Update src/3rdparty/webkit from trunk.

Imported from 839d8709327f925aacb3b6362c06152594def97e
in branch qtwebkit-2.0 of repository
git://gitorious.org/+qtwebkit-developers/webkit/qtwebkit.git

Rubber-stamped-by: Simon Hausmann

3624 files changed, 317257 insertions, 151389 deletions

diff --git a/src/3rdparty/webkit/.gitattributes b/src/3rdparty/webkit/.gitattributes
deleted file mode 100644
index 5b43bd02a0..0000000000
--- a/src/3rdparty/webkit/.gitattributes
+++ /dev/null
@@ -1,4 +0,0 @@
-# To enable automatic merging of ChangeLog files, use the following command:
-# git config merge.changelog.driver "resolve-ChangeLogs --merge-driver %O %A %B"
-ChangeLog* merge=changelog
-
diff --git a/src/3rdparty/webkit/.gitignore b/src/3rdparty/webkit/.gitignore
deleted file mode 100644
index b9595b321d..0000000000
--- a/src/3rdparty/webkit/.gitignore
+++ /dev/null
@@ -1,6 +0,0 @@
-*.mode*
-*.pbxuser
-*.perspective*
-*.pyc
-build/
-/WebKitBuild/
diff --git a/src/3rdparty/webkit/.tag b/src/3rdparty/webkit/.tag
new file mode 100644
index 0000000000..12573f4741
--- /dev/null
+++ b/src/3rdparty/webkit/.tag
@@ -0,0 +1 @@
+839d8709327f925aacb3b6362c06152594def97e
diff --git a/src/3rdparty/webkit/ChangeLog b/src/3rdparty/webkit/ChangeLog
index 57cb0dec16..001dddb8bb 100644
--- a/src/3rdparty/webkit/ChangeLog
+++ b/src/3rdparty/webkit/ChangeLog
@@ -1,3 +1,293 @@
+2010-03-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Build JavaScriptCore as a static library.
+        https://bugs.webkit.org/show_bug.cgi?id=36590
+
+        This patch takes what was left of the unused JavaScriptCore.pro
+        and moved the compilation logic from JavaScriptCore.pri to
+        JavaScriptCore.pro.
+
+        * WebKit.pro:
+
+2010-03-16  Xan Lopez  <xlopez@igalia.com>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Update library version for 1.1.90 release.
+
+        * configure.ac:
+
+2010-03-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump version for 1.1.90 release.
+
+        * configure.ac:
+
+2010-03-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Add support for Fast Mobile Scrolling in the build system.
+
+        * configure.ac:
+
+2010-03-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Add WebKitTools/TestResultServer/index.yaml to gitattributes to ignore for crlf conversion.
+
+        * .gitattributes:
+
+2010-03-12  Scott Byer  <scottbyer@chromium.org>
+
+        Reviewed by David Levin.
+
+        Popup font size needs to be exposed to clients.
+        https://bugs.webkit.org/show_bug.cgi?id=35990
+
+        Add function to expose the popup menu font size, add a field to
+        WebPopupMenuInfo that receives that information to convey that to
+        the web view client's createPopupMenu() call.
+
+        * WebCore/platform/chromium/PopupMenuChromium.cpp:
+        * WebCore/platform/chromium/PopupMenuChromium.h:
+        * WebKit/chromium/public/WebPopupMenuInfo.h:
+        * WebKit/chromium/src/ChromeClientImpl.cpp:
+
+2010-03-11  Adam Roben  <aroben@apple.com>
+
+        Teach git about ObjC files
+
+        Fixes <http://webkit.org/b/36015>.
+
+        Reviewed by Tim Hatcher.
+
+        * .gitattributes: Set the diff attribute for .m and .mm files, and .h
+        files in Mac-specific directories. This can be used to generate
+        more-readable diffs of ObjC files.
+
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Versioning for 1.1.23.
+
+        * configure.ac:
+
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed distcheck fix.
+
+        * GNUmakefile.am:
+
+2010-03-08  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Blob.slice support.
+        https://bugs.webkit.org/show_bug.cgi?id=32993
+
+        Add ENABLE_BLOB_SLICE feature define.
+
+        * configure.ac:
+
+2010-03-04  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35726
+        Remove orphaned #ifdef WTF_USE_GLIB_ICU_UNICODE_HYBRID
+
+        Removing orphaned #if USE.
+
+        * GNUmakefile.am:
+
+2010-03-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make the OUTPUT_DIR variable in qmake projects independent of build-webkit's logic.
+
+        This also allows shadow builds relying only on qmake to work properly.
+
+        * WebKit.pri:
+
+2010-03-03  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Xan Lopez.
+
+        Miscellaneous little fixes for the windows build of webkit-gtk
+        https://bugs.webkit.org/show_bug.cgi?id=35640
+
+        * GNUmakefile.am: On Windows with GCC, presence of
+        __declspec(dllexport) on some symbols disables the autoexport/autoimport
+        feature for all others. Using regex here assures that all symbols that 
+        need to be exported in the dll are actually exported.
+
+2010-03-02  Arno Renevier  <arno@renevier.net>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] implements ChromeClient::requestGeolocationPermissionForFrame
+        https://bugs.webkit.org/show_bug.cgi?id=35210
+
+        * GNUmakefile.am:
+
+2010-03-02  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Ignore compiled Java test cases in .gitignore.
+        https://bugs.webkit.org/show_bug.cgi?id=35559
+
+        * .gitignore:
+
+2010-02-26  Arno Renevier  <arno@renevier.net>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] ignore WebKit/gtk/docs/GNUmakefile.in in .gitignore
+        https://bugs.webkit.org/show_bug.cgi?id=35424
+
+        * .gitignore:
+
+2010-02-24  Sam Kerner  <skerner@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Expose WebFrame::setCanHaveScrollbars().  This allows a view
+        which is being resized to not need scroll bars to ensure that
+        they are not drawn.
+
+        Existing function setAllowsScrolling() was renamed
+        setCanHaveScrollbars(), to be consistant with change 37159:
+        http://trac.webkit.org/changeset/37159
+
+        https://bugs.webkit.org/show_bug.cgi?id=35257
+
+        * WebKit/chromium/public/WebFrame.h:
+        * WebKit/chromium/src/ChromeClientImpl.cpp:
+        * WebKit/chromium/src/WebFrameImpl.cpp:
+        * WebKit/chromium/src/WebFrameImpl.h:
+
+2010-02-19  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove QGVLauncher
+
+        https://bugs.webkit.org/show_bug.cgi?id=35292
+
+        * WebKit.pro:
+
+2010-02-24  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Enable SharedWorkers by default, since that's been the default for
+        a long time in our build-webkit configuration.
+
+        * configure.ac:
+
+2010-02-23  James Choi  <jchoi42@pha.jhu.edu>
+
+        Add Solaris definitions
+        https://bugs.webkit.org/show_bug.cgi?id=35214
+
+        * WebKit/chromium/src/WebViewImpl.cpp
+        * WebKit/chromium/src/WebFrameImpl.cpp
+
+2010-02-23  Arno Renevier  <arno@renevier.net>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk]: testwebview does not work when called with absolute path
+        https://bugs.webkit.org/show_bug.cgi?id=34940
+
+        When testwebview is called as absolute path, chdir to executable
+        directory before searching resource files.
+
+        * GNUmakefile.am:
+
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Changes references of GOwnPtr to reflect their new place.
+        http://webkit.org/b/35084
+
+        * JavaScriptCore/JavaScriptCore.gypi:
+        * JavaScriptCore/wtf/Threading.h:
+        * JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h:
+
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Fixes references to GOwnPtr and GRefPtr so the GTK+ port builds
+        again.
+        http://webkit.org/b/35084
+
+        * GNUmakefile.am:
+
+2010-02-23  Diego Escalante Urrelo  <descalante@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [gtk] missing libsoup-2.4 package in gir generation
+        https://bugs.webkit.org/show_bug.cgi?id=35199
+
+        Include libsoup-2.4 package in gobject introspection .gir generation.
+
+        * GNUmakefile.am:
+
+2010-02-22  Huahui Wu  <hwu@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Add code that enables SquirrelFish Extreme (a.k.a JSCX, JSC JIT)
+        in Android. It's disabled by default, but is enabled when the 
+        enveronment variable ENABLE_JSC_JIT is set to true.
+        https://bugs.webkit.org/show_bug.cgi?id=34855
+
+        * Android.mk:
+
+2010-02-22  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump library versioning for 1.1.22 release.
+
+        * configure.ac:
+
+2010-02-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add support for layout tests on Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=31589
+
+        * WebKit.pro:
+
+2010-02-20  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] ENABLE_3D_RENDERING should be optional
+        https://bugs.webkit.org/show_bug.cgi?id=35100
+
+        * WebKit.pri: ENABLE_3D_RENDERING moved to a proper feature test
+
+2010-02-19  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by David Levin.
+
+        Add an ENABLE flag for sandboxed iframes to make it possible to disable it in releases
+        https://bugs.webkit.org/show_bug.cgi?id=35147
+
+        * configure.ac:
+
 2010-02-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Eric Seidel.
@@ -6,6 +296,571 @@
 
         * .gitattributes: Added.
 
+2010-02-17  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] GraphicsLayer: support perspective and 3D transforms
+        https://bugs.webkit.org/show_bug.cgi?id=34960
+
+        * WebKit.pri: added appropriate define: ENABLED_3D_RENDERING
+
+2010-02-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GStreamer] Should handle BUFFERING messages
+        https://bugs.webkit.org/show_bug.cgi?id=30004
+
+        * configure.ac: Bump gstreamer -core/-plugins-base requirements to
+        0.10.25 which is the minimum required version for on-disk buffering.
+
+2010-02-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump version to 1.1.22 so we can depend on it in applications.
+
+        * configure.ac:
+
+2010-02-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Removed WMLInputElement.* from .gitattributes as the file is
+        now CRLF clean.
+
+        * .gitattributes:
+
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make qtlauncher and qgvlauncher use the generated headers
+        path to make sure they are correctly generated.
+
+        * WebKit.pri:
+
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Manually add support for the install target on Symbian.
+
+        This is required to copy the headers over the ones in Qt.
+
+        * WebKit.pro:
+
+2010-02-11  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Detect properly different versions of libpng out there.
+
+        * configure.ac:
+
+2010-02-11  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix GTK+ build.
+
+        * configure.ac:
+
+2010-02-11  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        Adjust gstreamer-plugins-base minimum version check (from 0.10 to 0.10.23).
+
+        * configure.ac:
+
+2010-02-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Restore ENABLE_RUBY flag so vendors can ship with Ruby disabled if they choose.
+        https://bugs.webkit.org/show_bug.cgi?id=34698
+
+        * configure.ac:
+
+2010-02-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Bump version to 1.1.21, and adjust library versioning accordingly.
+
+        * configure.ac:
+
+2010-02-05  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        Add gstreamer-app-0.10 to configure.ac
+        https://bugs.webkit.org/show_bug.cgi?id=34317
+
+        * configure.ac:
+
+2010-02-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add .gitattributes file to tell git about files with Windows linefeeds
+        https://bugs.webkit.org/show_bug.cgi?id=34645
+
+        On Windows git defaults to "true" for core.autocrlf, meaning all text
+        files in the working directory are converted from CRLF to LF on checkin
+        time. Some files present in the repository have been checked in with
+        CRLF linefeeds and git should not try to convert them. The added
+        .gitattributes file tells git to not do any CRLF conversion.
+
+        * .gitattributes: Added.
+
+2010-02-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Generate convenience headers (QWebView, etc) using qmake
+
+        In Qt this is done using syncqt, but we use a pro-file instead
+        that generates makefile-rules for each of the extra headers.
+
+        These extra headers are installed alongside the normal headers.
+
+        * DerivedSources.pro: Include API-DerivedSources
+
+2010-02-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Lars Knoll.
+
+        [Qt] Make 'make -f Makefile.DerivedSources qmake' work
+
+        Previously this target ended up generating a file named
+        Makefile.DerivedSources.DerivedSources, and so on.
+
+        * DerivedSources.pro:
+
+2010-02-04  Christian Dywan  <christian@twotasts.de>
+
+        Reviewed by Xan Lopez.
+
+        Require either libsoup 2.28.2 or 2.29.90.
+
+        * configure.ac:
+
+2010-02-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump minimum libsoup requirement to 2.29.90
+
+        * configure.ac:
+
+2010-02-02  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Bump version, and adjust library versioning for 1.1.20.
+
+        * configure.ac:
+
+2010-01-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        A first step towards the Indexed Database API
+        https://bugs.webkit.org/show_bug.cgi?id=34342
+
+        Add Indexed Database API
+
+        * configure.ac:
+
+2010-01-27  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Don't build the tests in packages, only the launcher(s)
+
+        * WebKit.pro:
+
+2010-01-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Add the "d" suffix to QtWebKit's dll on Windows.
+
+        * WebKit.pri:
+
+2010-01-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Unreviewed build fix
+
+        [Qt] Build fix for windows when QTDIR contains release libraries.
+
+        * WebKit.pri: Use the <name>.lib syntax for linking instead of qmake's -l<name> emulation
+
+2010-01-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        First steps of the QtScript API.
+        
+        Two new classes were created; QScriptEngine and QScriptValue.
+        The first should encapsulate a javascript context and the second a script
+        value.
+        
+        This API is still in development, so it isn't compiled by default.
+        To trigger compilation, pass --qmakearg="CONFIG+=build-qtscript" to
+        build-webkit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32565
+
+        * WebKit.pro:
+
+2010-01-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix the build on Maemo5.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34051
+
+        * WebKit.pri: Disable the use of uitools, just like it's done for Symbian.
+
+2010-01-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Implement GraphicsLayer for accelerated layer compositing
+        https://bugs.webkit.org/show_bug.cgi?id=33514
+
+        * WebKit.pri: Addded compile flags to enable accelerated compositing
+        on versions higher than 4.5
+
+2010-01-20  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make DumpRenderTree build on Windows
+
+        * WebKit.pro:
+
+2010-01-20  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix the recursive generated_files target to work with qmake -r -o
+
+        * DerivedSources.pro:
+
+2010-01-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make it possible (on *nix at least) to recursively call "make generated_files"
+
+        * DerivedSources.pro:
+
+2010-01-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed. Shared library versioning update for 1.1.19.
+
+        * configure.ac:
+
+2010-01-15  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Rubber-stamped by Xan Lopez.
+
+        Bump version to 1.1.19.
+
+        * configure.ac:
+
+2010-01-14  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Defective dependencies caused build failing on QtBuildBot.
+        https://bugs.webkit.org/show_bug.cgi?id=33693
+
+        * WebKit.pri: CONFIG += depend_includepath added.
+
+2010-01-14  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Moves general includes before bindings includes in Android build system.
+        https://bugs.webkit.org/show_bug.cgi?id=33623
+
+        This avoids problems with collisions between WebCore/platform/text/StringBuilder.h
+        and the new JavaScriptCore/runtime/StringBuilder.h. This change puts
+        JavaScriptCore/runtime and other bindings includes after the WebCore and other
+        general includes, so that the WebCore StringBuilder.h is picked up when building
+        WebCore.
+
+        * Android.mk: Modified.
+
+2010-01-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Split the build process in two different .pro files.
+        This allows qmake to be run once all source files are available.
+
+        * DerivedSources.pro: Added.
+        * WebKit.pri:
+
+2010-01-07  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32987
+
+        Added ENABLE_XHTMLMP flag. Disabled by default.
+
+        * configure.ac:
+
+2010-01-05  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Based on idea and original patch by Evan Martin.
+
+        Remove libWebCore intermediate library, to improve link time.
+
+        [GTK] Build time must be reduced
+        https://bugs.webkit.org/show_bug.cgi?id=32921
+
+        * GNUmakefile.am:
+
+2010-01-05  Xan Lopez  <xlopez@igalia.com>
+
+        Bump for 1.1.18 release.
+
+        * configure.ac:
+
+2010-01-04  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Fix JSCore-1.0.gir path to fix make distcheck.
+
+        * GNUmakefile.am:
+
+2010-01-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix standalone package builds.
+
+        * WebKit.pri: Add logic for detecting standalone builds. Set OUTPUT_DIR to the top-level dir in that case.
+        * WebKit.pro: Don't build JSC and DRT for package builds.
+
+2010-01-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool should not require users to install mechanize
+        https://bugs.webkit.org/show_bug.cgi?id=32635
+
+        * .gitignore: Ignore autoinstall.cache.d directory created by autoinstall.py
+
+2009-12-28  Estêvão Samuel Procópio  <tevaum@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Bug 32940: [GTK] Changing the download throttle conditions.
+        https://bugs.webkit.org/show_bug.cgi?id=32716
+
+        The WebKitDownload progress notification was taking long to
+        update. This fix makes notification happens each 0.7 secs
+        or when the progress ups in 1%.
+
+        * WebKit/gtk/webkit/webkitdownload.cpp:
+
+2009-12-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Holger Freyther.
+
+        Adjusted path to QtLauncher.
+
+        * WebKit.pro:
+
+2009-12-19  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Add a couple of WebKitGtk files to .gitignore.
+
+        * .gitignore:
+
+2009-12-18  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] RemoveDashboard support. It's useless.
+
+        * configure.ac:
+
+2009-12-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Clean up the qmake build system to distinguish between trunk builds and package builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=32716
+
+        * WebKit.pri: Use standalone_package instead of QTDIR_build
+
+2009-12-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Build fixes for make distcheck.
+
+        * GNUmakefile.am:
+
+2009-12-16  Dan Winship  <danw@gnome.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Content-Encoding support
+
+        https://bugs.webkit.org/show_bug.cgi?id=522772
+
+        * configure.ac: require libsoup 2.28.2 for SoupContentDecoder
+
+2009-12-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        string-base64 test does not compute a valid base64 string
+        http://bugs.webkit.org/show_bug.cgi?id=16806
+
+        * tests/string-base64.js: change str[i] to str.charCodeAt(i)
+
+2009-12-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Should provide an API to control the IconDatabase
+        https://bugs.webkit.org/show_bug.cgi?id=32334
+
+        Add test to make sure favicon reporting works.
+
+        * GNUmakefile.am:
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds Android Makefiles for building with V8.
+        https://bugs.webkit.org/show_bug.cgi?id=32278
+
+        * Android.mk: Modified. Includes Makefiles for V8.
+
+2009-12-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Adds Makefiles for Android port.
+        https://bugs.webkit.org/show_bug.cgi?id=31325
+
+        * Android.mk: Added.
+
+2009-12-08  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Xan Lopez.
+
+        * configure.ac: Require only libSoup 2.27.91 but check for 2.29.3
+        and define HAVE_LIBSOUP_2_29_3 in that case.
+
+2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Late post-release version bump.
+
+        * configure.ac:
+
+2009-12-08  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Create a TextBreakIterator implementation based on GLib (without ICU)
+        https://bugs.webkit.org/show_bug.cgi?id=31469
+
+        Removing hybrid configuration for --with-unicode-backend=glib
+        ICU not required anymore.
+
+        * autotools/webkit.m4:
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Gtk.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * configure.ac:
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * configure.ac:
+
+2009-12-06  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Build the new API test.
+
+        [GTK] REGRESSION: webkit thinks it can render PDFs
+        https://bugs.webkit.org/show_bug.cgi?id=32183
+
+        * GNUmakefile.am:
+
+2009-12-05  Vincent Untz <vuntz@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Fixes race for builds with introspection enabled, and parallel
+        make.
+
+        * GNUmakefile.am:
+
+2009-12-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK]Enable DNS prefetching
+        https://bugs.webkit.org/show_bug.cgi?id=23846
+
+        Bump libsoup required version to 2.29.3 for DNS prefetching.
+
+        * configure.ac:
+
+2009-11-30  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Make sure we distribute and install GObject Introspection files.
+
+        * GNUmakefile.am:
+
+2009-11-30  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Build fix. Make sure JSCore-1.0.gir is added to the distributed
+        tarball.
+
+        * GNUmakefile.am:
+
+2009-11-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump versions for 1.1.17 release.
+
+        * configure.ac:
+
 2009-11-30  Jan-Arve Sæther  <jan-arve.saether@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -16,6 +871,110 @@
 
         * WebKit.pri:
 
+2009-11-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        * GNUmakefile.am: Add JavaScriptCore/wtf/gtk to 
+          the include path.
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * configure.ac:
+
+2009-11-24  Jason Smith  <dark.panda@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        RegExp#exec's returned Array-like object behaves differently from
+        regular Arrays
+        https://bugs.webkit.org/show_bug.cgi?id=31689
+
+        * LayoutTests/fast/js/regexp-in-and-foreach-handling.html: Added.
+        * LayoutTests/fast/js/script-tests/regexp-in-and-foreach-handling.js: Added.
+        * LayoutTests/fast/js/regexp-in-and-foreach-handling-expected.txt: Added.
+
+2009-11-24  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by David Levin.
+
+        Ignore Chromium's Xcode projects that are auto-generated from .gyp files.
+        https://bugs.webkit.org/show_bug.cgi?id=31847
+        
+        * .gitignore:  Add three .xcodeproj files.
+
+2009-11-09  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Gtk] Build from tarball fails with --enable-introspection
+        https://bugs.webkit.org/show_bug.cgi?id=31261
+
+        We need to enable gobject-introspection during distcheck otherwise
+        some of the required files are missing in tarball.
+
+        * GNUmakefile.am:
+
+2009-11-05  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Jan Alonzo.
+
+        [Gtk] Build failure with --enable-introspection
+        https://bugs.webkit.org/show_bug.cgi?id=31102
+
+        Add search and include paths for JSCore-1.0.gir required by
+        gobject-introspection tools.
+
+        * GNUmakefile.am:
+
+2009-11-04  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Update Cairo requirement to 1.6.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=19266
+
+        * configure.ac:
+
+2009-11-02  Estêvão Samuel Procópio  <tevaum@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [Build] make install ignores --prefix option for gobject-introspection.
+        https://bugs.webkit.org/show_bug.cgi?id=31025
+
+        Make the build system use the --prefix path also when installing
+        gobject-introspection files.
+
+        * configure.ac: use --prefix path in GITDIR and GIRTYPELIBDIR
+
+2009-11-02  Xan Lopez  <xlopez@igalia.com>
+
+        Bump version before release (or post-release, depending on your
+        point of view) so that we can make applications depending on
+        unreleased APIs in WebKit svn fail at configure time when the
+        requirements are not met.
+
+        * configure.ac:
+
+2009-11-01  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Turn on warnings for QtWebKit for gcc
+        https://bugs.webkit.org/show_bug.cgi?id=30958
+
+        * WebKit.pri: Turn on warnings for the GCC compiler
+
 2009-10-30  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Mark Rowe.
@@ -30,6 +989,19 @@
 
         * .gitignore: Added.
 
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        No new tests (no functional change).
+
+        * configure.ac:
+
 2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
 
         Rubber-stamped by Darin Adler.
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
index b9167a80ef..ba00d02e10 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
@@ -29,7 +29,6 @@
 #include "JSAPIValueWrapper.h"
 #include "JSGlobalObject.h"
 #include "JSValue.h"
-#include <wtf/Platform.h>
 #include <wtf/UnusedParam.h>
 
 namespace JSC {
@@ -51,16 +50,20 @@ typedef struct OpaqueJSValue* JSObjectRef;
 
 inline JSC::ExecState* toJS(JSContextRef c)
 {
+    ASSERT(c);
     return reinterpret_cast<JSC::ExecState*>(const_cast<OpaqueJSContext*>(c));
 }
 
 inline JSC::ExecState* toJS(JSGlobalContextRef c)
 {
+    ASSERT(c);
     return reinterpret_cast<JSC::ExecState*>(c);
 }
 
-inline JSC::JSValue toJS(JSC::ExecState*, JSValueRef v)
+inline JSC::JSValue toJS(JSC::ExecState* exec, JSValueRef v)
 {
+    ASSERT_UNUSED(exec, exec);
+    ASSERT(v);
 #if USE(JSVALUE32_64)
     JSC::JSCell* jsCell = reinterpret_cast<JSC::JSCell*>(const_cast<OpaqueJSValue*>(v));
     if (!jsCell)
@@ -73,6 +76,20 @@ inline JSC::JSValue toJS(JSC::ExecState*, JSValueRef v)
 #endif
 }
 
+inline JSC::JSValue toJSForGC(JSC::ExecState* exec, JSValueRef v)
+{
+    ASSERT_UNUSED(exec, exec);
+    ASSERT(v);
+#if USE(JSVALUE32_64)
+    JSC::JSCell* jsCell = reinterpret_cast<JSC::JSCell*>(const_cast<OpaqueJSValue*>(v));
+    if (!jsCell)
+        return JSC::JSValue();
+    return jsCell;
+#else
+    return JSC::JSValue::decode(reinterpret_cast<JSC::EncodedJSValue>(const_cast<OpaqueJSValue*>(v)));
+#endif
+}
+
 inline JSC::JSObject* toJS(JSObjectRef o)
 {
     return reinterpret_cast<JSC::JSObject*>(o);
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/APIShims.h b/src/3rdparty/webkit/JavaScriptCore/API/APIShims.h
new file mode 100644
index 0000000000..9a6cacbdb9
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/API/APIShims.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef APIShims_h
+#define APIShims_h
+
+#include "CallFrame.h"
+#include "JSLock.h"
+
+namespace JSC {
+
+class APIEntryShimWithoutLock {
+protected:
+    APIEntryShimWithoutLock(JSGlobalData* globalData, bool registerThread)
+        : m_globalData(globalData)
+        , m_entryIdentifierTable(setCurrentIdentifierTable(globalData->identifierTable))
+    {
+        if (registerThread)
+            globalData->heap.registerThread();
+        m_globalData->timeoutChecker.start();
+    }
+
+    ~APIEntryShimWithoutLock()
+    {
+        m_globalData->timeoutChecker.stop();
+        setCurrentIdentifierTable(m_entryIdentifierTable);
+    }
+
+private:
+    JSGlobalData* m_globalData;
+    IdentifierTable* m_entryIdentifierTable;
+};
+
+class APIEntryShim : public APIEntryShimWithoutLock {
+public:
+    // Normal API entry
+    APIEntryShim(ExecState* exec, bool registerThread = true)
+        : APIEntryShimWithoutLock(&exec->globalData(), registerThread)
+        , m_lock(exec)
+    {
+    }
+
+    // JSPropertyNameAccumulator only has a globalData.
+    APIEntryShim(JSGlobalData* globalData, bool registerThread = true)
+        : APIEntryShimWithoutLock(globalData, registerThread)
+        , m_lock(globalData->isSharedInstance ? LockForReal : SilenceAssertionsOnly)
+    {
+    }
+
+private:
+    JSLock m_lock;
+};
+
+class APICallbackShim {
+public:
+    APICallbackShim(ExecState* exec)
+        : m_dropAllLocks(exec)
+        , m_globalData(&exec->globalData())
+    {
+        resetCurrentIdentifierTable();
+    }
+
+    ~APICallbackShim()
+    {
+        setCurrentIdentifierTable(m_globalData->identifierTable);
+    }
+
+private:
+    JSLock::DropAllLocks m_dropAllLocks;
+    JSGlobalData* m_globalData;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp
index 4a32d35bff..ebfeafa820 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp
@@ -28,6 +28,7 @@
 #include "JSBasePrivate.h"
 
 #include "APICast.h"
+#include "APIShims.h"
 #include "Completion.h"
 #include "OpaqueJSString.h"
 #include "SourceCode.h"
@@ -43,8 +44,7 @@ using namespace JSC;
 JSValueRef JSEvaluateScript(JSContextRef ctx, JSStringRef script, JSObjectRef thisObject, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsThisObject = toJS(thisObject);
 
@@ -69,8 +69,7 @@ JSValueRef JSEvaluateScript(JSContextRef ctx, JSStringRef script, JSObjectRef th
 bool JSCheckScriptSyntax(JSContextRef ctx, JSStringRef script, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     SourceCode source = makeSource(script->ustring(), sourceURL->ustring(), startingLineNumber);
     Completion completion = checkSyntax(exec->dynamicGlobalObject()->globalExec(), source);
@@ -94,12 +93,11 @@ void JSGarbageCollect(JSContextRef ctx)
         return;
 
     ExecState* exec = toJS(ctx);
-    JSGlobalData& globalData = exec->globalData();
-
-    JSLock lock(globalData.isSharedInstance ? LockForReal : SilenceAssertionsOnly);
+    APIEntryShim entryShim(exec, false);
 
+    JSGlobalData& globalData = exec->globalData();
     if (!globalData.heap.isBusy())
-        globalData.heap.collect();
+        globalData.heap.collectAllGarbage();
 
     // FIXME: Perhaps we should trigger a second mark and sweep
     // once the garbage collector is done if this is called when
@@ -109,8 +107,6 @@ void JSGarbageCollect(JSContextRef ctx)
 void JSReportExtraMemoryCost(JSContextRef ctx, size_t size)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
-
+    APIEntryShim entryShim(exec);
     exec->globalData().heap.reportExtraMemoryCost(size);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
index d1ce9b364c..2e16720ceb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
@@ -65,27 +65,15 @@ typedef struct OpaqueJSValue* JSObjectRef;
 /* JavaScript symbol exports */
 
 #undef JS_EXPORT
-#if defined(BUILDING_WX__)
+#if defined(JS_NO_EXPORT)
     #define JS_EXPORT
 #elif defined(__GNUC__) && !defined(__CC_ARM) && !defined(__ARMCC__)
     #define JS_EXPORT __attribute__((visibility("default")))
-#elif defined(_WIN32_WCE)
-    #if defined(JS_BUILDING_JS)
-        #define JS_EXPORT __declspec(dllexport)
-    #elif defined(JS_IMPORT_JS)
-        #define JS_EXPORT __declspec(dllimport)
-    #else
-        #define JS_EXPORT
-    #endif
-#elif defined(WIN32) || defined(_WIN32)
-    /*
-     * TODO: Export symbols with JS_EXPORT when using MSVC.
-     * See http://bugs.webkit.org/show_bug.cgi?id=16227
-     */
+#elif defined(WIN32) || defined(_WIN32) || defined(_WIN32_WCE)
     #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
-    #define JS_EXPORT __declspec(dllexport)
+        #define JS_EXPORT __declspec(dllexport)
     #else
-    #define JS_EXPORT __declspec(dllimport)
+        #define JS_EXPORT __declspec(dllimport)
     #endif
 #else
     #define JS_EXPORT
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp
index 1c33962729..9c5f6d73e6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "JSCallbackConstructor.h"
 
+#include "APIShims.h"
 #include "APICast.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/JSLock.h>
@@ -66,7 +67,7 @@ static JSObject* constructJSCallback(ExecState* exec, JSObject* constructor, con
         JSValueRef exception = 0;
         JSObjectRef result;
         {
-            JSLock::DropAllLocks dropAllLocks(exec);
+            APICallbackShim callbackShim(exec);
             result = callback(ctx, constructorRef, argumentCount, arguments.data(), &exception);
         }
         if (exception)
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
index c4bd7ad3c8..e52994724e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
@@ -41,7 +41,7 @@ public:
     
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
 
 protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
index b7dd76858e..63c8add854 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
@@ -24,9 +24,9 @@
  */
 
 #include "config.h"
-#include <wtf/Platform.h>
 #include "JSCallbackFunction.h"
 
+#include "APIShims.h"
 #include "APICast.h"
 #include "CodeBlock.h"
 #include "JSFunction.h"
@@ -61,7 +61,7 @@ JSValue JSCallbackFunction::call(ExecState* exec, JSObject* functionObject, JSVa
     JSValueRef exception = 0;
     JSValueRef result;
     {
-        JSLock::DropAllLocks dropAllLocks(exec);
+        APICallbackShim callbackShim(exec);
         result = static_cast<JSCallbackFunction*>(functionObject)->m_callback(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception);
     }
     if (exception)
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
index 0cf25c4362..10dae6b73f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
@@ -41,7 +41,7 @@ public:
     // refactor the code so this override isn't necessary
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
 
 private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
index d19890a884..1cf7a02b25 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
@@ -33,6 +33,84 @@
 
 namespace JSC {
 
+struct JSCallbackObjectData {
+    JSCallbackObjectData(void* privateData, JSClassRef jsClass)
+        : privateData(privateData)
+        , jsClass(jsClass)
+    {
+        JSClassRetain(jsClass);
+    }
+    
+    ~JSCallbackObjectData()
+    {
+        JSClassRelease(jsClass);
+    }
+    
+    JSValue getPrivateProperty(const Identifier& propertyName) const
+    {
+        if (!m_privateProperties)
+            return JSValue();
+        return m_privateProperties->getPrivateProperty(propertyName);
+    }
+    
+    void setPrivateProperty(const Identifier& propertyName, JSValue value)
+    {
+        if (!m_privateProperties)
+            m_privateProperties.set(new JSPrivatePropertyMap);
+        m_privateProperties->setPrivateProperty(propertyName, value);
+    }
+    
+    void deletePrivateProperty(const Identifier& propertyName)
+    {
+        if (!m_privateProperties)
+            return;
+        m_privateProperties->deletePrivateProperty(propertyName);
+    }
+
+    void markChildren(MarkStack& markStack)
+    {
+        if (!m_privateProperties)
+            return;
+        m_privateProperties->markChildren(markStack);
+    }
+
+    void* privateData;
+    JSClassRef jsClass;
+    struct JSPrivatePropertyMap {
+        JSValue getPrivateProperty(const Identifier& propertyName) const
+        {
+            PrivatePropertyMap::const_iterator location = m_propertyMap.find(propertyName.ustring().rep());
+            if (location == m_propertyMap.end())
+                return JSValue();
+            return location->second;
+        }
+        
+        void setPrivateProperty(const Identifier& propertyName, JSValue value)
+        {
+            m_propertyMap.set(propertyName.ustring().rep(), value);
+        }
+        
+        void deletePrivateProperty(const Identifier& propertyName)
+        {
+            m_propertyMap.remove(propertyName.ustring().rep());
+        }
+
+        void markChildren(MarkStack& markStack)
+        {
+            for (PrivatePropertyMap::iterator ptr = m_propertyMap.begin(); ptr != m_propertyMap.end(); ++ptr) {
+                if (ptr->second)
+                    markStack.append(ptr->second);
+            }
+        }
+
+    private:
+        typedef HashMap<RefPtr<UString::Rep>, JSValue, IdentifierRepHash> PrivatePropertyMap;
+        PrivatePropertyMap m_propertyMap;
+    };
+    OwnPtr<JSPrivatePropertyMap> m_privateProperties;
+};
+
+    
 template <class Base>
 class JSCallbackObject : public Base {
 public:
@@ -50,7 +128,22 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), Base::AnonymousSlotCount); 
+    }
+    
+    JSValue getPrivateProperty(const Identifier& propertyName) const
+    {
+        return m_callbackObjectData->getPrivateProperty(propertyName);
+    }
+    
+    void setPrivateProperty(const Identifier& propertyName, JSValue value)
+    {
+        m_callbackObjectData->setPrivateProperty(propertyName, value);
+    }
+    
+    void deletePrivateProperty(const Identifier& propertyName)
+    {
+        m_callbackObjectData->deletePrivateProperty(propertyName);
     }
 
 protected:
@@ -61,6 +154,7 @@ private:
 
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     
     virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
 
@@ -69,7 +163,7 @@ private:
 
     virtual bool hasInstance(ExecState* exec, JSValue value, JSValue proto);
 
-    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
     virtual double toNumber(ExecState*) const;
     virtual UString toString(ExecState*) const;
@@ -78,6 +172,12 @@ private:
     virtual CallType getCallData(CallData&);
     virtual const ClassInfo* classInfo() const { return &info; }
 
+    virtual void markChildren(MarkStack& markStack)
+    {
+        Base::markChildren(markStack);
+        m_callbackObjectData->markChildren(markStack);
+    }
+
     void init(ExecState*);
  
     static JSCallbackObject* asCallbackObject(JSValue);
@@ -85,27 +185,10 @@ private:
     static JSValue JSC_HOST_CALL call(ExecState*, JSObject* functionObject, JSValue thisValue, const ArgList&);
     static JSObject* construct(ExecState*, JSObject* constructor, const ArgList&);
    
-    static JSValue staticValueGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue staticFunctionGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue callbackGetter(ExecState*, const Identifier&, const PropertySlot&);
-
-    struct JSCallbackObjectData {
-        JSCallbackObjectData(void* privateData, JSClassRef jsClass)
-            : privateData(privateData)
-            , jsClass(jsClass)
-        {
-            JSClassRetain(jsClass);
-        }
-        
-        ~JSCallbackObjectData()
-        {
-            JSClassRelease(jsClass);
-        }
-        
-        void* privateData;
-        JSClassRef jsClass;
-    };
-    
+    static JSValue staticValueGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue staticFunctionGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue callbackGetter(ExecState*, JSValue, const Identifier&);
+
     OwnPtr<JSCallbackObjectData> m_callbackObjectData;
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
index 9b726e8a03..6c83eb4e7e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
@@ -24,6 +24,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "APIShims.h"
 #include "APICast.h"
 #include "Error.h"
 #include "JSCallbackFunction.h"
@@ -79,7 +80,7 @@ void JSCallbackObject<Base>::init(ExecState* exec)
     
     // initialize from base to derived
     for (int i = static_cast<int>(initRoutines.size()) - 1; i >= 0; i--) {
-        JSLock::DropAllLocks dropAllLocks(exec);
+        APICallbackShim callbackShim(exec);
         JSObjectInitializeCallback initialize = initRoutines[i];
         initialize(toRef(exec), toRef(this));
     }
@@ -117,7 +118,7 @@ bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, const Identifie
         if (JSObjectHasPropertyCallback hasProperty = jsClass->hasProperty) {
             if (!propertyNameRef)
                 propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-            JSLock::DropAllLocks dropAllLocks(exec);
+            APICallbackShim callbackShim(exec);
             if (hasProperty(ctx, thisRef, propertyNameRef.get())) {
                 slot.setCustom(this, callbackGetter);
                 return true;
@@ -128,18 +129,18 @@ bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, const Identifie
             JSValueRef exception = 0;
             JSValueRef value;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 value = getProperty(ctx, thisRef, propertyNameRef.get(), &exception);
             }
-            exec->setException(toJS(exec, exception));
-            if (value) {
-                slot.setValue(toJS(exec, value));
-                return true;
-            }
             if (exception) {
+                exec->setException(toJS(exec, exception));
                 slot.setValue(jsUndefined());
                 return true;
             }
+            if (value) {
+                slot.setValue(toJS(exec, value));
+                return true;
+            }
         }
         
         if (OpaqueJSClassStaticValuesTable* staticValues = jsClass->staticValues(exec)) {
@@ -167,6 +168,25 @@ bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, unsigned proper
 }
 
 template <class Base>
+bool JSCallbackObject<Base>::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    PropertySlot slot;
+    if (getOwnPropertySlot(exec, propertyName, slot)) {
+        // Ideally we should return an access descriptor, but returning a value descriptor is better than nothing.
+        JSValue value = slot.getValue(exec, propertyName);
+        if (!exec->hadException())
+            descriptor.setValue(value);
+        // We don't know whether the property is configurable, but assume it is.
+        descriptor.setConfigurable(true);
+        // We don't know whether the property is enumerable (we could call getOwnPropertyNames() to find out), but assume it isn't.
+        descriptor.setEnumerable(false);
+        return true;
+    }
+
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+template <class Base>
 void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     JSContextRef ctx = toRef(exec);
@@ -181,10 +201,11 @@ void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName
             JSValueRef exception = 0;
             bool result;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             if (result || exception)
                 return;
         }
@@ -199,10 +220,11 @@ void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName
                     JSValueRef exception = 0;
                     bool result;
                     {
-                        JSLock::DropAllLocks dropAllLocks(exec);
+                        APICallbackShim callbackShim(exec);
                         result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
                     }
-                    exec->setException(toJS(exec, exception));
+                    if (exception)
+                        exec->setException(toJS(exec, exception));
                     if (result || exception)
                         return;
                 } else
@@ -237,10 +259,11 @@ bool JSCallbackObject<Base>::deleteProperty(ExecState* exec, const Identifier& p
             JSValueRef exception = 0;
             bool result;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 result = deleteProperty(ctx, thisRef, propertyNameRef.get(), &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             if (result || exception)
                 return true;
         }
@@ -298,10 +321,11 @@ JSObject* JSCallbackObject<Base>::construct(ExecState* exec, JSObject* construct
             JSValueRef exception = 0;
             JSObject* result;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 result = toJS(callAsConstructor(execRef, constructorRef, argumentCount, arguments.data(), &exception));
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             return result;
         }
     }
@@ -322,10 +346,11 @@ bool JSCallbackObject<Base>::hasInstance(ExecState* exec, JSValue value, JSValue
             JSValueRef exception = 0;
             bool result;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 result = hasInstance(execRef, thisRef, valueRef, &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             return result;
         }
     }
@@ -360,10 +385,11 @@ JSValue JSCallbackObject<Base>::call(ExecState* exec, JSObject* functionObject,
             JSValueRef exception = 0;
             JSValue result;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 result = toJS(exec, callAsFunction(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception));
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             return result;
         }
     }
@@ -373,14 +399,14 @@ JSValue JSCallbackObject<Base>::call(ExecState* exec, JSObject* functionObject,
 }
 
 template <class Base>
-void JSCallbackObject<Base>::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSCallbackObject<Base>::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     JSContextRef execRef = toRef(exec);
     JSObjectRef thisRef = toRef(this);
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) {
         if (JSObjectGetPropertyNamesCallback getPropertyNames = jsClass->getPropertyNames) {
-            JSLock::DropAllLocks dropAllLocks(exec);
+            APICallbackShim callbackShim(exec);
             getPropertyNames(execRef, thisRef, toRef(&propertyNames));
         }
         
@@ -390,7 +416,7 @@ void JSCallbackObject<Base>::getOwnPropertyNames(ExecState* exec, PropertyNameAr
             for (iterator it = staticValues->begin(); it != end; ++it) {
                 UString::Rep* name = it->first.get();
                 StaticValueEntry* entry = it->second;
-                if (entry->getProperty && !(entry->attributes & kJSPropertyAttributeDontEnum))
+                if (entry->getProperty && (!(entry->attributes & kJSPropertyAttributeDontEnum) || (mode == IncludeDontEnumProperties)))
                     propertyNames.add(Identifier(exec, name));
             }
         }
@@ -401,13 +427,13 @@ void JSCallbackObject<Base>::getOwnPropertyNames(ExecState* exec, PropertyNameAr
             for (iterator it = staticFunctions->begin(); it != end; ++it) {
                 UString::Rep* name = it->first.get();
                 StaticFunctionEntry* entry = it->second;
-                if (!(entry->attributes & kJSPropertyAttributeDontEnum))
+                if (!(entry->attributes & kJSPropertyAttributeDontEnum) || (mode == IncludeDontEnumProperties))
                     propertyNames.add(Identifier(exec, name));
             }
         }
     }
     
-    Base::getOwnPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 template <class Base>
@@ -426,7 +452,7 @@ double JSCallbackObject<Base>::toNumber(ExecState* exec) const
             JSValueRef exception = 0;
             JSValueRef value;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 value = convertToType(ctx, thisRef, kJSTypeNumber, &exception);
             }
             if (exception) {
@@ -435,7 +461,8 @@ double JSCallbackObject<Base>::toNumber(ExecState* exec) const
             }
 
             double dValue;
-            return toJS(exec, value).getNumber(dValue) ? dValue : NaN;
+            if (value)
+                return toJS(exec, value).getNumber(dValue) ? dValue : NaN;
         }
             
     return Base::toNumber(exec);
@@ -452,14 +479,15 @@ UString JSCallbackObject<Base>::toString(ExecState* exec) const
             JSValueRef exception = 0;
             JSValueRef value;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 value = convertToType(ctx, thisRef, kJSTypeString, &exception);
             }
             if (exception) {
                 exec->setException(toJS(exec, exception));
                 return "";
             }
-            return toJS(exec, value).getString();
+            if (value)
+                return toJS(exec, value).getString(exec);
         }
             
     return Base::toString(exec);
@@ -488,9 +516,9 @@ bool JSCallbackObject<Base>::inherits(JSClassRef c) const
 }
 
 template <class Base>
-JSValue JSCallbackObject<Base>::staticValueGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::staticValueGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
+    JSCallbackObject* thisObj = asCallbackObject(slotBase);
     
     JSObjectRef thisRef = toRef(thisObj);
     RefPtr<OpaqueJSString> propertyNameRef;
@@ -504,23 +532,24 @@ JSValue JSCallbackObject<Base>::staticValueGetter(ExecState* exec, const Identif
                     JSValueRef exception = 0;
                     JSValueRef value;
                     {
-                        JSLock::DropAllLocks dropAllLocks(exec);
+                        APICallbackShim callbackShim(exec);
                         value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
                     }
-                    exec->setException(toJS(exec, exception));
+                    if (exception) {
+                        exec->setException(toJS(exec, exception));
+                        return jsUndefined();
+                    }
                     if (value)
                         return toJS(exec, value);
-                    if (exception)
-                        return jsUndefined();
                 }
-                    
+
     return throwError(exec, ReferenceError, "Static value property defined with NULL getProperty callback.");
 }
 
 template <class Base>
-JSValue JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
+    JSCallbackObject* thisObj = asCallbackObject(slotBase);
     
     // Check for cached or override property.
     PropertySlot slot2(thisObj);
@@ -543,9 +572,9 @@ JSValue JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, const Iden
 }
 
 template <class Base>
-JSValue JSCallbackObject<Base>::callbackGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::callbackGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
+    JSCallbackObject* thisObj = asCallbackObject(slotBase);
     
     JSObjectRef thisRef = toRef(thisObj);
     RefPtr<OpaqueJSString> propertyNameRef;
@@ -557,14 +586,15 @@ JSValue JSCallbackObject<Base>::callbackGetter(ExecState* exec, const Identifier
             JSValueRef exception = 0;
             JSValueRef value;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception) {
+                exec->setException(toJS(exec, exception));
+                return jsUndefined();
+            }
             if (value)
                 return toJS(exec, value);
-            if (exception)
-                return jsUndefined();
         }
             
     return throwError(exec, ReferenceError, "hasProperty callback returned true for a property that doesn't exist.");
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp
index 3785bab5ce..3c2133db9e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp
@@ -33,11 +33,28 @@
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 #include <runtime/Identifier.h>
+#include <wtf/unicode/UTF8.h>
 
+using namespace std;
 using namespace JSC;
+using namespace WTF::Unicode;
 
 const JSClassDefinition kJSClassDefinitionEmpty = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 
+static inline UString tryCreateStringFromUTF8(const char* string)
+{
+    if (!string)
+        return UString::null();
+
+    size_t length = strlen(string);
+    Vector<UChar, 1024> buffer(length);
+    UChar* p = buffer.data();
+    if (conversionOK != convertUTF8ToUTF16(&string, string + length, &p, p + length))
+        return UString::null();
+
+    return UString(buffer.data(), p - buffer.data());
+}
+
 OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass* protoClass) 
     : parentClass(definition->parentClass)
     , prototypeClass(0)
@@ -52,7 +69,7 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
     , callAsConstructor(definition->callAsConstructor)
     , hasInstance(definition->hasInstance)
     , convertToType(definition->convertToType)
-    , m_className(UString::Rep::createFromUTF8(definition->className))
+    , m_className(tryCreateStringFromUTF8(definition->className))
     , m_staticValues(0)
     , m_staticFunctions(0)
 {
@@ -61,8 +78,14 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
     if (const JSStaticValue* staticValue = definition->staticValues) {
         m_staticValues = new OpaqueJSClassStaticValuesTable();
         while (staticValue->name) {
-            StaticValueEntry* e = new StaticValueEntry(staticValue->getProperty, staticValue->setProperty, staticValue->attributes);
-            m_staticValues->add(UString::Rep::createFromUTF8(staticValue->name), e);
+            UString valueName = tryCreateStringFromUTF8(staticValue->name);
+            if (!valueName.isNull()) {
+                // Use a local variable here to sidestep an RVCT compiler bug.
+                StaticValueEntry* entry = new StaticValueEntry(staticValue->getProperty, staticValue->setProperty, staticValue->attributes);
+                UStringImpl* impl = valueName.rep();
+                impl->ref();
+                m_staticValues->add(impl, entry);
+            }
             ++staticValue;
         }
     }
@@ -70,8 +93,14 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
     if (const JSStaticFunction* staticFunction = definition->staticFunctions) {
         m_staticFunctions = new OpaqueJSClassStaticFunctionsTable();
         while (staticFunction->name) {
-            StaticFunctionEntry* e = new StaticFunctionEntry(staticFunction->callAsFunction, staticFunction->attributes);
-            m_staticFunctions->add(UString::Rep::createFromUTF8(staticFunction->name), e);
+            UString functionName = tryCreateStringFromUTF8(staticFunction->name);
+            if (!functionName.isNull()) {
+                // Use a local variable here to sidestep an RVCT compiler bug.
+                StaticFunctionEntry* entry = new StaticFunctionEntry(staticFunction->callAsFunction, staticFunction->attributes);
+                UStringImpl* impl = functionName.rep();
+                impl->ref();
+                m_staticFunctions->add(impl, entry);
+            }
             ++staticFunction;
         }
     }
@@ -82,12 +111,13 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
 
 OpaqueJSClass::~OpaqueJSClass()
 {
-    ASSERT(!m_className.rep()->identifierTable());
+    // The empty string is shared across threads & is an identifier, in all other cases we should have done a deep copy in className(), below. 
+    ASSERT(!m_className.size() || !m_className.rep()->isIdentifier());
 
     if (m_staticValues) {
         OpaqueJSClassStaticValuesTable::const_iterator end = m_staticValues->end();
         for (OpaqueJSClassStaticValuesTable::const_iterator it = m_staticValues->begin(); it != end; ++it) {
-            ASSERT(!it->first->identifierTable());
+            ASSERT(!it->first->isIdentifier());
             delete it->second;
         }
         delete m_staticValues;
@@ -96,7 +126,7 @@ OpaqueJSClass::~OpaqueJSClass()
     if (m_staticFunctions) {
         OpaqueJSClassStaticFunctionsTable::const_iterator end = m_staticFunctions->end();
         for (OpaqueJSClassStaticFunctionsTable::const_iterator it = m_staticFunctions->begin(); it != end; ++it) {
-            ASSERT(!it->first->identifierTable());
+            ASSERT(!it->first->isIdentifier());
             delete it->second;
         }
         delete m_staticFunctions;
@@ -115,56 +145,46 @@ static void clearReferenceToPrototype(JSObjectRef prototype)
 {
     OpaqueJSClassContextData* jsClassData = static_cast<OpaqueJSClassContextData*>(JSObjectGetPrivate(prototype));
     ASSERT(jsClassData);
-    jsClassData->cachedPrototype = 0;
+    jsClassData->cachedPrototype.clear(toJS(prototype));
 }
 
-PassRefPtr<OpaqueJSClass> OpaqueJSClass::create(const JSClassDefinition* definition)
+PassRefPtr<OpaqueJSClass> OpaqueJSClass::create(const JSClassDefinition* clientDefinition)
 {
-    if (const JSStaticFunction* staticFunctions = definition->staticFunctions) {
-        // copy functions into a prototype class
-        JSClassDefinition protoDefinition = kJSClassDefinitionEmpty;
-        protoDefinition.staticFunctions = staticFunctions;
-        protoDefinition.finalize = clearReferenceToPrototype;
-        
-        // We are supposed to use JSClassRetain/Release but since we know that we currently have
-        // the only reference to this class object we cheat and use a RefPtr instead.
-        RefPtr<OpaqueJSClass> protoClass = adoptRef(new OpaqueJSClass(&protoDefinition, 0));
-
-        // remove functions from the original class
-        JSClassDefinition objectDefinition = *definition;
-        objectDefinition.staticFunctions = 0;
+    JSClassDefinition definition = *clientDefinition; // Avoid modifying client copy.
 
-        return adoptRef(new OpaqueJSClass(&objectDefinition, protoClass.get()));
-    }
-
-    return adoptRef(new OpaqueJSClass(definition, 0));
+    JSClassDefinition protoDefinition = kJSClassDefinitionEmpty;
+    protoDefinition.finalize = clearReferenceToPrototype;
+    swap(definition.staticFunctions, protoDefinition.staticFunctions); // Move static functions to the prototype.
+    
+    // We are supposed to use JSClassRetain/Release but since we know that we currently have
+    // the only reference to this class object we cheat and use a RefPtr instead.
+    RefPtr<OpaqueJSClass> protoClass = adoptRef(new OpaqueJSClass(&protoDefinition, 0));
+    return adoptRef(new OpaqueJSClass(&definition, protoClass.get()));
 }
 
 OpaqueJSClassContextData::OpaqueJSClassContextData(OpaqueJSClass* jsClass)
     : m_class(jsClass)
-    , cachedPrototype(0)
 {
     if (jsClass->m_staticValues) {
         staticValues = new OpaqueJSClassStaticValuesTable;
         OpaqueJSClassStaticValuesTable::const_iterator end = jsClass->m_staticValues->end();
         for (OpaqueJSClassStaticValuesTable::const_iterator it = jsClass->m_staticValues->begin(); it != end; ++it) {
-            ASSERT(!it->first->identifierTable());
-            StaticValueEntry* e = new StaticValueEntry(it->second->getProperty, it->second->setProperty, it->second->attributes);
-            staticValues->add(UString::Rep::createCopying(it->first->data(), it->first->size()), e);
-
+            ASSERT(!it->first->isIdentifier());
+            // Use a local variable here to sidestep an RVCT compiler bug.
+            StaticValueEntry* entry = new StaticValueEntry(it->second->getProperty, it->second->setProperty, it->second->attributes);
+            staticValues->add(UString::Rep::create(it->first->characters(), it->first->length()), entry);
         }
-            
     } else
         staticValues = 0;
-        
 
     if (jsClass->m_staticFunctions) {
         staticFunctions = new OpaqueJSClassStaticFunctionsTable;
         OpaqueJSClassStaticFunctionsTable::const_iterator end = jsClass->m_staticFunctions->end();
         for (OpaqueJSClassStaticFunctionsTable::const_iterator it = jsClass->m_staticFunctions->begin(); it != end; ++it) {
-            ASSERT(!it->first->identifierTable());
-            StaticFunctionEntry* e = new StaticFunctionEntry(it->second->callAsFunction, it->second->attributes);
-            staticFunctions->add(UString::Rep::createCopying(it->first->data(), it->first->size()), e);
+            ASSERT(!it->first->isIdentifier());
+            // Use a local variable here to sidestep an RVCT compiler bug.
+            StaticFunctionEntry* entry = new StaticFunctionEntry(it->second->callAsFunction, it->second->attributes);
+            staticFunctions->add(UString::Rep::create(it->first->characters(), it->first->length()), entry);
         }
             
     } else
@@ -241,5 +261,5 @@ JSObject* OpaqueJSClass::prototype(ExecState* exec)
                 jsClassData.cachedPrototype->setPrototype(prototype);
         }
     }
-    return jsClassData.cachedPrototype;
+    return jsClassData.cachedPrototype.get();
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h
index c4777ddfd1..ae60aadef9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h
@@ -31,6 +31,7 @@
 #include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 #include <runtime/UString.h>
+#include <runtime/WeakGCPtr.h>
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
 
@@ -76,7 +77,7 @@ struct OpaqueJSClassContextData : Noncopyable {
 
     OpaqueJSClassStaticValuesTable* staticValues;
     OpaqueJSClassStaticFunctionsTable* staticFunctions;
-    JSC::JSObject* cachedPrototype;
+    JSC::WeakGCPtr<JSC::JSObject> cachedPrototype;
 };
 
 struct OpaqueJSClass : public ThreadSafeShared<OpaqueJSClass> {
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
index e6626b7060..9d4f38c1e2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
@@ -33,9 +33,8 @@
 #include "JSClassRef.h"
 #include "JSGlobalObject.h"
 #include "JSObject.h"
-#include <wtf/Platform.h>
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 #include <mach-o/dyld.h>
 
 static const int32_t webkitFirstVersionWithConcurrentGlobalContexts = 0x2100500; // 528.5.0
@@ -46,7 +45,7 @@ using namespace JSC;
 JSContextGroupRef JSContextGroupCreate()
 {
     initializeThreading();
-    return toRef(JSGlobalData::create().releaseRef());
+    return toRef(JSGlobalData::createNonDefault().releaseRef());
 }
 
 JSContextGroupRef JSContextGroupRetain(JSContextGroupRef group)
@@ -63,7 +62,7 @@ void JSContextGroupRelease(JSContextGroupRef group)
 JSGlobalContextRef JSGlobalContextCreate(JSClassRef globalObjectClass)
 {
     initializeThreading();
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     // When running on Tiger or Leopard, or if the application was linked before JSGlobalContextCreate was changed
     // to use a unique JSGlobalData, we use a shared one for compatibility.
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
@@ -74,7 +73,7 @@ JSGlobalContextRef JSGlobalContextCreate(JSClassRef globalObjectClass)
         JSLock lock(LockForReal);
         return JSGlobalContextCreateInGroup(toRef(&JSGlobalData::sharedInstance()), globalObjectClass);
     }
-#endif // PLATFORM(DARWIN)
+#endif // OS(DARWIN)
 
     return JSGlobalContextCreateInGroup(0, globalObjectClass);
 }
@@ -84,8 +83,9 @@ JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClass
     initializeThreading();
 
     JSLock lock(LockForReal);
+    RefPtr<JSGlobalData> globalData = group ? PassRefPtr<JSGlobalData>(toJS(group)) : JSGlobalData::createNonDefault();
 
-    RefPtr<JSGlobalData> globalData = group ? PassRefPtr<JSGlobalData>(toJS(group)) : JSGlobalData::create();
+    APIEntryShim entryShim(globalData.get(), false);
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
     globalData->makeUsableFromMultipleThreads();
@@ -108,12 +108,9 @@ JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClass
 JSGlobalContextRef JSGlobalContextRetain(JSGlobalContextRef ctx)
 {
     ExecState* exec = toJS(ctx);
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSGlobalData& globalData = exec->globalData();
-
-    globalData.heap.registerThread();
-
     gcProtect(exec->dynamicGlobalObject());
     globalData.ref();
     return ctx;
@@ -124,25 +121,39 @@ void JSGlobalContextRelease(JSGlobalContextRef ctx)
     ExecState* exec = toJS(ctx);
     JSLock lock(exec);
 
-    gcUnprotect(exec->dynamicGlobalObject());
-
     JSGlobalData& globalData = exec->globalData();
-    if (globalData.refCount() == 2) { // One reference is held by JSGlobalObject, another added by JSGlobalContextRetain().
-        // The last reference was released, this is our last chance to collect.
-        ASSERT(!globalData.heap.protectedObjectCount());
-        ASSERT(!globalData.heap.isBusy());
+    JSGlobalObject* dgo = exec->dynamicGlobalObject();
+    IdentifierTable* savedIdentifierTable = setCurrentIdentifierTable(globalData.identifierTable);
+
+    // One reference is held by JSGlobalObject, another added by JSGlobalContextRetain().
+    bool releasingContextGroup = globalData.refCount() == 2;
+    bool releasingGlobalObject = Heap::heap(dgo)->unprotect(dgo);
+    // If this is the last reference to a global data, it should also
+    // be the only remaining reference to the global object too!
+    ASSERT(!releasingContextGroup || releasingGlobalObject);
+
+    // An API 'JSGlobalContextRef' retains two things - a global object and a
+    // global data (or context group, in API terminology).
+    // * If this is the last reference to any contexts in the given context group,
+    //   call destroy on the heap (the global data is being  freed).
+    // * If this was the last reference to the global object, then unprotecting
+    //   it may  release a lot of GC memory - run the garbage collector now.
+    // * If there are more references remaining the the global object, then do nothing
+    //   (specifically that is more protects, which we assume come from other JSGlobalContextRefs).
+    if (releasingContextGroup)
         globalData.heap.destroy();
-    } else
-        globalData.heap.collect();
+    else if (releasingGlobalObject)
+        globalData.heap.collectAllGarbage();
 
     globalData.deref();
+
+    setCurrentIdentifierTable(savedIdentifierTable);
 }
 
 JSObjectRef JSContextGetGlobalObject(JSContextRef ctx)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     // It is necessary to call toThisObject to get the wrapper object when used with WebCore.
     return toRef(exec->lexicalGlobalObject()->toThisObject(exec));
@@ -157,8 +168,7 @@ JSContextGroupRef JSContextGetGroup(JSContextRef ctx)
 JSGlobalContextRef JSContextGetGlobalContext(JSContextRef ctx)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toGlobalRef(exec->lexicalGlobalObject()->globalExec());
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
index 06ef578a87..8fdbdab905 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
@@ -26,6 +26,7 @@
 
 #include "config.h"
 #include "JSObjectRef.h"
+#include "JSObjectRefPrivate.h"
 
 #include "APICast.h"
 #include "CodeBlock.h"
@@ -48,7 +49,6 @@
 #include "ObjectPrototype.h"
 #include "PropertyNameArray.h"
 #include "RegExpConstructor.h"
-#include <wtf/Platform.h>
 
 using namespace JSC;
 
@@ -76,8 +76,7 @@ void JSClassRelease(JSClassRef jsClass)
 JSObjectRef JSObjectMake(JSContextRef ctx, JSClassRef jsClass, void* data)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     if (!jsClass)
         return toRef(new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure())); // slightly more efficient
@@ -92,8 +91,7 @@ JSObjectRef JSObjectMake(JSContextRef ctx, JSClassRef jsClass, void* data)
 JSObjectRef JSObjectMakeFunctionWithCallback(JSContextRef ctx, JSStringRef name, JSObjectCallAsFunctionCallback callAsFunction)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     Identifier nameID = name ? name->identifier(&exec->globalData()) : Identifier(exec, "anonymous");
     
@@ -103,8 +101,7 @@ JSObjectRef JSObjectMakeFunctionWithCallback(JSContextRef ctx, JSStringRef name,
 JSObjectRef JSObjectMakeConstructor(JSContextRef ctx, JSClassRef jsClass, JSObjectCallAsConstructorCallback callAsConstructor)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsPrototype = jsClass ? jsClass->prototype(exec) : 0;
     if (!jsPrototype)
@@ -118,8 +115,7 @@ JSObjectRef JSObjectMakeConstructor(JSContextRef ctx, JSClassRef jsClass, JSObje
 JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned parameterCount, const JSStringRef parameterNames[], JSStringRef body, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     Identifier nameID = name ? name->identifier(&exec->globalData()) : Identifier(exec, "anonymous");
     
@@ -141,8 +137,7 @@ JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned pa
 JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* result;
     if (argumentCount) {
@@ -167,8 +162,7 @@ JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSVa
 JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
@@ -188,8 +182,7 @@ JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSVal
 JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
@@ -209,8 +202,7 @@ JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount, const JSVa
 JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
@@ -230,8 +222,7 @@ JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSV
 JSValueRef JSObjectGetPrototype(JSContextRef ctx, JSObjectRef object)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     return toRef(exec, jsObject->prototype());
@@ -240,8 +231,7 @@ JSValueRef JSObjectGetPrototype(JSContextRef ctx, JSObjectRef object)
 void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     JSValue jsValue = toJS(exec, value);
@@ -252,8 +242,7 @@ void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value
 bool JSObjectHasProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     
@@ -263,8 +252,7 @@ bool JSObjectHasProperty(JSContextRef ctx, JSObjectRef object, JSStringRef prope
 JSValueRef JSObjectGetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
 
@@ -280,8 +268,7 @@ JSValueRef JSObjectGetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef
 void JSObjectSetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSPropertyAttributes attributes, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     Identifier name(propertyName->identifier(&exec->globalData()));
@@ -304,8 +291,7 @@ void JSObjectSetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef prope
 JSValueRef JSObjectGetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned propertyIndex, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
 
@@ -322,8 +308,7 @@ JSValueRef JSObjectGetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsi
 void JSObjectSetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned propertyIndex, JSValueRef value, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     JSValue jsValue = toJS(exec, value);
@@ -339,8 +324,7 @@ void JSObjectSetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned p
 bool JSObjectDeleteProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
 
@@ -380,6 +364,55 @@ bool JSObjectSetPrivate(JSObjectRef object, void* data)
     return false;
 }
 
+JSValueRef JSObjectGetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
+{
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
+    JSObject* jsObject = toJS(object);
+    JSValue result;
+    Identifier name(propertyName->identifier(&exec->globalData()));
+    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::info))
+        result = static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->getPrivateProperty(name);
+    else if (jsObject->inherits(&JSCallbackObject<JSObject>::info))
+        result = static_cast<JSCallbackObject<JSObject>*>(jsObject)->getPrivateProperty(name);
+    return toRef(exec, result);
+}
+
+bool JSObjectSetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value)
+{
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
+    JSObject* jsObject = toJS(object);
+    JSValue jsValue = toJS(exec, value);
+    Identifier name(propertyName->identifier(&exec->globalData()));
+    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::info)) {
+        static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivateProperty(name, jsValue);
+        return true;
+    }
+    if (jsObject->inherits(&JSCallbackObject<JSObject>::info)) {
+        static_cast<JSCallbackObject<JSObject>*>(jsObject)->setPrivateProperty(name, jsValue);
+        return true;
+    }
+    return false;
+}
+
+bool JSObjectDeletePrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
+{
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
+    JSObject* jsObject = toJS(object);
+    Identifier name(propertyName->identifier(&exec->globalData()));
+    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::info)) {
+        static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->deletePrivateProperty(name);
+        return true;
+    }
+    if (jsObject->inherits(&JSCallbackObject<JSObject>::info)) {
+        static_cast<JSCallbackObject<JSObject>*>(jsObject)->deletePrivateProperty(name);
+        return true;
+    }
+    return false;
+}
+
 bool JSObjectIsFunction(JSContextRef, JSObjectRef object)
 {
     CallData callData;
@@ -389,8 +422,7 @@ bool JSObjectIsFunction(JSContextRef, JSObjectRef object)
 JSValueRef JSObjectCallAsFunction(JSContextRef ctx, JSObjectRef object, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     JSObject* jsThisObject = toJS(thisObject);
@@ -427,8 +459,7 @@ bool JSObjectIsConstructor(JSContextRef, JSObjectRef object)
 JSObjectRef JSObjectCallAsConstructor(JSContextRef ctx, JSObjectRef object, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
 
@@ -466,8 +497,7 @@ JSPropertyNameArrayRef JSObjectCopyPropertyNames(JSContextRef ctx, JSObjectRef o
 {
     JSObject* jsObject = toJS(object);
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSGlobalData* globalData = &exec->globalData();
 
@@ -492,7 +522,7 @@ JSPropertyNameArrayRef JSPropertyNameArrayRetain(JSPropertyNameArrayRef array)
 void JSPropertyNameArrayRelease(JSPropertyNameArrayRef array)
 {
     if (--array->refCount == 0) {
-        JSLock lock(array->globalData->isSharedInstance ? LockForReal : SilenceAssertionsOnly);
+        APIEntryShim entryShim(array->globalData, false);
         delete array;
     }
 }
@@ -510,9 +540,6 @@ JSStringRef JSPropertyNameArrayGetNameAtIndex(JSPropertyNameArrayRef array, size
 void JSPropertyNameAccumulatorAddName(JSPropertyNameAccumulatorRef array, JSStringRef propertyName)
 {
     PropertyNameArray* propertyNames = toJS(array);
-
-    propertyNames->globalData()->heap.registerThread();
-    JSLock lock(propertyNames->globalData()->isSharedInstance ? LockForReal : SilenceAssertionsOnly);
-
+    APIEntryShim entryShim(propertyNames->globalData());
     propertyNames->add(propertyName->identifier(propertyNames->globalData()));
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRefPrivate.h b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRefPrivate.h
new file mode 100644
index 0000000000..32e80ab26f
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRefPrivate.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSObjectRefPrivate_h
+#define JSObjectRefPrivate_h
+
+#include <JavaScriptCore/JSObjectRef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*!
+ @function
+ @abstract Sets a private property on an object.  This private property cannot be accessed from within JavaScript.
+ @param ctx The execution context to use.
+ @param object The JSObject whose private property you want to set.
+ @param propertyName A JSString containing the property's name.
+ @param value A JSValue to use as the property's value.  This may be NULL.
+ @result true if object can store private data, otherwise false.
+ @discussion This API allows you to store JS values directly an object in a way that will be ensure that they are kept alive without exposing them to JavaScript code and without introducing the reference cycles that may occur when using JSValueProtect.
+
+ The default object class does not allocate storage for private data. Only objects created with a non-NULL JSClass can store private properties.
+ */
+JS_EXPORT bool JSObjectSetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value);
+
+/*!
+ @function
+ @abstract Gets a private property from an object.
+ @param ctx The execution context to use.
+ @param object The JSObject whose private property you want to get.
+ @param propertyName A JSString containing the property's name.
+ @result The property's value if object has the property, otherwise NULL.
+ */
+JS_EXPORT JSValueRef JSObjectGetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName);
+
+/*!
+ @function
+ @abstract Deletes a private property from an object.
+ @param ctx The execution context to use.
+ @param object The JSObject whose private property you want to delete.
+ @param propertyName A JSString containing the property's name.
+ @result true if object can store private data, otherwise false.
+ @discussion The default object class does not allocate storage for private data. Only objects created with a non-NULL JSClass can store private data.
+ */
+JS_EXPORT bool JSObjectDeletePrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // JSObjectRefPrivate_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h
index c58b958210..92135b1535 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h
@@ -37,7 +37,8 @@
 extern "C" {
 #endif
 
-#if !defined(WIN32) && !defined(_WIN32) && !defined(__WINSCW__)
+#if !defined(WIN32) && !defined(_WIN32) && !defined(__WINSCW__) \
+    && !(defined(__CC_ARM) || defined(__ARMCC__)) /* RVCT */
 /*!
 @typedef JSChar
 @abstract A Unicode character.
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp
index 2207181bd6..ced8203087 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp
@@ -26,12 +26,14 @@
 #include "config.h"
 #include "JSValueRef.h"
 
-#include <wtf/Platform.h>
 #include "APICast.h"
+#include "APIShims.h"
 #include "JSCallbackObject.h"
 
 #include <runtime/JSGlobalObject.h>
+#include <runtime/JSONObject.h>
 #include <runtime/JSString.h>
+#include <runtime/LiteralParser.h>
 #include <runtime/Operations.h>
 #include <runtime/Protect.h>
 #include <runtime/UString.h>
@@ -41,13 +43,14 @@
 
 #include <algorithm> // for std::min
 
-JSType JSValueGetType(JSContextRef ctx, JSValueRef value)
+using namespace JSC;
+
+::JSType JSValueGetType(JSContextRef ctx, JSValueRef value)
 {
-    JSC::ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSC::JSLock lock(exec);
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
 
-    JSC::JSValue jsValue = toJS(exec, value);
+    JSValue jsValue = toJS(exec, value);
 
     if (jsValue.isUndefined())
         return kJSTypeUndefined;
@@ -63,13 +66,10 @@ JSType JSValueGetType(JSContextRef ctx, JSValueRef value)
     return kJSTypeObject;
 }
 
-using namespace JSC; // placed here to avoid conflict between JSC::JSType and JSType, above.
-
 bool JSValueIsUndefined(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isUndefined();
@@ -78,8 +78,7 @@ bool JSValueIsUndefined(JSContextRef ctx, JSValueRef value)
 bool JSValueIsNull(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isNull();
@@ -88,8 +87,7 @@ bool JSValueIsNull(JSContextRef ctx, JSValueRef value)
 bool JSValueIsBoolean(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isBoolean();
@@ -98,8 +96,7 @@ bool JSValueIsBoolean(JSContextRef ctx, JSValueRef value)
 bool JSValueIsNumber(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isNumber();
@@ -108,8 +105,7 @@ bool JSValueIsNumber(JSContextRef ctx, JSValueRef value)
 bool JSValueIsString(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isString();
@@ -118,8 +114,7 @@ bool JSValueIsString(JSContextRef ctx, JSValueRef value)
 bool JSValueIsObject(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isObject();
@@ -128,8 +123,7 @@ bool JSValueIsObject(JSContextRef ctx, JSValueRef value)
 bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsClass)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     
@@ -145,8 +139,7 @@ bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsCla
 bool JSValueIsEqual(JSContextRef ctx, JSValueRef a, JSValueRef b, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsA = toJS(exec, a);
     JSValue jsB = toJS(exec, b);
@@ -163,20 +156,18 @@ bool JSValueIsEqual(JSContextRef ctx, JSValueRef a, JSValueRef b, JSValueRef* ex
 bool JSValueIsStrictEqual(JSContextRef ctx, JSValueRef a, JSValueRef b)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsA = toJS(exec, a);
     JSValue jsB = toJS(exec, b);
 
-    return JSValue::strictEqual(jsA, jsB);
+    return JSValue::strictEqual(exec, jsA, jsB);
 }
 
 bool JSValueIsInstanceOfConstructor(JSContextRef ctx, JSValueRef value, JSObjectRef constructor, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
 
@@ -195,8 +186,7 @@ bool JSValueIsInstanceOfConstructor(JSContextRef ctx, JSValueRef value, JSObject
 JSValueRef JSValueMakeUndefined(JSContextRef ctx)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toRef(exec, jsUndefined());
 }
@@ -204,8 +194,7 @@ JSValueRef JSValueMakeUndefined(JSContextRef ctx)
 JSValueRef JSValueMakeNull(JSContextRef ctx)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toRef(exec, jsNull());
 }
@@ -213,8 +202,7 @@ JSValueRef JSValueMakeNull(JSContextRef ctx)
 JSValueRef JSValueMakeBoolean(JSContextRef ctx, bool value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toRef(exec, jsBoolean(value));
 }
@@ -222,8 +210,7 @@ JSValueRef JSValueMakeBoolean(JSContextRef ctx, bool value)
 JSValueRef JSValueMakeNumber(JSContextRef ctx, double value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toRef(exec, jsNumber(exec, value));
 }
@@ -231,17 +218,40 @@ JSValueRef JSValueMakeNumber(JSContextRef ctx, double value)
 JSValueRef JSValueMakeString(JSContextRef ctx, JSStringRef string)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toRef(exec, jsString(exec, string->ustring()));
 }
 
+JSValueRef JSValueMakeFromJSONString(JSContextRef ctx, JSStringRef string)
+{
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
+    LiteralParser parser(exec, string->ustring(), LiteralParser::StrictJSON);
+    return toRef(exec, parser.tryLiteralParse());
+}
+
+JSStringRef JSValueCreateJSONString(JSContextRef ctx, JSValueRef apiValue, unsigned indent, JSValueRef* exception)
+{
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
+    JSValue value = toJS(exec, apiValue);
+    UString result = JSONStringify(exec, value, indent);
+    if (exception)
+        *exception = 0;
+    if (exec->hadException()) {
+        if (exception)
+            *exception = toRef(exec, exec->exception());
+        exec->clearException();
+        return 0;
+    }
+    return OpaqueJSString::create(result).releaseRef();
+}
+
 bool JSValueToBoolean(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.toBoolean(exec);
@@ -250,8 +260,7 @@ bool JSValueToBoolean(JSContextRef ctx, JSValueRef value)
 double JSValueToNumber(JSContextRef ctx, JSValueRef value, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
 
@@ -268,8 +277,7 @@ double JSValueToNumber(JSContextRef ctx, JSValueRef value, JSValueRef* exception
 JSStringRef JSValueToStringCopy(JSContextRef ctx, JSValueRef value, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     
@@ -286,8 +294,7 @@ JSStringRef JSValueToStringCopy(JSContextRef ctx, JSValueRef value, JSValueRef*
 JSObjectRef JSValueToObject(JSContextRef ctx, JSValueRef value, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     
@@ -304,19 +311,17 @@ JSObjectRef JSValueToObject(JSContextRef ctx, JSValueRef value, JSValueRef* exce
 void JSValueProtect(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
-    JSValue jsValue = toJS(exec, value);
+    JSValue jsValue = toJSForGC(exec, value);
     gcProtect(jsValue);
 }
 
 void JSValueUnprotect(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
-    JSValue jsValue = toJS(exec, value);
+    JSValue jsValue = toJSForGC(exec, value);
     gcUnprotect(jsValue);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.h
index 7a7bf93a17..4186db822a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.h
@@ -27,6 +27,7 @@
 #define JSValueRef_h
 
 #include <JavaScriptCore/JSBase.h>
+#include <JavaScriptCore/WebKitAvailability.h>
 
 #ifndef __cplusplus
 #include <stdbool.h>
@@ -208,6 +209,28 @@ JS_EXPORT JSValueRef JSValueMakeNumber(JSContextRef ctx, double number);
 */
 JS_EXPORT JSValueRef JSValueMakeString(JSContextRef ctx, JSStringRef string);
 
+/* Converting to and from JSON formatted strings */
+
+/*!
+ @function
+ @abstract       Creates a JavaScript value from a JSON formatted string.
+ @param ctx      The execution context to use.
+ @param string   The JSString containing the JSON string to be parsed.
+ @result         A JSValue containing the parsed value, or NULL if the input is invalid.
+ */
+JS_EXPORT JSValueRef JSValueMakeFromJSONString(JSContextRef ctx, JSStringRef string) AVAILABLE_AFTER_WEBKIT_VERSION_4_0;
+
+/*!
+ @function
+ @abstract       Creates a JavaScript string containing the JSON serialized representation of a JS value.
+ @param ctx      The execution context to use.
+ @param value    The value to serialize.
+ @param indent   The number of spaces to indent when nesting.  If 0, the resulting JSON will not contains newlines.  The size of the indent is clamped to 10 spaces.
+ @param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result         A JSString with the result of serialization, or NULL if an exception is thrown.
+ */
+JS_EXPORT JSStringRef JSValueCreateJSONString(JSContextRef ctx, JSValueRef value, unsigned indent, JSValueRef* exception) AVAILABLE_AFTER_WEBKIT_VERSION_4_0;
+
 /* Converting to primitive values */
 
 /*!
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/OpaqueJSString.cpp b/src/3rdparty/webkit/JavaScriptCore/API/OpaqueJSString.cpp
index 7c7b1af69f..f740abe3b1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/OpaqueJSString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/OpaqueJSString.cpp
@@ -42,7 +42,7 @@ PassRefPtr<OpaqueJSString> OpaqueJSString::create(const UString& ustring)
 UString OpaqueJSString::ustring() const
 {
     if (this && m_characters)
-        return UString(m_characters, m_length, true);
+        return UString(m_characters, m_length);
     return UString::null();
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h b/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h
index 8402528317..0e4f091cc7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009, 2010 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,7 +42,7 @@
 #define WEBKIT_VERSION_LATEST 0x9999
 
 #ifdef __APPLE__
-#import <AvailabilityMacros.h>
+#include <AvailabilityMacros.h>
 #else
 /*
  * For non-Mac platforms, require the newest version.
@@ -86,6 +86,9 @@
     #elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_6
         /* WebKit 3.0 is the version that shipped on Mac OS X 10.5. */
         #define WEBKIT_VERSION_MIN_REQUIRED WEBKIT_VERSION_3_0
+    #elif !defined(MAC_OS_X_VERSION_10_7) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_7
+        /* WebKit 4.0 is the version that shipped on Mac OS X 10.6. */
+        #define WEBKIT_VERSION_MIN_REQUIRED WEBKIT_VERSION_4_0
     #else
         #define WEBKIT_VERSION_MIN_REQUIRED WEBKIT_VERSION_LATEST
     #endif
@@ -645,9 +648,9 @@
  * 
  * Used on declarations introduced in WebKit 4.0
  */
-#if WEBKIT_VERSION_MAX_ALLOWED < WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MAX_ALLOWED < WEBKIT_VERSION_4_0
     #define AVAILABLE_IN_WEBKIT_VERSION_4_0     UNAVAILABLE_ATTRIBUTE
-#elif WEBKIT_VERSION_MIN_REQUIRED < WEBKIT_VERSION_LATEST
+#elif WEBKIT_VERSION_MIN_REQUIRED < WEBKIT_VERSION_4_0
     #define AVAILABLE_IN_WEBKIT_VERSION_4_0     WEAK_IMPORT_ATTRIBUTE
 #else
     #define AVAILABLE_IN_WEBKIT_VERSION_4_0
@@ -659,7 +662,7 @@
  * Used on declarations introduced in WebKit 4.0, 
  * and deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_IN_WEBKIT_VERSION_4_0_BUT_DEPRECATED    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_IN_WEBKIT_VERSION_4_0_BUT_DEPRECATED    AVAILABLE_IN_WEBKIT_VERSION_4_0
@@ -671,7 +674,7 @@
  * Used on declarations introduced in WebKit 1.0, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER
@@ -683,7 +686,7 @@
  * Used on declarations introduced in WebKit 1.1, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER
@@ -695,7 +698,7 @@
  * Used on declarations introduced in WebKit 1.2, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER
@@ -707,7 +710,7 @@
  * Used on declarations introduced in WebKit 1.3, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER
@@ -719,7 +722,7 @@
  * Used on declarations introduced in WebKit 2.0, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER
@@ -731,7 +734,7 @@
  * Used on declarations introduced in WebKit 3.0, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER
@@ -743,7 +746,7 @@
  * Used on declarations introduced in WebKit 3.1, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER
@@ -754,11 +757,148 @@
  * 
  * Used on types deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define DEPRECATED_IN_WEBKIT_VERSION_4_0
 #endif
 
 
+
+
+
+
+/*
+ * AVAILABLE_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MAX_ALLOWED < WEBKIT_VERSION_LATEST
+    #define AVAILABLE_AFTER_WEBKIT_VERSION_4_0     UNAVAILABLE_ATTRIBUTE
+#elif WEBKIT_VERSION_MIN_REQUIRED < WEBKIT_VERSION_LATEST
+    #define AVAILABLE_AFTER_WEBKIT_VERSION_4_0     WEAK_IMPORT_ATTRIBUTE
+#else
+    #define AVAILABLE_AFTER_WEBKIT_VERSION_4_0
+#endif
+
+/*
+ * AVAILABLE_AFTER_WEBKIT_VERSION_4_0_BUT_DEPRECATED
+ * 
+ * Used on declarations introduced after WebKit 4.0, 
+ * and deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_AFTER_WEBKIT_VERSION_4_0_BUT_DEPRECATED    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_AFTER_WEBKIT_VERSION_4_0_BUT_DEPRECATED    AVAILABLE_AFTER_WEBKIT_VERSION_4_0
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 1.0, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 1.1, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 1.2, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 1.3, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 2.0, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 3.0, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 3.1, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_4_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 4.0 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_4_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_4_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_4_0_AND_LATER
+#endif
+
+/*
+ * DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on types deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+#endif
+
+
 #endif /* __WebKitAvailability__ */
diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 8932b3bf0c..7ce07875f3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,3 +1,190 @@
+2010-04-05  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Symbian] Consolidate Symbian WINSCW environment configuration
+        https://bugs.webkit.org/show_bug.cgi?id=37100
+
+        Move the "undefinition" of WIN32 and _WIN32 from WebCore/config.h
+        to JavaScriptCore/wtf/Platform.h as it is not specific to WebCore.
+
+        PLATFORM(WIN) and OS(WIN) no longer needs to be undefined as
+        undefining WIN32 takes care of it.
+
+        * wtf/Platform.h:
+
+2010-03-30  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by nobody, build break.
+
+        [Qt] Fix build break on Qt Mac.
+
+        DESTDIR path on Mac do not include the configuration path by default
+        like on Windows. Have to force it.
+
+        * JavaScriptCore.pro:
+
+2010-02-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add support for Widgets 1.0: View Mode Media Feature
+        https://bugs.webkit.org/show_bug.cgi?id=35446
+
+        Add an enable flag for the Widgets (http://www.w3.org/TR/widgets-reqs/)
+        and turn it on for Qt only.
+
+        * wtf/Platform.h:
+
+2010-03-29  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use the -l syntax for linking against JavaScriptCore on Windows.
+        This allow qmake to extract dependencies correctly when generating VS
+        solutions.
+
+        * JavaScriptCore.pri:
+
+2010-03-29  Thomas Zander  <t.zander@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36742
+
+        gcc for Symbian doesn't support gcc extensions like atomicity.h - disable
+
+        * wtf/Threading.h: also detect os symbian
+
+2010-03-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove the definition of WTF_CHANGES guards from the build system
+        https://bugs.webkit.org/show_bug.cgi?id=31670
+  
+        * JavaScriptCore.pro: Remove the definition of WTF_CHANGES
+        as it is already defined in config.h
+
+2010-03-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Build JavaScriptCore as a static library.
+        https://bugs.webkit.org/show_bug.cgi?id=36590
+
+        This patch takes what was left of the unused JavaScriptCore.pro
+        and moved the compilation logic from JavaScriptCore.pri to
+        JavaScriptCore.pro.
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+        * qt/api/QtScript.pro:
+
+2010-03-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by nobody, build fix.
+
+        [Qt] Build fix on MSVC. Reverts r55633 for stdint.h
+
+        This file gets included in generated moc files which don't
+        include the prefix header.
+
+        * os-win32/stdint.h:
+
+2010-03-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative windows build fix part II).
+
+2010-03-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative windows build fix).
+
+2010-03-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 36519 - JSGlobalContextRelease is unnecessarily slow
+
+        Since [ http://trac.webkit.org/changeset/35917 ], calling
+        JSGlobalContextRelease always triggers a GC heap collection
+        (if not a full destroy). As per 35917's changelog "This is
+        only really necessary when the (JSGlobalObject's) last
+        reference is released, but there is no way to determine that,
+        and no harm in collecting slightly more often."
+        
+        Well, we now know of cases of API clients who are harmed by
+        the performance penalty of collecting too often, so it's time
+        to add a way to determine whether a call to JSGlobalContextRelease
+        is removing the last protect from it's global object.  If further
+        protects are retaining the global object (likely from other
+        JSGlobalContextRefs), then don't trigger a GC collection.
+
+        * API/JSContextRef.cpp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::unprotect): return a boolean indicating that the value is now unprotected.
+        * runtime/Collector.h:
+        * wtf/HashCountedSet.h:
+        (WTF::::remove): return a boolean indicating whether the value was removed from the set.
+
+2010-03-23  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice): Some versions of GCC emit a warning about the implicit 64- to 32-bit truncation
+        that takes place here. An explicit cast is sufficient to silence it.
+
+2010-03-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * runtime/ArrayPrototype.cpp: (JSC::arrayProtoFuncSplice): Fixed a typo - length doesn't
+        need to be converted with toInteger().
+
+2010-03-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36511
+        <rdar://problem/7753498> Safari freezes when using SPUTNIK JavaScript conformance check
+
+        Test: fast/js/sputnik-S15.4.4.12_A3_T3.html
+
+        * runtime/ArrayPrototype.cpp: (JSC::arrayProtoFuncSplice): We were incorrectly computing
+        the start offset, and iterated over (almost) all integers. Note that this can be fixed
+        without using doubles, but the code would be much more complicated, and there is no important
+        reason to stick to integers here.
+
+2010-03-23  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fix compilation on Itanium in 32-bit mode
+        https://bugs.webkit.org/show_bug.cgi?id=36494
+
+        * wtf/Platform.h: Introduce CPU(IA64_32). Don't define
+          WTF_USE_JSVALUE64 if the CPU is in 32-bit mode.
+
+2010-03-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Interpreter fix for <rdar://problem/7728196> REGRESSION (r46701): -(-2147483648)
+        evaluates to -2147483648 on 32 bit (35842)
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Only take the fast negate path if
+        a bit other than bit 31 is set. If none of bits 0-30 are set, then the
+        value we're negating can only be 0 or -2147483648, and neither can be
+        negated in int space.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate): Updated the JIT implementation to match
+        the interpreter, since it's slightly simpler.
+
 2010-03-22  Siddharth Mathur  <siddharth.mathur@nokia.com>
 
         Reviewed by Laszlo Gombos.
@@ -26,6 +213,3142 @@
         (WTF::AlignedBlockAllocator::~AlignedBlockAllocator):
         * wtf/symbian/BlockAllocatorSymbian.h: Added.
 
+2010-03-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed <rdar://problem/7728196> REGRESSION (r46701): -(-2147483648)
+        evaluates to -2147483648 on 32 bit (35842)
+        
+        Two ways to fix the same bug:
+        
+        1. Check for overflow when negating, since negating the largest negative
+        int causes overflow.
+        
+        2. Constant-fold even when negating a negative, since, like they say in
+        high school, "math works."
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchNeg32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchNeg32): Added a branching version
+        of the negate operator.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate): Use the branching version of the negate 
+        operator to check for overflow.
+
+        (JSC::JIT::emitSlow_op_negate): Link the check for overflow to a slow case.
+        (We could emit inline code for this, since we know what the result would
+        be, but that's probably just a waste of generated code.)
+
+        * parser/Grammar.y: Constant fold even when negating a negative.
+
+2010-03-22  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/36431> Clean up 'int' use in UString.cpp after r54789
+
+        Reviewed by Darin Adler.
+
+        * runtime/UString.cpp:
+        (JSC::UString::from): Changed argument type from 'unsigned int'
+        to 'unsigned' to match WebKit coding style.
+        (JSC::UString::find): Changed static_cast<int>() to
+        static_cast<unsigned>() now that this method returns unsigned.
+        (JSC::UString::rfind): Ditto.
+        * runtime/UString.h:
+        (JSC::UString::from): Changed argument type from 'unsigned int'
+        to 'unsigned' to match WebKit coding style.
+
+2010-03-22  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add support for syntax checking in the QtScript API.
+
+        New class was created; the QScriptSyntaxCheckResult which main
+        responsibility is to provide results of the ECMA Script code
+        syntax check. The class is not fully functional as the JSC C API
+        doesn't expose an error column number, but it is a good start point
+        for a future development.
+
+        [Qt] QtScript functionality should be extended by syntax checking.
+        https://bugs.webkit.org/show_bug.cgi?id=36123
+
+        * qt/api/QtScript.pro:
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::checkSyntax):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::checkSyntax):
+        * qt/api/qscriptengine_p.h:
+        * qt/api/qscriptsyntaxcheckresult.cpp: Added.
+        (QScriptSyntaxCheckResult::QScriptSyntaxCheckResult):
+        (QScriptSyntaxCheckResult::~QScriptSyntaxCheckResult):
+        (QScriptSyntaxCheckResult::operator=):
+        (QScriptSyntaxCheckResult::state):
+        (QScriptSyntaxCheckResult::errorLineNumber):
+        (QScriptSyntaxCheckResult::errorColumnNumber):
+        (QScriptSyntaxCheckResult::errorMessage):
+        * qt/api/qscriptsyntaxcheckresult.h: Added.
+        * qt/api/qscriptsyntaxcheckresult_p.cpp: Added.
+        (QScriptSyntaxCheckResultPrivate::~QScriptSyntaxCheckResultPrivate):
+        (QScriptSyntaxCheckResultPrivate::errorMessage):
+        (QScriptSyntaxCheckResultPrivate::errorLineNumber):
+        * qt/api/qscriptsyntaxcheckresult_p.h: Added.
+        (QScriptSyntaxCheckResultPrivate::get):
+        (QScriptSyntaxCheckResultPrivate::QScriptSyntaxCheckResultPrivate):
+        (QScriptSyntaxCheckResultPrivate::state):
+        (QScriptSyntaxCheckResultPrivate::errorColumnNumber):
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::checkSyntax_data):
+        (tst_QScriptEngine::checkSyntax):
+
+2010-03-21  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        New class; QScriptProgram.
+
+        The class should be used to evaluate the same script multiple times
+        more efficiently.
+
+        [Qt] QtScript should have QScriptProgram class
+        https://bugs.webkit.org/show_bug.cgi?id=36008
+
+        * qt/api/QtScript.pro:
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::evaluate):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::evaluate):
+        * qt/api/qscriptengine_p.h:
+        (QScriptEnginePrivate::evaluate):
+        * qt/api/qscriptprogram.cpp: Added.
+        (QScriptProgram::QScriptProgram):
+        (QScriptProgram::~QScriptProgram):
+        (QScriptProgram::operator=):
+        (QScriptProgram::isNull):
+        (QScriptProgram::sourceCode):
+        (QScriptProgram::fileName):
+        (QScriptProgram::firstLineNumber):
+        (QScriptProgram::operator==):
+        (QScriptProgram::operator!=):
+        * qt/api/qscriptprogram.h: Added.
+        * qt/api/qscriptprogram_p.h: Added.
+        (QScriptProgramPrivate::get):
+        (QScriptProgramPrivate::QScriptProgramPrivate):
+        (QScriptProgramPrivate::~QScriptProgramPrivate):
+        (QScriptProgramPrivate::isNull):
+        (QScriptProgramPrivate::sourceCode):
+        (QScriptProgramPrivate::fileName):
+        (QScriptProgramPrivate::firstLineNumber):
+        (QScriptProgramPrivate::operator==):
+        (QScriptProgramPrivate::operator!=):
+        (QScriptProgramPrivate::program):
+        (QScriptProgramPrivate::file):
+        (QScriptProgramPrivate::line):
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::evaluateProgram):
+
+2010-03-21  David Kilzer  <ddkilzer@apple.com>
+
+        Blind attempt #2 to fix the Windows build after r56314
+
+        * API/tests/testapi.c: Include JSObjectRefPrivate.h for the new
+        methods instead of declaring them locally (and non-extern).
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Backed out previous change.
+
+2010-03-21  David Kilzer  <ddkilzer@apple.com>
+
+        Blind attempt to fix the Windows build after r56314
+
+        Try to fix the following errors on the Windows buildbot:
+
+            Linking...
+            testapi.obj : error LNK2001: unresolved external symbol "bool __cdecl JSObjectSetPrivateProperty(struct OpaqueJSContext const *,struct OpaqueJSValue *,struct OpaqueJSString *,struct OpaqueJSValue const *)" (?JSObjectSetPrivateProperty@@YA_NPBUOpaqueJSContext@@PAUOpaqueJSValue@@PAUOpaqueJSString@@PBU2@@Z)
+            testapi.obj : error LNK2001: unresolved external symbol "struct OpaqueJSValue const * __cdecl JSObjectGetPrivateProperty(struct OpaqueJSContext const *,struct OpaqueJSValue *,struct OpaqueJSString *)" (?JSObjectGetPrivateProperty@@YAPBUOpaqueJSValue@@PBUOpaqueJSContext@@PAU1@PAUOpaqueJSString@@@Z)
+            C:\cygwin\home\buildbot\slave\win-release\build\WebKitBuild\bin\testapi.exe : fatal error LNK1120: 2 unresolved externals
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Added
+        missing symbols to be exported.
+
+2010-03-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Documentation fix for previous patch.
+
+        * API/JSObjectRefPrivate.h:
+
+2010-03-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSC needs an API to allow custom objects to have aprivate GC-accessible properties
+        https://bugs.webkit.org/show_bug.cgi?id=36420
+
+        Add new API methods to support "private" properties on custom
+        objects.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSCallbackObjectData):
+        (JSC::JSCallbackObjectData::~JSCallbackObjectData):
+        (JSC::JSCallbackObjectData::getPrivateProperty):
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::deletePrivateProperty):
+        (JSC::JSCallbackObjectData::markChildren):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::deletePrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::getPrivateProperty):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        (JSC::JSCallbackObject::deletePrivateProperty):
+        (JSC::JSCallbackObject::markChildren):
+        * API/JSObjectRef.cpp:
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        * API/JSObjectRefPrivate.h: Added.
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-03-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fixes after introduction of Brew files.
+
+        * wscript:
+
+2010-03-18  Tom Callaway  <tcallawa@redhat.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 35429: Fix compile on SPARC64
+        https://bugs.webkit.org/show_bug.cgi?id=35429
+
+        * wtf/Platform.h: Set WTF_USE_JSVALUE64 for SPARC64
+
+2010-03-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add API to directly expose JSON parsing
+        https://bugs.webkit.org/show_bug.cgi?id=34887
+
+        Add API to expose JSON parsing directly, and add tests to testapi
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeFromJSONString):
+        (JSValueCreateJSONString):
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.exp:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONStringify):
+        * runtime/JSONObject.h:
+
+2010-03-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler and Mark Rowe.
+
+        Update WebKit availability macros for release after 4.0.
+
+        * API/WebKitAvailability.h:
+
+2010-03-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        undefined, NaN, and Infinity should be ReadOnly
+        https://bugs.webkit.org/show_bug.cgi?id=36263
+
+        Simply add the ReadOnly flag to these properties.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+
+2010-03-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Speed up Math.round a little by removing unneeded special case
+        https://bugs.webkit.org/show_bug.cgi?id=36107
+
+        Test: fast/js/math.html
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncRound): This function had a special case for numbers
+        between -0.5 and -0.0 to return -0.0. But the algorithm in the function
+        already yields -0.0 for those cases, so the extra checking and branching
+        is unneeded.
+
+2010-03-17  Mike Homey  <glandium@debian.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Build fix for SPARC. Fix missing macro value.
+
+        * wtf/Platform.h:
+
+2010-03-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt, Darin Adler.
+
+        Bug 36083 - REGRESSION (r55772-r55834): Crash in JavaScriptCore RegExp code on PowerPC
+
+        The problem is a bug in our port of PCRE - that a read may take place from the first character in an
+        empty string.  For the time being, revert to using a valid pointer in the data segment rather than
+        an invalid non-null pointer into the zero-page for the empty string's data pointer.  A better fix for
+        this will be to remove PCRE.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::empty):
+
+2010-03-16  Darin Adler  <darin@apple.com>
+
+        Rolled out r56081 since it broke the Windows build.
+
+2010-03-16  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove extra <new> include and add guards to operator new/delete definitions
+        https://bugs.webkit.org/show_bug.cgi?id=35967
+
+        Remove extra <new> header include from FastAlloc.cpp since it is included in 
+        FastAlloc.h. Add ENABLE(GLOBAL_FASTMALLOC_NEW) macro guard to operator
+        new/delete/new []/delete [] definitions.
+
+        * wtf/FastMalloc.cpp:
+
+2010-03-15  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add a function to create a BREW instance without local variable declarations.
+        https://bugs.webkit.org/show_bug.cgi?id=34705
+
+        Add a template function to create a BREW instance in one line.
+
+        * wtf/brew/ShellBrew.h: Added.
+        (WTF::createInstance):
+
+2010-03-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Removed a now-incorrect comment I forgot to remove in my last check-in.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavenge):
+
+2010-03-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed a portion of:
+        <rdar://problem/7165917> | https://bugs.webkit.org/show_bug.cgi?id=28676
+        Safari 4 does not release memory back to the operating system fast enough (28676)
+
+        Every few seconds, release a percentage of the minimum unused page count
+        during that time period.
+
+        SunSpider reports no change, command-line or in-browser, Mac or Windows.
+        
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::init):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMalloc_PageHeap::initializeScavenger): Renamed shouldContinueScavenging
+        to shouldScavenge, since scavenging is no longer something that we interrupt.
+
+        (WTF::TCMalloc_PageHeap::scavenge): The new scavenging algorithm. Fixes
+        a bug where the old code would release only one item from each size class
+        per scavenge, potentially leaving large numbers of large-sized objects
+        unreleased for a long time.
+
+        (WTF::TCMalloc_PageHeap::shouldScavenge):
+        (WTF::TCMalloc_PageHeap::New):
+        (WTF::TCMalloc_PageHeap::AllocLarge):
+        (WTF::TCMalloc_PageHeap::Delete):
+        (WTF::TCMalloc_PageHeap::GrowHeap):
+        (WTF::TCMalloc_PageHeap::scavengerThread):
+        (WTF::TCMalloc_PageHeap::periodicScavenge): Updated to track the minimum
+        value of free_committed_pages_ during a given scavenge period.
+
+2010-03-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35843
+        Re-land reverted fix to JSString::getIndex()
+
+        Calling getIndex() on a JSString in rope form may result in a JSException being thrown
+        if there is insuficient memory so value(exec) returns UString() with length zero,
+        which will be passed to jsSingleCharacterSubstring.
+        Add a slow case function to trap the error & return a safe null value, until the
+        exception is handled.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::getIndexSlowCase):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::jsSingleCharacterString):
+        (JSC::JSString::getStringPropertySlot):
+
+2010-03-04  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add a long long version of abs() for MSVC.
+
+        * wtf/MathExtras.h:
+        (abs):
+
+2010-03-15  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Combine ctiTrampolines on ARM and Thumb-2
+        https://bugs.webkit.org/show_bug.cgi?id=36014
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+
+2010-03-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 36075 - Clean up screwyness re static string impls & Identifiers.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass): Classname may be null/empty, and these are an identifer.  This is okay, since the null/empty strings are shared across all threads.
+        * JavaScriptCore.exp:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add): No need to explicitly hash null reps, this is done in the ststic UStringImpl constructor.
+        (JSC::Identifier::addSlowCase): UStringImpl::empty() handled & checkCurrentIdentifierTable now called in the header.
+        (JSC::Identifier::checkCurrentIdentifierTable): Replaces checkSameIdentifierTable (this no longer checked the rep since the identifierTable pointer was removed from UString::Rep long ago).
+        * runtime/Identifier.h:
+        (JSC::Identifier::add): Replace call to checkSameIdentifierTable with call to checkCurrentIdentifierTable at head of function.
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::~UStringImpl): Remove call to checkConsistency - this function no longer checks anything interesting.
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::UStringOrRopeImpl): Set s_refCountFlagIsIdentifier in static constructor.
+        (JSC::UStringImpl::UStringImpl): remove calls to checkConsistency (see above), add new ASSERT to substring constructor.
+        (JSC::UStringImpl::setHash): ASSERT not static (static strings set the hash in their constructor, should not reach this code path).
+        (JSC::UStringImpl::create): Add missing ASSERT.
+        (JSC::UStringImpl::setIsIdentifier): ASSERT !isStatic() (static strings hash set in constructor).
+
+2010-03-12  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by David Levin.
+
+        Two functions tryConsumeCharacter() and tryConsumeCharacterClass() are
+        removed from yarr/RegexInterpreter.cpp because they are never called.
+
+        * yarr/RegexInterpreter.cpp:
+
+2010-03-11  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        The JSNative state was renamed to JSPrimitive. The new name better
+        coresponds to the ECMAScript standard.
+
+        Enum QScriptValuePrivate::States was renamed to State to obey Qt
+        coding style rules ("States" name suggests that a state could
+        mixed together with an other state using bitwise logic operators.
+
+        [Qt] QScriptValuePrivate::States has naming issues
+        https://bugs.webkit.org/show_bug.cgi?id=35968
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::):
+        (QScriptValuePrivate::QScriptValuePrivate):
+        (QScriptValuePrivate::isBool):
+        (QScriptValuePrivate::isNumber):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isString):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toBool):
+        (QScriptValuePrivate::assignEngine):
+        (QScriptValuePrivate::refinedJSValue):
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        Add export.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        Add export.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        Remove nonsense comments used in development & commited in error.
+
+        * runtime/UStringImpl.h:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        Remove export.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36041
+        Remove unnecessary differences in common code between WebCore::StringImpl & JSC::UStringImpl
+
+        Much of the code in WebCore::StringImpl and JSC::UStringImpl is now very similar,
+        but has trivial and unnecessary formatting differences, such as the exact wording
+        of comments, missing ASSERTs, functions implemented in the .h vs .cpp etc.
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add): UStringImpl::empty() now automatically hashes, uas per WebCore strings.
+        (JSC::Identifier::addSlowCase): UStringImpl::empty() now automatically hashes, uas per WebCore strings.
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::~UStringImpl): Only call bufferOwnership() once, add missing ASSERTs.
+        (JSC::UStringImpl::createUninitialized): Move from .h, not commonly called, no need to inline.
+        (JSC::UStringImpl::create): Move from .h, not commonly called, no need to inline.
+        (JSC::UStringImpl::sharedBuffer): Rewritten to more closely match WebCore implementation, remove need for separate baseSharedBuffer() method.
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::UStringImpl): Automatically hash static strings, ASSERT m_data & m_length are non-null/non-zero in non-static strings.
+        (JSC::UStringImpl::setHash): Add missing ASSERT.
+        (JSC::UStringImpl::create): Moved to .cpp / added missing check for empty string creation.
+        (JSC::UStringImpl::adopt): Vector.size() returns size_t, not unsigned.
+        (JSC::UStringImpl::cost): Renamed m_bufferSubstring -> m_substringBuffer
+        (JSC::UStringImpl::hash): Reordered in file.
+        (JSC::UStringImpl::existingHash): Reordered in file.
+        (JSC::UStringImpl::computeHash): Reordered in file, renamed parameter.
+        (JSC::UStringImpl::checkConsistency): rewrote ASSERT.
+        (JSC::UStringImpl::bufferOwnership): Return type should be BufferOwnership.
+        (JSC::UStringImpl::): Moved friends to head of class.
+
+2010-03-11  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by David Kilzer.
+
+        <rdar://problem/7745082> Make it possible to build WebKit for older Mac OS X versions from the current Mac OS X version
+
+        Default to using the appropriate SDK if the target Mac OS X version is not the current Mac OS X version.
+
+        * Configurations/Base.xcconfig:
+
+2010-03-11  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/7745082> Make it possible to build WebKit for older Mac OS X versions from the current Mac OS X version
+
+        Introduce TARGET_MAC_OS_X_VERSION_MAJOR to represent the Mac OS X version that is being targeted.  It defaults to the
+        current Mac OS X version unless otherwise specified.
+
+        Key off TARGET_MAC_OS_X_VERSION_MAJOR where we'd previously been keying off MAC_OS_X_VERSION_MAJOR.
+
+        Explicitly map from the target Mac OS X version to the preferred compiler since Xcode's default compiler choice
+        may not be usable when targetting a different Mac OS X version.
+
+        Key off TARGET_GCC_VERSION rather than MAC_OS_X_VERSION_MAJOR in locations where we'd previously been keying off
+        MAC_OS_X_VERSION_MAJOR but the decision is really related to the compiler version being used.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2010-03-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Sort the project file.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-03-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Sort the project file .
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-03-11  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Buildfix for Thumb-2 after r55684. Add branch8 and branchTest8 functions.
+        https://bugs.webkit.org/show_bug.cgi?id=35892
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::ldrb):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load8):
+        (JSC::MacroAssemblerARMv7::branch8):
+        (JSC::MacroAssemblerARMv7::branchTest8):
+        (JSC::MacroAssemblerARMv7::setTest8):
+
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+        
+        Rename JSC::UStringImpl::data() to characters(), to match WebCore::StringImpl.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::keyForCharacterSwitch):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::processClauseList):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        (JSC::Identifier::addSlowCase):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/UString.cpp:
+        (JSC::UString::toStrictUInt32):
+        (JSC::equal):
+        * runtime/UString.h:
+        (JSC::UString::data):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::characters):
+        (JSC::UStringImpl::hash):
+        (JSC::UStringImpl::setHash):
+
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler, Geoffrey Garen, Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35991
+        Would be faster to not use a thread specific to implement StringImpl::empty()
+
+        Change JSC::UStringImpl's implementation of empty() match to match StringImpl's new implementation
+        (use a static defined within the empty() method), and change the interface to match too (return
+        a pointer not a reference). 
+
+        ~0% performance impact (possible minor progression from moving empty() from .h to .cpp).
+
+        * JavaScriptCore.exp:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::addSlowCase):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        (JSC::UString::UString):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::empty):
+        (JSC::UStringImpl::create):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::adopt):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::tryCreateUninitialized):
+
+2010-03-10  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, fixing Snow Leopard build.
+
+        * wtf/mac/MainThreadMac.mm: Forgot 'static' for a new local function.
+        (WTF::postTimer):
+
+2010-03-10  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make Document::postTask to use a single queue of tasks, to fire them in order
+        https://bugs.webkit.org/show_bug.cgi?id=35943
+
+        The patch uses CFRunLoopTimer to schedule execution of tasks instead of performSelectorOnMainThread which apparently can starve other event sources.
+        The timer is used when the schedule request is coming on the main thread itself. This happens when the task is posted on the main thread or
+        when too many tasks are posted and the queue does 'stop and re-schedule' to make sure run loop has a chance to execute other events.
+
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::timerFired):
+        (WTF::postTimer):
+        (WTF::scheduleDispatchFunctionsOnMainThread): Use timer posted to the current RunLoop if scheduling the task execution while on the main thread.
+
+2010-03-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: added new symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: removed old symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov, Darin Adler, and Sam Weinig.
+
+        Refactored fastCheckConsistency to match some review comments:
+            - renamed fastCheckConsistency to fastMallocSize, and changed ValueCheck
+              to ASSERT that a pointer's fastMallocSize is not 0.
+            - implemented a version of fastMallocSize for tcmalloc.
+            
+        Also moved some pre-existing code around to avoid a problem related to
+        mismatched #define/#undef of malloc/free in this source file.
+
+        * JavaScriptCore.exp:
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocSize): Renamed. Fixed indentation.
+
+        (WTF::TCMalloc_PageHeap::scavenge): Removed an incorrect ASSERT that
+        got in the way of testing the tcmalloc implementation. (More information
+        on why this ASSERT is incorrect is in <rdar://problem/7165917>.)
+
+        (WTF::TCMallocStats::fastMallocSize): Implemented for tcmalloc.
+
+        * wtf/FastMalloc.h: Updated for rename.
+
+        * wtf/ValueCheck.h:
+        (WTF::): Moved the ASSERT that used to be in fastCheckConsistency here.
+
+2010-03-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        Make global new/delete operators configurable for all ports and disable it
+        for the wx port for now.
+
+        * wtf/FastMalloc.h:
+        * wtf/Platform.h:
+
+2010-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (reverting r54510).
+
+        This caused a performance regression, by breaking the code
+        generator's logic to calculate the skip level for resolving
+        variables (traced by rdar:7683350)  Reverting for now.
+
+        * parser/Grammar.y:
+        * parser/NodeConstructors.h:
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ForInNode::ForInNode):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+
+2010-03-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Changed FastMalloc statistics reporting to be a bit clearer. We now
+        report:
+            - Reserved VM Bytes: the VM that has been mapped into the process.
+            - Committed VM Bytes: the subset of Reserved VM Bytes actually in use.
+            - Free List Bytes: the subset of Committed VM Bytes in a free list.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocStatistics):
+        (WTF::TCMallocStats::fastMallocStatistics): Updated to report the statistics
+        above. Standardized use of "ifdef WTF_CHANGES". Added a SpinLockHolder
+        around all statistics gathering, since it reads from the page heap.
+
+        * wtf/FastMalloc.h: Updated to report the statistics above. 
+
+2010-03-09  Gabor Loki  <loki@webkit.org>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Buildfix for ARM after r55684. Add branch8 and branchTest8 functions.
+        https://bugs.webkit.org/show_bug.cgi?id=35892
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::dataTransfer32):
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load8):
+        (JSC::MacroAssemblerARM::branch8):
+        (JSC::MacroAssemblerARM::branchTest8):
+
+2010-03-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: 'P' is not a type. Luckily, 'void' is.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastCheckConsistency):
+
+2010-03-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: export a new symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Switching malloc implementations requires a world rebuild
+        https://bugs.webkit.org/show_bug.cgi?id=35899
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastCheckConsistency):
+        (WTF::TCMallocStats::fastCheckConsistency):
+        * wtf/FastMalloc.h:
+        * wtf/ValueCheck.h:
+        (WTF::): Moved pointer checking into a helper function in FastMalloc.cpp,
+        so you can switch malloc implementations without rebuilding the world.
+
+2010-03-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        TypeInfo is unnecessarily large
+        https://bugs.webkit.org/show_bug.cgi?id=35850
+
+        Reduce the size of the type and flags members to a single
+        byte each, reducing the size of Structure by 8 bytes.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branch8):
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        (JSC::MacroAssemblerX86Common::setTest8):
+          Add single byte branches, and correct setTest8 to do a
+          single byte read from memory, and actually store the result
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::cmpb_im):
+        (JSC::X86Assembler::testb_im):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_construct_verify):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::type):
+
+2010-03-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (reverting regression).
+
+        Reverting 55035, this caused a regression.
+        (https://bugs.webkit.org/show_bug.cgi?id=35843)
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/UStringImpl.cpp:
+        * runtime/UStringImpl.h:
+
+2010-03-08  Stuart Morgan  <stuartmorgan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Added a new USE definition for secure text mode on the Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=31265
+
+        * wtf/Platform.h:
+
+2010-03-08  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Blob.slice support.
+        https://bugs.webkit.org/show_bug.cgi?id=32993
+
+        Add ENABLE_BLOB_SLICE feature define.
+        Also fix a problem that JSValue.toInteger is not exposed on Windows.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-07  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Small performance fix in the QScriptConverter::toString().
+
+        The QByteArray was replaced by the QVarLengthArray which doesn't
+        have to allocate any memory on heap.
+
+        [Qt] QScriptConverter::toString() should use QVarLengthArray instead of QByteArray
+        https://bugs.webkit.org/show_bug.cgi?id=35577
+
+        * qt/api/qscriptconverter_p.h:
+        (QScriptConverter::toString):
+
+2010-03-06  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Remove unnecessary includes of wtf/Platform.h.  This is already pulled in by config.h.
+
+        * API/APICast.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        * API/JSValueRef.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/AssemblerBuffer.h:
+        * assembler/AssemblerBufferWithConstantPool.h:
+        * assembler/CodeLocation.h:
+        * assembler/LinkBuffer.h:
+        * assembler/MIPSAssembler.h:
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        * assembler/MacroAssemblerMIPS.h:
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/RepatchBuffer.h:
+        * assembler/X86Assembler.h:
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        * jit/JITInlineMethods.h:
+        * jit/JITStubs.h:
+        * os-win32/stdint.h:
+        * runtime/JSAPIValueWrapper.h:
+        * runtime/JSImmediate.h:
+        * wtf/ASCIICType.h:
+        * wtf/StdLibExtras.h:
+        * wtf/VMTags.h:
+        * yarr/RegexCompiler.h:
+        * yarr/RegexInterpreter.h:
+        * yarr/RegexJIT.h:
+        * yarr/RegexParser.h:
+        * yarr/RegexPattern.h:
+
+2010-03-06  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Share OwnPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=35776
+
+        Share OwnPtr implementation with BREW MP and remove OwnPtrBrew.
+
+        * wtf/OwnPtrBrew.cpp: Added.
+        (WTF::deleteOwnedPtr):
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.cpp: Removed.
+        * wtf/brew/OwnPtrBrew.h: Removed.
+
+2010-03-06  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        Implemented JIT_OPTIMIZE_NATIVE_CALL for WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=33426
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+
+2010-03-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Add enw exports to windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JSC should cache int to Identifier conversion as it does for ordinary strings
+        https://bugs.webkit.org/show_bug.cgi?id=35814
+
+        Make the NumericStrings cache cache unsigned ints in addition to signed.
+        We keep them separate from the int cache as it both simplifies code, and
+        also because the unsigned path is exclusive to property access and therefore
+        seems to have different usage patterns.
+
+        The primary trigger for the unsigned to Identifier propertyName conversion
+        is the construction of array-like objects out of normal objects.  Given these
+        tend to be relative small numbers, and the array-like behaviour lends itself
+        to sequential values this patch also adds a non-colliding cache for all small
+        numbers.
+
+        * JavaScriptCore.exp:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::from):
+        * runtime/Identifier.h:
+        * runtime/NumericStrings.h:
+        (JSC::NumericStrings::add):
+        (JSC::NumericStrings::lookup):
+        (JSC::NumericStrings::lookupSmallString):
+
+2010-03-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Allow static property getters to interact with JSCs caching
+        https://bugs.webkit.org/show_bug.cgi?id=35716
+
+        Add new opcodes for handling cached lookup of static value getters.
+        More or less the same as with JS getters, all that changes is that
+        instead of calling through a JSFunction we always know that we have
+        a C function to call.
+
+        For the patching routines in the JIT we now need to pass a few
+        new parameters to allow us to pass enough information to the stub
+        function to allow us to call the C function correctly.  Logically
+        this shouldn't actually be necessary as all of these functions ignore
+        the identifier, but removing the ident parameter would require
+        somewhat involved changes to the way we implement getOwnPropertySlot,
+        etc.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        (JSC::Instruction::):
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticValueSlot):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::):
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::cachedPropertyType):
+        (JSC::PropertySlot::isCacheable):
+        (JSC::PropertySlot::isCacheableValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setCacheableCustom):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        (JSC::PropertySlot::clearOffset):
+        (JSC::PropertySlot::customGetter):
+
+2010-03-04  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed. Remove a non-ASCII character introduced in the following bug.
+
+        put_by_id does will incorrectly cache writes where a specific value exists, where at the point of caching the same value is being written.
+        https://bugs.webkit.org/show_bug.cgi?id=35537
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+
+2010-03-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make the OUTPUT_DIR variable in qmake projects independent of build-webkit's logic.
+
+        This also allows shadow builds relying only on qmake to work properly.
+        * jsc.pro:
+        * qt/api/QtScript.pro:
+        * qt/tests/qscriptengine/qscriptengine.pro:
+        * qt/tests/qscriptvalue/qscriptvalue.pro:
+        * qt/tests/tests.pri:
+
+2010-03-03  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        QScriptValue::isObject fix.
+
+        Fix broken internal state evaluation from JSValue to JSNative / JSObject.
+        New function was introduced which should take care about promoting
+        JSValue state inside QScriptValuePrivate. It should be used instead of a
+        direct JSC C API call.
+
+        The bug exposed a weakness in autotest suite, as the QScriptValuePrivate
+        is based on state machine with lazy state evaluation, there is a possibility
+        that serial sequencial calls to the same public const function could return
+        different results. The patch fix the issue.
+
+        [Qt] Sometimes QScriptValue::isObject returns an incorrect value
+        https://bugs.webkit.org/show_bug.cgi?id=35387
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::isBool):
+        (QScriptValuePrivate::isNumber):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isString):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::isError):
+        (QScriptValuePrivate::isObject):
+        (QScriptValuePrivate::isFunction):
+        (QScriptValuePrivate::call):
+        (QScriptValuePrivate::refineJSValue):
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::initScriptValues):
+        (tst_QScriptValue::isValid_makeData):
+        (tst_QScriptValue::isValid_test):
+        (tst_QScriptValue::isBool_makeData):
+        (tst_QScriptValue::isBool_test):
+        (tst_QScriptValue::isBoolean_makeData):
+        (tst_QScriptValue::isBoolean_test):
+        (tst_QScriptValue::isNumber_makeData):
+        (tst_QScriptValue::isNumber_test):
+        (tst_QScriptValue::isFunction_test):
+        (tst_QScriptValue::isNull_makeData):
+        (tst_QScriptValue::isNull_test):
+        (tst_QScriptValue::isString_makeData):
+        (tst_QScriptValue::isString_test):
+        (tst_QScriptValue::isUndefined_makeData):
+        (tst_QScriptValue::isUndefined_test):
+        (tst_QScriptValue::isObject_makeData):
+        (tst_QScriptValue::isObject_test):
+        (tst_QScriptValue::toString_makeData):
+        (tst_QScriptValue::toString_test):
+        (tst_QScriptValue::toNumber_makeData):
+        (tst_QScriptValue::toNumber_test):
+        (tst_QScriptValue::toBool_makeData):
+        (tst_QScriptValue::toBool_test):
+        (tst_QScriptValue::toBoolean_makeData):
+        (tst_QScriptValue::toBoolean_test):
+        (tst_QScriptValue::toInteger_makeData):
+        (tst_QScriptValue::toInteger_test):
+        (tst_QScriptValue::toInt32_makeData):
+        (tst_QScriptValue::toInt32_test):
+        (tst_QScriptValue::toUInt32_makeData):
+        (tst_QScriptValue::toUInt32_test):
+        (tst_QScriptValue::toUInt16_makeData):
+        (tst_QScriptValue::toUInt16_test):
+
+2010-03-03  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Gavin Barraclough.
+
+        MIPS JIT Supports
+        https://bugs.webkit.org/show_bug.cgi?id=30144
+
+        The following changes enable MIPS YARR and YARR_JIT.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MIPSAssembler.h: Added.
+        (JSC::MIPSRegisters::):
+        (JSC::MIPSAssembler::MIPSAssembler):
+        (JSC::MIPSAssembler::):
+        (JSC::MIPSAssembler::JmpSrc::JmpSrc):
+        (JSC::MIPSAssembler::JmpDst::JmpDst):
+        (JSC::MIPSAssembler::JmpDst::isUsed):
+        (JSC::MIPSAssembler::JmpDst::used):
+        (JSC::MIPSAssembler::emitInst):
+        (JSC::MIPSAssembler::nop):
+        (JSC::MIPSAssembler::loadDelayNop):
+        (JSC::MIPSAssembler::copDelayNop):
+        (JSC::MIPSAssembler::move):
+        (JSC::MIPSAssembler::li):
+        (JSC::MIPSAssembler::lui):
+        (JSC::MIPSAssembler::addiu):
+        (JSC::MIPSAssembler::addu):
+        (JSC::MIPSAssembler::subu):
+        (JSC::MIPSAssembler::mult):
+        (JSC::MIPSAssembler::mfhi):
+        (JSC::MIPSAssembler::mflo):
+        (JSC::MIPSAssembler::mul):
+        (JSC::MIPSAssembler::andInsn):
+        (JSC::MIPSAssembler::andi):
+        (JSC::MIPSAssembler::nor):
+        (JSC::MIPSAssembler::orInsn):
+        (JSC::MIPSAssembler::ori):
+        (JSC::MIPSAssembler::xorInsn):
+        (JSC::MIPSAssembler::xori):
+        (JSC::MIPSAssembler::slt):
+        (JSC::MIPSAssembler::sltu):
+        (JSC::MIPSAssembler::sltiu):
+        (JSC::MIPSAssembler::sll):
+        (JSC::MIPSAssembler::sllv):
+        (JSC::MIPSAssembler::sra):
+        (JSC::MIPSAssembler::srav):
+        (JSC::MIPSAssembler::lw):
+        (JSC::MIPSAssembler::lwl):
+        (JSC::MIPSAssembler::lwr):
+        (JSC::MIPSAssembler::lhu):
+        (JSC::MIPSAssembler::sw):
+        (JSC::MIPSAssembler::jr):
+        (JSC::MIPSAssembler::jalr):
+        (JSC::MIPSAssembler::jal):
+        (JSC::MIPSAssembler::bkpt):
+        (JSC::MIPSAssembler::bgez):
+        (JSC::MIPSAssembler::bltz):
+        (JSC::MIPSAssembler::beq):
+        (JSC::MIPSAssembler::bne):
+        (JSC::MIPSAssembler::bc1t):
+        (JSC::MIPSAssembler::bc1f):
+        (JSC::MIPSAssembler::newJmpSrc):
+        (JSC::MIPSAssembler::appendJump):
+        (JSC::MIPSAssembler::addd):
+        (JSC::MIPSAssembler::subd):
+        (JSC::MIPSAssembler::muld):
+        (JSC::MIPSAssembler::lwc1):
+        (JSC::MIPSAssembler::ldc1):
+        (JSC::MIPSAssembler::swc1):
+        (JSC::MIPSAssembler::sdc1):
+        (JSC::MIPSAssembler::mtc1):
+        (JSC::MIPSAssembler::mfc1):
+        (JSC::MIPSAssembler::truncwd):
+        (JSC::MIPSAssembler::cvtdw):
+        (JSC::MIPSAssembler::ceqd):
+        (JSC::MIPSAssembler::cngtd):
+        (JSC::MIPSAssembler::cnged):
+        (JSC::MIPSAssembler::cltd):
+        (JSC::MIPSAssembler::cled):
+        (JSC::MIPSAssembler::cueqd):
+        (JSC::MIPSAssembler::coled):
+        (JSC::MIPSAssembler::coltd):
+        (JSC::MIPSAssembler::culed):
+        (JSC::MIPSAssembler::cultd):
+        (JSC::MIPSAssembler::label):
+        (JSC::MIPSAssembler::align):
+        (JSC::MIPSAssembler::getRelocatedAddress):
+        (JSC::MIPSAssembler::getDifferenceBetweenLabels):
+        (JSC::MIPSAssembler::size):
+        (JSC::MIPSAssembler::executableCopy):
+        (JSC::MIPSAssembler::getCallReturnOffset):
+        (JSC::MIPSAssembler::linkJump):
+        (JSC::MIPSAssembler::linkCall):
+        (JSC::MIPSAssembler::linkPointer):
+        (JSC::MIPSAssembler::relinkJump):
+        (JSC::MIPSAssembler::relinkCall):
+        (JSC::MIPSAssembler::repatchInt32):
+        (JSC::MIPSAssembler::repatchPointer):
+        (JSC::MIPSAssembler::repatchLoadPtrToLEA):
+        (JSC::MIPSAssembler::relocateJumps):
+        (JSC::MIPSAssembler::linkWithOffset):
+        (JSC::MIPSAssembler::linkCallInternal):
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerMIPS.h: Added.
+        (JSC::MacroAssemblerMIPS::MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::):
+        (JSC::MacroAssemblerMIPS::add32):
+        (JSC::MacroAssemblerMIPS::and32):
+        (JSC::MacroAssemblerMIPS::lshift32):
+        (JSC::MacroAssemblerMIPS::mul32):
+        (JSC::MacroAssemblerMIPS::not32):
+        (JSC::MacroAssemblerMIPS::or32):
+        (JSC::MacroAssemblerMIPS::rshift32):
+        (JSC::MacroAssemblerMIPS::sub32):
+        (JSC::MacroAssemblerMIPS::xor32):
+        (JSC::MacroAssemblerMIPS::load32):
+        (JSC::MacroAssemblerMIPS::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerMIPS::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::loadPtrWithPatchToLEA):
+        (JSC::MacroAssemblerMIPS::loadPtrWithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::load16):
+        (JSC::MacroAssemblerMIPS::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::store32):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPoint):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerMIPS::pop):
+        (JSC::MacroAssemblerMIPS::push):
+        (JSC::MacroAssemblerMIPS::move):
+        (JSC::MacroAssemblerMIPS::swap):
+        (JSC::MacroAssemblerMIPS::signExtend32ToPtr):
+        (JSC::MacroAssemblerMIPS::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerMIPS::branch32):
+        (JSC::MacroAssemblerMIPS::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerMIPS::branch16):
+        (JSC::MacroAssemblerMIPS::branchTest32):
+        (JSC::MacroAssemblerMIPS::jump):
+        (JSC::MacroAssemblerMIPS::branchAdd32):
+        (JSC::MacroAssemblerMIPS::branchMul32):
+        (JSC::MacroAssemblerMIPS::branchSub32):
+        (JSC::MacroAssemblerMIPS::breakpoint):
+        (JSC::MacroAssemblerMIPS::nearCall):
+        (JSC::MacroAssemblerMIPS::call):
+        (JSC::MacroAssemblerMIPS::ret):
+        (JSC::MacroAssemblerMIPS::set32):
+        (JSC::MacroAssemblerMIPS::setTest32):
+        (JSC::MacroAssemblerMIPS::moveWithPatch):
+        (JSC::MacroAssemblerMIPS::branchPtrWithPatch):
+        (JSC::MacroAssemblerMIPS::storePtrWithPatch):
+        (JSC::MacroAssemblerMIPS::tailRecursiveCall):
+        (JSC::MacroAssemblerMIPS::makeTailRecursiveCall):
+        (JSC::MacroAssemblerMIPS::loadDouble):
+        (JSC::MacroAssemblerMIPS::storeDouble):
+        (JSC::MacroAssemblerMIPS::addDouble):
+        (JSC::MacroAssemblerMIPS::subDouble):
+        (JSC::MacroAssemblerMIPS::mulDouble):
+        (JSC::MacroAssemblerMIPS::convertInt32ToDouble):
+        (JSC::MacroAssemblerMIPS::insertRelaxationWords):
+        (JSC::MacroAssemblerMIPS::branchTrue):
+        (JSC::MacroAssemblerMIPS::branchFalse):
+        (JSC::MacroAssemblerMIPS::branchEqual):
+        (JSC::MacroAssemblerMIPS::branchNotEqual):
+        (JSC::MacroAssemblerMIPS::branchDouble):
+        (JSC::MacroAssemblerMIPS::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerMIPS::linkCall):
+        (JSC::MacroAssemblerMIPS::repatchCall):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+
+2010-03-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+
+2010-03-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2010-03-03  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add virtual memory tags for TCMalloc and WebCore's purgeable buffers.
+
+        * wtf/TCSystemAlloc.cpp:
+        (TryMmap): Use the VM tag.
+        * wtf/VMTags.h: Make use of VM_MEMORY_TCMALLOC and VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS.
+
+2010-03-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber stamped by Adam Roben.
+
+        Fix bogus xcopy that was polluting source tree at build time.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+
+2010-03-02  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Oliver Hunt.
+
+        Allow building smoothly on win32 and win64 using GCC
+        https://bugs.webkit.org/show_bug.cgi?id=35607
+
+        * jit/JITStubs.h:
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::currentThreadStackBase):
+
+2010-03-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by David Levin.
+
+        Revert database thread changes that are no longer required
+        https://bugs.webkit.org/show_bug.cgi?id=35519
+
+        Jochen Eisinger created 55214 and 55247 to track which database
+        owns which thread.  Dmitry suggested that this could also
+        be done via TLS, though.  After exploring the options, Jochen
+        chose to go the TLS route, so these patches are no longer needed.
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::isMainThread):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::createThreadInternal):
+
+2010-03-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::toString().
+
+        More ECMA Script compliance, especially for values as NaN, Inifinite
+        and really big/small numbers.
+
+        [Qt] QScriptValue::toString() returns incorrect values
+        https://bugs.webkit.org/show_bug.cgi?id=34850
+
+        * qt/api/qscriptconverter_p.h:
+        (QScriptConverter::toString):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toString):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toString_initData):
+        (tst_QScriptValue::toString_makeData):
+        (tst_QScriptValue::toString_test):
+
+2010-03-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Introduce a new class; QScriptString.
+
+        The QScriptString class should act as a handle to "interned"
+        strings in a QScriptEngine.
+
+        [Qt] QtScript should provide QScriptString
+        https://bugs.webkit.org/show_bug.cgi?id=34843
+
+        * qt/api/QtScript.pro:
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::toStringHandle):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.h:
+        (QScriptEnginePrivate::toStringHandle):
+        * qt/api/qscriptstring.cpp: Added.
+        (QScriptString::QScriptString):
+        (QScriptString::~QScriptString):
+        (QScriptString::operator=):
+        (QScriptString::isValid):
+        (QScriptString::operator==):
+        (QScriptString::operator!=):
+        (QScriptString::toArrayIndex):
+        (QScriptString::toString):
+        (QScriptString::operator QString):
+        (qHash):
+        * qt/api/qscriptstring.h: Added.
+        * qt/api/qscriptstring_p.h: Added.
+        (QScriptStringPrivate::QScriptStringPrivate):
+        (QScriptStringPrivate::~QScriptStringPrivate):
+        (QScriptStringPrivate::get):
+        (QScriptStringPrivate::isValid):
+        (QScriptStringPrivate::operator==):
+        (QScriptStringPrivate::operator!=):
+        (QScriptStringPrivate::toArrayIndex):
+        (QScriptStringPrivate::toString):
+        (QScriptStringPrivate::id):
+        * qt/tests/qscriptstring/qscriptstring.pro: Added.
+        * qt/tests/qscriptstring/tst_qscriptstring.cpp: Added.
+        (tst_QScriptString::tst_QScriptString):
+        (tst_QScriptString::~tst_QScriptString):
+        (tst_QScriptString::test):
+        (tst_QScriptString::hash):
+        (tst_QScriptString::toArrayIndex_data):
+        (tst_QScriptString::toArrayIndex):
+        * qt/tests/tests.pro:
+
+2010-03-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Export function on windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Refactor named getter function signature to be in line with indexing getter signature
+        https://bugs.webkit.org/show_bug.cgi?id=35563
+
+        This removes the PropertySlot argument from getter functions, and makes them directly
+        pass the slot base.  This makes the semantics for the functions match that of the
+        indexing getters.
+
+        On the down side, this means that we can no longer simply use a proxy function for
+        JS getters, so we now add another marker value to indicate that a getter is present
+        and branch accordingly.
+
+        Against all rationality sunspider reports this as a perf win, but i suspect it's just noise.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::staticValueGetter):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * JavaScriptCore.exp:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        * runtime/JSFunction.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+        (JSC::regExpObjectLastIndex):
+
+2010-03-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        PropertySlot::getValue(ExecState, unsigned) unnecessarily converts index to an Identifier
+        https://bugs.webkit.org/show_bug.cgi?id=35561
+
+        Fix this by defining a separate property getter function for index getters.  This allows
+        us to pass an unsigned number without the conversion to an Identifier.  We then update
+        setCustomIndex to take this new getter type.
+
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::setCustom):
+        (JSC::PropertySlot::setCustomIndex):
+
+2010-03-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 35537 - put_by_id does will incorrectly cache writes where a specific value exists,
+                    where at the point of caching the same value is being written.
+
+        When performing a put_by_id that is replacing a property already present on the object,
+        there are three interesting cases regarding the state of the specific value:
+
+        (1) No specific value set - nothing to do, leave the structure in it's current state,
+            can cache.
+        (2) A specific value was set, the new put is not of a specified value (i.e. function),
+            or is of a different specific value - in these cases we need to perform a despecifying
+            transition to clear the specific value in the structure, but having done so this is a
+            normal property so as such we can again cache normally.
+        (3) A specific value was set, and we are overwriting with the same value - in these cases
+            leave the structure unchanged, but since a specific value is set we cannot cache this
+            put (we would need the JIT to dynamically check the value being written matched).
+
+        Unfortunately, the current behaviour does not match this.  the checks for a specific value
+        being present & the value matching are combined in such a way that in case (2), above we
+        will unnecessarily prevent the transition being cached, but in case (3) we will incorrectly
+        fail to prevent caching.
+
+        The bug exposes itself if multiple puts of the same specific value are performed to a
+        property, and erroneously the put is allowed to be cached by the JIT.  Method checks may be
+        generated caching calls of this structure.  Subsequent puts performed from JIT code may
+        write different values without triggering a despecify transition, and as such cached method
+        checks will continue to pass, despite the value having changed.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+
+2010-03-01  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build on Mac OS X/Cocoa 64-bit
+
+        * JavaScriptCore.pri: Add missing implementation file to resolve JSC symbols
+
+2010-02-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Geoff Garen.
+
+        Remove wrec.  All builds should have switched to yarr by now.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * wrec: Removed.
+        * wrec/CharacterClass.cpp: Removed.
+        * wrec/CharacterClass.h: Removed.
+        * wrec/CharacterClassConstructor.cpp: Removed.
+        * wrec/CharacterClassConstructor.h: Removed.
+        * wrec/Escapes.h: Removed.
+        * wrec/Quantifier.h: Removed.
+        * wrec/WREC.cpp: Removed.
+        * wrec/WREC.h: Removed.
+        * wrec/WRECFunctors.cpp: Removed.
+        * wrec/WRECFunctors.h: Removed.
+        * wrec/WRECGenerator.cpp: Removed.
+        * wrec/WRECGenerator.h: Removed.
+        * wrec/WRECParser.cpp: Removed.
+        * wrec/WRECParser.h: Removed.
+        * wscript:
+
+2010-02-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make the lookup table generator include an explicit cast to expected
+        type of the function.  We do this because otherwise the blind intptr_t
+        cast that is subsequently applied allows incorrectly typed functions
+        to be inserted into the table, where they will only fail at runtime.
+        This change makes such errors produce a compile time failure.
+
+        * create_hash_table:
+
+2010-02-26  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Symbian specific getCPUTime implemetation
+        https://bugs.webkit.org/show_bug.cgi?id=34742
+
+        Default implementation doesn't work on Symbian devices.
+        This change adds a proper implementation by
+        asking thread execution time from the current thread.
+
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35406
+        <rdar://problem/6945502> Make generic array methods work with JavaArray
+
+        Renamed lazyCreationData to subclassData. This is extra data that can be used by JSArray
+        subclasses (you can't add new data members, because it wouldn't fit in JSCell otherwise).
+
+        * JavaScriptCore.exp:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::subclassData):
+        (JSC::JSArray::setSubclassData):
+        * runtime/JSArray.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::~RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::fillArrayInstance):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertySlot):
+        (JSC::RegExpMatchesArray::getOwnPropertyDescriptor):
+        (JSC::RegExpMatchesArray::put):
+        (JSC::RegExpMatchesArray::deleteProperty):
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+
+2010-02-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        JSC crashes like crazy in the JSPropertyNameIterator destructor
+
+        Add back null check of m_cachedStructure.  Curse last minute changes.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+
+2010-02-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Race condition in JSPropertyNameIterator and Structure destruction
+        https://bugs.webkit.org/show_bug.cgi?id=35398
+
+        JSPropertyNameIterator and Structure have a cyclic dependency that they
+        manage by clearing the appropriate reference in each other during their
+        destruction.  However if the Structure is destroyed while the 
+        JSPropertyNameIterator is dead but not yet finalized the Structures
+        WeakGCPtr will return null, and so prevent Structure from clearing
+        the m_cachedStructure pointer of the iterator.  When the iterator is
+        then finalised the m_cachedStructure is invalid, and the attempt to
+        clear the structures back reference fails.
+
+        To fix this we simply make JSPropertyNameIterator keep the Structure
+        alive, using the weak pointer to break the ref cycle.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+          The iterator now keeps m_cachedStructure alive itself, so no longer needs
+          to check for it being cleared
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::setCachedStructure):
+          Add an assertion to ensure correct usage
+        (JSC::JSPropertyNameIterator::cachedStructure):
+          Add .get()
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+          Add an assertion that our iterator isn't already dead, and remove
+          the now unnecessary attempt to clear the ref in the iterator
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::hasDeadObject):
+          An assert-only function to allow us to assert correct behaviour
+          in the Structure destructor
+
+2010-02-25  Jochen Eisinger  <jochen@chromium.org>
+ 
+        Reviewed by Jeremy Orlow.
+ 
+        Make the context that was passed to the ThreadFunction accessible.
+        https://bugs.webkit.org/show_bug.cgi?id=35379
+
+        When a database is opened, right now you
+        don't have any context from where it is opened. The problem is that
+        the actual calls that open a database go through the sqlite3 vfs
+        layer, so there's no easy way to pass this function down to to
+        platform/sql/chromium/SQLFileSystemChromium*.cpp
+
+        This patch will allow you to get from anywhere within webkit a pointer
+        to the Thread object that actually created the thread you're currently
+        on (in case of the database, this can be either a thread forked of
+        from the main thread or from a worker thread), and query the object
+        for context information.
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::threadContext):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        (WTF::threadContext):
+        * wtf/ThreadingWin.cpp:
+        (WTF::):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::threadContext):
+
+2010-02-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reverting to re-submit with better change log.
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::isMainThread):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::createThreadInternal):
+
+2010-02-25  Jochen Eisinger  <jochen@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Make the context that was passed to the ThreadFunction accessible.
+        https://bugs.webkit.org/show_bug.cgi?id=35379
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::threadContext):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        (WTF::threadContext):
+        * wtf/ThreadingWin.cpp:
+        (WTF::):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::threadContext):
+
+2010-02-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [REGRESSION in r55185] EXC_BAD_ACCESS on opening inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=35335
+
+        compileGetDirectOffset modifies the contents of the object register
+        when the object is not using the inline storage array.  As the object
+        register contains our 'this' pointer we can't allow it to be clobbered.
+        The fix is simply to copy the register into a separate scratch register
+        when we're loading off an object that doesn't use inline storage.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdSelfList):
+
+2010-02-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Speed up getter performance in the jit
+        https://bugs.webkit.org/show_bug.cgi?id=35332
+
+        Implement getter lookup caching in the interpreter.
+        The getter stubs are generated through basically the
+        same code paths as the normal get_by_id caching.
+        Instead of simply loading a property and returning,
+        we load the getter slot, and pass the getter, base value
+        and return address to a shared stub used for getter
+        dispatch.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/GetterSetter.h:
+
+2010-02-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Web Inspector: Regression: r55027+: Inspector broken
+        https://bugs.webkit.org/show_bug.cgi?id=35253
+
+        op_get_by_id_getter_chain was not passing the correct this parameter.
+        The bug was caused by incorrect use of baseCell instead of baseValue,
+        baseValue contains the original object for the lookup (and hence the
+        correct this object), baseCell is clobbered as part of walking the
+        prototype chain.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-02-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Rubber-stamped by Dimitri Glazkov.
+
+        Chromium build fix.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Changes references of GOwnPtr to reflect their new place.
+        http://webkit.org/b/35084
+
+        * JavaScriptCore/JavaScriptCore.gypi:
+        * JavaScriptCore/wtf/Threading.h:
+        * JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h:
+
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Adding the EFL implementation of JavaScriptCore.
+        See https://bugs.webkit.org/show_bug.cgi?id=35084 for details.
+
+        * GNUmakefile.am: Updated to reflect the new location of GOwnPtr and
+                          GRefPtr.
+        * wtf/efl/MainThreadEfl.cpp: Added.
+        * wtf/gobject/GOwnPtr.cpp: Moved from wtf/gtk.
+        * wtf/gobject/GOwnPtr.h: Moved from wtf/gtk.
+        * wtf/gobject/GRefPtr.cpp: Moved from wtf/gtk.
+        * wtf/gobject/GRefPtr.h: Moved from wtf/gtk.
+
+2010-02-22  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove auto_ptr usage in JavaScriptCore.
+        https://bugs.webkit.org/show_bug.cgi?id=35221
+
+        * parser/Nodes.h: Removed now unneeded adopt method.
+        * parser/Parser.cpp: Removed <memory> include as it is not required anymore.
+        * wtf/OwnPtr.h: Removed the constructor from auto_ptr.
+        * wtf/VectorTraits.h: Removed a template specialization for auto_ptr.
+        * wtf/unicode/Collator.h: Made userDefault return a PassOwnPtr.
+        * wtf/unicode/CollatorDefault.cpp:
+        (WTF::Collator::userDefault): Changed the method to match the next signature.
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault): Ditto.
+
+2010-02-22  Huahui Wu  <hwu@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Add code that enables SquirrelFish Extreme (a.k.a JSCX, JSC JIT)
+        in Android. It's disabled by default, but is enabled when the 
+        enveronment variable ENABLE_JSC_JIT is set to true.
+        https://bugs.webkit.org/show_bug.cgi?id=34855
+
+        * Android.mk:
+        * wtf/Platform.h:
+
+2010-02-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSStringBuilder should not CRASH if allocation fails, it should throw a JSException.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::JSStringBuilder):
+        (JSC::JSStringBuilder::append):
+        (JSC::JSStringBuilder::build):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::build):
+        * wtf/Vector.h:
+        (WTF::VectorBufferBase::tryAllocateBuffer):
+        (WTF::):
+        (WTF::VectorBuffer::tryAllocateBuffer):
+        (WTF::::tryExpandCapacity):
+        (WTF::::tryReserveCapacity):
+        (WTF::::tryAppend):
+
+2010-02-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Map FastMalloc to BREW memory allocator
+        https://bugs.webkit.org/show_bug.cgi?id=33570
+
+        Use MALLOC macro instead of the standard malloc function.
+        Although RVCT provides malloc, we can't use it in BREW
+        because the loader does not initialize the base address properly.
+
+        * wtf/FastMalloc.cpp:
+        * wtf/brew/SystemMallocBrew.h: Added.
+        (mallocBrew):
+        (callocBrew):
+        (freeBrew):
+        (reallocBrew):
+
+2010-02-22  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Build fix for make distcheck.
+
+        * GNUmakefile.am:
+
+2010-02-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        [Qt] Build fix for RVCT.
+
+        Fix after r55024. The "-i" option is for perl not for the
+        script.
+
+        * DerivedSources.pro:
+
+2010-02-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make UString::m_data be const, and make the UChar owned/ref-counted by CrossThreadRefCounted be const too.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::data):
+        (JSC::UStringImpl::UStringImpl):
+        * wtf/OwnFastMallocPtr.h:
+        (WTF::OwnFastMallocPtr::~OwnFastMallocPtr):
+
+2010-02-21  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HashMapTranslatorAdapter::translate() needs to set the mapped value.
+
+        HTTPHeaderMap::add(const char*, const String&) does not work
+        https://bugs.webkit.org/show_bug.cgi?id=35227
+
+        * wtf/HashMap.h:
+        (WTF::HashMapTranslatorAdapter::translate):
+
+2010-02-19  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by David Levin.
+
+        Add an ENABLE flag for sandboxed iframes to make it possible to disable it in releases
+        https://bugs.webkit.org/show_bug.cgi?id=35147
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-02-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSString::getIndex() calls value() to resolve the string value (is a rope)
+        to a UString, then passes the result to jsSingleCharacterSubstring without
+        checking for an exception.  In case of out-of-memory the returned UString
+        is null(), which may result in an out-of-buounds substring being created.
+        This is bad.
+
+        Simple fix is to be able to get an index from a rope without resolving to
+        UString.  This may be a useful optimization in some test cases.
+
+        The same bug exists in some other methods is JSString, these can be fixed
+        by changing them to call getIndex().
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::jsSingleCharacterString):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/UStringImpl.cpp:
+        (JSC::singleCharacterSubstring):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::singleCharacterSubstring):
+
+2010-02-19  Oliver Hunt  <oliver@apple.com>
+
+        RS = Gavin Barraclough.
+
+        Split the 32/64 version of JITPropertyAccess into a separate file.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp: Added.
+        (JSC::JIT::emit_op_put_by_index):
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emitSlow_op_method_check):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchMethodCallProto):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emitSlow_op_get_by_pname):
+
+2010-02-19  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Added additional parameter to create_rvct_stubs 
+        for setting the regularexpression prefix.
+        Renamed it because it now works for other platforms too.
+        https://bugs.webkit.org/show_bug.cgi?id=34951
+
+        * DerivedSources.pro:
+        * create_jit_stubs: Copied from JavaScriptCore/create_rvct_stubs.
+        * create_rvct_stubs: Removed.
+
+2010-02-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve interpreter getter performance
+        https://bugs.webkit.org/show_bug.cgi?id=35138
+
+        Improve the performance of getter dispatch by making it possible
+        for the interpreter to cache the GetterSetter object lookup.
+
+        To do this we simply need to make PropertySlot aware of getters
+        as a potentially cacheable property, and record the base and this
+        objects for a getter access.  This allows us to use more-or-less
+        identical code to that used by the normal get_by_id caching, with
+        the dispatch being the only actual difference.
+
+        I'm holding off of implementing this in the JIT until I do some
+        cleanup to try and making coding in the JIT not be as horrible
+        as it is currently.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::fillGetterPropertySlot):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::isGetter):
+        (JSC::PropertySlot::isCacheable):
+        (JSC::PropertySlot::isCacheableValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        (JSC::PropertySlot::clearOffset):
+        (JSC::PropertySlot::thisValue):
+
+2010-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a portion of:
+        <rdar://problem/7165917> | https://bugs.webkit.org/show_bug.cgi?id=28676
+        Safari 4 does not release memory back to the operating system fast enough (28676)
+        
+        This patch fixes a surprisingly common edge case in which the page heap
+        would have only one free span, but that span would be larger than the
+        minimum free size, so we would decide not to free it, even though it
+        could be as large as 100MB or more!
+        
+        SunSpider reports no change on Mac or Windows.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavenge): Call shouldContinueScavenging() instead
+        of doing the math ourselves. Don't keep a local value for pagesDecommitted
+        because that lets free_committed_pages_ be wrong temporarily. Instead,
+        update free_committed_pages_ as we go. ASSERT that we aren't releasing
+        a span that has already been released, because we think this is impossible.
+        Finally, don't be afraid to release all free memory in the page heap when
+        scavenging. We only scavenge after 5 seconds of the application's working
+        set not growing, and we keep both thread caches and a central cache on
+        top of the page heap, so the extra free pages in the page heap were just
+        overkill.
+
+2010-02-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35070
+        Addition of 2 strings of length 2^31 may result in a string of length 0.
+
+        Check for overflow when creating a new JSString as a result of an addition
+        or concatenation, throw an out of memory exception.
+
+        * runtime/JSString.h:
+        (JSC::):
+        * runtime/Operations.h:
+        (JSC::jsString):
+
+2010-02-17  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [Linux] Webkit incompatible with Java plugins
+        https://bugs.webkit.org/show_bug.cgi?id=24912
+
+        Add support for GFile to GOwnPtr.
+
+        Based on original work by Gustavo Noronha.
+
+        * wtf/gtk/GOwnPtr.cpp:
+        (WTF::GFile):
+        * wtf/gtk/GOwnPtr.h:
+
+2010-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix a handful of other leaks seen on the buildbot.
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::deref): Delegate through to the subclass version of deref to ensure that
+        the correct cleanup takes place.  This function previously featured some code that attempted to
+        skip deletion of static UStringImpl's.  Closer inspection revealed that it was in fact equivalent
+        to "if (false)", meaning that UStringImpl's which had their final deref performed via this function
+        were leaked.
+
+2010-02-16  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix a handful of leaks seen on the buildbot.
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::deref): Call URopeImpl::destructNonRecursive rather than delete
+        to ensure that the rope's fibers are also destroyed.
+
+2010-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34964
+        Leaks tool reports false memory leaks due to Rope implementation.
+
+        A rope is a recursive data structure where each node in the rope holds a set of
+        pointers, each of which may reference either a string (in UStringImpl form) or
+        another rope node.  A low bit in each pointer is used to distinguish between
+        rope & string elements, in a fashion similar to the recently-removed
+        PtrAndFlags class (see https://bugs.webkit.org/show_bug.cgi?id=33731 ).  Again,
+        this causes a problem for Leaks - refactor to remove the magic pointer
+        mangling.
+
+        Move Rope out from JSString.h and rename to URopeImpl, to match UStringImpl.
+        Give UStringImpl and URopeImpl a common parent class, UStringOrRopeImpl.
+        Repurpose an otherwise invalid permutation to flags (static & should report
+        memory cost) to identify ropes.
+
+        This allows us to change the rope's fibers to interrogate the object rather
+        than storing a bool within the low bits of the pointer (or in some cases the
+        use of a common parent class removes the need to determine the type at all -
+        there is a common interface to ref or get the length of either ropes or strings).
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::keyForCharacterSwitch):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        (JSC::Identifier::addSlowCase):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/JSString.h:
+        (JSC::):
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::~JSString):
+        (JSC::RopeBuilder::appendStringInConstruct):
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::RopeBuilder::JSStringFinalizerStruct::JSStringFinalizerStruct):
+        (JSC::RopeBuilder::JSStringFinalizerStruct::):
+        * runtime/UString.cpp:
+        (JSC::UString::toStrictUInt32):
+        (JSC::equal):
+        * runtime/UString.h:
+        (JSC::UString::isEmpty):
+        (JSC::UString::size):
+        * runtime/UStringImpl.cpp:
+        (JSC::URopeImpl::derefFibersNonRecursive):
+        (JSC::URopeImpl::destructNonRecursive):
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::isRope):
+        (JSC::UStringOrRopeImpl::length):
+        (JSC::UStringOrRopeImpl::ref):
+        (JSC::UStringOrRopeImpl::):
+        (JSC::UStringOrRopeImpl::operator new):
+        (JSC::UStringOrRopeImpl::UStringOrRopeImpl):
+        (JSC::UStringImpl::adopt):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::tryCreateUninitialized):
+        (JSC::UStringImpl::data):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::):
+        (JSC::URopeImpl::tryCreateUninitialized):
+        (JSC::URopeImpl::initializeFiber):
+        (JSC::URopeImpl::fiberCount):
+        (JSC::URopeImpl::fibers):
+        (JSC::URopeImpl::deref):
+        (JSC::URopeImpl::URopeImpl):
+        (JSC::URopeImpl::hasOneRef):
+        (JSC::UStringOrRopeImpl::deref):
+
+2010-02-15  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix the SP at ctiOpThrowNotCaught on Thumb2 (JSVALUE32)
+        https://bugs.webkit.org/show_bug.cgi?id=34939
+
+        * jit/JITStubs.cpp:
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build Fix!).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Some general Rope related refactoring.
+
+        Rename Rope::m_ropeLength to m_fiberCount, to be more descriptive.
+        Rename Rope::m_stringLength to simply m_length (since this is the
+        more conventional name for the length of a string).  Move append
+        behaviour out into a new RopeBuilder class, so that Rope no longer
+        needs any knowledge of the JSString or UString implementation.
+
+        Make Rope no longer be nested within JSString.
+        (Rope now no-longer need reside within JSString.h, but leaving
+        the change of moving this out to a different header as a separate
+        change from these renames).
+
+        * JavaScriptCore.exp:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * runtime/JSString.cpp:
+        (JSC::Rope::destructNonRecursive):
+        (JSC::Rope::~Rope):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::Rope::Fiber::Fiber):
+        (JSC::Rope::Fiber::deref):
+        (JSC::Rope::Fiber::ref):
+        (JSC::Rope::Fiber::refAndGetLength):
+        (JSC::Rope::Fiber::isRope):
+        (JSC::Rope::Fiber::rope):
+        (JSC::Rope::Fiber::isString):
+        (JSC::Rope::Fiber::string):
+        (JSC::Rope::Fiber::nonFiber):
+        (JSC::Rope::tryCreateUninitialized):
+        (JSC::Rope::append):
+        (JSC::Rope::fiberCount):
+        (JSC::Rope::length):
+        (JSC::Rope::fibers):
+        (JSC::Rope::Rope):
+        (JSC::Rope::operator new):
+        (JSC::):
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::~JSString):
+        (JSC::RopeBuilder::length):
+        (JSC::RopeBuilder::canGetIndex):
+        (JSC::RopeBuilder::appendStringInConstruct):
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::RopeBuilder::isRope):
+        (JSC::RopeBuilder::fiberCount):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/Operations.h:
+        (JSC::jsString):
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Add missing cast for !YARR (PPC) builds.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+
+2010-02-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Many false leaks in release builds due to PtrAndFlags
+
+        StructureTransitionTable was effectively a smart pointer type,
+        one machine word in size and wholly contained as a member of
+        of Structure.  It either pointed to an actual table, or could
+        be used to describe a single transtion entry without use of a
+        table.
+
+        This, however, worked by using a PtrAndFlags, which is not
+        compatible with the leaks tool.  Since there is no clear way to
+        obtain another bit for 'free' here, and since there are bits
+        available up in Structure, merge this functionality back up into
+        Structure.  Having this in a separate class was quite clean
+        from an enacapsulation perspective, but this solution doesn't
+        seem to bad - all table access is now intermediated through the
+        Structure::structureTransitionTableFoo methods, keeping the
+        optimization fairly well contained.
+
+        This was the last use of PtrAndFlags, so removing the file too.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::):
+        (JSC::Structure::structureTransitionTableContains):
+        (JSC::Structure::structureTransitionTableGet):
+        (JSC::Structure::structureTransitionTableHasTransition):
+        (JSC::Structure::structureTransitionTableRemove):
+        (JSC::Structure::structureTransitionTableAdd):
+        (JSC::Structure::structureTransitionTable):
+        (JSC::Structure::setStructureTransitionTable):
+        (JSC::Structure::singleTransition):
+        (JSC::Structure::setSingleTransition):
+        * runtime/StructureTransitionTable.h:
+        * wtf/PtrAndFlags.h: Removed.
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Geoff Garen.
+
+        Bug 34948 - tryMakeString should fail on error in length calculation
+
+        Ooops! - "bool overflow" argument should have been "bool& overflow".
+
+        * runtime/UString.h:
+        (JSC::sumWithOverflow):
+        (JSC::tryMakeString):
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build Fix (pt 2!)).
+
+        Some symbol names have changed, remove, will readd if required.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build Fix (pt 1?)).
+
+        Some symbol names have changed, remove, will readd if required.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed some mistaken code added in http://trac.webkit.org/changeset/53860.
+
+        * API/APIShims.h:
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim): No need to start/stop the
+        timeout checker when calling out from the API to the client; we want to
+        monitor the VM for timeouts, not the client. This mistake was harmless /
+        undetectable, since it's totally redundant with the APIEntryShim, which
+        also starts / stops the timeout checker.
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 34952 - String lengths in UString should be unsigned.
+        This matches WebCore::StringImpl, and better unifies behaviour throughout JSC.
+
+        * JavaScriptCore.exp:
+        * bytecode/EvalCodeCache.h:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        * runtime/Identifier.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEscape):
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::indent):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncSplit):
+        (JSC::trimString):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::from):
+        (JSC::UString::getCString):
+        (JSC::UString::ascii):
+        (JSC::UString::operator[]):
+        (JSC::UString::toStrictUInt32):
+        (JSC::UString::find):
+        (JSC::UString::rfind):
+        (JSC::UString::substr):
+        (JSC::operator<):
+        (JSC::operator>):
+        (JSC::compare):
+        (JSC::equal):
+        (JSC::UString::UTF8String):
+        * runtime/UString.h:
+        (JSC::UString::size):
+        (JSC::operator==):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::create):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::size):
+        (JSC::UStringImpl::computeHash):
+        (JSC::UStringImpl::UStringImpl):
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 34948 - tryMakeString should fail on error in length calculation
+
+        The sum of the length of substrings could overflow.
+
+        * runtime/UString.h:
+        (JSC::sumWithOverflow):
+        (JSC::tryMakeString):
+
+2010-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/7628524> Crash beneath JSGlobalContextRelease when
+        typing in Google search field with GuardMalloc/full page heap enabled
+
+        * API/JSContextRef.cpp: Don't use APIEntryShim, since that requires
+        a JSGlobalData, which this function destroys. Do use setCurrentIdentifierTable
+        and JSLock instead, since those are the two features of APIEntryShim we
+        require.
+
+2010-02-15  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Added additional parameter to create_rvct_stubs 
+        for setting the offset of thunkReturnAddress.
+        https://bugs.webkit.org/show_bug.cgi?id=34657
+
+        * create_rvct_stubs:
+        * jit/JITStubs.cpp:
+
+2010-02-15  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::toIntXX methods.
+
+        More ECMA Script compliance.
+
+        [Qt] QScriptValue::toIntXX returns incorrect values
+        https://bugs.webkit.org/show_bug.cgi?id=34847
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toInteger):
+        (QScriptValuePrivate::toInt32):
+        (QScriptValuePrivate::toUInt32):
+        (QScriptValuePrivate::toUInt16):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toInteger_initData):
+        (tst_QScriptValue::toInteger_makeData):
+        (tst_QScriptValue::toInteger_test):
+        (tst_QScriptValue::toInt32_initData):
+        (tst_QScriptValue::toInt32_makeData):
+        (tst_QScriptValue::toInt32_test):
+        (tst_QScriptValue::toUInt32_initData):
+        (tst_QScriptValue::toUInt32_makeData):
+        (tst_QScriptValue::toUInt32_test):
+        (tst_QScriptValue::toUInt16_initData):
+        (tst_QScriptValue::toUInt16_makeData):
+        (tst_QScriptValue::toUInt16_test):
+
+2010-02-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        Implement NEVER_INLINE and NO_RETURN for RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=34740
+
+        * wtf/AlwaysInline.h:
+
+2010-02-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from JIT data stuctures.
+
+        These break the OS X Leaks tool.  Free up a bit in CallLinkInfo, and invalid
+        permutation of pointer states in MethodCallLinkInfo to represent the removed bits.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * runtime/UString.h:
+
+2010-02-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Many false leaks in release builds due to PtrAndFlags
+
+        Remove UntypedPtrAndBitfield (similar to PtrAndFlags) in UStringImpl,
+        and steal bits from the refCount instead.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+        (JSC::UStringImpl::):
+
+2010-02-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Removed an unnecessary data dependency from my last patch.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::markChildren): Since isAnyStringMarked being false
+        is a condition of entering the loop, we can just use '=' instead of '|='.
+
+2010-02-12  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Additional refptr/passrefptr workarounds for WINSCW compiler
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+
+        * wtf/PassRefPtr.h:
+        (WTF::refIfNotNull):
+        (WTF::PassRefPtr::PassRefPtr):
+        (WTF::PassRefPtr::~PassRefPtr):
+        (WTF::PassRefPtr::clear):
+        (WTF::::operator):
+        * wtf/RefPtr.h:
+        (WTF::RefPtr::RefPtr):
+        (WTF::::operator):
+
+2010-02-12  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Don't import the cmath functions from std:: for WINSCW.
+
+        * wtf/MathExtras.h:
+
+2010-02-12  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Adam Barth.
+
+        Typedef both JSChar and UChar to wchar_t in RVCT.
+        https://bugs.webkit.org/show_bug.cgi?id=34560
+
+        Define both JSChar and UChar to wchar_t as the size
+        of wchar_t is 2 bytes in RVCT.
+
+        * API/JSStringRef.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2010-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt and Darin Adler.
+
+        The rest of the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=34864 | <rdar://problem/7594198>
+        Many objects left uncollected after visiting mail.google.com and closing
+        window
+        
+        Don't unconditionally hang onto small strings. Instead, hang onto all
+        small strings as long as any small string is still referenced.
+        
+        SunSpider reports no change.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markRoots): Mark the small strings cache last, so it can
+        check if anything else has kept any strings alive.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren): Only keep our strings alive if some
+        other reference to at least one of them exists, too.
+
+2010-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Some progress toward fixing
+        https://bugs.webkit.org/show_bug.cgi?id=34864 | <rdar://problem/7594198>
+        Many objects left uncollected after visiting mail.google.com and closing
+        window
+        
+        SunSpider reports no change.
+        
+        Keep weak references, rather than protected references, to cached for-in
+        property name enumerators.
+        
+        One problem with protected references is that a chain like 
+            [ gc object 1 ] => [ non-gc object ] => [ gc object 2 ]
+        takes two GC passes to break, since the first pass collects [ gc object 1 ],
+        releasing [ non-gc object ] and unprotecting [ gc object 2 ], and only
+        then can a second pass collect [ gc object 2 ].
+        
+        Another problem with protected references is that they can keep a bunch
+        of strings alive long after they're useful. In SunSpider and a few popular
+        websites, the size-speed tradeoff seems to favor weak references.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator): Moved this constructor
+        into the .cpp file, since it's not used elsewhere.
+
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator): Added a destructor
+        to support our weak reference.
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::clearEnumerationCache):
+        (JSC::Structure::enumerationCache): Added a function for clearing a
+        Structure's enumeration cache, used by our new destructor. Also fixed
+        indentation to match the rest of the file.
+
+        * runtime/Structure.h: Changed from protected pointer to weak pointer.
+
+2010-02-11  Chris Rogers  <crogers@google.com>
+
+        Reviewed by David Levin.
+
+        audio engine: add Complex number class
+        https://bugs.webkit.org/show_bug.cgi?id=34538
+
+        * wtf/Complex.h: Added.
+        (WebCore::complexFromMagnitudePhase):
+
+2010-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added an SPI for asking about all the different live objects on the heap.
+        Useful for memory debugging.
+
+        * JavaScriptCore.exp: Export the new SPI.
+
+        * runtime/Collector.cpp:
+        (JSC::typeName): Use a little capitalization. Don't crash in the case of
+        a non-object cell, since it might just be an uninitialized cell.
+
+        (JSC::Heap::objectTypeCounts): The new SPI.
+
+        * runtime/Collector.h:
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::advance):
+        (JSC::LiveObjectIterator::operator++):
+        (JSC::DeadObjectIterator::operator++):
+        (JSC::ObjectIterator::operator++): Made 2 tweaks to these iterators:
+        (1) Skip the last cell in the block, since it's a dummy sentinel, and
+        we don't want it to confuse the object count; (2) Fixed a logic error
+        in LiveObjectIterator that could cause it to iterate dead objects if
+        m_block were equal to m_heap.nextBlock and m_cell were less than
+        m_heap.nextCell. No test for this since I can't think of a way that this
+        could make WebKit behave badly.
+
+2010-02-11  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Guard cmath using declarations in MathExtras.h on Android
+        https://bugs.webkit.org/show_bug.cgi?id=34840
+
+        Android does not provide these functions.
+
+        * wtf/MathExtras.h:
+
+2010-02-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Restore ENABLE_RUBY flag so vendors can ship with Ruby disabled if they choose.
+        https://bugs.webkit.org/show_bug.cgi?id=34698
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-02-10  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Add Windows complex text support and Mac support for containsCharacters.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34759
+
+        * wscript:
+
+2010-02-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Addressing issues found by style bot.
+
+        * wtf/ValueCheck.h: Renamed header guard to match final file name.
+
+        * wtf/Vector.h: (WTF::::checkConsistency): Remove braces around a one-line clause.
+
+2010-02-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34490
+        WebCore::ImageEventSender::dispatchPendingEvents() crashes in certain conditions
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added ValueCheck.h.
+
+        * wtf/ValueCheck.h: Added. Moved code out of HashTraits, since it would be awkward to
+        include that from Vector.h.
+        (WTF::ValueCheck::checkConsistency): Allow null pointers, those are pretty consistent.
+
+        * wtf/HashTraits.h: Moved value checking code out of here.
+
+        * wtf/HashTable.h: (WTF::::checkTableConsistencyExceptSize): Updated for the above changes.
+
+        * wtf/Vector.h:
+        (WTF::::checkConsistency): Check all vector elements.
+        (WTF::ValueCheck): Support checking a Vector as an element in other containers. Currently
+        unused.
+
+2010-02-10  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::toBool.
+
+        Fix ECMA compliance in the QScriptValue for values like 0, NaN and
+        empty strings.
+
+        [Qt] QScriptValue::toBool problem
+        https://bugs.webkit.org/show_bug.cgi?id=34793
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toBool):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toBool_initData):
+        (tst_QScriptValue::toBool_makeData):
+        (tst_QScriptValue::toBool_test):
+        (tst_QScriptValue::toBoolean_initData):
+        (tst_QScriptValue::toBoolean_makeData):
+        (tst_QScriptValue::toBoolean_test):
+
+2009-10-06  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Use derefIfNotNull() to work around WINSCW compiler forward declaration bug
+
+        The compiler bug is reported at
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
+
+        The change should be reverted when the above bug is fixed in WINSCW compiler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+
+2009-10-06  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Get rid of WINSCW hack for UnSpecifiedBoolType
+
+        Add parenthesis around (RefPtr::*UnspecifiedBoolType) to make the WINSCW
+        compiler work with the default UnSpecifiedBoolType() operator.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+
+        * wtf/RefPtr.h:
+
+2010-02-09  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        New functions nullValue() and undefinedValue().
+
+        [Qt] QScriptEngine should contain nullValue and undefinedValue methods
+        https://bugs.webkit.org/show_bug.cgi?id=34749
+
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::nullValue):
+        (QScriptEngine::undefinedValue):
+        * qt/api/qscriptengine.h:
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::nullValue):
+        (tst_QScriptEngine::undefinedValue):
+
+2010-02-09  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fixes for QScriptValue::toNumber().
+
+        Fix ECMA compliance in QScriptValue for values unbound
+        to a QScriptEngine.
+
+        [Qt] QScriptValue::toNumber() is broken
+        https://bugs.webkit.org/show_bug.cgi?id=34592
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toNumber):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toNumber_initData):
+        (tst_QScriptValue::toNumber_makeData):
+        (tst_QScriptValue::toNumber_test):
+
+2010-02-09  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::isNumber().
+
+        The isNumber() should return 'true' if the value is in the CNumber
+        state.
+
+        [Qt] QScriptValue::isNumber() returns an incorrect value
+        https://bugs.webkit.org/show_bug.cgi?id=34575
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::isNumber):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::isNumber_initData):
+        (tst_QScriptValue::isNumber_makeData):
+        (tst_QScriptValue::isNumber_test):
+
+2010-02-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Small refactoring to the small strings cache to allow it to be cleared
+        dynamically.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::clear):
+        * runtime/SmallStrings.h: Moved initialization code into a shared function,
+        and changed the constructor to call it.
+
+2010-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Geoff Garen.
+
+        Rename StringBuilder::release && JSStringBuilder::releaseJSString
+        to 'build()'.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::stringify):
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::build):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToFixed):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::build):
+
+2010-02-09  John Sullivan  <sullivan@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=34772
+        Overzealous new assertion in URStringImpl::adopt()
+
+        Reviewed by Adam Barth.
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::adopt):
+        Only assert that vector.data() is non-zero if vector.size() is non-zero.
+
+2010-02-09  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Try to fix build problem on SnowLeopard slaves to bring them back.
+
+        * API/JSClassRef.cpp:
+        (tryCreateStringFromUTF8): Mark method as 'static inline' to suppress "warning: no previous prototype for ..."
+
+2010-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Three small string fixes:
+        (1) StringBuilder::release should CRASH if the buffer allocation failed.
+        (2) Remove weird, dead code from JSString::tryGetValue, replace with an ASSERT.
+        (3) Move UString::createFromUTF8 out to the API, as tryCreateStringFromUTF8.
+            This is only used from the API, and (now) unlike other UString::create
+            methods may return UString::null() to indicate failure cases.  Better
+            handle these in the API.
+
+        * API/JSClassRef.cpp:
+        (tryCreateStringFromUTF8):
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * runtime/JSString.h:
+        (JSC::Fiber::tryGetValue):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::release):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::from):
+        (JSC::UString::find):
+        * runtime/UString.h:
+
 2010-02-09  Janne Koskinen  <janne.p.koskinen@digia.com>
 
         Reviewed by Laszlo Gombos.
@@ -39,36 +3362,3696 @@
         * runtime/JSValue.cpp:
         (JSC::nonInlineNaN):
 
-2010-01-07  Norbert Leser  <norbert.leser@nokia.com>
+2010-02-09  Tamas Szirbucz  <szirbucz@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add a soft modulo operation to ARM JIT using a trampoline function.
+        The performance progression is about ~1.8% on ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=34424
+
+        Developed in cooperation with Gabor Loki.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::softModulo):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiSoftModulo):
+        * wtf/Platform.h:
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (SL/win build fixes).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/StringPrototype.cpp:
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt
+
+        Make String.replace throw an exception on out-of-memory, rather than
+        returning a null (err, empty-ish) string.  Move String::replaceRange
+        and String::spliceSubstringsWithSeparators out to StringPrototype -
+        these were fairly specific use anyway, and we can better integrate
+        throwing the JS expcetion this way.
+
+        Also removes redundant assignment operator from UString.
+
+        * JavaScriptCore.exp:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringRange::StringRange):
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::jsReplaceRange):
+        (JSC::stringProtoFuncReplace):
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+
+2010-02-08  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Undefine WTF_OS_WINDOWS and WTF_PLATFORM_WIN
+        https://bugs.webkit.org/show_bug.cgi?id=34561
+
+        As the binary for simulator is built with MSVC 2005,
+        WTF_OS_WINDOWS and WTF_PLATFORM_WIN are defined.
+        Undefine them as we don't target Windows.
+
+        * wtf/Platform.h:
+
+2010-02-08  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Darin Adler.
+
+        audio engine: add Vector3 class
+        https://bugs.webkit.org/show_bug.cgi?id=34548
+
+        * wtf/Vector3.h: Added.
+        (WebCore::Vector3::Vector3):
+        (WebCore::Vector3::abs):
+        (WebCore::Vector3::isZero):
+        (WebCore::Vector3::normalize):
+        (WebCore::Vector3::x):
+        (WebCore::Vector3::y):
+        (WebCore::Vector3::z):
+        (WebCore::operator+):
+        (WebCore::operator-):
+        (WebCore::operator*):
+        (WebCore::dot):
+        (WebCore::cross):
+        (WebCore::distance):
+
+2010-02-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix warning in clang++
+
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make makeString CRASH if we fail to allocate a string.
+
+        (tryMakeString or jsMakeNontrivialString can be used where we
+        expect allocation may fail and want to handle the error).
+
+        * runtime/JSStringBuilder.h:
+        (JSC::jsMakeNontrivialString):
+        * runtime/UString.h:
+        (JSC::tryMakeString):
+        (JSC::makeString):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Remove a couple of unnecesary C-style casts spotted by Darin.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::globalFuncEscape):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Switch some more StringBuilder/jsNontrivialString code to use
+        JSStringBuilder/jsMakeNontrivialString - these methods will
+        throw an exception if we hit out-of-memory, rather than just
+        CRASHing.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Use an empty identifier instead of a null identifier for parse
+        tokens without an identifier.
+
+        This helps encapsulate the null UStringImpl within UString.
+
+        * parser/Grammar.y:
+        * parser/NodeConstructors.h:
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ForInNode::ForInNode):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+
+2010-02-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Build fix for make distcheck.
+
+        * GNUmakefile.am:
+
+2010-02-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed RVCT build fix.
+
+        Similar to r54391, don't import the cmath functions from std:: for RVCT.
+
+        * wtf/MathExtras.h:
+
+2010-02-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Change UStringImpl::create to CRASH if the string cannot be allocated,
+        rather than returning a null string (which will behave like a zero-length
+        string if used).
+
+        Also move createRep function from UString to become new overloaded
+        UStringImpl::create methods.  In doing so, bring their behaviour closer to
+        being in line with WebCore::StringImpl, in removing the behaviour that they
+        can be used to produce null UStrings (ASSERT the char* provided is non-null).
+        This behaviour of converting null C-strings to null UStrings is inefficient
+        (cmompared to just using UString::null()), incompatible with WebCore::StringImpl's
+        behaviour, and may generate unexpected behaviour, since in many cases a null
+        UString can be used like an empty string.
+
+        With these changes UStringImpl need not have a concept of null impls, we can
+        start transitioning this to become an implementation detail of UString, that
+        internally it chooses to use a null-object rather than an actually zero impl
+        pointer.
+
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * profiler/Profile.cpp:
+        (JSC::Profile::Profile):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::stopProfiling):
+        * runtime/Error.cpp:
+        (JSC::Error::create):
+        (JSC::throwError):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        (JSC::UString::UString):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::isNull):
+        (JSC::UString::null):
+        (JSC::UString::rep):
+        (JSC::UString::UString):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::create):
+        * runtime/UStringImpl.h:
+
+2010-02-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Define SYSTEM_MALLOC 1
+        https://bugs.webkit.org/show_bug.cgi?id=34640
+
+        Make BREWMP use system malloc because FastMalloc is not ported.
+
+        * wtf/Platform.h:
+
+2010-02-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Don't call CRASH() in fastMalloc and fastCalloc when the requested memory size is 0
+        https://bugs.webkit.org/show_bug.cgi?id=34569
+
+        With USE_SYSTEM_MALLOC=1, fastMalloc and fastCalloc call CRASH()
+        if the return value of malloc and calloc is 0.
+        
+        However, these functions can return 0 when the request size is 0.
+        Libc manual says, "If size is 0, then malloc() returns either NULL,
+        or a unique pointer value that can later be successfully passed to free()."
+        Though malloc returns a unique pointer in most systems,
+        0 can be returned in some systems. For instance, BREW's MALLOC returns 0
+        when size is 0.
+
+        If malloc or calloc returns 0 due to allocation size, increase the size
+        to 1 and try again.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+
+2010-02-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Build fix.  Remove a symbol corresponding to an inline function from the linker export
+        file to prevent a weak external failure.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Accommodate rename of script.
+
+2010-02-04  Daniel Bates  <dbates@webkit.org>
+
+        [Qt] Unreviewed, build fix for Qt bot.
+
+        * runtime/JSStringBuilder.h: Changed #include <X.h> notation #include "X.h".
+
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Clearing a WeakGCPtr is weird
+        https://bugs.webkit.org/show_bug.cgi?id=34627
+
+        Added a WeakGCPtr::clear interface.
+        
+        As discussed in https://bugs.webkit.org/show_bug.cgi?id=33383, the old
+        interface made it pretty weird for a client to conditionally clear a
+        WeakGCPtr, which is exactly what clients want to do when objects are
+        finalized.
+
+        * API/JSClassRef.cpp:
+        (clearReferenceToPrototype): Use the new WeakGCPtr::clear() interface. 
+
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::clear): Added an interface for clearing a WeakGCPtr,
+        iff its current value is the value passed in. It's cumbersome for the
+        client to do this test, since WeakGCPtr sometimes pretends to be null.
+
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export a header.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-02-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add a JSStringBuilder class (similar-to, and derived-from StringBuilder) to
+        construct JSStrings, throwing a JS exception should we run out of memory whilst
+        allocating storage for the string.
+
+        Similarly, add jsMakeNontrivialString methods to use in cases where previously
+        we were calling makeString & passing the result to jsNontrivialString.  Again,
+        these new methods throw if we hit an out of memory condition.
+
+        Move throwOutOfMemoryError into ExceptionHelpers, to make it more widely available.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToGMTString):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::throwOutOfMemoryError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSStringBuilder.h: Added.
+        (JSC::JSStringBuilder::releaseJSString):
+        (JSC::jsMakeNontrivialString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/Operations.cpp:
+        * runtime/Operations.h:
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::append):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+
+2010-02-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * wtf/MathExtras.h:
+
+2010-02-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Make MathExtras.h compatible with <cmath>
+        https://bugs.webkit.org/show_bug.cgi?id=34618
+
+        * wtf/MathExtras.h: Include <cmath> instead of <math.h>.
+        Use "using" as we do elsewhere in WTF for the four functions from <cmath>
+        we want to use without the prefix. Later we could consider making the std
+        explicit at call sites instead.
+
+2010-02-04  Tamas Szirbucz  <szirbucz@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Use an easily appendable structure for trampolines instead of pointer parameters.
+        https://bugs.webkit.org/show_bug.cgi?id=34424
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITThunks::ctiVirtualCallLink):
+        (JSC::JITThunks::ctiVirtualCall):
+        (JSC::JITThunks::ctiNativeCallThunk):
+
+2010-02-04  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Increase test coverage for the QScriptValue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34533
+
+        * qt/tests/qscriptvalue/qscriptvalue.pro:
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
+        (tst_QScriptValue::tst_QScriptValue):
+        (tst_QScriptValue::~tst_QScriptValue):
+        (tst_QScriptValue::dataHelper):
+        (tst_QScriptValue::newRow):
+        (tst_QScriptValue::testHelper):
+        (tst_QScriptValue::ctor):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h: Added.
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp: Added.
+        (tst_QScriptValue::initScriptValues):
+        (tst_QScriptValue::isValid_initData):
+        (tst_QScriptValue::isValid_makeData):
+        (tst_QScriptValue::isValid_test):
+        (tst_QScriptValue::isBool_initData):
+        (tst_QScriptValue::isBool_makeData):
+        (tst_QScriptValue::isBool_test):
+        (tst_QScriptValue::isBoolean_initData):
+        (tst_QScriptValue::isBoolean_makeData):
+        (tst_QScriptValue::isBoolean_test):
+        (tst_QScriptValue::isFunction_initData):
+        (tst_QScriptValue::isFunction_makeData):
+        (tst_QScriptValue::isFunction_test):
+        (tst_QScriptValue::isNull_initData):
+        (tst_QScriptValue::isNull_makeData):
+        (tst_QScriptValue::isNull_test):
+        (tst_QScriptValue::isString_initData):
+        (tst_QScriptValue::isString_makeData):
+        (tst_QScriptValue::isString_test):
+        (tst_QScriptValue::isUndefined_initData):
+        (tst_QScriptValue::isUndefined_makeData):
+        (tst_QScriptValue::isUndefined_test):
+        (tst_QScriptValue::isObject_initData):
+        (tst_QScriptValue::isObject_makeData):
+        (tst_QScriptValue::isObject_test):
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Define WTF_PLATFORM_BREWMP_SIMULATOR when AEE_SIMULATOR is defined
+        https://bugs.webkit.org/show_bug.cgi?id=34514
+
+        PLATFORM(BREWMP_SIMULATOR) guard is needed to make distinction between BREWMP
+        and BREWMP simulator.
+
+        * wtf/Platform.h:
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Remove COMPILE_ASSERT conflict with the underlying PLATFORM
+        https://bugs.webkit.org/show_bug.cgi?id=34190
+
+        COMPILE_ASSERT conflicts with the underlying PLATFORM because it is defined
+        both in WTF's Assertions.h and BREWMP's AEEClassIDs.h. Include AEEClassIDs.h
+        in Assertions.h and undef COMPILE_ASSERT to avoid redefining COMPILE_ASSERT.
+
+        * wtf/Assertions.h:
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Implement OwnPtrBrew to make sure BREW instances are freed.
+        https://bugs.webkit.org/show_bug.cgi?id=34518
+
+        Add OwnPtrBrew to release IFile, IFileMgr and IBitmap instances.
+
+        * wtf/brew/OwnPtrBrew.cpp: Added.
+        (WTF::IFileMgr):
+        (WTF::IFile):
+        (WTF::IBitmap):
+        (WTF::freeOwnedPtrBrew):
+        * wtf/brew/OwnPtrBrew.h: Added.
+        (WTF::OwnPtrBrew::OwnPtrBrew):
+        (WTF::OwnPtrBrew::~OwnPtrBrew):
+        (WTF::OwnPtrBrew::get):
+        (WTF::OwnPtrBrew::release):
+        (WTF::OwnPtrBrew::outPtr):
+        (WTF::OwnPtrBrew::set):
+        (WTF::OwnPtrBrew::clear):
+        (WTF::OwnPtrBrew::operator*):
+        (WTF::OwnPtrBrew::operator->):
+        (WTF::OwnPtrBrew::operator!):
+        (WTF::OwnPtrBrew::operator UnspecifiedBoolType):
+        (WTF::OwnPtrBrew::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::getPtr):
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Export WTF::fastStrDup symbol
+        https://bugs.webkit.org/show_bug.cgi?id=34526
+
+        * JavaScriptCore.exp:
+
+2010-02-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Enable JIT compilation for wx.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34536
+
+        * wtf/Platform.h:
+
+2010-02-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Crash in CollectorBitmap::get at nbcolympics.com
+        https://bugs.webkit.org/show_bug.cgi?id=34504
+
+        This was caused by the use of m_offset to determine the offset of
+        a new property into the property storage.  This patch corrects
+        the effected cases by incorporating the anonymous slot count. It
+        also removes the duplicate copy of anonymous slot count from the
+        property table as keeping this up to date merely increased the
+        chance of a mismatch.  Finally I've added a large number of
+        assertions in an attempt to prevent such a bug from happening
+        again.
+
+        With the new assertions in place the existing anonymous slot tests
+        all fail without the m_offset fixes.
+
+        * runtime/PropertyMapHashTable.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::get):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::createPropertyMapHashTable):
+        (JSC::Structure::rehashPropertyMapHashTable):
+        (JSC::Structure::checkConsistency):
+
+2010-02-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Copyright year updating for Windows version resources should be automatic
+        https://bugs.webkit.org/show_bug.cgi?id=34503
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add dummy main thread functions
+        https://bugs.webkit.org/show_bug.cgi?id=33569
+
+        Add dummy initializeMainThreadPlatform and
+        scheduleDispatchFunctionsOnMainThread.
+
+        * wtf/brew/MainThreadBrew.cpp: Added.
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Add using WTF::getLocalTime to CurrentTime.h
+        https://bugs.webkit.org/show_bug.cgi?id=34493
+
+        * wtf/CurrentTime.h:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add HAVE_XXX definitions
+        https://bugs.webkit.org/show_bug.cgi?id=34414
+
+        Add HAVE_ERRNO_H=1
+
+        * wtf/Platform.h:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Don't define HAVE_TM_GMTOFF, HAVE_TM_ZONE and HAVE_TIMEGM
+        https://bugs.webkit.org/show_bug.cgi?id=34388
+
+        BREWMP does not have these features.
+
+        * wtf/Platform.h:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Define WTF_PLATFORM_BREWMP=1 when BUILDING_BREWMP is defined
+        https://bugs.webkit.org/show_bug.cgi?id=34386
+
+        Define WTF_PLATFORM_BREWMP=1 so that PLATFORM(BREWMP) guard can be used.
+
+        * wtf/Platform.h:
+
+2010-02-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Date.UTC() should apply TimeClip operation.
+        https://bugs.webkit.org/show_bug.cgi?id=34461
+
+        ECMAScript 5 15.9.4.3:
+        > 9 Return TimeClip(MakeDate(MakeDay(yr, m, dt), MakeTime(h, min, s, milli))).
+
+        * runtime/DateConstructor.cpp:
+        (JSC::dateUTC): Calls WTF::timeClip().
+
+2010-02-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that Math.round() retunrs incorrect results for huge integers
+        https://bugs.webkit.org/show_bug.cgi?id=34462
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncRound): Avoid "arg + 0.5".
+
+2010-02-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Port WTF's currentTime
+        https://bugs.webkit.org/show_bug.cgi?id=33567
+
+        Combine GETUTCSECONDS and GETTIMEMS to calculate the number
+        of milliseconds since 1970/01/01 00:00:00 UTC.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::currentTime):
+
+2010-02-01  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        [Qt] WinCE buildfix after r52729 and fix for Q_BIG_ENDIAN typo.
+        https://bugs.webkit.org/show_bug.cgi?id=34378
+
+        * wtf/Platform.h:
+
+2010-02-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Structure not accounting for anonymous slots when computing property storage size
+        https://bugs.webkit.org/show_bug.cgi?id=34441
+
+        Previously any Structure with anonymous storage would have a property map, so we
+        were only including anonymous slot size if there was a property map.  Given this
+        is no longer the case we should always include the anonymous slot count in the
+        property storage size.
+
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+
+2010-02-01  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix, update exports file (again)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-01  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix, update exports file
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSC is failing to propagate anonymous slot count on some transitions
+        https://bugs.webkit.org/show_bug.cgi?id=34321
+
+        Remove secondary Structure constructor, and make Structure store a copy
+        of the number of anonymous slots directly so saving an immediate allocation
+        of a property map for all structures with anonymous storage, which also
+        avoids the leaked property map on new property transition in the original
+        version of this patch.
+
+        We need to propagate the the anonymous slot count otherwise we can end up
+        with a structure recording incorrect information about the available and
+        needed space for property storage, or alternatively incorrectly reusing
+        some slots.
+
+        * JavaScriptCore.exp:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::createPropertyMapHashTable):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::hasAnonymousSlots):
+        (JSC::Structure::anonymousSlotCount):
+
+2010-01-31  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Buildfix for WinCE + style fixes (TLS_OUT_OF_INDEXES is not defined).
+        https://bugs.webkit.org/show_bug.cgi?id=34380
+
+        * wtf/ThreadSpecific.h:
+
+2010-01-31  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        [Windows] Fix a bug of round() with huge integral numbers
+        https://bugs.webkit.org/show_bug.cgi?id=34297
+
+        Fix a bug that round() for huge integral numbers returns incorrect
+        results. For example, round(8639999913600001) returns
+        8639999913600002 without this change though the double type can
+        represent 8639999913600001 precisely.
+
+        Math.round() of JavaScript has a similar problem. But this change
+        doesn't fix it because Math.round() doesn't use round() of
+        MathExtra.h.
+
+        * wtf/MathExtras.h:
+        (round): Avoid to do "num + 0.5" or "num - 0.5".
+        (roundf): Fixed similarly.
+        (llround): Calls round().
+        (llroundf): Calls roundf().
+        (lround): Calls round().
+        (lroundf): Calls roundf().
+
+2010-01-29  Mark Rowe  <mrowe@apple.com>
+
+        Sort Xcode projects.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-01-29  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build.
+
+        Disable ENABLE_INDEXED_DATABASE since it is "completely non-functional".
+
+        As the comment in FeatureDefines.xcconfig notes, the list of feature defines
+        needs to be kept in sync across the various files.  The default values also
+        need to be kept in sync between these files and build-webkit.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-01-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Fix the ARM build.
+
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure): Call the right Structure::create overload.
+
+2010-01-28  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix for MSW, use ThreadingWin.cpp as the Windows pthreads implementation
+        implements pthread_t in a way that makes it impossible to check its validity,
+        which is needed by ThreadingPthreads.cpp.
+
+        * wscript:
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        DOM Objects shouldn't all require custom mark functions
+        https://bugs.webkit.org/show_bug.cgi?id=34291
+
+        Make getAnonymousValue const-friendly
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::getAnonymousValue):
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Simplify anonymous slot implementation
+        https://bugs.webkit.org/show_bug.cgi?id=34282
+
+        A class must now specify the number of slots it needs at construction time
+        rather than later on with a transition.  This makes many things simpler,
+        we no longer need to need an additional transition on object creation to
+        add the anonymous slots, and we remove the need for a number of transition
+        type checks. 
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSCell.h:
+        (JSC::JSCell::createDummyStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSObject::putAnonymousValue):
+        (JSC::JSObject::getAnonymousValue):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::Fiber::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::anonymousSlotCount):
+        * runtime/StructureTransitionTable.h:
+
+2010-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        MessageEvent.data should deserialize in the context of the MessageEvent's global object
+        https://bugs.webkit.org/show_bug.cgi?id=34227
+
+        Add logic to allow us to create an Object, Array, or Date instance
+        so we can create them in the context of a specific global object,
+        rather than just using the current lexical global object.
+
+        * JavaScriptCore.exp:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyObject):
+        (JSC::constructEmptyArray):
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
+
+        It is very difficult to catch stale pointers that are HashMap keys - since a pointer's hash
+        is just its value, it is very unlikely that any observable problem is reproducible.
+
+        This extends hash table consistency checks to check that pointers are referencing allocated
+        memory blocks, and makes it possible to invoke the checks explicitly (it is not feasible
+        to enable CHECK_HASHTABLE_CONSISTENCY by default, because that affects performance too much).
+
+        * wtf/HashMap.h: (WTF::::checkConsistency): Call through to HashTable implementation. We can
+        add similar calls to HashSet and HashCountedSet, but I haven't seen hard to debug problems
+        with those yet.
+
+        * wtf/HashSet.h: (WTF::::remove): The version of checkTableConsistency that's guarded by
+        CHECK_HASHTABLE_CONSISTENCY is now called internalCheckTableConsistency().
+
+        * wtf/HashTable.h:
+        (WTF::HashTable::internalCheckTableConsistency):
+        (WTF::HashTable::internalCheckTableConsistencyExceptSize):
+        (WTF::HashTable::checkTableConsistencyExceptSize):
+        Expose checkTableConsistency() even if CHECK_HASHTABLE_CONSISTENCY is off.
+        (WTF::::add): Updated for checkTableConsistency renaming.
+        (WTF::::addPassingHashCode): Ditto.
+        (WTF::::removeAndInvalidate): Ditto.
+        (WTF::::remove): Ditto.
+        (WTF::::rehash): Ditto.
+        (WTF::::checkTableConsistency): The assertion for !shouldExpand() was not correct - this
+        function returns true for tables with m_table == 0.
+        (WTF::::checkTableConsistencyExceptSize): Call checkValueConsistency for key. Potentially,
+        we could do the same for values.
+
+        * wtf/HashTraits.h:
+        (WTF::GenericHashTraits::checkValueConsistency): An empty function that can be overridden
+        to add checks. Currently, the only override is for pointer hashes.
+
+        * wtf/RefPtrHashMap.h: (WTF::::remove): Updated for checkTableConsistency renaming.
+
+2010-01-27  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove trailing \ from inline function code
+        https://bugs.webkit.org/show_bug.cgi?id=34223
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::countLeadingZerosPartial):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Port WTF's randomNumber
+        https://bugs.webkit.org/show_bug.cgi?id=33566
+
+        Use GETRAND to generate 4 byte random byte sequence to implement
+        weakRandomNumber. Create a secure random number generator with
+        AEECLSID_RANDOM to implement randomNumber.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::weakRandomNumber):
+        (WTF::randomNumber):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Port getCPUTime
+        https://bugs.webkit.org/show_bug.cgi?id=33572
+
+        Use GETUPTIMEMS which returns a continuously and
+        linearly increasing millisecond timer from the time the device
+        was powered on. This function is enough to implement getCPUTime.
+
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Oliver Hunt.
+
+        [BREWMP] Add MarkStack fastMalloc implementation for platforms without VirtualAlloc or mmap.
+        https://bugs.webkit.org/show_bug.cgi?id=33582
+
+        Use fastMalloc and fastFree to implement MarkStack::allocateStack and
+        MarkStack::releaseStack for platforms without page level allocation.
+
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackNone.cpp: Added.
+        (JSC::MarkStack::initializePagesize):
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Don't use time function
+        https://bugs.webkit.org/show_bug.cgi?id=33577
+
+        Calling time(0) in BREW devices causes a crash because time
+        is not properly ported in most devices. Cast currentTime() to
+        time_t to get the same result as time(0).
+
+        * wtf/DateMath.cpp:
+        (WTF::calculateUTCOffset):
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Revert r53899 (HashMap<AtomicStringImpl*, Value> key checks) and subsequent build fixes,
+        because they make SVG tests crash in release builds.
+
+        * wtf/HashMap.h:
+        (WTF::::remove):
+        * wtf/HashSet.h:
+        (WTF::::remove):
+        * wtf/HashTable.h:
+        (WTF::::add):
+        (WTF::::addPassingHashCode):
+        (WTF::::removeAndInvalidate):
+        (WTF::::remove):
+        (WTF::::rehash):
+        (WTF::::checkTableConsistency):
+        (WTF::::checkTableConsistencyExceptSize):
+        * wtf/HashTraits.h:
+        (WTF::GenericHashTraits::emptyValue):
+        (WTF::):
+        * wtf/RefPtrHashMap.h:
+        (WTF::::remove):
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        More Windows build fixing.
+
+        * wtf/HashTraits.h: _msize takes void*, remove const qualifier from type.
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * wtf/HashTraits.h: Include malloc.h for _msize().
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * wtf/HashTable.h: (WTF::HashTable::checkTableConsistencyExceptSize): Remove const from a
+        static (empty) version of this function.
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
+
+        It is very difficult to catch stale pointers that are HashMap keys - since a pointer's hash
+        is just its value, it is very unlikely that any observable problem is reproducible.
+
+        This extends hash table consistency checks to check that pointers are referencing allocated
+        memory blocks, and makes it possible to invoke the checks explicitly (it is not feasible
+        to enable CHECK_HASHTABLE_CONSISTENCY by default, because that affects performance too much).
+
+        * wtf/HashMap.h: (WTF::::checkConsistency): Call through to HashTable implementation. We can
+        add similar calls to HashSet and HashCountedSet, but I haven't seen hard to debug problems
+        with those yet.
+
+        * wtf/HashSet.h: (WTF::::remove): The version of checkTableConsistency that's guarded by
+        CHECK_HASHTABLE_CONSISTENCY is now called internalCheckTableConsistency().
+
+        * wtf/HashTable.h:
+        (WTF::HashTable::internalCheckTableConsistency):
+        (WTF::HashTable::internalCheckTableConsistencyExceptSize):
+        (WTF::HashTable::checkTableConsistencyExceptSize):
+        Expose checkTableConsistency() even if CHECK_HASHTABLE_CONSISTENCY is off.
+        (WTF::::add): Updated for checkTableConsistency renaming.
+        (WTF::::addPassingHashCode): Ditto.
+        (WTF::::removeAndInvalidate): Ditto.
+        (WTF::::remove): Ditto.
+        (WTF::::rehash): Ditto.
+        (WTF::::checkTableConsistency): The assertion for !shouldExpand() was not correct - this
+        function returns true for tables with m_table == 0.
+        (WTF::::checkTableConsistencyExceptSize): Call checkValueConsistency for key. Potentially,
+        we could do the same for values.
+
+        * wtf/HashTraits.h:
+        (WTF::GenericHashTraits::checkValueConsistency): An empty function that can be overridden
+        to add checks. Currently, the only override is for pointer hashes.
+
+        * wtf/RefPtrHashMap.h: (WTF::::remove): Updated for checkTableConsistency renaming.
+
+2010-01-26  Lyon Chen  <liachen@rim.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Opcode.h use const void* for Opcode cause error #1211 for RVCT compiler
+        https://bugs.webkit.org/show_bug.cgi?id=33902
+
+        * bytecode/Opcode.h:
+
+2010-01-26  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Windows build references non-existent include paths
+        https://bugs.webkit.org/show_bug.cgi?id=34175
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+
+2010-01-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Using JavaScriptCore API with a webkit vended context can result in slow script dialog
+        https://bugs.webkit.org/show_bug.cgi?id=34172
+
+        Make the APIShim correctly increment and decrement the timeout
+        entry counter.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+
+2010-01-26  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix compilation of QtScript with non-gcc compilers
+
+        Variable length stack arrays are a gcc extension. Use QVarLengthArray
+        as a more portable solution that still tries to allocate on the stack
+        first.
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::call):
+
+2010-01-26  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix the build on platforms without JIT support.
+
+        The JIT support should be determined at compile-time via wtf/Platform.h
+
+        * qt/api/QtScript.pro:
+
+2010-01-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        First steps of the QtScript API.
+        
+        Two new classes were created; QScriptEngine and QScriptValue.
+        The first should encapsulate a javascript context and the second a script
+        value.
+        
+        This API is still in development, so it isn't compiled by default.
+        To trigger compilation, pass --qmakearg="CONFIG+=build-qtscript" to
+        build-webkit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32565
+
+        * qt/api/QtScript.pro: Added.
+        * qt/api/qscriptconverter_p.h: Added.
+        (QScriptConverter::toString):
+        * qt/api/qscriptengine.cpp: Added.
+        (QScriptEngine::QScriptEngine):
+        (QScriptEngine::~QScriptEngine):
+        (QScriptEngine::evaluate):
+        (QScriptEngine::collectGarbage):
+        * qt/api/qscriptengine.h: Added.
+        * qt/api/qscriptengine_p.cpp: Added.
+        (QScriptEnginePrivate::QScriptEnginePrivate):
+        (QScriptEnginePrivate::~QScriptEnginePrivate):
+        (QScriptEnginePrivate::evaluate):
+        * qt/api/qscriptengine_p.h: Added.
+        (QScriptEnginePrivate::get):
+        (QScriptEnginePrivate::collectGarbage):
+        (QScriptEnginePrivate::makeJSValue):
+        (QScriptEnginePrivate::context):
+        * qt/api/qscriptvalue.cpp: Added.
+        (QScriptValue::QScriptValue):
+        (QScriptValue::~QScriptValue):
+        (QScriptValue::isValid):
+        (QScriptValue::isBool):
+        (QScriptValue::isBoolean):
+        (QScriptValue::isNumber):
+        (QScriptValue::isNull):
+        (QScriptValue::isString):
+        (QScriptValue::isUndefined):
+        (QScriptValue::isError):
+        (QScriptValue::isObject):
+        (QScriptValue::isFunction):
+        (QScriptValue::toString):
+        (QScriptValue::toNumber):
+        (QScriptValue::toBool):
+        (QScriptValue::toBoolean):
+        (QScriptValue::toInteger):
+        (QScriptValue::toInt32):
+        (QScriptValue::toUInt32):
+        (QScriptValue::toUInt16):
+        (QScriptValue::call):
+        (QScriptValue::engine):
+        (QScriptValue::operator=):
+        (QScriptValue::equals):
+        (QScriptValue::strictlyEquals):
+        * qt/api/qscriptvalue.h: Added.
+        (QScriptValue::):
+        * qt/api/qscriptvalue_p.h: Added.
+        (QScriptValuePrivate::):
+        (QScriptValuePrivate::get):
+        (QScriptValuePrivate::QScriptValuePrivate):
+        (QScriptValuePrivate::isValid):
+        (QScriptValuePrivate::isBool):
+        (QScriptValuePrivate::isNumber):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isString):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::isError):
+        (QScriptValuePrivate::isObject):
+        (QScriptValuePrivate::isFunction):
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toBool):
+        (QScriptValuePrivate::toInteger):
+        (QScriptValuePrivate::toInt32):
+        (QScriptValuePrivate::toUInt32):
+        (QScriptValuePrivate::toUInt16):
+        (QScriptValuePrivate::equals):
+        (QScriptValuePrivate::strictlyEquals):
+        (QScriptValuePrivate::assignEngine):
+        (QScriptValuePrivate::call):
+        (QScriptValuePrivate::engine):
+        (QScriptValuePrivate::context):
+        (QScriptValuePrivate::value):
+        (QScriptValuePrivate::object):
+        (QScriptValuePrivate::inherits):
+        (QScriptValuePrivate::isJSBased):
+        (QScriptValuePrivate::isNumberBased):
+        (QScriptValuePrivate::isStringBased):
+        * qt/api/qtscriptglobal.h: Added.
+        * qt/tests/qscriptengine/qscriptengine.pro: Added.
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp: Added.
+        (tst_QScriptEngine::tst_QScriptEngine):
+        (tst_QScriptEngine::~tst_QScriptEngine):
+        (tst_QScriptEngine::init):
+        (tst_QScriptEngine::cleanup):
+        (tst_QScriptEngine::collectGarbage):
+        (tst_QScriptEngine::evaluate):
+        * qt/tests/qscriptvalue/qscriptvalue.pro: Added.
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp: Added.
+        (tst_QScriptValue::tst_QScriptValue):
+        (tst_QScriptValue::~tst_QScriptValue):
+        (tst_QScriptValue::init):
+        (tst_QScriptValue::cleanup):
+        (tst_QScriptValue::ctor):
+        (tst_QScriptValue::toString_data):
+        (tst_QScriptValue::toString):
+        (tst_QScriptValue::copyConstructor_data):
+        (tst_QScriptValue::copyConstructor):
+        (tst_QScriptValue::assignOperator_data):
+        (tst_QScriptValue::assignOperator):
+        (tst_QScriptValue::dataSharing):
+        (tst_QScriptValue::constructors_data):
+        (tst_QScriptValue::constructors):
+        (tst_QScriptValue::call):
+        * qt/tests/tests.pri: Added.
+        * qt/tests/tests.pro: Added.
+
+2010-01-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium Linux tests: the pthread functions on Linux produce segfault if they receive 0 thread handle.
+        After r53714, we can have 0 thread handles passed to pthread_join and pthread_detach if corresponding threads
+        were already terminated and their threadMap entries cleared.
+        Add a 0 check.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+
+2010-01-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
 
-        Reviewed by NOBODY (OOPS!).
+        Refactor JITStubs.cpp so that DEFINE_STUB_FUNCTION is only used once for each function
+        https://bugs.webkit.org/show_bug.cgi?id=33866
+
+        Place the guard USE(JSVALUE32_64) inside the body of the DEFINE_STUB_FUNCTION
+        macro for those functions that are always present.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-01-22  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Remove the Bakefile build system, which is no longer being used.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34022
+
+        * JavaScriptCoreSources.bkl: Removed.
+        * jscore.bkl: Removed.
+
+2010-01-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34025
+        Enable client-based Geolocation abstraction for Mac, Windows AppleWebKit targets.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-01-22  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempted Snow Leopard build fix.
+
+        * wtf/ThreadingPthreads.cpp: Add a forward declaration of a function which is not 'static'.
+
+2009-01-22  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix the leak of ThreadIdentifiers in threadMap across threads.
+        https://bugs.webkit.org/show_bug.cgi?id=32689
+
+        Test is added to DumpRenderTree.mm.
+
+        * Android.mk: Added file ThreadIdentifierDataPthreads.(h|cpp) to build.
+        * Android.v8.wtf.mk: Ditto.
+        * GNUmakefile.am: Ditto.
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Ditto.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+        * wtf/ThreadIdentifierDataPthreads.cpp: Added. Contains custom implementation of thread-specific data that uses custom destructor.
+        (WTF::ThreadIdentifierData::~ThreadIdentifierData): Removes the ThreadIdentifier from the threadMap.
+        (WTF::ThreadIdentifierData::identifier):
+        (WTF::ThreadIdentifierData::initialize):
+        (WTF::ThreadIdentifierData::destruct): Custom thread-specific destructor. Resets the value for the key again to cause second invoke.
+        (WTF::ThreadIdentifierData::initializeKeyOnceHelper):
+        (WTF::ThreadIdentifierData::initializeKeyOnce): Need to use pthread_once since initialization may come on any thread(s).
+        * wtf/ThreadIdentifierDataPthreads.h: Added.
+        (WTF::ThreadIdentifierData::ThreadIdentifierData):
+
+        * wtf/Threading.cpp:
+        (WTF::threadEntryPoint): Move initializeCurrentThreadInternal to after the lock to make
+                                 sure it is invoked when ThreadIdentifier is already established.
+
+        * wtf/Threading.h: Rename setThreadNameInternal -> initializeCurrentThreadInternal since it does more then only set the name now.
+        * wtf/ThreadingNone.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+        * wtf/ThreadingWin.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+        (WTF::initializeThreading): Ditto.
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::clearPthreadHandleForIdentifier): Make it not 'static' so the ~ThreadIdentifierData() in another file can call it.
+        (WTF::initializeCurrentThreadInternal): Set the thread-specific data. The ThreadIdentifier is already established by creating thread.
+        (WTF::waitForThreadCompletion): Remove call to clearPthreadHandleForIdentifier(threadID) since it is now done in ~ThreadIdentifierData().
+        (WTF::detachThread): Ditto.
+        (WTF::currentThread): Use the thread-specific data to get the ThreadIdentifier. It's many times faster then Mutex-protected iteration through the map.
+                              Also, set the thread-specific data if called first time on the thread.
+
+2010-01-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add ThreadSpecific for ENABLE(SINGLE_THREADED)
+        https://bugs.webkit.org/show_bug.cgi?id=33878
+
+        Implement ThreadSpecific with a simple getter/setter
+        when ENABLE(SINGLE_THREADED) is true.
+
+        Due to the change in https://bugs.webkit.org/show_bug.cgi?id=33236,
+        an implementation of ThreadSpecific must be available to build WebKit.
+        This causes a build failure for platforms without a proper
+        ThreadSpecific implementation.
+
+        * wtf/ThreadSpecific.h:
+        (WTF::::ThreadSpecific):
+        (WTF::::~ThreadSpecific):
+        (WTF::::get):
+        (WTF::::set):
+        (WTF::::destroy):
+
+2010-01-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add fastStrDup to FastMalloc
+        https://bugs.webkit.org/show_bug.cgi?id=33937
+
+        The new string returned by fastStrDup is obtained with fastMalloc,
+        and can be freed with fastFree. This makes the memory management 
+        more consistent because we don't need to keep strdup allocated pointers
+        and free them with free(). Instead we can use fastFree everywhere.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastStrDup):
+        * wtf/FastMalloc.h:
+
+2010-01-21  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        history.back() for same-document history traversals isn't synchronous as the specification states.
+        <rdar://problem/7535011> and https://bugs.webkit.org/show_bug.cgi?id=33538
+
+        * wtf/Platform.h: Add a "HISTORY_ALWAYS_ASYNC" enable and turn it on for Chromium.
+
+2010-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Always create a prototype for automatically managed classes.
+        
+        This fixes some errors where prototype chains were not correctly hooked
+        up, and also ensures that API classes work correctly with features like
+        instanceof.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::create): Cleaned up some of this code. Also changed it
+        to always create a prototype class.
+
+        * API/tests/testapi.c:
+        (Derived2_class):
+        (main): Fixed a null value crash in the exception checking code.
+        * API/tests/testapi.js: Added some tests for the case where a prototype
+        chain would not be hooked up correctly.
+
+2010-01-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Force JSC to create a prototype chain for API classes with a
+        parent class but no static functions.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::create):
+
+2010-01-21  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Object.getOwnPropertyDescriptor always returns undefined for JS API objects
+        https://bugs.webkit.org/show_bug.cgi?id=33946
+
+        Ideally the getOwnPropertyDescriptor() reimplementation should return an
+        access descriptor that wraps the property getter and setter callbacks, but
+        that approach is much more involved than returning a value descriptor.
+        Keep it simple for now.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyDescriptor):
+        * API/tests/testapi.js:
+
+2010-01-20  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger): Remove unnecessary function call.
+
+2010-01-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Use the inline i386 assembly for x86_64 as well rather than falling back to using pthread mutexes.
+
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+
+2010-01-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7215063> Use GCD instead of an extra thread for FastMalloc scavenging on platforms where it is supported
+
+        Abstract the background scavenging slightly so that an alternate implementation that uses GCD can be used on platforms
+        where it is supported.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::init):
+        (WTF::TCMalloc_PageHeap::initializeScavenger):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMalloc_PageHeap::shouldContinueScavenging):
+        (WTF::TCMalloc_PageHeap::Delete):
+        (WTF::TCMalloc_PageHeap::periodicScavenge):
+        * wtf/Platform.h:
+
+2010-01-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7562708> REGRESSION(53460): Heap::destroy may not run
+        all destructors
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::freeBlocks): Instead of fully marking protected objects,
+        just set their mark bits. This prevents protected objects from keeping
+        unprotected objects alive. Destructor order is not guaranteed, so it's
+        OK to destroy objects pointed to by protected objects before destroying
+        protected objects.
+
+2010-01-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        CrossThreadCopier needs to support ThreadSafeShared better.
+        https://bugs.webkit.org/show_bug.cgi?id=33698
+
+        * wtf/TypeTraits.cpp: Added tests for the new type traits.
+        * wtf/TypeTraits.h:
+        (WTF::IsSubclass): Determines if a class is a derived from another class.
+        (WTF::IsSubclassOfTemplate): Determines if a class is a derived from a
+        template class (with one parameter that is unknown).
+        (WTF::RemoveTemplate): Reveals the type for a template parameter.
+
+2010-01-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler and Adam Roben.
+
+        Feature defines are difficult to maintain on Windows builds
+        https://bugs.webkit.org/show_bug.cgi?id=33883
+
+        FeatureDefines.vsprops are now maintained in a way similar to
+        Configurations/FeatureDefines.xcconfig, with the added advantage
+        of having a single FeatureDefines file across all projects.
+
+        * Configurations/FeatureDefines.xcconfig: Add comments about keeping feature definitions in sync.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add FeatureDefines.vsprops inherited property sheet.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add FeatureDefines.vsprops inherited property sheet.
+
+2010-01-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix for r53547.
+
+        * DerivedSources.pro:
+
+2010-01-20  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make extraCompilers for generated sources depend on their scripts
+
+        * DerivedSources.pro:
+
+2010-01-19  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        When JavaScriptCore calls Debugger::Exception, have it pass a
+        hasHandler variable that represents if exception is being handled
+        in the same function (not in a parent on the call stack).
+        
+        This just adds a new parameter, no behavior is changed.
+
+        * debugger/Debugger.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2010-01-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Inline functions that are hot in DOM manipulation
+        https://bugs.webkit.org/show_bug.cgi?id=33820
+        
+        (3% speedup on Dromaeo DOM Core tests)
+
+        * runtime/WeakGCMap.h:
+        (JSC::::get): inline
+
+2010-01-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix for JIT with RVCT.
+
+        Remove IMPORT statement; cti_vm_throw is already defined in JITStubs.h.
+        Remove extra ')'.
+
+        * jit/JITStubs.cpp:
+        (JSC::ctiVMThrowTrampoline):
+
+2010-01-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
+
+        This bug was caused by a GC-protected object being destroyed early by
+        Heap::destroy. Clients of the GC protect APIs (reasonably) expect pointers
+        to GC-protected memory to be valid.
+
+        The solution is to do two passes of tear-down in Heap::destroy. The first
+        pass tears down all unprotected objects. The second pass ASSERTs that all
+        previously protected objects are now unprotected, and then tears down
+        all perviously protected objects. These two passes simulate the two passes
+        that would have been required to free a protected object during normal GC.
+        
+        * API/JSContextRef.cpp: Removed some ASSERTs that have moved into Heap.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy): Moved ASSERTs to here.
+        (JSC::Heap::freeBlock): Tidied up the use of didShrink by moving its
+        setter to the function that does the shrinking.
+        (JSC::Heap::freeBlocks): Implemented above algorithm.
+        (JSC::Heap::shrinkBlocks): Tidied up the use of didShrink.
+
+2010-01-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Reverting r53455, breaks 2 javascriptcore tests.
+
+        * API/JSContextRef.cpp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::shrinkBlocks):
+
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Revert r53454, since it causes much sadness in this world.
+
+        * runtime/UString.cpp:
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
+
+        This bug was caused by a GC-protected object being destroyed early by
+        Heap::destroy. Clients of the GC protect APIs (reasonably) expect pointers
+        to GC-protected memory to be valid.
+
+        The solution is to do two passes of tear-down in Heap::destroy. The first
+        pass tears down all unprotected objects. The second pass ASSERTs that all
+        previously protected objects are now unprotected, and then tears down
+        all perviously protected objects. These two passes simulate the two passes
+        that would have been required to free a protected object during normal GC.
+        
+        * API/JSContextRef.cpp: Removed some ASSERTs that have moved into Heap.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy): Moved ASSERTs to here.
+        (JSC::Heap::freeBlock): Tidied up the use of didShrink by moving its
+        setter to the function that does the shrinking.
+        (JSC::Heap::freeBlocks): Implemented above algorithm.
+        (JSC::Heap::shrinkBlocks): Tidied up the use of didShrink.
+
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove UntypedPtrAndBitfield from UStringImpl (akin to PtrAndFlags).
+
+        This break the OS X Leaks tool.  Instead, free up some more bits from the refCount.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=month.
+        https://bugs.webkit.org/show_bug.cgi?id=33021
+
+        Expose the following functions to be used by WebCore:
+         - WTF::msToyear()
+         - WTF::dayInYear()
+         - WTF::monthFromDayInYear()
+         - WTF::dayInMonthFromDayInYear()
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::msToYear): Remove "static inline".
+        (WTF::dayInYear): Remove "static inline".
+        (WTF::monthFromDayInYear): Remove "static inline".
+        (WTF::dayInMonthFromDayInYear): Remove "static inline".
+        * wtf/DateMath.h: Declare the above functions.
+
+2010-01-18  Darin Adler  <darin@apple.com>
+
+        Fix build by reverting the previous change.
+
+        * runtime/UString.h: Rolled out the FastAllocBase base class.
+        It was making UString larger, and therefore JSString larger,
+        and too big for a garbage collection cell.
+
+        This raises the unpleasant possibility that many classes became
+        larger because we added the FastAllocBase base class. I am
+        worried about this, and it needs to be investigated.
+
+2010-01-18  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for UString class
+        https://bugs.webkit.org/show_bug.cgi?id=27831
+
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new' and no need to be copyable:
+
+        class name     - instantiated at:
+        classs UString - JavaScriptCore/runtime/UString.cpp:160
+
+        * runtime/UString.h:
+
+2010-01-18  Evan Cheng  <evan.cheng@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add some ALWAYS_INLINE for key functions not inlined by some versions of GCC.
+        rdar://problem/7553780
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::getPropertySlot): ALWAYS_INLINE both overloads.
+        * runtime/JSString.h:
+        (JSC::JSString::JSString): ALWAYS_INLINE the version that takes a UString.
+        * runtime/UString.h:
+        (JSC::operator==): ALWAYS_INLINE the version that compares two UString objects.
+
+2010-01-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Delete dftables-xxxxxxxx.in files automatically.
+        https://bugs.webkit.org/show_bug.cgi?id=33796
+
+        * pcre/dftables: unlink unnecessary temporary file.
+
+2010-01-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Force qmake to generate a single makefile for DerivedSources.pro
+
+        * DerivedSources.pro:
+
+2010-01-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Rubber-stamped by Gustavo Noronha Silva.
+
+        Rolling out r53391 and r53392 because of random crashes on buildbots.
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * runtime/UString.cpp:
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        * runtime/UString.h:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix the build with strict gcc and RVCT versions: It's not legal to cast a
+        pointer to a function to a void* without an intermediate cast to a non-pointer
+        type. A cast to a ptrdiff_t inbetween fixes it.
+
+        * runtime/JSString.h:
+        (JSC::Fiber::JSString):
+
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove UntypedPtrAndBitfield from UStringImpl (akin to PtrAndFlags).
+
+        This break the OS X Leaks tool.  Instead, free up some more bits from the refCount.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from JIT data stuctures.
+
+        These break the OS X Leaks tool.  Free up a bit in CallLinkInfo, and invalid
+        permutation of pointer states in MethodCallLinkInfo to represent the removed bits.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * runtime/UString.h:
+
+2010-01-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Cache JS string values made from DOM strings (Dromaeo speedup)
+        https://bugs.webkit.org/show_bug.cgi?id=33768
+        <rdar://problem/7353576>
+
+        * runtime/JSString.h:
+        (JSC::jsStringWithFinalizer): Added new mechanism for a string to have an optional
+        finalizer callback, for the benefit of weak-referencing caches.
+        (JSC::):
+        (JSC::Fiber::JSString):
+        (JSC::Fiber::~JSString):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope): Clear fibers so this doesn't look like a string with a finalizer.
+        * runtime/WeakGCMap.h: Include "Collector.h" to make this header includable by itself.
+
+2010-01-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for <rdar://problem/7548432>
+        Add ALWAYS_INLINE to jsLess for a 1% speedup on llvm-gcc.
+
+        * runtime/Operations.h:
+        (JSC::jsLess):
+
+2010-01-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESISON: Google maps buttons not working properly
+        https://bugs.webkit.org/show_bug.cgi?id=31871
+
+        REGRESSION(r52948): JavaScript exceptions thrown on Google Maps when
+        getting directions for a second time
+        https://bugs.webkit.org/show_bug.cgi?id=33446
+        
+        SunSpider and v8 report no change.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID): Update our cached offset in case
+        flattening the dictionary changed any of its offsets.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain): ditto
+
+2010-01-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33705
+        UStringImpl::create() should use internal storage
+
+        When creating a UStringImpl copying of a UChar*, we can use an internal buffer,
+        by calling UStringImpl::tryCreateUninitialized().
+
+        Also, remove duplicate of copyChars from JSString, call UStringImpl's version.
+
+        Small (max 0.5%) progression on Sunspidey.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::create):
+
+2010-01-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make naming & behaviour of UString[Impl] methods more consistent.
+        https://bugs.webkit.org/show_bug.cgi?id=33702
+
+        UString::create() creates a copy of the UChar* passed, but UStringImpl::create() assumes
+        that it should assume ownership of the provided buffer (with UString::createNonCopying()
+        and UStringImpl::createCopying() providing the alternate behaviours).  Unify on create()
+        taking a copy of the provided buffer.  For non-copying cases, use the name 'adopt', and
+        make this method take a Vector<UChar>&.  For cases where non-copying construction was being
+        used, other than from a Vector<UChar>, change the code to allocate the storage along with
+        the UStringImpl using UStringImpl::createUninitialized().  (The adopt() method also more
+        closely matches that of WebCore::StringImpl).
+
+        Also, UString::createUninitialized() and UStringImpl::createUninitialized() have incompatible
+        behaviours, in that the UString form sets the provided UChar* to a null or non-null value to
+        indicate success or failure, but UStringImpl uses the returned PassRefPtr<UStringImpl> to
+        indicate when allocation has failed (potentially leaving the output Char* uninitialized).
+        This is also incompatible with WebCore::StringImpl's behaviour, in that
+        StringImpl::createUninitialized() will CRASH() if unable to allocate.  Some uses of
+        createUninitialized() in JSC are unsafe, since they do not test the result for null.
+        UStringImpl's indication is preferable, since we may want a successful call to set the result
+        buffer to 0 (specifically, StringImpl returns 0 for the buffer where createUninitialized()
+        returns the empty string, which seems reasonable to catch bugs early).  UString's method
+        cannot support UStringImpl's behaviour directly, since it returns an object rather than a
+        pointer.
+            - remove UString::createUninitialized(), replace with calls to UStringImpl::createUninitialized()
+            - create a UStringImpl::tryCreateUninitialized() form UStringImpl::createUninitialized(),
+              with current behaviour, make createUninitialized() crash on failure to allocate.
+            - make cases in JSC that do not check the result call createUninitialized(), and cases that do
+              check call tryCreateUninitialized().
+
+        Rename computedHash() to existingHash(), to bring this in line wih WebCore::StringImpl.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * JavaScriptCore.exp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::CStringTranslator::translate):
+        (JSC::UCharBufferTranslator::translate):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        * runtime/Lookup.h:
+        (JSC::HashTable::entry):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::release):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/Structure.cpp:
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::checkConsistency):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTableHash::hash):
+        * runtime/UString.cpp:
+        (JSC::createRep):
+        (JSC::UString::UString):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::adopt):
+        (JSC::IdentifierRepHash::hash):
+        (JSC::makeString):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::adopt):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::tryCreateUninitialized):
+        (JSC::UStringImpl::existingHash):
+
+2010-01-13  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSON.stringify and JSON.parse needlessly process properties in the prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=33053
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (buildfix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33641
+        Assertion failure in Lexer.cpp if input stream ends while in string escape
+
+        Test: fast/js/end-in-string-escape.html
+
+        * parser/Lexer.cpp: (JSC::Lexer::lex): Bail out quickly on end of stream, not giving the
+        assertion a chance to fire.
+
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (buildfix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig & Darin Adler.
+
+        Three quick fixes to UStringImpl.
+            - The destroy() method can be switched back to a normal destructor; since we've switched
+              the way we protect static strings to be using an odd ref-count the destroy() won't abort.
+            - The cost() calculation logic was wrong.  If you have multiple JSStrings wrapping substrings
+              of a base string, they would each report the full cost of the base string to the heap.
+              Instead we should only be reporting once for the base string.
+            - Remove the overloaded new operator calling fastMalloc, replace this with a 'using' to pick
+              up the implementation from the parent class.
+
+        * JavaScriptCore.exp:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::deref):
+
+2010-01-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Split the build process in two different .pro files.
+        This allows qmake to be run once all source files are available.
+
+        * DerivedSources.pro: Added.
+        * JavaScriptCore.pri: Moved source generation to DerivedSources.pro
+        * pcre/pcre.pri: Moved source generation to DerivedSources.pro
+
+2010-01-12  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [ES5] Implement Object.getOwnPropertyNames
+        https://bugs.webkit.org/show_bug.cgi?id=32242
+
+        Add an extra argument to getPropertyNames() and getOwnPropertyNames()
+        (and all reimplementations thereof) that indicates whether non-enumerable
+        properties should be added.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyNames):
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertyNames):
+        * runtime/Arguments.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyNames):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertyNames):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyNames):
+        * runtime/JSFunction.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertyNames):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getOwnPropertyNames):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::getOwnPropertyNames):
+        * runtime/JSVariableObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+        * runtime/StringObject.h:
+        * runtime/Structure.cpp: Rename getEnumerablePropertyNames() to getPropertyNames(), which takes an extra argument.
+        (JSC::Structure::getPropertyNames):
+        * runtime/Structure.h:
+        (JSC::):
+
+2010-01-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33540
+        Make it possible to build in debug mode with assertions disabled
+
+        * jit/JITStubs.cpp: (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Identifier.cpp: (JSC::Identifier::checkSameIdentifierTable):
+        * wtf/FastMalloc.cpp:
+        * wtf/HashTable.h: (WTF::HashTableConstIterator::checkValidity):
+        * yarr/RegexCompiler.cpp: (JSC::Yarr::compileRegex):
+
+2009-11-23  Yong Li  <yoli@rim.com>
+
+        Reviewed by Adam Treat.
+
+        Make GIF decoder support down-sampling
+        https://bugs.webkit.org/show_bug.cgi?id=31806
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::upperBoundScaledY):
+        (WebCore::ImageDecoder::lowerBoundScaledY):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::scaledRect):
+        (WebCore::RGBA32Buffer::setScaledRect):
+        (WebCore::ImageDecoder::scaledSize):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::sizeNowAvailable):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        (WebCore::copyOnePixel):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::frameComplete):
+
+2010-01-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        ecma/Date/15.9.5.12-1.js fails every night at midnight
+        https://bugs.webkit.org/show_bug.cgi?id=28041
+
+        Change the test to use a concrete time instead of "now".
+
+        * tests/mozilla/ecma/Date/15.9.5.10-1.js:
+        * tests/mozilla/ecma/Date/15.9.5.12-1.js:
+
+2010-01-11  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Enable JIT and YARR_JIT if (CPU(X86_64) && OS(LINUX) && GCC_VERSION >= 40100)
+
+        * wtf/Platform.h:
+
+2010-01-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33481
+        Uninitialized data members in ArrayStorage
+        
+        SunSpider reports no change.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Initialize missing data members in the two cases
+        where we don't use fastZeroedMalloc, so it doesn't happen automatically.
+
+2010-01-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33480
+        
+        Improve debugging reliability for WTF on Windows.
+        Store WTF static library's PDB file into a better location.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2010-01-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+        Remove extraneous entries from def file causing build warning.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-10  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        RegExp.prototype.toString returns "//" for empty regular expressions
+        https://bugs.webkit.org/show_bug.cgi?id=33319
+
+        "//" starts a single-line comment, hence "/(?:)/" should be used, according to ECMA.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+        * tests/mozilla/ecma_2/RegExp/properties-001.js:
+        (AddRegExpCases):
+        * tests/mozilla/js1_2/regexp/toString.js:
+        Update relevant Mozilla tests (Mozilla has had this behavior since November 2003).
+
+2010-01-10  Darin Adler  <darin@apple.com>
+
+        * tests/mozilla/ecma/Array/15.4.1.1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.1.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.1-1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.2-1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.2-2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.3.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.4.1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/LexicalConventions/7.7.4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.13.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.16.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.18.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.5.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.7.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.3.1-3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.3.1-4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/TypeConversion/9.5-2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/jsref.js: Modified property allow-tabs.
+        * tests/mozilla/ecma/shell.js: Modified property allow-tabs.
+        * tests/mozilla/ecma_2/LexicalConventions/keywords-001.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/RegExp/exec-001.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/String/match-004.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/String/replace-001.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/String/split-002.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/jsref.js: Modified property allow-tabs.
+        * tests/mozilla/ecma_2/shell.js: Added property allow-tabs.
+        * tests/mozilla/ecma_3/Date/shell.js: Modified property allow-tabs.
+        * tests/mozilla/ecma_3/Exceptions/regress-181654.js: Added property allow-tabs.
+        * tests/mozilla/ecma_3/RegExp/regress-209067.js: Added property allow-tabs.
+        * tests/mozilla/ecma_3/RegExp/regress-85721.js: Added property allow-tabs.
+        * tests/mozilla/importList.html: Added property allow-tabs.
+        * tests/mozilla/js1_1/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/general1.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/general2.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/slice.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/splice1.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/splice2.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Objects/toString-001.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/String/charCodeAt.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/String/concat.js: Modified property allow-tabs.
+        * tests/mozilla/js1_2/String/match.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/String/slice.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/Function_object.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/Number.js: Modified property allow-tabs.
+        * tests/mozilla/js1_2/function/String.js: Modified property allow-tabs.
+        * tests/mozilla/js1_2/function/nesting.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/regexparg-1.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/regexparg-2-n.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/jsref.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/operator/equality.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/operator/strictEquality.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_dollar_number.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_input.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_input_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastIndex.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastMatch.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastMatch_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastParen.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastParen_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_leftContext.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_leftContext_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_multiline.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_multiline_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_object.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_rightContext.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_rightContext_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/alphanumeric.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/asterisk.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/backslash.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/backspace.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/beginLine.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/character_class.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/compile.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/control_characters.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/digit.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/dot.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/endLine.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/everything.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/exec.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/flags.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/global.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/hexadecimal.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/ignoreCase.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/interval.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/octal.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/parentheses.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/plus.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/question_mark.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/simple_form.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/source.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/special_characters.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/string_replace.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/string_search.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/string_split.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/test.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/toString.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/vertical_bar.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/whitespace.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/word_boundary.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/break.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/continue.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/do_while.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/switch.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/switch2.js: Added property allow-tabs.
+        * tests/mozilla/js1_3/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_4/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_5/Regress/regress-111557.js: Added property allow-tabs.
+        * tests/mozilla/js1_5/Regress/regress-216320.js: Added property allow-tabs.
+        * tests/mozilla/menuhead.html: Added property allow-tabs.
+        * tests/mozilla/mklistpage.pl: Added property allow-tabs.
+        * tests/mozilla/runtests.pl: Added property allow-tabs.
+
+2010-01-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33417
+
+        Cleans up style errors exposed by the patch for bug #33198.
+        Moreover, fixes all "Weird number of spaces at line-start. Are you using a 4-space indent?"
+        errors reported by check-webkit-style.
+
+        No functionality was changed. So, no new tests.
+
+        * wtf/Platform.h:
+
+2010-01-08  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Don't store RegExp flags string representation
+        https://bugs.webkit.org/show_bug.cgi?id=33321
+
+        It's unused; the string representation is reconstructed from flags.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+
+2010-01-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Memory use grows grows possibly unbounded in this JavaScript Array test case
+        https://bugs.webkit.org/show_bug.cgi?id=31675
+
+        This fixes one observed bug in this test case, which is that
+        arrays don't report extra cost for the sparse value maps.
+
+        SunSpider reports a small speedup.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase): Report extra memory cost for
+        the sparse value map.
+        * runtime/JSArray.h: 
+
+2010-01-08  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Remove unnecessary #include from FastMalloc.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=33393
+
+        * wtf/FastMalloc.cpp:
+
+2010-01-08  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52983.
+        http://trac.webkit.org/changeset/52983
+        https://bugs.webkit.org/show_bug.cgi?id=33321
+
+        Broke 59 JavaScriptCore tests.  I don't think Kent knew about
+        run-javascriptcore-tests.  Sadly neither does the commit-bot,
+        yet.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+        (JSC::RegExp::flags):
+
+2010-01-08  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52981.
+        http://trac.webkit.org/changeset/52981
+        https://bugs.webkit.org/show_bug.cgi?id=33319
+
+        Caused two JS tests to start failing:
+        ecma_2/RegExp/properties-001.js and js1_2/regexp/toString.js
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+2010-01-08  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Don't store RegExp flags string representation
+        https://bugs.webkit.org/show_bug.cgi?id=33321
+
+        It's unused; the string representation is reconstructed from flags.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+
+2010-01-08  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        RegExp.prototype.toString returns "//" for empty regular expressions
+        https://bugs.webkit.org/show_bug.cgi?id=33319
+
+        "//" starts a single-line comment, hence "/(?:)/" should be used, according to ECMA.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+2010-01-08  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
 
         RVCT compiler with "-Otime -O3" optimization tries to optimize out 
         inline new'ed pointers that are passed as arguments.
         Proposed patch assigns new'ed pointer explicitly outside function call.
 
+        https://bugs.webkit.org/show_bug.cgi?id=33084
+
         * API/JSClassRef.cpp:
         (OpaqueJSClass::OpaqueJSClass):
         (OpaqueJSClassContextData::OpaqueJSClassContextData):
 
-2009-11-19  Thiago Macieira <thiago.macieira@nokia.com>
+2010-01-08  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove an unnecessary cacheFlush from ARM_TRADITIONAL JIT
+        https://bugs.webkit.org/show_bug.cgi?id=33203
+
+        * assembler/ARMAssembler.cpp: Remove obsolete linkBranch function.
+        (JSC::ARMAssembler::executableCopy): Inline a clean linkBranch code.
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::getLdrImmAddress): Use inline function.
+        (JSC::ARMAssembler::getLdrImmAddressOnPool): Ditto.
+        (JSC::ARMAssembler::patchPointerInternal): Remove an unnecessary cacheFlush.
+        (JSC::ARMAssembler::linkJump): Use patchPointerInternal instead of linkBranch.
+        (JSC::ARMAssembler::linkCall): Ditto.
+        (JSC::ARMAssembler::relinkCall): Ditto.
+
+2010-01-07  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Build fix for JSVALUE32 when ENABLE_JIT_OPTIMIZE* are disabled
+        https://bugs.webkit.org/show_bug.cgi?id=33311
+
+        Move compileGetDirectOffset function to common part of JSVALUE32
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+
+2010-01-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Allow call sites to determine if ASSERT_* and LOG_* macros are operational
+        https://bugs.webkit.org/show_bug.cgi?id=33020
+
+        * wtf/Assertions.h: Set ASSERT_MSG_DISABLED, FATAL_DISABLED,
+        ERROR_DISABLED, LOG_DISABLED to 1 if the compiler does not support
+        variadic macros. Refactor for better readibility.
+
+2010-01-07  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32987
+
+        Added ENABLE_XHTMLMP flag. Disabled by default.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-01-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [Symbian] Port ARM traditional JIT Trampolines to RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=30552
+
+        Take the GCC implementation and mechanically convert
+        it to RVCT syntax.
+
+        Use 'bx rX' instead of 'mov pc, rX' when it is available.
+
+        Developed in cooperation with Iain Campbell and Gabor Loki.
+
+        * JavaScriptCore.pri: Extra step to generate RVCT stubs. The 
+        script generation intentionally executed all the time not just
+        for RVCT targets.
+
+        * create_rvct_stubs: Added. Perl script to expand precompiler macros
+        for RVCT assembler - the template is defined in JITStubs.cpp.
+
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::ctiVMThrowTrampoline):
+        (JSC::ctiOpThrowNotCaught):
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix a crash seen on the buildbots.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Disable specific function tracking here,
+        instead of in WebCore, to ensure that the disabling happens before a
+        specific function can be registered.
+
+2010-01-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Mac build fix.
+
+        * JavaScriptCore.exp: Export new JSGlobalData static data members.
+
+2010-01-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33057
+        REGRESSION(r49365): typeof(xhr.responseText) != "string" in Windows
+
+        <rdar://problem/7296920> REGRESSION: WebKit fails to start PeaceKeeper benchmark
+
+        Test: fast/js/webcore-string-comparison.html
+
+        In r49365, some code was moved from JSString.cpp to JSString.h, and as a result, WebCore
+        got a way to directly instantiate JSStrings over DLL borders. Since vftable for JSString was
+        not exported, objects created from WebCore got a different vptr, and JavaScriptCore
+        optimizations that relied on vptr of all JSString objects being equal failed.
+
+        * config.h: Added a JS_EXPORTCLASS macro for exporting classes. It's currently the same as
+        JS_EXPORTDATA, but it clearly needed a new name.
+
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::createNonDefault):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::sharedInstance):
+        * runtime/JSGlobalData.h:
+        Store vptrs just once, no need to repeatedly pick and copy them. This makes it possible to
+        assert vptr correctness in object destructors (which don't have access to JSGlobalData,
+        and even Heap::heap(this) will fail for fake objects created from storeVPtrs()).
+
+        * runtime/JSArray.cpp: (JSC::JSArray::~JSArray): Assert that vptr is what we expect it to be.
+        It's important to assert in destructor, because MSVC changes the vptr after constructor
+        is invoked.
+        * runtime/JSByteArray.cpp: (JSC::JSByteArray::~JSByteArray): Ditto.
+        * runtime/JSByteArray.h: Ditto.
+        * runtime/JSFunction.h: Ditto.
+        * runtime/JSFunction.cpp: (JSC::JSFunction::~JSFunction): Ditto.
+
+        * runtime/JSCell.h: (JSC::JSCell::setVPtr): Added a method to substitute vptr for another
+        one.
+
+        * runtime/JSString.h: Export JSString class together with its vftable, and tell other
+        libraries tp import it. This is needed on platforms that have a separate JavaScriptCore
+        dynamic library - and on Mac, we already did the export via JavaScriptCore.exp.
+        (JSC::JSString::~JSString): Assert tha vptr is what we expect it to be.
+        (JSC::fixupVPtr): Store a previously saved primary vftable pointer (do nothing if building
+        JavaScriptCore itself).
+        (JSC::jsSingleCharacterString): Call fixupVPtr in case this is call across DLL boundary.
+        (JSC::jsSingleCharacterSubstring): Ditto.
+        (JSC::jsNontrivialString): Ditto.
+        (JSC::jsString): Ditto.
+        (JSC::jsSubstring): Ditto.
+        (JSC::jsOwnedString): Ditto.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export the new static
+        JSGlobalData members that are used in WebCore via inline functions.
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Safari memory usage skyrockets using new Google AdWords interface
+        https://bugs.webkit.org/show_bug.cgi?id=33343
+
+        The memory use was caused by the global object creating too many structures
+        as it thrashed between different specific functions.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::addAnonymousSlotsTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::despecifyAllFunctions):
+        * runtime/Structure.h:
+        (JSC::Structure::disableSpecificFunctionTracking): Track a thrash count
+        for specific functions. Disable specific function tracking once the
+        thrash count has been hit.
+
+2010-01-07  Csaba Osztrogonác  <ossy@webkit.org>
 
         Reviewed by Simon Hausmann.
 
-        Build fix for 32-bit Sparc machines: these machines are big-endian.
+        [Qt] Enable JIT in debug mode on win32 after r51141 fixed the crashes.
+
+        * JavaScriptCore.pri:
+
+2010-01-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Mac] Build fix when FAST_MALLOC_MATCH_VALIDATION=1
+        https://bugs.webkit.org/show_bug.cgi?id=33312
+
+        Using of operator += cause compile error on Mac, so it is changed to
+        "= static_cast<AllocAlignmentInteger*>(old_ptr) + 1".
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::realloc):
+
+2010-01-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Build fix when FAST_MALLOC_MATCH_VALIDATION=1
+        https://bugs.webkit.org/show_bug.cgi?id=33312
+
+        Remove pByte (committed in r42344 from #20422), because pByte doesn't
+        exist and it is unnecessary.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::realloc):
+
+2010-01-06  Gavin Barraclough  <barraclough@apple.com>
+
+        QT build fix.
+
+        * runtime/Identifier.cpp:
+        (JSC::createIdentifierTableSpecific):
+
+2010-01-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix part I.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-06  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * runtime/Identifier.cpp:
+        (JSC::createIdentifierTableSpecificCallback):
+
+2010-01-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33236
+        Remove m_identifierTable pointer from UString
+
+        Currently every string holds a pointer so that during destruction,
+        if a string has been used as an identifier, it can remove itself
+        from the table.  By instead accessing the identifierTable via a
+        thread specific tracking the table associated with the current
+        globaldata, we can save the memory cost of this pointer.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+
+            - change the API shims to track the identifierTable of the current JSGlobalData.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupCreate):
+
+            - update creation of JSGlobalData for API usage to use new create method.
+            - fix shim instanciation bug in JSGlobalContextCreateInGroup.
+
+        * JavaScriptCore.exp:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+
+            - add asserts to check the identifierTable is being tracked correctly.
+
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierTable::~IdentifierTable):
+        (JSC::IdentifierTable::add):
+        (JSC::Identifier::remove):
+        (JSC::Identifier::checkSameIdentifierTable):
+        (JSC::createIdentifierTableSpecificCallback):
+        (JSC::createIdentifierTableSpecific):
+        (JSC::createDefaultDataSpecific):
+
+            - Use currentIdentifierTable() instead of UStringImpl::m_identifierTable.
+            - Define methods to access the thread specific identifier tables.
+
+        * runtime/Identifier.h:
+        (JSC::ThreadIdentifierTableData::ThreadIdentifierTableData):
+        (JSC::defaultIdentifierTable):
+        (JSC::setDefaultIdentifierTable):
+        (JSC::currentIdentifierTable):
+        (JSC::setCurrentIdentifierTable):
+        (JSC::resetCurrentIdentifierTable):
+
+            - Declare methods to access the thread specific identifier tables.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::createNonDefault):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::sharedInstance):
+
+            - creation of JSGlobalData objects, other than for API usage, associate themselves with the current thread.
+
+        * runtime/JSGlobalData.h:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::destroy):
+
+            - destroy() method should be using isIdentifier().
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+
+            - replace m_identifierTable with a single m_isIdentifier bit.
+
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+            - change string hash result from 32-bit to 31-bit, to free a bit in UStringImpl for m_isIdentifier.
+
+2009-12-25 Patrick Gansterer <paroga@paroga.com>
+ 
+        Reviewed by Eric Seidel.
+
+        Buildfix for WinCE + style fixes.
+        https://bugs.webkit.org/show_bug.cgi?id=32939
+
+        * jsc.cpp:
+        (functionPrint):
+        (functionQuit):
+        (parseArguments):
+        (fillBufferWithContentsOfFile):
+ 
+2010-01-05  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        WinCE buildfix after r52791 (renamed PLATFORM(WINCE) to OS(WINCE)).
+        https://bugs.webkit.org/show_bug.cgi?id=33205
+
+        * jit/ExecutableAllocator.h:
+
+2010-01-05  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Added compiler error for unsupported platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=33112
+
+        * jit/JITStubs.cpp:
+
+2010-01-05  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Follow r52729 in ARMAssembler.
+        https://bugs.webkit.org/show_bug.cgi?id=33208
+
+        Use WTF_ARM_ARCH_AT_LEAST instead of ARM_ARCH_VERSION
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::encodeComplexImm): Move tmp declaration to ARMv7
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::bkpt):
+
+2010-01-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Unreviewed build fix for Gtk+
+
+        Don't use // comments in Platform.h, at least some of them seem to make the version of GCC
+        used on the Gtk buildbot unhappy.
 
         * wtf/Platform.h:
 
-2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Fisher.
+
+        Reorganize, document and rename OS() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33198
+
+        * wtf/Platform.h: Rename, reorganize and document OS() macros.
+
+        Adapt to name changes. Also fixed a few incorrect OS checks.
+
+        * API/JSContextRef.cpp:
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::isVFPPresent):
+        * assembler/MacroAssemblerX86Common.h:
+        * bytecode/SamplingTool.cpp:
+        * config.h:
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorSymbian.cpp:
+        * jit/ExecutableAllocatorWin.cpp:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        * jsc.cpp:
+        (main):
+        * parser/Grammar.y:
+        * profiler/ProfileNode.cpp:
+        (JSC::getCount):
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::currentThreadStackBase):
+        (JSC::getCurrentPlatformThread):
+        (JSC::suspendThread):
+        (JSC::resumeThread):
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+        * runtime/Collector.h:
+        * runtime/DateConstructor.cpp:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreading):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackPosix.cpp:
+        * runtime/MarkStackSymbian.cpp:
+        * runtime/MarkStackWin.cpp:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncLastIndexOf):
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+        * runtime/UString.cpp:
+        (JSC::UString::from):
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+        * wtf/CurrentTime.cpp:
+        (WTF::lowResUTCTime):
+        * wtf/CurrentTime.h:
+        (WTF::getLocalTime):
+        * wtf/DateMath.cpp:
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_ThreadCache::InitModule):
+        (WTF::TCMallocStats::):
+        * wtf/FastMalloc.h:
+        * wtf/MathExtras.h:
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+        * wtf/StringExtras.h:
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+        * wtf/TCSystemAlloc.cpp:
+        * wtf/ThreadSpecific.h:
+        (WTF::::destroy):
+        * wtf/Threading.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::wtfThreadEntryPoint):
+        (WTF::createThreadInternal):
+        * wtf/VMTags.h:
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault):
+        * wtf/win/MainThreadWin.cpp:
+        (WTF::initializeMainThreadPlatform):
+
+2010-01-04  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Add missing files to the build system - make distcheck build fix.
+
+        * GNUmakefile.am:
+
+2010-01-04  Gavin Barraclough <barraclough@apple.com>
+
+        Reviewed by Sam Weinig, additional coding by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33163
+        Add string hashing functions to WTF.
+        Use WTF's string hashing functions from UStringImpl.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/UStringImpl.cpp:
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::computeHash):
+        * wtf/HashFunctions.h:
+        * wtf/StringHashFunctions.h: Added.
+        (WTF::stringHash):
+
+2010-01-04  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempt to fix ARM bulid.
+
+        * wtf/Platform.h:
+
+2010-01-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        Add an 'isIdentifier' to UStringImpl, use this where appropriate
+        (where previously 'identifierTable' was being tested).
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::addSlowCase):
+        * runtime/Identifier.h:
+        (JSC::Identifier::add):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::isIdentifier):
+
+2010-01-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "Shimmey Shimmey" Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33158
+        Refactor JSC API entry/exit to use RAII instead of copy/pasting code.
+        Make it easier to change set of actions taken when passing across the API boundary.
+
+        * API/APIShims.h: Added.
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APIEntryShim::APIEntryShim):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        (JSGarbageCollect):
+        (JSReportExtraMemoryCost):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::init):
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::getOwnPropertyNames):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        (JSObjectCopyPropertyNames):
+        (JSPropertyNameArrayRelease):
+        (JSPropertyNameAccumulatorAddName):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-01-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Ada Chan and Mark Rowe.
+
+        Updated copyright string
+
+        * Info.plist:
+        * JavaScriptCore.vcproj/JavaScriptCore.resources/Info.plist:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc:
+
+2010-01-04  Adam Roben  <aroben@apple.com>
+
+        No review, rolling out r52741.
+        http://trac.webkit.org/changeset/52741
+        https://bugs.webkit.org/show_bug.cgi?id=33056
+
+        * wtf/AlwaysInline.h:
+
+2010-01-04  Patrick Gansterer  <paroga@paroga.com>
 
         Reviewed by Darin Adler.
 
-        Make WebKit build correctly on FreeBSD, IA64, and Alpha.
-        Based on work by Petr Salinger <Petr.Salinger@seznam.cz>,
-        and Colin Watson <cjwatson@ubuntu.com>.
+        Add cacheFlush support for WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=33110
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2010-01-04  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Roben.
+
+        Implement NO_RETURN for COMPILER(MSVC).
+        https://bugs.webkit.org/show_bug.cgi?id=33056
+
+        * wtf/AlwaysInline.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix some PLATFORM(*_ENDIAN) uses to CPU()
+        https://bugs.webkit.org/show_bug.cgi?id=33148
+
+        * runtime/JSCell.cpp:
+        (JSC::):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Document CPU() macros in comments.
+        https://bugs.webkit.org/show_bug.cgi?id=33147
+
+        * wtf/Platform.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Reorganize, document and rename CPU() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33145
+        ExecutableAllocatorSymbian appears to have buggy ARM version check
+        https://bugs.webkit.org/show_bug.cgi?id=33138
+        
+        * wtf/Platform.h:
+        Rename all macros related to detection of particular CPUs or
+        classes of CPUs to CPU(), reorganize and document them.
+
+        All remaining changes are adapting to the renames, plus fixing the
+        second bug cited above.
+        
+        * assembler/ARMAssembler.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.cpp:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/X86Assembler.h:
+        (JSC::X86Registers::):
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::movl_mEAX):
+        (JSC::X86Assembler::movl_EAXm):
+        (JSC::X86Assembler::repatchLoadPtrToLEA):
+        (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorSymbian.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        (JSC::JIT::emitCount):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBase):
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+        * wrec/WREC.h:
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateReturnFailure):
+        * wrec/WRECGenerator.h:
+        * wtf/FastMalloc.cpp:
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+        * wtf/Threading.h:
+        * wtf/dtoa.cpp:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+        * yarr/RegexJIT.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Clean up COMPILER macros and remove unused ones.
+        https://bugs.webkit.org/show_bug.cgi?id=33132
+        
+        Removed values are COMPILER(BORLAND) and COMPILER(CYGWIN) - they were
+        not used anywhere.
 
         * wtf/Platform.h:
 
+2010-01-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Update wtf/Platform.h to document the new system for porting macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33130
+
+        * wtf/Platform.h:
+
+2009-12-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        PLATFORM(CAIRO) should be defined by WIN_CAIRO define
+        https://bugs.webkit.org/show_bug.cgi?id=22250
+
+        * wtf/Platform.h: Define WTF_PLATFORM_CAIRO for GTK port only
+        For the WinCairo port WTF_PLATFORM_CAIRO is already defined in config.h
+
+2009-12-28  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Delete ThreadPrivate instance after it is finished.
+        https://bugs.webkit.org/show_bug.cgi?id=32614
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::ThreadMonitor::instance):
+        (WTF::ThreadMonitor::threadFinished):
+        (WTF::createThreadInternal):
+        (WTF::detachThread):
+
+2009-12-28  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Cleanup of #define JS_EXPORT.
+
+        * API/JSBase.h:
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Barth.
+
+        WinCE buildfix (HWND_MESSAGE isn't supported there)
+
+        * wtf/win/MainThreadWin.cpp:
+        (WTF::initializeMainThreadPlatform):
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Barth.
+
+        Added a file with WinMain function to link agains in WinCE.
+
+        * os-win32/WinMain.cpp: Added.
+        (convertToUtf8):
+        (WinMain):
+
+2009-12-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed; revert of r52550.
+
+        The change regressed the following LayoutTests for QtWebKit.
+
+        fast/workers/worker-call.html -> crashed
+        fast/workers/worker-close.html -> crashed
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+
+2009-12-24  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix memory leak by deleting instance of ThreadPrivate
+        in function waitForThreadCompletion(), synchronously, or in
+        detachThread(), asynchronously.
+        https://bugs.webkit.org/show_bug.cgi?id=32614 
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+
+2009-12-23  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Laszlo Gombos.
+
+        Include stddef.h for ptrdiff_t
+        https://bugs.webkit.org/show_bug.cgi?id=32891
+
+        ptrdiff_t is typedef-ed in stddef.h.
+        Include stddef.h in jit/ExecutableAllocator.h.
+
+        * jit/ExecutableAllocator.h:
+
+2009-12-23  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        Buildfix after r47092.
+
+        * wtf/wince/MemoryManager.cpp:
+        (WTF::tryFastMalloc):
+        (WTF::tryFastZeroedMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::tryFastRealloc):
+
+2009-12-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate getter support.
+        https://bugs.webkit.org/show_bug.cgi?id=32876
+
+        Expose dateToDaysFrom1970().
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::dateToDaysFrom1970):
+        * wtf/DateMath.h:
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Turn off datagrid by default, at least for all platforms Apple ships.
+        The datagrid implementation isn't ready for general web use yet.
+
+        * Configurations/FeatureDefines.xcconfig: Turn off datagrid by default.
+
+2009-12-22  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Updates Android's scheduleDispatchFunctionsOnMainThread() to use new
+        AndroidThreading class, rather than using JavaSharedClient directly.
+        This fixes the current layering violation.
+        https://bugs.webkit.org/show_bug.cgi?id=32651
+
+        The pattern is copied from Chromium, which uses the ChromiumThreading
+        class. This patch also fixes the style in ChromiumThreading.h.
+
+        * wtf/android/AndroidThreading.h: Added. Declares AndroidThreading.
+        * wtf/android/MainThreadAndroid.cpp: Modified
+        (WTF::scheduleDispatchFunctionsOnMainThread): Uses AndroidThreading.
+        * wtf/chromium/ChromiumThreading.h: Modified. Fixes style.
+
+2009-12-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix a couple of problems with UntypedPtrAndBitfield.
+
+        Add a m_leaksPtr to reduce false positives from leaks in debug builds
+        (this isn't perfect because we'd like a solution for release builds,
+        but this is now at least as good as a PtrAndFlags would be).
+
+        Switch SmallStringsto use a regular string for the base, rather than
+        a static one.  UntypedPtrAndBitfield assumes all strings are at least
+        8 byte aligned; this migt not be true of static strings.  Shared buffers
+        are heap allocated, as are all UStringImpls other than static strings.
+        Static strings cannot end up being the owner string of substrings,
+        since the only static strings are length 0.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/UStringImpl.h:
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UStringImpl::UStringImpl):
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        RVCT (__ARMCC_VERSION < 400000) does not provide strcasecmp and strncasecmp
+        https://bugs.webkit.org/show_bug.cgi?id=32857
+
+        Add implementation of strcasecmp and strncasecmp for RVCT < 4.0
+        because earlier versions of RVCT 4.0 does not provide these functions.
+
+        * wtf/StringExtras.cpp: Added.
+        (strcasecmp):
+        (strncasecmp):
+        * wtf/StringExtras.h:
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Define ALWAYS_INLINE and WTF_PRIVATE_INLINE to __forceinline for RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=32853
+
+        Use __forceinline forces RVCT to compile a C or C++ function
+        inline. The compiler attempts to inline the function, regardless of
+        the characteristics of the function.
+
+        * wtf/AlwaysInline.h:
+        * wtf/FastMalloc.h:
+
+2009-12-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Prospective GTK build fix: Add UStringImpl.cpp/h to the build.
+
+        * GNUmakefile.am:
+
+2009-12-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, add UStringImpl.cpp to the build.
+
+        * JavaScriptCore.pri:
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows Build fix part 5.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+        Fix breakage of world introduced in build fix to r52463.
+
+        * runtime/UStringImpl.h:
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32831
+        Replace UString::Rep implementation, following introduction of ropes to JSC.
+
+            * Remove redundant overcapacity mechanisms.
+            * Reduce memory cost of Rep's.
+            * Add an inline storage mechanism akin to that in WebCore's StringImpl.
+
+        ~1% Sunspider progression.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        (JSC::createRep):
+        (JSC::UString::createFromUTF8):
+        (JSC::UString::createUninitialized):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::ascii):
+        (JSC::UString::operator=):
+        (JSC::UString::toStrictUInt32):
+        (JSC::equal):
+        * runtime/UString.h:
+        (JSC::UString::isEmpty):
+        (JSC::UString::cost):
+        (JSC::makeString):
+        * runtime/UStringImpl.cpp: Added.
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::destroy):
+        (JSC::UStringImpl::computeHash):
+        * runtime/UStringImpl.h: Added.
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::createCopying):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::data):
+        (JSC::UStringImpl::size):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::hash):
+        (JSC::UStringImpl::computedHash):
+        (JSC::UStringImpl::setHash):
+        (JSC::UStringImpl::identifierTable):
+        (JSC::UStringImpl::setIdentifierTable):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::allocChars):
+        (JSC::UStringImpl::copyChars):
+        (JSC::UStringImpl::computeHash):
+        (JSC::UStringImpl::null):
+        (JSC::UStringImpl::empty):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::operator new):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+
+2009-12-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move some build decisions from Qt build system into source files
+        https://bugs.webkit.org/show_bug.cgi?id=31956
+
+        * JavaScriptCore.pri: Compile files unconditionally
+        * jit/ExecutableAllocatorPosix.cpp: Guard with PLATFORM(UNIX) && !PLATFORM(SYMBIAN)
+        * jit/ExecutableAllocatorWin.cpp: Guard with PLATFORM(WIN_OS)
+        * runtime/MarkStackPosix.cpp: Guard with PLATFORM(UNIX) && !PLATFORM(SYMBIAN)
+        * runtime/MarkStackSymbian.cpp: Guard with PLATFORM(SYMBIAN)
+        * runtime/MarkStackWin.cpp: Guard with PLATFORM(WIN_OS)
+        * wtf/Platform.h: Guard ENABLE_JSC_MULTIPLE_THREADS with ENABLE_SINGLE_THREADED for the Qt port
+        * wtf/ThreadingNone.cpp: Guard with ENABLE(SINGLE_THREADED)
+        * wtf/qt/ThreadingQt.cpp: Guard with !ENABLE(SINGLE_THREADED)
+
+2009-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add createNonCopying method to UString to make replace constructor passed bool,
+        to make behaviour more explicit.  Add createFromUTF8 to UString (wrapping method
+        on UString::Rep), since other cases of transliteration (e.g.  from ascii) are
+        performed in UString constructors.  Add/use setHash & size() accessors on Rep,
+        rather than accessing _hash/len directly.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::ustring):
+        * JavaScriptCore.exp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        (JSC::CStringTranslator::translate):
+        (JSC::UCharBufferTranslator::translate):
+        (JSC::Identifier::addSlowCase):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::refAndGetLength):
+        (JSC::JSString::Rope::append):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::release):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::createNonCopying):
+        (JSC::UString::createFromUTF8):
+        * runtime/UString.h:
+        (JSC::UString::Rep::setHash):
+        (JSC::UString::~UString):
+        (JSC::makeString):
+
+2009-12-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich and Gavin Barraclough.
+        
+        Changed Register constructors to assignment operators, to streamline
+        moving values into registers. (In theory, there's no difference between
+        the two, since the constructor should just inline away, but there seems
+        to be a big difference in the addled mind of the GCC optimizer.)
+
+        In the interpreter, this is a 3.5% SunSpider speedup and a 1K-2K
+        reduction in stack usage per privateExecute stack frame.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::setCalleeArguments):
+        (JSC::ExecState::setCallerFrame):
+        (JSC::ExecState::setScopeChain):
+        (JSC::ExecState::init):
+        (JSC::ExecState::setArgumentCount):
+        (JSC::ExecState::setCallee):
+        (JSC::ExecState::setCodeBlock): Added a little bit of casting so these
+        functions could use the new Register assignment operators.
+
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::Register):
+        (JSC::Register::operator=): Swapped in assignment operators for constructors.
+
 2009-12-18  Yongjun Zhang  <yongjun.zhang@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -81,6 +7064,1656 @@
 
         * wtf/Assertions.h:
 
+2009-12-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixed intermittent failure seen on Windows buildbot, and in other JSC
+        API clients.
+        
+        Added a WeakGCPtr class and changed OpaqueJSClass::cachedPrototype to
+        use it, to avoid vending a stale object as a prototype.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::prototype):
+        * API/JSClassRef.h: Use WeakGCPtr.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/WeakGCPtr.h: Added.
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::get):
+        (JSC::WeakGCPtr::clear):
+        (JSC::WeakGCPtr::operator*):
+        (JSC::WeakGCPtr::operator->):
+        (JSC::WeakGCPtr::operator!):
+        (JSC::WeakGCPtr::operator bool):
+        (JSC::WeakGCPtr::operator UnspecifiedBoolType):
+        (JSC::WeakGCPtr::assign):
+        (JSC::::operator):
+        (JSC::operator==):
+        (JSC::operator!=):
+        (JSC::static_pointer_cast):
+        (JSC::const_pointer_cast):
+        (JSC::getPtr): Added WeakGCPtr to the project.
+
+2009-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32720
+
+        * JavaScriptCore.exp:
+            - Remove exports for UString::append
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Make StringBuilder a private header (was project).
+
+2009-12-18  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] GRefPtr does not take a reference when assigned a raw pointer
+        https://bugs.webkit.org/show_bug.cgi?id=32709
+
+        Ensure that when assigning a raw pointer to a GRefPtr, the reference
+        count is incremented. Also remove the GRefPtr conversion overload as
+        GRefPtr types have necessarily incompatible reference counting.
+
+        * wtf/gtk/GRefPtr.h:
+        (WTF::GRefPtr::operator=):
+
+2009-12-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Clean up the qmake build system to distinguish between trunk builds and package builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=32716
+
+        * pcre/pcre.pri: Use standalone_package instead of QTDIR_build
+
+2009-12-18  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Compile warning from line 29 of GRefPtr.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=32703
+
+        Fix memory leak and compiler warning in GRefPtr GHashTable template
+        specialization.
+
+        * wtf/gtk/GRefPtr.cpp:
+        (WTF::refGPtr):
+
+2009-12-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add BUILDING_ON_SNOW_LEOPARD and TARGETING_SNOW_LEOPARD #defines.
+
+        * wtf/Platform.h:
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Sync JavaScriptCore.vcproj with JavaScriptCore.xcodeproj and the
+        source tree
+
+        Fixes <http://webkit.org/b/32665>.
+
+        Reviewed by Ada Chan.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Moved
+        around files and filters so that the structure matches
+        JavaScriptCore.xcodeproj and the source tree. A few headers that were
+        previously omitted have been added, as well as JSZombie.{cpp,h}.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Remove HeavyProfile and TreeProfile completely
+
+        These were mostly removed in r42808, but the empty files were left in
+        place.
+
+        Fixes <http://webkit.org/b/32664>.
+
+        Reviewed by John Sullivan.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCoreSources.bkl:
+        Removed HeavyProfile/TreeProfile source files.
+
+        * profiler/HeavyProfile.cpp: Removed.
+        * profiler/HeavyProfile.h: Removed.
+        * profiler/TreeProfile.cpp: Removed.
+        * profiler/TreeProfile.h: Removed.
+
+2009-12-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] WebKit GTK needs a wrapper for ref counted glib/gobject structs
+        https://bugs.webkit.org/show_bug.cgi?id=21599
+
+        Implement GRefPtr, a smart pointer for reference counted GObject types.
+
+        * GNUmakefile.am:
+        * wtf/gtk/GOwnPtr.cpp:
+        (WTF::GDir):
+        * wtf/gtk/GRefPtr.h: Added.
+        (WTF::):
+        (WTF::GRefPtr::GRefPtr):
+        (WTF::GRefPtr::~GRefPtr):
+        (WTF::GRefPtr::clear):
+        (WTF::GRefPtr::get):
+        (WTF::GRefPtr::operator*):
+        (WTF::GRefPtr::operator->):
+        (WTF::GRefPtr::operator!):
+        (WTF::GRefPtr::operator UnspecifiedBoolType):
+        (WTF::GRefPtr::hashTableDeletedValue):
+        (WTF::::operator):
+        (WTF::::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::static_pointer_cast):
+        (WTF::const_pointer_cast):
+        (WTF::getPtr):
+        (WTF::adoptGRef):
+        (WTF::refGPtr):
+        (WTF::derefGPtr):
+
+2009-12-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Build fixes for make distcheck.
+
+        * GNUmakefile.am:
+
+2009-12-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/7355025> Interpreter::privateExecute macro generates
+        bloated code
+        
+        This patch cuts Interpreter stack use by about a third.
+
+        * bytecode/Opcode.h: Changed Opcode to const void* to work with the
+        const static initiliazation we want to do in Interpreter::privateExecute.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter): Moved hashtable initialization here to
+        avoid polluting Interpreter::privateExecute's stack, and changed it from a
+        series of add() calls to one add() call in a loop, to cut down on code size.
+
+        (JSC::Interpreter::privateExecute): Changed a series of label computations
+        to a copy of a compile-time constant array to cut down on code size.
+
+2009-12-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Disable debug variants of WebKit frameworks.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam "r=me" Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32498
+        <rdar://problem/7471495>
+        REGRESSION(r51978-r52039): AJAX "Mark This Forum Read" function no longer
+        works
+        
+        Fixed a tyop.
+
+        * runtime/Operations.h:
+        (JSC::jsAdd): Use the '&&' operator, not the ',' operator.
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the windows build: don't export this inlined function.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Inlined JSCell's operator new.
+        
+        3.7% speedup on bench-allocate-nonretained.js.
+
+        * JavaScriptCore.exp:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC::JSCell::operator new):
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed the number heap, replacing it with a one-item free list for
+        numbers, taking advantage of the fact that two number cells fit inside
+        the space for one regular cell, and number cells don't require destruction.
+        
+        SunSpider says 1.6% faster in JSVALUE32 mode (the only mode that
+        heap-allocates numbers).
+        
+        SunSpider says 1.1% faster in JSVALUE32_64 mode. v8 says 0.8% faster
+        in JSVALUE32_64 mode. 10% speedup on bench-alloc-nonretained.js. 6%
+        speedup on bench-alloc-retained.js.
+        
+        There's a lot of formulaic change in this patch, but not much substance.
+
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::recordExtraCost):
+        (JSC::Heap::allocate):
+        (JSC::Heap::resizeBlocks):
+        (JSC::Heap::growBlocks):
+        (JSC::Heap::shrinkBlocks):
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::clearMarkBits):
+        (JSC::Heap::markedCells):
+        (JSC::Heap::sweep):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::addToStatistics):
+        (JSC::Heap::statistics):
+        (JSC::Heap::isBusy):
+        (JSC::Heap::reset):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::primaryHeapBegin):
+        (JSC::Heap::primaryHeapEnd):
+        * runtime/Collector.h:
+        (JSC::): Removed all code pertaining to the number heap, and changed all
+        heap template functions and classes to non-template functions and classes.
+
+        (JSC::Heap::allocateNumber): A new optimization to replace the number
+        heap: allocate half-sized number cells in pairs, returning the first
+        cell and caching the second cell for the next allocation.
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::LiveObjectIterator::LiveObjectIterator):
+        (JSC::LiveObjectIterator::operator++):
+        (JSC::DeadObjectIterator::DeadObjectIterator):
+        (JSC::DeadObjectIterator::operator++):
+        (JSC::ObjectIterator::ObjectIterator):
+        (JSC::ObjectIterator::operator++):
+        * runtime/JSCell.h:
+        (JSC::JSCell::isNumber): Removed all code pertaining to the number heap,
+        and changed all heap template functions and classes to non-template functions
+        and classes.
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WeakGCMap class
+        https://bugs.webkit.org/show_bug.cgi?id=32547
+
+        Inherits WeakGCMap from FastAllocBase because it is instantiated by
+        'new' at: WebCore/dom/Document.cpp:512.
+
+        * runtime/WeakGCMap.h:
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for dtoa's P5Node struct
+        https://bugs.webkit.org/show_bug.cgi?id=32544
+
+        Inherits P5Node struct from Noncopyable because it is instantiated by
+        'new' at wtf/dtoa.cpp:588 and don't need to be copyable.
+
+        * wtf/dtoa.cpp:
+
+2009-12-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32524
+        REGRESSION(52084): fast/dom/prototypes.html failing two CSS tests
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount): The original patch put the parentheses in the wrong
+        place, completely changing the calculation and making it almost always
+        wrong. Moved the parentheses around the '+' operation, like the original
+        compiler warning suggested.
+
+2009-12-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Unreviewed trivial buildfix.
+
+        Fix crosses initialization of usedPrimaryBlocks for JSValue32
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively):
+
+2009-12-14  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        GCC 4.3.x warning fixed. Suggested parantheses added.
+        warning: ../../../JavaScriptCore/wtf/StdLibExtras.h:77: warning: suggest parentheses around + or - in operand of &
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount):
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Changed GC from mark-sweep to mark-allocate.
+        
+        Added WeakGCMap to keep WebCore blissfully ignorant about objects that
+        have become garbage but haven't run their destructors yet.
+        
+        1% SunSpider speedup.
+        7.6% v8 speedup (37% splay speedup).
+        17% speedup on bench-alloc-nonretained.js.
+        18% speedup on bench-alloc-retained.js.
+
+        * API/JSBase.cpp:
+        (JSGarbageCollect):
+        * API/JSContextRef.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated for renames and new
+        files.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): Updated to use the Collector
+        iterator abstraction.
+
+        * jsc.cpp:
+        (functionGC): Updated for rename.
+
+        * runtime/Collector.cpp: Slightly reduced the number of allocations per
+        collection, so that small workloads only allocate on collector block,
+        rather than two.
+
+        (JSC::Heap::Heap): Updated to use the new allocateBlock function.
+
+        (JSC::Heap::destroy): Updated to use the new freeBlocks function.
+
+        (JSC::Heap::allocateBlock): New function to initialize a block when
+        allocating it.
+
+        (JSC::Heap::freeBlock): Consolidated the responsibility for running
+        destructors into this function.
+
+        (JSC::Heap::freeBlocks): Updated to use freeBlock.
+
+        (JSC::Heap::recordExtraCost): Sweep the heap in this reporting function,
+        so that allocation, which is more common, doesn't have to check extraCost.
+
+        (JSC::Heap::heapAllocate): Run destructors right before recycling a
+        garbage cell. This has better cache utilization than a separate sweep phase.
+
+        (JSC::Heap::resizeBlocks):
+        (JSC::Heap::growBlocks):
+        (JSC::Heap::shrinkBlocks): New set of functions for managing the size of
+        the heap, now that the heap doesn't maintain any information about its
+        size.
+
+        (JSC::isPointerAligned):
+        (JSC::isHalfCellAligned):
+        (JSC::isPossibleCell):
+        (JSC::isCellAligned):
+        (JSC::Heap::markConservatively): Cleaned up this code a bit.
+
+        (JSC::Heap::clearMarkBits):
+        (JSC::Heap::markedCells): Some helper functions for examining the the mark
+        bitmap.
+
+        (JSC::Heap::sweep): Simplified this function by using a DeadObjectIterator.
+
+        (JSC::Heap::markRoots): Reordered some operations for clarity.
+
+        (JSC::Heap::objectCount):
+        (JSC::Heap::addToStatistics):
+        (JSC::Heap::statistics): Rewrote these functions to calculate an object
+        count on demand, since the heap doesn't maintain this information by 
+        itself.
+
+        (JSC::Heap::reset): New function for resetting the heap once we've
+        exhausted heap space.
+
+        (JSC::Heap::collectAllGarbage): This function matches the old collect()
+        behavior, but it's now an uncommon function used only by API.
+
+        * runtime/Collector.h:
+        (JSC::CollectorBitmap::count):
+        (JSC::CollectorBitmap::isEmpty): Added some helper functions for managing
+        the collector mark bitmap.
+
+        (JSC::Heap::reportExtraMemoryCost): Changed reporting from cell equivalents
+        to bytes, so it's easier to understand.
+        
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::CollectorHeapIterator):
+        (JSC::CollectorHeapIterator::operator!=):
+        (JSC::CollectorHeapIterator::operator*):
+        (JSC::CollectorHeapIterator::advance):
+        (JSC::::LiveObjectIterator):
+        (JSC::::operator):
+        (JSC::::DeadObjectIterator):
+        (JSC::::ObjectIterator): New iterators for encapsulating details about
+        heap layout, and what's live and dead on the heap.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::increaseVectorLength): Delay reporting extra cost until
+        we're fully constructed, so the heap mark phase won't visit us in an
+        invalid state.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::):
+        (JSC::JSCell::createDummyStructure):
+        (JSC::JSCell::JSCell):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h: Added a dummy cell to simplify allocation logic.
+
+        * runtime/JSString.h:
+        (JSC::jsSubstring): Don't report extra cost for substrings, since they
+        share a buffer that's already reported extra cost.
+
+        * runtime/Tracing.d:
+        * runtime/Tracing.h: Changed these dtrace hooks not to report object
+        counts, since they're no longer cheap to compute.
+
+        * runtime/UString.h: Updated for renames.
+
+        * runtime/WeakGCMap.h: Added.
+        (JSC::WeakGCMap::isEmpty):
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::uncheckedBegin):
+        (JSC::WeakGCMap::uncheckedEnd):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove): Mentioned above.
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount): Added a bit population count function, so the heap can
+        count live objects to fulfill statistics questions.
+
+The very last cell in the block is not allocated -- should not be marked.
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Export some new symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Removed some old exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Use unsigned instead of uint32_t to avoid dependencies.
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount):
+
+2009-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative Windows build fix).
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+
+2009-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32496
+        Switch remaining cases of string construction to use StringBuilder.
+        Builds strings using a vector rather than using string append / addition.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::indent):
+        * runtime/JSString.h:
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::substituteBackreferences):
+        (JSC::stringProtoFuncConcat):
+
+2009-12-08  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add code to allow toggling ATSUI/Core Text rendering at runtime in ComplexTextController.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        The goal here is to allow for a zero runtime hit for ports that decide to select
+        the API at compile time.
+        When both USE(ATSUI) and USE(CORE_TEXT) are true, the API is toggled
+        at runtime.  Core Text is used for OS Versions >= 10.6.
+
+        * wtf/Platform.h: #define USE_CORE_TEXT and USE_ATSUI on Chrome/Mac.
+
+2009-12-11  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Unify codegen for forward and backward variants of branches
+        https://bugs.webkit.org/show_bug.cgi?id=32463
+
+        * jit/JIT.h:
+        (JSC::JIT::emit_op_loop): Implemented in terms of forward variant.
+        (JSC::JIT::emit_op_loop_if_true): ditto
+        (JSC::JIT::emitSlow_op_loop_if_true): ditto
+        (JSC::JIT::emit_op_loop_if_false): ditto
+        (JSC::JIT::emitSlow_op_loop_if_false): ditto
+        (JSC::JIT::emit_op_loop_if_less): ditto
+        (JSC::JIT::emitSlow_op_loop_if_less): ditto
+        * jit/JITOpcodes.cpp:
+
+2009-12-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Allow WTFs concept of the main thread to differ from pthreads when necessary.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-12-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32454
+        Refactor construction of simple strings to avoid string concatenation.
+
+        Building strings through concatenation has a memory and performance cost -
+        a memory cost since we must over-allocate the buffer to leave space to append
+        into, and performance in that the string may still require reallocation (and
+        thus copying during construction).  Instead move the full construction to
+        within a single function call (makeString), so that the arguments' lengths
+        can be calculated and an appropriate sized buffer allocated before copying
+        any characters.
+
+        ~No performance change (~2% progression on date tests).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::escapeQuotes):
+        (JSC::valueToSourceString):
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpToSourceString):
+        (JSC::regexpName):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::substitute):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DateConversion.cpp:
+        (JSC::formatDate):
+        (JSC::formatDateUTCVariant):
+        (JSC::formatTime):
+        (JSC::formatTimeUTC):
+        * runtime/DateConversion.h:
+        (JSC::):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToGMTString):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        (JSC::createErrorMessage):
+        (JSC::createInvalidParamError):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded):
+        (JSC::functionProtoFuncToString):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        * runtime/UString.h:
+        (JSC::):
+        (JSC::makeString):
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32400
+        Switch remaining cases of string addition to use ropes.
+
+        Re-landing r51975 - added toPrimitiveString method,
+        performs toPrimitive then subsequent toString operations.
+
+        ~1% progression on Sunspidey.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Added
+        $(WebKitOutputDir)/include/private to the include path.
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Move QuartzCorePresent.h to include/private
+
+        This fixes other projects that use wtf/Platform.h
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Let VS do its thang.
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Write
+        QuartzCorePresent.h to $(WebKitOutputDir)/include/private.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        Added $(WebKitOutputDir)/include/private to the include path.
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Fix clean builds and everything rebuilding on every build
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Don't
+        write out QuartzCorePresent.h if it exists but is older than
+        QuartzCore.h. Also, create the directory we write QuartzCorePresent.h
+        into first.
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix for systems with spaces in their paths
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Quote some paths.
+
+2009-12-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add check for presence of QuartzCore headers
+        https://bugs.webkit.org/show_bug.cgi?id=31856
+        
+        The script now checks for the presence of QuartzCore.h. If present
+        it will turn on ACCELERATED_COMPOSITING and 3D_RENDERING to enable
+        HW compositing on Windows. The script writes QuartzCorePresent.h to
+        the build directory which has a define telling whether QuartzCore is 
+        present.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+        * wtf/Platform.h:
+
+2009-12-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a problem that JSC::gregorianDateTimeToMS() returns a negative
+        value for a huge year value.
+        https://bugs.webkit.org/show_bug.cgi?id=32304
+
+        * wtf/DateMath.cpp:
+        (WTF::dateToDaysFrom1970): Renamed from dateToDayInYear, and changed the return type to double.
+        (WTF::calculateDSTOffset): Follow the dateToDaysFrom1970() change.
+        (WTF::timeClip): Use maxECMAScriptTime.
+        (JSC::gregorianDateTimeToMS): Follow the dateToDaysFrom1970() change.
+
+2009-12-10  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r51975.
+        http://trac.webkit.org/changeset/51975
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Incorrect caching of prototype lookup with dictionary base
+        https://bugs.webkit.org/show_bug.cgi?id=32402
+
+        Make sure we don't add cached prototype lookup to the proto_list
+        lookup chain if the top level object is a dictionary.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32400
+        Switch remaining cases of string addition to use ropes.
+
+        ~1% progression on Sunspidey.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-10  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove JSObject::getPropertyAttributes() and all usage of it.
+        https://bugs.webkit.org/show_bug.cgi?id=31933
+
+        getOwnPropertyDescriptor() should be used instead.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyDescriptor):
+        * debugger/DebuggerActivation.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::propertyIsEnumerable):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        * runtime/JSVariableObject.h:
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt & Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32367
+        Add support for short Ropes (up to 3 entries) inline within JSString.
+        (rather than externally allocating an object to hold the rope).
+        Switch jsAdd of (JSString* + JSString*) to now make use of Ropes.
+
+        ~1% progression on Sunspidey.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::deref):
+        (JSC::JSString::Rope::Fiber::ref):
+        (JSC::JSString::Rope::Fiber::refAndGetLength):
+        (JSC::JSString::Rope::append):
+        (JSC::JSString::JSString):
+        (JSC::JSString::~JSString):
+        (JSC::JSString::value):
+        (JSC::JSString::tryGetValue):
+        (JSC::JSString::length):
+        (JSC::JSString::canGetIndex):
+        (JSC::JSString::appendStringInConstruct):
+        (JSC::JSString::appendValueInConstructAndIncrementLength):
+        (JSC::JSString::isRope):
+        (JSC::JSString::string):
+        (JSC::JSString::ropeLength):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+        (JSC::resolveBase):
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix three more things found by compiling with clang++.
+        
+        * runtime/Structure.h:
+        (JSC::StructureTransitionTable::reifySingleTransition):
+        Add the 'std' qualifier to the call to make_pair.
+
+        * wtf/DateMath.cpp:
+        (WTF::initializeDates):
+        Incrementing a bool is deprecated according to the C++ specification.
+        
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+        Name lookup should not be done in dependent bases, so explicitly qualify the call to set.
+
+2009-12-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Google reader gets stuck in the "Loading..." state and does not complete
+        https://bugs.webkit.org/show_bug.cgi?id=32256
+        <rdar://problem/7456388>
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jless): Fix some backward branches.
+
+2009-12-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32228
+        Make destruction of ropes non-recursive to prevent stack exhaustion.
+        Also, pass a UString& into initializeFiber rather than a Ustring::Rep*,
+        since the Rep is not being ref counted this could result in usage of a
+        Rep with refcount zero (where the Rep comes from a temporary UString
+        returned from a function).
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::destructNonRecursive):
+        (JSC::JSString::Rope::~Rope):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::initializeFiber):
+        * runtime/Operations.h:
+        (JSC::concatenateStrings):
+
+2009-12-09  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31930
+
+        Update to r51457. ASSERTs changed to COMPILE_ASSERTs.
+        The speedup is 25%.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::VPtrSet::VPtrSet):
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Updates Android Makefiles with latest additions.
+        https://bugs.webkit.org/show_bug.cgi?id=32278
+
+        * Android.mk: Modified.
+        * Android.v8.wtf.mk: Modified.
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix a bug found while trying to compile JavaScriptCore with clang++.
+
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::PatternTerm): Don't self assign here.  Use false instead.
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Attempt to fix the Windows build.
+        
+        * wtf/FastMalloc.h:
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix some things found while trying to compile JavaScriptCore with clang++.
+
+        * wtf/FastMalloc.h:
+        Add correct exception specifications for the allocation/deallocation operators.
+        
+        * wtf/Vector.h:
+        * wtf/VectorTraits.h:
+        Fix a bunch of struct/class mismatches.
+
+2009-12-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+
+        move code generation portions of Nodes.cpp to bytecompiler directory
+        https://bugs.webkit.org/show_bug.cgi?id=32284
+
+        * bytecompiler/NodesCodegen.cpp: Copied from parser/Nodes.cpp. Removed parts that
+        are not about codegen.
+        * parser/Nodes.cpp: Removed everything that is about codegen.
+
+        Update build systems:
+        
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+
+2009-12-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Mac plugins support.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32236
+
+        * wtf/Platform.h:
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by David Levin.
+
+        Revert and reopen "Add asserts to RefCounted to make sure ref/deref happens on the right thread."
+        It may have caused massive increase of reported leaks on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref):
+        (WTF::RefCountedBase::hasOneRef):
+        (WTF::RefCountedBase::refCount):
+        (WTF::RefCountedBase::derefBase):
+        * wtf/ThreadVerifier.h: Removed.
+
+2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Darin Adler.
+
+        Make WebKit build correctly on FreeBSD, IA64, and Alpha.
+        Based on work by Petr Salinger <Petr.Salinger@seznam.cz>,
+        and Colin Watson <cjwatson@ubuntu.com>.
+
+        * wtf/Platform.h:
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure): Disable thread verification on this class since it uses addressOfCount().
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref): Add ASSERT.
+        (WTF::RefCountedBase::hasOneRef): Ditto.
+        (WTF::RefCountedBase::refCount): Ditto.
+        (WTF::RefCountedBase::derefBase): Ditto.
+        (WTF::RefCountedBase::disableThreadVerification): delegate to ThreadVerifier method.
+        * wtf/ThreadVerifier.h: Added.
+        (WTF::ThreadVerifier::ThreadVerifier): New Debug-only class to verify that ref/deref of RefCounted is done on the same thread.
+        (WTF::ThreadVerifier::activate): Activates checks. Called when ref count becomes above 2.
+        (WTF::ThreadVerifier::deactivate): Deactivates checks. Called when ref count drops below 2.
+        (WTF::ThreadVerifier::disableThreadVerification): used on objects that should not be checked (StringImpl etc)
+        (WTF::ThreadVerifier::verifyThread):
+        * GNUmakefile.am: Add ThreadVerifier.h to the build file.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+2009-12-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Adds Makefiles for Android port.
+        https://bugs.webkit.org/show_bug.cgi?id=31325
+
+        * Android.mk: Added.
+        * Android.v8.wtf.mk: Added.
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-12-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fixage part I).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32184
+        Handle out-of-memory conditions with JSC Ropes with a JS exception, rather than crashing.
+        Switch from using fastMalloc to tryFastMalloc, pass an ExecState to record the exception on.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::toString):
+        * API/JSValueRef.cpp:
+        (JSValueIsStrictEqual):
+        * JavaScriptCore.exp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        (JSC::Profiler::createCallIdentifier):
+        (JSC::createCallIdentifierFromFunctionImp):
+        * profiler/Profiler.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::name):
+        (JSC::InternalFunction::displayName):
+        (JSC::InternalFunction::calculatedDisplayName):
+        * runtime/InternalFunction.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getString):
+        * runtime/JSCell.h:
+        (JSC::JSValue::getString):
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::~Rope):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toNumber):
+        (JSC::JSString::toString):
+        (JSC::JSString::toThisString):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::createOrNull):
+        (JSC::JSString::Rope::operator new):
+        (JSC::JSString::value):
+        (JSC::JSString::tryGetValue):
+        (JSC::JSString::getIndex):
+        (JSC::JSString::getStringPropertySlot):
+        (JSC::JSValue::toString):
+        * runtime/JSValue.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/Operations.cpp:
+        (JSC::JSValue::strictEqualSlowCase):
+        * runtime/Operations.h:
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::concatenateStrings):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::equalTo):
+        * runtime/PropertyDescriptor.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Holger Freyther.
+
+        Turn on (SVG) Filters support, by default.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * Configurations/FeatureDefines.xcconfig: Enable FILTERS build flag.
+
+2009-12-07  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix. Be flexible about which version of ICU is used on Windows.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Add optional xcopy commands to copy ICU 4.2.
+
+2009-12-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        op_loop_if_less JIT codegen is broken for 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=32221
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false): Fix codegen in this version - test was backwards.
+
+2009-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Object.create fails if properties on the descriptor are getters
+        https://bugs.webkit.org/show_bug.cgi?id=32219
+
+        Correctly initialise the PropertySlots with the descriptor object.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Actually tested 64-bit *and* 32-bit build this time.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Really really fix 64-bit build for prior patch (actually tested this time).
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false):
+        (JSC::JIT::emitSlow_op_loop_if_false):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Really fix 64-bit build for prior patch.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jless):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Fix 64-bit build for prior patch.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_if_less):
+
+2009-12-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        conway benchmark spends half it's time in op_less (jump fusion fails)
+        https://bugs.webkit.org/show_bug.cgi?id=32190
+
+        <1% speedup on SunSpider and V8
+        2x speedup on "conway" benchmark
+        
+        Two optimizations:
+        1) Improve codegen for logical operators &&, || and ! in a condition context
+        
+        When generating code for combinations of &&, || and !, in a
+        condition context (i.e. in an if statement or loop condition), we
+        used to produce a value, and then separately jump based on its
+        truthiness. Now we pass the false and true targets in, and let the
+        logical operators generate jumps directly. This helps in four
+        ways:
+
+        a) Individual clauses of a short-circuit logical operator can now
+        jump directly to the then or else clause of an if statement (or to
+        the top or exit of a loop) instead of jumping to a jump.
+        
+        b) It used to be that jump fusion with the condition of the first
+        clause of a logical operator was inhibited, because the register
+        was ref'd to be used later, in the actual condition jump; this no
+        longer happens since a jump straight to the final target is
+        generated directly.
+
+        c) It used to be that jump fusion with the condition of the second
+        clause of a logical operator was inhibited, because there was a
+        jump target right after the second clause and before the actual
+        condition jump. But now it's no longer necessary for the first
+        clause to jump there so jump fusion is not blocked.
+
+        d) We avoid generating excess mov statements in some cases.
+        
+        As a concrete example this source:
+        
+        if (!((x < q && y < q) || (t < q && z < q))) {
+            // ...
+        }
+        
+        Used to generate this bytecode:
+        
+        [  34] less              r1, r-15, r-19
+        [  38] jfalse            r1, 7(->45)
+        [  41] less              r1, r-16, r-19
+        [  45] jtrue             r1, 14(->59)
+        [  48] less              r1, r-17, r-19
+        [  52] jfalse            r1, 7(->59)
+        [  55] less              r1, r-18, r-19
+        [  59] jtrue             r1, 17(->76)
+        
+        And now generates this bytecode (also taking advantage of the second optimization below):
+        
+        [  34] jnless            r-15, r-19, 8(->42)
+        [  38] jless             r-16, r-19, 26(->64)
+        [  42] jnless            r-17, r-19, 8(->50)
+        [  46] jless             r-18, r-19, 18(->64)
+        
+        Note the jump fusion and the fact that there's less jump
+        indirection - three of the four jumps go straight to the target
+        clause instead of indirecting through another jump.
+        
+        2) Implement jless opcode to take advantage of the above, since we'll now often generate
+        a less followed by a jtrue where fusion is not forbidden.
+       
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::hasConditionContextCodegen): Helper function to determine
+        whether a node supports special conditional codegen. Return false as this is the default.
+        (JSC::ExpressionNode::emitBytecodeInConditionContext): Assert not reached - only really
+        defined for nodes that do have conditional codegen.
+        (JSC::UnaryOpNode::expr): Add const version.
+        (JSC::LogicalNotNode::hasConditionContextCodegen): Returne true only if subexpression
+        supports it.
+        (JSC::LogicalOpNode::hasConditionContextCodegen): Return true.
+        * parser/Nodes.cpp:
+        (JSC::LogicalNotNode::emitBytecodeInConditionContext): Implemented - just swap
+        the true and false targets for the child node.
+        (JSC::LogicalOpNode::emitBytecodeInConditionContext): Implemented - handle jumps
+        directly, improving codegen quality. Also handles further nested conditional codegen.
+        (JSC::ConditionalNode::emitBytecode): Use condition context codegen when available.
+        (JSC::IfNode::emitBytecode): ditto
+        (JSC::IfElseNode::emitBytecode): ditto
+        (JSC::DoWhileNode::emitBytecode): ditto
+        (JSC::WhileNode::emitBytecode): ditto
+        (JSC::ForNode::emitBytecode): ditto
+
+        * bytecode/Opcode.h: 
+        - Added loop_if_false opcode - needed now that falsey jumps can be backwards.
+        - Added jless opcode to take advantage of new fusion opportunities.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Handle above.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfTrue): Add peephole for less + jtrue ==> jless.
+        (JSC::BytecodeGenerator::emitJumpIfFalse): Add handling of backwrds falsey jumps.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNodeInConditionContext): Wrapper to handle tracking of
+        overly deep expressions etc.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Implement the two new opcodes (loop_if_false, jless).
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Implement JIT support for the two new opcodes.
+        (JSC::JIT::privateCompileSlowCases): ditto
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emitSlow_op_jless): ditto
+        (JSC::JIT::emitBinaryDoubleOp): ditto
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_if_less): ditto
+        (JSC::JIT::emit_op_loop_if_false): ditto
+        (JSC::JIT::emitSlow_op_loop_if_false): ditto
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-12-04  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        JavaScript delete operator should return false for string properties
+        https://bugs.webkit.org/show_bug.cgi?id=32012
+
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::deleteProperty):
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Rolled back r51633 because it causes a perf regression in Chromium.
+
+        * wtf/Platform.h:
+
+2009-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Try and fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:  Export a symbol that should be exported.
+
+2009-12-03  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Mac build.
+
+        * JavaScriptCore.exp:  Export a symbol that should be exported.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION(4.0.3-48777): Crash in JSC::ExecState::propertyNames() (Debug-only?)
+        https://bugs.webkit.org/show_bug.cgi?id=32133
+
+        Work around odd GCC-ism and correct the scopechain for use by
+        calls made while a cachedcall is active on the callstack.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::newCallFrame):
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "Brraaaaiiiinnnnnzzzzzzzz" Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32136
+        Add a rope representation to JSString.  Presently JSString always holds its data in UString form.
+        Instead, allow the result of a string concatenation to be represented in a tree form - with a
+        variable sized, reference-counted rope node retaining a set of UString::Reps (or other rope nopes).
+
+        Strings must still currently be resolved down to a flat UString representation before being used,
+        but by holding the string in a rope representation during construction we can avoid copying data
+        until we know the final size of the string.
+
+        ~2% progression on SunSpider (~25% on date-format-xparb, ~20% on string-validate-input).
+
+        * JavaScriptCore.exp:
+
+            - Update exports.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+            - Make use of new JSString::length() method to avoid prematurely resolving ropes.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+
+            - Switch the string length trampoline to read the length directly from JSString::m_length,
+              rather than from the JSString's UString::Rep's 'len' property.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+            - Modify op_add such that addition of two strings, where either or both strings are already
+              in rope representation, produces a rope as a result.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::~Rope):
+        (JSC::copyChars):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::toNumber):
+        (JSC::JSString::toString):
+        (JSC::JSString::toThisString):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::Fiber):
+        (JSC::JSString::Rope::Fiber::destroy):
+        (JSC::JSString::Rope::Fiber::isRope):
+        (JSC::JSString::Rope::Fiber::rope):
+        (JSC::JSString::Rope::Fiber::string):
+        (JSC::JSString::Rope::create):
+        (JSC::JSString::Rope::initializeFiber):
+        (JSC::JSString::Rope::ropeLength):
+        (JSC::JSString::Rope::stringLength):
+        (JSC::JSString::Rope::fibers):
+        (JSC::JSString::Rope::Rope):
+        (JSC::JSString::Rope::operator new):
+        (JSC::JSString::JSString):
+        (JSC::JSString::value):
+        (JSC::JSString::length):
+        (JSC::JSString::isRope):
+        (JSC::JSString::rope):
+        (JSC::JSString::string):
+        (JSC::JSString::canGetIndex):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::jsSubstring):
+        (JSC::JSString::getStringPropertySlot):
+
+            - Add rope form.
+
+        * runtime/Operations.h:
+        (JSC::jsAdd):
+        (JSC::concatenateStrings):
+
+            - Update string concatenation, and addition of ropes, to produce ropes.
+
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+
+            - Make use of new JSString::length() method to avoid prematurely resolving ropes.
+
+2009-11-23  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Switch Chrome/Mac to use Core Text APIs rather than ATSUI APIs.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        No test since this is already covered by existing pixel tests.
+
+        * wtf/Platform.h: #define USE_CORE_TEXT for Chrome/Mac.
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add files missed in prior patch.
+
+        * runtime/JSZombie.cpp:
+        (JSC::):
+        (JSC::JSZombie::leakedZombieStructure):
+        * runtime/JSZombie.h: Added.
+        (JSC::JSZombie::JSZombie):
+        (JSC::JSZombie::isZombie):
+        (JSC::JSZombie::classInfo):
+        (JSC::JSZombie::isGetterSetter):
+        (JSC::JSZombie::isAPIValueWrapper):
+        (JSC::JSZombie::isPropertyNameIterator):
+        (JSC::JSZombie::getCallData):
+        (JSC::JSZombie::getConstructData):
+        (JSC::JSZombie::getUInt32):
+        (JSC::JSZombie::toPrimitive):
+        (JSC::JSZombie::getPrimitiveNumber):
+        (JSC::JSZombie::toBoolean):
+        (JSC::JSZombie::toNumber):
+        (JSC::JSZombie::toString):
+        (JSC::JSZombie::toObject):
+        (JSC::JSZombie::markChildren):
+        (JSC::JSZombie::put):
+        (JSC::JSZombie::deleteProperty):
+        (JSC::JSZombie::toThisObject):
+        (JSC::JSZombie::toThisString):
+        (JSC::JSZombie::toThisJSString):
+        (JSC::JSZombie::getJSNumber):
+        (JSC::JSZombie::getOwnPropertySlot):
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add zombies to JSC
+        https://bugs.webkit.org/show_bug.cgi?id=32103
+
+        Add a compile time flag to make the JSC collector replace "unreachable"
+        objects with zombie objects.  The zombie object is a JSCell subclass that
+        ASSERTs on any attempt to use the JSCell methods.  In addition there are
+        a number of additional assertions in bottleneck code to catch zombie usage
+        as quickly as possible.
+
+        Grrr. Argh. Brains.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Register.h:
+        (JSC::Register::Register):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::append):
+        (JSC::ArgList::ArgList):
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::sweep):
+        * runtime/Collector.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::isZombie):
+        (JSC::JSValue::isZombie):
+        * runtime/JSValue.h:
+        (JSC::JSValue::decode):
+        (JSC::JSValue::JSValue):
+        * wtf/Platform.h:
+
+2009-12-01  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Added variants of find/contains/add that allow a foreign key type to be used.
+        This will allow AtomicString-keyed maps to be queried by C string without
+        having to create a temporary AtomicString (see HTTPHeaderMap.)
+        The code for this is adapted from the equivalent in HashSet.h.
+
+        * wtf/HashMap.h:
+        (WTF::HashMap::find):
+        (WTF::HashMap::contains):
+        (WTF::HashMap::add):
+        * wtf/HashSet.h: Changed "method" to "function member" in a comment.
+
+2009-12-01  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Revert 51551 because it broke GTK+.
+
+        * wtf/Platform.h:
+
+2009-11-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows Build fix.  Reviewed by NOBODY.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31859 - Make world selection for JSC IsolatedWorlds automagical.
+
+        WebCore presently has to explicitly specify the world before entering into JSC,
+        which is a little fragile (particularly since property access via a
+        getter/setter might invoke execution). Instead derive the current world from
+        the lexical global object.
+        
+        Remove the temporary duct tape of willExecute/didExecute virtual hooks on the JSGlobalData::ClientData - these are no longer necessary.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+
+2009-11-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove obsolete PLATFORM(KDE) code
+        https://bugs.webkit.org/show_bug.cgi?id=31958
+
+        KDE is now using unpatched QtWebKit.
+
+        * parser/Lexer.cpp: Remove obsolete KDE_USE_FINAL guard
+        * wtf/Platform.h: Remove PLATFORM(KDE) definition and code 
+        section that is guarded with it.
+
 2009-11-30  Jan-Arve Sæther  <jan-arve.saether@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -97,6 +8730,15 @@
 
         * wtf/TypeTraits.h:
 
+2009-11-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Mac build has JIT disabled
+        https://bugs.webkit.org/show_bug.cgi?id=31828
+
+        * wtf/Platform.h: Enable JIT for Qt Mac builds
+
 2009-11-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
         Reviewed by Eric Seidel.
@@ -107,15 +8749,219 @@
         * runtime/MarkStack.h:
         (JSC::MarkStack::MarkStackArray::shrinkAllocation):
 
-2009-11-18  Gabor Loki  <loki@inf.u-szeged.hu>
+2009-11-28  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
 
-        Reviewed by Darin Adler.
+        Reviewed by Gavin Barraclough.
 
-        Fix the clobber list of cacheFlush for ARM and Thumb2 on Linux
-        https://bugs.webkit.org/show_bug.cgi?id=31631
+        https://bugs.webkit.org/show_bug.cgi?id=31930
 
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutableAllocator::cacheFlush):
+        Seems a typo. We don't need ~270k memory to determine the vptrs.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::VPtrSet::VPtrSet):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed. 
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        Build fix for chromium after r51423.
+        Exclude gtk directory from chromium build.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-11-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Incorrect behaviour of jneq_null in the interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=31901
+
+        Correct the logic of jneq_null.  This is already covered by existing tests.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-11-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        * GNUmakefile.am: Change the path for GOwnPtr.*.
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Remove
+          GOwnPtr.cpp from the exclude list.
+        * JavaScriptCore.gypi: Change the path for GOwnPtr.*.
+        * wscript: Remove GOwnPtr.cpp from the exclude list.
+        * wtf/GOwnPtr.cpp: Removed.
+        * wtf/GOwnPtr.h: Removed.
+        * wtf/Threading.h: Change the path for GOwnPtr.h.
+        * wtf/gtk/GOwnPtr.cpp: Copied from JavaScriptCore/wtf/GOwnPtr.cpp.
+        * wtf/gtk/GOwnPtr.h: Copied from JavaScriptCore/wtf/GOwnPtr.h.
+        * wtf/unicode/glib/UnicodeGLib.h: Change the path for GOwnPtr.h.
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Add ability to enable ACCELERATED_COMPOSITING on Windows (currently disabled)
+        https://bugs.webkit.org/show_bug.cgi?id=27314
+
+        * wtf/Platform.h:
+
+2009-11-24  Jason Smith  <dark.panda@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        RegExp#exec's returned Array-like object behaves differently from
+        regular Arrays
+        https://bugs.webkit.org/show_bug.cgi?id=31689
+
+        * JavaScriptCore/runtime/RegExpConstructor.cpp: ensure that undefined
+        values are added to the returned RegExpMatchesArray
+
+2009-11-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        JSON.stringify performance on undefined is very poor
+        https://bugs.webkit.org/show_bug.cgi?id=31839
+
+        Switch from a UString to a Vector<UChar> when building
+        the JSON string, allowing us to safely remove the substr-copy
+        we otherwise did when unwinding an undefined property.
+
+        Also turns out to be a ~5% speedup on stringification.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::StringBuilder::append):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+
+2009-11-24  Mark Rowe  <mrowe@apple.com>
+
+        Fix production builds where the source tree may be read-only.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Include "config.h" to meet Coding Style Guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=31792
+
+        * wtf/unicode/UTF8.cpp:
+        * wtf/unicode/glib/UnicodeGLib.cpp:
+        * wtf/unicode/wince/UnicodeWince.cpp:
+
+2009-11-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Streamlined some Math functions where we expect or know the result not
+        to be representable as an int.
+        
+        SunSpider says 0.6% faster.
+
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::jsDoubleNumber):
+        (JSC::JSValue::JSValue): Added a function for making a numeric JSValue
+        and skipping the "can I encode this as an int?" check, avoiding the
+        overhead of int <-> double roundtripping and double <-> double comparison
+        and branching.
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan): For these functions, which we expect or know
+        to produce results not representable as ints, call jsDoubleNumber instead
+        of jsNumber.
+
+2009-11-23  Mark Rowe  <mrowe@apple.com>
+
+        Unreviewed. Unbreak the regression tests after r51329.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): Null-check clientData before dereferencing it.
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction): Ditto.
+
+2009-11-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Part 1/3 of <rdar://problem/7377477> REGRESSION: Many web pages fail to render after interesting script runs in isolated world
+
+        Some clients of the JavaScriptCore API expect to be able to make callbacks over the JSC API,
+        and for this to automagically cause execution to take place in the world associated with the
+        global object associated with the ExecState (JSContextRef) passed.  However this is not how
+        things work - the world must be explicitly set within WebCore.
+
+        Making this work just for API calls to evaluate & call will be a far from perfect solution,
+        since direct (non-API) use of JSC still relies on WebCore setting the current world correctly.
+        A better solution would be to make this all work automagically all throughout WebCore, but this
+        will require more refactoring.
+
+        Since the API is in JSC but worlds only exist in WebCore, add callbacks on the JSGlobalData::ClientData
+        to allow it to update the current world on entry/exit via the JSC API.  This is temporary duck
+        tape, and should be removed once the current world no longer needs to be explicitly tracked.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::ClientData::beginningExecution):
+        (JSC::JSGlobalData::ClientData::completedExecution):
+        * runtime/JSGlobalData.h:
+
+2009-11-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Adds MainThreadAndroid.cpp with Android-specific WTF threading functions.
+        https://bugs.webkit.org/show_bug.cgi?id=31807
+
+        * wtf/android: Added.
+        * wtf/android/MainThreadAndroid.cpp: Added.
+        (WTF::timeoutFired):
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31748
+        Make WebSocketHandleCFNet respect proxy auto-configuration files via CFProxySupport
+
+        * JavaScriptCore.exp: Export callOnMainThreadAndWait.
 
 2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
@@ -134,6 +8980,213 @@
         (JSC::stringProtoFuncLastIndexOf):Add an extra test 
         to check for NaN for Symbian.
 
+2009-11-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Android port lacks implementation of atomicIncrement and atomicDecrement.
+        https://bugs.webkit.org/show_bug.cgi?id=31715
+
+        * wtf/Threading.h: Modified.
+        (WTF::atomicIncrement): Added Android implementation.
+        (WTF::atomicDecrement): Added Android implementation.
+
+2009-11-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Sort source lists and remove obsolete comments 
+        from the build system.
+
+        * JavaScriptCore.pri:
+
+2009-11-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt][Mac] Turn on multiple JavaScript threads for QtWebkit on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=31753
+
+        * wtf/Platform.h:
+
+2009-11-19  Steve Block  <steveblock@google.com>
+
+        Android port lacks configuration in Platform.h and config.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31671
+
+        * wtf/Platform.h: Modified. Added Android-specific configuration.
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31690
+        Make SocketStreamHandleCFNet work on Windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/MainThread.cpp:
+        (WTF::FunctionWithContext::FunctionWithContext):
+        (WTF::dispatchFunctionsFromMainThread):
+        (WTF::callOnMainThreadAndWait):
+        * wtf/MainThread.h:
+        Re-add callOnMainThreadAndWait(), which was removed in bug 23926.
+
+2009-11-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        isMainThread() on Chromium (Mac and Linux) is so slow it timeouts LayoutTests..
+        https://bugs.webkit.org/show_bug.cgi?id=31693
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading): grab and use the pthread_t of the main thread instead of ThreadIdentifier.
+        (WTF::isMainThread): Ditto.
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(STRING_H) guard from JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=31668
+
+        * config.h:
+        * runtime/UString.cpp:
+
+2009-11-19  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Fixing a bug in MessageQueue::removeIf() that leads to an
+        assertion failure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31657
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::removeIf):
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(FLOAT_H) guard
+        https://bugs.webkit.org/show_bug.cgi?id=31661
+
+        JavaScriptCore has a dependency on float.h, there is
+        no need to guard float.h.
+
+        * runtime/DatePrototype.cpp: Remove include directive 
+        for float.h as it is included in MathExtras.h already.
+        * runtime/Operations.cpp: Ditto.
+        * runtime/UString.cpp: Ditto.
+        * wtf/dtoa.cpp: Ditto.
+        * wtf/MathExtras.h: Remove HAVE(FLOAT_H) guard.
+        * wtf/Platform.h: Ditto.
+
+2009-11-19  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build fix for 32-bit Sparc machines: these machines are big-endian.
+
+        * wtf/Platform.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove support for Qt v4.3 or older versions
+        https://bugs.webkit.org/show_bug.cgi?id=29469
+
+        * JavaScriptCore.pro:
+        * jsc.pro:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move UString::from(double) implementation to new
+        WTF::doubleToStringInJavaScriptFormat(), and expose it because WebCore
+        code will use it.
+        https://bugs.webkit.org/show_bug.cgi?id=31330
+
+        - Introduce new function createRep(const char*, unsigned) and
+          UString::UString(const char*, unsigned) to reduce 2 calls to strlen().
+        - Fix a bug that dtoa() doesn't update *rve if the input value is NaN
+          or Infinity.
+
+        No new tests because this doesn't change the behavior.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/UString.cpp:
+        (JSC::createRep):
+        (JSC::UString::UString):
+        (JSC::UString::from): Move the code to doubleToStringInJavaScriptFormat().
+        * runtime/UString.h:
+        * wtf/dtoa.cpp:
+        (WTF::dtoa): Fix a bug about rve.
+        (WTF::append): A helper for doubleToStringInJavaScriptFormat().
+        (WTF::doubleToStringInJavaScriptFormat): Move the code from UString::from(double).
+        * wtf/dtoa.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove WTF_USE_JAVASCRIPTCORE_BINDINGS as it is no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=31643
+
+        * JavaScriptCore.pro:
+
+2009-11-18  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Remove Chromium's unnecessary dependency on wtf's tcmalloc files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31648
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-11-18  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [Qt] Implement symbol hiding for JSC's JIT functions.
+
+        These functions are implemented directly in assembly, so they need the
+        proper directives to enable/disable visibility. On ELF systems, it's
+        .hidden, whereas on Mach-O systems (Mac) it's .private_extern. On
+        Windows, it's not necessary since you have to explicitly export. I
+        also implemented the AIX idiom, though it's unlikely anyone will
+        implement AIX/POWER JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=30864
+
+        * jit/JITStubs.cpp:
+
+2009-11-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Interpreter may do an out of range access when throwing an exception in the profiler.
+        https://bugs.webkit.org/show_bug.cgi?id=31635
+
+        Add bounds check.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2009-11-18  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Fix the clobber list of cacheFlush for ARM and Thumb2 on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=31631
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
 2009-11-18  Harald Fernengel  <harald.fernengel@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -146,6 +9199,91 @@
 
         * JavaScriptCore.pri:
 
+2009-11-17  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add JSContextRefPrivate.h to list of copied files.
+
+        Reviewed by Mark Rowe.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2009-11-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [GTK] Style cleanup for GOwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=31506
+
+        Remove forward declaration in GOwnPtr and do some style cleanup.
+
+        * wtf/GOwnPtr.cpp:
+        * wtf/GOwnPtr.h:
+        (WTF::GOwnPtr::GOwnPtr):
+        (WTF::GOwnPtr::~GOwnPtr):
+        (WTF::GOwnPtr::get):
+        (WTF::GOwnPtr::release):
+        (WTF::GOwnPtr::outPtr):
+        (WTF::GOwnPtr::set):
+        (WTF::GOwnPtr::clear):
+        (WTF::GOwnPtr::operator*):
+        (WTF::GOwnPtr::operator->):
+        (WTF::GOwnPtr::operator!):
+        (WTF::GOwnPtr::operator UnspecifiedBoolType):
+        (WTF::GOwnPtr::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::getPtr):
+        (WTF::freeOwnedGPtr):
+
+2009-11-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Incorrect use of JavaScriptCore API in DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=31577
+
+        Add assertions to the 'toJS' functions to catch mistakes like
+        this early.  Restructure existing code which blindly passed potentially
+        null values to toJS when forwarding exceptions so that a null check is
+        performed first.
+
+        * API/APICast.h:
+        (toJS):
+        (toJSForGC):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/tests/testapi.c: Fix errors in the API tester.
+        (MyObject_getProperty):
+        (MyObject_convertToType):
+        (EvilExceptionObject_convertToType):
+
+2009-11-16  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31050
+
+        Minor fixes for JSVALUE32_64: branchConvertDoubleToInt32
+        failed on a CortexA8 CPU, but not on a simulator; and
+        JITCall.cpp modifications was somehow not committed to mainline.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::fmrs_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+
 2009-11-16  Joerg Bornemann  <joerg.bornemann@trolltech.com>
 
         Reviewed by Simon Hausmann.
@@ -155,18 +9293,102 @@
         * JavaScriptCore.pri: Add missing include path.
         * wtf/Platform.h: Include ce_time.h for Windows CE 6.
 
-2009-11-12  Thiago Macieira <thiago.macieira@nokia.com>
+2009-11-13  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
 
-        Reviewed by Kenneth Rohde Christiansen.
+        Reviewed by Gavin Barraclough.
 
-        [Qt] Fix linking on Linux 32-bit.
+        https://bugs.webkit.org/show_bug.cgi?id=31050
 
-        It was missing the ".text" directive at the top of the file,
-        indicating that code would follow. Without it, the assembler created
-        "NOTYPE" symbols, which would result in linker errors.
-        https://bugs.webkit.org/show_bug.cgi?id=30863
+        Adding optimization support for mode JSVALUE32_64
+        on ARM systems.
 
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+
+2009-11-14  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31050
+
+        Adding JSVALUE32_64 support for ARM (but not turning it
+        on by default). All optimizations must be disabled, since
+        this patch is only the first of a series of patches.
+
+        During the work, a lot of x86 specific code revealed and
+        made platform independent.
+        See revisions: 50531 50541 50593 50594 50595
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::fdivd_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::neg32):
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::branchOr32):
+        (JSC::MacroAssemblerARM::set8):
+        (JSC::MacroAssemblerARM::setTest8):
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::divDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::zeroDouble):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
         * jit/JITStubs.cpp:
+        * wtf/StdLibExtras.h:
+
+2009-11-13  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        Adding isAlphanumeric abstraction, required
+        by TextBoundaries.cpp.
+
+        * wtf/unicode/glib/UnicodeGLib.h:
+        (WTF::Unicode::isAlphanumeric):
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::isAlphanumeric):
+
+2009-11-13  Norbert Leser  <norbert.leser&nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Added macros for USERINCLUDE paths within symbian blocks
+        to guarantee inclusion of respective header files from local path
+        first (to avoid clashes with same names of header files in system include path).
+
+        * JavaScriptCore.pri:
+
+2009-11-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        JSValueProtect and JSValueUnprotect don't protect API wrapper values
+        https://bugs.webkit.org/show_bug.cgi?id=31485
+
+        Make JSValueProtect/Unprotect use a new 'toJS' function, 'toJSForGC' that
+        does not attempt to to strip out API wrapper objects.
+
+        * API/APICast.h:
+        (toJSForGC):
+        * API/JSValueRef.cpp:
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * API/tests/testapi.c:
+        (makeGlobalNumberValue):
+        (main):
 
 2009-11-13  İsmail Dönmez  <ismail@namtrac.org>
 
@@ -176,6 +9398,63 @@
 
         * JavaScriptCore.pri:
 
+2009-11-12  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Calculate the time offset only if we were able to parse
+        the date string. This saves an IPC in Chromium for
+        invalid date strings.
+        https://bugs.webkit.org/show_bug.cgi?id=31416
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::parseDateFromNullTerminatedCharacters):
+
+2009-11-12  Oliver Hunt  <oliver@apple.com>
+
+        Rollout r50896 until i can work out why it causes failures.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::emitBytecode):
+
+2009-11-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        Remove LIBRARY directive from def file to fix Debug_All target.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Holger Freyther.
+
+        Revert r50204, since it makes DRT crash on 32 bits release builds
+        for GTK+.
+
+        * wtf/FastMalloc.h:
+
+2009-11-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Start unifying entry logic for function and eval code.
+
+        Eval now uses a ret instruction to end execution, and sets up
+        a callframe more in line with what we do for function entry.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::emitBytecode):
+
 2009-11-12  Richard Moe Gustavsen  <richard.gustavsen@nokia.com>
 
         Reviewed by Kenneth Rohde Christiansen.
@@ -188,6 +9467,654 @@
 
         * wtf/Platform.h:
 
+2009-11-12  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix linking on Linux 32-bit.
+
+        It was missing the ".text" directive at the top of the file,
+        indicating that code would follow. Without it, the assembler created
+        "NOTYPE" symbols, which would result in linker errors.
+        https://bugs.webkit.org/show_bug.cgi?id=30863
+
+        * jit/JITStubs.cpp:
+
+2009-11-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Refactor multiple JavaScriptCore threads
+        https://bugs.webkit.org/show_bug.cgi?id=31328
+
+        Remove the id field from the PlatformThread structure 
+        as it is not used.
+
+        * runtime/Collector.cpp:
+        (JSC::getCurrentPlatformThread):
+        (JSC::suspendThread):
+        (JSC::resumeThread):
+        (JSC::getPlatformThreadRegisters):
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Linux build fix: Added an #include for UINT_MAX.
+
+        * runtime/WeakRandom.h:
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        JavaScriptGlue build fix: Marked a file 'private' instead of 'project'.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin "avGni arBalroguch" Barraclough.
+
+        Faster Math.random, based on GameRand.
+        
+        SunSpider says 1.4% faster.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added the header to the project.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h: Use an object to track random number generation
+        state, initialized to the current time.
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        (JSC::mathProtoFuncRandom): Use the new hotness.
+
+        * runtime/WeakRandom.h: Added.
+        (JSC::WeakRandom::WeakRandom):
+        (JSC::WeakRandom::get):
+        (JSC::WeakRandom::advance): The new hotness.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Imported the v8 DST cache.
+        
+        SunSpider says 1.5% faster.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache): Reset the DST cache when resetting
+        other date data.
+
+        * runtime/JSGlobalData.h:
+        (JSC::DSTOffsetCache::DSTOffsetCache):
+        (JSC::DSTOffsetCache::reset): Added a struct for the DST cache.
+
+        * wtf/DateMath.cpp:
+        (WTF::calculateDSTOffsetSimple):
+        (WTF::calculateDSTOffset):
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::getDSTOffset):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h: The imported code for probing and updating the cache.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed an edge case that could cause the engine not to notice a timezone
+        change.
+        
+        No test because this case would require manual intervention to change
+        the timezone during the test.
+        
+        SunSpider reports no change.
+
+        * runtime/DateInstanceCache.h:
+        (JSC::DateInstanceCache::DateInstanceCache):
+        (JSC::DateInstanceCache::reset): Added a helper function for resetting
+        this cache. Also, shrank the cache, since we'll be resetting it often.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache): Include resetting the DateInstanceCache
+        in resetting Date data. (Otherwise, a cache hit could bypass a necessary
+        timezone update check.)
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Some manual inlining and constant propogation in Date code.
+        
+        SunSpider reports a 0.4% speedup on date-*, no overall speedup. Shark
+        says some previously evident stalls are now gone.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DateConversion.cpp:
+        (JSC::formatTime):
+        (JSC::formatTimeUTC): Split formatTime into UTC and non-UTC variants.
+
+        * runtime/DateConversion.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::calculateGregorianDateTime):
+        (JSC::DateInstance::calculateGregorianDateTimeUTC):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::gregorianDateTime):
+        (JSC::DateInstance::gregorianDateTimeUTC): Split gregorianDateTime into
+        a UTC and non-UTC variant, and split each variant into a fast inline
+        case and a slow out-of-line case.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Updated for the gregorianDateTime change above.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export a new symbol.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam "Home Wrecker" Weinig.
+
+        Added a tiny cache for Date parsing.
+        
+        SunSpider says 1.2% faster.
+
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate): Try to reuse the last parsed Date, if present.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache):
+        * runtime/JSGlobalData.h: Added storage for last parsed Date. Refactored
+        this code to make resetting the date cache easier.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Updated for
+        refactoring.
+
+        * wtf/DateMath.cpp:
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h: Changed ExecState to be first parameter, as is the JSC custom.
+
+2009-11-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Can cache prototype lookups on uncacheable dictionaries.
+        https://bugs.webkit.org/show_bug.cgi?id=31198
+
+        Replace fromDictionaryTransition with flattenDictionaryObject and
+        flattenDictionaryStructure.  This change is necessary as we need to
+        guarantee that our attempt to convert away from a dictionary structure
+        will definitely succeed, and in some cases this requires mutating the
+        object storage itself.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/JSObject.h:
+        (JSC::JSObject::flattenDictionaryObject):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        * runtime/Structure.cpp:
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::comparePropertyMapEntryIndices):
+        * runtime/Structure.h:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Not reviewed, build fix.
+
+        Remove extra character from r50701.
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Not reviewed, build fix.
+
+        Revert r50695 because it broke QtWebKit (clean builds).
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Prepended $$PWD to GENERATED_SOURCES_DIR to avoid potential ambiguities when included from WebCore.pro.
+        Some preprocessors consider this GENERATED_SOURCES_DIR relative to current invoking dir (e.g., ./WebCore),
+        and not the working dir of JavaCriptCore.pri (i.e., ../JavaScriptCore/).
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=31040
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (speculative snow leopard and windows build fixes).
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+        
+        Hopefully, the last build fix.
+
+        Create better separation in DateMath about the JSC
+        and non-JSC portions. Also, only expose the non-JSC
+        version in the exports.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::getUTCOffset):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h:
+        (JSC::gmtoffset):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        For the change in DateMath.
+
+        * config.h:
+        * wtf/DateMath.cpp:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: export some symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: updated export file.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added some #includes.
+
+        * wtf/CurrentTime.h:
+        * wtf/DateMath.h:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31197
+        Implemented a timezone cache not based on Mac OS X's notify_check API.
+        
+        If the VM calculates the local timezone offset from UTC, it caches the
+        result until the end of the current VM invocation. (We don't want to cache
+        forever, because the user's timezone may change over time.)
+        
+        This removes notify_* overhead on Mac, and, more significantly, removes
+        OS time and date call overhead on non-Mac platforms.
+
+        ~8% speedup on Date microbenchmark on Mac. SunSpider reports maybe a tiny
+        speedup on Mac. (Speedup on non-Mac platforms should be even more noticeable.)
+
+        * JavaScriptCore.exp:
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Made the 
+        DynamicGlobalObjectScope constructor responsible for checking whether a
+        dynamicGlobalObject has already been set. This eliminated some duplicate
+        client code, and allowed me to avoid adding even more duplicate client
+        code. Made DynamicGlobalObjectScope responsible for resetting the
+        local timezone cache upon first entry to the VM.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateUTC):
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * runtime/DateConversion.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::gregorianDateTime):
+        * runtime/DateInstance.h:
+        * runtime/DateInstanceCache.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * wtf/DateMath.cpp:
+        (WTF::getCurrentUTCTime):
+        (WTF::getCurrentUTCTimeWithMicroseconds):
+        (WTF::getLocalTime):
+        (JSC::getUTCOffset): Use the new cache. Also, see below.
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::initializeDates):
+        (JSC::parseDateFromNullTerminatedCharacters): Simplified the way this function
+        accounts for the local timezone offset, to accomodate our new caching API,
+        and a (possibly misguided) caller in WebCore. Also, see below.
+        * wtf/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime): Moved most of the code in
+        DateMath.* into the JSC namespace. The code needed to move so it could
+        naturally interact with ExecState and JSGlobalData to support caching.
+        Logically, it seemed right to move it, too, since this code is not really
+        as low-level as the WTF namespace might imply -- it implements a set of
+        date parsing and conversion quirks that are finely tuned to the JavaScript
+        language. Also removed the Mac OS X notify_* infrastructure.
+        
+        * wtf/CurrentTime.h:
+        (WTF::currentTimeMS):
+        (WTF::getLocalTime): Moved the rest of the DateMath code here, and renamed
+        it to make it consistent with WTF's currentTime function.
+
+2009-11-06  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Unreviewed trivial buildfix after r50595.
+
+        Rename the remaining rshiftPtr calls to rshift32
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitFastArithImmToInt):
+
+2009-11-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Tidy up the shift methods on the macro-assembler interface.
+
+        Currently behaviour of shifts of a magnitude > 0x1f is undefined.
+        Instead defined that all shifts are masked to this range.  This makes a lot of
+        practical sense, both since having undefined behaviour is not particularly
+        desirable, and because this behaviour is commonly required (particularly since
+        it is required bt ECMA-262 for shifts).
+
+        Update the ARM assemblers to provide this behaviour.  Remove (now) redundant
+        masks from JITArithmetic, and remove rshiftPtr (this was used in case that
+        could be rewritten in a simpler form using rshift32, only optimized JSVALUE32
+        on x86-64, which uses JSVALUE64!)
+
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::rshift32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::lshift32):
+        (JSC::MacroAssemblerARMv7::rshift32):
+        * assembler/MacroAssemblerX86_64.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+
+2009-11-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Remove a magic number (1) from the JIT, instead compute the value with OBJECT_OFFSET.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArg):
+        (JSC::JIT::emitPutJITStubArgConstant):
+        (JSC::JIT::emitGetJITStubArg):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::getArgument):
+        * jit/JITStubs.h:
+
+2009-11-05  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31159
+        Fix branchDouble behaviour on ARM THUMB2 JIT.
+
+        The x86 branchDouble behaviour is reworked, and all JIT
+        ports should follow the x86 port. See bug 31104 and 31151
+
+        This patch contains a fix for the traditional ARM port
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::fmrs_r):
+        (JSC::ARMAssembler::ftosid_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::):
+        (JSC::MacroAssemblerARM::branchDouble):
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+
+2009-11-05  Chris Jerdonek  <chris.jerdonek@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Removed the "this is part of the KDE project" comments from 
+        all *.h, *.cpp, *.idl, and *.pm files.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31167
+        
+        The maintenance and architecture page in the project wiki lists
+        this as a task.
+        
+        This change includes no changes or additions to test cases 
+        since the change affects only comments.
+        
+        * wtf/wince/FastMallocWince.h:
+
+2009-11-05  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Use ARMv7 specific encoding for immediate constants on ARMv7 target
+        https://bugs.webkit.org/show_bug.cgi?id=31060
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::getOp2): Use INVALID_IMM
+        (JSC::ARMAssembler::getImm): Use encodeComplexImm for complex immediate
+        (JSC::ARMAssembler::moveImm): Ditto.
+        (JSC::ARMAssembler::encodeComplexImm): Encode a constant by one or two
+        instructions or a PC relative load.
+        * assembler/ARMAssembler.h: Use INVALID_IMM if a constant cannot be
+        encoded as an immediate constant.
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::movw_r): 16-bit immediate load
+        (JSC::ARMAssembler::movt_r): High halfword 16-bit immediate load
+        (JSC::ARMAssembler::getImm16Op2): Encode immediate constant for
+        movw_r and mowt_r
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Provide TARGETING_TIGER and TARGETING_LEOPARD as analogues to
+        BUILDING_ON_TIGER and BUILDING_ON_LEOPARD.  The TARGETING_ macros
+        consider the deployment target; the BUILDING_ON_ macros consider the
+        headers being built against.
+
+        * wtf/Platform.h:
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31151
+        Fix branchDouble behaviour on ARM THUMB2 JIT.
+
+        The ARMv7 JIT is currently using ARMv7Assembler::ConditionEQ to branch
+        for DoubleEqualOrUnordered, however this is incorrect - ConditionEQ won't
+        branch on unordered operands.  Similarly, DoubleLessThanOrUnordered &
+        DoubleLessThanOrEqualOrUnordered use ARMv7Assembler::ConditionLO &
+        ARMv7Assembler::ConditionLS, whereas they should be using
+        ARMv7Assembler::ConditionLT & ARMv7Assembler::ConditionLE.
+
+        Fix these, and fill out the missing DoubleConditions.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::):
+        (JSC::MacroAssemblerARMv7::branchDouble):
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Enable native call optimizations on ARMv7.  (Existing ARM_TRADITIONAL
+        implementation was generic, worked perfectly, just needed turning on).
+
+        * jit/JITOpcodes.cpp:
+        * wtf/Platform.h:
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Mark Rowe, Oliver Hunt, and Sam Weinig.
+
+        Add a missing assert to the ARMv7 JIT.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::ARMThumbImmediate):
+
+2009-11-04  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Remove bogus op_ prefix on dumped version of three opcodes.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+
+2009-11-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix dumping of constants in bytecode so that they aren't printed as large positive register numbers.
+
+        We do this by having the registerName function return information about the constant if the register
+        number corresponds to a constant.  This requires that registerName, and several functions that call it,
+        be converted to member functions of CodeBlock so that the constant value can be retrieved.  The
+        ExecState also needs to be threaded down through these functions so that it can be passed on to
+        constantName when needed.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::constantName):
+        (JSC::CodeBlock::registerName):
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isConstantRegisterIndex):
+
+2009-11-04  Pavel Heimlich  <tropikhajma@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30647
+        Solaris build failure due to strnstr.
+
+        * wtf/StringExtras.h: Enable strnstr on Solaris, too.
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31104
+        Refactor x86-specific behaviour out of the JIT.
+
+        - Add explicit double branch conditions for ordered and unordered comparisons (presently the brehaviour is a mix).
+        - Refactor double to int conversion out into the MacroAssembler.
+        - Remove broken double to int conversion for !JSVALUE32_64 builds - this code was broken and slowing us down, fixing it showed it not to be an improvement.
+        - Remove exclusion of double to int conversion from (1 % X) cases in JSVALUE32_64 builds - if this was of benefit this is no longer the case; simplify.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        (JSC::MacroAssemblerX86Common::branchConvertDoubleToInt32):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove BUILDING_ON_LEOPARD from JavaScriptCore.gyp.  This is supposed
+        to be set as needed only in wtf/Platform.h.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
 2009-11-02  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Gavin Barraclough.
@@ -205,19 +10132,161 @@
         * jit/JITStubs.cpp:
         (JSC::JITThunks::tryCacheGetByID):
 
-2009-10-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2009-11-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        PLATFORM(CF) should be set when building for Qt on Darwin
+        https://bugs.webkit.org/show_bug.cgi?id=23671
+
+        * wtf/Platform.h: Turn on CF support if both QT and DARWIN
+        platforms are defined.
 
-        Reviewed by NOBODY (OOPS!).
+2009-11-02  Dmitry Titov  <dimich@chromium.org>
 
-        [Qt] Use the default timeout interval for JS as the HTML tokenizer delay for setHtml()
+        Reviewed by David Levin.
 
-        This ensures that long-running JavaScript (for example due to a modal alert() dialog),
-        will not trigger a deferred load after only 500ms (the default tokenizer delay) while
-        still giving a reasonable timeout (10 seconds) to prevent deadlock.
+        Remove threadsafe refcounting from tasks used with WTF::MessageQueue.
+        https://bugs.webkit.org/show_bug.cgi?id=30612
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::alwaysTruePredicate):
+        (WTF::MessageQueue::~MessageQueue):
+        (WTF::MessageQueue::append):
+        (WTF::MessageQueue::appendAndCheckEmpty):
+        (WTF::MessageQueue::prepend):
+        (WTF::MessageQueue::waitForMessage):
+        (WTF::MessageQueue::waitForMessageFilteredWithTimeout):
+        (WTF::MessageQueue::tryGetMessage):
+        (WTF::MessageQueue::removeIf):
+        The MessageQueue is changed to act as a queue of OwnPtr<DataType>. It takes ownership
+        of posted tasks and passes it to the new owner (in another thread) when the task is fetched.
+        All methods have arguments of type PassOwnPtr<DataType> and return the same type.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29381
+        * wtf/Threading.cpp:
+        (WTF::createThread):
+        Superficial change to trigger rebuild of JSC project on Windows,
+        workaround for https://bugs.webkit.org/show_bug.cgi?id=30890
+
+2009-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
 
-        * runtime/TimeoutChecker.h: Add getter for the timeout interval
+        Fixed failing layout test: restore a special case I accidentally deleted.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::setNewValueFromDateArgs): In the case of applying a change to a date
+        that is NaN, reset the date to 0 *and* then apply the change; don't just
+        reset the date to 0.
+
+2009-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: update for object-to-pointer change.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-10-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30942
+        Use pointers instead of copies to pass GregorianDateTime objects around.
+        
+        SunSpider reports a shocking 4.5% speedup on date-format-xparb, and 1.3%
+        speedup on date-format-tofte.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::gregorianDateTime):
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Renamed getGregorianDateTime to gregorianDateTime,
+        since it no longer has an out parameter. Uses 0 to indicate invalid dates.
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's ListHashSet
+        https://bugs.webkit.org/show_bug.cgi?id=30853
+
+        Inherits ListHashSet class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/rendering/RenderBlock.cpp:1813.
+
+        * wtf/ListHashSet.h:
+
+2009-10-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Regression: crash enumerating properties of an object with getters or setters
+        https://bugs.webkit.org/show_bug.cgi?id=30948
+
+        Add a guard to prevent us trying to cache property enumeration on
+        objects with getters or setters.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+ 
+        No new tests (no functional change).
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION (r50218-r50262): E*TRADE accounts page is missing content
+        https://bugs.webkit.org/show_bug.cgi?id=30947
+        <rdar://problem/7348833>
+
+        The logic for flagging that a structure has non-enumerable properties
+        was in addPropertyWithoutTransition, rather than in the core Structure::put
+        method.  Despite this I was unable to produce a testcase that caused
+        the failure that etrade was experiencing, but the new assertion in
+        getEnumerablePropertyNames triggers on numerous layout tests without
+        the fix, so in effecti all for..in enumeration in any test ends up
+        doing the required consistency check.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::put):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::checkConsistency):
 
 2009-10-29  Gabor Loki  <loki@inf.u-szeged.hu>
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make b/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make
deleted file mode 100644
index 9eaccab4b5..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make
+++ /dev/null
@@ -1,76 +0,0 @@
-# Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions
-# are met:
-#
-# 1.  Redistributions of source code must retain the above copyright
-#     notice, this list of conditions and the following disclaimer. 
-# 2.  Redistributions in binary form must reproduce the above copyright
-#     notice, this list of conditions and the following disclaimer in the
-#     documentation and/or other materials provided with the distribution. 
-# 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
-#     its contributors may be used to endorse or promote products derived
-#     from this software without specific prior written permission. 
-#
-# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
-# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
-# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-VPATH = \
-    $(JavaScriptCore) \
-    $(JavaScriptCore)/parser \
-    $(JavaScriptCore)/pcre \
-    $(JavaScriptCore)/docs \
-    $(JavaScriptCore)/runtime \
-    $(JavaScriptCore)/interpreter \
-    $(JavaScriptCore)/jit \
-#
-
-.PHONY : all
-all : \
-    ArrayPrototype.lut.h \
-    chartables.c \
-    DatePrototype.lut.h \
-    Grammar.cpp \
-    JSONObject.lut.h \
-    Lexer.lut.h \
-    MathObject.lut.h \
-    NumberConstructor.lut.h \
-    RegExpConstructor.lut.h \
-    RegExpObject.lut.h \
-    StringPrototype.lut.h \
-    docs/bytecode.html \
-#
-
-# lookup tables for classes
-
-%.lut.h: create_hash_table %.cpp
-	$^ -i > $@
-Lexer.lut.h: create_hash_table Keywords.table
-	$^ > $@
-
-# JavaScript language grammar
-
-Grammar.cpp: Grammar.y
-	bison -d -p jscyy $< -o $@ > bison_out.txt 2>&1
-	perl -p -e 'END { if ($$conflict) { unlink "Grammar.cpp"; die; } } $$conflict ||= /conflict/' < bison_out.txt
-	touch Grammar.cpp.h
-	touch Grammar.hpp
-	cat Grammar.cpp.h Grammar.hpp > Grammar.h
-	rm -f Grammar.cpp.h Grammar.hpp bison_out.txt
-
-# character tables for PCRE
-
-chartables.c : dftables
-	$^ $@
-
-docs/bytecode.html: make-bytecode-docs.pl Interpreter.cpp 
-	perl $^ $@
diff --git a/src/3rdparty/webkit/JavaScriptCore/Info.plist b/src/3rdparty/webkit/JavaScriptCore/Info.plist
index 17949b026d..77c9eb8049 100644
--- a/src/3rdparty/webkit/JavaScriptCore/Info.plist
+++ b/src/3rdparty/webkit/JavaScriptCore/Info.plist
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
 	<key>CFBundleDevelopmentRegion</key>
@@ -7,7 +7,7 @@
 	<key>CFBundleExecutable</key>
 	<string>${PRODUCT_NAME}</string>
 	<key>CFBundleGetInfoString</key>
-	<string>${BUNDLE_VERSION}, Copyright 2003-2009 Apple Inc.; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 1997-2005 University of Cambridge; Copyright 1991, 2000, 2001 by Lucent Technologies.</string>
+	<string>${BUNDLE_VERSION}, Copyright 2003-2010 Apple Inc.; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 1997-2005 University of Cambridge; Copyright 1991, 2000, 2001 by Lucent Technologies.</string>
 	<key>CFBundleIdentifier</key>
 	<string>com.apple.${PRODUCT_NAME}</string>
 	<key>CFBundleInfoDictionaryVersion</key>
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
index 03c23c35c2..e5f3408efa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
@@ -64,6 +64,7 @@
             'bytecode/StructureStubInfo.h',
             'bytecompiler/BytecodeGenerator.cpp',
             'bytecompiler/BytecodeGenerator.h',
+            'bytecompiler/NodesCodegen.cpp',
             'bytecompiler/Label.h',
             'bytecompiler/LabelScope.h',
             'bytecompiler/RegisterID.h',
@@ -119,6 +120,7 @@
             'jit/JITInlineMethods.h',
             'jit/JITOpcodes.cpp',
             'jit/JITPropertyAccess.cpp',
+            'jit/JITPropertyAccess32_64.cpp',
             'jit/JITStubCall.h',
             'jit/JITStubs.cpp',
             'jit/JITStubs.h',
@@ -148,8 +150,6 @@
             'pcre/ucpinternal.h',
             'pcre/ucptable.cpp',
             'profiler/CallIdentifier.h',
-            'profiler/HeavyProfile.cpp',
-            'profiler/HeavyProfile.h',
             'profiler/Profile.cpp',
             'profiler/Profile.h',
             'profiler/ProfileGenerator.cpp',
@@ -159,8 +159,6 @@
             'profiler/Profiler.cpp',
             'profiler/Profiler.h',
             'profiler/ProfilerServer.h',
-            'profiler/TreeProfile.cpp',
-            'profiler/TreeProfile.h',
             'runtime/ArgList.cpp',
             'runtime/ArgList.h',
             'runtime/Arguments.cpp',
@@ -332,20 +330,7 @@
             'runtime/Tracing.h',
             'runtime/UString.cpp',
             'runtime/UString.h',
-            'wrec/CharacterClass.cpp',
-            'wrec/CharacterClass.h',
-            'wrec/CharacterClassConstructor.cpp',
-            'wrec/CharacterClassConstructor.h',
-            'wrec/Escapes.h',
-            'wrec/Quantifier.h',
-            'wrec/WREC.cpp',
-            'wrec/WREC.h',
-            'wrec/WRECFunctors.cpp',
-            'wrec/WRECFunctors.h',
-            'wrec/WRECGenerator.cpp',
-            'wrec/WRECGenerator.h',
-            'wrec/WRECParser.cpp',
-            'wrec/WRECParser.h',
+            'runtime/WeakRandom.h',
             'wtf/AlwaysInline.h',
             'wtf/ASCIICType.h',
             'wtf/Assertions.cpp',
@@ -369,8 +354,8 @@
             'wtf/FastMalloc.h',
             'wtf/Forward.h',
             'wtf/GetPtr.h',
-            'wtf/GOwnPtr.cpp',
-            'wtf/GOwnPtr.h',
+            'wtf/gobject/GOwnPtr.cpp',
+            'wtf/gobject/GOwnPtr.h',
             'wtf/gtk/MainThreadGtk.cpp',
             'wtf/gtk/ThreadingGtk.cpp',
             'wtf/HashCountedSet.h',
@@ -400,8 +385,6 @@
             'wtf/PassRefPtr.h',
             'wtf/Platform.h',
             'wtf/PtrAndFlags.h',
-            'wtf/qt/MainThreadQt.cpp',
-            'wtf/qt/ThreadingQt.cpp',
             'wtf/RandomNumber.cpp',
             'wtf/RandomNumber.h',
             'wtf/RandomNumberSeed.h',
@@ -414,11 +397,16 @@
             'wtf/SegmentedVector.h',
             'wtf/StdLibExtras.h',
             'wtf/StringExtras.h',
+            'wtf/StringHashFunctions.h',
             'wtf/TCPackedCache.h',
+            'wtf/qt/MainThreadQt.cpp',
+            'wtf/qt/ThreadingQt.cpp',
             'wtf/TCPageMap.h',
             'wtf/TCSpinLock.h',
             'wtf/TCSystemAlloc.cpp',
             'wtf/TCSystemAlloc.h',
+            'wtf/ThreadIdentifierDataPthreads.cpp',
+            'wtf/ThreadIdentifierDataPthreads.h',
             'wtf/Threading.cpp',
             'wtf/Threading.h',
             'wtf/ThreadingNone.cpp',
@@ -440,6 +428,7 @@
             'wtf/unicode/UTF8.cpp',
             'wtf/unicode/UTF8.h',
             'wtf/UnusedParam.h',
+            'wtf/ValueCheck.h',
             'wtf/Vector.h',
             'wtf/VectorTraits.h',
             'wtf/VMTags.h',
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order
index 3ae3ec6dd3..d6f6caabe5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order
@@ -1625,7 +1625,6 @@ __ZN3JSC18EmptyStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10Registe
 __ZN3JSCL27compareByStringPairForQSortEPKvS1_
 __Z22jsc_pcre_ucp_othercasej
 __ZN3JSCL35objectProtoFuncPropertyIsEnumerableEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
-__ZNK3JSC8JSObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
 __ZN3WTF7HashMapIjN3JSC7JSValueENS_7IntHashIjEENS_10HashTraitsIjEENS5_IS2_EEE3setERKjRKS2_
 __ZN3WTF9HashTableIjSt4pairIjN3JSC7JSValueEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEE
 __ZN3JSC12RegisterFile21releaseExcessCapacityEv
@@ -1841,7 +1840,6 @@ __ZN3JSC6JSCell14toThisJSStringEPNS_9ExecStateE
 __ZNK3JSC6JSCell12toThisStringEPNS_9ExecStateE
 __ZN3JSCL27objectProtoFuncLookupSetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSC8JSObject12lookupSetterEPNS_9ExecStateERKNS_10IdentifierE
-__ZNK3JSC16JSVariableObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
 __ZN3JSC9ExecState22regExpConstructorTableEPS0_
 __ZN3JSCL24regExpConstructorDollar7EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
 __ZN3JSCL24regExpConstructorDollar8EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
index a0f9f8efa6..1ad02517c2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
@@ -1,15 +1,16 @@
 # JavaScriptCore - Qt4 build info
 VPATH += $$PWD
+JAVASCRIPTCORE_TARGET = jscore
 
-CONFIG(debug, debug|release) {
-    isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}debug
-    OBJECTS_DIR = obj/debug
-} else { # Release
-    isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}release
-    OBJECTS_DIR = obj/release
+CONFIG(standalone_package) {
+    isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = $$PWD/generated
+} else {
+    isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = generated
 }
 
-symbian {
+symbian: {
+    # Need to guarantee this comes before system includes of /epoc32/include
+    MMP_RULES += "USERINCLUDE ../JavaScriptCore/profiler"
     LIBS += -lhal
 }
 
@@ -23,24 +24,22 @@ INCLUDEPATH = \
     $$PWD/interpreter \
     $$PWD/jit \
     $$PWD/parser \
+    $$PWD/pcre \
     $$PWD/profiler \
     $$PWD/runtime \
-    $$PWD/wrec \
     $$PWD/wtf \
     $$PWD/wtf/symbian \
     $$PWD/wtf/unicode \
     $$PWD/yarr \
     $$PWD/API \
     $$PWD/ForwardingHeaders \
-    $$GENERATED_SOURCES_DIR \
+    $$JSC_GENERATED_SOURCES_DIR \
     $$INCLUDEPATH
 
+win32-*: DEFINES += _HAS_TR1=0
+
 DEFINES += BUILDING_QT__ BUILDING_JavaScriptCore BUILDING_WTF
 
-GENERATED_SOURCES_DIR_SLASH = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
-win32-* {
-    LIBS += -lwinmm
-}
 contains(JAVASCRIPTCORE_JIT,yes) {
     DEFINES+=ENABLE_JIT=1
     DEFINES+=ENABLE_YARR_JIT=1
@@ -52,236 +51,41 @@ contains(JAVASCRIPTCORE_JIT,no) {
     DEFINES+=ENABLE_YARR=0
 }
 
-# In debug mode JIT disabled until crash fixed
-win32-* {
-    CONFIG(debug):!contains(DEFINES, ENABLE_JIT=1): DEFINES+=ENABLE_JIT=0
-}
-
-# Rules when JIT enabled (not disabled)
-!contains(DEFINES, ENABLE_JIT=0) {
-    linux*-g++*:greaterThan(QT_GCC_MAJOR_VERSION,3):greaterThan(QT_GCC_MINOR_VERSION,0) {
-        QMAKE_CXXFLAGS += -fno-stack-protector
-        QMAKE_CFLAGS += -fno-stack-protector
-    }
-}
-
 wince* {
     INCLUDEPATH += $$QT_SOURCE_TREE/src/3rdparty/ce-compat
-    SOURCES += $$QT_SOURCE_TREE/src/3rdparty/ce-compat/ce_time.c
     DEFINES += WINCEBASIC
 }
 
-include(pcre/pcre.pri)
-
-LUT_FILES += \
-    runtime/DatePrototype.cpp \
-    runtime/JSONObject.cpp \
-    runtime/NumberConstructor.cpp \
-    runtime/StringPrototype.cpp \
-    runtime/ArrayPrototype.cpp \
-    runtime/MathObject.cpp \
-    runtime/RegExpConstructor.cpp \
-    runtime/RegExpObject.cpp
-
-KEYWORDLUT_FILES += \
-    parser/Keywords.table
-
-JSCBISON += \
-    parser/Grammar.y
 
-SOURCES += \
-    wtf/Assertions.cpp \
-    wtf/ByteArray.cpp \
-    wtf/HashTable.cpp \
-    wtf/MainThread.cpp \
-    wtf/RandomNumber.cpp \
-    wtf/RefCountedLeakCounter.cpp \
-    wtf/TypeTraits.cpp \
-    wtf/unicode/CollatorDefault.cpp \
-    wtf/unicode/icu/CollatorICU.cpp \
-    wtf/unicode/UTF8.cpp \
-    API/JSBase.cpp \
-    API/JSCallbackConstructor.cpp \
-    API/JSCallbackFunction.cpp \
-    API/JSCallbackObject.cpp \
-    API/JSClassRef.cpp \
-    API/JSContextRef.cpp \
-    API/JSObjectRef.cpp \
-    API/JSStringRef.cpp \
-    API/JSValueRef.cpp \
-    API/OpaqueJSString.cpp \
-    runtime/InitializeThreading.cpp \
-    runtime/JSGlobalData.cpp \
-    runtime/JSGlobalObject.cpp \
-    runtime/JSStaticScopeObject.cpp \
-    runtime/JSVariableObject.cpp \
-    runtime/JSActivation.cpp \
-    runtime/JSNotAnObject.cpp \
-    runtime/JSONObject.cpp \
-    runtime/LiteralParser.cpp \
-    runtime/MarkStack.cpp \
-    runtime/TimeoutChecker.cpp \
-    bytecode/CodeBlock.cpp \
-    bytecode/StructureStubInfo.cpp \
-    bytecode/JumpTable.cpp \
-    assembler/ARMAssembler.cpp \
-    assembler/MacroAssemblerARM.cpp \
-    jit/JIT.cpp \
-    jit/JITCall.cpp \
-    jit/JITArithmetic.cpp \
-    jit/JITOpcodes.cpp \
-    jit/JITPropertyAccess.cpp \
-    jit/ExecutableAllocator.cpp \
-    jit/JITStubs.cpp \
-    bytecompiler/BytecodeGenerator.cpp \
-    runtime/ExceptionHelpers.cpp \
-    runtime/JSPropertyNameIterator.cpp \
-    interpreter/Interpreter.cpp \
-    bytecode/Opcode.cpp \
-    bytecode/SamplingTool.cpp \
-    yarr/RegexCompiler.cpp \
-    yarr/RegexInterpreter.cpp \
-    yarr/RegexJIT.cpp \
-    interpreter/RegisterFile.cpp
+defineTest(addJavaScriptCoreLib) {
+    pathToJavaScriptCoreOutput = $$ARGS
+    CONFIG(debug_and_release):CONFIG(debug, debug|release): pathToJavaScriptCoreOutput = $$pathToJavaScriptCoreOutput/debug
+    CONFIG(debug_and_release):CONFIG(release, debug|release): pathToJavaScriptCoreOutput = $$pathToJavaScriptCoreOutput/release
 
-symbian {
-    SOURCES += jit/ExecutableAllocatorSymbian.cpp \
-              runtime/MarkStackSymbian.cpp
-} else {
-    win32-*|wince* {
-        SOURCES += jit/ExecutableAllocatorWin.cpp \
-                  runtime/MarkStackWin.cpp
+    win32-msvc* {
+        LIBS += -L$$pathToJavaScriptCoreOutput
+        LIBS += -l$$JAVASCRIPTCORE_TARGET
+    } else:symbian {
+        LIBS += -l$${JAVASCRIPTCORE_TARGET}.lib
     } else {
-        SOURCES += jit/ExecutableAllocatorPosix.cpp \
-                  runtime/MarkStackPosix.cpp
+        # Make sure jscore will be early in the list of libraries to workaround a bug in MinGW
+        # that can't resolve symbols from QtCore if libjscore comes after.
+        QMAKE_LIBDIR = $$pathToJavaScriptCoreOutput $$QMAKE_LIBDIR
+        LIBS += -l$$JAVASCRIPTCORE_TARGET
     }
-}
-
-!contains(DEFINES, USE_SYSTEM_MALLOC) {
-    SOURCES += wtf/TCSystemAlloc.cpp
-}
-
-# AllInOneFile.cpp helps gcc analize and optimize code
-# Other compilers may be able to do this at link time
-SOURCES += \
-    runtime/ArgList.cpp \
-    runtime/Arguments.cpp \
-    runtime/ArrayConstructor.cpp \
-    runtime/ArrayPrototype.cpp \
-    runtime/BooleanConstructor.cpp \
-    runtime/BooleanObject.cpp \
-    runtime/BooleanPrototype.cpp \
-    runtime/CallData.cpp \
-    runtime/Collector.cpp \
-    runtime/CommonIdentifiers.cpp \
-    runtime/ConstructData.cpp \
-    wtf/CurrentTime.cpp \
-    runtime/DateConstructor.cpp \
-    runtime/DateConversion.cpp \
-    runtime/DateInstance.cpp \
-    runtime/DatePrototype.cpp \
-    debugger/Debugger.cpp \
-    debugger/DebuggerCallFrame.cpp \
-    debugger/DebuggerActivation.cpp \
-    wtf/dtoa.cpp \
-    runtime/Error.cpp \
-    runtime/ErrorConstructor.cpp \
-    runtime/ErrorInstance.cpp \
-    runtime/ErrorPrototype.cpp \
-    interpreter/CallFrame.cpp \
-    runtime/Executable.cpp \
-    runtime/FunctionConstructor.cpp \
-    runtime/FunctionPrototype.cpp \
-    runtime/GetterSetter.cpp \
-    runtime/GlobalEvalFunction.cpp \
-    runtime/Identifier.cpp \
-    runtime/InternalFunction.cpp \
-    runtime/Completion.cpp \
-    runtime/JSArray.cpp \
-    runtime/JSAPIValueWrapper.cpp \
-    runtime/JSByteArray.cpp \
-    runtime/JSCell.cpp \
-    runtime/JSFunction.cpp \
-    runtime/JSGlobalObjectFunctions.cpp \
-    runtime/JSImmediate.cpp \
-    runtime/JSLock.cpp \
-    runtime/JSNumberCell.cpp \
-    runtime/JSObject.cpp \
-    runtime/JSString.cpp \
-    runtime/JSValue.cpp \
-    runtime/JSWrapperObject.cpp \
-    parser/Lexer.cpp \
-    runtime/Lookup.cpp \
-    runtime/MathObject.cpp \
-    runtime/NativeErrorConstructor.cpp \
-    runtime/NativeErrorPrototype.cpp \
-    parser/Nodes.cpp \
-    runtime/NumberConstructor.cpp \
-    runtime/NumberObject.cpp \
-    runtime/NumberPrototype.cpp \
-    runtime/ObjectConstructor.cpp \
-    runtime/ObjectPrototype.cpp \
-    runtime/Operations.cpp \
-    parser/Parser.cpp \
-    parser/ParserArena.cpp \
-    runtime/PropertyDescriptor.cpp \
-    runtime/PropertyNameArray.cpp \
-    runtime/PropertySlot.cpp \
-    runtime/PrototypeFunction.cpp \
-    runtime/RegExp.cpp \
-    runtime/RegExpConstructor.cpp \
-    runtime/RegExpObject.cpp \
-    runtime/RegExpPrototype.cpp \
-    runtime/ScopeChain.cpp \
-    runtime/SmallStrings.cpp \
-    runtime/StringConstructor.cpp \
-    runtime/StringObject.cpp \
-    runtime/StringPrototype.cpp \
-    runtime/Structure.cpp \
-    runtime/StructureChain.cpp \
-    runtime/UString.cpp \
-    profiler/HeavyProfile.cpp \
-    profiler/Profile.cpp \
-    profiler/ProfileGenerator.cpp \
-    profiler/ProfileNode.cpp \
-    profiler/Profiler.cpp \
-    profiler/TreeProfile.cpp \
-    wtf/DateMath.cpp \
-    wtf/FastMalloc.cpp \
-    wtf/symbian/BlockAllocatorSymbian.cpp \
-    wtf/Threading.cpp \
-    wtf/qt/MainThreadQt.cpp
 
-!contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
-    SOURCES += wtf/qt/ThreadingQt.cpp
-} else {
-    DEFINES += ENABLE_JSC_MULTIPLE_THREADS=0
-    SOURCES += wtf/ThreadingNone.cpp
-}
-
-# GENERATOR 1-A: LUT creator
-lut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.lut.h
-lut.commands = perl $$PWD/create_hash_table ${QMAKE_FILE_NAME} -i > ${QMAKE_FILE_OUT}
-lut.depend = ${QMAKE_FILE_NAME}
-lut.input = LUT_FILES
-lut.CONFIG += no_link
-addExtraCompiler(lut)
+    win32-* {
+        LIBS += -lwinmm
+    }
 
-# GENERATOR 1-B: particular LUT creator (for 1 file only)
-keywordlut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}Lexer.lut.h
-keywordlut.commands = perl $$PWD/create_hash_table ${QMAKE_FILE_NAME} -i > ${QMAKE_FILE_OUT}
-keywordlut.depend = ${QMAKE_FILE_NAME}
-keywordlut.input = KEYWORDLUT_FILES
-keywordlut.CONFIG += no_link
-addExtraCompiler(keywordlut)
+    # The following line is to prevent qmake from adding jscore to libQtWebKit's prl dependencies.
+    # The compromise we have to accept by disabling explicitlib is to drop support to link QtWebKit and QtScript
+    # statically in applications (which isn't used often because, among other things, of licensing obstacles).
+    CONFIG -= explicitlib
 
-# GENERATOR 2: bison grammar
-jscbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-jscbison.commands = bison -d -p jscyy ${QMAKE_FILE_NAME} -o $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c ${QMAKE_FILE_OUT} && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
-jscbison.depend = ${QMAKE_FILE_NAME}
-jscbison.input = JSCBISON
-jscbison.variable_out = GENERATED_SOURCES
-jscbison.dependency_type = TYPE_C
-jscbison.CONFIG = target_predeps
-addExtraCompilerWithHeader(jscbison)
+    export(QMAKE_LIBDIR)
+    export(LIBS)
+    export(CONFIG)
 
+    return(true)
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
index a1affd4d6e..405678712e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
@@ -1,28 +1,21 @@
 # JavaScriptCore - qmake build info
 CONFIG += building-libs
 include($$PWD/../WebKit.pri)
+include(JavaScriptCore.pri)
 
 TEMPLATE = lib
 CONFIG += staticlib
-TARGET = JavaScriptCore
+# Don't use JavaScriptCore as the target name. qmake would create a JavaScriptCore.vcproj for msvc
+# which already exists as a directory
+TARGET = $$JAVASCRIPTCORE_TARGET
+QT += core
 
 CONFIG += depend_includepath
 
 contains(QT_CONFIG, embedded):CONFIG += embedded
 
-CONFIG(QTDIR_build) {
-    GENERATED_SOURCES_DIR = $$PWD/generated
-    OLDDESTDIR = $$DESTDIR
-    include($$QT_SOURCE_TREE/src/qbase.pri)
-    INSTALLS =
-    DESTDIR = $$OLDDESTDIR
-    DEFINES *= NDEBUG
-}
-
-isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
-GENERATED_SOURCES_DIR_SLASH = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
-
-INCLUDEPATH += $$GENERATED_SOURCES_DIR
+CONFIG(debug_and_release):CONFIG(debug, debug|release): DESTDIR = debug
+CONFIG(debug_and_release):CONFIG(release, debug|release): DESTDIR = release
 
 !CONFIG(QTDIR_build) {
     CONFIG(debug, debug|release) {
@@ -32,18 +25,12 @@ INCLUDEPATH += $$GENERATED_SOURCES_DIR
     }
 }
 
-CONFIG(release):!CONFIG(QTDIR_build) {
-    contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
-    unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
+CONFIG(QTDIR_build) {
+    # Remove the following 2 lines if you want debug information in JavaScriptCore
+    CONFIG -= separate_debug_info
+    CONFIG += no_debug_info
 }
 
-linux-*: DEFINES += HAVE_STDINT_H
-freebsd-*: DEFINES += HAVE_PTHREAD_NP_H
-
-DEFINES += BUILD_WEBKIT
-
-win32-*: DEFINES += _HAS_TR1=0
-
 # Pick up 3rdparty libraries from INCLUDE/LIB just like with MSVC
 win32-g++ {
     TMPPATH            = $$quote($$(INCLUDE))
@@ -52,17 +39,179 @@ win32-g++ {
     QMAKE_LIBDIR_POST += $$split(TMPPATH,";")
 }
 
-DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1
-
-DEFINES += WTF_CHANGES=1
-
-include(JavaScriptCore.pri)
+*-g++*:QMAKE_CXXFLAGS_RELEASE -= -O2
+*-g++*:QMAKE_CXXFLAGS_RELEASE += -O3
 
-QMAKE_EXTRA_TARGETS += generated_files
+# Rules when JIT enabled (not disabled)
+!contains(DEFINES, ENABLE_JIT=0) {
+    linux*-g++*:greaterThan(QT_GCC_MAJOR_VERSION,3):greaterThan(QT_GCC_MINOR_VERSION,0) {
+        QMAKE_CXXFLAGS += -fno-stack-protector
+        QMAKE_CFLAGS += -fno-stack-protector
+    }
+}
 
-lessThan(QT_MINOR_VERSION, 4) {
-    DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
+wince* {
+    SOURCES += $$QT_SOURCE_TREE/src/3rdparty/ce-compat/ce_time.c
 }
 
-*-g++*:QMAKE_CXXFLAGS_RELEASE -= -O2
-*-g++*:QMAKE_CXXFLAGS_RELEASE += -O3
+include(pcre/pcre.pri)
+
+SOURCES += \
+    API/JSBase.cpp \
+    API/JSCallbackConstructor.cpp \
+    API/JSCallbackFunction.cpp \
+    API/JSCallbackObject.cpp \
+    API/JSClassRef.cpp \
+    API/JSContextRef.cpp \
+    API/JSObjectRef.cpp \
+    API/JSStringRef.cpp \
+    API/JSValueRef.cpp \
+    API/OpaqueJSString.cpp \
+    assembler/ARMAssembler.cpp \
+    assembler/MacroAssemblerARM.cpp \
+    bytecode/CodeBlock.cpp \
+    bytecode/JumpTable.cpp \
+    bytecode/Opcode.cpp \
+    bytecode/SamplingTool.cpp \
+    bytecode/StructureStubInfo.cpp \
+    bytecompiler/BytecodeGenerator.cpp \
+    bytecompiler/NodesCodegen.cpp \
+    debugger/DebuggerActivation.cpp \
+    debugger/DebuggerCallFrame.cpp \
+    debugger/Debugger.cpp \
+    interpreter/CallFrame.cpp \
+    interpreter/Interpreter.cpp \
+    interpreter/RegisterFile.cpp \
+    jit/ExecutableAllocatorFixedVMPool.cpp \
+    jit/ExecutableAllocatorPosix.cpp \
+    jit/ExecutableAllocatorSymbian.cpp \
+    jit/ExecutableAllocatorWin.cpp \
+    jit/ExecutableAllocator.cpp \
+    jit/JITArithmetic.cpp \
+    jit/JITCall.cpp \
+    jit/JIT.cpp \
+    jit/JITOpcodes.cpp \
+    jit/JITPropertyAccess.cpp \
+    jit/JITPropertyAccess32_64.cpp \
+    jit/JITStubs.cpp \
+    parser/Lexer.cpp \
+    parser/Nodes.cpp \
+    parser/ParserArena.cpp \
+    parser/Parser.cpp \
+    profiler/Profile.cpp \
+    profiler/ProfileGenerator.cpp \
+    profiler/ProfileNode.cpp \
+    profiler/Profiler.cpp \
+    runtime/ArgList.cpp \
+    runtime/Arguments.cpp \
+    runtime/ArrayConstructor.cpp \
+    runtime/ArrayPrototype.cpp \
+    runtime/BooleanConstructor.cpp \
+    runtime/BooleanObject.cpp \
+    runtime/BooleanPrototype.cpp \
+    runtime/CallData.cpp \
+    runtime/Collector.cpp \
+    runtime/CommonIdentifiers.cpp \
+    runtime/Completion.cpp \
+    runtime/ConstructData.cpp \
+    runtime/DateConstructor.cpp \
+    runtime/DateConversion.cpp \
+    runtime/DateInstance.cpp \
+    runtime/DatePrototype.cpp \
+    runtime/ErrorConstructor.cpp \
+    runtime/Error.cpp \
+    runtime/ErrorInstance.cpp \
+    runtime/ErrorPrototype.cpp \
+    runtime/ExceptionHelpers.cpp \
+    runtime/Executable.cpp \
+    runtime/FunctionConstructor.cpp \
+    runtime/FunctionPrototype.cpp \
+    runtime/GetterSetter.cpp \
+    runtime/GlobalEvalFunction.cpp \
+    runtime/Identifier.cpp \
+    runtime/InitializeThreading.cpp \
+    runtime/InternalFunction.cpp \
+    runtime/JSActivation.cpp \
+    runtime/JSAPIValueWrapper.cpp \
+    runtime/JSArray.cpp \
+    runtime/JSByteArray.cpp \
+    runtime/JSCell.cpp \
+    runtime/JSFunction.cpp \
+    runtime/JSGlobalData.cpp \
+    runtime/JSGlobalObject.cpp \
+    runtime/JSGlobalObjectFunctions.cpp \
+    runtime/JSImmediate.cpp \
+    runtime/JSLock.cpp \
+    runtime/JSNotAnObject.cpp \
+    runtime/JSNumberCell.cpp \
+    runtime/JSObject.cpp \
+    runtime/JSONObject.cpp \
+    runtime/JSPropertyNameIterator.cpp \
+    runtime/JSStaticScopeObject.cpp \
+    runtime/JSString.cpp \
+    runtime/JSValue.cpp \
+    runtime/JSVariableObject.cpp \
+    runtime/JSWrapperObject.cpp \
+    runtime/LiteralParser.cpp \
+    runtime/Lookup.cpp \
+    runtime/MarkStackPosix.cpp \
+    runtime/MarkStackSymbian.cpp \
+    runtime/MarkStackWin.cpp \
+    runtime/MarkStack.cpp \
+    runtime/MathObject.cpp \
+    runtime/NativeErrorConstructor.cpp \
+    runtime/NativeErrorPrototype.cpp \
+    runtime/NumberConstructor.cpp \
+    runtime/NumberObject.cpp \
+    runtime/NumberPrototype.cpp \
+    runtime/ObjectConstructor.cpp \
+    runtime/ObjectPrototype.cpp \
+    runtime/Operations.cpp \
+    runtime/PropertyDescriptor.cpp \
+    runtime/PropertyNameArray.cpp \
+    runtime/PropertySlot.cpp \
+    runtime/PrototypeFunction.cpp \
+    runtime/RegExpConstructor.cpp \
+    runtime/RegExp.cpp \
+    runtime/RegExpObject.cpp \
+    runtime/RegExpPrototype.cpp \
+    runtime/ScopeChain.cpp \
+    runtime/SmallStrings.cpp \
+    runtime/StringConstructor.cpp \
+    runtime/StringObject.cpp \
+    runtime/StringPrototype.cpp \
+    runtime/StructureChain.cpp \
+    runtime/Structure.cpp \
+    runtime/TimeoutChecker.cpp \
+    runtime/UString.cpp \
+    runtime/UStringImpl.cpp \
+    wtf/Assertions.cpp \
+    wtf/ByteArray.cpp \
+    wtf/CurrentTime.cpp \
+    wtf/DateMath.cpp \
+    wtf/dtoa.cpp \
+    wtf/FastMalloc.cpp \
+    wtf/HashTable.cpp \
+    wtf/MainThread.cpp \
+    wtf/qt/MainThreadQt.cpp \
+    wtf/qt/ThreadingQt.cpp \
+    wtf/RandomNumber.cpp \
+    wtf/RefCountedLeakCounter.cpp \
+    wtf/symbian/BlockAllocatorSymbian.cpp \
+    wtf/ThreadingNone.cpp \
+    wtf/Threading.cpp \
+    wtf/TypeTraits.cpp \
+    wtf/unicode/CollatorDefault.cpp \
+    wtf/unicode/icu/CollatorICU.cpp \
+    wtf/unicode/UTF8.cpp \
+    yarr/RegexCompiler.cpp \
+    yarr/RegexInterpreter.cpp \
+    yarr/RegexJIT.cpp
+
+# Generated files, simply list them for JavaScriptCore
+SOURCES += \
+    $${JSC_GENERATED_SOURCES_DIR}/Grammar.cpp
+
+!contains(DEFINES, USE_SYSTEM_MALLOC) {
+    SOURCES += wtf/TCSystemAlloc.cpp
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp
index 1324586dcf..7393aa1466 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #include "ARMAssembler.h"
 
@@ -34,39 +34,6 @@ namespace JSC {
 
 // Patching helpers
 
-ARMWord* ARMAssembler::getLdrImmAddress(ARMWord* insn, uint32_t* constPool)
-{
-    // Must be an ldr ..., [pc +/- imm]
-    ASSERT((*insn & 0x0f7f0000) == 0x051f0000);
-
-    if (constPool && (*insn & 0x1))
-        return reinterpret_cast<ARMWord*>(constPool + ((*insn & SDT_OFFSET_MASK) >> 1));
-
-    ARMWord addr = reinterpret_cast<ARMWord>(insn) + 2 * sizeof(ARMWord);
-    if (*insn & DT_UP)
-        return reinterpret_cast<ARMWord*>(addr + (*insn & SDT_OFFSET_MASK));
-    else
-        return reinterpret_cast<ARMWord*>(addr - (*insn & SDT_OFFSET_MASK));
-}
-
-void ARMAssembler::linkBranch(void* code, JmpSrc from, void* to, int useConstantPool)
-{
-    ARMWord* insn = reinterpret_cast<ARMWord*>(code) + (from.m_offset / sizeof(ARMWord));
-
-    if (!useConstantPool) {
-        int diff = reinterpret_cast<ARMWord*>(to) - reinterpret_cast<ARMWord*>(insn + 2);
-
-        if ((diff <= BOFFSET_MAX && diff >= BOFFSET_MIN)) {
-            *insn = B | getConditionalField(*insn) | (diff & BRANCH_MASK);
-            ExecutableAllocator::cacheFlush(insn, sizeof(ARMWord));
-            return;
-        }
-    }
-    ARMWord* addr = getLdrImmAddress(insn);
-    *addr = reinterpret_cast<ARMWord>(to);
-    ExecutableAllocator::cacheFlush(addr, sizeof(ARMWord));
-}
-
 void ARMAssembler::patchConstantPoolLoad(void* loadAddr, void* constPoolAddr)
 {
     ARMWord *ldr = reinterpret_cast<ARMWord*>(loadAddr);
@@ -118,7 +85,7 @@ ARMWord ARMAssembler::getOp2(ARMWord imm)
     if ((imm & 0x00ffffff) == 0)
         return OP2_IMM | (imm >> 24) | (rol << 8);
 
-    return 0;
+    return INVALID_IMM;
 }
 
 int ARMAssembler::genInt(int reg, ARMWord imm, bool positive)
@@ -236,25 +203,18 @@ ARMWord ARMAssembler::getImm(ARMWord imm, int tmpReg, bool invert)
 
     // Do it by 1 instruction
     tmp = getOp2(imm);
-    if (tmp)
+    if (tmp != INVALID_IMM)
         return tmp;
 
     tmp = getOp2(~imm);
-    if (tmp) {
+    if (tmp != INVALID_IMM) {
         if (invert)
             return tmp | OP2_INV_IMM;
         mvn_r(tmpReg, tmp);
         return tmpReg;
     }
 
-    // Do it by 2 instruction
-    if (genInt(tmpReg, imm, true))
-        return tmpReg;
-    if (genInt(tmpReg, ~imm, false))
-        return tmpReg;
-
-    ldr_imm(tmpReg, imm);
-    return tmpReg;
+    return encodeComplexImm(imm, tmpReg);
 }
 
 void ARMAssembler::moveImm(ARMWord imm, int dest)
@@ -263,50 +223,68 @@ void ARMAssembler::moveImm(ARMWord imm, int dest)
 
     // Do it by 1 instruction
     tmp = getOp2(imm);
-    if (tmp) {
+    if (tmp != INVALID_IMM) {
         mov_r(dest, tmp);
         return;
     }
 
     tmp = getOp2(~imm);
-    if (tmp) {
+    if (tmp != INVALID_IMM) {
         mvn_r(dest, tmp);
         return;
     }
 
+    encodeComplexImm(imm, dest);
+}
+
+ARMWord ARMAssembler::encodeComplexImm(ARMWord imm, int dest)
+{
+#if WTF_ARM_ARCH_AT_LEAST(7)
+    ARMWord tmp = getImm16Op2(imm);
+    if (tmp != INVALID_IMM) {
+        movw_r(dest, tmp);
+        return dest;
+    }
+    movw_r(dest, getImm16Op2(imm & 0xffff));
+    movt_r(dest, getImm16Op2(imm >> 16));
+    return dest;
+#else
     // Do it by 2 instruction
     if (genInt(dest, imm, true))
-        return;
+        return dest;
     if (genInt(dest, ~imm, false))
-        return;
+        return dest;
 
     ldr_imm(dest, imm);
+    return dest;
+#endif
 }
 
 // Memory load/store helpers
 
-void ARMAssembler::dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset)
+void ARMAssembler::dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset, bool bytes)
 {
+    ARMWord transferFlag = bytes ? DT_BYTE : 0;
     if (offset >= 0) {
         if (offset <= 0xfff)
-            dtr_u(isLoad, srcDst, base, offset);
+            dtr_u(isLoad, srcDst, base, offset | transferFlag);
         else if (offset <= 0xfffff) {
             add_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
-            dtr_u(isLoad, srcDst, ARMRegisters::S0, offset & 0xfff);
+            dtr_u(isLoad, srcDst, ARMRegisters::S0, (offset & 0xfff) | transferFlag);
         } else {
             ARMWord reg = getImm(offset, ARMRegisters::S0);
-            dtr_ur(isLoad, srcDst, base, reg);
+            dtr_ur(isLoad, srcDst, base, reg | transferFlag);
         }
     } else {
         offset = -offset;
         if (offset <= 0xfff)
-            dtr_d(isLoad, srcDst, base, offset);
+            dtr_d(isLoad, srcDst, base, offset | transferFlag);
         else if (offset <= 0xfffff) {
             sub_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
-            dtr_d(isLoad, srcDst, ARMRegisters::S0, offset & 0xfff);
+            dtr_d(isLoad, srcDst, ARMRegisters::S0, (offset & 0xfff) | transferFlag);
         } else {
             ARMWord reg = getImm(offset, ARMRegisters::S0);
-            dtr_dr(isLoad, srcDst, base, reg);
+            dtr_dr(isLoad, srcDst, base, reg | transferFlag);
         }
     }
 }
@@ -378,10 +356,17 @@ void* ARMAssembler::executableCopy(ExecutablePool* allocator)
         // The last bit is set if the constant must be placed on constant pool.
         int pos = (*iter) & (~0x1);
         ARMWord* ldrAddr = reinterpret_cast<ARMWord*>(data + pos);
-        ARMWord offset = *getLdrImmAddress(ldrAddr);
-        if (offset != 0xffffffff) {
-            JmpSrc jmpSrc(pos);
-            linkBranch(data, jmpSrc, data + offset, ((*iter) & 1));
+        ARMWord* addr = getLdrImmAddress(ldrAddr);
+        if (*addr != 0xffffffff) {
+            if (!(*iter & 1)) {
+                int diff = reinterpret_cast<ARMWord*>(data + *addr) - (ldrAddr + DefaultPrefetching);
+
+                if ((diff <= BOFFSET_MAX && diff >= BOFFSET_MIN)) {
+                    *ldrAddr = B | getConditionalField(*ldrAddr) | (diff & BRANCH_MASK);
+                    continue;
+                }
+            }
+            *addr = reinterpret_cast<ARMWord>(data + *addr);
         }
     }
 
@@ -390,4 +375,4 @@ void* ARMAssembler::executableCopy(ExecutablePool* allocator)
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h
index 9f9a450e1c..f93db6827a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h
@@ -27,9 +27,7 @@
 #ifndef ARMAssembler_h
 #define ARMAssembler_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #include "AssemblerBufferWithConstantPool.h"
 #include <wtf/Assertions.h>
@@ -121,6 +119,7 @@ namespace JSC {
             MUL = 0x00000090,
             MULL = 0x00c00090,
             FADDD = 0x0e300b00,
+            FDIVD = 0x0e800b00,
             FSUBD = 0x0e300b40,
             FMULD = 0x0e200b00,
             FCMPD = 0x0eb40b40,
@@ -133,12 +132,18 @@ namespace JSC {
             B = 0x0a000000,
             BL = 0x0b000000,
             FMSR = 0x0e000a10,
+            FMRS = 0x0e100a10,
             FSITOD = 0x0eb80bc0,
+            FTOSID = 0x0ebd0b40,
             FMSTAT = 0x0ef1fa10,
-#if ARM_ARCH_VERSION >= 5
+#if WTF_ARM_ARCH_AT_LEAST(5)
             CLZ = 0x016f0f10,
             BKPT = 0xe120070,
 #endif
+#if WTF_ARM_ARCH_AT_LEAST(7)
+            MOVW = 0x03000000,
+            MOVT = 0x03400000,
+#endif
         };
 
         enum {
@@ -148,6 +153,7 @@ namespace JSC {
             SET_CC = (1 << 20),
             OP2_OFSREG = (1 << 25),
             DT_UP = (1 << 23),
+            DT_BYTE = (1 << 22),
             DT_WB = (1 << 21),
             // This flag is inlcuded in LDR and STR
             DT_PRE = (1 << 24),
@@ -175,6 +181,9 @@ namespace JSC {
             padForAlign32 = 0xee120070,
         };
 
+        static const ARMWord INVALID_IMM = 0xf0000000;
+        static const int DefaultPrefetching = 2;
+
         class JmpSrc {
             friend class ARMAssembler;
         public:
@@ -333,6 +342,20 @@ namespace JSC {
             emitInst(static_cast<ARMWord>(cc) | MOV, rd, ARMRegisters::r0, op2);
         }
 
+#if WTF_ARM_ARCH_AT_LEAST(7)
+        void movw_r(int rd, ARMWord op2, Condition cc = AL)
+        {
+            ASSERT((op2 | 0xf0fff) == 0xf0fff);
+            m_buffer.putInt(static_cast<ARMWord>(cc) | MOVW | RD(rd) | op2);
+        }
+
+        void movt_r(int rd, ARMWord op2, Condition cc = AL)
+        {
+            ASSERT((op2 | 0xf0fff) == 0xf0fff);
+            m_buffer.putInt(static_cast<ARMWord>(cc) | MOVT | RD(rd) | op2);
+        }
+#endif
+
         void movs_r(int rd, ARMWord op2, Condition cc = AL)
         {
             emitInst(static_cast<ARMWord>(cc) | MOV | SET_CC, rd, ARMRegisters::r0, op2);
@@ -378,6 +401,11 @@ namespace JSC {
             emitInst(static_cast<ARMWord>(cc) | FADDD, dd, dn, dm);
         }
 
+        void fdivd_r(int dd, int dn, int dm, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FDIVD, dd, dn, dm);
+        }
+
         void fsubd_r(int dd, int dn, int dm, Condition cc = AL)
         {
             emitInst(static_cast<ARMWord>(cc) | FSUBD, dd, dn, dm);
@@ -482,17 +510,27 @@ namespace JSC {
             emitInst(static_cast<ARMWord>(cc) | FMSR, rn, dd, 0);
         }
 
+        void fmrs_r(int rd, int dn, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FMRS, rd, dn, 0);
+        }
+
         void fsitod_r(int dd, int dm, Condition cc = AL)
         {
             emitInst(static_cast<ARMWord>(cc) | FSITOD, dd, 0, dm);
         }
 
+        void ftosid_r(int fd, int dm, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FTOSID, fd, 0, dm);
+        }
+
         void fmstat(Condition cc = AL)
         {
             m_buffer.putInt(static_cast<ARMWord>(cc) | FMSTAT);
         }
 
-#if ARM_ARCH_VERSION >= 5
+#if WTF_ARM_ARCH_AT_LEAST(5)
         void clz_r(int rd, int rm, Condition cc = AL)
         {
             m_buffer.putInt(static_cast<ARMWord>(cc) | CLZ | RD(rd) | RM(rm));
@@ -501,7 +539,7 @@ namespace JSC {
 
         void bkpt(ARMWord value)
         {
-#if ARM_ARCH_VERSION >= 5
+#if WTF_ARM_ARCH_AT_LEAST(5)
             m_buffer.putInt(BKPT | ((value & 0xff0) << 4) | (value & 0xf));
 #else
             // Cannot access to Zero memory address
@@ -594,15 +632,32 @@ namespace JSC {
 
         // Patching helpers
 
-        static ARMWord* getLdrImmAddress(ARMWord* insn, uint32_t* constPool = 0);
-        static void linkBranch(void* code, JmpSrc from, void* to, int useConstantPool = 0);
+        static ARMWord* getLdrImmAddress(ARMWord* insn)
+        {
+            // Must be an ldr ..., [pc +/- imm]
+            ASSERT((*insn & 0x0f7f0000) == 0x051f0000);
+
+            ARMWord addr = reinterpret_cast<ARMWord>(insn) + DefaultPrefetching * sizeof(ARMWord);
+            if (*insn & DT_UP)
+                return reinterpret_cast<ARMWord*>(addr + (*insn & SDT_OFFSET_MASK));
+            return reinterpret_cast<ARMWord*>(addr - (*insn & SDT_OFFSET_MASK));
+        }
+
+        static ARMWord* getLdrImmAddressOnPool(ARMWord* insn, uint32_t* constPool)
+        {
+            // Must be an ldr ..., [pc +/- imm]
+            ASSERT((*insn & 0x0f7f0000) == 0x051f0000);
+
+            if (*insn & 0x1)
+                return reinterpret_cast<ARMWord*>(constPool + ((*insn & SDT_OFFSET_MASK) >> 1));
+            return getLdrImmAddress(insn);
+        }
 
         static void patchPointerInternal(intptr_t from, void* to)
         {
             ARMWord* insn = reinterpret_cast<ARMWord*>(from);
             ARMWord* addr = getLdrImmAddress(insn);
             *addr = reinterpret_cast<ARMWord>(to);
-            ExecutableAllocator::cacheFlush(addr, sizeof(ARMWord));
         }
 
         static ARMWord patchConstantPoolLoad(ARMWord load, ARMWord value)
@@ -647,12 +702,13 @@ namespace JSC {
         void linkJump(JmpSrc from, JmpDst to)
         {
             ARMWord* insn = reinterpret_cast<ARMWord*>(m_buffer.data()) + (from.m_offset / sizeof(ARMWord));
-            *getLdrImmAddress(insn, m_buffer.poolAddress()) = static_cast<ARMWord>(to.m_offset);
+            ARMWord* addr = getLdrImmAddressOnPool(insn, m_buffer.poolAddress());
+            *addr = static_cast<ARMWord>(to.m_offset);
         }
 
         static void linkJump(void* code, JmpSrc from, void* to)
         {
-            linkBranch(code, from, to);
+            patchPointerInternal(reinterpret_cast<intptr_t>(code) + from.m_offset, to);
         }
 
         static void relinkJump(void* from, void* to)
@@ -662,12 +718,12 @@ namespace JSC {
 
         static void linkCall(void* code, JmpSrc from, void* to)
         {
-            linkBranch(code, from, to, true);
+            patchPointerInternal(reinterpret_cast<intptr_t>(code) + from.m_offset, to);
         }
 
         static void relinkCall(void* from, void* to)
         {
-            relinkJump(from, to);
+            patchPointerInternal(reinterpret_cast<intptr_t>(from) - sizeof(ARMWord), to);
         }
 
         // Address operations
@@ -708,12 +764,22 @@ namespace JSC {
         }
 
         static ARMWord getOp2(ARMWord imm);
+
+#if WTF_ARM_ARCH_AT_LEAST(7)
+        static ARMWord getImm16Op2(ARMWord imm)
+        {
+            if (imm <= 0xffff)
+                return (imm & 0xf000) << 4 | (imm & 0xfff);
+            return INVALID_IMM;
+        }
+#endif
         ARMWord getImm(ARMWord imm, int tmpReg, bool invert = false);
         void moveImm(ARMWord imm, int dest);
+        ARMWord encodeComplexImm(ARMWord imm, int dest);
 
         // Memory load/store helpers
 
-        void dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset);
+        void dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset, bool bytes = false);
         void baseIndexTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset);
         void doubleTransfer(bool isLoad, FPRegisterID srcDst, RegisterID base, int32_t offset);
 
@@ -764,6 +830,6 @@ namespace JSC {
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #endif // ARMAssembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
index 02ce2e93a1..21279f5fa1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 University of Szeged
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,9 +27,7 @@
 #ifndef ARMAssembler_h
 #define ARMAssembler_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM_THUMB2)
+#if ENABLE(ASSEMBLER) && CPU(ARM_THUMB2)
 
 #include "AssemblerBuffer.h"
 #include <wtf/Assertions.h>
@@ -201,10 +200,10 @@ class ARMThumbImmediate {
 
     ALWAYS_INLINE static void countLeadingZerosPartial(uint32_t& value, int32_t& zeros, const int N)
     {
-        if (value & ~((1<<N)-1)) /* check for any of the top N bits (of 2N bits) are set */ \
-            value >>= N;         /* if any were set, lose the bottom N */ \
-        else                     /* if none of the top N bits are set, */ \
-            zeros += N;          /* then we have identified N leading zeros */
+        if (value & ~((1 << N) - 1)) /* check for any of the top N bits (of 2N bits) are set */
+            value >>= N;             /* if any were set, lose the bottom N */
+        else                         /* if none of the top N bits are set, */
+            zeros += N;              /* then we have identified N leading zeros */
     }
 
     static int32_t countLeadingZeros(uint32_t value)
@@ -236,6 +235,11 @@ class ARMThumbImmediate {
     ARMThumbImmediate(ThumbImmediateType type, uint16_t value)
         : m_type(TypeUInt16)
     {
+        // Make sure this constructor is only reached with type TypeUInt16;
+        // this extra parameter makes the code a little clearer by making it
+        // explicit at call sites which type is being constructed
+        ASSERT_UNUSED(type, type == TypeUInt16);
+
         m_value.asInt = value;
     }
 
@@ -577,11 +581,13 @@ private:
         OP_MOV_reg_T1       = 0x4600,
         OP_BLX              = 0x4700,
         OP_BX               = 0x4700,
-        OP_LDRH_reg_T1      = 0x5A00,
         OP_STR_reg_T1       = 0x5000,
         OP_LDR_reg_T1       = 0x5800,
+        OP_LDRH_reg_T1      = 0x5A00,
+        OP_LDRB_reg_T1      = 0x5C00,
         OP_STR_imm_T1       = 0x6000,
         OP_LDR_imm_T1       = 0x6800,
+        OP_LDRB_imm_T1      = 0x7800,
         OP_LDRH_imm_T1      = 0x8800,
         OP_STR_imm_T2       = 0x9000,
         OP_LDR_imm_T2       = 0x9800,
@@ -626,12 +632,15 @@ private:
         OP_SUB_imm_T4   = 0xF2A0,
         OP_MOVT         = 0xF2C0,
         OP_NOP_T2a      = 0xF3AF,
+        OP_LDRB_imm_T3  = 0xF810,
+        OP_LDRB_reg_T2  = 0xF810,
         OP_LDRH_reg_T2  = 0xF830,
         OP_LDRH_imm_T3  = 0xF830,
         OP_STR_imm_T4   = 0xF840,
         OP_STR_reg_T2   = 0xF840,
         OP_LDR_imm_T4   = 0xF850,
         OP_LDR_reg_T2   = 0xF850,
+        OP_LDRB_imm_T2  = 0xF890,
         OP_LDRH_imm_T2  = 0xF8B0,
         OP_STR_imm_T3   = 0xF8C0,
         OP_LDR_imm_T3   = 0xF8D0,
@@ -1075,6 +1084,52 @@ public:
             m_formatter.twoWordOp12Reg4FourFours(OP_LDRH_reg_T2, rn, FourFours(rt, 0, shift, rm));
     }
 
+    void ldrb(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
+        ASSERT(imm.isUInt12());
+
+        if (!((rt | rn) & 8) && imm.isUInt5())
+            m_formatter.oneWordOp5Imm5Reg3Reg3(OP_LDRB_imm_T1, imm.getUInt5(), rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDRB_imm_T2, rn, rt, imm.getUInt12());
+    }
+
+    void ldrb(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
+    {
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(index || wback);
+        ASSERT(!wback | (rt != rn));
+
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+
+        ASSERT(!(offset & ~0xff));
+
+        offset |= (wback << 8);
+        offset |= (add   << 9);
+        offset |= (index << 10);
+        offset |= (1 << 11);
+
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDRB_imm_T3, rn, rt, offset);
+    }
+
+    void ldrb(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift = 0)
+    {
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_LDRB_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_LDRB_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+
     void lsl(RegisterID rd, RegisterID rm, int32_t shiftAmount)
     {
         ASSERT(!BadReg(rd));
@@ -1827,6 +1882,6 @@ private:
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_THUMB2)
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_THUMB2)
 
 #endif // ARMAssembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
index 525fe9813e..aad70e4dc1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -26,8 +26,6 @@
 #ifndef AbstractMacroAssembler_h
 #define AbstractMacroAssembler_h
 
-#include <wtf/Platform.h>
-
 #include <MacroAssemblerCodeRef.h>
 #include <CodeLocation.h>
 #include <wtf/Noncopyable.h>
@@ -173,16 +171,16 @@ public:
     struct Imm32 {
         explicit Imm32(int32_t value)
             : m_value(value)
-#if PLATFORM(ARM)
+#if CPU(ARM) || CPU(MIPS)
             , m_isPointer(false)
 #endif
         {
         }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
         explicit Imm32(ImmPtr ptr)
             : m_value(ptr.asIntptr())
-#if PLATFORM(ARM)
+#if CPU(ARM) || CPU(MIPS)
             , m_isPointer(true)
 #endif
         {
@@ -190,13 +188,14 @@ public:
 #endif
 
         int32_t m_value;
-#if PLATFORM(ARM)
+#if CPU(ARM) || CPU(MIPS)
         // We rely on being able to regenerate code to recover exception handling
         // information.  Since ARMv7 supports 16-bit immediates there is a danger
         // that if pointer values change the layout of the generated code will change.
         // To avoid this problem, always generate pointers (and thus Imm32s constructed
         // from ImmPtrs) with a code sequence that is able  to represent  any pointer
         // value - don't use a more compact form in these cases.
+        // Same for MIPS.
         bool m_isPointer;
 #endif
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
index 073906a526..e2fb8a1cc6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
@@ -26,8 +26,6 @@
 #ifndef AssemblerBuffer_h
 #define AssemblerBuffer_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include "stdint.h"
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
index af3c3be07e..b1c537e1e3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
@@ -27,8 +27,6 @@
 #ifndef AssemblerBufferWithConstantPool_h
 #define AssemblerBufferWithConstantPool_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include "AssemblerBuffer.h"
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/CodeLocation.h b/src/3rdparty/webkit/JavaScriptCore/assembler/CodeLocation.h
index b910b6f882..cab28cd905 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/CodeLocation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/CodeLocation.h
@@ -26,7 +26,6 @@
 #ifndef CodeLocation_h
 #define CodeLocation_h
 
-#include <wtf/Platform.h>
 
 #include <MacroAssemblerCodeRef.h>
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/LinkBuffer.h b/src/3rdparty/webkit/JavaScriptCore/assembler/LinkBuffer.h
index 6d0811703c..47cac5ab63 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/LinkBuffer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/LinkBuffer.h
@@ -26,8 +26,6 @@
 #ifndef LinkBuffer_h
 #define LinkBuffer_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include <MacroAssembler.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MIPSAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MIPSAssembler.h
new file mode 100644
index 0000000000..0ab929deeb
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MIPSAssembler.h
@@ -0,0 +1,935 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 University of Szeged
+ * All rights reserved.
+ * Copyright (C) 2010 MIPS Technologies, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY MIPS TECHNOLOGIES, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL MIPS TECHNOLOGIES, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MIPSAssembler_h
+#define MIPSAssembler_h
+
+#if ENABLE(ASSEMBLER) && CPU(MIPS)
+
+#include "AssemblerBuffer.h"
+#include <wtf/Assertions.h>
+#include <wtf/SegmentedVector.h>
+
+namespace JSC {
+
+typedef uint32_t MIPSWord;
+
+namespace MIPSRegisters {
+typedef enum {
+    r0 = 0,
+    r1,
+    r2,
+    r3,
+    r4,
+    r5,
+    r6,
+    r7,
+    r8,
+    r9,
+    r10,
+    r11,
+    r12,
+    r13,
+    r14,
+    r15,
+    r16,
+    r17,
+    r18,
+    r19,
+    r20,
+    r21,
+    r22,
+    r23,
+    r24,
+    r25,
+    r26,
+    r27,
+    r28,
+    r29,
+    r30,
+    r31,
+    zero = r0,
+    at = r1,
+    v0 = r2,
+    v1 = r3,
+    a0 = r4,
+    a1 = r5,
+    a2 = r6,
+    a3 = r7,
+    t0 = r8,
+    t1 = r9,
+    t2 = r10,
+    t3 = r11,
+    t4 = r12,
+    t5 = r13,
+    t6 = r14,
+    t7 = r15,
+    s0 = r16,
+    s1 = r17,
+    s2 = r18,
+    s3 = r19,
+    s4 = r20,
+    s5 = r21,
+    s6 = r22,
+    s7 = r23,
+    t8 = r24,
+    t9 = r25,
+    k0 = r26,
+    k1 = r27,
+    gp = r28,
+    sp = r29,
+    fp = r30,
+    ra = r31
+} RegisterID;
+
+typedef enum {
+    f0,
+    f1,
+    f2,
+    f3,
+    f4,
+    f5,
+    f6,
+    f7,
+    f8,
+    f9,
+    f10,
+    f11,
+    f12,
+    f13,
+    f14,
+    f15,
+    f16,
+    f17,
+    f18,
+    f19,
+    f20,
+    f21,
+    f22,
+    f23,
+    f24,
+    f25,
+    f26,
+    f27,
+    f28,
+    f29,
+    f30,
+    f31
+} FPRegisterID;
+
+} // namespace MIPSRegisters
+
+class MIPSAssembler {
+public:
+    typedef MIPSRegisters::RegisterID RegisterID;
+    typedef MIPSRegisters::FPRegisterID FPRegisterID;
+    typedef SegmentedVector<int, 64> Jumps;
+
+    MIPSAssembler()
+    {
+    }
+
+    // MIPS instruction opcode field position
+    enum {
+        OP_SH_RD = 11,
+        OP_SH_RT = 16,
+        OP_SH_RS = 21,
+        OP_SH_SHAMT = 6,
+        OP_SH_CODE = 16,
+        OP_SH_FD = 6,
+        OP_SH_FS = 11,
+        OP_SH_FT = 16
+    };
+
+    class JmpSrc {
+        friend class MIPSAssembler;
+    public:
+        JmpSrc()
+            : m_offset(-1)
+        {
+        }
+
+    private:
+        JmpSrc(int offset)
+            : m_offset(offset)
+        {
+        }
+
+        int m_offset;
+    };
+
+    class JmpDst {
+        friend class MIPSAssembler;
+    public:
+        JmpDst()
+            : m_offset(-1)
+            , m_used(false)
+        {
+        }
+
+        bool isUsed() const { return m_used; }
+        void used() { m_used = true; }
+    private:
+        JmpDst(int offset)
+            : m_offset(offset)
+            , m_used(false)
+        {
+            ASSERT(m_offset == offset);
+        }
+
+        int m_offset : 31;
+        int m_used : 1;
+    };
+
+    void emitInst(MIPSWord op)
+    {
+        void* oldBase = m_buffer.data();
+
+        m_buffer.putInt(op);
+
+        void* newBase = m_buffer.data();
+        if (oldBase != newBase)
+            relocateJumps(oldBase, newBase);
+    }
+
+    void nop()
+    {
+        emitInst(0x00000000);
+    }
+
+    /* Need to insert one load data delay nop for mips1.  */
+    void loadDelayNop()
+    {
+#if WTF_MIPS_ISA(1)
+        nop();
+#endif
+    }
+
+    /* Need to insert one coprocessor access delay nop for mips1.  */
+    void copDelayNop()
+    {
+#if WTF_MIPS_ISA(1)
+        nop();
+#endif
+    }
+
+    void move(RegisterID rd, RegisterID rs)
+    {
+        /* addu */
+        emitInst(0x00000021 | (rd << OP_SH_RD) | (rs << OP_SH_RS));
+    }
+
+    /* Set an immediate value to a register.  This may generate 1 or 2
+       instructions.  */
+    void li(RegisterID dest, int imm)
+    {
+        if (imm >= -32768 && imm <= 32767)
+            addiu(dest, MIPSRegisters::zero, imm);
+        else if (imm >= 0 && imm < 65536)
+            ori(dest, MIPSRegisters::zero, imm);
+        else {
+            lui(dest, imm >> 16);
+            if (imm & 0xffff)
+                ori(dest, dest, imm);
+        }
+    }
+
+    void lui(RegisterID rt, int imm)
+    {
+        emitInst(0x3c000000 | (rt << OP_SH_RT) | (imm & 0xffff));
+    }
+
+    void addiu(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x24000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (imm & 0xffff));
+    }
+
+    void addu(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000021 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void subu(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000023 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void mult(RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000018 | (rs << OP_SH_RS) | (rt << OP_SH_RT));
+    }
+
+    void mfhi(RegisterID rd)
+    {
+        emitInst(0x00000010 | (rd << OP_SH_RD));
+    }
+
+    void mflo(RegisterID rd)
+    {
+        emitInst(0x00000012 | (rd << OP_SH_RD));
+    }
+
+    void mul(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+#if WTF_MIPS_ISA_AT_LEAST(32) 
+        emitInst(0x70000002 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+#else
+        mult(rs, rt);
+        mflo(rd);
+#endif
+    }
+
+    void andInsn(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000024 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void andi(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x30000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (imm & 0xffff));
+    }
+
+    void nor(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000027 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void orInsn(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000025 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void ori(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x34000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (imm & 0xffff));
+    }
+
+    void xorInsn(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000026 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void xori(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x38000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (imm & 0xffff));
+    }
+
+    void slt(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x0000002a | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void sltu(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x0000002b | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void sltiu(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x2c000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (imm & 0xffff));
+    }
+
+    void sll(RegisterID rd, RegisterID rt, int shamt)
+    {
+        emitInst(0x00000000 | (rd << OP_SH_RD) | (rt << OP_SH_RT)
+                 | ((shamt & 0x1f) << OP_SH_SHAMT));
+    }
+
+    void sllv(RegisterID rd, RegisterID rt, int rs)
+    {
+        emitInst(0x00000004 | (rd << OP_SH_RD) | (rt << OP_SH_RT)
+                 | (rs << OP_SH_RS));
+    }
+
+    void sra(RegisterID rd, RegisterID rt, int shamt)
+    {
+        emitInst(0x00000003 | (rd << OP_SH_RD) | (rt << OP_SH_RT)
+                 | ((shamt & 0x1f) << OP_SH_SHAMT));
+    }
+
+    void srav(RegisterID rd, RegisterID rt, RegisterID rs)
+    {
+        emitInst(0x00000007 | (rd << OP_SH_RD) | (rt << OP_SH_RT)
+                 | (rs << OP_SH_RS));
+    }
+
+    void lw(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x8c000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void lwl(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x88000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void lwr(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x98000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void lhu(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x94000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void sw(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0xac000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+    }
+
+    void jr(RegisterID rs)
+    {
+        emitInst(0x00000008 | (rs << OP_SH_RS));
+    }
+
+    void jalr(RegisterID rs)
+    {
+        emitInst(0x0000f809 | (rs << OP_SH_RS));
+    }
+
+    void jal()
+    {
+        emitInst(0x0c000000);
+    }
+
+    void bkpt()
+    {
+        int value = 512; /* BRK_BUG */
+        emitInst(0x0000000d | ((value & 0x3ff) << OP_SH_CODE));
+    }
+
+    void bgez(RegisterID rs, int imm)
+    {
+        emitInst(0x04010000 | (rs << OP_SH_RS) | (imm & 0xffff));
+    }
+
+    void bltz(RegisterID rs, int imm)
+    {
+        emitInst(0x04000000 | (rs << OP_SH_RS) | (imm & 0xffff));
+    }
+
+    void beq(RegisterID rs, RegisterID rt, int imm)
+    {
+        emitInst(0x10000000 | (rs << OP_SH_RS) | (rt << OP_SH_RT) | (imm & 0xffff));
+    }
+
+    void bne(RegisterID rs, RegisterID rt, int imm)
+    {
+        emitInst(0x14000000 | (rs << OP_SH_RS) | (rt << OP_SH_RT) | (imm & 0xffff));
+    }
+
+    void bc1t()
+    {
+        emitInst(0x45010000);
+    }
+
+    void bc1f()
+    {
+        emitInst(0x45000000);
+    }
+
+    JmpSrc newJmpSrc()
+    {
+        return JmpSrc(m_buffer.size());
+    }
+
+    void appendJump()
+    {
+        m_jumps.append(m_buffer.size());
+    }
+
+    void addd(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200000 | (fd << OP_SH_FD) | (fs << OP_SH_FS)
+                 | (ft << OP_SH_FT));
+    }
+
+    void subd(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200001 | (fd << OP_SH_FD) | (fs << OP_SH_FS)
+                 | (ft << OP_SH_FT));
+    }
+
+    void muld(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200002 | (fd << OP_SH_FD) | (fs << OP_SH_FS)
+                 | (ft << OP_SH_FT));
+    }
+
+    void lwc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xc4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+        copDelayNop();
+    }
+
+    void ldc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xd4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+    }
+
+    void swc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xe4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+    }
+
+    void sdc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xf4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+    }
+
+    void mtc1(RegisterID rt, FPRegisterID fs)
+    {
+        emitInst(0x44800000 | (fs << OP_SH_FS) | (rt << OP_SH_RT));
+        copDelayNop();
+    }
+
+    void mfc1(RegisterID rt, FPRegisterID fs)
+    {
+        emitInst(0x44000000 | (fs << OP_SH_FS) | (rt << OP_SH_RT));
+        copDelayNop();
+    }
+
+    void truncwd(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x4620000d | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
+    void cvtdw(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x46800021 | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
+    void ceqd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200032 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cngtd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003f | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cnged(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003d | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cltd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003c | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cled(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003e | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cueqd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200033 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void coled(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200036 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void coltd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200034 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void culed(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200037 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cultd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200035 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    // General helpers
+
+    JmpDst label()
+    {
+        return JmpDst(m_buffer.size());
+    }
+
+    JmpDst align(int alignment)
+    {
+        while (!m_buffer.isAligned(alignment))
+            bkpt();
+
+        return label();
+    }
+
+    static void* getRelocatedAddress(void* code, JmpSrc jump)
+    {
+        ASSERT(jump.m_offset != -1);
+        void* b = reinterpret_cast<void*>((reinterpret_cast<intptr_t>(code)) + jump.m_offset);
+        return b;
+    }
+
+    static void* getRelocatedAddress(void* code, JmpDst label)
+    {
+        void* b = reinterpret_cast<void*>((reinterpret_cast<intptr_t>(code)) + label.m_offset);
+        return b;
+    }
+
+    static int getDifferenceBetweenLabels(JmpDst from, JmpDst to)
+    {
+        return to.m_offset - from.m_offset;
+    }
+
+    static int getDifferenceBetweenLabels(JmpDst from, JmpSrc to)
+    {
+        return to.m_offset - from.m_offset;
+    }
+
+    static int getDifferenceBetweenLabels(JmpSrc from, JmpDst to)
+    {
+        return to.m_offset - from.m_offset;
+    }
+
+    // Assembler admin methods:
+
+    size_t size() const
+    {
+        return m_buffer.size();
+    }
+
+    void* executableCopy(ExecutablePool* allocator)
+    {
+        void *result = m_buffer.executableCopy(allocator);
+        if (!result)
+            return 0;
+
+        relocateJumps(m_buffer.data(), result);
+        return result;
+    }
+
+    static unsigned getCallReturnOffset(JmpSrc call)
+    {
+        // The return address is after a call and a delay slot instruction
+        return call.m_offset;
+    }
+
+    // Linking & patching:
+    //
+    // 'link' and 'patch' methods are for use on unprotected code - such as the code
+    // within the AssemblerBuffer, and code being patched by the patch buffer.  Once
+    // code has been finalized it is (platform support permitting) within a non-
+    // writable region of memory; to modify the code in an execute-only execuable
+    // pool the 'repatch' and 'relink' methods should be used.
+
+    void linkJump(JmpSrc from, JmpDst to)
+    {
+        ASSERT(to.m_offset != -1);
+        ASSERT(from.m_offset != -1);
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(m_buffer.data()) + from.m_offset);
+        MIPSWord* toPos = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(m_buffer.data()) + to.m_offset);
+
+        ASSERT(!(*(insn - 1)) && !(*(insn - 2)) && !(*(insn - 3)) && !(*(insn - 5)));
+        insn = insn - 6;
+        linkWithOffset(insn, toPos);
+    }
+
+    static void linkJump(void* code, JmpSrc from, void* to)
+    {
+        ASSERT(from.m_offset != -1);
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
+
+        ASSERT(!(*(insn - 1)) && !(*(insn - 2)) && !(*(insn - 3)) && !(*(insn - 5)));
+        insn = insn - 6;
+        linkWithOffset(insn, to);
+    }
+
+    static void linkCall(void* code, JmpSrc from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
+        linkCallInternal(insn, to);
+    }
+
+    static void linkPointer(void* code, JmpDst from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        *insn = (*insn & 0xffff0000) | ((reinterpret_cast<intptr_t>(to) >> 16) & 0xffff);
+        insn++;
+        ASSERT((*insn & 0xfc000000) == 0x34000000); // ori
+        *insn = (*insn & 0xffff0000) | (reinterpret_cast<intptr_t>(to) & 0xffff);
+    }
+
+    static void relinkJump(void* from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+
+        ASSERT(!(*(insn - 1)) && !(*(insn - 5)));
+        insn = insn - 6;
+        int flushSize = linkWithOffset(insn, to);
+
+        ExecutableAllocator::cacheFlush(insn, flushSize);
+    }
+
+    static void relinkCall(void* from, void* to)
+    {
+        void* start;
+        int size = linkCallInternal(from, to);
+        if (size == sizeof(MIPSWord))
+            start = reinterpret_cast<void*>(reinterpret_cast<intptr_t>(from) - 2 * sizeof(MIPSWord));
+        else
+            start = reinterpret_cast<void*>(reinterpret_cast<intptr_t>(from) - 4 * sizeof(MIPSWord));
+
+        ExecutableAllocator::cacheFlush(start, size);
+    }
+
+    static void repatchInt32(void* from, int32_t to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        *insn = (*insn & 0xffff0000) | ((to >> 16) & 0xffff);
+        insn++;
+        ASSERT((*insn & 0xfc000000) == 0x34000000); // ori
+        *insn = (*insn & 0xffff0000) | (to & 0xffff);
+        insn--;
+        ExecutableAllocator::cacheFlush(insn, 2 * sizeof(MIPSWord));
+    }
+
+    static void repatchPointer(void* from, void* to)
+    {
+        repatchInt32(from, reinterpret_cast<int32_t>(to));
+    }
+
+    static void repatchLoadPtrToLEA(void* from)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+        insn = insn + 3;
+        ASSERT((*insn & 0xfc000000) == 0x8c000000); // lw
+        /* lw -> addiu */
+        *insn = 0x24000000 | (*insn & 0x03ffffff);
+
+        ExecutableAllocator::cacheFlush(insn, sizeof(MIPSWord));
+    }
+
+private:
+
+    /* Update each jump in the buffer of newBase.  */
+    void relocateJumps(void* oldBase, void* newBase)
+    {
+        // Check each jump
+        for (Jumps::Iterator iter = m_jumps.begin(); iter != m_jumps.end(); ++iter) {
+            int pos = *iter;
+            MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(newBase) + pos);
+            insn = insn + 2;
+            // Need to make sure we have 5 valid instructions after pos
+            if ((unsigned int)pos >= m_buffer.size() - 5 * sizeof(MIPSWord))
+                continue;
+
+            if ((*insn & 0xfc000000) == 0x08000000) { // j
+                int offset = *insn & 0x03ffffff;
+                int oldInsnAddress = (int)insn - (int)newBase + (int)oldBase;
+                int topFourBits = (oldInsnAddress + 4) >> 28;
+                int oldTargetAddress = (topFourBits << 28) | (offset << 2);
+                int newTargetAddress = oldTargetAddress - (int)oldBase + (int)newBase;
+                int newInsnAddress = (int)insn;
+                if (((newInsnAddress + 4) >> 28) == (newTargetAddress >> 28))
+                    *insn = 0x08000000 | ((newTargetAddress >> 2) & 0x3ffffff);
+                else {
+                    /* lui */
+                    *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((newTargetAddress >> 16) & 0xffff);
+                    /* ori */
+                    *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (newTargetAddress & 0xffff);
+                    /* jr */
+                    *(insn + 2) = 0x00000008 | (MIPSRegisters::t9 << OP_SH_RS);
+                }
+            } else if ((*insn & 0xffe00000) == 0x3c000000) { // lui
+                int high = (*insn & 0xffff) << 16;
+                int low = *(insn + 1) & 0xffff;
+                int oldTargetAddress = high | low;
+                int newTargetAddress = oldTargetAddress - (int)oldBase + (int)newBase;
+                /* lui */
+                *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((newTargetAddress >> 16) & 0xffff);
+                /* ori */
+                *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (newTargetAddress & 0xffff);
+            }
+        }
+    }
+
+    static int linkWithOffset(MIPSWord* insn, void* to)
+    {
+        ASSERT((*insn & 0xfc000000) == 0x10000000 // beq
+               || (*insn & 0xfc000000) == 0x14000000 // bne
+               || (*insn & 0xffff0000) == 0x45010000 // bc1t
+               || (*insn & 0xffff0000) == 0x45000000); // bc1f
+        intptr_t diff = (reinterpret_cast<intptr_t>(to)
+                         - reinterpret_cast<intptr_t>(insn) - 4) >> 2;
+
+        if (diff < -32768 || diff > 32767 || *(insn + 2) != 0x10000003) {
+            /*
+                Convert the sequence:
+                  beq $2, $3, target
+                  nop
+                  b 1f
+                  nop
+                  nop
+                  nop
+                1:
+
+                to the new sequence if possible:
+                  bne $2, $3, 1f
+                  nop
+                  j    target
+                  nop
+                  nop
+                  nop
+                1:
+
+                OR to the new sequence:
+                  bne $2, $3, 1f
+                  nop
+                  lui $25, target >> 16
+                  ori $25, $25, target & 0xffff
+                  jr $25
+                  nop
+                1:
+
+                Note: beq/bne/bc1t are converted to bne/beq/bc1f.
+            */
+
+            if (*(insn + 2) == 0x10000003) {
+                if ((*insn & 0xfc000000) == 0x10000000) // beq
+                    *insn = (*insn & 0x03ff0000) | 0x14000005; // bne
+                else if ((*insn & 0xfc000000) == 0x14000000) // bne
+                    *insn = (*insn & 0x03ff0000) | 0x10000005; // beq
+                else if ((*insn & 0xffff0000) == 0x45010000) // bc1t
+                    *insn = 0x45000005; // bc1f
+                else
+                    ASSERT(0);
+            }
+
+            insn = insn + 2;
+            if ((reinterpret_cast<intptr_t>(insn) + 4) >> 28
+                == reinterpret_cast<intptr_t>(to) >> 28) {
+                *insn = 0x08000000 | ((reinterpret_cast<intptr_t>(to) >> 2) & 0x3ffffff);
+                *(insn + 1) = 0;
+                return 4 * sizeof(MIPSWord);
+            }
+
+            intptr_t newTargetAddress = reinterpret_cast<intptr_t>(to);
+            /* lui */
+            *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((newTargetAddress >> 16) & 0xffff);
+            /* ori */
+            *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (newTargetAddress & 0xffff);
+            /* jr */
+            *(insn + 2) = 0x00000008 | (MIPSRegisters::t9 << OP_SH_RS);
+            return 5 * sizeof(MIPSWord);
+        }
+
+        *insn = (*insn & 0xffff0000) | (diff & 0xffff);
+        return sizeof(MIPSWord);
+    }
+
+    static int linkCallInternal(void* from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+        insn = insn - 4;
+
+        if ((*(insn + 2) & 0xfc000000) == 0x0c000000) { // jal
+            if ((reinterpret_cast<intptr_t>(from) - 4) >> 28
+                == reinterpret_cast<intptr_t>(to) >> 28) {
+                *(insn + 2) = 0x0c000000 | ((reinterpret_cast<intptr_t>(to) >> 2) & 0x3ffffff);
+                return sizeof(MIPSWord);
+            }
+
+            /* lui $25, (to >> 16) & 0xffff */
+            *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((reinterpret_cast<intptr_t>(to) >> 16) & 0xffff);
+            /* ori $25, $25, to & 0xffff */
+            *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (reinterpret_cast<intptr_t>(to) & 0xffff);
+            /* jalr $25 */
+            *(insn + 2) = 0x0000f809 | (MIPSRegisters::t9 << OP_SH_RS);
+            return 3 * sizeof(MIPSWord);
+        }
+
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        ASSERT((*(insn + 1) & 0xfc000000) == 0x34000000); // ori
+
+        /* lui */
+        *insn = (*insn & 0xffff0000) | ((reinterpret_cast<intptr_t>(to) >> 16) & 0xffff);
+        /* ori */
+        *(insn + 1) = (*(insn + 1) & 0xffff0000) | (reinterpret_cast<intptr_t>(to) & 0xffff);
+        return 2 * sizeof(MIPSWord);
+    }
+
+    AssemblerBuffer m_buffer;
+    Jumps m_jumps;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && CPU(MIPS)
+
+#endif // MIPSAssembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
index 2743ab4e4b..e6f698fbb5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
@@ -26,23 +26,27 @@
 #ifndef MacroAssembler_h
 #define MacroAssembler_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
 #include "MacroAssemblerARMv7.h"
 namespace JSC { typedef MacroAssemblerARMv7 MacroAssemblerBase; };
 
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif CPU(ARM_TRADITIONAL)
 #include "MacroAssemblerARM.h"
 namespace JSC { typedef MacroAssemblerARM MacroAssemblerBase; };
 
-#elif PLATFORM(X86)
+#elif CPU(MIPS)
+#include "MacroAssemblerMIPS.h"
+namespace JSC {
+typedef MacroAssemblerMIPS MacroAssemblerBase;
+};
+
+#elif CPU(X86)
 #include "MacroAssemblerX86.h"
 namespace JSC { typedef MacroAssemblerX86 MacroAssemblerBase; };
 
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
 #include "MacroAssemblerX86_64.h"
 namespace JSC { typedef MacroAssemblerX86_64 MacroAssemblerBase; };
 
@@ -60,7 +64,7 @@ public:
     using MacroAssemblerBase::jump;
     using MacroAssemblerBase::branch32;
     using MacroAssemblerBase::branch16;
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     using MacroAssemblerBase::branchPtr;
     using MacroAssemblerBase::branchTestPtr;
 #endif
@@ -133,7 +137,8 @@ public:
 
     // Ptr methods
     // On 32-bit platforms (i.e. x86), these methods directly map onto their 32-bit equivalents.
-#if !PLATFORM(X86_64)
+    // FIXME: should this use a test for 32-bitness instead of this specific exception?
+#if !CPU(X86_64)
     void addPtr(RegisterID src, RegisterID dest)
     {
         add32(src, dest);
@@ -179,16 +184,6 @@ public:
         or32(imm, dest);
     }
 
-    void rshiftPtr(RegisterID shift_amount, RegisterID dest)
-    {
-        rshift32(shift_amount, dest);
-    }
-
-    void rshiftPtr(Imm32 imm, RegisterID dest)
-    {
-        rshift32(imm, dest);
-    }
-
     void subPtr(RegisterID src, RegisterID dest)
     {
         sub32(src, dest);
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
index d726ecd9c6..b5b20fa07d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
@@ -26,11 +26,11 @@
 
 #include "config.h"
 
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #include "MacroAssemblerARM.h"
 
-#if PLATFORM(LINUX)
+#if OS(LINUX)
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
@@ -43,7 +43,7 @@ namespace JSC {
 
 static bool isVFPPresent()
 {
-#if PLATFORM(LINUX)
+#if OS(LINUX)
     int fd = open("/proc/self/auxv", O_RDONLY);
     if (fd > 0) {
         Elf32_auxv_t aux;
@@ -62,7 +62,8 @@ static bool isVFPPresent()
 
 const bool MacroAssemblerARM::s_isVFPPresent = isVFPPresent();
 
-#if defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_REQUIRE_NATURAL_ALIGNMENT
+#if CPU(ARMV5_OR_LOWER)
+/* On ARMv5 and below, natural alignment is required. */
 void MacroAssemblerARM::load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
 {
     ARMWord op2;
@@ -91,4 +92,4 @@ void MacroAssemblerARM::load32WithUnalignedHalfWords(BaseIndex address, Register
 
 }
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
index 7a72b0698f..52c4fa22ae 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -28,9 +28,7 @@
 #ifndef MacroAssemblerARM_h
 #define MacroAssemblerARM_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #include "ARMAssembler.h"
 #include "AbstractMacroAssembler.h"
@@ -38,6 +36,9 @@
 namespace JSC {
 
 class MacroAssemblerARM : public AbstractMacroAssembler<ARMAssembler> {
+    static const int DoubleConditionMask = 0x0f;
+    static const int DoubleConditionBitSpecial = 0x10;
+    COMPILE_ASSERT(!(DoubleConditionBitSpecial & DoubleConditionMask), DoubleConditionBitSpecial_should_not_interfere_with_ARMAssembler_Condition_codes);
 public:
     enum Condition {
         Equal = ARMAssembler::EQ,
@@ -57,11 +58,20 @@ public:
     };
 
     enum DoubleCondition {
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
         DoubleEqual = ARMAssembler::EQ,
+        DoubleNotEqual = ARMAssembler::NE | DoubleConditionBitSpecial,
         DoubleGreaterThan = ARMAssembler::GT,
         DoubleGreaterThanOrEqual = ARMAssembler::GE,
-        DoubleLessThan = ARMAssembler::LT,
-        DoubleLessThanOrEqual = ARMAssembler::LE,
+        DoubleLessThan = ARMAssembler::CC,
+        DoubleLessThanOrEqual = ARMAssembler::LS,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = ARMAssembler::EQ | DoubleConditionBitSpecial,
+        DoubleNotEqualOrUnordered = ARMAssembler::NE,
+        DoubleGreaterThanOrUnordered = ARMAssembler::HI,
+        DoubleGreaterThanOrEqualOrUnordered = ARMAssembler::CS,
+        DoubleLessThanOrUnordered = ARMAssembler::LT,
+        DoubleLessThanOrEqualOrUnordered = ARMAssembler::LE,
     };
 
     static const RegisterID stackPointerRegister = ARMRegisters::sp;
@@ -106,14 +116,18 @@ public:
             m_assembler.ands_r(dest, dest, w);
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void lshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.movs_r(dest, m_assembler.lsl(dest, imm.m_value & 0x1f));
+        ARMWord w = ARMAssembler::getOp2(0x1f);
+        ASSERT(w != ARMAssembler::INVALID_IMM);
+        m_assembler.and_r(ARMRegisters::S0, shift_amount, w);
+
+        m_assembler.movs_r(dest, m_assembler.lsl_r(dest, ARMRegisters::S0));
     }
 
-    void lshift32(RegisterID shift_amount, RegisterID dest)
+    void lshift32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.movs_r(dest, m_assembler.lsl_r(dest, shift_amount));
+        m_assembler.movs_r(dest, m_assembler.lsl(dest, imm.m_value & 0x1f));
     }
 
     void mul32(RegisterID src, RegisterID dest)
@@ -131,6 +145,11 @@ public:
         m_assembler.muls_r(dest, src, ARMRegisters::S0);
     }
 
+    void neg32(RegisterID srcDest)
+    {
+        m_assembler.rsbs_r(srcDest, srcDest, ARMAssembler::getOp2(0));
+    }
+
     void not32(RegisterID dest)
     {
         m_assembler.mvns_r(dest, dest);
@@ -148,7 +167,11 @@ public:
 
     void rshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.movs_r(dest, m_assembler.asr_r(dest, shift_amount));
+        ARMWord w = ARMAssembler::getOp2(0x1f);
+        ASSERT(w != ARMAssembler::INVALID_IMM);
+        m_assembler.and_r(ARMRegisters::S0, shift_amount, w);
+
+        m_assembler.movs_r(dest, m_assembler.asr_r(dest, ARMRegisters::S0));
     }
 
     void rshift32(Imm32 imm, RegisterID dest)
@@ -189,6 +212,11 @@ public:
         m_assembler.eors_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
+    void load8(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.dataTransfer32(true, dest, address.base, address.offset, true);
+    }
+
     void load32(ImplicitAddress address, RegisterID dest)
     {
         m_assembler.dataTransfer32(true, dest, address.base, address.offset);
@@ -199,7 +227,7 @@ public:
         m_assembler.baseIndexTransfer32(true, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
     }
 
-#if defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_REQUIRE_NATURAL_ALIGNMENT
+#if CPU(ARMV5_OR_LOWER)
     void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest);
 #else
     void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
@@ -334,6 +362,12 @@ public:
             move(src, dest);
     }
 
+    Jump branch8(Condition cond, Address left, Imm32 right)
+    {
+        load8(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
+    }
+
     Jump branch32(Condition cond, RegisterID left, RegisterID right, int useConstantPool = 0)
     {
         m_assembler.cmp_r(left, right);
@@ -397,6 +431,12 @@ public:
         return m_assembler.jmp(ARMCondition(cond));
     }
 
+    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        load8(address, ARMRegisters::S1);
+        return branchTest32(cond, ARMRegisters::S1, mask);
+    }
+
     Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
     {
         ASSERT((cond == Zero) || (cond == NonZero));
@@ -505,6 +545,20 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
+    Jump branchNeg32(Condition cond, RegisterID srcDest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        neg32(srcDest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchOr32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
+        or32(src, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
     void breakpoint()
     {
         m_assembler.bkpt(0);
@@ -548,6 +602,25 @@ public:
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
+    void set8(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        set32(cond, left, right, dest);
+    }
+
+    void set8(Condition cond, Address left, RegisterID right, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        load32(left, ARMRegisters::S1);
+        set32(cond, ARMRegisters::S1, right, dest);
+    }
+
+    void set8(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        set32(cond, left, right, dest);
+    }
+
     void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
     {
         load32(address, ARMRegisters::S1);
@@ -559,6 +632,12 @@ public:
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
+    void setTest8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        setTest32(cond, address, mask, dest);
+    }
+
     void add32(Imm32 imm, RegisterID src, RegisterID dest)
     {
         m_assembler.add_r(dest, src, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
@@ -666,6 +745,12 @@ public:
         m_assembler.doubleTransfer(true, dest, address.base, address.offset);
     }
 
+    void loadDouble(void* address, FPRegisterID dest)
+    {
+        m_assembler.ldr_un_imm(ARMRegisters::S0, (ARMWord)address);
+        m_assembler.fdtr_u(true, dest, ARMRegisters::S0, 0);
+    }
+
     void storeDouble(FPRegisterID src, ImplicitAddress address)
     {
         m_assembler.doubleTransfer(false, src, address.base, address.offset);
@@ -682,6 +767,18 @@ public:
         addDouble(ARMRegisters::SD0, dest);
     }
 
+    void divDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.fdivd_r(dest, dest, src);
+    }
+
+    void divDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT_NOT_REACHED(); // Untested
+        loadDouble(src, ARMRegisters::SD0);
+        divDouble(ARMRegisters::SD0, dest);
+    }
+
     void subDouble(FPRegisterID src, FPRegisterID dest)
     {
         m_assembler.fsubd_r(dest, dest, src);
@@ -710,11 +807,30 @@ public:
         m_assembler.fsitod_r(dest, dest);
     }
 
+    void convertInt32ToDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT_NOT_REACHED(); // Untested
+        // flds does not worth the effort here
+        load32(src, ARMRegisters::S1);
+        convertInt32ToDouble(ARMRegisters::S1, dest);
+    }
+
+    void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
+    {
+        ASSERT_NOT_REACHED(); // Untested
+        // flds does not worth the effort here
+        m_assembler.ldr_un_imm(ARMRegisters::S1, (ARMWord)src.m_ptr);
+        m_assembler.dtr_u(true, ARMRegisters::S1, ARMRegisters::S1, 0);
+        convertInt32ToDouble(ARMRegisters::S1, dest);
+    }
+
     Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
     {
         m_assembler.fcmpd_r(left, right);
         m_assembler.fmstat();
-        return Jump(m_assembler.jmp(static_cast<ARMAssembler::Condition>(cond)));
+        if (cond & DoubleConditionBitSpecial)
+            m_assembler.cmp_r(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::VS);
+        return Jump(m_assembler.jmp(static_cast<ARMAssembler::Condition>(cond & ~DoubleConditionMask)));
     }
 
     // Truncates 'src' to an integer, and places the resulting 'dest'.
@@ -729,6 +845,29 @@ public:
         return jump();
     }
 
+    // Convert 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, 0).
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp)
+    {
+        m_assembler.ftosid_r(ARMRegisters::SD0, src);
+        m_assembler.fmrs_r(dest, ARMRegisters::SD0);
+
+        // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
+        m_assembler.fsitod_r(ARMRegisters::SD0, ARMRegisters::SD0);
+        failureCases.append(branchDouble(DoubleNotEqualOrUnordered, src, ARMRegisters::SD0));
+
+        // If the result is zero, it might have been -0.0, and 0.0 equals to -0.0
+        failureCases.append(branchTest32(Zero, dest));
+    }
+
+    void zeroDouble(FPRegisterID srcDest)
+    {
+        m_assembler.mov_r(ARMRegisters::S0, ARMAssembler::getOp2(0));
+        convertInt32ToDouble(ARMRegisters::S0, srcDest);
+    }
+
 protected:
     ARMAssembler::Condition ARMCondition(Condition cond)
     {
@@ -811,6 +950,6 @@ private:
 
 }
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #endif // MacroAssemblerARM_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index c4795172d2..3d08f0e73a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 University of Szeged
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,8 +27,6 @@
 #ifndef MacroAssemblerARMv7_h
 #define MacroAssemblerARMv7_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include "ARMv7Assembler.h"
@@ -93,13 +92,21 @@ public:
         Zero = ARMv7Assembler::ConditionEQ,
         NonZero = ARMv7Assembler::ConditionNE
     };
-
     enum DoubleCondition {
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
         DoubleEqual = ARMv7Assembler::ConditionEQ,
+        DoubleNotEqual = ARMv7Assembler::ConditionVC, // Not the right flag! check for this & handle differently.
         DoubleGreaterThan = ARMv7Assembler::ConditionGT,
         DoubleGreaterThanOrEqual = ARMv7Assembler::ConditionGE,
         DoubleLessThan = ARMv7Assembler::ConditionLO,
         DoubleLessThanOrEqual = ARMv7Assembler::ConditionLS,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = ARMv7Assembler::ConditionVS, // Not the right flag! check for this & handle differently.
+        DoubleNotEqualOrUnordered = ARMv7Assembler::ConditionNE,
+        DoubleGreaterThanOrUnordered = ARMv7Assembler::ConditionHI,
+        DoubleGreaterThanOrEqualOrUnordered = ARMv7Assembler::ConditionHS,
+        DoubleLessThanOrUnordered = ARMv7Assembler::ConditionLT,
+        DoubleLessThanOrEqualOrUnordered = ARMv7Assembler::ConditionLE,
     };
 
     static const RegisterID stackPointerRegister = ARMRegisters::sp;
@@ -189,14 +196,19 @@ public:
         }
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void lshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.lsl(dest, dest, imm.m_value);
+        // Clamp the shift to the range 0..31
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(0x1f);
+        ASSERT(armImm.isValid());
+        m_assembler.ARM_and(dataTempRegister, shift_amount, armImm);
+
+        m_assembler.lsl(dest, dest, dataTempRegister);
     }
 
-    void lshift32(RegisterID shift_amount, RegisterID dest)
+    void lshift32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.lsl(dest, dest, shift_amount);
+        m_assembler.lsl(dest, dest, imm.m_value & 0x1f);
     }
 
     void mul32(RegisterID src, RegisterID dest)
@@ -233,12 +245,17 @@ public:
 
     void rshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.asr(dest, dest, shift_amount);
+        // Clamp the shift to the range 0..31
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(0x1f);
+        ASSERT(armImm.isValid());
+        m_assembler.ARM_and(dataTempRegister, shift_amount, armImm);
+
+        m_assembler.asr(dest, dest, dataTempRegister);
     }
 
     void rshift32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.asr(dest, dest, imm.m_value);
+        m_assembler.asr(dest, dest, imm.m_value & 0x1f);
     }
 
     void sub32(RegisterID src, RegisterID dest)
@@ -350,6 +367,20 @@ private:
         }
     }
 
+    void load8(ArmAddress address, RegisterID dest)
+    {
+        if (address.type == ArmAddress::HasIndex)
+            m_assembler.ldrb(dest, address.base, address.u.index, address.u.scale);
+        else if (address.u.offset >= 0) {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.u.offset);
+            ASSERT(armImm.isValid());
+            m_assembler.ldrb(dest, address.base, armImm);
+        } else {
+            ASSERT(address.u.offset >= -255);
+            m_assembler.ldrb(dest, address.base, address.u.offset, true, false);
+        }
+    }
+
     void store32(RegisterID src, ArmAddress address)
     {
         if (address.type == ArmAddress::HasIndex)
@@ -386,6 +417,11 @@ public:
         m_assembler.ldr(dest, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
     }
 
+    void load8(ImplicitAddress address, RegisterID dest)
+    {
+        load8(setupArmAddress(address), dest);
+    }
+
     DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
     {
         DataLabel32 label = moveWithPatch(Imm32(address.offset), dataTempRegister);
@@ -531,6 +567,23 @@ public:
     {
         m_assembler.vcmp_F64(left, right);
         m_assembler.vmrs_APSR_nzcv_FPSCR();
+
+        if (cond == DoubleNotEqual) {
+            // ConditionNE jumps if NotEqual *or* unordered - force the unordered cases not to jump.
+            Jump unordered = makeBranch(ARMv7Assembler::ConditionVS);
+            Jump result = makeBranch(ARMv7Assembler::ConditionNE);
+            unordered.link(this);
+            return result;
+        }
+        if (cond == DoubleEqualOrUnordered) {
+            Jump unordered = makeBranch(ARMv7Assembler::ConditionVS);
+            Jump notEqual = makeBranch(ARMv7Assembler::ConditionNE);
+            unordered.link(this);
+            // We get here if either unordered, or equal.
+            Jump result = makeJump();
+            notEqual.link(this);
+            return result;
+        }
         return makeBranch(cond);
     }
 
@@ -758,6 +811,19 @@ public:
         return branch32(cond, addressTempRegister, Imm32(right.m_value << 16));
     }
 
+    Jump branch8(Condition cond, RegisterID left, Imm32 right)
+    {
+        compare32(left, right);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch8(Condition cond, Address left, Imm32 right)
+    {
+        // use addressTempRegister incase the branch8 we call uses dataTempRegister. :-/
+        load8(left, addressTempRegister);
+        return branch8(cond, addressTempRegister, right);
+    }
+
     Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
     {
         ASSERT((cond == Zero) || (cond == NonZero));
@@ -788,6 +854,21 @@ public:
         return branchTest32(cond, addressTempRegister, mask);
     }
 
+    Jump branchTest8(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        test32(reg, mask);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        // use addressTempRegister incase the branchTest8 we call uses dataTempRegister. :-/
+        load8(address, addressTempRegister);
+        return branchTest8(cond, addressTempRegister, mask);
+    }
+
     Jump jump()
     {
         return Jump(makeJump());
@@ -938,6 +1019,14 @@ public:
         m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
     }
 
+    void setTest8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        load8(address, dataTempRegister);
+        test32(dataTempRegister, mask);
+        m_assembler.it(armV7Condition(cond), false);
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(1));
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
+    }
 
     DataLabel32 moveWithPatch(Imm32 imm, RegisterID dst)
     {
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
index 3681af8a8c..543b0fa241 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -26,8 +26,6 @@
 #ifndef MacroAssemblerCodeRef_h
 #define MacroAssemblerCodeRef_h
 
-#include <wtf/Platform.h>
-
 #include "ExecutableAllocator.h"
 #include "PassRefPtr.h"
 #include "RefPtr.h"
@@ -37,7 +35,7 @@
 
 // ASSERT_VALID_CODE_POINTER checks that ptr is a non-null pointer, and that it is a valid
 // instruction address on the platform (for example, check any alignment requirements).
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
 // ARM/thumb instructions must be 16-bit aligned, but all code pointers to be loaded
 // into the processor are decorated with the bottom bit set, indicating that this is
 // thumb code (as oposed to 32-bit traditional ARM).  The first test checks for both
@@ -130,7 +128,7 @@ public:
     }
 
     explicit MacroAssemblerCodePtr(void* value)
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
         // Decorate the pointer as a thumb code pointer.
         : m_value(reinterpret_cast<char*>(value) + 1)
 #else
@@ -147,7 +145,7 @@ public:
     }
 
     void* executableAddress() const { return m_value; }
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
     // To use this pointer as a data address remove the decoration.
     void* dataLocation() const { ASSERT_VALID_CODE_POINTER(m_value); return reinterpret_cast<char*>(m_value) - 1; }
 #else
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerMIPS.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerMIPS.h
new file mode 100644
index 0000000000..27e30fc394
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerMIPS.h
@@ -0,0 +1,1658 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 MIPS Technologies, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY MIPS TECHNOLOGIES, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL MIPS TECHNOLOGIES, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MacroAssemblerMIPS_h
+#define MacroAssemblerMIPS_h
+
+#if ENABLE(ASSEMBLER) && CPU(MIPS)
+
+#include "AbstractMacroAssembler.h"
+#include "MIPSAssembler.h"
+
+namespace JSC {
+
+class MacroAssemblerMIPS : public AbstractMacroAssembler<MIPSAssembler> {
+public:
+
+    MacroAssemblerMIPS()
+        : m_fixedWidth(false)
+    {
+    }
+
+    static const Scale ScalePtr = TimesFour;
+
+    // For storing immediate number
+    static const RegisterID immTempRegister = MIPSRegisters::t0;
+    // For storing data loaded from the memory
+    static const RegisterID dataTempRegister = MIPSRegisters::t1;
+    // For storing address base
+    static const RegisterID addrTempRegister = MIPSRegisters::t2;
+    // For storing compare result
+    static const RegisterID cmpTempRegister = MIPSRegisters::t3;
+
+    // FP temp register
+    static const FPRegisterID fpTempRegister = MIPSRegisters::f16;
+
+    enum Condition {
+        Equal,
+        NotEqual,
+        Above,
+        AboveOrEqual,
+        Below,
+        BelowOrEqual,
+        GreaterThan,
+        GreaterThanOrEqual,
+        LessThan,
+        LessThanOrEqual,
+        Overflow,
+        Signed,
+        Zero,
+        NonZero
+    };
+
+    enum DoubleCondition {
+        DoubleEqual,
+        DoubleNotEqual,
+        DoubleGreaterThan,
+        DoubleGreaterThanOrEqual,
+        DoubleLessThan,
+        DoubleLessThanOrEqual,
+        DoubleEqualOrUnordered,
+        DoubleNotEqualOrUnordered,
+        DoubleGreaterThanOrUnordered,
+        DoubleGreaterThanOrEqualOrUnordered,
+        DoubleLessThanOrUnordered,
+        DoubleLessThanOrEqualOrUnordered
+    };
+
+    static const RegisterID stackPointerRegister = MIPSRegisters::sp;
+    static const RegisterID returnAddressRegister = MIPSRegisters::ra;
+
+    // Integer arithmetic operations:
+    //
+    // Operations are typically two operand - operation(source, srcDst)
+    // For many operations the source may be an Imm32, the srcDst operand
+    // may often be a memory location (explictly described using an Address
+    // object).
+
+    void add32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.addu(dest, dest, src);
+    }
+
+    void add32(Imm32 imm, RegisterID dest)
+    {
+        add32(imm, dest, dest);
+    }
+
+    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (!imm.m_isPointer && imm.m_value >= -32768 && imm.m_value <= 32767
+            && !m_fixedWidth) {
+            /*
+              addiu     dest, src, imm
+            */
+            m_assembler.addiu(dest, src, imm.m_value);
+        } else {
+            /*
+              li        immTemp, imm
+              addu      dest, src, immTemp
+            */
+            move(imm, immTempRegister);
+            m_assembler.addu(dest, src, immTempRegister);
+        }
+    }
+
+    void add32(Imm32 imm, Address address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+              lw        dataTemp, offset(base)
+              li        immTemp, imm
+              addu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, offset(base)
+            */
+            m_assembler.lw(dataTempRegister, address.base, address.offset);
+            if (!imm.m_isPointer
+                && imm.m_value >= -32768 && imm.m_value <= 32767
+                && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister,
+                                  imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.addu(dataTempRegister, dataTempRegister,
+                                 immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, address.base, address.offset);
+        } else {
+            /*
+              lui       addrTemp, (offset + 0x8000) >> 16
+              addu      addrTemp, addrTemp, base
+              lw        dataTemp, (offset & 0xffff)(addrTemp)
+              li        immtemp, imm
+              addu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, (offset & 0xffff)(addrTemp)
+            */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dataTempRegister, addrTempRegister, address.offset);
+
+            if (imm.m_value >= -32768 && imm.m_value <= 32767 && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister,
+                                  imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.addu(dataTempRegister, dataTempRegister,
+                                 immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, addrTempRegister, address.offset);
+        }
+    }
+
+    void add32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        add32(dataTempRegister, dest);
+    }
+
+    void add32(RegisterID src, Address dest)
+    {
+        if (dest.offset >= -32768 && dest.offset <= 32767 && !m_fixedWidth) {
+            /*
+              lw        dataTemp, offset(base)
+              addu      dataTemp, dataTemp, src
+              sw        dataTemp, offset(base)
+            */
+            m_assembler.lw(dataTempRegister, dest.base, dest.offset);
+            m_assembler.addu(dataTempRegister, dataTempRegister, src);
+            m_assembler.sw(dataTempRegister, dest.base, dest.offset);
+        } else {
+            /*
+              lui       addrTemp, (offset + 0x8000) >> 16
+              addu      addrTemp, addrTemp, base
+              lw        dataTemp, (offset & 0xffff)(addrTemp)
+              addu      dataTemp, dataTemp, src
+              sw        dataTemp, (offset & 0xffff)(addrTemp)
+            */
+            m_assembler.lui(addrTempRegister, (dest.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, dest.base);
+            m_assembler.lw(dataTempRegister, addrTempRegister, dest.offset);
+            m_assembler.addu(dataTempRegister, dataTempRegister, src);
+            m_assembler.sw(dataTempRegister, addrTempRegister, dest.offset);
+        }
+    }
+
+    void add32(Imm32 imm, AbsoluteAddress address)
+    {
+        /*
+           li   addrTemp, address
+           li   immTemp, imm
+           lw   dataTemp, 0(addrTemp)
+           addu dataTemp, dataTemp, immTemp
+           sw   dataTemp, 0(addrTemp)
+        */
+        move(ImmPtr(address.m_ptr), addrTempRegister);
+        m_assembler.lw(dataTempRegister, addrTempRegister, 0);
+        if (!imm.m_isPointer && imm.m_value >= -32768 && imm.m_value <= 32767
+            && !m_fixedWidth)
+            m_assembler.addiu(dataTempRegister, dataTempRegister, imm.m_value);
+        else {
+            move(imm, immTempRegister);
+            m_assembler.addu(dataTempRegister, dataTempRegister, immTempRegister);
+        }
+        m_assembler.sw(dataTempRegister, addrTempRegister, 0);
+    }
+
+    void and32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.andInsn(dest, dest, src);
+    }
+
+    void and32(Imm32 imm, RegisterID dest)
+    {
+        if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
+            move(MIPSRegisters::zero, dest);
+        else if (!imm.m_isPointer && imm.m_value > 0 && imm.m_value < 65535
+                 && !m_fixedWidth)
+            m_assembler.andi(dest, dest, imm.m_value);
+        else {
+            /*
+              li        immTemp, imm
+              and       dest, dest, immTemp
+            */
+            move(imm, immTempRegister);
+            m_assembler.andInsn(dest, dest, immTempRegister);
+        }
+    }
+
+    void lshift32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.sll(dest, dest, imm.m_value);
+    }
+
+    void lshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.sllv(dest, dest, shiftAmount);
+    }
+
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.mul(dest, dest, src);
+    }
+
+    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
+            move(MIPSRegisters::zero, dest);
+        else if (!imm.m_isPointer && imm.m_value == 1 && !m_fixedWidth)
+            move(src, dest);
+        else {
+            /*
+                li      dataTemp, imm
+                mul     dest, src, dataTemp
+            */
+            move(imm, dataTempRegister);
+            m_assembler.mul(dest, src, dataTempRegister);
+        }
+    }
+
+    void not32(RegisterID srcDest)
+    {
+        m_assembler.nor(srcDest, srcDest, MIPSRegisters::zero);
+    }
+
+    void or32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orInsn(dest, dest, src);
+    }
+
+    void or32(Imm32 imm, RegisterID dest)
+    {
+        if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
+            return;
+
+        if (!imm.m_isPointer && imm.m_value > 0 && imm.m_value < 65535
+            && !m_fixedWidth) {
+            m_assembler.ori(dest, dest, imm.m_value);
+            return;
+        }
+
+        /*
+            li      dataTemp, imm
+            or      dest, dest, dataTemp
+        */
+        move(imm, dataTempRegister);
+        m_assembler.orInsn(dest, dest, dataTempRegister);
+    }
+
+    void rshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.srav(dest, dest, shiftAmount);
+    }
+
+    void rshift32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.sra(dest, dest, imm.m_value);
+    }
+
+    void sub32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.subu(dest, dest, src);
+    }
+
+    void sub32(Imm32 imm, RegisterID dest)
+    {
+        if (!imm.m_isPointer && imm.m_value >= -32767 && imm.m_value <= 32768
+            && !m_fixedWidth) {
+            /*
+              addiu     dest, src, imm
+            */
+            m_assembler.addiu(dest, dest, -imm.m_value);
+        } else {
+            /*
+              li        immTemp, imm
+              subu      dest, src, immTemp
+            */
+            move(imm, immTempRegister);
+            m_assembler.subu(dest, dest, immTempRegister);
+        }
+    }
+
+    void sub32(Imm32 imm, Address address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+              lw        dataTemp, offset(base)
+              li        immTemp, imm
+              subu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, offset(base)
+            */
+            m_assembler.lw(dataTempRegister, address.base, address.offset);
+            if (!imm.m_isPointer
+                && imm.m_value >= -32767 && imm.m_value <= 32768
+                && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister,
+                                  -imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.subu(dataTempRegister, dataTempRegister,
+                                 immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, address.base, address.offset);
+        } else {
+            /*
+              lui       addrTemp, (offset + 0x8000) >> 16
+              addu      addrTemp, addrTemp, base
+              lw        dataTemp, (offset & 0xffff)(addrTemp)
+              li        immtemp, imm
+              subu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, (offset & 0xffff)(addrTemp)
+            */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dataTempRegister, addrTempRegister, address.offset);
+
+            if (!imm.m_isPointer
+                && imm.m_value >= -32767 && imm.m_value <= 32768
+                && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister,
+                                  -imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.subu(dataTempRegister, dataTempRegister,
+                                 immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, addrTempRegister, address.offset);
+        }
+    }
+
+    void sub32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        sub32(dataTempRegister, dest);
+    }
+
+    void sub32(Imm32 imm, AbsoluteAddress address)
+    {
+        /*
+           li   addrTemp, address
+           li   immTemp, imm
+           lw   dataTemp, 0(addrTemp)
+           subu dataTemp, dataTemp, immTemp
+           sw   dataTemp, 0(addrTemp)
+        */
+        move(ImmPtr(address.m_ptr), addrTempRegister);
+        m_assembler.lw(dataTempRegister, addrTempRegister, 0);
+
+        if (!imm.m_isPointer && imm.m_value >= -32767 && imm.m_value <= 32768
+            && !m_fixedWidth) {
+            m_assembler.addiu(dataTempRegister, dataTempRegister,
+                              -imm.m_value);
+        } else {
+            move(imm, immTempRegister);
+            m_assembler.subu(dataTempRegister, dataTempRegister, immTempRegister);
+        }
+        m_assembler.sw(dataTempRegister, addrTempRegister, 0);
+    }
+
+    void xor32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.xorInsn(dest, dest, src);
+    }
+
+    void xor32(Imm32 imm, RegisterID dest)
+    {
+        /*
+            li  immTemp, imm
+            xor dest, dest, immTemp
+        */
+        move(imm, immTempRegister);
+        m_assembler.xorInsn(dest, dest, immTempRegister);
+    }
+
+    // Memory access operations:
+    //
+    // Loads are of the form load(address, destination) and stores of the form
+    // store(source, address).  The source for a store may be an Imm32.  Address
+    // operand objects to loads and store will be implicitly constructed if a
+    // register is passed.
+
+    void load32(ImplicitAddress address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth)
+            m_assembler.lw(dest, address.base, address.offset);
+        else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                lw      dest, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    void load32(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lw      dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dest, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                lw      dest, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister,
+                             immTempRegister);
+            m_assembler.lw(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32764
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                (Big-Endian)
+                lwl     dest, address.offset(addrTemp)
+                lwr     dest, address.offset+3(addrTemp)
+                (Little-Endian)
+                lwl     dest, address.offset+3(addrTemp)
+                lwr     dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+#if CPU(BIG_ENDIAN)
+            m_assembler.lwl(dest, addrTempRegister, address.offset);
+            m_assembler.lwr(dest, addrTempRegister, address.offset + 3);
+#else
+            m_assembler.lwl(dest, addrTempRegister, address.offset + 3);
+            m_assembler.lwr(dest, addrTempRegister, address.offset);
+
+#endif
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, address.offset >> 16
+                ori     immTemp, immTemp, address.offset & 0xffff
+                addu    addrTemp, addrTemp, immTemp
+                (Big-Endian)
+                lw      dest, 0(at)
+                lw      dest, 3(at)
+                (Little-Endian)
+                lw      dest, 3(at)
+                lw      dest, 0(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, address.offset >> 16);
+            m_assembler.ori(immTempRegister, immTempRegister, address.offset);
+            m_assembler.addu(addrTempRegister, addrTempRegister,
+                             immTempRegister);
+#if CPU(BIG_ENDIAN)
+            m_assembler.lwl(dest, addrTempRegister, 0);
+            m_assembler.lwr(dest, addrTempRegister, 3);
+#else
+            m_assembler.lwl(dest, addrTempRegister, 3);
+            m_assembler.lwr(dest, addrTempRegister, 0);
+#endif
+        }
+    }
+
+    void load32(void* address, RegisterID dest)
+    {
+        /*
+            li  addrTemp, address
+            lw  dest, 0(addrTemp)
+        */
+        move(ImmPtr(address), addrTempRegister);
+        m_assembler.lw(dest, addrTempRegister, 0);
+    }
+
+    DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        m_fixedWidth = true;
+        /*
+            lui addrTemp, address.offset >> 16
+            ori addrTemp, addrTemp, address.offset & 0xffff
+            addu        addrTemp, addrTemp, address.base
+            lw  dest, 0(addrTemp)
+        */
+        DataLabel32 dataLabel(this);
+        move(Imm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.lw(dest, addrTempRegister, 0);
+        m_fixedWidth = false;
+        return dataLabel;
+    }
+
+    Label loadPtrWithPatchToLEA(Address address, RegisterID dest)
+    {
+        m_fixedWidth = true;
+        /*
+            lui         addrTemp, address.offset >> 16
+            ori         addrTemp, addrTemp, address.offset & 0xffff
+            addu        addrTemp, addrTemp, address.base
+            lw          dest, 0(addrTemp)
+        */
+        Label label(this);
+        move(Imm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.lw(dest, addrTempRegister, 0);
+        m_fixedWidth = false;
+        return label;
+    }
+
+    Label loadPtrWithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        return loadPtrWithPatchToLEA(address, dest);
+    }
+
+    /* Need to use zero-extened load half-word for load16.  */
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lhu     dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lhu(dest, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                lhu     dest, (address.offset & 0xffff)(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister,
+                             immTempRegister);
+            m_assembler.lhu(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        m_fixedWidth = true;
+        /*
+            lui addrTemp, address.offset >> 16
+            ori addrTemp, addrTemp, address.offset & 0xffff
+            addu        addrTemp, addrTemp, address.base
+            sw  src, 0(addrTemp)
+        */
+        DataLabel32 dataLabel(this);
+        move(Imm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.sw(src, addrTempRegister, 0);
+        m_fixedWidth = false;
+        return dataLabel;
+    }
+
+    void store32(RegisterID src, ImplicitAddress address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth)
+            m_assembler.sw(src, address.base, address.offset);
+        else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                sw      src, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.sw(src, addrTempRegister, address.offset);
+        }
+    }
+
+    void store32(RegisterID src, BaseIndex address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                sw      src, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.sw(src, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                sw      src, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister,
+                             immTempRegister);
+            m_assembler.sw(src, addrTempRegister, address.offset);
+        }
+    }
+
+    void store32(Imm32 imm, ImplicitAddress address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            if (!imm.m_isPointer && !imm.m_value)
+                m_assembler.sw(MIPSRegisters::zero, address.base,
+                               address.offset);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.sw(immTempRegister, address.base, address.offset);
+            }
+        } else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                sw      immTemp, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
+                m_assembler.sw(MIPSRegisters::zero, addrTempRegister,
+                               address.offset);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.sw(immTempRegister, addrTempRegister,
+                               address.offset);
+            }
+        }
+    }
+
+    void store32(RegisterID src, void* address)
+    {
+        /*
+            li  addrTemp, address
+            sw  src, 0(addrTemp)
+        */
+        move(ImmPtr(address), addrTempRegister);
+        m_assembler.sw(src, addrTempRegister, 0);
+    }
+
+    void store32(Imm32 imm, void* address)
+    {
+        /*
+            li  immTemp, imm
+            li  addrTemp, address
+            sw  src, 0(addrTemp)
+        */
+        if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth) {
+            move(ImmPtr(address), addrTempRegister);
+            m_assembler.sw(MIPSRegisters::zero, addrTempRegister, 0);
+        } else {
+            move(imm, immTempRegister);
+            move(ImmPtr(address), addrTempRegister);
+            m_assembler.sw(immTempRegister, addrTempRegister, 0);
+        }
+    }
+
+    // Floating-point operations:
+
+    bool supportsFloatingPoint() const
+    {
+#if WTF_MIPS_DOUBLE_FLOAT
+        return true;
+#else
+        return false;
+#endif
+    }
+
+    bool supportsFloatingPointTruncate() const
+    {
+#if WTF_MIPS_DOUBLE_FLOAT && WTF_MIPS_ISA_AT_LEAST(2)
+        return true;
+#else
+        return false;
+#endif
+    }
+
+    // Stack manipulation operations:
+    //
+    // The ABI is assumed to provide a stack abstraction to memory,
+    // containing machine word sized units of data.  Push and pop
+    // operations add and remove a single register sized unit of data
+    // to or from the stack.  Peek and poke operations read or write
+    // values on the stack, without moving the current stack position.
+
+    void pop(RegisterID dest)
+    {
+        m_assembler.lw(dest, MIPSRegisters::sp, 0);
+        m_assembler.addiu(MIPSRegisters::sp, MIPSRegisters::sp, 4);
+    }
+
+    void push(RegisterID src)
+    {
+        m_assembler.addiu(MIPSRegisters::sp, MIPSRegisters::sp, -4);
+        m_assembler.sw(src, MIPSRegisters::sp, 0);
+    }
+
+    void push(Address address)
+    {
+        load32(address, dataTempRegister);
+        push(dataTempRegister);
+    }
+
+    void push(Imm32 imm)
+    {
+        move(imm, immTempRegister);
+        push(immTempRegister);
+    }
+
+    // Register move operations:
+    //
+    // Move values in registers.
+
+    void move(Imm32 imm, RegisterID dest)
+    {
+        if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
+            move(MIPSRegisters::zero, dest);
+        else if (imm.m_isPointer || m_fixedWidth) {
+            m_assembler.lui(dest, imm.m_value >> 16);
+            m_assembler.ori(dest, dest, imm.m_value);
+        } else
+            m_assembler.li(dest, imm.m_value);
+    }
+
+    void move(RegisterID src, RegisterID dest)
+    {
+        if (src != dest || m_fixedWidth)
+            m_assembler.move(dest, src);
+    }
+
+    void move(ImmPtr imm, RegisterID dest)
+    {
+        move(Imm32(imm), dest);
+    }
+
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        move(reg1, immTempRegister);
+        move(reg2, reg1);
+        move(immTempRegister, reg2);
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest || m_fixedWidth)
+            move(src, dest);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest || m_fixedWidth)
+            move(src, dest);
+    }
+
+    // Forwards / external control flow operations:
+    //
+    // This set of jump and conditional branch operations return a Jump
+    // object which may linked at a later point, allow forwards jump,
+    // or jumps that will require external linkage (after the code has been
+    // relocated).
+    //
+    // For branches, signed <, >, <= and >= are denoted as l, g, le, and ge
+    // respecitvely, for unsigned comparisons the names b, a, be, and ae are
+    // used (representing the names 'below' and 'above').
+    //
+    // Operands to the comparision are provided in the expected order, e.g.
+    // jle32(reg1, Imm32(5)) will branch if the value held in reg1, when
+    // treated as a signed 32bit value, is less than or equal to 5.
+    //
+    // jz and jnz test whether the first operand is equal to zero, and take
+    // an optional second operand of a mask under which to perform the test.
+
+    Jump branch32(Condition cond, RegisterID left, RegisterID right)
+    {
+        if (cond == Equal || cond == Zero)
+            return branchEqual(left, right);
+        if (cond == NotEqual || cond == NonZero)
+            return branchNotEqual(left, right);
+        if (cond == Above) {
+            m_assembler.sltu(cmpTempRegister, right, left);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == AboveOrEqual) {
+            m_assembler.sltu(cmpTempRegister, left, right);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Below) {
+            m_assembler.sltu(cmpTempRegister, left, right);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == BelowOrEqual) {
+            m_assembler.sltu(cmpTempRegister, right, left);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == GreaterThan) {
+            m_assembler.slt(cmpTempRegister, right, left);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == GreaterThanOrEqual) {
+            m_assembler.slt(cmpTempRegister, left, right);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == LessThan) {
+            m_assembler.slt(cmpTempRegister, left, right);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == LessThanOrEqual) {
+            m_assembler.slt(cmpTempRegister, right, left);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Overflow) {
+            /*
+                xor     cmpTemp, left, right
+                bgez    No_overflow, cmpTemp    # same sign bit -> no overflow
+                nop
+                subu    cmpTemp, left, right
+                xor     cmpTemp, cmpTemp, left
+                bgez    No_overflow, cmpTemp    # same sign bit -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+              No_overflow:
+            */
+            m_assembler.xorInsn(cmpTempRegister, left, right);
+            m_assembler.bgez(cmpTempRegister, 11);
+            m_assembler.nop();
+            m_assembler.subu(cmpTempRegister, left, right);
+            m_assembler.xorInsn(cmpTempRegister, cmpTempRegister, left);
+            m_assembler.bgez(cmpTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            m_assembler.subu(cmpTempRegister, left, right);
+            // Check if the result is negative.
+            m_assembler.slt(cmpTempRegister, cmpTempRegister,
+                            MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+
+        return Jump();
+    }
+
+    Jump branch32(Condition cond, RegisterID left, Imm32 right)
+    {
+        move(right, immTempRegister);
+        return branch32(cond, left, immTempRegister);
+    }
+
+    Jump branch32(Condition cond, RegisterID left, Address right)
+    {
+        load32(right, dataTempRegister);
+        return branch32(cond, left, dataTempRegister);
+    }
+
+    Jump branch32(Condition cond, Address left, RegisterID right)
+    {
+        load32(left, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch32(Condition cond, Address left, Imm32 right)
+    {
+        load32(left, dataTempRegister);
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    {
+        load32(left, dataTempRegister);
+        // Be careful that the previous load32() uses immTempRegister.
+        // So, we need to put move() after load32().
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    {
+        load32WithUnalignedHalfWords(left, dataTempRegister);
+        // Be careful that the previous load32WithUnalignedHalfWords()
+        // uses immTempRegister.
+        // So, we need to put move() after load32WithUnalignedHalfWords().
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, RegisterID right)
+    {
+        load32(left.m_ptr, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
+    {
+        load32(left.m_ptr, dataTempRegister);
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, RegisterID right)
+    {
+        load16(left, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    {
+        ASSERT(!(right.m_value & 0xFFFF0000));
+        load16(left, dataTempRegister);
+        // Be careful that the previous load16() uses immTempRegister.
+        // So, we need to put move() after load16().
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        m_assembler.andInsn(cmpTempRegister, reg, mask);
+        if (cond == Zero)
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        if (mask.m_value == -1 && !m_fixedWidth) {
+            if (cond == Zero)
+                return branchEqual(reg, MIPSRegisters::zero);
+            return branchNotEqual(reg, MIPSRegisters::zero);
+        }
+        move(mask, immTempRegister);
+        return branchTest32(cond, reg, immTempRegister);
+    }
+
+    Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        load32(address, dataTempRegister);
+        return branchTest32(cond, dataTempRegister, mask);
+    }
+
+    Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    {
+        load32(address, dataTempRegister);
+        return branchTest32(cond, dataTempRegister, mask);
+    }
+
+    Jump jump()
+    {
+        return branchEqual(MIPSRegisters::zero, MIPSRegisters::zero);
+    }
+
+    void jump(RegisterID target)
+    {
+        m_assembler.jr(target);
+        m_assembler.nop();
+    }
+
+    void jump(Address address)
+    {
+        m_fixedWidth = true;
+        load32(address, MIPSRegisters::t9);
+        m_assembler.jr(MIPSRegisters::t9);
+        m_assembler.nop();
+        m_fixedWidth = false;
+    }
+
+    // Arithmetic control flow operations:
+    //
+    // This set of conditional branch operations branch based
+    // on the result of an arithmetic operation.  The operation
+    // is performed as normal, storing the result.
+    //
+    // * jz operations branch if the result is zero.
+    // * jo operations branch if the (signed) arithmetic
+    //   operation caused an overflow to occur.
+
+    Jump branchAdd32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                move    dest, dataTemp
+                xor     cmpTemp, dataTemp, src
+                bltz    cmpTemp, No_overflow    # diff sign bit -> no overflow
+                addu    dest, dataTemp, src
+                xor     cmpTemp, dest, dataTemp
+                bgez    cmpTemp, No_overflow    # same sign big -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            move(dest, dataTempRegister);
+            m_assembler.xorInsn(cmpTempRegister, dataTempRegister, src);
+            m_assembler.bltz(cmpTempRegister, 10);
+            m_assembler.addu(dest, dataTempRegister, src);
+            m_assembler.xorInsn(cmpTempRegister, dest, dataTempRegister);
+            m_assembler.bgez(cmpTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            add32(src, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            add32(src, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            add32(src, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        return branchAdd32(cond, immTempRegister, dest);
+    }
+
+    Jump branchMul32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                mult    src, dest
+                mfhi    dataTemp
+                mflo    dest
+                sra     addrTemp, dest, 31
+                beq     dataTemp, addrTemp, No_overflow # all sign bits (bit 63 to bit 31) are the same -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            m_assembler.mult(src, dest);
+            m_assembler.mfhi(dataTempRegister);
+            m_assembler.mflo(dest);
+            m_assembler.sra(addrTempRegister, dest, 31);
+            m_assembler.beq(dataTempRegister, addrTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            mul32(src, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            mul32(src, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            mul32(src, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        move(src, dest);
+        return branchMul32(cond, immTempRegister, dest);
+    }
+
+    Jump branchSub32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                move    dest, dataTemp
+                xor     cmpTemp, dataTemp, src
+                bgez    cmpTemp, No_overflow    # same sign bit -> no overflow
+                subu    dest, dataTemp, src
+                xor     cmpTemp, dest, dataTemp
+                bgez    cmpTemp, No_overflow    # same sign bit -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            move(dest, dataTempRegister);
+            m_assembler.xorInsn(cmpTempRegister, dataTempRegister, src);
+            m_assembler.bgez(cmpTempRegister, 10);
+            m_assembler.subu(dest, dataTempRegister, src);
+            m_assembler.xorInsn(cmpTempRegister, dest, dataTempRegister);
+            m_assembler.bgez(cmpTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            sub32(src, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            sub32(src, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            sub32(src, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        return branchSub32(cond, immTempRegister, dest);
+    }
+
+    // Miscellaneous operations:
+
+    void breakpoint()
+    {
+        m_assembler.bkpt();
+    }
+
+    Call nearCall()
+    {
+        /* We need two words for relaxation.  */
+        m_assembler.nop();
+        m_assembler.nop();
+        m_assembler.jal();
+        m_assembler.nop();
+        return Call(m_assembler.newJmpSrc(), Call::LinkableNear);
+    }
+
+    Call call()
+    {
+        m_assembler.lui(MIPSRegisters::t9, 0);
+        m_assembler.ori(MIPSRegisters::t9, MIPSRegisters::t9, 0);
+        m_assembler.jalr(MIPSRegisters::t9);
+        m_assembler.nop();
+        return Call(m_assembler.newJmpSrc(), Call::Linkable);
+    }
+
+    Call call(RegisterID target)
+    {
+        m_assembler.jalr(target);
+        m_assembler.nop();
+        return Call(m_assembler.newJmpSrc(), Call::None);
+    }
+
+    Call call(Address address)
+    {
+        m_fixedWidth = true;
+        load32(address, MIPSRegisters::t9);
+        m_assembler.jalr(MIPSRegisters::t9);
+        m_assembler.nop();
+        m_fixedWidth = false;
+        return Call(m_assembler.newJmpSrc(), Call::None);
+    }
+
+    void ret()
+    {
+        m_assembler.jr(MIPSRegisters::ra);
+        m_assembler.nop();
+    }
+
+    void set32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        if (cond == Equal || cond == Zero) {
+            m_assembler.xorInsn(dest, left, right);
+            m_assembler.sltiu(dest, dest, 1);
+        } else if (cond == NotEqual || cond == NonZero) {
+            m_assembler.xorInsn(dest, left, right);
+            m_assembler.sltu(dest, MIPSRegisters::zero, dest);
+        } else if (cond == Above)
+            m_assembler.sltu(dest, right, left);
+        else if (cond == AboveOrEqual) {
+            m_assembler.sltu(dest, left, right);
+            m_assembler.xori(dest, dest, 1);
+        } else if (cond == Below)
+            m_assembler.sltu(dest, left, right);
+        else if (cond == BelowOrEqual) {
+            m_assembler.sltu(dest, right, left);
+            m_assembler.xori(dest, dest, 1);
+        } else if (cond == GreaterThan)
+            m_assembler.slt(dest, right, left);
+        else if (cond == GreaterThanOrEqual) {
+            m_assembler.slt(dest, left, right);
+            m_assembler.xori(dest, dest, 1);
+        } else if (cond == LessThan)
+            m_assembler.slt(dest, left, right);
+        else if (cond == LessThanOrEqual) {
+            m_assembler.slt(dest, right, left);
+            m_assembler.xori(dest, dest, 1);
+        } else if (cond == Overflow) {
+            /*
+                xor     cmpTemp, left, right
+                bgez    Done, cmpTemp   # same sign bit -> no overflow
+                move    dest, 0
+                subu    cmpTemp, left, right
+                xor     cmpTemp, cmpTemp, left # diff sign bit -> overflow
+                slt     dest, cmpTemp, 0
+              Done:
+            */
+            m_assembler.xorInsn(cmpTempRegister, left, right);
+            m_assembler.bgez(cmpTempRegister, 4);
+            m_assembler.move(dest, MIPSRegisters::zero);
+            m_assembler.subu(cmpTempRegister, left, right);
+            m_assembler.xorInsn(cmpTempRegister, cmpTempRegister, left);
+            m_assembler.slt(dest, cmpTempRegister, MIPSRegisters::zero);
+        } else if (cond == Signed) {
+            m_assembler.subu(dest, left, right);
+            // Check if the result is negative.
+            m_assembler.slt(dest, dest, MIPSRegisters::zero);
+        }
+    }
+
+    void set32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        move(right, immTempRegister);
+        set32(cond, left, immTempRegister, dest);
+    }
+
+    void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        load32(address, dataTempRegister);
+        if (mask.m_value == -1 && !m_fixedWidth) {
+            if (cond == Zero)
+                m_assembler.sltiu(dest, dataTempRegister, 1);
+            else
+                m_assembler.sltu(dest, MIPSRegisters::zero, dataTempRegister);
+        } else {
+            move(mask, immTempRegister);
+            m_assembler.andInsn(cmpTempRegister, dataTempRegister,
+                                 immTempRegister);
+            if (cond == Zero)
+                m_assembler.sltiu(dest, cmpTempRegister, 1);
+            else
+                m_assembler.sltu(dest, MIPSRegisters::zero, cmpTempRegister);
+        }
+    }
+
+    DataLabel32 moveWithPatch(Imm32 imm, RegisterID dest)
+    {
+        m_fixedWidth = true;
+        DataLabel32 label(this);
+        move(imm, dest);
+        m_fixedWidth = false;
+        return label;
+    }
+
+    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    {
+        m_fixedWidth = true;
+        DataLabelPtr label(this);
+        move(initialValue, dest);
+        m_fixedWidth = false;
+        return label;
+    }
+
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        m_fixedWidth = true;
+        dataLabel = moveWithPatch(initialRightValue, immTempRegister);
+        Jump temp = branch32(cond, left, immTempRegister);
+        m_fixedWidth = false;
+        return temp;
+    }
+
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        m_fixedWidth = true;
+        load32(left, dataTempRegister);
+        dataLabel = moveWithPatch(initialRightValue, immTempRegister);
+        Jump temp = branch32(cond, dataTempRegister, immTempRegister);
+        m_fixedWidth = false;
+        return temp;
+    }
+
+    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    {
+        m_fixedWidth = true;
+        DataLabelPtr dataLabel = moveWithPatch(initialValue, dataTempRegister);
+        store32(dataTempRegister, address);
+        m_fixedWidth = false;
+        return dataLabel;
+    }
+
+    DataLabelPtr storePtrWithPatch(ImplicitAddress address)
+    {
+        return storePtrWithPatch(ImmPtr(0), address);
+    }
+
+    Call tailRecursiveCall()
+    {
+        // Like a normal call, but don't update the returned address register
+        m_fixedWidth = true;
+        move(Imm32(0), MIPSRegisters::t9);
+        m_assembler.jr(MIPSRegisters::t9);
+        m_assembler.nop();
+        m_fixedWidth = false;
+        return Call(m_assembler.newJmpSrc(), Call::Linkable);
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        oldJump.link(this);
+        return tailRecursiveCall();
+    }
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+#if WTF_MIPS_ISA(1)
+        /*
+            li          addrTemp, address.offset
+            addu        addrTemp, addrTemp, base
+            lwc1        dest, 0(addrTemp)
+            lwc1        dest+1, 4(addrTemp)
+         */
+        move(Imm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.lwc1(dest, addrTempRegister, 0);
+        m_assembler.lwc1(FPRegisterID(dest + 1), addrTempRegister, 4);
+#else
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            m_assembler.ldc1(dest, address.base, address.offset);
+        } else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                ldc1    dest, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.ldc1(dest, addrTempRegister, address.offset);
+        }
+#endif
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+#if WTF_MIPS_ISA(1)
+        /*
+            li          addrTemp, address.offset
+            addu        addrTemp, addrTemp, base
+            swc1        dest, 0(addrTemp)
+            swc1        dest+1, 4(addrTemp)
+         */
+        move(Imm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.swc1(src, addrTempRegister, 0);
+        m_assembler.swc1(FPRegisterID(src + 1), addrTempRegister, 4);
+#else
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth)
+            m_assembler.sdc1(src, address.base, address.offset);
+        else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                sdc1    src, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.sdc1(src, addrTempRegister, address.offset);
+        }
+#endif
+    }
+
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.addd(dest, dest, src);
+    }
+
+    void addDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        m_assembler.addd(dest, dest, fpTempRegister);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.subd(dest, dest, src);
+    }
+
+    void subDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        m_assembler.subd(dest, dest, fpTempRegister);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.muld(dest, dest, src);
+    }
+
+    void mulDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        m_assembler.muld(dest, dest, fpTempRegister);
+    }
+
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.mtc1(src, fpTempRegister);
+        m_assembler.cvtdw(dest, fpTempRegister);
+    }
+
+    void insertRelaxationWords()
+    {
+        /* We need four words for relaxation. */
+        m_assembler.beq(MIPSRegisters::zero, MIPSRegisters::zero, 3); // Jump over nops;
+        m_assembler.nop();
+        m_assembler.nop();
+        m_assembler.nop();
+    }
+
+    Jump branchTrue()
+    {
+        m_assembler.appendJump();
+        m_assembler.bc1t();
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.newJmpSrc());
+    }
+
+    Jump branchFalse()
+    {
+        m_assembler.appendJump();
+        m_assembler.bc1f();
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.newJmpSrc());
+    }
+
+    Jump branchEqual(RegisterID rs, RegisterID rt)
+    {
+        m_assembler.appendJump();
+        m_assembler.beq(rs, rt, 0);
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.newJmpSrc());
+    }
+
+    Jump branchNotEqual(RegisterID rs, RegisterID rt)
+    {
+        m_assembler.appendJump();
+        m_assembler.bne(rs, rt, 0);
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.newJmpSrc());
+    }
+
+    Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        if (cond == DoubleEqual) {
+            m_assembler.ceqd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleNotEqual) {
+            m_assembler.ceqd(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleGreaterThan) {
+            m_assembler.cngtd(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleGreaterThanOrEqual) {
+            m_assembler.cnged(right, left);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleLessThan) {
+            m_assembler.cltd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleLessThanOrEqual) {
+            m_assembler.cled(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleEqualOrUnordered) {
+            m_assembler.cueqd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleGreaterThanOrUnordered) {
+            m_assembler.coled(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleGreaterThanOrEqualOrUnordered) {
+            m_assembler.coltd(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleLessThanOrUnordered) {
+            m_assembler.cultd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleLessThanOrEqualOrUnordered) {
+            m_assembler.culed(left, right);
+            return branchTrue();
+        }
+        ASSERT(0);
+
+        return Jump();
+    }
+
+    // Truncates 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, INT_MAX 0x7fffffff).
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.truncwd(fpTempRegister, src);
+        m_assembler.mfc1(dest, fpTempRegister);
+        return branch32(Equal, dest, Imm32(0x7fffffff));
+    }
+
+private:
+    // If m_fixedWidth is true, we will generate a fixed number of instructions.
+    // Otherwise, we can emit any number of instructions.
+    bool m_fixedWidth;
+
+    friend class LinkBuffer;
+    friend class RepatchBuffer;
+
+    static void linkCall(void* code, Call call, FunctionPtr function)
+    {
+        MIPSAssembler::linkCall(code, call.m_jmp, function.value());
+    }
+
+    static void repatchCall(CodeLocationCall call, CodeLocationLabel destination)
+    {
+        MIPSAssembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+
+    static void repatchCall(CodeLocationCall call, FunctionPtr destination)
+    {
+        MIPSAssembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+
+};
+
+}
+
+#endif // ENABLE(ASSEMBLER) && CPU(MIPS)
+
+#endif // MacroAssemblerMIPS_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
index 6e962406d1..0366541c33 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
@@ -26,9 +26,7 @@
 #ifndef MacroAssemblerX86_h
 #define MacroAssemblerX86_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && PLATFORM(X86)
+#if ENABLE(ASSEMBLER) && CPU(X86)
 
 #include "MacroAssemblerX86Common.h"
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
index 5ebefa7dfb..073f5631bd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -26,8 +26,6 @@
 #ifndef MacroAssemblerX86Common_h
 #define MacroAssemblerX86Common_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include "X86Assembler.h"
@@ -36,6 +34,10 @@
 namespace JSC {
 
 class MacroAssemblerX86Common : public AbstractMacroAssembler<X86Assembler> {
+    static const int DoubleConditionBitInvert = 0x10;
+    static const int DoubleConditionBitSpecial = 0x20;
+    static const int DoubleConditionBits = DoubleConditionBitInvert | DoubleConditionBitSpecial;
+
 public:
 
     enum Condition {
@@ -56,13 +58,24 @@ public:
     };
 
     enum DoubleCondition {
-        DoubleEqual = X86Assembler::ConditionE,
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
+        DoubleEqual = X86Assembler::ConditionE | DoubleConditionBitSpecial,
         DoubleNotEqual = X86Assembler::ConditionNE,
         DoubleGreaterThan = X86Assembler::ConditionA,
         DoubleGreaterThanOrEqual = X86Assembler::ConditionAE,
-        DoubleLessThan = X86Assembler::ConditionB,
-        DoubleLessThanOrEqual = X86Assembler::ConditionBE,
+        DoubleLessThan = X86Assembler::ConditionA | DoubleConditionBitInvert,
+        DoubleLessThanOrEqual = X86Assembler::ConditionAE | DoubleConditionBitInvert,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = X86Assembler::ConditionE,
+        DoubleNotEqualOrUnordered = X86Assembler::ConditionNE | DoubleConditionBitSpecial,
+        DoubleGreaterThanOrUnordered = X86Assembler::ConditionB | DoubleConditionBitInvert,
+        DoubleGreaterThanOrEqualOrUnordered = X86Assembler::ConditionBE | DoubleConditionBitInvert,
+        DoubleLessThanOrUnordered = X86Assembler::ConditionB,
+        DoubleLessThanOrEqualOrUnordered = X86Assembler::ConditionBE,
     };
+    COMPILE_ASSERT(
+        !((X86Assembler::ConditionE | X86Assembler::ConditionNE | X86Assembler::ConditionA | X86Assembler::ConditionAE | X86Assembler::ConditionB | X86Assembler::ConditionBE) & DoubleConditionBits),
+        DoubleConditionBits_should_not_interfere_with_X86Assembler_Condition_codes);
 
     static const RegisterID stackPointerRegister = X86Registers::esp;
 
@@ -416,20 +429,35 @@ public:
 
     void convertInt32ToDouble(Address src, FPRegisterID dest)
     {
+        ASSERT(isSSE2Present());
         m_assembler.cvtsi2sd_mr(src.offset, src.base, dest);
     }
 
     Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
     {
         ASSERT(isSSE2Present());
-        m_assembler.ucomisd_rr(right, left);
-        return Jump(m_assembler.jCC(x86Condition(cond)));
-    }
 
-    Jump branchDouble(DoubleCondition cond, FPRegisterID left, Address right)
-    {
-        m_assembler.ucomisd_mr(right.offset, right.base, left);
-        return Jump(m_assembler.jCC(x86Condition(cond)));
+        if (cond & DoubleConditionBitInvert)
+            m_assembler.ucomisd_rr(left, right);
+        else
+            m_assembler.ucomisd_rr(right, left);
+
+        if (cond == DoubleEqual) {
+            Jump isUnordered(m_assembler.jp());
+            Jump result = Jump(m_assembler.je());
+            isUnordered.link(this);
+            return result;
+        } else if (cond == DoubleNotEqualOrUnordered) {
+            Jump isUnordered(m_assembler.jp());
+            Jump isEqual(m_assembler.je());
+            isUnordered.link(this);
+            Jump result = jump();
+            isEqual.link(this);
+            return result;
+        }
+
+        ASSERT(!(cond & DoubleConditionBitSpecial));
+        return Jump(m_assembler.jCC(static_cast<X86Assembler::Condition>(cond & ~DoubleConditionBits)));
     }
 
     // Truncates 'src' to an integer, and places the resulting 'dest'.
@@ -443,6 +471,25 @@ public:
         return branch32(Equal, dest, Imm32(0x80000000));
     }
 
+    // Convert 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, 0).
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvttsd2si_rr(src, dest);
+
+        // If the result is zero, it might have been -0.0, and the double comparison won't catch this!
+        failureCases.append(branchTest32(Zero, dest));
+
+        // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
+        convertInt32ToDouble(dest, fpTemp);
+        m_assembler.ucomisd_rr(fpTemp, src);
+        failureCases.append(m_assembler.jp());
+        failureCases.append(m_assembler.jne());
+    }
+
     void zeroDouble(FPRegisterID srcDest)
     {
         ASSERT(isSSE2Present());
@@ -493,7 +540,7 @@ public:
             m_assembler.movl_i32r(imm.m_value, dest);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void move(RegisterID src, RegisterID dest)
     {
         // Note: on 64-bit this is is a full register move; perhaps it would be
@@ -509,7 +556,8 @@ public:
 
     void swap(RegisterID reg1, RegisterID reg2)
     {
-        m_assembler.xchgq_rr(reg1, reg2);
+        if (reg1 != reg2)
+            m_assembler.xchgq_rr(reg1, reg2);
     }
 
     void signExtend32ToPtr(RegisterID src, RegisterID dest)
@@ -570,6 +618,12 @@ public:
     // an optional second operand of a mask under which to perform the test.
 
 public:
+    Jump branch8(Condition cond, Address left, Imm32 right)
+    {
+        m_assembler.cmpb_im(right.m_value, left.offset, left.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
     Jump branch32(Condition cond, RegisterID left, RegisterID right)
     {
         m_assembler.cmpl_rr(right, left);
@@ -667,6 +721,16 @@ public:
             m_assembler.testl_i32m(mask.m_value, address.offset, address.base, address.index, address.scale);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
+    
+    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        if (mask.m_value == -1)
+            m_assembler.cmpb_im(0, address.offset, address.base);
+        else
+            m_assembler.testb_im(mask.m_value, address.offset, address.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
 
     Jump jump()
     {
@@ -786,6 +850,13 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
+    Jump branchNeg32(Condition cond, RegisterID srcDest)
+    {
+        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        neg32(srcDest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
     Jump branchOr32(Condition cond, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
@@ -867,10 +938,11 @@ public:
     void setTest8(Condition cond, Address address, Imm32 mask, RegisterID dest)
     {
         if (mask.m_value == -1)
-            m_assembler.cmpl_im(0, address.offset, address.base);
+            m_assembler.cmpb_im(0, address.offset, address.base);
         else
-            m_assembler.testl_i32m(mask.m_value, address.offset, address.base);
+            m_assembler.testb_im(mask.m_value, address.offset, address.base);
         m_assembler.setCC_r(x86Condition(cond), dest);
+        m_assembler.movzbl_rr(dest, dest);
     }
 
     void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
@@ -889,18 +961,13 @@ protected:
         return static_cast<X86Assembler::Condition>(cond);
     }
 
-    X86Assembler::Condition x86Condition(DoubleCondition cond)
-    {
-        return static_cast<X86Assembler::Condition>(cond);
-    }
-
 private:
     // Only MacroAssemblerX86 should be using the following method; SSE2 is always available on
     // x86_64, and clients & subclasses of MacroAssembler should be using 'supportsFloatingPoint()'.
     friend class MacroAssemblerX86;
 
-#if PLATFORM(X86)
-#if PLATFORM(MAC)
+#if CPU(X86)
+#if OS(MAC_OS_X)
 
     // All X86 Macs are guaranteed to support at least SSE2,
     static bool isSSE2Present()
@@ -908,7 +975,7 @@ private:
         return true;
     }
 
-#else // PLATFORM(MAC)
+#else // OS(MAC_OS_X)
 
     enum SSE2CheckState {
         NotCheckedSSE2,
@@ -951,8 +1018,8 @@ private:
     
     static SSE2CheckState s_sse2CheckState;
 
-#endif // PLATFORM(MAC)
-#elif !defined(NDEBUG) // PLATFORM(X86)
+#endif // OS(MAC_OS_X)
+#elif !defined(NDEBUG) // CPU(X86)
 
     // On x86-64 we should never be checking for SSE2 in a non-debug build,
     // but non debug add this method to keep the asserts above happy.
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
index 0f95fe62e5..b36c32310b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
@@ -26,9 +26,7 @@
 #ifndef MacroAssemblerX86_64_h
 #define MacroAssemblerX86_64_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && PLATFORM(X86_64)
+#if ENABLE(ASSEMBLER) && CPU(X86_64)
 
 #include "MacroAssemblerX86Common.h"
 
@@ -192,33 +190,6 @@ public:
         m_assembler.orq_ir(imm.m_value, dest);
     }
 
-    void rshiftPtr(RegisterID shift_amount, RegisterID dest)
-    {
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86Registers::ecx) {
-            swap(shift_amount, X86Registers::ecx);
-
-            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.sarq_CLr(X86Registers::ecx);
-            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86Registers::ecx)
-                m_assembler.sarq_CLr(shift_amount);
-            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.sarq_CLr(dest);
-        
-            swap(shift_amount, X86Registers::ecx);
-        } else
-            m_assembler.sarq_CLr(dest);
-    }
-
-    void rshiftPtr(Imm32 imm, RegisterID dest)
-    {
-        m_assembler.sarq_i8r(imm.m_value, dest);
-    }
-
     void subPtr(RegisterID src, RegisterID dest)
     {
         m_assembler.subq_rr(src, dest);
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/RepatchBuffer.h b/src/3rdparty/webkit/JavaScriptCore/assembler/RepatchBuffer.h
index 89cbf06d1a..72cf6b27f0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/RepatchBuffer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/RepatchBuffer.h
@@ -26,8 +26,6 @@
 #ifndef RepatchBuffer_h
 #define RepatchBuffer_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include <MacroAssembler.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
index cbbaaa5a16..57b811c630 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
@@ -26,9 +26,7 @@
 #ifndef X86Assembler_h
 #define X86Assembler_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && (PLATFORM(X86) || PLATFORM(X86_64))
+#if ENABLE(ASSEMBLER) && (CPU(X86) || CPU(X86_64))
 
 #include "AssemblerBuffer.h"
 #include <stdint.h>
@@ -50,7 +48,7 @@ namespace X86Registers {
         esi,
         edi,
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         r8,
         r9,
         r10,
@@ -118,18 +116,19 @@ private:
         OP_XOR_GvEv                     = 0x33,
         OP_CMP_EvGv                     = 0x39,
         OP_CMP_GvEv                     = 0x3B,
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         PRE_REX                         = 0x40,
 #endif
         OP_PUSH_EAX                     = 0x50,
         OP_POP_EAX                      = 0x58,
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         OP_MOVSXD_GvEv                  = 0x63,
 #endif
         PRE_OPERAND_SIZE                = 0x66,
         PRE_SSE_66                      = 0x66,
         OP_PUSH_Iz                      = 0x68,
         OP_IMUL_GvEvIz                  = 0x69,
+        OP_GROUP1_EbIb                  = 0x80,
         OP_GROUP1_EvIz                  = 0x81,
         OP_GROUP1_EvIb                  = 0x83,
         OP_TEST_EvGv                    = 0x85,
@@ -296,7 +295,7 @@ public:
 
     // Arithmetic operations:
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
     void adcl_im(int imm, void* addr)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -346,7 +345,7 @@ public:
         }
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void addq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_ADD_EvGv, src, dst);
@@ -423,7 +422,7 @@ public:
         }
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void andq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_AND_EvGv, src, dst);
@@ -509,7 +508,7 @@ public:
         }
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void orq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_OR_EvGv, src, dst);
@@ -575,7 +574,7 @@ public:
         }
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void subq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_SUB_EvGv, src, dst);
@@ -641,7 +640,7 @@ public:
         }
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void xorq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_XOR_EvGv, src, dst);
@@ -689,7 +688,7 @@ public:
         m_formatter.oneByteOp(OP_GROUP2_EvCL, GROUP2_OP_SHL, dst);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void sarq_CLr(RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_GROUP2_EvCL, GROUP2_OP_SAR, dst);
@@ -760,7 +759,7 @@ public:
         m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, dst);
         m_formatter.immediate32(imm);
     }
-
+    
     void cmpl_im(int imm, int offset, RegisterID base)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -771,6 +770,12 @@ public:
             m_formatter.immediate32(imm);
         }
     }
+    
+    void cmpb_im(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP1_EbIb, GROUP1_OP_CMP, base, offset);
+        m_formatter.immediate8(imm);
+    }
 
     void cmpl_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
     {
@@ -789,7 +794,7 @@ public:
         m_formatter.immediate32(imm);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void cmpq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_CMP_EvGv, src, dst);
@@ -890,6 +895,12 @@ public:
         m_formatter.oneByteOp(OP_GROUP3_EvIz, GROUP3_OP_TEST, base, offset);
         m_formatter.immediate32(imm);
     }
+    
+    void testb_im(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_EbIb, GROUP3_OP_TEST, base, offset);
+        m_formatter.immediate8(imm);
+    }
 
     void testl_i32m(int imm, int offset, RegisterID base, RegisterID index, int scale)
     {
@@ -897,7 +908,7 @@ public:
         m_formatter.immediate32(imm);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void testq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_TEST_EvGv, src, dst);
@@ -971,7 +982,7 @@ public:
         m_formatter.oneByteOp(OP_XCHG_EvGv, src, dst);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void xchgq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_XCHG_EvGv, src, dst);
@@ -1001,7 +1012,7 @@ public:
     void movl_mEAX(void* addr)
     {
         m_formatter.oneByteOp(OP_MOV_EAXOv);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
 #else
         m_formatter.immediate32(reinterpret_cast<int>(addr));
@@ -1038,14 +1049,14 @@ public:
     void movl_EAXm(void* addr)
     {
         m_formatter.oneByteOp(OP_MOV_OvEAX);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
 #else
         m_formatter.immediate32(reinterpret_cast<int>(addr));
 #endif
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void movq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_MOV_EvGv, src, dst);
@@ -1157,7 +1168,7 @@ public:
     {
         m_formatter.oneByteOp(OP_LEA, dst, base, offset);
     }
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void leaq_mr(int offset, RegisterID base, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_LEA, dst, base, offset);
@@ -1323,7 +1334,7 @@ public:
         m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, base, offset);
     }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
     void cvtsi2sd_mr(void* address, XMMRegisterID dst)
     {
         m_formatter.prefix(PRE_SSE_F2);
@@ -1343,7 +1354,7 @@ public:
         m_formatter.twoByteOp(OP2_MOVD_EdVd, (RegisterID)src, dst);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void movq_rr(XMMRegisterID src, RegisterID dst)
     {
         m_formatter.prefix(PRE_SSE_66);
@@ -1369,7 +1380,7 @@ public:
         m_formatter.twoByteOp(OP2_MOVSD_VsdWsd, (RegisterID)dst, base, offset);
     }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
     void movsd_mr(void* address, XMMRegisterID dst)
     {
         m_formatter.prefix(PRE_SSE_F2);
@@ -1535,7 +1546,7 @@ public:
 
     static void repatchLoadPtrToLEA(void* where)
     {
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         // On x86-64 pointer memory accesses require a 64-bit operand, and as such a REX prefix.
         // Skip over the prefix byte.
         where = reinterpret_cast<char*>(where) + 1;
@@ -1679,7 +1690,7 @@ private:
             memoryModRM(reg, base, index, scale, offset);
         }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
         void oneByteOp(OneByteOpcodeID opcode, int reg, void* address)
         {
             m_buffer.ensureSpace(maxInstructionSize);
@@ -1722,7 +1733,7 @@ private:
             memoryModRM(reg, base, index, scale, offset);
         }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
         void twoByteOp(TwoByteOpcodeID opcode, int reg, void* address)
         {
             m_buffer.ensureSpace(maxInstructionSize);
@@ -1732,7 +1743,7 @@ private:
         }
 #endif
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         // Quad-word-sized operands:
         //
         // Used to format 64-bit operantions, planting a REX.w prefix.
@@ -1891,7 +1902,7 @@ private:
         static const RegisterID noBase = X86Registers::ebp;
         static const RegisterID hasSib = X86Registers::esp;
         static const RegisterID noIndex = X86Registers::esp;
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         static const RegisterID noBase2 = X86Registers::r13;
         static const RegisterID hasSib2 = X86Registers::r12;
 
@@ -1967,7 +1978,7 @@ private:
         void memoryModRM(int reg, RegisterID base, int offset)
         {
             // A base of esp or r12 would be interpreted as a sib, so force a sib with no index & put the base in there.
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
             if ((base == hasSib) || (base == hasSib2)) {
 #else
             if (base == hasSib) {
@@ -1982,7 +1993,7 @@ private:
                     m_buffer.putIntUnchecked(offset);
                 }
             } else {
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
                 if (!offset && (base != noBase) && (base != noBase2))
 #else
                 if (!offset && (base != noBase))
@@ -2001,7 +2012,7 @@ private:
         void memoryModRM_disp32(int reg, RegisterID base, int offset)
         {
             // A base of esp or r12 would be interpreted as a sib, so force a sib with no index & put the base in there.
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
             if ((base == hasSib) || (base == hasSib2)) {
 #else
             if (base == hasSib) {
@@ -2018,7 +2029,7 @@ private:
         {
             ASSERT(index != noIndex);
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
             if (!offset && (base != noBase) && (base != noBase2))
 #else
             if (!offset && (base != noBase))
@@ -2033,7 +2044,7 @@ private:
             }
         }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
         void memoryModRM(int reg, void* address)
         {
             // noBase + ModRmMemoryNoDisp means noBase + ModRmMemoryDisp32!
@@ -2048,6 +2059,6 @@ private:
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(X86)
+#endif // ENABLE(ASSEMBLER) && CPU(X86)
 
 #endif // X86Assembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
index c9159341dc..1f090a4c79 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -49,9 +49,9 @@ namespace JSC {
 static UString escapeQuotes(const UString& str)
 {
     UString result = str;
-    int pos = 0;
-    while ((pos = result.find('\"', pos)) >= 0) {
-        result = result.substr(0, pos) + "\"\\\"\"" + result.substr(pos + 1);
+    unsigned pos = 0;
+    while ((pos = result.find('\"', pos)) != UString::NotFound) {
+        result = makeString(result.substr(0, pos), "\"\\\"\"", result.substr(pos + 1));
         pos += 4;
     }
     return result;
@@ -62,49 +62,50 @@ static UString valueToSourceString(ExecState* exec, JSValue val)
     if (!val)
         return "0";
 
-    if (val.isString()) {
-        UString result("\"");
-        result += escapeQuotes(val.toString(exec)) + "\"";
-        return result;
-    } 
+    if (val.isString())
+        return makeString("\"", escapeQuotes(val.toString(exec)), "\"");
 
     return val.toString(exec);
 }
 
-static CString registerName(int r)
+static CString constantName(ExecState* exec, int k, JSValue value)
 {
-    if (r == missingThisObjectMarker())
-        return "<null>";
-
-    return (UString("r") + UString::from(r)).UTF8String();
+    return makeString(valueToSourceString(exec, value), "(@k", UString::from(k - FirstConstantRegisterIndex), ")").UTF8String();
 }
 
-static CString constantName(ExecState* exec, int k, JSValue value)
+static CString idName(int id0, const Identifier& ident)
 {
-    return (valueToSourceString(exec, value) + "(@k" + UString::from(k) + ")").UTF8String();
+    return makeString(ident.ustring(), "(@id", UString::from(id0), ")").UTF8String();
 }
 
-static CString idName(int id0, const Identifier& ident)
+CString CodeBlock::registerName(ExecState* exec, int r) const
 {
-    return (ident.ustring() + "(@id" + UString::from(id0) +")").UTF8String();
+    if (r == missingThisObjectMarker())
+        return "<null>";
+
+    if (isConstantRegisterIndex(r))
+        return constantName(exec, r, getConstant(r));
+
+    return makeString("r", UString::from(r)).UTF8String();
 }
 
 static UString regexpToSourceString(RegExp* regExp)
 {
-    UString pattern = UString("/") + regExp->pattern() + "/";
+    char postfix[5] = { '/', 0, 0, 0, 0 };
+    int index = 1;
     if (regExp->global())
-        pattern += "g";
+        postfix[index++] = 'g';
     if (regExp->ignoreCase())
-        pattern += "i";
+        postfix[index++] = 'i';
     if (regExp->multiline())
-        pattern += "m";
+        postfix[index] = 'm';
 
-    return pattern;
+    return makeString("/", regExp->pattern(), postfix);
 }
 
 static CString regexpName(int re, RegExp* regexp)
 {
-    return (regexpToSourceString(regexp) + "(@re" + UString::from(re) + ")").UTF8String();
+    return makeString(regexpToSourceString(regexp), "(@re", UString::from(re), ")").UTF8String();
 }
 
 static UString pointerToSourceString(void* p)
@@ -135,44 +136,44 @@ NEVER_INLINE static const char* debugHookName(int debugHookID)
     return "";
 }
 
-static void printUnaryOp(int location, Vector<Instruction>::const_iterator& it, const char* op)
+void CodeBlock::printUnaryOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
 
-    printf("[%4d] %s\t\t %s, %s\n", location, op, registerName(r0).c_str(), registerName(r1).c_str());
+    printf("[%4d] %s\t\t %s, %s\n", location, op, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
 }
 
-static void printBinaryOp(int location, Vector<Instruction>::const_iterator& it, const char* op)
+void CodeBlock::printBinaryOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
     int r2 = (++it)->u.operand;
-    printf("[%4d] %s\t\t %s, %s, %s\n", location, op, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+    printf("[%4d] %s\t\t %s, %s, %s\n", location, op, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
 }
 
-static void printConditionalJump(const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator& it, int location, const char* op)
+void CodeBlock::printConditionalJump(ExecState* exec, const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator& it, int location, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int offset = (++it)->u.operand;
-    printf("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(r0).c_str(), offset, location + offset);
+    printf("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(exec, r0).c_str(), offset, location + offset);
 }
 
-static void printGetByIdOp(int location, Vector<Instruction>::const_iterator& it, const Vector<Identifier>& m_identifiers, const char* op)
+void CodeBlock::printGetByIdOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
     int id0 = (++it)->u.operand;
-    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(r0).c_str(), registerName(r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
+    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
     it += 4;
 }
 
-static void printPutByIdOp(int location, Vector<Instruction>::const_iterator& it, const Vector<Identifier>& m_identifiers, const char* op)
+void CodeBlock::printPutByIdOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int id0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
-    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
     it += 4;
 }
 
@@ -357,7 +358,7 @@ void CodeBlock::dump(ExecState* exec) const
         unsigned registerIndex = m_numVars;
         size_t i = 0;
         do {
-            printf("   r%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue()).ascii());
+            printf("   k%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue()).ascii());
             ++i;
             ++registerIndex;
         } while (i < m_constantRegisters.size());
@@ -481,7 +482,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_enter_with_activation: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] enter_with_activation %s\n", location, registerName(r0).c_str());
+            printf("[%4d] enter_with_activation %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_create_arguments: {
@@ -494,148 +495,148 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_convert_this: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] convert_this %s\n", location, registerName(r0).c_str());
+            printf("[%4d] convert_this %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_new_object: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] new_object\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] new_object\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_new_array: {
             int dst = (++it)->u.operand;
             int argv = (++it)->u.operand;
             int argc = (++it)->u.operand;
-            printf("[%4d] new_array\t %s, %s, %d\n", location, registerName(dst).c_str(), registerName(argv).c_str(), argc);
+            printf("[%4d] new_array\t %s, %s, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, argv).c_str(), argc);
             break;
         }
         case op_new_regexp: {
             int r0 = (++it)->u.operand;
             int re0 = (++it)->u.operand;
-            printf("[%4d] new_regexp\t %s, %s\n", location, registerName(r0).c_str(), regexpName(re0, regexp(re0)).c_str());
+            printf("[%4d] new_regexp\t %s, %s\n", location, registerName(exec, r0).c_str(), regexpName(re0, regexp(re0)).c_str());
             break;
         }
         case op_mov: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] mov\t\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            printf("[%4d] mov\t\t %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_not: {
-            printUnaryOp(location, it, "not");
+            printUnaryOp(exec, location, it, "not");
             break;
         }
         case op_eq: {
-            printBinaryOp(location, it, "eq");
+            printBinaryOp(exec, location, it, "eq");
             break;
         }
         case op_eq_null: {
-            printUnaryOp(location, it, "eq_null");
+            printUnaryOp(exec, location, it, "eq_null");
             break;
         }
         case op_neq: {
-            printBinaryOp(location, it, "neq");
+            printBinaryOp(exec, location, it, "neq");
             break;
         }
         case op_neq_null: {
-            printUnaryOp(location, it, "neq_null");
+            printUnaryOp(exec, location, it, "neq_null");
             break;
         }
         case op_stricteq: {
-            printBinaryOp(location, it, "stricteq");
+            printBinaryOp(exec, location, it, "stricteq");
             break;
         }
         case op_nstricteq: {
-            printBinaryOp(location, it, "nstricteq");
+            printBinaryOp(exec, location, it, "nstricteq");
             break;
         }
         case op_less: {
-            printBinaryOp(location, it, "less");
+            printBinaryOp(exec, location, it, "less");
             break;
         }
         case op_lesseq: {
-            printBinaryOp(location, it, "lesseq");
+            printBinaryOp(exec, location, it, "lesseq");
             break;
         }
         case op_pre_inc: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] pre_inc\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] pre_inc\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_pre_dec: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] pre_dec\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] pre_dec\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_post_inc: {
-            printUnaryOp(location, it, "post_inc");
+            printUnaryOp(exec, location, it, "post_inc");
             break;
         }
         case op_post_dec: {
-            printUnaryOp(location, it, "post_dec");
+            printUnaryOp(exec, location, it, "post_dec");
             break;
         }
         case op_to_jsnumber: {
-            printUnaryOp(location, it, "to_jsnumber");
+            printUnaryOp(exec, location, it, "to_jsnumber");
             break;
         }
         case op_negate: {
-            printUnaryOp(location, it, "negate");
+            printUnaryOp(exec, location, it, "negate");
             break;
         }
         case op_add: {
-            printBinaryOp(location, it, "add");
+            printBinaryOp(exec, location, it, "add");
             ++it;
             break;
         }
         case op_mul: {
-            printBinaryOp(location, it, "mul");
+            printBinaryOp(exec, location, it, "mul");
             ++it;
             break;
         }
         case op_div: {
-            printBinaryOp(location, it, "div");
+            printBinaryOp(exec, location, it, "div");
             ++it;
             break;
         }
         case op_mod: {
-            printBinaryOp(location, it, "mod");
+            printBinaryOp(exec, location, it, "mod");
             break;
         }
         case op_sub: {
-            printBinaryOp(location, it, "sub");
+            printBinaryOp(exec, location, it, "sub");
             ++it;
             break;
         }
         case op_lshift: {
-            printBinaryOp(location, it, "lshift");
+            printBinaryOp(exec, location, it, "lshift");
             break;            
         }
         case op_rshift: {
-            printBinaryOp(location, it, "rshift");
+            printBinaryOp(exec, location, it, "rshift");
             break;
         }
         case op_urshift: {
-            printBinaryOp(location, it, "urshift");
+            printBinaryOp(exec, location, it, "urshift");
             break;
         }
         case op_bitand: {
-            printBinaryOp(location, it, "bitand");
+            printBinaryOp(exec, location, it, "bitand");
             ++it;
             break;
         }
         case op_bitxor: {
-            printBinaryOp(location, it, "bitxor");
+            printBinaryOp(exec, location, it, "bitxor");
             ++it;
             break;
         }
         case op_bitor: {
-            printBinaryOp(location, it, "bitor");
+            printBinaryOp(exec, location, it, "bitor");
             ++it;
             break;
         }
         case op_bitnot: {
-            printUnaryOp(location, it, "bitnot");
+            printUnaryOp(exec, location, it, "bitnot");
             break;
         }
         case op_instanceof: {
@@ -643,59 +644,59 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
             int r3 = (++it)->u.operand;
-            printf("[%4d] instanceof\t\t %s, %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str());
+            printf("[%4d] instanceof\t\t %s, %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str(), registerName(exec, r3).c_str());
             break;
         }
         case op_typeof: {
-            printUnaryOp(location, it, "typeof");
+            printUnaryOp(exec, location, it, "typeof");
             break;
         }
         case op_is_undefined: {
-            printUnaryOp(location, it, "is_undefined");
+            printUnaryOp(exec, location, it, "is_undefined");
             break;
         }
         case op_is_boolean: {
-            printUnaryOp(location, it, "is_boolean");
+            printUnaryOp(exec, location, it, "is_boolean");
             break;
         }
         case op_is_number: {
-            printUnaryOp(location, it, "is_number");
+            printUnaryOp(exec, location, it, "is_number");
             break;
         }
         case op_is_string: {
-            printUnaryOp(location, it, "is_string");
+            printUnaryOp(exec, location, it, "is_string");
             break;
         }
         case op_is_object: {
-            printUnaryOp(location, it, "is_object");
+            printUnaryOp(exec, location, it, "is_object");
             break;
         }
         case op_is_function: {
-            printUnaryOp(location, it, "is_function");
+            printUnaryOp(exec, location, it, "is_function");
             break;
         }
         case op_in: {
-            printBinaryOp(location, it, "in");
+            printBinaryOp(exec, location, it, "in");
             break;
         }
         case op_resolve: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve\t\t %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve\t\t %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_resolve_skip: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
-            printf("[%4d] resolve_skip\t %s, %s, %d\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), skipLevels);
+            printf("[%4d] resolve_skip\t %s, %s, %d\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), skipLevels);
             break;
         }
         case op_resolve_global: {
             int r0 = (++it)->u.operand;
             JSValue scope = JSValue((++it)->u.jsCell);
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_global\t %s, %s, %s\n", location, registerName(r0).c_str(), valueToSourceString(exec, scope).ascii(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve_global\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), valueToSourceString(exec, scope).ascii(), idName(id0, m_identifiers[id0]).c_str());
             it += 2;
             break;
         }
@@ -703,125 +704,165 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int index = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
-            printf("[%4d] get_scoped_var\t %s, %d, %d\n", location, registerName(r0).c_str(), index, skipLevels);
+            printf("[%4d] get_scoped_var\t %s, %d, %d\n", location, registerName(exec, r0).c_str(), index, skipLevels);
             break;
         }
         case op_put_scoped_var: {
             int index = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
             int r0 = (++it)->u.operand;
-            printf("[%4d] put_scoped_var\t %d, %d, %s\n", location, index, skipLevels, registerName(r0).c_str());
+            printf("[%4d] put_scoped_var\t %d, %d, %s\n", location, index, skipLevels, registerName(exec, r0).c_str());
             break;
         }
         case op_get_global_var: {
             int r0 = (++it)->u.operand;
             JSValue scope = JSValue((++it)->u.jsCell);
             int index = (++it)->u.operand;
-            printf("[%4d] get_global_var\t %s, %s, %d\n", location, registerName(r0).c_str(), valueToSourceString(exec, scope).ascii(), index);
+            printf("[%4d] get_global_var\t %s, %s, %d\n", location, registerName(exec, r0).c_str(), valueToSourceString(exec, scope).ascii(), index);
             break;
         }
         case op_put_global_var: {
             JSValue scope = JSValue((++it)->u.jsCell);
             int index = (++it)->u.operand;
             int r0 = (++it)->u.operand;
-            printf("[%4d] put_global_var\t %s, %d, %s\n", location, valueToSourceString(exec, scope).ascii(), index, registerName(r0).c_str());
+            printf("[%4d] put_global_var\t %s, %d, %s\n", location, valueToSourceString(exec, scope).ascii(), index, registerName(exec, r0).c_str());
             break;
         }
         case op_resolve_base: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_base\t %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve_base\t %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_resolve_with_base: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_with_base %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve_with_base %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_get_by_id: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id");
+            printGetByIdOp(exec, location, it, "get_by_id");
             break;
         }
         case op_get_by_id_self: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_self");
+            printGetByIdOp(exec, location, it, "get_by_id_self");
             break;
         }
         case op_get_by_id_self_list: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_self_list");
+            printGetByIdOp(exec, location, it, "get_by_id_self_list");
             break;
         }
         case op_get_by_id_proto: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_proto");
+            printGetByIdOp(exec, location, it, "get_by_id_proto");
             break;
         }
         case op_get_by_id_proto_list: {
-            printGetByIdOp(location, it, m_identifiers, "op_get_by_id_proto_list");
+            printGetByIdOp(exec, location, it, "op_get_by_id_proto_list");
             break;
         }
         case op_get_by_id_chain: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_chain");
+            printGetByIdOp(exec, location, it, "get_by_id_chain");
+            break;
+        }
+        case op_get_by_id_getter_self: {
+            printGetByIdOp(exec, location, it, "get_by_id_getter_self");
+            break;
+        }
+        case op_get_by_id_getter_self_list: {
+            printGetByIdOp(exec, location, it, "get_by_id_getter_self_list");
+            break;
+        }
+        case op_get_by_id_getter_proto: {
+            printGetByIdOp(exec, location, it, "get_by_id_getter_proto");
+            break;
+        }
+        case op_get_by_id_getter_proto_list: {
+            printGetByIdOp(exec, location, it, "get_by_id_getter_proto_list");
+            break;
+        }
+        case op_get_by_id_getter_chain: {
+            printGetByIdOp(exec, location, it, "get_by_id_getter_chain");
+            break;
+        }
+        case op_get_by_id_custom_self: {
+            printGetByIdOp(exec, location, it, "get_by_id_custom_self");
+            break;
+        }
+        case op_get_by_id_custom_self_list: {
+            printGetByIdOp(exec, location, it, "get_by_id_custom_self_list");
+            break;
+        }
+        case op_get_by_id_custom_proto: {
+            printGetByIdOp(exec, location, it, "get_by_id_custom_proto");
+            break;
+        }
+        case op_get_by_id_custom_proto_list: {
+            printGetByIdOp(exec, location, it, "get_by_id_custom_proto_list");
+            break;
+        }
+        case op_get_by_id_custom_chain: {
+            printGetByIdOp(exec, location, it, "get_by_id_custom_chain");
             break;
         }
         case op_get_by_id_generic: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_generic");
+            printGetByIdOp(exec, location, it, "get_by_id_generic");
             break;
         }
         case op_get_array_length: {
-            printGetByIdOp(location, it, m_identifiers, "get_array_length");
+            printGetByIdOp(exec, location, it, "get_array_length");
             break;
         }
         case op_get_string_length: {
-            printGetByIdOp(location, it, m_identifiers, "get_string_length");
+            printGetByIdOp(exec, location, it, "get_string_length");
             break;
         }
         case op_put_by_id: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id");
+            printPutByIdOp(exec, location, it, "put_by_id");
             break;
         }
         case op_put_by_id_replace: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id_replace");
+            printPutByIdOp(exec, location, it, "put_by_id_replace");
             break;
         }
         case op_put_by_id_transition: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id_transition");
+            printPutByIdOp(exec, location, it, "put_by_id_transition");
             break;
         }
         case op_put_by_id_generic: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id_generic");
+            printPutByIdOp(exec, location, it, "put_by_id_generic");
             break;
         }
         case op_put_getter: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] put_getter\t %s, %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+            printf("[%4d] put_getter\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_put_setter: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] put_setter\t %s, %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+            printf("[%4d] put_setter\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_method_check: {
-            printf("[%4d] op_method_check\n", location);
+            printf("[%4d] method_check\n", location);
             break;
         }
         case op_del_by_id: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] del_by_id\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] del_by_id\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_get_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] get_by_val\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+            printf("[%4d] get_by_val\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
             break;
         }
         case op_get_by_pname: {
@@ -831,28 +872,28 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r3 = (++it)->u.operand;
             int r4 = (++it)->u.operand;
             int r5 = (++it)->u.operand;
-            printf("[%4d] get_by_pname\t %s, %s, %s, %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str(), registerName(r4).c_str(), registerName(r5).c_str());
+            printf("[%4d] get_by_pname\t %s, %s, %s, %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str(), registerName(exec, r3).c_str(), registerName(exec, r4).c_str(), registerName(exec, r5).c_str());
             break;
         }
         case op_put_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] put_by_val\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+            printf("[%4d] put_by_val\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
             break;
         }
         case op_del_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] del_by_val\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+            printf("[%4d] del_by_val\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
             break;
         }
         case op_put_by_index: {
             int r0 = (++it)->u.operand;
             unsigned n0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] put_by_index\t %s, %u, %s\n", location, registerName(r0).c_str(), n0, registerName(r1).c_str());
+            printf("[%4d] put_by_index\t %s, %u, %s\n", location, registerName(exec, r0).c_str(), n0, registerName(exec, r1).c_str());
             break;
         }
         case op_jmp: {
@@ -866,91 +907,102 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             break;
         }
         case op_jtrue: {
-            printConditionalJump(begin, it, location, "jtrue");
+            printConditionalJump(exec, begin, it, location, "jtrue");
             break;
         }
         case op_loop_if_true: {
-            printConditionalJump(begin, it, location, "loop_if_true");
+            printConditionalJump(exec, begin, it, location, "loop_if_true");
+            break;
+        }
+        case op_loop_if_false: {
+            printConditionalJump(exec, begin, it, location, "loop_if_false");
             break;
         }
         case op_jfalse: {
-            printConditionalJump(begin, it, location, "jfalse");
+            printConditionalJump(exec, begin, it, location, "jfalse");
             break;
         }
         case op_jeq_null: {
-            printConditionalJump(begin, it, location, "jeq_null");
+            printConditionalJump(exec, begin, it, location, "jeq_null");
             break;
         }
         case op_jneq_null: {
-            printConditionalJump(begin, it, location, "jneq_null");
+            printConditionalJump(exec, begin, it, location, "jneq_null");
             break;
         }
         case op_jneq_ptr: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_jnless: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_jnlesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_loop_if_less: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
+            break;
+        }
+        case op_jless: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printf("[%4d] jless\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_loop_if_lesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_switch_imm: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).c_str());
             break;
         }
         case op_switch_char: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).c_str());
             break;
         }
         case op_switch_string: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).c_str());
             break;
         }
         case op_new_func: {
             int r0 = (++it)->u.operand;
             int f0 = (++it)->u.operand;
-            printf("[%4d] new_func\t\t %s, f%d\n", location, registerName(r0).c_str(), f0);
+            printf("[%4d] new_func\t\t %s, f%d\n", location, registerName(exec, r0).c_str(), f0);
             break;
         }
         case op_new_func_exp: {
             int r0 = (++it)->u.operand;
             int f0 = (++it)->u.operand;
-            printf("[%4d] new_func_exp\t %s, f%d\n", location, registerName(r0).c_str(), f0);
+            printf("[%4d] new_func_exp\t %s, f%d\n", location, registerName(exec, r0).c_str(), f0);
             break;
         }
         case op_call: {
@@ -958,7 +1010,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int func = (++it)->u.operand;
             int argCount = (++it)->u.operand;
             int registerOffset = (++it)->u.operand;
-            printf("[%4d] call\t\t %s, %s, %d, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), argCount, registerOffset);
+            printf("[%4d] call\t\t %s, %s, %d, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), argCount, registerOffset);
             break;
         }
         case op_call_eval: {
@@ -966,7 +1018,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int func = (++it)->u.operand;
             int argCount = (++it)->u.operand;
             int registerOffset = (++it)->u.operand;
-            printf("[%4d] call_eval\t %s, %s, %d, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), argCount, registerOffset);
+            printf("[%4d] call_eval\t %s, %s, %d, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), argCount, registerOffset);
             break;
         }
         case op_call_varargs: {
@@ -974,16 +1026,16 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int func = (++it)->u.operand;
             int argCount = (++it)->u.operand;
             int registerOffset = (++it)->u.operand;
-            printf("[%4d] call_varargs\t %s, %s, %s, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), registerName(argCount).c_str(), registerOffset);
+            printf("[%4d] call_varargs\t %s, %s, %s, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), registerName(exec, argCount).c_str(), registerOffset);
             break;
         }
         case op_load_varargs: {
-            printUnaryOp(location, it, "load_varargs");
+            printUnaryOp(exec, location, it, "load_varargs");
             break;
         }
         case op_tear_off_activation: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] tear_off_activation\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] tear_off_activation\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_tear_off_arguments: {
@@ -992,7 +1044,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_ret: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] ret\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] ret\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_construct: {
@@ -1002,26 +1054,26 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int registerOffset = (++it)->u.operand;
             int proto = (++it)->u.operand;
             int thisRegister = (++it)->u.operand;
-            printf("[%4d] construct\t %s, %s, %d, %d, %s, %s\n", location, registerName(dst).c_str(), registerName(func).c_str(), argCount, registerOffset, registerName(proto).c_str(), registerName(thisRegister).c_str());
+            printf("[%4d] construct\t %s, %s, %d, %d, %s, %s\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), argCount, registerOffset, registerName(exec, proto).c_str(), registerName(exec, thisRegister).c_str());
             break;
         }
         case op_construct_verify: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] construct_verify\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            printf("[%4d] construct_verify\t %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_strcat: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int count = (++it)->u.operand;
-            printf("[%4d] op_strcat\t %s, %s, %d\n", location, registerName(r0).c_str(), registerName(r1).c_str(), count);
+            printf("[%4d] strcat\t\t %s, %s, %d\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), count);
             break;
         }
         case op_to_primitive: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] op_to_primitive\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            printf("[%4d] to_primitive\t %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_get_pnames: {
@@ -1030,7 +1082,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r2 = it[3].u.operand;
             int r3 = it[4].u.operand;
             int offset = it[5].u.operand;
-            printf("[%4d] get_pnames\t %s, %s, %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str(), offset, location + offset);
+            printf("[%4d] get_pnames\t %s, %s, %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str(), registerName(exec, r3).c_str(), offset, location + offset);
             it += OPCODE_LENGTH(op_get_pnames) - 1;
             break;
         }
@@ -1038,13 +1090,13 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int dest = it[1].u.operand;
             int iter = it[4].u.operand;
             int offset = it[5].u.operand;
-            printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(dest).c_str(), registerName(iter).c_str(), offset, location + offset);
+            printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(exec, dest).c_str(), registerName(exec, iter).c_str(), offset, location + offset);
             it += OPCODE_LENGTH(op_next_pname) - 1;
             break;
         }
         case op_push_scope: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] push_scope\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] push_scope\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_pop_scope: {
@@ -1055,7 +1107,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] push_new_scope \t%s, %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+            printf("[%4d] push_new_scope \t%s, %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_jmp_scopes: {
@@ -1066,30 +1118,30 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_catch: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] catch\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] catch\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_throw: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] throw\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] throw\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_new_error: {
             int r0 = (++it)->u.operand;
             int errorType = (++it)->u.operand;
             int k0 = (++it)->u.operand;
-            printf("[%4d] new_error\t %s, %d, %s\n", location, registerName(r0).c_str(), errorType, constantName(exec, k0, getConstant(k0)).c_str());
+            printf("[%4d] new_error\t %s, %d, %s\n", location, registerName(exec, r0).c_str(), errorType, constantName(exec, k0, getConstant(k0)).c_str());
             break;
         }
         case op_jsr: {
             int retAddrDst = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(retAddrDst).c_str(), offset, location + offset);
+            printf("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(exec, retAddrDst).c_str(), offset, location + offset);
             break;
         }
         case op_sret: {
             int retAddrSrc = (++it)->u.operand;
-            printf("[%4d] sret\t\t %s\n", location, registerName(retAddrSrc).c_str());
+            printf("[%4d] sret\t\t %s\n", location, registerName(exec, retAddrSrc).c_str());
             break;
         }
         case op_debug: {
@@ -1101,17 +1153,17 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_profile_will_call: {
             int function = (++it)->u.operand;
-            printf("[%4d] profile_will_call %s\n", location, registerName(function).c_str());
+            printf("[%4d] profile_will_call %s\n", location, registerName(exec, function).c_str());
             break;
         }
         case op_profile_did_call: {
             int function = (++it)->u.operand;
-            printf("[%4d] profile_did_call\t %s\n", location, registerName(function).c_str());
+            printf("[%4d] profile_did_call\t %s\n", location, registerName(exec, function).c_str());
             break;
         }
         case op_end: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] end\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] end\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
     }
@@ -1343,16 +1395,16 @@ void CodeBlock::derefStructures(Instruction* vPC) const
 {
     Interpreter* interpreter = m_globalData->interpreter;
 
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self)) {
         vPC[4].u.structure->deref();
         return;
     }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_proto)) {
         vPC[4].u.structure->deref();
         vPC[5].u.structure->deref();
         return;
     }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain)) {
         vPC[4].u.structure->deref();
         vPC[5].u.structureChain->deref();
         return;
@@ -1373,7 +1425,9 @@ void CodeBlock::derefStructures(Instruction* vPC) const
         return;
     }
     if ((vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto_list))
-        || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self_list))) {
+        || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self_list))
+        || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_proto_list))
+        || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self_list))) {
         PolymorphicAccessStructureList* polymorphicStructures = vPC[4].u.polymorphicStructures;
         polymorphicStructures->derefStructures(vPC[5].u.operand);
         delete polymorphicStructures;
@@ -1388,16 +1442,16 @@ void CodeBlock::refStructures(Instruction* vPC) const
 {
     Interpreter* interpreter = m_globalData->interpreter;
 
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self)) {
         vPC[4].u.structure->ref();
         return;
     }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_proto)) {
         vPC[4].u.structure->ref();
         vPC[5].u.structure->ref();
         return;
     }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain)) {
         vPC[4].u.structure->ref();
         vPC[5].u.structureChain->ref();
         return;
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
index 4ba58d77e5..d92dc9d851 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
@@ -36,7 +36,6 @@
 #include "JSGlobalObject.h"
 #include "JumpTable.h"
 #include "Nodes.h"
-#include "PtrAndFlags.h"
 #include "RegExp.h"
 #include "UString.h"
 #include <wtf/FastAllocBase.h>
@@ -110,44 +109,54 @@ namespace JSC {
         CodeLocationNearCall callReturnLocation;
         CodeLocationDataLabelPtr hotPathBegin;
         CodeLocationNearCall hotPathOther;
-        PtrAndFlags<CodeBlock, HasSeenShouldRepatch> ownerCodeBlock;
+        CodeBlock* ownerCodeBlock;
         CodeBlock* callee;
-        unsigned position;
+        unsigned position : 31;
+        unsigned hasSeenShouldRepatch : 1;
         
         void setUnlinked() { callee = 0; }
         bool isLinked() { return callee; }
 
         bool seenOnce()
         {
-            return ownerCodeBlock.isFlagSet(hasSeenShouldRepatch);
+            return hasSeenShouldRepatch;
         }
 
         void setSeen()
         {
-            ownerCodeBlock.setFlag(hasSeenShouldRepatch);
+            hasSeenShouldRepatch = true;
         }
     };
 
     struct MethodCallLinkInfo {
         MethodCallLinkInfo()
             : cachedStructure(0)
+            , cachedPrototypeStructure(0)
         {
         }
 
         bool seenOnce()
         {
-            return cachedPrototypeStructure.isFlagSet(hasSeenShouldRepatch);
+            ASSERT(!cachedStructure);
+            return cachedPrototypeStructure;
         }
 
         void setSeen()
         {
-            cachedPrototypeStructure.setFlag(hasSeenShouldRepatch);
+            ASSERT(!cachedStructure && !cachedPrototypeStructure);
+            // We use the values of cachedStructure & cachedPrototypeStructure to indicate the
+            // current state.
+            //     - In the initial state, both are null.
+            //     - Once this transition has been taken once, cachedStructure is
+            //       null and cachedPrototypeStructure is set to a nun-null value.
+            //     - Once the call is linked both structures are set to non-null values.
+            cachedPrototypeStructure = (Structure*)1;
         }
 
         CodeLocationCall callReturnLocation;
         CodeLocationDataLabelPtr structureLabel;
         Structure* cachedStructure;
-        PtrAndFlags<Structure, HasSeenShouldRepatch> cachedPrototypeStructure;
+        Structure* cachedPrototypeStructure;
     };
 
     struct FunctionRegisterInfo {
@@ -438,7 +447,7 @@ namespace JSC {
         size_t numberOfConstantRegisters() const { return m_constantRegisters.size(); }
         void addConstantRegister(const Register& r) { return m_constantRegisters.append(r); }
         Register& constantRegister(int index) { return m_constantRegisters[index - FirstConstantRegisterIndex]; }
-        ALWAYS_INLINE bool isConstantRegisterIndex(int index) { return index >= FirstConstantRegisterIndex; }
+        ALWAYS_INLINE bool isConstantRegisterIndex(int index) const { return index >= FirstConstantRegisterIndex; }
         ALWAYS_INLINE JSValue getConstant(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex].jsValue(); }
 
         unsigned addFunctionDecl(NonNullPassRefPtr<FunctionExecutable> n) { unsigned size = m_functionDecls.size(); m_functionDecls.append(n); return size; }
@@ -482,6 +491,13 @@ namespace JSC {
     private:
 #if !defined(NDEBUG) || ENABLE(OPCODE_SAMPLING)
         void dump(ExecState*, const Vector<Instruction>::const_iterator& begin, Vector<Instruction>::const_iterator&) const;
+
+        CString registerName(ExecState*, int r) const;
+        void printUnaryOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
+        void printBinaryOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
+        void printConditionalJump(ExecState*, const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator&, int location, const char* op) const;
+        void printGetByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
+        void printPutByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
 #endif
 
         void reparseForExceptionInfoIfNecessary(CallFrame*);
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
index 05834fcbfe..a036dd496a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
@@ -65,7 +65,7 @@ namespace JSC {
         bool isEmpty() const { return m_cacheMap.isEmpty(); }
 
     private:
-        static const int maxCacheableSourceLength = 256;
+        static const unsigned maxCacheableSourceLength = 256;
         static const int maxCacheEntries = 64;
 
         typedef HashMap<RefPtr<UString::Rep>, RefPtr<EvalExecutable> > EvalCacheMap;
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
index bcef7fb196..ab6659f7a4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
@@ -31,6 +31,7 @@
 
 #include "MacroAssembler.h"
 #include "Opcode.h"
+#include "PropertySlot.h"
 #include "Structure.h"
 #include <wtf/VectorTraits.h>
 
@@ -144,6 +145,7 @@ namespace JSC {
         Instruction(StructureChain* structureChain) { u.structureChain = structureChain; }
         Instruction(JSCell* jsCell) { u.jsCell = jsCell; }
         Instruction(PolymorphicAccessStructureList* polymorphicStructures) { u.polymorphicStructures = polymorphicStructures; }
+        Instruction(PropertySlot::GetValueFunc getterFunc) { u.getterFunc = getterFunc; }
 
         union {
             Opcode opcode;
@@ -152,6 +154,7 @@ namespace JSC {
             StructureChain* structureChain;
             JSCell* jsCell;
             PolymorphicAccessStructureList* polymorphicStructures;
+            PropertySlot::GetValueFunc getterFunc;
         } u;
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
index 4facbef5b2..509daeb109 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
@@ -104,6 +104,16 @@ namespace JSC {
         macro(op_get_by_id_proto, 8) \
         macro(op_get_by_id_proto_list, 8) \
         macro(op_get_by_id_chain, 8) \
+        macro(op_get_by_id_getter_self, 8) \
+        macro(op_get_by_id_getter_self_list, 8) \
+        macro(op_get_by_id_getter_proto, 8) \
+        macro(op_get_by_id_getter_proto_list, 8) \
+        macro(op_get_by_id_getter_chain, 8) \
+        macro(op_get_by_id_custom_self, 8) \
+        macro(op_get_by_id_custom_self_list, 8) \
+        macro(op_get_by_id_custom_proto, 8) \
+        macro(op_get_by_id_custom_proto_list, 8) \
+        macro(op_get_by_id_custom_chain, 8) \
         macro(op_get_by_id_generic, 8) \
         macro(op_get_array_length, 8) \
         macro(op_get_string_length, 8) \
@@ -128,9 +138,11 @@ namespace JSC {
         macro(op_jneq_ptr, 4) \
         macro(op_jnless, 4) \
         macro(op_jnlesseq, 4) \
+        macro(op_jless, 4) \
         macro(op_jmp_scopes, 3) \
         macro(op_loop, 2) \
         macro(op_loop_if_true, 3) \
+        macro(op_loop_if_false, 3) \
         macro(op_loop_if_less, 4) \
         macro(op_loop_if_lesseq, 4) \
         macro(op_switch_imm, 4) \
@@ -194,8 +206,12 @@ namespace JSC {
     #undef VERIFY_OPCODE_ID
 
 #if HAVE(COMPUTED_GOTO)
+#if COMPILER(RVCT)
     typedef void* Opcode;
 #else
+    typedef const void* Opcode;
+#endif
+#else
     typedef OpcodeID Opcode;
 #endif
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
index 865c919335..3f0babc549 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
@@ -33,7 +33,7 @@
 #include "Interpreter.h"
 #include "Opcode.h"
 
-#if !PLATFORM(WIN_OS)
+#if !OS(WINDOWS)
 #include <unistd.h>
 #endif
 
@@ -91,7 +91,7 @@ void SamplingFlags::stop() {}
 uint32_t SamplingFlags::s_flags = 1 << 15;
 
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 
 static void sleepForMicroseconds(unsigned us)
 {
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 04dae15374..e46bb15f1d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -616,7 +616,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJump(Label* target)
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* target)
 {
-    if (m_lastOpcodeID == op_less && !target->isForward()) {
+    if (m_lastOpcodeID == op_less) {
         int dstIndex;
         int src1Index;
         int src2Index;
@@ -627,7 +627,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
             rewindBinaryOp();
 
             size_t begin = instructions().size();
-            emitOpcode(op_loop_if_less);
+            emitOpcode(target->isForward() ? op_jless : op_loop_if_less);
             instructions().append(src1Index);
             instructions().append(src2Index);
             instructions().append(target->bind(begin, instructions().size()));
@@ -692,9 +692,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* target)
 {
-    ASSERT(target->isForward());
-
-    if (m_lastOpcodeID == op_less) {
+    if (m_lastOpcodeID == op_less && target->isForward()) {
         int dstIndex;
         int src1Index;
         int src2Index;
@@ -711,7 +709,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
             instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
-    } else if (m_lastOpcodeID == op_lesseq) {
+    } else if (m_lastOpcodeID == op_lesseq && target->isForward()) {
         int dstIndex;
         int src1Index;
         int src2Index;
@@ -738,12 +736,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
             rewindUnaryOp();
 
             size_t begin = instructions().size();
-            emitOpcode(op_jtrue);
+            emitOpcode(target->isForward() ? op_jtrue : op_loop_if_true);
             instructions().append(srcIndex);
             instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
-    } else if (m_lastOpcodeID == op_eq_null) {
+    } else if (m_lastOpcodeID == op_eq_null && target->isForward()) {
         int dstIndex;
         int srcIndex;
 
@@ -758,7 +756,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
             instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
-    } else if (m_lastOpcodeID == op_neq_null) {
+    } else if (m_lastOpcodeID == op_neq_null && target->isForward()) {
         int dstIndex;
         int srcIndex;
 
@@ -776,7 +774,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
     }
 
     size_t begin = instructions().size();
-    emitOpcode(op_jfalse);
+    emitOpcode(target->isForward() ? op_jfalse : op_loop_if_false);
     instructions().append(cond->index());
     instructions().append(target->bind(begin, instructions().size()));
     return target;
@@ -906,7 +904,7 @@ RegisterID* BytecodeGenerator::emitEqualityOp(OpcodeID opcodeID, RegisterID* dst
             && src1->isTemporary()
             && m_codeBlock->isConstantRegisterIndex(src2->index())
             && m_codeBlock->constantRegister(src2->index()).jsValue().isString()) {
-            const UString& value = asString(m_codeBlock->constantRegister(src2->index()).jsValue())->value();
+            const UString& value = asString(m_codeBlock->constantRegister(src2->index()).jsValue())->tryGetValue();
             if (value == "undefined") {
                 rewindUnaryOp();
                 emitOpcode(op_is_undefined);
@@ -1942,9 +1940,9 @@ static int32_t keyForCharacterSwitch(ExpressionNode* node, int32_t min, int32_t
     UNUSED_PARAM(max);
     ASSERT(node->isString());
     UString::Rep* clause = static_cast<StringNode*>(node)->value().ustring().rep();
-    ASSERT(clause->size() == 1);
+    ASSERT(clause->length() == 1);
     
-    int32_t key = clause->data()[0];
+    int32_t key = clause->characters()[0];
     ASSERT(key >= min);
     ASSERT(key <= max);
     return key - min;
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 4648fb57e6..8b6a425194 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -192,6 +192,19 @@ namespace JSC {
             return emitNode(0, n);
         }
 
+        void emitNodeInConditionContext(ExpressionNode* n, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)
+        {
+            if (!m_codeBlock->numberOfLineInfos() || m_codeBlock->lastLineInfo().lineNumber != n->lineNo()) {
+                LineInfo info = { instructions().size(), n->lineNo() };
+                m_codeBlock->addLineInfo(info);
+            }
+            if (m_emitNodeDepth >= s_maxEmitNodeDepth)
+                emitThrowExpressionTooDeepException();
+            ++m_emitNodeDepth;
+            n->emitBytecodeInConditionContext(*this, trueTarget, falseTarget, fallThroughMeansTrue);
+            --m_emitNodeDepth;
+        }
+
         void emitExpressionInfo(unsigned divot, unsigned startOffset, unsigned endOffset)
         { 
             divot -= m_codeBlock->sourceOffset();
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/NodesCodegen.cpp
new file mode 100644
index 0000000000..e682c73571
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -0,0 +1,1999 @@
+/*
+*  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
+*  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+*  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+*  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+*  Copyright (C) 2007 Maks Orlovich
+*  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+*
+*  This library is free software; you can redistribute it and/or
+*  modify it under the terms of the GNU Library General Public
+*  License as published by the Free Software Foundation; either
+*  version 2 of the License, or (at your option) any later version.
+*
+*  This library is distributed in the hope that it will be useful,
+*  but WITHOUT ANY WARRANTY; without even the implied warranty of
+*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+*  Library General Public License for more details.
+*
+*  You should have received a copy of the GNU Library General Public License
+*  along with this library; see the file COPYING.LIB.  If not, write to
+*  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+*  Boston, MA 02110-1301, USA.
+*
+*/
+
+#include "config.h"
+#include "Nodes.h"
+#include "NodeConstructors.h"
+
+#include "BytecodeGenerator.h"
+#include "CallFrame.h"
+#include "Debugger.h"
+#include "JIT.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "JSStaticScopeObject.h"
+#include "LabelScope.h"
+#include "Lexer.h"
+#include "Operations.h"
+#include "Parser.h"
+#include "PropertyNameArray.h"
+#include "RegExpObject.h"
+#include "SamplingTool.h"
+#include <wtf/Assertions.h>
+#include <wtf/RefCountedLeakCounter.h>
+#include <wtf/Threading.h>
+
+using namespace WTF;
+
+namespace JSC {
+
+/*
+    Details of the emitBytecode function.
+
+    Return value: The register holding the production's value.
+             dst: An optional parameter specifying the most efficient destination at
+                  which to store the production's value. The callee must honor dst.
+
+    The dst argument provides for a crude form of copy propagation. For example,
+
+        x = 1
+
+    becomes
+    
+        load r[x], 1
+    
+    instead of 
+
+        load r0, 1
+        mov r[x], r0
+    
+    because the assignment node, "x =", passes r[x] as dst to the number node, "1".
+*/
+
+// ------------------------------ ThrowableExpressionData --------------------------------
+
+static void substitute(UString& string, const UString& substring)
+{
+    unsigned position = string.find("%s");
+    ASSERT(position != UString::NotFound);
+    string = makeString(string.substr(0, position), substring, string.substr(position + 2));
+}
+
+RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* message)
+{
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
+    generator.emitThrow(exception);
+    return exception;
+}
+
+RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const UString& label)
+{
+    UString message = messageTemplate;
+    substitute(message, label);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
+    generator.emitThrow(exception);
+    return exception;
+}
+
+inline RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const Identifier& label)
+{
+    return emitThrowError(generator, type, messageTemplate, label.ustring());
+}
+
+// ------------------------------ NullNode -------------------------------------
+
+RegisterID* NullNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, jsNull());
+}
+
+// ------------------------------ BooleanNode ----------------------------------
+
+RegisterID* BooleanNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, m_value);
+}
+
+// ------------------------------ NumberNode -----------------------------------
+
+RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, m_value);
+}
+
+// ------------------------------ StringNode -----------------------------------
+
+RegisterID* StringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, m_value);
+}
+
+// ------------------------------ RegExpNode -----------------------------------
+
+RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegExp> regExp = RegExp::create(generator.globalData(), m_pattern.ustring(), m_flags.ustring());
+    if (!regExp->isValid())
+        return emitThrowError(generator, SyntaxError, "Invalid regular expression: %s", regExp->errorMessage());
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());
+}
+
+// ------------------------------ ThisNode -------------------------------------
+
+RegisterID* ThisNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.moveToDestinationIfNeeded(dst, generator.thisRegister());
+}
+
+// ------------------------------ ResolveNode ----------------------------------
+
+bool ResolveNode::isPure(BytecodeGenerator& generator) const
+{
+    return generator.isLocal(m_ident);
+}
+
+RegisterID* ResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (dst == generator.ignoredResult())
+            return 0;
+        return generator.moveToDestinationIfNeeded(dst, local);
+    }
+    
+    generator.emitExpressionInfo(m_startOffset + m_ident.size(), m_ident.size(), 0);
+    return generator.emitResolve(generator.finalDestination(dst), m_ident);
+}
+
+// ------------------------------ ArrayNode ------------------------------------
+
+RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // FIXME: Should we put all of this code into emitNewArray?
+
+    unsigned length = 0;
+    ElementNode* firstPutElement;
+    for (firstPutElement = m_element; firstPutElement; firstPutElement = firstPutElement->next()) {
+        if (firstPutElement->elision())
+            break;
+        ++length;
+    }
+
+    if (!firstPutElement && !m_elision)
+        return generator.emitNewArray(generator.finalDestination(dst), m_element);
+
+    RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element);
+
+    for (ElementNode* n = firstPutElement; n; n = n->next()) {
+        RegisterID* value = generator.emitNode(n->value());
+        length += n->elision();
+        generator.emitPutByIndex(array.get(), length++, value);
+    }
+
+    if (m_elision) {
+        RegisterID* value = generator.emitLoad(0, jsNumber(generator.globalData(), m_elision + length));
+        generator.emitPutById(array.get(), generator.propertyNames().length, value);
+    }
+
+    return generator.moveToDestinationIfNeeded(dst, array.get());
+}
+
+bool ArrayNode::isSimpleArray() const
+{
+    if (m_elision || m_optional)
+        return false;
+    for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {
+        if (ptr->elision())
+            return false;
+    }
+    return true;
+}
+
+ArgumentListNode* ArrayNode::toArgumentList(JSGlobalData* globalData) const
+{
+    ASSERT(!m_elision && !m_optional);
+    ElementNode* ptr = m_element;
+    if (!ptr)
+        return 0;
+    ArgumentListNode* head = new (globalData) ArgumentListNode(globalData, ptr->value());
+    ArgumentListNode* tail = head;
+    ptr = ptr->next();
+    for (; ptr; ptr = ptr->next()) {
+        ASSERT(!ptr->elision());
+        tail = new (globalData) ArgumentListNode(globalData, tail, ptr->value());
+    }
+    return head;
+}
+
+// ------------------------------ ObjectLiteralNode ----------------------------
+
+RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+     if (!m_list) {
+         if (dst == generator.ignoredResult())
+             return 0;
+         return generator.emitNewObject(generator.finalDestination(dst));
+     }
+     return generator.emitNode(dst, m_list);
+}
+
+// ------------------------------ PropertyListNode -----------------------------
+
+RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> newObj = generator.tempDestination(dst);
+    
+    generator.emitNewObject(newObj.get());
+    
+    for (PropertyListNode* p = this; p; p = p->m_next) {
+        RegisterID* value = generator.emitNode(p->m_node->m_assign);
+        
+        switch (p->m_node->m_type) {
+            case PropertyNode::Constant: {
+                generator.emitPutById(newObj.get(), p->m_node->name(), value);
+                break;
+            }
+            case PropertyNode::Getter: {
+                generator.emitPutGetter(newObj.get(), p->m_node->name(), value);
+                break;
+            }
+            case PropertyNode::Setter: {
+                generator.emitPutSetter(newObj.get(), p->m_node->name(), value);
+                break;
+            }
+            default:
+                ASSERT_NOT_REACHED();
+        }
+    }
+    
+    return generator.moveToDestinationIfNeeded(dst, newObj.get());
+}
+
+// ------------------------------ BracketAccessorNode --------------------------------
+
+RegisterID* BracketAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments, m_subscript->isPure(generator));
+    RegisterID* property = generator.emitNode(m_subscript);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitGetByVal(generator.finalDestination(dst), base.get(), property);
+}
+
+// ------------------------------ DotAccessorNode --------------------------------
+
+RegisterID* DotAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RegisterID* base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitGetById(generator.finalDestination(dst), base, m_ident);
+}
+
+// ------------------------------ ArgumentListNode -----------------------------
+
+RegisterID* ArgumentListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expr);
+    return generator.emitNode(dst, m_expr);
+}
+
+// ------------------------------ NewExprNode ----------------------------------
+
+RegisterID* NewExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
+    return generator.emitConstruct(generator.finalDestination(dst), func.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ EvalFunctionCallNode ----------------------------------
+
+RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> func = generator.tempDestination(dst);
+    RefPtr<RegisterID> thisRegister = generator.newTemporary();
+    generator.emitExpressionInfo(divot() - startOffset() + 4, 4, 0);
+    generator.emitResolveWithBase(thisRegister.get(), func.get(), generator.propertyNames().eval);
+    return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallValueNode ----------------------------------
+
+RegisterID* FunctionCallValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
+    RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
+    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallResolveNode ----------------------------------
+
+RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
+        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
+        return generator.emitCall(generator.finalDestination(dst, thisRegister.get()), local.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> func = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
+        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
+        return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+
+    RefPtr<RegisterID> func = generator.newTemporary();
+    RefPtr<RegisterID> thisRegister = generator.newTemporary();
+    int identifierStart = divot() - startOffset();
+    generator.emitExpressionInfo(identifierStart + m_ident.size(), m_ident.size(), 0);
+    generator.emitResolveWithBase(thisRegister.get(), func.get(), m_ident);
+    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallBracketNode ----------------------------------
+
+RegisterID* FunctionCallBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RegisterID* property = generator.emitNode(m_subscript);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property);
+    RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallDotNode ----------------------------------
+
+RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> function = generator.tempDestination(dst);
+    RefPtr<RegisterID> thisRegister = generator.newTemporary();
+    generator.emitNode(thisRegister.get(), m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    generator.emitMethodCheck();
+    generator.emitGetById(function.get(), thisRegister.get(), m_ident);
+    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+RegisterID* CallFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
+    generator.emitJumpIfNotFunctionCall(function.get(), realCall.get());
+    {
+        RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+        RefPtr<RegisterID> thisRegister = generator.newTemporary();
+        ArgumentListNode* oldList = m_args->m_listNode;
+        if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+            m_args->m_listNode = m_args->m_listNode->m_next;
+        } else
+            generator.emitLoad(thisRegister.get(), jsNull());
+
+        generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+        generator.emitJump(end.get());
+        m_args->m_listNode = oldList;
+    }
+    generator.emitLabel(realCall.get());
+    {
+        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+    generator.emitLabel(end.get());
+    return finalDestination.get();
+}
+    
+static bool areTrivialApplyArguments(ArgumentsNode* args)
+{
+    return !args->m_listNode || !args->m_listNode->m_expr || !args->m_listNode->m_next
+        || (!args->m_listNode->m_next->m_next && args->m_listNode->m_next->m_expr->isSimpleArray());
+}
+
+RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // A few simple cases can be trivially handled as ordinary function calls.
+    // function.apply(), function.apply(arg) -> identical to function.call
+    // function.apply(thisArg, [arg0, arg1, ...]) -> can be trivially coerced into function.call(thisArg, arg0, arg1, ...) and saves object allocation
+    bool mayBeCall = areTrivialApplyArguments(m_args);
+
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
+    generator.emitJumpIfNotFunctionApply(function.get(), realCall.get());
+    {
+        if (mayBeCall) {
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+            RefPtr<RegisterID> thisRegister = generator.newTemporary();
+            ArgumentListNode* oldList = m_args->m_listNode;
+            if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+                generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+                m_args->m_listNode = m_args->m_listNode->m_next;
+                if (m_args->m_listNode) {
+                    ASSERT(m_args->m_listNode->m_expr->isSimpleArray());
+                    ASSERT(!m_args->m_listNode->m_next);
+                    m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_expr)->toArgumentList(generator.globalData());
+                }
+            } else
+                generator.emitLoad(thisRegister.get(), jsNull());
+            generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+            m_args->m_listNode = oldList;
+        } else {
+            ASSERT(m_args->m_listNode && m_args->m_listNode->m_next);
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.newTemporary(), base.get());
+            RefPtr<RegisterID> argsCountRegister = generator.newTemporary();
+            RefPtr<RegisterID> thisRegister = generator.newTemporary();
+            RefPtr<RegisterID> argsRegister = generator.newTemporary();
+            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+            ArgumentListNode* args = m_args->m_listNode->m_next;
+            bool isArgumentsApply = false;
+            if (args->m_expr->isResolveNode()) {
+                ResolveNode* resolveNode = static_cast<ResolveNode*>(args->m_expr);
+                isArgumentsApply = generator.willResolveToArguments(resolveNode->identifier());
+                if (isArgumentsApply)
+                    generator.emitMove(argsRegister.get(), generator.uncheckedRegisterForArguments());
+            }
+            if (!isArgumentsApply)
+                generator.emitNode(argsRegister.get(), args->m_expr);
+            while ((args = args->m_next))
+                generator.emitNode(args->m_expr);
+
+            generator.emitLoadVarargs(argsCountRegister.get(), argsRegister.get());
+            generator.emitCallVarargs(finalDestination.get(), realFunction.get(), thisRegister.get(), argsCountRegister.get(), divot(), startOffset(), endOffset());
+        }
+        generator.emitJump(end.get());
+    }
+    generator.emitLabel(realCall.get());
+    {
+        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+    generator.emitLabel(end.get());
+    return finalDestination.get();
+}
+
+// ------------------------------ PostfixResolveNode ----------------------------------
+
+static RegisterID* emitPreIncOrDec(BytecodeGenerator& generator, RegisterID* srcDst, Operator oper)
+{
+    return (oper == OpPlusPlus) ? generator.emitPreInc(srcDst) : generator.emitPreDec(srcDst);
+}
+
+static RegisterID* emitPostIncOrDec(BytecodeGenerator& generator, RegisterID* dst, RegisterID* srcDst, Operator oper)
+{
+    if (srcDst == dst)
+        return generator.emitToJSNumber(dst, srcDst);
+    return (oper == OpPlusPlus) ? generator.emitPostInc(dst, srcDst) : generator.emitPostDec(dst, srcDst);
+}
+
+RegisterID* PostfixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident)) {
+            if (dst == generator.ignoredResult())
+                return 0;
+            return generator.emitToJSNumber(generator.finalDestination(dst), local);
+        }
+
+        if (dst == generator.ignoredResult())
+            return emitPreIncOrDec(generator, local, m_operator);
+        return emitPostIncOrDec(generator, generator.finalDestination(dst), local, m_operator);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> value = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
+        RegisterID* oldValue;
+        if (dst == generator.ignoredResult()) {
+            oldValue = 0;
+            emitPreIncOrDec(generator, value.get(), m_operator);
+        } else {
+            oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
+        }
+        generator.emitPutScopedVar(depth, index, value.get(), globalObject);
+        return oldValue;
+    }
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RefPtr<RegisterID> value = generator.newTemporary();
+    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), value.get(), m_ident);
+    RegisterID* oldValue;
+    if (dst == generator.ignoredResult()) {
+        oldValue = 0;
+        emitPreIncOrDec(generator, value.get(), m_operator);
+    } else {
+        oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
+    }
+    generator.emitPutById(base.get(), m_ident, value.get());
+    return oldValue;
+}
+
+// ------------------------------ PostfixBracketNode ----------------------------------
+
+RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
+    RegisterID* oldValue;
+    if (dst == generator.ignoredResult()) {
+        oldValue = 0;
+        if (m_operator == OpPlusPlus)
+            generator.emitPreInc(value.get());
+        else
+            generator.emitPreDec(value.get());
+    } else {
+        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
+    }
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), value.get());
+    return oldValue;
+}
+
+// ------------------------------ PostfixDotNode ----------------------------------
+
+RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);
+    RegisterID* oldValue;
+    if (dst == generator.ignoredResult()) {
+        oldValue = 0;
+        if (m_operator == OpPlusPlus)
+            generator.emitPreInc(value.get());
+        else
+            generator.emitPreDec(value.get());
+    } else {
+        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
+    }
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutById(base.get(), m_ident, value.get());
+    return oldValue;
+}
+
+// ------------------------------ PostfixErrorNode -----------------------------------
+
+RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
+        ? "Postfix ++ operator applied to value that is not a reference."
+        : "Postfix -- operator applied to value that is not a reference.");
+}
+
+// ------------------------------ DeleteResolveNode -----------------------------------
+
+RegisterID* DeleteResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (generator.registerFor(m_ident))
+        return generator.emitLoad(generator.finalDestination(dst), false);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RegisterID* base = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
+    return generator.emitDeleteById(generator.finalDestination(dst, base), base, m_ident);
+}
+
+// ------------------------------ DeleteBracketNode -----------------------------------
+
+RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> r0 = generator.emitNode(m_base);
+    RegisterID* r1 = generator.emitNode(m_subscript);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitDeleteByVal(generator.finalDestination(dst), r0.get(), r1);
+}
+
+// ------------------------------ DeleteDotNode -----------------------------------
+
+RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RegisterID* r0 = generator.emitNode(m_base);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitDeleteById(generator.finalDestination(dst), r0, m_ident);
+}
+
+// ------------------------------ DeleteValueNode -----------------------------------
+
+RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitNode(generator.ignoredResult(), m_expr);
+
+    // delete on a non-location expression ignores the value and returns true
+    return generator.emitLoad(generator.finalDestination(dst), true);
+}
+
+// ------------------------------ VoidNode -------------------------------------
+
+RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult()) {
+        generator.emitNode(generator.ignoredResult(), m_expr);
+        return 0;
+    }
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
+    return generator.emitLoad(dst, jsUndefined());
+}
+
+// ------------------------------ TypeOfValueNode -----------------------------------
+
+RegisterID* TypeOfResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (dst == generator.ignoredResult())
+            return 0;
+        return generator.emitTypeOf(generator.finalDestination(dst), local);
+    }
+
+    RefPtr<RegisterID> scratch = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
+    generator.emitGetById(scratch.get(), scratch.get(), m_ident);
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitTypeOf(generator.finalDestination(dst, scratch.get()), scratch.get());
+}
+
+// ------------------------------ TypeOfValueNode -----------------------------------
+
+RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult()) {
+        generator.emitNode(generator.ignoredResult(), m_expr);
+        return 0;
+    }
+    RefPtr<RegisterID> src = generator.emitNode(m_expr);
+    return generator.emitTypeOf(generator.finalDestination(dst), src.get());
+}
+
+// ------------------------------ PrefixResolveNode ----------------------------------
+
+RegisterID* PrefixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident)) {
+            if (dst == generator.ignoredResult())
+                return 0;
+            RefPtr<RegisterID> r0 = generator.emitLoad(generator.finalDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
+            return generator.emitBinaryOp(op_add, r0.get(), local, r0.get(), OperandTypes());
+        }
+
+        emitPreIncOrDec(generator, local, m_operator);
+        return generator.moveToDestinationIfNeeded(dst, local);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> propDst = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
+        emitPreIncOrDec(generator, propDst.get(), m_operator);
+        generator.emitPutScopedVar(depth, index, propDst.get(), globalObject);
+        return generator.moveToDestinationIfNeeded(dst, propDst.get());
+    }
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
+    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), propDst.get(), m_ident);
+    emitPreIncOrDec(generator, propDst.get(), m_operator);
+    generator.emitPutById(base.get(), m_ident, propDst.get());
+    return generator.moveToDestinationIfNeeded(dst, propDst.get());
+}
+
+// ------------------------------ PrefixBracketNode ----------------------------------
+
+RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
+    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
+
+    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
+    RegisterID* value = generator.emitGetByVal(propDst.get(), base.get(), property.get());
+    if (m_operator == OpPlusPlus)
+        generator.emitPreInc(value);
+    else
+        generator.emitPreDec(value);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), value);
+    return generator.moveToDestinationIfNeeded(dst, propDst.get());
+}
+
+// ------------------------------ PrefixDotNode ----------------------------------
+
+RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
+
+    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
+    RegisterID* value = generator.emitGetById(propDst.get(), base.get(), m_ident);
+    if (m_operator == OpPlusPlus)
+        generator.emitPreInc(value);
+    else
+        generator.emitPreDec(value);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutById(base.get(), m_ident, value);
+    return generator.moveToDestinationIfNeeded(dst, propDst.get());
+}
+
+// ------------------------------ PrefixErrorNode -----------------------------------
+
+RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
+        ? "Prefix ++ operator applied to value that is not a reference."
+        : "Prefix -- operator applied to value that is not a reference.");
+}
+
+// ------------------------------ Unary Operation Nodes -----------------------------------
+
+RegisterID* UnaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RegisterID* src = generator.emitNode(m_expr);
+    return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src);
+}
+
+
+// ------------------------------ LogicalNotNode -----------------------------------
+
+void LogicalNotNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)
+{
+    ASSERT(expr()->hasConditionContextCodegen());
+
+    // reverse the true and false targets
+    generator.emitNodeInConditionContext(expr(), falseTarget, trueTarget, !fallThroughMeansTrue);
+}
+
+
+// ------------------------------ Binary Operation Nodes -----------------------------------
+
+// BinaryOpNode::emitStrcat:
+//
+// This node generates an op_strcat operation.  This opcode can handle concatenation of three or
+// more values, where we can determine a set of separate op_add operations would be operating on
+// string values.
+//
+// This function expects to be operating on a graph of AST nodes looking something like this:
+//
+//     (a)...     (b)
+//          \   /
+//           (+)     (c)
+//              \   /
+//      [d]     ((+))
+//         \    /
+//          [+=]
+//
+// The assignment operation is optional, if it exists the register holding the value on the
+// lefthand side of the assignment should be passing as the optional 'lhs' argument.
+//
+// The method should be called on the node at the root of the tree of regular binary add
+// operations (marked in the diagram with a double set of parentheses).  This node must
+// be performing a string concatenation (determined by statically detecting that at least
+// one child must be a string).  
+//
+// Since the minimum number of values being concatenated together is expected to be 3, if
+// a lhs to a concatenating assignment is not provided then the  root add should have at
+// least one left child that is also an add that can be determined to be operating on strings.
+//
+RegisterID* BinaryOpNode::emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs, ReadModifyResolveNode* emitExpressionInfoForMe)
+{
+    ASSERT(isAdd());
+    ASSERT(resultDescriptor().definitelyIsString());
+
+    // Create a list of expressions for all the adds in the tree of nodes we can convert into
+    // a string concatenation.  The rightmost node (c) is added first.  The rightmost node is
+    // added first, and the leftmost child is never added, so the vector produced for the
+    // example above will be [ c, b ].
+    Vector<ExpressionNode*, 16> reverseExpressionList;
+    reverseExpressionList.append(m_expr2);
+
+    // Examine the left child of the add.  So long as this is a string add, add its right-child
+    // to the list, and keep processing along the left fork.
+    ExpressionNode* leftMostAddChild = m_expr1;
+    while (leftMostAddChild->isAdd() && leftMostAddChild->resultDescriptor().definitelyIsString()) {
+        reverseExpressionList.append(static_cast<AddNode*>(leftMostAddChild)->m_expr2);
+        leftMostAddChild = static_cast<AddNode*>(leftMostAddChild)->m_expr1;
+    }
+
+    Vector<RefPtr<RegisterID>, 16> temporaryRegisters;
+
+    // If there is an assignment, allocate a temporary to hold the lhs after conversion.
+    // We could possibly avoid this (the lhs is converted last anyway, we could let the
+    // op_strcat node handle its conversion if required).
+    if (lhs)
+        temporaryRegisters.append(generator.newTemporary());
+
+    // Emit code for the leftmost node ((a) in the example).
+    temporaryRegisters.append(generator.newTemporary());
+    RegisterID* leftMostAddChildTempRegister = temporaryRegisters.last().get();
+    generator.emitNode(leftMostAddChildTempRegister, leftMostAddChild);
+
+    // Note on ordering of conversions:
+    //
+    // We maintain the same ordering of conversions as we would see if the concatenations
+    // was performed as a sequence of adds (otherwise this optimization could change
+    // behaviour should an object have been provided a valueOf or toString method).
+    //
+    // Considering the above example, the sequnce of execution is:
+    //     * evaluate operand (a)
+    //     * evaluate operand (b)
+    //     * convert (a) to primitive   <-  (this would be triggered by the first add)
+    //     * convert (b) to primitive   <-  (ditto)
+    //     * evaluate operand (c)
+    //     * convert (c) to primitive   <-  (this would be triggered by the second add)
+    // And optionally, if there is an assignment:
+    //     * convert (d) to primitive   <-  (this would be triggered by the assigning addition)
+    //
+    // As such we do not plant an op to convert the leftmost child now.  Instead, use
+    // 'leftMostAddChildTempRegister' as a flag to trigger generation of the conversion
+    // once the second node has been generated.  However, if the leftmost child is an
+    // immediate we can trivially determine that no conversion will be required.
+    // If this is the case
+    if (leftMostAddChild->isString())
+        leftMostAddChildTempRegister = 0;
+
+    while (reverseExpressionList.size()) {
+        ExpressionNode* node = reverseExpressionList.last();
+        reverseExpressionList.removeLast();
+
+        // Emit the code for the current node.
+        temporaryRegisters.append(generator.newTemporary());
+        generator.emitNode(temporaryRegisters.last().get(), node);
+
+        // On the first iteration of this loop, when we first reach this point we have just
+        // generated the second node, which means it is time to convert the leftmost operand.
+        if (leftMostAddChildTempRegister) {
+            generator.emitToPrimitive(leftMostAddChildTempRegister, leftMostAddChildTempRegister);
+            leftMostAddChildTempRegister = 0; // Only do this once.
+        }
+        // Plant a conversion for this node, if necessary.
+        if (!node->isString())
+            generator.emitToPrimitive(temporaryRegisters.last().get(), temporaryRegisters.last().get());
+    }
+    ASSERT(temporaryRegisters.size() >= 3);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
+
+    // If there is an assignment convert the lhs now.  This will also copy lhs to
+    // the temporary register we allocated for it.
+    if (lhs)
+        generator.emitToPrimitive(temporaryRegisters[0].get(), lhs);
+
+    return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());
+}
+
+RegisterID* BinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    OpcodeID opcodeID = this->opcodeID();
+
+    if (opcodeID == op_add && m_expr1->isAdd() && m_expr1->resultDescriptor().definitelyIsString())
+        return emitStrcat(generator, dst);
+
+    if (opcodeID == op_neq) {
+        if (m_expr1->isNull() || m_expr2->isNull()) {
+            RefPtr<RegisterID> src = generator.tempDestination(dst);
+            generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
+            return generator.emitUnaryOp(op_neq_null, generator.finalDestination(dst, src.get()), src.get());
+        }
+    }
+
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitBinaryOp(opcodeID, generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
+}
+
+RegisterID* EqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_expr1->isNull() || m_expr2->isNull()) {
+        RefPtr<RegisterID> src = generator.tempDestination(dst);
+        generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
+        return generator.emitUnaryOp(op_eq_null, generator.finalDestination(dst, src.get()), src.get());
+    }
+
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitEqualityOp(op_eq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
+}
+
+RegisterID* StrictEqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitEqualityOp(op_stricteq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
+}
+
+RegisterID* ReverseBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src2, src1.get(), OperandTypes(m_expr2->resultDescriptor(), m_expr1->resultDescriptor()));
+}
+
+RegisterID* ThrowableBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
+}
+
+RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RefPtr<RegisterID> src2 = generator.emitNode(m_expr2);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitGetByIdExceptionInfo(op_instanceof);
+    RegisterID* src2Prototype = generator.emitGetById(generator.newTemporary(), src2.get(), generator.globalData()->propertyNames->prototype);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitInstanceOf(generator.finalDestination(dst, src1.get()), src1.get(), src2.get(), src2Prototype);
+}
+
+// ------------------------------ LogicalOpNode ----------------------------
+
+RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> temp = generator.tempDestination(dst);
+    RefPtr<Label> target = generator.newLabel();
+    
+    generator.emitNode(temp.get(), m_expr1);
+    if (m_operator == OpLogicalAnd)
+        generator.emitJumpIfFalse(temp.get(), target.get());
+    else
+        generator.emitJumpIfTrue(temp.get(), target.get());
+    generator.emitNode(temp.get(), m_expr2);
+    generator.emitLabel(target.get());
+
+    return generator.moveToDestinationIfNeeded(dst, temp.get());
+}
+
+void LogicalOpNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)
+{
+    if (m_expr1->hasConditionContextCodegen()) {
+        RefPtr<Label> afterExpr1 = generator.newLabel();
+        if (m_operator == OpLogicalAnd)
+            generator.emitNodeInConditionContext(m_expr1, afterExpr1.get(), falseTarget, true);
+        else 
+            generator.emitNodeInConditionContext(m_expr1, trueTarget, afterExpr1.get(), false);
+        generator.emitLabel(afterExpr1.get());
+    } else {
+        RegisterID* temp = generator.emitNode(m_expr1);
+        if (m_operator == OpLogicalAnd)
+            generator.emitJumpIfFalse(temp, falseTarget);
+        else
+            generator.emitJumpIfTrue(temp, trueTarget);
+    }
+
+    if (m_expr2->hasConditionContextCodegen())
+        generator.emitNodeInConditionContext(m_expr2, trueTarget, falseTarget, fallThroughMeansTrue);
+    else {
+        RegisterID* temp = generator.emitNode(m_expr2);
+        if (fallThroughMeansTrue)
+            generator.emitJumpIfFalse(temp, falseTarget);
+        else
+            generator.emitJumpIfTrue(temp, trueTarget);
+    }
+}
+
+// ------------------------------ ConditionalNode ------------------------------
+
+RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> newDst = generator.finalDestination(dst);
+    RefPtr<Label> beforeElse = generator.newLabel();
+    RefPtr<Label> afterElse = generator.newLabel();
+
+    if (m_logical->hasConditionContextCodegen()) {
+        RefPtr<Label> beforeThen = generator.newLabel();
+        generator.emitNodeInConditionContext(m_logical, beforeThen.get(), beforeElse.get(), true);
+        generator.emitLabel(beforeThen.get());
+    } else {
+        RegisterID* cond = generator.emitNode(m_logical);
+        generator.emitJumpIfFalse(cond, beforeElse.get());
+    }
+
+    generator.emitNode(newDst.get(), m_expr1);
+    generator.emitJump(afterElse.get());
+
+    generator.emitLabel(beforeElse.get());
+    generator.emitNode(newDst.get(), m_expr2);
+
+    generator.emitLabel(afterElse.get());
+
+    return newDst.get();
+}
+
+// ------------------------------ ReadModifyResolveNode -----------------------------------
+
+// FIXME: should this be moved to be a method on BytecodeGenerator?
+static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, ExpressionNode* m_right, Operator oper, OperandTypes types, ReadModifyResolveNode* emitExpressionInfoForMe = 0)
+{
+    OpcodeID opcodeID;
+    switch (oper) {
+        case OpMultEq:
+            opcodeID = op_mul;
+            break;
+        case OpDivEq:
+            opcodeID = op_div;
+            break;
+        case OpPlusEq:
+            if (m_right->isAdd() && m_right->resultDescriptor().definitelyIsString())
+                return static_cast<AddNode*>(m_right)->emitStrcat(generator, dst, src1, emitExpressionInfoForMe);
+            opcodeID = op_add;
+            break;
+        case OpMinusEq:
+            opcodeID = op_sub;
+            break;
+        case OpLShift:
+            opcodeID = op_lshift;
+            break;
+        case OpRShift:
+            opcodeID = op_rshift;
+            break;
+        case OpURShift:
+            opcodeID = op_urshift;
+            break;
+        case OpAndEq:
+            opcodeID = op_bitand;
+            break;
+        case OpXOrEq:
+            opcodeID = op_bitxor;
+            break;
+        case OpOrEq:
+            opcodeID = op_bitor;
+            break;
+        case OpModEq:
+            opcodeID = op_mod;
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            return dst;
+    }
+
+    RegisterID* src2 = generator.emitNode(m_right);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
+
+    return generator.emitBinaryOp(opcodeID, dst, src1, src2, types);
+}
+
+RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident)) {
+            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        }
+        
+        if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
+            RefPtr<RegisterID> result = generator.newTemporary();
+            generator.emitMove(result.get(), local);
+            emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+            generator.emitMove(local, result.get());
+            return generator.moveToDestinationIfNeeded(dst, result.get());
+        }
+        
+        RegisterID* result = emitReadModifyAssignment(generator, local, local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        return generator.moveToDestinationIfNeeded(dst, result);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> src1 = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
+        RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        generator.emitPutScopedVar(depth, index, result, globalObject);
+        return result;
+    }
+
+    RefPtr<RegisterID> src1 = generator.tempDestination(dst);
+    generator.emitExpressionInfo(divot() - startOffset() + m_ident.size(), m_ident.size(), 0);
+    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), src1.get(), m_ident);
+    RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()), this);
+    return generator.emitPutById(base.get(), m_ident, result);
+}
+
+// ------------------------------ AssignResolveNode -----------------------------------
+
+RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident))
+            return generator.emitNode(dst, m_right);
+        
+        RegisterID* result = generator.emitNode(local, m_right);
+        return generator.moveToDestinationIfNeeded(dst, result);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
+        if (dst == generator.ignoredResult())
+            dst = 0;
+        RegisterID* value = generator.emitNode(dst, m_right);
+        generator.emitPutScopedVar(depth, index, value, globalObject);
+        return value;
+    }
+
+    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    RegisterID* value = generator.emitNode(dst, m_right);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitPutById(base.get(), m_ident, value);
+}
+
+// ------------------------------ AssignDotNode -----------------------------------
+
+RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
+    RegisterID* result = generator.emitNode(value.get(), m_right);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutById(base.get(), m_ident, result);
+    return generator.moveToDestinationIfNeeded(dst, result);
+}
+
+// ------------------------------ ReadModifyDotNode -----------------------------------
+
+RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitPutById(base.get(), m_ident, updatedValue);
+}
+
+// ------------------------------ AssignErrorNode -----------------------------------
+
+RegisterID* AssignErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    return emitThrowError(generator, ReferenceError, "Left side of assignment is not a reference.");
+}
+
+// ------------------------------ AssignBracketNode -----------------------------------
+
+RegisterID* AssignBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
+    RegisterID* result = generator.emitNode(value.get(), m_right);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), result);
+    return generator.moveToDestinationIfNeeded(dst, result);
+}
+
+// ------------------------------ ReadModifyBracketNode -----------------------------------
+
+RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), updatedValue);
+
+    return updatedValue;
+}
+
+// ------------------------------ CommaNode ------------------------------------
+
+RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expressions.size() > 1);
+    for (size_t i = 0; i < m_expressions.size() - 1; i++)
+        generator.emitNode(generator.ignoredResult(), m_expressions[i]);
+    return generator.emitNode(dst, m_expressions.last());
+}
+
+// ------------------------------ ConstDeclNode ------------------------------------
+
+RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator& generator)
+{
+    if (RegisterID* local = generator.constRegisterFor(m_ident)) {
+        if (!m_init)
+            return local;
+
+        return generator.emitNode(local, m_init);
+    }
+
+    if (generator.codeType() != EvalCode) {
+        if (m_init)
+            return generator.emitNode(m_init);
+        else
+            return generator.emitResolve(generator.newTemporary(), m_ident);
+    }
+    // FIXME: While this code should only be hit in eval code, it will potentially
+    // assign to the wrong base if m_ident exists in an intervening dynamic scope.
+    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
+    RegisterID* value = m_init ? generator.emitNode(m_init) : generator.emitLoad(0, jsUndefined());
+    return generator.emitPutById(base.get(), m_ident, value);
+}
+
+RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    RegisterID* result = 0;
+    for (ConstDeclNode* n = this; n; n = n->m_next)
+        result = n->emitCodeSingle(generator);
+
+    return result;
+}
+
+// ------------------------------ ConstStatementNode -----------------------------
+
+RegisterID* ConstStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return generator.emitNode(m_next);
+}
+
+// ------------------------------ SourceElements -------------------------------
+
+
+inline StatementNode* SourceElements::lastStatement() const
+{
+    size_t size = m_statements.size();
+    return size ? m_statements[size - 1] : 0;
+}
+
+inline void SourceElements::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    size_t size = m_statements.size();
+    for (size_t i = 0; i < size; ++i)
+        generator.emitNode(dst, m_statements[i]);
+}
+
+// ------------------------------ BlockNode ------------------------------------
+
+inline StatementNode* BlockNode::lastStatement() const
+{
+    return m_statements ? m_statements->lastStatement() : 0;
+}
+
+RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_statements)
+        m_statements->emitBytecode(generator, dst);
+    return 0;
+}
+
+// ------------------------------ EmptyStatementNode ---------------------------
+
+RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return dst;
+}
+
+// ------------------------------ DebuggerStatementNode ---------------------------
+
+RegisterID* DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(DidReachBreakpoint, firstLine(), lastLine());
+    return dst;
+}
+
+// ------------------------------ ExprStatementNode ----------------------------
+
+RegisterID* ExprStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expr);
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine()); 
+    return generator.emitNode(dst, m_expr);
+}
+
+// ------------------------------ VarStatementNode ----------------------------
+
+RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    ASSERT(m_expr);
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return generator.emitNode(m_expr);
+}
+
+// ------------------------------ IfNode ---------------------------------------
+
+RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<Label> afterThen = generator.newLabel();
+
+    if (m_condition->hasConditionContextCodegen()) {
+        RefPtr<Label> beforeThen = generator.newLabel();
+        generator.emitNodeInConditionContext(m_condition, beforeThen.get(), afterThen.get(), true);
+        generator.emitLabel(beforeThen.get());
+    } else {
+        RegisterID* cond = generator.emitNode(m_condition);
+        generator.emitJumpIfFalse(cond, afterThen.get());
+    }
+
+    generator.emitNode(dst, m_ifBlock);
+    generator.emitLabel(afterThen.get());
+
+    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
+    return 0;
+}
+
+// ------------------------------ IfElseNode ---------------------------------------
+
+RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<Label> beforeElse = generator.newLabel();
+    RefPtr<Label> afterElse = generator.newLabel();
+
+    if (m_condition->hasConditionContextCodegen()) {
+        RefPtr<Label> beforeThen = generator.newLabel();
+        generator.emitNodeInConditionContext(m_condition, beforeThen.get(), beforeElse.get(), true);
+        generator.emitLabel(beforeThen.get());
+    } else {
+        RegisterID* cond = generator.emitNode(m_condition);
+        generator.emitJumpIfFalse(cond, beforeElse.get());
+    }
+
+    generator.emitNode(dst, m_ifBlock);
+    generator.emitJump(afterElse.get());
+
+    generator.emitLabel(beforeElse.get());
+
+    generator.emitNode(dst, m_elseBlock);
+
+    generator.emitLabel(afterElse.get());
+
+    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
+    return 0;
+}
+
+// ------------------------------ DoWhileNode ----------------------------------
+
+RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    RefPtr<Label> topOfLoop = generator.newLabel();
+    generator.emitLabel(topOfLoop.get());
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+   
+    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
+    if (m_expr->hasConditionContextCodegen())
+        generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), false);
+    else {
+        RegisterID* cond = generator.emitNode(m_expr);
+        generator.emitJumpIfTrue(cond, topOfLoop.get());
+    }
+
+    generator.emitLabel(scope->breakTarget());
+    return result.get();
+}
+
+// ------------------------------ WhileNode ------------------------------------
+
+RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    generator.emitJump(scope->continueTarget());
+
+    RefPtr<Label> topOfLoop = generator.newLabel();
+    generator.emitLabel(topOfLoop.get());
+    
+    generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
+
+    if (m_expr->hasConditionContextCodegen())
+        generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), false);
+    else {
+        RegisterID* cond = generator.emitNode(m_expr);
+        generator.emitJumpIfTrue(cond, topOfLoop.get());
+    }
+
+    generator.emitLabel(scope->breakTarget());
+    
+    // FIXME: This should return the last statement executed so that it can be returned as a Completion
+    return 0;
+}
+
+// ------------------------------ ForNode --------------------------------------
+
+RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (m_expr1)
+        generator.emitNode(generator.ignoredResult(), m_expr1);
+
+    RefPtr<Label> condition = generator.newLabel();
+    generator.emitJump(condition.get());
+
+    RefPtr<Label> topOfLoop = generator.newLabel();
+    generator.emitLabel(topOfLoop.get());
+
+    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    if (m_expr3)
+        generator.emitNode(generator.ignoredResult(), m_expr3);
+
+    generator.emitLabel(condition.get());
+    if (m_expr2) {
+        if (m_expr2->hasConditionContextCodegen())
+            generator.emitNodeInConditionContext(m_expr2, topOfLoop.get(), scope->breakTarget(), false);
+        else {
+            RegisterID* cond = generator.emitNode(m_expr2);
+            generator.emitJumpIfTrue(cond, topOfLoop.get());
+        }
+    } else
+        generator.emitJump(topOfLoop.get());
+
+    generator.emitLabel(scope->breakTarget());
+    return result.get();
+}
+
+// ------------------------------ ForInNode ------------------------------------
+
+RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    if (!m_lexpr->isLocation())
+        return emitThrowError(generator, ReferenceError, "Left side of for-in statement is not a reference.");
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (m_init)
+        generator.emitNode(generator.ignoredResult(), m_init);
+
+    RefPtr<RegisterID> base = generator.newTemporary();
+    generator.emitNode(base.get(), m_expr);
+    RefPtr<RegisterID> i = generator.newTemporary();
+    RefPtr<RegisterID> size = generator.newTemporary();
+    RefPtr<RegisterID> expectedSubscript;
+    RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), base.get(), i.get(), size.get(), scope->breakTarget());
+    generator.emitJump(scope->continueTarget());
+
+    RefPtr<Label> loopStart = generator.newLabel();
+    generator.emitLabel(loopStart.get());
+
+    RegisterID* propertyName;
+    bool optimizedForinAccess = false;
+    if (m_lexpr->isResolveNode()) {
+        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
+        propertyName = generator.registerFor(ident);
+        if (!propertyName) {
+            propertyName = generator.newTemporary();
+            RefPtr<RegisterID> protect = propertyName;
+            RegisterID* base = generator.emitResolveBase(generator.newTemporary(), ident);
+
+            generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+            generator.emitPutById(base, ident, propertyName);
+        } else {
+            expectedSubscript = generator.emitMove(generator.newTemporary(), propertyName);
+            generator.pushOptimisedForIn(expectedSubscript.get(), iter.get(), i.get(), propertyName);
+            optimizedForinAccess = true;
+        }
+    } else if (m_lexpr->isDotAccessorNode()) {
+        DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
+        const Identifier& ident = assignNode->identifier();
+        propertyName = generator.newTemporary();
+        RefPtr<RegisterID> protect = propertyName;
+        RegisterID* base = generator.emitNode(assignNode->base());
+
+        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
+        generator.emitPutById(base, ident, propertyName);
+    } else {
+        ASSERT(m_lexpr->isBracketAccessorNode());
+        BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr);
+        propertyName = generator.newTemporary();
+        RefPtr<RegisterID> protect = propertyName;
+        RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
+        RegisterID* subscript = generator.emitNode(assignNode->subscript());
+        
+        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
+        generator.emitPutByVal(base.get(), subscript, propertyName);
+    }   
+
+    generator.emitNode(dst, m_statement);
+
+    if (optimizedForinAccess)
+        generator.popOptimisedForIn();
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitNextPropertyName(propertyName, base.get(), i.get(), size.get(), iter.get(), loopStart.get());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitLabel(scope->breakTarget());
+    return dst;
+}
+
+// ------------------------------ ContinueNode ---------------------------------
+
+// ECMA 12.7
+RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    LabelScope* scope = generator.continueTarget(m_ident);
+
+    if (!scope)
+        return m_ident.isEmpty()
+            ? emitThrowError(generator, SyntaxError, "Invalid continue statement.")
+            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
+
+    generator.emitJumpScopes(scope->continueTarget(), scope->scopeDepth());
+    return dst;
+}
+
+// ------------------------------ BreakNode ------------------------------------
+
+// ECMA 12.8
+RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    LabelScope* scope = generator.breakTarget(m_ident);
+    
+    if (!scope)
+        return m_ident.isEmpty()
+            ? emitThrowError(generator, SyntaxError, "Invalid break statement.")
+            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
+
+    generator.emitJumpScopes(scope->breakTarget(), scope->scopeDepth());
+    return dst;
+}
+
+// ------------------------------ ReturnNode -----------------------------------
+
+RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    if (generator.codeType() != FunctionCode)
+        return emitThrowError(generator, SyntaxError, "Invalid return statement.");
+
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    RegisterID* r0 = m_value ? generator.emitNode(dst, m_value) : generator.emitLoad(dst, jsUndefined());
+    RefPtr<RegisterID> returnRegister;
+    if (generator.scopeDepth()) {
+        RefPtr<Label> l0 = generator.newLabel();
+        if (generator.hasFinaliser() && !r0->isTemporary()) {
+            returnRegister = generator.emitMove(generator.newTemporary(), r0);
+            r0 = returnRegister.get();
+        }
+        generator.emitJumpScopes(l0.get(), 0);
+        generator.emitLabel(l0.get());
+    }
+    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
+    return generator.emitReturn(r0);
+}
+
+// ------------------------------ WithNode -------------------------------------
+
+RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<RegisterID> scope = generator.newTemporary();
+    generator.emitNode(scope.get(), m_expr); // scope must be protected until popped
+    generator.emitExpressionInfo(m_divot, m_expressionLength, 0);
+    generator.emitPushScope(scope.get());
+    RegisterID* result = generator.emitNode(dst, m_statement);
+    generator.emitPopScope();
+    return result;
+}
+
+// ------------------------------ CaseClauseNode --------------------------------
+
+inline void CaseClauseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_statements)
+        m_statements->emitBytecode(generator, dst);
+}
+
+// ------------------------------ CaseBlockNode --------------------------------
+
+enum SwitchKind { 
+    SwitchUnset = 0,
+    SwitchNumber = 1, 
+    SwitchString = 2, 
+    SwitchNeither = 3 
+};
+
+static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>& literalVector, SwitchKind& typeForTable, bool& singleCharacterSwitch, int32_t& min_num, int32_t& max_num)
+{
+    for (; list; list = list->getNext()) {
+        ExpressionNode* clauseExpression = list->getClause()->expr();
+        literalVector.append(clauseExpression);
+        if (clauseExpression->isNumber()) {
+            double value = static_cast<NumberNode*>(clauseExpression)->value();
+            int32_t intVal = static_cast<int32_t>(value);
+            if ((typeForTable & ~SwitchNumber) || (intVal != value)) {
+                typeForTable = SwitchNeither;
+                break;
+            }
+            if (intVal < min_num)
+                min_num = intVal;
+            if (intVal > max_num)
+                max_num = intVal;
+            typeForTable = SwitchNumber;
+            continue;
+        }
+        if (clauseExpression->isString()) {
+            if (typeForTable & ~SwitchString) {
+                typeForTable = SwitchNeither;
+                break;
+            }
+            const UString& value = static_cast<StringNode*>(clauseExpression)->value().ustring();
+            if (singleCharacterSwitch &= value.size() == 1) {
+                int32_t intVal = value.rep()->characters()[0];
+                if (intVal < min_num)
+                    min_num = intVal;
+                if (intVal > max_num)
+                    max_num = intVal;
+            }
+            typeForTable = SwitchString;
+            continue;
+        }
+        typeForTable = SwitchNeither;
+        break;        
+    }
+}
+    
+SwitchInfo::SwitchType CaseBlockNode::tryOptimizedSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num)
+{
+    SwitchKind typeForTable = SwitchUnset;
+    bool singleCharacterSwitch = true;
+    
+    processClauseList(m_list1, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    processClauseList(m_list2, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    
+    if (typeForTable == SwitchUnset || typeForTable == SwitchNeither)
+        return SwitchInfo::SwitchNone;
+    
+    if (typeForTable == SwitchNumber) {
+        int32_t range = max_num - min_num;
+        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
+            return SwitchInfo::SwitchImmediate;
+        return SwitchInfo::SwitchNone;
+    } 
+    
+    ASSERT(typeForTable == SwitchString);
+    
+    if (singleCharacterSwitch) {
+        int32_t range = max_num - min_num;
+        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
+            return SwitchInfo::SwitchCharacter;
+    }
+
+    return SwitchInfo::SwitchString;
+}
+
+RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, RegisterID* switchExpression, RegisterID* dst)
+{
+    RefPtr<Label> defaultLabel;
+    Vector<RefPtr<Label>, 8> labelVector;
+    Vector<ExpressionNode*, 8> literalVector;
+    int32_t min_num = std::numeric_limits<int32_t>::max();
+    int32_t max_num = std::numeric_limits<int32_t>::min();
+    SwitchInfo::SwitchType switchType = tryOptimizedSwitch(literalVector, min_num, max_num);
+
+    if (switchType != SwitchInfo::SwitchNone) {
+        // Prepare the various labels
+        for (uint32_t i = 0; i < literalVector.size(); i++)
+            labelVector.append(generator.newLabel());
+        defaultLabel = generator.newLabel();
+        generator.beginSwitch(switchExpression, switchType);
+    } else {
+        // Setup jumps
+        for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
+            RefPtr<RegisterID> clauseVal = generator.newTemporary();
+            generator.emitNode(clauseVal.get(), list->getClause()->expr());
+            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
+            labelVector.append(generator.newLabel());
+            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
+        }
+        
+        for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
+            RefPtr<RegisterID> clauseVal = generator.newTemporary();
+            generator.emitNode(clauseVal.get(), list->getClause()->expr());
+            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
+            labelVector.append(generator.newLabel());
+            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
+        }
+        defaultLabel = generator.newLabel();
+        generator.emitJump(defaultLabel.get());
+    }
+
+    RegisterID* result = 0;
+
+    size_t i = 0;
+    for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
+        generator.emitLabel(labelVector[i++].get());
+        list->getClause()->emitBytecode(generator, dst);
+    }
+
+    if (m_defaultClause) {
+        generator.emitLabel(defaultLabel.get());
+        m_defaultClause->emitBytecode(generator, dst);
+    }
+
+    for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
+        generator.emitLabel(labelVector[i++].get());
+        list->getClause()->emitBytecode(generator, dst);
+    }
+    if (!m_defaultClause)
+        generator.emitLabel(defaultLabel.get());
+
+    ASSERT(i == labelVector.size());
+    if (switchType != SwitchInfo::SwitchNone) {
+        ASSERT(labelVector.size() == literalVector.size());
+        generator.endSwitch(labelVector.size(), labelVector.data(), literalVector.data(), defaultLabel.get(), min_num, max_num);
+    }
+    return result;
+}
+
+// ------------------------------ SwitchNode -----------------------------------
+
+RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Switch);
+
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
+    RegisterID* r1 = m_block->emitBytecodeForBlock(generator, r0.get(), dst);
+
+    generator.emitLabel(scope->breakTarget());
+    return r1;
+}
+
+// ------------------------------ LabelNode ------------------------------------
+
+RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (generator.breakTarget(m_name))
+        return emitThrowError(generator, SyntaxError, "Duplicate label: %s.", m_name);
+
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::NamedLabel, &m_name);
+    RegisterID* r0 = generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->breakTarget());
+    return r0;
+}
+
+// ------------------------------ ThrowNode ------------------------------------
+
+RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    RefPtr<RegisterID> expr = generator.emitNode(m_expr);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitThrow(expr.get());
+    return 0;
+}
+
+// ------------------------------ TryNode --------------------------------------
+
+RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // NOTE: The catch and finally blocks must be labeled explicitly, so the
+    // optimizer knows they may be jumped to from anywhere.
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    RefPtr<Label> tryStartLabel = generator.newLabel();
+    RefPtr<Label> finallyStart;
+    RefPtr<RegisterID> finallyReturnAddr;
+    if (m_finallyBlock) {
+        finallyStart = generator.newLabel();
+        finallyReturnAddr = generator.newTemporary();
+        generator.pushFinallyContext(finallyStart.get(), finallyReturnAddr.get());
+    }
+
+    generator.emitLabel(tryStartLabel.get());
+    generator.emitNode(dst, m_tryBlock);
+
+    if (m_catchBlock) {
+        RefPtr<Label> catchEndLabel = generator.newLabel();
+        
+        // Normal path: jump over the catch block.
+        generator.emitJump(catchEndLabel.get());
+
+        // Uncaught exception path: the catch block.
+        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
+        RefPtr<RegisterID> exceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
+        if (m_catchHasEval) {
+            RefPtr<RegisterID> dynamicScopeObject = generator.emitNewObject(generator.newTemporary());
+            generator.emitPutById(dynamicScopeObject.get(), m_exceptionIdent, exceptionRegister.get());
+            generator.emitMove(exceptionRegister.get(), dynamicScopeObject.get());
+            generator.emitPushScope(exceptionRegister.get());
+        } else
+            generator.emitPushNewScope(exceptionRegister.get(), m_exceptionIdent, exceptionRegister.get());
+        generator.emitNode(dst, m_catchBlock);
+        generator.emitPopScope();
+        generator.emitLabel(catchEndLabel.get());
+    }
+
+    if (m_finallyBlock) {
+        generator.popFinallyContext();
+        // there may be important registers live at the time we jump
+        // to a finally block (such as for a return or throw) so we
+        // ref the highest register ever used as a conservative
+        // approach to not clobbering anything important
+        RefPtr<RegisterID> highestUsedRegister = generator.highestUsedRegister();
+        RefPtr<Label> finallyEndLabel = generator.newLabel();
+
+        // Normal path: invoke the finally block, then jump over it.
+        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
+        generator.emitJump(finallyEndLabel.get());
+
+        // Uncaught exception path: invoke the finally block, then re-throw the exception.
+        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
+        RefPtr<RegisterID> tempExceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
+        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
+        generator.emitThrow(tempExceptionRegister.get());
+
+        // The finally block.
+        generator.emitLabel(finallyStart.get());
+        generator.emitNode(dst, m_finallyBlock);
+        generator.emitSubroutineReturn(finallyReturnAddr.get());
+
+        generator.emitLabel(finallyEndLabel.get());
+    }
+
+    return dst;
+}
+
+// ------------------------------ ScopeNode -----------------------------
+
+inline void ScopeNode::emitStatementsBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_data->m_statements)
+        m_data->m_statements->emitBytecode(generator, dst);
+}
+
+// ------------------------------ ProgramNode -----------------------------
+
+RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
+
+    RefPtr<RegisterID> dstRegister = generator.newTemporary();
+    generator.emitLoad(dstRegister.get(), jsUndefined());
+    emitStatementsBytecode(generator, dstRegister.get());
+
+    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
+    generator.emitEnd(dstRegister.get());
+    return 0;
+}
+
+// ------------------------------ EvalNode -----------------------------
+
+RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
+
+    RefPtr<RegisterID> dstRegister = generator.newTemporary();
+    generator.emitLoad(dstRegister.get(), jsUndefined());
+    emitStatementsBytecode(generator, dstRegister.get());
+
+    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
+    generator.emitEnd(dstRegister.get());
+    return 0;
+}
+
+// ------------------------------ FunctionBodyNode -----------------------------
+
+RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
+    emitStatementsBytecode(generator, generator.ignoredResult());
+    StatementNode* singleStatement = this->singleStatement();
+    if (singleStatement && singleStatement->isBlock()) {
+        StatementNode* lastStatementInBlock = static_cast<BlockNode*>(singleStatement)->lastStatement();
+        if (lastStatementInBlock && lastStatementInBlock->isReturnNode())
+            return 0;
+    }
+
+    RegisterID* r0 = generator.emitLoad(0, jsUndefined());
+    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
+    generator.emitReturn(r0);
+    return 0;
+}
+
+// ------------------------------ FuncDeclNode ---------------------------------
+
+RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    return dst;
+}
+
+// ------------------------------ FuncExprNode ---------------------------------
+
+RegisterID* FuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    return generator.emitNewFunctionExpression(generator.finalDestination(dst), this);
+}
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/config.h b/src/3rdparty/webkit/JavaScriptCore/config.h
index 66817612f6..d5fdfe9ddd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/config.h
+++ b/src/3rdparty/webkit/JavaScriptCore/config.h
@@ -25,24 +25,26 @@
 
 #include <wtf/Platform.h>
 
-#if PLATFORM(WIN_OS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
+#if OS(WINDOWS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
 #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
 #define JS_EXPORTDATA __declspec(dllexport)
 #else
 #define JS_EXPORTDATA __declspec(dllimport)
 #endif
+#define JS_EXPORTCLASS JS_EXPORTDATA
 #else
 #define JS_EXPORTDATA
+#define JS_EXPORTCLASS
 #endif
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 
 // If we don't define these, they get defined in windef.h. 
 // We want to use std::min and std::max
 #define max max
 #define min min
 
-#if !COMPILER(MSVC7) && !PLATFORM(WINCE)
+#if !COMPILER(MSVC7) && !OS(WINCE)
 // We need to define this before the first #include of stdlib.h or it won't contain rand_s.
 #ifndef _CRT_RAND_S
 #define _CRT_RAND_S
@@ -51,13 +53,12 @@
 
 #endif
 
-#if PLATFORM(FREEBSD) || PLATFORM(OPENBSD)
+#if OS(FREEBSD) || OS(OPENBSD)
 #define HAVE_PTHREAD_NP_H 1
 #endif
 
 /* FIXME: if all platforms have these, do they really need #defines? */
 #define HAVE_STDINT_H 1
-#define HAVE_STRING_H 1
 
 #define WTF_CHANGES 1
 
@@ -74,3 +75,15 @@
 #include <wtf/DisallowCType.h>
 #endif
 
+#if PLATFORM(CHROMIUM)
+#if !defined(WTF_USE_V8)
+#define WTF_USE_V8 1
+#endif
+#endif /* PLATFORM(CHROMIUM) */
+
+#if !defined(WTF_USE_V8)
+#define WTF_USE_V8 0
+#endif /* !defined(WTF_USE_V8) */
+
+/* Using V8 implies not using JSC and vice versa */
+#define WTF_USE_JSC !WTF_USE_V8
diff --git a/src/3rdparty/webkit/JavaScriptCore/create_hash_table b/src/3rdparty/webkit/JavaScriptCore/create_hash_table
index 4184500ed4..77463fbdcb 100755
--- a/src/3rdparty/webkit/JavaScriptCore/create_hash_table
+++ b/src/3rdparty/webkit/JavaScriptCore/create_hash_table
@@ -252,18 +252,21 @@ sub output() {
     foreach my $key (@keys) {
         my $firstValue = "";
         my $secondValue = "";
+        my $castStr = "";
 
         if ($values[$i]{"type"} eq "Function") {
+            $castStr = "static_cast<NativeFunction>";
             $firstValue = $values[$i]{"function"};
             $secondValue = $values[$i]{"params"};
         } elsif ($values[$i]{"type"} eq "Property") {
+            $castStr = "static_cast<PropertySlot::GetValueFunc>";
             $firstValue = $values[$i]{"get"};
             $secondValue = $values[$i]{"put"};
         } elsif ($values[$i]{"type"} eq "Lexer") {
             $firstValue = $values[$i]{"value"};
             $secondValue = "0";
         }
-        print "   { \"$key\", $attrs[$i], (intptr_t)$firstValue, (intptr_t)$secondValue },\n";
+        print "   { \"$key\", $attrs[$i], (intptr_t)" . $castStr . "($firstValue), (intptr_t)$secondValue },\n";
         $i++;
     }
     print "   { 0, 0, 0, 0 }\n";
diff --git a/src/3rdparty/webkit/JavaScriptCore/create_jit_stubs b/src/3rdparty/webkit/JavaScriptCore/create_jit_stubs
new file mode 100644
index 0000000000..4d510ea2fd
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/create_jit_stubs
@@ -0,0 +1,69 @@
+#! /usr/bin/perl -w
+#
+# Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+# Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Library General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Library General Public License for more details.
+#
+# You should have received a copy of the GNU Library General Public License
+# along with this library; see the file COPYING.LIB.  If not, write to
+# the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+
+use strict;
+use File::Basename;
+use Getopt::Long;
+
+my $usage = basename($0) . " --prefix prefix [--offset offset] file";
+
+my $rtype_template = quotemeta("#rtype#");
+my $offset_template = quotemeta("#offset#");
+my $op_template = quotemeta("#op#");
+
+my $prefix;
+my $offset = 32;
+my $file;
+
+my $getOptionsResult = GetOptions(
+    'prefix=s' => \$prefix,
+    'offset=i' => \$offset
+);
+
+$file = $ARGV[0];
+
+die "$usage\n" unless ($prefix and $file);
+
+my $stub_template = "";
+my $stub = "";
+
+my $rtype = "";
+my $op = "";
+
+print STDERR "Creating JIT stubs for $file \n";
+open(IN, $file) or die "No such file $file";
+
+while ( $_ = <IN> ) {
+    if ( /^$prefix\((.*)\)/ ) {
+        $stub_template .= $1 . "\n";
+    }
+    if ( /^DEFINE_STUB_FUNCTION\((.*), (.*)\)/ ) {
+        $stub = $stub_template;
+        $rtype = quotemeta($1);
+        $op = quotemeta($2);
+        $stub =~ s/$offset_template/$offset/g;
+        $stub =~ s/$rtype_template/$rtype/g;
+        $stub =~ s/$op_template/$op/g;
+        $stub =~ s/\\\*/\*/g;
+        print $stub;
+    }
+}
+
+close(IN);
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
index 902a802e6f..cbcbd21a96 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
@@ -67,8 +67,9 @@ void Debugger::recompileAllJSFunctions(JSGlobalData* globalData)
     FunctionExecutableSet functionExecutables;
     SourceProviderMap sourceProviders;
 
-    Heap::iterator heapEnd = globalData->heap.primaryHeapEnd();
-    for (Heap::iterator it = globalData->heap.primaryHeapBegin(); it != heapEnd; ++it) {
+    LiveObjectIterator it = globalData->heap.primaryHeapBegin();
+    LiveObjectIterator heapEnd = globalData->heap.primaryHeapEnd();
+    for ( ; it != heapEnd; ++it) {
         if (!(*it)->inherits(&JSFunction::info))
             continue;
 
@@ -93,7 +94,7 @@ void Debugger::recompileAllJSFunctions(JSGlobalData* globalData)
     // JavaScript in the inspector.
     SourceProviderMap::const_iterator end = sourceProviders.end();
     for (SourceProviderMap::const_iterator iter = sourceProviders.begin(); iter != end; ++iter)
-        sourceParsed(iter->second, SourceCode(iter->first), -1, 0);
+        sourceParsed(iter->second, SourceCode(iter->first), -1, UString());
 }
 
 JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
index 3ee9767258..3b9bec4ac9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
@@ -42,7 +42,7 @@ namespace JSC {
         virtual void detach(JSGlobalObject*);
 
         virtual void sourceParsed(ExecState*, const SourceCode&, int errorLineNumber, const UString& errorMessage) = 0;
-        virtual void exception(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
+        virtual void exception(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber, bool hasHandler) = 0;
         virtual void atStatement(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
         virtual void callEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
         virtual void returnEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
index 5cc9a9f786..0444d23d20 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
@@ -71,14 +71,14 @@ bool DebuggerActivation::deleteProperty(ExecState* exec, const Identifier& prope
     return m_activation->deleteProperty(exec, propertyName);
 }
 
-void DebuggerActivation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void DebuggerActivation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    m_activation->getPropertyNames(exec, propertyNames);
+    m_activation->getPropertyNames(exec, propertyNames, mode);
 }
 
-bool DebuggerActivation::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
+bool DebuggerActivation::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    return m_activation->getPropertyAttributes(exec, propertyName, attributes);
+    return m_activation->getOwnPropertyDescriptor(exec, propertyName, descriptor);
 }
 
 void DebuggerActivation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
index 63cf63558e..392701741b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
@@ -42,8 +42,8 @@ namespace JSC {
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue, unsigned attributes);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
-        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes);
         virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes);
         virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
@@ -51,7 +51,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index c9d7cc6622..05a385d2d8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -44,18 +44,18 @@ const UString* DebuggerCallFrame::functionName() const
     JSFunction* function = asFunction(m_callFrame->callee());
     if (!function)
         return 0;
-    return &function->name(&m_callFrame->globalData());
+    return &function->name(m_callFrame);
 }
     
 UString DebuggerCallFrame::calculatedFunctionName() const
 {
     if (!m_callFrame->codeBlock())
-        return 0;
+        return UString();
     
     JSFunction* function = asFunction(m_callFrame->callee());
     if (!function)
-        return 0;
-    return function->calculatedDisplayName(&m_callFrame->globalData());
+        return UString();
+    return function->calculatedDisplayName(m_callFrame);
 }
 
 DebuggerCallFrame::Type DebuggerCallFrame::type() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h
index 5732add979..ffe067f630 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h
@@ -1,31 +1,31 @@
-// Automatically generated from ../runtime/ArrayPrototype.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\ArrayPrototype.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue arrayTableValues[22] = {
-   { "toString", DontEnum|Function, (intptr_t)arrayProtoFuncToString, (intptr_t)0 },
-   { "toLocaleString", DontEnum|Function, (intptr_t)arrayProtoFuncToLocaleString, (intptr_t)0 },
-   { "concat", DontEnum|Function, (intptr_t)arrayProtoFuncConcat, (intptr_t)1 },
-   { "join", DontEnum|Function, (intptr_t)arrayProtoFuncJoin, (intptr_t)1 },
-   { "pop", DontEnum|Function, (intptr_t)arrayProtoFuncPop, (intptr_t)0 },
-   { "push", DontEnum|Function, (intptr_t)arrayProtoFuncPush, (intptr_t)1 },
-   { "reverse", DontEnum|Function, (intptr_t)arrayProtoFuncReverse, (intptr_t)0 },
-   { "shift", DontEnum|Function, (intptr_t)arrayProtoFuncShift, (intptr_t)0 },
-   { "slice", DontEnum|Function, (intptr_t)arrayProtoFuncSlice, (intptr_t)2 },
-   { "sort", DontEnum|Function, (intptr_t)arrayProtoFuncSort, (intptr_t)1 },
-   { "splice", DontEnum|Function, (intptr_t)arrayProtoFuncSplice, (intptr_t)2 },
-   { "unshift", DontEnum|Function, (intptr_t)arrayProtoFuncUnShift, (intptr_t)1 },
-   { "every", DontEnum|Function, (intptr_t)arrayProtoFuncEvery, (intptr_t)1 },
-   { "forEach", DontEnum|Function, (intptr_t)arrayProtoFuncForEach, (intptr_t)1 },
-   { "some", DontEnum|Function, (intptr_t)arrayProtoFuncSome, (intptr_t)1 },
-   { "indexOf", DontEnum|Function, (intptr_t)arrayProtoFuncIndexOf, (intptr_t)1 },
-   { "lastIndexOf", DontEnum|Function, (intptr_t)arrayProtoFuncLastIndexOf, (intptr_t)1 },
-   { "filter", DontEnum|Function, (intptr_t)arrayProtoFuncFilter, (intptr_t)1 },
-   { "reduce", DontEnum|Function, (intptr_t)arrayProtoFuncReduce, (intptr_t)1 },
-   { "reduceRight", DontEnum|Function, (intptr_t)arrayProtoFuncReduceRight, (intptr_t)1 },
-   { "map", DontEnum|Function, (intptr_t)arrayProtoFuncMap, (intptr_t)1 },
+   { "toString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncToString), (intptr_t)0 },
+   { "toLocaleString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncToLocaleString), (intptr_t)0 },
+   { "concat", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncConcat), (intptr_t)1 },
+   { "join", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncJoin), (intptr_t)1 },
+   { "pop", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncPop), (intptr_t)0 },
+   { "push", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncPush), (intptr_t)1 },
+   { "reverse", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncReverse), (intptr_t)0 },
+   { "shift", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncShift), (intptr_t)0 },
+   { "slice", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncSlice), (intptr_t)2 },
+   { "sort", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncSort), (intptr_t)1 },
+   { "splice", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncSplice), (intptr_t)2 },
+   { "unshift", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncUnShift), (intptr_t)1 },
+   { "every", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncEvery), (intptr_t)1 },
+   { "forEach", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncForEach), (intptr_t)1 },
+   { "some", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncSome), (intptr_t)1 },
+   { "indexOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncIndexOf), (intptr_t)1 },
+   { "lastIndexOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncLastIndexOf), (intptr_t)1 },
+   { "filter", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncFilter), (intptr_t)1 },
+   { "reduce", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncReduce), (intptr_t)1 },
+   { "reduceRight", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncReduceRight), (intptr_t)1 },
+   { "map", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncMap), (intptr_t)1 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h
index 8b1c7350c5..56acdbac41 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h
@@ -1,56 +1,56 @@
-// Automatically generated from ../runtime/DatePrototype.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\DatePrototype.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue dateTableValues[47] = {
-   { "toString", DontEnum|Function, (intptr_t)dateProtoFuncToString, (intptr_t)0 },
-   { "toISOString", DontEnum|Function, (intptr_t)dateProtoFuncToISOString, (intptr_t)0 },
-   { "toUTCString", DontEnum|Function, (intptr_t)dateProtoFuncToUTCString, (intptr_t)0 },
-   { "toDateString", DontEnum|Function, (intptr_t)dateProtoFuncToDateString, (intptr_t)0 },
-   { "toTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToTimeString, (intptr_t)0 },
-   { "toLocaleString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleString, (intptr_t)0 },
-   { "toLocaleDateString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleDateString, (intptr_t)0 },
-   { "toLocaleTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleTimeString, (intptr_t)0 },
-   { "valueOf", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
-   { "getTime", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
-   { "getFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetFullYear, (intptr_t)0 },
-   { "getUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCFullYear, (intptr_t)0 },
-   { "toGMTString", DontEnum|Function, (intptr_t)dateProtoFuncToGMTString, (intptr_t)0 },
-   { "getMonth", DontEnum|Function, (intptr_t)dateProtoFuncGetMonth, (intptr_t)0 },
-   { "getUTCMonth", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCMonth, (intptr_t)0 },
-   { "getDate", DontEnum|Function, (intptr_t)dateProtoFuncGetDate, (intptr_t)0 },
-   { "getUTCDate", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCDate, (intptr_t)0 },
-   { "getDay", DontEnum|Function, (intptr_t)dateProtoFuncGetDay, (intptr_t)0 },
-   { "getUTCDay", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCDay, (intptr_t)0 },
-   { "getHours", DontEnum|Function, (intptr_t)dateProtoFuncGetHours, (intptr_t)0 },
-   { "getUTCHours", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCHours, (intptr_t)0 },
-   { "getMinutes", DontEnum|Function, (intptr_t)dateProtoFuncGetMinutes, (intptr_t)0 },
-   { "getUTCMinutes", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCMinutes, (intptr_t)0 },
-   { "getSeconds", DontEnum|Function, (intptr_t)dateProtoFuncGetSeconds, (intptr_t)0 },
-   { "getUTCSeconds", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCSeconds, (intptr_t)0 },
-   { "getMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncGetMilliSeconds, (intptr_t)0 },
-   { "getUTCMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCMilliseconds, (intptr_t)0 },
-   { "getTimezoneOffset", DontEnum|Function, (intptr_t)dateProtoFuncGetTimezoneOffset, (intptr_t)0 },
-   { "setTime", DontEnum|Function, (intptr_t)dateProtoFuncSetTime, (intptr_t)1 },
-   { "setMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncSetMilliSeconds, (intptr_t)1 },
-   { "setUTCMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCMilliseconds, (intptr_t)1 },
-   { "setSeconds", DontEnum|Function, (intptr_t)dateProtoFuncSetSeconds, (intptr_t)2 },
-   { "setUTCSeconds", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCSeconds, (intptr_t)2 },
-   { "setMinutes", DontEnum|Function, (intptr_t)dateProtoFuncSetMinutes, (intptr_t)3 },
-   { "setUTCMinutes", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCMinutes, (intptr_t)3 },
-   { "setHours", DontEnum|Function, (intptr_t)dateProtoFuncSetHours, (intptr_t)4 },
-   { "setUTCHours", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCHours, (intptr_t)4 },
-   { "setDate", DontEnum|Function, (intptr_t)dateProtoFuncSetDate, (intptr_t)1 },
-   { "setUTCDate", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCDate, (intptr_t)1 },
-   { "setMonth", DontEnum|Function, (intptr_t)dateProtoFuncSetMonth, (intptr_t)2 },
-   { "setUTCMonth", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCMonth, (intptr_t)2 },
-   { "setFullYear", DontEnum|Function, (intptr_t)dateProtoFuncSetFullYear, (intptr_t)3 },
-   { "setUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCFullYear, (intptr_t)3 },
-   { "setYear", DontEnum|Function, (intptr_t)dateProtoFuncSetYear, (intptr_t)1 },
-   { "getYear", DontEnum|Function, (intptr_t)dateProtoFuncGetYear, (intptr_t)0 },
-   { "toJSON", DontEnum|Function, (intptr_t)dateProtoFuncToJSON, (intptr_t)0 },
+   { "toString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToString), (intptr_t)0 },
+   { "toISOString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToISOString), (intptr_t)0 },
+   { "toUTCString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToUTCString), (intptr_t)0 },
+   { "toDateString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToDateString), (intptr_t)0 },
+   { "toTimeString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToTimeString), (intptr_t)0 },
+   { "toLocaleString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToLocaleString), (intptr_t)0 },
+   { "toLocaleDateString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToLocaleDateString), (intptr_t)0 },
+   { "toLocaleTimeString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToLocaleTimeString), (intptr_t)0 },
+   { "valueOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetTime), (intptr_t)0 },
+   { "getTime", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetTime), (intptr_t)0 },
+   { "getFullYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetFullYear), (intptr_t)0 },
+   { "getUTCFullYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCFullYear), (intptr_t)0 },
+   { "toGMTString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToGMTString), (intptr_t)0 },
+   { "getMonth", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetMonth), (intptr_t)0 },
+   { "getUTCMonth", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCMonth), (intptr_t)0 },
+   { "getDate", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetDate), (intptr_t)0 },
+   { "getUTCDate", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCDate), (intptr_t)0 },
+   { "getDay", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetDay), (intptr_t)0 },
+   { "getUTCDay", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCDay), (intptr_t)0 },
+   { "getHours", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetHours), (intptr_t)0 },
+   { "getUTCHours", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCHours), (intptr_t)0 },
+   { "getMinutes", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetMinutes), (intptr_t)0 },
+   { "getUTCMinutes", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCMinutes), (intptr_t)0 },
+   { "getSeconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetSeconds), (intptr_t)0 },
+   { "getUTCSeconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCSeconds), (intptr_t)0 },
+   { "getMilliseconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetMilliSeconds), (intptr_t)0 },
+   { "getUTCMilliseconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCMilliseconds), (intptr_t)0 },
+   { "getTimezoneOffset", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetTimezoneOffset), (intptr_t)0 },
+   { "setTime", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetTime), (intptr_t)1 },
+   { "setMilliseconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetMilliSeconds), (intptr_t)1 },
+   { "setUTCMilliseconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCMilliseconds), (intptr_t)1 },
+   { "setSeconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetSeconds), (intptr_t)2 },
+   { "setUTCSeconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCSeconds), (intptr_t)2 },
+   { "setMinutes", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetMinutes), (intptr_t)3 },
+   { "setUTCMinutes", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCMinutes), (intptr_t)3 },
+   { "setHours", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetHours), (intptr_t)4 },
+   { "setUTCHours", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCHours), (intptr_t)4 },
+   { "setDate", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetDate), (intptr_t)1 },
+   { "setUTCDate", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCDate), (intptr_t)1 },
+   { "setMonth", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetMonth), (intptr_t)2 },
+   { "setUTCMonth", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCMonth), (intptr_t)2 },
+   { "setFullYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetFullYear), (intptr_t)3 },
+   { "setUTCFullYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCFullYear), (intptr_t)3 },
+   { "setYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetYear), (intptr_t)1 },
+   { "getYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetYear), (intptr_t)0 },
+   { "toJSON", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToJSON), (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/GeneratedJITStubs_RVCT.h b/src/3rdparty/webkit/JavaScriptCore/generated/GeneratedJITStubs_RVCT.h
new file mode 100644
index 0000000000..94ab75685e
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/GeneratedJITStubs_RVCT.h
@@ -0,0 +1,1199 @@
+extern "C" EncodedJSValue JITStubThunked_op_convert_this(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_convert_this(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_convert_this
+    str lr, [sp, #32]
+    bl JITStubThunked_op_convert_this
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_end(STUB_ARGS_DECLARATION);
+__asm void cti_op_end(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_end
+    str lr, [sp, #32]
+    bl JITStubThunked_op_end
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_add(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_add(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_add
+    str lr, [sp, #32]
+    bl JITStubThunked_op_add
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_pre_inc(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_pre_inc(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_pre_inc
+    str lr, [sp, #32]
+    bl JITStubThunked_op_pre_inc
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_timeout_check(STUB_ARGS_DECLARATION);
+__asm int cti_timeout_check(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_timeout_check
+    str lr, [sp, #32]
+    bl JITStubThunked_timeout_check
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_register_file_check(STUB_ARGS_DECLARATION);
+__asm void cti_register_file_check(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_register_file_check
+    str lr, [sp, #32]
+    bl JITStubThunked_register_file_check
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_loop_if_lesseq(STUB_ARGS_DECLARATION);
+__asm int cti_op_loop_if_lesseq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_loop_if_lesseq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_loop_if_lesseq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_object(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_object(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_object
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_object
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_id_generic(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_id_generic(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_id_generic
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_id_generic
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_generic(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_generic(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_generic
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_generic
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_id(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_id(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_id
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_id
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_id_fail(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_id_fail(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_id_fail
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_id_fail
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_put_by_id_transition_realloc(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_put_by_id_transition_realloc(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_id_transition_realloc
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_id_transition_realloc
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_method_check(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_method_check(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_method_check
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_method_check
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_self_fail(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_self_fail(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_self_fail
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_self_fail
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_getter_stub(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_getter_stub(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_getter_stub
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_getter_stub
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_custom_stub(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_custom_stub(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_custom_stub
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_custom_stub
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_proto_list(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_proto_list(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_proto_list
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_proto_list
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_proto_list_full(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_proto_list_full(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_proto_list_full
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_proto_list_full
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_proto_fail(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_proto_fail(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_proto_fail
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_proto_fail
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_array_fail(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_array_fail(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_array_fail
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_array_fail
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_string_fail(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_string_fail(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_string_fail
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_string_fail
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_instanceof(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_instanceof(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_instanceof
+    str lr, [sp, #32]
+    bl JITStubThunked_op_instanceof
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_del_by_id(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_del_by_id(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_del_by_id
+    str lr, [sp, #32]
+    bl JITStubThunked_op_del_by_id
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_mul(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_mul(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_mul
+    str lr, [sp, #32]
+    bl JITStubThunked_op_mul
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_func(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_func(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_func
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_func
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void* JITStubThunked_op_call_JSFunction(STUB_ARGS_DECLARATION);
+__asm void* cti_op_call_JSFunction(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_call_JSFunction
+    str lr, [sp, #32]
+    bl JITStubThunked_op_call_JSFunction
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" VoidPtrPair JITStubThunked_op_call_arityCheck(STUB_ARGS_DECLARATION);
+__asm VoidPtrPair cti_op_call_arityCheck(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_call_arityCheck
+    str lr, [sp, #32]
+    bl JITStubThunked_op_call_arityCheck
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void* JITStubThunked_vm_lazyLinkCall(STUB_ARGS_DECLARATION);
+__asm void* cti_vm_lazyLinkCall(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_vm_lazyLinkCall
+    str lr, [sp, #32]
+    bl JITStubThunked_vm_lazyLinkCall
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_push_activation(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_push_activation(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_push_activation
+    str lr, [sp, #32]
+    bl JITStubThunked_op_push_activation
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_call_NotJSFunction(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_call_NotJSFunction(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_call_NotJSFunction
+    str lr, [sp, #32]
+    bl JITStubThunked_op_call_NotJSFunction
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_create_arguments(STUB_ARGS_DECLARATION);
+__asm void cti_op_create_arguments(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_create_arguments
+    str lr, [sp, #32]
+    bl JITStubThunked_op_create_arguments
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_create_arguments_no_params(STUB_ARGS_DECLARATION);
+__asm void cti_op_create_arguments_no_params(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_create_arguments_no_params
+    str lr, [sp, #32]
+    bl JITStubThunked_op_create_arguments_no_params
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_tear_off_activation(STUB_ARGS_DECLARATION);
+__asm void cti_op_tear_off_activation(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_tear_off_activation
+    str lr, [sp, #32]
+    bl JITStubThunked_op_tear_off_activation
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_tear_off_arguments(STUB_ARGS_DECLARATION);
+__asm void cti_op_tear_off_arguments(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_tear_off_arguments
+    str lr, [sp, #32]
+    bl JITStubThunked_op_tear_off_arguments
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_profile_will_call(STUB_ARGS_DECLARATION);
+__asm void cti_op_profile_will_call(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_profile_will_call
+    str lr, [sp, #32]
+    bl JITStubThunked_op_profile_will_call
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_profile_did_call(STUB_ARGS_DECLARATION);
+__asm void cti_op_profile_did_call(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_profile_did_call
+    str lr, [sp, #32]
+    bl JITStubThunked_op_profile_did_call
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_ret_scopeChain(STUB_ARGS_DECLARATION);
+__asm void cti_op_ret_scopeChain(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_ret_scopeChain
+    str lr, [sp, #32]
+    bl JITStubThunked_op_ret_scopeChain
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_array(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_array(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_array
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_array
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_resolve(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_resolve(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_resolve
+    str lr, [sp, #32]
+    bl JITStubThunked_op_resolve
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_construct_JSConstruct(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_construct_JSConstruct(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_construct_JSConstruct
+    str lr, [sp, #32]
+    bl JITStubThunked_op_construct_JSConstruct
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_construct_NotJSConstruct(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_construct_NotJSConstruct(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_construct_NotJSConstruct
+    str lr, [sp, #32]
+    bl JITStubThunked_op_construct_NotJSConstruct
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_val(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_val(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_val
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_val
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_val_string(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_val_string(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_val_string
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_val_string
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_val_byte_array(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_val_byte_array(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_val_byte_array
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_val_byte_array
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_sub(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_sub(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_sub
+    str lr, [sp, #32]
+    bl JITStubThunked_op_sub
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_val(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_val(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_val
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_val
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_val_byte_array(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_val_byte_array(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_val_byte_array
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_val_byte_array
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_lesseq(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_lesseq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_lesseq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_lesseq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_load_varargs(STUB_ARGS_DECLARATION);
+__asm int cti_op_load_varargs(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_load_varargs
+    str lr, [sp, #32]
+    bl JITStubThunked_op_load_varargs
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_negate(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_negate(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_negate
+    str lr, [sp, #32]
+    bl JITStubThunked_op_negate
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_resolve_base(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_resolve_base(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_resolve_base
+    str lr, [sp, #32]
+    bl JITStubThunked_op_resolve_base
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_resolve_skip(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_resolve_skip(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_resolve_skip
+    str lr, [sp, #32]
+    bl JITStubThunked_op_resolve_skip
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_resolve_global(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_resolve_global(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_resolve_global
+    str lr, [sp, #32]
+    bl JITStubThunked_op_resolve_global
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_div(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_div(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_div
+    str lr, [sp, #32]
+    bl JITStubThunked_op_div
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_pre_dec(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_pre_dec(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_pre_dec
+    str lr, [sp, #32]
+    bl JITStubThunked_op_pre_dec
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_jless(STUB_ARGS_DECLARATION);
+__asm int cti_op_jless(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_jless
+    str lr, [sp, #32]
+    bl JITStubThunked_op_jless
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_jlesseq(STUB_ARGS_DECLARATION);
+__asm int cti_op_jlesseq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_jlesseq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_jlesseq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_not(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_not(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_not
+    str lr, [sp, #32]
+    bl JITStubThunked_op_not
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_jtrue(STUB_ARGS_DECLARATION);
+__asm int cti_op_jtrue(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_jtrue
+    str lr, [sp, #32]
+    bl JITStubThunked_op_jtrue
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_post_inc(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_post_inc(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_post_inc
+    str lr, [sp, #32]
+    bl JITStubThunked_op_post_inc
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_eq(STUB_ARGS_DECLARATION);
+__asm int cti_op_eq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_eq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_eq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_eq_strings(STUB_ARGS_DECLARATION);
+__asm int cti_op_eq_strings(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_eq_strings
+    str lr, [sp, #32]
+    bl JITStubThunked_op_eq_strings
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_lshift(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_lshift(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_lshift
+    str lr, [sp, #32]
+    bl JITStubThunked_op_lshift
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_bitand(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_bitand(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_bitand
+    str lr, [sp, #32]
+    bl JITStubThunked_op_bitand
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_rshift(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_rshift(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_rshift
+    str lr, [sp, #32]
+    bl JITStubThunked_op_rshift
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_bitnot(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_bitnot(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_bitnot
+    str lr, [sp, #32]
+    bl JITStubThunked_op_bitnot
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_resolve_with_base(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_resolve_with_base(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_resolve_with_base
+    str lr, [sp, #32]
+    bl JITStubThunked_op_resolve_with_base
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_func_exp(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_func_exp(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_func_exp
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_func_exp
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_mod(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_mod(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_mod
+    str lr, [sp, #32]
+    bl JITStubThunked_op_mod
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_less(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_less(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_less
+    str lr, [sp, #32]
+    bl JITStubThunked_op_less
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_post_dec(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_post_dec(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_post_dec
+    str lr, [sp, #32]
+    bl JITStubThunked_op_post_dec
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_urshift(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_urshift(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_urshift
+    str lr, [sp, #32]
+    bl JITStubThunked_op_urshift
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_bitxor(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_bitxor(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_bitxor
+    str lr, [sp, #32]
+    bl JITStubThunked_op_bitxor
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_regexp(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_regexp(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_regexp
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_regexp
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_bitor(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_bitor(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_bitor
+    str lr, [sp, #32]
+    bl JITStubThunked_op_bitor
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_call_eval(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_call_eval(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_call_eval
+    str lr, [sp, #32]
+    bl JITStubThunked_op_call_eval
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_throw(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_throw(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_throw
+    str lr, [sp, #32]
+    bl JITStubThunked_op_throw
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSPropertyNameIterator* JITStubThunked_op_get_pnames(STUB_ARGS_DECLARATION);
+__asm JSPropertyNameIterator* cti_op_get_pnames(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_pnames
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_pnames
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_has_property(STUB_ARGS_DECLARATION);
+__asm int cti_has_property(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_has_property
+    str lr, [sp, #32]
+    bl JITStubThunked_has_property
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_push_scope(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_push_scope(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_push_scope
+    str lr, [sp, #32]
+    bl JITStubThunked_op_push_scope
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_pop_scope(STUB_ARGS_DECLARATION);
+__asm void cti_op_pop_scope(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_pop_scope
+    str lr, [sp, #32]
+    bl JITStubThunked_op_pop_scope
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_typeof(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_typeof(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_typeof
+    str lr, [sp, #32]
+    bl JITStubThunked_op_typeof
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_undefined(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_undefined(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_undefined
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_undefined
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_boolean(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_boolean(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_boolean
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_boolean
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_number(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_number(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_number
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_number
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_string(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_string(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_string
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_string
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_object(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_object(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_object
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_object
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_function(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_function(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_function
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_function
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_stricteq(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_stricteq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_stricteq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_stricteq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_to_primitive(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_to_primitive(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_to_primitive
+    str lr, [sp, #32]
+    bl JITStubThunked_op_to_primitive
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_strcat(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_strcat(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_strcat
+    str lr, [sp, #32]
+    bl JITStubThunked_op_strcat
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_nstricteq(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_nstricteq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_nstricteq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_nstricteq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_to_jsnumber(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_to_jsnumber(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_to_jsnumber
+    str lr, [sp, #32]
+    bl JITStubThunked_op_to_jsnumber
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_in(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_in(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_in
+    str lr, [sp, #32]
+    bl JITStubThunked_op_in
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_push_new_scope(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_push_new_scope(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_push_new_scope
+    str lr, [sp, #32]
+    bl JITStubThunked_op_push_new_scope
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_jmp_scopes(STUB_ARGS_DECLARATION);
+__asm void cti_op_jmp_scopes(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_jmp_scopes
+    str lr, [sp, #32]
+    bl JITStubThunked_op_jmp_scopes
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_index(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_index(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_index
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_index
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void* JITStubThunked_op_switch_imm(STUB_ARGS_DECLARATION);
+__asm void* cti_op_switch_imm(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_switch_imm
+    str lr, [sp, #32]
+    bl JITStubThunked_op_switch_imm
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void* JITStubThunked_op_switch_char(STUB_ARGS_DECLARATION);
+__asm void* cti_op_switch_char(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_switch_char
+    str lr, [sp, #32]
+    bl JITStubThunked_op_switch_char
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void* JITStubThunked_op_switch_string(STUB_ARGS_DECLARATION);
+__asm void* cti_op_switch_string(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_switch_string
+    str lr, [sp, #32]
+    bl JITStubThunked_op_switch_string
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_del_by_val(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_del_by_val(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_del_by_val
+    str lr, [sp, #32]
+    bl JITStubThunked_op_del_by_val
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_getter(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_getter(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_getter
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_getter
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_setter(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_setter(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_setter
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_setter
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_error(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_error(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_error
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_error
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_debug(STUB_ARGS_DECLARATION);
+__asm void cti_op_debug(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_debug
+    str lr, [sp, #32]
+    bl JITStubThunked_op_debug
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_vm_throw(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_vm_throw(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_vm_throw
+    str lr, [sp, #32]
+    bl JITStubThunked_vm_throw
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_to_object(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_to_object(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_to_object
+    str lr, [sp, #32]
+    bl JITStubThunked_to_object
+    ldr lr, [sp, #32]
+    bx lr
+}
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
index 4f78903844..50ff9cd9c3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
@@ -76,7 +76,7 @@
 /* Copy the first part of user declarations.  */
 
 /* Line 189 of yacc.c  */
-#line 3 "../parser/Grammar.y"
+#line 3 "parser\\Grammar.y"
 
 
 /*
@@ -120,7 +120,7 @@
 // Default values for bison.
 #define YYDEBUG 0 // Set to 1 to debug a parse error.
 #define jscyydebug 0 // Set to 1 to debug a parse error.
-#if !PLATFORM(DARWIN)
+#if !OS(DARWIN)
 // Avoid triggering warnings in older bison by not setting this on the Darwin platform.
 // FIXME: Is this still needed?
 #define YYERROR_VERBOSE
@@ -221,7 +221,7 @@ static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserAr
 
 
 /* Line 189 of yacc.c  */
-#line 225 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+#line 225 "C:/dev/webkit-2.0/JavaScriptCore/generated\\Grammar.tab.c"
 
 /* Enabling traces.  */
 #ifndef YYDEBUG
@@ -321,7 +321,7 @@ typedef union YYSTYPE
 {
 
 /* Line 214 of yacc.c  */
-#line 146 "../parser/Grammar.y"
+#line 146 "parser\\Grammar.y"
 
     int                 intValue;
     double              doubleValue;
@@ -356,7 +356,7 @@ typedef union YYSTYPE
 
 
 /* Line 214 of yacc.c  */
-#line 360 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+#line 360 "C:/dev/webkit-2.0/JavaScriptCore/generated\\Grammar.tab.c"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
@@ -380,7 +380,7 @@ typedef struct YYLTYPE
 /* Copy the second part of user declarations.  */
 
 /* Line 264 of yacc.c  */
-#line 178 "../parser/Grammar.y"
+#line 178 "parser\\Grammar.y"
 
 
 template <typename T> inline void setStatementLocation(StatementNode* statement, const T& start, const T& end)
@@ -396,7 +396,7 @@ static inline void setExceptionLocation(ThrowableExpressionData* node, unsigned
 
 
 /* Line 264 of yacc.c  */
-#line 400 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+#line 400 "C:/dev/webkit-2.0/JavaScriptCore/generated\\Grammar.tab.c"
 
 #ifdef short
 # undef short
@@ -2974,42 +2974,42 @@ yyreduce:
         case 2:
 
 /* Line 1455 of yacc.c  */
-#line 293 "../parser/Grammar.y"
+#line 293 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); ;}
     break;
 
   case 3:
 
 /* Line 1455 of yacc.c  */
-#line 294 "../parser/Grammar.y"
+#line 294 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
     break;
 
   case 4:
 
 /* Line 1455 of yacc.c  */
-#line 295 "../parser/Grammar.y"
+#line 295 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
     break;
 
   case 5:
 
 /* Line 1455 of yacc.c  */
-#line 296 "../parser/Grammar.y"
+#line 296 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, (yyvsp[(1) - (1)].doubleValue)), 0, 1); ;}
     break;
 
   case 6:
 
 /* Line 1455 of yacc.c  */
-#line 297 "../parser/Grammar.y"
+#line 297 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
     break;
 
   case 7:
 
 /* Line 1455 of yacc.c  */
-#line 298 "../parser/Grammar.y"
+#line 298 "parser\\Grammar.y"
     {
                                             Lexer& l = *GLOBAL_DATA->lexer;
                                             const Identifier* pattern;
@@ -3026,7 +3026,7 @@ yyreduce:
   case 8:
 
 /* Line 1455 of yacc.c  */
-#line 309 "../parser/Grammar.y"
+#line 309 "parser\\Grammar.y"
     {
                                             Lexer& l = *GLOBAL_DATA->lexer;
                                             const Identifier* pattern;
@@ -3043,35 +3043,35 @@ yyreduce:
   case 9:
 
 /* Line 1455 of yacc.c  */
-#line 323 "../parser/Grammar.y"
+#line 323 "parser\\Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 10:
 
 /* Line 1455 of yacc.c  */
-#line 324 "../parser/Grammar.y"
+#line 324 "parser\\Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 11:
 
 /* Line 1455 of yacc.c  */
-#line 325 "../parser/Grammar.y"
+#line 325 "parser\\Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, (yyvsp[(1) - (3)].doubleValue), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 12:
 
 /* Line 1455 of yacc.c  */
-#line 326 "../parser/Grammar.y"
+#line 326 "parser\\Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (7)].ident), *(yyvsp[(2) - (7)].ident), 0, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); if (!(yyval.propertyNode).m_node) YYABORT; ;}
     break;
 
   case 13:
 
 /* Line 1455 of yacc.c  */
-#line 328 "../parser/Grammar.y"
+#line 328 "parser\\Grammar.y"
     {
                                                                  (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (8)].ident), *(yyvsp[(2) - (8)].ident), (yyvsp[(4) - (8)].parameterList).m_node.head, (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line)), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
                                                                  if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
@@ -3085,7 +3085,7 @@ yyreduce:
   case 14:
 
 /* Line 1455 of yacc.c  */
-#line 339 "../parser/Grammar.y"
+#line 339 "parser\\Grammar.y"
     { (yyval.propertyList).m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
                                           (yyval.propertyList).m_node.tail = (yyval.propertyList).m_node.head;
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (1)].propertyNode).m_features;
@@ -3095,7 +3095,7 @@ yyreduce:
   case 15:
 
 /* Line 1455 of yacc.c  */
-#line 343 "../parser/Grammar.y"
+#line 343 "parser\\Grammar.y"
     { (yyval.propertyList).m_node.head = (yyvsp[(1) - (3)].propertyList).m_node.head;
                                           (yyval.propertyList).m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (3)].propertyList).m_features | (yyvsp[(3) - (3)].propertyNode).m_features;
@@ -3105,70 +3105,70 @@ yyreduce:
   case 17:
 
 /* Line 1455 of yacc.c  */
-#line 351 "../parser/Grammar.y"
+#line 351 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 18:
 
 /* Line 1455 of yacc.c  */
-#line 352 "../parser/Grammar.y"
+#line 352 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
     break;
 
   case 19:
 
 /* Line 1455 of yacc.c  */
-#line 354 "../parser/Grammar.y"
+#line 354 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
     break;
 
   case 20:
 
 /* Line 1455 of yacc.c  */
-#line 358 "../parser/Grammar.y"
+#line 358 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
     break;
 
   case 23:
 
 /* Line 1455 of yacc.c  */
-#line 361 "../parser/Grammar.y"
+#line 361 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 24:
 
 /* Line 1455 of yacc.c  */
-#line 362 "../parser/Grammar.y"
+#line 362 "parser\\Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (3)].expressionNode); ;}
     break;
 
   case 25:
 
 /* Line 1455 of yacc.c  */
-#line 366 "../parser/Grammar.y"
+#line 366 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
     break;
 
   case 26:
 
 /* Line 1455 of yacc.c  */
-#line 367 "../parser/Grammar.y"
+#line 367 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
     break;
 
   case 27:
 
 /* Line 1455 of yacc.c  */
-#line 368 "../parser/Grammar.y"
+#line 368 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
     break;
 
   case 28:
 
 /* Line 1455 of yacc.c  */
-#line 372 "../parser/Grammar.y"
+#line 372 "parser\\Grammar.y"
     { (yyval.elementList).m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
                                           (yyval.elementList).m_node.tail = (yyval.elementList).m_node.head;
                                           (yyval.elementList).m_features = (yyvsp[(2) - (2)].expressionNode).m_features;
@@ -3178,7 +3178,7 @@ yyreduce:
   case 29:
 
 /* Line 1455 of yacc.c  */
-#line 377 "../parser/Grammar.y"
+#line 377 "parser\\Grammar.y"
     { (yyval.elementList).m_node.head = (yyvsp[(1) - (4)].elementList).m_node.head;
                                           (yyval.elementList).m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
                                           (yyval.elementList).m_features = (yyvsp[(1) - (4)].elementList).m_features | (yyvsp[(4) - (4)].expressionNode).m_features;
@@ -3188,35 +3188,35 @@ yyreduce:
   case 30:
 
 /* Line 1455 of yacc.c  */
-#line 384 "../parser/Grammar.y"
+#line 384 "parser\\Grammar.y"
     { (yyval.intValue) = 0; ;}
     break;
 
   case 32:
 
 /* Line 1455 of yacc.c  */
-#line 389 "../parser/Grammar.y"
+#line 389 "parser\\Grammar.y"
     { (yyval.intValue) = 1; ;}
     break;
 
   case 33:
 
 /* Line 1455 of yacc.c  */
-#line 390 "../parser/Grammar.y"
+#line 390 "parser\\Grammar.y"
     { (yyval.intValue) = (yyvsp[(1) - (2)].intValue) + 1; ;}
     break;
 
   case 35:
 
 /* Line 1455 of yacc.c  */
-#line 395 "../parser/Grammar.y"
+#line 395 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>((yyvsp[(1) - (1)].funcExprNode).m_node, (yyvsp[(1) - (1)].funcExprNode).m_features, (yyvsp[(1) - (1)].funcExprNode).m_numConstants); ;}
     break;
 
   case 36:
 
 /* Line 1455 of yacc.c  */
-#line 396 "../parser/Grammar.y"
+#line 396 "parser\\Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
@@ -3226,7 +3226,7 @@ yyreduce:
   case 37:
 
 /* Line 1455 of yacc.c  */
-#line 400 "../parser/Grammar.y"
+#line 400 "parser\\Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
@@ -3236,7 +3236,7 @@ yyreduce:
   case 38:
 
 /* Line 1455 of yacc.c  */
-#line 404 "../parser/Grammar.y"
+#line 404 "parser\\Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
@@ -3246,7 +3246,7 @@ yyreduce:
   case 40:
 
 /* Line 1455 of yacc.c  */
-#line 412 "../parser/Grammar.y"
+#line 412 "parser\\Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
@@ -3256,7 +3256,7 @@ yyreduce:
   case 41:
 
 /* Line 1455 of yacc.c  */
-#line 416 "../parser/Grammar.y"
+#line 416 "parser\\Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
@@ -3266,7 +3266,7 @@ yyreduce:
   case 42:
 
 /* Line 1455 of yacc.c  */
-#line 420 "../parser/Grammar.y"
+#line 420 "parser\\Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
@@ -3276,7 +3276,7 @@ yyreduce:
   case 44:
 
 /* Line 1455 of yacc.c  */
-#line 428 "../parser/Grammar.y"
+#line 428 "parser\\Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); 
@@ -3286,7 +3286,7 @@ yyreduce:
   case 46:
 
 /* Line 1455 of yacc.c  */
-#line 436 "../parser/Grammar.y"
+#line 436 "parser\\Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants);
@@ -3296,21 +3296,21 @@ yyreduce:
   case 47:
 
 /* Line 1455 of yacc.c  */
-#line 443 "../parser/Grammar.y"
+#line 443 "parser\\Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 48:
 
 /* Line 1455 of yacc.c  */
-#line 444 "../parser/Grammar.y"
+#line 444 "parser\\Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 49:
 
 /* Line 1455 of yacc.c  */
-#line 445 "../parser/Grammar.y"
+#line 445 "parser\\Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
@@ -3320,7 +3320,7 @@ yyreduce:
   case 50:
 
 /* Line 1455 of yacc.c  */
-#line 449 "../parser/Grammar.y"
+#line 449 "parser\\Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); ;}
@@ -3329,21 +3329,21 @@ yyreduce:
   case 51:
 
 /* Line 1455 of yacc.c  */
-#line 455 "../parser/Grammar.y"
+#line 455 "parser\\Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 52:
 
 /* Line 1455 of yacc.c  */
-#line 456 "../parser/Grammar.y"
+#line 456 "parser\\Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 53:
 
 /* Line 1455 of yacc.c  */
-#line 457 "../parser/Grammar.y"
+#line 457 "parser\\Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
@@ -3353,7 +3353,7 @@ yyreduce:
   case 54:
 
 /* Line 1455 of yacc.c  */
-#line 461 "../parser/Grammar.y"
+#line 461 "parser\\Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); 
@@ -3363,21 +3363,21 @@ yyreduce:
   case 55:
 
 /* Line 1455 of yacc.c  */
-#line 468 "../parser/Grammar.y"
+#line 468 "parser\\Grammar.y"
     { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 56:
 
 /* Line 1455 of yacc.c  */
-#line 469 "../parser/Grammar.y"
+#line 469 "parser\\Grammar.y"
     { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
     break;
 
   case 57:
 
 /* Line 1455 of yacc.c  */
-#line 473 "../parser/Grammar.y"
+#line 473 "parser\\Grammar.y"
     { (yyval.argumentList).m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
                                           (yyval.argumentList).m_node.tail = (yyval.argumentList).m_node.head;
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (1)].expressionNode).m_features;
@@ -3387,7 +3387,7 @@ yyreduce:
   case 58:
 
 /* Line 1455 of yacc.c  */
-#line 477 "../parser/Grammar.y"
+#line 477 "parser\\Grammar.y"
     { (yyval.argumentList).m_node.head = (yyvsp[(1) - (3)].argumentList).m_node.head;
                                           (yyval.argumentList).m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (3)].argumentList).m_features | (yyvsp[(3) - (3)].expressionNode).m_features;
@@ -3397,252 +3397,252 @@ yyreduce:
   case 64:
 
 /* Line 1455 of yacc.c  */
-#line 495 "../parser/Grammar.y"
+#line 495 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 65:
 
 /* Line 1455 of yacc.c  */
-#line 496 "../parser/Grammar.y"
+#line 496 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 67:
 
 /* Line 1455 of yacc.c  */
-#line 501 "../parser/Grammar.y"
+#line 501 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 68:
 
 /* Line 1455 of yacc.c  */
-#line 502 "../parser/Grammar.y"
+#line 502 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 69:
 
 /* Line 1455 of yacc.c  */
-#line 506 "../parser/Grammar.y"
+#line 506 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDeleteNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 70:
 
 /* Line 1455 of yacc.c  */
-#line 507 "../parser/Grammar.y"
+#line 507 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
     break;
 
   case 71:
 
 /* Line 1455 of yacc.c  */
-#line 508 "../parser/Grammar.y"
+#line 508 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeTypeOfNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 72:
 
 /* Line 1455 of yacc.c  */
-#line 509 "../parser/Grammar.y"
+#line 509 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 73:
 
 /* Line 1455 of yacc.c  */
-#line 510 "../parser/Grammar.y"
+#line 510 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 74:
 
 /* Line 1455 of yacc.c  */
-#line 511 "../parser/Grammar.y"
+#line 511 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 75:
 
 /* Line 1455 of yacc.c  */
-#line 512 "../parser/Grammar.y"
+#line 512 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 76:
 
 /* Line 1455 of yacc.c  */
-#line 513 "../parser/Grammar.y"
+#line 513 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 77:
 
 /* Line 1455 of yacc.c  */
-#line 514 "../parser/Grammar.y"
+#line 514 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNegateNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 78:
 
 /* Line 1455 of yacc.c  */
-#line 515 "../parser/Grammar.y"
+#line 515 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeBitwiseNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 79:
 
 /* Line 1455 of yacc.c  */
-#line 516 "../parser/Grammar.y"
+#line 516 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 85:
 
 /* Line 1455 of yacc.c  */
-#line 530 "../parser/Grammar.y"
+#line 530 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 86:
 
 /* Line 1455 of yacc.c  */
-#line 531 "../parser/Grammar.y"
+#line 531 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 87:
 
 /* Line 1455 of yacc.c  */
-#line 532 "../parser/Grammar.y"
+#line 532 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 89:
 
 /* Line 1455 of yacc.c  */
-#line 538 "../parser/Grammar.y"
+#line 538 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 90:
 
 /* Line 1455 of yacc.c  */
-#line 540 "../parser/Grammar.y"
+#line 540 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 91:
 
 /* Line 1455 of yacc.c  */
-#line 542 "../parser/Grammar.y"
+#line 542 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 93:
 
 /* Line 1455 of yacc.c  */
-#line 547 "../parser/Grammar.y"
+#line 547 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 94:
 
 /* Line 1455 of yacc.c  */
-#line 548 "../parser/Grammar.y"
+#line 548 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 96:
 
 /* Line 1455 of yacc.c  */
-#line 554 "../parser/Grammar.y"
+#line 554 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 97:
 
 /* Line 1455 of yacc.c  */
-#line 556 "../parser/Grammar.y"
+#line 556 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 99:
 
 /* Line 1455 of yacc.c  */
-#line 561 "../parser/Grammar.y"
+#line 561 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 100:
 
 /* Line 1455 of yacc.c  */
-#line 562 "../parser/Grammar.y"
+#line 562 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 101:
 
 /* Line 1455 of yacc.c  */
-#line 563 "../parser/Grammar.y"
+#line 563 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 103:
 
 /* Line 1455 of yacc.c  */
-#line 568 "../parser/Grammar.y"
+#line 568 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 104:
 
 /* Line 1455 of yacc.c  */
-#line 569 "../parser/Grammar.y"
+#line 569 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 105:
 
 /* Line 1455 of yacc.c  */
-#line 570 "../parser/Grammar.y"
+#line 570 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 107:
 
 /* Line 1455 of yacc.c  */
-#line 575 "../parser/Grammar.y"
+#line 575 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 108:
 
 /* Line 1455 of yacc.c  */
-#line 576 "../parser/Grammar.y"
+#line 576 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 109:
 
 /* Line 1455 of yacc.c  */
-#line 577 "../parser/Grammar.y"
+#line 577 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 110:
 
 /* Line 1455 of yacc.c  */
-#line 578 "../parser/Grammar.y"
+#line 578 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 111:
 
 /* Line 1455 of yacc.c  */
-#line 579 "../parser/Grammar.y"
+#line 579 "parser\\Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
@@ -3651,7 +3651,7 @@ yyreduce:
   case 112:
 
 /* Line 1455 of yacc.c  */
-#line 582 "../parser/Grammar.y"
+#line 582 "parser\\Grammar.y"
     { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
@@ -3660,35 +3660,35 @@ yyreduce:
   case 114:
 
 /* Line 1455 of yacc.c  */
-#line 589 "../parser/Grammar.y"
+#line 589 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 115:
 
 /* Line 1455 of yacc.c  */
-#line 590 "../parser/Grammar.y"
+#line 590 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 116:
 
 /* Line 1455 of yacc.c  */
-#line 591 "../parser/Grammar.y"
+#line 591 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 117:
 
 /* Line 1455 of yacc.c  */
-#line 592 "../parser/Grammar.y"
+#line 592 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 118:
 
 /* Line 1455 of yacc.c  */
-#line 594 "../parser/Grammar.y"
+#line 594 "parser\\Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
@@ -3697,35 +3697,35 @@ yyreduce:
   case 120:
 
 /* Line 1455 of yacc.c  */
-#line 601 "../parser/Grammar.y"
+#line 601 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 121:
 
 /* Line 1455 of yacc.c  */
-#line 602 "../parser/Grammar.y"
+#line 602 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 122:
 
 /* Line 1455 of yacc.c  */
-#line 603 "../parser/Grammar.y"
+#line 603 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 123:
 
 /* Line 1455 of yacc.c  */
-#line 604 "../parser/Grammar.y"
+#line 604 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 124:
 
 /* Line 1455 of yacc.c  */
-#line 606 "../parser/Grammar.y"
+#line 606 "parser\\Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
@@ -3734,7 +3734,7 @@ yyreduce:
   case 125:
 
 /* Line 1455 of yacc.c  */
-#line 610 "../parser/Grammar.y"
+#line 610 "parser\\Grammar.y"
     { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
@@ -3743,217 +3743,217 @@ yyreduce:
   case 127:
 
 /* Line 1455 of yacc.c  */
-#line 617 "../parser/Grammar.y"
+#line 617 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 128:
 
 /* Line 1455 of yacc.c  */
-#line 618 "../parser/Grammar.y"
+#line 618 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 129:
 
 /* Line 1455 of yacc.c  */
-#line 619 "../parser/Grammar.y"
+#line 619 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 130:
 
 /* Line 1455 of yacc.c  */
-#line 620 "../parser/Grammar.y"
+#line 620 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 132:
 
 /* Line 1455 of yacc.c  */
-#line 626 "../parser/Grammar.y"
+#line 626 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 133:
 
 /* Line 1455 of yacc.c  */
-#line 628 "../parser/Grammar.y"
+#line 628 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 134:
 
 /* Line 1455 of yacc.c  */
-#line 630 "../parser/Grammar.y"
+#line 630 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 135:
 
 /* Line 1455 of yacc.c  */
-#line 632 "../parser/Grammar.y"
+#line 632 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 137:
 
 /* Line 1455 of yacc.c  */
-#line 638 "../parser/Grammar.y"
+#line 638 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 138:
 
 /* Line 1455 of yacc.c  */
-#line 639 "../parser/Grammar.y"
+#line 639 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 139:
 
 /* Line 1455 of yacc.c  */
-#line 641 "../parser/Grammar.y"
+#line 641 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 140:
 
 /* Line 1455 of yacc.c  */
-#line 643 "../parser/Grammar.y"
+#line 643 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 142:
 
 /* Line 1455 of yacc.c  */
-#line 648 "../parser/Grammar.y"
+#line 648 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 144:
 
 /* Line 1455 of yacc.c  */
-#line 654 "../parser/Grammar.y"
+#line 654 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 146:
 
 /* Line 1455 of yacc.c  */
-#line 659 "../parser/Grammar.y"
+#line 659 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 148:
 
 /* Line 1455 of yacc.c  */
-#line 664 "../parser/Grammar.y"
+#line 664 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 150:
 
 /* Line 1455 of yacc.c  */
-#line 670 "../parser/Grammar.y"
+#line 670 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 152:
 
 /* Line 1455 of yacc.c  */
-#line 676 "../parser/Grammar.y"
+#line 676 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 154:
 
 /* Line 1455 of yacc.c  */
-#line 681 "../parser/Grammar.y"
+#line 681 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 156:
 
 /* Line 1455 of yacc.c  */
-#line 687 "../parser/Grammar.y"
+#line 687 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 158:
 
 /* Line 1455 of yacc.c  */
-#line 693 "../parser/Grammar.y"
+#line 693 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 160:
 
 /* Line 1455 of yacc.c  */
-#line 698 "../parser/Grammar.y"
+#line 698 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 162:
 
 /* Line 1455 of yacc.c  */
-#line 704 "../parser/Grammar.y"
+#line 704 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 164:
 
 /* Line 1455 of yacc.c  */
-#line 710 "../parser/Grammar.y"
+#line 710 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 166:
 
 /* Line 1455 of yacc.c  */
-#line 715 "../parser/Grammar.y"
+#line 715 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 168:
 
 /* Line 1455 of yacc.c  */
-#line 721 "../parser/Grammar.y"
+#line 721 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 170:
 
 /* Line 1455 of yacc.c  */
-#line 726 "../parser/Grammar.y"
+#line 726 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 172:
 
 /* Line 1455 of yacc.c  */
-#line 732 "../parser/Grammar.y"
+#line 732 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 174:
 
 /* Line 1455 of yacc.c  */
-#line 738 "../parser/Grammar.y"
+#line 738 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 176:
 
 /* Line 1455 of yacc.c  */
-#line 744 "../parser/Grammar.y"
+#line 744 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 178:
 
 /* Line 1455 of yacc.c  */
-#line 750 "../parser/Grammar.y"
+#line 750 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
                                         ;}
@@ -3962,7 +3962,7 @@ yyreduce:
   case 180:
 
 /* Line 1455 of yacc.c  */
-#line 758 "../parser/Grammar.y"
+#line 758 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants);
                                         ;}
@@ -3971,7 +3971,7 @@ yyreduce:
   case 182:
 
 /* Line 1455 of yacc.c  */
-#line 766 "../parser/Grammar.y"
+#line 766 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature,
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
                                         ;}
@@ -3980,112 +3980,112 @@ yyreduce:
   case 183:
 
 /* Line 1455 of yacc.c  */
-#line 772 "../parser/Grammar.y"
+#line 772 "parser\\Grammar.y"
     { (yyval.op) = OpEqual; ;}
     break;
 
   case 184:
 
 /* Line 1455 of yacc.c  */
-#line 773 "../parser/Grammar.y"
+#line 773 "parser\\Grammar.y"
     { (yyval.op) = OpPlusEq; ;}
     break;
 
   case 185:
 
 /* Line 1455 of yacc.c  */
-#line 774 "../parser/Grammar.y"
+#line 774 "parser\\Grammar.y"
     { (yyval.op) = OpMinusEq; ;}
     break;
 
   case 186:
 
 /* Line 1455 of yacc.c  */
-#line 775 "../parser/Grammar.y"
+#line 775 "parser\\Grammar.y"
     { (yyval.op) = OpMultEq; ;}
     break;
 
   case 187:
 
 /* Line 1455 of yacc.c  */
-#line 776 "../parser/Grammar.y"
+#line 776 "parser\\Grammar.y"
     { (yyval.op) = OpDivEq; ;}
     break;
 
   case 188:
 
 /* Line 1455 of yacc.c  */
-#line 777 "../parser/Grammar.y"
+#line 777 "parser\\Grammar.y"
     { (yyval.op) = OpLShift; ;}
     break;
 
   case 189:
 
 /* Line 1455 of yacc.c  */
-#line 778 "../parser/Grammar.y"
+#line 778 "parser\\Grammar.y"
     { (yyval.op) = OpRShift; ;}
     break;
 
   case 190:
 
 /* Line 1455 of yacc.c  */
-#line 779 "../parser/Grammar.y"
+#line 779 "parser\\Grammar.y"
     { (yyval.op) = OpURShift; ;}
     break;
 
   case 191:
 
 /* Line 1455 of yacc.c  */
-#line 780 "../parser/Grammar.y"
+#line 780 "parser\\Grammar.y"
     { (yyval.op) = OpAndEq; ;}
     break;
 
   case 192:
 
 /* Line 1455 of yacc.c  */
-#line 781 "../parser/Grammar.y"
+#line 781 "parser\\Grammar.y"
     { (yyval.op) = OpXOrEq; ;}
     break;
 
   case 193:
 
 /* Line 1455 of yacc.c  */
-#line 782 "../parser/Grammar.y"
+#line 782 "parser\\Grammar.y"
     { (yyval.op) = OpOrEq; ;}
     break;
 
   case 194:
 
 /* Line 1455 of yacc.c  */
-#line 783 "../parser/Grammar.y"
+#line 783 "parser\\Grammar.y"
     { (yyval.op) = OpModEq; ;}
     break;
 
   case 196:
 
 /* Line 1455 of yacc.c  */
-#line 788 "../parser/Grammar.y"
+#line 788 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 198:
 
 /* Line 1455 of yacc.c  */
-#line 793 "../parser/Grammar.y"
+#line 793 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 200:
 
 /* Line 1455 of yacc.c  */
-#line 798 "../parser/Grammar.y"
+#line 798 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 218:
 
 /* Line 1455 of yacc.c  */
-#line 822 "../parser/Grammar.y"
+#line 822 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
@@ -4093,7 +4093,7 @@ yyreduce:
   case 219:
 
 /* Line 1455 of yacc.c  */
-#line 824 "../parser/Grammar.y"
+#line 824 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
@@ -4101,7 +4101,7 @@ yyreduce:
   case 220:
 
 /* Line 1455 of yacc.c  */
-#line 829 "../parser/Grammar.y"
+#line 829 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
@@ -4109,7 +4109,7 @@ yyreduce:
   case 221:
 
 /* Line 1455 of yacc.c  */
-#line 831 "../parser/Grammar.y"
+#line 831 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
                                           AUTO_SEMICOLON; ;}
@@ -4118,7 +4118,7 @@ yyreduce:
   case 222:
 
 /* Line 1455 of yacc.c  */
-#line 837 "../parser/Grammar.y"
+#line 837 "parser\\Grammar.y"
     { (yyval.varDeclList).m_node = 0;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
@@ -4131,7 +4131,7 @@ yyreduce:
   case 223:
 
 /* Line 1455 of yacc.c  */
-#line 844 "../parser/Grammar.y"
+#line 844 "parser\\Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
@@ -4146,7 +4146,7 @@ yyreduce:
   case 224:
 
 /* Line 1455 of yacc.c  */
-#line 854 "../parser/Grammar.y"
+#line 854 "parser\\Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (3)].ident), 0);
@@ -4159,7 +4159,7 @@ yyreduce:
   case 225:
 
 /* Line 1455 of yacc.c  */
-#line 862 "../parser/Grammar.y"
+#line 862 "parser\\Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
                                           (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
@@ -4174,7 +4174,7 @@ yyreduce:
   case 226:
 
 /* Line 1455 of yacc.c  */
-#line 874 "../parser/Grammar.y"
+#line 874 "parser\\Grammar.y"
     { (yyval.varDeclList).m_node = 0;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
@@ -4187,7 +4187,7 @@ yyreduce:
   case 227:
 
 /* Line 1455 of yacc.c  */
-#line 881 "../parser/Grammar.y"
+#line 881 "parser\\Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
@@ -4202,7 +4202,7 @@ yyreduce:
   case 228:
 
 /* Line 1455 of yacc.c  */
-#line 891 "../parser/Grammar.y"
+#line 891 "parser\\Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (3)].ident), 0);
@@ -4215,7 +4215,7 @@ yyreduce:
   case 229:
 
 /* Line 1455 of yacc.c  */
-#line 899 "../parser/Grammar.y"
+#line 899 "parser\\Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
                                           (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
@@ -4230,7 +4230,7 @@ yyreduce:
   case 230:
 
 /* Line 1455 of yacc.c  */
-#line 911 "../parser/Grammar.y"
+#line 911 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
@@ -4238,7 +4238,7 @@ yyreduce:
   case 231:
 
 /* Line 1455 of yacc.c  */
-#line 914 "../parser/Grammar.y"
+#line 914 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
@@ -4246,7 +4246,7 @@ yyreduce:
   case 232:
 
 /* Line 1455 of yacc.c  */
-#line 919 "../parser/Grammar.y"
+#line 919 "parser\\Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (1)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyval.constDeclList).m_node.head;
                                           (yyval.constDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
@@ -4260,7 +4260,7 @@ yyreduce:
   case 233:
 
 /* Line 1455 of yacc.c  */
-#line 928 "../parser/Grammar.y"
+#line 928 "parser\\Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
                                           (yyvsp[(1) - (3)].constDeclList).m_node.tail->m_next = (yyvsp[(3) - (3)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyvsp[(3) - (3)].constDeclNode).m_node;
@@ -4274,42 +4274,42 @@ yyreduce:
   case 234:
 
 /* Line 1455 of yacc.c  */
-#line 939 "../parser/Grammar.y"
+#line 939 "parser\\Grammar.y"
     { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 235:
 
 /* Line 1455 of yacc.c  */
-#line 940 "../parser/Grammar.y"
+#line 940 "parser\\Grammar.y"
     { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 236:
 
 /* Line 1455 of yacc.c  */
-#line 944 "../parser/Grammar.y"
+#line 944 "parser\\Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 237:
 
 /* Line 1455 of yacc.c  */
-#line 948 "../parser/Grammar.y"
+#line 948 "parser\\Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 238:
 
 /* Line 1455 of yacc.c  */
-#line 952 "../parser/Grammar.y"
+#line 952 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
     break;
 
   case 239:
 
 /* Line 1455 of yacc.c  */
-#line 956 "../parser/Grammar.y"
+#line 956 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
@@ -4317,7 +4317,7 @@ yyreduce:
   case 240:
 
 /* Line 1455 of yacc.c  */
-#line 958 "../parser/Grammar.y"
+#line 958 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
@@ -4325,7 +4325,7 @@ yyreduce:
   case 241:
 
 /* Line 1455 of yacc.c  */
-#line 964 "../parser/Grammar.y"
+#line 964 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
@@ -4333,7 +4333,7 @@ yyreduce:
   case 242:
 
 /* Line 1455 of yacc.c  */
-#line 967 "../parser/Grammar.y"
+#line 967 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
                                                                                          mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
@@ -4345,7 +4345,7 @@ yyreduce:
   case 243:
 
 /* Line 1455 of yacc.c  */
-#line 976 "../parser/Grammar.y"
+#line 976 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
@@ -4353,7 +4353,7 @@ yyreduce:
   case 244:
 
 /* Line 1455 of yacc.c  */
-#line 978 "../parser/Grammar.y"
+#line 978 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
@@ -4361,7 +4361,7 @@ yyreduce:
   case 245:
 
 /* Line 1455 of yacc.c  */
-#line 980 "../parser/Grammar.y"
+#line 980 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
@@ -4369,7 +4369,7 @@ yyreduce:
   case 246:
 
 /* Line 1455 of yacc.c  */
-#line 983 "../parser/Grammar.y"
+#line 983 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_features | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_numConstants + (yyvsp[(5) - (9)].expressionNode).m_numConstants + (yyvsp[(7) - (9)].expressionNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
@@ -4380,7 +4380,7 @@ yyreduce:
   case 247:
 
 /* Line 1455 of yacc.c  */
-#line 989 "../parser/Grammar.y"
+#line 989 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_varDeclarations, (yyvsp[(10) - (10)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_funcDeclarations, (yyvsp[(10) - (10)].statementNode).m_funcDeclarations),
@@ -4392,7 +4392,7 @@ yyreduce:
   case 248:
 
 /* Line 1455 of yacc.c  */
-#line 996 "../parser/Grammar.y"
+#line 996 "parser\\Grammar.y"
     {
                                             ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
                                             setExceptionLocation(node, (yylsp[(3) - (7)]).first_column, (yylsp[(3) - (7)]).last_column, (yylsp[(5) - (7)]).last_column);
@@ -4406,7 +4406,7 @@ yyreduce:
   case 249:
 
 /* Line 1455 of yacc.c  */
-#line 1005 "../parser/Grammar.y"
+#line 1005 "parser\\Grammar.y"
     { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
                                           setExceptionLocation(forIn, (yylsp[(4) - (8)]).first_column, (yylsp[(5) - (8)]).first_column + 1, (yylsp[(6) - (8)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, *(yyvsp[(4) - (8)].ident), DeclarationStacks::HasInitializer);
@@ -4417,7 +4417,7 @@ yyreduce:
   case 250:
 
 /* Line 1455 of yacc.c  */
-#line 1011 "../parser/Grammar.y"
+#line 1011 "parser\\Grammar.y"
     { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
                                           setExceptionLocation(forIn, (yylsp[(4) - (9)]).first_column, (yylsp[(6) - (9)]).first_column + 1, (yylsp[(7) - (9)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, *(yyvsp[(4) - (9)].ident), DeclarationStacks::HasInitializer);
@@ -4430,21 +4430,21 @@ yyreduce:
   case 251:
 
 /* Line 1455 of yacc.c  */
-#line 1021 "../parser/Grammar.y"
+#line 1021 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 253:
 
 /* Line 1455 of yacc.c  */
-#line 1026 "../parser/Grammar.y"
+#line 1026 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 255:
 
 /* Line 1455 of yacc.c  */
-#line 1031 "../parser/Grammar.y"
+#line 1031 "parser\\Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
@@ -4454,7 +4454,7 @@ yyreduce:
   case 256:
 
 /* Line 1455 of yacc.c  */
-#line 1035 "../parser/Grammar.y"
+#line 1035 "parser\\Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
@@ -4464,7 +4464,7 @@ yyreduce:
   case 257:
 
 /* Line 1455 of yacc.c  */
-#line 1039 "../parser/Grammar.y"
+#line 1039 "parser\\Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
@@ -4474,7 +4474,7 @@ yyreduce:
   case 258:
 
 /* Line 1455 of yacc.c  */
-#line 1043 "../parser/Grammar.y"
+#line 1043 "parser\\Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
@@ -4484,7 +4484,7 @@ yyreduce:
   case 259:
 
 /* Line 1455 of yacc.c  */
-#line 1050 "../parser/Grammar.y"
+#line 1050 "parser\\Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
@@ -4493,7 +4493,7 @@ yyreduce:
   case 260:
 
 /* Line 1455 of yacc.c  */
-#line 1053 "../parser/Grammar.y"
+#line 1053 "parser\\Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
@@ -4502,7 +4502,7 @@ yyreduce:
   case 261:
 
 /* Line 1455 of yacc.c  */
-#line 1056 "../parser/Grammar.y"
+#line 1056 "parser\\Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
@@ -4511,7 +4511,7 @@ yyreduce:
   case 262:
 
 /* Line 1455 of yacc.c  */
-#line 1059 "../parser/Grammar.y"
+#line 1059 "parser\\Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
@@ -4520,7 +4520,7 @@ yyreduce:
   case 263:
 
 /* Line 1455 of yacc.c  */
-#line 1065 "../parser/Grammar.y"
+#line 1065 "parser\\Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
@@ -4529,7 +4529,7 @@ yyreduce:
   case 264:
 
 /* Line 1455 of yacc.c  */
-#line 1068 "../parser/Grammar.y"
+#line 1068 "parser\\Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
@@ -4538,7 +4538,7 @@ yyreduce:
   case 265:
 
 /* Line 1455 of yacc.c  */
-#line 1071 "../parser/Grammar.y"
+#line 1071 "parser\\Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
@@ -4547,7 +4547,7 @@ yyreduce:
   case 266:
 
 /* Line 1455 of yacc.c  */
-#line 1074 "../parser/Grammar.y"
+#line 1074 "parser\\Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
@@ -4556,7 +4556,7 @@ yyreduce:
   case 267:
 
 /* Line 1455 of yacc.c  */
-#line 1080 "../parser/Grammar.y"
+#line 1080 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
                                                                                          (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features | WithFeature, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
@@ -4565,7 +4565,7 @@ yyreduce:
   case 268:
 
 /* Line 1455 of yacc.c  */
-#line 1086 "../parser/Grammar.y"
+#line 1086 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
                                                                                          (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].caseBlockNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].caseBlockNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
@@ -4574,14 +4574,14 @@ yyreduce:
   case 269:
 
 /* Line 1455 of yacc.c  */
-#line 1092 "../parser/Grammar.y"
+#line 1092 "parser\\Grammar.y"
     { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
     break;
 
   case 270:
 
 /* Line 1455 of yacc.c  */
-#line 1094 "../parser/Grammar.y"
+#line 1094 "parser\\Grammar.y"
     { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_varDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_varDeclarations), (yyvsp[(4) - (5)].clauseList).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_funcDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_funcDeclarations), (yyvsp[(4) - (5)].clauseList).m_funcDeclarations),
@@ -4592,14 +4592,14 @@ yyreduce:
   case 271:
 
 /* Line 1455 of yacc.c  */
-#line 1102 "../parser/Grammar.y"
+#line 1102 "parser\\Grammar.y"
     { (yyval.clauseList).m_node.head = 0; (yyval.clauseList).m_node.tail = 0; (yyval.clauseList).m_varDeclarations = 0; (yyval.clauseList).m_funcDeclarations = 0; (yyval.clauseList).m_features = 0; (yyval.clauseList).m_numConstants = 0; ;}
     break;
 
   case 273:
 
 /* Line 1455 of yacc.c  */
-#line 1107 "../parser/Grammar.y"
+#line 1107 "parser\\Grammar.y"
     { (yyval.clauseList).m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_node.tail = (yyval.clauseList).m_node.head;
                                           (yyval.clauseList).m_varDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_varDeclarations;
@@ -4611,7 +4611,7 @@ yyreduce:
   case 274:
 
 /* Line 1455 of yacc.c  */
-#line 1113 "../parser/Grammar.y"
+#line 1113 "parser\\Grammar.y"
     { (yyval.clauseList).m_node.head = (yyvsp[(1) - (2)].clauseList).m_node.head;
                                           (yyval.clauseList).m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_varDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_varDeclarations);
@@ -4624,35 +4624,35 @@ yyreduce:
   case 275:
 
 /* Line 1455 of yacc.c  */
-#line 1123 "../parser/Grammar.y"
+#line 1123 "parser\\Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 276:
 
 /* Line 1455 of yacc.c  */
-#line 1124 "../parser/Grammar.y"
+#line 1124 "parser\\Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
     break;
 
   case 277:
 
 /* Line 1455 of yacc.c  */
-#line 1128 "../parser/Grammar.y"
+#line 1128 "parser\\Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
     break;
 
   case 278:
 
 /* Line 1455 of yacc.c  */
-#line 1129 "../parser/Grammar.y"
+#line 1129 "parser\\Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
     break;
 
   case 279:
 
 /* Line 1455 of yacc.c  */
-#line 1133 "../parser/Grammar.y"
+#line 1133 "parser\\Grammar.y"
     { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(3) - (3)].statementNode).m_varDeclarations, (yyvsp[(3) - (3)].statementNode).m_funcDeclarations, (yyvsp[(3) - (3)].statementNode).m_features, (yyvsp[(3) - (3)].statementNode).m_numConstants); ;}
@@ -4661,7 +4661,7 @@ yyreduce:
   case 280:
 
 /* Line 1455 of yacc.c  */
-#line 1139 "../parser/Grammar.y"
+#line 1139 "parser\\Grammar.y"
     { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
@@ -4671,7 +4671,7 @@ yyreduce:
   case 281:
 
 /* Line 1455 of yacc.c  */
-#line 1143 "../parser/Grammar.y"
+#line 1143 "parser\\Grammar.y"
     { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; 
@@ -4681,7 +4681,7 @@ yyreduce:
   case 282:
 
 /* Line 1455 of yacc.c  */
-#line 1150 "../parser/Grammar.y"
+#line 1150 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_varDeclarations, (yyvsp[(4) - (4)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_funcDeclarations, (yyvsp[(4) - (4)].statementNode).m_funcDeclarations),
@@ -4693,7 +4693,7 @@ yyreduce:
   case 283:
 
 /* Line 1455 of yacc.c  */
-#line 1156 "../parser/Grammar.y"
+#line 1156 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
@@ -4705,7 +4705,7 @@ yyreduce:
   case 284:
 
 /* Line 1455 of yacc.c  */
-#line 1163 "../parser/Grammar.y"
+#line 1163 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_varDeclarations, (yyvsp[(7) - (9)].statementNode).m_varDeclarations), (yyvsp[(9) - (9)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_funcDeclarations, (yyvsp[(7) - (9)].statementNode).m_funcDeclarations), (yyvsp[(9) - (9)].statementNode).m_funcDeclarations),
@@ -4717,7 +4717,7 @@ yyreduce:
   case 285:
 
 /* Line 1455 of yacc.c  */
-#line 1172 "../parser/Grammar.y"
+#line 1172 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
@@ -4725,7 +4725,7 @@ yyreduce:
   case 286:
 
 /* Line 1455 of yacc.c  */
-#line 1174 "../parser/Grammar.y"
+#line 1174 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
@@ -4733,14 +4733,14 @@ yyreduce:
   case 287:
 
 /* Line 1455 of yacc.c  */
-#line 1179 "../parser/Grammar.y"
+#line 1179 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)->body()); ;}
     break;
 
   case 288:
 
 /* Line 1455 of yacc.c  */
-#line 1181 "../parser/Grammar.y"
+#line 1181 "parser\\Grammar.y"
     {
           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0);
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
@@ -4753,14 +4753,14 @@ yyreduce:
   case 289:
 
 /* Line 1455 of yacc.c  */
-#line 1191 "../parser/Grammar.y"
+#line 1191 "parser\\Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(5) - (6)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(4) - (6)].intValue), (yyvsp[(6) - (6)].intValue), (yylsp[(4) - (6)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(5) - (6)].functionBodyNode), (yylsp[(4) - (6)]), (yylsp[(6) - (6)])); ;}
     break;
 
   case 290:
 
 /* Line 1455 of yacc.c  */
-#line 1193 "../parser/Grammar.y"
+#line 1193 "parser\\Grammar.y"
     {
           (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line), (yyvsp[(3) - (7)].parameterList).m_node.head), (yyvsp[(3) - (7)].parameterList).m_features | ClosureFeature, 0);
           if ((yyvsp[(3) - (7)].parameterList).m_features & ArgumentsFeature)
@@ -4772,14 +4772,14 @@ yyreduce:
   case 291:
 
 /* Line 1455 of yacc.c  */
-#line 1199 "../parser/Grammar.y"
+#line 1199 "parser\\Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); ;}
     break;
 
   case 292:
 
 /* Line 1455 of yacc.c  */
-#line 1201 "../parser/Grammar.y"
+#line 1201 "parser\\Grammar.y"
     {
           (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
@@ -4791,7 +4791,7 @@ yyreduce:
   case 293:
 
 /* Line 1455 of yacc.c  */
-#line 1210 "../parser/Grammar.y"
+#line 1210 "parser\\Grammar.y"
     { (yyval.parameterList).m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
                                           (yyval.parameterList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           (yyval.parameterList).m_node.tail = (yyval.parameterList).m_node.head; ;}
@@ -4800,7 +4800,7 @@ yyreduce:
   case 294:
 
 /* Line 1455 of yacc.c  */
-#line 1213 "../parser/Grammar.y"
+#line 1213 "parser\\Grammar.y"
     { (yyval.parameterList).m_node.head = (yyvsp[(1) - (3)].parameterList).m_node.head;
                                           (yyval.parameterList).m_features = (yyvsp[(1) - (3)].parameterList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
                                           (yyval.parameterList).m_node.tail = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].parameterList).m_node.tail, *(yyvsp[(3) - (3)].ident));  ;}
@@ -4809,28 +4809,28 @@ yyreduce:
   case 295:
 
 /* Line 1455 of yacc.c  */
-#line 1219 "../parser/Grammar.y"
+#line 1219 "parser\\Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 296:
 
 /* Line 1455 of yacc.c  */
-#line 1220 "../parser/Grammar.y"
+#line 1220 "parser\\Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 297:
 
 /* Line 1455 of yacc.c  */
-#line 1224 "../parser/Grammar.y"
+#line 1224 "parser\\Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
     break;
 
   case 298:
 
 /* Line 1455 of yacc.c  */
-#line 1225 "../parser/Grammar.y"
+#line 1225 "parser\\Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing((yyvsp[(1) - (1)].sourceElements).m_node, (yyvsp[(1) - (1)].sourceElements).m_varDeclarations, (yyvsp[(1) - (1)].sourceElements).m_funcDeclarations, (yyvsp[(1) - (1)].sourceElements).m_features, 
                                                                                 (yylsp[(1) - (1)]).last_line, (yyvsp[(1) - (1)].sourceElements).m_numConstants); ;}
     break;
@@ -4838,7 +4838,7 @@ yyreduce:
   case 299:
 
 /* Line 1455 of yacc.c  */
-#line 1230 "../parser/Grammar.y"
+#line 1230 "parser\\Grammar.y"
     { (yyval.sourceElements).m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
                                           (yyval.sourceElements).m_node->append((yyvsp[(1) - (1)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = (yyvsp[(1) - (1)].statementNode).m_varDeclarations;
@@ -4851,7 +4851,7 @@ yyreduce:
   case 300:
 
 /* Line 1455 of yacc.c  */
-#line 1237 "../parser/Grammar.y"
+#line 1237 "parser\\Grammar.y"
     { (yyval.sourceElements).m_node->append((yyvsp[(2) - (2)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_varDeclarations, (yyvsp[(2) - (2)].statementNode).m_varDeclarations);
                                           (yyval.sourceElements).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (2)].statementNode).m_funcDeclarations);
@@ -4863,259 +4863,259 @@ yyreduce:
   case 304:
 
 /* Line 1455 of yacc.c  */
-#line 1251 "../parser/Grammar.y"
+#line 1251 "parser\\Grammar.y"
     { ;}
     break;
 
   case 305:
 
 /* Line 1455 of yacc.c  */
-#line 1252 "../parser/Grammar.y"
+#line 1252 "parser\\Grammar.y"
     { ;}
     break;
 
   case 306:
 
 /* Line 1455 of yacc.c  */
-#line 1253 "../parser/Grammar.y"
+#line 1253 "parser\\Grammar.y"
     { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
     break;
 
   case 307:
 
 /* Line 1455 of yacc.c  */
-#line 1254 "../parser/Grammar.y"
+#line 1254 "parser\\Grammar.y"
     { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
     break;
 
   case 308:
 
 /* Line 1455 of yacc.c  */
-#line 1258 "../parser/Grammar.y"
+#line 1258 "parser\\Grammar.y"
     { ;}
     break;
 
   case 309:
 
 /* Line 1455 of yacc.c  */
-#line 1259 "../parser/Grammar.y"
+#line 1259 "parser\\Grammar.y"
     { ;}
     break;
 
   case 310:
 
 /* Line 1455 of yacc.c  */
-#line 1260 "../parser/Grammar.y"
+#line 1260 "parser\\Grammar.y"
     { ;}
     break;
 
   case 311:
 
 /* Line 1455 of yacc.c  */
-#line 1261 "../parser/Grammar.y"
+#line 1261 "parser\\Grammar.y"
     { if (*(yyvsp[(1) - (7)].ident) != "get" && *(yyvsp[(1) - (7)].ident) != "set") YYABORT; ;}
     break;
 
   case 312:
 
 /* Line 1455 of yacc.c  */
-#line 1262 "../parser/Grammar.y"
+#line 1262 "parser\\Grammar.y"
     { if (*(yyvsp[(1) - (8)].ident) != "get" && *(yyvsp[(1) - (8)].ident) != "set") YYABORT; ;}
     break;
 
   case 316:
 
 /* Line 1455 of yacc.c  */
-#line 1272 "../parser/Grammar.y"
+#line 1272 "parser\\Grammar.y"
     { ;}
     break;
 
   case 317:
 
 /* Line 1455 of yacc.c  */
-#line 1273 "../parser/Grammar.y"
+#line 1273 "parser\\Grammar.y"
     { ;}
     break;
 
   case 318:
 
 /* Line 1455 of yacc.c  */
-#line 1275 "../parser/Grammar.y"
+#line 1275 "parser\\Grammar.y"
     { ;}
     break;
 
   case 322:
 
 /* Line 1455 of yacc.c  */
-#line 1282 "../parser/Grammar.y"
+#line 1282 "parser\\Grammar.y"
     { ;}
     break;
 
   case 517:
 
 /* Line 1455 of yacc.c  */
-#line 1650 "../parser/Grammar.y"
+#line 1650 "parser\\Grammar.y"
     { ;}
     break;
 
   case 518:
 
 /* Line 1455 of yacc.c  */
-#line 1651 "../parser/Grammar.y"
+#line 1651 "parser\\Grammar.y"
     { ;}
     break;
 
   case 520:
 
 /* Line 1455 of yacc.c  */
-#line 1656 "../parser/Grammar.y"
+#line 1656 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 521:
 
 /* Line 1455 of yacc.c  */
-#line 1660 "../parser/Grammar.y"
+#line 1660 "parser\\Grammar.y"
     { ;}
     break;
 
   case 522:
 
 /* Line 1455 of yacc.c  */
-#line 1661 "../parser/Grammar.y"
+#line 1661 "parser\\Grammar.y"
     { ;}
     break;
 
   case 525:
 
 /* Line 1455 of yacc.c  */
-#line 1667 "../parser/Grammar.y"
+#line 1667 "parser\\Grammar.y"
     { ;}
     break;
 
   case 526:
 
 /* Line 1455 of yacc.c  */
-#line 1668 "../parser/Grammar.y"
+#line 1668 "parser\\Grammar.y"
     { ;}
     break;
 
   case 530:
 
 /* Line 1455 of yacc.c  */
-#line 1675 "../parser/Grammar.y"
+#line 1675 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 533:
 
 /* Line 1455 of yacc.c  */
-#line 1684 "../parser/Grammar.y"
+#line 1684 "parser\\Grammar.y"
     { ;}
     break;
 
   case 534:
 
 /* Line 1455 of yacc.c  */
-#line 1685 "../parser/Grammar.y"
+#line 1685 "parser\\Grammar.y"
     { ;}
     break;
 
   case 539:
 
 /* Line 1455 of yacc.c  */
-#line 1702 "../parser/Grammar.y"
+#line 1702 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 555:
 
 /* Line 1455 of yacc.c  */
-#line 1733 "../parser/Grammar.y"
+#line 1733 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 557:
 
 /* Line 1455 of yacc.c  */
-#line 1735 "../parser/Grammar.y"
+#line 1735 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 559:
 
 /* Line 1455 of yacc.c  */
-#line 1740 "../parser/Grammar.y"
+#line 1740 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 561:
 
 /* Line 1455 of yacc.c  */
-#line 1742 "../parser/Grammar.y"
+#line 1742 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 563:
 
 /* Line 1455 of yacc.c  */
-#line 1747 "../parser/Grammar.y"
+#line 1747 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 565:
 
 /* Line 1455 of yacc.c  */
-#line 1749 "../parser/Grammar.y"
+#line 1749 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 568:
 
 /* Line 1455 of yacc.c  */
-#line 1761 "../parser/Grammar.y"
+#line 1761 "parser\\Grammar.y"
     { ;}
     break;
 
   case 569:
 
 /* Line 1455 of yacc.c  */
-#line 1762 "../parser/Grammar.y"
+#line 1762 "parser\\Grammar.y"
     { ;}
     break;
 
   case 578:
 
 /* Line 1455 of yacc.c  */
-#line 1786 "../parser/Grammar.y"
+#line 1786 "parser\\Grammar.y"
     { ;}
     break;
 
   case 580:
 
 /* Line 1455 of yacc.c  */
-#line 1791 "../parser/Grammar.y"
+#line 1791 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 585:
 
 /* Line 1455 of yacc.c  */
-#line 1802 "../parser/Grammar.y"
+#line 1802 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 592:
 
 /* Line 1455 of yacc.c  */
-#line 1818 "../parser/Grammar.y"
+#line 1818 "parser\\Grammar.y"
     { ;}
     break;
 
 
 
 /* Line 1455 of yacc.c  */
-#line 5119 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+#line 5119 "C:/dev/webkit-2.0/JavaScriptCore/generated\\Grammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -5334,7 +5334,7 @@ yyreturn:
 
 
 /* Line 1675 of yacc.c  */
-#line 1834 "../parser/Grammar.y"
+#line 1834 "parser\\Grammar.y"
 
 
 #undef GLOBAL_DATA
@@ -5491,12 +5491,9 @@ static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData* globalData, co
 static ExpressionNode* makeNegateNode(JSGlobalData* globalData, ExpressionNode* n)
 {
     if (n->isNumber()) {
-        NumberNode* number = static_cast<NumberNode*>(n);
-
-        if (number->value() > 0.0) {
-            number->setValue(-number->value());
-            return number;
-        }
+        NumberNode* numberNode = static_cast<NumberNode*>(n);
+        numberNode->setValue(-numberNode->value());
+        return numberNode;
     }
 
     return new (globalData) NegateNode(globalData, n);
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
index a485e42cf8..69942f753f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
@@ -112,7 +112,7 @@ typedef union YYSTYPE
 {
 
 /* Line 1676 of yacc.c  */
-#line 146 "../parser/Grammar.y"
+#line 146 "parser\\Grammar.y"
 
     int                 intValue;
     double              doubleValue;
@@ -147,7 +147,7 @@ typedef union YYSTYPE
 
 
 /* Line 1676 of yacc.c  */
-#line 151 "JavaScriptCore/tmp/../generated/Grammar.tab.h"
+#line 151 "C:/dev/webkit-2.0/JavaScriptCore/generated\\Grammar.tab.h"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/JSONObject.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/JSONObject.lut.h
index a9b1631301..acfe7d2026 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/JSONObject.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/JSONObject.lut.h
@@ -1,12 +1,12 @@
-// Automatically generated from ../runtime/JSONObject.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\JSONObject.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue jsonTableValues[3] = {
-   { "parse", DontEnum|Function, (intptr_t)JSONProtoFuncParse, (intptr_t)1 },
-   { "stringify", DontEnum|Function, (intptr_t)JSONProtoFuncStringify, (intptr_t)1 },
+   { "parse", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(JSONProtoFuncParse), (intptr_t)1 },
+   { "stringify", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(JSONProtoFuncStringify), (intptr_t)1 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h
index 95c33b6378..556a6f4947 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h
@@ -1,46 +1,46 @@
-// Automatically generated from ../parser/Keywords.table using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from parser\Keywords.table using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue mainTableValues[37] = {
-   { "null", 0, (intptr_t)NULLTOKEN, (intptr_t)0 },
-   { "true", 0, (intptr_t)TRUETOKEN, (intptr_t)0 },
-   { "false", 0, (intptr_t)FALSETOKEN, (intptr_t)0 },
-   { "break", 0, (intptr_t)BREAK, (intptr_t)0 },
-   { "case", 0, (intptr_t)CASE, (intptr_t)0 },
-   { "catch", 0, (intptr_t)CATCH, (intptr_t)0 },
-   { "const", 0, (intptr_t)CONSTTOKEN, (intptr_t)0 },
-   { "default", 0, (intptr_t)DEFAULT, (intptr_t)0 },
-   { "finally", 0, (intptr_t)FINALLY, (intptr_t)0 },
-   { "for", 0, (intptr_t)FOR, (intptr_t)0 },
-   { "instanceof", 0, (intptr_t)INSTANCEOF, (intptr_t)0 },
-   { "new", 0, (intptr_t)NEW, (intptr_t)0 },
-   { "var", 0, (intptr_t)VAR, (intptr_t)0 },
-   { "continue", 0, (intptr_t)CONTINUE, (intptr_t)0 },
-   { "function", 0, (intptr_t)FUNCTION, (intptr_t)0 },
-   { "return", 0, (intptr_t)RETURN, (intptr_t)0 },
-   { "void", 0, (intptr_t)VOIDTOKEN, (intptr_t)0 },
-   { "delete", 0, (intptr_t)DELETETOKEN, (intptr_t)0 },
-   { "if", 0, (intptr_t)IF, (intptr_t)0 },
-   { "this", 0, (intptr_t)THISTOKEN, (intptr_t)0 },
-   { "do", 0, (intptr_t)DO, (intptr_t)0 },
-   { "while", 0, (intptr_t)WHILE, (intptr_t)0 },
-   { "else", 0, (intptr_t)ELSE, (intptr_t)0 },
-   { "in", 0, (intptr_t)INTOKEN, (intptr_t)0 },
-   { "switch", 0, (intptr_t)SWITCH, (intptr_t)0 },
-   { "throw", 0, (intptr_t)THROW, (intptr_t)0 },
-   { "try", 0, (intptr_t)TRY, (intptr_t)0 },
-   { "typeof", 0, (intptr_t)TYPEOF, (intptr_t)0 },
-   { "with", 0, (intptr_t)WITH, (intptr_t)0 },
-   { "debugger", 0, (intptr_t)DEBUGGER, (intptr_t)0 },
-   { "class", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "enum", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "export", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "extends", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "import", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "super", 0, (intptr_t)RESERVED, (intptr_t)0 },
+   { "null", 0, (intptr_t)(NULLTOKEN), (intptr_t)0 },
+   { "true", 0, (intptr_t)(TRUETOKEN), (intptr_t)0 },
+   { "false", 0, (intptr_t)(FALSETOKEN), (intptr_t)0 },
+   { "break", 0, (intptr_t)(BREAK), (intptr_t)0 },
+   { "case", 0, (intptr_t)(CASE), (intptr_t)0 },
+   { "catch", 0, (intptr_t)(CATCH), (intptr_t)0 },
+   { "const", 0, (intptr_t)(CONSTTOKEN), (intptr_t)0 },
+   { "default", 0, (intptr_t)(DEFAULT), (intptr_t)0 },
+   { "finally", 0, (intptr_t)(FINALLY), (intptr_t)0 },
+   { "for", 0, (intptr_t)(FOR), (intptr_t)0 },
+   { "instanceof", 0, (intptr_t)(INSTANCEOF), (intptr_t)0 },
+   { "new", 0, (intptr_t)(NEW), (intptr_t)0 },
+   { "var", 0, (intptr_t)(VAR), (intptr_t)0 },
+   { "continue", 0, (intptr_t)(CONTINUE), (intptr_t)0 },
+   { "function", 0, (intptr_t)(FUNCTION), (intptr_t)0 },
+   { "return", 0, (intptr_t)(RETURN), (intptr_t)0 },
+   { "void", 0, (intptr_t)(VOIDTOKEN), (intptr_t)0 },
+   { "delete", 0, (intptr_t)(DELETETOKEN), (intptr_t)0 },
+   { "if", 0, (intptr_t)(IF), (intptr_t)0 },
+   { "this", 0, (intptr_t)(THISTOKEN), (intptr_t)0 },
+   { "do", 0, (intptr_t)(DO), (intptr_t)0 },
+   { "while", 0, (intptr_t)(WHILE), (intptr_t)0 },
+   { "else", 0, (intptr_t)(ELSE), (intptr_t)0 },
+   { "in", 0, (intptr_t)(INTOKEN), (intptr_t)0 },
+   { "switch", 0, (intptr_t)(SWITCH), (intptr_t)0 },
+   { "throw", 0, (intptr_t)(THROW), (intptr_t)0 },
+   { "try", 0, (intptr_t)(TRY), (intptr_t)0 },
+   { "typeof", 0, (intptr_t)(TYPEOF), (intptr_t)0 },
+   { "with", 0, (intptr_t)(WITH), (intptr_t)0 },
+   { "debugger", 0, (intptr_t)(DEBUGGER), (intptr_t)0 },
+   { "class", 0, (intptr_t)(RESERVED), (intptr_t)0 },
+   { "enum", 0, (intptr_t)(RESERVED), (intptr_t)0 },
+   { "export", 0, (intptr_t)(RESERVED), (intptr_t)0 },
+   { "extends", 0, (intptr_t)(RESERVED), (intptr_t)0 },
+   { "import", 0, (intptr_t)(RESERVED), (intptr_t)0 },
+   { "super", 0, (intptr_t)(RESERVED), (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h
index 9cb0ee21de..85a1bb64fd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h
@@ -1,28 +1,28 @@
-// Automatically generated from ../runtime/MathObject.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\MathObject.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue mathTableValues[19] = {
-   { "abs", DontEnum|Function, (intptr_t)mathProtoFuncAbs, (intptr_t)1 },
-   { "acos", DontEnum|Function, (intptr_t)mathProtoFuncACos, (intptr_t)1 },
-   { "asin", DontEnum|Function, (intptr_t)mathProtoFuncASin, (intptr_t)1 },
-   { "atan", DontEnum|Function, (intptr_t)mathProtoFuncATan, (intptr_t)1 },
-   { "atan2", DontEnum|Function, (intptr_t)mathProtoFuncATan2, (intptr_t)2 },
-   { "ceil", DontEnum|Function, (intptr_t)mathProtoFuncCeil, (intptr_t)1 },
-   { "cos", DontEnum|Function, (intptr_t)mathProtoFuncCos, (intptr_t)1 },
-   { "exp", DontEnum|Function, (intptr_t)mathProtoFuncExp, (intptr_t)1 },
-   { "floor", DontEnum|Function, (intptr_t)mathProtoFuncFloor, (intptr_t)1 },
-   { "log", DontEnum|Function, (intptr_t)mathProtoFuncLog, (intptr_t)1 },
-   { "max", DontEnum|Function, (intptr_t)mathProtoFuncMax, (intptr_t)2 },
-   { "min", DontEnum|Function, (intptr_t)mathProtoFuncMin, (intptr_t)2 },
-   { "pow", DontEnum|Function, (intptr_t)mathProtoFuncPow, (intptr_t)2 },
-   { "random", DontEnum|Function, (intptr_t)mathProtoFuncRandom, (intptr_t)0 },
-   { "round", DontEnum|Function, (intptr_t)mathProtoFuncRound, (intptr_t)1 },
-   { "sin", DontEnum|Function, (intptr_t)mathProtoFuncSin, (intptr_t)1 },
-   { "sqrt", DontEnum|Function, (intptr_t)mathProtoFuncSqrt, (intptr_t)1 },
-   { "tan", DontEnum|Function, (intptr_t)mathProtoFuncTan, (intptr_t)1 },
+   { "abs", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncAbs), (intptr_t)1 },
+   { "acos", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncACos), (intptr_t)1 },
+   { "asin", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncASin), (intptr_t)1 },
+   { "atan", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncATan), (intptr_t)1 },
+   { "atan2", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncATan2), (intptr_t)2 },
+   { "ceil", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncCeil), (intptr_t)1 },
+   { "cos", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncCos), (intptr_t)1 },
+   { "exp", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncExp), (intptr_t)1 },
+   { "floor", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncFloor), (intptr_t)1 },
+   { "log", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncLog), (intptr_t)1 },
+   { "max", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncMax), (intptr_t)2 },
+   { "min", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncMin), (intptr_t)2 },
+   { "pow", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncPow), (intptr_t)2 },
+   { "random", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncRandom), (intptr_t)0 },
+   { "round", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncRound), (intptr_t)1 },
+   { "sin", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncSin), (intptr_t)1 },
+   { "sqrt", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncSqrt), (intptr_t)1 },
+   { "tan", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncTan), (intptr_t)1 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h
index 6285d62648..1cd411766f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h
@@ -1,15 +1,15 @@
-// Automatically generated from ../runtime/NumberConstructor.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\NumberConstructor.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue numberTableValues[6] = {
-   { "NaN", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorNaNValue, (intptr_t)0 },
-   { "NEGATIVE_INFINITY", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorNegInfinity, (intptr_t)0 },
-   { "POSITIVE_INFINITY", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorPosInfinity, (intptr_t)0 },
-   { "MAX_VALUE", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorMaxValue, (intptr_t)0 },
-   { "MIN_VALUE", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorMinValue, (intptr_t)0 },
+   { "NaN", DontEnum|DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(numberConstructorNaNValue), (intptr_t)0 },
+   { "NEGATIVE_INFINITY", DontEnum|DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(numberConstructorNegInfinity), (intptr_t)0 },
+   { "POSITIVE_INFINITY", DontEnum|DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(numberConstructorPosInfinity), (intptr_t)0 },
+   { "MAX_VALUE", DontEnum|DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(numberConstructorMaxValue), (intptr_t)0 },
+   { "MIN_VALUE", DontEnum|DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(numberConstructorMinValue), (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h
index a3f15b3a36..938d368082 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h
@@ -1,31 +1,31 @@
-// Automatically generated from ../runtime/RegExpConstructor.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\RegExpConstructor.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue regExpConstructorTableValues[22] = {
-   { "input", None, (intptr_t)regExpConstructorInput, (intptr_t)setRegExpConstructorInput },
-   { "$_", DontEnum, (intptr_t)regExpConstructorInput, (intptr_t)setRegExpConstructorInput },
-   { "multiline", None, (intptr_t)regExpConstructorMultiline, (intptr_t)setRegExpConstructorMultiline },
-   { "$*", DontEnum, (intptr_t)regExpConstructorMultiline, (intptr_t)setRegExpConstructorMultiline },
-   { "lastMatch", DontDelete|ReadOnly, (intptr_t)regExpConstructorLastMatch, (intptr_t)0 },
-   { "$&", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorLastMatch, (intptr_t)0 },
-   { "lastParen", DontDelete|ReadOnly, (intptr_t)regExpConstructorLastParen, (intptr_t)0 },
-   { "$+", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorLastParen, (intptr_t)0 },
-   { "leftContext", DontDelete|ReadOnly, (intptr_t)regExpConstructorLeftContext, (intptr_t)0 },
-   { "$`", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorLeftContext, (intptr_t)0 },
-   { "rightContext", DontDelete|ReadOnly, (intptr_t)regExpConstructorRightContext, (intptr_t)0 },
-   { "$'", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorRightContext, (intptr_t)0 },
-   { "$1", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar1, (intptr_t)0 },
-   { "$2", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar2, (intptr_t)0 },
-   { "$3", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar3, (intptr_t)0 },
-   { "$4", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar4, (intptr_t)0 },
-   { "$5", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar5, (intptr_t)0 },
-   { "$6", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar6, (intptr_t)0 },
-   { "$7", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar7, (intptr_t)0 },
-   { "$8", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar8, (intptr_t)0 },
-   { "$9", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar9, (intptr_t)0 },
+   { "input", None, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorInput), (intptr_t)setRegExpConstructorInput },
+   { "$_", DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorInput), (intptr_t)setRegExpConstructorInput },
+   { "multiline", None, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorMultiline), (intptr_t)setRegExpConstructorMultiline },
+   { "$*", DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorMultiline), (intptr_t)setRegExpConstructorMultiline },
+   { "lastMatch", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLastMatch), (intptr_t)0 },
+   { "$&", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLastMatch), (intptr_t)0 },
+   { "lastParen", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLastParen), (intptr_t)0 },
+   { "$+", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLastParen), (intptr_t)0 },
+   { "leftContext", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLeftContext), (intptr_t)0 },
+   { "$`", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLeftContext), (intptr_t)0 },
+   { "rightContext", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorRightContext), (intptr_t)0 },
+   { "$'", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorRightContext), (intptr_t)0 },
+   { "$1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar1), (intptr_t)0 },
+   { "$2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar2), (intptr_t)0 },
+   { "$3", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar3), (intptr_t)0 },
+   { "$4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar4), (intptr_t)0 },
+   { "$5", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar5), (intptr_t)0 },
+   { "$6", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar6), (intptr_t)0 },
+   { "$7", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar7), (intptr_t)0 },
+   { "$8", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar8), (intptr_t)0 },
+   { "$9", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar9), (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h
index 8c87f16477..aadd236da1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h
@@ -1,15 +1,15 @@
-// Automatically generated from ../runtime/RegExpObject.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\RegExpObject.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue regExpTableValues[6] = {
-   { "global", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectGlobal, (intptr_t)0 },
-   { "ignoreCase", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectIgnoreCase, (intptr_t)0 },
-   { "multiline", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectMultiline, (intptr_t)0 },
-   { "source", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectSource, (intptr_t)0 },
-   { "lastIndex", DontDelete|DontEnum, (intptr_t)regExpObjectLastIndex, (intptr_t)setRegExpObjectLastIndex },
+   { "global", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpObjectGlobal), (intptr_t)0 },
+   { "ignoreCase", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpObjectIgnoreCase), (intptr_t)0 },
+   { "multiline", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpObjectMultiline), (intptr_t)0 },
+   { "source", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpObjectSource), (intptr_t)0 },
+   { "lastIndex", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpObjectLastIndex), (intptr_t)setRegExpObjectLastIndex },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
index c8ff849942..2d08eac19c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
@@ -1,45 +1,45 @@
-// Automatically generated from ../runtime/StringPrototype.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\StringPrototype.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue stringTableValues[36] = {
-   { "toString", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
-   { "valueOf", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
-   { "charAt", DontEnum|Function, (intptr_t)stringProtoFuncCharAt, (intptr_t)1 },
-   { "charCodeAt", DontEnum|Function, (intptr_t)stringProtoFuncCharCodeAt, (intptr_t)1 },
-   { "concat", DontEnum|Function, (intptr_t)stringProtoFuncConcat, (intptr_t)1 },
-   { "indexOf", DontEnum|Function, (intptr_t)stringProtoFuncIndexOf, (intptr_t)1 },
-   { "lastIndexOf", DontEnum|Function, (intptr_t)stringProtoFuncLastIndexOf, (intptr_t)1 },
-   { "match", DontEnum|Function, (intptr_t)stringProtoFuncMatch, (intptr_t)1 },
-   { "replace", DontEnum|Function, (intptr_t)stringProtoFuncReplace, (intptr_t)2 },
-   { "search", DontEnum|Function, (intptr_t)stringProtoFuncSearch, (intptr_t)1 },
-   { "slice", DontEnum|Function, (intptr_t)stringProtoFuncSlice, (intptr_t)2 },
-   { "split", DontEnum|Function, (intptr_t)stringProtoFuncSplit, (intptr_t)2 },
-   { "substr", DontEnum|Function, (intptr_t)stringProtoFuncSubstr, (intptr_t)2 },
-   { "substring", DontEnum|Function, (intptr_t)stringProtoFuncSubstring, (intptr_t)2 },
-   { "toLowerCase", DontEnum|Function, (intptr_t)stringProtoFuncToLowerCase, (intptr_t)0 },
-   { "toUpperCase", DontEnum|Function, (intptr_t)stringProtoFuncToUpperCase, (intptr_t)0 },
-   { "localeCompare", DontEnum|Function, (intptr_t)stringProtoFuncLocaleCompare, (intptr_t)1 },
-   { "toLocaleLowerCase", DontEnum|Function, (intptr_t)stringProtoFuncToLowerCase, (intptr_t)0 },
-   { "toLocaleUpperCase", DontEnum|Function, (intptr_t)stringProtoFuncToUpperCase, (intptr_t)0 },
-   { "big", DontEnum|Function, (intptr_t)stringProtoFuncBig, (intptr_t)0 },
-   { "small", DontEnum|Function, (intptr_t)stringProtoFuncSmall, (intptr_t)0 },
-   { "blink", DontEnum|Function, (intptr_t)stringProtoFuncBlink, (intptr_t)0 },
-   { "bold", DontEnum|Function, (intptr_t)stringProtoFuncBold, (intptr_t)0 },
-   { "fixed", DontEnum|Function, (intptr_t)stringProtoFuncFixed, (intptr_t)0 },
-   { "italics", DontEnum|Function, (intptr_t)stringProtoFuncItalics, (intptr_t)0 },
-   { "strike", DontEnum|Function, (intptr_t)stringProtoFuncStrike, (intptr_t)0 },
-   { "sub", DontEnum|Function, (intptr_t)stringProtoFuncSub, (intptr_t)0 },
-   { "sup", DontEnum|Function, (intptr_t)stringProtoFuncSup, (intptr_t)0 },
-   { "fontcolor", DontEnum|Function, (intptr_t)stringProtoFuncFontcolor, (intptr_t)1 },
-   { "fontsize", DontEnum|Function, (intptr_t)stringProtoFuncFontsize, (intptr_t)1 },
-   { "anchor", DontEnum|Function, (intptr_t)stringProtoFuncAnchor, (intptr_t)1 },
-   { "link", DontEnum|Function, (intptr_t)stringProtoFuncLink, (intptr_t)1 },
-   { "trim", DontEnum|Function, (intptr_t)stringProtoFuncTrim, (intptr_t)0 },
-   { "trimLeft", DontEnum|Function, (intptr_t)stringProtoFuncTrimLeft, (intptr_t)0 },
-   { "trimRight", DontEnum|Function, (intptr_t)stringProtoFuncTrimRight, (intptr_t)0 },
+   { "toString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToString), (intptr_t)0 },
+   { "valueOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToString), (intptr_t)0 },
+   { "charAt", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncCharAt), (intptr_t)1 },
+   { "charCodeAt", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncCharCodeAt), (intptr_t)1 },
+   { "concat", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncConcat), (intptr_t)1 },
+   { "indexOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncIndexOf), (intptr_t)1 },
+   { "lastIndexOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncLastIndexOf), (intptr_t)1 },
+   { "match", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncMatch), (intptr_t)1 },
+   { "replace", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncReplace), (intptr_t)2 },
+   { "search", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSearch), (intptr_t)1 },
+   { "slice", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSlice), (intptr_t)2 },
+   { "split", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSplit), (intptr_t)2 },
+   { "substr", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSubstr), (intptr_t)2 },
+   { "substring", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSubstring), (intptr_t)2 },
+   { "toLowerCase", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToLowerCase), (intptr_t)0 },
+   { "toUpperCase", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToUpperCase), (intptr_t)0 },
+   { "localeCompare", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncLocaleCompare), (intptr_t)1 },
+   { "toLocaleLowerCase", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToLowerCase), (intptr_t)0 },
+   { "toLocaleUpperCase", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToUpperCase), (intptr_t)0 },
+   { "big", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncBig), (intptr_t)0 },
+   { "small", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSmall), (intptr_t)0 },
+   { "blink", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncBlink), (intptr_t)0 },
+   { "bold", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncBold), (intptr_t)0 },
+   { "fixed", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncFixed), (intptr_t)0 },
+   { "italics", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncItalics), (intptr_t)0 },
+   { "strike", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncStrike), (intptr_t)0 },
+   { "sub", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSub), (intptr_t)0 },
+   { "sup", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSup), (intptr_t)0 },
+   { "fontcolor", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncFontcolor), (intptr_t)1 },
+   { "fontsize", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncFontsize), (intptr_t)1 },
+   { "anchor", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncAnchor), (intptr_t)1 },
+   { "link", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncLink), (intptr_t)1 },
+   { "trim", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncTrim), (intptr_t)0 },
+   { "trimLeft", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncTrimLeft), (intptr_t)0 },
+   { "trimRight", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncTrimRight), (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
index e903b79e33..eb48a03d67 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
@@ -38,7 +38,7 @@ namespace JSC {
             : m_valid(false)
             , m_interpreter(callFrame->interpreter())
             , m_exception(exception)
-            , m_globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : function->scope().globalObject())
+            , m_globalObjectScope(callFrame, function->scope().globalObject())
         {
             ASSERT(!function->isHostFunction());
             m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, function, argCount, function->scope().node(), exception);
@@ -52,7 +52,14 @@ namespace JSC {
         }
         void setThis(JSValue v) { m_closure.setArgument(0, v); }
         void setArgument(int n, JSValue v) { m_closure.setArgument(n + 1, v); }
-        CallFrame* newCallFrame() { return m_closure.newCallFrame; }
+
+        CallFrame* newCallFrame(ExecState* exec)
+        {
+            CallFrame* callFrame = m_closure.newCallFrame;
+            callFrame->setScopeChain(exec->scopeChain());
+            return callFrame;
+        }
+
         ~CachedCall()
         {
             if (m_valid)
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
index b4d49db08b..e3ea689165 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
@@ -39,7 +39,11 @@ namespace JSC  {
     public:
         JSFunction* callee() const { return this[RegisterFile::Callee].function(); }
         CodeBlock* codeBlock() const { return this[RegisterFile::CodeBlock].Register::codeBlock(); }
-        ScopeChainNode* scopeChain() const { return this[RegisterFile::ScopeChain].Register::scopeChain(); }
+        ScopeChainNode* scopeChain() const
+        {
+            ASSERT(this[RegisterFile::ScopeChain].Register::scopeChain());
+            return this[RegisterFile::ScopeChain].Register::scopeChain();
+        }
         int argumentCount() const { return this[RegisterFile::ArgumentCount].i(); }
 
         JSValue thisValue();
@@ -66,6 +70,7 @@ namespace JSC  {
         // or a pointer everywhere.
         JSGlobalData& globalData() const
         {
+            ASSERT(scopeChain()->globalData);
             return *scopeChain()->globalData;
         }
 
@@ -105,9 +110,9 @@ namespace JSC  {
         Arguments* optionalCalleeArguments() const { return this[RegisterFile::OptionalCalleeArguments].arguments(); }
         Instruction* returnPC() const { return this[RegisterFile::ReturnPC].vPC(); }
 
-        void setCalleeArguments(JSValue arguments) { this[RegisterFile::OptionalCalleeArguments] = arguments; }
-        void setCallerFrame(CallFrame* callerFrame) { this[RegisterFile::CallerFrame] = callerFrame; }
-        void setScopeChain(ScopeChainNode* scopeChain) { this[RegisterFile::ScopeChain] = scopeChain; }
+        void setCalleeArguments(JSValue arguments) { static_cast<Register*>(this)[RegisterFile::OptionalCalleeArguments] = arguments; }
+        void setCallerFrame(CallFrame* callerFrame) { static_cast<Register*>(this)[RegisterFile::CallerFrame] = callerFrame; }
+        void setScopeChain(ScopeChainNode* scopeChain) { static_cast<Register*>(this)[RegisterFile::ScopeChain] = scopeChain; }
 
         ALWAYS_INLINE void init(CodeBlock* codeBlock, Instruction* vPC, ScopeChainNode* scopeChain,
             CallFrame* callerFrame, int returnValueRegister, int argc, JSFunction* function)
@@ -117,8 +122,8 @@ namespace JSC  {
             setCodeBlock(codeBlock);
             setScopeChain(scopeChain);
             setCallerFrame(callerFrame);
-            this[RegisterFile::ReturnPC] = vPC; // This is either an Instruction* or a pointer into JIT generated code stored as an Instruction*.
-            this[RegisterFile::ReturnValueRegister] = Register::withInt(returnValueRegister);
+            static_cast<Register*>(this)[RegisterFile::ReturnPC] = vPC; // This is either an Instruction* or a pointer into JIT generated code stored as an Instruction*.
+            static_cast<Register*>(this)[RegisterFile::ReturnValueRegister] = Register::withInt(returnValueRegister);
             setArgumentCount(argc); // original argument count (for the sake of the "arguments" object)
             setCallee(function);
             setCalleeArguments(JSValue());
@@ -135,9 +140,9 @@ namespace JSC  {
         CallFrame* removeHostCallFrameFlag() { return reinterpret_cast<CallFrame*>(reinterpret_cast<intptr_t>(this) & ~HostCallFrameFlag); }
 
     private:
-        void setArgumentCount(int count) { this[RegisterFile::ArgumentCount] = Register::withInt(count); }
-        void setCallee(JSFunction* callee) { this[RegisterFile::Callee] = callee; }
-        void setCodeBlock(CodeBlock* codeBlock) { this[RegisterFile::CodeBlock] = codeBlock; }
+        void setArgumentCount(int count) { static_cast<Register*>(this)[RegisterFile::ArgumentCount] = Register::withInt(count); }
+        void setCallee(JSFunction* callee) { static_cast<Register*>(this)[RegisterFile::Callee] = callee; }
+        void setCodeBlock(CodeBlock* codeBlock) { static_cast<Register*>(this)[RegisterFile::CodeBlock] = codeBlock; }
 
         static const intptr_t HostCallFrameFlag = 1;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
index db0edc4370..2713fd4371 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
@@ -40,6 +40,7 @@
 #include "DebuggerCallFrame.h"
 #include "EvalCodeCache.h"
 #include "ExceptionHelpers.h"
+#include "GetterSetter.h"
 #include "GlobalEvalFunction.h"
 #include "JSActivation.h"
 #include "JSArray.h"
@@ -169,7 +170,7 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
     PropertySlot slot(globalObject);
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
+        if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
             if (vPC[4].u.structure)
                 vPC[4].u.structure->deref();
             globalObject->structure()->ref();
@@ -300,7 +301,7 @@ NEVER_INLINE JSValue Interpreter::callEval(CallFrame* callFrame, RegisterFile* r
     if (!program.isString())
         return program;
 
-    UString programSource = asString(program)->value();
+    UString programSource = asString(program)->value(callFrame);
 
     LiteralParser preparser(callFrame, programSource, LiteralParser::NonStrictJSON);
     if (JSValue parsedObject = preparser.tryLiteralParse())
@@ -321,7 +322,13 @@ Interpreter::Interpreter()
     : m_sampleEntryDepth(0)
     , m_reentryDepth(0)
 {
+#if HAVE(COMPUTED_GOTO)
     privateExecute(InitializeAndReturn, 0, 0, 0);
+
+    for (int i = 0; i < numOpcodeIDs; ++i)
+        m_opcodeIDTable.add(m_opcodeTable[i], static_cast<OpcodeID>(i));
+#endif // HAVE(COMPUTED_GOTO)
+
 #if ENABLE(OPCODE_SAMPLING)
     enableSampler();
 #endif
@@ -527,7 +534,8 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
 
     if (Debugger* debugger = callFrame->dynamicGlobalObject()->debugger()) {
         DebuggerCallFrame debuggerCallFrame(callFrame, exceptionValue);
-        debugger->exception(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset));
+        bool hasHandler = codeBlock->handlerForBytecodeOffset(bytecodeOffset);
+        debugger->exception(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset), hasHandler);
     }
 
     // If we throw in the middle of a call instruction, we need to notify
@@ -537,7 +545,7 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
 #if !ENABLE(JIT)
         if (isCallBytecode(codeBlock->instructions()[bytecodeOffset].u.opcode))
             profiler->didExecute(callFrame, callFrame->r(codeBlock->instructions()[bytecodeOffset + 2].u.operand).jsValue());
-        else if (codeBlock->instructions()[bytecodeOffset + 8].u.opcode == getOpcode(op_construct))
+        else if (codeBlock->instructions().size() > (bytecodeOffset + 8) && codeBlock->instructions()[bytecodeOffset + 8].u.opcode == getOpcode(op_construct))
             profiler->didExecute(callFrame, callFrame->r(codeBlock->instructions()[bytecodeOffset + 10].u.operand).jsValue());
 #else
         int functionRegisterIndex;
@@ -647,7 +655,7 @@ JSValue Interpreter::execute(FunctionExecutable* functionExecutable, CallFrame*
         return jsNull();
     }
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject);
+    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject);
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd);
     size_t dst = 0;
@@ -777,7 +785,7 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
         }
     }
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject);
+    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject);
 
     EvalCodeBlock* codeBlock = &eval->bytecode(callFrame, scopeChain);
 
@@ -1022,8 +1030,20 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
     // Cache hit: Specialize instruction and ref Structures.
 
     if (slot.slotBase() == baseValue) {
-        vPC[0] = getOpcode(op_get_by_id_self);
-        vPC[5] = slot.cachedOffset();
+        switch (slot.cachedPropertyType()) {
+        case PropertySlot::Getter:
+            vPC[0] = getOpcode(op_get_by_id_getter_self);
+            vPC[5] = slot.cachedOffset();
+            break;
+        case PropertySlot::Custom:
+            vPC[0] = getOpcode(op_get_by_id_custom_self);
+            vPC[5] = slot.customGetter();
+            break;
+        default:
+            vPC[0] = getOpcode(op_get_by_id_self);
+            vPC[5] = slot.cachedOffset();
+            break;
+        }
 
         codeBlock->refStructures(vPC);
         return;
@@ -1038,33 +1058,62 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         ASSERT(slot.slotBase().isObject());
 
         JSObject* baseObject = asObject(slot.slotBase());
+        size_t offset = slot.cachedOffset();
 
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
-        if (baseObject->structure()->isDictionary())
-            baseObject->setStructure(Structure::fromDictionaryTransition(baseObject->structure()));
+        if (baseObject->structure()->isDictionary()) {
+            baseObject->flattenDictionaryObject();
+            offset = baseObject->structure()->get(propertyName);
+        }
 
         ASSERT(!baseObject->structure()->isUncacheableDictionary());
-
-        vPC[0] = getOpcode(op_get_by_id_proto);
+        
+        switch (slot.cachedPropertyType()) {
+        case PropertySlot::Getter:
+            vPC[0] = getOpcode(op_get_by_id_getter_proto);
+            vPC[6] = offset;
+            break;
+        case PropertySlot::Custom:
+            vPC[0] = getOpcode(op_get_by_id_custom_proto);
+            vPC[6] = slot.customGetter();
+            break;
+        default:
+            vPC[0] = getOpcode(op_get_by_id_proto);
+            vPC[6] = offset;
+            break;
+        }
         vPC[5] = baseObject->structure();
-        vPC[6] = slot.cachedOffset();
 
         codeBlock->refStructures(vPC);
         return;
     }
 
-    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase());
+    size_t offset = slot.cachedOffset();
+    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset);
     if (!count) {
         vPC[0] = getOpcode(op_get_by_id_generic);
         return;
     }
 
-    vPC[0] = getOpcode(op_get_by_id_chain);
+    
+    switch (slot.cachedPropertyType()) {
+    case PropertySlot::Getter:
+        vPC[0] = getOpcode(op_get_by_id_getter_chain);
+        vPC[7] = offset;
+        break;
+    case PropertySlot::Custom:
+        vPC[0] = getOpcode(op_get_by_id_custom_chain);
+        vPC[7] = slot.customGetter();
+        break;
+    default:
+        vPC[0] = getOpcode(op_get_by_id_chain);
+        vPC[7] = offset;
+        break;
+    }
     vPC[4] = structure;
     vPC[5] = structure->prototypeChain(callFrame);
     vPC[6] = count;
-    vPC[7] = slot.cachedOffset();
     codeBlock->refStructures(vPC);
 }
 
@@ -1081,16 +1130,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 {
     // One-time initialization of our address tables. We have to put this code
     // here because our labels are only in scope inside this function.
-    if (flag == InitializeAndReturn) {
+    if (UNLIKELY(flag == InitializeAndReturn)) {
         #if HAVE(COMPUTED_GOTO)
-            #define ADD_BYTECODE(id, length) m_opcodeTable[id] = &&id;
-                FOR_EACH_OPCODE_ID(ADD_BYTECODE);
-            #undef ADD_BYTECODE
-
-            #define ADD_OPCODE_ID(id, length) m_opcodeIDTable.add(&&id, id);
-                FOR_EACH_OPCODE_ID(ADD_OPCODE_ID);
-            #undef ADD_OPCODE_ID
-            ASSERT(m_opcodeIDTable.size() == numOpcodeIDs);
+            #define LIST_OPCODE_LABEL(id, length) &&id,
+                static Opcode labels[] = { FOR_EACH_OPCODE_ID(LIST_OPCODE_LABEL) };
+                for (size_t i = 0; i < sizeof(labels) / sizeof(Opcode); ++i)
+                    m_opcodeTable[i] = labels[i];
+            #undef LIST_OPCODE_LABEL
         #endif // HAVE(COMPUTED_GOTO)
         return JSValue();
     }
@@ -1306,7 +1352,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        callFrame->r(dst) = jsBoolean(JSValue::strictEqual(src1, src2));
+        callFrame->r(dst) = jsBoolean(JSValue::strictEqual(callFrame, src1, src2));
 
         vPC += OPCODE_LENGTH(op_stricteq);
         NEXT_INSTRUCTION();
@@ -1321,7 +1367,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        callFrame->r(dst) = jsBoolean(!JSValue::strictEqual(src1, src2));
+        callFrame->r(dst) = jsBoolean(!JSValue::strictEqual(callFrame, src1, src2));
 
         vPC += OPCODE_LENGTH(op_nstricteq);
         NEXT_INSTRUCTION();
@@ -1474,7 +1520,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         int dst = vPC[1].u.operand;
         JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
-        if (src.isInt32() && src.asInt32())
+        if (src.isInt32() && (src.asInt32() & 0x7fffffff)) // non-zero and no overflow
             callFrame->r(dst) = jsNumber(callFrame, -src.asInt32());
         else {
             JSValue result = jsNumber(callFrame, -src.toNumber(callFrame));
@@ -1495,7 +1541,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
+        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | (src2.asInt32() & 0xc0000000))) // no overflow
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() + src2.asInt32());
         else {
             JSValue result = jsAdd(callFrame, src1, src2);
@@ -1582,7 +1628,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
+        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | (src2.asInt32() & 0xc0000000))) // no overflow
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() - src2.asInt32());
         else {
             JSValue result = jsNumber(callFrame, src1.toNumber(callFrame) - src2.toNumber(callFrame));
@@ -2153,6 +2199,93 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         uncacheGetByID(callFrame->codeBlock(), vPC);
         NEXT_INSTRUCTION();
     }
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_getter_proto);
+#endif
+    DEFINE_OPCODE(op_get_by_id_getter_proto) {
+        /* op_get_by_id_getter_proto dst(r) base(r) property(id) structure(sID) prototypeStructure(sID) offset(n) nop(n)
+         
+         Cached property access: Attempts to get a cached getter property from the
+         value base's prototype. If the cache misses, op_get_by_id_getter_proto
+         reverts to op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                ASSERT(structure->prototypeForLookup(callFrame).isObject());
+                JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
+                Structure* prototypeStructure = vPC[5].u.structure;
+                
+                if (LIKELY(protoObject->structure() == prototypeStructure)) {
+                    int dst = vPC[1].u.operand;
+                    int offset = vPC[6].u.operand;
+                    if (GetterSetter* getterSetter = asGetterSetter(protoObject->getDirectOffset(offset).asCell())) {
+                        JSObject* getter = getterSetter->getter();
+                        CallData callData;
+                        CallType callType = getter->getCallData(callData);
+                        JSValue result = call(callFrame, getter, callType, callData, asObject(baseCell), ArgList());
+                        CHECK_FOR_EXCEPTION();
+                        callFrame->r(dst) = result;
+                    } else
+                        callFrame->r(dst) = jsUndefined();
+                    vPC += OPCODE_LENGTH(op_get_by_id_getter_proto);
+                    NEXT_INSTRUCTION();
+                }
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+    skip_id_getter_proto:
+#endif
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_custom_proto);
+#endif
+    DEFINE_OPCODE(op_get_by_id_custom_proto) {
+        /* op_get_by_id_custom_proto dst(r) base(r) property(id) structure(sID) prototypeStructure(sID) offset(n) nop(n)
+         
+         Cached property access: Attempts to use a cached named property getter
+         from the value base's prototype. If the cache misses, op_get_by_id_custom_proto
+         reverts to op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                ASSERT(structure->prototypeForLookup(callFrame).isObject());
+                JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
+                Structure* prototypeStructure = vPC[5].u.structure;
+                
+                if (LIKELY(protoObject->structure() == prototypeStructure)) {
+                    int dst = vPC[1].u.operand;
+                    int property = vPC[3].u.operand;
+                    Identifier& ident = callFrame->codeBlock()->identifier(property);
+                    
+                    PropertySlot::GetValueFunc getter = vPC[6].u.getterFunc;
+                    JSValue result = getter(callFrame, protoObject, ident);
+                    CHECK_FOR_EXCEPTION();
+                    callFrame->r(dst) = result;
+                    vPC += OPCODE_LENGTH(op_get_by_id_custom_proto);
+                    NEXT_INSTRUCTION();
+                }
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+    skip_id_custom_proto:
+#endif
     DEFINE_OPCODE(op_get_by_id_self_list) {
         // Polymorphic self access caching currently only supported when JITting.
         ASSERT_NOT_REACHED();
@@ -2167,6 +2300,34 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_get_by_id_proto_list);
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_get_by_id_getter_self_list) {
+        // Polymorphic self access caching currently only supported when JITting.
+        ASSERT_NOT_REACHED();
+        // This case of the switch must not be empty, else (op_get_by_id_self_list == op_get_by_id_chain)!
+        vPC += OPCODE_LENGTH(op_get_by_id_self_list);
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_get_by_id_getter_proto_list) {
+        // Polymorphic prototype access caching currently only supported when JITting.
+        ASSERT_NOT_REACHED();
+        // This case of the switch must not be empty, else (op_get_by_id_proto_list == op_get_by_id_chain)!
+        vPC += OPCODE_LENGTH(op_get_by_id_proto_list);
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_get_by_id_custom_self_list) {
+        // Polymorphic self access caching currently only supported when JITting.
+        ASSERT_NOT_REACHED();
+        // This case of the switch must not be empty, else (op_get_by_id_self_list == op_get_by_id_chain)!
+        vPC += OPCODE_LENGTH(op_get_by_id_custom_self_list);
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_get_by_id_custom_proto_list) {
+        // Polymorphic prototype access caching currently only supported when JITting.
+        ASSERT_NOT_REACHED();
+        // This case of the switch must not be empty, else (op_get_by_id_proto_list == op_get_by_id_chain)!
+        vPC += OPCODE_LENGTH(op_get_by_id_proto_list);
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_get_by_id_chain) {
         /* op_get_by_id_chain dst(r) base(r) property(id) structure(sID) structureChain(chain) count(n) offset(n)
 
@@ -2213,6 +2374,86 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         uncacheGetByID(callFrame->codeBlock(), vPC);
         NEXT_INSTRUCTION();
     }
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_getter_self);
+#endif
+    DEFINE_OPCODE(op_get_by_id_getter_self) {
+        /* op_get_by_id_self dst(r) base(r) property(id) structure(sID) offset(n) nop(n) nop(n)
+         
+         Cached property access: Attempts to get a cached property from the
+         value base. If the cache misses, op_get_by_id_getter_self reverts to
+         op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                ASSERT(baseCell->isObject());
+                JSObject* baseObject = asObject(baseCell);
+                int dst = vPC[1].u.operand;
+                int offset = vPC[5].u.operand;
+
+                if (GetterSetter* getterSetter = asGetterSetter(baseObject->getDirectOffset(offset).asCell())) {
+                    JSObject* getter = getterSetter->getter();
+                    CallData callData;
+                    CallType callType = getter->getCallData(callData);
+                    JSValue result = call(callFrame, getter, callType, callData, baseObject, ArgList());
+                    CHECK_FOR_EXCEPTION();
+                    callFrame->r(dst) = result;
+                } else
+                    callFrame->r(dst) = jsUndefined();
+
+                vPC += OPCODE_LENGTH(op_get_by_id_getter_self);
+                NEXT_INSTRUCTION();
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+    skip_id_getter_self:
+#endif
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_custom_self);
+#endif
+    DEFINE_OPCODE(op_get_by_id_custom_self) {
+        /* op_get_by_id_custom_self dst(r) base(r) property(id) structure(sID) offset(n) nop(n) nop(n)
+         
+         Cached property access: Attempts to use a cached named property getter
+         from the value base. If the cache misses, op_get_by_id_custom_self reverts to
+         op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                ASSERT(baseCell->isObject());
+                int dst = vPC[1].u.operand;
+                int property = vPC[3].u.operand;
+                Identifier& ident = callFrame->codeBlock()->identifier(property);
+
+                PropertySlot::GetValueFunc getter = vPC[5].u.getterFunc;
+                JSValue result = getter(callFrame, baseValue, ident);
+                CHECK_FOR_EXCEPTION();
+                callFrame->r(dst) = result;
+                vPC += OPCODE_LENGTH(op_get_by_id_custom_self);
+                NEXT_INSTRUCTION();
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+skip_id_custom_self:
+#endif
     DEFINE_OPCODE(op_get_by_id_generic) {
         /* op_get_by_id_generic dst(r) base(r) property(id) nop(sID) nop(n) nop(n) nop(n)
 
@@ -2233,6 +2474,113 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_get_by_id_generic);
         NEXT_INSTRUCTION();
     }
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_getter_chain);
+#endif
+    DEFINE_OPCODE(op_get_by_id_getter_chain) {
+        /* op_get_by_id_getter_chain dst(r) base(r) property(id) structure(sID) structureChain(chain) count(n) offset(n)
+         
+         Cached property access: Attempts to get a cached property from the
+         value base's prototype chain. If the cache misses, op_get_by_id_getter_chain
+         reverts to op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                RefPtr<Structure>* it = vPC[5].u.structureChain->head();
+                size_t count = vPC[6].u.operand;
+                RefPtr<Structure>* end = it + count;
+                
+                while (true) {
+                    JSObject* baseObject = asObject(baseCell->structure()->prototypeForLookup(callFrame));
+                    
+                    if (UNLIKELY(baseObject->structure() != (*it).get()))
+                        break;
+                    
+                    if (++it == end) {
+                        int dst = vPC[1].u.operand;
+                        int offset = vPC[7].u.operand;
+                        if (GetterSetter* getterSetter = asGetterSetter(baseObject->getDirectOffset(offset).asCell())) {
+                            JSObject* getter = getterSetter->getter();
+                            CallData callData;
+                            CallType callType = getter->getCallData(callData);
+                            JSValue result = call(callFrame, getter, callType, callData, baseValue, ArgList());
+                            CHECK_FOR_EXCEPTION();
+                            callFrame->r(dst) = result;
+                        } else
+                            callFrame->r(dst) = jsUndefined();
+                        vPC += OPCODE_LENGTH(op_get_by_id_getter_chain);
+                        NEXT_INSTRUCTION();
+                    }
+                    
+                    // Update baseCell, so that next time around the loop we'll pick up the prototype's prototype.
+                    baseCell = baseObject;
+                }
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+    skip_id_getter_chain:
+#endif
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_custom_chain);
+#endif
+    DEFINE_OPCODE(op_get_by_id_custom_chain) {
+        /* op_get_by_id_custom_chain dst(r) base(r) property(id) structure(sID) structureChain(chain) count(n) offset(n)
+         
+         Cached property access: Attempts to use a cached named property getter on the
+         value base's prototype chain. If the cache misses, op_get_by_id_custom_chain
+         reverts to op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                RefPtr<Structure>* it = vPC[5].u.structureChain->head();
+                size_t count = vPC[6].u.operand;
+                RefPtr<Structure>* end = it + count;
+                
+                while (true) {
+                    JSObject* baseObject = asObject(baseCell->structure()->prototypeForLookup(callFrame));
+                    
+                    if (UNLIKELY(baseObject->structure() != (*it).get()))
+                        break;
+                    
+                    if (++it == end) {
+                        int dst = vPC[1].u.operand;
+                        int property = vPC[3].u.operand;
+                        Identifier& ident = callFrame->codeBlock()->identifier(property);
+                        
+                        PropertySlot::GetValueFunc getter = vPC[7].u.getterFunc;
+                        JSValue result = getter(callFrame, baseObject, ident);
+                        CHECK_FOR_EXCEPTION();
+                        callFrame->r(dst) = result;
+                        vPC += OPCODE_LENGTH(op_get_by_id_custom_chain);
+                        NEXT_INSTRUCTION();
+                    }
+                    
+                    // Update baseCell, so that next time around the loop we'll pick up the prototype's prototype.
+                    baseCell = baseObject;
+                }
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+    skip_id_custom_chain:
+#endif
     DEFINE_OPCODE(op_get_array_length) {
         /* op_get_array_length dst(r) base(r) property(id) nop(sID) nop(n) nop(n) nop(n)
 
@@ -2265,7 +2613,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue baseValue = callFrame->r(base).jsValue();
         if (LIKELY(isJSString(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
-            callFrame->r(dst) = jsNumber(callFrame, asString(baseValue)->value().size());
+            callFrame->r(dst) = jsNumber(callFrame, asString(baseValue)->length());
             vPC += OPCODE_LENGTH(op_get_string_length);
             NEXT_INSTRUCTION();
         }
@@ -2479,7 +2827,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 else
                     result = jsArray->JSArray::get(callFrame, i);
             } else if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
-                result = asString(baseValue)->getIndex(&callFrame->globalData(), i);
+                result = asString(baseValue)->getIndex(callFrame, i);
             else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i))
                 result = asByteArray(baseValue)->getIndex(callFrame, i);
             else
@@ -2647,6 +2995,26 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_loop_if_true);
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_loop_if_false) {
+        /* loop_if_true cond(r) target(offset)
+         
+           Jumps to offset target from the current instruction, if and
+           only if register cond converts to boolean as false.
+
+           Additionally this loop instruction may terminate JS execution is
+           the JS timeout is reached.
+         */
+        int cond = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
+        if (!callFrame->r(cond).jsValue().toBoolean(callFrame)) {
+            vPC += target;
+            CHECK_FOR_TIMEOUT();
+            NEXT_INSTRUCTION();
+        }
+        
+        vPC += OPCODE_LENGTH(op_loop_if_true);
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_jtrue) {
         /* jtrue cond(r) target(offset)
 
@@ -2707,7 +3075,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int target = vPC[2].u.operand;
         JSValue srcValue = callFrame->r(src).jsValue();
 
-        if (!srcValue.isUndefinedOrNull() || (srcValue.isCell() && !srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
+        if (!srcValue.isUndefinedOrNull() && (!srcValue.isCell() || !srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -2810,6 +3178,29 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_jnless);
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_jless) {
+        /* jless src1(r) src2(r) target(offset)
+
+           Checks whether register src1 is less than register src2, as
+           with the ECMAScript '<' operator, and then jumps to offset
+           target from the current instruction, if and only if the 
+           result of the comparison is true.
+        */
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
+
+        bool result = jsLess(callFrame, src1, src2);
+        CHECK_FOR_EXCEPTION();
+        
+        if (result) {
+            vPC += target;
+            NEXT_INSTRUCTION();
+        }
+
+        vPC += OPCODE_LENGTH(op_jless);
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_jnlesseq) {
         /* jnlesseq src1(r) src2(r) target(offset)
 
@@ -2872,11 +3263,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else {
-            UString::Rep* value = asString(scrutinee)->value().rep();
-            if (value->size() != 1)
+            UString::Rep* value = asString(scrutinee)->value(callFrame).rep();
+            if (value->length() != 1)
                 vPC += defaultOffset;
             else
-                vPC += callFrame->codeBlock()->characterSwitchJumpTable(tableIndex).offsetForValue(value->data()[0], defaultOffset);
+                vPC += callFrame->codeBlock()->characterSwitchJumpTable(tableIndex).offsetForValue(value->characters()[0], defaultOffset);
         }
         NEXT_INSTRUCTION();
     }
@@ -2895,7 +3286,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else 
-            vPC += callFrame->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(asString(scrutinee)->value().rep(), defaultOffset);
+            vPC += callFrame->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(asString(scrutinee)->value(callFrame).rep(), defaultOffset);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_new_func) {
@@ -3487,7 +3878,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int src = vPC[2].u.operand;
         int count = vPC[3].u.operand;
 
-        callFrame->r(dst) = concatenateStrings(callFrame, &callFrame->registers()[src], count);
+        callFrame->r(dst) = jsString(callFrame, &callFrame->registers()[src], count);
+        CHECK_FOR_EXCEPTION();
         vPC += OPCODE_LENGTH(op_strcat);
 
         NEXT_INSTRUCTION();
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
index 76184baafb..ecd7403246 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
@@ -51,17 +51,18 @@ namespace JSC {
     class Register : public WTF::FastAllocBase {
     public:
         Register();
-        Register(JSValue);
 
+        Register(const JSValue&);
+        Register& operator=(const JSValue&);
         JSValue jsValue() const;
         
-        Register(JSActivation*);
-        Register(CallFrame*);
-        Register(CodeBlock*);
-        Register(JSFunction*);
-        Register(JSPropertyNameIterator*);
-        Register(ScopeChainNode*);
-        Register(Instruction*);
+        Register& operator=(JSActivation*);
+        Register& operator=(CallFrame*);
+        Register& operator=(CodeBlock*);
+        Register& operator=(JSFunction*);
+        Register& operator=(JSPropertyNameIterator*);
+        Register& operator=(ScopeChainNode*);
+        Register& operator=(Instruction*);
 
         int32_t i() const;
         JSActivation* activation() const;
@@ -75,12 +76,12 @@ namespace JSC {
 
         static Register withInt(int32_t i)
         {
-            return Register(i);
+            Register r;
+            r.u.i = i;
+            return r;
         }
 
     private:
-        Register(int32_t);
-
         union {
             int32_t i;
             EncodedJSValue value;
@@ -98,13 +99,25 @@ namespace JSC {
     ALWAYS_INLINE Register::Register()
     {
 #ifndef NDEBUG
-        u.value = JSValue::encode(JSValue());
+        *this = JSValue();
+#endif
+    }
+
+    ALWAYS_INLINE Register::Register(const JSValue& v)
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!v.isZombie());
 #endif
+        u.value = JSValue::encode(v);
     }
 
-    ALWAYS_INLINE Register::Register(JSValue v)
+    ALWAYS_INLINE Register& Register::operator=(const JSValue& v)
     {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!v.isZombie());
+#endif
         u.value = JSValue::encode(v);
+        return *this;
     }
 
     ALWAYS_INLINE JSValue Register::jsValue() const
@@ -114,44 +127,46 @@ namespace JSC {
 
     // Interpreter functions
 
-    ALWAYS_INLINE Register::Register(JSActivation* activation)
+    ALWAYS_INLINE Register& Register::operator=(JSActivation* activation)
     {
         u.activation = activation;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(CallFrame* callFrame)
+    ALWAYS_INLINE Register& Register::operator=(CallFrame* callFrame)
     {
         u.callFrame = callFrame;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(CodeBlock* codeBlock)
+    ALWAYS_INLINE Register& Register::operator=(CodeBlock* codeBlock)
     {
         u.codeBlock = codeBlock;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(JSFunction* function)
+    ALWAYS_INLINE Register& Register::operator=(JSFunction* function)
     {
         u.function = function;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(Instruction* vPC)
+    ALWAYS_INLINE Register& Register::operator=(Instruction* vPC)
     {
         u.vPC = vPC;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(ScopeChainNode* scopeChain)
+    ALWAYS_INLINE Register& Register::operator=(ScopeChainNode* scopeChain)
     {
         u.scopeChain = scopeChain;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(JSPropertyNameIterator* propertyNameIterator)
+    ALWAYS_INLINE Register& Register::operator=(JSPropertyNameIterator* propertyNameIterator)
     {
         u.propertyNameIterator = propertyNameIterator;
-    }
-
-    ALWAYS_INLINE Register::Register(int32_t i)
-    {
-        u.i = i;
+        return *this;
     }
 
     ALWAYS_INLINE int32_t Register::i() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
index 5424199596..510effe0dd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
@@ -36,7 +36,7 @@ RegisterFile::~RegisterFile()
 #if HAVE(MMAP)
     munmap(m_buffer, ((m_max - m_start) + m_maxGlobals) * sizeof(Register));
 #elif HAVE(VIRTUALALLOC)
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     VirtualFree(m_buffer, DWORD(m_commitEnd) - DWORD(m_buffer), MEM_DECOMMIT);
 #endif
     VirtualFree(m_buffer, 0, MEM_RELEASE);
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
index 953c70f7bc..1fc4f828b4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
@@ -176,7 +176,7 @@ namespace JSC {
     #if HAVE(MMAP)
         m_buffer = static_cast<Register*>(mmap(0, bufferLength, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, VM_TAG_FOR_REGISTERFILE_MEMORY, 0));
         if (m_buffer == MAP_FAILED) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
             fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
 #else
             fprintf(stderr, "Could not allocate register file: %d\n", errno);
@@ -186,7 +186,7 @@ namespace JSC {
     #elif HAVE(VIRTUALALLOC)
         m_buffer = static_cast<Register*>(VirtualAlloc(0, roundUpAllocationSize(bufferLength, commitSize), MEM_RESERVE, PAGE_READWRITE));
         if (!m_buffer) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
             fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
 #else
             fprintf(stderr, "Could not allocate register file: %d\n", errno);
@@ -196,7 +196,7 @@ namespace JSC {
         size_t committedSize = roundUpAllocationSize(maxGlobals * sizeof(Register), commitSize);
         void* commitCheck = VirtualAlloc(m_buffer, committedSize, MEM_COMMIT, PAGE_READWRITE);
         if (commitCheck != m_buffer) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
             fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
 #else
             fprintf(stderr, "Could not allocate register file: %d\n", errno);
@@ -242,7 +242,7 @@ namespace JSC {
         if (newEnd > m_commitEnd) {
             size_t size = roundUpAllocationSize(reinterpret_cast<char*>(newEnd) - reinterpret_cast<char*>(m_commitEnd), commitSize);
             if (!VirtualAlloc(m_commitEnd, size, MEM_COMMIT, PAGE_READWRITE)) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
                 fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
 #else
                 fprintf(stderr, "Could not allocate register file: %d\n", errno);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
index 9ca62c8696..8f46dee51f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
@@ -26,6 +26,7 @@
 #ifndef ExecutableAllocator_h
 #define ExecutableAllocator_h
 
+#include <stddef.h> // for ptrdiff_t
 #include <limits>
 #include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h>
@@ -33,15 +34,25 @@
 #include <wtf/UnusedParam.h>
 #include <wtf/Vector.h>
 
-#if PLATFORM(IPHONE)
+#if OS(IPHONE_OS)
 #include <libkern/OSCacheControl.h>
 #include <sys/mman.h>
 #endif
 
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
 #include <e32std.h>
 #endif
 
+#if CPU(MIPS) && OS(LINUX)
+#include <sys/cachectl.h>
+#endif
+
+#if OS(WINCE)
+// From pkfuncs.h (private header file from the Platform Builder)
+#define CACHE_SYNC_ALL 0x07F
+extern "C" __declspec(dllimport) void CacheRangeFlush(LPVOID pAddr, DWORD dwLength, DWORD dwFlags);
+#endif
+
 #define JIT_ALLOCATOR_PAGE_SIZE (ExecutableAllocator::pageSize)
 #define JIT_ALLOCATOR_LARGE_ALLOC_SIZE (ExecutableAllocator::pageSize * 4)
 
@@ -78,7 +89,7 @@ private:
     struct Allocation {
         char* pages;
         size_t size;
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
         RChunk* chunk;
 #endif
     };
@@ -179,17 +190,43 @@ public:
 #endif
 
 
-#if PLATFORM(X86) || PLATFORM(X86_64)
+#if CPU(X86) || CPU(X86_64)
     static void cacheFlush(void*, size_t)
     {
     }
-#elif PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)
+#elif CPU(MIPS)
+    static void cacheFlush(void* code, size_t size)
+    {
+#if COMPILER(GCC) && (GCC_VERSION >= 40300)
+#if WTF_MIPS_ISA_REV(2) && (GCC_VERSION < 40403)
+        int lineSize;
+        asm("rdhwr %0, $1" : "=r" (lineSize));
+        //
+        // Modify "start" and "end" to avoid GCC 4.3.0-4.4.2 bug in
+        // mips_expand_synci_loop that may execute synci one more time.
+        // "start" points to the fisrt byte of the cache line.
+        // "end" points to the last byte of the line before the last cache line.
+        // Because size is always a multiple of 4, this is safe to set
+        // "end" to the last byte.
+        //
+        intptr_t start = reinterpret_cast<intptr_t>(code) & (-lineSize);
+        intptr_t end = ((reinterpret_cast<intptr_t>(code) + size - 1) & (-lineSize)) - 1;
+        __builtin___clear_cache(reinterpret_cast<char*>(start), reinterpret_cast<char*>(end));
+#else
+        intptr_t end = reinterpret_cast<intptr_t>(code) + size;
+        __builtin___clear_cache(reinterpret_cast<char*>(code), reinterpret_cast<char*>(end));
+#endif
+#else
+        _flush_cache(reinterpret_cast<char*>(code), size, BCACHE);
+#endif
+    }
+#elif CPU(ARM_THUMB2) && OS(IPHONE_OS)
     static void cacheFlush(void* code, size_t size)
     {
         sys_dcache_flush(code, size);
         sys_icache_invalidate(code, size);
     }
-#elif PLATFORM(ARM_THUMB2) && PLATFORM(LINUX)
+#elif CPU(ARM_THUMB2) && OS(LINUX)
     static void cacheFlush(void* code, size_t size)
     {
         asm volatile (
@@ -205,12 +242,12 @@ public:
             : "r" (code), "r" (reinterpret_cast<char*>(code) + size)
             : "r0", "r1", "r2");
     }
-#elif PLATFORM(SYMBIAN)
+#elif OS(SYMBIAN)
     static void cacheFlush(void* code, size_t size)
     {
         User::IMB_Range(code, static_cast<char*>(code) + size);
     }
-#elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX)
+#elif CPU(ARM_TRADITIONAL) && OS(LINUX)
     static void cacheFlush(void* code, size_t size)
     {
         asm volatile (
@@ -226,6 +263,11 @@ public:
             : "r" (code), "r" (reinterpret_cast<char*>(code) + size)
             : "r0", "r1", "r2");
     }
+#elif OS(WINCE)
+    static void cacheFlush(void* code, size_t size)
+    {
+        CacheRangeFlush(code, size, CACHE_SYNC_ALL);
+    }
 #else
     #error "The cacheFlush support is missing on this platform."
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
index 7682b9c642..dd1db4e24a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
@@ -29,7 +29,7 @@
 
 #include <errno.h>
 
-#if ENABLE(ASSEMBLER) && PLATFORM(MAC) && PLATFORM(X86_64)
+#if ENABLE(ASSEMBLER) && OS(DARWIN) && CPU(X86_64)
 
 #include "TCSpinLock.h"
 #include <mach/mach_init.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
index 13a8626789..06375adb53 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
@@ -27,7 +27,7 @@
 
 #include "ExecutableAllocator.h"
 
-#if ENABLE(ASSEMBLER)
+#if ENABLE(ASSEMBLER) && OS(UNIX) && !OS(SYMBIAN)
 
 #include <sys/mman.h>
 #include <unistd.h>
@@ -35,7 +35,7 @@
 
 namespace JSC {
 
-#if !(PLATFORM(MAC) && PLATFORM(X86_64))
+#if !(OS(DARWIN) && CPU(X86_64))
 
 void ExecutableAllocator::intializePageSize()
 {
@@ -57,7 +57,7 @@ void ExecutablePool::systemRelease(const ExecutablePool::Allocation& alloc)
     ASSERT_UNUSED(result, !result);
 }
 
-#endif // !(PLATFORM(MAC) && PLATFORM(X86_64))
+#endif // !(OS(DARWIN) && CPU(X86_64))
 
 #if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
 void ExecutableAllocator::reprotectRegion(void* start, size_t size, ProtectionSeting setting)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
index c96ecae3b7..e82975c9c2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
@@ -22,7 +22,7 @@
 
 #include "ExecutableAllocator.h"
 
-#if ENABLE(ASSEMBLER) && PLATFORM(SYMBIAN)
+#if ENABLE(ASSEMBLER) && OS(SYMBIAN)
 
 #include <e32hal.h>
 #include <e32std.h>
@@ -34,7 +34,7 @@ namespace JSC {
 
 void ExecutableAllocator::intializePageSize()
 {
-#if PLATFORM_ARM_ARCH(5)
+#if CPU(ARMV5_OR_LOWER)
     // The moving memory model (as used in ARMv5 and earlier platforms)
     // on Symbian OS limits the number of chunks for each process to 16. 
     // To mitigate this limitation increase the pagesize to 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
index e6ac855719..e38323c5fd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
@@ -27,7 +27,7 @@
 
 #include "ExecutableAllocator.h"
 
-#if ENABLE(ASSEMBLER)
+#if ENABLE(ASSEMBLER) && OS(WINDOWS)
 
 #include "windows.h"
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
index 000e4b8214..b414101d09 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
@@ -27,7 +27,7 @@
 #include "JIT.h"
 
 // This probably does not belong here; adding here for now as a quick Windows build fix.
-#if ENABLE(ASSEMBLER) && PLATFORM(X86) && !PLATFORM(MAC)
+#if ENABLE(ASSEMBLER) && CPU(X86) && !OS(MAC_OS_X)
 #include "MacroAssembler.h"
 JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse2CheckState = NotCheckedSSE2;
 #endif
@@ -37,7 +37,6 @@ JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse
 #include "CodeBlock.h"
 #include "Interpreter.h"
 #include "JITInlineMethods.h"
-#include "JITStubs.h"
 #include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
@@ -251,6 +250,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_jneq_null)
         DEFINE_OP(op_jneq_ptr)
         DEFINE_OP(op_jnless)
+        DEFINE_OP(op_jless)
         DEFINE_OP(op_jnlesseq)
         DEFINE_OP(op_jsr)
         DEFINE_OP(op_jtrue)
@@ -259,6 +259,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_loop_if_less)
         DEFINE_OP(op_loop_if_lesseq)
         DEFINE_OP(op_loop_if_true)
+        DEFINE_OP(op_loop_if_false)
         DEFINE_OP(op_lshift)
         DEFINE_OP(op_method_check)
         DEFINE_OP(op_mod)
@@ -321,6 +322,16 @@ void JIT::privateCompileMainPass()
         case op_get_by_id_proto_list:
         case op_get_by_id_self:
         case op_get_by_id_self_list:
+        case op_get_by_id_getter_chain:
+        case op_get_by_id_getter_proto:
+        case op_get_by_id_getter_proto_list:
+        case op_get_by_id_getter_self:
+        case op_get_by_id_getter_self_list:
+        case op_get_by_id_custom_chain:
+        case op_get_by_id_custom_proto:
+        case op_get_by_id_custom_proto_list:
+        case op_get_by_id_custom_self:
+        case op_get_by_id_custom_self_list:
         case op_get_string_length:
         case op_put_by_id_generic:
         case op_put_by_id_replace:
@@ -390,11 +401,13 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_instanceof)
         DEFINE_SLOWCASE_OP(op_jfalse)
         DEFINE_SLOWCASE_OP(op_jnless)
+        DEFINE_SLOWCASE_OP(op_jless)
         DEFINE_SLOWCASE_OP(op_jnlesseq)
         DEFINE_SLOWCASE_OP(op_jtrue)
         DEFINE_SLOWCASE_OP(op_loop_if_less)
         DEFINE_SLOWCASE_OP(op_loop_if_lesseq)
         DEFINE_SLOWCASE_OP(op_loop_if_true)
+        DEFINE_SLOWCASE_OP(op_loop_if_false)
         DEFINE_SLOWCASE_OP(op_lshift)
         DEFINE_SLOWCASE_OP(op_method_check)
         DEFINE_SLOWCASE_OP(op_mod)
@@ -579,7 +592,7 @@ void JIT::unlinkCall(CallLinkInfo* callLinkInfo)
     // When the JSFunction is deleted the pointer embedded in the instruction stream will no longer be valid
     // (and, if a new JSFunction happened to be constructed at the same location, we could get a false positive
     // match).  Reset the check so it no longer matches.
-    RepatchBuffer repatchBuffer(callLinkInfo->ownerCodeBlock.get());
+    RepatchBuffer repatchBuffer(callLinkInfo->ownerCodeBlock);
 #if USE(JSVALUE32_64)
     repatchBuffer.repatch(callLinkInfo->hotPathBegin, 0);
 #else
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
index e19ea1750c..a8f725d808 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
@@ -26,8 +26,6 @@
 #ifndef JIT_h
 #define JIT_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(JIT)
 
 // We've run into some problems where changing the size of the class JIT leads to
@@ -192,7 +190,7 @@ namespace JSC {
         // on x86/x86-64 it is ecx for performance reasons, since the
         // MacroAssembler will need to plant register swaps if it is not -
         // however the code will still function correctly.
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         static const RegisterID returnValueRegister = X86Registers::eax;
         static const RegisterID cachedResultRegister = X86Registers::eax;
         static const RegisterID firstArgumentRegister = X86Registers::edi;
@@ -210,7 +208,7 @@ namespace JSC {
         static const FPRegisterID fpRegT0 = X86Registers::xmm0;
         static const FPRegisterID fpRegT1 = X86Registers::xmm1;
         static const FPRegisterID fpRegT2 = X86Registers::xmm2;
-#elif PLATFORM(X86)
+#elif CPU(X86)
         static const RegisterID returnValueRegister = X86Registers::eax;
         static const RegisterID cachedResultRegister = X86Registers::eax;
         // On x86 we always use fastcall conventions = but on
@@ -228,7 +226,7 @@ namespace JSC {
         static const FPRegisterID fpRegT0 = X86Registers::xmm0;
         static const FPRegisterID fpRegT1 = X86Registers::xmm1;
         static const FPRegisterID fpRegT2 = X86Registers::xmm2;
-#elif PLATFORM(ARM_THUMB2)
+#elif CPU(ARM_THUMB2)
         static const RegisterID returnValueRegister = ARMRegisters::r0;
         static const RegisterID cachedResultRegister = ARMRegisters::r0;
         static const RegisterID firstArgumentRegister = ARMRegisters::r0;
@@ -244,7 +242,7 @@ namespace JSC {
         static const FPRegisterID fpRegT0 = ARMRegisters::d0;
         static const FPRegisterID fpRegT1 = ARMRegisters::d1;
         static const FPRegisterID fpRegT2 = ARMRegisters::d2;
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif CPU(ARM_TRADITIONAL)
         static const RegisterID returnValueRegister = ARMRegisters::r0;
         static const RegisterID cachedResultRegister = ARMRegisters::r0;
         static const RegisterID firstArgumentRegister = ARMRegisters::r0;
@@ -283,32 +281,32 @@ namespace JSC {
             return JIT(globalData, codeBlock).privateCompile();
         }
 
-        static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress)
+        static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdProto(stubInfo, structure, prototypeStructure, cachedOffset, returnAddress, callFrame);
+            jit.privateCompileGetByIdProto(stubInfo, structure, prototypeStructure, ident, slot, cachedOffset, returnAddress, callFrame);
         }
 
-        static void compileGetByIdSelfList(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
+        static void compileGetByIdSelfList(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdSelfList(stubInfo, polymorphicStructures, currentIndex, structure, cachedOffset);
+            jit.privateCompileGetByIdSelfList(stubInfo, polymorphicStructures, currentIndex, structure, ident, slot, cachedOffset);
         }
-        static void compileGetByIdProtoList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset)
+        static void compileGetByIdProtoList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdProtoList(stubInfo, prototypeStructureList, currentIndex, structure, prototypeStructure, cachedOffset, callFrame);
+            jit.privateCompileGetByIdProtoList(stubInfo, prototypeStructureList, currentIndex, structure, prototypeStructure, ident, slot, cachedOffset, callFrame);
         }
-        static void compileGetByIdChainList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset)
+        static void compileGetByIdChainList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdChainList(stubInfo, prototypeStructureList, currentIndex, structure, chain, count, cachedOffset, callFrame);
+            jit.privateCompileGetByIdChainList(stubInfo, prototypeStructureList, currentIndex, structure, chain, count, ident, slot, cachedOffset, callFrame);
         }
 
-        static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress)
+        static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdChain(stubInfo, structure, chain, count, cachedOffset, returnAddress, callFrame);
+            jit.privateCompileGetByIdChain(stubInfo, structure, chain, count, ident, slot, cachedOffset, returnAddress, callFrame);
         }
         
         static void compilePutByIdTransition(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
@@ -317,10 +315,10 @@ namespace JSC {
             jit.privateCompilePutByIdTransition(stubInfo, oldStructure, newStructure, cachedOffset, chain, returnAddress);
         }
 
-        static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
+        static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, TrampolineStructure *trampolines)
         {
             JIT jit(globalData);
-            jit.privateCompileCTIMachineTrampolines(executablePool, globalData, ctiStringLengthTrampoline, ctiVirtualCallLink, ctiVirtualCall, ctiNativeCallThunk);
+            jit.privateCompileCTIMachineTrampolines(executablePool, globalData, trampolines);
         }
 
         static void patchGetByIdSelf(CodeBlock* codeblock, StructureStubInfo*, Structure*, size_t cachedOffset, ReturnAddressPtr returnAddress);
@@ -354,14 +352,14 @@ namespace JSC {
         void privateCompileLinkPass();
         void privateCompileSlowCases();
         JITCode privateCompile();
-        void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
-        void privateCompileGetByIdSelfList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, size_t cachedOffset);
-        void privateCompileGetByIdProtoList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame);
-        void privateCompileGetByIdChainList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame);
-        void privateCompileGetByIdChain(StructureStubInfo*, Structure*, StructureChain*, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
+        void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, const Identifier&, const PropertySlot&, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
+        void privateCompileGetByIdSelfList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, const Identifier&, const PropertySlot&, size_t cachedOffset);
+        void privateCompileGetByIdProtoList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, Structure* prototypeStructure, const Identifier&, const PropertySlot&, size_t cachedOffset, CallFrame* callFrame);
+        void privateCompileGetByIdChainList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, StructureChain* chain, size_t count, const Identifier&, const PropertySlot&, size_t cachedOffset, CallFrame* callFrame);
+        void privateCompileGetByIdChain(StructureStubInfo*, Structure*, StructureChain*, size_t count, const Identifier&, const PropertySlot&, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
         void privateCompilePutByIdTransition(StructureStubInfo*, Structure*, Structure*, size_t cachedOffset, StructureChain*, ReturnAddressPtr returnAddress);
 
-        void privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* data, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk);
+        void privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* data, TrampolineStructure *trampolines);
         void privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress);
 
         void addSlowCase(Jump);
@@ -436,7 +434,7 @@ namespace JSC {
         void emitSub32Constant(unsigned dst, unsigned op, int32_t constant, ResultType opType);
         void emitBinaryDoubleOp(OpcodeID, unsigned dst, unsigned op1, unsigned op2, OperandTypes, JumpList& notInt32Op1, JumpList& notInt32Op2, bool op1IsInRegisters = true, bool op2IsInRegisters = true);
 
-#if PLATFORM(X86)
+#if CPU(X86)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 7;
         static const int patchOffsetPutByIdExternalLoad = 13;
@@ -465,6 +463,47 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 11;
         static const int patchOffsetMethodCheckProtoStruct = 18;
         static const int patchOffsetMethodCheckPutFunction = 29;
+#elif CPU(ARM_TRADITIONAL)
+        // These architecture specific value are used to enable patching - see comment on op_put_by_id.
+        static const int patchOffsetPutByIdStructure = 4;
+        static const int patchOffsetPutByIdExternalLoad = 16;
+        static const int patchLengthPutByIdExternalLoad = 4;
+        static const int patchOffsetPutByIdPropertyMapOffset1 = 20;
+        static const int patchOffsetPutByIdPropertyMapOffset2 = 28;
+        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
+        static const int patchOffsetGetByIdStructure = 4;
+        static const int patchOffsetGetByIdBranchToSlowCase = 16;
+        static const int patchOffsetGetByIdExternalLoad = 16;
+        static const int patchLengthGetByIdExternalLoad = 4;
+        static const int patchOffsetGetByIdPropertyMapOffset1 = 20;
+        static const int patchOffsetGetByIdPropertyMapOffset2 = 28;
+        static const int patchOffsetGetByIdPutResult = 36;
+#if ENABLE(OPCODE_SAMPLING)
+        #error "OPCODE_SAMPLING is not yet supported"
+#else
+        static const int patchOffsetGetByIdSlowCaseCall = 32;
+#endif
+        static const int patchOffsetOpCallCompareToJump = 12;
+
+        static const int patchOffsetMethodCheckProtoObj = 12;
+        static const int patchOffsetMethodCheckProtoStruct = 20;
+        static const int patchOffsetMethodCheckPutFunction = 32;
+
+        // sequenceOpCall
+        static const int sequenceOpCallInstructionSpace = 12;
+        static const int sequenceOpCallConstantSpace = 2;
+        // sequenceMethodCheck
+        static const int sequenceMethodCheckInstructionSpace = 40;
+        static const int sequenceMethodCheckConstantSpace = 6;
+        // sequenceGetByIdHotPath
+        static const int sequenceGetByIdHotPathInstructionSpace = 36;
+        static const int sequenceGetByIdHotPathConstantSpace = 4;
+        // sequenceGetByIdSlowCase
+        static const int sequenceGetByIdSlowCaseInstructionSpace = 40;
+        static const int sequenceGetByIdSlowCaseConstantSpace = 2;
+        // sequencePutById
+        static const int sequencePutByIdInstructionSpace = 36;
+        static const int sequencePutByIdConstantSpace = 4;
 #else
 #error "JSVALUE32_64 not supported on this platform."
 #endif
@@ -533,7 +572,7 @@ namespace JSC {
         void compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID structure, RegisterID offset, RegisterID scratch);
         void compilePutDirectOffset(RegisterID base, RegisterID value, Structure* structure, size_t cachedOffset);
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
         static const int patchOffsetPutByIdExternalLoad = 20;
@@ -556,7 +595,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 20;
         static const int patchOffsetMethodCheckProtoStruct = 30;
         static const int patchOffsetMethodCheckPutFunction = 50;
-#elif PLATFORM(X86)
+#elif CPU(X86)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 7;
         static const int patchOffsetPutByIdExternalLoad = 13;
@@ -583,7 +622,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 11;
         static const int patchOffsetMethodCheckProtoStruct = 18;
         static const int patchOffsetMethodCheckPutFunction = 29;
-#elif PLATFORM(ARM_THUMB2)
+#elif CPU(ARM_THUMB2)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
         static const int patchOffsetPutByIdExternalLoad = 26;
@@ -606,7 +645,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 24;
         static const int patchOffsetMethodCheckProtoStruct = 34;
         static const int patchOffsetMethodCheckPutFunction = 58;
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif CPU(ARM_TRADITIONAL)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 4;
         static const int patchOffsetPutByIdExternalLoad = 16;
@@ -629,10 +668,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 12;
         static const int patchOffsetMethodCheckProtoStruct = 20;
         static const int patchOffsetMethodCheckPutFunction = 32;
-#endif
-#endif // USE(JSVALUE32_64)
 
-#if PLATFORM(ARM_TRADITIONAL)
         // sequenceOpCall
         static const int sequenceOpCallInstructionSpace = 12;
         static const int sequenceOpCallConstantSpace = 2;
@@ -649,6 +685,7 @@ namespace JSC {
         static const int sequencePutByIdInstructionSpace = 28;
         static const int sequencePutByIdConstantSpace = 3;
 #endif
+#endif // USE(JSVALUE32_64)
 
 #if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
 #define BEGIN_UNINTERRUPTED_SEQUENCE(name) beginUninterruptedSequence(name ## InstructionSpace, name ## ConstantSpace)
@@ -697,6 +734,7 @@ namespace JSC {
         void emit_op_jneq_null(Instruction*);
         void emit_op_jneq_ptr(Instruction*);
         void emit_op_jnless(Instruction*);
+        void emit_op_jless(Instruction*);
         void emit_op_jnlesseq(Instruction*);
         void emit_op_jsr(Instruction*);
         void emit_op_jtrue(Instruction*);
@@ -705,6 +743,7 @@ namespace JSC {
         void emit_op_loop_if_less(Instruction*);
         void emit_op_loop_if_lesseq(Instruction*);
         void emit_op_loop_if_true(Instruction*);
+        void emit_op_loop_if_false(Instruction*);
         void emit_op_lshift(Instruction*);
         void emit_op_method_check(Instruction*);
         void emit_op_mod(Instruction*);
@@ -759,6 +798,9 @@ namespace JSC {
         void emit_op_to_jsnumber(Instruction*);
         void emit_op_to_primitive(Instruction*);
         void emit_op_unexpected_load(Instruction*);
+#if ENABLE(JIT_OPTIMIZE_MOD)
+        void softModulo();
+#endif
 
         void emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_bitand(Instruction*, Vector<SlowCaseEntry>::iterator&);
@@ -779,11 +821,13 @@ namespace JSC {
         void emitSlow_op_instanceof(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jfalse(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jnless(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jless(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jnlesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jtrue(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_less(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_lesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_true(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_loop_if_false(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_lshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&);
@@ -911,6 +955,46 @@ namespace JSC {
 #endif
 #endif
     } JIT_CLASS_ALIGNMENT;
+
+    inline void JIT::emit_op_loop(Instruction* currentInstruction)
+    {
+        emitTimeoutCheck();
+        emit_op_jmp(currentInstruction);
+    }
+
+    inline void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
+    {
+        emitTimeoutCheck();
+        emit_op_jtrue(currentInstruction);
+    }
+
+    inline void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+    {
+        emitSlow_op_jtrue(currentInstruction, iter);
+    }
+
+    inline void JIT::emit_op_loop_if_false(Instruction* currentInstruction)
+    {
+        emitTimeoutCheck();
+        emit_op_jfalse(currentInstruction);
+    }
+
+    inline void JIT::emitSlow_op_loop_if_false(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+    {
+        emitSlow_op_jfalse(currentInstruction, iter);
+    }
+
+    inline void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
+    {
+        emitTimeoutCheck();
+        emit_op_jless(currentInstruction);
+    }
+
+    inline void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+    {
+        emitSlow_op_jless(currentInstruction, iter);
+    }
+
 } // namespace JSC
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
index 8cda482040..2e1ff403b6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
@@ -31,6 +31,7 @@
 #include "CodeBlock.h"
 #include "JITInlineMethods.h"
 #include "JITStubCall.h"
+#include "JITStubs.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
@@ -55,8 +56,7 @@ void JIT::emit_op_negate(Instruction* currentInstruction)
     emitLoad(src, regT1, regT0);
 
     Jump srcNotInt = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
-    addSlowCase(branch32(Equal, regT0, Imm32(0)));
-
+    addSlowCase(branchTest32(Zero, regT0, Imm32(0x7fffffff)));
     neg32(regT0);
     emitStoreInt32(dst, regT0, (dst == src));
 
@@ -77,7 +77,7 @@ void JIT::emitSlow_op_negate(Instruction* currentInstruction, Vector<SlowCaseEnt
 {
     unsigned dst = currentInstruction[1].u.operand;
 
-    linkSlowCase(iter); // 0 check
+    linkSlowCase(iter); // 0x7fffffff check
     linkSlowCase(iter); // double check
 
     JITStubCall stubCall(this, cti_op_negate);
@@ -148,6 +148,69 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
     emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 }
 
+void JIT::emit_op_jless(Instruction* currentInstruction)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    JumpList notInt32Op1;
+    JumpList notInt32Op2;
+
+    // Int32 less.
+    if (isOperandConstantImmediateInt(op1)) {
+        emitLoad(op2, regT3, regT2);
+        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(GreaterThan, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        emitLoad(op1, regT1, regT0);
+        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
+    } else {
+        emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(LessThan, regT0, regT2), target);
+    }
+
+    if (!supportsFloatingPoint()) {
+        addSlowCase(notInt32Op1);
+        addSlowCase(notInt32Op2);
+        return;
+    }
+    Jump end = jump();
+
+    // Double less.
+    emitBinaryDoubleOp(op_jless, target, op1, op2, OperandTypes(), notInt32Op1, notInt32Op2, !isOperandConstantImmediateInt(op1), isOperandConstantImmediateInt(op1) || !isOperandConstantImmediateInt(op2));
+    end.link(this);
+}
+
+void JIT::emitSlow_op_jless(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    if (!supportsFloatingPoint()) {
+        if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
+            linkSlowCase(iter); // int32 check
+        linkSlowCase(iter); // int32 check
+    } else {
+        if (!isOperandConstantImmediateInt(op1)) {
+            linkSlowCase(iter); // double check
+            linkSlowCase(iter); // int32 check
+        }
+        if (isOperandConstantImmediateInt(op1) || !isOperandConstantImmediateInt(op2))
+            linkSlowCase(iter); // double check
+    }
+
+    JITStubCall stubCall(this, cti_op_jless);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+}
+
 void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 {
     unsigned op1 = currentInstruction[1].u.operand;
@@ -829,11 +892,15 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 break;
             case op_jnless:
                 emitLoadDouble(op1, fpRegT2);
-                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT0, fpRegT2), dst);
+                addJump(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT0, fpRegT2), dst);
+                break;
+            case op_jless:
+                emitLoadDouble(op1, fpRegT2);
+                addJump(branchDouble(DoubleLessThan, fpRegT2, fpRegT0), dst);
                 break;
             case op_jnlesseq:
                 emitLoadDouble(op1, fpRegT2);
-                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT2), dst);
+                addJump(branchDouble(DoubleLessThanOrUnordered, fpRegT0, fpRegT2), dst);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -882,11 +949,15 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 break;
             case op_jnless:
                 emitLoadDouble(op2, fpRegT1);
-                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), dst);
+                addJump(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), dst);
+                break;
+            case op_jless:
+                emitLoadDouble(op2, fpRegT1);
+                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), dst);
                 break;
             case op_jnlesseq:
                 emitLoadDouble(op2, fpRegT1);
-                addJump(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), dst);
+                addJump(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), dst);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -1000,20 +1071,11 @@ void JIT::emit_op_div(Instruction* currentInstruction)
     divDouble(fpRegT1, fpRegT0);
 
     JumpList doubleResult;
-    if (!isOperandConstantImmediateInt(op1) || getConstantOperand(op1).asInt32() > 1) {
-        m_assembler.cvttsd2si_rr(fpRegT0, regT0);
-        convertInt32ToDouble(regT0, fpRegT1);
-        m_assembler.ucomisd_rr(fpRegT1, fpRegT0);
+    branchConvertDoubleToInt32(fpRegT0, regT0, doubleResult, fpRegT1);
 
-        doubleResult.append(m_assembler.jne());
-        doubleResult.append(m_assembler.jp());
-        
-        doubleResult.append(branchTest32(Zero, regT0));
-
-        // Int32 result.
-        emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
-        end.append(jump());
-    }
+    // Int32 result.
+    emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
+    end.append(jump());
 
     // Double result.
     doubleResult.link(this);
@@ -1054,7 +1116,7 @@ void JIT::emitSlow_op_div(Instruction* currentInstruction, Vector<SlowCaseEntry>
 
 /* ------------------------------ BEGIN: OP_MOD ------------------------------ */
 
-#if PLATFORM(X86) || PLATFORM(X86_64)
+#if CPU(X86) || CPU(X86_64)
 
 void JIT::emit_op_mod(Instruction* currentInstruction)
 {
@@ -1116,7 +1178,7 @@ void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>
     stubCall.call(dst);
 }
 
-#else // PLATFORM(X86) || PLATFORM(X86_64)
+#else // CPU(X86) || CPU(X86_64)
 
 void JIT::emit_op_mod(Instruction* currentInstruction)
 {
@@ -1124,17 +1186,43 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
+#if ENABLE(JIT_OPTIMIZE_MOD)    
+    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    
+    addSlowCase(branch32(Equal, regT2, Imm32(0)));
+    
+    emitNakedCall(m_globalData->jitStubs.ctiSoftModulo());
+
+    emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
+#else
     JITStubCall stubCall(this, cti_op_mod);
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call(dst);
+#endif
 }
 
-void JIT::emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&)
+void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, cti_op_mod);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call(result);
+#else
+    ASSERT_NOT_REACHED();
+#endif
 }
 
-#endif // PLATFORM(X86) || PLATFORM(X86_64)
+#endif // CPU(X86) || CPU(X86_64)
 
 /* ------------------------------ END: OP_MOD ------------------------------ */
 
@@ -1152,13 +1240,8 @@ void JIT::emit_op_lshift(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotImmediateInteger(regT2);
     emitFastArithImmToInt(regT0);
     emitFastArithImmToInt(regT2);
-#if !PLATFORM(X86)
-    // Mask with 0x1f as per ecma-262 11.7.2 step 7.
-    // On 32-bit x86 this is not necessary, since the shift anount is implicitly masked in the instruction.
-    and32(Imm32(0x1f), regT2);
-#endif
     lshift32(regT2, regT0);
-#if !USE(JSVALUE64)
+#if USE(JSVALUE32)
     addSlowCase(branchAdd32(Overflow, regT0, regT0));
     signExtend32ToPtr(regT0, regT0);
 #endif
@@ -1203,11 +1286,7 @@ void JIT::emit_op_rshift(Instruction* currentInstruction)
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         // Mask with 0x1f as per ecma-262 11.7.2 step 7.
-#if USE(JSVALUE64)
         rshift32(Imm32(getConstantOperandImmediateInt(op2) & 0x1f), regT0);
-#else
-        rshiftPtr(Imm32(getConstantOperandImmediateInt(op2) & 0x1f), regT0);
-#endif
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT2);
         if (supportsFloatingPointTruncate()) {
@@ -1234,15 +1313,9 @@ void JIT::emit_op_rshift(Instruction* currentInstruction)
             emitJumpSlowCaseIfNotImmediateInteger(regT2);
         }
         emitFastArithImmToInt(regT2);
-#if !PLATFORM(X86)
-        // Mask with 0x1f as per ecma-262 11.7.2 step 7.
-        // On 32-bit x86 this is not necessary, since the shift anount is implicitly masked in the instruction.
-        and32(Imm32(0x1f), regT2);
-#endif
-#if USE(JSVALUE64)
         rshift32(regT2, regT0);
-#else
-        rshiftPtr(regT2, regT0);
+#if USE(JSVALUE32)
+        signExtend32ToPtr(regT0, regT0);
 #endif
     }
 #if USE(JSVALUE64)
@@ -1365,7 +1438,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1406,7 +1479,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1452,7 +1525,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1479,6 +1552,191 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
     }
 }
 
+void JIT::emit_op_jless(Instruction* currentInstruction)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the fast path:
+    // - int immediate to constant int immediate
+    // - constant int immediate to int immediate
+    // - int immediate to int immediate
+
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(JSVALUE64)
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
+#else
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
+#endif
+        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+#if USE(JSVALUE64)
+        int32_t op1imm = getConstantOperandImmediateInt(op1);
+#else
+        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
+#endif
+        addJump(branch32(GreaterThan, regT1, Imm32(op1imm)), target);
+    } else {
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+
+        addJump(branch32(LessThan, regT0, regT1), target);
+    }
+}
+
+void JIT::emitSlow_op_jless(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the slow path:
+    // - floating-point number to constant int immediate
+    // - constant int immediate to floating-point number
+    // - floating-point number to floating-point number.
+
+    if (isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(JSVALUE64)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            addPtr(tagTypeNumberRegister, regT0);
+            movePtrToDouble(regT0, fpRegT0);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2 = checkStructure(regT0, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
+#endif
+            
+            int32_t op2imm = getConstantOperand(op2).asInt32();
+                    
+            move(Imm32(op2imm), regT1);
+            convertInt32ToDouble(regT1, fpRegT1);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), target);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(JSVALUE64)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, cti_op_jless);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+
+    } else if (isOperandConstantImmediateInt(op1)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(JSVALUE64)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT1);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1 = emitJumpIfNotJSCell(regT1);
+            
+            Jump fail2 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
+#endif
+            
+            int32_t op1imm = getConstantOperand(op1).asInt32();
+                    
+            move(Imm32(op1imm), regT0);
+            convertInt32ToDouble(regT0, fpRegT0);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), target);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(JSVALUE64)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, cti_op_jless);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+
+    } else {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(JSVALUE64)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            Jump fail2 = emitJumpIfNotImmediateNumber(regT1);
+            Jump fail3 = emitJumpIfImmediateInteger(regT1);
+            addPtr(tagTypeNumberRegister, regT0);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT0, fpRegT0);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2 = emitJumpIfNotJSCell(regT1);
+
+            Jump fail3 = checkStructure(regT0, m_globalData->numberStructure.get());
+            Jump fail4 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
+            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
+#endif
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), target);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(JSVALUE64)
+            fail1.link(this);
+            fail2.link(this);
+            fail3.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2.link(this);
+            fail3.link(this);
+            fail4.link(this);
+#endif
+        }
+
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, cti_op_jless);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+    }
+}
+
 void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 {
     unsigned op1 = currentInstruction[1].u.operand;
@@ -1550,7 +1808,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1591,7 +1849,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1637,7 +1895,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1849,7 +2107,7 @@ void JIT::emitSlow_op_pre_dec(Instruction* currentInstruction, Vector<SlowCaseEn
 
 /* ------------------------------ BEGIN: OP_MOD ------------------------------ */
 
-#if PLATFORM(X86) || PLATFORM(X86_64)
+#if CPU(X86) || CPU(X86_64)
 
 void JIT::emit_op_mod(Instruction* currentInstruction)
 {
@@ -1898,7 +2156,7 @@ void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>
     stubCall.call(result);
 }
 
-#else // PLATFORM(X86) || PLATFORM(X86_64)
+#else // CPU(X86) || CPU(X86_64)
 
 void JIT::emit_op_mod(Instruction* currentInstruction)
 {
@@ -1906,18 +2164,43 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
+#if ENABLE(JIT_OPTIMIZE_MOD)    
+    emitGetVirtualRegisters(op1, regT0, op2, regT2);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
+    emitJumpSlowCaseIfNotImmediateInteger(regT2);
+    
+    addSlowCase(branch32(Equal, regT2, Imm32(1)));
+
+    emitNakedCall(m_globalData->jitStubs.ctiSoftModulo());
+
+    emitPutVirtualRegister(result, regT0);
+#else
     JITStubCall stubCall(this, cti_op_mod);
     stubCall.addArgument(op1, regT2);
     stubCall.addArgument(op2, regT2);
     stubCall.call(result);
+#endif
 }
 
-void JIT::emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&)
+void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, cti_op_mod);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
+#else
     ASSERT_NOT_REACHED();
+#endif
 }
 
-#endif // PLATFORM(X86) || PLATFORM(X86_64)
+#endif // CPU(X86) || CPU(X86_64)
 
 /* ------------------------------ END: OP_MOD ------------------------------ */
 
@@ -2160,27 +2443,10 @@ void JIT::emit_op_div(Instruction* currentInstruction)
     }
     divDouble(fpRegT1, fpRegT0);
 
-    JumpList doubleResult;
-    Jump end;
-    bool attemptIntConversion = (!isOperandConstantImmediateInt(op1) || getConstantOperand(op1).asInt32() > 1) && isOperandConstantImmediateInt(op2);
-    if (attemptIntConversion) {
-        m_assembler.cvttsd2si_rr(fpRegT0, regT0);
-        doubleResult.append(branchTest32(Zero, regT0));
-        m_assembler.ucomisd_rr(fpRegT1, fpRegT0);
-        
-        doubleResult.append(m_assembler.jne());
-        doubleResult.append(m_assembler.jp());
-        emitFastArithIntToImmNoCheck(regT0, regT0);
-        end = jump();
-    }
-
     // Double result.
-    doubleResult.link(this);
     moveDoubleToPtr(fpRegT0, regT0);
     subPtr(tagTypeNumberRegister, regT0);
 
-    if (attemptIntConversion)
-        end.link(this);
     emitPutVirtualRegister(dst, regT0);
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
index f7fcc0a6e2..da603bd37e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
@@ -159,7 +159,7 @@ void JIT::emit_op_construct_verify(Instruction* currentInstruction)
     emitLoad(dst, regT1, regT0);
     addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
+    addSlowCase(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
 }
 
 void JIT::emitSlow_op_construct_verify(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -315,7 +315,13 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     emitLoad(callee, regT1, regT0);
 
     DataLabelPtr addressOfLinkedFunctionCheck;
+
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
+
     Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, ImmPtr(0));
+
+    END_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
+
     addSlowCase(jumpToSlow);
     ASSERT(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow) == patchOffsetOpCallCompareToJump);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
index 69cf16728e..5d889b52f9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
@@ -26,8 +26,6 @@
 #ifndef JITCode_h
 #define JITCode_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(JIT)
 
 #include "CallFrame.h"
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
index 93d6ce76ed..91d891e88d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
@@ -26,7 +26,6 @@
 #ifndef JITInlineMethods_h
 #define JITInlineMethods_h
 
-#include <wtf/Platform.h>
 
 #if ENABLE(JIT)
 
@@ -37,7 +36,7 @@ namespace JSC {
 // puts an arg onto the stack, as an arg to a context threaded function.
 ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID src, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(src, argumentStackOffset);
 }
 
@@ -45,7 +44,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID src, unsigned argumentNumbe
 
 ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(unsigned value, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(Imm32(value), argumentStackOffset);
 }
 
@@ -53,7 +52,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(unsigned value, unsigned argum
 
 ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(void* value, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(ImmPtr(value), argumentStackOffset);
 }
 
@@ -61,7 +60,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(void* value, unsigned argument
 
 ALWAYS_INLINE void JIT::emitGetJITStubArg(unsigned argumentNumber, RegisterID dst)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     peek(dst, argumentStackOffset);
 }
 
@@ -115,7 +114,7 @@ ALWAYS_INLINE JIT::Call JIT::emitNakedCall(CodePtr function)
 
 ALWAYS_INLINE void JIT::beginUninterruptedSequence(int insnSpace, int constSpace)
 {
-#if PLATFORM(ARM_TRADITIONAL)
+#if CPU(ARM_TRADITIONAL)
 #ifndef NDEBUG
     // Ensure the label after the sequence can also fit
     insnSpace += sizeof(ARMWord);
@@ -144,7 +143,7 @@ ALWAYS_INLINE void JIT::endUninterruptedSequence(int insnSpace, int constSpace)
 
 #endif
 
-#if PLATFORM(ARM)
+#if CPU(ARM)
 
 ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
 {
@@ -161,7 +160,7 @@ ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
     loadPtr(address, linkRegister);
 }
 
-#else // PLATFORM(X86) || PLATFORM(X86_64)
+#else // CPU(X86) || CPU(X86_64)
 
 ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
 {
@@ -194,10 +193,10 @@ ALWAYS_INLINE void JIT::restoreArgumentReference()
 }
 ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
 {
-#if PLATFORM(X86)
+#if CPU(X86)
     // Within a trampoline the return address will be on the stack at this point.
     addPtr(Imm32(sizeof(void*)), stackPointerRegister, firstArgumentRegister);
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
     move(stackPointerRegister, firstArgumentRegister);
 #endif
     // In the trampoline on x86-64, the first argument register is not overwritten.
@@ -265,9 +264,9 @@ ALWAYS_INLINE void JIT::clearSamplingFlag(int32_t flag)
 #if ENABLE(SAMPLING_COUNTERS)
 ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t count)
 {
-#if PLATFORM(X86_64) // Or any other 64-bit plattform.
+#if CPU(X86_64) // Or any other 64-bit plattform.
     addPtr(Imm32(count), AbsoluteAddress(&counter.m_counter));
-#elif PLATFORM(X86) // Or any other little-endian 32-bit plattform.
+#elif CPU(X86) // Or any other little-endian 32-bit plattform.
     intptr_t hiWord = reinterpret_cast<intptr_t>(&counter.m_counter) + sizeof(int32_t);
     add32(Imm32(count), AbsoluteAddress(&counter.m_counter));
     addWithCarry32(Imm32(0), AbsoluteAddress(reinterpret_cast<void*>(hiWord)));
@@ -278,7 +277,7 @@ ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t cou
 #endif
 
 #if ENABLE(OPCODE_SAMPLING)
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
 ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
 {
     move(ImmPtr(m_interpreter->sampler()->sampleSlot()), X86Registers::ecx);
@@ -293,7 +292,7 @@ ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostF
 #endif
 
 #if ENABLE(CODEBLOCK_SAMPLING)
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
 ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
 {
     move(ImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86Registers::ecx);
@@ -585,7 +584,7 @@ ALWAYS_INLINE bool JIT::getOperandConstantImmediateInt(unsigned op1, unsigned op
 
 ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID tag, RegisterID payload, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(payload, argumentStackOffset);
     poke(tag, argumentStackOffset + 1);
 }
@@ -594,7 +593,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID tag, RegisterID payload, un
 
 ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch1, RegisterID scratch2)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     if (m_codeBlock->isConstantRegisterIndex(src)) {
         JSValue constant = m_codeBlock->getConstant(src);
         poke(Imm32(constant.payload()), argumentStackOffset);
@@ -817,7 +816,7 @@ ALWAYS_INLINE void JIT::emitFastArithImmToInt(RegisterID reg)
 #if USE(JSVALUE64)
     UNUSED_PARAM(reg);
 #else
-    rshiftPtr(Imm32(JSImmediate::IntegerPayloadShift), reg);
+    rshift32(Imm32(JSImmediate::IntegerPayloadShift), reg);
 #endif
 }
 
@@ -846,7 +845,7 @@ ALWAYS_INLINE void JIT::emitTagAsBoolImmediate(RegisterID reg)
 // get arg puts an arg from the SF register array onto the stack, as an arg to a context threaded function.
 ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     if (m_codeBlock->isConstantRegisterIndex(src)) {
         JSValue value = m_codeBlock->getConstant(src);
         poke(ImmPtr(JSValue::encode(value)), argumentStackOffset);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
index 14736cfb80..d04857c16a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -40,8 +41,12 @@ namespace JSC {
 
 #if USE(JSVALUE32_64)
 
-void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
+void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, TrampolineStructure *trampolines)
 {
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    Label softModBegin = align();
+    softModulo();
+#endif
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
     // (1) This function provides fast property access for string length
     Label stringLengthBegin = align();
@@ -52,8 +57,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
 
     // Checks out okay! - get the length from the Ustring.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSString, m_value) + OBJECT_OFFSETOF(UString, m_rep)), regT2);
-    load32(Address(regT2, OBJECT_OFFSETOF(UString::Rep, len)), regT2);
+    load32(Address(regT0, OBJECT_OFFSETOF(JSString, m_length)), regT2);
 
     Jump string_failureCases3 = branch32(Above, regT2, Imm32(INT_MAX));
     move(regT2, regT0);
@@ -138,7 +142,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     loadPtr(Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_jitCode)), regT0);
     jump(regT0);
 
-#if PLATFORM(X86)
+#if CPU(X86) || CPU(ARM_TRADITIONAL)
     Label nativeCallThunk = align();
     preserveReturnAddressAfterCall(regT0);
     emitPutToCallFrameHeader(regT0, RegisterFile::ReturnPC); // Push return address
@@ -149,6 +153,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT1);
     emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
     
+#if CPU(X86)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
 
     /* We have two structs that we use to describe the stackframe we set up for our
@@ -160,7 +165,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
      * stack pointer by the right amount after the call.
      */
 
-#if COMPILER(MSVC) || PLATFORM(LINUX)
+#if COMPILER(MSVC) || OS(LINUX)
 #if COMPILER(MSVC)
 #pragma pack(push)
 #pragma pack(4)
@@ -223,7 +228,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     storePtr(regT2, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
     storePtr(regT3, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
 
-#if COMPILER(MSVC) || PLATFORM(LINUX)
+#if COMPILER(MSVC) || OS(LINUX)
     // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
     addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86Registers::ecx);
 
@@ -248,6 +253,95 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // so pull them off now
     addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
 
+#elif CPU(ARM_TRADITIONAL)
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
+
+    // Allocate stack space for our arglist
+    COMPILE_ASSERT((sizeof(ArgList) & 0x7) == 0 && sizeof(JSValue) == 8 && sizeof(Register) == 8, ArgList_should_by_8byte_aligned);
+    subPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+
+    // Set up arguments
+    subPtr(Imm32(1), regT0); // Don't include 'this' in argcount
+
+    // Push argcount
+    storePtr(regT0, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_argCount)));
+
+    // Calculate the start of the callframe header, and store in regT1
+    move(callFrameRegister, regT1);
+    sub32(Imm32(RegisterFile::CallFrameHeaderSize * (int32_t)sizeof(Register)), regT1);
+
+    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (regT1)
+    mul32(Imm32(sizeof(Register)), regT0, regT0);
+    subPtr(regT0, regT1);
+
+    // push pointer to arguments
+    storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_args)));
+
+    // Argument passing method:
+    // r0 - points to return value
+    // r1 - callFrame
+    // r2 - callee
+    // stack: this(JSValue) and a pointer to ArgList
+
+#if OS(WINCE)
+    // Setup arg4:
+    push(stackPointerRegister);
+
+    // Setup arg3:
+    // regT1 currently points to the first argument, regT1-sizeof(Register) points to 'this'
+    load32(Address(regT1, -(int32_t)sizeof(void*) * 2), ARMRegisters::r3);
+    push(ARMRegisters::r3);
+    load32(Address(regT1, -(int32_t)sizeof(void*)), regT3);
+    storePtr(regT3, Address(stackPointerRegister));
+
+    // Setup arg2:
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT2);
+
+    // Setup arg1:
+    move(callFrameRegister, regT1);
+
+    // Setup arg0:
+    move(stackPointerRegister, regT0);
+
+    call(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data)));
+
+    load32(Address(stackPointerRegister, 0), regT0);
+    load32(Address(stackPointerRegister, 4), regT1);
+
+    addPtr(Imm32(sizeof(ArgList) + 8), stackPointerRegister);
+#else // OS(WINCE)
+    move(stackPointerRegister, regT3);
+    subPtr(Imm32(8), stackPointerRegister);
+    move(stackPointerRegister, regT0);
+    subPtr(Imm32(8 + 4 + 4 /* padding */), stackPointerRegister);
+
+    // Setup arg4:
+    storePtr(regT3, Address(stackPointerRegister, 8));
+
+    // Setup arg3:
+    // regT1 currently points to the first argument, regT1-sizeof(Register) points to 'this'
+    load32(Address(regT1, -(int32_t)sizeof(void*) * 2), regT3);
+    storePtr(regT3, Address(stackPointerRegister, 0));
+    load32(Address(regT1, -(int32_t)sizeof(void*)), regT3);
+    storePtr(regT3, Address(stackPointerRegister, 4));
+
+    // Setup arg2:
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT2);
+
+    // Setup arg1:
+    move(callFrameRegister, regT1);
+
+    call(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data)));
+
+    // Load return value
+    load32(Address(stackPointerRegister, 16), regT0);
+    load32(Address(stackPointerRegister, 20), regT1);
+
+    addPtr(Imm32(sizeof(ArgList) + 16 + 8), stackPointerRegister);
+#endif // OS(WINCE)
+
+#endif
+
     // Check for an exception
     move(ImmPtr(&globalData->exception), regT2);
     Jump sawException = branch32(NotEqual, tagFor(0, regT2), Imm32(JSValue::EmptyValueTag));
@@ -305,18 +399,21 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     CodeRef finalCode = patchBuffer.finalizeCode();
     *executablePool = finalCode.m_executablePool;
 
-    *ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
-    *ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
+    trampolines->ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
+    trampolines->ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    *ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
+    trampolines->ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
 #else
     UNUSED_PARAM(ctiStringLengthTrampoline);
 #endif
 #if ENABLE(JIT_OPTIMIZE_CALL)
-    *ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
+    trampolines->ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
 #else
     UNUSED_PARAM(ctiVirtualCallLink);
 #endif
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    trampolines->ctiSoftModulo = trampolineAt(finalCode, softModBegin);
+#endif
 }
 
 void JIT::emit_op_mov(Instruction* currentInstruction)
@@ -349,58 +446,6 @@ void JIT::emit_op_jmp(Instruction* currentInstruction)
     addJump(jump(), target);
 }
 
-void JIT::emit_op_loop(Instruction* currentInstruction)
-{
-    unsigned target = currentInstruction[1].u.operand;
-    emitTimeoutCheck();
-    addJump(jump(), target);
-}
-
-void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
-{
-    unsigned op1 = currentInstruction[1].u.operand;
-    unsigned op2 = currentInstruction[2].u.operand;
-    unsigned target = currentInstruction[3].u.operand;
-
-    emitTimeoutCheck();
-
-    if (isOperandConstantImmediateInt(op1)) {
-        emitLoad(op2, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op1).asInt32())), target);
-        return;
-    }
-    
-    if (isOperandConstantImmediateInt(op2)) {
-        emitLoad(op1, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
-        return;
-    }
-
-    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-    addJump(branch32(LessThan, regT0, regT2), target);
-}
-
-void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned op1 = currentInstruction[1].u.operand;
-    unsigned op2 = currentInstruction[2].u.operand;
-    unsigned target = currentInstruction[3].u.operand;
-
-    if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
-        linkSlowCase(iter); // int32 check
-    linkSlowCase(iter); // int32 check
-
-    JITStubCall stubCall(this, cti_op_loop_if_less);
-    stubCall.addArgument(op1);
-    stubCall.addArgument(op2);
-    stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
-}
-
 void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
 {
     unsigned op1 = currentInstruction[1].u.operand;
@@ -471,7 +516,7 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
 
     // Check that baseVal 'ImplementsDefaultHasInstance'.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
+    addSlowCase(branchTest8(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
 
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
@@ -649,40 +694,6 @@ void JIT::emit_op_strcat(Instruction* currentInstruction)
     stubCall.call(currentInstruction[1].u.operand);
 }
 
-void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
-{
-    unsigned cond = currentInstruction[1].u.operand;
-    unsigned target = currentInstruction[2].u.operand;
-
-    emitTimeoutCheck();
-
-    emitLoad(cond, regT1, regT0);
-
-    Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
-    addJump(branch32(NotEqual, regT0, Imm32(0)), target);
-    Jump isNotZero = jump();
-
-    isNotInteger.link(this);
-
-    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::FalseTag)));
-
-    isNotZero.link(this);
-}
-
-void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned cond = currentInstruction[1].u.operand;
-    unsigned target = currentInstruction[2].u.operand;
-
-    linkSlowCase(iter);
-
-    JITStubCall stubCall(this, cti_op_jtrue);
-    stubCall.addArgument(cond);
-    stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
-}
-
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_base);
@@ -786,7 +797,7 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
 
         zeroDouble(fpRegT0);
         emitLoadDouble(cond, fpRegT1);
-        addJump(branchDouble(DoubleEqual, fpRegT0, fpRegT1), target);
+        addJump(branchDouble(DoubleEqualOrUnordered, fpRegT0, fpRegT1), target);
     } else
         addSlowCase(isNotInteger);
 
@@ -858,7 +869,7 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    addJump(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
@@ -885,7 +896,7 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    addJump(branchTest8(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
@@ -1198,7 +1209,7 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
         isNotObject.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
     if (base != m_codeBlock->thisRegister()) {
         loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        isNotObject.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+        isNotObject.append(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
     }
 
     // We could inline the case where you have a valid cache, but
@@ -1477,7 +1488,7 @@ void JIT::emit_op_convert_this(Instruction* currentInstruction)
     addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    addSlowCase(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
 
     map(m_bytecodeIndex + OPCODE_LENGTH(op_convert_this), thisRegister, regT1, regT0);
 }
@@ -1521,8 +1532,12 @@ void JIT::emit_op_profile_did_call(Instruction* currentInstruction)
 #define RECORD_JUMP_TARGET(targetOffset) \
    do { m_labels[m_bytecodeIndex + (targetOffset)].used(); } while (false)
 
-void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
+void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, TrampolineStructure *trampolines)
 {
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    Label softModBegin = align();
+    softModulo();
+#endif
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
     // (2) The second function provides fast property access for string length
     Label stringLengthBegin = align();
@@ -1532,8 +1547,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
 
     // Checks out okay! - get the length from the Ustring.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSString, m_value) + OBJECT_OFFSETOF(UString, m_rep)), regT0);
-    load32(Address(regT0, OBJECT_OFFSETOF(UString::Rep, len)), regT0);
+    load32(Address(regT0, OBJECT_OFFSETOF(JSString, m_length)), regT0);
 
     Jump string_failureCases3 = branch32(Above, regT0, Imm32(JSImmediate::maxImmediateInt));
 
@@ -1628,7 +1642,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
     
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, X86Registers::ecx);
 
     // Allocate stack space for our arglist
@@ -1664,7 +1678,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     call(Address(X86Registers::esi, OBJECT_OFFSETOF(JSFunction, m_data)));
     
     addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
-#elif PLATFORM(X86)
+#elif CPU(X86)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
 
     /* We have two structs that we use to describe the stackframe we set up for our
@@ -1675,7 +1689,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
      * not the rest of the callframe so we need a nice way to ensure we increment the
      * stack pointer by the right amount after the call.
      */
-#if COMPILER(MSVC) || PLATFORM(LINUX)
+#if COMPILER(MSVC) || OS(LINUX)
     struct NativeCallFrameStructure {
       //  CallFrame* callFrame; // passed in EDX
         JSObject* callee;
@@ -1728,7 +1742,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     loadPtr(Address(regT1, -(int)sizeof(Register)), regT1);
     storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue)));
 
-#if COMPILER(MSVC) || PLATFORM(LINUX)
+#if COMPILER(MSVC) || OS(LINUX)
     // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
     addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86Registers::ecx);
 
@@ -1756,7 +1770,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // so pull them off now
     addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
 
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif CPU(ARM)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
 
     // Allocate stack space for our arglist
@@ -1780,7 +1794,30 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // push pointer to arguments
     storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_args)));
 
-    // Setup arg3: regT1 currently points to the first argument, regT1-sizeof(Register) points to 'this'
+    // regT1 currently points to the first argument, regT1-sizeof(Register) points to 'this'
+
+#if OS(WINCE)
+    // Setup arg3:
+    loadPtr(Address(regT1, -(int32_t)sizeof(Register)), ARMRegisters::r3);
+
+    // Setup arg2:
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT2);
+
+    // Setup arg1:
+    move(callFrameRegister, regT1);
+
+    // Setup arg0:
+    move(stackPointerRegister, regT0);
+    subPtr(Imm32(sizeof(Register)), stackPointerRegister);
+    storePtr(regT0, Address(stackPointerRegister));
+
+    call(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data)));
+
+    loadPtr(Address(regT0), regT0);
+
+    addPtr(Imm32(sizeof(Register) + sizeof(ArgList)), stackPointerRegister);
+#else // OS(WINCE)
+    // Setup arg3:
     loadPtr(Address(regT1, -(int32_t)sizeof(Register)), regT2);
 
     // Setup arg2:
@@ -1790,11 +1827,12 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     move(callFrameRegister, regT0);
 
     // Setup arg4: This is a plain hack
-    move(stackPointerRegister, ARMRegisters::S0);
+    move(stackPointerRegister, ARMRegisters::r3);
 
     call(Address(regT1, OBJECT_OFFSETOF(JSFunction, m_data)));
 
     addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+#endif // OS(WINCE)
 
 #elif ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
 #error "JIT_OPTIMIZE_NATIVE_CALL not yet supported on this platform."
@@ -1854,11 +1892,14 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     CodeRef finalCode = patchBuffer.finalizeCode();
     *executablePool = finalCode.m_executablePool;
 
-    *ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
-    *ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
-    *ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
+    trampolines->ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
+    trampolines->ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
+    trampolines->ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    trampolines->ctiSoftModulo = trampolineAt(finalCode, softModBegin);
+#endif
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    *ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
+    trampolines->ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
 #else
     UNUSED_PARAM(ctiStringLengthTrampoline);
 #endif
@@ -1902,47 +1943,6 @@ void JIT::emit_op_jmp(Instruction* currentInstruction)
     RECORD_JUMP_TARGET(target);
 }
 
-void JIT::emit_op_loop(Instruction* currentInstruction)
-{
-    emitTimeoutCheck();
-
-    unsigned target = currentInstruction[1].u.operand;
-    addJump(jump(), target);
-}
-
-void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
-{
-    emitTimeoutCheck();
-
-    unsigned op1 = currentInstruction[1].u.operand;
-    unsigned op2 = currentInstruction[2].u.operand;
-    unsigned target = currentInstruction[3].u.operand;
-    if (isOperandConstantImmediateInt(op2)) {
-        emitGetVirtualRegister(op1, regT0);
-        emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
-        int32_t op2imm = getConstantOperandImmediateInt(op2);
-#else
-        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
-        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target);
-    } else if (isOperandConstantImmediateInt(op1)) {
-        emitGetVirtualRegister(op2, regT0);
-        emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
-        int32_t op1imm = getConstantOperandImmediateInt(op1);
-#else
-        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
-#endif
-        addJump(branch32(GreaterThan, regT0, Imm32(op1imm)), target);
-    } else {
-        emitGetVirtualRegisters(op1, regT0, op2, regT1);
-        emitJumpSlowCaseIfNotImmediateInteger(regT0);
-        emitJumpSlowCaseIfNotImmediateInteger(regT1);
-        addJump(branch32(LessThan, regT0, regT1), target);
-    }
-}
-
 void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
 {
     emitTimeoutCheck();
@@ -1992,7 +1992,7 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
 
     // Check that baseVal 'ImplementsDefaultHasInstance'.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
+    addSlowCase(branchTest8(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
 
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
@@ -2153,7 +2153,7 @@ void JIT::emit_op_construct_verify(Instruction* currentInstruction)
 
     emitJumpSlowCaseIfNotJSCell(regT0);
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
+    addSlowCase(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
 
 }
 
@@ -2181,21 +2181,6 @@ void JIT::emit_op_strcat(Instruction* currentInstruction)
     stubCall.call(currentInstruction[1].u.operand);
 }
 
-void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
-{
-    emitTimeoutCheck();
-
-    unsigned target = currentInstruction[2].u.operand;
-    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
-
-    Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
-    addJump(emitJumpIfImmediateInteger(regT0), target);
-
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target);
-    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
-
-    isZero.link(this);
-};
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_base);
@@ -2277,7 +2262,7 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    addJump(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
@@ -2298,7 +2283,7 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    addJump(branchTest8(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
@@ -2454,7 +2439,7 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
         isNotObject.append(emitJumpIfNotJSCell(regT0));
     if (base != m_codeBlock->thisRegister()) {
         loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        isNotObject.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+        isNotObject.append(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
     }
 
     // We could inline the case where you have a valid cache, but
@@ -2605,7 +2590,7 @@ void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
 
     emitJumpSlowCaseIfNotJSCell(regT0, srcVReg);
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(NumberType)));
+    addSlowCase(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(NumberType)));
     
     wasImmediate.link(this);
 
@@ -2716,7 +2701,7 @@ void JIT::emit_op_eq_null(Instruction* currentInstruction)
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    setTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+    setTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
 
     Jump wasNotImmediate = jump();
 
@@ -2741,7 +2726,7 @@ void JIT::emit_op_neq_null(Instruction* currentInstruction)
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    setTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+    setTest8(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
 
     Jump wasNotImmediate = jump();
 
@@ -2801,7 +2786,7 @@ void JIT::emit_op_convert_this(Instruction* currentInstruction)
 
     emitJumpSlowCaseIfNotJSCell(regT0);
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT1);
-    addSlowCase(branchTest32(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    addSlowCase(branchTest8(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
 
 }
 
@@ -2875,36 +2860,6 @@ void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCas
     stubCall.call(dst);
 }
 
-void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned op1 = currentInstruction[1].u.operand;
-    unsigned op2 = currentInstruction[2].u.operand;
-    unsigned target = currentInstruction[3].u.operand;
-    if (isOperandConstantImmediateInt(op2)) {
-        linkSlowCase(iter);
-        JITStubCall stubCall(this, cti_op_loop_if_less);
-        stubCall.addArgument(regT0);
-        stubCall.addArgument(op2, regT2);
-        stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
-    } else if (isOperandConstantImmediateInt(op1)) {
-        linkSlowCase(iter);
-        JITStubCall stubCall(this, cti_op_loop_if_less);
-        stubCall.addArgument(op1, regT2);
-        stubCall.addArgument(regT0);
-        stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
-    } else {
-        linkSlowCase(iter);
-        linkSlowCase(iter);
-        JITStubCall stubCall(this, cti_op_loop_if_less);
-        stubCall.addArgument(regT0);
-        stubCall.addArgument(regT1);
-        stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
-    }
-}
-
 void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     unsigned op2 = currentInstruction[2].u.operand;
@@ -2945,15 +2900,6 @@ void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCas
     stubPutByValCall.call();
 }
 
-void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    linkSlowCase(iter);
-    JITStubCall stubCall(this, cti_op_jtrue);
-    stubCall.addArgument(regT0);
-    stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand);
-}
-
 void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
@@ -3100,6 +3046,81 @@ void JIT::emitSlow_op_to_jsnumber(Instruction* currentInstruction, Vector<SlowCa
 
 #endif // USE(JSVALUE32_64)
 
+// For both JSValue32_64 and JSValue32
+#if ENABLE(JIT_OPTIMIZE_MOD)
+#if CPU(ARM_TRADITIONAL)
+void JIT::softModulo()
+{
+    push(regS0);
+    push(regS1);
+    push(regT1);
+    push(regT3);
+#if USE(JSVALUE32_64)
+    m_assembler.mov_r(regT3, regT2);
+    m_assembler.mov_r(regT2, regT0);
+#else
+    m_assembler.mov_r(regT3, m_assembler.asr(regT2, 1));
+    m_assembler.mov_r(regT2, m_assembler.asr(regT0, 1));
+#endif
+    m_assembler.mov_r(regT1, ARMAssembler::getOp2(0));
+    
+    m_assembler.teq_r(regT3, ARMAssembler::getOp2(0));
+    m_assembler.rsb_r(regT3, regT3, ARMAssembler::getOp2(0), ARMAssembler::MI);
+    m_assembler.eor_r(regT1, regT1, ARMAssembler::getOp2(1), ARMAssembler::MI);
+    
+    m_assembler.teq_r(regT2, ARMAssembler::getOp2(0));
+    m_assembler.rsb_r(regT2, regT2, ARMAssembler::getOp2(0), ARMAssembler::MI);
+    m_assembler.eor_r(regT1, regT1, ARMAssembler::getOp2(2), ARMAssembler::MI);
+    
+    Jump exitBranch = branch32(LessThan, regT2, regT3);
+
+    m_assembler.sub_r(regS1, regT3, ARMAssembler::getOp2(1));
+    m_assembler.tst_r(regS1, regT3);
+    m_assembler.and_r(regT2, regT2, regS1, ARMAssembler::EQ);
+    m_assembler.and_r(regT0, regS1, regT3);
+    Jump exitBranch2 = branchTest32(Zero, regT0);
+    
+    m_assembler.clz_r(regS1, regT2);
+    m_assembler.clz_r(regS0, regT3);
+    m_assembler.sub_r(regS0, regS0, regS1);
+
+    m_assembler.rsbs_r(regS0, regS0, ARMAssembler::getOp2(31));
+
+    m_assembler.mov_r(regS0, m_assembler.lsl(regS0, 1), ARMAssembler::NE);
+
+    m_assembler.add_r(ARMRegisters::pc, ARMRegisters::pc, m_assembler.lsl(regS0, 2), ARMAssembler::NE);
+    m_assembler.mov_r(regT0, regT0);
+    
+    for (int i = 31; i > 0; --i) {
+        m_assembler.cmp_r(regT2, m_assembler.lsl(regT3, i));
+        m_assembler.sub_r(regT2, regT2, m_assembler.lsl(regT3, i), ARMAssembler::CS);
+    }
+
+    m_assembler.cmp_r(regT2, regT3);
+    m_assembler.sub_r(regT2, regT2, regT3, ARMAssembler::CS);
+    
+    exitBranch.link(this);
+    exitBranch2.link(this);
+    
+    m_assembler.teq_r(regT1, ARMAssembler::getOp2(0));
+    m_assembler.rsb_r(regT2, regT2, ARMAssembler::getOp2(0), ARMAssembler::GT);
+    
+#if USE(JSVALUE32_64)
+    m_assembler.mov_r(regT0, regT2);
+#else
+    m_assembler.mov_r(regT0, m_assembler.lsl(regT2, 1));
+    m_assembler.eor_r(regT0, regT0, ARMAssembler::getOp2(1));
+#endif
+    pop(regT3);
+    pop(regT1);
+    pop(regS1);
+    pop(regS0);
+    ret();
+}
+#else
+#error "JIT_OPTIMIZE_MOD not yet supported on this platform."
+#endif // CPU(ARM_TRADITIONAL)
+#endif
 } // namespace JSC
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
index bf367a6077..3399f033de 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -24,11 +24,15 @@
  */
 
 #include "config.h"
+
+#if !USE(JSVALUE32_64)
+
 #include "JIT.h"
 
 #if ENABLE(JIT)
 
 #include "CodeBlock.h"
+#include "GetterSetter.h"
 #include "JITInlineMethods.h"
 #include "JITStubCall.h"
 #include "JSArray.h"
@@ -48,958 +52,6 @@ using namespace std;
 
 namespace JSC {
 
-#if USE(JSVALUE32_64)
-
-void JIT::emit_op_put_by_index(Instruction* currentInstruction)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned value = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_put_by_index);
-    stubCall.addArgument(base);
-    stubCall.addArgument(Imm32(property));
-    stubCall.addArgument(value);
-    stubCall.call();
-}
-
-void JIT::emit_op_put_getter(Instruction* currentInstruction)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned function = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_put_getter);
-    stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
-    stubCall.addArgument(function);
-    stubCall.call();
-}
-
-void JIT::emit_op_put_setter(Instruction* currentInstruction)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned function = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_put_setter);
-    stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
-    stubCall.addArgument(function);
-    stubCall.call();
-}
-
-void JIT::emit_op_del_by_id(Instruction* currentInstruction)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_del_by_id);
-    stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
-    stubCall.call(dst);
-}
-
-
-#if !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
-
-// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
-void JIT::emit_op_method_check(Instruction*) {}
-void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
-#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
-#error "JIT_OPTIMIZE_METHOD_CALLS requires JIT_OPTIMIZE_PROPERTY_ACCESS"
-#endif
-
-void JIT::emit_op_get_by_val(Instruction* currentInstruction)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_get_by_val);
-    stubCall.addArgument(base);
-    stubCall.addArgument(property);
-    stubCall.call(dst);
-}
-
-void JIT::emitSlow_op_get_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
-{
-    ASSERT_NOT_REACHED();
-}
-
-void JIT::emit_op_put_by_val(Instruction* currentInstruction)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned value = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_put_by_val);
-    stubCall.addArgument(base);
-    stubCall.addArgument(property);
-    stubCall.addArgument(value);
-    stubCall.call();
-}
-
-void JIT::emitSlow_op_put_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
-{
-    ASSERT_NOT_REACHED();
-}
-
-void JIT::emit_op_get_by_id(Instruction* currentInstruction)
-{
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-    int ident = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_get_by_id_generic);
-    stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
-    stubCall.call(dst);
-
-    m_propertyAccessInstructionIndex++;
-}
-
-void JIT::emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
-{
-    m_propertyAccessInstructionIndex++;
-    ASSERT_NOT_REACHED();
-}
-
-void JIT::emit_op_put_by_id(Instruction* currentInstruction)
-{
-    int base = currentInstruction[1].u.operand;
-    int ident = currentInstruction[2].u.operand;
-    int value = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_put_by_id_generic);
-    stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
-    stubCall.addArgument(value);
-    stubCall.call();
-
-    m_propertyAccessInstructionIndex++;
-}
-
-void JIT::emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
-{
-    m_propertyAccessInstructionIndex++;
-    ASSERT_NOT_REACHED();
-}
-
-#else // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-/* ------------------------------ BEGIN: ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
-
-#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
-
-void JIT::emit_op_method_check(Instruction* currentInstruction)
-{
-    // Assert that the following instruction is a get_by_id.
-    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id);
-
-    currentInstruction += OPCODE_LENGTH(op_method_check);
-
-    // Do the method check - check the object & its prototype's structure inline (this is the common case).
-    m_methodCallCompilationInfo.append(MethodCallCompilationInfo(m_propertyAccessInstructionIndex));
-    MethodCallCompilationInfo& info = m_methodCallCompilationInfo.last();
-
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-
-    emitLoad(base, regT1, regT0);
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT2);
-    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-
-    // This will be relinked to load the function without doing a load.
-    DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
-    move(Imm32(JSValue::CellTag), regT1);
-    Jump match = jump();
-
-    ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
-    ASSERT(differenceBetween(info.structureToCompare, protoStructureToCompare) == patchOffsetMethodCheckProtoStruct);
-    ASSERT(differenceBetween(info.structureToCompare, putFunction) == patchOffsetMethodCheckPutFunction);
-
-    // Link the failure cases here.
-    structureCheck.link(this);
-    protoStructureCheck.link(this);
-
-    // Do a regular(ish) get_by_id (the slow case will be link to
-    // cti_op_get_by_id_method_check instead of cti_op_get_by_id.
-    compileGetByIdHotPath();
-
-    match.link(this);
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeIndex + OPCODE_LENGTH(op_method_check), dst, regT1, regT0);
-
-    // We've already generated the following get_by_id, so make sure it's skipped over.
-    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
-}
-
-void JIT::emitSlow_op_method_check(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    currentInstruction += OPCODE_LENGTH(op_method_check);
-
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-    int ident = currentInstruction[3].u.operand;
-
-    compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter, true);
-
-    // We've already generated the following get_by_id, so make sure it's skipped over.
-    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
-}
-
-#else //!ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
-
-// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
-void JIT::emit_op_method_check(Instruction*) {}
-void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
-
-#endif
-
-void JIT::emit_op_get_by_val(Instruction* currentInstruction)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-    
-    emitLoad2(base, regT1, regT0, property, regT3, regT2);
-
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
-
-    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
-    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
-    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::EmptyValueTag)));
-
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_val), dst, regT1, regT0);
-}
-
-void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-
-    linkSlowCase(iter); // property int32 check
-    linkSlowCaseIfNotJSCell(iter, base); // base cell check
-    linkSlowCase(iter); // base array check
-    linkSlowCase(iter); // vector length check
-    linkSlowCase(iter); // empty value
-
-    JITStubCall stubCall(this, cti_op_get_by_val);
-    stubCall.addArgument(base);
-    stubCall.addArgument(property);
-    stubCall.call(dst);
-}
-
-void JIT::emit_op_put_by_val(Instruction* currentInstruction)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned value = currentInstruction[3].u.operand;
-
-    emitLoad2(base, regT1, regT0, property, regT3, regT2);
-
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
-
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
-
-    Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::EmptyValueTag));
-
-    Label storeResult(this);
-    emitLoad(value, regT1, regT0);
-    store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))); // payload
-    store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4)); // tag
-    Jump end = jump();
-
-    empty.link(this);
-    add32(Imm32(1), Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
-    branch32(Below, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
-
-    add32(Imm32(1), regT2, regT0);
-    store32(regT0, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length)));
-    jump().linkTo(storeResult, this);
-
-    end.link(this);
-}
-
-void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned value = currentInstruction[3].u.operand;
-
-    linkSlowCase(iter); // property int32 check
-    linkSlowCaseIfNotJSCell(iter, base); // base cell check
-    linkSlowCase(iter); // base not array check
-    linkSlowCase(iter); // in vector check
-
-    JITStubCall stubPutByValCall(this, cti_op_put_by_val);
-    stubPutByValCall.addArgument(base);
-    stubPutByValCall.addArgument(property);
-    stubPutByValCall.addArgument(value);
-    stubPutByValCall.call();
-}
-
-void JIT::emit_op_get_by_id(Instruction* currentInstruction)
-{
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-    
-    emitLoad(base, regT1, regT0);
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-    compileGetByIdHotPath();
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_id), dst, regT1, regT0);
-}
-
-void JIT::compileGetByIdHotPath()
-{
-    // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
-    // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
-    // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
-    // to jump back to if one of these trampolies finds a match.
-    Label hotPathBegin(this);
-    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
-    m_propertyAccessInstructionIndex++;
-
-    DataLabelPtr structureToCompare;
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-    addSlowCase(structureCheck);
-    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetGetByIdStructure);
-    ASSERT(differenceBetween(hotPathBegin, structureCheck) == patchOffsetGetByIdBranchToSlowCase);
-
-    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT2);
-    Label externalLoadComplete(this);
-    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetGetByIdExternalLoad);
-    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthGetByIdExternalLoad);
-
-    DataLabel32 displacementLabel1 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT0); // payload
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetGetByIdPropertyMapOffset1);
-    DataLabel32 displacementLabel2 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT1); // tag
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetGetByIdPropertyMapOffset2);
-
-    Label putResult(this);
-    ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
-}
-
-void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-    int ident = currentInstruction[3].u.operand;
-
-    compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter);
-}
-
-void JIT::compileGetByIdSlowCase(int dst, int base, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck)
-{
-    // As for the hot path of get_by_id, above, we ensure that we can use an architecture specific offset
-    // so that we only need track one pointer into the slow case code - we track a pointer to the location
-    // of the call (which we can use to look up the patch information), but should a array-length or
-    // prototype access trampoline fail we want to bail out back to here.  To do so we can subtract back
-    // the distance from the call to the head of the slow case.
-    linkSlowCaseIfNotJSCell(iter, base);
-    linkSlowCase(iter);
-
-    Label coldPathBegin(this);
-
-    JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
-    stubCall.addArgument(regT1, regT0);
-    stubCall.addArgument(ImmPtr(ident));
-    Call call = stubCall.call(dst);
-
-    ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
-
-    // Track the location of the call; this will be used to recover patch information.
-    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
-    m_propertyAccessInstructionIndex++;
-}
-
-void JIT::emit_op_put_by_id(Instruction* currentInstruction)
-{
-    // In order to be able to patch both the Structure, and the object offset, we store one pointer,
-    // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
-    // such that the Structure & offset are always at the same distance from this.
-
-    int base = currentInstruction[1].u.operand;
-    int value = currentInstruction[3].u.operand;
-
-    emitLoad2(base, regT1, regT0, value, regT3, regT2);
-
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-
-    Label hotPathBegin(this);
-    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
-    m_propertyAccessInstructionIndex++;
-
-    // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
-    DataLabelPtr structureToCompare;
-    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
-    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetPutByIdStructure);
-
-    // Plant a load from a bogus ofset in the object's property map; we will patch this later, if it is to be used.
-    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
-    Label externalLoadComplete(this);
-    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetPutByIdExternalLoad);
-    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
-
-    DataLabel32 displacementLabel1 = storePtrWithAddressOffsetPatch(regT2, Address(regT0, patchGetByIdDefaultOffset)); // payload
-    DataLabel32 displacementLabel2 = storePtrWithAddressOffsetPatch(regT3, Address(regT0, patchGetByIdDefaultOffset)); // tag
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetPutByIdPropertyMapOffset1);
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetPutByIdPropertyMapOffset2);
-}
-
-void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    int base = currentInstruction[1].u.operand;
-    int ident = currentInstruction[2].u.operand;
-
-    linkSlowCaseIfNotJSCell(iter, base);
-    linkSlowCase(iter);
-
-    JITStubCall stubCall(this, cti_op_put_by_id);
-    stubCall.addArgument(regT1, regT0);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
-    stubCall.addArgument(regT3, regT2); 
-    Call call = stubCall.call();
-
-    // Track the location of the call; this will be used to recover patch information.
-    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
-    m_propertyAccessInstructionIndex++;
-}
-
-// Compile a store into an object's property storage.  May overwrite base.
-void JIT::compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, Structure* structure, size_t cachedOffset)
-{
-    int offset = cachedOffset;
-    if (structure->isUsingInlineStorage())
-        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) /  sizeof(Register);
-    else
-        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
-    emitStore(offset, valueTag, valuePayload, base);
-}
-
-// Compile a load from an object's property storage.  May overwrite base.
-void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, Structure* structure, size_t cachedOffset)
-{
-    int offset = cachedOffset;
-    if (structure->isUsingInlineStorage())
-        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) / sizeof(Register);
-    else
-        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
-    emitLoad(offset, resultTag, resultPayload, base);
-}
-
-void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset)
-{
-    if (base->isUsingInlineStorage()) {
-        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]), resultPayload);
-        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]) + 4, resultTag);
-        return;
-    }
-
-    size_t offset = cachedOffset * sizeof(JSValue);
-
-    PropertyStorage* protoPropertyStorage = &base->m_externalStorage;
-    loadPtr(static_cast<void*>(protoPropertyStorage), temp);
-    load32(Address(temp, offset), resultPayload);
-    load32(Address(temp, offset + 4), resultTag);
-}
-
-void JIT::testPrototype(Structure* structure, JumpList& failureCases)
-{
-    if (structure->m_prototype.isNull())
-        return;
-
-    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&asCell(structure->m_prototype)->m_structure), ImmPtr(asCell(structure->m_prototype)->m_structure)));
-}
-
-void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
-{
-    // It is assumed that regT0 contains the basePayload and regT1 contains the baseTag.  The value can be found on the stack.
-
-    JumpList failureCases;
-    failureCases.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
-    failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
-    testPrototype(oldStructure, failureCases);
-
-    // Verify that nothing in the prototype chain has a setter for this property. 
-    for (RefPtr<Structure>* it = chain->head(); *it; ++it)
-        testPrototype(it->get(), failureCases);
-
-    // Reallocate property storage if needed.
-    Call callTarget;
-    bool willNeedStorageRealloc = oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
-    if (willNeedStorageRealloc) {
-        // This trampoline was called to like a JIT stub; before we can can call again we need to
-        // remove the return address from the stack, to prevent the stack from becoming misaligned.
-        preserveReturnAddressAfterCall(regT3);
- 
-        JITStubCall stubCall(this, cti_op_put_by_id_transition_realloc);
-        stubCall.skipArgument(); // base
-        stubCall.skipArgument(); // ident
-        stubCall.skipArgument(); // value
-        stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
-        stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
-        stubCall.call(regT0);
-
-        restoreReturnAddressBeforeReturn(regT3);
-    }
-
-    sub32(Imm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
-    add32(Imm32(1), AbsoluteAddress(newStructure->addressOfCount()));
-    storePtr(ImmPtr(newStructure), Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)));
- 
-    load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*)), regT3);
-    load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*) + 4), regT2);
-
-    // Write the value
-    compilePutDirectOffset(regT0, regT2, regT3, newStructure, cachedOffset);
-
-    ret();
-    
-    ASSERT(!failureCases.empty());
-    failureCases.link(this);
-    restoreArgumentReferenceForTrampoline();
-    Call failureCall = tailRecursiveCall();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    patchBuffer.link(failureCall, FunctionPtr(cti_op_put_by_id_fail));
-
-    if (willNeedStorageRealloc) {
-        ASSERT(m_calls.size() == 1);
-        patchBuffer.link(m_calls[0].from, FunctionPtr(cti_op_put_by_id_transition_realloc));
-    }
-    
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relinkCallerToTrampoline(returnAddress, entryLabel);
-}
-
-void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
-{
-    RepatchBuffer repatchBuffer(codeBlock);
-
-    // We don't want to patch more than once - in future go to cti_op_get_by_id_generic.
-    // Should probably go to JITStubs::cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
-
-    int offset = sizeof(JSValue) * cachedOffset;
-
-    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
-    // and makes the subsequent load's offset automatically correct
-    if (structure->isUsingInlineStorage())
-        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad));
-
-    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetGetByIdStructure), structure);
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset1), offset); // payload
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset2), offset + 4); // tag
-}
-
-void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
-{
-    RepatchBuffer repatchBuffer(codeBlock);
-
-    ASSERT(!methodCallLinkInfo.cachedStructure);
-    methodCallLinkInfo.cachedStructure = structure;
-    structure->ref();
-
-    Structure* prototypeStructure = proto->structure();
-    ASSERT(!methodCallLinkInfo.cachedPrototypeStructure);
-    methodCallLinkInfo.cachedPrototypeStructure = prototypeStructure;
-    prototypeStructure->ref();
-
-    repatchBuffer.repatch(methodCallLinkInfo.structureLabel, structure);
-    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj), proto);
-    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoStruct), prototypeStructure);
-    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckPutFunction), callee);
-
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id));
-}
-
-void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
-{
-    RepatchBuffer repatchBuffer(codeBlock);
-
-    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    // Should probably go to cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_put_by_id_generic));
-
-    int offset = sizeof(JSValue) * cachedOffset;
-
-    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
-    // and makes the subsequent load's offset automatically correct
-    if (structure->isUsingInlineStorage())
-        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetPutByIdExternalLoad));
-
-    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetPutByIdStructure), structure);
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset1), offset); // payload
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset2), offset + 4); // tag
-}
-
-void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
-{
-    StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress);
-    
-    // regT0 holds a JSCell*
-
-    // Check for array
-    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
-
-    // Checks out okay! - get the length from the storage
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
-    load32(Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT2);
-
-    Jump failureCases2 = branch32(Above, regT2, Imm32(INT_MAX));
-    move(regT2, regT0);
-    move(Imm32(JSValue::Int32Tag), regT1);
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
-    patchBuffer.link(failureCases1, slowCaseBegin);
-    patchBuffer.link(failureCases2, slowCaseBegin);
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-
-    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_array_fail));
-}
-
-void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
-{
-    // regT0 holds a JSCell*
-
-    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
-    // referencing the prototype object - let's speculatively load it's table nice and early!)
-    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-
-    Jump failureCases1 = checkStructure(regT0, structure);
-
-    // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
-    move(ImmPtr(prototypeStructure), regT3);
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
-#else
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
-#endif
-
-    // Checks out okay! - getDirectOffset
-    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
-
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
-    patchBuffer.link(failureCases1, slowCaseBegin);
-    patchBuffer.link(failureCases2, slowCaseBegin);
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-
-    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
-}
-
-
-void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
-{
-    // regT0 holds a JSCell*
-    
-    Jump failureCase = checkStructure(regT0, structure);
-    compileGetDirectOffset(regT0, regT1, regT0, structure, cachedOffset);
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
-    if (!lastProtoBegin)
-        lastProtoBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
-
-    patchBuffer.link(failureCase, lastProtoBegin);
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-
-    structure->ref();
-    polymorphicStructures->list[currentIndex].set(entryLabel, structure);
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-}
-
-void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame)
-{
-    // regT0 holds a JSCell*
-    
-    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
-    // referencing the prototype object - let's speculatively load it's table nice and early!)
-    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-
-    // Check eax is an object of the right Structure.
-    Jump failureCases1 = checkStructure(regT0, structure);
-
-    // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
-    move(ImmPtr(prototypeStructure), regT3);
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
-#else
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
-#endif
-
-    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
-
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
-    patchBuffer.link(failureCases1, lastProtoBegin);
-    patchBuffer.link(failureCases2, lastProtoBegin);
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-
-    structure->ref();
-    prototypeStructure->ref();
-    prototypeStructures->list[currentIndex].set(entryLabel, structure, prototypeStructure);
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-}
-
-void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame)
-{
-    // regT0 holds a JSCell*
-    
-    ASSERT(count);
-    
-    JumpList bucketsOfFail;
-
-    // Check eax is an object of the right Structure.
-    bucketsOfFail.append(checkStructure(regT0, structure));
-
-    Structure* currStructure = structure;
-    RefPtr<Structure>* chainEntries = chain->head();
-    JSObject* protoObject = 0;
-    for (unsigned i = 0; i < count; ++i) {
-        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
-        currStructure = chainEntries[i].get();
-
-        // Check the prototype object's Structure had not changed.
-        Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
-        move(ImmPtr(currStructure), regT3);
-        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
-#else
-        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
-#endif
-    }
-    ASSERT(protoObject);
-
-    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
-
-    patchBuffer.link(bucketsOfFail, lastProtoBegin);
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-
-    // Track the stub we have created so that it will be deleted later.
-    structure->ref();
-    chain->ref();
-    prototypeStructures->list[currentIndex].set(entryLabel, structure, chain);
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-}
-
-void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
-{
-    // regT0 holds a JSCell*
-    
-    ASSERT(count);
-    
-    JumpList bucketsOfFail;
-
-    // Check eax is an object of the right Structure.
-    bucketsOfFail.append(checkStructure(regT0, structure));
-
-    Structure* currStructure = structure;
-    RefPtr<Structure>* chainEntries = chain->head();
-    JSObject* protoObject = 0;
-    for (unsigned i = 0; i < count; ++i) {
-        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
-        currStructure = chainEntries[i].get();
-
-        // Check the prototype object's Structure had not changed.
-        Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
-        move(ImmPtr(currStructure), regT3);
-        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
-#else
-        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
-#endif
-    }
-    ASSERT(protoObject);
-
-    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    patchBuffer.link(bucketsOfFail, stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall));
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-
-    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
-}
-
-/* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
-
-#endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID structure, RegisterID offset)
-{
-    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
-    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
-    ASSERT(sizeof(JSValue) == 8);
-
-    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
-    Jump finishedLoad = jump();
-    notUsingInlineStorage.link(this);
-    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
-    finishedLoad.link(this);
-}
-
-void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-    unsigned expected = currentInstruction[4].u.operand;
-    unsigned iter = currentInstruction[5].u.operand;
-    unsigned i = currentInstruction[6].u.operand;
-
-    emitLoad2(property, regT1, regT0, base, regT3, regT2);
-    emitJumpSlowCaseIfNotJSCell(property, regT1);
-    addSlowCase(branchPtr(NotEqual, regT0, payloadFor(expected)));
-    // Property registers are now available as the property is known
-    emitJumpSlowCaseIfNotJSCell(base, regT3);
-    emitLoadPayload(iter, regT1);
-    
-    // Test base's structure
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchPtr(NotEqual, regT0, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure))));
-    load32(addressFor(i), regT3);
-    sub32(Imm32(1), regT3);
-    addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
-    compileGetDirectOffset(regT2, regT1, regT0, regT0, regT3);    
-
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_pname), dst, regT1, regT0);
-}
-
-void JIT::emitSlow_op_get_by_pname(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-    
-    linkSlowCaseIfNotJSCell(iter, property);
-    linkSlowCase(iter);
-    linkSlowCaseIfNotJSCell(iter, base);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    
-    JITStubCall stubCall(this, cti_op_get_by_val);
-    stubCall.addArgument(base);
-    stubCall.addArgument(property);
-    stubCall.call(dst);
-}
-
-#else // USE(JSVALUE32_64)
-
 void JIT::emit_op_get_by_val(Instruction* currentInstruction)
 {
     unsigned dst = currentInstruction[1].u.operand;
@@ -1031,6 +83,20 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
     emitPutVirtualRegister(dst);
 }
 
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID structure, RegisterID offset, RegisterID scratch)
+{
+    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
+    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
+
+    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
+    loadPtr(BaseIndex(base, offset, ScalePtr, OBJECT_OFFSETOF(JSObject, m_inlineStorage)), result);
+    Jump finishedLoad = jump();
+    notUsingInlineStorage.link(this);
+    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), scratch);
+    loadPtr(BaseIndex(scratch, offset, ScalePtr, 0), result);
+    finishedLoad.link(this);
+}
+
 void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
 {
     unsigned dst = currentInstruction[1].u.operand;
@@ -1457,20 +523,6 @@ void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID res
     } 
 }
 
-void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID structure, RegisterID offset, RegisterID scratch)
-{
-    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
-    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
-
-    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
-    loadPtr(BaseIndex(base, offset, ScalePtr, OBJECT_OFFSETOF(JSObject, m_inlineStorage)), result);
-    Jump finishedLoad = jump();
-    notUsingInlineStorage.link(this);
-    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), scratch);
-    loadPtr(BaseIndex(scratch, offset, ScalePtr, 0), result);    
-    finishedLoad.link(this);
-}
-
 void JIT::testPrototype(Structure* structure, JumpList& failureCases)
 {
     if (structure->m_prototype.isNull())
@@ -1574,7 +626,6 @@ void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodC
     structure->ref();
 
     Structure* prototypeStructure = proto->structure();
-    ASSERT(!methodCallLinkInfo.cachedPrototypeStructure);
     methodCallLinkInfo.cachedPrototypeStructure = prototypeStructure;
     prototypeStructure->ref();
 
@@ -1645,7 +696,7 @@ void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_array_fail));
 }
 
-void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
 {
     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
     // referencing the prototype object - let's speculatively load it's table nice and early!)
@@ -1656,18 +707,35 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
 
     // Check the prototype object's Structure had not changed.
     Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     move(ImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
 #endif
 
-    // Checks out okay! - getDirectOffset
-    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
-
+    bool needsStubLink = false;
+    
+    // Checks out okay!
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     Jump success = jump();
-
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
@@ -1678,6 +746,12 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
     // Track the stub we have created so that it will be deleted later.
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
     stubInfo->stubRoutine = entryLabel;
@@ -1691,14 +765,43 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
 }
 
-void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
+void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
 {
     Jump failureCase = checkStructure(regT0, structure);
-    compileGetDirectOffset(regT0, regT0, structure, cachedOffset);
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        if (!structure->isUsingInlineStorage()) {
+            move(regT0, regT1);
+            compileGetDirectOffset(regT1, regT1, structure, cachedOffset);
+        } else
+            compileGetDirectOffset(regT0, regT1, structure, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(regT0, regT0, structure, cachedOffset);
     Jump success = jump();
 
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
     if (!lastProtoBegin)
@@ -1720,7 +823,7 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
     repatchBuffer.relink(jumpLocation, entryLabel);
 }
 
-void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame)
+void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
 {
     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
     // referencing the prototype object - let's speculatively load it's table nice and early!)
@@ -1731,20 +834,45 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
 
     // Check the prototype object's Structure had not changed.
     Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     move(ImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
 #endif
 
-    // Checks out okay! - getDirectOffset
-    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
+    // Checks out okay!
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
 
     Jump success = jump();
 
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
     patchBuffer.link(failureCases1, lastProtoBegin);
@@ -1765,10 +893,9 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     repatchBuffer.relink(jumpLocation, entryLabel);
 }
 
-void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame)
+void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
 {
     ASSERT(count);
-    
     JumpList bucketsOfFail;
 
     // Check eax is an object of the right Structure.
@@ -1784,7 +911,7 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
 
         // Check the prototype object's Structure had not changed.
         Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         move(ImmPtr(currStructure), regT3);
         bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
 #else
@@ -1792,11 +919,36 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
 #endif
     }
     ASSERT(protoObject);
-
-    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
+    
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     Jump success = jump();
 
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
 
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
@@ -1819,10 +971,10 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     repatchBuffer.relink(jumpLocation, entryLabel);
 }
 
-void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
 {
     ASSERT(count);
-    
+
     JumpList bucketsOfFail;
 
     // Check eax is an object of the right Structure.
@@ -1837,7 +989,7 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
 
         // Check the prototype object's Structure had not changed.
         Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         move(ImmPtr(currStructure), regT3);
         bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
 #else
@@ -1846,11 +998,36 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
     }
     ASSERT(protoObject);
 
-    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     Jump success = jump();
 
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+
     // Use the patch information to link the failure cases back to the original slow case routine.
     patchBuffer.link(bucketsOfFail, stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall));
 
@@ -1874,8 +1051,8 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
 
 #endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
-#endif // USE(JSVALUE32_64)
-
 } // namespace JSC
 
 #endif // ENABLE(JIT)
+
+#endif // !USE(JSVALUE32_64)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
new file mode 100644
index 0000000000..ec33026a7e
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -0,0 +1,1145 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(JSVALUE32_64)
+
+#include "JIT.h"
+
+#if ENABLE(JIT)
+
+#include "CodeBlock.h"
+#include "JITInlineMethods.h"
+#include "JITStubCall.h"
+#include "JSArray.h"
+#include "JSFunction.h"
+#include "JSPropertyNameIterator.h"
+#include "Interpreter.h"
+#include "LinkBuffer.h"
+#include "RepatchBuffer.h"
+#include "ResultType.h"
+#include "SamplingTool.h"
+
+#ifndef NDEBUG
+#include <stdio.h>
+#endif
+
+using namespace std;
+
+namespace JSC {
+    
+void JIT::emit_op_put_by_index(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_put_by_index);
+    stubCall.addArgument(base);
+    stubCall.addArgument(Imm32(property));
+    stubCall.addArgument(value);
+    stubCall.call();
+}
+
+void JIT::emit_op_put_getter(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned function = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_put_getter);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.addArgument(function);
+    stubCall.call();
+}
+
+void JIT::emit_op_put_setter(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned function = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_put_setter);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.addArgument(function);
+    stubCall.call();
+}
+
+void JIT::emit_op_del_by_id(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_del_by_id);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.call(dst);
+}
+
+
+#if !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
+void JIT::emit_op_method_check(Instruction*) {}
+void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
+#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+#error "JIT_OPTIMIZE_METHOD_CALLS requires JIT_OPTIMIZE_PROPERTY_ACCESS"
+#endif
+
+void JIT::emit_op_get_by_val(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_get_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.call(dst);
+}
+
+void JIT::emitSlow_op_get_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_put_by_val(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_put_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.addArgument(value);
+    stubCall.call();
+}
+
+void JIT::emitSlow_op_put_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int ident = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_get_by_id_generic);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.call(dst);
+    
+    m_propertyAccessInstructionIndex++;
+}
+
+void JIT::emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    m_propertyAccessInstructionIndex++;
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
+{
+    int base = currentInstruction[1].u.operand;
+    int ident = currentInstruction[2].u.operand;
+    int value = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_put_by_id_generic);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(value);
+    stubCall.call();
+    
+    m_propertyAccessInstructionIndex++;
+}
+
+void JIT::emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    m_propertyAccessInstructionIndex++;
+    ASSERT_NOT_REACHED();
+}
+
+#else // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+/* ------------------------------ BEGIN: ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+
+void JIT::emit_op_method_check(Instruction* currentInstruction)
+{
+    // Assert that the following instruction is a get_by_id.
+    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id);
+    
+    currentInstruction += OPCODE_LENGTH(op_method_check);
+    
+    // Do the method check - check the object & its prototype's structure inline (this is the common case).
+    m_methodCallCompilationInfo.append(MethodCallCompilationInfo(m_propertyAccessInstructionIndex));
+    MethodCallCompilationInfo& info = m_methodCallCompilationInfo.last();
+    
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    
+    emitLoad(base, regT1, regT0);
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
+    
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT2);
+    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    
+    // This will be relinked to load the function without doing a load.
+    DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
+    
+    END_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
+    
+    move(Imm32(JSValue::CellTag), regT1);
+    Jump match = jump();
+    
+    ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
+    ASSERT(differenceBetween(info.structureToCompare, protoStructureToCompare) == patchOffsetMethodCheckProtoStruct);
+    ASSERT(differenceBetween(info.structureToCompare, putFunction) == patchOffsetMethodCheckPutFunction);
+    
+    // Link the failure cases here.
+    structureCheck.link(this);
+    protoStructureCheck.link(this);
+    
+    // Do a regular(ish) get_by_id (the slow case will be link to
+    // cti_op_get_by_id_method_check instead of cti_op_get_by_id.
+    compileGetByIdHotPath();
+    
+    match.link(this);
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_method_check), dst, regT1, regT0);
+    
+    // We've already generated the following get_by_id, so make sure it's skipped over.
+    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
+}
+
+void JIT::emitSlow_op_method_check(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    currentInstruction += OPCODE_LENGTH(op_method_check);
+    
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int ident = currentInstruction[3].u.operand;
+    
+    compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter, true);
+    
+    // We've already generated the following get_by_id, so make sure it's skipped over.
+    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
+}
+
+#else //!ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+
+// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
+void JIT::emit_op_method_check(Instruction*) {}
+void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
+
+#endif
+
+void JIT::emit_op_get_by_val(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    emitLoad2(base, regT1, regT0, property, regT3, regT2);
+    
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+    
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+    
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
+    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::EmptyValueTag)));
+    
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_val), dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    linkSlowCase(iter); // property int32 check
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base array check
+    linkSlowCase(iter); // vector length check
+    linkSlowCase(iter); // empty value
+    
+    JITStubCall stubCall(this, cti_op_get_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.call(dst);
+}
+
+void JIT::emit_op_put_by_val(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+    
+    emitLoad2(base, regT1, regT0, property, regT3, regT2);
+    
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+    
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
+    
+    Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::EmptyValueTag));
+    
+    Label storeResult(this);
+    emitLoad(value, regT1, regT0);
+    store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))); // payload
+    store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4)); // tag
+    Jump end = jump();
+    
+    empty.link(this);
+    add32(Imm32(1), Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+    branch32(Below, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
+    
+    add32(Imm32(1), regT2, regT0);
+    store32(regT0, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+    jump().linkTo(storeResult, this);
+    
+    end.link(this);
+}
+
+void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+    
+    linkSlowCase(iter); // property int32 check
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base not array check
+    linkSlowCase(iter); // in vector check
+    
+    JITStubCall stubPutByValCall(this, cti_op_put_by_val);
+    stubPutByValCall.addArgument(base);
+    stubPutByValCall.addArgument(property);
+    stubPutByValCall.addArgument(value);
+    stubPutByValCall.call();
+}
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    
+    emitLoad(base, regT1, regT0);
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    compileGetByIdHotPath();
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_id), dst, regT1, regT0);
+}
+
+void JIT::compileGetByIdHotPath()
+{
+    // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
+    // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
+    // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
+    // to jump back to if one of these trampolies finds a match.
+    
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
+    
+    Label hotPathBegin(this);
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
+    m_propertyAccessInstructionIndex++;
+    
+    DataLabelPtr structureToCompare;
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    addSlowCase(structureCheck);
+    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetGetByIdStructure);
+    ASSERT(differenceBetween(hotPathBegin, structureCheck) == patchOffsetGetByIdBranchToSlowCase);
+    
+    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT2);
+    Label externalLoadComplete(this);
+    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetGetByIdExternalLoad);
+    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthGetByIdExternalLoad);
+    
+    DataLabel32 displacementLabel1 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT0); // payload
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetGetByIdPropertyMapOffset1);
+    DataLabel32 displacementLabel2 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT1); // tag
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetGetByIdPropertyMapOffset2);
+    
+    Label putResult(this);
+    ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
+    
+    END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
+}
+
+void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int ident = currentInstruction[3].u.operand;
+    
+    compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter);
+}
+
+void JIT::compileGetByIdSlowCase(int dst, int base, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck)
+{
+    // As for the hot path of get_by_id, above, we ensure that we can use an architecture specific offset
+    // so that we only need track one pointer into the slow case code - we track a pointer to the location
+    // of the call (which we can use to look up the patch information), but should a array-length or
+    // prototype access trampoline fail we want to bail out back to here.  To do so we can subtract back
+    // the distance from the call to the head of the slow case.
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+    
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
+    
+#ifndef NDEBUG
+    Label coldPathBegin(this);
+#endif
+    JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    Call call = stubCall.call(dst);
+    
+    END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
+    
+    ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
+    
+    // Track the location of the call; this will be used to recover patch information.
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
+    m_propertyAccessInstructionIndex++;
+}
+
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
+{
+    // In order to be able to patch both the Structure, and the object offset, we store one pointer,
+    // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
+    // such that the Structure & offset are always at the same distance from this.
+    
+    int base = currentInstruction[1].u.operand;
+    int value = currentInstruction[3].u.operand;
+    
+    emitLoad2(base, regT1, regT0, value, regT3, regT2);
+    
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequencePutById);
+    
+    Label hotPathBegin(this);
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
+    m_propertyAccessInstructionIndex++;
+    
+    // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
+    DataLabelPtr structureToCompare;
+    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
+    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetPutByIdStructure);
+    
+    // Plant a load from a bogus ofset in the object's property map; we will patch this later, if it is to be used.
+    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
+    Label externalLoadComplete(this);
+    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetPutByIdExternalLoad);
+    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
+    
+    DataLabel32 displacementLabel1 = storePtrWithAddressOffsetPatch(regT2, Address(regT0, patchGetByIdDefaultOffset)); // payload
+    DataLabel32 displacementLabel2 = storePtrWithAddressOffsetPatch(regT3, Address(regT0, patchGetByIdDefaultOffset)); // tag
+    
+    END_UNINTERRUPTED_SEQUENCE(sequencePutById);
+    
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetPutByIdPropertyMapOffset1);
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetPutByIdPropertyMapOffset2);
+}
+
+void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int base = currentInstruction[1].u.operand;
+    int ident = currentInstruction[2].u.operand;
+    
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+    
+    JITStubCall stubCall(this, cti_op_put_by_id);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(regT3, regT2); 
+    Call call = stubCall.call();
+    
+    // Track the location of the call; this will be used to recover patch information.
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
+    m_propertyAccessInstructionIndex++;
+}
+
+// Compile a store into an object's property storage.  May overwrite base.
+void JIT::compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, Structure* structure, size_t cachedOffset)
+{
+    int offset = cachedOffset;
+    if (structure->isUsingInlineStorage())
+        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) /  sizeof(Register);
+    else
+        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    emitStore(offset, valueTag, valuePayload, base);
+}
+
+// Compile a load from an object's property storage.  May overwrite base.
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, Structure* structure, size_t cachedOffset)
+{
+    int offset = cachedOffset;
+    if (structure->isUsingInlineStorage())
+        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) / sizeof(Register);
+    else
+        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    emitLoad(offset, resultTag, resultPayload, base);
+}
+
+void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset)
+{
+    if (base->isUsingInlineStorage()) {
+        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]), resultPayload);
+        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]) + 4, resultTag);
+        return;
+    }
+    
+    size_t offset = cachedOffset * sizeof(JSValue);
+    
+    PropertyStorage* protoPropertyStorage = &base->m_externalStorage;
+    loadPtr(static_cast<void*>(protoPropertyStorage), temp);
+    load32(Address(temp, offset), resultPayload);
+    load32(Address(temp, offset + 4), resultTag);
+}
+
+void JIT::testPrototype(Structure* structure, JumpList& failureCases)
+{
+    if (structure->m_prototype.isNull())
+        return;
+    
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&asCell(structure->m_prototype)->m_structure), ImmPtr(asCell(structure->m_prototype)->m_structure)));
+}
+
+void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
+{
+    // It is assumed that regT0 contains the basePayload and regT1 contains the baseTag.  The value can be found on the stack.
+    
+    JumpList failureCases;
+    failureCases.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+    failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
+    testPrototype(oldStructure, failureCases);
+    
+    // Verify that nothing in the prototype chain has a setter for this property. 
+    for (RefPtr<Structure>* it = chain->head(); *it; ++it)
+        testPrototype(it->get(), failureCases);
+    
+    // Reallocate property storage if needed.
+    Call callTarget;
+    bool willNeedStorageRealloc = oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
+    if (willNeedStorageRealloc) {
+        // This trampoline was called to like a JIT stub; before we can can call again we need to
+        // remove the return address from the stack, to prevent the stack from becoming misaligned.
+        preserveReturnAddressAfterCall(regT3);
+        
+        JITStubCall stubCall(this, cti_op_put_by_id_transition_realloc);
+        stubCall.skipArgument(); // base
+        stubCall.skipArgument(); // ident
+        stubCall.skipArgument(); // value
+        stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
+        stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
+        stubCall.call(regT0);
+        
+        restoreReturnAddressBeforeReturn(regT3);
+    }
+    
+    sub32(Imm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
+    add32(Imm32(1), AbsoluteAddress(newStructure->addressOfCount()));
+    storePtr(ImmPtr(newStructure), Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)));
+    
+    load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*)), regT3);
+    load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*) + 4), regT2);
+    
+    // Write the value
+    compilePutDirectOffset(regT0, regT2, regT3, newStructure, cachedOffset);
+    
+    ret();
+    
+    ASSERT(!failureCases.empty());
+    failureCases.link(this);
+    restoreArgumentReferenceForTrampoline();
+    Call failureCall = tailRecursiveCall();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    
+    patchBuffer.link(failureCall, FunctionPtr(cti_op_put_by_id_fail));
+    
+    if (willNeedStorageRealloc) {
+        ASSERT(m_calls.size() == 1);
+        patchBuffer.link(m_calls[0].from, FunctionPtr(cti_op_put_by_id_transition_realloc));
+    }
+    
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relinkCallerToTrampoline(returnAddress, entryLabel);
+}
+
+void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
+{
+    RepatchBuffer repatchBuffer(codeBlock);
+    
+    // We don't want to patch more than once - in future go to cti_op_get_by_id_generic.
+    // Should probably go to JITStubs::cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
+    
+    int offset = sizeof(JSValue) * cachedOffset;
+    
+    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
+    // and makes the subsequent load's offset automatically correct
+    if (structure->isUsingInlineStorage())
+        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad));
+    
+    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetGetByIdStructure), structure);
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset1), offset); // payload
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset2), offset + 4); // tag
+}
+
+void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
+{
+    RepatchBuffer repatchBuffer(codeBlock);
+    
+    ASSERT(!methodCallLinkInfo.cachedStructure);
+    methodCallLinkInfo.cachedStructure = structure;
+    structure->ref();
+    
+    Structure* prototypeStructure = proto->structure();
+    methodCallLinkInfo.cachedPrototypeStructure = prototypeStructure;
+    prototypeStructure->ref();
+    
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel, structure);
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj), proto);
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoStruct), prototypeStructure);
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckPutFunction), callee);
+    
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id));
+}
+
+void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
+{
+    RepatchBuffer repatchBuffer(codeBlock);
+    
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    // Should probably go to cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_put_by_id_generic));
+    
+    int offset = sizeof(JSValue) * cachedOffset;
+    
+    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
+    // and makes the subsequent load's offset automatically correct
+    if (structure->isUsingInlineStorage())
+        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetPutByIdExternalLoad));
+    
+    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetPutByIdStructure), structure);
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset1), offset); // payload
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset2), offset + 4); // tag
+}
+
+void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
+{
+    StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress);
+    
+    // regT0 holds a JSCell*
+    
+    // Check for array
+    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
+    
+    // Checks out okay! - get the length from the storage
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
+    load32(Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT2);
+    
+    Jump failureCases2 = branch32(Above, regT2, Imm32(INT_MAX));
+    move(regT2, regT0);
+    move(Imm32(JSValue::Int32Tag), regT1);
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
+    patchBuffer.link(failureCases1, slowCaseBegin);
+    patchBuffer.link(failureCases2, slowCaseBegin);
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+    
+    // Track the stub we have created so that it will be deleted later.
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+    
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_array_fail));
+}
+
+void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+    
+    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
+    // referencing the prototype object - let's speculatively load it's table nice and early!)
+    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
+    
+    Jump failureCases1 = checkStructure(regT0, structure);
+    
+    // Check the prototype object's Structure had not changed.
+    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if CPU(X86_64)
+    move(ImmPtr(prototypeStructure), regT3);
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
+#else
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+#endif
+    bool needsStubLink = false;
+    // Checks out okay!
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+    
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
+    patchBuffer.link(failureCases1, slowCaseBegin);
+    patchBuffer.link(failureCases2, slowCaseBegin);
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+
+    // Track the stub we have created so that it will be deleted later.
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+    
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
+}
+
+
+void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
+{
+    // regT0 holds a JSCell*
+    Jump failureCase = checkStructure(regT0, structure);
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        if (!structure->isUsingInlineStorage()) {
+            move(regT0, regT1);
+            compileGetDirectOffset(regT1, regT2, regT1, structure, cachedOffset);
+        } else
+            compileGetDirectOffset(regT0, regT2, regT1, structure, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(regT0, regT1, regT0, structure, cachedOffset);
+
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }    
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
+    if (!lastProtoBegin)
+        lastProtoBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
+    
+    patchBuffer.link(failureCase, lastProtoBegin);
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    
+    structure->ref();
+    polymorphicStructures->list[currentIndex].set(entryLabel, structure);
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+}
+
+void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+    
+    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
+    // referencing the prototype object - let's speculatively load it's table nice and early!)
+    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
+    
+    // Check eax is an object of the right Structure.
+    Jump failureCases1 = checkStructure(regT0, structure);
+    
+    // Check the prototype object's Structure had not changed.
+    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if CPU(X86_64)
+    move(ImmPtr(prototypeStructure), regT3);
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
+#else
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+#endif
+    
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+    
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+    patchBuffer.link(failureCases1, lastProtoBegin);
+    patchBuffer.link(failureCases2, lastProtoBegin);
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+    
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    
+    structure->ref();
+    prototypeStructure->ref();
+    prototypeStructures->list[currentIndex].set(entryLabel, structure, prototypeStructure);
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+}
+
+void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+    ASSERT(count);
+    
+    JumpList bucketsOfFail;
+    
+    // Check eax is an object of the right Structure.
+    bucketsOfFail.append(checkStructure(regT0, structure));
+    
+    Structure* currStructure = structure;
+    RefPtr<Structure>* chainEntries = chain->head();
+    JSObject* protoObject = 0;
+    for (unsigned i = 0; i < count; ++i) {
+        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
+        currStructure = chainEntries[i].get();
+        
+        // Check the prototype object's Structure had not changed.
+        Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if CPU(X86_64)
+        move(ImmPtr(currStructure), regT3);
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
+#else
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
+#endif
+    }
+    ASSERT(protoObject);
+    
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+    
+    patchBuffer.link(bucketsOfFail, lastProtoBegin);
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+    
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    
+    // Track the stub we have created so that it will be deleted later.
+    structure->ref();
+    chain->ref();
+    prototypeStructures->list[currentIndex].set(entryLabel, structure, chain);
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+}
+
+void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+    ASSERT(count);
+    
+    JumpList bucketsOfFail;
+    
+    // Check eax is an object of the right Structure.
+    bucketsOfFail.append(checkStructure(regT0, structure));
+    
+    Structure* currStructure = structure;
+    RefPtr<Structure>* chainEntries = chain->head();
+    JSObject* protoObject = 0;
+    for (unsigned i = 0; i < count; ++i) {
+        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
+        currStructure = chainEntries[i].get();
+        
+        // Check the prototype object's Structure had not changed.
+        Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if CPU(X86_64)
+        move(ImmPtr(currStructure), regT3);
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
+#else
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
+#endif
+    }
+    ASSERT(protoObject);
+    
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    patchBuffer.link(bucketsOfFail, stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall));
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+    
+    // Track the stub we have created so that it will be deleted later.
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+    
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
+}
+
+/* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+#endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID structure, RegisterID offset)
+{
+    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
+    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
+    ASSERT(sizeof(JSValue) == 8);
+    
+    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
+    Jump finishedLoad = jump();
+    notUsingInlineStorage.link(this);
+    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
+    finishedLoad.link(this);
+}
+
+void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    unsigned expected = currentInstruction[4].u.operand;
+    unsigned iter = currentInstruction[5].u.operand;
+    unsigned i = currentInstruction[6].u.operand;
+    
+    emitLoad2(property, regT1, regT0, base, regT3, regT2);
+    emitJumpSlowCaseIfNotJSCell(property, regT1);
+    addSlowCase(branchPtr(NotEqual, regT0, payloadFor(expected)));
+    // Property registers are now available as the property is known
+    emitJumpSlowCaseIfNotJSCell(base, regT3);
+    emitLoadPayload(iter, regT1);
+    
+    // Test base's structure
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
+    addSlowCase(branchPtr(NotEqual, regT0, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure))));
+    load32(addressFor(i), regT3);
+    sub32(Imm32(1), regT3);
+    addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
+    compileGetDirectOffset(regT2, regT1, regT0, regT0, regT3);    
+    
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_pname), dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_get_by_pname(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    linkSlowCaseIfNotJSCell(iter, property);
+    linkSlowCase(iter);
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    
+    JITStubCall stubCall(this, cti_op_get_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.call(dst);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
+#endif // ENABLE(JSVALUE32_64)
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
index c5ed9e3a48..cfbd7dc68b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
@@ -38,7 +38,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Cell)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -46,7 +46,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Cell)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -54,7 +54,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(VoidPtr)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -62,7 +62,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Int)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -70,7 +70,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Int)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -78,7 +78,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Void)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -87,7 +87,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Value)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 #endif
@@ -145,7 +145,7 @@ namespace JSC {
 
         void getArgument(size_t argumentNumber, JIT::RegisterID tag, JIT::RegisterID payload)
         {
-            size_t stackIndex = stackIndexStart + (argumentNumber * stackIndexStep);
+            size_t stackIndex = JITSTACKFRAME_ARGS_INDEX + (argumentNumber * stackIndexStep);
             m_jit->peek(payload, stackIndex);
             m_jit->peek(tag, stackIndex + 1);
         }
@@ -222,7 +222,6 @@ namespace JSC {
 
     private:
         static const size_t stackIndexStep = sizeof(EncodedJSValue) == 2 * sizeof(void*) ? 2 : 1;
-        static const size_t stackIndexStart = 1; // Index 0 is reserved for restoreArgumentReference().
 
         JIT* m_jit;
         FunctionPtr m_stub;
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
index 8385f929b3..816926885a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
@@ -38,6 +38,7 @@
 #include "Collector.h"
 #include "Debugger.h"
 #include "ExceptionHelpers.h"
+#include "GetterSetter.h"
 #include "GlobalEvalFunction.h"
 #include "JIT.h"
 #include "JSActivation.h"
@@ -56,6 +57,7 @@
 #include "RegExpPrototype.h"
 #include "Register.h"
 #include "SamplingTool.h"
+#include <wtf/StdLibExtras.h>
 #include <stdarg.h>
 #include <stdio.h>
 
@@ -63,31 +65,37 @@ using namespace std;
 
 namespace JSC {
 
-#if PLATFORM(DARWIN) || PLATFORM(WIN_OS)
+#if OS(DARWIN) || OS(WINDOWS)
 #define SYMBOL_STRING(name) "_" #name
 #else
 #define SYMBOL_STRING(name) #name
 #endif
 
-#if PLATFORM(IPHONE)
+#if OS(IPHONE_OS)
 #define THUMB_FUNC_PARAM(name) SYMBOL_STRING(name)
 #else
 #define THUMB_FUNC_PARAM(name)
 #endif
 
-#if PLATFORM(LINUX) && PLATFORM(X86_64)
+#if OS(LINUX) && CPU(X86_64)
 #define SYMBOL_STRING_RELOCATION(name) #name "@plt"
 #else
 #define SYMBOL_STRING_RELOCATION(name) SYMBOL_STRING(name)
 #endif
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     // Mach-O platform
 #define HIDE_SYMBOL(name) ".private_extern _" #name
-#elif PLATFORM(AIX)
+#elif OS(AIX)
     // IBM's own file format
 #define HIDE_SYMBOL(name) ".lglobl " #name
-#elif PLATFORM(LINUX) || PLATFORM(FREEBSD) || PLATFORM(OPENBSD) || PLATFORM(SOLARIS) || (PLATFORM(HPUX) && PLATFORM(IA64)) || PLATFORM(SYMBIAN) || PLATFORM(NETBSD)
+#elif   OS(LINUX)               \
+     || OS(FREEBSD)             \
+     || OS(OPENBSD)             \
+     || OS(SOLARIS)             \
+     || (OS(HPUX) && CPU(IA64)) \
+     || OS(SYMBIAN)             \
+     || OS(NETBSD)
     // ELF platform
 #define HIDE_SYMBOL(name) ".hidden " #name
 #else
@@ -96,7 +104,7 @@ namespace JSC {
 
 #if USE(JSVALUE32_64)
 
-#if COMPILER(GCC) && PLATFORM(X86)
+#if COMPILER(GCC) && CPU(X86)
 
 // These ASSERTs remind you that, if you change the layout of JITStackFrame, you
 // need to change the assembly trampolines below to match.
@@ -155,7 +163,7 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
     
-#elif COMPILER(GCC) && PLATFORM(X86_64)
+#elif COMPILER(GCC) && CPU(X86_64)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on x86-64."
@@ -225,73 +233,28 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
 
-#elif COMPILER(GCC) && PLATFORM(ARM_THUMB2)
+#elif COMPILER(GCC) && CPU(ARM_THUMB2)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on ARMv7."
 #endif
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "sub sp, sp, #0x3c" "\n"
-    "str lr, [sp, #0x20]" "\n"
-    "str r4, [sp, #0x24]" "\n"
-    "str r5, [sp, #0x28]" "\n"
-    "str r6, [sp, #0x2c]" "\n"
-    "str r1, [sp, #0x30]" "\n"
-    "str r2, [sp, #0x34]" "\n"
-    "str r3, [sp, #0x38]" "\n"
-    "cpy r5, r2" "\n"
-    "mov r6, #512" "\n"
-    "blx r0" "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
-    "bx lr" "\n"
-);
+#define THUNK_RETURN_ADDRESS_OFFSET      0x3C
+#define PRESERVED_RETURN_ADDRESS_OFFSET  0x40
+#define PRESERVED_R4_OFFSET              0x44
+#define PRESERVED_R5_OFFSET              0x48
+#define PRESERVED_R6_OFFSET              0x4C
+#define REGISTER_FILE_OFFSET             0x50
+#define CALLFRAME_OFFSET                 0x54
+#define EXCEPTION_OFFSET                 0x58
+#define ENABLE_PROFILER_REFERENCE_OFFSET 0x64
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-    "cpy r0, sp" "\n"
-    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
-    "bx lr" "\n"
-);
+#elif COMPILER(GCC) && CPU(ARM_TRADITIONAL)
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiOpThrowNotCaught) "\n"
-SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
-    "bx lr" "\n"
-);
+#define THUNK_RETURN_ADDRESS_OFFSET 64
+#define PRESERVEDR4_OFFSET          68
 
-#elif COMPILER(MSVC)
+#elif COMPILER(MSVC) && CPU(X86)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST configuration not supported on MSVC."
@@ -355,11 +318,13 @@ extern "C" {
     }
 }
 
-#endif // COMPILER(GCC) && PLATFORM(X86)
+#else
+    #error "JIT not supported on this platform."
+#endif
 
 #else // USE(JSVALUE32_64)
 
-#if COMPILER(GCC) && PLATFORM(X86)
+#if COMPILER(GCC) && CPU(X86)
 
 // These ASSERTs remind you that, if you change the layout of JITStackFrame, you
 // need to change the assembly trampolines below to match.
@@ -417,7 +382,7 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
     
-#elif COMPILER(GCC) && PLATFORM(X86_64)
+#elif COMPILER(GCC) && CPU(X86_64)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on x86-64."
@@ -494,111 +459,67 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
 
-#elif COMPILER(GCC) && PLATFORM(ARM_THUMB2)
+#elif COMPILER(GCC) && CPU(ARM_THUMB2)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on ARMv7."
 #endif
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "sub sp, sp, #0x40" "\n"
-    "str lr, [sp, #0x20]" "\n"
-    "str r4, [sp, #0x24]" "\n"
-    "str r5, [sp, #0x28]" "\n"
-    "str r6, [sp, #0x2c]" "\n"
-    "str r1, [sp, #0x30]" "\n"
-    "str r2, [sp, #0x34]" "\n"
-    "str r3, [sp, #0x38]" "\n"
-    "cpy r5, r2" "\n"
-    "mov r6, #512" "\n"
-    "blx r0" "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x40" "\n"
-    "bx lr" "\n"
-);
+#define THUNK_RETURN_ADDRESS_OFFSET      0x1C
+#define PRESERVED_RETURN_ADDRESS_OFFSET  0x20
+#define PRESERVED_R4_OFFSET              0x24
+#define PRESERVED_R5_OFFSET              0x28
+#define PRESERVED_R6_OFFSET              0x2C
+#define REGISTER_FILE_OFFSET             0x30
+#define CALLFRAME_OFFSET                 0x34
+#define EXCEPTION_OFFSET                 0x38
+#define ENABLE_PROFILER_REFERENCE_OFFSET 0x40
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-    "cpy r0, sp" "\n"
-    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x40" "\n"
-    "bx lr" "\n"
-);
+#elif COMPILER(GCC) && CPU(ARM_TRADITIONAL)
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiOpThrowNotCaught) "\n"
-SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
-    "bx lr" "\n"
-);
+#define THUNK_RETURN_ADDRESS_OFFSET 32
+#define PRESERVEDR4_OFFSET          36
 
-#elif COMPILER(GCC) && PLATFORM(ARM_TRADITIONAL)
+#elif COMPILER(RVCT) && CPU(ARM_TRADITIONAL)
 
-asm volatile (
-".text\n"
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "stmdb sp!, {r1-r3}" "\n"
-    "stmdb sp!, {r4-r8, lr}" "\n"
-    "sub sp, sp, #36" "\n"
-    "mov r4, r2" "\n"
-    "mov r5, #512" "\n"
-    "mov lr, pc" "\n"
-    "mov pc, r0" "\n"
-    "add sp, sp, #36" "\n"
-    "ldmia sp!, {r4-r8, lr}" "\n"
-    "add sp, sp, #12" "\n"
-    "mov pc, lr" "\n"
-);
+__asm EncodedJSValue ctiTrampoline(void*, RegisterFile*, CallFrame*, JSValue*, Profiler**, JSGlobalData*)
+{
+    ARM
+    stmdb sp!, {r1-r3}
+    stmdb sp!, {r4-r8, lr}
+    sub sp, sp, #36
+    mov r4, r2
+    mov r5, #512
+    mov lr, pc
+    bx r0
+    add sp, sp, #36
+    ldmia sp!, {r4-r8, lr}
+    add sp, sp, #12
+    bx lr
+}
 
-asm volatile (
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-    "mov r0, sp" "\n"
-    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
+__asm void ctiVMThrowTrampoline()
+{
+    ARM
+    PRESERVE8
+    mov r0, sp
+    bl cti_vm_throw
+    add sp, sp, #36
+    ldmia sp!, {r4-r8, lr}
+    add sp, sp, #12
+    bx lr
+}
 
-// Both has the same return sequence
-".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
-SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
-    "add sp, sp, #36" "\n"
-    "ldmia sp!, {r4-r8, lr}" "\n"
-    "add sp, sp, #12" "\n"
-    "mov pc, lr" "\n"
-);
+__asm void ctiOpThrowNotCaught()
+{
+    ARM
+    add sp, sp, #36
+    ldmia sp!, {r4-r8, lr}
+    add sp, sp, #12
+    bx lr
+}
 
-#elif COMPILER(MSVC)
+#elif COMPILER(MSVC) && CPU(X86)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST configuration not supported on MSVC."
@@ -661,10 +582,114 @@ extern "C" {
      }
 }
 
-#endif // COMPILER(GCC) && PLATFORM(X86)
+#else
+    #error "JIT not supported on this platform."
+#endif
 
 #endif // USE(JSVALUE32_64)
 
+#if COMPILER(GCC) && CPU(ARM_THUMB2)
+
+asm volatile(
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
+".thumb" "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "sub sp, sp, #" STRINGIZE_VALUE_OF(ENABLE_PROFILER_REFERENCE_OFFSET) "\n"
+    "str lr, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_RETURN_ADDRESS_OFFSET) "]" "\n"
+    "str r4, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R4_OFFSET) "]" "\n"
+    "str r5, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R5_OFFSET) "]" "\n"
+    "str r6, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R6_OFFSET) "]" "\n"
+    "str r1, [sp, #" STRINGIZE_VALUE_OF(REGISTER_FILE_OFFSET) "]" "\n"
+    "str r2, [sp, #" STRINGIZE_VALUE_OF(CALLFRAME_OFFSET) "]" "\n"
+    "str r3, [sp, #" STRINGIZE_VALUE_OF(EXCEPTION_OFFSET) "]" "\n"
+    "cpy r5, r2" "\n"
+    "mov r6, #512" "\n"
+    "blx r0" "\n"
+    "ldr r6, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R6_OFFSET) "]" "\n"
+    "ldr r5, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R5_OFFSET) "]" "\n"
+    "ldr r4, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R4_OFFSET) "]" "\n"
+    "ldr lr, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_RETURN_ADDRESS_OFFSET) "]" "\n"
+    "add sp, sp, #" STRINGIZE_VALUE_OF(ENABLE_PROFILER_REFERENCE_OFFSET) "\n"
+    "bx lr" "\n"
+);
+
+asm volatile(
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
+".thumb" "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "cpy r0, sp" "\n"
+    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
+    "ldr r6, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R6_OFFSET) "]" "\n"
+    "ldr r5, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R5_OFFSET) "]" "\n"
+    "ldr r4, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R4_OFFSET) "]" "\n"
+    "ldr lr, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_RETURN_ADDRESS_OFFSET) "]" "\n"
+    "add sp, sp, #" STRINGIZE_VALUE_OF(ENABLE_PROFILER_REFERENCE_OFFSET) "\n"
+    "bx lr" "\n"
+);
+
+asm volatile(
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
+".thumb" "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "ldr r6, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R6_OFFSET) "]" "\n"
+    "ldr r5, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R5_OFFSET) "]" "\n"
+    "ldr r4, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R4_OFFSET) "]" "\n"
+    "ldr lr, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_RETURN_ADDRESS_OFFSET) "]" "\n"
+    "add sp, sp, #" STRINGIZE_VALUE_OF(ENABLE_PROFILER_REFERENCE_OFFSET) "\n"
+    "bx lr" "\n"
+);
+
+#elif COMPILER(GCC) && CPU(ARM_TRADITIONAL)
+
+asm volatile(
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "stmdb sp!, {r1-r3}" "\n"
+    "stmdb sp!, {r4-r8, lr}" "\n"
+    "sub sp, sp, #" STRINGIZE_VALUE_OF(PRESERVEDR4_OFFSET) "\n"
+    "mov r4, r2" "\n"
+    "mov r5, #512" "\n"
+    // r0 contains the code
+    "mov lr, pc" "\n"
+    "mov pc, r0" "\n"
+    "add sp, sp, #" STRINGIZE_VALUE_OF(PRESERVEDR4_OFFSET) "\n"
+    "ldmia sp!, {r4-r8, lr}" "\n"
+    "add sp, sp, #12" "\n"
+    "mov pc, lr" "\n"
+);
+
+asm volatile(
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "mov r0, sp" "\n"
+    "bl " SYMBOL_STRING(cti_vm_throw) "\n"
+
+// Both has the same return sequence
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "add sp, sp, #" STRINGIZE_VALUE_OF(PRESERVEDR4_OFFSET) "\n"
+    "ldmia sp!, {r4-r8, lr}" "\n"
+    "add sp, sp, #12" "\n"
+    "mov pc, lr" "\n"
+);
+
+#endif
+
 #if ENABLE(OPCODE_SAMPLING)
     #define CTI_SAMPLER stackFrame.globalData->interpreter->sampler()
 #else
@@ -673,24 +698,30 @@ extern "C" {
 
 JITThunks::JITThunks(JSGlobalData* globalData)
 {
-    JIT::compileCTIMachineTrampolines(globalData, &m_executablePool, &m_ctiStringLengthTrampoline, &m_ctiVirtualCallLink, &m_ctiVirtualCall, &m_ctiNativeCallThunk);
+    JIT::compileCTIMachineTrampolines(globalData, &m_executablePool, &m_trampolineStructure);
 
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
     // Unfortunate the arm compiler does not like the use of offsetof on JITStackFrame (since it contains non POD types),
     // and the OBJECT_OFFSETOF macro does not appear constantish enough for it to be happy with its use in COMPILE_ASSERT
     // macros.
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedReturnAddress) == 0x20);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR4) == 0x24);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR5) == 0x28);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR6) == 0x2c);
-
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, registerFile) == 0x30);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, callFrame) == 0x34);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, exception) == 0x38);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedReturnAddress) == PRESERVED_RETURN_ADDRESS_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR4) == PRESERVED_R4_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR5) == PRESERVED_R5_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR6) == PRESERVED_R6_OFFSET);
+
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, registerFile) == REGISTER_FILE_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, callFrame) == CALLFRAME_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, exception) == EXCEPTION_OFFSET);
     // The fifth argument is the first item already on the stack.
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, enabledProfilerReference) == 0x40);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, enabledProfilerReference) == ENABLE_PROFILER_REFERENCE_OFFSET);
+
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, thunkReturnAddress) == THUNK_RETURN_ADDRESS_OFFSET);
+
+#elif CPU(ARM_TRADITIONAL)
+
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, thunkReturnAddress) == THUNK_RETURN_ADDRESS_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR4) == PRESERVEDR4_OFFSET);
 
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, thunkReturnAddress) == 0x1C);
 #endif
 }
 
@@ -790,8 +821,10 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
     if (slot.slotBase() == baseValue) {
         // set this up, so derefStructures can do it's job.
         stubInfo->initGetByIdSelf(structure);
-
-        JIT::patchGetByIdSelf(codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
+        if (slot.cachedPropertyType() != PropertySlot::Value)
+            ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
+        else
+            JIT::patchGetByIdSelf(codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
         return;
     }
 
@@ -804,19 +837,25 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
         ASSERT(slot.slotBase().isObject());
 
         JSObject* slotBaseObject = asObject(slot.slotBase());
-
+        size_t offset = slot.cachedOffset();
+        
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
-        if (slotBaseObject->structure()->isDictionary())
-            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+        if (slotBaseObject->structure()->isDictionary()) {
+            slotBaseObject->flattenDictionaryObject();
+            offset = slotBaseObject->structure()->get(propertyName);
+        }
         
         stubInfo->initGetByIdProto(structure, slotBaseObject->structure());
 
-        JIT::compileGetByIdProto(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), slot.cachedOffset(), returnAddress);
+        ASSERT(!structure->isDictionary());
+        ASSERT(!slotBaseObject->structure()->isDictionary());
+        JIT::compileGetByIdProto(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), propertyName, slot, offset, returnAddress);
         return;
     }
 
-    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase());
+    size_t offset = slot.cachedOffset();
+    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset);
     if (!count) {
         stubInfo->accessType = access_get_by_id_generic;
         return;
@@ -824,7 +863,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
 
     StructureChain* prototypeChain = structure->prototypeChain(callFrame);
     stubInfo->initGetByIdChain(structure, prototypeChain);
-    JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, slot.cachedOffset(), returnAddress);
+    JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, propertyName, slot, offset, returnAddress);
 }
 
 #endif // ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
@@ -920,7 +959,7 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         } \
     } while (0)
 
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
 
 #define DEFINE_STUB_FUNCTION(rtype, op) \
     extern "C" { \
@@ -934,14 +973,14 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         ".thumb" "\n" \
         ".thumb_func " THUMB_FUNC_PARAM(cti_##op) "\n" \
         SYMBOL_STRING(cti_##op) ":" "\n" \
-        "str lr, [sp, #0x1c]" "\n" \
+        "str lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
         "bl " SYMBOL_STRING(JITStubThunked_##op) "\n" \
-        "ldr lr, [sp, #0x1c]" "\n" \
+        "ldr lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
         "bx lr" "\n" \
         ); \
     rtype JITStubThunked_##op(STUB_ARGS_DECLARATION) \
 
-#elif PLATFORM(ARM_TRADITIONAL) && COMPILER(GCC)
+#elif CPU(ARM_TRADITIONAL) && COMPILER(GCC)
 
 #define DEFINE_STUB_FUNCTION(rtype, op) \
     extern "C" { \
@@ -950,13 +989,39 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
     asm volatile ( \
         ".globl " SYMBOL_STRING(cti_##op) "\n" \
         SYMBOL_STRING(cti_##op) ":" "\n" \
-        "str lr, [sp, #32]" "\n" \
+        "str lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
         "bl " SYMBOL_STRING(JITStubThunked_##op) "\n" \
-        "ldr lr, [sp, #32]" "\n" \
+        "ldr lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
         "mov pc, lr" "\n" \
         ); \
     rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
 
+#elif CPU(ARM_TRADITIONAL) && COMPILER(RVCT)
+
+#define DEFINE_STUB_FUNCTION(rtype, op) rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
+
+/* The following is a workaround for RVCT toolchain; precompiler macros are not expanded before the code is passed to the assembler */
+
+/* The following section is a template to generate code for GeneratedJITStubs_RVCT.h */
+/* The pattern "#xxx#" will be replaced with "xxx" */
+
+/*
+RVCT(extern "C" #rtype# JITStubThunked_#op#(STUB_ARGS_DECLARATION);)
+RVCT(__asm #rtype# cti_#op#(STUB_ARGS_DECLARATION))
+RVCT({)
+RVCT(    ARM)
+RVCT(    IMPORT JITStubThunked_#op#)
+RVCT(    str lr, [sp, ##offset#])
+RVCT(    bl JITStubThunked_#op#)
+RVCT(    ldr lr, [sp, ##offset#])
+RVCT(    bx lr)
+RVCT(})
+RVCT()
+*/
+
+/* Include the generated file */
+#include "GeneratedJITStubs_RVCT.h"
+
 #else
 #define DEFINE_STUB_FUNCTION(rtype, op) rtype JIT_STUB cti_##op(STUB_ARGS_DECLARATION)
 #endif
@@ -988,38 +1053,19 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_add)
 
     JSValue v1 = stackFrame.args[0].jsValue();
     JSValue v2 = stackFrame.args[1].jsValue();
-
-    double left;
-    double right = 0.0;
-
-    bool rightIsNumber = v2.getNumber(right);
-    if (rightIsNumber && v1.getNumber(left))
-        return JSValue::encode(jsNumber(stackFrame.globalData, left + right));
-    
     CallFrame* callFrame = stackFrame.callFrame;
 
-    bool leftIsString = v1.isString();
-    if (leftIsString && v2.isString()) {
-        RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
-        if (UNLIKELY(!value)) {
-            throwOutOfMemoryError(callFrame);
-            VM_THROW_EXCEPTION();
-        }
-
-        return JSValue::encode(jsString(stackFrame.globalData, value.release()));
+    if (v1.isString()) {
+        JSValue result = v2.isString()
+            ? jsString(callFrame, asString(v1), asString(v2))
+            : jsString(callFrame, asString(v1), v2.toPrimitiveString(callFrame));
+        CHECK_FOR_EXCEPTION_AT_END();
+        return JSValue::encode(result);
     }
 
-    if (rightIsNumber & leftIsString) {
-        RefPtr<UString::Rep> value = v2.isInt32() ?
-            concatenate(asString(v1)->value().rep(), v2.asInt32()) :
-            concatenate(asString(v1)->value().rep(), right);
-
-        if (UNLIKELY(!value)) {
-            throwOutOfMemoryError(callFrame);
-            VM_THROW_EXCEPTION();
-        }
-        return JSValue::encode(jsString(stackFrame.globalData, value.release()));
-    }
+    double left = 0.0, right;
+    if (v1.getNumber(left) && v2.getNumber(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left + right));
 
     // All other cases are pretty uncommon
     JSValue result = jsAddSlowCase(callFrame, v1, v2);
@@ -1068,19 +1114,6 @@ DEFINE_STUB_FUNCTION(void, register_file_check)
     throwStackOverflowError(oldCallFrame, stackFrame.globalData, ReturnAddressPtr(oldCallFrame->returnPC()), STUB_RETURN_ADDRESS);
 }
 
-DEFINE_STUB_FUNCTION(int, op_loop_if_less)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    JSValue src1 = stackFrame.args[0].jsValue();
-    JSValue src2 = stackFrame.args[1].jsValue();
-    CallFrame* callFrame = stackFrame.callFrame;
-
-    bool result = jsLess(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
 DEFINE_STUB_FUNCTION(int, op_loop_if_lesseq)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -1197,7 +1230,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
     // If we successfully got something, then the base from which it is being accessed must
     // be an object.  (Assertion to ensure asObject() call below is safe, which comes after
     // an isCacheable() chceck.
-    ASSERT(!slot.isCacheable() || slot.slotBase().isObject());
+    ASSERT(!slot.isCacheableValue() || slot.slotBase().isObject());
 
     // Check that:
     //   * We're dealing with a JSCell,
@@ -1208,7 +1241,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
     JSCell* specific;
     JSObject* slotBaseObject;
     if (baseValue.isCell()
-        && slot.isCacheable()
+        && slot.isCacheableValue()
         && !(structure = asCell(baseValue)->structure())->isUncacheableDictionary()
         && (slotBaseObject = asObject(slot.slotBase()))->getPropertySpecificValue(callFrame, ident, specific)
         && specific
@@ -1219,7 +1252,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
         if (slotBaseObject->structure()->isDictionary())
-            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+            slotBaseObject->flattenDictionaryObject();
 
         // The result fetched should always be the callee!
         ASSERT(result == JSValue(callee));
@@ -1304,7 +1337,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
             stubInfo->u.getByIdSelfList.listSize++;
         }
 
-        JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), slot.cachedOffset());
+        JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), ident, slot, slot.cachedOffset());
 
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
             ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
@@ -1342,19 +1375,51 @@ static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(Str
     return prototypeStructureList;
 }
 
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_getter_stub)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    CallFrame* callFrame = stackFrame.callFrame;
+    GetterSetter* getterSetter = asGetterSetter(stackFrame.args[0].jsObject());
+    if (!getterSetter->getter())
+        return JSValue::encode(jsUndefined());
+    JSObject* getter = asObject(getterSetter->getter());
+    CallData callData;
+    CallType callType = getter->getCallData(callData);
+    JSValue result = call(callFrame, getter, callType, callData, stackFrame.args[1].jsObject(), ArgList());
+    if (callFrame->hadException())
+        returnToThrowTrampoline(&callFrame->globalData(), stackFrame.args[2].returnAddress(), STUB_RETURN_ADDRESS);
+
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_custom_stub)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSObject* slotBase = stackFrame.args[0].jsObject();
+    PropertySlot::GetValueFunc getter = reinterpret_cast<PropertySlot::GetValueFunc>(stackFrame.args[1].asPointer);
+    const Identifier& ident = stackFrame.args[2].identifier();
+    JSValue result = getter(callFrame, slotBase, ident);
+    if (callFrame->hadException())
+        returnToThrowTrampoline(&callFrame->globalData(), stackFrame.args[3].returnAddress(), STUB_RETURN_ADDRESS);
+    
+    return JSValue::encode(result);
+}
+
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
     CallFrame* callFrame = stackFrame.callFrame;
+    const Identifier& propertyName = stackFrame.args[1].identifier();
 
     JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
-    JSValue result = baseValue.get(callFrame, stackFrame.args[1].identifier(), slot);
+    JSValue result = baseValue.get(callFrame, propertyName, slot);
 
     CHECK_FOR_EXCEPTION();
 
-    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isUncacheableDictionary()) {
+    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isDictionary()) {
         ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
         return JSValue::encode(result);
     }
@@ -1365,28 +1430,34 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 
     ASSERT(slot.slotBase().isObject());
     JSObject* slotBaseObject = asObject(slot.slotBase());
+    
+    size_t offset = slot.cachedOffset();
 
     if (slot.slotBase() == baseValue)
         ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
     else if (slot.slotBase() == asCell(baseValue)->structure()->prototypeForLookup(callFrame)) {
+        ASSERT(!asCell(baseValue)->structure()->isDictionary());
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
-        if (slotBaseObject->structure()->isDictionary())
-            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+        if (slotBaseObject->structure()->isDictionary()) {
+            slotBaseObject->flattenDictionaryObject();
+            offset = slotBaseObject->structure()->get(propertyName);
+        }
 
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
 
-        JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), slot.cachedOffset());
+        JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), propertyName, slot, offset);
 
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
             ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
-    } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase())) {
+    } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset)) {
+        ASSERT(!asCell(baseValue)->structure()->isDictionary());
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
 
         StructureChain* protoChain = structure->prototypeChain(callFrame);
-        JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, slot.cachedOffset());
+        JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, propertyName, slot, offset);
 
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
             ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
@@ -1531,7 +1602,7 @@ DEFINE_STUB_FUNCTION(void*, op_call_JSFunction)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
     CallData callData;
     ASSERT(stackFrame.args[0].jsValue().getCallData(callData) == CallTypeJS);
 #endif
@@ -1780,7 +1851,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_construct_JSConstruct)
         VM_THROW_EXCEPTION();
     }
 
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
     ConstructData constructData;
     ASSERT(constructor->getConstructData(constructData) == ConstructTypeJS);
 #endif
@@ -1850,7 +1921,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val)
         } else if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i)) {
             // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
             ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val_string));
-            result = asString(baseValue)->getIndex(stackFrame.globalData, i);
+            result = asString(baseValue)->getIndex(callFrame, i);
         } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
             // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
             ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val_byte_array));
@@ -1881,7 +1952,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val_string)
     if (LIKELY(subscript.isUInt32())) {
         uint32_t i = subscript.asUInt32();
         if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
-            result = asString(baseValue)->getIndex(stackFrame.globalData, i);
+            result = asString(baseValue)->getIndex(callFrame, i);
         else {
             result = baseValue.get(callFrame, i);
             if (!isJSString(globalData, baseValue))
@@ -2046,19 +2117,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_lesseq)
     return JSValue::encode(result);
 }
 
-DEFINE_STUB_FUNCTION(int, op_loop_if_true)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    JSValue src1 = stackFrame.args[0].jsValue();
-
-    CallFrame* callFrame = stackFrame.callFrame;
-
-    bool result = src1.toBoolean(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-    
 DEFINE_STUB_FUNCTION(int, op_load_varargs)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2217,7 +2275,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_global)
     PropertySlot slot(globalObject);
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
+        if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
             GlobalResolveInfo& globalResolveInfo = callFrame->codeBlock()->globalResolveInfo(globalResolveInfoIndex);
             if (globalResolveInfo.structure)
                 globalResolveInfo.structure->deref();
@@ -2333,8 +2391,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_post_inc)
     return JSValue::encode(number);
 }
 
-#if USE(JSVALUE32_64)
-
 DEFINE_STUB_FUNCTION(int, op_eq)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2342,6 +2398,7 @@ DEFINE_STUB_FUNCTION(int, op_eq)
     JSValue src1 = stackFrame.args[0].jsValue();
     JSValue src2 = stackFrame.args[1].jsValue();
 
+#if USE(JSVALUE32_64)
     start:
     if (src2.isUndefined()) {
         return src1.isNull() || 
@@ -2397,20 +2454,20 @@ DEFINE_STUB_FUNCTION(int, op_eq)
 
     if (cell1->isString()) {
         if (src2.isInt32())
-            return static_cast<JSString*>(cell1)->value().toDouble() == src2.asInt32();
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == src2.asInt32();
             
         if (src2.isDouble())
-            return static_cast<JSString*>(cell1)->value().toDouble() == src2.asDouble();
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == src2.asDouble();
 
         if (src2.isTrue())
-            return static_cast<JSString*>(cell1)->value().toDouble() == 1.0;
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == 1.0;
 
         if (src2.isFalse())
-            return static_cast<JSString*>(cell1)->value().toDouble() == 0.0;
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == 0.0;
 
         JSCell* cell2 = asCell(src2);
         if (cell2->isString())
-            return static_cast<JSString*>(cell1)->value() == static_cast<JSString*>(cell2)->value();
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame) == static_cast<JSString*>(cell2)->value(stackFrame.callFrame);
 
         src2 = asObject(cell2)->toPrimitive(stackFrame.callFrame);
         CHECK_FOR_EXCEPTION();
@@ -2422,8 +2479,18 @@ DEFINE_STUB_FUNCTION(int, op_eq)
     src1 = asObject(cell1)->toPrimitive(stackFrame.callFrame);
     CHECK_FOR_EXCEPTION();
     goto start;
+    
+#else // USE(JSVALUE32_64)
+    CallFrame* callFrame = stackFrame.callFrame;
+    
+    bool result = JSValue::equalSlowCaseInline(callFrame, src1, src2);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+#endif // USE(JSVALUE32_64)
 }
 
+#if USE(JSVALUE32_64)
+
 DEFINE_STUB_FUNCTION(int, op_eq_strings)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2433,26 +2500,10 @@ DEFINE_STUB_FUNCTION(int, op_eq_strings)
 
     ASSERT(string1->isString());
     ASSERT(string2->isString());
-    return string1->value() == string2->value();
+    return string1->value(stackFrame.callFrame) == string2->value(stackFrame.callFrame);
 }
 
-#else // USE(JSVALUE32_64)
-
-DEFINE_STUB_FUNCTION(int, op_eq)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    JSValue src1 = stackFrame.args[0].jsValue();
-    JSValue src2 = stackFrame.args[1].jsValue();
-
-    CallFrame* callFrame = stackFrame.callFrame;
-
-    bool result = JSValue::equalSlowCaseInline(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-#endif // USE(JSVALUE32_64)
+#endif
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_lshift)
 {
@@ -2731,7 +2782,7 @@ DEFINE_STUB_FUNCTION(int, has_property)
 
     JSObject* base = stackFrame.args[0].jsObject();
     JSString* property = stackFrame.args[1].jsString();
-    return base->hasProperty(stackFrame.callFrame, Identifier(stackFrame.callFrame, property->value()));
+    return base->hasProperty(stackFrame.callFrame, Identifier(stackFrame.callFrame, property->value(stackFrame.callFrame)));
 }
 
 DEFINE_STUB_FUNCTION(JSObject*, op_push_scope)
@@ -2808,7 +2859,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_stricteq)
     JSValue src1 = stackFrame.args[0].jsValue();
     JSValue src2 = stackFrame.args[1].jsValue();
 
-    return JSValue::encode(jsBoolean(JSValue::strictEqual(src1, src2)));
+    return JSValue::encode(jsBoolean(JSValue::strictEqual(stackFrame.callFrame, src1, src2)));
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_primitive)
@@ -2822,7 +2873,9 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_strcat)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSValue::encode(concatenateStrings(stackFrame.callFrame, &stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32()));
+    JSValue result = jsString(stackFrame.callFrame, &stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32());
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_nstricteq)
@@ -2832,7 +2885,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_nstricteq)
     JSValue src1 = stackFrame.args[0].jsValue();
     JSValue src2 = stackFrame.args[1].jsValue();
 
-    return JSValue::encode(jsBoolean(!JSValue::strictEqual(src1, src2)));
+    return JSValue::encode(jsBoolean(!JSValue::strictEqual(stackFrame.callFrame, src1, src2)));
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_jsnumber)
@@ -2941,9 +2994,9 @@ DEFINE_STUB_FUNCTION(void*, op_switch_char)
     void* result = codeBlock->characterSwitchJumpTable(tableIndex).ctiDefault.executableAddress();
 
     if (scrutinee.isString()) {
-        UString::Rep* value = asString(scrutinee)->value().rep();
-        if (value->size() == 1)
-            result = codeBlock->characterSwitchJumpTable(tableIndex).ctiForValue(value->data()[0]).executableAddress();
+        UString::Rep* value = asString(scrutinee)->value(callFrame).rep();
+        if (value->length() == 1)
+            result = codeBlock->characterSwitchJumpTable(tableIndex).ctiForValue(value->characters()[0]).executableAddress();
     }
 
     return result;
@@ -2961,7 +3014,7 @@ DEFINE_STUB_FUNCTION(void*, op_switch_string)
     void* result = codeBlock->stringSwitchJumpTable(tableIndex).ctiDefault.executableAddress();
 
     if (scrutinee.isString()) {
-        UString::Rep* value = asString(scrutinee)->value().rep();
+        UString::Rep* value = asString(scrutinee)->value(callFrame).rep();
         result = codeBlock->stringSwitchJumpTable(tableIndex).ctiForValue(value).executableAddress();
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
index 69776cb337..dad4f121dc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
@@ -29,8 +29,6 @@
 #ifndef JITStubs_h
 #define JITStubs_h
 
-#include <wtf/Platform.h>
-
 #include "MacroAssemblerCodeRef.h"
 #include "Register.h"
 
@@ -74,8 +72,16 @@ namespace JSC {
         JSString* jsString() { return static_cast<JSString*>(asPointer); }
         ReturnAddressPtr returnAddress() { return ReturnAddressPtr(asPointer); }
     };
+    
+    struct TrampolineStructure {
+        MacroAssemblerCodePtr ctiStringLengthTrampoline;
+        MacroAssemblerCodePtr ctiVirtualCallLink;
+        MacroAssemblerCodePtr ctiVirtualCall;
+        MacroAssemblerCodePtr ctiNativeCallThunk;
+        MacroAssemblerCodePtr ctiSoftModulo;
+    };
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     struct JITStackFrame {
         void* reserved; // Unused
         JITStubArg args[6];
@@ -99,11 +105,11 @@ namespace JSC {
         // When JIT code makes a call, it pushes its return address just below the rest of the stack.
         ReturnAddressPtr* returnAddressSlot() { return reinterpret_cast<ReturnAddressPtr*>(this) - 1; }
     };
-#elif PLATFORM(X86)
-#if COMPILER(MSVC)
+#elif CPU(X86)
+#if COMPILER(MSVC) || (OS(WINDOWS) && COMPILER(GCC))
 #pragma pack(push)
 #pragma pack(4)
-#endif // COMPILER(MSVC)
+#endif // COMPILER(MSVC) || (OS(WINDOWS) && COMPILER(GCC))
     struct JITStackFrame {
         void* reserved; // Unused
         JITStubArg args[6];
@@ -127,10 +133,10 @@ namespace JSC {
         // When JIT code makes a call, it pushes its return address just below the rest of the stack.
         ReturnAddressPtr* returnAddressSlot() { return reinterpret_cast<ReturnAddressPtr*>(this) - 1; }
     };
-#if COMPILER(MSVC)
+#if COMPILER(MSVC) || (OS(WINDOWS) && COMPILER(GCC))
 #pragma pack(pop)
-#endif // COMPILER(MSVC)
-#elif PLATFORM(ARM_THUMB2)
+#endif // COMPILER(MSVC) || (OS(WINDOWS) && COMPILER(GCC))
+#elif CPU(ARM_THUMB2)
     struct JITStackFrame {
         void* reserved; // Unused
         JITStubArg args[6];
@@ -158,7 +164,7 @@ namespace JSC {
         
         ReturnAddressPtr* returnAddressSlot() { return &thunkReturnAddress; }
     };
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif CPU(ARM_TRADITIONAL)
     struct JITStackFrame {
         JITStubArg padding; // Unused
         JITStubArg args[7];
@@ -187,6 +193,8 @@ namespace JSC {
 #error "JITStackFrame not defined for this platform."
 #endif
 
+#define JITSTACKFRAME_ARGS_INDEX (OBJECT_OFFSETOF(JITStackFrame, args) / sizeof(void*))
+
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
     #define STUB_ARGS_DECLARATION void* args, ...
     #define STUB_ARGS (reinterpret_cast<void**>(vl_args) - 1)
@@ -200,16 +208,16 @@ namespace JSC {
     #define STUB_ARGS_DECLARATION void** args
     #define STUB_ARGS (args)
 
-    #if PLATFORM(X86) && COMPILER(MSVC)
+    #if CPU(X86) && COMPILER(MSVC)
     #define JIT_STUB __fastcall
-    #elif PLATFORM(X86) && COMPILER(GCC)
+    #elif CPU(X86) && COMPILER(GCC)
     #define JIT_STUB  __attribute__ ((fastcall))
     #else
     #define JIT_STUB
     #endif
 #endif
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     struct VoidPtrPair {
         void* first;
         void* second;
@@ -237,18 +245,16 @@ namespace JSC {
         static void tryCacheGetByID(CallFrame*, CodeBlock*, ReturnAddressPtr returnAddress, JSValue baseValue, const Identifier& propertyName, const PropertySlot&, StructureStubInfo* stubInfo);
         static void tryCachePutByID(CallFrame*, CodeBlock*, ReturnAddressPtr returnAddress, JSValue baseValue, const PutPropertySlot&, StructureStubInfo* stubInfo);
 
-        MacroAssemblerCodePtr ctiStringLengthTrampoline() { return m_ctiStringLengthTrampoline; }
-        MacroAssemblerCodePtr ctiVirtualCallLink() { return m_ctiVirtualCallLink; }
-        MacroAssemblerCodePtr ctiVirtualCall() { return m_ctiVirtualCall; }
-        MacroAssemblerCodePtr ctiNativeCallThunk() { return m_ctiNativeCallThunk; }
+        MacroAssemblerCodePtr ctiStringLengthTrampoline() { return m_trampolineStructure.ctiStringLengthTrampoline; }
+        MacroAssemblerCodePtr ctiVirtualCallLink() { return m_trampolineStructure.ctiVirtualCallLink; }
+        MacroAssemblerCodePtr ctiVirtualCall() { return m_trampolineStructure.ctiVirtualCall; }
+        MacroAssemblerCodePtr ctiNativeCallThunk() { return m_trampolineStructure.ctiNativeCallThunk; }
+        MacroAssemblerCodePtr ctiSoftModulo() { return m_trampolineStructure.ctiSoftModulo; }
 
     private:
         RefPtr<ExecutablePool> m_executablePool;
 
-        MacroAssemblerCodePtr m_ctiStringLengthTrampoline;
-        MacroAssemblerCodePtr m_ctiVirtualCallLink;
-        MacroAssemblerCodePtr m_ctiVirtualCall;
-        MacroAssemblerCodePtr m_ctiNativeCallThunk;
+        TrampolineStructure m_trampolineStructure;
     };
 
 extern "C" {
@@ -268,6 +274,8 @@ extern "C" {
     EncodedJSValue JIT_STUB cti_op_get_by_id_array_fail(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_generic(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_method_check(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_getter_stub(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_custom_stub(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_proto_fail(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list_full(STUB_ARGS_DECLARATION);
@@ -333,9 +341,7 @@ extern "C" {
     int JIT_STUB cti_op_jlesseq(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_jtrue(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_load_varargs(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_op_loop_if_less(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_loop_if_lesseq(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_op_loop_if_true(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_timeout_check(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_has_property(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_create_arguments(STUB_ARGS_DECLARATION);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
index b6bc0aad3f..252fb961c9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
@@ -37,7 +37,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#if !PLATFORM(WIN_OS)
+#if !OS(WINDOWS)
 #include <unistd.h>
 #endif
 
@@ -54,10 +54,10 @@
 #include <signal.h>
 #endif
 
-#if COMPILER(MSVC) && !PLATFORM(WINCE)
+#if COMPILER(MSVC) && !OS(WINCE)
 #include <crtdbg.h>
-#include <windows.h>
 #include <mmsystem.h>
+#include <windows.h>
 #endif
 
 #if PLATFORM(QT)
@@ -88,8 +88,8 @@ static JSValue JSC_HOST_CALL functionClearSamplingFlags(ExecState*, JSObject*, J
 
 struct Script {
     bool isFile;
-    char *argument;
-    
+    char* argument;
+
     Script(bool isFile, char *argument)
         : isFile(isFile)
         , argument(argument)
@@ -174,12 +174,12 @@ GlobalObject::GlobalObject(const Vector<UString>& arguments)
 JSValue JSC_HOST_CALL functionPrint(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     for (unsigned i = 0; i < args.size(); ++i) {
-        if (i != 0)
+        if (i)
             putchar(' ');
-        
+
         printf("%s", args.at(i).toString(exec).UTF8String().c_str());
     }
-    
+
     putchar('\n');
     fflush(stdout);
     return jsUndefined();
@@ -194,7 +194,7 @@ JSValue JSC_HOST_CALL functionDebug(ExecState* exec, JSObject*, JSValue, const A
 JSValue JSC_HOST_CALL functionGC(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     JSLock lock(SilenceAssertionsOnly);
-    exec->heap()->collect();
+    exec->heap()->collectAllGarbage();
     return jsUndefined();
 }
 
@@ -292,8 +292,18 @@ JSValue JSC_HOST_CALL functionReadline(ExecState* exec, JSObject*, JSValue, cons
 
 JSValue JSC_HOST_CALL functionQuit(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
+    // Technically, destroying the heap in the middle of JS execution is a no-no,
+    // but we want to maintain compatibility with the Mozilla test suite, so
+    // we pretend that execution has terminated to avoid ASSERTs, then tear down the heap.
+    exec->globalData().dynamicGlobalObject = 0;
+
     cleanupGlobalData(&exec->globalData());
     exit(EXIT_SUCCESS);
+
+#if COMPILER(MSVC) && OS(WINCE)
+    // Without this, Visual Studio will complain that this method does not return a value.
+    return jsUndefined();
+#endif
 }
 
 // Use SEH for Release builds only to get rid of the crash report dialog
@@ -313,7 +323,7 @@ int jscmain(int argc, char** argv, JSGlobalData*);
 
 int main(int argc, char** argv)
 {
-#if defined(_DEBUG) && PLATFORM(WIN_OS)
+#if defined(_DEBUG) && OS(WINDOWS)
     _CrtSetReportFile(_CRT_WARN, _CRTDBG_FILE_STDERR);
     _CrtSetReportMode(_CRT_WARN, _CRTDBG_MODE_FILE);
     _CrtSetReportFile(_CRT_ERROR, _CRTDBG_FILE_STDERR);
@@ -322,7 +332,7 @@ int main(int argc, char** argv)
     _CrtSetReportMode(_CRT_ASSERT, _CRTDBG_MODE_FILE);
 #endif
 
-#if COMPILER(MSVC) && !PLATFORM(WINCE)
+#if COMPILER(MSVC) && !OS(WINCE)
     timeBeginPeriod(1);
 #endif
 
@@ -463,30 +473,27 @@ static void parseArguments(int argc, char** argv, Options& options, JSGlobalData
     int i = 1;
     for (; i < argc; ++i) {
         const char* arg = argv[i];
-        if (strcmp(arg, "-f") == 0) {
+        if (!strcmp(arg, "-f")) {
             if (++i == argc)
                 printUsageStatement(globalData);
             options.scripts.append(Script(true, argv[i]));
             continue;
         }
-        if (strcmp(arg, "-e") == 0) {
+        if (!strcmp(arg, "-e")) {
             if (++i == argc)
                 printUsageStatement(globalData);
             options.scripts.append(Script(false, argv[i]));
             continue;
         }
-        if (strcmp(arg, "-h") == 0 || strcmp(arg, "--help") == 0) {
-            printUsageStatement(globalData, true);
-        }
-        if (strcmp(arg, "-i") == 0) {
+        if (!strcmp(arg, "-i")) {
             options.interactive = true;
             continue;
         }
-        if (strcmp(arg, "-d") == 0) {
+        if (!strcmp(arg, "-d")) {
             options.dump = true;
             continue;
         }
-        if (strcmp(arg, "-s") == 0) {
+        if (!strcmp(arg, "-s")) {
 #if HAVE(SIGNAL_H)
             signal(SIGILL, _exit);
             signal(SIGFPE, _exit);
@@ -495,16 +502,18 @@ static void parseArguments(int argc, char** argv, Options& options, JSGlobalData
 #endif
             continue;
         }
-        if (strcmp(arg, "--") == 0) {
+        if (!strcmp(arg, "--")) {
             ++i;
             break;
         }
+        if (!strcmp(arg, "-h") || !strcmp(arg, "--help"))
+            printUsageStatement(globalData, true);
         options.scripts.append(Script(true, argv[i]));
     }
-    
+
     if (options.scripts.isEmpty())
         options.interactive = true;
-    
+
     for (; i < argc; ++i)
         options.arguments.append(argv[i]);
 }
@@ -532,20 +541,20 @@ static bool fillBufferWithContentsOfFile(const UString& fileName, Vector<char>&
         return false;
     }
 
-    size_t buffer_size = 0;
-    size_t buffer_capacity = 1024;
+    size_t bufferSize = 0;
+    size_t bufferCapacity = 1024;
 
-    buffer.resize(buffer_capacity);
+    buffer.resize(bufferCapacity);
 
     while (!feof(f) && !ferror(f)) {
-        buffer_size += fread(buffer.data() + buffer_size, 1, buffer_capacity - buffer_size, f);
-        if (buffer_size == buffer_capacity) { // guarantees space for trailing '\0'
-            buffer_capacity *= 2;
-            buffer.resize(buffer_capacity);
+        bufferSize += fread(buffer.data() + bufferSize, 1, bufferCapacity - bufferSize, f);
+        if (bufferSize == bufferCapacity) { // guarantees space for trailing '\0'
+            bufferCapacity *= 2;
+            buffer.resize(bufferCapacity);
         }
     }
     fclose(f);
-    buffer[buffer_size] = '\0';
+    buffer[bufferSize] = '\0';
 
     return true;
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/os-win32/WinMain.cpp b/src/3rdparty/webkit/JavaScriptCore/os-win32/WinMain.cpp
new file mode 100644
index 0000000000..17800d0050
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/os-win32/WinMain.cpp
@@ -0,0 +1,81 @@
+/*
+ *  Copyright (C) 2009 Patrick Gansterer (paroga@paroga.com)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "Vector.h"
+#include <winbase.h>
+#include <winnls.h>
+#include <wtf/UnusedParam.h>
+
+int main(int argc, char** argv);
+
+static inline char* convertToUtf8(LPCWSTR widecharString, int length)
+{
+    int requiredSize = WideCharToMultiByte(CP_UTF8, 0, widecharString, length, 0, 0, 0, 0);
+    char* multibyteString = new char[requiredSize + 1];
+
+    WideCharToMultiByte(CP_UTF8, 0, widecharString, length, multibyteString, requiredSize, 0, 0);
+    multibyteString[requiredSize] = '\0';
+
+    return multibyteString;
+}
+
+int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int nCmdShow)
+{
+    UNUSED_PARAM(hInstance);
+    UNUSED_PARAM(hPrevInstance);
+    UNUSED_PARAM(nCmdShow);
+
+    Vector<char*> arguments;
+    TCHAR buffer[MAX_PATH];
+
+    int length = GetModuleFileNameW(0, buffer, MAX_PATH);
+    arguments.append(convertToUtf8(buffer, length));
+
+    WCHAR* commandLine = lpCmdLine;
+    while (commandLine[0] != '\0') {
+        int commandLineLength = 1;
+        WCHAR endChar = ' ';
+
+        while (commandLine[0] == ' ')
+            ++commandLine;
+
+        if (commandLine[0] == '\"') {
+            ++commandLine;
+            endChar = '\"';
+        }
+
+        while (commandLine[commandLineLength] != endChar && commandLine[commandLineLength] != '\0')
+            ++commandLineLength;
+
+        arguments.append(convertToUtf8(commandLine, commandLineLength));
+
+        commandLine += commandLineLength;
+        if (endChar != ' ' && commandLine[0] != '\0')
+            ++commandLine;
+    }
+
+    int res = main(arguments.size(), arguments.data());
+
+    for (size_t i = 0; i < arguments.size(); i++)
+        delete arguments[i];
+
+    return res;
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
index 6d953dfed1..4d6e7d1954 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
@@ -43,7 +43,7 @@
 // Default values for bison.
 #define YYDEBUG 0 // Set to 1 to debug a parse error.
 #define jscyydebug 0 // Set to 1 to debug a parse error.
-#if !PLATFORM(DARWIN)
+#if !OS(DARWIN)
 // Avoid triggering warnings in older bison by not setting this on the Darwin platform.
 // FIXME: Is this still needed?
 #define YYERROR_VERBOSE
@@ -1987,12 +1987,9 @@ static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData* globalData, co
 static ExpressionNode* makeNegateNode(JSGlobalData* globalData, ExpressionNode* n)
 {
     if (n->isNumber()) {
-        NumberNode* number = static_cast<NumberNode*>(n);
-
-        if (number->value() > 0.0) {
-            number->setValue(-number->value());
-            return number;
-        }
+        NumberNode* numberNode = static_cast<NumberNode*>(n);
+        numberNode->setValue(-numberNode->value());
+        return numberNode;
     }
 
     return new (globalData) NegateNode(globalData, n);
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
index df3083834f..83f56bd244 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
@@ -39,10 +39,7 @@ using namespace Unicode;
 // We can't specify the namespace in yacc's C output, so do it here instead.
 using namespace JSC;
 
-#ifndef KDE_USE_FINAL
 #include "Grammar.h"
-#endif
-
 #include "Lookup.h"
 #include "Lexer.lut.h"
 
@@ -642,6 +639,8 @@ inStringEscapeSequence:
         shiftLineTerminator();
         goto inString;
     }
+    if (m_current == -1)
+        goto returnError;
     record16(singleEscape(m_current));
     shift1();
     goto inString;
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
index 45009dce44..4b97e9aadb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
@@ -49,63 +49,6 @@ using namespace WTF;
 
 namespace JSC {
 
-/*
-    Details of the emitBytecode function.
-
-    Return value: The register holding the production's value.
-             dst: An optional parameter specifying the most efficient destination at
-                  which to store the production's value. The callee must honor dst.
-
-    The dst argument provides for a crude form of copy propagation. For example,
-
-        x = 1
-
-    becomes
-    
-        load r[x], 1
-    
-    instead of 
-
-        load r0, 1
-        mov r[x], r0
-    
-    because the assignment node, "x =", passes r[x] as dst to the number node, "1".
-*/
-
-// ------------------------------ ThrowableExpressionData --------------------------------
-
-static void substitute(UString& string, const UString& substring)
-{
-    int position = string.find("%s");
-    ASSERT(position != -1);
-    UString newString = string.substr(0, position);
-    newString.append(substring);
-    newString.append(string.substr(position + 2));
-    string = newString;
-}
-
-RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* message)
-{
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
-    generator.emitThrow(exception);
-    return exception;
-}
-
-RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const UString& label)
-{
-    UString message = messageTemplate;
-    substitute(message, label);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
-    generator.emitThrow(exception);
-    return exception;
-}
-
-inline RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const Identifier& label)
-{
-    return emitThrowError(generator, type, messageTemplate, label.ustring());
-}
 
 // ------------------------------ StatementNode --------------------------------
 
@@ -130,1753 +73,6 @@ inline StatementNode* SourceElements::singleStatement() const
     return size == 1 ? m_statements[0] : 0;
 }
 
-inline StatementNode* SourceElements::lastStatement() const
-{
-    size_t size = m_statements.size();
-    return size ? m_statements[size - 1] : 0;
-}
-
-// ------------------------------ NullNode -------------------------------------
-
-RegisterID* NullNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, jsNull());
-}
-
-// ------------------------------ BooleanNode ----------------------------------
-
-RegisterID* BooleanNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, m_value);
-}
-
-// ------------------------------ NumberNode -----------------------------------
-
-RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, m_value);
-}
-
-// ------------------------------ StringNode -----------------------------------
-
-RegisterID* StringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, m_value);
-}
-
-// ------------------------------ RegExpNode -----------------------------------
-
-RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegExp> regExp = RegExp::create(generator.globalData(), m_pattern.ustring(), m_flags.ustring());
-    if (!regExp->isValid())
-        return emitThrowError(generator, SyntaxError, "Invalid regular expression: %s", regExp->errorMessage());
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());
-}
-
-// ------------------------------ ThisNode -------------------------------------
-
-RegisterID* ThisNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.moveToDestinationIfNeeded(dst, generator.thisRegister());
-}
-
-// ------------------------------ ResolveNode ----------------------------------
-
-bool ResolveNode::isPure(BytecodeGenerator& generator) const
-{
-    return generator.isLocal(m_ident);
-}
-
-RegisterID* ResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (dst == generator.ignoredResult())
-            return 0;
-        return generator.moveToDestinationIfNeeded(dst, local);
-    }
-    
-    generator.emitExpressionInfo(m_startOffset + m_ident.size(), m_ident.size(), 0);
-    return generator.emitResolve(generator.finalDestination(dst), m_ident);
-}
-
-// ------------------------------ ArrayNode ------------------------------------
-
-RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    // FIXME: Should we put all of this code into emitNewArray?
-
-    unsigned length = 0;
-    ElementNode* firstPutElement;
-    for (firstPutElement = m_element; firstPutElement; firstPutElement = firstPutElement->next()) {
-        if (firstPutElement->elision())
-            break;
-        ++length;
-    }
-
-    if (!firstPutElement && !m_elision)
-        return generator.emitNewArray(generator.finalDestination(dst), m_element);
-
-    RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element);
-
-    for (ElementNode* n = firstPutElement; n; n = n->next()) {
-        RegisterID* value = generator.emitNode(n->value());
-        length += n->elision();
-        generator.emitPutByIndex(array.get(), length++, value);
-    }
-
-    if (m_elision) {
-        RegisterID* value = generator.emitLoad(0, jsNumber(generator.globalData(), m_elision + length));
-        generator.emitPutById(array.get(), generator.propertyNames().length, value);
-    }
-
-    return generator.moveToDestinationIfNeeded(dst, array.get());
-}
-
-bool ArrayNode::isSimpleArray() const
-{
-    if (m_elision || m_optional)
-        return false;
-    for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {
-        if (ptr->elision())
-            return false;
-    }
-    return true;
-}
-
-ArgumentListNode* ArrayNode::toArgumentList(JSGlobalData* globalData) const
-{
-    ASSERT(!m_elision && !m_optional);
-    ElementNode* ptr = m_element;
-    if (!ptr)
-        return 0;
-    ArgumentListNode* head = new (globalData) ArgumentListNode(globalData, ptr->value());
-    ArgumentListNode* tail = head;
-    ptr = ptr->next();
-    for (; ptr; ptr = ptr->next()) {
-        ASSERT(!ptr->elision());
-        tail = new (globalData) ArgumentListNode(globalData, tail, ptr->value());
-    }
-    return head;
-}
-
-// ------------------------------ ObjectLiteralNode ----------------------------
-
-RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-     if (!m_list) {
-         if (dst == generator.ignoredResult())
-             return 0;
-         return generator.emitNewObject(generator.finalDestination(dst));
-     }
-     return generator.emitNode(dst, m_list);
-}
-
-// ------------------------------ PropertyListNode -----------------------------
-
-RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> newObj = generator.tempDestination(dst);
-    
-    generator.emitNewObject(newObj.get());
-    
-    for (PropertyListNode* p = this; p; p = p->m_next) {
-        RegisterID* value = generator.emitNode(p->m_node->m_assign);
-        
-        switch (p->m_node->m_type) {
-            case PropertyNode::Constant: {
-                generator.emitPutById(newObj.get(), p->m_node->name(), value);
-                break;
-            }
-            case PropertyNode::Getter: {
-                generator.emitPutGetter(newObj.get(), p->m_node->name(), value);
-                break;
-            }
-            case PropertyNode::Setter: {
-                generator.emitPutSetter(newObj.get(), p->m_node->name(), value);
-                break;
-            }
-            default:
-                ASSERT_NOT_REACHED();
-        }
-    }
-    
-    return generator.moveToDestinationIfNeeded(dst, newObj.get());
-}
-
-// ------------------------------ BracketAccessorNode --------------------------------
-
-RegisterID* BracketAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments, m_subscript->isPure(generator));
-    RegisterID* property = generator.emitNode(m_subscript);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitGetByVal(generator.finalDestination(dst), base.get(), property);
-}
-
-// ------------------------------ DotAccessorNode --------------------------------
-
-RegisterID* DotAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RegisterID* base = generator.emitNode(m_base);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitGetById(generator.finalDestination(dst), base, m_ident);
-}
-
-// ------------------------------ ArgumentListNode -----------------------------
-
-RegisterID* ArgumentListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    ASSERT(m_expr);
-    return generator.emitNode(dst, m_expr);
-}
-
-// ------------------------------ NewExprNode ----------------------------------
-
-RegisterID* NewExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> func = generator.emitNode(m_expr);
-    return generator.emitConstruct(generator.finalDestination(dst), func.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ EvalFunctionCallNode ----------------------------------
-
-RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> func = generator.tempDestination(dst);
-    RefPtr<RegisterID> thisRegister = generator.newTemporary();
-    generator.emitExpressionInfo(divot() - startOffset() + 4, 4, 0);
-    generator.emitResolveWithBase(thisRegister.get(), func.get(), generator.propertyNames().eval);
-    return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallValueNode ----------------------------------
-
-RegisterID* FunctionCallValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> func = generator.emitNode(m_expr);
-    RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallResolveNode ----------------------------------
-
-RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
-        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-        return generator.emitCall(generator.finalDestination(dst, thisRegister.get()), local.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> func = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
-        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-        return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-
-    RefPtr<RegisterID> func = generator.newTemporary();
-    RefPtr<RegisterID> thisRegister = generator.newTemporary();
-    int identifierStart = divot() - startOffset();
-    generator.emitExpressionInfo(identifierStart + m_ident.size(), m_ident.size(), 0);
-    generator.emitResolveWithBase(thisRegister.get(), func.get(), m_ident);
-    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallBracketNode ----------------------------------
-
-RegisterID* FunctionCallBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RegisterID* property = generator.emitNode(m_subscript);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> function = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property);
-    RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallDotNode ----------------------------------
-
-RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> function = generator.tempDestination(dst);
-    RefPtr<RegisterID> thisRegister = generator.newTemporary();
-    generator.emitNode(thisRegister.get(), m_base);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    generator.emitMethodCheck();
-    generator.emitGetById(function.get(), thisRegister.get(), m_ident);
-    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-RegisterID* CallFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<Label> realCall = generator.newLabel();
-    RefPtr<Label> end = generator.newLabel();
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
-    generator.emitJumpIfNotFunctionCall(function.get(), realCall.get());
-    {
-        RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
-        RefPtr<RegisterID> thisRegister = generator.newTemporary();
-        ArgumentListNode* oldList = m_args->m_listNode;
-        if (m_args->m_listNode && m_args->m_listNode->m_expr) {
-            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
-            m_args->m_listNode = m_args->m_listNode->m_next;
-        } else
-            generator.emitLoad(thisRegister.get(), jsNull());
-
-        generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-        generator.emitJump(end.get());
-        m_args->m_listNode = oldList;
-    }
-    generator.emitLabel(realCall.get());
-    {
-        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-    generator.emitLabel(end.get());
-    return finalDestination.get();
-}
-    
-static bool areTrivialApplyArguments(ArgumentsNode* args)
-{
-    return !args->m_listNode || !args->m_listNode->m_expr || !args->m_listNode->m_next
-        || (!args->m_listNode->m_next->m_next && args->m_listNode->m_next->m_expr->isSimpleArray());
-}
-
-RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    // A few simple cases can be trivially handled as ordinary function calls.
-    // function.apply(), function.apply(arg) -> identical to function.call
-    // function.apply(thisArg, [arg0, arg1, ...]) -> can be trivially coerced into function.call(thisArg, arg0, arg1, ...) and saves object allocation
-    bool mayBeCall = areTrivialApplyArguments(m_args);
-
-    RefPtr<Label> realCall = generator.newLabel();
-    RefPtr<Label> end = generator.newLabel();
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
-    generator.emitJumpIfNotFunctionApply(function.get(), realCall.get());
-    {
-        if (mayBeCall) {
-            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
-            RefPtr<RegisterID> thisRegister = generator.newTemporary();
-            ArgumentListNode* oldList = m_args->m_listNode;
-            if (m_args->m_listNode && m_args->m_listNode->m_expr) {
-                generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
-                m_args->m_listNode = m_args->m_listNode->m_next;
-                if (m_args->m_listNode) {
-                    ASSERT(m_args->m_listNode->m_expr->isSimpleArray());
-                    ASSERT(!m_args->m_listNode->m_next);
-                    m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_expr)->toArgumentList(generator.globalData());
-                }
-            } else
-                generator.emitLoad(thisRegister.get(), jsNull());
-            generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-            m_args->m_listNode = oldList;
-        } else {
-            ASSERT(m_args->m_listNode && m_args->m_listNode->m_next);
-            RefPtr<RegisterID> realFunction = generator.emitMove(generator.newTemporary(), base.get());
-            RefPtr<RegisterID> argsCountRegister = generator.newTemporary();
-            RefPtr<RegisterID> thisRegister = generator.newTemporary();
-            RefPtr<RegisterID> argsRegister = generator.newTemporary();
-            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
-            ArgumentListNode* args = m_args->m_listNode->m_next;
-            bool isArgumentsApply = false;
-            if (args->m_expr->isResolveNode()) {
-                ResolveNode* resolveNode = static_cast<ResolveNode*>(args->m_expr);
-                isArgumentsApply = generator.willResolveToArguments(resolveNode->identifier());
-                if (isArgumentsApply)
-                    generator.emitMove(argsRegister.get(), generator.uncheckedRegisterForArguments());
-            }
-            if (!isArgumentsApply)
-                generator.emitNode(argsRegister.get(), args->m_expr);
-            while ((args = args->m_next))
-                generator.emitNode(args->m_expr);
-
-            generator.emitLoadVarargs(argsCountRegister.get(), argsRegister.get());
-            generator.emitCallVarargs(finalDestination.get(), realFunction.get(), thisRegister.get(), argsCountRegister.get(), divot(), startOffset(), endOffset());
-        }
-        generator.emitJump(end.get());
-    }
-    generator.emitLabel(realCall.get());
-    {
-        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-    generator.emitLabel(end.get());
-    return finalDestination.get();
-}
-
-// ------------------------------ PostfixResolveNode ----------------------------------
-
-static RegisterID* emitPreIncOrDec(BytecodeGenerator& generator, RegisterID* srcDst, Operator oper)
-{
-    return (oper == OpPlusPlus) ? generator.emitPreInc(srcDst) : generator.emitPreDec(srcDst);
-}
-
-static RegisterID* emitPostIncOrDec(BytecodeGenerator& generator, RegisterID* dst, RegisterID* srcDst, Operator oper)
-{
-    if (srcDst == dst)
-        return generator.emitToJSNumber(dst, srcDst);
-    return (oper == OpPlusPlus) ? generator.emitPostInc(dst, srcDst) : generator.emitPostDec(dst, srcDst);
-}
-
-RegisterID* PostfixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident)) {
-            if (dst == generator.ignoredResult())
-                return 0;
-            return generator.emitToJSNumber(generator.finalDestination(dst), local);
-        }
-
-        if (dst == generator.ignoredResult())
-            return emitPreIncOrDec(generator, local, m_operator);
-        return emitPostIncOrDec(generator, generator.finalDestination(dst), local, m_operator);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> value = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
-        RegisterID* oldValue;
-        if (dst == generator.ignoredResult()) {
-            oldValue = 0;
-            emitPreIncOrDec(generator, value.get(), m_operator);
-        } else {
-            oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
-        }
-        generator.emitPutScopedVar(depth, index, value.get(), globalObject);
-        return oldValue;
-    }
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RefPtr<RegisterID> value = generator.newTemporary();
-    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), value.get(), m_ident);
-    RegisterID* oldValue;
-    if (dst == generator.ignoredResult()) {
-        oldValue = 0;
-        emitPreIncOrDec(generator, value.get(), m_operator);
-    } else {
-        oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
-    }
-    generator.emitPutById(base.get(), m_ident, value.get());
-    return oldValue;
-}
-
-// ------------------------------ PostfixBracketNode ----------------------------------
-
-RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
-    RegisterID* oldValue;
-    if (dst == generator.ignoredResult()) {
-        oldValue = 0;
-        if (m_operator == OpPlusPlus)
-            generator.emitPreInc(value.get());
-        else
-            generator.emitPreDec(value.get());
-    } else {
-        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
-    }
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), value.get());
-    return oldValue;
-}
-
-// ------------------------------ PostfixDotNode ----------------------------------
-
-RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);
-    RegisterID* oldValue;
-    if (dst == generator.ignoredResult()) {
-        oldValue = 0;
-        if (m_operator == OpPlusPlus)
-            generator.emitPreInc(value.get());
-        else
-            generator.emitPreDec(value.get());
-    } else {
-        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
-    }
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutById(base.get(), m_ident, value.get());
-    return oldValue;
-}
-
-// ------------------------------ PostfixErrorNode -----------------------------------
-
-RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
-        ? "Postfix ++ operator applied to value that is not a reference."
-        : "Postfix -- operator applied to value that is not a reference.");
-}
-
-// ------------------------------ DeleteResolveNode -----------------------------------
-
-RegisterID* DeleteResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (generator.registerFor(m_ident))
-        return generator.emitLoad(generator.finalDestination(dst), false);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* base = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
-    return generator.emitDeleteById(generator.finalDestination(dst, base), base, m_ident);
-}
-
-// ------------------------------ DeleteBracketNode -----------------------------------
-
-RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> r0 = generator.emitNode(m_base);
-    RegisterID* r1 = generator.emitNode(m_subscript);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitDeleteByVal(generator.finalDestination(dst), r0.get(), r1);
-}
-
-// ------------------------------ DeleteDotNode -----------------------------------
-
-RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RegisterID* r0 = generator.emitNode(m_base);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitDeleteById(generator.finalDestination(dst), r0, m_ident);
-}
-
-// ------------------------------ DeleteValueNode -----------------------------------
-
-RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitNode(generator.ignoredResult(), m_expr);
-
-    // delete on a non-location expression ignores the value and returns true
-    return generator.emitLoad(generator.finalDestination(dst), true);
-}
-
-// ------------------------------ VoidNode -------------------------------------
-
-RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult()) {
-        generator.emitNode(generator.ignoredResult(), m_expr);
-        return 0;
-    }
-    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
-    return generator.emitLoad(dst, jsUndefined());
-}
-
-// ------------------------------ TypeOfValueNode -----------------------------------
-
-RegisterID* TypeOfResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (dst == generator.ignoredResult())
-            return 0;
-        return generator.emitTypeOf(generator.finalDestination(dst), local);
-    }
-
-    RefPtr<RegisterID> scratch = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
-    generator.emitGetById(scratch.get(), scratch.get(), m_ident);
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitTypeOf(generator.finalDestination(dst, scratch.get()), scratch.get());
-}
-
-// ------------------------------ TypeOfValueNode -----------------------------------
-
-RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult()) {
-        generator.emitNode(generator.ignoredResult(), m_expr);
-        return 0;
-    }
-    RefPtr<RegisterID> src = generator.emitNode(m_expr);
-    return generator.emitTypeOf(generator.finalDestination(dst), src.get());
-}
-
-// ------------------------------ PrefixResolveNode ----------------------------------
-
-RegisterID* PrefixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident)) {
-            if (dst == generator.ignoredResult())
-                return 0;
-            RefPtr<RegisterID> r0 = generator.emitLoad(generator.finalDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
-            return generator.emitBinaryOp(op_add, r0.get(), local, r0.get(), OperandTypes());
-        }
-
-        emitPreIncOrDec(generator, local, m_operator);
-        return generator.moveToDestinationIfNeeded(dst, local);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> propDst = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
-        emitPreIncOrDec(generator, propDst.get(), m_operator);
-        generator.emitPutScopedVar(depth, index, propDst.get(), globalObject);
-        return generator.moveToDestinationIfNeeded(dst, propDst.get());
-    }
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
-    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), propDst.get(), m_ident);
-    emitPreIncOrDec(generator, propDst.get(), m_operator);
-    generator.emitPutById(base.get(), m_ident, propDst.get());
-    return generator.moveToDestinationIfNeeded(dst, propDst.get());
-}
-
-// ------------------------------ PrefixBracketNode ----------------------------------
-
-RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
-    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
-
-    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
-    RegisterID* value = generator.emitGetByVal(propDst.get(), base.get(), property.get());
-    if (m_operator == OpPlusPlus)
-        generator.emitPreInc(value);
-    else
-        generator.emitPreDec(value);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), value);
-    return generator.moveToDestinationIfNeeded(dst, propDst.get());
-}
-
-// ------------------------------ PrefixDotNode ----------------------------------
-
-RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
-
-    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
-    RegisterID* value = generator.emitGetById(propDst.get(), base.get(), m_ident);
-    if (m_operator == OpPlusPlus)
-        generator.emitPreInc(value);
-    else
-        generator.emitPreDec(value);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutById(base.get(), m_ident, value);
-    return generator.moveToDestinationIfNeeded(dst, propDst.get());
-}
-
-// ------------------------------ PrefixErrorNode -----------------------------------
-
-RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
-        ? "Prefix ++ operator applied to value that is not a reference."
-        : "Prefix -- operator applied to value that is not a reference.");
-}
-
-// ------------------------------ Unary Operation Nodes -----------------------------------
-
-RegisterID* UnaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RegisterID* src = generator.emitNode(m_expr);
-    return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src);
-}
-
-// ------------------------------ Binary Operation Nodes -----------------------------------
-
-// BinaryOpNode::emitStrcat:
-//
-// This node generates an op_strcat operation.  This opcode can handle concatenation of three or
-// more values, where we can determine a set of separate op_add operations would be operating on
-// string values.
-//
-// This function expects to be operating on a graph of AST nodes looking something like this:
-//
-//     (a)...     (b)
-//          \   /
-//           (+)     (c)
-//              \   /
-//      [d]     ((+))
-//         \    /
-//          [+=]
-//
-// The assignment operation is optional, if it exists the register holding the value on the
-// lefthand side of the assignment should be passing as the optional 'lhs' argument.
-//
-// The method should be called on the node at the root of the tree of regular binary add
-// operations (marked in the diagram with a double set of parentheses).  This node must
-// be performing a string concatenation (determined by statically detecting that at least
-// one child must be a string).  
-//
-// Since the minimum number of values being concatenated together is expected to be 3, if
-// a lhs to a concatenating assignment is not provided then the  root add should have at
-// least one left child that is also an add that can be determined to be operating on strings.
-//
-RegisterID* BinaryOpNode::emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs, ReadModifyResolveNode* emitExpressionInfoForMe)
-{
-    ASSERT(isAdd());
-    ASSERT(resultDescriptor().definitelyIsString());
-
-    // Create a list of expressions for all the adds in the tree of nodes we can convert into
-    // a string concatenation.  The rightmost node (c) is added first.  The rightmost node is
-    // added first, and the leftmost child is never added, so the vector produced for the
-    // example above will be [ c, b ].
-    Vector<ExpressionNode*, 16> reverseExpressionList;
-    reverseExpressionList.append(m_expr2);
-
-    // Examine the left child of the add.  So long as this is a string add, add its right-child
-    // to the list, and keep processing along the left fork.
-    ExpressionNode* leftMostAddChild = m_expr1;
-    while (leftMostAddChild->isAdd() && leftMostAddChild->resultDescriptor().definitelyIsString()) {
-        reverseExpressionList.append(static_cast<AddNode*>(leftMostAddChild)->m_expr2);
-        leftMostAddChild = static_cast<AddNode*>(leftMostAddChild)->m_expr1;
-    }
-
-    Vector<RefPtr<RegisterID>, 16> temporaryRegisters;
-
-    // If there is an assignment, allocate a temporary to hold the lhs after conversion.
-    // We could possibly avoid this (the lhs is converted last anyway, we could let the
-    // op_strcat node handle its conversion if required).
-    if (lhs)
-        temporaryRegisters.append(generator.newTemporary());
-
-    // Emit code for the leftmost node ((a) in the example).
-    temporaryRegisters.append(generator.newTemporary());
-    RegisterID* leftMostAddChildTempRegister = temporaryRegisters.last().get();
-    generator.emitNode(leftMostAddChildTempRegister, leftMostAddChild);
-
-    // Note on ordering of conversions:
-    //
-    // We maintain the same ordering of conversions as we would see if the concatenations
-    // was performed as a sequence of adds (otherwise this optimization could change
-    // behaviour should an object have been provided a valueOf or toString method).
-    //
-    // Considering the above example, the sequnce of execution is:
-    //     * evaluate operand (a)
-    //     * evaluate operand (b)
-    //     * convert (a) to primitive   <-  (this would be triggered by the first add)
-    //     * convert (b) to primitive   <-  (ditto)
-    //     * evaluate operand (c)
-    //     * convert (c) to primitive   <-  (this would be triggered by the second add)
-    // And optionally, if there is an assignment:
-    //     * convert (d) to primitive   <-  (this would be triggered by the assigning addition)
-    //
-    // As such we do not plant an op to convert the leftmost child now.  Instead, use
-    // 'leftMostAddChildTempRegister' as a flag to trigger generation of the conversion
-    // once the second node has been generated.  However, if the leftmost child is an
-    // immediate we can trivially determine that no conversion will be required.
-    // If this is the case
-    if (leftMostAddChild->isString())
-        leftMostAddChildTempRegister = 0;
-
-    while (reverseExpressionList.size()) {
-        ExpressionNode* node = reverseExpressionList.last();
-        reverseExpressionList.removeLast();
-
-        // Emit the code for the current node.
-        temporaryRegisters.append(generator.newTemporary());
-        generator.emitNode(temporaryRegisters.last().get(), node);
-
-        // On the first iteration of this loop, when we first reach this point we have just
-        // generated the second node, which means it is time to convert the leftmost operand.
-        if (leftMostAddChildTempRegister) {
-            generator.emitToPrimitive(leftMostAddChildTempRegister, leftMostAddChildTempRegister);
-            leftMostAddChildTempRegister = 0; // Only do this once.
-        }
-        // Plant a conversion for this node, if necessary.
-        if (!node->isString())
-            generator.emitToPrimitive(temporaryRegisters.last().get(), temporaryRegisters.last().get());
-    }
-    ASSERT(temporaryRegisters.size() >= 3);
-
-    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
-    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
-    if (emitExpressionInfoForMe)
-        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
-
-    // If there is an assignment convert the lhs now.  This will also copy lhs to
-    // the temporary register we allocated for it.
-    if (lhs)
-        generator.emitToPrimitive(temporaryRegisters[0].get(), lhs);
-
-    return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());
-}
-
-RegisterID* BinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    OpcodeID opcodeID = this->opcodeID();
-
-    if (opcodeID == op_add && m_expr1->isAdd() && m_expr1->resultDescriptor().definitelyIsString())
-        return emitStrcat(generator, dst);
-
-    if (opcodeID == op_neq) {
-        if (m_expr1->isNull() || m_expr2->isNull()) {
-            RefPtr<RegisterID> src = generator.tempDestination(dst);
-            generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
-            return generator.emitUnaryOp(op_neq_null, generator.finalDestination(dst, src.get()), src.get());
-        }
-    }
-
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitBinaryOp(opcodeID, generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
-}
-
-RegisterID* EqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_expr1->isNull() || m_expr2->isNull()) {
-        RefPtr<RegisterID> src = generator.tempDestination(dst);
-        generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
-        return generator.emitUnaryOp(op_eq_null, generator.finalDestination(dst, src.get()), src.get());
-    }
-
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitEqualityOp(op_eq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
-}
-
-RegisterID* StrictEqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitEqualityOp(op_stricteq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
-}
-
-RegisterID* ReverseBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src2, src1.get(), OperandTypes(m_expr2->resultDescriptor(), m_expr1->resultDescriptor()));
-}
-
-RegisterID* ThrowableBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
-}
-
-RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RefPtr<RegisterID> src2 = generator.emitNode(m_expr2);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitGetByIdExceptionInfo(op_instanceof);
-    RegisterID* src2Prototype = generator.emitGetById(generator.newTemporary(), src2.get(), generator.globalData()->propertyNames->prototype);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitInstanceOf(generator.finalDestination(dst, src1.get()), src1.get(), src2.get(), src2Prototype);
-}
-
-// ------------------------------ LogicalOpNode ----------------------------
-
-RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> temp = generator.tempDestination(dst);
-    RefPtr<Label> target = generator.newLabel();
-    
-    generator.emitNode(temp.get(), m_expr1);
-    if (m_operator == OpLogicalAnd)
-        generator.emitJumpIfFalse(temp.get(), target.get());
-    else
-        generator.emitJumpIfTrue(temp.get(), target.get());
-    generator.emitNode(temp.get(), m_expr2);
-    generator.emitLabel(target.get());
-
-    return generator.moveToDestinationIfNeeded(dst, temp.get());
-}
-
-// ------------------------------ ConditionalNode ------------------------------
-
-RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> newDst = generator.finalDestination(dst);
-    RefPtr<Label> beforeElse = generator.newLabel();
-    RefPtr<Label> afterElse = generator.newLabel();
-
-    RegisterID* cond = generator.emitNode(m_logical);
-    generator.emitJumpIfFalse(cond, beforeElse.get());
-
-    generator.emitNode(newDst.get(), m_expr1);
-    generator.emitJump(afterElse.get());
-
-    generator.emitLabel(beforeElse.get());
-    generator.emitNode(newDst.get(), m_expr2);
-
-    generator.emitLabel(afterElse.get());
-
-    return newDst.get();
-}
-
-// ------------------------------ ReadModifyResolveNode -----------------------------------
-
-// FIXME: should this be moved to be a method on BytecodeGenerator?
-static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, ExpressionNode* m_right, Operator oper, OperandTypes types, ReadModifyResolveNode* emitExpressionInfoForMe = 0)
-{
-    OpcodeID opcodeID;
-    switch (oper) {
-        case OpMultEq:
-            opcodeID = op_mul;
-            break;
-        case OpDivEq:
-            opcodeID = op_div;
-            break;
-        case OpPlusEq:
-            if (m_right->isAdd() && m_right->resultDescriptor().definitelyIsString())
-                return static_cast<AddNode*>(m_right)->emitStrcat(generator, dst, src1, emitExpressionInfoForMe);
-            opcodeID = op_add;
-            break;
-        case OpMinusEq:
-            opcodeID = op_sub;
-            break;
-        case OpLShift:
-            opcodeID = op_lshift;
-            break;
-        case OpRShift:
-            opcodeID = op_rshift;
-            break;
-        case OpURShift:
-            opcodeID = op_urshift;
-            break;
-        case OpAndEq:
-            opcodeID = op_bitand;
-            break;
-        case OpXOrEq:
-            opcodeID = op_bitxor;
-            break;
-        case OpOrEq:
-            opcodeID = op_bitor;
-            break;
-        case OpModEq:
-            opcodeID = op_mod;
-            break;
-        default:
-            ASSERT_NOT_REACHED();
-            return dst;
-    }
-
-    RegisterID* src2 = generator.emitNode(m_right);
-
-    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
-    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
-    if (emitExpressionInfoForMe)
-        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
-
-    return generator.emitBinaryOp(opcodeID, dst, src1, src2, types);
-}
-
-RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident)) {
-            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-        }
-        
-        if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
-            RefPtr<RegisterID> result = generator.newTemporary();
-            generator.emitMove(result.get(), local);
-            emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-            generator.emitMove(local, result.get());
-            return generator.moveToDestinationIfNeeded(dst, result.get());
-        }
-        
-        RegisterID* result = emitReadModifyAssignment(generator, local, local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-        return generator.moveToDestinationIfNeeded(dst, result);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> src1 = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
-        RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-        generator.emitPutScopedVar(depth, index, result, globalObject);
-        return result;
-    }
-
-    RefPtr<RegisterID> src1 = generator.tempDestination(dst);
-    generator.emitExpressionInfo(divot() - startOffset() + m_ident.size(), m_ident.size(), 0);
-    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), src1.get(), m_ident);
-    RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()), this);
-    return generator.emitPutById(base.get(), m_ident, result);
-}
-
-// ------------------------------ AssignResolveNode -----------------------------------
-
-RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident))
-            return generator.emitNode(dst, m_right);
-        
-        RegisterID* result = generator.emitNode(local, m_right);
-        return generator.moveToDestinationIfNeeded(dst, result);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
-        if (dst == generator.ignoredResult())
-            dst = 0;
-        RegisterID* value = generator.emitNode(dst, m_right);
-        generator.emitPutScopedVar(depth, index, value, globalObject);
-        return value;
-    }
-
-    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    RegisterID* value = generator.emitNode(dst, m_right);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitPutById(base.get(), m_ident, value);
-}
-
-// ------------------------------ AssignDotNode -----------------------------------
-
-RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
-    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
-    RegisterID* result = generator.emitNode(value.get(), m_right);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutById(base.get(), m_ident, result);
-    return generator.moveToDestinationIfNeeded(dst, result);
-}
-
-// ------------------------------ ReadModifyDotNode -----------------------------------
-
-RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitPutById(base.get(), m_ident, updatedValue);
-}
-
-// ------------------------------ AssignErrorNode -----------------------------------
-
-RegisterID* AssignErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    return emitThrowError(generator, ReferenceError, "Left side of assignment is not a reference.");
-}
-
-// ------------------------------ AssignBracketNode -----------------------------------
-
-RegisterID* AssignBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
-    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
-    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
-    RegisterID* result = generator.emitNode(value.get(), m_right);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), result);
-    return generator.moveToDestinationIfNeeded(dst, result);
-}
-
-// ------------------------------ ReadModifyBracketNode -----------------------------------
-
-RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
-    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
-    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), updatedValue);
-
-    return updatedValue;
-}
-
-// ------------------------------ CommaNode ------------------------------------
-
-RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    ASSERT(m_expressions.size() > 1);
-    for (size_t i = 0; i < m_expressions.size() - 1; i++)
-        generator.emitNode(generator.ignoredResult(), m_expressions[i]);
-    return generator.emitNode(dst, m_expressions.last());
-}
-
-// ------------------------------ ConstDeclNode ------------------------------------
-
-RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator& generator)
-{
-    if (RegisterID* local = generator.constRegisterFor(m_ident)) {
-        if (!m_init)
-            return local;
-
-        return generator.emitNode(local, m_init);
-    }
-
-    if (generator.codeType() != EvalCode) {
-        if (m_init)
-            return generator.emitNode(m_init);
-        else
-            return generator.emitResolve(generator.newTemporary(), m_ident);
-    }
-    // FIXME: While this code should only be hit in eval code, it will potentially
-    // assign to the wrong base if m_ident exists in an intervening dynamic scope.
-    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
-    RegisterID* value = m_init ? generator.emitNode(m_init) : generator.emitLoad(0, jsUndefined());
-    return generator.emitPutById(base.get(), m_ident, value);
-}
-
-RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    RegisterID* result = 0;
-    for (ConstDeclNode* n = this; n; n = n->m_next)
-        result = n->emitCodeSingle(generator);
-
-    return result;
-}
-
-// ------------------------------ ConstStatementNode -----------------------------
-
-RegisterID* ConstStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    return generator.emitNode(m_next);
-}
-
-// ------------------------------ SourceElements -------------------------------
-
-inline void SourceElements::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    size_t size = m_statements.size();
-    for (size_t i = 0; i < size; ++i)
-        generator.emitNode(dst, m_statements[i]);
-}
-
-// ------------------------------ BlockNode ------------------------------------
-
-inline StatementNode* BlockNode::lastStatement() const
-{
-    return m_statements ? m_statements->lastStatement() : 0;
-}
-
-RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_statements)
-        m_statements->emitBytecode(generator, dst);
-    return 0;
-}
-
-// ------------------------------ EmptyStatementNode ---------------------------
-
-RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    return dst;
-}
-
-// ------------------------------ DebuggerStatementNode ---------------------------
-
-RegisterID* DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(DidReachBreakpoint, firstLine(), lastLine());
-    return dst;
-}
-
-// ------------------------------ ExprStatementNode ----------------------------
-
-RegisterID* ExprStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    ASSERT(m_expr);
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine()); 
-    return generator.emitNode(dst, m_expr);
-}
-
-// ------------------------------ VarStatementNode ----------------------------
-
-RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    ASSERT(m_expr);
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    return generator.emitNode(m_expr);
-}
-
-// ------------------------------ IfNode ---------------------------------------
-
-RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<Label> afterThen = generator.newLabel();
-
-    RegisterID* cond = generator.emitNode(m_condition);
-    generator.emitJumpIfFalse(cond, afterThen.get());
-
-    generator.emitNode(dst, m_ifBlock);
-    generator.emitLabel(afterThen.get());
-
-    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
-    return 0;
-}
-
-// ------------------------------ IfElseNode ---------------------------------------
-
-RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<Label> beforeElse = generator.newLabel();
-    RefPtr<Label> afterElse = generator.newLabel();
-
-    RegisterID* cond = generator.emitNode(m_condition);
-    generator.emitJumpIfFalse(cond, beforeElse.get());
-
-    generator.emitNode(dst, m_ifBlock);
-    generator.emitJump(afterElse.get());
-
-    generator.emitLabel(beforeElse.get());
-
-    generator.emitNode(dst, m_elseBlock);
-
-    generator.emitLabel(afterElse.get());
-
-    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
-    return 0;
-}
-
-// ------------------------------ DoWhileNode ----------------------------------
-
-RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    RefPtr<Label> topOfLoop = generator.newLabel();
-    generator.emitLabel(topOfLoop.get());
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-   
-    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
-    RegisterID* cond = generator.emitNode(m_expr);
-    generator.emitJumpIfTrue(cond, topOfLoop.get());
-
-    generator.emitLabel(scope->breakTarget());
-    return result.get();
-}
-
-// ------------------------------ WhileNode ------------------------------------
-
-RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    generator.emitJump(scope->continueTarget());
-
-    RefPtr<Label> topOfLoop = generator.newLabel();
-    generator.emitLabel(topOfLoop.get());
-    
-    generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
-    RegisterID* cond = generator.emitNode(m_expr);
-    generator.emitJumpIfTrue(cond, topOfLoop.get());
-
-    generator.emitLabel(scope->breakTarget());
-    
-    // FIXME: This should return the last statement executed so that it can be returned as a Completion
-    return 0;
-}
-
-// ------------------------------ ForNode --------------------------------------
-
-RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (m_expr1)
-        generator.emitNode(generator.ignoredResult(), m_expr1);
-
-    RefPtr<Label> condition = generator.newLabel();
-    generator.emitJump(condition.get());
-
-    RefPtr<Label> topOfLoop = generator.newLabel();
-    generator.emitLabel(topOfLoop.get());
-
-    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    if (m_expr3)
-        generator.emitNode(generator.ignoredResult(), m_expr3);
-
-    generator.emitLabel(condition.get());
-    if (m_expr2) {
-        RegisterID* cond = generator.emitNode(m_expr2);
-        generator.emitJumpIfTrue(cond, topOfLoop.get());
-    } else
-        generator.emitJump(topOfLoop.get());
-
-    generator.emitLabel(scope->breakTarget());
-    return result.get();
-}
-
-// ------------------------------ ForInNode ------------------------------------
-
-RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    if (!m_lexpr->isLocation())
-        return emitThrowError(generator, ReferenceError, "Left side of for-in statement is not a reference.");
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (m_init)
-        generator.emitNode(generator.ignoredResult(), m_init);
-
-    RefPtr<RegisterID> base = generator.newTemporary();
-    generator.emitNode(base.get(), m_expr);
-    RefPtr<RegisterID> i = generator.newTemporary();
-    RefPtr<RegisterID> size = generator.newTemporary();
-    RefPtr<RegisterID> expectedSubscript;
-    RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), base.get(), i.get(), size.get(), scope->breakTarget());
-    generator.emitJump(scope->continueTarget());
-
-    RefPtr<Label> loopStart = generator.newLabel();
-    generator.emitLabel(loopStart.get());
-
-    RegisterID* propertyName;
-    bool optimizedForinAccess = false;
-    if (m_lexpr->isResolveNode()) {
-        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
-        propertyName = generator.registerFor(ident);
-        if (!propertyName) {
-            propertyName = generator.newTemporary();
-            RefPtr<RegisterID> protect = propertyName;
-            RegisterID* base = generator.emitResolveBase(generator.newTemporary(), ident);
-
-            generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-            generator.emitPutById(base, ident, propertyName);
-        } else {
-            expectedSubscript = generator.emitMove(generator.newTemporary(), propertyName);
-            generator.pushOptimisedForIn(expectedSubscript.get(), iter.get(), i.get(), propertyName);
-            optimizedForinAccess = true;
-        }
-    } else if (m_lexpr->isDotAccessorNode()) {
-        DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
-        const Identifier& ident = assignNode->identifier();
-        propertyName = generator.newTemporary();
-        RefPtr<RegisterID> protect = propertyName;
-        RegisterID* base = generator.emitNode(assignNode->base());
-
-        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
-        generator.emitPutById(base, ident, propertyName);
-    } else {
-        ASSERT(m_lexpr->isBracketAccessorNode());
-        BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr);
-        propertyName = generator.newTemporary();
-        RefPtr<RegisterID> protect = propertyName;
-        RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
-        RegisterID* subscript = generator.emitNode(assignNode->subscript());
-        
-        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
-        generator.emitPutByVal(base.get(), subscript, propertyName);
-    }   
-
-    generator.emitNode(dst, m_statement);
-
-    if (optimizedForinAccess)
-        generator.popOptimisedForIn();
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitNextPropertyName(propertyName, base.get(), i.get(), size.get(), iter.get(), loopStart.get());
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    generator.emitLabel(scope->breakTarget());
-    return dst;
-}
-
-// ------------------------------ ContinueNode ---------------------------------
-
-// ECMA 12.7
-RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    LabelScope* scope = generator.continueTarget(m_ident);
-
-    if (!scope)
-        return m_ident.isEmpty()
-            ? emitThrowError(generator, SyntaxError, "Invalid continue statement.")
-            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
-
-    generator.emitJumpScopes(scope->continueTarget(), scope->scopeDepth());
-    return dst;
-}
-
-// ------------------------------ BreakNode ------------------------------------
-
-// ECMA 12.8
-RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    LabelScope* scope = generator.breakTarget(m_ident);
-    
-    if (!scope)
-        return m_ident.isEmpty()
-            ? emitThrowError(generator, SyntaxError, "Invalid break statement.")
-            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
-
-    generator.emitJumpScopes(scope->breakTarget(), scope->scopeDepth());
-    return dst;
-}
-
-// ------------------------------ ReturnNode -----------------------------------
-
-RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    if (generator.codeType() != FunctionCode)
-        return emitThrowError(generator, SyntaxError, "Invalid return statement.");
-
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    RegisterID* r0 = m_value ? generator.emitNode(dst, m_value) : generator.emitLoad(dst, jsUndefined());
-    RefPtr<RegisterID> returnRegister;
-    if (generator.scopeDepth()) {
-        RefPtr<Label> l0 = generator.newLabel();
-        if (generator.hasFinaliser() && !r0->isTemporary()) {
-            returnRegister = generator.emitMove(generator.newTemporary(), r0);
-            r0 = returnRegister.get();
-        }
-        generator.emitJumpScopes(l0.get(), 0);
-        generator.emitLabel(l0.get());
-    }
-    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
-    return generator.emitReturn(r0);
-}
-
-// ------------------------------ WithNode -------------------------------------
-
-RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<RegisterID> scope = generator.newTemporary();
-    generator.emitNode(scope.get(), m_expr); // scope must be protected until popped
-    generator.emitExpressionInfo(m_divot, m_expressionLength, 0);
-    generator.emitPushScope(scope.get());
-    RegisterID* result = generator.emitNode(dst, m_statement);
-    generator.emitPopScope();
-    return result;
-}
-
-// ------------------------------ CaseClauseNode --------------------------------
-
-inline void CaseClauseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_statements)
-        m_statements->emitBytecode(generator, dst);
-}
-
-// ------------------------------ CaseBlockNode --------------------------------
-
-enum SwitchKind { 
-    SwitchUnset = 0,
-    SwitchNumber = 1, 
-    SwitchString = 2, 
-    SwitchNeither = 3 
-};
-
-static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>& literalVector, SwitchKind& typeForTable, bool& singleCharacterSwitch, int32_t& min_num, int32_t& max_num)
-{
-    for (; list; list = list->getNext()) {
-        ExpressionNode* clauseExpression = list->getClause()->expr();
-        literalVector.append(clauseExpression);
-        if (clauseExpression->isNumber()) {
-            double value = static_cast<NumberNode*>(clauseExpression)->value();
-            int32_t intVal = static_cast<int32_t>(value);
-            if ((typeForTable & ~SwitchNumber) || (intVal != value)) {
-                typeForTable = SwitchNeither;
-                break;
-            }
-            if (intVal < min_num)
-                min_num = intVal;
-            if (intVal > max_num)
-                max_num = intVal;
-            typeForTable = SwitchNumber;
-            continue;
-        }
-        if (clauseExpression->isString()) {
-            if (typeForTable & ~SwitchString) {
-                typeForTable = SwitchNeither;
-                break;
-            }
-            const UString& value = static_cast<StringNode*>(clauseExpression)->value().ustring();
-            if (singleCharacterSwitch &= value.size() == 1) {
-                int32_t intVal = value.rep()->data()[0];
-                if (intVal < min_num)
-                    min_num = intVal;
-                if (intVal > max_num)
-                    max_num = intVal;
-            }
-            typeForTable = SwitchString;
-            continue;
-        }
-        typeForTable = SwitchNeither;
-        break;        
-    }
-}
-    
-SwitchInfo::SwitchType CaseBlockNode::tryOptimizedSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num)
-{
-    SwitchKind typeForTable = SwitchUnset;
-    bool singleCharacterSwitch = true;
-    
-    processClauseList(m_list1, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
-    processClauseList(m_list2, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
-    
-    if (typeForTable == SwitchUnset || typeForTable == SwitchNeither)
-        return SwitchInfo::SwitchNone;
-    
-    if (typeForTable == SwitchNumber) {
-        int32_t range = max_num - min_num;
-        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
-            return SwitchInfo::SwitchImmediate;
-        return SwitchInfo::SwitchNone;
-    } 
-    
-    ASSERT(typeForTable == SwitchString);
-    
-    if (singleCharacterSwitch) {
-        int32_t range = max_num - min_num;
-        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
-            return SwitchInfo::SwitchCharacter;
-    }
-
-    return SwitchInfo::SwitchString;
-}
-
-RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, RegisterID* switchExpression, RegisterID* dst)
-{
-    RefPtr<Label> defaultLabel;
-    Vector<RefPtr<Label>, 8> labelVector;
-    Vector<ExpressionNode*, 8> literalVector;
-    int32_t min_num = std::numeric_limits<int32_t>::max();
-    int32_t max_num = std::numeric_limits<int32_t>::min();
-    SwitchInfo::SwitchType switchType = tryOptimizedSwitch(literalVector, min_num, max_num);
-
-    if (switchType != SwitchInfo::SwitchNone) {
-        // Prepare the various labels
-        for (uint32_t i = 0; i < literalVector.size(); i++)
-            labelVector.append(generator.newLabel());
-        defaultLabel = generator.newLabel();
-        generator.beginSwitch(switchExpression, switchType);
-    } else {
-        // Setup jumps
-        for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
-            RefPtr<RegisterID> clauseVal = generator.newTemporary();
-            generator.emitNode(clauseVal.get(), list->getClause()->expr());
-            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
-            labelVector.append(generator.newLabel());
-            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
-        }
-        
-        for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
-            RefPtr<RegisterID> clauseVal = generator.newTemporary();
-            generator.emitNode(clauseVal.get(), list->getClause()->expr());
-            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
-            labelVector.append(generator.newLabel());
-            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
-        }
-        defaultLabel = generator.newLabel();
-        generator.emitJump(defaultLabel.get());
-    }
-
-    RegisterID* result = 0;
-
-    size_t i = 0;
-    for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
-        generator.emitLabel(labelVector[i++].get());
-        list->getClause()->emitBytecode(generator, dst);
-    }
-
-    if (m_defaultClause) {
-        generator.emitLabel(defaultLabel.get());
-        m_defaultClause->emitBytecode(generator, dst);
-    }
-
-    for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
-        generator.emitLabel(labelVector[i++].get());
-        list->getClause()->emitBytecode(generator, dst);
-    }
-    if (!m_defaultClause)
-        generator.emitLabel(defaultLabel.get());
-
-    ASSERT(i == labelVector.size());
-    if (switchType != SwitchInfo::SwitchNone) {
-        ASSERT(labelVector.size() == literalVector.size());
-        generator.endSwitch(labelVector.size(), labelVector.data(), literalVector.data(), defaultLabel.get(), min_num, max_num);
-    }
-    return result;
-}
-
-// ------------------------------ SwitchNode -----------------------------------
-
-RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Switch);
-
-    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
-    RegisterID* r1 = m_block->emitBytecodeForBlock(generator, r0.get(), dst);
-
-    generator.emitLabel(scope->breakTarget());
-    return r1;
-}
-
-// ------------------------------ LabelNode ------------------------------------
-
-RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (generator.breakTarget(m_name))
-        return emitThrowError(generator, SyntaxError, "Duplicate label: %s.", m_name);
-
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::NamedLabel, &m_name);
-    RegisterID* r0 = generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->breakTarget());
-    return r0;
-}
-
-// ------------------------------ ThrowNode ------------------------------------
-
-RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    RefPtr<RegisterID> expr = generator.emitNode(m_expr);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitThrow(expr.get());
-    return 0;
-}
-
-// ------------------------------ TryNode --------------------------------------
-
-RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    // NOTE: The catch and finally blocks must be labeled explicitly, so the
-    // optimizer knows they may be jumped to from anywhere.
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    RefPtr<Label> tryStartLabel = generator.newLabel();
-    RefPtr<Label> finallyStart;
-    RefPtr<RegisterID> finallyReturnAddr;
-    if (m_finallyBlock) {
-        finallyStart = generator.newLabel();
-        finallyReturnAddr = generator.newTemporary();
-        generator.pushFinallyContext(finallyStart.get(), finallyReturnAddr.get());
-    }
-
-    generator.emitLabel(tryStartLabel.get());
-    generator.emitNode(dst, m_tryBlock);
-
-    if (m_catchBlock) {
-        RefPtr<Label> catchEndLabel = generator.newLabel();
-        
-        // Normal path: jump over the catch block.
-        generator.emitJump(catchEndLabel.get());
-
-        // Uncaught exception path: the catch block.
-        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
-        RefPtr<RegisterID> exceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
-        if (m_catchHasEval) {
-            RefPtr<RegisterID> dynamicScopeObject = generator.emitNewObject(generator.newTemporary());
-            generator.emitPutById(dynamicScopeObject.get(), m_exceptionIdent, exceptionRegister.get());
-            generator.emitMove(exceptionRegister.get(), dynamicScopeObject.get());
-            generator.emitPushScope(exceptionRegister.get());
-        } else
-            generator.emitPushNewScope(exceptionRegister.get(), m_exceptionIdent, exceptionRegister.get());
-        generator.emitNode(dst, m_catchBlock);
-        generator.emitPopScope();
-        generator.emitLabel(catchEndLabel.get());
-    }
-
-    if (m_finallyBlock) {
-        generator.popFinallyContext();
-        // there may be important registers live at the time we jump
-        // to a finally block (such as for a return or throw) so we
-        // ref the highest register ever used as a conservative
-        // approach to not clobbering anything important
-        RefPtr<RegisterID> highestUsedRegister = generator.highestUsedRegister();
-        RefPtr<Label> finallyEndLabel = generator.newLabel();
-
-        // Normal path: invoke the finally block, then jump over it.
-        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
-        generator.emitJump(finallyEndLabel.get());
-
-        // Uncaught exception path: invoke the finally block, then re-throw the exception.
-        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
-        RefPtr<RegisterID> tempExceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
-        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
-        generator.emitThrow(tempExceptionRegister.get());
-
-        // The finally block.
-        generator.emitLabel(finallyStart.get());
-        generator.emitNode(dst, m_finallyBlock);
-        generator.emitSubroutineReturn(finallyReturnAddr.get());
-
-        generator.emitLabel(finallyEndLabel.get());
-    }
-
-    return dst;
-}
-
 // -----------------------------ScopeNodeData ---------------------------
 
 ScopeNodeData::ScopeNodeData(ParserArena& arena, SourceElements* statements, VarStack* varStack, FunctionStack* funcStack, int numConstants)
@@ -1908,12 +104,6 @@ ScopeNode::ScopeNode(JSGlobalData* globalData, const SourceCode& source, SourceE
 {
 }
 
-inline void ScopeNode::emitStatementsBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_data->m_statements)
-        m_data->m_statements->emitBytecode(generator, dst);
-}
-
 StatementNode* ScopeNode::singleStatement() const
 {
     return m_data->m_statements ? m_data->m_statements->singleStatement() : 0;
@@ -1937,19 +127,6 @@ PassRefPtr<ProgramNode> ProgramNode::create(JSGlobalData* globalData, SourceElem
     return node.release();
 }
 
-RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
-
-    RefPtr<RegisterID> dstRegister = generator.newTemporary();
-    generator.emitLoad(dstRegister.get(), jsUndefined());
-    emitStatementsBytecode(generator, dstRegister.get());
-
-    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
-    generator.emitEnd(dstRegister.get());
-    return 0;
-}
-
 // ------------------------------ EvalNode -----------------------------
 
 inline EvalNode::EvalNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
@@ -1968,19 +145,6 @@ PassRefPtr<EvalNode> EvalNode::create(JSGlobalData* globalData, SourceElements*
     return node.release();
 }
 
-RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
-
-    RefPtr<RegisterID> dstRegister = generator.newTemporary();
-    generator.emitLoad(dstRegister.get(), jsUndefined());
-    emitStatementsBytecode(generator, dstRegister.get());
-
-    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
-    generator.emitEnd(dstRegister.get());
-    return 0;
-}
-
 // ------------------------------ FunctionBodyNode -----------------------------
 
 FunctionParameters::FunctionParameters(ParameterNode* firstParameter)
@@ -2028,37 +192,4 @@ PassRefPtr<FunctionBodyNode> FunctionBodyNode::create(JSGlobalData* globalData,
     return node.release();
 }
 
-RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
-    emitStatementsBytecode(generator, generator.ignoredResult());
-    StatementNode* singleStatement = this->singleStatement();
-    if (singleStatement && singleStatement->isBlock()) {
-        StatementNode* lastStatementInBlock = static_cast<BlockNode*>(singleStatement)->lastStatement();
-        if (lastStatementInBlock && lastStatementInBlock->isReturnNode())
-            return 0;
-    }
-
-    RegisterID* r0 = generator.emitLoad(0, jsUndefined());
-    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
-    generator.emitReturn(r0);
-    return 0;
-}
-
-// ------------------------------ FuncDeclNode ---------------------------------
-
-RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    return dst;
-}
-
-// ------------------------------ FuncExprNode ---------------------------------
-
-RegisterID* FuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    return generator.emitNewFunctionExpression(generator.finalDestination(dst), this);
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
index be84c4a1b1..78521657fc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
@@ -40,6 +40,7 @@ namespace JSC {
     class ArgumentListNode;
     class BytecodeGenerator;
     class FunctionBodyNode;
+    class Label;
     class PropertyListNode;
     class ReadModifyResolveNode;
     class RegisterID;
@@ -151,6 +152,9 @@ namespace JSC {
         virtual bool isCommaNode() const { return false; }
         virtual bool isSimpleArray() const { return false; }
         virtual bool isAdd() const { return false; }
+        virtual bool hasConditionContextCodegen() const { return false; }
+
+        virtual void emitBytecodeInConditionContext(BytecodeGenerator&, Label*, Label*, bool) { ASSERT_NOT_REACHED(); }
 
         virtual ExpressionNode* stripUnaryPlus() { return this; }
 
@@ -757,6 +761,7 @@ namespace JSC {
 
     protected:
         ExpressionNode* expr() { return m_expr; }
+        const ExpressionNode* expr() const { return m_expr; }
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -788,6 +793,9 @@ namespace JSC {
     class LogicalNotNode : public UnaryOpNode {
     public:
         LogicalNotNode(JSGlobalData*, ExpressionNode*);
+    private:
+        void emitBytecodeInConditionContext(BytecodeGenerator&, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue);
+        virtual bool hasConditionContextCodegen() const { return expr()->hasConditionContextCodegen(); }
     };
 
     class BinaryOpNode : public ExpressionNode {
@@ -952,6 +960,8 @@ namespace JSC {
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+        void emitBytecodeInConditionContext(BytecodeGenerator&, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue);
+        virtual bool hasConditionContextCodegen() const { return true; }
 
         ExpressionNode* m_expr1;
         ExpressionNode* m_expr2;
@@ -1375,12 +1385,6 @@ namespace JSC {
 
         using ParserArenaRefCounted::operator new;
 
-        void adoptData(std::auto_ptr<ScopeNodeData> data)
-        {
-            ASSERT(!data->m_arena.contains(this));
-            ASSERT(!m_data);
-            m_data.adopt(data);
-        }
         ScopeNodeData* data() const { return m_data.get(); }
         void destroyData() { m_data.clear(); }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
index 4c046d0627..039fc46fec 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
@@ -27,9 +27,6 @@
 #include "Lexer.h"
 #include <wtf/HashSet.h>
 #include <wtf/Vector.h>
-#include <memory>
-
-using std::auto_ptr;
 
 #ifndef yyparse
 extern int jscyyparse(void*);
@@ -50,7 +47,7 @@ void Parser::parse(JSGlobalData* globalData, int* errLine, UString* errMsg)
         errMsg = &defaultErrMsg;
 
     *errLine = -1;
-    *errMsg = 0;
+    *errMsg = UString();
 
     Lexer& lexer = *globalData->lexer;
     lexer.setCode(*m_source, m_arena);
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/dftables b/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
index 1f0ea01df1..669b948ffc 100755
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
@@ -269,4 +269,5 @@ sub readHeaderValues()
     
     eval $content;
     die "$@" if $@;
+    unlink $tempFile;
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre.pri b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre.pri
index c33c67ce97..4f59e17f4d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre.pri
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre.pri
@@ -3,8 +3,6 @@ VPATH += $$PWD
 INCLUDEPATH += $$PWD $$OUTPUT_DIR/JavaScriptCore/tmp
 DEPENDPATH += $$PWD
 
-isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
-
 SOURCES += \
     pcre_compile.cpp \
     pcre_exec.cpp \
@@ -12,24 +10,3 @@ SOURCES += \
     pcre_ucp_searchfuncs.cpp \
     pcre_xclass.cpp
 
-!CONFIG(QTDIR_build) {
-    defineTest(addExtraCompiler) {
-        QMAKE_EXTRA_COMPILERS += $$1
-        generated_files.depends += compiler_$${1}_make_all
-        export(QMAKE_EXTRA_COMPILERS)
-        export(generated_files.depends)
-        return(true)
-    }
-}
-
-# GENERATOR: "chartables.c": compile and execute the chartables generator (and add it to sources)
-win32-msvc*|wince*: PREPROCESSOR = "--preprocessor=\"$$QMAKE_CC /E\""
-DFTABLES = $$PWD/dftables
-ctgen.input = DFTABLES
-ctgen.output = $$GENERATED_SOURCES_DIR/chartables.c
-ctgen.commands = perl $$DFTABLES ${QMAKE_FILE_OUT} $$PREPROCESSOR
-ctgen.CONFIG += target_predeps no_link
-ctgen.variable_out = GENERATED_SOURCES
-ctgen.dependency_type = TYPE_C
-ctgen.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR}${QMAKE_FILE_BASE}
-addExtraCompiler(ctgen)
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp
index 16619d427f..8ca2eb4b79 100644
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp
@@ -2164,14 +2164,14 @@ void Histogram::add(const JSRegExp* re, double elapsedTime)
 
 HistogramTimeLogger::HistogramTimeLogger(const JSRegExp* re)
     : m_re(re)
-    , m_startTime(getCurrentUTCTimeWithMicroseconds())
+    , m_startTime(currentTimeMS())
 {
 }
 
 HistogramTimeLogger::~HistogramTimeLogger()
 {
     static Histogram histogram;
-    histogram.add(m_re, getCurrentUTCTimeWithMicroseconds() - m_startTime);
+    histogram.add(m_re, currentTimeMS() - m_startTime);
 }
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp
deleted file mode 100644
index e69de29bb2..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp
+++ /dev/null
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h b/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h
deleted file mode 100644
index e69de29bb2..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h
+++ /dev/null
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp
index de75e71c61..c90f9b0b31 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp
@@ -42,7 +42,7 @@ Profile::Profile(const UString& title, unsigned uid)
 {
     // FIXME: When multi-threading is supported this will be a vector and calls
     // into the profiler will need to know which thread it is executing on.
-    m_head = ProfileNode::create(CallIdentifier("Thread_1", 0, 0), 0, 0);
+    m_head = ProfileNode::create(CallIdentifier("Thread_1", UString(), 0), 0, 0);
 }
 
 Profile::~Profile()
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
index dc68ecb0af..f3670335a6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
@@ -63,7 +63,7 @@ void ProfileGenerator::addParentForConsoleStart(ExecState* exec)
     JSValue function;
 
     exec->interpreter()->retrieveLastCaller(exec, lineNumber, sourceID, sourceURL, function);
-    m_currentNode = ProfileNode::create(Profiler::createCallIdentifier(&exec->globalData(), function ? function.toThisObject(exec) : 0, sourceURL, lineNumber), m_head.get(), m_head.get());
+    m_currentNode = ProfileNode::create(Profiler::createCallIdentifier(exec, function ? function.toThisObject(exec) : 0, sourceURL, lineNumber), m_head.get(), m_head.get());
     m_head->insertNode(m_currentNode.get());
 }
 
@@ -124,7 +124,7 @@ void ProfileGenerator::stopProfiling()
     m_currentNode = m_currentNode->parent();
 
    if (double headSelfTime = m_head->selfTime()) {
-        RefPtr<ProfileNode> idleNode = ProfileNode::create(CallIdentifier(NonJSExecution, 0, 0), m_head.get(), m_head.get());
+        RefPtr<ProfileNode> idleNode = ProfileNode::create(CallIdentifier(NonJSExecution, UString(), 0), m_head.get(), m_head.get());
 
         idleNode->setTotalTime(headSelfTime);
         idleNode->setSelfTime(headSelfTime);
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp
index 19050aa0c6..fb126b3feb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp
@@ -33,15 +33,17 @@
 #include <stdio.h>
 #include <wtf/DateMath.h>
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #include <windows.h>
 #endif
 
+using namespace WTF;
+
 namespace JSC {
 
 static double getCount()
 {
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
     static LARGE_INTEGER frequency = {0};
     if (!frequency.QuadPart)
         QueryPerformanceFrequency(&frequency);
@@ -49,7 +51,7 @@ static double getCount()
     QueryPerformanceCounter(&counter);
     return static_cast<double>(counter.QuadPart) / frequency.QuadPart;
 #else
-    return WTF::getCurrentUTCTimeWithMicroseconds();
+    return currentTimeMS();
 #endif
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
index 6f72e08174..fe8727a4bf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
@@ -46,7 +46,7 @@ static const char* GlobalCodeExecution = "(program)";
 static const char* AnonymousFunction = "(anonymous function)";
 static unsigned ProfilesUID = 0;
 
-static CallIdentifier createCallIdentifierFromFunctionImp(JSGlobalData*, JSFunction*);
+static CallIdentifier createCallIdentifierFromFunctionImp(ExecState*, JSFunction*);
 
 Profiler* Profiler::s_sharedProfiler = 0;
 Profiler* Profiler::s_sharedEnabledProfilerReference = 0;
@@ -109,14 +109,14 @@ void Profiler::willExecute(ExecState* exec, JSValue function)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::willExecute, createCallIdentifier(&exec->globalData(), function, "", 0), exec->lexicalGlobalObject()->profileGroup());
+    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::willExecute, createCallIdentifier(exec, function, "", 0), exec->lexicalGlobalObject()->profileGroup());
 }
 
 void Profiler::willExecute(ExecState* exec, const UString& sourceURL, int startingLineNumber)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    CallIdentifier callIdentifier = createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber);
+    CallIdentifier callIdentifier = createCallIdentifier(exec, JSValue(), sourceURL, startingLineNumber);
 
     dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::willExecute, callIdentifier, exec->lexicalGlobalObject()->profileGroup());
 }
@@ -125,17 +125,17 @@ void Profiler::didExecute(ExecState* exec, JSValue function)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), function, "", 0), exec->lexicalGlobalObject()->profileGroup());
+    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(exec, function, "", 0), exec->lexicalGlobalObject()->profileGroup());
 }
 
 void Profiler::didExecute(ExecState* exec, const UString& sourceURL, int startingLineNumber)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
+    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(exec, JSValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
 }
 
-CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValue functionValue, const UString& defaultSourceURL, int defaultLineNumber)
+CallIdentifier Profiler::createCallIdentifier(ExecState* exec, JSValue functionValue, const UString& defaultSourceURL, int defaultLineNumber)
 {
     if (!functionValue)
         return CallIdentifier(GlobalCodeExecution, defaultSourceURL, defaultLineNumber);
@@ -144,17 +144,17 @@ CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValue
     if (asObject(functionValue)->inherits(&JSFunction::info)) {
         JSFunction* function = asFunction(functionValue);
         if (!function->executable()->isHostFunction())
-            return createCallIdentifierFromFunctionImp(globalData, function);
+            return createCallIdentifierFromFunctionImp(exec, function);
     }
     if (asObject(functionValue)->inherits(&InternalFunction::info))
-        return CallIdentifier(static_cast<InternalFunction*>(asObject(functionValue))->name(globalData), defaultSourceURL, defaultLineNumber);
-    return CallIdentifier("(" + asObject(functionValue)->className() + " object)", defaultSourceURL, defaultLineNumber);
+        return CallIdentifier(static_cast<InternalFunction*>(asObject(functionValue))->name(exec), defaultSourceURL, defaultLineNumber);
+    return CallIdentifier(makeString("(", asObject(functionValue)->className(), " object)"), defaultSourceURL, defaultLineNumber);
 }
 
-CallIdentifier createCallIdentifierFromFunctionImp(JSGlobalData* globalData, JSFunction* function)
+CallIdentifier createCallIdentifierFromFunctionImp(ExecState* exec, JSFunction* function)
 {
     ASSERT(!function->isHostFunction());
-    const UString& name = function->calculatedDisplayName(globalData);
+    const UString& name = function->calculatedDisplayName(exec);
     return CallIdentifier(name.isEmpty() ? AnonymousFunction : name, function->jsExecutable()->sourceURL(), function->jsExecutable()->lineNo());
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
index 21621bfd65..4b8b4a019f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
@@ -52,7 +52,7 @@ namespace JSC {
         }
 
         static Profiler* profiler(); 
-        static CallIdentifier createCallIdentifier(JSGlobalData*, JSValue, const UString& sourceURL, int lineNumber);
+        static CallIdentifier createCallIdentifier(ExecState* exec, JSValue, const UString& sourceURL, int lineNumber);
 
         void startProfiling(ExecState*, const UString& title);
         PassRefPtr<Profile> stopProfiling(ExecState*, const UString& title);
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp
deleted file mode 100644
index e69de29bb2..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp
+++ /dev/null
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.h b/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.h
deleted file mode 100644
index e69de29bb2..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.h
+++ /dev/null
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/QtScript.pro b/src/3rdparty/webkit/JavaScriptCore/qt/api/QtScript.pro
new file mode 100644
index 0000000000..88629c79f6
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/QtScript.pro
@@ -0,0 +1,46 @@
+TARGET     = QtScript
+TEMPLATE   = lib
+QT         = core
+
+INCLUDEPATH += $$PWD
+
+CONFIG += building-libs
+
+isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = ../../generated
+CONFIG(debug, debug|release) {
+    OBJECTS_DIR = obj/debug
+} else { # Release
+    OBJECTS_DIR = obj/release
+}
+
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../..
+include($$PWD/../../../WebKit.pri)
+
+include($$PWD/../../JavaScriptCore.pri)
+addJavaScriptCoreLib(../..)
+
+INCLUDEPATH += $$PWD/../../API
+
+SOURCES +=  $$PWD/qscriptengine.cpp \
+            $$PWD/qscriptengine_p.cpp \
+            $$PWD/qscriptvalue.cpp \
+            $$PWD/qscriptstring.cpp \
+            $$PWD/qscriptprogram.cpp \
+            $$PWD/qscriptsyntaxcheckresult.cpp \
+
+HEADERS +=  $$PWD/qtscriptglobal.h \
+            $$PWD/qscriptengine.h \
+            $$PWD/qscriptengine_p.h \
+            $$PWD/qscriptvalue.h \
+            $$PWD/qscriptvalue_p.h \
+            $$PWD/qscriptconverter_p.h \
+            $$PWD/qscriptstring.h \
+            $$PWD/qscriptstring_p.h \
+            $$PWD/qscriptprogram.h \
+            $$PWD/qscriptprogram_p.h \
+            $$PWD/qscriptsyntaxcheckresult.h \
+
+
+!static: DEFINES += QT_MAKEDLL
+
+DESTDIR = $$OUTPUT_DIR/lib
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptconverter_p.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptconverter_p.h
new file mode 100644
index 0000000000..cd86e2074c
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptconverter_p.h
@@ -0,0 +1,132 @@
+/*
+    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptconverter_p_h
+#define qscriptconverter_p_h
+
+#include <JavaScriptCore/JavaScript.h>
+#include <QtCore/qnumeric.h>
+#include <QtCore/qstring.h>
+#include <QtCore/qvarlengtharray.h>
+
+extern char *qdtoa(double d, int mode, int ndigits, int *decpt, int *sign, char **rve, char **digits_str);
+
+/*
+  \internal
+  \class QScriptConverter
+  QScriptValue and QScriptEngine helper class. This class's responsibility is to convert values
+  between JS values and Qt/C++ values.
+
+  This is a nice way to inline these functions in both QScriptValue and QScriptEngine.
+*/
+class QScriptConverter {
+public:
+    static quint32 toArrayIndex(const JSStringRef jsstring)
+    {
+        // FIXME this function should be exported by JSC C API.
+        QString qstring = toString(jsstring);
+
+        bool ok;
+        quint32 idx = qstring.toUInt(&ok);
+        if (!ok || toString(idx) != qstring)
+            idx = 0xffffffff;
+
+        return idx;
+    }
+
+    static QString toString(const JSStringRef str)
+    {
+        return QString(reinterpret_cast<const QChar*>(JSStringGetCharactersPtr(str)), JSStringGetLength(str));
+    }
+    static JSStringRef toString(const QString& str)
+    {
+        return JSStringCreateWithUTF8CString(str.toUtf8().constData());
+    }
+    static JSStringRef toString(const char* str)
+    {
+        return JSStringCreateWithUTF8CString(str);
+    }
+    static QString toString(double value)
+    {
+        // FIXME this should be easier. The ideal fix is to create
+        // a new function in JSC C API which could cover the functionality.
+
+        if (qIsNaN(value))
+            return QString::fromLatin1("NaN");
+        if (qIsInf(value))
+            return QString::fromLatin1(value < 0 ? "-Infinity" : "Infinity");
+        if (!value)
+            return QString::fromLatin1("0");
+
+        QVarLengthArray<char, 25> buf;
+        int decpt;
+        int sign;
+        char* result = 0;
+        char* endresult;
+        (void)qdtoa(value, 0, 0, &decpt, &sign, &endresult, &result);
+
+        if (!result)
+            return QString();
+
+        int resultLen = endresult - result;
+        if (decpt <= 0 && decpt > -6) {
+            buf.resize(-decpt + 2 + sign);
+            qMemSet(buf.data(), '0', -decpt + 2 + sign);
+            if (sign) // fix the sign.
+                buf[0] = '-';
+            buf[sign + 1] = '.';
+            buf.append(result, resultLen);
+        } else {
+            if (sign)
+                buf.append('-');
+            int length = buf.size() - sign + resultLen;
+            if (decpt <= 21 && decpt > 0) {
+                if (length <= decpt) {
+                    const char* zeros = "0000000000000000000000000";
+                    buf.append(result, resultLen);
+                    buf.append(zeros, decpt - length);
+                } else {
+                    buf.append(result, decpt);
+                    buf.append('.');
+                    buf.append(result + decpt, resultLen - decpt);
+                }
+            } else if (result[0] >= '0' && result[0] <= '9') {
+                if (length > 1) {
+                    buf.append(result, 1);
+                    buf.append('.');
+                    buf.append(result + 1, resultLen - 1);
+                } else
+                    buf.append(result, resultLen);
+                buf.append('e');
+                buf.append(decpt >= 0 ? '+' : '-');
+                int e = qAbs(decpt - 1);
+                if (e >= 100)
+                    buf.append('0' + e / 100);
+                if (e >= 10)
+                    buf.append('0' + (e % 100) / 10);
+                buf.append('0' + e % 10);
+            }
+        }
+        free(result);
+        buf.append(0);
+        return QString::fromLatin1(buf.constData());
+    }
+};
+
+#endif // qscriptconverter_p_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine.cpp
new file mode 100644
index 0000000000..6a3edc1b84
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine.cpp
@@ -0,0 +1,145 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "qscriptengine.h"
+
+#include "qscriptengine_p.h"
+#include "qscriptprogram_p.h"
+#include "qscriptsyntaxcheckresult_p.h"
+#include "qscriptvalue_p.h"
+
+/*!
+    Constructs a QScriptEngine object.
+
+    The globalObject() is initialized to have properties as described in ECMA-262, Section 15.1.
+*/
+QScriptEngine::QScriptEngine()
+    : d_ptr(new QScriptEnginePrivate(this))
+{
+}
+
+/*!
+    Destroys this QScriptEngine.
+*/
+QScriptEngine::~QScriptEngine()
+{
+}
+
+/*!
+  Checks the syntax of the given \a program. Returns a
+  QScriptSyntaxCheckResult object that contains the result of the check.
+*/
+QScriptSyntaxCheckResult QScriptEngine::checkSyntax(const QString &program)
+{
+    // FIXME This is not optimal.
+    // The JSC C API needs a context to perform a syntax check, it means that a QScriptEnginePrivate
+    // had to be created. This function is static so we have to create QScriptEnginePrivate for each
+    // call. We can't remove the "static" for compatibility reason, at least up to Qt5.
+    // QScriptSyntaxCheckResultPrivate takes ownership of newly created engine. The engine will be
+    // kept as long as it is needed for lazy evaluation of properties of
+    // the QScriptSyntaxCheckResultPrivate.
+    QScriptEnginePrivate* engine = new QScriptEnginePrivate(/* q_ptr */ 0);
+    return QScriptSyntaxCheckResultPrivate::get(engine->checkSyntax(program));
+}
+
+/*!
+    Evaluates \a program, using \a lineNumber as the base line number,
+    and returns the result of the evaluation.
+
+    The script code will be evaluated in the current context.
+
+    The evaluation of \a program can cause an exception in the
+    engine; in this case the return value will be the exception
+    that was thrown (typically an \c{Error} object). You can call
+    hasUncaughtException() to determine if an exception occurred in
+    the last call to evaluate().
+
+    \a lineNumber is used to specify a starting line number for \a
+    program; line number information reported by the engine that pertain
+    to this evaluation (e.g. uncaughtExceptionLineNumber()) will be
+    based on this argument. For example, if \a program consists of two
+    lines of code, and the statement on the second line causes a script
+    exception, uncaughtExceptionLineNumber() would return the given \a
+    lineNumber plus one. When no starting line number is specified, line
+    numbers will be 1-based.
+
+    \a fileName is used for error reporting. For example in error objects
+    the file name is accessible through the "fileName" property if it's
+    provided with this function.
+*/
+QScriptValue QScriptEngine::evaluate(const QString& program, const QString& fileName, int lineNumber)
+{
+    return QScriptValuePrivate::get(d_ptr->evaluate(program, fileName, lineNumber));
+}
+
+QScriptValue QScriptEngine::evaluate(const QScriptProgram& program)
+{
+    return QScriptValuePrivate::get(d_ptr->evaluate(QScriptProgramPrivate::get(program)));
+}
+
+/*!
+    Runs the garbage collector.
+
+    The garbage collector will attempt to reclaim memory by locating and disposing of objects that are
+    no longer reachable in the script environment.
+
+    Normally you don't need to call this function; the garbage collector will automatically be invoked
+    when the QScriptEngine decides that it's wise to do so (i.e. when a certain number of new objects
+    have been created). However, you can call this function to explicitly request that garbage
+    collection should be performed as soon as possible.
+*/
+void QScriptEngine::collectGarbage()
+{
+    d_ptr->collectGarbage();
+}
+
+/*!
+  Returns a handle that represents the given string, \a str.
+
+  QScriptString can be used to quickly look up properties, and
+  compare property names, of script objects.
+
+  \sa QScriptValue::property()
+*/
+QScriptString QScriptEngine::toStringHandle(const QString& str)
+{
+    return QScriptStringPrivate::get(d_ptr->toStringHandle(str));
+}
+
+/*!
+  Returns a QScriptValue of the primitive type Null.
+
+  \sa undefinedValue()
+*/
+QScriptValue QScriptEngine::nullValue()
+{
+    return QScriptValue(this, QScriptValue::NullValue);
+}
+
+/*!
+  Returns a QScriptValue of the primitive type Undefined.
+
+  \sa nullValue()
+*/
+QScriptValue QScriptEngine::undefinedValue()
+{
+    return QScriptValue(this, QScriptValue::UndefinedValue);
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine.h
new file mode 100644
index 0000000000..ee066c9cdd
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine.h
@@ -0,0 +1,56 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptengine_h
+#define qscriptengine_h
+
+#include "qscriptprogram.h"
+#include "qscriptstring.h"
+#include "qscriptsyntaxcheckresult.h"
+#include <QtCore/qobject.h>
+#include <QtCore/qshareddata.h>
+#include <QtCore/qstring.h>
+
+class QScriptValue;
+class QScriptEnginePrivate;
+
+// Internal typedef
+typedef QExplicitlySharedDataPointer<QScriptEnginePrivate> QScriptEnginePtr;
+
+class QScriptEngine : public QObject {
+public:
+    QScriptEngine();
+    ~QScriptEngine();
+
+    static QScriptSyntaxCheckResult checkSyntax(const QString& program);
+    QScriptValue evaluate(const QString& program, const QString& fileName = QString(), int lineNumber = 1);
+    QScriptValue evaluate(const QScriptProgram& program);
+    void collectGarbage();
+
+    QScriptString toStringHandle(const QString& str);
+
+    QScriptValue nullValue();
+    QScriptValue undefinedValue();
+private:
+    friend class QScriptEnginePrivate;
+
+    QScriptEnginePtr d_ptr;
+};
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine_p.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine_p.cpp
new file mode 100644
index 0000000000..32551b013a
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine_p.cpp
@@ -0,0 +1,71 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "qscriptengine_p.h"
+
+#include "qscriptprogram_p.h"
+#include "qscriptvalue_p.h"
+
+/*!
+    Constructs a default QScriptEnginePrivate object, a new global context will be created.
+    \internal
+*/
+QScriptEnginePrivate::QScriptEnginePrivate(const QScriptEngine* engine)
+    : q_ptr(const_cast<QScriptEngine*>(engine))
+    , m_context(JSGlobalContextCreate(0))
+{
+}
+
+QScriptEnginePrivate::~QScriptEnginePrivate()
+{
+    JSGlobalContextRelease(m_context);
+}
+
+QScriptSyntaxCheckResultPrivate* QScriptEnginePrivate::checkSyntax(const QString& program)
+{
+    JSValueRef exception;
+    if (JSCheckScriptSyntax(m_context, QScriptConverter::toString(program), /* url */ 0, /* starting line */ 1, &exception))
+        return new QScriptSyntaxCheckResultPrivate(this);
+    JSValueProtect(m_context, exception);
+    return new QScriptSyntaxCheckResultPrivate(this, const_cast<JSObjectRef>(exception));
+}
+
+/*!
+    Evaluates program and returns the result of the evaluation.
+    \internal
+*/
+QScriptValuePrivate* QScriptEnginePrivate::evaluate(const QString& program, const QString& fileName, int lineNumber)
+{
+    JSStringRef script = QScriptConverter::toString(program);
+    JSStringRef file = QScriptConverter::toString(fileName);
+    return new QScriptValuePrivate(this, evaluate(script, file, lineNumber));
+}
+
+/*!
+    Evaluates program and returns the result of the evaluation.
+    \internal
+*/
+QScriptValuePrivate* QScriptEnginePrivate::evaluate(const QScriptProgramPrivate* program)
+{
+    if (program->isNull())
+        return new QScriptValuePrivate;
+    return new QScriptValuePrivate(this, evaluate(program->program(), program->file(), program->line()));
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine_p.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine_p.h
new file mode 100644
index 0000000000..bf958bae9c
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine_p.h
@@ -0,0 +1,121 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptengine_p_h
+#define qscriptengine_p_h
+
+#include "qscriptconverter_p.h"
+#include "qscriptengine.h"
+#include "qscriptstring_p.h"
+#include "qscriptsyntaxcheckresult_p.h"
+#include "qscriptvalue.h"
+#include <JavaScriptCore/JavaScript.h>
+#include <QtCore/qshareddata.h>
+#include <QtCore/qstring.h>
+
+class QScriptEngine;
+class QScriptSyntaxCheckResultPrivate;
+
+class QScriptEnginePrivate : public QSharedData {
+public:
+    static QScriptEnginePtr get(const QScriptEngine* q) { Q_ASSERT(q); return q->d_ptr; }
+    static QScriptEngine* get(const QScriptEnginePrivate* d) { Q_ASSERT(d); return d->q_ptr; }
+
+    QScriptEnginePrivate(const QScriptEngine*);
+    ~QScriptEnginePrivate();
+
+    QScriptSyntaxCheckResultPrivate* checkSyntax(const QString& program);
+    QScriptValuePrivate* evaluate(const QString& program, const QString& fileName, int lineNumber);
+    QScriptValuePrivate* evaluate(const QScriptProgramPrivate* program);
+    inline JSValueRef evaluate(JSStringRef program, JSStringRef fileName, int lineNumber);
+    inline void collectGarbage();
+
+    inline JSValueRef makeJSValue(double number) const;
+    inline JSValueRef makeJSValue(int number) const;
+    inline JSValueRef makeJSValue(uint number) const;
+    inline JSValueRef makeJSValue(const QString& string) const;
+    inline JSValueRef makeJSValue(bool number) const;
+    inline JSValueRef makeJSValue(QScriptValue::SpecialValue value) const;
+
+    inline QScriptStringPrivate* toStringHandle(const QString& str) const;
+
+    inline JSGlobalContextRef context() const;
+private:
+    QScriptEngine* q_ptr;
+    JSGlobalContextRef m_context;
+};
+
+
+JSValueRef QScriptEnginePrivate::evaluate(JSStringRef program, JSStringRef fileName, int lineNumber)
+{
+    JSValueRef exception;
+    JSValueRef result = JSEvaluateScript(m_context, program, /* Global Object */ 0, fileName, lineNumber, &exception);
+    if (!result)
+        return exception; // returns an exception
+    return result;
+}
+
+void QScriptEnginePrivate::collectGarbage()
+{
+    JSGarbageCollect(m_context);
+}
+
+JSValueRef QScriptEnginePrivate::makeJSValue(double number) const
+{
+    return JSValueMakeNumber(m_context, number);
+}
+
+JSValueRef QScriptEnginePrivate::makeJSValue(int number) const
+{
+    return JSValueMakeNumber(m_context, number);
+}
+
+JSValueRef QScriptEnginePrivate::makeJSValue(uint number) const
+{
+    return JSValueMakeNumber(m_context, number);
+}
+
+JSValueRef QScriptEnginePrivate::makeJSValue(const QString& string) const
+{
+    return JSValueMakeString(m_context, QScriptConverter::toString(string));
+}
+
+JSValueRef QScriptEnginePrivate::makeJSValue(bool value) const
+{
+    return JSValueMakeBoolean(m_context, value);
+}
+
+JSValueRef QScriptEnginePrivate::makeJSValue(QScriptValue::SpecialValue value) const
+{
+    if (value == QScriptValue::NullValue)
+        return JSValueMakeNull(m_context);
+    return JSValueMakeUndefined(m_context);
+}
+
+QScriptStringPrivate* QScriptEnginePrivate::toStringHandle(const QString& str) const
+{
+    return new QScriptStringPrivate(str);
+}
+
+JSGlobalContextRef QScriptEnginePrivate::context() const
+{
+    return m_context;
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram.cpp
new file mode 100644
index 0000000000..d7d494851f
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram.cpp
@@ -0,0 +1,136 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "qscriptprogram.h"
+
+#include "qscriptprogram_p.h"
+
+/*!
+  \internal
+
+  \class QScriptProgram
+
+  \brief The QScriptProgram class encapsulates a Qt Script program.
+
+  \ingroup script
+
+  QScriptProgram retains the compiled representation of the script if
+  possible. Thus, QScriptProgram can be used to evaluate the same
+  script multiple times more efficiently.
+
+  \code
+  QScriptEngine engine;
+  QScriptProgram program("1 + 2");
+  QScriptValue result = engine.evaluate(program);
+  \endcode
+*/
+
+/*!
+  Constructs a null QScriptProgram.
+*/
+QScriptProgram::QScriptProgram()
+    : d_ptr(new QScriptProgramPrivate)
+{}
+
+/*!
+  Constructs a new QScriptProgram with the given \a sourceCode, \a
+  fileName and \a firstLineNumber.
+*/
+QScriptProgram::QScriptProgram(const QString& sourceCode,
+               const QString fileName,
+               int firstLineNumber)
+    : d_ptr(new QScriptProgramPrivate(sourceCode, fileName, firstLineNumber))
+{}
+
+/*!
+  Destroys this QScriptProgram.
+*/
+QScriptProgram::~QScriptProgram()
+{}
+
+/*!
+  Constructs a new QScriptProgram that is a copy of \a other.
+*/
+QScriptProgram::QScriptProgram(const QScriptProgram& other)
+{
+    d_ptr = other.d_ptr;
+}
+
+/*!
+  Assigns the \a other value to this QScriptProgram.
+*/
+QScriptProgram& QScriptProgram::operator=(const QScriptProgram& other)
+{
+    d_ptr = other.d_ptr;
+    return *this;
+}
+
+/*!
+  Returns true if this QScriptProgram is null; otherwise
+  returns false.
+*/
+bool QScriptProgram::isNull() const
+{
+    return d_ptr->isNull();
+}
+
+/*!
+  Returns the source code of this program.
+*/
+QString QScriptProgram::sourceCode() const
+{
+    return d_ptr->sourceCode();
+}
+
+/*!
+  Returns the filename associated with this program.
+*/
+QString QScriptProgram::fileName() const
+{
+    return d_ptr->fileName();
+}
+
+/*!
+  Returns the line number associated with this program.
+*/
+int QScriptProgram::firstLineNumber() const
+{
+    return d_ptr->firstLineNumber();
+}
+
+/*!
+  Returns true if this QScriptProgram is equal to \a other;
+  otherwise returns false.
+*/
+bool QScriptProgram::operator==(const QScriptProgram& other) const
+{
+    return d_ptr == other.d_ptr || *d_ptr == *other.d_ptr;
+}
+
+/*!
+  Returns true if this QScriptProgram is not equal to \a other;
+  otherwise returns false.
+*/
+bool QScriptProgram::operator!=(const QScriptProgram& other) const
+{
+    return d_ptr != other.d_ptr && *d_ptr != *other.d_ptr;
+}
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram.h
new file mode 100644
index 0000000000..93c8a3c3b6
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram.h
@@ -0,0 +1,53 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptprogram_h
+#define qscriptprogram_h
+
+#include "qtscriptglobal.h"
+#include <QtCore/qshareddata.h>
+#include <QtCore/qstring.h>
+
+class QScriptProgramPrivate;
+class Q_JAVASCRIPT_EXPORT QScriptProgram {
+public:
+    QScriptProgram();
+    QScriptProgram(const QString& sourceCode,
+                   const QString fileName = QString(),
+                   int firstLineNumber = 1);
+    QScriptProgram(const QScriptProgram& other);
+    ~QScriptProgram();
+
+    QScriptProgram& operator=(const QScriptProgram& other);
+
+    bool isNull() const;
+
+    QString sourceCode() const;
+    QString fileName() const;
+    int firstLineNumber() const;
+
+    bool operator==(const QScriptProgram& other) const;
+    bool operator!=(const QScriptProgram& other) const;
+
+private:
+    QExplicitlySharedDataPointer<QScriptProgramPrivate> d_ptr;
+    Q_DECLARE_PRIVATE(QScriptProgram)
+};
+
+#endif // qscriptprogram_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram_p.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram_p.h
new file mode 100644
index 0000000000..6e80e853b7
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram_p.h
@@ -0,0 +1,129 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptprogram_p_h
+#define qscriptprogram_p_h
+
+#include "qscriptconverter_p.h"
+#include "qscriptprogram.h"
+#include <JavaScriptCore/JavaScript.h>
+#include <QtCore/qshareddata.h>
+#include <QtCore/qstring.h>
+
+/*
+   FIXME The QScriptProgramPrivate potentially could be much faster. In current implementation we
+   gain CPU time only by avoiding QString -> JSStringRef conversion. In the ideal world we should
+   have a function inside the JSC C API that could provide us "parse once, execute multiple times"
+   functionality.
+*/
+
+class QScriptProgramPrivate : public QSharedData {
+public:
+    inline static QScriptProgramPrivate* get(const QScriptProgram& program);
+    inline QScriptProgramPrivate();
+    inline QScriptProgramPrivate(const QString& sourceCode,
+                   const QString fileName,
+                   int firstLineNumber);
+
+    inline ~QScriptProgramPrivate();
+
+    inline bool isNull() const;
+
+    inline QString sourceCode() const;
+    inline QString fileName() const;
+    inline int firstLineNumber() const;
+
+    inline bool operator==(const QScriptProgramPrivate& other) const;
+    inline bool operator!=(const QScriptProgramPrivate& other) const;
+
+    inline JSStringRef program() const;
+    inline JSStringRef file() const;
+    inline int line() const;
+private:
+    JSStringRef m_program;
+    JSStringRef m_fileName;
+    int m_line;
+};
+
+QScriptProgramPrivate* QScriptProgramPrivate::get(const QScriptProgram& program)
+{
+    return const_cast<QScriptProgramPrivate*>(program.d_ptr.constData());
+}
+
+QScriptProgramPrivate::QScriptProgramPrivate()
+    : m_program(0)
+    , m_fileName(0)
+    , m_line(-1)
+{}
+
+QScriptProgramPrivate::QScriptProgramPrivate(const QString& sourceCode,
+               const QString fileName,
+               int firstLineNumber)
+                   : m_program(QScriptConverter::toString(sourceCode))
+                   , m_fileName(QScriptConverter::toString(fileName))
+                   , m_line(firstLineNumber)
+{}
+
+QScriptProgramPrivate::~QScriptProgramPrivate()
+{
+    if (!isNull()) {
+        JSStringRelease(m_program);
+        JSStringRelease(m_fileName);
+    }
+}
+
+bool QScriptProgramPrivate::isNull() const
+{
+    return !m_program;
+}
+
+QString QScriptProgramPrivate::sourceCode() const
+{
+    return QScriptConverter::toString(m_program);
+}
+
+QString QScriptProgramPrivate::fileName() const
+{
+    return QScriptConverter::toString(m_fileName);
+}
+
+int QScriptProgramPrivate::firstLineNumber() const
+{
+    return m_line;
+}
+
+bool QScriptProgramPrivate::operator==(const QScriptProgramPrivate& other) const
+{
+    return m_line == other.m_line
+            && JSStringIsEqual(m_fileName, other.m_fileName)
+            && JSStringIsEqual(m_program, other.m_program);
+}
+
+bool QScriptProgramPrivate::operator!=(const QScriptProgramPrivate& other) const
+{
+    return m_line != other.m_line
+            || !JSStringIsEqual(m_fileName, other.m_fileName)
+            || !JSStringIsEqual(m_program, other.m_program);
+}
+
+JSStringRef QScriptProgramPrivate::program() const { return m_program; }
+JSStringRef QScriptProgramPrivate::file() const {return m_fileName; }
+int QScriptProgramPrivate::line() const { return m_line; }
+
+#endif // qscriptprogram_p_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring.cpp
new file mode 100644
index 0000000000..83c03c50fe
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring.cpp
@@ -0,0 +1,131 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "qscriptstring.h"
+
+#include "qscriptstring_p.h"
+#include <QtCore/qhash.h>
+
+/*!
+  Constructs an invalid QScriptString.
+*/
+QScriptString::QScriptString()
+    : d_ptr(new QScriptStringPrivate())
+{
+}
+/*!
+  Constructs an QScriptString from internal representation
+  \internal
+*/
+QScriptString::QScriptString(QScriptStringPrivate* d)
+    : d_ptr(d)
+{
+}
+
+/*!
+  Constructs a new QScriptString that is a copy of \a other.
+*/
+QScriptString::QScriptString(const QScriptString& other)
+{
+    d_ptr = other.d_ptr;
+}
+
+/*!
+  Destroys this QScriptString.
+*/
+QScriptString::~QScriptString()
+{
+}
+
+/*!
+  Assigns the \a other value to this QScriptString.
+*/
+QScriptString& QScriptString::operator=(const QScriptString& other)
+{
+    d_ptr = other.d_ptr;
+    return *this;
+}
+
+/*!
+  Returns true if this QScriptString is valid; otherwise
+  returns false.
+*/
+bool QScriptString::isValid() const
+{
+    return d_ptr->isValid();
+}
+
+/*!
+  Returns true if this QScriptString is equal to \a other;
+  otherwise returns false.
+*/
+bool QScriptString::operator==(const QScriptString& other) const
+{
+    return d_ptr == other.d_ptr || *d_ptr == *(other.d_ptr);
+}
+
+/*!
+  Returns true if this QScriptString is not equal to \a other;
+  otherwise returns false.
+*/
+bool QScriptString::operator!=(const QScriptString& other) const
+{
+    return d_ptr != other.d_ptr || *d_ptr != *(other.d_ptr);
+}
+
+/*!
+  Attempts to convert this QScriptString to a QtScript array index,
+  and returns the result.
+
+  If a conversion error occurs, *\a{ok} is set to false; otherwise
+  *\a{ok} is set to true.
+*/
+quint32 QScriptString::toArrayIndex(bool* ok) const
+{
+    return d_ptr->toArrayIndex(ok);
+}
+
+/*!
+  Returns the string that this QScriptString represents, or a
+  null string if this QScriptString is not valid.
+
+  \sa isValid()
+*/
+QString QScriptString::toString() const
+{
+    return d_ptr->toString();
+}
+
+/*!
+  Returns the string that this QScriptString represents, or a
+  null string if this QScriptString is not valid.
+
+  \sa toString()
+*/
+QScriptString::operator QString() const
+{
+    return d_ptr->toString();
+}
+
+uint qHash(const QScriptString& key)
+{
+    return qHash(QScriptStringPrivate::get(key)->id());
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring.h
new file mode 100644
index 0000000000..16593bc3ea
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring.h
@@ -0,0 +1,58 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptstring_h
+#define qscriptstring_h
+
+#include "qtscriptglobal.h"
+#include <QtCore/qshareddata.h>
+#include <QtCore/qstring.h>
+
+class QScriptStringPrivate;
+typedef QExplicitlySharedDataPointer<QScriptStringPrivate> QScriptStringPtr;
+
+class Q_JAVASCRIPT_EXPORT QScriptString {
+public:
+    QScriptString();
+    QScriptString(const QScriptString& other);
+    ~QScriptString();
+
+    QScriptString& operator=(const QScriptString& other);
+
+    bool isValid() const;
+
+    bool operator==(const QScriptString& other) const;
+    bool operator!=(const QScriptString& other) const;
+
+    quint32 toArrayIndex(bool* ok = 0) const;
+
+    QString toString() const;
+    operator QString() const;
+
+private:
+    QScriptString(QScriptStringPrivate* d);
+
+    QScriptStringPtr d_ptr;
+
+    friend class QScriptStringPrivate;
+};
+
+uint qHash(const QScriptString& key);
+
+#endif // qscriptstring_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring_p.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring_p.h
new file mode 100644
index 0000000000..f4fd117fba
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring_p.h
@@ -0,0 +1,112 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptstring_p_h
+#define qscriptstring_p_h
+
+#include "qscriptconverter_p.h"
+#include "qscriptstring.h"
+#include <JavaScriptCore/JavaScript.h>
+#include <QtCore/qnumeric.h>
+#include <QtCore/qshareddata.h>
+
+class QScriptStringPrivate : public QSharedData {
+public:
+    inline QScriptStringPrivate();
+    inline QScriptStringPrivate(const QString& qtstring);
+    inline ~QScriptStringPrivate();
+
+    static inline QScriptString get(QScriptStringPrivate* d);
+    static inline QScriptStringPtr get(const QScriptString& p);
+
+    inline bool isValid() const;
+
+    inline bool operator==(const QScriptStringPrivate& other) const;
+    inline bool operator!=(const QScriptStringPrivate& other) const;
+
+    inline quint32 toArrayIndex(bool* ok = 0) const;
+
+    inline QString toString() const;
+
+    inline quint64 id() const;
+
+private:
+    JSStringRef m_string;
+};
+
+
+QScriptStringPrivate::QScriptStringPrivate()
+    : m_string(0)
+{}
+
+QScriptStringPrivate::QScriptStringPrivate(const QString& qtstring)
+    : m_string(JSStringRetain(QScriptConverter::toString(qtstring)))
+{}
+
+QScriptStringPrivate::~QScriptStringPrivate()
+{
+    if (isValid())
+        JSStringRelease(m_string);
+}
+
+QScriptString QScriptStringPrivate::get(QScriptStringPrivate* d)
+{
+    Q_ASSERT(d);
+    return QScriptString(d);
+}
+
+QScriptStringPtr QScriptStringPrivate::get(const QScriptString& p)
+{
+    return p.d_ptr;
+}
+
+bool QScriptStringPrivate::isValid() const
+{
+    return m_string;
+}
+
+bool QScriptStringPrivate::operator==(const QScriptStringPrivate& other) const
+{
+    return isValid() && other.isValid() && JSStringIsEqual(m_string, other.m_string);
+}
+
+bool QScriptStringPrivate::operator!=(const QScriptStringPrivate& other) const
+{
+    return isValid() && other.isValid() && !JSStringIsEqual(m_string, other.m_string);
+}
+
+quint32 QScriptStringPrivate::toArrayIndex(bool* ok) const
+{
+    quint32 idx = QScriptConverter::toArrayIndex(m_string);
+    if (ok)
+        *ok = (idx != 0xffffffff);
+    return idx;
+}
+
+QString QScriptStringPrivate::toString() const
+{
+    return QScriptConverter::toString(m_string);
+}
+
+quint64 QScriptStringPrivate::id() const
+{
+    return reinterpret_cast<quint32>(m_string);
+}
+
+#endif // qscriptstring_p_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult.cpp
new file mode 100644
index 0000000000..2085f5b669
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult.cpp
@@ -0,0 +1,142 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "qscriptsyntaxcheckresult.h"
+#include "qscriptsyntaxcheckresult_p.h"
+
+/*!
+  \class QScriptSyntaxCheckResult
+
+  \brief The QScriptSyntaxCheckResult class provides the result of a script syntax check.
+
+  \ingroup script
+  \mainclass
+
+  QScriptSyntaxCheckResult is returned by QScriptEngine::checkSyntax() to
+  provide information about the syntactical (in)correctness of a script.
+*/
+
+/*!
+    \enum QScriptSyntaxCheckResult::State
+
+    This enum specifies the state of a syntax check.
+
+    \value Error The program contains a syntax error.
+    \value Intermediate The program is incomplete.
+    \value Valid The program is a syntactically correct Qt Script program.
+*/
+
+/*!
+  Constructs a new QScriptSyntaxCheckResult from the \a other result.
+*/
+QScriptSyntaxCheckResult::QScriptSyntaxCheckResult(const QScriptSyntaxCheckResult& other)
+    : d_ptr(other.d_ptr)
+{}
+
+/*!
+  Constructs a new QScriptSyntaxCheckResult from an internal representation.
+  \internal
+*/
+QScriptSyntaxCheckResult::QScriptSyntaxCheckResult(QScriptSyntaxCheckResultPrivate* d)
+    : d_ptr(d)
+{}
+
+/*!
+  Destroys this QScriptSyntaxCheckResult.
+*/
+QScriptSyntaxCheckResult::~QScriptSyntaxCheckResult()
+{}
+
+/*!
+  Assigns the \a other result to this QScriptSyntaxCheckResult, and returns a
+  reference to this QScriptSyntaxCheckResult.
+*/
+QScriptSyntaxCheckResult& QScriptSyntaxCheckResult::operator=(const QScriptSyntaxCheckResult& other)
+{
+    d_ptr = other.d_ptr;
+    return *this;
+}
+
+/*!
+  Returns the state of this QScriptSyntaxCheckResult.
+*/
+QScriptSyntaxCheckResult::State QScriptSyntaxCheckResult::state() const
+{
+    return d_ptr->state();
+}
+
+/*!
+  Returns the error line number of this QScriptSyntaxCheckResult, or -1 if
+  there is no error.
+
+  \sa state(), errorMessage()
+*/
+int QScriptSyntaxCheckResult::errorLineNumber() const
+{
+    return d_ptr->errorLineNumber();
+}
+
+/*!
+  Returns the error column number of this QScriptSyntaxCheckResult, or -1 if
+  there is no error.
+
+  \sa state(), errorLineNumber()
+*/
+int QScriptSyntaxCheckResult::errorColumnNumber() const
+{
+    return d_ptr->errorColumnNumber();
+}
+
+/*!
+  Returns the error message of this QScriptSyntaxCheckResult, or an empty
+  string if there is no error.
+
+  \sa state(), errorLineNumber()
+*/
+QString QScriptSyntaxCheckResult::errorMessage() const
+{
+    return d_ptr->errorMessage();
+}
+
+QScriptSyntaxCheckResultPrivate::~QScriptSyntaxCheckResultPrivate()
+{
+    if (m_exception)
+        JSValueUnprotect(m_engine->context(), m_exception);
+}
+
+QString QScriptSyntaxCheckResultPrivate::errorMessage() const
+{
+    if (m_exception)
+        return QScriptConverter::toString(JSValueToStringCopy(m_engine->context(), m_exception, /* exception */ 0));
+    return QString();
+}
+
+int QScriptSyntaxCheckResultPrivate::errorLineNumber() const
+{
+    if (!m_exception)
+        return -1;
+    // m_exception is an instance of the Exception so it has "line" attribute.
+    JSValueRef line = JSObjectGetProperty(m_engine->context(),
+                                          m_exception,
+                                          QScriptConverter::toString("line"),
+                                          /* exceptions */0);
+    return JSValueToNumber(m_engine->context(), line, /* exceptions */0);
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult.h
new file mode 100644
index 0000000000..aa57744bcc
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult.h
@@ -0,0 +1,50 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptsyntaxcheckresult_h
+#define qscriptsyntaxcheckresult_h
+
+#include "qtscriptglobal.h"
+#include <QtCore/qshareddata.h>
+
+class QScriptSyntaxCheckResultPrivate;
+class Q_JAVASCRIPT_EXPORT QScriptSyntaxCheckResult {
+public:
+    enum State {
+        Error,
+        Intermediate,
+        Valid
+    };
+
+    QScriptSyntaxCheckResult(const QScriptSyntaxCheckResult& other);
+    ~QScriptSyntaxCheckResult();
+    QScriptSyntaxCheckResult& operator=(const QScriptSyntaxCheckResult& other);
+
+    State state() const;
+    int errorLineNumber() const;
+    int errorColumnNumber() const;
+    QString errorMessage() const;
+
+private:
+    QScriptSyntaxCheckResult(QScriptSyntaxCheckResultPrivate* d);
+    QExplicitlySharedDataPointer<QScriptSyntaxCheckResultPrivate> d_ptr;
+
+    friend class QScriptSyntaxCheckResultPrivate;
+};
+#endif // qscriptsyntaxcheckresult_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult_p.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult_p.h
new file mode 100644
index 0000000000..6e1a131a4d
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult_p.h
@@ -0,0 +1,73 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptsyntaxcheckresult_p_h
+#define qscriptsyntaxcheckresult_p_h
+
+#include "qscriptconverter_p.h"
+#include "qscriptengine_p.h"
+#include "qscriptsyntaxcheckresult.h"
+#include <JavaScriptCore/JavaScript.h>
+#include <QtCore/qshareddata.h>
+
+class QScriptSyntaxCheckResultPrivate : public QSharedData {
+public:
+    static inline QScriptSyntaxCheckResult get(QScriptSyntaxCheckResultPrivate* p);
+    inline QScriptSyntaxCheckResultPrivate(const QScriptEnginePrivate* engine);
+    inline QScriptSyntaxCheckResultPrivate(const QScriptEnginePrivate* engine, JSObjectRef value);
+    ~QScriptSyntaxCheckResultPrivate();
+
+    inline QScriptSyntaxCheckResult::State state() const;
+    int errorLineNumber() const;
+    inline int errorColumnNumber() const;
+    QString errorMessage() const;
+private:
+    JSObjectRef m_exception;
+    QScriptEnginePtr m_engine;
+};
+
+QScriptSyntaxCheckResult QScriptSyntaxCheckResultPrivate::get(QScriptSyntaxCheckResultPrivate* p)
+{
+    return QScriptSyntaxCheckResult(p);
+}
+
+QScriptSyntaxCheckResultPrivate::QScriptSyntaxCheckResultPrivate(const QScriptEnginePrivate* engine)
+    : m_exception(0)
+    , m_engine(const_cast<QScriptEnginePrivate*>(engine))
+{}
+
+QScriptSyntaxCheckResultPrivate::QScriptSyntaxCheckResultPrivate(const QScriptEnginePrivate* engine, JSObjectRef value)
+    : m_exception(value)
+    , m_engine(const_cast<QScriptEnginePrivate*>(engine))
+{}
+
+QScriptSyntaxCheckResult::State QScriptSyntaxCheckResultPrivate::state() const
+{
+    // FIXME This function doesn't return QScriptSyntaxCheckResult::Intermediate
+    return m_exception ? QScriptSyntaxCheckResult::Error : QScriptSyntaxCheckResult::Valid;
+}
+
+int QScriptSyntaxCheckResultPrivate::errorColumnNumber() const
+{
+    // FIXME JSC C API doesn't expose the error column number.
+    return m_exception ? 1 : -1;
+}
+
+
+#endif // qscriptsyntaxcheckresult_p_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue.cpp
new file mode 100644
index 0000000000..127fe04101
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue.cpp
@@ -0,0 +1,556 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "qscriptvalue.h"
+
+#include "qscriptengine.h"
+#include "qscriptengine_p.h"
+#include "qscriptvalue_p.h"
+#include <QtCore/qdebug.h>
+
+/*!
+    Constructs an invalid value.
+*/
+QScriptValue::QScriptValue()
+    : d_ptr(new QScriptValuePrivate())
+{
+}
+
+/*!
+  Constructs a new QScriptValue with a boolean \a value.
+*/
+QScriptValue::QScriptValue(bool value)
+    : d_ptr(new QScriptValuePrivate(value))
+{
+}
+
+/*!
+  Constructs a new QScriptValue with a number \a value.
+*/
+QScriptValue::QScriptValue(int value)
+    : d_ptr(new QScriptValuePrivate(value))
+{
+}
+
+/*!
+  Constructs a new QScriptValue with a number \a value.
+*/
+QScriptValue::QScriptValue(uint value)
+    : d_ptr(new QScriptValuePrivate(value))
+{
+}
+
+/*!
+  Constructs a new QScriptValue with a number \a value.
+*/
+QScriptValue::QScriptValue(qsreal value)
+    : d_ptr(new QScriptValuePrivate(value))
+{
+}
+
+/*!
+  Constructs a new QScriptValue with a string \a value.
+*/
+QScriptValue::QScriptValue(const QString& value)
+    : d_ptr(new QScriptValuePrivate(value))
+{
+}
+
+/*!
+  Constructs a new QScriptValue with a special \a value.
+*/
+QScriptValue::QScriptValue(SpecialValue value)
+    : d_ptr(new QScriptValuePrivate(value))
+{
+}
+
+/*!
+  Constructs a new QScriptValue with a string \a value.
+*/
+QScriptValue::QScriptValue(const char* value)
+    : d_ptr(new QScriptValuePrivate(QString::fromUtf8(value)))
+{
+}
+
+/*!
+    Block automatic convertion to bool
+    \internal
+*/
+QScriptValue::QScriptValue(void* d)
+{
+    Q_ASSERT(false);
+}
+
+/*!
+    Constructs a new QScriptValue from private
+    \internal
+*/
+QScriptValue::QScriptValue(QScriptValuePrivate* d)
+    : d_ptr(d)
+{
+}
+
+/*!
+  \obsolete
+
+  Constructs a new QScriptValue with the boolean \a value and
+  registers it with the script \a engine.
+*/
+QScriptValue::QScriptValue(QScriptEngine* engine, bool value)
+    : d_ptr(new QScriptValuePrivate(engine, value))
+{
+}
+
+/*!
+  \obsolete
+
+  Constructs a new QScriptValue with the integer \a value and
+  registers it with the script \a engine.
+*/
+QScriptValue::QScriptValue(QScriptEngine* engine, int value)
+    : d_ptr(new QScriptValuePrivate(engine, value))
+{
+}
+
+/*!
+  \obsolete
+
+  Constructs a new QScriptValue with the unsigned integer \a value and
+  registers it with the script \a engine.
+ */
+QScriptValue::QScriptValue(QScriptEngine* engine, uint value)
+    : d_ptr(new QScriptValuePrivate(engine, value))
+{
+}
+
+/*!
+  \obsolete
+
+  Constructs a new QScriptValue with the qsreal \a value and
+  registers it with the script \a engine.
+*/
+QScriptValue::QScriptValue(QScriptEngine* engine, qsreal value)
+    : d_ptr(new QScriptValuePrivate(engine, value))
+{
+}
+
+/*!
+  \obsolete
+
+  Constructs a new QScriptValue with the string \a value and
+  registers it with the script \a engine.
+*/
+QScriptValue::QScriptValue(QScriptEngine* engine, const QString& value)
+    : d_ptr(new QScriptValuePrivate(engine, value))
+{
+}
+
+/*!
+  \obsolete
+
+  Constructs a new QScriptValue with the string \a value and
+  registers it with the script \a engine.
+*/
+QScriptValue::QScriptValue(QScriptEngine* engine, const char* value)
+    : d_ptr(new QScriptValuePrivate(engine, QString::fromUtf8(value)))
+{
+}
+
+/*!
+  \obsolete
+
+  Constructs a new QScriptValue with the special \a value and
+  registers it with the script \a engine.
+*/
+QScriptValue::QScriptValue(QScriptEngine* engine, SpecialValue value)
+    : d_ptr(new QScriptValuePrivate(engine, value))
+{
+}
+
+/*!
+  Constructs a new QScriptValue that is a copy of \a other.
+
+  Note that if \a other is an object (i.e., isObject() would return
+  true), then only a reference to the underlying object is copied into
+  the new script value (i.e., the object itself is not copied).
+*/
+QScriptValue::QScriptValue(const QScriptValue& other)
+    : d_ptr(other.d_ptr)
+{
+}
+
+/*!
+    Destroys this QScriptValue.
+*/
+QScriptValue::~QScriptValue()
+{
+}
+
+/*!
+  Returns true if this QScriptValue is valid; otherwise returns
+  false.
+*/
+bool QScriptValue::isValid() const
+{
+    return d_ptr->isValid();
+}
+
+/*!
+  Returns true if this QScriptValue is of the primitive type Boolean;
+  otherwise returns false.
+
+  \sa toBool()
+*/
+bool QScriptValue::isBool() const
+{
+    return d_ptr->isBool();
+}
+
+/*!
+  \obsolete
+
+  Use isBool() instead.
+  Returns true if this QScriptValue is of the primitive type Boolean;
+  otherwise returns false.
+*/
+bool QScriptValue::isBoolean() const
+{
+    return d_ptr->isBool();
+}
+
+/*!
+  Returns true if this QScriptValue is of the primitive type Number;
+  otherwise returns false.
+
+  \sa toNumber()
+*/
+bool QScriptValue::isNumber() const
+{
+    return d_ptr->isNumber();
+}
+
+/*!
+  Returns true if this QScriptValue is of the primitive type Null;
+  otherwise returns false.
+
+  \sa QScriptEngine::nullValue()
+*/
+bool QScriptValue::isNull() const
+{
+    return d_ptr->isNull();
+}
+
+/*!
+  Returns true if this QScriptValue is of the primitive type String;
+  otherwise returns false.
+
+  \sa toString()
+*/
+bool QScriptValue::isString() const
+{
+    return d_ptr->isString();
+}
+
+/*!
+  Returns true if this QScriptValue is of the primitive type Undefined;
+  otherwise returns false.
+
+  \sa QScriptEngine::undefinedValue()
+*/
+bool QScriptValue::isUndefined() const
+{
+    return d_ptr->isUndefined();
+}
+
+/*!
+  Returns true if this QScriptValue is an object of the Error class;
+  otherwise returns false.
+
+  \sa QScriptContext::throwError()
+*/
+bool QScriptValue::isError() const
+{
+    return d_ptr->isError();
+}
+
+/*!
+  Returns true if this QScriptValue is of the Object type; otherwise
+  returns false.
+
+  Note that function values, variant values, and QObject values are
+  objects, so this function returns true for such values.
+
+  \sa toObject(), QScriptEngine::newObject()
+*/
+bool QScriptValue::isObject() const
+{
+    return d_ptr->isObject();
+}
+
+/*!
+  Returns true if this QScriptValue is a function; otherwise returns
+  false.
+
+  \sa call()
+*/
+bool QScriptValue::isFunction() const
+{
+    return d_ptr->isFunction();
+}
+
+/*!
+  Returns the string value of this QScriptValue, as defined in
+  \l{ECMA-262} section 9.8, "ToString".
+
+  Note that if this QScriptValue is an object, calling this function
+  has side effects on the script engine, since the engine will call
+  the object's toString() function (and possibly valueOf()) in an
+  attempt to convert the object to a primitive value (possibly
+  resulting in an uncaught script exception).
+
+  \sa isString()
+*/
+QString QScriptValue::toString() const
+{
+    return d_ptr->toString();
+}
+
+/*!
+  Returns the number value of this QScriptValue, as defined in
+  \l{ECMA-262} section 9.3, "ToNumber".
+
+  Note that if this QScriptValue is an object, calling this function
+  has side effects on the script engine, since the engine will call
+  the object's valueOf() function (and possibly toString()) in an
+  attempt to convert the object to a primitive value (possibly
+  resulting in an uncaught script exception).
+
+  \sa isNumber(), toInteger(), toInt32(), toUInt32(), toUInt16()
+*/
+qsreal QScriptValue::toNumber() const
+{
+    return d_ptr->toNumber();
+}
+
+/*!
+  Returns the boolean value of this QScriptValue, using the conversion
+  rules described in \l{ECMA-262} section 9.2, "ToBoolean".
+
+  Note that if this QScriptValue is an object, calling this function
+  has side effects on the script engine, since the engine will call
+  the object's valueOf() function (and possibly toString()) in an
+  attempt to convert the object to a primitive value (possibly
+  resulting in an uncaught script exception).
+
+  \sa isBool()
+*/
+bool QScriptValue::toBool() const
+{
+    return d_ptr->toBool();
+}
+
+/*!
+  \obsolete
+
+  Use toBool() instead.
+*/
+bool QScriptValue::toBoolean() const
+{
+    return d_ptr->toBool();
+}
+
+/*!
+  Returns the integer value of this QScriptValue, using the conversion
+  rules described in \l{ECMA-262} section 9.4, "ToInteger".
+
+  Note that if this QScriptValue is an object, calling this function
+  has side effects on the script engine, since the engine will call
+  the object's valueOf() function (and possibly toString()) in an
+  attempt to convert the object to a primitive value (possibly
+  resulting in an uncaught script exception).
+
+  \sa toNumber()
+*/
+qsreal QScriptValue::toInteger() const
+{
+    return d_ptr->toInteger();
+}
+
+/*!
+  Returns the signed 32-bit integer value of this QScriptValue, using
+  the conversion rules described in \l{ECMA-262} section 9.5, "ToInt32".
+
+  Note that if this QScriptValue is an object, calling this function
+  has side effects on the script engine, since the engine will call
+  the object's valueOf() function (and possibly toString()) in an
+  attempt to convert the object to a primitive value (possibly
+  resulting in an uncaught script exception).
+
+  \sa toNumber(), toUInt32()
+*/
+qint32 QScriptValue::toInt32() const
+{
+    return d_ptr->toInt32();
+}
+
+/*!
+  Returns the unsigned 32-bit integer value of this QScriptValue, using
+  the conversion rules described in \l{ECMA-262} section 9.6, "ToUint32".
+
+  Note that if this QScriptValue is an object, calling this function
+  has side effects on the script engine, since the engine will call
+  the object's valueOf() function (and possibly toString()) in an
+  attempt to convert the object to a primitive value (possibly
+  resulting in an uncaught script exception).
+
+  \sa toNumber(), toInt32()
+*/
+quint32 QScriptValue::toUInt32() const
+{
+    return d_ptr->toUInt32();
+}
+
+/*!
+  Returns the unsigned 16-bit integer value of this QScriptValue, using
+  the conversion rules described in \l{ECMA-262} section 9.7, "ToUint16".
+
+  Note that if this QScriptValue is an object, calling this function
+  has side effects on the script engine, since the engine will call
+  the object's valueOf() function (and possibly toString()) in an
+  attempt to convert the object to a primitive value (possibly
+  resulting in an uncaught script exception).
+
+  \sa toNumber()
+*/
+quint16 QScriptValue::toUInt16() const
+{
+    return d_ptr->toUInt16();
+}
+
+/*!
+  Calls this QScriptValue as a function, using \a thisObject as
+  the `this' object in the function call, and passing \a args
+  as arguments to the function. Returns the value returned from
+  the function.
+
+  If this QScriptValue is not a function, call() does nothing
+  and returns an invalid QScriptValue.
+
+  Note that if \a thisObject is not an object, the global object
+  (see \l{QScriptEngine::globalObject()}) will be used as the
+  `this' object.
+
+  Calling call() can cause an exception to occur in the script engine;
+  in that case, call() returns the value that was thrown (typically an
+  \c{Error} object). You can call
+  QScriptEngine::hasUncaughtException() to determine if an exception
+  occurred.
+
+  \snippet doc/src/snippets/code/src_script_qscriptvalue.cpp 2
+
+  \sa construct()
+*/
+QScriptValue QScriptValue::call(const QScriptValue& thisObject, const QScriptValueList& args)
+{
+    return d_ptr->call(thisObject.d_ptr.data(), args);
+}
+
+/*!
+  Returns the QScriptEngine that created this QScriptValue,
+  or 0 if this QScriptValue is invalid or the value is not
+  associated with a particular engine.
+*/
+QScriptEngine* QScriptValue::engine() const
+{
+    QScriptEnginePrivate* engine = d_ptr->engine();
+    if (engine)
+        return QScriptEnginePrivate::get(engine);
+    return 0;
+}
+
+/*!
+  Assigns the \a other value to this QScriptValue.
+
+  Note that if \a other is an object (isObject() returns true),
+  only a reference to the underlying object will be assigned;
+  the object itself will not be copied.
+*/
+QScriptValue& QScriptValue::operator=(const QScriptValue& other)
+{
+    d_ptr = other.d_ptr;
+    return *this;
+}
+
+/*!
+  Returns true if this QScriptValue is equal to \a other, otherwise
+  returns false. The comparison follows the behavior described in
+  \l{ECMA-262} section 11.9.3, "The Abstract Equality Comparison
+  Algorithm".
+
+  This function can return true even if the type of this QScriptValue
+  is different from the type of the \a other value; i.e. the
+  comparison is not strict.  For example, comparing the number 9 to
+  the string "9" returns true; comparing an undefined value to a null
+  value returns true; comparing a \c{Number} object whose primitive
+  value is 6 to a \c{String} object whose primitive value is "6"
+  returns true; and comparing the number 1 to the boolean value
+  \c{true} returns true. If you want to perform a comparison
+  without such implicit value conversion, use strictlyEquals().
+
+  Note that if this QScriptValue or the \a other value are objects,
+  calling this function has side effects on the script engine, since
+  the engine will call the object's valueOf() function (and possibly
+  toString()) in an attempt to convert the object to a primitive value
+  (possibly resulting in an uncaught script exception).
+
+  \sa strictlyEquals(), lessThan()
+*/
+bool QScriptValue::equals(const QScriptValue& other) const
+{
+    return d_ptr == other.d_ptr || d_ptr->equals(QScriptValuePrivate::get(other));
+}
+
+/*!
+  Returns true if this QScriptValue is equal to \a other using strict
+  comparison (no conversion), otherwise returns false. The comparison
+  follows the behavior described in \l{ECMA-262} section 11.9.6, "The
+  Strict Equality Comparison Algorithm".
+
+  If the type of this QScriptValue is different from the type of the
+  \a other value, this function returns false. If the types are equal,
+  the result depends on the type, as shown in the following table:
+
+    \table
+    \header \o Type \o Result
+    \row    \o Undefined  \o true
+    \row    \o Null       \o true
+    \row    \o Boolean    \o true if both values are true, false otherwise
+    \row    \o Number     \o false if either value is NaN (Not-a-Number); true if values are equal, false otherwise
+    \row    \o String     \o true if both values are exactly the same sequence of characters, false otherwise
+    \row    \o Object     \o true if both values refer to the same object, false otherwise
+    \endtable
+
+  \sa equals()
+*/
+bool QScriptValue::strictlyEquals(const QScriptValue& other) const
+{
+    return d_ptr == other.d_ptr || d_ptr->strictlyEquals(QScriptValuePrivate::get(other));
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue.h
new file mode 100644
index 0000000000..d45aed359f
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue.h
@@ -0,0 +1,99 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptvalue_h
+#define qscriptvalue_h
+
+#include <QtCore/qlist.h>
+#include <QtCore/qshareddata.h>
+
+class QScriptEngine;
+class QScriptValuePrivate;
+
+class QScriptValue;
+typedef QList<QScriptValue> QScriptValueList;
+
+typedef double qsreal;
+
+class QScriptValue {
+public:    
+    enum SpecialValue {
+        NullValue,
+        UndefinedValue
+    };
+
+    QScriptValue();
+    QScriptValue(bool value);
+    QScriptValue(int value);
+    QScriptValue(uint value);
+    QScriptValue(qsreal value);
+    QScriptValue(const QString& value);
+    QScriptValue(const char* value);
+    QScriptValue(SpecialValue value);
+    QScriptValue(const QScriptValue& other);
+
+    QScriptValue(QScriptEngine* engine, bool value);
+    QScriptValue(QScriptEngine* engine, int value);
+    QScriptValue(QScriptEngine* engine, uint value);
+    QScriptValue(QScriptEngine* engine, qsreal value);
+    QScriptValue(QScriptEngine* engine, const QString& value);
+    QScriptValue(QScriptEngine* engine, const char* value);
+    QScriptValue(QScriptEngine* engine, SpecialValue value);
+
+    ~QScriptValue();
+
+    QScriptValue& operator=(const QScriptValue& other);
+    bool equals(const QScriptValue& other) const;
+    bool strictlyEquals(const QScriptValue& other) const;
+
+    QScriptEngine* engine() const;
+
+    bool isValid() const;
+    bool isBool() const;
+    bool isBoolean() const;
+    bool isNumber() const;
+    bool isFunction() const;
+    bool isNull() const;
+    bool isString() const;
+    bool isUndefined() const;
+    bool isObject() const;
+    bool isError() const;
+
+    QString toString() const;
+    qsreal toNumber() const;
+    bool toBool() const;
+    bool toBoolean() const;
+    qsreal toInteger() const;
+    qint32 toInt32() const;
+    quint32 toUInt32() const;
+    quint16 toUInt16() const;
+
+    QScriptValue call(const QScriptValue& thisObject = QScriptValue(),
+                      const QScriptValueList& args = QScriptValueList());
+
+private:
+    QScriptValue(void*);
+    QScriptValue(QScriptValuePrivate*);
+
+    QExplicitlySharedDataPointer<QScriptValuePrivate> d_ptr;
+
+    friend class QScriptValuePrivate;
+};
+
+#endif // qscriptvalue_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue_p.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue_p.h
new file mode 100644
index 0000000000..e5c2a82868
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue_p.h
@@ -0,0 +1,754 @@
+/*
+    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptvalue_p_h
+#define qscriptvalue_p_h
+
+#include "qscriptconverter_p.h"
+#include "qscriptengine_p.h"
+#include "qscriptvalue.h"
+#include <JavaScriptCore/JavaScript.h>
+#include <QtCore/qmath.h>
+#include <QtCore/qnumeric.h>
+#include <QtCore/qshareddata.h>
+#include <QtCore/qvarlengtharray.h>
+
+class QScriptEngine;
+class QScriptValue;
+
+/*
+  \internal
+  \class QScriptValuePrivate
+
+  Implementation of QScriptValue.
+  The implementation is based on a state machine. The states names are included in
+  QScriptValuePrivate::State. Each method should check for the current state and then perform a
+  correct action.
+
+  State:
+    Invalid -> QSVP is invalid, no assumptions should be made about class members (apart from m_value).
+    CString -> QSVP is created from QString or const char* and no JSC engine has been associated yet.
+        Current value is kept in m_string,
+    CNumber -> QSVP is created from int, uint, double... and no JSC engine has been bind yet. Current
+        value is kept in m_number
+    CBool -> QSVP is created from bool and no JSC engine has been associated yet. Current value is kept
+        in m_number
+    CSpecial -> QSVP is Undefined or Null, but a JSC engine hasn't been associated yet, current value
+        is kept in m_number (cast of QScriptValue::SpecialValue)
+    JSValue -> QSVP is associated with engine, but there is no information about real type, the state
+        have really short live cycle. Normally it is created as a function call result.
+    JSPrimitive -> QSVP is associated with engine, and it is sure that it isn't a JavaScript object.
+    JSObject -> QSVP is associated with engine, and it is sure that it is a JavaScript object.
+
+  Each state keep all necessary information to invoke all methods, if not it should be changed to
+  a proper state. Changed state shouldn't be reverted.
+*/
+
+class QScriptValuePrivate : public QSharedData {
+public:
+    inline static QScriptValuePrivate* get(const QScriptValue& q);
+    inline static QScriptValue get(const QScriptValuePrivate* d);
+    inline static QScriptValue get(QScriptValuePrivate* d);
+
+    inline ~QScriptValuePrivate();
+
+    inline QScriptValuePrivate();
+    inline QScriptValuePrivate(const QString& string);
+    inline QScriptValuePrivate(bool value);
+    inline QScriptValuePrivate(int number);
+    inline QScriptValuePrivate(uint number);
+    inline QScriptValuePrivate(qsreal number);
+    inline QScriptValuePrivate(QScriptValue::SpecialValue value);
+
+    inline QScriptValuePrivate(const QScriptEngine* engine, bool value);
+    inline QScriptValuePrivate(const QScriptEngine* engine, int value);
+    inline QScriptValuePrivate(const QScriptEngine* engine, uint value);
+    inline QScriptValuePrivate(const QScriptEngine* engine, qsreal value);
+    inline QScriptValuePrivate(const QScriptEngine* engine, const QString& value);
+    inline QScriptValuePrivate(const QScriptEngine* engine, QScriptValue::SpecialValue value);
+
+    inline QScriptValuePrivate(const QScriptEnginePrivate* engine, JSValueRef value);
+    inline QScriptValuePrivate(const QScriptEnginePrivate* engine, JSValueRef value, JSObjectRef object);
+
+    inline bool isValid() const;
+    inline bool isBool();
+    inline bool isNumber();
+    inline bool isNull();
+    inline bool isString();
+    inline bool isUndefined();
+    inline bool isError();
+    inline bool isObject();
+    inline bool isFunction();
+
+    inline QString toString() const;
+    inline qsreal toNumber() const;
+    inline bool toBool() const;
+    inline qsreal toInteger() const;
+    inline qint32 toInt32() const;
+    inline quint32 toUInt32() const;
+    inline quint16 toUInt16() const;
+
+    inline bool equals(QScriptValuePrivate* other);
+    inline bool strictlyEquals(const QScriptValuePrivate* other) const;
+    inline bool assignEngine(QScriptEnginePrivate* engine);
+
+    inline QScriptValuePrivate* call(const QScriptValuePrivate* , const QScriptValueList& args);
+
+    inline JSGlobalContextRef context() const;
+    inline JSValueRef value() const;
+    inline JSObjectRef object() const;
+    inline QScriptEnginePrivate* engine() const;
+
+private:
+    // Please, update class documentation when you change the enum.
+    enum State {
+        Invalid = 0,
+        CString = 0x1000,
+        CNumber,
+        CBool,
+        CSpecial,
+        JSValue = 0x2000, // JS values are equal or higher then this value.
+        JSPrimitive,
+        JSObject
+    } m_state;
+    QScriptEnginePtr m_engine;
+    QString m_string;
+    qsreal m_number;
+    JSValueRef m_value;
+    JSObjectRef m_object;
+
+    inline void setValue(JSValueRef);
+
+    inline bool inherits(const char*);
+    inline State refinedJSValue();
+
+    inline bool isJSBased() const;
+    inline bool isNumberBased() const;
+    inline bool isStringBased() const;
+};
+
+QScriptValuePrivate* QScriptValuePrivate::get(const QScriptValue& q) { return q.d_ptr.data(); }
+
+QScriptValue QScriptValuePrivate::get(const QScriptValuePrivate* d)
+{
+    return QScriptValue(const_cast<QScriptValuePrivate*>(d));
+}
+
+QScriptValue QScriptValuePrivate::get(QScriptValuePrivate* d)
+{
+    return QScriptValue(d);
+}
+
+QScriptValuePrivate::~QScriptValuePrivate()
+{
+    if (m_value)
+        JSValueUnprotect(context(), m_value);
+}
+
+QScriptValuePrivate::QScriptValuePrivate()
+    : m_state(Invalid)
+    , m_value(0)
+{
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QString& string)
+    : m_state(CString)
+    , m_string(string)
+    , m_value(0)
+{
+}
+
+QScriptValuePrivate::QScriptValuePrivate(bool value)
+    : m_state(CBool)
+    , m_number(value)
+    , m_value(0)
+{
+}
+
+QScriptValuePrivate::QScriptValuePrivate(int number)
+    : m_state(CNumber)
+    , m_number(number)
+    , m_value(0)
+{
+}
+
+QScriptValuePrivate::QScriptValuePrivate(uint number)
+    : m_state(CNumber)
+    , m_number(number)
+    , m_value(0)
+{
+}
+
+QScriptValuePrivate::QScriptValuePrivate(qsreal number)
+    : m_state(CNumber)
+    , m_number(number)
+    , m_value(0)
+{
+}
+
+QScriptValuePrivate::QScriptValuePrivate(QScriptValue::SpecialValue value)
+    : m_state(CSpecial)
+    , m_number(value)
+    , m_value(0)
+{
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEngine* engine, bool value)
+    : m_state(JSPrimitive)
+{
+    if (!engine) {
+        // slower path reinitialization
+        m_state = CBool;
+        m_number = value;
+        m_value = 0;
+    } else {
+        m_engine = QScriptEnginePrivate::get(engine);
+        m_value = m_engine->makeJSValue(value);
+        JSValueProtect(context(), m_value);
+    }
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEngine* engine, int value)
+    : m_state(JSPrimitive)
+{
+    if (!engine) {
+        // slower path reinitialization
+        m_state = CNumber;
+        m_number = value;
+        m_value = 0;
+    } else {
+        m_engine = QScriptEnginePrivate::get(engine);
+        m_value = m_engine->makeJSValue(value);
+        JSValueProtect(context(), m_value);
+    }
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEngine* engine, uint value)
+    : m_state(JSPrimitive)
+{
+    if (!engine) {
+        // slower path reinitialization
+        m_state = CNumber;
+        m_number = value;
+        m_value = 0;
+    } else {
+        m_engine = QScriptEnginePrivate::get(engine);
+        m_value = m_engine->makeJSValue(value);
+        JSValueProtect(context(), m_value);
+    }
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEngine* engine, qsreal value)
+    : m_state(JSPrimitive)
+{
+    if (!engine) {
+        // slower path reinitialization
+        m_state = CNumber;
+        m_number = value;
+        m_value = 0;
+    } else {
+        m_engine = QScriptEnginePrivate::get(engine);
+        m_value = m_engine->makeJSValue(value);
+        JSValueProtect(context(), m_value);
+    }
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEngine* engine, const QString& value)
+    : m_state(JSPrimitive)
+{
+    if (!engine) {
+        // slower path reinitialization
+        m_state = CString;
+        m_string = value;
+        m_value = 0;
+    } else {
+        m_engine = QScriptEnginePrivate::get(engine);
+        m_value = m_engine->makeJSValue(value);
+        JSValueProtect(context(), m_value);
+    }
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEngine* engine, QScriptValue::SpecialValue value)
+    : m_state(JSPrimitive)
+{
+    if (!engine) {
+        // slower path reinitialization
+        m_state = CSpecial;
+        m_number = value;
+        m_value = 0;
+    } else {
+        m_engine = QScriptEnginePrivate::get(engine);
+        m_value = m_engine->makeJSValue(value);
+        JSValueProtect(context(), m_value);
+    }
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEnginePrivate* engine, JSValueRef value)
+    : m_state(JSValue)
+    , m_engine(const_cast<QScriptEnginePrivate*>(engine))
+    , m_value(value)
+{
+    Q_ASSERT(engine);
+    JSValueProtect(context(), m_value);
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEnginePrivate* engine, JSValueRef value, JSObjectRef object)
+    : m_state(JSObject)
+    , m_engine(const_cast<QScriptEnginePrivate*>(engine))
+    , m_value(value)
+    , m_object(object)
+{
+    Q_ASSERT(engine);
+    JSValueProtect(context(), m_value);
+}
+
+bool QScriptValuePrivate::isValid() const { return m_state != Invalid; }
+
+bool QScriptValuePrivate::isBool()
+{
+    switch (m_state) {
+    case CBool:
+        return true;
+    case JSValue:
+        if (refinedJSValue() != JSPrimitive)
+            return false;
+        // Fall-through.
+    case JSPrimitive:
+        return JSValueIsBoolean(context(), value());
+    default:
+        return false;
+    }
+}
+
+bool QScriptValuePrivate::isNumber()
+{
+    switch (m_state) {
+    case CNumber:
+        return true;
+    case JSValue:
+        if (refinedJSValue() != JSPrimitive)
+            return false;
+        // Fall-through.
+    case JSPrimitive:
+        return JSValueIsNumber(context(), value());
+    default:
+        return false;
+    }
+}
+
+bool QScriptValuePrivate::isNull()
+{
+    switch (m_state) {
+    case CSpecial:
+        return m_number == static_cast<int>(QScriptValue::NullValue);
+    case JSValue:
+        if (refinedJSValue() != JSPrimitive)
+            return false;
+        // Fall-through.
+    case JSPrimitive:
+        return JSValueIsNull(context(), value());
+    default:
+        return false;
+    }
+}
+
+bool QScriptValuePrivate::isString()
+{
+    switch (m_state) {
+    case CString:
+        return true;
+    case JSValue:
+        if (refinedJSValue() != JSPrimitive)
+            return false;
+        // Fall-through.
+    case JSPrimitive:
+        return JSValueIsString(context(), value());
+    default:
+        return false;
+    }
+}
+
+bool QScriptValuePrivate::isUndefined()
+{
+    switch (m_state) {
+    case CSpecial:
+        return m_number == static_cast<int>(QScriptValue::UndefinedValue);
+    case JSValue:
+        if (refinedJSValue() != JSPrimitive)
+            return false;
+        // Fall-through.
+    case JSPrimitive:
+        return JSValueIsUndefined(context(), value());
+    default:
+        return false;
+    }
+}
+
+bool QScriptValuePrivate::isError()
+{
+    switch (m_state) {
+    case JSValue:
+        if (refinedJSValue() != JSObject)
+            return false;
+        // Fall-through.
+    case JSObject:
+        return inherits("Error");
+    default:
+        return false;
+    }
+}
+
+bool QScriptValuePrivate::isObject()
+{
+    switch (m_state) {
+    case JSValue:
+        return refinedJSValue() == JSObject;
+    case JSObject:
+        return true;
+
+    default:
+        return false;
+    }
+}
+
+bool QScriptValuePrivate::isFunction()
+{
+    switch (m_state) {
+    case JSValue:
+        if (refinedJSValue() != JSObject)
+            return false;
+        // Fall-through.
+    case JSObject:
+        return JSObjectIsFunction(context(), object());
+    default:
+        return false;
+    }
+}
+
+QString QScriptValuePrivate::toString() const
+{
+    switch (m_state) {
+    case Invalid:
+        return QString();
+    case CBool:
+        return m_number ? QString::fromLatin1("true") : QString::fromLatin1("false");
+    case CString:
+        return m_string;
+    case CNumber:
+        return QScriptConverter::toString(m_number);
+    case CSpecial:
+        return m_number == QScriptValue::NullValue ? QString::fromLatin1("null") : QString::fromLatin1("undefined");
+    case JSValue:
+    case JSPrimitive:
+    case JSObject:
+        return QScriptConverter::toString(JSValueToStringCopy(context(), value(), /* exception */ 0));
+    }
+
+    Q_ASSERT_X(false, "toString()", "Not all states are included in the previous switch statement.");
+    return QString(); // Avoid compiler warning.
+}
+
+qsreal QScriptValuePrivate::toNumber() const
+{
+    switch (m_state) {
+    case JSValue:
+    case JSPrimitive:
+    case JSObject:
+        return JSValueToNumber(context(), value(), /* exception */ 0);
+    case CNumber:
+        return m_number;
+    case CBool:
+        return m_number ? 1 : 0;
+    case Invalid:
+        return 0;
+    case CSpecial:
+        return m_number == QScriptValue::NullValue ? 0 : qQNaN();
+    case CString:
+        bool ok;
+        qsreal result = m_string.toDouble(&ok);
+        if (ok)
+            return result;
+        result = m_string.toInt(&ok, 0); // Try other bases.
+        if (ok)
+            return result;
+        if (m_string == "Infinity" || m_string == "-Infinity")
+            return qInf();
+        return m_string.length() ? qQNaN() : 0;
+    }
+
+    Q_ASSERT_X(false, "toNumber()", "Not all states are included in the previous switch statement.");
+    return 0; // Avoid compiler warning.
+}
+
+bool QScriptValuePrivate::toBool() const
+{
+    switch (m_state) {
+    case JSValue:
+    case JSPrimitive:
+        return JSValueToBoolean(context(), value());
+    case JSObject:
+        return true;
+    case CNumber:
+        return !(qIsNaN(m_number) || !m_number);
+    case CBool:
+        return m_number;
+    case Invalid:
+    case CSpecial:
+        return false;
+    case CString:
+        return m_string.length();
+    }
+
+    Q_ASSERT_X(false, "toBool()", "Not all states are included in the previous switch statement.");
+    return false; // Avoid compiler warning.
+}
+
+qsreal QScriptValuePrivate::toInteger() const
+{
+    qsreal result = toNumber();
+    if (qIsNaN(result))
+        return 0;
+    if (qIsInf(result))
+        return result;
+    return (result > 0) ? qFloor(result) : -1 * qFloor(-result);
+}
+
+qint32 QScriptValuePrivate::toInt32() const
+{
+    qsreal result = toInteger();
+    // Orginaly it should look like that (result == 0 || qIsInf(result) || qIsNaN(result)), but
+    // some of these operation are invoked in toInteger subcall.
+    if (qIsInf(result))
+        return 0;
+    return result;
+}
+
+quint32 QScriptValuePrivate::toUInt32() const
+{
+    qsreal result = toInteger();
+    // Orginaly it should look like that (result == 0 || qIsInf(result) || qIsNaN(result)), but
+    // some of these operation are invoked in toInteger subcall.
+    if (qIsInf(result))
+        return 0;
+    return result;
+}
+
+quint16 QScriptValuePrivate::toUInt16() const
+{
+    return toInt32();
+}
+
+
+bool QScriptValuePrivate::equals(QScriptValuePrivate* other)
+{
+    if (!isValid() || !other->isValid())
+        return false;
+
+    if ((m_state == other->m_state) && !isJSBased()) {
+        if (isNumberBased())
+            return m_number == other->m_number;
+        return m_string == other->m_string;
+    }
+
+    if (isJSBased() && !other->isJSBased()) {
+        if (!other->assignEngine(engine())) {
+            qWarning("equals(): Cannot compare to a value created in a different engine");
+            return false;
+        }
+    } else if (!isJSBased() && other->isJSBased()) {
+        if (!other->assignEngine(other->engine())) {
+            qWarning("equals(): Cannot compare to a value created in a different engine");
+            return false;
+        }
+    }
+
+    return JSValueIsEqual(context(), value(), other->value(), /* exception */ 0);
+}
+
+bool QScriptValuePrivate::strictlyEquals(const QScriptValuePrivate* other) const
+{
+    if (m_state != other->m_state)
+        return false;
+    if (isJSBased()) {
+        if (other->engine() != engine()) {
+            qWarning("strictlyEquals(): Cannot compare to a value created in a different engine");
+            return false;
+        }
+        return JSValueIsStrictEqual(context(), value(), other->value());
+    }
+    if (isStringBased())
+        return m_string == other->m_string;
+    if (isNumberBased())
+        return m_number == other->m_number;
+
+    return false; // Invalid state.
+}
+
+/*!
+  Tries to assign \a engine to this value. Returns true on success; otherwise returns false.
+*/
+bool QScriptValuePrivate::assignEngine(QScriptEnginePrivate* engine)
+{
+    JSValueRef value;
+    switch (m_state) {
+    case CBool:
+        value = engine->makeJSValue(static_cast<bool>(m_number));
+        break;
+    case CString:
+        value = engine->makeJSValue(m_string);
+        break;
+    case CNumber:
+        value = engine->makeJSValue(m_number);
+        break;
+    case CSpecial:
+        value = engine->makeJSValue(static_cast<QScriptValue::SpecialValue>(m_number));
+        break;
+    default:
+        if (!isJSBased())
+            Q_ASSERT_X(!isJSBased(), "assignEngine()", "Not all states are included in the previous switch statement.");
+        else
+            qWarning("JSValue can't be rassigned to an another engine.");
+        return false;
+    }
+    m_engine = engine;
+    m_state = JSPrimitive;
+    setValue(value);
+    return true;
+}
+
+QScriptValuePrivate* QScriptValuePrivate::call(const QScriptValuePrivate*, const QScriptValueList& args)
+{
+    switch (m_state) {
+    case JSValue:
+        if (refinedJSValue() != JSObject)
+            return new QScriptValuePrivate;
+        // Fall-through.
+    case JSObject:
+        {
+            // Convert all arguments and bind to the engine.
+            int argc = args.size();
+            QVarLengthArray<JSValueRef, 8> argv(argc);
+            QScriptValueList::const_iterator i = args.constBegin();
+            for (int j = 0; i != args.constEnd(); j++, i++) {
+                QScriptValuePrivate* value = QScriptValuePrivate::get(*i);
+                if (!value->assignEngine(engine())) {
+                    qWarning("QScriptValue::call() failed: cannot call function with values created in a different engine");
+                    return new QScriptValuePrivate;
+                }
+                argv[j] = value->value();
+            }
+
+            // Make the call
+            JSValueRef exception = 0;
+            JSValueRef result = JSObjectCallAsFunction(context(), object(), /* thisObject */ 0, argc, argv.constData(), &exception);
+            if (!result && exception)
+                return new QScriptValuePrivate(engine(), exception);
+            if (result && !exception)
+                return new QScriptValuePrivate(engine(), result);
+        }
+        // this QSV is not a function <-- !result && !exception. Fall-through.
+    default:
+        return new QScriptValuePrivate;
+    }
+}
+
+QScriptEnginePrivate* QScriptValuePrivate::engine() const
+{
+    // As long as m_engine is an autoinitializated pointer we can safely return it without
+    // checking current state.
+    return m_engine.data();
+}
+
+JSGlobalContextRef QScriptValuePrivate::context() const
+{
+    Q_ASSERT(isJSBased());
+    return m_engine->context();
+}
+
+JSValueRef QScriptValuePrivate::value() const
+{
+    Q_ASSERT(isJSBased());
+    return m_value;
+}
+
+JSObjectRef QScriptValuePrivate::object() const
+{
+    Q_ASSERT(m_state == JSObject);
+    return m_object;
+}
+
+void QScriptValuePrivate::setValue(JSValueRef value)
+{
+    if (m_value)
+        JSValueUnprotect(context(), m_value);
+    if (value)
+        JSValueProtect(context(), value);
+    m_value = value;
+}
+
+/*!
+  \internal
+  Returns true if QSV is created from constructor with the given \a name, it has to be a
+  built-in type.
+*/
+bool QScriptValuePrivate::inherits(const char* name)
+{
+    Q_ASSERT(isJSBased());
+    JSObjectRef globalObject = JSContextGetGlobalObject(context());
+    JSValueRef error = JSObjectGetProperty(context(), globalObject, QScriptConverter::toString(name), 0);
+    return JSValueIsInstanceOfConstructor(context(), value(), JSValueToObject(context(), error, /* exception */ 0), /* exception */ 0);
+}
+
+/*!
+  \internal
+  Refines the state of this QScriptValuePrivate. Returns the new state.
+*/
+QScriptValuePrivate::State QScriptValuePrivate::refinedJSValue()
+{
+    Q_ASSERT(m_state == JSValue);
+    if (!JSValueIsObject(context(), value())) {
+        m_state = JSPrimitive;
+    } else {
+        m_state = JSObject;
+        // We are sure that value is an JSObject, so we can const_cast safely without
+        // calling JSC C API (JSValueToObject(context(), value(), /* exceptions */ 0)).
+        m_object = const_cast<JSObjectRef>(m_value);
+    }
+    return m_state;
+}
+
+/*!
+  \internal
+  Returns true if QSV have an engine associated.
+*/
+bool QScriptValuePrivate::isJSBased() const { return m_state >= JSValue; }
+
+/*!
+  \internal
+  Returns true if current value of QSV is placed in m_number.
+*/
+bool QScriptValuePrivate::isNumberBased() const { return !isJSBased() && !isStringBased() && m_state != Invalid; }
+
+/*!
+  \internal
+  Returns true if current value of QSV is placed in m_string.
+*/
+bool QScriptValuePrivate::isStringBased() const { return m_state == CString; }
+
+#endif // qscriptvalue_p_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qtscriptglobal.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qtscriptglobal.h
new file mode 100644
index 0000000000..29749c0ba9
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qtscriptglobal.h
@@ -0,0 +1,44 @@
+/*
+    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qtscriptglobal_h
+#define qtscriptglobal_h
+
+#include <QtCore/qglobal.h>
+
+#if defined(Q_OS_WIN) || defined(Q_OS_SYMBIAN)
+#  if defined(QT_NODLL)
+#  elif defined(QT_MAKEDLL)        /* create a Qt DLL library */
+#    if defined(QT_BUILD_JAVASCRIPT_LIB)
+#      define Q_JAVASCRIPT_EXPORT Q_DECL_EXPORT
+#    else
+#      define Q_JAVASCRIPT_EXPORT Q_DECL_IMPORT
+#    endif
+#  elif defined(QT_DLL) /* use a Qt DLL library */
+#    define Q_JAVASCRIPT_EXPORT
+#  endif
+#endif
+
+#if defined(QT_SHARED)
+#  define Q_JAVASCRIPT_EXPORT Q_DECL_EXPORT
+#else
+#  define Q_JAVASCRIPT_EXPORT
+#endif
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptengine/qscriptengine.pro b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptengine/qscriptengine.pro
new file mode 100644
index 0000000000..d521dd89bd
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptengine/qscriptengine.pro
@@ -0,0 +1,8 @@
+TEMPLATE = app
+TARGET = tst_qscriptengine
+QT += testlib
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+include(../tests.pri)
+
+SOURCES += tst_qscriptengine.cpp
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptengine/tst_qscriptengine.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptengine/tst_qscriptengine.cpp
new file mode 100644
index 0000000000..263279616b
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptengine/tst_qscriptengine.cpp
@@ -0,0 +1,275 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "qscriptengine.h"
+#include "qscriptprogram.h"
+#include "qscriptsyntaxcheckresult.h"
+#include "qscriptvalue.h"
+#include <QtTest/qtest.h>
+
+class tst_QScriptEngine : public QObject {
+    Q_OBJECT
+
+public:
+    tst_QScriptEngine() {}
+    virtual ~tst_QScriptEngine() {}
+
+public slots:
+    void init() {}
+    void cleanup() {}
+
+private slots:
+    void evaluate();
+    void collectGarbage();
+    void nullValue();
+    void undefinedValue();
+    void evaluateProgram();
+    void checkSyntax_data();
+    void checkSyntax();
+};
+
+/* Evaluating a script that throw an unhandled exception should return an invalid value. */
+void tst_QScriptEngine::evaluate()
+{
+    QScriptEngine engine;
+    QVERIFY2(engine.evaluate("1+1").isValid(), "the expression should be evaluated and an valid result should be returned");
+    QVERIFY2(engine.evaluate("ping").isValid(), "Script throwing an unhandled exception should return an exception value");
+}
+
+/* Test garbage collection, at least try to not crash. */
+void tst_QScriptEngine::collectGarbage()
+{
+    QScriptEngine engine;
+    QScriptValue foo = engine.evaluate("( function foo() {return 'pong';} )");
+    QVERIFY(foo.isFunction());
+    engine.collectGarbage();
+    QCOMPARE(foo.call().toString(), QString::fromAscii("pong"));
+}
+
+void tst_QScriptEngine::nullValue()
+{
+    QScriptEngine engine;
+    QScriptValue value = engine.nullValue();
+    QVERIFY(value.isValid());
+    QVERIFY(value.isNull());
+}
+
+void tst_QScriptEngine::undefinedValue()
+{
+    QScriptEngine engine;
+    QScriptValue value = engine.undefinedValue();
+    QVERIFY(value.isValid());
+    QVERIFY(value.isUndefined());
+}
+
+void tst_QScriptEngine::evaluateProgram()
+{
+    QScriptEngine eng;
+    {
+        QString code("1 + 2");
+        QString fileName("hello.js");
+        int lineNumber = 123;
+        QScriptProgram program(code, fileName, lineNumber);
+        QVERIFY(!program.isNull());
+        QCOMPARE(program.sourceCode(), code);
+        QCOMPARE(program.fileName(), fileName);
+        QCOMPARE(program.firstLineNumber(), lineNumber);
+
+        QScriptValue expected = eng.evaluate(code);
+        for (int x = 0; x < 10; ++x) {
+            QScriptValue ret = eng.evaluate(program);
+            QVERIFY(ret.equals(expected));
+        }
+
+        // operator=
+        QScriptProgram sameProgram = program;
+        QVERIFY(sameProgram == program);
+        QVERIFY(eng.evaluate(sameProgram).equals(expected));
+
+        // copy constructor
+        QScriptProgram sameProgram2(program);
+        QVERIFY(sameProgram2 == program);
+        QVERIFY(eng.evaluate(sameProgram2).equals(expected));
+
+        QScriptProgram differentProgram("2 + 3");
+        QVERIFY(differentProgram != program);
+        QVERIFY(!eng.evaluate(differentProgram).equals(expected));
+    }
+
+    // Program that accesses variable in the scope
+    {
+        QScriptProgram program("a");
+        QVERIFY(!program.isNull());
+        {
+            QScriptValue ret = eng.evaluate(program);
+            QVERIFY(ret.isError());
+            QCOMPARE(ret.toString(), QString::fromLatin1("ReferenceError: Can't find variable: a"));
+        }
+        {
+            QScriptValue ret = eng.evaluate(program);
+            QVERIFY(ret.isError());
+        }
+        eng.evaluate("a = 456");
+        {
+            QScriptValue ret = eng.evaluate(program);
+            QVERIFY(!ret.isError());
+            QCOMPARE(ret.toNumber(), 456.0);
+        }
+    }
+
+    // Program that creates closure
+    {
+        QScriptProgram program("(function() { var count = 0; return function() { return count++; }; })");
+        QVERIFY(!program.isNull());
+        QScriptValue createCounter = eng.evaluate(program);
+        QVERIFY(createCounter.isFunction());
+        QScriptValue counter = createCounter.call();
+        QVERIFY(counter.isFunction());
+        {
+            QScriptValue ret = counter.call();
+            QVERIFY(ret.isNumber());
+        }
+        QScriptValue counter2 = createCounter.call();
+        QVERIFY(counter2.isFunction());
+        QVERIFY(!counter2.equals(counter));
+        {
+            QScriptValue ret = counter2.call();
+            QVERIFY(ret.isNumber());
+        }
+    }
+
+    // Same program run in different engines
+    {
+        QString code("1 + 2");
+        QScriptProgram program(code);
+        QVERIFY(!program.isNull());
+        double expected = eng.evaluate(program).toNumber();
+        for (int x = 0; x < 2; ++x) {
+            QScriptEngine eng2;
+            for (int y = 0; y < 2; ++y) {
+                double ret = eng2.evaluate(program).toNumber();
+                QCOMPARE(ret, expected);
+            }
+        }
+    }
+
+    // No program
+    {
+        QScriptProgram program;
+        QVERIFY(program.isNull());
+        QScriptValue ret = eng.evaluate(program);
+        QVERIFY(!ret.isValid());
+    }
+}
+
+void tst_QScriptEngine::checkSyntax_data()
+{
+    QTest::addColumn<QString>("code");
+    QTest::addColumn<int>("expectedState");
+    QTest::addColumn<int>("errorLineNumber");
+    QTest::addColumn<int>("errorColumnNumber");
+    QTest::addColumn<QString>("errorMessage");
+
+    QTest::newRow("0")
+        << QString("0") << int(QScriptSyntaxCheckResult::Valid)
+        << -1 << -1 << "";
+    QTest::newRow("if (")
+        << QString("if (\n") << int(QScriptSyntaxCheckResult::Intermediate)
+        << 1 << 4 << "";
+    QTest::newRow("if else")
+        << QString("\nif else") << int(QScriptSyntaxCheckResult::Error)
+        << 2 << 4 << "SyntaxError: Parse error";
+    QTest::newRow("{if}")
+            << QString("{\n{\nif\n}\n") << int(QScriptSyntaxCheckResult::Error)
+        << 4 << 1 << "SyntaxError: Parse error";
+    QTest::newRow("foo[")
+        << QString("foo[") << int(QScriptSyntaxCheckResult::Error)
+        << 1 << 4 << "SyntaxError: Parse error";
+    QTest::newRow("foo['bar']")
+        << QString("foo['bar']") << int(QScriptSyntaxCheckResult::Valid)
+        << -1 << -1 << "";
+
+    QTest::newRow("/*")
+        << QString("/*") << int(QScriptSyntaxCheckResult::Intermediate)
+        << 1 << 1 << "Unclosed comment at end of file";
+    QTest::newRow("/*\nMy comment")
+        << QString("/*\nMy comment") << int(QScriptSyntaxCheckResult::Intermediate)
+        << 1 << 1 << "Unclosed comment at end of file";
+    QTest::newRow("/*\nMy comment */\nfoo = 10")
+        << QString("/*\nMy comment */\nfoo = 10") << int(QScriptSyntaxCheckResult::Valid)
+        << -1 << -1 << "";
+    QTest::newRow("foo = 10 /*")
+        << QString("foo = 10 /*") << int(QScriptSyntaxCheckResult::Intermediate)
+        << -1 << -1 << "";
+    QTest::newRow("foo = 10; /*")
+        << QString("foo = 10; /*") << int(QScriptSyntaxCheckResult::Intermediate)
+        << 1 << 11 << "Expected `end of file'";
+    QTest::newRow("foo = 10 /* My comment */")
+        << QString("foo = 10 /* My comment */") << int(QScriptSyntaxCheckResult::Valid)
+        << -1 << -1 << "";
+
+    QTest::newRow("/=/")
+        << QString("/=/") << int(QScriptSyntaxCheckResult::Valid) << -1 << -1 << "";
+    QTest::newRow("/=/g")
+        << QString("/=/g") << int(QScriptSyntaxCheckResult::Valid) << -1 << -1 << "";
+    QTest::newRow("/a/")
+        << QString("/a/") << int(QScriptSyntaxCheckResult::Valid) << -1 << -1 << "";
+    QTest::newRow("/a/g")
+        << QString("/a/g") << int(QScriptSyntaxCheckResult::Valid) << -1 << -1 << "";
+}
+
+void tst_QScriptEngine::checkSyntax()
+{
+    QFETCH(QString, code);
+    QFETCH(int, expectedState);
+    QFETCH(int, errorLineNumber);
+    QFETCH(int, errorColumnNumber);
+    QFETCH(QString, errorMessage);
+
+    QScriptSyntaxCheckResult result = QScriptEngine::checkSyntax(code);
+
+    // assignment
+    {
+        QScriptSyntaxCheckResult copy = result;
+        QCOMPARE(copy.state(), result.state());
+        QCOMPARE(copy.errorLineNumber(), result.errorLineNumber());
+        QCOMPARE(copy.errorColumnNumber(), result.errorColumnNumber());
+        QCOMPARE(copy.errorMessage(), result.errorMessage());
+    }
+    {
+        QScriptSyntaxCheckResult copy(result);
+        QCOMPARE(copy.state(), result.state());
+        QCOMPARE(copy.errorLineNumber(), result.errorLineNumber());
+        QCOMPARE(copy.errorColumnNumber(), result.errorColumnNumber());
+        QCOMPARE(copy.errorMessage(), result.errorMessage());
+    }
+
+    if (expectedState == QScriptSyntaxCheckResult::Intermediate)
+        QEXPECT_FAIL("", "QScriptSyntaxCheckResult::state() doesn't return the Intermediate state", Abort);
+    QCOMPARE(result.state(), QScriptSyntaxCheckResult::State(expectedState));
+    QCOMPARE(result.errorLineNumber(), errorLineNumber);
+    if (expectedState != QScriptSyntaxCheckResult::Valid && errorColumnNumber != 1)
+            QEXPECT_FAIL("", "QScriptSyntaxCheckResult::errorColumnNumber() doesn't return correct value", Continue);
+    QCOMPARE(result.errorColumnNumber(), errorColumnNumber);
+    QCOMPARE(result.errorMessage(), errorMessage);
+}
+
+
+QTEST_MAIN(tst_QScriptEngine)
+#include "tst_qscriptengine.moc"
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptstring/qscriptstring.pro b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptstring/qscriptstring.pro
new file mode 100644
index 0000000000..5ad9b7c572
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptstring/qscriptstring.pro
@@ -0,0 +1,7 @@
+TEMPLATE = app
+TARGET = tst_qscriptstring
+QT += testlib
+include(../tests.pri)
+
+SOURCES += tst_qscriptstring.cpp
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptstring/tst_qscriptstring.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptstring/tst_qscriptstring.cpp
new file mode 100644
index 0000000000..ff31835333
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptstring/tst_qscriptstring.cpp
@@ -0,0 +1,175 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef tst_qscriptstring_h
+#define tst_qscriptstring_h
+
+#include "qscriptengine.h"
+#include "qscriptstring.h"
+#include <QtCore/qhash.h>
+#include <QtTest/QtTest>
+
+class tst_QScriptString : public QObject {
+    Q_OBJECT
+
+public:
+    tst_QScriptString();
+    virtual ~tst_QScriptString();
+
+private slots:
+    void test();
+    void hash();
+    void toArrayIndex_data();
+    void toArrayIndex();
+};
+
+tst_QScriptString::tst_QScriptString()
+{
+}
+
+tst_QScriptString::~tst_QScriptString()
+{
+}
+
+void tst_QScriptString::test()
+{
+    QScriptEngine eng;
+    {
+        QScriptString str;
+        QVERIFY(!str.isValid());
+        QVERIFY(str == str);
+        QVERIFY(!(str != str));
+        QVERIFY(str.toString().isNull());
+
+        QScriptString str1(str);
+        QVERIFY(!str1.isValid());
+
+        QScriptString str2 = str;
+        QVERIFY(!str2.isValid());
+
+        QCOMPARE(str.toArrayIndex(), quint32(0xffffffff));
+    }
+    for (int x = 0; x < 2; ++x) {
+        QString ciao = QString::fromLatin1("ciao");
+        QScriptString str = eng.toStringHandle(ciao);
+        QVERIFY(str.isValid());
+        QVERIFY(str == str);
+        QVERIFY(!(str != str));
+        QCOMPARE(str.toString(), ciao);
+
+        QScriptString str1(str);
+        QCOMPARE(str, str1);
+
+        QScriptString str2 = str;
+        QCOMPARE(str, str2);
+
+        QScriptString str3 = eng.toStringHandle(ciao);
+        QVERIFY(str3.isValid());
+        QCOMPARE(str, str3);
+
+        eng.collectGarbage();
+
+        QVERIFY(str.isValid());
+        QCOMPARE(str.toString(), ciao);
+        QVERIFY(str1.isValid());
+        QCOMPARE(str1.toString(), ciao);
+        QVERIFY(str2.isValid());
+        QCOMPARE(str2.toString(), ciao);
+        QVERIFY(str3.isValid());
+        QCOMPARE(str3.toString(), ciao);
+    }
+    {
+        QScriptEngine* eng2 = new QScriptEngine;
+        QString one = QString::fromLatin1("one");
+        QString two = QString::fromLatin1("two");
+        QScriptString oneInterned = eng2->toStringHandle(one);
+        QCOMPARE(oneInterned.toString(), one);
+        QScriptString twoInterned = eng2->toStringHandle(two);
+        QCOMPARE(twoInterned.toString(), two);
+        QVERIFY(oneInterned != twoInterned);
+        QVERIFY(!(oneInterned == twoInterned));
+
+        delete eng2;
+    }
+}
+
+void tst_QScriptString::hash()
+{
+    QScriptEngine engine;
+    QHash<QScriptString, int> stringToInt;
+    QScriptString foo = engine.toStringHandle("foo");
+
+    QScriptString bar = engine.toStringHandle("bar");
+    QVERIFY(!stringToInt.contains(foo));
+    for (int i = 0; i < 1000000; ++i)
+        stringToInt.insert(foo, 123);
+    QCOMPARE(stringToInt.value(foo), 123);
+    QVERIFY(!stringToInt.contains(bar));
+    stringToInt.insert(bar, 456);
+    QCOMPARE(stringToInt.value(bar), 456);
+    QCOMPARE(stringToInt.value(foo), 123);
+}
+
+void tst_QScriptString::toArrayIndex_data()
+{
+    QTest::addColumn<QString>("input");
+    QTest::addColumn<bool>("expectSuccess");
+    QTest::addColumn<quint32>("expectedIndex");
+    QTest::newRow("foo") << QString::fromLatin1("foo") << false << quint32(0xffffffff);
+    QTest::newRow("empty") << QString::fromLatin1("") << false << quint32(0xffffffff);
+    QTest::newRow("0") << QString::fromLatin1("0") << true << quint32(0);
+    QTest::newRow("00") << QString::fromLatin1("00") << false << quint32(0xffffffff);
+    QTest::newRow("1") << QString::fromLatin1("1") << true << quint32(1);
+    QTest::newRow("123") << QString::fromLatin1("123") << true << quint32(123);
+    QTest::newRow("-1") << QString::fromLatin1("-1") << false << quint32(0xffffffff);
+    QTest::newRow("0a") << QString::fromLatin1("0a") << false << quint32(0xffffffff);
+    QTest::newRow("0x1") << QString::fromLatin1("0x1") << false << quint32(0xffffffff);
+    QTest::newRow("01") << QString::fromLatin1("01") << false << quint32(0xffffffff);
+    QTest::newRow("101a") << QString::fromLatin1("101a") << false << quint32(0xffffffff);
+    QTest::newRow("4294967294") << QString::fromLatin1("4294967294") << true << quint32(0xfffffffe);
+    QTest::newRow("4294967295") << QString::fromLatin1("4294967295") << false << quint32(0xffffffff);
+    QTest::newRow("11111111111") << QString::fromLatin1("11111111111") << false << quint32(0xffffffff);
+    QTest::newRow("0.0") << QString::fromLatin1("0.0") << false << quint32(0xffffffff);
+    QTest::newRow("1.0") << QString::fromLatin1("1.0") << false << quint32(0xffffffff);
+    QTest::newRow("1.5") << QString::fromLatin1("1.5") << false << quint32(0xffffffff);
+    QTest::newRow("1.") << QString::fromLatin1("1.") << false << quint32(0xffffffff);
+    QTest::newRow(".1") << QString::fromLatin1(".1") << false << quint32(0xffffffff);
+    QTest::newRow("1e0") << QString::fromLatin1("1e0") << false << quint32(0xffffffff);
+}
+
+void tst_QScriptString::toArrayIndex()
+{
+    QFETCH(QString, input);
+    QFETCH(bool, expectSuccess);
+    QFETCH(quint32, expectedIndex);
+    QScriptEngine engine;
+    for (int x = 0; x < 2; ++x) {
+        bool isArrayIndex;
+        bool* ptr = (!x) ? &isArrayIndex : (bool*)0;
+        quint32 result = engine.toStringHandle(input).toArrayIndex(ptr);
+        if (!x)
+            QCOMPARE(isArrayIndex, expectSuccess);
+        QCOMPARE(result, expectedIndex);
+    }
+}
+
+QTEST_MAIN(tst_QScriptString)
+#include "tst_qscriptstring.moc"
+
+#endif // tst_qscriptstring_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/qscriptvalue.pro b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/qscriptvalue.pro
new file mode 100644
index 0000000000..35cc17da90
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/qscriptvalue.pro
@@ -0,0 +1,12 @@
+TEMPLATE = app
+TARGET = tst_qscriptvalue
+QT += testlib
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+include(../tests.pri)
+
+SOURCES += \
+    tst_qscriptvalue.cpp \
+    tst_qscriptvalue_generated.cpp
+
+HEADERS += \
+    tst_qscriptvalue.h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.cpp
new file mode 100644
index 0000000000..82f09014fa
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.cpp
@@ -0,0 +1,435 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "tst_qscriptvalue.h"
+#include <QtCore/qnumeric.h>
+
+tst_QScriptValue::tst_QScriptValue()
+    : engine(0)
+{
+}
+
+tst_QScriptValue::~tst_QScriptValue()
+{
+    delete engine;
+}
+
+void tst_QScriptValue::dataHelper(InitDataFunction init, DefineDataFunction define)
+{
+    QTest::addColumn<QString>("__expression__");
+    (this->*init)();
+    QHash<QString, QScriptValue>::const_iterator it;
+    for (it = m_values.constBegin(); it != m_values.constEnd(); ++it) {
+        m_currentExpression = it.key();
+        (this->*define)(it.key().toLatin1());
+    }
+    m_currentExpression = QString();
+}
+
+QTestData& tst_QScriptValue::newRow(const char* tag)
+{
+    return QTest::newRow(tag) << m_currentExpression;
+}
+
+void tst_QScriptValue::testHelper(TestFunction fun)
+{
+    QFETCH(QString, __expression__);
+    QScriptValue value = m_values.value(__expression__);
+    (this->*fun)(__expression__.toLatin1(), value);
+}
+
+
+void tst_QScriptValue::ctor()
+{
+    QScriptEngine eng;
+    {
+        QScriptValue v;
+        QCOMPARE(v.isValid(), false);
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v(&eng, QScriptValue::UndefinedValue);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isUndefined(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.engine(), &eng);
+    }
+    {
+        QScriptValue v(&eng, QScriptValue::NullValue);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNull(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.engine(), &eng);
+    }
+    {
+        QScriptValue v(&eng, false);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isBoolean(), true);
+        QCOMPARE(v.isBool(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toBoolean(), false);
+        QCOMPARE(v.engine(), &eng);
+    }
+    {
+        QScriptValue v(&eng, int(1));
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNumber(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toNumber(), 1.0);
+        QCOMPARE(v.engine(), &eng);
+    }
+    {
+        QScriptValue v(int(0x43211234));
+        QVERIFY(v.isNumber());
+        QCOMPARE(v.toInt32(), 0x43211234);
+    }
+    {
+        QScriptValue v(&eng, uint(1));
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNumber(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toNumber(), 1.0);
+        QCOMPARE(v.engine(), &eng);
+    }
+    {
+        QScriptValue v(uint(0x43211234));
+        QVERIFY(v.isNumber());
+        QCOMPARE(v.toUInt32(), uint(0x43211234));
+    }
+    {
+        QScriptValue v(&eng, 1.0);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNumber(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toNumber(), 1.0);
+        QCOMPARE(v.engine(), &eng);
+    }
+    {
+        QScriptValue v(12345678910.5);
+        QVERIFY(v.isNumber());
+        QCOMPARE(v.toNumber(), 12345678910.5);
+    }
+    {
+        QScriptValue v(&eng, "ciao");
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isString(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toString(), QLatin1String("ciao"));
+        QCOMPARE(v.engine(), &eng);
+    }
+    {
+        QScriptValue v(&eng, QString("ciao"));
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isString(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toString(), QLatin1String("ciao"));
+        QCOMPARE(v.engine(), &eng);
+    }
+    // copy constructor, operator=
+    {
+        QScriptValue v(&eng, 1.0);
+        QScriptValue v2(v);
+        QCOMPARE(v2.strictlyEquals(v), true);
+        QCOMPARE(v2.engine(), &eng);
+
+        QScriptValue v3(v);
+        QCOMPARE(v3.strictlyEquals(v), true);
+        QCOMPARE(v3.strictlyEquals(v2), true);
+        QCOMPARE(v3.engine(), &eng);
+
+        QScriptValue v4(&eng, 2.0);
+        QCOMPARE(v4.strictlyEquals(v), false);
+        v3 = v4;
+        QCOMPARE(v3.strictlyEquals(v), false);
+        QCOMPARE(v3.strictlyEquals(v4), true);
+
+        v2 = QScriptValue();
+        QCOMPARE(v2.strictlyEquals(v), false);
+        QCOMPARE(v.toNumber(), 1.0);
+
+        QScriptValue v5(v);
+        QCOMPARE(v5.strictlyEquals(v), true);
+        v = QScriptValue();
+        QCOMPARE(v5.strictlyEquals(v), false);
+        QCOMPARE(v5.toNumber(), 1.0);
+    }
+
+    // constructors that take no engine argument
+    {
+        QScriptValue v(QScriptValue::UndefinedValue);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isUndefined(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v(QScriptValue::NullValue);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNull(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v(false);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isBoolean(), true);
+        QCOMPARE(v.isBool(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toBoolean(), false);
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v(int(1));
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNumber(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toNumber(), 1.0);
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v(uint(1));
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNumber(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toNumber(), 1.0);
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v(1.0);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNumber(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toNumber(), 1.0);
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v("ciao");
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isString(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toString(), QLatin1String("ciao"));
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v(QString("ciao"));
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isString(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toString(), QLatin1String("ciao"));
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    // copy constructor, operator=
+    {
+        QScriptValue v(1.0);
+        QScriptValue v2(v);
+        QCOMPARE(v2.strictlyEquals(v), true);
+        QCOMPARE(v2.engine(), (QScriptEngine*)0);
+
+        QScriptValue v3(v);
+        QCOMPARE(v3.strictlyEquals(v), true);
+        QCOMPARE(v3.strictlyEquals(v2), true);
+        QCOMPARE(v3.engine(), (QScriptEngine*)0);
+
+        QScriptValue v4(2.0);
+        QCOMPARE(v4.strictlyEquals(v), false);
+        v3 = v4;
+        QCOMPARE(v3.strictlyEquals(v), false);
+        QCOMPARE(v3.strictlyEquals(v4), true);
+
+        v2 = QScriptValue();
+        QCOMPARE(v2.strictlyEquals(v), false);
+        QCOMPARE(v.toNumber(), 1.0);
+
+        QScriptValue v5(v);
+        QCOMPARE(v5.strictlyEquals(v), true);
+        v = QScriptValue();
+        QCOMPARE(v5.strictlyEquals(v), false);
+        QCOMPARE(v5.toNumber(), 1.0);
+    }
+
+    // 0 engine
+    QVERIFY(QScriptValue(0, QScriptValue::UndefinedValue).isUndefined());
+    QVERIFY(QScriptValue(0, QScriptValue::NullValue).isNull());
+    QVERIFY(QScriptValue(0, false).isBool());
+    QVERIFY(QScriptValue(0, int(1)).isNumber());
+    QVERIFY(QScriptValue(0, uint(1)).isNumber());
+    QVERIFY(QScriptValue(0, 1.0).isNumber());
+    QVERIFY(QScriptValue(0, "ciao").isString());
+    QVERIFY(QScriptValue(0, QString("ciao")).isString());
+}
+
+void tst_QScriptValue::toStringSimple_data()
+{
+    QTest::addColumn<QString>("code");
+    QTest::addColumn<QString>("result");
+
+    QTest::newRow("string") << QString::fromAscii("'hello'") << QString::fromAscii("hello");
+    QTest::newRow("string utf") << QString::fromUtf8("'ąśćżźółńę'") << QString::fromUtf8("ąśćżźółńę");
+    QTest::newRow("expression") << QString::fromAscii("1 + 4") << QString::fromAscii("5");
+    QTest::newRow("null") << QString::fromAscii("null") << QString::fromAscii("null");
+    QTest::newRow("boolean") << QString::fromAscii("false") << QString::fromAscii("false");
+    QTest::newRow("undefined") << QString::fromAscii("undefined") << QString::fromAscii("undefined");
+    QTest::newRow("object") << QString::fromAscii("new Object") << QString::fromAscii("[object Object]");
+}
+
+/* Test conversion to string from different JSC types */
+void tst_QScriptValue::toStringSimple()
+{
+    QFETCH(QString, code);
+    QFETCH(QString, result);
+
+    QScriptEngine engine;
+    QCOMPARE(engine.evaluate(code).toString(), result);
+}
+
+void tst_QScriptValue::copyConstructor_data()
+{
+    QScriptEngine engine;
+    QScriptValue nnumber(123);
+    QScriptValue nstring("ping");
+    QScriptValue number(engine.evaluate("1"));
+    QScriptValue string(engine.evaluate("'foo'"));
+    QScriptValue object(engine.evaluate("new Object"));
+    QScriptValue undefined(engine.evaluate("undefined"));
+    QScriptValue null(engine.evaluate("null"));
+
+    QTest::addColumn<QScriptValue>("value");
+    QTest::addColumn<QString>("result");
+
+    QTest::newRow("native number") << nnumber << QString::number(123);
+    QTest::newRow("native string") << nstring << QString("ping");
+    QTest::newRow("number") << number << QString::fromAscii("1");
+    QTest::newRow("string") << string << QString::fromAscii("foo");
+    QTest::newRow("object") << object << QString::fromAscii("[object Object]");
+    QTest::newRow("undefined") << undefined << QString::fromAscii("undefined");
+    QTest::newRow("null") << null << QString::fromAscii("null");
+}
+
+void tst_QScriptValue::copyConstructor()
+{
+    QFETCH(QScriptValue, value);
+    QFETCH(QString, result);
+
+    QVERIFY(value.isValid());
+    QScriptValue tmp(value);
+    QVERIFY(tmp.isValid());
+    QCOMPARE(tmp.toString(), result);
+}
+
+void tst_QScriptValue::assignOperator_data()
+{
+    copyConstructor_data();
+}
+
+void tst_QScriptValue::assignOperator()
+{
+    QFETCH(QScriptValue, value);
+    QFETCH(QString, result);
+
+    QScriptValue tmp;
+    tmp = value;
+    QVERIFY(tmp.isValid());
+    QCOMPARE(tmp.toString(), result);
+}
+
+/* Test internal data sharing between a diffrenet QScriptValue. */
+void tst_QScriptValue::dataSharing()
+{
+    QScriptEngine engine;
+    QScriptValue v1;
+    QScriptValue v2(v1);
+
+    v1 = engine.evaluate("1"); // v1 == 1 ; v2 invalid.
+    QVERIFY(v1.isValid());
+    QVERIFY(!v2.isValid());
+
+    v2 = v1; // v1 == 1; v2 == 1.
+    QVERIFY(v1.isValid());
+    QVERIFY(v2.isValid());
+
+    v1 = engine.evaluate("obj = new Date"); // v1 == [object Date] ; v2 == 1.
+    QVERIFY(v1.isValid());
+    QVERIFY(v2.isValid());
+    QVERIFY(v2.toString() != v1.toString());
+
+    // TODO add object manipulation (v1 and v2 point to the same object).
+}
+
+void tst_QScriptValue::constructors_data()
+{
+    QScriptEngine engine;
+
+    QTest::addColumn<QScriptValue>("value");
+    QTest::addColumn<QString>("string");
+    QTest::addColumn<bool>("valid");
+    QTest::addColumn<bool>("object");
+
+    QTest::newRow("invalid") << QScriptValue() << QString() << false << false;
+    QTest::newRow("number") << QScriptValue(-21) << QString::number(-21) << true << false;
+    QTest::newRow("bool") << QScriptValue(true) << QString::fromAscii("true") << true << false;
+    QTest::newRow("double") << QScriptValue(21.12) << QString::number(21.12) << true << false;
+    QTest::newRow("string") << QScriptValue("AlaMaKota") << QString::fromAscii("AlaMaKota") << true << false;
+    QTest::newRow("object") << engine.evaluate("new Object") << QString::fromAscii("[object Object]") << true << true;
+    QTest::newRow("null") << QScriptValue(QScriptValue::NullValue)<< QString::fromAscii("null") << true << false;
+    QTest::newRow("undef") << QScriptValue(QScriptValue::UndefinedValue)<< QString::fromAscii("undefined") << true << false;
+}
+
+void tst_QScriptValue::constructors()
+{
+    QFETCH(QScriptValue, value);
+    QFETCH(QString, string);
+    QFETCH(bool, valid);
+    QFETCH(bool, object);
+
+    QCOMPARE(value.isValid(), valid);
+    QCOMPARE(value.toString(), string);
+    QCOMPARE(value.isObject(), object);
+}
+
+void tst_QScriptValue::call()
+{
+    QScriptEngine engine;
+    QScriptValue ping = engine.evaluate("( function() {return 'ping';} )");
+    QScriptValue incr = engine.evaluate("( function(i) {return i + 1;} )");
+    QScriptValue one(1);
+    QScriptValue five(5);
+    QScriptValue result;
+
+    QVERIFY(one.isValid());
+    QVERIFY(five.isValid());
+
+    QVERIFY(ping.isValid());
+    QVERIFY(ping.isFunction());
+    result = ping.call();
+    QVERIFY(result.isValid());
+    QCOMPARE(result.toString(), QString::fromUtf8("ping"));
+
+    QVERIFY(incr.isValid());
+    QVERIFY(incr.isFunction());
+    result = incr.call(QScriptValue(), QScriptValueList() << one);
+    QVERIFY(result.isValid());
+    QCOMPARE(result.toString(), QString("2"));
+
+    QCOMPARE(incr.call(QScriptValue(), QScriptValueList() << five).toString(), QString::fromAscii("6"));
+
+    QVERIFY(incr.call().isValid()); // Exception.
+}
+
+
+QTEST_MAIN(tst_QScriptValue)
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.h b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.h
new file mode 100644
index 0000000000..28154a9823
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.h
@@ -0,0 +1,196 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef tst_qscriptvalue_h
+#define tst_qscriptvalue_h
+
+#include "qscriptengine.h"
+#include "qscriptvalue.h"
+#include <QtCore/qnumeric.h>
+#include <QtTest/qtest.h>
+
+Q_DECLARE_METATYPE(QScriptValue*);
+Q_DECLARE_METATYPE(QScriptValue);
+
+class tst_QScriptValue : public QObject {
+    Q_OBJECT
+
+public:
+    tst_QScriptValue();
+    virtual ~tst_QScriptValue();
+
+private slots:
+    void toStringSimple_data();
+    void toStringSimple();
+    void copyConstructor_data();
+    void copyConstructor();
+    void assignOperator_data();
+    void assignOperator();
+    void dataSharing();
+    void constructors_data();
+    void constructors();
+    void call();
+    void ctor();
+
+    // Generated test functions.
+    void isBool_data();
+    void isBool();
+
+    void isBoolean_data();
+    void isBoolean();
+
+    void isNumber_data();
+    void isNumber();
+
+    void isFunction_data();
+    void isFunction();
+
+    void isNull_data();
+    void isNull();
+
+    void isObject_data();
+    void isObject();
+
+    void isString_data();
+    void isString();
+
+    void isUndefined_data();
+    void isUndefined();
+
+    void isValid_data();
+    void isValid();
+
+    void toString_data();
+    void toString();
+
+    void toNumber_data();
+    void toNumber();
+
+    void toBool_data();
+    void toBool();
+
+    void toBoolean_data();
+    void toBoolean();
+
+    void toInteger_data();
+    void toInteger();
+
+    void toInt32_data();
+    void toInt32();
+
+    void toUInt32_data();
+    void toUInt32();
+
+    void toUInt16_data();
+    void toUInt16();
+
+private:
+    typedef void (tst_QScriptValue::*InitDataFunction)();
+    typedef void (tst_QScriptValue::*DefineDataFunction)(const char*);
+    void dataHelper(InitDataFunction init, DefineDataFunction define);
+    QTestData& newRow(const char* tag);
+
+    typedef void (tst_QScriptValue::*TestFunction)(const char*, const QScriptValue&);
+    void testHelper(TestFunction fun);
+
+    // Generated functions
+
+    void initScriptValues();
+
+    void isBool_initData();
+    void isBool_makeData(const char* expr);
+    void isBool_test(const char* expr, const QScriptValue& value);
+
+    void isBoolean_initData();
+    void isBoolean_makeData(const char* expr);
+    void isBoolean_test(const char* expr, const QScriptValue& value);
+
+    void isNumber_initData();
+    void isNumber_makeData(const char* expr);
+    void isNumber_test(const char* expr, const QScriptValue&);
+
+    void isFunction_initData();
+    void isFunction_makeData(const char* expr);
+    void isFunction_test(const char* expr, const QScriptValue& value);
+
+    void isNull_initData();
+    void isNull_makeData(const char* expr);
+    void isNull_test(const char* expr, const QScriptValue& value);
+
+    void isObject_initData();
+    void isObject_makeData(const char* expr);
+    void isObject_test(const char* expr, const QScriptValue& value);
+
+    void isString_initData();
+    void isString_makeData(const char* expr);
+    void isString_test(const char* expr, const QScriptValue& value);
+
+    void isUndefined_initData();
+    void isUndefined_makeData(const char* expr);
+    void isUndefined_test(const char* expr, const QScriptValue& value);
+
+    void isValid_initData();
+    void isValid_makeData(const char* expr);
+    void isValid_test(const char* expr, const QScriptValue& value);
+
+    void toString_initData();
+    void toString_makeData(const char*);
+    void toString_test(const char*, const QScriptValue&);
+
+    void toNumber_initData();
+    void toNumber_makeData(const char*);
+    void toNumber_test(const char*, const QScriptValue&);
+
+    void toBool_initData();
+    void toBool_makeData(const char*);
+    void toBool_test(const char*, const QScriptValue&);
+
+    void toBoolean_initData();
+    void toBoolean_makeData(const char*);
+    void toBoolean_test(const char*, const QScriptValue&);
+
+    void toInteger_initData();
+    void toInteger_makeData(const char*);
+    void toInteger_test(const char*, const QScriptValue&);
+
+    void toInt32_initData();
+    void toInt32_makeData(const char*);
+    void toInt32_test(const char*, const QScriptValue&);
+
+    void toUInt32_initData();
+    void toUInt32_makeData(const char*);
+    void toUInt32_test(const char*, const QScriptValue&);
+
+    void toUInt16_initData();
+    void toUInt16_makeData(const char*);
+    void toUInt16_test(const char*, const QScriptValue&);
+
+private:
+    QScriptEngine* engine;
+    QHash<QString, QScriptValue> m_values;
+    QString m_currentExpression;
+};
+
+#define DEFINE_TEST_FUNCTION(name) \
+void tst_QScriptValue::name##_data() { dataHelper(&tst_QScriptValue::name##_initData, &tst_QScriptValue::name##_makeData); } \
+void tst_QScriptValue::name() { testHelper(&tst_QScriptValue::name##_test); }
+
+
+
+#endif // tst_qscriptvalue_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp
new file mode 100644
index 0000000000..970c96083a
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp
@@ -0,0 +1,1922 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "tst_qscriptvalue.h"
+
+#define DEFINE_TEST_VALUE(expr) m_values.insert(QString::fromLatin1(#expr), expr)
+
+void tst_QScriptValue::initScriptValues()
+{
+    m_values.clear();
+    if (engine)
+        delete engine;
+    engine = new QScriptEngine;
+    DEFINE_TEST_VALUE(QScriptValue());
+    DEFINE_TEST_VALUE(QScriptValue(QScriptValue::UndefinedValue));
+    DEFINE_TEST_VALUE(QScriptValue(QScriptValue::NullValue));
+    DEFINE_TEST_VALUE(QScriptValue(true));
+    DEFINE_TEST_VALUE(QScriptValue(false));
+    DEFINE_TEST_VALUE(QScriptValue(int(122)));
+    DEFINE_TEST_VALUE(QScriptValue(uint(124)));
+    DEFINE_TEST_VALUE(QScriptValue(0));
+    DEFINE_TEST_VALUE(QScriptValue(0.0));
+    DEFINE_TEST_VALUE(QScriptValue(123.0));
+    DEFINE_TEST_VALUE(QScriptValue(6.37e-8));
+    DEFINE_TEST_VALUE(QScriptValue(-6.37e-8));
+    DEFINE_TEST_VALUE(QScriptValue(0x43211234));
+    DEFINE_TEST_VALUE(QScriptValue(0x10000));
+    DEFINE_TEST_VALUE(QScriptValue(0x10001));
+    DEFINE_TEST_VALUE(QScriptValue(qSNaN()));
+    DEFINE_TEST_VALUE(QScriptValue(qQNaN()));
+    DEFINE_TEST_VALUE(QScriptValue(qInf()));
+    DEFINE_TEST_VALUE(QScriptValue(-qInf()));
+    DEFINE_TEST_VALUE(QScriptValue("NaN"));
+    DEFINE_TEST_VALUE(QScriptValue("Infinity"));
+    DEFINE_TEST_VALUE(QScriptValue("-Infinity"));
+    DEFINE_TEST_VALUE(QScriptValue("ciao"));
+    DEFINE_TEST_VALUE(QScriptValue(QString::fromLatin1("ciao")));
+    DEFINE_TEST_VALUE(QScriptValue(QString("")));
+    DEFINE_TEST_VALUE(QScriptValue(QString()));
+    DEFINE_TEST_VALUE(QScriptValue(QString("0")));
+    DEFINE_TEST_VALUE(QScriptValue(QString("123")));
+    DEFINE_TEST_VALUE(QScriptValue(QString("12.4")));
+    DEFINE_TEST_VALUE(QScriptValue(0, QScriptValue::UndefinedValue));
+    DEFINE_TEST_VALUE(QScriptValue(0, QScriptValue::NullValue));
+    DEFINE_TEST_VALUE(QScriptValue(0, true));
+    DEFINE_TEST_VALUE(QScriptValue(0, false));
+    DEFINE_TEST_VALUE(QScriptValue(0, int(122)));
+    DEFINE_TEST_VALUE(QScriptValue(0, uint(124)));
+    DEFINE_TEST_VALUE(QScriptValue(0, 0));
+    DEFINE_TEST_VALUE(QScriptValue(0, 0.0));
+    DEFINE_TEST_VALUE(QScriptValue(0, 123.0));
+    DEFINE_TEST_VALUE(QScriptValue(0, 6.37e-8));
+    DEFINE_TEST_VALUE(QScriptValue(0, -6.37e-8));
+    DEFINE_TEST_VALUE(QScriptValue(0, 0x43211234));
+    DEFINE_TEST_VALUE(QScriptValue(0, 0x10000));
+    DEFINE_TEST_VALUE(QScriptValue(0, 0x10001));
+    DEFINE_TEST_VALUE(QScriptValue(0, qSNaN()));
+    DEFINE_TEST_VALUE(QScriptValue(0, qQNaN()));
+    DEFINE_TEST_VALUE(QScriptValue(0, qInf()));
+    DEFINE_TEST_VALUE(QScriptValue(0, -qInf()));
+    DEFINE_TEST_VALUE(QScriptValue(0, "NaN"));
+    DEFINE_TEST_VALUE(QScriptValue(0, "Infinity"));
+    DEFINE_TEST_VALUE(QScriptValue(0, "-Infinity"));
+    DEFINE_TEST_VALUE(QScriptValue(0, "ciao"));
+    DEFINE_TEST_VALUE(QScriptValue(0, QString::fromLatin1("ciao")));
+    DEFINE_TEST_VALUE(QScriptValue(0, QString("")));
+    DEFINE_TEST_VALUE(QScriptValue(0, QString()));
+    DEFINE_TEST_VALUE(QScriptValue(0, QString("0")));
+    DEFINE_TEST_VALUE(QScriptValue(0, QString("123")));
+    DEFINE_TEST_VALUE(QScriptValue(0, QString("12.3")));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QScriptValue::UndefinedValue));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QScriptValue::NullValue));
+    DEFINE_TEST_VALUE(QScriptValue(engine, true));
+    DEFINE_TEST_VALUE(QScriptValue(engine, false));
+    DEFINE_TEST_VALUE(QScriptValue(engine, int(122)));
+    DEFINE_TEST_VALUE(QScriptValue(engine, uint(124)));
+    DEFINE_TEST_VALUE(QScriptValue(engine, 0));
+    DEFINE_TEST_VALUE(QScriptValue(engine, 0.0));
+    DEFINE_TEST_VALUE(QScriptValue(engine, 123.0));
+    DEFINE_TEST_VALUE(QScriptValue(engine, 6.37e-8));
+    DEFINE_TEST_VALUE(QScriptValue(engine, -6.37e-8));
+    DEFINE_TEST_VALUE(QScriptValue(engine, 0x43211234));
+    DEFINE_TEST_VALUE(QScriptValue(engine, 0x10000));
+    DEFINE_TEST_VALUE(QScriptValue(engine, 0x10001));
+    DEFINE_TEST_VALUE(QScriptValue(engine, qSNaN()));
+    DEFINE_TEST_VALUE(QScriptValue(engine, qQNaN()));
+    DEFINE_TEST_VALUE(QScriptValue(engine, qInf()));
+    DEFINE_TEST_VALUE(QScriptValue(engine, -qInf()));
+    DEFINE_TEST_VALUE(QScriptValue(engine, "NaN"));
+    DEFINE_TEST_VALUE(QScriptValue(engine, "Infinity"));
+    DEFINE_TEST_VALUE(QScriptValue(engine, "-Infinity"));
+    DEFINE_TEST_VALUE(QScriptValue(engine, "ciao"));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QString::fromLatin1("ciao")));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QString("")));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QString()));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QString("0")));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QString("123")));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QString("1.23")));
+    DEFINE_TEST_VALUE(engine->evaluate("[]"));
+    DEFINE_TEST_VALUE(engine->evaluate("{}"));
+    DEFINE_TEST_VALUE(engine->evaluate("Object.prototype"));
+    DEFINE_TEST_VALUE(engine->evaluate("Date.prototype"));
+    DEFINE_TEST_VALUE(engine->evaluate("Array.prototype"));
+    DEFINE_TEST_VALUE(engine->evaluate("Function.prototype"));
+    DEFINE_TEST_VALUE(engine->evaluate("Error.prototype"));
+    DEFINE_TEST_VALUE(engine->evaluate("Object"));
+    DEFINE_TEST_VALUE(engine->evaluate("Array"));
+    DEFINE_TEST_VALUE(engine->evaluate("Number"));
+    DEFINE_TEST_VALUE(engine->evaluate("Function"));
+    DEFINE_TEST_VALUE(engine->evaluate("(function() { return 1; })"));
+    DEFINE_TEST_VALUE(engine->evaluate("(function() { return 'ciao'; })"));
+    DEFINE_TEST_VALUE(engine->evaluate("(function() { throw new Error('foo'); })"));
+    DEFINE_TEST_VALUE(engine->evaluate("/foo/"));
+    DEFINE_TEST_VALUE(engine->evaluate("new Object()"));
+    DEFINE_TEST_VALUE(engine->evaluate("new Array()"));
+    DEFINE_TEST_VALUE(engine->evaluate("new Error()"));
+    DEFINE_TEST_VALUE(engine->evaluate("a = new Object(); a.foo = 22; a.foo"));
+    DEFINE_TEST_VALUE(engine->evaluate("Undefined"));
+    DEFINE_TEST_VALUE(engine->evaluate("Null"));
+    DEFINE_TEST_VALUE(engine->evaluate("True"));
+    DEFINE_TEST_VALUE(engine->evaluate("False"));
+    DEFINE_TEST_VALUE(engine->evaluate("undefined"));
+    DEFINE_TEST_VALUE(engine->evaluate("null"));
+    DEFINE_TEST_VALUE(engine->evaluate("true"));
+    DEFINE_TEST_VALUE(engine->evaluate("false"));
+    DEFINE_TEST_VALUE(engine->evaluate("122"));
+    DEFINE_TEST_VALUE(engine->evaluate("124"));
+    DEFINE_TEST_VALUE(engine->evaluate("0"));
+    DEFINE_TEST_VALUE(engine->evaluate("0.0"));
+    DEFINE_TEST_VALUE(engine->evaluate("123.0"));
+    DEFINE_TEST_VALUE(engine->evaluate("6.37e-8"));
+    DEFINE_TEST_VALUE(engine->evaluate("-6.37e-8"));
+    DEFINE_TEST_VALUE(engine->evaluate("0x43211234"));
+    DEFINE_TEST_VALUE(engine->evaluate("0x10000"));
+    DEFINE_TEST_VALUE(engine->evaluate("0x10001"));
+    DEFINE_TEST_VALUE(engine->evaluate("NaN"));
+    DEFINE_TEST_VALUE(engine->evaluate("Infinity"));
+    DEFINE_TEST_VALUE(engine->evaluate("-Infinity"));
+    DEFINE_TEST_VALUE(engine->evaluate("'ciao'"));
+    DEFINE_TEST_VALUE(engine->evaluate("''"));
+    DEFINE_TEST_VALUE(engine->evaluate("'0'"));
+    DEFINE_TEST_VALUE(engine->evaluate("'123'"));
+    DEFINE_TEST_VALUE(engine->evaluate("'12.4'"));
+    DEFINE_TEST_VALUE(engine->nullValue());
+    DEFINE_TEST_VALUE(engine->undefinedValue());
+}
+
+
+void tst_QScriptValue::isValid_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isValid_makeData(const char* expr)
+{
+    static QSet<QString> isValid;
+    if (isValid.isEmpty()) {
+        isValid << "QScriptValue(QScriptValue::UndefinedValue)"
+                << "QScriptValue(QScriptValue::NullValue)"
+                << "QScriptValue(true)"
+                << "QScriptValue(false)"
+                << "QScriptValue(int(122))"
+                << "QScriptValue(uint(124))"
+                << "QScriptValue(0)"
+                << "QScriptValue(0.0)"
+                << "QScriptValue(123.0)"
+                << "QScriptValue(6.37e-8)"
+                << "QScriptValue(-6.37e-8)"
+                << "QScriptValue(0x43211234)"
+                << "QScriptValue(0x10000)"
+                << "QScriptValue(0x10001)"
+                << "QScriptValue(qSNaN())"
+                << "QScriptValue(qQNaN())"
+                << "QScriptValue(qInf())"
+                << "QScriptValue(-qInf())"
+                << "QScriptValue(\"NaN\")"
+                << "QScriptValue(\"Infinity\")"
+                << "QScriptValue(\"-Infinity\")"
+                << "QScriptValue(\"ciao\")"
+                << "QScriptValue(QString::fromLatin1(\"ciao\"))"
+                << "QScriptValue(QString(\"\"))"
+                << "QScriptValue(QString())"
+                << "QScriptValue(QString(\"0\"))"
+                << "QScriptValue(QString(\"123\"))"
+                << "QScriptValue(QString(\"12.4\"))"
+                << "QScriptValue(0, QScriptValue::UndefinedValue)"
+                << "QScriptValue(0, QScriptValue::NullValue)"
+                << "QScriptValue(0, true)"
+                << "QScriptValue(0, false)"
+                << "QScriptValue(0, int(122))"
+                << "QScriptValue(0, uint(124))"
+                << "QScriptValue(0, 0)"
+                << "QScriptValue(0, 0.0)"
+                << "QScriptValue(0, 123.0)"
+                << "QScriptValue(0, 6.37e-8)"
+                << "QScriptValue(0, -6.37e-8)"
+                << "QScriptValue(0, 0x43211234)"
+                << "QScriptValue(0, 0x10000)"
+                << "QScriptValue(0, 0x10001)"
+                << "QScriptValue(0, qSNaN())"
+                << "QScriptValue(0, qQNaN())"
+                << "QScriptValue(0, qInf())"
+                << "QScriptValue(0, -qInf())"
+                << "QScriptValue(0, \"NaN\")"
+                << "QScriptValue(0, \"Infinity\")"
+                << "QScriptValue(0, \"-Infinity\")"
+                << "QScriptValue(0, \"ciao\")"
+                << "QScriptValue(0, QString::fromLatin1(\"ciao\"))"
+                << "QScriptValue(0, QString(\"\"))"
+                << "QScriptValue(0, QString())"
+                << "QScriptValue(0, QString(\"0\"))"
+                << "QScriptValue(0, QString(\"123\"))"
+                << "QScriptValue(0, QString(\"12.3\"))"
+                << "QScriptValue(engine, QScriptValue::UndefinedValue)"
+                << "QScriptValue(engine, QScriptValue::NullValue)"
+                << "QScriptValue(engine, true)"
+                << "QScriptValue(engine, false)"
+                << "QScriptValue(engine, int(122))"
+                << "QScriptValue(engine, uint(124))"
+                << "QScriptValue(engine, 0)"
+                << "QScriptValue(engine, 0.0)"
+                << "QScriptValue(engine, 123.0)"
+                << "QScriptValue(engine, 6.37e-8)"
+                << "QScriptValue(engine, -6.37e-8)"
+                << "QScriptValue(engine, 0x43211234)"
+                << "QScriptValue(engine, 0x10000)"
+                << "QScriptValue(engine, 0x10001)"
+                << "QScriptValue(engine, qSNaN())"
+                << "QScriptValue(engine, qQNaN())"
+                << "QScriptValue(engine, qInf())"
+                << "QScriptValue(engine, -qInf())"
+                << "QScriptValue(engine, \"NaN\")"
+                << "QScriptValue(engine, \"Infinity\")"
+                << "QScriptValue(engine, \"-Infinity\")"
+                << "QScriptValue(engine, \"ciao\")"
+                << "QScriptValue(engine, QString::fromLatin1(\"ciao\"))"
+                << "QScriptValue(engine, QString(\"\"))"
+                << "QScriptValue(engine, QString())"
+                << "QScriptValue(engine, QString(\"0\"))"
+                << "QScriptValue(engine, QString(\"123\"))"
+                << "QScriptValue(engine, QString(\"1.23\"))"
+                << "engine->evaluate(\"[]\")"
+                << "engine->evaluate(\"{}\")"
+                << "engine->evaluate(\"Object.prototype\")"
+                << "engine->evaluate(\"Date.prototype\")"
+                << "engine->evaluate(\"Array.prototype\")"
+                << "engine->evaluate(\"Function.prototype\")"
+                << "engine->evaluate(\"Error.prototype\")"
+                << "engine->evaluate(\"Object\")"
+                << "engine->evaluate(\"Array\")"
+                << "engine->evaluate(\"Number\")"
+                << "engine->evaluate(\"Function\")"
+                << "engine->evaluate(\"(function() { return 1; })\")"
+                << "engine->evaluate(\"(function() { return 'ciao'; })\")"
+                << "engine->evaluate(\"(function() { throw new Error('foo'); })\")"
+                << "engine->evaluate(\"/foo/\")"
+                << "engine->evaluate(\"new Object()\")"
+                << "engine->evaluate(\"new Array()\")"
+                << "engine->evaluate(\"new Error()\")"
+                << "engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")"
+                << "engine->evaluate(\"Undefined\")"
+                << "engine->evaluate(\"Null\")"
+                << "engine->evaluate(\"True\")"
+                << "engine->evaluate(\"False\")"
+                << "engine->evaluate(\"undefined\")"
+                << "engine->evaluate(\"null\")"
+                << "engine->evaluate(\"true\")"
+                << "engine->evaluate(\"false\")"
+                << "engine->evaluate(\"122\")"
+                << "engine->evaluate(\"124\")"
+                << "engine->evaluate(\"0\")"
+                << "engine->evaluate(\"0.0\")"
+                << "engine->evaluate(\"123.0\")"
+                << "engine->evaluate(\"6.37e-8\")"
+                << "engine->evaluate(\"-6.37e-8\")"
+                << "engine->evaluate(\"0x43211234\")"
+                << "engine->evaluate(\"0x10000\")"
+                << "engine->evaluate(\"0x10001\")"
+                << "engine->evaluate(\"NaN\")"
+                << "engine->evaluate(\"Infinity\")"
+                << "engine->evaluate(\"-Infinity\")"
+                << "engine->evaluate(\"'ciao'\")"
+                << "engine->evaluate(\"''\")"
+                << "engine->evaluate(\"'0'\")"
+                << "engine->evaluate(\"'123'\")"
+                << "engine->evaluate(\"'12.4'\")"
+                << "engine->nullValue()"
+                << "engine->undefinedValue()";
+    }
+    newRow(expr) << isValid.contains(expr);
+}
+
+void tst_QScriptValue::isValid_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isValid(), expected);
+    QCOMPARE(value.isValid(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isValid)
+
+
+void tst_QScriptValue::isBool_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isBool_makeData(const char* expr)
+{
+    static QSet<QString> isBool;
+    if (isBool.isEmpty()) {
+        isBool << "QScriptValue(true)"
+                << "QScriptValue(false)"
+                << "QScriptValue(0, true)"
+                << "QScriptValue(0, false)"
+                << "QScriptValue(engine, true)"
+                << "QScriptValue(engine, false)"
+                << "engine->evaluate(\"true\")"
+                << "engine->evaluate(\"false\")";
+    }
+    newRow(expr) << isBool.contains(expr);
+}
+
+void tst_QScriptValue::isBool_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isBool(), expected);
+    QCOMPARE(value.isBool(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isBool)
+
+
+void tst_QScriptValue::isBoolean_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isBoolean_makeData(const char* expr)
+{
+    static QSet<QString> isBoolean;
+    if (isBoolean.isEmpty()) {
+        isBoolean << "QScriptValue(true)"
+                << "QScriptValue(false)"
+                << "QScriptValue(0, true)"
+                << "QScriptValue(0, false)"
+                << "QScriptValue(engine, true)"
+                << "QScriptValue(engine, false)"
+                << "engine->evaluate(\"true\")"
+                << "engine->evaluate(\"false\")";
+    }
+    newRow(expr) << isBoolean.contains(expr);
+}
+
+void tst_QScriptValue::isBoolean_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isBoolean(), expected);
+    QCOMPARE(value.isBoolean(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isBoolean)
+
+
+void tst_QScriptValue::isNumber_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isNumber_makeData(const char* expr)
+{
+    static QSet<QString> isNumber;
+    if (isNumber.isEmpty()) {
+        isNumber << "QScriptValue(int(122))"
+                << "QScriptValue(uint(124))"
+                << "QScriptValue(0)"
+                << "QScriptValue(0.0)"
+                << "QScriptValue(123.0)"
+                << "QScriptValue(6.37e-8)"
+                << "QScriptValue(-6.37e-8)"
+                << "QScriptValue(0x43211234)"
+                << "QScriptValue(0x10000)"
+                << "QScriptValue(0x10001)"
+                << "QScriptValue(qSNaN())"
+                << "QScriptValue(qQNaN())"
+                << "QScriptValue(qInf())"
+                << "QScriptValue(-qInf())"
+                << "QScriptValue(0, int(122))"
+                << "QScriptValue(0, uint(124))"
+                << "QScriptValue(0, 0)"
+                << "QScriptValue(0, 0.0)"
+                << "QScriptValue(0, 123.0)"
+                << "QScriptValue(0, 6.37e-8)"
+                << "QScriptValue(0, -6.37e-8)"
+                << "QScriptValue(0, 0x43211234)"
+                << "QScriptValue(0, 0x10000)"
+                << "QScriptValue(0, 0x10001)"
+                << "QScriptValue(0, qSNaN())"
+                << "QScriptValue(0, qQNaN())"
+                << "QScriptValue(0, qInf())"
+                << "QScriptValue(0, -qInf())"
+                << "QScriptValue(engine, int(122))"
+                << "QScriptValue(engine, uint(124))"
+                << "QScriptValue(engine, 0)"
+                << "QScriptValue(engine, 0.0)"
+                << "QScriptValue(engine, 123.0)"
+                << "QScriptValue(engine, 6.37e-8)"
+                << "QScriptValue(engine, -6.37e-8)"
+                << "QScriptValue(engine, 0x43211234)"
+                << "QScriptValue(engine, 0x10000)"
+                << "QScriptValue(engine, 0x10001)"
+                << "QScriptValue(engine, qSNaN())"
+                << "QScriptValue(engine, qQNaN())"
+                << "QScriptValue(engine, qInf())"
+                << "QScriptValue(engine, -qInf())"
+                << "engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")"
+                << "engine->evaluate(\"122\")"
+                << "engine->evaluate(\"124\")"
+                << "engine->evaluate(\"0\")"
+                << "engine->evaluate(\"0.0\")"
+                << "engine->evaluate(\"123.0\")"
+                << "engine->evaluate(\"6.37e-8\")"
+                << "engine->evaluate(\"-6.37e-8\")"
+                << "engine->evaluate(\"0x43211234\")"
+                << "engine->evaluate(\"0x10000\")"
+                << "engine->evaluate(\"0x10001\")"
+                << "engine->evaluate(\"NaN\")"
+                << "engine->evaluate(\"Infinity\")"
+                << "engine->evaluate(\"-Infinity\")";
+    }
+    newRow(expr) << isNumber.contains(expr);
+}
+
+void tst_QScriptValue::isNumber_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isNumber(), expected);
+    QCOMPARE(value.isNumber(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isNumber)
+
+
+void tst_QScriptValue::isFunction_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isFunction_makeData(const char* expr)
+{
+    static QSet<QString> isFunction;
+    if (isFunction.isEmpty()) {
+        isFunction << "engine->evaluate(\"Function.prototype\")"
+                << "engine->evaluate(\"Object\")"
+                << "engine->evaluate(\"Array\")"
+                << "engine->evaluate(\"Number\")"
+                << "engine->evaluate(\"Function\")"
+                << "engine->evaluate(\"(function() { return 1; })\")"
+                << "engine->evaluate(\"(function() { return 'ciao'; })\")"
+                << "engine->evaluate(\"(function() { throw new Error('foo'); })\")"
+                << "engine->evaluate(\"/foo/\")";
+    }
+    newRow(expr) << isFunction.contains(expr);
+}
+
+void tst_QScriptValue::isFunction_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isFunction(), expected);
+    QCOMPARE(value.isFunction(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isFunction)
+
+
+void tst_QScriptValue::isNull_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isNull_makeData(const char* expr)
+{
+    static QSet<QString> isNull;
+    if (isNull.isEmpty()) {
+        isNull << "QScriptValue(QScriptValue::NullValue)"
+                << "QScriptValue(0, QScriptValue::NullValue)"
+                << "QScriptValue(engine, QScriptValue::NullValue)"
+                << "engine->evaluate(\"null\")"
+                << "engine->nullValue()";
+    }
+    newRow(expr) << isNull.contains(expr);
+}
+
+void tst_QScriptValue::isNull_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isNull(), expected);
+    QCOMPARE(value.isNull(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isNull)
+
+
+void tst_QScriptValue::isString_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isString_makeData(const char* expr)
+{
+    static QSet<QString> isString;
+    if (isString.isEmpty()) {
+        isString << "QScriptValue(\"NaN\")"
+                << "QScriptValue(\"Infinity\")"
+                << "QScriptValue(\"-Infinity\")"
+                << "QScriptValue(\"ciao\")"
+                << "QScriptValue(QString::fromLatin1(\"ciao\"))"
+                << "QScriptValue(QString(\"\"))"
+                << "QScriptValue(QString())"
+                << "QScriptValue(QString(\"0\"))"
+                << "QScriptValue(QString(\"123\"))"
+                << "QScriptValue(QString(\"12.4\"))"
+                << "QScriptValue(0, \"NaN\")"
+                << "QScriptValue(0, \"Infinity\")"
+                << "QScriptValue(0, \"-Infinity\")"
+                << "QScriptValue(0, \"ciao\")"
+                << "QScriptValue(0, QString::fromLatin1(\"ciao\"))"
+                << "QScriptValue(0, QString(\"\"))"
+                << "QScriptValue(0, QString())"
+                << "QScriptValue(0, QString(\"0\"))"
+                << "QScriptValue(0, QString(\"123\"))"
+                << "QScriptValue(0, QString(\"12.3\"))"
+                << "QScriptValue(engine, \"NaN\")"
+                << "QScriptValue(engine, \"Infinity\")"
+                << "QScriptValue(engine, \"-Infinity\")"
+                << "QScriptValue(engine, \"ciao\")"
+                << "QScriptValue(engine, QString::fromLatin1(\"ciao\"))"
+                << "QScriptValue(engine, QString(\"\"))"
+                << "QScriptValue(engine, QString())"
+                << "QScriptValue(engine, QString(\"0\"))"
+                << "QScriptValue(engine, QString(\"123\"))"
+                << "QScriptValue(engine, QString(\"1.23\"))"
+                << "engine->evaluate(\"'ciao'\")"
+                << "engine->evaluate(\"''\")"
+                << "engine->evaluate(\"'0'\")"
+                << "engine->evaluate(\"'123'\")"
+                << "engine->evaluate(\"'12.4'\")";
+    }
+    newRow(expr) << isString.contains(expr);
+}
+
+void tst_QScriptValue::isString_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isString(), expected);
+    QCOMPARE(value.isString(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isString)
+
+
+void tst_QScriptValue::isUndefined_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isUndefined_makeData(const char* expr)
+{
+    static QSet<QString> isUndefined;
+    if (isUndefined.isEmpty()) {
+        isUndefined << "QScriptValue(QScriptValue::UndefinedValue)"
+                << "QScriptValue(0, QScriptValue::UndefinedValue)"
+                << "QScriptValue(engine, QScriptValue::UndefinedValue)"
+                << "engine->evaluate(\"{}\")"
+                << "engine->evaluate(\"undefined\")"
+                << "engine->undefinedValue()";
+    }
+    newRow(expr) << isUndefined.contains(expr);
+}
+
+void tst_QScriptValue::isUndefined_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isUndefined(), expected);
+    QCOMPARE(value.isUndefined(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isUndefined)
+
+
+
+
+
+void tst_QScriptValue::isObject_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isObject_makeData(const char* expr)
+{
+    static QSet<QString> isObject;
+    if (isObject.isEmpty()) {
+        isObject << "engine->evaluate(\"[]\")"
+                << "engine->evaluate(\"Object.prototype\")"
+                << "engine->evaluate(\"Date.prototype\")"
+                << "engine->evaluate(\"Array.prototype\")"
+                << "engine->evaluate(\"Function.prototype\")"
+                << "engine->evaluate(\"Error.prototype\")"
+                << "engine->evaluate(\"Object\")"
+                << "engine->evaluate(\"Array\")"
+                << "engine->evaluate(\"Number\")"
+                << "engine->evaluate(\"Function\")"
+                << "engine->evaluate(\"(function() { return 1; })\")"
+                << "engine->evaluate(\"(function() { return 'ciao'; })\")"
+                << "engine->evaluate(\"(function() { throw new Error('foo'); })\")"
+                << "engine->evaluate(\"/foo/\")"
+                << "engine->evaluate(\"new Object()\")"
+                << "engine->evaluate(\"new Array()\")"
+                << "engine->evaluate(\"new Error()\")"
+                << "engine->evaluate(\"Undefined\")"
+                << "engine->evaluate(\"Null\")"
+                << "engine->evaluate(\"True\")"
+                << "engine->evaluate(\"False\")";
+    }
+    newRow(expr) << isObject.contains(expr);
+}
+
+void tst_QScriptValue::isObject_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isObject(), expected);
+    QCOMPARE(value.isObject(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isObject)
+
+
+void tst_QScriptValue::toString_initData()
+{
+    QTest::addColumn<QString>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toString_makeData(const char* expr)
+{
+    static QHash<QString, QString> toString;
+    if (toString.isEmpty()) {
+        toString.insert("QScriptValue()", "");
+        toString.insert("QScriptValue(QScriptValue::UndefinedValue)", "undefined");
+        toString.insert("QScriptValue(QScriptValue::NullValue)", "null");
+        toString.insert("QScriptValue(true)", "true");
+        toString.insert("QScriptValue(false)", "false");
+        toString.insert("QScriptValue(int(122))", "122");
+        toString.insert("QScriptValue(uint(124))", "124");
+        toString.insert("QScriptValue(0)", "0");
+        toString.insert("QScriptValue(0.0)", "0");
+        toString.insert("QScriptValue(123.0)", "123");
+        toString.insert("QScriptValue(6.37e-8)", "6.37e-8");
+        toString.insert("QScriptValue(-6.37e-8)", "-6.37e-8");
+        toString.insert("QScriptValue(0x43211234)", "1126240820");
+        toString.insert("QScriptValue(0x10000)", "65536");
+        toString.insert("QScriptValue(0x10001)", "65537");
+        toString.insert("QScriptValue(qSNaN())", "NaN");
+        toString.insert("QScriptValue(qQNaN())", "NaN");
+        toString.insert("QScriptValue(qInf())", "Infinity");
+        toString.insert("QScriptValue(-qInf())", "-Infinity");
+        toString.insert("QScriptValue(\"NaN\")", "NaN");
+        toString.insert("QScriptValue(\"Infinity\")", "Infinity");
+        toString.insert("QScriptValue(\"-Infinity\")", "-Infinity");
+        toString.insert("QScriptValue(\"ciao\")", "ciao");
+        toString.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", "ciao");
+        toString.insert("QScriptValue(QString(\"\"))", "");
+        toString.insert("QScriptValue(QString())", "");
+        toString.insert("QScriptValue(QString(\"0\"))", "0");
+        toString.insert("QScriptValue(QString(\"123\"))", "123");
+        toString.insert("QScriptValue(QString(\"12.4\"))", "12.4");
+        toString.insert("QScriptValue(0, QScriptValue::UndefinedValue)", "undefined");
+        toString.insert("QScriptValue(0, QScriptValue::NullValue)", "null");
+        toString.insert("QScriptValue(0, true)", "true");
+        toString.insert("QScriptValue(0, false)", "false");
+        toString.insert("QScriptValue(0, int(122))", "122");
+        toString.insert("QScriptValue(0, uint(124))", "124");
+        toString.insert("QScriptValue(0, 0)", "0");
+        toString.insert("QScriptValue(0, 0.0)", "0");
+        toString.insert("QScriptValue(0, 123.0)", "123");
+        toString.insert("QScriptValue(0, 6.37e-8)", "6.37e-8");
+        toString.insert("QScriptValue(0, -6.37e-8)", "-6.37e-8");
+        toString.insert("QScriptValue(0, 0x43211234)", "1126240820");
+        toString.insert("QScriptValue(0, 0x10000)", "65536");
+        toString.insert("QScriptValue(0, 0x10001)", "65537");
+        toString.insert("QScriptValue(0, qSNaN())", "NaN");
+        toString.insert("QScriptValue(0, qQNaN())", "NaN");
+        toString.insert("QScriptValue(0, qInf())", "Infinity");
+        toString.insert("QScriptValue(0, -qInf())", "-Infinity");
+        toString.insert("QScriptValue(0, \"NaN\")", "NaN");
+        toString.insert("QScriptValue(0, \"Infinity\")", "Infinity");
+        toString.insert("QScriptValue(0, \"-Infinity\")", "-Infinity");
+        toString.insert("QScriptValue(0, \"ciao\")", "ciao");
+        toString.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", "ciao");
+        toString.insert("QScriptValue(0, QString(\"\"))", "");
+        toString.insert("QScriptValue(0, QString())", "");
+        toString.insert("QScriptValue(0, QString(\"0\"))", "0");
+        toString.insert("QScriptValue(0, QString(\"123\"))", "123");
+        toString.insert("QScriptValue(0, QString(\"12.3\"))", "12.3");
+        toString.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", "undefined");
+        toString.insert("QScriptValue(engine, QScriptValue::NullValue)", "null");
+        toString.insert("QScriptValue(engine, true)", "true");
+        toString.insert("QScriptValue(engine, false)", "false");
+        toString.insert("QScriptValue(engine, int(122))", "122");
+        toString.insert("QScriptValue(engine, uint(124))", "124");
+        toString.insert("QScriptValue(engine, 0)", "0");
+        toString.insert("QScriptValue(engine, 0.0)", "0");
+        toString.insert("QScriptValue(engine, 123.0)", "123");
+        toString.insert("QScriptValue(engine, 6.37e-8)", "6.37e-8");
+        toString.insert("QScriptValue(engine, -6.37e-8)", "-6.37e-8");
+        toString.insert("QScriptValue(engine, 0x43211234)", "1126240820");
+        toString.insert("QScriptValue(engine, 0x10000)", "65536");
+        toString.insert("QScriptValue(engine, 0x10001)", "65537");
+        toString.insert("QScriptValue(engine, qSNaN())", "NaN");
+        toString.insert("QScriptValue(engine, qQNaN())", "NaN");
+        toString.insert("QScriptValue(engine, qInf())", "Infinity");
+        toString.insert("QScriptValue(engine, -qInf())", "-Infinity");
+        toString.insert("QScriptValue(engine, \"NaN\")", "NaN");
+        toString.insert("QScriptValue(engine, \"Infinity\")", "Infinity");
+        toString.insert("QScriptValue(engine, \"-Infinity\")", "-Infinity");
+        toString.insert("QScriptValue(engine, \"ciao\")", "ciao");
+        toString.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", "ciao");
+        toString.insert("QScriptValue(engine, QString(\"\"))", "");
+        toString.insert("QScriptValue(engine, QString())", "");
+        toString.insert("QScriptValue(engine, QString(\"0\"))", "0");
+        toString.insert("QScriptValue(engine, QString(\"123\"))", "123");
+        toString.insert("QScriptValue(engine, QString(\"1.23\"))", "1.23");
+        toString.insert("engine->evaluate(\"[]\")", "");
+        toString.insert("engine->evaluate(\"{}\")", "undefined");
+        toString.insert("engine->evaluate(\"Object.prototype\")", "[object Object]");
+        toString.insert("engine->evaluate(\"Date.prototype\")", "Invalid Date");
+        toString.insert("engine->evaluate(\"Array.prototype\")", "");
+        toString.insert("engine->evaluate(\"Function.prototype\")", "function () {\n    [native code]\n}");
+        toString.insert("engine->evaluate(\"Error.prototype\")", "Error: Unknown error");
+        toString.insert("engine->evaluate(\"Object\")", "function Object() {\n    [native code]\n}");
+        toString.insert("engine->evaluate(\"Array\")", "function Array() {\n    [native code]\n}");
+        toString.insert("engine->evaluate(\"Number\")", "function Number() {\n    [native code]\n}");
+        toString.insert("engine->evaluate(\"Function\")", "function Function() {\n    [native code]\n}");
+        toString.insert("engine->evaluate(\"(function() { return 1; })\")", "function () { return 1; }");
+        toString.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", "function () { return 'ciao'; }");
+        toString.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", "function () { throw new Error('foo'); }");
+        toString.insert("engine->evaluate(\"/foo/\")", "/foo/");
+        toString.insert("engine->evaluate(\"new Object()\")", "[object Object]");
+        toString.insert("engine->evaluate(\"new Array()\")", "");
+        toString.insert("engine->evaluate(\"new Error()\")", "Error: Unknown error");
+        toString.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", "22");
+        toString.insert("engine->evaluate(\"Undefined\")", "ReferenceError: Can't find variable: Undefined");
+        toString.insert("engine->evaluate(\"Null\")", "ReferenceError: Can't find variable: Null");
+        toString.insert("engine->evaluate(\"True\")", "ReferenceError: Can't find variable: True");
+        toString.insert("engine->evaluate(\"False\")", "ReferenceError: Can't find variable: False");
+        toString.insert("engine->evaluate(\"undefined\")", "undefined");
+        toString.insert("engine->evaluate(\"null\")", "null");
+        toString.insert("engine->evaluate(\"true\")", "true");
+        toString.insert("engine->evaluate(\"false\")", "false");
+        toString.insert("engine->evaluate(\"122\")", "122");
+        toString.insert("engine->evaluate(\"124\")", "124");
+        toString.insert("engine->evaluate(\"0\")", "0");
+        toString.insert("engine->evaluate(\"0.0\")", "0");
+        toString.insert("engine->evaluate(\"123.0\")", "123");
+        toString.insert("engine->evaluate(\"6.37e-8\")", "6.37e-8");
+        toString.insert("engine->evaluate(\"-6.37e-8\")", "-6.37e-8");
+        toString.insert("engine->evaluate(\"0x43211234\")", "1126240820");
+        toString.insert("engine->evaluate(\"0x10000\")", "65536");
+        toString.insert("engine->evaluate(\"0x10001\")", "65537");
+        toString.insert("engine->evaluate(\"NaN\")", "NaN");
+        toString.insert("engine->evaluate(\"Infinity\")", "Infinity");
+        toString.insert("engine->evaluate(\"-Infinity\")", "-Infinity");
+        toString.insert("engine->evaluate(\"'ciao'\")", "ciao");
+        toString.insert("engine->evaluate(\"''\")", "");
+        toString.insert("engine->evaluate(\"'0'\")", "0");
+        toString.insert("engine->evaluate(\"'123'\")", "123");
+        toString.insert("engine->evaluate(\"'12.4'\")", "12.4");
+        toString.insert("engine->nullValue()", "null");
+        toString.insert("engine->undefinedValue()", "undefined");
+    }
+    newRow(expr) << toString.value(expr);
+}
+
+void tst_QScriptValue::toString_test(const char*, const QScriptValue& value)
+{
+    QFETCH(QString, expected);
+    QCOMPARE(value.toString(), expected);
+    QCOMPARE(value.toString(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toString)
+
+
+void tst_QScriptValue::toNumber_initData()
+{
+    QTest::addColumn<qsreal>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toNumber_makeData(const char* expr)
+{
+    static QHash<QString, qsreal> toNumber;
+    if (toNumber.isEmpty()) {
+        toNumber.insert("QScriptValue()", 0);
+        toNumber.insert("QScriptValue(QScriptValue::UndefinedValue)", qQNaN());
+        toNumber.insert("QScriptValue(QScriptValue::NullValue)", 0);
+        toNumber.insert("QScriptValue(true)", 1);
+        toNumber.insert("QScriptValue(false)", 0);
+        toNumber.insert("QScriptValue(int(122))", 122);
+        toNumber.insert("QScriptValue(uint(124))", 124);
+        toNumber.insert("QScriptValue(0)", 0);
+        toNumber.insert("QScriptValue(0.0)", 0);
+        toNumber.insert("QScriptValue(123.0)", 123);
+        toNumber.insert("QScriptValue(6.37e-8)", 6.369999999999999e-08);
+        toNumber.insert("QScriptValue(-6.37e-8)", -6.369999999999999e-08);
+        toNumber.insert("QScriptValue(0x43211234)", 1126240820);
+        toNumber.insert("QScriptValue(0x10000)", 65536);
+        toNumber.insert("QScriptValue(0x10001)", 65537);
+        toNumber.insert("QScriptValue(qSNaN())", qQNaN());
+        toNumber.insert("QScriptValue(qQNaN())", qQNaN());
+        toNumber.insert("QScriptValue(qInf())", qInf());
+        toNumber.insert("QScriptValue(-qInf())", qInf());
+        toNumber.insert("QScriptValue(\"NaN\")", qQNaN());
+        toNumber.insert("QScriptValue(\"Infinity\")", qInf());
+        toNumber.insert("QScriptValue(\"-Infinity\")", qInf());
+        toNumber.insert("QScriptValue(\"ciao\")", qQNaN());
+        toNumber.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", qQNaN());
+        toNumber.insert("QScriptValue(QString(\"\"))", 0);
+        toNumber.insert("QScriptValue(QString())", 0);
+        toNumber.insert("QScriptValue(QString(\"0\"))", 0);
+        toNumber.insert("QScriptValue(QString(\"123\"))", 123);
+        toNumber.insert("QScriptValue(QString(\"12.4\"))", 12.4);
+        toNumber.insert("QScriptValue(0, QScriptValue::UndefinedValue)", qQNaN());
+        toNumber.insert("QScriptValue(0, QScriptValue::NullValue)", 0);
+        toNumber.insert("QScriptValue(0, true)", 1);
+        toNumber.insert("QScriptValue(0, false)", 0);
+        toNumber.insert("QScriptValue(0, int(122))", 122);
+        toNumber.insert("QScriptValue(0, uint(124))", 124);
+        toNumber.insert("QScriptValue(0, 0)", 0);
+        toNumber.insert("QScriptValue(0, 0.0)", 0);
+        toNumber.insert("QScriptValue(0, 123.0)", 123);
+        toNumber.insert("QScriptValue(0, 6.37e-8)", 6.369999999999999e-08);
+        toNumber.insert("QScriptValue(0, -6.37e-8)", -6.369999999999999e-08);
+        toNumber.insert("QScriptValue(0, 0x43211234)", 1126240820);
+        toNumber.insert("QScriptValue(0, 0x10000)", 65536);
+        toNumber.insert("QScriptValue(0, 0x10001)", 65537);
+        toNumber.insert("QScriptValue(0, qSNaN())", qQNaN());
+        toNumber.insert("QScriptValue(0, qQNaN())", qQNaN());
+        toNumber.insert("QScriptValue(0, qInf())", qInf());
+        toNumber.insert("QScriptValue(0, -qInf())", qInf());
+        toNumber.insert("QScriptValue(0, \"NaN\")", qQNaN());
+        toNumber.insert("QScriptValue(0, \"Infinity\")", qInf());
+        toNumber.insert("QScriptValue(0, \"-Infinity\")", qInf());
+        toNumber.insert("QScriptValue(0, \"ciao\")", qQNaN());
+        toNumber.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", qQNaN());
+        toNumber.insert("QScriptValue(0, QString(\"\"))", 0);
+        toNumber.insert("QScriptValue(0, QString())", 0);
+        toNumber.insert("QScriptValue(0, QString(\"0\"))", 0);
+        toNumber.insert("QScriptValue(0, QString(\"123\"))", 123);
+        toNumber.insert("QScriptValue(0, QString(\"12.3\"))", 12.3);
+        toNumber.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", qQNaN());
+        toNumber.insert("QScriptValue(engine, QScriptValue::NullValue)", 0);
+        toNumber.insert("QScriptValue(engine, true)", 1);
+        toNumber.insert("QScriptValue(engine, false)", 0);
+        toNumber.insert("QScriptValue(engine, int(122))", 122);
+        toNumber.insert("QScriptValue(engine, uint(124))", 124);
+        toNumber.insert("QScriptValue(engine, 0)", 0);
+        toNumber.insert("QScriptValue(engine, 0.0)", 0);
+        toNumber.insert("QScriptValue(engine, 123.0)", 123);
+        toNumber.insert("QScriptValue(engine, 6.37e-8)", 6.369999999999999e-08);
+        toNumber.insert("QScriptValue(engine, -6.37e-8)", -6.369999999999999e-08);
+        toNumber.insert("QScriptValue(engine, 0x43211234)", 1126240820);
+        toNumber.insert("QScriptValue(engine, 0x10000)", 65536);
+        toNumber.insert("QScriptValue(engine, 0x10001)", 65537);
+        toNumber.insert("QScriptValue(engine, qSNaN())", qQNaN());
+        toNumber.insert("QScriptValue(engine, qQNaN())", qQNaN());
+        toNumber.insert("QScriptValue(engine, qInf())", qInf());
+        toNumber.insert("QScriptValue(engine, -qInf())", qInf());
+        toNumber.insert("QScriptValue(engine, \"NaN\")", qQNaN());
+        toNumber.insert("QScriptValue(engine, \"Infinity\")", qInf());
+        toNumber.insert("QScriptValue(engine, \"-Infinity\")", qInf());
+        toNumber.insert("QScriptValue(engine, \"ciao\")", qQNaN());
+        toNumber.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", qQNaN());
+        toNumber.insert("QScriptValue(engine, QString(\"\"))", 0);
+        toNumber.insert("QScriptValue(engine, QString())", 0);
+        toNumber.insert("QScriptValue(engine, QString(\"0\"))", 0);
+        toNumber.insert("QScriptValue(engine, QString(\"123\"))", 123);
+        toNumber.insert("QScriptValue(engine, QString(\"1.23\"))", 1.23);
+        toNumber.insert("engine->evaluate(\"[]\")", 0);
+        toNumber.insert("engine->evaluate(\"{}\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Object.prototype\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Date.prototype\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Array.prototype\")", 0);
+        toNumber.insert("engine->evaluate(\"Function.prototype\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Error.prototype\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Object\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Array\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Number\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Function\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"(function() { return 1; })\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"/foo/\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"new Object()\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"new Array()\")", 0);
+        toNumber.insert("engine->evaluate(\"new Error()\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", 22);
+        toNumber.insert("engine->evaluate(\"Undefined\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Null\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"True\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"False\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"undefined\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"null\")", 0);
+        toNumber.insert("engine->evaluate(\"true\")", 1);
+        toNumber.insert("engine->evaluate(\"false\")", 0);
+        toNumber.insert("engine->evaluate(\"122\")", 122);
+        toNumber.insert("engine->evaluate(\"124\")", 124);
+        toNumber.insert("engine->evaluate(\"0\")", 0);
+        toNumber.insert("engine->evaluate(\"0.0\")", 0);
+        toNumber.insert("engine->evaluate(\"123.0\")", 123);
+        toNumber.insert("engine->evaluate(\"6.37e-8\")", 6.369999999999999e-08);
+        toNumber.insert("engine->evaluate(\"-6.37e-8\")", -6.369999999999999e-08);
+        toNumber.insert("engine->evaluate(\"0x43211234\")", 1126240820);
+        toNumber.insert("engine->evaluate(\"0x10000\")", 65536);
+        toNumber.insert("engine->evaluate(\"0x10001\")", 65537);
+        toNumber.insert("engine->evaluate(\"NaN\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Infinity\")", qInf());
+        toNumber.insert("engine->evaluate(\"-Infinity\")", qInf());
+        toNumber.insert("engine->evaluate(\"'ciao'\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"''\")", 0);
+        toNumber.insert("engine->evaluate(\"'0'\")", 0);
+        toNumber.insert("engine->evaluate(\"'123'\")", 123);
+        toNumber.insert("engine->evaluate(\"'12.4'\")", 12.4);
+        toNumber.insert("engine->nullValue()", 0);
+        toNumber.insert("engine->undefinedValue()", qQNaN());
+    }
+    newRow(expr) << toNumber.value(expr);
+}
+
+void tst_QScriptValue::toNumber_test(const char*, const QScriptValue& value)
+{
+    QFETCH(qsreal, expected);
+    if (qIsNaN(expected)) {
+        QVERIFY(qIsNaN(value.toNumber()));
+        return;
+    }
+    if (qIsInf(expected)) {
+        QVERIFY(qIsInf(value.toNumber()));
+        QVERIFY(qIsInf(value.toNumber()));
+        return;
+    }
+    QCOMPARE(value.toNumber(), expected);
+    QCOMPARE(value.toNumber(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toNumber)
+
+
+void tst_QScriptValue::toBool_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toBool_makeData(const char* expr)
+{
+    static QHash<QString, bool> toBool;
+    if (toBool.isEmpty()) {
+        toBool.insert("QScriptValue()", false);
+        toBool.insert("QScriptValue(QScriptValue::UndefinedValue)", false);
+        toBool.insert("QScriptValue(QScriptValue::NullValue)", false);
+        toBool.insert("QScriptValue(true)", true);
+        toBool.insert("QScriptValue(false)", false);
+        toBool.insert("QScriptValue(int(122))", true);
+        toBool.insert("QScriptValue(uint(124))", true);
+        toBool.insert("QScriptValue(0)", false);
+        toBool.insert("QScriptValue(0.0)", false);
+        toBool.insert("QScriptValue(123.0)", true);
+        toBool.insert("QScriptValue(6.37e-8)", true);
+        toBool.insert("QScriptValue(-6.37e-8)", true);
+        toBool.insert("QScriptValue(0x43211234)", true);
+        toBool.insert("QScriptValue(0x10000)", true);
+        toBool.insert("QScriptValue(0x10001)", true);
+        toBool.insert("QScriptValue(qSNaN())", false);
+        toBool.insert("QScriptValue(qQNaN())", false);
+        toBool.insert("QScriptValue(qInf())", true);
+        toBool.insert("QScriptValue(-qInf())", true);
+        toBool.insert("QScriptValue(\"NaN\")", true);
+        toBool.insert("QScriptValue(\"Infinity\")", true);
+        toBool.insert("QScriptValue(\"-Infinity\")", true);
+        toBool.insert("QScriptValue(\"ciao\")", true);
+        toBool.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", true);
+        toBool.insert("QScriptValue(QString(\"\"))", false);
+        toBool.insert("QScriptValue(QString())", false);
+        toBool.insert("QScriptValue(QString(\"0\"))", true);
+        toBool.insert("QScriptValue(QString(\"123\"))", true);
+        toBool.insert("QScriptValue(QString(\"12.4\"))", true);
+        toBool.insert("QScriptValue(0, QScriptValue::UndefinedValue)", false);
+        toBool.insert("QScriptValue(0, QScriptValue::NullValue)", false);
+        toBool.insert("QScriptValue(0, true)", true);
+        toBool.insert("QScriptValue(0, false)", false);
+        toBool.insert("QScriptValue(0, int(122))", true);
+        toBool.insert("QScriptValue(0, uint(124))", true);
+        toBool.insert("QScriptValue(0, 0)", false);
+        toBool.insert("QScriptValue(0, 0.0)", false);
+        toBool.insert("QScriptValue(0, 123.0)", true);
+        toBool.insert("QScriptValue(0, 6.37e-8)", true);
+        toBool.insert("QScriptValue(0, -6.37e-8)", true);
+        toBool.insert("QScriptValue(0, 0x43211234)", true);
+        toBool.insert("QScriptValue(0, 0x10000)", true);
+        toBool.insert("QScriptValue(0, 0x10001)", true);
+        toBool.insert("QScriptValue(0, qSNaN())", false);
+        toBool.insert("QScriptValue(0, qQNaN())", false);
+        toBool.insert("QScriptValue(0, qInf())", true);
+        toBool.insert("QScriptValue(0, -qInf())", true);
+        toBool.insert("QScriptValue(0, \"NaN\")", true);
+        toBool.insert("QScriptValue(0, \"Infinity\")", true);
+        toBool.insert("QScriptValue(0, \"-Infinity\")", true);
+        toBool.insert("QScriptValue(0, \"ciao\")", true);
+        toBool.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", true);
+        toBool.insert("QScriptValue(0, QString(\"\"))", false);
+        toBool.insert("QScriptValue(0, QString())", false);
+        toBool.insert("QScriptValue(0, QString(\"0\"))", true);
+        toBool.insert("QScriptValue(0, QString(\"123\"))", true);
+        toBool.insert("QScriptValue(0, QString(\"12.3\"))", true);
+        toBool.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", false);
+        toBool.insert("QScriptValue(engine, QScriptValue::NullValue)", false);
+        toBool.insert("QScriptValue(engine, true)", true);
+        toBool.insert("QScriptValue(engine, false)", false);
+        toBool.insert("QScriptValue(engine, int(122))", true);
+        toBool.insert("QScriptValue(engine, uint(124))", true);
+        toBool.insert("QScriptValue(engine, 0)", false);
+        toBool.insert("QScriptValue(engine, 0.0)", false);
+        toBool.insert("QScriptValue(engine, 123.0)", true);
+        toBool.insert("QScriptValue(engine, 6.37e-8)", true);
+        toBool.insert("QScriptValue(engine, -6.37e-8)", true);
+        toBool.insert("QScriptValue(engine, 0x43211234)", true);
+        toBool.insert("QScriptValue(engine, 0x10000)", true);
+        toBool.insert("QScriptValue(engine, 0x10001)", true);
+        toBool.insert("QScriptValue(engine, qSNaN())", false);
+        toBool.insert("QScriptValue(engine, qQNaN())", false);
+        toBool.insert("QScriptValue(engine, qInf())", true);
+        toBool.insert("QScriptValue(engine, -qInf())", true);
+        toBool.insert("QScriptValue(engine, \"NaN\")", true);
+        toBool.insert("QScriptValue(engine, \"Infinity\")", true);
+        toBool.insert("QScriptValue(engine, \"-Infinity\")", true);
+        toBool.insert("QScriptValue(engine, \"ciao\")", true);
+        toBool.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", true);
+        toBool.insert("QScriptValue(engine, QString(\"\"))", false);
+        toBool.insert("QScriptValue(engine, QString())", false);
+        toBool.insert("QScriptValue(engine, QString(\"0\"))", true);
+        toBool.insert("QScriptValue(engine, QString(\"123\"))", true);
+        toBool.insert("QScriptValue(engine, QString(\"1.23\"))", true);
+        toBool.insert("engine->evaluate(\"[]\")", true);
+        toBool.insert("engine->evaluate(\"{}\")", false);
+        toBool.insert("engine->evaluate(\"Object.prototype\")", true);
+        toBool.insert("engine->evaluate(\"Date.prototype\")", true);
+        toBool.insert("engine->evaluate(\"Array.prototype\")", true);
+        toBool.insert("engine->evaluate(\"Function.prototype\")", true);
+        toBool.insert("engine->evaluate(\"Error.prototype\")", true);
+        toBool.insert("engine->evaluate(\"Object\")", true);
+        toBool.insert("engine->evaluate(\"Array\")", true);
+        toBool.insert("engine->evaluate(\"Number\")", true);
+        toBool.insert("engine->evaluate(\"Function\")", true);
+        toBool.insert("engine->evaluate(\"(function() { return 1; })\")", true);
+        toBool.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", true);
+        toBool.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", true);
+        toBool.insert("engine->evaluate(\"/foo/\")", true);
+        toBool.insert("engine->evaluate(\"new Object()\")", true);
+        toBool.insert("engine->evaluate(\"new Array()\")", true);
+        toBool.insert("engine->evaluate(\"new Error()\")", true);
+        toBool.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", true);
+        toBool.insert("engine->evaluate(\"Undefined\")", true);
+        toBool.insert("engine->evaluate(\"Null\")", true);
+        toBool.insert("engine->evaluate(\"True\")", true);
+        toBool.insert("engine->evaluate(\"False\")", true);
+        toBool.insert("engine->evaluate(\"undefined\")", false);
+        toBool.insert("engine->evaluate(\"null\")", false);
+        toBool.insert("engine->evaluate(\"true\")", true);
+        toBool.insert("engine->evaluate(\"false\")", false);
+        toBool.insert("engine->evaluate(\"122\")", true);
+        toBool.insert("engine->evaluate(\"124\")", true);
+        toBool.insert("engine->evaluate(\"0\")", false);
+        toBool.insert("engine->evaluate(\"0.0\")", false);
+        toBool.insert("engine->evaluate(\"123.0\")", true);
+        toBool.insert("engine->evaluate(\"6.37e-8\")", true);
+        toBool.insert("engine->evaluate(\"-6.37e-8\")", true);
+        toBool.insert("engine->evaluate(\"0x43211234\")", true);
+        toBool.insert("engine->evaluate(\"0x10000\")", true);
+        toBool.insert("engine->evaluate(\"0x10001\")", true);
+        toBool.insert("engine->evaluate(\"NaN\")", false);
+        toBool.insert("engine->evaluate(\"Infinity\")", true);
+        toBool.insert("engine->evaluate(\"-Infinity\")", true);
+        toBool.insert("engine->evaluate(\"'ciao'\")", true);
+        toBool.insert("engine->evaluate(\"''\")", false);
+        toBool.insert("engine->evaluate(\"'0'\")", true);
+        toBool.insert("engine->evaluate(\"'123'\")", true);
+        toBool.insert("engine->evaluate(\"'12.4'\")", true);
+        toBool.insert("engine->nullValue()", false);
+        toBool.insert("engine->undefinedValue()", false);
+    }
+    newRow(expr) << toBool.value(expr);
+}
+
+void tst_QScriptValue::toBool_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.toBool(), expected);
+    QCOMPARE(value.toBool(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toBool)
+
+
+void tst_QScriptValue::toBoolean_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toBoolean_makeData(const char* expr)
+{
+    static QHash<QString, bool> toBoolean;
+    if (toBoolean.isEmpty()) {
+        toBoolean.insert("QScriptValue()", false);
+        toBoolean.insert("QScriptValue(QScriptValue::UndefinedValue)", false);
+        toBoolean.insert("QScriptValue(QScriptValue::NullValue)", false);
+        toBoolean.insert("QScriptValue(true)", true);
+        toBoolean.insert("QScriptValue(false)", false);
+        toBoolean.insert("QScriptValue(int(122))", true);
+        toBoolean.insert("QScriptValue(uint(124))", true);
+        toBoolean.insert("QScriptValue(0)", false);
+        toBoolean.insert("QScriptValue(0.0)", false);
+        toBoolean.insert("QScriptValue(123.0)", true);
+        toBoolean.insert("QScriptValue(6.37e-8)", true);
+        toBoolean.insert("QScriptValue(-6.37e-8)", true);
+        toBoolean.insert("QScriptValue(0x43211234)", true);
+        toBoolean.insert("QScriptValue(0x10000)", true);
+        toBoolean.insert("QScriptValue(0x10001)", true);
+        toBoolean.insert("QScriptValue(qSNaN())", false);
+        toBoolean.insert("QScriptValue(qQNaN())", false);
+        toBoolean.insert("QScriptValue(qInf())", true);
+        toBoolean.insert("QScriptValue(-qInf())", true);
+        toBoolean.insert("QScriptValue(\"NaN\")", true);
+        toBoolean.insert("QScriptValue(\"Infinity\")", true);
+        toBoolean.insert("QScriptValue(\"-Infinity\")", true);
+        toBoolean.insert("QScriptValue(\"ciao\")", true);
+        toBoolean.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", true);
+        toBoolean.insert("QScriptValue(QString(\"\"))", false);
+        toBoolean.insert("QScriptValue(QString())", false);
+        toBoolean.insert("QScriptValue(QString(\"0\"))", true);
+        toBoolean.insert("QScriptValue(QString(\"123\"))", true);
+        toBoolean.insert("QScriptValue(QString(\"12.4\"))", true);
+        toBoolean.insert("QScriptValue(0, QScriptValue::UndefinedValue)", false);
+        toBoolean.insert("QScriptValue(0, QScriptValue::NullValue)", false);
+        toBoolean.insert("QScriptValue(0, true)", true);
+        toBoolean.insert("QScriptValue(0, false)", false);
+        toBoolean.insert("QScriptValue(0, int(122))", true);
+        toBoolean.insert("QScriptValue(0, uint(124))", true);
+        toBoolean.insert("QScriptValue(0, 0)", false);
+        toBoolean.insert("QScriptValue(0, 0.0)", false);
+        toBoolean.insert("QScriptValue(0, 123.0)", true);
+        toBoolean.insert("QScriptValue(0, 6.37e-8)", true);
+        toBoolean.insert("QScriptValue(0, -6.37e-8)", true);
+        toBoolean.insert("QScriptValue(0, 0x43211234)", true);
+        toBoolean.insert("QScriptValue(0, 0x10000)", true);
+        toBoolean.insert("QScriptValue(0, 0x10001)", true);
+        toBoolean.insert("QScriptValue(0, qSNaN())", false);
+        toBoolean.insert("QScriptValue(0, qQNaN())", false);
+        toBoolean.insert("QScriptValue(0, qInf())", true);
+        toBoolean.insert("QScriptValue(0, -qInf())", true);
+        toBoolean.insert("QScriptValue(0, \"NaN\")", true);
+        toBoolean.insert("QScriptValue(0, \"Infinity\")", true);
+        toBoolean.insert("QScriptValue(0, \"-Infinity\")", true);
+        toBoolean.insert("QScriptValue(0, \"ciao\")", true);
+        toBoolean.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", true);
+        toBoolean.insert("QScriptValue(0, QString(\"\"))", false);
+        toBoolean.insert("QScriptValue(0, QString())", false);
+        toBoolean.insert("QScriptValue(0, QString(\"0\"))", true);
+        toBoolean.insert("QScriptValue(0, QString(\"123\"))", true);
+        toBoolean.insert("QScriptValue(0, QString(\"12.3\"))", true);
+        toBoolean.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", false);
+        toBoolean.insert("QScriptValue(engine, QScriptValue::NullValue)", false);
+        toBoolean.insert("QScriptValue(engine, true)", true);
+        toBoolean.insert("QScriptValue(engine, false)", false);
+        toBoolean.insert("QScriptValue(engine, int(122))", true);
+        toBoolean.insert("QScriptValue(engine, uint(124))", true);
+        toBoolean.insert("QScriptValue(engine, 0)", false);
+        toBoolean.insert("QScriptValue(engine, 0.0)", false);
+        toBoolean.insert("QScriptValue(engine, 123.0)", true);
+        toBoolean.insert("QScriptValue(engine, 6.37e-8)", true);
+        toBoolean.insert("QScriptValue(engine, -6.37e-8)", true);
+        toBoolean.insert("QScriptValue(engine, 0x43211234)", true);
+        toBoolean.insert("QScriptValue(engine, 0x10000)", true);
+        toBoolean.insert("QScriptValue(engine, 0x10001)", true);
+        toBoolean.insert("QScriptValue(engine, qSNaN())", false);
+        toBoolean.insert("QScriptValue(engine, qQNaN())", false);
+        toBoolean.insert("QScriptValue(engine, qInf())", true);
+        toBoolean.insert("QScriptValue(engine, -qInf())", true);
+        toBoolean.insert("QScriptValue(engine, \"NaN\")", true);
+        toBoolean.insert("QScriptValue(engine, \"Infinity\")", true);
+        toBoolean.insert("QScriptValue(engine, \"-Infinity\")", true);
+        toBoolean.insert("QScriptValue(engine, \"ciao\")", true);
+        toBoolean.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", true);
+        toBoolean.insert("QScriptValue(engine, QString(\"\"))", false);
+        toBoolean.insert("QScriptValue(engine, QString())", false);
+        toBoolean.insert("QScriptValue(engine, QString(\"0\"))", true);
+        toBoolean.insert("QScriptValue(engine, QString(\"123\"))", true);
+        toBoolean.insert("QScriptValue(engine, QString(\"1.23\"))", true);
+        toBoolean.insert("engine->evaluate(\"[]\")", true);
+        toBoolean.insert("engine->evaluate(\"{}\")", false);
+        toBoolean.insert("engine->evaluate(\"Object.prototype\")", true);
+        toBoolean.insert("engine->evaluate(\"Date.prototype\")", true);
+        toBoolean.insert("engine->evaluate(\"Array.prototype\")", true);
+        toBoolean.insert("engine->evaluate(\"Function.prototype\")", true);
+        toBoolean.insert("engine->evaluate(\"Error.prototype\")", true);
+        toBoolean.insert("engine->evaluate(\"Object\")", true);
+        toBoolean.insert("engine->evaluate(\"Array\")", true);
+        toBoolean.insert("engine->evaluate(\"Number\")", true);
+        toBoolean.insert("engine->evaluate(\"Function\")", true);
+        toBoolean.insert("engine->evaluate(\"(function() { return 1; })\")", true);
+        toBoolean.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", true);
+        toBoolean.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", true);
+        toBoolean.insert("engine->evaluate(\"/foo/\")", true);
+        toBoolean.insert("engine->evaluate(\"new Object()\")", true);
+        toBoolean.insert("engine->evaluate(\"new Array()\")", true);
+        toBoolean.insert("engine->evaluate(\"new Error()\")", true);
+        toBoolean.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", true);
+        toBoolean.insert("engine->evaluate(\"Undefined\")", true);
+        toBoolean.insert("engine->evaluate(\"Null\")", true);
+        toBoolean.insert("engine->evaluate(\"True\")", true);
+        toBoolean.insert("engine->evaluate(\"False\")", true);
+        toBoolean.insert("engine->evaluate(\"undefined\")", false);
+        toBoolean.insert("engine->evaluate(\"null\")", false);
+        toBoolean.insert("engine->evaluate(\"true\")", true);
+        toBoolean.insert("engine->evaluate(\"false\")", false);
+        toBoolean.insert("engine->evaluate(\"122\")", true);
+        toBoolean.insert("engine->evaluate(\"124\")", true);
+        toBoolean.insert("engine->evaluate(\"0\")", false);
+        toBoolean.insert("engine->evaluate(\"0.0\")", false);
+        toBoolean.insert("engine->evaluate(\"123.0\")", true);
+        toBoolean.insert("engine->evaluate(\"6.37e-8\")", true);
+        toBoolean.insert("engine->evaluate(\"-6.37e-8\")", true);
+        toBoolean.insert("engine->evaluate(\"0x43211234\")", true);
+        toBoolean.insert("engine->evaluate(\"0x10000\")", true);
+        toBoolean.insert("engine->evaluate(\"0x10001\")", true);
+        toBoolean.insert("engine->evaluate(\"NaN\")", false);
+        toBoolean.insert("engine->evaluate(\"Infinity\")", true);
+        toBoolean.insert("engine->evaluate(\"-Infinity\")", true);
+        toBoolean.insert("engine->evaluate(\"'ciao'\")", true);
+        toBoolean.insert("engine->evaluate(\"''\")", false);
+        toBoolean.insert("engine->evaluate(\"'0'\")", true);
+        toBoolean.insert("engine->evaluate(\"'123'\")", true);
+        toBoolean.insert("engine->evaluate(\"'12.4'\")", true);
+        toBoolean.insert("engine->nullValue()", false);
+        toBoolean.insert("engine->undefinedValue()", false);
+    }
+    newRow(expr) << toBoolean.value(expr);
+}
+
+void tst_QScriptValue::toBoolean_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.toBoolean(), expected);
+    QCOMPARE(value.toBoolean(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toBoolean)
+
+
+void tst_QScriptValue::toInteger_initData()
+{
+    QTest::addColumn<qsreal>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toInteger_makeData(const char* expr)
+{
+    static QHash<QString, qsreal> toInteger;
+    if (toInteger.isEmpty()) {
+        toInteger.insert("QScriptValue()", 0);
+        toInteger.insert("QScriptValue(QScriptValue::UndefinedValue)", 0);
+        toInteger.insert("QScriptValue(QScriptValue::NullValue)", 0);
+        toInteger.insert("QScriptValue(true)", 1);
+        toInteger.insert("QScriptValue(false)", 0);
+        toInteger.insert("QScriptValue(int(122))", 122);
+        toInteger.insert("QScriptValue(uint(124))", 124);
+        toInteger.insert("QScriptValue(0)", 0);
+        toInteger.insert("QScriptValue(0.0)", 0);
+        toInteger.insert("QScriptValue(123.0)", 123);
+        toInteger.insert("QScriptValue(6.37e-8)", 0);
+        toInteger.insert("QScriptValue(-6.37e-8)", 0);
+        toInteger.insert("QScriptValue(0x43211234)", 1126240820);
+        toInteger.insert("QScriptValue(0x10000)", 65536);
+        toInteger.insert("QScriptValue(0x10001)", 65537);
+        toInteger.insert("QScriptValue(qSNaN())", 0);
+        toInteger.insert("QScriptValue(qQNaN())", 0);
+        toInteger.insert("QScriptValue(qInf())", qInf());
+        toInteger.insert("QScriptValue(-qInf())", qInf());
+        toInteger.insert("QScriptValue(\"NaN\")", 0);
+        toInteger.insert("QScriptValue(\"Infinity\")", qInf());
+        toInteger.insert("QScriptValue(\"-Infinity\")", qInf());
+        toInteger.insert("QScriptValue(\"ciao\")", 0);
+        toInteger.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", 0);
+        toInteger.insert("QScriptValue(QString(\"\"))", 0);
+        toInteger.insert("QScriptValue(QString())", 0);
+        toInteger.insert("QScriptValue(QString(\"0\"))", 0);
+        toInteger.insert("QScriptValue(QString(\"123\"))", 123);
+        toInteger.insert("QScriptValue(QString(\"12.4\"))", 12);
+        toInteger.insert("QScriptValue(0, QScriptValue::UndefinedValue)", 0);
+        toInteger.insert("QScriptValue(0, QScriptValue::NullValue)", 0);
+        toInteger.insert("QScriptValue(0, true)", 1);
+        toInteger.insert("QScriptValue(0, false)", 0);
+        toInteger.insert("QScriptValue(0, int(122))", 122);
+        toInteger.insert("QScriptValue(0, uint(124))", 124);
+        toInteger.insert("QScriptValue(0, 0)", 0);
+        toInteger.insert("QScriptValue(0, 0.0)", 0);
+        toInteger.insert("QScriptValue(0, 123.0)", 123);
+        toInteger.insert("QScriptValue(0, 6.37e-8)", 0);
+        toInteger.insert("QScriptValue(0, -6.37e-8)", 0);
+        toInteger.insert("QScriptValue(0, 0x43211234)", 1126240820);
+        toInteger.insert("QScriptValue(0, 0x10000)", 65536);
+        toInteger.insert("QScriptValue(0, 0x10001)", 65537);
+        toInteger.insert("QScriptValue(0, qSNaN())", 0);
+        toInteger.insert("QScriptValue(0, qQNaN())", 0);
+        toInteger.insert("QScriptValue(0, qInf())", qInf());
+        toInteger.insert("QScriptValue(0, -qInf())", qInf());
+        toInteger.insert("QScriptValue(0, \"NaN\")", 0);
+        toInteger.insert("QScriptValue(0, \"Infinity\")", qInf());
+        toInteger.insert("QScriptValue(0, \"-Infinity\")", qInf());
+        toInteger.insert("QScriptValue(0, \"ciao\")", 0);
+        toInteger.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", 0);
+        toInteger.insert("QScriptValue(0, QString(\"\"))", 0);
+        toInteger.insert("QScriptValue(0, QString())", 0);
+        toInteger.insert("QScriptValue(0, QString(\"0\"))", 0);
+        toInteger.insert("QScriptValue(0, QString(\"123\"))", 123);
+        toInteger.insert("QScriptValue(0, QString(\"12.3\"))", 12);
+        toInteger.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", 0);
+        toInteger.insert("QScriptValue(engine, QScriptValue::NullValue)", 0);
+        toInteger.insert("QScriptValue(engine, true)", 1);
+        toInteger.insert("QScriptValue(engine, false)", 0);
+        toInteger.insert("QScriptValue(engine, int(122))", 122);
+        toInteger.insert("QScriptValue(engine, uint(124))", 124);
+        toInteger.insert("QScriptValue(engine, 0)", 0);
+        toInteger.insert("QScriptValue(engine, 0.0)", 0);
+        toInteger.insert("QScriptValue(engine, 123.0)", 123);
+        toInteger.insert("QScriptValue(engine, 6.37e-8)", 0);
+        toInteger.insert("QScriptValue(engine, -6.37e-8)", 0);
+        toInteger.insert("QScriptValue(engine, 0x43211234)", 1126240820);
+        toInteger.insert("QScriptValue(engine, 0x10000)", 65536);
+        toInteger.insert("QScriptValue(engine, 0x10001)", 65537);
+        toInteger.insert("QScriptValue(engine, qSNaN())", 0);
+        toInteger.insert("QScriptValue(engine, qQNaN())", 0);
+        toInteger.insert("QScriptValue(engine, qInf())", qInf());
+        toInteger.insert("QScriptValue(engine, -qInf())", qInf());
+        toInteger.insert("QScriptValue(engine, \"NaN\")", 0);
+        toInteger.insert("QScriptValue(engine, \"Infinity\")", qInf());
+        toInteger.insert("QScriptValue(engine, \"-Infinity\")", qInf());
+        toInteger.insert("QScriptValue(engine, \"ciao\")", 0);
+        toInteger.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", 0);
+        toInteger.insert("QScriptValue(engine, QString(\"\"))", 0);
+        toInteger.insert("QScriptValue(engine, QString())", 0);
+        toInteger.insert("QScriptValue(engine, QString(\"0\"))", 0);
+        toInteger.insert("QScriptValue(engine, QString(\"123\"))", 123);
+        toInteger.insert("QScriptValue(engine, QString(\"1.23\"))", 1);
+        toInteger.insert("engine->evaluate(\"[]\")", 0);
+        toInteger.insert("engine->evaluate(\"{}\")", 0);
+        toInteger.insert("engine->evaluate(\"Object.prototype\")", 0);
+        toInteger.insert("engine->evaluate(\"Date.prototype\")", 0);
+        toInteger.insert("engine->evaluate(\"Array.prototype\")", 0);
+        toInteger.insert("engine->evaluate(\"Function.prototype\")", 0);
+        toInteger.insert("engine->evaluate(\"Error.prototype\")", 0);
+        toInteger.insert("engine->evaluate(\"Object\")", 0);
+        toInteger.insert("engine->evaluate(\"Array\")", 0);
+        toInteger.insert("engine->evaluate(\"Number\")", 0);
+        toInteger.insert("engine->evaluate(\"Function\")", 0);
+        toInteger.insert("engine->evaluate(\"(function() { return 1; })\")", 0);
+        toInteger.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", 0);
+        toInteger.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", 0);
+        toInteger.insert("engine->evaluate(\"/foo/\")", 0);
+        toInteger.insert("engine->evaluate(\"new Object()\")", 0);
+        toInteger.insert("engine->evaluate(\"new Array()\")", 0);
+        toInteger.insert("engine->evaluate(\"new Error()\")", 0);
+        toInteger.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", 22);
+        toInteger.insert("engine->evaluate(\"Undefined\")", 0);
+        toInteger.insert("engine->evaluate(\"Null\")", 0);
+        toInteger.insert("engine->evaluate(\"True\")", 0);
+        toInteger.insert("engine->evaluate(\"False\")", 0);
+        toInteger.insert("engine->evaluate(\"undefined\")", 0);
+        toInteger.insert("engine->evaluate(\"null\")", 0);
+        toInteger.insert("engine->evaluate(\"true\")", 1);
+        toInteger.insert("engine->evaluate(\"false\")", 0);
+        toInteger.insert("engine->evaluate(\"122\")", 122);
+        toInteger.insert("engine->evaluate(\"124\")", 124);
+        toInteger.insert("engine->evaluate(\"0\")", 0);
+        toInteger.insert("engine->evaluate(\"0.0\")", 0);
+        toInteger.insert("engine->evaluate(\"123.0\")", 123);
+        toInteger.insert("engine->evaluate(\"6.37e-8\")", 0);
+        toInteger.insert("engine->evaluate(\"-6.37e-8\")", 0);
+        toInteger.insert("engine->evaluate(\"0x43211234\")", 1126240820);
+        toInteger.insert("engine->evaluate(\"0x10000\")", 65536);
+        toInteger.insert("engine->evaluate(\"0x10001\")", 65537);
+        toInteger.insert("engine->evaluate(\"NaN\")", 0);
+        toInteger.insert("engine->evaluate(\"Infinity\")", qInf());
+        toInteger.insert("engine->evaluate(\"-Infinity\")", qInf());
+        toInteger.insert("engine->evaluate(\"'ciao'\")", 0);
+        toInteger.insert("engine->evaluate(\"''\")", 0);
+        toInteger.insert("engine->evaluate(\"'0'\")", 0);
+        toInteger.insert("engine->evaluate(\"'123'\")", 123);
+        toInteger.insert("engine->evaluate(\"'12.4'\")", 12);
+        toInteger.insert("engine->nullValue()", 0);
+        toInteger.insert("engine->undefinedValue()", 0);
+    }
+    newRow(expr) << toInteger.value(expr);
+}
+
+void tst_QScriptValue::toInteger_test(const char*, const QScriptValue& value)
+{
+    QFETCH(qsreal, expected);
+    if (qIsInf(expected)) {
+        QVERIFY(qIsInf(value.toInteger()));
+        QVERIFY(qIsInf(value.toInteger()));
+        return;
+    }
+    QCOMPARE(value.toInteger(), expected);
+    QCOMPARE(value.toInteger(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toInteger)
+
+
+void tst_QScriptValue::toInt32_initData()
+{
+    QTest::addColumn<qint32>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toInt32_makeData(const char* expr)
+{
+    static QHash<QString, qint32> toInt32;
+    if (toInt32.isEmpty()) {
+        toInt32.insert("QScriptValue()", 0);
+        toInt32.insert("QScriptValue(QScriptValue::UndefinedValue)", 0);
+        toInt32.insert("QScriptValue(QScriptValue::NullValue)", 0);
+        toInt32.insert("QScriptValue(true)", 1);
+        toInt32.insert("QScriptValue(false)", 0);
+        toInt32.insert("QScriptValue(int(122))", 122);
+        toInt32.insert("QScriptValue(uint(124))", 124);
+        toInt32.insert("QScriptValue(0)", 0);
+        toInt32.insert("QScriptValue(0.0)", 0);
+        toInt32.insert("QScriptValue(123.0)", 123);
+        toInt32.insert("QScriptValue(6.37e-8)", 0);
+        toInt32.insert("QScriptValue(-6.37e-8)", 0);
+        toInt32.insert("QScriptValue(0x43211234)", 1126240820);
+        toInt32.insert("QScriptValue(0x10000)", 65536);
+        toInt32.insert("QScriptValue(0x10001)", 65537);
+        toInt32.insert("QScriptValue(qSNaN())", 0);
+        toInt32.insert("QScriptValue(qQNaN())", 0);
+        toInt32.insert("QScriptValue(qInf())", 0);
+        toInt32.insert("QScriptValue(-qInf())", 0);
+        toInt32.insert("QScriptValue(\"NaN\")", 0);
+        toInt32.insert("QScriptValue(\"Infinity\")", 0);
+        toInt32.insert("QScriptValue(\"-Infinity\")", 0);
+        toInt32.insert("QScriptValue(\"ciao\")", 0);
+        toInt32.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", 0);
+        toInt32.insert("QScriptValue(QString(\"\"))", 0);
+        toInt32.insert("QScriptValue(QString())", 0);
+        toInt32.insert("QScriptValue(QString(\"0\"))", 0);
+        toInt32.insert("QScriptValue(QString(\"123\"))", 123);
+        toInt32.insert("QScriptValue(QString(\"12.4\"))", 12);
+        toInt32.insert("QScriptValue(0, QScriptValue::UndefinedValue)", 0);
+        toInt32.insert("QScriptValue(0, QScriptValue::NullValue)", 0);
+        toInt32.insert("QScriptValue(0, true)", 1);
+        toInt32.insert("QScriptValue(0, false)", 0);
+        toInt32.insert("QScriptValue(0, int(122))", 122);
+        toInt32.insert("QScriptValue(0, uint(124))", 124);
+        toInt32.insert("QScriptValue(0, 0)", 0);
+        toInt32.insert("QScriptValue(0, 0.0)", 0);
+        toInt32.insert("QScriptValue(0, 123.0)", 123);
+        toInt32.insert("QScriptValue(0, 6.37e-8)", 0);
+        toInt32.insert("QScriptValue(0, -6.37e-8)", 0);
+        toInt32.insert("QScriptValue(0, 0x43211234)", 1126240820);
+        toInt32.insert("QScriptValue(0, 0x10000)", 65536);
+        toInt32.insert("QScriptValue(0, 0x10001)", 65537);
+        toInt32.insert("QScriptValue(0, qSNaN())", 0);
+        toInt32.insert("QScriptValue(0, qQNaN())", 0);
+        toInt32.insert("QScriptValue(0, qInf())", 0);
+        toInt32.insert("QScriptValue(0, -qInf())", 0);
+        toInt32.insert("QScriptValue(0, \"NaN\")", 0);
+        toInt32.insert("QScriptValue(0, \"Infinity\")", 0);
+        toInt32.insert("QScriptValue(0, \"-Infinity\")", 0);
+        toInt32.insert("QScriptValue(0, \"ciao\")", 0);
+        toInt32.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", 0);
+        toInt32.insert("QScriptValue(0, QString(\"\"))", 0);
+        toInt32.insert("QScriptValue(0, QString())", 0);
+        toInt32.insert("QScriptValue(0, QString(\"0\"))", 0);
+        toInt32.insert("QScriptValue(0, QString(\"123\"))", 123);
+        toInt32.insert("QScriptValue(0, QString(\"12.3\"))", 12);
+        toInt32.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", 0);
+        toInt32.insert("QScriptValue(engine, QScriptValue::NullValue)", 0);
+        toInt32.insert("QScriptValue(engine, true)", 1);
+        toInt32.insert("QScriptValue(engine, false)", 0);
+        toInt32.insert("QScriptValue(engine, int(122))", 122);
+        toInt32.insert("QScriptValue(engine, uint(124))", 124);
+        toInt32.insert("QScriptValue(engine, 0)", 0);
+        toInt32.insert("QScriptValue(engine, 0.0)", 0);
+        toInt32.insert("QScriptValue(engine, 123.0)", 123);
+        toInt32.insert("QScriptValue(engine, 6.37e-8)", 0);
+        toInt32.insert("QScriptValue(engine, -6.37e-8)", 0);
+        toInt32.insert("QScriptValue(engine, 0x43211234)", 1126240820);
+        toInt32.insert("QScriptValue(engine, 0x10000)", 65536);
+        toInt32.insert("QScriptValue(engine, 0x10001)", 65537);
+        toInt32.insert("QScriptValue(engine, qSNaN())", 0);
+        toInt32.insert("QScriptValue(engine, qQNaN())", 0);
+        toInt32.insert("QScriptValue(engine, qInf())", 0);
+        toInt32.insert("QScriptValue(engine, -qInf())", 0);
+        toInt32.insert("QScriptValue(engine, \"NaN\")", 0);
+        toInt32.insert("QScriptValue(engine, \"Infinity\")", 0);
+        toInt32.insert("QScriptValue(engine, \"-Infinity\")", 0);
+        toInt32.insert("QScriptValue(engine, \"ciao\")", 0);
+        toInt32.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", 0);
+        toInt32.insert("QScriptValue(engine, QString(\"\"))", 0);
+        toInt32.insert("QScriptValue(engine, QString())", 0);
+        toInt32.insert("QScriptValue(engine, QString(\"0\"))", 0);
+        toInt32.insert("QScriptValue(engine, QString(\"123\"))", 123);
+        toInt32.insert("QScriptValue(engine, QString(\"1.23\"))", 1);
+        toInt32.insert("engine->evaluate(\"[]\")", 0);
+        toInt32.insert("engine->evaluate(\"{}\")", 0);
+        toInt32.insert("engine->evaluate(\"Object.prototype\")", 0);
+        toInt32.insert("engine->evaluate(\"Date.prototype\")", 0);
+        toInt32.insert("engine->evaluate(\"Array.prototype\")", 0);
+        toInt32.insert("engine->evaluate(\"Function.prototype\")", 0);
+        toInt32.insert("engine->evaluate(\"Error.prototype\")", 0);
+        toInt32.insert("engine->evaluate(\"Object\")", 0);
+        toInt32.insert("engine->evaluate(\"Array\")", 0);
+        toInt32.insert("engine->evaluate(\"Number\")", 0);
+        toInt32.insert("engine->evaluate(\"Function\")", 0);
+        toInt32.insert("engine->evaluate(\"(function() { return 1; })\")", 0);
+        toInt32.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", 0);
+        toInt32.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", 0);
+        toInt32.insert("engine->evaluate(\"/foo/\")", 0);
+        toInt32.insert("engine->evaluate(\"new Object()\")", 0);
+        toInt32.insert("engine->evaluate(\"new Array()\")", 0);
+        toInt32.insert("engine->evaluate(\"new Error()\")", 0);
+        toInt32.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", 22);
+        toInt32.insert("engine->evaluate(\"Undefined\")", 0);
+        toInt32.insert("engine->evaluate(\"Null\")", 0);
+        toInt32.insert("engine->evaluate(\"True\")", 0);
+        toInt32.insert("engine->evaluate(\"False\")", 0);
+        toInt32.insert("engine->evaluate(\"undefined\")", 0);
+        toInt32.insert("engine->evaluate(\"null\")", 0);
+        toInt32.insert("engine->evaluate(\"true\")", 1);
+        toInt32.insert("engine->evaluate(\"false\")", 0);
+        toInt32.insert("engine->evaluate(\"122\")", 122);
+        toInt32.insert("engine->evaluate(\"124\")", 124);
+        toInt32.insert("engine->evaluate(\"0\")", 0);
+        toInt32.insert("engine->evaluate(\"0.0\")", 0);
+        toInt32.insert("engine->evaluate(\"123.0\")", 123);
+        toInt32.insert("engine->evaluate(\"6.37e-8\")", 0);
+        toInt32.insert("engine->evaluate(\"-6.37e-8\")", 0);
+        toInt32.insert("engine->evaluate(\"0x43211234\")", 1126240820);
+        toInt32.insert("engine->evaluate(\"0x10000\")", 65536);
+        toInt32.insert("engine->evaluate(\"0x10001\")", 65537);
+        toInt32.insert("engine->evaluate(\"NaN\")", 0);
+        toInt32.insert("engine->evaluate(\"Infinity\")", 0);
+        toInt32.insert("engine->evaluate(\"-Infinity\")", 0);
+        toInt32.insert("engine->evaluate(\"'ciao'\")", 0);
+        toInt32.insert("engine->evaluate(\"''\")", 0);
+        toInt32.insert("engine->evaluate(\"'0'\")", 0);
+        toInt32.insert("engine->evaluate(\"'123'\")", 123);
+        toInt32.insert("engine->evaluate(\"'12.4'\")", 12);
+        toInt32.insert("engine->nullValue()", 0);
+        toInt32.insert("engine->undefinedValue()", 0);
+    }
+    newRow(expr) << toInt32.value(expr);
+}
+
+void tst_QScriptValue::toInt32_test(const char*, const QScriptValue& value)
+{
+    QFETCH(qint32, expected);
+    QCOMPARE(value.toInt32(), expected);
+    QCOMPARE(value.toInt32(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toInt32)
+
+
+void tst_QScriptValue::toUInt32_initData()
+{
+    QTest::addColumn<quint32>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toUInt32_makeData(const char* expr)
+{
+    static QHash<QString, quint32> toUInt32;
+    if (toUInt32.isEmpty()) {
+        toUInt32.insert("QScriptValue()", 0);
+        toUInt32.insert("QScriptValue(QScriptValue::UndefinedValue)", 0);
+        toUInt32.insert("QScriptValue(QScriptValue::NullValue)", 0);
+        toUInt32.insert("QScriptValue(true)", 1);
+        toUInt32.insert("QScriptValue(false)", 0);
+        toUInt32.insert("QScriptValue(int(122))", 122);
+        toUInt32.insert("QScriptValue(uint(124))", 124);
+        toUInt32.insert("QScriptValue(0)", 0);
+        toUInt32.insert("QScriptValue(0.0)", 0);
+        toUInt32.insert("QScriptValue(123.0)", 123);
+        toUInt32.insert("QScriptValue(6.37e-8)", 0);
+        toUInt32.insert("QScriptValue(-6.37e-8)", 0);
+        toUInt32.insert("QScriptValue(0x43211234)", 1126240820);
+        toUInt32.insert("QScriptValue(0x10000)", 65536);
+        toUInt32.insert("QScriptValue(0x10001)", 65537);
+        toUInt32.insert("QScriptValue(qSNaN())", 0);
+        toUInt32.insert("QScriptValue(qQNaN())", 0);
+        toUInt32.insert("QScriptValue(qInf())", 0);
+        toUInt32.insert("QScriptValue(-qInf())", 0);
+        toUInt32.insert("QScriptValue(\"NaN\")", 0);
+        toUInt32.insert("QScriptValue(\"Infinity\")", 0);
+        toUInt32.insert("QScriptValue(\"-Infinity\")", 0);
+        toUInt32.insert("QScriptValue(\"ciao\")", 0);
+        toUInt32.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", 0);
+        toUInt32.insert("QScriptValue(QString(\"\"))", 0);
+        toUInt32.insert("QScriptValue(QString())", 0);
+        toUInt32.insert("QScriptValue(QString(\"0\"))", 0);
+        toUInt32.insert("QScriptValue(QString(\"123\"))", 123);
+        toUInt32.insert("QScriptValue(QString(\"12.4\"))", 12);
+        toUInt32.insert("QScriptValue(0, QScriptValue::UndefinedValue)", 0);
+        toUInt32.insert("QScriptValue(0, QScriptValue::NullValue)", 0);
+        toUInt32.insert("QScriptValue(0, true)", 1);
+        toUInt32.insert("QScriptValue(0, false)", 0);
+        toUInt32.insert("QScriptValue(0, int(122))", 122);
+        toUInt32.insert("QScriptValue(0, uint(124))", 124);
+        toUInt32.insert("QScriptValue(0, 0)", 0);
+        toUInt32.insert("QScriptValue(0, 0.0)", 0);
+        toUInt32.insert("QScriptValue(0, 123.0)", 123);
+        toUInt32.insert("QScriptValue(0, 6.37e-8)", 0);
+        toUInt32.insert("QScriptValue(0, -6.37e-8)", 0);
+        toUInt32.insert("QScriptValue(0, 0x43211234)", 1126240820);
+        toUInt32.insert("QScriptValue(0, 0x10000)", 65536);
+        toUInt32.insert("QScriptValue(0, 0x10001)", 65537);
+        toUInt32.insert("QScriptValue(0, qSNaN())", 0);
+        toUInt32.insert("QScriptValue(0, qQNaN())", 0);
+        toUInt32.insert("QScriptValue(0, qInf())", 0);
+        toUInt32.insert("QScriptValue(0, -qInf())", 0);
+        toUInt32.insert("QScriptValue(0, \"NaN\")", 0);
+        toUInt32.insert("QScriptValue(0, \"Infinity\")", 0);
+        toUInt32.insert("QScriptValue(0, \"-Infinity\")", 0);
+        toUInt32.insert("QScriptValue(0, \"ciao\")", 0);
+        toUInt32.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", 0);
+        toUInt32.insert("QScriptValue(0, QString(\"\"))", 0);
+        toUInt32.insert("QScriptValue(0, QString())", 0);
+        toUInt32.insert("QScriptValue(0, QString(\"0\"))", 0);
+        toUInt32.insert("QScriptValue(0, QString(\"123\"))", 123);
+        toUInt32.insert("QScriptValue(0, QString(\"12.3\"))", 12);
+        toUInt32.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", 0);
+        toUInt32.insert("QScriptValue(engine, QScriptValue::NullValue)", 0);
+        toUInt32.insert("QScriptValue(engine, true)", 1);
+        toUInt32.insert("QScriptValue(engine, false)", 0);
+        toUInt32.insert("QScriptValue(engine, int(122))", 122);
+        toUInt32.insert("QScriptValue(engine, uint(124))", 124);
+        toUInt32.insert("QScriptValue(engine, 0)", 0);
+        toUInt32.insert("QScriptValue(engine, 0.0)", 0);
+        toUInt32.insert("QScriptValue(engine, 123.0)", 123);
+        toUInt32.insert("QScriptValue(engine, 6.37e-8)", 0);
+        toUInt32.insert("QScriptValue(engine, -6.37e-8)", 0);
+        toUInt32.insert("QScriptValue(engine, 0x43211234)", 1126240820);
+        toUInt32.insert("QScriptValue(engine, 0x10000)", 65536);
+        toUInt32.insert("QScriptValue(engine, 0x10001)", 65537);
+        toUInt32.insert("QScriptValue(engine, qSNaN())", 0);
+        toUInt32.insert("QScriptValue(engine, qQNaN())", 0);
+        toUInt32.insert("QScriptValue(engine, qInf())", 0);
+        toUInt32.insert("QScriptValue(engine, -qInf())", 0);
+        toUInt32.insert("QScriptValue(engine, \"NaN\")", 0);
+        toUInt32.insert("QScriptValue(engine, \"Infinity\")", 0);
+        toUInt32.insert("QScriptValue(engine, \"-Infinity\")", 0);
+        toUInt32.insert("QScriptValue(engine, \"ciao\")", 0);
+        toUInt32.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", 0);
+        toUInt32.insert("QScriptValue(engine, QString(\"\"))", 0);
+        toUInt32.insert("QScriptValue(engine, QString())", 0);
+        toUInt32.insert("QScriptValue(engine, QString(\"0\"))", 0);
+        toUInt32.insert("QScriptValue(engine, QString(\"123\"))", 123);
+        toUInt32.insert("QScriptValue(engine, QString(\"1.23\"))", 1);
+        toUInt32.insert("engine->evaluate(\"[]\")", 0);
+        toUInt32.insert("engine->evaluate(\"{}\")", 0);
+        toUInt32.insert("engine->evaluate(\"Object.prototype\")", 0);
+        toUInt32.insert("engine->evaluate(\"Date.prototype\")", 0);
+        toUInt32.insert("engine->evaluate(\"Array.prototype\")", 0);
+        toUInt32.insert("engine->evaluate(\"Function.prototype\")", 0);
+        toUInt32.insert("engine->evaluate(\"Error.prototype\")", 0);
+        toUInt32.insert("engine->evaluate(\"Object\")", 0);
+        toUInt32.insert("engine->evaluate(\"Array\")", 0);
+        toUInt32.insert("engine->evaluate(\"Number\")", 0);
+        toUInt32.insert("engine->evaluate(\"Function\")", 0);
+        toUInt32.insert("engine->evaluate(\"(function() { return 1; })\")", 0);
+        toUInt32.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", 0);
+        toUInt32.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", 0);
+        toUInt32.insert("engine->evaluate(\"/foo/\")", 0);
+        toUInt32.insert("engine->evaluate(\"new Object()\")", 0);
+        toUInt32.insert("engine->evaluate(\"new Array()\")", 0);
+        toUInt32.insert("engine->evaluate(\"new Error()\")", 0);
+        toUInt32.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", 22);
+        toUInt32.insert("engine->evaluate(\"Undefined\")", 0);
+        toUInt32.insert("engine->evaluate(\"Null\")", 0);
+        toUInt32.insert("engine->evaluate(\"True\")", 0);
+        toUInt32.insert("engine->evaluate(\"False\")", 0);
+        toUInt32.insert("engine->evaluate(\"undefined\")", 0);
+        toUInt32.insert("engine->evaluate(\"null\")", 0);
+        toUInt32.insert("engine->evaluate(\"true\")", 1);
+        toUInt32.insert("engine->evaluate(\"false\")", 0);
+        toUInt32.insert("engine->evaluate(\"122\")", 122);
+        toUInt32.insert("engine->evaluate(\"124\")", 124);
+        toUInt32.insert("engine->evaluate(\"0\")", 0);
+        toUInt32.insert("engine->evaluate(\"0.0\")", 0);
+        toUInt32.insert("engine->evaluate(\"123.0\")", 123);
+        toUInt32.insert("engine->evaluate(\"6.37e-8\")", 0);
+        toUInt32.insert("engine->evaluate(\"-6.37e-8\")", 0);
+        toUInt32.insert("engine->evaluate(\"0x43211234\")", 1126240820);
+        toUInt32.insert("engine->evaluate(\"0x10000\")", 65536);
+        toUInt32.insert("engine->evaluate(\"0x10001\")", 65537);
+        toUInt32.insert("engine->evaluate(\"NaN\")", 0);
+        toUInt32.insert("engine->evaluate(\"Infinity\")", 0);
+        toUInt32.insert("engine->evaluate(\"-Infinity\")", 0);
+        toUInt32.insert("engine->evaluate(\"'ciao'\")", 0);
+        toUInt32.insert("engine->evaluate(\"''\")", 0);
+        toUInt32.insert("engine->evaluate(\"'0'\")", 0);
+        toUInt32.insert("engine->evaluate(\"'123'\")", 123);
+        toUInt32.insert("engine->evaluate(\"'12.4'\")", 12);
+        toUInt32.insert("engine->nullValue()", 0);
+        toUInt32.insert("engine->undefinedValue()", 0);
+    }
+    newRow(expr) << toUInt32.value(expr);
+}
+
+void tst_QScriptValue::toUInt32_test(const char*, const QScriptValue& value)
+{
+    QFETCH(quint32, expected);
+    QCOMPARE(value.toUInt32(), expected);
+    QCOMPARE(value.toUInt32(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toUInt32)
+
+
+void tst_QScriptValue::toUInt16_initData()
+{
+    QTest::addColumn<quint16>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toUInt16_makeData(const char* expr)
+{
+    static QHash<QString, quint16> toUInt16;
+    if (toUInt16.isEmpty()) {
+        toUInt16.insert("QScriptValue()", 0);
+        toUInt16.insert("QScriptValue(QScriptValue::UndefinedValue)", 0);
+        toUInt16.insert("QScriptValue(QScriptValue::NullValue)", 0);
+        toUInt16.insert("QScriptValue(true)", 1);
+        toUInt16.insert("QScriptValue(false)", 0);
+        toUInt16.insert("QScriptValue(int(122))", 122);
+        toUInt16.insert("QScriptValue(uint(124))", 124);
+        toUInt16.insert("QScriptValue(0)", 0);
+        toUInt16.insert("QScriptValue(0.0)", 0);
+        toUInt16.insert("QScriptValue(123.0)", 123);
+        toUInt16.insert("QScriptValue(6.37e-8)", 0);
+        toUInt16.insert("QScriptValue(-6.37e-8)", 0);
+        toUInt16.insert("QScriptValue(0x43211234)", 4660);
+        toUInt16.insert("QScriptValue(0x10000)", 0);
+        toUInt16.insert("QScriptValue(0x10001)", 1);
+        toUInt16.insert("QScriptValue(qSNaN())", 0);
+        toUInt16.insert("QScriptValue(qQNaN())", 0);
+        toUInt16.insert("QScriptValue(qInf())", 0);
+        toUInt16.insert("QScriptValue(-qInf())", 0);
+        toUInt16.insert("QScriptValue(\"NaN\")", 0);
+        toUInt16.insert("QScriptValue(\"Infinity\")", 0);
+        toUInt16.insert("QScriptValue(\"-Infinity\")", 0);
+        toUInt16.insert("QScriptValue(\"ciao\")", 0);
+        toUInt16.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", 0);
+        toUInt16.insert("QScriptValue(QString(\"\"))", 0);
+        toUInt16.insert("QScriptValue(QString())", 0);
+        toUInt16.insert("QScriptValue(QString(\"0\"))", 0);
+        toUInt16.insert("QScriptValue(QString(\"123\"))", 123);
+        toUInt16.insert("QScriptValue(QString(\"12.4\"))", 12);
+        toUInt16.insert("QScriptValue(0, QScriptValue::UndefinedValue)", 0);
+        toUInt16.insert("QScriptValue(0, QScriptValue::NullValue)", 0);
+        toUInt16.insert("QScriptValue(0, true)", 1);
+        toUInt16.insert("QScriptValue(0, false)", 0);
+        toUInt16.insert("QScriptValue(0, int(122))", 122);
+        toUInt16.insert("QScriptValue(0, uint(124))", 124);
+        toUInt16.insert("QScriptValue(0, 0)", 0);
+        toUInt16.insert("QScriptValue(0, 0.0)", 0);
+        toUInt16.insert("QScriptValue(0, 123.0)", 123);
+        toUInt16.insert("QScriptValue(0, 6.37e-8)", 0);
+        toUInt16.insert("QScriptValue(0, -6.37e-8)", 0);
+        toUInt16.insert("QScriptValue(0, 0x43211234)", 4660);
+        toUInt16.insert("QScriptValue(0, 0x10000)", 0);
+        toUInt16.insert("QScriptValue(0, 0x10001)", 1);
+        toUInt16.insert("QScriptValue(0, qSNaN())", 0);
+        toUInt16.insert("QScriptValue(0, qQNaN())", 0);
+        toUInt16.insert("QScriptValue(0, qInf())", 0);
+        toUInt16.insert("QScriptValue(0, -qInf())", 0);
+        toUInt16.insert("QScriptValue(0, \"NaN\")", 0);
+        toUInt16.insert("QScriptValue(0, \"Infinity\")", 0);
+        toUInt16.insert("QScriptValue(0, \"-Infinity\")", 0);
+        toUInt16.insert("QScriptValue(0, \"ciao\")", 0);
+        toUInt16.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", 0);
+        toUInt16.insert("QScriptValue(0, QString(\"\"))", 0);
+        toUInt16.insert("QScriptValue(0, QString())", 0);
+        toUInt16.insert("QScriptValue(0, QString(\"0\"))", 0);
+        toUInt16.insert("QScriptValue(0, QString(\"123\"))", 123);
+        toUInt16.insert("QScriptValue(0, QString(\"12.3\"))", 12);
+        toUInt16.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", 0);
+        toUInt16.insert("QScriptValue(engine, QScriptValue::NullValue)", 0);
+        toUInt16.insert("QScriptValue(engine, true)", 1);
+        toUInt16.insert("QScriptValue(engine, false)", 0);
+        toUInt16.insert("QScriptValue(engine, int(122))", 122);
+        toUInt16.insert("QScriptValue(engine, uint(124))", 124);
+        toUInt16.insert("QScriptValue(engine, 0)", 0);
+        toUInt16.insert("QScriptValue(engine, 0.0)", 0);
+        toUInt16.insert("QScriptValue(engine, 123.0)", 123);
+        toUInt16.insert("QScriptValue(engine, 6.37e-8)", 0);
+        toUInt16.insert("QScriptValue(engine, -6.37e-8)", 0);
+        toUInt16.insert("QScriptValue(engine, 0x43211234)", 4660);
+        toUInt16.insert("QScriptValue(engine, 0x10000)", 0);
+        toUInt16.insert("QScriptValue(engine, 0x10001)", 1);
+        toUInt16.insert("QScriptValue(engine, qSNaN())", 0);
+        toUInt16.insert("QScriptValue(engine, qQNaN())", 0);
+        toUInt16.insert("QScriptValue(engine, qInf())", 0);
+        toUInt16.insert("QScriptValue(engine, -qInf())", 0);
+        toUInt16.insert("QScriptValue(engine, \"NaN\")", 0);
+        toUInt16.insert("QScriptValue(engine, \"Infinity\")", 0);
+        toUInt16.insert("QScriptValue(engine, \"-Infinity\")", 0);
+        toUInt16.insert("QScriptValue(engine, \"ciao\")", 0);
+        toUInt16.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", 0);
+        toUInt16.insert("QScriptValue(engine, QString(\"\"))", 0);
+        toUInt16.insert("QScriptValue(engine, QString())", 0);
+        toUInt16.insert("QScriptValue(engine, QString(\"0\"))", 0);
+        toUInt16.insert("QScriptValue(engine, QString(\"123\"))", 123);
+        toUInt16.insert("QScriptValue(engine, QString(\"1.23\"))", 1);
+        toUInt16.insert("engine->evaluate(\"[]\")", 0);
+        toUInt16.insert("engine->evaluate(\"{}\")", 0);
+        toUInt16.insert("engine->evaluate(\"Object.prototype\")", 0);
+        toUInt16.insert("engine->evaluate(\"Date.prototype\")", 0);
+        toUInt16.insert("engine->evaluate(\"Array.prototype\")", 0);
+        toUInt16.insert("engine->evaluate(\"Function.prototype\")", 0);
+        toUInt16.insert("engine->evaluate(\"Error.prototype\")", 0);
+        toUInt16.insert("engine->evaluate(\"Object\")", 0);
+        toUInt16.insert("engine->evaluate(\"Array\")", 0);
+        toUInt16.insert("engine->evaluate(\"Number\")", 0);
+        toUInt16.insert("engine->evaluate(\"Function\")", 0);
+        toUInt16.insert("engine->evaluate(\"(function() { return 1; })\")", 0);
+        toUInt16.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", 0);
+        toUInt16.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", 0);
+        toUInt16.insert("engine->evaluate(\"/foo/\")", 0);
+        toUInt16.insert("engine->evaluate(\"new Object()\")", 0);
+        toUInt16.insert("engine->evaluate(\"new Array()\")", 0);
+        toUInt16.insert("engine->evaluate(\"new Error()\")", 0);
+        toUInt16.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", 22);
+        toUInt16.insert("engine->evaluate(\"Undefined\")", 0);
+        toUInt16.insert("engine->evaluate(\"Null\")", 0);
+        toUInt16.insert("engine->evaluate(\"True\")", 0);
+        toUInt16.insert("engine->evaluate(\"False\")", 0);
+        toUInt16.insert("engine->evaluate(\"undefined\")", 0);
+        toUInt16.insert("engine->evaluate(\"null\")", 0);
+        toUInt16.insert("engine->evaluate(\"true\")", 1);
+        toUInt16.insert("engine->evaluate(\"false\")", 0);
+        toUInt16.insert("engine->evaluate(\"122\")", 122);
+        toUInt16.insert("engine->evaluate(\"124\")", 124);
+        toUInt16.insert("engine->evaluate(\"0\")", 0);
+        toUInt16.insert("engine->evaluate(\"0.0\")", 0);
+        toUInt16.insert("engine->evaluate(\"123.0\")", 123);
+        toUInt16.insert("engine->evaluate(\"6.37e-8\")", 0);
+        toUInt16.insert("engine->evaluate(\"-6.37e-8\")", 0);
+        toUInt16.insert("engine->evaluate(\"0x43211234\")", 4660);
+        toUInt16.insert("engine->evaluate(\"0x10000\")", 0);
+        toUInt16.insert("engine->evaluate(\"0x10001\")", 1);
+        toUInt16.insert("engine->evaluate(\"NaN\")", 0);
+        toUInt16.insert("engine->evaluate(\"Infinity\")", 0);
+        toUInt16.insert("engine->evaluate(\"-Infinity\")", 0);
+        toUInt16.insert("engine->evaluate(\"'ciao'\")", 0);
+        toUInt16.insert("engine->evaluate(\"''\")", 0);
+        toUInt16.insert("engine->evaluate(\"'0'\")", 0);
+        toUInt16.insert("engine->evaluate(\"'123'\")", 123);
+        toUInt16.insert("engine->evaluate(\"'12.4'\")", 12);
+        toUInt16.insert("engine->nullValue()", 0);
+        toUInt16.insert("engine->undefinedValue()", 0);
+    }
+    newRow(expr) << toUInt16.value(expr);
+}
+
+void tst_QScriptValue::toUInt16_test(const char*, const QScriptValue& value)
+{
+    QFETCH(quint16, expected);
+    QCOMPARE(value.toUInt16(), expected);
+    QCOMPARE(value.toUInt16(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toUInt16)
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/tests.pri b/src/3rdparty/webkit/JavaScriptCore/qt/tests/tests.pri
new file mode 100644
index 0000000000..5af338369d
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/tests.pri
@@ -0,0 +1,19 @@
+QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+QMAKE_LIBDIR = $$OUTPUT_DIR/lib $$QMAKE_LIBDIR
+mac:!static:contains(QT_CONFIG, qt_framework):!CONFIG(webkit_no_framework) {
+    LIBS += -framework QtScript
+    QMAKE_FRAMEWORKPATH = $$OUTPUT_DIR/lib $$QMAKE_FRAMEWORKPATH
+} else {
+    win32-*|wince* {
+        LIBS += -lQtScript$${QT_MAJOR_VERSION}
+    } else {
+        LIBS += -lQtScript
+    }
+}
+
+CONFIG(release, debug|release) {
+    DEFINES += NDEBUG
+}
+
+INCLUDEPATH += $$PWD/../api
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/tests.pro b/src/3rdparty/webkit/JavaScriptCore/qt/tests/tests.pro
new file mode 100644
index 0000000000..7c3f590c5c
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/tests.pro
@@ -0,0 +1,4 @@
+TEMPLATE = subdirs
+SUBDIRS =   qscriptengine \
+            qscriptvalue \
+            qscriptstring
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
index 32277705af..8e1fdbe4b8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
@@ -104,7 +104,11 @@ namespace JSC {
         void append(JSValue v)
         {
             ASSERT(!m_isReadOnly);
-            
+
+#if ENABLE(JSC_ZOMBIES)
+            ASSERT(!v.isZombie());
+#endif
+
             if (m_isUsingInlineBuffer && m_size < inlineCapacity) {
                 m_vector.uncheckedAppend(v);
                 ++m_size;
@@ -187,6 +191,10 @@ namespace JSC {
             : m_args(args)
             , m_argCount(argCount)
         {
+#if ENABLE(JSC_ZOMBIES)
+            for (size_t i = 0; i < argCount; i++)
+                ASSERT(!m_args[i].isZombie());
+#endif
         }
         
         ArgList(Register* args, int argCount)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
index 86a8f0a9ed..bb30e3bc98 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
@@ -204,6 +204,19 @@ bool Arguments::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return JSObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
 }
 
+void Arguments::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (mode == IncludeDontEnumProperties) {
+        for (unsigned i = 0; i < d->numArguments; ++i) {
+            if (!d->deletedArguments || !d->deletedArguments[i])
+                propertyNames.add(Identifier(exec, UString::from(i)));
+        }
+        propertyNames.add(exec->propertyNames().callee);
+        propertyNames.add(exec->propertyNames().length);
+    }
+    JSObject::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
 void Arguments::put(ExecState* exec, unsigned i, JSValue value, PutPropertySlot& slot)
 {
     if (i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
index 9b674a2fad..9797e086d8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
@@ -85,7 +85,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
     protected:
@@ -96,6 +96,7 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual void put(ExecState*, unsigned propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
index 7a894478c6..4e8dc02737 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -28,6 +28,7 @@
 #include "CachedCall.h"
 #include "Interpreter.h"
 #include "JIT.h"
+#include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
 #include "Lookup.h"
 #include "Operations.h"
@@ -182,8 +183,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue
         totalSize += str.size();
         
         if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
+            throwOutOfMemoryError(exec);
         }
         
         if (exec->hadException())
@@ -195,17 +195,16 @@ JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue
     Vector<UChar> buffer;
     buffer.reserveCapacity(totalSize);
     if (!buffer.data())
-        return throwError(exec, GeneralError, "Out of memory");
+        return throwOutOfMemoryError(exec);
         
     for (unsigned i = 0; i < length; i++) {
         if (i)
             buffer.append(',');
         if (RefPtr<UString::Rep> rep = strBuffer[i])
-            buffer.append(rep->data(), rep->size());
+            buffer.append(rep->characters(), rep->length());
     }
     ASSERT(buffer.size() == totalSize);
-    unsigned finalSize = buffer.size();
-    return jsString(exec, UString(buffer.releaseBuffer(), finalSize, false));
+    return jsString(exec, UString::adopt(buffer));
 }
 
 JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -224,42 +223,28 @@ JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, J
     if (alreadyVisited)
         return jsEmptyString(exec); // return an empty string, avoding infinite recursion.
 
-    Vector<UChar, 256> strBuffer;
+    JSStringBuilder strBuffer;
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned k = 0; k < length; k++) {
         if (k >= 1)
             strBuffer.append(',');
-        if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
-            break;
-        }
 
         JSValue element = thisObj->get(exec, k);
-        if (element.isUndefinedOrNull())
-            continue;
-
-        JSObject* o = element.toObject(exec);
-        JSValue conversionFunction = o->get(exec, exec->propertyNames().toLocaleString);
-        UString str;
-        CallData callData;
-        CallType callType = conversionFunction.getCallData(callData);
-        if (callType != CallTypeNone)
-            str = call(exec, conversionFunction, callType, callData, element, exec->emptyList()).toString(exec);
-        else
-            str = element.toString(exec);
-        strBuffer.append(str.data(), str.size());
-
-        if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
+        if (!element.isUndefinedOrNull()) {
+            JSObject* o = element.toObject(exec);
+            JSValue conversionFunction = o->get(exec, exec->propertyNames().toLocaleString);
+            UString str;
+            CallData callData;
+            CallType callType = conversionFunction.getCallData(callData);
+            if (callType != CallTypeNone)
+                str = call(exec, conversionFunction, callType, callData, element, exec->emptyList()).toString(exec);
+            else
+                str = element.toString(exec);
+            strBuffer.append(str);
         }
-
-        if (exec->hadException())
-            break;
     }
     arrayVisitedElements.remove(thisObj);
-    return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
+    return strBuffer.build(exec);
 }
 
 JSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -276,38 +261,27 @@ JSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValue thi
     if (alreadyVisited)
         return jsEmptyString(exec); // return an empty string, avoding infinite recursion.
 
-    Vector<UChar, 256> strBuffer;
+    JSStringBuilder strBuffer;
 
-    UChar comma = ',';
-    UString separator = args.at(0).isUndefined() ? UString(&comma, 1) : args.at(0).toString(exec);
+    UString separator;
+    if (!args.at(0).isUndefined())
+        separator = args.at(0).toString(exec);
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned k = 0; k < length; k++) {
-        if (k >= 1)
-            strBuffer.append(separator.data(), separator.size());
-        if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
-            break;
+        if (k >= 1) {
+            if (separator.isNull())
+                strBuffer.append(',');
+            else
+                strBuffer.append(separator);
         }
 
         JSValue element = thisObj->get(exec, k);
-        if (element.isUndefinedOrNull())
-            continue;
-
-        UString str = element.toString(exec);
-        strBuffer.append(str.data(), str.size());
-
-        if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
-        }
-
-        if (exec->hadException())
-            break;
+        if (!element.isUndefinedOrNull())
+            strBuffer.append(element.toString(exec));
     }
     arrayVisitedElements.remove(thisObj);
-    return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
+    return strBuffer.build(exec);
 }
 
 JSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -532,14 +506,19 @@ JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValue t
     // 15.4.4.12
     JSArray* resObj = constructEmptyArray(exec);
     JSValue result = resObj;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+
+    // FIXME: Firefox returns an empty array.
     if (!args.size())
         return jsUndefined();
-    int begin = args.at(0).toUInt32(exec);
-    if (begin < 0)
-        begin = std::max<int>(begin + length, 0);
-    else
-        begin = std::min<int>(begin, length);
+
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    double relativeBegin = args.at(0).toInteger(exec);
+    unsigned begin;
+    if (relativeBegin < 0) {
+        relativeBegin += length;
+        begin = (relativeBegin < 0) ? 0 : static_cast<unsigned>(relativeBegin);
+    } else
+        begin = std::min<unsigned>(static_cast<unsigned>(relativeBegin), length);
 
     unsigned deleteCount;
     if (args.size() > 1)
@@ -565,7 +544,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValue t
             for (unsigned k = length; k > length - deleteCount + additionalArgs; --k)
                 thisObj->deleteProperty(exec, k - 1);
         } else {
-            for (unsigned k = length - deleteCount; (int)k > begin; --k) {
+            for (unsigned k = length - deleteCount; k > begin; --k) {
                 if (JSValue obj = getProperty(exec, thisObj, k + deleteCount - 1))
                     thisObj->put(exec, k + additionalArgs - 1, obj);
                 else
@@ -745,8 +724,8 @@ JSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec, JSObject*, JSValue th
             cachedCall.setArgument(0, array->getIndex(k));
             cachedCall.setArgument(1, jsNumber(exec, k));
             cachedCall.setArgument(2, thisObj);
-            
-            if (!cachedCall.call().toBoolean(exec))
+            JSValue result = cachedCall.call();
+            if (!result.toBoolean(cachedCall.newCallFrame(exec)))
                 return jsBoolean(false);
         }
     }
@@ -846,8 +825,8 @@ JSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec, JSObject*, JSValue thi
             cachedCall.setArgument(0, array->getIndex(k));
             cachedCall.setArgument(1, jsNumber(exec, k));
             cachedCall.setArgument(2, thisObj);
-            
-            if (cachedCall.call().toBoolean(exec))
+            JSValue result = cachedCall.call();
+            if (result.toBoolean(cachedCall.newCallFrame(exec)))
                 return jsBoolean(true);
         }
     }
@@ -1034,7 +1013,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue
         JSValue e = getProperty(exec, thisObj, index);
         if (!e)
             continue;
-        if (JSValue::strictEqual(searchElement, e))
+        if (JSValue::strictEqual(exec, searchElement, e))
             return jsNumber(exec, index);
     }
 
@@ -1065,7 +1044,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSVa
         JSValue e = getProperty(exec, thisObj, index);
         if (!e)
             continue;
-        if (JSValue::strictEqual(searchElement, e))
+        if (JSValue::strictEqual(exec, searchElement, e))
             return jsNumber(exec, index);
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h b/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
index 929a5e78b4..74089a53b9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
@@ -43,7 +43,7 @@ namespace JSC {
 
         ~BatchedTransitionOptimizer()
         {
-            m_object->setStructure(Structure::fromDictionaryTransition(m_object->structure()));
+            m_object->flattenDictionaryObject();
         }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
index 69c2e51349..4b02acb1dc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
@@ -34,7 +34,7 @@ namespace JSC {
         
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
index 6626182c93..28592901db 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
@@ -32,6 +32,7 @@
 #include "JSONObject.h"
 #include "JSString.h"
 #include "JSValue.h"
+#include "JSZombie.h"
 #include "MarkStack.h"
 #include "Nodes.h"
 #include "Tracing.h"
@@ -44,7 +45,7 @@
 #include <wtf/UnusedParam.h>
 #include <wtf/VMTags.h>
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
 #include <mach/mach_init.h>
 #include <mach/mach_port.h>
@@ -52,40 +53,24 @@
 #include <mach/thread_act.h>
 #include <mach/vm_map.h>
 
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 
 #include <windows.h>
 #include <malloc.h>
 
-#elif PLATFORM(HAIKU)
+#elif OS(HAIKU)
 
 #include <OS.h>
 
-#elif PLATFORM(UNIX)
+#elif OS(UNIX)
 
 #include <stdlib.h>
-#if !PLATFORM(HAIKU)
+#if !OS(HAIKU)
 #include <sys/mman.h>
 #endif
 #include <unistd.h>
 
-#if defined(QT_LINUXBASE)
-#include <dlfcn.h>
-#endif
-
-#if defined(__UCLIBC__)
-// versions of uClibc 0.9.28 and below do not have
-// pthread_getattr_np or pthread_attr_getstack.
-#if __UCLIBC_MAJOR__ == 0 && \
-    (__UCLIBC_MINOR__ < 9 || \
-    (__UCLIBC_MINOR__ == 9 && __UCLIBC_SUBLEVEL__ <= 30))
-#define UCLIBC_USE_PROC_SELF_MAPS 1
-#include <stdio_ext.h>
-extern int *__libc_stack_end;
-#endif
-#endif
-
-#if PLATFORM(SOLARIS)
+#if OS(SOLARIS)
 #include <thread.h>
 #else
 #include <pthread.h>
@@ -95,7 +80,7 @@ extern int *__libc_stack_end;
 #include <pthread_np.h>
 #endif
 
-#if PLATFORM(QNX)
+#if OS(QNX)
 #include <fcntl.h>
 #include <sys/procfs.h>
 #include <stdio.h>
@@ -114,21 +99,17 @@ namespace JSC {
 
 const size_t GROWTH_FACTOR = 2;
 const size_t LOW_WATER_FACTOR = 4;
-const size_t ALLOCATIONS_PER_COLLECTION = 4000;
+const size_t ALLOCATIONS_PER_COLLECTION = 3600;
 // This value has to be a macro to be used in max() without introducing
 // a PIC branch in Mach-O binaries, see <rdar://problem/5971391>.
 #define MIN_ARRAY_SIZE (static_cast<size_t>(14))
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 typedef mach_port_t PlatformThread;
-#elif PLATFORM(WIN_OS)
-struct PlatformThread {
-    PlatformThread(DWORD _id, HANDLE _handle) : id(_id), handle(_handle) {}
-    DWORD id;
-    HANDLE handle;
-};
+#elif OS(WINDOWS)
+typedef HANDLE PlatformThread;
 #endif
 
 class Heap::Thread {
@@ -155,13 +136,13 @@ Heap::Heap(JSGlobalData* globalData)
     , m_currentThreadRegistrar(0)
 #endif
     , m_globalData(globalData)
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
     , m_blockallocator(JSCCOLLECTOR_VIRTUALMEM_RESERVATION, BLOCK_SIZE)
 #endif
 {
     ASSERT(globalData);
-    memset(&primaryHeap, 0, sizeof(CollectorHeap));
-    memset(&numberHeap, 0, sizeof(CollectorHeap));
+    memset(&m_heap, 0, sizeof(CollectorHeap));
+    allocateBlock();
 }
 
 Heap::~Heap()
@@ -177,6 +158,9 @@ void Heap::destroy()
     if (!m_globalData)
         return;
 
+    ASSERT(!m_globalData->dynamicGlobalObject);
+    ASSERT(!isBusy());
+    
     // The global object is not GC protected at this point, so sweeping may delete it
     // (and thus the global data) before other objects that may use the global data.
     RefPtr<JSGlobalData> protect(m_globalData);
@@ -184,13 +168,7 @@ void Heap::destroy()
     delete m_markListSet;
     m_markListSet = 0;
 
-    sweep<PrimaryHeap>();
-    // No need to sweep number heap, because the JSNumber destructor doesn't do anything.
-
-    ASSERT(!primaryHeap.numLiveObjects);
-
-    freeBlocks(&primaryHeap);
-    freeBlocks(&numberHeap);
+    freeBlocks();
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
     if (m_currentThreadRegistrar) {
@@ -205,30 +183,25 @@ void Heap::destroy()
         t = next;
     }
 #endif
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
     m_blockallocator.destroy();
 #endif
     m_globalData = 0;
 }
 
-template <HeapType heapType>
 NEVER_INLINE CollectorBlock* Heap::allocateBlock()
 {
-    // Disable the use of vm_map for the Qt build on Darwin, because when compiled on 10.4
-    // it crashes on 10.5
-#if PLATFORM(DARWIN) && !PLATFORM(QT)
+#if OS(DARWIN)
     vm_address_t address = 0;
-    // FIXME: tag the region as a JavaScriptCore heap when we get a registered VM tag: <rdar://problem/6054788>.
     vm_map(current_task(), &address, BLOCK_SIZE, BLOCK_OFFSET_MASK, VM_FLAGS_ANYWHERE | VM_TAG_FOR_COLLECTOR_MEMORY, MEMORY_OBJECT_NULL, 0, FALSE, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
-#elif PLATFORM(SYMBIAN)
+#elif OS(SYMBIAN)
     void* address = m_blockallocator.alloc();  
     if (!address)
         CRASH();
-    memset(reinterpret_cast<void*>(address), 0, BLOCK_SIZE);
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
     void* address = VirtualAlloc(NULL, BLOCK_SIZE, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
-#elif PLATFORM(WIN_OS)
-#if COMPILER(MINGW)
+#elif OS(WINDOWS)
+#if COMPILER(MINGW) && !defined(__MINGW64_VERSION_MAJOR)
     void* address = __mingw_aligned_malloc(BLOCK_SIZE, BLOCK_SIZE);
 #else
     void* address = _aligned_malloc(BLOCK_SIZE, BLOCK_SIZE);
@@ -237,7 +210,6 @@ NEVER_INLINE CollectorBlock* Heap::allocateBlock()
 #elif HAVE(POSIX_MEMALIGN)
     void* address;
     posix_memalign(&address, BLOCK_SIZE, BLOCK_SIZE);
-    memset(address, 0, BLOCK_SIZE);
 #else
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
@@ -263,58 +235,64 @@ NEVER_INLINE CollectorBlock* Heap::allocateBlock()
         munmap(reinterpret_cast<char*>(address + adjust + BLOCK_SIZE), extra - adjust);
 
     address += adjust;
-    memset(reinterpret_cast<void*>(address), 0, BLOCK_SIZE);
 #endif
 
+    // Initialize block.
+
     CollectorBlock* block = reinterpret_cast<CollectorBlock*>(address);
-    block->freeList = block->cells;
     block->heap = this;
-    block->type = heapType;
+    clearMarkBits(block);
+
+    Structure* dummyMarkableCellStructure = m_globalData->dummyMarkableCellStructure.get();
+    for (size_t i = 0; i < HeapConstants::cellsPerBlock; ++i)
+        new (block->cells + i) JSCell(dummyMarkableCellStructure);
+    
+    // Add block to blocks vector.
 
-    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
-    size_t numBlocks = heap.numBlocks;
-    if (heap.usedBlocks == numBlocks) {
+    size_t numBlocks = m_heap.numBlocks;
+    if (m_heap.usedBlocks == numBlocks) {
         static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR;
         if (numBlocks > maxNumBlocks)
             CRASH();
         numBlocks = max(MIN_ARRAY_SIZE, numBlocks * GROWTH_FACTOR);
-        heap.numBlocks = numBlocks;
-        heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, numBlocks * sizeof(CollectorBlock*)));
+        m_heap.numBlocks = numBlocks;
+        m_heap.blocks = static_cast<CollectorBlock**>(fastRealloc(m_heap.blocks, numBlocks * sizeof(CollectorBlock*)));
     }
-    heap.blocks[heap.usedBlocks++] = block;
+    m_heap.blocks[m_heap.usedBlocks++] = block;
 
     return block;
 }
 
-template <HeapType heapType>
 NEVER_INLINE void Heap::freeBlock(size_t block)
 {
-    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
+    m_heap.didShrink = true;
 
-    freeBlock(heap.blocks[block]);
+    ObjectIterator it(m_heap, block);
+    ObjectIterator end(m_heap, block + 1);
+    for ( ; it != end; ++it)
+        (*it)->~JSCell();
+    freeBlockPtr(m_heap.blocks[block]);
 
     // swap with the last block so we compact as we go
-    heap.blocks[block] = heap.blocks[heap.usedBlocks - 1];
-    heap.usedBlocks--;
+    m_heap.blocks[block] = m_heap.blocks[m_heap.usedBlocks - 1];
+    m_heap.usedBlocks--;
 
-    if (heap.numBlocks > MIN_ARRAY_SIZE && heap.usedBlocks < heap.numBlocks / LOW_WATER_FACTOR) {
-        heap.numBlocks = heap.numBlocks / GROWTH_FACTOR; 
-        heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, heap.numBlocks * sizeof(CollectorBlock*)));
+    if (m_heap.numBlocks > MIN_ARRAY_SIZE && m_heap.usedBlocks < m_heap.numBlocks / LOW_WATER_FACTOR) {
+        m_heap.numBlocks = m_heap.numBlocks / GROWTH_FACTOR; 
+        m_heap.blocks = static_cast<CollectorBlock**>(fastRealloc(m_heap.blocks, m_heap.numBlocks * sizeof(CollectorBlock*)));
     }
 }
 
-NEVER_INLINE void Heap::freeBlock(CollectorBlock* block)
+NEVER_INLINE void Heap::freeBlockPtr(CollectorBlock* block)
 {
-    // Disable the use of vm_deallocate for the Qt build on Darwin, because when compiled on 10.4
-    // it crashes on 10.5
-#if PLATFORM(DARWIN) && !PLATFORM(QT)
+#if OS(DARWIN)    
     vm_deallocate(current_task(), reinterpret_cast<vm_address_t>(block), BLOCK_SIZE);
-#elif PLATFORM(SYMBIAN)
+#elif OS(SYMBIAN)
     m_blockallocator.free(reinterpret_cast<void*>(block));
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
     VirtualFree(block, 0, MEM_RELEASE);
-#elif PLATFORM(WIN_OS)
-#if COMPILER(MINGW)
+#elif OS(WINDOWS)
+#if COMPILER(MINGW) && !defined(__MINGW64_VERSION_MAJOR)
     __mingw_aligned_free(block);
 #else
     _aligned_free(block);
@@ -326,13 +304,34 @@ NEVER_INLINE void Heap::freeBlock(CollectorBlock* block)
 #endif
 }
 
-void Heap::freeBlocks(CollectorHeap* heap)
+void Heap::freeBlocks()
 {
-    for (size_t i = 0; i < heap->usedBlocks; ++i)
-        if (heap->blocks[i])
-            freeBlock(heap->blocks[i]);
-    fastFree(heap->blocks);
-    memset(heap, 0, sizeof(CollectorHeap));
+    ProtectCountSet protectedValuesCopy = m_protectedValues;
+
+    clearMarkBits();
+    ProtectCountSet::iterator protectedValuesEnd = protectedValuesCopy.end();
+    for (ProtectCountSet::iterator it = protectedValuesCopy.begin(); it != protectedValuesEnd; ++it)
+        markCell(it->first);
+
+    m_heap.nextCell = 0;
+    m_heap.nextBlock = 0;
+    DeadObjectIterator it(m_heap, m_heap.nextBlock, m_heap.nextCell);
+    DeadObjectIterator end(m_heap, m_heap.usedBlocks);
+    for ( ; it != end; ++it)
+        (*it)->~JSCell();
+
+    ASSERT(!protectedObjectCount());
+
+    protectedValuesEnd = protectedValuesCopy.end();
+    for (ProtectCountSet::iterator it = protectedValuesCopy.begin(); it != protectedValuesEnd; ++it)
+        it->first->~JSCell();
+
+    for (size_t block = 0; block < m_heap.usedBlocks; ++block)
+        freeBlockPtr(m_heap.blocks[block]);
+
+    fastFree(m_heap.blocks);
+
+    memset(&m_heap, 0, sizeof(CollectorHeap));
 }
 
 void Heap::recordExtraCost(size_t cost)
@@ -347,123 +346,109 @@ void Heap::recordExtraCost(size_t cost)
     // are either very short lived temporaries, or have extremely long lifetimes. So
     // if a large value survives one garbage collection, there is not much point to
     // collecting more frequently as long as it stays alive.
-    // NOTE: we target the primaryHeap unconditionally as JSNumber doesn't modify cost 
 
-    primaryHeap.extraCost += cost;
+    if (m_heap.extraCost > maxExtraCost && m_heap.extraCost > m_heap.usedBlocks * BLOCK_SIZE / 2) {
+        // If the last iteration through the heap deallocated blocks, we need
+        // to clean up remaining garbage before marking. Otherwise, the conservative
+        // marking mechanism might follow a pointer to unmapped memory.
+        if (m_heap.didShrink)
+            sweep();
+        reset();
+    }
+    m_heap.extraCost += cost;
 }
 
-template <HeapType heapType> ALWAYS_INLINE void* Heap::heapAllocate(size_t s)
+void* Heap::allocate(size_t s)
 {
-    typedef typename HeapConstants<heapType>::Block Block;
-    typedef typename HeapConstants<heapType>::Cell Cell;
-
-    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
+    typedef HeapConstants::Block Block;
+    typedef HeapConstants::Cell Cell;
+    
     ASSERT(JSLock::lockCount() > 0);
     ASSERT(JSLock::currentThreadIsHoldingLock());
-    ASSERT_UNUSED(s, s <= HeapConstants<heapType>::cellSize);
+    ASSERT_UNUSED(s, s <= HeapConstants::cellSize);
 
-    ASSERT(heap.operationInProgress == NoOperation);
-    ASSERT(heapType == PrimaryHeap || heap.extraCost == 0);
-    // FIXME: If another global variable access here doesn't hurt performance
-    // too much, we could CRASH() in NDEBUG builds, which could help ensure we
-    // don't spend any time debugging cases where we allocate inside an object's
-    // deallocation code.
+    ASSERT(m_heap.operationInProgress == NoOperation);
 
 #if COLLECT_ON_EVERY_ALLOCATION
-    collect();
+    collectAllGarbage();
+    ASSERT(m_heap.operationInProgress == NoOperation);
 #endif
 
-    size_t numLiveObjects = heap.numLiveObjects;
-    size_t usedBlocks = heap.usedBlocks;
-    size_t i = heap.firstBlockWithPossibleSpace;
-
-    // if we have a huge amount of extra cost, we'll try to collect even if we still have
-    // free cells left.
-    if (heapType == PrimaryHeap && heap.extraCost > ALLOCATIONS_PER_COLLECTION) {
-        size_t numLiveObjectsAtLastCollect = heap.numLiveObjectsAtLastCollect;
-        size_t numNewObjects = numLiveObjects - numLiveObjectsAtLastCollect;
-        const size_t newCost = numNewObjects + heap.extraCost;
-        if (newCost >= ALLOCATIONS_PER_COLLECTION && newCost >= numLiveObjectsAtLastCollect)
-            goto collect;
-    }
+allocate:
 
-    ASSERT(heap.operationInProgress == NoOperation);
-#ifndef NDEBUG
-    // FIXME: Consider doing this in NDEBUG builds too (see comment above).
-    heap.operationInProgress = Allocation;
-#endif
+    // Fast case: find the next garbage cell and recycle it.
 
-scan:
-    Block* targetBlock;
-    size_t targetBlockUsedCells;
-    if (i != usedBlocks) {
-        targetBlock = reinterpret_cast<Block*>(heap.blocks[i]);
-        targetBlockUsedCells = targetBlock->usedCells;
-        ASSERT(targetBlockUsedCells <= HeapConstants<heapType>::cellsPerBlock);
-        while (targetBlockUsedCells == HeapConstants<heapType>::cellsPerBlock) {
-            if (++i == usedBlocks)
-                goto collect;
-            targetBlock = reinterpret_cast<Block*>(heap.blocks[i]);
-            targetBlockUsedCells = targetBlock->usedCells;
-            ASSERT(targetBlockUsedCells <= HeapConstants<heapType>::cellsPerBlock);
-        }
-        heap.firstBlockWithPossibleSpace = i;
-    } else {
+    do {
+        ASSERT(m_heap.nextBlock < m_heap.usedBlocks);
+        Block* block = reinterpret_cast<Block*>(m_heap.blocks[m_heap.nextBlock]);
+        do {
+            ASSERT(m_heap.nextCell < HeapConstants::cellsPerBlock);
+            if (!block->marked.get(m_heap.nextCell)) { // Always false for the last cell in the block
+                Cell* cell = block->cells + m_heap.nextCell;
 
-collect:
-        size_t numLiveObjectsAtLastCollect = heap.numLiveObjectsAtLastCollect;
-        size_t numNewObjects = numLiveObjects - numLiveObjectsAtLastCollect;
-        const size_t newCost = numNewObjects + heap.extraCost;
+                m_heap.operationInProgress = Allocation;
+                JSCell* imp = reinterpret_cast<JSCell*>(cell);
+                imp->~JSCell();
+                m_heap.operationInProgress = NoOperation;
 
-        if (newCost >= ALLOCATIONS_PER_COLLECTION && newCost >= numLiveObjectsAtLastCollect) {
-#ifndef NDEBUG
-            heap.operationInProgress = NoOperation;
-#endif
-            bool foundGarbage = collect();
-            numLiveObjects = heap.numLiveObjects;
-            usedBlocks = heap.usedBlocks;
-            i = heap.firstBlockWithPossibleSpace;
-#ifndef NDEBUG
-            heap.operationInProgress = Allocation;
-#endif
-            if (foundGarbage)
-                goto scan;
-        }
+                ++m_heap.nextCell;
+                return cell;
+            }
+        } while (++m_heap.nextCell != HeapConstants::cellsPerBlock);
+        m_heap.nextCell = 0;
+    } while (++m_heap.nextBlock != m_heap.usedBlocks);
 
-        // didn't find a block, and GC didn't reclaim anything, need to allocate a new block
-        targetBlock = reinterpret_cast<Block*>(allocateBlock<heapType>());
-        heap.firstBlockWithPossibleSpace = heap.usedBlocks - 1;
-        targetBlockUsedCells = 0;
-    }
+    // Slow case: reached the end of the heap. Mark live objects and start over.
 
-    // find a free spot in the block and detach it from the free list
-    Cell* newCell = targetBlock->freeList;
+    reset();
+    goto allocate;
+}
 
-    // "next" field is a cell offset -- 0 means next cell, so a zeroed block is already initialized
-    targetBlock->freeList = (newCell + 1) + newCell->u.freeCell.next;
+void Heap::resizeBlocks()
+{
+    m_heap.didShrink = false;
 
-    targetBlock->usedCells = static_cast<uint32_t>(targetBlockUsedCells + 1);
-    heap.numLiveObjects = numLiveObjects + 1;
+    size_t usedCellCount = markedCells();
+    size_t minCellCount = usedCellCount + max(ALLOCATIONS_PER_COLLECTION, usedCellCount);
+    size_t minBlockCount = (minCellCount + HeapConstants::cellsPerBlock - 1) / HeapConstants::cellsPerBlock;
 
-#ifndef NDEBUG
-    // FIXME: Consider doing this in NDEBUG builds too (see comment above).
-    heap.operationInProgress = NoOperation;
-#endif
+    size_t maxCellCount = 1.25f * minCellCount;
+    size_t maxBlockCount = (maxCellCount + HeapConstants::cellsPerBlock - 1) / HeapConstants::cellsPerBlock;
 
-    return newCell;
+    if (m_heap.usedBlocks < minBlockCount)
+        growBlocks(minBlockCount);
+    else if (m_heap.usedBlocks > maxBlockCount)
+        shrinkBlocks(maxBlockCount);
 }
 
-void* Heap::allocate(size_t s)
+void Heap::growBlocks(size_t neededBlocks)
 {
-    return heapAllocate<PrimaryHeap>(s);
+    ASSERT(m_heap.usedBlocks < neededBlocks);
+    while (m_heap.usedBlocks < neededBlocks)
+        allocateBlock();
 }
 
-void* Heap::allocateNumber(size_t s)
+void Heap::shrinkBlocks(size_t neededBlocks)
 {
-    return heapAllocate<NumberHeap>(s);
+    ASSERT(m_heap.usedBlocks > neededBlocks);
+    
+    // Clear the always-on last bit, so isEmpty() isn't fooled by it.
+    for (size_t i = 0; i < m_heap.usedBlocks; ++i)
+        m_heap.blocks[i]->marked.clear(HeapConstants::cellsPerBlock - 1);
+
+    for (size_t i = 0; i != m_heap.usedBlocks && m_heap.usedBlocks != neededBlocks; ) {
+        if (m_heap.blocks[i]->marked.isEmpty()) {
+            freeBlock(i);
+        } else
+            ++i;
+    }
+
+    // Reset the always-on last bit.
+    for (size_t i = 0; i < m_heap.usedBlocks; ++i)
+        m_heap.blocks[i]->marked.set(HeapConstants::cellsPerBlock - 1);
 }
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 void* g_stackBase = 0;
 
 inline bool isPageWritable(void* page)
@@ -520,7 +505,7 @@ static void* getStackBase(void* previousFrame)
 }
 #endif
 
-#if PLATFORM(QNX)
+#if OS(QNX)
 static inline void *currentThreadStackBaseQNX()
 {
     static void* stackBase = 0;
@@ -549,10 +534,10 @@ static inline void *currentThreadStackBaseQNX()
 
 static inline void* currentThreadStackBase()
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     pthread_t thread = pthread_self();
     return pthread_get_stackaddr_np(thread);
-#elif PLATFORM(WIN_OS) && PLATFORM(X86) && COMPILER(MSVC)
+#elif OS(WINDOWS) && CPU(X86) && COMPILER(MSVC)
     // offset 0x18 from the FS segment register gives a pointer to
     // the thread information block for the current thread
     NT_TIB* pTib;
@@ -561,10 +546,7 @@ static inline void* currentThreadStackBase()
         MOV pTib, EAX
     }
     return static_cast<void*>(pTib->StackBase);
-#elif PLATFORM(WIN_OS) && PLATFORM(X86_64) && COMPILER(MSVC)
-    PNT_TIB64 pTib = reinterpret_cast<PNT_TIB64>(NtCurrentTeb());
-    return reinterpret_cast<void*>(pTib->StackBase);
-#elif PLATFORM(WIN_OS) && PLATFORM(X86) && COMPILER(GCC)
+#elif OS(WINDOWS) && CPU(X86) && COMPILER(GCC)
     // offset 0x18 from the FS segment register gives a pointer to
     // the thread information block for the current thread
     NT_TIB* pTib;
@@ -572,18 +554,21 @@ static inline void* currentThreadStackBase()
           : "=r" (pTib)
         );
     return static_cast<void*>(pTib->StackBase);
-#elif PLATFORM(QNX)
+#elif OS(WINDOWS) && CPU(X86_64)
+    PNT_TIB64 pTib = reinterpret_cast<PNT_TIB64>(NtCurrentTeb());
+    return reinterpret_cast<void*>(pTib->StackBase);
+#elif OS(QNX)
     return currentThreadStackBaseQNX();
-#elif PLATFORM(SOLARIS)
+#elif OS(SOLARIS)
     stack_t s;
     thr_stksegment(&s);
     return s.ss_sp;
-#elif PLATFORM(OPENBSD)
+#elif OS(OPENBSD)
     pthread_t thread = pthread_self();
     stack_t stack;
     pthread_stackseg_np(thread, &stack);
     return stack.ss_sp;
-#elif PLATFORM(SYMBIAN)
+#elif OS(SYMBIAN)
     static void* stackBase = 0;
     if (stackBase == 0) {
         TThreadStackInfo info;
@@ -592,63 +577,21 @@ static inline void* currentThreadStackBase()
         stackBase = (void*)info.iBase;
     }
     return (void*)stackBase;
-#elif PLATFORM(HAIKU)
+#elif OS(HAIKU)
     thread_info threadInfo;
     get_thread_info(find_thread(NULL), &threadInfo);
     return threadInfo.stack_end;
-#elif PLATFORM(UNIX)
-#ifdef UCLIBC_USE_PROC_SELF_MAPS
-    // Read /proc/self/maps and locate the line whose address
-    // range contains __libc_stack_end.
-    FILE *file = fopen("/proc/self/maps", "r");
-    if (!file)
-        return 0;
-    __fsetlocking(file, FSETLOCKING_BYCALLER);
-    char *line = NULL;
-    size_t lineLen = 0;
-    while (!feof_unlocked(file)) {
-        if (getdelim(&line, &lineLen, '\n', file) <= 0)
-            break;
-
-        long from;
-        long to;
-        if (sscanf (line, "%lx-%lx", &from, &to) != 2)
-            continue;
-        if (from <= (long)__libc_stack_end && (long)__libc_stack_end < to) {
-            fclose(file);
-            free(line);
-#ifdef _STACK_GROWS_UP
-            return (void *)from;
-#else
-            return (void *)to;
-#endif
-        }
-    }
-    fclose(file);
-    free(line);
-    return 0;
-#else
+#elif OS(UNIX)
     static void* stackBase = 0;
     static size_t stackSize = 0;
     static pthread_t stackThread;
     pthread_t thread = pthread_self();
     if (stackBase == 0 || thread != stackThread) {
-#if defined(QT_LINUXBASE)
-        // LinuxBase is missing pthread_getattr_np - resolve it once at runtime instead
-        // see http://bugs.linuxbase.org/show_bug.cgi?id=2364
-        typedef int (*GetAttrPtr)(pthread_t, pthread_attr_t *);
-        static int (*pthread_getattr_np_ptr)(pthread_t, pthread_attr_t *) = 0;
-        if (!pthread_getattr_np_ptr)
-            *(void **)&pthread_getattr_np_ptr = dlsym(RTLD_DEFAULT, "pthread_getattr_np");
-#endif
         pthread_attr_t sattr;
         pthread_attr_init(&sattr);
-#if HAVE(PTHREAD_NP_H) || PLATFORM(NETBSD)
+#if HAVE(PTHREAD_NP_H) || OS(NETBSD)
         // e.g. on FreeBSD 5.4, neundorf@kde.org
         pthread_attr_get_np(thread, &sattr);
-#elif defined(QT_LINUXBASE)
-        if (pthread_getattr_np_ptr)
-            pthread_getattr_np_ptr(thread, &sattr);
 #else
         // FIXME: this function is non-portable; other POSIX systems may have different np alternatives
         pthread_getattr_np(thread, &sattr);
@@ -660,8 +603,7 @@ static inline void* currentThreadStackBase()
         stackThread = thread;
     }
     return static_cast<char*>(stackBase) + stackSize;
-#endif
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
     if (g_stackBase)
         return g_stackBase;
     else {
@@ -677,11 +619,10 @@ static inline void* currentThreadStackBase()
 
 static inline PlatformThread getCurrentPlatformThread()
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     return pthread_mach_thread_np(pthread_self());
-#elif PLATFORM(WIN_OS)
-    HANDLE threadHandle = pthread_getw32threadhandle_np(pthread_self());
-    return PlatformThread(GetCurrentThreadId(), threadHandle);
+#elif OS(WINDOWS)
+    return pthread_getw32threadhandle_np(pthread_self());
 #endif
 }
 
@@ -750,10 +691,37 @@ void Heap::registerThread()
 
 #endif
 
-#define IS_POINTER_ALIGNED(p) (((intptr_t)(p) & (sizeof(char*) - 1)) == 0)
+inline bool isPointerAligned(void* p)
+{
+    return (((intptr_t)(p) & (sizeof(char*) - 1)) == 0);
+}
+
+// Cell size needs to be a power of two for isPossibleCell to be valid.
+COMPILE_ASSERT(sizeof(CollectorCell) % 2 == 0, Collector_cell_size_is_power_of_two);
+
+#if USE(JSVALUE32)
+static bool isHalfCellAligned(void *p)
+{
+    return (((intptr_t)(p) & (CELL_MASK >> 1)) == 0);
+}
+
+static inline bool isPossibleCell(void* p)
+{
+    return isHalfCellAligned(p) && p;
+}
 
-// cell size needs to be a power of two for this to be valid
-#define IS_HALF_CELL_ALIGNED(p) (((intptr_t)(p) & (CELL_MASK >> 1)) == 0)
+#else
+
+static inline bool isCellAligned(void *p)
+{
+    return (((intptr_t)(p) & CELL_MASK) == 0);
+}
+
+static inline bool isPossibleCell(void* p)
+{
+    return isCellAligned(p) && p;
+}
+#endif // USE(JSVALUE32)
 
 void Heap::markConservatively(MarkStack& markStack, void* start, void* end)
 {
@@ -764,46 +732,33 @@ void Heap::markConservatively(MarkStack& markStack, void* start, void* end)
     }
 
     ASSERT((static_cast<char*>(end) - static_cast<char*>(start)) < 0x1000000);
-    ASSERT(IS_POINTER_ALIGNED(start));
-    ASSERT(IS_POINTER_ALIGNED(end));
+    ASSERT(isPointerAligned(start));
+    ASSERT(isPointerAligned(end));
 
     char** p = static_cast<char**>(start);
     char** e = static_cast<char**>(end);
 
-    size_t usedPrimaryBlocks = primaryHeap.usedBlocks;
-    size_t usedNumberBlocks = numberHeap.usedBlocks;
-    CollectorBlock** primaryBlocks = primaryHeap.blocks;
-    CollectorBlock** numberBlocks = numberHeap.blocks;
-
-    const size_t lastCellOffset = sizeof(CollectorCell) * (CELLS_PER_BLOCK - 1);
-
+    CollectorBlock** blocks = m_heap.blocks;
     while (p != e) {
         char* x = *p++;
-        if (IS_HALF_CELL_ALIGNED(x) && x) {
+        if (isPossibleCell(x)) {
+            size_t usedBlocks;
             uintptr_t xAsBits = reinterpret_cast<uintptr_t>(x);
             xAsBits &= CELL_ALIGN_MASK;
+
             uintptr_t offset = xAsBits & BLOCK_OFFSET_MASK;
+            const size_t lastCellOffset = sizeof(CollectorCell) * (CELLS_PER_BLOCK - 1);
+            if (offset > lastCellOffset)
+                continue;
+
             CollectorBlock* blockAddr = reinterpret_cast<CollectorBlock*>(xAsBits - offset);
-            // Mark the the number heap, we can mark these Cells directly to avoid the virtual call cost
-            for (size_t block = 0; block < usedNumberBlocks; block++) {
-                if ((numberBlocks[block] == blockAddr) & (offset <= lastCellOffset)) {
-                    Heap::markCell(reinterpret_cast<JSCell*>(xAsBits));
-                    goto endMarkLoop;
-                }
-            }
-          
-            // Mark the primary heap
-            for (size_t block = 0; block < usedPrimaryBlocks; block++) {
-                if ((primaryBlocks[block] == blockAddr) & (offset <= lastCellOffset)) {
-                    if (reinterpret_cast<CollectorCell*>(xAsBits)->u.freeCell.zeroIfFree) {
-                        markStack.append(reinterpret_cast<JSCell*>(xAsBits));
-                        markStack.drain();
-                    }
-                    break;
-                }
+            usedBlocks = m_heap.usedBlocks;
+            for (size_t block = 0; block < usedBlocks; block++) {
+                if (blocks[block] != blockAddr)
+                    continue;
+                markStack.append(reinterpret_cast<JSCell*>(xAsBits));
+                markStack.drain();
             }
-        endMarkLoop:
-            ;
         }
     }
 }
@@ -842,10 +797,10 @@ void Heap::markCurrentThreadConservatively(MarkStack& markStack)
 
 static inline void suspendThread(const PlatformThread& platformThread)
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     thread_suspend(platformThread);
-#elif PLATFORM(WIN_OS)
-    SuspendThread(platformThread.handle);
+#elif OS(WINDOWS)
+    SuspendThread(platformThread);
 #else
 #error Need a way to suspend threads on this platform
 #endif
@@ -853,10 +808,10 @@ static inline void suspendThread(const PlatformThread& platformThread)
 
 static inline void resumeThread(const PlatformThread& platformThread)
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     thread_resume(platformThread);
-#elif PLATFORM(WIN_OS)
-    ResumeThread(platformThread.handle);
+#elif OS(WINDOWS)
+    ResumeThread(platformThread);
 #else
 #error Need a way to resume threads on this platform
 #endif
@@ -864,23 +819,23 @@ static inline void resumeThread(const PlatformThread& platformThread)
 
 typedef unsigned long usword_t; // word size, assumed to be either 32 or 64 bit
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
-#if PLATFORM(X86)
+#if CPU(X86)
 typedef i386_thread_state_t PlatformThreadRegisters;
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
 typedef x86_thread_state64_t PlatformThreadRegisters;
-#elif PLATFORM(PPC)
+#elif CPU(PPC)
 typedef ppc_thread_state_t PlatformThreadRegisters;
-#elif PLATFORM(PPC64)
+#elif CPU(PPC64)
 typedef ppc_thread_state64_t PlatformThreadRegisters;
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
 typedef arm_thread_state_t PlatformThreadRegisters;
 #else
 #error Unknown Architecture
 #endif
 
-#elif PLATFORM(WIN_OS)&& PLATFORM(X86)
+#elif OS(WINDOWS) && CPU(X86)
 typedef CONTEXT PlatformThreadRegisters;
 #else
 #error Need a thread register struct for this platform
@@ -888,21 +843,21 @@ typedef CONTEXT PlatformThreadRegisters;
 
 static size_t getPlatformThreadRegisters(const PlatformThread& platformThread, PlatformThreadRegisters& regs)
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
-#if PLATFORM(X86)
+#if CPU(X86)
     unsigned user_count = sizeof(regs)/sizeof(int);
     thread_state_flavor_t flavor = i386_THREAD_STATE;
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
     unsigned user_count = x86_THREAD_STATE64_COUNT;
     thread_state_flavor_t flavor = x86_THREAD_STATE64;
-#elif PLATFORM(PPC) 
+#elif CPU(PPC) 
     unsigned user_count = PPC_THREAD_STATE_COUNT;
     thread_state_flavor_t flavor = PPC_THREAD_STATE;
-#elif PLATFORM(PPC64)
+#elif CPU(PPC64)
     unsigned user_count = PPC_THREAD_STATE64_COUNT;
     thread_state_flavor_t flavor = PPC_THREAD_STATE64;
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
     unsigned user_count = ARM_THREAD_STATE_COUNT;
     thread_state_flavor_t flavor = ARM_THREAD_STATE;
 #else
@@ -916,11 +871,11 @@ static size_t getPlatformThreadRegisters(const PlatformThread& platformThread, P
         CRASH();
     }
     return user_count * sizeof(usword_t);
-// end PLATFORM(DARWIN)
+// end OS(DARWIN)
 
-#elif PLATFORM(WIN_OS) && PLATFORM(X86)
+#elif OS(WINDOWS) && CPU(X86)
     regs.ContextFlags = CONTEXT_INTEGER | CONTEXT_CONTROL | CONTEXT_SEGMENTS;
-    GetThreadContext(platformThread.handle, &regs);
+    GetThreadContext(platformThread, &regs);
     return sizeof(CONTEXT);
 #else
 #error Need a way to get thread registers on this platform
@@ -929,17 +884,17 @@ static size_t getPlatformThreadRegisters(const PlatformThread& platformThread, P
 
 static inline void* otherThreadStackPointer(const PlatformThreadRegisters& regs)
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
 #if __DARWIN_UNIX03
 
-#if PLATFORM(X86)
+#if CPU(X86)
     return reinterpret_cast<void*>(regs.__esp);
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
     return reinterpret_cast<void*>(regs.__rsp);
-#elif PLATFORM(PPC) || PLATFORM(PPC64)
+#elif CPU(PPC) || CPU(PPC64)
     return reinterpret_cast<void*>(regs.__r1);
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
     return reinterpret_cast<void*>(regs.__sp);
 #else
 #error Unknown Architecture
@@ -947,11 +902,11 @@ static inline void* otherThreadStackPointer(const PlatformThreadRegisters& regs)
 
 #else // !__DARWIN_UNIX03
 
-#if PLATFORM(X86)
+#if CPU(X86)
     return reinterpret_cast<void*>(regs.esp);
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
     return reinterpret_cast<void*>(regs.rsp);
-#elif (PLATFORM(PPC) || PLATFORM(PPC64))
+#elif CPU(PPC) || CPU(PPC64)
     return reinterpret_cast<void*>(regs.r1);
 #else
 #error Unknown Architecture
@@ -959,8 +914,8 @@ static inline void* otherThreadStackPointer(const PlatformThreadRegisters& regs)
 
 #endif // __DARWIN_UNIX03
 
-// end PLATFORM(DARWIN)
-#elif PLATFORM(X86) && PLATFORM(WIN_OS)
+// end OS(DARWIN)
+#elif CPU(X86) && OS(WINDOWS)
     return reinterpret_cast<void*>((uintptr_t) regs.Esp);
 #else
 #error Need a way to get the stack pointer for another thread on this platform
@@ -1025,15 +980,15 @@ void Heap::protect(JSValue k)
     m_protectedValues.add(k.asCell());
 }
 
-void Heap::unprotect(JSValue k)
+bool Heap::unprotect(JSValue k)
 {
     ASSERT(k);
     ASSERT(JSLock::currentThreadIsHoldingLock() || !m_globalData->isSharedInstance);
 
     if (!k.isCell())
-        return;
+        return false;
 
-    m_protectedValues.remove(k.asCell());
+    return m_protectedValues.remove(k.asCell());
 }
 
 void Heap::markProtectedObjects(MarkStack& markStack)
@@ -1045,109 +1000,68 @@ void Heap::markProtectedObjects(MarkStack& markStack)
     }
 }
 
-template <HeapType heapType> size_t Heap::sweep()
+void Heap::clearMarkBits()
 {
-    typedef typename HeapConstants<heapType>::Block Block;
-    typedef typename HeapConstants<heapType>::Cell Cell;
+    for (size_t i = 0; i < m_heap.usedBlocks; ++i)
+        clearMarkBits(m_heap.blocks[i]);
+}
 
-    // SWEEP: delete everything with a zero refcount (garbage) and unmark everything else
-    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
-    
-    size_t emptyBlocks = 0;
-    size_t numLiveObjects = heap.numLiveObjects;
-    
-    for (size_t block = 0; block < heap.usedBlocks; block++) {
-        Block* curBlock = reinterpret_cast<Block*>(heap.blocks[block]);
-        
-        size_t usedCells = curBlock->usedCells;
-        Cell* freeList = curBlock->freeList;
-        
-        if (usedCells == HeapConstants<heapType>::cellsPerBlock) {
-            // special case with a block where all cells are used -- testing indicates this happens often
-            for (size_t i = 0; i < HeapConstants<heapType>::cellsPerBlock; i++) {
-                if (!curBlock->marked.get(i >> HeapConstants<heapType>::bitmapShift)) {
-                    Cell* cell = curBlock->cells + i;
-                    
-                    if (heapType != NumberHeap) {
-                        JSCell* imp = reinterpret_cast<JSCell*>(cell);
-                        // special case for allocated but uninitialized object
-                        // (We don't need this check earlier because nothing prior this point 
-                        // assumes the object has a valid vptr.)
-                        if (cell->u.freeCell.zeroIfFree == 0)
-                            continue;
-                        
-                        imp->~JSCell();
-                    }
-                    
-                    --usedCells;
-                    --numLiveObjects;
-                    
-                    // put cell on the free list
-                    cell->u.freeCell.zeroIfFree = 0;
-                    cell->u.freeCell.next = freeList - (cell + 1);
-                    freeList = cell;
-                }
-            }
-        } else {
-            size_t minimumCellsToProcess = usedCells;
-            for (size_t i = 0; (i < minimumCellsToProcess) & (i < HeapConstants<heapType>::cellsPerBlock); i++) {
-                Cell* cell = curBlock->cells + i;
-                if (cell->u.freeCell.zeroIfFree == 0) {
-                    ++minimumCellsToProcess;
-                } else {
-                    if (!curBlock->marked.get(i >> HeapConstants<heapType>::bitmapShift)) {
-                        if (heapType != NumberHeap) {
-                            JSCell* imp = reinterpret_cast<JSCell*>(cell);
-                            imp->~JSCell();
-                        }
-                        --usedCells;
-                        --numLiveObjects;
-                        
-                        // put cell on the free list
-                        cell->u.freeCell.zeroIfFree = 0;
-                        cell->u.freeCell.next = freeList - (cell + 1); 
-                        freeList = cell;
-                    }
-                }
-            }
-        }
-        
-        curBlock->usedCells = static_cast<uint32_t>(usedCells);
-        curBlock->freeList = freeList;
-        curBlock->marked.clearAll();
-        
-        if (!usedCells)
-            ++emptyBlocks;
-    }
-    
-    if (heap.numLiveObjects != numLiveObjects)
-        heap.firstBlockWithPossibleSpace = 0;
-    
-    heap.numLiveObjects = numLiveObjects;
-    heap.numLiveObjectsAtLastCollect = numLiveObjects;
-    heap.extraCost = 0;
-    
-    if (!emptyBlocks)
-        return numLiveObjects;
+void Heap::clearMarkBits(CollectorBlock* block)
+{
+    // allocate assumes that the last cell in every block is marked.
+    block->marked.clearAll();
+    block->marked.set(HeapConstants::cellsPerBlock - 1);
+}
 
-    size_t neededCells = 1.25f * (numLiveObjects + max(ALLOCATIONS_PER_COLLECTION, numLiveObjects));
-    size_t neededBlocks = (neededCells + HeapConstants<heapType>::cellsPerBlock - 1) / HeapConstants<heapType>::cellsPerBlock;
-    for (size_t block = 0; block < heap.usedBlocks; block++) {
-        if (heap.usedBlocks <= neededBlocks)
-            break;
+size_t Heap::markedCells(size_t startBlock, size_t startCell) const
+{
+    ASSERT(startBlock <= m_heap.usedBlocks);
+    ASSERT(startCell < HeapConstants::cellsPerBlock);
+
+    if (startBlock >= m_heap.usedBlocks)
+        return 0;
 
-        Block* curBlock = reinterpret_cast<Block*>(heap.blocks[block]);
-        if (curBlock->usedCells)
-            continue;
+    size_t result = 0;
+    result += m_heap.blocks[startBlock]->marked.count(startCell);
+    for (size_t i = startBlock + 1; i < m_heap.usedBlocks; ++i)
+        result += m_heap.blocks[i]->marked.count();
+
+    return result;
+}
+
+void Heap::sweep()
+{
+    ASSERT(m_heap.operationInProgress == NoOperation);
+    if (m_heap.operationInProgress != NoOperation)
+        CRASH();
+    m_heap.operationInProgress = Collection;
+    
+#if !ENABLE(JSC_ZOMBIES)
+    Structure* dummyMarkableCellStructure = m_globalData->dummyMarkableCellStructure.get();
+#endif
 
-        freeBlock<heapType>(block);
-        block--; // Don't move forward a step in this case
+    DeadObjectIterator it(m_heap, m_heap.nextBlock, m_heap.nextCell);
+    DeadObjectIterator end(m_heap, m_heap.usedBlocks);
+    for ( ; it != end; ++it) {
+        JSCell* cell = *it;
+#if ENABLE(JSC_ZOMBIES)
+        if (!cell->isZombie()) {
+            const ClassInfo* info = cell->classInfo();
+            cell->~JSCell();
+            new (cell) JSZombie(info, JSZombie::leakedZombieStructure());
+            Heap::markCell(cell);
+        }
+#else
+        cell->~JSCell();
+        // Callers of sweep assume it's safe to mark any cell in the heap.
+        new (cell) JSCell(dummyMarkableCellStructure);
+#endif
     }
 
-    return numLiveObjects;
+    m_heap.operationInProgress = NoOperation;
 }
 
-bool Heap::collect()
+void Heap::markRoots()
 {
 #ifndef NDEBUG
     if (m_globalData->isSharedInstance) {
@@ -1156,66 +1070,62 @@ bool Heap::collect()
     }
 #endif
 
-    ASSERT((primaryHeap.operationInProgress == NoOperation) | (numberHeap.operationInProgress == NoOperation));
-    if ((primaryHeap.operationInProgress != NoOperation) | (numberHeap.operationInProgress != NoOperation))
+    ASSERT(m_heap.operationInProgress == NoOperation);
+    if (m_heap.operationInProgress != NoOperation)
         CRASH();
 
-    JAVASCRIPTCORE_GC_BEGIN();
-    primaryHeap.operationInProgress = Collection;
-    numberHeap.operationInProgress = Collection;
+    m_heap.operationInProgress = Collection;
 
-    // MARK: first mark all referenced objects recursively starting out from the set of root objects
     MarkStack& markStack = m_globalData->markStack;
+
+    // Reset mark bits.
+    clearMarkBits();
+
+    // Mark stack roots.
     markStackObjectsConservatively(markStack);
+    m_globalData->interpreter->registerFile().markCallFrames(markStack, this);
+
+    // Mark explicitly registered roots.
     markProtectedObjects(markStack);
+
+    // Mark misc. other roots.
     if (m_markListSet && m_markListSet->size())
         MarkedArgumentBuffer::markLists(markStack, *m_markListSet);
     if (m_globalData->exception)
         markStack.append(m_globalData->exception);
-    m_globalData->interpreter->registerFile().markCallFrames(markStack, this);
-    m_globalData->smallStrings.markChildren(markStack);
     if (m_globalData->functionCodeBlockBeingReparsed)
         m_globalData->functionCodeBlockBeingReparsed->markAggregate(markStack);
     if (m_globalData->firstStringifierToMark)
         JSONObject::markStringifiers(markStack, m_globalData->firstStringifierToMark);
 
+    // Mark the small strings cache last, since it will clear itself if nothing
+    // else has marked it.
+    m_globalData->smallStrings.markChildren(markStack);
+
     markStack.drain();
     markStack.compact();
-    JAVASCRIPTCORE_GC_MARKED();
-
-    size_t originalLiveObjects = primaryHeap.numLiveObjects + numberHeap.numLiveObjects;
-    size_t numLiveObjects = sweep<PrimaryHeap>();
-    numLiveObjects += sweep<NumberHeap>();
-
-    primaryHeap.operationInProgress = NoOperation;
-    numberHeap.operationInProgress = NoOperation;
-    JAVASCRIPTCORE_GC_END(originalLiveObjects, numLiveObjects);
 
-    return numLiveObjects < originalLiveObjects;
+    m_heap.operationInProgress = NoOperation;
 }
 
-size_t Heap::objectCount() 
+size_t Heap::objectCount() const
 {
-    return primaryHeap.numLiveObjects + numberHeap.numLiveObjects - m_globalData->smallStrings.count(); 
+    return m_heap.nextBlock * HeapConstants::cellsPerBlock // allocated full blocks
+           + m_heap.nextCell // allocated cells in current block
+           + markedCells(m_heap.nextBlock, m_heap.nextCell) // marked cells in remainder of m_heap
+           - m_heap.usedBlocks; // 1 cell per block is a dummy sentinel
 }
 
-template <HeapType heapType> 
-static void addToStatistics(Heap::Statistics& statistics, const CollectorHeap& heap)
+void Heap::addToStatistics(Heap::Statistics& statistics) const
 {
-    typedef HeapConstants<heapType> HC;
-    for (size_t i = 0; i < heap.usedBlocks; ++i) {
-        if (heap.blocks[i]) {
-            statistics.size += BLOCK_SIZE;
-            statistics.free += (HC::cellsPerBlock - heap.blocks[i]->usedCells) * HC::cellSize;
-        }
-    }
+    statistics.size += m_heap.usedBlocks * BLOCK_SIZE;
+    statistics.free += m_heap.usedBlocks * BLOCK_SIZE - (objectCount() * HeapConstants::cellSize);
 }
 
 Heap::Statistics Heap::statistics() const
 {
     Statistics statistics = { 0, 0 };
-    JSC::addToStatistics<PrimaryHeap>(statistics, primaryHeap);
-    JSC::addToStatistics<NumberHeap>(statistics, numberHeap);
+    addToStatistics(statistics);
     return statistics;
 }
 
@@ -1261,12 +1171,13 @@ static const char* typeName(JSCell* cell)
         return "number";
 #endif
     if (cell->isGetterSetter())
-        return "gettersetter";
+        return "Getter-Setter";
     if (cell->isAPIValueWrapper())
-        return "value wrapper";
+        return "API wrapper";
     if (cell->isPropertyNameIterator())
-        return "for-in iterator";
-    ASSERT(cell->isObject());
+        return "For-in iterator";
+    if (!cell->isObject())
+        return "[empty cell]";
     const ClassInfo* info = cell->classInfo();
     return info ? info->className : "Object";
 }
@@ -1282,19 +1193,75 @@ HashCountedSet<const char*>* Heap::protectedObjectTypeCounts()
     return counts;
 }
 
+HashCountedSet<const char*>* Heap::objectTypeCounts()
+{
+    HashCountedSet<const char*>* counts = new HashCountedSet<const char*>;
+
+    LiveObjectIterator it = primaryHeapBegin();
+    LiveObjectIterator heapEnd = primaryHeapEnd();
+    for ( ; it != heapEnd; ++it)
+        counts->add(typeName(*it));
+
+    return counts;
+}
+
 bool Heap::isBusy()
 {
-    return (primaryHeap.operationInProgress != NoOperation) | (numberHeap.operationInProgress != NoOperation);
+    return m_heap.operationInProgress != NoOperation;
+}
+
+void Heap::reset()
+{
+    JAVASCRIPTCORE_GC_BEGIN();
+
+    markRoots();
+
+    JAVASCRIPTCORE_GC_MARKED();
+
+    m_heap.nextCell = 0;
+    m_heap.nextBlock = 0;
+    m_heap.nextNumber = 0;
+    m_heap.extraCost = 0;
+#if ENABLE(JSC_ZOMBIES)
+    sweep();
+#endif
+    resizeBlocks();
+
+    JAVASCRIPTCORE_GC_END();
+}
+
+void Heap::collectAllGarbage()
+{
+    JAVASCRIPTCORE_GC_BEGIN();
+
+    // If the last iteration through the heap deallocated blocks, we need
+    // to clean up remaining garbage before marking. Otherwise, the conservative
+    // marking mechanism might follow a pointer to unmapped memory.
+    if (m_heap.didShrink)
+        sweep();
+
+    markRoots();
+
+    JAVASCRIPTCORE_GC_MARKED();
+
+    m_heap.nextCell = 0;
+    m_heap.nextBlock = 0;
+    m_heap.nextNumber = 0;
+    m_heap.extraCost = 0;
+    sweep();
+    resizeBlocks();
+
+    JAVASCRIPTCORE_GC_END();
 }
 
-Heap::iterator Heap::primaryHeapBegin()
+LiveObjectIterator Heap::primaryHeapBegin()
 {
-    return iterator(primaryHeap.blocks, primaryHeap.blocks + primaryHeap.usedBlocks);
+    return LiveObjectIterator(m_heap, 0);
 }
 
-Heap::iterator Heap::primaryHeapEnd()
+LiveObjectIterator Heap::primaryHeapEnd()
 {
-    return iterator(primaryHeap.blocks + primaryHeap.usedBlocks, primaryHeap.blocks + primaryHeap.usedBlocks);
+    return LiveObjectIterator(m_heap, m_heap.usedBlocks);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
index 086e519e79..3db3d7e9ea 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
@@ -28,14 +28,14 @@
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/StdLibExtras.h>
 #include <wtf/Threading.h>
 
-// This is supremely lame that we require pthreads to build on windows.
 #if ENABLE(JSC_MULTIPLE_THREADS)
 #include <pthread.h>
 #endif
 
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
 #include <wtf/symbian/BlockAllocatorSymbian.h>
 #endif
 
@@ -51,19 +51,21 @@ namespace JSC {
     class MarkStack;
 
     enum OperationInProgress { NoOperation, Allocation, Collection };
-    enum HeapType { PrimaryHeap, NumberHeap };
 
-    template <HeapType> class CollectorHeapIterator;
+    class LiveObjectIterator;
 
     struct CollectorHeap {
+        size_t nextBlock;
+        size_t nextCell;
         CollectorBlock** blocks;
+        
+        void* nextNumber;
+
         size_t numBlocks;
         size_t usedBlocks;
-        size_t firstBlockWithPossibleSpace;
 
-        size_t numLiveObjects;
-        size_t numLiveObjectsAtLastCollect;
         size_t extraCost;
+        bool didShrink;
 
         OperationInProgress operationInProgress;
     };
@@ -71,21 +73,21 @@ namespace JSC {
     class Heap : public Noncopyable {
     public:
         class Thread;
-        typedef CollectorHeapIterator<PrimaryHeap> iterator;
 
         void destroy();
 
         void* allocateNumber(size_t);
         void* allocate(size_t);
 
-        bool collect();
         bool isBusy(); // true if an allocation or collection is in progress
+        void collectAllGarbage();
 
-        static const size_t minExtraCostSize = 256;
+        static const size_t minExtraCost = 256;
+        static const size_t maxExtraCost = 1024 * 1024;
 
         void reportExtraMemoryCost(size_t cost);
 
-        size_t objectCount();
+        size_t objectCount() const;
         struct Statistics {
             size_t size;
             size_t free;
@@ -93,7 +95,9 @@ namespace JSC {
         Statistics statistics() const;
 
         void protect(JSValue);
-        void unprotect(JSValue);
+        // Returns true if the value is no longer protected by any protect pointers
+        // (though it may still be alive due to heap/stack references).
+        bool unprotect(JSValue);
 
         static Heap* heap(JSValue); // 0 for immediate values
         static Heap* heap(JSCell*);
@@ -102,6 +106,7 @@ namespace JSC {
         size_t protectedObjectCount();
         size_t protectedGlobalObjectCount();
         HashCountedSet<const char*>* protectedObjectTypeCounts();
+        HashCountedSet<const char*>* objectTypeCounts();
 
         void registerThread(); // Only needs to be called by clients that can use the same heap from multiple threads.
 
@@ -115,13 +120,12 @@ namespace JSC {
         JSGlobalData* globalData() const { return m_globalData; }
         static bool isNumber(JSCell*);
         
-        // Iterators for the object heap.
-        iterator primaryHeapBegin();
-        iterator primaryHeapEnd();
+        LiveObjectIterator primaryHeapBegin();
+        LiveObjectIterator primaryHeapEnd();
 
     private:
-        template <HeapType heapType> void* heapAllocate(size_t);
-        template <HeapType heapType> size_t sweep();
+        void reset();
+        void sweep();
         static CollectorBlock* cellBlock(const JSCell*);
         static size_t cellOffset(const JSCell*);
 
@@ -129,12 +133,22 @@ namespace JSC {
         Heap(JSGlobalData*);
         ~Heap();
 
-        template <HeapType heapType> NEVER_INLINE CollectorBlock* allocateBlock();
-        template <HeapType heapType> NEVER_INLINE void freeBlock(size_t);
-        NEVER_INLINE void freeBlock(CollectorBlock*);
-        void freeBlocks(CollectorHeap*);
+        NEVER_INLINE CollectorBlock* allocateBlock();
+        NEVER_INLINE void freeBlock(size_t);
+        NEVER_INLINE void freeBlockPtr(CollectorBlock*);
+        void freeBlocks();
+        void resizeBlocks();
+        void growBlocks(size_t neededBlocks);
+        void shrinkBlocks(size_t neededBlocks);
+        void clearMarkBits();
+        void clearMarkBits(CollectorBlock*);
+        size_t markedCells(size_t startBlock = 0, size_t startCell = 0) const;
 
         void recordExtraCost(size_t);
+
+        void addToStatistics(Statistics&) const;
+
+        void markRoots();
         void markProtectedObjects(MarkStack&);
         void markCurrentThreadConservatively(MarkStack&);
         void markCurrentThreadConservativelyInternal(MarkStack&);
@@ -143,8 +157,7 @@ namespace JSC {
 
         typedef HashCountedSet<JSCell*> ProtectCountSet;
 
-        CollectorHeap primaryHeap;
-        CollectorHeap numberHeap;
+        CollectorHeap m_heap;
 
         ProtectCountSet m_protectedValues;
 
@@ -161,7 +174,7 @@ namespace JSC {
         pthread_key_t m_currentThreadRegistrar;
 #endif
 
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
         // Allocates collector blocks with correct alignment
         WTF::AlignedBlockAllocator m_blockallocator; 
 #endif
@@ -180,7 +193,7 @@ namespace JSC {
 #endif
     template<> struct CellSize<sizeof(uint64_t)> { static const size_t m_value = 64; };
 
-#if PLATFORM(WINCE) || PLATFORM(SYMBIAN)
+#if OS(WINCE) || OS(SYMBIAN)
     const size_t BLOCK_SIZE = 64 * 1024; // 64k
 #else
     const size_t BLOCK_SIZE = 64 * 4096; // 256k
@@ -195,87 +208,60 @@ namespace JSC {
     const size_t SMALL_CELL_SIZE = CELL_SIZE / 2;
     const size_t CELL_MASK = CELL_SIZE - 1;
     const size_t CELL_ALIGN_MASK = ~CELL_MASK;
-    const size_t CELLS_PER_BLOCK = (BLOCK_SIZE * 8 - sizeof(uint32_t) * 8 - sizeof(void *) * 8 - 2 * (7 + 3 * 8)) / (CELL_SIZE * 8 + 2);
-    const size_t SMALL_CELLS_PER_BLOCK = 2 * CELLS_PER_BLOCK;
+    const size_t CELLS_PER_BLOCK = (BLOCK_SIZE - sizeof(Heap*)) * 8 * CELL_SIZE / (8 * CELL_SIZE + 1) / CELL_SIZE; // one bitmap byte can represent 8 cells.
+    
     const size_t BITMAP_SIZE = (CELLS_PER_BLOCK + 7) / 8;
     const size_t BITMAP_WORDS = (BITMAP_SIZE + 3) / sizeof(uint32_t);
-  
+
     struct CollectorBitmap {
         uint32_t bits[BITMAP_WORDS];
         bool get(size_t n) const { return !!(bits[n >> 5] & (1 << (n & 0x1F))); } 
         void set(size_t n) { bits[n >> 5] |= (1 << (n & 0x1F)); } 
         void clear(size_t n) { bits[n >> 5] &= ~(1 << (n & 0x1F)); } 
         void clearAll() { memset(bits, 0, sizeof(bits)); }
+        size_t count(size_t startCell = 0)
+        {
+            size_t result = 0;
+            for ( ; (startCell & 0x1F) != 0; ++startCell) {
+                if (get(startCell))
+                    ++result;
+            }
+            for (size_t i = startCell >> 5; i < BITMAP_WORDS; ++i)
+                result += WTF::bitCount(bits[i]);
+            return result;
+        }
+        size_t isEmpty() // Much more efficient than testing count() == 0.
+        {
+            for (size_t i = 0; i < BITMAP_WORDS; ++i)
+                if (bits[i] != 0)
+                    return false;
+            return true;
+        }
     };
   
     struct CollectorCell {
-        union {
-            double memory[CELL_ARRAY_LENGTH];
-            struct {
-                void* zeroIfFree;
-                ptrdiff_t next;
-            } freeCell;
-        } u;
-    };
-
-    struct SmallCollectorCell {
-        union {
-            double memory[CELL_ARRAY_LENGTH / 2];
-            struct {
-                void* zeroIfFree;
-                ptrdiff_t next;
-            } freeCell;
-        } u;
+        double memory[CELL_ARRAY_LENGTH];
     };
 
     class CollectorBlock {
     public:
         CollectorCell cells[CELLS_PER_BLOCK];
-        uint32_t usedCells;
-        CollectorCell* freeList;
         CollectorBitmap marked;
         Heap* heap;
-        HeapType type;
     };
 
-    class SmallCellCollectorBlock {
-    public:
-        SmallCollectorCell cells[SMALL_CELLS_PER_BLOCK];
-        uint32_t usedCells;
-        SmallCollectorCell* freeList;
-        CollectorBitmap marked;
-        Heap* heap;
-        HeapType type;
-    };
-    
-    template <HeapType heapType> struct HeapConstants;
-
-    template <> struct HeapConstants<PrimaryHeap> {
+    struct HeapConstants {
         static const size_t cellSize = CELL_SIZE;
         static const size_t cellsPerBlock = CELLS_PER_BLOCK;
-        static const size_t bitmapShift = 0;
         typedef CollectorCell Cell;
         typedef CollectorBlock Block;
     };
 
-    template <> struct HeapConstants<NumberHeap> {
-        static const size_t cellSize = SMALL_CELL_SIZE;
-        static const size_t cellsPerBlock = SMALL_CELLS_PER_BLOCK;
-        static const size_t bitmapShift = 1;
-        typedef SmallCollectorCell Cell;
-        typedef SmallCellCollectorBlock Block;
-    };
-
     inline CollectorBlock* Heap::cellBlock(const JSCell* cell)
     {
         return reinterpret_cast<CollectorBlock*>(reinterpret_cast<uintptr_t>(cell) & BLOCK_MASK);
     }
 
-    inline bool Heap::isNumber(JSCell* cell)
-    {
-        return Heap::cellBlock(cell)->type == NumberHeap;
-    }
-
     inline size_t Heap::cellOffset(const JSCell* cell)
     {
         return (reinterpret_cast<uintptr_t>(cell) & BLOCK_OFFSET_MASK) / CELL_SIZE;
@@ -293,8 +279,20 @@ namespace JSC {
 
     inline void Heap::reportExtraMemoryCost(size_t cost)
     {
-        if (cost > minExtraCostSize) 
-            recordExtraCost(cost / (CELL_SIZE * 2)); 
+        if (cost > minExtraCost) 
+            recordExtraCost(cost);
+    }
+    
+    inline void* Heap::allocateNumber(size_t s)
+    {
+        if (void* result = m_heap.nextNumber) {
+            m_heap.nextNumber = 0;
+            return result;
+        }
+
+        void* result = allocate(s);
+        m_heap.nextNumber = static_cast<char*>(result) + (CELL_SIZE / 2);
+        return result;
     }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CollectorHeapIterator.h b/src/3rdparty/webkit/JavaScriptCore/runtime/CollectorHeapIterator.h
index e38a8524cd..be6f3c94ba 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CollectorHeapIterator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CollectorHeapIterator.h
@@ -31,58 +31,108 @@
 
 namespace JSC {
 
-    template <HeapType heapType> class CollectorHeapIterator {
+    class CollectorHeapIterator {
     public:
-        CollectorHeapIterator(CollectorBlock** block, CollectorBlock** endBlock);
-
-        bool operator!=(const CollectorHeapIterator<heapType>& other) { return m_block != other.m_block || m_cell != other.m_cell; }
-        CollectorHeapIterator<heapType>& operator++();
+        bool operator!=(const CollectorHeapIterator& other);
         JSCell* operator*() const;
     
-    private:
-        typedef typename HeapConstants<heapType>::Block Block;
-        typedef typename HeapConstants<heapType>::Cell Cell;
-
-        Block** m_block;
-        Block** m_endBlock;
-        Cell* m_cell;
-        Cell* m_endCell;
+    protected:
+        CollectorHeapIterator(CollectorHeap&, size_t startBlock, size_t startCell);
+        void advance(size_t max);
+
+        CollectorHeap& m_heap;
+        size_t m_block;
+        size_t m_cell;
+    };
+
+    class LiveObjectIterator : public CollectorHeapIterator {
+    public:
+        LiveObjectIterator(CollectorHeap&, size_t startBlock, size_t startCell = 0);
+        LiveObjectIterator& operator++();
+    };
+
+    class DeadObjectIterator : public CollectorHeapIterator {
+    public:
+        DeadObjectIterator(CollectorHeap&, size_t startBlock, size_t startCell = 0);
+        DeadObjectIterator& operator++();
+    };
+
+    class ObjectIterator : public CollectorHeapIterator {
+    public:
+        ObjectIterator(CollectorHeap&, size_t startBlock, size_t startCell = 0);
+        ObjectIterator& operator++();
     };
 
-    template <HeapType heapType> 
-    CollectorHeapIterator<heapType>::CollectorHeapIterator(CollectorBlock** block, CollectorBlock** endBlock)
-        : m_block(reinterpret_cast<Block**>(block))
-        , m_endBlock(reinterpret_cast<Block**>(endBlock))
-        , m_cell(m_block == m_endBlock ? 0 : (*m_block)->cells)
-        , m_endCell(m_block == m_endBlock ? 0 : (*m_block)->cells + HeapConstants<heapType>::cellsPerBlock)
+    inline CollectorHeapIterator::CollectorHeapIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
+        : m_heap(heap)
+        , m_block(startBlock)
+        , m_cell(startCell)
+    {
+    }
+
+    inline bool CollectorHeapIterator::operator!=(const CollectorHeapIterator& other)
     {
-        if (m_cell && m_cell->u.freeCell.zeroIfFree == 0)
-            ++*this;
+        return m_block != other.m_block || m_cell != other.m_cell;
     }
 
-    template <HeapType heapType> 
-    CollectorHeapIterator<heapType>& CollectorHeapIterator<heapType>::operator++()
+    inline JSCell* CollectorHeapIterator::operator*() const
+    {
+        return reinterpret_cast<JSCell*>(m_heap.blocks[m_block]->cells + m_cell);
+    }
+    
+    // Iterators advance up to the next-to-last -- and not the last -- cell in a
+    // block, since the last cell is a dummy sentinel.
+    inline void CollectorHeapIterator::advance(size_t max)
+    {
+        ++m_cell;
+        if (m_cell == max) {
+            m_cell = 0;
+            ++m_block;
+        }
+    }
+
+    inline LiveObjectIterator::LiveObjectIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
+        : CollectorHeapIterator(heap, startBlock, startCell - 1)
+    {
+        ++(*this);
+    }
+
+    inline LiveObjectIterator& LiveObjectIterator::operator++()
+    {
+        advance(HeapConstants::cellsPerBlock - 1);
+        if (m_block < m_heap.nextBlock || (m_block == m_heap.nextBlock && m_cell < m_heap.nextCell))
+            return *this;
+
+        while (m_block < m_heap.usedBlocks && !m_heap.blocks[m_block]->marked.get(m_cell))
+            advance(HeapConstants::cellsPerBlock - 1);
+        return *this;
+    }
+
+    inline DeadObjectIterator::DeadObjectIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
+        : CollectorHeapIterator(heap, startBlock, startCell - 1)
+    {
+        ++(*this);
+    }
+
+    inline DeadObjectIterator& DeadObjectIterator::operator++()
     {
         do {
-            for (++m_cell; m_cell != m_endCell; ++m_cell)
-                if (m_cell->u.freeCell.zeroIfFree != 0) {
-                    return *this;
-                }
-
-            if (++m_block != m_endBlock) {
-                m_cell = (*m_block)->cells;
-                m_endCell = (*m_block)->cells + HeapConstants<heapType>::cellsPerBlock;
-            }
-        } while(m_block != m_endBlock);
-
-        m_cell = 0;
+            advance(HeapConstants::cellsPerBlock - 1);
+            ASSERT(m_block > m_heap.nextBlock || (m_block == m_heap.nextBlock && m_cell >= m_heap.nextCell));
+        } while (m_block < m_heap.usedBlocks && m_heap.blocks[m_block]->marked.get(m_cell));
         return *this;
     }
 
-    template <HeapType heapType> 
-    JSCell* CollectorHeapIterator<heapType>::operator*() const
+    inline ObjectIterator::ObjectIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
+        : CollectorHeapIterator(heap, startBlock, startCell - 1)
     {
-        return reinterpret_cast<JSCell*>(m_cell);
+        ++(*this);
+    }
+
+    inline ObjectIterator& ObjectIterator::operator++()
+    {
+        advance(HeapConstants::cellsPerBlock - 1);
+        return *this;
     }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
index abe503844f..de24f4a0d4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
@@ -50,6 +50,7 @@
     macro(get) \
     macro(getPrototypeOf) \
     macro(getOwnPropertyDescriptor) \
+    macro(getOwnPropertyNames) \
     macro(hasOwnProperty) \
     macro(ignoreCase) \
     macro(index) \
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
index 2507698e72..2f88df95d8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
@@ -36,6 +36,7 @@ namespace JSC {
 Completion checkSyntax(ExecState* exec, const SourceCode& source)
 {
     JSLock lock(exec);
+    ASSERT(exec->globalData().identifierTable == currentIdentifierTable());
 
     RefPtr<ProgramExecutable> program = ProgramExecutable::create(exec, source);
     JSObject* error = program->checkSyntax(exec);
@@ -48,6 +49,7 @@ Completion checkSyntax(ExecState* exec, const SourceCode& source)
 Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& source, JSValue thisValue)
 {
     JSLock lock(exec);
+    ASSERT(exec->globalData().identifierTable == currentIdentifierTable());
 
     RefPtr<ProgramExecutable> program = ProgramExecutable::create(exec, source);
     JSObject* error = program->compile(exec, scopeChain.node());
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
index 9908fef80c..ab95d0668d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
@@ -28,6 +28,7 @@
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
 #include <math.h>
@@ -35,7 +36,7 @@
 #include <wtf/DateMath.h>
 #include <wtf/MathExtras.h>
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if OS(WINCE) && !PLATFORM(QT)
 extern "C" time_t time(time_t* timer); // Provided by libce.
 #endif
 
@@ -77,14 +78,14 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
     double value;
 
     if (numArgs == 0) // new Date() ECMA 15.9.3.3
-        value = getCurrentUTCTime();
+        value = jsCurrentTime();
     else if (numArgs == 1) {
         if (args.at(0).inherits(&DateInstance::info))
             value = asDateInstance(args.at(0))->internalNumber();
         else {
             JSValue primitive = args.at(0).toPrimitive(exec);
             if (primitive.isString())
-                value = parseDate(primitive.getString());
+                value = parseDate(exec, primitive.getString(exec));
             else
                 value = primitive.toNumber(exec);
         }
@@ -108,7 +109,7 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
             t.second = args.at(5).toInt32(exec);
             t.isDST = -1;
             double ms = (numArgs >= 7) ? args.at(6).toNumber(exec) : 0;
-            value = gregorianDateTimeToMS(t, ms, false);
+            value = gregorianDateTimeToMS(exec, t, ms, false);
         }
     }
 
@@ -132,8 +133,12 @@ static JSValue JSC_HOST_CALL callDate(ExecState* exec, JSObject*, JSValue, const
     time_t localTime = time(0);
     tm localTM;
     getLocalTime(&localTime, &localTM);
-    GregorianDateTime ts(localTM);
-    return jsNontrivialString(exec, formatDate(ts) + " " + formatTime(ts, false));
+    GregorianDateTime ts(exec, localTM);
+    DateConversionBuffer date;
+    DateConversionBuffer time;
+    formatDate(ts, date);
+    formatTime(ts, time);
+    return jsMakeNontrivialString(exec, date, " ", time);
 }
 
 CallType DateConstructor::getCallData(CallData& callData)
@@ -144,12 +149,12 @@ CallType DateConstructor::getCallData(CallData& callData)
 
 static JSValue JSC_HOST_CALL dateParse(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, parseDate(args.at(0).toString(exec)));
+    return jsNumber(exec, parseDate(exec, args.at(0).toString(exec)));
 }
 
 static JSValue JSC_HOST_CALL dateNow(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
-    return jsNumber(exec, getCurrentUTCTime());
+    return jsNumber(exec, jsCurrentTime());
 }
 
 static JSValue JSC_HOST_CALL dateUTC(ExecState* exec, JSObject*, JSValue, const ArgList& args) 
@@ -173,7 +178,7 @@ static JSValue JSC_HOST_CALL dateUTC(ExecState* exec, JSObject*, JSValue, const
     t.minute = args.at(4).toInt32(exec);
     t.second = args.at(5).toInt32(exec);
     double ms = (n >= 7) ? args.at(6).toNumber(exec) : 0;
-    return jsNumber(exec, gregorianDateTimeToMS(t, ms, true));
+    return jsNumber(exec, timeClip(gregorianDateTimeToMS(exec, t, ms, true)));
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.cpp
index a725478956..f129407f7b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.cpp
@@ -43,6 +43,7 @@
 #include "config.h"
 #include "DateConversion.h"
 
+#include "CallFrame.h"
 #include "UString.h"
 #include <wtf/DateMath.h>
 #include <wtf/StringExtras.h>
@@ -51,51 +52,51 @@ using namespace WTF;
 
 namespace JSC {
 
-double parseDate(const UString &date)
+double parseDate(ExecState* exec, const UString &date)
 {
-    return parseDateFromNullTerminatedCharacters(date.UTF8String().c_str());
+    if (date == exec->globalData().cachedDateString)
+        return exec->globalData().cachedDateStringValue;
+    double value = parseDateFromNullTerminatedCharacters(exec, date.UTF8String().c_str());
+    exec->globalData().cachedDateString = date;
+    exec->globalData().cachedDateStringValue = value;
+    return value;
 }
 
-UString formatDate(const GregorianDateTime &t)
+void formatDate(const GregorianDateTime &t, DateConversionBuffer& buffer)
 {
-    char buffer[100];
-    snprintf(buffer, sizeof(buffer), "%s %s %02d %04d",
+    snprintf(buffer, DateConversionBufferSize, "%s %s %02d %04d",
         weekdayName[(t.weekDay + 6) % 7],
         monthName[t.month], t.monthDay, t.year + 1900);
-    return buffer;
 }
 
-UString formatDateUTCVariant(const GregorianDateTime &t)
+void formatDateUTCVariant(const GregorianDateTime &t, DateConversionBuffer& buffer)
 {
-    char buffer[100];
-    snprintf(buffer, sizeof(buffer), "%s, %02d %s %04d",
+    snprintf(buffer, DateConversionBufferSize, "%s, %02d %s %04d",
         weekdayName[(t.weekDay + 6) % 7],
         t.monthDay, monthName[t.month], t.year + 1900);
-    return buffer;
 }
 
-UString formatTime(const GregorianDateTime &t, bool utc)
+void formatTime(const GregorianDateTime &t, DateConversionBuffer& buffer)
 {
-    char buffer[100];
-    if (utc) {
-        snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT", t.hour, t.minute, t.second);
-    } else {
-        int offset = abs(gmtoffset(t));
-        char timeZoneName[70];
-        struct tm gtm = t;
-        strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
+    int offset = abs(gmtoffset(t));
+    char timeZoneName[70];
+    struct tm gtm = t;
+    strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
 
-        if (timeZoneName[0]) {
-            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d (%s)",
-                t.hour, t.minute, t.second,
-                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, timeZoneName);
-        } else {
-            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d",
-                t.hour, t.minute, t.second,
-                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60);
-        }
+    if (timeZoneName[0]) {
+        snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT%c%02d%02d (%s)",
+            t.hour, t.minute, t.second,
+            gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, timeZoneName);
+    } else {
+        snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT%c%02d%02d",
+            t.hour, t.minute, t.second,
+            gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60);
     }
-    return UString(buffer);
+}
+
+void formatTimeUTC(const GregorianDateTime &t, DateConversionBuffer& buffer)
+{
+    snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT", t.hour, t.minute, t.second);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.h
index 0d128158e9..ff32b503d8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.h
@@ -42,18 +42,21 @@
 #ifndef DateConversion_h
 #define DateConversion_h
 
-namespace WTF {
-    struct GregorianDateTime;
-}
+#include "UString.h"
 
 namespace JSC {
 
-class UString;
+class ExecState;
+struct GregorianDateTime;
 
-double parseDate(const UString&);
-UString formatDate(const WTF::GregorianDateTime&);
-UString formatDateUTCVariant(const WTF::GregorianDateTime&);
-UString formatTime(const WTF::GregorianDateTime&, bool inputIsUTC);
+static const unsigned DateConversionBufferSize = 100;
+typedef char DateConversionBuffer[DateConversionBufferSize];
+
+double parseDate(ExecState* exec, const UString&);
+void formatDate(const GregorianDateTime&, DateConversionBuffer&);
+void formatDateUTCVariant(const GregorianDateTime&, DateConversionBuffer&);
+void formatTime(const GregorianDateTime&, DateConversionBuffer&);
+void formatTimeUTC(const GregorianDateTime&, DateConversionBuffer&);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
index d4c9ef7408..b43b183e27 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
@@ -40,36 +40,48 @@ DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structu
     setInternalValue(jsNaN(exec));
 }
 
+DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structure, double time)
+    : JSWrapperObject(structure)
+{
+    setInternalValue(jsNumber(exec, timeClip(time)));
+}
+
 DateInstance::DateInstance(ExecState* exec, double time)
     : JSWrapperObject(exec->lexicalGlobalObject()->dateStructure())
 {
     setInternalValue(jsNumber(exec, timeClip(time)));
 }
 
-bool DateInstance::getGregorianDateTime(ExecState* exec, bool outputIsUTC, GregorianDateTime& t) const
+const GregorianDateTime* DateInstance::calculateGregorianDateTime(ExecState* exec) const
 {
     double milli = internalNumber();
     if (isnan(milli))
-        return false;
+        return 0;
 
     if (!m_data)
         m_data = exec->globalData().dateInstanceCache.add(milli);
 
-    if (outputIsUTC) {
-        if (m_data->m_gregorianDateTimeUTCCachedForMS != milli) {
-            WTF::msToGregorianDateTime(internalNumber(), true, m_data->m_cachedGregorianDateTimeUTC);
-            m_data->m_gregorianDateTimeUTCCachedForMS = milli;
-        }
-        t.copyFrom(m_data->m_cachedGregorianDateTimeUTC);
-    } else {
-        if (m_data->m_gregorianDateTimeCachedForMS != milli) {
-            WTF::msToGregorianDateTime(internalNumber(), false, m_data->m_cachedGregorianDateTime);
-            m_data->m_gregorianDateTimeCachedForMS = milli;
-        }
-        t.copyFrom(m_data->m_cachedGregorianDateTime);
+    if (m_data->m_gregorianDateTimeCachedForMS != milli) {
+        msToGregorianDateTime(exec, milli, false, m_data->m_cachedGregorianDateTime);
+        m_data->m_gregorianDateTimeCachedForMS = milli;
     }
+    return &m_data->m_cachedGregorianDateTime;
+}
+
+const GregorianDateTime* DateInstance::calculateGregorianDateTimeUTC(ExecState* exec) const
+{
+    double milli = internalNumber();
+    if (isnan(milli))
+        return 0;
 
-    return true;
+    if (!m_data)
+        m_data = exec->globalData().dateInstanceCache.add(milli);
+
+    if (m_data->m_gregorianDateTimeUTCCachedForMS != milli) {
+        msToGregorianDateTime(exec, milli, true, m_data->m_cachedGregorianDateTimeUTC);
+        m_data->m_gregorianDateTimeUTCCachedForMS = milli;
+    }
+    return &m_data->m_cachedGregorianDateTimeUTC;
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
index 38b321c699..77d46de5df 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
@@ -32,23 +32,38 @@ namespace JSC {
     class DateInstance : public JSWrapperObject {
     public:
         DateInstance(ExecState*, double);
+        DateInstance(ExecState*, NonNullPassRefPtr<Structure>, double);
         explicit DateInstance(ExecState*, NonNullPassRefPtr<Structure>);
 
         double internalNumber() const { return internalValue().uncheckedGetNumber(); }
 
         static JS_EXPORTDATA const ClassInfo info;
 
-        bool getGregorianDateTime(ExecState*, bool outputIsUTC, WTF::GregorianDateTime&) const;
+        const GregorianDateTime* gregorianDateTime(ExecState* exec) const
+        {
+            if (m_data && m_data->m_gregorianDateTimeCachedForMS == internalNumber())
+                return &m_data->m_cachedGregorianDateTime;
+            return calculateGregorianDateTime(exec);
+        }
+        
+        const GregorianDateTime* gregorianDateTimeUTC(ExecState* exec) const
+        {
+            if (m_data && m_data->m_gregorianDateTimeUTCCachedForMS == internalNumber())
+                return &m_data->m_cachedGregorianDateTimeUTC;
+            return calculateGregorianDateTimeUTC(exec);
+        }
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
         static const unsigned StructureFlags = OverridesMarkChildren | JSWrapperObject::StructureFlags;
 
     private:
+        const GregorianDateTime* calculateGregorianDateTime(ExecState*) const;
+        const GregorianDateTime* calculateGregorianDateTimeUTC(ExecState*) const;
         virtual const ClassInfo* classInfo() const { return &info; }
 
         mutable RefPtr<DateInstanceData> m_data;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstanceCache.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstanceCache.h
index b626c1dd28..d208580a34 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstanceCache.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstanceCache.h
@@ -40,9 +40,9 @@ namespace JSC {
         static PassRefPtr<DateInstanceData> create() { return adoptRef(new DateInstanceData); }
 
         double m_gregorianDateTimeCachedForMS;
-        WTF::GregorianDateTime m_cachedGregorianDateTime;
+        GregorianDateTime m_cachedGregorianDateTime;
         double m_gregorianDateTimeUTCCachedForMS;
-        WTF::GregorianDateTime m_cachedGregorianDateTimeUTC;
+        GregorianDateTime m_cachedGregorianDateTimeUTC;
 
     private:
         DateInstanceData()
@@ -56,6 +56,11 @@ namespace JSC {
     public:
         DateInstanceCache()
         {
+            reset();
+        }
+        
+        void reset()
+        {
             for (size_t i = 0; i < cacheSize; ++i)
                 m_cache[i].key = NaN;
         }
@@ -72,7 +77,7 @@ namespace JSC {
         }
 
     private:
-        static const size_t cacheSize = 64;
+        static const size_t cacheSize = 16;
 
         struct CacheEntry {
             double key;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
index 3f3e1f915a..25b0ac42b6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
@@ -26,9 +26,9 @@
 #include "DateConversion.h"
 #include "Error.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
 #include "DateInstance.h"
-#include <float.h>
 
 #if !PLATFORM(MAC) && HAVE(LANGINFO_H)
 #include <langinfo.h>
@@ -60,7 +60,7 @@
 #include <CoreFoundation/CoreFoundation.h>
 #endif
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if OS(WINCE) && !PLATFORM(QT)
 extern "C" size_t strftime(char * const s, const size_t maxsize, const char * const format, const struct tm * const t); //provided by libce
 #endif
 
@@ -198,7 +198,7 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, L
 {
 #if HAVE(LANGINFO_H)
     static const nl_item formats[] = { D_T_FMT, D_FMT, T_FMT };
-#elif (PLATFORM(WINCE) && !PLATFORM(QT)) || PLATFORM(SYMBIAN)
+#elif (OS(WINCE) && !PLATFORM(QT)) || OS(SYMBIAN)
      // strftime() does not support '#' on WinCE or Symbian
     static const char* const formatStrings[] = { "%c", "%x", "%X" };
 #else
@@ -253,11 +253,10 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, L
 
 static JSCell* formatLocaleDate(ExecState* exec, DateInstance* dateObject, double, LocaleDateTimeFormat format, const ArgList&)
 {
-    GregorianDateTime gregorianDateTime;
-    const bool outputIsUTC = false;
-    if (!dateObject->getGregorianDateTime(exec, outputIsUTC, gregorianDateTime))
+    const GregorianDateTime* gregorianDateTime = dateObject->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return formatLocaleDate(exec, gregorianDateTime, format);
+    return formatLocaleDate(exec, *gregorianDateTime, format);
 }
 
 #endif // !PLATFORM(MAC)
@@ -420,14 +419,16 @@ JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDate(t) + " " + formatTime(t, outputIsUTC));
+    DateConversionBuffer date;
+    DateConversionBuffer time;
+    formatDate(*gregorianDateTime, date);
+    formatTime(*gregorianDateTime, time);
+    return jsMakeNontrivialString(exec, date, " ", time);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -435,14 +436,16 @@ JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, outputIsUTC));
+    DateConversionBuffer date;
+    DateConversionBuffer time;
+    formatDateUTCVariant(*gregorianDateTime, date);
+    formatTimeUTC(*gregorianDateTime, time);
+    return jsMakeNontrivialString(exec, date, " ", time);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -450,17 +453,15 @@ JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
     
-    const bool outputIsUTC = true;
-    
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
     // Maximum amount of space we need in buffer: 6 (max. digits in year) + 2 * 5 (2 characters each for month, day, hour, minute, second) + 4 (. + 3 digits for milliseconds)
     // 6 for formatting and one for null termination = 27.  We add one extra character to allow us to force null termination.
     char buffer[28];
-    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + t.year, t.month + 1, t.monthDay, t.hour, t.minute, t.second, static_cast<int>(fmod(thisDateObj->internalNumber(), 1000)));
+    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + gregorianDateTime->year, gregorianDateTime->month + 1, gregorianDateTime->monthDay, gregorianDateTime->hour, gregorianDateTime->minute, gregorianDateTime->second, static_cast<int>(fmod(thisDateObj->internalNumber(), 1000)));
     buffer[sizeof(buffer) - 1] = 0;
     return jsNontrivialString(exec, buffer);
 }
@@ -470,14 +471,14 @@ JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec, JSObject*, JSVa
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDate(t));
+    DateConversionBuffer date;
+    formatDate(*gregorianDateTime, date);
+    return jsNontrivialString(exec, date);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -485,14 +486,14 @@ JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSVa
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatTime(t, outputIsUTC));
+    DateConversionBuffer time;
+    formatTime(*gregorianDateTime, time);
+    return jsNontrivialString(exec, time);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -535,14 +536,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, 1900 + t.year);
+    return jsNumber(exec, 1900 + gregorianDateTime->year);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -550,14 +549,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JS
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, 1900 + t.year);
+    return jsNumber(exec, 1900 + gregorianDateTime->year);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -565,14 +562,16 @@ JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, outputIsUTC));
+    DateConversionBuffer date;
+    DateConversionBuffer time;
+    formatDateUTCVariant(*gregorianDateTime, date);
+    formatTimeUTC(*gregorianDateTime, time);
+    return jsMakeNontrivialString(exec, date, " ", time);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -580,14 +579,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.month);
+    return jsNumber(exec, gregorianDateTime->month);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -595,14 +592,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.month);
+    return jsNumber(exec, gregorianDateTime->month);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -610,14 +605,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.monthDay);
+    return jsNumber(exec, gregorianDateTime->monthDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -625,14 +618,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.monthDay);
+    return jsNumber(exec, gregorianDateTime->monthDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -640,14 +631,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue th
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.weekDay);
+    return jsNumber(exec, gregorianDateTime->weekDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -655,14 +644,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.weekDay);
+    return jsNumber(exec, gregorianDateTime->weekDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -670,14 +657,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.hour);
+    return jsNumber(exec, gregorianDateTime->hour);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -685,14 +670,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.hour);
+    return jsNumber(exec, gregorianDateTime->hour);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -700,14 +683,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.minute);
+    return jsNumber(exec, gregorianDateTime->minute);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -715,14 +696,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSV
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.minute);
+    return jsNumber(exec, gregorianDateTime->minute);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -730,14 +709,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.second);
+    return jsNumber(exec, gregorianDateTime->second);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -745,14 +722,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSV
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.second);
+    return jsNumber(exec, gregorianDateTime->second);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -790,14 +765,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*,
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, -gmtoffset(t) / minutesPerHour);
+    return jsNumber(exec, -gregorianDateTime->utcOffset / minutesPerHour);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -830,16 +803,21 @@ static JSValue setNewValueFromTimeArgs(ExecState* exec, JSValue thisValue, const
     double secs = floor(milli / msPerSecond);
     double ms = milli - secs * msPerSecond;
 
-    GregorianDateTime t;
-    thisDateObj->getGregorianDateTime(exec, inputIsUTC, t);
+    const GregorianDateTime* other = inputIsUTC 
+        ? thisDateObj->gregorianDateTimeUTC(exec)
+        : thisDateObj->gregorianDateTime(exec);
+    if (!other)
+        return jsNaN(exec);
 
-    if (!fillStructuresUsingTimeArgs(exec, args, numArgsToUse, &ms, &t)) {
+    GregorianDateTime gregorianDateTime;
+    gregorianDateTime.copyFrom(*other);
+    if (!fillStructuresUsingTimeArgs(exec, args, numArgsToUse, &ms, &gregorianDateTime)) {
         JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     } 
     
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(exec, gregorianDateTime, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
@@ -857,26 +835,28 @@ static JSValue setNewValueFromDateArgs(ExecState* exec, JSValue thisValue, const
     }      
     
     double milli = thisDateObj->internalNumber();
-    double ms = 0;
-
-    GregorianDateTime t;
-    if (numArgsToUse == 3 && isnan(milli))
-        // Based on ECMA 262 15.9.5.40 - .41 (set[UTC]FullYear)
-        // the time must be reset to +0 if it is NaN. 
-        WTF::msToGregorianDateTime(0, true, t);
-    else {
-        double secs = floor(milli / msPerSecond);
-        ms = milli - secs * msPerSecond;
-        thisDateObj->getGregorianDateTime(exec, inputIsUTC, t);
+    double ms = 0; 
+
+    GregorianDateTime gregorianDateTime; 
+    if (numArgsToUse == 3 && isnan(milli)) 
+        msToGregorianDateTime(exec, 0, true, gregorianDateTime); 
+    else { 
+        ms = milli - floor(milli / msPerSecond) * msPerSecond; 
+        const GregorianDateTime* other = inputIsUTC 
+            ? thisDateObj->gregorianDateTimeUTC(exec)
+            : thisDateObj->gregorianDateTime(exec);
+        if (!other)
+            return jsNaN(exec);
+        gregorianDateTime.copyFrom(*other);
     }
     
-    if (!fillStructuresUsingDateArgs(exec, args, numArgsToUse, &ms, &t)) {
+    if (!fillStructuresUsingDateArgs(exec, args, numArgsToUse, &ms, &gregorianDateTime)) {
         JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     } 
            
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(exec, gregorianDateTime, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
@@ -970,8 +950,6 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue);     
     if (args.isEmpty()) { 
         JSValue result = jsNaN(exec);
@@ -982,15 +960,16 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
     double milli = thisDateObj->internalNumber();
     double ms = 0;
 
-    GregorianDateTime t;
+    GregorianDateTime gregorianDateTime;
     if (isnan(milli))
         // Based on ECMA 262 B.2.5 (setYear)
         // the time must be reset to +0 if it is NaN. 
-        WTF::msToGregorianDateTime(0, true, t);
+        msToGregorianDateTime(exec, 0, true, gregorianDateTime);
     else {   
         double secs = floor(milli / msPerSecond);
         ms = milli - secs * msPerSecond;
-        thisDateObj->getGregorianDateTime(exec, outputIsUTC, t);
+        if (const GregorianDateTime* other = thisDateObj->gregorianDateTime(exec))
+            gregorianDateTime.copyFrom(*other);
     }
     
     bool ok = true;
@@ -1001,8 +980,8 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
         return result;
     }
             
-    t.year = (year > 99 || year < 0) ? year - 1900 : year;
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, outputIsUTC));
+    gregorianDateTime.year = (year > 99 || year < 0) ? year - 1900 : year;
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(exec, gregorianDateTime, ms, false));
     thisDateObj->setInternalValue(result);
     return result;
 }
@@ -1012,16 +991,14 @@ JSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
 
     // NOTE: IE returns the full year even in getYear.
-    return jsNumber(exec, t.year);
+    return jsNumber(exec, gregorianDateTime->year);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToJSON(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
index f565775499..612ca06a4e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
@@ -39,7 +39,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
index ddd4bc4f5e..69464b75fd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
@@ -94,7 +94,7 @@ JSObject* Error::create(ExecState* exec, ErrorType type, const UString& message,
 
 JSObject* Error::create(ExecState* exec, ErrorType type, const char* message)
 {
-    return create(exec, type, message, -1, -1, NULL);
+    return create(exec, type, message, -1, -1, UString());
 }
 
 JSObject* throwError(ExecState* exec, JSObject* error)
@@ -105,21 +105,21 @@ JSObject* throwError(ExecState* exec, JSObject* error)
 
 JSObject* throwError(ExecState* exec, ErrorType type)
 {
-    JSObject* error = Error::create(exec, type, UString(), -1, -1, NULL);
+    JSObject* error = Error::create(exec, type, UString(), -1, -1, UString());
     exec->setException(error);
     return error;
 }
 
 JSObject* throwError(ExecState* exec, ErrorType type, const UString& message)
 {
-    JSObject* error = Error::create(exec, type, message, -1, -1, NULL);
+    JSObject* error = Error::create(exec, type, message, -1, -1, UString());
     exec->setException(error);
     return error;
 }
 
 JSObject* throwError(ExecState* exec, ErrorType type, const char* message)
 {
-    JSObject* error = Error::create(exec, type, message, -1, -1, NULL);
+    JSObject* error = Error::create(exec, type, message, -1, -1, UString());
     exec->setException(error);
     return error;
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp
index a9a7a43e95..eb357337ce 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -23,6 +23,7 @@
 
 #include "JSFunction.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
 #include "UString.h"
@@ -48,21 +49,19 @@ ErrorPrototype::ErrorPrototype(ExecState* exec, NonNullPassRefPtr<Structure> str
 JSValue JSC_HOST_CALL errorProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
+    JSValue name = thisObj->get(exec, exec->propertyNames().name);
+    JSValue message = thisObj->get(exec, exec->propertyNames().message);
 
-    UString s = "Error";
+    // Mozilla-compatible format.
 
-    JSValue v = thisObj->get(exec, exec->propertyNames().name);
-    if (!v.isUndefined())
-        s = v.toString(exec);
-
-    v = thisObj->get(exec, exec->propertyNames().message);
-    if (!v.isUndefined()) {
-        // Mozilla-compatible format.
-        s += ": ";
-        s += v.toString(exec);
+    if (!name.isUndefined()) {
+        if (!message.isUndefined())
+            return jsMakeNontrivialString(exec, name.toString(exec), ": ", message.toString(exec));
+        return jsNontrivialString(exec, name.toString(exec));
     }
-
-    return jsNontrivialString(exec, s);
+    if (!message.isUndefined())
+        return jsMakeNontrivialString(exec, "Error: ", message.toString(exec));
+    return jsNontrivialString(exec, "Error");
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
index 5bead90d9f..b9c6319fb2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -58,7 +58,7 @@ JSValue createInterruptedExecutionException(JSGlobalData* globalData)
 
 static JSValue createError(ExecState* exec, ErrorType e, const char* msg)
 {
-    return Error::create(exec, e, msg, -1, -1, 0);
+    return Error::create(exec, e, msg, -1, -1, UString());
 }
 
 JSValue createStackOverflowError(ExecState* exec)
@@ -77,9 +77,7 @@ JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, u
     int endOffset = 0;
     int divotPoint = 0;
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
-    UString message = "Can't find variable: ";
-    message.append(ident.ustring());
-    JSObject* exception = Error::create(exec, ReferenceError, message, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
+    JSObject* exception = Error::create(exec, ReferenceError, makeString("Can't find variable: ", ident.ustring()), line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionEndOffsetPropertyName), jsNumber(exec, divotPoint + endOffset), ReadOnly | DontDelete);
@@ -88,59 +86,36 @@ JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, u
     
 static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, int expressionStart, int expressionStop, JSValue value, UString error)
 {
-    if (!expressionStop || expressionStart > codeBlock->source()->length()) {
-        UString errorText = value.toString(exec);
-        errorText.append(" is ");
-        errorText.append(error);
-        return errorText;
-    }
+    if (!expressionStop || expressionStart > codeBlock->source()->length())
+        return makeString(value.toString(exec), " is ", error);
+    if (expressionStart < expressionStop)
+        return makeString("Result of expression '", codeBlock->source()->getRange(expressionStart, expressionStop), "' [", value.toString(exec), "] is ", error, ".");
 
-    UString errorText = "Result of expression ";
-    
-    if (expressionStart < expressionStop) {
-        errorText.append('\'');
-        errorText.append(codeBlock->source()->getRange(expressionStart, expressionStop));
-        errorText.append("' [");
-        errorText.append(value.toString(exec));
-        errorText.append("] is ");
-    } else {
-        // No range information, so give a few characters of context
-        const UChar* data = codeBlock->source()->data();
-        int dataLength = codeBlock->source()->length();
-        int start = expressionStart;
-        int stop = expressionStart;
-        // Get up to 20 characters of context to the left and right of the divot, clamping to the line.
-        // then strip whitespace.
-        while (start > 0 && (expressionStart - start < 20) && data[start - 1] != '\n')
-            start--;
-        while (start < (expressionStart - 1) && isStrWhiteSpace(data[start]))
-            start++;
-        while (stop < dataLength && (stop - expressionStart < 20) && data[stop] != '\n')
-            stop++;
-        while (stop > expressionStart && isStrWhiteSpace(data[stop]))
-            stop--;
-        errorText.append("near '...");
-        errorText.append(codeBlock->source()->getRange(start, stop));
-        errorText.append("...' [");
-        errorText.append(value.toString(exec));
-        errorText.append("] is ");
-    }
-    errorText.append(error);
-    errorText.append(".");
-    return errorText;
+    // No range information, so give a few characters of context
+    const UChar* data = codeBlock->source()->data();
+    int dataLength = codeBlock->source()->length();
+    int start = expressionStart;
+    int stop = expressionStart;
+    // Get up to 20 characters of context to the left and right of the divot, clamping to the line.
+    // then strip whitespace.
+    while (start > 0 && (expressionStart - start < 20) && data[start - 1] != '\n')
+        start--;
+    while (start < (expressionStart - 1) && isStrWhiteSpace(data[start]))
+        start++;
+    while (stop < dataLength && (stop - expressionStart < 20) && data[stop] != '\n')
+        stop++;
+    while (stop > expressionStart && isStrWhiteSpace(data[stop]))
+        stop--;
+    return makeString("Result of expression near '...", codeBlock->source()->getRange(start, stop), "...' [", value.toString(exec), "] is ", error, ".");
 }
 
 JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValue value, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
-    UString message = "not a valid argument for '";
-    message.append(op);
-    message.append("'");
-    
     int startOffset = 0;
     int endOffset = 0;
     int divotPoint = 0;
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
-    UString errorMessage = createErrorMessage(exec, codeBlock, line, divotPoint, divotPoint + endOffset, value, message);
+    UString errorMessage = createErrorMessage(exec, codeBlock, line, divotPoint, divotPoint + endOffset, value, makeString("not a valid argument for '", op, "'"));
     JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
@@ -213,4 +188,9 @@ JSObject* createNotAnObjectError(ExecState* exec, JSNotAnObjectErrorStub* error,
     return exception;
 }
 
+JSValue throwOutOfMemoryError(ExecState* exec)
+{
+    return throwError(exec, GeneralError, "Out of memory");
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
index e739d0954c..b6e7373546 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
@@ -51,6 +51,7 @@ namespace JSC {
     JSObject* createNotAConstructorError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
     JSValue createNotAFunctionError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
     JSObject* createNotAnObjectError(ExecState*, JSNotAnObjectErrorStub*, unsigned bytecodeOffset, CodeBlock*);
+    JSValue throwOutOfMemoryError(ExecState*);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp
index 7586746565..79900dcc14 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp
@@ -30,6 +30,7 @@
 #include "CodeBlock.h"
 #include "JIT.h"
 #include "Parser.h"
+#include "StringBuilder.h"
 #include "Vector.h"
 
 namespace JSC {
@@ -265,14 +266,13 @@ PassRefPtr<FunctionExecutable> FunctionExecutable::fromGlobalCode(const Identifi
 UString FunctionExecutable::paramString() const
 {
     FunctionParameters& parameters = *m_parameters;
-    UString s("");
+    StringBuilder builder;
     for (size_t pos = 0; pos < parameters.size(); ++pos) {
-        if (!s.isEmpty())
-            s += ", ";
-        s += parameters[pos].ustring();
+        if (!builder.isEmpty())
+            builder.append(", ");
+        builder.append(parameters[pos].ustring());
     }
-
-    return s;
+    return builder.build();
 }
 
 };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
index 9d8840079f..9b0b1bbe46 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -21,14 +21,15 @@
 #include "config.h"
 #include "FunctionConstructor.h"
 
+#include "Debugger.h"
 #include "FunctionPrototype.h"
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSString.h"
-#include "Parser.h"
-#include "Debugger.h"
 #include "Lexer.h"
 #include "Nodes.h"
+#include "Parser.h"
+#include "StringBuilder.h"
 
 namespace JSC {
 
@@ -76,12 +77,19 @@ JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifi
     if (args.isEmpty())
         program = "(function() { \n})";
     else if (args.size() == 1)
-        program = "(function() { " + args.at(0).toString(exec) + "\n})";
+        program = makeString("(function() { ", args.at(0).toString(exec), "\n})");
     else {
-        program = "(function(" + args.at(0).toString(exec);
-        for (size_t i = 1; i < args.size() - 1; i++)
-            program += "," + args.at(i).toString(exec);
-        program += ") { " + args.at(args.size() - 1).toString(exec) + "\n})";
+        StringBuilder builder;
+        builder.append("(function(");
+        builder.append(args.at(0).toString(exec));
+        for (size_t i = 1; i < args.size() - 1; i++) {
+            builder.append(",");
+            builder.append(args.at(i).toString(exec));
+        }
+        builder.append(") { ");
+        builder.append(args.at(args.size() - 1).toString(exec));
+        builder.append("\n})");
+        program = builder.build();
     }
 
     int errLine;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
index 45f17b1ba5..a77b5b27e9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -25,6 +25,7 @@
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "Interpreter.h"
 #include "Lexer.h"
 #include "PrototypeFunction.h"
@@ -76,7 +77,7 @@ static inline void insertSemicolonIfNeeded(UString& functionBody)
         UChar ch = functionBody[i];
         if (!Lexer::isWhiteSpace(ch) && !Lexer::isLineTerminator(ch)) {
             if (ch != ';' && ch != '}')
-                functionBody = functionBody.substr(0, i + 1) + ";" + functionBody.substr(i + 1, functionBody.size() - (i + 1));
+                functionBody = makeString(functionBody.substr(0, i + 1), ";", functionBody.substr(i + 1, functionBody.size() - (i + 1)));
             return;
         }
     }
@@ -90,13 +91,13 @@ JSValue JSC_HOST_CALL functionProtoFuncToString(ExecState* exec, JSObject*, JSVa
             FunctionExecutable* executable = function->jsExecutable();
             UString sourceString = executable->source().toString();
             insertSemicolonIfNeeded(sourceString);
-            return jsString(exec, "function " + function->name(&exec->globalData()) + "(" + executable->paramString() + ") " + sourceString);
+            return jsMakeNontrivialString(exec, "function ", function->name(exec), "(", executable->paramString(), ") ", sourceString);
         }
     }
 
     if (thisValue.inherits(&InternalFunction::info)) {
         InternalFunction* function = asInternalFunction(thisValue);
-        return jsString(exec, "function " + function->name(&exec->globalData()) + "() {\n    [native code]\n}");
+        return jsMakeNontrivialString(exec, "function ", function->name(exec), "() {\n    [native code]\n}");
     }
 
     return throwError(exec, TypeError);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
index d1d6a1d1bc..af783f7b2b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
@@ -34,7 +34,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto)
         {
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
index 68e9ea3cce..27ffbe78a7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
@@ -34,6 +34,7 @@ namespace JSC {
     // This is an internal value object which stores getter and setter functions
     // for a property.
     class GetterSetter : public JSCell {
+        friend class JIT;
     public:
         GetterSetter(ExecState* exec)
             : JSCell(exec->globalData().getterSetterStructure.get())
@@ -50,7 +51,7 @@ namespace JSC {
         void setSetter(JSObject* setter) { m_setter = setter; }
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(GetterSetterType, OverridesMarkChildren));
+            return Structure::create(prototype, TypeInfo(GetterSetterType, OverridesMarkChildren), AnonymousSlotCount);
         }
     private:
         virtual bool isGetterSetter() const;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
index 389b1c34c2..a14ce4d044 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
@@ -37,7 +37,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
index 7db723b82f..9acccf0776 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
@@ -22,12 +22,15 @@
 #include "Identifier.h"
 
 #include "CallFrame.h"
+#include "NumericStrings.h"
 #include <new> // for placement new
 #include <string.h> // for strlen
 #include <wtf/Assertions.h>
 #include <wtf/FastMalloc.h>
 #include <wtf/HashSet.h>
 
+using WTF::ThreadSpecific;
+
 namespace JSC {
 
 typedef HashMap<const char*, RefPtr<UString::Rep>, PtrHash<const char*> > LiteralIdentifierTable;
@@ -38,13 +41,13 @@ public:
     {
         HashSet<UString::Rep*>::iterator end = m_table.end();
         for (HashSet<UString::Rep*>::iterator iter = m_table.begin(); iter != end; ++iter)
-            (*iter)->setIdentifierTable(0);
+            (*iter)->setIsIdentifier(false);
     }
-    
+
     std::pair<HashSet<UString::Rep*>::iterator, bool> add(UString::Rep* value)
     {
         std::pair<HashSet<UString::Rep*>::iterator, bool> result = m_table.add(value);
-        (*result.first)->setIdentifierTable(this);
+        (*result.first)->setIsIdentifier(true);
         return result;
     }
 
@@ -52,7 +55,7 @@ public:
     std::pair<HashSet<UString::Rep*>::iterator, bool> add(U value)
     {
         std::pair<HashSet<UString::Rep*>::iterator, bool> result = m_table.add<U, V>(value);
-        (*result.first)->setIdentifierTable(this);
+        (*result.first)->setIsIdentifier(true);
         return result;
     }
 
@@ -77,20 +80,20 @@ void deleteIdentifierTable(IdentifierTable* table)
 
 bool Identifier::equal(const UString::Rep* r, const char* s)
 {
-    int length = r->len;
-    const UChar* d = r->data();
+    int length = r->length();
+    const UChar* d = r->characters();
     for (int i = 0; i != length; ++i)
         if (d[i] != (unsigned char)s[i])
             return false;
     return s[length] == 0;
 }
 
-bool Identifier::equal(const UString::Rep* r, const UChar* s, int length)
+bool Identifier::equal(const UString::Rep* r, const UChar* s, unsigned length)
 {
-    if (r->len != length)
+    if (r->length() != length)
         return false;
-    const UChar* d = r->data();
-    for (int i = 0; i != length; ++i)
+    const UChar* d = r->characters();
+    for (unsigned i = 0; i != length; ++i)
         if (d[i] != s[i])
             return false;
     return true;
@@ -110,27 +113,21 @@ struct CStringTranslator {
     static void translate(UString::Rep*& location, const char* c, unsigned hash)
     {
         size_t length = strlen(c);
-        UChar* d = static_cast<UChar*>(fastMalloc(sizeof(UChar) * length));
+        UChar* d;
+        UString::Rep* r = UString::Rep::createUninitialized(length, d).releaseRef();
         for (size_t i = 0; i != length; i++)
             d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
-        
-        UString::Rep* r = UString::Rep::create(d, static_cast<int>(length)).releaseRef();
-        r->_hash = hash;
-
+        r->setHash(hash);
         location = r;
     }
 };
 
 PassRefPtr<UString::Rep> Identifier::add(JSGlobalData* globalData, const char* c)
 {
-    if (!c) {
-        UString::Rep::null().hash();
-        return &UString::Rep::null();
-    }
-    if (!c[0]) {
-        UString::Rep::empty().hash();
-        return &UString::Rep::empty();
-    }
+    if (!c)
+        return UString::null().rep();
+    if (!c[0])
+        return UString::Rep::empty();
     if (!c[1])
         return add(globalData, globalData->smallStrings.singleCharacterStringRep(static_cast<unsigned char>(c[0])));
 
@@ -175,13 +172,11 @@ struct UCharBufferTranslator {
 
     static void translate(UString::Rep*& location, const UCharBuffer& buf, unsigned hash)
     {
-        UChar* d = static_cast<UChar*>(fastMalloc(sizeof(UChar) * buf.length));
+        UChar* d;
+        UString::Rep* r = UString::Rep::createUninitialized(buf.length, d).releaseRef();
         for (unsigned i = 0; i != buf.length; i++)
             d[i] = buf.s[i];
-        
-        UString::Rep* r = UString::Rep::create(d, buf.length).releaseRef();
-        r->_hash = hash;
-        
+        r->setHash(hash);
         location = r; 
     }
 };
@@ -193,10 +188,8 @@ PassRefPtr<UString::Rep> Identifier::add(JSGlobalData* globalData, const UChar*
         if (c <= 0xFF)
             return add(globalData, globalData->smallStrings.singleCharacterStringRep(c));
     }
-    if (!length) {
-        UString::Rep::empty().hash();
-        return &UString::Rep::empty();
-    }
+    if (!length)
+        return UString::Rep::empty();
     UCharBuffer buf = {s, length}; 
     pair<HashSet<UString::Rep*>::iterator, bool> addResult = globalData->identifierTable->add<UCharBuffer, UCharBufferTranslator>(buf);
 
@@ -212,22 +205,19 @@ PassRefPtr<UString::Rep> Identifier::add(ExecState* exec, const UChar* s, int le
 
 PassRefPtr<UString::Rep> Identifier::addSlowCase(JSGlobalData* globalData, UString::Rep* r)
 {
-    ASSERT(!r->identifierTable());
-    if (r->len == 1) {
-        UChar c = r->data()[0];
+    ASSERT(!r->isIdentifier());
+    // The empty & null strings are static singletons, and static strings are handled
+    // in ::add() in the header, so we should never get here with a zero length string.
+    ASSERT(r->length());
+
+    if (r->length() == 1) {
+        UChar c = r->characters()[0];
         if (c <= 0xFF)
             r = globalData->smallStrings.singleCharacterStringRep(c);
-            if (r->identifierTable()) {
-#ifndef NDEBUG
-                checkSameIdentifierTable(globalData, r);
-#endif
+            if (r->isIdentifier())
                 return r;
-            }
-    }
-    if (!r->len) {
-        UString::Rep::empty().hash();
-        return &UString::Rep::empty();
     }
+
     return *globalData->identifierTable->add(r).first;
 }
 
@@ -238,29 +228,69 @@ PassRefPtr<UString::Rep> Identifier::addSlowCase(ExecState* exec, UString::Rep*
 
 void Identifier::remove(UString::Rep* r)
 {
-    r->identifierTable()->remove(r);
+    currentIdentifierTable()->remove(r);
+}
+    
+Identifier Identifier::from(ExecState* exec, unsigned value)
+{
+    return Identifier(exec, exec->globalData().numericStrings.add(value));
+}
+
+Identifier Identifier::from(ExecState* exec, int value)
+{
+    return Identifier(exec, exec->globalData().numericStrings.add(value));
+}
+
+Identifier Identifier::from(ExecState* exec, double value)
+{
+    return Identifier(exec, exec->globalData().numericStrings.add(value));
 }
 
 #ifndef NDEBUG
 
-void Identifier::checkSameIdentifierTable(ExecState* exec, UString::Rep* rep)
+void Identifier::checkCurrentIdentifierTable(JSGlobalData* globalData)
 {
-    ASSERT(rep->identifierTable() == exec->globalData().identifierTable);
+    // Check the identifier table accessible through the threadspecific matches the
+    // globalData's identifier table.
+    ASSERT_UNUSED(globalData, globalData->identifierTable == currentIdentifierTable());
 }
 
-void Identifier::checkSameIdentifierTable(JSGlobalData* globalData, UString::Rep* rep)
+void Identifier::checkCurrentIdentifierTable(ExecState* exec)
 {
-    ASSERT(rep->identifierTable() == globalData->identifierTable);
+    checkCurrentIdentifierTable(&exec->globalData());
 }
 
 #else
 
-void Identifier::checkSameIdentifierTable(ExecState*, UString::Rep*)
+// These only exists so that our exports are the same for debug and release builds.
+// This would be an ASSERT_NOT_REACHED(), but we're in NDEBUG only code here!
+void Identifier::checkCurrentIdentifierTable(JSGlobalData*) { CRASH(); }
+void Identifier::checkCurrentIdentifierTable(ExecState*) { CRASH(); }
+
+#endif
+
+ThreadSpecific<ThreadIdentifierTableData>* g_identifierTableSpecific = 0;
+
+#if ENABLE(JSC_MULTIPLE_THREADS)
+
+pthread_once_t createIdentifierTableSpecificOnce = PTHREAD_ONCE_INIT;
+static void createIdentifierTableSpecificCallback()
 {
+    ASSERT(!g_identifierTableSpecific);
+    g_identifierTableSpecific = new ThreadSpecific<ThreadIdentifierTableData>();
 }
+void createIdentifierTableSpecific()
+{
+    pthread_once(&createIdentifierTableSpecificOnce, createIdentifierTableSpecificCallback);
+    ASSERT(g_identifierTableSpecific);
+}
+
+#else 
 
-void Identifier::checkSameIdentifierTable(JSGlobalData*, UString::Rep*)
+void createIdentifierTableSpecific()
 {
+    ASSERT(!g_identifierTableSpecific);
+    g_identifierTableSpecific = new ThreadSpecific<ThreadIdentifierTableData>();
 }
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h
index 2249179cfc..48b1da1ca5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h
@@ -22,6 +22,7 @@
 #define Identifier_h
 
 #include "JSGlobalData.h"
+#include "ThreadSpecific.h"
 #include "UString.h"
 
 namespace JSC {
@@ -53,9 +54,9 @@ namespace JSC {
         
         const char* ascii() const { return _ustring.ascii(); }
         
-        static Identifier from(ExecState* exec, unsigned y) { return Identifier(exec, UString::from(y)); }
-        static Identifier from(ExecState* exec, int y) { return Identifier(exec, UString::from(y)); }
-        static Identifier from(ExecState* exec, double y) { return Identifier(exec, UString::from(y)); }
+        static Identifier from(ExecState* exec, unsigned y);
+        static Identifier from(ExecState* exec, int y);
+        static Identifier from(ExecState* exec, double y);
         
         bool isNull() const { return _ustring.isNull(); }
         bool isEmpty() const { return _ustring.isEmpty(); }
@@ -75,7 +76,7 @@ namespace JSC {
         static void remove(UString::Rep*);
 
         static bool equal(const UString::Rep*, const char*);
-        static bool equal(const UString::Rep*, const UChar*, int length);
+        static bool equal(const UString::Rep*, const UChar*, unsigned length);
         static bool equal(const UString::Rep* a, const UString::Rep* b) { return JSC::equal(a, b); }
 
         static PassRefPtr<UString::Rep> add(ExecState*, const char*); // Only to be used with string literals.
@@ -92,30 +93,28 @@ namespace JSC {
 
         static PassRefPtr<UString::Rep> add(ExecState* exec, UString::Rep* r)
         {
-            if (r->identifierTable()) {
 #ifndef NDEBUG
-                checkSameIdentifierTable(exec, r);
+            checkCurrentIdentifierTable(exec);
 #endif
+            if (r->isIdentifier())
                 return r;
-            }
             return addSlowCase(exec, r);
         }
         static PassRefPtr<UString::Rep> add(JSGlobalData* globalData, UString::Rep* r)
         {
-            if (r->identifierTable()) {
 #ifndef NDEBUG
-                checkSameIdentifierTable(globalData, r);
+            checkCurrentIdentifierTable(globalData);
 #endif
+            if (r->isIdentifier())
                 return r;
-            }
             return addSlowCase(globalData, r);
         }
 
         static PassRefPtr<UString::Rep> addSlowCase(ExecState*, UString::Rep* r);
         static PassRefPtr<UString::Rep> addSlowCase(JSGlobalData*, UString::Rep* r);
 
-        static void checkSameIdentifierTable(ExecState*, UString::Rep*);
-        static void checkSameIdentifierTable(JSGlobalData*, UString::Rep*);
+        static void checkCurrentIdentifierTable(ExecState*);
+        static void checkCurrentIdentifierTable(JSGlobalData*);
     };
     
     inline bool operator==(const Identifier& a, const Identifier& b)
@@ -141,6 +140,67 @@ namespace JSC {
     IdentifierTable* createIdentifierTable();
     void deleteIdentifierTable(IdentifierTable*);
 
+    struct ThreadIdentifierTableData {
+        ThreadIdentifierTableData()
+            : defaultIdentifierTable(0)
+            , currentIdentifierTable(0)
+        {
+        }
+
+        IdentifierTable* defaultIdentifierTable;
+        IdentifierTable* currentIdentifierTable;
+    };
+
+    extern WTF::ThreadSpecific<ThreadIdentifierTableData>* g_identifierTableSpecific;
+    void createIdentifierTableSpecific();
+
+    inline IdentifierTable* defaultIdentifierTable()
+    {
+        if (!g_identifierTableSpecific)
+            createIdentifierTableSpecific();
+        ThreadIdentifierTableData& data = **g_identifierTableSpecific;
+
+        return data.defaultIdentifierTable;
+    }
+
+    inline void setDefaultIdentifierTable(IdentifierTable* identifierTable)
+    {
+        if (!g_identifierTableSpecific)
+            createIdentifierTableSpecific();
+        ThreadIdentifierTableData& data = **g_identifierTableSpecific;
+
+        data.defaultIdentifierTable = identifierTable;
+    }
+
+    inline IdentifierTable* currentIdentifierTable()
+    {
+        if (!g_identifierTableSpecific)
+            createIdentifierTableSpecific();
+        ThreadIdentifierTableData& data = **g_identifierTableSpecific;
+
+        return data.currentIdentifierTable;
+    }
+
+    inline IdentifierTable* setCurrentIdentifierTable(IdentifierTable* identifierTable)
+    {
+        if (!g_identifierTableSpecific)
+            createIdentifierTableSpecific();
+        ThreadIdentifierTableData& data = **g_identifierTableSpecific;
+
+        IdentifierTable* oldIdentifierTable = data.currentIdentifierTable;
+        data.currentIdentifierTable = identifierTable;
+        return oldIdentifierTable;
+    }
+
+    inline void resetCurrentIdentifierTable()
+    {
+        if (!g_identifierTableSpecific)
+            createIdentifierTableSpecific();
+        ThreadIdentifierTableData& data = **g_identifierTableSpecific;
+
+        data.currentIdentifierTable = data.defaultIdentifierTable;
+    }
+
 } // namespace JSC
 
 #endif // Identifier_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
index fea89f875e..2605a9a7cd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
@@ -41,7 +41,7 @@ using namespace WTF;
 
 namespace JSC {
 
-#if PLATFORM(DARWIN) && ENABLE(JSC_MULTIPLE_THREADS)
+#if OS(DARWIN) && ENABLE(JSC_MULTIPLE_THREADS)
 static pthread_once_t initializeThreadingKeyOnce = PTHREAD_ONCE_INIT;
 #endif
 
@@ -49,15 +49,16 @@ static void initializeThreadingOnce()
 {
     WTF::initializeThreading();
     initializeUString();
+    JSGlobalData::storeVPtrs();
 #if ENABLE(JSC_MULTIPLE_THREADS)
     s_dtoaP5Mutex = new Mutex;
-    WTF::initializeDates();
+    initializeDates();
 #endif
 }
 
 void initializeThreading()
 {
-#if PLATFORM(DARWIN) && ENABLE(JSC_MULTIPLE_THREADS)
+#if OS(DARWIN) && ENABLE(JSC_MULTIPLE_THREADS)
     pthread_once(&initializeThreadingKeyOnce, initializeThreadingOnce);
 #else
     static bool initializedThreading = false;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp
index 2ba2984b2b..c48d6288e5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp
@@ -43,29 +43,29 @@ InternalFunction::InternalFunction(JSGlobalData* globalData, NonNullPassRefPtr<S
     putDirect(globalData->propertyNames->name, jsString(globalData, name.ustring()), DontDelete | ReadOnly | DontEnum);
 }
 
-const UString& InternalFunction::name(JSGlobalData* globalData)
+const UString& InternalFunction::name(ExecState* exec)
 {
-    return asString(getDirect(globalData->propertyNames->name))->value();
+    return asString(getDirect(exec->globalData().propertyNames->name))->value(exec);
 }
 
-const UString InternalFunction::displayName(JSGlobalData* globalData)
+const UString InternalFunction::displayName(ExecState* exec)
 {
-    JSValue displayName = getDirect(globalData->propertyNames->displayName);
+    JSValue displayName = getDirect(exec->globalData().propertyNames->displayName);
     
-    if (displayName && isJSString(globalData, displayName))
-        return asString(displayName)->value();
+    if (displayName && isJSString(&exec->globalData(), displayName))
+        return asString(displayName)->value(exec);
     
     return UString::null();
 }
 
-const UString InternalFunction::calculatedDisplayName(JSGlobalData* globalData)
+const UString InternalFunction::calculatedDisplayName(ExecState* exec)
 {
-    const UString explicitName = displayName(globalData);
+    const UString explicitName = displayName(exec);
     
     if (!explicitName.isEmpty())
         return explicitName;
     
-    return name(globalData);
+    return name(exec);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
index de9a1d6ecb..d19b82b38a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
@@ -36,13 +36,13 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const; 
         static JS_EXPORTDATA const ClassInfo info;
 
-        const UString& name(JSGlobalData*);
-        const UString displayName(JSGlobalData*);
-        const UString calculatedDisplayName(JSGlobalData*);
+        const UString& name(ExecState*);
+        const UString displayName(ExecState*);
+        const UString calculatedDisplayName(ExecState*);
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
index aca550e2f6..10ded4cd44 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
@@ -23,8 +23,6 @@
 #ifndef JSAPIValueWrapper_h
 #define JSAPIValueWrapper_h
 
-#include <wtf/Platform.h>
-
 #include "JSCell.h"
 #include "CallFrame.h"
 
@@ -39,7 +37,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren | OverridesGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren | OverridesGetPropertyNames), AnonymousSlotCount);
         }
 
         
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
index 22fdaafd46..85e8bbaaff 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
@@ -139,9 +139,9 @@ bool JSActivation::isDynamicScope() const
     return d()->functionExecutable->usesEval();
 }
 
-JSValue JSActivation::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSActivation::argumentsGetter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSActivation* activation = asActivation(slot.slotBase());
+    JSActivation* activation = asActivation(slotBase);
 
     if (activation->d()->functionExecutable->usesArguments()) {
         PropertySlot slot;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
index ee9819106a..91c960ce7c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
@@ -66,7 +66,7 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); }
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
@@ -89,7 +89,7 @@ namespace JSC {
             RefPtr<FunctionExecutable> functionExecutable;
         };
         
-        static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue argumentsGetter(ExecState*, JSValue, const Identifier&);
         NEVER_INLINE PropertySlot::GetValueFunc getArgumentsGetter();
 
         JSActivationData* d() const { return static_cast<JSActivationData*>(JSVariableObject::d); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
index fd9e7b2e4c..d3ef44cb9e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
@@ -151,7 +151,8 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength)
     m_vectorLength = initialCapacity;
     m_storage->m_numValuesInVector = 0;
     m_storage->m_sparseValueMap = 0;
-    m_storage->lazyCreationData = 0;
+    m_storage->subclassData = 0;
+    m_storage->reportedMapCapacity = 0;
 
     JSValue* vector = m_storage->m_vector;
     for (size_t i = 0; i < initialCapacity; ++i)
@@ -172,6 +173,8 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, const ArgList& list)
     m_vectorLength = initialCapacity;
     m_storage->m_numValuesInVector = initialCapacity;
     m_storage->m_sparseValueMap = 0;
+    m_storage->subclassData = 0;
+    m_storage->reportedMapCapacity = 0;
 
     size_t i = 0;
     ArgList::const_iterator end = list.end();
@@ -185,6 +188,7 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, const ArgList& list)
 
 JSArray::~JSArray()
 {
+    ASSERT(vptr() == JSGlobalData::jsArrayVPtr);
     checkConsistency(DestructorConsistencyCheck);
 
     delete m_storage->m_sparseValueMap;
@@ -328,13 +332,24 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
         }
 
         // We miss some cases where we could compact the storage, such as a large array that is being filled from the end
-        // (which will only be compacted as we reach indices that are less than cutoff) - but this makes the check much faster.
+        // (which will only be compacted as we reach indices that are less than MIN_SPARSE_ARRAY_INDEX) - but this makes the check much faster.
         if ((i > MAX_STORAGE_VECTOR_INDEX) || !isDenseEnoughForVector(i + 1, storage->m_numValuesInVector + 1)) {
             if (!map) {
                 map = new SparseArrayValueMap;
                 storage->m_sparseValueMap = map;
             }
-            map->set(i, value);
+
+            pair<SparseArrayValueMap::iterator, bool> result = map->add(i, value);
+            if (!result.second) { // pre-existing entry
+                result.first->second = value;
+                return;
+            }
+
+            size_t capacity = map->capacity();
+            if (capacity != storage->reportedMapCapacity) {
+                Heap::heap(this)->reportExtraMemoryCost((capacity - storage->reportedMapCapacity) * (sizeof(unsigned) + sizeof(JSValue)));
+                storage->reportedMapCapacity = capacity;
+            }
             return;
         }
     }
@@ -380,8 +395,6 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
 
     unsigned vectorLength = m_vectorLength;
 
-    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
-
     if (newNumValuesInVector == storage->m_numValuesInVector + 1) {
         for (unsigned j = vectorLength; j < newVectorLength; ++j)
             storage->m_vector[j] = JSValue();
@@ -402,6 +415,8 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
     m_storage = storage;
 
     checkConsistency();
+
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
 }
 
 bool JSArray::deleteProperty(ExecState* exec, const Identifier& propertyName)
@@ -454,7 +469,7 @@ bool JSArray::deleteProperty(ExecState* exec, unsigned i)
     return false;
 }
 
-void JSArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // FIXME: Filling PropertyNameArray with an identifier for every integer
     // is incredibly inefficient for large arrays. We need a different approach,
@@ -474,7 +489,10 @@ void JSArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNa
             propertyNames.add(Identifier::from(exec, it->first));
     }
 
-    JSObject::getOwnPropertyNames(exec, propertyNames);
+    if (mode == IncludeDontEnumProperties)
+        propertyNames.add(exec->propertyNames().length);
+
+    JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 bool JSArray::increaseVectorLength(unsigned newLength)
@@ -492,13 +510,15 @@ bool JSArray::increaseVectorLength(unsigned newLength)
     if (!tryFastRealloc(storage, storageSize(newVectorLength)).getValue(storage))
         return false;
 
-    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
     m_vectorLength = newVectorLength;
 
     for (unsigned i = vectorLength; i < newVectorLength; ++i)
         storage->m_vector[i] = JSValue();
 
     m_storage = storage;
+
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
+
     return true;
 }
 
@@ -785,7 +805,7 @@ struct AVLTreeAbstractorForArrayCompare {
             m_cachedCall->setThis(m_globalThisValue);
             m_cachedCall->setArgument(0, va);
             m_cachedCall->setArgument(1, vb);
-            compareResult = m_cachedCall->call().toNumber(m_cachedCall->newCallFrame());
+            compareResult = m_cachedCall->call().toNumber(m_cachedCall->newCallFrame(m_exec));
         } else {
             MarkedArgumentBuffer arguments;
             arguments.append(va);
@@ -1002,14 +1022,14 @@ unsigned JSArray::compactForSorting()
     return numDefined;
 }
 
-void* JSArray::lazyCreationData()
+void* JSArray::subclassData() const
 {
-    return m_storage->lazyCreationData;
+    return m_storage->subclassData;
 }
 
-void JSArray::setLazyCreationData(void* d)
+void JSArray::setSubclassData(void* d)
 {
-    m_storage->lazyCreationData = d;
+    m_storage->subclassData = d;
 }
 
 #if CHECK_ARRAY_CONSISTENCY
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
index 8c224517cd..f65f2bcf70 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
@@ -31,7 +31,8 @@ namespace JSC {
         unsigned m_length;
         unsigned m_numValuesInVector;
         SparseArrayValueMap* m_sparseValueMap;
-        void* lazyCreationData; // A JSArray subclass can use this to fill the vector lazily.
+        void* subclassData; // A JSArray subclass can use this to fill the vector lazily.
+        size_t reportedMapCapacity;
         JSValue m_vector[1];
     };
 
@@ -87,7 +88,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
         
         inline void markChildrenDirect(MarkStack& markStack);
@@ -97,11 +98,11 @@ namespace JSC {
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
         virtual void markChildren(MarkStack&);
 
-        void* lazyCreationData();
-        void setLazyCreationData(void*);
+        void* subclassData() const;
+        void setSubclassData(void*);
 
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
index 5e5003b188..803a08c97c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
@@ -42,10 +42,18 @@ JSByteArray::JSByteArray(ExecState* exec, NonNullPassRefPtr<Structure> structure
 {
     putDirect(exec->globalData().propertyNames->length, jsNumber(exec, m_storage->length()), ReadOnly | DontDelete);
 }
-    
+
+#if !ASSERT_DISABLED
+JSByteArray::~JSByteArray()
+{
+    ASSERT(vptr() == JSGlobalData::jsByteArrayVPtr);
+}
+#endif
+
+
 PassRefPtr<Structure> JSByteArray::createStructure(JSValue prototype)
 {
-    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
     return result;
 }
 
@@ -96,12 +104,12 @@ void JSByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
     setIndex(exec, propertyName, value);
 }
 
-void JSByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     unsigned length = m_storage->length();
     for (unsigned i = 0; i < length; ++i)
         propertyNames.add(Identifier::from(exec, i));
-    JSObject::getOwnPropertyNames(exec, propertyNames);
+    JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
index fe6e124d6f..5b7adcf888 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
@@ -33,7 +33,7 @@
 namespace JSC {
 
     class JSByteArray : public JSObject {
-        friend struct VPtrSet;
+        friend class JSGlobalData;
     public:
         bool canAccessIndex(unsigned i) { return i < m_storage->length(); }
         JSValue getIndex(ExecState* exec, unsigned i)
@@ -82,7 +82,7 @@ namespace JSC {
         virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
 
-        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
         virtual const ClassInfo* classInfo() const { return m_classInfo; }
         static const ClassInfo s_defaultInfo;
@@ -91,6 +91,10 @@ namespace JSC {
 
         WTF::ByteArray* storage() const { return m_storage.get(); }
 
+#if !ASSERT_DISABLED
+        virtual ~JSByteArray();
+#endif
+
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
index fae056eb7a..869fbfc883 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
@@ -59,10 +59,10 @@ static const union {
     } doubles;
     
 } NaNInf = { {
-#if PLATFORM(BIG_ENDIAN)
+#if CPU(BIG_ENDIAN)
     { 0x7f, 0xf8, 0, 0, 0, 0, 0, 0 },
     { 0x7f, 0xf0, 0, 0, 0, 0, 0, 0 }
-#elif PLATFORM(MIDDLE_ENDIAN)
+#elif CPU(MIDDLE_ENDIAN)
     { 0, 0, 0xf8, 0x7f, 0, 0, 0, 0 },
     { 0, 0, 0xf0, 0x7f, 0, 0, 0, 0 }
 #else
@@ -76,27 +76,22 @@ extern const double Inf = NaNInf.doubles.Inf_Double;
  
 #endif // !(defined NAN && defined INFINITY)
 
-void* JSCell::operator new(size_t size, ExecState* exec)
-{
-    return exec->heap()->allocate(size);
-}
-
 bool JSCell::getUInt32(uint32_t&) const
 {
     return false;
 }
 
-bool JSCell::getString(UString&stringValue) const
+bool JSCell::getString(ExecState* exec, UString&stringValue) const
 {
     if (!isString())
         return false;
-    stringValue = static_cast<const JSString*>(this)->value();
+    stringValue = static_cast<const JSString*>(this)->value(exec);
     return true;
 }
 
-UString JSCell::getString() const
+UString JSCell::getString(ExecState* exec) const
 {
-    return isString() ? static_cast<const JSString*>(this)->value() : UString();
+    return isString() ? static_cast<const JSString*>(this)->value(exec) : UString();
 }
 
 JSObject* JSCell::getObject()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
index 722ae339ed..3c8c829102 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
@@ -42,14 +42,19 @@ namespace JSC {
         friend class JSString;
         friend class JSValue;
         friend class JSAPIValueWrapper;
-        friend struct VPtrSet;
+        friend class JSZombie;
+        friend class JSGlobalData;
 
     private:
         explicit JSCell(Structure*);
-        JSCell(); // Only used for initializing Collector blocks.
         virtual ~JSCell();
 
     public:
+        static PassRefPtr<Structure> createDummyStructure()
+        {
+            return Structure::create(jsNull(), TypeInfo(UnspecifiedType), AnonymousSlotCount);
+        }
+
         // Querying the type.
 #if USE(JSVALUE32)
         bool isNumber() const;
@@ -64,8 +69,8 @@ namespace JSC {
         Structure* structure() const;
 
         // Extracting the value.
-        bool getString(UString&) const;
-        UString getString() const; // null string if not a string
+        bool getString(ExecState* exec, UString&) const;
+        UString getString(ExecState* exec) const; // null string if not a string
         JSObject* getObject(); // NULL if not an object
         const JSObject* getObject() const; // NULL if not an object
         
@@ -90,6 +95,9 @@ namespace JSC {
         void* operator new(size_t, void* placementNewDestination) { return placementNewDestination; }
 
         virtual void markChildren(MarkStack&);
+#if ENABLE(JSC_ZOMBIES)
+        virtual bool isZombie() const { return false; }
+#endif
 
         // Object operations, with the toObject operation included.
         virtual const ClassInfo* classInfo() const;
@@ -103,6 +111,10 @@ namespace JSC {
         virtual JSString* toThisJSString(ExecState*);
         virtual JSValue getJSNumber();
         void* vptr() { return *reinterpret_cast<void**>(this); }
+        void setVPtr(void* vptr) { *reinterpret_cast<void**>(this) = vptr; }
+
+    protected:
+        static const unsigned AnonymousSlotCount = 0;
 
     private:
         // Base implementation; for non-object classes implements getPropertySlot.
@@ -118,11 +130,6 @@ namespace JSC {
     {
     }
 
-    // Only used for initializing Collector blocks.
-    inline JSCell::JSCell()
-    {
-    }
-
     inline JSCell::~JSCell()
     {
     }
@@ -130,7 +137,7 @@ namespace JSC {
 #if USE(JSVALUE32)
     inline bool JSCell::isNumber() const
     {
-        return Heap::isNumber(const_cast<JSCell*>(this));
+        return m_structure->typeInfo().type() == NumberType;
     }
 #endif
 
@@ -158,6 +165,11 @@ namespace JSC {
         return globalData->heap.allocate(size);
     }
 
+    inline void* JSCell::operator new(size_t size, ExecState* exec)
+    {
+        return exec->heap()->allocate(size);
+    }
+
     // --- JSValue inlines ----------------------------
 
     inline bool JSValue::isString() const
@@ -175,14 +187,14 @@ namespace JSC {
         return isCell() && asCell()->isObject();
     }
 
-    inline bool JSValue::getString(UString& s) const
+    inline bool JSValue::getString(ExecState* exec, UString& s) const
     {
-        return isCell() && asCell()->getString(s);
+        return isCell() && asCell()->getString(exec, s);
     }
 
-    inline UString JSValue::getString() const
+    inline UString JSValue::getString(ExecState* exec) const
     {
-        return isCell() ? asCell()->getString() : UString();
+        return isCell() ? asCell()->getString(exec) : UString();
     }
 
     inline JSObject* JSValue::getObject() const
@@ -342,7 +354,13 @@ namespace JSC {
     {
         return cellBlock(c)->heap;
     }
-
+    
+#if ENABLE(JSC_ZOMBIES)
+    inline bool JSValue::isZombie() const
+    {
+        return isCell() && asCell() && asCell()->isZombie();
+    }
+#endif
 } // namespace JSC
 
 #endif // JSCell_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
index 024e5869f7..cba679555b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
@@ -81,6 +81,8 @@ JSFunction::JSFunction(ExecState* exec, NonNullPassRefPtr<FunctionExecutable> ex
 
 JSFunction::~JSFunction()
 {
+    ASSERT(vptr() == JSGlobalData::jsFunctionVPtr);
+
     // JIT code for other functions may have had calls linked directly to the code for this function; these links
     // are based on a check for the this pointer value for this JSFunction - which will no longer be valid once
     // this memory is freed and may be reused (potentially for another, different JSFunction).
@@ -120,23 +122,23 @@ JSValue JSFunction::call(ExecState* exec, JSValue thisValue, const ArgList& args
     return exec->interpreter()->execute(jsExecutable(), exec, this, thisValue.toThisObject(exec), args, scopeChain().node(), exec->exceptionSlot());
 }
 
-JSValue JSFunction::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::argumentsGetter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFunction* thisObj = asFunction(slot.slotBase());
+    JSFunction* thisObj = asFunction(slotBase);
     ASSERT(!thisObj->isHostFunction());
     return exec->interpreter()->retrieveArguments(exec, thisObj);
 }
 
-JSValue JSFunction::callerGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::callerGetter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFunction* thisObj = asFunction(slot.slotBase());
+    JSFunction* thisObj = asFunction(slotBase);
     ASSERT(!thisObj->isHostFunction());
     return exec->interpreter()->retrieveCaller(exec, thisObj);
 }
 
-JSValue JSFunction::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::lengthGetter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFunction* thisObj = asFunction(slot.slotBase());
+    JSFunction* thisObj = asFunction(slotBase);
     ASSERT(!thisObj->isHostFunction());
     return jsNumber(exec, thisObj->jsExecutable()->parameterCount());
 }
@@ -160,17 +162,17 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     }
 
     if (propertyName == exec->propertyNames().arguments) {
-        slot.setCustom(this, argumentsGetter);
+        slot.setCacheableCustom(this, argumentsGetter);
         return true;
     }
 
     if (propertyName == exec->propertyNames().length) {
-        slot.setCustom(this, lengthGetter);
+        slot.setCacheableCustom(this, lengthGetter);
         return true;
     }
 
     if (propertyName == exec->propertyNames().caller) {
-        slot.setCustom(this, callerGetter);
+        slot.setCacheableCustom(this, callerGetter);
         return true;
     }
 
@@ -206,6 +208,17 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
         return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
     }
     
+void JSFunction::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (!isHostFunction() && (mode == IncludeDontEnumProperties)) {
+        propertyNames.add(exec->propertyNames().arguments);
+        propertyNames.add(exec->propertyNames().callee);
+        propertyNames.add(exec->propertyNames().caller);
+        propertyNames.add(exec->propertyNames().length);
+    }
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
 void JSFunction::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (isHostFunction()) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
index fcac9aaaa0..afa24a8be8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
@@ -36,7 +36,7 @@ namespace JSC {
 
     class JSFunction : public InternalFunction {
         friend class JIT;
-        friend struct VPtrSet;
+        friend class JSGlobalData;
 
         typedef InternalFunction Base;
 
@@ -61,7 +61,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
         NativeFunction nativeFunction()
@@ -82,6 +82,7 @@ namespace JSC {
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
 
@@ -89,9 +90,9 @@ namespace JSC {
 
         virtual const ClassInfo* classInfo() const { return &info; }
 
-        static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
-        static JSValue callerGetter(ExecState*, const Identifier&, const PropertySlot&);
-        static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue argumentsGetter(ExecState*, JSValue, const Identifier&);
+        static JSValue callerGetter(ExecState*, JSValue, const Identifier&);
+        static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
 
         RefPtr<ExecutableBase> m_executable;
         ScopeChain& scopeChain()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
index 1221ef282b..45abc86de1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -45,10 +45,10 @@
 #include "JSNotAnObject.h"
 #include "JSPropertyNameIterator.h"
 #include "JSStaticScopeObject.h"
-#include "Parser.h"
 #include "Lexer.h"
 #include "Lookup.h"
 #include "Nodes.h"
+#include "Parser.h"
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
 #include <wtf/Threading.h>
@@ -71,40 +71,38 @@ extern JSC_CONST_HASHTABLE HashTable regExpTable;
 extern JSC_CONST_HASHTABLE HashTable regExpConstructorTable;
 extern JSC_CONST_HASHTABLE HashTable stringTable;
 
-struct VPtrSet {
-    VPtrSet();
-
-    void* jsArrayVPtr;
-    void* jsByteArrayVPtr;
-    void* jsStringVPtr;
-    void* jsFunctionVPtr;
-};
+void* JSGlobalData::jsArrayVPtr;
+void* JSGlobalData::jsByteArrayVPtr;
+void* JSGlobalData::jsStringVPtr;
+void* JSGlobalData::jsFunctionVPtr;
 
-VPtrSet::VPtrSet()
+void JSGlobalData::storeVPtrs()
 {
-    // Bizarrely, calling fastMalloc here is faster than allocating space on the stack.
-    void* storage = fastMalloc(sizeof(CollectorBlock));
+    CollectorCell cell;
+    void* storage = &cell;
 
+    COMPILE_ASSERT(sizeof(JSArray) <= sizeof(CollectorCell), sizeof_JSArray_must_be_less_than_CollectorCell);
     JSCell* jsArray = new (storage) JSArray(JSArray::createStructure(jsNull()));
-    jsArrayVPtr = jsArray->vptr();
+    JSGlobalData::jsArrayVPtr = jsArray->vptr();
     jsArray->~JSCell();
 
+    COMPILE_ASSERT(sizeof(JSByteArray) <= sizeof(CollectorCell), sizeof_JSByteArray_must_be_less_than_CollectorCell);
     JSCell* jsByteArray = new (storage) JSByteArray(JSByteArray::VPtrStealingHack);
-    jsByteArrayVPtr = jsByteArray->vptr();
+    JSGlobalData::jsByteArrayVPtr = jsByteArray->vptr();
     jsByteArray->~JSCell();
 
+    COMPILE_ASSERT(sizeof(JSString) <= sizeof(CollectorCell), sizeof_JSString_must_be_less_than_CollectorCell);
     JSCell* jsString = new (storage) JSString(JSString::VPtrStealingHack);
-    jsStringVPtr = jsString->vptr();
+    JSGlobalData::jsStringVPtr = jsString->vptr();
     jsString->~JSCell();
 
+    COMPILE_ASSERT(sizeof(JSFunction) <= sizeof(CollectorCell), sizeof_JSFunction_must_be_less_than_CollectorCell);
     JSCell* jsFunction = new (storage) JSFunction(JSFunction::createStructure(jsNull()));
-    jsFunctionVPtr = jsFunction->vptr();
+    JSGlobalData::jsFunctionVPtr = jsFunction->vptr();
     jsFunction->~JSCell();
-
-    fastFree(storage);
 }
 
-JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
+JSGlobalData::JSGlobalData(bool isShared)
     : isSharedInstance(isShared)
     , clientData(0)
     , arrayTable(fastNew<HashTable>(JSC::arrayTable))
@@ -124,13 +122,10 @@ JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
     , propertyNameIteratorStructure(JSPropertyNameIterator::createStructure(jsNull()))
     , getterSetterStructure(GetterSetter::createStructure(jsNull()))
     , apiWrapperStructure(JSAPIValueWrapper::createStructure(jsNull()))
+    , dummyMarkableCellStructure(JSCell::createDummyStructure())
 #if USE(JSVALUE32)
     , numberStructure(JSNumberCell::createStructure(jsNull()))
 #endif
-    , jsArrayVPtr(vptrSet.jsArrayVPtr)
-    , jsByteArrayVPtr(vptrSet.jsByteArrayVPtr)
-    , jsStringVPtr(vptrSet.jsStringVPtr)
-    , jsFunctionVPtr(vptrSet.jsFunctionVPtr)
     , identifierTable(createIdentifierTable())
     , propertyNames(new CommonIdentifiers(this))
     , emptyList(new MarkedArgumentBuffer)
@@ -146,7 +141,9 @@ JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
     , dynamicGlobalObject(0)
     , functionCodeBlockBeingReparsed(0)
     , firstStringifierToMark(0)
-    , markStack(vptrSet.jsArrayVPtr)
+    , markStack(jsArrayVPtr)
+    , cachedUTCOffset(NaN)
+    , weakRandom(static_cast<int>(currentTime()))
 #ifndef NDEBUG
     , mainThreadOnly(false)
 #endif
@@ -197,9 +194,17 @@ JSGlobalData::~JSGlobalData()
     delete clientData;
 }
 
-PassRefPtr<JSGlobalData> JSGlobalData::create(bool isShared)
+PassRefPtr<JSGlobalData> JSGlobalData::createNonDefault()
+{
+    return adoptRef(new JSGlobalData(false));
+}
+
+PassRefPtr<JSGlobalData> JSGlobalData::create()
 {
-    return adoptRef(new JSGlobalData(isShared, VPtrSet()));
+    JSGlobalData* globalData = new JSGlobalData(false);
+    setDefaultIdentifierTable(globalData->identifierTable);
+    setCurrentIdentifierTable(globalData->identifierTable);
+    return adoptRef(globalData);
 }
 
 PassRefPtr<JSGlobalData> JSGlobalData::createLeaked()
@@ -219,7 +224,7 @@ JSGlobalData& JSGlobalData::sharedInstance()
 {
     JSGlobalData*& instance = sharedInstanceInternal();
     if (!instance) {
-        instance = create(true).releaseRef();
+        instance = new JSGlobalData(true);
 #if ENABLE(JSC_MULTIPLE_THREADS)
         instance->makeUsableFromMultipleThreads();
 #endif
@@ -251,6 +256,14 @@ JSGlobalData::ClientData::~ClientData()
 {
 }
 
+void JSGlobalData::resetDateCache()
+{
+    cachedUTCOffset = NaN;
+    dstOffsetCache.reset();
+    cachedDateString = UString();
+    dateInstanceCache.reset();
+}
+
 void JSGlobalData::startSampling()
 {
     interpreter->startSampling();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
index d2aa2da436..0f1f3c69ec 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
@@ -38,6 +38,7 @@
 #include "NumericStrings.h"
 #include "SmallStrings.h"
 #include "TimeoutChecker.h"
+#include "WeakRandom.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
@@ -61,7 +62,26 @@ namespace JSC {
 
     struct HashTable;
     struct Instruction;    
-    struct VPtrSet;
+
+    struct DSTOffsetCache {
+        DSTOffsetCache()
+        {
+            reset();
+        }
+        
+        void reset()
+        {
+            offset = 0.0;
+            start = 0.0;
+            end = -1.0;
+            increment = 0.0;
+        }
+
+        double offset;
+        double start;
+        double end;
+        double increment;
+    };
 
     class JSGlobalData : public RefCounted<JSGlobalData> {
     public:
@@ -72,8 +92,9 @@ namespace JSC {
         static bool sharedInstanceExists();
         static JSGlobalData& sharedInstance();
 
-        static PassRefPtr<JSGlobalData> create(bool isShared = false);
+        static PassRefPtr<JSGlobalData> create();
         static PassRefPtr<JSGlobalData> createLeaked();
+        static PassRefPtr<JSGlobalData> createNonDefault();
         ~JSGlobalData();
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
@@ -102,15 +123,17 @@ namespace JSC {
         RefPtr<Structure> propertyNameIteratorStructure;
         RefPtr<Structure> getterSetterStructure;
         RefPtr<Structure> apiWrapperStructure;
+        RefPtr<Structure> dummyMarkableCellStructure;
 
 #if USE(JSVALUE32)
         RefPtr<Structure> numberStructure;
 #endif
 
-        void* jsArrayVPtr;
-        void* jsByteArrayVPtr;
-        void* jsStringVPtr;
-        void* jsFunctionVPtr;
+        static void storeVPtrs();
+        static JS_EXPORTDATA void* jsArrayVPtr;
+        static JS_EXPORTDATA void* jsByteArrayVPtr;
+        static JS_EXPORTDATA void* jsStringVPtr;
+        static JS_EXPORTDATA void* jsFunctionVPtr;
 
         IdentifierTable* identifierTable;
         CommonIdentifiers* propertyNames;
@@ -153,19 +176,29 @@ namespace JSC {
 
         MarkStack markStack;
 
+        double cachedUTCOffset;
+        DSTOffsetCache dstOffsetCache;
+        
+        UString cachedDateString;
+        double cachedDateStringValue;
+        
+        WeakRandom weakRandom;
+
 #ifndef NDEBUG
         bool mainThreadOnly;
 #endif
 
+        void resetDateCache();
+
         void startSampling();
         void stopSampling();
         void dumpSampleData(ExecState* exec);
     private:
-        JSGlobalData(bool isShared, const VPtrSet&);
+        JSGlobalData(bool isShared);
         static JSGlobalData*& sharedInstanceInternal();
         void createNativeThunk();
     };
-
+    
 } // namespace JSC
 
 #endif // JSGlobalData_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
index cf3f1d175b..86690bd277 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -128,6 +128,8 @@ void JSGlobalObject::init(JSObject* thisValue)
 {
     ASSERT(JSLock::currentThreadIsHoldingLock());
 
+    structure()->disableSpecificFunctionTracking();
+
     d()->globalData = Heap::heap(this)->globalData();
     d()->globalScopeChain = ScopeChain(this, d()->globalData.get(), this, thisValue);
 
@@ -317,9 +319,9 @@ void JSGlobalObject::reset(JSValue prototype)
     // Set global values.
     GlobalPropertyInfo staticGlobals[] = {
         GlobalPropertyInfo(Identifier(exec, "Math"), new (exec) MathObject(exec, MathObject::createStructure(d()->objectPrototype)), DontEnum | DontDelete),
-        GlobalPropertyInfo(Identifier(exec, "NaN"), jsNaN(exec), DontEnum | DontDelete),
-        GlobalPropertyInfo(Identifier(exec, "Infinity"), jsNumber(exec, Inf), DontEnum | DontDelete),
-        GlobalPropertyInfo(Identifier(exec, "undefined"), jsUndefined(), DontEnum | DontDelete),
+        GlobalPropertyInfo(Identifier(exec, "NaN"), jsNaN(exec), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(Identifier(exec, "Infinity"), jsNumber(exec, Inf), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(Identifier(exec, "undefined"), jsUndefined(), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(Identifier(exec, "JSON"), new (exec) JSONObject(JSONObject::createStructure(d()->objectPrototype)), DontEnum | DontDelete)
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
index 720d3a56da..bbb6d5e562 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
@@ -267,7 +267,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
@@ -413,11 +413,21 @@ namespace JSC {
     {
         return new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure());
     }
+    
+    inline JSObject* constructEmptyObject(ExecState* exec, JSGlobalObject* globalObject)
+    {
+        return new (exec) JSObject(globalObject->emptyObjectStructure());
+    }
 
     inline JSArray* constructEmptyArray(ExecState* exec)
     {
         return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure());
     }
+    
+    inline JSArray* constructEmptyArray(ExecState* exec, JSGlobalObject* globalObject)
+    {
+        return new (exec) JSArray(globalObject->arrayStructure());
+    }
 
     inline JSArray* constructEmptyArray(ExecState* exec, unsigned initialLength)
     {
@@ -442,7 +452,13 @@ namespace JSC {
             : m_dynamicGlobalObjectSlot(callFrame->globalData().dynamicGlobalObject)
             , m_savedDynamicGlobalObject(m_dynamicGlobalObjectSlot)
         {
-            m_dynamicGlobalObjectSlot = dynamicGlobalObject;
+            if (!m_dynamicGlobalObjectSlot) {
+                m_dynamicGlobalObjectSlot = dynamicGlobalObject;
+
+                // Reset the date cache between JS invocations to force the VM
+                // to observe time zone changes.
+                callFrame->globalData().resetDateCache();
+            }
         }
 
         ~DynamicGlobalObjectScope()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index dc327188a1..be114d7b3c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -27,14 +27,17 @@
 
 #include "CallFrame.h"
 #include "GlobalEvalFunction.h"
+#include "Interpreter.h"
 #include "JSGlobalObject.h"
-#include "LiteralParser.h"
 #include "JSString.h"
-#include "Interpreter.h"
-#include "Parser.h"
-#include "dtoa.h"
+#include "JSStringBuilder.h"
 #include "Lexer.h"
+#include "LiteralParser.h"
 #include "Nodes.h"
+#include "Parser.h"
+#include "StringBuilder.h"
+#include "StringExtras.h"
+#include "dtoa.h"
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -55,24 +58,24 @@ static JSValue encode(ExecState* exec, const ArgList& args, const char* doNotEsc
     if (!cstr.c_str())
         return throwError(exec, URIError, "String contained an illegal UTF-16 sequence.");
 
-    UString result = "";
+    JSStringBuilder builder;
     const char* p = cstr.c_str();
     for (size_t k = 0; k < cstr.size(); k++, p++) {
         char c = *p;
         if (c && strchr(doNotEscape, c))
-            result.append(c);
+            builder.append(c);
         else {
             char tmp[4];
-            sprintf(tmp, "%%%02X", static_cast<unsigned char>(c));
-            result += tmp;
+            snprintf(tmp, 4, "%%%02X", static_cast<unsigned char>(c));
+            builder.append(tmp);
         }
     }
-    return jsString(exec, result);
+    return builder.build(exec);
 }
 
 static JSValue decode(ExecState* exec, const ArgList& args, const char* doNotUnescape, bool strict)
 {
-    UString result = "";
+    JSStringBuilder builder;
     UString str = args.at(0).toString(exec);
     int k = 0;
     int len = str.size();
@@ -106,7 +109,7 @@ static JSValue decode(ExecState* exec, const ArgList& args, const char* doNotUne
                             charLen = 0;
                         else if (character >= 0x10000) {
                             // Convert to surrogate pair.
-                            result.append(static_cast<UChar>(0xD800 | ((character - 0x10000) >> 10)));
+                            builder.append(static_cast<UChar>(0xD800 | ((character - 0x10000) >> 10)));
                             u = static_cast<UChar>(0xDC00 | ((character - 0x10000) & 0x3FF));
                         } else
                             u = static_cast<UChar>(character);
@@ -131,9 +134,9 @@ static JSValue decode(ExecState* exec, const ArgList& args, const char* doNotUne
             }
         }
         k++;
-        result.append(c);
+        builder.append(c);
     }
-    return jsString(exec, result);
+    return builder.build(exec);
 }
 
 bool isStrWhiteSpace(UChar c)
@@ -376,32 +379,30 @@ JSValue JSC_HOST_CALL globalFuncEscape(ExecState* exec, JSObject*, JSValue, cons
         "0123456789"
         "*+-./@_";
 
-    UString result = "";
-    UString s;
+    JSStringBuilder builder;
     UString str = args.at(0).toString(exec);
     const UChar* c = str.data();
-    for (int k = 0; k < str.size(); k++, c++) {
+    for (unsigned k = 0; k < str.size(); k++, c++) {
         int u = c[0];
         if (u > 255) {
             char tmp[7];
             sprintf(tmp, "%%u%04X", u);
-            s = UString(tmp);
+            builder.append(tmp);
         } else if (u != 0 && strchr(do_not_escape, static_cast<char>(u)))
-            s = UString(c, 1);
+            builder.append(c, 1);
         else {
             char tmp[4];
             sprintf(tmp, "%%%02X", u);
-            s = UString(tmp);
+            builder.append(tmp);
         }
-        result += s;
     }
 
-    return jsString(exec, result);
+    return builder.build(exec);
 }
 
 JSValue JSC_HOST_CALL globalFuncUnescape(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    UString result = "";
+    StringBuilder builder;
     UString str = args.at(0).toString(exec);
     int k = 0;
     int len = str.size();
@@ -420,10 +421,10 @@ JSValue JSC_HOST_CALL globalFuncUnescape(ExecState* exec, JSObject*, JSValue, co
             k += 2;
         }
         k++;
-        result.append(*c);
+        builder.append(*c);
     }
 
-    return jsString(exec, result);
+    return jsString(exec, builder.build());
 }
 
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
index 4ed35fc45e..0f54f6008e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
@@ -22,8 +22,6 @@
 #ifndef JSImmediate_h
 #define JSImmediate_h
 
-#include <wtf/Platform.h>
-
 #if !USE(JSVALUE32_64)
 
 #include <wtf/Assertions.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
index c36dc10e46..f4764e270b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
@@ -121,7 +121,7 @@ bool JSNotAnObject::deleteProperty(ExecState* exec, unsigned)
     return false;
 }
 
-void JSNotAnObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray&)
+void JSNotAnObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray&, EnumerationMode)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
index a271c4e494..339d41f5a2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
@@ -62,7 +62,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
      private:
@@ -91,7 +91,7 @@ namespace JSC {
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
         JSNotAnObjectErrorStub* m_exception;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
index 309488fed2..bcb506b973 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
@@ -76,7 +76,7 @@ namespace JSC {
             return globalData->heap.allocateNumber(size);
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, OverridesGetOwnPropertySlot | NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, OverridesGetOwnPropertySlot | NeedsThisConversion), AnonymousSlotCount); }
 
     private:
         JSNumberCell(JSGlobalData* globalData, double value)
@@ -109,6 +109,11 @@ namespace JSC {
         return static_cast<JSNumberCell*>(v.asCell());
     }
 
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState* exec, double d)
+    {
+        *this = jsNumberCell(exec, d);
+    }
+
     inline JSValue::JSValue(ExecState* exec, double d)
     {
         JSValue v = JSImmediate::from(d);
@@ -193,6 +198,11 @@ namespace JSC {
 #endif // USE(JSVALUE32)
 
 #if USE(JSVALUE64)
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState*, double d)
+    {
+        *this = JSImmediate::fromNumberOutsideIntegerRange(d);
+    }
+
     inline JSValue::JSValue(ExecState*, double d)
     {
         JSValue v = JSImmediate::from(d);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp
index 297d457347..d5f3303e49 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp
@@ -32,6 +32,7 @@
 #include "JSArray.h"
 #include "LiteralParser.h"
 #include "PropertyNameArray.h"
+#include "StringBuilder.h"
 #include <wtf/MathExtras.h>
 
 namespace JSC {
@@ -70,8 +71,6 @@ public:
     void markAggregate(MarkStack&);
 
 private:
-    typedef UString StringBuilder;
-
     class Holder {
     public:
         Holder(JSObject*);
@@ -136,7 +135,7 @@ static inline JSValue unwrapBoxedPrimitive(ExecState* exec, JSValue value)
 
 static inline UString gap(ExecState* exec, JSValue space)
 {
-    const int maxGapLength = 10;
+    const unsigned maxGapLength = 10;
     space = unwrapBoxedPrimitive(exec, space);
 
     // If the space value is a number, create a gap string with that number of spaces.
@@ -156,7 +155,7 @@ static inline UString gap(ExecState* exec, JSValue space)
     }
 
     // If the space value is a string, use it as the gap string, otherwise use no gap string.
-    UString spaces = space.getString();
+    UString spaces = space.getString(exec);
     if (spaces.size() > maxGapLength) {
         spaces = spaces.substr(0, maxGapLength);
     }
@@ -213,7 +212,7 @@ Stringifier::Stringifier(ExecState* exec, JSValue replacer, JSValue space)
                 break;
 
             UString propertyName;
-            if (name.getString(propertyName)) {
+            if (name.getString(exec, propertyName)) {
                 m_arrayReplacerPropertyNames.add(Identifier(exec, propertyName));
                 continue;
             }
@@ -269,7 +268,7 @@ JSValue Stringifier::stringify(JSValue value)
     if (m_exec->hadException())
         return jsNull();
 
-    return jsString(m_exec, result);
+    return jsString(m_exec, result.build());
 }
 
 void Stringifier::appendQuotedString(StringBuilder& builder, const UString& value)
@@ -389,7 +388,7 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder&
     }
 
     UString stringValue;
-    if (value.getString(stringValue)) {
+    if (value.getString(m_exec, stringValue)) {
         appendQuotedString(builder, stringValue);
         return StringifySucceeded;
     }
@@ -457,9 +456,9 @@ inline bool Stringifier::willIndent() const
 inline void Stringifier::indent()
 {
     // Use a single shared string, m_repeatedGap, so we don't keep allocating new ones as we indent and unindent.
-    int newSize = m_indent.size() + m_gap.size();
+    unsigned newSize = m_indent.size() + m_gap.size();
     if (newSize > m_repeatedGap.size())
-        m_repeatedGap.append(m_gap);
+        m_repeatedGap = makeString(m_repeatedGap, m_gap);
     ASSERT(newSize <= m_repeatedGap.size());
     m_indent = m_repeatedGap.substr(0, newSize);
 }
@@ -502,7 +501,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
                 m_propertyNames = stringifier.m_arrayReplacerPropertyNames.data();
             else {
                 PropertyNameArray objectPropertyNames(exec);
-                m_object->getPropertyNames(exec, objectPropertyNames);
+                m_object->getOwnPropertyNames(exec, objectPropertyNames);
                 m_propertyNames = objectPropertyNames.releaseData();
             }
             m_size = m_propertyNames->propertyNameVector().size();
@@ -586,7 +585,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
             // This only occurs when get an undefined value for an object property.
             // In this case we don't want the separator and property name that we
             // already appended, so roll back.
-            builder = builder.substr(0, rollBackPoint);
+            builder.resize(rollBackPoint);
             break;
     }
 
@@ -747,7 +746,7 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                 objectStack.append(object);
                 indexStack.append(0);
                 propertyStack.append(PropertyNameArray(m_exec));
-                object->getPropertyNames(m_exec, propertyStack.last());
+                object->getOwnPropertyNames(m_exec, propertyStack.last());
                 // fallthrough
             }
             objectStartVisitMember:
@@ -869,4 +868,12 @@ JSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState* exec, JSObject*, JSValue
     return Stringifier(exec, replacer, space).stringify(value);
 }
 
+UString JSONStringify(ExecState* exec, JSValue value, unsigned indent)
+{
+    JSValue result = Stringifier(exec, jsNull(), jsNumber(exec, indent)).stringify(value);
+    if (result.isUndefinedOrNull())
+        return UString();
+    return result.getString(exec);
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
index ec3fa40966..7a9e0a48b9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
@@ -41,7 +41,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
         static void markStringifiers(MarkStack&, Stringifier*);
@@ -57,6 +57,8 @@ namespace JSC {
         static const ClassInfo info;
     };
 
+    UString JSONStringify(ExecState* exec, JSValue value, unsigned indent);
+
 } // namespace JSC
 
 #endif // JSONObject_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
index 6932deda97..61d3bb1457 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
@@ -42,7 +42,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSObject);
 
-static inline void getEnumerablePropertyNames(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames)
+static inline void getClassPropertyNames(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Add properties from the static hashtables of properties
     for (; classInfo; classInfo = classInfo->parentClass) {
@@ -55,7 +55,7 @@ static inline void getEnumerablePropertyNames(ExecState* exec, const ClassInfo*
         int hashSizeMask = table->compactSize - 1;
         const HashEntry* entry = table->table;
         for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
-            if (entry->key() && !(entry->attributes() & DontEnum))
+            if (entry->key() && (!(entry->attributes() & DontEnum) || (mode == IncludeDontEnumProperties)))
                 propertyNames.add(entry->key());
         }
     }
@@ -406,26 +406,10 @@ bool JSObject::hasInstance(ExecState* exec, JSValue value, JSValue proto)
 
 bool JSObject::propertyIsEnumerable(ExecState* exec, const Identifier& propertyName) const
 {
-    unsigned attributes;
-    if (!getPropertyAttributes(exec, propertyName, attributes))
+    PropertyDescriptor descriptor;
+    if (!const_cast<JSObject*>(this)->getOwnPropertyDescriptor(exec, propertyName, descriptor))
         return false;
-    return !(attributes & DontEnum);
-}
-
-bool JSObject::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    JSCell* specificValue;
-    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound)
-        return true;
-    
-    // Look in the static hashtable of properties
-    const HashEntry* entry = findPropertyHashEntry(exec, propertyName);
-    if (entry) {
-        attributes = entry->attributes();
-        return true;
-    }
-    
-    return false;
+    return descriptor.enumerable();
 }
 
 bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyName, JSCell*& specificValue) const
@@ -441,9 +425,9 @@ bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyNa
     return false;
 }
 
-void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    getOwnPropertyNames(exec, propertyNames);
+    getOwnPropertyNames(exec, propertyNames, mode);
 
     if (prototype().isNull())
         return;
@@ -451,10 +435,10 @@ void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyName
     JSObject* prototype = asObject(this->prototype());
     while(1) {
         if (prototype->structure()->typeInfo().overridesGetPropertyNames()) {
-            prototype->getPropertyNames(exec, propertyNames);
+            prototype->getPropertyNames(exec, propertyNames, mode);
             break;
         }
-        prototype->getOwnPropertyNames(exec, propertyNames);
+        prototype->getOwnPropertyNames(exec, propertyNames, mode);
         JSValue nextProto = prototype->prototype();
         if (nextProto.isNull())
             break;
@@ -462,10 +446,10 @@ void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyName
     }
 }
 
-void JSObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    m_structure->getEnumerablePropertyNames(propertyNames);
-    getEnumerablePropertyNames(exec, classInfo(), propertyNames);
+    m_structure->getPropertyNames(propertyNames, mode);
+    getClassPropertyNames(exec, classInfo(), propertyNames, mode);
 }
 
 bool JSObject::toBoolean(ExecState*) const
@@ -522,19 +506,22 @@ void JSObject::removeDirect(const Identifier& propertyName)
 
 void JSObject::putDirectFunction(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirectFunction(Identifier(exec, function->name(&exec->globalData())), function, attr);
+    putDirectFunction(Identifier(exec, function->name(exec)), function, attr);
 }
 
 void JSObject::putDirectFunctionWithoutTransition(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirectFunctionWithoutTransition(Identifier(exec, function->name(&exec->globalData())), function, attr);
+    putDirectFunctionWithoutTransition(Identifier(exec, function->name(exec)), function, attr);
 }
 
 NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, JSValue* location)
 {
-    if (JSObject* getterFunction = asGetterSetter(*location)->getter())
-        slot.setGetterSlot(getterFunction);
-    else
+    if (JSObject* getterFunction = asGetterSetter(*location)->getter()) {
+        if (!structure()->isDictionary())
+            slot.setCacheableGetterSlot(this, getterFunction, offsetForLocation(location));
+        else
+            slot.setGetterSlot(getterFunction);
+    } else
         slot.setUndefined();
 }
 
@@ -599,7 +586,7 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
     if (descriptor.isEmpty())
         return true;
 
-    if (current.equalTo(descriptor))
+    if (current.equalTo(exec, descriptor))
         return true;
 
     // Filter out invalid changes
@@ -645,7 +632,7 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
                 return false;
             }
             if (!current.writable()) {
-                if (descriptor.value() || !JSValue::strictEqual(current.value(), descriptor.value())) {
+                if (descriptor.value() || !JSValue::strictEqual(exec, current.value(), descriptor.value())) {
                     if (throwException)
                         throwError(exec, TypeError, "Attempting to change value of a readonly property.");
                     return false;
@@ -667,12 +654,12 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
     // Changing the accessor functions of an existing accessor property
     ASSERT(descriptor.isAccessorDescriptor());
     if (!current.configurable()) {
-        if (descriptor.setterPresent() && !(current.setter() && JSValue::strictEqual(current.setter(), descriptor.setter()))) {
+        if (descriptor.setterPresent() && !(current.setter() && JSValue::strictEqual(exec, current.setter(), descriptor.setter()))) {
             if (throwException)
                 throwError(exec, TypeError, "Attempting to change the setter of an unconfigurable property.");
             return false;
         }
-        if (descriptor.getterPresent() && !(current.getter() && JSValue::strictEqual(current.getter(), descriptor.getter()))) {
+        if (descriptor.getterPresent() && !(current.getter() && JSValue::strictEqual(exec, current.getter(), descriptor.getter()))) {
             if (throwException)
                 throwError(exec, TypeError, "Attempting to change the getter of an unconfigurable property.");
             return false;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
index 5a89c40a8a..cd8f7f7127 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
@@ -122,8 +122,8 @@ namespace JSC {
 
         virtual bool hasInstance(ExecState*, JSValue, JSValue prototypeProperty);
 
-        virtual void getPropertyNames(ExecState*, PropertyNameArray&);
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
         virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
         virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
@@ -135,7 +135,6 @@ namespace JSC {
         virtual JSObject* toThisObject(ExecState*) const;
         virtual JSObject* unwrappedObject();
 
-        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
         bool getPropertySpecificValue(ExecState* exec, const Identifier& propertyName, JSCell*& specificFunction) const;
 
         // This get function only looks at the property map.
@@ -207,19 +206,25 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+        }
+
+        void flattenDictionaryObject()
+        {
+            m_structure->flattenDictionaryStructure(this);
         }
 
     protected:
         static const unsigned StructureFlags = 0;
 
-        void addAnonymousSlots(unsigned count);
         void putAnonymousValue(unsigned index, JSValue value)
         {
+            ASSERT(index < m_structure->anonymousSlotCount());
             *locationForOffset(index) = value;
         }
-        JSValue getAnonymousValue(unsigned index)
+        JSValue getAnonymousValue(unsigned index) const
         {
+            ASSERT(index < m_structure->anonymousSlotCount());
             return *locationForOffset(index);
         }
 
@@ -229,7 +234,7 @@ namespace JSC {
         using JSCell::isGetterSetter;
         using JSCell::toObject;
         void getObject();
-        void getString();
+        void getString(ExecState* exec);
         void isObject();
         void isString();
 #if USE(JSVALUE32)
@@ -377,7 +382,7 @@ ALWAYS_INLINE bool JSCell::fastGetOwnPropertySlot(ExecState* exec, const Identif
 
 // It may seem crazy to inline a function this large but it makes a big difference
 // since this is function very hot in variable lookup
-inline bool JSObject::getPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+ALWAYS_INLINE bool JSObject::getPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     JSObject* object = this;
     while (true) {
@@ -390,7 +395,7 @@ inline bool JSObject::getPropertySlot(ExecState* exec, const Identifier& propert
     }
 }
 
-inline bool JSObject::getPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+ALWAYS_INLINE bool JSObject::getPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     JSObject* object = this;
     while (true) {
@@ -431,12 +436,20 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
         JSCell* currentSpecificFunction;
         size_t offset = m_structure->get(propertyName, currentAttributes, currentSpecificFunction);
         if (offset != WTF::notFound) {
+            // If there is currently a specific function, and there now either isn't,
+            // or the new value is different, then despecify.
             if (currentSpecificFunction && (specificFunction != currentSpecificFunction))
                 m_structure->despecifyDictionaryFunction(propertyName);
             if (checkReadOnly && currentAttributes & ReadOnly)
                 return;
             putDirectOffset(offset, value);
-            if (!specificFunction && !currentSpecificFunction)
+            // At this point, the objects structure only has a specific value set if previously there
+            // had been one set, and if the new value being specified is the same (otherwise we would
+            // have despecified, above).  So, if currentSpecificFunction is not set, or if the new
+            // value is different (or there is no new value), then the slot now has no value - and
+            // as such it is cachable.
+            // If there was previously a value, and the new value is the same, then we cannot cache.
+            if (!currentSpecificFunction || (specificFunction != currentSpecificFunction))
                 slot.setExistingProperty(this, offset);
             return;
         }
@@ -463,7 +476,8 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
         ASSERT(offset < structure->propertyStorageCapacity());
         setStructure(structure.release());
         putDirectOffset(offset, value);
-        // See comment on setNewProperty call below.
+        // This is a new property; transitions with specific values are not currently cachable,
+        // so leave the slot in an uncachable state.
         if (!specificFunction)
             slot.setNewProperty(this, offset);
         return;
@@ -476,14 +490,28 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
         if (checkReadOnly && currentAttributes & ReadOnly)
             return;
 
-        if (currentSpecificFunction && (specificFunction != currentSpecificFunction)) {
+        // There are three possibilities here:
+        //  (1) There is an existing specific value set, and we're overwriting with *the same value*.
+        //       * Do nothing - no need to despecify, but that means we can't cache (a cached
+        //         put could write a different value). Leave the slot in an uncachable state.
+        //  (2) There is a specific value currently set, but we're writing a different value.
+        //       * First, we have to despecify.  Having done so, this is now a regular slot
+        //         with no specific value, so go ahead & cache like normal.
+        //  (3) Normal case, there is no specific value set.
+        //       * Go ahead & cache like normal.
+        if (currentSpecificFunction) {
+            // case (1) Do the put, then return leaving the slot uncachable.
+            if (specificFunction == currentSpecificFunction) {
+                putDirectOffset(offset, value);
+                return;
+            }
+            // case (2) Despecify, fall through to (3).
             setStructure(Structure::despecifyFunctionTransition(m_structure, propertyName));
-            putDirectOffset(offset, value);
-            // Function transitions are not currently cachable, so leave the slot in an uncachable state.
-            return;
         }
-        putDirectOffset(offset, value);
+
+        // case (3) set the slot, do the put, return.
         slot.setExistingProperty(this, offset);
+        putDirectOffset(offset, value);
         return;
     }
 
@@ -505,7 +533,8 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
     ASSERT(offset < structure->propertyStorageCapacity());
     setStructure(structure.release());
     putDirectOffset(offset, value);
-    // Function transitions are not currently cachable, so leave the slot in an uncachable state.
+    // This is a new property; transitions with specific values are not currently cachable,
+    // so leave the slot in an uncachable state.
     if (!specificFunction)
         slot.setNewProperty(this, offset);
 }
@@ -524,17 +553,6 @@ inline void JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
     putDirectInternal(propertyName, value, attributes, false, slot, getJSFunction(globalData, value));
 }
 
-inline void JSObject::addAnonymousSlots(unsigned count)
-{
-    size_t currentCapacity = m_structure->propertyStorageCapacity();
-    RefPtr<Structure> structure = Structure::addAnonymousSlotsTransition(m_structure, count);
-
-    if (currentCapacity != structure->propertyStorageCapacity())
-        allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
-
-    setStructure(structure.release());
-}
-
 inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
 {
     ASSERT(value);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index 6fd03446eb..a5d4da01b6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -35,6 +35,24 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSPropertyNameIterator);
 
+inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlots)
+    : JSCell(exec->globalData().propertyNameIteratorStructure.get())
+    , m_cachedStructure(0)
+    , m_numCacheableSlots(numCacheableSlots)
+    , m_jsStringsSize(propertyNameArrayData->propertyNameVector().size())
+    , m_jsStrings(new JSValue[m_jsStringsSize])
+{
+    PropertyNameArrayData::PropertyNameVector& propertyNameVector = propertyNameArrayData->propertyNameVector();
+    for (size_t i = 0; i < m_jsStringsSize; ++i)
+        m_jsStrings[i] = jsOwnedString(exec, propertyNameVector[i].ustring());
+}
+
+JSPropertyNameIterator::~JSPropertyNameIterator()
+{
+    if (m_cachedStructure)
+        m_cachedStructure->clearEnumerationCache(this);
+}
+
 JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject* o)
 {
     ASSERT(!o->structure()->enumerationCache() ||
@@ -45,7 +63,8 @@ JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject
     o->getPropertyNames(exec, propertyNames);
     size_t numCacheableSlots = 0;
     if (!o->structure()->hasNonEnumerableProperties() && !o->structure()->hasAnonymousSlots() &&
-        !o->structure()->isUncacheableDictionary() && !o->structure()->typeInfo().overridesGetPropertyNames())
+        !o->structure()->hasGetterSetterProperties() && !o->structure()->isUncacheableDictionary() &&
+        !o->structure()->typeInfo().overridesGetPropertyNames())
         numCacheableSlots = o->structure()->propertyStorageSize();
 
     JSPropertyNameIterator* jsPropertyNameIterator = new (exec) JSPropertyNameIterator(exec, propertyNames.data(), numCacheableSlots);
@@ -76,7 +95,7 @@ JSValue JSPropertyNameIterator::get(ExecState* exec, JSObject* base, size_t i)
     if (m_cachedStructure == base->structure() && m_cachedPrototypeChain == base->structure()->prototypeChain(exec))
         return identifier;
 
-    if (!base->hasProperty(exec, Identifier(exec, asString(identifier)->value())))
+    if (!base->hasProperty(exec, Identifier(exec, asString(identifier)->value(exec))))
         return JSValue();
     return identifier;
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
index 529ae8b363..01700ac212 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -47,8 +47,10 @@ namespace JSC {
         
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren));
+            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren), AnonymousSlotCount);
         }
+        
+        virtual ~JSPropertyNameIterator();
 
         virtual bool isPropertyNameIterator() const { return true; }
 
@@ -65,8 +67,13 @@ namespace JSC {
         JSValue get(ExecState*, JSObject*, size_t i);
         size_t size() { return m_jsStringsSize; }
 
-        void setCachedStructure(Structure* structure) { m_cachedStructure = structure; }
-        Structure* cachedStructure() { return m_cachedStructure; }
+        void setCachedStructure(Structure* structure)
+        {
+            ASSERT(!m_cachedStructure);
+            ASSERT(structure);
+            m_cachedStructure = structure;
+        }
+        Structure* cachedStructure() { return m_cachedStructure.get(); }
 
         void setCachedPrototypeChain(NonNullPassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
         StructureChain* cachedPrototypeChain() { return m_cachedPrototypeChain.get(); }
@@ -74,30 +81,28 @@ namespace JSC {
     private:
         JSPropertyNameIterator(ExecState*, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlot);
 
-        Structure* m_cachedStructure;
+        RefPtr<Structure> m_cachedStructure;
         RefPtr<StructureChain> m_cachedPrototypeChain;
         uint32_t m_numCacheableSlots;
         uint32_t m_jsStringsSize;
         OwnArrayPtr<JSValue> m_jsStrings;
     };
 
-inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlots)
-    : JSCell(exec->globalData().propertyNameIteratorStructure.get())
-    , m_cachedStructure(0)
-    , m_numCacheableSlots(numCacheableSlots)
-    , m_jsStringsSize(propertyNameArrayData->propertyNameVector().size())
-    , m_jsStrings(new JSValue[m_jsStringsSize])
-{
-    PropertyNameArrayData::PropertyNameVector& propertyNameVector = propertyNameArrayData->propertyNameVector();
-    for (size_t i = 0; i < m_jsStringsSize; ++i)
-        m_jsStrings[i] = jsOwnedString(exec, propertyNameVector[i].ustring());
-}
-
-inline void Structure::setEnumerationCache(JSPropertyNameIterator* enumerationCache)
-{
-    ASSERT(!isDictionary());
-    m_enumerationCache = enumerationCache;
-}
+    inline void Structure::setEnumerationCache(JSPropertyNameIterator* enumerationCache)
+    {
+        ASSERT(!isDictionary());
+        m_enumerationCache = enumerationCache;
+    }
+
+    inline void Structure::clearEnumerationCache(JSPropertyNameIterator* enumerationCache)
+    {
+        m_enumerationCache.clear(enumerationCache);
+    }
+
+    inline JSPropertyNameIterator* Structure::enumerationCache()
+    {
+        return m_enumerationCache.get();
+    }
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
index 2542878064..4d156d4756 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -57,7 +57,7 @@ namespace JSC{
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
         void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); }
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
index 20ba8684f6..815198bb78 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
@@ -25,41 +25,127 @@
 
 #include "JSGlobalObject.h"
 #include "JSObject.h"
+#include "Operations.h"
 #include "StringObject.h"
 #include "StringPrototype.h"
 
 namespace JSC {
 
+// Overview: this methods converts a JSString from holding a string in rope form
+// down to a simple UString representation.  It does so by building up the string
+// backwards, since we want to avoid recursion, we expect that the tree structure
+// representing the rope is likely imbalanced with more nodes down the left side
+// (since appending to the string is likely more common) - and as such resolving
+// in this fashion should minimize work queue size.  (If we built the queue forwards
+// we would likely have to place all of the constituent UStringImpls into the
+// Vector before performing any concatenation, but by working backwards we likely
+// only fill the queue with the number of substrings at any given level in a
+// rope-of-ropes.)
+void JSString::resolveRope(ExecState* exec) const
+{
+    ASSERT(isRope());
+
+    // Allocate the buffer to hold the final string, position initially points to the end.
+    UChar* buffer;
+    if (PassRefPtr<UStringImpl> newImpl = UStringImpl::tryCreateUninitialized(m_length, buffer))
+        m_value = newImpl;
+    else {
+        for (unsigned i = 0; i < m_fiberCount; ++i) {
+            m_other.m_fibers[i]->deref();
+            m_other.m_fibers[i] = 0;
+        }
+        m_fiberCount = 0;
+        ASSERT(!isRope());
+        ASSERT(m_value == UString());
+        throwOutOfMemoryError(exec);
+        return;
+    }
+    UChar* position = buffer + m_length;
+
+    // Start with the current Rope.
+    Vector<Rope::Fiber, 32> workQueue;
+    Rope::Fiber currentFiber;
+    for (unsigned i = 0; i < (m_fiberCount - 1); ++i)
+        workQueue.append(m_other.m_fibers[i]);
+    currentFiber = m_other.m_fibers[m_fiberCount - 1];
+    while (true) {
+        if (currentFiber->isRope()) {
+            Rope* rope = static_cast<URopeImpl*>(currentFiber);
+            // Copy the contents of the current rope into the workQueue, with the last item in 'currentFiber'
+            // (we will be working backwards over the rope).
+            unsigned fiberCountMinusOne = rope->fiberCount() - 1;
+            for (unsigned i = 0; i < fiberCountMinusOne; ++i)
+                workQueue.append(rope->fibers(i));
+            currentFiber = rope->fibers(fiberCountMinusOne);
+        } else {
+            UStringImpl* string = static_cast<UStringImpl*>(currentFiber);
+            unsigned length = string->length();
+            position -= length;
+            UStringImpl::copyChars(position, string->characters(), length);
+
+            // Was this the last item in the work queue?
+            if (workQueue.isEmpty()) {
+                // Create a string from the UChar buffer, clear the rope RefPtr.
+                ASSERT(buffer == position);
+                for (unsigned i = 0; i < m_fiberCount; ++i) {
+                    m_other.m_fibers[i]->deref();
+                    m_other.m_fibers[i] = 0;
+                }
+                m_fiberCount = 0;
+
+                ASSERT(!isRope());
+                return;
+            }
+
+            // No! - set the next item up to process.
+            currentFiber = workQueue.last();
+            workQueue.removeLast();
+        }
+    }
+}
+
+JSString* JSString::getIndexSlowCase(ExecState* exec, unsigned i)
+{
+    ASSERT(isRope());
+    resolveRope(exec);
+    // Return a safe no-value result, this should never be used, since the excetion will be thrown.
+    if (exec->exception())
+        return jsString(exec, "");
+    ASSERT(!isRope());
+    ASSERT(i < m_value.size());
+    return jsSingleCharacterSubstring(exec, m_value, i);
+}
+
 JSValue JSString::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     return const_cast<JSString*>(this);
 }
 
-bool JSString::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
+bool JSString::getPrimitiveNumber(ExecState* exec, double& number, JSValue& result)
 {
-    value = this;
-    number = m_value.toDouble();
+    result = this;
+    number = value(exec).toDouble();
     return false;
 }
 
 bool JSString::toBoolean(ExecState*) const
 {
-    return !m_value.isEmpty();
+    return m_length;
 }
 
-double JSString::toNumber(ExecState*) const
+double JSString::toNumber(ExecState* exec) const
 {
-    return m_value.toDouble();
+    return value(exec).toDouble();
 }
 
-UString JSString::toString(ExecState*) const
+UString JSString::toString(ExecState* exec) const
 {
-    return m_value;
+    return value(exec);
 }
 
-UString JSString::toThisString(ExecState*) const
+UString JSString::toThisString(ExecState* exec) const
 {
-    return m_value;
+    return value(exec);
 }
 
 JSString* JSString::toThisJSString(ExecState*)
@@ -106,14 +192,14 @@ bool JSString::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
 bool JSString::getStringPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
     if (propertyName == exec->propertyNames().length) {
-        descriptor.setDescriptor(jsNumber(exec, m_value.size()), DontEnum | DontDelete | ReadOnly);
+        descriptor.setDescriptor(jsNumber(exec, m_length), DontEnum | DontDelete | ReadOnly);
         return true;
     }
     
     bool isStrictUInt32;
     unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
-    if (isStrictUInt32 && i < static_cast<unsigned>(m_value.size())) {
-        descriptor.setDescriptor(jsSingleCharacterSubstring(exec, m_value, i), DontDelete | ReadOnly);
+    if (isStrictUInt32 && i < m_length) {
+        descriptor.setDescriptor(getIndex(exec, i), DontDelete | ReadOnly);
         return true;
     }
     
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
index 39dfe751cb..58df01321b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
@@ -41,7 +41,6 @@ namespace JSC {
 
     JSString* jsSingleCharacterString(JSGlobalData*, UChar);
     JSString* jsSingleCharacterString(ExecState*, UChar);
-    JSString* jsSingleCharacterSubstring(JSGlobalData*, const UString&, unsigned offset);
     JSString* jsSingleCharacterSubstring(ExecState*, const UString&, unsigned offset);
     JSString* jsSubstring(JSGlobalData*, const UString&, unsigned offset, unsigned length);
     JSString* jsSubstring(ExecState*, const UString&, unsigned offset, unsigned length);
@@ -59,14 +58,63 @@ namespace JSC {
     JSString* jsOwnedString(JSGlobalData*, const UString&); 
     JSString* jsOwnedString(ExecState*, const UString&); 
 
-    class JSString : public JSCell {
-        friend class JIT;
-        friend struct VPtrSet;
+    typedef void (*JSStringFinalizerCallback)(JSString*, void* context);
+    JSString* jsStringWithFinalizer(ExecState*, const UString&, JSStringFinalizerCallback callback, void* context);
 
+    class JS_EXPORTCLASS JSString : public JSCell {
     public:
-        JSString(JSGlobalData* globalData, const UString& value)
+        friend class JIT;
+        friend class JSGlobalData;
+
+        typedef URopeImpl Rope;
+
+        class RopeBuilder {
+        public:
+            RopeBuilder(unsigned fiberCount)
+                : m_index(0)
+                , m_rope(Rope::tryCreateUninitialized(fiberCount))
+            {
+            }
+
+            bool isOutOfMemory() { return !m_rope; }
+
+            void append(Rope::Fiber& fiber)
+            {
+                ASSERT(m_rope);
+                m_rope->initializeFiber(m_index, fiber);
+            }
+            void append(const UString& string)
+            {
+                ASSERT(m_rope);
+                m_rope->initializeFiber(m_index, string.rep());
+            }
+            void append(JSString* jsString)
+            {
+                if (jsString->isRope()) {
+                    for (unsigned i = 0; i < jsString->m_fiberCount; ++i)
+                        append(jsString->m_other.m_fibers[i]);
+                } else
+                    append(jsString->string());
+            }
+
+            PassRefPtr<Rope> release()
+            {
+                ASSERT(m_index == m_rope->fiberCount());
+                return m_rope.release();
+            }
+
+            unsigned length() { return m_rope->length(); }
+
+        private:
+            unsigned m_index;
+            RefPtr<Rope> m_rope;
+        };
+
+        ALWAYS_INLINE JSString(JSGlobalData* globalData, const UString& value)
             : JSCell(globalData->stringStructure.get())
+            , m_length(value.size())
             , m_value(value)
+            , m_fiberCount(0)
         {
             Heap::heap(this)->reportExtraMemoryCost(value.cost());
         }
@@ -74,33 +122,173 @@ namespace JSC {
         enum HasOtherOwnerType { HasOtherOwner };
         JSString(JSGlobalData* globalData, const UString& value, HasOtherOwnerType)
             : JSCell(globalData->stringStructure.get())
+            , m_length(value.size())
             , m_value(value)
+            , m_fiberCount(0)
         {
         }
         JSString(JSGlobalData* globalData, PassRefPtr<UString::Rep> value, HasOtherOwnerType)
             : JSCell(globalData->stringStructure.get())
+            , m_length(value->length())
             , m_value(value)
+            , m_fiberCount(0)
         {
         }
-        
-        const UString& value() const { return m_value; }
+        JSString(JSGlobalData* globalData, PassRefPtr<Rope> rope)
+            : JSCell(globalData->stringStructure.get())
+            , m_length(rope->length())
+            , m_fiberCount(1)
+        {
+            m_other.m_fibers[0] = rope.releaseRef();
+        }
+        // This constructor constructs a new string by concatenating s1 & s2.
+        // This should only be called with fiberCount <= 3.
+        JSString(JSGlobalData* globalData, unsigned fiberCount, JSString* s1, JSString* s2)
+            : JSCell(globalData->stringStructure.get())
+            , m_length(s1->length() + s2->length())
+            , m_fiberCount(fiberCount)
+        {
+            ASSERT(fiberCount <= s_maxInternalRopeLength);
+            unsigned index = 0;
+            appendStringInConstruct(index, s1);
+            appendStringInConstruct(index, s2);
+            ASSERT(fiberCount == index);
+        }
+        // This constructor constructs a new string by concatenating s1 & s2.
+        // This should only be called with fiberCount <= 3.
+        JSString(JSGlobalData* globalData, unsigned fiberCount, JSString* s1, const UString& u2)
+            : JSCell(globalData->stringStructure.get())
+            , m_length(s1->length() + u2.size())
+            , m_fiberCount(fiberCount)
+        {
+            ASSERT(fiberCount <= s_maxInternalRopeLength);
+            unsigned index = 0;
+            appendStringInConstruct(index, s1);
+            appendStringInConstruct(index, u2);
+            ASSERT(fiberCount == index);
+        }
+        // This constructor constructs a new string by concatenating s1 & s2.
+        // This should only be called with fiberCount <= 3.
+        JSString(JSGlobalData* globalData, unsigned fiberCount, const UString& u1, JSString* s2)
+            : JSCell(globalData->stringStructure.get())
+            , m_length(u1.size() + s2->length())
+            , m_fiberCount(fiberCount)
+        {
+            ASSERT(fiberCount <= s_maxInternalRopeLength);
+            unsigned index = 0;
+            appendStringInConstruct(index, u1);
+            appendStringInConstruct(index, s2);
+            ASSERT(fiberCount == index);
+        }
+        // This constructor constructs a new string by concatenating v1, v2 & v3.
+        // This should only be called with fiberCount <= 3 ... which since every
+        // value must require a fiberCount of at least one implies that the length
+        // for each value must be exactly 1!
+        JSString(ExecState* exec, JSValue v1, JSValue v2, JSValue v3)
+            : JSCell(exec->globalData().stringStructure.get())
+            , m_length(0)
+            , m_fiberCount(s_maxInternalRopeLength)
+        {
+            unsigned index = 0;
+            appendValueInConstructAndIncrementLength(exec, index, v1);
+            appendValueInConstructAndIncrementLength(exec, index, v2);
+            appendValueInConstructAndIncrementLength(exec, index, v3);
+            ASSERT(index == s_maxInternalRopeLength);
+        }
+
+        JSString(JSGlobalData* globalData, const UString& value, JSStringFinalizerCallback finalizer, void* context)
+            : JSCell(globalData->stringStructure.get())
+            , m_length(value.size())
+            , m_value(value)
+            , m_fiberCount(0)
+        {
+            // nasty hack because we can't union non-POD types
+            m_other.m_finalizerCallback = finalizer;
+            m_other.m_finalizerContext = context;
+            Heap::heap(this)->reportExtraMemoryCost(value.cost());
+        }
+
+        ~JSString()
+        {
+            ASSERT(vptr() == JSGlobalData::jsStringVPtr);
+            for (unsigned i = 0; i < m_fiberCount; ++i)
+                m_other.m_fibers[i]->deref();
+
+            if (!m_fiberCount && m_other.m_finalizerCallback)
+                m_other.m_finalizerCallback(this, m_other.m_finalizerContext);
+        }
+
+        const UString& value(ExecState* exec) const
+        {
+            if (isRope())
+                resolveRope(exec);
+            return m_value;
+        }
+        const UString tryGetValue() const
+        {
+            // If this is a rope, m_value should be null -
+            // if this is not a rope, m_value should be non-null.
+            ASSERT(isRope() == m_value.isNull());
+            return m_value;
+        }
+        unsigned length() { return m_length; }
 
         bool getStringPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         bool getStringPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
         bool getStringPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor&);
 
-        bool canGetIndex(unsigned i) { return i < static_cast<unsigned>(m_value.size()); }
-        JSString* getIndex(JSGlobalData*, unsigned);
+        bool canGetIndex(unsigned i) { return i < m_length; }
+        JSString* getIndex(ExecState*, unsigned);
+        JSString* getIndexSlowCase(ExecState*, unsigned);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion), AnonymousSlotCount); }
 
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
         JSString(VPtrStealingHackType) 
             : JSCell(0)
+            , m_fiberCount(0)
         {
         }
 
+        void resolveRope(ExecState*) const;
+
+        void appendStringInConstruct(unsigned& index, const UString& string)
+        {
+            UStringImpl* impl = string.rep();
+            impl->ref();
+            m_other.m_fibers[index++] = impl;
+        }
+
+        void appendStringInConstruct(unsigned& index, JSString* jsString)
+        {
+            if (jsString->isRope()) {
+                for (unsigned i = 0; i < jsString->m_fiberCount; ++i) {
+                    Rope::Fiber fiber = jsString->m_other.m_fibers[i];
+                    fiber->ref();
+                    m_other.m_fibers[index++] = fiber;
+                }
+            } else
+                appendStringInConstruct(index, jsString->string());
+        }
+
+        void appendValueInConstructAndIncrementLength(ExecState* exec, unsigned& index, JSValue v)
+        {
+            if (v.isString()) {
+                ASSERT(asCell(v)->isString());
+                JSString* s = static_cast<JSString*>(asCell(v));
+                ASSERT(s->fiberCount() == 1);
+                appendStringInConstruct(index, s);
+                m_length += s->length();
+            } else {
+                UString u(v.toString(exec));
+                UStringImpl* impl = u.rep();
+                impl->ref();
+                m_other.m_fibers[index++] = impl;
+                m_length += u.size();
+            }
+        }
+
         virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
         virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
@@ -117,11 +305,48 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
-        UString m_value;
+        static const unsigned s_maxInternalRopeLength = 3;
+
+        // A string is represented either by a UString or a Rope.
+        unsigned m_length;
+        mutable UString m_value;
+        mutable unsigned m_fiberCount;
+        // This structure exists to support a temporary workaround for a GC issue.
+        struct JSStringFinalizerStruct {
+            JSStringFinalizerStruct() : m_finalizerCallback(0) {}
+            union {
+                mutable Rope::Fiber m_fibers[s_maxInternalRopeLength];
+                struct {
+                    JSStringFinalizerCallback m_finalizerCallback;
+                    void* m_finalizerContext;
+                };
+            };
+        } m_other;
+
+        bool isRope() const { return m_fiberCount; }
+        UString& string() { ASSERT(!isRope()); return m_value; }
+        unsigned fiberCount() { return m_fiberCount ? m_fiberCount : 1; }
+
+        friend JSValue jsString(ExecState* exec, JSString* s1, JSString* s2);
+        friend JSValue jsString(ExecState* exec, const UString& u1, JSString* s2);
+        friend JSValue jsString(ExecState* exec, JSString* s1, const UString& u2);
+        friend JSValue jsString(ExecState* exec, Register* strings, unsigned count);
+        friend JSValue jsString(ExecState* exec, JSValue thisValue, const ArgList& args);
+        friend JSString* jsStringWithFinalizer(ExecState*, const UString&, JSStringFinalizerCallback callback, void* context);
     };
 
     JSString* asString(JSValue);
 
+    // When an object is created from a different DLL, MSVC changes vptr to a "local" one right after invoking a constructor,
+    // see <http://groups.google.com/group/microsoft.public.vc.language/msg/55cdcefeaf770212>.
+    // This breaks isJSString(), and we don't need that hack anyway, so we change vptr back to primary one.
+    // The below function must be called by any inline function that invokes a JSString constructor.
+#if COMPILER(MSVC) && !defined(BUILDING_JavaScriptCore)
+    inline JSString* fixupVPtr(JSGlobalData* globalData, JSString* string) { string->setVPtr(globalData->jsStringVPtr); return string; }
+#else
+    inline JSString* fixupVPtr(JSGlobalData*, JSString* string) { return string; }
+#endif
+
     inline JSString* asString(JSValue value)
     {
         ASSERT(asCell(value)->isString());
@@ -137,16 +362,17 @@ namespace JSC {
     {
         if (c <= 0xFF)
             return globalData->smallStrings.singleCharacterString(globalData, c);
-        return new (globalData) JSString(globalData, UString(&c, 1));
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, UString(&c, 1)));
     }
 
-    inline JSString* jsSingleCharacterSubstring(JSGlobalData* globalData, const UString& s, unsigned offset)
+    inline JSString* jsSingleCharacterSubstring(ExecState* exec, const UString& s, unsigned offset)
     {
+        JSGlobalData* globalData = &exec->globalData();
         ASSERT(offset < static_cast<unsigned>(s.size()));
         UChar c = s.data()[offset];
         if (c <= 0xFF)
             return globalData->smallStrings.singleCharacterString(globalData, c);
-        return new (globalData) JSString(globalData, UString::Rep::create(s.rep(), offset, 1));
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, UString(UString::Rep::create(s.rep(), offset, 1))));
     }
 
     inline JSString* jsNontrivialString(JSGlobalData* globalData, const char* s)
@@ -154,19 +380,22 @@ namespace JSC {
         ASSERT(s);
         ASSERT(s[0]);
         ASSERT(s[1]);
-        return new (globalData) JSString(globalData, s);
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, s));
     }
 
     inline JSString* jsNontrivialString(JSGlobalData* globalData, const UString& s)
     {
         ASSERT(s.size() > 1);
-        return new (globalData) JSString(globalData, s);
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, s));
     }
 
-    inline JSString* JSString::getIndex(JSGlobalData* globalData, unsigned i)
+    inline JSString* JSString::getIndex(ExecState* exec, unsigned i)
     {
         ASSERT(canGetIndex(i));
-        return jsSingleCharacterSubstring(globalData, m_value, i);
+        if (isRope())
+            return getIndexSlowCase(exec, i);
+        ASSERT(i < m_value.size());
+        return jsSingleCharacterSubstring(exec, value(exec), i);
     }
 
     inline JSString* jsString(JSGlobalData* globalData, const UString& s)
@@ -179,9 +408,16 @@ namespace JSC {
             if (c <= 0xFF)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
-        return new (globalData) JSString(globalData, s);
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, s));
     }
-        
+
+    inline JSString* jsStringWithFinalizer(ExecState* exec, const UString& s, JSStringFinalizerCallback callback, void* context)
+    {
+        ASSERT(s.size() && (s.size() > 1 || s.data()[0] > 0xFF));
+        JSGlobalData* globalData = &exec->globalData();
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, s, callback, context));
+    }
+
     inline JSString* jsSubstring(JSGlobalData* globalData, const UString& s, unsigned offset, unsigned length)
     {
         ASSERT(offset <= static_cast<unsigned>(s.size()));
@@ -194,7 +430,7 @@ namespace JSC {
             if (c <= 0xFF)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
-        return new (globalData) JSString(globalData, UString::Rep::create(s.rep(), offset, length));
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, UString(UString::Rep::create(s.rep(), offset, length)), JSString::HasOtherOwner));
     }
 
     inline JSString* jsOwnedString(JSGlobalData* globalData, const UString& s)
@@ -207,13 +443,12 @@ namespace JSC {
             if (c <= 0xFF)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
-        return new (globalData) JSString(globalData, s, JSString::HasOtherOwner);
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, s, JSString::HasOtherOwner));
     }
 
     inline JSString* jsEmptyString(ExecState* exec) { return jsEmptyString(&exec->globalData()); }
     inline JSString* jsString(ExecState* exec, const UString& s) { return jsString(&exec->globalData(), s); }
     inline JSString* jsSingleCharacterString(ExecState* exec, UChar c) { return jsSingleCharacterString(&exec->globalData(), c); }
-    inline JSString* jsSingleCharacterSubstring(ExecState* exec, const UString& s, unsigned offset) { return jsSingleCharacterSubstring(&exec->globalData(), s, offset); }
     inline JSString* jsSubstring(ExecState* exec, const UString& s, unsigned offset, unsigned length) { return jsSubstring(&exec->globalData(), s, offset, length); }
     inline JSString* jsNontrivialString(ExecState* exec, const UString& s) { return jsNontrivialString(&exec->globalData(), s); }
     inline JSString* jsNontrivialString(ExecState* exec, const char* s) { return jsNontrivialString(&exec->globalData(), s); }
@@ -222,14 +457,14 @@ namespace JSC {
     ALWAYS_INLINE bool JSString::getStringPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
     {
         if (propertyName == exec->propertyNames().length) {
-            slot.setValue(jsNumber(exec, m_value.size()));
+            slot.setValue(jsNumber(exec, m_length));
             return true;
         }
 
         bool isStrictUInt32;
         unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
-        if (isStrictUInt32 && i < static_cast<unsigned>(m_value.size())) {
-            slot.setValue(jsSingleCharacterSubstring(exec, m_value, i));
+        if (isStrictUInt32 && i < m_length) {
+            slot.setValue(getIndex(exec, i));
             return true;
         }
 
@@ -238,8 +473,8 @@ namespace JSC {
         
     ALWAYS_INLINE bool JSString::getStringPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
     {
-        if (propertyName < static_cast<unsigned>(m_value.size())) {
-            slot.setValue(jsSingleCharacterSubstring(exec, m_value, propertyName));
+        if (propertyName < m_length) {
+            slot.setValue(getIndex(exec, propertyName));
             return true;
         }
 
@@ -258,7 +493,7 @@ namespace JSC {
     inline UString JSValue::toString(ExecState* exec) const
     {
         if (isString())
-            return static_cast<JSString*>(asCell())->value();
+            return static_cast<JSString*>(asCell())->value(exec);
         if (isInt32())
             return exec->globalData().numericStrings.add(asInt32());
         if (isDouble())
@@ -275,6 +510,26 @@ namespace JSC {
         return asCell()->toString(exec);
     }
 
+    inline UString JSValue::toPrimitiveString(ExecState* exec) const
+    {
+        if (isString())
+            return static_cast<JSString*>(asCell())->value(exec);
+        if (isInt32())
+            return exec->globalData().numericStrings.add(asInt32());
+        if (isDouble())
+            return exec->globalData().numericStrings.add(asDouble());
+        if (isTrue())
+            return "true";
+        if (isFalse())
+            return "false";
+        if (isNull())
+            return "null";
+        if (isUndefined())
+            return "undefined";
+        ASSERT(isCell());
+        return asCell()->toPrimitive(exec, NoPreference).toString(exec);
+    }
+
 } // namespace JSC
 
 #endif // JSString_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStringBuilder.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStringBuilder.h
new file mode 100644
index 0000000000..8f208a1f31
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStringBuilder.h
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSStringBuilder_h
+#define JSStringBuilder_h
+
+#include "ExceptionHelpers.h"
+#include "JSString.h"
+#include "Vector.h"
+
+namespace JSC {
+
+class JSStringBuilder {
+public:
+    JSStringBuilder()
+        : m_okay(true)
+    {
+    }
+
+    void append(const UChar u)
+    {
+        m_okay &= buffer.tryAppend(&u, 1);
+    }
+
+    void append(const char* str)
+    {
+        append(str, strlen(str));
+    }
+
+    void append(const char* str, size_t len)
+    {
+        m_okay &= buffer.tryReserveCapacity(buffer.size() + len);
+        for (size_t i = 0; i < len; i++) {
+            UChar u = static_cast<unsigned char>(str[i]);
+            m_okay &= buffer.tryAppend(&u, 1);
+        }
+    }
+
+    void append(const UChar* str, size_t len)
+    {
+        m_okay &= buffer.tryAppend(str, len);
+    }
+
+    void append(const UString& str)
+    {
+        m_okay &= buffer.tryAppend(str.data(), str.size());
+    }
+
+    JSValue build(ExecState* exec)
+    {
+        if (!m_okay)
+            return throwOutOfMemoryError(exec);
+        buffer.shrinkToFit();
+        if (!buffer.data())
+            return throwOutOfMemoryError(exec);
+        return jsString(exec, UString::adopt(buffer));
+    }
+
+protected:
+    Vector<UChar, 64> buffer;
+    bool m_okay;
+};
+
+template<typename StringType1, typename StringType2>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2)
+{
+    PassRefPtr<UStringImpl> result = tryMakeString(string1, string2);
+    if (!result)
+        return throwOutOfMemoryError(exec);
+    return jsNontrivialString(exec, result);
+}
+
+template<typename StringType1, typename StringType2, typename StringType3>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3)
+{
+    PassRefPtr<UStringImpl> result = tryMakeString(string1, string2, string3);
+    if (!result)
+        return throwOutOfMemoryError(exec);
+    return jsNontrivialString(exec, result);
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
+{
+    PassRefPtr<UStringImpl> result = tryMakeString(string1, string2, string3, string4);
+    if (!result)
+        return throwOutOfMemoryError(exec);
+    return jsNontrivialString(exec, result);
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
+{
+    PassRefPtr<UStringImpl> result = tryMakeString(string1, string2, string3, string4, string5);
+    if (!result)
+        return throwOutOfMemoryError(exec);
+    return jsNontrivialString(exec, result);
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
+{
+    PassRefPtr<UStringImpl> result = tryMakeString(string1, string2, string3, string4, string5, string6);
+    if (!result)
+        return throwOutOfMemoryError(exec);
+    return jsNontrivialString(exec, result);
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
index 7c8960071d..e225bc72ce 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
@@ -50,6 +50,8 @@ namespace JSC {
         TypeInfo(JSType type, unsigned flags = 0)
             : m_type(type)
         {
+            ASSERT(flags <= 0xFF);
+            ASSERT(type <= 0xFF);
             // ImplementsDefaultHasInstance means (ImplementsHasInstance & !OverridesHasInstance)
             if ((flags & (ImplementsHasInstance | OverridesHasInstance)) == ImplementsHasInstance)
                 m_flags = flags | ImplementsDefaultHasInstance;
@@ -57,7 +59,7 @@ namespace JSC {
                 m_flags = flags;
         }
 
-        JSType type() const { return m_type; }
+        JSType type() const { return (JSType)m_type; }
 
         bool masqueradesAsUndefined() const { return m_flags & MasqueradesAsUndefined; }
         bool implementsHasInstance() const { return m_flags & ImplementsHasInstance; }
@@ -69,8 +71,8 @@ namespace JSC {
         unsigned flags() const { return m_flags; }
 
     private:
-        JSType m_type;
-        unsigned m_flags;
+        unsigned char m_type;
+        unsigned char m_flags;
     };
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
index bafb85b4e8..502312caea 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
@@ -174,7 +174,7 @@ uint32_t toUInt32SlowCase(double d, bool& ok)
 
 NEVER_INLINE double nonInlineNaN()
 {
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
     return nanval();
 #else
     return std::numeric_limits<double>::quiet_NaN();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
index 1063cdcd52..6da921f307 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
@@ -80,6 +80,7 @@ namespace JSC {
         enum JSUndefinedTag { JSUndefined };
         enum JSTrueTag { JSTrue };
         enum JSFalseTag { JSFalse };
+        enum EncodeAsDoubleTag { EncodeAsDouble };
 
         JSValue();
         JSValue(JSNullTag);
@@ -90,6 +91,7 @@ namespace JSC {
         JSValue(const JSCell* ptr);
 
         // Numbers
+        JSValue(EncodeAsDoubleTag, ExecState*, double);
         JSValue(ExecState*, double);
         JSValue(ExecState*, char);
         JSValue(ExecState*, unsigned char);
@@ -135,8 +137,8 @@ namespace JSC {
         bool getBoolean() const; // false if not a boolean
         bool getNumber(double&) const;
         double uncheckedGetNumber() const;
-        bool getString(UString&) const;
-        UString getString() const; // null string if not a string
+        bool getString(ExecState* exec, UString&) const;
+        UString getString(ExecState* exec) const; // null string if not a string
         JSObject* getObject() const; // 0 if not an object
 
         CallType getCallData(CallData&);
@@ -156,6 +158,7 @@ namespace JSC {
         double toNumber(ExecState*) const;
         JSValue toJSNumber(ExecState*) const; // Fast path for when you expect that the value is an immediate number.
         UString toString(ExecState*) const;
+        UString toPrimitiveString(ExecState*) const;
         JSObject* toObject(ExecState*) const;
 
         // Integer conversions.
@@ -166,6 +169,10 @@ namespace JSC {
         uint32_t toUInt32(ExecState*) const;
         uint32_t toUInt32(ExecState*, bool& ok) const;
 
+#if ENABLE(JSC_ZOMBIES)
+        bool isZombie() const;
+#endif
+
         // Floating point conversions (this is a convenience method for webcore;
         // signle precision float is not a representation used in JS or JSC).
         float toFloat(ExecState* exec) const { return static_cast<float>(toNumber(exec)); }
@@ -186,9 +193,9 @@ namespace JSC {
         static bool equal(ExecState* exec, JSValue v1, JSValue v2);
         static bool equalSlowCase(ExecState* exec, JSValue v1, JSValue v2);
         static bool equalSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2);
-        static bool strictEqual(JSValue v1, JSValue v2);
-        static bool strictEqualSlowCase(JSValue v1, JSValue v2);
-        static bool strictEqualSlowCaseInline(JSValue v1, JSValue v2);
+        static bool strictEqual(ExecState* exec, JSValue v1, JSValue v2);
+        static bool strictEqualSlowCase(ExecState* exec, JSValue v1, JSValue v2);
+        static bool strictEqualSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2);
 
         JSValue getJSNumber(); // JSValue() if this is not a JSNumber or number object
 
@@ -228,7 +235,7 @@ namespace JSC {
         union {
             EncodedJSValue asEncodedJSValue;
             double asDouble;
-#if PLATFORM(BIG_ENDIAN)
+#if CPU(BIG_ENDIAN)
             struct {
                 int32_t tag;
                 int32_t payload;
@@ -279,6 +286,11 @@ namespace JSC {
         return b ? JSValue(JSValue::JSTrue) : JSValue(JSValue::JSFalse);
     }
 
+    ALWAYS_INLINE JSValue jsDoubleNumber(ExecState* exec, double d)
+    {
+        return JSValue(JSValue::EncodeAsDouble, exec, d);
+    }
+
     ALWAYS_INLINE JSValue jsNumber(ExecState* exec, double d)
     {
         return JSValue(exec, d);
@@ -431,6 +443,9 @@ namespace JSC {
     {
         JSValue v;
         v.u.asEncodedJSValue = encodedJSValue;
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!v.isZombie());
+#endif
         return v;
     }
 
@@ -477,6 +492,9 @@ namespace JSC {
         else
             u.asBits.tag = EmptyValueTag;
         u.asBits.payload = reinterpret_cast<int32_t>(ptr);
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::JSValue(const JSCell* ptr)
@@ -486,6 +504,9 @@ namespace JSC {
         else
             u.asBits.tag = EmptyValueTag;
         u.asBits.payload = reinterpret_cast<int32_t>(const_cast<JSCell*>(ptr));
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::operator bool() const
@@ -583,6 +604,11 @@ namespace JSC {
         return reinterpret_cast<JSCell*>(u.asBits.payload);
     }
 
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState*, double d)
+    {
+        u.asDouble = d;
+    }
+
     inline JSValue::JSValue(ExecState* exec, double d)
     {
         const int32_t asInt32 = static_cast<int32_t>(d);
@@ -781,11 +807,17 @@ namespace JSC {
     inline JSValue::JSValue(JSCell* ptr)
         : m_ptr(ptr)
     {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::JSValue(const JSCell* ptr)
         : m_ptr(const_cast<JSCell*>(ptr))
     {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::operator bool() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp
index 6586393428..73650016a9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp
@@ -42,25 +42,15 @@ bool JSVariableObject::deleteProperty(ExecState* exec, const Identifier& propert
     return JSObject::deleteProperty(exec, propertyName);
 }
 
-void JSVariableObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSVariableObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     SymbolTable::const_iterator end = symbolTable().end();
     for (SymbolTable::const_iterator it = symbolTable().begin(); it != end; ++it) {
-        if (!(it->second.getAttributes() & DontEnum))
+        if (!(it->second.getAttributes() & DontEnum) || (mode == IncludeDontEnumProperties))
             propertyNames.add(Identifier(exec, it->first.get()));
     }
     
-    JSObject::getOwnPropertyNames(exec, propertyNames);
-}
-
-bool JSVariableObject::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    SymbolTableEntry entry = symbolTable().get(propertyName.ustring().rep());
-    if (!entry.isNull()) {
-        attributes = entry.getAttributes() | DontDelete;
-        return true;
-    }
-    return JSObject::getPropertyAttributes(exec, propertyName, attributes);
+    JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 bool JSVariableObject::isVariableObject() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
index d8b1479c03..6c679ce072 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
@@ -49,18 +49,16 @@ namespace JSC {
         virtual void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes) = 0;
 
         virtual bool deleteProperty(ExecState*, const Identifier&);
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
         
         virtual bool isVariableObject() const;
         virtual bool isDynamicScope() const = 0;
 
-        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
-
         Register& registerAt(int index) const { return d->registers[index]; }
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
         
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
index 191ff3b910..f19cd30c85 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
@@ -38,9 +38,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
+    protected:
+        static const unsigned AnonymousSlotCount = 1 + JSObject::AnonymousSlotCount;
+
     private:
         virtual void markChildren(MarkStack&);
         
@@ -50,7 +53,6 @@ namespace JSC {
     inline JSWrapperObject::JSWrapperObject(NonNullPassRefPtr<Structure> structure)
         : JSObject(structure)
     {
-        addAnonymousSlots(1);
         putAnonymousValue(0, jsNull());
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.cpp
index 483dce002f..072d29b6af 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,32 +23,26 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef WREC_h
-#define WREC_h
+#include "config.h"
+#include "JSZombie.h"
+#include "ClassInfo.h"
 
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include <wtf/unicode/Unicode.h>
-
-#if COMPILER(GCC) && PLATFORM(X86)
-#define WREC_CALL __attribute__ ((regparm (3)))
-#else
-#define WREC_CALL
-#endif
+#if ENABLE(JSC_ZOMBIES)
 
 namespace JSC {
-    class Interpreter;
-    class UString;
-}
 
-namespace JSC { namespace WREC {
+const ClassInfo JSZombie::s_info = { "Zombie", 0, 0, 0 };
 
-    typedef int (*CompiledRegExp)(const UChar* input, unsigned start, unsigned length, int* output) WREC_CALL;
-
-} } // namespace JSC::WREC
+Structure* JSZombie::leakedZombieStructure() {
+    static Structure* structure = 0;
+    if (!structure) {
+        Structure::startIgnoringLeaks();
+        structure = Structure::create(jsNull(), TypeInfo(UnspecifiedType)).releaseRef();
+        Structure::stopIgnoringLeaks();
+    }
+    return structure;
+}
 
-#endif // ENABLE(WREC)
+}
 
-#endif // WREC_h
+#endif // ENABLE(JSC_ZOMBIES)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.h
new file mode 100644
index 0000000000..8b33ea61bf
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSZombie_h
+#define JSZombie_h
+
+#include "JSCell.h"
+
+#if ENABLE(JSC_ZOMBIES)
+namespace JSC {
+
+class JSZombie : public JSCell {
+public:
+    JSZombie(const ClassInfo* oldInfo, Structure* structure)
+        : JSCell(structure)
+        , m_oldInfo(oldInfo)
+    {
+    }
+    virtual bool isZombie() const { return true; }
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static Structure* leakedZombieStructure();
+
+    virtual bool isGetterSetter() const { ASSERT_NOT_REACHED(); return false; }
+    virtual bool isAPIValueWrapper() const { ASSERT_NOT_REACHED(); return false; }
+    virtual bool isPropertyNameIterator() const { ASSERT_NOT_REACHED(); return false; }
+    virtual CallType getCallData(CallData&) { ASSERT_NOT_REACHED(); return CallTypeNone; }
+    virtual ConstructType getConstructData(ConstructData&) { ASSERT_NOT_REACHED(); return ConstructTypeNone; }
+    virtual bool getUInt32(uint32_t&) const { ASSERT_NOT_REACHED(); return false; }
+    virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const { ASSERT_NOT_REACHED(); return jsNull(); }
+    virtual bool getPrimitiveNumber(ExecState*, double&, JSValue&) { ASSERT_NOT_REACHED(); return false; }
+    virtual bool toBoolean(ExecState*) const { ASSERT_NOT_REACHED(); return false; }
+    virtual double toNumber(ExecState*) const { ASSERT_NOT_REACHED(); return 0.0; }
+    virtual UString toString(ExecState*) const { ASSERT_NOT_REACHED(); return ""; }
+    virtual JSObject* toObject(ExecState*) const { ASSERT_NOT_REACHED(); return 0; }
+    virtual void markChildren(MarkStack&) { ASSERT_NOT_REACHED(); }
+    virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&) { ASSERT_NOT_REACHED(); }
+    virtual void put(ExecState*, unsigned, JSValue) { ASSERT_NOT_REACHED(); }
+    virtual bool deleteProperty(ExecState*, const Identifier&) { ASSERT_NOT_REACHED(); return false; }
+    virtual bool deleteProperty(ExecState*, unsigned) { ASSERT_NOT_REACHED(); return false; }
+    virtual JSObject* toThisObject(ExecState*) const { ASSERT_NOT_REACHED(); return 0; }
+    virtual UString toThisString(ExecState*) const { ASSERT_NOT_REACHED(); return ""; }
+    virtual JSString* toThisJSString(ExecState*) { ASSERT_NOT_REACHED(); return 0; }
+    virtual JSValue getJSNumber() { ASSERT_NOT_REACHED(); return jsNull(); }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
+    virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
+    
+    static const ClassInfo s_info;
+private:
+    const ClassInfo* m_oldInfo;
+};
+
+}
+
+#endif // ENABLE(JSC_ZOMBIES)
+
+#endif // JSZombie_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
index d242282f39..cc33bae187 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
@@ -29,6 +29,7 @@
 #include "JSArray.h"
 #include "JSString.h"
 #include "Lexer.h"
+#include "StringBuilder.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/dtoa.h>
 
@@ -134,48 +135,48 @@ template <LiteralParser::ParserMode mode> inline LiteralParser::TokenType Litera
 {
     ++m_ptr;
     const UChar* runStart;
-    token.stringToken = UString();
+    StringBuilder builder;
     do {
         runStart = m_ptr;
         while (m_ptr < m_end && isSafeStringCharacter<mode>(*m_ptr))
             ++m_ptr;
         if (runStart < m_ptr)
-            token.stringToken.append(runStart, m_ptr - runStart);
+            builder.append(runStart, m_ptr - runStart);
         if ((mode == StrictJSON) && m_ptr < m_end && *m_ptr == '\\') {
             ++m_ptr;
             if (m_ptr >= m_end)
                 return TokError;
             switch (*m_ptr) {
                 case '"':
-                    token.stringToken.append('"');
+                    builder.append('"');
                     m_ptr++;
                     break;
                 case '\\':
-                    token.stringToken.append('\\');
+                    builder.append('\\');
                     m_ptr++;
                     break;
                 case '/':
-                    token.stringToken.append('/');
+                    builder.append('/');
                     m_ptr++;
                     break;
                 case 'b':
-                    token.stringToken.append('\b');
+                    builder.append('\b');
                     m_ptr++;
                     break;
                 case 'f':
-                    token.stringToken.append('\f');
+                    builder.append('\f');
                     m_ptr++;
                     break;
                 case 'n':
-                    token.stringToken.append('\n');
+                    builder.append('\n');
                     m_ptr++;
                     break;
                 case 'r':
-                    token.stringToken.append('\r');
+                    builder.append('\r');
                     m_ptr++;
                     break;
                 case 't':
-                    token.stringToken.append('\t');
+                    builder.append('\t');
                     m_ptr++;
                     break;
 
@@ -186,7 +187,7 @@ template <LiteralParser::ParserMode mode> inline LiteralParser::TokenType Litera
                         if (!isASCIIHexDigit(m_ptr[i]))
                             return TokError;
                     }
-                    token.stringToken.append(JSC::Lexer::convertUnicode(m_ptr[1], m_ptr[2], m_ptr[3], m_ptr[4]));
+                    builder.append(JSC::Lexer::convertUnicode(m_ptr[1], m_ptr[2], m_ptr[3], m_ptr[4]));
                     m_ptr += 5;
                     break;
 
@@ -199,6 +200,7 @@ template <LiteralParser::ParserMode mode> inline LiteralParser::TokenType Litera
     if (m_ptr >= m_end || *m_ptr != '"')
         return TokError;
 
+    token.stringToken = builder.build();
     token.type = TokString;
     token.end = ++m_ptr;
     return TokString;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp
index 8359ff7f66..4e9e086029 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp
@@ -34,7 +34,7 @@ void HashTable::createTable(JSGlobalData* globalData) const
         entries[i].setKey(0);
     for (int i = 0; values[i].key; ++i) {
         UString::Rep* identifier = Identifier::add(globalData, values[i].key).releaseRef();
-        int hashIndex = identifier->computedHash() & compactHashSizeMask;
+        int hashIndex = identifier->existingHash() & compactHashSizeMask;
         HashEntry* entry = &entries[hashIndex];
 
         if (entry->key()) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
index 4d706894aa..995aeee0e4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
@@ -144,7 +144,7 @@ namespace JSC {
         {
             ASSERT(table);
 
-            const HashEntry* entry = &table[identifier.ustring().rep()->computedHash() & compactHashSizeMask];
+            const HashEntry* entry = &table[identifier.ustring().rep()->existingHash() & compactHashSizeMask];
 
             if (!entry->key())
                 return 0;
@@ -181,7 +181,7 @@ namespace JSC {
         if (entry->attributes() & Function)
             setUpStaticFunctionSlot(exec, entry, thisObj, propertyName, slot);
         else
-            slot.setCustom(thisObj, entry->propertyGetter());
+            slot.setCacheableCustom(thisObj, entry->propertyGetter());
 
         return true;
     }
@@ -258,7 +258,7 @@ namespace JSC {
 
         ASSERT(!(entry->attributes() & Function));
 
-        slot.setCustom(thisObj, entry->propertyGetter());
+        slot.setCacheableCustom(thisObj, entry->propertyGetter());
         return true;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
index a114ae08c4..c551bac631 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
@@ -153,7 +153,7 @@ namespace JSC {
                 ASSERT(0 == (size % MarkStack::pageSize()));
                 if (size == m_allocated)
                     return;
-#if PLATFORM(WIN_OS) || PLATFORM(SYMBIAN)
+#if OS(WINDOWS) || OS(SYMBIAN) || PLATFORM(BREWMP)
                 // We cannot release a part of a region with VirtualFree.  To get around this,
                 // we'll release the entire region and reallocate the size that we want.
                 releaseStack(m_data, m_allocated);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackNone.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackNone.cpp
new file mode 100644
index 0000000000..b1ff48b44f
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackNone.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Company 100, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "MarkStack.h"
+
+#include "FastMalloc.h"
+
+namespace JSC {
+
+void MarkStack::initializePagesize()
+{
+    MarkStack::s_pageSize = 4096;
+}
+
+void* MarkStack::allocateStack(size_t size)
+{
+    return fastMalloc(size);
+}
+
+void MarkStack::releaseStack(void* addr, size_t)
+{
+    return fastFree(addr);
+}
+
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
index 8e78ff39e1..c28bc0de99 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
@@ -24,10 +24,10 @@
  */
 
 #include "config.h"
-
-
 #include "MarkStack.h"
 
+#if OS(UNIX) && !OS(SYMBIAN)
+
 #include <unistd.h>
 #include <sys/mman.h>
 
@@ -48,3 +48,5 @@ void MarkStack::releaseStack(void* addr, size_t size)
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackSymbian.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackSymbian.cpp
index a0ce8f629b..bda14ac3ab 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackSymbian.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackSymbian.cpp
@@ -20,6 +20,8 @@
 #include "config.h"
 #include "MarkStack.h"
 
+#if OS(SYMBIAN)
+
 #include <e32hal.h>
 
 namespace JSC {
@@ -42,3 +44,5 @@ void MarkStack::releaseStack(void* addr, size_t size)
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackWin.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackWin.cpp
index 1fdd06a655..a171c788c5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackWin.cpp
@@ -24,10 +24,10 @@
  */
 
 #include "config.h"
-
-
 #include "MarkStack.h"
 
+#if OS(WINDOWS)
+
 #include "windows.h"
 
 namespace JSC {
@@ -51,3 +51,5 @@ void MarkStack::releaseStack(void* addr, size_t)
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
index e8b7b972fd..8ef97e53b7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
@@ -96,7 +96,6 @@ MathObject::MathObject(ExecState* exec, NonNullPassRefPtr<Structure> structure)
     putDirectWithoutTransition(Identifier(exec, "PI"), jsNumber(exec, piDouble), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(Identifier(exec, "SQRT1_2"), jsNumber(exec, sqrt(0.5)), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(Identifier(exec, "SQRT2"), jsNumber(exec, sqrt(2.0)), DontDelete | DontEnum | ReadOnly);
-    WTF::initializeWeakRandomNumberGenerator();
 }
 
 // ECMA 15.8
@@ -120,22 +119,22 @@ JSValue JSC_HOST_CALL mathProtoFuncAbs(ExecState* exec, JSObject*, JSValue, cons
 
 JSValue JSC_HOST_CALL mathProtoFuncACos(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, acos(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, acos(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncASin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, asin(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, asin(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncATan(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, atan(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, atan(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncATan2(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, atan2(args.at(0).toNumber(exec), args.at(1).toNumber(exec)));
+    return jsDoubleNumber(exec, atan2(args.at(0).toNumber(exec), args.at(1).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState* exec, JSObject*, JSValue, const ArgList& args)
@@ -145,12 +144,12 @@ JSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState* exec, JSObject*, JSValue, con
 
 JSValue JSC_HOST_CALL mathProtoFuncCos(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, cos(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, cos(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncExp(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, exp(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, exp(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
@@ -160,7 +159,7 @@ JSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState* exec, JSObject*, JSValue, co
 
 JSValue JSC_HOST_CALL mathProtoFuncLog(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, log(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, log(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncMax(ExecState* exec, JSObject*, JSValue, const ArgList& args)
@@ -211,30 +210,29 @@ JSValue JSC_HOST_CALL mathProtoFuncPow(ExecState* exec, JSObject*, JSValue, cons
 
 JSValue JSC_HOST_CALL mathProtoFuncRandom(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
-    return jsNumber(exec, WTF::weakRandomNumber());
+    return jsDoubleNumber(exec, exec->globalData().weakRandom.get());
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncRound(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     double arg = args.at(0).toNumber(exec);
-    if (signbit(arg) && arg >= -0.5)
-         return jsNumber(exec, -0.0);
-    return jsNumber(exec, floor(arg + 0.5));
+    double integer = ceil(arg);
+    return jsNumber(exec, integer - (integer - arg > 0.5));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncSin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, sin(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, sin(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncSqrt(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, sqrt(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, sqrt(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncTan(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, tan(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, tan(args.at(0).toNumber(exec)));
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
index 7f474b8298..a9f70313d4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
@@ -37,7 +37,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp
index c655faee41..403fc7ecca 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp
@@ -33,7 +33,7 @@ ASSERT_CLASS_FITS_IN_CELL(NativeErrorConstructor);
 const ClassInfo NativeErrorConstructor::info = { "Function", &InternalFunction::info, 0, 0 };
 
 NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, NativeErrorPrototype* nativeErrorPrototype)
-    : InternalFunction(&exec->globalData(), structure, Identifier(exec, nativeErrorPrototype->getDirect(exec->propertyNames().name).getString()))
+    : InternalFunction(&exec->globalData(), structure, Identifier(exec, nativeErrorPrototype->getDirect(exec->propertyNames().name).getString(exec)))
     , m_errorStructure(ErrorInstance::createStructure(nativeErrorPrototype))
 {
     putDirect(exec->propertyNames().length, jsNumber(exec, 1), DontDelete | ReadOnly | DontEnum); // ECMA 15.11.7.5
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
index cc6c51d4ea..cf549ae175 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
@@ -29,11 +29,11 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(NumberConstructor);
 
-static JSValue numberConstructorNaNValue(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue numberConstructorNegInfinity(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue numberConstructorPosInfinity(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue numberConstructorMaxValue(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue numberConstructorMinValue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorNaNValue(ExecState*, JSValue, const Identifier&);
+static JSValue numberConstructorNegInfinity(ExecState*, JSValue, const Identifier&);
+static JSValue numberConstructorPosInfinity(ExecState*, JSValue, const Identifier&);
+static JSValue numberConstructorMaxValue(ExecState*, JSValue, const Identifier&);
+static JSValue numberConstructorMinValue(ExecState*, JSValue, const Identifier&);
 
 } // namespace JSC
 
@@ -73,27 +73,27 @@ bool NumberConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<NumberConstructor, InternalFunction>(exec, ExecState::numberTable(exec), this, propertyName, descriptor);
 }
 
-static JSValue numberConstructorNaNValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorNaNValue(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNaN(exec);
 }
 
-static JSValue numberConstructorNegInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorNegInfinity(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, -Inf);
 }
 
-static JSValue numberConstructorPosInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorPosInfinity(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, Inf);
 }
 
-static JSValue numberConstructorMaxValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorMaxValue(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, 1.7976931348623157E+308);
 }
 
-static JSValue numberConstructorMinValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorMinValue(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, 5E-324);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
index cf19b6f962..723c4b2831 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
@@ -39,7 +39,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
         enum { NaNValue, NegInfinity, PosInfinity, MaxValue, MinValue };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
index 8223a90a38..6c18cdd3bf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
@@ -33,7 +33,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp
index df31404b9c..5680eb1c86 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -25,9 +25,11 @@
 #include "Error.h"
 #include "JSFunction.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
+#include "Operations.h"
 #include "PrototypeFunction.h"
+#include "StringBuilder.h"
 #include "dtoa.h"
-#include "Operations.h"
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
 #include <wtf/Vector.h>
@@ -73,11 +75,12 @@ static UString integerPartNoExp(double d)
     bool resultIsInfOrNan = (decimalPoint == 9999);
     size_t length = strlen(result);
 
-    UString str = sign ? "-" : "";
+    StringBuilder builder;
+    builder.append(sign ? "-" : "");
     if (resultIsInfOrNan)
-        str += result;
+        builder.append((const char*)result);
     else if (decimalPoint <= 0)
-        str += "0";
+        builder.append("0");
     else {
         Vector<char, 1024> buf(decimalPoint + 1);
 
@@ -89,10 +92,10 @@ static UString integerPartNoExp(double d)
             strncpy(buf.data(), result, decimalPoint);
         buf[decimalPoint] = '\0';
 
-        str.append(buf.data());
+        builder.append((const char*)(buf.data()));
     }
 
-    return str;
+    return builder.build();
 }
 
 static UString charSequence(char c, int count)
@@ -236,13 +239,16 @@ JSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState* exec, JSObject*, JSValue
 
     UString s;
     if (x < 0) {
-        s.append('-');
+        s = "-";
         x = -x;
-    } else if (x == -0.0)
-        x = 0;
+    } else {
+        s = "";
+        if (x == -0.0)
+            x = 0;
+    }
 
     if (x >= pow(10.0, 21.0))
-        return jsString(exec, s + UString::from(x));
+        return jsString(exec, makeString(s, UString::from(x)));
 
     const double tenToTheF = pow(10.0, f);
     double n = floor(x * tenToTheF);
@@ -253,17 +259,19 @@ JSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState* exec, JSObject*, JSValue
 
     int k = m.size();
     if (k <= f) {
-        UString z;
+        StringBuilder z;
         for (int i = 0; i < f + 1 - k; i++)
             z.append('0');
-        m = z + m;
+        z.append(m);
+        m = z.build();
         k = f + 1;
-        ASSERT(k == m.size());
+        ASSERT(k == static_cast<int>(m.size()));
     }
     int kMinusf = k - f;
-    if (kMinusf < m.size())
-        return jsString(exec, s + m.substr(0, kMinusf) + "." + m.substr(kMinusf));
-    return jsString(exec, s + m.substr(0, kMinusf));
+
+    if (kMinusf < static_cast<int>(m.size()))
+        return jsString(exec, makeString(s, m.substr(0, kMinusf), ".", m.substr(kMinusf)));
+    return jsString(exec, makeString(s, m.substr(0, kMinusf)));
 }
 
 static void fractionalPartToString(char* buf, int& i, const char* result, int resultLength, int fractionalDigits)
@@ -391,7 +399,8 @@ JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec, JSObject*, JSV
     if (x < 0) {
         s = "-";
         x = -x;
-    }
+    } else
+        s = "";
 
     if (!(doublePrecision >= 1 && doublePrecision <= 21)) // true for NaN
         return throwError(exec, RangeError, "toPrecision() argument must be between 1 and 21");
@@ -422,10 +431,10 @@ JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec, JSObject*, JSV
         m = integerPartNoExp(n);
         if (e < -6 || e >= precision) {
             if (m.size() > 1)
-                m = m.substr(0, 1) + "." + m.substr(1);
+                m = makeString(m.substr(0, 1), ".", m.substr(1));
             if (e >= 0)
-                return jsNontrivialString(exec, s + m + "e+" + UString::from(e));
-            return jsNontrivialString(exec, s + m + "e-" + UString::from(-e));
+                return jsMakeNontrivialString(exec, s, m, "e+", UString::from(e));
+            return jsMakeNontrivialString(exec, s, m, "e-", UString::from(-e));
         }
     } else {
         m = charSequence('0', precision);
@@ -433,13 +442,13 @@ JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec, JSObject*, JSV
     }
 
     if (e == precision - 1)
-        return jsString(exec, s + m);
+        return jsString(exec, makeString(s, m));
     if (e >= 0) {
-        if (e + 1 < m.size())
-            return jsString(exec, s + m.substr(0, e + 1) + "." + m.substr(e + 1));
-        return jsString(exec, s + m);
+        if (e + 1 < static_cast<int>(m.size()))
+            return jsString(exec, makeString(s, m.substr(0, e + 1), ".", m.substr(e + 1)));
+        return jsString(exec, makeString(s, m));
     }
-    return jsNontrivialString(exec, s + "0." + charSequence('0', -(e + 1)) + m);
+    return jsMakeNontrivialString(exec, s, "0.", charSequence('0', -(e + 1)), m);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumericStrings.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumericStrings.h
index c0696a479a..89235af776 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumericStrings.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumericStrings.h
@@ -45,6 +45,8 @@ namespace JSC {
 
         UString add(int i)
         {
+            if (static_cast<unsigned>(i) < cacheSize)
+                return lookupSmallString(static_cast<unsigned>(i));
             CacheEntry<int>& entry = lookup(i);
             if (i == entry.key && !entry.value.isNull())
                 return entry.value;
@@ -53,6 +55,17 @@ namespace JSC {
             return entry.value;
         }
 
+        UString add(unsigned i)
+        {
+            if (i < cacheSize)
+                return lookupSmallString(static_cast<unsigned>(i));
+            CacheEntry<unsigned>& entry = lookup(i);
+            if (i == entry.key && !entry.value.isNull())
+                return entry.value;
+            entry.key = i;
+            entry.value = UString::from(i);
+            return entry.value;
+        }
     private:
         static const size_t cacheSize = 64;
 
@@ -64,9 +77,19 @@ namespace JSC {
 
         CacheEntry<double>& lookup(double d) { return doubleCache[WTF::FloatHash<double>::hash(d) & (cacheSize - 1)]; }
         CacheEntry<int>& lookup(int i) { return intCache[WTF::IntHash<int>::hash(i) & (cacheSize - 1)]; }
+        CacheEntry<unsigned>& lookup(unsigned i) { return unsignedCache[WTF::IntHash<unsigned>::hash(i) & (cacheSize - 1)]; }
+        const UString& lookupSmallString(unsigned i)
+        {
+            ASSERT(i < cacheSize);
+            if (smallIntCache[i].isNull())
+                smallIntCache[i] = UString::from(i);
+            return smallIntCache[i];
+        }
 
         CacheEntry<double> doubleCache[cacheSize];
         CacheEntry<int> intCache[cacheSize];
+        CacheEntry<unsigned> unsignedCache[cacheSize];
+        UString smallIntCache[cacheSize];
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
index 837d5a6f3c..0838eb4375 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -36,6 +36,7 @@ ASSERT_CLASS_FITS_IN_CELL(ObjectConstructor);
 
 static JSValue JSC_HOST_CALL objectConstructorGetPrototypeOf(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyNames(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL objectConstructorKeys(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL objectConstructorDefineProperty(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL objectConstructorDefineProperties(ExecState*, JSObject*, JSValue, const ArgList&);
@@ -52,6 +53,7 @@ ObjectConstructor::ObjectConstructor(ExecState* exec, NonNullPassRefPtr<Structur
     
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().getPrototypeOf, objectConstructorGetPrototypeOf), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().getOwnPropertyDescriptor, objectConstructorGetOwnPropertyDescriptor), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().getOwnPropertyNames, objectConstructorGetOwnPropertyNames), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().keys, objectConstructorKeys), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 3, exec->propertyNames().defineProperty, objectConstructorDefineProperty), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().defineProperties, objectConstructorDefineProperties), DontEnum);
@@ -126,6 +128,20 @@ JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState* exec,
 }
 
 // FIXME: Use the enumeration cache.
+JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyNames(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError, "Requested property names of a value that is not an object.");
+    PropertyNameArray properties(exec);
+    asObject(args.at(0))->getOwnPropertyNames(exec, properties, IncludeDontEnumProperties);
+    JSArray* names = constructEmptyArray(exec);
+    size_t numProperties = properties.size();
+    for (size_t i = 0; i < numProperties; i++)
+        names->push(exec, jsOwnedString(exec, properties[i].ustring()));
+    return names;
+}
+
+// FIXME: Use the enumeration cache.
 JSValue JSC_HOST_CALL objectConstructorKeys(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     if (!args.at(0).isObject())
@@ -148,14 +164,14 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
     }
     JSObject* description = asObject(in);
 
-    PropertySlot enumerableSlot;
+    PropertySlot enumerableSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().enumerable, enumerableSlot)) {
         desc.setEnumerable(enumerableSlot.getValue(exec, exec->propertyNames().enumerable).toBoolean(exec));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot configurableSlot;
+    PropertySlot configurableSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().configurable, configurableSlot)) {
         desc.setConfigurable(configurableSlot.getValue(exec, exec->propertyNames().configurable).toBoolean(exec));
         if (exec->hadException())
@@ -163,21 +179,21 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
     }
 
     JSValue value;
-    PropertySlot valueSlot;
+    PropertySlot valueSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().value, valueSlot)) {
         desc.setValue(valueSlot.getValue(exec, exec->propertyNames().value));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot writableSlot;
+    PropertySlot writableSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().writable, writableSlot)) {
         desc.setWritable(writableSlot.getValue(exec, exec->propertyNames().writable).toBoolean(exec));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot getSlot;
+    PropertySlot getSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().get, getSlot)) {
         JSValue get = getSlot.getValue(exec, exec->propertyNames().get);
         if (exec->hadException())
@@ -193,7 +209,7 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
         desc.setGetter(get);
     }
 
-    PropertySlot setSlot;
+    PropertySlot setSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().set, setSlot)) {
         JSValue set = setSlot.getValue(exec, exec->propertyNames().set);
         if (exec->hadException())
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
index 0970b7c44f..c32a00734a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -24,6 +24,7 @@
 #include "Error.h"
 #include "JSFunction.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "PrototypeFunction.h"
 
 namespace JSC {
@@ -148,7 +149,7 @@ JSValue JSC_HOST_CALL objectProtoFuncToLocaleString(ExecState* exec, JSObject*,
 
 JSValue JSC_HOST_CALL objectProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    return jsNontrivialString(exec, "[object " + thisValue.toThisObject(exec)->className() + "]");
+    return jsMakeNontrivialString(exec, "[object ", thisValue.toThisObject(exec)->className(), "]");
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp
index 093bbecf38..cf236bf5e3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp
@@ -29,10 +29,6 @@
 #include <stdio.h>
 #include <wtf/MathExtras.h>
 
-#if HAVE(FLOAT_H)
-#include <float.h>
-#endif
-
 namespace JSC {
 
 bool JSValue::equalSlowCase(ExecState* exec, JSValue v1, JSValue v2)
@@ -40,16 +36,9 @@ bool JSValue::equalSlowCase(ExecState* exec, JSValue v1, JSValue v2)
     return equalSlowCaseInline(exec, v1, v2);
 }
 
-bool JSValue::strictEqualSlowCase(JSValue v1, JSValue v2)
-{
-    return strictEqualSlowCaseInline(v1, v2);
-}
-
-NEVER_INLINE JSValue throwOutOfMemoryError(ExecState* exec)
+bool JSValue::strictEqualSlowCase(ExecState* exec, JSValue v1, JSValue v2)
 {
-    JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-    exec->setException(error);
-    return error;
+    return strictEqualSlowCaseInline(exec, v1, v2);
 }
 
 NEVER_INLINE JSValue jsAddSlowCase(CallFrame* callFrame, JSValue v1, JSValue v2)
@@ -58,12 +47,13 @@ NEVER_INLINE JSValue jsAddSlowCase(CallFrame* callFrame, JSValue v1, JSValue v2)
     JSValue p1 = v1.toPrimitive(callFrame);
     JSValue p2 = v2.toPrimitive(callFrame);
 
-    if (p1.isString() || p2.isString()) {
-        RefPtr<UString::Rep> value = concatenate(p1.toString(callFrame).rep(), p2.toString(callFrame).rep());
-        if (!value)
-            return throwOutOfMemoryError(callFrame);
-        return jsString(callFrame, value.release());
+    if (p1.isString()) {
+        return p2.isString()
+            ? jsString(callFrame, asString(p1), asString(p2))
+            : jsString(callFrame, asString(p1), p2.toString(callFrame));
     }
+    if (p2.isString())
+        return jsString(callFrame, p1.toString(callFrame), asString(p2));
 
     return jsNumber(callFrame, p1.toNumber(callFrame) + p2.toNumber(callFrame));
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
index 1aa68b3a00..cc0d603944 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
@@ -22,6 +22,7 @@
 #ifndef Operations_h
 #define Operations_h
 
+#include "ExceptionHelpers.h"
 #include "Interpreter.h"
 #include "JSImmediate.h"
 #include "JSNumberCell.h"
@@ -29,12 +30,176 @@
 
 namespace JSC {
 
-    NEVER_INLINE JSValue throwOutOfMemoryError(ExecState*);
     NEVER_INLINE JSValue jsAddSlowCase(CallFrame*, JSValue, JSValue);
     JSValue jsTypeStringForValue(CallFrame*, JSValue);
     bool jsIsObjectType(JSValue);
     bool jsIsFunctionType(JSValue);
 
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, JSString* s2)
+    {
+        unsigned length1 = s1->length();
+        if (!length1)
+            return s2;
+        unsigned length2 = s2->length();
+        if (!length2)
+            return s1;
+        if ((length1 + length2) < length1)
+            return throwOutOfMemoryError(exec);
+
+        unsigned fiberCount = s1->fiberCount() + s2->fiberCount();
+        JSGlobalData* globalData = &exec->globalData();
+
+        if (fiberCount <= JSString::s_maxInternalRopeLength)
+            return new (globalData) JSString(globalData, fiberCount, s1, s2);
+
+        JSString::RopeBuilder ropeBuilder(fiberCount);
+        if (UNLIKELY(ropeBuilder.isOutOfMemory()))
+            return throwOutOfMemoryError(exec);
+        ropeBuilder.append(s1);
+        ropeBuilder.append(s2);
+        return new (globalData) JSString(globalData, ropeBuilder.release());
+    }
+
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, const UString& u1, JSString* s2)
+    {
+        unsigned length1 = u1.size();
+        if (!length1)
+            return s2;
+        unsigned length2 = s2->length();
+        if (!length2)
+            return jsString(exec, u1);
+        if ((length1 + length2) < length1)
+            return throwOutOfMemoryError(exec);
+
+        unsigned fiberCount = 1 + s2->fiberCount();
+        JSGlobalData* globalData = &exec->globalData();
+
+        if (fiberCount <= JSString::s_maxInternalRopeLength)
+            return new (globalData) JSString(globalData, fiberCount, u1, s2);
+
+        JSString::RopeBuilder ropeBuilder(fiberCount);
+        if (UNLIKELY(ropeBuilder.isOutOfMemory()))
+            return throwOutOfMemoryError(exec);
+        ropeBuilder.append(u1);
+        ropeBuilder.append(s2);
+        return new (globalData) JSString(globalData, ropeBuilder.release());
+    }
+
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, const UString& u2)
+    {
+        unsigned length1 = s1->length();
+        if (!length1)
+            return jsString(exec, u2);
+        unsigned length2 = u2.size();
+        if (!length2)
+            return s1;
+        if ((length1 + length2) < length1)
+            return throwOutOfMemoryError(exec);
+
+        unsigned fiberCount = s1->fiberCount() + 1;
+        JSGlobalData* globalData = &exec->globalData();
+
+        if (fiberCount <= JSString::s_maxInternalRopeLength)
+            return new (globalData) JSString(globalData, fiberCount, s1, u2);
+
+        JSString::RopeBuilder ropeBuilder(fiberCount);
+        if (UNLIKELY(ropeBuilder.isOutOfMemory()))
+            return throwOutOfMemoryError(exec);
+        ropeBuilder.append(s1);
+        ropeBuilder.append(u2);
+        return new (globalData) JSString(globalData, ropeBuilder.release());
+    }
+
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, Register* strings, unsigned count)
+    {
+        ASSERT(count >= 3);
+
+        unsigned fiberCount = 0;
+        for (unsigned i = 0; i < count; ++i) {
+            JSValue v = strings[i].jsValue();
+            if (LIKELY(v.isString()))
+                fiberCount += asString(v)->fiberCount();
+            else
+                ++fiberCount;
+        }
+
+        JSGlobalData* globalData = &exec->globalData();
+        if (fiberCount == 3)
+            return new (globalData) JSString(exec, strings[0].jsValue(), strings[1].jsValue(), strings[2].jsValue());
+
+        JSString::RopeBuilder ropeBuilder(fiberCount);
+        if (UNLIKELY(ropeBuilder.isOutOfMemory()))
+            return throwOutOfMemoryError(exec);
+
+        unsigned length = 0;
+        bool overflow = false;
+
+        for (unsigned i = 0; i < count; ++i) {
+            JSValue v = strings[i].jsValue();
+            if (LIKELY(v.isString()))
+                ropeBuilder.append(asString(v));
+            else
+                ropeBuilder.append(v.toString(exec));
+
+            unsigned newLength = ropeBuilder.length();
+            if (newLength < length)
+                overflow = true;
+            length = newLength;
+        }
+
+        if (overflow)
+            return throwOutOfMemoryError(exec);
+
+        return new (globalData) JSString(globalData, ropeBuilder.release());
+    }
+
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, JSValue thisValue, const ArgList& args)
+    {
+        unsigned fiberCount = 0;
+        if (LIKELY(thisValue.isString()))
+            fiberCount += asString(thisValue)->fiberCount();
+        else
+            ++fiberCount;
+        for (unsigned i = 0; i < args.size(); ++i) {
+            JSValue v = args.at(i);
+            if (LIKELY(v.isString()))
+                fiberCount += asString(v)->fiberCount();
+            else
+                ++fiberCount;
+        }
+
+        JSString::RopeBuilder ropeBuilder(fiberCount);
+        if (UNLIKELY(ropeBuilder.isOutOfMemory()))
+            return throwOutOfMemoryError(exec);
+
+        if (LIKELY(thisValue.isString()))
+            ropeBuilder.append(asString(thisValue));
+        else
+            ropeBuilder.append(thisValue.toString(exec));
+
+        unsigned length = 0;
+        bool overflow = false;
+
+        for (unsigned i = 0; i < args.size(); ++i) {
+            JSValue v = args.at(i);
+            if (LIKELY(v.isString()))
+                ropeBuilder.append(asString(v));
+            else
+                ropeBuilder.append(v.toString(exec));
+
+            unsigned newLength = ropeBuilder.length();
+            if (newLength < length)
+                overflow = true;
+            length = newLength;
+        }
+
+        if (overflow)
+            return throwOutOfMemoryError(exec);
+
+        JSGlobalData* globalData = &exec->globalData();
+        return new (globalData) JSString(globalData, ropeBuilder.release());
+    }
+
     // ECMA 11.9.3
     inline bool JSValue::equal(ExecState* exec, JSValue v1, JSValue v2)
     {
@@ -53,7 +218,7 @@ namespace JSC {
             bool s1 = v1.isString();
             bool s2 = v2.isString();
             if (s1 && s2)
-                return asString(v1)->value() == asString(v2)->value();
+                return asString(v1)->value(exec) == asString(v2)->value(exec);
 
             if (v1.isUndefinedOrNull()) {
                 if (v2.isUndefinedOrNull())
@@ -110,17 +275,17 @@ namespace JSC {
     }
 
     // ECMA 11.9.3
-    ALWAYS_INLINE bool JSValue::strictEqualSlowCaseInline(JSValue v1, JSValue v2)
+    ALWAYS_INLINE bool JSValue::strictEqualSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2)
     {
         ASSERT(v1.isCell() && v2.isCell());
 
         if (v1.asCell()->isString() && v2.asCell()->isString())
-            return asString(v1)->value() == asString(v2)->value();
+            return asString(v1)->value(exec) == asString(v2)->value(exec);
 
         return v1 == v2;
     }
 
-    inline bool JSValue::strictEqual(JSValue v1, JSValue v2)
+    inline bool JSValue::strictEqual(ExecState* exec, JSValue v1, JSValue v2)
     {
         if (v1.isInt32() && v2.isInt32())
             return v1 == v2;
@@ -131,10 +296,10 @@ namespace JSC {
         if (!v1.isCell() || !v2.isCell())
             return v1 == v2;
 
-        return strictEqualSlowCaseInline(v1, v2);
+        return strictEqualSlowCaseInline(exec, v1, v2);
     }
 
-    inline bool jsLess(CallFrame* callFrame, JSValue v1, JSValue v2)
+    ALWAYS_INLINE bool jsLess(CallFrame* callFrame, JSValue v1, JSValue v2)
     {
         if (v1.isInt32() && v2.isInt32())
             return v1.asInt32() < v2.asInt32();
@@ -146,7 +311,7 @@ namespace JSC {
 
         JSGlobalData* globalData = &callFrame->globalData();
         if (isJSString(globalData, v1) && isJSString(globalData, v2))
-            return asString(v1)->value() < asString(v2)->value();
+            return asString(v1)->value(callFrame) < asString(v2)->value(callFrame);
 
         JSValue p1;
         JSValue p2;
@@ -156,7 +321,7 @@ namespace JSC {
         if (wasNotString1 | wasNotString2)
             return n1 < n2;
 
-        return asString(p1)->value() < asString(p2)->value();
+        return asString(p1)->value(callFrame) < asString(p2)->value(callFrame);
     }
 
     inline bool jsLessEq(CallFrame* callFrame, JSValue v1, JSValue v2)
@@ -171,7 +336,7 @@ namespace JSC {
 
         JSGlobalData* globalData = &callFrame->globalData();
         if (isJSString(globalData, v1) && isJSString(globalData, v2))
-            return !(asString(v2)->value() < asString(v1)->value());
+            return !(asString(v2)->value(callFrame) < asString(v1)->value(callFrame));
 
         JSValue p1;
         JSValue p2;
@@ -181,7 +346,7 @@ namespace JSC {
         if (wasNotString1 | wasNotString2)
             return n1 <= n2;
 
-        return !(asString(p2)->value() < asString(p1)->value());
+        return !(asString(p2)->value(callFrame) < asString(p1)->value(callFrame));
     }
 
     // Fast-path choices here are based on frequency data from SunSpider:
@@ -195,36 +360,21 @@ namespace JSC {
 
     ALWAYS_INLINE JSValue jsAdd(CallFrame* callFrame, JSValue v1, JSValue v2)
     {
-        double left;
-        double right = 0.0;
-
-        bool rightIsNumber = v2.getNumber(right);
-        if (rightIsNumber && v1.getNumber(left))
+        double left = 0.0, right;
+        if (v1.getNumber(left) && v2.getNumber(right))
             return jsNumber(callFrame, left + right);
         
-        bool leftIsString = v1.isString();
-        if (leftIsString && v2.isString()) {
-            RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
-            if (!value)
-                return throwOutOfMemoryError(callFrame);
-            return jsString(callFrame, value.release());
-        }
-
-        if (rightIsNumber & leftIsString) {
-            RefPtr<UString::Rep> value = v2.isInt32() ?
-                concatenate(asString(v1)->value().rep(), v2.asInt32()) :
-                concatenate(asString(v1)->value().rep(), right);
-
-            if (!value)
-                return throwOutOfMemoryError(callFrame);
-            return jsString(callFrame, value.release());
+        if (v1.isString()) {
+            return v2.isString()
+                ? jsString(callFrame, asString(v1), asString(v2))
+                : jsString(callFrame, asString(v1), v2.toPrimitiveString(callFrame));
         }
 
         // All other cases are pretty uncommon
         return jsAddSlowCase(callFrame, v1, v2);
     }
 
-    inline size_t normalizePrototypeChain(CallFrame* callFrame, JSValue base, JSValue slotBase)
+    inline size_t normalizePrototypeChain(CallFrame* callFrame, JSValue base, JSValue slotBase, const Identifier& propertyName, size_t& slotOffset)
     {
         JSCell* cell = asCell(base);
         size_t count = 0;
@@ -242,8 +392,11 @@ namespace JSC {
 
             // Since we're accessing a prototype in a loop, it's a good bet that it
             // should not be treated as a dictionary.
-            if (cell->structure()->isDictionary())
-                asObject(cell)->setStructure(Structure::fromDictionaryTransition(cell->structure()));
+            if (cell->structure()->isDictionary()) {
+                asObject(cell)->flattenDictionaryObject();
+                if (slotBase == cell)
+                    slotOffset = cell->structure()->get(propertyName); 
+            }
 
             ++count;
         }
@@ -265,7 +418,7 @@ namespace JSC {
             // Since we're accessing a prototype in a loop, it's a good bet that it
             // should not be treated as a dictionary.
             if (base->structure()->isDictionary())
-                asObject(base)->setStructure(Structure::fromDictionaryTransition(base->structure()));
+                asObject(base)->flattenDictionaryObject();
 
             ++count;
         }
@@ -293,52 +446,6 @@ namespace JSC {
         ASSERT_NOT_REACHED();
         return JSValue();
     }
-
-    ALWAYS_INLINE JSValue concatenateStrings(CallFrame* callFrame, Register* strings, unsigned count)
-    {
-        ASSERT(count >= 3);
-
-        // Estimate the amount of space required to hold the entire string.  If all
-        // arguments are strings, we can easily calculate the exact amount of space
-        // required.  For any other arguments, for now let's assume they may require
-        // 11 UChars of storage.  This is enouch to hold any int, and likely is also
-        // reasonable for the other immediates.  We may want to come back and tune
-        // this value at some point.
-        unsigned bufferSize = 0;
-        for (unsigned i = 0; i < count; ++i) {
-            JSValue v = strings[i].jsValue();
-            if (LIKELY(v.isString()))
-                bufferSize += asString(v)->value().size();
-            else
-                bufferSize += 11;
-        }
-
-        // Allocate an output string to store the result.
-        // If the first argument is a String, and if it has the capacity (or can grow
-        // its capacity) to hold the entire result then use this as a base to concatenate
-        // onto.  Otherwise, allocate a new empty output buffer.
-        JSValue firstValue = strings[0].jsValue();
-        RefPtr<UString::Rep> resultRep;
-        if (firstValue.isString() && (resultRep = asString(firstValue)->value().rep())->reserveCapacity(bufferSize)) {
-            // We're going to concatenate onto the first string - remove it from the list of items to be appended.
-            ++strings;
-            --count;
-        } else
-            resultRep = UString::Rep::createEmptyBuffer(bufferSize);
-        UString result(resultRep);
-
-        // Loop over the operands, writing them into the output buffer.
-        for (unsigned i = 0; i < count; ++i) {
-            JSValue v = strings[i].jsValue();
-            if (LIKELY(v.isString()))
-                result.append(asString(v)->value());
-            else
-                result.append(v.toString(callFrame));
-        }
-
-        return jsString(callFrame, result);
-    }
-
 } // namespace JSC
 
 #endif // Operations_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp
index 4db814f624..558ae28525 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp
@@ -153,15 +153,15 @@ void PropertyDescriptor::setGetter(JSValue getter)
     m_attributes &= ~ReadOnly;
 }
 
-bool PropertyDescriptor::equalTo(const PropertyDescriptor& other) const
+bool PropertyDescriptor::equalTo(ExecState* exec, const PropertyDescriptor& other) const
 {
     if (!other.m_value == m_value ||
         !other.m_getter == m_getter ||
         !other.m_setter == m_setter)
         return false;
-    return (!m_value || JSValue::strictEqual(other.m_value, m_value)) && 
-           (!m_getter || JSValue::strictEqual(other.m_getter, m_getter)) && 
-           (!m_setter || JSValue::strictEqual(other.m_setter, m_setter)) &&
+    return (!m_value || JSValue::strictEqual(exec, other.m_value, m_value)) && 
+           (!m_getter || JSValue::strictEqual(exec, other.m_getter, m_getter)) && 
+           (!m_setter || JSValue::strictEqual(exec, other.m_setter, m_setter)) &&
            attributesEqual(other);
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h
index 40bec86b03..ff9f1608b8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h
@@ -61,7 +61,7 @@ namespace JSC {
         bool configurablePresent() const { return m_seenAttributes & ConfigurablePresent; }
         bool setterPresent() const { return m_setter; }
         bool getterPresent() const { return m_getter; }
-        bool equalTo(const PropertyDescriptor& other) const;
+        bool equalTo(ExecState* exec, const PropertyDescriptor& other) const;
         bool attributesEqual(const PropertyDescriptor& other) const;
         unsigned attributesWithOverride(const PropertyDescriptor& other) const;
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
index 5b63f79ec2..44dc2b84ff 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
@@ -61,7 +61,6 @@ namespace JSC {
         unsigned size;
         unsigned keyCount;
         unsigned deletedSentinelCount;
-        unsigned anonymousSlotCount;
         unsigned lastIndexUsed;
         Vector<unsigned>* deletedOffsets;
         unsigned entryIndices[1];
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
index c28b6a4553..6b246691ba 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
@@ -30,7 +30,7 @@ static const size_t setThreshold = 20;
 
 void PropertyNameArray::add(UString::Rep* identifier)
 {
-    ASSERT(identifier == &UString::Rep::null() || identifier == &UString::Rep::empty() || identifier->identifierTable());
+    ASSERT(identifier == UString::null().rep() || identifier == UString::Rep::empty() || identifier->isIdentifier());
 
     size_t size = m_data->propertyNameVector().size();
     if (size < setThreshold) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
index a0a2f48f9c..2306a11e57 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
@@ -26,19 +26,19 @@
 
 namespace JSC {
 
-JSValue PropertySlot::functionGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue PropertySlot::functionGetter(ExecState* exec) const
 {
     // Prevent getter functions from observing execution if an exception is pending.
     if (exec->hadException())
         return exec->exception();
 
     CallData callData;
-    CallType callType = slot.m_data.getterFunc->getCallData(callData);
+    CallType callType = m_data.getterFunc->getCallData(callData);
     if (callType == CallTypeHost)
-        return callData.native.function(exec, slot.m_data.getterFunc, slot.slotBase(), exec->emptyList());
+        return callData.native.function(exec, m_data.getterFunc, thisValue(), exec->emptyList());
     ASSERT(callType == CallTypeJS);
     // FIXME: Can this be done more efficiently using the callData?
-    return asFunction(slot.m_data.getterFunc)->call(exec, slot.slotBase(), exec->emptyList());
+    return asFunction(m_data.getterFunc)->call(exec, thisValue(), exec->emptyList());
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
index 15d90342ae..de9ddc9982 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
@@ -34,10 +34,20 @@ namespace JSC {
 
 #define JSC_VALUE_SLOT_MARKER 0
 #define JSC_REGISTER_SLOT_MARKER reinterpret_cast<GetValueFunc>(1)
+#define INDEX_GETTER_MARKER reinterpret_cast<GetValueFunc>(2)
+#define GETTER_FUNCTION_MARKER reinterpret_cast<GetValueFunc>(3)
 
     class PropertySlot {
     public:
+        enum CachedPropertyType {
+            Uncacheable,
+            Getter,
+            Custom,
+            Value
+        };
+
         PropertySlot()
+            : m_cachedPropertyType(Uncacheable)
         {
             clearBase();
             clearOffset();
@@ -46,12 +56,14 @@ namespace JSC {
 
         explicit PropertySlot(const JSValue base)
             : m_slotBase(base)
+            , m_cachedPropertyType(Uncacheable)
         {
             clearOffset();
             clearValue();
         }
 
-        typedef JSValue (*GetValueFunc)(ExecState*, const Identifier&, const PropertySlot&);
+        typedef JSValue (*GetValueFunc)(ExecState*, JSValue slotBase, const Identifier&);
+        typedef JSValue (*GetIndexValueFunc)(ExecState*, JSValue slotBase, unsigned);
 
         JSValue getValue(ExecState* exec, const Identifier& propertyName) const
         {
@@ -59,7 +71,11 @@ namespace JSC {
                 return *m_data.valueSlot;
             if (m_getValue == JSC_REGISTER_SLOT_MARKER)
                 return (*m_data.registerSlot).jsValue();
-            return m_getValue(exec, propertyName, *this);
+            if (m_getValue == INDEX_GETTER_MARKER)
+                return m_getIndexValue(exec, slotBase(), index());
+            if (m_getValue == GETTER_FUNCTION_MARKER)
+                return functionGetter(exec);
+            return m_getValue(exec, slotBase(), propertyName);
         }
 
         JSValue getValue(ExecState* exec, unsigned propertyName) const
@@ -68,10 +84,16 @@ namespace JSC {
                 return *m_data.valueSlot;
             if (m_getValue == JSC_REGISTER_SLOT_MARKER)
                 return (*m_data.registerSlot).jsValue();
-            return m_getValue(exec, Identifier::from(exec, propertyName), *this);
+            if (m_getValue == INDEX_GETTER_MARKER)
+                return m_getIndexValue(exec, m_slotBase, m_data.index);
+            if (m_getValue == GETTER_FUNCTION_MARKER)
+                return functionGetter(exec);
+            return m_getValue(exec, slotBase(), Identifier::from(exec, propertyName));
         }
 
-        bool isCacheable() const { return m_offset != WTF::notFound; }
+        CachedPropertyType cachedPropertyType() const { return m_cachedPropertyType; }
+        bool isCacheable() const { return m_cachedPropertyType != Uncacheable; }
+        bool isCacheableValue() const { return m_cachedPropertyType == Value; }
         size_t cachedOffset() const
         {
             ASSERT(isCacheable());
@@ -102,6 +124,7 @@ namespace JSC {
             m_slotBase = slotBase;
             m_data.valueSlot = valueSlot;
             m_offset = offset;
+            m_cachedPropertyType = Value;
         }
         
         void setValue(JSValue value)
@@ -128,25 +151,49 @@ namespace JSC {
             ASSERT(slotBase);
             ASSERT(getValue);
             m_getValue = getValue;
+            m_getIndexValue = 0;
             m_slotBase = slotBase;
         }
-
-        void setCustomIndex(JSValue slotBase, unsigned index, GetValueFunc getValue)
+        
+        void setCacheableCustom(JSValue slotBase, GetValueFunc getValue)
         {
             ASSERT(slotBase);
             ASSERT(getValue);
             m_getValue = getValue;
+            m_getIndexValue = 0;
+            m_slotBase = slotBase;
+            m_cachedPropertyType = Custom;
+        }
+
+        void setCustomIndex(JSValue slotBase, unsigned index, GetIndexValueFunc getIndexValue)
+        {
+            ASSERT(slotBase);
+            ASSERT(getIndexValue);
+            m_getValue = INDEX_GETTER_MARKER;
+            m_getIndexValue = getIndexValue;
             m_slotBase = slotBase;
             m_data.index = index;
         }
-        
+
         void setGetterSlot(JSObject* getterFunc)
         {
             ASSERT(getterFunc);
-            m_getValue = functionGetter;
+            m_thisValue = m_slotBase;
+            m_getValue = GETTER_FUNCTION_MARKER;
             m_data.getterFunc = getterFunc;
         }
-        
+
+        void setCacheableGetterSlot(JSValue slotBase, JSObject* getterFunc, unsigned offset)
+        {
+            ASSERT(getterFunc);
+            m_getValue = GETTER_FUNCTION_MARKER;
+            m_thisValue = m_slotBase;
+            m_slotBase = slotBase;
+            m_data.getterFunc = getterFunc;
+            m_offset = offset;
+            m_cachedPropertyType = Getter;
+        }
+
         void setUndefined()
         {
             setValue(jsUndefined());
@@ -182,15 +229,24 @@ namespace JSC {
         {
             // Clear offset even in release builds, in case this PropertySlot has been used before.
             // (For other data members, we don't need to clear anything because reuse would meaningfully overwrite them.)
-            m_offset = WTF::notFound;
+            m_offset = 0;
+            m_cachedPropertyType = Uncacheable;
         }
 
         unsigned index() const { return m_data.index; }
 
+        JSValue thisValue() const { return m_thisValue; }
+
+        GetValueFunc customGetter() const
+        {
+            ASSERT(m_cachedPropertyType == Custom);
+            return m_getValue;
+        }
     private:
-        static JSValue functionGetter(ExecState*, const Identifier&, const PropertySlot&);
+        JSValue functionGetter(ExecState*) const;
 
         GetValueFunc m_getValue;
+        GetIndexValueFunc m_getIndexValue;
         
         JSValue m_slotBase;
         union {
@@ -201,8 +257,10 @@ namespace JSC {
         } m_data;
 
         JSValue m_value;
+        JSValue m_thisValue;
 
         size_t m_offset;
+        CachedPropertyType m_cachedPropertyType;
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
index 7dd4a8ffde..f0979432c5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
@@ -40,20 +40,12 @@
 
 #else
 
-#if ENABLE(WREC)
-#include "JIT.h"
-#include "WRECGenerator.h"
-#endif
 #include <pcre/pcre.h>
 
 #endif
 
 namespace JSC {
 
-#if ENABLE(WREC)
-using namespace WREC;
-#endif
-
 inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern)
     : m_pattern(pattern)
     , m_flagBits(0)
@@ -65,18 +57,17 @@ inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern)
 
 inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern, const UString& flags)
     : m_pattern(pattern)
-    , m_flags(flags)
     , m_flagBits(0)
     , m_constructionError(0)
     , m_numSubpatterns(0)
 {
     // NOTE: The global flag is handled on a case-by-case basis by functions like
     // String::match and RegExpObject::match.
-    if (flags.find('g') != -1)
+    if (flags.find('g') != UString::NotFound)
         m_flagBits |= Global;
-    if (flags.find('i') != -1)
+    if (flags.find('i') != UString::NotFound)
         m_flagBits |= IgnoreCase;
-    if (flags.find('m') != -1)
+    if (flags.find('m') != UString::NotFound)
         m_flagBits |= Multiline;
 
     compile(globalData);
@@ -118,7 +109,7 @@ int RegExp::match(const UString& s, int startOffset, Vector<int, 32>* ovector)
     if (ovector)
         ovector->clear();
 
-    if (startOffset > s.size() || s.isNull())
+    if (static_cast<unsigned>(startOffset) > s.size() || s.isNull())
         return -1;
 
 #if ENABLE(YARR_JIT)
@@ -165,18 +156,9 @@ int RegExp::match(const UString& s, int startOffset, Vector<int, 32>* ovector)
 
 #else
 
-void RegExp::compile(JSGlobalData* globalData)
+void RegExp::compile(JSGlobalData*)
 {
     m_regExp = 0;
-#if ENABLE(WREC)
-    m_wrecFunction = Generator::compileRegExp(globalData, m_pattern, &m_numSubpatterns, &m_constructionError, m_executablePool, ignoreCase(), multiline());
-    if (m_wrecFunction || m_constructionError)
-        return;
-    // Fall through to non-WREC case.
-#else
-    UNUSED_PARAM(globalData);
-#endif
-
     JSRegExpIgnoreCaseOption ignoreCaseOption = ignoreCase() ? JSRegExpIgnoreCase : JSRegExpDoNotIgnoreCase;
     JSRegExpMultilineOption multilineOption = multiline() ? JSRegExpMultiline : JSRegExpSingleLine;
     m_regExp = jsRegExpCompile(reinterpret_cast<const UChar*>(m_pattern.data()), m_pattern.size(), ignoreCaseOption, multilineOption, &m_numSubpatterns, &m_constructionError);
@@ -189,39 +171,9 @@ int RegExp::match(const UString& s, int startOffset, Vector<int, 32>* ovector)
     if (ovector)
         ovector->clear();
 
-    if (startOffset > s.size() || s.isNull())
+    if (static_cast<unsigned>(startOffset) > s.size() || s.isNull())
         return -1;
 
-#if ENABLE(WREC)
-    if (m_wrecFunction) {
-        int offsetVectorSize = (m_numSubpatterns + 1) * 2;
-        int* offsetVector;
-        Vector<int, 32> nonReturnedOvector;
-        if (ovector) {
-            ovector->resize(offsetVectorSize);
-            offsetVector = ovector->data();
-        } else {
-            nonReturnedOvector.resize(offsetVectorSize);
-            offsetVector = nonReturnedOvector.data();
-        }
-        ASSERT(offsetVector);
-        for (int j = 0; j < offsetVectorSize; ++j)
-            offsetVector[j] = -1;
-
-        int result = m_wrecFunction(s.data(), startOffset, s.size(), offsetVector);
-
-        if (result < 0) {
-#ifndef NDEBUG
-            // TODO: define up a symbol, rather than magic -1
-            if (result != -1)
-                fprintf(stderr, "jsRegExpExecute failed with result %d\n", result);
-#endif
-            if (ovector)
-                ovector->clear();
-        }
-        return result;
-    } else
-#endif
     if (m_regExp) {
         // Set up the offset vector for the result.
         // First 2/3 used for result, the last third used by PCRE.
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h
index 24d4199f4c..695b688047 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h
@@ -23,7 +23,6 @@
 #define RegExp_h
 
 #include "UString.h"
-#include "WREC.h"
 #include "ExecutableAllocator.h"
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
@@ -49,7 +48,6 @@ namespace JSC {
         bool multiline() const { return m_flagBits & Multiline; }
 
         const UString& pattern() const { return m_pattern; }
-        const UString& flags() const { return m_flags; }
 
         bool isValid() const { return !m_constructionError; }
         const char* errorMessage() const { return m_constructionError; }
@@ -66,7 +64,6 @@ namespace JSC {
         enum FlagBits { Global = 1, IgnoreCase = 2, Multiline = 4 };
 
         UString m_pattern; // FIXME: Just decompile m_regExp instead of storing this.
-        UString m_flags; // FIXME: Just decompile m_regExp instead of storing this.
         int m_flagBits;
         const char* m_constructionError;
         unsigned m_numSubpatterns;
@@ -76,10 +73,6 @@ namespace JSC {
 #elif ENABLE(YARR)
         OwnPtr<Yarr::BytecodePattern> m_regExpBytecode;
 #else
-#if ENABLE(WREC)
-        WREC::CompiledRegExp m_wrecFunction;
-        RefPtr<ExecutablePool> m_executablePool;
-#endif
         JSRegExp* m_regExp;
 #endif
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
index c609e083a3..c0cfc37b10 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -35,21 +35,21 @@
 
 namespace JSC {
 
-static JSValue regExpConstructorInput(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorLastMatch(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorLastParen(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorLeftContext(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorRightContext(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar1(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar2(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar3(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar4(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar5(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar6(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar7(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar8(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar9(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorInput(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorMultiline(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorLastMatch(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorLastParen(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorLeftContext(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorRightContext(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar1(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar2(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar3(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar4(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar5(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar6(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar7(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar8(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar9(ExecState*, JSValue, const Identifier&);
 
 static void setRegExpConstructorInput(ExecState*, JSObject*, JSValue);
 static void setRegExpConstructorMultiline(ExecState*, JSObject*, JSValue);
@@ -113,17 +113,17 @@ RegExpMatchesArray::RegExpMatchesArray(ExecState* exec, RegExpConstructorPrivate
     memcpy(d->lastOvector().data(), data->lastOvector().data(), offsetVectorSize * sizeof(int));
     // d->multiline is not needed, and remains uninitialized
 
-    setLazyCreationData(d);
+    setSubclassData(d);
 }
 
 RegExpMatchesArray::~RegExpMatchesArray()
 {
-    delete static_cast<RegExpConstructorPrivate*>(lazyCreationData());
+    delete static_cast<RegExpConstructorPrivate*>(subclassData());
 }
 
 void RegExpMatchesArray::fillArrayInstance(ExecState* exec)
 {
-    RegExpConstructorPrivate* d = static_cast<RegExpConstructorPrivate*>(lazyCreationData());
+    RegExpConstructorPrivate* d = static_cast<RegExpConstructorPrivate*>(subclassData());
     ASSERT(d);
 
     unsigned lastNumSubpatterns = d->lastNumSubPatterns;
@@ -132,6 +132,8 @@ void RegExpMatchesArray::fillArrayInstance(ExecState* exec)
         int start = d->lastOvector()[2 * i];
         if (start >= 0)
             JSArray::put(exec, i, jsSubstring(exec, d->lastInput, start, d->lastOvector()[2 * i + 1] - start));
+        else
+            JSArray::put(exec, i, jsUndefined());
     }
 
     PutPropertySlot slot;
@@ -139,7 +141,7 @@ void RegExpMatchesArray::fillArrayInstance(ExecState* exec)
     JSArray::put(exec, exec->propertyNames().input, jsString(exec, d->input), slot);
 
     delete d;
-    setLazyCreationData(0);
+    setSubclassData(0);
 }
 
 JSObject* RegExpConstructor::arrayOfMatches(ExecState* exec) const
@@ -193,79 +195,79 @@ bool RegExpConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<RegExpConstructor, InternalFunction>(exec, ExecState::regExpConstructorTable(exec), this, propertyName, descriptor);
 }
 
-JSValue regExpConstructorDollar1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 1);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 1);
 }
 
-JSValue regExpConstructorDollar2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 2);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 2);
 }
 
-JSValue regExpConstructorDollar3(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar3(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 3);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 3);
 }
 
-JSValue regExpConstructorDollar4(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar4(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 4);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 4);
 }
 
-JSValue regExpConstructorDollar5(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar5(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 5);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 5);
 }
 
-JSValue regExpConstructorDollar6(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar6(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 6);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 6);
 }
 
-JSValue regExpConstructorDollar7(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar7(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 7);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 7);
 }
 
-JSValue regExpConstructorDollar8(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar8(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 8);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 8);
 }
 
-JSValue regExpConstructorDollar9(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar9(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 9);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 9);
 }
 
-JSValue regExpConstructorInput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorInput(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return jsString(exec, asRegExpConstructor(slot.slotBase())->input());
+    return jsString(exec, asRegExpConstructor(slotBase)->input());
 }
 
-JSValue regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorMultiline(ExecState*, JSValue slotBase, const Identifier&)
 {
-    return jsBoolean(asRegExpConstructor(slot.slotBase())->multiline());
+    return jsBoolean(asRegExpConstructor(slotBase)->multiline());
 }
 
-JSValue regExpConstructorLastMatch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLastMatch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 0);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 0);
 }
 
-JSValue regExpConstructorLastParen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLastParen(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getLastParen(exec);
+    return asRegExpConstructor(slotBase)->getLastParen(exec);
 }
 
-JSValue regExpConstructorLeftContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLeftContext(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getLeftContext(exec);
+    return asRegExpConstructor(slotBase)->getLeftContext(exec);
 }
 
-JSValue regExpConstructorRightContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorRightContext(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getRightContext(exec);
+    return asRegExpConstructor(slotBase)->getRightContext(exec);
 }
 
 void RegExpConstructor::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -300,7 +302,7 @@ JSObject* constructRegExp(ExecState* exec, const ArgList& args)
 
     RefPtr<RegExp> regExp = RegExp::create(&exec->globalData(), pattern, flags);
     if (!regExp->isValid())
-        return throwError(exec, SyntaxError, UString("Invalid regular expression: ").append(regExp->errorMessage()));
+        return throwError(exec, SyntaxError, makeString("Invalid regular expression: ", regExp->errorMessage()));
     return new (exec) RegExpObject(exec->lexicalGlobalObject()->regExpStructure(), regExp.release());
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
index f9ca9cf1cd..8f4be71687 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
@@ -59,7 +59,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
index 829f7cf256..b823621563 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
@@ -32,58 +32,58 @@ namespace JSC {
     private:
         virtual bool getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             return JSArray::getOwnPropertySlot(exec, propertyName, slot);
         }
 
         virtual bool getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             return JSArray::getOwnPropertySlot(exec, propertyName, slot);
         }
 
         virtual bool getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             return JSArray::getOwnPropertyDescriptor(exec, propertyName, descriptor);
         }
 
         virtual void put(ExecState* exec, const Identifier& propertyName, JSValue v, PutPropertySlot& slot)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             JSArray::put(exec, propertyName, v, slot);
         }
 
         virtual void put(ExecState* exec, unsigned propertyName, JSValue v)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             JSArray::put(exec, propertyName, v);
         }
 
         virtual bool deleteProperty(ExecState* exec, const Identifier& propertyName)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             return JSArray::deleteProperty(exec, propertyName);
         }
 
         virtual bool deleteProperty(ExecState* exec, unsigned propertyName)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             return JSArray::deleteProperty(exec, propertyName);
         }
 
-        virtual void getOwnPropertyNames(ExecState* exec, PropertyNameArray& arr)
+        virtual void getOwnPropertyNames(ExecState* exec, PropertyNameArray& arr, EnumerationMode mode = ExcludeDontEnumProperties)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
-            JSArray::getOwnPropertyNames(exec, arr);
+            JSArray::getOwnPropertyNames(exec, arr, mode);
         }
 
         void fillArrayInstance(ExecState*);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
index 679d072ccf..3758e5380a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
@@ -30,11 +30,11 @@
 
 namespace JSC {
 
-static JSValue regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpObjectSource(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpObjectLastIndex(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpObjectGlobal(ExecState*, JSValue, const Identifier&);
+static JSValue regExpObjectIgnoreCase(ExecState*, JSValue, const Identifier&);
+static JSValue regExpObjectMultiline(ExecState*, JSValue, const Identifier&);
+static JSValue regExpObjectSource(ExecState*, JSValue, const Identifier&);
+static JSValue regExpObjectLastIndex(ExecState*, JSValue, const Identifier&);
 static void setRegExpObjectLastIndex(ExecState*, JSObject*, JSValue);
 
 } // namespace JSC
@@ -77,29 +77,29 @@ bool RegExpObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<RegExpObject, JSObject>(exec, ExecState::regExpTable(exec), this, propertyName, descriptor);
 }
 
-JSValue regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectGlobal(ExecState*, JSValue slotBase, const Identifier&)
 {
-    return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->global());
+    return jsBoolean(asRegExpObject(slotBase)->regExp()->global());
 }
 
-JSValue regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectIgnoreCase(ExecState*, JSValue slotBase, const Identifier&)
 {
-    return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->ignoreCase());
+    return jsBoolean(asRegExpObject(slotBase)->regExp()->ignoreCase());
 }
  
-JSValue regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectMultiline(ExecState*, JSValue slotBase, const Identifier&)
 {            
-    return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->multiline());
+    return jsBoolean(asRegExpObject(slotBase)->regExp()->multiline());
 }
 
-JSValue regExpObjectSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return jsString(exec, asRegExpObject(slot.slotBase())->regExp()->pattern());
+    return jsString(exec, asRegExpObject(slotBase)->regExp()->pattern());
 }
 
-JSValue regExpObjectLastIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectLastIndex(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return jsNumber(exec, asRegExpObject(slot.slotBase())->lastIndex());
+    return jsNumber(exec, asRegExpObject(slotBase)->lastIndex());
 }
 
 void RegExpObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -142,7 +142,7 @@ bool RegExpObject::match(ExecState* exec, const ArgList& args)
 
     UString input = args.isEmpty() ? regExpConstructor->input() : args.at(0).toString(exec);
     if (input.isNull()) {
-        throwError(exec, GeneralError, "No input to " + toString(exec) + ".");
+        throwError(exec, GeneralError, makeString("No input to ", toString(exec), "."));
         return false;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
index 3117c86fda..4ad11ef7a5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
@@ -49,7 +49,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
index bbc9e85b57..dd5fe0252f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -27,6 +27,7 @@
 #include "JSFunction.h"
 #include "JSObject.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "JSValue.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
@@ -91,7 +92,7 @@ JSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec, JSObject*, JSValue
     }
 
     if (!regExp->isValid())
-        return throwError(exec, SyntaxError, UString("Invalid regular expression: ").append(regExp->errorMessage()));
+        return throwError(exec, SyntaxError, makeString("Invalid regular expression: ", regExp->errorMessage()));
 
     asRegExpObject(thisValue)->setRegExp(regExp.release());
     asRegExpObject(thisValue)->setLastIndex(0);
@@ -106,15 +107,17 @@ JSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState* exec, JSObject*, JSValu
         return throwError(exec, TypeError);
     }
 
-    UString result = "/" + asRegExpObject(thisValue)->get(exec, exec->propertyNames().source).toString(exec);
-    result.append('/');
+    char postfix[5] = { '/', 0, 0, 0, 0 };
+    int index = 1;
     if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().global).toBoolean(exec))
-        result.append('g');
+        postfix[index++] = 'g';
     if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().ignoreCase).toBoolean(exec))
-        result.append('i');
+        postfix[index++] = 'i';
     if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().multiline).toBoolean(exec))
-        result.append('m');
-    return jsNontrivialString(exec, result);
+        postfix[index] = 'm';
+    UString source = asRegExpObject(thisValue)->get(exec, exec->propertyNames().source).toString(exec);
+    // If source is empty, use "/(?:)/" to avoid colliding with comment syntax
+    return jsMakeNontrivialString(exec, "/", source.size() ? source : UString("(?:)"), postfix);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
index 04701cbde7..78bd4e42c4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
@@ -34,6 +34,11 @@
 namespace JSC {
 static const unsigned numCharactersToStore = 0x100;
 
+static inline bool isMarked(JSString* string)
+{
+    return string && Heap::isCellMarked(string);
+}
+
 class SmallStringsStorage : public Noncopyable {
 public:
     SmallStringsStorage();
@@ -41,41 +46,23 @@ public:
     UString::Rep* rep(unsigned char character) { return &m_reps[character]; }
 
 private:
-    UChar m_characters[numCharactersToStore];
-    UString::BaseString m_base;
     UString::Rep m_reps[numCharactersToStore];
 };
 
 SmallStringsStorage::SmallStringsStorage()
-    : m_base(m_characters, numCharactersToStore)
 {
-    m_base.rc = numCharactersToStore + 1;
-    // make sure UString doesn't try to reuse the buffer by pretending we have one more character in it
-    m_base.usedCapacity = numCharactersToStore + 1;
-    m_base.capacity = numCharactersToStore + 1;
-    m_base.checkConsistency();
-
-    for (unsigned i = 0; i < numCharactersToStore; ++i)
-        m_characters[i] = i;
-
-    memset(&m_reps, 0, sizeof(m_reps));
+    UChar* characterBuffer = 0;
+    RefPtr<UStringImpl> baseString = UStringImpl::createUninitialized(numCharactersToStore, characterBuffer);
     for (unsigned i = 0; i < numCharactersToStore; ++i) {
-        m_reps[i].offset = i;
-        m_reps[i].len = 1;
-        m_reps[i].rc = 1;
-        m_reps[i].setBaseString(&m_base);
-        m_reps[i].checkConsistency();
+        characterBuffer[i] = i;
+        new (&m_reps[i]) UString::Rep(&characterBuffer[i], 1, PassRefPtr<UStringImpl>(baseString));
     }
 }
 
 SmallStrings::SmallStrings()
-    : m_emptyString(0)
-    , m_storage(0)
 {
     COMPILE_ASSERT(numCharactersToStore == sizeof(m_singleCharacterStrings) / sizeof(m_singleCharacterStrings[0]), IsNumCharactersConstInSyncWithClassUsage);
-
-    for (unsigned i = 0; i < numCharactersToStore; ++i)
-        m_singleCharacterStrings[i] = 0;
+    clear();
 }
 
 SmallStrings::~SmallStrings()
@@ -84,6 +71,25 @@ SmallStrings::~SmallStrings()
 
 void SmallStrings::markChildren(MarkStack& markStack)
 {
+    /*
+       Our hypothesis is that small strings are very common. So, we cache them
+       to avoid GC churn. However, in cases where this hypothesis turns out to
+       be false -- including the degenerate case where all JavaScript execution
+       has terminated -- we don't want to waste memory.
+
+       To test our hypothesis, we check if any small string has been marked. If
+       so, it's probably reasonable to mark the rest. If not, we clear the cache.
+     */
+
+    bool isAnyStringMarked = isMarked(m_emptyString);
+    for (unsigned i = 0; i < numCharactersToStore && !isAnyStringMarked; ++i)
+        isAnyStringMarked = isMarked(m_singleCharacterStrings[i]);
+    
+    if (!isAnyStringMarked) {
+        clear();
+        return;
+    }
+    
     if (m_emptyString)
         markStack.append(m_emptyString);
     for (unsigned i = 0; i < numCharactersToStore; ++i) {
@@ -92,6 +98,13 @@ void SmallStrings::markChildren(MarkStack& markStack)
     }
 }
 
+void SmallStrings::clear()
+{
+    m_emptyString = 0;
+    for (unsigned i = 0; i < numCharactersToStore; ++i)
+        m_singleCharacterStrings[i] = 0;
+}
+
 unsigned SmallStrings::count() const
 {
     unsigned count = 0;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
index efecbb0751..cc11d0ace5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
@@ -57,6 +57,7 @@ namespace JSC {
         UString::Rep* singleCharacterStringRep(unsigned char character);
 
         void markChildren(MarkStack&);
+        void clear();
 
         unsigned count() const;
 
diff --git a/src/3rdparty/webkit/WebCore/history/cf/HistoryPropertyList.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringBuilder.h
index fcb8c478a4..59b01e007a 100644
--- a/src/3rdparty/webkit/WebCore/history/cf/HistoryPropertyList.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringBuilder.h
@@ -23,45 +23,58 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef HistoryPropertyList_h
-#define HistoryPropertyList_h
+#ifndef StringBuilder_h
+#define StringBuilder_h
 
-#include "BinaryPropertyList.h"
-#include "PlatformString.h"
-#include <wtf/RetainPtr.h>
+#include <wtf/Vector.h>
 
-namespace WebCore {
+namespace JSC {
 
-class HistoryItem;
-
-class HistoryPropertyListWriter : public BinaryPropertyListWriter {
+class StringBuilder {
 public:
-    RetainPtr<CFDataRef> releaseData();
+    void append(const UChar u)
+    {
+        buffer.append(u);
+    }
 
-protected:
-    HistoryPropertyListWriter();
+    void append(const char* str)
+    {
+        append(str, strlen(str));
+    }
+
+    void append(const char* str, size_t len)
+    {
+        buffer.reserveCapacity(buffer.size() + len);
+        for (size_t i = 0; i < len; i++)
+            buffer.append(static_cast<unsigned char>(str[i]));
+    }
 
-    void writeHistoryItem(BinaryPropertyListObjectStream&, HistoryItem*);
+    void append(const UChar* str, size_t len)
+    {
+        buffer.append(str, len);
+    }
 
-private:
-    virtual void writeHistoryItems(BinaryPropertyListObjectStream&) = 0;
+    void append(const UString& str)
+    {
+        buffer.append(str.data(), str.size());
+    }
 
-    virtual void writeObjects(BinaryPropertyListObjectStream&);
-    virtual UInt8* buffer(size_t);
+    bool isEmpty() { return buffer.isEmpty(); }
+    void reserveCapacity(size_t newCapacity) { buffer.reserveCapacity(newCapacity); }
+    void resize(size_t size) { buffer.resize(size); }
+    size_t size() const { return buffer.size(); }
 
-    const String m_dailyVisitCountsKey;
-    const String m_displayTitleKey;
-    const String m_lastVisitWasFailureKey;
-    const String m_lastVisitWasHTTPNonGetKey;
-    const String m_lastVisitedDateKey;
-    const String m_redirectURLsKey;
-    const String m_titleKey;
-    const String m_urlKey;
-    const String m_visitCountKey;
-    const String m_weeklyVisitCountsKey;
+    UChar operator[](size_t i) const { return buffer.at(i); }
 
-    UInt8* m_buffer;
-    size_t m_bufferSize;
+    UString build()
+    {
+        buffer.shrinkToFit();
+        ASSERT(buffer.data() || !buffer.size());
+        return UString::adopt(buffer);
+    }
+
+protected:
+    Vector<UChar, 64> buffer;
 };
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp
index 2f3adbef64..c7b62bfc81 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp
@@ -30,12 +30,12 @@ namespace JSC {
 
 static NEVER_INLINE JSValue stringFromCharCodeSlowCase(ExecState* exec, const ArgList& args)
 {
-    UChar* buf = static_cast<UChar*>(fastMalloc(args.size() * sizeof(UChar)));
-    UChar* p = buf;
-    ArgList::const_iterator end = args.end();
-    for (ArgList::const_iterator it = args.begin(); it != end; ++it)
-        *p++ = static_cast<UChar>((*it).toUInt32(exec));
-    return jsString(exec, UString(buf, p - buf, false));
+    unsigned length = args.size();
+    UChar* buf;
+    PassRefPtr<UStringImpl> impl = UStringImpl::createUninitialized(length, buf);
+    for (unsigned i = 0; i < length; ++i)
+        buf[i] = static_cast<UChar>(args.at(i).toUInt32(exec));
+    return jsString(exec, impl);
 }
 
 static JSValue JSC_HOST_CALL stringFromCharCode(ExecState* exec, JSObject*, JSValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
index 7216d3adc5..f8e0e872b4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
@@ -79,15 +79,21 @@ bool StringObject::deleteProperty(ExecState* exec, const Identifier& propertyNam
 {
     if (propertyName == exec->propertyNames().length)
         return false;
+    bool isStrictUInt32;
+    unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
+    if (isStrictUInt32 && internalValue()->canGetIndex(i))
+        return false;
     return JSObject::deleteProperty(exec, propertyName);
 }
 
-void StringObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void StringObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    int size = internalValue()->value().size();
+    int size = internalValue()->length();
     for (int i = 0; i < size; ++i)
         propertyNames.add(Identifier(exec, UString::from(i)));
-    return JSObject::getOwnPropertyNames(exec, propertyNames);
+    if (mode == IncludeDontEnumProperties)
+        propertyNames.add(exec->propertyNames().length);
+    return JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
index 84e1ad24a0..e3add77b92 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
@@ -39,7 +39,7 @@ namespace JSC {
 
         virtual void put(ExecState* exec, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const JS_EXPORTDATA ClassInfo info;
@@ -48,7 +48,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
index 69e1939635..43c3e3839a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -44,7 +44,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | MasqueradesAsUndefined | OverridesGetPropertyNames | StringObject::StructureFlags;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
index a0cc9f1490..bef408316a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
@@ -28,7 +28,9 @@
 #include "JSGlobalObjectFunctions.h"
 #include "JSArray.h"
 #include "JSFunction.h"
+#include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
+#include "Operations.h"
 #include "PropertyNameArray.h"
 #include "RegExpConstructor.h"
 #include "RegExpObject.h"
@@ -148,12 +150,11 @@ bool StringPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier
 
 // ------------------------------ Functions --------------------------
 
-static inline UString substituteBackreferences(const UString& replacement, const UString& source, const int* ovector, RegExp* reg)
+static NEVER_INLINE UString substituteBackreferencesSlow(const UString& replacement, const UString& source, const int* ovector, RegExp* reg, unsigned i)
 {
-    UString substitutedReplacement;
+    Vector<UChar> substitutedReplacement;
     int offset = 0;
-    int i = -1;
-    while ((i = replacement.find('$', i + 1)) != -1) {
+    do {
         if (i + 1 == replacement.size())
             break;
 
@@ -205,15 +206,21 @@ static inline UString substituteBackreferences(const UString& replacement, const
         i += 1 + advance;
         offset = i + 1;
         substitutedReplacement.append(source.data() + backrefStart, backrefLength);
-    }
-
-    if (!offset)
-        return replacement;
+    } while ((i = replacement.find('$', i + 1)) != UString::NotFound);
 
     if (replacement.size() - offset)
         substitutedReplacement.append(replacement.data() + offset, replacement.size() - offset);
 
-    return substitutedReplacement;
+    substitutedReplacement.shrinkToFit();
+    return UString::adopt(substitutedReplacement);
+}
+
+static inline UString substituteBackreferences(const UString& replacement, const UString& source, const int* ovector, RegExp* reg)
+{
+    unsigned i = replacement.find('$', 0);
+    if (UNLIKELY(i != UString::NotFound))
+        return substituteBackreferencesSlow(replacement, source, ovector, reg, i);
+    return replacement;
 }
 
 static inline int localeCompare(const UString& a, const UString& b)
@@ -221,10 +228,90 @@ static inline int localeCompare(const UString& a, const UString& b)
     return Collator::userDefault()->collate(reinterpret_cast<const ::UChar*>(a.data()), a.size(), reinterpret_cast<const ::UChar*>(b.data()), b.size());
 }
 
+struct StringRange {
+public:
+    StringRange(int pos, int len)
+        : position(pos)
+        , length(len)
+    {
+    }
+
+    StringRange()
+    {
+    }
+
+    int position;
+    int length;
+};
+
+JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, JSString* sourceVal, const UString& source, const StringRange* substringRanges, int rangeCount, const UString* separators, int separatorCount);
+JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, JSString* sourceVal, const UString& source, const StringRange* substringRanges, int rangeCount, const UString* separators, int separatorCount)
+{
+    if (rangeCount == 1 && separatorCount == 0) {
+        int sourceSize = source.size();
+        int position = substringRanges[0].position;
+        int length = substringRanges[0].length;
+        if (position <= 0 && length >= sourceSize)
+            return sourceVal;
+        // We could call UString::substr, but this would result in redundant checks
+        return jsString(exec, UStringImpl::create(source.rep(), max(0, position), min(sourceSize, length)));
+    }
+
+    int totalLength = 0;
+    for (int i = 0; i < rangeCount; i++)
+        totalLength += substringRanges[i].length;
+    for (int i = 0; i < separatorCount; i++)
+        totalLength += separators[i].size();
+
+    if (totalLength == 0)
+        return jsString(exec, "");
+
+    UChar* buffer;
+    PassRefPtr<UStringImpl> impl = UStringImpl::tryCreateUninitialized(totalLength, buffer);
+    if (!impl)
+        return throwOutOfMemoryError(exec);
+
+    int maxCount = max(rangeCount, separatorCount);
+    int bufferPos = 0;
+    for (int i = 0; i < maxCount; i++) {
+        if (i < rangeCount) {
+            UStringImpl::copyChars(buffer + bufferPos, source.data() + substringRanges[i].position, substringRanges[i].length);
+            bufferPos += substringRanges[i].length;
+        }
+        if (i < separatorCount) {
+            UStringImpl::copyChars(buffer + bufferPos, separators[i].data(), separators[i].size());
+            bufferPos += separators[i].size();
+        }
+    }
+
+    return jsString(exec, impl);
+}
+
+JSValue jsReplaceRange(ExecState* exec, const UString& source, int rangeStart, int rangeLength, const UString& replacement);
+JSValue jsReplaceRange(ExecState* exec, const UString& source, int rangeStart, int rangeLength, const UString& replacement)
+{
+    int replacementLength = replacement.size();
+    int totalLength = source.size() - rangeLength + replacementLength;
+    if (totalLength == 0)
+        return jsString(exec, "");
+
+    UChar* buffer;
+    PassRefPtr<UStringImpl> impl = UStringImpl::tryCreateUninitialized(totalLength, buffer);
+    if (!impl)
+        return throwOutOfMemoryError(exec);
+
+    UStringImpl::copyChars(buffer, source.data(), rangeStart);
+    UStringImpl::copyChars(buffer + rangeStart, replacement.data(), replacementLength);
+    int rangeEnd = rangeStart + rangeLength;
+    UStringImpl::copyChars(buffer + rangeStart + replacementLength, source.data() + rangeEnd, source.size() - rangeEnd);
+
+    return jsString(exec, impl);
+}
+
 JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSString* sourceVal = thisValue.toThisJSString(exec);
-    const UString& source = sourceVal->value();
+    const UString& source = sourceVal->value(exec);
 
     JSValue pattern = args.at(0);
 
@@ -242,9 +329,9 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
         RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
 
         int lastIndex = 0;
-        int startPosition = 0;
+        unsigned startPosition = 0;
 
-        Vector<UString::Range, 16> sourceRanges;
+        Vector<StringRange, 16> sourceRanges;
         Vector<UString, 16> replacements;
 
         // This is either a loop (if global is set) or a one-way (if not).
@@ -263,7 +350,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
                 if (matchIndex < 0)
                     break;
                 
-                sourceRanges.append(UString::Range(lastIndex, matchIndex - lastIndex));
+                sourceRanges.append(StringRange(lastIndex, matchIndex - lastIndex));
 
                 int completeMatchStart = ovector[0];
                 unsigned i = 0;
@@ -281,7 +368,8 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
                 cachedCall.setArgument(i++, sourceVal);
                 
                 cachedCall.setThis(exec->globalThisValue());
-                replacements.append(cachedCall.call().toString(cachedCall.newCallFrame()));
+                JSValue result = cachedCall.call();
+                replacements.append(result.toString(cachedCall.newCallFrame(exec)));
                 if (exec->hadException())
                     break;
 
@@ -304,7 +392,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
                 if (matchIndex < 0)
                     break;
 
-                sourceRanges.append(UString::Range(lastIndex, matchIndex - lastIndex));
+                sourceRanges.append(StringRange(lastIndex, matchIndex - lastIndex));
 
                 if (callType != CallTypeNone) {
                     int completeMatchStart = ovector[0];
@@ -344,19 +432,18 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
         if (!lastIndex && replacements.isEmpty())
             return sourceVal;
 
-        if (lastIndex < source.size())
-            sourceRanges.append(UString::Range(lastIndex, source.size() - lastIndex));
+        if (static_cast<unsigned>(lastIndex) < source.size())
+            sourceRanges.append(StringRange(lastIndex, source.size() - lastIndex));
 
-        return jsString(exec, source.spliceSubstringsWithSeparators(sourceRanges.data(), sourceRanges.size(),
-            replacements.data(), replacements.size()));
+        return jsSpliceSubstringsWithSeparators(exec, sourceVal, source, sourceRanges.data(), sourceRanges.size(), replacements.data(), replacements.size());
     }
 
     // Not a regular expression, so treat the pattern as a string.
 
     UString patternString = pattern.toString(exec);
-    int matchPos = source.find(patternString);
+    unsigned matchPos = source.find(patternString);
 
-    if (matchPos == -1)
+    if (matchPos == UString::NotFound)
         return sourceVal;
 
     int matchLen = patternString.size();
@@ -370,7 +457,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
     }
 
     int ovector[2] = { matchPos, matchPos + matchLen };
-    return jsString(exec, source.replaceRange(matchPos, matchLen, substituteBackreferences(replacementString, source, ovector, 0)));
+    return jsReplaceRange(exec, source, matchPos, matchLen, substituteBackreferences(replacementString, source, ovector, 0));
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -422,12 +509,14 @@ JSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState* exec, JSObject*, JSVa
 
 JSValue JSC_HOST_CALL stringProtoFuncConcat(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isString() && (args.size() == 1)) {
+        JSValue v = args.at(0);
+        return v.isString()
+            ? jsString(exec, asString(thisValue), asString(v))
+            : jsString(exec, asString(thisValue), v.toString(exec));
+    }
 
-    ArgList::const_iterator end = args.end();
-    for (ArgList::const_iterator it = args.begin(); it != end; ++it)
-        s += (*it).toString(exec);
-    return jsString(exec, s);
+    return jsString(exec, thisValue, args);
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -452,7 +541,10 @@ JSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue
         pos = static_cast<int>(dpos);
     }
 
-    return jsNumber(exec, s.find(u2, pos));
+    unsigned result = s.find(u2, pos);
+    if (result == UString::NotFound)
+        return jsNumber(exec, -1);
+    return jsNumber(exec, result);
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -469,12 +561,16 @@ JSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSV
         dpos = 0;
     else if (!(dpos <= len)) // true for NaN
         dpos = len;
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
     // Work around for broken NaN compare operator
     else if (isnan(dpos))
         dpos = len;
 #endif
-    return jsNumber(exec, s.rfind(u2, static_cast<int>(dpos)));
+
+    unsigned result = s.rfind(u2, static_cast<unsigned>(dpos));
+    if (result == UString::NotFound)
+        return jsNumber(exec, -1);
+    return jsNumber(exec, result);
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -586,7 +682,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue t
 
     JSArray* result = constructEmptyArray(exec);
     unsigned i = 0;
-    int p0 = 0;
+    unsigned p0 = 0;
     unsigned limit = a1.isUndefined() ? 0xFFFFFFFFU : a1.toUInt32(exec);
     if (a0.inherits(&RegExpObject::info)) {
         RegExp* reg = asRegExpObject(a0)->regExp();
@@ -594,7 +690,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue t
             // empty string matched by regexp -> empty array
             return result;
         }
-        int pos = 0;
+        unsigned pos = 0;
         while (i != limit && pos < s.size()) {
             Vector<int, 32> ovector;
             int mpos = reg->match(s, pos, &ovector);
@@ -602,7 +698,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue t
                 break;
             int mlen = ovector[1] - ovector[0];
             pos = mpos + (mlen == 0 ? 1 : mlen);
-            if (mpos != p0 || mlen) {
+            if (static_cast<unsigned>(mpos) != p0 || mlen) {
                 result->put(exec, i++, jsSubstring(exec, s, p0, mpos - p0));
                 p0 = mpos + mlen;
             }
@@ -624,8 +720,9 @@ JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue t
             while (i != limit && p0 < s.size() - 1)
                 result->put(exec, i++, jsSingleCharacterSubstring(exec, s, p0++));
         } else {
-            int pos;
-            while (i != limit && (pos = s.find(u2, p0)) >= 0) {
+            unsigned pos;
+            
+            while (i != limit && (pos = s.find(u2, p0)) != UString::NotFound) {
                 result->put(exec, i++, jsSubstring(exec, s, p0, pos - p0));
                 p0 = pos + u2.size();
             }
@@ -696,7 +793,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState* exec, JSObject*, JSVal
 JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSString* sVal = thisValue.toThisJSString(exec);
-    const UString& s = sVal->value();
+    const UString& s = sVal->value(exec);
 
     int sSize = s.size();
     if (!sSize)
@@ -712,7 +809,7 @@ JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSV
         buffer[i] = toASCIILower(c);
     }
     if (!(ored & ~0x7f))
-        return jsString(exec, UString(buffer.releaseBuffer(), sSize, false));
+        return jsString(exec, UString::adopt(buffer));
 
     bool error;
     int length = Unicode::toLower(buffer.data(), sSize, sData, sSize, &error);
@@ -722,15 +819,18 @@ JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSV
         if (error)
             return sVal;
     }
-    if (length == sSize && memcmp(buffer.data(), sData, length * sizeof(UChar)) == 0)
-        return sVal;
-    return jsString(exec, UString(buffer.releaseBuffer(), length, false));
+    if (length == sSize) {
+        if (memcmp(buffer.data(), sData, length * sizeof(UChar)) == 0)
+            return sVal;
+    } else
+        buffer.resize(length);
+    return jsString(exec, UString::adopt(buffer));
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSString* sVal = thisValue.toThisJSString(exec);
-    const UString& s = sVal->value();
+    const UString& s = sVal->value(exec);
 
     int sSize = s.size();
     if (!sSize)
@@ -746,7 +846,7 @@ JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSV
         buffer[i] = toASCIIUpper(c);
     }
     if (!(ored & ~0x7f))
-        return jsString(exec, UString(buffer.releaseBuffer(), sSize, false));
+        return jsString(exec, UString::adopt(buffer));
 
     bool error;
     int length = Unicode::toUpper(buffer.data(), sSize, sData, sSize, &error);
@@ -756,9 +856,12 @@ JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSV
         if (error)
             return sVal;
     }
-    if (length == sSize && memcmp(buffer.data(), sData, length * sizeof(UChar)) == 0)
-        return sVal;
-    return jsString(exec, UString(buffer.releaseBuffer(), length, false));
+    if (length == sSize) {
+        if (memcmp(buffer.data(), sData, length * sizeof(UChar)) == 0)
+            return sVal;
+    } else
+        buffer.resize(length);
+    return jsString(exec, UString::adopt(buffer));
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -774,62 +877,62 @@ JSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec, JSObject*, J
 JSValue JSC_HOST_CALL stringProtoFuncBig(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<big>" + s + "</big>");
+    return jsMakeNontrivialString(exec, "<big>", s, "</big>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncSmall(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<small>" + s + "</small>");
+    return jsMakeNontrivialString(exec, "<small>", s, "</small>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncBlink(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<blink>" + s + "</blink>");
+    return jsMakeNontrivialString(exec, "<blink>", s, "</blink>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncBold(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<b>" + s + "</b>");
+    return jsMakeNontrivialString(exec, "<b>", s, "</b>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncFixed(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsString(exec, "<tt>" + s + "</tt>");
+    return jsMakeNontrivialString(exec, "<tt>", s, "</tt>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncItalics(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<i>" + s + "</i>");
+    return jsMakeNontrivialString(exec, "<i>", s, "</i>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncStrike(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<strike>" + s + "</strike>");
+    return jsMakeNontrivialString(exec, "<strike>", s, "</strike>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncSub(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<sub>" + s + "</sub>");
+    return jsMakeNontrivialString(exec, "<sub>", s, "</sub>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncSup(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<sup>" + s + "</sup>");
+    return jsMakeNontrivialString(exec, "<sup>", s, "</sup>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncFontcolor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
     JSValue a0 = args.at(0);
-    return jsNontrivialString(exec, "<font color=\"" + a0.toString(exec) + "\">" + s + "</font>");
+    return jsMakeNontrivialString(exec, "<font color=\"", a0.toString(exec), "\">", s, "</font>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -842,7 +945,8 @@ JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValu
         unsigned stringSize = s.size();
         unsigned bufferSize = 22 + stringSize;
         UChar* buffer;
-        if (!tryFastMalloc(bufferSize * sizeof(UChar)).getValue(buffer))
+        PassRefPtr<UStringImpl> impl = UStringImpl::tryCreateUninitialized(bufferSize, buffer);
+        if (!impl)
             return jsUndefined();
         buffer[0] = '<';
         buffer[1] = 'f';
@@ -867,17 +971,17 @@ JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValu
         buffer[19 + stringSize] = 'n';
         buffer[20 + stringSize] = 't';
         buffer[21 + stringSize] = '>';
-        return jsNontrivialString(exec, UString(buffer, bufferSize, false));
+        return jsNontrivialString(exec, impl);
     }
 
-    return jsNontrivialString(exec, "<font size=\"" + a0.toString(exec) + "\">" + s + "</font>");
+    return jsMakeNontrivialString(exec, "<font size=\"", a0.toString(exec), "\">", s, "</font>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
     JSValue a0 = args.at(0);
-    return jsNontrivialString(exec, "<a name=\"" + a0.toString(exec) + "\">" + s + "</a>");
+    return jsMakeNontrivialString(exec, "<a name=\"", a0.toString(exec), "\">", s, "</a>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -890,7 +994,8 @@ JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue th
     unsigned stringSize = s.size();
     unsigned bufferSize = 15 + linkTextSize + stringSize;
     UChar* buffer;
-    if (!tryFastMalloc(bufferSize * sizeof(UChar)).getValue(buffer))
+    PassRefPtr<UStringImpl> impl = UStringImpl::tryCreateUninitialized(bufferSize, buffer);
+    if (!impl)
         return jsUndefined();
     buffer[0] = '<';
     buffer[1] = 'a';
@@ -909,7 +1014,7 @@ JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue th
     buffer[12 + linkTextSize + stringSize] = '/';
     buffer[13 + linkTextSize + stringSize] = 'a';
     buffer[14 + linkTextSize + stringSize] = '>';
-    return jsNontrivialString(exec, UString(buffer, bufferSize, false));
+    return jsNontrivialString(exec, impl);
 }
 
 enum {
@@ -925,12 +1030,12 @@ static inline bool isTrimWhitespace(UChar c)
 static inline JSValue trimString(ExecState* exec, JSValue thisValue, int trimKind)
 {
     UString str = thisValue.toThisString(exec);
-    int left = 0;
+    unsigned left = 0;
     if (trimKind & TrimLeft) {
         while (left < str.size() && isTrimWhitespace(str[left]))
             left++;
     }
-    int right = str.size();
+    unsigned right = str.size();
     if (trimKind & TrimRight) {
         while (right > left && isTrimWhitespace(str[right - 1]))
             right--;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
index 65b62f9532..6f23c7d2f9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
@@ -77,6 +77,108 @@ static HashSet<Structure*>& ignoreSet = *(new HashSet<Structure*>);
 static HashSet<Structure*>& liveStructureSet = *(new HashSet<Structure*>);
 #endif
 
+static int comparePropertyMapEntryIndices(const void* a, const void* b);
+
+inline void Structure::setTransitionTable(TransitionTable* table)
+{
+    ASSERT(m_isUsingSingleSlot);
+#ifndef NDEBUG
+    setSingleTransition(0);
+#endif
+    m_isUsingSingleSlot = false;
+    m_transitions.m_table = table;
+    // This implicitly clears the flag that indicates we're using a single transition
+    ASSERT(!m_isUsingSingleSlot);
+}
+
+// The contains and get methods accept imprecise matches, so if an unspecialised transition exists
+// for the given key they will consider that transition to be a match.  If a specialised transition
+// exists and it matches the provided specificValue, get will return the specific transition.
+inline bool Structure::transitionTableContains(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
+{
+    if (m_isUsingSingleSlot) {
+        Structure* existingTransition = singleTransition();
+        return existingTransition && existingTransition->m_nameInPrevious.get() == key.first
+               && existingTransition->m_attributesInPrevious == key.second
+               && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0);
+    }
+    TransitionTable::iterator find = transitionTable()->find(key);
+    if (find == transitionTable()->end())
+        return false;
+
+    return find->second.first || find->second.second->transitionedFor(specificValue);
+}
+
+inline Structure* Structure::transitionTableGet(const StructureTransitionTableHash::Key& key, JSCell* specificValue) const
+{
+    if (m_isUsingSingleSlot) {
+        Structure* existingTransition = singleTransition();
+        if (existingTransition && existingTransition->m_nameInPrevious.get() == key.first
+            && existingTransition->m_attributesInPrevious == key.second
+            && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0))
+            return existingTransition;
+        return 0;
+    }
+
+    Transition transition = transitionTable()->get(key);
+    if (transition.second && transition.second->transitionedFor(specificValue))
+        return transition.second;
+    return transition.first;
+}
+
+inline bool Structure::transitionTableHasTransition(const StructureTransitionTableHash::Key& key) const
+{
+    if (m_isUsingSingleSlot) {
+        Structure* transition = singleTransition();
+        return transition && transition->m_nameInPrevious == key.first
+        && transition->m_attributesInPrevious == key.second;
+    }
+    return transitionTable()->contains(key);
+}
+
+inline void Structure::transitionTableRemove(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
+{
+    if (m_isUsingSingleSlot) {
+        ASSERT(transitionTableContains(key, specificValue));
+        setSingleTransition(0);
+        return;
+    }
+    TransitionTable::iterator find = transitionTable()->find(key);
+    if (!specificValue)
+        find->second.first = 0;
+    else
+        find->second.second = 0;
+    if (!find->second.first && !find->second.second)
+        transitionTable()->remove(find);
+}
+
+inline void Structure::transitionTableAdd(const StructureTransitionTableHash::Key& key, Structure* structure, JSCell* specificValue)
+{
+    if (m_isUsingSingleSlot) {
+        if (!singleTransition()) {
+            setSingleTransition(structure);
+            return;
+        }
+        Structure* existingTransition = singleTransition();
+        TransitionTable* transitionTable = new TransitionTable;
+        setTransitionTable(transitionTable);
+        if (existingTransition)
+            transitionTableAdd(std::make_pair(existingTransition->m_nameInPrevious.get(), existingTransition->m_attributesInPrevious), existingTransition, existingTransition->m_specificValueInPrevious);
+    }
+    if (!specificValue) {
+        TransitionTable::iterator find = transitionTable()->find(key);
+        if (find == transitionTable()->end())
+            transitionTable()->add(key, Transition(structure, 0));
+        else
+            find->second.first = structure;
+    } else {
+        // If we're adding a transition to a specific value, then there cannot be
+        // an existing transition
+        ASSERT(!transitionTable()->contains(key));
+        transitionTable()->add(key, Transition(0, structure));
+    }
+}
+
 void Structure::dumpStatistics()
 {
 #if DUMP_STRUCTURE_ID_STATISTICS
@@ -121,7 +223,7 @@ void Structure::dumpStatistics()
 #endif
 }
 
-Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
+Structure::Structure(JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount)
     : m_typeInfo(typeInfo)
     , m_prototype(prototype)
     , m_specificValueInPrevious(0)
@@ -132,7 +234,12 @@ Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
     , m_isPinnedPropertyTable(false)
     , m_hasGetterSetterProperties(false)
     , m_attributesInPrevious(0)
+    , m_specificFunctionThrashCount(0)
+    , m_anonymousSlotCount(anonymousSlotCount)
+    , m_isUsingSingleSlot(true)
 {
+    m_transitions.m_singleTransition = 0;
+
     ASSERT(m_prototype);
     ASSERT(m_prototype.isObject() || m_prototype.isNull());
 
@@ -154,15 +261,11 @@ Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
 Structure::~Structure()
 {
     if (m_previous) {
-        if (m_nameInPrevious)
-            m_previous->table.remove(make_pair(m_nameInPrevious.get(), m_attributesInPrevious), m_specificValueInPrevious);
-        else
-            m_previous->table.removeAnonymousSlotTransition(m_anonymousSlotsInPrevious);
+        ASSERT(m_nameInPrevious);
+        m_previous->transitionTableRemove(make_pair(m_nameInPrevious.get(), m_attributesInPrevious), m_specificValueInPrevious);
 
     }
-    
-    if (m_enumerationCache)
-        m_enumerationCache->setCachedStructure(0);
+    ASSERT(!m_enumerationCache.hasDeadObject());
 
     if (m_propertyTable) {
         unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
@@ -175,6 +278,9 @@ Structure::~Structure()
         fastFree(m_propertyTable);
     }
 
+    if (!m_isUsingSingleSlot)
+        delete transitionTable();
+
 #ifndef NDEBUG
 #if ENABLE(JSC_MULTIPLE_THREADS)
     MutexLocker protect(ignoreSetMutex);
@@ -273,12 +379,8 @@ void Structure::materializePropertyMap()
 
     for (ptrdiff_t i = structures.size() - 2; i >= 0; --i) {
         structure = structures[i];
-        if (!structure->m_nameInPrevious) {
-            m_propertyTable->anonymousSlotCount += structure->m_anonymousSlotsInPrevious;
-            continue;
-        }
         structure->m_nameInPrevious->ref();
-        PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious, ++m_propertyTable->lastIndexUsed);
+        PropertyMapEntry entry(structure->m_nameInPrevious.get(), m_anonymousSlotCount + structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious, ++m_propertyTable->lastIndexUsed);
         insertIntoPropertyMapHashTable(entry);
     }
 }
@@ -300,7 +402,7 @@ void Structure::despecifyDictionaryFunction(const Identifier& propertyName)
     ASSERT(isDictionary());
     ASSERT(m_propertyTable);
 
-    unsigned i = rep->computedHash();
+    unsigned i = rep->existingHash();
 
 #if DUMP_PROPERTYMAP_STATS
     ++numProbes;
@@ -318,7 +420,7 @@ void Structure::despecifyDictionaryFunction(const Identifier& propertyName)
     ++numCollisions;
 #endif
 
-    unsigned k = 1 | doubleHash(rep->computedHash());
+    unsigned k = 1 | doubleHash(rep->existingHash());
 
     while (1) {
         i += k;
@@ -342,9 +444,11 @@ PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Struct
     ASSERT(!structure->isDictionary());
     ASSERT(structure->typeInfo().type() == ObjectType);
 
-    if (Structure* existingTransition = structure->table.get(make_pair(propertyName.ustring().rep(), attributes), specificValue)) {
+    if (Structure* existingTransition = structure->transitionTableGet(make_pair(propertyName.ustring().rep(), attributes), specificValue)) {
         ASSERT(existingTransition->m_offset != noOffset);
-        offset = existingTransition->m_offset;
+        offset = existingTransition->m_offset + existingTransition->m_anonymousSlotCount;
+        ASSERT(offset >= structure->m_anonymousSlotCount);
+        ASSERT(structure->m_anonymousSlotCount == existingTransition->m_anonymousSlotCount);
         return existingTransition;
     }
 
@@ -356,17 +460,22 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
     ASSERT(!structure->isDictionary());
     ASSERT(structure->typeInfo().type() == ObjectType);
     ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, specificValue, offset));
+    
+    if (structure->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
+        specificValue = 0;
 
     if (structure->transitionCount() > s_maxTransitionLength) {
         RefPtr<Structure> transition = toCacheableDictionaryTransition(structure);
         ASSERT(structure != transition);
         offset = transition->put(propertyName, attributes, specificValue);
+        ASSERT(offset >= structure->m_anonymousSlotCount);
+        ASSERT(structure->m_anonymousSlotCount == transition->m_anonymousSlotCount);
         if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
             transition->growPropertyStorageCapacity();
         return transition.release();
     }
 
-    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
+    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo(), structure->anonymousSlotCount());
 
     transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
     transition->m_previous = structure;
@@ -376,6 +485,7 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
     transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
+    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
 
     if (structure->m_propertyTable) {
         if (structure->m_isPinnedPropertyTable)
@@ -392,12 +502,14 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
     }
 
     offset = transition->put(propertyName, attributes, specificValue);
+    ASSERT(offset >= structure->m_anonymousSlotCount);
+    ASSERT(structure->m_anonymousSlotCount == transition->m_anonymousSlotCount);
     if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
         transition->growPropertyStorageCapacity();
 
-    transition->m_offset = offset;
-
-    structure->table.add(make_pair(propertyName.ustring().rep(), attributes), transition.get(), specificValue);
+    transition->m_offset = offset - structure->m_anonymousSlotCount;
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
+    structure->transitionTableAdd(make_pair(propertyName.ustring().rep(), attributes), transition.get(), specificValue);
     return transition.release();
 }
 
@@ -408,34 +520,40 @@ PassRefPtr<Structure> Structure::removePropertyTransition(Structure* structure,
     RefPtr<Structure> transition = toUncacheableDictionaryTransition(structure);
 
     offset = transition->remove(propertyName);
+    ASSERT(offset >= structure->m_anonymousSlotCount);
+    ASSERT(structure->m_anonymousSlotCount == transition->m_anonymousSlotCount);
 
     return transition.release();
 }
 
 PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure, JSValue prototype)
 {
-    RefPtr<Structure> transition = create(prototype, structure->typeInfo());
+    RefPtr<Structure> transition = create(prototype, structure->typeInfo(), structure->anonymousSlotCount());
 
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
     transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
+    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
 
     // Don't set m_offset, as one can not transition to this.
 
     structure->materializePropertyMapIfNecessary();
     transition->m_propertyTable = structure->copyPropertyTable();
     transition->m_isPinnedPropertyTable = true;
-
+    
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
     return transition.release();
 }
 
 PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structure, const Identifier& replaceFunction)
 {
-    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
+    ASSERT(structure->m_specificFunctionThrashCount < maxSpecificFunctionThrashCount);
+    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo(), structure->anonymousSlotCount());
 
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
     transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
+    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount + 1;
 
     // Don't set m_offset, as one can not transition to this.
 
@@ -443,67 +561,32 @@ PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structur
     transition->m_propertyTable = structure->copyPropertyTable();
     transition->m_isPinnedPropertyTable = true;
 
-    bool removed = transition->despecifyFunction(replaceFunction);
-    ASSERT_UNUSED(removed, removed);
-
-    return transition.release();
-}
-
-PassRefPtr<Structure> Structure::addAnonymousSlotsTransition(Structure* structure, unsigned count)
-{
-    if (Structure* transition = structure->table.getAnonymousSlotTransition(count)) {
-        ASSERT(transition->storedPrototype() == structure->storedPrototype());
-        return transition;
+    if (transition->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
+        transition->despecifyAllFunctions();
+    else {
+        bool removed = transition->despecifyFunction(replaceFunction);
+        ASSERT_UNUSED(removed, removed);
     }
-    ASSERT(count);
-    ASSERT(count < ((1<<6) - 2));
-    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
     
-    transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
-    transition->m_previous = structure;
-    transition->m_nameInPrevious = 0;
-    transition->m_attributesInPrevious = 0;
-    transition->m_anonymousSlotsInPrevious = count;
-    transition->m_specificValueInPrevious = 0;
-    transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
-    transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
-    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
-
-    if (structure->m_propertyTable) {
-        if (structure->m_isPinnedPropertyTable)
-            transition->m_propertyTable = structure->copyPropertyTable();
-        else {
-            transition->m_propertyTable = structure->m_propertyTable;
-            structure->m_propertyTable = 0;
-        }
-    } else {
-        if (structure->m_previous)
-            transition->materializePropertyMap();
-        else
-            transition->createPropertyMapHashTable();
-    }
-
-    transition->addAnonymousSlots(count);
-    if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
-        transition->growPropertyStorageCapacity();
-
-    structure->table.addAnonymousSlotTransition(count, transition.get());
-    return transition.release();    
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
+    return transition.release();
 }
 
 PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
 {
-    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
+    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo(), structure->anonymousSlotCount());
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = transition->m_hasGetterSetterProperties;
     transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
+    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
 
     // Don't set m_offset, as one can not transition to this.
 
     structure->materializePropertyMapIfNecessary();
     transition->m_propertyTable = structure->copyPropertyTable();
     transition->m_isPinnedPropertyTable = true;
-
+    
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
     return transition.release();
 }
 
@@ -511,16 +594,18 @@ PassRefPtr<Structure> Structure::toDictionaryTransition(Structure* structure, Di
 {
     ASSERT(!structure->isUncacheableDictionary());
     
-    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
+    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo(), structure->anonymousSlotCount());
     transition->m_dictionaryKind = kind;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
     transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
+    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
     
     structure->materializePropertyMapIfNecessary();
     transition->m_propertyTable = structure->copyPropertyTable();
     transition->m_isPinnedPropertyTable = true;
     
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
     return transition.release();
 }
 
@@ -534,32 +619,62 @@ PassRefPtr<Structure> Structure::toUncacheableDictionaryTransition(Structure* st
     return toDictionaryTransition(structure, UncachedDictionaryKind);
 }
 
-PassRefPtr<Structure> Structure::fromDictionaryTransition(Structure* structure)
+PassRefPtr<Structure> Structure::flattenDictionaryStructure(JSObject* object)
 {
-    ASSERT(structure->isDictionary());
-
-    // Since dictionary Structures are not shared, and no opcodes specialize
-    // for them, we don't need to allocate a new Structure when transitioning
-    // to non-dictionary status.
-
-    // FIMXE: We can make this more efficient by canonicalizing the Structure (draining the
-    // deleted offsets vector) before transitioning from dictionary. 
-    if (!structure->m_propertyTable || !structure->m_propertyTable->deletedOffsets || structure->m_propertyTable->deletedOffsets->isEmpty())
-        structure->m_dictionaryKind = NoneDictionaryKind;
+    ASSERT(isDictionary());
+    if (isUncacheableDictionary()) {
+        ASSERT(m_propertyTable);
+        Vector<PropertyMapEntry*> sortedPropertyEntries(m_propertyTable->keyCount);
+        PropertyMapEntry** p = sortedPropertyEntries.data();
+        unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
+        for (unsigned i = 1; i <= entryCount; i++) {
+            if (m_propertyTable->entries()[i].key)
+                *p++ = &m_propertyTable->entries()[i];
+        }
+        size_t propertyCount = p - sortedPropertyEntries.data();
+        qsort(sortedPropertyEntries.data(), propertyCount, sizeof(PropertyMapEntry*), comparePropertyMapEntryIndices);
+        sortedPropertyEntries.resize(propertyCount);
+
+        // We now have the properties currently defined on this object
+        // in the order that they are expected to be in, but we need to
+        // reorder the storage, so we have to copy the current values out
+        Vector<JSValue> values(propertyCount);
+        unsigned anonymousSlotCount = m_anonymousSlotCount;
+        for (unsigned i = 0; i < propertyCount; i++) {
+            PropertyMapEntry* entry = sortedPropertyEntries[i];
+            values[i] = object->getDirectOffset(entry->offset);
+            // Update property table to have the new property offsets
+            entry->offset = anonymousSlotCount + i;
+            entry->index = i;
+        }
+        
+        // Copy the original property values into their final locations
+        for (unsigned i = 0; i < propertyCount; i++)
+            object->putDirectOffset(anonymousSlotCount + i, values[i]);
+
+        if (m_propertyTable->deletedOffsets) {
+            delete m_propertyTable->deletedOffsets;
+            m_propertyTable->deletedOffsets = 0;
+        }
+    }
 
-    return structure;
+    m_dictionaryKind = NoneDictionaryKind;
+    return this;
 }
 
 size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!m_enumerationCache);
+
+    if (m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
+        specificValue = 0;
+
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
-    if (attributes & DontEnum)
-        m_hasNonEnumerableProperties = true;
 
     size_t offset = put(propertyName, attributes, specificValue);
+    ASSERT(offset >= m_anonymousSlotCount);
     if (propertyStorageSize() > propertyStorageCapacity())
         growPropertyStorageCapacity();
     return offset;
@@ -574,6 +689,7 @@ size_t Structure::removePropertyWithoutTransition(const Identifier& propertyName
 
     m_isPinnedPropertyTable = true;
     size_t offset = remove(propertyName);
+    ASSERT(offset >= m_anonymousSlotCount);
     return offset;
 }
 
@@ -630,7 +746,6 @@ PropertyMapHashTable* Structure::copyPropertyTable()
     if (m_propertyTable->deletedOffsets)
         newTable->deletedOffsets = new Vector<unsigned>(*m_propertyTable->deletedOffsets);
 
-    newTable->anonymousSlotCount = m_propertyTable->anonymousSlotCount;
     return newTable;
 }
 
@@ -640,7 +755,7 @@ size_t Structure::get(const UString::Rep* rep, unsigned& attributes, JSCell*& sp
     if (!m_propertyTable)
         return notFound;
 
-    unsigned i = rep->computedHash();
+    unsigned i = rep->existingHash();
 
 #if DUMP_PROPERTYMAP_STATS
     ++numProbes;
@@ -653,6 +768,7 @@ size_t Structure::get(const UString::Rep* rep, unsigned& attributes, JSCell*& sp
     if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
         attributes = m_propertyTable->entries()[entryIndex - 1].attributes;
         specificValue = m_propertyTable->entries()[entryIndex - 1].specificValue;
+        ASSERT(m_propertyTable->entries()[entryIndex - 1].offset >= m_anonymousSlotCount);
         return m_propertyTable->entries()[entryIndex - 1].offset;
     }
 
@@ -660,7 +776,7 @@ size_t Structure::get(const UString::Rep* rep, unsigned& attributes, JSCell*& sp
     ++numCollisions;
 #endif
 
-    unsigned k = 1 | doubleHash(rep->computedHash());
+    unsigned k = 1 | doubleHash(rep->existingHash());
 
     while (1) {
         i += k;
@@ -676,6 +792,7 @@ size_t Structure::get(const UString::Rep* rep, unsigned& attributes, JSCell*& sp
         if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
             attributes = m_propertyTable->entries()[entryIndex - 1].attributes;
             specificValue = m_propertyTable->entries()[entryIndex - 1].specificValue;
+            ASSERT(m_propertyTable->entries()[entryIndex - 1].offset >= m_anonymousSlotCount);
             return m_propertyTable->entries()[entryIndex - 1].offset;
         }
     }
@@ -691,7 +808,7 @@ bool Structure::despecifyFunction(const Identifier& propertyName)
 
     UString::Rep* rep = propertyName._ustring.rep();
 
-    unsigned i = rep->computedHash();
+    unsigned i = rep->existingHash();
 
 #if DUMP_PROPERTYMAP_STATS
     ++numProbes;
@@ -711,7 +828,7 @@ bool Structure::despecifyFunction(const Identifier& propertyName)
     ++numCollisions;
 #endif
 
-    unsigned k = 1 | doubleHash(rep->computedHash());
+    unsigned k = 1 | doubleHash(rep->existingHash());
 
     while (1) {
         i += k;
@@ -732,6 +849,17 @@ bool Structure::despecifyFunction(const Identifier& propertyName)
     }
 }
 
+void Structure::despecifyAllFunctions()
+{
+    materializePropertyMapIfNecessary();
+    if (!m_propertyTable)
+        return;
+    
+    unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
+    for (unsigned i = 1; i <= entryCount; ++i)
+        m_propertyTable->entries()[i].specificValue = 0;
+}
+
 size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!propertyName.isNull());
@@ -739,6 +867,9 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
 
     checkConsistency();
 
+    if (attributes & DontEnum)
+        m_hasNonEnumerableProperties = true;
+
     UString::Rep* rep = propertyName._ustring.rep();
 
     if (!m_propertyTable)
@@ -746,7 +877,7 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
 
     // FIXME: Consider a fast case for tables with no deleted sentinels.
 
-    unsigned i = rep->computedHash();
+    unsigned i = rep->existingHash();
     unsigned k = 0;
     bool foundDeletedElement = false;
     unsigned deletedElementIndex = 0; // initialize to make the compiler happy
@@ -769,7 +900,7 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
         }
 
         if (k == 0) {
-            k = 1 | doubleHash(rep->computedHash());
+            k = 1 | doubleHash(rep->existingHash());
 #if DUMP_PROPERTYMAP_STATS
             ++numCollisions;
 #endif
@@ -810,9 +941,10 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
         newOffset = m_propertyTable->deletedOffsets->last();
         m_propertyTable->deletedOffsets->removeLast();
     } else
-        newOffset = m_propertyTable->keyCount + m_propertyTable->anonymousSlotCount;
+        newOffset = m_propertyTable->keyCount + m_anonymousSlotCount;
     m_propertyTable->entries()[entryIndex - 1].offset = newOffset;
-
+    
+    ASSERT(newOffset >= m_anonymousSlotCount);
     ++m_propertyTable->keyCount;
 
     if ((m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount) * 2 >= m_propertyTable->size)
@@ -822,14 +954,9 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
     return newOffset;
 }
 
-void Structure::addAnonymousSlots(unsigned count)
-{
-    m_propertyTable->anonymousSlotCount += count;
-}
-
 bool Structure::hasTransition(UString::Rep* rep, unsigned attributes)
 {
-    return table.hasTransition(make_pair(rep, attributes));
+    return transitionTableHasTransition(make_pair(rep, attributes));
 }
 
 size_t Structure::remove(const Identifier& propertyName)
@@ -849,7 +976,7 @@ size_t Structure::remove(const Identifier& propertyName)
 #endif
 
     // Find the thing to remove.
-    unsigned i = rep->computedHash();
+    unsigned i = rep->existingHash();
     unsigned k = 0;
     unsigned entryIndex;
     UString::Rep* key = 0;
@@ -863,7 +990,7 @@ size_t Structure::remove(const Identifier& propertyName)
             break;
 
         if (k == 0) {
-            k = 1 | doubleHash(rep->computedHash());
+            k = 1 | doubleHash(rep->existingHash());
 #if DUMP_PROPERTYMAP_STATS
             ++numCollisions;
 #endif
@@ -881,6 +1008,7 @@ size_t Structure::remove(const Identifier& propertyName)
     m_propertyTable->entryIndices[i & m_propertyTable->sizeMask] = deletedSentinelIndex;
 
     size_t offset = m_propertyTable->entries()[entryIndex - 1].offset;
+    ASSERT(offset >= m_anonymousSlotCount);
 
     key->deref();
     m_propertyTable->entries()[entryIndex - 1].key = 0;
@@ -906,8 +1034,8 @@ size_t Structure::remove(const Identifier& propertyName)
 void Structure::insertIntoPropertyMapHashTable(const PropertyMapEntry& entry)
 {
     ASSERT(m_propertyTable);
-
-    unsigned i = entry.key->computedHash();
+    ASSERT(entry.offset >= m_anonymousSlotCount);
+    unsigned i = entry.key->existingHash();
     unsigned k = 0;
 
 #if DUMP_PROPERTYMAP_STATS
@@ -920,7 +1048,7 @@ void Structure::insertIntoPropertyMapHashTable(const PropertyMapEntry& entry)
             break;
 
         if (k == 0) {
-            k = 1 | doubleHash(entry.key->computedHash());
+            k = 1 | doubleHash(entry.key->existingHash());
 #if DUMP_PROPERTYMAP_STATS
             ++numCollisions;
 #endif
@@ -985,7 +1113,6 @@ void Structure::rehashPropertyMapHashTable(unsigned newTableSize)
     m_propertyTable = static_cast<PropertyMapHashTable*>(fastZeroedMalloc(PropertyMapHashTable::allocationSize(newTableSize)));
     m_propertyTable->size = newTableSize;
     m_propertyTable->sizeMask = newTableSize - 1;
-    m_propertyTable->anonymousSlotCount = oldTable->anonymousSlotCount;
 
     unsigned lastIndexUsed = 0;
     unsigned entryCount = oldTable->keyCount + oldTable->deletedSentinelCount;
@@ -1003,7 +1130,7 @@ void Structure::rehashPropertyMapHashTable(unsigned newTableSize)
     checkConsistency();
 }
 
-static int comparePropertyMapEntryIndices(const void* a, const void* b)
+int comparePropertyMapEntryIndices(const void* a, const void* b)
 {
     unsigned ia = static_cast<PropertyMapEntry* const*>(a)[0]->index;
     unsigned ib = static_cast<PropertyMapEntry* const*>(b)[0]->index;
@@ -1014,7 +1141,7 @@ static int comparePropertyMapEntryIndices(const void* a, const void* b)
     return 0;
 }
 
-void Structure::getEnumerablePropertyNames(PropertyNameArray& propertyNames)
+void Structure::getPropertyNames(PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     materializePropertyMapIfNecessary();
     if (!m_propertyTable)
@@ -1025,7 +1152,8 @@ void Structure::getEnumerablePropertyNames(PropertyNameArray& propertyNames)
         int i = 0;
         unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
         for (unsigned k = 1; k <= entryCount; k++) {
-            if (m_propertyTable->entries()[k].key && !(m_propertyTable->entries()[k].attributes & DontEnum)) {
+            ASSERT(m_hasNonEnumerableProperties || !(m_propertyTable->entries()[k].attributes & DontEnum));
+            if (m_propertyTable->entries()[k].key && (!(m_propertyTable->entries()[k].attributes & DontEnum) || (mode == IncludeDontEnumProperties))) {
                 PropertyMapEntry* value = &m_propertyTable->entries()[k];
                 int j;
                 for (j = i - 1; j >= 0 && a[j]->index > value->index; --j)
@@ -1052,7 +1180,7 @@ void Structure::getEnumerablePropertyNames(PropertyNameArray& propertyNames)
     PropertyMapEntry** p = sortedEnumerables.data();
     unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
     for (unsigned i = 1; i <= entryCount; i++) {
-        if (m_propertyTable->entries()[i].key && !(m_propertyTable->entries()[i].attributes & DontEnum))
+        if (m_propertyTable->entries()[i].key && (!(m_propertyTable->entries()[i].attributes & DontEnum) || (mode == IncludeDontEnumProperties)))
             *p++ = &m_propertyTable->entries()[i];
     }
 
@@ -1112,11 +1240,13 @@ void Structure::checkConsistency()
 
     unsigned nonEmptyEntryCount = 0;
     for (unsigned c = 1; c <= m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount; ++c) {
+        ASSERT(m_hasNonEnumerableProperties || !(m_propertyTable->entries()[c].attributes & DontEnum));
         UString::Rep* rep = m_propertyTable->entries()[c].key;
+        ASSERT(m_propertyTable->entries()[c].offset >= m_anonymousSlotCount);
         if (!rep)
             continue;
         ++nonEmptyEntryCount;
-        unsigned i = rep->computedHash();
+        unsigned i = rep->existingHash();
         unsigned k = 0;
         unsigned entryIndex;
         while (1) {
@@ -1125,7 +1255,7 @@ void Structure::checkConsistency()
             if (rep == m_propertyTable->entries()[entryIndex - 1].key)
                 break;
             if (k == 0)
-                k = 1 | doubleHash(rep->computedHash());
+                k = 1 | doubleHash(rep->existingHash());
             i += k;
         }
         ASSERT(entryIndex == c + 1);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
index f355c532d4..968443a828 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
@@ -36,6 +36,7 @@
 #include "StructureTransitionTable.h"
 #include "JSTypeInfo.h"
 #include "UString.h"
+#include "WeakGCPtr.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
@@ -51,13 +52,18 @@ namespace JSC {
     class PropertyNameArray;
     class PropertyNameArrayData;
 
+    enum EnumerationMode {
+        ExcludeDontEnumProperties,
+        IncludeDontEnumProperties
+    };
+
     class Structure : public RefCounted<Structure> {
     public:
         friend class JIT;
         friend class StructureTransitionTable;
-        static PassRefPtr<Structure> create(JSValue prototype, const TypeInfo& typeInfo)
+        static PassRefPtr<Structure> create(JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount)
         {
-            return adoptRef(new Structure(prototype, typeInfo));
+            return adoptRef(new Structure(prototype, typeInfo, anonymousSlotCount));
         }
 
         static void startIgnoringLeaks();
@@ -70,11 +76,11 @@ namespace JSC {
         static PassRefPtr<Structure> removePropertyTransition(Structure*, const Identifier& propertyName, size_t& offset);
         static PassRefPtr<Structure> changePrototypeTransition(Structure*, JSValue prototype);
         static PassRefPtr<Structure> despecifyFunctionTransition(Structure*, const Identifier&);
-        static PassRefPtr<Structure> addAnonymousSlotsTransition(Structure*, unsigned count);
         static PassRefPtr<Structure> getterSetterTransition(Structure*);
         static PassRefPtr<Structure> toCacheableDictionaryTransition(Structure*);
         static PassRefPtr<Structure> toUncacheableDictionaryTransition(Structure*);
-        static PassRefPtr<Structure> fromDictionaryTransition(Structure*);
+
+        PassRefPtr<Structure> flattenDictionaryStructure(JSObject*);
 
         ~Structure();
 
@@ -96,7 +102,7 @@ namespace JSC {
 
         void growPropertyStorageCapacity();
         unsigned propertyStorageCapacity() const { return m_propertyStorageCapacity; }
-        unsigned propertyStorageSize() const { return m_propertyTable ? m_propertyTable->keyCount + m_propertyTable->anonymousSlotCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : m_offset + 1; }
+        unsigned propertyStorageSize() const { return m_anonymousSlotCount + (m_propertyTable ? m_propertyTable->keyCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : static_cast<unsigned>(m_offset + 1)); }
         bool isUsingInlineStorage() const;
 
         size_t get(const Identifier& propertyName);
@@ -121,19 +127,22 @@ namespace JSC {
 
         bool hasNonEnumerableProperties() const { return m_hasNonEnumerableProperties; }
 
-        bool hasAnonymousSlots() const { return m_propertyTable && m_propertyTable->anonymousSlotCount; }
+        bool hasAnonymousSlots() const { return !!m_anonymousSlotCount; }
+        unsigned anonymousSlotCount() const { return m_anonymousSlotCount; }
         
         bool isEmpty() const { return m_propertyTable ? !m_propertyTable->keyCount : m_offset == noOffset; }
 
-        JSCell* specificValue() { return m_specificValueInPrevious; }
         void despecifyDictionaryFunction(const Identifier& propertyName);
+        void disableSpecificFunctionTracking() { m_specificFunctionThrashCount = maxSpecificFunctionThrashCount; }
 
         void setEnumerationCache(JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
-        JSPropertyNameIterator* enumerationCache() { return m_enumerationCache.get(); }
-        void getEnumerablePropertyNames(PropertyNameArray&);
-
+        void clearEnumerationCache(JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
+        JSPropertyNameIterator* enumerationCache(); // Defined in JSPropertyNameIterator.h.
+        void getPropertyNames(PropertyNameArray&, EnumerationMode mode);
+        
     private:
-        Structure(JSValue prototype, const TypeInfo&);
+
+        Structure(JSValue prototype, const TypeInfo&, unsigned anonymousSlotCount);
         
         typedef enum { 
             NoneDictionaryKind = 0,
@@ -144,7 +153,6 @@ namespace JSC {
 
         size_t put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t remove(const Identifier& propertyName);
-        void addAnonymousSlots(unsigned slotCount);
 
         void expandPropertyMapHashTable();
         void rehashPropertyMapHashTable();
@@ -155,6 +163,7 @@ namespace JSC {
         void checkConsistency();
 
         bool despecifyFunction(const Identifier&);
+        void despecifyAllFunctions();
 
         PropertyMapHashTable* copyPropertyTable();
         void materializePropertyMap();
@@ -170,6 +179,20 @@ namespace JSC {
             // Since the number of transitions is always the same as m_offset, we keep the size of Structure down by not storing both.
             return m_offset == noOffset ? 0 : m_offset + 1;
         }
+
+        typedef std::pair<Structure*, Structure*> Transition;
+        typedef HashMap<StructureTransitionTableHash::Key, Transition, StructureTransitionTableHash, StructureTransitionTableHashTraits> TransitionTable;
+
+        inline bool transitionTableContains(const StructureTransitionTableHash::Key& key, JSCell* specificValue);
+        inline void transitionTableRemove(const StructureTransitionTableHash::Key& key, JSCell* specificValue);
+        inline void transitionTableAdd(const StructureTransitionTableHash::Key& key, Structure* structure, JSCell* specificValue);
+        inline bool transitionTableHasTransition(const StructureTransitionTableHash::Key& key) const;
+        inline Structure* transitionTableGet(const StructureTransitionTableHash::Key& key, JSCell* specificValue) const;
+
+        TransitionTable* transitionTable() const { ASSERT(!m_isUsingSingleSlot); return m_transitions.m_table; }
+        inline void setTransitionTable(TransitionTable* table);
+        Structure* singleTransition() const { ASSERT(m_isUsingSingleSlot); return m_transitions.m_singleTransition; }
+        void setSingleTransition(Structure* structure) { ASSERT(m_isUsingSingleSlot); m_transitions.m_singleTransition = structure; }
         
         bool isValid(ExecState*, StructureChain* cachedPrototypeChain) const;
 
@@ -179,6 +202,8 @@ namespace JSC {
 
         static const signed char noOffset = -1;
 
+        static const unsigned maxSpecificFunctionThrashCount = 3;
+
         TypeInfo m_typeInfo;
 
         JSValue m_prototype;
@@ -188,13 +213,19 @@ namespace JSC {
         RefPtr<UString::Rep> m_nameInPrevious;
         JSCell* m_specificValueInPrevious;
 
-        StructureTransitionTable table;
+        // 'm_isUsingSingleSlot' indicates whether we are using the single transition optimisation.
+        union {
+            TransitionTable* m_table;
+            Structure* m_singleTransition;
+        } m_transitions;
 
-        ProtectedPtr<JSPropertyNameIterator> m_enumerationCache;
+        WeakGCPtr<JSPropertyNameIterator> m_enumerationCache;
 
         PropertyMapHashTable* m_propertyTable;
 
         uint32_t m_propertyStorageCapacity;
+
+        // m_offset does not account for anonymous slots
         signed char m_offset;
 
         unsigned m_dictionaryKind : 2;
@@ -209,7 +240,10 @@ namespace JSC {
 #else
         unsigned m_attributesInPrevious : 7;
 #endif
-        unsigned m_anonymousSlotsInPrevious : 6;
+        unsigned m_specificFunctionThrashCount : 2;
+        unsigned m_anonymousSlotCount : 5;
+        unsigned m_isUsingSingleSlot : 1;
+        // 4 free bits
     };
 
     inline size_t Structure::get(const Identifier& propertyName)
@@ -222,7 +256,7 @@ namespace JSC {
 
         UString::Rep* rep = propertyName._ustring.rep();
 
-        unsigned i = rep->computedHash();
+        unsigned i = rep->existingHash();
 
 #if DUMP_PROPERTYMAP_STATS
         ++numProbes;
@@ -239,7 +273,7 @@ namespace JSC {
         ++numCollisions;
 #endif
 
-        unsigned k = 1 | WTF::doubleHash(rep->computedHash());
+        unsigned k = 1 | WTF::doubleHash(rep->existingHash());
 
         while (1) {
             i += k;
@@ -256,58 +290,7 @@ namespace JSC {
                 return m_propertyTable->entries()[entryIndex - 1].offset;
         }
     }
-    
-    bool StructureTransitionTable::contains(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
-    {
-        if (usingSingleTransitionSlot()) {
-            Structure* existingTransition = singleTransition();
-            return existingTransition && existingTransition->m_nameInPrevious.get() == key.first
-                   && existingTransition->m_attributesInPrevious == key.second
-                   && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0);
-        }
-        TransitionTable::iterator find = table()->find(key);
-        if (find == table()->end())
-            return false;
 
-        return find->second.first || find->second.second->transitionedFor(specificValue);
-    }
-
-    Structure* StructureTransitionTable::get(const StructureTransitionTableHash::Key& key, JSCell* specificValue) const
-    {
-        if (usingSingleTransitionSlot()) {
-            Structure* existingTransition = singleTransition();
-            if (existingTransition && existingTransition->m_nameInPrevious.get() == key.first
-                && existingTransition->m_attributesInPrevious == key.second
-                && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0))
-                return existingTransition;
-            return 0;
-        }
-
-        Transition transition = table()->get(key);
-        if (transition.second && transition.second->transitionedFor(specificValue))
-            return transition.second;
-        return transition.first;
-    }
-
-    bool StructureTransitionTable::hasTransition(const StructureTransitionTableHash::Key& key) const
-    {
-        if (usingSingleTransitionSlot()) {
-            Structure* transition = singleTransition();
-            return transition && transition->m_nameInPrevious == key.first
-            && transition->m_attributesInPrevious == key.second;
-        }
-        return table()->contains(key);
-    }
-    
-    void StructureTransitionTable::reifySingleTransition()
-    {
-        ASSERT(usingSingleTransitionSlot());
-        Structure* existingTransition = singleTransition();
-        TransitionTable* transitionTable = new TransitionTable;
-        setTransitionTable(transitionTable);
-        if (existingTransition)
-            add(make_pair(existingTransition->m_nameInPrevious.get(), existingTransition->m_attributesInPrevious), existingTransition, existingTransition->m_specificValueInPrevious);
-    }
 } // namespace JSC
 
 #endif // Structure_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
index f39560a777..d1dc2d9c64 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
@@ -30,7 +30,6 @@
 #include <wtf/HashFunctions.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashTraits.h>
-#include <wtf/PtrAndFlags.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 
@@ -42,7 +41,7 @@ namespace JSC {
         typedef std::pair<RefPtr<UString::Rep>, unsigned> Key;
         static unsigned hash(const Key& p)
         {
-            return p.first->computedHash();
+            return p.first->existingHash();
         }
 
         static bool equal(const Key& a, const Key& b)
@@ -67,148 +66,6 @@ namespace JSC {
         static bool isDeletedValue(const TraitType& value) { return FirstTraits::isDeletedValue(value.first); }
     };
 
-    class StructureTransitionTable {
-        typedef std::pair<Structure*, Structure*> Transition;
-        struct TransitionTable : public HashMap<StructureTransitionTableHash::Key, Transition, StructureTransitionTableHash, StructureTransitionTableHashTraits> {
-            typedef HashMap<unsigned, Structure*> AnonymousSlotMap;
-
-            void addSlotTransition(unsigned count, Structure* structure)
-            {
-                ASSERT(!getSlotTransition(count));
-                if (!m_anonymousSlotTable)
-                    m_anonymousSlotTable.set(new AnonymousSlotMap);
-                m_anonymousSlotTable->add(count, structure);
-            }
-
-            void removeSlotTransition(unsigned count)
-            {
-                ASSERT(getSlotTransition(count));
-                m_anonymousSlotTable->remove(count);
-            }
-
-            Structure* getSlotTransition(unsigned count)
-            {
-                if (!m_anonymousSlotTable)
-                    return 0;
-
-                AnonymousSlotMap::iterator find = m_anonymousSlotTable->find(count);
-                if (find == m_anonymousSlotTable->end())
-                    return 0;
-                return find->second;
-            }
-        private:
-            OwnPtr<AnonymousSlotMap> m_anonymousSlotTable;
-        };
-    public:
-        StructureTransitionTable() {
-            m_transitions.m_singleTransition.set(0);
-            m_transitions.m_singleTransition.setFlag(usingSingleSlot);
-        }
-
-        ~StructureTransitionTable() {
-            if (!usingSingleTransitionSlot())
-                delete table();
-        }
-
-        // The contains and get methods accept imprecise matches, so if an unspecialised transition exists
-        // for the given key they will consider that transition to be a match.  If a specialised transition
-        // exists and it matches the provided specificValue, get will return the specific transition.
-        inline bool contains(const StructureTransitionTableHash::Key&, JSCell* specificValue);
-        inline Structure* get(const StructureTransitionTableHash::Key&, JSCell* specificValue) const;
-        inline bool hasTransition(const StructureTransitionTableHash::Key& key) const;
-        void remove(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
-        {
-            if (usingSingleTransitionSlot()) {
-                ASSERT(contains(key, specificValue));
-                setSingleTransition(0);
-                return;
-            }
-            TransitionTable::iterator find = table()->find(key);
-            if (!specificValue)
-                find->second.first = 0;
-            else
-                find->second.second = 0;
-            if (!find->second.first && !find->second.second)
-                table()->remove(find);
-        }
-        void add(const StructureTransitionTableHash::Key& key, Structure* structure, JSCell* specificValue)
-        {
-            if (usingSingleTransitionSlot()) {
-                if (!singleTransition()) {
-                    setSingleTransition(structure);
-                    return;
-                }
-                reifySingleTransition();
-            }
-            if (!specificValue) {
-                TransitionTable::iterator find = table()->find(key);
-                if (find == table()->end())
-                    table()->add(key, Transition(structure, (Structure*)0));
-                else
-                    find->second.first = structure;
-            } else {
-                // If we're adding a transition to a specific value, then there cannot be
-                // an existing transition
-                ASSERT(!table()->contains(key));
-                table()->add(key, Transition((Structure*)0, structure));
-            }
-        }
-
-        Structure* getAnonymousSlotTransition(unsigned count)
-        {
-            if (usingSingleTransitionSlot())
-                return 0;
-            return table()->getSlotTransition(count);
-        }
-
-        void addAnonymousSlotTransition(unsigned count, Structure* structure)
-        {
-            if (usingSingleTransitionSlot())
-                reifySingleTransition();
-            ASSERT(!table()->getSlotTransition(count));
-            table()->addSlotTransition(count, structure);
-        }
-        
-        void removeAnonymousSlotTransition(unsigned count)
-        {
-            ASSERT(!usingSingleTransitionSlot());
-            table()->removeSlotTransition(count);
-        }
-    private:
-        TransitionTable* table() const { ASSERT(!usingSingleTransitionSlot()); return m_transitions.m_table; }
-        Structure* singleTransition() const {
-            ASSERT(usingSingleTransitionSlot());
-            return m_transitions.m_singleTransition.get();
-        }
-        bool usingSingleTransitionSlot() const { return m_transitions.m_singleTransition.isFlagSet(usingSingleSlot); }
-        void setSingleTransition(Structure* structure)
-        { 
-            ASSERT(usingSingleTransitionSlot());
-            m_transitions.m_singleTransition.set(structure);
-        }
-
-        void setTransitionTable(TransitionTable* table)
-        {
-            ASSERT(usingSingleTransitionSlot());
-#ifndef NDEBUG
-            setSingleTransition(0);
-#endif
-            m_transitions.m_table = table;
-            // This implicitly clears the flag that indicates we're using a single transition
-            ASSERT(!usingSingleTransitionSlot());
-        }
-        inline void reifySingleTransition();
-
-        enum UsingSingleSlot {
-            usingSingleSlot
-        };
-        // Last bit indicates whether we are using the single transition optimisation
-        union {
-            TransitionTable* m_table;
-            PtrAndFlagsBase<Structure, UsingSingleSlot> m_singleTransition;
-        } m_transitions;
-    };
-
 } // namespace JSC
 
 #endif // StructureTransitionTable_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
index 2a056c9d5c..2dc1028d39 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
@@ -33,14 +33,18 @@
 #include "CallFrame.h"
 #include "JSGlobalObject.h"
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 #include <mach/mach.h>
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 #include <windows.h>
 #else
 #include "CurrentTime.h"
 #endif
 
+#if PLATFORM(BREWMP)
+#include <AEEStdLib.h>
+#endif
+
 using namespace std;
 
 namespace JSC {
@@ -54,7 +58,7 @@ static const int intervalBetweenChecks = 1000;
 // Returns the time the current thread has spent executing, in milliseconds.
 static inline unsigned getCPUTime()
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     mach_msg_type_number_t infoCount = THREAD_BASIC_INFO_COUNT;
     thread_basic_info_data_t info;
 
@@ -67,7 +71,7 @@ static inline unsigned getCPUTime()
     time += info.system_time.seconds * 1000 + info.system_time.microseconds / 1000;
     
     return time;
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
     union {
         FILETIME fileTime;
         unsigned long long fileTimeAsLong;
@@ -80,6 +84,18 @@ static inline unsigned getCPUTime()
     GetThreadTimes(GetCurrentThread(), &creationTime, &exitTime, &kernelTime.fileTime, &userTime.fileTime);
     
     return userTime.fileTimeAsLong / 10000 + kernelTime.fileTimeAsLong / 10000;
+#elif OS(SYMBIAN)
+    RThread current;
+    TTimeIntervalMicroSeconds cpuTime;
+
+    TInt err = current.GetCpuTime(cpuTime);
+    ASSERT_WITH_MESSAGE(err == KErrNone, "GetCpuTime failed with %d", err);
+    return cpuTime.Int64() / 1000;
+#elif PLATFORM(BREWMP)
+    // This function returns a continuously and linearly increasing millisecond
+    // timer from the time the device was powered on.
+    // There is only one thread in BREW, so this is enough.
+    return GETUPTIMEMS();
 #else
     // FIXME: We should return the time the current thread has spent executing.
     return currentTime() * 1000;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h
index 5925641f80..7bfa6d0830 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h
@@ -40,7 +40,6 @@ namespace JSC {
         TimeoutChecker();
 
         void setTimeoutInterval(unsigned timeoutInterval) { m_timeoutInterval = timeoutInterval; }
-        unsigned timeoutInterval() const { return m_timeoutInterval; }
         
         unsigned ticksUntilNextCheck() { return m_ticksUntilNextCheck; }
         
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Tracing.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Tracing.h
index e544f66926..c28c85f614 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Tracing.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Tracing.h
@@ -33,7 +33,7 @@
 #define JAVASCRIPTCORE_GC_BEGIN()
 #define JAVASCRIPTCORE_GC_BEGIN_ENABLED() 0
 
-#define JAVASCRIPTCORE_GC_END(arg0, arg1)
+#define JAVASCRIPTCORE_GC_END()
 #define JAVASCRIPTCORE_GC_END_ENABLED() 0
 
 #define JAVASCRIPTCORE_GC_MARKED()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
index e66ca93b84..9da669d25b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
@@ -30,12 +30,12 @@
 #include "Identifier.h"
 #include "Operations.h"
 #include <ctype.h>
-#include <float.h>
 #include <limits.h>
 #include <limits>
 #include <math.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
@@ -44,9 +44,6 @@
 #include <wtf/unicode/UTF8.h>
 #include <wtf/StringExtras.h>
 
-#if HAVE(STRING_H)
-#include <string.h>
-#endif
 #if HAVE(STRINGS_H)
 #include <strings.h>
 #endif
@@ -55,52 +52,11 @@ using namespace WTF;
 using namespace WTF::Unicode;
 using namespace std;
 
-// This can be tuned differently per platform by putting platform #ifs right here.
-// If you don't define this macro at all, then copyChars will just call directly
-// to memcpy.
-#define USTRING_COPY_CHARS_INLINE_CUTOFF 20
-
 namespace JSC {
- 
+
 extern const double NaN;
 extern const double Inf;
 
-// This number must be at least 2 to avoid sharing empty, null as well as 1 character strings from SmallStrings.
-static const int minLengthToShare = 10;
-
-static inline size_t overflowIndicator() { return std::numeric_limits<size_t>::max(); }
-static inline size_t maxUChars() { return std::numeric_limits<size_t>::max() / sizeof(UChar); }
-
-static inline PossiblyNull<UChar*> allocChars(size_t length)
-{
-    ASSERT(length);
-    if (length > maxUChars())
-        return 0;
-    return tryFastMalloc(sizeof(UChar) * length);
-}
-
-static inline PossiblyNull<UChar*> reallocChars(UChar* buffer, size_t length)
-{
-    ASSERT(length);
-    if (length > maxUChars())
-        return 0;
-    return tryFastRealloc(buffer, sizeof(UChar) * length);
-}
-
-static inline void copyChars(UChar* destination, const UChar* source, unsigned numCharacters)
-{
-#ifdef USTRING_COPY_CHARS_INLINE_CUTOFF
-    if (numCharacters <= USTRING_COPY_CHARS_INLINE_CUTOFF) {
-        for (unsigned i = 0; i < numCharacters; ++i)
-            destination[i] = source[i];
-        return;
-    }
-#endif
-    memcpy(destination, source, numCharacters * sizeof(UChar));
-}
-
-COMPILE_ASSERT(sizeof(UChar) == 2, uchar_is_2_bytes);
-
 CString::CString(const char* c)
     : m_length(strlen(c))
     , m_data(new char[m_length + 1])
@@ -190,728 +146,33 @@ bool operator==(const CString& c1, const CString& c2)
     return len == c2.size() && (len == 0 || memcmp(c1.c_str(), c2.c_str(), len) == 0);
 }
 
-// These static strings are immutable, except for rc, whose initial value is chosen to 
-// reduce the possibility of it becoming zero due to ref/deref not being thread-safe.
-static UChar sharedEmptyChar;
-UString::BaseString* UString::Rep::nullBaseString;
-UString::BaseString* UString::Rep::emptyBaseString;
-UString* UString::nullUString;
-
-static void initializeStaticBaseString(UString::BaseString& base)
-{
-    base.rc = INT_MAX / 2;
-    base.m_identifierTableAndFlags.setFlag(UString::Rep::StaticFlag);
-    base.checkConsistency();
-}
+// The null string is immutable, except for refCount.
+UString::Rep* UString::s_nullRep;
+UString* UString::s_nullUString;
 
 void initializeUString()
 {
-    UString::Rep::nullBaseString = new UString::BaseString(0, 0);
-    initializeStaticBaseString(*UString::Rep::nullBaseString);
-
-    UString::Rep::emptyBaseString = new UString::BaseString(&sharedEmptyChar, 0);
-    initializeStaticBaseString(*UString::Rep::emptyBaseString);
-
-    UString::nullUString = new UString;
-}
-
-static char* statBuffer = 0; // Only used for debugging via UString::ascii().
-
-PassRefPtr<UString::Rep> UString::Rep::createCopying(const UChar* d, int l)
-{
-    UChar* copyD = static_cast<UChar*>(fastMalloc(l * sizeof(UChar)));
-    copyChars(copyD, d, l);
-    return create(copyD, l);
-}
-
-PassRefPtr<UString::Rep> UString::Rep::createFromUTF8(const char* string)
-{
-    if (!string)
-        return &UString::Rep::null();
-
-    size_t length = strlen(string);
-    Vector<UChar, 1024> buffer(length);
-    UChar* p = buffer.data();
-    if (conversionOK != convertUTF8ToUTF16(&string, string + length, &p, p + length))
-        return &UString::Rep::null();
-
-    return UString::Rep::createCopying(buffer.data(), p - buffer.data());
-}
-
-PassRefPtr<UString::Rep> UString::Rep::create(UChar* string, int length, PassRefPtr<UString::SharedUChar> sharedBuffer)
-{
-    PassRefPtr<UString::Rep> rep = create(string, length);
-    rep->baseString()->setSharedBuffer(sharedBuffer);
-    rep->checkConsistency();
-    return rep;
-}
-
-UString::SharedUChar* UString::Rep::sharedBuffer()
-{
-    UString::BaseString* base = baseString();
-    if (len < minLengthToShare)
-        return 0;
-
-    return base->sharedBuffer();
-}
-
-void UString::Rep::destroy()
-{
-    checkConsistency();
-
-    // Static null and empty strings can never be destroyed, but we cannot rely on 
-    // reference counting, because ref/deref are not thread-safe.
-    if (!isStatic()) {
-        if (identifierTable())
-            Identifier::remove(this);
-
-        UString::BaseString* base = baseString();
-        if (base == this) {
-            if (m_sharedBuffer)
-                m_sharedBuffer->deref();
-            else
-                fastFree(base->buf);
-        } else
-            base->deref();
-
-        delete this;
-    }
-}
-
-// Golden ratio - arbitrary start value to avoid mapping all 0's to all 0's
-// or anything like that.
-const unsigned PHI = 0x9e3779b9U;
-
-// Paul Hsieh's SuperFastHash
-// http://www.azillionmonkeys.com/qed/hash.html
-unsigned UString::Rep::computeHash(const UChar* s, int len)
-{
-    unsigned l = len;
-    uint32_t hash = PHI;
-    uint32_t tmp;
-
-    int rem = l & 1;
-    l >>= 1;
-
-    // Main loop
-    for (; l > 0; l--) {
-        hash += s[0];
-        tmp = (s[1] << 11) ^ hash;
-        hash = (hash << 16) ^ tmp;
-        s += 2;
-        hash += hash >> 11;
-    }
-
-    // Handle end case
-    if (rem) {
-        hash += s[0];
-        hash ^= hash << 11;
-        hash += hash >> 17;
-    }
-
-    // Force "avalanching" of final 127 bits
-    hash ^= hash << 3;
-    hash += hash >> 5;
-    hash ^= hash << 2;
-    hash += hash >> 15;
-    hash ^= hash << 10;
-
-    // this avoids ever returning a hash code of 0, since that is used to
-    // signal "hash not computed yet", using a value that is likely to be
-    // effectively the same as 0 when the low bits are masked
-    if (hash == 0)
-        hash = 0x80000000;
-
-    return hash;
-}
-
-// Paul Hsieh's SuperFastHash
-// http://www.azillionmonkeys.com/qed/hash.html
-unsigned UString::Rep::computeHash(const char* s, int l)
-{
-    // This hash is designed to work on 16-bit chunks at a time. But since the normal case
-    // (above) is to hash UTF-16 characters, we just treat the 8-bit chars as if they
-    // were 16-bit chunks, which should give matching results
-
-    uint32_t hash = PHI;
-    uint32_t tmp;
-
-    size_t rem = l & 1;
-    l >>= 1;
-
-    // Main loop
-    for (; l > 0; l--) {
-        hash += static_cast<unsigned char>(s[0]);
-        tmp = (static_cast<unsigned char>(s[1]) << 11) ^ hash;
-        hash = (hash << 16) ^ tmp;
-        s += 2;
-        hash += hash >> 11;
-    }
-
-    // Handle end case
-    if (rem) {
-        hash += static_cast<unsigned char>(s[0]);
-        hash ^= hash << 11;
-        hash += hash >> 17;
-    }
-
-    // Force "avalanching" of final 127 bits
-    hash ^= hash << 3;
-    hash += hash >> 5;
-    hash ^= hash << 2;
-    hash += hash >> 15;
-    hash ^= hash << 10;
-
-    // this avoids ever returning a hash code of 0, since that is used to
-    // signal "hash not computed yet", using a value that is likely to be
-    // effectively the same as 0 when the low bits are masked
-    if (hash == 0)
-        hash = 0x80000000;
-
-    return hash;
-}
-
-#ifndef NDEBUG
-void UString::Rep::checkConsistency() const
-{
-    const UString::BaseString* base = baseString();
-
-    // There is no recursion for base strings.
-    ASSERT(base == base->baseString());
-
-    if (isStatic()) {
-        // There are only two static strings: null and empty.
-        ASSERT(!len);
-
-        // Static strings cannot get in identifier tables, because they are globally shared.
-        ASSERT(!identifierTable());
-    }
-
-    // The string fits in buffer.
-    ASSERT(base->usedPreCapacity <= base->preCapacity);
-    ASSERT(base->usedCapacity <= base->capacity);
-    ASSERT(-offset <= base->usedPreCapacity);
-    ASSERT(offset + len <= base->usedCapacity);
-}
-#endif
-
-UString::SharedUChar* UString::BaseString::sharedBuffer()
-{
-    if (!m_sharedBuffer)
-        setSharedBuffer(SharedUChar::create(new OwnFastMallocPtr<UChar>(buf)));
-    return m_sharedBuffer;
-}
-
-void UString::BaseString::setSharedBuffer(PassRefPtr<UString::SharedUChar> sharedBuffer)
-{
-    // The manual steps below are because m_sharedBuffer can't be a RefPtr. m_sharedBuffer
-    // is in a union with another variable to avoid making BaseString any larger.
-    if (m_sharedBuffer)
-        m_sharedBuffer->deref();
-    m_sharedBuffer = sharedBuffer.releaseRef();
-}
-
-bool UString::BaseString::slowIsBufferReadOnly()
-{
-    // The buffer may not be modified as soon as the underlying data has been shared with another class.
-    if (m_sharedBuffer->isShared())
-        return true;
-
-    // At this point, we know it that the underlying buffer isn't shared outside of this base class,
-    // so get rid of m_sharedBuffer.
-    OwnPtr<OwnFastMallocPtr<UChar> > mallocPtr(m_sharedBuffer->release());
-    UChar* unsharedBuf = const_cast<UChar*>(mallocPtr->release());
-    setSharedBuffer(0);
-    preCapacity += (buf - unsharedBuf);
-    buf = unsharedBuf;
-    return false;
-}
-
-// Put these early so they can be inlined.
-static inline size_t expandedSize(size_t capacitySize, size_t precapacitySize)
-{
-    // Combine capacitySize & precapacitySize to produce a single size to allocate,
-    // check that doing so does not result in overflow.
-    size_t size = capacitySize + precapacitySize;
-    if (size < capacitySize)
-        return overflowIndicator();
-
-    // Small Strings (up to 4 pages):
-    // Expand the allocation size to 112.5% of the amount requested.  This is largely sicking
-    // to our previous policy, however 112.5% is cheaper to calculate.
-    if (size < 0x4000) {
-        size_t expandedSize = ((size + (size >> 3)) | 15) + 1;
-        // Given the limited range within which we calculate the expansion in this
-        // fashion the above calculation should never overflow.
-        ASSERT(expandedSize >= size);
-        ASSERT(expandedSize < maxUChars());
-        return expandedSize;
-    }
-
-    // Medium Strings (up to 128 pages):
-    // For pages covering multiple pages over-allocation is less of a concern - any unused
-    // space will not be paged in if it is not used, so this is purely a VM overhead.  For
-    // these strings allocate 2x the requested size.
-    if (size < 0x80000) {
-        size_t expandedSize = ((size + size) | 0xfff) + 1;
-        // Given the limited range within which we calculate the expansion in this
-        // fashion the above calculation should never overflow.
-        ASSERT(expandedSize >= size);
-        ASSERT(expandedSize < maxUChars());
-        return expandedSize;
-    }
-
-    // Large Strings (to infinity and beyond!):
-    // Revert to our 112.5% policy - probably best to limit the amount of unused VM we allow
-    // any individual string be responsible for.
-    size_t expandedSize = ((size + (size >> 3)) | 0xfff) + 1;
-
-    // Check for overflow - any result that is at least as large as requested (but
-    // still below the limit) is okay.
-    if ((expandedSize >= size) && (expandedSize < maxUChars()))
-        return expandedSize;
-    return overflowIndicator();
-}
-
-static inline bool expandCapacity(UString::Rep* rep, int requiredLength)
-{
-    rep->checkConsistency();
-    ASSERT(!rep->baseString()->isBufferReadOnly());
-
-    UString::BaseString* base = rep->baseString();
-
-    if (requiredLength > base->capacity) {
-        size_t newCapacity = expandedSize(requiredLength, base->preCapacity);
-        UChar* oldBuf = base->buf;
-        if (!reallocChars(base->buf, newCapacity).getValue(base->buf)) {
-            base->buf = oldBuf;
-            return false;
-        }
-        base->capacity = newCapacity - base->preCapacity;
-    }
-    if (requiredLength > base->usedCapacity)
-        base->usedCapacity = requiredLength;
-
-    rep->checkConsistency();
-    return true;
-}
-
-bool UString::Rep::reserveCapacity(int capacity)
-{
-    // If this is an empty string there is no point 'growing' it - just allocate a new one.
-    // If the BaseString is shared with another string that is using more capacity than this
-    // string is, then growing the buffer won't help.
-    // If the BaseString's buffer is readonly, then it isn't allowed to grow.
-    UString::BaseString* base = baseString();
-    if (!base->buf || !base->capacity || (offset + len) != base->usedCapacity || base->isBufferReadOnly())
-        return false;
-    
-    // If there is already sufficient capacity, no need to grow!
-    if (capacity <= base->capacity)
-        return true;
-
-    checkConsistency();
-
-    size_t newCapacity = expandedSize(capacity, base->preCapacity);
-    UChar* oldBuf = base->buf;
-    if (!reallocChars(base->buf, newCapacity).getValue(base->buf)) {
-        base->buf = oldBuf;
-        return false;
-    }
-    base->capacity = newCapacity - base->preCapacity;
-
-    checkConsistency();
-    return true;
-}
-
-void UString::expandCapacity(int requiredLength)
-{
-    if (!JSC::expandCapacity(m_rep.get(), requiredLength))
-        makeNull();
-}
-
-void UString::expandPreCapacity(int requiredPreCap)
-{
-    m_rep->checkConsistency();
-    ASSERT(!m_rep->baseString()->isBufferReadOnly());
-
-    BaseString* base = m_rep->baseString();
-
-    if (requiredPreCap > base->preCapacity) {
-        size_t newCapacity = expandedSize(requiredPreCap, base->capacity);
-        int delta = newCapacity - base->capacity - base->preCapacity;
-
-        UChar* newBuf;
-        if (!allocChars(newCapacity).getValue(newBuf)) {
-            makeNull();
-            return;
-        }
-        copyChars(newBuf + delta, base->buf, base->capacity + base->preCapacity);
-        fastFree(base->buf);
-        base->buf = newBuf;
-
-        base->preCapacity = newCapacity - base->capacity;
-    }
-    if (requiredPreCap > base->usedPreCapacity)
-        base->usedPreCapacity = requiredPreCap;
-
-    m_rep->checkConsistency();
-}
-
-static PassRefPtr<UString::Rep> createRep(const char* c)
-{
-    if (!c)
-        return &UString::Rep::null();
-
-    if (!c[0])
-        return &UString::Rep::empty();
-
-    size_t length = strlen(c);
-    UChar* d;
-    if (!allocChars(length).getValue(d))
-        return &UString::Rep::null();
-    else {
-        for (size_t i = 0; i < length; i++)
-            d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
-        return UString::Rep::create(d, static_cast<int>(length));
-    }
+    // UStringImpl::empty() does not construct its static string in a threadsafe fashion,
+    // so ensure it has been initialized from here.
+    UStringImpl::empty();
 
+    UString::s_nullRep = new UStringImpl(0, 0, UStringImpl::ConstructStaticString);
+    UString::s_nullUString = new UString;
 }
 
 UString::UString(const char* c)
-    : m_rep(createRep(c))
-{
-}
-
-UString::UString(const UChar* c, int length)
+    : m_rep(Rep::create(c))
 {
-    if (length == 0) 
-        m_rep = &Rep::empty();
-    else
-        m_rep = Rep::createCopying(c, length);
 }
 
-UString::UString(UChar* c, int length, bool copy)
+UString::UString(const char* c, unsigned length)
+    : m_rep(Rep::create(c, length))
 {
-    if (length == 0)
-        m_rep = &Rep::empty();
-    else if (copy)
-        m_rep = Rep::createCopying(c, length);
-    else
-        m_rep = Rep::create(c, length);
 }
 
-UString::UString(const Vector<UChar>& buffer)
+UString::UString(const UChar* c, unsigned length)
+    : m_rep(Rep::create(c, length))
 {
-    if (!buffer.size())
-        m_rep = &Rep::empty();
-    else
-        m_rep = Rep::createCopying(buffer.data(), buffer.size());
-}
-
-static ALWAYS_INLINE int newCapacityWithOverflowCheck(const int currentCapacity, const int extendLength, const bool plusOne = false)
-{
-    ASSERT_WITH_MESSAGE(extendLength >= 0, "extendedLength = %d", extendLength);
-
-    const int plusLength = plusOne ? 1 : 0;
-    if (currentCapacity > std::numeric_limits<int>::max() - extendLength - plusLength)
-        CRASH();
-
-    return currentCapacity + extendLength + plusLength;
-}
-
-static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Rep> r, const UChar* tData, int tSize)
-{
-    RefPtr<UString::Rep> rep = r;
-
-    rep->checkConsistency();
-
-    int thisSize = rep->size();
-    int thisOffset = rep->offset;
-    int length = thisSize + tSize;
-    UString::BaseString* base = rep->baseString();
-
-    // possible cases:
-    if (tSize == 0) {
-        // t is empty
-    } else if (thisSize == 0) {
-        // this is empty
-        rep = UString::Rep::createCopying(tData, tSize);
-    } else if (rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
-            rep = &UString::Rep::null();
-        if (rep->data()) {
-            copyChars(rep->data() + thisSize, tData, tSize);
-            rep->len = length;
-            rep->_hash = 0;
-        }
-    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
-        // this reaches the end of the buffer - extend it if it's long enough to append to
-        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
-            rep = &UString::Rep::null();
-        if (rep->data()) {
-            copyChars(rep->data() + thisSize, tData, tSize);
-            rep = UString::Rep::create(rep, 0, length);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            rep = &UString::Rep::null();
-        else {
-            copyChars(d, rep->data(), thisSize);
-            copyChars(d + thisSize, tData, tSize);
-            rep = UString::Rep::create(d, length);
-            rep->baseString()->capacity = newCapacity;
-        }
-    }
-
-    rep->checkConsistency();
-
-    return rep.release();
-}
-
-static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Rep> r, const char* t)
-{
-    RefPtr<UString::Rep> rep = r;
-
-    rep->checkConsistency();
-
-    int thisSize = rep->size();
-    int thisOffset = rep->offset;
-    int tSize = static_cast<int>(strlen(t));
-    int length = thisSize + tSize;
-    UString::BaseString* base = rep->baseString();
-
-    // possible cases:
-    if (thisSize == 0) {
-        // this is empty
-        rep = createRep(t);
-    } else if (tSize == 0) {
-        // t is empty, we'll just return *this below.
-    } else if (rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
-        UChar* d = rep->data();
-        if (d) {
-            for (int i = 0; i < tSize; ++i)
-                d[thisSize + i] = static_cast<unsigned char>(t[i]); // use unsigned char to zero-extend instead of sign-extend
-            rep->len = length;
-            rep->_hash = 0;
-        }
-    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
-        // this string reaches the end of the buffer - extend it
-        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
-        UChar* d = rep->data();
-        if (d) {
-            for (int i = 0; i < tSize; ++i)
-                d[thisSize + i] = static_cast<unsigned char>(t[i]); // use unsigned char to zero-extend instead of sign-extend
-            rep = UString::Rep::create(rep, 0, length);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            rep = &UString::Rep::null();
-        else {
-            copyChars(d, rep->data(), thisSize);
-            for (int i = 0; i < tSize; ++i)
-                d[thisSize + i] = static_cast<unsigned char>(t[i]); // use unsigned char to zero-extend instead of sign-extend
-            rep = UString::Rep::create(d, length);
-            rep->baseString()->capacity = newCapacity;
-        }
-    }
-
-    rep->checkConsistency();
-
-    return rep.release();
-}
-
-PassRefPtr<UString::Rep> concatenate(UString::Rep* a, UString::Rep* b)
-{
-    a->checkConsistency();
-    b->checkConsistency();
-
-    int aSize = a->size();
-    int bSize = b->size();
-    int aOffset = a->offset;
-
-    // possible cases:
-
-    UString::BaseString* aBase = a->baseString();
-    if (bSize == 1 && aOffset + aSize == aBase->usedCapacity && aOffset + aSize < aBase->capacity && !aBase->isBufferReadOnly()) {
-        // b is a single character (common fast case)
-        ++aBase->usedCapacity;
-        a->data()[aSize] = b->data()[0];
-        return UString::Rep::create(a, 0, aSize + 1);
-    }
-
-    // a is empty
-    if (aSize == 0)
-        return b;
-    // b is empty
-    if (bSize == 0)
-        return a;
-
-    int bOffset = b->offset;
-    int length = aSize + bSize;
-
-    UString::BaseString* bBase = b->baseString();
-    if (aOffset + aSize == aBase->usedCapacity && aSize >= minShareSize && 4 * aSize >= bSize
-        && (-bOffset != bBase->usedPreCapacity || aSize >= bSize) && !aBase->isBufferReadOnly()) {
-        // - a reaches the end of its buffer so it qualifies for shared append
-        // - also, it's at least a quarter the length of b - appending to a much shorter
-        //   string does more harm than good
-        // - however, if b qualifies for prepend and is longer than a, we'd rather prepend
-        
-        UString x(a);
-        x.expandCapacity(newCapacityWithOverflowCheck(aOffset, length));
-        if (!a->data() || !x.data())
-            return 0;
-        copyChars(a->data() + aSize, b->data(), bSize);
-        PassRefPtr<UString::Rep> result = UString::Rep::create(a, 0, length);
-
-        a->checkConsistency();
-        b->checkConsistency();
-        result->checkConsistency();
-
-        return result;
-    }
-
-    if (-bOffset == bBase->usedPreCapacity && bSize >= minShareSize && 4 * bSize >= aSize && !bBase->isBufferReadOnly()) {
-        // - b reaches the beginning of its buffer so it qualifies for shared prepend
-        // - also, it's at least a quarter the length of a - prepending to a much shorter
-        //   string does more harm than good
-        UString y(b);
-        y.expandPreCapacity(-bOffset + aSize);
-        if (!b->data() || !y.data())
-            return 0;
-        copyChars(b->data() - aSize, a->data(), aSize);
-        PassRefPtr<UString::Rep> result = UString::Rep::create(b, -aSize, length);
-
-        a->checkConsistency();
-        b->checkConsistency();
-        result->checkConsistency();
-
-        return result;
-    }
-
-    // a does not qualify for append, and b does not qualify for prepend, gotta make a whole new string
-    size_t newCapacity = expandedSize(length, 0);
-    UChar* d;
-    if (!allocChars(newCapacity).getValue(d))
-        return 0;
-    copyChars(d, a->data(), aSize);
-    copyChars(d + aSize, b->data(), bSize);
-    PassRefPtr<UString::Rep> result = UString::Rep::create(d, length);
-    result->baseString()->capacity = newCapacity;
-
-    a->checkConsistency();
-    b->checkConsistency();
-    result->checkConsistency();
-
-    return result;
-}
-
-PassRefPtr<UString::Rep> concatenate(UString::Rep* rep, int i)
-{
-    UChar buf[1 + sizeof(i) * 3];
-    UChar* end = buf + sizeof(buf) / sizeof(UChar);
-    UChar* p = end;
-  
-    if (i == 0)
-        *--p = '0';
-    else if (i == INT_MIN) {
-        char minBuf[1 + sizeof(i) * 3];
-        sprintf(minBuf, "%d", INT_MIN);
-        return concatenate(rep, minBuf);
-    } else {
-        bool negative = false;
-        if (i < 0) {
-            negative = true;
-            i = -i;
-        }
-        while (i) {
-            *--p = static_cast<unsigned short>((i % 10) + '0');
-            i /= 10;
-        }
-        if (negative)
-            *--p = '-';
-    }
-
-    return concatenate(rep, p, static_cast<int>(end - p));
-
-}
-
-PassRefPtr<UString::Rep> concatenate(UString::Rep* rep, double d)
-{
-    // avoid ever printing -NaN, in JS conceptually there is only one NaN value
-    if (isnan(d))
-        return concatenate(rep, "NaN");
-
-    if (d == 0.0) // stringify -0 as 0
-        d = 0.0;
-
-    char buf[80];
-    int decimalPoint;
-    int sign;
-
-    char result[80];
-    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
-    int length = static_cast<int>(strlen(result));
-  
-    int i = 0;
-    if (sign)
-        buf[i++] = '-';
-  
-    if (decimalPoint <= 0 && decimalPoint > -6) {
-        buf[i++] = '0';
-        buf[i++] = '.';
-        for (int j = decimalPoint; j < 0; j++)
-            buf[i++] = '0';
-        strcpy(buf + i, result);
-    } else if (decimalPoint <= 21 && decimalPoint > 0) {
-        if (length <= decimalPoint) {
-            strcpy(buf + i, result);
-            i += length;
-            for (int j = 0; j < decimalPoint - length; j++)
-                buf[i++] = '0';
-            buf[i] = '\0';
-        } else {
-            strncpy(buf + i, result, decimalPoint);
-            i += decimalPoint;
-            buf[i++] = '.';
-            strcpy(buf + i, result + decimalPoint);
-        }
-    } else if (result[0] < '0' || result[0] > '9')
-        strcpy(buf + i, result);
-    else {
-        buf[i++] = result[0];
-        if (length > 1) {
-            buf[i++] = '.';
-            strcpy(buf + i, result + 1);
-            i += length - 1;
-        }
-        
-        buf[i++] = 'e';
-        buf[i++] = (decimalPoint >= 0) ? '+' : '-';
-        // decimalPoint can't be more than 3 digits decimal given the
-        // nature of float representation
-        int exponential = decimalPoint - 1;
-        if (exponential < 0)
-            exponential = -exponential;
-        if (exponential >= 100)
-            buf[i++] = static_cast<char>('0' + exponential / 100);
-        if (exponential >= 10)
-            buf[i++] = static_cast<char>('0' + (exponential % 100) / 10);
-        buf[i++] = static_cast<char>('0' + exponential % 10);
-        buf[i++] = '\0';
-    }
-    
-    return concatenate(rep, buf);
 }
 
 UString UString::from(int i)
@@ -919,7 +180,7 @@ UString UString::from(int i)
     UChar buf[1 + sizeof(i) * 3];
     UChar* end = buf + sizeof(buf) / sizeof(UChar);
     UChar* p = end;
-  
+
     if (i == 0)
         *--p = '0';
     else if (i == INT_MIN) {
@@ -940,7 +201,7 @@ UString UString::from(int i)
             *--p = '-';
     }
 
-    return UString(p, static_cast<int>(end - p));
+    return UString(p, static_cast<unsigned>(end - p));
 }
 
 UString UString::from(long long i)
@@ -953,7 +214,7 @@ UString UString::from(long long i)
         *--p = '0';
     else if (i == std::numeric_limits<long long>::min()) {
         char minBuf[1 + sizeof(i) * 3];
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
         snprintf(minBuf, sizeof(minBuf) - 1, "%I64d", std::numeric_limits<long long>::min());
 #else
         snprintf(minBuf, sizeof(minBuf) - 1, "%lld", std::numeric_limits<long long>::min());
@@ -973,15 +234,15 @@ UString UString::from(long long i)
             *--p = '-';
     }
 
-    return UString(p, static_cast<int>(end - p));
+    return UString(p, static_cast<unsigned>(end - p));
 }
 
-UString UString::from(unsigned int u)
+UString UString::from(unsigned u)
 {
     UChar buf[sizeof(u) * 3];
     UChar* end = buf + sizeof(buf) / sizeof(UChar);
     UChar* p = end;
-    
+
     if (u == 0)
         *--p = '0';
     else {
@@ -990,8 +251,8 @@ UString UString::from(unsigned int u)
             u /= 10;
         }
     }
-    
-    return UString(p, static_cast<int>(end - p));
+
+    return UString(p, static_cast<unsigned>(end - p));
 }
 
 UString UString::from(long l)
@@ -1020,264 +281,21 @@ UString UString::from(long l)
             *--p = '-';
     }
 
-    return UString(p, static_cast<int>(end - p));
+    return UString(p, end - p);
 }
 
 UString UString::from(double d)
 {
-    // avoid ever printing -NaN, in JS conceptually there is only one NaN value
-    if (isnan(d))
-        return "NaN";
-    if (!d)
-        return "0"; // -0 -> "0"
-
-    char buf[80];
-    int decimalPoint;
-    int sign;
-    
-    char result[80];
-    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
-    int length = static_cast<int>(strlen(result));
-  
-    int i = 0;
-    if (sign)
-        buf[i++] = '-';
-  
-    if (decimalPoint <= 0 && decimalPoint > -6) {
-        buf[i++] = '0';
-        buf[i++] = '.';
-        for (int j = decimalPoint; j < 0; j++)
-            buf[i++] = '0';
-        strcpy(buf + i, result);
-    } else if (decimalPoint <= 21 && decimalPoint > 0) {
-        if (length <= decimalPoint) {
-            strcpy(buf + i, result);
-            i += length;
-            for (int j = 0; j < decimalPoint - length; j++)
-                buf[i++] = '0';
-            buf[i] = '\0';
-        } else {
-            strncpy(buf + i, result, decimalPoint);
-            i += decimalPoint;
-            buf[i++] = '.';
-            strcpy(buf + i, result + decimalPoint);
-        }
-    } else if (result[0] < '0' || result[0] > '9')
-        strcpy(buf + i, result);
-    else {
-        buf[i++] = result[0];
-        if (length > 1) {
-            buf[i++] = '.';
-            strcpy(buf + i, result + 1);
-            i += length - 1;
-        }
-        
-        buf[i++] = 'e';
-        buf[i++] = (decimalPoint >= 0) ? '+' : '-';
-        // decimalPoint can't be more than 3 digits decimal given the
-        // nature of float representation
-        int exponential = decimalPoint - 1;
-        if (exponential < 0)
-            exponential = -exponential;
-        if (exponential >= 100)
-            buf[i++] = static_cast<char>('0' + exponential / 100);
-        if (exponential >= 10)
-            buf[i++] = static_cast<char>('0' + (exponential % 100) / 10);
-        buf[i++] = static_cast<char>('0' + exponential % 10);
-        buf[i++] = '\0';
-    }
-    
-    return UString(buf);
-}
-
-UString UString::spliceSubstringsWithSeparators(const Range* substringRanges, int rangeCount, const UString* separators, int separatorCount) const
-{
-    m_rep->checkConsistency();
-
-    if (rangeCount == 1 && separatorCount == 0) {
-        int thisSize = size();
-        int position = substringRanges[0].position;
-        int length = substringRanges[0].length;
-        if (position <= 0 && length >= thisSize)
-            return *this;
-        return UString::Rep::create(m_rep, max(0, position), min(thisSize, length));
-    }
-
-    int totalLength = 0;
-    for (int i = 0; i < rangeCount; i++)
-        totalLength += substringRanges[i].length;
-    for (int i = 0; i < separatorCount; i++)
-        totalLength += separators[i].size();
-
-    if (totalLength == 0)
-        return "";
-
-    UChar* buffer;
-    if (!allocChars(totalLength).getValue(buffer))
-        return null();
-
-    int maxCount = max(rangeCount, separatorCount);
-    int bufferPos = 0;
-    for (int i = 0; i < maxCount; i++) {
-        if (i < rangeCount) {
-            copyChars(buffer + bufferPos, data() + substringRanges[i].position, substringRanges[i].length);
-            bufferPos += substringRanges[i].length;
-        }
-        if (i < separatorCount) {
-            copyChars(buffer + bufferPos, separators[i].data(), separators[i].size());
-            bufferPos += separators[i].size();
-        }
-    }
-
-    return UString::Rep::create(buffer, totalLength);
-}
-
-UString UString::replaceRange(int rangeStart, int rangeLength, const UString& replacement) const
-{
-    m_rep->checkConsistency();
-
-    int replacementLength = replacement.size();
-    int totalLength = size() - rangeLength + replacementLength;
-    if (totalLength == 0)
-        return "";
-
-    UChar* buffer;
-    if (!allocChars(totalLength).getValue(buffer))
-        return null();
-
-    copyChars(buffer, data(), rangeStart);
-    copyChars(buffer + rangeStart, replacement.data(), replacementLength);
-    int rangeEnd = rangeStart + rangeLength;
-    copyChars(buffer + rangeStart + replacementLength, data() + rangeEnd, size() - rangeEnd);
-
-    return UString::Rep::create(buffer, totalLength);
-}
-
-
-UString& UString::append(const UString &t)
-{
-    m_rep->checkConsistency();
-    t.rep()->checkConsistency();
-
-    int thisSize = size();
-    int thisOffset = m_rep->offset;
-    int tSize = t.size();
-    int length = thisSize + tSize;
-    BaseString* base = m_rep->baseString();
-
-    // possible cases:
-    if (thisSize == 0) {
-        // this is empty
-        *this = t;
-    } else if (tSize == 0) {
-        // t is empty
-    } else if (m_rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
-        if (data()) {
-            copyChars(m_rep->data() + thisSize, t.data(), tSize);
-            m_rep->len = length;
-            m_rep->_hash = 0;
-        }
-    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
-        // this reaches the end of the buffer - extend it if it's long enough to append to
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
-        if (data()) {
-            copyChars(m_rep->data() + thisSize, t.data(), tSize);
-            m_rep = Rep::create(m_rep, 0, length);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            makeNull();
-        else {
-            copyChars(d, data(), thisSize);
-            copyChars(d + thisSize, t.data(), tSize);
-            m_rep = Rep::create(d, length);
-            m_rep->baseString()->capacity = newCapacity;
-        }
-    }
-
-    m_rep->checkConsistency();
-    t.rep()->checkConsistency();
-
-    return *this;
-}
-
-UString& UString::append(const UChar* tData, int tSize)
-{
-    m_rep = concatenate(m_rep.release(), tData, tSize);
-    return *this;
-}
-
-UString& UString::append(const char* t)
-{
-    m_rep = concatenate(m_rep.release(), t);
-    return *this;
-}
-
-UString& UString::append(UChar c)
-{
-    m_rep->checkConsistency();
-
-    int thisOffset = m_rep->offset;
-    int length = size();
-    BaseString* base = m_rep->baseString();
-
-    // possible cases:
-    if (length == 0) {
-        // this is empty - must make a new m_rep because we don't want to pollute the shared empty one 
-        size_t newCapacity = expandedSize(1, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            makeNull();
-        else {
-            d[0] = c;
-            m_rep = Rep::create(d, 1);
-            m_rep->baseString()->capacity = newCapacity;
-        }
-    } else if (m_rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
-        UChar* d = m_rep->data();
-        if (d) {
-            d[length] = c;
-            m_rep->len = length + 1;
-            m_rep->_hash = 0;
-        }
-    } else if (thisOffset + length == base->usedCapacity && length >= minShareSize && !base->isBufferReadOnly()) {
-        // this reaches the end of the string - extend it and share
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
-        UChar* d = m_rep->data();
-        if (d) {
-            d[length] = c;
-            m_rep = Rep::create(m_rep, 0, length + 1);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length + 1, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            makeNull();
-        else {
-            copyChars(d, data(), length);
-            d[length] = c;
-            m_rep = Rep::create(d, length + 1);
-            m_rep->baseString()->capacity = newCapacity;
-        }
-    }
-
-    m_rep->checkConsistency();
-
-    return *this;
+    DtoaBuffer buffer;
+    unsigned length;
+    doubleToStringInJavaScriptFormat(d, buffer, &length);
+    return UString(buffer, length);
 }
 
 bool UString::getCString(CStringBuffer& buffer) const
 {
-    int length = size();
-    int neededSize = length + 1;
+    unsigned length = size();
+    unsigned neededSize = length + 1;
     buffer.resize(neededSize);
     char* buf = buffer.data();
 
@@ -1299,13 +317,15 @@ bool UString::getCString(CStringBuffer& buffer) const
 
 char* UString::ascii() const
 {
-    int length = size();
-    int neededSize = length + 1;
-    delete[] statBuffer;
-    statBuffer = new char[neededSize];
+    static char* asciiBuffer = 0;
+
+    unsigned length = size();
+    unsigned neededSize = length + 1;
+    delete[] asciiBuffer;
+    asciiBuffer = new char[neededSize];
 
     const UChar* p = data();
-    char* q = statBuffer;
+    char* q = asciiBuffer;
     const UChar* limit = p + length;
     while (p != limit) {
         *q = static_cast<char>(p[0]);
@@ -1314,39 +334,7 @@ char* UString::ascii() const
     }
     *q = '\0';
 
-    return statBuffer;
-}
-
-UString& UString::operator=(const char* c)
-{
-    if (!c) {
-        m_rep = &Rep::null();
-        return *this;
-    }
-
-    if (!c[0]) {
-        m_rep = &Rep::empty();
-        return *this;
-    }
-
-    int l = static_cast<int>(strlen(c));
-    UChar* d;
-    BaseString* base = m_rep->baseString();
-    if (!base->isShared() && l <= base->capacity && m_rep == base && m_rep->offset == 0 && base->preCapacity == 0) {
-        d = base->buf;
-        m_rep->_hash = 0;
-        m_rep->len = l;
-    } else {
-        if (!allocChars(l).getValue(d)) {
-            makeNull();
-            return *this;
-        }
-        m_rep = Rep::create(d, l);
-    }
-    for (int i = 0; i < l; i++)
-        d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
-
-    return *this;
+    return asciiBuffer;
 }
 
 bool UString::is8Bit() const
@@ -1362,7 +350,7 @@ bool UString::is8Bit() const
     return true;
 }
 
-UChar UString::operator[](int pos) const
+UChar UString::operator[](unsigned pos) const
 {
     if (pos >= size())
         return '\0';
@@ -1502,10 +490,10 @@ uint32_t UString::toStrictUInt32(bool* ok) const
         *ok = false;
 
     // Empty string is not OK.
-    int len = m_rep->len;
+    unsigned len = m_rep->length();
     if (len == 0)
         return 0;
-    const UChar* p = m_rep->data();
+    const UChar* p = m_rep->characters();
     unsigned short c = p[0];
 
     // If the first digit is 0, only 0 itself is OK.
@@ -1546,102 +534,92 @@ uint32_t UString::toStrictUInt32(bool* ok) const
     }
 }
 
-int UString::find(const UString& f, int pos) const
+unsigned UString::find(const UString& f, unsigned pos) const
 {
-    int fsz = f.size();
-
-    if (pos < 0)
-        pos = 0;
+    unsigned fsz = f.size();
 
     if (fsz == 1) {
         UChar ch = f[0];
         const UChar* end = data() + size();
         for (const UChar* c = data() + pos; c < end; c++) {
             if (*c == ch)
-                return static_cast<int>(c - data());
+                return static_cast<unsigned>(c - data());
         }
-        return -1;
+        return NotFound;
     }
 
-    int sz = size();
+    unsigned sz = size();
     if (sz < fsz)
-        return -1;
+        return NotFound;
     if (fsz == 0)
         return pos;
     const UChar* end = data() + sz - fsz;
-    int fsizeminusone = (fsz - 1) * sizeof(UChar);
+    unsigned fsizeminusone = (fsz - 1) * sizeof(UChar);
     const UChar* fdata = f.data();
     unsigned short fchar = fdata[0];
     ++fdata;
     for (const UChar* c = data() + pos; c <= end; c++) {
         if (c[0] == fchar && !memcmp(c + 1, fdata, fsizeminusone))
-            return static_cast<int>(c - data());
+            return static_cast<unsigned>(c - data());
     }
 
-    return -1;
+    return NotFound;
 }
 
-int UString::find(UChar ch, int pos) const
+unsigned UString::find(UChar ch, unsigned pos) const
 {
-    if (pos < 0)
-        pos = 0;
     const UChar* end = data() + size();
     for (const UChar* c = data() + pos; c < end; c++) {
         if (*c == ch)
-            return static_cast<int>(c - data());
+            return static_cast<unsigned>(c - data());
     }
-    
-    return -1;
+
+    return NotFound;
 }
 
-int UString::rfind(const UString& f, int pos) const
+unsigned UString::rfind(const UString& f, unsigned pos) const
 {
-    int sz = size();
-    int fsz = f.size();
+    unsigned sz = size();
+    unsigned fsz = f.size();
     if (sz < fsz)
-        return -1;
-    if (pos < 0)
-        pos = 0;
+        return NotFound;
     if (pos > sz - fsz)
         pos = sz - fsz;
     if (fsz == 0)
         return pos;
-    int fsizeminusone = (fsz - 1) * sizeof(UChar);
+    unsigned fsizeminusone = (fsz - 1) * sizeof(UChar);
     const UChar* fdata = f.data();
     for (const UChar* c = data() + pos; c >= data(); c--) {
         if (*c == *fdata && !memcmp(c + 1, fdata + 1, fsizeminusone))
-            return static_cast<int>(c - data());
+            return static_cast<unsigned>(c - data());
     }
 
-    return -1;
+    return NotFound;
 }
 
-int UString::rfind(UChar ch, int pos) const
+unsigned UString::rfind(UChar ch, unsigned pos) const
 {
     if (isEmpty())
-        return -1;
+        return NotFound;
     if (pos + 1 >= size())
         pos = size() - 1;
     for (const UChar* c = data() + pos; c >= data(); c--) {
         if (*c == ch)
-            return static_cast<int>(c - data());
+            return static_cast<unsigned>(c - data());
     }
 
-    return -1;
+    return NotFound;
 }
 
-UString UString::substr(int pos, int len) const
+UString UString::substr(unsigned pos, unsigned len) const
 {
-    int s = size();
+    unsigned s = size();
 
-    if (pos < 0)
-        pos = 0;
-    else if (pos >= s)
+    if (pos >= s)
         pos = s;
-    if (len < 0)
-        len = s;
-    if (pos + len >= s)
-        len = s - pos;
+    unsigned limit = s - pos;
+    if (len > limit)
+        len = limit;
 
     if (pos == 0 && len == s)
         return *this;
@@ -1668,12 +646,12 @@ bool operator==(const UString& s1, const char *s2)
 
 bool operator<(const UString& s1, const UString& s2)
 {
-    const int l1 = s1.size();
-    const int l2 = s2.size();
-    const int lmin = l1 < l2 ? l1 : l2;
+    const unsigned l1 = s1.size();
+    const unsigned l2 = s2.size();
+    const unsigned lmin = l1 < l2 ? l1 : l2;
     const UChar* c1 = s1.data();
     const UChar* c2 = s2.data();
-    int l = 0;
+    unsigned l = 0;
     while (l < lmin && *c1 == *c2) {
         c1++;
         c2++;
@@ -1687,12 +665,12 @@ bool operator<(const UString& s1, const UString& s2)
 
 bool operator>(const UString& s1, const UString& s2)
 {
-    const int l1 = s1.size();
-    const int l2 = s2.size();
-    const int lmin = l1 < l2 ? l1 : l2;
+    const unsigned l1 = s1.size();
+    const unsigned l2 = s2.size();
+    const unsigned lmin = l1 < l2 ? l1 : l2;
     const UChar* c1 = s1.data();
     const UChar* c2 = s2.data();
-    int l = 0;
+    unsigned l = 0;
     while (l < lmin && *c1 == *c2) {
         c1++;
         c2++;
@@ -1706,12 +684,12 @@ bool operator>(const UString& s1, const UString& s2)
 
 int compare(const UString& s1, const UString& s2)
 {
-    const int l1 = s1.size();
-    const int l2 = s2.size();
-    const int lmin = l1 < l2 ? l1 : l2;
+    const unsigned l1 = s1.size();
+    const unsigned l2 = s2.size();
+    const unsigned lmin = l1 < l2 ? l1 : l2;
     const UChar* c1 = s1.data();
     const UChar* c2 = s2.data();
-    int l = 0;
+    unsigned l = 0;
     while (l < lmin && *c1 == *c2) {
         c1++;
         c2++;
@@ -1729,12 +707,12 @@ int compare(const UString& s1, const UString& s2)
 
 bool equal(const UString::Rep* r, const UString::Rep* b)
 {
-    int length = r->len;
-    if (length != b->len)
+    unsigned length = r->length();
+    if (length != b->length())
         return false;
-    const UChar* d = r->data();
-    const UChar* s = b->data();
-    for (int i = 0; i != length; ++i) {
+    const UChar* d = r->characters();
+    const UChar* s = b->characters();
+    for (unsigned i = 0; i != length; ++i) {
         if (d[i] != s[i])
             return false;
     }
@@ -1744,7 +722,7 @@ bool equal(const UString::Rep* r, const UString::Rep* b)
 CString UString::UTF8String(bool strict) const
 {
     // Allocate a buffer big enough to hold all the characters.
-    const int length = size();
+    const unsigned length = size();
     Vector<char, 1024> buffer(length * 3);
 
     // Convert to runs of 8-bit characters.
@@ -1757,16 +735,4 @@ CString UString::UTF8String(bool strict) const
     return CString(buffer.data(), p - buffer.data());
 }
 
-// For use in error handling code paths -- having this not be inlined helps avoid PIC branches to fetch the global on Mac OS X.
-NEVER_INLINE void UString::makeNull()
-{
-    m_rep = &Rep::null();
-}
-
-// For use in error handling code paths -- having this not be inlined helps avoid PIC branches to fetch the global on Mac OS X.
-NEVER_INLINE UString::Rep* UString::nullRep()
-{
-    return &Rep::null();
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
index c4dad2a3d5..e6162018fc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
@@ -24,13 +24,13 @@
 #define UString_h
 
 #include "Collector.h"
+#include "UStringImpl.h"
 #include <stdint.h>
 #include <string.h>
 #include <wtf/Assertions.h>
 #include <wtf/CrossThreadRefCounted.h>
 #include <wtf/OwnFastMallocPtr.h>
 #include <wtf/PassRefPtr.h>
-#include <wtf/PtrAndFlags.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/Unicode.h>
@@ -40,8 +40,6 @@ namespace JSC {
     using WTF::PlacementNewAdoptType;
     using WTF::PlacementNewAdopt;
 
-    class IdentifierTable;
-  
     class CString {
     public:
         CString()
@@ -71,223 +69,50 @@ namespace JSC {
         char* m_data;
     };
 
+    bool operator==(const CString&, const CString&);
+
     typedef Vector<char, 32> CStringBuffer;
 
     class UString {
         friend class JIT;
 
     public:
-        typedef CrossThreadRefCounted<OwnFastMallocPtr<UChar> > SharedUChar;
-        struct BaseString;
-        struct Rep : Noncopyable {
-            friend class JIT;
-
-            static PassRefPtr<Rep> create(UChar* buffer, int length)
-            {
-                return adoptRef(new BaseString(buffer, length));
-            }
-
-            static PassRefPtr<Rep> createEmptyBuffer(size_t size)
-            {
-                // Guard against integer overflow
-                if (size < (std::numeric_limits<size_t>::max() / sizeof(UChar))) {
-                    void* buf = 0;
-                    if (tryFastMalloc(size * sizeof(UChar)).getValue(buf))
-                        return adoptRef(new BaseString(static_cast<UChar*>(buf), 0, size));
-                }
-                return adoptRef(new BaseString(0, 0, 0));
-            }
-
-            static PassRefPtr<Rep> createCopying(const UChar*, int);
-            static PassRefPtr<Rep> create(PassRefPtr<Rep> base, int offset, int length);
-
-            // Constructs a string from a UTF-8 string, using strict conversion (see comments in UTF8.h).
-            // Returns UString::Rep::null for null input or conversion failure.
-            static PassRefPtr<Rep> createFromUTF8(const char*);
-
-            // Uses SharedUChar to have joint ownership over the UChar*.
-            static PassRefPtr<Rep> create(UChar*, int, PassRefPtr<SharedUChar>);
-
-            SharedUChar* sharedBuffer();
-            void destroy();
-
-            bool baseIsSelf() const { return m_identifierTableAndFlags.isFlagSet(BaseStringFlag); }
-            UChar* data() const;
-            int size() const { return len; }
-
-            unsigned hash() const { if (_hash == 0) _hash = computeHash(data(), len); return _hash; }
-            unsigned computedHash() const { ASSERT(_hash); return _hash; } // fast path for Identifiers
-
-            static unsigned computeHash(const UChar*, int length);
-            static unsigned computeHash(const char*, int length);
-            static unsigned computeHash(const char* s) { return computeHash(s, strlen(s)); }
-
-            IdentifierTable* identifierTable() const { return m_identifierTableAndFlags.get(); }
-            void setIdentifierTable(IdentifierTable* table) { ASSERT(!isStatic()); m_identifierTableAndFlags.set(table); }
-
-            bool isStatic() const { return m_identifierTableAndFlags.isFlagSet(StaticFlag); }
-            void setStatic(bool);
-            void setBaseString(PassRefPtr<BaseString>);
-            BaseString* baseString();
-            const BaseString* baseString() const;
-
-            Rep* ref() { ++rc; return this; }
-            ALWAYS_INLINE void deref() { if (--rc == 0) destroy(); }
-
-            void checkConsistency() const;
-            enum UStringFlags {
-                StaticFlag,
-                BaseStringFlag
-            };
-
-            // unshared data
-            int offset;
-            int len;
-            int rc; // For null and empty static strings, this field does not reflect a correct count, because ref/deref are not thread-safe. A special case in destroy() guarantees that these do not get deleted.
-            mutable unsigned _hash;
-            PtrAndFlags<IdentifierTable, UStringFlags> m_identifierTableAndFlags;
-
-            static BaseString& null() { return *nullBaseString; }
-            static BaseString& empty() { return *emptyBaseString; }
-
-            bool reserveCapacity(int capacity);
-
-        protected:
-            // Constructor for use by BaseString subclass; they use the union with m_baseString for another purpose.
-            Rep(int length)
-                : offset(0)
-                , len(length)
-                , rc(1)
-                , _hash(0)
-                , m_baseString(0)
-            {
-            }
-
-            Rep(PassRefPtr<BaseString> base, int offsetInBase, int length)
-                : offset(offsetInBase)
-                , len(length)
-                , rc(1)
-                , _hash(0)
-                , m_baseString(base.releaseRef())
-            {
-                checkConsistency();
-            }
-
-            union {
-                // If !baseIsSelf()
-                BaseString* m_baseString;
-                // If baseIsSelf()
-                SharedUChar* m_sharedBuffer;
-            };
-
-        private:
-            // For SmallStringStorage which allocates an array and does initialization manually.
-            Rep() { }
-
-            friend class SmallStringsStorage;
-            friend void initializeUString();
-            JS_EXPORTDATA static BaseString* nullBaseString;
-            JS_EXPORTDATA static BaseString* emptyBaseString;
-        };
-
-
-        struct BaseString : public Rep {
-            bool isShared() { return rc != 1 || isBufferReadOnly(); }
-            void setSharedBuffer(PassRefPtr<SharedUChar>);
-
-            bool isBufferReadOnly()
-            {
-                if (!m_sharedBuffer)
-                    return false;
-                return slowIsBufferReadOnly();
-            }
-
-            // potentially shared data.
-            UChar* buf;
-            int preCapacity;
-            int usedPreCapacity;
-            int capacity;
-            int usedCapacity;
-
-            size_t reportedCost;
-
-        private:
-            BaseString(UChar* buffer, int length, int additionalCapacity = 0)
-                : Rep(length)
-                , buf(buffer)
-                , preCapacity(0)
-                , usedPreCapacity(0)
-                , capacity(length + additionalCapacity)
-                , usedCapacity(length)
-                , reportedCost(0)
-            {
-                m_identifierTableAndFlags.setFlag(BaseStringFlag);
-                checkConsistency();
-            }
-
-            SharedUChar* sharedBuffer();
-            bool slowIsBufferReadOnly();
-
-            friend struct Rep;
-            friend class SmallStringsStorage;
-            friend void initializeUString();
-        };
-
+        typedef UStringImpl Rep;
+    
     public:
         UString();
-        UString(const char*);
-        UString(const UChar*, int length);
-        UString(UChar*, int length, bool copy);
+        UString(const char*); // Constructor for null-terminated string.
+        UString(const char*, unsigned length);
+        UString(const UChar*, unsigned length);
+        UString(const Vector<UChar>& buffer);
 
         UString(const UString& s)
             : m_rep(s.m_rep)
         {
         }
 
-        UString(const Vector<UChar>& buffer);
+        // Special constructor for cases where we overwrite an object in place.
+        UString(PlacementNewAdoptType)
+            : m_rep(PlacementNewAdopt)
+        {
+        }
 
         ~UString()
         {
         }
 
-        // Special constructor for cases where we overwrite an object in place.
-        UString(PlacementNewAdoptType)
-            : m_rep(PlacementNewAdopt)
+        template<size_t inlineCapacity>
+        static PassRefPtr<UStringImpl> adopt(Vector<UChar, inlineCapacity>& vector)
         {
+            return Rep::adopt(vector);
         }
 
         static UString from(int);
         static UString from(long long);
-        static UString from(unsigned int);
+        static UString from(unsigned);
         static UString from(long);
         static UString from(double);
 
-        struct Range {
-        public:
-            Range(int pos, int len)
-                : position(pos)
-                , length(len)
-            {
-            }
-
-            Range()
-            {
-            }
-
-            int position;
-            int length;
-        };
-
-        UString spliceSubstringsWithSeparators(const Range* substringRanges, int rangeCount, const UString* separators, int separatorCount) const;
-
-        UString replaceRange(int rangeStart, int RangeEnd, const UString& replacement) const;
-
-        UString& append(const UString&);
-        UString& append(const char*);
-        UString& append(UChar);
-        UString& append(char c) { return append(static_cast<UChar>(static_cast<unsigned char>(c))); }
-        UString& append(const UChar*, int size);
-
         bool getCString(CStringBuffer&) const;
 
         // NOTE: This method should only be used for *debugging* purposes as it
@@ -304,21 +129,16 @@ namespace JSC {
          */
         CString UTF8String(bool strict = false) const;
 
-        UString& operator=(const char*c);
-
-        UString& operator+=(const UString& s) { return append(s); }
-        UString& operator+=(const char* s) { return append(s); }
-
-        const UChar* data() const { return m_rep->data(); }
+        const UChar* data() const { return m_rep->characters(); }
 
-        bool isNull() const { return (m_rep == &Rep::null()); }
-        bool isEmpty() const { return (!m_rep->len); }
+        bool isNull() const { return m_rep == s_nullRep; }
+        bool isEmpty() const { return !m_rep->length(); }
 
         bool is8Bit() const;
 
-        int size() const { return m_rep->size(); }
+        unsigned size() const { return m_rep->length(); }
 
-        UChar operator[](int pos) const;
+        UChar operator[](unsigned pos) const;
 
         double toDouble(bool tolerateTrailingJunk, bool tolerateEmptyString) const;
         double toDouble(bool tolerateTrailingJunk) const;
@@ -330,17 +150,17 @@ namespace JSC {
 
         unsigned toArrayIndex(bool* ok = 0) const;
 
-        int find(const UString& f, int pos = 0) const;
-        int find(UChar, int pos = 0) const;
-        int rfind(const UString& f, int pos) const;
-        int rfind(UChar, int pos) const;
+        static const unsigned NotFound = 0xFFFFFFFFu;
+        unsigned find(const UString& f, unsigned pos = 0) const;
+        unsigned find(UChar, unsigned pos = 0) const;
+        unsigned rfind(const UString& f, unsigned pos) const;
+        unsigned rfind(UChar, unsigned pos) const;
 
-        UString substr(int pos = 0, int len = -1) const;
+        UString substr(unsigned pos = 0, unsigned len = 0xFFFFFFFF) const;
 
-        static const UString& null() { return *nullUString; }
+        static const UString& null() { return *s_nullUString; }
 
         Rep* rep() const { return m_rep.get(); }
-        static Rep* nullRep();
 
         UString(PassRefPtr<Rep> r)
             : m_rep(r)
@@ -348,38 +168,21 @@ namespace JSC {
             ASSERT(m_rep);
         }
 
-        size_t cost() const;
-
-        // Attempt to grow this string such that it can grow to a total length of 'capacity'
-        // without reallocation.  This may fail a number of reasons - if the BasicString is
-        // shared and another string is using part of the capacity beyond our end point, if
-        // the realloc fails, or if this string is empty and has no storage.
-        //
-        // This method returns a boolean indicating success.
-        bool reserveCapacity(int capacity)
-        {
-            return m_rep->reserveCapacity(capacity);
-        }
+        size_t cost() const { return m_rep->cost(); }
 
     private:
-        void expandCapacity(int requiredLength);
-        void expandPreCapacity(int requiredPreCap);
-        void makeNull();
-
         RefPtr<Rep> m_rep;
-        static UString* nullUString;
+
+        JS_EXPORTDATA static Rep* s_nullRep;
+        static UString* s_nullUString;
 
         friend void initializeUString();
         friend bool operator==(const UString&, const UString&);
-        friend PassRefPtr<Rep> concatenate(Rep*, Rep*); // returns 0 if out of memory
     };
-    PassRefPtr<UString::Rep> concatenate(UString::Rep*, UString::Rep*);
-    PassRefPtr<UString::Rep> concatenate(UString::Rep*, int);
-    PassRefPtr<UString::Rep> concatenate(UString::Rep*, double);
 
-    inline bool operator==(const UString& s1, const UString& s2)
+    ALWAYS_INLINE bool operator==(const UString& s1, const UString& s2)
     {
-        int size = s1.size();
+        unsigned size = s1.size();
         switch (size) {
         case 0:
             return !s2.size();
@@ -423,117 +226,428 @@ namespace JSC {
         return !JSC::operator==(s1, s2);
     }
 
-    bool operator==(const CString&, const CString&);
+    int compare(const UString&, const UString&);
 
-    inline UString operator+(const UString& s1, const UString& s2)
+    inline UString::UString()
+        : m_rep(s_nullRep)
     {
-        RefPtr<UString::Rep> result = concatenate(s1.rep(), s2.rep());
-        return UString(result ? result.release() : UString::nullRep());
     }
 
-    int compare(const UString&, const UString&);
+    // Rule from ECMA 15.2 about what an array index is.
+    // Must exactly match string form of an unsigned integer, and be less than 2^32 - 1.
+    inline unsigned UString::toArrayIndex(bool* ok) const
+    {
+        unsigned i = toStrictUInt32(ok);
+        if (ok && i >= 0xFFFFFFFFU)
+            *ok = false;
+        return i;
+    }
 
-    bool equal(const UString::Rep*, const UString::Rep*);
+    // We'd rather not do shared substring append for small strings, since
+    // this runs too much risk of a tiny initial string holding down a
+    // huge buffer.
+    static const unsigned minShareSize = Heap::minExtraCost / sizeof(UChar);
 
-    inline PassRefPtr<UString::Rep> UString::Rep::create(PassRefPtr<UString::Rep> rep, int offset, int length)
-    {
-        ASSERT(rep);
-        rep->checkConsistency();
+    struct IdentifierRepHash : PtrHash<RefPtr<JSC::UString::Rep> > {
+        static unsigned hash(const RefPtr<JSC::UString::Rep>& key) { return key->existingHash(); }
+        static unsigned hash(JSC::UString::Rep* key) { return key->existingHash(); }
+    };
 
-        int repOffset = rep->offset;
+    void initializeUString();
 
-        PassRefPtr<BaseString> base = rep->baseString();
+    template<typename StringType>
+    class StringTypeAdapter {
+    };
 
-        ASSERT(-(offset + repOffset) <= base->usedPreCapacity);
-        ASSERT(offset + repOffset + length <= base->usedCapacity);
+    template<>
+    class StringTypeAdapter<char*> {
+    public:
+        StringTypeAdapter<char*>(char* buffer)
+            : m_buffer((unsigned char*)buffer)
+            , m_length(strlen(buffer))
+        {
+        }
 
-        // Steal the single reference this Rep was created with.
-        return adoptRef(new Rep(base, repOffset + offset, length));
-    }
+        unsigned length() { return m_length; }
+
+        void writeTo(UChar* destination)
+        {
+            for (unsigned i = 0; i < m_length; ++i)
+                destination[i] = m_buffer[i];
+        }
+
+    private:
+        const unsigned char* m_buffer;
+        unsigned m_length;
+    };
+
+    template<>
+    class StringTypeAdapter<const char*> {
+    public:
+        StringTypeAdapter<const char*>(const char* buffer)
+            : m_buffer((unsigned char*)buffer)
+            , m_length(strlen(buffer))
+        {
+        }
+
+        unsigned length() { return m_length; }
 
-    inline UChar* UString::Rep::data() const
+        void writeTo(UChar* destination)
+        {
+            for (unsigned i = 0; i < m_length; ++i)
+                destination[i] = m_buffer[i];
+        }
+
+    private:
+        const unsigned char* m_buffer;
+        unsigned m_length;
+    };
+
+    template<>
+    class StringTypeAdapter<UString> {
+    public:
+        StringTypeAdapter<UString>(UString& string)
+            : m_data(string.data())
+            , m_length(string.size())
+        {
+        }
+
+        unsigned length() { return m_length; }
+
+        void writeTo(UChar* destination)
+        {
+            for (unsigned i = 0; i < m_length; ++i)
+                destination[i] = m_data[i];
+        }
+
+    private:
+        const UChar* m_data;
+        unsigned m_length;
+    };
+
+    inline void sumWithOverflow(unsigned& total, unsigned addend, bool& overflow)
     {
-        const BaseString* base = baseString();
-        return base->buf + base->preCapacity + offset;
+        unsigned oldTotal = total;
+        total = oldTotal + addend;
+        if (total < oldTotal)
+            overflow = true;
     }
 
-    inline void UString::Rep::setStatic(bool v)
+    template<typename StringType1, typename StringType2>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2)
     {
-        ASSERT(!identifierTable());
-        if (v)
-            m_identifierTableAndFlags.setFlag(StaticFlag);
-        else
-            m_identifierTableAndFlags.clearFlag(StaticFlag);
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+
+        return resultImpl;
     }
 
-    inline void UString::Rep::setBaseString(PassRefPtr<BaseString> base)
+    template<typename StringType1, typename StringType2, typename StringType3>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3)
     {
-        ASSERT(base != this);
-        ASSERT(!baseIsSelf());
-        m_baseString = base.releaseRef();
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+
+        return resultImpl;
     }
 
-    inline UString::BaseString* UString::Rep::baseString()
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
     {
-        return !baseIsSelf() ? m_baseString : reinterpret_cast<BaseString*>(this) ;
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+        StringTypeAdapter<StringType4> adapter4(string4);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        sumWithOverflow(length, adapter4.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+        result += adapter3.length();
+        adapter4.writeTo(result);
+
+        return resultImpl;
     }
 
-    inline const UString::BaseString* UString::Rep::baseString() const
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
     {
-        return const_cast<Rep*>(this)->baseString();
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+        StringTypeAdapter<StringType4> adapter4(string4);
+        StringTypeAdapter<StringType5> adapter5(string5);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        sumWithOverflow(length, adapter4.length(), overflow);
+        sumWithOverflow(length, adapter5.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+        result += adapter3.length();
+        adapter4.writeTo(result);
+        result += adapter4.length();
+        adapter5.writeTo(result);
+
+        return resultImpl;
     }
 
-#ifdef NDEBUG
-    inline void UString::Rep::checkConsistency() const
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
     {
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+        StringTypeAdapter<StringType4> adapter4(string4);
+        StringTypeAdapter<StringType5> adapter5(string5);
+        StringTypeAdapter<StringType6> adapter6(string6);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        sumWithOverflow(length, adapter4.length(), overflow);
+        sumWithOverflow(length, adapter5.length(), overflow);
+        sumWithOverflow(length, adapter6.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+        result += adapter3.length();
+        adapter4.writeTo(result);
+        result += adapter4.length();
+        adapter5.writeTo(result);
+        result += adapter5.length();
+        adapter6.writeTo(result);
+
+        return resultImpl;
     }
-#endif
 
-    inline UString::UString()
-        : m_rep(&Rep::null())
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7)
     {
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+        StringTypeAdapter<StringType4> adapter4(string4);
+        StringTypeAdapter<StringType5> adapter5(string5);
+        StringTypeAdapter<StringType6> adapter6(string6);
+        StringTypeAdapter<StringType7> adapter7(string7);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        sumWithOverflow(length, adapter4.length(), overflow);
+        sumWithOverflow(length, adapter5.length(), overflow);
+        sumWithOverflow(length, adapter6.length(), overflow);
+        sumWithOverflow(length, adapter7.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+        result += adapter3.length();
+        adapter4.writeTo(result);
+        result += adapter4.length();
+        adapter5.writeTo(result);
+        result += adapter5.length();
+        adapter6.writeTo(result);
+        result += adapter6.length();
+        adapter7.writeTo(result);
+
+        return resultImpl;
     }
 
-    // Rule from ECMA 15.2 about what an array index is.
-    // Must exactly match string form of an unsigned integer, and be less than 2^32 - 1.
-    inline unsigned UString::toArrayIndex(bool* ok) const
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8)
     {
-        unsigned i = toStrictUInt32(ok);
-        if (ok && i >= 0xFFFFFFFFU)
-            *ok = false;
-        return i;
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+        StringTypeAdapter<StringType4> adapter4(string4);
+        StringTypeAdapter<StringType5> adapter5(string5);
+        StringTypeAdapter<StringType6> adapter6(string6);
+        StringTypeAdapter<StringType7> adapter7(string7);
+        StringTypeAdapter<StringType8> adapter8(string8);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        sumWithOverflow(length, adapter4.length(), overflow);
+        sumWithOverflow(length, adapter5.length(), overflow);
+        sumWithOverflow(length, adapter6.length(), overflow);
+        sumWithOverflow(length, adapter7.length(), overflow);
+        sumWithOverflow(length, adapter8.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+        result += adapter3.length();
+        adapter4.writeTo(result);
+        result += adapter4.length();
+        adapter5.writeTo(result);
+        result += adapter5.length();
+        adapter6.writeTo(result);
+        result += adapter6.length();
+        adapter7.writeTo(result);
+        result += adapter7.length();
+        adapter8.writeTo(result);
+
+        return resultImpl;
     }
 
-    // We'd rather not do shared substring append for small strings, since
-    // this runs too much risk of a tiny initial string holding down a
-    // huge buffer.
-    // FIXME: this should be size_t but that would cause warnings until we
-    // fix UString sizes to be size_t instead of int
-    static const int minShareSize = Heap::minExtraCostSize / sizeof(UChar);
+    template<typename StringType1, typename StringType2>
+    UString makeString(StringType1 string1, StringType2 string2)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-    inline size_t UString::cost() const
+    template<typename StringType1, typename StringType2, typename StringType3>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3)
     {
-        BaseString* base = m_rep->baseString();
-        size_t capacity = (base->capacity + base->preCapacity) * sizeof(UChar);
-        size_t reportedCost = base->reportedCost;
-        ASSERT(capacity >= reportedCost);
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-        size_t capacityDelta = capacity - reportedCost;
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3, string4);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-        if (capacityDelta < static_cast<size_t>(minShareSize))
-            return 0;
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-        base->reportedCost = capacity;
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-        return capacityDelta;
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
     }
 
-    struct IdentifierRepHash : PtrHash<RefPtr<JSC::UString::Rep> > {
-        static unsigned hash(const RefPtr<JSC::UString::Rep>& key) { return key->computedHash(); }
-        static unsigned hash(JSC::UString::Rep* key) { return key->computedHash(); }
-    };
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7, string8);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-    void initializeUString();
 } // namespace JSC
 
 namespace WTF {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.cpp
new file mode 100644
index 0000000000..aba63ad615
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.cpp
@@ -0,0 +1,192 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "UStringImpl.h"
+
+#include "Identifier.h"
+#include "StdLibExtras.h"
+#include "UString.h"
+#include <wtf/unicode/UTF8.h>
+
+using namespace WTF::Unicode;
+using namespace std;
+
+namespace JSC {
+
+static const unsigned minLengthToShare = 20;
+
+UStringImpl::~UStringImpl()
+{
+    ASSERT(!isStatic());
+
+    if (isIdentifier())
+        Identifier::remove(this);
+
+    BufferOwnership ownership = bufferOwnership();
+    if (ownership != BufferInternal) {
+        if (ownership == BufferOwned) {
+            ASSERT(!m_sharedBuffer);
+            ASSERT(m_data);
+            fastFree(const_cast<UChar*>(m_data));
+        } else if (ownership == BufferSubstring) {
+            ASSERT(m_substringBuffer);
+            m_substringBuffer->deref();
+        } else {
+            ASSERT(ownership == BufferShared);
+            ASSERT(m_sharedBuffer);
+            m_sharedBuffer->deref();
+        }
+    }
+}
+
+UStringImpl* UStringImpl::empty()
+{
+    // FIXME: This works around a bug in our port of PCRE, that a regular expression
+    // run on the empty string may still perform a read from the first element, and
+    // as such we need this to be a valid pointer. No code should ever be reading
+    // from a zero length string, so this should be able to be a non-null pointer
+    // into the zero-page.
+    // Replace this with 'reinterpret_cast<UChar*>(static_cast<intptr_t>(1))' once
+    // PCRE goes away.
+    static UChar emptyUCharData = 0;
+    DEFINE_STATIC_LOCAL(UStringImpl, emptyString, (&emptyUCharData, 0, ConstructStaticString));
+    return &emptyString;
+}
+
+PassRefPtr<UStringImpl> UStringImpl::createUninitialized(unsigned length, UChar*& data)
+{
+    if (!length) {
+        data = 0;
+        return empty();
+    }
+
+    // Allocate a single buffer large enough to contain the StringImpl
+    // struct as well as the data which it contains. This removes one 
+    // heap allocation from this call.
+    if (length > ((std::numeric_limits<size_t>::max() - sizeof(UStringImpl)) / sizeof(UChar)))
+        CRASH();
+    size_t size = sizeof(UStringImpl) + length * sizeof(UChar);
+    UStringImpl* string = static_cast<UStringImpl*>(fastMalloc(size));
+
+    data = reinterpret_cast<UChar*>(string + 1);
+    return adoptRef(new (string) UStringImpl(length));
+}
+
+PassRefPtr<UStringImpl> UStringImpl::create(const UChar* characters, unsigned length)
+{
+    if (!characters || !length)
+        return empty();
+
+    UChar* data;
+    PassRefPtr<UStringImpl> string = createUninitialized(length, data);
+    memcpy(data, characters, length * sizeof(UChar));
+    return string;
+}
+
+PassRefPtr<UStringImpl> UStringImpl::create(const char* characters, unsigned length)
+{
+    if (!characters || !length)
+        return empty();
+
+    UChar* data;
+    PassRefPtr<UStringImpl> string = createUninitialized(length, data);
+    for (unsigned i = 0; i != length; ++i) {
+        unsigned char c = characters[i];
+        data[i] = c;
+    }
+    return string;
+}
+
+PassRefPtr<UStringImpl> UStringImpl::create(const char* string)
+{
+    if (!string)
+        return empty();
+    return create(string, strlen(string));
+}
+
+PassRefPtr<UStringImpl> UStringImpl::create(PassRefPtr<SharedUChar> sharedBuffer, const UChar* buffer, unsigned length)
+{
+    if (!length)
+        return empty();
+    return adoptRef(new UStringImpl(buffer, length, sharedBuffer));
+}
+
+SharedUChar* UStringImpl::sharedBuffer()
+{
+    if (m_length < minLengthToShare)
+        return 0;
+    // All static strings are smaller that the minimim length to share.
+    ASSERT(!isStatic());
+
+    BufferOwnership ownership = bufferOwnership();
+
+    if (ownership == BufferInternal)
+        return 0;
+    if (ownership == BufferSubstring)
+        return m_substringBuffer->sharedBuffer();
+    if (ownership == BufferOwned) {
+        ASSERT(!m_sharedBuffer);
+        m_sharedBuffer = SharedUChar::create(new SharableUChar(m_data)).releaseRef();
+        m_refCountAndFlags = (m_refCountAndFlags & ~s_refCountMaskBufferOwnership) | BufferShared;
+    }
+
+    ASSERT(bufferOwnership() == BufferShared);
+    ASSERT(m_sharedBuffer);
+    return m_sharedBuffer;
+}
+
+void URopeImpl::derefFibersNonRecursive(Vector<URopeImpl*, 32>& workQueue)
+{
+    unsigned length = fiberCount();
+    for (unsigned i = 0; i < length; ++i) {
+        Fiber& fiber = fibers(i);
+        if (fiber->isRope()) {
+            URopeImpl* nextRope = static_cast<URopeImpl*>(fiber);
+            if (nextRope->hasOneRef())
+                workQueue.append(nextRope);
+            else
+                nextRope->deref();
+        } else
+            static_cast<UStringImpl*>(fiber)->deref();
+    }
+}
+
+void URopeImpl::destructNonRecursive()
+{
+    Vector<URopeImpl*, 32> workQueue;
+
+    derefFibersNonRecursive(workQueue);
+    delete this;
+
+    while (!workQueue.isEmpty()) {
+        URopeImpl* rope = workQueue.last();
+        workQueue.removeLast();
+        rope->derefFibersNonRecursive(workQueue);
+        delete rope;
+    }
+}
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.h b/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.h
new file mode 100644
index 0000000000..4dccb25267
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.h
@@ -0,0 +1,344 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef UStringImpl_h
+#define UStringImpl_h
+
+#include <limits>
+#include <wtf/CrossThreadRefCounted.h>
+#include <wtf/OwnFastMallocPtr.h>
+#include <wtf/PossiblyNull.h>
+#include <wtf/StringHashFunctions.h>
+#include <wtf/Vector.h>
+#include <wtf/unicode/Unicode.h>
+
+namespace JSC {
+
+class IdentifierTable;
+
+typedef OwnFastMallocPtr<const UChar> SharableUChar;
+typedef CrossThreadRefCounted<SharableUChar> SharedUChar;
+
+class UStringOrRopeImpl : public Noncopyable {
+public:
+    bool isRope() { return (m_refCountAndFlags & s_refCountIsRope) == s_refCountIsRope; }
+    unsigned length() const { return m_length; }
+
+    void ref() { m_refCountAndFlags += s_refCountIncrement; }
+    inline void deref();
+
+protected:
+    enum BufferOwnership {
+        BufferInternal,
+        BufferOwned,
+        BufferSubstring,
+        BufferShared,
+    };
+
+    using Noncopyable::operator new;
+    void* operator new(size_t, void* inPlace) { return inPlace; }
+
+    // For SmallStringStorage, which allocates an array and uses an in-place new.
+    UStringOrRopeImpl() { }
+
+    UStringOrRopeImpl(unsigned length, BufferOwnership ownership)
+        : m_refCountAndFlags(s_refCountIncrement | s_refCountFlagShouldReportedCost | ownership)
+        , m_length(length)
+    {
+        ASSERT(!isRope());
+    }
+
+    enum StaticStringConstructType { ConstructStaticString };
+    UStringOrRopeImpl(unsigned length, StaticStringConstructType)
+        : m_refCountAndFlags(s_refCountFlagStatic | s_refCountFlagIsIdentifier | BufferOwned)
+        , m_length(length)
+    {
+        ASSERT(!isRope());
+    }
+
+    enum RopeConstructType { ConstructRope };
+    UStringOrRopeImpl(RopeConstructType)
+        : m_refCountAndFlags(s_refCountIncrement | s_refCountIsRope)
+        , m_length(0)
+    {
+        ASSERT(isRope());
+    }
+
+    // The bottom 5 bits hold flags, the top 27 bits hold the ref count.
+    // When dereferencing UStringImpls we check for the ref count AND the
+    // static bit both being zero - static strings are never deleted.
+    static const unsigned s_refCountMask = 0xFFFFFFE0;
+    static const unsigned s_refCountIncrement = 0x20;
+    static const unsigned s_refCountFlagStatic = 0x10;
+    static const unsigned s_refCountFlagShouldReportedCost = 0x8;
+    static const unsigned s_refCountFlagIsIdentifier = 0x4;
+    static const unsigned s_refCountMaskBufferOwnership = 0x3;
+    // Use an otherwise invalid permutation of flags (static & shouldReportedCost -
+    // static strings do not set shouldReportedCost in the constructor, and this bit
+    // is only ever cleared, not set) to identify objects that are ropes.
+    static const unsigned s_refCountIsRope = s_refCountFlagStatic | s_refCountFlagShouldReportedCost;
+
+    unsigned m_refCountAndFlags;
+    unsigned m_length;
+};
+
+class UStringImpl : public UStringOrRopeImpl {
+    friend class CStringTranslator;
+    friend class UCharBufferTranslator;
+    friend class JIT;
+    friend class SmallStringsStorage;
+    friend class UStringOrRopeImpl;
+    friend void initializeUString();
+private:
+    // For SmallStringStorage, which allocates an array and uses an in-place new.
+    UStringImpl() { }
+
+    // Used to construct static strings, which have an special refCount that can never hit zero.
+    // This means that the static string will never be destroyed, which is important because
+    // static strings will be shared across threads & ref-counted in a non-threadsafe manner.
+    UStringImpl(const UChar* characters, unsigned length, StaticStringConstructType)
+        : UStringOrRopeImpl(length, ConstructStaticString)
+        , m_data(characters)
+        , m_buffer(0)
+        , m_hash(0)
+    {
+        hash();
+    }
+
+    // Create a normal string with internal storage (BufferInternal)
+    UStringImpl(unsigned length)
+        : UStringOrRopeImpl(length, BufferInternal)
+        , m_data(reinterpret_cast<UChar*>(this + 1))
+        , m_buffer(0)
+        , m_hash(0)
+    {
+        ASSERT(m_data);
+        ASSERT(m_length);
+    }
+
+    // Create a UStringImpl adopting ownership of the provided buffer (BufferOwned)
+    UStringImpl(const UChar* characters, unsigned length)
+        : UStringOrRopeImpl(length, BufferOwned)
+        , m_data(characters)
+        , m_buffer(0)
+        , m_hash(0)
+    {
+        ASSERT(m_data);
+        ASSERT(m_length);
+    }
+
+    // Used to create new strings that are a substring of an existing UStringImpl (BufferSubstring)
+    UStringImpl(const UChar* characters, unsigned length, PassRefPtr<UStringImpl> base)
+        : UStringOrRopeImpl(length, BufferSubstring)
+        , m_data(characters)
+        , m_substringBuffer(base.releaseRef())
+        , m_hash(0)
+    {
+        ASSERT(m_data);
+        ASSERT(m_length);
+        ASSERT(m_substringBuffer->bufferOwnership() != BufferSubstring);
+    }
+
+    // Used to construct new strings sharing an existing SharedUChar (BufferShared)
+    UStringImpl(const UChar* characters, unsigned length, PassRefPtr<SharedUChar> sharedBuffer)
+        : UStringOrRopeImpl(length, BufferShared)
+        , m_data(characters)
+        , m_sharedBuffer(sharedBuffer.releaseRef())
+        , m_hash(0)
+    {
+        ASSERT(m_data);
+        ASSERT(m_length);
+    }
+
+    // For use only by Identifier's XXXTranslator helpers.
+    void setHash(unsigned hash)
+    {
+        ASSERT(!isStatic());
+        ASSERT(!m_hash);
+        ASSERT(hash == computeHash(m_data, m_length));
+        m_hash = hash;
+    }
+
+public:
+    ~UStringImpl();
+
+    static PassRefPtr<UStringImpl> create(const UChar*, unsigned length);
+    static PassRefPtr<UStringImpl> create(const char*, unsigned length);
+    static PassRefPtr<UStringImpl> create(const char*);
+    static PassRefPtr<UStringImpl> create(PassRefPtr<SharedUChar>, const UChar*, unsigned length);
+    static PassRefPtr<UStringImpl> create(PassRefPtr<UStringImpl> rep, unsigned offset, unsigned length)
+    {
+        ASSERT(rep);
+        ASSERT(length <= rep->length());
+
+        if (!length)
+            return empty();
+
+        UStringImpl* ownerRep = (rep->bufferOwnership() == BufferSubstring) ? rep->m_substringBuffer : rep.get();
+        return adoptRef(new UStringImpl(rep->m_data + offset, length, ownerRep));
+    }
+
+    static PassRefPtr<UStringImpl> createUninitialized(unsigned length, UChar*& output);
+    static PassRefPtr<UStringImpl> tryCreateUninitialized(unsigned length, UChar*& output)
+    {
+        if (!length) {
+            output = 0;
+            return empty();
+        }
+
+        if (length > ((std::numeric_limits<size_t>::max() - sizeof(UStringImpl)) / sizeof(UChar)))
+            return 0;
+        UStringImpl* resultImpl;
+        if (!tryFastMalloc(sizeof(UChar) * length + sizeof(UStringImpl)).getValue(resultImpl))
+            return 0;
+        output = reinterpret_cast<UChar*>(resultImpl + 1);
+        return adoptRef(new(resultImpl) UStringImpl(length));
+    }
+
+    template<size_t inlineCapacity>
+    static PassRefPtr<UStringImpl> adopt(Vector<UChar, inlineCapacity>& vector)
+    {
+        if (size_t size = vector.size()) {
+            ASSERT(vector.data());
+            return adoptRef(new UStringImpl(vector.releaseBuffer(), size));
+        }
+        return empty();
+    }
+
+    SharedUChar* sharedBuffer();
+    const UChar* characters() const { return m_data; }
+
+    size_t cost()
+    {
+        // For substrings, return the cost of the base string.
+        if (bufferOwnership() == BufferSubstring)
+            return m_substringBuffer->cost();
+
+        if (m_refCountAndFlags & s_refCountFlagShouldReportedCost) {
+            m_refCountAndFlags &= ~s_refCountFlagShouldReportedCost;
+            return m_length;
+        }
+        return 0;
+    }
+
+    bool isIdentifier() const { return m_refCountAndFlags & s_refCountFlagIsIdentifier; }
+    void setIsIdentifier(bool isIdentifier)
+    {
+        ASSERT(!isStatic());
+        if (isIdentifier)
+            m_refCountAndFlags |= s_refCountFlagIsIdentifier;
+        else
+            m_refCountAndFlags &= ~s_refCountFlagIsIdentifier;
+    }
+
+    unsigned hash() const { if (!m_hash) m_hash = computeHash(m_data, m_length); return m_hash; }
+    unsigned existingHash() const { ASSERT(m_hash); return m_hash; }
+    static unsigned computeHash(const UChar* data, unsigned length) { return WTF::stringHash(data, length); }
+    static unsigned computeHash(const char* data, unsigned length) { return WTF::stringHash(data, length); }
+    static unsigned computeHash(const char* data) { return WTF::stringHash(data); }
+
+    ALWAYS_INLINE void deref() { m_refCountAndFlags -= s_refCountIncrement; if (!(m_refCountAndFlags & (s_refCountMask | s_refCountFlagStatic))) delete this; }
+
+    static UStringImpl* empty();
+
+    static void copyChars(UChar* destination, const UChar* source, unsigned numCharacters)
+    {
+        if (numCharacters <= s_copyCharsInlineCutOff) {
+            for (unsigned i = 0; i < numCharacters; ++i)
+                destination[i] = source[i];
+        } else
+            memcpy(destination, source, numCharacters * sizeof(UChar));
+    }
+
+private:
+    // This number must be at least 2 to avoid sharing empty, null as well as 1 character strings from SmallStrings.
+    static const unsigned s_copyCharsInlineCutOff = 20;
+
+    BufferOwnership bufferOwnership() const { return static_cast<BufferOwnership>(m_refCountAndFlags & s_refCountMaskBufferOwnership); }
+    bool isStatic() const { return m_refCountAndFlags & s_refCountFlagStatic; }
+
+    const UChar* m_data;
+    union {
+        void* m_buffer;
+        UStringImpl* m_substringBuffer;
+        SharedUChar* m_sharedBuffer;
+    };
+    mutable unsigned m_hash;
+};
+
+class URopeImpl : public UStringOrRopeImpl {
+    friend class UStringOrRopeImpl;
+public:
+    // A URopeImpl is composed from a set of smaller strings called Fibers.
+    // Each Fiber in a rope is either UStringImpl or another URopeImpl.
+    typedef UStringOrRopeImpl* Fiber;
+
+    // Creates a URopeImpl comprising of 'fiberCount' Fibers.
+    // The URopeImpl is constructed in an uninitialized state - initialize must be called for each Fiber in the URopeImpl.
+    static PassRefPtr<URopeImpl> tryCreateUninitialized(unsigned fiberCount)
+    {
+        void* allocation;
+        if (tryFastMalloc(sizeof(URopeImpl) + (fiberCount - 1) * sizeof(Fiber)).getValue(allocation))
+            return adoptRef(new (allocation) URopeImpl(fiberCount));
+        return 0;
+    }
+
+    void initializeFiber(unsigned &index, Fiber fiber)
+    {
+        m_fibers[index++] = fiber;
+        fiber->ref();
+        m_length += fiber->length();
+    }
+
+    unsigned fiberCount() { return m_fiberCount; }
+    Fiber& fibers(unsigned index) { return m_fibers[index]; }
+
+    ALWAYS_INLINE void deref() { m_refCountAndFlags -= s_refCountIncrement; if (!(m_refCountAndFlags & s_refCountMask)) destructNonRecursive(); }
+
+private:
+    URopeImpl(unsigned fiberCount) : UStringOrRopeImpl(ConstructRope), m_fiberCount(fiberCount) {}
+
+    void destructNonRecursive();
+    void derefFibersNonRecursive(Vector<URopeImpl*, 32>& workQueue);
+
+    bool hasOneRef() { return (m_refCountAndFlags & s_refCountMask) == s_refCountIncrement; }
+
+    unsigned m_fiberCount;
+    Fiber m_fibers[1];
+};
+
+inline void UStringOrRopeImpl::deref()
+{
+    if (isRope())
+        static_cast<URopeImpl*>(this)->deref();
+    else
+        static_cast<UStringImpl*>(this)->deref();
+}
+
+bool equal(const UStringImpl*, const UStringImpl*);
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCMap.h b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCMap.h
new file mode 100644
index 0000000000..39a91c5fa5
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCMap.h
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WeakGCMap_h
+#define WeakGCMap_h
+
+#include "Collector.h"
+#include <wtf/HashMap.h>
+
+namespace JSC {
+
+class JSCell;
+
+// A HashMap whose get() function returns emptyValue() for cells awaiting destruction.
+template<typename KeyType, typename MappedType>
+class WeakGCMap : public FastAllocBase {
+    /*
+    Invariants:
+        * A value enters the WeakGCMap marked. (Guaranteed by set().)
+        * A value that becomes unmarked leaves the WeakGCMap before being recycled. (Guaranteed by the value's destructor removing it from the WeakGCMap.)
+        * A value that becomes unmarked leaves the WeakGCMap before becoming marked again. (Guaranteed by all destructors running before the mark phase begins.)
+        * During the mark phase, all values in the WeakGCMap are valid. (Guaranteed by all destructors running before the mark phase begins.)
+    */
+
+public:
+    typedef typename HashMap<KeyType, MappedType>::iterator iterator;
+    typedef typename HashMap<KeyType, MappedType>::const_iterator const_iterator;
+    
+    bool isEmpty() { return m_map.isEmpty(); }
+
+    MappedType get(const KeyType& key) const;
+    pair<iterator, bool> set(const KeyType&, const MappedType&); 
+    MappedType take(const KeyType& key);
+
+    // These unchecked functions provide access to a value even if the value's
+    // mark bit is not set. This is used, among other things, to retrieve values
+    // during the GC mark phase, which begins by clearing all mark bits.
+
+    MappedType uncheckedGet(const KeyType& key) const { return m_map.get(key); }
+    bool uncheckedRemove(const KeyType&, const MappedType&);
+
+    iterator uncheckedBegin() { return m_map.begin(); }
+    iterator uncheckedEnd() { return m_map.end(); }
+
+    const_iterator uncheckedBegin() const { return m_map.begin(); }
+    const_iterator uncheckedEnd() const { return m_map.end(); }
+
+private:
+    HashMap<KeyType, MappedType> m_map;
+};
+
+template<typename KeyType, typename MappedType>
+inline MappedType WeakGCMap<KeyType, MappedType>::get(const KeyType& key) const
+{
+    MappedType result = m_map.get(key);
+    if (result == HashTraits<MappedType>::emptyValue())
+        return result;
+    if (!Heap::isCellMarked(result))
+        return HashTraits<MappedType>::emptyValue();
+    return result;
+}
+
+template<typename KeyType, typename MappedType>
+MappedType WeakGCMap<KeyType, MappedType>::take(const KeyType& key)
+{
+    MappedType result = m_map.take(key);
+    if (result == HashTraits<MappedType>::emptyValue())
+        return result;
+    if (!Heap::isCellMarked(result))
+        return HashTraits<MappedType>::emptyValue();
+    return result;
+}
+
+template<typename KeyType, typename MappedType>
+pair<typename HashMap<KeyType, MappedType>::iterator, bool> WeakGCMap<KeyType, MappedType>::set(const KeyType& key, const MappedType& value)
+{
+    Heap::markCell(value); // If value is newly allocated, it's not marked, so mark it now.
+    pair<iterator, bool> result = m_map.add(key, value);
+    if (!result.second) { // pre-existing entry
+        result.second = !Heap::isCellMarked(result.first->second);
+        result.first->second = value;
+    }
+    return result;
+}
+
+template<typename KeyType, typename MappedType>
+bool WeakGCMap<KeyType, MappedType>::uncheckedRemove(const KeyType& key, const MappedType& value)
+{
+    iterator it = m_map.find(key);
+    if (it == m_map.end())
+        return false;
+    if (it->second != value)
+        return false;
+    m_map.remove(it);
+    return true;
+}
+
+} // namespace JSC
+
+#endif // WeakGCMap_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCPtr.h b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCPtr.h
new file mode 100644
index 0000000000..5f58374e4d
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCPtr.h
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WeakGCPtr_h
+#define WeakGCPtr_h
+
+#include "Collector.h"
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+// A smart pointer whose get() function returns 0 for cells awaiting destruction.
+template <typename T> class WeakGCPtr : Noncopyable {
+public:
+    WeakGCPtr() : m_ptr(0) { }
+    WeakGCPtr(T* ptr) { assign(ptr); }
+
+    T* get() const
+    {
+        if (!m_ptr || !Heap::isCellMarked(m_ptr))
+            return 0;
+        return m_ptr;
+    }
+    
+    void clear(JSCell* ptr)
+    {
+        if (ptr == m_ptr)
+            m_ptr = 0;
+    }
+
+    T& operator*() const { return *get(); }
+    T* operator->() const { return get(); }
+    
+    bool operator!() const { return !get(); }
+
+    // This conversion operator allows implicit conversion to bool but not to other integer types.
+#if COMPILER(WINSCW)
+    operator bool() const { return m_ptr; }
+#else
+    typedef T* WeakGCPtr::*UnspecifiedBoolType;
+    operator UnspecifiedBoolType() const { return get() ? &WeakGCPtr::m_ptr : 0; }
+#endif
+
+    WeakGCPtr& operator=(T*);
+
+#if !ASSERT_DISABLED
+    bool hasDeadObject() const { return !!m_ptr; }
+#endif
+
+private:
+    void assign(T* ptr)
+    {
+        if (ptr)
+            Heap::markCell(ptr);
+        m_ptr = ptr;
+    }
+
+    T* m_ptr;
+};
+
+template <typename T> inline WeakGCPtr<T>& WeakGCPtr<T>::operator=(T* optr)
+{
+    assign(optr);
+    return *this;
+}
+
+template <typename T, typename U> inline bool operator==(const WeakGCPtr<T>& a, const WeakGCPtr<U>& b)
+{ 
+    return a.get() == b.get(); 
+}
+
+template <typename T, typename U> inline bool operator==(const WeakGCPtr<T>& a, U* b)
+{ 
+    return a.get() == b; 
+}
+
+template <typename T, typename U> inline bool operator==(T* a, const WeakGCPtr<U>& b) 
+{
+    return a == b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const WeakGCPtr<T>& a, const WeakGCPtr<U>& b)
+{ 
+    return a.get() != b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const WeakGCPtr<T>& a, U* b)
+{
+    return a.get() != b; 
+}
+
+template <typename T, typename U> inline bool operator!=(T* a, const WeakGCPtr<U>& b)
+{ 
+    return a != b.get(); 
+}
+
+template <typename T, typename U> inline WeakGCPtr<T> static_pointer_cast(const WeakGCPtr<U>& p)
+{ 
+    return WeakGCPtr<T>(static_cast<T*>(p.get())); 
+}
+
+template <typename T, typename U> inline WeakGCPtr<T> const_pointer_cast(const WeakGCPtr<U>& p)
+{ 
+    return WeakGCPtr<T>(const_cast<T*>(p.get())); 
+}
+
+template <typename T> inline T* getPtr(const WeakGCPtr<T>& p)
+{
+    return p.get();
+}
+
+} // namespace JSC
+
+#endif // WeakGCPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/WeakRandom.h b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakRandom.h
new file mode 100644
index 0000000000..ff3995e80a
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakRandom.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ *
+ * Copyright (c) 2009 Ian C. Bullard
+ * 
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following
+ * conditions:
+ * 
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef WeakRandom_h
+#define WeakRandom_h
+
+#include <limits.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+class WeakRandom {
+public:
+    WeakRandom(unsigned seed)
+        : m_low(seed ^ 0x49616E42)
+        , m_high(seed)
+    {
+    }
+
+    double get()
+    {
+        return advance() / (UINT_MAX + 1.0);
+    }
+
+private:
+    unsigned advance()
+    {
+        m_high = (m_high << 16) + (m_high >> 16);
+        m_high += m_low;
+        m_low += m_high;
+        return m_high;
+    }
+
+    unsigned m_low;
+    unsigned m_high;
+};
+
+} // namespace JSC
+
+#endif // WeakRandom_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.cpp
deleted file mode 100644
index e3f12f2221..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.cpp
+++ /dev/null
@@ -1,140 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "CharacterClass.h"
-
-#if ENABLE(WREC)
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-const CharacterClass& CharacterClass::newline() {
-    static const UChar asciiNewlines[2] = { '\n', '\r' };
-    static const UChar unicodeNewlines[2] = { 0x2028, 0x2029 };
-    static const CharacterClass charClass = {
-        asciiNewlines, 2,
-        0, 0,
-        unicodeNewlines, 2,
-        0, 0,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::digits() {
-    static const CharacterRange asciiDigitsRange[1] = { { '0', '9' } };
-    static const CharacterClass charClass = {
-        0, 0,
-        asciiDigitsRange, 1,
-        0, 0,
-        0, 0,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::spaces() {
-    static const UChar asciiSpaces[1] = { ' ' };
-    static const CharacterRange asciiSpacesRange[1] = { { '\t', '\r' } };
-    static const UChar unicodeSpaces[8] = { 0x00a0, 0x1680, 0x180e, 0x2028, 0x2029, 0x202f, 0x205f, 0x3000 };
-    static const CharacterRange unicodeSpacesRange[1] = { { 0x2000, 0x200a } };
-    static const CharacterClass charClass = {
-        asciiSpaces, 1,
-        asciiSpacesRange, 1,
-        unicodeSpaces, 8,
-        unicodeSpacesRange, 1,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::wordchar() {
-    static const UChar asciiWordchar[1] = { '_' };
-    static const CharacterRange asciiWordcharRange[3] = { { '0', '9' }, { 'A', 'Z' }, { 'a', 'z' } };
-    static const CharacterClass charClass = {
-        asciiWordchar, 1,
-        asciiWordcharRange, 3,
-        0, 0,
-        0, 0,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::nondigits() {
-    static const CharacterRange asciiNondigitsRange[2] = { { 0, '0' - 1 }, { '9' + 1, 0x7f } };
-    static const CharacterRange unicodeNondigitsRange[1] = { { 0x0080, 0xffff } };
-    static const CharacterClass charClass = {
-        0, 0,
-        asciiNondigitsRange, 2,
-        0, 0,
-        unicodeNondigitsRange, 1,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::nonspaces() {
-    static const CharacterRange asciiNonspacesRange[3] = { { 0, '\t' - 1 }, { '\r' + 1, ' ' - 1 }, { ' ' + 1, 0x7f } }; 
-    static const CharacterRange unicodeNonspacesRange[9] = {
-        { 0x0080, 0x009f },
-        { 0x00a1, 0x167f },
-        { 0x1681, 0x180d },
-        { 0x180f, 0x1fff },
-        { 0x200b, 0x2027 },
-        { 0x202a, 0x202e },
-        { 0x2030, 0x205e },
-        { 0x2060, 0x2fff },
-        { 0x3001, 0xffff }
-    }; 
-    static const CharacterClass charClass = {
-        0, 0,
-        asciiNonspacesRange, 3,
-        0, 0,
-        unicodeNonspacesRange, 9,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::nonwordchar() {
-    static const UChar asciiNonwordchar[1] = { '`' };
-    static const CharacterRange asciiNonwordcharRange[4] = { { 0, '0' - 1 }, { '9' + 1, 'A' - 1 }, { 'Z' + 1, '_' - 1 }, { 'z' + 1, 0x7f } };
-    static const CharacterRange unicodeNonwordcharRange[1] = { { 0x0080, 0xffff } };
-    static const CharacterClass charClass = {
-        asciiNonwordchar, 1,
-        asciiNonwordcharRange, 4,
-        0, 0,
-        unicodeNonwordcharRange, 1,
-    };
-    
-    return charClass;
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.h b/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.h
deleted file mode 100644
index 8a9d2fc19e..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.h
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CharacterClass_h
-#define CharacterClass_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include <wtf/unicode/Unicode.h>
-
-namespace JSC { namespace WREC {
-
-    struct CharacterRange {
-        UChar begin;
-        UChar end;
-    };
-
-    struct CharacterClass {
-        static const CharacterClass& newline();
-        static const CharacterClass& digits();
-        static const CharacterClass& spaces();
-        static const CharacterClass& wordchar();
-        static const CharacterClass& nondigits();
-        static const CharacterClass& nonspaces();
-        static const CharacterClass& nonwordchar();
-
-        const UChar* matches;
-        unsigned numMatches;
-
-        const CharacterRange* ranges;
-        unsigned numRanges;
-
-        const UChar* matchesUnicode;
-        unsigned numMatchesUnicode;
-
-        const CharacterRange* rangesUnicode;
-        unsigned numRangesUnicode;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // CharacterClass_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.cpp
deleted file mode 100644
index 06f42628d9..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.cpp
+++ /dev/null
@@ -1,257 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "CharacterClassConstructor.h"
-
-#if ENABLE(WREC)
-
-#include "pcre_internal.h"
-#include <wtf/ASCIICType.h>
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-void CharacterClassConstructor::addSorted(Vector<UChar>& matches, UChar ch)
-{
-    unsigned pos = 0;
-    unsigned range = matches.size();
-
-    // binary chop, find position to insert char.
-    while (range) {
-        unsigned index = range >> 1;
-
-        int val = matches[pos+index] - ch;
-        if (!val)
-            return;
-        else if (val > 0)
-            range = index;
-        else {
-            pos += (index+1);
-            range -= (index+1);
-        }
-    }
-    
-    if (pos == matches.size())
-        matches.append(ch);
-    else
-        matches.insert(pos, ch);
-}
-
-void CharacterClassConstructor::addSortedRange(Vector<CharacterRange>& ranges, UChar lo, UChar hi)
-{
-    unsigned end = ranges.size();
-    
-    // Simple linear scan - I doubt there are that many ranges anyway...
-    // feel free to fix this with something faster (eg binary chop).
-    for (unsigned i = 0; i < end; ++i) {
-        // does the new range fall before the current position in the array
-        if (hi < ranges[i].begin) {
-            // optional optimization: concatenate appending ranges? - may not be worthwhile.
-            if (hi == (ranges[i].begin - 1)) {
-                ranges[i].begin = lo;
-                return;
-            }
-            CharacterRange r = {lo, hi};
-            ranges.insert(i, r);
-            return;
-        }
-        // Okay, since we didn't hit the last case, the end of the new range is definitely at or after the begining
-        // If the new range start at or before the end of the last range, then the overlap (if it starts one after the
-        // end of the last range they concatenate, which is just as good.
-        if (lo <= (ranges[i].end + 1)) {
-            // found an intersect! we'll replace this entry in the array.
-            ranges[i].begin = std::min(ranges[i].begin, lo);
-            ranges[i].end = std::max(ranges[i].end, hi);
-
-            // now check if the new range can subsume any subsequent ranges.
-            unsigned next = i+1;
-            // each iteration of the loop we will either remove something from the list, or break the loop.
-            while (next < ranges.size()) {
-                if (ranges[next].begin <= (ranges[i].end + 1)) {
-                    // the next entry now overlaps / concatenates this one.
-                    ranges[i].end = std::max(ranges[i].end, ranges[next].end);
-                    ranges.remove(next);
-                } else
-                    break;
-            }
-            
-            return;
-        }
-    }
-
-    // CharacterRange comes after all existing ranges.
-    CharacterRange r = {lo, hi};
-    ranges.append(r);
-}
-
-void CharacterClassConstructor::put(UChar ch)
-{
-    // Parsing a regular expression like [a-z], we start in an initial empty state:
-    //     ((m_charBuffer == -1) && !m_isPendingDash)
-    // When buffer the 'a' sice it may be (and is in this case) part of a range:
-    //     ((m_charBuffer != -1) && !m_isPendingDash)
-    // Having parsed the hyphen we then record that the dash is also pending:
-    //     ((m_charBuffer != -1) && m_isPendingDash)
-    // The next change will always take us back to the initial state - either because
-    // a complete range has been parsed (such as [a-z]), or because a flush is forced,
-    // due to an early end in the regexp ([a-]), or a character class escape being added
-    // ([a-\s]).  The fourth permutation of m_charBuffer and m_isPendingDash is not permitted.
-    ASSERT(!((m_charBuffer == -1) && m_isPendingDash));
-
-    if (m_charBuffer != -1) {
-        if (m_isPendingDash) {
-            // EXAMPLE: parsing [-a-c], the 'c' reaches this case - we have buffered a previous character and seen a hyphen, so this is a range.
-            UChar lo = m_charBuffer;
-            UChar hi = ch;
-            // Reset back to the inital state.
-            m_charBuffer = -1;
-            m_isPendingDash = false;
-            
-            // This is an error, detected lazily.  Do not proceed.
-            if (lo > hi) {
-                m_isUpsideDown = true;
-                return;
-            }
-            
-            if (lo <= 0x7f) {
-                char asciiLo = lo;
-                char asciiHi = std::min(hi, (UChar)0x7f);
-                addSortedRange(m_ranges, lo, asciiHi);
-                
-                if (m_isCaseInsensitive) {
-                    if ((asciiLo <= 'Z') && (asciiHi >= 'A'))
-                        addSortedRange(m_ranges, std::max(asciiLo, 'A')+('a'-'A'), std::min(asciiHi, 'Z')+('a'-'A'));
-                    if ((asciiLo <= 'z') && (asciiHi >= 'a'))
-                        addSortedRange(m_ranges, std::max(asciiLo, 'a')+('A'-'a'), std::min(asciiHi, 'z')+('A'-'a'));
-                }
-            }
-            if (hi >= 0x80) {
-                UChar unicodeCurr = std::max(lo, (UChar)0x80);
-                addSortedRange(m_rangesUnicode, unicodeCurr, hi);
-                
-                if (m_isCaseInsensitive) {
-                    // we're going to scan along, updating the start of the range
-                    while (unicodeCurr <= hi) {
-                        // Spin forwards over any characters that don't have two cases.
-                        for (; jsc_pcre_ucp_othercase(unicodeCurr) == -1; ++unicodeCurr) {
-                            // if this was the last character in the range, we're done.
-                            if (unicodeCurr == hi)
-                                return;
-                        }
-                        // if we fall through to here, unicodeCurr <= hi & has another case. Get the other case.
-                        UChar rangeStart = unicodeCurr;
-                        UChar otherCurr = jsc_pcre_ucp_othercase(unicodeCurr);
-                        
-                        // If unicodeCurr is not yet hi, check the next char in the range.  If it also has another case,
-                        // and if it's other case value is one greater then the othercase value for the current last
-                        // character included in the range, we can include next into the range.
-                        while ((unicodeCurr < hi) && (jsc_pcre_ucp_othercase(unicodeCurr + 1) == (otherCurr + 1))) {
-                            // increment unicodeCurr; it points to the end of the range.
-                            // increment otherCurr, due to the check above other for next must be 1 greater than the currrent other value.
-                            ++unicodeCurr;
-                            ++otherCurr;
-                        }
-                        
-                        // otherChar is the last in the range of other case chars, calculate offset to get back to the start.
-                        addSortedRange(m_rangesUnicode, otherCurr-(unicodeCurr-rangeStart), otherCurr);
-                        
-                        // unicodeCurr has been added, move on to the next char.
-                        ++unicodeCurr;
-                    }
-                }
-            }
-        } else if (ch == '-')
-            // EXAMPLE: parsing [-a-c], the second '-' reaches this case - the hyphen is treated as potentially indicating a range.
-            m_isPendingDash = true;
-        else {
-            // EXAMPLE: Parsing [-a-c], the 'a' reaches this case - we repace the previously buffered char with the 'a'.
-            flush();
-            m_charBuffer = ch;
-        }
-    } else
-        // EXAMPLE: Parsing [-a-c], the first hyphen reaches this case - there is no buffered character
-        // (the hyphen not treated as a special character in this case, same handling for any char).
-        m_charBuffer = ch;
-}
-
-// When a character is added to the set we do not immediately add it to the arrays, in case it is actually defining a range.
-// When we have determined the character is not used in specifing a range it is added, in a sorted fashion, to the appropriate
-// array (either ascii or unicode).
-// If the pattern is case insensitive we add entries for both cases.
-void CharacterClassConstructor::flush()
-{
-    if (m_charBuffer != -1) {
-        if (m_charBuffer <= 0x7f) {
-            if (m_isCaseInsensitive && isASCIILower(m_charBuffer))
-                addSorted(m_matches, toASCIIUpper(m_charBuffer));
-            addSorted(m_matches, m_charBuffer);
-            if (m_isCaseInsensitive && isASCIIUpper(m_charBuffer))
-                addSorted(m_matches, toASCIILower(m_charBuffer));
-        } else {
-            addSorted(m_matchesUnicode, m_charBuffer);
-            if (m_isCaseInsensitive) {
-                int other = jsc_pcre_ucp_othercase(m_charBuffer);
-                if (other != -1)
-                    addSorted(m_matchesUnicode, other);
-            }
-        }
-        m_charBuffer = -1;
-    }
-    
-    if (m_isPendingDash) {
-        addSorted(m_matches, '-');
-        m_isPendingDash = false;
-    }
-}
-
-void CharacterClassConstructor::append(const CharacterClass& other)
-{
-    // [x-\s] will add, 'x', '-', and all unicode spaces to new class (same as [x\s-]).
-    // Need to check the spec, really, but think this matches PCRE behaviour.
-    flush();
-    
-    if (other.numMatches) {
-        for (size_t i = 0; i < other.numMatches; ++i)
-            addSorted(m_matches, other.matches[i]);
-    }
-    if (other.numRanges) {
-        for (size_t i = 0; i < other.numRanges; ++i)
-            addSortedRange(m_ranges, other.ranges[i].begin, other.ranges[i].end);
-    }
-    if (other.numMatchesUnicode) {
-        for (size_t i = 0; i < other.numMatchesUnicode; ++i)
-            addSorted(m_matchesUnicode, other.matchesUnicode[i]);
-    }
-    if (other.numRangesUnicode) {
-        for (size_t i = 0; i < other.numRangesUnicode; ++i)
-            addSortedRange(m_rangesUnicode, other.rangesUnicode[i].begin, other.rangesUnicode[i].end);
-    }
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.h b/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.h
deleted file mode 100644
index 581733dd6e..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.h
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CharacterClassConstructor_h
-#define CharacterClassConstructor_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include "CharacterClass.h"
-#include <wtf/AlwaysInline.h>
-#include <wtf/Vector.h>
-#include <wtf/unicode/Unicode.h>
-
-namespace JSC { namespace WREC {
-
-    class CharacterClassConstructor {
-    public:
-        CharacterClassConstructor(bool isCaseInsensitive)
-            : m_charBuffer(-1)
-            , m_isPendingDash(false)
-            , m_isCaseInsensitive(isCaseInsensitive)
-            , m_isUpsideDown(false)
-        {
-        }
-
-        void flush();
-        
-        // We need to flush prior to an escaped hyphen to prevent it as being treated as indicating
-        // a range, e.g. [a\-c] we flush prior to adding the hyphen so that this is not treated as
-        // [a-c].  However, we do not want to flush if we have already seen a non escaped hyphen -
-        // e.g. [+-\-] should be treated the same as [+--], producing a range that will also match
-        // a comma.
-        void flushBeforeEscapedHyphen()
-        {
-            if (!m_isPendingDash)
-                flush();
-        }
-        
-        void put(UChar ch);
-        void append(const CharacterClass& other);
-
-        bool isUpsideDown() { return m_isUpsideDown; }
-
-        ALWAYS_INLINE CharacterClass charClass()
-        {
-            CharacterClass newCharClass = {
-                m_matches.begin(), m_matches.size(),
-                m_ranges.begin(), m_ranges.size(),
-                m_matchesUnicode.begin(), m_matchesUnicode.size(),
-                m_rangesUnicode.begin(), m_rangesUnicode.size(),
-            };
-
-            return newCharClass;
-        }
-
-    private:
-        void addSorted(Vector<UChar>& matches, UChar ch);
-        void addSortedRange(Vector<CharacterRange>& ranges, UChar lo, UChar hi);
-
-        int m_charBuffer;
-        bool m_isPendingDash;
-        bool m_isCaseInsensitive;
-        bool m_isUpsideDown;
-
-        Vector<UChar> m_matches;
-        Vector<CharacterRange> m_ranges;
-        Vector<UChar> m_matchesUnicode;
-        Vector<CharacterRange> m_rangesUnicode;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // CharacterClassConstructor_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/Escapes.h b/src/3rdparty/webkit/JavaScriptCore/wrec/Escapes.h
deleted file mode 100644
index 16c1d6fb42..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/Escapes.h
+++ /dev/null
@@ -1,150 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef Escapes_h
-#define Escapes_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include <wtf/Assertions.h>
-
-namespace JSC { namespace WREC {
-
-    class CharacterClass;
-
-    class Escape {
-    public:
-        enum Type {
-            PatternCharacter,
-            CharacterClass,
-            Backreference,
-            WordBoundaryAssertion,
-            Error,
-        };
-        
-        Escape(Type type)
-            : m_type(type)
-        {
-        }
-
-        Type type() const { return m_type; }
-
-    private:
-        Type m_type;
-        
-    protected:
-        // Used by subclasses to store data.
-        union {
-            int i;
-            const WREC::CharacterClass* c;
-        } m_u;
-        bool m_invert;
-    };
-
-    class PatternCharacterEscape : public Escape {
-    public:
-        static const PatternCharacterEscape& cast(const Escape& escape)
-        {
-            ASSERT(escape.type() == PatternCharacter);
-            return static_cast<const PatternCharacterEscape&>(escape);
-        }
-        
-        PatternCharacterEscape(int character)
-            : Escape(PatternCharacter)
-        {
-            m_u.i = character;
-        }
-        
-        operator Escape() const { return *this; }
-        
-        int character() const { return m_u.i; }
-    };
-
-    class CharacterClassEscape : public Escape {
-    public:
-        static const CharacterClassEscape& cast(const Escape& escape)
-        {
-            ASSERT(escape.type() == CharacterClass);
-            return static_cast<const CharacterClassEscape&>(escape);
-        }
-        
-        CharacterClassEscape(const WREC::CharacterClass& characterClass, bool invert)
-            : Escape(CharacterClass)
-        {
-            m_u.c = &characterClass;
-            m_invert = invert;
-        }
-        
-        operator Escape() { return *this; }
-        
-        const WREC::CharacterClass& characterClass() const { return *m_u.c; }
-        bool invert() const { return m_invert; }
-    };
-
-    class BackreferenceEscape : public Escape {
-    public:
-        static const BackreferenceEscape& cast(const Escape& escape)
-        {
-            ASSERT(escape.type() == Backreference);
-            return static_cast<const BackreferenceEscape&>(escape);
-        }
-        
-        BackreferenceEscape(int subpatternId)
-            : Escape(Backreference)
-        {
-            m_u.i = subpatternId;
-        }
-        
-        operator Escape() const { return *this; }
-        
-        int subpatternId() const { return m_u.i; }
-    };
-
-    class WordBoundaryAssertionEscape : public Escape {
-    public:
-        static const WordBoundaryAssertionEscape& cast(const Escape& escape)
-        {
-            ASSERT(escape.type() == WordBoundaryAssertion);
-            return static_cast<const WordBoundaryAssertionEscape&>(escape);
-        }
-        
-        WordBoundaryAssertionEscape(bool invert)
-            : Escape(WordBoundaryAssertion)
-        {
-            m_invert = invert;
-        }
-        
-        operator Escape() const { return *this; }
-        
-        bool invert() const { return m_invert; }
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // Escapes_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/Quantifier.h b/src/3rdparty/webkit/JavaScriptCore/wrec/Quantifier.h
deleted file mode 100644
index 3da74cda14..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/Quantifier.h
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef Quantifier_h
-#define Quantifier_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include <wtf/Assertions.h>
-#include <limits.h>
-
-namespace JSC { namespace WREC {
-
-    struct Quantifier {
-        enum Type {
-            None,
-            Greedy,
-            NonGreedy,
-            Error,
-        };
-
-        Quantifier(Type type = None, unsigned min = 0, unsigned max = Infinity)
-            : type(type)
-            , min(min)
-            , max(max)
-        {
-            ASSERT(min <= max);
-        }
-
-        Type type;
-
-        unsigned min;
-        unsigned max;
-
-        static const unsigned Infinity = UINT_MAX;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // Quantifier_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp
deleted file mode 100644
index 145a1cee8f..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "WREC.h"
-
-#if ENABLE(WREC)
-
-#include "CharacterClassConstructor.h"
-#include "Interpreter.h"
-#include "JSGlobalObject.h"
-#include "RegisterFile.h"
-#include "WRECFunctors.h"
-#include "WRECParser.h"
-#include "pcre_internal.h"
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-CompiledRegExp Generator::compileRegExp(JSGlobalData* globalData, const UString& pattern, unsigned* numSubpatterns_ptr, const char** error_ptr, RefPtr<ExecutablePool>& pool, bool ignoreCase, bool multiline)
-{
-    if (pattern.size() > MAX_PATTERN_SIZE) {
-        *error_ptr = "regular expression too large";
-        return 0;
-    }
-
-    Parser parser(pattern, ignoreCase, multiline);
-    Generator& generator = parser.generator();
-    MacroAssembler::JumpList failures;
-    MacroAssembler::Jump endOfInput;
-
-    generator.generateEnter();
-    generator.generateSaveIndex();
-
-    Label beginPattern(&generator);
-    parser.parsePattern(failures);
-    generator.generateReturnSuccess();
-
-    failures.link(&generator);
-    generator.generateIncrementIndex(&endOfInput);
-    parser.parsePattern(failures);
-    generator.generateReturnSuccess();
-
-    failures.link(&generator);
-    generator.generateIncrementIndex();
-    generator.generateJumpIfNotEndOfInput(beginPattern);
-    
-    endOfInput.link(&generator);
-    generator.generateReturnFailure();
-
-    if (parser.error()) {
-        *error_ptr = parser.syntaxError(); // NULL in the case of patterns that WREC doesn't support yet.
-        return 0;
-    }
-
-    *numSubpatterns_ptr = parser.numSubpatterns();
-    pool = globalData->executableAllocator.poolForSize(generator.size());
-    return reinterpret_cast<CompiledRegExp>(generator.copyCode(pool.get()));
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.cpp
deleted file mode 100644
index 5f1674efc1..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.cpp
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "WRECFunctors.h"
-
-#if ENABLE(WREC)
-
-#include "WRECGenerator.h"
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-void GeneratePatternCharacterFunctor::generateAtom(Generator* generator, Generator::JumpList& failures)
-{
-    generator->generatePatternCharacter(failures, m_ch);
-}
-
-void GeneratePatternCharacterFunctor::backtrack(Generator* generator)
-{
-    generator->generateBacktrack1();
-}
-
-void GenerateCharacterClassFunctor::generateAtom(Generator* generator, Generator::JumpList& failures)
-{
-    generator->generateCharacterClass(failures, *m_charClass, m_invert);
-}
-
-void GenerateCharacterClassFunctor::backtrack(Generator* generator)
-{
-    generator->generateBacktrack1();
-}
-
-void GenerateBackreferenceFunctor::generateAtom(Generator* generator, Generator::JumpList& failures)
-{
-    generator->generateBackreference(failures, m_subpatternId);
-}
-
-void GenerateBackreferenceFunctor::backtrack(Generator* generator)
-{
-    generator->generateBacktrackBackreference(m_subpatternId);
-}
-
-void GenerateParenthesesNonGreedyFunctor::generateAtom(Generator* generator, Generator::JumpList& failures)
-{
-    generator->generateParenthesesNonGreedy(failures, m_start, m_success, m_fail);
-}
-
-void GenerateParenthesesNonGreedyFunctor::backtrack(Generator*)
-{
-    // FIXME: do something about this.
-    CRASH();
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.h b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.h
deleted file mode 100644
index 610ce559e9..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.h
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include "WRECGenerator.h"
-#include <wtf/unicode/Unicode.h>
-
-namespace JSC { namespace WREC {
-
-    struct CharacterClass;
-
-    class GenerateAtomFunctor {
-    public:
-        virtual ~GenerateAtomFunctor() {}
-
-        virtual void generateAtom(Generator*, Generator::JumpList&) = 0;
-        virtual void backtrack(Generator*) = 0;
-    };
-
-    class GeneratePatternCharacterFunctor : public GenerateAtomFunctor {
-    public:
-        GeneratePatternCharacterFunctor(const UChar ch)
-            : m_ch(ch)
-        {
-        }
-
-        virtual void generateAtom(Generator*, Generator::JumpList&);
-        virtual void backtrack(Generator*);
-
-    private:
-        const UChar m_ch;
-    };
-
-    class GenerateCharacterClassFunctor : public GenerateAtomFunctor {
-    public:
-        GenerateCharacterClassFunctor(const CharacterClass* charClass, bool invert)
-            : m_charClass(charClass)
-            , m_invert(invert)
-        {
-        }
-
-        virtual void generateAtom(Generator*, Generator::JumpList&);
-        virtual void backtrack(Generator*);
-
-    private:
-        const CharacterClass* m_charClass;
-        bool m_invert;
-    };
-
-    class GenerateBackreferenceFunctor : public GenerateAtomFunctor {
-    public:
-        GenerateBackreferenceFunctor(unsigned subpatternId)
-            : m_subpatternId(subpatternId)
-        {
-        }
-
-        virtual void generateAtom(Generator*, Generator::JumpList&);
-        virtual void backtrack(Generator*);
-
-    private:
-        unsigned m_subpatternId;
-    };
-
-    class GenerateParenthesesNonGreedyFunctor : public GenerateAtomFunctor {
-    public:
-        GenerateParenthesesNonGreedyFunctor(Generator::Label start, Generator::Jump success, Generator::Jump fail)
-            : m_start(start)
-            , m_success(success)
-            , m_fail(fail)
-        {
-        }
-
-        virtual void generateAtom(Generator*, Generator::JumpList&);
-        virtual void backtrack(Generator*);
-
-    private:
-        Generator::Label m_start;
-        Generator::Jump m_success;
-        Generator::Jump m_fail;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp
deleted file mode 100644
index e62add37d8..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp
+++ /dev/null
@@ -1,653 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "WREC.h"
-
-#if ENABLE(WREC)
-
-#include "CharacterClassConstructor.h"
-#include "Interpreter.h"
-#include "WRECFunctors.h"
-#include "WRECParser.h"
-#include "pcre_internal.h"
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-void Generator::generateEnter()
-{
-#if PLATFORM(X86)
-    // On x86 edi & esi are callee preserved registers.
-    push(X86Registers::edi);
-    push(X86Registers::esi);
-    
-#if COMPILER(MSVC)
-    // Move the arguments into registers.
-    peek(input, 3);
-    peek(index, 4);
-    peek(length, 5);
-    peek(output, 6);
-#else
-    // On gcc the function is regparm(3), so the input, index, and length registers
-    // (eax, edx, and ecx respectively) already contain the appropriate values.
-    // Just load the fourth argument (output) into edi
-    peek(output, 3);
-#endif
-#endif
-}
-
-void Generator::generateReturnSuccess()
-{
-    ASSERT(returnRegister != index);
-    ASSERT(returnRegister != output);
-
-    // Set return value.
-    pop(returnRegister); // match begin
-    store32(returnRegister, output);
-    store32(index, Address(output, 4)); // match end
-    
-    // Restore callee save registers.
-#if PLATFORM(X86)
-    pop(X86Registers::esi);
-    pop(X86Registers::edi);
-#endif
-    ret();
-}
-
-void Generator::generateSaveIndex()
-{
-    push(index);
-}
-
-void Generator::generateIncrementIndex(Jump* failure)
-{
-    peek(index);
-    if (failure)
-        *failure = branch32(Equal, length, index);
-    add32(Imm32(1), index);
-    poke(index);
-}
-
-void Generator::generateLoadCharacter(JumpList& failures)
-{
-    failures.append(branch32(Equal, length, index));
-    load16(BaseIndex(input, index, TimesTwo), character);
-}
-
-// For the sake of end-of-line assertions, we treat one-past-the-end as if it
-// were part of the input string.
-void Generator::generateJumpIfNotEndOfInput(Label target)
-{
-    branch32(LessThanOrEqual, index, length, target);
-}
-
-void Generator::generateReturnFailure()
-{
-    pop();
-    move(Imm32(-1), returnRegister);
-
-#if PLATFORM(X86)
-    pop(X86Registers::esi);
-    pop(X86Registers::edi);
-#endif
-    ret();
-}
-
-void Generator::generateBacktrack1()
-{
-    sub32(Imm32(1), index);
-}
-
-void Generator::generateBacktrackBackreference(unsigned subpatternId)
-{
-    sub32(Address(output, (2 * subpatternId + 1) * sizeof(int)), index);
-    add32(Address(output, (2 * subpatternId) * sizeof(int)), index);
-}
-
-void Generator::generateBackreferenceQuantifier(JumpList& failures, Quantifier::Type quantifierType, unsigned subpatternId, unsigned min, unsigned max)
-{
-    GenerateBackreferenceFunctor functor(subpatternId);
-
-    load32(Address(output, (2 * subpatternId) * sizeof(int)), character);
-    Jump skipIfEmpty = branch32(Equal, Address(output, ((2 * subpatternId) + 1) * sizeof(int)), character);
-
-    ASSERT(quantifierType == Quantifier::Greedy || quantifierType == Quantifier::NonGreedy);
-    if (quantifierType == Quantifier::Greedy)
-        generateGreedyQuantifier(failures, functor, min, max);
-    else
-        generateNonGreedyQuantifier(failures, functor, min, max);
-
-    skipIfEmpty.link(this);
-}
-
-void Generator::generateNonGreedyQuantifier(JumpList& failures, GenerateAtomFunctor& functor, unsigned min, unsigned max)
-{
-    JumpList atomFailedList;
-    JumpList alternativeFailedList;
-
-    // (0) Setup: Save, then init repeatCount.
-    push(repeatCount);
-    move(Imm32(0), repeatCount);
-    Jump start = jump();
-
-    // (4) Quantifier failed: No more atom reading possible.
-    Label quantifierFailed(this);
-    pop(repeatCount);
-    failures.append(jump()); 
-
-    // (3) Alternative failed: If we can, read another atom, then fall through to (2) to try again.
-    Label alternativeFailed(this);
-    pop(index);
-    if (max != Quantifier::Infinity)
-        branch32(Equal, repeatCount, Imm32(max), quantifierFailed);
-
-    // (1) Read an atom.
-    if (min)
-        start.link(this);
-    Label readAtom(this);
-    functor.generateAtom(this, atomFailedList);
-    atomFailedList.linkTo(quantifierFailed, this);
-    add32(Imm32(1), repeatCount);
-    
-    // (2) Keep reading if we're under the minimum.
-    if (min > 1)
-        branch32(LessThan, repeatCount, Imm32(min), readAtom);
-
-    // (3) Test the rest of the alternative.
-    if (!min)
-        start.link(this);
-    push(index);
-    m_parser.parseAlternative(alternativeFailedList);
-    alternativeFailedList.linkTo(alternativeFailed, this);
-
-    pop();
-    pop(repeatCount);
-}
-
-void Generator::generateGreedyQuantifier(JumpList& failures, GenerateAtomFunctor& functor, unsigned min, unsigned max)
-{
-    if (!max)
-        return;
-
-    JumpList doneReadingAtomsList;
-    JumpList alternativeFailedList;
-
-    // (0) Setup: Save, then init repeatCount.
-    push(repeatCount);
-    move(Imm32(0), repeatCount);
-
-    // (1) Greedily read as many copies of the atom as possible, then jump to (2).
-    Label readAtom(this);
-    functor.generateAtom(this, doneReadingAtomsList);
-    add32(Imm32(1), repeatCount);
-    if (max == Quantifier::Infinity)
-        jump(readAtom);
-    else if (max == 1)
-        doneReadingAtomsList.append(jump());
-    else {
-        branch32(NotEqual, repeatCount, Imm32(max), readAtom);
-        doneReadingAtomsList.append(jump());
-    }
-
-    // (5) Quantifier failed: No more backtracking possible.
-    Label quantifierFailed(this);
-    pop(repeatCount);
-    failures.append(jump()); 
-
-    // (4) Alternative failed: Backtrack, then fall through to (2) to try again.
-    Label alternativeFailed(this);
-    pop(index);
-    functor.backtrack(this);
-    sub32(Imm32(1), repeatCount);
-
-    // (2) Verify that we have enough atoms.
-    doneReadingAtomsList.link(this);
-    branch32(LessThan, repeatCount, Imm32(min), quantifierFailed);
-
-    // (3) Test the rest of the alternative.
-    push(index);
-    m_parser.parseAlternative(alternativeFailedList);
-    alternativeFailedList.linkTo(alternativeFailed, this);
-
-    pop();
-    pop(repeatCount);
-}
-
-void Generator::generatePatternCharacterSequence(JumpList& failures, int* sequence, size_t count)
-{
-    for (size_t i = 0; i < count;) {
-        if (i < count - 1) {
-            if (generatePatternCharacterPair(failures, sequence[i], sequence[i + 1])) {
-                i += 2;
-                continue;
-            }
-        }
-
-        generatePatternCharacter(failures, sequence[i]);
-        ++i;
-    }
-}
-
-bool Generator::generatePatternCharacterPair(JumpList& failures, int ch1, int ch2)
-{
-    if (m_parser.ignoreCase()) {
-        // Non-trivial case folding requires more than one test, so we can't
-        // test as a pair with an adjacent character.
-        if (!isASCII(ch1) && Unicode::toLower(ch1) != Unicode::toUpper(ch1))
-            return false;
-        if (!isASCII(ch2) && Unicode::toLower(ch2) != Unicode::toUpper(ch2))
-            return false;
-    }
-
-    // Optimistically consume 2 characters.
-    add32(Imm32(2), index);
-    failures.append(branch32(GreaterThan, index, length));
-
-    // Load the characters we just consumed, offset -2 characters from index.
-    load32(BaseIndex(input, index, TimesTwo, -2 * 2), character);
-
-    if (m_parser.ignoreCase()) {
-        // Convert ASCII alphabet characters to upper case before testing for
-        // equality. (ASCII non-alphabet characters don't require upper-casing
-        // because they have no uppercase equivalents. Unicode characters don't
-        // require upper-casing because we only handle Unicode characters whose
-        // upper and lower cases are equal.)
-        int ch1Mask = 0;
-        if (isASCIIAlpha(ch1)) {
-            ch1 |= 32;
-            ch1Mask = 32;
-        }
-
-        int ch2Mask = 0;
-        if (isASCIIAlpha(ch2)) {
-            ch2 |= 32;
-            ch2Mask = 32;
-        }
-
-        int mask = ch1Mask | (ch2Mask << 16);
-        if (mask)
-            or32(Imm32(mask), character);
-    }
-    int pair = ch1 | (ch2 << 16);
-
-    failures.append(branch32(NotEqual, character, Imm32(pair)));
-    return true;
-}
-
-void Generator::generatePatternCharacter(JumpList& failures, int ch)
-{
-    generateLoadCharacter(failures);
-
-    // used for unicode case insensitive
-    bool hasUpper = false;
-    Jump isUpper;
-    
-    // if case insensitive match
-    if (m_parser.ignoreCase()) {
-        UChar lower, upper;
-        
-        // check for ascii case sensitive characters
-        if (isASCIIAlpha(ch)) {
-            or32(Imm32(32), character);
-            ch |= 32;
-        } else if (!isASCII(ch) && ((lower = Unicode::toLower(ch)) != (upper = Unicode::toUpper(ch)))) {
-            // handle unicode case sentitive characters - branch to success on upper
-            isUpper = branch32(Equal, character, Imm32(upper));
-            hasUpper = true;
-            ch = lower;
-        }
-    }
-    
-    // checks for ch, or lower case version of ch, if insensitive
-    failures.append(branch32(NotEqual, character, Imm32((unsigned short)ch)));
-
-    if (m_parser.ignoreCase() && hasUpper) {
-        // for unicode case insensitive matches, branch here if upper matches.
-        isUpper.link(this);
-    }
-    
-    // on success consume the char
-    add32(Imm32(1), index);
-}
-
-void Generator::generateCharacterClassInvertedRange(JumpList& failures, JumpList& matchDest, const CharacterRange* ranges, unsigned count, unsigned* matchIndex, const UChar* matches, unsigned matchCount)
-{
-    do {
-        // pick which range we're going to generate
-        int which = count >> 1;
-        char lo = ranges[which].begin;
-        char hi = ranges[which].end;
-        
-        // check if there are any ranges or matches below lo.  If not, just jl to failure -
-        // if there is anything else to check, check that first, if it falls through jmp to failure.
-        if ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
-            Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
-            
-            // generate code for all ranges before this one
-            if (which)
-                generateCharacterClassInvertedRange(failures, matchDest, ranges, which, matchIndex, matches, matchCount);
-            
-            while ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
-                matchDest.append(branch32(Equal, character, Imm32((unsigned short)matches[*matchIndex])));
-                ++*matchIndex;
-            }
-            failures.append(jump());
-
-            loOrAbove.link(this);
-        } else if (which) {
-            Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
-
-            generateCharacterClassInvertedRange(failures, matchDest, ranges, which, matchIndex, matches, matchCount);
-            failures.append(jump());
-
-            loOrAbove.link(this);
-        } else
-            failures.append(branch32(LessThan, character, Imm32((unsigned short)lo)));
-
-        while ((*matchIndex < matchCount) && (matches[*matchIndex] <= hi))
-            ++*matchIndex;
-
-        matchDest.append(branch32(LessThanOrEqual, character, Imm32((unsigned short)hi)));
-        // fall through to here, the value is above hi.
-
-        // shuffle along & loop around if there are any more matches to handle.
-        unsigned next = which + 1;
-        ranges += next;
-        count -= next;
-    } while (count);
-}
-
-void Generator::generateCharacterClassInverted(JumpList& matchDest, const CharacterClass& charClass)
-{
-    Jump unicodeFail;
-    if (charClass.numMatchesUnicode || charClass.numRangesUnicode) {
-        Jump isAscii = branch32(LessThanOrEqual, character, Imm32(0x7f));
-    
-        if (charClass.numMatchesUnicode) {
-            for (unsigned i = 0; i < charClass.numMatchesUnicode; ++i) {
-                UChar ch = charClass.matchesUnicode[i];
-                matchDest.append(branch32(Equal, character, Imm32(ch)));
-            }
-        }
-        
-        if (charClass.numRangesUnicode) {
-            for (unsigned i = 0; i < charClass.numRangesUnicode; ++i) {
-                UChar lo = charClass.rangesUnicode[i].begin;
-                UChar hi = charClass.rangesUnicode[i].end;
-                
-                Jump below = branch32(LessThan, character, Imm32(lo));
-                matchDest.append(branch32(LessThanOrEqual, character, Imm32(hi)));
-                below.link(this);
-            }
-        }
-
-        unicodeFail = jump();
-        isAscii.link(this);
-    }
-
-    if (charClass.numRanges) {
-        unsigned matchIndex = 0;
-        JumpList failures; 
-        generateCharacterClassInvertedRange(failures, matchDest, charClass.ranges, charClass.numRanges, &matchIndex, charClass.matches, charClass.numMatches);
-        while (matchIndex < charClass.numMatches)
-            matchDest.append(branch32(Equal, character, Imm32((unsigned short)charClass.matches[matchIndex++])));
-
-        failures.link(this);
-    } else if (charClass.numMatches) {
-        // optimization: gather 'a','A' etc back together, can mask & test once.
-        Vector<char> matchesAZaz;
-
-        for (unsigned i = 0; i < charClass.numMatches; ++i) {
-            char ch = charClass.matches[i];
-            if (m_parser.ignoreCase()) {
-                if (isASCIILower(ch)) {
-                    matchesAZaz.append(ch);
-                    continue;
-                }
-                if (isASCIIUpper(ch))
-                    continue;
-            }
-            matchDest.append(branch32(Equal, character, Imm32((unsigned short)ch)));
-        }
-
-        if (unsigned countAZaz = matchesAZaz.size()) {
-            or32(Imm32(32), character);
-            for (unsigned i = 0; i < countAZaz; ++i)
-                matchDest.append(branch32(Equal, character, Imm32(matchesAZaz[i])));
-        }
-    }
-
-    if (charClass.numMatchesUnicode || charClass.numRangesUnicode)
-        unicodeFail.link(this);
-}
-
-void Generator::generateCharacterClass(JumpList& failures, const CharacterClass& charClass, bool invert)
-{
-    generateLoadCharacter(failures);
-
-    if (invert)
-        generateCharacterClassInverted(failures, charClass);
-    else {
-        JumpList successes;
-        generateCharacterClassInverted(successes, charClass);
-        failures.append(jump());
-        successes.link(this);
-    }
-    
-    add32(Imm32(1), index);
-}
-
-void Generator::generateParenthesesAssertion(JumpList& failures)
-{
-    JumpList disjunctionFailed;
-
-    push(index);
-    m_parser.parseDisjunction(disjunctionFailed);
-    Jump success = jump();
-
-    disjunctionFailed.link(this);
-    pop(index);
-    failures.append(jump());
-
-    success.link(this);
-    pop(index);
-}
-
-void Generator::generateParenthesesInvertedAssertion(JumpList& failures)
-{
-    JumpList disjunctionFailed;
-
-    push(index);
-    m_parser.parseDisjunction(disjunctionFailed);
-
-    // If the disjunction succeeded, the inverted assertion failed.
-    pop(index);
-    failures.append(jump());
-
-    // If the disjunction failed, the inverted assertion succeeded.
-    disjunctionFailed.link(this);
-    pop(index);
-}
-
-void Generator::generateParenthesesNonGreedy(JumpList& failures, Label start, Jump success, Jump fail)
-{
-    jump(start);
-    success.link(this);
-    failures.append(fail);
-}
-
-Generator::Jump Generator::generateParenthesesResetTrampoline(JumpList& newFailures, unsigned subpatternIdBefore, unsigned subpatternIdAfter)
-{
-    Jump skip = jump();
-    newFailures.link(this);
-    for (unsigned i = subpatternIdBefore + 1; i <= subpatternIdAfter; ++i) {
-        store32(Imm32(-1), Address(output, (2 * i) * sizeof(int)));
-        store32(Imm32(-1), Address(output, (2 * i + 1) * sizeof(int)));
-    }
-    
-    Jump newFailJump = jump();
-    skip.link(this);
-    
-    return newFailJump;
-}
-
-void Generator::generateAssertionBOL(JumpList& failures)
-{
-    if (m_parser.multiline()) {
-        JumpList previousIsNewline;
-
-        // begin of input == success
-        previousIsNewline.append(branch32(Equal, index, Imm32(0)));
-
-        // now check prev char against newline characters.
-        load16(BaseIndex(input, index, TimesTwo, -2), character);
-        generateCharacterClassInverted(previousIsNewline, CharacterClass::newline());
-
-        failures.append(jump());
-
-        previousIsNewline.link(this);
-    } else
-        failures.append(branch32(NotEqual, index, Imm32(0)));
-}
-
-void Generator::generateAssertionEOL(JumpList& failures)
-{
-    if (m_parser.multiline()) {
-        JumpList nextIsNewline;
-
-        generateLoadCharacter(nextIsNewline); // end of input == success
-        generateCharacterClassInverted(nextIsNewline, CharacterClass::newline());
-        failures.append(jump());
-        nextIsNewline.link(this);
-    } else {
-        failures.append(branch32(NotEqual, length, index));
-    }
-}
-
-void Generator::generateAssertionWordBoundary(JumpList& failures, bool invert)
-{
-    JumpList wordBoundary;
-    JumpList notWordBoundary;
-
-    // (1) Check if the previous value was a word char
-
-    // (1.1) check for begin of input
-    Jump atBegin = branch32(Equal, index, Imm32(0));
-    // (1.2) load the last char, and chck if is word character
-    load16(BaseIndex(input, index, TimesTwo, -2), character);
-    JumpList previousIsWord;
-    generateCharacterClassInverted(previousIsWord, CharacterClass::wordchar());
-    // (1.3) if we get here, previous is not a word char
-    atBegin.link(this);
-
-    // (2) Handle situation where previous was NOT a \w
-
-    generateLoadCharacter(notWordBoundary);
-    generateCharacterClassInverted(wordBoundary, CharacterClass::wordchar());
-    // (2.1) If we get here, neither chars are word chars
-    notWordBoundary.append(jump());
-
-    // (3) Handle situation where previous was a \w
-
-    // (3.0) link success in first match to here
-    previousIsWord.link(this);
-    generateLoadCharacter(wordBoundary);
-    generateCharacterClassInverted(notWordBoundary, CharacterClass::wordchar());
-    // (3.1) If we get here, this is an end of a word, within the input.
-    
-    // (4) Link everything up
-    
-    if (invert) {
-        // handle the fall through case
-        wordBoundary.append(jump());
-    
-        // looking for non word boundaries, so link boundary fails to here.
-        notWordBoundary.link(this);
-
-        failures.append(wordBoundary);
-    } else {
-        // looking for word boundaries, so link successes here.
-        wordBoundary.link(this);
-        
-        failures.append(notWordBoundary);
-    }
-}
-
-void Generator::generateBackreference(JumpList& failures, unsigned subpatternId)
-{
-    push(index);
-    push(repeatCount);
-
-    // get the start pos of the backref into repeatCount (multipurpose!)
-    load32(Address(output, (2 * subpatternId) * sizeof(int)), repeatCount);
-
-    Jump skipIncrement = jump();
-    Label topOfLoop(this);
-
-    add32(Imm32(1), index);
-    add32(Imm32(1), repeatCount);
-    skipIncrement.link(this);
-
-    // check if we're at the end of backref (if we are, success!)
-    Jump endOfBackRef = branch32(Equal, Address(output, ((2 * subpatternId) + 1) * sizeof(int)), repeatCount);
-
-    load16(BaseIndex(input, repeatCount, MacroAssembler::TimesTwo), character);
-
-    // check if we've run out of input (this would be a can o'fail)
-    Jump endOfInput = branch32(Equal, length, index);
-
-    branch16(Equal, BaseIndex(input, index, TimesTwo), character, topOfLoop);
-
-    endOfInput.link(this);
-
-    // Failure
-    pop(repeatCount);
-    pop(index);
-    failures.append(jump());
-
-    // Success
-    endOfBackRef.link(this);
-    pop(repeatCount);
-    pop();
-}
-
-void Generator::terminateAlternative(JumpList& successes, JumpList& failures)
-{
-    successes.append(jump());
-    
-    failures.link(this);
-    peek(index);
-}
-
-void Generator::terminateDisjunction(JumpList& successes)
-{
-    successes.link(this);
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h
deleted file mode 100644
index 294c3d05fb..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h
+++ /dev/null
@@ -1,128 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef WRECGenerator_h
-#define WRECGenerator_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include "Quantifier.h"
-#include "MacroAssembler.h"
-#include <wtf/ASCIICType.h>
-#include <wtf/unicode/Unicode.h>
-#include "WREC.h"
-
-namespace JSC { 
-
-    class JSGlobalData;
-
-    namespace WREC {
-
-    class CharacterRange;
-    class GenerateAtomFunctor;
-    class Parser;
-    struct CharacterClass;
-
-    class Generator : private MacroAssembler {
-    public:
-        using MacroAssembler::Jump;
-        using MacroAssembler::JumpList;
-        using MacroAssembler::Label;
-
-        enum ParenthesesType { Capturing, NonCapturing, Assertion, InvertedAssertion, Error };
-
-        static CompiledRegExp compileRegExp(JSGlobalData*, const UString& pattern, unsigned* numSubpatterns_ptr, const char** error_ptr, RefPtr<ExecutablePool>& pool, bool ignoreCase = false, bool multiline = false);
-    
-        Generator(Parser& parser)
-            : m_parser(parser)
-        {
-        }
-
-#if PLATFORM(X86)
-        static const RegisterID input = X86Registers::eax;
-        static const RegisterID index = X86Registers::edx;
-        static const RegisterID length = X86Registers::ecx;
-        static const RegisterID output = X86Registers::edi;
-
-        static const RegisterID character = X86Registers::esi;
-        static const RegisterID repeatCount = X86Registers::ebx; // How many times the current atom repeats in the current match.
-
-        static const RegisterID returnRegister = X86Registers::eax;
-#endif
-#if PLATFORM(X86_64)
-        static const RegisterID input = X86Registers::edi;
-        static const RegisterID index = X86Registers::esi;
-        static const RegisterID length = X86Registers::edx;
-        static const RegisterID output = X86Registers::ecx;
-
-        static const RegisterID character = X86Registers::eax;
-        static const RegisterID repeatCount = X86Registers::ebx; // How many times the current atom repeats in the current match.
-
-        static const RegisterID returnRegister = X86Registers::eax;
-#endif
-
-        void generateEnter();
-        void generateSaveIndex();
-        void generateIncrementIndex(Jump* failure = 0);
-        void generateLoadCharacter(JumpList& failures);
-        void generateJumpIfNotEndOfInput(Label);
-        void generateReturnSuccess();
-        void generateReturnFailure();
-
-        void generateGreedyQuantifier(JumpList& failures, GenerateAtomFunctor& functor, unsigned min, unsigned max);
-        void generateNonGreedyQuantifier(JumpList& failures, GenerateAtomFunctor& functor, unsigned min, unsigned max);
-        void generateBacktrack1();
-        void generateBacktrackBackreference(unsigned subpatternId);
-        void generateCharacterClass(JumpList& failures, const CharacterClass& charClass, bool invert);
-        void generateCharacterClassInverted(JumpList& failures, const CharacterClass& charClass);
-        void generateCharacterClassInvertedRange(JumpList& failures, JumpList& matchDest, const CharacterRange* ranges, unsigned count, unsigned* matchIndex, const UChar* matches, unsigned matchCount);
-        void generatePatternCharacter(JumpList& failures, int ch);
-        void generatePatternCharacterSequence(JumpList& failures, int* sequence, size_t count);
-        void generateAssertionWordBoundary(JumpList& failures, bool invert);
-        void generateAssertionBOL(JumpList& failures);
-        void generateAssertionEOL(JumpList& failures);
-        void generateBackreference(JumpList& failures, unsigned subpatternID);
-        void generateBackreferenceQuantifier(JumpList& failures, Quantifier::Type quantifierType, unsigned subpatternId, unsigned min, unsigned max);
-        void generateParenthesesAssertion(JumpList& failures);
-        void generateParenthesesInvertedAssertion(JumpList& failures);
-        Jump generateParenthesesResetTrampoline(JumpList& newFailures, unsigned subpatternIdBefore, unsigned subpatternIdAfter);
-        void generateParenthesesNonGreedy(JumpList& failures, Label start, Jump success, Jump fail);
-
-        void terminateAlternative(JumpList& successes, JumpList& failures);
-        void terminateDisjunction(JumpList& successes);
-
-    private:
-        bool generatePatternCharacterPair(JumpList& failures, int ch1, int ch2);
-
-        Parser& m_parser;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // WRECGenerator_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp
deleted file mode 100644
index 1709bf9290..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp
+++ /dev/null
@@ -1,643 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "WRECParser.h"
-
-#if ENABLE(WREC)
-
-#include "CharacterClassConstructor.h"
-#include "WRECFunctors.h"
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-// These error messages match the error messages used by PCRE.
-const char* Parser::QuantifierOutOfOrder = "numbers out of order in {} quantifier";
-const char* Parser::QuantifierWithoutAtom = "nothing to repeat";
-const char* Parser::ParenthesesUnmatched = "unmatched parentheses";
-const char* Parser::ParenthesesTypeInvalid = "unrecognized character after (?";
-const char* Parser::ParenthesesNotSupported = ""; // Not a user-visible syntax error -- just signals a syntax that WREC doesn't support yet.
-const char* Parser::CharacterClassUnmatched = "missing terminating ] for character class";
-const char* Parser::CharacterClassOutOfOrder = "range out of order in character class";
-const char* Parser::EscapeUnterminated = "\\ at end of pattern";
-
-class PatternCharacterSequence {
-typedef Generator::JumpList JumpList;
-
-public:
-    PatternCharacterSequence(Generator& generator, JumpList& failures)
-        : m_generator(generator)
-        , m_failures(failures)
-    {
-    }
-    
-    size_t size() { return m_sequence.size(); }
-    
-    void append(int ch)
-    {
-        m_sequence.append(ch);
-    }
-    
-    void flush()
-    {
-        if (!m_sequence.size())
-            return;
-
-        m_generator.generatePatternCharacterSequence(m_failures, m_sequence.begin(), m_sequence.size());
-        m_sequence.clear();
-    }
-
-    void flush(const Quantifier& quantifier)
-    {
-        if (!m_sequence.size())
-            return;
-
-        m_generator.generatePatternCharacterSequence(m_failures, m_sequence.begin(), m_sequence.size() - 1);
-
-        switch (quantifier.type) {
-        case Quantifier::None:
-        case Quantifier::Error:
-            ASSERT_NOT_REACHED();
-            break;
-
-        case Quantifier::Greedy: {
-            GeneratePatternCharacterFunctor functor(m_sequence.last());
-            m_generator.generateGreedyQuantifier(m_failures, functor, quantifier.min, quantifier.max);
-            break;
-        }
-        
-        case Quantifier::NonGreedy: {
-            GeneratePatternCharacterFunctor functor(m_sequence.last());
-            m_generator.generateNonGreedyQuantifier(m_failures, functor, quantifier.min, quantifier.max);
-            break;
-        }
-        }
-        
-        m_sequence.clear();
-    }
-
-private:
-    Generator& m_generator;
-    JumpList& m_failures;
-    Vector<int, 8> m_sequence;
-};
-
-ALWAYS_INLINE Quantifier Parser::consumeGreedyQuantifier()
-{
-    switch (peek()) {
-        case '?':
-            consume();
-            return Quantifier(Quantifier::Greedy, 0, 1);
-
-        case '*':
-            consume();
-            return Quantifier(Quantifier::Greedy, 0);
-
-        case '+':
-            consume();
-            return Quantifier(Quantifier::Greedy, 1);
-
-        case '{': {
-            SavedState state(*this);
-            consume();
-
-            // Accept: {n}, {n,}, {n,m}.
-            // Reject: {n,m} where n > m.
-            // Ignore: Anything else, such as {n, m}.
-
-            if (!peekIsDigit()) {
-                state.restore();
-                return Quantifier();
-            }
-
-            unsigned min = consumeNumber();
-            unsigned max = min;
-
-            if (peek() == ',') {
-                consume();
-                max = peekIsDigit() ? consumeNumber() : Quantifier::Infinity;
-            }
-
-            if (peek() != '}') {
-                state.restore();
-                return Quantifier();
-            }
-            consume();
- 
-            if (min > max) {
-                setError(QuantifierOutOfOrder);
-                return Quantifier(Quantifier::Error);
-            }
-
-            return Quantifier(Quantifier::Greedy, min, max);
-         }
-
-         default:
-            return Quantifier(); // No quantifier.
-    }
-}
-
-Quantifier Parser::consumeQuantifier()
-{
-    Quantifier q = consumeGreedyQuantifier();
-    
-    if ((q.type == Quantifier::Greedy) && (peek() == '?')) {
-        consume();
-        q.type = Quantifier::NonGreedy;
-    }
-    
-    return q;
-}
-
-bool Parser::parseCharacterClassQuantifier(JumpList& failures, const CharacterClass& charClass, bool invert)
-{
-    Quantifier q = consumeQuantifier();
-
-    switch (q.type) {
-    case Quantifier::None: {
-        m_generator.generateCharacterClass(failures, charClass, invert);
-        break;
-    }
-
-    case Quantifier::Greedy: {
-        GenerateCharacterClassFunctor functor(&charClass, invert);
-        m_generator.generateGreedyQuantifier(failures, functor, q.min, q.max);
-        break;
-    }
-
-    case Quantifier::NonGreedy: {
-        GenerateCharacterClassFunctor functor(&charClass, invert);
-        m_generator.generateNonGreedyQuantifier(failures, functor, q.min, q.max);
-        break;
-    }
-
-    case Quantifier::Error:
-        return false;
-    }
-    
-    return true;
-}
-
-bool Parser::parseBackreferenceQuantifier(JumpList& failures, unsigned subpatternId)
-{
-    Quantifier q = consumeQuantifier();
-
-    switch (q.type) {
-    case Quantifier::None: {
-        m_generator.generateBackreference(failures, subpatternId);
-        break;
-    }
-
-    case Quantifier::Greedy:
-    case Quantifier::NonGreedy:
-        m_generator.generateBackreferenceQuantifier(failures, q.type, subpatternId, q.min, q.max);
-        return true;
-
-    case Quantifier::Error:
-        return false;
-    }
-    
-    return true;
-}
-
-bool Parser::parseParentheses(JumpList& failures)
-{
-    ParenthesesType type = consumeParenthesesType();
-
-    // FIXME: WREC originally failed to backtrack correctly in cases such as
-    // "c".match(/(.*)c/). Now, most parentheses handling is disabled. For
-    // unsupported parentheses, we fall back on PCRE.
-
-    switch (type) {
-        case Generator::Assertion: {
-            m_generator.generateParenthesesAssertion(failures);
-
-            if (consume() != ')') {
-                setError(ParenthesesUnmatched);
-                return false;
-            }
-
-            Quantifier quantifier = consumeQuantifier();
-            if (quantifier.type != Quantifier::None && quantifier.min == 0) {
-                setError(ParenthesesNotSupported);
-                return false;
-            }
-
-            return true;
-        }
-        case Generator::InvertedAssertion: {
-            m_generator.generateParenthesesInvertedAssertion(failures);
-
-            if (consume() != ')') {
-                setError(ParenthesesUnmatched);
-                return false;
-            }
-
-            Quantifier quantifier = consumeQuantifier();
-            if (quantifier.type != Quantifier::None && quantifier.min == 0) {
-                setError(ParenthesesNotSupported);
-                return false;
-            }
-
-            return true;
-        }
-        default:
-            setError(ParenthesesNotSupported);
-            return false;
-    }
-}
-
-bool Parser::parseCharacterClass(JumpList& failures)
-{
-    bool invert = false;
-    if (peek() == '^') {
-        consume();
-        invert = true;
-    }
-
-    CharacterClassConstructor constructor(m_ignoreCase);
-
-    int ch;
-    while ((ch = peek()) != ']') {
-        switch (ch) {
-        case EndOfPattern:
-            setError(CharacterClassUnmatched);
-            return false;
-
-        case '\\': {
-            consume();
-            Escape escape = consumeEscape(true);
-
-            switch (escape.type()) {
-                case Escape::PatternCharacter: {
-                    int character = PatternCharacterEscape::cast(escape).character();
-                    if (character == '-')
-                        constructor.flushBeforeEscapedHyphen();
-                    constructor.put(character);
-                    break;
-                }
-                case Escape::CharacterClass: {
-                    const CharacterClassEscape& characterClassEscape = CharacterClassEscape::cast(escape);
-                    ASSERT(!characterClassEscape.invert());
-                    constructor.append(characterClassEscape.characterClass());
-                    break;
-                }
-                case Escape::Error:
-                    return false;
-                case Escape::Backreference:
-                case Escape::WordBoundaryAssertion: {
-                    ASSERT_NOT_REACHED();
-                    break;
-                }
-            }
-            break;
-        }
-
-        default:
-            consume();
-            constructor.put(ch);
-        }
-    }
-    consume();
-
-    // lazily catch reversed ranges ([z-a])in character classes
-    if (constructor.isUpsideDown()) {
-        setError(CharacterClassOutOfOrder);
-        return false;
-    }
-
-    constructor.flush();
-    CharacterClass charClass = constructor.charClass();
-    return parseCharacterClassQuantifier(failures, charClass, invert);
-}
-
-bool Parser::parseNonCharacterEscape(JumpList& failures, const Escape& escape)
-{
-    switch (escape.type()) {
-        case Escape::PatternCharacter:
-            ASSERT_NOT_REACHED();
-            return false;
-
-        case Escape::CharacterClass:
-            return parseCharacterClassQuantifier(failures, CharacterClassEscape::cast(escape).characterClass(), CharacterClassEscape::cast(escape).invert());
-
-        case Escape::Backreference:
-            return parseBackreferenceQuantifier(failures, BackreferenceEscape::cast(escape).subpatternId());
-
-        case Escape::WordBoundaryAssertion:
-            m_generator.generateAssertionWordBoundary(failures, WordBoundaryAssertionEscape::cast(escape).invert());
-            return true;
-
-        case Escape::Error:
-            return false;
-    }
-
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-Escape Parser::consumeEscape(bool inCharacterClass)
-{
-    switch (peek()) {
-    case EndOfPattern:
-        setError(EscapeUnterminated);
-        return Escape(Escape::Error);
-
-    // Assertions
-    case 'b':
-        consume();
-        if (inCharacterClass)
-            return PatternCharacterEscape('\b');
-        return WordBoundaryAssertionEscape(false); // do not invert
-    case 'B':
-        consume();
-        if (inCharacterClass)
-            return PatternCharacterEscape('B');
-        return WordBoundaryAssertionEscape(true); // invert
-
-    // CharacterClassEscape
-    case 'd':
-        consume();
-        return CharacterClassEscape(CharacterClass::digits(), false);
-    case 's':
-        consume();
-        return CharacterClassEscape(CharacterClass::spaces(), false);
-    case 'w':
-        consume();
-        return CharacterClassEscape(CharacterClass::wordchar(), false);
-    case 'D':
-        consume();
-        return inCharacterClass
-            ? CharacterClassEscape(CharacterClass::nondigits(), false)
-            : CharacterClassEscape(CharacterClass::digits(), true);
-    case 'S':
-        consume();
-        return inCharacterClass
-            ? CharacterClassEscape(CharacterClass::nonspaces(), false)
-            : CharacterClassEscape(CharacterClass::spaces(), true);
-    case 'W':
-        consume();
-        return inCharacterClass
-            ? CharacterClassEscape(CharacterClass::nonwordchar(), false)
-            : CharacterClassEscape(CharacterClass::wordchar(), true);
-
-    // DecimalEscape
-    case '1':
-    case '2':
-    case '3':
-    case '4':
-    case '5':
-    case '6':
-    case '7':
-    case '8':
-    case '9': {
-        if (peekDigit() > m_numSubpatterns || inCharacterClass) {
-            // To match Firefox, we parse an invalid backreference in the range [1-7]
-            // as an octal escape.
-            return peekDigit() > 7 ? PatternCharacterEscape('\\') : PatternCharacterEscape(consumeOctal());
-        }
-
-        int value = 0;
-        do {
-            unsigned newValue = value * 10 + peekDigit();
-            if (newValue > m_numSubpatterns)
-                break;
-            value = newValue;
-            consume();
-        } while (peekIsDigit());
-
-        return BackreferenceEscape(value);
-    }
-
-    // Octal escape
-    case '0':
-        consume();
-        return PatternCharacterEscape(consumeOctal());
-
-    // ControlEscape
-    case 'f':
-        consume();
-        return PatternCharacterEscape('\f');
-    case 'n':
-        consume();
-        return PatternCharacterEscape('\n');
-    case 'r':
-        consume();
-        return PatternCharacterEscape('\r');
-    case 't':
-        consume();
-        return PatternCharacterEscape('\t');
-    case 'v':
-        consume();
-        return PatternCharacterEscape('\v');
-
-    // ControlLetter
-    case 'c': {
-        SavedState state(*this);
-        consume();
-        
-        int control = consume();
-        // To match Firefox, inside a character class, we also accept numbers
-        // and '_' as control characters.
-        if ((!inCharacterClass && !isASCIIAlpha(control)) || (!isASCIIAlphanumeric(control) && control != '_')) {
-            state.restore();
-            return PatternCharacterEscape('\\');
-        }
-        return PatternCharacterEscape(control & 31);
-    }
-
-    // HexEscape
-    case 'x': {
-        consume();
-
-        SavedState state(*this);
-        int x = consumeHex(2);
-        if (x == -1) {
-            state.restore();
-            return PatternCharacterEscape('x');
-        }
-        return PatternCharacterEscape(x);
-    }
-
-    // UnicodeEscape
-    case 'u': {
-        consume();
-
-        SavedState state(*this);
-        int x = consumeHex(4);
-        if (x == -1) {
-            state.restore();
-            return PatternCharacterEscape('u');
-        }
-        return PatternCharacterEscape(x);
-    }
-
-    // IdentityEscape
-    default:
-        return PatternCharacterEscape(consume());
-    }
-}
-
-void Parser::parseAlternative(JumpList& failures)
-{
-    PatternCharacterSequence sequence(m_generator, failures);
-
-    while (1) {
-        switch (peek()) {
-        case EndOfPattern:
-        case '|':
-        case ')':
-            sequence.flush();
-            return;
-
-        case '*':
-        case '+':
-        case '?':
-        case '{': {
-            Quantifier q = consumeQuantifier();
-
-            if (q.type == Quantifier::None) {
-                sequence.append(consume());
-                continue;
-            }
-
-            if (q.type == Quantifier::Error)
-                return;
-
-            if (!sequence.size()) {
-                setError(QuantifierWithoutAtom);
-                return;
-            }
-
-            sequence.flush(q);
-            continue;
-        }
-
-        case '^':
-            consume();
-
-            sequence.flush();
-            m_generator.generateAssertionBOL(failures);
-            continue;
-
-        case '$':
-            consume();
-
-            sequence.flush();
-            m_generator.generateAssertionEOL(failures);
-            continue;
-
-        case '.':
-            consume();
-
-            sequence.flush();
-            if (!parseCharacterClassQuantifier(failures, CharacterClass::newline(), true))
-                return;
-            continue;
-
-        case '[':
-            consume();
-
-            sequence.flush();
-            if (!parseCharacterClass(failures))
-                return;
-            continue;
-
-        case '(':
-            consume();
-
-            sequence.flush();
-            if (!parseParentheses(failures))
-                return;
-            continue;
-
-        case '\\': {
-            consume();
-
-            Escape escape = consumeEscape(false);
-            if (escape.type() == Escape::PatternCharacter) {
-                sequence.append(PatternCharacterEscape::cast(escape).character());
-                continue;
-            }
-
-            sequence.flush();
-            if (!parseNonCharacterEscape(failures, escape))
-                return;
-            continue;
-        }
-
-        default:
-            sequence.append(consume());
-            continue;
-        }
-    }
-}
-
-/*
-  TOS holds index.
-*/
-void Parser::parseDisjunction(JumpList& failures)
-{
-    parseAlternative(failures);
-    if (peek() != '|')
-        return;
-
-    JumpList successes;
-    do {
-        consume();
-        m_generator.terminateAlternative(successes, failures);
-        parseAlternative(failures);
-    } while (peek() == '|');
-
-    m_generator.terminateDisjunction(successes);
-}
-
-Generator::ParenthesesType Parser::consumeParenthesesType()
-{
-    if (peek() != '?')
-        return Generator::Capturing;
-    consume();
-
-    switch (consume()) {
-    case ':':
-        return Generator::NonCapturing;
-    
-    case '=':
-        return Generator::Assertion;
-
-    case '!':
-        return Generator::InvertedAssertion;
-
-    default:
-        setError(ParenthesesTypeInvalid);
-        return Generator::Error;
-    }
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.h b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.h
deleted file mode 100644
index a3e151b7e0..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.h
+++ /dev/null
@@ -1,214 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef Parser_h
-#define Parser_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include "Escapes.h"
-#include "Quantifier.h"
-#include "UString.h"
-#include "WRECGenerator.h"
-#include <wtf/ASCIICType.h>
-
-namespace JSC { namespace WREC {
-
-    struct CharacterClass;
-
-    class Parser {
-    typedef Generator::JumpList JumpList;
-    typedef Generator::ParenthesesType ParenthesesType;
-
-    friend class SavedState;
-
-    public:
-        Parser(const UString& pattern, bool ignoreCase, bool multiline)
-            : m_generator(*this)
-            , m_data(pattern.data())
-            , m_size(pattern.size())
-            , m_ignoreCase(ignoreCase)
-            , m_multiline(multiline)
-        {
-            reset();
-        }
-        
-        Generator& generator() { return m_generator; }
-
-        bool ignoreCase() const { return m_ignoreCase; }
-        bool multiline() const { return m_multiline; }
-
-        void recordSubpattern() { ++m_numSubpatterns; }
-        unsigned numSubpatterns() const { return m_numSubpatterns; }
-        
-        const char* error() const { return m_error; }
-        const char* syntaxError() const { return m_error == ParenthesesNotSupported ? 0 : m_error; }
-        
-        void parsePattern(JumpList& failures)
-        {
-            reset();
-
-            parseDisjunction(failures);
-
-            if (peek() != EndOfPattern)
-                setError(ParenthesesUnmatched); // Parsing the pattern should fully consume it.
-        }
-
-        void parseDisjunction(JumpList& failures);
-        void parseAlternative(JumpList& failures);
-        bool parseTerm(JumpList& failures);
-        bool parseNonCharacterEscape(JumpList& failures, const Escape&);
-        bool parseParentheses(JumpList& failures);
-        bool parseCharacterClass(JumpList& failures);
-        bool parseCharacterClassQuantifier(JumpList& failures, const CharacterClass& charClass, bool invert);
-        bool parseBackreferenceQuantifier(JumpList& failures, unsigned subpatternId);
-
-    private:
-        class SavedState {
-        public:
-            SavedState(Parser& parser)
-                : m_parser(parser)
-                , m_index(parser.m_index)
-            {
-            }
-            
-            void restore()
-            {
-                m_parser.m_index = m_index;
-            }
-
-        private:
-            Parser& m_parser;
-            unsigned m_index;
-        };
-
-        void reset()
-        {
-            m_index = 0;
-            m_numSubpatterns = 0;
-            m_error = 0;
-        }
-
-        void setError(const char* error)
-        {
-            if (m_error)
-                return;
-            m_error = error;
-        }
-
-        int peek()
-        {
-            if (m_index >= m_size)
-                return EndOfPattern;
-            return m_data[m_index];
-        }
-
-        int consume()
-        {
-            if (m_index >= m_size)
-                return EndOfPattern;
-            return m_data[m_index++];
-        }
-
-        bool peekIsDigit()
-        {
-            return WTF::isASCIIDigit(peek());
-        }
-
-        unsigned peekDigit()
-        {
-            ASSERT(peekIsDigit());
-            return peek() - '0';
-        }
-
-        unsigned consumeDigit()
-        {
-            ASSERT(peekIsDigit());
-            return consume() - '0';
-        }
-
-        unsigned consumeNumber()
-        {
-            int n = consumeDigit();
-            while (peekIsDigit()) {
-                n *= 10;
-                n += consumeDigit();
-            }
-            return n;
-        }
-
-        int consumeHex(int count)
-        {
-            int n = 0;
-            while (count--) {
-                if (!WTF::isASCIIHexDigit(peek()))
-                    return -1;
-                n = (n << 4) | WTF::toASCIIHexValue(consume());
-            }
-            return n;
-        }
-
-        unsigned consumeOctal()
-        {
-            unsigned n = 0;
-            while (n < 32 && WTF::isASCIIOctalDigit(peek()))
-                n = n * 8 + consumeDigit();
-            return n;
-        }
-        
-        ALWAYS_INLINE Quantifier consumeGreedyQuantifier();
-        Quantifier consumeQuantifier();
-        Escape consumeEscape(bool inCharacterClass);
-        ParenthesesType consumeParenthesesType();
-
-        static const int EndOfPattern = -1;
-
-        // Error messages.
-        static const char* QuantifierOutOfOrder;
-        static const char* QuantifierWithoutAtom;
-        static const char* ParenthesesUnmatched;
-        static const char* ParenthesesTypeInvalid;
-        static const char* ParenthesesNotSupported;
-        static const char* CharacterClassUnmatched;
-        static const char* CharacterClassOutOfOrder;
-        static const char* EscapeUnterminated;
-
-        Generator m_generator;
-        const UChar* m_data;
-        unsigned m_size;
-        unsigned m_index;
-        bool m_ignoreCase;
-        bool m_multiline;
-        unsigned m_numSubpatterns;
-        const char* m_error;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // Parser_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wscript b/src/3rdparty/webkit/JavaScriptCore/wscript
index 7a5ba1bca6..61ad1fbc97 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wscript
+++ b/src/3rdparty/webkit/JavaScriptCore/wscript
@@ -29,18 +29,19 @@ import commands
 
 from settings import *
 
-jscore_excludes = ['jsc.cpp', 'ucptable.cpp', 'GOwnPtr.cpp']
-jscore_excludes.extend(get_excludes(jscore_dir, ['*CF.cpp', '*Symbian.cpp']))
+jscore_excludes = ['jsc.cpp', 'ucptable.cpp']
+jscore_excludes.extend(get_excludes(jscore_dir, ['*Brew.cpp', '*CF.cpp', '*Symbian.cpp']))
 
 sources = []
 
-jscore_excludes.extend(get_excludes(jscore_dir, ['*Win.cpp', '*None.cpp']))
+jscore_excludes.extend(get_excludes(jscore_dir, ['*None.cpp']))
 
 if building_on_win32:
-    jscore_excludes += ['ExecutableAllocatorPosix.cpp', 'MarkStackPosix.cpp']
+    jscore_excludes += ['ExecutableAllocatorPosix.cpp', 'MarkStackPosix.cpp', 'ThreadingPthreads.cpp']
     sources += ['jit/ExecutableAllocatorWin.cpp', 'runtime/MarkStackWin.cpp']
 else:
     jscore_excludes.append('JSStringRefBSTR.cpp')
+    jscore_excludes.extend(get_excludes(jscore_dir, ['*Win.cpp']))
 
 def generate_jscore_derived_sources():
     # build the derived sources
@@ -71,11 +72,13 @@ def build(bld):
     full_dirs = get_dirs_for_features(jscore_dir, features=[build_port], dirs=jscore_dirs)
 
     includes = common_includes + full_dirs
+    if sys.platform.startswith('darwin'):
+        includes.append(os.path.join(jscore_dir, 'icu'))
 
     # 1. A simple program
     jscore = bld.new_task_gen(
         features = 'cxx cstaticlib',
-        includes = '. .. assembler wrec DerivedSources ForwardingHeaders ' + ' '.join(includes),
+        includes = '. .. assembler DerivedSources ForwardingHeaders ' + ' '.join(includes),
         source = sources,
         target = 'jscore',
         uselib = 'WX ICU ' + get_config(),
@@ -86,7 +89,7 @@ def build(bld):
         
     obj = bld.new_task_gen(
         features = 'cxx cprogram',
-        includes = '. .. assembler wrec DerivedSources ForwardingHeaders ' + ' '.join(includes),
+        includes = '. .. assembler DerivedSources ForwardingHeaders ' + ' '.join(includes),
         source = 'jsc.cpp',
         target = 'jsc',
         uselib = 'WX ICU ' + get_config(),
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h
index 0c3c29fb3a..b43bb37851 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h
@@ -30,7 +30,6 @@
 #define WTF_ASCIICType_h
 
 #include <wtf/Assertions.h>
-#include <wtf/Platform.h>
 
 // The behavior of many of the functions in the <ctype.h> header is dependent
 // on the current locale. But in the WebKit project, all uses of those functions
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h b/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h
index 64fdd99577..ce27df6f6c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h
@@ -23,7 +23,7 @@
 #ifndef ALWAYS_INLINE
 #if COMPILER(GCC) && defined(NDEBUG) && !COMPILER(MINGW)
 #define ALWAYS_INLINE inline __attribute__((__always_inline__))
-#elif COMPILER(MSVC) && defined(NDEBUG)
+#elif (COMPILER(MSVC) || COMPILER(RVCT)) && defined(NDEBUG)
 #define ALWAYS_INLINE __forceinline
 #else
 #define ALWAYS_INLINE inline
@@ -33,6 +33,8 @@
 #ifndef NEVER_INLINE
 #if COMPILER(GCC)
 #define NEVER_INLINE __attribute__((__noinline__))
+#elif COMPILER(RVCT)
+#define NEVER_INLINE __declspec(noinline)
 #else
 #define NEVER_INLINE
 #endif
@@ -57,6 +59,8 @@
 #ifndef NO_RETURN
 #if COMPILER(GCC)
 #define NO_RETURN __attribute((__noreturn__))
+#elif COMPILER(RVCT)
+#define NO_RETURN __declspec(noreturn)
 #else
 #define NO_RETURN
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp
index 6c5e2e3069..cadbc915dc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp
@@ -35,7 +35,7 @@
 #include <CoreFoundation/CFString.h>
 #endif
 
-#if COMPILER(MSVC) && !PLATFORM(WINCE)
+#if COMPILER(MSVC) && !OS(WINCE)
 #ifndef WINVER
 #define WINVER 0x0500
 #endif
@@ -46,7 +46,7 @@
 #include <crtdbg.h>
 #endif
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 #include <winbase.h>
 #endif
 
@@ -82,7 +82,7 @@ static void vprintf_stderr_common(const char* format, va_list args)
                 break;
 
             if (_vsnprintf(buffer, size, format, args) != -1) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
                 // WinCE only supports wide chars
                 wchar_t* wideBuffer = (wchar_t*)malloc(size * sizeof(wchar_t));
                 if (wideBuffer == NULL)
@@ -105,7 +105,7 @@ static void vprintf_stderr_common(const char* format, va_list args)
         } while (size > 1024);
     }
 #endif
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
     vfprintf(stdout, format, args);
 #else
     vfprintf(stderr, format, args);
@@ -123,7 +123,7 @@ static void printf_stderr_common(const char* format, ...)
 
 static void printCallSite(const char* file, int line, const char* function)
 {
-#if PLATFORM(WIN) && !PLATFORM(WINCE) && defined _DEBUG
+#if OS(WIN) && !OS(WINCE) && defined _DEBUG
     _CrtDbgReport(_CRT_WARN, file, line, NULL, "%s\n", function);
 #else
     printf_stderr_common("(%s:%d %s)\n", file, line, function);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
index aa72e5af45..0e02af5ef1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
@@ -50,7 +50,7 @@
 #include <inttypes.h>
 #endif
 
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
 #include <e32def.h>
 #include <e32debug.h>
 #endif
@@ -61,24 +61,50 @@
 #define ASSERTIONS_DISABLED_DEFAULT 0
 #endif
 
+#if COMPILER(MSVC7) || COMPILER(WINSCW)
+#define HAVE_VARIADIC_MACRO 0
+#else
+#define HAVE_VARIADIC_MACRO 1
+#endif
+
 #ifndef ASSERT_DISABLED
 #define ASSERT_DISABLED ASSERTIONS_DISABLED_DEFAULT
 #endif
 
+#ifndef ASSERT_MSG_DISABLED
+#if HAVE(VARIADIC_MACRO)
+#define ASSERT_MSG_DISABLED ASSERTIONS_DISABLED_DEFAULT
+#else
+#define ASSERT_MSG_DISABLED 1
+#endif
+#endif
+
 #ifndef ASSERT_ARG_DISABLED
 #define ASSERT_ARG_DISABLED ASSERTIONS_DISABLED_DEFAULT
 #endif
 
 #ifndef FATAL_DISABLED
+#if HAVE(VARIADIC_MACRO)
 #define FATAL_DISABLED ASSERTIONS_DISABLED_DEFAULT
+#else
+#define FATAL_DISABLED 1
+#endif
 #endif
 
 #ifndef ERROR_DISABLED
+#if HAVE(VARIADIC_MACRO)
 #define ERROR_DISABLED ASSERTIONS_DISABLED_DEFAULT
+#else
+#define ERROR_DISABLED 1
+#endif
 #endif
 
 #ifndef LOG_DISABLED
+#if HAVE(VARIADIC_MACRO)
 #define LOG_DISABLED ASSERTIONS_DISABLED_DEFAULT
+#else
+#define LOG_DISABLED 1
+#endif
 #endif
 
 #if COMPILER(GCC)
@@ -125,7 +151,7 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 /* CRASH -- gets us into the debugger or the crash reporter -- signals are ignored by the crash reporter so we must do better */
 
 #ifndef CRASH
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
 #define CRASH() do { \
     __DEBUGGER(); \
     User::Panic(_L("Webkit CRASH"),0); \
@@ -138,9 +164,9 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 #endif
 #endif
 
-/* ASSERT, ASSERT_WITH_MESSAGE, ASSERT_NOT_REACHED */
+/* ASSERT, ASSERT_NOT_REACHED, ASSERT_UNUSED */
 
-#if PLATFORM(WINCE) && !PLATFORM(TORCHMOBILE)
+#if OS(WINCE) && !PLATFORM(TORCHMOBILE)
 /* FIXME: We include this here only to avoid a conflict with the ASSERT macro. */
 #include <windows.h>
 #undef min
@@ -148,21 +174,22 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 #undef ERROR
 #endif
 
-#if PLATFORM(WIN_OS) || PLATFORM(SYMBIAN)
+#if OS(WINDOWS) || OS(SYMBIAN)
 /* FIXME: Change to use something other than ASSERT to avoid this conflict with the underlying platform */
 #undef ASSERT
 #endif
 
+#if PLATFORM(BREWMP)
+/* FIXME: We include this here only to avoid a conflict with the COMPILE_ASSERT macro. */
+#include <AEEClassIDs.h>
+
+/* FIXME: Change to use something other than COMPILE_ASSERT to avoid this conflict with the underlying platform */
+#undef COMPILE_ASSERT
+#endif
+
 #if ASSERT_DISABLED
 
 #define ASSERT(assertion) ((void)0)
-#if COMPILER(MSVC7)
-#define ASSERT_WITH_MESSAGE(assertion) ((void)0)
-#elif COMPILER(WINSCW)
-#define ASSERT_WITH_MESSAGE(assertion, arg...) ((void)0)
-#else
-#define ASSERT_WITH_MESSAGE(assertion, ...) ((void)0)
-#endif /* COMPILER(MSVC7) */
 #define ASSERT_NOT_REACHED() ((void)0)
 #define ASSERT_UNUSED(variable, assertion) ((void)variable)
 
@@ -174,10 +201,24 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
         CRASH(); \
     } \
 while (0)
+
+#define ASSERT_NOT_REACHED() do { \
+    WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, 0); \
+    CRASH(); \
+} while (0)
+
+#define ASSERT_UNUSED(variable, assertion) ASSERT(assertion)
+
+#endif
+
+/* ASSERT_WITH_MESSAGE */
+
 #if COMPILER(MSVC7)
 #define ASSERT_WITH_MESSAGE(assertion) ((void)0)
 #elif COMPILER(WINSCW)
 #define ASSERT_WITH_MESSAGE(assertion, arg...) ((void)0)
+#elif ASSERT_MSG_DISABLED
+#define ASSERT_WITH_MESSAGE(assertion, ...) ((void)0)
 #else
 #define ASSERT_WITH_MESSAGE(assertion, ...) do \
     if (!(assertion)) { \
@@ -185,16 +226,9 @@ while (0)
         CRASH(); \
     } \
 while (0)
-#endif /* COMPILER(MSVC7) */
-#define ASSERT_NOT_REACHED() do { \
-    WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, 0); \
-    CRASH(); \
-} while (0)
-
-#define ASSERT_UNUSED(variable, assertion) ASSERT(assertion)
-
 #endif
-
+                        
+                        
 /* ASSERT_ARG */
 
 #if ASSERT_ARG_DISABLED
@@ -219,12 +253,12 @@ while (0)
 
 /* FATAL */
 
-#if FATAL_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
-#define FATAL(...) ((void)0)
-#elif COMPILER(MSVC7)
+#if COMPILER(MSVC7)
 #define FATAL() ((void)0)
 #elif COMPILER(WINSCW)
-#define FATAL(args...) ((void)0)
+#define FATAL(arg...) ((void)0)
+#elif FATAL_DISABLED
+#define FATAL(...) ((void)0)
 #else
 #define FATAL(...) do { \
     WTFReportFatalError(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, __VA_ARGS__); \
@@ -234,24 +268,24 @@ while (0)
 
 /* LOG_ERROR */
 
-#if ERROR_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
-#define LOG_ERROR(...) ((void)0)
-#elif COMPILER(MSVC7)
+#if COMPILER(MSVC7)
 #define LOG_ERROR() ((void)0)
 #elif COMPILER(WINSCW)
 #define LOG_ERROR(arg...)  ((void)0)
+#elif ERROR_DISABLED
+#define LOG_ERROR(...) ((void)0)
 #else
 #define LOG_ERROR(...) WTFReportError(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, __VA_ARGS__)
 #endif
 
 /* LOG */
 
-#if LOG_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
-#define LOG(channel, ...) ((void)0)
-#elif COMPILER(MSVC7)
+#if COMPILER(MSVC7)
 #define LOG() ((void)0)
 #elif COMPILER(WINSCW)
 #define LOG(arg...) ((void)0)
+#elif LOG_DISABLED
+#define LOG(channel, ...) ((void)0)
 #else
 #define LOG(channel, ...) WTFLog(&JOIN_LOG_CHANNEL_WITH_PREFIX(LOG_CHANNEL_PREFIX, channel), __VA_ARGS__)
 #define JOIN_LOG_CHANNEL_WITH_PREFIX(prefix, channel) JOIN_LOG_CHANNEL_WITH_PREFIX_LEVEL_2(prefix, channel)
@@ -260,12 +294,12 @@ while (0)
 
 /* LOG_VERBOSE */
 
-#if LOG_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
-#define LOG_VERBOSE(channel, ...) ((void)0)
-#elif COMPILER(MSVC7)
+#if COMPILER(MSVC7)
 #define LOG_VERBOSE(channel) ((void)0)
 #elif COMPILER(WINSCW)
 #define LOG_VERBOSE(channel, arg...) ((void)0)
+#elif LOG_DISABLED
+#define LOG_VERBOSE(channel, ...) ((void)0)
 #else
 #define LOG_VERBOSE(channel, ...) WTFLogVerbose(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, &JOIN_LOG_CHANNEL_WITH_PREFIX(LOG_CHANNEL_PREFIX, channel), __VA_ARGS__)
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Complex.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Complex.h
new file mode 100644
index 0000000000..cfd1d2008e
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Complex.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Complex_h
+#define Complex_h
+
+#include <complex>
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+typedef std::complex<double> Complex;
+
+inline Complex complexFromMagnitudePhase(double magnitude, double phase)
+{
+    return Complex(magnitude * cos(phase), magnitude * sin(phase));
+}
+
+} // namespace WebCore
+
+#endif // Complex_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
index b36cae5abb..30ca7c3692 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
@@ -33,7 +33,7 @@
 #include "config.h"
 #include "CurrentTime.h"
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 
 // Windows is first since we want to use hires timers, despite PLATFORM(CF)
 // being defined.
@@ -45,7 +45,7 @@
 #include <time.h>
 
 #if USE(QUERY_PERFORMANCE_COUNTER)
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 extern "C" time_t mktime(struct tm *t);
 #else
 #include <sys/timeb.h>
@@ -59,6 +59,8 @@ extern "C" time_t mktime(struct tm *t);
 #include <glib.h>
 #elif PLATFORM(WX)
 #include <wx/datetime.h>
+#elif PLATFORM(BREWMP)
+#include <AEEStdLib.h>
 #else // Posix systems relying on the gettimeofday()
 #include <sys/time.h>
 #endif
@@ -71,7 +73,7 @@ namespace WTF {
 
 const double msPerSecond = 1000.0;
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 
 #if USE(QUERY_PERFORMANCE_COUNTER)
 
@@ -123,7 +125,7 @@ static double highResUpTime()
 
 static double lowResUTCTime()
 {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     SYSTEMTIME systemTime;
     GetSystemTime(&systemTime);
     struct tm tmtime;
@@ -277,6 +279,20 @@ double currentTime()
     return (double)now.GetTicks() + (double)(now.GetMillisecond() / 1000.0);
 }
 
+#elif PLATFORM(BREWMP)
+
+// GETUTCSECONDS returns the number of seconds since 1980/01/06 00:00:00 UTC,
+// and GETTIMEMS returns the number of milliseconds that have elapsed since the last
+// occurrence of 00:00:00 local time.
+// We can combine GETUTCSECONDS and GETTIMEMS to calculate the number of milliseconds
+// since 1970/01/01 00:00:00 UTC.
+double currentTime()
+{
+    // diffSeconds is the number of seconds from 1970/01/01 to 1980/01/06
+    const unsigned diffSeconds = 315964800;
+    return static_cast<double>(diffSeconds + GETUTCSECONDS() + ((GETTIMEMS() % 1000) / msPerSecond));
+}
+
 #else // Other Posix systems rely on the gettimeofday().
 
 double currentTime()
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h
index 31f1ec8753..033448fa6c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h
@@ -32,16 +32,36 @@
 #ifndef CurrentTime_h
 #define CurrentTime_h
 
+#include <time.h>
+
 namespace WTF {
 
-    // Returns the current system (UTC) time in seconds, starting January 1, 1970.
-    // Precision varies depending on a platform but usually is as good or better 
+    // Returns the current UTC time in seconds, counted from January 1, 1970.
+    // Precision varies depending on platform but is usually as good or better 
     // than a millisecond.
     double currentTime();
 
+    // Same thing, in milliseconds.
+    inline double currentTimeMS()
+    {
+        return currentTime() * 1000.0; 
+    }
+
+    inline void getLocalTime(const time_t* localTime, struct tm* localTM)
+    {
+    #if COMPILER(MSVC7) || COMPILER(MINGW) || OS(WINCE)
+        *localTM = *localtime(localTime);
+    #elif COMPILER(MSVC)
+        localtime_s(localTM, localTime);
+    #else
+        localtime_r(localTime, localTM);
+    #endif
+    }
+
 } // namespace WTF
 
 using WTF::currentTime;
+using WTF::getLocalTime;
 
 #endif // CurrentTime_h
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
index 2110432c31..b9a0207a4c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
@@ -39,6 +39,33 @@
  * other provisions required by the MPL or the GPL, as the case may be.
  * If you do not delete the provisions above, a recipient may use your
  * version of this file under any of the LGPL, the MPL or the GPL.
+
+ * Copyright 2006-2008 the V8 project authors. All rights reserved.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -61,11 +88,7 @@
 #include <errno.h>
 #endif
 
-#if PLATFORM(DARWIN)
-#include <notify.h>
-#endif
-
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 extern "C" size_t strftime(char * const s, const size_t maxsize, const char * const format, const struct tm * const t);
 extern "C" struct tm * localtime(const time_t *timer);
 #endif
@@ -78,8 +101,14 @@ extern "C" struct tm * localtime(const time_t *timer);
 #include <sys/timeb.h>
 #endif
 
+#if USE(JSC)
+#include "CallFrame.h"
+#endif
+
 #define NaN std::numeric_limits<double>::quiet_NaN()
 
+using namespace WTF;
+
 namespace WTF {
 
 /* Constants */
@@ -91,6 +120,10 @@ static const double secondsPerYear = 24.0 * 60.0 * 60.0 * 365.0;
 static const double usecPerSec = 1000000.0;
 
 static const double maxUnixTime = 2145859200.0; // 12/31/2037
+// ECMAScript asks not to support for a date of which total
+// millisecond value is larger than the following value.
+// See 15.9.1.14 of ECMA-262 5th edition.
+static const double maxECMAScriptTime = 8.64E15;
 
 // Day of year for the first day of each month, where index 0 is January, and day 0 is January 1.
 // First for non-leap years, then for leap years.
@@ -139,7 +172,7 @@ static inline double msToDays(double ms)
     return floor(ms / msPerDay);
 }
 
-static inline int msToYear(double ms)
+int msToYear(double ms)
 {
     int approxYear = static_cast<int>(floor(ms / (msPerDay * 365.2425)) + 1970);
     double msFromApproxYearTo1970 = msPerDay * daysFrom1970ToYear(approxYear);
@@ -150,7 +183,7 @@ static inline int msToYear(double ms)
     return approxYear;
 }
 
-static inline int dayInYear(double ms, int year)
+int dayInYear(double ms, int year)
 {
     return static_cast<int>(msToDays(ms) - daysFrom1970ToYear(year));
 }
@@ -196,7 +229,7 @@ static inline int msToHours(double ms)
     return static_cast<int>(result);
 }
 
-static inline int monthFromDayInYear(int dayInYear, bool leapYear)
+int monthFromDayInYear(int dayInYear, bool leapYear)
 {
     const int d = dayInYear;
     int step;
@@ -234,7 +267,7 @@ static inline bool checkMonth(int dayInYear, int& startDayOfThisMonth, int& star
     return (dayInYear <= startDayOfNextMonth);
 }
 
-static inline int dayInMonthFromDayInYear(int dayInYear, bool leapYear)
+int dayInMonthFromDayInYear(int dayInYear, bool leapYear)
 {
     const int d = dayInYear;
     int step;
@@ -277,7 +310,7 @@ static inline double timeToMS(double hour, double min, double sec, double ms)
     return (((hour * minutesPerHour + min) * secondsPerMinute + sec) * msPerSecond + ms);
 }
 
-static int dateToDayInYear(int year, int month, int day)
+double dateToDaysFrom1970(int year, int month, int day)
 {
     year += month / 12;
 
@@ -287,34 +320,13 @@ static int dateToDayInYear(int year, int month, int day)
         --year;
     }
 
-    int yearday = static_cast<int>(floor(daysFrom1970ToYear(year)));
+    double yearday = floor(daysFrom1970ToYear(year));
+    ASSERT((year >= 1970 && yearday >= 0) || (year < 1970 && yearday < 0));
     int monthday = monthToDayInYear(month, isLeapYear(year));
 
     return yearday + monthday + day - 1;
 }
 
-double getCurrentUTCTime()
-{
-    return floor(getCurrentUTCTimeWithMicroseconds());
-}
-
-// Returns current time in milliseconds since 1 Jan 1970.
-double getCurrentUTCTimeWithMicroseconds()
-{
-    return currentTime() * 1000.0; 
-}
-
-void getLocalTime(const time_t* localTime, struct tm* localTM)
-{
-#if COMPILER(MSVC7) || COMPILER(MINGW) || PLATFORM(WINCE)
-    *localTM = *localtime(localTime);
-#elif COMPILER(MSVC)
-    localtime_s(localTM, localTime);
-#else
-    localtime_r(localTime, localTM);
-#endif
-}
-
 // There is a hard limit at 2038 that we currently do not have a workaround
 // for (rdar://problem/5052975).
 static inline int maximumYearForDST()
@@ -328,7 +340,7 @@ static inline int minimumYearForDST()
     // greater than the max year minus 27 (2010), we want to use the max year
     // minus 27 instead, to ensure there is a range of 28 years that all years
     // can map to.
-    return std::min(msToYear(getCurrentUTCTime()), maximumYearForDST() - 27) ;
+    return std::min(msToYear(jsCurrentTime()), maximumYearForDST() - 27) ;
 }
 
 /*
@@ -367,7 +379,11 @@ int equivalentYearForDST(int year)
 
 static int32_t calculateUTCOffset()
 {
+#if PLATFORM(BREWMP)
+    time_t localTime = static_cast<time_t>(currentTime());
+#else
     time_t localTime = time(0);
+#endif
     tm localt;
     getLocalTime(&localTime, &localt);
 
@@ -399,44 +415,10 @@ static int32_t calculateUTCOffset()
     return static_cast<int32_t>(utcOffset * 1000);
 }
 
-#if PLATFORM(DARWIN)
-static int32_t s_cachedUTCOffset; // In milliseconds. An assumption here is that access to an int32_t variable is atomic on platforms that take this code path.
-static bool s_haveCachedUTCOffset;
-static int s_notificationToken;
-#endif
-
-/*
- * Get the difference in milliseconds between this time zone and UTC (GMT)
- * NOT including DST.
- */
-double getUTCOffset()
-{
-#if PLATFORM(DARWIN)
-    if (s_haveCachedUTCOffset) {
-        int notified;
-        uint32_t status = notify_check(s_notificationToken, &notified);
-        if (status == NOTIFY_STATUS_OK && !notified)
-            return s_cachedUTCOffset;
-    }
-#endif
-
-    int32_t utcOffset = calculateUTCOffset();
-
-#if PLATFORM(DARWIN)
-    // Theoretically, it is possible that several threads will be executing this code at once, in which case we will have a race condition,
-    // and a newer value may be overwritten. In practice, time zones don't change that often.
-    s_cachedUTCOffset = utcOffset;
-#endif
-
-    return utcOffset;
-}
-
 /*
- * Get the DST offset for the time passed in.  Takes
- * seconds (not milliseconds) and cannot handle dates before 1970
- * on some OS'
+ * Get the DST offset for the time passed in.
  */
-static double getDSTOffsetSimple(double localTimeSeconds, double utcOffset)
+static double calculateDSTOffsetSimple(double localTimeSeconds, double utcOffset)
 {
     if (localTimeSeconds > maxUnixTime)
         localTimeSeconds = maxUnixTime;
@@ -465,9 +447,9 @@ static double getDSTOffsetSimple(double localTimeSeconds, double utcOffset)
 }
 
 // Get the DST offset, given a time in UTC
-static double getDSTOffset(double ms, double utcOffset)
+static double calculateDSTOffset(double ms, double utcOffset)
 {
-    // On Mac OS X, the call to localtime (see getDSTOffsetSimple) will return historically accurate
+    // On Mac OS X, the call to localtime (see calculateDSTOffsetSimple) will return historically accurate
     // DST information (e.g. New Zealand did not have DST from 1946 to 1974) however the JavaScript
     // standard explicitly dictates that historical information should not be considered when
     // determining DST. For this reason we shift away from years that localtime can handle but would
@@ -479,69 +461,22 @@ static double getDSTOffset(double ms, double utcOffset)
         int dayInYearLocal = dayInYear(ms, year);
         int dayInMonth = dayInMonthFromDayInYear(dayInYearLocal, leapYear);
         int month = monthFromDayInYear(dayInYearLocal, leapYear);
-        int day = dateToDayInYear(equivalentYear, month, dayInMonth);
+        double day = dateToDaysFrom1970(equivalentYear, month, dayInMonth);
         ms = (day * msPerDay) + msToMilliseconds(ms);
     }
 
-    return getDSTOffsetSimple(ms / msPerSecond, utcOffset);
-}
-
-double gregorianDateTimeToMS(const GregorianDateTime& t, double milliSeconds, bool inputIsUTC)
-{
-    int day = dateToDayInYear(t.year + 1900, t.month, t.monthDay);
-    double ms = timeToMS(t.hour, t.minute, t.second, milliSeconds);
-    double result = (day * msPerDay) + ms;
-
-    if (!inputIsUTC) { // convert to UTC
-        double utcOffset = getUTCOffset();
-        result -= utcOffset;
-        result -= getDSTOffset(result, utcOffset);
-    }
-
-    return result;
-}
-
-// input is UTC
-void msToGregorianDateTime(double ms, bool outputIsUTC, GregorianDateTime& tm)
-{
-    double dstOff = 0.0;
-    double utcOff = 0.0;
-    if (!outputIsUTC) {
-        utcOff = getUTCOffset();
-        dstOff = getDSTOffset(ms, utcOff);
-        ms += dstOff + utcOff;
-    }
-
-    const int year = msToYear(ms);
-    tm.second   =  msToSeconds(ms);
-    tm.minute   =  msToMinutes(ms);
-    tm.hour     =  msToHours(ms);
-    tm.weekDay  =  msToWeekDay(ms);
-    tm.yearDay  =  dayInYear(ms, year);
-    tm.monthDay =  dayInMonthFromDayInYear(tm.yearDay, isLeapYear(year));
-    tm.month    =  monthFromDayInYear(tm.yearDay, isLeapYear(year));
-    tm.year     =  year - 1900;
-    tm.isDST    =  dstOff != 0.0;
-    tm.utcOffset = static_cast<long>((dstOff + utcOff) / msPerSecond);
-    tm.timeZone = NULL;
+    return calculateDSTOffsetSimple(ms / msPerSecond, utcOffset);
 }
 
 void initializeDates()
 {
 #ifndef NDEBUG
     static bool alreadyInitialized;
-    ASSERT(!alreadyInitialized++);
+    ASSERT(!alreadyInitialized);
+    alreadyInitialized = true;
 #endif
 
     equivalentYearForDST(2000); // Need to call once to initialize a static used in this function.
-#if PLATFORM(DARWIN)
-    // Register for a notification whenever the time zone changes.
-    uint32_t status = notify_register_check("com.apple.system.timezone", &s_notificationToken);
-    if (status == NOTIFY_STATUS_OK) {
-        s_cachedUTCOffset = calculateUTCOffset();
-        s_haveCachedUTCOffset = true;
-    }
-#endif
 }
 
 static inline double ymdhmsToSeconds(long year, int mon, int day, int hour, int minute, int second)
@@ -557,7 +492,7 @@ static inline double ymdhmsToSeconds(long year, int mon, int day, int hour, int
 // We follow the recommendation of RFC 2822 to consider all
 // obsolete time zones not listed here equivalent to "-0000".
 static const struct KnownZone {
-#if !PLATFORM(WIN_OS)
+#if !OS(WINDOWS)
     const
 #endif
         char tzName[4];
@@ -622,8 +557,12 @@ static bool parseLong(const char* string, char** stopPosition, int base, long* r
     return true;
 }
 
-double parseDateFromNullTerminatedCharacters(const char* dateString)
+// Odd case where 'exec' is allowed to be 0, to accomodate a caller in WebCore.
+static double parseDateFromNullTerminatedCharacters(const char* dateString, bool& haveTZ, int& offset)
 {
+    haveTZ = false;
+    offset = 0;
+
     // This parses a date in the form:
     //     Tuesday, 09-Nov-99 23:12:40 GMT
     // or
@@ -824,9 +763,6 @@ double parseDateFromNullTerminatedCharacters(const char* dateString)
         }
     }
 
-    bool haveTZ = false;
-    int offset = 0;
-
     // Don't fail if the time zone is missing. 
     // Some websites omit the time zone (4275206).
     if (*dateString) {
@@ -889,33 +825,172 @@ double parseDateFromNullTerminatedCharacters(const char* dateString)
         else
             year += 1900;
     }
+    
+    return ymdhmsToSeconds(year, month + 1, day, hour, minute, second) * msPerSecond;
+}
+
+double parseDateFromNullTerminatedCharacters(const char* dateString)
+{
+    bool haveTZ;
+    int offset;
+    double ms = parseDateFromNullTerminatedCharacters(dateString, haveTZ, offset);
+    if (isnan(ms))
+        return NaN;
 
     // fall back to local timezone
     if (!haveTZ) {
-        GregorianDateTime t;
-        t.monthDay = day;
-        t.month = month;
-        t.year = year - 1900;
-        t.isDST = -1;
-        t.second = second;
-        t.minute = minute;
-        t.hour = hour;
-
-        // Use our gregorianDateTimeToMS() rather than mktime() as the latter can't handle the full year range.
-        return gregorianDateTimeToMS(t, 0, false);
+        double utcOffset = calculateUTCOffset();
+        double dstOffset = calculateDSTOffset(ms, utcOffset);
+        offset = static_cast<int>((utcOffset + dstOffset) / msPerMinute);
     }
-
-    return (ymdhmsToSeconds(year, month + 1, day, hour, minute, second) - (offset * 60.0)) * msPerSecond;
+    return ms - (offset * msPerMinute);
 }
 
 double timeClip(double t)
 {
     if (!isfinite(t))
         return NaN;
-    if (fabs(t) > 8.64E15)
+    if (fabs(t) > maxECMAScriptTime)
         return NaN;
     return trunc(t);
 }
+} // namespace WTF
 
+#if USE(JSC)
+namespace JSC {
+
+// Get the DST offset for the time passed in.
+//
+// NOTE: The implementation relies on the fact that no time zones have
+// more than one daylight savings offset change per month.
+// If this function is called with NaN it returns NaN.
+static double getDSTOffset(ExecState* exec, double ms, double utcOffset)
+{
+    DSTOffsetCache& cache = exec->globalData().dstOffsetCache;
+    double start = cache.start;
+    double end = cache.end;
+
+    if (start <= ms) {
+        // If the time fits in the cached interval, return the cached offset.
+        if (ms <= end) return cache.offset;
+
+        // Compute a possible new interval end.
+        double newEnd = end + cache.increment;
+
+        if (ms <= newEnd) {
+            double endOffset = calculateDSTOffset(newEnd, utcOffset);
+            if (cache.offset == endOffset) {
+                // If the offset at the end of the new interval still matches
+                // the offset in the cache, we grow the cached time interval
+                // and return the offset.
+                cache.end = newEnd;
+                cache.increment = msPerMonth;
+                return endOffset;
+            } else {
+                double offset = calculateDSTOffset(ms, utcOffset);
+                if (offset == endOffset) {
+                    // The offset at the given time is equal to the offset at the
+                    // new end of the interval, so that means that we've just skipped
+                    // the point in time where the DST offset change occurred. Updated
+                    // the interval to reflect this and reset the increment.
+                    cache.start = ms;
+                    cache.end = newEnd;
+                    cache.increment = msPerMonth;
+                } else {
+                    // The interval contains a DST offset change and the given time is
+                    // before it. Adjust the increment to avoid a linear search for
+                    // the offset change point and change the end of the interval.
+                    cache.increment /= 3;
+                    cache.end = ms;
+                }
+                // Update the offset in the cache and return it.
+                cache.offset = offset;
+                return offset;
+            }
+        }
+    }
 
-} // namespace WTF
+    // Compute the DST offset for the time and shrink the cache interval
+    // to only contain the time. This allows fast repeated DST offset
+    // computations for the same time.
+    double offset = calculateDSTOffset(ms, utcOffset);
+    cache.offset = offset;
+    cache.start = ms;
+    cache.end = ms;
+    cache.increment = msPerMonth;
+    return offset;
+}
+
+/*
+ * Get the difference in milliseconds between this time zone and UTC (GMT)
+ * NOT including DST.
+ */
+double getUTCOffset(ExecState* exec)
+{
+    double utcOffset = exec->globalData().cachedUTCOffset;
+    if (!isnan(utcOffset))
+        return utcOffset;
+    exec->globalData().cachedUTCOffset = calculateUTCOffset();
+    return exec->globalData().cachedUTCOffset;
+}
+
+double gregorianDateTimeToMS(ExecState* exec, const GregorianDateTime& t, double milliSeconds, bool inputIsUTC)
+{
+    double day = dateToDaysFrom1970(t.year + 1900, t.month, t.monthDay);
+    double ms = timeToMS(t.hour, t.minute, t.second, milliSeconds);
+    double result = (day * WTF::msPerDay) + ms;
+
+    if (!inputIsUTC) { // convert to UTC
+        double utcOffset = getUTCOffset(exec);
+        result -= utcOffset;
+        result -= getDSTOffset(exec, result, utcOffset);
+    }
+
+    return result;
+}
+
+// input is UTC
+void msToGregorianDateTime(ExecState* exec, double ms, bool outputIsUTC, GregorianDateTime& tm)
+{
+    double dstOff = 0.0;
+    double utcOff = 0.0;
+    if (!outputIsUTC) {
+        utcOff = getUTCOffset(exec);
+        dstOff = getDSTOffset(exec, ms, utcOff);
+        ms += dstOff + utcOff;
+    }
+
+    const int year = msToYear(ms);
+    tm.second   =  msToSeconds(ms);
+    tm.minute   =  msToMinutes(ms);
+    tm.hour     =  msToHours(ms);
+    tm.weekDay  =  msToWeekDay(ms);
+    tm.yearDay  =  dayInYear(ms, year);
+    tm.monthDay =  dayInMonthFromDayInYear(tm.yearDay, isLeapYear(year));
+    tm.month    =  monthFromDayInYear(tm.yearDay, isLeapYear(year));
+    tm.year     =  year - 1900;
+    tm.isDST    =  dstOff != 0.0;
+    tm.utcOffset = static_cast<long>((dstOff + utcOff) / WTF::msPerSecond);
+    tm.timeZone = NULL;
+}
+
+double parseDateFromNullTerminatedCharacters(ExecState* exec, const char* dateString)
+{
+    ASSERT(exec);
+    bool haveTZ;
+    int offset;
+    double ms = WTF::parseDateFromNullTerminatedCharacters(dateString, haveTZ, offset);
+    if (isnan(ms))
+        return NaN;
+
+    // fall back to local timezone
+    if (!haveTZ) {
+        double utcOffset = getUTCOffset(exec);
+        double dstOffset = getDSTOffset(exec, ms, utcOffset);
+        offset = static_cast<int>((utcOffset + dstOffset) / WTF::msPerMinute);
+    }
+    return ms - (offset * WTF::msPerMinute);
+}
+
+} // namespace JSC
+#endif // USE(JSC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.h b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.h
index 6110f766ab..033d25e220 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.h
@@ -42,27 +42,27 @@
 #ifndef DateMath_h
 #define DateMath_h
 
-#include <time.h>
+#include <math.h>
 #include <string.h>
+#include <time.h>
+#include <wtf/CurrentTime.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/UnusedParam.h>
 
 namespace WTF {
-
-struct GregorianDateTime;
-
 void initializeDates();
-void msToGregorianDateTime(double, bool outputIsUTC, GregorianDateTime&);
-double gregorianDateTimeToMS(const GregorianDateTime&, double, bool inputIsUTC);
-double getUTCOffset();
 int equivalentYearForDST(int year);
-double getCurrentUTCTime();
-double getCurrentUTCTimeWithMicroseconds();
-void getLocalTime(const time_t*, tm*);
 
 // Not really math related, but this is currently the only shared place to put these.  
-double parseDateFromNullTerminatedCharacters(const char*);
+double parseDateFromNullTerminatedCharacters(const char* dateString);
 double timeClip(double);
 
+inline double jsCurrentTime()
+{
+    // JavaScript doesn't recognize fractions of a millisecond.
+    return floor(WTF::currentTimeMS());
+}
+
 const char * const weekdayName[7] = { "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun" };
 const char * const monthName[12] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };
 
@@ -74,9 +74,39 @@ const double msPerSecond = 1000.0;
 const double msPerMinute = 60.0 * 1000.0;
 const double msPerHour = 60.0 * 60.0 * 1000.0;
 const double msPerDay = 24.0 * 60.0 * 60.0 * 1000.0;
+const double msPerMonth = 2592000000.0;
 
-// Intentionally overridding the default tm of the system
-// Tee members of tm differ on various operating systems.
+// Returns the number of days from 1970-01-01 to the specified date.
+double dateToDaysFrom1970(int year, int month, int day);
+int msToYear(double ms);
+int dayInYear(double ms, int year);
+int monthFromDayInYear(int dayInYear, bool leapYear);
+int dayInMonthFromDayInYear(int dayInYear, bool leapYear);
+
+} // namespace WTF
+
+using WTF::dateToDaysFrom1970;
+using WTF::dayInMonthFromDayInYear;
+using WTF::dayInYear;
+using WTF::minutesPerHour;
+using WTF::monthFromDayInYear;
+using WTF::msPerDay;
+using WTF::msPerSecond;
+using WTF::msToYear;
+using WTF::secondsPerMinute;
+
+#if USE(JSC)
+namespace JSC {
+class ExecState;
+struct GregorianDateTime;
+
+void msToGregorianDateTime(ExecState*, double, bool outputIsUTC, GregorianDateTime&);
+double gregorianDateTimeToMS(ExecState*, const GregorianDateTime&, double, bool inputIsUTC);
+double getUTCOffset(ExecState*);
+double parseDateFromNullTerminatedCharacters(ExecState*, const char* dateString);
+
+// Intentionally overridding the default tm of the system.
+// The members of tm differ on various operating systems.
 struct GregorianDateTime : Noncopyable {
     GregorianDateTime()
         : second(0)
@@ -98,7 +128,7 @@ struct GregorianDateTime : Noncopyable {
         delete [] timeZone;
     }
 
-    GregorianDateTime(const tm& inTm)
+    GregorianDateTime(ExecState* exec, const tm& inTm)
         : second(inTm.tm_sec)
         , minute(inTm.tm_min)
         , hour(inTm.tm_hour)
@@ -109,10 +139,11 @@ struct GregorianDateTime : Noncopyable {
         , year(inTm.tm_year)
         , isDST(inTm.tm_isdst)
     {
+        UNUSED_PARAM(exec);
 #if HAVE(TM_GMTOFF)
         utcOffset = static_cast<int>(inTm.tm_gmtoff);
 #else
-        utcOffset = static_cast<int>(getUTCOffset() / msPerSecond + (isDST ? secondsPerHour : 0));
+        utcOffset = static_cast<int>(getUTCOffset(exec) / WTF::msPerSecond + (isDST ? WTF::secondsPerHour : 0));
 #endif
 
 #if HAVE(TM_ZONE)
@@ -186,7 +217,7 @@ static inline int gmtoffset(const GregorianDateTime& t)
 {
     return t.utcOffset;
 }
-
-} // namespace WTF
+} // namespace JSC
+#endif // USE(JSC)
 
 #endif // DateMath_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
index 6cd8ef055e..e7d9efa471 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
@@ -114,11 +114,13 @@ static void initializeIsForbiddenKey()
   pthread_key_create(&isForbiddenKey, 0);
 }
 
+#if !ASSERT_DISABLED
 static bool isForbidden()
 {
     pthread_once(&isForbiddenKeyOnce, initializeIsForbiddenKey);
     return !!pthread_getspecific(isForbiddenKey);
 }
+#endif
 
 void fastMallocForbid()
 {
@@ -177,6 +179,17 @@ void* fastZeroedMalloc(size_t n)
     memset(result, 0, n);
     return result;
 }
+
+char* fastStrDup(const char* src)
+{
+    int len = strlen(src) + 1;
+    char* dup = static_cast<char*>(fastMalloc(len));
+
+    if (dup)
+        memcpy(dup, src, len);
+
+    return dup;
+}
     
 TryMallocReturnValue tryFastZeroedMalloc(size_t n) 
 {
@@ -191,11 +204,14 @@ TryMallocReturnValue tryFastZeroedMalloc(size_t n)
 
 #if FORCE_SYSTEM_MALLOC
 
-#include <stdlib.h>
-#if !PLATFORM(WIN_OS)
-    #include <pthread.h>
-#else
-    #include "windows.h"
+#if PLATFORM(BREWMP)
+#include "brew/SystemMallocBrew.h"
+#endif
+
+#if OS(DARWIN)
+#include <malloc/malloc.h>
+#elif COMPILER(MSVC)
+#include <malloc.h>
 #endif
 
 namespace WTF {
@@ -233,8 +249,16 @@ void* fastMalloc(size_t n)
     void* result = malloc(n);
 #endif
 
-    if (!result)
+    if (!result) {
+#if PLATFORM(BREWMP)
+        // The behavior of malloc(0) is implementation defined.
+        // To make sure that fastMalloc never returns 0, retry with fastMalloc(1).
+        if (!n)
+            return fastMalloc(1);
+#endif
         CRASH();
+    }
+
     return result;
 }
 
@@ -273,8 +297,16 @@ void* fastCalloc(size_t n_elements, size_t element_size)
     void* result = calloc(n_elements, element_size);
 #endif
 
-    if (!result)
+    if (!result) {
+#if PLATFORM(BREWMP)
+        // If either n_elements or element_size is 0, the behavior of calloc is implementation defined.
+        // To make sure that fastCalloc never returns 0, retry with fastCalloc(1, 1).
+        if (!n_elements || !element_size)
+            return fastCalloc(1, 1);
+#endif
         CRASH();
+    }
+
     return result;
 }
 
@@ -343,13 +375,24 @@ void releaseFastMallocFreeMemory() { }
     
 FastMallocStatistics fastMallocStatistics()
 {
-    FastMallocStatistics statistics = { 0, 0, 0, 0 };
+    FastMallocStatistics statistics = { 0, 0, 0 };
     return statistics;
 }
 
+size_t fastMallocSize(const void* p)
+{
+#if OS(DARWIN)
+    return malloc_size(p);
+#elif COMPILER(MSVC)
+    return _msize(const_cast<void*>(p));
+#else
+    return 1;
+#endif
+}
+
 } // namespace WTF
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 // This symbol is present in the JavaScriptCore exports file even when FastMalloc is disabled.
 // It will never be used in this case, so it's type and value are less interesting than its presence.
 extern "C" const int jscore_fastmalloc_introspection = 0;
@@ -374,12 +417,11 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 #include <algorithm>
 #include <errno.h>
 #include <limits>
-#include <new>
 #include <pthread.h>
 #include <stdarg.h>
 #include <stddef.h>
 #include <stdio.h>
-#if PLATFORM(UNIX)
+#if OS(UNIX)
 #include <unistd.h>
 #endif
 #if COMPILER(MSVC)
@@ -389,13 +431,17 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 #include <windows.h>
 #endif
 
-#if WTF_CHANGES
+#ifdef WTF_CHANGES
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 #include "MallocZoneSupport.h"
 #include <wtf/HashSet.h>
 #include <wtf/Vector.h>
 #endif
+#if HAVE(DISPATCH_H)
+#include <dispatch/dispatch.h>
+#endif
+
 
 #ifndef PRIuS
 #define PRIuS "zu"
@@ -405,7 +451,7 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 // call to the function on Mac OS X, and it's used in performance-critical code. So we
 // use a function pointer. But that's not necessarily faster on other platforms, and we had
 // problems with this technique on Windows, so we'll do this only on Mac OS X.
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 static void* (*pthread_getspecific_function_pointer)(pthread_key_t) = pthread_getspecific;
 #define pthread_getspecific(key) pthread_getspecific_function_pointer(key)
 #endif
@@ -433,8 +479,8 @@ namespace WTF {
 #define MESSAGE LOG_ERROR
 #define CHECK_CONDITION ASSERT
 
-#if PLATFORM(DARWIN)
-class Span;
+#if OS(DARWIN)
+struct Span;
 class TCMalloc_Central_FreeListPadded;
 class TCMalloc_PageHeap;
 class TCMalloc_ThreadCache;
@@ -990,7 +1036,7 @@ class PageHeapAllocator {
 
   int inuse() const { return inuse_; }
 
-#if defined(WTF_CHANGES) && PLATFORM(DARWIN)
+#if defined(WTF_CHANGES) && OS(DARWIN)
   template <class Recorder>
   void recordAdministrativeRegions(Recorder& recorder, const RemoteMemoryReader& reader)
   {
@@ -1172,7 +1218,7 @@ template <int BITS> class MapSelector {
 };
 
 #if defined(WTF_CHANGES)
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
 // On all known X86-64 platforms, the upper 16 bits are always unused and therefore 
 // can be excluded from the PageMap key.
 // See http://en.wikipedia.org/wiki/X86-64#Virtual_address_space_details
@@ -1206,29 +1252,30 @@ template <> class MapSelector<32> {
 // -------------------------------------------------------------------------
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-// The central page heap collects spans of memory that have been deleted but are still committed until they are released
-// back to the system.  We use a background thread to periodically scan the list of free spans and release some back to the
-// system.  Every 5 seconds, the background thread wakes up and does the following:
-// - Check if we needed to commit memory in the last 5 seconds.  If so, skip this scavenge because it's a sign that we are short
-// of free committed pages and so we should not release them back to the system yet.
-// - Otherwise, go through the list of free spans (from largest to smallest) and release up to a fraction of the free committed pages
-// back to the system.
-// - If the number of free committed pages reaches kMinimumFreeCommittedPageCount, we can stop the scavenging and block the
-// scavenging thread until the number of free committed pages goes above kMinimumFreeCommittedPageCount.
-
-// Background thread wakes up every 5 seconds to scavenge as long as there is memory available to return to the system.
-static const int kScavengeTimerDelayInSeconds = 5;
+// The page heap maintains a free list for spans that are no longer in use by
+// the central cache or any thread caches. We use a background thread to
+// periodically scan the free list and release a percentage of it back to the OS.
+
+// If free_committed_pages_ exceeds kMinimumFreeCommittedPageCount, the
+// background thread:
+//     - wakes up
+//     - pauses for kScavengeDelayInSeconds
+//     - returns to the OS a percentage of the memory that remained unused during
+//       that pause (kScavengePercentage * min_free_committed_pages_since_last_scavenge_)
+// The goal of this strategy is to reduce memory pressure in a timely fashion
+// while avoiding thrashing the OS allocator.
+
+// Time delay before the page heap scavenger will consider returning pages to
+// the OS.
+static const int kScavengeDelayInSeconds = 2;
+
+// Approximate percentage of free committed pages to return to the OS in one
+// scavenge.
+static const float kScavengePercentage = .5f;
 
 // Number of free committed pages that we want to keep around.
 static const size_t kMinimumFreeCommittedPageCount = 512;
 
-// During a scavenge, we'll release up to a fraction of the free committed pages.
-#if PLATFORM(WIN)
-// We are slightly less aggressive in releasing memory on Windows due to performance reasons.
-static const int kMaxScavengeAmountFactor = 3;
-#else
-static const int kMaxScavengeAmountFactor = 2;
-#endif
 #endif
 
 class TCMalloc_PageHeap {
@@ -1334,8 +1381,9 @@ class TCMalloc_PageHeap {
   // Number of pages kept in free lists that are still committed.
   Length free_committed_pages_;
 
-  // Number of pages that we committed in the last scavenge wait interval.
-  Length pages_committed_since_last_scavenge_;
+  // Minimum number of free committed pages since last scavenge. (Can be 0 if
+  // we've committed new pages since the last scavenge.)
+  Length min_free_committed_pages_since_last_scavenge_;
 #endif
 
   bool GrowHeap(Length n);
@@ -1372,26 +1420,34 @@ class TCMalloc_PageHeap {
   // Index of last free list we scavenged
   size_t scavenge_index_;
   
-#if defined(WTF_CHANGES) && PLATFORM(DARWIN)
+#if defined(WTF_CHANGES) && OS(DARWIN)
   friend class FastMallocZone;
 #endif
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-  static NO_RETURN void* runScavengerThread(void*);
+  void initializeScavenger();
+  ALWAYS_INLINE void signalScavenger();
+  void scavenge();
+  ALWAYS_INLINE bool shouldScavenge() const;
 
+#if !HAVE(DISPATCH_H)
+  static NO_RETURN void* runScavengerThread(void*);
   NO_RETURN void scavengerThread();
 
-  void scavenge();
-
-  inline bool shouldContinueScavenging() const;
+  // Keeps track of whether the background thread is actively scavenging memory every kScavengeDelayInSeconds, or
+  // it's blocked waiting for more pages to be deleted.
+  bool m_scavengeThreadActive;
 
   pthread_mutex_t m_scavengeMutex;
-
   pthread_cond_t m_scavengeCondition;
+#else // !HAVE(DISPATCH_H)
+  void periodicScavenge();
+
+  dispatch_queue_t m_scavengeQueue;
+  dispatch_source_t m_scavengeTimer;
+  bool m_scavengingScheduled;
+#endif
 
-  // Keeps track of whether the background thread is actively scavenging memory every kScavengeTimerDelayInSeconds, or
-  // it's blocked waiting for more pages to be deleted.
-  bool m_scavengeThreadActive;
 #endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
 };
 
@@ -1404,7 +1460,7 @@ void TCMalloc_PageHeap::init()
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
   free_committed_pages_ = 0;
-  pages_committed_since_last_scavenge_ = 0;
+  min_free_committed_pages_since_last_scavenge_ = 0;
 #endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
 
   scavenge_counter_ = 0;
@@ -1419,15 +1475,23 @@ void TCMalloc_PageHeap::init()
   }
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+  initializeScavenger();
+#endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+}
+
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+
+#if !HAVE(DISPATCH_H)
+
+void TCMalloc_PageHeap::initializeScavenger()
+{
   pthread_mutex_init(&m_scavengeMutex, 0);
   pthread_cond_init(&m_scavengeCondition, 0);
   m_scavengeThreadActive = true;
   pthread_t thread;
   pthread_create(&thread, 0, runScavengerThread, this);
-#endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
 }
 
-#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
 void* TCMalloc_PageHeap::runScavengerThread(void* context)
 {
   static_cast<TCMalloc_PageHeap*>(context)->scavengerThread();
@@ -1437,42 +1501,60 @@ void* TCMalloc_PageHeap::runScavengerThread(void* context)
 #endif
 }
 
-void TCMalloc_PageHeap::scavenge() 
+ALWAYS_INLINE void TCMalloc_PageHeap::signalScavenger()
 {
-    // If we have to commit memory in the last 5 seconds, it means we don't have enough free committed pages
-    // for the amount of allocations that we do.  So hold off on releasing memory back to the system.
-    if (pages_committed_since_last_scavenge_ > 0) {
-        pages_committed_since_last_scavenge_ = 0;
-        return;
-    }
-    Length pagesDecommitted = 0;
-    for (int i = kMaxPages; i >= 0; i--) {
+  if (!m_scavengeThreadActive && shouldScavenge())
+    pthread_cond_signal(&m_scavengeCondition);
+}
+
+#else // !HAVE(DISPATCH_H)
+
+void TCMalloc_PageHeap::initializeScavenger()
+{
+  m_scavengeQueue = dispatch_queue_create("com.apple.JavaScriptCore.FastMallocSavenger", NULL);
+  m_scavengeTimer = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, m_scavengeQueue);
+  dispatch_time_t startTime = dispatch_time(DISPATCH_TIME_NOW, kScavengeDelayInSeconds * NSEC_PER_SEC);
+  dispatch_source_set_timer(m_scavengeTimer, startTime, kScavengeDelayInSeconds * NSEC_PER_SEC, 1000 * NSEC_PER_USEC);
+  dispatch_source_set_event_handler(m_scavengeTimer, ^{ periodicScavenge(); });
+  m_scavengingScheduled = false;
+}
+
+ALWAYS_INLINE void TCMalloc_PageHeap::signalScavenger()
+{
+  if (!m_scavengingScheduled && shouldScavenge()) {
+    m_scavengingScheduled = true;
+    dispatch_resume(m_scavengeTimer);
+  }
+}
+
+#endif
+
+void TCMalloc_PageHeap::scavenge()
+{
+    size_t pagesToRelease = min_free_committed_pages_since_last_scavenge_ * kScavengePercentage;
+    size_t targetPageCount = std::max<size_t>(kMinimumFreeCommittedPageCount, free_committed_pages_ - pagesToRelease);
+
+    for (int i = kMaxPages; i >= 0 && free_committed_pages_ > targetPageCount; i--) {
         SpanList* slist = (static_cast<size_t>(i) == kMaxPages) ? &large_ : &free_[i];
-        if (!DLL_IsEmpty(&slist->normal)) {
-            // Release the last span on the normal portion of this list
+        while (!DLL_IsEmpty(&slist->normal) && free_committed_pages_ > targetPageCount) {
             Span* s = slist->normal.prev; 
-            // Only decommit up to a fraction of the free committed pages if pages_allocated_since_last_scavenge_ > 0.
-            if ((pagesDecommitted + s->length) * kMaxScavengeAmountFactor > free_committed_pages_)
-                continue;
             DLL_Remove(s);
-            TCMalloc_SystemRelease(reinterpret_cast<void*>(s->start << kPageShift),
-                                   static_cast<size_t>(s->length << kPageShift));
+            ASSERT(!s->decommitted);
             if (!s->decommitted) {
-                pagesDecommitted += s->length;
+                TCMalloc_SystemRelease(reinterpret_cast<void*>(s->start << kPageShift),
+                                       static_cast<size_t>(s->length << kPageShift));
+                ASSERT(free_committed_pages_ >= s->length);
+                free_committed_pages_ -= s->length;
                 s->decommitted = true;
             }
             DLL_Prepend(&slist->returned, s);
-            // We can stop scavenging if the number of free committed pages left is less than or equal to the minimum number we want to keep around.
-            if (free_committed_pages_ <= kMinimumFreeCommittedPageCount + pagesDecommitted)
-                break;
         }
     }
-    pages_committed_since_last_scavenge_ = 0;
-    ASSERT(free_committed_pages_ >= pagesDecommitted);
-    free_committed_pages_ -= pagesDecommitted;
+
+    min_free_committed_pages_since_last_scavenge_ = free_committed_pages_;
 }
 
-inline bool TCMalloc_PageHeap::shouldContinueScavenging() const 
+ALWAYS_INLINE bool TCMalloc_PageHeap::shouldScavenge() const 
 {
     return free_committed_pages_ > kMinimumFreeCommittedPageCount; 
 }
@@ -1504,9 +1586,6 @@ inline Span* TCMalloc_PageHeap::New(Length n) {
     if (result->decommitted) {
         TCMalloc_SystemCommit(reinterpret_cast<void*>(result->start << kPageShift), static_cast<size_t>(n << kPageShift));
         result->decommitted = false;
-#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-        pages_committed_since_last_scavenge_ += n;
-#endif
     }
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
     else {
@@ -1514,6 +1593,8 @@ inline Span* TCMalloc_PageHeap::New(Length n) {
         // free committed pages count.
         ASSERT(free_committed_pages_ >= n);
         free_committed_pages_ -= n;
+        if (free_committed_pages_ < min_free_committed_pages_since_last_scavenge_)
+            min_free_committed_pages_since_last_scavenge_ = free_committed_pages_;
     }
 #endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
     ASSERT(Check());
@@ -1575,9 +1656,6 @@ Span* TCMalloc_PageHeap::AllocLarge(Length n) {
     if (best->decommitted) {
         TCMalloc_SystemCommit(reinterpret_cast<void*>(best->start << kPageShift), static_cast<size_t>(n << kPageShift));
         best->decommitted = false;
-#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-        pages_committed_since_last_scavenge_ += n;
-#endif
     }
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
     else {
@@ -1585,6 +1663,8 @@ Span* TCMalloc_PageHeap::AllocLarge(Length n) {
         // free committed pages count.
         ASSERT(free_committed_pages_ >= n);
         free_committed_pages_ -= n;
+        if (free_committed_pages_ < min_free_committed_pages_since_last_scavenge_)
+            min_free_committed_pages_since_last_scavenge_ = free_committed_pages_;
     }
 #endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
     ASSERT(Check());
@@ -1728,14 +1808,15 @@ inline void TCMalloc_PageHeap::Delete(Span* span) {
       // If the merged span is decommitted, that means we decommitted any neighboring spans that were
       // committed.  Update the free committed pages count.
       free_committed_pages_ -= neighboringCommittedSpansLength;
+      if (free_committed_pages_ < min_free_committed_pages_since_last_scavenge_)
+            min_free_committed_pages_since_last_scavenge_ = free_committed_pages_;
   } else {
       // If the merged span remains committed, add the deleted span's size to the free committed pages count.
       free_committed_pages_ += n;
   }
 
   // Make sure the scavenge thread becomes active if we have enough freed pages to release some back to the system.
-  if (!m_scavengeThreadActive && shouldContinueScavenging())
-      pthread_cond_signal(&m_scavengeCondition);
+  signalScavenger();
 #else
   IncrementalScavenge(n);
 #endif
@@ -1893,10 +1974,6 @@ bool TCMalloc_PageHeap::GrowHeap(Length n) {
   }
   ask = actual_size >> kPageShift;
 
-#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-  pages_committed_since_last_scavenge_ += ask;
-#endif
-
   uint64_t old_system_bytes = system_bytes_;
   system_bytes_ += (ask << kPageShift);
   const PageID p = reinterpret_cast<uintptr_t>(ptr) >> kPageShift;
@@ -2278,7 +2355,9 @@ static inline TCMalloc_PageHeap* getPageHeap()
 #define pageheap getPageHeap()
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-#if PLATFORM(WIN_OS)
+
+#if !HAVE(DISPATCH_H)
+#if OS(WINDOWS)
 static void sleep(unsigned seconds)
 {
     ::Sleep(seconds * 1000);
@@ -2292,21 +2371,38 @@ void TCMalloc_PageHeap::scavengerThread()
 #endif
 
   while (1) {
-      if (!shouldContinueScavenging()) {
+      if (!shouldScavenge()) {
           pthread_mutex_lock(&m_scavengeMutex);
           m_scavengeThreadActive = false;
-          // Block until there are enough freed pages to release back to the system.
+          // Block until there are enough free committed pages to release back to the system.
           pthread_cond_wait(&m_scavengeCondition, &m_scavengeMutex);
           m_scavengeThreadActive = true;
           pthread_mutex_unlock(&m_scavengeMutex);
       }
-      sleep(kScavengeTimerDelayInSeconds);
+      sleep(kScavengeDelayInSeconds);
       {
           SpinLockHolder h(&pageheap_lock);
           pageheap->scavenge();
       }
   }
 }
+
+#else
+
+void TCMalloc_PageHeap::periodicScavenge()
+{
+  {
+    SpinLockHolder h(&pageheap_lock);
+    pageheap->scavenge();
+  }
+
+  if (!shouldScavenge()) {
+    m_scavengingScheduled = false;
+    dispatch_suspend(m_scavengeTimer);
+  }
+}
+#endif // HAVE(DISPATCH_H)
+
 #endif
 
 // If TLS is available, we also store a copy
@@ -2816,7 +2912,7 @@ void TCMalloc_ThreadCache::InitModule() {
     }
     pageheap->init();
     phinited = 1;
-#if defined(WTF_CHANGES) && PLATFORM(DARWIN)
+#if defined(WTF_CHANGES) && OS(DARWIN)
     FastMallocZone::init();
 #endif
   }
@@ -3795,7 +3891,7 @@ void* realloc(void* old_ptr, size_t new_size) {
     return new_ptr;
   } else {
 #if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
-    old_ptr = pByte + sizeof(AllocAlignmentInteger);  // Set old_ptr back to the user pointer.
+    old_ptr = static_cast<AllocAlignmentInteger*>(old_ptr) + 1; // Set old_ptr back to the user pointer.
 #endif
     return old_ptr;
   }
@@ -3845,6 +3941,8 @@ static inline void* cpp_alloc(size_t size, bool nothrow) {
   }
 }
 
+#if ENABLE(GLOBAL_FASTMALLOC_NEW)
+
 void* operator new(size_t size) {
   void* p = cpp_alloc(size, false);
   // We keep this next instruction out of cpp_alloc for a reason: when
@@ -3899,6 +3997,8 @@ void operator delete[](void* p, const std::nothrow_t&) __THROW {
   do_free(p);
 }
 
+#endif
+
 extern "C" void* memalign(size_t align, size_t size) __THROW {
   void* result = do_memalign(align, size);
   MallocHook::InvokeNewHook(result, size);
@@ -4014,7 +4114,62 @@ void *(*__memalign_hook)(size_t, size_t, const void *) = MemalignOverride;
 
 #endif
 
-#if defined(WTF_CHANGES) && PLATFORM(DARWIN)
+#ifdef WTF_CHANGES
+void releaseFastMallocFreeMemory()
+{
+    // Flush free pages in the current thread cache back to the page heap.
+    // Low watermark mechanism in Scavenge() prevents full return on the first pass.
+    // The second pass flushes everything.
+    if (TCMalloc_ThreadCache* threadCache = TCMalloc_ThreadCache::GetCacheIfPresent()) {
+        threadCache->Scavenge();
+        threadCache->Scavenge();
+    }
+
+    SpinLockHolder h(&pageheap_lock);
+    pageheap->ReleaseFreePages();
+}
+    
+FastMallocStatistics fastMallocStatistics()
+{
+    FastMallocStatistics statistics;
+
+    SpinLockHolder lockHolder(&pageheap_lock);
+    statistics.reservedVMBytes = static_cast<size_t>(pageheap->SystemBytes());
+    statistics.committedVMBytes = statistics.reservedVMBytes - pageheap->ReturnedBytes();
+
+    statistics.freeListBytes = 0;
+    for (unsigned cl = 0; cl < kNumClasses; ++cl) {
+        const int length = central_cache[cl].length();
+        const int tc_length = central_cache[cl].tc_length();
+
+        statistics.freeListBytes += ByteSizeForClass(cl) * (length + tc_length);
+    }
+    for (TCMalloc_ThreadCache* threadCache = thread_heaps; threadCache ; threadCache = threadCache->next_)
+        statistics.freeListBytes += threadCache->Size();
+
+    return statistics;
+}
+
+size_t fastMallocSize(const void* ptr)
+{
+    const PageID p = reinterpret_cast<uintptr_t>(ptr) >> kPageShift;
+    Span* span = pageheap->GetDescriptorEnsureSafe(p);
+
+    if (!span || span->free)
+        return 0;
+
+    for (void* free = span->objects; free != NULL; free = *((void**) free)) {
+        if (ptr == free)
+            return 0;
+    }
+
+    if (size_t cl = span->sizeclass)
+        return ByteSizeForClass(cl);
+
+    return span->length << kPageShift;
+}
+
+#if OS(DARWIN)
 
 class FreeObjectFinder {
     const RemoteMemoryReader& m_reader;
@@ -4297,7 +4452,7 @@ extern "C" {
 malloc_introspection_t jscore_fastmalloc_introspection = { &FastMallocZone::enumerate, &FastMallocZone::goodSize, &FastMallocZone::check, &FastMallocZone::print,
     &FastMallocZone::log, &FastMallocZone::forceLock, &FastMallocZone::forceUnlock, &FastMallocZone::statistics
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !OS(IPHONE_OS)
     , 0 // zone_locked will not be called on the zone unless it advertises itself as version five or higher.
 #endif
 
@@ -4331,44 +4486,9 @@ void FastMallocZone::init()
     static FastMallocZone zone(pageheap, &thread_heaps, static_cast<TCMalloc_Central_FreeListPadded*>(central_cache), &span_allocator, &threadheap_allocator);
 }
 
-#endif
-
-#if WTF_CHANGES
-void releaseFastMallocFreeMemory()
-{
-    // Flush free pages in the current thread cache back to the page heap.
-    // Low watermark mechanism in Scavenge() prevents full return on the first pass.
-    // The second pass flushes everything.
-    if (TCMalloc_ThreadCache* threadCache = TCMalloc_ThreadCache::GetCacheIfPresent()) {
-        threadCache->Scavenge();
-        threadCache->Scavenge();
-    }
-
-    SpinLockHolder h(&pageheap_lock);
-    pageheap->ReleaseFreePages();
-}
-    
-FastMallocStatistics fastMallocStatistics()
-{
-    FastMallocStatistics statistics;
-    {
-        SpinLockHolder lockHolder(&pageheap_lock);
-        statistics.heapSize = static_cast<size_t>(pageheap->SystemBytes());
-        statistics.freeSizeInHeap = static_cast<size_t>(pageheap->FreeBytes());
-        statistics.returnedSize = pageheap->ReturnedBytes();
-        statistics.freeSizeInCaches = 0;
-        for (TCMalloc_ThreadCache* threadCache = thread_heaps; threadCache ; threadCache = threadCache->next_)
-            statistics.freeSizeInCaches += threadCache->Size();
-    }
-    for (unsigned cl = 0; cl < kNumClasses; ++cl) {
-        const int length = central_cache[cl].length();
-        const int tc_length = central_cache[cl].tc_length();
-        statistics.freeSizeInCaches += ByteSizeForClass(cl) * (length + tc_length);
-    }
-    return statistics;
-}
+#endif // OS(DARWIN)
 
 } // namespace WTF
-#endif
+#endif // WTF_CHANGES
 
 #endif // FORCE_SYSTEM_MALLOC
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
index 541b05d3af..9f82275c44 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
@@ -26,19 +26,15 @@
 #include <stdlib.h>
 #include <new>
 
-#if COMPILER(GCC)
-#define WTF_FAST_MALLOC_EXPORT __attribute__((visibility("default")))
-#else
-#define WTF_FAST_MALLOC_EXPORT
-#endif
-
 namespace WTF {
 
     // These functions call CRASH() if an allocation fails.
-    void* fastMalloc(size_t) WTF_FAST_MALLOC_EXPORT;
+    void* fastMalloc(size_t);
     void* fastZeroedMalloc(size_t);
-    void* fastCalloc(size_t numElements, size_t elementSize) WTF_FAST_MALLOC_EXPORT;
-    void* fastRealloc(void*, size_t) WTF_FAST_MALLOC_EXPORT;
+    void* fastCalloc(size_t numElements, size_t elementSize);
+    void* fastRealloc(void*, size_t);
+    char* fastStrDup(const char*);
+    size_t fastMallocSize(const void*);
 
     struct TryMallocReturnValue {
         TryMallocReturnValue(void* data)
@@ -77,7 +73,7 @@ namespace WTF {
     TryMallocReturnValue tryFastCalloc(size_t n_elements, size_t element_size);
     TryMallocReturnValue tryFastRealloc(void* p, size_t n);
 
-    void fastFree(void*) WTF_FAST_MALLOC_EXPORT;
+    void fastFree(void*);
 
 #ifndef NDEBUG    
     void fastMallocForbid();
@@ -87,10 +83,9 @@ namespace WTF {
     void releaseFastMallocFreeMemory();
     
     struct FastMallocStatistics {
-        size_t heapSize;
-        size_t freeSizeInHeap;
-        size_t freeSizeInCaches;
-        size_t returnedSize;
+        size_t reservedVMBytes;
+        size_t committedVMBytes;
+        size_t freeListBytes;
     };
     FastMallocStatistics fastMallocStatistics();
 
@@ -194,17 +189,18 @@ using WTF::tryFastZeroedMalloc;
 using WTF::tryFastCalloc;
 using WTF::tryFastRealloc;
 using WTF::fastFree;
+using WTF::fastStrDup;
 
 #ifndef NDEBUG    
 using WTF::fastMallocForbid;
 using WTF::fastMallocAllow;
 #endif
 
-#if COMPILER(GCC) && PLATFORM(DARWIN)
+#if COMPILER(GCC) && OS(DARWIN)
 #define WTF_PRIVATE_INLINE __private_extern__ inline __attribute__((always_inline))
 #elif COMPILER(GCC)
 #define WTF_PRIVATE_INLINE inline __attribute__((always_inline))
-#elif COMPILER(MSVC)
+#elif COMPILER(MSVC) || COMPILER(RVCT)
 #define WTF_PRIVATE_INLINE __forceinline
 #else
 #define WTF_PRIVATE_INLINE inline
@@ -219,17 +215,23 @@ using WTF::fastMallocAllow;
 // debug-only code to make sure we don't use the system malloc via the default operator
 // new by accident.
 
-// We musn't customize the global operator new and delete for the Qt port.
-#if !PLATFORM(QT)
+#if ENABLE(GLOBAL_FASTMALLOC_NEW)
 
-WTF_PRIVATE_INLINE void* operator new(size_t size) { return fastMalloc(size); }
+#if COMPILER(MSVC)
+#pragma warning(push)
+#pragma warning(disable: 4290) // Disable the C++ exception specification ignored warning.
+#endif
+WTF_PRIVATE_INLINE void* operator new(size_t size) throw (std::bad_alloc) { return fastMalloc(size); }
 WTF_PRIVATE_INLINE void* operator new(size_t size, const std::nothrow_t&) throw() { return fastMalloc(size); }
-WTF_PRIVATE_INLINE void operator delete(void* p) { fastFree(p); }
+WTF_PRIVATE_INLINE void operator delete(void* p) throw() { fastFree(p); }
 WTF_PRIVATE_INLINE void operator delete(void* p, const std::nothrow_t&) throw() { fastFree(p); }
-WTF_PRIVATE_INLINE void* operator new[](size_t size) { return fastMalloc(size); }
+WTF_PRIVATE_INLINE void* operator new[](size_t size) throw (std::bad_alloc) { return fastMalloc(size); }
 WTF_PRIVATE_INLINE void* operator new[](size_t size, const std::nothrow_t&) throw() { return fastMalloc(size); }
-WTF_PRIVATE_INLINE void operator delete[](void* p) { fastFree(p); }
+WTF_PRIVATE_INLINE void operator delete[](void* p) throw() { fastFree(p); }
 WTF_PRIVATE_INLINE void operator delete[](void* p, const std::nothrow_t&) throw() { fastFree(p); }
+#if COMPILER(MSVC)
+#pragma warning(pop)
+#endif
 
 #endif
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h
deleted file mode 100644
index 4993348524..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- *  Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
- *  Copyright (C) 2008 Collabora Ltd.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef GOwnPtr_h
-#define GOwnPtr_h
-
-#include <algorithm>
-#include <glib.h>
-#include <wtf/Assertions.h>
-#include <wtf/Noncopyable.h>
-
-namespace WTF {
-    template <typename T> inline void freeOwnedGPtr(T* ptr) { g_free(reinterpret_cast<void*>(ptr)); }
-    template<> void freeOwnedGPtr<GError>(GError*);
-    template<> void freeOwnedGPtr<GList>(GList*);
-    template<> void freeOwnedGPtr<GCond>(GCond*);
-    template<> void freeOwnedGPtr<GMutex>(GMutex*);
-    template<> void freeOwnedGPtr<GPatternSpec>(GPatternSpec*);
-    template<> void freeOwnedGPtr<GDir>(GDir*);
-    template<> void freeOwnedGPtr<GHashTable>(GHashTable*);
-
-    template <typename T> class GOwnPtr : public Noncopyable {
-    public:
-        explicit GOwnPtr(T* ptr = 0) : m_ptr(ptr) { }
-        ~GOwnPtr() { freeOwnedGPtr(m_ptr); }
-
-        T* get() const { return m_ptr; }
-        T* release() { T* ptr = m_ptr; m_ptr = 0; return ptr; }
-        T*& outPtr() { ASSERT(!m_ptr); return m_ptr; }
-
-        void set(T* ptr) { ASSERT(!ptr || m_ptr != ptr); freeOwnedGPtr(m_ptr); m_ptr = ptr; }
-        void clear() { freeOwnedGPtr(m_ptr); m_ptr = 0; }
-
-        T& operator*() const { ASSERT(m_ptr); return *m_ptr; }
-        T* operator->() const { ASSERT(m_ptr); return m_ptr; }
-
-        bool operator!() const { return !m_ptr; }
-
-        // This conversion operator allows implicit conversion to bool but not to other integer types.
-        typedef T* GOwnPtr::*UnspecifiedBoolType;
-        operator UnspecifiedBoolType() const { return m_ptr ? &GOwnPtr::m_ptr : 0; }
-
-        void swap(GOwnPtr& o) { std::swap(m_ptr, o.m_ptr); }
-
-    private:
-        T* m_ptr;
-    };
-    
-    template <typename T> inline void swap(GOwnPtr<T>& a, GOwnPtr<T>& b) { a.swap(b); }
-
-    template <typename T, typename U> inline bool operator==(const GOwnPtr<T>& a, U* b)
-    { 
-        return a.get() == b; 
-    }
-    
-    template <typename T, typename U> inline bool operator==(T* a, const GOwnPtr<U>& b) 
-    {
-        return a == b.get(); 
-    }
-
-    template <typename T, typename U> inline bool operator!=(const GOwnPtr<T>& a, U* b)
-    {
-        return a.get() != b; 
-    }
-
-    template <typename T, typename U> inline bool operator!=(T* a, const GOwnPtr<U>& b)
-    { 
-        return a != b.get(); 
-    }
-    
-    template <typename T> inline typename GOwnPtr<T>::PtrType getPtr(const GOwnPtr<T>& p)
-    {
-        return p.get();
-    }
-
-} // namespace WTF
-
-using WTF::GOwnPtr;
-
-#endif // GOwnPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
index 165eb41346..4ed75c5179 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
@@ -43,7 +43,7 @@ namespace WTF {
         int capacity() const;
         bool isEmpty() const;
         
-        // iterators iterate over pairs of values and counts
+        // Iterators iterate over pairs of values and counts.
         iterator begin();
         iterator end();
         const_iterator begin() const;
@@ -54,21 +54,21 @@ namespace WTF {
         bool contains(const ValueType&) const;
         unsigned count(const ValueType&) const;
 
-        // increases the count if an equal value is already present
-        // the return value is a pair of an interator to the new value's location, 
-        // and a bool that is true if an new entry was added
+        // Increases the count if an equal value is already present
+        // the return value is a pair of an interator to the new value's 
+        // location, and a bool that is true if an new entry was added.
         std::pair<iterator, bool> add(const ValueType&);
         
-        // reduces the count of the value, and removes it if count
-        // goes down to zero
-        void remove(const ValueType&);
-        void remove(iterator);
+        // Reduces the count of the value, and removes it if count
+        // goes down to zero, returns true if the value is removed.
+        bool remove(const ValueType&);
+        bool remove(iterator);
  
-        // removes the value, regardless of its count
+        // Removes the value, regardless of its count.
         void removeAll(iterator);
         void removeAll(const ValueType&);
 
-        // clears the whole set
+        // Clears the whole set.
         void clear();
 
     private:
@@ -150,24 +150,27 @@ namespace WTF {
     }
     
     template<typename Value, typename HashFunctions, typename Traits>
-    inline void HashCountedSet<Value, HashFunctions, Traits>::remove(const ValueType& value)
+    inline bool HashCountedSet<Value, HashFunctions, Traits>::remove(const ValueType& value)
     {
-        remove(find(value));
+        return remove(find(value));
     }
     
     template<typename Value, typename HashFunctions, typename Traits>
-    inline void HashCountedSet<Value, HashFunctions, Traits>::remove(iterator it)
+    inline bool HashCountedSet<Value, HashFunctions, Traits>::remove(iterator it)
     {
         if (it == end())
-            return;
+            return false;
 
         unsigned oldVal = it->second;
-        ASSERT(oldVal != 0);
+        ASSERT(oldVal);
         unsigned newVal = oldVal - 1;
-        if (newVal == 0)
-            m_impl.remove(it);
-        else
+        if (newVal) {
             it->second = newVal;
+            return false;
+        }
+
+        m_impl.remove(it);
+        return true;
     }
     
     template<typename Value, typename HashFunctions, typename Traits>
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashFunctions.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashFunctions.h
index 13afb723df..2c66a2d9fb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashFunctions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashFunctions.h
@@ -173,9 +173,6 @@ namespace WTF {
     template<typename P> struct DefaultHash<RefPtr<P> > { typedef PtrHash<RefPtr<P> > Hash; };
 
     template<typename T, typename U> struct DefaultHash<std::pair<T, U> > { typedef PairHash<T, U> Hash; };
-    
-    // Golden ratio - arbitrary start value to avoid mapping all 0's to all 0's
-    static const unsigned stringHashingStartValue = 0x9e3779b9U;
 
 } // namespace WTF
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
index 3de5ee6e0c..09094d1ad5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
@@ -83,6 +83,25 @@ namespace WTF {
 
         MappedType take(const KeyType&); // efficient combination of get with remove
 
+        // An alternate version of find() that finds the object by hashing and comparing
+        // with some other type, to avoid the cost of type conversion. HashTranslator
+        // must have the following function members:
+        //   static unsigned hash(const T&);
+        //   static bool equal(const ValueType&, const T&);
+        template<typename T, typename HashTranslator> iterator find(const T&);
+        template<typename T, typename HashTranslator> const_iterator find(const T&) const;
+        template<typename T, typename HashTranslator> bool contains(const T&) const;
+
+        // An alternate version of add() that finds the object by hashing and comparing
+        // with some other type, to avoid the cost of type conversion if the object is already
+        // in the table. HashTranslator must have the following function members:
+        //   static unsigned hash(const T&);
+        //   static bool equal(const ValueType&, const T&);
+        //   static translate(ValueType&, const T&, unsigned hashCode);
+        template<typename T, typename HashTranslator> pair<iterator, bool> add(const T&, const MappedType&);
+
+        void checkConsistency() const;
+
     private:
         pair<iterator, bool> inlineAdd(const KeyType&, const MappedType&);
 
@@ -107,6 +126,20 @@ namespace WTF {
         }
     };
 
+    template<typename ValueType, typename ValueTraits, typename T, typename Translator>
+    struct HashMapTranslatorAdapter {
+        typedef typename ValueType::first_type KeyType;
+        typedef typename ValueType::second_type MappedType;
+
+        static unsigned hash(const T& key) { return Translator::hash(key); }
+        static bool equal(const KeyType& a, const T& b) { return Translator::equal(a, b); }
+        static void translate(ValueType& location, const T& key, const MappedType& mapped, unsigned hashCode)
+        {
+            Translator::translate(location.first, key, hashCode);
+            location.second = mapped;
+        }
+    };
+
     template<typename T, typename U, typename V, typename W, typename X>
     inline void HashMap<T, U, V, W, X>::swap(HashMap& other)
     {
@@ -174,6 +207,33 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    inline typename HashMap<T, U, V, W, X>::iterator
+    HashMap<T, U, V, W, X>::find(const TYPE& value)
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template find<TYPE, Adapter>(value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    inline typename HashMap<T, U, V, W, X>::const_iterator 
+    HashMap<T, U, V, W, X>::find(const TYPE& value) const
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template find<TYPE, Adapter>(value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    inline bool
+    HashMap<T, U, V, W, X>::contains(const TYPE& value) const
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template contains<TYPE, Adapter>(value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
     inline pair<typename HashMap<T, U, V, W, X>::iterator, bool>
     HashMap<T, U, V, W, X>::inlineAdd(const KeyType& key, const MappedType& mapped) 
     {
@@ -194,6 +254,15 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    pair<typename HashMap<T, U, V, W, X>::iterator, bool>
+    HashMap<T, U, V, W, X>::add(const TYPE& key, const MappedType& value)
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template addPassingHashCode<TYPE, MappedType, Adapter>(key, value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
     pair<typename HashMap<T, U, V, W, X>::iterator, bool>
     HashMap<T, U, V, W, X>::add(const KeyType& key, const MappedType& mapped)
     {
@@ -215,7 +284,7 @@ namespace WTF {
     {
         if (it.m_impl == m_impl.end())
             return;
-        m_impl.checkTableConsistency();
+        m_impl.internalCheckTableConsistency();
         m_impl.removeWithoutEntryConsistencyCheck(it.m_impl);
     }
 
@@ -245,6 +314,13 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
+    inline void HashMap<T, U, V, W, X>::checkConsistency() const
+    {
+        m_impl.checkTableConsistency();
+    }
+
+
+    template<typename T, typename U, typename V, typename W, typename X>
     bool operator==(const HashMap<T, U, V, W, X>& a, const HashMap<T, U, V, W, X>& b)
     {
         if (a.size() != b.size())
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h
index f4e2cf7e37..442949081f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h
@@ -81,7 +81,7 @@ namespace WTF {
 
         // An alternate version of add() that finds the object by hashing and comparing
         // with some other type, to avoid the cost of type conversion if the object is already
-        // in the table. HashTranslator must have the following methods:
+        // in the table. HashTranslator must have the following function members:
         //   static unsigned hash(const T&);
         //   static bool equal(const ValueType&, const T&);
         //   static translate(ValueType&, const T&, unsigned hashCode);
@@ -224,7 +224,7 @@ namespace WTF {
     {
         if (it.m_impl == m_impl.end())
             return;
-        m_impl.checkTableConsistency();
+        m_impl.internalCheckTableConsistency();
         m_impl.removeWithoutEntryConsistencyCheck(it.m_impl);
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashTable.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashTable.h
index 3b283f8228..ceb8963636 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashTable.h
@@ -24,12 +24,14 @@
 
 #include "FastMalloc.h"
 #include "HashTraits.h"
+#include "ValueCheck.h"
 #include <wtf/Assertions.h>
 #include <wtf/Threading.h>
 
 namespace WTF {
 
 #define DUMP_HASHTABLE_STATS 0
+// Enables internal WTF consistency checks that are invoked automatically. Non-WTF callers can call checkTableConsistency() even if internal checks are disabled.
 #define CHECK_HASHTABLE_CONSISTENCY 0
 
 #ifdef NDEBUG
@@ -197,7 +199,7 @@ namespace WTF {
         void checkValidity(const const_iterator& other) const
         {
             ASSERT(m_table);
-            ASSERT(other.m_table);
+            ASSERT_UNUSED(other, other.m_table);
             ASSERT(m_table == other.m_table);
         }
 #else
@@ -340,11 +342,18 @@ namespace WTF {
         ValueType* lookup(const Key& key) { return lookup<Key, IdentityTranslatorType>(key); }
         template<typename T, typename HashTranslator> ValueType* lookup(const T&);
 
-#if CHECK_HASHTABLE_CONSISTENCY
+#if !ASSERT_DISABLED
         void checkTableConsistency() const;
 #else
         static void checkTableConsistency() { }
 #endif
+#if CHECK_HASHTABLE_CONSISTENCY
+        void internalCheckTableConsistency() const { checkTableConsistency(); }
+        void internalCheckTableConsistencyExceptSize() const { checkTableConsistencyExceptSize(); }
+#else
+        static void internalCheckTableConsistencyExceptSize() { }
+        static void internalCheckTableConsistency() { }
+#endif
 
     private:
         static ValueType* allocateTable(int size);
@@ -383,7 +392,7 @@ namespace WTF {
         iterator makeKnownGoodIterator(ValueType* pos) { return iterator(this, pos, m_table + m_tableSize, HashItemKnownGood); }
         const_iterator makeKnownGoodConstIterator(ValueType* pos) const { return const_iterator(this, pos, m_table + m_tableSize, HashItemKnownGood); }
 
-#if CHECK_HASHTABLE_CONSISTENCY
+#if !ASSERT_DISABLED
         void checkTableConsistencyExceptSize() const;
 #else
         static void checkTableConsistencyExceptSize() { }
@@ -624,7 +633,7 @@ namespace WTF {
         if (!m_table)
             expand();
 
-        checkTableConsistency();
+        internalCheckTableConsistency();
 
         ASSERT(m_table);
 
@@ -693,7 +702,7 @@ namespace WTF {
             return p;
         }
         
-        checkTableConsistency();
+        internalCheckTableConsistency();
         
         return std::make_pair(makeKnownGoodIterator(entry), true);
     }
@@ -709,7 +718,7 @@ namespace WTF {
         if (!m_table)
             expand();
 
-        checkTableConsistency();
+        internalCheckTableConsistency();
 
         FullLookupType lookupResult = fullLookupForWriting<T, HashTranslator>(key);
 
@@ -738,7 +747,7 @@ namespace WTF {
             return p;
         }
 
-        checkTableConsistency();
+        internalCheckTableConsistency();
 
         return std::make_pair(makeKnownGoodIterator(entry), true);
     }
@@ -805,7 +814,7 @@ namespace WTF {
     void HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::removeAndInvalidate(ValueType* pos)
     {
         invalidateIterators();
-        checkTableConsistency();
+        internalCheckTableConsistency();
         remove(pos);
     }
 
@@ -823,7 +832,7 @@ namespace WTF {
         if (shouldShrink())
             shrink();
 
-        checkTableConsistency();
+        internalCheckTableConsistency();
     }
 
     template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
@@ -892,7 +901,7 @@ namespace WTF {
     template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
     void HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::rehash(int newTableSize)
     {
-        checkTableConsistencyExceptSize();
+        internalCheckTableConsistencyExceptSize();
 
         int oldTableSize = m_tableSize;
         ValueType* oldTable = m_table;
@@ -914,7 +923,7 @@ namespace WTF {
 
         deallocateTable(oldTable, oldTableSize);
 
-        checkTableConsistency();
+        internalCheckTableConsistency();
     }
 
     template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
@@ -981,13 +990,13 @@ namespace WTF {
         return *this;
     }
 
-#if CHECK_HASHTABLE_CONSISTENCY
+#if !ASSERT_DISABLED
 
     template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
     void HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::checkTableConsistency() const
     {
         checkTableConsistencyExceptSize();
-        ASSERT(!shouldExpand());
+        ASSERT(!m_table || !shouldExpand());
         ASSERT(!shouldShrink());
     }
 
@@ -1012,6 +1021,8 @@ namespace WTF {
             const_iterator it = find(Extractor::extract(*entry));
             ASSERT(entry == it.m_position);
             ++count;
+
+            ValueCheck<Key>::checkConsistency(it->first);
         }
 
         ASSERT(count == m_keyCount);
@@ -1021,7 +1032,7 @@ namespace WTF {
         ASSERT(m_tableSize == m_tableSizeMask + 1);
     }
 
-#endif // CHECK_HASHTABLE_CONSISTENCY
+#endif // ASSERT_DISABLED
 
 #if CHECK_HASHTABLE_ITERATORS
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ListHashSet.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ListHashSet.h
index 38cc998506..54ed36b2a9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ListHashSet.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ListHashSet.h
@@ -51,7 +51,7 @@ namespace WTF {
     template<typename ValueArg> struct ListHashSetNodeAllocator;
     template<typename ValueArg, typename HashArg> struct ListHashSetNodeHashFunctions;
 
-    template<typename ValueArg, typename HashArg = typename DefaultHash<ValueArg>::Hash> class ListHashSet {
+    template<typename ValueArg, typename HashArg = typename DefaultHash<ValueArg>::Hash> class ListHashSet : public FastAllocBase {
     private:
         typedef ListHashSetNode<ValueArg> Node;
         typedef ListHashSetNodeAllocator<ValueArg> NodeAllocator;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
index e999094df2..40a4ae5308 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
@@ -39,10 +39,12 @@ namespace WTF {
 struct FunctionWithContext {
     MainThreadFunction* function;
     void* context;
+    ThreadCondition* syncFlag;
 
-    FunctionWithContext(MainThreadFunction* function = 0, void* context = 0)
+    FunctionWithContext(MainThreadFunction* function = 0, void* context = 0, ThreadCondition* syncFlag = 0)
         : function(function)
         , context(context)
+        , syncFlag(syncFlag)
     { 
     }
 };
@@ -92,6 +94,8 @@ void dispatchFunctionsFromMainThread()
         }
 
         invocation.function(invocation.context);
+        if (invocation.syncFlag)
+            invocation.syncFlag->signal();
 
         // If we are running accumulated functions for too long so UI may become unresponsive, we need to
         // yield so the user input can be processed. Otherwise user may not be able to even close the window.
@@ -117,6 +121,24 @@ void callOnMainThread(MainThreadFunction* function, void* context)
         scheduleDispatchFunctionsOnMainThread();
 }
 
+void callOnMainThreadAndWait(MainThreadFunction* function, void* context)
+{
+    ASSERT(function);
+
+    if (isMainThread()) {
+        function(context);
+        return;
+    }
+
+    ThreadCondition syncFlag;
+    Mutex& functionQueueMutex = mainThreadFunctionQueueMutex();
+    MutexLocker locker(functionQueueMutex);
+    functionQueue().append(FunctionWithContext(function, context, &syncFlag));
+    if (functionQueue().size() == 1)
+        scheduleDispatchFunctionsOnMainThread();
+    syncFlag.wait(functionQueueMutex);
+}
+
 void setMainThreadCallbacksPaused(bool paused)
 {
     ASSERT(isMainThread());
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
index 01ce80476f..8c0275bac6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
@@ -38,6 +38,9 @@ typedef void MainThreadFunction(void*);
 
 void callOnMainThread(MainThreadFunction*, void* context);
 
+// Blocks the thread until the call finishes on the main thread. Misusing this can easily cause deadlocks.
+void callOnMainThreadAndWait(MainThreadFunction*, void* context);
+
 void setMainThreadCallbacksPaused(bool paused);
 
 // Must be called from the main thread (Darwin is an exception to this rule).
@@ -52,6 +55,7 @@ void dispatchFunctionsFromMainThread();
 } // namespace WTF
 
 using WTF::callOnMainThread;
+using WTF::callOnMainThreadAndWait;
 using WTF::setMainThreadCallbacksPaused;
 
 #endif // MainThread_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
index 556230eb8c..a0c7466a1c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,28 +26,24 @@
 #ifndef WTF_MathExtras_h
 #define WTF_MathExtras_h
 
-#include <math.h>
+#include <cmath>
+#include <float.h>
 #include <stdlib.h>
 
-#if PLATFORM(SOLARIS)
+#if OS(SOLARIS)
 #include <ieeefp.h>
 #endif
 
-#if PLATFORM(OPENBSD)
+#if OS(OPENBSD)
 #include <sys/types.h>
 #include <machine/ieee.h>
 #endif
 
 #if COMPILER(MSVC)
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 #include <stdlib.h>
 #endif
 #include <limits>
-
-#if HAVE(FLOAT_H)
-#include <float.h>
-#endif
-
 #endif
 
 #ifndef M_PI
@@ -66,7 +62,7 @@ const double piOverFourDouble = M_PI_4;
 const float piOverFourFloat = static_cast<float>(M_PI_4);
 #endif
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
 // Work around a bug in the Mac OS X libc where ceil(-0.1) return +0.
 inline double wtf_ceil(double x) { return copysign(ceil(x), x); }
@@ -75,7 +71,7 @@ inline double wtf_ceil(double x) { return copysign(ceil(x), x); }
 
 #endif
 
-#if PLATFORM(SOLARIS)
+#if OS(SOLARIS)
 
 #ifndef isfinite
 inline bool isfinite(double x) { return finite(x) && !isnand(x); }
@@ -89,7 +85,7 @@ inline bool signbit(double x) { return x < 0.0; } // FIXME: Wrong for negative 0
 
 #endif
 
-#if PLATFORM(OPENBSD)
+#if OS(OPENBSD)
 
 #ifndef isfinite
 inline bool isfinite(double x) { return finite(x); }
@@ -102,18 +98,33 @@ inline bool signbit(double x) { struct ieee_double *p = (struct ieee_double *)&x
 
 #if COMPILER(MSVC) || COMPILER(RVCT)
 
-inline long long llround(double num) { return static_cast<long long>(num > 0 ? num + 0.5 : ceil(num - 0.5)); }
-inline long long llroundf(float num) { return static_cast<long long>(num > 0 ? num + 0.5f : ceil(num - 0.5f)); }
-inline long lround(double num) { return static_cast<long>(num > 0 ? num + 0.5 : ceil(num - 0.5)); }
-inline long lroundf(float num) { return static_cast<long>(num > 0 ? num + 0.5f : ceilf(num - 0.5f)); }
-inline double round(double num) { return num > 0 ? floor(num + 0.5) : ceil(num - 0.5); }
-inline float roundf(float num) { return num > 0 ? floorf(num + 0.5f) : ceilf(num - 0.5f); }
+// We must not do 'num + 0.5' or 'num - 0.5' because they can cause precision loss.
+static double round(double num)
+{
+    double integer = ceil(num);
+    if (num > 0)
+        return integer - num > 0.5 ? integer - 1.0 : integer;
+    return integer - num >= 0.5 ? integer - 1.0 : integer;
+}
+static float roundf(float num)
+{
+    float integer = ceilf(num);
+    if (num > 0)
+        return integer - num > 0.5f ? integer - 1.0f : integer;
+    return integer - num >= 0.5f ? integer - 1.0f : integer;
+}
+inline long long llround(double num) { return static_cast<long long>(round(num)); }
+inline long long llroundf(float num) { return static_cast<long long>(roundf(num)); }
+inline long lround(double num) { return static_cast<long>(round(num)); }
+inline long lroundf(float num) { return static_cast<long>(roundf(num)); }
 inline double trunc(double num) { return num > 0 ? floor(num) : ceil(num); }
 
 #endif
 
 #if COMPILER(MSVC)
 
+inline long long abs(long long num) { return _abs64(num); }
+
 inline bool isinf(double num) { return !_finite(num) && !_isnan(num); }
 inline bool isnan(double num) { return !!_isnan(num); }
 inline bool signbit(double num) { return _copysign(1.0, num) < 0; }
@@ -177,4 +188,11 @@ inline float deg2turn(float d) { return d / 360.0f; }
 inline float rad2grad(float r) { return r * 200.0f / piFloat; }
 inline float grad2rad(float g) { return g * piFloat / 200.0f; }
 
+#if !COMPILER(MSVC) && !COMPILER(RVCT) && !OS(ANDROID) && !COMPILER(WINSCW)
+using std::isfinite;
+using std::isinf;
+using std::isnan;
+using std::signbit;
+#endif
+
 #endif // #ifndef WTF_MathExtras_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
index 9c9a4a789a..48bd10ad0d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
@@ -44,23 +44,27 @@ namespace WTF {
         MessageQueueMessageReceived,  // A message was successfully received and returned.
     };
 
+    // The queue takes ownership of messages and transfer it to the new owner
+    // when messages are fetched from the queue.
+    // Essentially, MessageQueue acts as a queue of OwnPtr<DataType>.
     template<typename DataType>
     class MessageQueue : public Noncopyable {
     public:
         MessageQueue() : m_killed(false) { }
-        
-        void append(const DataType&);
-        bool appendAndCheckEmpty(const DataType&);
-        void prepend(const DataType&);
-        bool waitForMessage(DataType&);
+        ~MessageQueue();
+
+        void append(PassOwnPtr<DataType>);
+        bool appendAndCheckEmpty(PassOwnPtr<DataType>);
+        void prepend(PassOwnPtr<DataType>);
+
+        PassOwnPtr<DataType> waitForMessage();
+        PassOwnPtr<DataType> tryGetMessage();
         template<typename Predicate>
-        MessageQueueWaitResult waitForMessageFilteredWithTimeout(DataType&, Predicate&, double absoluteTime);
+        PassOwnPtr<DataType> waitForMessageFilteredWithTimeout(MessageQueueWaitResult&, Predicate&, double absoluteTime);
 
         template<typename Predicate>
         void removeIf(Predicate&);
 
-        bool tryGetMessage(DataType&);
-
         void kill();
         bool killed() const;
 
@@ -70,86 +74,98 @@ namespace WTF {
         static double infiniteTime() { return std::numeric_limits<double>::max(); }
 
     private:
-        static bool alwaysTruePredicate(DataType&) { return true; }
+        static bool alwaysTruePredicate(DataType*) { return true; }
 
         mutable Mutex m_mutex;
         ThreadCondition m_condition;
-        Deque<DataType> m_queue;
+        Deque<DataType*> m_queue;
         bool m_killed;
     };
 
     template<typename DataType>
-    inline void MessageQueue<DataType>::append(const DataType& message)
+    MessageQueue<DataType>::~MessageQueue()
+    {
+        deleteAllValues(m_queue);
+    }
+
+    template<typename DataType>
+    inline void MessageQueue<DataType>::append(PassOwnPtr<DataType> message)
     {
         MutexLocker lock(m_mutex);
-        m_queue.append(message);
+        m_queue.append(message.release());
         m_condition.signal();
     }
 
     // Returns true if the queue was empty before the item was added.
     template<typename DataType>
-    inline bool MessageQueue<DataType>::appendAndCheckEmpty(const DataType& message)
+    inline bool MessageQueue<DataType>::appendAndCheckEmpty(PassOwnPtr<DataType> message)
     {
         MutexLocker lock(m_mutex);
         bool wasEmpty = m_queue.isEmpty();
-        m_queue.append(message);
+        m_queue.append(message.release());
         m_condition.signal();
         return wasEmpty;
     }
 
     template<typename DataType>
-    inline void MessageQueue<DataType>::prepend(const DataType& message)
+    inline void MessageQueue<DataType>::prepend(PassOwnPtr<DataType> message)
     {
         MutexLocker lock(m_mutex);
-        m_queue.prepend(message);
+        m_queue.prepend(message.release());
         m_condition.signal();
     }
 
     template<typename DataType>
-    inline bool MessageQueue<DataType>::waitForMessage(DataType& result)
+    inline PassOwnPtr<DataType> MessageQueue<DataType>::waitForMessage()
     {
-        MessageQueueWaitResult exitReason = waitForMessageFilteredWithTimeout(result, MessageQueue<DataType>::alwaysTruePredicate, infiniteTime());
+        MessageQueueWaitResult exitReason; 
+        PassOwnPtr<DataType> result = waitForMessageFilteredWithTimeout(exitReason, MessageQueue<DataType>::alwaysTruePredicate, infiniteTime());
         ASSERT(exitReason == MessageQueueTerminated || exitReason == MessageQueueMessageReceived);
-        return exitReason == MessageQueueMessageReceived;
+        return result;
     }
 
     template<typename DataType>
     template<typename Predicate>
-    inline MessageQueueWaitResult MessageQueue<DataType>::waitForMessageFilteredWithTimeout(DataType& result, Predicate& predicate, double absoluteTime)
+    inline PassOwnPtr<DataType> MessageQueue<DataType>::waitForMessageFilteredWithTimeout(MessageQueueWaitResult& result, Predicate& predicate, double absoluteTime)
     {
         MutexLocker lock(m_mutex);
         bool timedOut = false;
 
-        DequeConstIterator<DataType> found = m_queue.end();
+        DequeConstIterator<DataType*> found = m_queue.end();
         while (!m_killed && !timedOut && (found = m_queue.findIf(predicate)) == m_queue.end())
             timedOut = !m_condition.timedWait(m_mutex, absoluteTime);
 
         ASSERT(!timedOut || absoluteTime != infiniteTime());
 
-        if (m_killed)
-            return MessageQueueTerminated;
+        if (m_killed) {
+            result = MessageQueueTerminated;
+            return 0;
+        }
 
-        if (timedOut)
-            return MessageQueueTimeout;
+        if (timedOut) {
+            result = MessageQueueTimeout;
+            return 0;
+        }
 
         ASSERT(found != m_queue.end());
-        result = *found;
+        DataType* message = *found;
         m_queue.remove(found);
-        return MessageQueueMessageReceived;
+        result = MessageQueueMessageReceived;
+        return message;
     }
 
     template<typename DataType>
-    inline bool MessageQueue<DataType>::tryGetMessage(DataType& result)
+    inline PassOwnPtr<DataType> MessageQueue<DataType>::tryGetMessage()
     {
         MutexLocker lock(m_mutex);
         if (m_killed)
-            return false;
+            return 0;
         if (m_queue.isEmpty())
-            return false;
+            return 0;
 
-        result = m_queue.first();
+        DataType* message = m_queue.first();
         m_queue.removeFirst();
-        return true;
+        return message;
     }
 
     template<typename DataType>
@@ -157,9 +173,15 @@ namespace WTF {
     inline void MessageQueue<DataType>::removeIf(Predicate& predicate)
     {
         MutexLocker lock(m_mutex);
-        DequeConstIterator<DataType> found = m_queue.end();
-        while ((found = m_queue.findIf(predicate)) != m_queue.end()) {
+        // See bug 31657 for why this loop looks so weird
+        while (true) {
+            DequeConstIterator<DataType*> found = m_queue.findIf(predicate);
+            if (found == m_queue.end())
+                break;
+
+            DataType* message = *found;
             m_queue.remove(found);
+            delete message;
        }
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h
index c88235a8a9..8b6cbf45e7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h
@@ -35,7 +35,7 @@ namespace WTF {
 
         ~OwnFastMallocPtr()
         {
-            fastFree(m_ptr);
+            fastFree(const_cast<void*>(static_cast<const void*>(const_cast<const T*>(m_ptr))));
         }
 
         T* get() const { return m_ptr; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h
index b7e62b1eab..af1684bddb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h
@@ -40,7 +40,6 @@ namespace WTF {
         typedef ValueType* PtrType;
 
         explicit OwnPtr(PtrType ptr = 0) : m_ptr(ptr) { }
-        OwnPtr(std::auto_ptr<ValueType> autoPtr) : m_ptr(autoPtr.release()) { }
         // See comment in PassOwnPtr.h for why this takes a const reference.
         template <typename U> OwnPtr(const PassOwnPtr<U>& o);
 
@@ -58,8 +57,6 @@ namespace WTF {
         // FIXME: This should be renamed to adopt. 
         void set(PtrType ptr) { ASSERT(!ptr || m_ptr != ptr); deleteOwnedPtr(m_ptr); m_ptr = ptr; }
 
-        void adopt(std::auto_ptr<ValueType> autoPtr) { ASSERT(!autoPtr.get() || m_ptr != autoPtr.get()); deleteOwnedPtr(m_ptr); m_ptr = autoPtr.release(); }
-
         void clear() { deleteOwnedPtr(m_ptr); m_ptr = 0; }
 
         ValueType& operator*() const { ASSERT(m_ptr); return *m_ptr; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrBrew.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrBrew.cpp
new file mode 100644
index 0000000000..c8384e1d0a
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrBrew.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Company 100 Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "OwnPtr.h"
+
+#include <AEEBitmap.h>
+#include <AEEFile.h>
+#include <AEEStdLib.h>
+
+namespace WTF {
+
+void deleteOwnedPtr(IFileMgr* ptr)
+{
+    if (ptr)
+        IFILEMGR_Release(ptr);
+}
+
+void deleteOwnedPtr(IFile* ptr)
+{
+    if (ptr)
+        IFILE_Release(ptr);
+}
+
+void deleteOwnedPtr(IBitmap* ptr)
+{
+    if (ptr)
+        IBitmap_Release(ptr);
+}
+
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h
index 6d91a54b9e..c59fdc51e4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile, Inc.
+ * Copyright (C) 2010 Company 100 Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,6 +38,14 @@ typedef struct HPEN__* HPEN;
 typedef struct HRGN__* HRGN;
 #endif
 
+#if PLATFORM(BREWMP)
+// Forward delcarations at this point avoid the need to include BREW includes
+// in WTF headers.
+typedef struct _IFileMgr IFileMgr;
+typedef struct _IFile IFile;
+typedef struct IBitmap IBitmap;
+#endif
+
 namespace WTF {
 
     template <typename T> inline void deleteOwnedPtr(T* ptr)
@@ -56,6 +65,12 @@ namespace WTF {
     void deleteOwnedPtr(HRGN);
 #endif
 
+#if PLATFORM(BREWMP)
+    void deleteOwnedPtr(IFileMgr*);
+    void deleteOwnedPtr(IFile*);
+    void deleteOwnedPtr(IBitmap*);
+#endif
+
 } // namespace WTF
 
 #endif // WTF_OwnPtrCommon_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
index f56bc1065d..9c6e44fe4a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
@@ -28,28 +28,29 @@ namespace WTF {
     template<typename T> class RefPtr;
     template<typename T> class PassRefPtr;
     template <typename T> PassRefPtr<T> adoptRef(T*);
-    
-    // Remove inline for winscw compiler to prevent the compiler agressively resolving 
-    // T::deref(), which will fail compiling when PassRefPtr<T> is used as class member 
-    // or function arguments before T is defined.
-    template<typename T> 
+
+
+    // Remove inline for WINSCW compiler to prevent the compiler agressively resolving
+    // T::ref() and T::deref(), which will fail compiling when PassRefPtr<T> is used as
+    // a class member or function arguments before T is defined.
+    template<typename T>
 #if !COMPILER(WINSCW)
-    inline 
+    inline
 #endif
-    void derefIfNotNull(T* ptr)
+    void refIfNotNull(T* ptr)
     {
         if (UNLIKELY(ptr != 0))
-            ptr->deref();
+            ptr->ref();
     }
 
-    template<typename T>
+    template<typename T> 
 #if !COMPILER(WINSCW)
-    inline
+    inline 
 #endif
-    void refIfNotNull(T* ptr)
+    void derefIfNotNull(T* ptr)
     {
         if (UNLIKELY(ptr != 0))
-            ptr->ref();
+            ptr->deref();
     }
 
     template<typename T> class PassRefPtr {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
index 4a008cc9c3..fa78b451a5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
@@ -27,431 +27,509 @@
 #ifndef WTF_Platform_h
 #define WTF_Platform_h
 
-/* PLATFORM handles OS, operating environment, graphics API, and CPU */
+/* ==== PLATFORM handles OS, operating environment, graphics API, and
+   CPU. This macro will be phased out in favor of platform adaptation
+   macros, policy decision macros, and top-level port definitions. ==== */
 #define PLATFORM(WTF_FEATURE) (defined WTF_PLATFORM_##WTF_FEATURE  && WTF_PLATFORM_##WTF_FEATURE)
+
+
+/* ==== Platform adaptation macros: these describe properties of the target environment. ==== */
+
+/* COMPILER() - the compiler being used to build the project */
 #define COMPILER(WTF_FEATURE) (defined WTF_COMPILER_##WTF_FEATURE  && WTF_COMPILER_##WTF_FEATURE)
+/* CPU() - the target CPU architecture */
+#define CPU(WTF_FEATURE) (defined WTF_CPU_##WTF_FEATURE  && WTF_CPU_##WTF_FEATURE)
+/* HAVE() - specific system features (headers, functions or similar) that are present or not */
 #define HAVE(WTF_FEATURE) (defined HAVE_##WTF_FEATURE  && HAVE_##WTF_FEATURE)
-#define USE(WTF_FEATURE) (defined WTF_USE_##WTF_FEATURE  && WTF_USE_##WTF_FEATURE)
-#define ENABLE(WTF_FEATURE) (defined ENABLE_##WTF_FEATURE  && ENABLE_##WTF_FEATURE)
+/* OS() - underlying operating system; only to be used for mandated low-level services like 
+   virtual memory, not to choose a GUI toolkit */
+#define OS(WTF_FEATURE) (defined WTF_OS_##WTF_FEATURE  && WTF_OS_##WTF_FEATURE)
 
-/* Operating systems - low-level dependencies */
 
-/* PLATFORM(DARWIN) */
-/* Operating system level dependencies for Mac OS X / Darwin that should */
-/* be used regardless of operating environment */
-#ifdef __APPLE__
-#define WTF_PLATFORM_DARWIN 1
-#include <AvailabilityMacros.h>
-#if !defined(MAC_OS_X_VERSION_10_5) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_5
-#define BUILDING_ON_TIGER 1
-#elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_6
-#define BUILDING_ON_LEOPARD 1
-#endif
-#include <TargetConditionals.h>
-#endif
+/* ==== Policy decision macros: these define policy choices for a particular port. ==== */
 
-/* PLATFORM(WIN_OS) */
-/* Operating system level dependencies for Windows that should be used */
-/* regardless of operating environment */
-#if defined(WIN32) || defined(_WIN32)
-#define WTF_PLATFORM_WIN_OS 1
-#endif
+/* USE() - use a particular third-party library or optional OS service */
+#define USE(WTF_FEATURE) (defined WTF_USE_##WTF_FEATURE  && WTF_USE_##WTF_FEATURE)
+/* ENABLE() - turn on a specific feature of WebKit */
+#define ENABLE(WTF_FEATURE) (defined ENABLE_##WTF_FEATURE  && ENABLE_##WTF_FEATURE)
 
-/* PLATFORM(WINCE) */
-/* Operating system level dependencies for Windows CE that should be used */
-/* regardless of operating environment */
-/* Note that for this platform PLATFORM(WIN_OS) is also defined. */
-#if defined(_WIN32_WCE)
-#define WTF_PLATFORM_WINCE 1
-#endif
 
-/* PLATFORM(LINUX) */
-/* Operating system level dependencies for Linux-like systems that */
-/* should be used regardless of operating environment */
-#ifdef __linux__
-#define WTF_PLATFORM_LINUX 1
-#endif
 
-/* PLATFORM(FREEBSD) */
-/* Operating system level dependencies for FreeBSD-like systems that */
-/* should be used regardless of operating environment */
-#ifdef __FreeBSD__
-#define WTF_PLATFORM_FREEBSD 1
-#endif
+/* ==== COMPILER() - the compiler being used to build the project ==== */
 
-/* PLATFORM(OPENBSD) */
-/* Operating system level dependencies for OpenBSD systems that */
-/* should be used regardless of operating environment */
-#ifdef __OpenBSD__
-#define WTF_PLATFORM_OPENBSD 1
+/* COMPILER(MSVC) Microsoft Visual C++ */
+/* COMPILER(MSVC7) Microsoft Visual C++ v7 or lower*/
+#if defined(_MSC_VER)
+#define WTF_COMPILER_MSVC 1
+#if _MSC_VER < 1400
+#define WTF_COMPILER_MSVC7 1
 #endif
-
-/* PLATFORM(SOLARIS) */
-/* Operating system level dependencies for Solaris that should be used */
-/* regardless of operating environment */
-#if defined(sun) || defined(__sun)
-#define WTF_PLATFORM_SOLARIS 1
 #endif
 
-#if defined (__SYMBIAN32__)
-/* we are cross-compiling, it is not really windows */
-#undef WTF_PLATFORM_WIN_OS
-#undef WTF_PLATFORM_WIN
-#define WTF_PLATFORM_SYMBIAN 1
+/* COMPILER(RVCT)  - ARM RealView Compilation Tools */
+#if defined(__CC_ARM) || defined(__ARMCC__)
+#define WTF_COMPILER_RVCT 1
 #endif
 
-
-/* PLATFORM(NETBSD) */
-/* Operating system level dependencies for NetBSD that should be used */
-/* regardless of operating environment */
-#if defined(__NetBSD__)
-#define WTF_PLATFORM_NETBSD 1
+/* COMPILER(GCC) - GNU Compiler Collection */
+/* --gnu option of the RVCT compiler also defines __GNUC__ */
+#if defined(__GNUC__) && !COMPILER(RVCT)
+#define WTF_COMPILER_GCC 1
+#define GCC_VERSION (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
 #endif
 
-/* PLATFORM(QNX) */
-/* Operating system level dependencies for QNX that should be used */
-/* regardless of operating environment */
-#if defined(__QNXNTO__)
-#define WTF_PLATFORM_QNX 1
+/* COMPILER(MINGW) - MinGW GCC */
+#if defined(MINGW) || defined(__MINGW32__)
+#define WTF_COMPILER_MINGW 1
 #endif
 
-/* PLATFORM(UNIX) */
-/* Operating system level dependencies for Unix-like systems that */
-/* should be used regardless of operating environment */
-#if   PLATFORM(DARWIN)     \
-   || PLATFORM(FREEBSD)    \
-   || PLATFORM(SYMBIAN)    \
-   || PLATFORM(NETBSD)     \
-   || defined(unix)        \
-   || defined(__unix)      \
-   || defined(__unix__)    \
-   || defined(_AIX)        \
-   || defined(__HAIKU__)   \
-   || defined(__QNXNTO__)
-#define WTF_PLATFORM_UNIX 1
+/* COMPILER(WINSCW) - CodeWarrior for Symbian emulator */
+#if defined(__WINSCW__)
+#define WTF_COMPILER_WINSCW 1
+/* cross-compiling, it is not really windows */
+#undef WIN32
+#undef _WIN32
 #endif
 
-/* Operating environments */
 
-/* PLATFORM(CHROMIUM) */
-/* PLATFORM(QT) */
-/* PLATFORM(GTK) */
-/* PLATFORM(MAC) */
-/* PLATFORM(WIN) */
-#if defined(BUILDING_CHROMIUM__)
-#define WTF_PLATFORM_CHROMIUM 1
-#elif defined(BUILDING_QT__)
-#define WTF_PLATFORM_QT 1
 
-/* PLATFORM(KDE) */
-#if defined(BUILDING_KDE__)
-#define WTF_PLATFORM_KDE 1
-#endif
-
-#elif defined(BUILDING_WX__)
-#define WTF_PLATFORM_WX 1
-#elif defined(BUILDING_GTK__)
-#define WTF_PLATFORM_GTK 1
-#elif defined(BUILDING_HAIKU__)
-#define WTF_PLATFORM_HAIKU 1
-#elif PLATFORM(DARWIN)
-#define WTF_PLATFORM_MAC 1
-#elif PLATFORM(WIN_OS)
-#define WTF_PLATFORM_WIN 1
-#endif
+/* ==== CPU() - the target CPU architecture ==== */
 
-/* PLATFORM(IPHONE) */
-#if (defined(TARGET_OS_EMBEDDED) && TARGET_OS_EMBEDDED) || (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)
-#define WTF_PLATFORM_IPHONE 1
-#endif
+/* This also defines CPU(BIG_ENDIAN) or CPU(MIDDLE_ENDIAN) or neither, as appropriate. */
 
-/* PLATFORM(IPHONE_SIMULATOR) */
-#if defined(TARGET_IPHONE_SIMULATOR) && TARGET_IPHONE_SIMULATOR
-#define WTF_PLATFORM_IPHONE 1
-#define WTF_PLATFORM_IPHONE_SIMULATOR 1
-#else
-#define WTF_PLATFORM_IPHONE_SIMULATOR 0
+/* CPU(ALPHA) - DEC Alpha */
+#if defined(__alpha__)
+#define WTF_CPU_ALPHA 1
 #endif
 
-#if !defined(WTF_PLATFORM_IPHONE)
-#define WTF_PLATFORM_IPHONE 0
+/* CPU(IA64) - Itanium / IA-64 */
+#if defined(__ia64__)
+#define WTF_CPU_IA64 1
+/* 32-bit mode on Itanium */
+#if !defined(__LP64__)
+#define WTF_CPU_IA64_32 1
+#endif
+#endif
+
+/* CPU(MIPS) - MIPS 32-bit */
+/* Note: Only O32 ABI is tested, so we enable it for O32 ABI for now.  */
+#if (defined(mips) || defined(__mips__)) \
+    && defined(_ABIO32)
+#define WTF_CPU_MIPS 1
+#if defined(__MIPSEB__)
+#define WTF_CPU_BIG_ENDIAN 1
+#endif
+#define WTF_MIPS_PIC (defined __PIC__)
+#define WTF_MIPS_ARCH __mips
+#define WTF_MIPS_ISA(v) (defined WTF_MIPS_ARCH && WTF_MIPS_ARCH == v)
+#define WTF_MIPS_ISA_AT_LEAST(v) (defined WTF_MIPS_ARCH && WTF_MIPS_ARCH >= v)
+#define WTF_MIPS_ARCH_REV __mips_isa_rev
+#define WTF_MIPS_ISA_REV(v) (defined WTF_MIPS_ARCH_REV && WTF_MIPS_ARCH_REV == v)
+#define WTF_MIPS_DOUBLE_FLOAT (defined __mips_hard_float && !defined __mips_single_float)
+#endif /* MIPS */
+
+/* CPU(PPC) - PowerPC 32-bit */
+#if   defined(__ppc__)     \
+    || defined(__PPC__)     \
+    || defined(__powerpc__) \
+    || defined(__powerpc)   \
+    || defined(__POWERPC__) \
+    || defined(_M_PPC)      \
+    || defined(__PPC)
+#define WTF_CPU_PPC 1
+#define WTF_CPU_BIG_ENDIAN 1
 #endif
 
-/* Graphics engines */
-
-/* PLATFORM(CG) and PLATFORM(CI) */
-#if PLATFORM(MAC) || PLATFORM(IPHONE)
-#define WTF_PLATFORM_CG 1
-#endif
-#if PLATFORM(MAC) && !PLATFORM(IPHONE)
-#define WTF_PLATFORM_CI 1
+/* CPU(PPC64) - PowerPC 64-bit */
+#if   defined(__ppc64__) \
+    || defined(__PPC64__)
+#define WTF_CPU_PPC64 1
+#define WTF_CPU_BIG_ENDIAN 1
 #endif
 
-/* PLATFORM(SKIA) for Win/Linux, CG/CI for Mac */
-#if PLATFORM(CHROMIUM)
-#if PLATFORM(DARWIN)
-#define WTF_PLATFORM_CG 1
-#define WTF_PLATFORM_CI 1
-#define WTF_USE_ATSUI 1
-#else
-#define WTF_PLATFORM_SKIA 1
-#endif
+/* CPU(SH4) - SuperH SH-4 */
+#if defined(__SH4__)
+#define WTF_CPU_SH4 1
 #endif
 
-/* Makes PLATFORM(WIN) default to PLATFORM(CAIRO) */
-/* FIXME: This should be changed from a blacklist to a whitelist */
-#if !PLATFORM(MAC) && !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(CHROMIUM) && !PLATFORM(WINCE) && !PLATFORM(HAIKU)
-#define WTF_PLATFORM_CAIRO 1
+/* CPU(SPARC32) - SPARC 32-bit */
+#if defined(__sparc) && !defined(__arch64__) || defined(__sparcv8)
+#define WTF_CPU_SPARC32 1
+#define WTF_CPU_BIG_ENDIAN 1
 #endif
 
-/* CPU */
-
-/* PLATFORM(PPC) */
-#if   defined(__ppc__)     \
-   || defined(__PPC__)     \
-   || defined(__powerpc__) \
-   || defined(__powerpc)   \
-   || defined(__POWERPC__) \
-   || defined(_M_PPC)      \
-   || defined(__PPC)
-#define WTF_PLATFORM_PPC 1
-#define WTF_PLATFORM_BIG_ENDIAN 1
+/* CPU(SPARC64) - SPARC 64-bit */
+#if defined(__sparc__) && defined(__arch64__) || defined (__sparcv9)
+#define WTF_CPU_SPARC64 1
+#define WTF_CPU_BIG_ENDIAN 1
 #endif
 
-/* PLATFORM(SPARC32) */
-#if defined(__sparc) && !defined(__arch64__) || defined(__sparcv8)
-#define WTF_PLATFORM_SPARC32 1
-#define WTF_PLATFORM_BIG_ENDIAN 1
+/* CPU(SPARC) - any SPARC, true for CPU(SPARC32) and CPU(SPARC64) */
+#if CPU(SPARC32) || CPU(SPARC64)
+#define WTF_CPU_SPARC 1
 #endif
 
-#if PLATFORM(SPARC32) || PLATFORM(SPARC64)
-#define WTF_PLATFORM_SPARC
+/* CPU(X86) - i386 / x86 32-bit */
+#if   defined(__i386__) \
+    || defined(i386)     \
+    || defined(_M_IX86)  \
+    || defined(_X86_)    \
+    || defined(__THW_INTEL)
+#define WTF_CPU_X86 1
 #endif
 
-/* PLATFORM(PPC64) */
-#if   defined(__ppc64__) \
-   || defined(__PPC64__)
-#define WTF_PLATFORM_PPC64 1
-#define WTF_PLATFORM_BIG_ENDIAN 1
+/* CPU(X86_64) - AMD64 / Intel64 / x86_64 64-bit */
+#if   defined(__x86_64__) \
+    || defined(_M_X64)
+#define WTF_CPU_X86_64 1
 #endif
 
-/* PLATFORM(ARM) */
-#define PLATFORM_ARM_ARCH(N) (PLATFORM(ARM) && ARM_ARCH_VERSION >= N)
-
+/* CPU(ARM) - ARM, any version*/
 #if   defined(arm) \
-   || defined(__arm__)
-#define WTF_PLATFORM_ARM 1
+    || defined(__arm__)
+#define WTF_CPU_ARM 1
 
 #if defined(__ARMEB__)
-#define WTF_PLATFORM_BIG_ENDIAN 1
+#define WTF_CPU_BIG_ENDIAN 1
 
 #elif !defined(__ARM_EABI__) \
-   && !defined(__EABI__) \
-   && !defined(__VFP_FP__)
-#define WTF_PLATFORM_MIDDLE_ENDIAN 1
+    && !defined(__EABI__) \
+    && !defined(__VFP_FP__) \
+    && !defined(ANDROID)
+#define WTF_CPU_MIDDLE_ENDIAN 1
 
 #endif
 
-/* Set ARM_ARCH_VERSION */
+#define WTF_ARM_ARCH_AT_LEAST(N) (CPU(ARM) && WTF_ARM_ARCH_VERSION >= N)
+
+/* Set WTF_ARM_ARCH_VERSION */
 #if   defined(__ARM_ARCH_4__) \
-   || defined(__ARM_ARCH_4T__) \
-   || defined(__MARM_ARMV4__) \
-   || defined(_ARMV4I_)
-#define ARM_ARCH_VERSION 4
+    || defined(__ARM_ARCH_4T__) \
+    || defined(__MARM_ARMV4__) \
+    || defined(_ARMV4I_)
+#define WTF_ARM_ARCH_VERSION 4
 
 #elif defined(__ARM_ARCH_5__) \
-   || defined(__ARM_ARCH_5T__) \
-   || defined(__ARM_ARCH_5E__) \
-   || defined(__ARM_ARCH_5TE__) \
-   || defined(__ARM_ARCH_5TEJ__) \
-   || defined(__MARM_ARMV5__)
-#define ARM_ARCH_VERSION 5
+    || defined(__ARM_ARCH_5T__) \
+    || defined(__ARM_ARCH_5E__) \
+    || defined(__ARM_ARCH_5TE__) \
+    || defined(__ARM_ARCH_5TEJ__) \
+    || defined(__MARM_ARMV5__)
+#define WTF_ARM_ARCH_VERSION 5
 
 #elif defined(__ARM_ARCH_6__) \
-   || defined(__ARM_ARCH_6J__) \
-   || defined(__ARM_ARCH_6K__) \
-   || defined(__ARM_ARCH_6Z__) \
-   || defined(__ARM_ARCH_6ZK__) \
-   || defined(__ARM_ARCH_6T2__) \
-   || defined(__ARMV6__)
-#define ARM_ARCH_VERSION 6
+    || defined(__ARM_ARCH_6J__) \
+    || defined(__ARM_ARCH_6K__) \
+    || defined(__ARM_ARCH_6Z__) \
+    || defined(__ARM_ARCH_6ZK__) \
+    || defined(__ARM_ARCH_6T2__) \
+    || defined(__ARMV6__)
+#define WTF_ARM_ARCH_VERSION 6
 
 #elif defined(__ARM_ARCH_7A__) \
-   || defined(__ARM_ARCH_7R__)
-#define ARM_ARCH_VERSION 7
+    || defined(__ARM_ARCH_7R__)
+#define WTF_ARM_ARCH_VERSION 7
 
 /* RVCT sets _TARGET_ARCH_ARM */
 #elif defined(__TARGET_ARCH_ARM)
-#define ARM_ARCH_VERSION __TARGET_ARCH_ARM
+#define WTF_ARM_ARCH_VERSION __TARGET_ARCH_ARM
 
 #else
-#define ARM_ARCH_VERSION 0
+#define WTF_ARM_ARCH_VERSION 0
 
 #endif
 
-/* Set THUMB_ARM_VERSION */
+/* Set WTF_THUMB_ARCH_VERSION */
 #if   defined(__ARM_ARCH_4T__)
-#define THUMB_ARCH_VERSION 1
+#define WTF_THUMB_ARCH_VERSION 1
 
 #elif defined(__ARM_ARCH_5T__) \
-   || defined(__ARM_ARCH_5TE__) \
-   || defined(__ARM_ARCH_5TEJ__)
-#define THUMB_ARCH_VERSION 2
+    || defined(__ARM_ARCH_5TE__) \
+    || defined(__ARM_ARCH_5TEJ__)
+#define WTF_THUMB_ARCH_VERSION 2
 
 #elif defined(__ARM_ARCH_6J__) \
-   || defined(__ARM_ARCH_6K__) \
-   || defined(__ARM_ARCH_6Z__) \
-   || defined(__ARM_ARCH_6ZK__) \
-   || defined(__ARM_ARCH_6M__)
-#define THUMB_ARCH_VERSION 3
+    || defined(__ARM_ARCH_6K__) \
+    || defined(__ARM_ARCH_6Z__) \
+    || defined(__ARM_ARCH_6ZK__) \
+    || defined(__ARM_ARCH_6M__)
+#define WTF_THUMB_ARCH_VERSION 3
 
 #elif defined(__ARM_ARCH_6T2__) \
-   || defined(__ARM_ARCH_7__) \
-   || defined(__ARM_ARCH_7A__) \
-   || defined(__ARM_ARCH_7R__) \
-   || defined(__ARM_ARCH_7M__)
-#define THUMB_ARCH_VERSION 4
+    || defined(__ARM_ARCH_7__) \
+    || defined(__ARM_ARCH_7A__) \
+    || defined(__ARM_ARCH_7R__) \
+    || defined(__ARM_ARCH_7M__)
+#define WTF_THUMB_ARCH_VERSION 4
 
 /* RVCT sets __TARGET_ARCH_THUMB */
 #elif defined(__TARGET_ARCH_THUMB)
-#define THUMB_ARCH_VERSION __TARGET_ARCH_THUMB
+#define WTF_THUMB_ARCH_VERSION __TARGET_ARCH_THUMB
 
 #else
-#define THUMB_ARCH_VERSION 0
+#define WTF_THUMB_ARCH_VERSION 0
 #endif
 
-/* On ARMv5 and below the natural alignment is required. */
-#if !defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_ARCH_VERSION <= 5
-#define ARM_REQUIRE_NATURAL_ALIGNMENT 1
+
+/* CPU(ARMV5_OR_LOWER) - ARM instruction set v5 or earlier */
+/* On ARMv5 and below the natural alignment is required. 
+   And there are some other differences for v5 or earlier. */
+#if !defined(ARMV5_OR_LOWER) && !WTF_ARM_ARCH_AT_LEAST(6)
+#define WTF_CPU_ARMV5_OR_LOWER 1
 #endif
 
-/* Defines two pseudo-platforms for ARM and Thumb-2 instruction set. */
-#if !defined(WTF_PLATFORM_ARM_TRADITIONAL) && !defined(WTF_PLATFORM_ARM_THUMB2)
+
+/* CPU(ARM_TRADITIONAL) - Thumb2 is not available, only traditional ARM (v4 or greater) */
+/* CPU(ARM_THUMB2) - Thumb2 instruction set is available */
+/* Only one of these will be defined. */
+#if !defined(WTF_CPU_ARM_TRADITIONAL) && !defined(WTF_CPU_ARM_THUMB2)
 #  if defined(thumb2) || defined(__thumb2__) \
-  || ((defined(__thumb) || defined(__thumb__)) && THUMB_ARCH_VERSION == 4)
-#    define WTF_PLATFORM_ARM_TRADITIONAL 0
-#    define WTF_PLATFORM_ARM_THUMB2 1
-#  elif PLATFORM_ARM_ARCH(4)
-#    define WTF_PLATFORM_ARM_TRADITIONAL 1
-#    define WTF_PLATFORM_ARM_THUMB2 0
+    || ((defined(__thumb) || defined(__thumb__)) && WTF_THUMB_ARCH_VERSION == 4)
+#    define WTF_CPU_ARM_TRADITIONAL 0
+#    define WTF_CPU_ARM_THUMB2 1
+#  elif WTF_ARM_ARCH_AT_LEAST(4)
+#    define WTF_CPU_ARM_TRADITIONAL 1
+#    define WTF_CPU_ARM_THUMB2 0
 #  else
 #    error "Not supported ARM architecture"
 #  endif
-#elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(ARM_THUMB2) /* Sanity Check */
-#  error "Cannot use both of WTF_PLATFORM_ARM_TRADITIONAL and WTF_PLATFORM_ARM_THUMB2 platforms"
-#endif // !defined(ARM_TRADITIONAL) && !defined(ARM_THUMB2)
+#elif CPU(ARM_TRADITIONAL) && CPU(ARM_THUMB2) /* Sanity Check */
+#  error "Cannot use both of WTF_CPU_ARM_TRADITIONAL and WTF_CPU_ARM_THUMB2 platforms"
+#endif /* !defined(WTF_CPU_ARM_TRADITIONAL) && !defined(WTF_CPU_ARM_THUMB2) */
+
 #endif /* ARM */
 
-/* PLATFORM(X86) */
-#if   defined(__i386__) \
-   || defined(i386)     \
-   || defined(_M_IX86)  \
-   || defined(_X86_)    \
-   || defined(__THW_INTEL)
-#define WTF_PLATFORM_X86 1
+
+
+/* ==== OS() - underlying operating system; only to be used for mandated low-level services like 
+   virtual memory, not to choose a GUI toolkit ==== */
+
+/* OS(ANDROID) - Android */
+#ifdef ANDROID
+#define WTF_OS_ANDROID 1
 #endif
 
-/* PLATFORM(X86_64) */
-#if   defined(__x86_64__) \
-   || defined(_M_X64)
-#define WTF_PLATFORM_X86_64 1
+/* OS(AIX) - AIX */
+#ifdef _AIX
+#define WTF_OS_AIX 1
 #endif
 
-/* PLATFORM(IA64) */
-#if defined(__ia64__)
-#define WTF_PLATFORM_IA64 1
+/* OS(DARWIN) - Any Darwin-based OS, including Mac OS X and iPhone OS */
+#ifdef __APPLE__
+#define WTF_OS_DARWIN 1
+
+/* FIXME: BUILDING_ON_.., and TARGETING... macros should be folded into the OS() system */
+#include <AvailabilityMacros.h>
+#if !defined(MAC_OS_X_VERSION_10_5) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_5
+#define BUILDING_ON_TIGER 1
+#elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_6
+#define BUILDING_ON_LEOPARD 1
+#elif !defined(MAC_OS_X_VERSION_10_7) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7
+#define BUILDING_ON_SNOW_LEOPARD 1
+#endif
+#if !defined(MAC_OS_X_VERSION_10_5) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_5
+#define TARGETING_TIGER 1
+#elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_6
+#define TARGETING_LEOPARD 1
+#elif !defined(MAC_OS_X_VERSION_10_7) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_7
+#define TARGETING_SNOW_LEOPARD 1
 #endif
+#include <TargetConditionals.h>
 
-/* PLATFORM(ALPHA) */
-#if defined(__alpha__)
-#define WTF_PLATFORM_ALPHA 1
 #endif
 
-/* PLATFORM(SH4) */
-#if defined(__SH4__)
-#define WTF_PLATFORM_SH4 1
+/* OS(IPHONE_OS) - iPhone OS */
+/* OS(MAC_OS_X) - Mac OS X (not including iPhone OS) */
+#if OS(DARWIN) && ((defined(TARGET_OS_EMBEDDED) && TARGET_OS_EMBEDDED)  \
+    || (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)                   \
+    || (defined(TARGET_IPHONE_SIMULATOR) && TARGET_IPHONE_SIMULATOR))
+#define WTF_OS_IPHONE_OS 1
+#elif OS(DARWIN) && defined(TARGET_OS_MAC) && TARGET_OS_MAC
+#define WTF_OS_MAC_OS_X 1
 #endif
 
-/* PLATFORM(SPARC64) */
-#if defined(__sparc__) && defined(__arch64__) || defined (__sparcv9)
-#define WTF_PLATFORM_SPARC64 1
-#define WTF_PLATFORM_BIG_ENDIAN 1
+/* OS(FREEBSD) - FreeBSD */
+#ifdef __FreeBSD__
+#define WTF_OS_FREEBSD 1
 #endif
 
-/* PLATFORM(WINCE) && PLATFORM(QT)
-   We can not determine the endianess at compile time. For
-   Qt for Windows CE the endianess is specified in the
-   device specific makespec
-*/
-#if PLATFORM(WINCE) && PLATFORM(QT)
-#   include <QtGlobal>
-#   undef WTF_PLATFORM_BIG_ENDIAN
-#   undef WTF_PLATFORM_MIDDLE_ENDIAN
-#   if Q_BYTE_ORDER == Q_BIG_EDIAN
-#       define WTF_PLATFORM_BIG_ENDIAN 1
-#   endif
+/* OS(HAIKU) - Haiku */
+#ifdef __HAIKU__
+#define WTF_OS_HAIKU 1
+#endif
 
-#   include <ce_time.h>
+/* OS(LINUX) - Linux */
+#ifdef __linux__
+#define WTF_OS_LINUX 1
 #endif
 
-#if PLATFORM(WINCE) && PLATFORM(QT)
-#   include <ce_time.h>
+/* OS(NETBSD) - NetBSD */
+#if defined(__NetBSD__)
+#define WTF_PLATFORM_NETBSD 1
 #endif
 
-/* Compiler */
+/* OS(OPENBSD) - OpenBSD */
+#ifdef __OpenBSD__
+#define WTF_OS_OPENBSD 1
+#endif
 
-/* COMPILER(MSVC) */
-#if defined(_MSC_VER)
-#define WTF_COMPILER_MSVC 1
-#if _MSC_VER < 1400
-#define WTF_COMPILER_MSVC7 1
+/* OS(QNX) - QNX */
+#if defined(__QNXNTO__)
+#define WTF_OS_QNX 1
 #endif
+
+/* OS(SOLARIS) - Solaris */
+#if defined(sun) || defined(__sun)
+#define WTF_OS_SOLARIS 1
 #endif
 
-/* COMPILER(RVCT) */
-#if defined(__CC_ARM) || defined(__ARMCC__)
-#define WTF_COMPILER_RVCT 1
+/* OS(WINCE) - Windows CE; note that for this platform OS(WINDOWS) is also defined */
+#if defined(_WIN32_WCE)
+#define WTF_OS_WINCE 1
 #endif
 
-/* COMPILER(GCC) */
-/* --gnu option of the RVCT compiler also defines __GNUC__ */
-#if defined(__GNUC__) && !COMPILER(RVCT)
-#define WTF_COMPILER_GCC 1
-#define GCC_VERSION (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
+/* OS(WINDOWS) - Any version of Windows */
+#if defined(WIN32) || defined(_WIN32)
+#define WTF_OS_WINDOWS 1
 #endif
 
-/* COMPILER(MINGW) */
-#if defined(MINGW) || defined(__MINGW32__)
-#define WTF_COMPILER_MINGW 1
+/* OS(SYMBIAN) - Symbian */
+#if defined (__SYMBIAN32__)
+#define WTF_OS_SYMBIAN 1
+#endif
+
+/* OS(UNIX) - Any Unix-like system */
+#if   OS(AIX)              \
+    || OS(ANDROID)          \
+    || OS(DARWIN)           \
+    || OS(FREEBSD)          \
+    || OS(HAIKU)            \
+    || OS(LINUX)            \
+    || OS(NETBSD)           \
+    || OS(OPENBSD)          \
+    || OS(QNX)              \
+    || OS(SOLARIS)          \
+    || OS(SYMBIAN)          \
+    || defined(unix)        \
+    || defined(__unix)      \
+    || defined(__unix__)
+#define WTF_OS_UNIX 1
 #endif
 
-/* COMPILER(BORLAND) */
-/* not really fully supported - is this relevant any more? */
-#if defined(__BORLANDC__)
-#define WTF_COMPILER_BORLAND 1
+/* Operating environments */
+
+/* FIXME: these are all mixes of OS, operating environment and policy choices. */
+/* PLATFORM(CHROMIUM) */
+/* PLATFORM(QT) */
+/* PLATFORM(WX) */
+/* PLATFORM(GTK) */
+/* PLATFORM(HAIKU) */
+/* PLATFORM(MAC) */
+/* PLATFORM(WIN) */
+#if defined(BUILDING_CHROMIUM__)
+#define WTF_PLATFORM_CHROMIUM 1
+#elif defined(BUILDING_QT__)
+#define WTF_PLATFORM_QT 1
+#elif defined(BUILDING_WX__)
+#define WTF_PLATFORM_WX 1
+#elif defined(BUILDING_GTK__)
+#define WTF_PLATFORM_GTK 1
+#elif defined(BUILDING_HAIKU__)
+#define WTF_PLATFORM_HAIKU 1
+#elif defined(BUILDING_BREWMP__)
+#define WTF_PLATFORM_BREWMP 1
+#if defined(AEE_SIMULATOR)
+#define WTF_PLATFORM_BREWMP_SIMULATOR 1
+#else
+#define WTF_PLATFORM_BREWMP_SIMULATOR 0
+#endif
+#undef WTF_OS_WINDOWS
+#undef WTF_PLATFORM_WIN
+#elif OS(DARWIN)
+#define WTF_PLATFORM_MAC 1
+#elif OS(WINDOWS)
+#define WTF_PLATFORM_WIN 1
 #endif
 
-/* COMPILER(CYGWIN) */
-/* not really fully supported - is this relevant any more? */
-#if defined(__CYGWIN__)
-#define WTF_COMPILER_CYGWIN 1
+/* PLATFORM(IPHONE) */
+/* FIXME: this is sometimes used as an OS switch and sometimes for higher-level things */
+#if (defined(TARGET_OS_EMBEDDED) && TARGET_OS_EMBEDDED) || (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)
+#define WTF_PLATFORM_IPHONE 1
 #endif
 
-/* COMPILER(WINSCW) */
-#if defined(__WINSCW__)
-#define WTF_COMPILER_WINSCW 1
+/* PLATFORM(IPHONE_SIMULATOR) */
+#if defined(TARGET_IPHONE_SIMULATOR) && TARGET_IPHONE_SIMULATOR
+#define WTF_PLATFORM_IPHONE 1
+#define WTF_PLATFORM_IPHONE_SIMULATOR 1
+#else
+#define WTF_PLATFORM_IPHONE_SIMULATOR 0
 #endif
 
-#if (PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN)) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
+#if !defined(WTF_PLATFORM_IPHONE)
+#define WTF_PLATFORM_IPHONE 0
+#endif
+
+/* PLATFORM(ANDROID) */
+/* FIXME: this is sometimes used as an OS() switch, and other times to drive
+   policy choices */
+#if defined(ANDROID)
+#define WTF_PLATFORM_ANDROID 1
+#endif
+
+/* Graphics engines */
+
+/* PLATFORM(CG) and PLATFORM(CI) */
+#if PLATFORM(MAC) || PLATFORM(IPHONE)
+#define WTF_PLATFORM_CG 1
+#endif
+#if PLATFORM(MAC) && !PLATFORM(IPHONE)
+#define WTF_PLATFORM_CI 1
+#endif
+
+/* PLATFORM(SKIA) for Win/Linux, CG/CI for Mac */
+#if PLATFORM(CHROMIUM)
+#define ENABLE_HISTORY_ALWAYS_ASYNC 1
+#if OS(DARWIN)
+#define WTF_PLATFORM_CG 1
+#define WTF_PLATFORM_CI 1
+#define WTF_USE_ATSUI 1
+#define WTF_USE_CORE_TEXT 1
+#else
+#define WTF_PLATFORM_SKIA 1
+#endif
+#endif
+
+#if PLATFORM(GTK)
+#define WTF_PLATFORM_CAIRO 1
+#endif
+
+
+/* OS(WINCE) && PLATFORM(QT)
+   We can not determine the endianess at compile time. For
+   Qt for Windows CE the endianess is specified in the
+   device specific makespec
+*/
+#if OS(WINCE) && PLATFORM(QT)
+#   include <QtGlobal>
+#   undef WTF_CPU_BIG_ENDIAN
+#   undef WTF_CPU_MIDDLE_ENDIAN
+#   if Q_BYTE_ORDER == Q_BIG_ENDIAN
+#       define WTF_CPU_BIG_ENDIAN 1
+#   endif
+
+#   include <ce_time.h>
+#endif
+
+#if (PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN) || (PLATFORM(QT) && OS(DARWIN) && !ENABLE(SINGLE_THREADED))) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
 #define ENABLE_JSC_MULTIPLE_THREADS 1
 #endif
 
 /* On Windows, use QueryPerformanceCounter by default */
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #define WTF_USE_QUERY_PERFORMANCE_COUNTER  1
 #endif
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if OS(WINCE) && !PLATFORM(QT)
 #undef ENABLE_JSC_MULTIPLE_THREADS
 #define ENABLE_JSC_MULTIPLE_THREADS        0
 #define USE_SYSTEM_MALLOC                  0
@@ -462,26 +540,28 @@
 #define ENABLE_WML                         1
 #define HAVE_ACCESSIBILITY                 0
 
-#define NOMINMAX       // Windows min and max conflict with standard macros
-#define NOSHLWAPI      // shlwapi.h not available on WinCe
+#define NOMINMAX       /* Windows min and max conflict with standard macros */
+#define NOSHLWAPI      /* shlwapi.h not available on WinCe */
 
-// MSDN documentation says these functions are provided with uspce.lib.  But we cannot find this file.
-#define __usp10__      // disable "usp10.h"
+/* MSDN documentation says these functions are provided with uspce.lib.  But we cannot find this file. */
+#define __usp10__      /* disable "usp10.h" */
 
-#define _INC_ASSERT    // disable "assert.h"
+#define _INC_ASSERT    /* disable "assert.h" */
 #define assert(x)
 
-// _countof is only included in CE6; for CE5 we need to define it ourself
+/* _countof is only included in CE6; for CE5 we need to define it ourself */
 #ifndef _countof
 #define _countof(x) (sizeof(x) / sizeof((x)[0]))
 #endif
 
-#endif  /* PLATFORM(WINCE) && !PLATFORM(QT) */
+#endif  /* OS(WINCE) && !PLATFORM(QT) */
 
-/* for Unicode, KDE uses Qt */
-#if PLATFORM(KDE) || PLATFORM(QT)
+#if PLATFORM(QT)
 #define WTF_USE_QT4_UNICODE 1
-#elif PLATFORM(WINCE)
+#if !defined(ENABLE_WIDGETS_10_SUPPORT)
+#define ENABLE_WIDGETS_10_SUPPORT 1
+#endif
+#elif OS(WINCE)
 #define WTF_USE_WINCE_UNICODE 1
 #elif PLATFORM(GTK)
 /* The GTK+ Unicode backend is configurable */
@@ -493,7 +573,7 @@
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
 #define HAVE_PTHREAD_RWLOCK 1
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER) && defined(__x86_64__)
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER) && CPU(X86_64)
 #define WTF_USE_PLUGIN_HOST_PROCESS 1
 #endif
 #if !defined(ENABLE_MAC_JAVA_BRIDGE)
@@ -506,10 +586,19 @@
 #define HAVE_RUNLOOP_TIMER 1
 #endif /* PLATFORM(MAC) && !PLATFORM(IPHONE) */
 
-#if PLATFORM(CHROMIUM) && PLATFORM(DARWIN)
+#if PLATFORM(MAC)
+#define WTF_USE_CARBON_SECURE_INPUT_MODE 1
+#endif
+
+#if PLATFORM(CHROMIUM) && OS(DARWIN)
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
 #define HAVE_PTHREAD_RWLOCK 1
+#define WTF_USE_CARBON_SECURE_INPUT_MODE 1
+#endif
+
+#if PLATFORM(QT) && OS(DARWIN)
+#define WTF_PLATFORM_CF 1
 #endif
 
 #if PLATFORM(IPHONE)
@@ -529,12 +618,28 @@
 #define HAVE_PTHREAD_RWLOCK 1
 #endif
 
+#if PLATFORM(ANDROID)
+#define WTF_USE_PTHREADS 1
+#define WTF_PLATFORM_SGL 1
+#define USE_SYSTEM_MALLOC 1
+#define ENABLE_MAC_JAVA_BRIDGE 1
+#define LOG_DISABLED 1
+/* Prevents Webkit from drawing the caret in textfields and textareas
+   This prevents unnecessary invals. */
+#define ENABLE_TEXT_CARET 1
+#define ENABLE_JAVASCRIPT_DEBUGGER 0
+#endif
+
 #if PLATFORM(WIN)
 #define WTF_USE_WININET 1
 #endif
 
 #if PLATFORM(WX)
 #define ENABLE_ASSEMBLER 1
+#define ENABLE_GLOBAL_FASTMALLOC_NEW 0
+#if OS(DARWIN)
+#define WTF_PLATFORM_CF 1
+#endif
 #endif
 
 #if PLATFORM(GTK)
@@ -553,24 +658,29 @@
 #define ENABLE_NETSCAPE_PLUGIN_API 0
 #endif
 
+#if PLATFORM(BREWMP)
+#define USE_SYSTEM_MALLOC 1
+#endif
+
 #if !defined(HAVE_ACCESSIBILITY)
 #if PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN) || PLATFORM(GTK) || PLATFORM(CHROMIUM)
 #define HAVE_ACCESSIBILITY 1
 #endif
 #endif /* !defined(HAVE_ACCESSIBILITY) */
 
-#if PLATFORM(UNIX) && !PLATFORM(SYMBIAN)
+#if OS(UNIX) && !OS(SYMBIAN)
 #define HAVE_SIGNAL_H 1
 #endif
 
-#if !PLATFORM(WIN_OS) && !PLATFORM(SOLARIS) && !PLATFORM(QNX) \
-    && !PLATFORM(SYMBIAN) && !PLATFORM(HAIKU) && !COMPILER(RVCT)
+#if !OS(WINDOWS) && !OS(SOLARIS) && !OS(QNX) \
+    && !OS(SYMBIAN) && !OS(HAIKU) && !OS(RVCT) \
+    && !OS(ANDROID) && !PLATFORM(BREWMP)
 #define HAVE_TM_GMTOFF 1
 #define HAVE_TM_ZONE 1
 #define HAVE_TIMEGM 1
-#endif     
+#endif
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
 #define HAVE_ERRNO_H 1
 #define HAVE_LANGINFO_H 1
@@ -582,27 +692,32 @@
 #define HAVE_SYS_TIME_H 1
 #define HAVE_SYS_TIMEB_H 1
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE) && !PLATFORM(QT)
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
+#define HAVE_DISPATCH_H 1
+
+#if !PLATFORM(IPHONE) && !PLATFORM(QT)
 #define HAVE_MADV_FREE_REUSE 1
 #define HAVE_MADV_FREE 1
 #define HAVE_PTHREAD_SETNAME_NP 1
 #endif
 
+#endif
+
 #if PLATFORM(IPHONE)
 #define HAVE_MADV_FREE 1
 #endif
 
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 
-#define HAVE_FLOAT_H 1
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 #define HAVE_ERRNO_H 0
 #else
 #define HAVE_SYS_TIMEB_H 1
 #endif
 #define HAVE_VIRTUALALLOC 1
 
-#elif PLATFORM(SYMBIAN)
+#elif OS(SYMBIAN)
 
 #define HAVE_ERRNO_H 1
 #define HAVE_MMAP 0
@@ -615,7 +730,11 @@
 #define HAVE_SYS_PARAM_H 1
 #endif
 
-#elif PLATFORM(QNX)
+#elif PLATFORM(BREWMP)
+
+#define HAVE_ERRNO_H 1
+
+#elif OS(QNX)
 
 #define HAVE_ERRNO_H 1
 #define HAVE_MMAP 1
@@ -624,13 +743,23 @@
 #define HAVE_SYS_PARAM_H 1
 #define HAVE_SYS_TIME_H 1
 
+#elif OS(ANDROID)
+
+#define HAVE_ERRNO_H 1
+#define HAVE_LANGINFO_H 0
+#define HAVE_MMAP 1
+#define HAVE_SBRK 1
+#define HAVE_STRINGS_H 1
+#define HAVE_SYS_PARAM_H 1
+#define HAVE_SYS_TIME_H 1
+
 #else
 
 /* FIXME: is this actually used or do other platforms generate their own config.h? */
 
 #define HAVE_ERRNO_H 1
 /* As long as Haiku doesn't have a complete support of locale this will be disabled. */
-#if !PLATFORM(HAIKU)
+#if !OS(HAIKU)
 #define HAVE_LANGINFO_H 1
 #endif
 #define HAVE_MMAP 1
@@ -643,6 +772,11 @@
 
 /* ENABLE macro defaults */
 
+#if PLATFORM(QT)
+// We musn't customize the global operator new and delete for the Qt port.
+#define ENABLE_GLOBAL_FASTMALLOC_NEW 0
+#endif
+
 /* fastMalloc match validation allows for runtime verification that
    new is matched by delete, fastMalloc is matched by fastFree, etc. */
 #if !defined(ENABLE_FAST_MALLOC_MATCH_VALIDATION)
@@ -677,6 +811,10 @@
 #define ENABLE_DASHBOARD_SUPPORT 0
 #endif
 
+#if !defined(ENABLE_WIDGETS_10_SUPPORT)
+#define ENABLE_WIDGETS_10_SUPPORT 0
+#endif
+
 #if !defined(ENABLE_INSPECTOR)
 #define ENABLE_INSPECTOR 1
 #endif
@@ -701,6 +839,10 @@
 #define ENABLE_OPCODE_STATS 0
 #endif
 
+#if !defined(ENABLE_GLOBAL_FASTMALLOC_NEW)
+#define ENABLE_GLOBAL_FASTMALLOC_NEW 1
+#endif
+
 #define ENABLE_SAMPLING_COUNTERS 0
 #define ENABLE_SAMPLING_FLAGS 0
 #define ENABLE_OPCODE_SAMPLING 0
@@ -729,11 +871,14 @@
 #endif
 
 #if !defined(WTF_USE_JSVALUE64) && !defined(WTF_USE_JSVALUE32) && !defined(WTF_USE_JSVALUE32_64)
-#if (PLATFORM(X86_64) && (PLATFORM(UNIX) || PLATFORM(WIN_OS))) || PLATFORM(IA64) || PLATFORM(ALPHA)
+#if (CPU(X86_64) && (OS(UNIX) || OS(WINDOWS))) \
+    || (CPU(IA64) && !CPU(IA64_32)) \
+    || CPU(ALPHA) \
+    || CPU(SPARC64)
 #define WTF_USE_JSVALUE64 1
-#elif PLATFORM(ARM) || PLATFORM(PPC64)
+#elif CPU(ARM) || CPU(PPC64) || CPU(MIPS)
 #define WTF_USE_JSVALUE32 1
-#elif PLATFORM(WIN_OS) && COMPILER(MINGW)
+#elif OS(WINDOWS) && COMPILER(MINGW)
 /* Using JSVALUE32_64 causes padding/alignement issues for JITStubArg
 on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #define WTF_USE_JSVALUE32 1
@@ -749,40 +894,53 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #if !defined(ENABLE_JIT)
 
 /* The JIT is tested & working on x86_64 Mac */
-#if PLATFORM(X86_64) && PLATFORM(MAC)
+#if CPU(X86_64) && PLATFORM(MAC)
     #define ENABLE_JIT 1
 /* The JIT is tested & working on x86 Mac */
-#elif PLATFORM(X86) && PLATFORM(MAC)
+#elif CPU(X86) && PLATFORM(MAC)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-#elif PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)
+#elif CPU(ARM_THUMB2) && PLATFORM(IPHONE)
+    #define ENABLE_JIT 1
+/* The JIT is tested & working on Android */
+#elif CPU(ARM_THUMB2) && PLATFORM(ANDROID) && ENABLE(ANDROID_JSC_JIT)
     #define ENABLE_JIT 1
-    #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
 /* The JIT is tested & working on x86 Windows */
-#elif PLATFORM(X86) && PLATFORM(WIN)
+#elif CPU(X86) && PLATFORM(WIN)
     #define ENABLE_JIT 1
 #endif
 
-#if PLATFORM(QT)
-#if PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100
+#if PLATFORM(QT) || PLATFORM(WX)
+#if CPU(X86_64) && OS(DARWIN)
+    #define ENABLE_JIT 1
+#elif CPU(X86) && OS(DARWIN)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-#elif PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MSVC)
+#elif CPU(X86) && OS(WINDOWS) && COMPILER(MINGW) && GCC_VERSION >= 40100
+    #define ENABLE_JIT 1
+    #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
+#elif CPU(X86) && OS(WINDOWS) && COMPILER(MSVC)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_REGISTER 1
-#elif PLATFORM(X86) && PLATFORM(LINUX) && GCC_VERSION >= 40100
+#elif CPU(X86) && OS(LINUX) && GCC_VERSION >= 40100
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-#elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX)
+#elif CPU(X86_64) && OS(LINUX) && GCC_VERSION >= 40100
+    #define ENABLE_JIT 1
+#elif CPU(ARM_TRADITIONAL) && OS(LINUX)
     #define ENABLE_JIT 1
-    #if PLATFORM(ARM_THUMB2)
-        #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
-    #endif
 #endif
 #endif /* PLATFORM(QT) */
 
 #endif /* !defined(ENABLE_JIT) */
 
+/* CPU architecture specific optimizations */
+#if CPU(ARM_TRADITIONAL)
+#if ENABLE(JIT) && !defined(ENABLE_JIT_OPTIMIZE_MOD) && WTF_ARM_ARCH_AT_LEAST(5)
+#define ENABLE_JIT_OPTIMIZE_MOD 1
+#endif
+#endif
+
 #if ENABLE(JIT)
 #ifndef ENABLE_JIT_OPTIMIZE_CALL
 #define ENABLE_JIT_OPTIMIZE_CALL 1
@@ -796,11 +954,14 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #ifndef ENABLE_JIT_OPTIMIZE_METHOD_CALLS
 #define ENABLE_JIT_OPTIMIZE_METHOD_CALLS 1
 #endif
+#ifndef ENABLE_JIT_OPTIMIZE_MOD
+#define ENABLE_JIT_OPTIMIZE_MOD 0
+#endif
 #endif
 
-#if PLATFORM(X86) && COMPILER(MSVC)
+#if CPU(X86) && COMPILER(MSVC)
 #define JSC_HOST_CALL __fastcall
-#elif PLATFORM(X86) && COMPILER(GCC)
+#elif CPU(X86) && COMPILER(GCC)
 #define JSC_HOST_CALL __attribute__ ((fastcall))
 #else
 #define JSC_HOST_CALL
@@ -820,19 +981,23 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #if !defined(ENABLE_YARR_JIT)
 
 /* YARR supports x86 & x86-64, and has been tested on Mac and Windows. */
-#if (PLATFORM(X86) && PLATFORM(MAC)) \
- || (PLATFORM(X86_64) && PLATFORM(MAC)) \
- || (PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)) \
- || (PLATFORM(X86) && PLATFORM(WIN))
+#if (CPU(X86) && PLATFORM(MAC)) \
+    || (CPU(X86_64) && PLATFORM(MAC)) \
+    || (CPU(ARM_THUMB2) && PLATFORM(IPHONE)) \
+    || (CPU(ARM_THUMB2) && PLATFORM(ANDROID) && ENABLE(ANDROID_JSC_JIT)) \
+    || (CPU(X86) && PLATFORM(WIN)) \
+    || (CPU(X86) && PLATFORM(WX))
 #define ENABLE_YARR 1
 #define ENABLE_YARR_JIT 1
 #endif
 
 #if PLATFORM(QT)
-#if (PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100) \
- || (PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MSVC)) \
- || (PLATFORM(X86) && PLATFORM(LINUX) && GCC_VERSION >= 40100) \
- || (PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX))
+#if (CPU(X86) && OS(WINDOWS) && COMPILER(MINGW) && GCC_VERSION >= 40100) \
+    || (CPU(X86) && OS(WINDOWS) && COMPILER(MSVC)) \
+    || (CPU(X86) && OS(LINUX) && GCC_VERSION >= 40100) \
+    || (CPU(X86_64) && OS(LINUX) && GCC_VERSION >= 40100) \
+    || (CPU(ARM_TRADITIONAL) && OS(LINUX)) \
+    || (CPU(MIPS) && OS(LINUX))
 #define ENABLE_YARR 1
 #define ENABLE_YARR_JIT 1
 #endif
@@ -856,7 +1021,7 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #define ENABLE_ASSEMBLER_WX_EXCLUSIVE 0
 #endif
 
-#if !defined(ENABLE_PAN_SCROLLING) && PLATFORM(WIN_OS)
+#if !defined(ENABLE_PAN_SCROLLING) && OS(WINDOWS)
 #define ENABLE_PAN_SCROLLING 1
 #endif
 
@@ -882,17 +1047,30 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #define WTF_USE_ACCELERATED_COMPOSITING 1
 #endif
 
+/* FIXME: Defining ENABLE_3D_RENDERING here isn't really right, but it's always used with
+   with WTF_USE_ACCELERATED_COMPOSITING, and it allows the feature to be turned on and
+   off in one place. */
+#if PLATFORM(WIN)
+#include "QuartzCorePresent.h"
+#if QUARTZCORE_PRESENT
+#define WTF_USE_ACCELERATED_COMPOSITING 1
+#define ENABLE_3D_RENDERING 1
+#endif
+#endif
+
 #if COMPILER(GCC)
 #define WARN_UNUSED_RETURN __attribute__ ((warn_unused_result))
 #else
 #define WARN_UNUSED_RETURN
 #endif
 
-#if !ENABLE(NETSCAPE_PLUGIN_API) || (ENABLE(NETSCAPE_PLUGIN_API) && ((PLATFORM(UNIX) && (PLATFORM(QT) || PLATFORM(WX))) || PLATFORM(GTK)))
+#if !ENABLE(NETSCAPE_PLUGIN_API) || (ENABLE(NETSCAPE_PLUGIN_API) && ((OS(UNIX) && (PLATFORM(QT) || PLATFORM(WX))) || PLATFORM(GTK)))
 #define ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 1
 #endif
 
 /* Set up a define for a common error that is intended to cause a build error -- thus the space after Error. */
 #define WTF_PLATFORM_CFNETWORK Error USE_macro_should_be_used_with_CFNETWORK
 
+#define ENABLE_JSC_ZOMBIES 0
+
 #endif /* WTF_Platform_h */
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
index 52fb13084e..fc4826307a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
@@ -34,12 +34,18 @@
 #include <stdint.h>
 #include <stdlib.h>
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 extern "C" {
 #include "wince/mt19937ar.c"
 }
 #endif
 
+#if PLATFORM(BREWMP)
+#include <AEEAppGen.h>
+#include <AEESource.h>
+#include <AEEStdLib.h>
+#endif
+
 namespace WTF {
 
 double weakRandomNumber()
@@ -47,6 +53,10 @@ double weakRandomNumber()
 #if COMPILER(MSVC) && defined(_CRT_RAND_S)
     // rand_s is incredibly slow on windows so we fall back on rand for Math.random
     return (rand() + (rand() / (RAND_MAX + 1.0))) / (RAND_MAX + 1.0);
+#elif PLATFORM(BREWMP)
+    uint32_t bits;
+    GETRAND(reinterpret_cast<byte*>(&bits), sizeof(uint32_t));
+    return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
 #else
     return randomNumber();
 #endif
@@ -66,10 +76,10 @@ double randomNumber()
     uint32_t bits;
     rand_s(&bits);
     return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
-#elif PLATFORM(DARWIN)
+#elif OS(DARWIN)
     uint32_t bits = arc4random();
     return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
-#elif PLATFORM(UNIX)
+#elif OS(UNIX)
     uint32_t part1 = random() & (RAND_MAX - 1);
     uint32_t part2 = random() & (RAND_MAX - 1);
     // random only provides 31 bits
@@ -80,9 +90,9 @@ double randomNumber()
     // Mask off the low 53bits
     fullRandom &= (1LL << 53) - 1;
     return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
     return genrand_res53();
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
     uint32_t part1 = rand() & (RAND_MAX - 1);
     uint32_t part2 = rand() & (RAND_MAX - 1);
     uint32_t part3 = rand() & (RAND_MAX - 1);
@@ -99,6 +109,16 @@ double randomNumber()
     // Mask off the low 53bits
     fullRandom &= (1LL << 53) - 1;
     return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
+#elif PLATFORM(BREWMP)
+    uint32_t bits;
+    ISource* randomSource;
+
+    IShell* shell = reinterpret_cast<AEEApplet*>(GETAPPINSTANCE())->m_pIShell;
+    ISHELL_CreateInstance(shell, AEECLSID_RANDOM, reinterpret_cast<void**>(&randomSource));
+    ISOURCE_Read(randomSource, reinterpret_cast<char*>(&bits), 4);
+    ISOURCE_Release(randomSource);
+
+    return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
 #else
     uint32_t part1 = rand() & (RAND_MAX - 1);
     uint32_t part2 = rand() & (RAND_MAX - 1);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h
index a66433e61d..ae414c0e32 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h
@@ -33,12 +33,12 @@
 #include <sys/time.h>
 #endif
 
-#if PLATFORM(UNIX)
+#if OS(UNIX)
 #include <sys/types.h>
 #include <unistd.h>
 #endif
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 extern "C" {
 void init_by_array(unsigned long init_key[],int key_length);
 }
@@ -49,9 +49,9 @@ namespace WTF {
 
 inline void initializeRandomNumberGenerator()
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     // On Darwin we use arc4random which initialises itself.
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
     // initialize rand()
     srand(static_cast<unsigned>(time(0)));
 
@@ -64,7 +64,7 @@ inline void initializeRandomNumberGenerator()
     init_by_array(initializationBuffer, 4);
 #elif COMPILER(MSVC) && defined(_CRT_RAND_S)
     // On Windows we use rand_s which initialises itself
-#elif PLATFORM(UNIX)
+#elif OS(UNIX)
     // srandomdev is not guaranteed to exist on linux so we use this poor seed, this should be improved
     timeval time;
     gettimeofday(&time, 0);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
index 838871543b..84e841ce57 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
@@ -24,6 +24,7 @@
 #include <algorithm>
 #include "AlwaysInline.h"
 #include "FastAllocBase.h"
+#include "PassRefPtr.h"
 
 namespace WTF {
 
@@ -50,13 +51,13 @@ namespace WTF {
         RefPtr(HashTableDeletedValueType) : m_ptr(hashTableDeletedValue()) { }
         bool isHashTableDeletedValue() const { return m_ptr == hashTableDeletedValue(); }
 
-        ~RefPtr() { T* ptr = m_ptr; derefIfNotNull(ptr); }
+        ~RefPtr() { derefIfNotNull(m_ptr); }
         
-        template <typename U> RefPtr(const RefPtr<U>& o) : m_ptr(static_cast<T*>(o.get())) { if (T* ptr = static_cast<T*>(m_ptr)) ptr->ref(); }
+        template <typename U> RefPtr(const RefPtr<U>& o) : m_ptr(o.get()) { T* ptr = m_ptr; refIfNotNull(ptr); }
         
         T* get() const { return m_ptr; }
         
-        void clear() { T* ptr = m_ptr; derefIfNotNull(ptr); m_ptr = 0; }
+        void clear() { derefIfNotNull(m_ptr); m_ptr = 0; }
         PassRefPtr<T> release() { PassRefPtr<T> tmp = adoptRef(m_ptr); m_ptr = 0; return tmp; }
 
         T& operator*() const { return *m_ptr; }
@@ -65,12 +66,8 @@ namespace WTF {
         bool operator!() const { return !m_ptr; }
     
         // This conversion operator allows implicit conversion to bool but not to other integer types.
-#if COMPILER(WINSCW)
-        operator bool() const { return m_ptr; }
-#else
-        typedef T* RefPtr::*UnspecifiedBoolType;
+        typedef T* (RefPtr::*UnspecifiedBoolType);
         operator UnspecifiedBoolType() const { return m_ptr ? &RefPtr::m_ptr : 0; }
-#endif
         
         RefPtr& operator=(const RefPtr&);
         RefPtr& operator=(T*);
@@ -139,8 +136,7 @@ namespace WTF {
     {
         T* ptr = m_ptr;
         m_ptr = o.releaseRef();
-        if (ptr)
-            ptr->deref();
+        derefIfNotNull(ptr);
         return *this;
     }
 
@@ -156,8 +152,7 @@ namespace WTF {
     {
         T* ptr = m_ptr;
         m_ptr = o.releaseRef();
-        if (ptr)
-            ptr->deref();
+        derefIfNotNull(ptr);
         return *this;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h
index 943302556f..7f6ebfeadd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h
@@ -285,7 +285,7 @@ namespace WTF {
     {
         if (it.m_impl == m_impl.end())
             return;
-        m_impl.checkTableConsistency();
+        m_impl.internalCheckTableConsistency();
         m_impl.removeWithoutEntryConsistencyCheck(it.m_impl);
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
index c9b574251b..96a929c7ed 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
@@ -26,7 +26,6 @@
 #ifndef WTF_StdLibExtras_h
 #define WTF_StdLibExtras_h
 
-#include <wtf/Platform.h>
 #include <wtf/Assertions.h>
 
 // Use these to declare and define a static local variable (static T;) so that
@@ -48,6 +47,10 @@
 // NULL can cause compiler problems, especially in cases of multiple inheritance.
 #define OBJECT_OFFSETOF(class, field) (reinterpret_cast<ptrdiff_t>(&(reinterpret_cast<class*>(0x4000)->field)) - 0x4000)
 
+// STRINGIZE: Can convert any value to quoted string, even expandable macros
+#define STRINGIZE(exp) #exp
+#define STRINGIZE_VALUE_OF(exp) STRINGIZE(exp)
+
 namespace WTF {
 
     /*
@@ -65,6 +68,14 @@ namespace WTF {
         return u.to;
     }
 
+    // Returns a count of the number of bits set in 'bits'.
+    inline size_t bitCount(unsigned bits)
+    {
+        bits = bits - ((bits >> 1) & 0x55555555);
+        bits = (bits & 0x33333333) + ((bits >> 2) & 0x33333333);
+        return (((bits + (bits >> 4)) & 0xF0F0F0F) * 0x1010101) >> 24;
+    }
+
 } // namespace WTF
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/loader/cf/ResourceLoaderCFNet.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.cpp
index 83642c613a..1b96417c8c 100644
--- a/src/3rdparty/webkit/WebCore/loader/cf/ResourceLoaderCFNet.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Company 100, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,21 +24,39 @@
  */
 
 #include "config.h"
-#include "ResourceLoader.h"
 
-#include "FrameLoader.h"
-#include "FrameLoaderClient.h"
+#if COMPILER(RVCT) && __ARMCC_VERSION < 400000
 
-namespace WebCore {
+#include "StringExtras.h"
 
-bool ResourceLoader::shouldCacheResponse(ResourceHandle*, CFCachedURLResponseRef cachedResponse)
+#include "ASCIICType.h"
+
+int strcasecmp(const char* s1, const char* s2)
+{
+    while (toASCIIUpper(*s1) == toASCIIUpper(*s2)) {
+        if (*s1 == '\0')
+            return 0;
+        s1++;
+        s2++;
+    }
+
+    return toASCIIUpper(*s1) - toASCIIUpper(*s2);
+}
+
+int strncasecmp(const char* s1, const char* s2, size_t len)
 {
-    if (!m_sendResourceLoadCallbacks)
+    while (len > 0 && toASCIIUpper(*s1) == toASCIIUpper(*s2)) {
+        if (*s1 == '\0')
+            return 0;
+        s1++;
+        s2++;
+        len--;
+    }
+
+    if (!len)
         return 0;
 
-    CFURLResponseRef response = CFCachedURLResponseGetWrappedResponse(cachedResponse);
-    CFDataRef data = CFCachedURLResponseGetReceiverData(cachedResponse);
-    return frameLoader()->client()->shouldCacheResponse(documentLoader(), identifier(), response, CFDataGetBytePtr(data), CFDataGetLength(data));
+    return toASCIIUpper(*s1) - toASCIIUpper(*s2);
 }
 
-} // namespace WebCore
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
index 1120d65473..b1ec09f095 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
@@ -34,6 +34,7 @@
 #endif 
 
 #if COMPILER(MSVC)
+// FIXME: why a COMPILER check instead of OS? also, these should be HAVE checks
 
 inline int snprintf(char* buffer, size_t count, const char* format, ...) 
 {
@@ -45,7 +46,7 @@ inline int snprintf(char* buffer, size_t count, const char* format, ...)
     return result;
 }
 
-#if COMPILER(MSVC7) || PLATFORM(WINCE)
+#if COMPILER(MSVC7) || OS(WINCE)
 
 inline int vsnprintf(char* buffer, size_t count, const char* format, va_list args)
 {
@@ -54,7 +55,7 @@ inline int vsnprintf(char* buffer, size_t count, const char* format, va_list arg
 
 #endif
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 
 inline int strnicmp(const char* string1, const char* string2, size_t count)
 {
@@ -85,7 +86,8 @@ inline int strcasecmp(const char* s1, const char* s2)
 
 #endif
 
-#if PLATFORM(WIN_OS) || PLATFORM(LINUX)
+#if OS(WINDOWS) || OS(LINUX) || OS(SOLARIS)
+// FIXME: should check HAVE_STRNSTR
 
 inline char* strnstr(const char* buffer, const char* target, size_t bufferLength)
 {
@@ -101,4 +103,11 @@ inline char* strnstr(const char* buffer, const char* target, size_t bufferLength
 
 #endif
 
+#if COMPILER(RVCT) && __ARMCC_VERSION < 400000
+
+int strcasecmp(const char* s1, const char* s2);
+int strncasecmp(const char* s1, const char* s2, size_t len);
+
+#endif
+
 #endif // WTF_StringExtras_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StringHashFunctions.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StringHashFunctions.h
new file mode 100644
index 0000000000..07f117f52a
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StringHashFunctions.h
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2005, 2006, 2008, 2010 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#ifndef WTF_StringHashFunctions_h
+#define WTF_StringHashFunctions_h
+
+#include <wtf/unicode/Unicode.h>
+
+namespace WTF {
+
+// Golden ratio - arbitrary start value to avoid mapping all 0's to all 0's
+static const unsigned stringHashingStartValue = 0x9e3779b9U;
+
+// stringHash methods based on Paul Hsieh's SuperFastHash.
+// http://www.azillionmonkeys.com/qed/hash.html
+// char* data is interpreted as latin-encoded (zero extended to 16 bits).
+
+inline unsigned stringHash(const UChar* data, unsigned length)
+{
+    unsigned hash = WTF::stringHashingStartValue;
+    unsigned rem = length & 1;
+    length >>= 1;
+
+    // Main loop
+    for (; length > 0; length--) {
+        hash += data[0];
+        unsigned tmp = (data[1] << 11) ^ hash;
+        hash = (hash << 16) ^ tmp;
+        data += 2;
+        hash += hash >> 11;
+    }
+
+    // Handle end case
+    if (rem) {
+        hash += data[0];
+        hash ^= hash << 11;
+        hash += hash >> 17;
+    }
+
+    // Force "avalanching" of final 127 bits
+    hash ^= hash << 3;
+    hash += hash >> 5;
+    hash ^= hash << 2;
+    hash += hash >> 15;
+    hash ^= hash << 10;
+
+    hash &= 0x7fffffff;
+
+    // this avoids ever returning a hash code of 0, since that is used to
+    // signal "hash not computed yet", using a value that is likely to be
+    // effectively the same as 0 when the low bits are masked
+    if (hash == 0)
+        hash = 0x40000000;
+
+    return hash;
+}
+
+inline unsigned stringHash(const char* data, unsigned length)
+{
+    unsigned hash = WTF::stringHashingStartValue;
+    unsigned rem = length & 1;
+    length >>= 1;
+
+    // Main loop
+    for (; length > 0; length--) {
+        hash += static_cast<unsigned char>(data[0]);
+        unsigned tmp = (static_cast<unsigned char>(data[1]) << 11) ^ hash;
+        hash = (hash << 16) ^ tmp;
+        data += 2;
+        hash += hash >> 11;
+    }
+
+    // Handle end case
+    if (rem) {
+        hash += static_cast<unsigned char>(data[0]);
+        hash ^= hash << 11;
+        hash += hash >> 17;
+    }
+
+    // Force "avalanching" of final 127 bits
+    hash ^= hash << 3;
+    hash += hash >> 5;
+    hash ^= hash << 2;
+    hash += hash >> 15;
+    hash ^= hash << 10;
+
+    hash &= 0x7fffffff;
+
+    // this avoids ever returning a hash code of 0, since that is used to
+    // signal "hash not computed yet", using a value that is likely to be
+    // effectively the same as 0 when the low bits are masked
+    if (hash == 0)
+        hash = 0x40000000;
+
+    return hash;
+}
+
+inline unsigned stringHash(const char* data)
+{
+    unsigned hash = WTF::stringHashingStartValue;
+
+    // Main loop
+    for (;;) {
+        unsigned char b0 = data[0];
+        if (!b0)
+            break;
+        unsigned char b1 = data[1];
+        if (!b1) {
+            hash += b0;
+            hash ^= hash << 11;
+            hash += hash >> 17;
+            break;
+        }
+        hash += b0;
+        unsigned tmp = (b1 << 11) ^ hash;
+        hash = (hash << 16) ^ tmp;
+        data += 2;
+        hash += hash >> 11;
+    }
+
+    // Force "avalanching" of final 127 bits.
+    hash ^= hash << 3;
+    hash += hash >> 5;
+    hash ^= hash << 2;
+    hash += hash >> 15;
+    hash ^= hash << 10;
+
+    hash &= 0x7fffffff;
+
+    // This avoids ever returning a hash code of 0, since that is used to
+    // signal "hash not computed yet", using a value that is likely to be
+    // effectively the same as 0 when the low bits are masked.
+    if (hash == 0)
+        hash = 0x40000000;
+
+    return hash;
+}
+
+} // namespace WTF
+
+#endif // WTF_StringHashFunctions_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h
index b8fce7e9d9..8a73e135fb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h
@@ -33,13 +33,11 @@
 #ifndef TCMALLOC_INTERNAL_SPINLOCK_H__
 #define TCMALLOC_INTERNAL_SPINLOCK_H__
 
-#if (PLATFORM(X86) || PLATFORM(PPC)) && (COMPILER(GCC) || COMPILER(MSVC))
+#if (CPU(X86) || CPU(X86_64) || CPU(PPC)) && (COMPILER(GCC) || COMPILER(MSVC))
 
 #include <time.h>       /* For nanosleep() */
 
-#if !PLATFORM(WIN_OS)
 #include <sched.h>      /* For sched_yield() */
-#endif
 
 #if HAVE(STDINT_H)
 #include <stdint.h>
@@ -49,7 +47,7 @@
 #include <sys/types.h>
 #endif
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #ifndef WIN32_LEAN_AND_MEAN
 #define WIN32_LEAN_AND_MEAN
 #endif
@@ -64,7 +62,7 @@ struct TCMalloc_SpinLock {
   inline void Lock() {
     int r;
 #if COMPILER(GCC)
-#if PLATFORM(X86)
+#if CPU(X86) || CPU(X86_64)
     __asm__ __volatile__
       ("xchgl %0, %1"
        : "=r"(r), "=m"(lockword_)
@@ -94,7 +92,7 @@ struct TCMalloc_SpinLock {
 
   inline void Unlock() {
 #if COMPILER(GCC)
-#if PLATFORM(X86)
+#if CPU(X86) || CPU(X86_64)
     __asm__ __volatile__
       ("movl $0, %0"
        : "=m"(lockword_)
@@ -105,7 +103,7 @@ struct TCMalloc_SpinLock {
       ("isync\n\t"
        "eieio\n\t"
        "stw %1, %0"
-#if PLATFORM(DARWIN) || PLATFORM(PPC)
+#if OS(DARWIN) || CPU(PPC)
        : "=o" (lockword_)
 #else
        : "=m" (lockword_) 
@@ -136,15 +134,11 @@ struct TCMalloc_SpinLock {
 #define SPINLOCK_INITIALIZER { 0 }
 
 static void TCMalloc_SlowLock(volatile unsigned int* lockword) {
-#if !PLATFORM(WIN_OS)
   sched_yield();        // Yield immediately since fast path failed
-#else
-  SwitchToThread();
-#endif
   while (true) {
     int r;
 #if COMPILER(GCC)
-#if PLATFORM(X86)
+#if CPU(X86) || CPU(X86_64)
     __asm__ __volatile__
       ("xchgl %0, %1"
        : "=r"(r), "=m"(*lockword)
@@ -184,7 +178,7 @@ static void TCMalloc_SlowLock(volatile unsigned int* lockword) {
     // from taking 30 seconds to 16 seconds.
 
     // Sleep for a few milliseconds
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
     Sleep(2);
 #else
     struct timespec tm;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
index 659bb0e64d..c46ff311f1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
@@ -38,6 +38,7 @@
 #include "Assertions.h"
 #include "TCSpinLock.h"
 #include "UnusedParam.h"
+#include "VMTags.h"
 
 #if HAVE(STDINT_H)
 #include <stdint.h>
@@ -47,7 +48,7 @@
 #include <sys/types.h>
 #endif
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #include "windows.h"
 #else
 #include <errno.h>
@@ -178,7 +179,7 @@ static void* TryMmap(size_t size, size_t *actual_size, size_t alignment) {
   void* result = mmap(NULL, size + extra,
                       PROT_READ | PROT_WRITE,
                       MAP_PRIVATE|MAP_ANONYMOUS,
-                      -1, 0);
+                      VM_TAG_FOR_TCMALLOC_MEMORY, 0);
   if (result == reinterpret_cast<void*>(MAP_FAILED)) {
     mmap_failure = true;
     return NULL;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp
new file mode 100644
index 0000000000..042d49e9fc
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(PTHREADS)
+
+#include "ThreadIdentifierDataPthreads.h"
+
+#include "Threading.h"
+
+namespace WTF {
+
+pthread_key_t ThreadIdentifierData::m_key;
+
+void clearPthreadHandleForIdentifier(ThreadIdentifier);
+
+ThreadIdentifierData::~ThreadIdentifierData()
+{
+    clearPthreadHandleForIdentifier(m_identifier);
+}
+
+ThreadIdentifier ThreadIdentifierData::identifier()
+{
+    initializeKeyOnce();
+    ThreadIdentifierData* threadIdentifierData = static_cast<ThreadIdentifierData*>(pthread_getspecific(m_key));
+
+    return threadIdentifierData ? threadIdentifierData->m_identifier : 0;
+}
+
+void ThreadIdentifierData::initialize(ThreadIdentifier id)
+{
+    ASSERT(!identifier());
+
+    initializeKeyOnce();
+    pthread_setspecific(m_key, new ThreadIdentifierData(id));
+}
+
+void ThreadIdentifierData::destruct(void* data)
+{
+    ThreadIdentifierData* threadIdentifierData = static_cast<ThreadIdentifierData*>(data);
+    ASSERT(threadIdentifierData);
+
+    if (threadIdentifierData->m_isDestroyedOnce) {
+        delete threadIdentifierData;
+        return;
+    }
+
+    threadIdentifierData->m_isDestroyedOnce = true;
+    // Re-setting the value for key causes another destruct() call after all other thread-specific destructors were called.
+    pthread_setspecific(m_key, threadIdentifierData);
+}
+
+void ThreadIdentifierData::initializeKeyOnceHelper()
+{
+    if (pthread_key_create(&m_key, destruct))
+        CRASH();
+}
+
+void ThreadIdentifierData::initializeKeyOnce()
+{
+    static pthread_once_t onceControl = PTHREAD_ONCE_INIT;
+    if (pthread_once(&onceControl, initializeKeyOnceHelper))
+        CRASH();
+}
+
+} // namespace WTF
+
+#endif // USE(PTHREADS)
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h
new file mode 100644
index 0000000000..3af87a8aa3
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ThreadIdentifierDataPthreads_h
+#define ThreadIdentifierDataPthreads_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/Threading.h>
+
+namespace WTF {
+
+// Holds ThreadIdentifier in the thread-specific storage and employs pthreads-specific 2-pass destruction to reliably remove
+// ThreadIdentifier from threadMap. It assumes regular ThreadSpecific types don't use multiple-pass destruction.
+class ThreadIdentifierData : public Noncopyable {
+public:
+    ~ThreadIdentifierData();
+
+    // Creates and puts an instance of ThreadIdentifierData into thread-specific storage.
+    static void initialize(ThreadIdentifier identifier);
+
+    // Returns 0 if thread-specific storage was not initialized.
+    static ThreadIdentifier identifier();
+
+private:
+    ThreadIdentifierData(ThreadIdentifier identifier)
+        : m_identifier(identifier)
+        , m_isDestroyedOnce(false)
+    {
+    }
+
+    // This thread-specific destructor is called 2 times when thread terminates:
+    // - first, when all the other thread-specific destructors are called, it simply remembers it was 'destroyed once'
+    // and re-sets itself into the thread-specific slot to make Pthreads to call it again later.
+    // - second, after all thread-specific destructors were invoked, it gets called again - this time, we remove the
+    // ThreadIdentifier from the threadMap, completing the cleanup.
+    static void destruct(void* data);
+
+    static void initializeKeyOnceHelper();
+    static void initializeKeyOnce();
+
+    ThreadIdentifier m_identifier;
+    bool m_isDestroyedOnce;
+    static pthread_key_t m_key;
+};
+
+} // namespace WTF
+
+#endif // ThreadIdentifierDataPthreads_h
+
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
index b6f5fd3c8b..7e5679f964 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
@@ -47,13 +47,13 @@
 #include <pthread.h>
 #elif PLATFORM(QT)
 #include <QThreadStorage>
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 #include <windows.h>
 #endif
 
 namespace WTF {
 
-#if !USE(PTHREADS) && !PLATFORM(QT) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && !PLATFORM(QT) && OS(WINDOWS)
 // ThreadSpecificThreadExit should be called each time when a thread is detached.
 // This is done automatically for threads created with WTF::createThread.
 void ThreadSpecificThreadExit();
@@ -68,7 +68,7 @@ public:
     ~ThreadSpecific();
 
 private:
-#if !USE(PTHREADS) && !PLATFORM(QT) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && !PLATFORM(QT) && OS(WINDOWS)
     friend void ThreadSpecificThreadExit();
 #endif
     
@@ -76,7 +76,7 @@ private:
     void set(T*);
     void static destroy(void* ptr);
 
-#if USE(PTHREADS) || PLATFORM(QT) || PLATFORM(WIN_OS)
+#if USE(PTHREADS) || PLATFORM(QT) || OS(WINDOWS)
     struct Data : Noncopyable {
         Data(T* value, ThreadSpecific<T>* owner) : value(value), owner(owner) {}
 #if PLATFORM(QT)
@@ -91,15 +91,44 @@ private:
     };
 #endif
 
+#if ENABLE(SINGLE_THREADED)
+    T* m_value;
+#else
 #if USE(PTHREADS)
     pthread_key_t m_key;
 #elif PLATFORM(QT)
     QThreadStorage<Data*> m_key;
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
     int m_index;
 #endif
+#endif
 };
 
+#if ENABLE(SINGLE_THREADED)
+template<typename T>
+inline ThreadSpecific<T>::ThreadSpecific()
+    : m_value(0)
+{
+}
+
+template<typename T>
+inline ThreadSpecific<T>::~ThreadSpecific()
+{
+}
+
+template<typename T>
+inline T* ThreadSpecific<T>::get()
+{
+    return m_value;
+}
+
+template<typename T>
+inline void ThreadSpecific<T>::set(T* ptr)
+{
+    ASSERT(!get());
+    m_value = ptr;
+}
+#else
 #if USE(PTHREADS)
 template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
@@ -157,7 +186,12 @@ inline void ThreadSpecific<T>::set(T* ptr)
     m_key.setLocalData(data);
 }
 
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
+
+// TLS_OUT_OF_INDEXES is not defined on WinCE.
+#ifndef TLS_OUT_OF_INDEXES
+#define TLS_OUT_OF_INDEXES 0xffffffff
+#endif
 
 // The maximum number of TLS keys that can be created. For simplification, we assume that:
 // 1) Once the instance of ThreadSpecific<> is created, it will not be destructed until the program dies.
@@ -171,14 +205,14 @@ template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
     : m_index(-1)
 {
-    DWORD tls_key = TlsAlloc();
-    if (tls_key == TLS_OUT_OF_INDEXES)
+    DWORD tlsKey = TlsAlloc();
+    if (tlsKey == TLS_OUT_OF_INDEXES)
         CRASH();
 
     m_index = InterlockedIncrement(&tlsKeyCount()) - 1;
     if (m_index >= kMaxTlsKeySize)
         CRASH();
-    tlsKeys()[m_index] = tls_key;
+    tlsKeys()[m_index] = tlsKey;
 }
 
 template<typename T>
@@ -207,10 +241,12 @@ inline void ThreadSpecific<T>::set(T* ptr)
 #else
 #error ThreadSpecific is not implemented for this platform.
 #endif
+#endif
 
 template<typename T>
 inline void ThreadSpecific<T>::destroy(void* ptr)
 {
+#if !ENABLE(SINGLE_THREADED)
     Data* data = static_cast<Data*>(ptr);
 
 #if USE(PTHREADS)
@@ -230,7 +266,7 @@ inline void ThreadSpecific<T>::destroy(void* ptr)
     pthread_setspecific(data->owner->m_key, 0);
 #elif PLATFORM(QT)
     // Do nothing here
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
     TlsSetValue(tlsKeys()[data->owner->m_index], 0);
 #else
 #error ThreadSpecific is not implemented for this platform.
@@ -239,6 +275,7 @@ inline void ThreadSpecific<T>::destroy(void* ptr)
 #if !PLATFORM(QT)
     delete data;
 #endif
+#endif
 }
 
 template<typename T>
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
index 1d4185ccea..49de59ec00 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
@@ -49,13 +49,14 @@ static void* threadEntryPoint(void* contextData)
 {
     NewThreadContext* context = reinterpret_cast<NewThreadContext*>(contextData);
 
-    setThreadNameInternal(context->name);
-
-    // Block until our creating thread has completed any extra setup work.
+    // Block until our creating thread has completed any extra setup work, including
+    // establishing ThreadIdentifier.
     {
         MutexLocker locker(context->creationMutex);
     }
 
+    initializeCurrentThreadInternal(context->name);
+
     // Grab the info that we need out of the context, then deallocate it.
     ThreadFunction entryPoint = context->entryPoint;
     void* data = context->data;
@@ -75,7 +76,7 @@ ThreadIdentifier createThread(ThreadFunction entryPoint, void* data, const char*
 
     NewThreadContext* context = new NewThreadContext(entryPoint, data, name);
 
-    // Prevent the thread body from executing until we've established the thread identifier
+    // Prevent the thread body from executing until we've established the thread identifier.
     MutexLocker locker(context->creationMutex);
 
     return createThreadInternal(threadEntryPoint, context, name);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
index 3e25c95b9a..768aecfab5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
@@ -61,7 +61,7 @@
 
 #include "Platform.h"
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 #include <windows.h>
 #endif
 
@@ -69,11 +69,13 @@
 #include <wtf/Locker.h>
 #include <wtf/Noncopyable.h>
 
-#if PLATFORM(WIN_OS) && !PLATFORM(WINCE)
+#if OS(WINDOWS) && !OS(WINCE)
 #include <windows.h>
-#elif PLATFORM(DARWIN)
+#elif OS(DARWIN)
 #include <libkern/OSAtomic.h>
-#elif COMPILER(GCC) && !defined(__SYMBIAN32__)
+#elif OS(ANDROID)
+#include <cutils/atomic.h>
+#elif COMPILER(GCC) && !OS(SYMBIAN)
 #if (__GNUC__ > 4) || ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 2))
 #include <ext/atomicity.h>
 #else
@@ -84,7 +86,7 @@
 #if USE(PTHREADS)
 #include <pthread.h>
 #elif PLATFORM(GTK)
-#include <wtf/GOwnPtr.h>
+#include "GOwnPtr.h"
 typedef struct _GMutex GMutex;
 typedef struct _GCond GCond;
 #endif
@@ -119,7 +121,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction, void*, const char* threadN
 
 // Called in the thread during initialization.
 // Helpful for platforms where the thread name must be set from within the thread.
-void setThreadNameInternal(const char* threadName);
+void initializeCurrentThreadInternal(const char* threadName);
 
 ThreadIdentifier currentThread();
 bool isMainThread();
@@ -142,7 +144,7 @@ typedef GOwnPtr<GCond> PlatformCondition;
 typedef QT_PREPEND_NAMESPACE(QMutex)* PlatformMutex;
 typedef void* PlatformReadWriteLock; // FIXME: Implement.
 typedef QT_PREPEND_NAMESPACE(QWaitCondition)* PlatformCondition;
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 struct PlatformMutex {
     CRITICAL_SECTION m_internalMutex;
     size_t m_recursionCount;
@@ -215,10 +217,10 @@ private:
     PlatformCondition m_condition;
 };
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
-#if COMPILER(MINGW) || COMPILER(MSVC7) || PLATFORM(WINCE)
+#if COMPILER(MINGW) || COMPILER(MSVC7) || OS(WINCE)
 inline int atomicIncrement(int* addend) { return InterlockedIncrement(reinterpret_cast<long*>(addend)); }
 inline int atomicDecrement(int* addend) { return InterlockedDecrement(reinterpret_cast<long*>(addend)); }
 #else
@@ -226,13 +228,18 @@ inline int atomicIncrement(int volatile* addend) { return InterlockedIncrement(r
 inline int atomicDecrement(int volatile* addend) { return InterlockedDecrement(reinterpret_cast<long volatile*>(addend)); }
 #endif
 
-#elif PLATFORM(DARWIN)
+#elif OS(DARWIN)
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
 inline int atomicIncrement(int volatile* addend) { return OSAtomicIncrement32Barrier(const_cast<int*>(addend)); }
 inline int atomicDecrement(int volatile* addend) { return OSAtomicDecrement32Barrier(const_cast<int*>(addend)); }
 
-#elif COMPILER(GCC) && !PLATFORM(SPARC64) && !defined(__SYMBIAN32__) // sizeof(_Atomic_word) != sizeof(int) on sparc64 gcc
+#elif OS(ANDROID)
+
+inline int atomicIncrement(int volatile* addend) { return android_atomic_inc(addend); }
+inline int atomicDecrement(int volatile* addend) { return android_atomic_dec(addend); }
+
+#elif COMPILER(GCC) && !CPU(SPARC64) && !OS(SYMBIAN) // sizeof(_Atomic_word) != sizeof(int) on sparc64 gcc
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
 inline int atomicIncrement(int volatile* addend) { return __gnu_cxx::__exchange_and_add(addend, 1) + 1; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp
index 46f23d211f..2e8a259f4d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp
@@ -30,11 +30,13 @@
 #include "config.h"
 #include "Threading.h"
 
+#if ENABLE(SINGLE_THREADED)
+
 namespace WTF {
 
 void initializeThreading() { }
 ThreadIdentifier createThreadInternal(ThreadFunction, void*, const char*) { return ThreadIdentifier(); }
-void setThreadNameInternal(const char*) { }
+void initializeCurrentThreadInternal(const char*) { }
 int waitForThreadCompletion(ThreadIdentifier, void**) { return 0; }
 void detachThread(ThreadIdentifier) { }
 ThreadIdentifier currentThread() { return ThreadIdentifier(); }
@@ -57,3 +59,5 @@ void lockAtomicallyInitializedStaticMutex() { }
 void unlockAtomicallyInitializedStaticMutex() { }
 
 } // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
index 6cad5e3618..2feb808295 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
@@ -37,6 +37,8 @@
 #include "MainThread.h"
 #include "RandomNumberSeed.h"
 #include "StdLibExtras.h"
+#include "ThreadIdentifierDataPthreads.h"
+#include "ThreadSpecific.h"
 #include "UnusedParam.h"
 #include <errno.h>
 
@@ -45,7 +47,7 @@
 #include <sys/time.h>
 #endif
 
-#if PLATFORM(ANDROID)
+#if OS(ANDROID)
 #include "jni_utility.h"
 #endif
 
@@ -55,10 +57,12 @@ typedef HashMap<ThreadIdentifier, pthread_t> ThreadMap;
 
 static Mutex* atomicallyInitializedStaticMutex;
 
-#if !PLATFORM(DARWIN) || PLATFORM(CHROMIUM)
-static ThreadIdentifier mainThreadIdentifier; // The thread that was the first to call initializeThreading(), which must be the main thread.
+#if !OS(DARWIN) || PLATFORM(CHROMIUM) || USE(WEB_THREAD)
+static pthread_t mainThread; // The thread that was the first to call initializeThreading(), which must be the main thread.
 #endif
 
+void clearPthreadHandleForIdentifier(ThreadIdentifier);
+
 static Mutex& threadMapMutex()
 {
     DEFINE_STATIC_LOCAL(Mutex, mutex, ());
@@ -71,8 +75,8 @@ void initializeThreading()
         atomicallyInitializedStaticMutex = new Mutex;
         threadMapMutex();
         initializeRandomNumberGenerator();
-#if !PLATFORM(DARWIN) || PLATFORM(CHROMIUM)
-        mainThreadIdentifier = currentThread();
+#if !OS(DARWIN) || PLATFORM(CHROMIUM) || USE(WEB_THREAD)
+        mainThread = pthread_self();
 #endif
         initializeMainThread();
     }
@@ -108,7 +112,7 @@ static ThreadIdentifier identifierByPthreadHandle(const pthread_t& pthreadHandle
     return 0;
 }
 
-static ThreadIdentifier establishIdentifierForPthreadHandle(pthread_t& pthreadHandle)
+static ThreadIdentifier establishIdentifierForPthreadHandle(const pthread_t& pthreadHandle)
 {
     ASSERT(!identifierByPthreadHandle(pthreadHandle));
 
@@ -128,7 +132,7 @@ static pthread_t pthreadHandleForIdentifier(ThreadIdentifier id)
     return threadMap().get(id);
 }
 
-static void clearPthreadHandleForIdentifier(ThreadIdentifier id)
+void clearPthreadHandleForIdentifier(ThreadIdentifier id)
 {
     MutexLocker locker(threadMapMutex());
 
@@ -137,7 +141,7 @@ static void clearPthreadHandleForIdentifier(ThreadIdentifier id)
     threadMap().remove(id);
 }
 
-#if PLATFORM(ANDROID)
+#if OS(ANDROID)
 // On the Android platform, threads must be registered with the VM before they run.
 struct ThreadData {
     ThreadFunction entryPoint;
@@ -185,13 +189,17 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
 }
 #endif
 
-void setThreadNameInternal(const char* threadName)
+void initializeCurrentThreadInternal(const char* threadName)
 {
 #if HAVE(PTHREAD_SETNAME_NP)
     pthread_setname_np(threadName);
 #else
     UNUSED_PARAM(threadName);
 #endif
+
+    ThreadIdentifier id = identifierByPthreadHandle(pthread_self());
+    ASSERT(id);
+    ThreadIdentifierData::initialize(id);
 }
 
 int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
@@ -199,12 +207,13 @@ int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
     ASSERT(threadID);
 
     pthread_t pthreadHandle = pthreadHandleForIdentifier(threadID);
+    if (!pthreadHandle)
+        return 0;
 
     int joinResult = pthread_join(pthreadHandle, result);
     if (joinResult == EDEADLK)
         LOG_ERROR("ThreadIdentifier %u was found to be deadlocked trying to quit", threadID);
 
-    clearPthreadHandleForIdentifier(threadID);
     return joinResult;
 }
 
@@ -213,26 +222,30 @@ void detachThread(ThreadIdentifier threadID)
     ASSERT(threadID);
 
     pthread_t pthreadHandle = pthreadHandleForIdentifier(threadID);
+    if (!pthreadHandle)
+        return;
 
     pthread_detach(pthreadHandle);
-
-    clearPthreadHandleForIdentifier(threadID);
 }
 
 ThreadIdentifier currentThread()
 {
-    pthread_t currentThread = pthread_self();
-    if (ThreadIdentifier id = identifierByPthreadHandle(currentThread))
+    ThreadIdentifier id = ThreadIdentifierData::identifier();
+    if (id)
         return id;
-    return establishIdentifierForPthreadHandle(currentThread);
+
+    // Not a WTF-created thread, ThreadIdentifier is not established yet.
+    id = establishIdentifierForPthreadHandle(pthread_self());
+    ThreadIdentifierData::initialize(id);
+    return id;
 }
 
 bool isMainThread()
 {
-#if PLATFORM(DARWIN) && !PLATFORM(CHROMIUM)
+#if OS(DARWIN) && !PLATFORM(CHROMIUM) && !USE(WEB_THREAD)
     return pthread_main_np();
 #else
-    return currentThread() == mainThreadIdentifier;
+    return pthread_equal(pthread_self(), mainThread);
 #endif
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp
index cccbda14ef..73c3f0c14d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp
@@ -87,10 +87,10 @@
 #include "Threading.h"
 
 #include "MainThread.h"
-#if !USE(PTHREADS) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && OS(WINDOWS)
 #include "ThreadSpecific.h"
 #endif
-#if !PLATFORM(WINCE)
+#if !OS(WINCE)
 #include <process.h>
 #endif
 #if HAVE(ERRNO_H)
@@ -118,7 +118,7 @@ typedef struct tagTHREADNAME_INFO {
 } THREADNAME_INFO;
 #pragma pack(pop)
 
-void setThreadNameInternal(const char* szThreadName)
+void initializeCurrentThreadInternal(const char* szThreadName)
 {
     THREADNAME_INFO info;
     info.dwType = 0x1000;
@@ -161,7 +161,7 @@ void initializeThreading()
         initializeRandomNumberGenerator();
         initializeMainThread();
         mainThreadIdentifier = currentThread();
-        setThreadNameInternal("Main Thread");
+        initializeCurrentThreadInternal("Main Thread");
     }
 }
 
@@ -205,7 +205,7 @@ static unsigned __stdcall wtfThreadEntryPoint(void* param)
 
     void* result = invocation.function(invocation.data);
 
-#if !USE(PTHREADS) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && OS(WINDOWS)
     // Do the TLS cleanup.
     ThreadSpecificThreadExit();
 #endif
@@ -218,7 +218,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
     unsigned threadIdentifier = 0;
     ThreadIdentifier threadID = 0;
     ThreadFunctionInvocation* invocation = new ThreadFunctionInvocation(entryPoint, data);
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     // This is safe on WINCE, since CRT is in the core and innately multithreaded.
     // On desktop Windows, need to use _beginthreadex (not available on WinCE) if using any CRT functions
     HANDLE threadHandle = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)wtfThreadEntryPoint, invocation, 0, (LPDWORD)&threadIdentifier);
@@ -226,7 +226,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
     HANDLE threadHandle = reinterpret_cast<HANDLE>(_beginthreadex(0, 0, wtfThreadEntryPoint, invocation, 0, &threadIdentifier));
 #endif
     if (!threadHandle) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
         LOG_ERROR("Failed to create thread at entry point %p with data %p: %ld", entryPoint, data, ::GetLastError());
 #elif defined(NO_ERRNO)
         LOG_ERROR("Failed to create thread at entry point %p with data %p.", entryPoint, data);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp
index 36fc6c68f9..9e51ad0813 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp
@@ -1,6 +1,6 @@
  /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -101,6 +101,20 @@ COMPILE_ASSERT((!IsSameType<int, int*>::value), WTF_IsSameType_int_int_pointer_f
 COMPILE_ASSERT((!IsSameType<bool, const bool>::value), WTF_IsSameType_const_change_false);
 COMPILE_ASSERT((!IsSameType<bool, volatile bool>::value), WTF_IsSameType_volatile_change_false);
 
+template <typename T>
+class TestBaseClass {
+};
+
+class TestDerivedClass : public TestBaseClass<int> {
+};
+
+COMPILE_ASSERT((IsSubclass<TestDerivedClass, TestBaseClass<int> >::value), WTF_Test_IsSubclass_Derived_From_Base);
+COMPILE_ASSERT((!IsSubclass<TestBaseClass<int>, TestDerivedClass>::value), WTF_Test_IsSubclass_Base_From_Derived);
+COMPILE_ASSERT((IsSubclassOfTemplate<TestDerivedClass, TestBaseClass>::value), WTF_Test_IsSubclassOfTemplate_Base_From_Derived);
+COMPILE_ASSERT((IsSameType<RemoveTemplate<TestBaseClass<int>, TestBaseClass>::Type, int>::value), WTF_Test_RemoveTemplate);
+COMPILE_ASSERT((IsSameType<RemoveTemplate<int, TestBaseClass>::Type, int>::value), WTF_Test_RemoveTemplate_WithoutTemplate);
+
+
 COMPILE_ASSERT((IsSameType<bool, RemoveConst<const bool>::Type>::value), WTF_test_RemoveConst_const_bool);
 COMPILE_ASSERT((!IsSameType<bool, RemoveConst<volatile bool>::Type>::value), WTF_test_RemoveConst_volatile_bool);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
index 9e75e7a943..62dbc4926c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
@@ -1,6 +1,6 @@
  /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -104,6 +104,40 @@ namespace WTF {
         static const bool value = true;
     };
 
+    template <typename T, typename U> class IsSubclass {
+        typedef char YesType;
+        struct NoType {
+            char padding[8];
+        };
+
+        static YesType subclassCheck(U*);
+        static NoType subclassCheck(...);
+        static T* t;
+    public:
+        static const bool value = sizeof(subclassCheck(t)) == sizeof(YesType);
+    };
+
+    template <typename T, template<class V> class U> class IsSubclassOfTemplate {
+        typedef char YesType;
+        struct NoType {
+            char padding[8];
+        };
+
+        template<typename W> static YesType subclassCheck(U<W>*);
+        static NoType subclassCheck(...);
+        static T* t;
+    public:
+        static const bool value = sizeof(subclassCheck(t)) == sizeof(YesType);
+    };
+
+    template <typename T, template <class V> class OuterTemplate> struct RemoveTemplate {
+        typedef T Type;
+    };
+
+    template <typename T, template <class V> class OuterTemplate> struct RemoveTemplate<OuterTemplate<T>, OuterTemplate> {
+        typedef T Type;
+    };
+
     template <typename T> struct RemoveConst {
         typedef T Type;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h b/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h
index 519f518949..7ac02da2c4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h
@@ -26,14 +26,18 @@
 #ifndef VMTags_h
 #define VMTags_h
 
-#include <wtf/Platform.h>
-
 // On Mac OS X, the VM subsystem allows tagging memory requested from mmap and vm_map
 // in order to aid tools that inspect system memory use. 
-#if PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+#if OS(DARWIN) && !defined(BUILDING_ON_TIGER)
 
 #include <mach/vm_statistics.h>
 
+#if defined(VM_MEMORY_TCMALLOC)
+#define VM_TAG_FOR_TCMALLOC_MEMORY VM_MAKE_TAG(VM_MEMORY_TCMALLOC)
+#else
+#define VM_TAG_FOR_TCMALLOC_MEMORY VM_MAKE_TAG(53)
+#endif // defined(VM_MEMORY_TCMALLOC)
+
 #if defined(VM_MEMORY_JAVASCRIPT_CORE) && defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
 #define VM_TAG_FOR_COLLECTOR_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_CORE)
 #define VM_TAG_FOR_REGISTERFILE_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE)
@@ -44,12 +48,20 @@
 #define VM_TAG_FOR_REGISTERFILE_MEMORY VM_MAKE_TAG(65)
 #endif // defined(VM_MEMORY_JAVASCRIPT_CORE) && defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
 
-#else // PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+#if defined(VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS)
+#define VM_TAG_FOR_WEBCORE_PURGEABLE_MEMORY VM_MAKE_TAG(VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS)
+#else
+#define VM_TAG_FOR_WEBCORE_PURGEABLE_MEMORY VM_MAKE_TAG(69)
+#endif // defined(VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS)
+
+#else // OS(DARWIN) && !defined(BUILDING_ON_TIGER)
 
+#define VM_TAG_FOR_TCMALLOC_MEMORY -1
 #define VM_TAG_FOR_COLLECTOR_MEMORY -1
 #define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY -1
 #define VM_TAG_FOR_REGISTERFILE_MEMORY -1
+#define VM_TAG_FOR_WEBCORE_PURGEABLE_MEMORY -1
 
-#endif // PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+#endif // OS(DARWIN) && !defined(BUILDING_ON_TIGER)
 
 #endif // VMTags_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ValueCheck.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ValueCheck.h
new file mode 100644
index 0000000000..2a86eb0f23
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ValueCheck.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ValueCheck_h
+#define ValueCheck_h
+
+#include <wtf/FastMalloc.h>
+
+namespace WTF {
+
+template<typename T> struct ValueCheck {
+    typedef T TraitType;
+    static void checkConsistency(const T&) { }
+};
+
+#if !ASSERT_DISABLED
+template<typename P> struct ValueCheck<P*> {
+    typedef P* TraitType;
+    static void checkConsistency(const P* p)
+    {
+        if (!p)
+            return;
+        ASSERT(fastMallocSize(p));
+        ValueCheck<P>::checkConsistency(*p);
+    }
+};
+#endif
+
+}
+
+#endif // ValueCheck_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
index e1fc5b4f9a..6f55e53bf0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
@@ -24,6 +24,7 @@
 #include "FastAllocBase.h"
 #include "Noncopyable.h"
 #include "NotFound.h"
+#include "ValueCheck.h"
 #include "VectorTraits.h"
 #include <limits>
 #include <utility>
@@ -71,7 +72,7 @@ namespace WTF {
     }
 
     template <bool needsDestruction, typename T>
-    class VectorDestructor;
+    struct VectorDestructor;
 
     template<typename T>
     struct VectorDestructor<false, T>
@@ -90,7 +91,7 @@ namespace WTF {
     };
 
     template <bool needsInitialization, bool canInitializeWithMemset, typename T>
-    class VectorInitializer;
+    struct VectorInitializer;
 
     template<bool ignore, typename T>
     struct VectorInitializer<false, ignore, T>
@@ -118,7 +119,7 @@ namespace WTF {
     };
 
     template <bool canMoveWithMemcpy, typename T>
-    class VectorMover;
+    struct VectorMover;
 
     template<typename T>
     struct VectorMover<false, T>
@@ -162,7 +163,7 @@ namespace WTF {
     };
 
     template <bool canCopyWithMemcpy, typename T>
-    class VectorCopier;
+    struct VectorCopier;
 
     template<typename T>
     struct VectorCopier<false, T>
@@ -187,7 +188,7 @@ namespace WTF {
     };
 
     template <bool canFillWithMemset, typename T>
-    class VectorFiller;
+    struct VectorFiller;
 
     template<typename T>
     struct VectorFiller<false, T>
@@ -212,7 +213,7 @@ namespace WTF {
     };
     
     template<bool canCompareWithMemcmp, typename T>
-    class VectorComparer;
+    struct VectorComparer;
     
     template<typename T>
     struct VectorComparer<false, T>
@@ -285,6 +286,20 @@ namespace WTF {
             m_buffer = static_cast<T*>(fastMalloc(newCapacity * sizeof(T)));
         }
 
+        bool tryAllocateBuffer(size_t newCapacity)
+        {
+            if (newCapacity > std::numeric_limits<size_t>::max() / sizeof(T))
+                return false;
+
+            T* newBuffer;
+            if (tryFastMalloc(newCapacity * sizeof(T)).getValue(newBuffer)) {
+                m_capacity = newCapacity;
+                m_buffer = newBuffer;
+                return true;
+            }
+            return false;
+        }
+
         void deallocateBuffer(T* bufferToDeallocate)
         {
             if (m_buffer == bufferToDeallocate) {
@@ -360,6 +375,7 @@ namespace WTF {
         void restoreInlineBufferIfNeeded() { }
 
         using Base::allocateBuffer;
+        using Base::tryAllocateBuffer;
         using Base::deallocateBuffer;
 
         using Base::buffer;
@@ -404,6 +420,15 @@ namespace WTF {
             }
         }
 
+        bool tryAllocateBuffer(size_t newCapacity)
+        {
+            if (newCapacity > inlineCapacity)
+                return Base::tryAllocateBuffer(newCapacity);
+            m_buffer = inlineBuffer();
+            m_capacity = inlineCapacity;
+            return true;
+        }
+
         void deallocateBuffer(T* bufferToDeallocate)
         {
             if (bufferToDeallocate == inlineBuffer())
@@ -537,6 +562,7 @@ namespace WTF {
         void grow(size_t size);
         void resize(size_t size);
         void reserveCapacity(size_t newCapacity);
+        bool tryReserveCapacity(size_t newCapacity);
         void reserveInitialCapacity(size_t initialCapacity);
         void shrinkCapacity(size_t newCapacity);
         void shrinkToFit() { shrinkCapacity(size()); }
@@ -547,6 +573,7 @@ namespace WTF {
         template<typename U> void append(const U&);
         template<typename U> void uncheckedAppend(const U& val);
         template<size_t otherCapacity> void append(const Vector<T, otherCapacity>&);
+        template<typename U> bool tryAppend(const U*, size_t);
 
         template<typename U> void insert(size_t position, const U*, size_t);
         template<typename U> void insert(size_t position, const U&);
@@ -586,9 +613,13 @@ namespace WTF {
             m_buffer.swap(other.m_buffer);
         }
 
+        void checkConsistency();
+
     private:
         void expandCapacity(size_t newMinCapacity);
         const T* expandCapacity(size_t newMinCapacity, const T*);
+        bool tryExpandCapacity(size_t newMinCapacity);
+        const T* tryExpandCapacity(size_t newMinCapacity, const T*);
         template<typename U> U* expandCapacity(size_t newMinCapacity, U*); 
 
         size_t m_size;
@@ -739,6 +770,26 @@ namespace WTF {
         return begin() + index;
     }
 
+    template<typename T, size_t inlineCapacity>
+    bool Vector<T, inlineCapacity>::tryExpandCapacity(size_t newMinCapacity)
+    {
+        return tryReserveCapacity(max(newMinCapacity, max(static_cast<size_t>(16), capacity() + capacity() / 4 + 1)));
+    }
+    
+    template<typename T, size_t inlineCapacity>
+    const T* Vector<T, inlineCapacity>::tryExpandCapacity(size_t newMinCapacity, const T* ptr)
+    {
+        if (ptr < begin() || ptr >= end()) {
+            if (!tryExpandCapacity(newMinCapacity))
+                return 0;
+            return ptr;
+        }
+        size_t index = ptr - begin();
+        if (!tryExpandCapacity(newMinCapacity))
+            return 0;
+        return begin() + index;
+    }
+
     template<typename T, size_t inlineCapacity> template<typename U>
     inline U* Vector<T, inlineCapacity>::expandCapacity(size_t newMinCapacity, U* ptr)
     {
@@ -794,6 +845,21 @@ namespace WTF {
     }
     
     template<typename T, size_t inlineCapacity>
+    bool Vector<T, inlineCapacity>::tryReserveCapacity(size_t newCapacity)
+    {
+        if (newCapacity <= capacity())
+            return true;
+        T* oldBuffer = begin();
+        T* oldEnd = end();
+        if (!m_buffer.tryAllocateBuffer(newCapacity))
+            return false;
+        ASSERT(begin());
+        TypeOperations::move(oldBuffer, oldEnd, begin());
+        m_buffer.deallocateBuffer(oldBuffer);
+        return true;
+    }
+    
+    template<typename T, size_t inlineCapacity>
     inline void Vector<T, inlineCapacity>::reserveInitialCapacity(size_t initialCapacity)
     {
         ASSERT(!m_size);
@@ -845,6 +911,25 @@ namespace WTF {
     }
 
     template<typename T, size_t inlineCapacity> template<typename U>
+    bool Vector<T, inlineCapacity>::tryAppend(const U* data, size_t dataSize)
+    {
+        size_t newSize = m_size + dataSize;
+        if (newSize > capacity()) {
+            data = tryExpandCapacity(newSize, data);
+            if (!data)
+                return false;
+            ASSERT(begin());
+        }
+        if (newSize < m_size)
+            return false;
+        T* dest = end();
+        for (size_t i = 0; i < dataSize; ++i)
+            new (&dest[i]) T(data[i]);
+        m_size = newSize;
+        return true;
+    }
+
+    template<typename T, size_t inlineCapacity> template<typename U>
     ALWAYS_INLINE void Vector<T, inlineCapacity>::append(const U& val)
     {
         const U* ptr = &val;
@@ -987,6 +1072,15 @@ namespace WTF {
     }
 
     template<typename T, size_t inlineCapacity>
+    inline void Vector<T, inlineCapacity>::checkConsistency()
+    {
+#if !ASSERT_DISABLED
+        for (size_t i = 0; i < size(); ++i)
+            ValueCheck<T>::checkConsistency(at(i));
+#endif
+    }
+
+    template<typename T, size_t inlineCapacity>
     void deleteAllValues(const Vector<T, inlineCapacity>& collection)
     {
         typedef typename Vector<T, inlineCapacity>::const_iterator iterator;
@@ -1016,6 +1110,15 @@ namespace WTF {
         return !(a == b);
     }
 
+#if !ASSERT_DISABLED
+    template<typename T> struct ValueCheck<Vector<T> > {
+        typedef Vector<T> TraitType;
+        static void checkConsistency(const Vector<T>& v)
+        {
+            v.checkConsistency();
+        }
+    };
+#endif
 
 } // namespace WTF
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector3.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector3.h
new file mode 100644
index 0000000000..3c40b61119
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector3.h
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Vector3_h
+#define Vector3_h
+
+#include <math.h>
+
+namespace WebCore {
+
+class Vector3 {
+public:
+    Vector3()
+        : m_x(0.0)
+        , m_y(0.0)
+        , m_z(0.0)
+    {
+    }
+
+    Vector3(double x, double y, double z)
+        : m_x(x)
+        , m_y(y)
+        , m_z(z)
+    {
+    }
+
+    Vector3(const float p[3])
+        : m_x(p[0])
+        , m_y(p[1])
+        , m_z(p[2])
+    {
+    }
+
+    Vector3(const double p[3])
+        : m_x(p[0])
+        , m_y(p[1])
+        , m_z(p[2])
+    {
+    }
+
+    double abs() const
+    {
+        return sqrt(m_x * m_x + m_y * m_y + m_z * m_z);
+    }
+
+    bool isZero() const
+    {
+        return !m_x && !m_y && !m_z;
+    }
+
+    void normalize()
+    {
+        double absValue = abs();
+        if (!absValue)
+            return;
+
+        double k = 1.0 / absValue;
+        m_x *= k;
+        m_y *= k;
+        m_z *= k;
+    }
+
+    double x() const { return m_x; }
+    double y() const { return m_y; }
+    double z() const { return m_z; }
+
+private:
+    double m_x;
+    double m_y;
+    double m_z;
+};
+
+inline Vector3 operator+(const Vector3& v1, const Vector3& v2)
+{
+    return Vector3(v1.x() + v2.x(), v1.y() + v2.y(), v1.z() + v2.z());
+}
+
+inline Vector3 operator-(const Vector3& v1, const Vector3& v2)
+{
+    return Vector3(v1.x() - v2.x(), v1.y() - v2.y(), v1.z() - v2.z());
+}
+
+inline Vector3 operator*(double k, const Vector3& v)
+{
+    return Vector3(k * v.x(), k * v.y(), k * v.z());
+}
+
+inline Vector3 operator*(const Vector3& v, double k)
+{
+    return Vector3(k * v.x(), k * v.y(), k * v.z());
+}
+
+inline double dot(const Vector3& v1, const Vector3& v2)
+{
+    return v1.x() * v2.x() + v1.y() * v2.y() + v1.z() * v2.z();
+}
+
+inline Vector3 cross(const Vector3& v1, const Vector3& v2)
+{
+    double x3 = v1.y() * v2.z() - v1.z() * v2.y();
+    double y3 = v1.z() * v2.x() - v1.x() * v2.z();
+    double z3 = v1.x() * v2.y() - v1.y() * v2.x();
+    return Vector3(x3, y3, z3);
+}
+
+inline double distance(const Vector3& v1, const Vector3& v2)
+{
+    return (v1 - v2).abs();
+}
+
+} // WebCore
+
+#endif // Vector3_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h b/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
index eb4c279cc3..3f33b290d9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
@@ -32,7 +32,7 @@ using std::pair;
 namespace WTF {
 
     template<bool isPod, typename T>
-    class VectorTraitsBase;
+    struct VectorTraitsBase;
 
     template<typename T>
     struct VectorTraitsBase<false, T>
@@ -80,9 +80,6 @@ namespace WTF {
     template<typename P>
     struct VectorTraits<OwnPtr<P> > : SimpleClassVectorTraits { };
 
-    template<typename P>
-    struct VectorTraits<std::auto_ptr<P> > : SimpleClassVectorTraits { };
-
     template<typename First, typename Second>
     struct VectorTraits<pair<First, Second> >
     {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp
index d75c17a933..6289d0464c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp
@@ -140,7 +140,6 @@
 #else
 #define NO_ERRNO
 #endif
-#include <float.h>
 #include <math.h>
 #include <stdint.h>
 #include <stdlib.h>
@@ -148,6 +147,7 @@
 #include <wtf/AlwaysInline.h>
 #include <wtf/Assertions.h>
 #include <wtf/FastMalloc.h>
+#include <wtf/MathExtras.h>
 #include <wtf/Vector.h>
 #include <wtf/Threading.h>
 
@@ -159,9 +159,9 @@
 #pragma warning(disable: 4554)
 #endif
 
-#if PLATFORM(BIG_ENDIAN)
+#if CPU(BIG_ENDIAN)
 #define IEEE_MC68k
-#elif PLATFORM(MIDDLE_ENDIAN)
+#elif CPU(MIDDLE_ENDIAN)
 #define IEEE_ARM
 #else
 #define IEEE_8087
@@ -262,7 +262,8 @@ typedef union { double d; uint32_t L[2]; } U;
 #define Pack_32
 #endif
 
-#if PLATFORM(PPC64) || PLATFORM(X86_64)
+#if CPU(PPC64) || CPU(X86_64)
+// FIXME: should we enable this on all 64-bit CPUs?
 // 64-bit emulation provided by the compiler is likely to be slower than dtoa own code on 32-bit hardware.
 #define USE_LONG_LONG
 #endif
@@ -560,7 +561,7 @@ static void mult(BigInt& aRef, const BigInt& bRef)
     aRef = c;
 }
 
-struct P5Node {
+struct P5Node : Noncopyable {
     BigInt val;
     P5Node* next;
 };
@@ -1869,7 +1870,7 @@ static ALWAYS_INLINE int quorem(BigInt& b, BigInt& S)
  *       calculation.
  */
 
-void dtoa(char* result, double dd, int ndigits, int* decpt, int* sign, char** rve)
+void dtoa(DtoaBuffer result, double dd, int ndigits, int* decpt, int* sign, char** rve)
 {
     /*
         Arguments ndigits, decpt, sign are similar to those
@@ -1908,16 +1909,23 @@ void dtoa(char* result, double dd, int ndigits, int* decpt, int* sign, char** rv
     {
         /* Infinity or NaN */
         *decpt = 9999;
-        if (!word1(&u) && !(word0(&u) & 0xfffff))
+        if (!word1(&u) && !(word0(&u) & 0xfffff)) {
             strcpy(result, "Infinity");
-        else 
+            if (rve)
+                *rve = result + 8;
+        } else {
             strcpy(result, "NaN");
+            if (rve)
+                *rve = result + 3;
+        }
         return;
     }
     if (!dval(&u)) {
         *decpt = 1;
         result[0] = '0';
         result[1] = '\0';
+        if (rve)
+            *rve = result + 1;
         return;
     }
 
@@ -2376,4 +2384,83 @@ ret:
         *rve = s;
 }
 
+static ALWAYS_INLINE void append(char*& next, const char* src, unsigned size)
+{
+    for (unsigned i = 0; i < size; ++i)
+        *next++ = *src++;
+}
+
+void doubleToStringInJavaScriptFormat(double d, DtoaBuffer buffer, unsigned* resultLength)
+{
+    ASSERT(buffer);
+
+    // avoid ever printing -NaN, in JS conceptually there is only one NaN value
+    if (isnan(d)) {
+        append(buffer, "NaN", 3);
+        if (resultLength)
+            *resultLength = 3;
+        return;
+    }
+    // -0 -> "0"
+    if (!d) {
+        buffer[0] = '0';
+        if (resultLength)
+            *resultLength = 1;
+        return;
+    }
+
+    int decimalPoint;
+    int sign;
+
+    DtoaBuffer result;
+    char* resultEnd = 0;
+    WTF::dtoa(result, d, 0, &decimalPoint, &sign, &resultEnd);
+    int length = resultEnd - result;
+
+    char* next = buffer;
+    if (sign)
+        *next++ = '-';
+
+    if (decimalPoint <= 0 && decimalPoint > -6) {
+        *next++ = '0';
+        *next++ = '.';
+        for (int j = decimalPoint; j < 0; j++)
+            *next++ = '0';
+        append(next, result, length);
+    } else if (decimalPoint <= 21 && decimalPoint > 0) {
+        if (length <= decimalPoint) {
+            append(next, result, length);
+            for (int j = 0; j < decimalPoint - length; j++)
+                *next++ = '0';
+        } else {
+            append(next, result, decimalPoint);
+            *next++ = '.';
+            append(next, result + decimalPoint, length - decimalPoint);
+        }
+    } else if (result[0] < '0' || result[0] > '9')
+        append(next, result, length);
+    else {
+        *next++ = result[0];
+        if (length > 1) {
+            *next++ = '.';
+            append(next, result + 1, length - 1);
+        }
+
+        *next++ = 'e';
+        *next++ = (decimalPoint >= 0) ? '+' : '-';
+        // decimalPoint can't be more than 3 digits decimal given the
+        // nature of float representation
+        int exponential = decimalPoint - 1;
+        if (exponential < 0)
+            exponential = -exponential;
+        if (exponential >= 100)
+            *next++ = static_cast<char>('0' + exponential / 100);
+        if (exponential >= 10)
+            *next++ = static_cast<char>('0' + (exponential % 100) / 10);
+        *next++ = static_cast<char>('0' + exponential % 10);
+    }
+    if (resultLength)
+        *resultLength = next - buffer;
+}
+
 } // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h
index cbec7c7182..6127f53972 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h
@@ -30,8 +30,18 @@ namespace WTF {
     extern WTF::Mutex* s_dtoaP5Mutex;
 
     double strtod(const char* s00, char** se);
-    void dtoa(char* result, double d, int ndigits, int* decpt, int* sign, char** rve);
+
+    typedef char DtoaBuffer[80];
+    void dtoa(DtoaBuffer result, double d, int ndigits, int* decpt, int* sign, char** rve);
+
+    // dtoa() for ECMA-262 'ToString Applied to the Number Type.'
+    // The *resultLength will have the length of the resultant string in bufer.
+    // The resultant string isn't terminated by 0.
+    void doubleToStringInJavaScriptFormat(double, DtoaBuffer, unsigned* resultLength);
 
 } // namespace WTF
 
+using WTF::DtoaBuffer;
+using WTF::doubleToStringInJavaScriptFormat;
+
 #endif // WTF_dtoa_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.cpp
index 432885f1c9..da0d83996e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.cpp
@@ -19,6 +19,9 @@
 #include "config.h"
 #include "GOwnPtr.h"
 
+#include <gio/gio.h>
+#include <glib.h>
+
 namespace WTF {
 
 template <> void freeOwnedGPtr<GError>(GError* ptr)
@@ -56,10 +59,9 @@ template <> void freeOwnedGPtr<GDir>(GDir* ptr)
         g_dir_close(ptr);
 }
 
-template <> void freeOwnedGPtr<GHashTable>(GHashTable* ptr)
+template <> void freeOwnedGPtr<GFile>(GFile* ptr)
 {
     if (ptr)
-        g_hash_table_unref(ptr);
+        g_object_unref(ptr);
 }
-
 } // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.h
new file mode 100644
index 0000000000..1fc594c9fa
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.h
@@ -0,0 +1,148 @@
+/*
+ *  Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008 Collabora Ltd.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef GOwnPtr_h
+#define GOwnPtr_h
+
+#include <algorithm>
+#include <wtf/Assertions.h>
+#include <wtf/Noncopyable.h>
+
+// Forward delcarations at this point avoid the need to include GLib includes
+// in WTF headers.
+typedef struct _GError GError;
+typedef struct _GList GList;
+typedef struct _GCond GCond;
+typedef struct _GMutex GMutex;
+typedef struct _GPatternSpec GPatternSpec;
+typedef struct _GDir GDir;
+typedef struct _GHashTable GHashTable;
+typedef struct _GFile GFile;
+extern "C" void g_free(void*);
+
+namespace WTF {
+
+template <typename T> inline void freeOwnedGPtr(T* ptr);
+template<> void freeOwnedGPtr<GError>(GError*);
+template<> void freeOwnedGPtr<GList>(GList*);
+template<> void freeOwnedGPtr<GCond>(GCond*);
+template<> void freeOwnedGPtr<GMutex>(GMutex*);
+template<> void freeOwnedGPtr<GPatternSpec>(GPatternSpec*);
+template<> void freeOwnedGPtr<GDir>(GDir*);
+template<> void freeOwnedGPtr<GHashTable>(GHashTable*);
+template<> void freeOwnedGPtr<GFile>(GFile*);
+
+template <typename T> class GOwnPtr : public Noncopyable {
+public:
+    explicit GOwnPtr(T* ptr = 0) : m_ptr(ptr) { }
+    ~GOwnPtr() { freeOwnedGPtr(m_ptr); }
+
+    T* get() const { return m_ptr; }
+    T* release()
+    {
+        T* ptr = m_ptr;
+        m_ptr = 0;
+        return ptr;
+    }
+
+    T*& outPtr()
+    {
+        ASSERT(!m_ptr);
+        return m_ptr;
+    }
+
+    void set(T* ptr)
+    {
+        ASSERT(!ptr || m_ptr != ptr);
+        freeOwnedGPtr(m_ptr);
+        m_ptr = ptr;
+    }
+
+    void clear()
+    {
+        freeOwnedGPtr(m_ptr);
+        m_ptr = 0;
+    }
+
+    T& operator*() const
+    {
+        ASSERT(m_ptr);
+        return *m_ptr;
+    }
+
+    T* operator->() const
+    {
+        ASSERT(m_ptr);
+        return m_ptr;
+    }
+
+    bool operator!() const { return !m_ptr; }
+
+    // This conversion operator allows implicit conversion to bool but not to other integer types.
+    typedef T* GOwnPtr::*UnspecifiedBoolType;
+    operator UnspecifiedBoolType() const { return m_ptr ? &GOwnPtr::m_ptr : 0; }
+
+    void swap(GOwnPtr& o) { std::swap(m_ptr, o.m_ptr); }
+
+private:
+    T* m_ptr;
+};
+
+template <typename T> inline void swap(GOwnPtr<T>& a, GOwnPtr<T>& b)
+{
+    a.swap(b);
+}
+
+template <typename T, typename U> inline bool operator==(const GOwnPtr<T>& a, U* b)
+{ 
+    return a.get() == b; 
+}
+
+template <typename T, typename U> inline bool operator==(T* a, const GOwnPtr<U>& b) 
+{
+    return a == b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const GOwnPtr<T>& a, U* b)
+{
+    return a.get() != b; 
+}
+
+template <typename T, typename U> inline bool operator!=(T* a, const GOwnPtr<U>& b)
+{ 
+    return a != b.get(); 
+}
+
+template <typename T> inline typename GOwnPtr<T>::PtrType getPtr(const GOwnPtr<T>& p)
+{
+    return p.get();
+}
+
+template <typename T> inline void freeOwnedGPtr(T* ptr)
+{
+    g_free(ptr);
+}
+
+} // namespace WTF
+
+using WTF::GOwnPtr;
+
+#endif // GOwnPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.cpp
new file mode 100644
index 0000000000..e7cf34bd4e
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.cpp
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2009 Martin Robinson
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "GRefPtr.h"
+
+#include <glib.h>
+
+namespace WTF {
+
+template <> GHashTable* refGPtr(GHashTable* ptr)
+{
+    if (ptr)
+        g_hash_table_ref(ptr);
+    return ptr;
+}
+
+template <> void derefGPtr(GHashTable* ptr)
+{
+    g_hash_table_unref(ptr);
+}
+
+} // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.h
new file mode 100644
index 0000000000..66739ef984
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.h
@@ -0,0 +1,187 @@
+/*
+ *  Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008 Collabora Ltd.
+ *  Copyright (C) 2009 Martin Robinson
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef WTF_GRefPtr_h
+#define WTF_GRefPtr_h
+
+#include "AlwaysInline.h"
+#include <algorithm>
+
+typedef struct _GHashTable GHashTable;
+
+namespace WTF {
+
+enum GRefPtrAdoptType { GRefPtrAdopt };
+template <typename T> inline T* refGPtr(T*);
+template <typename T> inline void derefGPtr(T*);
+template <typename T> class GRefPtr;
+template <typename T> GRefPtr<T> adoptGRef(T*);
+template <> GHashTable* refGPtr(GHashTable* ptr);
+template <> void derefGPtr(GHashTable* ptr);
+
+template <typename T> class GRefPtr {
+public:
+    GRefPtr() : m_ptr(0) { }
+    GRefPtr(T* ptr) : m_ptr(ptr) { if (ptr) refGPtr(ptr); }
+    GRefPtr(const GRefPtr& o) : m_ptr(o.m_ptr) { if (T* ptr = m_ptr) refGPtr(ptr); }
+    template <typename U> GRefPtr(const GRefPtr<U>& o) : m_ptr(o.get()) { if (T* ptr = m_ptr) refGPtr(ptr); }
+
+    ~GRefPtr() { if (T* ptr = m_ptr) derefGPtr(ptr); }
+
+    void clear()
+    {
+        if (T* ptr = m_ptr)
+            derefGPtr(ptr);
+        m_ptr = 0;
+    }
+
+    T* get() const { return m_ptr; }
+    T& operator*() const { return *m_ptr; }
+    ALWAYS_INLINE T* operator->() const { return m_ptr; }
+
+    bool operator!() const { return !m_ptr; }
+
+    // This conversion operator allows implicit conversion to bool but not to other integer types.
+    typedef T* GRefPtr::*UnspecifiedBoolType;
+    operator UnspecifiedBoolType() const { return m_ptr ? &GRefPtr::m_ptr : 0; }
+
+    GRefPtr& operator=(const GRefPtr&);
+    GRefPtr& operator=(T*);
+    template <typename U> GRefPtr& operator=(const GRefPtr<U>&);
+
+    void swap(GRefPtr&);
+    friend GRefPtr adoptGRef<T>(T*);
+
+private:
+    static T* hashTableDeletedValue() { return reinterpret_cast<T*>(-1); }
+    // Adopting constructor.
+    GRefPtr(T* ptr, GRefPtrAdoptType) : m_ptr(ptr) {}
+
+    T* m_ptr;
+};
+
+template <typename T> inline GRefPtr<T>& GRefPtr<T>::operator=(const GRefPtr<T>& o)
+{
+    T* optr = o.get();
+    if (optr)
+        refGPtr(optr);
+    T* ptr = m_ptr;
+    m_ptr = optr;
+    if (ptr)
+        derefGPtr(ptr);
+    return *this;
+}
+
+template <typename T> inline GRefPtr<T>& GRefPtr<T>::operator=(T* optr)
+{
+    T* ptr = m_ptr;
+    if (optr)
+        refGPtr(optr);
+    m_ptr = optr;
+    if (ptr)
+        derefGPtr(ptr);
+    return *this;
+}
+
+template <class T> inline void GRefPtr<T>::swap(GRefPtr<T>& o)
+{
+    std::swap(m_ptr, o.m_ptr);
+}
+
+template <class T> inline void swap(GRefPtr<T>& a, GRefPtr<T>& b)
+{
+    a.swap(b);
+}
+
+template <typename T, typename U> inline bool operator==(const GRefPtr<T>& a, const GRefPtr<U>& b)
+{
+    return a.get() == b.get();
+}
+
+template <typename T, typename U> inline bool operator==(const GRefPtr<T>& a, U* b)
+{
+    return a.get() == b;
+}
+
+template <typename T, typename U> inline bool operator==(T* a, const GRefPtr<U>& b)
+{
+    return a == b.get();
+}
+
+template <typename T, typename U> inline bool operator!=(const GRefPtr<T>& a, const GRefPtr<U>& b)
+{
+    return a.get() != b.get();
+}
+
+template <typename T, typename U> inline bool operator!=(const GRefPtr<T>& a, U* b)
+{
+    return a.get() != b;
+}
+
+template <typename T, typename U> inline bool operator!=(T* a, const GRefPtr<U>& b)
+{
+    return a != b.get();
+}
+
+template <typename T, typename U> inline GRefPtr<T> static_pointer_cast(const GRefPtr<U>& p)
+{
+    return GRefPtr<T>(static_cast<T*>(p.get()));
+}
+
+template <typename T, typename U> inline GRefPtr<T> const_pointer_cast(const GRefPtr<U>& p)
+{
+    return GRefPtr<T>(const_cast<T*>(p.get()));
+}
+
+template <typename T> inline T* getPtr(const GRefPtr<T>& p)
+{
+    return p.get();
+}
+
+template <typename T> GRefPtr<T> adoptGRef(T* p)
+{
+    return GRefPtr<T>(p, GRefPtrAdopt);
+}
+
+template <typename T> inline T* refGPtr(T* ptr)
+{
+    if (ptr)
+        g_object_ref_sink(ptr);
+    return ptr;
+}
+
+template <typename T> inline void derefGPtr(T* ptr)
+{
+    if (ptr)
+        g_object_unref(ptr);
+}
+
+} // namespace WTF
+
+using WTF::GRefPtr;
+using WTF::refGPtr;
+using WTF::derefGPtr;
+using WTF::adoptGRef;
+using WTF::static_pointer_cast;
+using WTF::const_pointer_cast;
+
+#endif // WTF_GRefPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
index 1fdd2bbb9c..dc04a684c3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "Threading.h"
 
+#if !ENABLE(SINGLE_THREADED)
+
 #include "CurrentTime.h"
 #include "HashMap.h"
 #include "MainThread.h"
@@ -64,6 +66,21 @@ void ThreadPrivate::run()
     m_returnValue = m_entryPoint(m_data);
 }
 
+class ThreadMonitor : public QObject {
+    Q_OBJECT
+public:
+    static ThreadMonitor * instance()
+    {
+        static ThreadMonitor *instance = new ThreadMonitor();
+        return instance;
+    }
+
+public Q_SLOTS:
+    void threadFinished()
+    {
+        sender()->deleteLater();
+    }
+};
 
 static Mutex* atomicallyInitializedStaticMutex;
 
@@ -155,6 +172,9 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
         LOG_ERROR("Failed to create thread at entry point %p with data %p", entryPoint, data);
         return 0;
     }
+
+    QObject::connect(thread, SIGNAL(finished()), ThreadMonitor::instance(), SLOT(threadFinished()));
+
     thread->start();
 
     QThread* threadRef = static_cast<QThread*>(thread);
@@ -162,7 +182,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
     return establishIdentifierForThread(threadRef);
 }
 
-void setThreadNameInternal(const char*)
+void initializeCurrentThreadInternal(const char*)
 {
 }
 
@@ -181,8 +201,10 @@ int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
     return !res;
 }
 
-void detachThread(ThreadIdentifier)
+void detachThread(ThreadIdentifier threadID)
 {
+    ASSERT(threadID);
+    clearThreadForIdentifier(threadID);
 }
 
 ThreadIdentifier currentThread()
@@ -267,3 +289,7 @@ void ThreadCondition::broadcast()
 }
 
 } // namespace WebCore
+
+#include "ThreadingQt.moc"
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/BlockAllocatorSymbian.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/BlockAllocatorSymbian.cpp
index cc8fd15a9e..6a28e9ef4f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/BlockAllocatorSymbian.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/BlockAllocatorSymbian.cpp
@@ -28,7 +28,7 @@
 
 #include "config.h"
 
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
 
 #include "BlockAllocatorSymbian.h"
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Collator.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Collator.h
index 51e8a063f2..fe6a8096ce 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Collator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Collator.h
@@ -29,8 +29,8 @@
 #ifndef WTF_Collator_h
 #define WTF_Collator_h
 
-#include <memory>
 #include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/unicode/Unicode.h>
 
 #if USE(ICU_UNICODE) && !UCONFIG_NO_COLLATION
@@ -47,7 +47,7 @@ namespace WTF {
         ~Collator();
         void setOrderLowerFirst(bool);
 
-        static std::auto_ptr<Collator> userDefault();
+        static PassOwnPtr<Collator> userDefault();
 
         Result collate(const ::UChar*, size_t, const ::UChar*, size_t) const;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/CollatorDefault.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/CollatorDefault.cpp
index eddbe534ff..4e05432243 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/CollatorDefault.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/CollatorDefault.cpp
@@ -45,9 +45,9 @@ void Collator::setOrderLowerFirst(bool)
 {
 }
 
-std::auto_ptr<Collator> Collator::userDefault()
+PassOwnPtr<Collator> Collator::userDefault()
 {
-    return std::auto_ptr<Collator>(new Collator(0));
+    return new Collator(0);
 }
 
 // A default implementation for platforms that lack Unicode-aware collation.
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/UTF8.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/UTF8.cpp
index 9e713fe364..21d58563cc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/UTF8.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/UTF8.cpp
@@ -23,6 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
 #include "UTF8.h"
 
 namespace WTF {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
index 7016a039f8..d59439dc83 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
@@ -26,11 +26,7 @@
 #include <wtf/Assertions.h>
 
 #if USE(QT4_UNICODE)
-#if COMPILER(WINSCW) || COMPILER(RVCT)
-#include "wtf/unicode/qt4/UnicodeQt4.h"
-#else
 #include "qt4/UnicodeQt4.h"
-#endif
 #elif USE(ICU_UNICODE)
 #include <wtf/unicode/icu/UnicodeIcu.h>
 #elif USE(GLIB_UNICODE)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
index a779b36809..e20c376e44 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
@@ -19,6 +19,7 @@
  *
  */
 
+#include "config.h"
 #include "UnicodeGLib.h"
 
 namespace WTF {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
index c03d3ec3b1..46b00ea89c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
@@ -26,7 +26,7 @@
 #define UnicodeGLib_h
 
 #include "UnicodeMacrosFromICU.h"
-#include <wtf/GOwnPtr.h>
+#include "GOwnPtr.h"
 
 #include <glib.h>
 #include <pango/pango.h>
@@ -152,6 +152,11 @@ inline bool isArabicChar(UChar32 c)
     return c >= 0x0600 && c <= 0x06FF;
 }
 
+inline bool isAlphanumeric(UChar32 c)
+{
+    return g_unichar_isalnum(c);
+}
+
 inline bool isFormatChar(UChar32 c)
 {
     return g_unichar_type(c) == G_UNICODE_FORMAT;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp
index 6376bb31fe..ecab5bdc37 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp
@@ -36,7 +36,7 @@
 #include <unicode/ucol.h>
 #include <string.h>
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 #include "RetainPtr.h"
 #include <CoreFoundation/CoreFoundation.h>
 #endif
@@ -57,11 +57,11 @@ Collator::Collator(const char* locale)
 {
 }
 
-std::auto_ptr<Collator> Collator::userDefault()
+PassOwnPtr<Collator> Collator::userDefault()
 {
-#if PLATFORM(DARWIN) && PLATFORM(CF)
+#if OS(DARWIN) && PLATFORM(CF)
     // Mac OS X doesn't set UNIX locale to match user-selected one, so ICU default doesn't work.
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !OS(IPHONE_OS)
     RetainPtr<CFLocaleRef> currentLocale(AdoptCF, CFLocaleCopyCurrent());
     CFStringRef collationOrder = (CFStringRef)CFLocaleGetValue(currentLocale.get(), kCFLocaleCollatorIdentifier);
 #else
@@ -71,11 +71,11 @@ std::auto_ptr<Collator> Collator::userDefault()
     char buf[256];
     if (collationOrder) {
         CFStringGetCString(collationOrder, buf, sizeof(buf), kCFStringEncodingASCII);
-        return std::auto_ptr<Collator>(new Collator(buf));
+        return new Collator(buf);
     } else
-        return std::auto_ptr<Collator>(new Collator(""));
+        return new Collator("");
 #else
-    return std::auto_ptr<Collator>(new Collator(0));
+    return new Collator(0);
 #endif
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
index 35c6fbfd7b..a2a5c0a576 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
@@ -164,6 +164,11 @@ inline bool isArabicChar(UChar32 c)
       return ublock_getCode(c) == UBLOCK_ARABIC;
 }
 
+inline bool isAlphanumeric(UChar32 c)
+{
+    return u_isalnum(c);
+}
+
 inline bool isSeparatorSpace(UChar32 c)
 {
     return u_charType(c) == U_SPACE_SEPARATOR;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
index bdf20287ad..9b1754a207 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
@@ -30,7 +30,6 @@
 
 #include <stdint.h>
 
-#if QT_VERSION >= 0x040300
 QT_BEGIN_NAMESPACE
 namespace QUnicodeTables {
     struct Properties {
@@ -55,10 +54,9 @@ namespace QUnicodeTables {
     Q_CORE_EXPORT const Properties * QT_FASTCALL properties(ushort ucs2);
 }
 QT_END_NAMESPACE
-#endif
 
 // ugly hack to make UChar compatible with JSChar in API/JSStringRef.h
-#if defined(Q_OS_WIN) || COMPILER(WINSCW)
+#if defined(Q_OS_WIN) || COMPILER(WINSCW) || COMPILER(RVCT)
 typedef wchar_t UChar;
 #else
 typedef uint16_t UChar;
@@ -186,8 +184,6 @@ enum CharCategory {
 };
 
 
-#if QT_VERSION >= 0x040300
-
 // FIXME: handle surrogates correctly in all methods
 
 inline UChar32 toLower(UChar32 ch)
@@ -406,138 +402,6 @@ inline CharCategory category(UChar32 c)
     return (CharCategory) U_MASK(QChar::category(c));
 }
 
-#else
-
-inline UChar32 toLower(UChar32 ch)
-{
-    if (ch > 0xffff)
-        return ch;
-    return QChar((unsigned short)ch).toLower().unicode();
-}
-
-inline int toLower(UChar* result, int resultLength, const UChar* src, int srcLength,  bool* error)
-{
-  *error = false;
-  if (resultLength < srcLength) {
-    *error = true;
-    return srcLength;
-  }
-  for (int i = 0; i < srcLength; ++i)
-    result[i] = QChar(src[i]).toLower().unicode();
-  return srcLength;
-}
-
-inline UChar32 toUpper(UChar32 ch)
-{
-    if (ch > 0xffff)
-        return ch;
-    return QChar((unsigned short)ch).toUpper().unicode();
-}
-
-inline int toUpper(UChar* result, int resultLength, const UChar* src, int srcLength,  bool* error)
-{
-    *error = false;
-    if (resultLength < srcLength) {
-        *error = true;
-        return srcLength;
-    }
-    for (int i = 0; i < srcLength; ++i)
-        result[i] = QChar(src[i]).toUpper().unicode();
-    return srcLength;
-}
-
-inline int toTitleCase(UChar32 c)
-{
-    if (c > 0xffff)
-        return c;
-    return QChar((unsigned short)c).toUpper().unicode();
-}
-
-inline UChar32 foldCase(UChar32 c)
-{
-    if (c > 0xffff)
-        return c;
-    return QChar((unsigned short)c).toLower().unicode();
-}
-
-inline int foldCase(UChar* result, int resultLength, const UChar* src, int srcLength,  bool* error)
-{
-    return toLower(result, resultLength, src, srcLength, error);
-}
-
-inline bool isPrintableChar(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).isPrint();
-}
-
-inline bool isArabicChar(UChar32 c)
-{
-    return c >= 0x0600 && c <= 0x06FF;
-}
-
-inline bool isSeparatorSpace(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).category() == QChar::Separator_Space;
-}
-
-inline bool isPunct(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).isPunct();
-}
-
-inline bool isLower(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).category() == QChar::Letter_Lowercase;
-}
-
-inline UChar32 mirroredChar(UChar32 c)
-{
-    if (c > 0xffff)
-        return c;
-    return QChar(c).mirroredChar().unicode();
-}
-
-inline uint8_t combiningClass(UChar32 c)
-{
-    if (c > 0xffff)
-        return 0;
-    return QChar((unsigned short)c).combiningClass();
-}
-
-inline DecompositionType decompositionType(UChar32 c)
-{
-    if (c > 0xffff)
-        return DecompositionNone;
-    return (DecompositionType)QChar(c).decompositionTag();
-}
-
-inline int umemcasecmp(const UChar* a, const UChar* b, int len)
-{
-    for (int i = 0; i < len; ++i) {
-        QChar c1 = QChar(a[i]).toLower();
-        QChar c2 = QChar(b[i]).toLower();
-        if (c1 != c2)
-        return c1.unicode() - c2.unicode();
-    }
-    return 0;
-}
-
-inline Direction direction(UChar32 c)
-{
-    if (c > 0xffff)
-        return LeftToRight;
-    return (Direction)QChar(c).direction();
-}
-
-inline CharCategory category(UChar32 c)
-{
-    if (c > 0xffff)
-        return NoCategory;
-    return (CharCategory) U_MASK(QChar(c).category());
-}
-
-#endif
-
 } }
 
 #endif // WTF_UNICODE_QT4_H
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
index 966f2a1767..2df44f8d9e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
@@ -19,6 +19,7 @@
  *  Boston, MA 02110-1301, USA.
  */
 
+#include "config.h"
 #include "UnicodeWince.h"
 
 #include <wchar.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/wince/FastMallocWince.h b/src/3rdparty/webkit/JavaScriptCore/wtf/wince/FastMallocWince.h
index 93d9f75956..37174f01eb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/wince/FastMallocWince.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/wince/FastMallocWince.h
@@ -1,5 +1,4 @@
 /*
- *  This file is part of the KDE libraries
  *  Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2007-2009 Torch Mobile, Inc. All rights reserved
  *
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/wince/MemoryManager.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/wince/MemoryManager.cpp
index b65b368235..81d4f805be 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/wince/MemoryManager.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/wince/MemoryManager.cpp
@@ -139,25 +139,25 @@ void* fastZeroedMalloc(size_t n)
     return p;
 }
 
-void* tryFastMalloc(size_t n)
+TryMallocReturnValue tryFastMalloc(size_t n)
 {
     MemoryAllocationCanFail canFail;
     return fastMalloc(n);
 }
 
-void* tryFastZeroedMalloc(size_t n)
+TryMallocReturnValue tryFastZeroedMalloc(size_t n)
 {
     MemoryAllocationCanFail canFail;
     return fastZeroedMalloc(n);
 }
 
-void* tryFastCalloc(size_t n_elements, size_t element_size)
+TryMallocReturnValue tryFastCalloc(size_t n_elements, size_t element_size)
 {
     MemoryAllocationCanFail canFail;
     return fastCalloc(n_elements, element_size);
 }
 
-void* tryFastRealloc(void* p, size_t n)
+TryMallocReturnValue tryFastRealloc(void* p, size_t n)
 {
     MemoryAllocationCanFail canFail;
     return fastRealloc(p, n);
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp
index c7b3c8119f..9cd3d123c1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp
@@ -708,7 +708,7 @@ const char* compileRegex(const UString& patternString, RegexPattern& pattern)
         unsigned numSubpatterns = pattern.m_numSubpatterns;
 
         constructor.reset();
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
         const char* error =
 #endif
             parse(constructor, patternString, numSubpatterns);
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h
index 3ed2be9e4a..9d2443a591 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h
@@ -26,13 +26,11 @@
 #ifndef RegexCompiler_h
 #define RegexCompiler_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(YARR)
 
-#include <wtf/unicode/Unicode.h>
 #include "RegexParser.h"
 #include "RegexPattern.h"
+#include <wtf/unicode/Unicode.h>
 
 namespace JSC { namespace Yarr {
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
index d0880866a3..c2cb1c28ab 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
@@ -280,20 +280,6 @@ public:
         return false;
     }
 
-    bool tryConsumeCharacter(int testChar)
-    {
-        if (input.atEnd())
-            return false;
-
-        int ch = input.read();
-
-        if (pattern->m_ignoreCase ? ((Unicode::toLower(testChar) == ch) || (Unicode::toUpper(testChar) == ch)) : (testChar == ch)) {
-            input.next();
-            return true;
-        }
-        return false;
-    }
-
     bool checkCharacter(int testChar, int inputPosition)
     {
         return testChar == input.readChecked(inputPosition);
@@ -305,23 +291,6 @@ public:
         return (loChar == ch) || (hiChar == ch);
     }
 
-    bool tryConsumeCharacterClass(CharacterClass* characterClass, bool invert)
-    {
-        if (input.atEnd())
-            return false;
-
-        bool match = testCharacterClass(characterClass, input.read());
-
-        if (invert)
-            match = !match;
-
-        if (match) {
-            input.next();
-            return true;
-        }
-        return false;
-    }
-
     bool checkCharacterClass(CharacterClass* characterClass, bool invert, int inputPosition)
     {
         bool match = testCharacterClass(characterClass, input.readChecked(inputPosition));
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
index 48c9a5ef85..e3c3122281 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
@@ -26,13 +26,11 @@
 #ifndef RegexInterpreter_h
 #define RegexInterpreter_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(YARR)
 
-#include <wtf/unicode/Unicode.h>
 #include "RegexParser.h"
 #include "RegexPattern.h"
+#include <wtf/unicode/Unicode.h>
 
 namespace JSC { namespace Yarr {
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
index 5ce579ab27..271d4535eb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
@@ -44,7 +44,7 @@ namespace JSC { namespace Yarr {
 class RegexGenerator : private MacroAssembler {
     friend void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline);
 
-#if PLATFORM(ARM)
+#if CPU(ARM)
     static const RegisterID input = ARMRegisters::r0;
     static const RegisterID index = ARMRegisters::r1;
     static const RegisterID length = ARMRegisters::r2;
@@ -54,7 +54,17 @@ class RegexGenerator : private MacroAssembler {
     static const RegisterID regT1 = ARMRegisters::r6;
 
     static const RegisterID returnRegister = ARMRegisters::r0;
-#elif PLATFORM(X86)
+#elif CPU(MIPS)
+    static const RegisterID input = MIPSRegisters::a0;
+    static const RegisterID index = MIPSRegisters::a1;
+    static const RegisterID length = MIPSRegisters::a2;
+    static const RegisterID output = MIPSRegisters::a3;
+
+    static const RegisterID regT0 = MIPSRegisters::t4;
+    static const RegisterID regT1 = MIPSRegisters::t5;
+
+    static const RegisterID returnRegister = MIPSRegisters::v0;
+#elif CPU(X86)
     static const RegisterID input = X86Registers::eax;
     static const RegisterID index = X86Registers::edx;
     static const RegisterID length = X86Registers::ecx;
@@ -64,7 +74,7 @@ class RegexGenerator : private MacroAssembler {
     static const RegisterID regT1 = X86Registers::esi;
 
     static const RegisterID returnRegister = X86Registers::eax;
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
     static const RegisterID input = X86Registers::edi;
     static const RegisterID index = X86Registers::esi;
     static const RegisterID length = X86Registers::edx;
@@ -1288,11 +1298,11 @@ class RegexGenerator : private MacroAssembler {
 
     void generateEnter()
     {
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         push(X86Registers::ebp);
         move(stackPointerRegister, X86Registers::ebp);
         push(X86Registers::ebx);
-#elif PLATFORM(X86)
+#elif CPU(X86)
         push(X86Registers::ebp);
         move(stackPointerRegister, X86Registers::ebp);
         // TODO: do we need spill registers to fill the output pointer if there are no sub captures?
@@ -1308,28 +1318,32 @@ class RegexGenerator : private MacroAssembler {
     #else
         loadPtr(Address(X86Registers::ebp, 2 * sizeof(void*)), output);
     #endif
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
         push(ARMRegisters::r4);
         push(ARMRegisters::r5);
         push(ARMRegisters::r6);
         move(ARMRegisters::r3, output);
+#elif CPU(MIPS)
+        // Do nothing.
 #endif
     }
 
     void generateReturn()
     {
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         pop(X86Registers::ebx);
         pop(X86Registers::ebp);
-#elif PLATFORM(X86)
+#elif CPU(X86)
         pop(X86Registers::esi);
         pop(X86Registers::edi);
         pop(X86Registers::ebx);
         pop(X86Registers::ebp);
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
         pop(ARMRegisters::r6);
         pop(ARMRegisters::r5);
         pop(ARMRegisters::r4);
+#elif CPU(MIPS)
+        // Do nothing
 #endif
         ret();
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
index 1872f21009..fd765bc204 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
@@ -26,8 +26,6 @@
 #ifndef RegexJIT_h
 #define RegexJIT_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(YARR_JIT)
 
 #include "MacroAssembler.h"
@@ -37,7 +35,7 @@
 #include <pcre.h>
 struct JSRegExp; // temporary, remove when fallback is removed.
 
-#if PLATFORM(X86) && !COMPILER(MSVC)
+#if CPU(X86) && !COMPILER(MSVC)
 #define YARR_CALL __attribute__ ((regparm (3)))
 #else
 #define YARR_CALL
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h
index 64e8463054..c946c2e8e4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h
@@ -26,14 +26,12 @@
 #ifndef RegexParser_h
 #define RegexParser_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(YARR)
 
 #include <UString.h>
+#include <limits.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/unicode/Unicode.h>
-#include <limits.h>
 
 namespace JSC { namespace Yarr {
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h
index a4511318ba..2e8f4689c0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h
@@ -26,7 +26,6 @@
 #ifndef RegexPattern_h
 #define RegexPattern_h
 
-#include <wtf/Platform.h>
 
 #if ENABLE(YARR)
 
@@ -137,7 +136,7 @@ struct PatternTerm {
 
     PatternTerm(unsigned spatternId)
         : type(TypeBackReference)
-        , invertOrCapture(invertOrCapture)
+        , invertOrCapture(false)
     {
         subpatternId = spatternId;
         quantityType = QuantifierFixedCount;
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
deleted file mode 100644
index 4de7ad868e..0000000000
--- a/src/3rdparty/webkit/VERSION
+++ /dev/null
@@ -1,11 +0,0 @@
-This is a snapshot of the Qt port of WebKit from
-
-        git://gitorious.org/qtwebkit/qtwebkit.git
-
-The commit imported was from the
-
-        qtwebkit/qtwebkit-4.6 branch/tag
-
-and has the sha1 checksum
-
-        ecfa4583e573ce4dff1f0df12f6bdba3022376e5
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 2bd506beb1..3eedeffa73 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,23034 +1,12061 @@
-2010-03-25  yael aharon  <yael.aharon@nokia.com>
+2010-04-05  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Reviewed by Laszlo Gombos.
-
-        [Qt] Windowed netscape plugins don't work with QGraphicsWebView on Symbian
-        https://bugs.webkit.org/show_bug.cgi?id=35112
-
-        Add a proxy widget when loading a QWidget based plugin in a QGraphicsWebView.
-
-        * plugins/symbian/PluginContainerSymbian.cpp:
-        (PluginContainerSymbian::PluginContainerSymbian):
-        (PluginContainerSymbian::focusInEvent):
-        * plugins/symbian/PluginContainerSymbian.h:
-        (WebCore::PluginContainerSymbian::proxy):
-        * plugins/symbian/PluginViewSymbian.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::platformStart):
-        (WebCore::PluginView::platformDestroy):
-
-2010-03-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed for the Qt 4.6 branch by Simon Hausmann.
-
-        Accept XHTML-MP content type as XHTML content
-        https://bugs.webkit.org/show_bug.cgi?id=34262
-
-        Enable processing XHTML-MP mime type as an XHTML document
-        even if XHTML-MP support is not enabled.
-
-        * platform/MIMETypeRegistry.cpp:
-        (WebCore::initializeSupportedNonImageMimeTypes):
-
-2010-03-22  Jakub Wieczorek  <jwieczorek@webkit.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Simon Hausmann.
+        [Qt] Maemo5 theme - wrong spelling
+        https://bugs.webkit.org/show_bug.cgi?id=37110
 
-        [Qt] Don't construct a QLineEdit every time when painting a text field
-        https://bugs.webkit.org/show_bug.cgi?id=36373
-
-        Instead, keep one instance per RenderTheme around.
+        Correcting wrong spelling in RenderThemeQt.cpp.
 
         * platform/qt/RenderThemeQt.cpp:
-        (WebCore::findFrameLineWidth):
-
-2010-03-26  Janne Koskinen  <janne.p.koskinen@digia.com>
-
-        Reviewed by Laszlo Gombos.
 
-        Don't undefine SKIP_STATIC_CONSTRUCTORS_ON_GCC for Symbian HW targets.
-        https://bugs.webkit.org/show_bug.cgi?id=34081
+2010-04-01  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Defining StringImpl instances as globals will cause a crash on process exit as 
-        StringImpl::Remove expects TLS which was already deleted at time of exiting main and ends up
-        constructing one exiting thread.
-
-        * config.h:
-
-2010-02-02  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=34076
-        <rdar://problem/7594601> Crash in mangleme in WebCore::Element::getAttribute
-
-        Test: fast/forms/misplaced-img-form-registration.html
-
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::registerImgElement): Assert that the same image isn't added
-        to vector again.
-        (WebCore::HTMLFormElement::removeImgElement): Similarly, assert that we're removing something
-        that's actually registered.
-
-        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::~HTMLImageElement): If parser fails
-        to insert the image element, then there will be no removed from tree notification either,
-        need to unregister right away.
-
-2010-01-25  Alexey Proskuryakov  <ap@apple.com>
-
-        Rubber-stamped by Geoffrey Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=34076
-        An image remains accessible via form.property syntax after being removed from document.
-
-        Fix crashing regression tests (tables/mozilla/bugs/bug4527.html et al.)
-
-        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::insertedIntoTree): Remove incorrect
-        assertions added in the previous patch - it's mot true that m_for is always a parent; table
-        parsing can reparent the image element, but m_form still needs to be set.
-
-2010-01-25  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=34076
-        An image remains accessible via form.property syntax after being removed from document.
-
-        Tests: fast/forms/removed-image-as-property.html
-               fast/forms/reparented-image-as-property.html
-
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::~HTMLImageElement): This is called during GC - not a good time
-        to make observable changes to DOM.
-        (WebCore::HTMLImageElement::insertedIntoTree): This is the right place to do any work that
-        depends on connectedness to some ancestor. We still allow for m_form to be set via constructor,
-        which happens during parsing.
-        (WebCore::HTMLImageElement::removedFromTree): Ditto.
-
-        * html/HTMLImageElement.h: Added removedFromTree/insertedIntoTree, moved removedFromDocument
-        and insertedIntoDocument to private section, as they shouldn't be called directly.
-
-2009-12-08  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Navigating to a cached page can result in accessing a destroyed HTMLInputElement.
-        <rdar://problem/6856662> and https://webkit.org/b/32293
-
-        Test: fast/loader/input-element-page-cache-crash.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute): Make sure to unregister for the activation
-          callback after the new m_autocomplete setting has been stored so the unregistration actually
-          takes place.
-
-2009-12-13  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7341364> Crash at HTMLParser::popOneBlockCommon() after
-        handling misnested residual style tags
-
-        Test: fast/parser/residual-style-close-ref-clone.html
-
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks): Gave the
-        block stack a strong reference to the cloned residual style element. 
-
-2009-12-23  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        <rdar://problem/7487164> First line of text cannot be selected
-        https://bugs.webkit.org/show_bug.cgi?id=32749
+        [Qt] Maemo5 theme - <select multiple> custom rendering
+        https://bugs.webkit.org/show_bug.cgi?id=36369
 
-        Test: fast/text/remove-zero-length-run.html
+        Customizing rendering of <select multiple> elements in Maemo5.
 
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::positionLineBox): Changed code that assumed that if a box was being
-            removed, it was the only box in the RenderText. Instead, correctly preserve the list of
-            text boxes.
-        (WebCore::RenderText::checkConsistency): Updated for earlier rename.
+        * platform/qt/Maemo5Webstyle.cpp:
+        (Maemo5WebStyle::drawMultipleComboButton):
+        (Maemo5WebStyle::drawSimpleComboButton):
+        (Maemo5WebStyle::getButtonImageSize):
+        (Maemo5WebStyle::findComboButton):
+        (Maemo5WebStyle::drawComplexControl):
+        * platform/qt/Maemo5Webstyle.h:
 
-2009-12-10  Oliver Hunt  <oliver@apple.com>
+2010-03-31  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Reviewed by Alexey Proskuryakov.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Crash in XMLTokenizer::popCurrentNode if window.close() is called during parsing
-        https://bugs.webkit.org/show_bug.cgi?id=31576
+        [Qt] Maemo5 theme - form controls style
+        https://bugs.webkit.org/show_bug.cgi?id=36370
 
-        Add a RefCounted wrapper object around xmlParserCtxtPtr so we can
-        maintain it's lifetime more effectively.
+        Adjusting Mameo5 form elements rendering.
 
-        Test: fast/parser/xhtml-close-while-parsing.xhtml
+        * WebCore.pri:
+        * WebCore.pro:
+        * css/themeQtMaemo5.css: Added.
+        (select):
+        (select:disabled):
+        (select:active):
+        (select:active:disabled):
+        (textarea):
+        (textarea:disabled):
+        (textarea:active):
+        * platform/qt/Maemo5Webstyle.cpp: Added.
+        (Maemo5WebStyle::Maemo5WebStyle):
+        (drawRectangularControlBackgorund):
+        (Maemo5WebStyle::drawChecker):
+        (Maemo5WebStyle::findChecker):
+        (Maemo5WebStyle::drawRadio):
+        (Maemo5WebStyle::findRadio):
+        (Maemo5WebStyle::drawControl):
+        (Maemo5WebStyle::drawComplexControl):
+        * platform/qt/Maemo5Webstyle.h: Added.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::isControlStyled):
+        (WebCore::RenderThemeQt::popupInternalPaddingBottom):
+        (WebCore::RenderThemeQt::extraDefaultStyleSheet):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        * platform/qt/RenderThemeQt.h:
 
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::popCurrentNode):
-        * dom/XMLTokenizer.h:
-        (WebCore::XMLParserContext::context):
-        (WebCore::XMLParserContext::XMLParserContext):
-        (WebCore::XMLTokenizer::context):
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLParserContext::createStringParser):
-        (WebCore::XMLParserContext::createMemoryParser):
-        (WebCore::XMLParserContext::~XMLParserContext):
-        (WebCore::XMLTokenizer::~XMLTokenizer):
-        (WebCore::XMLTokenizer::doWrite):
-        (WebCore::XMLTokenizer::initializeParserContext):
-        (WebCore::XMLTokenizer::doEnd):
-        (WebCore::XMLTokenizer::lineNumber):
-        (WebCore::XMLTokenizer::columnNumber):
-        (WebCore::XMLTokenizer::stopParsing):
-        (WebCore::parseXMLDocumentFragment):
-        (WebCore::parseAttributes):
+2010-04-05  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-2009-11-09  Anders Carlsson  <andersca@apple.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Darin Adler and Dan Bernstein.
+        [Symbian] Consolidate Symbian WINSCW environment configuration
+        https://bugs.webkit.org/show_bug.cgi?id=37100
 
-        <rdar://problem/7328395>
-        https://bugs.webkit.org/show_bug.cgi?id=31277
+        Move the "undefinition" of WIN32 and _WIN32 from WebCore/config.h
+        to JavaScriptCore/wtf/Platform.h as it is not specific to WebCore.
 
-        When an object tag's style changes (for example when child nodes are added/removed),
-        reuse its Frame (if it has one) instead of creating multiple Frames.
+        No new tests as there is no new functionality.
 
-        Test: fast/dom/HTMLObjectElement/children-changed.html
+        * config.h:
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::requestObject):
+2010-04-05  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-2009-12-05  Adam Langley  <agl@google.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Adam Barth.
+        Consolidate the definition of SKIP_STATIC_CONSTRUCTORS_ON_GCC
 
-        Check that a CSS format() argument is of a valid type.
+        Instead of defining and undefining it later, let's not
+        define SKIP_STATIC_CONSTRUCTORS_ON_GCC for WINSCW.
 
-        https://bugs.webkit.org/show_bug.cgi?id=31815
-        http://code.google.com/p/chromium/issues/detail?id=28582
+        No new tests as there is no new functionality.
 
-        Test: fast/css/url-format-non-string.html
+        * config.h:
 
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFontFaceSrc):
+2010-03-30  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-2010-03-19  Miikka Heikkinen  <miikka.heikkinen@digia.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Simon Hausmann.
+        [Qt] Maemo5 theme - QtMaemoWebPopup class
+        https://bugs.webkit.org/show_bug.cgi?id=36790
 
-        [Qt] Support for QT_LIBINFIX in Symbian builds
+        Moving maemo5 theme related code from WebCore.pri to WebCore.pro and adding
+        new maemo menu lists popup class source and header to the project.
 
-        Configuring Qt with -qtlibinfix parameter will enable installing
-        an alternate version of Qt on devices that already have it on ROM.
-        This patch provides support for infixed builds of Webkit.
+        The code was in .pri file because of a theme css that was conditionally included.
+        As the css file is been included unconditionally there is no need to this
+        code to be kept in webcore.pri.
 
+        * WebCore.pri:
         * WebCore.pro:
 
-2010-01-31  Benjamin Poulain  <benjamin.poulain@nokia.com>
+2010-04-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
         Reviewed by Eric Seidel.
 
-        [Qt] Enable FAST_MOBILE_SCROLLING on Qt embedded platforms
-        https://bugs.webkit.org/show_bug.cgi?id=34168
-
-        Enable FAST_MOBILE_SCROLLING for Qt on Maemo 5, Linux embedded
-        and Symbian
-
-        * WebCore.pro:
-
-2010-01-19  Daniel Bates  <dbates@rim.com>
-
-        Reviewed by Adam Treat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=33408
-
-        Implements an optimization to ignore fixed background images
-        (i.e. background-attachment: fixed) when a page does not contain
-        any fixed position elements so as to allow fast repaints (via bit
-        blit) when scrolling a page.
-
-        Currently, if a page has elements that specify either a fixed
-        background or a fixed position then we perform a slow repaint
-        (i.e disable blitting) so as to avoid rendering artifacts.
-        However, on low-powered/mobile devices slow repaints can cause
-        noticeable delays when scrolling a page with a fixed background
-        image. By sacrificing support for fixed background images when
-        there are no fixed elements on the page and with come care, we
-        don't need to force slow repaints and can avoid rendering artifacts.
-        Hence, on such devices we can improve the responsiveness of
-        scrolling a page with a fixed background image.
-
-        Note, this optimization is only enabled if the WebKit is built
-        with FAST_MOBILE_SCROLLING enabled.
-
-        Tests: fast/fast-mobile-scrolling/fixed-position-element.html
-               fast/fast-mobile-scrolling/no-fixed-position-elements.html
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
-        Disable fixed background attachment if we can blit on scroll.
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::styleWillChange):
-
-2010-03-11  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Avoid double-buffering with Qt image decoders
-
-        Pass QIODevice::Unbuffered when opening the QBuffer that
-        wraps the image data, to hint to Qt that no extra buffering
-        is needed.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::setData):
-
-2010-01-14  Diego Gonzalez  <diego.gonzalez@openbossa.org>
-
-        Reviewed by Kenneth Christiansen.
-
-        [Qt] Missing fileSystemPath() method in Qt KURL implementation
-        https://bugs.webkit.org/show_bug.cgi?id=33614
-
-        No new tests.
-
-        * platform/qt/KURLQt.cpp:
-        (WebCore::KURL::fileSystemPath):
-
-2010-02-01  Andreas Kling  <andreas.kling@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
+        Accept XHTML-MP content type as XHTML content
+        https://bugs.webkit.org/show_bug.cgi?id=34262
 
-        [Qt] In the StyledPainter determine the style from the Render and Scrollbar theme instead of from the paint device
-        https://bugs.webkit.org/show_bug.cgi?id=34054
+        Enable processing XHTML-MP mime type as an XHTML document
+        even if XHTML-MP support is not enabled.
 
-        Getting the style from the painter's paint device is a hack that breaks when
-        the paint device's style is different than the style that is used when
-        calculating the metries earlier when there is no painter available.
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
 
-        This change moves us closer to always using the same style.
+2010-04-01  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::StylePainter::StylePainter):
-        (WebCore::StylePainter::init):
-        (WebCore::RenderThemeQt::paintButton):
-        (WebCore::RenderThemeQt::paintTextField):
-        (WebCore::RenderThemeQt::paintMenuList):
-        (WebCore::RenderThemeQt::paintMenuListButton):
-        (WebCore::RenderThemeQt::paintSliderTrack):
-        (WebCore::RenderThemeQt::paintMediaMuteButton):
-        (WebCore::RenderThemeQt::paintMediaPlayButton):
-        (WebCore::RenderThemeQt::paintMediaSliderTrack):
-        (WebCore::RenderThemeQt::paintMediaSliderThumb):
-        * platform/qt/RenderThemeQt.h:
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::ScrollbarThemeQt::paint):
-        (WebCore::ScrollbarThemeQt::hitTest):
-        (WebCore::ScrollbarThemeQt::shouldCenterOnThumb):
-        (WebCore::ScrollbarThemeQt::scrollbarThickness):
-        (WebCore::ScrollbarThemeQt::thumbLength):
-        (WebCore::ScrollbarThemeQt::trackPosition):
-        (WebCore::ScrollbarThemeQt::trackLength):
-        (WebCore::ScrollbarThemeQt::paintScrollCorner):
-        (WebCore::ScrollbarThemeQt::style):
-        * platform/qt/ScrollbarThemeQt.h:
+        Reviewed by Dave Hyatt.
 
-2010-01-25  Simon Hausmann  <hausmann@webkit.org>
+        iframe flattening doesn't flatten
+        https://bugs.webkit.org/show_bug.cgi?id=36798
 
-        Reviewed by Kenneth Rohde Christiansen.
+        Fixed to the iframe flattening code so that the iframes on
+        http://www.samisite.com/test-csb2nf/id43.htm are actually
+        flattened.
 
-        [Qt] Use the fallback style on Maemo 5
+        Covered by current tests.
 
-        https://bugs.webkit.org/show_bug.cgi?id=34376
+        * page/FrameView.cpp: Propagate contents changes of iframes
+        and subframes in framesets to the parent so that it is relayouted
+        (WebCore::FrameView::setContentsSize):
+        (WebCore::FrameView::adjustViewSize):
+        (WebCore::FrameView::scheduleRelayout):
+        * rendering/RenderPart.cpp: HTMLIFrameElement do not inherit from
+        HTMLFrameElement, but HTMLFrameElementBase, correct cast. Correct
+        the use of inset border values. Avoid a sometimes unnecessary
+        relayout.
+        (WebCore::RenderPart::layoutWithFlattening):
+        * rendering/RenderPartObject.cpp: Make the calcHeight and calcWidth
+        return the right values, considering scrolling and fixed width/height
+        (WebCore::RenderPartObject::flattenFrame):
+        (WebCore::RenderPartObject::calcHeight):
+        (WebCore::RenderPartObject::calcWidth):
+        (WebCore::RenderPartObject::layout):
 
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::RenderThemeQt):
-        (WebCore::RenderThemeQt::fallbackStyle):
-        (WebCore::RenderThemeQt::qStyle):
-        (WebCore::RenderThemeQt::setPaletteFromPageClientIfExists):
-        * platform/qt/RenderThemeQt.h:
+2010-03-31  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-2010-01-29  Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+        Unreviewed crash fix.
 
-        Reviewed by Simon Hausmann.
+        Crash with frame flattening on after r56854
+        https://bugs.webkit.org/show_bug.cgi?id=36894
 
-        [Qt] Speed up the WebCore::String -> QString conversion
+        Solution tested by Greg Bolsinga, thanks.
 
-        Use QString(const QChar *, int len) constructor instead of QString::fromUtf16 to
-        avoid BOM checks and byteswapping.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::avoidScrollbarCreation):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
 
-        * bridge/qt/qt_class.cpp:
-        (JSC::Bindings::QtClass::fieldNamed):
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertValueToQVariant):
+2010-03-31  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-2010-01-14  Andreas Kling  <andreas.kling@nokia.com>
+        Reviewed by Antti Koivisto.
 
-        Reviewed by Kenneth Rohde Christiansen.
+        iframe flattening doesn't flatten
+        https://bugs.webkit.org/show_bug.cgi?id=36798
 
-        [Qt] Enable scrolling optimization for pages with embedded widgets
+        Do not draw scrollbars for subframes when frame flattening is
+        enabled. Implemented using a virtual method in ScrollView as
+        suggested by Dave Hyatt.
 
-        https://bugs.webkit.org/show_bug.cgi?id=33373
+        Do not suppress scrollbars as that is wrong according to
+        Dave Hyatt.
 
-        Added a basic manual test for scrolling of embedded QWidgets.
+        Covered by current tests.
 
-        * manual-tests/qt/qtplugin-scrolling.html: Added.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::avoidScrollbarCreation):
+        * page/FrameView.h:
         * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollContents):
-        (WebCore::ScrollView::setParent):
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
         * platform/ScrollView.h:
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::platformInit):
-        (WebCore::ScrollView::platformAddChild):
-        (WebCore::ScrollView::platformRemoveChild):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::invalidateRect):
-
-2010-01-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Turn off websocket support by default for Qt 4.6.x
-        https://bugs.webkit.org/show_bug.cgi?id=34284
-
-        * WebCore.pro:
-
-2010-01-26  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] JavaScript prompt is currently broken.
-        https://bugs.webkit.org/show_bug.cgi?id=30914
-
-        Remove the manual test case in favor of an automated
-        test case in WebKit/qt/tests/qwebpage.
-
-        * manual-tests/qt/java-script-prompt.html: Removed.
-
-2010-01-25  Janne Koskinen  <janne.p.koskinen@digia.com>
-
-        Reviewed by Simon Hausmann.
+        (WebCore::ScrollView::avoidScrollbarCreation):
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::layoutWithFlattening):
 
-        [Qt] Phone backup support for QtWebkit for Symbian devices.
-        https://bugs.webkit.org/show_bug.cgi?id=34077
+2010-03-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        * WebCore.pro:
+        Reviewed by Antti Koivisto.
 
-2010-01-21  Thiago Macieira  <thiago.macieira@nokia.com>
+        iframe flattening doesn't flatten
+        https://bugs.webkit.org/show_bug.cgi?id=36798
 
-        Reviewed by Simon Hausmann.
+        Fix wrongly reversing logic in frame flattening check.
 
-        [Qt] Fix incorrect dependency to QtXmlPatterns in generated include/QtWebKit/QtWebKit header
+        Tests:
+        fast/frames/flattening/iframe-flattening-fixed-height.html
+        fast/frames/flattening/iframe-flattening-fixed-width.html
+        fast/frames/flattening/iframe-flattening-fixed-width-and-height.html
+        fast/frames/flattening/iframe-flattening-fixed-width-and-height-no-scrolling.html
 
-        The generated file includes QtXmlPatterns/QtXmlPatterns, which is neither used/required by
-        the public QtWebKit API nor will it be available if Qt is configured with -no-xmlpatterns.
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::flattenFrame):
 
-        * WebCore.pro: Trick syncqt to believe that xmlpatterns is not a dependency, so that it's not
-        included in the generated file. It'll still be used and linked to with this trick.
+2010-03-31  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
-2010-01-17  Srinidhi Shreedhara  <srinidhi.shreedhara@nokia.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Simon Hausmann.
+        tryLayoutDoingPositionedMovementOnly does not have to be in RenderObject or be virtual
+        https://bugs.webkit.org/show_bug.cgi?id=36810
 
-        [Qt] [Symbian] SetWindow call in npapi plugin does not happen when the cooridnates are negative
-        https://bugs.webkit.org/show_bug.cgi?id=33573
+        Move tryLayoutDoingPositionedMovementOnly as a regular method of RenderBox
 
-        * plugins/symbian/PluginViewSymbian.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded): Remove tests for negative
-        coordinates for early return.
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::tryLayoutDoingPositionedMovementOnly):
+        * rendering/RenderObject.h:
 
-2010-01-14  Norbert Leser  <norbert.leser@nokia.com>
+2010-03-30  Stanislav Paltis  <Stanislav.Paltis@nokia.com>
 
         Reviewed by Laszlo Gombos.
 
-        Platform Symbian specific:
-        Added time-based optimization (-Otime) and increased optimization level to -O3,
-        conditionally for RVCT compiler (for ARM), for increasing performance
-        (primarily affecting JavaScript execution).
-        Default settings are -Ospace and -O2.
+        [Qt] qmake/symbian build failure
+        https://bugs.webkit.org/show_bug.cgi?id=36745
 
-        No new tests needed because no new funtionality is introduced,
-        only potential regression on existing tests needs to be evaluated.
+        Fix build break in Symbian build introduced in r56714,
+        by modifying comment escape character from ";" to "#".
 
         * WebCore.pro:
 
-2010-01-13  Girish Ramakrishnan  <girish@forwardbias.in>
+2010-03-29  Janne Koskinen  <janne.p.koskinen@digia.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt/Win] Flash in QGraphicsWebView does not process hover correctly.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=33591
-        
-        Mouse hover does not work as expected with the flash in some sites.
-        - http://www.bbc.co.uk/ Hover over the map
-        - http://www.barbie.com/ Hover over the menu items (Games, Videos)
-        The problem appears to be that Flash queries NPNVnetscapeWindow on every
-        mouse hover. I do not how flash uses this value but returning 0 when flash
-        is in windowless mode solves the problem (When using QGraphicsWebView we
-        inject wmode opaque, thereby putting the plugin in windowless mode).
+        [Qt] Package build fixes for Symbian
 
-        * plugins/win/PluginViewWin.cpp:
-        (windowHandleForPageClient):
-
-2010-01-13  Miikka Heikkinen <miikka.heikkinen@digia.com>
-
-        Reviewed by Simon Hausmann.
+        * enable building standalone QtWebkit for Symbian using qtlibinfix configuration option
 
-        [Qt/Symbian] Added missing vendor information to qtwebkit.sis
+        qtlibinfix adds possibility having multiple versions of Qt in Symbian devices.
+        Fix also allows unfrozen DLL exports during development.
 
-        This information is necessary to Symbian sign the package.
+        * Removed heap size configuration. DLLs don't have a heap.
 
-        http://bugreports.qt.nokia.com/browse/QTBUG-7290
+        * Removed enforcement to def files for package builds. Instead inherit the setting from
+        Qt's qconfig.pri whether to use def files or not. It's still possible to override this
+        also at qmake time by passing CONFIG+=def_files.
 
         * WebCore.pro:
 
-2010-01-12  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        [Qt] XSL stylesheets can load documents from a different origin
-
-        https://bugs.webkit.org/show_bug.cgi?id=33423
-
-        * xml/XSLTProcessorQt.cpp:
-        (WebCore::XSLTUriResolver::XSLTUriResolver):
-        (WebCore::XSLTUriResolver::resolve):
-        (WebCore::XSLTProcessor::transformToString):
-
-2010-01-07  Yael Aharon  <yael.aharon@nokia.com>
+2010-03-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Allow the application to override online/offline network status
-        https://bugs.webkit.org/show_bug.cgi?id=32684
-
-        Added API to NetworkStateNotifier for forcing network status.
+        Reviewed by Antti Koivisto.
 
-        * platform/network/NetworkStateNotifier.h:
-        * platform/network/qt/NetworkStateNotifierPrivate.h:
-        * platform/network/qt/NetworkStateNotifierQt.cpp:
-        (WebCore::NetworkStateNotifierPrivate::NetworkStateNotifierPrivate):
-        (WebCore::NetworkStateNotifierPrivate::onlineStateChanged):
-        (WebCore::NetworkStateNotifierPrivate::networkAccessPermissionChanged):
-        (WebCore::NetworkStateNotifier::updateState):
-        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
-        (WebCore::NetworkStateNotifier::setNetworkAccessAllowed):
+        Implement flattening for iframes.
 
-2010-01-07  Simon Hausmann  <simon.hausmann@nokia.com>
+        Refactoring of frameset flattening code to reuse it for
+        iframe flattening.
 
-        Reviewed by Tor Arne Vestbø.
+        Tests: fast/frames/flattening/iframe-flattening-simple.html
 
-        [Qt] Fix linkage against Qt mobility API bearer management module
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::scheduleRelayout):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setFrameFlatteningEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::frameFlatteningEnabled):
+        * rendering/RenderFrame.cpp:
+        * rendering/RenderFrame.h:
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::flattenFrameSet):
+        * rendering/RenderFrameSet.h:
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::layoutWithFlattening):
+        * rendering/RenderPart.h:
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::flattenFrame):
+        (WebCore::RenderPartObject::calcHeight):
+        (WebCore::RenderPartObject::calcWidth):
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderPartObject.h:
 
-        Use the documented .pro file syntax to link against the correct
-        library and (more importantly) get the include paths correct.
+2010-03-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        * WebCore.pro:
+        Reviewed by David Kilzer.
 
-2010-01-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Guard Geolocation files with ENABLE_GEOLOCATION
+        https://bugs.webkit.org/show_bug.cgi?id=25756
 
-        Reviewed by NOBODY (OOPS!).
+        The intent is to guard the Geolocation implementation files 
+        and minimize the impact on on clients/call sites.
 
-        [RVCT] ACID3 test crash
-        https://bugs.webkit.org/show_bug.cgi?id=33280
+        * DerivedSources.make:
+        * WebCore.Geolocation.exp: Added. Exported interfaces if GEOLOCATION
+        is enabled.
+        * WebCore.base.exp:
+        * bindings/js/JSCustomPositionCallback.cpp:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        * bindings/js/JSGeolocationCustom.cpp:
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::disconnectFrame): Stub implementation if
+        GEOLOCATION is turned off.
+        (WebCore::Geolocation::Geolocation): Ditto.
+        (WebCore::Geolocation::~Geolocation): Ditto.
+        (WebCore::Geolocation::setIsAllowed): Ditto.
+        * page/Geolocation.h: 
+        * page/Geolocation.idl:
+        * page/GeolocationPositionCache.cpp:
+        * page/Geoposition.idl:
+        * page/PositionError.idl:
+        * platform/GeolocationService.cpp:
+        * platform/mock/GeolocationServiceMock.cpp:
 
-        Workaround developed by Yongjun Zhang.
+2010-03-22  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        * dom/Element.cpp:
-        (WebCore::Element::setAttribute):
+        Reviewed by Simon Fraser.
 
-2010-01-06  Simon Hausmann  <simon.hausmann@nokia.com>
+        Add support for Widgets 1.0: View Mode Media Feature
+        https://bugs.webkit.org/show_bug.cgi?id=35446
 
-        Unreviewed trivial Qt build fix.
+        When enabling Web Widgets, add support for the view-mode media
+        feature (http://www.w3.org/TR/widgets-vmmf/).
 
-        Prefix the phonon includes with phonon/ to avoid conflicts with the S60
-        audio routing API ( http://wiki.forum.nokia.com/index.php/Audio_Routing_API ).
+        Test: fast/media/media-feature-wgt-view-mode.html
 
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        * css/CSSValueKeywords.in:
+        * css/MediaFeatureNames.h:
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::view_modeMediaFeatureEval):
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::isDocked):
+        (WebCore::ChromeClient::isFloating):
+        (WebCore::ChromeClient::isApplication):
+        (WebCore::ChromeClient::isFullscreen):
 
-2009-12-31  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-03-29  Luiz Agostini  <luiz.agostini@openbossa.org>
 
         Reviewed by Kenneth Rohde Christiansen.
 
-        Do not include Frame.h under WebCore/html/canvas
-        https://bugs.webkit.org/show_bug.cgi?id=33082
+        [Qt] Multiselect - Adding method itemIsSelected() to QtAbstractWebPopup
+        https://bugs.webkit.org/show_bug.cgi?id=36769
 
-        No new tests, as there is no new functionality.
+        Adding method itemIsSelected() to QtAbstractWebPopup.
 
-        * html/canvas/CanvasRenderingContext2D.cpp:
+        * platform/qt/QtAbstractWebPopup.h:
+        (WebCore::QtAbstractWebPopup::itemIsSelected):
 
-2009-12-30  Janne Koskinen  <janne.p.koskinen@digia.com>
+2010-03-29  Dawit Alemayehu  <adawit@kde.org>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Add support for Symbian def files
-
-        * WebCore.pro:
-
-2009-12-30  Simon Hausmann  <simon.hausmann@nokia.com>
+        Added a function, WebCore::shouldTreatAsAttachment, to HTTPParsers.*
 
-        Unreviewed Qt/Symbian build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=36395
 
-        Don't build network state notifier support when building inside of Qt.
-        Otherwise the Qt build depends on an external module that itself depends
-        on Qt again.
+        This function, which was moved from WebKit/chromium/src/FrameClientImpl.cpp,
+        is used to check whether or not a request is supposed to be rendered or
+        simply downloaded based on the "Content-Disposition" header sent by the
+        web server. The intent of code refactoring is to avoid code duplication
+        so that this piece of code can be used by other implementations such as
+        QtWebKit.
 
-        * WebCore.pro:
-
-2009-12-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::shouldTreatAsAttachment):
+        * platform/network/HTTPParsers.h:
 
-        Reviewed by Simon Hausmann.
+2010-03-29  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Turn off DataGrid support by default.
+        Reviewed by nobody, build fix.
 
-        No new tests, as there is no new functionality.
+        [Qt] Fix build break introduced in r56724.
 
         * WebCore.pro:
 
-2009-12-17  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
+2010-03-29  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        [Qt] support navigator.onLine and ononline/onoffline events.
-        https://bugs.webkit.org/show_bug.cgi?id=32555
+        Reviewed by Simon Hausmann.
 
-        Hooked up Bearer Management to NetworkStateNotifier. This solution is available 
-        only if QtMobility's Bearer Management is installed.
+        [Qt] Do not generate INSTALLS for webkit when building inside Qt.
+        Qt will do this for us.
 
         * WebCore.pro:
-        * platform/network/NetworkStateNotifier.h:
-        * platform/network/qt/NetworkStateNotifierPrivate.h: Added.
-        * platform/network/qt/NetworkStateNotifierQt.cpp: Added.
-        (WebCore::NetworkStateNotifierPrivate::NetworkStateNotifierPrivate):
-        (WebCore::NetworkStateNotifierPrivate::onlineStateChanged):
-        (WebCore::NetworkStateNotifierPrivate::~NetworkStateNotifierPrivate):
-        (WebCore::NetworkStateNotifier::updateState):
-        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
-
-2009-12-17  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Symbian build fix: Don't include QtXml/qxmlstream.h but omit the prefix, to
-        make sure we pick up the header file from QtCore. That is where the implementation
-        is compiled.
-
-        * dom/XMLTokenizer.h:
 
-2009-12-14  Holger Hans Peter Freyther  <zecke@selfish.org>
+2010-03-29  Antti Koivisto  <koivisto@iki.fi>
 
         Reviewed by Kenneth Rohde Christiansen.
 
-        [Qt] Add manual test for JavaScript prompt corner case
-        https://bugs.webkit.org/show_bug.cgi?id=30914
-
-        The patch is based on the work done by Gupta Manish.
-
-        Verify behavior of the JavaScript prompt function. Currently
-        Qt is not behaving like other WebKit ports and Firefox in
-        regards to accepting the prompt but not entering a text.
-
-        * manual-tests/qt/java-script-prompt.html: Added.
-
-2009-12-21  Andreas Kling  <andreas.kling@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        Fix assertion failure when dragging an SVG image.
-        https://bugs.webkit.org/show_bug.cgi?id=32511
-
-        Test: fast/images/drag-svg-as-image.html
-
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::filenameExtension): Return "svg"
-        * svg/graphics/SVGImage.h:
-
-2009-11-23  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Wrong runtime instance objects of wrapped QObjects may be used if
-        the wrapped object died before the gc removed the instance.
-
-        https://bugs.webkit.org/show_bug.cgi?id=31681
-
-        Before using a cached instance, verify that its wrapped QObject is
-        still alive.
+        https://bugs.webkit.org/show_bug.cgi?id=36703
+        Timer restart loop during page loading
+        
+        Fix regression introduced in http://trac.webkit.org/changeset/54526. 
+        Restarting the request timer unconditionally from the timer callback is a bad idea. 
+        Instead, start the timer when a non-cached request completes.
 
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::getQtInstance):
-        * bridge/qt/qt_instance.h:
-        (JSC::Bindings::QtInstance::hashKey):
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::nonCacheRequestComplete):
+        (WebCore::Loader::Host::servePendingRequests):
 
-2009-11-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+2010-03-29  Thomas Zander  <t.zander@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Fix crash of QtWebKit on any page with Flash when compiled with MinGW.
-
-        Fix inline assembly, don't dereference the function pointer twice.
+        [Qt] Shadowbuilds of WebCore with Qt on Symbian fails.
 
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::hookedBeginPaint):
-        (WebCore::PluginView::hookedEndPaint):
+        https://bugs.webkit.org/show_bug.cgi?id=36749
 
-2009-11-22  Jakub Wieczorek  <faw217@gmail.com>
+        Doing a 'make sis' expects the dll in the libdir, so place it
+        there. This fixes out-of-source building to always put the dll
+        in the expected dir.
 
-        Reviewed by Adam Barth.
-
-        [Qt] Remove the Referer header when redirecting to a non-secure site
-        https://bugs.webkit.org/show_bug.cgi?id=31785
-
-        This makes Qt pass two tests introduced in r50226.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        * WebCore.pro: Fix for shadow builds inside Qt.
 
-2009-11-19  Olivier Goffart  <ogoffart@trolltech.com>
+2010-03-29  Thomas Zander  <t.zander@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Normalize signal and slot signatures.
+        [Qt] Make it possible to build using both Windows and Linux for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=36748
 
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        * WebCore.pro: don't assume Windows buildsystem is the only one
+        and exclude the windows-only setters from the linux builds.
 
-2009-11-18  Benjamin Poulain  <benjamin.poulain@nokia.com>
+2010-03-29  Thomas Zander  <t.zander@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] WebKit crashes when loading certain SVG images
-
-        Check if the familly exist before creating the PlatformData from it.
+        https://bugs.webkit.org/show_bug.cgi?id=36745
 
-        https://bugs.webkit.org/show_bug.cgi?id=29443
+        [Qt] Fix def file builds with Qt 4.7.
 
-        Test: svg/text/text-font-invalid.html
+        Switched to using DEF_FILE, which is the official variable.
 
-        * platform/graphics/qt/FontFallbackListQt.cpp:
-        (WebCore::FontFallbackList::fontDataAt):
+        * WebCore.pro: Use DEF_FILE
 
-2009-11-14  Antonio Gomes  <tonikitoo@webkit.org>
+2010-03-28  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-        Reviewed by Antti Koivisto.
-
-        [Qt] Broken back/forward after using ErrorPageExtension to set error page
-        https://bugs.webkit.org/show_bug.cgi?id=30573
+        Reviewed by Simon Hausmann.
 
-        Make FrameLoader::checkLoadCompleteForThisFrame method
-        to check for any working DocumentLoader instance (through
-        activeDocumentLoader()) instead of only checking for
-        'm_provisionalDocumentLoader' in order to decide to if
-        it is going to reset of not the back and forward history.
-        after an error page has been loaded.
+        [Qt] GraphicsLayer: Timing functions don't work with transitions
+        https://bugs.webkit.org/show_bug.cgi?id=36589
 
-        Test: LayoutTests/fast/history/back-forward-reset-after-error-handling.html
+        If the animation value doesn't have timing function set, we need to
+        use the animation's timing function.
+        
+        Fixed also a bug in passing the duration to solveCubicBezierFunction.
+        The duration was divided two times by 1000 and meanwhile casted to int.
+        It needs to be kept as double and divided by 1000 only once.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+        Test case: https://bugs.webkit.org/attachment.cgi?id=51619
 
-2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::applyTimingFunction):
+        (WebCore::AnimationQt:::AnimationQtBase):
+        (WebCore::AnimationQt::updateCurrentTime):
 
-        Reviewed by Kenneth Rohde Christiansen.
+2010-03-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        [Qt] Few classes have virtual functions but non-virtual destructor
-        https://bugs.webkit.org/show_bug.cgi?id=31269
+        Reviewed by Simon Hausmann.
 
-        No new tests as there is no functional change.
+        [Qt] Remove the definition of WTF_CHANGES guards from the build system
+        https://bugs.webkit.org/show_bug.cgi?id=31670
 
-        * platform/qt/QWebPageClient.h:
-        (QWebPageClient::~QWebPageClient): Add virtual destructor.
+        No new tests as there is no new functionality.
 
-2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+        * WebCore.pri: Remove the definition of WTF_CHANGES
+        as it is already defined in config.h
 
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Allow setting HTTP headers with empty value in XMLHTTPRequest
-        https://bugs.webkit.org/show_bug.cgi?id=31140
+2010-03-26  Janne Koskinen  <janne.p.koskinen@digia.com>
 
-        QtNetwork interprets null string as request to remove the header, not add it.
-        Replace null values with empty values before passing them to QtNetwork.
+        Reviewed by Laszlo Gombos.
 
-        Test: http/tests/xmlhttprequest/xmlhttprequest-setrequestheader-no-value.html
+        Don't undefine SKIP_STATIC_CONSTRUCTORS_ON_GCC for Symbian HW targets.
+        https://bugs.webkit.org/show_bug.cgi?id=34081
 
-        * platform/network/qt/ResourceRequestQt.cpp:
-        (WebCore::ResourceRequest::toNetworkRequest):
+        Defining StringImpl instances as globals will cause a crash on process exit as 
+        StringImpl::Remove expects TLS which was already deleted at time of exiting main and ends up
+        constructing one exiting thread.
 
-2009-11-05  Jakub Wieczorek  <faw217@gmail.com>
+        * config.h:
 
-        Reviewed by Holger Freyther.
+2010-03-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        [Qt] The XML tokenizer reports a parse error twice if it occurs before the document element is found.
-        https://bugs.webkit.org/show_bug.cgi?id=31144
+        Reviewed by Simon Hausmann.
 
-        XMLTokenizer::doEnd() uses an additional logic to report a parse failure in
-        documents that end prematurely but are not considered invalid by QXmlStream.
-        This is to stay compatible with the libxml2 implementation.
-        However, that code path would be also hit in situations when it should not,
-        i.e. the error would have already been caught and handled. As a result, the
-        same error would be reported twice.
+        [Qt] Build JavaScriptCore as a static library.
+        https://bugs.webkit.org/show_bug.cgi?id=36590
 
-        No new tests, because the problem is already covered by
-        fast/parser/xml-declaration-missing-ending-mark.html.
+        This patch takes what was left of the unused JavaScriptCore.pro
+        and moved the compilation logic from JavaScriptCore.pri to
+        JavaScriptCore.pro.
 
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::doEnd):
+        * WebCore.pro:
 
-2009-11-05  Yuta Kitamura  <yutak@chromium.org>
+2010-03-25  Jakub Wieczorek  <jwieczorek@webkit.org>
 
         Reviewed by Eric Seidel.
 
-        Fix ASSERT(currentStyle = renderStyle()).
-        https://bugs.webkit.org/show_bug.cgi?id=31152
-
-        * dom/Element.cpp:
-        (WebCore::Element::pseudoStyleCacheIsInvalid): We should have used "==" instead of "=".
-
-2009-11-04  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] ASSERT failure when receiving 401 HTTP Authentication response.
-        https://bugs.webkit.org/show_bug.cgi?id=31077
-
-        Allow sending the response body under the same conditions that we
-        allow it to finish without reporting an error.
+        [Qt] RenderTheme: fix size adjustment for text fields
+        https://bugs.webkit.org/show_bug.cgi?id=36413
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-
-2009-11-03  Evan Martin  <evan@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Fix an off-by-one in the CSS lexer that causes memory corruption in
-        hard-to-trigger circumstances.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30827
-
-        Test: fast/css/end-of-buffer-crash.html
-
-        * css/maketokenizer: Add comments, fix off-by-one.
-
-2009-11-02  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Crash due to double-destroy related to CSS run-in property
-        https://bugs.webkit.org/show_bug.cgi?id=31034
-        rdar://problem/7328458
-
-        Test: fast/css/run-in-crash.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::destroy): Reorder destruction so the
-        continuation is destroyed after anonymous children. See comment
-        in the code for more details of why this is right.
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::destroy): Ditto.
-
-2009-10-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Holger Hans Peter Freyther.
-
-        If the owner widget of the page has a palette set, we
-        should use that one. This was only working when the
-        owner was a QWebView. This patch fixes that.
+        To match other ports, remove the hardcoded dimensions for text fields so that
+        the default ones from WebCore can be used.
+        Properly apply the correct padding to text areas - this fixes their appearance
+        with the Oxygen style.
 
         * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::applyTheme):
-
-2009-10-29  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Oliver Hunt.
-
-        [GTK] Threading problems with some of the tests
-        https://bugs.webkit.org/show_bug.cgi?id=30814
-
-        Create strings shared among threads with crossThreadString
-        constructor method.
-
-        * storage/Database.cpp:
-        (WebCore::Database::Database):
-
-2009-10-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by NOBODY (OOPS!).
-
-        [Qt] Use the default timeout interval for JS as the HTML tokenizer delay for setHtml()
-
-        This ensures that long-running JavaScript (for example due to a modal alert() dialog),
-        will not trigger a deferred load after only 500ms (the default tokenizer delay) while
-        still giving a reasonable timeout (10 seconds) to prevent deadlock.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29381
-
-        * html/HTMLTokenizer.cpp: Change debug output to print the actual tokenizer delay
-
-2009-10-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by NOBODY (OOPS!).
-
-        Clear the initial request when loading synchronously to prevent duplicate loads
-
-        MainResourceLoader uses the member m_initialRequest to store a request for future
-        deferred loads. When doing a synchronous load, in handleDataLoadNow(), we therefore
-        have to clear this request so that subsequent entries into the loader will not start
-        yet another load.
+        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
 
-        This can for example happen in setDefersLoading() as a result of a PageGroupLoadDeferrer
-        going out of scope when returning from Chrome::runJavaScriptAlert(), where the alert()
-        came from a script executed as part of the first/original load.
+2010-03-26  Qi Zhang  <qi.2.zhang@nokia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30879
+        Reviewed by Laszlo Gombos.
 
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::handleDataLoadNow): clear m_initialRequest
+        [Qt] fast/canvas/drawImage-with-negative-source-destination.html failed
+        https://bugs.webkit.org/show_bug.cgi?id=35005
 
-2009-11-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+        To support negative width or height at context.drawImage
 
-        Reviewed by Timothy Hatcher.
+        * platform/graphics/qt/StillImageQt.cpp:
+        (WebCore::StillImage::draw):
 
-        WebInspector: Use a different method to identify the webkit port in
-        InspectorBackent::platform().
-        This corrects the inspector expected behavior with Qt on Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=31116
+2010-03-24  Dmitry Titov  <dimich@chromium.org>
 
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::platform):
-        (WebCore::InspectorBackend::port):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/front-end/InspectorControllerStub.js:
-        (.WebInspector.InspectorControllerStub.prototype.port):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
-        (WebInspector.toolbarDragStart):
+        Unreviewed, Chromium test fix.
 
-2009-11-12  Benjamin Poulain  <benjamin.poulain@nokia.com>
+        Recent r56445 added CustomEvent and a test but it didn't work on Chromium bots.
+        Test crashed due to infinte recursion because the compiler did not have the right definition of toV8(CustomEvent*)
+        and was substituting toV8(Event*).
 
-        Reviewed by Kenneth Rohde Christiansen.
+        Fixing test fast/events/custom-event.html
 
-        Custom printing shrink factors
-        https://bugs.webkit.org/show_bug.cgi?id=29042
+        * bindings/v8/custom/V8EventCustom.cpp:
 
-        This reverts commit r49769. The public API for this needs to be reviewed
-        before its inclusion in Qt.
+2010-03-03  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        * page/PrintContext.cpp:
-        (WebCore::PrintContext::begin):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        * page/Settings.h:
+        Reviewed by Antti Koivisto.
 
-2009-11-09  Norbert Leser  <norbert.leser@nokia.com>
+        Add support for DOM Level 3 Custom Event
+        http://www.w3.org/TR/DOM-Level-3-Events
 
-        Reviewed by Kenneth Rohde Christiansen.
+        V8 Generator change by Nate Chapin <japhet@chromium.org>, Thanks!
 
-        Moved macro MMP_RULES (LINKEROPTION) into symbian instead of symbian-sbsv2,
-        since adjustment of RW-section base address will be needed for all new symbian
-        tool chains, specifically for arm and gcc compilation targets.
-        Also, change target address to 0xE00000 to be sufficient for all targets.
+        Test: fast/events/custom-event.html
 
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pri:
         * WebCore.pro:
+        * WebCore/DerivedSources.make:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * dom/CustomEvent.cpp: Added.
+        (WebCore::CustomEvent::CustomEvent):
+        (WebCore::CustomEvent::initCustomEvent):
+        (WebCore::CustomEvent::isCustomEvent):
+        * dom/CustomEvent.h: Added.
+        (WebCore::CustomEvent::create):
+        (WebCore::CustomEvent::detail):
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent):
+        * dom/Event.cpp:
+        (WebCore::Event::isCustomEvent):
+        * dom/Event.h:
 
-2009-11-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        [Qt] Make the default style background color valid.
-        Currently the color is transparent but invalid, this causes
-        list boxes in QtWebKit to be drawn with a black background
-        since r49242.
-        https://bugs.webkit.org/show_bug.cgi?id=31295
-
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::initialBackgroundColor):
-        * rendering/style/StyleBackgroundData.cpp:
-        (WebCore::StyleBackgroundData::StyleBackgroundData):
-
-2009-11-11  Simon Hausmann  <simon.hausmann@nokia.com>
+2010-03-23  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Reviewed by Tor Arne Vestbø.
+        Reviewed by Simon Hausmann.
 
-        Introduce a function for querying the input method status
-        in QWebPageClient.
+        Add a way to check if the page client is making use of
+        a QWidget.
 
         * platform/qt/QWebPageClient.h:
+        (QWebPageClient::isQWidgetClient):
 
-2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+2010-03-25  Antti Koivisto  <koivisto@iki.fi>
 
         Reviewed by Kenneth Rohde Christiansen.
 
-        [Qt] Pass credentials provided by XMLHTTPRequest to the network request.
-        https://bugs.webkit.org/show_bug.cgi?id=31208
-
-        After r42483, the credentials are no longer passed to the network request
-        in the URL of the request.
-        Pass the credentials from XMLHTTPRequest to the network request, the same
-        way that other ports do.
-
-        After this patch LayoutTests/http/xmlhttprequest/basic-auth.html passes.
+        https://bugs.webkit.org/show_bug.cgi?id=36316
+        Tiles of selected content do not update if not in viewport
+        
+        Don't clip repaints to viewport when tiling is enabled.
 
-        * platform/network/qt/ResourceHandleQt.cpp:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::loadResourceSynchronously):
+        * page/Frame.cpp:
+        (WebCore::Frame::setView):
+        (WebCore::Frame::setTiledBackingStoreEnabled):
 
-2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+2010-03-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Unreviewed build fix for WebInspector with Qt build.
+        Reviewed by Simon Hausmann.
 
-        Simply re-generate the Qt resource file by running
-        WebKitTools/Scripts/generate-qt-inspector-resource
+        [Qt] Implement ChromeClient::windowResizerRect()
 
-        * inspector/front-end/WebKit.qrc:
+        https://bugs.webkit.org/show_bug.cgi?id=21300
 
-2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+        The helper function geometryRelativeToOwnerWidget() in the page
+        client is used to clip the resize rect to the actual size of the
+        viewport, not the size of the QGraphicsView.
 
-        Reviewed by Tor Arne Vestbø.
+        * platform/qt/QWebPageClient.h:
 
-        Make QWebPluginDatabase private API for now.
+2010-03-26  Olivier Goffart  <ogoffart@trolltech.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30775
+        Reviewed by Simon Hausmann.
 
-        * WebCore.pro:
+        [Qt] Fix compilation on Windows
 
-2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+        For some reason, the MSVC compiler choose the
+        operator+(const QString &, const QString &) instead of
+        operator+(const WebCore::String &, const WebCore::String &)
+        resulting in errors when QT_USE_FAST_OPERATOR_PLUS is used.
 
-        Reviewed by Tor Arne Vestbø.
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::handleElementNamespaces):
 
-        Extended the conversion of the WebCore ResourceRequest to the
-        QNetworkRequest with a mandatory originating object argument,
-        which is meant to be the QWebFrame the request belongs to.
+2010-03-25  Diego Gonzalez  <diego.gonzalez@openbossa.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29975
+        Reviewed by Eric Seidel.
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-        (WebCore::QNetworkReplyHandler::start):
-        * platform/network/qt/ResourceRequest.h:
-        * platform/network/qt/ResourceRequestQt.cpp:
-        (WebCore::ResourceRequest::toNetworkRequest):
+        Missing forward ENABLE_DATALIST macro to JavaScript enabled features macros
+        on WebKit.pri
 
-2009-11-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+        [Qt] Forward ENABLE_DATALIST macro to JavaScript enabled macros
+        https://bugs.webkit.org/show_bug.cgi?id=36547
 
-        Reviewed by Adam Barth.
+        * WebCore.pri:
 
-        QWebView crash fix.
+2010-03-25  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        The QWebView should not crash if the stop() method is called from
-        a function triggered by the loadProgress signal.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        A null pointer protection was added in the ProgressTracker::incrementProgress.
+        [Qt] Fix the package build on Maemo 5
 
-        New autotest was created.
+        https://bugs.webkit.org/show_bug.cgi?id=36607
 
-        https://bugs.webkit.org/show_bug.cgi?id=29425
+        Always embed the stylesheet for the no-listbox rendering. This way it'll be
+        included in the generated files for the package generation.
 
-        * loader/ProgressTracker.cpp:
-        (WebCore::ProgressTracker::incrementProgress):
+        * WebCore.pri:
 
-2009-11-02  Kai Koehne  <kai.koehne@nokia.com>
+2010-03-19  Miikka Heikkinen  <miikka.heikkinen@digia.com>
 
-        Reviewed by Holger Freyther.
+        Reviewed by Simon Hausmann.
 
-        Remove implementation of ImageDecocerQt::clearFrameBufferCache.
-        The implementation was buggy, and will visually break repeating
-        animations anyway.
+        [Qt] Support for QT_LIBINFIX in Symbian builds
 
-        https://bugs.webkit.org/show_bug.cgi?id=31009
+        Configuring Qt with -qtlibinfix parameter will enable installing
+        an alternate version of Qt on devices that already have it on ROM.
+        This patch provides support for infixed builds of Webkit.
 
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        * WebCore.pro:
 
-2009-11-01  Yael Aharon  <yael.aharon@nokia.com>
+2010-03-24  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Don't add '/' to the URL path if the it does not include '/' after the protocol component
-        https://bugs.webkit.org/show_bug.cgi?id=30971
-
-        Match IE8 behaviour, that does not add '/' if there is none after the protocol component.
-
-        * platform/KURL.cpp:
-        (WebCore::KURL::parse):
-
-2009-10-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Holger Hans Peter Freyther.
-
-        If the owner widget of the page has a palette set, we
-        should use that one. This was only working when the
-        owner was a QWebView. This patch fixes that.
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::applyTheme):
-
-2009-10-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Implement DELETE HTTP method for XmlHttpRequest
-        https://bugs.webkit.org/show_bug.cgi?id=30894
-
-        No new tests as this functionality is already tested by the 
-        xmlhttprequest LayoutTests. As this patch depends on an unreleased
-        version of the dependent QtNetwork library and the tests will be
-        enabled later once the dependent library is released (and the
-        buildbot is updated).
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
-        (WebCore::QNetworkReplyHandler::start):
-
-2009-11-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Rubber-stamped by Antti Koivisto.
-
-        [Qt] Build fix for Windows CE
-
-        * plugins/PluginDatabase.cpp:
-
-2009-11-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Fix Qt build on Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=30905
-
-        * WebCore.pro:
-        * platform/graphics/BitmapImage.h:
-        * platform/graphics/qt/ImageQt.cpp:
-        (WebCore::BitmapImage::BitmapImage):
-        (WebCore::BitmapImage::create):
-
-2009-10-28  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
+        Make Icon::createIconForFiles() optional.
+        https://bugs.webkit.org/show_bug.cgi?id=35072
+
+        r54923 made Icon::createIconForFiles() deprecated. However moving
+        existing icon loading code to outside of WebCore is not good.  So,
+        we assume:
+        - ChromeClient::chooseIconForFiles(), renamed from iconForFiles(), is
+          the primary API to load icons.
+        - Icon::createIconForFiles() is an optional API to help
+          implementing ChromeClient::iconForFiles().
+
+        This patch removes a call to Icon::createIconForFiles() from
+        FileChooser::loadIcon(), and ChromeClient::chooseIconForFiles() of
+        non-Chromium ports calls Icon::createIconForFiles().
+
+        * WebCore.base.exp: Export FileChooser::iconLoaded(),
+          Icon::createIconForFiles(), and Icon::~Icon().
+        * WebCore.xcodeproj/project.pbxproj: Export Icon.h
+        * loader/EmptyClient.h: Rename iconForFiles() to chooseIconForFiles().
+        * page/Chrome.cpp: ditto.
+        * page/Chrome.h: ditto.
+        * page/ChromeClient.h: ditto.
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::loadIcon):
+        * platform/graphics/Icon.h: Remove a comment on createIconForFiles().
+        * platform/graphics/chromium/IconChromiumLinux.cpp: Remove createIconForFiles().
+        * platform/graphics/chromium/IconChromiumMac.cpp: ditto.
+        * platform/graphics/chromium/IconChromiumWin.cpp: ditto.
+        * rendering/RenderFileUploadControl.cpp: Rename iconForFiles() to chooseIconForFiles().
+        * rendering/RenderFileUploadControl.h: ditto.
 
-        Don't run JavaScript URLs in view source mode
-        https://bugs.webkit.org/show_bug.cgi?id=30881
+2010-03-23  Dan Bernstein  <mitz@apple.com>
 
-        Just say no.
+        Fixed typos.
 
-        Test: http/tests/security/view-source-no-javascript-url.html
+        * manual-tests/plugin-visible-rect-change.html:
 
-        * bindings/ScriptControllerBase.cpp:
-        (WebCore::ScriptController::executeIfJavaScriptURL):
+2010-03-23  Dan Bernstein  <mitz@apple.com>
 
-2009-10-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        Reviewed by John Sullivan.
 
-        Unreviewed. Fixes style problems pointed out by Evan Martin.
+        WebCore part of
+        <rdar://problem/7197736> Plug-in clip rect does not update when overflow
+        clip changes
+        https://bugs.webkit.org/show_bug.cgi?id=36479.
 
-        * platform/gtk/Language.cpp:
-        (WebCore::defaultLanguage):
+        * manual-tests/plugin-visible-rect-change.html: Added.
+        * platform/mac/WidgetMac.mm:
+        (WebCore::WidgetPrivate::WidgetPrivate): Added previousVisibleRect.
+        (WebCore::Widget::setFrameRect): If the visible rect changed but the
+        frame rect did not, send a -visibleRectDidChange message to the view,
+        if it responds to it.
+        (WebCore::Widget::releasePlatformWidget): Reset previousVisibleRect.
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidgetGeometry): Track changes to the clip rect
+        imposed by the enclosing layer. Call Widget::setFrameRect when it changes,
+        even if the frame rect did not.
+        * rendering/RenderWidget.h:
+        (WebCore::RenderWidget::windowClipRect): Added this accessor.
 
-2009-10-29  Dan Bernstein  <mitz@apple.com>
+2010-03-23  Simon Fraser  <simon.fraser@apple.com>
 
-        Rubber-stamped by Mark Rowe.
+        Reviewed by Dan Bernstein.
 
-        64-bit Leopard build fix after r50259
+        Assertion ASSERTION FAILED: rootLayer == m_clipRectsRoot at hulu.com
+        https://bugs.webkit.org/show_bug.cgi?id=34065
         
-        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
-        Declared ATSUTextInserted in 64-bit.
-        (WebCore::fontHasMirroringInfo): Use %d format and cast to int.
-        (WebCore::disableLigatures): Ditto.
-        (WebCore::initializeATSUStyle): Ditto.
-        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Ditto.
+        Fix another cause of assertions related to the clip rects root. Embeds
+        with zero size caused the overlap testing to fail, yet we require them to work
+        for correct compositing, so when the composited bounds is empty, use a 1x1 rect
+        for overlap testing.
 
-2009-10-29  Dan Bernstein  <mitz@apple.com>
+        Test: compositing/geometry/empty-embed-rects.html
 
-        Tiger build fix after r50259
-
-        * platform/graphics/mac/ComplexTextController.h:
-        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
-
-2009-10-29  Dan Bernstein  <mitz@apple.com>
-
-        Attempted Tiger build fix after r50259
-
-        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
-
-2009-10-28  Steve Falkenburg  <sfalken@apple.com>
-
-        Rubber stamped by Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30899
-        WebKit fails to build release on 32-bit Windows systems
-
-        * WebCore.vcproj/WebCore.vcproj: Excluded files from project.
-        * bindings/js/JSBindingsAllInOne.cpp: Added.
-
-2009-10-28  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        Fixed typos in color names.
-
-        * inspector/front-end/Color.js:
-
-2009-10-28  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Share code between the ATSUI- and Core Text-based Font implementations by doing the
-        following:
-        - Generalize CoreTextController as ComplexTextController, keeping the Core Text-specific
-          parts in ComplexTextControllerCoreText.cpp.
-        - Generalize FontMacCoreText as FontComplexTextMac using ComplexTextController
-        - Implement ATSUI-specific parts of ComplexTextController in ComplexTextControllerATSUI.
-        - Remove FontMacATSUI.
-
-        * WebCore.xcodeproj/project.pbxproj: Removed CoreTextController.{cpp,h}, FontMacATSUI.mm,
-        and FontMacCoreText.cpp, and added ComplexTextController.{cpp,h},
-        ComplexTextControllerATSUI.cpp, ComplexTextControllerCoreText.cpp, and
-        FontComplexTextMac.cpp.
-
-        * platform/graphics/mac/ComplexTextController.cpp: Copied from CoreTextController.cpp and
-        kept the non-Core Text-specific bits.
-        (WebCore::ComplexTextController::ComplexTextController): Updated for renames, including
-        its own.
-        (WebCore::ComplexTextController::offsetForPosition): Updated for renames and for
-        m_complexTextRuns holding references instead of objects.
-        (WebCore::ComplexTextController::collectComplexTextRuns): Updated for renames, including
-        its own.
-        (WebCore::ComplexTextController::advance): Updated for renames.
-        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Updated for renames and for
-        m_complexTextRuns holding references instead of objects, and changed to use the glyphs()
-        and advances() accessors.
-
-        * platform/graphics/mac/ComplexTextController.h: Copied from CoreTextController.h and
-        renamed CoreTextController to ComplexTextController and CoreTextRun to ComplexTextRun. Made
-        the latter RefCounted, added ATSUI-specific members to it, and made some other members
-        Core Text-specific. Renamed m_coreTextRuns to m_complexTextRuns and made it hold references
-        rather than objects.
-        (WebCore::ComplexTextController::ComplexTextRun::create):
-        (WebCore::ComplexTextController::ComplexTextRun::glyphs):
-        (WebCore::ComplexTextController::ComplexTextRun::advances):
-
-        * platform/graphics/mac/ComplexTextControllerATSUI.cpp: Added. Includes ATSUI-specific
-        parts of the ComplexTextController implementation. 
-        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): This ATSUI
-        callback populates the ComplexTextRun’s glyphs, advances and indices vectors. It is invoked
-        when the ComplexTextRun constructor calls ATSUGetGlyphBounds().
-        (WebCore::isArabicLamWithAlefLigature): Helper function, copied from FontMacATSUI.mm.
-        (WebCore::shapeArabic): Helper function, adapted from FontMacATSUI.mm.
-        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Sets up the
-        ATSUTextLayout, substituting the text buffer if necessary for things like shaping Arabic,
-        mirroring glyphs or directionality overrides, then calls ATSUGetGlyphBounds() in order to
-        get the glyphs, advances and indices vectors populated.
-        (WebCore::fontHasMirroringInfo): Helper function, copied from FontMacATSUI.mm.
-        (WebCore::disableLigatures): Ditto.
-        (WebCore::initializeATSUStyle): Ditto, somewhat cleaned up and simplified.
-        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Constructs
-        ComplexTextRuns, either missing-glyphs ones or ATSUTextLayout-based ones.
-
-        * platform/graphics/mac/ComplexTextControllerCoreText.cpp: Copied from
-        CoreTextController.cpp and kept the Core Text-specific bits.
-        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Updated for renames,
-        including its own, and moved the code to initialize m_glyphs and m_advances here. Previously
-        this was done in adjustGlyphsAndAdvances().
-        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Updated for renames,
-        including its own.
-        * platform/graphics/mac/CoreTextController.cpp: Removed.
-        * platform/graphics/mac/CoreTextController.h: Removed.
-        * platform/graphics/mac/FontComplexTextMac.cpp: Renamed FontMacCoreText.cpp to this.
-        (WebCore::Font::selectionRectForComplexText): Changed to use ComplexTextController instead
-        of CoreTextController.
-        (WebCore::Font::drawComplexText): Ditto.
-        (WebCore::Font::floatWidthForComplexText): Ditto.
-        (WebCore::Font::offsetForPositionForComplexText): Ditto.
-        * platform/graphics/mac/FontMacATSUI.mm: Removed.
-        * platform/graphics/mac/FontMacCoreText.cpp: Removed.
-
-2009-10-27  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        WAI-ARIA: add support for 'option' role
-        https://bugs.webkit.org/show_bug.cgi?id=30843
-
-        Test: accessibility/aria-option-role.html
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::addToOverlapMap):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
 
-        * accessibility/AccessibilityListBoxOption.h:
-        (WebCore::AccessibilityListBoxOption::canHaveChildren):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::RoleEntry::):
-        (WebCore::AccessibilityRenderObject::canHaveChildren):
+2010-03-23  David Levin  <levin@chromium.org>
 
-2009-10-28  Jens Alfke  <snej@chromium.org>
+        Reviewed by Nate Chapin.
 
-        Reviewed by Eric Seidel.
+        [chromium] XMLHttpRequest.send sends 'undefined' string when passed undefined value.
+        https://bugs.webkit.org/show_bug.cgi?id=36506
 
-        Fix GCC compiler warnings in WebCore, and enable -Wall and -Werror for Chromium build.
-        https://bugs.webkit.org/show_bug.cgi?id=30716
+        Test: http/tests/xmlhttprequest/send-undefined-and-null.html
 
-        * WebCore.gyp/WebCore.gyp:  Enable "chromium_code" flag, just on Mac build for now.
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::createARIARoleMap):  Fix struct visibiity warning.
-        * bindings/v8/ScriptCallStack.h:  Fix out-of-order member initialization warning.
-        * bindings/v8/V8Collection.h:
-        (WebCore::getV8Object):  Function in header should not be 'static' (fixes unused-static warning.)
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):  Fix signed/unsigned comparison warning.
-        * bindings/v8/V8GCController.cpp:
-        (WebCore::ObjectGrouperVisitor::applyGrouping):  Fix unused-variable warning.
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):  Enable ListButtonPart case to avoid
-            warning about missing cases in 'switch' statement.
-        * editing/EditorCommand.cpp:
-        (WebCore::createCommandMap):  Fix struct visibiity warning.
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::State::State):  Fix out-of-order member initialization warning.
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart):  Add empty 'default' case in
-            'switch' statement to avoid missing-case warning.
-        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):  Ditto.
-        * xml/XPathFunctions.cpp:
-        (WebCore::XPath::createFunctionMap):  Fix struct visibiity warning.
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::isDocumentType): Unrelated style fix: fixed the casing of the method.
+        (WebCore::V8XMLHttpRequest::sendCallback): Added check for null/undefined to do the send.
+        This mirrors what is done in the JSC bindings. Previously, sending 'null' worked because
+        the last case, which did "toWebCoreStringWithNullCheck", resulted in sending an empty
+        request body.
 
-2009-10-29  Adam Barth  <abarth@webkit.org>
+2010-03-23  Chris Evans  <cevans@chromium.org>
 
         Reviewed by Darin Adler.
 
-        REGRESSION: crashes in WebCore::RedirectScheduler::timerFired(WebCore::Timer<WebCore::RedirectScheduler>*)
-        https://bugs.webkit.org/show_bug.cgi?id=30839
-
-        Added null check for the case when the frame is detached from the page.
-
-        * loader/RedirectScheduler.cpp:
-        (WebCore::RedirectScheduler::timerFired):
-
-2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+        Fix hard-to-see crash due to incorrect libxml API usage.
 
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30817
-        Use parentObjectUnignored instead of parentObject in webkit_accessible_get_parent
-
-        Also removes the hack I had originally added to solve bug 25411, because
-        the fix here is what I should have done in the first place.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_parent):
+        https://bugs.webkit.org/show_bug.cgi?id=36000
 
-2009-10-28  Dmitry Titov  <dimich@chromium.org>
+        Test: fast/text/bad-encoding.html
 
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30805
-        Add MessageQueue::removeIf(Predicate&) to remove certain tasks without pulling them from the queue.
-        Existing Database tests cover this, no change in functionality.
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::doEnd): Avoid operations on a closed context.
 
-        * storage/DatabaseThread.cpp:
-        (WebCore::SameDatabasePredicate::SameDatabasePredicate): Added predicate that flags the tasks belonging to a specified database.
-        (WebCore::SameDatabasePredicate::operator()):
-        (WebCore::DatabaseThread::unscheduleDatabaseTasks): changed to use the new removeIf method.
+2010-03-23  Nate Chapin  <japhet@chromium.org>
 
-2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+        Unreviewed, revert r56376.
 
-        Reviewed by Timothy Hatcher.
+        This revision introduced a crash in a couple of layout tests
+        on Chromium Linux.
 
-        Web Inspector: Glue subsequent timeline records with same category
-        and title together.
+        * page/chromium/ChromeClientChromium.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::):
+        (WebCore::PopupContainer::create):
+        (WebCore::PopupContainer::PopupContainer):
+        (WebCore::PopupContainer::showPopup):
+        (WebCore::PopupContainer::showExternal):
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupMenu::show):
+        * platform/chromium/PopupMenuChromium.h:
+        (WebCore::PopupItem::):
+        (WebCore::PopupItem::PopupItem):
+        (WebCore::PopupContainerSettings::):
+        (WebCore::PopupContainer::listBox):
 
-        https://bugs.webkit.org/show_bug.cgi?id=30885
+2010-03-23  David Hyatt  <hyatt@apple.com>
 
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/TimelinePanel.js:
-        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
-        (WebInspector.TimelinePanel.prototype._formatRecord):
-        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
-        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+        Reviewed by Simon Fraser and Darin Adler.
 
-2009-10-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        https://bugs.webkit.org/show_bug.cgi?id=36272, make sure nth-child can work when the portion with "n" is omitted.
 
-        Reviewed by Xan Lopez.
+        Added fast/css/nth-child-implied-step.html
 
-        [GTK] Fails new test fast/js/navigator-language.html
-        https://bugs.webkit.org/show_bug.cgi?id=30440
+        * css/CSSGrammar.y:
+        * css/tokenizer.flex:
 
-        Reimplement WebCore::defaultLanguage to account for changes in
-        locale done by setLocale.
+2010-03-23  Darin Adler  <darin@apple.com>
 
-        Already existing test: fast/js/navigator-language.html
+        Reviewed by Sam Weinig.
 
-        * platform/gtk/Language.cpp:
-        (WebCore::defaultLanguage):
+        Reduce and straighten internal use of DOMImplementation
+        https://bugs.webkit.org/show_bug.cgi?id=36501
 
-2009-10-28  Eric Carlson  <eric.carlson@apple.com>
+        * WebCore.xcodeproj/project.pbxproj: Xcode decided to
+        re-sort this file.
 
-        Reviewed by Simon Fraser.
+        * dom/Clipboard.cpp: Removed unneeded include of DOMImplementation.h.
 
-        <rdar://problem/7303145> 
-        Can't exit full screen mode or restart movie after pressing command -R.
+        * dom/DOMImplementation.cpp: Removed unneeded createDocument and
+        createHTMLDocument functions. These should be done directly instead
+        of involving the DOMImplementation class.
+        * dom/DOMImplementation.h: Ditto.
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::removedFromDocument):
-        (WebCore::HTMLMediaElement::documentWillBecomeInactive):
-            Exit from fullscreen if necessary.
-        * html/HTMLMediaElement.h:
+        * dom/DocumentType.cpp: Removed unneeded include of DOMImplementation.h.
 
-2009-10-28  Alexey Proskuryakov  <ap@apple.com>
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::createTokenizer): Don't allocate a
+        DOMImplementation object just to use a class member function.
 
-        Unreviewed - a trivial fix to get Windows bots running.
+        * loader/CachedFont.cpp: Removed unneeded include of DOMImplementation.h.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30841
-        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::responseXML): Use Document::create to create a
+        new document instead of involving DOMImplementation.
+        * xml/XSLTProcessor.cpp:
+        (WebCore::XSLTProcessor::createDocumentFromSource): Ditto. And in the case
+        where we do need to call DOMImplementation to interpret the MIME type,
+        don't allocate a DOMImplementation object just to use a class member
+        function.
 
-        * platform/network/cf/ResourceRequestCFNet.cpp: (WebCore::setHeaderFields): Don't try to
-        access empty vector's data.
+2010-03-23  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Xan Lopez.
+        [Qt] Maemo5 theme - all <select> elements should be rendered as menu lists.
+        https://bugs.webkit.org/show_bug.cgi?id=36367
 
-        https://bugs.webkit.org/show_bug.cgi?id=25897
-        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+        Enabling NO_LISTBOX_RENDERING in WebCore.pri for Maemo5.
 
-        Remove the extraneous object of ROLE_PANEL.
+        * WebCore.pri:
 
-        * accessibility/gtk/AccessibilityObjectAtk.cpp:
-        (AccessibilityObject::accessibilityPlatformIncludesObject):
+2010-03-22  Joseph Pecoraro  <joepeck@webkit.org>
 
-2009-10-28  Jonathan Dixon  <joth@chromium.org>
+        Reviewed by David Kilzer.
 
-        Reviewed by Eric Seidel.
+        Upstream iPhone KeyEvent platform code and share with Mac platform
+        https://bugs.webkit.org/show_bug.cgi?id=35870
 
-        Bug 30547: (Chromium) searchbox not rendered properly due to the css property -webkit-border-radius
-        https://bugs.webkit.org/show_bug.cgi?id=30547
+        * platform/iphone/KeyEventCodesIPhone.h: Improper comment for #endif.
+        * platform/iphone/KeyEventIPhone.mm: Fixed headers.
 
-        Test: fast/css/text-input-with-webkit-border-radius.html
+2010-03-23  David Hyatt  <hyatt@apple.com>
 
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::paintTextFieldInternal):
-          Implemented rounded border rendering in Chromium Windows theme renderer.
+        Reviewed by Jeremy Orlow.
 
-2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=36277, make sure nth-child supports the positive unary prefix (+) as well as the negative
+        one (-).
 
-        Reviewed by Timothy Hatcher.
+        Added fast/css/nth-child-unary-prefix.html
 
-        Web Inspector: Pull items collections from resources panel and
-        timeline panel into AbstractTimelinePanel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30875
-
-        * inspector/front-end/AbstractTimelinePanel.js:
-        (WebInspector.AbstractTimelinePanel):
-        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
-        (WebInspector.AbstractTimelinePanel.prototype.createItemTreeElement):
-        (WebInspector.AbstractTimelinePanel.prototype.createItemGraph):
-        (WebInspector.AbstractTimelinePanel.prototype._showCategory):
-        (WebInspector.AbstractTimelinePanel.prototype._hideCategory):
-        (WebInspector.AbstractTimelinePanel.prototype.filter):
-        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
-        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
-        (WebInspector.AbstractTimelinePanel.prototype.refresh):
-        (WebInspector.AbstractTimelinePanel.prototype.reset):
-        (WebInspector.AbstractTimelinePanel.prototype.get calculator):
-        (WebInspector.AbstractTimelinePanel.prototype.set calculator):
-        (WebInspector.AbstractTimelinePanel.prototype.addItem):
-        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
-        (WebInspector.AbstractTimelinePanel.prototype.refreshItem):
-        (WebInspector.AbstractTimelinePanel.prototype.revealAndSelectItem):
-        (WebInspector.AbstractTimelinePanel.prototype.sortItems):
-        (WebInspector.AbstractTimelinePanel.prototype.adjustScrollPosition):
-        (WebInspector.AbstractTimelineCategory):
-        (WebInspector.AbstractTimelineCategory.prototype.toString):
-        * inspector/front-end/ResourceCategory.js:
-        (WebInspector.ResourceCategory):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.createItemTreeElement):
-        (WebInspector.ResourcesPanel.prototype.createItemGraph):
-        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
-        (WebInspector.ResourcesPanel.prototype.populateSidebar):
-        (WebInspector.ResourcesPanel.prototype.get searchableViews):
-        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction.sortFuction):
-        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction):
-        (WebInspector.ResourcesPanel.prototype.searchMatchFound):
-        (WebInspector.ResourcesPanel.prototype.searchCanceled):
-        (WebInspector.ResourcesPanel.prototype.performSearch):
-        (WebInspector.ResourcesPanel.prototype.refresh):
-        (WebInspector.ResourcesPanel.prototype.reset):
-        (WebInspector.ResourcesPanel.prototype.removeResource):
-        (WebInspector.ResourcesPanel.prototype.addMessageToResource):
-        (WebInspector.ResourcesPanel.prototype.clearMessages):
-        (WebInspector.ResourcesPanel.prototype.refreshResource):
-        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
-        (WebInspector.ResourcesPanel.prototype.showResource):
-        (WebInspector.ResourcesPanel.prototype._sortResourcesIfNeeded):
-        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
-        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
-        (WebInspector.ResourcesPanel.prototype.get _resources):
-        (WebInspector.ResourceTimeCalculator.prototype._upperBound):
-        * inspector/front-end/TimelinePanel.js:
-        (WebInspector.TimelinePanel):
-        (WebInspector.TimelinePanel.prototype.get categories):
-        (WebInspector.TimelinePanel.prototype.populateSidebar):
-        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
-        (WebInspector.TimelinePanel.prototype.createItemTreeElement):
-        (WebInspector.TimelinePanel.prototype.createItemGraph):
-        (WebInspector.TimelinePanel.prototype._formatRecord):
-        (WebInspector.TimelineCategory):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
+        * css/tokenizer.flex:
 
-2009-10-28  Kelly Norton  <knorton@google.com>
+2010-03-23  Andrey Kosyakov  <caseq@chromium.org>
 
-        Reviewed by Pavel Feldman.
+        Reviewed by Dmitry Titov.
 
-        Resets InspectorFrontend in InspectorTimelineAgent instead of removing it so
-        that it remains active on refreshs and page transitions.
-        https://bugs.webkit.org/show_bug.cgi?id=30874
+        Change notification sent to inspector frontend on workers creation / destruction
+        to be posted asynchronously to avoid JS reenterability problems. Also, renamed
+        willDestroyWorker to didDestroyWorker to reflect that it gets called later and got
+        rid of explicit IDs for workers (use addresses instead).
+        https://bugs.webkit.org/show_bug.cgi?id=36213
 
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::didDestroyWorker):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setFrontendProxyObject):
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::resetFrontendProxyObject):
-        * inspector/InspectorTimelineAgent.h:
-
-2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Provide a way to get counter values with layoutTestContoller
-        https://bugs.webkit.org/show_bug.cgi?id=30555
-
-        Expose WebCore::counterValueForElement as a WebCore API.
-
-        * WebCore.base.exp:
-        * rendering/RenderTreeAsText.cpp:
-        (WebCore::writeCounterValuesFromChildren):
-        (WebCore::counterValueForElement):
-        * rendering/RenderTreeAsText.h:
-
-2009-10-28  Nate Chapin  <japhet@chromium.org>
-
-        Unreviewed, Chromium build fix for r50225.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::defaultObjectContentType):
-
-2009-10-28  Eric Z. Ayers  <zundel@google.com>
-
-        Reviewed by Pavel Feldman.
-
-        Adds InspectorTimelineAgent  instrumentation for encountering a
-        <SCRIPT> tag when parsing an HTML document. 
-
-        https://bugs.webkit.org/show_bug.cgi?id=30861
-
-        * bindings/js/ScriptSourceCode.h:
-        (WebCore::ScriptSourceCode::ScriptSourceCode):
-        (WebCore::ScriptSourceCode::startLine):
-        (WebCore::ScriptSourceCode::url):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptHandler):
-        (WebCore::HTMLTokenizer::scriptExecution):
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::willLoadXHR):
-        (WebCore::InspectorTimelineAgent::willScriptTag):
-        (WebCore::InspectorTimelineAgent::didScriptTag):
-        * inspector/InspectorTimelineAgent.h:
-        (WebCore::):
-        * inspector/TimelineRecordFactory.cpp:
-        (WebCore::TimelineRecordFactory::createScriptTagTimelineRecord):
-        * inspector/TimelineRecordFactory.h:
-        * inspector/front-end/TimelineAgent.js:
+        (WebCore::PostWorkerNotificationToFrontendTask::create):
+        (WebCore::PostWorkerNotificationToFrontendTask::PostWorkerNotificationToFrontendTask):
+        (WebCore::PostWorkerNotificationToFrontendTask::performTask):
+        (WebCore::InspectorController::postWorkerNotificationToFrontend):
+        (WebCore::InspectorController::didCreateWorker):
+        (WebCore::InspectorController::didDestroyWorker):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didDestroyWorker):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorWorkerResource.h:
+        (WebCore::InspectorWorkerResource::create):
+        (WebCore::InspectorWorkerResource::id):
+        (WebCore::InspectorWorkerResource::InspectorWorkerResource):
+        * inspector/front-end/InjectedFakeWorker.js:
+        (InjectedFakeWorker.FakeWorker.prototype.terminate):
+        * inspector/front-end/WorkersSidebarPane.js:
+        (WebInspector.didDestroyWorker):
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::AbstractWorker):
+        (WebCore::AbstractWorker::onDestroyWorker):
+        * workers/AbstractWorker.h:
+        (WebCore::AbstractWorker::asID):
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
 
-2009-10-28  Steve Block  <steveblock@google.com>
+2010-03-22  David Hyatt  <hyatt@apple.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Sam Weinig.
 
-        Makes sure that Geolocation watch IDs remain positive on overflow.
-        https://bugs.webkit.org/show_bug.cgi?id=30122
+        https://bugs.webkit.org/show_bug.cgi?id=36266, support DOM Level 3 focusin/focusout events.  Add support for
+        IE onfocusin/onfocusout extensions to HTML.  The old DOM level 2 names (DOMFocusIn/DOMFocusOut are still supported).
 
-        No new tests possible.
+        Added fast/events/focusinout.html
 
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::watchPosition): Modified. Reset the watch ID to 1 on overflow.
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Event.cpp:
+        (WebCore::Event::aliasedType):
+        (WebCore::Event::hasAliasedType):
+        * dom/Event.h:
+        * dom/EventNames.h:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * dom/EventTarget.h:
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchUIEvent):
+        * html/HTMLAttributeNames.in:
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::parseMappedAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::parseMappedAttribute):
 
-2009-10-28  George Staikos  <george.staikos@torchmobile.com>
+2010-03-23  MORITA Hajime  <morrita@google.com>
 
-        Attempt to fix the Mac debug build after 50225.
+        Reviewed by Alexey Proskuryakov.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::defaultObjectContentType):
+        WebCore::SelectionController::setSelection NULL pointer
+        https://bugs.webkit.org/show_bug.cgi?id=31545
 
-2009-10-28  Alexey Proskuryakov  <ap@apple.com>
+        Added missing NULL-check that other APIs have.
 
-        Reviewed by Darin Adler.
+        Test: svg/dom/frame-related-api-during-load.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=30841
-        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::deselectAll):
 
-        Tests: http/tests/ssl/referer-301.html
-               http/tests/ssl/referer-303.html
+2010-03-23  Qi Zhang  <qi.2.zhang@nokia.com>
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
-        Remove Referer header if redirecting from https to another protocol.
+        Reviewed by Simon Hausmann.
 
-        * platform/network/ResourceRequestBase.cpp:
-        (WebCore::ResourceRequestBase::clearHTTPReferrer): Update request counterparts, as it is
-        always done when changing or adding header fields.
-        (WebCore::ResourceRequestBase::clearHTTPOrigin): Ditto.
+        [Qt] LayoutTests/fast/canvas/fillrect_gradient.html failed
+        https://bugs.webkit.org/show_bug.cgi?id=36444
 
-        * platform/network/ResourceRequestBase.h: clearHTTPReferrer() and clearHTTPOrigin() are
-        no longer inline, since they have non-trivial implementations.
+        Handle duplicated or unsorted colorStop at platformDestory
 
-        * platform/network/mac/ResourceRequestMac.mm:
-        (WebCore::ResourceRequest::doUpdatePlatformRequest): Fixed to synchronize header field removals.
-        (WebCore::ResourceRequest::doUpdateResourceRequest): Ditto.
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
 
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::willSendRequest):
-        * platform/network/cf/ResourceRequestCFNet.cpp:
-        (WebCore::setHeaderFields):
-        (WebCore::ResourceRequest::doUpdatePlatformRequest):
-        (WebCore::ResourceRequest::doUpdateResourceRequest):
-        Match Mac changes.
-        
-2009-10-28  Joe Mason  <jmason@rim.com>
+2010-03-23  Julien Chaffraix  <jchaffraix@webkit.org>
 
-        Reviewed by Adam Treat.
+        Unreviewed build fix.
 
-        Add FrameLoader::defaultObjectContentType, containing common code for
-        implementing FrameLoaderClient::objectContentType.  (Currently the gtk
-        and win ports have copied this code, and the qt port uses similar code
-        with a few extra clauses.  Moving this to a utility function cuts down
-        on copied code.)   This causes no behavioural change.
+        Try to make the window buildbot happy.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30868
+        * xml/XMLHttpRequestProgressEventThrottle.cpp:
+        * xml/XMLHttpRequestProgressEventThrottle.h: Move initialization of the
+        static const in the cpp file.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::defaultObjectContentType):
-        * loader/FrameLoader.h:
+2010-03-23  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Reviewed by Timothy Hatcher.
 
-        Reviewed by Tor Arne Vestbø.
+        Web Inspector: make gear menu appear on styles panel at all times.
 
-        [Qt] QWebHistory::saveState() is inconsistent with the Qt API
-        https://bugs.webkit.org/show_bug.cgi?id=30710
+        https://bugs.webkit.org/show_bug.cgi?id=36490
 
-        Enforce the versioning, by ignoring any version different
-        from 1.
+        * inspector/front-end/inspector.css:
 
-        * history/qt/HistoryItemQt.cpp:
-        (WebCore::HistoryItem::restoreState):
-        (WebCore::HistoryItem::saveState):
+2010-03-23  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Timothy Hatcher.
 
-        Not reviewed: follow up fix to InspectorControllerStub.
-        Define it after inspector.js due to namespace
+        Web Inspector: render nodes in inherited style bars as links.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30866
+        https://bugs.webkit.org/show_bug.cgi?id=36486
 
-        * inspector/front-end/inspector.html:
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement.breakpointClicked):
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._update.else.insertInheritedNodeSeparator):
+        (WebInspector.StylesSidebarPane.prototype._update):
+        (WebInspector.StylesSidebarPane.prototype._selectNode):
+        * inspector/front-end/inspector.js:
 
-2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-23  Julien Chaffraix  <jchaffraix@webkit.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Alexey Proskuryakov.
 
-        Web Inspector: Add InspectorController stub in order to
-        support opening in standalone mode.
+        [XHR] onProgress event needs to be dispatched according to what the specification states
+        https://bugs.webkit.org/show_bug.cgi?id=18654
 
-        https://bugs.webkit.org/show_bug.cgi?id=30866
+        Test: http/tests/xmlhttprequest/xmlhttprequest-50ms-download-dispatch.html
 
+        * Android.mk:
+        * GNUmakefile.am:
         * WebCore.gypi:
+        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/InspectorControllerStub.js: Added.
-        (.WebInspector.InspectorControllerStub):
-        (.WebInspector.InspectorControllerStub.prototype.wrapCallback):
-        (.WebInspector.InspectorControllerStub.prototype.isWindowVisible):
-        (.WebInspector.InspectorControllerStub.prototype.platform):
-        (.WebInspector.InspectorControllerStub.prototype.closeWindow):
-        (.WebInspector.InspectorControllerStub.prototype.attach):
-        (.WebInspector.InspectorControllerStub.prototype.detach):
-        (.WebInspector.InspectorControllerStub.prototype.storeLastActivePanel):
-        (.WebInspector.InspectorControllerStub.prototype.clearMessages):
-        (.WebInspector.InspectorControllerStub.prototype.searchingForNode):
-        (.WebInspector.InspectorControllerStub.prototype.search):
-        (.WebInspector.InspectorControllerStub.prototype.toggleNodeSearch):
-        (.WebInspector.InspectorControllerStub.prototype.setAttachedWindowHeight):
-        (.WebInspector.InspectorControllerStub.prototype.moveByUnrestricted):
-        (.WebInspector.InspectorControllerStub.prototype.addResourceSourceToFrame):
-        (.WebInspector.InspectorControllerStub.prototype.addSourceToFrame):
-        (.WebInspector.InspectorControllerStub.prototype.getResourceDocumentNode):
-        (.WebInspector.InspectorControllerStub.prototype.highlightDOMNode):
-        (.WebInspector.InspectorControllerStub.prototype.hideDOMNodeHighlight):
-        (.WebInspector.InspectorControllerStub.prototype.inspectedWindow):
-        (.WebInspector.InspectorControllerStub.prototype.loaded):
-        (.WebInspector.InspectorControllerStub.prototype.localizedStringsURL):
-        (.WebInspector.InspectorControllerStub.prototype.windowUnloading):
-        (.WebInspector.InspectorControllerStub.prototype.hiddenPanels):
-        (.WebInspector.InspectorControllerStub.prototype.debuggerEnabled):
-        (.WebInspector.InspectorControllerStub.prototype.enableResourceTracking):
-        (.WebInspector.InspectorControllerStub.prototype.disableResourceTracking):
-        (.WebInspector.InspectorControllerStub.prototype.resourceTrackingEnabled):
-        (.WebInspector.InspectorControllerStub.prototype.enableDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.disableDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.addBreakpoint):
-        (.WebInspector.InspectorControllerStub.prototype.removeBreakpoint):
-        (.WebInspector.InspectorControllerStub.prototype.updateBreakpoint):
-        (.WebInspector.InspectorControllerStub.prototype.pauseInDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.pauseOnExceptions):
-        (.WebInspector.InspectorControllerStub.prototype.setPauseOnExceptions):
-        (.WebInspector.InspectorControllerStub.prototype.resumeDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.profilerEnabled):
-        (.WebInspector.InspectorControllerStub.prototype.enableProfiler):
-        (.WebInspector.InspectorControllerStub.prototype.disableProfiler):
-        (.WebInspector.InspectorControllerStub.prototype.startProfiling):
-        (.WebInspector.InspectorControllerStub.prototype.stopProfiling):
-        (.WebInspector.InspectorControllerStub.prototype.getProfileHeaders):
-        (.WebInspector.InspectorControllerStub.prototype.getProfile):
-        (.WebInspector.InspectorControllerStub.prototype.takeHeapSnapshot):
-        (.WebInspector.InspectorControllerStub.prototype.databaseTableNames):
-        (.WebInspector.InspectorControllerStub.prototype.stepIntoStatementInDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.stepOutOfFunctionInDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.stepOverStatementInDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.setSetting):
-        (.WebInspector.InspectorControllerStub.prototype.dispatchOnInjectedScript):
-        (.WebInspector.InspectorControllerStub.prototype.releaseWrapperObjectGroup):
-        (.WebInspector.InspectorControllerStub.prototype.setting):
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector.UIString):
+        * WebCore.xcodeproj/project.pbxproj:
+        Added XMLHttpRequestProgressEventThrottle to the build systems.
 
-2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Created the throttle.
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener): The 'readyState' event are
+        dispatched using the XMLHttpRequestProgressEventThrottle now. For the DONE state, we
+        need to flush any pending progress event as we do not want it to be dispatched after
+        the DONE readyState event.
+        (WebCore::XMLHttpRequest::createRequest): Made this event use the
+        XMLHttpRequestProgressEventThrottle for event dispatching.
+        (WebCore::XMLHttpRequest::abort): Ditto.
+        (WebCore::XMLHttpRequest::networkError): Ditto.
+        (WebCore::XMLHttpRequest::abortError): Ditto.
+        (WebCore::XMLHttpRequest::didReceiveData): Ditto. Also fixed a potential warning.
+        (WebCore::XMLHttpRequest::suspend):
+        (WebCore::XMLHttpRequest::resume): Implemented the logic for suspend / resume.
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequestProgressEventThrottle.cpp: Added.
+        (WebCore::XMLHttpRequestProgressEventThrottle::XMLHttpRequestProgressEventThrottle):
+        (WebCore::XMLHttpRequestProgressEventThrottle::~XMLHttpRequestProgressEventThrottle):
+        (WebCore::XMLHttpRequestProgressEventThrottle::dispatchProgressEvent): Implemented the bulk
+        of the event throttling here: we use a timer to do so, as long as the timer is active it means
+        that events are coming faster than the throttling time and we coalesce them.
+        (WebCore::XMLHttpRequestProgressEventThrottle::dispatchEvent): Generic method to dispatch an event.
+        (WebCore::XMLHttpRequestProgressEventThrottle::flushProgressEvent): Called when we want to dispatch
+        any pending events and stopping any further dispatching.
+        (WebCore::XMLHttpRequestProgressEventThrottle::dispatchPausedEvent): Used to dispatch the event
+        that was queued due to the object being suspended.
+        (WebCore::XMLHttpRequestProgressEventThrottle::fired): Used to dispatch any coalesced event.
+        (WebCore::XMLHttpRequestProgressEventThrottle::hasEventToDispatch): Used to check if we have
+        an event to dispatch.
+        (WebCore::XMLHttpRequestProgressEventThrottle::suspend): Marked the object as suspended.
+        (WebCore::XMLHttpRequestProgressEventThrottle::resume): Dispatched the event that was queued.
+        * xml/XMLHttpRequestProgressEventThrottle.h: Added.
+        (WebCore::):
+        (WebCore::XMLHttpRequestProgressEventThrottle::suspended):
 
-        Reviewed by Jan Alonzo.
+2010-03-23  Pavel Feldman  <pfeldman@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=25897
-        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+        Reviewed by Timothy Hatcher.
 
-        Expands upon the new funtionality which allows platforms to indicate
-        that a particular object should not be ignored, so that they can
-        specify that an object should be ignored or that it should be left up
-        to the default handling to decide.
+        Web Inspector: Element inspector search funtion: Error dispatching: performSearch.
 
-        * accessibility/AccessibilityObject.h:
-        * accessibility/chromium/AccessibilityObjectChromium.cpp:
-        * accessibility/gtk/AccessibilityObjectAtk.cpp:
-        * accessibility/mac/AccessibilityObjectMac.mm:
-        * accessibility/qt/AccessibilityObjectQt.cpp:
-        * accessibility/win/AccessibilityObjectWin.cpp:
-        * accessibility/wx/AccessibilityObjectWx.cpp:
-        (AccessibilityObject::accessibilityPlatformIncludesObject):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (AccessibilityRenderObject::accessibilityIsIgnored):
+        https://bugs.webkit.org/show_bug.cgi?id=36488
 
+        Test: inspector/elements-panel-search.html
 
-2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult):
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor.):
+        (injectedScriptConstructor):
 
-        Reviewed by Jan Alonzo.
+2010-03-23  Qi Zhang  <qi.2.zhang@nokia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=25534
-        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+        Reviewed by Simon Hausmann.
 
-        Expose the table summary as the accessible description because there is no summary object.
+        [Qt]  fast/canvas/patternfill-repeat.html failed.
+        https://bugs.webkit.org/show_bug.cgi?id=34477
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_description):
+        Change Pattern to expose the repeatX and repeatY
+        At GraphicsContextQt to apply repeatX and repeatY
 
-2009-10-28  Steve Block  <steveblock@google.com>
+        * platform/graphics/Pattern.h:
+        (WebCore::Pattern::repeatX):
+        (WebCore::Pattern::repeatY):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::rotate):
 
-        Reviewed by Eric Seidel.
+2010-03-23  Alex Milowski  <alex@milowski.com>
 
-        Adds ScriptController::intializeThreading(), with both JSC and V8 implementations.
-        https://bugs.webkit.org/show_bug.cgi?id=30678
+        Reviewed by Kenneth Rohde Christiansen.
 
-        This new method is used from common code, rather than calling JSC::initializeThreading() (or the V8 equivalent) directly.
+        Removed the use of beta STIX fonts.
 
-        Build fix, no new tests required.
+        * css/mathml.css:
 
-        * bindings/js/ScriptController.cpp: Modified.
-        (WebCore::ScriptController::initializeThreading): Added.
-        * bindings/js/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
-        * bindings/v8/ScriptController.cpp: Modified.
-        (WebCore::ScriptController::initializeThreading): Added.
-        * bindings/v8/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
-        * loader/icon/IconDatabase.cpp: Modified.
-        (WebCore::iconDatabase): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
-        * storage/Database.cpp: Modified.
-        (WebCore::Database::Database): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
+2010-03-23  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+        Reviewed by Holger Freyther.
 
-        Reviewed by Darin Adler.
+        [GTK] Does not build with latest GTK+ development release
+        https://bugs.webkit.org/show_bug.cgi?id=36398
 
-        Document a feature of the m_liveDecodedResources list.
-        https://bugs.webkit.org/show_bug.cgi?id=30209
-
-        The code made the assumption that the list is sorted by
-        the m_lastDecodedAccessTime property of the CachedResource.
-        The above is not true when CachedResource::setDecodedSize
-        is called and the item is inserted the first time. In this
-        case the m_lastDecodedAccessTime is still zero and the
-        m_liveDecodedResources list becomes unsorted.
-
-        It is impossible that Cache::pruneLiveResources will
-        stop to process the list too early due this feature and
-        the alternatives of updating m_lastDecodedAccessTime in
-        CachedResource::setDecodedSize or changing the insert
-        to search the right position have a negative impact on
-        performance. The best solution for now is to document
-        this feature.
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::pruneLiveResources):
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::setDecodedSize):
+        Fix building with newest GTK+ versions.
 
-2009-10-28  Xan Lopez  <xlopez@igalia.com>
+        * GNUmakefile.am:
+        * platform/gtk/GtkPluginWidget.cpp:
+        (WebCore::GtkPluginWidget::invalidateRect):
+        (WebCore::GtkPluginWidget::paint):
+        * platform/gtk/GtkVersioning.h: Added.
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::paint):
+        * plugins/gtk/gtk2xtbin.c:
+        (gtk_xtbin_set_position):
+        (gtk_xtbin_unrealize):
 
-        Reviewed by Jan Alonzo.
+2010-03-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
-        https://bugs.webkit.org/show_bug.cgi?id=25897
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Make text controls always implement the text interface, and the
-        editable text interface when they are not read only. This is what
-        ATK-users expect.
+        [Qt] Remove support for Qt v4.4
+        https://bugs.webkit.org/show_bug.cgi?id=36389
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (getInterfaceMaskFromObject):
+        No new tests as there is no new functionality.
 
-2009-10-27  Holger Hans Peter Freyther  <zecke@selfish.org>
+        * WebCore.pri:
+        * WebCore.pro:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        * platform/qt/KURLQt.cpp:
+        (WebCore::KURL::operator QUrl):
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::paintScrollCorner):
+        * plugins/mac/PluginViewMac.cpp:
 
-        Reviewed by Simon Fraser.
+2010-03-23  Kent Tamura  <tkent@chromium.org>
 
-        Change HitTestResult methods to use (3d) transformation aware methods
-        https://bugs.webkit.org/show_bug.cgi?id=27347
+        Reviewed by Adam Barth.
 
-        The current HitTestResult methods are not using the (3d)
-        transformation aware routines. This can lead to an assertion
-        SVGRenderBase::mapLocalToContainer method.
+        Add checks if setNeedsWillValidateCheck() and
+        setNeedsValidityCheck() are called correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=34924
 
-        Change HitTestResult::imageRect to use the (3d) transformation
-        aware RenderBox::absoluteContentQuad to avoid running into
-        an assertion with SVG content.
+        Introduce HTMLFormControlElement::m_willValidate and
+        m_isValid. They are the caches of willValidate() and
+        isValidFormControlElement(). setNeedsWillValidateCheck() updates
+        m_willValidate and setNeedsValidityCheck() updates m_isValid.
 
-        Remove HitTestResult::boundingBox() as it is only used in
-        two places and conceptually doesn't belong into a HitTest
-        which is operating on points.
+        willValidate() and isValidFormControlElement() have assertions to
+        check m_willvalidate or m_isValid has the correct state. If
+        setNeedsWillValidateCheck() or setNeedsValidityCheck() is needed
+        to be called and is not called, these assertions fail.
 
-        A classic test case is not possible as the methods are not excercised
-        from within HTML/SVG but from the WebKit API Layer. A unittest
-        for Qt/Gtk+/Mac would need to be written but Qt/Gtk+ currently
-        do not support 3d transformations making it impossible to write
-        a reliable test case and the Mac port is currently not doing
-        unit testing.
+        * html/HTMLButtonElement.h:
+        (WebCore::HTMLButtonElement::recalcWillValidate):
+        * html/HTMLFieldSetElement.h:
+        (WebCore::HTMLFieldSetElement::recalcWillValidate):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        (WebCore::HTMLFormControlElement::recalcWillValidate):
+        (WebCore::HTMLFormControlElement::willValidate):
+        (WebCore::HTMLFormControlElement::setNeedsWillValidateCheck):
+        (WebCore::HTMLFormControlElement::validationMessage):
+        (WebCore::HTMLFormControlElement::isValidFormControlElement):
+        (WebCore::HTMLFormControlElement::setNeedsValidityCheck):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::recalcWillValidate):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setNonDirtyValue):
 
+2010-03-22  Pavel Feldman  <pfeldman@chromium.org>
 
-        * rendering/HitTestResult.cpp: Remove boundingBox() method
-        (WebCore::HitTestResult::imageRect): Use transformation aware method
-        * rendering/HitTestResult.h: Remove boundingBox()
+        Reviewed by Dave Hyatt.
 
-2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+        Web Inspector: display CSS selector source line in the styles sidebar pane.
 
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=36414
 
-        [Qt] Custom Cursor doesn't use hotspot.
-        https://bugs.webkit.org/show_bug.cgi?id=30820
+        This change adds a sourceLine field into the CSSStyleRule that is populated
+        from within the parser. CSSParser is now keeping track of the line numbers
+        and last selector line number that is being used while creating CSSStyleRules.
 
-        Cursors loaded from a QPixmap didn't specifiy the
-        hotspot. Take the hotspot values from the mac
-        implementation.
+        Test: inspector/styles-source-lines.html
 
-        * platform/qt/CursorQt.cpp:
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::lex):
+        (WebCore::CSSParser::countLines):
+        (WebCore::CSSParser::createStyleRule):
+        * css/CSSParser.h:
+        (WebCore::CSSParser::updateLastSelectorLine):
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::CSSStyleRule):
+        * css/CSSStyleRule.h:
+        (WebCore::CSSStyleRule::create):
+        (WebCore::CSSStyleRule::sourceLine):
+        * css/tokenizer.flex:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForRule):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
 
-2009-10-27  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-22  Qi Zhang  <qi.2.zhang@nokia.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Laszlo Gombos.
 
-        Web Inspector: Initial revision of the Timeline grid.
+        [Qt] Fix arc function in canvas
+        https://bugs.webkit.org/show_bug.cgi?id=36296
 
-        https://bugs.webkit.org/show_bug.cgi?id=30834
+        Based on HTLM5 spec (4.8.10.1.8 Complex shapes), arc function should draw a line to previous point, not only the arc.
 
-        * English.lproj/localizedStrings.js:
-        * WebCore.gypi:
-        * inspector/front-end/AbstractTimelinePanel.js:
-        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
-        (WebInspector.AbstractTimelinePanel.prototype.refresh):
-        (WebInspector.AbstractTimelineCalculator):
-        * inspector/front-end/Images/timelineBarBlue.png: Added.
-        * inspector/front-end/Images/timelineBarGray.png: Added.
-        * inspector/front-end/Images/timelineBarGreen.png: Added.
-        * inspector/front-end/Images/timelineBarOrange.png: Added.
-        * inspector/front-end/Images/timelineBarPurple.png: Added.
-        * inspector/front-end/Images/timelineBarRed.png: Added.
-        * inspector/front-end/Images/timelineBarYellow.png: Added.
-        * inspector/front-end/Images/timelineCheckmarks.png: Added.
-        * inspector/front-end/Images/timelineDots.png: Added.
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceTimeCalculator):
-        (WebInspector.ResourceTransferSizeCalculator):
-        * inspector/front-end/TimelineAgent.js:
-        * inspector/front-end/TimelinePanel.js:
-        (WebInspector.TimelinePanel):
-        (WebInspector.TimelinePanel.prototype.get statusBarItems):
-        (WebInspector.TimelinePanel.prototype.get categories):
-        (WebInspector.TimelinePanel.prototype.populateSidebar):
-        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
-        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
-        (WebInspector.TimelinePanel.prototype.refresh):
-        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClick):
-        (WebInspector.TimelinePanel.prototype.reset):
-        (WebInspector.TimelinePanel.prototype._formatRecord):
-        (WebInspector.TimelinePanel.prototype.showCategory):
-        (WebInspector.TimelinePanel.prototype.hideCategory):
-        (WebInspector.TimelineRecordTreeElement):
-        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
-        (WebInspector.TimelineCalculator):
-        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
-        (WebInspector.TimelineCalculator.prototype.computePercentageFromEventTime):
-        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
-        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
-        (WebInspector.TimelineCalculator.prototype.formatValue):
-        (WebInspector.TimelineGraph):
-        (WebInspector.TimelineGraph.prototype.get graphElement):
-        (WebInspector.TimelineGraph.prototype.refreshLabelPositions):
-        (WebInspector.TimelineGraph.prototype.refresh):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector._createPanels):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::addArc):
 
-2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
+2010-03-19  Abhishek Arya  <inferno@chromium.org>
 
-        Reviewed by Pavel Feldman.
+        Reviewed by Adam Barth.
 
-        Web Inspector: Move runAfterPendingDispatches to TestController for Clarity
-        https://bugs.webkit.org/show_bug.cgi?id=30844
+        https://bugs.webkit.org/show_bug.cgi?id=36339
+        Off-by-one memory corruption fix for long invalid websockets upgrade header
 
-        * inspector/front-end/TestController.js:
-        (WebInspector.TestController.prototype.runAfterPendingDispatches):
-        * inspector/front-end/inspector.js: moved runAfterPendingDispatches
+        Test: websocket/tests/long-invalid-header.html
 
-2009-10-27  Darin Fisher  <darin@chromium.org>
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::readServerHandshake):
 
-        Reviewed by Dimitri Glazkov.
+2010-03-22  Fumitoshi Ukai  <ukai@chromium.org>
 
-        Add missing forward declaration of FramelessScrollView.
-        https://bugs.webkit.org/show_bug.cgi?id=30824
+        Unreviewed build fix for Chromim Mac at r56376
 
-        * platform/chromium/FramelessScrollViewClient.h:
+        Fix initializer order  of PopupContainer.
 
-2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::PopupContainer):
 
-        Reviewed by Adele Peterson.
+2010-03-22  Jay Campan  <jcampan@google.com>
 
-        WAI-ARIA: add support for 'presentation' role
-        https://bugs.webkit.org/show_bug.cgi?id=30806
+        Reviewed by Darin Fisher.
 
-        Test: accessibility/aria-presentational-role.html
+        Making Chromium select popups not steal activation from the browser.
+        Select popups are now like autocomplete popups, shown in non-activated
+        windows.
+        https://bugs.webkit.org/show_bug.cgi?id=36062
 
-        * accessibility/AccessibilityObject.h:
+        * page/chromium/ChromeClientChromium.h:
+        * platform/chromium/PopupMenuChromium.cpp:
         (WebCore::):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        (WebCore::RoleEntry::):
-
-2009-10-27  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        ARIA menu/menu item need AXRoleDescription
-        https://bugs.webkit.org/show_bug.cgi?id=30804
-
-        Make sure that role descriptions will default to the system's first, before
-        returning an unknown role.
-
-        Test: platform/mac/accessibility/aria-menu-role-descriptions.html
-
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper roleDescription]):
-
-2009-10-27  Geoffrey Garen  <ggaren@apple.com>
-
-        Qt build fix: migrated away from API that no longer exists.
-
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertQVariantToValue):
-
-2009-10-27  Geoffrey Garen  <ggaren@apple.com>
-
-        Qt build fix: migrated away from API that no longer exists.
-
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertValueToQVariant):
+        (WebCore::PopupContainer::create):
+        (WebCore::PopupContainer::PopupContainer):
+        (WebCore::PopupContainer::~PopupContainer):
+        (WebCore::PopupContainer::showPopup):
+        (WebCore::PopupContainer::showExternal):
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupMenu::show):
+        * platform/chromium/PopupMenuChromium.h:
+        (WebCore::PopupContainer::):
+        (WebCore::PopupContainer::popupType):
 
-2009-10-27  Oliver Hunt  <oliver@apple.com>
+2010-03-22  Dmitry Titov  <dimich@chromium.org>
 
-        Fix wording in comment.
+        Reviewed by Nate Chapin.
 
-        * bridge/objc/objc_instance.mm:
-        (allocateAutoReleasePool):
+        [v8] Crash if the worker is terminated before its initial script is executed.
+        https://bugs.webkit.org/show_bug.cgi?id=36336
 
-2009-10-27  Oliver Hunt  <oliver@apple.com>
+        Test: fast/workers/termination-early.html
 
-        Reviewed by Darin Adler.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded): Check for 0 context. When terminated, the v8 heap initialization returns 0.
+        (WebCore::WorkerContextExecutionProxy::evaluate): Don't execute script if initialization failed.
+        * bindings/v8/WorkerContextExecutionProxy.h:
 
-        Crash occurs after launching Newsfire 1.6 for the first time
-        https://bugs.webkit.org/show_bug.cgi?id=30807
+2010-03-22  Andrey Kosyakov  <caseq@chromium.org>
 
-        We allocate an autorelease pool but then store it off the stack. In a
-        GC environment this led to it being collected, and thus caused badness
-        to ensue.  To work around this we simply avoid using a pool at all in
-        a GC environment as it would be a no-op anyway.
+        Reviewed by Pavel Feldman.
 
-        * bridge/objc/objc_instance.mm:
-        (allocateAutoReleasePool):
-        (ObjcInstance::virtualBegin):
+        Support creation of fake workers before document is loaded by deferring
+        attaching of fake workers iframe until document is loaded and buffering all
+        messages addressed to worker.
+        https://bugs.webkit.org/show_bug.cgi?id=36445
 
-2009-10-27  Steve Block  <steveblock@google.com>
+        * inspector/front-end/InjectedFakeWorker.js:
+        (InjectedFakeWorker.FakeWorker.prototype.postMessage):
+        (InjectedFakeWorker.FakeWorker.prototype._buildWorker):
+        (InjectedFakeWorker.FakeWorker.prototype._attachWorkerFrameToDocument):
+        (InjectedFakeWorker.FakeWorker.prototype._onWorkerFrameLoaded):
 
-        Reviewed by Darin Adler.
+2010-03-22  Darin Fisher  <darin@chromium.org>
 
-        When a Geolocation method is called, immediately calls the error calback asynchronously if permissions
-        have already been denied.
-        https://bugs.webkit.org/show_bug.cgi?id=27944.
+        Reviewed by Brady Eidson.
 
-        Tests: fast/dom/Geolocation/permission-denied-already-error.html
-               fast/dom/Geolocation/permission-denied-already-success.html
+        HistoryController::replaceState() should modify m_currentItem
+        instead of the current HistoryItem of the BackForwardList.
 
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. GeoNotifier takes Geolocation object as constructor argument.
-        (WebCore::Geolocation::GeoNotifier::setFatalError): Added. Sets a fatal error for this notifier, causing it to terminate immediately and call the error callback asynchronously.
-        (WebCore::Geolocation::GeoNotifier::timerFired): Added. Used to call the error callback asynchronously on fatal error.
-        (WebCore::Geolocation::getCurrentPosition): Modified. Calls startRequest.
-        (WebCore::Geolocation::watchPosition): Modified. Calls startRequest.
-        (WebCore::Geolocation::startRequest): Added. Common functionality for starting a one-shot or watch request. Sets a fatal error on the notifier if permissions have already been denied.
-        (WebCore::Geolocation::fatalErrorOccurred): Added. Registers that a notifier has encountered a fatal error and should be destroyed.
-        (WebCore::Geolocation::setIsAllowed): Modified. Uses a standard error message for the error callback when permissions are denied.
-        * page/Geolocation.h: Modified.
-        (WebCore::Geolocation::isDenied): Added. Determines whether permissions have been denied.
+        https://bugs.webkit.org/show_bug.cgi?id=36435
 
-2009-10-27  Chris Marrin  <cmarrin@apple.com>
+        Test: fast/loader/stateobjects/replacestate-in-iframe.html
 
-        Reviewed by Oliver Hunt.
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::replaceState):
 
-        Fixed a bug where I was using the wrong Canvas pointer to do a cross-domain check
-        https://bugs.webkit.org/show_bug.cgi?id=30840
+2010-03-22  Joseph Pecoraro  <joepeck@webkit.org>
 
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::drawImage):
+        Reviewed by David Kilzer.
 
-2009-10-27  Eric Seidel  <eric@webkit.org>
+        Upstream Part of the iPhone Platform sharing code with the Mac Platform
+        https://bugs.webkit.org/show_bug.cgi?id=35870
+        <rdar://problem/7707283> and <rdar://problem/7707318>
 
-        Reviewed by Nikolas Zimmermann.
+        Part 3 of 3: Shared code between iphone and mac. The shared code was
+        refactored to be usable by both platforms without platform specific
+        typing, meaning no NSEvent versus WebEvent special cases.
 
-        SVGStyledElement::getPresentationAttribute() can return a shared CSSValue (some SVG tests randomly fail on the bot, and in release builds)
-        https://bugs.webkit.org/show_bug.cgi?id=29620
+          Shared code usable by either mac or iphone platforms.
 
-        SVG was modifying CSSValues cached of off CSSMappedAttributeDeclarations.
-        This patch fixes the check to make sure that a new CSSMappedAttributeDeclaration is
-        created before returning a CSSValue that JavaScript can modify.
+        * platform/cocoa/KeyEventCocoa.h:
+        * platform/cocoa/KeyEventCocoa.mm:
+        (WebCore::keyIdentifierForCharCode):
+        (WebCore::windowsKeyCodeForKeyCode):
+        (WebCore::windowsKeyCodeForCharCode):
 
-        Test: svg/dom/getPresentationAttribute-cache-corruption.svg
+          Make use of the shared code. Keep anything platform specific in the
+          original file before calling the shared code.
 
-        * svg/SVGStyledElement.cpp:
-        (WebCore::SVGStyledElement::getPresentationAttribute):
+        * platform/iphone/KeyEventIPhone.mm:
+        (WebCore::keyIdentifierForKeyEvent):
+        * platform/mac/KeyEventMac.mm:
+        (WebCore::keyIdentifierForKeyEvent):
+        (WebCore::windowsKeyCodeForKeyEvent):
 
-2009-10-27  Dan Bernstein  <mitz@apple.com>
+2010-03-22  Kevin Decker  <kdecker@apple.com>
 
         Reviewed by Simon Fraser.
 
-        Incomplete repaint of text field in relative positioned inline at imdb.com
-        https://bugs.webkit.org/show_bug.cgi?id=30047
+        https://bugs.webkit.org/show_bug.cgi?id=36328
 
-        Test: fast/repaint/inline-relative-positioned.html
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::RenderEmbeddedObject): Fix a find/repalce mistake from my earlier patch.
+        Rename m_setShowsMissingPluginIndicator -> m_showsMissingPluginIndicator. 
+        (WebCore::RenderEmbeddedObject::updateWidget): Don't update the widget if we're showing
+        the missing plug-in indicator.
+        (WebCore::RenderEmbeddedObject::paint):Fix a find/repalce mistake from my earlier patch.
+        Rename m_setShowsMissingPluginIndicator -> m_showsMissingPluginIndicator. 
+        (WebCore::RenderEmbeddedObject::paintReplaced): Ditto.
+        * rendering/RenderEmbeddedObject.h: Ditto.
+        (WebCore::RenderEmbeddedObject::setShowsMissingPluginIndicator): Ditto.
+        (WebCore::RenderEmbeddedObject::showsMissingPluginIndicator): Ditto.
 
-        Implemented offsetFromContainer(), mapLocalToContainer() and
-        mapAbsoluteToLocalPoint() in RenderInline.
+2010-03-22  Joseph Pecoraro  <joepeck@webkit.org>
 
-        * rendering/RenderBox.h: Fixed argument names in the declaration of
-        mapLocalToContainer().
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::offsetFromContainer):
-        (WebCore::RenderInline::mapLocalToContainer):
-        (WebCore::RenderInline::mapAbsoluteToLocalPoint):
-        * rendering/RenderInline.h:
+        Reviewed by David Kilzer.
 
-2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
+        Upstream Part of the iPhone Platform sharing code with the Mac Platform
+        https://bugs.webkit.org/show_bug.cgi?id=35870
+        <rdar://problem/7707283>
 
-        Speculative build fix for Chromium.
+        Part 2 of 3: No changes other than moving code around.
+        Copied KeyEvent function from platform/mac to a platform/cocoa shared directory.
 
-        * platform/graphics/GraphicsContext3D.h:
+        * WebCore.xcodeproj/project.pbxproj: Added cocoa group and new files.
+        * platform/cocoa/KeyEventCocoa.h: Added.
+        * platform/cocoa/KeyEventCocoa.mm: Copied from WebCore/platform/mac/KeyEventMac.mm.
+        (WebCore::keyIdentifierForKeyEvent):
+        (WebCore::windowsKeyCodeForKeyEvent): Include the shared code.
+        * platform/mac/KeyEventMac.mm:
 
-2009-10-27  Chris Marrin  <cmarrin@apple.com>
+2010-03-22  Joseph Pecoraro  <joepeck@webkit.org>
 
-        Reviewed by Simon Fraser.
-        
-        Make WebGL context failure more robust and make it succeed in more cases
-        https://bugs.webkit.org/show_bug.cgi?id=30349
+        Reviewed by David Kilzer.
 
-        Bubble a failure to get a CGLContext up to HTMLContextElement so it can
-        return null from getContext. Also added a more robust pixel format choosing 
-        mechanism and can render correctly when a SW renderer is chosen.
+        Part 1 of 3: Upstream iPhone KeyEvent platform code and share with Mac platform
+        https://bugs.webkit.org/show_bug.cgi?id=35870
+        <rdar://problem/7707283>
 
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext):
-        * html/canvas/CanvasRenderingContext.h:
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        * html/canvas/CanvasRenderingContext3D.h:
-        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
-        (WebCore::CanvasRenderingContext3D::cleanupAfterGraphicsCall):
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/Canvas3DLayer.mm:
-        (-[Canvas3DLayer copyCGLPixelFormatForDisplayMask:]):
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::setPixelFormat):
-        (WebCore::GraphicsContext3D::create):
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
-        (WebCore::GraphicsContext3D::~GraphicsContext3D):
-        (WebCore::GraphicsContext3D::reshape):
-        (WebCore::ensureContext):
+        * WebCore.xcodeproj/project.pbxproj: Added iphone group and new files.
+        * platform/iphone: Added.
+        * platform/iphone/KeyEventCodesIPhone.h: Added.
+        * platform/iphone/KeyEventIPhone.mm: Added. Ensure PLATFORM(IPHONE)
+        * platform/mac/KeyEventMac.mm: Ensure PLATFORM(MAC)
 
-2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+2010-03-22  Kevin Decker  <kdecker@apple.com>
+    
+        Attempt to fix the Leopard build.
+        * rendering/RenderEmbeddedObject.cpp: Add ".f" to contants.
 
-        Mac build fix: a forwarding header.
+2010-03-22  Justin Schuh  <jschuh@chromium.org>
 
-        * ForwardingHeaders/wtf/DateInstanceCache.h: Added.
+        Reviewed by Dirk Schulze.
 
-2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+        Out of bounds read in SVG feColorMatrix filter
+        https://bugs.webkit.org/show_bug.cgi?id=32714
 
-        No Review.
+        Prevents an invalid read when a valid values attribute is not
+        supplied for an feColorMatrix SVG filter. Also fixes general
+        handling of missing or invalid values attribute.
 
-        Making fontWeightIsBold static to fix Snow Leopard build.
+        Tests: svg/filters/feColorMatrix-invalid-value.svg
+               svg/filters/feColorMatrix-values.svg
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::fontWeightIsBold):
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::build):
 
-2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+2010-03-22  Philippe Normand  <pnormand@igalia.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Eric Carlson.
 
-        WebKit cannot remove nested bold tags
-        https://bugs.webkit.org/show_bug.cgi?id=30784
+        [GStreamer] Use ImageBuffer API to do painting
+        https://bugs.webkit.org/show_bug.cgi?id=35783
 
-        This patch modifies getPropertiesNotInComputedStyle so that it compares font-weight
-        more flexibly. Instead of comparing cssText, it uses fontWeightIsBold which converts
-        all font weights to either bold or unbold state.
+        New ImageGStreamer class abstracting the conversion of GStreamer
+        buffers to cairo surfaces. Using this makes the painting code of
+        the player more generic.
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::fontWeightIsBold):
-        (WebCore::getPropertiesNotInComputedStyle): Removes font-weight property
-        if two style have the same value under getFontWeightValue
+        * GNUmakefile.am:
+        * platform/graphics/gstreamer/ImageGStreamer.h: Added.
+        (WebCore::ImageGStreamer::image):
+        * platform/graphics/gstreamer/ImageGStreamerCairo.cpp: Added.
+        (ImageGStreamer::createImage):
+        (ImageGStreamer::ImageGStreamer):
+        (ImageGStreamer::~ImageGStreamer):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-2009-10-27  Carol Szabo  <carol.szabo@nokia.com>
+2010-03-22  Beth Dakin  <bdakin@apple.com>
 
         Reviewed by Darin Adler.
 
-        Give an ability to WebKit to free statically allocated pointers
-        before quit.
-        https://bugs.webkit.org/show_bug.cgi?id=27980
-
-        No new tests for this as the change does not affect WebKit
-        functionality, but only memory usage.
-
-        * JavaScriptCore/wtf/StdLibExtras.h:
-        Allowed for the override of DEFINE_STATIC_LOCAL via compiler 
-        commandline options or elsewhere in the code. Useful for 
-        implementing custom builds that free resources allocated via
-        DEFINE_STATIC_LOCAL.
+        Fix for <rdar://problem/7766437> With Web Inspector opened, a crash 
+        occurs at Webcore:getMatchedCSSRules() when navigating to a 
+        previous page
 
-2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
+        defaultView() can legitimately by null (as it is in this case), so 
+        it must be null-checked.
 
-        Build fix, no review needed.
-
-        Fixing the BUILD. m_estimatedSize in Database.h should be of type
-        'unsigned long' instead of 'unsigned long long'.
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getStyles):
+        (WebCore::InspectorDOMAgent::getComputedStyle):
+        (WebCore::InspectorDOMAgent::getMatchedCSSRules):
 
-        No tests required.
+2010-03-22  Kevin Decker  <kdecker@apple.com>
 
-        * storage/Database.h:
+        Reviewed by Darin.
 
-2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=36328
+        
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadPlugin): Call setShowsMissingPluginIndicator(true) in cases that fail
+        to generate a widget.
+        * rendering/RenderEmbeddedObject.cpp: Added new missing plug-in related static constants
+        (WebCore::RenderEmbeddedObject::RenderEmbeddedObject): Initialize newly boolean to false.
+        (WebCore::RenderEmbeddedObject::paint): Added.
+        (WebCore::RenderEmbeddedObject::paintReplaced): Added. Draws a subtle rounded rectangle
+        containing the text "Missing Plug-in".
+        * rendering/RenderEmbeddedObject.h: Added the following two methods below.
+        (WebCore::RenderEmbeddedObject::setShowsMissingPluginIndicator):
+        (WebCore::RenderEmbeddedObject::showsMissingPluginIndicator):
+        * rendering/RenderWidget.h: Moved paint(PaintInfo&, int, int) from private to protected.
+
+2010-03-22  Jakub Wieczorek  <faw217@gmail.com>
 
-        Reviewed by Adam Barth.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Refactoring the Database class to not depend on
-        OriginQuotaManager. Also, adding a SecurityOrigin copy to each
-        Database instance, that is safe to use on the file
-        thread. Finally, adding new simple fields and getters to the
-        Database object for storing/getting the display name and estimated
-        size specified by the user in the openDatabase() call.
+        [Qt] Phonon media backend: expose supported MIME types to WebCore
 
-        https://bugs.webkit.org/show_bug.cgi?id=30548
+        https://bugs.webkit.org/show_bug.cgi?id=33453
 
-        * page/SecurityOrigin.h:
-        * storage/Database.cpp:
-        (WebCore::Database::openDatabase): Storing the display name and
-        the estimated size in the Database object.
-        (WebCore::Database::Database): Storing the display name and the
-        estimated size in the Database object, as well as a SecurityOrigin
-        instance that is safe to use on the DB thread.
-        (WebCore::Database::maximumSize): Delegate the call to
-        DatabaseTracker::getMaxSizeForDatabase().
-        (WebCore::Database::databaseThreadSecurityOrigin): Return the
-        SecurityOrigin instance that's safe to use on the DB thread.
-        (WebCore::Database::threadSafeSecurityOrigin): Return the
-        SecurityOrigin instance that's safe to use on the current thread.
-        (WebCore::Database::displayName): Return the display name
-        specified by the user in the openDatabase() call.
-        (WebCore::Database::estimatedSize): Return the estimated size
-        specified by the user in the openDatabase() call.
-        (WebCore::Database::fileName): Return the name of the file where
-        the current Database is tored.
-        * storage/Database.h:
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::getMaxSizeForDatabase): Returns the
-        maximum size for a DB file based on the current size of that file
-        and the space available for that origin.
-        * storage/DatabaseTracker.h:
-        * storage/SQLTransaction.cpp:
-        * storage/SQLTransactionClient.cpp:
-        (WebCore::SQLTransactionClient::didCommitTransaction): Use the
-        correct SecurityOrigin instance.
+        MediaPlayerPrivate should expose the MIME types that are supported
+        by the underlying backend in Phonon.
 
-2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::supportedTypesCache):
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
 
-        Reviewed by Timothy Hatcher.
+2010-03-22  Alexander Pavlov  <apavlov@chromium.org>
 
-        Web Inspector: Pretty Print all HTML Collection Types like we do for NodeList
-        https://bugs.webkit.org/show_bug.cgi?id=30709
+        Reviewed by Pavel Feldman.
 
-        Test: inspector/console-format-collections.html
+        Web Inspector: AuditRules still use getMatchedCSSRules as a part of the img-related audit.
+        https://bugs.webkit.org/show_bug.cgi?id=36424
 
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.receivedImages):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.pushImageNodes):
         * inspector/front-end/InjectedScript.js:
-        (Object.type): check for instances of HTMLCollection like we do for NodeList
-        * inspector/front-end/inspector.js: added WebInspector.pendingDispatches counter
-        (WebInspector.dispatch): increment and decrement dispatch counter
-        (WebInspector.runAfterPendingDispatches): run when there are no more dispatches
-
-2009-10-27  Kelly Norton  <knorton@google.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Adds XMLHttpRequest support to InspectorTimelineAgent.
-        https://bugs.webkit.org/show_bug.cgi?id=30578
-
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
-        (WebCore::InspectorTimelineAgent::didChangeXHRReadyState):
-        (WebCore::InspectorTimelineAgent::willLoadXHR):
-        (WebCore::InspectorTimelineAgent::didLoadXHR):
-        * inspector/InspectorTimelineAgent.h:
-        (WebCore::):
-        * inspector/TimelineRecordFactory.cpp:
-        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord):
-        (WebCore::TimelineRecordFactory::createXHRLoadTimelineRecord):
-        * inspector/TimelineRecordFactory.h:
-        * inspector/front-end/TimelineAgent.js:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
-
-2009-10-27  Enrica Casucci  <enrica@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        REGRESSION (Safari 4.0.3-ToT): After pressing Shift-PageDown, pressing Shift-Up 
-        extends the top of the selection upwards (but should shrink the selection instead)
-        <rdar://problem/7269075>
-        https://bugs.webkit.org/show_bug.cgi?id=29981
-
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::modify): Added setting m_lastChangeWasHorizontalExtension.
-
-2009-10-27  Brian Weinstein  <bweinstein@apple.com>
-
-        Rubber-stamped by Tim Hatcher.
-        
-        Removed an extra console.log from ElementsTreeOutline.
-
-        * inspector/front-end/ElementsTreeOutline.js:
-
-2009-10-27  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Rewrote JavaScriptSourceSyntaxHighlighter to be more accurate
-        https://bugs.webkit.org/show_bug.cgi?id=27147
-
-        Tests: LayoutTests/inspector/javascript-syntax-highlight.html
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.JavaScriptSourceSyntaxHighlighter.process): Added. Processes 100 tokens at a time.
-        (WebInspector.JavaScriptSourceSyntaxHighlighter.lex): Added. Scans for a token.
-        (WebInspector.JavaScriptSourceSyntaxHighlighter.appendNonToken): Added. Appends the non-token characters that lex ignored.
-        (WebInspector.JavaScriptSourceSyntaxHighlighter.syntaxHighlightNode): Added. To syntax highlight node in ElementsTreeOutline.
-
-2009-10-27  Mads Ager  <ager@chromium.org>
+        (injectedScriptConstructor):
 
-        Reviewed by Adam Barth.
+2010-03-22  Darin Adler  <darin@apple.com>
 
-        [V8] Missing null check after string conversion in error reporting
-        https://bugs.webkit.org/show_bug.cgi?id=30774
+        Reviewed by Dan Bernstein.
 
-        Add null check after string conversion in error reporting code.
-        ToString conversion can fail for instance when an exception is
-        thrown during conversion.
+        TextBreakIteratorICU.cpp is incompatible with new UBreakIterator type in ICU 4.4
+        https://bugs.webkit.org/show_bug.cgi?id=36381
 
-        Test: fast/dom/error-to-string-stack-overflow.html
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::setUpIterator): Use reinterpret_cast instead of static_cast or relying
+        on conversion to void*.
+        (WebCore::textBreakFirst): Ditto.
+        (WebCore::textBreakLast): Ditto.
+        (WebCore::textBreakNext): Ditto.
+        (WebCore::textBreakPrevious): Ditto.
+        (WebCore::textBreakPreceding): Ditto.
+        (WebCore::textBreakFollowing): Ditto.
+        (WebCore::textBreakCurrent): Ditto.
+        (WebCore::isTextBreak): Ditto.
+        (WebCore::setUpIteratorWithRules): Ditto.
 
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::reportException):
+2010-03-22  Eric Carlson  <eric.carlson@apple.com>
 
-2009-10-27  Steve Block  <steveblock@google.com>
+        Reviewed by Sam Weinig.
 
-        Reviewed by Darin Adler.
+        Typo in GPL license text
+        https://bugs.webkit.org/show_bug.cgi?id=36442
 
-        Use a pair of maps to store Geolocation watchers.
-        https://bugs.webkit.org/show_bug.cgi?id=29178
+        Fix typo - "aint with this library" -> "along with this library".
 
-        The pair of maps allows us to look up a watcher either by its ID or by its GeoNotifier object.
-        The ability to look up by a watcher by its GeoNotifier object will be required when implementing
-        Geolocation::fatalErrorOccurred. See https://bugs.webkit.org/show_bug.cgi?id=27944
+        * bindings/scripts/CodeGenerator.pm:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/scripts/IDLStructure.pm:
+        * bindings/scripts/generate-bindings.pl:
 
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::Watchers::set): Added. Adds a watcher with the given ID.
-        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by ID.
-        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by GeoNotifier object.
-        (WebCore::Geolocation::Watchers::clear): Added. Removes all watchers.
-        (WebCore::Geolocation::Watchers::isEmpty): Added. Determines if there are no watchers.
-        (WebCore::Geolocation::Watchers::getNotifiersVector): Added. Gets a vector of the GeoNotifier objects.
-        (WebCore::Geolocation::watchPosition): Modified. Rename watcher identifier static variable.
-        (WebCore::Geolocation::stopTimersForWatchers): Modified. Use Watchers::getNotifiersVector.
-        (WebCore::Geolocation::handleError): Modified. Use Watchers::getNotifiersVector.
-        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Use Watchers::getNotifiersVector.
-        * page/Geolocation.h: Modified. Adds Geolocation::Watchers class.
-
-2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
+2010-03-22  Jakub Wieczorek  <jwieczorek@webkit.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Simon Hausmann.
 
-        [V8] DOM Storage runtime flag should default to on
-        https://bugs.webkit.org/show_bug.cgi?id=30828
+        [Qt] Don't construct a QLineEdit every time when painting a text field
+        https://bugs.webkit.org/show_bug.cgi?id=36373
 
-        The DOM Storage runtime flag was supposed to default to on.  I accidentally
-        changed the logic to default to false when I moved the flag.
+        Instead, keep one instance per RenderTheme around.
 
-        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::findFrameLineWidth):
 
-2009-10-27  Fumitoshi Ukai  <ukai@chromium.org>
+2010-03-22  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Fix crash found in chromium test_shell.
-        https://bugs.webkit.org/show_bug.cgi?id=30808
+        [Qt] Multiselect Popup - adjusting QtAbstractWebPopup
+        https://bugs.webkit.org/show_bug.cgi?id=36186
 
-        When WebSocket is deleted without close, webkit would crash
-        when it handles didClose.
+        QtAbstractWebPopup must provide new methods to be used by its descendants that
+        wish to handle <select multiple> elements.
 
-        Check scriptExecutionContext before post task for event.
-        Use WebSocketChannel::disconnect() instead of close() in WebSocket
-        destructor, so that WebSocketChannel should not call deleted WebSocket
-        back in didClose().
-        To make sure WebSocketChannel alive while it is processing WebSocket
-        protocol over SocketStreamHandle, ref() in connect() and deref() in
-        didClose().
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::selectItem):
+        (WebCore::QtAbstractWebPopup::multiple):
+        * platform/qt/QtAbstractWebPopup.h:
 
-        * websockets/WebSocket.cpp:
-        (WebCore::WebSocket::~WebSocket):
-        (WebCore::WebSocket::didConnect):
-        (WebCore::WebSocket::didReceiveMessage):
-        (WebCore::WebSocket::didClose):
-        * websockets/WebSocketChannel.cpp:
-        (WebCore::WebSocketChannel::connect):
-        (WebCore::WebSocketChannel::disconnect):
-        (WebCore::WebSocketChannel::didClose):
-        (WebCore::WebSocketChannel::didReceiveData):
-        * websockets/WebSocketChannel.h:
+2010-03-22  Alex Milowski  <alex@milowski.com>
 
-2009-10-27  Dan Bernstein  <mitz@apple.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Darin Adler.
+        Added basic support for mfrac (fractions)
 
-        Updated Apple license
+        Test: mathml/presentation/fractions.xhtml
 
-        * LICENSE-APPLE:
+        * WebCore.xcodeproj/project.pbxproj:
+        * mathml/MathMLInlineContainerElement.cpp:
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/RenderMathMLFraction.cpp: Added.
+        (WebCore::RenderMathMLFraction::RenderMathMLFraction):
+        (WebCore::RenderMathMLFraction::updateFromElement):
+        (WebCore::RenderMathMLFraction::addChild):
+        * mathml/RenderMathMLFraction.h: Added.
 
-2009-10-27  Brady Eidson  <beidson@apple.com>
+2010-03-22  Kevin Decker  <kdecker@apple.com>
 
-        Rubberstamped by Sam Weinig.
+        Reviewed by John Sullivan.
 
-        Re-enable the check that disallows pages with unload handlers in the page cache.
+        https://bugs.webkit.org/show_bug.cgi?id=36328
 
-        <rdar://problem/7196485> and http://webkit.org/b/29021 
+        * page/mac/WebCoreViewFactory.h: Added -missingPluginText method 
+        * platform/LocalizedStrings.h: Added missingPluginText()
+        * platform/gtk/LocalizedStringsGtk.cpp: Likewise.
+        * platform/mac/LocalizedStringsMac.mm: Same here.
+        * platform/qt/Localizations.cpp: Ditto.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
+2010-03-22  Yury Semikhatsky  <yurys@chromium.org>
 
-2009-10-27  Timothy Hatcher  <timothy@apple.com>
+        Reviewed by Pavel Feldman.
 
-        Remove more empty files that didn't get removed earlier.
+        Handle worker exceptions in V8MessageHandler like it's done in regular documents. This way all worker exceptions will be logged in the console not only those which happen in event listeners. 
 
-        * inspector/DOMDispatchTimelineItem.cpp: Removed.
-        * inspector/DOMDispatchTimelineItem.h: Removed.
+        https://bugs.webkit.org/show_bug.cgi?id=31171
 
-2009-10-27  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Removed explicit call to reportException.
+        * bindings/v8/V8Utilities.cpp: reportException function was removed since it's not used.
+        (WebCore::getScriptExecutionContext):
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::v8MessageHandler):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded): Setup message handler when first worker context is created.
 
-        Reviewed by Tor Arne Vestbø.
+2010-03-22  Leandro Pereira  <leandro@profusion.mobi>
 
-        [Qt] Fix assertion crashes introduced by changes made in r50110.
+        Reviewed by Simon Hausmann.
 
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::parseEndElement): only call popCurrentNode() if there are nodes left in the stack.
+        Add EFL-specific code to page/EventHandler.cpp.
+        http://webkit.org/b/36306
 
-2009-10-27  Timothy Hatcher  <timothy@apple.com>
+        * page/EventHandler.cpp:
 
-        Remove empty files that didn't get removed earlier.
+2010-03-22  Leandro Pereira  <leandro@profusion.mobi>
 
-        * inspector/TimelineItem.cpp: Removed.
-        * inspector/TimelineItem.h: Removed.
+        Reviewed by Simon Hausmann.
 
-2009-10-27  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+        Add EFL-specific code to platform/DragImage.h and
+        platform/DragData.h.
+        http://webkit.org/b/36310
 
-        Reviewed by Xan Lopez.
+        * platform/DragImage.h:
+        * platform/DragData.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=25534
-        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+2010-03-22  Leandro Pereira  <leandro@profusion.mobi>
 
-        First part of the implementation of AtkTable.
+        Reviewed by Simon Hausmann.
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (getCell):
-        (getCellIndex):
-        (webkit_accessible_table_ref_at):
-        (webkit_accessible_table_get_index_at):
-        (webkit_accessible_table_get_n_columns):
-        (webkit_accessible_table_get_n_rows):
-        (webkit_accessible_table_get_column_extent_at):
-        (webkit_accessible_table_get_row_extent_at):
-        (webkit_accessible_table_get_row_header):
-        (atk_table_interface_init):
-        (AtkInterfacesInitFunctions):
-        (GetAtkInterfaceTypeFromWAIType):
+        Add EFL-specific code to platform/FileSystem.h.
+        http://webkit.org/b/36313
 
-2009-10-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        * platform/FileSystem.h:
 
-        Reviewed by Lars Knoll.
+2010-03-22  Leandro Pereira  <leandro@profusion.mobi>
 
-        [Qt] Don't lose remainder when computing wheel event deltas
+        Reviewed by Simon Hausmann.
 
-        * platform/qt/WheelEventQt.cpp:
+        Add EFL-specific code to platform/Cursor.h.
+        http://webkit.org/b/36319
 
-2009-10-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        * platform/Cursor.h:
 
-        Reviewed by Antti Koivisto.
+2010-03-22  Leandro Pereira  <leandro@profusion.mobi>
 
-        Fix QtWebKit build for WIN_OS if Netscape plug-in support
-        is turned off and refactor some related code
-        https://bugs.webkit.org/show_bug.cgi?id=30786
+        Reviewed by Simon Hausmann.
 
-        No new tests as there is no new functionality introduced.
+        Add EFL-specific code to platform/NotImplemented.h.
+        http://webkit.org/b/36320
 
-        * platform/FileSystem.h: Refactor to make sure that each different
-        type definition is only repeated once.
+        * platform/NotImplemented.h:
 
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::compareFileVersion): Move it out from the
-        ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH guard and combine it with the
-        function body from PluginPackageWin.
+2010-03-21  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-        * plugins/win/PluginPackageWin.cpp: Remove compareFileVersion as
-        it is now in PluginPackage.cpp.
+        Reviewed by Simon Hausmann.
 
-2009-10-26  Xan Lopez  <xlopez@igalia.com>
+        [Qt] GraphicsLayer: matrix interpolations in transform-animations don't behave correctly
+        https://bugs.webkit.org/show_bug.cgi?id=35520
+        
+        The case where the list of source and target transform operations are 
+        not the same but have the same size needs to be special-cased in
+        GraphicsLayerQt, as well as the case where the source or target
+        operation list is empty. The URLs listed here render correctly after
+        applying the patch.
 
-        Reviewed by Gustavo Noronha.
+        Tests: https://bug-35520-attachments.webkit.org/attachment.cgi?id=49890
+               https://bug-35520-attachments.webkit.org/attachment.cgi?id=49889
+            
 
-        https://bugs.webkit.org/show_bug.cgi?id=27011
-        [Gtk] Implement support for get_index_in_parent
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::TransformAnimationQt::applyFrame):
 
-        Implement atk_object_get_index_in_parent.
+2010-03-21  Dmitry Gorbik  <socket.h@gmail.com>
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_index_in_parent):
+        <http://webkit.org/b/14858> <col> width ignored when not tied to a single cell
 
-2009-10-27  Eric Seidel  <eric@webkit.org>
+        Reviewed by David Kilzer.
 
-        No review, rolling out r50131.
-        http://trac.webkit.org/changeset/50131
+        Fixed width calculation for cells with span when <col> is defined.
 
-        * bridge/objc/objc_instance.h:
-        * bridge/objc/objc_instance.mm:
-        (ObjcInstance::ObjcInstance):
-        (ObjcInstance::virtualEnd):
+        Test: fast/table/col-width-span-expand.html
 
-2009-10-26  Daniel Bates  <dbates@webkit.org>
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::styleOrColWidth): Added the calculation of cell width
+        in case of <col> defined and span > 1.
 
-        Reviewed by Darin Adler.
+2010-03-20  Antonio Gomes  <tonikitoo@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30491
+        Reviewed by Kenneth Christiansen.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        Fixes an issue where pressing return/enter on the keyboard 
-        in <isindex> does not submit it if is not within a <form>.
+        Spatial Navigation: Code simplification in FocusController.cpp and SpatialNavigation.cpp (part I)
+        https://bugs.webkit.org/show_bug.cgi?id=36168
 
-        According to the HTML 2.0 thru HTML 4.01 spec 
-        (http://www.w3.org/MarkUp/html-spec/html-spec_7.html#SEC7.5), the 
-        <isindex> element does not need to be within a <form> element in 
-        order to submit it. It can submitted on its own. Also, if present,
-        the href property of the <base> element will dictate where to submit
-        the value of the <isindex> element (this is analogous to the action 
-        property of the <form> element).
+        Make use of isNull and document methods introduced in FocusCandidate class by patch in bug 36167.
+        No functionalty change.
 
-        Tests: http/tests/misc/isindex-with-no-form-base-href.html
-               http/tests/misc/isindex-with-no-form.html
+        * page/FocusController.cpp:
+        (WebCore::updateFocusCandidateIfCloser):
+        * page/SpatialNavigation.cpp:
+        (WebCore::distanceInDirection):
 
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::defaultEventHandler): Calls createTemporaryFormForIsIndex()
-        to create a <form> if none is present and we are an <isindex> element.
-        (WebCore::HTMLInputElement::createTemporaryFormForIsIndex): Added.
-        * html/HTMLInputElement.h:
+2010-03-20  Kevin Ollivier  <kevino@theolliviers.com>
 
-2009-10-26  Oliver Hunt  <oliver@apple.com>
+        [wx] Build fixes after recent changes.
 
-        Reviewed by Maciej Stachowiak.
+        * platform/graphics/wx/ImageWx.cpp:
+        * wscript:
 
-        Crash occurs after launching Newsfire 1.6 for the first time
-        https://bugs.webkit.org/show_bug.cgi?id=30807
+2010-03-20  Joseph Pecoraro  <joepeck@webkit.org>
 
-        Use a RetainPtr in ObjcBinding to ensure that we adequately
-        protect the autorelease pool from GC in GC'd applications.
+        Reviewed by David Kilzer.
 
-        * bridge/objc/objc_instance.h:
-        * bridge/objc/objc_instance.mm:
-        (ObjcInstance::ObjcInstance):
-        (ObjcInstance::virtualEnd):
+        Assertion failure in media/video-controls-with-mutation-event-handler.html
+        https://bugs.webkit.org/show_bug.cgi?id=36376
 
-2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Test: media/video-controls-with-mutation-event-handler.html
 
-        Unreviewed.
+        Break early (when not attached) in the defaultEventHandler before the
+        slider is completely set up.
 
-        [Qt] Build fix for QtWebKit after r50125.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+        (WebCore::MediaControlVolumeSliderElement::defaultEventHandler):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
 
-        * WebCore.pro: Rename TimelineItem to TimelineRecord.
+2010-03-19  Shinichiro Hamaji  <hamaji@chromium.org>
 
-2009-10-26  Matt Mueller  <mattm@chromium.org>
+        Reviewed by Dan Bernstein.
 
-        Reviewed by Darin Adler.
+        WebCore::RenderButton::styleDidChange ReadAV@NULL (6739b7fe455ecb54a6812c0866c3b47c)
+        https://bugs.webkit.org/show_bug.cgi?id=34641
 
-        Refactor synchronizable property handling to store one shouldSynchronize flag per set of properties rather than one per property.
+        Don't dig into buttons and menu lists when finding which element
+        should be modified by :first-letter pseudo class.  Even before
+        this change, we didn't dig into inline buttons and menu lists as
+        they are replaced so this issue wasn't found long time.
 
-        Fixes reading uninitialized memory in SynchronizableProperty hash function as well as simplifying the code.
+        Test: fast/css/first-letter-block-form-controls-crash.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=30658
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter):
 
-        Covered by running various svg tests under valgrind, ex:
-        LayoutTests/svg/custom/js-late-mask-and-object-creation.svg
+2010-03-19  Adam Barth  <abarth@webkit.org>
 
-        * svg/SynchronizablePropertyController.cpp:
-        (WebCore::SynchronizableProperties::addProperty):
-        (WebCore::SynchronizableProperties::synchronize):
-        (WebCore::SynchronizableProperties::startAnimation):
-        (WebCore::SynchronizableProperties::stopAnimation):
-        (WebCore::SynchronizablePropertyController::registerProperty):
-        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
-        (WebCore::SynchronizablePropertyController::synchronizeProperty):
-        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
-        (WebCore::SynchronizablePropertyController::startAnimation):
-        (WebCore::SynchronizablePropertyController::stopAnimation):
-        * svg/SynchronizablePropertyController.h:
-        (WebCore::SynchronizableProperties::SynchronizableProperties):
-        (WebCore::SynchronizableProperties::setNeedsSynchronization):
+        Reviewed by Daniel Bates.
 
-2009-10-26  Kelly Norton  <knorton@google.com>
+        Change XSSAuditor block syntax
+        https://bugs.webkit.org/show_bug.cgi?id=34436
 
-        Reviewed by Timothy Hatcher.
+        Update our blocking syntax to something more reasonable.  Also,
+        implemented a way for a web site to disable the filter.
 
-        Renames TimelineItem to TimelineRecord and updates all call sites.
-        https://bugs.webkit.org/show_bug.cgi?id=30785
+        Tests: http/tests/security/xssAuditor/no-protection-script-tag.html
+               http/tests/security/xssAuditor/xss-protection-parsing-01.html
 
-        * GNUmakefile.am: 
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addRecordToTimeline):
-        * inspector/InspectorFrontend.h:
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::willLayout):
-        (WebCore::InspectorTimelineAgent::didLayout):
-        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::willPaint):
-        (WebCore::InspectorTimelineAgent::didPaint):
-        (WebCore::InspectorTimelineAgent::willWriteHTML):
-        (WebCore::InspectorTimelineAgent::didWriteHTML):
-        (WebCore::InspectorTimelineAgent::didInstallTimer):
-        (WebCore::InspectorTimelineAgent::didRemoveTimer):
-        (WebCore::InspectorTimelineAgent::willFireTimer):
-        (WebCore::InspectorTimelineAgent::didFireTimer):
-        (WebCore::InspectorTimelineAgent::reset):
-        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
-        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
-        * inspector/InspectorTimelineAgent.h:
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::xssProtection):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::skipToken):
+        (WebCore::parseXSSProtectionHeader):
+        * platform/network/HTTPParsers.h:
         (WebCore::):
-        (WebCore::InspectorTimelineAgent::RecordEntry::RecordEntry):
-        * inspector/TimelineItemFactory.cpp: Removed.
-        * inspector/TimelineItemFactory.h: Removed.
-        * inspector/TimelineRecordFactory.cpp: Added.
-        (WebCore::TimelineRecordFactory::createGenericRecord):
-        (WebCore::TimelineRecordFactory::createDOMDispatchRecord):
-        (WebCore::TimelineRecordFactory::createGenericTimerRecord):
-        (WebCore::TimelineRecordFactory::createTimerInstallRecord):
-        * inspector/TimelineRecordFactory.h: Added.
-        (WebCore::TimelineRecordFactory::TimelineRecordFactory):
-        * inspector/front-end/TimelineAgent.js:
-        (WebInspector.addRecordToTimeline):
-        * inspector/front-end/TimelinePanel.js:
-        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
-        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
-        (WebInspector.TimelinePanel.prototype.getRecordTypeName):
-        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
-
-2009-10-26  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Antti Koivisto.
-
-        [Qt] Windowless Plugins : Print preview shows only part of flash when view is scrolled
-        
-        When printing, QPrinter's preview mode uses a QPicture to capture the output. The
-        QPicture holds a reference to the X Pixmap. As a result, the print preview would
-        update itself when the X Pixmap changes. To prevent the print preview from updating
-        whenever m_drawable is updated (i.e when the view updates), we create a copy.
-        
-        We require that a QPixmap::copy() result in a QPixmap backed by a XPixmap
-        regardless of the graphicssystem. This is taken care of by
-        commit d310f7c710ecb331a9689861f0551eabd38e946e in Qt (4.6)
-        
-        The beauty of this patch is that the newly created X Pixmap is managed by Qt and
-        it will free the Pixmap whenever the user closes the print preview dialog and
-        handles the case of displaying multiple preview dialogs nicely.
-        
-        All credit to Samuel Rødal for suggesting usage of QPixmap::copy().
-        
-        https://bugs.webkit.org/show_bug.cgi?id=30714
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
-
-2009-10-26  Benjamin Otte  <otte@gnome.org>
-
-        Reviewed by Gustavo Noronha.
-
-        Don't store properties in the MediaPlayerPrivate class
-
-        Access them via the MediaPlayer class instead.
-        https://bugs.webkit.org/show_bug.cgi?id=30462
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::seek):
-        (WebCore::MediaPlayerPrivate::setVolume):
-        (WebCore::MediaPlayerPrivate::setRate):
-        (WebCore::MediaPlayerPrivate::setVisible):
-        (WebCore::MediaPlayerPrivate::paint):
-        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-
-2009-10-26  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <http://webkit.org/b/30801>.
-        Web Inspector: Control + ]/[ on Windows doesn't change Panels.
-        
-        In my testing, Windows uses "U+00DB" and "U+00DD" to represent
-        [ and ], so we should honor those as well.
-
-        * inspector/front-end/inspector.js:
-        (WebInspector.documentKeyDown):
-
-2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        Make .rc files compile on Windows without depending on MFC headers
-        https://bugs.webkit.org/show_bug.cgi?id=30750
-
-        * WebCore.vcproj/QTMovieWin.rc: Use winresrc.h because it exists 
-        even when MFC is not installed, and is all that's needed here.
 
-2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
+2010-03-19  Eric Uhrhane  <ericu@chromium.org>
 
-        Reviewed by Darin Adler.
-
-        Build corrections for ENABLE_FILTERS in Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=30797
-
-        Build correction for ENABLE_FILTERS feature.  No new tests needed.
-
-        * platform/graphics/filters/FEColorMatrix.cpp: Use MathExtras.h and
-          its piDouble constant.
-        * platform/graphics/filters/FEGaussianBlur.cpp: Use MathExtras.h and
-          its piDouble constant.  Remove unnecessary call to floor used in
-          the division of an unsigned, converting to int.
-        * platform/graphics/win/SimpleFontDataCairoWin.cpp: Correct include
-          style for MathExtras.h.
+        Reviewed by Dmitry Titov.
 
-2009-10-26  Brady Eidson  <beidson@apple.com>
+        Refactor DatabaseTracker.cpp for thread safety
+        https://bugs.webkit.org/show_bug.cgi?id=34991
 
-        Reviewed by Darin Adler.
+        This enables calling into DatabaseTracker from multiple context threads,
+        as will happen once Workers can access the Database.  It required a fair
+        amount of reshuffling of locks.  I ended up splitting the public
+        interface [calls that take locks and call private functions] from the
+        implementations [calls that assert that locks are already held] in order
+        to avoid lock conflicts.  I also had to make sure we weren't sharing
+        Strings or SecurityOrigins across threads.
 
-        <rdar://problem/7289467> and http://webkit.org/b/30798 - REGRESSION (r48687): www.myuhc.com doesn't load.
+        No new tests.
 
-        Test: fast/loader/grandparent-completion-starts-redirect.html
+        Allow access to database handles from multiple threads IFF SQLite is new enough and the user requests it.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::completed): Notify all descendants that the load completed, not just direct children.
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::SQLiteDatabase):
+        (WebCore::SQLiteDatabase::disableThreadingChecks):
+        * platform/sql/SQLiteDatabase.h:
+        (WebCore::SQLiteDatabase::sqlite3Handle):
+        (WebCore::SQLiteDatabase::disableThreadingChecks):
 
-2009-10-26  Dan Bernstein  <mitz@apple.com>
+        Remove an asynchronous call from Database::close back to the execution thread, so that cleanup can be more deterministic.
 
-        Reviewed by Beth Dakin.
+        * storage/Database.cpp:
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::Database::close):
+        * storage/Database.h:
+        (WebCore::Database::):
+        * storage/DatabaseDetails.h:
+        (WebCore::DatabaseDetails::DatabaseDetails):
+        (WebCore::DatabaseDetails::thread):
+        * storage/DatabaseTask.cpp:
+        (WebCore::DatabaseCloseTask::doPerformTask):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThread):
 
-        Re-add CSSPropertyWebkitBackgroundSize in one more place
+        Any Strings that get stored in DatabaseTracker, and any Strings returned from DatabaseTracker, are now threadsafeCopies.
+        Public functions now take all needed locks, then generally call only private functions [there are a few exceptions: deletion functions and origins()].
+        Private functions no longer take locks.
+        m_quotaMapGuard becomes m_databaseGuard, and now protects m_database, m_quotaMap, m_proposedDatabases, m_databaseDirectoryPath, m_originsBeingDeleted, m_beingCreated, and m_beingDeleted.
+        m_proposedDatabases replaces m_proposedDatabase, to account for reentrancy.
 
-        Fixes transitions/multiple-background-size-transitions.html, transitions/background-transitions.html
+        * storage/DatabaseTracker.h:
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::originQuotaManagerNoLock):
+        (WebCore::DatabaseTracker::originQuotaManager):
+        (WebCore::DatabaseTracker::DatabaseTracker):
+        (WebCore::DatabaseTracker::setDatabaseDirectoryPath):
+        (WebCore::DatabaseTracker::databaseDirectoryPath):
+        (WebCore::DatabaseTracker::trackerDatabasePath):
+        (WebCore::DatabaseTracker::openTrackerDatabase):
+        (WebCore::DatabaseTracker::canEstablishDatabase):
+        (WebCore::DatabaseTracker::hasEntryForOriginNoLock):
+        (WebCore::DatabaseTracker::hasEntryForOrigin):
+        (WebCore::DatabaseTracker::hasEntryForDatabase):
+        (WebCore::DatabaseTracker::originPath):
+        (WebCore::DatabaseTracker::fullPathForDatabaseNoLock):
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+        (WebCore::DatabaseTracker::populateOrigins):
+        (WebCore::DatabaseTracker::origins):
+        (WebCore::DatabaseTracker::databaseNamesForOriginNoLock):
+        (WebCore::DatabaseTracker::databaseNamesForOrigin):
+        (WebCore::DatabaseTracker::detailsForNameAndOrigin):
+        (WebCore::DatabaseTracker::setDatabaseDetails):
+        (WebCore::DatabaseTracker::usageForDatabase):
+        (WebCore::DatabaseTracker::addOpenDatabase):
+        (WebCore::DatabaseTracker::removeOpenDatabase):
+        (WebCore::DatabaseTracker::usageForOriginNoLock):
+        (WebCore::DatabaseTracker::usageForOrigin):
+        (WebCore::DatabaseTracker::quotaForOriginNoLock):
+        (WebCore::DatabaseTracker::quotaForOrigin):
+        (WebCore::DatabaseTracker::setQuota):
+        (WebCore::DatabaseTracker::addDatabase):
+        (WebCore::DatabaseTracker::deleteAllDatabases):
+        (WebCore::DatabaseTracker::deleteOrigin):
+        (WebCore::DatabaseTracker::deleteDatabase):
+        (WebCore::DatabaseTracker::deleteDatabaseFile):
+        (WebCore::DatabaseTracker::setClient):
+        (WebCore::DatabaseTracker::scheduleNotifyDatabaseChanged):
+        (WebCore::DatabaseTracker::notifyDatabasesChanged):
+
+        These functions keep track of in-progress deletions and creations, so that we can make sure nobody every deletes a database file while a live database is using it.
+        (WebCore::DatabaseTracker::canCreateDatabase):
+        (WebCore::DatabaseTracker::recordCreatingDatabase):
+        (WebCore::DatabaseTracker::doneCreatingDatabase):
+        (WebCore::DatabaseTracker::creatingDatabase):
+        (WebCore::DatabaseTracker::canDeleteDatabase):
+        (WebCore::DatabaseTracker::recordDeletingDatabase):
+        (WebCore::DatabaseTracker::doneDeletingDatabase):
+        (WebCore::DatabaseTracker::deletingDatabase):
+        (WebCore::DatabaseTracker::canDeleteOrigin):
+        (WebCore::DatabaseTracker::deletingOrigin):
+        (WebCore::DatabaseTracker::recordDeletingOrigin):
+        (WebCore::DatabaseTracker::doneDeletingOrigin):
+
+        Any SecurityOrigins stored in OriginQuotaManager are now threadsafeCopies of inputs.  There's a new tryLock() function in addition to the existing lock().
 
-        * page/animation/AnimationBase.cpp:
-        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        * storage/OriginQuotaManager.cpp:
+        (WebCore::OriginQuotaManager::tryLock):
+        (WebCore::OriginQuotaManager::trackOrigin):
+        * storage/OriginQuotaManager.h:
 
-2009-10-26  Jeremy Orlow  <jorlow@chromium.org>
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::databaseIdentifier):
+        Removed DEFINE_STATIC_LOCAL wrapper on a local variable; it appears to have been a small optimization, but it's not thread-safe.
 
-        Reviewed by Dimitri Glazkov.
+2010-03-19  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        [V8] Tidy up the DOM Storage runtime flag stuff
-        https://bugs.webkit.org/show_bug.cgi?id=30794
+        Reviewed by Antti Koivisto.
 
-        Clean up the DOM Storage runtime flag stuff to match the new way of doing
-        things.  No behavioral changes.
+        Multiselect popups - rendering
+        https://bugs.webkit.org/show_bug.cgi?id=36006
 
-        * bindings/v8/RuntimeEnabledFeatures.cpp:
-        * bindings/v8/RuntimeEnabledFeatures.h:
-        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
-        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
-        (WebCore::RuntimeEnabledFeatures::setLocalStorageEnabled):
-        (WebCore::RuntimeEnabledFeatures::localStorageEnabled):
-        (WebCore::RuntimeEnabledFeatures::setSessionStorageEnabled):
-        (WebCore::RuntimeEnabledFeatures::sessionStorageEnabled):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * storage/Storage.cpp:
-        * storage/Storage.h:
+        The objective of this patch is to create a compile time flag that can be used
+        to force all <select> elements to be rendered as menu lists.
 
-2009-10-26  Brady Eidson  <beidson@apple.com>
+        Theme stylesheet mechanism has been used to change the appearance of the elements.
 
-        Reviewed by Darin Adler.
+        Class QtStyleOptionWebComboBox has been introduced to provide to QStyle objects
+        the needed information to render <select multiple> comboboxes.
 
-        <rdar://problem/7308952> and http://webkit.org/b/30424 - REGRESSION (r48687): Pages on ucas.com appear blank.
+        * WebCore.pri:
+        * WebCore.pro:
+        * css/themeQtNoListboxes.css: Added.
+        (select[size][multiple]):
+        * dom/SelectElement.h:
+        (WebCore::SelectElementData::usesMenuList):
+        * platform/qt/QtStyleOptionWebComboBox.h: Added.
+        (WebCore::QtStyleOptionWebComboBox::QtStyleOptionWebComboBox):
+        (WebCore::QtStyleOptionWebComboBox::multiple):
+        (WebCore::QtStyleOptionWebComboBox::checkMultiple):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::extraDefaultStyleSheet):
+        (WebCore::RenderThemeQt::paintMenuList):
+        (WebCore::RenderThemeQt::paintMenuListButton):
+        * platform/qt/RenderThemeQt.h:
 
-        Test: fast/loader/history-forward-in-head.html
+2010-03-19  Zhenyao Mo  <zmo@google.com>
 
-        * loader/RedirectScheduler.cpp:
-        (WebCore::RedirectScheduler::scheduleHistoryNavigation): Restore the moved canGoBackOrForward() check.
-          This restores the side effect of an invalid history navigation canceling previous scheduled redirects
-          and also fixes the bug of scheduling an invalid history navigation canceling parsing of the current document.
-        (WebCore::RedirectScheduler::timerFired): Removed the canGoBackOrForward() check as it is now made before
-          the redirect is scheduled.
+        Reviewed by Oliver Hunt.
 
-2009-10-26  Alexey Proskuryakov  <ap@apple.com>
+        Update WebGLArray.slice() to new spec
+        https://bugs.webkit.org/show_bug.cgi?id-35612
+
+        * bindings/js/JSWebGLArrayCustom.cpp: Adding support for default inputs.
+        (WebCore::JSWebGLArray::slice):
+        * bindings/v8/custom/V8WebGLArrayCustom.cpp: Ditto.
+        (WebCore::V8WebGLArray::sliceCallback):
+        * html/canvas/WebGLArray.cpp: Map start/end to offset/length.
+        (WebCore::WebGLArray::calculateOffsetAndLength):
+        * html/canvas/WebGLArray.h: Modified slice parameters.
+        * html/canvas/WebGLArray.idl: Define custom binding for slice().
+        * html/canvas/WebGLByteArray.cpp: Modified slice parameters.
+        (WebCore::WebGLByteArray::slice):
+        * html/canvas/WebGLByteArray.h: Ditto.
+        * html/canvas/WebGLFloatArray.cpp: Ditto.
+        (WebCore::WebGLFloatArray::slice):
+        * html/canvas/WebGLFloatArray.h: Ditto.
+        * html/canvas/WebGLIntArray.cpp: Ditto.
+        (WebCore::WebGLIntArray::slice):
+        * html/canvas/WebGLIntArray.h: Ditto.
+        * html/canvas/WebGLShortArray.cpp: Ditto.
+        (WebCore::WebGLShortArray::slice):
+        * html/canvas/WebGLShortArray.h: Ditto.
+        * html/canvas/WebGLUnsignedByteArray.cpp: Ditto.
+        (WebCore::WebGLUnsignedByteArray::slice):
+        * html/canvas/WebGLUnsignedByteArray.h: Ditto.
+        * html/canvas/WebGLUnsignedIntArray.cpp: Ditto.
+        (WebCore::WebGLUnsignedIntArray::slice):
+        * html/canvas/WebGLUnsignedIntArray.h: Ditto.
+        * html/canvas/WebGLUnsignedShortArray.cpp: Ditto.
+        (WebCore::WebGLUnsignedShortArray::slice):
+        * html/canvas/WebGLUnsignedShortArray.h: Ditto.
+
+2010-03-19  Yong Li <yong.li@torchmobile.com> and Andy Estes <aestes@apple.com>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30049
-        <rdar://problem/7286002> Manipulating DOM from a script while parsing XHTML can cause a crash
+        Ensure the segments inside SharedBuffer are merged before constructing
+        a CFData with it.
 
-        Tests: fast/parser/remove-current-node-parent-x-2.xhtml
-               fast/parser/remove-current-node-parent-x.xhtml
+        https://bugs.webkit.org/show_bug.cgi?id=50843
 
-        * dom/XMLTokenizer.h: Store the whole stack of parent nodes - element.parentNode() is
-        unreliable after DOM manipulation.
+        * manual-tests/WebKitSite.webarchive: Added.
+        * manual-tests/webarchive-test.html: Added.
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::createCFData):
 
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::pushCurrentNode): Push the new node onto stack.
-        (WebCore::XMLTokenizer::popCurrentNode): This is now called instead of setCurrentNode when
-        exiting a node.
-        (WebCore::XMLTokenizer::clearCurrentNodeStack): We're aborting; or just done parsing. This
-        replaces setCurrentNode(0).
-        (WebCore::XMLTokenizer::enterText): Call pushCurrentNode().
-        (WebCore::XMLTokenizer::exitText): Call popCurrentNode(), removing a long-standing FIXME
-        (not sure if it was ever practical though - how can a parent become null while adding text?)
+2010-03-19  Justin Schuh  <jschuh@chromium.org>
 
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::~XMLTokenizer): Call clearCurrentNodeStack().
-        (WebCore::XMLTokenizer::startElementNs): Call pushCurrentNode().
-        (WebCore::XMLTokenizer::endElementNs): Call popCurrentNode() to safely get to a parent. Also
-        added a check fo script element still being in document - Firefox parses those that aren't,
-        but doesn't execute them.
+        Reviewed by Oliver Hunt.
 
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::~XMLTokenizer):
-        (WebCore::XMLTokenizer::parseStartElement):
-        (WebCore::XMLTokenizer::parseEndElement):
-        Match libxml2 version changes.
+        Security: ReadAV@NULL for negative feMorphology filter radius
+        https://bugs.webkit.org/show_bug.cgi?id=34566
 
-2009-10-26  Dan Bernstein  <mitz@apple.com>
+        Prevents building the filter if either radius is negative.
+        Catches negative radii resulting from conversions.
 
-        Reviewed by Beth Dakin.
+        Test: svg/filters/feMorphology-invalid-radius.svg
 
-        background-size: X treated as background-size: X X, not background-size: X auto
-        https://bugs.webkit.org/show_bug.cgi?id=28440
+        * svg/SVGFEMorphologyElement.cpp:
+        (WebCore::SVGFEMorphologyElement::build):
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
 
-        Updated fast/backgrounds/size/resources/parsing-background-size-values.js
-        and fast/backgrounds/size/resources/parsing-inherit.js
+2010-03-19  Chris Marrin  <cmarrin@apple.com>
 
-        Reinstated -webkit-background-size and kept its behavior of filling in
-        the second value with the first one; and changed background-size to have
-        the behavior of filling in the second value with 'auto'.
+        Reviewed by Simon Fraser.
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (computedProperties): Re-added CSSPropertyWebkitBackgroundSize.
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue): Ditto.
-        (WebCore::CSSParser::parseFillSize): Adapted for the new parsing rule.
-        (WebCore::CSSParser::parseFillProperty): Re-added
-        CSSPropertyWebkitBackgroundSize.
-        (WebCore::cssPropertyID): Removed mapping of -webkit-background-size to
-        background-size.
-        * css/CSSParser.h:
-        * css/CSSPropertyNames.in: Re-added -webkit-background-size.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty): Re-added
-        CSSPropertyWebkitBackgroundSize.
+        Fixed a crash with AnimationController getting deleted out from under itself.
+        
+        It's possible for the Frame that owns an AnimationController to get deleted
+        in the EndTransitionEvent (or other animation events) to get deleted in the
+        event handler. Normally this case is protected against by preventing the Frame
+        from getting deleted until the end of the runloop. But native uses of the 
+        WebView can subvert this protection. So I added a protector to the 
+        animation event dispatcher to protect it in those cases.
 
-2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Test: transitions/transition-end-event-destroy-iframe.html
 
-        Reviewed by Eric Seidel.
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
 
-        [Qt] Use "%lli" to format "long long" on WIN_OS to fix HTML5 WebDB crash
-        https://bugs.webkit.org/show_bug.cgi?id=30777
+2010-03-19  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        No new tests as the crash can be reproduced by existing storage
-        LayoutTests (by hitting an assert in debug mode Webkit on WIN_OS).
+        Reviewed by Antti Koivisto.
 
-        * platform/text/String.cpp:
-        (WebCore::String::number): Qt's QString::vsprintf does not
-        understand the "%I64u" format string. Always use the "%lli"
-        format string for Qt port.
+        Multiselect Popup - PopupMenuClient extension
+        https://bugs.webkit.org/show_bug.cgi?id=36178
 
-2009-10-26  Tony Chang  <tony@chromium.org>
+        PopupMenuClient class is the interface used by combobox popup implementations.
+        It needs to be extended to handle <select multiple> needs.
 
-        Reviewed by Eric Seidel.
+        A new interface named ListPopupMenuClient that inherits from PopupMenuClient was created.
+        The use of this new class instead of adding methods to PopupMenuClient avoids changes
+        in other non related implementations of PopupMenuClient.
 
-        Roll back r50073 because r50041-50043 were reverted.  r50073 was
-        a chromium side fix for r50041.
-        https://bugs.webkit.org/show_bug.cgi?id=30789
+        RenderMenuList has changed to inherit ListPopupMenuClient instead of PopupMenuClient
+        and to have the new methods implemented.
 
-        * bindings/v8/V8Collection.h:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::getItem):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::getItem):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * platform/PopupMenuClient.h:
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::listBoxSelectItem):
+        (WebCore::RenderMenuList::multiple):
+        * rendering/RenderMenuList.h:
 
-2009-10-26  Geoffrey Garen  <ggaren@apple.com>
+2010-03-19  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Dimitri Glazkov.
 
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=30765
-        REGRESSION (r48701): Removing an event listener causes the one added just after it not to fire
+        https://bugs.webkit.org/show_bug.cgi?id=36387
+        REGRESSION: Can "uncheck" radio buttons by clicking on them
         
-        and related bugs.
-
-        If the event listener being removed is prior to the current firing event
-        iterator, we need to decrement the current firing event iterator in
-        addition to the endpoint. (Otherwise, shrinking the event listener vector
-        by one implicity moves the current firing event iterator forward by one.
-        It's like relativity, only without the planets.)
-        
-        Also took the opportunity to change some pointers to references, since
-        they can't be null.
-
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::removeEventListener):
-        (WebCore::EventTarget::removeAllEventListeners): Update iterator in addition
-        to end, if need be.
-        (WebCore::EventTarget::fireEventListeners): Updated for interface changes.
-        Added a comment to explain a behavior that was implicit enough to be
-        confusing.
-
-        * dom/EventTarget.h:
-        (WebCore::FiringEventIterator::FiringEventIterator):
-        (WebCore::EventTarget::isFiringEventListeners): Updated for interface changes.
-
-2009-10-26  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <http://webkit.org/b/30792>.
-        Web Inspector: When changing resource scope, resource graph can get in weird state.
-        
-        If the user was scrolled down while looking at All resources, and then just
-        selects Fonts, or something that doesn't have many resources, then the graph
-        will stay scrolled down, even when there is no content there.
+        My change in r56174 caused radio buttons and checkboxes to go down the same code path by virtue
+        of allowsIndeterminate(), but this broke save/restore behavior on radio buttons.
         
-        When the filter is updated, scroll to the top of the graph view, so this won't
-        happen.
-
-        * inspector/front-end/AbstractTimelinePanel.js:
-        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
-
-2009-10-26  Sam Weinig  <sam@webkit.org>
-
-        Fix mac clean build.
-
-        * html/HTMLOptionsCollection.idl:
-
-2009-10-26  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Extract AbstractTimelinePanel that will be a base
-        class for ResourcesPanel and TimelinePanel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30776
-
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/AbstractTimelinePanel.js: Added.
-        (WebInspector.AbstractTimelinePanel):
-        (WebInspector.AbstractTimelinePanel.prototype.get categories):
-        (WebInspector.AbstractTimelinePanel.prototype.showCategory):
-        (WebInspector.AbstractTimelinePanel.prototype.hideCategory):
-        (WebInspector.AbstractTimelinePanel.prototype.createTimelinePanels):
-        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel.createFilterElement):
-        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel):
-        (WebInspector.AbstractTimelinePanel.prototype.filter):
-        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
-        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
-        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
-        (WebInspector.AbstractTimelinePanel.prototype._updateSummaryGraph):
-        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
-        (WebInspector.AbstractTimelinePanel.prototype.get needsRefresh):
-        (WebInspector.AbstractTimelinePanel.prototype.set needsRefresh):
-        (WebInspector.AbstractTimelinePanel.prototype.refreshIfNeeded):
-        (WebInspector.AbstractTimelinePanel.prototype.show):
-        (WebInspector.AbstractTimelinePanel.prototype.resize):
-        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
-        (WebInspector.TimelineCalculator):
-        (WebInspector.TimelineCalculator.prototype.computeSummaryValues):
-        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
-        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
-        (WebInspector.TimelineCalculator.prototype.get boundarySpan):
-        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
-        (WebInspector.TimelineCalculator.prototype.reset):
-        (WebInspector.TimelineCalculator.prototype._value):
-        (WebInspector.TimelineCalculator.prototype.formatValue):
-        * inspector/front-end/ResourceCategory.js:
-        (WebInspector.ResourceCategory):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get toolbarItemLabel):
-        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
-        (WebInspector.ResourcesPanel.prototype.get categories):
-        (WebInspector.ResourcesPanel.prototype.showCategory):
-        (WebInspector.ResourcesPanel.prototype.hideCategory):
-        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
-        (WebInspector.ResourcesPanel.prototype.populateSidebar):
-        (WebInspector.ResourcesPanel.prototype.createPanelEnabler):
-        (WebInspector.ResourcesPanel.prototype.createStatusbarButtons):
-        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
-        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
-        (WebInspector.ResourcesPanel.prototype.show):
-        (WebInspector.ResourcesPanel.prototype.resize):
-        (WebInspector.ResourcesPanel.prototype.reset):
-        (WebInspector.ResourcesPanel.prototype.updateGraphDividersIfNeeded):
-        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth):
-        (WebInspector.ResourceTimeCalculator):
-        (WebInspector.ResourceTransferSizeCalculator):
-        (WebInspector.ResourceTransferSizeCalculator.prototype.computeBarGraphLabels):
-        * inspector/front-end/SummaryBar.js:
-        (WebInspector.SummaryBar.prototype.update):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
-
-2009-10-26  Avi Drissman  <avi@google.com>
-
-        Reviewed by Darin Adler.
-
-        Use Helvetica in the Inspector as intended.
-        https://bugs.webkit.org/show_bug.cgi?id=30787
-
-        * inspector/front-end/inspector.css:
-
-2009-10-26  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Don't set window.opener to 0 for the current FrameLoader if a noreferrer link was clicked, only suppress opener in a new frame.
-        https://bugs.webkit.org/show_bug.cgi?id=30781
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::urlSelected): Don't suppress opener in the current frame for noreferrer navigations.
-
-2009-10-26  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Data loss occurs when unbolding nested bold tags.
-        https://bugs.webkit.org/show_bug.cgi?id=30083
-
-        Fixes the loop in swapInNodePreservingAttributesAndChildren by saving nextSibling() of child
-        to a temporary valuable.  It was originally calling nextSibling() after appending the child
-        to new parent, in which case, nextSibling is always 0.
-
-        Test: editing/style/unbolding-nested-b.html
-
-        * editing/ReplaceNodeWithSpanCommand.cpp:
-        (WebCore::swapInNodePreservingAttributesAndChildren):
-
-2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Storage events should use Document::url() rather than documentURI()
-        https://bugs.webkit.org/show_bug.cgi?id=30535
-
-        Storage events should use Document::url() rather than Document::documentURI()
-        per http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
-
-        Test: storage/domstorage/documentURI.html
-
-        * storage/StorageEventDispatcher.cpp:
-        (WebCore::StorageEventDispatcher::dispatch):
-
-2009-10-26  Sam Weinig  <sam@webkit.org>
-
-        Rubber-stamped by Darin Adler.
-
-        Rollout r50041-50043.  The HTML5 spec changed to make HTMLOptionsCollection
-        inherit from HTMLCollection.
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSHTMLAllCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::callHTMLAllCollection):
-        (WebCore::JSHTMLAllCollection::nameGetter):
-        (WebCore::JSHTMLAllCollection::item):
-        (WebCore::JSHTMLAllCollection::namedItem):
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::callHTMLCollection):
-        (WebCore::JSHTMLCollection::nameGetter):
-        (WebCore::JSHTMLCollection::item):
-        (WebCore::JSHTMLCollection::namedItem):
-        (WebCore::toJS):
-        * bindings/js/JSHTMLCollectionFunctions.h: Removed.
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
-        (WebCore::JSHTMLOptionsCollection::length):
-        (WebCore::JSHTMLOptionsCollection::indexSetter):
-        * bindings/objc/DOMHTML.mm:
-        (kitClass):
-        * bindings/objc/DOMUtility.mm:
-        (JSC::createDOMWrapper):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * html/HTMLCollection.idl:
-        * html/HTMLOptionsCollection.idl:
+        Fix by saving and restoring both the intermediate and checked state for radio buttons
+        and checkboxes, as well as the "current radio button" state.
 
-2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
+        Test: fast/forms/radio-checkbox-restore-indeterminate.html
 
-        Reviewed by Adam Roben.
-
-        Build fix for ENABLE_FILTERS under Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=30762
-
-        Build correction for ENABLE_FILTERS feature.  No new tests needed.
-
-        * WebCore.vcproj/WebCore.vcproj:  Make the following changes:
-          (1) Create a new 'filters' sub-folder of the platform/graphics 
-              folder to properly show the sources held in this directory.
-          (2) Move the files that are currently shown in svn/graphics/filters
-              to platform/graphics/filters (where they actually live on disk).
-          (3) Add the missing SVGFilter, SVGFilterBuilder, and SVGFETile to
-              the project so they are built.
-          (4) Remove SVGFEFloodElement.cpp from the build, since it is already
-              being compiled by SVGAllInOne.cpp.  Its presence as a separate
-              entity is causing a linker warning for duplicate symbols.
-          (5) Add ImageBuffer.cpp to the build to support color space
-              calculations for non-CG builds.
-        * WebCore.vcproj/WebCoreCommon.vsprops: Add the platform/graphics/filters
-          path to the search paths in the project.
-
-2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        console.assert should prefix messages with "Assertion failed: "
-        https://bugs.webkit.org/show_bug.cgi?id=19135
-
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleMessage.prototype.toMessageElement): Append "Assertion failed: " for AssertMessageType.
-        (WebInspector.ConsoleMessage.prototype.toString):
-        * page/Console.cpp:
-        (WebCore::Console::assertCondition): Use AssertMessageType.
-        * page/Console.h:
-        (WebCore::MessageType): Added AssertMessageType.
-
-2009-10-26  Rahul Kuchhal  <kuchhal@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Prevent crash when optgroup element is empty by adding a NULL check.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30365
-
-        Test: fast/forms/select-empty-optgroup.html
-
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::appendFormData):
-
-2009-10-21  Steven Knight  <sgk@chromium.org>
-
-        Reviewed by David Levin.
-
-        Refactor gyp for separate webcore_bindings{,_sources} targets.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30447
-
-        Handle long link lines by building .idl-generated bindings in a
-        separate webcore_bindings library target.  Avoid Visual Studio
-        dependency issues by building additional generated .cpp and .h files
-        in a separate webcore_bindings_sources target.
-
-        Chrome should still build and test successfully.
-
-        * WebCore.gyp/WebCore.gyp:
-        * WebCore.gypi:
-
-2009-10-26  Mike Belshe  <mike@belshe.com>
-
-        Reviewed by Darin Fisher.
-
-        Make the number of connections for chromium controlled by
-        chromium rather than by ResourceRequestBase.
-        https://bugs.webkit.org/show_bug.cgi?id=30661
-
-        * platform/network/ResourceRequestBase.cpp:
-        * platform/network/chromium/ResourceRequest.cpp:
-
-2009-10-26  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Unreviewed. make distcheck build fixes.
-
-        * GNUmakefile.am:
-
-2009-10-26  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Unbreak Chromium build: that requires adding custom implementations
-        for HTMLOptionsCollection's item and namedItem.  Keep v8 binding
-        close to JSC bindings as well.
-        https://bugs.webkit.org/show_bug.cgi?id=30780
-
-        * bindings/v8/V8Collection.h:
-        (WebCore::getNamedItemsFromCollection):
-        (WebCore::getItemFromCollection):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-10-23  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Adam Barth and Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30723
-        <rdar://problem/6189415> Input names added to multipart/form-data headers need to be escaped.
-
-        Test: http/tests/security/escape-form-data-field-names.html
-
-        * platform/network/FormDataBuilder.cpp:
-        (WebCore::appendQuotedString):
-        (WebCore::FormDataBuilder::beginMultiPartHeader):
-        (WebCore::FormDataBuilder::addFilenameToMultiPartHeader):
-        Percent-escape line breaks and quotation marks.
+        * html/HTMLInputElement.cpp:
+        (WebCore::EventHandlingState::EventHandlingState): New struct to hold state between preDispatchEventHandler()
+        and postDispatchEventHandler().
+        (WebCore::HTMLInputElement::preDispatchEventHandler): Store intermedate and checked state
+        and the current radio button.
+        (WebCore::HTMLInputElement::postDispatchEventHandler): Restore state as appropriate.
+        * html/HTMLInputElement.h: Add a comment to clarify how 'intermediate' interacts with 'checked', according
+        to the spec.
 
-2009-10-26  Kelly Norton  <knorton@google.com>
+2010-03-19  Alexander Pavlov  <apavlov@chromium.org>
 
         Reviewed by Pavel Feldman.
 
-        Adds DOMTimer support to InspectorTimelineAgent.
-        https://bugs.webkit.org/show_bug.cgi?id=30467
-
-        * inspector/InspectorTimelineAgent.cpp: Added timer support and fixed some method names.
-        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::didLayout):
-        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::didPaint):
-        (WebCore::InspectorTimelineAgent::didWriteHTML):
-        (WebCore::InspectorTimelineAgent::didInstallTimer): Added.
-        (WebCore::InspectorTimelineAgent::didRemoveTimer): Added.
-        (WebCore::InspectorTimelineAgent::willFireTimer): Added.
-        (WebCore::InspectorTimelineAgent::didFireTimer): Added.
-        (WebCore::InspectorTimelineAgent::addItemToTimeline): Added.
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentTimelineItem): Renamed.
-        * inspector/InspectorTimelineAgent.h:
-        (WebCore::):
-        * inspector/TimelineItemFactory.cpp: Add methods for timer-related ScriptObjects.
-        (WebCore::TimelineItemFactory::createGenericTimerTimelineItem):
-        (WebCore::TimelineItemFactory::createTimerInstallTimelineItem):
-        * inspector/TimelineItemFactory.h:
-        * page/DOMTimer.cpp: Added instrumentation points.
-        (WebCore::DOMTimer::install):
-        (WebCore::DOMTimer::removeById):
-        (WebCore::DOMTimer::fired):
-
-2009-10-26  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Sam Weinig.
+        Web Inspector: caret moves past prompt in javascript console
+        https://bugs.webkit.org/show_bug.cgi?id=26602
 
-        <rdar://problem/6988966> Hardware layers do not show up in page snapshots
+        Having noticed any Element children besides a leading <br> (which are empty
+        text nodes), WebCore editing facility thinks it should delete the <br>,
+        thus clearing away the text prompt contents.
 
-        Add a method that gets called when snapshotting Canvas3DLayers for page snapshots,
-        that allows the layer to return a CGImageRef of its contents.
-        
-        * platform/graphics/mac/Canvas3DLayer.h:
-        * platform/graphics/mac/Canvas3DLayer.mm:
-        (-[Canvas3DLayer copyImageSnapshotWithColorSpace:]):
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.clearAutoComplete):
+        (WebInspector.TextPrompt.prototype._completionsReady):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.pruneEmptyTextNodes):
 
-2009-10-26  Yury Semikhatsky  <yurys@chromium.org>
+2010-03-19  Adam Roben  <aroben@apple.com>
 
-        Reviewed by Pavel Feldman.
+        Windows clean build fix after r56192
 
-        Pass "console" as object group when evaluating selection.
+        * WebCore.vcproj/WebCore.vcproj: Copy headers from
+        platform/graphics/cg to $WebKitOutputDir as part of the post-build
+        event so that WebKit can use them. (The only one we currently require
+        is FontPlatformData.h.)
 
-        https://bugs.webkit.org/show_bug.cgi?id=30738
+        * platform/graphics/win/FontPlatformDataCGWin.cpp: Touched to force a
+        build.
 
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
+2010-03-19  Joseph Pecoraro  <joepeck@webkit.org>
 
-2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
+        Reviewed by David Kilzer.
 
-        Reviewed by Pavel Feldman.
+        Assertion failure in media/video-controls-with-mutation-event-handler.html
+        https://bugs.webkit.org/show_bug.cgi?id=36376
 
-        Fix for Console not showing repeat count when repeatedly logging an Event
-        https://bugs.webkit.org/show_bug.cgi?id=30324
+        Fix crashing test. Underlying the media element's volume slider is a
+        range input, which sanitizes values before expected on the media control.
 
-        * inspector/ConsoleMessage.cpp:
-        (WebCore::ConsoleMessage::addToConsole):
-        (WebCore::ConsoleMessage::updateRepeatCountInConsole): Added.
-        * inspector/ConsoleMessage.h:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addConsoleMessage): Calls updateRepeatCountInConsole if it is a repeating message.
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addConsoleMessage): Renamed WebCore::InspectorFrontend::addMessageToConsole
-        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount): Added. Called when repeatCount is incremented.
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.addMessage): Removed calls to msg.isEqual.
-        (WebInspector.ConsoleView.prototype.updateMessageRepeatCount): Added.
-        (WebInspector.ConsoleView.prototype._incrementErrorWarningCount): Added. Updates the error/warning count.
-        (WebInspector.ConsoleView.prototype.clearMessages):
-        (WebInspector.ConsoleMessage):
-        (WebInspector.ConsoleMessage.prototype.toMessageElement): Use ConsoleMessage._updateRepeatCount
-        (WebInspector.ConsoleMessage.prototype._updateRepeatCount):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addConsoleMessage): Renamed WebInspector.addMessageToConsole.
-        (WebInspector.updateConsoleMessageRepeatCount): Added.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
 
-2009-10-26  Chris Fleizach  <cfleizach@apple.com>
+2010-03-19  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Darin Adler.
 
-        crash with AX on when an image map contains an anchor tag
-        https://bugs.webkit.org/show_bug.cgi?id=30739
-
-        Tests: accessibility/crashing-a-tag-in-map.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::addChildren):
-
-2009-10-26  Steve Block  <steveblock@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Adds feature ENABLE guards to V8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=30697
-
-        This adds guards for the following features to the V8 bindings,
-        to allow builds with V8 to succeed when these features are not enabled.
-        - DATABASE
-        - WORKERS
-        - SHARED_WORKERS
-        - SVG
-        - XPATH
-        - XSLT
-        - INSPECTOR
-
-        This is a build fix only, no new tests required.
+        3 of the new HTML5 loading events need to be asynchronous.
 
-        * bindings/v8/DOMObjectsInclude.h: Modified.
-        * bindings/v8/DerivedSourcesAllInOne.cpp: Modified.
-        * bindings/v8/V8Index.cpp: Modified.
-        * bindings/v8/V8Index.h: Modified.
+        Laying the groundwork for:
+        https://bugs.webkit.org/show_bug.cgi?id=36201
+        https://bugs.webkit.org/show_bug.cgi?id=36202
+        https://bugs.webkit.org/show_bug.cgi?id=36334
+        https://bugs.webkit.org/show_bug.cgi?id=36335
 
-2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+        Document already had an asynchronous event delivery mechanism for storage events, so
+        we can repurpose that for all async events.
 
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25679
-        [Gtk] Improve accessibility of focusable lists
-
-        Fixes the issues with the Atk states exposed for ListBoxOption
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (setAtkStateSetFromCoreObject):
-
-2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27085
-        [Gtk] Incorrect rendering of list
+        No new tests. (No change in behavior)
 
-        Adds a way for platforms to indicate that a particular object
-        should not be ignored.
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::implicitClose): Use Document::schedule* for the related events.
+        (WebCore::Document::enqueueEvent): Renamed from enqueueStorageEvent
+        (WebCore::Document::pendingEventTimerFired): Renamed from "storageEventTimerFired"
+        (WebCore::Document::statePopped): Use Document::schedulePopstateEvent
+        (WebCore::Document::enqueuePageshowEvent): All Pageshow events are piped through here.
+          This will be made asynchronous in a separate patch.
+        (WebCore::Document::enqueueHashchangeEvent): All Hashchange events are piped through here.
+          This will be made asynchronous in a separate patch.
+        (WebCore::Document::enqueuePopstateEvent): All Popstate events are piped through here.
+          This will be made asynchronous in a separate patch.
+        * dom/Document.h:
+        (WebCore::):
 
-        * accessibility/AccessibilityObject.h:
-        * accessibility/chromium/AccessibilityObjectChromium.cpp:
-        * accessibility/gtk/AccessibilityObjectAtk.cpp:
-        * accessibility/mac/AccessibilityObjectMac.mm:
-        * accessibility/qt/AccessibilityObjectQt.cpp:
-        * accessibility/win/AccessibilityObjectWin.cpp:
-        * accessibility/wx/AccessibilityObjectWx.cpp:
-        (AccessibilityObject::accessibilityPlatformIncludesObject):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (AccessibilityRenderObject::accessibilityIsIgnored):
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Use Document::enqueuePageshowEvent
 
-2009-10-26  Kinuko Yasuda  <kinuko@google.com>
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadInSameDocument): Use Document::enqueueHashchangeEvent
 
-        Reviewed by Jan Alonzo.
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch): Use Document::enqueueEvent
 
-        Bug 30619: [Linux] Menu key doesn't work
-        https://bugs.webkit.org/show_bug.cgi?id=30619
+2010-03-19  Kevin Decker  <kdecker@apple.com>
 
-        Test: manual-tests/keyboard-menukey-event.html
-        No new layout tests: testing this will require changes in the test
-        controller in a platform-specific way.
+        Reviewed by Darin Adler and Brady Eidson.
 
-        * platform/chromium/KeyCodeConversionGtk.cpp:
-        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
-        GDK_Menu to return VKEY_APPS instead of VKEY_MENU.
-        * platform/gtk/KeyEventGtk.cpp:
-        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
-        GDK_Menu to return V_APPS instead of VK_MENU.
+        First step toward:
+        https://bugs.webkit.org/show_bug.cgi?id=36328
 
-2009-10-25  Anton Muhin  <antonm@chromium.org>
+        This is the first step torward eliminating the WebKit WebNullPluginView class. The responsibility for this will soon
+        be in platform-independent code in WebCore. The plan is to change RenderEmbeddedObject and give it the capability of
+        drawing the missing plug-in text. 
 
-        Reviewed by Adam Barth.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestObject): Renamed the renderer parameter to requestEmbeddedObject and made it
+        a RenderEmbeddedObject.
+        (WebCore::FrameLoader::loadPlugin): Likewise.
+        * loader/FrameLoader.h: Updated loadPlugin() and requestObject() method signatures accordingly. 
 
-        Reuse already fetched proxy.
-        https://bugs.webkit.org/show_bug.cgi?id=30747
+2010-03-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        Reviewed by Simon Hausmann.
 
-2009-10-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        [Qt] Disable TILED_BACKING_STORE if Qt version is earlier than Qt4.6
+        https://bugs.webkit.org/show_bug.cgi?id=36348
 
-        Unreviewed build fix.
+        Backing store implementation for QtWebKit requires at least Qt
+        version 4.6.
 
-        Build fix for WIN_OS if Netscape plugin support is turned off
-        https://bugs.webkit.org/show_bug.cgi?id=30753
+        No new tests as there is no new functionality.
 
-        * plugins/PluginDatabase.cpp:
+        * WebCore.pri:
 
-2009-10-25  Hironori Bono  <hbono@chromium.org>
+2010-03-19  Joseph Pecoraro  <joepeck@webkit.org>
 
-        Reviewed by Darin Adler.
-
-        A quick fix for Bug 29103.
-        Since String::startsWith() cannot fold non-ASCII characters, this change folds the prefix string
-        and the option string before calling String::startsWith().
-        https://bugs.webkit.org/show_bug.cgi?id=29103
+        Reviewed by David Kilzer.
 
-        Tests: fast/forms/listbox-typeahead-cyrillic.html
-               fast/forms/listbox-typeahead-greek.html
+        <input type=range> does not validate correctly without a renderer and the tests are incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=36259
 
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::typeAheadFind):
+        Setting value attribute on an <input type=range> to an out-of-range value fires oninput
+        https://bugs.webkit.org/show_bug.cgi?id=16990
 
-2009-10-25  Keishi Hattori  <casey.hattori@gmail.com>
+        Part 2 of 2: When setting the range element's value, overflows and underflows
+        are automatically sanitized to valid values. Moved the general case
+        sanitization code out of the Renderer into HTMLInputElement::sanitizeValue.
 
-        Reviewed by Timothy Hatcher.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::value): when getting a default value on reset() ensure the defaultValue is provided
+        (WebCore::HTMLInputElement::sanitizeValue): clamp the value within the max/min/step range constraints
+        * html/StepRange.cpp:
+        (WebCore::StepRange::StepRange): allow const element in the constructor
+        (WebCore::StepRange::clampValue): clamp from a String value
+        * html/StepRange.h:
+        (WebCore::StepRange::defaultValue): easy calculation of the default value for max/min/step range constraints
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::updateFromElement): no longer handle the general case sanitization in the renderer
 
-        Web Inspector: Expanding a node in the Console should not show the element in Elements panel
-        https://bugs.webkit.org/show_bug.cgi?id=30749
+2010-03-19  Joseph Pecoraro  <joepeck@webkit.org>
 
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement.prototype.onmousedown): Check if inside disclosure triangle.
+        Reviewed by David Kilzer.
 
-2009-10-25  Sam Weinig  <sam@webkit.org>
+        <input type=range> does not validate correctly without a renderer and the tests are incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=36259
 
-        Reviewed by Dan Bernstein.
+        Part 1 of 2: Refactoring the SliderRange struct out of RenderSlider
+        into a more appropriate place. Changed the named to StepRange. Changed
+        from a struct to a class.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=30751
-        HTMLOptionsCollection should not inherit from HTMLCollection
+          Added new files to the build.
 
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        Added JSHTMLCollectionFunctions.h
-
-        * bindings/js/JSHTMLAllCollectionCustom.cpp:
-        (WebCore::callHTMLAllCollection):
-        (WebCore::JSHTMLAllCollection::nameGetter):
-        (WebCore::JSHTMLAllCollection::item):
-        (WebCore::JSHTMLAllCollection::namedItem):
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::callHTMLCollection):
-        (WebCore::JSHTMLCollection::nameGetter):
-        (WebCore::JSHTMLCollection::item):
-        (WebCore::JSHTMLCollection::namedItem):
-        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
-        (WebCore::callHTMLCollection):
-        (WebCore::JSHTMLOptionsCollection::getCallData):
-        (WebCore::JSHTMLOptionsCollection::canGetItemsForName):
-        (WebCore::JSHTMLOptionsCollection::nameGetter):
-        (WebCore::JSHTMLOptionsCollection::indexSetter):
-        (WebCore::JSHTMLOptionsCollection::item):
-        (WebCore::JSHTMLOptionsCollection::namedItem):
-        Refactor to use generic implementation of HTMLCollection bindings functions
-        from JSHTMLCollectionFunctions.h
-
-        * bindings/js/JSHTMLCollectionFunctions.h: Added.
-        (WebCore::getCollectionNamedItems):
-        (WebCore::getCollectionItems):
-        (WebCore::callHTMLCollectionGeneric):
-        Added generic functions that JSHTMLCollection, JSHTMLAllCollection and
-        JSHTMLOptionsCollection can all use.
-
-        * bindings/js/JSHTMLDocumentCustom.cpp: Add include of JSHTMLAllCollection.h
-        for toJS on document.all.
-
-        * bindings/objc/DOMHTML.mm:
-        * bindings/objc/DOMUtility.mm:
-        (JSC::createDOMWrapper):
-        Remove special cases for HTMLOptionsCollection.
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * html/HTMLAllCollection.idl:
-        * html/HTMLCollection.idl:
-        * html/HTMLOptionsCollection.idl:
-
-2009-10-24  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Fixed issue with IME inside console
-        https://bugs.webkit.org/show_bug.cgi?id=30660
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._promptKeyDown):
-        * inspector/front-end/DatabaseQueryView.js:
-        (WebInspector.DatabaseQueryView.prototype._promptKeyDown):
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
-        (WebInspector.searchKeyDown): Moved performSearch here from WebInspector.searchKeyUp.
-        (WebInspector.startEditing.element.handleKeyEvent):
-        (WebInspector.startEditing):
-        * inspector/front-end/utilities.js:
-        (isEnterKey): Added. Check if in IME.
-
-2009-10-24  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30752>.
-        Web Inspector: Multiple Selection on Scope Bars by default Conflicts with other behavior on OSX.
-        
-        Have the scope bars select one scope by default, but if the multiple selection key
-        is pressed, allow for multiple selection.
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView):
-        (WebInspector.ConsoleView.prototype._updateFilter):
-        (WebInspector.ConsoleView.prototype.filter):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.filter):
-        (WebInspector.ResourcesPanel.prototype._updateFilter):
 
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
+          Renamed and moved class SliderRange to StepRange.
 
-        Make the scope bars in the Web Inspector match other scope bars in Mac OS X.
-        Also cleans up the CSS to use classes instead of ID selectors.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28186
-
-        Reviewed by Dan Bernstein.
-
-        * inspector/front-end/ResourcesPanel.js: Add the scope-bar class.
-        * inspector/front-end/inspector.css: Lots of changes to make it look right.
-        * inspector/front-end/inspector.html: Add the scope-bar class.
-
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
-
-        Fix selecting Resources in the Web Inspector's Resources panel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30743
-
-        Reviewed by Pavel Feldman.
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.isCategoryVisible): Added.
-        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable): Call
-        isCategoryVisible on the ResourcesPanel.
-
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
-
-        Fix the Scope Bar in the Web Inspector's Resource panel, so that selecting
-        All will deselect the other filters.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30744
-
-        Reviewed by Pavel Feldman.
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.createFilterElement): Better syntax.
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.filter): Use a normal for loop,
-        and the child variable instead of target in the loop. Other clean up.
-
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
-
-        Make resizing the Web Inspector's Elements panel sidebar work again.
-        Also makes Resources panel use the sidebar code in Panel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30742
-
-        Reviewed by Pavel Feldman.
-
-        * inspector/front-end/Panel.js:
-        (WebInspector.Panel): Don't create the sidebar with an argument.
-        (WebInspector.Panel.prototype.show): Call updateSidebarWidth.
-        (WebInspector.Panel.prototype.handleKeyEvent): Call handleSidebarKeyEvent.
-        (WebInspector.Panel.prototype.handleSidebarKeyEvent): Added.
-        (WebInspector.Panel.prototype.createSidebar): Renamed from _createSidebar.
-        (WebInspector.Panel.prototype._sidebarDragging): Call updateSidebarWidth.
-        (WebInspector.Panel.prototype.updateSidebarWidth): Renamed from _updateSidebarWidth.
-        (WebInspector.Panel.prototype.setSidebarWidth): Added. Called by updateSidebarWidth.
-        (WebInspector.Panel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel): Call createSidebar.
-        (WebInspector.ProfilesPanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.show): Remove call to _updateSidebarWidth.
-        (WebInspector.ResourcesPanel.prototype.showResource): Call updateSidebarWidth
-        (WebInspector.ResourcesPanel.prototype.closeVisibleResource): Ditto.
-        (WebInspector.ResourcesPanel.prototype.setSidebarWidth): Added.
-        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth): Added.
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel): Call createSidebar.
-        (WebInspector.StoragePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
-        * inspector/front-end/TimelinePanel.js:
-        (WebInspector.TimelinePanel): Call createSidebar.
-        (WebInspector.TimelinePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
-
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
-
-        Call updateSelection() in a few places so hovering in the Web Inspector's
-        Elements panel always has the correct row selection height.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30735
-
-        Reviewed by Pavel Feldman.
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton): Call updateSelection().
-        (WebInspector.ElementsTreeElement.prototype._insertInLastAttributePosition): Ditto.
-        * inspector/front-end/inspector.css: Prevent text wrapping in the middle of the add attribute text.
-
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
-
-        Remove the re-root tree feature from the Web Inspector's
-        Elements panel. This feature wasn't super useful and gets
-        in the way of double-click to edit.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30736
-
-        Reviewed by Pavel Feldman.
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement.prototype.ondblclick):
-
-2009-10-24  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Implements ReturnsNew hint for V8 bindings generation code.
-        https://bugs.webkit.org/show_bug.cgi?id=30745
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
-
-2009-10-24  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Missing images at 350.org due to wrong URLs
-        https://bugs.webkit.org/show_bug.cgi?id=30748
-
-        Test: fast/dom/HTMLImageElement/parse-src.html
-
-        * dom/Element.cpp:
-        (WebCore::Element::getURLAttribute): Pass the attribute value through deprecateParseURL().
-        This matches what the Objective-C bindings do, as well as what HTMLImageLoader::sourceURI()
-        and SVGImageLoader::sourceURI() do.
-
-2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Unreviewed.
-
-        [Qt] Build fix for QtWebKit after r50013.
-
-        * WebCore.pro:
-
-2009-10-24  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [V8] Fix up to accommodate for HTMLAllCollection changes in
-        http://trac.webkit.org/changeset/49998.
-
-        * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
-
-2009-10-23  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        <rdar://problem/7294131> Assertion failure in AuthenticationMac at
-        mac(const Credential&) after authenticating to MobileMe Gallery movie
-
-        * platform/network/Credential.cpp:
-        (WebCore::Credential::Credential): Initialize m_persistence.
-        (WebCore::Credential::isEmpty): Made this method const.
-        * platform/network/Credential.h:
-        * platform/network/mac/AuthenticationMac.mm:
-        (WebCore::mac): Return nil if the Credential is empty.
-
-2009-10-23  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30617>.
-        Web Inspector: Resources Scope Bar Should Allow Combinations.
-        
-        Refactor the filtering in ResourcePanel to make it match ConsoleView,
-        and add a divider between All, and the other choices of Resource types.
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.filter):
-        (WebInspector.ResourcesPanel.prototype._updateFilter):
-        * inspector/front-end/inspector.css:
-
-2009-10-23  Chris Evans  <cevans@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Ignore the Refresh header if we're in view source mode.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27239
-
-        Test: http/tests/security/view-source-no-refresh.html
-
-        * loader/FrameLoader.cpp: ignore Refresh in view-source mode.
-
-2009-10-23  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30734
-        Remove XMLTokenizer::m_currentNodeIsReferenced
-
-        No change in behavior, no tests.
+        * html/StepRange.cpp: Added.
+        (WebCore::StepRange::StepRange):
+        (WebCore::StepRange::clampValue):
+        (WebCore::StepRange::valueFromElement):
+        (WebCore::sliderPosition):
+        * html/StepRange.h: Added.
+        (WebCore::StepRange::proportionFromValue):
+        (WebCore::StepRange::valueFromProportion):
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::updateFromElement): updated to use StepRange
+        (WebCore::RenderSlider::setValueForPosition): updated to use StepRange
 
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::setCurrentNode):
-        * dom/XMLTokenizer.h:
-        Don't store a boolean for the current node being the document - we can always check for that.
+2010-03-19  Antti Koivisto  <koivisto@iki.fi>
 
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::XMLTokenizer):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::XMLTokenizer):
-        A fragment passed to XMLTokenizer is never null - in fact, the first thing we do is dereference
-        it unconditionally, and then begin checking it for null, as if it could help.
-
-2009-10-23  Beth Dakin  <bdakin@apple.com>
+        Reviewed by Simon Hausmann.
 
-        No review since this is a build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=36366
+        Repaint loop when painting using scaled CTMs with different translations
 
-        Build fix for the Mac. (Build is only broken when SVG filters are 
-        enabled.)
+        The code in RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality
+        tests if the scaling has changed from the previous value by comparing the
+        transformations. The test fails if the scale is the same but the translation 
+        changes. This can lead to infinite repaint loop if the document is painted 
+        in pieces using different translations (for example for tiling).
 
-        Labelled these function static.
-        * platform/graphics/filters/FEComponentTransfer.cpp:
-        (WebCore::identity):
-        (WebCore::table):
-        (WebCore::discrete):
-        (WebCore::linear):
-        (WebCore::gamma):
-        * platform/graphics/filters/FEGaussianBlur.cpp:
-        (WebCore::boxBlur):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
 
-2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-19  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: Implement a Timeline panel.
+        Web Inspector: editing shorthands does not always work.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30725
+        https://bugs.webkit.org/show_bug.cgi?id=36362
 
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/Images/timelineIcon.png: Added.
-        * inspector/front-end/TimelineAgent.js:
-        (WebInspector.addItemToTimeline):
-        (WebInspector.timelineProfilerWasStarted):
-        (WebInspector.timelineProfilerWasStopped):
-        * inspector/front-end/TimelinePanel.js: Added.
-        (WebInspector.TimelinePanel):
-        (WebInspector.TimelinePanel.prototype.toolbarItemClass.get toolbarItemLabel):
-        (WebInspector.TimelinePanel.prototype.get statusBarItems):
-        (WebInspector.TimelinePanel.prototype.handleKeyEvent):
-        (WebInspector.TimelinePanel.prototype.timelineWasStarted):
-        (WebInspector.TimelinePanel.prototype.timelineWasStopped):
-        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
-        (WebInspector.TimelinePanel.prototype._innerAddItemToTimeline):
-        (WebInspector.TimelinePanel.prototype._toggleTimelineButton):
-        (WebInspector.TimelinePanel.prototype.setMainViewWidth):
-        (WebInspector.TimelinePanel.prototype.getItemTypeName):
-        (WebInspector.TimelineRecordTreeElement):
-        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
-        * inspector/front-end/WebKit.qrc:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::applyStyleText):
+        (WebCore::InspectorDOMAgent::populateObjectWithStyleProperties):
+        (WebCore::InspectorDOMAgent::shorthandValue):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
         * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector._createPanels):
-
-2009-10-23  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Clash Between Search's onkeyup and incremental search events
-        https://bugs.webkit.org/show_bug.cgi?id=30731
-
+        (.section .properties li.disabled .enabled-button):
         * inspector/front-end/inspector.js:
-        (WebInspector.performSearch): prevent incremental search event from clobbering a forced search
-
-2009-10-23  Kelly Norton  <knorton@google.com>
+        (WebInspector.startEditing.editingCommitted):
 
-        Reviewed by Pavel Feldman.
+2010-03-19  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Removes the need for C++ Timeline types in InspectorTimelineAgent in favor
-        of ScriptObjects.
-        https://bugs.webkit.org/show_bug.cgi?id=30707
+        Reviewed by Simon Hausmann.
 
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * inspector/DOMDispatchTimelineItem.cpp: Removed.
-        * inspector/DOMDispatchTimelineItem.h: Removed.
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
-        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::willLayout):
-        (WebCore::InspectorTimelineAgent::didLayout):
-        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::willPaint):
-        (WebCore::InspectorTimelineAgent::didPaint):
-        (WebCore::InspectorTimelineAgent::willWriteHTML):
-        (WebCore::InspectorTimelineAgent::didWriteHTML):
-        (WebCore::InspectorTimelineAgent::reset):
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
-        (WebCore::InspectorTimelineAgent::pushCurrentTimelineItem):
-        * inspector/InspectorTimelineAgent.h:
-        (WebCore::InspectorTimelineAgent::TimelineItemEntry::TimelineItemEntry):
-        * inspector/TimelineItem.cpp: Removed.
-        * inspector/TimelineItem.h: Removed.
-        * inspector/TimelineItemFactory.cpp: Added.
-        (WebCore::TimelineItemFactory::createGenericTimelineItem):
-        (WebCore::TimelineItemFactory::createDOMDispatchTimelineItem):
-        * inspector/TimelineItemFactory.h: Added.
-        (WebCore::):
-        (WebCore::TimelineItemFactory::TimelineItemFactory):
+        [Qt] Don't replace clip when drawing complex text
 
-2009-10-23  Gavin Barraclough  <barraclough@apple.com>
+        * platform/graphics/qt/FontQt.cpp:
 
-        Reviewed by Geoff Garen.
+2010-03-18  Darin Fisher  <darin@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30729
-        Provide private API to request the global context for a specific world.
-        Used to initialize parameters on the global object.
+        Reviewed by Adam Barth.
 
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::globalObject):
-        * bindings/js/ScriptController.h:
+        If a frame is already in the document, then setting its "src" attribute
+        should add the resultant navigation to history.
 
-2009-10-23  Steve Block  <steveblock@google.com>
+        https://bugs.webkit.org/show_bug.cgi?id=9166
 
-        Reviewed by Eric Seidel.
+        This behavior is specified in section 4.8.2 of the HTML5 spec.
 
-        Fixes style problems in Android-specific files.
-        https://bugs.webkit.org/show_bug.cgi?id=30717
-
-        Style changes only, no new tests possible.
-
-        * page/android/EventHandlerAndroid.cpp: Modified.
-        (WebCore::EventHandler::passMouseDownEventToWidget): Fixes whitespace in method signature.
-        (WebCore::EventHandler::passSubframeEventToSubframe): Fixes whitespace in method signature.
-        (WebCore::EventHandler::passWheelEventToWidget): Fixes whitespace in method signature.
-        (WebCore::EventHandler::passMouseMoveEventToSubframe): Fixes whitespace in method signature.
-        * platform/android/ClipboardAndroid.h: Modified. Fixes header include order and indenting.
-        * platform/android/CursorAndroid.cpp: Modified. 
-        (WebCore::grabCursor): Fixes function braces.
-        (WebCore::grabbingCursor): Fixes function braces.
-        * platform/android/FileChooserAndroid.cpp: Modified.
-        (WebCore::FileChooser::basenameForWidth): Fixes braces on while statement, and updates String::copy to String::threadsafeCopy.
-        * platform/android/FileSystemAndroid.cpp: Modified. Fixes header include order.
-        (WebCore::unloadModule): Fixes zero test.
-        (WebCore::writeToFile): Fixes if statement structure.
-        * platform/android/KeyEventAndroid.cpp: Modified.
-        (WebCore::windowsKeyCodeForKeyEvent): Fixes switch statement indenting.
-        (WebCore::keyIdentifierForAndroidKeyCode): Fixes switch statement indenting.
-        * platform/android/ScreenAndroid.cpp: Modified. Fixes header include order and switch statement indenting.
-        * platform/android/TemporaryLinkStubs.cpp: Modified. Fixes header include order.
-
-2009-10-23  Sam Weinig  <sam@webkit.org>
-
-        Another shot at a fixed build.
+        Test: fast/loader/frame-src-change-added-to-history.html
 
-        * DerivedSources.cpp:
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::openURL):
+        (WebCore::HTMLFrameElementBase::setLocation):
+        * html/HTMLFrameElementBase.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestFrame):
+        * loader/FrameLoader.h:
 
-2009-10-23  Sam Weinig  <sam@webkit.org>
+2010-03-18  Chris Evans  <cevans@chromium.org>
 
-        Another shot at a fixed build.
+        Reviewed by Nikolas Zimmermann.
 
-        * html/HTMLOptionsCollection.idl:
+        Fix a minor crash with mismatched array sizes in SVG animation
+        elements.
 
-2009-10-23  Brady Eidson  <beidson@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35606
 
-        50,000!
+        Test: svg/animations/keypoints-mismatch.svg
 
-        * ChangeLog: Point out revision 50,000.
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::startedActiveInterval):
+        Globally apply validations relevant to all animation types.
 
-2009-10-23  Sam Weinig  <sam@webkit.org>
+2010-03-18  Vangelis Kokkevis  <vangelis@chromium.org>
 
-        Reviewed by Anders Carlsson.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=30695
-        Drop .tags() support from HTMLCollection
+        Reviewed by Adam Barth.
 
-        - Make .tags() only work for HTMLAllCollections in JS. .tags() is still
-          available for all HTMLCollection like objects in Objective-C since that
-          is API.
-        - Auto-generate HTMLAllCollection.
+        Implement software composited graphics layers in Chromium using the Skia library.
+        https://bugs.webkit.org/show_bug.cgi?id=35557
+        This is an initial step in the implementation. Layer compositing is functioning
+        but not optimized in any way. Subsesquent check-ins will be necessary to fine tune
+        it.
 
-        Test: fast/dom/HTMLDocument/document-all.html
+        Test: No new exposed functionality so no new tests.
 
-        * DerivedSources.make:
-        * GNUmakefile.am:
         * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSHTMLAllCollection.cpp: Removed.
-        * bindings/js/JSHTMLAllCollection.h: Removed.
-        * bindings/js/JSHTMLAllCollectionCustom.cpp: Added.
-        (WebCore::getNamedItems):
-        (WebCore::callHTMLAllCollection):
-        (WebCore::JSHTMLAllCollection::getCallData):
-        (WebCore::JSHTMLAllCollection::canGetItemsForName):
-        (WebCore::JSHTMLAllCollection::nameGetter):
-        (WebCore::JSHTMLAllCollection::item):
-        (WebCore::JSHTMLAllCollection::namedItem):
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/Document.cpp:
-        (WebCore::Document::all):
-        * dom/Document.h:
-        * dom/HTMLAllCollection.idl: Removed.
-        * html/HTMLAllCollection.cpp: Added.
-        (WebCore::HTMLAllCollection::create):
-        (WebCore::HTMLAllCollection::HTMLAllCollection):
-        (WebCore::HTMLAllCollection::~HTMLAllCollection):
-        * html/HTMLAllCollection.h: Added.
-        * html/HTMLAllCollection.idl: Added.
-        * html/HTMLCollection.h:
-        * html/HTMLCollection.idl:
-        * html/HTMLDocument.idl:
-        * page/DOMWindow.idl:
+          Added new source files to the chromium build
+        * platform/graphics/GraphicsLayer.h:
+          Added necessary typedef's and forward declarations for Chromium.
+        * platform/graphics/skia/GraphicsLayerSkia.cpp: Added.
+        * platform/graphics/skia/GraphicsLayerSkia.h: Added.
+          Declaration and implementation of the platform-specific GraphicsLayer class.
+        * platform/graphics/skia/LayerRendererSkia.cpp: Added.
+        * platform/graphics/skia/LayerRendererSkia.h: Added.
+          Declaration and implementation of the Skia-based software compositor.
+        * platform/graphics/skia/LayerSkia.cpp: Added.
+        * platform/graphics/skia/LayerSkia.h: Added.
+          Declaration and implementation of a compositable layer that uses a Skia canvas
+          for backing store.
+
+2010-03-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by Timothy Hatcher.
+        Make setPrinting() with printing=false, restore the previous
+        media type in use.
 
-        Web Inspector: pull basic sidebar implementation into the Panel.
+        Test: fast/media/print-restores-previous-mediatype.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=30720
+        * page/Frame.cpp:
+        (WebCore::Frame::setPrinting):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::adjustMediaTypeForPrinting):
+        * page/FrameView.h:
 
-        * inspector/front-end/Panel.js:
-        (WebInspector.Panel):
-        (WebInspector.Panel.prototype.jumpToPreviousSearchResult):
-        (WebInspector.Panel.prototype.handleKeyEvent):
-        (WebInspector.Panel.prototype._createSidebar):
-        (WebInspector.Panel.prototype._startSidebarDragging):
-        (WebInspector.Panel.prototype._sidebarDragging):
-        (WebInspector.Panel.prototype._endSidebarDragging):
-        (WebInspector.Panel.prototype._updateSidebarWidth):
-        (WebInspector.Panel.prototype.setCenterViewWidth):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel):
-        (WebInspector.ProfilesPanel.prototype.setCenterViewWidth):
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel):
-        (WebInspector.StoragePanel.prototype.setCenterViewWidth):
+2010-03-18  David Kilzer  <ddkilzer@apple.com>
 
-2009-10-23  Jens Alfke  <snej@chromium.org>
+        <http://webkit.org/b/36338> Remove unused RenderReplaced::adjustOverflowForBoxShadowAndReflect() declaration
 
-        Reviewed by Dimitri Glazkov.
+        Rubber-stamped by Darin Adler.
 
-        Slight optimizations to object returning and exception handling in generated V8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=30599
+        This declaration should have been removed in r47440.
 
-        * bindings/scripts/CodeGeneratorV8.pm: Generate better code
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertToV8Object): Added overload that takes a Ref<>
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Remove unnecessary template param to prevent compile error
+        * rendering/RenderReplaced.h:
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Removed.
 
-2009-10-23  Alpha Lam  <hclam@chromium.org>
+2010-03-18  Jian Li  <jianli@chromium.org>
 
-        Reviewed by Eric Carlson.
+        Reviewed by Dmitry Titov.
 
-        Volume slider always starts at half volume
-        https://bugs.webkit.org/show_bug.cgi?id=28322
+        Dragging a PDF image triggers assertion in DragController::startDrag()
+        https://bugs.webkit.org/show_bug.cgi?id=36247
 
-        Sets the value attribute of volume slider to the volume attribute
-        of the media element. Also update the value attribute of the
-        input element for the volume slider when the volume attribute
-        of the media element is updated.
+        Test: fast/images/drag-pdf-as-image.html
 
-        Test: media/video-volume-slider.html
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::filenameExtension):
+        * platform/graphics/cg/PDFDocumentImage.h:
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlVolumeSliderElement::update):
-        Set the value attribute of the input element for the volume slider
-        using the current volume of the media element.
-        * rendering/MediaControlElements.h:
-        Add method definition of update().
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::createVolumeSlider):
-        Creates a volume slider with value attribute equals to the current
-        volume attribute of the media element.
+2010-03-18  Simon Fraser  <simon.fraser@apple.com>
 
-2009-10-23  Evan Martin  <evan@chromium.org>
+        Reviewed by Dan Bernstein.
 
-        Reviewed by Eric Seidel.
+        Avoid taking a reference to a String owned by a temporary AtomicString.
 
-        Chrome Linux: fix caret positioning in LTR complex languages
-        The caret is positioned off by one in languages like Thai.
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::RareData::parseNth):
 
-        https://bugs.webkit.org/show_bug.cgi?id=28284
+2010-03-18  Chris Marrin  <cmarrin@apple.com>
 
-        A group of us spent a while trying various approaches to write a test
-        for this; however, since it is only that the blinking cursor is
-        displayed incorrectly, we concluded it can not be tested.
+        Reviewed by Simon Fraser.
 
-        (Patch by Hironori Bono.)
+        Fixed parenting issues with HW layers on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=32449
+        
+        CACF can't properly fix superlayer changes, so a layer added
+        as a sublayer must have a null superlayer. I changed a couple of
+        places that change sublayers to removeFromSuperlayer while adding
+        to a new layer. This fixes both the problem of disappearing children
+        and children getting doubled. Also got rid of removeSublayer(). Layers
+        should always be removed from their parent with removeFromSuperlayer().
+        
+        This also removed moveLayer(), which is not used and may not be safe in how
+        it copies.
 
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::Font::selectionRectForComplexText):
+        * platform/graphics/win/GraphicsLayerCACF.cpp:Changed setName to be like Mac, to give more debugging info (to fix problems like these)
+        (WebCore::GraphicsLayerCACF::setName):
+        * platform/graphics/win/WKCACFLayer.cpp:Make sure superlayer is null before adding
+        (WebCore::WKCACFLayer::insertSublayer):
+        (WebCore::WKCACFLayer::replaceSublayer):
+        (WebCore::WKCACFLayer::removeFromSuperlayer):
+        (WebCore::WKCACFLayer::setSublayers):
+        (WebCore::WKCACFLayer::printLayer):print the superlayer for better debugging
+        * platform/graphics/win/WKCACFLayer.h:
 
-2009-10-23  Tony Chang  <tony@chromium.org>
+2010-03-18  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        Reviewed by David Levin.
+        Unreviewed, build fix.
 
-        Fix Chromium build after IsoldatedWorld change (r49963).
-        https://bugs.webkit.org/show_bug.cgi?id=30719
+        [Chromium] Change the order of mac/ and cg/ include dirs to fix compile break
+        due to http://trac.webkit.org/changeset/56192,
 
-        * bindings/ScriptControllerBase.cpp:
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::executeScriptInIsolatedWorld):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::mainThreadNormalWorld):
-        * bindings/v8/ScriptController.h:
-        (WebCore::ScriptController::windowShell):
-        (WebCore::ScriptController::existingWindowShell):
-        * dom/Document.cpp:
-        (WebCore::Document::createWrapperCache):
-        * dom/ScriptExecutionContext.cpp:
-        * dom/ScriptExecutionContext.h:
-        * xml/XMLHttpRequest.cpp:
-        * xml/XMLHttpRequest.h:
+        * WebCore.gyp/WebCore.gyp: Changed the order.
 
-2009-10-23  Xiaomei Ji  <xji@chromium.org>
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Oliver Hunt.
 
-        Fix caretRangeFromPoint()/elementFromPoint() returns wrong result 
-        for a zoomed and scrolled page.
-        https://bugs.webkit.org/show_bug.cgi?id=30689.
+        https://bugs.webkit.org/show_bug.cgi?id=36325
 
-        The real cause is the wrong calculation of event.clientX/Y when
-        page is zoomed and scolled.
-        After Sam fixed the event.clientX/Y in r49551, the hit test point
-        should be recalculated (revert r49490).
+        Add support for stopImmediatePropagation from DOM Level 3 Events.
 
-        Test: fast/dom/Document/CaretRangeFromPoint/caretRangeFromPoint-in-zoom-and-scroll.html
+        Added fast/events/stop-immediate-propagation.html.
 
-        * dom/Document.cpp:
-        (WebCore::Document::elementFromPoint): calculate the correct point
-        relative to document when page is zoomed and scrolled.
-        (WebCore::Document::caretRangeFromPoint): calculate the correct point
-        relative to document when page is zoomed and scrolled.
+        * dom/Event.cpp:
+        (WebCore::Event::Event):
+        * dom/Event.h:
+        (WebCore::Event::timeStamp):
+        (WebCore::Event::stopPropagation):
+        (WebCore::Event::stopImmediatePropagation):
+        (WebCore::Event::propagationStopped):
+        (WebCore::Event::immediatePropagationStopped):
+        * dom/Event.idl:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
 
-2009-10-22  Dumitru Daniliuc  <dumi@chromium.org>
+2010-03-18  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        Reviewed by Dmitry Titov.
+        Unreviewed, build fix.
 
-        Adding a class that allows us to enable/disable features at
-        runtime. Adding a flag to enable database support.
+        Return frame accessor back to Geolocation, it's used in GeolocationServiceChromium.
+        The accessor was removed in http://trac.webkit.org/changeset/56188.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30653
+        * page/Geolocation.h:
+        (WebCore::Geolocation::frame): Added back.
 
-        * WebCore.gypi:
-        * bindings/v8/RuntimeEnabledFeatures.cpp: Added.
-        * bindings/v8/RuntimeEnabledFeatures.h: Added.
-        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
-        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
-        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * page/DOMWindow.idl:
+2010-03-18  Brent Fulgham  <bfulgham@webkit.org>
 
-2009-10-23  Keishi Hattori  <casey.hattori@gmail.com>
+        Reviewed by Adam Roben.
 
-        Reviewed by Timothy Hatcher.
+        Help reduce build problems due to font declarations.
+        https://bugs.webkit.org/show_bug.cgi?id=36190
 
-        Inspector injects _inspectorCommandLineAPI into global object when opened
-        https://bugs.webkit.org/show_bug.cgi?id=30675
+        Functions unchanged, no new tests.
 
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getCompletions):
-        (InjectedScript._evaluateOn):
-        (InjectedScript.addInspectedNode):
-        (InjectedScript._ensureCommandLineAPIInstalled): Moved _inspectorCommandLineAPI from window to console.
+        * WebCore.vcproj/WebCore.vcproj: Add new file, and show
+          movement of FontPlatformData.h to cg/ directory.
+        * platform/graphics/cairo/FontPlatformData.h: Merge in
+          WinCairo-specific declarations.  Correct constructor
+          declaration to use type float for font size.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::hfont):
+        (WebCore::FontPlatformData::useGDI):
+        (WebCore::FontPlatformData::fontFace):
+        (WebCore::FontPlatformData::setSize):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        * platform/graphics/cairo/FontPlatformDataCairo.cpp:
+        (WebCore::FontPlatformData::FontPlatformData): Correct
+          constructor to accept type float for font size.
+        * platform/graphics/cg/FontPlatformData.h: Copied from WebCore/platform/graphics/win/FontPlatformData.h.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::hfont):
+        (WebCore::FontPlatformData::cgFont):
+        (WebCore::FontPlatformData::operator==):
+        * platform/graphics/win/FontPlatformData.h: Removed.
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        (WebCore::FontPlatformData::operator==): Move implementation
+          here (previously in header) to match other cairo-based ports.
+        * platform/graphics/win/RefCountedHFONT.h: Added.  This
+          was extracted from win/FontPlatformData.h, and is now shared
+          by the cg/FontPlatformData.h and cairo/FontPlatformData.h
+        (WebCore::RefCountedHFONT::create):
+        (WebCore::RefCountedHFONT::createDeleted):
+        (WebCore::RefCountedHFONT::~RefCountedHFONT):
+        (WebCore::RefCountedHFONT::hfont):
+        (WebCore::RefCountedHFONT::hash):
+        (WebCore::RefCountedHFONT::RefCountedHFONT):
 
-2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
+2010-03-18  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Tor Arne Vestbø.
+        No review.
 
-        [Qt] don't undef NULL in Symbian emulator
+        Fix brace style after r56170.
+        
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
 
-        npapi.h way of defining mwerks compiler,__intel__
-        and win32 are all true for Symbian emulator.
-        Changed the definions so that NULL won't be undefined
-        when compiling for Symbian emulator nor target HW.
+2010-03-18  Simon Fraser  <simon.fraser@apple.com>
 
-        * bridge/npapi.h:
+        Reviewed by Dave Hyatt.
 
-2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=36274
+        CSS3 :nth-child selector 'odd' keyword case sensitivity test fails
+        
+        The tests for "odd", "even" etc. for nth-child selectors should be case insensitive.
 
-        Reviewed by Tor Arne Vestbø.
+        Test: fast/css/nth-child-odd-case-insensitive.html
 
-        [Qt] Correct linking of sqlite3 for Symbian
-        https://bugs.webkit.org/show_bug.cgi?id=30569
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::RareData::parseNth):
 
-        ".lib" will try to include library as static library
-        causing the library to be searched from wrong directory and if found
-        will be statically linked instead of the inteded dynamic linking.
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-        * WebCore.pro:
+        Reviewed by Oliver Hunt.
 
-2009-10-23  Enrica Casucci  <enrica@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=36265
 
-        Reviewed by Adele Peterson.
+        Add support for event.defaultPrevented from DOM level 3.
+    
+        Added fast/events/defaultprevented.html
 
-        REGRESSION: Copy is copying incorrect background-color
-        <rdar://problem/7248529>
-        https://bugs.webkit.org/show_bug.cgi?id=29697
+        * dom/Event.idl:
 
-        Test: editing/execCommand/indent-paragraphs.html
+2010-03-18  Darin Adler  <darin@apple.com>
 
-        This change removes the BackgroundColor from the list 
-        of inheritable CSS properties and changes significantly
-        the way we perform indentation.
-        The new implementation of IndentOutdentCommand uses a new method
-        defined in CompositeEditCommand called moveParagraphWithClones.
-        This is an improved version of the original moveParagraph that
-        is aimed at preserving the original markup of the paragraph being
-        moved.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::): removed CSSPropertyBackgroundColor from editingStyleProperties.
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::CompositeEditCommand): Removed trailing blanks.
-        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt): Removed trailing blanks.
-        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement): Added.
-        (WebCore::CompositeEditCommand::cleanupAfterDeletion): Added.
-        (WebCore::CompositeEditCommand::moveParagraphWithClones): Added.
-        (WebCore::CompositeEditCommand::moveParagraphs): Modified to use cleanupAfterDeletion.
-        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Removed trailing blanks.
-        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph): Removed trailing blanks.
-        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary): Removed trailing blanks.
-        * editing/CompositeEditCommand.h: Added three new methods.
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Changed to use moveParagraphWithClones.
-        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Changed to use moveParagraphWithClones.
-        (WebCore::IndentOutdentCommand::indentRegion): Removed comment.
-        * editing/IndentOutdentCommand.h: Removed prepareBlockquoteLevelForInsertion method.
-
-2009-10-23  Steve Block  <steveblock@google.com>
+        Remove Geolocation.lastPosition, no longer in the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=36255
+        rdar://problem/7746357
 
-        Reviewed by Eric Seidel.
+        * WebCore.base.exp: Updated since Geolocation's destructor is now non-virtual.
 
-        Adds missing UnusedParam.h includes, required when INSPECTOR is not enabled.
-        https://bugs.webkit.org/show_bug.cgi?id=30677
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::lastPosition): Add an assertion; it's only legal to
+        call this if access to the location is allowed.
 
-        Build fix, no new tests required.
+        * page/Geolocation.h: Removed unneeded includes. Made destructor non-virtual,
+        although it will still be virtual if any of the base classes have a virtual
+        destructor. Made lastPosition, isAllowed, and isDenied functions private.
+        Removed unused suspend, resume, setShouldClearCache, shouldClearCache,
+        and frame functions.
 
-        * page/Console.cpp: Modified. Added UnusedParam.h include.
-        * workers/WorkerContext.cpp: Modified. Added UnusedParam.h include.
+        * page/Geolocation.idl: Removed lastPosition read-only attribute. No longer in
+        the Geolocation specification.
 
-2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-        Reviewed by Holger Freyther.
+        Reviewed by Simon Fraser.
 
-        [Qt] Plugins : Use window's winId() instead of the widget's.
+        https://bugs.webkit.org/show_bug.cgi?id=36275
 
-        As per, https://developer.mozilla.org/en/NPN_GetValue
-        NPNVnetscapeWindow on Unix/X11: "Gets the browser toplevel window in which the
-        plug-in is displayed; returns Window".
+        Make sure :not does not allow pseudo-elements inside it. (Hooray for another pointless
+        restriction on :not.)
 
-        The issue was found because NPNVNetscapeWindow winId() ends up creating
-        a native window resulting in flicker.
+        Added fast/css/invalid-not-with-pseudo-element.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=30706
+        * css/CSSGrammar.y:
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::matchesPseudoElement):
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::getValue):
+2010-03-18  Dan Bernstein  <mitz@apple.com>
 
-2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
+        Reviewed by Darin Adler.
 
-        Reviewed by Holger Freyther.
+        <rdar://problem/7761400> Rework the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=18722
 
-        [Qt] Windowless Plugins : Don't use m_clipRect when painting.
+        Test: fast/dynamic/float-remove-above-line-2.html
 
-        Though it works, it is not correct to use m_clipRect for painting
-        in Windowless mode. Instead, the rect paramater that is passed
-        as a part of PluginView::paint() must be used. This change will
-        also result in some speedup since previously we used to paint all
-        the visible parts of a windowless plugin (even if those parts were
-        not dirty).
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeFloatingObject): Treat 0- and less-than-0-height floats
+        as having a height of 1 so that they intersect with the line they originate on.
+        (WebCore::RenderBlock::clearFloats): Use numeric_limits.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Removed the intersection checks here,
+        so that a float is always included in the float list of the line it originates on, even
+        if it does not intersect that line. This ensures that every float is accounted for, which
+        is necessary during incremental layout when adding floats from clean lines.
 
-        Also, fix invalidateRect() to compute the correct width and height.
+2010-03-18  Antti Koivisto  <koivisto@iki.fi>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30711
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::invalidateRect):
+        https://bugs.webkit.org/show_bug.cgi?id=36102
+        [Qt] Scaling control API for tiled backing store
+        
+        Commit the new scale synchronously after unfreeze to avoid ugliness.
 
-2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::TiledBackingStore):
+        (WebCore::TiledBackingStore::setContentsScale):
+        (WebCore::TiledBackingStore::commitScaleChange):
+        (WebCore::TiledBackingStore::setContentsFrozen):
+        * platform/graphics/TiledBackingStore.h:
 
-        Reviewed by Holger Freyther.
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-        Plugins : Use test.swf in the plugins manual tests.
+        Reviewed by Simon Fraser.
 
-        They previously referenced youtube videos which among other things are
-        cumbersome to use without internet connection. The old youtube link is
-        just commented out so that testing with youtube can be done with
-        little effort.
+        https://bugs.webkit.org/show_bug.cgi?id=36281
 
-        https://bugs.webkit.org/show_bug.cgi?id=30662
+        Make sure an exception is raised if an @import rule is inserted in the wrong place.
+        
+        Also make sure (so that this particular test case passes) that rgba(0, 0, 0, 0) is dumped
+        as transparent by getComputedStyle, since it most commonly occurs in background-color and
+        that default makes more sense than dumping rgba values.
 
-        * manual-tests/plugins/test.swf: Copied from LayoutTests/fast/replaced/resources/test.swf.
-        * manual-tests/plugins/windowed.html:
-        * manual-tests/plugins/windowless.html:
-        * manual-tests/qt/plugin-sibling-frame-include.html:
+        Added fast/css/invalid-import-insertion.html
 
-2009-10-23  Brian Weinstein  <bweinstein@apple.com>
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::createColor):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::insertRule):
 
-        Reviewed by Jon Honeycutt.
+2010-03-18  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Fix the Windows Release build by moving Accessibility files
-        into all-in-one file and excluding them from the build.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * WebCore.vcproj/WebCore.vcproj:
-        * accessibility/AccessibilityAllInOne.cpp: Added.
+        Multiselect Popup - Listbox click simulation
+        https://bugs.webkit.org/show_bug.cgi?id=36177
 
-2009-10-16  Gavin Barraclough  <barraclough@apple.com>
+        Listbox popups will need to notify the corresponding select elements that a
+        selection change happened. The current HTMLSelectElement interface does not
+        allow multiple selections.
 
-        Reviewed by Sam Weinig & Geoff Garen.
+        The new method  listBoxSelectItem will be used for that. I have refactored part
+        of the mouse handling code in bug 36124 and I am now reusing it here for
+        <select multiple> popups. All the other cases will handled as they were before to be
+        sure that no side effects will show up.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30696
-        Add support for IsolatedWorlds to JSC bindings.
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::updateListBoxSelection):
+        (WebCore::SelectElement::listBoxOnChange):
+        * dom/SelectElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::listBoxPopupClick):
+        * html/HTMLSelectElement.h:
 
-        An IsolatedWorld is basically a parallel, separate copy of the window shells and DOM wrapper objects for
-        a given document.  To support isolation this patch:
+2010-03-12  Ojan Vafai  <ojan@chromium.org>
 
-            * Adds support to the ScriptController to track multiple window shells, one per world.
-            * Adds support to Document to support multiple separate wrapper-maps, one per world.
-            * Replaces the single global DOM wrapper map (on the WebCoreJSClientData) with separate maps,
-              stored on the (new) IsolatedWorld objects.
+        Reviewed by David Levin.
 
-        In addition to supporting separate copies of these objects, two other features are supported:
+        smartdelete should only occur after double-click
+        https://bugs.webkit.org/show_bug.cgi?id=35314
 
-            * It is necessary to track the current world on entry into JSC, so that within callbacks out to WebCore
-              we can determine which world (and as such, set of DOM bindings) we should be operating on.
-            * EventListeners & Callbacks are run in the world they were registered in.
-              This requires the handler to retain a reference to the world.
+        1. Consolidate all notions of selection-granularity into SelectionController.
+        2. Now only mouse-based selections store a selection-granularity. This matches NSTextView.
 
-        No new tests. (Enabled existing isolated world layout tests.)
+        New tests were added in http://trac.webkit.org/changeset/55913.
 
         * WebCore.base.exp:
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSCallbackData.cpp:
-        (WebCore::JSCallbackData::invokeCallback):
-        * bindings/js/JSCallbackData.h:
-        (WebCore::JSCallbackData::JSCallbackData):
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::removeWrappers):
-        (WebCore::DOMObjectWrapperMap::get):
-        (WebCore::DOMObjectWrapperMap::set):
-        (WebCore::DOMObjectWrapperMap::remove):
-        (WebCore::DOMObjectWrapperMap::take):
-        (WebCore::IsolatedWorld::IsolatedWorld):
-        (WebCore::IsolatedWorld::~IsolatedWorld):
-        (WebCore::EnterIsolatedWorld::EnterIsolatedWorld):
-        (WebCore::EnterIsolatedWorld::~EnterIsolatedWorld):
-        (WebCore::JSGlobalDataWorldIterator::JSGlobalDataWorldIterator):
-        (WebCore::JSGlobalDataWorldIterator::operator bool):
-        (WebCore::JSGlobalDataWorldIterator::operator*):
-        (WebCore::JSGlobalDataWorldIterator::operator->):
-        (WebCore::JSGlobalDataWorldIterator::operator++):
-        (WebCore::getCurrentWorld):
-        (WebCore::getNormalWorld):
-        (WebCore::commonNormalWorld):
-        (WebCore::commonCurrentWorld):
-        (WebCore::DOMObjectHashTableMap::mapFor):
-        (WebCore::DOMObjectWrapperMap::mapFor):
-        (WebCore::forgetDOMObject):
-        (WebCore::getCachedDOMNodeWrapper):
-        (WebCore::forgetDOMNode):
-        (WebCore::cacheDOMNodeWrapper):
-        (WebCore::forgetAllDOMNodesForDocument):
-        (WebCore::forgetWorldOfDOMNodesForDocument):
-        (WebCore::isObservableThroughDOM):
-        (WebCore::markDOMNodesForDocument):
-        (WebCore::markActiveObjectsForContext):
-        (WebCore::takeWrappers):
-        (WebCore::updateDOMNodeDocument):
-        (WebCore::markDOMObjectWrapper):
-        (WebCore::allowsAccessFromFrame):
-        (WebCore::printErrorMessageForFrame):
-        (WebCore::JSC_DebuggerCallFrame_evaluateInWorld):
-        (WebCore::JSC_callInWorld):
-        (WebCore::JSC_constructInWorld):
-        (WebCore::JSC_evaluateInWorld):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::IsolatedWorld::rememberDocument):
-        (WebCore::IsolatedWorld::forgetDocument):
-        (WebCore::IsolatedWorld::rememberScriptController):
-        (WebCore::IsolatedWorld::forgetScriptController):
-        (WebCore::DOMObjectHashTableMap::~DOMObjectHashTableMap):
-        (WebCore::DOMObjectHashTableMap::get):
-        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
-        (WebCore::WebCoreJSClientData::currentWorld):
-        (WebCore::WebCoreJSClientData::normalWorld):
-        (WebCore::WebCoreJSClientData::rememberWorld):
-        (WebCore::WebCoreJSClientData::forgetWorld):
-        (WebCore::debuggerWorld):
-        (WebCore::pluginWorld):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
-        (WebCore::toJSDOMGlobalObject):
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::printErrorMessage):
-        (WebCore::JSDOMWindowBase::commonJSGlobalData):
-        (WebCore::toJS):
-        (WebCore::toJSDOMWindow):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        (WebCore::JSDOMWindow::open):
-        (WebCore::JSDOMWindow::showModalDialog):
-        (WebCore::JSDOMWindow::setTimeout):
-        (WebCore::JSDOMWindow::setInterval):
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::toJS):
-        (WebCore::toJSDOMWindowShell):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSDesktopNotificationsCustom.cpp:
-        (WebCore::JSNotification::addEventListener):
-        (WebCore::):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener):
-        (WebCore::JSEventListener::handleEvent):
-        (WebCore::JSEventListener::reportError):
-        * bindings/js/JSEventListener.h:
-        (WebCore::JSEventListener::create):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        (WebCore::JSHTMLDocument::open):
-        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
-        (WebCore::JSHTMLFrameSetElement::nameGetter):
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::databaseForId):
-        (WebCore::JSInspectorBackend::inspectedWindow):
-        (WebCore::JSInspectorBackend::nodeForId):
-        * bindings/js/JSLazyEventListener.cpp:
-        (WebCore::JSLazyEventListener::JSLazyEventListener):
-        (WebCore::JSLazyEventListener::parseCode):
-        * bindings/js/JSLazyEventListener.h:
-        (WebCore::JSLazyEventListener::create):
-        * bindings/js/JSMessageChannelCustom.cpp:
-        (WebCore::JSMessageChannel::markChildren):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::markChildren):
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        (WebCore::JSNode::markChildren):
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::acceptNode):
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::construct):
-        (WebCore::JSQuarantinedObjectWrapper::call):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSSharedWorkerCustom.cpp:
-        (WebCore::JSSharedWorker::markChildren):
-        * bindings/js/JSWebSocketCustom.cpp:
-        (WebCore::JSWebSocket::addEventListener):
-        (WebCore::JSWebSocket::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        (WebCore::JSWorkerContext::setTimeout):
-        (WebCore::JSWorkerContext::setInterval):
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::constructXMLHttpRequest):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::markChildren):
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::markChildren):
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::create):
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::executeFunctionInContext):
-        (WebCore::ScheduledAction::execute):
-        * bindings/js/ScheduledAction.h:
-        (WebCore::ScheduledAction::ScheduledAction):
-        * bindings/js/ScriptCachedFrameData.cpp:
-        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
-        (WebCore::ScriptCachedFrameData::restore):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::~ScriptController):
-        (WebCore::ScriptController::evaluateInWorld):
-        (WebCore::ScriptController::evaluate):
-        (WebCore::ScriptController::evaluateInIsolatedWorld):
-        (WebCore::ScriptController::clearWindowShell):
-        (WebCore::ScriptController::initScript):
-        (WebCore::ScriptController::processingUserGestureEvent):
-        (WebCore::ScriptController::attachDebugger):
-        (WebCore::ScriptController::updateDocument):
-        (WebCore::ScriptController::bindingRootObject):
-        (WebCore::ScriptController::createRootObject):
-        (WebCore::ScriptController::windowScriptNPObject):
-        (WebCore::ScriptController::jsObjectForPluginElement):
-        * bindings/js/ScriptController.h:
-        (WebCore::ScriptController::windowShell):
-        (WebCore::ScriptController::existingWindowShell):
-        (WebCore::ScriptController::globalObject):
-        (WebCore::ScriptController::forgetWorld):
-        * bindings/js/ScriptControllerMac.mm:
-        (WebCore::ScriptController::windowScriptObject):
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
-        * bindings/js/ScriptFunctionCall.cpp:
-        (WebCore::ScriptFunctionCall::call):
-        (WebCore::ScriptFunctionCall::construct):
-        * bindings/js/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/js/ScriptState.cpp:
-        (WebCore::scriptStateFromNode):
-        (WebCore::scriptStateFromPage):
-        * bindings/js/ScriptState.h:
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::WorkerScriptController):
-        (WebCore::WorkerScriptController::evaluate):
-        * bindings/objc/DOMInternal.mm:
-        (-[WebScriptObject _initializeScriptDOMNodeImp]):
-        * bindings/objc/WebScriptObject.mm:
-        (-[WebScriptObject callWebScriptMethod:withArguments:]):
-        (-[WebScriptObject evaluateWebScript:]):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/NP_jsobject.cpp:
-        (_NPN_InvokeDefault):
-        (_NPN_Invoke):
-        (_NPN_Evaluate):
-        (_NPN_Construct):
-        * bridge/jni/jni_jsobject.mm:
-        (JavaJSObject::call):
-        (JavaJSObject::eval):
-        * dom/Document.cpp:
-        (WebCore::Document::createWrapperCache):
-        * dom/Document.h:
-        (WebCore::Document::wrapperCacheMap):
-        (WebCore::Document::getWrapperCache):
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::startUserInitiatedProfiling):
-        (WebCore::InspectorController::stopUserInitiatedProfiling):
-        * inspector/JavaScriptCallFrame.cpp:
-        (WebCore::JavaScriptCallFrame::evaluate):
+        * editing/MoveSelectionCommand.cpp:
+        (WebCore::MoveSelectionCommand::MoveSelectionCommand):
+        (WebCore::MoveSelectionCommand::doApply):
+        * editing/MoveSelectionCommand.h:
+        (WebCore::MoveSelectionCommand::create):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        (WebCore::SelectionController::setSelection):
+        (WebCore::SelectionController::modify):
+        (WebCore::SelectionController::clear):
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::setSelection):
+        (WebCore::SelectionController::granularity):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::VisibleSelection):
+        (WebCore::VisibleSelection::expandUsingGranularity):
+        (WebCore::VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity):
+        (WebCore::VisibleSelection::validate):
+        * editing/VisibleSelection.h:
+        (WebCore::operator==):
         * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
-        * platform/network/mac/AuthenticationMac.mm:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::XMLHttpRequest):
-        (WebCore::XMLHttpRequest::dropProtection):
-        * xml/XMLHttpRequest.h:
-        (WebCore::XMLHttpRequest::create):
-
-2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: EventListenersSidebarPane TODO No Longer Needed
-        https://bugs.webkit.org/show_bug.cgi?id=30705
-
-        * inspector/front-end/EventListenersSidebarPane.js:
-
-2009-10-22  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Tim Hatcher.
+        (WebCore::FrameLoader::clear):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::extend):
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::selectClosestWordFromMouseEvent):
+        (WebCore::EventHandler::selectClosestWordOrLinkFromMouseEvent):
+        (WebCore::EventHandler::handleMousePressEventTripleClick):
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        (WebCore::EventHandler::updateSelectionForMouseDrag):
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::selectionGranularity):
+        * page/Frame.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setSelectionRange):
 
-        https://bugs.webkit.org/show_bug.cgi?id=30506
-        <rdar://problem/7319845> Resources that the server sent as 304 not modified are not shown
-        in the inspectors resource pane
+2010-03-18  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        I don't know how to make a test for this.
+        Unreviewed, build fix.
 
-        The issue here was that preloaded resources weren't added to DocLoader document resource set,
-        but Web Inspector asked DocLoader to fetch data from CachedResource. Even when (if) document
-        parser eventually requested the same resource for real and it got added to resource set, it
-        was too late - the Inspector wasn't updated.
+        [V8] Turn npObjectTypeInfo into a function, make everyone happy.
 
-        * inspector/InspectorResource.cpp:
-        (WebCore::InspectorResource::cachedResource):
-        (WebCore::InspectorResource::type):
-        (WebCore::InspectorResource::resourceData):
-        * inspector/InspectorResource.h:
-        Fix the issue by trying to fetch corresponding CachedResource harder - also look in global
-        cache. This seems safe, and easier than updating the Inspector on transitions between
-        resource states (revalidate vs. revalidate done and preload vs. non-preload).
+        * bindings/v8/NPV8Object.cpp:
+        (WebCore::npObjectTypeInfo): Added new function.
+        (npCreateV8ScriptObject):
+        * bindings/v8/NPV8Object.h: Turned npObjectTypeInfo into function.
+        * bindings/v8/V8NPObject.cpp: Replaced references to function
 
-2009-10-22  Beth Dakin  <bdakin@apple.com>
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by Simon Fraser.
 
-        Fix for <rdar://problem/6942706> ER: Add a CSS property that allows 
-        shadows to work for SVG content
-        -and corresponding-
-        https://bugs.webkit.org/show_bug.cgi?id=30479
+        https://bugs.webkit.org/show_bug.cgi?id=36283
+        
+        The wrong constants were being used for the code that attempted to compact the background-repeat shorthand to
+        a single value.
 
-        This patch adds a new SVG-specific CSS property called -webkit-
-        shadow that has the same syntax as -webkit-box-shadow
+        Added fast/backgrounds/background-repeat-computed-style.html
 
-        Add CSSPropertyWebkitShadow to the list of SVG CSS properties, and 
-        make valueForShadow a member function rather than a static function 
         * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::valueForShadow):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSComputedStyleDeclaration.h:
-
-        Call valueForShadow for CSSPropertyWebkitShadow
-        * css/SVGCSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
-
-        Do standard CSS stuff for CSSPropertyWebkitShadow
-        * css/SVGCSSParser.cpp:
-        (WebCore::CSSParser::parseSVGValue):
-        * css/SVGCSSPropertyNames.in:
-        * css/SVGCSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applySVGProperty):
-
-        Set the appropriate shadow on the paint context if we have one. 
-        This seems to be all we have to do to have an SVG-shaped shadow.
-        * rendering/SVGRenderSupport.cpp:
-        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
-
-        Add shadow to SVGRenderStyle. I added a new macro that I don't like 
-        just because that's the way things are done here right now.
-        * rendering/style/SVGRenderStyle.cpp:
-        (WebCore::SVGRenderStyle::SVGRenderStyle):
-        (WebCore::SVGRenderStyle::operator==):
-        * rendering/style/SVGRenderStyle.h:
-        * rendering/style/SVGRenderStyleDefs.cpp:
-        (StyleShadowSVGData::StyleShadowSVGData):
-        (StyleShadowSVGData::operator==):
-        * rendering/style/SVGRenderStyleDefs.h:
-        (WebCore::StyleShadowSVGData::create):
-        (WebCore::StyleShadowSVGData::copy):
-        (WebCore::StyleShadowSVGData::operator!=):
-
-2009-10-22  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
- 
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25530
-        [Gtk] Implement LABEL_FOR/LABELLED_BY relationship pair for labels
-
-        Implements atk_object_ref_relation_set and LABEL_FOR/LABELLED_BY.
-        Also causes the accessible name for labeled controls to be based on
-        the label as expected, rather than based on the contents.
-
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        (correspondingLabelForControlElement):
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (setAtkRelationSetFromCoreObject):
-        (webkit_accessible_ref_relation_set):
-        (webkit_accessible_class_init):
-        (webkit_accessible_get_name):
+        (WebCore::fillRepeatToCSSValue):
 
-2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+2010-03-18  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Dave Hyatt.
 
-        Web Inspector: windowFocused and windowBlured Fail to Clear/Mark Inspector as "inactive"
-        https://bugs.webkit.org/show_bug.cgi?id=30663
+        https://bugs.webkit.org/show_bug.cgi?id=36273
+        CSS3 :indeterminate and input type=radio test fails
 
-          Correctly handle focusing/blurring on inner <iframe>'s such as Source Frames.
+        The :indeterminate pseudo-class should apply to both radio buttons and checkboxes.
 
-        * inspector/front-end/inspector.js:
-        (WebInspector.windowFocused): fix for inner iframes
-        (WebInspector.windowBlurred): fix for inner iframes
-        (WebInspector.addMainEventListeners): change useCapture to false
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setIndeterminate): Use allowsIndeterminate() to determine if the input
+        supports the indeterminate state.
+        (WebCore::HTMLInputElement::preDispatchEventHandler): Use allowsIndeterminate() to determine whether
+        to handle the indeterminate state.
+        (WebCore::HTMLInputElement::postDispatchEventHandler): Ditto.
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::allowsIndeterminate): New utility method, returns true for radio buttons
+        and checkboxes.
 
-2009-10-22  Jaime Yap  <jaimeyap@google.com>
+2010-03-18  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Dave Hyatt.
 
-        Makes a page reload optional when activating resource monitoring in
-        InspectorController. It leaves the default behavior as performing the reload.
-        Reload is an optional param so callsites do not have to change.
+        https://bugs.webkit.org/show_bug.cgi?id=36271
+        CSS3 :enabled on an input type=hidden element fails
+        
+        The CSS3 selectors spec now makes it clear that hidden inputs should respect
+        the :enabled and :disabled pseudo-classes.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30684
+        Test: fast/forms/hidden-input-enabled.html
 
-        No new tests added.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): Remove checks for hidden inputs.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::enableResourceTracking):
-        * inspector/InspectorController.h:
+2010-03-18  Enrica Casucci  <enrica@apple.com>
 
-2009-10-22  Shu Chang  <Chang.Shu@nokia.com>
+        Reviewed by Simon Fraser.
 
-        Reviewed by Eric Seidel.
+        Intro text at Star Wars demo is clipped.
+        <rdar://problem/7560979>
+        https://bugs.webkit.org/show_bug.cgi?id=33909
+        
+        Test: compositing/repaint/layer-repaint.html
+        
+        We are flipping the coordinates for drawing, therefore
+        we must flip them also when we invalidate the rectangles.
 
-        [Qt] Fix memory leak in QNetworkReplyHandler::abort().
-        In QNetworkReplyHandler::release(), m_reply should no longer point to its parent
-        after being released.
-        https://bugs.webkit.org/show_bug.cgi?id=30167
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::WebLayer::setNeedsDisplay):
 
-        No layout test available as a non-functional fix.
+2010-03-18  Nate Chapin  <japhet@chromium.org>
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::abort):
-        (WebCore::QNetworkReplyHandler::release):
+        Unreviewed, Chromium build fix.
 
-2009-10-22  Pavel Feldman  <pfeldman@chromium.org>
+        Missed a #include in V8Collection.h.
 
-        Reviewed by Timothy Hatcher.
+        * bindings/v8/V8Collection.h:
 
-        Web Inspector: Fix DOMAgent leak.
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30615
+        Reviewed by Simon Fraser.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::~InspectorController):
-        (WebCore::InspectorController::setFrontendProxyObject):
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::releaseDOMAgent):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.h:
-        (WebCore::InspectorDOMAgent::create):
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=36284.
+        
+        Make sure the CSS parser properly rejects negative border widths.
 
-2009-10-22  Dimitri Glazkov  <dglazkov@chromium.org>
+        Added fast/borders/negative-border-width.html
 
-        Reviewed by Adam Barth.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
 
-        [V8] Rework event listeners to not hold references to frame or V8 context.
+2010-03-18  Nate Chapin  <japhet@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30648
+        Reviewed by Dimitri Glazkov.
 
-        Covered by existing layout tests: fast/events/attribute-listener*
+        [V8] Remove V8Index.h and all references to V8ClassIndex.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=33477
 
-        * bindings/scripts/CodeGeneratorV8.pm: Added passing ScriptExecutionContext*
-            to event listener handling code.
-        * bindings/v8/DateExtension.cpp:
-        (WebCore::DateExtension::setAllowSleep): Changed to use currentContext().
-        * bindings/v8/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener): Reworked to match JSC logic.
-        (WebCore::getEventListenerHandlerBody): Added ScriptExecutionContext* param.
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Removed Frame* param
-            and usage.
-        (WebCore::V8AbstractEventListener::handleEvent): Chaged to use ScriptExecutionContext*.
-        (WebCore::V8AbstractEventListener::invokeEventHandler): Ditto.
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8AbstractEventListener::getListenerObject): Ditto.
-        (WebCore::V8AbstractEventListener::prepareListenerObject): Ditto.
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/NPV8Object.h:
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWindowShell.h:
         * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):  Added ScriptExecutionContext* param.
-        (WebCore::V8DOMWrapper::getEventListener): Ditto.
         * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Ditto.
-        * bindings/v8/V8EventListenerList.h:
-        (WebCore::V8EventListenerList::findOrCreateWrapper): Removed ContextType* template param,
-            because it's no longer needed.
-        * bindings/v8/V8IsolatedWorld.h:
-        (WebCore::V8IsolatedWorld::sharedContext): Renamed from shared_context.
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::V8LazyEventListener): Removed Frame* param and usage.
-        (WebCore::V8LazyEventListener::callListenerFunction): Added ScriptExecutionContext* param.
-        (WebCore::V8LazyEventListener::prepareListenerObject): Ditto.
-        * bindings/v8/V8LazyEventListener.h:
-        (WebCore::V8LazyEventListener::create): Reordered params to match JSC impl.
+        * bindings/v8/V8GCController.cpp:
+        * bindings/v8/V8Helpers.cpp:
+        * bindings/v8/V8Index.h: Removed.
+        * bindings/v8/V8IsolatedContext.h:
+        * bindings/v8/V8NPObject.cpp:
         * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::V8Proxy): Adjusted formatting to match WebKit style.
-        (WebCore::V8Proxy::evaluateInNewContext): Changed to use m_context directly.
-        (WebCore::V8Proxy::setInjectedScriptContextDebugId): Ditto.
-        (WebCore::V8Proxy::createWrapperFromCacheSlowCase): Ditto.
-        (WebCore::V8Proxy::isContextInitialized): Ditto.
-        (WebCore::V8Proxy::updateDocumentWrapperCache): Ditto.
-        (WebCore::V8Proxy::clearDocumentWrapperCache): Ditto.
-        (WebCore::V8Proxy::disposeContextHandles): Added explicit disposing of m_context. 
-        (WebCore::V8Proxy::clearForClose): Changed to use m_context directly.
-        (WebCore::V8Proxy::clearForNavigation): Ditto.
-        (WebCore::V8Proxy::setSecurityToken): Ditto.
-        (WebCore::V8Proxy::updateDocument): Ditto.
-        (WebCore::V8Proxy::initContextIfNeeded): Ditto.
-        (WebCore::V8Proxy::context): Changed to use v8::Local.
-        (WebCore::V8Proxy::mainWorldContext): Changed to use m_context directly. 
-        (WebCore::V8Proxy::setContextDebugId): Ditto.
-        (WebCore::toV8Context):
-        * bindings/v8/V8Proxy.h: Removed shared_context decl, changed to use straight
-            v8::Persistent for m_context.
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::workerProxy): Added.
-        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener): Removed
-            WorkerContextExecutionProxy* param.
-        (WebCore::V8WorkerContextEventListener::handleEvent): Started using ScriptExecutionContext*.
-        (WebCore::V8WorkerContextEventListener::reportError): Ditto.
-        (WebCore::V8WorkerContextEventListener::callListenerFunction): Ditto.
-        (WebCore::V8WorkerContextEventListener::getReceiverObject): Ditto.
-        * bindings/v8/V8WorkerContextEventListener.h:
-        (WebCore::V8WorkerContextEventListener::create): Removed
-            WorkerContextExecutionProxy* param.
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/V8SVGPODTypeWrapper.h:
         * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener): Removed ContextType*
-            template param.
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::V8EventListener): Removed Frame* param.
-        (WebCore::V8EventListener::getListenerFunction): Started using ScriptExecutionContext*.
-        (WebCore::V8EventListener::callListenerFunction): Ditto.
-        * bindings/v8/custom/V8CustomEventListener.h:
-        (WebCore::V8EventListener::create): Removed Frame* param.
-
-2009-10-14  Gaurav Shah  <gauravsh@google.com>
-
-        Reviewed by Darin Fisher.
-
-        Replaces temporary link stub for <keygen> tag handler for the Chromium
-        browser with a call via the Chromium Bridge.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30360
-
-        * platform/SSLKeyGenerator.h:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/SSLKeyGeneratorChromium.cpp:
-        (WebCore::getSupportedKeySizes):
-        (WebCore::signedPublicKeyAndChallengeString):
-        * platform/chromium/TemporaryLinkStubs.cpp:
-        (WebCore::KURL::fileSystemPath):
-        (WebCore::SharedBuffer::createWithContentsOfFile):
-
-2009-10-22  Avi Drissman  <avi@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fixes Chromium Mac pasteboard handling to flow through the same code paths as other platforms.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30591
-
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writeImage):
-
-2009-10-20  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Make accelerated compositing debug indicators work in release builds
-        https://bugs.webkit.org/show_bug.cgi?id=30588
-        
-        Allow some debug indicators, that show which page elements go into compositing layers,
-        to work in release builds, when the runtime prefs are set.
-
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::GraphicsLayer):
-        (WebCore::GraphicsLayer::setZPosition):
-        * platform/graphics/GraphicsLayer.h:
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::clearBorderColor):
-        (WebCore::GraphicsLayer::showRepaintCounter):
-        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
-        (WebCore::GraphicsLayerCA::updateMasksToBounds):
-        (WebCore::GraphicsLayerCA::updateLayerDrawsContent):
-        (WebCore::GraphicsLayerCA::setDebugBorder):
-        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
-        (WebCore::GraphicsLayerCA::setupContentsLayer):
-        * platform/graphics/mac/WebLayer.mm:
-
-2009-10-22  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Reviewed by Pavel Feldman.
-
-        Inspector should support monitorEvents/un monitorEvents() in the command line
-        https://bugs.webkit.org/show_bug.cgi?id=19879
-
-        * inspector/front-end/EventListenersSidebarPane.js:
-        (WebInspector.EventListenersSidebarPane.prototype.update.callback): Ignores event listeners generated by monitorEvent
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._ensureCommandLineAPIInstalled): Added _inspectorCommandLineAPI._logEvent, _allEventTypes, 
-        _normalizeEventTypes, monitorEvent, unmonitorEvent.
-
-2009-10-21  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Pavel Feldman.
-
-        Web Inspector: windowFocused and windowBlurred Fail to Clear/Mark Inspector as "inactive"
-        https://bugs.webkit.org/show_bug.cgi?id=30663
-
-        * inspector/front-end/inspector.js:
-        (WebInspector.windowFocused):
-        (WebInspector.windowBlurred):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/WrapperTypeInfo.h: Move WrapperTypeInfo struct into its own file from V8Index.h.
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8EventSourceConstructor.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.h:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.h:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.h:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
 
-2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+2010-03-18  Yury Semikhatsky  <yurys@chromium.org>
 
         Reviewed by Pavel Feldman.
 
-        Web Inspector: Error - requestContentType [undefined] is not an object
-        https://bugs.webkit.org/show_bug.cgi?id=30666
-
-        * inspector/front-end/ResourceView.js:
-        (WebInspector.ResourceView.prototype._refreshFormData):
+        Preserve console history between debugging sessions.
 
-2009-10-22  Maxime Simon  <simon.maxime@gmail.com>
+        https://bugs.webkit.org/show_bug.cgi?id=36223
 
-        Reviewed by Holger Freyther.
-
-        [Haiku] Correction of the accented letter width (they were 2 characters long).
-        https://bugs.webkit.org/show_bug.cgi?id=30629
-
-        * platform/graphics/haiku/SimpleFontDataHaiku.cpp:
-        (WebCore::SimpleFontData::platformWidthForGlyph):
-
-2009-10-21  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        <rdar://problem/7270320> Screenshots of off-screen plug-ins are blank
-        <rdar://problem/7270314> After halting a transparent PluginView on
-        Windows, the transparency is applied twice
-
-        Replace use of Frame::nodeImage() with a function that takes a snapshot
-        of a PluginView.
-
-        Reviewed by Dan Bernstein.
-
-        * plugins/PluginView.h:
-        Made paintWindowedPluginIntoContext() non-const, as it now calls
-        paintIntoTransformedContext(). Declare paintIntoTransformedContext()
-        and snapshot() for Windows platforms.
-
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::paintIntoTransformedContext):
-        Paints into the passed HDC without applying any coordinate translations.
-        Code moved from paintWindowedPluginIntoContext() and paint(). Removed
-        the memset() of windowpos in lieu of assignment.
-        (WebCore::PluginView::paintWindowedPluginIntoContext):
-        Code moved to paintIntoTransformedContext().
-        (WebCore::PluginView::paint):
-        Ditto.
-        (WebCore::PluginView::snapshot):
-        Create a context, and if the plug-in is windowless, translate it so the
-        plug-in will draw at the correct location. Create a bitmap, and select
-        it into the context. Paint the plug-in, and create a BitmapImage from
-        the bitmap.
-        (WebCore::PluginView::halt):
-        Use snapshot().
-
-2009-10-22  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Fix calculation of length in WebSocketChannel.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=30656
-
-        * websockets/WebSocketChannel.cpp:
-        (WebCore::WebSocketChannel::didReceiveData):
-
-2009-10-21  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Adding the ability to enable/disable functions in V8 at runtime.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30650
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-
-2009-10-21  Darin Adler  <darin@apple.com>
-
-        Swedish search (and other languages as well) is broken while fixing Japanese search
-        https://bugs.webkit.org/show_bug.cgi?id=30646
-
-        Rolled Japanese tailoring out that was done to fix
-        https://bugs.webkit.org/show_bug.cgi?id=30437 earlier.
-        It was overriding the locale-specific tailoring.
-        We'll land a fix once we figure out how to add the
-        Japanese tailoring without removing anything.
-
-        * editing/TextIterator.cpp: Rolled out r49924.
-
-2009-10-21  Pavel Feldman  <pfeldman@chromium.org>
-
-        Not reviewed: chromium build fix - add missing image to gypi.
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._settingsLoaded):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed.printResult):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings.prototype._load):
 
-        * WebCore.gypi:
+2010-03-18  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-2009-10-21  Brian Weinstein  <bweinstein@apple.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Eric Seidel.
+        [Qt] GraphicsLayer: Pausing and resuming of animations don't work as expected
+        https://bugs.webkit.org/show_bug.cgi?id=36219
+        
+        addAnimation and pauseAnimation were handling animation state changes in
+        the wrong way.
+        Apparently WebCore calls addAnimation for resuming, so we have to make 
+        sure to resume an existing animation if that happens. Also, timeOffset 
+        is now used for synchronization of the Qt animation clock with the 
+        WebCore clock, as opposed to using it as a delay timer. 
+        Both those fixes were necessary to get the layout test to work.
+        
+        LayoutTests/animations/play-state.html now passed on Qt.
 
-        Fixes part of <http://webkit.org/b/30522>.
-        Web Inspector: DOM Exceptions throughout the Inspector should be more human readable.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::AnimationQtBase::AnimationQtBase):
+        (WebCore::TransformAnimationQt::updateState):
+        (WebCore::GraphicsLayerQt::addAnimation):
+        (WebCore::GraphicsLayerQt::pauseAnimation):
 
-        Expose the description attribute that is now a member of
-        ExceptionBase as of r49723, so when a user logs an exception, they
-        can see the description in the Web Inspector.
+2010-03-18  Adam Langley  <agl@chromium.org>
 
-        Test: fast/dom/dom-exception-description.html
+        Reviewed by David Levin.
 
-        * dom/DOMCoreException.idl:
-        * dom/EventException.idl:
-        * dom/RangeException.idl:
-        * svg/SVGException.idl:
-        * xml/XMLHttpRequestException.idl:
-        * xml/XPathException.idl:
+        [chromium] Fix inverted logic in per-strike renderer patch.
 
-2009-10-21  Brian Weinstein  <bweinstein@apple.com>
+        I screwed up in r55089 and got one of the conditions backwards. Thanks
+        to Roman Tsisyk for pointing it out.
 
-        Reviewed by Timothy Hatcher.
+        https://bugs.webkit.org/show_bug.cgi?id=35495
 
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30616>.
-        REGRESSION (r49036): Web Inspector: Summary graph no longer switching to size summary.
-        
-        Add a check to make sure a function we need to calculate percentages is
-        defined before we use it.
+        Test: platform/chromium/fast/text/chromium-linux-fontconfig-renderstyle.html
 
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::querySystemForRenderStyle):
 
-2009-10-21  Keishi Hattori  <casey.hattori@gmail.com>
+2010-03-18  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        REGRESSION: Clicking on nodes in the console should take you to the element in the DOM
-        https://bugs.webkit.org/show_bug.cgi?id=27231
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._formatnode): Turns on ElementsTreeOutline.showInElementsPanelEnabled
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline): Added ElementsTreeOutline.showInElementsPanelEnabled
-        (WebInspector.ElementsTreeElement.prototype.onmousedown): Reveals the node in the Elements panel if 
-        treeOutline.showInElementsPanelEnabled is true.
-
-2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
+        Web Inspector: Show inherited styles for a selected DOM element
 
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30637
-        Fix a compiler warning in windows.
+        https://bugs.webkit.org/show_bug.cgi?id=28039
 
-        * loader/ResourceLoadNotifier.h:
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getStyles):
+        (WebCore::InspectorDOMAgent::populateObjectWithStyleProperties):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.CSSStyleDeclaration):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._update):
+        (WebInspector.StylesSidebarPane.prototype._containsInherited):
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyInherited):
+        (WebInspector.StylePropertiesSection.prototype.onpopulate):
 
-2009-10-21  Dmitry Titov  <dimich@chromium.org>
+2010-03-15  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Gustavo Noronha.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        Fix the crash when a node not in a document receives dispatchEvent.
-        https://bugs.webkit.org/show_bug.cgi?id=30611
+        Spatial Navigation: Add isNull() and document() convenience methods to FocusCandidate.
+        https://bugs.webkit.org/show_bug.cgi?id=36167
 
-        Test: fast/events/dispatch-event-no-document.html
+        It turns out that Spatial Navigation related code (in FocusController.cpp for
+        instance) can be simplified and look better if FocusCandidate class offer some
+        convenience method. This patch introduces a couple of them (isNull and a Document
+        getter). It also adds another constructor that receives a Node as parameter.
 
-        * dom/EventTarget.cpp: Check for scriptExecutionContext() at the moment of dispatchEvent; do nothing if no context.
-        (WebCore::EventTarget::dispatchEvent):
+        A followup refactoring patch will be making use of these helper methods.
 
-2009-10-21  Adam Langley  <agl@google.com>
+        * page/SpatialNavigation.h:
+        (WebCore::FocusCandidate::FocusCandidate): Added a "Node*" parameter
+        to FocusCandidate's constructor.
+        (WebCore::FocusCandidate::isNull): In the Spatial Navigation logic, a NULL
+        FocusCandidate object is one that does not hold a valid reference to a "Node*".
+        (WebCore::FocusCandidate::document): This method returns a pointer for the FocusCandidate
+        node's document, if |node| is a valid pointer.
 
-        Reviewed by Eric Seidel.
+2010-03-18  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Chromium Linux: disable subpixel text on layers.
+        Reviewed by Antti Koivisto.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30635
-        http://code.google.com/p/chromium/issues/detail?id=25365
+        [Qt] [Performance] GraphicsLayerQt updates the scene too often
+        https://bugs.webkit.org/show_bug.cgi?id=36158
+
+        This fix makes sure that flushChanges is only called when necessary,
+        by calling the notifySync function asynchronously, which makes sure flushChanges() is called
+        after the WebCore compositor has made all its changes.
+
+        This has shown a visual improvement on several test-cases.
+
+        * Makefile:
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::):
+        (WebCore::GraphicsLayerQtImpl::notifySyncRequired):
+        (WebCore::GraphicsLayerQtImpl::notifyChange):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        (WebCore::GraphicsLayerQt::setMaskLayer):
+        (WebCore::GraphicsLayerQt::setPosition):
+        (WebCore::GraphicsLayerQt::setAnchorPoint):
+        (WebCore::GraphicsLayerQt::setSize):
+        (WebCore::GraphicsLayerQt::setTransform):
+        (WebCore::GraphicsLayerQt::setChildrenTransform):
+        (WebCore::GraphicsLayerQt::setPreserves3D):
+        (WebCore::GraphicsLayerQt::setMasksToBounds):
+        (WebCore::GraphicsLayerQt::setDrawsContent):
+        (WebCore::GraphicsLayerQt::setBackgroundColor):
+        (WebCore::GraphicsLayerQt::clearBackgroundColor):
+        (WebCore::GraphicsLayerQt::setContentsOpaque):
+        (WebCore::GraphicsLayerQt::setBackfaceVisibility):
+        (WebCore::GraphicsLayerQt::setOpacity):
+        (WebCore::GraphicsLayerQt::setContentsRect):
+
+2010-03-18  Stephen White  <senorblanco@chromium.org>
 
-        With the addition of layers for drawing rounded corners in r49641,
-        subpixel text on rounded rectangles broke. This is because the layer
-        only contains a single alpha channel and this is insufficient to
-        compose subpixel text correctly.
+        Reviewed by Oliver Hunt.
 
-        On Windows, a large body of code in TransparencyWin.cpp exists to try
-        to deal with this. Even then, in some cases, it downgrades to
-        anti-aliased text. We need a fix for the grevious effects quickly thus
-        this patch disables subpixel text when rendering into a layer.
+        Parsing of rgb() colors in HTML canvas is still fairly slow.
+        findNamedColor() was showing up as hot, so this patch attempts to
+        avoid calling it by putting the rgb() check ahead of the named
+        colors.  It also removes a call to Color::Color() from
+        CanvasStyle, which was doing a redundant check for the hex
+        color and named colors, which CSSParser already does.  Finally, it
+        changes the ad-hoc parser to check for negative values, and clamps them
+        at zero.  This avoids the lex/yacc path for rgb() colors with
+        negative color components.
 
-        This would be covered by existing tests except that subpixel text is
-        disabled for pixel tests on Chromium Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=36199
 
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::isCanvasMultiLayered):
-        (WebCore::adjustTextRenderMode):
-        (WebCore::Font::drawGlyphs):
-        (WebCore::Font::drawComplexText):
+        Covered by fast/canvas/set-colors.html.
 
-2009-10-21  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wxMac 10.4 build fix, make sure we specify the Sqlite3 dependency correctly as otherwise
-        it will use the sqlite3 system library rather than WebCoreSQLite3.
+        * css/CSSParser.cpp:
+        (WebCore::parseInt):
+        (WebCore::CSSParser::parseColor):
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyFillColor):
 
-        * wscript:
+2010-03-18  David Kilzer  <ddkilzer@apple.com>
 
-2009-10-21  Dan Bernstein  <mitz@apple.com>
+        <http://webkit.org/b/36246> Node::removeAllEventListenersSlowCase is declared but not used
 
         Reviewed by Sam Weinig.
 
-        Fixed background-clip parsing regressions introduced in r46240.
-
-        Test: fast/css/background-clip-text.html
-
-        * css/CSSParser.cpp:
-        (WebCore::parseBackgroundClip): Added this helper method.
-        (WebCore::CSSParser::parseFillShorthand): Use parseBackgroundClip() to
-        reparse the value. The old code called parseFillProperty() again, which
-        didn’t work, because parseFillProperty() advances the value list.
-        (WebCore::CSSParser::parseFillProperty): Changed to use
-        parseBackgroundClip().
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::operator EFillBox): Added a case for
-        CSSValueWebkitText.
-
-2009-10-21  Alexander Pavlov  <apavlov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
+        * dom/Node.h:
+        (WebCore::Node::removeAllEventListenersSlowCase): Removed
+        declaration.  Implementation was removed in r48701.
 
-        Enable creation of custom SidebarTreeElements for different ProfileTypes
+2010-03-17  Stephan Aßmus  <superstippi@gmx.de>
 
-        ProfileTypes can now create sidebar tree elements of custom types.
-        https://bugs.webkit.org/show_bug.cgi?id=30520
+        Reviewed by Oliver Hunt.
 
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
-        (WebInspector.CPUProfileType.prototype.createSidebarTreeElementForProfile):
-        (WebInspector.CPUProfileType.prototype.createView):
-        (WebInspector.CPUProfile.prototype.get head):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfileType.prototype.buttonClicked):
-        (WebInspector.ProfileType.prototype.viewForProfile):
-        (WebInspector.ProfileType.prototype.createView):
-        (WebInspector.ProfileType.prototype.createSidebarTreeElementForProfile):
-        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
-        (WebInspector.ProfilesPanel.prototype.showProfile):
+        [Haiku] Implement ImageBuffer support
+        https://bugs.webkit.org/show_bug.cgi?id=35288
 
-2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
+        Covered by existing tests.
 
-        Reviewed by Timothy Hatcher.
+        The StillImage class implements WebCore::Image by wrapping a native
+        BBitmap. It will be needed to implement WebCore::ImageBuffer. This
+        solution is just like it's done in the Qt port.
 
-        Web Inspector: Selectors in the Styles pane should trigger a search for that selector when clicked
-        https://bugs.webkit.org/show_bug.cgi?id=17126
+        * platform/graphics/haiku/StillImageHaiku.cpp: Added.
+        (WebCore::StillImage::StillImage):
+        (WebCore::StillImage::destroyDecodedData):
+        (WebCore::StillImage::decodedSize):
+        (WebCore::StillImage::size):
+        (WebCore::StillImage::nativeImageForCurrentFrame):
+        (WebCore::StillImage::draw):
+        * platform/graphics/haiku/StillImageHaiku.h: Added.
+        (WebCore::StillImage::create):
 
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult): only change focusedDOMNode on a manual search
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertiesSection.prototype._clickSelector): trigger a search
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement.prototype._startEditing): correctly start editing attribute value instead of name
+2010-03-17  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-2009-10-20  Pavel Feldman  <pfeldman@chromium.org>
+        Rubber stamped by Gustavo Noronha Silva.
 
-        Reviewed by Timothy Hatcher.
+        [Gtk+] Avoid making a copy of the HTTPHeaderMap.
 
-        Web Inspector: Fix DOM Agent leak.
+        ResourceRequest::httpHeaderFields() is returning a const
+        reference but we are storing it as a simple value. This
+        means that we run either the copy constructor or the assignment
+        operator and make a copy of the RefPtrs.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30615
+        This extra copy can be avoided easily by storing
+        the result as a const reference.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::~InspectorController):
-
-2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        * platform/network/soup/ResourceResponseSoup.cpp:
+        (WebCore::ResourceResponseSoup::toSoupMessage):
 
-        Reviewed by Holger Freyther.
+2010-03-17  Alexander Pavlov  <apavlov@chromium.org>
 
-        Plugins: Create manual tests for testing plugins
-        
-        Create two test files:
-        1. windowed.html - Test plugin in windowed mode.
-        2. windowless.html - Test plugin in windowless mode.
+        Reviewed by Pavel Feldman.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30503
+        Web Inspector: When switching resources in the Resources panel, the Content tab is always selected
+        https://bugs.webkit.org/show_bug.cgi?id=36222
 
-        * manual-tests/plugins/windowed.html: Added.
-        * manual-tests/plugins/windowless.html: Added.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.showResource):
 
-2009-10-21  Satoshi Nakagawa  <psychs@limechat.net>
+2010-03-17  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Darin Adler.
 
-        Fixed Japanese text search problems.
-        Treat small kana letters and kana letters as different characters in search.
-        Do not ignore diacritic marks in search for Japanese texts.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30437
-
-        Test: fast/text/international/japanese-kana-letters.html
-
-        * editing/TextIterator.cpp:
-        (WebCore::createCollator):
-        (WebCore::collator):
-        (WebCore::createSearcher):
-
-2009-10-20  Eric Z. Ayers  <zundel@google.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Changes TimelineItems to be created with raw timestamps as opposed
-        to a time relative to a start of session.  Normalized timestamps cause
-        problems when monitoring a browsing session across multiple page
-        transitions.
-
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
-        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::willLayout):
-        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::willPaint):
-        (WebCore::InspectorTimelineAgent::willWriteHTML):
-        (WebCore::InspectorTimelineAgent::reset):
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
-        * inspector/InspectorTimelineAgent.h:
-
-2009-10-20  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix leak of WebSocketChannel by adopting the newly-created reference.
-
-        * websockets/WebSocketChannel.h:
-        (WebCore::WebSocketChannel::create):
-
-2009-10-20  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        DOM Storage runtime flag changes
-        https://bugs.webkit.org/show_bug.cgi?id=30602
-
-        Part 1/2.  Removing sessionStorageEnabled in next patch after the
-        Chromium side of the changes lands.
+        databaseIdentifiers are not filtered for slashes
+        <rdar://problem/7708789> and https://bugs.webkit.org/show_bug.cgi?id=36243
 
-        Revert my changes to Settings and instead implement DOM Storage enabling via
-        the methods agreed upon in https://bugs.webkit.org/show_bug.cgi?id=30240
+        In addition to filtering for '/' and '\', to remove the directory vulnerability
+        on all platforms, it seems worth it to also escape other characters that are
+        obviously dangerous or illegal to have in a filename (mostly inspired by the 
+        Windows illegal-character list).
 
-        This stuff was (intentionally) never exposed to web pages or DRT, so there's no
-        LayoutTest visible changes and thus no tests.
+        No new tests - It's unclear how a test could possibly work into our testing
+        infrastructure.
 
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * page/DOMWindow.idl:
-        * storage/Storage.cpp:
-        (WebCore::Storage::setLocalStorageAvailable):
-        (WebCore::Storage::localStorageAvailable):
-        (WebCore::Storage::setSessionStorageAvailable):
-        (WebCore::Storage::sessionStorageAvailable):
-        * storage/Storage.h:
+        * page/SecurityOrigin.cpp:
+        (WebCore::): Added a 128-bool table "needsEscaping" that has a true/false answer
+          for lower-ASCII.
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier): "Unescape" the host
+          component using the KURL utility.
+        (WebCore::shouldEscapeUChar): If the char is lower-ASCII, look it up in the 
+          needsEscaping table. Otherwise, let it pass.
+        (WebCore::encodedHost): Modeled after KURL's host escaping method, but targeted 
+          for the escaping considerations for the host component. We don't use the KURL
+          version because this one is "different" enough because it operates on UTF16 and
+          has its own "is bad character?" decider.
+        (WebCore::SecurityOrigin::databaseIdentifier): Create the escaped host if needed,
+          and use it instead of the unescaped host.
+        * page/SecurityOrigin.h:
 
-2009-10-20  John Gregg  <johnnyg@google.com>
+2010-03-17  Dmitry Titov  <dimich@chromium.org>
 
-        Reviewed by David Levin.
+        Reviewed by Dimitri Glazkov.
 
-        Need to turn off notifications properly at runtime
-        https://bugs.webkit.org/show_bug.cgi?id=30409
+        [v8] Avoid reentry into v8 after TerminateExecution() on a worker thread.
+        https://bugs.webkit.org/show_bug.cgi?id=36239
 
-        This code only affects chromium, and is all behind a compile time
-        flag current turned off, so no new tests.
+        Test: fast/workers/termination-with-port-messages.html
 
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::throwError): Avoid throwing if v8 execution is terminated anyways.
+        * bindings/v8/WorkerScriptController.h:
+        (WebCore::WorkerScriptController::proxy): Return V8 proxy as 0 if execution is terminating. Callers to check for 0 before invoking v8.
         * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * notifications/NotificationCenter.cpp:
-        (WebCore::NotificationCenter::setIsAvailable):
-        (WebCore::NotificationCenter::isAvailable):
-        * notifications/NotificationCenter.h:
-        * page/DOMWindow.idl:
-        * workers/WorkerContext.idl:
+        (WebCore::SetTimeoutOrInterval): Bail out if v8 proxy is 0.
+        (WebCore::toV8): Ditto
 
-2009-10-20  James Robinson  <jamesr@chromium.org>
+2010-03-17  José Millán Soto  <jmillan@igalia.com>
 
         Reviewed by Adam Barth.
 
-        Fixes RefPtr initialization in the V8 implementation of WebCore::ScriptString to use the ::create() idiom and
-        use adoptRef() properly.  I failed to read the RefPtr docs the first time through :(
-
-        No new tests, error was caught by valgrind on the Chromium builders.
-
-        * bindings/v8/ScriptString.h:
-        (WebCore::ScriptString::ScriptString):
-        (WebCore::ScriptString::operator=):
-        * bindings/v8/ScriptStringImpl.h:
-        (WebCore::ScriptStringImpl::create):
+        Change the way of prefetching DNS to allow prefetching function to use full URL
+        https://bugs.webkit.org/show_bug.cgi?id=35589
 
-2009-10-20  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Pavel Feldman.
+        Creates a new function, ResourceHandle::prepareForURL, whose default implementation
+        calls prefetchDNS with the host of the given URL as the parameter.
+        Soup implementation of ResourceHandle::prepareForURL executes soup_session_prepare_for_uri.
+        Soup implementation of prefetchDNS is removed.
+        Changed various prefetchDNS calls to ResourceHandle::prepareForURL calls.
 
-        Web Inspector: populate child nodes before sorting them.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29673
-
-        * inspector/front-end/BottomUpProfileDataGridTree.js:
-        (WebInspector.BottomUpProfileDataGridNode): Swapped with BottomUpProfileDataGridTree to be consistent with TopDownProfileDataGridNode.
-        (WebInspector.BottomUpProfileDataGridNode.prototype._takePropertiesFromProfileDataGridNode):
-        (WebInspector.BottomUpProfileDataGridNode.prototype._keepOnlyChild):
-        (WebInspector.BottomUpProfileDataGridNode.prototype._exclude):
-        (WebInspector.BottomUpProfileDataGridNode.prototype._merge):
-        (WebInspector.BottomUpProfileDataGridNode.prototype._sharedPopulate):
-        (WebInspector.BottomUpProfileDataGridTree.prototype.exclude):
-        * inspector/front-end/ProfileDataGridTree.js:
-        (WebInspector.ProfileDataGridNode.prototype.sort): Added missing parentheses.
-        (WebInspector.ProfileDataGridNode.prototype.get _parent):
-        (WebInspector.ProfileDataGridNode.prototype._populate):
-        * inspector/front-end/TopDownProfileDataGridTree.js:
-        (WebInspector.TopDownProfileDataGridNode.prototype._sharedPopulate):
-
-2009-10-20  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Remove redundant String ref/deref calls in generated V8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=30579
-
-        * bindings/v8/V8Binding.h:
-        (WebCore::toString): Fix return type of 'toString' to make it truly a no-op
-            instead of constructing/destructing a String.
-
-2009-10-20  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25411
-        [GTK] ATK accessible ancestry broken
-
-        Work around for the problem of bogus additional objects in the ancestry.
-        We now set the parent when we ref the child, then ask the Atk child if
-        it knows its parent. This solves the bulk of the cases. For those it
-        doesn't, fall back to the existing logic.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_parent):
-        (webkit_accessible_ref_child):
-
-2009-10-20  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Alice Liu.
-
-        Fixes <http://webkit.org/b/30421>.
-        Web Inpsector: Local Files can show up on Cookies List with Cookies from other Domain.
-
-        When a page like Google generates an about:blank, it shows up as a local file on
-        the list of Cookie domains, but has all of the cookies of Google. When we are adding
-        cookie domains to the inspector, we should only add the domain is the URL of the resource
-        is in the HTTP protocol family or a file URL.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::didFinishLoading):
+        * GNUmakefile.am:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::mouseDidMoveOverElement):
+        * platform/network/DNS.h:
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::prepareForURL):
+        * platform/network/ResourceHandle.h:
+        * platform/network/chromium/DNSChromium.cpp:
+        (WebCore::ResourceHandle::prepareForURL):
+        * platform/network/soup/DNSSoup.cpp: Removed.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::prepareForURL):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::parseMappedAttribute):
 
-2009-10-20  Mark Mentovai  <mark@chromium.org>
+2010-03-17  Kenneth Russell  <kbr@google.com>
 
         Reviewed by Darin Fisher.
 
-        Use a version of libWebKitSystemInterface with global symbols marked
-        private_extern for Chromium Mac.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30590
-
-        * WebCore.gyp/WebCore.gyp:
-        * WebCore.gyp/mac: Added.
-        * WebCore.gyp/mac/Empty.cpp: Added.
-        * WebCore.gyp/mac/adjust_visibility.sh: Added.
-
-2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Allow custom memory allocation control for WebCore's CSSProperty
-        https://bugs.webkit.org/show_bug.cgi?id=30564
-
-        Inherits CSSProperty class from FastAllocBase because it has been
-        instantiated by 'new' in WebCore/css/CSSParser.cpp:367.
-
-        * css/CSSProperty.h:
-
-2009-10-20  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Hide Chromium's media slider thumb if no source has been loaded.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30529
+        Revert WebGL context attributes changes 33416 / r56074 and 36200 / r56093
+        https://bugs.webkit.org/show_bug.cgi?id=36233
 
-        Covered by existing layout tests, notably:
-            LayoutTests/media/controls-rendering.html
-            LayoutTests/media/unsupported-tracks.html
-            LayoutTests/media/video-src-none.html
+        The patch for bug 33416, which added multisampling support to the
+        WebGL back buffer, uncovered some OpenGL driver bugs on the build
+        bots which need further investigation to determine the appropriate
+        workaround. Reverting this change, the minor build fix in 36189,
+        and the skipping of the affected tests in bug 36200.
 
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::hasSource): Returns true if an HTMLMediaElement has a valid source set.
-        (WebCore::paintMediaMuteButton): Refactored to use hasSource().
-        (WebCore::paintMediaPlayButton): Ditto.
-        (WebCore::paintMediaSliderThumb): Add call to hasSource() to determine if we should paint the thumb.
+        Built and tested WebKit and Chromium and ran all WebGL layout
+        tests in both.
 
-2009-10-20  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Added getter for FrameLoader:m_suppressOpenerInNewFrame.
-        This will allow Chromium to more intelligently detect
-        noreferrer links and therefore open them in a new process.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30581
-
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::suppressOpenerInNewFrame): Added.
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/Canvas3DLayer.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer drawInCGLContext:pixelFormat:forLayerTime:displayTime:]):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::GraphicsContext3D::bindFramebuffer):
+        (WebCore::GraphicsContext3D::readPixels):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D):
 
-2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
+2010-03-17  Yael Aharon  <yael.aharon@nokia.com>
 
         Reviewed by Darin Adler.
 
-        Allow custom memory allocation control for WebCore's CSSParserFunction
-        https://bugs.webkit.org/show_bug.cgi?id=30563
-
-        Inherits CSSParserFunction struct from FastAllocBase because it has been
-        instantiated by 'new' in WebCore/css/CSSParser.cpp:4827.
-
-        * css/CSSProperty.h:
-
-2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Watched Expressions Buttons Do Not Match Inspector Styles
-        https://bugs.webkit.org/show_bug.cgi?id=30554
-
-        * inspector/front-end/inspector.css: added style to pane buttons
+        Optimize painting for HTMLProgressElement
+        https://bugs.webkit.org/show_bug.cgi?id=36113
+        Cache the progress bar's position, so it is not required to recalculate
+        it for each repaint. 
+        Call repaintRectangle() when the position changes.
 
-2009-10-20  Yury Semikhatsky  <yurys@chromium.org>
+        No new tests, as no new functionality introduced.
 
-        Reviewed by Pavel Feldman.
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::parseMappedAttribute):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::getNumberOfPixelsForProgressPosition):
+        (WebCore::RenderThemeQt::paintProgressBar):
+        * platform/qt/RenderThemeQt.h:
+        * rendering/RenderProgress.cpp:
+        (WebCore::RenderProgress::RenderProgress):
+        (WebCore::RenderProgress::updateFromElement):
+        * rendering/RenderProgress.h:
+        (WebCore::RenderProgress::position):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::getNumberOfPixelsForProgressPosition):
+        * rendering/RenderTheme.h:
 
-        Set debug id for contexts of isolated worlds to distinguish them in debugger.
+2010-03-17  Antonio Gomes  <tonikitoo@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30559
+        Mac Buildfix: Using ASSERT_UNUSED instead of ASSERT.
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluateInIsolatedWorld):
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
-        * bindings/v8/V8Proxy.h:
+        Reviewed by Simon fraser.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-2009-10-20  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
 
-        Unreviewed buildfix.
-        [Qt] Add FEGaussianBlur.h and FEGaussianBlur.cpp which were refactored in r49778 to WebCore.pro.
+2010-03-17  Enrica Casucci  <enrica@apple.com>
 
-        * WebCore.pro:
-
-2009-10-20  Fumitoshi Ukai  <ukai@chromium.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by David Levin.
+        Missing support for showing compositing layers borders and repaint count on Windows.
+        <rdar://problem/7760736>
+        <https://bugs.webkit.org/show_bug.cgi?id=36197>
 
-        Set EnabledAtRuntime for WebSocket in DOMWindow
-        https://bugs.webkit.org/show_bug.cgi?id=29896
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::WebLayer::drawInContext): Modified to use the correct font on Windows.
 
-        Supported by chromium/v8 only.
-        Add WebSocket::isAvailable()/setIsAvailable(bool) to control v8
-        bindings.
-        Remove Settings::experimentalWebSocketsEnabled() and
-        setExperimentalWebSocketsEnabled(bool).
+2010-03-16  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        * WebCore.base.exp:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::webSocket):
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getConstructor):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * page/DOMWindow.idl:
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        * page/Settings.h:
-        * websockets/WebSocket.cpp:
-        (WebCore::WebSocket::setIsAvailable):
-        (WebCore::WebSocket::isAvailable):
-        * websockets/WebSocket.h:
+        Reviewed by Antti Koivisto.
 
-2009-10-19  Oliver Hunt  <oliver@apple.com>
+        [Qt] Multiselect Popup - SelectElement refactoring.
+        https://bugs.webkit.org/show_bug.cgi?id=36124
 
-        Reviewed by Sam Weinig.
+        As it is today it is not possible to the menulists popups to tell SelectElement
+        that more then one option is selected. If you select one the other ones
+        selected state will turn off.
 
-        REGRESSION: Dromaeo DOM test is 14% slower
-        https://bugs.webkit.org/show_bug.cgi?id=30273
+        For <select multiple> I needed to extend the API used by menulist popups. This
+        is the first step. Just refactoring SelectElement without any behavior change.
+        Separating code that will be reused in future patches.
 
-        Whoops, make prototype bindings actually use the StructureFlags.
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::updateSelectedState):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        * dom/SelectElement.h:
 
-        * bindings/scripts/CodeGeneratorJS.pm:
+2010-03-17  Nate Chapin  <japhet@chromium.org>
 
-2009-10-19  James Robinson  <jamesr@chromium.org>
+        Unreviewed, Chromium build fix.
 
-        Reviewed by Adam Barth.
+        Delete the correct file this time.
 
-        Better implementation of WebCore::ScriptString for the V8 bindings.
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp: Copied from WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp.
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp: Removed.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29909
+2010-03-17  Nate Chapin  <japhet@chromium.org>
 
-        WebCore::ScriptString is used for XMLHttpRequest's responseText attribute which is
-        shared with JavaScript.  Thus, simply using a WebCore::String and copying the value
-        is pretty inefficient, especially since responseText is built up with a sequence of
-        operator+= calls.  JSC builds use a JSC::UString to share the buffer when possible,
-        this patch adopts a similar approach for V8.
+        Reviewed by Dimitri Glazkov.
 
-        No new tests, behavior is unchanged and covered by LayoutTests/http/tests/xmlhttprequest
+        [V8] Remove custom bindings callbacks that aren't in use.
+        (The relevant .idl doesn't mark them as V8Custom or Custom).
+        
+        https://bugs.webkit.org/show_bug.cgi?id=33066
 
+        * Android.v8bindings.mk:
         * WebCore.gypi:
-        * bindings/v8/ScriptString.h:
-        (WebCore::ScriptString::ScriptString):
-        (WebCore::ScriptString::operator String):
-        (WebCore::ScriptString::isNull):
-        (WebCore::ScriptString::size):
-        (WebCore::ScriptString::operator=):
-        (WebCore::ScriptString::operator+=):
-        (WebCore::ScriptString::v8StringOrNull):
-        * bindings/v8/ScriptStringImpl.cpp: Added.
-        (WebCore::ScriptStringImpl::ScriptStringImpl):
-        (WebCore::ScriptStringImpl::~ScriptStringImpl):
-        (WebCore::ScriptStringImpl::toString):
-        (WebCore::ScriptStringImpl::isNull):
-        (WebCore::ScriptStringImpl::size):
-        (WebCore::ScriptStringImpl::append):
-        * bindings/v8/ScriptStringImpl.h: Added.
-        (WebCore::ScriptStringImpl::ScriptStringImpl):
-        (WebCore::ScriptStringImpl::v8StringHandle):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
         * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp: Removed.
 
-2009-10-19  Adam Barth  <abarth@webkit.org>
+2010-03-17  Steve Block  <steveblock@google.com>
 
-        No review, rolling out r49837.
-        http://trac.webkit.org/changeset/49837
-
-        * page/Settings.cpp:
-        (WebCore::Settings::setStandardFontFamily):
-        (WebCore::Settings::setFixedFontFamily):
-        (WebCore::Settings::setSerifFontFamily):
-        (WebCore::Settings::setSansSerifFontFamily):
-        (WebCore::Settings::setCursiveFontFamily):
-        (WebCore::Settings::setFantasyFontFamily):
-        * page/Settings.h:
-        (WebCore::Settings::standardFontFamily):
-        (WebCore::Settings::fixedFontFamily):
-        (WebCore::Settings::serifFontFamily):
-        (WebCore::Settings::sansSerifFontFamily):
-        (WebCore::Settings::cursiveFontFamily):
-        (WebCore::Settings::fantasyFontFamily):
-        * platform/text/UScriptCode.h: Removed.
+        Reviewed by Dimitri Glazkov.
 
-2009-10-19  Kwang Yul Seo  <skyul@company100.net>
+        Adds ENABLE(WORKERS) guards to V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=36221
 
-        Reviewed by Eric Seidel.
+        Build fix only, no new tests.
 
-        Check COMPILER(MSVC) instead of PLATFORM(WIN_OS) to avoid the use of vasprintf.
-        https://bugs.webkit.org/show_bug.cgi?id=30473
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::toV8Context):
 
-        vasprintf is missing in MSVC. Use COMPILER(MSVC) guards instead of
-        PLALTFORM(WIN_OS) guards.
+2010-03-17  Yury Semikhatsky  <yurys@chromium.org>
 
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::error):
+        Reviewed by Pavel Feldman.
 
-2009-10-19  Jungshik Shin  <jshin@chromium.org>
+        Remove unused reference to InspectorController from InspectorFrontend.
 
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=36218
 
-        https://bugs.webkit.org/show_bug.cgi?id=20797
+        * inspector/InspectorFrontend.h:
 
-        Make generic font family getters/setters accept an additional
-        argument (script code). It has a default value so that if an embedder
-        does not have/want a per-script font family setting, call-sites
-        don't have to be changed.
-        This is to prepare for fixing bug 10874 (font selection is not
-        language-dependent) and bug 18085.
+2010-03-17 Ilya Tikhonovsky  <loislo@chromium.org>
 
-        There should be no change in layout and no new layout test
-        is added.
+        Reviewed by Pavel Feldman.
 
-        * WebCore.base.exp:
-        * page/Settings.cpp:
-        * page/Settings.h:
-        * platform/text/UScriptCode.h: Added. This is for ports that
-          do not use ICU. the part of ICU's common/unicode/uscript.h
-          that defines script code enum was copied. To keep enums compatible
-          with those in ICU, we don't generate the list out of Scripts.txt
-          of the Unicode Data base or CLDR's data.
+        WebInspector: Timeline improvements - next iteration.
 
-2009-10-19  Evan Stade  <estade@chromium.org>
+        The top level records should be collapsed.
+        Virtually linked events should be nested in Timeline like Send Request and
+        corresponding Received Responce, Timer Install and Timer Fire etc.
+        It should be possible to see Main Resource request.
 
-        Reviewed by Darin Adler.
+        https://bugs.webkit.org/show_bug.cgi?id=36122
 
-        Clarify usage of SuddenTermination API. No code change.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didReceiveResponse):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        * inspector/InspectorTimelineAgent.h:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._findParentRecord):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.resize):
+        (WebInspector.TimelinePanel.prototype._createTopLevelRecord):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._clean):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._addToRecordsWindow):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype.get children):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        * inspector/front-end/inspector.css:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveResponse):
 
-        * platform/SuddenTermination.h:
+2010-03-17  Alexander Pavlov  <apavlov@chromium.org>
 
-2009-10-19  Oliver Hunt  <oliver@apple.com>
+        Reviewed by Pavel Feldman.
 
-        Reviewed by Gavin Barraclough.
+        Web Inspector: Reimplement style-related audits using native API
+        https://bugs.webkit.org/show_bug.cgi?id=36172
 
-        REGRESSION: Dromaeo DOM test is 14% slower
-        https://bugs.webkit.org/show_bug.cgi?id=30273
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getAllStyles):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getAllStyles):
+        (WebCore::InspectorDOMAgent::getMatchedCSSRules):
+        (WebCore::InspectorDOMAgent::buildObjectForStyleSheet):
+        (WebCore::InspectorDOMAgent::buildObjectForRule):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetAllStyles):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.evaluateInTargetWindow):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback.selectorsCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback.routine):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun):
+        * inspector/front-end/DOMAgent.js:
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
 
-        Make DOM bindings automatically inherit correct structure
-        flags rather than being needlessly conservative.  This is
-        done by making the bindings generator use the same model
-        for TypeInfo flags that we now use in JSC.
+2010-03-17  Steve Block  <steveblock@google.com>
 
-        This gains us about 1% of this regression back.
+        Reviewed by Jeremy Orlow.
 
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::createStructure):
-        (WebCore::DOMConstructorObject::createStructure):
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructure):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::createStructure):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructure):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/objc/objc_runtime.h:
-        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
-        * bridge/runtime_array.h:
-        (JSC::RuntimeArray::createStructure):
-        * bridge/runtime_method.h:
-        (JSC::RuntimeMethod::createStructure):
-        * bridge/runtime_object.h:
-        (JSC::RuntimeObjectImp::createStructure):
+        Replace instances of bzero in WebCore/bridge common code with memset
+        https://bugs.webkit.org/show_bug.cgi?id=36214
 
-2009-10-19  Robin Qiu  <robin.qiu@torchmobile.com.cn>
+        Syntax change only, no new tests.
 
-        Reviewed by Nikolas Zimmermann.
+        * bridge/jni/JNIUtility.cpp:
+        (JSC::Bindings::getJNIField):
+        * bridge/jni/jsc/JNIBridgeJSC.cpp:
+        (JavaField::dispatchValueFromInstance):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/v8/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertNPVariantToJValue):
+        * bridge/jni/v8/JavaNPObjectV8.cpp:
+        (JSC::Bindings::AllocJavaNPObject):
 
-        Fixed a bug on nested SVG <use> elements.
-        https://bugs.webkit.org/show_bug.cgi?id=26117
-        When a <use> element refer to another <use> element which has
-        child/children, the instance tree built for this <use> element
-        is incorrect (more nodes than expected).
+2010-03-17  Yury Semikhatsky  <yurys@chromium.org>
 
-        Test: svg/dom/use-on-use-with-child.svg
+        Reviewed by Pavel Feldman.
 
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::buildInstanceTree):
+        Mark inspector resources as changed so that they are reloaded on the next frontend connection.
+        
+        Split resetScriptObjects into code specific for page navigation and insepctor frontend disconnection.
 
-2009-10-19  Oliver Hunt  <oliver@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=36183
 
-        Small changes to fully invalidate and update the JavaScriptCallFrame.
+        * WebCore.xcodeproj/project.pbxproj: Added InspectorWorkerResource.h to the project file.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::disconnectFrontend):
+        (WebCore::InspectorController::unbindAllResources):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::releaseScriptObject):
 
-        <rdar://problem/7020755> JSDebugger crashes after reloading from a breakpoint
-        https://bugs.webkit.org/show_bug.cgi?id=27146
+2010-03-17  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        * inspector/JavaScriptCallFrame.h:
-        (WebCore::JavaScriptCallFrame::invalidate):
-        (WebCore::JavaScriptCallFrame::update):
-
-2009-10-19  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dmitri Titov.
+        Web Inspector: Capture main resource load events in timeline panel.
 
-        Remove "source" from storage events
-        https://bugs.webkit.org/show_bug.cgi?id=30536
+        https://bugs.webkit.org/show_bug.cgi?id=36188
 
-        Remove "source" from storage events per
-        http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
-
-        This was removed because it makes it introduces synchronous access that can
-        cross the event loop boundry (since a storage event can fire from one process
-        and be handled in another).
-
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * storage/StorageEvent.cpp:
-        (WebCore::StorageEvent::create):
-        (WebCore::StorageEvent::StorageEvent):
-        (WebCore::StorageEvent::initStorageEvent):
-        * storage/StorageEvent.h:
-        (WebCore::StorageEvent::uri):
-        * storage/StorageEvent.idl:
-        * storage/StorageEventDispatcher.cpp:
-        (WebCore::StorageEventDispatcher::dispatch):
-
-2009-10-19  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Remove ResourceLoadNotifier::activeDocumentLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30533
-
-        Removing this method from ResourceLoadNotifier better decouples the
-        notifier from FrameLoader.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
-        (WebCore::FrameLoader::requestFromDelegate):
-        * loader/ResourceLoadNotifier.cpp:
-        (WebCore::ResourceLoadNotifier::didReceiveResponse):
-        * loader/ResourceLoadNotifier.h:
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::willSendRequest):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+        (WebInspector.TimelinePanel.prototype.timelineWasStopped):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._clearPanel):
+        (WebInspector.TimelinePanel.FormattedRecord):
 
-2009-10-19  Adam Barth  <abarth@webkit.org>
+2010-03-17  Zoltan Horvath  <zoltan@webkit.org>
 
         Reviewed by Eric Seidel.
 
-        Move sendRemainingDelegateMessages to ResourceLoadNotifier
-        https://bugs.webkit.org/show_bug.cgi?id=30531
+        Allow custom memory allocation control for AtomicString class
+        https://bugs.webkit.org/show_bug.cgi?id=35907
 
-        This method is about notifying folks and doesn't interact with the rest
-        of FrameLoader.
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new':
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::willLoadMediaElementURL):
-        (WebCore::FrameLoader::commitProvisionalLoad):
-        (WebCore::FrameLoader::loadResourceSynchronously):
-        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
-        * loader/FrameLoader.h:
-        * loader/ResourceLoadNotifier.cpp:
-        (WebCore::ResourceLoadNotifier::sendRemainingDelegateMessages):
-        * loader/ResourceLoadNotifier.h:
+        class name   - instantiated at: WebCore/'location'
+        AtomicString - WebCore/html/HTMLTableElement.cpp:525
 
-2009-10-19  Adam Barth  <abarth@webkit.org>
+        * platform/text/AtomicString.h:
 
-        Reviewed by Eric Seidel.
+2010-03-16  John Abd-El-Malek  <jam@chromium.org>
 
-        Bypass popup blocker using click event
-        https://bugs.webkit.org/show_bug.cgi?id=21501
+        Reviewed by Darin Fisher.
 
-        Keep track of which events were generated by JavaScript and use that
-        inforation when figuring out if we're processing a user gesture.
+        Give keyboard focus to PluginDocuments by default
+        https://bugs.webkit.org/show_bug.cgi?id=36147
 
-        Test: http/tests/security/popup-blocked-from-fake-event.html
+        Test: http/tests/plugins/plugin-document-has-focus.html
 
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::processingUserGestureEvent):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::processingUserGesture):
-        * dom/Document.cpp:
-        (WebCore::Document::createEvent):
-        * dom/Event.cpp:
-        (WebCore::Event::Event):
-        * dom/Event.h:
-        (WebCore::Event::createdByDOM):
-        (WebCore::Event::setCreatedByDOM):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginDocument::pluginNode):
+        * loader/PluginDocument.h:
+        * page/EventHandler.cpp:
+        (WebCore::eventTargetNodeForDocument):
 
-2009-10-19  Dumitru Daniliuc  <dumi@chromium.org>
+2010-03-16  Chris Fleizach  <cfleizach@apple.com>
 
         Reviewed by Darin Adler.
 
-        Fixing a typo.
+        REGRESSION (r53857): Crash when tabbing to <map>
+        https://bugs.webkit.org/show_bug.cgi?id=36017
 
-        https://bugs.webkit.org/show_bug.cgi?id=30543
+        Test: fast/events/imagemap-norender-crash.html
 
-        * platform/sql/SQLiteDatabase.h:
+        * html/HTMLMapElement.cpp:
+        (WebCore::HTMLMapElement::imageElement):
 
-2009-10-19  Dmitry Titov  <dimich@chromium.org>
+2010-03-16  Brent Fulgham  <bfulgham@webkit.org>
 
-        Reviewed by Darin Adler.
+        Build fix.  No Review.
 
-        Manual Test for crash caused by JS accessing DOMWindow which is disconnected from the Frame.
-        https://bugs.webkit.org/show_bug.cgi?id=30544
+        Correct missing includes in cURL network backend introduced
+        by recent changes in WebKit.
 
-        * manual-tests/crash-on-accessing-domwindow-without-frame.html: Added.
+        * platform/network/curl/ResourceHandleCurl.cpp: Add missing
+          includes for SharedBuffer and PassRefPtr.
+        (WebCore::ResourceHandle::loadResourceSynchronously): Correct
+          constructor signature for ResourceHandle to match @r55688.
+        * platform/network/curl/ResourceHandleManager.cpp: Add missing
+          include for RetainPtr.
 
-2009-10-19  Simon Fraser  <simon.fraser@apple.com>
+2010-03-16  Zhenyao Mo  <zmo@google.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Darin Fisher.
 
-        Flash at end of opacity/transform transition sometimes
-        https://bugs.webkit.org/show_bug.cgi?id=30501
-        
-        When a transition finishes, there window of time between when the animation is
-        removed, and the final style set on the GraphicsLayer. This caused the layer to revert
-        to its old appearance for one or two frames. To avoid this, we set the final
-        transform or opacity at the start of the transition; we know that the animation
-        will override the final value for as long as its running.
-        
-        No test because this is a very transient effect that can't be captured
-        in a test.
+        Hook up WebGLContextAttributes to OpenGL context creation code
+        https://bugs.webkit.org/show_bug.cgi?id=33416
 
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::createGraphicsLayer):
-        (WebCore::RenderLayerBacking::updateLayerOpacity):
-        (WebCore::RenderLayerBacking::updateLayerTransform):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::startTransition):
-        * rendering/RenderLayerBacking.h:
+        Test: fast/canvas/webgl/context-attributes-alpha-depth-stencil-antialias.html
 
-2009-10-19  Pavel Feldman  <pfeldman@chromium.org>
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp: Fix an index bug.
+        * platform/graphics/GraphicsContext3D.h: Add members/functions for multisampling/stencil buffer purpose.
+        * platform/graphics/mac/Canvas3DLayer.h: Add GraphicsContext3D as a member of Canvas3DLayer.
+        * platform/graphics/mac/Canvas3DLayer.mm: Add multisampling support.
+        * platform/graphics/mac/GraphicsContext3DMac.cpp: Hook up WebGLContextAttributes to OpenGL context creation code for Mac.
+        * platform/graphics/mac/GraphicsLayerCA.mm: Adjust to modified Canvas3DLayer init call.
 
-        Reviewed by Timothy Hatcher.
+2010-03-16  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
 
-        Web Inspector: Add more stop characters into console completions.
+        Reviewed by Xan Lopez.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30477
+        https://bugs.webkit.org/show_bug.cgi?id=35504
+        [Gtk] Evaluate and fix AtkTable for layout tables
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions):
-        (WebInspector.ConsoleView.prototype._reportCompletions):
+        Causes "layout tables" to be exposed as AccessibilityTables for Gtk.
 
-2009-10-19  Marshall Culpepper  <mculpepper@appcelerator.com>
+        * accessibility/AccessibilityTable.cpp:
+        (AccessibilityTable::isTableExposableThroughAccessibility):
 
-        Reviewed by Adam Roben.
+2010-03-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        implemented ClipboardWin::files()
-        https://bugs.webkit.org/show_bug.cgi?id=29666
+        Unreviewed. Build fix for distcheck.
 
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::ClipboardWin::files):
+        * GNUmakefile.am:
 
-2009-10-19  Nate Chapin  <japhet@chromium.org>
+2010-03-15  Darin Fisher  <darin@chromium.org>
 
-        Reviewed by Alexey Proskuryakov.
+        Reviewed by Adam Barth.
 
-        Add support for link relations in HTMLAnchorElement and implement rel="noreferrer".
+        https://bugs.webkit.org/show_bug.cgi?id=36152
+        [chromium] Add support for history.pushState and history.replaceState
 
-        https://bugs.webkit.org/show_bug.cgi?id=28986
+        This is covered by the existing tests in fast/loader/stateobjects
 
-        Tests: http/tests/navigation/no-referrer-reset.html
-               http/tests/navigation/no-referrer-same-window.html
-               http/tests/navigation/no-referrer-subframe.html
-               http/tests/navigation/no-referrer-target-blank.html
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::ZigZag::Deserializer::deserialize):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/v8/SerializedScriptValue.h:
+        Switch to returning v8::Null instead of the empty value to match JSC
+        and the spec.
 
-        * WebCore.base.exp: Update FrameLoader::loadFrameRequest export symbol
-        * html/HTMLAnchorElement.cpp: Add support for link relations and implement noreferrer
-        (WebCore::HTMLAnchorElement::HTMLAnchorElement):
-        (WebCore::HTMLAnchorElement::defaultEventHandler):
-        (WebCore::HTMLAnchorElement::parseMappedAttribute):
-        (WebCore::HTMLAnchorElement::hasRel):
-        (WebCore::HTMLAnchorElement::setRel):
-        * html/HTMLAnchorElement.h: Add support for link relations and implement noreferrer
         * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::createWindow):
-        (WebCore::FrameLoader::changeLocation):
-        (WebCore::FrameLoader::urlSelected): Add parameter for referrer policy
-        (WebCore::FrameLoader::loadFrameRequest): Add parameter for referrer policy
-        (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy): Suppress opener if requested by ReferrerPolicy
-        * loader/FrameLoader.h: Update urlSelected and loadFrameRequest prototypes
-        * loader/FrameLoaderTypes.h: Add enum for referrer policy
-        * loader/RedirectScheduler.cpp:
-        (WebCore::RedirectScheduler::timerFired):
-        * page/ContextMenuController.cpp:
-        (WebCore::ContextMenuController::contextMenuItemSelected): Update call to urlSelected()
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::defaultEventHandler): Update call to urlSelected()
-
-
-2009-10-19  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by Dimitri Glazkov (dglazkov@chromium.org).
-
-        [v8] typeof(HTMLMediaElement) should return undefined if media
-        engine is not available
-        https://bugs.webkit.org/show_bug.cgi?id=30343
-
-        Check for availability of the media engine to disable
-        HTMLMediaElement, HTMLAudioElement, HTMLVideoElement, MediaError
-        in runtime.
-
-        Try runs and review in Chromium:
-        http://codereview.chromium.org/276011
-
-        Test: manual-tests/chromium/media-player-not-available.html
-
-        The above test can work work in Chromium. Testing procedures:
-        1. Remove all media support libraries in Chromium (e.g. ffmpeg libraries)
-        2. Open Chromium with above test page
-        3. Verify the test results according to the test page
-
-        * bindings/v8/custom/V8CustomBinding.h:
-        Declare enabler methods.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        Report enabled only if media player is available.
-        * manual-tests/chromium/media-player-not-available.html: Added.
-        Manual test, following instruction in this test for procedures.
-        * page/DOMWindow.idl:
-        Mark HTMLMediaElement, HTMLAudioElement, HTMLVideElement, MediaError
-        as enabled at runtime.
+        (WebCore::FrameLoader::loadInSameDocument): Call
+        dispatchDidNavigateWithinPage just before dispatching events to the
+        page.  This ordering is important since the event handlers could
+        destroy the page or start another navigation.
 
-2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        * loader/FrameLoaderClient.h: Add dispatchDidNavigateWithinPage to
+        notify the client whenever a navigation occurs without changing any of
+        the documents in the page.
 
-        Reviewed by David Hyatt.
+2010-03-16  Adam Roben  <aroben@apple.com>
 
-        Refactor out some of the code in paint() into paintPanScrollIcon()
-        and paintScrollbars() in preparation of some Qt API changes.
+        Fix linker warnings when building WebCore on Windows
 
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::paint):
-        * platform/ScrollView.h:
+        Rubber-stamped by Steve Falkenburg.
 
-2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        * WebCore.vcproj/WebCore.vcproj: Exclude JSDOMFormData.cpp from the
+        build, since it's already included in DerivedSources.cpp. Also let VS
+        sort this file as it saw fit.
 
-        Reviewed by Adam Roben.
+2010-03-15  Antti Koivisto  <koivisto@iki.fi>
 
-        Make the local static panScrollIcon into a Image* instead
-        of a RefPtr<Image>.
+        Reviewed by Simon Hausmann.
 
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::wheelEvent):
+        https://bugs.webkit.org/show_bug.cgi?id=36121
+        [Qt] Make WebKit scrollbars work with tiling
+         
+        Translate coordinates correctly.
 
-2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+        * page/Frame.cpp:
+        (WebCore::Frame::tiledBackingStorePaintEnd):
 
-        Reviewed by David Levin.
+2010-03-16  Jakub Wieczorek  <jwieczorek@webkit.org>
 
-        Forcefully set antialiasing for Chromium media controls.
+        Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30521
+        [Qt] MediaPlayerPrivate: Initialize m_mediaPlayerControl to 0 to avoid crashes
+        when no media services can be found.
 
-        Before it was nondeterministiacally being enabled based on the previous state of GraphicsContext.
+        https://bugs.webkit.org/show_bug.cgi?id=36142
 
-        Covered by existing layout tests.
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
 
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::paintMediaSlider): Added setShouldAntialias(true).
+2010-03-16  Adam Barth  <abarth@webkit.org>
 
-2009-10-19  Jens Alfke  <jens@mooseyard.com>
+        Unreviewed.
 
-        Reviewed by Darin Adler.
+        noscript tag should render when @sandbox disables JavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=36092
 
-        Optimize string upper/lowercasing
-        https://bugs.webkit.org/show_bug.cgi?id=30261
-        
-        - Added AtomicString::upper() and lower()
-        - Further optimized StringImpl::lower()
-        - Removed StringImpl::isLower()
-        - Added QualifiedName::localNameUpper(), which is cached, thereby saving
-          thousands of upper() calls and string allocations.
- 
-         * dom/Element.cpp:
-         (WebCore::Element::setAttribute): Call AtomicString::lower()
-         * dom/QualifiedName.cpp:
-         (WebCore::QualifiedName::localNameUpper): New method
-         * dom/QualifiedName.h: Added localNameUpper() method
-         * dom/StyledElement.cpp:
-         (WebCore::StyledElement::parseMappedAttribute):  Call AtomicString::lower()
-         * html/HTMLDocument.cpp:
-         (WebCore::HTMLDocument::createElement): Call AtomicString::lower()
-         * html/HTMLElement.cpp:
-         (WebCore::HTMLElement::nodeName): Call localNameUpper()
-         * platform/text/AtomicString.cpp:
-         (WebCore::AtomicString::lower): New method
-         (WebCore::AtomicString::upper): New method
-         * platform/text/AtomicString.h: Added lower() and upper()
-         * platform/text/StringImpl.cpp: Removed isLower()
-         (WebCore::StringImpl::lower): Further optimization of initial loop
-         * platform/text/StringImpl.h: Removed isLower()
- 
-2009-10-19  Nate Chapin  <japhet@chromium.org>
+        Add missing "!" in plugin code.  Should fix plugins/embed-inside-object
+        on Gtk and Qt.
 
-        Reviewed by Adam Barth.
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load):
 
-        If a call to a plugin's invokeMethod, invokeDefault or construct
-        returns false, throw an exception into JS.        
+2010-03-16  Nate Chapin  <japhet@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30239
+        Reviewed by Dimitri Glazkov.
 
-        Test: plugins/netscape-invoke-failure.html
+        [V8] Delete DerivedSourcesAllInOne.cpp.
 
-        * bindings/v8/V8NPObject.cpp: Check return values of invokeMethod, invokeDefault and construct.
-        (npObjectInvokeImpl):
-        * bridge/c/c_instance.cpp:
-        (JSC::Bindings::CInstance::invokeMethod): Check return value
-        (JSC::Bindings::CInstance::invokeDefaultMethod): Check return value
-        (JSC::Bindings::CInstance::invokeConstruct): Check return value
+        https://bugs.webkit.org/show_bug.cgi?id=33048
 
-2009-10-16  Stephen White  <senorblanco@chromium.org>
+        * Android.v8bindings.mk:
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Removed.
 
-        Reviewed by Adam Barth.
+2010-03-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Fix for chromium/skia canvas arc start/end positions, when the arc is
-        >= 360 degrees.
-        https://bugs.webkit.org/show_bug.cgi?id=30449
+        Revert r56006 as it caused functional issues. We will work on a
+        testcase, and rework the fix, and land when we have this a bit
+        more testable.
 
-        Covered by new test:
-        LayoutTests/fast/canvas/arc360.html
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::paintMediaPlayButton):
 
-        * platform/graphics/skia/PathSkia.cpp:
-        (WebCore::Path::addArc):
+2010-03-16  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-10-19  Kent Tamura  <tkent@chromium.org>
+        Reviewed by Timothy Hatcher.
 
-        Reviewed by Alexey Proskuryakov.
+        Web Inspector: Errors when inspecting styles of non-renderable elements in XHTML.
 
-        Fix uninitialized variable reference in Element::removeAttribute().
-        https://bugs.webkit.org/show_bug.cgi?id=30502
+        https://bugs.webkit.org/show_bug.cgi?id=35025
 
-        * dom/Element.cpp:
-        (WebCore::Element::removeAttribute):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getStyles):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._addAttribute):
+        (WebInspector.DOMWindow.prototype.Object):
+        * inspector/front-end/MetricsSidebarPane.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update.callback):
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylesSidebarPane.prototype._update):
 
-2009-10-19  Eric Carlson  <eric.carlson@apple.com>
+2010-03-12  Antonio Gomes  <tonikitoo@webkit.org>
 
         Reviewed by Simon Fraser.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30463
-        Remove HTML5 media element 'loadend' event
+        Spatial Navigation: Add a scrollIntoView call when focusing an element.
+        https://bugs.webkit.org/show_bug.cgi?id=36020
 
-        * dom/EventNames.h:
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseMappedAttribute): Remove 'loadend'.
-        (WebCore::HTMLMediaElement::loadInternal): Ditto.
-        (WebCore::HTMLMediaElement::noneSupported): Ditto.
-        (WebCore::HTMLMediaElement::mediaEngineError): Ditto.
-        (WebCore::HTMLMediaElement::setNetworkState): Ditto.
-        (WebCore::HTMLMediaElement::userCancelledLoad): Ditto.
-
-2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Adam Barth.
+        When focusing an element in Spatial Navigation logic, it is desired to make
+        this element visible in the current viewport. For that to happen, there
+        could be a call to Element's scrollIntoView method at focusing time. However
+        for visual aspects, it is preferable to scroll to an inflated rect of |element|
+        in order to consider the focus outline width.
+        As Element's scrollIntoView method does not provide this flexibility, patch adds
+        a custom scrollIntoView method to SpatialNavigation.h .
 
-        [Qt] Remove deletion of outgoing FormData object when reply is finished.
-        The buffers will be destroyed a bit later, when the QNetworkReply is deleted.
-        Bug: https://bugs.webkit.org/show_bug.cgi?id=29551
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        * platform/network/qt/QNetworkReplyHandler.h:
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocusDirectionally):
+        * page/SpatialNavigation.cpp:
+        (WebCore::scrollIntoView):
+        * page/SpatialNavigation.h:
 
-2009-10-19  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Reviewed by Darin Adler.
+        Reviewed by Eric Seidel.
 
-        Fix hard-to-reproduce crash in HTMLTokenizer by avoiding a rare
-        fastRealloc edge case.
-        https://bugs.webkit.org/show_bug.cgi?id=29313
+        [GTK] Position queries are lagging
+        https://bugs.webkit.org/show_bug.cgi?id=34372
 
-        No test, the crash shows up occasionally in crash dumps, we weren't able
-        to reproduce it locally.
+        Normalize timeout priorities through the GStreamer media player as
+        a whole. This should help avoid that any of them is starved.
 
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::enlargeScriptBuffer): Added an early exit to
-            avoid calling fastRealloc with the size of 0.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::processBufferingStats):
+        (WebCore::MediaPlayerPrivate::muteChanged):
+        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_render):
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (webKitWebSrcNeedDataCb):
+        (webKitWebSrcEnoughDataCb):
+        (webKitWebSrcSeekDataCb):
 
-2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+2010-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
         Reviewed by Eric Seidel.
 
-        Use fillRect() instead of drawRect() to fix Chromium media controls rendering.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30371
+        [GTK] Position queries are lagging
+        https://bugs.webkit.org/show_bug.cgi?id=34372
 
-        Chromium Mac layout tests will need to be rebaselined.  Existing layout tests for Linux/Win still pass.
+        Use default priority also for parsing data: URIs.
 
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::paintMediaSlider): Use fillRect() instead of drawRect().
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startData):
 
-2009-10-19  Dmitry Titov  <dimich@chromium.org>
+2010-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Reviewed by Adam Barth.
+        Reviewed by Eric Seidel.
 
-        Crash in DOMWindow::clearTimeout etc when DOMWindow is not connected to a frame.
-        https://bugs.webkit.org/show_bug.cgi?id=29832
+        [GTK] Position queries are lagging
+        https://bugs.webkit.org/show_bug.cgi?id=34372
 
-        Need to make sure the script caches are reset when frame gets disconnected from still-alive DOMWindow.
-        This will prevent JS from calling DOMWindow methods that can not be completed w/o the frame.
+        Normalize SharedTimers priorities to always be
+        G_PRIORITY_DEFAULT. As it is currently, timers that should happen
+        immediately (0 miliseconds delay) end up delayed by a lot of time
+        due to glib starving lower priority sources.
 
-        I am not sure it's possible to test this since the only file that repros the problem need ~10 seconds to cause crash.
+        * platform/gtk/SharedTimerGtk.cpp:
+        (WebCore::setSharedTimerFireTime):
 
-        * page/Frame.cpp:
-        (WebCore::Frame::~Frame): Right after frame disconnects from DOMWindow, clear WindowShell.
+2010-03-16  Xan Lopez  <xlopez@igalia.com>
 
-2009-10-19  Csaba Osztrogonác  <ossy@webkit.org>
+        Reviewed by Gustavo Noronha.
 
-        Unreviewed build warning fix.
-        [Qt] Apply changes to WebCore.pro introduced in r49778
+        Add support for Fast Mobile Scrolling in the build system.
 
-        * WebCore.pro: Removed svg/graphics/filters/SVGFEGaussianBlur.h from HEADERS
+        * GNUmakefile.am:
 
-2009-10-19  Dirk Schulze  <krit@webkit.org>
+2010-03-11  Yury Semikhatsky <yurys@chromium.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Pavel Feldman.
 
-        Move feGaussianBlur from WebCore/svg to WebCore/platform
-        [https://bugs.webkit.org/show_bug.cgi?id=30495]
+        Introduce InspectorFrontendClient that provides InspectorFrontend with an interface to the embedder. InspectorClient now serves as a delegate for InspectorController and does not contain methods for managing inspector frontend window. That allows to create remote InspectorFrontendHost.
 
-        This patch moves SVGFRGaussianBlur from svg/graphics/filters
-        to platform/graphics/filters/FEGaussianBlur. This is needed
-        for shadow support on Qt and Cairo.
-        No change in functionality, therfore no new test case needed.
+        Introduce InspectorFrontendClient that would provide InspectorFrontend with an interface to the embedder
+        https://bugs.webkit.org/show_bug.cgi?id=35036
 
         * GNUmakefile.am:
+        * WebCore.Inspector.exp:
+        * WebCore.base.exp:
         * WebCore.gypi:
+        * WebCore.order:
         * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/filters/FEGaussianBlur.cpp: Added.
-        * platform/graphics/filters/FEGaussianBlur.h: Added.
-        * svg/SVGFEGaussianBlurElement.h:
-        * svg/graphics/filters/SVGFEGaussianBlur.cpp: Removed.
-        * svg/graphics/filters/SVGFEGaussianBlur.h: Removed.
-
-2009-10-19  Yael Aharon  <yael.aharon@nokia.com>
-
-        Unreviewed.
-
-        Added reviewer name to r49574.
-
-2009-10-19  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30489
-        [Gtk] The document frame/html container claims to be parentless
-
-        Work around for the parentless claim made by the accessible associated
-        with the embedded WebView. When we identify this condition, get the
-        widget's parent, and then get the AtkObject from that. Admittedly an ugly
-        hack, but we'll need it for Yelp and other Gtk+/GNOME applications which
-        plan to switch over to WebKit.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_parent):
-
-2009-10-19  Benjamin Otte  <otte@gnome.org>
-
-        Reviewed by Jan Alonzo.
-
-        Handle duration queries properly
-        https://bugs.webkit.org/show_bug.cgi?id=29999
-
-        Previously duration queries failed to handle unknown duration
-        and didn't treat the returned duration as an unsigned.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::duration):
-
-2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Fix build on Windows.
-
-        * plugins/win/PluginViewWin.cpp:
-        (windowHandleForPageClient):
-
-2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Holger Freyther.
-
-        [Qt] Windowed Plugins: Don't crash when client is 0.
-        
-        Client is 0 when we use QWebPage without a QWebView or QGraphicsWebView.
-        In addition, setFrameRect()/updatePluginWidget() is called even if the
-        plugin was not succesfully loaded. updatePluginWidget() updates the
-        window rect which is, in theory, useful to draw something that indicates
-        that we didn't load successfully.
-        
-        So, a status check is added to setNPWindowIfNeeded.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30380
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::platformStart):
-
-2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Holger Freyther.
-
-        [Qt] Windowed Plugins: Fix crash when QWebPage is deleted after QWebView.
-        
-        Fixes various sources of crashes:
-        1. The PluginContainer is a child of QWebView. When the view gets deleted,
-        the PluginView is not notified about the deletion of PluginContainer.
-        2. QWebView destructor does not set client to 0.
-        3. Sometimes pending paint events are sent after the plugin has died, so add
-        a check in PluginView::setNPWindowIfNeeded.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30354
-
-        * plugins/qt/PluginContainerQt.cpp:
-        (PluginContainerQt::~PluginContainerQt):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
-
-2009-10-19  Jakob Truelsen  <antialize@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29042
-        Allow one to customize the minimal and maximal shrink factors used when printing.
-
-        * page/PrintContext.cpp:
-        (WebCore::PrintContext::begin):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setPrintingMinimumShrinkFactor):
-        (WebCore::Settings::setPrintingMaximumShrinkFactor):
-        * page/Settings.h:
-        (WebCore::Settings::printingMinimumShrinkFactor):
-        (WebCore::Settings::printingMaximumShrinkFactor):
-
-2009-10-18  Erik Arvidsson  <arv@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Fixes issue where doubleclicking a word could select following adjacent newlines.
-        https://bugs.webkit.org/show_bug.cgi?id=30234
-
-        Tests: platform/mac/editing/selection/doubleclick-should-not-expand-across-lines.html
-               platform/mac/editing/selection/script-tests/TEMPLATE.html
-               platform/win/editing/selection/doubleclick-should-not-expand-across-lines.html
-               platform/win/editing/selection/script-tests/TEMPLATE.html
-
-        * editing/VisibleSelection.cpp:
-        (WebCore::VisibleSelection::appendTrailingWhitespace):
-
-2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
-
-        CURL build fix, use proper header name.
-
-        * platform/network/curl/ResourceHandleManager.h:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorClient.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::windowVisible):
+        (WebCore::InspectorController::frontendReady):
+        (WebCore::InspectorController::willCloseFrontend):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::setInspectorFrontendClient):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::setFrontend):
+        (WebCore::InspectorController::show):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::releaseDOMAgent):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::enableDebugger):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::hasInspectorFrontendClient):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::InspectorFrontend):
+        (WebCore::InspectorFrontend::~InspectorFrontend):
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::bringToFront):
+        (WebCore::InspectorFrontend::inspectedURLChanged):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorFrontendClient.h: Added.
+        (WebCore::InspectorFrontendClient::~InspectorFrontendClient):
+        * inspector/InspectorFrontendClientLocal.cpp: Added.
+        (WebCore::FrontendMenuProvider::create):
+        (WebCore::FrontendMenuProvider::disconnect):
+        (WebCore::FrontendMenuProvider::FrontendMenuProvider):
+        (WebCore::FrontendMenuProvider::~FrontendMenuProvider):
+        (WebCore::FrontendMenuProvider::populateContextMenu):
+        (WebCore::FrontendMenuProvider::contextMenuItemSelected):
+        (WebCore::FrontendMenuProvider::contextMenuCleared):
+        (WebCore::InspectorFrontendClientLocal::InspectorFrontendClientLocal):
+        (WebCore::InspectorFrontendClientLocal::~InspectorFrontendClientLocal):
+        (WebCore::InspectorFrontendClientLocal::windowObjectCleared):
+        (WebCore::InspectorFrontendClientLocal::frontendLoaded):
+        (WebCore::InspectorFrontendClientLocal::canAttachWindow):
+        (WebCore::InspectorFrontendClientLocal::changeAttachedWindowHeight):
+        (WebCore::InspectorFrontendClientLocal::moveWindowBy):
+        (WebCore::InspectorFrontendClientLocal::showContextMenu):
+        (WebCore::InspectorFrontendClientLocal::setAttachedWindow):
+        (WebCore::InspectorFrontendClientLocal::restoreAttachedWindowHeight):
+        (WebCore::InspectorFrontendClientLocal::constrainedAttachedWindowHeight):
+        * inspector/InspectorFrontendClientLocal.h: Added.
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::loaded):
+        (WebCore::InspectorFrontendHost::attach):
+        (WebCore::InspectorFrontendHost::detach):
+        (WebCore::InspectorFrontendHost::closeWindow):
+        (WebCore::InspectorFrontendHost::bringToFront):
+        (WebCore::InspectorFrontendHost::inspectedURLChanged):
+        (WebCore::InspectorFrontendHost::canAttachWindow):
+        (WebCore::InspectorFrontendHost::setAttachedWindowHeight):
+        (WebCore::InspectorFrontendHost::moveWindowBy):
+        (WebCore::InspectorFrontendHost::showContextMenu):
+        * inspector/InspectorFrontendHost.h:
+        (WebCore::InspectorFrontendHost::create):
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub.prototype.bringToFront):
+        (.WebInspector.InspectorFrontendHostStub.prototype.inspectedURLChanged):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.close):
+        (WebInspector.bringToFront):
+        (WebInspector.inspectedURLChanged):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyInspectorClient::openInspectorFrontend):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::~Page):
+        * page/Page.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        (WebCore::ContextMenu::addInspectElementItem):
 
-2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-16  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: Properties on Arrays and NodeLists are not logged correctly.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30485
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._formatarray):
-        (WebInspector.ConsoleView.prototype._printArray):
-
-2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
-
-        Not reviewed: touching WebCore so that it
-        initiated inspector frontend deployment on Windows.
+        Web Inspector: migrate to native styles inspector in
+        order to inspect styles from foreighn domains.
 
-        Web Inspector: frontend files are not deployed in Windows
-        incremental build.
+        https://bugs.webkit.org/show_bug.cgi?id=36117
 
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getStyles):
+        (WebCore::InspectorBackend::getInlineStyle):
+        (WebCore::InspectorBackend::getComputedStyle):
+        (WebCore::InspectorBackend::applyStyleText):
+        (WebCore::InspectorBackend::setStyleText):
+        (WebCore::InspectorBackend::setStyleProperty):
+        (WebCore::InspectorBackend::toggleStyleEnabled):
+        (WebCore::InspectorBackend::setRuleSelector):
+        (WebCore::InspectorBackend::addRule):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
         * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::unbind):
-
-2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Title of dir(["test", "test2"]) should be Array
-
-        https://bugs.webkit.org/show_bug.cgi?id=30486
-
-        Test: inspector/console-tests.html
-
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::getStyles):
+        (WebCore::InspectorDOMAgent::getInlineStyle):
+        (WebCore::InspectorDOMAgent::getComputedStyle):
+        (WebCore::InspectorDOMAgent::getMatchedCSSRules):
+        (WebCore::InspectorDOMAgent::getAttributeStyles):
+        (WebCore::InspectorDOMAgent::applyStyleText):
+        (WebCore::InspectorDOMAgent::setStyleText):
+        (WebCore::InspectorDOMAgent::setStyleProperty):
+        (WebCore::InspectorDOMAgent::toggleStyleEnabled):
+        (WebCore::InspectorDOMAgent::setRuleSelector):
+        (WebCore::InspectorDOMAgent::addRule):
+        (WebCore::InspectorDOMAgent::bindStyle):
+        (WebCore::InspectorDOMAgent::bindRule):
+        (WebCore::InspectorDOMAgent::buildObjectForStyle):
+        (WebCore::InspectorDOMAgent::populateObjectWithStyleProperties):
+        (WebCore::InspectorDOMAgent::buildObjectForRule):
+        (WebCore::InspectorDOMAgent::uniqueStyleProperties):
+        (WebCore::InspectorDOMAgent::longhandProperties):
+        (WebCore::InspectorDOMAgent::shorthandPriority):
+        (WebCore::InspectorDOMAgent::ruleAffectsNode):
+        (WebCore::InspectorDOMAgent::toArray):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        (WebCore::InspectorFrontend::didGetStyles):
+        (WebCore::InspectorFrontend::didGetComputedStyle):
+        (WebCore::InspectorFrontend::didGetInlineStyle):
+        (WebCore::InspectorFrontend::didApplyStyleText):
+        (WebCore::InspectorFrontend::didSetStyleText):
+        (WebCore::InspectorFrontend::didSetStyleProperty):
+        (WebCore::InspectorFrontend::didToggleStyleEnabled):
+        (WebCore::InspectorFrontend::didSetRuleSelector):
+        (WebCore::InspectorFrontend::didAddRule):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.CSSStyleDeclaration):
+        * inspector/front-end/ElementsTreeOutline.js:
         * inspector/front-end/InjectedScript.js:
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted.callback):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.callback):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        (WebInspector.StylePropertyTreeElement.prototype.):
 
-2009-10-18  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Nikolas Zimmermann.
-
-        REGRESSION: SVG Mask doesn't work for maskContentUnits="objectBoundingBox"
-        [https://bugs.webkit.org/show_bug.cgi?id=30480]
-
-        Patch for SVGMaskElement landed in r49598 should correct the location of
-        the mask image graphics context. It only corrects the location for userSpaceOnUse
-        mode in maskContentUnits but breaks objectBoundingBoxMode.
-        The maskDestRect shouldn't be moved. It is not responsible for the correct context
-        postioin but for the correct position of the mask image.
-        This patch calculates the context postion independently from the maskDestRect.
-        It also uses lineareRGB color space for masking on CG now. This is the default
-        color space for masking operations.
-        We already have tests for both maskContentUnits modes.
-
-            *svg/W3C-SVG-1.1/masking-intro-01-f.svg
-            *svg/custom/mask-with-default-value.svg
-
-        Some tests needed new pixel tests because of the new color space.
-
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::drawMaskerContent):
-
-2009-10-18  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Use v8::Integer::NewFromUnsigned when converting unsigneds into V8's numbers.
-        That is notably faster for small numbers (most common case).
-        https://bugs.webkit.org/show_bug.cgi?id=30493
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-
-2009-10-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Holger Freyther.
-
-        [GTK] Add MathML to the build system
-        https://bugs.webkit.org/show_bug.cgi?id=30487
-
-        Add MathML sources if MathML support is enabled.
-
-        * GNUmakefile.am:
-
-2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Non-PCH build fix. Added missing header.
-
-        * bridge/runtime_root.h:
-
-2009-10-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Compositing layers not correctly updated after partial layout
-        https://bugs.webkit.org/show_bug.cgi?id=30425
-        
-        When a partial layout happened, for example as the result of a postion-change-only
-        layout, then some compositing layer positions were not correctly updated. To fix
-        this, updateLayerPositions() now carries along a flag that is set at the rootmost
-        layer being updated, and used to determine when we hit the first compositing layer
-        in this update. RenderLayerBacking::updateAfterLayout() makes use of this information
-        to do a full geometry update on that layer, which is thus the rootmost compositing
-        layer that is being updated.
-
-        Test: compositing/geometry/partial-layout-update.html
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPositions):
-        (WebCore::RenderLayer::scrollToOffset):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-        * rendering/RenderLayerBacking.h:
-
-2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        Add support for proxies in CURL.
- 
-        https://bugs.webkit.org/show_bug.cgi?id=30446
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::ResourceHandleManager::setProxyInfo):
-        (WebCore::ResourceHandleManager::initializeHandle):
-        * platform/network/curl/ResourceHandleManager.h:
-        (WebCore::ResourceHandleManager::):
-
-2009-10-18  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez
-
-        https://bugs.webkit.org/show_bug.cgi?id=25901
-        Use ATK_ROLE_SECTION for divTag and ATK_ROLE_LABEL for labelTag
+2010-03-16  Shinichiro Hamaji  <hamaji@chromium.org>
 
-        Replaces the use of ATK_ROLE_PANEL with the expected accessible roles.
+        Reviewed by Darin Adler.
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_role):
+        RenderText::m_text should be a String, not RefPtr<StringImpl>
+        https://bugs.webkit.org/show_bug.cgi?id=36010
 
-2009-10-17  Nikolas Zimmermann  <nzimmermann@rim.com>
+        Refactoring only, so no new tests.
 
-        Reviewed by George Staikos.
+        * platform/text/PlatformString.h:
+        (WebCore::String::makeLower):
+        (WebCore::String::makeUpper):
+        (WebCore::String::makeSecure):
+        (WebCore::String::makeCapitalized):
+        (WebCore::String::containsOnlyASCII):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+        (WebCore::RenderText::widthFromCache):
+        (WebCore::RenderText::trimmedPrefWidths):
+        (WebCore::RenderText::containsOnlyWhitespace):
+        (WebCore::RenderText::setTextInternal):
+        (WebCore::RenderText::setText):
+        (WebCore::RenderText::previousOffset):
+        (WebCore::RenderText::previousOffsetForBackwardDeletion):
+        (WebCore::RenderText::nextOffset):
+        * rendering/RenderText.h:
+        (WebCore::RenderText::text):
+        (WebCore::RenderText::characters):
+        (WebCore::RenderText::textLength):
+
+2010-03-16  Adam Barth  <abarth@webkit.org>
 
-        Cleanup SVGElement code, preparing for animVal support
-        https://bugs.webkit.org/show_bug.cgi?id=30466
+        Reviewed by Darin Adler.
 
-        Add new SynchronizablePropertyController and move the code for SVG property <-> XML attribute synchronization
-        from SVGElement. This is a further preparation for animVal support, where SynchronizablePropertyController will
-        be used to control the start/end state of an animated property.
+        noscript tag should render when @sandbox disables JavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=36092
 
-        We're currently tracking animated properties that need synchronization, generalize this concept and use
-        it to track their creation (bound to certain SVG*Element classes) as well as a flag determing the need
-        of synchronization (no SVG DOM object wrappers, no synchronization needed).
+        Instead of talking to Settings directly to figure out if JavaScript is
+        enabled in a frame, we need to talk to the ScriptController.  The
+        ScriptController is better at answering that question because it knows
+        about @sandbox.
 
-        No change in functionality, thus no tests.
+        Test: fast/frames/sandboxed-iframe-noscript.html
 
-        * GNUmakefile.am: Add 'SynchronizablePropertyController.cpp/h' to build
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * svg/SVGAllInOne.cpp: Ditto.
-        * svg/SVGAnimatedProperty.h: Add registerProperty() function 
-        (WebCore::::SVGAnimatedProperty): Call registerProperty() function  
-        (WebCore::::registerProperty): Add new registerProperty() function, announcing new properties to SynchronizablePropertyController.
-        * svg/SVGAnimatedTemplate.h: Use propertyController() method, to access the new functions moved from SVGElement.
-        (WebCore::lookupOrCreateWrapper):
-        * svg/SVGElement.cpp: Adapt to code moving to SynchronizablePropertyController.
-        (WebCore::SVGElement::updateAnimatedSVGAttribute):
-        * svg/SVGElement.h: Move handling SVG property synchronization to SynchronizablePropertyController.
-        (WebCore::SVGElement::propertyController): Expose reference to SynchronizablePropertyController object.
-        * svg/SVGViewSpec.cpp: Reorder initialization order of contextElement, leading to possible crashes.
-        (WebCore::SVGViewSpec::SVGViewSpec):
-        (WebCore::SVGViewSpec::viewTarget):
-        * svg/SVGViewSpec.h: Ditto.
-        (WebCore::SVGViewSpec::contextElement):
-        * svg/SynchronizablePropertyController.cpp: Added.
-        (WebCore::SynchronizablePropertyController::SynchronizablePropertyController):
-        (WebCore::SynchronizablePropertyController::registerProperty):
-        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
-        (WebCore::SynchronizablePropertyController::synchronizeProperty):
-        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
-        (WebCore::SynchronizablePropertyController::startAnimation):
-        (WebCore::SynchronizablePropertyController::stopAnimation):
-        * svg/SynchronizablePropertyController.h: Added.
-        (WebCore::SynchronizableProperty::SynchronizableProperty):
-        (WebCore::SynchronizableProperty::isHashTableDeletedValue):
-        (WebCore::SynchronizableProperty::operator==):
-        (WebCore::SynchronizablePropertyHash::hash):
-        (WebCore::SynchronizablePropertyHash::equal):
-        (WebCore::SynchronizablePropertyHashTraits::constructDeletedValue):
-        (WebCore::SynchronizablePropertyHashTraits::isDeletedValue):
-
-2009-10-17  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createRenderer):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::rendererIsNeeded):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::noscriptCreateErrorCheck):
+        (WebCore::HTMLParser::isInline):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load):
 
-        Reviewed by Xan Lopez.
+2010-03-15  John Gregg  <johnnyg@google.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=25413
-        [GTK] Please expose the level of headings
+        Reviewed by David Levin.
 
-        Exposes the heading level as an attribute of the AtkObject.
+        Notification object should expose absolute URL of icon
+        https://bugs.webkit.org/show_bug.cgi?id=35800
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (addAttributeToSet):
-        (webkit_accessible_get_attributes):
-        (webkit_accessible_class_init):
+        Covered by existing tests.
 
-2009-10-17  Kwang Yul Seo  <skyul@company100.net>
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        * notifications/Notification.h:
+        (WebCore::Notification::iconURL):
 
-        Reviewed by Eric Seidel.
+2010-03-15  Leandro Pereira  <leandro@profusion.mobi>
 
-        EventHandler::eventLoopHandleMouseDragged needs ENABLE(DRAG_SUPPORT) guards
-        https://bugs.webkit.org/show_bug.cgi?id=30472
+        Reviewed by Holger Freyther.
 
-        Put ENABLE(DRAG_SUPPORT) guards around EventHandler::eventLoopHandleMouseDragged
-        in EventHandler.cpp. MSVC fails to compile when DRAG_SUPPORT not enabled.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35887
 
-        * page/EventHandler.cpp:
+        * platform/efl/ClipboardEfl.cpp: Added.
+        * platform/efl/PasteboardEfl.cpp: Added.
 
-2009-10-17  Alpha Lam  <hclam@chromium.org>
+2010-03-15  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        [chromium] Video controls not zoomed / transformed correctly
-        https://bugs.webkit.org/show_bug.cgi?id=30461
-
-        Draw the images in the controls scaled.
-
-        No new tests. With this change Chromium will pass the following tests:
-        LayoutTests/media/video-controls-zoomed.html
-        LayoutTests/media/video-controls-transformed.html
+        Don't submit disabled menu options.
+        https://bugs.webkit.org/show_bug.cgi?id=35056
 
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::paintMediaButton):
-        Pass along the target rect directly.
-        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
-        Adjust the thumb slide applied with the scale factor.
+        Test: fast/forms/menulist-disabled-selected-option.html
 
-2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Unreviewed.
-
-        [Gtk] Build fix for WebKitGtk after r49723.
-
-        Add bindings/js/JSExceptionBase.* to the build.
-
-        * GNUmakefile.am:
-
-2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Unreviewed.
-
-        [Qt] Build fix for QtWebKit after r49723.
-
-        Add bindings/js/JSExceptionBase.cpp to the build.
-
-        * WebCore.pro:
-
-2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+        * dom/OptionElement.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::appendFormData):
+         If a selected option is disabled, skip it.
+         Remove code for non-selected menulist because of compatibility with
+         other browsers.
 
-        Reviewed by Dan Bernstein.
+2010-03-15  Leandro Pereira  <leandro@profusion.mobi>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30456
-        Fixes for new Debug_All Windows build configuration.
+        Reviewed by Holger Freyther.
 
-        * platform/network/cf/ResourceRequestCFNet.cpp:
-        (WebCore::findCFNetworkModule): Ask for the correct library instead of guessing.
-        * platform/win/ScrollbarThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
-        * rendering/RenderMediaControls.cpp: Use new DEBUG_ALL preprocessor define for library naming.
-        * rendering/RenderThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35884
 
-2009-10-16  Jon Honeycutt  <jhoneycutt@apple.com>
+        * platform/efl/FileSystemEfl.cpp: Added.
 
-        Add SPI to determine whether a plug-in has ever been halted.
+2010-03-15  Leandro Pereira  <leandro@profusion.mobi>
 
-        Part of <rdar://problem/7312158>.
+        Reviewed by Holger Freyther.
 
-        Reviewed by Dan Bernstein.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35882
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        Initialize m_hasBeenHalted.
+        * platform/efl/ContextMenuItemEfl.cpp: Added.
 
-        * plugins/PluginView.h:
-        (WebCore::PluginView::hasBeenHalted):
-        Return m_hasBeenHalted.
+2010-03-15  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
 
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::halt):
-        Set m_hasBeenHalted.
+        Reviewed by Holger Freyther.
 
-2009-10-16  Adam Barth  <abarth@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=35502
+        [Gtk] Objects of ATK_ROLE_TABLE should not implement AtkText
 
-        Reviewed by Alexey Proskuryakov.
+        Simple change to stop tables from implementing AtkText.
 
-        @charset rule after the first byte causes the rest of css to be ignored
-        https://bugs.webkit.org/show_bug.cgi?id=18265
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (getInterfaceMaskFromObject):
 
-        Apparently we're supposed to tolerate whitespace before the charset
-        rule so folks can write code like this:
+2010-03-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
 
-        <style>
-        @charset "utf-8"
-        ...
-        </style>
+        Reviewed by Adam Barth.
 
-        I'm told this is one of the top compatability problems in China.
-        Tests: fast/css/comment-before-charset-external.html
-               fast/css/comment-before-charset.html
-               fast/css/many-spaces-before-charset.html
-               fast/css/space-before-charset-external.html
-               fast/css/space-before-charset.html
+        According to the updated specification, a data field should always
+        result in a newline character being appended to the data buffer
+        regardless if the data buffer contains any data or not. However, upon
+        event dispatch, the last newline will be removed. This differs from an
+        older version of the specification where a newline character was
+        appended before the data value only if the buffer already contained
+        data. As a result, EventSource now supports receiving events with empty
+        data or newline characters only.
+        https://bugs.webkit.org/show_bug.cgi?id=33210
 
-        * css/CSSGrammar.y:
+        * page/EventSource.cpp:
+        (WebCore::EventSource::parseEventStreamLine):
 
-2009-10-16  Brian Weinstein  <bweinstein@apple.com>
+2010-03-15  Valters Svabe  <vsvabe@gmail.com>
 
         Reviewed by Darin Adler.
 
-        Fixes part of <http://webkit.org/b/30412>.
-        Web Inspector should get human readable DOM Exceptions.
-
-        Add a description field to ExceptionBase, and call it through 
-        reportException which allows the user/developer to get a more detailed
-        and coherent error explanation through the Web Inspector.
-
-        This only applies to exceptions that come from a script on the page when
-        it is run. DOM Exceptions that come from the code run in the console, or DOM
-        exceptions that are caught and logged will come in a future patch.
-
-        Tests: inspector/uncaught-dom1-exception.html
-               inspector/uncaught-dom3-exception.html
-               inspector/uncaught-dom8-exception.html
-
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::reportException):
-        * bindings/js/JSExceptionBase.cpp: Added.
-        (WebCore::toExceptionBase):
-        * bindings/js/JSExceptionBase.h: Added.
-        * dom/ExceptionBase.cpp:
-        (WebCore::ExceptionBase::ExceptionBase):
-        * dom/ExceptionBase.h:
-        (WebCore::ExceptionBase::description):
-        * dom/ExceptionCode.cpp:
-        (WebCore::):
-        (WebCore::getExceptionCodeDescription):
-        * dom/ExceptionCode.h:
-
-2009-10-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Build fix: forgot to check in this #include.
-
-        * bridge/runtime_root.h:
-
-2009-10-16  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Transform layer gets stuck with the wrong transform after an animation ends
-        <rdar://problem/7311662>
-
-        Work around a CoreAnimation bug which causes an animated transform layer to
-        end up with a stale transform.
+        :after selector displays in wrong place with nested div
+        https://bugs.webkit.org/show_bug.cgi?id=32288
         
-        Test: compositing/animation/state-at-end-event-transform-layer.html
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::bug7311367Workaround):
-        (WebCore::GraphicsLayerCA::removeAnimationFromLayer):
-
-2009-10-16  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        After running a transition with an end event listener, can't change the transform
-        https://bugs.webkit.org/show_bug.cgi?id=30454
-        
-        Fix an issue where, if a document had any listener for webkitTransitionEnd or webkitAnimationEnd,
-        the animations would not get cleaned up correctly, which broke subsequent changes of transform.
-        
-        Now, we always clean up the animations right after queuing up the end events.
-
-        Tests: animations/state-at-end-event.html
-               transitions/move-after-transition.html
-
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::onAnimationEnd):
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::onAnimationEnd):
+        Make sure we don't append things after :after-generated content, if
+        it's inside an anonymous block.
 
-2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+        Test: fast/css-generated-content/block-after.html
 
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Handle the Enter Key in the Elements Tree Hierarchy
-        https://bugs.webkit.org/show_bug.cgi?id=30428
-
-        TextNode => Edit Text Node
-        Has Attributes => Edit First Attribute
-        No Attributes => Start Editing New Attribute
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent): handle the "Enter" key
-        (WebInspector.ElementsTreeElement.prototype.set hovered): only add new attribute button on nodes with attributes
-        (WebInspector.ElementsTreeElement.prototype._addNewAttribute): prevent moving backwards where there are no attributes
-        (WebInspector.ElementsTreeElement.prototype._startEditingFromEvent): renamed to be clearer
-        (WebInspector.ElementsTreeElement.prototype._startEditing): transition to the appropriate edit state for a tree element
-
-2009-10-16  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Fix header indent style for FrameLoader and friends
-        https://bugs.webkit.org/show_bug.cgi?id=30430
-
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::frame):
-        (WebCore::FrameLoader::policyChecker):
-        (WebCore::FrameLoader::history):
-        (WebCore::FrameLoader::notifier):
-        (WebCore::FrameLoader::isLoadingMainResource):
-        (WebCore::FrameLoader::documentLoader):
-        (WebCore::FrameLoader::policyDocumentLoader):
-        (WebCore::FrameLoader::provisionalDocumentLoader):
-        (WebCore::FrameLoader::state):
-        (WebCore::FrameLoader::client):
-        (WebCore::FrameLoader::url):
-        (WebCore::FrameLoader::isLoadingFromCachedPage):
-        (WebCore::FrameLoader::committingFirstRealLoad):
-        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
-        (WebCore::FrameLoader::creatingInitialEmptyDocument):
-        * loader/HistoryController.h:
-        (WebCore::HistoryController::currentItem):
-        (WebCore::HistoryController::provisionalItem):
-        * loader/PolicyCallback.h:
-        (WebCore::PolicyCallback::request):
-        * loader/PolicyChecker.h:
-        (WebCore::PolicyChecker::loadType):
-        (WebCore::PolicyChecker::setLoadType):
-        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
-        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
-        * loader/RedirectScheduler.h:
-        * loader/ResourceLoadNotifier.h:
-
-2009-10-16  Steve Falkenburg  <sfalken@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Add a Debug_All configuration to build entire stack as debug.
-        Change Debug_Internal to:
-        - stop using _debug suffix for all WebKit/Safari binaries
-        - not use _debug as a DLL naming suffix
-        - use non-debug C runtime lib.
-
-        * WebCore.vcproj/QTMovieWin.vcproj: Add Debug_All configuration.
-        * WebCore.vcproj/WebCore.make: Debug build in makefile should build Debug_All.
-        * WebCore.vcproj/WebCore.sln: Add Debug_All configuration.
-        * WebCore.vcproj/WebCore.submit.sln: Add Debug_All configuration.
-        * WebCore.vcproj/WebCore.vcproj: Add Debug_All configuration.
-        * WebCore.vcproj/WebCoreGenerated.vcproj: Renamed single configuration from "Release" to "all".
-
-2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        No review, rolling out r49693, because it broke Chromium build.
-        http://trac.webkit.org/changeset/49693
-
-        * WebCore.gyp/WebCore.gyp:
-        * WebCore.gypi:
-
-2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by Eric Carlson.
-
-        Updated media resource selection algorithm to reflect latest HTML 5 specification.
-
-        Noticable changes:
-            -  Elements with no source should have their network state set to NETWORK_EMPTY as opposed to NETWORK_NO_SOURCE
-            -  Empty string ("") is now considered a valid URL resolving to the current page and will be loaded
-
-        Tests: media/video-src-empty.html
-               media/video-src-none.html
-
-        https://bugs.webkit.org/show_bug.cgi?id=30407
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::selectMediaResource): Updated code and comments to match spec.
-
-2009-10-16  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Insecure plug-ins don't trigger mixed content
-        https://bugs.webkit.org/show_bug.cgi?id=30431
-
-        Added the missing check.
-
-        Test: http/tests/security/mixedContent/insecure-plugin-in-iframe.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadPlugin):
-
-2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by Eric Carlson.
-
-        Set autobuffer to true and schedule load in V8 audio element constructor.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30448
-
-        Covered by existing tests.
-
-        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Set autobuffer to true and schedule load.
-
-2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Remove FIXME in RenderMediaControlsChromium as bug was fixed upstream.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30422
-
-        Covered by existing media layout tests.
-
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::paintMediaSlider): Removed round() and FIXME.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChild):
 
-2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+2010-03-15  Leandro Pereira  <leandro@profusion.mobi>
 
         Reviewed by Eric Seidel.
 
-        Fix Chromium media controls to render a disabled play button when the element is unintialized.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35885
 
-        https://bugs.webkit.org/show_bug.cgi?id=30410
+        * platform/efl/KURLEfl.cpp: Added.
 
-        Covered by existing layout tests.
+2010-03-15  Chris Fleizach  <cfleizach@apple.com>
 
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::paintMediaPlayButton): Include check for NETWORK_EMPTY to render disabled play button.
+        Reviewed by Beth Dakin.
 
-2009-10-16  Oliver Hunt  <oliver@apple.com>
+        VO not able to perform a VO-spacebar on facebook links
+        https://bugs.webkit.org/show_bug.cgi?id=36132
 
-        Reviewed by Gavin Barraclough.
+        When a label element is used as a click event handler, and it doesn't have any
+        corresponding control, it should handle the action itself.
 
-        Make typeinfo flags default to false
-        https://bugs.webkit.org/show_bug.cgi?id=30372
+        Test: accessibility/label-element-press.html
 
-        Last part -- replace HasDefaultGetPropertyNames with OverridesGetPropertyNames
-        flag.
+        * html/HTMLLabelElement.cpp:
+        (WebCore::HTMLLabelElement::accessKeyAction):
 
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructure):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::createStructure):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructure):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/runtime_array.h:
-        (JSC::RuntimeArray::createStructure):
-        * bridge/runtime_object.h:
-        (JSC::RuntimeObjectImp::createStructure):
+2010-03-15  Cameron Zwarich  <zwarich@apple.com>
 
-2009-10-16  Steven Knight  <sgk@chromium.org>
+        Reviewed by Geoff Garen.
 
-        Reviewed by David Levin.
+        Bug 36135 - GCController::garbageCollectNow() crashes when called from garbage collection
+        <https://bugs.webkit.org/show_bug.cgi?id=36135>
+        <rdar://problem/7752552>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30447
-        Handle long link lines by building .idl-generated bindings in a
-        separate webcore_bindings library target.  Avoid Visual Studio
-        dependency issues by building additional generated .cpp and .h files
-        in a separate webcore_bindings_sources target.
+        * bindings/js/GCController.cpp:
+        (WebCore::GCController::garbageCollectNow): Fail silently if garbage collection is
+        active rather than hitting the CRASH() reentrancy guard.
 
-        Chrome should still build and test successfully.
+2010-03-15  Simon Fraser  <simon.fraser@apple.com>
 
-        * WebCore.gyp/WebCore.gyp:
-        * WebCore.gypi:
-
-2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+        Reviewed by Dan Bernstein.
 
-        Reviewed by Eric Carlson.
+        Drop out of compositing mode when no elements need to composite
+        https://bugs.webkit.org/show_bug.cgi?id=36134
 
-        Transform transitions that used to be accelerated are no longer so
-        https://bugs.webkit.org/show_bug.cgi?id=30453
+        When no more elements on the page need to be composited, drop out of compositing
+        mode altogether, including removing the layer-backed view that hosts the layers.
 
-        The change in r49633, to not run accelerated animations/transitions on layers that
-        are not attached, broke accelerated transitions/animations in many cases where they start
-        as soon as the page loads. This change reverts the code that tests for the GraphicsLayer being
-        attached.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers): If the list of child layers to attach at
+        the root is empty, we have no composited layers, and can drop out of compositing mode by calling
+        willMoveOffscreen().
         
-        No test, because it's not possible from a test to know whether a transition is accelerated or not.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::startAnimation):
-        (WebCore::RenderLayerBacking::startTransition):
-
-2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wxMSW build fix, build the MSW source to get methods that use the MSW version of
-        PlatformModuleVersion.
-
-        * wscript:
-
-2009-10-16  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed build fix.  Add back MIMETypeRegistryChromium with the right
-        casing.
-
-        * platform/chromium/MIMETypeRegistryChromium.cpp: Added.
-        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
-        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
-        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
-        (WebCore::MIMETypeRegistry::isSupportedImageMIMEType):
-        (WebCore::MIMETypeRegistry::isSupportedImageResourceMIMEType):
-        (WebCore::MIMETypeRegistry::isSupportedImageMIMETypeForEncoding):
-        (WebCore::MIMETypeRegistry::isSupportedJavaScriptMIMEType):
-        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
-        (WebCore::MIMETypeRegistry::isSupportedMediaMIMEType):
-        (WebCore::MIMETypeRegistry::isJavaAppletMIMEType):
-        (WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension):
-        (WebCore::dummyHashSet):
-        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypes):
-        (WebCore::MIMETypeRegistry::getSupportedImageResourceMIMETypes):
-        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypesForEncoding):
-        (WebCore::MIMETypeRegistry::getSupportedNonImageMIMETypes):
-        (WebCore::MIMETypeRegistry::getSupportedMediaMIMETypes):
-
-2009-10-16  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        MimeTypeRegistryChromium is mis-casen
-        https://bugs.webkit.org/show_bug.cgi?id=30441
-
-        Change the case of MimeTypeRegistryChromium to match other platforms.
-
-        * WebCore.gypi:
-        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
-        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
-
-2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Change EmptyPluginHalterClient in SVGImage to be non-static, to
-        match changes made http://trac.webkit.org/changeset/49385.
-        https://bugs.webkit.org/show_bug.cgi?id=30403
-
-        Run the following layout test sequence:
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-01-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-03-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-04-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-05-b.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-06-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-08-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-09-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-10-t.svg
-          LayoutTests/svg/carto.net/scrollbar.svg
-          LayoutTests/svg/carto.net/selectionlist.svg
-
-        selectionlist.svg should not crash.
-
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::dataChanged): Made EmptyPluginHalterClient non-static.
-
-2009-10-16  Victor Wang  <victorw@chromium.org>
-
-        Reviewed by David Levin.
-
-        Add beforeload event support to V8DOMWrapper
-
-        https://bugs.webkit.org/show_bug.cgi?id=30413
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements): In several places,
+        use willBeComposited rather than calling needsToBeComposited(), because it avoids
+        recomputing state that we know already (but assert that we're getting it right).
+        When we're assessing the root layer in post-order, see if we have any child layers that
+        are compositing, and also whether the root itself needs to composite. If neither are
+        true, then we can drop out of compositing mode.
+        
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer): Move the
+        "inCompositingMode() && layer->isRootLayer()" test out of requiresCompositingLayer()
+        and into needsToBeComposited() so that we can call requiresCompositingLayer() separately
+        on the root layer above.
 
-        LayoutTests/fast/dom/beforeload/frame-before-load.html
+2010-03-15  Leandro Pereira  <leandro@profusion.mobi>
 
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-16  Adam Barth  <abarth@webkit.org>
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35888
 
-        Reviewed by Darin Adler.
+        * platform/efl/SoundEfl.cpp: Added.
 
-        MimeTypeRegistryChromium is mis-casen
-        https://bugs.webkit.org/show_bug.cgi?id=30441
+2010-03-15  Andy Estes  <aestes@apple.com>
 
-        Change the case of MimeTypeRegistryChromium to match other platforms.
+        Reviewed by John Sullivan.
 
-        * WebCore.gypi:
-        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
-        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
+        For continuous scrolling devices on the Mac (trackpads and Mighty/Magic
+        Mice), set the number of wheel ticks equal to the atomic increment of
+        the device: a pixel.  This ensures that any scrolling action will
+        generate at least one wheel tick, regardless of the speed/length of
+        the gesture.
 
-2009-10-16  Adam Barth  <abarth@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=29601
+        <rdar://problem/7453254>
 
-        Reviewed by Mark Rowe.
+        Tests: fast/events/continuous-platform-wheelevent-in-scrolling-div.html
+               fast/events/platform-wheelevent-in-scrolling-div.html
 
-        Chrome doesn't set Content-Type for file upload when the file extension
-        is not recognized
-        https://bugs.webkit.org/show_bug.cgi?id=30433
+        * platform/mac/WebCoreSystemInterface.h: Modify method signature.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Call into
+        WebKitSystemInterface to determine both wheelTicksX/Y and deltaX/Y.
+        WKSI will query the event system for number of wheel ticks and
+        pixels/lines scrolled based on the device type.
 
-        Apparently, getMIMETypeForPath is supposed to return
-        application/octet-stream when it doesn't have a better MIME type.
+2010-03-15  Philippe Normand  <pnormand@igalia.com>
 
-        * platform/chromium/MimeTypeRegistryChromium.cpp:
-        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+        Reviewed by Gustavo Noronha Silva.
 
-2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        [GStreamer] duration query optimizations
+        https://bugs.webkit.org/show_bug.cgi?id=36116
 
-        Pull out r49676 as it caused build breakges on Symbian
+        Don't reattempt duration queries that previously failed and cache
+        media duration only if it's known.
 
-        * plugins/symbian/PluginViewSymbian.cpp:
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::duration):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-03-11  Peter Kasting  <pkasting@google.com>
 
-        Reviewed by Ariya Hidayat.
+        Reviewed by Adam Barth.
 
-        Crash fix when loading NPAPI plugins on Qt/Mac
+        Clean up more bits of the open-source image decoders.  In addition to
+        simplifying things somewhat, this makes all the decoders the same in
+        terms of how they construct "image reader" subclasses and init scale
+        data.
 
-        There's no guarantee that the plist will be valid even if we
-        ask the plugin to create it. Crash obverved with iGetter.
+        https://bugs.webkit.org/show_bug.cgi?id=36040
 
-        * plugins/mac/PluginPackageMac.cpp:
+        No functional change, so no tests.
 
-2009-10-15  Stephen White  <senorblanco@chromium.org>
+        * platform/image-decoders/ImageDecoder.h: Reorder a few declarations to try and group/order members slightly better.
+        (WebCore::ImageDecoder::ImageDecoder):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp: Move reader construction into decode().  Prep scale data in setSize().  Remove useless comment.
+        (WebCore::GIFImageDecoder::setData):
+        (WebCore::GIFImageDecoder::setSize):
+        (WebCore::GIFImageDecoder::frameBufferAtIndex):
+        (WebCore::GIFImageDecoder::decode):
+        * platform/image-decoders/gif/GIFImageDecoder.h: Prep scale data in setSize().
+        * platform/image-decoders/gif/GIFImageReader.cpp: Prep scale data in setSize().
+        (GIFImageReader::read):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp: Shorten code.
+        (WebCore::ICOImageDecoder::setSize):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp: Fix style.  Move reader construction into decode().
+        (WebCore::JPEGImageReader::close):
+        (WebCore::JPEGImageReader::skipBytes):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h: Move reader construction into decode().
+        (WebCore::JPEGImageDecoder::filenameExtension):
+        * platform/image-decoders/png/PNGImageDecoder.cpp: Move reader construction into decode().  Track completion on decoder, not reader.  Prep scale data in setSize().  Remove useless comment.
+        (WebCore::PNGImageReader::PNGImageReader):
+        (WebCore::PNGImageReader::close):
+        (WebCore::PNGImageReader::decode):
+        (WebCore::PNGImageDecoder::setSize):
+        (WebCore::PNGImageDecoder::frameBufferAtIndex):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::pngComplete):
+        (WebCore::PNGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.h: Move reader construction into decode().  Track completion on decoder, not reader.  Prep scale data in setSize().
+        (WebCore::PNGImageDecoder::filenameExtension):
+        (WebCore::PNGImageDecoder::isComplete):
 
-        Reviewed by David Levin.
+2010-03-15  Philippe Normand  <pnormand@igalia.com>
 
-        Fix for Chromium/skia's implementation of canvas's isPointInPath().
-        https://bugs.webkit.org/show_bug.cgi?id=30402
+        Reviewed by Gustavo Noronha Silva.
 
-        Covered by LayoutTests/fast/canvas/pointInPath.html.
+        [GStreamer] updateStates called for all elements posting a state-change
+        https://bugs.webkit.org/show_bug.cgi?id=36115
 
-        * platform/graphics/skia/SkiaUtils.cpp:
-        (WebCore::SkPathContainsPoint):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback): Update player state
+        only for state-change messages coming from playbin2 directly.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (WebCore::MediaPlayerPrivate::pipeline): public accessor for the
+        playbin element.
 
-2009-10-15  Adam Barth  <abarth@webkit.org>
+2010-03-15  Jian Li  <jianli@chromium.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Nate Chapin.
 
-        Factor ResourceLoadNotifier out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30379
+        [v8] Add V8 bindings for DOMFormData.
+        https://bugs.webkit.org/show_bug.cgi?id=36026
 
-        These methods have virtually no interaction with the rest of
-        FrameLoader.
+        Test: http/tests/local/send-form-data.html
 
-        * GNUmakefile.am:
+        * Android.v8bindings.mk:
         * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * dom/Document.cpp:
-        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
-        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
-        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
-        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::willSendRequest):
-        (WebCore::ResourceLoadNotifier::didReceiveResponse):
-        (WebCore::ResourceLoadNotifier::didReceiveData):
-        (WebCore::ResourceLoadNotifier::didFailToLoad):
-        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
-        (WebCore::FrameLoader::sendRemainingDelegateMessages):
-        (WebCore::FrameLoader::requestFromDelegate):
-        (WebCore::ResourceLoadNotifier::didFinishLoad):
-        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
-        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::notifier):
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::receivedError):
-        * loader/ResourceLoadNotifier.cpp: Added.
-        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
-        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::willSendRequest):
-        (WebCore::ResourceLoadNotifier::didReceiveResponse):
-        (WebCore::ResourceLoadNotifier::didReceiveData):
-        (WebCore::ResourceLoadNotifier::didFinishLoad):
-        (WebCore::ResourceLoadNotifier::didFailToLoad):
-        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
-        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
-        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
-        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
-        * loader/ResourceLoadNotifier.h: Added.
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::willSendRequest):
-        (WebCore::ResourceLoader::didReceiveResponse):
-        (WebCore::ResourceLoader::didReceiveData):
-        (WebCore::ResourceLoader::didFinishLoadingOnePart):
-        (WebCore::ResourceLoader::didFail):
-        (WebCore::ResourceLoader::didCancel):
-        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8DOMFormDataCustom.cpp: Added.
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::sendCallback):
 
-2009-10-15  Roland Steiner  <rolandsteiner@google.com>
+2010-03-15  Jian Li  <jianli@chromium.org>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Sam Weinig.
 
-        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
-        (https://bugs.webkit.org/show_bug.cgi?id=30427)
+        Add DOMFormData.idl to expose FormData interface.
+        https://bugs.webkit.org/show_bug.cgi?id=36024
         
-        Remove no longer needed methods from ChromiumDataObject.
-
-        No new tests (no functional change)
-
-        * platform/chromium/ChromiumDataObject.h:
-
-2009-10-16  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
+        The implementation is based on XMLHttpRequest 2 spec:
+        http://dev.w3.org/2006/webapi/XMLHttpRequest-2/#formdata
 
-        [Qt] Need a way to inform the application when a Netscape plugin is created or deleted
-        https://bugs.webkit.org/show_bug.cgi?id=30179
-
-        Inform the application when a plugin is created or destroyed, but only if the 
-        application registered for these notifications.
-
-        * plugins/symbian/PluginViewSymbian.cpp:
-        (WebCore::PluginView::platformStart):
-        (WebCore::PluginView::platformDestroy):
-
-2009-10-16  Shu Chang  <Chang.Shu@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        Default language translation should be determined by locale settings,
-        e.g., "en-US".
-        https://bugs.webkit.org/show_bug.cgi?id=29653
-
-        Test: fast/js/navigator-language.html
-
-        * platform/qt/Localizations.cpp:
-        (WebCore::defaultLanguage):
-
-2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        Crash fix when loading NPAPI plugins on Qt/Mac
-
-        There's no guarantee that the plist will be valid even if we
-        ask the plugin to create it. Crash obverved with iGetter.
-
-        * plugins/mac/PluginPackageMac.cpp:
-
-2009-10-15  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by David Levin.
-
-        Fix for Chromium/skia's implementation of canvas's isPointInPath().
-        https://bugs.webkit.org/show_bug.cgi?id=30402
-
-        Covered by LayoutTests/fast/canvas/pointInPath.html.
-
-        * platform/graphics/skia/SkiaUtils.cpp:
-        (WebCore::SkPathContainsPoint):
-
-2009-10-15  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Factor ResourceLoadNotifier out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30379
-
-        These methods have virtually no interaction with the rest of
-        FrameLoader.
+        Test: http/tests/local/send-form-data.html
 
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * Android.jscbindings.mk:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
         * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
+        * WebCore.pri:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * dom/Document.cpp:
-        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
-        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
-        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
-        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::willSendRequest):
-        (WebCore::ResourceLoadNotifier::didReceiveResponse):
-        (WebCore::ResourceLoadNotifier::didReceiveData):
-        (WebCore::ResourceLoadNotifier::didFailToLoad):
-        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
-        (WebCore::FrameLoader::sendRemainingDelegateMessages):
-        (WebCore::FrameLoader::requestFromDelegate):
-        (WebCore::ResourceLoadNotifier::didFinishLoad):
-        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
-        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::notifier):
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::receivedError):
-        * loader/ResourceLoadNotifier.cpp: Added.
-        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
-        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::willSendRequest):
-        (WebCore::ResourceLoadNotifier::didReceiveResponse):
-        (WebCore::ResourceLoadNotifier::didReceiveData):
-        (WebCore::ResourceLoadNotifier::didFinishLoad):
-        (WebCore::ResourceLoadNotifier::didFailToLoad):
-        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
-        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
-        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
-        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
-        * loader/ResourceLoadNotifier.h: Added.
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::willSendRequest):
-        (WebCore::ResourceLoader::didReceiveResponse):
-        (WebCore::ResourceLoader::didReceiveData):
-        (WebCore::ResourceLoader::didFinishLoadingOnePart):
-        (WebCore::ResourceLoader::didFail):
-        (WebCore::ResourceLoader::didCancel):
-        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
-
-2009-10-15  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Darin Fisher.
-
-        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
-        (https://bugs.webkit.org/show_bug.cgi?id=30427)
-        
-        Remove no longer needed methods from ChromiumDataObject.
-
-        No new tests (no functional change)
-
-        * platform/chromium/ChromiumDataObject.h:
-
-2009-10-15  Daniel Bates  <dbates@webkit.org>
-
-        No review, rolling out r49644.
-        http://trac.webkit.org/changeset/49644
-        
-        We need to think about this change some more. See bug #30418 
-        for more details.
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::canSetBaseElementURL):
-        (WebCore::XSSAuditor::findInRequest):
-        * page/XSSAuditor.h:
-
-2009-10-14  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Add SPI to determine whether a node is a halted plug-in.
-
-        Part of <rdar://problem/7273354> Halted plug-ins should restart on
-        mouseover
+        * bindings/js/JSDOMFormDataCustom.cpp: Added.
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/DOMFormData.idl: Added.
+        * page/DOMWindow.idl:
 
-        https://bugs.webkit.org/show_bug.cgi?id=30151
+2010-03-15  Patrik Persson  <patrik.j.persson@ericsson.com>
 
         Reviewed by Darin Adler.
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        Initialize m_isHalted.
-
-        * plugins/PluginView.h:
-        (WebCore::PluginView::isHalted):
-        Return m_isHalted.
-
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::halt):
-        Set m_isHalted to true.
-        (WebCore::PluginView::restart):
-        clear m_isHalted.
+        https://bugs.webkit.org/show_bug.cgi?id=32369
 
-2009-10-15  Zoltan Horvath  <zoltan@webkit.org>
+        Revise iframe sandbox behavior to match the updated HTML5 spec.
 
-        Reviewed by Oliver Hunt.
-
-        [Qt] Build fix for QtWebKit after r49649.
+        - Enables window.sessionStorage in sandboxed iframes.
 
-        Change JSC::HasNonDefaultMark to OverridesMarkChildren in createStructure function.
+        - Raises SECURITY_ERR exceptions when window.localStorage or
+          window.openDatabase() is blocked by iframe sandboxing.
 
-        * bridge/qt/qt_runtime.h:
-        (JSC::Bindings::QtRuntimeMethod::createStructure):
+          Note: window.sessionStorage does not raise exceptions.
 
-2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+        WebKit would previously return null references in these cases.  The
+        new behavior is in accordance with HTML5:
 
-        Not reviewed - build fix.
+          http://dev.w3.org/html5/webstorage/   (sections 4.2 and 4.3)
+          http://dev.w3.org/html5/webdatabase/  (section 4.1)
+          http://www.mail-archive.com/whatwg@lists.whatwg.org/msg19786.html
 
-        Web Inspector: add file missing in r49648
-
-        * inspector/front-end/TestController.js: Added.
-        (WebInspector.TestController):
-        (WebInspector.TestController.prototype.waitUntilDone):
-        (WebInspector.TestController.prototype.notifyDone):
-        (WebInspector.evaluateForTestInFrontend):
-
-2009-10-15  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Make typeinfo flags default to false
-        https://bugs.webkit.org/show_bug.cgi?id=30372
-
-        Part 2 -- Reverse the TypeInfo HasDefaultMark flag to OverridesMarkChildren, etc
-
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::createStructure):
-        (WebCore::DOMConstructorObject::createStructure):
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructure):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::createStructure):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructure):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/qt/qt_runtime.h:
-        (JSC::Bindings::QtRuntimeMethod::createStructure):
-        * bridge/runtime_method.h:
-        (JSC::RuntimeMethod::createStructure):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::selectDOMStorage): exception handling
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent): exception handling
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage): re-enabled in iframe sandbox
+        (WebCore::DOMWindow::localStorage): raise exception rather than return null
+        (WebCore::DOMWindow::openDatabase): raise exception rather than return null
+        * page/DOMWindow.h: added exceptions to interface
+        * page/DOMWindow.idl: added exceptions to interface
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::canAccessLocalStorage): renamed function to reflect its purpose
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch): exception handling
 
-2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-15  Alexander Pavlov  <apavlov@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: introduce test controller with waitUntilDone
-        on frontend side.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30400
+        Web Inspector: Implement a progress indicator in the Audits panel
+        when resources are reloading
+        https://bugs.webkit.org/show_bug.cgi?id=35971
 
+        * English.lproj/localizedStrings.js:
+        * GNUmakefile.am:
         * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/TestController.js: Added.
-        (WebInspector.TestController):
-        (WebInspector.TestController.prototype.waitUntilDone):
-        (WebInspector.TestController.prototype.notifyDone):
-        (WebInspector.evaluateForTestInFrontend):
+        * inspector/front-end/AuditLauncherView.js:
+        (WebInspector.AuditLauncherView.prototype.updateResourceTrackingState):
+        (WebInspector.AuditLauncherView.prototype.get totalResources):
+        (WebInspector.AuditLauncherView.prototype.set totalResources):
+        (WebInspector.AuditLauncherView.prototype.get loadedResources):
+        (WebInspector.AuditLauncherView.prototype.set loadedResources):
+        (WebInspector.AuditLauncherView.prototype._resetResourceCount):
+        (WebInspector.AuditLauncherView.prototype.resourceStarted):
+        (WebInspector.AuditLauncherView.prototype.resourceFinished):
+        (WebInspector.AuditLauncherView.prototype.reset):
+        (WebInspector.AuditLauncherView.prototype._setAuditRunning):
+        (WebInspector.AuditLauncherView.prototype._launchButtonClicked):
+        (WebInspector.AuditLauncherView.prototype._createCategoryElement):
+        (WebInspector.AuditLauncherView.prototype._createLauncherUI):
+        (WebInspector.AuditLauncherView.prototype._updateResourceProgress):
+        (WebInspector.AuditLauncherView.prototype._updateButton):
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype.resourceStarted):
+        (WebInspector.AuditsPanel.prototype.resourceFinished):
+        (WebInspector.AuditsPanel.prototype.reset):
+        * inspector/front-end/Images/spinner.gif: Added.
         * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
+        * inspector/front-end/audits.css:
+        (.audit-launcher-view .resource-progress > img):
         * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
 
-2009-10-15  Daniel Bates  <dbates@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27895
-        
-        Fixes an issue in which injecting an inline event handler whose value ends in a single-line
-        JavaScript comment can bypass the XSSAuditor. Similarly fixes this issue with respect to
-        the HTML Base element, HTML Object element, inline and external script tags, and
-        JavaScript multi-line variants of all of these attacks.
-
-        Tests: http/tests/security/xssAuditor/base-href-comment.html
-               http/tests/security/xssAuditor/iframe-javascript-url-comment.html
-               http/tests/security/xssAuditor/img-onerror-HTML-comment.html
-               http/tests/security/xssAuditor/img-onerror-comment.html
-               http/tests/security/xssAuditor/object-tag-comment.html
-               http/tests/security/xssAuditor/script-tag-comment-HTML-entity.html
-               http/tests/security/xssAuditor/script-tag-comment.html
-               http/tests/security/xssAuditor/script-tag-with-source-comment.html
-
-        * page/XSSAuditor.cpp: Added constant minAttackLength.
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::canSetBaseElementURL):
-        (WebCore::XSSAuditor::findInRequest): Added parameter context. Only looks at up 
-        to minAttackLength of script code plus context (if any).
-        * page/XSSAuditor.h:
-
-2009-10-08  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
+2010-03-15  Philippe Normand  <pnormand@igalia.com>
 
-        Currently, Skia clip paths are 1-bit. This patch makes our path
-        clipping anti-aliased for non-canvas drawing.
+        Reviewed by Gustavo Noronha Silva.
 
-        http://code.google.com/p/chromium/issues/detail?id=5927
-        https://bugs.webkit.org/show_bug.cgi?id=28820
-        http://www.imperialviolet.org/2009/09/02/anti-aliased-clipping.html
+        [GStreamer] replace g_idle_add / g_timeout_add calls with Timers in the gstreamer player
+        https://bugs.webkit.org/show_bug.cgi?id=35735
 
-        Already covered by layout tests. New baselines will be needed in the
-        Chromium tree.
+        Replaced g_idle_add calls with Timers immediately started once
+        only. The g_timeout_add was replaced by a periodic Timer.
 
-        (Reland. First landed in r49329, reverted in r49330 due to Windows
-        build break)
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::volumeChangedTimerFired):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::processBufferingStats):
+        (WebCore::MediaPlayerPrivate::fillTimerFired):
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::muteChangedTimerFired):
+        (WebCore::MediaPlayerPrivate::muteChanged):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::clip):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::clip):
-        (WebCore::GraphicsContext::canvasClip):
-        (WebCore::GraphicsContext::clipPath):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::clipPathAntiAliased):
-        (PlatformContextSkia::restore):
-        (PlatformContextSkia::applyAntiAliasedClipPaths):
-        * platform/graphics/skia/PlatformContextSkia.h:
-        * platform/graphics/win/GraphicsContextWin.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/wince/GraphicsContextWince.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/wx/GraphicsContextWx.cpp:
-        (WebCore::GraphicsContext::canvasClip):
+2010-03-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-2009-10-15  Eric Carlson  <eric.carlson@apple.com>
+        Reviewed by Eric Carlson.
 
-        Reviewed by Simon Fraser.
+        media/video-preload.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=35793
 
-        <rdar://problem/7295738> No way to mute/unmute a movie in full screen video mode
+        Only effectively load, and start buffering when playing, or when
+        the preload attribute is set.
 
-        * WebCore.Video.exp: Export muted and setMute.
+        Test: media/video-preload.html
 
-2009-10-15  Simon Fraser  <simon.fraser@apple.com>
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::commitLoad):
+        (WebCore::MediaPlayerPrivate::prepareToPlay):
+        (WebCore::MediaPlayerPrivate::setPreload):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        Reviewed by Dan Bernstein.
+2010-03-15  Shu Chang  <Chang.Shu@nokia.com>
 
-        Transitions fail to run sometimes
-        https://bugs.webkit.org/show_bug.cgi?id=26770
+        Reviewed by Holger Freyther.
 
-        Fix an issue where we could attempt to start accelerated animations or transitions on
-        GraphicsLayer that were not rooted (because of visibility:hidden), which would leave
-        the AnimationController's m_waitingForResponse flag in a state that killed subsequent
-        software transitions.
+        [Qt] The behavior of QGradient with no stops is defined differently from HTML5 spec,
+        where the latter requires the gradient to be transparent black. Explicitly added a
+        transparent black color stop to match the HTML5 behavior.
+        https://bugs.webkit.org/show_bug.cgi?id=36060
 
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
-        (WebCore::AnimationControllerPrivate::endAnimationUpdate):
-        (WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
-        (WebCore::AnimationControllerPrivate::addToStartTimeResponseWaitList):
-        (WebCore::AnimationControllerPrivate::startTimeResponse):
-        * page/animation/AnimationControllerPrivate.h:
-        Make some methods non-inline for ease of debugging (these are not hot methods).
-        Rename m_waitingForAResponse to m_waitingForResponse.
-        
-        * platform/graphics/GraphicsLayer.h:
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::hasAncestor):
-        New method to report whether the receiver has the given layer as an ancestor. Used for checking
-        whether a layer is rooted.
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
 
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::startAnimation):
-        (WebCore::RenderLayerBacking::startTransition):
-        Don't try to start accelerated animations or transitions on non-rooted GraphicsLayers.
+2010-03-11  Antonio Gomes  <tonikitoo@webkit.org>
 
-2009-10-15  Alexander Pavlov  <apavlov@chromium.org>
+        Rubber-stamped by Holger Freyther.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        Reviewed by Pavel Feldman.
+        Some minor code clean ups in SpatialNavigation.cpp
 
-        Refactor ProfilesPanel to support multiple profile types
+        * page/SpatialNavigation.cpp:
+        (WebCore::distanceInDirection):
+        (WebCore::deflateIfOverlapped):
 
-        Data describing different profile types are now stored in distinct objects.
-        https://bugs.webkit.org/show_bug.cgi?id=30332
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.CPUProfileView.profileCallback):
-        (WebInspector.CPUProfileView):
-        (WebInspector.CPUProfileView.prototype._sortData):
-        (WebInspector.CPUProfileType):
-        (WebInspector.CPUProfileType.prototype.get buttonTooltip):
-        (WebInspector.CPUProfileType.prototype.get buttonStyle):
-        (WebInspector.CPUProfileType.prototype.buttonClicked):
-        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
-        (WebInspector.CPUProfile):
-        (WebInspector.CPUProfile.prototype.get title):
-        (WebInspector.CPUProfile.prototype.get uid):
-        (WebInspector.CPUProfile.prototype.get head):
-        (WebInspector.CPUProfile.prototype.createView):
-        (WebInspector.CPUProfile.prototype.viewForProfile):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfileType):
-        (WebInspector.ProfileType.prototype.get buttonTooltip):
-        (WebInspector.ProfileType.prototype.get buttonStyle):
-        (WebInspector.ProfileType.prototype.get buttonCaption):
-        (WebInspector.ProfileType.prototype.get id):
-        (WebInspector.ProfileType.prototype.get name):
-        (WebInspector.ProfileType.prototype.buttonClicked):
-        (WebInspector.ProfilesPanel):
-        (WebInspector.ProfilesPanel.prototype.get statusBarItems.clickHandler):
-        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
-        (WebInspector.ProfilesPanel.prototype.reset):
-        (WebInspector.ProfilesPanel.prototype.registerProfileType):
-        (WebInspector.ProfilesPanel.prototype._makeKey):
-        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
-        (WebInspector.ProfilesPanel.prototype.showProfile):
-        (WebInspector.ProfilesPanel.prototype.getProfileType):
-        (WebInspector.ProfilesPanel.prototype.showProfileForURL):
-        (WebInspector.ProfilesPanel.prototype.updateProfileTypeButtons):
-        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
-        (WebInspector.ProfilesPanel.prototype.get searchableViews):
-        (WebInspector.ProfilesPanel.prototype._updateInterface):
-        * inspector/front-end/inspector.js:
-        (WebInspector._createPanels):
-        (WebInspector.documentClick.followLink):
-        (WebInspector.documentClick):
-        (WebInspector.addProfileHeader):
-        (WebInspector.setRecordingProfile):
-        (WebInspector.linkifyStringAsFragment):
-        (WebInspector.showProfileForURL):
-
-2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-13  Ilya Tikhonovsky  <loislo@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: Enable inspector layout tests.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30014
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::evaluateForTestInFrontend):
-
-2009-10-15  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GStreamer] READY state doesn't mean "enough data"
-        https://bugs.webkit.org/show_bug.cgi?id=30003
-
-        STATE_READY means MediaPlayer::HaveNothing
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::updateStates):
-
-2009-10-15  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30002
-
-        implement cancelLoad
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::cancelLoad):
+        WebInspector: Position of GraphBar elements is calculating more carefully
+        and they fully visible at the bottom of Timeline panel.
+       
+        http://bugs.webkit.org/show_bug.cgi?id=35966
 
-2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
 
-        Reviewed by Gustavo Noronha.
+2010-03-15  MORITA Hajime  <morrita@google.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30353
-        
-        Fix race condition, leading to a deadlock
+        Reviewed by Alexey Proskuryakov.
 
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_timeout_func):
-        (webkit_video_sink_render):
-        (unlock_buffer_mutex):
-        (webkit_video_sink_unlock):
-        (webkit_video_sink_unlock_stop):
-        (webkit_video_sink_stop):
-        (webkit_video_sink_start):
-        (webkit_video_sink_class_init):
-        Fix race condition in unlock/render that would lead to deadlocks.
+        Selection.modify extends too far with 'lineboundary'.
+        https://bugs.webkit.org/show_bug.cgi?id=33413
 
-2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+        Selection.modify() with 'lineboundary' granularity implies just
+        "Go to the end of the line", unlike selection expansion with
+        other type of granularities. This change handled LineGranularity
+        as special case, to look-up end of line with UPSTREAM affinity. 
+        Doing this prevents look-up algorithm to go next line.
 
-        Reviewed by Gustavo Noronha.
+        Test: editing/selection/extend-selection-expected.txt
 
-        https://bugs.webkit.org/show_bug.cgi?id=30374
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset):
+        Handled an edge case for node look-up with UPSTREAM.
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyExtendingForward):
+        Added UPSTREAM tweak for the case for LineGranularity.
         
-        Check if caps are valid before parsing them
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::duration):
-        Check if caps are valid before parsing them in ::naturalSize().
-        This prevents assertions if the natural size should be calculated
-        before the video caps are negotiated.
-
-2009-10-15  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30006
-        [GStreamer] Unnecessary checks for Messages types in callbacks
-
-        refactored gst message callbacks into a single one
+2010-03-14  Yuzo Fujishima  <yuzo@google.com>
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::mediaPlayerPrivateMessageCallback):
-        (WebCore::do_gst_init):
-        (WebCore::MediaPlayerPrivate::duration):
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-
-2009-10-15  Shu Chang  <Chang.Shu@nokia.com>
-
-        Reviewed by Adele Peterson.
-
-        Anchor elements should be mouse focusable regardless isLink flag.
-        https://bugs.webkit.org/show_bug.cgi?id=26856
-
-        * html/HTMLAnchorElement.cpp:
-        * html/HTMLAnchorElement.h:
-
-2009-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
-
-        Not reviewed. Sort XCode project file.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-10-15  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Dave Hyatt.
-
-        Return correct shorthand property name for 
-        background-repeat-x, background-repeat-y, background-position-x,
-        background-position-y, -webkit-mask-position-x, -webkit-mask-position-y,
-        -webkit-mask-repeat-x, -webkit-mask-repeat-y.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28972
-
-        Test: fast/backgrounds/repeat/background-repeat-shorthand.html
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
+        Reviewed by Shinichiro Hamaji.
 
-2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+        Always call PrintContext.end() from PrintContext::pageNumberForElement().
 
-        Reviewed by Pavel Feldman.
-
-        Web Inspector: Migrate profiles to the injected script-based schema.
+        Without this change, WebKit remains in printing mode after determining the page number if the specified element is found.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30328
+        https://bugs.webkit.org/show_bug.cgi?id=36049
 
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getProfileHeaders):
-        (WebCore::InspectorBackend::getProfile):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addProfile):
-        (WebCore::InspectorController::getProfileHeaders):
-        (WebCore::InspectorController::getProfile):
-        (WebCore::InspectorController::createProfileHeader):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addProfileHeader):
-        (WebCore::InspectorFrontend::didGetProfileHeaders):
-        (WebCore::InspectorFrontend::didGetProfile):
-        * inspector/InspectorFrontend.h:
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::ProfileNodeClass):
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView.profileCallback):
-        (WebInspector.ProfileView):
-        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
-        (WebInspector.ProfileView.prototype._assignParentsInProfile):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addProfileHeader):
-
-2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
+        Test: printing/return-from-printing-mode.html
 
-        Web Inspector: Create and update frontend script objects only when
-        web inspector is visible.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30376
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::pageNumberForElement):
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addConsoleMessage):
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::pruneResources):
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
-        (WebCore::InspectorController::identifierForInitialRequest):
-        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
-        (WebCore::InspectorController::mainResourceFiredLoadEvent):
-        (WebCore::InspectorController::willSendRequest):
-        (WebCore::InspectorController::didReceiveResponse):
-        (WebCore::InspectorController::didReceiveContentLength):
-        (WebCore::InspectorController::didFinishLoading):
-        (WebCore::InspectorController::didFailLoading):
-        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
-        (WebCore::InspectorController::scriptImported):
-        (WebCore::InspectorController::didOpenDatabase):
-        (WebCore::InspectorController::didUseDOMStorage):
-        (WebCore::InspectorController::evaluateForTestInFrontend):
+2010-03-11  Philippe Normand  <pnormand@igalia.com>
 
-2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+        Reviewed by Gustavo Noronha Silva.
 
-        Fix Windows build.
+        [GStreamer] progressTimer never stopped after EOS
+        https://bugs.webkit.org/show_bug.cgi?id=36007
 
-        * dom/Document.idl:
+        Mark the pipeline as paused only if playback hasn't ended
+        yet. When didEnd() is triggered, the pipeline is paused (but
+        paused() still returns false) and a timeupdate event is fired,
+        those 2 conditions allow the HTMLMediaElement to stop the
+        progressTimer (in updatePlayerState, via mediaPlayerTimeChanged).
 
-2009-10-14  Joseph Pecoraro  <joepeck@webkit.org>
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::updateStates):
 
-        Reviewed by Adam Barth.
+2010-03-14  Chang Shu  <chang.shu@nokia.com>
 
-        [HTML5] Add document.head
-        https://bugs.webkit.org/show_bug.cgi?id=30232
+        Reviewed by Simon Hausmann.
 
-        Test is fast/dom/document-head.html
+        [Qt] [Symbian] Added block for ENABLE_SYMBIAN_DIALOG_PROVIDERS
+        on Symbian platform.
+        https://bugs.webkit.org/show_bug.cgi?id=35919
 
-        * dom/Document.idl: added readonly attribute head
+        * WebCore.pro:
 
-2009-10-14  Matt Mueller  <mattm@chromium.org>
+2010-03-14  Yael Aharon  <yael.aharon@nokia.com>
 
         Reviewed by Darin Adler.
 
-        Check FNonNeg after the unit switch to avoid valgrind uninitialised conditional reference in WebCore::CSSParser::validUnit.  See http://crbug.com/20939.
-        https://bugs.webkit.org/show_bug.cgi?id=30347
-        https://bugs.webkit.org/show_bug.cgi?id=22772
-
-        Covered by running LayoutTests/fast/css/invalid-percentage-property.html under valgrind.
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::validUnit):
-
-2009-10-14  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        Move scrolling code from FrameLoader to FrameView
-        https://bugs.webkit.org/show_bug.cgi?id=30370
-
-        This code is about controlling the Frame's view, not about loading
-        stuff into the frame.
+        Support for HTMLProgressElement
+        https://bugs.webkit.org/show_bug.cgi?id=35937
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::finishedParsing):
-        (WebCore::FrameLoader::scrollToAnchor):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollToFragment):
-        (WebCore::FrameView::scrollToAnchor):
-        * page/FrameView.h:
+        Added support for HTMLProgressElement.
+        This implementation is enabled only for Qt, because only RenderThemeQt
+        was modified to actually draw the progress element.
+        The labels attribute of the progress element will be implemented in a
+        separate patch.
 
-2009-10-14  Oliver Hunt  <oliver@apple.com>
+        Tests: fast/dom/HTMLProgressElement/progress-element.html
+               fast/dom/HTMLProgressElement/set-progress-properties.html
 
-        Reviewed by Geoff Garen.
-
-        Make typeinfo flags default to false
-        https://bugs.webkit.org/show_bug.cgi?id=30372
-        
-        Part 1. Reverse the HasStandardGetOwnPropertySlot flag.
-
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::createStructure):
-        (WebCore::DOMConstructorObject::createStructure):
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructure):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::createStructure):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructure):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/objc/objc_runtime.h:
-        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
-        * bridge/runtime_array.h:
-        (JSC::RuntimeArray::createStructure):
-        * bridge/runtime_method.h:
-        (JSC::RuntimeMethod::createStructure):
-        * bridge/runtime_object.h:
-        (JSC::RuntimeObjectImp::createStructure):
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSValueKeywords.in:
+        * css/html.css:
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        * html/HTMLElementsAllInOne.cpp:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLProgressElement.cpp: Added.
+        (WebCore::HTMLProgressElement::HTMLProgressElement):
+        (WebCore::HTMLProgressElement::create):
+        (WebCore::HTMLProgressElement::createRenderer):
+        (WebCore::HTMLProgressElement::formControlType):
+        (WebCore::HTMLProgressElement::parseMappedAttribute):
+        (WebCore::HTMLProgressElement::value):
+        (WebCore::HTMLProgressElement::setValue):
+        (WebCore::HTMLProgressElement::max):
+        (WebCore::HTMLProgressElement::setMax):
+        (WebCore::HTMLProgressElement::position):
+        * html/HTMLProgressElement.h: Added.
+        (WebCore::HTMLProgressElement::isOptionalFormControl):
+        * html/HTMLProgressElement.idl: Added.
+        * html/HTMLTagNames.in:
+        * page/DOMWindow.idl:
+        * platform/ThemeTypes.h:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustProgressBarStyle):
+        (WebCore::RenderThemeQt::paintProgressBar):
+        * platform/qt/RenderThemeQt.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isProgress):
+        * rendering/RenderProgress.cpp: Added.
+        (WebCore::RenderProgress::RenderProgress):
+        (WebCore::RenderProgress::baselinePosition):
+        (WebCore::RenderProgress::calcPrefWidths):
+        (WebCore::RenderProgress::layout):
+        (WebCore::RenderProgress::updateFromElement):
+        * rendering/RenderProgress.h: Added.
+        (WebCore::RenderProgress::renderName):
+        (WebCore::RenderProgress::isProgress):
+        (WebCore::toRenderProgress):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::paintBorderOnly):
+        (WebCore::RenderTheme::paintDecorations):
+        (WebCore::RenderTheme::adjustProgressBarStyle):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintProgressBar):
 
-2009-10-14  Adam Barth  <abarth@webkit.org>
+2010-03-14  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Darin Adler.
 
-        [XSSAuditor] Add an exception for local files
-        https://bugs.webkit.org/show_bug.cgi?id=30352
-
-        Reduce XSS auditor false positives by always letting pages load scripts
-        from their own host. We don't actually know of any false positives
-        that this prevents, but it seems like a good idea.
-
-        One subtly is that we don't add this exception for scripts that have a
-        query string because (1) URLs with query strings are more apt to
-        confuse servers and (2) it is much less common to load scripts with a
-        query string.
-
-        Tests: http/tests/security/xssAuditor/script-tag-with-source-same-host-with-query.html
-               http/tests/security/xssAuditor/script-tag-with-source-same-host.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-
-2009-10-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+        REGRESSION(r53287): drop event is not fired if dataTransfer.dropEffect is not explicitly set
+        https://bugs.webkit.org/show_bug.cgi?id=36095
 
-        Reviewed by George Staikos.
-
-        Kill virtual contextElement() method spread all over SVG code
-        https://bugs.webkit.org/show_bug.cgi?id=30183
-
-        Remove virtual contextElement() function from all SVG*Element classes, as all animated properties live in the
-        SVG*Element classes now instead of the SVGFitToViewBox / SVGURIReference / SVGExternalResourcesRequired
-        subclasses. This is a first step to working animVal support. More patches will follow that depend on this change.
-
-        Remove "This file is part of the KDE project" from several files, change my old mail adress wildfox -> zimmermann,
-        and remove vim modelines on all files I touched. No change in functionality, thus no new tests.
-
-        * svg/SVGAElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGAltGlyphElement.h: Remove virtual contextElement() method.
-        * svg/SVGAnimatedProperty.h:
-        (WebCore::::synchronize):
-        (WebCore::::startAnimation):
-        (WebCore::::stopAnimation):
-        * svg/SVGAnimationElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGCircleElement.h: Ditto.
-        * svg/SVGClipPathElement.h: Ditto.
-        * svg/SVGCursorElement.h: Ditto.
-        * svg/SVGDefsElement.h: Ditto.
-        * svg/SVGEllipseElement.h: Ditto.
-        * svg/SVGExternalResourcesRequired.h: Remove pure-virtual contextElement() method.
-        * svg/SVGFEImageElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGFELightElement.h: Remove virtual contextElement() method.
-        * svg/SVGFEMergeNodeElement.h: Ditto.
-        * svg/SVGFilterElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGFilterPrimitiveStandardAttributes.h: Remove virtual contextElement() method.
-        * svg/SVGFitToViewBox.cpp:
-        (WebCore::SVGFitToViewBox::parseViewBox): Add Document* parameter - we used to fetch the Document pointer from the context element.
-        (WebCore::SVGFitToViewBox::parseMappedAttribute): Ditto.
-        * svg/SVGFitToViewBox.h: Remove pure-virtual contextElement() method.
-        * svg/SVGFontElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGForeignObjectElement.h: Ditto.
-        * svg/SVGGElement.h: Ditto.
-        * svg/SVGGradientElement.h: Ditto.
-        * svg/SVGImageElement.h: Ditto.
-        * svg/SVGLineElement.h: Ditto.
-        * svg/SVGMPathElement.h: Ditto. Fix license indention.
-        * svg/SVGMarkerElement.cpp:
-        (WebCore::SVGMarkerElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        * svg/SVGMarkerElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGMaskElement.h: Ditto.
-        * svg/SVGPathElement.h: Ditto.
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        * svg/SVGPatternElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGPolyElement.cpp:
-        (WebCore::SVGPolyElement::updateAnimatedSVGAttribute): synchronizeProperty<...>() has been renamed to PropertySynchronizer<...>::synchronize().
-        * svg/SVGPolyElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGRectElement.h: Ditto.
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        * svg/SVGSVGElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGScriptElement.h: Ditto.
-        * svg/SVGSwitchElement.h: Ditto.
-        * svg/SVGSymbolElement.cpp:
-        (WebCore::SVGSymbolElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        * svg/SVGSymbolElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGTRefElement.h: Remove virtual contextElement() method.
-        * svg/SVGTextContentElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGTextPathElement.h: Remove virtual contextElement() method.
-        * svg/SVGUseElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGViewElement.cpp:
-        (WebCore::SVGViewElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        * svg/SVGViewElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGViewSpec.cpp:
-        (WebCore::SVGViewSpec::setViewBoxString): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        (WebCore::SVGViewSpec::parseViewSpec): Ditto.
-        * svg/SVGViewSpec.h: Devirtualize contextElement() method, it's the only place where contextElement() remains needed.
-
-2009-10-14  Dirk Schulze  <krit@webkit.org>
+        The issue here is that while dropEffect is meant to be initialized
+        to "none", the behaviour of the drag is differs between dragEffect
+        not being set and dragEffect being explicitly set to "none"
 
-        Reviewed by Nikolas Zimmermann.
-
-        SVG Masking with wrong offset
-        [https://bugs.webkit.org/show_bug.cgi?id=30325]
-
-        SVGMaskElement moves the mask image graphics context to the wrong location.
-        In objectBoundingBoxMode the maskDestRect gets translated. This transformation
-        is not used in the later calculation. Fix by consistenly calculating the translation
-        offsets from the final mask destination rect.
+        This patch corrects this behaviour by making Clipboard distinguish
+        between the initial "none" value of dropEffect and an explicit "none".
+        This alone is insufficient for correct behaviour, we also need to
+        resurrect the removed defaultOperationForDrag function, but we now
+        use the function only when dragEffect is uninitialized.  There are a
+        few tweaks to the behaviour of the defaultOperationForDrag as well
+        to ensure exactly the same set of outcomes for all cases that we
+        may hit it.
 
-        Test: svg/custom/mask-with-default-value.svg
-
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::drawMaskerContent):
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+        (WebCore::dragOpFromIEOp):
+        (WebCore::Clipboard::destinationOperation):
+        * dom/Clipboard.h:
+        (WebCore::Clipboard::dropEffect):
+        (WebCore::Clipboard::dropEffectIsUninitialized):
+        * page/DragController.cpp:
+        (WebCore::defaultOperationForDrag):
+        (WebCore::DragController::tryDHTMLDrag):
 
-2009-10-14  Kevin Decker  <kdecker@apple.com>
+2010-03-14  Antti Koivisto  <koivisto@iki.fi>
 
-        Rubberstamped by Jon Honeycutt.
-        
-        Export a few more showSubstituteImage() related methods.
+        Reviewed by Simon Hausmann.
         
-        * WebCore.base.exp:
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-10-14  Evan Martin  <evan@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=35146
+        Support tiled backing store
 
-        Reviewed by Darin Adler.
-
-        Stringify CSS units manually (without printf) to make the formatting
-        locale-insensitive and obey CSS spec with respect to large values.
+        Implements a basic tiled backing store mechanism. Tiles are created and 
+        deleted on demand. The page content is cached to the tiles. Tile content
+        is kept in sync with the document. Since the backing store covers area
+        larger than the currently visible viewport, the document can be scrolled
+        quickly without having to enter rendering tree painting.
         
-        https://bugs.webkit.org/show_bug.cgi?id=18994
-
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::appendCSSDouble):
-        (WebCore::formatWithUnits):
-        (WebCore::CSSPrimitiveValue::cssText):
+        The tile management code is platform independent. This patch has simple QPixmap
+        based tile implementation for Qt.
+        
+        The feature is behind ENABLE_TILED_BACKING_STORE flag.
 
-2009-10-14  Mark Seaborn  <mseaborn@google.com>
+        * WebCore.pri:
+        * WebCore.pro:
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::setTiledBackingStoreEnabled):
+        (WebCore::Frame::tiledBackingStorePaintBegin):
+        (WebCore::Frame::tiledBackingStorePaint):
+        (WebCore::Frame::tiledBackingStorePaintEnd):
+        (WebCore::Frame::tiledBackingStoreContentsRect):
+        * page/Frame.h:
+        (WebCore::Frame::tiledBackingStore):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::doDeferredRepaints):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setTiledBackingStoreEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::tiledBackingStoreEnabled):
+        * platform/graphics/Tile.h: Added.
+        (WebCore::Tile::create):
+        (WebCore::Tile::coordinate):
+        (WebCore::Tile::rect):
+        * platform/graphics/TiledBackingStore.cpp: Added.
+        (WebCore::TiledBackingStore::TiledBackingStore):
+        (WebCore::TiledBackingStore::~TiledBackingStore):
+        (WebCore::TiledBackingStore::invalidate):
+        (WebCore::TiledBackingStore::updateTileBuffers):
+        (WebCore::TiledBackingStore::paint):
+        (WebCore::TiledBackingStore::viewportChanged):
+        (WebCore::TiledBackingStore::setContentsScale):
+        (WebCore::TiledBackingStore::tileDistance):
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::dropOverhangingTiles):
+        (WebCore::TiledBackingStore::dropTilesOutsideRect):
+        (WebCore::TiledBackingStore::tileAt):
+        (WebCore::TiledBackingStore::setTile):
+        (WebCore::TiledBackingStore::removeTile):
+        (WebCore::TiledBackingStore::mapToContents):
+        (WebCore::TiledBackingStore::mapFromContents):
+        (WebCore::TiledBackingStore::contentsRect):
+        (WebCore::TiledBackingStore::tileRectForCoordinate):
+        (WebCore::TiledBackingStore::tileCoordinateForPoint):
+        (WebCore::TiledBackingStore::startTileBufferUpdateTimer):
+        (WebCore::TiledBackingStore::tileBufferUpdateTimerFired):
+        (WebCore::TiledBackingStore::startTileCreationTimer):
+        (WebCore::TiledBackingStore::tileCreationTimerFired):
+        (WebCore::TiledBackingStore::setContentsFrozen):
+        * platform/graphics/TiledBackingStore.h: Added.
+        (WebCore::TiledBackingStore::contentsScale):
+        (WebCore::TiledBackingStore::contentsFrozen):
+        * platform/graphics/TiledBackingStoreClient.h: Added.
+        * platform/graphics/qt/TileQt.cpp: Added.
+        (WebCore::checkeredPixmap):
+        (WebCore::Tile::Tile):
+        (WebCore::Tile::~Tile):
+        (WebCore::Tile::isDirty):
+        (WebCore::Tile::isReadyToPaint):
+        (WebCore::Tile::invalidate):
+        (WebCore::Tile::updateBackBuffer):
+        (WebCore::Tile::swapBackBufferToFront):
+        (WebCore::Tile::paint):
+        (WebCore::Tile::paintCheckerPattern):
+
+2010-03-14  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Darin Adler.
 
-        Check error return value in Perl build script
-        https://bugs.webkit.org/show_bug.cgi?id=30316
-
-        * css/makevalues.pl: Die if gperf fails.
+        WebCore part of removing support for legacy versions of Core Graphics
 
-2009-10-14  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Nikolas Zimmermann.
+        * WebCore.vcproj/WebCore.vcproj: Removed FontDatabase.{cpp,h}
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs): Removed call to wkCanCreateCGFontWithLOGFONT(),
+        as it is now always true.
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::createFontPlatformData): Ditto.
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData): Updated for
+        the removal of m_cgFont.
+        (WebCore::FontCustomPlatformData::fontPlatformData): Removed call to
+        wkCanCreateCGFontWithLOGFONT(), as it is now always true.
+        (WebCore::createFontCustomPlatformData): Ditto. Also updated for change to
+        the FontCustomPlatformData constructor.
+        * platform/graphics/win/FontCustomPlatformData.h: Removed m_cgFont member.
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData): Removed cgFont
+        parameter.
+        * platform/graphics/win/FontDatabase.cpp: Removed.
+        * platform/graphics/win/FontDatabase.h: Removed.
+        * platform/graphics/win/FontPlatformDataCGWin.cpp:
+        (WebCore::FontPlatformData::platformDataInit): Removed call to
+        wkCanCreateCGFontWithLOGFONT(), as it is now always true.
+        * platform/win/TemporaryLinkStubs.cpp:
+        (WebCore::populateFontDatabase): Removed stub.
 
-        SVG wrong filterRegions for userSpaceOnUse and percentage values
-        [https://bugs.webkit.org/show_bug.cgi?id=30330]
+2010-03-14  Jessie Berlin  <jberlin@webkit.org>
 
-        Some clean-up of the SVG filter calculation code. This clean-up
-        also fixes the problem with percentage and userSpaceInUse mode.
+        Reviewed by Sam Weinig.
 
-        Test: svg/filters/subRegion-in-userSpace.svg
+        "event.ctrlKey" is always false when dragging an element with "ctrl" key down
+        https://bugs.webkit.org/show_bug.cgi?id=17113
 
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::FilterEffect):
-        * platform/graphics/filters/FilterEffect.h:
-        * rendering/SVGRenderSupport.cpp:
-        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
-        * svg/SVGFilterElement.cpp:
-        (WebCore::SVGFilterElement::buildFilter):
-        (WebCore::SVGFilterElement::canvasResource):
-        * svg/SVGFilterElement.h:
-        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
-        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes):
-        * svg/graphics/SVGResourceFilter.cpp:
-        (WebCore::SVGResourceFilter::SVGResourceFilter):
-        (WebCore::SVGResourceFilter::~SVGResourceFilter):
-        (WebCore::SVGResourceFilter::addFilterEffect):
-        (WebCore::SVGResourceFilter::prepareFilter):
-        * svg/graphics/SVGResourceFilter.h:
-        (WebCore::SVGResourceFilter::create):
-        * svg/graphics/filters/SVGFilter.cpp:
-        (WebCore::SVGFilter::SVGFilter):
-        (WebCore::SVGFilter::calculateEffectSubRegion):
-        (WebCore::SVGFilter::create):
-        * svg/graphics/filters/SVGFilter.h:
+        No new tests.
 
-2009-10-14  Chris Marrin  <cmarrin@apple.com>
+        * page/DragController.cpp:
+        (WebCore::createMouseEvent):
+        Use the current state of the shift, ctrl, alt, and meta keys when creating the drag mouse event.
 
-        The last change fixed the problem, removing diagnostic printfs.
+2010-03-13  Antonio Gomes  <tonikitoo@webkit.org>
 
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        Not reviewed identation fix.
 
-2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+        * manual-tests/spatial-navigation/spatial-navigation-test-cases.html:
 
-        CURL build fix for versions < 7.18.
+2010-03-13  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-        * platform/network/curl/ResourceHandleCurl.cpp:
-        (WebCore::ResourceHandle::setDefersLoading):
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::ResourceHandleManager::initializeHandle):
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-14  Chris Marrin  <cmarrin@apple.com>
+        [Qt] GraphicsLayer: Opacity change from zero to non-zero doesn't always have effect with AC
+        https://bugs.webkit.org/show_bug.cgi?id=36034
 
-        One more round of changes to figure out why the webgl 
-        tests are crashing on the build bot. Here I am trying
-        to see if we can create a software renderer. I am also
-        printing the found pixel formats.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::OpacityAnimationQt::applyFrame):
 
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
+2010-03-13  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-2009-10-14  Yael Aharon  <yael.aharon@nokia.com>
- 
-        Reviewed by Simon Hausmann.
- 
-        Enabling NPAPI plugin support on Qt Webkit for S60 platform
-        https://bugs.webkit.org/show_bug.cgi?id=29302
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Also implemented by Mahesh Kulkarni<mahesh.kulkarni@nokia.com>, 
-        Rohini Ananth <rohini.ananth@nokia.com> and help from Norbert Lesr
-        <norbert.leser@nokia.com>
-         
-        * WebCore.pro:
-        Enabling ENABLE_NETSCAPE_PLUGIN_API for S60 and added S60 specific 
-        new plugin files to be compiled under symbian: macro
+        [Qt] GraphicsLayer: Opacity transitions end with begin value
+        https://bugs.webkit.org/show_bug.cgi?id=36019
 
-        * bridge/npapi.h:
-        Added NPEvent and NPRegion definition for Symbian
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::AnimationQt::updateCurrentTime):
 
-        * plugins/PluginPackage.h:
-        Added S60 specific plugin interface and plugin loader variables
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::unload): Added !PLATFORM(SYMBIAN) macro.
-        Default implementation to be used only for non-symbian platform
-        * plugins/PluginDatabase.cpp:
-        Macro !SYMBIAN checking
-        * plugins/PluginView.h:
-        Add Symbian to platforms that support setNPWindowIfNeeded
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::setFrameRect): Add Symbian to platforms that
-        call setNPWindowRect from setFrameRect
-         
-        Added folder 'symbian' which contains implementation files for S60
-        platform-specific NPAPI plugin functionality, under /plugins folder
-        * plugins/symbian
-        * plugins/symbian/npinterface.h:
-        Plugin Interface to be implemented by S60 NPAPI plugins 
-        * plugins/symbian/PluginContainerSymbian.h:
-        * plugins/symbian/PluginContainerSymbian.cpp:
-        * plugins/symbian/PluginDatabaseSymbian.cpp:
-        * plugins/symbian/PluginViewSymbian.cpp:
-        * plugins/symbian/PluginPackageSymbian.cpp:
+2010-03-13  Dirk Schulze  <krit@webkit.org>
 
-2009-10-14  Chris Marrin  <cmarrin@apple.com>
+        No review, rolling out r55927.
+        http://trac.webkit.org/changeset/55927
+        https://bugs.webkit.org/show_bug.cgi?id=35793
 
-        More changes to figure out why the webgl tests are crashing on the build bot.
+        Breaks Gtk build bots.
 
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
-
-2009-10-14  Victor Wang  <victorw@chromium.org>
-
-        Reviewed by David Hyatt.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::setPreload):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        Round non-integer line height values.
+2010-03-12  Dirk Schulze  <krit@webkit.org>
 
-        Change webkit to rounding non-integer line height values
-        instead of truncating them. This fixes a layout test
-        failure on Windows and matches the calculation in IE and Firefox. 
+        Reviewed by Nikolas Zimmermann.
 
-        https://bugs.webkit.org/show_bug.cgi?id=24434
+        SVG Glyphs - transform path not context
+        https://bugs.webkit.org/show_bug.cgi?id=36070
 
-        Test: fast/css/line-height-rounding.html
-              fast/forms/textarea-scrollbar-height.htm
+        SVGFont should transform the path of a glyph, not the context. Modifying
+        the context causes wrong gradient transformations. This bug doesn't
+        influence CG because we generally fill or stroke texts with a mask image.
+        All other platforms provide a direct way to make the drawings.
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
-        * rendering/RenderBR.cpp:
-        (WebCore::RenderBR::lineHeight):
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::computedLineHeight):
+        * svg/SVGFont.cpp:
+        (WebCore::Font::drawTextUsingSVGFont):
 
-2009-10-13  Kelly Norton  <knorton@google.com>
+2010-03-12  Beth Dakin  <bdakin@apple.com>
 
-        Reviewed by Pavel Feldman.
+        Reviewed by Simon Fraser.
 
-        Removes the persistent setting for InspectorTimelineAgent and renames timeline related
-        interfaces to be more consistent with the JavaScript profiler.
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=34942 Fullscreen 
+        API naming is inconsistent
+        -and corresponding-
+        <rdar://problem/7729165>
 
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::startTimelineProfiler):
-        (WebCore::InspectorBackend::stopTimelineProfiler):
-        (WebCore::InspectorBackend::timelineProfilerEnabled):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setFrontendProxyObject):
-        (WebCore::InspectorController::startTimelineProfiler):
-        (WebCore::InspectorController::stopTimelineProfiler):
-        (WebCore::InspectorController::timelineProfilerEnabled):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::timelineProfilerWasStarted):
-        (WebCore::InspectorFrontend::timelineProfilerWasStopped):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/TimelineAgent.js:
-        (WebInspector.timelineProfilerWasStarted):
-        (WebInspector.timelineProfilerWasStopped):
+        This patch changes all occurrences of "fullScreen" to the more 
+        popular "fullscreen." webkitEnterFullScreen and 
+        webkitExitFullScreen have been maintained for now for backwards 
+        compatibility. 
 
-2009-10-01  Yong Li  <yong.li@torchmobile.com>
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::webkitEnterFullscreen):
+        (WebCore::HTMLVideoElement::webkitExitFullscreen):
+        * html/HTMLVideoElement.h:
+        (WebCore::HTMLVideoElement::webkitEnterFullScreen):
+        (WebCore::HTMLVideoElement::webkitExitFullScreen):
+        * html/HTMLVideoElement.idl:
+        * platform/graphics/mac/MediaPlayerProxy.h:
 
-        Reviewed by Adele Peterson.
+2010-03-12  James Robinson  <jamesr@chromium.org>
 
-        Fix crash when loading invalid image data
-        https://bugs.webkit.org/show_bug.cgi?id=29980
+        Reviewed by Adam Barth.
 
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::setImageSizeForAltText):
+        Add virtual destructor to DOMWrapperWorld
+        https://bugs.webkit.org/show_bug.cgi?id=36077
 
-2009-10-09  Stephen White  <senorblanco@chromium.org>
+        DOMWrapperWorld is RefCounted<DOMWrapperWorld>.  IsolatedWorld
+        inherits from DOMWrapperWorld and has member variables
+        with destructors, so DOMWrapperWorld needs to have a declared virtual
+        d'tor to ensure that its derived class's destructors are called.
 
-        Reviewed by Eric Seidel.
+        No new tests, no change in behavior
 
-        Fix for NULL ptr deref in canvas's toDataURL().
-        https://bugs.webkit.org/show_bug.cgi?id=30254
+        * bindings/v8/DOMWrapperWorld.h:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
 
-        Test: fast/canvas/canvas-toDataURL-crash.html
 
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::toDataURL):
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
 
-2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Oliver Hunt.
 
-        Not reviewed, reverting r49558 since it broke profiler tests.
+        Bug 36075 - Clean up screwyness re static string impls & Identifiers.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30328
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::~StringImpl): Add ASSERT
+        (WebCore::StringImpl::sharedBuffer): Add ASSERT
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::setHash): Add ASSERT
+        (WebCore::StringImpl::isStatic): added.
 
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getProfileHeaders):
-        (WebCore::InspectorBackend::getProfile):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addProfile):
-        (WebCore::InspectorController::getProfileHeaders):
-        (WebCore::InspectorController::getProfile):
-        (WebCore::InspectorController::createProfileHeader):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addProfileHeader):
-        (WebCore::InspectorFrontend::didGetProfileHeaders):
-        (WebCore::InspectorFrontend::didGetProfile):
-        * inspector/InspectorFrontend.h:
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::ProfileNodeClass):
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView.profileCallback):
-        (WebInspector.ProfileView):
-        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
-        (WebInspector.ProfileView.prototype._assignParentsInProfile):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addProfileHeader):
+2010-03-12  Enrica Casucci  <enrica@apple.com>
 
-2009-10-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+        Reviewed by Simon Fraser.
 
-        Reviewed by Simon Hausmann.
+        Content of 3D tests appears at the bottom right corner sometimes.
+        <rdar://problem/7556244>
+        <https://bugs.webkit.org/show_bug.cgi?id=36027>
 
-        ImageDecoderQt: Minor tweaks to the decoder
+        There were two problems to solve here:
+        - the incorrect anchoring of the rootChildLayer that was causing the composited
+          content to be positioned incorrectly
+        - the failure to paint the non composited content into the backing store when
+          animating composited content.
+          
+        The first problem has been solved by leaving the original anchor point for the
+        rootChildLayer and splitting the tasks of clipping and scrolling using two separate layers.
+        The second problem has been solved leveraging the knowledge that WebView has of the dirty region
+        of the backing store to pass this information to the layer renderer. This allows the renderer to force
+        a paint into the backing store before moving to the compositing.
+        
+        Tests: compositing/geometry/horizontal-scroll-composited.html
+               compositing/geometry/vertical-scroll-composited.html
+
+        * manual-tests/win/horizontal-scroll-composited.html: Removed. This is now a layout test.
+        * manual-tests/win/milliondollar.html: Added.
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::WKCACFLayerRenderer): Added initialization of dirty flag.
+        (WebCore::WKCACFLayerRenderer::setScrollFrame): 
+        (WebCore::WKCACFLayerRenderer::updateScrollFrame): Updated to resize and position the clip and scroll layers.
+        (WebCore::WKCACFLayerRenderer::setRootChildLayer):
+        (WebCore::WKCACFLayerRenderer::createRenderer): Added new layer hierarchy.
+        (WebCore::WKCACFLayerRenderer::destroyRenderer): Remove clip layer on destroy.
+        (WebCore::WKCACFLayerRenderer::resize):
+        (WebCore::WKCACFLayerRenderer::paint): Forcing paint massage to trigger paint into the backing store.
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        (WebCore::WKCACFLayerRenderer::setBackingStoreDirty): Added.
+
+2010-03-12  Robert Hogan  <robert@webkit.org>
 
-        - Only cache the data when we start to use it.
-        - Start with a repetition count of none for normal images.
-        - Do not use canRead as this will trigger parsing of the full image
-        - Cope with a GIF failing to decode the first frame, do not
-          set m_failed to true if decoding the first frame failed
-        - Inform the QImageReader about the format that was detected
-        - Always create a ImageDecoderQt when when we have more
-        than four byte.
+        Not reviewed, build fix.
 
+        Revert http://trac.webkit.org/projects/webkit/changeset/55374 which broke
+        the !ENABLE(DATABASE) build on all platforms when attempting to fix the
+        --minimal build on Qt.
 
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoder::create): Always create QImageReader for a significant speed up
-        (WebCore::ImageDecoderQt::ImageDecoderQt): Initialize m_repetitionCount to cAnimationNone
-        (WebCore::ImageDecoderQt::setData): Only call ImageDecoder::setData when everything has been received
-        (WebCore::ImageDecoderQt::isSizeAvailable): Do not check m_failed twice.
-        (WebCore::ImageDecoderQt::filenameExtension): Convert from QByteArray to String
-        (WebCore::ImageDecoderQt::frameBufferAtIndex): Check for m_failed before trying to decode
-        (WebCore::ImageDecoderQt::internalDecodeSize): Fail if the size is QSize()
-        (WebCore::ImageDecoderQt::forceLoadEverything): Handle the case were decoding the first frame fails
-        * platform/graphics/qt/ImageDecoderQt.h: Change the m_format type
-
-2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+        Support for SQLite now seems to be non-negotiable for the Qt build but making
+        it mandatory requires review, so re-break --minimal Qt build for now.
 
-        Reviewed by Pavel Feldman.
+        Qt build issue now tracked at https://bugs.webkit.org/show_bug.cgi?id=36073
 
-        Web Inspector: Migrate profiles to the injected script-based schema.
+        * page/GeolocationPositionCache.cpp:
 
-        https://bugs.webkit.org/show_bug.cgi?id=30328
+2010-03-12  Dan Bernstein  <mitz@apple.com>
 
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getProfileHeaders):
-        (WebCore::InspectorBackend::getProfile):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addProfile):
-        (WebCore::InspectorController::getProfileHeaders):
-        (WebCore::InspectorController::getProfile):
-        (WebCore::InspectorController::createProfileHeader):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addProfileHeader):
-        (WebCore::InspectorFrontend::didGetProfileHeaders):
-        (WebCore::InspectorFrontend::didGetProfile):
-        * inspector/InspectorFrontend.h:
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::ProfileNodeClass):
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView.profileCallback):
-        (WebInspector.ProfileView):
-        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
-        (WebInspector.ProfileView.prototype._assignParentsInProfile):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addProfileHeader):
+        Reviewed by Alexey Proskuryakov.
 
-2009-10-13  Yury Semikhatsky  <yurys@chromium.org>
+        <rdar://problem/7709115> REGRESSION: toolbar is missing at http://www.glom.org/
+        https://bugs.webkit.org/show_bug.cgi?id=35507
 
-        Reviewed by Pavel Feldman.
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet): Extend the change made in
+        <http://trac.webkit.org/changeset/48818> to detect the two variants of
+        KHTMLFixes.css in @import rules as well as in <link> elements.
 
-        Don't collect call frame properties until they're needed for completion.
+2010-03-12  Gavin Barraclough  <barraclough@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30334
+        Reviewed by Geoff Garen.
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getCompletions): if call frame id is specified and the expression is empty collect frame properties.
-        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain): don't send call frame properties until they're needed.
-        * inspector/front-end/ScriptsPanel.js:
+        Bug 36052 - [Qt] REGRESSION(55878) 63 test cases crash
 
-2009-10-13  Yongjun Zhang  <yongjun.zhang@nokia.com>
+        r55878 changed UStringImpl::empty()->characters() to be non-null,
+        so TextBreakIteratorQt.cpp now should check the length of strings
+        (previously was assuming all strings with a non-null data pointer
+        had a length of at least 1).
 
-        Reviewed by Ariya Hidayat.
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        (WebCore::wordBreakIterator):
+        (WebCore::characterBreakIterator):
+        (WebCore::lineBreakIterator):
+        (WebCore::sentenceBreakIterator):
 
-        https://bugs.webkit.org/show_bug.cgi?id=29106
-        [Qt] make CachedResourceHandle.h compile in winscw Symbian compiler.
+2010-03-12  Dirk Schulze  <krit@webkit.org>
 
-        Don't inline constructor CachedResourceHandle<T>(R*) to stop winscw
-        compiler aggressively resolve inheritance of class R.  
-        
-        The winscw compiler bug is reported at:
-        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
-        
-        The change should be reverted when the above bug is fixed in winscw compiler.
+        Reviewed by Nikolas Zimmermann.
 
-        * loader/CachedResourceHandle.h:
-        (WebCore::::CachedResourceHandle):
+        SVG fallback color doesn't work for bogus gradients.
+        https://bugs.webkit.org/show_bug.cgi?id=35479
 
-2009-10-13  Dimitri Glazkov  <dglazkov@chromium.org>
+        Use a given fallback color on ignored gradients if present. Gradients
+        must be ignored, if one dimension of the objects boundingBox is zero.
 
-        No review, rolling out r49554, because it broke Win and Chromium builds.
-        http://trac.webkit.org/changeset/49554
+        Test: svg/custom/gradient-with-1d-boundingbox.svg
 
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::cssText):
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::SVGPaintServer::strokePaintServer):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
 
-2009-10-13  Evan Martin  <evan@chromium.org>
+2010-03-12  David Hyatt  <hyatt@apple.com>
 
-        Reviewed by Adam Barth.
+        Reviewed by Dan Bernstein.
 
-        Stringify CSS units manually (without printf) to make the formatting
-        locale-insensitive and obey CSS spec with respect to large values.
+        https://bugs.webkit.org/show_bug.cgi?id=36069
         
-        https://bugs.webkit.org/show_bug.cgi?id=18994
+        Eliminate InlineRunBox.
 
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::appendCSSDouble):
-        (WebCore::formatWithUnits):
-        (WebCore::CSSPrimitiveValue::cssText):
-
-2009-10-13  Evan Martin  <evan@chromium.org>
-
-        Reviewed by David Levin.
-
-        Make grippy lines vertical on horizontal scrollbars in Linux Chrome.
-        While we're rebaselining scrollbars, fix an off by one in the vertical
-        scrollbar rendering too.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30319
-
-        Tests: this is covered by every pixel test involving scrollbars.
-
-        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
-        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
-
-2009-10-13  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by David Hyatt.
-
-        Fix issue where clientX and clientY on MouseEvents were wrong when
-        the page was zoomed and scrolled.
-
-        Test: fast/events/clientXY-in-zoom-and-scroll.html
-
-        * dom/MouseRelatedEvent.cpp:
-        (WebCore::contentsX): Take page zoom into account.
-        (WebCore::contentsY): Ditto.
-
-2009-10-13  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Change the order of arguments on some of the user stylesheet/script functions.  Split the removal functions
-        out into separate ones for scripts and stylesheets.
-
-        * WebCore.base.exp:
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::addUserScriptToWorld):
-        (WebCore::PageGroup::addUserStyleSheetToWorld):
-        (WebCore::PageGroup::removeUserScriptFromWorld):
-        (WebCore::PageGroup::removeUserStyleSheetFromWorld):
-        (WebCore::PageGroup::removeUserScriptsFromWorld):
-        (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
-        * page/PageGroup.h:
-        (WebCore::PageGroup::userScripts):
-        (WebCore::PageGroup::userStyleSheets):
-
-2009-10-13  Evan Martin  <evan@chromium.org>
-
-        Reviewed by Dmitry Titov.
-
-        Chrome's "Skia" theme paints select controls backwards in RTL.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30320
-
-        Test: fast/text/international/bidi-menulist.html
-        (The test is about something else, but it includes RTL selects.)
-
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintMenuList): flip the arrow position in RTL case.
-
-2009-10-13  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::adjustPosition):
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::InlineFlowBox):
+        (WebCore::InlineFlowBox::prevLineBox):
+        (WebCore::InlineFlowBox::nextLineBox):
+        (WebCore::InlineFlowBox::setNextLineBox):
+        (WebCore::InlineFlowBox::setPreviousLineBox):
+        * rendering/InlineRunBox.h: Removed.
+        * rendering/InlineTextBox.h:
+        (WebCore::InlineTextBox::InlineTextBox):
+        (WebCore::InlineTextBox::prevTextBox):
+        (WebCore::InlineTextBox::nextTextBox):
+        (WebCore::InlineTextBox::setNextTextBox):
+        (WebCore::InlineTextBox::setPreviousTextBox):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::destroy):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::destroy):
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::absoluteQuads):
+        (WebCore::RenderInline::linesBoundingBox):
+        (WebCore::RenderInline::linesVisibleOverflowBoundingBox):
+        (WebCore::RenderInline::addFocusRingRects):
+        (WebCore::RenderInline::paintOutline):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::deleteLineBoxTree):
+        (WebCore::RenderLineBoxList::extractLineBox):
+        (WebCore::RenderLineBoxList::attachLineBox):
+        (WebCore::RenderLineBoxList::removeLineBox):
+        (WebCore::RenderLineBoxList::deleteLineBoxes):
+        (WebCore::RenderLineBoxList::dirtyLineBoxes):
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+        (WebCore::RenderLineBoxList::checkConsistency):
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::absoluteRects):
+        (WebCore::RenderSVGInline::absoluteQuads):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+        (WebCore::RenderSVGText::objectBoundingBox):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::extractTextBox):
+        (WebCore::RenderText::attachTextBox):
+        (WebCore::RenderText::removeTextBox):
+        (WebCore::RenderText::createInlineTextBox):
+        (WebCore::RenderText::positionLineBox):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::nextRootBox):
+        (WebCore::RootInlineBox::prevRootBox):
 
-        https://bugs.webkit.org/show_bug.cgi?id=30318
-        ScriptExecutionContext is not anymore needed to create an EventListener - remove old code.
-        It's a followup to r48884. It removed the need to pass the ScritpExecutionContext
-        into EventListener constructor but did not remove the code pulling ScriptExecutionContext.
+2010-03-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Tests:
-        Test adds event listener to a DocumentType Node which is created without a document
-        and then dispatches the event after attaching a node to the tree. Event
-        should fire when node is attached to the tree.
+        Reviewed by Eric Carlson.
 
-        * fast/events/add-event-without-document-expected.txt: Added.
-        * fast/events/add-event-without-document.html: Added.
+        media/video-preload.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=35793
 
-        All changes in files below are the same - remove the code that calls
-        EventTarget::scriptExecutionContext and checks it for NULL.
+        Only effectively load, and start buffering when playing, or when
+        the preload attribute is set.
 
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDesktopNotificationsCustom.cpp:
-        (WebCore::JSNotification::addEventListener):
-        (WebCore::):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/js/JSWebSocketCustom.cpp:
-        (WebCore::JSWebSocket::addEventListener):
-        (WebCore::JSWebSocket::removeEventListener):
+        Test: media/video-preload.html
 
-2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::commitLoad):
+        (WebCore::MediaPlayerPrivate::prepareToPlay):
+        (WebCore::MediaPlayerPrivate::setPreload):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        Reviewed by David Levin.
+2010-03-12  Dmitry Titov  <dimich@chromium.org>
 
-        Enable SHARED_WORKERS for Chromium
-        https://bugs.webkit.org/show_bug.cgi?id=30289
+        Not reviewed, build fix.
 
-        Cleaned up bitrot in SharedWorker V8 bindings.
+        Reverts 55920 and 55921. Landing for Jian Li.
 
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
         * WebCore.gypi:
-        Removed default implementation of SharedWorkerRepository so Chromium can provide its own.
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        Added V8SharedWorkerContext.cpp.
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        Added case statements for SHAREDWORKER and SHAREDWORKERCONTEXT.
-        * bindings/v8/V8Index.cpp:
-        Now includes V8SharedWorkerContext.h to allow supporting SharedWorkers.
+        * WebCore.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMFormDataCustom.cpp: Removed.
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/scripts/CodeGeneratorJS.pm:
         * bindings/v8/V8Index.h:
-        Added definition for SHAREDWORKERCONTEXT wrapper.
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        Added includes for SharedWorker.h and SharedWorkerContext.h.
-        * bindings/v8/custom/V8CustomBinding.h:
-        Reorganized Worker field indexes to be clearer, and fixed mismatch in worker field index.
-        Also added field indexes for SharedWorkers.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        Added runtime enabler for the SharedWorker constructor.
-        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        Cleaned up bitrot (various APIs have changed since this file was written).
+        * bindings/v8/custom/V8DOMFormDataCustom.cpp: Removed.
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::sendCallback):
+        * html/DOMFormData.idl: Removed.
         * page/DOMWindow.idl:
-        Added EnabledAtRuntime flag to window.SharedWorker.
 
-2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+2010-03-12  Jakob Petsovits  <jpetsovits@rim.com>
 
-        Reviewed by Brady Eidson.
+        Reviewed by Dirk Schulze.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30345
-        HTTP tests for credential handling fail on Tiger
+        [OpenVG] Add support for drawing text to PainterOpenVG
+        https://bugs.webkit.org/show_bug.cgi?id=35581
 
-        We cannot prevent NSURLConnection from doing its credentil handling on Tiger anyway; so
-        let it do its work without intervention. Once again, we pass explicitly passed credentials
-        in URL, fixing regressions from Safari 3.
+        Doesn't come with any actual font classes, as OpenVG
+        by itself doesn't provide any access to platform fonts
+        but just the means to draw glyphs that have been loaded
+        manually before.
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceHandle::receivedCredential):
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::PlatformPainterState::PlatformPainterState):
+        (WebCore::PlatformPainterState::copyPaintState):
+        (WebCore::PainterOpenVG::textDrawingMode):
+        (WebCore::PainterOpenVG::setTextDrawingMode):
+        (WebCore::PainterOpenVG::drawText):
+        * platform/graphics/openvg/PainterOpenVG.h:
 
-2009-10-13  Roland Steiner  <rolandsteiner@google.com>
+2010-03-12  Jakob Petsovits  <jpetsovits@rim.com>
 
-        Reviewed by Adam Barth.
-
-        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
-
-        Reworked and added to the getter/setter interface in ChromiumDataObject:
-        - added contains...() methods to just query the state
-        - added containsValid...URL() methods for URL data members
-        - removed takeFileNames() as this was too type-dependent
-        - changed return type of fileNames() to Vector<String>
-        - added interface methods to allow appending to and iteration over file names
+        Reviewed by Dirk Schulze.
 
-        No new tests (no functional behavior changed).
+        [OpenVG] Use masks to implement non-rectilinear clipping
+        https://bugs.webkit.org/show_bug.cgi?id=35544
 
-        * platform/chromium/ChromiumDataObject.h:
-        (WebCore::ChromiumDataObject::containsMainURL):
-        (WebCore::ChromiumDataObject::containsValidMainURL):
-        (WebCore::ChromiumDataObject::containsMainURLTitle):
-        (WebCore::ChromiumDataObject::containsTextPlain):
-        (WebCore::ChromiumDataObject::containsTextHTML):
-        (WebCore::ChromiumDataObject::containsHTMLBaseURL):
-        (WebCore::ChromiumDataObject::containsValidHTMLBaseURL):
-        (WebCore::ChromiumDataObject::containsContent):
-        (WebCore::ChromiumDataObject::containsContentFileExtension):
-        (WebCore::ChromiumDataObject::containsContentFileName):
-        (WebCore::ChromiumDataObject::setContentFileName):
-        (WebCore::ChromiumDataObject::containsFileNames):
-        (WebCore::ChromiumDataObject::fileNames):
-        (WebCore::ChromiumDataObject::clearFileNames):
-        (WebCore::ChromiumDataObject::countFileNames):
-        (WebCore::ChromiumDataObject::fileNameAt):
-        (WebCore::ChromiumDataObject::setFileNames):
-        (WebCore::ChromiumDataObject::appendToFileNames):
-        (WebCore::ChromiumDataObject::popFileName):
-
-2009-10-13  Simon Fraser  <simon.fraser@apple.com>
-
-        Temporary debugging changes to figure out why the webgl tests are crashing on the build bot.
+        Requires some additional context switching logic to
+        make sure the right context is current when dealing
+        with the mask, because we don't store it by ourselves.
 
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        Initial version of this code was written by
+        Eli Fidler <efidler@rim.com>, I did a couple of
+        bug fixes and efficiency improvements since then.
 
-2009-10-13  Simon Fraser  <simon.fraser@apple.com>
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::PlatformPainterState::PlatformPainterState):
+        (WebCore::PlatformPainterState::~PlatformPainterState):
+        (WebCore::PlatformPainterState::maskingEnabled):
+        (WebCore::PlatformPainterState::applyState):
+        (WebCore::PlatformPainterState::saveMaskIfNecessary):
+        (WebCore::PainterOpenVG::intersectClipRect):
+        (WebCore::PainterOpenVG::clipPath):
+        (WebCore::PainterOpenVG::save):
+        * platform/graphics/openvg/PainterOpenVG.h:
+        (WebCore::PainterOpenVG::):
+        * platform/graphics/openvg/SurfaceOpenVG.cpp:
+        (WebCore::SurfaceOpenVG::makeCurrent):
+        (WebCore::SurfaceOpenVG::makeCompatibleCurrent):
+        * platform/graphics/openvg/SurfaceOpenVG.h:
+        (WebCore::SurfaceOpenVG::):
+
+2010-03-12  Jian Li  <jianli@chromium.org>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by Sam Weinig.
 
-        Visibility:visible inside a compositing layer doesn't make the element visible
-        https://bugs.webkit.org/show_bug.cgi?id=30339
+        Add DOMFormData.idl to expose FormData interface.
+        https://bugs.webkit.org/show_bug.cgi?id=36024
         
-        When deciding if a layer had any renderable content, RenderLayerBacking::paintIntoLayer()
-        only consulted hasVisibleContent(), which does not take into a account child layers which
-        may be visible. We also have to consult hasVisibleDescendant() as well.
-
-        Test: compositing/compositing-visible-descendant.html
-
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::hasVisibleDescendant):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::paintIntoLayer):
-
-2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Refactor ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
-        https://bugs.webkit.org/show_bug.cgi?id=30278
-
-        Move the definition of ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 
-        from the make system into common code.
-
-        Enable ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH if NETSCAPE_PLUGIN_API 
-        support is not enabled.
+        The implementation is based on XMLHttpRequest 2 spec:
+        http://dev.w3.org/2006/webapi/XMLHttpRequest-2/#formdata
 
-        Remove notImplemented() from PluginPackageNone.cpp and 
-        PluginDataNone.cpp make them just empty functions.
+        Test: http/tests/local/send-form-data.html
 
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
         * GNUmakefile.am:
-        * WebCore.pro:
-        * plugins/PluginDataNone.cpp:
-        (WebCore::PluginData::initPlugins):
-        (WebCore::PluginData::refresh):
-        * plugins/PluginPackageNone.cpp:
-        (WebCore::PluginPackage::determineQuirks):
-        (WebCore::PluginPackage::fetchInfo):
-        (WebCore::PluginPackage::load):
-
-2009-10-13  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30150
-        <rdar://problem/7283540> REGRESSION: Crash when accessing clipboardData.types
-
-        Test: editing/pasteboard/crash-accessing-clipboardData-types.html
-
-        * platform/mac/ClipboardMac.mm: (WebCore::addHTMLClipboardTypesForCocoaType): The String
-        class doesn't have operator bool, it's operator NSString* that is invoked instead, and it
-        converts null strings to non-null @"".
-
-2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
-
-        Reviewed by Dimitri Glazkov.
-
-        window attributes (like localStorage) that are disabled at runtime are still visible
-        https://bugs.webkit.org/show_bug.cgi?id=30240
-
-        Adding codegen/bindings to support runtime disabling of attributes.
-
-        No new tests (only supported by chrome currently)
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        Refactored the guts of GenerateBatchedAttributeData into a separate GenerateSingleBatchedAttribute with a passed-in indentation level to allow generating a single BatchedAttribute struct.
-        Added support for the EnabledAtRuntime extended attribute, which generates a call to the appropriate XXXXEnabled() API before adding the attribute to the instance.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::batchConfigureAttributes):
-        Refactored attribute setting code into a common inline routine.
-        * bindings/v8/V8Proxy.h:
-        (WebCore::configureAttribute):
-        Inline function which configures a single attribute given a BatchedAttribute struct.
-        * bindings/v8/custom/V8CustomBinding.h:
-        Added (DECLARE_)ACCESSOR_RUNTIME_ENABLER to allow enabling attributes at runtime.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        Added code to enable window.Audio only if MediaPlayer.isAvailable() == true
+        * WebCore.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMFormDataCustom.cpp: Added.
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/DOMFormData.idl: Added.
         * page/DOMWindow.idl:
-        Added [EnabledAtRuntime] extended attribute to the Audio attribute.
-
-2009-10-13  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Adam Barth.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27457
-        Added support for static validation on type=email input elements as per
-        HTML5 specs:
-        http://www.whatwg.org/specs/web-apps/current-work/#e-mail-state
-
-        Test: fast/forms/ValidityState-typeMismatch-email.html
-
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::typeMismatch): ValidityState.typeMismatch
-        performs validation on type=email input elements now.
-        (WebCore::ValidityState::isValidEmailAddress): simple validation method 
-        * html/ValidityState.h:
-
-2009-10-13  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by Adam Barth.
+2010-03-12  Jakob Petsovits  <jpetsovits@rim.com>
 
-        Event listeners installed on a window object returned from window.open() don't work
-        https://bugs.webkit.org/show_bug.cgi?id=28716
+        Reviewed by Dirk Schulze.
 
-        Tests: http/tests/security/window-events-clear-domain.html
-               http/tests/security/window-events-clear-port.html
-               http/tests/security/window-events-pass.html
+        [OpenVG] Add a SurfaceOpenVG constructor for EGL client buffer surfaces
+        https://bugs.webkit.org/show_bug.cgi?id=35538
 
-        * dom/Document.cpp: Split code of Document::clear() in a way to avoid removing all
-        window event handlers when implicitOpen is called. It is called in 2 cases - on
-        committing loaded content (no need to clean handlers) and on document.open() (needs to remove handlers).
+        SurfaceOpenVG can now not only encapsulate pbuffer
+        and window surfaces but also VGImage-based ones.
 
-        (WebCore::Document::open): in addition to calling implicitOpen it also removes window
-        event handlers, to preserve the behavior of document.open().
+        * platform/graphics/openvg/EGLDisplayOpenVG.cpp:
+        (WebCore::EGLDisplayOpenVG::createPbufferFromClientBuffer):
+        * platform/graphics/openvg/EGLDisplayOpenVG.h:
+        * platform/graphics/openvg/SurfaceOpenVG.cpp:
+        (WebCore::SurfaceOpenVG::SurfaceOpenVG):
+        * platform/graphics/openvg/SurfaceOpenVG.h:
 
-        (WebCore::Document::implicitOpen): includes the part of removed Document::clear() that
-        does not remove window event handlers.
+2010-03-12  Alpha Lam  <hclam@chromium.org>
 
-        * dom/Document.h: Removed clear().
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopLoading): add check to avoid removing window event handlers
-        if we transition from temporary empty document to a loaded one.
-
-        (WebCore::FrameLoader::didOpenURL): Remove closeURL() which was called twice when loading.
-        (WebCore::FrameLoader::finishedLoadingDocument): add closeURL() to compensate for change above.
-
-2009-10-13  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Pavel Feldman.
-
-        Fix a leak in the inspector by calling didRemoveNode with
-        an error code when it fails, instead of returning from the
-        Backend.
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::removeNode):
-        * inspector/front-end/ElementsTreeOutline.js:
-
-2009-10-13  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30337>.
-        Web Inspector: Should be able to delete nodes from the Elements Tree.
-        
-        When the delete key is pressed and a element is selected in the tree,
-        the element should be deleted from the Elements Tree and the DOM.
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::removeNode):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::didRemoveNode):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent):
-
-2009-10-13  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fix REGRESSION(49479): Mouseover on resources graph doesn't show timings.
-        
-        Set pointer-events: none on the new overlay so mouseover events are passed
-        to the resources graph so we can show timings.
-
-        * inspector/front-end/inspector.css:
-
-2009-10-13  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Plugins : Remove all traces of winId. Use ownerWidget() instead.
-        
-        This is a bug for two reasons:
-        1. Everytime we use winId(), we end up creating a native widget. This causes an
-        unnecessary copy of contents from the backing store to the native widget.
-        2. Neither windowed nor windowless plugins require the winId of the QWebView or
-        QGraphicsView.
-        
-        Introduce ownerWidget() which returns a QWidget * without creating a native widget
-        (as opposed to QWidget::find(winId)).
-
-       https://bugs.webkit.org/show_bug.cgi?id=30170
-
-        * platform/qt/PlatformScreenQt.cpp:
-        (WebCore::screenDepthPerComponent):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/qt/QWebPageClient.h:
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::setSharedXEventFields):
-        (WebCore::PluginView::initXEvent):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::platformStart):
-
-2009-10-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Unreviewed build system fix. Typo in a filename.
-
-        * GNUmakefile.am:
-
-2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-        Alter profile link format to enable multiple profile types
-        https://bugs.webkit.org/show_bug.cgi?id=30253
-
-        The new profile URL includes the profile type along with the
-        profile title and uid.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
-        (WebCore::InspectorController::addStartProfilingMessageToConsole):
-        * inspector/front-end/inspector.js:
-        (WebInspector.documentClick.followLink):
-        (WebInspector.documentClick):
-        (WebInspector.linkifyStringAsFragment):
+        Reviewed by Eric Carlson.
 
-2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
+        Fix a crash when resource loading of media element is canceled.
+        https://bugs.webkit.org/show_bug.cgi?id=35992
 
-        Reviewed by Timothy Hatcher.
+        Use of HTMLMediaElement::duration() after resource loading was canceled
+        will cause a crash. This is because HTMLMediaElement::m_player is used
+        when NULL.
+        Test: http/tests/media/video-cancel-load.html
 
-        Fix same-named profiles grouping in the Profiles panel.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::duration):
+        Avoid calling to m_player when it is null.
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+        Set m_readyState to HAVE_NOTHING.
 
-        The tree node re-parenting while adding a new group node was broken.
-         
-        https://bugs.webkit.org/show_bug.cgi?id=30299
+2010-03-12  Dan Bernstein  <mitz@apple.com>
 
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.addProfile):
+        Reviewed by Darin Adler.
 
-2009-10-12  Pavel Feldman  <pfeldman@chromium.org>
+        <rdar://problem/7725534> CSSPrimitiveValue::parserValue() returns deleted memory
+        https://bugs.webkit.org/show_bug.cgi?id=20069
 
-        Reviewed by Timothy Hatcher.
+        No test added, since with the CSS variables feature disabled, the pointer
+        to the freed memory is never dereferenced.
 
-        Web Inspector: Enforce async interaction between inspector controller and frontend.
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::valueOrPropertyName): Changed to return a const AtomicString& from
+        a static table.
+        (WebCore::CSSPrimitiveValue::parserValue): Updated for the above change.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30300
+2010-03-12  Dan Bernstein  <mitz@apple.com>
 
-        * inspector/front-end/inspector.js:
-        (WebInspector.dispatch.delayDispatch):
-        (WebInspector.dispatch):
+        Build fix.
 
-2009-10-12  Xiaomei Ji  <xji@chromium.org>
+        * platform/chromium/PlatformKeyboardEventChromium.cpp:
 
-        Reviewed by Sam Weinig.
+2010-03-12  Dan Bernstein  <mitz@apple.com>
 
-        Fix issue caretRangeFromPoint() returns wrong result for a zoomed and 
-        scrolled page.
-        https://bugs.webkit.org/show_bug.cgi?id=30034
+        Reviewed by Darin Adler.
 
-        * dom/Document.cpp:
-        (WebCore::Document::elementFromPoint): calculate the correct point 
-        relative to document when the page is zoomed and scrolled.
-        (WebCore::Document::caretRangeFromPoint): calculate the correct point 
-        relative to document when the page is zoomed and scrolled.
+        <rdar://problem/7694674> Hover states not updated when overflow section scrolls under stationary mouse pointer
+        https://bugs.webkit.org/show_bug.cgi?id=35949
 
-2009-10-12  Fumitoshi Ukai  <ukai@chromium.org>
+        Test: fast/events/overflow-scroll-fake-mouse-move.html
 
-        Reviewed by Sam Weinig.
+        Soon after an overflow section scrolls under the mouse pointer, dispatch
+        a fake mouse move event. This is similar to how frame scrolling is handled
+        in WebKit, and has the effect of updating hover state, dispatching DOM mouse
+        events, and updating the tool tip.
 
-        JavaScript bindings of WebSocket addEventListener/removeEventListener
-        https://bugs.webkit.org/show_bug.cgi?id=29841
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler): Initialize m_fakeMouseMoveEventTimer.
+        (WebCore::EventHandler::~EventHandler): Assert that the timer is not active.
+        (WebCore::EventHandler::clear): Stop the timer.
+        (WebCore::EventHandler::handleMousePressEvent): Cancel pending fake mouse
+        move events.
+        (WebCore::EventHandler::handleMouseMoveEvent): Ditto.
+        (WebCore::EventHandler::dispatchFakeMouseMoveEventSoonInQuad): If the mouse
+        is in the passed-in quad, ensure that a fake mouse move event is scheduled
+        to fire soon.
+        (WebCore::EventHandler::cancelFakeMouseMoveEvent): Does what the name says.
+        (WebCore::EventHandler::fakeMouseMoveEventTimerFired): Constructs a
+        PlatformMouseEvent with the current mouse location, modifier key state and
+        time stamp and calls mouseMoved().
+        * page/EventHandler.h:
+        * platform/PlatformKeyboardEvent.h: Declared getCurrentModifierState().
+        * platform/android/KeyEventAndroid.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Stubbed out.
+        * platform/brew/PlatformKeyboardEventBrew.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Ditto.
+        * platform/chromium/PlatformKeyboardEventChromium.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Added.
+        * platform/efl/PlatformKeyboardEventEfl.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Stubbed out.
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Ditto.
+        * platform/haiku/PlatformKeyboardEventHaiku.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Added.
+        * platform/mac/KeyEventMac.mm:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Ditto.
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Stubbed out.
+        * platform/win/KeyEventWin.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Added.
+        * platform/wx/KeyboardEventWx.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Ditto.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset): Call
+        EventHandler::dispatchFakeMouseMoveEventSoonInQuad(). Moved things around
+        a little to avoid computing the repaint rect twice.
 
-        Test: fast/websockets/websocket-event-target.html
+2010-03-12  Kent Hansen  <kent.hansen@nokia.com>
 
-        * bindings/js/JSWebSocketCustom.cpp:
-        (WebCore::JSWebSocket::addEventListener):
-        (WebCore::JSWebSocket::removeEventListener):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8WebSocketCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * websockets/WebSocket.idl:
+        Reviewed by Darin Adler.
 
-2009-10-12  Sam Weinig  <sam@webkit.org>
+        Webkit doesn't build with workers on and database off
+        https://bugs.webkit.org/show_bug.cgi?id=35997
 
-        Reviewed by Darin Adler.
+        Added missing ENABLE(DATABASE) guards.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29078
-        <rdar://problem/7288221>
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadShutdownStartTask::performTask):
 
-        Add a mechanism to blacklist certain codecs.  Initially, just blacklist UTF-7 as HTML5 encourages.
+2010-03-12  Dan Winship  <danw@gnome.org>
 
-        * platform/text/TextEncodingRegistry.cpp:
-        (WebCore::pruneBlacklistedCodecs):
-        (WebCore::buildBaseTextCodecMaps):
-        (WebCore::extendTextCodecMaps):
+        Reviewed by Gustavo Noronha.
 
-2009-10-09  Dave Hyatt  <hyatt@apple.com>
+        Make the defaultCookieJar use a no-third-party policy. Most
+        applications set their own cookie jar, but DumpRenderTree doesn't,
+        so it was failing the new third-party-cookie test.
 
-        Reviewed by Darin Adler.
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::defaultCookieJar):
 
-        Add support for the beforeload event to frames.  Complete support of the beforeload event by making sure
-        its wrapper gets properly constructed (so that the URL field of the event can be accessed).  Add support
-        for the Objective-C wrapper class as well.
+2010-03-11  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Added fast/dom/beforeload/frame-before-load.html
+        Reviewed by Laszlo Gombos.
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * bindings/objc/DOMEvents.mm:
-        (kitClass):
-        * dom/BeforeLoadEvent.h:
-        (WebCore::BeforeLoadEvent::isBeforeLoadEvent):
-        * dom/Event.cpp:
-        (WebCore::Event::isBeforeLoadEvent):
-        * dom/Event.h:
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadWithDocumentLoader):
+        [Qt] Enable network state notifier when compiling against Qt 4.7
+        https://bugs.webkit.org/show_bug.cgi?id=35983
 
-2009-10-12  Dan Bernstein  <mitz@apple.com>
+        * WebCore.pri:
+        * platform/network/qt/NetworkStateNotifierPrivate.h:
+        * platform/network/qt/NetworkStateNotifierQt.cpp:
 
-        Reviewed by Simon Fraser.
+2010-03-11  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
-        Fix <rdar://problem/7094146> Reproducible crash at
-        RenderObject::localToAbsolute()
+        Reviewed by Adam Treat.
 
-        Test: fast/dynamic/position-absolute-to-fixed-crash.html
+        Do not render the full frame when there is some elements with fixed positioning
+        https://bugs.webkit.org/show_bug.cgi?id=33150
 
-        The crash was caused by stale positioned objects lists following an
-        object transitioning from being absolutely position to being fixed
-        positioned.
+        The frame view take into acount the list of fixed object when scrolling
+        the view. If the number of object is lower than a certain threshold, the pixel
+        are blitted, and the invalidated area updated.
 
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::useSlowRepaints):
+        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped):
+        (WebCore::FrameView::addFixedObject):
+        (WebCore::FrameView::removeFixedObject):
+        (WebCore::FrameView::scrollContentsFastPath):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::scrollContentsFastPath):
+        * platform/ScrollView.h:
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::positionedObjects):
         * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::styleWillChange): In case of a transition between
-        absolute and fixed position, mark the parent as having a child needing
-        layout, so that this object will get inserted into its new container's
-        positioned objects list.
+        (WebCore::RenderBox::styleWillChange):
         * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::styleWillChange): Changed a condition to cover
-        this transition, so that this object gets removed from its current
-        container's positioned objects list.
-
-2009-10-12  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Add a palette() method that is needed by our RenderTheme.
-
-        * platform/qt/QWebPageClient.h:
-
-2009-10-12  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Nikolas Zimmermann.
+        (WebCore::RenderObject::styleWillChange):
 
-        SVG Gradients can't handle percentage values in userSpaceOnUse mode
-        [https://bugs.webkit.org/show_bug.cgi?id=30286]
-
-        Fixed *GradientAttributes to take SVGLength instead of double. This casues
-        the problem, that we can't calculate the correct size of a gradient on
-        userSpaceOnUse mode with percentage values.
-
-        Test: svg/custom/gradient-userSpaceOnUse-with-percentage.svg
-
-        * svg/LinearGradientAttributes.h:
-        (WebCore::LinearGradientAttributes::LinearGradientAttributes):
-        (WebCore::LinearGradientAttributes::x1):
-        (WebCore::LinearGradientAttributes::y1):
-        (WebCore::LinearGradientAttributes::x2):
-        (WebCore::LinearGradientAttributes::y2):
-        (WebCore::LinearGradientAttributes::setX1):
-        (WebCore::LinearGradientAttributes::setY1):
-        (WebCore::LinearGradientAttributes::setX2):
-        (WebCore::LinearGradientAttributes::setY2):
-        * svg/RadialGradientAttributes.h:
-        (WebCore::RadialGradientAttributes::RadialGradientAttributes):
-        (WebCore::RadialGradientAttributes::cx):
-        (WebCore::RadialGradientAttributes::cy):
-        (WebCore::RadialGradientAttributes::r):
-        (WebCore::RadialGradientAttributes::fx):
-        (WebCore::RadialGradientAttributes::fy):
-        (WebCore::RadialGradientAttributes::setCx):
-        (WebCore::RadialGradientAttributes::setCy):
-        (WebCore::RadialGradientAttributes::setR):
-        (WebCore::RadialGradientAttributes::setFx):
-        (WebCore::RadialGradientAttributes::setFy):
-        * svg/SVGLinearGradientElement.cpp:
-        (WebCore::SVGLinearGradientElement::buildGradient):
-        (WebCore::SVGLinearGradientElement::collectGradientProperties):
-        * svg/SVGRadialGradientElement.cpp:
-        (WebCore::SVGRadialGradientElement::buildGradient):
-        (WebCore::SVGRadialGradientElement::collectGradientProperties):
-
-2009-10-12  Brian Weinstein  <bweinstein@apple.com>
+2010-03-11  Aaron Boodman  <aa@chromium.org>
 
-        Reviewed by Timothy Hatcher.
+        Kill WebDocument::applicationID() (part 1).
 
-        Fixes <http://webkit.org/b/30315>.
-        Web Inspector: DOM Content and Load lines in Resources are unclear what they mean.
-        
-        Add tooltip text to the Load event and DOM Content event lines through
-        a new layer that allows these lines to be on top of the view.
+        Modify interface to WebCore::NotificationPresenter::checkPermission()
+        and remove implementation of WebDocument::applicationID(). Breaking
+        API changes will be in a subsequent change.
+        https://bugs.webkit.org/show_bug.cgi?id=35846
 
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
-        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
-        * inspector/front-end/inspector.css:
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::checkPermission):
+        * notifications/NotificationPresenter.h:
 
-2009-10-12  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-03-11  Dmitry Titov  <dimich@chromium.org>
 
-        No review, rolling out r49429, because it broke layout tests.
-        http://trac.webkit.org/changeset/49429
+        Reviewed by David Levin.
 
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+        [v8] Remove obsolete code for delayed dereferencing of DOM objects for single-heap, multithread v8 usage.
+        https://bugs.webkit.org/show_bug.cgi?id=36043
 
-2009-10-12  Dirk Schulze  <krit@webkit.org>
+        No new tests, no changes in functionality.
 
-        Reviewed by Eric Seidel.
+        * bindings/v8/DOMData.cpp:
+        (WebCore::DOMData::DOMData):
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::handleWeakObject):
+        * bindings/v8/DOMDataStore.cpp:
+        * bindings/v8/DOMDataStore.h:
+        (WebCore::DOMDataStore::domObjectMap):
+        (WebCore::DOMDataStore::activeDomObjectMap):
+        (WebCore::DOMDataStore::domSvgElementInstanceMap):
+        (WebCore::DOMDataStore::domSvgObjectWithContextMap):
+        * bindings/v8/ScopedDOMDataStore.cpp:
+        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
+        * bindings/v8/StaticDOMDataStore.cpp:
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        * bindings/v8/StaticDOMDataStore.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::removeAllDOMObjectsInCurrentThread):
 
-        SVG - crash on feMerge when input not available
-        [https://bugs.webkit.org/show_bug.cgi?id=30297]
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
 
-        Make a early return in SVGFEMergeElement if the needed
-        filter effect doesn't exist.
+        Rubber stamped by Oliver Hunt.
 
-        Test: svg/filters/feMerge-wrong-input.svg
+        Remove nonsense comments used in development & commited in error.
 
-        * svg/SVGFEMergeElement.cpp:
-        (WebCore::SVGFEMergeElement::build):
+        * platform/text/StringImpl.h:
 
-2009-10-12  Chris Marrin  <cmarrin@apple.com>
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Added automatic flush before compositing
-        https://bugs.webkit.org/show_bug.cgi?id=30236
-
-        This causes image to always render correctly. In writing a testcase
-        I needed to implement readPixels. This exposed a bug in reading back
-        values from a CanvasArray subclass, so I fixed that as well. Now when
-        you wrap a CanvasArray in a JSValue it actually wraps the specific
-        subclass. To do this I need to add virtual methods to each CanvasArray
-        subclass to determine the type and a custom toJS method for CanvasArray
-        to create the proper wrapper. 
+        https://bugs.webkit.org/show_bug.cgi?id=36041
+        Remove unnecessary differences in common code between WebCore::StringImpl & JSC::UStringImpl
 
-        Test: fast/canvas/webgl/triangle.html
+        Much of the code in WebCore::StringImpl and JSC::UStringImpl is now very similar,
+        but has trivial and unnecessary formatting differences, such as the exact wording
+        of comments, missing ASSERTs, functions implemented in the .h vs .cpp etc.
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCanvasArrayCustom.cpp:
-        (WebCore::toJS):
-        * html/canvas/CanvasArray.h:
-        (WebCore::CanvasArray::isByteArray):
-        (WebCore::CanvasArray::isUnsignedByteArray):
-        (WebCore::CanvasArray::isShortArray):
-        (WebCore::CanvasArray::isUnsignedShortArray):
-        (WebCore::CanvasArray::isIntArray):
-        (WebCore::CanvasArray::isUnsignedIntArray):
-        (WebCore::CanvasArray::isFloatArray):
-        * html/canvas/CanvasArray.idl:
-        * html/canvas/CanvasByteArray.h:
-        (WebCore::CanvasByteArray::isByteArray):
-        * html/canvas/CanvasFloatArray.h:
-        (WebCore::CanvasFloatArray::isFloatArray):
-        * html/canvas/CanvasIntArray.h:
-        (WebCore::CanvasIntArray::isIntArray):
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        (WebCore::CanvasRenderingContext3D::readPixels):
-        * html/canvas/CanvasRenderingContext3D.h:
-        * html/canvas/CanvasRenderingContext3D.idl:
-        * html/canvas/CanvasShortArray.h:
-        (WebCore::CanvasShortArray::isShortArray):
-        * html/canvas/CanvasUnsignedByteArray.h:
-        (WebCore::CanvasUnsignedByteArray::isUnsignedByteArray):
-        * html/canvas/CanvasUnsignedIntArray.h:
-        (WebCore::CanvasUnsignedIntArray::isUnsignedIntArray):
-        * html/canvas/CanvasUnsignedShortArray.h:
-        (WebCore::CanvasUnsignedShortArray::isUnsignedShortArray):
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/Canvas3DLayer.mm:
-        (-[Canvas3DLayer drawInCGLContext:pixelFormat:forLayerTime:displayTime:]):
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::readPixels):
-
-2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
-
-        Reviewed by Gustavo Noronha.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30307
-        
-        Fix 0 sentinel for g_object_set() function call.
-
-        * platform/graphics/gtk/DataSourceGStreamer.cpp:
-        (webkit_data_src_uri_set_uri):
-        0 is passed as 32 bit value on x86-64 in vararg functions, but
-        g_object_set() expects a 64 bit 0. This will cause crashes.
-
-2009-10-12  Cameron McCormack  <cam@mcc.id.au>
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::empty): Reordered in file, made empty()->characters() return a non-null value to match JSC.
+        (WebCore::StringImpl::createUninitialized): Added overflow check.
+        (WebCore::StringImpl::create): Reordered in file.
+        (WebCore::StringImpl::sharedBuffer): Reordered in file.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::): Remove ThreadGlobalData as friend, move SharableUChar & SharedUChar to WebCore namespace.
+        (WebCore::StringImpl::StringImpl): Made static constructor method (used to create empty string) take arguments, to match JSC & prevent accidental use.
+        (WebCore::StringImpl::setHash): Added missing ASSERT.
+        (WebCore::StringImpl::adopt): Make adpot work with Vectors with a non-zero inline capacity.
+        (WebCore::StringImpl::characters): Mark as const to match JSC.
+        (WebCore::StringImpl::hash): Use !m_hash instead of m_hash == 0.
+        (WebCore::StringImpl::computeHash): Remove redundant 'inline'.
 
-        Reviewed by Eric Seidel.
+2010-03-11  Mark Rowe  <mrowe@apple.com>
 
-        Drop in="" from <feFlood>
-        https://bugs.webkit.org/show_bug.cgi?id=29001
+        Reviewed by David Kilzer.
 
-        This makes <feFlood in="bogus"> have an effect, too.
+        <rdar://problem/7745082> Make it possible to build WebKit for older Mac OS X versions from the current Mac OS X version
 
-        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#feflood-attribute
+        Default to using the appropriate SDK if the target Mac OS X version is not the current Mac OS X version.
 
-        Test: svg/dom/feFlood-no-in1.html
+        * Configurations/Base.xcconfig:
 
-        * svg/SVGFEFloodElement.cpp:
-        (WebCore::SVGFEFloodElement::SVGFEFloodElement):
-        (WebCore::SVGFEFloodElement::build):
-        * svg/SVGFEFloodElement.h:
-        * svg/SVGFEFloodElement.idl:
-        * svg/graphics/filters/SVGFEFlood.cpp:
-        (WebCore::FEFlood::FEFlood):
-        (WebCore::FEFlood::create):
-        * svg/graphics/filters/SVGFEFlood.h:
+2010-03-11  Jungshik Shin  <jshin@chromium.org>
 
-2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+        [Chromium]: Plane 2 characters are rendered "blank" 
+         (not even empty boxes) on Windows even when there are fonts to
+         cover them. 
 
-        Reviewed by Gustavo Noronha.
+        https://bugs.webkit.org/show_bug.cgi?id=35605
 
-        https://bugs.webkit.org/show_bug.cgi?id=29998
-        
-        Scale video to completely fill the target surface while
-        keeping the aspect ratio. This fixes displaying of the
-        YouTube HTML5 sample website.
+        Test:LayoutTests/fast/text/international/plane2.html 
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        Scale video to completely fill the target surface, keep
-        the aspect ratio and center it.
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::LookupAltName): Add two ExtB fonts to the array (namePairs) that are used for Plane 2 character rendering.
+        (WebCore::FontCache::getFontDataForCharacters): Add two more fonts to the fallback font list
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::getFallbackFamily): Fix the fallback font lookup to cover Plane 2 (CJK ExtB).
 
-2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+2010-03-11  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Gustavo Noronha.
+        Reviewed by Holger Freyther.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29997
-        
-        Fixes double memcpy of all rendered video frames.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35889
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::mediaPlayerPrivateRepaintCallback):
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::duration):
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_timeout_func):
-        (webkit_video_sink_dispose):
-        (unlock_buffer_mutex):
-        (webkit_video_sink_unlock):
-        (marshal_VOID__MINIOBJECT):
-        (webkit_video_sink_class_init):
-        (webkit_video_sink_new):
-        * platform/graphics/gtk/VideoSinkGStreamer.h:
-        Directly pass the buffers up to the MediaPlayerPrivate::paint()
-        method instead of rendering them first to an intermediate cairo
-        surface. This should increase performance and peak memory usage.
+        * platform/efl/SystemTimeEfl.cpp: Added.
 
-2009-10-11  Daniel Bates  <dbates@webkit.org>
+2010-03-11  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Adam Barth.
+        Reviewed by Tim Hatcher.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30242
-        
-        Fixes an issue where JavaScript URLs that are URL-encoded twice can 
-        bypass the XSSAuditor.
-        
-        JavaScript URLs that are completed by method Document::completeURL have added
-        URL-encoded characters such that a direct comparison with the URL-decoded 
-        outgoing HTTP parameters is not sufficient. Instead, the URL-decoded outgoing 
-        HTTP parameters must be URL-decoded before comparison.
+        <rdar://problem/7745082> Make it possible to build WebKit for older Mac OS X versions from the current Mac OS X version
 
-        Tests: http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode.html
-               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2.html
-               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3.html
+        Introduce TARGET_MAC_OS_X_VERSION_MAJOR to represent the Mac OS X version that is being targeted.  It defaults to the
+        current Mac OS X version unless otherwise specified.
 
-        * bindings/ScriptControllerBase.cpp:
-        (WebCore::ScriptController::executeIfJavaScriptURL): Modified to pass XSSAuditor
-        the URL-decoded source code for the JavaScript URL.
-        * page/XSSAuditor.cpp:
-        (WebCore::isIllegalURICharacter): Minor syntactical change to the comment.
-        (WebCore::XSSAuditor::CachingURLCanonicalizer::canonicalizeURL): Added 
-        parameter decodeURLEscapeSequencesTwice.
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::decodeURL): Ditto.
-        (WebCore::XSSAuditor::findInRequest): Ditto.
-        * page/XSSAuditor.h:
-        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer): Ditto.
+        Key off TARGET_MAC_OS_X_VERSION_MAJOR where we'd previously been keying off MAC_OS_X_VERSION_MAJOR.
 
-2009-10-11  Dominic Cooney  <dominicc@google.com>
+        Explicitly map from the target Mac OS X version to the preferred compiler since Xcode's default compiler choice
+        may not be usable when targetting a different Mac OS X version.
 
-        Reviewed by Adam Barth.
+        Key off TARGET_GCC_VERSION rather than MAC_OS_X_VERSION_MAJOR in locations where we'd previously been keying off
+        MAC_OS_X_VERSION_MAJOR but the decision is really related to the compiler version being used.
 
-        Fixes a build break in the V8 bindings caused by revision 49420.
-        https://bugs.webkit.org/show_bug.cgi?id=30294
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/Version.xcconfig:
+        * Configurations/WebCore.xcconfig:
 
-        Revision 49420 introduces an IDL-defined CanvasActiveInfo
-        type. This causes a build break in the V8 bindings where
-        CanvasGraphicsContext3D naively refers to CanvasActiveInfo as a
-        non-ref type.
+2010-03-11  Anders Carlsson  <andersca@apple.com>
 
-        * WebCore.gypi: Include CanvasActiveInfo.idl in build.
-        * bindings/scripts/CodeGeneratorV8.pm: CanvasActiveInfo is a ref
-          ptr type.
-        * bindings/v8/DOMObjectsInclude.h: Include generated
-          CanvasActiveInfo files.
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
+        Reviewed by David Hyatt.
 
-2009-10-11  Collin Jackson  <collinj@webkit.org>
+        Remove invalidateContents, it isn't used and it never makes sense to only invalidate the contents.
 
-        Reviewed by Adam Barth.
+        * loader/EmptyClients.h:
+        * page/Chrome.cpp:
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * platform/HostWindow.h:
 
-        Log mixed content warnings to console
+2010-03-11  Nate Chapin  <japhet@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30290
+        Reviewed by Dimitri Glazkov.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
-        (WebCore::FrameLoader::checkIfRunInsecureContent):
+        [V8] Remove DOMObjectsInclude.h and update headers accordingly.
 
-2009-10-11  Søren Gjesse  <sgjesse@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=36036
 
-        Reviewed by Adam Barth.
+        * WebCore.gypi:
+        * bindings/v8/DOMData.h:
+        * bindings/v8/DOMDataStore.h:
+        * bindings/v8/DOMObjectsInclude.h: Removed.
+        * bindings/v8/V8DOMMap.cpp:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8GCController.cpp:
+        * bindings/v8/V8Proxy.cpp:
 
-        [V8] Add a context scope in JS listener destructor. The destructor code uses the cotext. See http://crbug.com/24200.
-        https://bugs.webkit.org/show_bug.cgi?id=30250
+2010-03-11  Simon Fraser  <simon.fraser@apple.com>
 
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+        Reviewed by Mark Rowe.
 
-2009-10-11  Lyon Chen  <lyon.chen@torchmobile.com>
+        Remove duplicate entries revealed after sorting.
 
-        Reviewed by Alexey Proskuryakov.
+        * WebCore.xcodeproj/project.pbxproj:
 
-        Correct the position of #endif sentence inside WebCore::Document::finishedParsing().
+2010-03-11  Simon Fraser  <simon.fraser@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30244
+        Reviewed by Mark Rowe.
 
-        This change requires no test case as it fix a compiling error.
+        Sort the project file (also removing some bogus spaces that caused Xcode to rewrite the file
+        every time you opened it).
 
-        * dom/Document.cpp:
-        (WebCore::Document::finishedParsing):
+        * WebCore.xcodeproj/project.pbxproj:
 
-2009-10-11  Dominic Cooney  <dominicc@google.com>
+2010-03-11  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by Adam Barth.
+        Reviewed by Dimitri Glazkov.
 
-        Sets a 500K stack limit for JavaScript workers in Chromium.
-        https://bugs.webkit.org/show_bug.cgi?id=29797
+        Fix style issues and improve comments from 
+        http://trac.webkit.org/changeset/55853.
 
-        Runaway recursion in JavaScript workers crashes the Chromium
-        worker process on OS X. This is because V8's default stack limit
-        is 512K on ia32 or 1M on x64, but the worker process runs workers
-        on a thread with the OS X default stack size--512K. Because there
-        are already some C+frames on the stack when V8 establishes its
-        512K default stack limit, and V8 doesn't precisely enforce the
-        stack limit, runaway recursion in V8 workers overflows the OS
-        stack and segfaults, killing the worker process. This is described
-        in Chromium bug 21653 <http://crbug.com/21653>.
+        https://bugs.webkit.org/show_bug.cgi?id=36029
 
-        This patch sets the V8 stack limit for worker JavaScript in
-        Chromium to a more conservative 500K on all platforms. This allows
-        some "headroom" for the C+stack in use when the limit is set up,
-        and some "legroom" for the V8 helper functions which in practice
-        briefly flout the V8 stack limit.
+        * platform/animation/TimingFunction.h:
+        (WebCore::TimingFunction::TimingFunction):
 
-        Test: LayoutTests/fast/workers/use-machine-stack.html
+2010-03-11  Chris Fleizach  <cfleizach@apple.com>
 
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
-        * bindings/v8/WorkerContextExecutionProxy.h:
+        Reviewed by Beth Dakin.
 
-2009-10-11  Kevin Ollivier  <kevino@theolliviers.com>
+        accessibilityIsIgnoredBase() needs to respect when platform says include
+        https://bugs.webkit.org/show_bug.cgi?id=36025
 
-        wx build fix for wxMac 2.9, use wxGC API for measuring text.
+        Changed accessibilityIsIgnoredBase() to return a policy instead of a yes/no
+        answer. This allows the platform to make a yes decision on an element.
 
-        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
-        (GetTextExtent):
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::accessibilityIsIgnored):
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::accessibilityIsIgnored):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnoredBase):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::accessibilityIsIgnored):
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
 
-2009-10-10  Cameron McCormack  <cam@mcc.id.au>
+2010-03-11  Kenneth Russell  <kbr@google.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Dimitri Glazkov.
 
-        Allow [Reflect] on SVG elements.
-        https://bugs.webkit.org/show_bug.cgi?id=28936
+        Fix build breakage with ENABLE_3D_CANVAS=0
+        https://bugs.webkit.org/show_bug.cgi?id=35995
 
-        Update the JS binding generators to reference SVGNames instead of
-        HTMLNames, if [Reflect]ing an attribute on an SVG element.  Make
-        SVGElement::id use [Reflect].
+        No new tests; verified in Chromium that WebGL is disabled in
+        ENABLE_3D_CANVAS=0 builds.
 
-        Also make [Reflect] on an attribute with a setter exception work in ObjC
-        bindings.
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
 
-        Test: svg/dom/id-reflect.html
+2010-03-11  Nate Chapin  <japhet@chromium.org>
 
-        * bindings/scripts/CodeGenerator.pm: Add a function to determine the
-        appropriate C+namespace for attribute name constants.
-        * bindings/scripts/CodeGeneratorObjC.pm: Generate ExceptionCode handling
-        code for [Reflect] on an attribute with a setter exception.
-        * bindings/scripts/CodeGeneratorCOM.pm: Generate "SVGNames" instead of
-        "HTMLNames" when appropriate.
-        * bindings/scripts/CodeGeneratorJS.pm: Ditto.
-        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
-        * svg/SVGElement.cpp: Remove getter and setter methods for id.
-        * svg/SVGElement.h: Ditto.
-        * svg/SVGElement.idl: Add [Reflect] to id.
+        Unreviewed, Chromium mac build fix.
 
-2009-10-10  Oliver Hunt  <oliver@apple.com>
+        Add an explicit copy constructor to TimingFunction.
+        http://trac.webkit.org/changeset/55835 trigged an inlining
+        bug in gcc that the copy constructor resolves.
 
-        Fix paths in xcode.
+        * platform/animation/TimingFunction.h:
+        (WebCore::TimingFunction::TimingFunction):
 
-        * WebCore.xcodeproj/project.pbxproj:
+2010-03-11  Chris Fleizach  <cfleizach@apple.com>
 
-2009-10-10  Oliver Hunt  <oliver@apple.com>
+        Fixing GTK. No review.
 
-        Reviewed by Eric Carlson.
+        support lang attribute on <option> elements
+        https://bugs.webkit.org/show_bug.cgi?id=36021
+ 
+        We don't need to cast to AccessibilityRenderObject to get language().
 
-        Implement getActiveAttrib and getActiveUniform
-        https://bugs.webkit.org/show_bug.cgi?id=30276
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_document_get_locale):
 
-        Implements the getActiveAttrib and getActiveUniform APIs.
-        Rather simple patch, adds CanvasActiveInfo definition and implementation
-        and adds forwarding to the GraphicsContext3D.
+2010-03-11  Chris Fleizach  <cfleizach@apple.com>
 
-        Test: fast/canvas/webgl/getActiveTest.html
+        Reviewed by Darin Adler.
 
-        * DerivedSources.make:
-        * WebCore.xcodeproj/project.pbxproj:
-        * html/canvas/CanvasActiveInfo.h: Added.
-        (WebCore::CanvasActiveInfo::create):
-        (WebCore::CanvasActiveInfo::name):
-        (WebCore::CanvasActiveInfo::type):
-        (WebCore::CanvasActiveInfo::size):
-        (WebCore::CanvasActiveInfo::CanvasActiveInfo):
-        * html/canvas/CanvasActiveInfo.idl: Added.
-        * html/canvas/CanvasObject.h:
-        (WebCore::CanvasObject::context):
-          Need to make the context public as it is needed to ensure we don't
-          provide a program from one context as an argument to another.
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        (WebCore::CanvasRenderingContext3D::getActiveAttrib):
-        (WebCore::CanvasRenderingContext3D::getActiveUniform):
-        * html/canvas/CanvasRenderingContext3D.h:
-        * html/canvas/CanvasRenderingContext3D.idl:
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::getActiveAttrib):
-        (WebCore::GraphicsContext3D::getActiveUniform):
+        support lang attribute on <option> elements
+        https://bugs.webkit.org/show_bug.cgi?id=36021
 
-2009-10-10  Pavel Feldman  <pfeldman@chromium.org>
+        Allow non AccessibilityRenderObject classes to access the lang
+        attribute by moving the useful code into AccessibilityObject.
 
-        Reviewed by Timothy Hatcher.
+        Test: platform/mac/accessibility/option-with-lang.html
 
-        Web Inspector: Adding new attributes in Element Panel is
-        counterintuitive.
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::language):
+        * accessibility/AccessibilityListBoxOption.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::language):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::language):
+        * accessibility/AccessibilityRenderObject.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=30057
+2010-03-11  Diego Gonzalez  <diego.gonzalez@openbossa.org>
 
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype._onmousemove):
-        (WebInspector.ElementsTreeElement.prototype.set hovered):
-        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton):
+        Reviewed by Simon Hausmann.
 
-2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        [Qt] Access key modifier should be Ctrl+Alt for Darwin derived OS and Alt for the others
+        https://bugs.webkit.org/show_bug.cgi?id=35993
 
-        Reviewed by Holger Freyther.
+        * page/qt/EventHandlerQt.cpp:
+        (WebCore::EventHandler::accessKeyModifiers):
 
-        Build fix if Netscape plugin support is turned off
-        https://bugs.webkit.org/show_bug.cgi?id=30275
+2010-03-08  Brett Wilson  <brettw@chromium.org>
 
-        In addition to fixing the build break with guards
-        remove notImplemented() from PluginViewNone.cpp and
-        make them just just be empty functions.
+        Reviewed by Adam Barth.
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::handleEvent):
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/PluginViewNone.cpp:
-        (WebCore::PluginView::setFocus):
-        (WebCore::PluginView::show):
-        (WebCore::PluginView::hide):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setParent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::handlePostReadFile):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::getValueStatic):
-        (WebCore::PluginView::invalidateRect):
-        (WebCore::PluginView::invalidateRegion):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::platformStart):
-        (WebCore::PluginView::platformDestroy):
-        (WebCore::PluginView::setParentVisible):
-        (WebCore::PluginView::updatePluginWidget):
+        Remove the deprecated argument to url_util::IsStandard in preparation
+        for deleting that version of the function. Pull the latest googleurl
+        with the new version for the Chromium builder.
 
-2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::isHierarchical):
 
-        Unreviewed.
+2010-03-11  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        [Qt] Build fix for QtWebKit after r49415.
+        Reviewed by Tor Arne Vestbø.
 
-        Add HistoryController.cpp to the build.
+        [Qt] Make it possible to do builds with separate debug info in packages
 
         * WebCore.pro:
 
-2009-10-09  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        [Chromium] KURLGoogle's protocolIs barfs on input containing hyphens
-        https://bugs.webkit.org/show_bug.cgi?id=30262
-
-        This is not testable from WebKit since WebKit never uses the member
-        function form of protocolIs with input that can be controlled from a
-        web page.  It always passes string literals lacking hyphens.
+2010-03-11  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        * platform/KURLGoogle.cpp:
-        (WebCore::lowerCaseEqualsASCII): Only assert if toASCIILower would
-        transform the input character.
+        Reviewed by Tor Arne Vestbø.
 
-2009-10-10  Adam Barth  <abarth@webkit.org>
+        [Qt] Avoid double-buffering with Qt image decoders
 
-        Reviewed by Oliver Hunt.
+        Pass QIODevice::Unbuffered when opening the QBuffer that
+        wraps the image data, to hint to Qt that no extra buffering
+        is needed.
 
-        Move HistoryController to its own file
-        https://bugs.webkit.org/show_bug.cgi?id=30272
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
 
-        Purely mechanical.
+2010-03-10  Ben Murdoch  <benm@google.com>
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/HistoryController.cpp: Added.
-        * loader/HistoryController.h: Added.
+        Reviewed by Jeremy Orlow.
 
-2009-10-09  Ryosuke Niwa  <rniwa@webkit.org>
+        [Android] The platform touch events on Android are missing support
+        for key modifiers.
+        https://bugs.webkit.org/show_bug.cgi?id=35521
 
-        Reviewed by Eric Seidel.
+        Add support in PlatformToucHEventAndroid for the platform supplying
+        key modifiers with touch events.
 
-        ApplyStyleCommand removes presentational tags even when not necessary
-        https://bugs.webkit.org/show_bug.cgi?id=28091
+        Fixes Android so it now passes basic-single-touch-events.html.
 
-        This patch updates implicitlyStyledElementShouldBeRemovedWhenApplyingStyle to return true
-        (triggering removal of tag) only if the style implicitly added by the element is not present in
-        the new style to apply. It also changes surroundNodeRangeWithElement so that it merges the
-        surrounding element when possible. applyTextDecorationStyle is modified so that it does not add
-        style span when the style attribute is empty.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Fix two compiler warnings.
+        * platform/PlatformTouchEvent.h:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent): Add support for
+            key modifiers on Android.
+        * platform/android/PlatformTouchEventAndroid.cpp:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent): ditto.
 
-        Test: editing/execCommand/toggle-style-3.html
+2010-03-10  Steve Block  <steveblock@google.com>
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::ApplyStyleCommand::shouldRemoveTextDecorationTag): Returns true if specified text
-        decoration is not present in the style to apply
-        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle): No longer
-        returns true if the tag is used in new style
-        (WebCore::ApplyStyleCommand::applyTextDecorationStyle): Does not add style-span when redundant
-        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement): Merges the newly created element
-        with the surrounding identical elements
-        * editing/ApplyStyleCommand.h:
+        Reviewed by Jeremy Orlow.
 
-2009-10-09  Adam Barth  <abarth@webkit.org>
+        Implements Geolocation maximumAge property
+        https://bugs.webkit.org/show_bug.cgi?id=30676
 
-        Reviewed by Darin Adler.
+        Test: fast/dom/Geolocation/maximum-age.html
 
-        Factor HistoryController out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30246
+        * WebCore.xcodeproj/project.pbxproj: Modified. Adds GeolocationPositionCache.h to Private headers
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::setUseCachedPosition): Added.
+        (WebCore::Geolocation::GeoNotifier::runSuccessCallback): Added.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Added logic to handle using a cached position
+        (WebCore::Geolocation::Watchers::contains): Added. Required to determine if a notifier is a watch request
+        (WebCore::Geolocation::startRequest): Modified. Added logic to check for a cached position
+        (WebCore::Geolocation::requestUsesCachedPosition): Added. Callback to Geolocation object when notifier uses a cached position
+        (WebCore::Geolocation::makeCachedPositionCallbacks): Added.
+        (WebCore::Geolocation::haveSuitableCachedPosition): Added.
+        (WebCore::Geolocation::setIsAllowed): Modified.
+        (WebCore::Geolocation::positionChanged): Modified. Make callbacks using cached position where appropriate
+        (WebCore::Geolocation::geolocationServiceErrorOccurred): Modified. Make callbacks using cached position where appropriate
+        * page/Geolocation.h: Modified.
 
-        HistoryController is in charge of managing the current / previous /
-        provisional HistoryItems.  The split isn't perfect, but it's a place to
-        start.  I'll move HistoryController into its own file in another patch.
+2010-03-11  Csaba Osztrogonác  <ossy@webkit.org>
 
-        * WebCore.base.exp:
-        * loader/FrameLoader.cpp:
-        (WebCore::HistoryController::HistoryController):
-        (WebCore::HistoryController::~HistoryController):
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::closeURL):
-        (WebCore::FrameLoader::begin):
-        (WebCore::HistoryController::restoreDocumentState):
-        (WebCore::HistoryController::setCurrentItem):
-        (WebCore::HistoryController::setProvisionalItem):
-        (WebCore::FrameLoader::loadURLIntoChildFrame):
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
-        (WebCore::FrameLoader::scrollToAnchor):
-        (WebCore::FrameLoader::commitProvisionalLoad):
-        (WebCore::FrameLoader::transitionToCommitted):
-        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
-        (WebCore::FrameLoader::didFirstLayout):
-        (WebCore::HistoryController::updateForFrameLoadCompleted):
-        (WebCore::FrameLoader::frameLoadCompleted):
-        (WebCore::FrameLoader::detachFromParent):
-        (WebCore::FrameLoader::receivedMainResourceError):
-        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
-        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
-        (WebCore::HistoryController::addHistoryItemForFragmentScroll):
-        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
-        (WebCore::FrameLoader::shouldTreatURLAsSameAsCurrent):
-        (WebCore::HistoryController::createHistoryItem):
-        (WebCore::FrameLoader::checkDidPerformFirstNavigation):
-        (WebCore::HistoryController::addBackForwardItemClippedAtTarget):
-        (WebCore::HistoryController::createHistoryItemTree):
-        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem):
-        (WebCore::HistoryController::restoreScrollPositionAndViewState):
-        (WebCore::HistoryController::invalidateCurrentItemCachedPage):
-        (WebCore::HistoryController::saveDocumentState):
-        (WebCore::FrameLoader::loadItem):
-        (WebCore::HistoryController::urlsMatchItem):
-        (WebCore::HistoryController::goToItem):
-        (WebCore::HistoryController::recursiveGoToItem):
-        (WebCore::HistoryController::childFramesMatchItem):
-        (WebCore::HistoryController::updateForStandardLoad):
-        (WebCore::HistoryController::updateForClientRedirect):
-        (WebCore::HistoryController::updateForBackForwardNavigation):
-        (WebCore::HistoryController::updateForReload):
-        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
-        (WebCore::HistoryController::updateForCommit):
-        (WebCore::HistoryController::updateForAnchorScroll):
-        (WebCore::HistoryController::saveDocumentAndScrollState):
-        (WebCore::HistoryController::setCurrentItemTitle):
-        (WebCore::FrameLoader::didChangeTitle):
-        * loader/FrameLoader.h:
-        (WebCore::HistoryController::current):
-        (WebCore::HistoryController::provisional):
-        (WebCore::FrameLoader::policyChecker):
-        (WebCore::FrameLoader::history):
-        (WebCore::FrameLoader::creatingInitialEmptyDocument):
-        * page/Page.cpp:
-        (WebCore::Page::goToItem):
+        Unreviewed buildfix after r55823. (To fix Qt --minimal build.)
+        I have déjà vu, I'm sure that I did it before. (r55598)
 
-2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+        * bindings/js/JSDOMWindowCustom.cpp: Missing #if ENABLE(DATABASE) guard added. 
 
-        Unreviewed - fixing an obvious typo in my previous check-in.
+2010-03-11  Csaba Osztrogonác  <ossy@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30260
-        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
+        [Qt] Unreviewed buildfix after r55833.
 
-        Fixes existing tests (which I thought I had run the previous time).
+        Rename all instances of data() to characters()
 
-        * platform/network/CredentialStorage.cpp: (WebCore::originsWithCredentials): Return the
-        set by reference.
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fieldNamed):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
 
-2009-10-09  David Levin  <levin@chromium.org>
+2010-03-11  Zoltan Horvath  <zoltan@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Simon Hausmann.
 
-        [v8] Need change to V8WorkerContextEventListener::reportError signature to match the base class.
-        https://bugs.webkit.org/show_bug.cgi?id=30264
+        Allow custom memory allocation control for RenderLayerBacking class
+        https://bugs.webkit.org/show_bug.cgi?id=35857
 
-        The base class method changed in r48884.
+        Inherits the following class from Noncopyable because it is
+        instantiated by 'new' and no need to be copyable:                                     
 
-        Test: fast/worker/worker-script-error.html
+        class name    - instantiated at: WebCore/'location'
+        RenderLayerBacking - rendering/RenderLayer.cpp:3047
 
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::reportError):
-        * bindings/v8/V8WorkerContextEventListener.h:
+        * rendering/RenderLayerBacking.h:
 
-2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+2010-03-11  Zoltan Horvath  <zoltan@webkit.org>
 
-        Reviewed by Brady Eidson.
+        Reviewed by Simon Hausmann.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30260
-        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
-
-        Tests: http/tests/xmlhttprequest/logout.html
-               http/tests/xmlhttprequest/re-login-async.html
-               http/tests/xmlhttprequest/re-login.html
-
-        Fix several issues with existing credential handling code.
-
-        * platform/network/CredentialStorage.cpp:
-        (WebCore::pathToDefaultProtectionSpaceMap): Changed the data structure to a simpler one.
-        (WebCore::originsWithCredentials): The reason for two-stage lookup above was that we didn't
-        want to iterate paths for origins that never had credentials associated with them. Changed
-        to use a separate HashSet for this.
-        (WebCore::pathToDefaultProtectionSpaceMap): The concept of default per-path credentials didn't
-        match the spec very well. UAs are supposed to deduce protection space from an URL, and then
-        use whichever credentials are known for this protection space. So, OriginToDefaultBasicCredentialMap
-        is now PathToDefaultProtectionSpaceMap.
-        (WebCore::protectionSpaceMapKeyFromURL): Factored out a helper that extracts a directory
-        URL from a given URL. These directory URLs are what we use as keys in PathToDefaultProtectionSpaceMap.
-        (WebCore::CredentialStorage::set): Updated for above changes.
-        (WebCore::findDefaultProtectionSpaceForURL): Factored out code iterating path length to find
-        a prefix in OriginToDefaultBasicCredentialMap.
-        (WebCore::CredentialStorage::set): Another version of set() can update credentials for a
-        URL default protection space. It does nothing if the given URL doesn't correspond to a known
-        protection space.
-        (WebCore::CredentialStorage::get): Renamed from getDefaultAuthenticationCredential.
-
-        * platform/network/CredentialStorage.h: Made the distinction between methods that use a known
-        protection space and those that deduce one from URL more clear.
+        Allow custom memory allocation control for TimingFunction struct
+        https://bugs.webkit.org/show_bug.cgi?id=35855
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start): Update credentials before starting the request for real.
-        This makes the following pattern work:
-          var req = new XMLHttpRequest("GET", "logout.html", "logout", "logout"); // wrong credentials
-          req.send("");
-          req.abort();
-        Abort() is used here to avoid having UA present an auth dialog after getting a 401 response.
-        Note that one cannot log in using the same method, because there isn't a known protection
-        space for the URL yet in that case, so the added code has no effect.
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Use a correct persistence for
-        calling receivedCredential(). This fixes logging in using an async XHR (withut abort(), of
-        course), and matches sync case.
-        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
-        Renamed getDefaultAuthenticationCredential() to get().
+        Inherits the following struct from FastAllocBase because it is 
+        instantiated by 'new':
 
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::start):
-        (WebCore::WebCoreSynchronousLoader::load):
-        Same changes as in Mac code.
+        class name    - instantiated at: WebCore/'location'
+        TimingFuction - platform/graphics/GraphicsLayer.h:89
 
-2009-10-09  Enrica Casucci  <enrica@apple.com>
+        * platform/animation/TimingFunction.h:
 
-        Reviewed by Adele Peterson.
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
 
-        Undoing a indent removes text instead of it's formatting.
-        <rdar://problem/7169206>
-        https://bugs.webkit.org/show_bug.cgi?id=28722
-        Restored the behavior prior to http://trac.webkit.org/changeset/46143. This change implemented the
-        indent command making simple DOM operation, without using moveParagraph which cause undo to be broken.
+        Rubber stamped by Oliver Hunt.
         
-        Added editing/undo/undo-indent.html test.
+        Rename JSC::UStringImpl::data() to characters(), to match WebCore::StringImpl.
 
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion): Restored. 
-        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Merged changes.
-        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Restored.
-        (WebCore::IndentOutdentCommand::indentRegion): Restored and added call to updateLayout to
-        ensure TextIterator could correctly calculate the position starting from the index.
-        * editing/IndentOutdentCommand.h: Restored.
+        * bridge/jni/jsc/JavaStringJSC.h:
+        (JSC::Bindings::JavaStringImpl::uchars):
+        * platform/text/AtomicString.cpp:
+        (WebCore::AtomicString::add):
+        (WebCore::AtomicString::find):
 
-2009-10-09  Jens Alfke  <snej@chromium.org>
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Darin Adler.
-        
-        Optimization: Many StringImpl transformations are no-ops and should just return 'this'
-        https://bugs.webkit.org/show_bug.cgi?id=30186
+        Reviewed by Mark Rowe.
 
-        Optimized StringImpl methods lower(), stripWhiteSpace() and simplifyWhiteSpace() to
-        detect no-ops and return this instead of creating a new instance.
-        Empirical testing shows that the majority of calls to these methods are no-ops, making
-        this worthwhile even if (in the case of lower()) the non-no-op case is slightly slowed.
-        Upper() is very rarely a no-op, so it wasn't worthwhile to optimize it.
+        Fix for r55825, threadsafeCopy no longer needs to special-case for
+        empty strings (in fact, doing so results in leaks).
 
         * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::lower):
-        (WebCore::StringImpl::upper): Just add a comment explaining why this wasn't optimized
-        (WebCore::StringImpl::stripWhiteSpace):
-        (WebCore::StringImpl::simplifyWhiteSpace):
+        (WebCore::StringImpl::threadsafeCopy):
 
-2009-10-09  Dirk Schulze  <krit@webkit.org>
+2010-03-10  Chang Shu  <chang.shu@nokia.com>
 
-        Reviewed by Oliver Hunt.
-
-        SVG Filter feGaussianBlur implementation is missing
-        [https://bugs.webkit.org/show_bug.cgi?id=28141]
-
-        This is the implementation of GaussianBlur filter for SVG.
+        Reviewed by Darin Adler.
 
-        There is already a test for feGaussianBlur
-        Test: svg/W3C-SVG-1.1/filters-gauss-01-b-w3c.svg 
+        While calculating alpha channel, convert the floating point value to
+        an integer in [0, 256) with equal distribution.
+        https://bugs.webkit.org/show_bug.cgi?id=22150
 
-        Test: svg/filters/feGaussianBlur.svg
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseColorParameters):
 
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::FilterEffect):
-        * platform/graphics/filters/FilterEffect.h:
-        (WebCore::FilterEffect::isAlphaImage):
-        (WebCore::FilterEffect::setIsAlphaImage):
-        * platform/graphics/filters/SourceAlpha.cpp:
-        (WebCore::SourceAlpha::apply):
-        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
-        (WebCore::boxBlur):
-        (WebCore::FEGaussianBlur::apply):
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
 
-2009-10-09  Philippe Normand  <pnormand@igalia.com>
+        Reviewed by Darin Adler, Geoffrey Garen, Maciej Stachowiak.
 
-        Reviewed by Gustavo Noronha.
+        https://bugs.webkit.org/show_bug.cgi?id=35991
+        Would be faster to not use a thread specific to implement StringImpl::empty()
 
-        [GTK] QoS support in the video sink
-        https://bugs.webkit.org/show_bug.cgi?id=29959
+        Copy JavaScriptCore in making 'static' strings threadsafe, make the empty string a static,
+        shared by all threads.
 
-        Removed the async buffer queue from the sink. Synchronize the
-        render method of the sink using a g_timeout_add() combined with a
-        gcond triggered when the buffer has been rendered.
-        Also fixed the video sink reference handling in the player, now
-        that the idle is not there anymore to mess up things.
+        ~2% progression on Dromaeo DOM core & JS lib tests.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_init):
-        (webkit_video_sink_timeout_func):
-        (webkit_video_sink_render):
-        (webkit_video_sink_dispose):
-        (unlock_buffer_mutex):
-        (webkit_video_sink_unlock):
-        (webkit_video_sink_stop):
-        (webkit_video_sink_class_init):
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        * platform/ThreadGlobalData.h:
+        (WebCore::ThreadGlobalData::eventNames):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::empty):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::deref):
+        (WebCore::StringImpl::hasOneRef):
 
-2009-10-09  Dirk Schulze  <krit@webkit.org>
+2010-03-08  Dumitru Daniliuc  <dumi@chromium.org>
 
-        Reviewed by Nikolas Zimmermann.
+        Reviewed by Adam Barth.
 
-        feMorphology filter is not implemented
-        [https://bugs.webkit.org/show_bug.cgi?id=5863]
+        Adding support for the optional creation callback that could be
+        passed to openDatabase().
 
-        Adds SVGFEMorphologyElement, for the SVG filter. It also fixes a bug
-        with the attribute "operator". It was only accessible via "_operator" 
-        on JavaScript.
+        Tests: storage/open-database-creation-callback.html
+               storage/open-database-creation-callback-isolated-world.html
 
-        Test: svg/dom/operatorAttribute.xhtml
+        https://bugs.webkit.org/show_bug.cgi?id=34726
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
+        * Android.jscbindings.mk
+        * Android.v8bindings.mk
         * GNUmakefile.am:
-        * WebCore.SVG.Filters.exp:
         * WebCore.gypi:
         * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * bindings/objc/DOM.mm:
-        (WebCore::createElementClassMap):
-        * bindings/objc/DOMSVG.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bindings/scripts/CodeGeneratorObjC.pm:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::openDatabase):
+        * bindings/js/JSDatabaseCallback.cpp: Added.
+        (WebCore::JSDatabaseCallback::JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::~JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::handleEvent):
+        * bindings/js/JSDatabaseCallback.h: Added.
+        (WebCore::JSDatabaseCallback::create):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::openDatabaseCallback):
+        * bindings/v8/custom/V8DatabaseCallback.cpp: Added.
+        (WebCore::V8DatabaseCallback::V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::~V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::handleEvent):
+        * bindings/v8/custom/V8DatabaseCallback.h: Added.
+        (WebCore::V8DatabaseCallback::create):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::openDatabase):
+        * page/DOMWindow.h:
         * page/DOMWindow.idl:
-        * svg/SVGAllInOne.cpp:
-        * svg/SVGFECompositeElement.idl:
-        * svg/SVGFEMorphologyElement.cpp: Added.
-        (WebCore::SVGFEMorphologyElement::SVGFEMorphologyElement):
-        (WebCore::SVGFEMorphologyElement::~SVGFEMorphologyElement):
-        (WebCore::SVGFEMorphologyElement::setRadius):
-        (WebCore::SVGFEMorphologyElement::parseMappedAttribute):
-        (WebCore::SVGFEMorphologyElement::build):
-        * svg/SVGFEMorphologyElement.h: Added.
-        * svg/SVGFEMorphologyElement.idl: Added.
-        * svg/graphics/filters/SVGFEMorphology.cpp:
-        (WebCore::operator<<):
-        * svg/graphics/filters/SVGFEMorphology.h:
-        (WebCore::):
-        * svg/svgtags.in:
-
-2009-10-09  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix Chromium breakage.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30104
-
-        * inspector/front-end/inspector.js:
-        (WebInspector.addCookieDomain): check that Storage panel is present before calling its methods.
-
-2009-10-09  Joe Ligman  <joseph.ligman@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Added pure virtual methods setInputMethodEnabled and setInputMethodHint to QWebPageClient
-
-        https://bugs.webkit.org/show_bug.cgi?id=30023
-
-        * platform/qt/QWebPageClient.h:
-
-2009-10-08  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Implement beforeload for images.  ImageLoadEventSender has been refactored into a more generic
-        ImageEventSender that can be used by both load and beforeload events.  If the document has any
-        beforeload listeners, then the installation of images onto the renderer becomes asynchronous
-        and will be held up until the beforeload event can fire at a later date.
-
-        Both beforeload and load events now fire at the end of the tokenizer write() methods, so that
-        in the typical parsing case we don't have to put off the beforeload/load events until after
-        a layout or paint might already have happened.  This lets beforeload/load not cause extra
-        layouts and repaints.
-
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-        (WebCore::Document::addListenerTypeIfNeeded):
-        * dom/Document.h:
-        (WebCore::Document::):
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::write):
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::attach):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::attach):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::write):
-        * loader/ImageLoader.cpp:
-        (WebCore::ImageBeforeLoadEventSender::ImageBeforeLoadEventSender):
-        (WebCore::ImageLoadEventSender::ImageLoadEventSender):
-        (WebCore::beforeLoadEventSender):
-        (WebCore::ImageLoader::ImageLoader):
-        (WebCore::ImageLoader::~ImageLoader):
-        (WebCore::ImageLoader::setImage):
-        (WebCore::ImageLoader::setLoadingImage):
-        (WebCore::ImageLoader::updateFromElement):
-        (WebCore::ImageLoader::notifyFinished):
-        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):
-        (WebCore::ImageLoader::dispatchPendingEvents):
-        (WebCore::ImageEventSender::ImageEventSender):
-        (WebCore::ImageEventSender::dispatchEventSoon):
-        (WebCore::ImageEventSender::cancelEvent):
-        (WebCore::ImageEventSender::dispatchPendingEvents):
-        (WebCore::ImageEventSender::timerFired):
-        * loader/ImageLoader.h:
-        (WebCore::ImageLoader::haveFiredBeforeLoadEvent):
-        * wml/WMLImageElement.cpp:
-        (WebCore::WMLImageElement::attach):
-
-2009-10-09  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Web Inspector: Wrap Database into ScriptObject in v8 bindings.
+        * storage/Database.cpp:
+        (WebCore::DatabaseCreationCallbackTask::create):
+        (WebCore::DatabaseCreationCallbackTask::performTask):
+        (WebCore::DatabaseCreationCallbackTask::DatabaseCreationCallbackTask):
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+        (WebCore::Database::performCreationCallback):
+        * storage/Database.h:
+        (WebCore::Database::isNew):
+        * storage/DatabaseCallback.h: Added.
+        (WebCore::DatabaseCallback::~DatabaseCallback):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        * workers/WorkerContext.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=30174
+2010-03-10  Justin Schuh  <jschuh@chromium.org>
 
-        No tests due to no Script* test infrastructure.
+        Reviewed by Adam Barth.
 
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
+        Make Chrome consistently handle leading format characters in URLs
 
-2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+        https://bugs.webkit.org/show_bug.cgi?id=35948
 
-        Reviewed by Simon Hausmann.
+        Test: http/tests/security/xss-DENIED-window-open-javascript-url-leading-format-char.html
 
-        [Qt] Windowless Plugins : Fix crash when using QWebPage without QWebView.
-        
-        'client' is 0 when we have no view.
+        * platform/KURLGoogle.cpp:
 
-        https://bugs.webkit.org/show_bug.cgi?id=30251
+2010-03-10  Jian Li  <jianli@chromium.org>
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
+        Reviewed by Dmitry Titov.
 
-2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+        Implementing DOMFormData class.
+        https://bugs.webkit.org/show_bug.cgi?id=35707
 
-        Reviewed by Simon Hausmann.
+        This patch only addresses the implementation of DOMFormData class and
+        moves the FormData construction logic from HTMLFormElement::createFormData
+        to FormData::create() so that it can be used by both HTMLFormElement
+        and XMLHttpRequest.
 
-        [Qt] Plugins : Add missing setCurrentPlugin(0)
+        The DOMFormData IDL interface will be exposed in another patch and the
+        test will be added then.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30248
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/DOMFormData.cpp: Added.
+        * html/DOMFormData.h: Added.
+        * html/FormDataList.h:
+        (WebCore::FormDataList::encoding):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::createFormData):
+        (WebCore::HTMLFormElement::submit):
+        * html/HTMLFormElement.h:
+        * platform/network/FormData.cpp:
+        (WebCore::FormData::create):
+        (WebCore::FormData::createMultiPart):
+        (WebCore::FormData::appendDOMFormData):
+        * platform/network/FormData.h:
+        (WebCore::FormData::boundary):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
+        * xml/XMLHttpRequest.h:
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::dispatchNPEvent):
+2010-03-10  Chris Fleizach  <cfleizach@apple.com>
 
-2009-10-09  Jakub Wieczorek  <faw217@gmail.com>
+        Reviewed by Beth Dakin.
 
-        Reviewed by Simon Hausmann.
+        VoiceOver can navigate to hidden content in widget (WAI-ARIA)
+        https://bugs.webkit.org/show_bug.cgi?id=35986
 
-        [Qt] beforeload event does not fire on script elements in XML
-        https://bugs.webkit.org/show_bug.cgi?id=30235
+        Elements that are subclassers of AXRenderObject have not been respecting
+        aria-hidden and other cases that would make them ignored. This applies
+        to tables, rows, cells, select boxes, sliders, and lists. Select boxes
+        also need to make sure their option elements respect aria-hidden as well.
 
-        r49194 was lacking a change to XMLTokenizerQt.cpp, equivalent to the one
-        made in XMLTokenizerLibxml2.cpp.
+        Test: accessibility/aria-hidden-with-elements.html
 
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::parseEndElement):
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::accessibilityIsIgnored):
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::addChildren):
+        (WebCore::AccessibilityListBox::accessibilityIsIgnored):
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * accessibility/AccessibilityListBox.h:
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::accessibilityIsIgnored):
+        * accessibility/AccessibilityListBoxOption.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnoredCommon):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
+        * accessibility/AccessibilitySlider.h:
+        (WebCore::AccessibilitySlider::roleValue):
+        (WebCore::AccessibilitySliderThumb::roleValue):
+        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableColumn.cpp:
+        (WebCore::AccessibilityTableColumn::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableColumn.h:
+        (WebCore::AccessibilityTableColumn::roleValue):
+        * accessibility/AccessibilityTableHeaderContainer.cpp:
+        (WebCore::AccessibilityTableHeaderContainer::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableHeaderContainer.h:
+        * accessibility/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::accessibilityIsIgnored):
 
-2009-10-09  Zoltan Horvath  <zoltan@webkit.org>
+2010-03-10  Dmitry Titov  <dimich@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Allow custom memory allocation control for WebCore's CSSParserValueList
-        https://bugs.webkit.org/show_bug.cgi?id=30249
-
-        Inherits CSSParserValueList class from FastAllocBase because it has 
-        been instantiated by 'new' in WebCore/css/CSSGrammar.y:1271.
-
-        * css/CSSParserValues.h:
-
-2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Windowless Plugins : Create Pixmap only when size changes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30214
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-
-2009-10-08  Jon Honeycutt  <jhoneycutt@apple.com>
+        Make Document::postTask to use a single queue of tasks, to fire them in order
+        https://bugs.webkit.org/show_bug.cgi?id=35943
 
-        Remove the WebKitPluginHalterEnabledPreferenceKey in favor of checking
-        for the existence of a PluginHalterDelegate.
+        Test: existing worker-cloneport.html which was broken by initial patch in http://trac.webkit.org/changeset/55593.
+        Additional test which indirectly verifies the order of execution will come as part of https://bugs.webkit.org/show_bug.cgi?id=34726
 
-        This fixes a leak of WebPluginHalterClients:
-        https://bugs.webkit.org/show_bug.cgi?id=30119.
-
-        Reviewed by Dan Bernstein.
+        * dom/Document.cpp:
+        (WebCore::Document::postTask): Always use the same task queue, independent of what thread is posting the task.
 
-        * WebCore.base.exp:
-        Removed the export of WebCore::Settings::setPluginHalterEnabled().
+2010-03-10  Sanjeev Radhakrishnan  <sanjeevr@chromium.org>
 
-        * loader/EmptyClients.h:
-        (WebCore::EmptyPluginHalterClient::enabled):
+        Reviewed by Darin Fisher.
 
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        Remove initialization of m_pluginHalterClient, which was removed. If a
-        non-null PluginHalterClient was passed, create the PluginHalter, and
-        set its allowed run time.
+        Allow a plugin to participate in the browser's print workflow.
+        https://bugs.webkit.org/show_bug.cgi?id=35550
 
-        * page/Page.h:
-        Removed pluginHalterEnabledStateChanged() and m_pluginHalterClient.
+        * loader/PluginDocument.cpp:
+        * loader/PluginDocument.h:
 
-        * page/PluginHalter.cpp:
-        (WebCore::PluginHalter::didStartPlugin):
-        Check whether the PluginHalterClient is enabled.
-        (WebCore::PluginHalter::didStopPlugin):
-        Ditto.
+2010-03-10  Ilya Tikhonovsky  <loislo@loislo-macbookpro.local>
 
-        * page/PluginHalter.h:
-        Made m_client an OwnPtr.
+        Reviewed by Pavel Feldman.
 
-        * page/PluginHalterClient.h:
-        Added a function to return the enabled state.
+        Sidebar resize element height was adjusted.
+        Display name for Function Call details was adjusted.
 
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        Remove initialization of removed member.
+        https://bugs.webkit.org/show_bug.cgi?id=35939
 
-        * page/Settings.h:
-        Removed settings for the enabled state of the PluginHalter; we now use
-        the existence of a WebPluginHalterDelegate to determine whether the
-        PluginHalter is enabled.
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
 
-2009-10-08  Adam Barth  <abarth@webkit.org>
+2010-03-10  Charles Wei  <charles.wei@torchmobile.com.cn>
 
-        Reviewed by Eric Seidel.
+        Reviewed by George Staikos.
 
-        Move executeScript from FrameLoader to ScriptController
-        https://bugs.webkit.org/show_bug.cgi?id=30200
+        Fix https://bugs.webkig.org/show_bug.cgi?id=35207
+        When XHTMLMP is enabled, all xhtml documents fail to render for webkit portings wich use libxml2 tokenizer.
 
-        These methods have virtually no interaction with FrameLoader.  They
-        really seem like they ought to belong to ScriptController.
+        No new tests as all the xhtml test cases in LayoutTests/dom/xhtml fails without this fix when XHTMLMP is enabled.
 
-        * WebCore.base.exp:
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::ScriptController):
-        (WebCore::ScriptController::executeScript):
-        (WebCore::ScriptController::executeIfJavaScriptURL):
-        (WebCore::ScriptController::evaluate):
-        * bindings/js/ScriptController.h:
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::ScriptController):
-        (WebCore::ScriptController::executeScript):
-        (WebCore::ScriptController::executeIfJavaScriptURL):
-        * bindings/v8/ScriptController.h:
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::notifyFinished):
+        * dom/Document.cpp:
+        (WebCore::Document::isXHTMLMPDocument):
         * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::endElementNs):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::parseEndElement):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptExecution):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::changeLocation):
-        (WebCore::FrameLoader::urlSelected):
-        (WebCore::FrameLoader::requestFrame):
-        (WebCore::FrameLoader::submitForm):
-        (WebCore::FrameLoader::replaceDocument):
-        * loader/FrameLoader.h:
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::performRequest):
-
-2009-10-08  Geoffrey Garen  <ggaren@apple.com>
-
-        Windows build fix: added missing #include.
-
-        * ForwardingHeaders/runtime/StructureChain.h: Copied from WebCore/ForwardingHeaders/runtime/PropertyNameArray.h.
-
-2009-10-08  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30237>.
-        DOM Content and Load lines aren't shown if a page is loaded when the inspector is up.
-        
-        Make sure to call update script object if we have an InspectorFrontend to
-        call it on when we get one of the new events.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
-        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+        (WebCore::XMLTokenizer::internalSubset):
+        (WebCore::externalSubsetHandler):
 
-2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+2010-03-10  Garret Kelly  <gdk@chromium.org>
 
-        Build fix: updated for removal of Structure::markAggregate().
-
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::markChildren):
+        Reviewed by Darin Fisher.
 
-2009-10-08  Jens Alfke  <snej@chromium.org>
+        Adding all of the touch-related sources into Chromium's WebCore build.
+        https://bugs.webkit.org/show_bug.cgi?id=35874
 
-        Reviewed by Darin Adler.
+        Patch tested against the try bots, but the feature is exercised in the
+        fast/events/touch tests.
 
-        Make AtomicString create its StringImpl via create(), not the constructor,
-        so it gets allocated in a single heap block, saving memory and CPU cycles.
-        This eliminates two StringImpl constructors, making the remaining ones
-        unambiguous, so the "AdoptBuffer" parameter is no longer needed.
-        Added const attribute to UChar* in StringImpl constructor, eliminating the
-        need for several const_casts in calls to it.
-        StringImpl also unfriends AtomicString (OMG drama!!!)
-        https://bugs.webkit.org/show_bug.cgi?id=30141
+        * WebCore.gypi:
 
-        * platform/text/AtomicString.cpp:
-        (WebCore::CStringTranslator::translate): Call StringImpl::create().
-        (WebCore::UCharBufferTranslator::translate): Ditto.
-        (WebCore::HashAndCharactersTranslator::translate): Ditto.
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::StringImpl): Remove unnecessary AdoptBuffer param.
-        (WebCore::StringImpl::adopt): Ditto.
-        (WebCore::StringImpl::createUninitialized): Ditto.
-        (WebCore::StringImpl::create): Ditto.
-        (WebCore::StringImpl::crossThreadString): Ditto.
-        * platform/text/StringImpl.h:
-        (WebCore::StringImpl::setHash): Used by AtomicString when creating StringImpls.
+2010-03-10  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-10-08  Anders Carlsson  <andersca@apple.com>
+        Reviewed by Timothy Hatcher.
 
-        Reviewed by Sam Weinig.
+        Web Inspector: now that audits panel is added, add it to the
+        enums (for storing last active, etc.).
 
-        Remove the shouldLoadMediaElementURL frame loader client function.
+        https://bugs.webkit.org/show_bug.cgi?id=35980
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::willLoadMediaElementURL):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+        * inspector/front-end/inspector.js:
+        (WebInspector.showAuditsPanel):
 
-2009-10-08  John Gregg  <johnnyg@google.com>
+2010-03-10  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        SVGURIReference Build problem for V8.  An additional stale reference to SVGURIReference bindings
-        which wasn't exposed until a clean build.
-        https://bugs.webkit.org/show_bug.cgi?id=30217
+        [V8] Instead of describing the type of a wrapped v8 object
+        with an enum value, use a pointer to struct with more complete
+        information.
 
-        No new tests, just a build fix.
-
-        * bindings/v8/V8Index.cpp:
+        https://bugs.webkit.org/show_bug.cgi?id=35941
 
-2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+        Refactoring only, so new tests.
 
-        Not reviewed. Sort XCode project file.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMData.cpp:
+        * bindings/v8/DOMData.h:
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8GCController.cpp:
+        * bindings/v8/V8Helpers.cpp:
+        * bindings/v8/V8Helpers.h:
+        * bindings/v8/V8Index.cpp: Removed.
+        * bindings/v8/V8Index.h:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.h:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.h:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
 
-        * WebCore.xcodeproj/project.pbxproj:
+2010-03-10  Antonio Gomes  <tonikitoo@webkit.org>
 
-2009-10-08  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+        Reviewed by Dave Hyatt.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        Reviewed by Timothy Hatcher.
+        Extend keyboard navigation to allow directional navigation (Manual tests)
+        https://bugs.webkit.org/show_bug.cgi?id=18662
 
-        unselectable resources in resource panel
-        https://bugs.webkit.org/show_bug.cgi?id=30079
+        Adds a manual tests for the Spatial Navigation feature comprasing varios
+        Html focusable elements (e.g. <a>, <table>, <iframe>) and much of the logic
+        provided by the feature.
 
-        manual test added
-        
-        Also changed the way DnD for resources in the Resources panel is 
-        handled.
+        * manual-tests/spatial-navigation/links.html: Added.
+        * manual-tests/spatial-navigation/spatial-navigation-test-cases.html: Added.
 
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondragstart):
-        * manual-tests/inspector/duplicate-resource-urls.html: Added.
+2010-03-10  Leandro Pereira  <leandro@profusion.mobi>
 
-2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Timothy Hatcher.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35890
 
-        Fixes <http://webkit.org/b/30233>
-        Local Storage and Cookies show Blank Titles on Local Files.
+        * platform/efl/ScrollbarEfl.h: Added.
+        * platform/efl/ScrollbarThemeEfl.h: Added.
 
-        If a local storage or cookies sidebar item has no domain, set the 
-        title to "Local Files", because that is what it represents.
+2010-03-10  Pavel Feldman  <pfeldman@chromium.org>
 
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.DOMStorageSidebarTreeElement.prototype.get mainTitle):
-        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle):
-        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
+        Reviewed by Timothy Hatcher.
 
-2009-10-08  Dave Hyatt  <hyatt@apple.com>
+        Web Inspector: Audits panel needs an icon.
+        Landing icon attached by Timothy. Enabling panel!
 
-        Reviewed by Oliver Hunt.
+        https://bugs.webkit.org/show_bug.cgi?id=35945
 
-        Fix failing media layout tests.  Don't make beforeload block loads of objects that aren't in the
-        document, since video/audio (and images eventually too) can load when not in the document yet.
+        * WebCore.gypi:
+        * inspector/front-end/Images/auditsIcon.png: Added.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
 
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+2010-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+        Roll-out r55657, as Xan noticed a bad degradation in playing
+        youtube HTML5 videos with it, that is fixed with it
+        reverted. Looks like we'll need to work a bit more on this.
 
-        Reviewed by Eric Seidel.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::volumeChangedTimerFired):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::processBufferingStats):
+        (WebCore::MediaPlayerPrivate::fillTimerFired):
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::muteChangedTimerFired):
+        (WebCore::MediaPlayerPrivate::muteChanged):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        Move SVGFitToViewBox ANIMATED_* macros in classes that inherit from it
-        https://bugs.webkit.org/show_bug.cgi?id=30230
+2010-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        This patch also devirtualizes viewBoxToViewTransform(), is it's superflous.
-        viewBoxToViewTransform() is now a simple static heper function in SVGFitToViewBox.
-        As a result, the SVGSVGElement::viewBoxToViewTransform() function now resuses the same logic.
+        Rubber-stamped by Xan Lopez.
 
-        As side-effect this patch fixes svg/custom/linking-a-03-b-transform.svg, the return
-        statement in SVGSVGElement::viewBoxToViewTransform() was clearly wrong.
+        Fix ready state when buffering under PLAYING. We should not go
+        back to HaveNothing in that case.
 
-        * svg/SVGFitToViewBox.cpp:
-        (WebCore::SVGFitToViewBox::SVGFitToViewBox):
-        (WebCore::SVGFitToViewBox::viewBoxToViewTransform):
-        * svg/SVGFitToViewBox.h:
-        * svg/SVGMarkerElement.cpp:
-        (WebCore::SVGMarkerElement::SVGMarkerElement):
-        (WebCore::SVGMarkerElement::viewBoxToViewTransform):
-        * svg/SVGMarkerElement.h:
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::SVGPatternElement):
-        (WebCore::SVGPatternElement::buildPattern):
-        * svg/SVGPatternElement.h:
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::SVGSVGElement):
-        (WebCore::SVGSVGElement::viewBoxToViewTransform):
-        * svg/SVGSVGElement.h:
-        * svg/SVGSymbolElement.cpp:
-        (WebCore::SVGSymbolElement::SVGSymbolElement):
-        * svg/SVGSymbolElement.h:
-        * svg/SVGViewElement.cpp:
-        (WebCore::SVGViewElement::SVGViewElement):
-        * svg/SVGViewElement.h:
-        * svg/SVGViewSpec.cpp:
-        (WebCore::SVGViewSpec::SVGViewSpec):
-        * svg/SVGViewSpec.h:
-
-2009-10-08  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        Correct a typo that fixes the resizing of columns in Cookie view when you
-        resize the Inspector window.
-
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView.prototype.resize):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::updateStates):
 
-2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+2010-03-10  Ada Chan  <adachan@apple.com>
 
         Reviewed by Adam Roben.
 
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=29811>
-        Text in Inspector's Styles gear menu is invisible.
-        
-        Adds a style rule for the option text and hr's in the gear menu,
-        to prevent them from being transparent.
-
-        * inspector/front-end/inspector.css:
-
-2009-10-08  John Gregg  <johnnyg@google.com>
-
-        Reviewed by David Levin.
-
-        Fix build problem with SVGURIReference in V8.
-        https://bugs.webkit.org/show_bug.cgi?id=30217
-
-        No new tests, just a build fix.
-
-        * WebCore.gypi:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-
-2009-10-07  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Eric Carlson.
+        https://bugs.webkit.org/show_bug.cgi?id=35976
 
-        Make beforeload work on <video>/<audio> elements.
+        Retrieve any dwItemData that's set on the context menu item in contextMenuItemByIdOrPosition().
 
-        Added fast/dom/beforeload/video-before-load.html
+        * platform/win/ContextMenuWin.cpp:
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseMappedAttribute):
-        (WebCore::HTMLMediaElement::selectMediaResource):
-        (WebCore::HTMLMediaElement::selectNextSourceChild):
+2010-03-10  Jeremy Orlow  <jorlow@chromium.org>
 
-2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+        Reviewed by Darin Fisher.
 
-        Reviewed by Eric Seidel.
+        Add IndexedDatabase class and hook it up.
+        https://bugs.webkit.org/show_bug.cgi?id=35927
 
-        Move SVGExternalResourcesRequired ANIMATED_* macros in classes that inherit from it
-        https://bugs.webkit.org/show_bug.cgi?id=30218
+        This change is mostly just adding the plumbing necessary for
+        the IndexedDatabaseRequest and IndexedDatabaseSync (not written
+        yet).
 
-        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
-        No change in functionality, thus no new tests.
+        This code is non-functional, so no tests (yet).
 
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::SVGAElement):
-        * svg/SVGAElement.h:
-        * svg/SVGAnimationElement.cpp:
-        (WebCore::SVGAnimationElement::SVGAnimationElement):
-        * svg/SVGAnimationElement.h:
-        * svg/SVGCircleElement.cpp:
-        (WebCore::SVGCircleElement::SVGCircleElement):
-        * svg/SVGCircleElement.h:
-        * svg/SVGClipPathElement.cpp:
-        (WebCore::SVGClipPathElement::SVGClipPathElement):
-        * svg/SVGClipPathElement.h:
-        * svg/SVGCursorElement.cpp:
-        (WebCore::SVGCursorElement::SVGCursorElement):
-        * svg/SVGCursorElement.h:
-        * svg/SVGDefsElement.cpp:
-        (WebCore::SVGDefsElement::SVGDefsElement):
-        * svg/SVGDefsElement.h:
-        * svg/SVGEllipseElement.cpp:
-        (WebCore::SVGEllipseElement::SVGEllipseElement):
-        * svg/SVGEllipseElement.h:
-        * svg/SVGExternalResourcesRequired.cpp:
-        (WebCore::SVGExternalResourcesRequired::SVGExternalResourcesRequired):
-        * svg/SVGExternalResourcesRequired.h:
-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::SVGFEImageElement):
-        * svg/SVGFEImageElement.h:
-        * svg/SVGFilterElement.cpp:
-        (WebCore::SVGFilterElement::SVGFilterElement):
-        * svg/SVGFilterElement.h:
-        * svg/SVGFontElement.cpp:
-        (WebCore::SVGFontElement::SVGFontElement):
-        * svg/SVGFontElement.h:
-        * svg/SVGForeignObjectElement.cpp:
-        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
-        * svg/SVGForeignObjectElement.h:
-        * svg/SVGGElement.cpp:
-        (WebCore::SVGGElement::SVGGElement):
-        * svg/SVGGElement.h:
-        * svg/SVGGradientElement.cpp:
-        (WebCore::SVGGradientElement::SVGGradientElement):
-        * svg/SVGGradientElement.h:
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::SVGImageElement):
-        * svg/SVGImageElement.h:
-        * svg/SVGLineElement.cpp:
-        (WebCore::SVGLineElement::SVGLineElement):
-        * svg/SVGLineElement.h:
-        * svg/SVGMPathElement.cpp:
-        (WebCore::SVGMPathElement::SVGMPathElement):
-        * svg/SVGMPathElement.h:
-        * svg/SVGMarkerElement.cpp:
-        (WebCore::SVGMarkerElement::SVGMarkerElement):
-        * svg/SVGMarkerElement.h:
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::SVGMaskElement):
-        * svg/SVGMaskElement.h:
-        * svg/SVGPathElement.cpp:
-        (WebCore::SVGPathElement::SVGPathElement):
-        * svg/SVGPathElement.h:
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::SVGPatternElement):
-        * svg/SVGPatternElement.h:
-        * svg/SVGPolyElement.cpp:
-        (WebCore::SVGPolyElement::SVGPolyElement):
-        * svg/SVGPolyElement.h:
-        * svg/SVGRectElement.cpp:
-        (WebCore::SVGRectElement::SVGRectElement):
-        * svg/SVGRectElement.h:
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::SVGSVGElement):
-        * svg/SVGSVGElement.h:
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::SVGScriptElement):
-        * svg/SVGScriptElement.h:
-        * svg/SVGSwitchElement.cpp:
-        (WebCore::SVGSwitchElement::SVGSwitchElement):
-        * svg/SVGSwitchElement.h:
-        * svg/SVGSymbolElement.cpp:
-        (WebCore::SVGSymbolElement::SVGSymbolElement):
-        * svg/SVGSymbolElement.h:
-        * svg/SVGTextContentElement.cpp:
-        (WebCore::SVGTextContentElement::SVGTextContentElement):
-        * svg/SVGTextContentElement.h:
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::SVGUseElement):
-        * svg/SVGUseElement.h:
-        * svg/SVGViewElement.cpp:
-        (WebCore::SVGViewElement::SVGViewElement):
-        * svg/SVGViewElement.h:
-
-2009-10-08  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Darin Adler.
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/chromium/ChromiumBridge.h:
+        * storage/IndexedDatabase.cpp: Added.
+        (WebCore::IndexedDatabase::get):
+        * storage/IndexedDatabase.h: Added.
+        (WebCore::IndexedDatabase::~IndexedDatabase):
+        * storage/IndexedDatabaseImpl.cpp: Added.
+        (WebCore::IndexedDatabaseImpl::get):
+        (WebCore::IndexedDatabaseImpl::IndexedDatabaseImpl):
+        (WebCore::IndexedDatabaseImpl::~IndexedDatabaseImpl):
+        (WebCore::IndexedDatabaseImpl::open):
+        * storage/IndexedDatabaseImpl.h: Added.
+        * storage/chromium/IndexedDatabase.cpp: Added.
+        (WebCore::IndexedDatabase::get):
+
+2010-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        SVG feComposite: operator over mixes up inputs
-        [https://bugs.webkit.org/show_bug.cgi?id=30205]
+        Reviewed by Sam Weinig.
 
-        SVG feComposite operator over mixed up the inputs.
-        The pixel-test svg/filters/feComposite.svg can already test this.
-        No new test result is needed as long as filters are disabled.
+        Add one more parent check during node removal.
+        https://bugs.webkit.org/show_bug.cgi?id=35818
 
-        * platform/graphics/filters/FEComposite.cpp:
-        (WebCore::FEComposite::apply):
+        Test: fast/dom/Node/mutation-blur.html
 
-2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChild): Added check.
 
-        Reviewed by George Staikos.
+2010-03-10  Pavel Feldman  <pfeldman@chromium.org>
 
-        Move SVGURIReference ANIMATED_* macros in classes that inherit from it
-        https://bugs.webkit.org/show_bug.cgi?id=30184
-
-        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
-        No change in functionality, thus no new tests.
-
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::SVGAElement):
-        * svg/SVGAElement.h:
-        * svg/SVGAltGlyphElement.cpp:
-        (WebCore::SVGAltGlyphElement::SVGAltGlyphElement):
-        * svg/SVGAltGlyphElement.h:
-        * svg/SVGCursorElement.cpp:
-        (WebCore::SVGCursorElement::SVGCursorElement):
-        * svg/SVGCursorElement.h:
-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::SVGFEImageElement):
-        * svg/SVGFEImageElement.h:
-        * svg/SVGFilterElement.cpp:
-        (WebCore::SVGFilterElement::SVGFilterElement):
-        * svg/SVGFilterElement.h:
-        * svg/SVGForeignObjectElement.cpp:
-        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
-        * svg/SVGForeignObjectElement.h:
-        * svg/SVGGradientElement.cpp:
-        (WebCore::SVGGradientElement::SVGGradientElement):
-        * svg/SVGGradientElement.h:
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::SVGImageElement):
-        * svg/SVGImageElement.h:
-        * svg/SVGMPathElement.cpp:
-        (WebCore::SVGMPathElement::SVGMPathElement):
-        (WebCore::SVGMPathElement::pathElement):
-        * svg/SVGMPathElement.h:
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::SVGMaskElement):
-        * svg/SVGMaskElement.h:
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::SVGPatternElement):
-        * svg/SVGPatternElement.h:
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::SVGScriptElement):
-        * svg/SVGScriptElement.h:
-        * svg/SVGTRefElement.cpp:
-        (WebCore::SVGTRefElement::SVGTRefElement):
-        * svg/SVGTRefElement.h:
-        * svg/SVGTextPathElement.cpp:
-        (WebCore::SVGTextPathElement::SVGTextPathElement):
-        * svg/SVGTextPathElement.h:
-        * svg/SVGURIReference.cpp:
-        (WebCore::SVGURIReference::SVGURIReference):
-        * svg/SVGURIReference.h:
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::SVGUseElement):
-        * svg/SVGUseElement.h:
+        Not reviewed: added missing quote into localized strings.
 
-2009-10-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+        * English.lproj/localizedStrings.js:
 
-        Reviewed by Simon Hausmann.
+2010-03-10  Jeremy Orlow  <jorlow@chromium.org>
 
-        [Qt] Re-add the QApplication::syncX() line for plugin windows removed
-        by r49169. Also changed the location of the sync just after the
-        creation instead of just before sending it to the plugin.
-        https://bugs.webkit.org/show_bug.cgi?id=25053
+        Commit files that were supposed to go in with the last checkin.
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::platformStart):
+2010-03-10  Jeremy Orlow  <jorlow@chromium.org>
 
-2009-10-08  Joseph Pecoraro  <joepeck@webkit.org>
+        Reviewed by Dimitry Glazkov.
 
-        Reviewed by Timothy Hatcher.
+        Baby steps towards IndexedDB: Start implementing callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=35911
 
-        Inspector: NodeLists Don't Display Well in the Console
-        https://bugs.webkit.org/show_bug.cgi?id=28061
+        This patch adds some infastructure for IndexedDB callbacks in V8.
+        It also adds a stub of IDBDatabaseRequest.  In the near future,
+        I'll gut the event based implementation code, flesh out IDBReqest
+        further, and start plumbing IndexedDatabaseRequest.
 
-        * inspector/front-end/InjectedScript.js:
-        (Object.type):
+        Code is not testible because it doesn't work (yet).
 
-2009-10-08  Girish Ramakrishnan  <girish@forwardbias.in>
+        * WebCore.gypi:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomIDBCallback.h: Added.
+        (WebCore::V8CustomIDBCallback::create):
+        (WebCore::V8CustomIDBCallback::~V8CustomIDBCallback):
+        (WebCore::V8CustomIDBCallback::handleEvent):
+        (WebCore::V8CustomIDBCallback::V8CustomIDBCallback):
+        * bindings/v8/custom/V8IndexedDatabaseRequestCustom.cpp:
+        (WebCore::V8IndexedDatabaseRequest::openCallback):
+        * storage/IDBDatabaseRequest.h: Added.
+        (WebCore::IDBDatabaseRequest::request):
+        * storage/IDBDatabaseRequest.idl: Added.
+        * storage/IndexedDatabaseRequest.idl:
+
+2010-03-10  Holger Hans Peter Freyther  <zecke@selfish.org>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Windowless plugins: Remove unnecessary XSync for opaque mode.
-        
-        The reason for the XSync was that the plugin would not know about the
-        Drawable. It turns out that the real reason behind this is that even
-        though XCreatePixmap returns a handle, this id is unknown to the server
-        until we flush the connection.
-        
-        So, move the XSync to right after we create the Pixmap.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30207
+        [Qt] Non animated gifs are animated in QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=35955
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paint):
+        Properly map Qt animated and non-animated values to WebCore's
+        understanding of animated and non-animated images. Currently
+        we can not map anything to the cAnimationLoopNone value.
 
-2009-10-07  Daniel Bates  <dbates@webkit.org>
+        * manual-tests/qt/qt-anim.gif: Added.
+        * manual-tests/qt/qt-gif-test.html: Added.
+        * manual-tests/qt/qt-noanim.gif: Added.
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::repetitionCount):
 
-        Reviewed by Eric Seidel.
+2010-03-07  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30188
-        
-        Fixes an issue where performing a non DHTML drag-and-drop operation 
-        does not work as expected. For instance, dragging some selected text 
-        to an external application, such as TextEdit.
-        
-        This issue was a regression that arose from patching bug #30107.
-        
-        This change is covered by the manual test: 
-        drag-out-of-background-window.html
+        Reviewed by Darin Adler.
 
-        * page/DragController.cpp:
-        (WebCore::DragController::startDrag): When performing a non-DHTML drag 
-        operation then default to drag operations DragOperationGeneric and 
-        DragOperationCopy according to similar functionality removed when fixing
-        bug #30107, see: 
-        http://trac.webkit.org/browser/trunk/WebKit/mac/WebView/WebHTMLView.mm?rev=48526#L3430 
+        [CAIRO] DoS on iexploder test with high text stroke width.
+        https://bugs.webkit.org/show_bug.cgi?id=33759
 
-2009-10-07  Xan Lopez  <xlopez@igalia.com>
+        Specifying a big text stroke width can make WebKitGTK+ spend
+        a very long time in the cairo library for stroking the path of
+        the text. The best way to prevent this from happening right now
+        is to not stroke paths with a certain width. Samuel proposed to
+        not stroke with a width that is twice the width of the text. The
+        reason to use twice the text width is that even one stroke of
+        any charachter to be drawn would cover the full width.
 
-        Fix more breakage in the GTKbuild.
+        Test: fast/text/text-stroke-width-cairo-dos.html
 
-        * GNUmakefile.am:
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
 
-2009-10-07  Adam Barth  <abarth@webkit.org>
+2010-03-10  Andrey Kosyakov  <caseq@chromium.org>
 
-        Reviewed by Eric Seidel.
-
-        Move PolicyChecker to it's own file
-        https://bugs.webkit.org/show_bug.cgi?id=30193
+        Reviewed by Pavel Feldman.
 
-        This is just moving code around and re-naming things.
+        Web Inspector: display list of active workers & support debugging
+        with fake workers.
+        https://bugs.webkit.org/show_bug.cgi?id=35568
 
-        * GNUmakefile.am:
+        * English.lproj/localizedStrings.js:
         * WebCore.gypi:
-        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/PolicyCallback.cpp: Added.
-        (WebCore::PolicyCallback::PolicyCallback):
-        (WebCore::PolicyCallback::~PolicyCallback):
-        (WebCore::PolicyCallback::clear):
-        (WebCore::PolicyCallback::set):
-        (WebCore::PolicyCallback::call):
-        (WebCore::PolicyCallback::clearRequest):
-        (WebCore::PolicyCallback::cancel):
-        * loader/PolicyCallback.h: Added.
-        (WebCore::PolicyCallback::request):
-        * loader/PolicyCheck.cpp: Removed.
-        * loader/PolicyCheck.h: Removed.
-
-2009-10-07  Joel Stanley  <joel@jms.id.au>
-
-        Reviewed by Mark Rowe.
-
-        Include <limits> for std::numeric_limits.  Required by gcc-4.4
-        https://bugs.webkit.org/show_bug.cgi?id=30197
-
-        * html/canvas/CanvasByteArray.h:
-        * html/canvas/CanvasIntArray.h:
-        * html/canvas/CanvasShortArray.h:
-        * html/canvas/CanvasUnsignedByteArray.h:
-        * html/canvas/CanvasUnsignedIntArray.h:
-        * html/canvas/CanvasUnsignedShortArray.h:
-
-2009-10-07  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Factor PolicyChecker out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30155
-
-        This patch separates PolicyChecker from FrameLoader.  Loader policy is
-        in change of managing the FrameLoaderClient callbacks.  Ideally, it
-        shouldn't know anything about FrameLoader, but I couldn't quite remove
-        all knowledge (although we might be able to do more later).  In a
-        future patch, I'll move PolicyChecker into a separate file.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::loadURL):
-        (WebCore::FrameLoader::load):
-        (WebCore::FrameLoader::loadWithDocumentLoader):
-        (WebCore::PolicyChecker::handleUnimplementablePolicy):
-        (WebCore::PolicyChecker::cannotShowMIMEType):
-        (WebCore::PolicyChecker::PolicyChecker):
-        (WebCore::PolicyChecker::checkNavigationPolicy):
-        (WebCore::PolicyChecker::checkContentPolicy):
-        (WebCore::FrameLoader::shouldReloadToHandleUnreachableURL):
-        (WebCore::FrameLoader::stopAllLoaders):
-        (WebCore::PolicyChecker::cancelCheck):
-        (WebCore::PolicyChecker::stopCheck):
-        (WebCore::PolicyChecker::continueAfterContentPolicy):
-        (WebCore::PolicyChecker::continueLoadAfterWillSubmitForm):
-        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
-        (WebCore::FrameLoader::loadPostRequest):
-        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
-        (WebCore::PolicyChecker::checkNewWindowPolicy):
-        (WebCore::PolicyChecker::continueAfterNewWindowPolicy):
-        (WebCore::PolicyChecker::continueAfterNavigationPolicy):
-        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
-        * loader/FrameLoader.h:
-        (WebCore::PolicyChecker::loadType):
-        (WebCore::PolicyChecker::setLoadType):
-        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
-        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
-        (WebCore::FrameLoader::policy):
-        * loader/FrameLoaderClient.h:
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::didCancel):
-        (WebCore::MainResourceLoader::willSendRequest):
-        (WebCore::MainResourceLoader::continueAfterContentPolicy):
-        (WebCore::MainResourceLoader::didReceiveResponse):
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::dataChanged):
-
-2009-10-07  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fixed <rdar://problem/5751979> Database code takes JSLock on secondary
-        thread, permanently slowing down JavaScript
-
-        Changed callback objects to use a standard helper object. The helper
-        object ASSERTs that it is deleted on the main thread, so no lock is
-        required when unprotecting its members. It also centralizes some previously
-        duplicated code.
-        
-        Callback objects that might be deleted on a secondary thread use
-        callOnMainThread to delete their helper objects on the main thread.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCallbackData.cpp: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
-        (WebCore::JSCallbackData::deleteData):
-        (WebCore::JSCallbackData::invokeCallback):
-        * bindings/js/JSCallbackData.h: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
-        (WebCore::JSCallbackData::JSCallbackData):
-        (WebCore::JSCallbackData::~JSCallbackData):
-        (WebCore::JSCallbackData::callback):
-        * bindings/js/JSCustomPositionCallback.cpp:
-        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionCallback.h:
-        * bindings/js/JSCustomPositionErrorCallback.cpp:
-        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.h:
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
-        (WebCore::JSCustomSQLStatementCallback::~JSCustomSQLStatementCallback):
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementCallback.h:
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
-        (WebCore::JSCustomSQLStatementErrorCallback::~JSCustomSQLStatementErrorCallback):
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.h:
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
-        (WebCore::JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback):
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.h:
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
-        (WebCore::JSCustomSQLTransactionErrorCallback::~JSCustomSQLTransactionErrorCallback):
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
-        * bindings/js/JSCustomVoidCallback.cpp:
-        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
-        (WebCore::JSCustomVoidCallback::~JSCustomVoidCallback):
-        (WebCore::JSCustomVoidCallback::handleEvent):
-        * bindings/js/JSCustomVoidCallback.h:
-        * storage/Database.cpp:
-        (WebCore::Database::Database):
-
-2009-10-07  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Dave Levin.
-
-        Fix StringImpl::m_buffer
-        https://bugs.webkit.org/show_bug.cgi?id=30189
-
-        Fix my previous StringImpl patch to avoid using an indefinite-length array member,
-        since MSVC doesn't like it. Instead, go back to offsetting by sizeof(StringImpl).
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::StringImpl):
-        (WebCore::StringImpl::createUninitialized):
-        * platform/text/StringImpl.h:
-        (WebCore::StringImpl::bufferIsInternal):
-
-2009-10-07  Aaron Boodman  <aa@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Update isolated worlds under v8 to support world reuse.
-        https://bugs.webkit.org/show_bug.cgi?id=30145
-
-        * bindings/v8/ScriptController.cpp:
-        Replace evaluateInNewIsolatedWorld() withe evaluateInIsolatedWorld(id).
-        (WebCore::ScriptController::evaluateInIsolatedWorld):
-        * bindings/v8/ScriptController.h: Ditto.
-        * bindings/v8/V8Proxy.cpp: Ditto.
-        (WebCore::V8Proxy::~V8Proxy): Dittio.
-        (WebCore::V8Proxy::evaluateInIsolatedWorld): Ditto.
-        * bindings/v8/V8Proxy.h: Ditto.
-        * bindings/v8/V8IsolatedWorld.cpp:
-        Add support for controlling lifetime of a world, rather than relying on GC.
-        (WebCore::V8IsolatedWorld::contextWeakReferenceCallback): Ditto.
-        (WebCore::V8IsolatedWorld::V8IsolatedWorld): Ditto.
-        (WebCore::V8IsolatedWorld::destroy): Ditto.
-        * bindings/v8/V8IsolatedWorld.h: Ditto.
-
-2009-10-07  Jeremy Orlow  <jorlow@chromium.org>
-
-        Build fix for http://trac.webkit.org/changeset/49272 on Windows
-
-        * platform/text/StringImpl.h:
-
-2009-10-07  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Optimization of StringImpl:
-        - Remove unnecessary m_bufferIsInternal member (saves 4 bytes). Instead, check whether
-          m_data points to just past the end of the object's members.
-        - copy() and createWithTerminatingNullCharacter() create the string in a single malloc
-          block instead of 2 (saves ~20 bytes and considerable CPU cycles, increases locality).
-        - Move m_length next to m_hash to save 4 bytes of padding in 64-bit builds.
-          
-        https://bugs.webkit.org/show_bug.cgi?id=29500
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::StringImpl): Re-ordered members.
-        (WebCore::StringImpl::~StringImpl): Change to is-buffer-internal check.
-        (WebCore::StringImpl::createUninitialized): Use new m_buffer member instead of sizeof()
-            to ensure chars are copied to correct location.
-        (WebCore::StringImpl::createWithTerminatingNullCharacter): Make sure copy is created
-            in a single malloc block.
-        (WebCore::StringImpl::threadsafeCopy): Make sure copy is created in a single malloc block.
-        (WebCore::StringImpl::crossThreadString): Make sure copy is created in a single malloc block.
-        (WebCore::StringImpl::sharedBuffer): Change to is-buffer-internal check.
-        * platform/text/StringImpl.h:
-        (WebCore::StringImpl::startsWith): Just fixed a confusing param name.
-        (WebCore::StringImpl::bufferIsInternal): Changed member var into accessor method.
-        (WebCore::StringImpl::m_data): Repositioned for optimal member packing in 64-bit.
-        (WebCore::StringImpl::m_buffer): Added to provide an explicit location for where internal buffer goes.
-
-2009-10-07  Daniel Bates  <dbates@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30102
-        And
-        <rdar://problem/5015957>
-        
-        Manual test to confirm that the not-allowed cursor is shown for an
-        invalid drag-and-drop operation.
-        
-        We cannot test this using DRT because of a discrepancy between the Windows
-        API-based drop effect and the WebKit drop effect. See bug #24731 for more
-        details.
-
-        * manual-tests/drag-cursor-notallowed.html: Added.
-
-2009-10-07  Mark Rowe  <mrowe@apple.com>
-
-        Fix the build.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-10-07  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <http://webkit.org/b/30104>.
-        Inspector should show cookies of sub-resources on the page.
-        
-        This function implements showing cookies for all sub-resources of a page.
-        When the page is loaded, it populates the Storage Panel with a list of all
-        domains that were loaded as part of the full page load (iframes, ads, etc).
-        When the user selects one of the domains, the inspector calls back into the
-        controller, and the controller combines all of the cookies from that domain
-        into a list, and sends that list is sent back to the controller to render.
-        
-        A domain now needs to be passed into CookieItemsView, and CookieSidebarTreeElement.
-        
-        As a result of a previous patch, we now have detailed cookie information for
-        both Windows on CFNetwork and Mac. Additionally, this patch provides deleteCookie
-        support on Windows.
-
-        * bindings/js/ScriptObject.cpp:
-        (WebCore::ScriptObject::set):
-        * bindings/js/ScriptObject.h:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getCookies):
-        (WebCore::InspectorBackend::deleteCookie):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * dom/Document.cpp:
+        (WebCore::Document::inspectorController):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::inspectorController):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::injectScript):
+        (WebCore::InjectedScriptHost::nextWorkerId):
+        (WebCore::InjectedScriptHost::didCreateWorker):
+        (WebCore::InjectedScriptHost::willDestroyWorker):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
         * inspector/InspectorController.cpp:
         (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::didFinishLoading):
-        (WebCore::InspectorController::getCookies):
-        (WebCore::InspectorController::buildArrayForCookies):
-        (WebCore::InspectorController::buildObjectForCookie):
-        (WebCore::InspectorController::deleteCookie):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didCreateWorker):
+        (WebCore::InspectorController::willDestroyWorker):
         * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        * inspector/InspectorDOMAgent.h:
         * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addCookieDomainForDocument):
+        (WebCore::InspectorFrontend::didCreateWorker):
+        (WebCore::InspectorFrontend::willDestroyWorker):
         * inspector/InspectorFrontend.h:
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView):
-        (WebInspector.CookieItemsView.prototype.update):
-        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.Cookies.getCookiesAsync):
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel):
-        (WebInspector.StoragePanel.prototype.reset):
-        (WebInspector.StoragePanel.prototype.addCookieDomain):
-        (WebInspector.StoragePanel.prototype.showCookies):
-        (WebInspector.CookieSidebarTreeElement):
-        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addCookieDomain):
-        * platform/Cookie.h:
-        (WebCore::CookieHash::hash):
-        (WebCore::CookieHash::equal):
-        (WTF::):
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::deleteCookie):
-
-2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Add ScriptObject::set(const char*, unsigned).
-
-        https://bugs.webkit.org/show_bug.cgi?id=30104
-
-        * bindings/v8/ScriptObject.cpp:
-        (WebCore::ScriptObject::set):
-        * bindings/v8/ScriptObject.h:
-
-2009-10-07  Brent Fulgham  <bfulgham@webkit.org>
-
-        Unreviewed build fix for Windows (Cairo).
-
-        Provide implementation of new BitmapImage::create that was
-        added in @r49060.
-
-        * platform/graphics/win/ImageCairoWin.cpp:
-
-2009-10-07  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by Eric Carlson.
-
-        Refactor RenderThemeChromiumMac and RenderThemeChromiumSkia to render media controls using GraphicsContext.
-
-        Design was based on existing RenderMediaControls.cpp used by RenderThemeSafari/Win.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29987
-
-        Covered by existing layout tests as no new functionality was introduced.
-
-        * WebCore.gypi: Added RenderMediaControlsChromium.cpp/h.
-        * css/mediaControlsChromium.css: Tweaked media slider position and border style.
-        * rendering/MediaControlElements.cpp:
-        (WebCore::toParentMediaElement): Taken from RenderMediaControls.
-        (WebCore::MediaControlElement::rendererIsNeeded): Don't call shouldRenderMediaControlPart() if element has no appearance.
-        (WebCore::MediaControlInputElement::rendererIsNeeded): Ditto.
-        * rendering/RenderMediaControls.cpp: Moved parentMediaElement() to MediaControlElements.
-        * rendering/RenderMediaControlsChromium.cpp: Added.
-        (WebCore::platformResource): Helper to load and cache media control image resources.
-        (WebCore::mediaSliderThumbImage): Implementation refactored from RenderThemeChromiumMac/Skia.
-        (WebCore::mediaVolumeSliderThumbImage): Ditto.
-        (WebCore::paintMediaButton): Ditto.
-        (WebCore::paintMediaMuteButton): Ditto.
-        (WebCore::paintMediaPlayButton): Ditto.
-        (WebCore::paintMediaSlider): Ditto.
-        (WebCore::paintMediaSliderThumb): Ditto.
-        (WebCore::paintMediaVolumeSlider): Ditto.
-        (WebCore::paintMediaVolumeSliderThumb): Ditto.
-        (WebCore::paintMediaTimelineContainer): Ditto.
-        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart): Ditto.
-        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart): Same
-        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
-        * rendering/RenderMediaControlsChromium.h: Added.
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize): Implementation delegated to RenderMediaControlsChromium.
-        (WebCore::RenderThemeChromiumMac::shouldRenderMediaControlPart): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground): Ditto.
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintMediaControlsBackground): Implementation delegated to RenderMediaControlsChromium.
-        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack): Ditto.
-        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Ditto.
-        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Ditto.
-        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Ditto.
-        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Ditto.
-        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton): Ditto.
-        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton): Ditto.
-        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Ditto.
-
-2009-10-07  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
+        * inspector/InspectorWorkerResource.h: Added.
+        (WebCore::InspectorWorkerResource::create):
+        (WebCore::InspectorWorkerResource::id):
+        (WebCore::InspectorWorkerResource::url):
+        (WebCore::InspectorWorkerResource::isSharedWorker):
+        (WebCore::InspectorWorkerResource::InspectorWorkerResource):
+        * inspector/front-end/Checkbox.js: Added.
+        (WebInspector.Checkbox.callbackWrapper):
+        (WebInspector.Checkbox):
+        (WebInspector.Checkbox.prototype.checked):
+        * inspector/front-end/InjectedFakeWorker.js:
+        (InjectedFakeWorker.FakeWorker):
+        (InjectedFakeWorker.FakeWorker.prototype.terminate):
+        (InjectedFakeWorker.FakeWorker.prototype._handleException):
+        (InjectedFakeWorker.FakeWorker.prototype._importScripts):
+        (InjectedFakeWorker.FakeWorker.prototype._loadScript):
+        (InjectedFakeWorker.FakeWorker.prototype._expandURLAndCheckOrigin):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasEnabled):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasDisabled):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.showInheritedToggleFunction):
+        (WebInspector.StylePropertiesSection):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/WorkersSidebarPane.js: Added.
+        (WebInspector.WorkersSidebarPane):
+        (WebInspector.WorkersSidebarPane.prototype.addWorker):
+        (WebInspector.WorkersSidebarPane.prototype.removeWorker):
+        (WebInspector.WorkersSidebarPane.prototype.setInstrumentation):
+        (WebInspector.WorkersSidebarPane.prototype.reset):
+        (WebInspector.WorkersSidebarPane.prototype._onTriggerInstrument):
+        (WebInspector.Worker):
+        (WebInspector.didCreateWorker):
+        (WebInspector.willDestroyWorker):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::AbstractWorker):
+        (WebCore::AbstractWorker::~AbstractWorker):
+        (WebCore::AbstractWorker::onDestroyWorker):
+        (WebCore::AbstractWorker::contextDestroyed):
+        * workers/AbstractWorker.h:
+        (WebCore::AbstractWorker::id):
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
 
-        Make plugins work with beforeload.
+2010-03-10  Roland Steiner  <rolandsteiner@chromium.org>
 
-        Added fast/dom/beforeload/flash-before-load.html
+        Unreviewed build fix. Fix variable name change that somehow didn't
+        make it into the patch.
 
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::parseMappedAttribute):
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::updateWidget):
+2010-03-10  Roland Steiner  <rolandsteiner@chromium.org>
 
-2009-10-07  Vitaly Repeshko  <vitalyr@chromium.org>
+        Reviewed by David Levin.
 
-        Reviewed by Adam Barth.
+        Bug 28293 -  [Chromium] event.datatransfer.getdata("text/uri-list") is treated the same as getdata("URL")
+        https://bugs.webkit.org/show_bug.cgi?id=28293
+        
+        Change ChromiumDataObject such that it treats types "URL" and "text/uri-list"
+        correctly for event.dataTransfer.getData/setData. Currently both are treated
+        as synonyms, but for "URL", getData is supposed to only return the first valid URL
+        contained within the data for "text/uri-list" (see HTML5 spec).
 
-        [V8] Protect JS listener object from GC while clearing a property on it.
-        See http://crbug.com/23780.
-        https://bugs.webkit.org/show_bug.cgi?id=30137
+        Tests: editing/pasteboard/dataTransfer-setData-getData.html
 
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::clearAllExceptFiles):
+        (WebCore::ChromiumDataObject::hasData):
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::clearURL):
+        (WebCore::ChromiumDataObject::hasValidURL):
+        (WebCore::ChromiumDataObject::getURL):
+        (WebCore::ChromiumDataObject::setURL):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::):
+        (WebCore::clipboardTypeFromMIMEType):
+        (WebCore::ClipboardChromium::clearData):
+        (WebCore::ClipboardChromium::getData):
+        (WebCore::ClipboardChromium::setData):
+        (WebCore::ClipboardChromium::types):
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::canSmartReplace):
 
-2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+2010-03-09  Pavel Feldman  <pfeldman@chromium.org>
 
-        Rubber-stamped by Eric Seidel.
+        Reviewed by Timothy Hatcher.
 
-        Allow custom memory allocation control for WebCore's CachedResourceClient class
-        https://bugs.webkit.org/show_bug.cgi?id=30165
+        Web Inspector: REGRESSION: Tall image resources are cropped over the bottom.
 
-        Inherits CachedResourceClient class from FastAllocBase because (its
-        child class) CSSFontFaceSource has been instantiated by 'new' in WebCore/css/CSSFontFaceSource.h:46.
+        https://bugs.webkit.org/show_bug.cgi?id=34720
 
-        * loader/CachedResourceClient.h:
+        * inspector/front-end/inspector.css:
 
-2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+2010-03-09  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Timothy Hatcher.
 
-        Allow custom memory allocation control for WebCore's IdentifierRep 
-        https://bugs.webkit.org/show_bug.cgi?id=30159                                                        
+        Web Inspector: REGRESSION: Pressing up/down arrow key to change numeric
+        value in CSS property takes focus away.
 
-        Inherits IdentifierRep class from FastAllocBase because it has been                                 
-        instantiated by 'new' in WebCore/bridge/IdentifierRep.cpp:61.  
+        https://bugs.webkit.org/show_bug.cgi?id=34697
 
-        * bridge/IdentifierRep.h:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        (WebInspector.StylePropertyTreeElement.prototype.):
 
-2009-10-07  Anton Muhin  <antonm@chromium.org>
+2010-03-09  Tony Chang  <tony@chromium.org>
 
         Reviewed by Adam Barth.
 
-        Fetch pointers to C+DOM window immediately from holder
-        object (do not search prototype chain for proper JS wrapper).
-        https://bugs.webkit.org/show_bug.cgi?id=29031
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::createNewContext):
-        (WebCore::V8Proxy::installDOMWindow):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::INDEXED_ACCESS_CHECK):
-2009-10-07  Adam Roben  <aroben@apple.com>
-
-        Fix typo in PluginView::load that was causing cross-origin loads to
-        be allowed
-
-        This typo was introduced in the build fix in r49213.
-
-        Fixes <http://webkit.org/b/30168> REGRESSION (r49213):
-        http/tests/plugins/local-geturl-from-remote.html is failing on Windows
-
-        Reviewed by Sam Weinig.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::load): Removed a comma operator that was making
-        a condition always evaluate to true.
-
-2009-10-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Do not create valid QColor's for invalid WebCore::Color's.
+        https://bugs.webkit.org/show_bug.cgi?id=21840
+        https://bugs.webkit.org/show_bug.cgi?id=23993
 
-        * platform/graphics/qt/ColorQt.cpp:
-        (WebCore::Color::operator QColor):
+        Fix an editing bug where replacing a selection would result in the
+        new text ending up inside nodes that were not visibly included in the
+        selection.  Instead, move our destination position out of nodes that
+        were not visibly included.
 
-2009-10-07  Janne Koskinen  <janne.p.koskinen@digia.com>
+        Tests: editing/deleting/backspace-avoid-preceding-style.html
+               editing/inserting/replace-at-visible-boundary.html
 
-        Reviewed by Simon Hausmann.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::positionAvoidingPrecedingNodes):
+        (WebCore::ReplaceSelectionCommand::doApply):
 
-        [Qt] Symbian SBSv2 .data segment adress fix
-        https://bugs.webkit.org/show_bug.cgi?id=30157
+2010-03-09  Brady Eidson  <beidson@apple.com>
 
-        RO-section in qtwebkit.dll exceeds allocated space in SBSv2. Move RW-section
-        base address to start from 0x800000 instead of the toolchain default 0x400000
+        Reviewed by Tim Hatcher.
 
-        * WebCore.pro:
+        REGRESSION: WebInspector docking busted on Windows
+        <rdar://problem/7728433> and https://bugs.webkit.org/show_bug.cgi?id=35953
 
-2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+        First off, a bit of settings-key related cleanup. If they're shared over multiple files, these 
+        things should be properly declared Strings, not random loose char*'s.
 
-        Reviewed by Timothy Hatcher.
+        Along with that change, we move the "inspectorStartsAttachedSettingName" from WebKit down to the
+        InspectorController in WebCore.
 
-        Web Inspector: Migrate database inspection to the injected script-based schema.
+        Finally, when the controller is ready to show the WebInspector window, it can use this newly
+        exposed settings key to call "setWindowVisible" directly instead of relying on "showWindow" to do
+        it indirectly.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29788
+        * WebCore.base.exp:
 
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::databaseForId):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::dispatchOnInjectedScript):
-        (WebCore::InspectorBackend::databaseForId):
-        (WebCore::InspectorBackend::selectDatabase):
-        (WebCore::InspectorBackend::getDatabaseTableNames):
-        (WebCore::InspectorBackend::reportDidDispatchOnInjectedScript):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
+        (WebCore::InspectorBackend::saveFrontendSettings):
         * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::frontendSettingsSettingName):
+        (WebCore::InspectorController::inspectorStartsAttachedSettingName):
+        (WebCore::InspectorController::scriptObjectReady): Using the new inspectorStartsAttachedSettingName
+          key and some "can I attach this?" logic, call setWindowVisible directly to display the inspector
+          window.
         (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::resetScriptObjects):
-        (WebCore::InspectorController::selectDatabase):
-        (WebCore::InspectorController::databaseForId):
-        (WebCore::InspectorController::didOpenDatabase):
-        (WebCore::InspectorController::didUseDOMStorage):
-        (WebCore::InspectorController::selectDOMStorage):
-        (WebCore::InspectorController::getDOMStorageResourceForId):
         * inspector/InspectorController.h:
-        * inspector/InspectorDatabaseResource.cpp:
-        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
-        (WebCore::InspectorDatabaseResource::bind):
-        * inspector/InspectorDatabaseResource.h:
-        (WebCore::InspectorDatabaseResource::database):
-        (WebCore::InspectorDatabaseResource::id):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addDatabase):
-        (WebCore::InspectorFrontend::selectDatabase):
-        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
-        (WebCore::InspectorFrontend::addDOMStorage):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/Database.js:
-        (WebInspector.Database):
-        (WebInspector.Database.prototype.get id):
-        (WebInspector.Database.prototype.set name):
-        (WebInspector.Database.prototype.set version):
-        (WebInspector.Database.prototype.set domain):
-        (WebInspector.Database.prototype.getTableNames):
-        (WebInspector.Database.prototype.executeSql):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.dispatch):
-        (InjectedScript.executeSql):
-        (InjectedScript.executeSql.errorCallback):
-        (InjectedScript.executeSql.queryTransaction):
-        * inspector/front-end/InjectedScriptAccess.js:
-        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
-        (InjectedScriptAccess._installHandler):
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel.prototype.selectDatabase):
-        (WebInspector.StoragePanel.prototype.dataGridForResult):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addDatabase):
 
-2009-10-07  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Windowless Plugins: Disable content propagation for QGraphicsView items
-        
-        We cannot support content propagation for items in QGraphicsView because
-        the contents of the backing store might be transformed. So turn it off
-        if we are not painting on QWidget.
-        
-        Note that this check will not work for a QWebView in a
-        QGraphicsProxyWidget, but I guess it's fine. Alternative is to do an
-        even uglier cast: static_cast painter's paintDevice() to QWidget and
-        check if it is the viewport() of QGraphicsView.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30149
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
-
-2009-10-07  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Fix the Qt build by adding the missing files to the build.
-
-        * WebCore.pro:
-
-2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Xan Lopez.
-
-        Fix incorrect convertion of double into int while assigning it to
-        a float.
-
-        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
-        (WebCore::SimpleFontData::platformInit):
-        * platform/graphics/gtk/SimpleFontDataPango.cpp:
-        (WebCore::SimpleFontData::platformInit):
-
-2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Xan Lopez.
+2010-03-09  Alexey Proskuryakov  <ap@apple.com>
 
-        Fix rounding error issues in height calculation in 64 bits.
-
-        Already covered by existing tests.
+        Reviewed by Mark Rowe.
 
-        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
-        (WebCore::SimpleFontData::platformInit):
-        * platform/graphics/gtk/SimpleFontDataPango.cpp:
-        (WebCore::SimpleFontData::platformInit):
+        https://bugs.webkit.org/show_bug.cgi?id=35951
+        <rdar://problem/7327060> Frequent crashes in Dashcode at JSC::Bindings::ObjcInstance::~ObjcInstance + 80
 
-2009-10-07  Shinichiro Hamaji  <hamaji@chromium.org>
+        * bridge/objc/objc_instance.mm: (createInstanceWrapperCache): Fix Tiger code path, too.
 
-        Reviewed by Eric Seidel.
+2010-03-09  Alexey Proskuryakov  <ap@apple.com>
 
-        Dual lines in css2.1 layout tests do not match:
-        https://bugs.webkit.org/show_bug.cgi?id=23262
+        Reviewed by Oliver Hunt.
 
-        Now we can put a counter node as the next sibling of a reset node.
-        Re-layout the counter content when the count is updated.
+        https://bugs.webkit.org/show_bug.cgi?id=35951
+        <rdar://problem/7327060> Frequent crashes in Dashcode at JSC::Bindings::ObjcInstance::~ObjcInstance + 80
 
-        Tests: fast/css/counters/t1204-increment-00-c-o.html
-               fast/css/counters/t1204-increment-01-c-o.html
+        * bridge/objc/objc_instance.mm: (createInstanceWrapperCache): It's not correct to use object
+        personality for keys, because the key can be a mutable object, so its hash can change over its
+        lifetime.
 
-        * rendering/CounterNode.cpp:
-        (WebCore::CounterNode::recount):
-        * rendering/RenderCounter.cpp:
-        (WebCore::findPlaceForCounter):
+2010-03-09  Ojan Vafai  <ojan@chromium.org>
 
-2009-10-06  Xan Lopez  <xlopez@igalia.com>
+        Reviewed by Darin Adler.
 
-        Try to fix the GTKbuild.
+        Fix review comment accidentally overlooked in bug 35713
+        https://bugs.webkit.org/show_bug.cgi?id=35947
 
-        * GNUmakefile.am:
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::setStartingSelectionOnSmartDelete):
+        * editing/DeleteSelectionCommand.h:
 
-2009-10-06  Adam Barth  <abarth@webkit.org>
+2010-03-03  Ojan Vafai  <ojan@chromium.org>
 
         Reviewed by Adam Barth.
 
-        Removed unused member variable from FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30146
+        undo after smartdelete should select the deleted space
+        https://bugs.webkit.org/show_bug.cgi?id=35713
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        * loader/FrameLoader.h:
+        TextEdit behavior is to select the deleted space after a smartdelete.
 
-2009-10-06  David Levin  <levin@chromium.org>
+        Tests: editing/undo/undo-smart-delete-reversed-selection.html
+               editing/undo/undo-smart-delete-word.html
 
-        Reviewed by NOBODY (build fix).
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::setStartingSelectionOnSmartDelete):
+        (WebCore::DeleteSelectionCommand::initializePositionData):
+        * editing/DeleteSelectionCommand.h:
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::setWithoutValidation):
+        This assert looks bogus to me. undo-smart-delete-reversed-selection.html hits it
+        but not as a result of the other changes in this patch. The granularity when
+        deleting after making a wordgranularity selection is wordgranularity, not charactergranularity.
 
-        A few small/trivial tweaks to the last build fix.
+2010-03-09  Steve Falkenburg  <sfalken@apple.com>
 
-        * bindings/scripts/CodeGeneratorV8.pm:
+        Rubber stamped by Adam Roben.
 
-2009-10-06  David Levin  <levin@chromium.org>
+        Load debug version of graphics library in Windows Debug_All builds.
 
-        Reviewed by Dimitri Glazkov.
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::acceleratedCompositingAvailable):
 
-        [Chromium] Need to adjust MessagePort, etc. code for the post clone work done.
-        https://bugs.webkit.org/show_bug.cgi?id=30147
+2010-03-09  Brady Eidson  <beidson@apple.com>
 
-        No change in functionality so no new tests.
+        Reviewed by Darin Adler.
 
-        * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/SerializedScriptValue.h: Added.
-         A very simple implementation of SerializedScriptValue
-         that only works for strings.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8MessageEventCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        Plug-ins don't always respect the cookie accept policy.
+        <rdar://problem/7338359> and https://bugs.webkit.org/show_bug.cgi?id=26391
 
-2009-10-06  Sam Weinig  <sam@webkit.org>
+        The problem is that the various plug-in implementations call into a ResourceLoader
+        directly instead of filtering the request through FrameLoader. This bypassed the step
+        of adding extra fields to the requests, such as the firstPartyForCookies URL.
 
-        Reviewed by Brady Eidson.
+        Since plug-in code is currently so strewn about and very platform specific, I
+        think reworking it needs to be a task for domain experts. I don't know the implications
+        of adding *all* the extra fields to plug-in requests, for example.
 
-        Fix for <rdar://problem/7271202>
-        Dispatch resource load delegate functions for the media element.
-        Since we don't get the required callbacks from the media engine,
-        just fake the parameters to the delegate functions as best as possible.
+        There's no harm in this targeted fix for the hole in our cookie accept policy until
+        plug-ins can more fundamentally change.
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::loadResource):
-        (WebCore::HTMLMediaElement::isSafeToLoadURL):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::willLoadMediaElementURL):
-        * loader/FrameLoader.h:
+        Test: http/tests/plugins/third-party-cookie-accept-policy.html
 
-2009-10-06  Oliver Hunt  <oliver@apple.com>
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::load): Don't load a resource without first giving the request 
+          a firstPartyForCookies URL.
 
-        Reviewed by NOBODY (Build fix).
+2010-03-09  Andy Estes  <aestes@apple.com>
 
-        More build fixes.
+        Reviewed by Adele Peterson.
 
-        * bindings/js/SerializedScriptValue.cpp:
-        (WebCore::DeserializingTreeWalker::getProperty):
-        (WebCore::TeardownTreeWalker::getProperty):
-        * bindings/js/SerializedScriptValue.h:
-        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        Check for null renderer in scrollNode().
+        https://bugs.webkit.org/show_bug.cgi?id=34700
 
-2009-10-06  Oliver Hunt  <oliver@apple.com>
+        Test: fast/events/remove-child-onscroll.html
 
-        Reviewed by NOBODY (Build fix).
+        * page/EventHandler.cpp:
+        (WebCore::scrollNode): Return early if node->renderer() == 0
 
-        Build and formatting fix.
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        * ForwardingHeaders/runtime/ExceptionHelpers.h: Added.
-        * bindings/js/SerializedScriptValue.cpp:
-        * bindings/js/SerializedScriptValue.h:
-        (WebCore::SerializedScriptValueData::operator bool):
-        (WebCore::SerializedScriptValueData::release):
-        (WebCore::SerializedScriptValue::release):
-        (WebCore::SerializedScriptValue::toString):
-        (WebCore::SerializedScriptValue::~SerializedScriptValue):
-        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        Unreviewed distcheck fix.
 
-2009-10-05  Oliver Hunt  <oliver@apple.com>
+        * GNUmakefile.am:
 
-        Reviewed by Gavin Barraclough.
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        It should be possible to post (clone) built-in JS objects to Workers
-        https://bugs.webkit.org/show_bug.cgi?id=22878
+        Unreviewed build fix (only exposed by make distcheck). The
+        SharedWorkers files are not built, they need to be distributed.
 
-        Implement object cloning semantics for postMessage.  Currently only
-        a partial implementation of the spec -- cloning of File, FileList,
-        ImageData, and RegExp were left out as they would have significantly
-        increased patch size.
+        * GNUmakefile.am:
 
-        Cloning requires multiple tree walks so we use a templated tree
-        walk function, allowing us to share a single implementation for
-        serialization, deserialization, and eventual destruction of the
-        serialized object tree.
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Test: fast/dom/Window/window-postmessage-clone.html
+        Reviewed by Dirk Schulze.
 
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::postMessage):
-        * bindings/js/JSMessageEventCustom.cpp:
-        (WebCore::JSMessageEvent::initMessageEvent):
-        * bindings/js/JSMessagePortCustom.h:
-        (WebCore::handlePostMessage):
-        * bindings/js/SerializedScriptValue.cpp: Added.
-        (WebCore::SerializedObject::set):
-        (WebCore::SerializedObject::names):
-        (WebCore::SerializedObject::values):
-        (WebCore::SerializedObject::create):
-        (WebCore::SerializedObject::clear):
-        (WebCore::SerializedObject::SerializedObject):
-        (WebCore::SerializedArray::setIndex):
-        (WebCore::SerializedArray::canDoFastRead):
-        (WebCore::SerializedArray::getIndex):
-        (WebCore::SerializedArray::getSparseIndex):
-        (WebCore::SerializedArray::length):
-        (WebCore::SerializedArray::create):
-        (WebCore::SerializedArray::clear):
-        (WebCore::SerializedArray::SerializedArray):
-        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
-        (WebCore::SharedSerializedData::asArray):
-        (WebCore::SharedSerializedData::asObject):
-        (WebCore::):
-        (WebCore::walk):
-        (WebCore::BaseWalker::BaseWalker):
-        (WebCore::BaseWalker::shouldTerminate):
-        (WebCore::BaseWalker::ticksUntilNextCheck):
-        (WebCore::BaseWalker::didTimeOut):
-        (WebCore::BaseWalker::throwStackOverflow):
-        (WebCore::BaseWalker::throwInterruptedException):
-        (WebCore::SerializingTreeWalker::SerializingTreeWalker):
-        (WebCore::SerializingTreeWalker::null):
-        (WebCore::SerializingTreeWalker::isArray):
-        (WebCore::SerializingTreeWalker::isObject):
-        (WebCore::SerializingTreeWalker::asInputArray):
-        (WebCore::SerializingTreeWalker::asInputObject):
-        (WebCore::SerializingTreeWalker::createOutputArray):
-        (WebCore::SerializingTreeWalker::createOutputObject):
-        (WebCore::SerializingTreeWalker::length):
-        (WebCore::SerializingTreeWalker::canDoFastRead):
-        (WebCore::SerializingTreeWalker::getIndex):
-        (WebCore::SerializingTreeWalker::getSparseIndex):
-        (WebCore::SerializingTreeWalker::getProperty):
-        (WebCore::SerializingTreeWalker::convertIfTerminal):
-        (WebCore::SerializingTreeWalker::getPropertyNames):
-        (WebCore::SerializingTreeWalker::putIndex):
-        (WebCore::SerializingTreeWalker::putProperty):
-        (WebCore::SerializingTreeWalker::startArray):
-        (WebCore::SerializingTreeWalker::endArray):
-        (WebCore::SerializingTreeWalker::startObject):
-        (WebCore::SerializingTreeWalker::endObject):
-        (WebCore::SerializedScriptValueData::serialize):
-        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
-        (WebCore::DeserializingTreeWalker::null):
-        (WebCore::DeserializingTreeWalker::isArray):
-        (WebCore::DeserializingTreeWalker::isObject):
-        (WebCore::DeserializingTreeWalker::asInputArray):
-        (WebCore::DeserializingTreeWalker::asInputObject):
-        (WebCore::DeserializingTreeWalker::createOutputArray):
-        (WebCore::DeserializingTreeWalker::createOutputObject):
-        (WebCore::DeserializingTreeWalker::length):
-        (WebCore::DeserializingTreeWalker::canDoFastRead):
-        (WebCore::DeserializingTreeWalker::getIndex):
-        (WebCore::DeserializingTreeWalker::getSparseIndex):
-        (WebCore::DeserializingTreeWalker::getProperty):
-        (WebCore::DeserializingTreeWalker::convertIfTerminal):
-        (WebCore::DeserializingTreeWalker::getPropertyNames):
-        (WebCore::DeserializingTreeWalker::putIndex):
-        (WebCore::DeserializingTreeWalker::putProperty):
-        (WebCore::DeserializingTreeWalker::startArray):
-        (WebCore::DeserializingTreeWalker::endArray):
-        (WebCore::DeserializingTreeWalker::startObject):
-        (WebCore::DeserializingTreeWalker::endObject):
-        (WebCore::SerializedScriptValueData::deserialize):
-        (WebCore::TeardownTreeWalker::shouldTerminate):
-        (WebCore::TeardownTreeWalker::ticksUntilNextCheck):
-        (WebCore::TeardownTreeWalker::didTimeOut):
-        (WebCore::TeardownTreeWalker::throwStackOverflow):
-        (WebCore::TeardownTreeWalker::throwInterruptedException):
-        (WebCore::TeardownTreeWalker::null):
-        (WebCore::TeardownTreeWalker::isArray):
-        (WebCore::TeardownTreeWalker::isObject):
-        (WebCore::TeardownTreeWalker::asInputArray):
-        (WebCore::TeardownTreeWalker::asInputObject):
-        (WebCore::TeardownTreeWalker::createOutputArray):
-        (WebCore::TeardownTreeWalker::createOutputObject):
-        (WebCore::TeardownTreeWalker::length):
-        (WebCore::TeardownTreeWalker::canDoFastRead):
-        (WebCore::TeardownTreeWalker::getIndex):
-        (WebCore::TeardownTreeWalker::getSparseIndex):
-        (WebCore::TeardownTreeWalker::getProperty):
-        (WebCore::TeardownTreeWalker::convertIfTerminal):
-        (WebCore::TeardownTreeWalker::getPropertyNames):
-        (WebCore::TeardownTreeWalker::putIndex):
-        (WebCore::TeardownTreeWalker::putProperty):
-        (WebCore::TeardownTreeWalker::startArray):
-        (WebCore::TeardownTreeWalker::endArray):
-        (WebCore::TeardownTreeWalker::startObject):
-        (WebCore::TeardownTreeWalker::endObject):
-        (WebCore::SerializedScriptValueData::tearDownSerializedData):
-        * bindings/js/SerializedScriptValue.h: Added.
-        (WebCore::SharedSerializedData::~SharedSerializedData):
-        (WebCore::SerializedScriptValueData::):
-        (WebCore::SerializedScriptValueData::type):
-        (WebCore::SerializedScriptValueData::~SerializedScriptValueData):
-        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
-        (WebCore::SerializedScriptValueData::asImmediate):
-        (WebCore::SerializedScriptValueData::asDouble):
-        (WebCore::SerializedScriptValueData::asString):
-        (WebCore::SerializedScriptValueData::asObject):
-        (WebCore::SerializedScriptValueData::asArray):
-        (WebCore::SerializedScriptValueData::operator bool ):
-        (WebCore::SerializedScriptValueData::release):
-        (WebCore::SerializedScriptValue::create):
-        (WebCore::SerializedScriptValue::release):
-        (WebCore::SerializedScriptValue::toString):
-        (WebCore::SerializedScriptValue::deserialize):
-        (WebCore::SerializedScriptValue::~SerializedScriptValue):
-        (WebCore::SerializedScriptValue::SerializedScriptValue):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bindings/scripts/CodeGeneratorObjC.pm:
-        * dom/MessageEvent.cpp:
-        (WebCore::MessageEvent::MessageEvent):
-        (WebCore::MessageEvent::initMessageEvent):
-        * dom/MessageEvent.h:
-        (WebCore::MessageEvent::create):
-        (WebCore::MessageEvent::data):
-        * dom/MessageEvent.idl:
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::postMessage):
-        * dom/MessagePort.h:
-        * dom/MessagePortChannel.cpp:
-        (WebCore::MessagePortChannel::EventData::create):
-        (WebCore::MessagePortChannel::EventData::EventData):
-        * dom/MessagePortChannel.h:
-        (WebCore::MessagePortChannel::EventData::message):
-        * page/DOMWindow.cpp:
-        (WebCore::PostMessageTimer::PostMessageTimer):
-        (WebCore::DOMWindow::postMessage):
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-        * page/EventSource.cpp:
-        (WebCore::EventSource::createMessageEvent):
-        * websockets/WebSocket.cpp:
-        (WebCore::WebSocket::didReceiveMessage):
-        * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::postMessage):
-        * workers/DedicatedWorkerContext.h:
-        * workers/DedicatedWorkerContext.idl:
-        * workers/Worker.cpp:
-        (WebCore::Worker::postMessage):
-        * workers/Worker.h:
-        * workers/Worker.idl:
-        * workers/WorkerContextProxy.h:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::MessageWorkerContextTask::create):
-        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
-        (WebCore::MessageWorkerTask::create):
-        (WebCore::MessageWorkerTask::MessageWorkerTask):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerObjectProxy.h:
-
-2009-10-06  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed build fix for Windows.
+        [GStreamer] Buffering logic is not correct, and does not work very well
+        https://bugs.webkit.org/show_bug.cgi?id=35706
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::load):
+        Fix buffering to match GStreamer expectancies regarding the
+        pipeline state, so that videos which really need buffering to play
+        correctly also work, while maintaining the convenience of
+        on-disk-buffering. This required a bit of shuffling of state
+        change handling.
 
-2009-10-06  Adam Barth  <abarth@webkit.org>
+        No behaviour change expected.
 
-        Reviewed by Eric Seidel.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::processBufferingStats):
+        (WebCore::MediaPlayerPrivate::fillTimerFired):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        Move FrameLoader::canLoad to SecurityOrigin
-        https://bugs.webkit.org/show_bug.cgi?id=30111
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        * WebCore.base.exp:
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::isSafeToLoadURL):
-        * loader/Cache.cpp:
-        (WebCore::Cache::requestResource):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadSubframe):
-        (WebCore::FrameLoader::loadPlugin):
-        (WebCore::FrameLoader::loadFrameRequest):
-        (WebCore::FrameLoader::loadResourceSynchronously):
-        (WebCore::FrameLoader::createJavaAppletWidget):
-        * loader/FrameLoader.h:
-        * loader/SubresourceLoader.cpp:
-        (WebCore::SubresourceLoader::create):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::canLoad):
-        (WebCore::SecurityOrigin::shouldHideReferrer):
-        * page/SecurityOrigin.h:
+        Reviewed by Dirk Schulze.
 
-2009-10-06  Adam Barth  <abarth@webkit.org>
+        [GStreamer] Buffering logic is not correct, and does not work very well
+        https://bugs.webkit.org/show_bug.cgi?id=35706
 
-        Reviewed by Eric Seidel.
+        Do not call pause(), but set the GStreamer state directly. This is
+        just a GStreamer implementation detail, and this will avoid having
+        side effects in case we change the pause implementation in the
+        future.
 
-        Move setLocalLoadPolicy and friends to SecurityOrigin
-        https://bugs.webkit.org/show_bug.cgi?id=30110
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::load):
 
-        These have more to do with security policies than with loading frames.
+2010-03-09  Chris Fleizach  <cfleizach@apple.com>
 
-        * WebCore.base.exp:
-        * dom/Document.cpp:
-        (WebCore::Document::initSecurityContext):
-        * loader/Cache.cpp:
-        (WebCore::Cache::requestResource):
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/SubresourceLoader.cpp:
-        (WebCore::SubresourceLoader::create):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::setLocalLoadPolicy):
-        (WebCore::SecurityOrigin::restrictAccessToLocal):
-        (WebCore::SecurityOrigin::allowSubstituteDataAccessToLocal):
-        * page/SecurityOrigin.h:
-        (WebCore::SecurityOrigin::):
+        Reviewed by Darin Adler.
 
-2009-10-06  Brian Weinstein  <bweinstein@apple.com>
+        AX: hit testing a list box doesn't work anymore
+        https://bugs.webkit.org/show_bug.cgi?id=35893
 
-        Reviewed by Brady Eidson.
+        Since <option> elements don't have renderers, their hit testing needs
+        to be handled with a special case.
 
-        Preparation for <http://webkit.org/b/30104>.
-        Inspector should show cookies of sub-resources on the page.
-        
-        Implement getRawCookies for CFNetwork for Windows, so we can see more
-        than just a key/value pair for Cookies when we are on Windows.
+        Test: platform/mac/accessibility/listbox-hit-test.html
 
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::getRawCookies):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaIsHidden):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
 
-2009-10-06  Dave Hyatt  <hyatt@apple.com>
+2010-03-09  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Adam Roben.
+        Reviewed by Timothy Hatcher.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30132, make beforeload work with <link> elements and
-        XML processing instructions.
+        Web Inspector: Refactor Audits panel presentation layer.
+        This change removes unnecessary complexity:
+          - Audit scores were not used
+          - Audit rule parameters are passed as rule constructor arguments
+          - View management aligned with the rest of the front-end
+          - Single TreeOutline is used for category results (no need to create sections for those)
+          - Rules code beautified and simplified where possible
+          - Some UI improvements applied (see attached screenshot)
+
+        https://bugs.webkit.org/show_bug.cgi?id=35860
+
+        * inspector/front-end/AuditCategories.js:
+        (WebInspector.AuditCategories.PagePerformance.prototype.initialize):
+        (WebInspector.AuditCategories.NetworkUtilization.prototype.initialize):
+        * inspector/front-end/AuditResultView.js:
+        (WebInspector.AuditResultView):
+        (WebInspector.AuditCategoryResultPane):
+        (WebInspector.AuditCategoryResultPane.prototype._appendResult):
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.GzipRule.prototype.doRun):
+        (WebInspector.AuditRules.CombineExternalResourcesRule):
+        (WebInspector.AuditRules.CombineExternalResourcesRule.prototype.doRun):
+        (WebInspector.AuditRules.CombineJsResourcesRule):
+        (WebInspector.AuditRules.CombineCssResourcesRule):
+        (WebInspector.AuditRules.MinimizeDnsLookupsRule):
+        (WebInspector.AuditRules.MinimizeDnsLookupsRule.prototype.doRun):
+        (WebInspector.AuditRules.ParallelizeDownloadRule):
+        (WebInspector.AuditRules.ParallelizeDownloadRule.prototype.doRun):
+        (WebInspector.AuditRules.UnusedCssRule):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        (WebInspector.AuditRules.CacheControlRule):
+        (WebInspector.AuditRules.CacheControlRule.prototype.doRun):
+        (WebInspector.AuditRules.CacheControlRule.prototype.execCheck):
+        (WebInspector.AuditRules.BrowserCacheControlRule):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype.handleNonCacheableResources):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype.runChecks):
+        (WebInspector.AuditRules.ProxyCacheControlRule):
+        (WebInspector.AuditRules.ProxyCacheControlRule.prototype.runChecks):
+        (WebInspector.AuditRules.ImageDimensionsRule):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        (WebInspector.AuditRules.CssInHeadRule):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.StylesScriptsOrderRule):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.CookieRuleBase):
+        (WebInspector.AuditRules.CookieRuleBase.prototype.doRun.resultCallback):
+        (WebInspector.AuditRules.CookieRuleBase.prototype.doRun):
+        (WebInspector.AuditRules.CookieSizeRule):
+        (WebInspector.AuditRules.CookieSizeRule.prototype.processCookies):
+        (WebInspector.AuditRules.StaticCookielessRule):
+        (WebInspector.AuditRules.StaticCookielessRule.prototype.processCookies):
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel):
+        (WebInspector.AuditsPanel.prototype._executeAudit.ruleResultReadyCallback):
+        (WebInspector.AuditsPanel.prototype._executeAudit):
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        (WebInspector.AuditsPanel.prototype._didMainResourceLoad):
+        (WebInspector.AuditsPanel.prototype.showResults):
+        (WebInspector.AuditsPanel.prototype.showLauncherView):
+        (WebInspector.AuditsPanel.prototype.get visibleView):
+        (WebInspector.AuditsPanel.prototype.set visibleView):
+        (WebInspector.AuditsPanel.prototype.show):
+        (WebInspector.AuditsPanel.prototype._clearButtonClicked):
+        (WebInspector.AuditCategory.prototype.addRule):
+        (WebInspector.AuditRule):
+        (WebInspector.AuditRule.prototype.set severity):
+        (WebInspector.AuditRule.prototype.run):
+        (WebInspector.AuditRule.prototype.doRun):
+        (WebInspector.AuditCategoryResult):
+        (WebInspector.AuditCategoryResult.prototype.addRuleResult):
+        (WebInspector.AuditRuleResult):
+        (WebInspector.AuditRuleResult.prototype.addChild):
+        (WebInspector.AuditRuleResult.prototype.addURL):
+        (WebInspector.AuditRuleResult.prototype.addURLs):
+        (WebInspector.AuditRuleResult.prototype.addSnippet):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/audits.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.documentKeyDown):
 
-        Fix up ProcessingInstruction's setData call so that it actually updates a stylesheet when the
-        data gets changed.
+2010-03-09  Yury Semikhatsky  <yurys@chromium.org>
 
-        Move dispatchBeforeLoadedEvent to ContainerNode so all Elements (and ProcessingInstruction) can
-        access it.
+        Reviewed by Pavel Feldman.
+ 
+        When enable resource tracking state changes use the same method as
+        location.reload for reloading inspected page.
 
-        Added fast/dom/beforeload/link-before-load.html
+        https://bugs.webkit.org/show_bug.cgi?id=35923
 
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
-        * dom/ContainerNode.h:
-        * dom/ProcessingInstruction.cpp:
-        (WebCore::ProcessingInstruction::checkStyleSheet):
-        (WebCore::ProcessingInstruction::setData):
-        * dom/ScriptElement.cpp:
-        (WebCore::ScriptElementData::requestScript):
-        * dom/ScriptElement.h:
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::endElementNs):
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::parseMappedAttribute):
-        (WebCore::HTMLLinkElement::process):
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::forAttributeValue):
-        * html/HTMLScriptElement.h:
-        * svg/SVGScriptElement.cpp:
-        * svg/SVGScriptElement.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::reloadPage):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::enableResourceTracking):
 
-2009-10-06  Simon Fraser  <simon.fraser@apple.com>
+2010-03-09  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Mark Rowe.
+        Reviewed by Timothy Hatcher.
 
-        accessibility/media-element.html crashes (and has incorrect result)
-        https://bugs.webkit.org/show_bug.cgi?id=30108
+        Web Inspector: highlight text node containers while searching for node.
 
-        Fix up the accessibilty label for the newly added fullscreen button,
-        and update the test result accordingly.
+        https://bugs.webkit.org/show_bug.cgi?id=35912
 
-        * accessibility/AccessibilityMediaControls.cpp:
-        (WebCore::AccessibilityMediaControl::controlTypeName):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mouseDidMoveOverElement):
 
-2009-10-06  Kelly Norton  <knorton@google.com>
+2010-03-09  Philippe Normand  <pnormand@igalia.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Gustavo Noronha Silva.
 
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30028>
-        Multiple calls to SetFrontendProxyObject can leave an InspectorTimelineAgent with an invalid
-        InspectorFrontend.
+        [GStreamer] player code cleanups
+        https://bugs.webkit.org/show_bug.cgi?id=35868
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setFrontendProxyObject): Adds a check for an existing timeline agent.
+        Cleaned up the private instance variables of the player.
 
-2009-10-06  Antti Koivisto  <antti@apple.com>
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::fillTimerFired):
+        (WebCore::MediaPlayerPrivate::mediaLocationChanged):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        Reviewed by Dave Kilzer.
+2010-03-09  Philippe Normand  <pnormand@igalia.com>
 
-        Move textRects to the right category in DOM.mm. Include DOMPrivate.h to ensure that the interfaces match.
+        Reviewed by Gustavo Noronha Silva.
 
-        * bindings/objc/DOM.mm:
-        (-[DOMNode textRects]):
+        [GStreamer] player code cleanups
+        https://bugs.webkit.org/show_bug.cgi?id=35868
 
-2009-10-06  Benjamin C Meyer  <bmeyer@rim.com>
+        Splitted GOwnPtrGtk.{cpp,h} to GOwnPtr{Soup,GStreamer}.{cpp,h}.
 
-        Reviewed by Ariya Hidayat.
-        
-        Match the behavior of other WebKit browser and have the first url of the drag data be the url passed in declareAndWriteDragImage and set the text of the drag data to be the title argument.
-        
-        Manual test: Drag the readability js link from http://lab.arc90.com/experiments/readability/
-        
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::declareAndWriteDragImage):
+        * GNUmakefile.am:
+        * platform/graphics/gstreamer/GOwnPtrGStreamer.cpp: Added.
+        (WTF::GstElement):
+        * platform/graphics/gstreamer/GOwnPtrGStreamer.h: Added.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        * platform/gtk/GOwnPtrGtk.cpp: Removed.
+        * platform/gtk/GOwnPtrGtk.h: Removed.
+        * platform/network/soup/CookieJarSoup.cpp:
+        * platform/network/soup/DNSSoup.cpp:
+        * platform/network/soup/GOwnPtrSoup.cpp: Added.
+        (WTF::SoupURI):
+        * platform/network/soup/GOwnPtrSoup.h: Added.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        * platform/network/soup/ResourceRequestSoup.cpp:
 
-2009-10-06  Kent Tamura  <tkent@chromium.org>
+2010-03-09  Shinichiro Hamaji  <hamaji@chromium.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Eric Seidel.
 
-        Implement min/max attributes, ValidityState.rangeUnderflow and
-        ValidityState.rangeOverflow for <input type=number> and <input type=range>
-        https://bugs.webkit.org/show_bug.cgi?id=29069
-        
-        HTMLInputElement::max and min are not defined for COM because they
-        conflict with the standard min() and max() macros.
+        [Chromium] Should remove paddings of Win/Linux chromium's buttons
+        https://bugs.webkit.org/show_bug.cgi?id=35629
 
-        Tests: fast/forms/ValidityState-rangeOverflow-number.html
-               fast/forms/ValidityState-rangeOverflow-range.html
-               fast/forms/ValidityState-rangeUnderflow-number.html
-               fast/forms/ValidityState-rangeUnderflow-range.html
-               fast/forms/input-minmax.html
+        No new tests, but we may need to rebaseline bunch of expectation
+        images in chromium's tree.
 
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::rangeUnderflow):
-        (WebCore::HTMLInputElement::rangeOverflow):
-        (WebCore::HTMLInputElement::rangeMinimum):
-        (WebCore::HTMLInputElement::rangeMaximum):
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::rangeUnderflow):
-        (WebCore::ValidityState::rangeOverflow):
-        * html/ValidityState.h:
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderRange::SliderRange):
-        (WebCore::SliderRange::valueFromElement):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        * rendering/RenderThemeChromiumSkia.h:
 
-2009-10-06  Adam Barth  <abarth@webkit.org>
+2010-03-08  Kent Tamura  <tkent@chromium.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Adam Barth.
 
-        Move m_openedByDOM to Page
-        https://bugs.webkit.org/show_bug.cgi?id=30109
+        Implement HTML5 <hgroup> element.
+        https://bugs.webkit.org/show_bug.cgi?id=33369
 
-        We only need one instance of m_openedByDOM per page, we should move it
-        to a page-scoped object.  Notice that it's only ever touched for the
-        main frame.
+        <hgroup> should behave the same as <nav>, <section>, <article>, and <aside>.
+        <hgroup> has no specific parsing rules.
 
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::close):
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        (WebCore::Page::openedByDOM):
-        (WebCore::Page::setOpenedByDOM):
-        * page/Page.h:
+        Test: fast/html/hgroup-element.html
 
-2009-10-06  Carol Szabo  <carol.szabo@nokia.com>
+        * css/html.css: Add hgroup as a block element.
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag): Add hgroupTag.
+        * html/HTMLElement.cpp:
+        (WebCore::createTagPriorityMap): Returns 5 for hgroupTag.
+        (WebCore::blockTagList): Add hgroupTag.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode): Add hgroupTag.
+        * html/HTMLTagNames.in: Add hgroup.
 
-        Reviewed by Ariya Hidayat.
+2010-03-08  Tony Chang  <tony@chromium.org>
 
-        [Qt] Some functions in GraphicsContext do not work
-        as expected if the associated painter has no clipping.
-        https://bugs.webkit.org/show_bug.cgi?id=29691
+        Reviewed by Adam Barth.
 
-        No new tests are associated with this because DumpRenderTree
-        always sets clipping on the painter, thus it would never hit 
-        the test case, but fast/box-shadow/basic-shadows.html is a
-        good example of what happens if the clipping is not set by
-        the user of QtWebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=32131
+        Crash when inserting an ordered list.
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::clipOut):
-        (WebCore::GraphicsContext::clipOutEllipseInRect):
-        Fixed to handle the case that there is no clipping
-        before the call.
+        Test: editing/execCommand/insert-ordered-list.html
 
-2009-10-06  Dave Hyatt  <hyatt@apple.com>
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::rangeFromLocationAndLength):
 
-        Reviewed by Adam Roben.
+2010-03-08  Darin Adler  <darin@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30131, make beforeload fire on script elements.
+        Reviewed by Dan Bernstein.
 
-        Added tests in fast/dom/beforeload/.
+        Added a test for crash when you quit inside an unload handler.
+        rdar://problem/6958347
 
-        * dom/ScriptElement.cpp:
-        (WebCore::ScriptElementData::requestScript):
-        * dom/ScriptElement.h:
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::endElementNs):
-        * html/HTMLAttributeNames.in:
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::parseMappedAttribute):
-        (WebCore::HTMLScriptElement::dispatchBeforeLoadEvent):
-        * html/HTMLScriptElement.h:
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptHandler):
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::dispatchBeforeLoadEvent):
-        * svg/SVGScriptElement.h:
+        * manual-tests/quit-inside-unload.html: Added.
 
-2009-10-06  Xan Lopez  <xlopez@igalia.com>
+2010-03-08  Darin Adler  <darin@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Jon Honeycutt.
 
-        https://bugs.webkit.org/show_bug.cgi?id=25526
-        [Gtk] Additional support is needed for caret browsing
+        Don't auto-play <audio> and <video> elements loaded in background tabs
+        https://bugs.webkit.org/show_bug.cgi?id=35886
+        rdar://problem/7117745
 
-        Enable caret movement commands also when caret browsing setting is
-        enabled.
+        * manual-tests/video-in-non-frontmost-tab.html: Added.
+        * manual-tests/resources/video-tab.html: Added.
 
-        * editing/EditorCommand.cpp:
-        (WebCore::caretBrowsingEnabled):
-        (WebCore::enabledVisibleSelectionOrCaretBrowsing):
-        (WebCore::enabledInEditableTextOrCaretBrowsing):
-        (WebCore::CommandEntry::):
-        * manual-tests/gtk/caret-browsing.html: Added.
+        * html/HTMLMediaElement.h: Added MediaCanStartListener as a base class, and
+        added the mediaCanStart function as well as a boolean,
+        m_isWaitingUntilMediaCanStart.
 
-2009-10-06  Anton Muhin  <antonm@chromium>
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize
+        m_isWaitingUntilMediaCanStart.
+        (WebCore::HTMLMediaElement::~HTMLMediaElement): Call
+        removeMediaCanStartListener if m_isWaitingUntilMediaCanStart is true. 
+        (WebCore::HTMLMediaElement::loadInternal): Set m_isWaitingUntilMediaCanStart
+        and call addMediaCanStartListener if canStartMedia is false.
+        (WebCore::HTMLMediaElement::mediaCanStart): Clear m_isWaitingUntilMediaCanStart
+        and call loadInternal.
 
-        Reviewed by Dimitri Glazkov.
+2010-03-08  Csaba Osztrogonác  <ossy@webkit.org>
 
-        Non standard, but popular exetension allows automagically
-        turn a function into a namespace resolver.  Support that in
-        Chromium as well.
+        [GTK] Unreviewed buildfix after r55688.
 
-        Adjust CodeGeneratorV8 to treat XPathNSResolver in a special way.
-        https://bugs.webkit.org/show_bug.cgi?id=30128
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (webKitWebSrcStart):
 
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::getXPathNSResolver):
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+2010-03-08  Csaba Osztrogonác  <ossy@webkit.org>
 
-2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+        [GTK] Unreviewed buildfix after r55688.
 
-        Reviewed by Timothy Hatcher.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
 
-        Web Inspector: close inspector client view on
-        InspectorController::close API call.
+2010-03-08  Csaba Osztrogonác  <ossy@webkit.org>
 
-        In order to run batch web inspector layout tests (and not affect
-        subsequent tests) we should close inspector client's view upon
-        InspectorController::close API call.
+        [Qt] Unreviewed buildfix after r55688.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30009
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously):
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::inspectedPageDestroyed):
-        (WebCore::InspectorController::close):
+2010-03-08  Alexey Proskuryakov  <ap@apple.com>
 
-2009-10-06  Simon Hausmann  <simon.hausmann@nokia.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Tor Arne Vestbø.
+        https://bugs.webkit.org/show_bug.cgi?id=35879
+        Eliminate m_mightDownloadFromHandle
 
-        Fix the Qt/Windows build by stubbing out the still image
-        support for halted plugins for the Qt build.
+        It was only used on Mac, and unnecessarily complicated the code.
 
-        Bugzilla entry https://bugs.webkit.org/show_bug.cgi?id=30130
-        tracks removing this by implementing Frame::nodeImage().
+        No change in behavior, thus no test.
 
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::halt):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::loadNow):
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::load):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::createResourceHandle):
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::ResourceHandle):
+        (WebCore::ResourceHandle::create):
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
 
-2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+2010-03-02  Peter Kasting  <pkasting@google.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Adam Barth.
 
-        [Qt] Change QImageReader usage in ImageDecoderQt
-        https://bugs.webkit.org/show_bug.cgi?id=27538
+        Clean up usage of m_failed in open-source image decoders, part 1.
+        https://bugs.webkit.org/show_bug.cgi?id=35411
+        
+        Makes setFailed() virtual so subclasses can override it (none do yet) to
+        do automatic cleanup on failure; makes it return a bool for easy
+        tailcalling; makes failed() the only way to access m_failed so
+        subclasses are assured setFailed() won't be bypassed.  Plus one or two
+        other tiny cleanup bits.
 
-        Replace the ReadContext with another appoach to
-        reading the image. Attempt to only read meta information
-        like the image size and number of frames (for animations)
-        first and then when the page is getting drawn decode
-        the image with the QImageReader.
+        Overriding setFailed() is coming in a subsequent patch because it can be
+        hairy and needs close review.
 
-        This is a huge benefit on pages with many images and saves
-        ~2GB of memory on the szeged image test page.
+        No functional change, so no tests.
 
         * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ImageDecoderQt):
         (WebCore::ImageDecoderQt::setData):
-        (WebCore::ImageDecoderQt::isSizeAvailable):
-        (WebCore::ImageDecoderQt::frameCount):
-        (WebCore::ImageDecoderQt::repetitionCount):
-        (WebCore::ImageDecoderQt::filenameExtension):
         (WebCore::ImageDecoderQt::frameBufferAtIndex):
-        (WebCore::ImageDecoderQt::clearFrameBufferCache):
         (WebCore::ImageDecoderQt::internalDecodeSize):
         (WebCore::ImageDecoderQt::internalReadImage):
         (WebCore::ImageDecoderQt::internalHandleCurrentImage):
         (WebCore::ImageDecoderQt::forceLoadEverything):
-        (WebCore::ImageDecoderQt::failRead):
+        (WebCore::ImageDecoderQt::clearPointers):
         * platform/graphics/qt/ImageDecoderQt.h:
-
-2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Make use of RGBA32Buffer in ImageDecoderQt
-        https://bugs.webkit.org/show_bug.cgi?id=27538
-
-        Use the RGBA32Buffer instead of the internal ImageData
-        to be able to use support of the base class, optionally
-        support WebCore decoders for Qt and most importantly
-        separate metadata and image data for better cache control.
-
-        Remove ImageSourceQt as everything is now shared with
-        the normal ImageSource.
-
-        Change the ownership of the NativeImagePtr/QPixmap in
-        ImageQt.cpp to delete the m_frame to be subject to cache
-        control.
-
-        * WebCore.pro:
-        * platform/graphics/ImageSource.cpp:
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
-        (WebCore::ImageDecoderQt::ReadContext::read):
-        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
-        (WebCore::ImageDecoderQt::ImageDecoderQt):
-        (WebCore::ImageDecoderQt::setData):
-        (WebCore::ImageDecoderQt::frameCount):
-        (WebCore::ImageDecoderQt::frameBufferAtIndex):
-        (WebCore::ImageDecoderQt::clearFrameBufferCache):
-        * platform/graphics/qt/ImageDecoderQt.h:
-        * platform/graphics/qt/ImageSourceQt.cpp: Removed.
         * platform/image-decoders/ImageDecoder.h:
-        (WebCore::RGBA32Buffer::decodedImage):
-        (WebCore::RGBA32Buffer::getAddr):
-        * platform/image-decoders/qt/RGBA32BufferQt.cpp: Added.
-        (WebCore::RGBA32Buffer::RGBA32Buffer):
-        (WebCore::RGBA32Buffer::setDecodedImage):
-        (WebCore::RGBA32Buffer::clear):
-        (WebCore::RGBA32Buffer::zeroFill):
-        (WebCore::RGBA32Buffer::copyBitmapData):
-        (WebCore::RGBA32Buffer::setSize):
-        (WebCore::RGBA32Buffer::asNewNativeImage):
-        (WebCore::RGBA32Buffer::hasAlpha):
-        (WebCore::RGBA32Buffer::setHasAlpha):
-        (WebCore::RGBA32Buffer::setStatus):
-        (WebCore::RGBA32Buffer::operator=):
-        (WebCore::RGBA32Buffer::width):
-        (WebCore::RGBA32Buffer::height):
-
-2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] ImageDecoderQt avoid QString creation.
-        https://bugs.webkit.org/show_bug.cgi?id=27538
-
-        Avoid going from CString to QString to String
-        and go directly from CString to String. Also
-        avoid going to lower case to avoid an extra
-        memory allocation.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoder::create):
-        (WebCore::ImageDecoderQt::ImageDecoderQt):
-        * platform/graphics/qt/ImageDecoderQt.h:
-
-2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Cleanup the ImageDecoder of Qt.
-        https://bugs.webkit.org/show_bug.cgi?id=27538
-
-        Remove the various enums for partial load. The fact is
-        that this image decoder will decode everything that is
-        in the file at once. Make it look like it behaves to
-        ease fixing this core problem.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ImageData::ImageData):
-        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
-        (WebCore::ImageDecoderQt::ReadContext::read):
-        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
-        (WebCore::ImageDecoderQt::hasFirstImageHeader):
-        (WebCore::ImageDecoderQt::setData):
-        * platform/graphics/qt/ImageDecoderQt.h:
-
-2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Reimplement instead of overload frameCount in ImageDecoderQt.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27538
-
-        Reimplement frameCount instead of overloading it.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::frameCount):
-        * platform/graphics/qt/ImageDecoderQt.h:
-
-2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] QImageReader does not support progressive reading
-        https://bugs.webkit.org/show_bug.cgi?id=27538
-
-        Change the ImageDecoderQt::setData to store the encoded
-        data in ImageDecoder.
-
-        Only call ReadContext when the whole Resource has been
-        loaded to avoid needless calls to reset and the
-        ReadContext as progressive loading is not supported.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::setData):
-        * platform/graphics/qt/ImageDecoderQt.h:
-
-2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Remove dead code from ImageDecoderQt
-        https://bugs.webkit.org/show_bug.cgi?id=27538
-
-        Remove unused variables and debugging code. The debug
-        code has never been used and does not provide anything
-        useful.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ReadContext::read):
-        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
-        (WebCore::ImageDecoderQt::setData):
-        (WebCore::ImageDecoderQt::isSizeAvailable):
-        (WebCore::ImageDecoderQt::frameCount):
-        (WebCore::ImageDecoderQt::repetitionCount):
-        (WebCore::ImageDecoderQt::filenameExtension):
-        (WebCore::ImageDecoderQt::imageAtIndex):
-
-2009-10-06  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] segfault when calling gst_video_format_parse_caps in the video sink
-        https://bugs.webkit.org/show_bug.cgi?id=30120
-
-        Fix use of gst_video_format_parse_caps()
-
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_idle_func):
-
-2009-10-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Update mediaControls CSS
-
-        * css/mediaControlsQt.css:
-
-2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Get rid of Preferences.ignoreWhitespace.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30092
-
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMAgent):
-        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.update):
-        (WebInspector.ElementsTreeElement):
-        (WebInspector.ElementsTreeElement.prototype.onpopulate):
-        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
-        (WebInspector.ElementsTreeElement.prototype._updateChildren):
-        * inspector/front-end/TextPrompt.js:
-        (WebInspector.TextPrompt.prototype.isCaretAtEndOfPrompt):
-        * inspector/front-end/inspector.js:
-        * inspector/front-end/utilities.js:
-        (Node.prototype.rangeOfWord):
-        (traverseNextNode):
-        (traversePreviousNode):
-        (onlyTextChild):
-
-2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Do not call nodeTitleInfo twice +
-        followup fixes for r49101.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30087
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement):
-
-2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Windowless plugins: Enable painting on printer.
-
-        The print preview dialog crashed because the depth of the drawable
-        changed owing to a bug in Qt - if you draw onto a 32-bit pixmap,
-        and set a 24-bit pixmap as source, it will convert the source to
-        32-bit.
-
-        1210fa5b2d65895ad2be1f9ca7cae586e3b29dc1 is the bug fix in Qt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20081
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
-
-2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Windowless plugins: Make painting and events work when page is zoomed.
-
-        The element gets resized when zoomed. So, we have to make sure that we resize
-        the drawable and do a setwindow call. Multiple calls to setwindow do not
-        crash plugin in windowless mode (unlike in windowed mode).
-
-        For mouse events we have to convert the pos to post-zoom position.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20081
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::setXButtonEventSpecificFields):
-        (WebCore::setXMotionEventSpecificFields):
-        (WebCore::setXCrossingEventSpecificFields):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setNPWindowIfNeeded):
-
-2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Windowless plugins: Add PluginQuirkRequiresDefaultScreenDepth quirk for Flash.
-
-        Flash does not use the visual provided by us to draw into the drawable.
-        It instead uses the system default visual (as returned by XDefaultVisual).
-        This means that if the screen default visual is 24-bit, Flash won't be
-        able to draw on 32-bit drawable created by us. This is a bug in Flash
-        and for the moment, the above quirk is only set for Flash.
-
-        Our strategy to create the drawable:
-        1. Create a 32-bit drawable if the default screen depth is 32 or the
-        quirk is not set (i.e not flash)
-        2. If we didn't create a 32-bit drawable (maybe the Display has no such
-        visual), we create a drawable with default screen depth.
-
-        As a result of the above changes, content propagation behavior changes as:
-        1. Content propagation is possible only if the drawable we create and
-        Qt's backing store are of the same depth.
-        2. If we created a 32-bit drawable, there is no need for content
-        propagation (Qt will take care of it).
-
-        https://bugs.webkit.org/show_bug.cgi?id=20081
-
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::determineQuirks):
-        * plugins/PluginQuirkSet.h:
-        (WebCore::):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paint):
-        (WebCore::getVisualAndColormap):
-        (WebCore::PluginView::platformStart):
-        (WebCore::PluginView::platformDestroy):
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::setData):
+        (WebCore::ImageDecoder::setSize):
+        (WebCore::ImageDecoder::setFailed):
+        (WebCore::ImageDecoder::failed):
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::isSizeAvailable):
+        (WebCore::BMPImageDecoder::frameBufferAtIndex):
+        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::setData):
+        (WebCore::GIFImageDecoder::isSizeAvailable):
+        (WebCore::GIFImageDecoder::frameBufferAtIndex):
+        (WebCore::GIFImageDecoder::decode):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::decodeAtIndex):
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::processDirectoryEntries):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+        (WebCore::JPEGImageDecoder::setData):
+        (WebCore::JPEGImageDecoder::isSizeAvailable):
+        (WebCore::JPEGImageDecoder::frameBufferAtIndex):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::decodingFailed):
+        (WebCore::PNGImageReader::decode):
+        (WebCore::PNGImageDecoder::setData):
+        (WebCore::PNGImageDecoder::isSizeAvailable):
+        (WebCore::PNGImageDecoder::frameBufferAtIndex):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+        (WebCore::PNGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.h:
 
-2009-10-06  Fumitoshi Ukai  <ukai@chromium.org>
+2010-03-08  Chris Marrin  <cmarrin@apple.com>
 
-        Reviewed by Ariya Hidayat.
+        Reviewed by Darin Adler.
 
-        Qt build fix.
-        https://bugs.webkit.org/show_bug.cgi?id=29362.
+        Disallow WebGL when HW comp is not turned on at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=35759
 
-        In Qt 4.5, a new function QPainter::fillRect(QRect, QColor) is
-        introduced to avoid the expensive construction of QBrush.
-        By casting WebCore::Color to QColor, we can compile on Qt 4.4
-        and use optimization for solid color fill in Qt 4.5.
+        When HW comp is turned off with the runtime flag, WebGL would still
+        create a context, but silently fail to render. This prevents that.
+        Now if HW comp is turned off getContext('webgl') will return null.
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::drawBorderlessRectShadow):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
 
-2009-10-05  Andrei Popescu  <andreip@google.com>
+2010-03-08  Darin Adler  <darin@apple.com>
 
-        Reviewed by Eric Carlson.
+        Reviewed by Jon Honeycutt.
 
-        Allow the platform media player to know the <video> poster URL.
-        Add MediaPlayerPrivate::prepareToPlay() to support media engines
-        that do not buffer video data automatically. This method allows
-        such media engines to start the buffering just before starting
-        playback.
-        https://bugs.webkit.org/show_bug.cgi?id=29133
+        https://bugs.webkit.org/show_bug.cgi?id=35876
 
-        All platforms that currently implement <video> return false
-        in MediaPlayerPrivate::canLoadPoster() and do nothing in
-        MediaPlayerPrivate::prepareToPlay() their behavior is
-        unchanged. The current set of media test should then be
-        sufficient to guarantee that this patch does not break anything.
+        Fix minor style issues in HTMLMediaElement and classes derived from it.
+        Made many public members private and protected.
 
         * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::loadResource):
-        After the MediaPlayer is created, inform it what the poster URL is.
-        (WebCore::HTMLMediaElement::updatePlayState):
-        Add another case where prepareToPlay is called for the platforms
-        that do not buffer video content automatically.
-        (WebCore::HTMLMediaElement::couldPlayIfEnoughData)
-        Same as potentiallyPlaying, except that we don't check for
-        the readyState being at least HAVE_FUTURE_DATA.
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::canLoadPoster):
-        Empty implementation for the NullMediaPlayerPrivate.
-        (WebCore::NullMediaPlayerPrivate::setPoster):
-        Empty implementation for the NullMediaPlayerPrivate.
-        (WebCore::MediaPlayer::canLoadPoster):
-        Proxy to the m_private.
-        (WebCore::MediaPlayer::setPoster):
-        Proxy to m_private.
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::canLoadPoster):
-        (WebCore::MediaPlayerPrivateInterface::setPoster):
-        Add new methods that allow the platform player to receive the poster URL.
-        (WebCore::MediaPlayerPrivateInterface::prepareToPlay):
-        Notifies the media engine that playback should start. The media engine
-        should start preparing (e.g. by initializing the player and starting to buffer)
-        and call back when the state is changed to HAVE_FUTURE_DATA.
-
-2009-10-06  David Levin  <levin@chromium.org>
-
-        Reviewed by Oliver Hunt.
-
-        StringImpl needs a method to get an instance for another thread which doesn't copy the underlying buffer.
-        https://bugs.webkit.org/show_bug.cgi?id=30095
-
-        All String::copy methods were changed to call either threadsafeCopy or crossThreadString. The method
-        call was made threadsafeCopy unless I could show that threadsafety wasn't needed.
+        (WebCore::HTMLMediaElement::screenRect): Got rid of a stray "const" and
+        retstructured the function to use early return and get rid of a local.
 
-        No visible change in functionality so no new tests.
+        * html/HTMLMediaElement.h: Made lots of members private and some
+        protected. Also use private inheritance instead of public. Removed
+        some unneeded includes.
 
-        * dom/MessagePortChannel.cpp:
-        (WebCore::MessagePortChannel::EventData::EventData):
-        * loader/WorkerThreadableLoader.cpp:
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
-        * loader/icon/IconDatabase.cpp:
-        (WebCore::IconDatabase::open):
-        (WebCore::IconDatabase::iconForPageURL):
-        (WebCore::IconDatabase::iconURLForPageURL):
-        (WebCore::IconDatabase::retainIconForPageURL):
-        (WebCore::IconDatabase::releaseIconForPageURL):
-        (WebCore::IconDatabase::setIconDataForIconURL):
-        (WebCore::IconDatabase::setIconURLForPageURL):
-        (WebCore::IconDatabase::databasePath):
-        (WebCore::IconDatabase::defaultDatabaseFilename):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::SecurityOrigin): Since this is used by SecurityOrigin::threadsafeCopy,
-        it makes threadsafe calls.
-        (WebCore::SecurityOrigin::threadsafeCopy): The only place that called this
-        needed a threadsafe method.
-        * page/SecurityOrigin.h:
-        * platform/CrossThreadCopier.cpp:
-        (WebCore::::copy):
-        * platform/KURL.cpp:
-        (WebCore::KURL::copy):
-        * platform/network/HTTPHeaderMap.cpp:
-        (WebCore::HTTPHeaderMap::copyData):
-        * platform/network/ResourceErrorBase.cpp:
-        (WebCore::ResourceErrorBase::copy):
-        * platform/network/ResourceRequestBase.cpp:
-        (WebCore::ResourceRequestBase::copyData):
-        * platform/network/ResourceResponseBase.cpp:
-        (WebCore::ResourceResponseBase::copyData):
-        * platform/sql/SQLValue.cpp:
-        (WebCore::SQLValue::SQLValue):
-        (WebCore::SQLValue::string):
-        * platform/sql/SQLValue.h:
-        (WebCore::SQLValue::SQLValue):
-        All constructors now initialize the m_number which is a double. Failure to
-        do so can result in unexpected crashes when it is copied in the copy constructor.
-        See http://blogs.msdn.com/oldnewthing/archive/2008/07/02/8679191.aspx, I was that colleague.
-        * platform/text/PlatformString.h:
-        * platform/text/String.cpp:
-        (WebCore::String::threadsafeCopy):
-        (WebCore::String::crossThreadString):
-        * platform/text/StringImpl.cpp:
-        Removed StringImpl::substringCopy which was no longer being used anywhere.
-        (WebCore::StringImpl::threadsafeCopy): Changed the name to indicate that
-        it is threadsafe.
-        (WebCore::StringImpl::crossThreadString): The way to get strings for
-        another thread which is not threadsafe. This shares the underlying buffer
-        with both strings and gives them a way to do threadsafe refcounting for it.
-        * platform/text/StringImpl.h:
-        * storage/ChangeVersionWrapper.cpp:
-        (WebCore::ChangeVersionWrapper::ChangeVersionWrapper):
-        * storage/Database.cpp:
-        (WebCore::updateGuidVersionMap):
-        (WebCore::Database::Database):
-        (WebCore::Database::getVersionFromDatabase):
-        (WebCore::Database::setVersionInDatabase):
-        (WebCore::Database::version):
-        (WebCore::Database::setExpectedVersion):
-        (WebCore::Database::securityOriginCopy):
-        (WebCore::Database::stringIdentifier):
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::scheduleNotifyDatabaseChanged):
-        * storage/OriginQuotaManager.cpp:
-        (WebCore::OriginQuotaManager::addDatabase):
-        * storage/SQLError.h:
-        (WebCore::SQLError::message):
-        (WebCore::SQLError::SQLError):
-        * storage/SQLStatement.cpp:
-        (WebCore::SQLStatement::SQLStatement):
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::syncTimerFired):
-        * storage/StorageMap.cpp:
-        (WebCore::StorageMap::importItem):
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
-        * storage/StorageSyncManager.cpp:
-        (WebCore::StorageSyncManager::StorageSyncManager):
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::url): Do the copy of the url in a way that is threadsafe.
-        (WebCore::SharedWorkerProxy::name):
-        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
-        (WebCore::DefaultSharedWorkerRepository::getProxy): Do the copy of the url in a way that is threadsafe.
-        * workers/SharedWorkerThread.cpp:
-        (WebCore::SharedWorkerThread::SharedWorkerThread):
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
-        (WebCore::MessageWorkerTask::MessageWorkerTask):
-        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
-        * workers/WorkerRunLoop.cpp:
-        (WebCore::WorkerRunLoop::Task::Task):
-        (WebCore::WorkerRunLoop::postTaskForMode):
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
-
-2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Windowless plugins: Use X Pixmap instead of QPixmap.
-
-        This has the following advantages:
-        1. Allows more sharing of code between gtk and Qt ports in the future
-        2. QPixmap creates 24-bit by default. We have to later 'upgrade' it to 32-bit.
-        3. QPixmap may sometime change depth behind our back! This will require us to
-        update the plugin about the new visual and colormap.
-        4. We cannot ensure that QPixmap is backed by a X Drawable. For example, with
-        -graphicssystem raster, QPixmap uses the raster (image) backend.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20081
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::platformDestroy):
-
-2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::parseMappedAttribute): Use player() instead
+        of m_player; HTMLMediaElement data members are now private, not protected.
+        (WebCore::HTMLVideoElement::supportsFullscreen): Ditto.
+        (WebCore::HTMLVideoElement::videoWidth): Ditto.
+        (WebCore::HTMLVideoElement::videoHeight): Ditto.
+        (WebCore::HTMLVideoElement::hasAvailableVideoFrame): Ditto.
+        (WebCore::HTMLVideoElement::webkitEnterFullScreen): Use isFullscreen()
+        instead of m_isFullscreen; same reason.
+        (WebCore::HTMLVideoElement::webkitExitFullScreen): Ditto.
+        (WebCore::HTMLVideoElement::webkitDisplayingFullscreen): Ditto.
+
+        * html/HTMLVideoElement.h: Removed an unneeded include. Made many
+        public functions private. Got rid of unused paint function, which was
+        replaced with paintCurrentFrameInContext a while back.
+
+2010-03-08  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Xan Lopez.
 
-        [Qt] Add support for windowless NPAPI plugins
+        https://bugs.webkit.org/show_bug.cgi?id=30895
+        [Gtk] The accessible hierarchy of tables is significantly incorrect for Atk
 
-        https://bugs.webkit.org/show_bug.cgi?id=20081
+        Gives platforms the ability to exclude parts of an AccessibilityTable
+        from the accessible hierarchy.
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::setFrameRect):
-        (WebCore::PluginView::handleEvent):
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::dispatchNPEvent):
-        (WebCore::setSharedXEventFields):
-        (WebCore::PluginView::initXEvent):
-        (WebCore::setXKeyEventSpecificFields):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::inputEventState):
-        (WebCore::setXButtonEventSpecificFields):
-        (WebCore::setXMotionEventSpecificFields):
-        (WebCore::setXCrossingEventSpecificFields):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::handleFocusInEvent):
-        (WebCore::PluginView::handleFocusOutEvent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::getValueStatic):
-        (WebCore::PluginView::invalidateRect):
-        (WebCore::PluginView::invalidateRegion):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::getPluginDisplay):
-        (WebCore::PluginView::platformStart):
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::determineAccessibilityRole):
+        * accessibility/AccessibilityTable.cpp:
+        (AccessibilityTable::addChildren):
+        * accessibility/AccessibilityTableColumn.h:
+        (accessibilityIsIgnored):
+        * accessibility/AccessibilityTableHeaderContainer.h:
+        (accessibilityIsIgnored):
+        * accessibility/AccessibilityTableRow.cpp:
+        (accessibilityIsIgnored):
 
-2009-10-05  Dirk Schulze  <krit@webkit.org>
+2010-03-08  Jian Li  <jianli@chromium.org>
 
-        Reviewed by Nikolas Zimmermann.
+        No review. Fix build break on Tiger intel release.
 
-        SVG Filters do not support source images besides "sourceGraphic"
-        [https://bugs.webkit.org/show_bug.cgi?id=6022]
+        * html/Blob.cpp:
+        * html/Blob.h:
 
-        Add support for SourceAlpha to SVG filters.
+2010-03-02  Adam Treat  <atreat@rim.com>
 
-        Test: svg/filters/sourceAlpha.svg
+        Reviewed by Dave Hyatt.
 
-        * platform/graphics/filters/SourceAlpha.cpp:
-        (WebCore::SourceAlpha::calculateEffectRect):
-        (WebCore::SourceAlpha::apply):
-        * platform/graphics/filters/SourceAlpha.h:
+        Refactor the HostWindow methods for repaint, scroll, invalidate and blit
+        of backingstore and window by eliminating the three bools that currently
+        exist as params of the repaint method.
+        https://bugs.webkit.org/show_bug.cgi?id=34214
 
-2009-10-05  John Abd-El-Malek  <jam@chromium.org>
+        I've added extra methods to provide the hosts with more semantic
+        information of what is being requested thus eliminating the need for
+        these bools.
 
-        Reviewed by Adam Barth.
+        No tests as this change should not introduce any behavior changes in any
+        of the ports.
 
-        Fix reliablity bot crash in DateExtension.
-        https://bugs.webkit.org/show_bug.cgi?id=30033
+        https://bugs.webkit.org/show_bug.cgi?id=34214
 
-        There were a few problems using the weak persistent pointers because no one else had a
-        handle to them.  The new approach stores them as a hidden value on the Date constructor.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::invalidateContents):
+        (WebCore::EmptyChromeClient::invalidateWindow):
+        (WebCore::EmptyChromeClient::invalidateContentsAndWindow):
+        (WebCore::EmptyChromeClient::invalidateContentsForSlowScroll):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::invalidateContents):
+        (WebCore::Chrome::invalidateWindow):
+        (WebCore::Chrome::invalidateContentsAndWindow):
+        (WebCore::Chrome::invalidateContentsForSlowScroll):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::invalidateRect):
+        * platform/HostWindow.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::wheelEvent):
 
-        * bindings/v8/DateExtension.cpp:
-        (WebCore::DateExtension::setAllowSleep):
-        (WebCore::DateExtension::GetNativeFunction):
-        (WebCore::DateExtension::Setup):
-        (WebCore::DateExtension::OnSleepDetected):
-        * bindings/v8/DateExtension.h:
-        * bindings/v8/V8HiddenPropertyName.cpp:
-        (WebCore::V8HiddenPropertyName::sleepFunction):
-        * bindings/v8/V8HiddenPropertyName.h:
+2010-03-08  Adam Barth  <abarth@webkit.org>
 
-2009-10-05  Stephanie Lewis  <slewis@apple.com>
+        Reviewed by Nate Chapin.
 
-        Reviewed by Dan Bernstein.
+        [V8] Block popups from inline script
+        https://bugs.webkit.org/show_bug.cgi?id=35474
 
-        Crash when trying to load a null stylesheet for a site specific hack. 
-        https://bugs.webkit.org/show_bug.cgi?id=30105
+        Apparently, we're supposed to look at the sourceURL to figure out
+        whether we're running a script tag or a hyperlink.  This logic is
+        copied from the JSC version.
 
-        Created a testcase and tested in browser.  DRT doesn't test
-        site specific hacks.
+        Test: http/tests/security/popup-blocked-from-window-open.html
 
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::evaluate):
 
-2009-10-05  James Robinson  <jamesr@google.com>
+2010-03-08  Stuart Morgan  <stuartmorgan@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Fix forward declaration (struct vs class mismatch)
-
-        https://bugs.webkit.org/show_bug.cgi?id=30094
+        Move the details of secure text mode into WebCore/platform.
+        Move the higher-level logic for secure text mode from Frame
+        to SelectionController.
 
-        * loader/RedirectScheduler.h:
+        https://bugs.webkit.org/show_bug.cgi?id=31265
 
-2009-10-05  Julie Parent  <jparent@chromium.org>
+        No new tests: no functional changes.
 
-        Unreviewed, last Chromium build fix corresponding to revision 49113.
-        Add include for BeforeLoadEvent to DOMObjectsInclude.h.
-
-        * bindings/v8/DOMObjectsInclude.h:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::setUseSecureKeyboardEntryWhenActive):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        (WebCore::SelectionController::updateSecureKeyboardEntryIfActive):
+        (WebCore::SelectionController::setUseSecureKeyboardEntry):
+        * editing/SelectionController.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::setDocument):
+        * page/Frame.h:
+        * platform/SecureTextInput.cpp: Added.
+        (WebCore::enableSecureTextInput):
+        (WebCore::disableSecureTextInput):
+        * platform/SecureTextInput.h: Added.
+        (WebCore::enableSecureTextInput):
+        (WebCore::disableSecureTextInput):
 
-2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+2010-03-08  Brady Eidson  <beidson@apple.com>
 
-        Fix Windows build.
+        Reviewed by Anders Carlsson.
 
-        * html/HTMLMediaElement.cpp:
+        Relax the 3rd party cookie policy in cases where it won't add a new tracking vector.
+        <rdar://problem/7163012> and https://bugs.webkit.org/show_bug.cgi?id=35824
 
-2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+        Test: http/tests/cookies/third-party-cookie-relaxing.html
 
-        Fix the build: MediaControllerThemeQT was renamed to MediaControllerThemeQuickTime.
+        If the 3rd-party domain in question already has a cookie set, allow changes
+        by setting the first party url of the request to be the url of the request itself:        
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::makeFinalRequest):
 
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+        Ditto:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
 
-2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
+        I've filed <rdar://problem/7728508> to track changing the policy in our networking layer.
 
-        Reviewed by Simon Fraser
-        
-        Support fullscreen in MediaPlayer (Mac)
-        https://bugs.webkit.org/show_bug.cgi?id=26742
+2010-03-08  Jian Li  <jianli@chromium.org>
 
-        Add a fullscreen button to the <video> controller if the media engine,
-        and the theme have support for fullscreen, and can show appropriate controls.
-        Clicking the button calls through the ChromeClient to the WebVideoFullscreenController
-        in WebKit to do a nice animation to fullscreen, with a custom controller.
+        Reviewed by Dmitry Titov.
 
-        * DerivedSources.make:
-        * WebCore.Video.exp: Added.
-        New export file for when VIDEO is enabled.
-        
-        * WebCore.base.exp: Export WebCore::HTMLNames::videoTag
-        * WebCore.xcodeproj/project.pbxproj: New files
+        Blob.slice support.
+        https://bugs.webkit.org/show_bug.cgi?id=32993
         
-        * html/HTMLMediaElement.h:
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::HTMLMediaElement):
-        (WebCore::HTMLMediaElement::willRemove):
-        (WebCore::HTMLMediaElement::screenRect):
-        (WebCore::HTMLMediaElement::enterFullscreen):
-        (WebCore::HTMLMediaElement::exitFullscreen):
-        (WebCore::HTMLMediaElement::platformMedia):
-        Add fullscreen logic. platformMedia returns a pointer to platform-specific playback data
-        used for fullscreen.
-        
-        * html/HTMLVideoElement.h:
-        * html/HTMLVideoElement.cpp:
-        (WebCore::HTMLVideoElement::supportsFullscreen): Check with both the player and the ChromeClient
-        to see if it's possile to enter fullscreen for this element.
-        
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::supportsFullscreenForNode):
-        (WebCore::ChromeClient::enterFullscreenForNode):
-        (WebCore::ChromeClient::exitFullscreenForNode):
-        New methods
-        
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::platformMedia):
-        (WebCore::MediaPlayer::platformMedia):
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::platformMedia):
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::platformMedia):
-        (WebCore::MediaPlayerPrivate::supportsFullscreen):
-        New methods to return platform-specific playback data for fullscreen.
-        
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlFullscreenButtonElement::defaultEventHandler):
-        Hook up the fullscreen button.
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
-        Allow the RenderThemeMac to make a decision about the availability of fullscreen based
-        on the QuickTime version, since this affects what controls are availabl.e
+        The following semantic is adopted per the discussions on public-webapps:
+        1) File.slice() does a synchronous IO to capture the current size and
+           modification time and cache them in the resulting Blob.
+        2) Subsequent Blob operations, like Blob.slice and Blob.size simply
+           use the cached values.
+        3) When the underlying file data are accessed, like in XHR.send(), the
+           UA will check the cached modification time against the current
+           modification time to determine if the file has been changed or not.
+           An error or exception will be thrown if needed.
 
-2009-10-05  Kevin Decker  <kdecker@apple.com>
+        Also add ENABLE_BLOB_SLICE feature define.
 
-        Export a few more methods from Settings.h
-        
-        Rubberstamped by Jon Honeycutt.
-        
-        * WebCore.base.exp:
+        Test: http/tests/local/send-sliced-dragged-file.html
 
-2009-10-05  Dmitry Titov  <dimich@chromium.org>
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pri:
+        * html/Blob.cpp:
+        (WebCore::Blob::Blob):
+        (WebCore::Blob::size):
+        (WebCore::Blob::slice):
+        * html/Blob.h:
+        (WebCore::Blob::start):
+        (WebCore::Blob::length):
+        (WebCore::Blob::modificationTime):
+        * html/Blob.idl:
+        * platform/network/FormData.cpp:
+        (WebCore::FormData::deepCopy):
+        (WebCore::FormData::appendFile):
+        (WebCore::FormData::appendFileRange):
+        * platform/network/FormData.h:
+        (WebCore::FormDataElement::FormDataElement):
+        (WebCore::operator==):
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::advanceCurrentStream):
+        (WebCore::openNextStream):
+        (WebCore::formCreate):
+        (WebCore::formOpen):
+        (WebCore::formRead):
+        (WebCore::setHTTPBody):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
 
-        Reviewed by Darin Adler.
+2010-03-08  Daniel Bates  <dbates@rim.com>
 
-        1-char fix for obviously reverse condition.
-        https://bugs.webkit.org/show_bug.cgi?id=30100
-        No test since the only difference is a timing of GC.
+        Reviewed by Simon Fraser.
 
-        * bindings/js/ScriptCachedFrameData.cpp:
-        (WebCore::ScriptCachedFrameData::clear): Revert condition. Almost a typo.
+        https://bugs.webkit.org/show_bug.cgi?id=34819
 
-2009-09-30  Kenneth Russell  <kbr@google.com>
+        Fixes an issue where we repaint the caret rectangle even if the associated
+        selection is not in a content editable element. This is extraneous since the
+        caret is only visible when the selection is in a content editable element.
+        Hence, we should only repaint the caret rectangle when the associated selection
+        is in a content editable element.
 
-        Reviewed by Darin Fisher.
+        Note, we always paint the caret when caret browsing is enabled.
 
-        Update platform-specific #ifdefs in GraphicsContext3D.h for the
-        Chromium port.
-        https://bugs.webkit.org/show_bug.cgi?id=29936
+        Test: fast/repaint/no-caret-repaint-in-non-content-editable-element.html
 
-        * platform/graphics/GraphicsContext3D.h:
-        Changed #if PLATFORM(SKIA) to #if PLATFORM(CHROMIUM).
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::recomputeCaretRect): Modified to call method
+        SelectionController::shouldRepaintCaret.
+        (WebCore::SelectionController::shouldRepaintCaret): Added.
+        (WebCore::SelectionController::invalidateCaretRect): Modified to call method
+        SelectionController::shouldRepaintCaret.
+        * editing/SelectionController.h:
 
-2009-10-05  Dan Bernstein  <mitz@apple.com>
+2010-03-08  Eric Carlson  <eric.carlson@apple.com>
 
         Reviewed by Darin Adler.
 
-        REGRESSION (r47440): Inserting text in the middle of content in a scrolled textfield results in painting bugs
-        <rdar://problem/7269108>
-        https://bugs.webkit.org/show_bug.cgi?id=29982
+        YouTube HTML5 video never starts playing on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=33954
 
-        Test: fast/repaint/line-in-scrolled-clipped-block.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlock): Use the unclipped overflow rect
-        (including layout overflow) for the repaint rect calculation.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::rfc2616DateStringFromTime): New, create an rfc 2616 formatted
+        string for an absolute time value.
+        (WebCore::addCookieParam): New, add a cookie param and value to a string builder.
+        (WebCore::MediaPlayerPrivate::setUpCookiesForQuickTime): Copy cookies for the movie to
+            be loaded from CFNetwork into WinINet so they are available when QuickTime tries to
+            download the movie.
+        (WebCore::MediaPlayerPrivate::load): Call setupCookiesForQuickTime.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
 
-2009-10-05  Drew Wilson  <atwilson@google.com>
+2010-03-08  Eric Uhrhane  <ericu@chromium.org>
 
         Reviewed by David Levin.
 
-        Chromium wants to turn off SharedWorkers at runtime
-        https://bugs.webkit.org/show_bug.cgi?id=29757
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::sharedWorker):
-        Now returns jsUndefined if isAvailable() returns false, to allow SharedWorkers to be disabled at runtime.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerRepository::isAvailable):
-        Made SharedWorkers available by default.
-        * workers/SharedWorkerRepository.h:
-        Added definition for SharedWorkerRepository::isAvailable().
-
-2009-10-05  Hironori Bono  <hbono@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        A super quick fix for Bug 28710.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28710
-
-        This change just resets the style sent to addStyleMarkup() to avoid an assertion error
-        and creates an empty style when computedStyleAtPosition is 0 to avoid a crash.
-        (This change is nothing but a better-than-crash change.)
-
-        Tests: editing/selection/select-crash-001.html
-               editing/selection/select-crash-002.html
+        Remove the now-redundant Settings fields for the Database
+        https://bugs.webkit.org/show_bug.cgi?id=35763
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::editingStyleAtPosition): Resets the style sent to addStyleMarkup() if it is not valid.
-        * editing/markup.cpp:
-        (WebCore::createMarkup): Creates an empty style if computedStyleAtPosition is 0.
-
-2009-10-05  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Silence duplicate errors logged for missing getComputedStyle
-        implementations. Improves the error message as well.
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::logUnimplementedPropertyID):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-
-2009-10-05  Julie Parent  <jparent@chromium.org>
-
-        Unreviewed, Chromium build fix #3.  Add V8BeforeLoadEvent.[cc|h] to derived sources.
-
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
+        No new tests; this code isn't called.
 
-2009-10-05  Mark Rowe  <mrowe@apple.com>
+        * WebCore.base.exp:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
 
-        Try and fix the GTK build.
+2010-03-07  David Levin  <levin@chromium.org>
 
-        * GNUmakefile.am:
+        Chromium Linux build fix.
 
-2009-10-05  Julie Parent  <jparent@chromium.org>
+        * platform/graphics/chromium/FontPlatformDataLinux.h: Add "class String" since a debug
+        only method returns a String.
 
-        Unreviewed, Chromium build fix #2.  Add new BEFORELOADEVENT to V8ClassIndex.
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        * bindings/v8/V8Index.h:
+        Chromium build fix.
 
-2009-10-05  Julie Parent  <jparent@chromium.org>
+        * platform/chromium/ClipboardChromium.cpp: Include Image.h since we're using WebCore::Image.
 
-        Unreviewed, Chromium build fix.  Missing "," after entry for BeforeLoadEvent.idl. 
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        * WebCore.gypi:
+        Gtk build fix.
 
-2009-10-05  Dave Hyatt  <hyatt@apple.com>
+        * platform/network/soup/ResourceHandleSoup.cpp: Include SharedBuffer.h since we're using WebCore::SharedBuffer.
 
-        Reviewed by Sam Weinig.
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Add a beforeload event that will be fired before subresources load. (It isn't fired yet.)  The event
-        has one field, the URL that is going to be requested.  Setting preventDefault will stop the load
-        from occurring.
+        Gtk build fix.
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/BeforeLoadEvent.h: Added.
-        (WebCore::BeforeLoadEvent::create):
-        (WebCore::BeforeLoadEvent::initBeforeLoadEvent):
-        (WebCore::BeforeLoadEvent::url):
-        (WebCore::BeforeLoadEvent::BeforeLoadEvent):
-        * dom/BeforeLoadEvent.idl: Added.
-        * dom/EventNames.h:
-        * page/DOMWindow.idl:
+        * platform/graphics/gtk/ImageGtk.cpp: Include SharedBuffer.h since we're using WebCore::SharedBuffer.
 
-2009-10-05  Priit Laes  <plaes@plaes.org>
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Gustavo Noronha.
+        Fix builds where USE_CG_SHADING is set.
 
-        Add Gentoo-specific paths for searching browser plugins.
-        https://bugs.webkit.org/show_bug.cgi?id=30088
+        * platform/graphics/cg/GradientCG.cpp: Include wtf/RetainPtr.h since WTF::RetainPtr is used when USE_CG_SHADING is set.
 
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::defaultPluginDirectories):
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-2009-10-02  Chris Marrin  <cmarrin@apple.com>
+        Windows build fix.  Add some required includes.
 
-        Reviewed by Adele Peterson.
+        * platform/graphics/win/ImageCGWin.cpp:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        * platform/win/ClipboardWin.cpp:
 
-        Add functionality to pause/throttle CSS transitions/animations in a WebView
-        https://bugs.webkit.org/show_bug.cgi?id=29942
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Exporting call from AnimationController
+        Gtk build fix.
 
-        * WebCore.base.exp:
+        * platform/graphics/GraphicsContext.h: Include wtf/PassOwnPtr.h since some platforms use WTF::PassOwnPtr in this header.
 
-2009-10-05  Kevin Decker  <kdecker@apple.com>
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Rubberstamped by Anders Carlsson.
-        
-        * WebCore.base.exp: Update export of HaltablePlugin/PluginHalterClient.
-        * WebCore.xcodeproj/project.pbxproj: Likewise.
+        Qt build fix.
 
-2009-10-05  Eric Seidel  <eric@webkit.org>
+        * platform/network/qt/ResourceHandleQt.cpp: Include SharedBuffer.h since we're using WebCore::SharedBuffer.
 
-        No review, rolling out r49104.
-        http://trac.webkit.org/changeset/49104
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        * html/HTMLInputElement.cpp:
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-        * html/ValidityState.cpp:
-        * html/ValidityState.h:
-        (WebCore::ValidityState::rangeUnderflow):
-        (WebCore::ValidityState::rangeOverflow):
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderRange::SliderRange):
-        (WebCore::SliderRange::valueFromElement):
+        Gtk build fix.
 
-2009-10-05  Kent Tamura  <tkent@chromium.org>
+        * platform/gtk/ClipboardGtk.cpp: Include Image.h since we're using WebCore::Image.
 
-        Reviewed by Eric Seidel.
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Update style immediately when validation-related values are updated.
-        https://bugs.webkit.org/show_bug.cgi?id=28868
+        Rubber-stamped by Cameron Zwarich.
 
-        In order to apply :valid, :invalid, :optional or :required lively,
-          - call setNeedsStyleRecalc() when properties which can change
-            willValidate state are updated, and
-             (Parent form element, name, disabled, readonly)
-          - call updateValidity() when properties which can change validity
-            state are updated. (value, pattern, required)
+        Remove unnecessary includes from header files, adding them to the handful of implementation files that need them.
 
-        Tests: fast/forms/input-live-pseudo-selectors.html
-               fast/forms/textarea-live-pseudo-selectors.html
+        * loader/CachedCSSStyleSheet.cpp:
+        * loader/CachedFont.cpp:
+        * loader/CachedImage.cpp:
+        * loader/CachedResource.cpp:
+        * loader/CachedResource.h:
+        * loader/CachedScript.cpp:
+        * loader/CachedXSLStyleSheet.cpp:
+        * loader/icon/IconFetcher.cpp:
+        * loader/loader.cpp:
+        * page/Page.cpp:
+        * platform/graphics/Image.cpp:
+        * platform/graphics/Image.h:
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        * platform/graphics/cg/PathCG.cpp:
+        * platform/graphics/mac/ImageMac.mm:
 
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
-        (WebCore::HTMLFormControlElement::parseMappedAttribute):
-        (WebCore::HTMLFormControlElement::required):
-        (WebCore::HTMLFormControlElement::updateValidity):
-        * html/HTMLFormControlElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setInputType):
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        (WebCore::HTMLInputElement::setValue):
-        (WebCore::HTMLInputElement::setValueFromRenderer):
-        (WebCore::HTMLInputElement::setFileListFromRenderer):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::setValue):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-2009-10-05  Kent Tamura  <tkent@chromium.org>
+        Chromium build fix.
 
-        Reviewed by Darin Adler.
+        * platform/chromium/ChromiumDataObject.h: Include SharedBuffer.h since the inline constructor of this
+        class means that the pointed-to type of the RefPtr member must be available.
 
-        Implement min/max attributes, ValidityState.rangeUnderflow and
-        ValidityState.rangeOverflow for <input type=number> and <input type=range>
-        https://bugs.webkit.org/show_bug.cgi?id=29069
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Tests: fast/forms/ValidityState-rangeOverflow-number.html
-               fast/forms/ValidityState-rangeOverflow-range.html
-               fast/forms/ValidityState-rangeUnderflow-number.html
-               fast/forms/ValidityState-rangeUnderflow-range.html
-               fast/forms/input-minmax.html
+        Qt build fix.
 
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::rangeUnderflow):
-        (WebCore::HTMLInputElement::rangeOverflow):
-        (WebCore::HTMLInputElement::rangeMinimum):
-        (WebCore::HTMLInputElement::rangeMaximum):
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::rangeUnderflow):
-        (WebCore::ValidityState::rangeOverflow):
-        * html/ValidityState.h:
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderRange::SliderRange):
-        (WebCore::SliderRange::valueFromElement):
+        * platform/network/qt/DnsPrefetchHelper.cpp: Include PlatformString.h since we're using WebCore::String.
 
-2009-10-05  Kent Tamura  <tkent@chromium.org>
+2010-03-07  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        Introduces
-         - new CSS pseudo selector: "-webkit-input-list-button"
-         - new CSS apperance type: "list-button"
-         - new ControlPart value: "ListButtonPart"
-        for the UI of the list attribute of the input element, and adds
-        implementation to draw ListButtonPart on Mac.
-        The code is guarded by ENABLE(DATALIST).
-
-        https://bugs.webkit.org/show_bug.cgi?id=27794
+        Fix a bug that validity.valueMissing for a radio button with required
+        in a form element always returns true.
+        https://bugs.webkit.org/show_bug.cgi?id=35472
 
-        Test: platform/mac/fast/forms/input-list-button-size.html
+        Test: fast/forms/ValidityState-valueMissing-radio.html
 
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
-        * css/CSSValueKeywords.in:
-        * css/html.css:
         * html/HTMLInputElement.cpp:
-        * platform/ThemeTypes.h:
-        (WebCore::):
-        * platform/mac/ThemeMac.mm:
-        (WebCore::listButtonSizes):
-        (WebCore::button):
-        (WebCore::paintButton):
-        (WebCore::ThemeMac::controlSize):
-        (WebCore::ThemeMac::minimumControlSize):
-        (WebCore::ThemeMac::controlBorder):
-        (WebCore::ThemeMac::paint):
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::adjustStyle):
-        (WebCore::RenderTheme::paint):
-        (WebCore::RenderTheme::paintBorderOnly):
-        (WebCore::RenderTheme::paintDecorations):
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::adjustRepaintRect):
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-
-2009-10-05  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30065>
-        nodeTitleInfo should be placed in ElementsTreeOutline.
-        
-        Move nodeTitleInfo into ElementsTreeOutline.js from utilities.js.
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement):
-        (WebInspector.ElementsTreeElement.prototype._updateTitle):
-        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
-        * inspector/front-end/utilities.js:
-
-2009-10-02  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Inform the application when a new request is created
-        https://bugs.webkit.org/show_bug.cgi?id=29975
-
-        Emit a signal each time a request is created, with the request and the frame
-        that created it.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-        (WebCore::QNetworkReplyHandler::start):
-
-2009-10-05  Ben Murdoch  <benm@google.com>
-
-        Reviewed by Darin Adler.
-
-        Add an ASSERT in updateGuidVersionMap.
-        https://bugs.webkit.org/show_bug.cgi?id=30077
-
-        * storage/Database.cpp:
-        (WebCore::updateGuidVersionMap): ASSERT that the guidMutex() is locked.
-
-2009-10-05  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Allow V8 to throw an exception in _NPN_SetException without worrying about context
-        if we don't have enough information to find the correct context.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30026
-
-        Part of the fix for Chromium's failure of LayouTests/plugins/netscape-throw-exception.html.
-
-        * bindings/v8/NPV8Object.cpp: 
-        (_NPN_SetException): Don't suppress the exception if we can't find the relevant context.
-
-2009-10-05  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Place "Close" button in docked mode on the same side as the window "Close" button in detached mode.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29961
-
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
-
-2009-10-05  J-P Nurmi  <jpnurmi@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Added pure virtual QWebPageClient::pluginParent()
-
-        https://bugs.webkit.org/show_bug.cgi?id=29710
-
-        * platform/qt/QWebPageClient.h:
-
-2009-10-05  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] windowsKeyCodeForKeyEvent() returns a wrong value for the F10 key.
-        https://bugs.webkit.org/show_bug.cgi?id=30042
-
-        * platform/qt/PlatformKeyboardEventQt.cpp:
-        (WebCore::windowsKeyCodeForKeyEvent):
-
-2009-10-05  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Unreviewed build fix for ENABLE(WEB_SOCKETS) and v8.
-
-        V8ObjectEventListener.h has been removed at r48978
-
-        * bindings/v8/custom/V8WebSocketCustom.cpp:
-
-2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector console stops working while JS in IFRAME is paused.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29958
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._evaluateOn):
-        (InjectedScript.addInspectedNode):
-        (InjectedScript._ensureCommandLineAPIInstalled):
-
-2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Introduce inspected object groups for console
-        and watch evaluation results so that they could be released
-        explicitly.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29891
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::wrapObject):
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::wrapObject):
-        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::clearConsoleMessages):
-        (WebCore::InspectorController::resetScriptObjects):
-        (WebCore::InspectorController::wrapObject):
-        (WebCore::InspectorController::unwrapObject):
-        (WebCore::InspectorController::releaseWrapperObjectGroup):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addMessageToConsole):
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
-        (WebInspector.ConsoleView.prototype.doEvalInWindow):
-        (WebInspector.ConsoleView.prototype._enterKeyPressed):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.evaluate):
-        (InjectedScript._evaluateAndWrap):
-        (InjectedScript.evaluateInCallFrame):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
-        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
-        * inspector/front-end/WatchExpressionsSidebarPane.js:
-        (WebInspector.WatchExpressionsSidebarPane):
-        (WebInspector.WatchExpressionsSection.prototype.update):
-
-2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Eric Carlson.
-
-        Move mediaControls extras for the Qt port into WebCore/css like other ports
+        (WebCore::checkedRadioButtons): Move the location to be used by valueMissing().
+        (WebCore::HTMLInputElement::valueMissing):
+          Use checkedRadioButtons() instead of document()->checkedRadioButtons().
 
-        https://bugs.webkit.org/show_bug.cgi?id=30013
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        * WebCore.pro:
-        * WebCore.qrc:
-        * css/mediaControlsQt.css: Renamed from WebCore/css/qt/mediaControls-extras.css.
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::extraMediaControlsStyleSheet):
+        Rubber-stamped by Cameron Zwarich.
 
-2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Eric Carlson.
+        Remove unnecessary includes from header files, adding them to the handful of implementation files that need them.
 
-        Rename WebCore/css/mediaControlsQT.css and MediaControllerThemeQT
+        * bindings/objc/DOM.mm:
+        * loader/CachedImage.h:
+        * loader/EmptyClients.h:
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        * platform/text/CString.h:
+        * platform/text/String.cpp:
+        * platform/text/mac/TextCodecMac.cpp:
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/filters/SVGFEImage.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=30013
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        The QT suffix has been expanded to QuickTime, to not cause confusion
-        and name-crashes with similar files in the Qt port.
+        Completely remove two files that were deleted in r55635 from the Xcode project.
 
-        * DerivedSources.make:
         * WebCore.xcodeproj/project.pbxproj:
-        * css/mediaControlsQuickTime.css: Renamed from WebCore/css/mediaControlsQT.css.
-        * rendering/RenderThemeMac.mm:
-        (WebCore::):
-        (WebCore::mediaControllerTheme):
-        (WebCore::RenderThemeMac::adjustSliderThumbSize):
-        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
-        (WebCore::RenderThemeMac::extraMediaControlsStyleSheet):
-
-2009-10-04  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-        
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30064>
-        Syntax Highlighting CSS shouldn't be duplicated.
-
-        Refactor syntax highlighting CSS into a new file, add it to the
-        projects, and have SourceFrame.js and inspector.html include the
-        new CSS file.
-
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._loaded):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspectorSyntaxHighlight.css: Added.
-        * inspector/front-end/WebKit.qrc:
 
-2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+2010-03-07  Sam Weinig  <sam@webkit.org>
 
-        Reviewed by Timothy Hatcher.
-        
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30062>
-        Inspector should syntax highlight JS/CSS in elements view.
-
-        Add syntax highlighting of CSS and JavaScript tags to the elements panel.
-        Copied CSS rules from SourceFrame.js to inspector.css, and have the text nodes
-        in utilities.js call the CSS or JS Syntax highlighters if their parent is a script
-        or style tag.
-
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/utilities.js:
-
-2009-10-04  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Eric Seidel
-
-        Enable Web Sockets in chromium build.
-        https://bugs.webkit.org/show_bug.cgi?id=29917
-
-        * WebCore.gyp/WebCore.gyp:
-
-2009-10-04  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustova Noronha.
-
-        [GTK] performs a POST when refreshing a view that was obtained with a GET
-        https://bugs.webkit.org/show_bug.cgi?id=29761
-
-        Update the HTTP method in the request stored by willSendRequest
-        after a redirect, since it could have changed.
-
-        Test: http/tests/navigation/postredirect-reload.html
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::restartedCallback):
-
-2009-10-04  Xan Lopez  <xlopez@igalia.com>
-
-        Revert previous patch, as the newly added test breaks other tests.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::restartedCallback):
-
-2009-10-04  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustova Noronha.
-
-        [GTK] performs a POST when refreshing a view that was obtained with a GET
-        https://bugs.webkit.org/show_bug.cgi?id=29761
-
-        Update the HTTP method in the request stored by willSendRequest
-        after a redirect, since it could have changed.
-
-        Test: http/tests/navigation/postredirect-reload.html
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::restartedCallback):
-
-2009-10-04  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Fixed Function leak in V8LazyEventListener.
-        (Should fix the remaning leak in
-        https://bugs.webkit.org/show_bug.cgi?id=29093).
-        V8LazyEventListeners used to create FunctionTemplates for each
-        wrapped listener which in turn created Functions that were cached
-        forever in V8 Context. Now there is at most one such Function per
-        Context.
-        https://bugs.webkit.org/show_bug.cgi?id=30060
-
-        Added new hidden property name to store toString result:
-        * bindings/v8/V8HiddenPropertyName.cpp:
-        * bindings/v8/V8HiddenPropertyName.h:
-
-        Switched to static FunctionTemplate:
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListenerToString):
-        (WebCore::V8LazyEventListener::prepareListenerObject):
-
-2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        CSS Source View Should be Syntax Highlighted
-        https://bugs.webkit.org/show_bug.cgi?id=14359
-
-          Support for WebKit's CSS Variables @variables and var()
-
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.CSSSourceSyntaxHighligher):
-
-2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector should remember preferences for docked/undocked etc
-        https://bugs.webkit.org/show_bug.cgi?id=29089
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype._toggleLargerResources): toggle the preference
-        * inspector/front-end/inspector.js:
-        (WebInspector._loadPreferences): factored out loading preferences
-        (WebInspector.loaded):
-
-2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        CSS Source View Should be Syntax Highlighted
-        https://bugs.webkit.org/show_bug.cgi?id=14359
-
-          Trigger the Syntax Highlighter for CSS files.
-
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype.syntaxHighlightJavascript):
-        (WebInspector.SourceFrame.prototype.syntaxHighlightCSS):
-        * inspector/front-end/SourceView.js:
-        (WebInspector.SourceView.prototype._contentLoaded):
-
-          Factored out the Syntax Highlighting procedure into a "Class"
-          Added CSSSourceSyntaxHighlighter and JavaScriptSourceSyntaxHighlighter
-
-        (WebInspector.SourceSyntaxHighligher):
-        (WebInspector.SourceSyntaxHighligher.prototype.createSpan):
-        (WebInspector.SourceSyntaxHighligher.prototype.process.processChunk):
-        (WebInspector.SourceSyntaxHighligher.prototype.process):
-        (WebInspector.CSSSourceSyntaxHighligher): the CSS Highlighter
-        (WebInspector.JavaScriptSourceSyntaxHighligher): the JS Highlighter
-
-2009-10-03  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Sam Weinig.
+        Reviewed by Dan Bernstein.
 
-        Factor back-forward list methods out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30037
+        Remove inconsistent "Too few arguments" handling for window.atob() and window.btoa()
+        https://bugs.webkit.org/show_bug.cgi?id=35848
 
-        This change moves these back-forward related methods from FrameLoader
-        to Page.  It's possible we should move these methods into some kind of
-        "page controller" object, but we can figure that out in a future patch.
+        - Take the opportunity to fully autogenerate window.atob() and window.btoa().
 
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/RedirectScheduler.cpp:
-        (WebCore::RedirectScheduler::timerFired):
-        * page/ContextMenuController.cpp:
-        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * bindings/js/JSDOMWindowCustom.cpp:
         * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::close):
-        * page/History.cpp:
-        (WebCore::History::length):
-        * page/Page.cpp:
-        (WebCore::Page::canGoBackOrForward):
-        (WebCore::Page::goBackOrForward):
-        (WebCore::Page::getHistoryLength):
-        * page/Page.h:
-        * platform/ContextMenu.cpp:
-        (WebCore::ContextMenu::populate):
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
-
-2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: prepare InspectorController for being used from layout tests.
-        This change adds evaluateForTestInFrontend method with the callback that
-        allows evaluating arbitrary code in the frontend context.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30008
-
-        * WebCore.Inspector.exp:
-        * WebCore.order:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::didEvaluateForTestInFrontend):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::evaluateForTestInFrontend):
-        (WebCore::InspectorController::didEvaluateForTestInFrontend):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/inspector.js:
-        (WebInspector.evaluateForTestInFrontend):
-
-2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Node search mode is not getting reset on element selection.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30016
-
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
-
-2009-10-02  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30036>
-        Should be able to resize Cookie Columns.
-
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView.prototype.update.callback):
-        (WebInspector.CookieItemsView.prototype.update):
-        (WebInspector.CookieItemsView.prototype.resize):
-
-2009-09-25  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Make WebCore::PluginView participate in plug-in halting.
-
-        Reviewed by Sam Weinig.
-
-        * platform/graphics/BitmapImage.h:
-        Declare a create() function that takes an HBITMAP.
-
-        * platform/graphics/win/ImageCGWin.cpp:
-        (WebCore::BitmapImage::create):
-        Use GetObject() to fill out a DIBSECTION structure for the given
-        HBITMAP. Call CGBitmapContextCreate() to create a CG context from the
-        bits of the bitmap. Create a CG image from the context, and pass this
-        when creating a new BitmapImage.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
-        If we successfully started, tell our parent frame's Page.
-        (WebCore::PluginView::stop):
-        Tell our parent frame's Page that we stopped.
-        (WebCore::PluginView::node):
-
-        * plugins/PluginView.h:
-        Inherit from HaltablePlugin.
-        (WebCore::PluginView::setPlatformPluginWidget):
-        On platforms where the platform plug-in widget is the WebCore::Widget's
-        platform widget, have setPlatformPluginWidget() call
-        setPlatformWidget().
-
-        * plugins/PluginViewNone.cpp:
-        (WebCore::PluginView::halt):
-        Stubbed.
-        (WebCore::PluginView::restart):
-        Stubbed.
+        (WebCore::DOMWindow::btoa):
+        (WebCore::DOMWindow::atob):
+        * page/DOMWindow.idl:
 
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::halt):
-        Stubbed.
-        (WebCore::PluginView::restart):
-        Stubbed.
+2010-03-07  Dan Bernstein  <mitz@apple.com>
 
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::halt):
-        Stubbed.
-        (WebCore::PluginView::restart):
-        Stubbed.
+        Reviewed by Simon Fraser.
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::halt):
-        Stubbed.
-        (WebCore::PluginView::restart):
-        Stubbed.
+        <rdar://problem/7722008> Column breaking ignores floats
+        https://bugs.webkit.org/show_bug.cgi?id=35837
 
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::platformDestroy):
-        After destroying the window, set the platform plug-in widget to 0 to
-        ensure that Widget isn't holding a stale handle.
-        (WebCore::PluginView::halt):
-        Have our element's RenderWidget display a screenshot of the plug-in,
-        then stop the plug-in and destroy it.
-        (WebCore::PluginView::restart):
-        Clear the RenderWidget's substitute image, then start the plug-in.
+        Test: fast/multicol/float-truncation.html
 
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::showSubstituteImage):
-        Set m_substituteImage to the passed image, and repaint.
-        (WebCore::RenderWidget::paint):
-        If we have a substitute image, paint that instead of allowing the
-        widget to paint itself.
+        Introduce an earlier column-break if otherwise a float that could fit
+        inside a single column will be split between columns.
 
-        * rendering/RenderWidget.h:
-        Declare showSubstituteImage(). Added a member to store the substitute
-        image.
+        It is still possible for floats to be needlessly broken if initially
+        they fit in the column, but normal flow truncation then shortens the
+        column.
 
-2009-10-02  Adam Barth  <abarth@webkit.org>
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::visibleTopOfHighestFloatExtendingBelow): Added.
+        Returns the visible top of the highest descendant float that visibly
+        extends below the given y offset, ignoring floats that are taller than
+        the given maximum height.
+        (WebCore::RenderBlock::layoutColumns): If the initial column height
+        would cause a float to be split, truncate above the float.
+        * rendering/RenderBlock.h:
 
-        Reviewed by Darin Adler.
+2010-03-07  Dmitry Titov  <dimich@chromium.org>
 
-        Move PolicyCheck out of FrameLoader.{h,cpp}
-        https://bugs.webkit.org/show_bug.cgi?id=30035
+        Not reviewed. Revert of r55593 which caused a regression of worker-cloneports.html.
 
-        Purely code motion (and adding a destructor).
+        REGRESSION(55593?): fast/workers/worker-cloneport.html is timing out on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=35819
 
+        * Android.jscbindings.mk:
+        * Android.v8bindings.mk:
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/PolicyCheck.cpp:
-        * loader/PolicyCheck.h:
-
-2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Add NPNVToolkit value quirk in plugins for nspluginwrapper.
-        Plugin error message was:
-        ERROR: failed to initialize brower-side RPC events listener
-        https://bugs.webkit.org/show_bug.cgi?id=25053
-
-        (WebCore::staticPluginQuirkRequiresGtkToolKit_NPN_GetValue):
-        (WebCore::PluginPackage::load):
-
-2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] X sync our XEmbed container window creation before sending the
-        xid to plugins.
-        https://bugs.webkit.org/show_bug.cgi?id=25053
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
-
-2009-10-02  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Setting zero size on a container of a video element doesn't hide the controller
-        https://bugs.webkit.org/show_bug.cgi?id=30031
-        
-        Fix a logic error in enclosingCompositingLayer() when mixing normal flow and 
-        positioned layers. This resulted in enclosingCompositingLayer() giving back a different
-        answer to the logic used to actually parent compositing layers, so layer positions
-        and layer hierarchy would be out of agreement.
-        
-        Test: compositing/geometry/clipped-video-controller.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::compositingContainer):
-        (WebCore::RenderLayer::enclosingCompositingLayer):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::setCompositingParent):
-
-2009-10-02  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        - Move the following methods of HTMLInputElement and HTMLTextAreaElement
-          to HTMLTextFormControlElement.
-           setSelectionStart()
-           setSelectionEnd()
-           select()
-           setSelectionRange()
-           selectionStart()
-           selectionEnd()
-           selection()
-
-        - Introduce cachedSelectionStart() and cachedSelectionEnd().
-
-        - Unify HTMLInputElement::isTextFieldWithRenderer() and
-         HTMLTextAreaElement::rendererAfterUpdateLayout() into textRendererAfterUpdateLayout().
-        
-        - Unify a part of parseMappedAttribute() of HTMLInputElement and HTMLTextAreaElement.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29782
-
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLTextFormControlElement::textRendererAfterUpdateLayout):
-        (WebCore::HTMLTextFormControlElement::setSelectionStart):
-        (WebCore::HTMLTextFormControlElement::setSelectionEnd):
-        (WebCore::HTMLTextFormControlElement::select):
-        (WebCore::HTMLTextFormControlElement::setSelectionRange):
-        (WebCore::HTMLTextFormControlElement::selectionStart):
-        (WebCore::HTMLTextFormControlElement::selectionEnd):
-        (WebCore::HTMLTextFormControlElement::selection):
-        (WebCore::HTMLTextFormControlElement::parseMappedAttribute):
-        * html/HTMLFormControlElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::select):
-        (WebCore::HTMLInputElement::cachedSelectionStart):
-        (WebCore::HTMLInputElement::cachedSelectionEnd):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        * html/HTMLTextAreaElement.h:
-        (WebCore::HTMLTextAreaElement::cachedSelectionStart):
-        (WebCore::HTMLTextAreaElement::cachedSelectionEnd):
-
-2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Disconnect event listeners on navigation.
-        Fixes http://crbug.com/23597.
-        https://bugs.webkit.org/show_bug.cgi?id=30027
-
-        Added V8ListenerGuard that is shared by listeners and proxy. On
-        navigation proxy sets a flag in the guard turning off listeners.
-
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8ListenerGuard::create):
-        (WebCore::V8ListenerGuard::isDisconnected):
-        (WebCore::V8ListenerGuard::disconnectListeners):
-        (WebCore::V8ListenerGuard::V8ListenerGuard):
-        (WebCore::V8AbstractEventListener::disconnected):
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getEventListener):
-        * bindings/v8/V8EventListenerList.h:
-        (WebCore::V8EventListenerList::findOrCreateWrapper):
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::V8LazyEventListener):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::V8Proxy):
-        (WebCore::V8Proxy::disconnectFrame):
-        (WebCore::V8Proxy::disconnectEventListeners):
-        (WebCore::V8Proxy::clearForNavigation):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::listenerGuard):
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener):
-        * bindings/v8/V8WorkerContextEventListener.h:
-        (WebCore::V8WorkerContextEventListener::create):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
-        (WebCore::WorkerContextExecutionProxy::dispose):
-        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
-        * bindings/v8/WorkerContextExecutionProxy.h:
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::V8EventListener):
-        * bindings/v8/custom/V8CustomEventListener.h:
-        (WebCore::V8EventListener::create):
-
-2009-10-02  Kenneth Russell  <kbr@google.com>
-
-        Reviewed by Dimitri Glazkov.
-
-        [chromium] Fix WebGL build after CustomGetter constructor changes
-        https://bugs.webkit.org/show_bug.cgi?id=30020
-
-        * page/DOMWindow.idl:
-        Changed CustomGetter to JSCCustomGetter for CanvasArray constructors.
-
-2009-10-02  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: text in a "Request Payload" section disappears on selection
-        https://bugs.webkit.org/show_bug.cgi?id=29967
-
-        No new tests.
-
-        * inspector/front-end/ResourceView.js:
-        (WebInspector.ResourceView.prototype._refreshRequestPayload):
-
-2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Recursion guard for V8Proxy::callFunction.
-        Fixes http://crbug.com/23278.
-        https://bugs.webkit.org/show_bug.cgi?id=29974
-
-        Test: fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::callFunction):
-
-2009-10-02  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        Fix test breakages by adding null checks, and putting inspector code in
-        ENABLE(INSPECTOR).
-
-        * dom/Document.cpp:
-        (WebCore::Document::finishedParsing):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::dispatchLoadEvent):
-
-2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Clean up the QNetworkReplyHandler to only apply HTTP headers
-        for protocols in the HTTP family.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-
-2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Move error check into sendResponseIfNeeded() as suggested
-        by Eric Seidel. Also, remove some dead code.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-
-2009-10-02  Enrica Casucci  <enrica@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Assertion failure in CompositeEditCommand::moveParagraphs() and crash in Node::nodeIndex() when pasting.
-        <rdar://problem/7148712>
-        https://bugs.webkit.org/show_bug.cgi?id=28992
-
-        Test: editing/selection/replace-selection-crash.html
-
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded): Handle properly the case of
-        the destination position matching the end of the paragraph to move.
-
-2009-10-02  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Implement per-storage-area quotas for LocalStorage
-        https://bugs.webkit.org/show_bug.cgi?id=29991
-
-        I put 90% of the code in StorageMap since the decision to allow an update is
-        closely tied to quota tracking.  The quota is set via a page's Settings class.
-        Like with the local storage path and whether it's enabled, it's assumed that
-        all pages in the same group will have the same settings.  The setting defaults
-        to 5mb which is what the spec suggests, but it can easily be changed to
-        anything else--including StorageMap::noQuota.  Any values in LocalStorage are
-        grandfathered in regarudless of quota, so importItem only tracks (and will
-        never block) imports.
-
-        I believe this change is a good transition to more complex quota management.
-        For example, if we wanted to track quotas in the SQLite DB, then we'd just add
-        a function to the StorageMap that sets the quota.  This would be fine since all
-        use of LocalStorage is blocked on the import completing, so you'd never hit a
-        quota error in the mean time.  Also, if embedders wanted to ask the user
-        whether to expand the quota whenever it's hit (before deciding whether or not
-        to raise an exception), a callback via the chrome client should be fairly easy.
-        That said, I think it's best to add these features in steps rather than one
-        huge patch.  (Both of these are on my TODO list, btw.)
-
-        Included is a layout test that verifies the behavior.  It assumes the default
-        quota is 5mb (since that's what Settings defaults to).
-
-        Test: storage/domstorage/localstorage/quota.html
-
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::localStorage):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setLocalStorageQuota):
-        * page/Settings.h:
-        (WebCore::Settings::localStorageQuota):
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::create):
-        (WebCore::StorageAreaImpl::StorageAreaImpl):
-        (WebCore::StorageAreaImpl::setItem):
-        (WebCore::StorageAreaImpl::clear):
-        * storage/StorageAreaImpl.h:
-        * storage/StorageMap.cpp:
-        (WebCore::StorageMap::create):
-        (WebCore::StorageMap::StorageMap):
-        (WebCore::StorageMap::copy):
-        (WebCore::StorageMap::setItem):
-        (WebCore::StorageMap::removeItem):
-        (WebCore::StorageMap::importItem):
-        * storage/StorageMap.h:
-        (WebCore::StorageMap::quota):
-        * storage/StorageNamespace.cpp:
-        (WebCore::StorageNamespace::localStorageNamespace):
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::localStorageNamespace):
-        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
-        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
-        (WebCore::StorageNamespaceImpl::copy):
-        (WebCore::StorageNamespaceImpl::storageArea):
-        * storage/StorageNamespaceImpl.h:
-
-2009-10-02  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Database Inspector crashes Safari when table has more than 21 columns
-        https://bugs.webkit.org/show_bug.cgi?id=29924
-
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel.prototype.dataGridForResult): adjust the minimum column width percentage to be flexible for many columns.
-
-2009-10-02  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <http://webkit.org/b/14370>.
-        Inspector's timeline should record when certain DOM events fired.
-        
-        This patch adds calls into the Web Inspector when the main frame
-        fires an load event, and when the document fires its DOMContent
-        event. Once these values are passed in, they are sent to the Web Inspector
-        as a timing change, and these are denoted by vertical lines in the resources
-        panel (blue for DOM Content, red for load event).
-
-        * English.lproj/localizedStrings.js: Added tooltip text.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDatabaseCallback.cpp: Removed.
+        * bindings/js/JSDatabaseCallback.h: Removed.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DatabaseCallback.cpp: Removed.
+        * bindings/v8/custom/V8DatabaseCallback.h: Removed.
         * dom/Document.cpp:
-        (WebCore::Document::finishedParsing): Added an Inspector callback for DOM Content.
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::mainResourceFiredDOMContentEvent): Tell the main resource it got the event.
-        (WebCore::InspectorController::mainResourceFiredLoadEvent): Ditto.
-        * inspector/InspectorController.h:
-        * inspector/InspectorResource.cpp:
-        (WebCore::InspectorResource::InspectorResource): Added new variables.
-        (WebCore::InspectorResource::updateScriptObject): Send new variables to inspector.js.
-        (WebCore::InspectorResource::markDOMContentEventTime): Send a TimingChange event.
-        (WebCore::InspectorResource::markLoadEventTime): Ditto.
-        * inspector/InspectorResource.h:
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.get mainResourceLoadTime):
-        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
-        (WebInspector.ResourcesPanel.prototype.get mainResourceDOMContentTime):
-        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
-        (WebInspector.ResourcesPanel.prototype.reset):
-        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded): Draw dividers for event timings.
-        (WebInspector.ResourceTimeCalculator.prototype.computePercentageFromEventTime):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.updateResource):
+        (WebCore::Document::postTask):
         * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::dispatchLoadEvent): Add an Inspector callback for the Load event.
-
-2009-10-02  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Add support for blacklist patterns to user stylesheets and scripts in addition to whitelist patterns.
-
-        * WebCore.base.exp:
-        * dom/Document.cpp:
-        (WebCore::Document::pageGroupUserSheets):
-        * page/Frame.cpp:
-        (WebCore::Frame::injectUserScriptsForWorld):
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::addUserScript):
-        (WebCore::PageGroup::addUserStyleSheet):
-        (WebCore::PageGroup::removeUserContentWithURLForWorld):
-        (WebCore::PageGroup::removeUserContentForWorld):
-        * page/PageGroup.h:
-        * page/UserContentURLPattern.cpp:
-        (WebCore::UserContentURLPattern::matchesPatterns):
-        * page/UserContentURLPattern.h:
-        * page/UserScript.h:
-        (WebCore::UserScript::UserScript):
-        (WebCore::UserScript::whitelist):
-        (WebCore::UserScript::blacklist):
-        * page/UserStyleSheet.h:
-        (WebCore::UserStyleSheet::UserStyleSheet):
-        (WebCore::UserStyleSheet::whitelist):
-        (WebCore::UserStyleSheet::blacklist):
-
-2009-10-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        Build fix when SVG is not enabled
-        https://bugs.webkit.org/show_bug.cgi?id=30011
-
-        Move TextRenderingMode related functions out from
-        the ENABLE(SVG) guard.
-
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
-
-2009-10-02  Kenneth Russell  <kbr@google.com>
-
-        Reviewed by Oliver Hunt.
-
-        WebGL crashes with recent CanvasArray change
-        https://bugs.webkit.org/show_bug.cgi?id=30018
-
-        Test: fast/canvas/webgl/array-unit-tests.html
-
-        * html/canvas/CanvasArray.cpp:
-        (WebCore::CanvasArray::CanvasArray):
-        Fix bug where PassRefPtr was tested after transferring value to RefPtr.
-
-2009-10-02  Steve Falkenburg  <sfalken@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=29989>
-        Safari version number shouldn't be exposed in WebKit code
-        
-        For a WebKit version of 532.3.4:
-        Product version is: 5.32.3.4 (was 4.0.3.0)
-        File version is: 5.32.3.4 (was 4.532.3.4)
-
-        * WebCore.vcproj/QTMovieWin.rc:
-
-2009-10-02  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Enable two point radial gradients in Chromium/Skia.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30017
-
-        Covered by the following tests:
-
-        LayoutTests/svg/W3C-SVG-1.1/pservers-grad-13-b.svg
-        LayoutTests/fast/backgrounds/svg-as-background-3.html
-        LayoutTests/fast/gradients/generated-gradients.html
-        LayoutTests/fast/gradients/simple-gradients.html
-
-        * platform/graphics/skia/GradientSkia.cpp:
-        (WebCore::Gradient::platformGradient):
-
-2009-10-02  Norbert Leser  <norbert.leser@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Conditionally guard cursor code (cursor and updateCursor functions) with !QT_NO_CURSOR.
-        Otherwise, it is inconsistent with class declaration of QCursor.
-
-        No new tests.
-
-        * platform/qt/QWebPageClient.h:
-
-2009-10-02  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] missing support for anamorphic PAR video size
-        https://bugs.webkit.org/show_bug.cgi?id=29717
-
-        cleanup of caps handling in the video sink
-
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_set_caps):
+        (WebCore::DOMWindow::openDatabase):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+        * storage/Database.h:
+        * storage/DatabaseCallback.h: Removed.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        * workers/WorkerContext.h:
 
-2009-10-02  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+2010-03-06  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Simon Hausmann.
+        Rubber-stamped by Sam Weinig.
 
-        Fix compiler warnings about unused function arguments.
+        Remove unnecessary includes of wtf/Platform.h.  This is already pulled in by config.h.
 
-        * bridge/qt/qt_class.h:
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtRuntimeMetaMethod::call):
-        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * accessibility/AccessibilityObject.h:
+        * dom/XMLTokenizer.cpp:
+        * dom/XMLTokenizerLibxml2.cpp:
         * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::initializeParserContext):
-        * platform/graphics/qt/FontCacheQt.cpp:
-        (WebCore::FontCache::getTraitsInFamily):
-        (WebCore::FontCache::getCachedFontPlatformData):
-        * platform/graphics/qt/FontFallbackListQt.cpp:
-        (WebCore::FontFallbackList::setPlatformFont):
-        * platform/graphics/qt/FontQt.cpp:
-        (WebCore::Font::offsetForPositionForComplexText):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawLineForText):
-        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
-        (WebCore::GraphicsContext::setPlatformShadow):
-        (WebCore::GraphicsContext::setURLForRect):
-        * platform/graphics/qt/IconQt.cpp:
-        (WebCore::Icon::createIconForFiles):
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::frameBufferAtIndex):
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::supportsType):
-        (WebCore::MediaPlayerPrivate::setEndTime):
-        * platform/graphics/qt/SimpleFontDataQt.cpp:
-        (WebCore::SimpleFontData::containsCharacters):
-        * platform/graphics/qt/StillImageQt.h:
-        (WebCore::StillImage::destroyDecodedData):
-        * platform/network/qt/DnsPrefetchHelper.h:
-        (WebCore::DnsPrefetchHelper::lookedUp):
-        * platform/qt/ContextMenuQt.cpp:
-        (WebCore::ContextMenu::setPlatformDescription):
-        * platform/qt/DragDataQt.cpp:
-        (WebCore::DragData::asURL):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::populate):
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::supportsFocusRing):
-        (WebCore::RenderThemeQt::systemFont):
-        (WebCore::RenderThemeQt::adjustButtonStyle):
-        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
-        (WebCore::RenderThemeQt::paintMediaSeekBackButton):
-        (WebCore::RenderThemeQt::paintMediaSeekForwardButton):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::platformAddChild):
-        * platform/qt/SearchPopupMenuQt.cpp:
-        (WebCore::SearchPopupMenu::saveRecentSearches):
-        (WebCore::SearchPopupMenu::loadRecentSearches):
-        * platform/qt/TemporaryLinkStubs.cpp:
-        (WebCore::signedPublicKeyAndChallengeString):
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::paint):
-        * xml/XSLStyleSheetQt.cpp:
-        (WebCore::XSLStyleSheet::loadChildSheet):
-        (WebCore::XSLStyleSheet::setParentStyleSheet):
+        * editing/TextAffinity.h:
+        * loader/FrameLoaderClient.h:
+        * page/FocusController.cpp:
+        * page/FrameTree.cpp:
+        * page/Geolocation.h:
+        * page/PositionCallback.h:
+        * page/PositionErrorCallback.h:
+        * platform/Cursor.h:
+        * platform/FileSystem.h:
+        * platform/FloatConversion.h:
+        * platform/KeyboardCodes.h:
+        * platform/PlatformKeyboardEvent.h:
+        * platform/PlatformTouchPoint.h:
+        * platform/SuddenTermination.h:
+        * platform/Widget.h:
+        * platform/graphics/Color.h:
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/IntPoint.h:
+        * platform/graphics/IntRect.h:
+        * platform/graphics/IntSize.h:
+        * platform/graphics/openvg/PainterOpenVG.h:
+        * platform/graphics/openvg/SurfaceOpenVG.h:
+        * platform/network/ResourceHandleClient.h:
+        * platform/text/Base64.cpp:
+        * rendering/style/SVGRenderStyle.h:
+        * xml/XSLTProcessor.cpp:
+        * xml/XSLTProcessorLibxslt.cpp:
         * xml/XSLTProcessorQt.cpp:
-        (WebCore::XSLTMessageHandler::handleMessage):
-        (WebCore::XSLTProcessor::transformToString):
-
-2009-10-02  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] missing support for anamorphic PAR video size
-        https://bugs.webkit.org/show_bug.cgi?id=29717
-
-        Scale the cairo surface of the video sink depending on the
-        pixel-aspect-ratio of the video buffer to paint. Also
-        destruct/re-create the surface when setSize() is called with a new
-        size.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::naturalSize):
-        (WebCore::MediaPlayerPrivate::setSize):
-        (WebCore::MediaPlayerPrivate::paint):
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_idle_func):
-
-2009-10-02  Ben Murdoch  <benm@google.com>
-
-        Reviewed by David Kilzer.
 
-        Stale database version persists through browser refresh (changeVersion doesn't work)
-        https://bugs.webkit.org/show_bug.cgi?id=27836
+2010-03-06  Sam Weinig  <sam@webkit.org>
 
-        Tests: storage/change-version-handle-reuse.html
-               storage/change-version.html
-
-        * bindings/v8/custom/V8DatabaseCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Implement the V8 binding for database.changeVersion().
-        (WebCore::createTransaction): Fix a bug that was checking the wrong argument index to save the success callback.
-        * storage/Database.cpp:
-        (WebCore::updateGuidVersionMap): Safely update the Guid/version hash map.
-        (WebCore::Database::~Database): Remove code that removes the database from the guid->database and guid->version maps.
-        (WebCore::Database::setVersionInDatabase): Add a comment to explain some behaviour.
-        (WebCore::Database::close): Move the code that updates the maps from the destructor to here.
-        (WebCore::Database::performOpenAndVerify): Call updateGuidVersionMap instead of setting the hash map directly.
-        (WebCore::Database::setExpectedVersion): Update the in memory guid->version map when we want to update the database version.
-
-2009-10-02  Janne Koskinen <janne.p.koskinen@digia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Partial WINSCW build fix.
-
-        Add parentheses around the function pointer declaration, similar to the
-        second hunk in r48825.
-
-        * loader/CachedResourceHandle.h:
+        Reviewed by Dan Bernstein.
 
-2009-10-02  Adam Barth  <abarth@webkit.org>
+        Move debug only JS wrapper-set tracking code into its own file.
+        https://bugs.webkit.org/show_bug.cgi?id=35839
 
-        Unreviewed attempted build fix by Xcode magic.
+        * GNUmakefile.am: Added new files.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
 
-        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::cacheDOMObjectWrapper):
+        (WebCore::forgetDOMObject):
+        (WebCore::forgetDOMNode):
+        (WebCore::cacheDOMNodeWrapper):
+        (WebCore::takeWrappers):
+        (WebCore::updateDOMNodeDocument):
+        Updated for new signature for willCacheWrapper and didUncacheWrapper.
 
-2009-10-02  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed build fix.  Actually add the new files.
-
-        * loader/RedirectScheduler.cpp: Added.
-        (WebCore::ScheduledRedirection::):
-        (WebCore::ScheduledRedirection::ScheduledRedirection):
-        (WebCore::RedirectScheduler::RedirectScheduler):
-        (WebCore::RedirectScheduler::~RedirectScheduler):
-        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
-        (WebCore::RedirectScheduler::clear):
-        (WebCore::RedirectScheduler::scheduleRedirect):
-        (WebCore::RedirectScheduler::mustLockBackForwardList):
-        (WebCore::RedirectScheduler::scheduleLocationChange):
-        (WebCore::RedirectScheduler::scheduleFormSubmission):
-        (WebCore::RedirectScheduler::scheduleRefresh):
-        (WebCore::RedirectScheduler::locationChangePending):
-        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
-        (WebCore::RedirectScheduler::timerFired):
-        (WebCore::RedirectScheduler::schedule):
-        (WebCore::RedirectScheduler::startTimer):
-        (WebCore::RedirectScheduler::cancel):
-        * loader/RedirectScheduler.h: Added.
-
-2009-10-01  Adam Barth  <abarth@webkit.org>
+        * bindings/js/JSDOMWrapper.cpp: Added.
+        (WebCore::DOMObject::~DOMObject):
+        (WebCore::DOMObject::defineOwnProperty):
+        Moved from JSDOMBinding.cpp.
 
-        Reviewed by Darin Adler.
+        * bindings/js/JSDebugWrapperSet.cpp: Added.
+        (WebCore::JSDebugWrapperSet::shared):
+        (WebCore::JSDebugWrapperSet::JSDebugWrapperSet):
+        * bindings/js/JSDebugWrapperSet.h: Added.
+        (WebCore::JSDebugWrapperSet::add):
+        (WebCore::JSDebugWrapperSet::remove):
+        (WebCore::JSDebugWrapperSet::contains):
+        (WebCore::JSDebugWrapperSet::willCacheWrapper):
+        (WebCore::JSDebugWrapperSet::didUncacheWrapper):
+        Moved from JSDOMBinding.cpp.
 
-        Move RedirectScheduler to its own file
-        https://bugs.webkit.org/show_bug.cgi?id=29952
+2010-03-06  Sam Weinig  <sam@webkit.org>
 
-        This change is purely code motion.
+        Rubber-stamped by Dan Bernstein.
 
-        No behavior change.
+        Move DOMObjectHashTableMap, DOMWrapperWorld and WebCoreJSClientData into
+        their own files.
 
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/RedirectScheduler.cpp: Added.
-        (WebCore::ScheduledRedirection::):
-        (WebCore::ScheduledRedirection::ScheduledRedirection):
-        (WebCore::RedirectScheduler::RedirectScheduler):
-        (WebCore::RedirectScheduler::~RedirectScheduler):
-        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
-        (WebCore::RedirectScheduler::clear):
-        (WebCore::RedirectScheduler::scheduleRedirect):
-        (WebCore::RedirectScheduler::mustLockBackForwardList):
-        (WebCore::RedirectScheduler::scheduleLocationChange):
-        (WebCore::RedirectScheduler::scheduleFormSubmission):
-        (WebCore::RedirectScheduler::scheduleRefresh):
-        (WebCore::RedirectScheduler::locationChangePending):
-        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
-        (WebCore::RedirectScheduler::timerFired):
-        (WebCore::RedirectScheduler::schedule):
-        (WebCore::RedirectScheduler::startTimer):
-        (WebCore::RedirectScheduler::cancel):
-        * loader/RedirectScheduler.h: Added.
-
-2009-10-02  Dave MacLachlan  <dmaclach@gmail.com>
-
-        Reviewed by David Levin.
-
-        Clean up warnings in WebCore/bindings/v8/npruntime.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=29971
-
-        Gets rid of warnings on gcc about using anonymous namespaces 
-          warning: 'StringKeyHashTraits' has a base
-          'WTF::GenericHashTraits<<unnamed>::StringKey>' 
-          whose type uses the anonymous namespace
-        and
-          warning: 'WTF::PairHashTraits<StringKeyHashTraits,
-          WTF::HashTraits<PrivateIdentifier*> >' has a base
-          'WTF::GenericHashTraits<std::pair<<unnamed>::StringKey,
-          PrivateIdentifier*> >' whose type uses the anonymous namespace
-
-        No tests required.
-
-        * bindings/v8/npruntime.cpp:
-
-2009-10-01  Mark Rowe  <mrowe@apple.com>
-
-        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2009-10-01  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Turn on ENABLE_3D_CANVAS in TOT
-        https://bugs.webkit.org/show_bug.cgi?id=29906
-
-        Fixed a bug found when running tests with flag on
-
-        * Configurations/FeatureDefines.xcconfig:
-        * WebCore.base.exp:
-        * bindings/js/JSCanvasArrayBufferConstructor.h:
-        (WebCore::construct):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext):
-        * html/canvas/CanvasArray.cpp:
-        (WebCore::CanvasArray::CanvasArray):
-        * html/canvas/CanvasByteArray.cpp:
-        (WebCore::CanvasByteArray::create):
-        * html/canvas/CanvasFloatArray.cpp:
-        (WebCore::CanvasFloatArray::create):
-        * html/canvas/CanvasIntArray.cpp:
-        (WebCore::CanvasIntArray::create):
-        * html/canvas/CanvasShortArray.cpp:
-        (WebCore::CanvasShortArray::create):
-        * html/canvas/CanvasUnsignedByteArray.cpp:
-        (WebCore::CanvasUnsignedByteArray::create):
-        * html/canvas/CanvasUnsignedIntArray.cpp:
-        (WebCore::CanvasUnsignedIntArray::create):
-        * html/canvas/CanvasUnsignedShortArray.cpp:
-        (WebCore::CanvasUnsignedShortArray::create):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setWebGLEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::webGLEnabled):
-
-2009-10-01  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for <rdar://problem/7264725> Re-add a vendor prefix to box-
-        shadow (29927)
-        -and corresponding-
-        https://bugs.webkit.org/show_bug.cgi?id=29927
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::ShadowParseContext::ShadowParseContext):
-        (WebCore::ShadowParseContext::commitValue):
-        (WebCore::ShadowParseContext::commitLength):
-        (WebCore::ShadowParseContext::commitColor):
-        (WebCore::cssPropertyID):
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap):
+        * bindings/js/DOMObjectHashTableMap.cpp: Copied from bindings/js/JSDOMBinding.cpp.
+        * bindings/js/DOMObjectHashTableMap.h: Copied from bindings/js/JSDOMBinding.h.
+        (WebCore::DOMObjectHashTableMap::~DOMObjectHashTableMap):
+        (WebCore::DOMObjectHashTableMap::get):
+        * bindings/js/DOMWrapperWorld.cpp: Copied from bindings/js/JSDOMBinding.cpp.
+        (WebCore::forgetWorldOfDOMNodesForDocument):
+        * bindings/js/DOMWrapperWorld.h: Copied from bindings/js/JSDOMBinding.h.
+        (WebCore::DOMWrapperWorld::create):
+        (WebCore::DOMWrapperWorld::rememberDocument):
+        (WebCore::DOMWrapperWorld::forgetDocument):
+        (WebCore::DOMWrapperWorld::isNormal):
+        (WebCore::debuggerWorld):
+        (WebCore::pluginWorld):
+        (WebCore::currentWorld):
+        (WebCore::Document::getWrapperCache):
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/WebCoreJSClientData.h: Copied from bindings/js/JSDOMBinding.h.
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        (WebCore::WebCoreJSClientData::~WebCoreJSClientData):
+        (WebCore::WebCoreJSClientData::normalWorld):
+        (WebCore::WebCoreJSClientData::getAllWorlds):
+        (WebCore::WebCoreJSClientData::rememberWorld):
+        (WebCore::WebCoreJSClientData::forgetWorld):
+        * bindings/js/WorkerScriptController.cpp:
 
-2009-10-01  Beth Dakin  <bdakin@apple.com>
+2010-03-06  Dan Bernstein  <mitz@apple.com>
 
         Rubber-stamped by Sam Weinig.
 
-        At bad merge at some point in the development of my patch must have 
-        put TextRenderMode.h in a weird spot in the xcodeproj. Moving it 
-        back where it belongs!
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-09-30  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Remove FrameLoader::schedule* APIs
-        https://bugs.webkit.org/show_bug.cgi?id=29950
-
-        Change clients of FrameLoader::schedule* to call redirectScheduler
-        directly.
-
-        No behavior change.
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::setLocation):
-        (WebCore::createWindow):
-        (WebCore::JSDOMWindow::open):
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::setLocation):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::navigateIfAllowed):
-        (WebCore::JSLocation::reload):
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::navigateIfAllowed):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-        (WebCore::Document::processHttpEquiv):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::write):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::requestFrame):
-        (WebCore::FrameLoader::submitForm):
-        (WebCore::FrameLoader::receivedFirstData):
-        * loader/FrameLoader.h:
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::selectCache):
-        * page/History.cpp:
-        (WebCore::History::back):
-        (WebCore::History::forward):
-        (WebCore::History::go):
-
-2009-10-01  Beth Dakin  <bdakin@apple.com>
-
-        Just removing a comment I accidentally committed earlier. 
-
-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::SimpleFontData::getCFStringAttributes):
-
-2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Clean up use of const and mutable in StorageMap
-        https://bugs.webkit.org/show_bug.cgi?id=29933
-
-        What's the point of having every single member variable be mutable and nearly
-        every method be const?  Let's clean it up.
-
-        * storage/StorageMap.cpp:
-        (WebCore::StorageMap::setIteratorToIndex):
-        (WebCore::StorageMap::key):
-        (WebCore::StorageMap::importItem):
-        * storage/StorageMap.h:
-
-2009-10-01  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Fix for <rdar://problem/6934421> Support CSS for Text Kerning and 
-        ligature
-        -and corresponding-
-        https://bugs.webkit.org/show_bug.cgi?id=6136
-
-        This patch makes the SVG CSS property text-rendering work with any 
-        HTML, much like it does in Firefox. It accepts four possible input 
-        values: auto, optimizeSpeed, optimizeLegibility, and 
-        geometricPrecision. Right now, in this implementation, here is what 
-        those values correspond to:
-
-        auto = optimizeSpeed = what we normally when the value's not set
-        optimizeLegibility = geometricPrecision = ligatures kerning
-
-        Add new file TextRenderingMode.h to the project files.
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-
-        CSS support for the new CSSPropertyTextRendering
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * css/CSSValueKeywords.in:
+        Remove an unused method.
 
-        All the old SVG CSS support for this property can go away. When 
-        it's used in SVG, it will just fall into the normal HTML case.
-        * css/SVGCSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
-        * css/SVGCSSParser.cpp:
-        (WebCore::CSSParser::parseSVGValue):
-        * css/SVGCSSPropertyNames.in:
-        * css/SVGCSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applySVGProperty):
-        * css/SVGCSSValueKeywords.in:
-
-        FontDescription stores the m_textRendering bit.
-        * platform/graphics/FontDescription.h:
-        (WebCore::FontDescription::FontDescription):
-        (WebCore::FontDescription::textRenderingMode):
-        (WebCore::FontDescription::setTextRenderingMode):
-        (WebCore::FontDescription::operator==):
-
-        We want to fall into the complex text rendering code path if 
-        kerning and ligatures have been enabled with this property.
-        * platform/graphics/FontFastPath.cpp:
-        (WebCore::Font::canUseGlyphCache):
-
-        Now takes a TextRenderingMode as a parameter.
-        * platform/graphics/SimpleFontData.h:
-
-        New header for the enum.
-        * platform/graphics/TextRenderingMode.h: Added.
-        (WebCore::):
-
-        getCFStringAttributes() now takes a TextRenderingMode as an 
-        attribute.
-        * platform/graphics/mac/CoreTextController.cpp:
-        (WebCore::CoreTextController::collectCoreTextRunsForCharacters):
-
-        Enable kerning and ligatures whenever the TextRenderingMode is 
-        OptimizeLegibility or GeometricPrecision
-        * platform/graphics/mac/FontMacATSUI.mm:
-        (WebCore::disableLigatures):
-        (WebCore::initializeATSUStyle):
-        (WebCore::ATSULayoutParameters::initialize):
-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::SimpleFontData::getCFStringAttributes):
-
-        More SVG CSS stuff that isn't needed anymore since SVG will use the 
-        new HTML CSS implementation.
-        * rendering/style/SVGRenderStyle.h:
-        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
-        (WebCore::SVGRenderStyle::setBitDefaults):
-        * rendering/style/SVGRenderStyleDefs.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock): Changed comment.
+        (WebCore::RenderBlock::floatRect): Removed.
+        * rendering/RenderBlock.h: Removed floatRect().
 
-2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+2010-03-06  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Use isClosure property of scope proxy to decide whether the
-        scope is a closure.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29965
-
-        * inspector/front-end/ScopeChainSidebarPane.js:
-        (WebInspector.ScopeChainSidebarPane.prototype.update):
-
-2009-10-01  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Odd color transitions on anchors with transition-property: all
-        https://bugs.webkit.org/show_bug.cgi?id=29911
-
-        When transitioning maybe-invalid colors, if the source and destination
-        color are both invalid, then don't animate.
-        
-        This fixes an issue where a child element of an element running a color
-        transition, with -webkit-transition-property:all, would show a color change.
-        This happened because the "maybe invalid color" logic copied the color style
-        into -webkit-text-fill-color for both endpoints, causing -webkit-text-fill-color
-        to animate while the transition ran, and to then to disappear when the transition
-        finished.
-        
-        Test: transitions/color-transition-all.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::PropertyWrapperMaybeInvalidColor::equals):
-        (WebCore::PropertyWrapperMaybeInvalidColor::blend):
-
-2009-10-01  Victor Wang  <victorw@chromium.org>
-
-        Reviewed by Oliver Hunt.
-
-        Allow dragging a node who has child nodes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28632
-
-        Test: fast/events/drag-parent-node.html
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::shouldDragAutoNode):
-
-2009-10-01  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] media player: better mute support
-        https://bugs.webkit.org/show_bug.cgi?id=29960
-
-        Handle volume and mute state with the two corresponding properties
-        of playbin2.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::setMuted):
-        (WebCore::MediaPlayerPrivate::setVolume):
-
-2009-10-01  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] video sink pad template colorspace is wrong
-        https://bugs.webkit.org/show_bug.cgi?id=29953
-
-        Set sink pad template colorspace depending on byte order.
-
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_idle_func):
-
-2009-10-01  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Refactored V8 event listeners:
-        (This change should fix http://crbug.com/21079 and
-        https://bugs.webkit.org/show_bug.cgi?id=29093.)
-         o All listeners use weak handles to JS objects to avoid creating
-           cycles and leaking memory.
-         o "Object" variants of listeners removed.
-         o All event accessor callbacks are generated.
-         o Custom event accessors removed.
-         o All wrappers have hidden dependencies on their listeners to
-           prevent listeners from being collected.
-         o All variats of getEventListener function grouped in V8DOMWrapper.
-         o Pointers to C+EventListener wrappers are stored in JS objects
-           instead of event listener lists.
-        https://bugs.webkit.org/show_bug.cgi?id=29825
-
-        * WebCore.gypi: Removed "Object" listeners.
-        * bindings/scripts/CodeGeneratorV8.pm: Now handles event accessors.
-        * bindings/v8/DOMObjectsInclude.h:
-
-        V8AbstractEventListener manages weak JS handle:
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::weakEventListenerCallback):
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
-        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
-        (WebCore::V8AbstractEventListener::handleEvent):
-        (WebCore::V8AbstractEventListener::disposeListenerObject):
-        (WebCore::V8AbstractEventListener::setListenerObject):
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8AbstractEventListener::cast):
-        (WebCore::V8AbstractEventListener::isLazy):
-        (WebCore::V8AbstractEventListener::getListenerObject):
-        (WebCore::V8AbstractEventListener::getExistingListenerObject):
-        (WebCore::V8AbstractEventListener::hasExistingListenerObject):
-        (WebCore::V8AbstractEventListener::disconnectFrame):
-        (WebCore::V8AbstractEventListener::disconnected):
-        (WebCore::V8AbstractEventListener::prepareListenerObject):
-        (WebCore::V8AbstractEventListener::lineNumber):
-        (WebCore::V8AbstractEventListener::virtualisAttribute):
-
-        Grouped getEventListener functions:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::getEventListener):
-        * bindings/v8/V8DOMWrapper.h:
-
-        Removed most event listener objects bookkeeping:
-        * bindings/v8/V8EventListenerList.cpp:
-        * bindings/v8/V8EventListenerList.h:
-        (WebCore::V8EventListenerList::findWrapper):
-        (WebCore::V8EventListenerList::clearWrapper):
-        (WebCore::V8EventListenerList::doFindWrapper):
-        (WebCore::V8EventListenerList::getHiddenProperty):
-        (WebCore::V8EventListenerList::findOrCreateWrapper):
-
-        Added hidden properties for storing EventListener wrappers:
-        * bindings/v8/V8HiddenPropertyName.cpp:
-        (WebCore::V8HiddenPropertyName::listener):
-        (WebCore::V8HiddenPropertyName::attributeListener):
-        * bindings/v8/V8HiddenPropertyName.h:
-
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::V8LazyEventListener):
-        (WebCore::V8LazyEventListener::callListenerFunction):
-        (WebCore::V8LazyEventListener::prepareListenerObject):
-        * bindings/v8/V8LazyEventListener.h:
-        (WebCore::V8LazyEventListener::isLazy):
-        * bindings/v8/V8ObjectEventListener.cpp: Removed.
-        * bindings/v8/V8ObjectEventListener.h: Removed.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::disconnectFrame):
-        (WebCore::V8Proxy::disconnectEventListeners):
-        * bindings/v8/V8Proxy.h:
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::reportError):
-        (WebCore::V8WorkerContextEventListener::getReceiverObject):
-        * bindings/v8/V8WorkerContextEventListener.h:
-        * bindings/v8/V8WorkerContextObjectEventListener.cpp: Removed.
-        * bindings/v8/V8WorkerContextObjectEventListener.h: Removed.
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::dispose):
-        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
-        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
-        * bindings/v8/WorkerContextExecutionProxy.h:
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::V8EventListener):
-        (WebCore::V8EventListener::getListenerFunction):
-        (WebCore::V8EventListener::callListenerFunction):
-        * bindings/v8/custom/V8CustomEventListener.h:
-        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::getEventListener):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WebSocketCustom.cpp:
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
-
-2009-10-01  Alexis Menard  <alexis.menard@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
+        Web Inspector: make timeline overview bars transparent to mouse events.
 
-        Rename QWebGraphicsItem to QGraphicsWebView
+        https://bugs.webkit.org/show_bug.cgi?id=35832
 
-        * WebCore.pro:
-
-2009-10-01  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Read-only transactions do not change file sizes and therefore
-        should not trigger quota updates.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29945
-
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::openTransactionAndPreflight):
-        (WebCore::SQLTransaction::runStatements):
-
-2009-09-30  Timothy Hatcher  <timothy@apple.com>
-
-        Fix list box scrolling by correctly overriding the scroll()
-        function on RenderBox.
-
-        <rdar://problem/7255440> REGRESSION (r48683): Mousewheel scrolling
-        of listboxes is broken (29756)
-
-        Reviewed by Dan Bernstein.
-
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::scroll):
-        * rendering/RenderListBox.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::scroll):
-        * rendering/RenderTextControlSingleLine.h:
-
-2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
+        * inspector/front-end/inspector.css:
 
-        Make a copy of listeners array before dispatching an event in
-        WebInspector.Object.prototype.dispatchEventToListeners. Otherwise if current
-        listener removes itself from the array next listener will be skipped.
+2010-03-06  Pavel Feldman  <pfeldman@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29920
+        Reviewed by Jeremy Orlow.
 
-        * inspector/front-end/Object.js:
-        (WebInspector.Object.prototype.dispatchEventToListeners): make a copy of listeners array before dispatching an event
+        Web Inspector: switching to/from Timeline Panel moves scroller.
+        (Also added couple of record details items as I was fixing it).
 
-2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35829
 
-        Reviewed by Xan Lopez.
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get defaultFocusedElement):
+        (WebInspector.TimelinePanel.prototype.show):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
 
-        [GTK] GtkIMContext filtering interferes with DOM key events
-        https://bugs.webkit.org/show_bug.cgi?id=28733
+2010-03-06  Patrick Gansterer  <paroga@paroga.com>
 
-        Ensure that keyboard events filtered by the GtkIMContext still create
-        the proper DOM events.
+        Reviewed by Eric Seidel.
 
-        No tests added. Instead previously skipped tests have been enabled.
+        Removed unnecessary WinCE file.
+        The same functionality is provided by platform/win/SystemTimeWin.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=35799
 
-        * platform/gtk/KeyEventGtk.cpp:
-        (WebCore::keyIdentifierForGdkKeyCode):
-        (WebCore::singleCharacterString):
+        * platform/wince/SystemTimeWince.cpp: Removed.
 
-2009-10-01  Philippe Normand  <pnormand@igalia.com>
+2010-03-06  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
 
-        Reviewed by Xan Lopez.
+        Reviewed by Eric Seidel.
 
-        [GTK] data: uri support in media player
-        https://bugs.webkit.org/show_bug.cgi?id=29842
+        https://bugs.webkit.org/show_bug.cgi?id=30895
+        [Gtk] The accessible hierarchy of tables is significantly incorrect for Atk
 
-        New GStreamer element to handle data: uris. For now only base64
-        encoded data is supported. Decoded data is handed over to
-        giostreamsrc.
+        This completes the fixing of the Atk table hierarchy which was started
+        in bug #35418.
 
-        * GNUmakefile.am:
-        * platform/graphics/gtk/DataSourceGStreamer.cpp: Added.
-        (_do_init):
-        (webkit_data_src_base_init):
-        (webkit_data_src_class_init):
-        (webkit_data_src_reset):
-        (webkit_data_src_init):
-        (webkit_data_src_finalize):
-        (webkit_data_src_uri_get_type):
-        (webkit_data_src_uri_get_protocols):
-        (webkit_data_src_uri_get_uri):
-        (webkit_data_src_uri_set_uri):
-        (webkit_data_src_uri_handler_init):
-        * platform/graphics/gtk/DataSourceGStreamer.h: Added.
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::do_gst_init):
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::mimeTypeCache):
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::determineAccessibilityRole):
 
-2009-09-30  Daniel Bates  <dbates@webkit.org>
+2010-03-06  MORITA Hajime  <morrita@google.com>
 
-        Reviewed by Adam Barth.
+        Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29944
+        Moved implementations of window.btoa() and window.atob() from
+        JSDOMWindow to DOMWindow, and make V8DOMWindow use DOMWindow
+        functions instead of having a separate implementation. As a side effect, the
+        error message has changed from "Cannot decode base64" to one that
+        indicates DOM Exception, which is compatible to Firefox.
         
-        Reduces false positives in the XSSAuditor by explicitly allowing requests
-        that do not contain illegal URI characters.
-        
-        As a side effect of this change, the tests property-inject.html, 
-        property-escape-noquotes.html, and property-escape-noquotes-tab-slash-chars.html 
-        fail because these attacks do not contain any illegal URI characters and 
-        thus are now allowed by the XSSAuditor, where previously they weren't. A future
-        change may reinstate this functionality.
-
-        Tests: http/tests/security/xssAuditor/script-tag-safe2.html
-               http/tests/security/xssAuditor/script-tag-safe3.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::isIllegalURICharacter): Added method.
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::findInRequest): Added parameter 
-        allowRequestIfNoIllegalURICharacters.
-        * page/XSSAuditor.h:
-
-2009-09-30  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        reproducible freeze and crash on closing form popup at bosch-home.nl
-        https://bugs.webkit.org/show_bug.cgi?id=28948
+        Refactoring: window.btoa() and window.atob() should be implemented on DOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=35723
 
-        showModalDialog calls getDirect on what is actually a window shell,
-        so ends up not getting a value (since no value can ever be placed
-        directly on the shell), which leads to incorrect behaviour.
-
-        We use a manual test rather than automatic as it was not
-        possible to get a modal run loop to work inside DRT.
+        No new test. No new functionality.
 
         * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::showModalDialog):
-        * manual-tests/showModalDialog-returnValue.html: manual testcase.
-
-2009-09-30  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Adds ValidityState.tooLong support for <input> and <textarea>.
-
-        Introduces tooLong() in HTMLFormControlElement and it always returns false.
-        HTMLInputElement and HTMLTextAreaElement overrides it and checks the text
-        length and maxLength.  tooLong() should work only for `dirty' values.
-        So, introduces m_isDirty flag for HTMLTextAreaElement, and
-        !m_data.value().isNull() works as a dirty flag for HTMLInputElement.
-
-        Renames parameter names of setMaxLength().
-
-        https://bugs.webkit.org/show_bug.cgi?id=27454
-
-        Tests: fast/forms/ValidityState-tooLong-input.html
-               fast/forms/ValidityState-tooLong-textarea.html
-
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::tooLong):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::tooLong):
-        (WebCore::HTMLInputElement::setMaxLength):
-        * html/HTMLInputElement.h:
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
-        (WebCore::HTMLTextAreaElement::reset):
-        (WebCore::HTMLTextAreaElement::updateValue):
-        (WebCore::HTMLTextAreaElement::setMaxLength):
-        (WebCore::HTMLTextAreaElement::tooLong):
-        * html/HTMLTextAreaElement.h:
-        * html/ValidityState.h:
-        (WebCore::ValidityState::tooLong):
-
-2009-09-30  Adam Barth  <abarth@webkit.org>
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
+        Moved conversion code to DOMWindow and invoke it. Argument
+        checking remains here.
+        
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::atobCallback):
+        (WebCore::V8DOMWindow::btoaCallback):
+        Remove conversion code and call DOMWindow APIs. Although argument
+        checking remains here.
+        
+        * page/DOMWindow.cpp:
+        (WebCore::hasMultibyteCharacters):
+        (WebCore::DOMWindow::btoa):
+        (WebCore::DOMWindow::atob):
+        * page/DOMWindow.h:
+        Moved Conversion code from JSDOMWindow, modifing to fit JSC independent.
 
-        Reviewed by Maciej Stachowiak.
+2010-03-06  Yuta Kitamura  <yutak@chromium.org>
 
-        Factor RedirectScheduler out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=29948
+        Reviewed by Eric Seidel.
 
-        This change introduces a new sub-object of Frame, redirectScheduler.
-        The redirectScheduler is responsible for scheduling redirects.
+        Fix decoration position in search input field.
 
-        This change leaves the code for the redirectScheduler in
-        FrameLoader.cpp.  A future change will move the class into its own
-        file.
+        This patch fixes rendering of input field of "search" type, whose decoration
+        (loupe icon and close button) was wrongly positioned when the input field was
+        contained in a block with -webkit-transform property.
 
-        No behavior change (hopefully!).
+        Chromium bug: http://crbug.com/20439
 
-        * loader/FrameLoader.cpp:
-        (WebCore::RedirectScheduler::RedirectScheduler):
-        (WebCore::RedirectScheduler::~RedirectScheduler):
-        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
-        (WebCore::RedirectScheduler::clear):
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::setDefersLoading):
-        (WebCore::FrameLoader::stopLoading):
-        (WebCore::FrameLoader::didOpenURL):
-        (WebCore::FrameLoader::didExplicitOpen):
-        (WebCore::FrameLoader::cancelAndClear):
-        (WebCore::FrameLoader::clear):
-        (WebCore::FrameLoader::checkCompleted):
-        (WebCore::FrameLoader::isScheduledLocationChangePending):
-        (WebCore::FrameLoader::scheduleHTTPRedirection):
-        (WebCore::RedirectScheduler::scheduleRedirect):
-        (WebCore::RedirectScheduler::mustLockBackForwardList):
-        (WebCore::FrameLoader::scheduleLocationChange):
-        (WebCore::RedirectScheduler::scheduleLocationChange):
-        (WebCore::FrameLoader::scheduleFormSubmission):
-        (WebCore::RedirectScheduler::scheduleFormSubmission):
-        (WebCore::FrameLoader::scheduleRefresh):
-        (WebCore::RedirectScheduler::scheduleRefresh):
-        (WebCore::RedirectScheduler::locationChangePending):
-        (WebCore::FrameLoader::scheduleHistoryNavigation):
-        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
-        (WebCore::RedirectScheduler::timerFired):
-        (WebCore::FrameLoader::provisionalLoadStarted):
-        (WebCore::RedirectScheduler::schedule):
-        (WebCore::RedirectScheduler::startTimer):
-        (WebCore::RedirectScheduler::cancel):
-        (WebCore::FrameLoader::completed):
-        (WebCore::FrameLoader::open):
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-        (WebCore::Frame::redirectScheduler):
-        * page/Frame.h:
+        [Chromium] Decoration of "search" input field is wrongly rendered
+        https://bugs.webkit.org/show_bug.cgi?id=30245
 
-2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+        No new tests, since this patch fixes an existing test
+        (fast/forms/search-transformed.html) in Chromium layout tests.
 
-        Build fix, not reviewed.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::convertToPaintingRect): Added. This method
+        does almost the same thing as RenderThemeMac::convertToPaintingRect.
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton): The position
+        of the icon should not depend on its absolute position.
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton): Ditto.
+        * rendering/RenderThemeChromiumSkia.h: Added new method.
 
-        More Windows build fixes for https://bugs.webkit.org/show_bug.cgi?id=29943
+2010-03-06  Ilya Tikhonovsky  <loislo@chromium.org>
 
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::willSendRequest):
+        Reviewed by Pavel Feldman.
 
-2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+        Web Inspector: in Timeline panel, click followed with mouse move resets popover.
 
-        Build fix, not reviewed.
+        https://bugs.webkit.org/show_bug.cgi?id=35827
 
-        Fix windows build for fix for https://bugs.webkit.org/show_bug.cgi?id=29943
+        * inspector/front-end/Popover.js:
+        (WebInspector.PopoverHelper.prototype._mouseDown):
+        (WebInspector.PopoverHelper.prototype._mouseMove):
+        (WebInspector.PopoverHelper.prototype._handleMouseAction):
 
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::willSendRequest):
+2010-03-05  Tony Chang  <tony@chromium.org>
 
-2009-09-30  Dimitri Glazkov  <dglazkov@chromium.org>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Darin Fisher.
+        https://bugs.webkit.org/show_bug.cgi?id=33247
+        Backwards cursor movement incorrect when previous block ends with <br>.
 
-        [V8] HTMLAudioElement, HTMLImageElement, and HTMLOptionElement are constructable, but they shouldn't be.
-        Only Audio, Image, and Option should be constructable.
-        https://bugs.webkit.org/show_bug.cgi?id=29940
+        If the cursor is trying to move into a node that has a height of 0,
+        skip over it.
 
-        Test: fast/dom/dom-constructor.html
+        Test: editing/execCommand/move-selection-back-line.html
 
-        * WebCore.gypi: Added new files to project.
-        * bindings/scripts/CodeGeneratorV8.pm: Modified to generate custom constructors.
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate): Removed handling of HTMLImageElement, HTMLOptionElement
-          and HTMLAudioElement construction.
-        * bindings/v8/V8HTMLAudioElementConstructor.h: Added.
-        * bindings/v8/V8HTMLImageElementConstructor.h: Added.
-        * bindings/v8/V8HTMLOptionElementConstructor.h: Added.
-        * bindings/v8/V8Index.cpp: Added new headers.
-        * bindings/v8/V8Index.h: Added Audio, Image and Option decls.
-        * bindings/v8/custom/V8CustomBinding.h: Ditto.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_GETTER): Added custom constructors.
-        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
-        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Added custom template creator.
-        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
-        (WebCore::V8HTMLOptionElementConstructor::GetTemplate): Ditto.
-        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
-        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Ditto.
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
 
-2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+2010-03-05  Andrey Kosyakov  <caseq@chromium.org>
 
-        Reviewed by Brady Eidson.
+        Reviewed by Eric Seidel.
 
-        307 redirects should pass along http body and Content-Type header
-        https://bugs.webkit.org/show_bug.cgi?id=29943
+        Enable resource loading callback while loading worker scripts
+        https://bugs.webkit.org/show_bug.cgi?id=35744
 
-        Follow-up fix for:
-        <rdar://problem/3802660> SAP: 307 (Temporary Redirect) responses should use POST, not GET
-        
-        Test: http/tests/loading/resources/redirect-methods-result.php
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
 
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::willSendRequest): Pass along http body and Content-Type header.
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): ditto
+2010-03-05  Chris Fleizach  <cfleizach@apple.com>
 
-2009-09-30  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Mark Rowe.
+        WAI-ARIA live region doesn't appear when <div> only has a <div> child
+        https://bugs.webkit.org/show_bug.cgi?id=35751
 
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=29941
-        REGRESSION (r48882-r48888): Many memory leaks on SnowLeopard leaks bot
+        Elements should not be ignored if they carry ARIA attributes in them.
 
-        Forgot to implement a destructor for JSDOMWindowBaseData, so it was
-        leaking its RefPtr data member.
+        Test: platform/mac/accessibility/div-containing-div-with-aria.html
 
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::destroyJSDOMWindowBaseData):
-        * bindings/js/JSDOMWindowBase.h:
-        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData::JSDOMWindowBaseData):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::supportsARIAAttributes):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::supportsARIADropping):
+        (WebCore::AccessibilityObject::supportsARIADragging):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::supportsARIADropping):
+        (WebCore::AccessibilityRenderObject::supportsARIADragging):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.h:
 
-2009-09-30  Dave Hyatt  <hyatt@apple.com>
+2010-03-05  Dmitry Titov  <dimich@chromium.org>
 
-        Reviewed by Tim Hatcher.
+        Reviewed by Oliver Hunt.
 
-        Make sure the removal of user stylesheets results in all of the WebViews being updated to
-        reflect the changes.
+        Add a manual test for crash in DOMWindow::clearTimeout when DOMWindow is not connected to Frame
+        https://bugs.webkit.org/show_bug.cgi?id=32353
 
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::removeUserContentWithURLForWorld):
-        (WebCore::PageGroup::removeUserContentForWorld):
+        * manual-tests/clearTimeout-crash-bug29832.html: Added.
 
-2009-09-30  Dan Bernstein  <mitz@apple.com>
+2010-03-05  Dmitry Titov  <dimich@chromium.org>
 
-        Reviewed by Sam Weinig.
+        Reviewed by David Levin.
 
-        REGRESSION(r47440): drop down menus at americanexpress.com disappear on mouse out
-        https://bugs.webkit.org/show_bug.cgi?id=29209
+        [v8] Remove wrong assert in GC callback
+        https://bugs.webkit.org/show_bug.cgi?id=35757
 
-        Test: fast/inline/relative-positioned-overflow.html
+        Test: fast/workers/wrapper-map-gc.html
 
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::computeVerticalOverflow): Add self-painting
-        inlines to overflow to ensure that they are included in hit-testing.
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::handleWeakObject): remove ASSERT(isMainThread()), move another assert up to verify we are on the right thread.
 
-2009-09-30  Simon Fraser  <simon.fraser@apple.com>
+2010-03-05  Alex Milowski  <alex@milowski.com>
 
-        Reviewed by Mark Rowe.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        transforms/3d tests are not run in Release builds
-        https://bugs.webkit.org/show_bug.cgi?id=29827
+        Added support for row layout with stretchy operators and
+        adjusted the over spacing for over and underover accordingly.
 
-        Make sure we export the WebCoreHas3DRendering symbol in Release builds,
-        because this symbols is used by run-webkit-tests (via 'nm') to detect whether
-        WebCore was built with ENABLE_3D_RENDERING turned on.
+        Tests: mathml/presentation/mo.xhtml
+               mathml/presentation/row.xhtml
 
-        * DerivedSources.make:
-        * WebCore.3DRendering.exp: Added.
         * WebCore.xcodeproj/project.pbxproj:
+        * mathml/MathMLInlineContainerElement.cpp:
+        * mathml/MathMLTextElement.cpp:
+        * mathml/RenderMathMLMath.cpp: Added.
+        * mathml/RenderMathMLMath.h: Added.
+        * mathml/RenderMathMLOperator.cpp: Added.
+        * mathml/RenderMathMLOperator.h: Added.
+        * mathml/RenderMathMLRow.cpp: Added.
+        * mathml/RenderMathMLRow.h: Added.
+        * mathml/RenderMathMLUnderOver.cpp:
+        * mathml/mathtags.in:
+
+2010-03-05  Dean Jackson  <dino@apple.com>
 
-2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
-
-        Build fix for QT.  Didn't know WebCore.pro existed.
-
-        * WebCore.pro:
-
-2009-09-30  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Add a method for removal of user scripts and stylesheets by URL from a specific world.
-
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::removeUserContentURLForWorld):
-        * page/PageGroup.h:
-
-2009-09-30  Chris Hawk  <hawk@chromium.org>
+        Reviewed by Simon Fraser.
 
-        Reviewed by Dimitri Glazkov.
+        https://bugs.webkit.org/show_bug.cgi?id=35772
+        Animation fill modes should be supported in the shorthand property
 
-        Fix for conditionals in the WebCore gyp file, which contained two separate
-        'conditions' values for the webcore target. The first entry was ignored,
-        resulting in some missine defines.
-        https://bugs.webkit.org/show_bug.cgi?id=29907
+        Add CSSPropertyWebkitAnimationFillMode to the list of properties
+        evaluated in the -webkit-animation shorthand.
 
-        * WebCore.gyp/WebCore.gyp:
+        Test: animations/animation-shorthand.html
 
-2009-09-21  Jeremy Orlow  <jorlow@chromium.org>
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAnimationShorthand):
 
-        Reviewed by Adam Barth.
+2010-03-05  Dean Jackson  <dino@apple.com>
 
-        DOM Storage needs to be more careful about where "ThreadSafe" objects are destroyed.
-        https://bugs.webkit.org/show_bug.cgi?id=29265
-
-        DOM Storage needs to be more careful about where "ThreadSafe" objects are
-        destroyed.  With the current code, there actually isn't a race condition, but
-        it sure would be easy for someone to introduce one.  A bunch of
-        ThreadSafeShared objects have RefPtrs to objects that are NOT ThreadSafeShared
-        objects.  If it were possible any of these objects' destructors to be fired off
-        the main thread, then the you'd have a race condition.  The code should be more
-        clear and self-documenting about how things related to each other.
-
-        Since the lifetime of a LocalStorageTask is bounded by the LocalStorageThread
-        which is bounded by the StorageSyncManager, StorageAreaImpl, and
-        StorageAreaSync, there's no reason for LocalStorageTask to store anything other
-        than pointers.  By breaking this dependency, we can eliminate the risk.
-
-        Note that we _could_ have LocalStorageThread's task queue just store
-        LocalStorageTask*'s rather than RefPtr<LocalStorageTask>s but then we'd need to
-        manually take care of deleting.  It'd probably also be possible to change
-        LocalStorageThread around so that it needn't hold onto a reference of itself
-        and have a more deterministic shutdown, but my initial attempts to do so
-        failed, and I decided it wasn't worth changing.  The queue is killed before
-        hand, so the thread is 100% impotent before the main thread continues anyway.
-
-        The constructors and destructors of StorageSyncManager, StorageAreaImpl, and
-        StorageAreaSync now have ASSERTs to verify they're running on the main thread. 
-        I'm fairly positive that it'd be impossible to hit these asserts and the fact
-        that these classes are no longer ThreadSafeShared should make it clear how
-        they're meant to be used, but I think it's worth it to be extra sure.  Of
-        course, ideally, we'd have such an assert every time a ref is incremented or
-        decremented.
-
-        Behavior should be unchanged and this is just an internal code cleanup, so no
-        new tests.
-
-        * storage/LocalStorageTask.cpp:
-        (WebCore::LocalStorageTask::LocalStorageTask):
-        (WebCore::LocalStorageTask::performTask):
-        * storage/LocalStorageTask.h:
-        (WebCore::LocalStorageTask::createImport):
-        (WebCore::LocalStorageTask::createSync):
-        (WebCore::LocalStorageTask::createTerminate):
-        * storage/LocalStorageThread.cpp:
-        (WebCore::LocalStorageThread::scheduleImport):
-        (WebCore::LocalStorageThread::scheduleSync):
-        * storage/LocalStorageThread.h:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::~StorageAreaImpl):
-        (WebCore::StorageAreaImpl::StorageAreaImpl):
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::StorageAreaSync):
-        (WebCore::StorageAreaSync::~StorageAreaSync):
-        * storage/StorageSyncManager.cpp:
-        (WebCore::StorageSyncManager::StorageSyncManager):
-        (WebCore::StorageSyncManager::~StorageSyncManager):
-        (WebCore::StorageSyncManager::scheduleImport):
-        (WebCore::StorageSyncManager::scheduleSync):
-        * storage/StorageSyncManager.h:
+        Reviewed by Simon Fraser
 
-2009-09-28  Jeremy Orlow  <jorlow@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=35815
+        Animation Fill Modes fail on Windows
 
-        Reviewed by Darin Fisher.
+        * css/CSSComputedStyleDeclaration.cpp:
+        * css/CSSStyleSelector.cpp:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+            - use new enum value
+        * platform/animation/Animation.h:
+            - change bitfield type
+        * rendering/style/RenderStyleConstants.h:
+            - add new enum for fill mode
 
-        Chromium needs to be able to override the way storage events are delivered
-        https://bugs.webkit.org/show_bug.cgi?id=29655
+2010-03-05  Csaba Osztrogonác  <ossy@webkit.org>
 
-        Chromium needs to be able to override the way storage events are delivered.
-        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
-        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
-        injection).  This is necessary because Chromium needs to transport events across
-        a process barrier and then dispatch them without use of a Frame*.
+        Unreviewed buildfix after r55593. (To fix Qt --minimal build.)
 
-        Behavior should not change with this, so no updates to tests.
+        * bindings/js/JSDOMWindowCustom.cpp: Missing #if ENABLE(DATABASE) guard added.
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::setItem):
-        (WebCore::StorageAreaImpl::removeItem):
-        (WebCore::StorageAreaImpl::clear):
-        * storage/StorageAreaImpl.h:
-        * storage/StorageEventDispatcher.cpp: Copied from WebCore/storage/StorageAreaImpl.cpp.
-        (WebCore::StorageEventDispatcher::dispatch):
-        * storage/StorageEventDispatcher.h: Added.  (Well, technically in the other half of this patch.)
-
-2009-09-30  Jian Li  <jianli@chromium.org>
+2010-03-05  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Darin Adler.
 
-        Need to check NULL frame in EventHandler::updateDragAndDrop.
-        https://bugs.webkit.org/show_bug.cgi?id=29929
-
-        Test: http/tests/misc/drag-over-iframe-invalid-source-crash.html
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::updateDragAndDrop):
-
-2009-09-29  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        ASSERTION FAILED: !repaintContainer || repaintContainer == this
-        https://bugs.webkit.org/show_bug.cgi?id=29755
-        
-        Generalize the fix for this bug to account for cases where there may be multiple
-        containing blocks between the repaint container, and the container of the element
-        being repainted.
-
-        Test: compositing/repaint/opacity-between-absolute2.html
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::mapLocalToContainer):
-        Call offsetFromAncestorContainer() to get the correct offset.
+        ASSERTION FAILED: rootLayer == m_clipRectsRoot at hulu.com
+        https://bugs.webkit.org/show_bug.cgi?id=34065
+        <rdar://problem/7573509>
         
-        (WebCore::RenderBox::computeRectForRepaint): Ditto
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::computeRectForRepaint): Ditto.
+        Fix one instance of this assertion (not necessarily the one seen on hulu.com).
         
-        * rendering/RenderObject.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::offsetFromAncestorContainer):
-        New method that computes an offset from some object in the ancestor container() chain.
-
-2009-09-30  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
-
-        Reviewed by Simon Hausmann.
+        If the layer that clippingRoot() is being called on is itself compositing,
+        then it acts as the clipping root. Without this, calls to RenderLayer::childrenClipRect()
+        and RenderLayer::selfClipRect() via FrameView::windowClipRectForLayer(), for plug-ins,
+        caused the caching of an incorrect clip rects root.
 
-        [Qt] Fix TextCodecQt::decode method after r48752 to return a non-null string if the length of the input is 0.
-        This fixes https://bugs.webkit.org/show_bug.cgi?id=29736.
+        Test: compositing/geometry/object-clip-rects-assertion.html
 
-        * platform/text/qt/TextCodecQt.cpp:
-        (WebCore::TextCodecQt::decode):
-
-2009-09-29  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Jon Honeycutt.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::clippingRoot):
 
-        Fix a couple of bugs with patterns.  Move the setting of the document URL to before the style
-        selector gets constructed so that pattern match testing gets the correct URL.
+2010-03-05  Simon Fraser  <simon.fraser@apple.com>
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-        * page/UserContentURLPattern.cpp:
-        (WebCore::UserContentURLPattern::parse):
+        Reviewed by Dan Bernstein.
 
-2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+        Child clipping compositing layers don't show the blue debug color
+        https://bugs.webkit.org/show_bug.cgi?id=35807
 
-        Rubber-stamped by Brady Eidson.
+        Set a layer owner on the GraphicsLayers created for clipping children,
+        so that they can get to the debug settings that give them the blue color.
 
-        Assertion failure in http/tests/xmlhttprequest/failed-auth.html.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateClippingLayers):
 
-        I couldn't find out why this only started to happen now, but it was incorrect to check
-        persistence of a credential returned by CredentialStorage::get() without checking that it
-        was non-null. When there is no credential for the protection space in storage, get()
-        returns a new object, and Credentil constructor doesn't initialize m_persistence.
+2010-03-05  Simon Fraser  <simon.fraser@apple.com>
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Moved the
-        assertion after credential null check.
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Added the same persistence
-        assertion, matching sync code (and CF one, as well).
+        Reviewed by Dan Bernstein.
 
-2009-09-29  Yong Li  <yong.li@torchmobile.com>
+        MobileMe movie page is missing playback controls
+        https://bugs.webkit.org/show_bug.cgi?id=35805
+        <rdar://problem/7653169>
+        
+        On pages with video or plug-ins, we run overlap tests to determine which layers
+        need to be composited. There was an ordering dependency bug in
+        RenderLayerCompositor::computeCompositingRequirements() that caused us to fail
+        to detect that a layer needed to be composited, resulting in page content
+        not being visible.
+        
+        Specifically, layer->setHasCompositingDescendant() can change the answer
+        to needsToBeComposited(), when a layer has to clip compositing descendants.
+        So if we change setHasCompositingDescendant(), then we need to re-test
+        clipsCompositingDescendants() and add the layer to the overlap map if so.
 
-        Reviewed by Darin Adler.
+        Test: compositing/overflow/overflow-compositing-descendant.html
 
-        Add an ASSERT for UTF8Encoding().isValid()
-        https://bugs.webkit.org/show_bug.cgi?id=29908
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
 
-        * platform/text/TextEncoding.cpp:
-        (WebCore::UTF8Encoding):
+2010-03-04  Dumitru Daniliuc  <dumi@chromium.org>
 
-2009-09-29  Dave Hyatt  <hyatt@apple.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Jon Honeycutt.
+        Adding support for the optional creation callback that could be
+        passed to openDatabase().
 
-        https://bugs.webkit.org/show_bug.cgi?id=29892
-        Add support for whitelist patterns to control conditional injection of user scripts and
-        user stylesheets.
+        Test: storage/open-database-creation-callback.html
 
-        No new tests. Not testable until WebKit portion is added in followup patch.
+        https://bugs.webkit.org/show_bug.cgi?id=34726
 
+        * Android.jscbindings.mk
+        * Android.v8bindings.mk
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * dom/Document.cpp:
-        (WebCore::Document::pageGroupUserSheets):
-        * page/Frame.cpp:
-        (WebCore::Frame::injectUserScriptsForWorld):
-        * page/UserContentURLPattern.cpp: Added.
-        (WebCore::UserContentURLPattern::matchesPatterns):
-        (WebCore::UserContentURLPattern::parse):
-        (WebCore::UserContentURLPattern::matches):
-        (WebCore::UserContentURLPattern::matchesHost):
-        (WebCore::MatchTester::MatchTester):
-        (WebCore::MatchTester::testStringFinished):
-        (WebCore::MatchTester::patternStringFinished):
-        (WebCore::MatchTester::eatWildcard):
-        (WebCore::MatchTester::eatSameChars):
-        (WebCore::MatchTester::test):
-        (WebCore::UserContentURLPattern::matchesPath):
-        * page/UserContentURLPattern.h: Added.
-        (WebCore::UserContentURLPattern::UserContentURLPattern):
-        (WebCore::UserContentURLPattern::scheme):
-        (WebCore::UserContentURLPattern::host):
-        (WebCore::UserContentURLPattern::path):
-        (WebCore::UserContentURLPattern::matchSubdomains):
-
-2009-09-29  Enrica Casucci  <enrica@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Reproducible crash pressing return inside quoted content
-        at WebCore::BreakBlockquoteCommand::doApply.
-        <rdar://problem/7085453>
-        In some case, like the one provided in the test case, m_downStreamEnd
-        refers to a node that gets deleted when executing the DeleteSelectionCommand.
-        We shouldn't use m_downStreamEnd to recalculate the new m_endPosition when
-        pruning is needed, because it may be point to a node that has been deleted, but
-        rather rely on removeNode in CompositeEditCommand to update m_endPosition correctly.
-
-        Test: editing/selection/blockquote-crash.html
-
-        * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply): Added check for invalid position
-        to avoid dereferencing a null node pointer.
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::DeleteSelectionCommand::mergeParagraphs): Don't reset m_endPosition
-        using the value in m_downStreamEnd when it is necessary to prune the start block.
-        
-2009-09-29  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        Basic authentication credentials are not sent automatically to top resources
-        https://bugs.webkit.org/show_bug.cgi?id=29901
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::openDatabase):
+        * bindings/js/JSDatabaseCallback.cpp: Added.
+        (WebCore::JSDatabaseCallback::JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::~JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::handleEvent):
+        * bindings/js/JSDatabaseCallback.h: Added.
+        (WebCore::JSDatabaseCallback::create):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::openDatabaseCallback):
+        * bindings/v8/custom/V8DatabaseCallback.cpp: Added.
+        (WebCore::V8DatabaseCallback::V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::~V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::handleEvent):
+        * bindings/v8/custom/V8DatabaseCallback.h: Added.
+        (WebCore::V8DatabaseCallback::create):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::openDatabase):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * storage/Database.cpp:
+        (WebCore::DatabaseCreationCallbackTask::create):
+        (WebCore::DatabaseCreationCallbackTask::performTask):
+        (WebCore::DatabaseCreationCallbackTask::DatabaseCreationCallbackTask):
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+        (WebCore::Database::performCreationCallback):
+        * storage/Database.h:
+        (WebCore::Database::isNew):
+        * storage/DatabaseCallback.h: Added.
+        (WebCore::DatabaseCallback::~DatabaseCallback):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        * workers/WorkerContext.h:
 
-        No new tests - I don't want to pollute root directory of http tests to check for this rather
-        minor issue.
+2010-03-05  Chris Marrin  <cmarrin@apple.com>
 
-        * platform/network/CredentialStorage.cpp:
-        (WebCore::CredentialStorage::set): Changed to always preserve leading slash.
-        (WebCore::CredentialStorage::getDefaultAuthenticationCredential): Made breaking out of the
-        loop more explicit.
+        Reviewed by Simon Fraser.
 
-2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+        Fixed infinite recursion of composited video on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=35798
+        
+        Due to a change in the way we get the platformLayer (WKCACFLayer)
+        for video, the mediaplayer was in an infinite loop with WKCACFLayer
+        bouncing notifySyncRequired calls back and forth. After discussion
+        we decided it would be better to avoid notifySyncRequired entirely,
+        which would walk up through WebCore calls and back down through
+        WebKit calls to tell the WKCACFLayerRenderer to kick off a render cycle.
+        
+        I subclassed WKCACFLayer into a WKCACFRootLayer which has a pointer to
+        the WKCACFLayerRenderer. When something changes, we get the rootLayer()
+        by walking up the layers and make a virtual call which WKCACFRootLayer
+        implements to tell WKCACFLayerRenderer to render.
+        
+        I also got rid of GraphicsLayer knowledge from WKCACFLayer. GraphicsLayerCACF
+        now makes a WebLayer subclass which implements the drawInContext()
+        virtual method.
+        
+        I also had to add protection to the platformLayer() call in 
+        MediaPlayerPrivateQuickTimeWin because it gets called earlier than before
+        when the layer is still null.
+
+        * platform/graphics/win/GraphicsLayerCACF.cpp:Implement WebLayer
+        (WebCore::WebLayer::create):
+        (WebCore::WebLayer::drawInContext):
+        (WebCore::WebLayer::WebLayer):
+        (WebCore::GraphicsLayerCACF::GraphicsLayerCACF):
+        (WebCore::GraphicsLayerCACF::setNeedsDisplayInRect):
+        (WebCore::GraphicsLayerCACF::updateLayerPreserves3D):
+        (WebCore::GraphicsLayerCACF::updateContentsImage):
+        * platform/graphics/win/GraphicsLayerCACF.h:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:Protect platformLayer from a null qtLayer
+        (WebCore::MediaPlayerPrivate::platformLayer):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:Got rid of no longer needed method
+        (WebCore::MediaPlayerPrivate::notifyAnimationStarted):
+        * platform/graphics/win/WKCACFLayer.cpp:Got rid of GraphicsLayer dependency. Made virtual.
+        (WebCore::displayCallback):
+        (WebCore::WKCACFLayer::create):
+        (WebCore::WKCACFLayer::WKCACFLayer):
+        (WebCore::WKCACFLayer::setNeedsCommit):
+        (WebCore::WKCACFLayer::setNeedsDisplay):
+        * platform/graphics/win/WKCACFLayer.h:
+        (WebCore::WKCACFLayer::setNeedsRender):
+        (WebCore::WKCACFLayer::drawInContext):
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:Create WKCACFRootLayer which tells WKCACFLayerRenderer to render
+        (WebCore::WKCACFRootLayer::WKCACFRootLayer):
+        (WebCore::WKCACFRootLayer::create):
+        (WebCore::WKCACFRootLayer::setNeedsRender):
+        (WebCore::WKCACFRootLayer::setNeedsDisplay):
+        (WebCore::WKCACFLayerRenderer::rootLayer):
+        (WebCore::WKCACFLayerRenderer::setRootChildLayer):
+        (WebCore::WKCACFLayerRenderer::setNeedsDisplay):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+
+2010-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by David Levin.
 
-        Web Inspector REGRESSION(r47820-r47822): Profiles aren't
-        added to the inspector unless the inspector is already open
-        when the profile completes.
+        [Chromium] Missing commas in WebCore.gypi file make building Geo unpossible.
+        https://bugs.webkit.org/show_bug.cgi?id=35797
 
-        https://bugs.webkit.org/show_bug.cgi?id=29897
+        No new tests, this is a latent compile break.
 
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype._populateProfiles):
+        * WebCore.gypi:
 
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+2010-03-04  Eric Carlson  <eric.carlson@apple.com>
 
-        Rubberstamped by David Hyatt.
+        Reviewed by Adele Peterson.
 
-        Fix to logic of earlier commit 48902.
+        <rdar://problem/7718442> Implement 'preload=none'
+        https://bugs.webkit.org/show_bug.cgi?id=35789
 
-        When merging two if's before committing, I forgot to invert the
-        bool check.
+        Don't load any media data when preload is 'none'.
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::ignoreHttpError):
+        Test: media/video-preload.html
 
-2009-09-29  Stephen White  <senorblanco@chromium.org>
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): Don't call player's setPreload method
+            when autoplay is set.
 
-        Unreviewed, build fix.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::setPreload): Set m_preload so we have the correct value when
+            the media engine is created.
 
-        Fixing Chromium build, following r48884.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_preload.
+        (WebCore::MediaPlayerPrivate::resumeLoad): New, kick off postponed a load.
+        (WebCore::MediaPlayerPrivate::load): Do nothing if preload is 'none'
+        (WebCore::MediaPlayerPrivate::loadInternal): New, complete loading.
+        (WebCore::MediaPlayerPrivate::prepareToPlay): New, resume a postponed load as someone
+            has called play().
+        (WebCore::MediaPlayerPrivate::setPreload): New, set m_preload.
 
-        [https://bugs.webkit.org/show_bug.cgi?id=29894]
+2010-03-04  Nate Chapin  <japhet@chromium.org>
 
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::handleEvent):
-        * bindings/v8/V8AbstractEventListener.h:
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::handleEvent):
-        * bindings/v8/V8WorkerContextEventListener.h:
-
-2009-09-29  Kent Tamura  <tkent@chromium.org>
+        Reviewed by Dimitri Glazkov.
 
-        Reviewed by Darin Adler.
+        [V8] Give CodeGeneratorV8.pm a much-needed spring cleaning.
 
-        Follows HTML5's maxLength change in September 2009.
-        - Change HTMLTextAreaElement.maxLength type to signed.
-        - HTMLTextAreaElement.maxLength returns -1 if maxlength= attribute is missing.
-        - HTMLTextAreaElement.maxLength and HTMLInputElement.maxLength
-          throw INDEX_SIZE_ERR for setting negative values.
-        https://bugs.webkit.org/show_bug.cgi?id=29796
+        https://bugs.webkit.org/show_bug.cgi?id=35697
 
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setMaxLength):
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
-        (WebCore::HTMLTextAreaElement::maxLength):
-        (WebCore::HTMLTextAreaElement::setMaxLength):
-        * html/HTMLTextAreaElement.h:
-        * html/HTMLTextAreaElement.idl:
+        * bindings/scripts/CodeGeneratorV8.pm: Remove unused code, fix style issues, make less hard-coded.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::addEventListenerCallback):
+        (WebCore::V8DOMWindow::removeEventListenerCallback):
 
-2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-03-05  Pavel Feldman  <pfeldman@chromium.org>
 
-        No review, rolling out r48894, because review discussion was not complete.
-        http://trac.webkit.org/changeset/48894
+        Not reviewed. Roll back r55522 since it regreses performance
+        according to chromium's page cycler.
 
-        * platform/sql/SQLiteTransaction.cpp:
-        (WebCore::SQLiteTransaction::begin):
+        https://bugs.webkit.org/show_bug.cgi?id=35568
 
-2009-09-29  Dirk Schulze  <krit@webkit.org>
+2010-03-05  Dean Jackson  <dino@apple.com>
 
-        Reviewed by Nikolas Zimmermann.
+        Reviewed by Simon Fraser and Chris Marrin.
 
-        SVG Filter feComposite implementation is missing
-        [https://bugs.webkit.org/show_bug.cgi?id=28362]
+        Bug 26869: Add fill modes for CSS Animations
+        https://bugs.webkit.org/show_bug.cgi?id=26869
 
-        feComposite implementation for SVG.
+        Tests: animations/fill-mode-removed.html
+               animations/fill-mode-transform.html
+               animations/fill-mode.html
 
-        Test: svg/filters/feComposite.svg
+        * css/CSSComputedStyleDeclaration.cpp:
+        * css/CSSParser.cpp:
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        * css/CSSStyleSelector.h:
+        * css/CSSValueKeywords.in:
+            - parse, assign and retrieve the value of the new
+              -webkit-animation-fill-mode property
+        * page/animation/AnimationBase.cpp:
+        * page/animation/AnimationBase.h:
+            - new state in animation engine for a finished animation
+              that is "filling" forwards in time. This allows the
+              engine to keep the animation around and not revert to the
+              old style.
+            - update the timer code to indicate it doesn't need to
+              keep animating if it is filling
+            - now that animations can extend beyond their elapsed time,
+              make sure progress works correctly with iteration counts
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate):
+            - ensure correct style value is returned at the right
+              time by checking for fill mode
+        (WebCore::KeyframeAnimation::onAnimationEnd):
+            - continue to send the end event, but only remove the
+              animation if it isn't filling forwards
+        * platform/animation/Animation.cpp:
+        * platform/animation/Animation.h:
+            - new fill mode member property
+        * platform/animation/AnimationList.cpp:
+            - ensure the fill mode is propagated to a list of style valus
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+            - make hardware layers use Core Animation's fill mode
 
-        * platform/graphics/filters/FEComposite.cpp:
-        (WebCore::arithmetic):
-        (WebCore::FEComposite::apply):
+2010-03-05  Ilya Tikhonovsky  <loislo@chromium.org>
 
-2009-09-29  Dumitru Daniliuc  <dumi@chromium.org>
+        Reviewed by Pavel Feldman.
 
-        Reviewed by Dimitri Glazkov.
+        Web Inspector: Do not show link helper in popovers and/or for external resources.
 
-        Starting all read-only transactions with an explicit BEGIN
-        DEFERRED command instead of BEGIN, since some ports (chromium)
-        might compile their own SQLite library and set BEGIN to BEGIN
-        IMMEDIATE by default; which would result in a deadlock in case of
-        two concurrent read-only transactions on the same DB, and would
-        unnecessarily delay other potential transactions to the same DB.
+        https://bugs.webkit.org/show_bug.cgi?id=35785
 
-        https://bugs.webkit.org/show_bug.cgi?id=29729
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.canShowSourceLine):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._scriptOrResourceForURLAndLine):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.hide):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentMouseOver):
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.addMainEventListeners):
 
-        * platform/sql/SQLiteTransaction.cpp:
-        (WebCore::SQLiteTransaction::begin):
+2010-03-05  Fumitoshi Ukai  <ukai@chromium.org>
 
-2009-09-29  Kenneth Russell  <kbr@google.com>
+        Reviewed by Alexey Proskuryakov.
 
-        Reviewed by Dimitri Glazkov.
+        WebSocket onmessageerror event handler
+        https://bugs.webkit.org/show_bug.cgi?id=35570
 
-        Add support for run-time flag for 3D canvas
-        https://bugs.webkit.org/show_bug.cgi?id=29826
+        Test: websocket/tests/error-detect.html
 
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext): Check page settings for
-        experimental WebGL flag before returning 3D graphics context.
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings): Initialize new flag to false.
-        (WebCore::Settings::setExperimentalWebGLEnabled):
-        * page/Settings.h: Set new flag.
-        (WebCore::Settings::experimentalWebGLEnabled): Return new flag.
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocketChannel::didConnect): assert scriptExecutionContext.
+        (WebCore::WebSocketChannel::didReceiveMessage): assert scriptExecutionContext.
+        (WebCore::WebSocket::didReceiveMessageError):
+        (WebCore::WebSocket::didClose): assert scriptExecutionContext.
+        * websockets/WebSocket.h:
+        * websockets/WebSocket.idl: Add onerror event listener
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData): call didReceiveMessageError if unknown frame tye is detected, or frame length overflowed.
+        * websockets/WebSocketChannelClient.h:
+        (WebCore::WebSocketChannelClient::didReceiveMessageError):
 
-2009-09-29  Jeremy Orlow  <jorlow@chromium.org>
+2010-03-04  Garret Kelly  <gdk@chromium.org>
 
         Reviewed by Darin Fisher.
 
-        Chromium needs to be able to override the way storage events are delivered - part 1
-        https://bugs.webkit.org/show_bug.cgi?id=29889
-
-        Chromium needs to be able to override the way storage events are delivered.
-        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
-        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
-        injection).  This is necessary because Chromium needs to transport events across
-        a process barrier and then dispatch them without use of a Frame*.
+        Changing private members from PlatformTouchEvent and PlatformTouchPoint
+        to be protected, so that Chromium's PlatformTouchEventBuilder and
+        PlatformTouchPointBuilder can access them. Exercised by the
+        fast/events/touch tests.
+        https://bugs.webkit.org/show_bug.cgi?id=35760
 
-        This patch should be a no-op for all ports other than Chromium.
+        * platform/PlatformTouchEvent.h:
+        (WebCore::PlatformTouchEvent::~PlatformTouchEvent):
+        * platform/PlatformTouchPoint.h:
+        (WebCore::PlatformTouchPoint::~PlatformTouchPoint):
 
-        * WebCore.gypi:
-        * storage/StorageEventDispatcher.h: Added.
+2010-03-04  Fumitoshi Ukai  <ukai@chromium.org>
 
-2009-09-29  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (missed file).
+        Reviewed by Alexey Proskuryakov.
 
-        Adding file missed in previous commit.
+        WebSocket crash bug when reloading the page while the WebSocket is busy
+        https://bugs.webkit.org/show_bug.cgi?id=35732
 
-        * manual-tests/gtk/resources/long_cell.cur: Copied from WebCore/dom/PositionCreationFunctions.h.
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::disconnect): clear m_context from WebSocketChannel and WebSocketHandshake.
+        (WebCore::WebSocketChannel::didOpen): check m_context
+        (WebCore::WebSocketChannel::didClose): clear m_context
+        (WebCore::WebSocketChannel::didReceiveData): check m_context, and check m_client early before appending to buffer
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::clearScriptExecutionContext): Added.
+        * websockets/WebSocketHandshake.h:
 
-2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-03-04  MORITA Hajime <morrita@google.com>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Alexey Proskuryakov.
 
-        [V8] Correct an issue with XMLHttpRequest attribute event listeners never being cleared.
-        https://bugs.webkit.org/show_bug.cgi?id=29888
+        Refactoring: XMLHTTPRequest.open() should have all overloaded implementations
+        https://bugs.webkit.org/show_bug.cgi?id=35630
 
-        Test: LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-abort-readyState-shouldDispatchEvent.html
+        Test: http/tests/xmlhttprequest/open-async-overload.html
 
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::open):
         * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::getEventListener): Added isAttribute parameter.
-        (WebCore::ACCESSOR_SETTER): Made all event listener setters create attribute listeners.
-        (WebCore::CALLBACK_FUNC_DECL): Made addEventListener create object listener.
+        (WebCore::V8XMLHttpRequest::openCallback):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::open):
+        * xml/XMLHttpRequest.h:
 
-2009-09-22  Martin Robinson  <martin.james.robinson@gmail.com>
+2010-03-04  James Robinson  <jamesr@google.com>
 
         Reviewed by Eric Seidel.
 
-        Fix corruption for non-square images.
+        Styles do not have to be synchronously rematched after every event dispatch
 
-        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
-        https://bugs.webkit.org/show_bug.cgi?id=29654
+        https://bugs.webkit.org/show_bug.cgi?id=32580
 
-        Added an additional manual-test for this issue to the existing Gtk
-        cursor image test.
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent):
 
-        * manual-tests/gtk/cursor-image.html:
-        * manual-tests/gtk/resources/long_cell.cur: Added.
-        * platform/graphics/gtk/ImageGtk.cpp:
-        (WebCore::BitmapImage::getGdkPixbuf):
+2010-03-04  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Timothy Hatcher.
+        maemo spelled as mameo in WebCore.pro
+        https://bugs.webkit.org/show_bug.cgi?id=35765
 
-        Build fix - pass a proper ScriptExecutipnContext to getEventListenerHandlerBody()
+        Spelling corrected.
 
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::getEventListenerHandlerBody):
-        * bindings/js/ScriptEventListener.h:
-        * bindings/v8/ScriptEventListener.cpp:
-        (WebCore::getEventListenerHandlerBody):
-        * bindings/v8/ScriptEventListener.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+        * WebCore.pro:
 
-2009-09-29  Nate Chapin  <japhet@chromium.org>
+2010-03-04  Tony Chang  <tony@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        Ensure that we don't scroll lock to an anchor node after a
-        user-initiated scroll, even if that scroll doesn't propagate
-        all the way up to FrameView.
-
-        Test: fast/events/node-event-anchor-lock.html
-
-        * page/EventHandler.cpp: Call setFrameWasScrolledByUser() when a scroll is handled by a node rather than a frame.
-        (WebCore::EventHandler::scrollOverflow):
-        (WebCore::EventHandler::handleWheelEvent):
-        (WebCore::EventHandler::sendScrollEvent): Use setFrameWasScrolledByUser();
-        (WebCore::EventHandler::setFrameWasScrolledByUser): Split out of sendScrollEvent();
-        (WebCore::EventHandler::passMousePressEventToScrollbar):
-        * page/EventHandler.h: Declare setFrameWasScrolledByUser().
-
-2009-09-28  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Darin Adler and Sam Weinig.
-
-        Onclick not fired for an element copied with cloneContents() or cloneNode()
-        https://bugs.webkit.org/show_bug.cgi?id=25130
-
-        The change here is that JS event listeners don't keep a reference to a global object from
-        where they were created, and instead take it as a parameter when parsing source code. Also,
-        the listener creation won't fail just because it happens for an element in a frameless
-        document.
-        Thus, moving nodes between documents no longer results in having incorrect registered
-        lazy event listeners on them.
+        https://bugs.webkit.org/show_bug.cgi?id=18819
+        Pressing option+page{down,up} should move the cursor and scroll in
+        content editable areas.  On other platforms, pressing page{down,up}
+        should move the cursor and scroll in content editable areas.
 
-        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
-               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
-               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
-               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
-               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
+        Test: editing/input/option-page-up-down.html
 
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
-        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
-        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
-        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
-        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
-        (WebCore::JSEventListener::reportError): Ditto.
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance):
 
-        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
-        to JSDOMGlobalObject.
+2010-03-03  Oliver Hunt  <oliver@apple.com>
 
-        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
-        creation was split between this function and ScriptEventListener; moved it here, as JS
-        global object can be different now.
+        Reviewed by Gavin Barraclough.
 
-        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
-        which can not be determined at parsing time.
+        Allow static property getters to interact with JSCs caching
+        https://bugs.webkit.org/show_bug.cgi?id=35716
 
-        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
-        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
-        expect that errors are logged at document parsing time, and because I don't know what other
-        side effects moving it vould have.
+        Update the obviously safe getters to allow caching
 
-        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
-        because JSC needs a global context here.
+        Test: fast/js/pic/cached-named-property-getter.html
 
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/objc/ObjCEventListener.h:
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::handleEvent):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::fireEventListeners):
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * inspector/InspectorDOMStorageResource.h:
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::handleEvent):
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::handleEvent):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
-        Don't pass global object to JSEventListener::create(), which no longer needs it.
-        Note that some of these functions still have an early return for null global object, which
-        can probably be removed in a later patch.
-        Pass ScriptExecutionContext to EventListener methods that now need it.
-
-        * bindings/scripts/CodeGeneratorCOM.pm: Don't force EventTarget implementation on Node -
-        it doesn't work yet (it didn't quite work before this patch, too, because it assumed that
-        any object implementing EventTarget COM interface originated from WebCore).
-
-        * dom/EventListener.idl: Just like in ObjC, EventListener should be a pure interface in
-        COM bindings.
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertySlot):
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::getOwnPropertySlot):
 
-2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+2010-03-04  Mark Rowe  <mrowe@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Removed virtual destructor from JSGlobalObjectData to eliminate pointer
-        fix-ups when accessing JSGlobalObject::d.
-        
-        Replaced with an explicit destructor function pointer.
+        <rdar://problem/7717249> DOMSVG.h includes a non-existent DOMSVGFEMorphologyElement.h
 
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::destroyJSDOMGlobalObjectData):
-        * bindings/js/JSDOMGlobalObject.h:
-        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        * WebCore.xcodeproj/project.pbxproj: Copy DOMSVGFEMorphologyElement.h and DOMSVGFEMorphologyElementInternal.h
+        in to the framework wrapper.
 
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+2010-03-04  James Robinson  <jamesr@chromium.org>
 
-        Reviewed by Simon Hausmann.
-
-        Don't rely on QNetworkReply::NetworkError codes, but
-        on HTTP error codes instead.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::ignoreHttpError):
-        (WebCore::QNetworkReplyHandler::finish):
-
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Use const references when using Qt's foreach.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Fix handling of QNetworkReply errors.
-
-        In the QNetworkReplyHandler::finish() a response was sent even when
-        the reply contained an error. This resulted in a sendResponseIfNeeded()
-        calling didReceiveResponse on the client, leading to the destruction
-        of the m_resourceHandle, discontinuing further processing in finish(),
-        and thus not calling didFail on the client.
-
-        Instead it continued as everything went fine, and
-        FrameLoaderClientQt::dispatchDecidePolicyForMIMEType() changed the
-        policy to PolicyDownload due to not being able to show the non existing
-        MIMEType. As the download also obviously fails, it ended up with a
-        policy change error.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
-
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        The code for showing error pages when the response was
-        a 401/403/404, was not actually doing so. This patch
-        fixes that.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
-
-2009-09-28  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        <rdar://problem/7259965> REGRESSION: http/tests/xmlhttprequest/cross-origin-authorization.html
-        is failing/crashing intermittently
-        https://bugs.webkit.org/show_bug.cgi?id=29322
-
-        This was caused by CStringBuffer::encodeBase64() returning a buffer that wasn't zero terminated.
-        The code had other issues as well, so I removed it altogether:
-        - it claimed to avoid some buffer copies, but it didn't;
-        - and I don't think that base64 encoding should be part of CString interface.
-
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::encodeBasicAuthorization): Encode username and password using Base64.h directly.
-        (WebCore::ResourceHandle::start): Use encodeBasicAuthorization().
-        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]): Ditto.
-        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Extended logging
-        to synchronous case.
-        (-[WebCoreSynchronousLoader connectionShouldUseCredentialStorage:]): Ditto.
-        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Ditto.
-        (-[WebCoreSynchronousLoader connection:didReceiveResponse:]): Ditto.
-        (-[WebCoreSynchronousLoader connection:didReceiveData:]): Ditto.
-        (-[WebCoreSynchronousLoader connectionDidFinishLoading:]): Ditto.
-        (-[WebCoreSynchronousLoader connection:didFailWithError:]): Ditto.
-
-        * platform/network/cf/ResourceHandleCFNet.cpp: Matched Mac changes.
-
-        * platform/text/CString.cpp:
-        * platform/text/CString.h:
-        (WebCore::CStringBuffer::create):
-        (WebCore::CStringBuffer::CStringBuffer):
-        Removed code that was added for Base64 in r48363.
-
-2009-09-29  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix typo in Localizations.cpp
-
-        https://bugs.webkit.org/show_bug.cgi?id=29872
-
-        * platform/qt/Localizations.cpp:
-        (WebCore::localizedMediaControlElementHelpText):
-
-2009-09-29  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Make the XSLT conditional in DOMWindow.idl's xsltProcessor
-        attribute conditional in the generated files, similar to
-        r44116.
-
-        * page/DOMWindow.idl:
-
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Reviewed by Dimitri Glazkov.
 
-        Reviewed by Simon Hausmann and Tor Arne Vestbø.
+        Handles setting HTMLSelectElement.length with mutation handlers present
+        https://bugs.webkit.org/show_bug.cgi?id=33983
 
-        Use the ResourceError as it is supposed to and handle
-        not HTTP errors from QNetworkReply.
+        When setting an HTMLSelectElement's length attribute, option elements have to be added or removed to the select
+        as appropriate.  This is a little tricky with mutation events since they might add, remove, or reorder elements
+        while option elements are being added or deleted.
 
-        Thanks to Adam Roben for his input.
+        Tests: fast/forms/select-set-length-optgroup.html
+               fast/forms/select-set-length-with-mutation-remove.html
+               fast/forms/select-set-length-with-mutation-reorder.html
+               fast/forms/select-set-length-with-mutation-reparent.html
+               fast/forms/select-set-length-with-mutation.html
+               fast/forms/select-set-length.html
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setLength):
 
-2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-04  Csaba Osztrogonác  <ossy@webkit.org>
 
-        Reviewed by Timothy Hatcher.
+        [Qt] Unreviewed buildfix after r55542 on Windows.
 
-        Web Inspector: Encapsulate JS listeners specifics into ScriptEventListener.
+        * WebCore.pro:
+         - plugins/win/PluginDatabaseWin.cpp removed.
+         - platform/win/WebCoreInstanceHandle.cpp added.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29816
+        * platform/win/WebCoreInstanceHandle.cpp: Remove explicit qualification in namespace declaration to make gcc happy.
 
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::getEventListenerHandlerBody):
-        * bindings/js/ScriptEventListener.h:
-        * bindings/v8/ScriptEventListener.cpp:
-        (WebCore::getEventListenerHandlerBody):
-        * bindings/v8/ScriptEventListener.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+2010-03-04  Nate Chapin  <japhet@chromium.org>
 
-2009-09-29  Xan Lopez  <xlopez@igalia.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Unreviewed attempt to fix the build.
+        Fix the case where we do a same document navigation, scroll,
+        then repeat the same document navigation.  Currently, the second
+        navigation does nothing.
 
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
+        https://bugs.webkit.org/show_bug.cgi?id=35547
 
-2009-09-28  Fumitoshi Ukai  <ukai@chromium.org>
+        Test: fast/loader/repeat-same-document-navigation.html
 
-        Reviewed by Eric Seidel.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadInSameDocument): Call scrollToFragment() whether or not the hash changed.
 
-        Add experimentalWebSocketsEnabled in Settings.
-        https://bugs.webkit.org/show_bug.cgi?id=28941
+2010-03-04  Simon Fraser  <simon.fraser@apple.com>
 
-        * WebCore.base.exp:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::webSocket):
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getConstructor):
-        * bindings/v8/custom/V8WebSocketCustom.cpp:
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setExperimentalWebSocketsEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::experimentalWebSocketsEnabled):
+        Build fix.
         
-2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Add platform code to support WebSocket for chromium.
-        https://bugs.webkit.org/show_bug.cgi?id=29171
+        const long long cMaxDistance = numeric_limits<long long>::max() created global
+        initializers at the call sites, so replace with an inline function.
 
-        To build within chromium tree, it requires a patch in bug 29174.
-        Real implementation will be landed in chromium tree.
-
-        * WebCore.gypi:
-        * platform/network/chromium/SocketStreamError.h: Added.
-        (WebCore::SocketStreamError::SocketStreamError):
-        * platform/network/chromium/SocketStreamHandle.h: Added.
-        (WebCore::SocketStreamHandle::create):
-
-2009-09-28  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        <rdar://problem/7157288> Crash in RenderStyle::computedLineHeight()
-        when Times New Roman is not installed
-
-        * platform/graphics/win/FontCacheWin.cpp:
-        (WebCore::FontCache::getLastResortFallbackFont): If Times New Roman is
-        not available, use the Windows default GUI font.
-
-2009-09-28  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        Do not add platform-specific methods to cross-platform header
-        FileSystem.h per Darin's feedback for 29109.
-        https://bugs.webkit.org/show_bug.cgi?id=29830
+        * page/FocusController.cpp:
+        (WebCore::updateFocusCandidateIfCloser):
+        * page/SpatialNavigation.cpp:
+        (WebCore::distanceInDirection):
+        * page/SpatialNavigation.h:
+        (WebCore::maxDistance):
+        (WebCore::FocusCandidate::FocusCandidate):
 
-        * platform/FileSystem.h:
-        * platform/chromium/DragDataChromium.cpp:
-        (WebCore::DragData::asURL):
-        * platform/chromium/FileSystemChromium.cpp:
+2010-03-04  Antonio Gomes  <tonikitoo@webkit.org>
 
-2009-09-28  Dumitru Daniliuc  <dumi@chromium.org>
+        Unreviewed attempt to fix Windows build.
 
-        Reviewed by Dimitri Glazkov.
+        * page/SpatialNavigation.cpp:
+        (WebCore::spatialDistance):
 
-        Register Chromium's VFSs with a proper sqlite3_io_methods
-        finder. This should only affect the POSIX implementation. The
-        Windows change is included for consistency and in case sqlite
-        starts using something similar in its Windows VFS in the future.
+2010-03-04  Simon Fraser  <simon.fraser@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29743
+        Build fix.
 
-        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
-        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
-        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+        Delcare updateFocusCandidateIfCloser static to avoid warning.
 
-2009-09-28  Nate Chapin  <japhet@chromium.org>
+        * page/FocusController.cpp:
+        (WebCore::updateFocusCandidateIfCloser):
 
-        Reviewed by Adam Barth.
+2010-03-04  Darin Fisher  <darin@chromium.org>
 
-        Change the V8 bindings' handling of window.toString(),
-        so we return [object DOMWindow] (like JSC), not [object global].
+        Reviewed by Dmitry Titov.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29742
+        [chromium] make history.{push,replace}State enabled at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=35753
 
-        This will fix a couple of Chromium port test failures and enable us to
-        use the default expectations for a bunch more.
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setPushStateEnabled):
+        (WebCore::RuntimeEnabledFeatures::pushStateEnabled):
+        (WebCore::RuntimeEnabledFeatures::replaceStateEnabled):
+        * page/History.idl:
 
-        * bindings/v8/custom/V8DOMWindowCustom.cpp: Use the DOMWindow wrapper instead
-        of the global object wrapper when it's available in the DOMWindow toString callback.
+2010-03-04  Antonio Gomes  <tonikitoo@webkit.org>
 
-2009-09-28  Nate Chapin  <japhet@chromium.org>
+        Unreviewed attempt to (again) fix Mac build.
 
-        Rubber stamped by David Levin.
+        * page/SpatialNavigation.cpp:
+        (WebCore::spatialDistance):
 
-        Chromium build fix, add back in #include of V8Proxy.h in V8WebKitPointConstructor.cpp.
+2010-03-04  Dan Bernstein  <mitz@apple.com>
 
-        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Re-include V8Proxy.h.
+        Based on a patch from Nick Jong.
 
-2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Simon Fraser.
 
-        Reviewed by Darin Adler.
+        Improve selection in multi-column blocks when hitting points above or
+        below a column rect.
 
-        NotNullPassRefPtr: smart pointer optimized for passing references that are not null
-        https://bugs.webkit.org/show_bug.cgi?id=29822
-        
-        Added NotNullPassRefPtr, and deployed it in all places that initialize
-        JavaScript objects.
+        Test: fast/multicol/hit-test-above-or-below.html
 
-        * bindings/js/DOMObjectWithSVGContext.h:
-        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::cacheDOMStructure):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObject::DOMObject):
-        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
-        (WebCore::DOMConstructorObject::DOMConstructorObject):
-        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
-        * bindings/js/JSInspectedObjectWrapper.cpp:
-        (WebCore::JSInspectedObjectWrapper::JSInspectedObjectWrapper):
-        * bindings/js/JSInspectedObjectWrapper.h:
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        (WebCore::JSInspectorCallbackWrapper::JSInspectorCallbackWrapper):
-        * bindings/js/JSInspectorCallbackWrapper.h:
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSWorkerContextBase.cpp:
-        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
-        * bindings/js/JSWorkerContextBase.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::RuntimeObjectImp):
-        * bridge/runtime_object.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustPointToColumnContents): If the point lies
+        within the horizontal range for a column, constrain it to the column (if
+        it is above) or the next column (if it is below).
 
-2009-09-28  Nate Chapin  <japhet@chromium.org>
+2010-03-04  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Simon Fraser.
 
-        Allow V8 to handle x/y parameters in a WebKitPoint constructor.
-        https://bugs.webkit.org/show_bug.cgi?id=29823
+        Attempt to fix Mac build.
 
-        Fixes V8's handling of LayoutTests/fast/dom/Window/webkitConvertPoint.html
+        * page/SpatialNavigation.cpp:
 
-        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Allow for x/y parameters in constructor.
+2010-03-04  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
 
-2009-09-28  Mark Rowe  <mrowe@apple.com>
+        Add SpatialNavigation header and cpp to Mac XCode project file.
 
-        Fix the build by doing something approximating reasonableness in the Xcode project.
+        Reviewed by Kenneth Christiansen.
 
         * WebCore.xcodeproj/project.pbxproj:
 
-2009-09-28  Simon Hausmann  <hausmann@webkit.org>
-
-        Prospective Tiger build fix.
+2010-03-02  Antonio Gomes  <tonikitoo@webkit.org>
 
-        * WebCore.xcodeproj/project.pbxproj: Try to use unique IDs for the new files.
+        Reviewed by Simon Fraser, Eric Seidel and Darin Adler.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
+        Based on the initial work of Marco Barisione <marco.barisione@collabora.co.uk>
 
-2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
+        Extend keyboard navigation to allow directional navigation
+        https://bugs.webkit.org/show_bug.cgi?id=18662
 
-        Reviewed by Timothy Hatcher.
+        This patch implements the core logic of the 'Spatial Navigation' feature [1].
+        It improves the accessibility support of WebCore by extending the basic keyboard
+        navigation currently available (based on Tab forward and backward) with the
+        addition of a two-dimensional directional navigation by using Left, Right, Up and
+        Down arrow keys to move to the "nearest" element in the corresponding direction.
 
-        Web Inspector: Add explicit frontend event for commit load.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29814
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::didCommitLoad):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMAgent.prototype._setDocument):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addResource):
-        (WebInspector.didCommitLoad):
-
-2009-09-28  Yaar Schnitman  <yaar@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
+        Highlights:
+        * Feature is turned off by default in Settings. Port specific APIs need to be added
+          for toggling it on/off.
+        * Only elements viewed in the current viewport can have focus move to it. If the
+          "nearest" is not in viewport dimensions, then a scroll-in-direction action is
+          performed.
 
-        Chromium port - recognize we are being built independently
-        of chromium and look for dependencies under webkit/chromium rather
-        than chromium/src.
+        Known issues (to be covered in follow-up bugs):
+        * Add port specific hooks to each DRT to enable/disable Spatial Navigation.
+        * Support for spatial navigation through form elements (<input>, <select>, etc)
+          is be added.
+        * Make navigation keys customizable. It currently works with arrows keys only
+          (up, down, right and left).
+        * Make it support modifiers (Alt, Ctrl and Shift).
+        * Improve support on scrollable content.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29722
-
-        * WebCore.gyp/WebCore.gyp: See above. Also removed a few files from
-          the sources list, since they are not supposed to be built here.
-
-2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Implement XSLT support with QtXmlPatterns.
-        https://bugs.webkit.org/show_bug.cgi?id=28303
+        [1] http://en.wikipedia.org/wiki/Spatial_navigation
 
+        * Android.mk:
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
-        * WebCoreSources.bkl:
-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        (WebCore::Document::~Document):
-        (WebCore::Document::setTransformSource):
-        * dom/Document.h:
-        (WebCore::Document::transformSource):
-        * dom/TransformSource.h: Added.
-        (WebCore::TransformSource::platformSource):
-        * dom/TransformSourceLibxslt.cpp: Added.
-        (WebCore::TransformSource::TransformSource): Wraps a libxml2 document.
-        (WebCore::TransformSource::~TransformSource):
-        * dom/TransformSourceQt.cpp: Added.
-        (WebCore::TransformSource::TransformSource): Wraps a plain string.
-        (WebCore::TransformSource::~TransformSource):
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::doEnd):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::doEnd):
-        (WebCore::XMLTokenizer::parseProcessingInstruction):
-        * xml/XSLStyleSheet.h:
-        (WebCore::XSLStyleSheet::sheetString):
-        * xml/XSLStyleSheetLibxslt.cpp:
-        (WebCore::XSLStyleSheet::document):
-        * xml/XSLStyleSheetQt.cpp: Added.
-        * xml/XSLTProcessor.h:
-        * xml/XSLTProcessorLibxslt.cpp:
-        (WebCore::xmlDocPtrFromNode):
-        * xml/XSLTProcessorQt.cpp: Added.
-        (WebCore::XSLTMessageHandler::XSLTMessageHandler): A subclass of QAbstractMessageHandler.
-        (WebCore::XSLTMessageHandler::handleMessage): Forwards all processor messages to the Console.
-        (WebCore::XSLTProcessor::transformToString): Uses QXmlQuery.
-
-2009-09-28  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by Eric Carlson.
-
-        Delegate implementation of rendererIsNeeded() for media control elements to RenderTheme.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28689
-
-        Covered by LayoutTests/media/video-no-audio.html
-
-        * rendering/MediaControlElements.cpp: Removed subclass implementations of rendererIsNeeded().
-        (WebCore::MediaControlElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
-        (WebCore::MediaControlInputElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
-        * rendering/MediaControlElements.h:
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::shouldRenderMediaControlPart): New method.  Contains logic moved from subclass implementations of rendererIsNeeded().
-        * rendering/RenderTheme.h:
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Override to always render mute button.
-        * rendering/RenderThemeChromiumSkia.h:
-
-2009-09-28  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        [chromium] DragData::asURL should return file URL.
-        https://bugs.webkit.org/show_bug.cgi?id=29109
-
-        Tested by LayoutTests/fast/events/drag-to-navigate.html.
-
-        * platform/FileSystem.h:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/DragDataChromium.cpp:
-        (WebCore::DragData::asURL):
-        * platform/chromium/FileSystemChromium.cpp:
-        (WebCore::getAbsolutePath):
-        (WebCore::isDirectory):
-        (WebCore::filePathToURL):
-
-2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Add a special case to handle index arguments, because we need to be
-        able to see if they're < 0.
-        https://bugs.webkit.org/show_bug.cgi?id=29810
-
-        Test: LayoutTests/dom/html/level1/core/hc_characterdataindexsizeerrdeletedatacountnegative.html
-
-        * bindings/scripts/CodeGeneratorV8.pm: Added special case (matching CodeGeneratorJS.pm)
-          for index arguments.
-
-2009-09-28  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Extend the MediaWiki/KHTMLFixes.css workaround to cover older MediaWiki versions
-        https://bugs.webkit.org/show_bug.cgi?id=29792
-
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::setCSSStyleSheet): If site specific hacks are
-        enabled, check if the linked style sheet is one of two versions of the
-        MediaWiki KHTMLFixes.css. If so, remove the offending rule.
-
-2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Fix an error in type logic in CodeGeneratorV8.pm, where
-        unsigned ints are accidentally used as signed.
-        https://bugs.webkit.org/show_bug.cgi?id=29810
-
-        Test: LayoutTests/fast/forms/textarea-maxlength.html
-
-        * bindings/scripts/CodeGeneratorV8.pm: Made sure "unsigned long" in IDL is
-          properly generates on "unsigned" return value.
-
-2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::defaultKeyboardEventHandler):
+        (WebCore::EventHandler::focusDirectionForKey):
+        (WebCore::EventHandler::defaultArrowEventHandler):
+        * page/EventHandler.h:
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocus):
+        (WebCore::FocusController::advanceFocusInDocumentOrder):
+        (WebCore::FocusController::advanceFocusDirectionally):
+        (WebCore::updateFocusCandidateIfCloser):
+        (WebCore::FocusController::findFocusableNodeInDirection):
+        (WebCore::FocusController::deepFindFocusableNodeInDirection):
+        * page/FocusController.h:
+        * page/FocusDirection.h:
+        (WebCore::):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setSpatialNavigationEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::isSpatialNavigationEnabled):
+        * page/SpatialNavigation.cpp: Added.
+        (WebCore::distanceInDirection):
+        (WebCore::renderRectRelativeToRootDocument):
+        (WebCore::alignmentForRects):
+        (WebCore::isHorizontalMove):
+        (WebCore::areRectsFullyAligned):
+        (WebCore::areRectsPartiallyAligned):
+        (WebCore::spatialDistance):
+        (WebCore::isRectInDirection):
+        (WebCore::hasOffscreenRect):
+        (WebCore::scrollInDirection):
+        (WebCore::isInRootDocument):
+        (WebCore::deflateIfOverlapped):
+        * page/SpatialNavigation.h: Added.
+        (WebCore::):
+        (WebCore::FocusCandidate::FocusCandidate):
 
-        Rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp.
-        https://bugs.webkit.org/show_bug.cgi?id=28303
+2010-03-04  Beth Dakin  <bdakin@apple.com>
 
-        In preparation for adding XSLT support with QtXmlPatterns to the Qt
-        port, rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp as we will
-        have our own implementation which most likely will not share any code
-        with the current one.
+        Reviewed by Anders Carlsson.
 
-        Additionally, fix some coding style issues.
+        This fixes the layering violation I committed yesterday by moving 
+        Page::instanceHandle into its own file just in the WebCore 
+        namespace.
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
+        Added WebCoreInstanceHandle.h + .cpp and removed PageWin.cpp
         * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * xml/XSLStyleSheet.cpp: Renamed to XSLStyleSheetLibxslt.cpp.
-        * xml/XSLStyleSheetLibxslt.cpp: Added.
-
-2009-09-28  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Prospective build fix for r48812.
-
-        Forgot to remove the inline reset() implementation when reverting the indentation
-        changes in the file.
-
-        * xml/XSLTProcessor.h:
-
-2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by nobody (trivial follow up fix), Joseph Pecoraro LGTM-ed.
-
-        Web Inspector: Follow up to r48809.
-        InspectorController.wrapObject should only be called on the inspectable page side.
-
-        https://bugs.webkit.org/show_bug.cgi?id=17429
-
-        * inspector/front-end/EventListenersSidebarPane.js:
-        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
-        (WebInspector.EventListenersSidebarPane.prototype.update):
-        (WebInspector.EventListenersSection):
-        (WebInspector.EventListenersSection.prototype.update):
-        (WebInspector.EventListenerBar):
-        (WebInspector.EventListenerBar.prototype.update):
-
-2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+        * page/win/PageWin.cpp: Removed.
 
-        Reviewed by Simon Hausmann.
-
-        Move the libxslt specific part of XSLTProcessor to a separate file.
-        https://bugs.webkit.org/show_bug.cgi?id=28303
-
-        In preparation for adding XSLT support with QtXmlPatterns to the Qt
-        port, move the libxslt part of the XSLTProcessor implementation into
-        another file and leave the part that can be reused and shared.
+        Remove all instance handle code from Page.
+        * page/Page.h:
 
-        Additionally, fix some coding style issues.
+        New files.
+        * platform/win/WebCoreInstanceHandle.cpp: Added.
+        * platform/win/WebCoreInstanceHandle.h: Added.
+        (WebCore::setInstanceHandle):
+        (WebCore::instanceHandle):
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * xml/XSLTProcessor.cpp:
-        (WebCore::XSLTProcessor::createDocumentFromSource): Remove trailing whitespaces.
-        (WebCore::createFragmentFromSource): Remove trailing whitespaces.
-        (WebCore::XSLTProcessor::transformToFragment): Remove trailing whitespaces.
-        (WebCore::XSLTProcessor::reset): Moved out of the class definition.
-        * xml/XSLTProcessorLibxslt.cpp: Added.
-        (WebCore::XSLTProcessor::genericErrorFunc): Moved.
-        (WebCore::XSLTProcessor::parseErrorFunc): Moved.
-        (WebCore::docLoaderFunc): Moved.
-        (WebCore::setXSLTLoadCallBack): Moved.
-        (WebCore::writeToVector): Moved.
-        (WebCore::saveResultToString): Moved.
-        (WebCore::xsltParamArrayFromParameterMap): Moved.
-        (WebCore::freeXsltParamArray): Moved.
-        (WebCore::xsltStylesheetPointer): Moved.
-        (WebCore::xmlDocPtrFromNode): Moved.
-        (WebCore::resultMIMEType): Moved.
-        (WebCore::XSLTProcessor::transformToString): Moved.
-
-2009-09-28  Charles Wei  <charles.wei@torchmobile.com.cn>
+        Switch to WebCore::instanceHandle() instead of 
+        Page::instanceHandle() and include the new header.
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::acceleratedCompositingAvailable):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::registerClass):
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::initializeOffScreenTimerWindow):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::registerPluginView):
+        (WebCore::PluginView::platformStart):
 
-        Reviewed by Nikolas Zimmermann.
+2010-03-04  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Fix the crash of SVG that crashes when use a non-exist symbol
-        https://bugs.webkit.org/show_bug.cgi?id=27693
+        Unreviewed build fix.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        Test: svg/custom/use-non-existing-symbol-crash.svg
+        'glib_file_name' renamed to 'gligFileName'.
 
-        * svg/SVGUseElement.cpp:
-        (WebCore::shadowTreeContainsChangedNodes):
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::Image::loadPlatformResource):
 
-2009-09-28  Joseph Pecoraro  <joepeck@webkit.org>
+2010-03-04  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Inspector Should Show Event Listeners/Handlers Registered on each Node
-        https://bugs.webkit.org/show_bug.cgi?id=17429
-        
-          Extracted a method from dispatchEvent to get the event ancestor chain
-        
-        * dom/Node.cpp:
-        (WebCore::Node::eventAncestors): the extracted method
-        (WebCore::Node::dispatchGenericEvent): use eventAncestors
-        * dom/Node.h:
+        Web Inspector: Remove two last synchronous calls from front-end to InspectorBackend.
 
-          Asynchronous Flow For the Inspector, Backend -> DOM Agent -> Frontend
-          The DOMAgent's getEventListenersForNode handles the logic of finding
-          all the relevant listeners in the event flow.
+        https://bugs.webkit.org/show_bug.cgi?id=35720
 
         * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getEventListenersForNode):
+        (WebCore::InspectorBackend::enableSearchingForNode):
+        (WebCore::InspectorBackend::disableSearchingForNode):
+        (WebCore::InspectorBackend::setPauseOnExceptionsState):
         * inspector/InspectorBackend.h:
         * inspector/InspectorBackend.idl:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::getEventListenersForNode):
-        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
-        (WebCore::InspectorDOMAgent::buildObjectForNode): added localName
-        * inspector/InspectorDOMAgent.h:
-        (WebCore::EventListenerInfo::EventListenerInfo):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorContorller::setSearchingForNode):
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/InspectorController.h:
         * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        (WebCore::InspectorFrontend::searchingForNodeWasEnabled):
+        (WebCore::InspectorFrontend::searchingForNodeWasDisabled):
+        (WebCore::InspectorFrontend::updatePauseOnExceptionsState):
         * inspector/InspectorFrontend.h:
-        (WebCore::InspectorFrontend::scriptState):
-        * inspector/front-end/DOMAgent.js: added localName to WebInspector.DOMNode from payload
-        (WebInspector.EventListeners.getEventListenersForNodeAsync.mycallback):
-        (WebInspector.EventListeners.getEventListenersForNodeAsync):
-
-          New Sidebar Pane in the Element's Panel
-          Includes Gear Menu for filtering the Event Listeners on the
-          "Selected Node Only" or "All Nodes"
-
-        * inspector/front-end/ElementsPanel.js: Handles refreshing the Pane when necessary
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        * inspector/front-end/ElementsPanel.js:
         (WebInspector.ElementsPanel):
-        (WebInspector.ElementsPanel.prototype.updateEventListeners):
-        * inspector/front-end/EventListenersSidebarPane.js: Added. 
-        (WebInspector.EventListenersSidebarPane): The 1st level in the Pane
-        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
-        (WebInspector.EventListenersSidebarPane.prototype.update):
-        (WebInspector.EventListenersSection): The 2nd level in the Pane
-        (WebInspector.EventListenersSection.prototype.update): filters on Preference
-        (WebInspector.EventListenersSection.prototype.addListener):
-        (WebInspector.EventListenerBar): The 3rd level in the Pane
-        (WebInspector.EventListenerBar.prototype._getNodeDisplayName):
-        (WebInspector.EventListenerBar.prototype._getFunctionDisplayName):
-        (WebInspector.EventListenersSidebarPane.prototype._changeSetting): For the Gear Menu
-        
-          Consolidated "appropriateSelectorForNode"
-
-        * inspector/front-end/StylesSidebarPane.js:
-        * inspector/front-end/utilities.js:
-
-          Miscellaneous Updates
-
-        * English.lproj/localizedStrings.js: "Event Listeners", "No Event Listeners", "Selected Node Only", "All Nodes"
-        * WebCore.gypi: included the new inspector files
-        * WebCore.vcproj/WebCore.vcproj: included source files that were missing
-        * inspector/front-end/Images/grayConnectorPoint.png: Added. Thanks to Timothy Hatcher.
-        * inspector/front-end/Images/whiteConnectorPoint.png: Added. Thanks to Timothy Hatcher.
-        * inspector/front-end/inspector.js: Preferences for the Gear Menu Event Listeners filter
-        * inspector/front-end/inspector.css: reused as much as possible
-        * inspector/front-end/inspector.html: include the new script
-        * inspector/front-end/WebKit.qrc: included the new inspector files
-
-2009-09-27  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29760
-        Implement CSSOM Range.getClientRects/getBoundingClientRect 
-
-        Tests: fast/dom/Range/getBoundingClientRect-getClientRects-relative-to-viewport.html
-               fast/dom/Range/getBoundingClientRect.html
-               fast/dom/Range/getClientRects.html
-
-        * dom/Range.cpp:
-        (WebCore::Range::getClientRects):
-        (WebCore::Range::getBoundingClientRect):
-        (WebCore::adjustFloatQuadsForScrollAndAbsoluteZoom):
-        (WebCore::Range::getBorderAndTextQuads):
-        * dom/Range.h:
-        * dom/Range.idl:
-        Implement Range.getClientRects/getBoundingClientRect.
-
-        * dom/Element.cpp:
-        * rendering/RenderObject.h: 
-        (WebCore::adjustForAbsoluteZoom):
-        (WebCore::adjustIntRectForAbsoluteZoom):
-        (WebCore::adjustFloatPointForAbsoluteZoom):
-        (WebCore::adjustFloatQuadForAbsoluteZoom):
-        Move point/quad adjustment methods from Element.cpp to RenderObject.h
-        so that Range.cpp can use them as well.
-
-2009-09-27  Simon Hausmann  <hausmann@webkit.org>
-
-        Unreviewed fix for WebInspector with Qt build.
-
-        Simply re-generate the Qt resource file by running
-        WebKitTools/Scripts/generate-qt-inspector-resource
-
-        * inspector/front-end/WebKit.qrc:
-
-2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by nobody (trivial ChangeLog fix).
-
-        Restore WebCore/ChangeLog truncated in r48778.
+        (WebInspector.ElementsPanel.prototype.get statusBarItems):
+        (WebInspector.ElementsPanel.prototype.hide):
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.searchingForNodeWasEnabled):
+        (WebInspector.ElementsPanel.prototype.searchingForNodeWasDisabled):
+        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.enableSearchingForNode):
+        (.WebInspector.InspectorBackendStub.prototype.disableSearchingForNode):
+        (.WebInspector.InspectorBackendStub.prototype.setPauseOnExceptionsState):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get statusBarItems):
+        (WebInspector.ScriptsPanel.prototype.updatePauseOnExceptionsState):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        (WebInspector.ScriptsPanel.prototype._togglePauseOnExceptions):
+        * inspector/front-end/inspector.js:
+        (WebInspector.searchingForNodeWasEnabled):
+        (WebInspector.searchingForNodeWasDisabled):
+        (WebInspector.updatePauseOnExceptionsState):
 
-2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-03  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: DOM store is being unbound twice, leading to assertion failure.
+        Web Inspector: Clicking on an error should take me to the error
 
-        https://bugs.webkit.org/show_bug.cgi?id=29770
+        https://bugs.webkit.org/show_bug.cgi?id=34860
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didOpenDatabase):
-        (WebCore::InspectorController::didUseDOMStorage):
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::unbind):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._selectTab):
+        (WebInspector.ResourceView.prototype.selectContentTab):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.showResource):
 
-2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-03  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: Do not track DOM changes while inspector window is closed.
+        Web Inspector: Remove sync access to resourceTrackingEnabled.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29769
+        https://bugs.webkit.org/show_bug.cgi?id=35693
 
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
         (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::resetScriptObjects):
-        (WebCore::InspectorController::didCommitLoad):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::setDocument):
-        * inspector/InspectorDOMAgent.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
-        * page/android/InspectorControllerAndroid.cpp:
-        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
-
-2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: [REGRESSION] Double Clicking Resources Fails to Open in New Window
-
-        https://bugs.webkit.org/show_bug.cgi?id=29762
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.setStyleText):
-        (InjectedScript.openInInspectedWindow):
-        * inspector/front-end/InjectedScriptAccess.js:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        (WebInspector.AuditsPanel.prototype.show):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub):
+        (.WebInspector.InspectorBackendStub.prototype.enableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.disableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.enableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.disableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.enableProfiler):
+        (.WebInspector.InspectorBackendStub.prototype.disableProfiler):
         * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
-
-2009-09-26  David Kilzer  <ddkilzer@apple.com>
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.get resourceTrackingEnabled):
+        (WebInspector.ResourcesPanel.prototype.get visibleView):
+        (WebInspector.ResourcesPanel.prototype.resourceTrackingWasEnabled):
+        (WebInspector.ResourcesPanel.prototype.resourceTrackingWasDisabled):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype.showResource):
+        (WebInspector.ResourcesPanel.prototype._enableResourceTracking):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
 
-        Part 2 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+2010-03-04  Antoine Quint  <ml@graougraou.com>
 
         Reviewed by Darin Adler.
 
-        Fix ENABLE_ORIENTATION_EVENTS for non-Mac platforms.
-
-        * DerivedSources.make: Moved Platform.h check for
-        ENABLE_ORIENTATION_EVENTS into Mac-only section and added
-        default of ENABLE_ORIENTATION_EVENTS = 0 to non-Mac section.
-        Added ifndef test to make it possible to override both
-        ENABLE_DASHBOARD_SUPPORT and ENABLE_ORIENTATION_EVENTS external
-        to the makefile.  Moved addition of ENABLE_ORIENTATION_EVENTS to
-        ADDITIONAL_IDL_DEFINES to common section.
-        * GNUmakefile.am: Added support for ENABLE_ORIENTATION_EVENTS if
-        it is ever used.
-        * WebCore.pro: Ditto.
-
-2009-09-26  Kent Tamura  <tkent@chromium.org>
+        DOM insertion mutation events should dispatch after a node is attached to the render tree
+        https://bugs.webkit.org/show_bug.cgi?id=35590
 
-        Reviewed by David Kilzer.
+        Test: fast/events/domnodeinsertedintodocument-dispatched-post-rendering.html
 
-        Move placeholder-related code to HTMLTextFormControlElement from
-        HTMLInputElement, WMLInputElement, InputElement, and
-        HTMLTextAreaElement.
-        https://bugs.webkit.org/show_bug.cgi?id=28703
+        Split off the internal-to-WebCore node insertion notification code from the DOM mutation
+        event dispatching, originally in dispatchChildInsertionEvents(), to a new static function
+        called notifyChildInserted(). This allows us to dispatch the mutation events at a later
+        time upon insertion of a child into to the tree, specifically _after_ attachment to the render
+        tree.
 
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::dispatchFocusEvent):
-        (WebCore::InputElement::dispatchBlurEvent):
-        (WebCore::InputElement::setValueFromRenderer):
-        * dom/InputElement.h:
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLTextFormControlElement::HTMLTextFormControlElement):
-        (WebCore::HTMLTextFormControlElement::~HTMLTextFormControlElement):
-        (WebCore::HTMLTextFormControlElement::dispatchFocusEvent):
-        (WebCore::HTMLTextFormControlElement::dispatchBlurEvent):
-        (WebCore::HTMLTextFormControlElement::placeholderShouldBeVisible):
-        (WebCore::HTMLTextFormControlElement::updatePlaceholderVisibility):
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLTextFormControlElement::handleFocusEvent):
-        (WebCore::HTMLTextFormControlElement::handleBlurEvent):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::HTMLInputElement):
-        (WebCore::HTMLInputElement::handleFocusEvent):
-        (WebCore::HTMLInputElement::handleBlurEvent):
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        (WebCore::HTMLInputElement::createRenderer):
-        (WebCore::HTMLInputElement::setValue):
-        (WebCore::HTMLInputElement::setValueFromRenderer):
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::supportsPlaceholder):
-        (WebCore::HTMLInputElement::isEmptyValue):
-        * html/HTMLIsIndexElement.cpp:
-        (WebCore::HTMLIsIndexElement::parseMappedAttribute):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
-        (WebCore::HTMLTextAreaElement::createRenderer):
-        * html/HTMLTextAreaElement.h:
-        (WebCore::HTMLTextAreaElement::supportsPlaceholder):
-        (WebCore::HTMLTextAreaElement::isEmptyValue):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::RenderTextControl):
-        * rendering/RenderTextControl.h:
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
-        * rendering/RenderTextControlMultiLine.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
-        (WebCore::RenderTextControlSingleLine::updateFromElement):
-        * rendering/RenderTextControlSingleLine.h:
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::setValue):
-        (WebCore::WMLInputElement::createRenderer):
-        * wml/WMLInputElement.h:
-
-2009-09-26  Shu Chang  <Chang.Shu@nokia.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Optimize the code so only the text from start to end is scanned.
-        https://bugs.webkit.org/show_bug.cgi?id=29092
-
-        On a platform with webkit+Qt+Symbian, the parsing time for a 600K text
-        file improved from 400ms to 40ms (10x faster).
-
-        * dom/Text.cpp:
-        (WebCore::Text::createWithLengthLimit):
-
-2009-09-26  Xiaomei Ji  <xji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        This Patch fixes [chromium] the drop-down is always left-aligned even
-        for RTL element.
-        https://bugs.webkit.org/show_bug.cgi?id=29612
-
-        For auto-complete, the items in drop-down should be right-aligned if
-        the directionality of <input> field is RTL.
-        For <select><option>, the items in drop-down should be right-aligned
-        if the directionality of <select> is RTL.
-
-        No automatic test is possible. Manual tests are added.
-
-        * manual-tests/autofill_alignment.html: Added.
-        * manual-tests/select_alignment.html: Added.
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::paintRow): Adjust the starting x-axis of text to
-        be paint if it should be right-aligned.
-
-2009-09-25  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        REGRESSION (r48775) FontList.plist written by TOT WebKit causes Safari 4
-        to crash on launch
-        https://bugs.webkit.org/show_bug.cgi?id=29759
-
-        * platform/graphics/win/FontDatabase.cpp:
-        (WebCore::writeFontDatabaseToPlist): Reverted to saving the CG font DB
-        property list at the root of FontList.plist, but with an additional
-        key for the last value of the Fonts registry key.
-        (WebCore::populateFontDatabase): Pass the FontList.plist in its entirety
-        to populatFontDatabaseFromPlist.
-
-2009-09-25  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Build fix. Adding missing header files.
-
-        * bindings/js/JSNamedNodeMapCustom.cpp:
-
-2009-09-25  David Kilzer  <ddkilzer@apple.com>
-
-        Part 1 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
-
-        Reviewed by Darin Adler.
-
-        * DerivedSources.make: Move tests for ENABLE_CONTEXT_MENUS,
-        ENABLE_DRAG_SUPPORT and ENABLE_INSPECTOR into Mac-only section.
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::appendChild):
+        (WebCore::notifyChildInserted):
+        (WebCore::dispatchChildInsertionEvents):
 
-2009-09-25  Adam Barth  <abarth@webkit.org>
+2010-03-04  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
-        Reviewed by Darin Adler.
+        Reviewed by Holger Freyther.
 
-        Load blocks during unload should not affect targeted loads
-        https://bugs.webkit.org/show_bug.cgi?id=29747
+        Make paths relocatable on runtime on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=32711
 
-        Move the check of the unload state after checking for targeted links.
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (get_webkit_datadir):
+        (WebCore::Image::loadPlatformResource):
 
-        Test: fast/loader/unload-hyperlink-targeted.html
+2010-03-04  Pavel Feldman  <pfeldman@chromium.org>
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadURL):
+        Reviewed by Timothy Hatcher.
 
-2009-09-25  Kenneth Russell  <kbr@google.com>
+        Web Inspector: Popup for Timeline panel will work in a tooltip mode
+
+        https://bugs.webkit.org/show_bug.cgi?id=35680
+
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover):
+        (WebInspector.Popover.prototype.show):
+        (WebInspector.Popover.prototype.hide):
+        (WebInspector.Popover.prototype._positionElement):
+        (WebInspector.PopoverHelper):
+        (WebInspector.PopoverHelper.prototype._mouseDown):
+        (WebInspector.PopoverHelper.prototype._mouseMove.doHide):
+        (WebInspector.PopoverHelper.prototype._mouseMove):
+        (WebInspector.PopoverHelper.prototype._resetHoverTimer):
+        (WebInspector.PopoverHelper.prototype.hidePopup):
+        (WebInspector.PopoverHelper.prototype._mouseHover):
+        (WebInspector.PopoverHelper.prototype._killHidePopupTimer):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get _recordStyles):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._adjustScrollPosition):
+        (WebInspector.TimelinePanel.prototype._getPopoverAnchor):
+        (WebInspector.TimelinePanel.prototype._showPopover):
+        (WebInspector.TimelinePanel.prototype._closeRecordDetails):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype._onClick):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._createCell):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._createRow):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._createLinkRow):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
+        * inspector/front-end/inspector.css:
 
-        Reviewed by Dimitri Glazkov.
+2010-03-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        [Chromium] Add initial V8 bindings for WebGL
-        https://bugs.webkit.org/show_bug.cgi?id=29664
+        Unreviewed build fix.
 
-        * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8CanvasArrayBufferCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CanvasArrayCustom.h: Added.
-        (WebCore::constructCanvasArray):
-        * bindings/v8/custom/V8CanvasByteArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasFloatArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasIntArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp: Added.
-        (WebCore::jsArrayToFloatArray):
-        (WebCore::jsArrayToIntArray):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::):
-        (WebCore::vertexAttribAndUniformHelperf):
-        (WebCore::uniformHelperi):
-        (WebCore::uniformMatrixHelper):
-        * bindings/v8/custom/V8CanvasShortArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * platform/graphics/GraphicsContext3D.h:
+        Build fix after r55464.
 
-2009-09-25  Jeremy Orlow  <jorlow@chromium.org>
+        No new tests, no new functionality.
 
-        This is breaking Chromium try bots, so I'm counting this as a build fix.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
 
-        Add more svn:ignore exceptions.  On different platforms, these files are
-        generated with different case for WebCore.
+2010-03-04  Leandro Pereira  <leandro@profusion.mobi>
 
-        * WebCore.gyp: Changed property svn:ignore.
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-09-25  Alexey Proskuryakov  <ap@apple.com>
+        Add EFL port files to platform/graphics/efl.
+        http://webkit.org/b/35539
 
-        Reverting r48767, as it broke Windows build in a non-trivial way.
+        * platform/graphics/efl/FloatRectEfl.cpp: Added.
+        * platform/graphics/efl/FontEfl.cpp: Added.
+        * platform/graphics/efl/IconEfl.cpp: Added.
+        * platform/graphics/efl/ImageEfl.cpp: Added.
+        * platform/graphics/efl/IntPointEfl.cpp: Added.
+        * platform/graphics/efl/IntRectEfl.cpp: Added.
 
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener):
-        (WebCore::JSEventListener::jsFunction):
-        (WebCore::JSEventListener::markJSFunction):
-        (WebCore::JSEventListener::handleEvent):
-        (WebCore::JSEventListener::reportError):
-        * bindings/js/JSEventListener.h:
-        (WebCore::JSEventListener::create):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSLazyEventListener.cpp:
-        (WebCore::JSLazyEventListener::JSLazyEventListener):
-        (WebCore::JSLazyEventListener::jsFunction):
-        (WebCore::JSLazyEventListener::parseCode):
-        * bindings/js/JSLazyEventListener.h:
-        (WebCore::JSLazyEventListener::create):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
-        * bindings/objc/ObjCEventListener.h:
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::handleEvent):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/EventListener.h:
-        (WebCore::EventListener::reportError):
-        (WebCore::EventListener::jsFunction):
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::fireEventListeners):
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * inspector/InspectorDOMStorageResource.h:
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::handleEvent):
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::handleEvent):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
+2010-03-04  Leandro Pereira  <leandro@profusion.mobi>
 
-2009-09-24  Tony Chang  <tony@chromium.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by David Levin.
+        Add EFL port files to platform/text/efl.
+        http://webkit.org/b/35740
 
-        Add a gyp variable to allow building a debug webcore without debug
-        symbols.  This allows for faster compile, link, and gdb times.
+        * platform/text/efl/TextBreakIteratorInternalICUEfl.cpp: Added.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29721
+2010-03-04  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
-        No new tests, build config change.
+        Reviewed by Holger Freyther.
 
-        * WebCore.gyp/WebCore.gyp:
+        https://bugs.webkit.org/show_bug.cgi?id=35726
+        Remove orphaned #ifdef WTF_USE_GLIB_ICU_UNICODE_HYBRID
 
-2009-09-25  Darin Fisher  <darin@chromium.org>
+        Removing orphaned #if USE.
 
-        Reviewed by Dimitri Glazkov.
+        * platform/ThreadGlobalData.h:
 
-        Declare RegisteredEventListener as a class instead of a struct.
-        This fixes a warning in the Chromium build.
+2010-03-03  Jeremy Orlow  <jorlow@chromium.org>
 
-        * dom/RegisteredEventListener.h:
+        Reviewed by Darin Fisher.
 
-2009-09-25  Dan Bernstein  <mitz@apple.com>
+        Throttle sync requests sent to the LocalStorage background thread
+        https://bugs.webkit.org/show_bug.cgi?id=34943
 
-        Reviewed by Jon Honeycutt.
+        Currently, once a second LocalStorage takes all keys/values which have
+        been changed and sends them to a background thread to sync.  The problem
+        is that this background thread can get overwhelmed and stop being
+        responsive.  This means that if any other page tries to start using
+        LocalStorage (and thus initiates the initial import) that'll block on
+        all the previous syncs completing.
 
-        WebCore part of
-        <rdar://problem/7211635> 2 byte characters are displayed as garbaged
-        <rdar://problem/7212626> garbled/gibberish text (off-by-one)
-
-        When the Windows Fonts directory contains more than one font file for a
-        given font name, which of the fonts gets assigned to the name in the
-        Core Graphics font database was determined arbitrarily and did not
-        always match the font GDI used for the same font name. The mismatch
-        caused character-to-glyph mapping to use one font and glyph rendering to
-        use another.
-
-        The fix is to update the Core Graphics font database from the registry
-        entries (that reflect the name-to-font mapping that GDI uses) after
-        populating it with the result of scanning the Fonts directory. As a
-        consequence, the directory needs to be scanned at startup every time the
-        registry key changes, so the last value of the registry key is kept
-        in the property list on disk so that it could be compared to the current
-        value on startup.
-
-        * platform/graphics/win/FontDatabase.cpp:
-        (WebCore::populateFontDatabaseFromPlist): Now takes a property list as
-        a parameter and avoids round-tripping through XML by calling
-        wkAddFontsFromPlist() instead of wkAddFontsFromPlistRepresentation().
-        (WebCore::fontFilenamesFromRegistryKey):
-        (WebCore::cgFontDBKey):
-        (WebCore::writeFontDatabaseToPlist): Now takes the CG font DB property
-        list and a property list with the font filenames from the registry and
-        writes a dictionary with those property lists as values.
-        (WebCore::fontFilenamesFromRegistry): Added. Returns an array with the
-        values in the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
-        registry key.
-        (WebCore::populateFontDatabase): Changed to read the contents of the
-        Fonts registry key and compare it with the last-saved value from the
-        property list, and to call wkAddFontsFromRegistry() after populating the
-        CG font DB from the file system. Uses wkCreateFontsPlist() instead of
-        wkCreateFontsPlistRepresentation() to avoid round-tripping through XML.
-
-2009-09-25  Geoffrey Garen  <ggaren@apple.com>
+        To mitigate this, I'm adding code so that we never schedule another
+        sync task when another is still running.  In order to keep the sync
+        tasks from growing exponentially when they do take longer than the
+        storage sync interval, I've also added a basic rate limiter.  No effort
+        is made to ensure fairness/ordering of what gets synced nor is there
+        any way for this rate to be changed because most normal uses of
+        LocalStorage really shouldn't be hitting these types of limits anyway.
 
-        Reviewed by Darin Adler.
+        The only behavioral change that's observible in JavaScript is time based
+        and thus it's not practical to make new tests that aren't racy.  The
+        existing layout tests cover LocalStorage pretty well, though.
 
-        Inlined some object creation code, including lexicalGlobalObject access
-        https://bugs.webkit.org/show_bug.cgi?id=29750
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performSync):
+        * storage/StorageAreaSync.h:
 
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::currentCallFrame):
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::hasBreakpoint): Updated for JavaScriptCore
-        API changes.
+2010-03-04  Andrey Kosyakov  <caseq@chromium.org>
 
-2009-09-25  Dave Hyatt  <hyatt@apple.com>
+        Reviewed by Pavel Feldman.
 
-        Reviewed by Anders Carlsson.
+        Added support for worker instrumentation in inspector
+        (display list of active workers, allow debugging of workers
+        by injecting fake JS implementation)
 
-        https://bugs.webkit.org/show_bug.cgi?id=24399
-        Make @import work in user stylesheets.  The first bug was that the URL wasn't being set on the
-        user sheets themselves, so relative @import URLs couldn't resolve properly.  The second bug
-        was that the loads would be denied.  This is fixed by using the requestUserCSSStyleSheet method
-        instead of the normal request method.  In order to know when to do this, CSSStyleSheets now have
-        a propagated boolean, m_isUserStyleSheet, that lets them know if they are user stylesheets or not.
+        https://bugs.webkit.org/show_bug.cgi?id=35568
 
-        * css/CSSImportRule.cpp:
-        (WebCore::CSSImportRule::insertedIntoParent):
-        * css/CSSStyleSheet.cpp:
-        (WebCore::CSSStyleSheet::CSSStyleSheet):
-        * css/CSSStyleSheet.h:
-        (WebCore::CSSStyleSheet::setIsUserStyleSheet):
-        (WebCore::CSSStyleSheet::isUserStyleSheet):
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
         * dom/Document.cpp:
-        (WebCore::Document::pageUserSheet):
-        (WebCore::Document::pageGroupUserSheets):
-
-2009-09-25  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler.
-
-        ASSERTION FAILED: !repaintContainer || repaintContainer == this
-        https://bugs.webkit.org/show_bug.cgi?id=29755
-        
-        It's possible for RenderObject::container() to return an object that is higher
-        in the hierarchy than the repaintContainer that is being used to repaint an
-        object. For example, this can happen when running an accelerated opacity
-        transition on an element with a position:absolute parent, and a position:absolute child.
-        
-        In this case we need to detect when RenderObject::container() will skip over
-        repaintContainer, and in that case adjust the coords to shift into repaintContainer's space.
-
-        Test: compositing/repaint/opacity-between-absolute.html
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::mapLocalToContainer):
-        (WebCore::RenderBox::computeRectForRepaint):
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::computeRectForRepaint):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::container):
-        * rendering/RenderObject.h:
-
-2009-09-25  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Crash with hardware accelerated rotation of a PDF image in a data URL
-        <rdar://problem/7250378>
-        
-        PDF images don't return a color space from CGImageGetColorSpace(),
-        so we need to null-check the return value before use.
-
-        Test: compositing/color-matching/pdf-image-match.html
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setContentsToImage):
-
-2009-09-25  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Null-deref when first access to an Attr node is after its Element is destroyed
-        https://bugs.webkit.org/show_bug.cgi?id=29748
-
-        Test: fast/dom/Attr/access-after-element-destruction.html
-
-        * bindings/js/JSAttrCustom.cpp:
-        (WebCore::JSAttr::markChildren): Added. Keeps the ownerElement alive as
-        long as the Attr is alive.
-
-        * bindings/js/JSNamedNodeMapCustom.cpp:
-        (WebCore::JSNamedNodeMap::markChildren): Added. Keeps the Element alive as
-        long as the NamedNodeMap is alive.
-
-        * dom/Attr.idl: Added CustomMarkFunction attribute.
+        (WebCore::Document::inspectorController):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::inspectorController):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::injectScript):
+        (WebCore::InjectedScriptHost::nextWorkerId):
+        (WebCore::InjectedScriptHost::didCreateWorker):
+        (WebCore::InjectedScriptHost::willDestroyWorker):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didCreateWorker):
+        (WebCore::InspectorController::willDestroyWorker):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didCreateWorker):
+        (WebCore::InspectorFrontend::willDestroyWorker):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorWorkerResource.h: Added.
+        (WebCore::InspectorWorkerResource::create):
+        (WebCore::InspectorWorkerResource::id):
+        (WebCore::InspectorWorkerResource::url):
+        (WebCore::InspectorWorkerResource::isSharedWorker):
+        (WebCore::InspectorWorkerResource::InspectorWorkerResource):
+        * inspector/front-end/Checkbox.js: Added.
+        (WebInspector.Checkbox.callbackWrapper):
+        (WebInspector.Checkbox):
+        (WebInspector.Checkbox.prototype.checked):
+        * inspector/front-end/InjectedFakeWorker.js:
+        (InjectedFakeWorker.FakeWorker):
+        (InjectedFakeWorker.FakeWorker.prototype.terminate):
+        (InjectedFakeWorker.FakeWorker.prototype._handleException):
+        (InjectedFakeWorker.FakeWorker.prototype._importScripts):
+        (InjectedFakeWorker.FakeWorker.prototype._loadScript):
+        (InjectedFakeWorker.FakeWorker.prototype._expandURLAndCheckOrigin):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasEnabled):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasDisabled):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/WorkersSidebarPane.js: Added.
+        (WebInspector.WorkersSidebarPane):
+        (WebInspector.WorkersSidebarPane.prototype.addWorker):
+        (WebInspector.WorkersSidebarPane.prototype.removeWorker):
+        (WebInspector.WorkersSidebarPane.prototype.setInstrumentation):
+        (WebInspector.WorkersSidebarPane.prototype.reset):
+        (WebInspector.WorkersSidebarPane.prototype._onTriggerInstrument):
+        (WebInspector.Worker):
+        (WebInspector.didCreateWorker):
+        (WebInspector.willDestroyWorker):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::AbstractWorker):
+        (WebCore::AbstractWorker::~AbstractWorker):
+        (WebCore::AbstractWorker::onDestroyWorker):
+        (WebCore::AbstractWorker::contextDestroyed):
+        * workers/AbstractWorker.h:
+        (WebCore::AbstractWorker::id):
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
 
-        * dom/NamedAttrMap.cpp:
-        (WebCore::NamedNodeMap::getAttributeItem): Tweaked formatting.
-        (WebCore::NamedNodeMap::detachFromElement): Call clearAttributes so we don't
-        have attributes hanging around that might need an Attr node created; that way
-        we won't crash with a null-dereference trying to deal with one of them. This
-        can't happen when working with JavaScript since the Element will be kept
-        alive due to the change above.
-        (WebCore::NamedNodeMap::addAttribute): Fix function name in comment.
-        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "1" and added
-        missing braces.
+2010-03-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        * dom/NamedAttrMap.h: Made the element function public so it can be used by
-        the JavaScript binding to keep the Element alive.
+        Reviewed by Tor Arne Vestbø.
 
-        * dom/NamedNodeMap.idl: Added CustomMarkFunction attribute.
+        [Qt] Make the OUTPUT_DIR variable in qmake projects independent of build-webkit's logic.
 
-2009-09-24  Alexey Proskuryakov  <ap@apple.com>
+        This also allows shadow builds relying only on qmake to work properly.
 
-        Reviewed by Darin Adler and Sam Weinig.
+        * WebCore.pro:
 
-        Onclick not fired for an element copied with cloneContents() or cloneNode()
-        https://bugs.webkit.org/show_bug.cgi?id=25130
+2010-03-02  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        The change here is that JS event listeners don't keep a reference to a global object from
-        where they were created, and instead take it as a parameter when parsing source code. Also,
-        the listener creation won't fail just because it happens for an element in a frameless
-        document.
-        Thus, moving nodes between documents no longer results in having incorrect registered
-        lazy event listeners on them.
+        Reviewed by Simon Hausmann.
 
-        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
-               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
-               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
-               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
-               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
+        [Qt] Avoid calling QFont::detach too often from FontQt
+        https://bugs.webkit.org/show_bug.cgi?id=35569
 
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
-        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
-        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
-        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
-        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
-        (WebCore::JSEventListener::reportError): Ditto.
+        The letter- and wordspacing is inside the WebCore::Font class,
+        our QFont is located in the WebCore::FontPlatformData. Everytime
+        we need to use a QFont inside WebCore::Font we are calling the
+        font method which gets the QFont from the WebCore::FontPlatformData
+        and is applying the letter- and wordspacing. Internally this
+        will attempt to detach the QFont...
 
-        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
-        to JSDOMGlobalObject.
+        Avoid calling setLetterSpacing and setWordSpacing on QFont if
+        the WebCore::Font has the default applied.
 
-        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
-        creation was split between this function and ScriptEventListener; moved it here, as JS
-        global object can be different now.
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::font):
 
-        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
-        which can not be determined at parsing time.
+2010-03-04  Alexander Pavlov  <apavlov@chromium.org>
 
-        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
-        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
-        expect that errors are logged at document parsing time, and because I don't know what other
-        side effects moving it vould have.
+        Reviewed by Pavel Feldman.
 
-        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
-        because JSC needs a global context here.
+        Web Inspector: Nothing happens on navigation to resource via a link if resource tracking is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=35574
 
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/objc/ObjCEventListener.h:
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::handleEvent):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::fireEventListeners):
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * inspector/InspectorDOMStorageResource.h:
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::handleEvent):
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::handleEvent):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
-        Don't pass global object to JSEventListener::create(), which no longer needs it.
-        Note that some of these functions still have an early return for null global object, which
-        can probably be removed in a later patch.
-        Pass ScriptExecutionContext to EventListener methods that now need it.
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.canShowSourceLine):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentMouseOver):
+        (WebInspector.documentMouseOut):
+        (WebInspector.hideBadLinkPopupIfNecessary):
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.showBadLinkPopup.popupOverOut):
+        (WebInspector.showBadLinkPopup):
+        (WebInspector.addMainEventListeners):
 
-2009-09-25  Enrica Casucci  <enrica@apple.com>
+2010-03-04  Vangelis Kokkevis  <vangelis@chromium.org>
 
-        Reviewed by Darin Adler, Dan Bernstein, Adele Peterson, and others.
+        Reviewed by Oliver Hunt.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29740
-        <rdar://problem/7168738> Gmail: After changing a foreground text color, pressing return doesn't apply background to new line
+        getUniformLocation() now returns null if uniform requested 
+        is not found.
+        https://bugs.webkit.org/show_bug.cgi?id=34669
+        
+        Test:LayoutTests/fast/canvas/webgl/uniform-location.html
+        (added missing test)
 
-        Change the way style is preserved when inserting a new paragraph.
-        The original code handled insertion at the beginning and at the end of a paragraph as special
-        cases. The newly created paragraph contained a set of nodes generated starting from the
-        computed style of the insertion node. This approach has two problems:
-        1. if the insertion node has a non opaque background color and one of the parent element did have
-        a solid background color the new paragraph did not have the element with the solid color in the tree.
-        2. in some circumstances it generated more markup than the original paragraph had (a span with bold, italic,
-        background color and some font attribute was being reproduced as span bold italic font as separate tags.
-        The new approach is to recreate in the new paragraph the same hierarchy of nodes found in the
-        paragraph where the insertion point is.
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getUniformLocation):
 
-        Test: editing/inserting/insert-bg-font.html
+2010-03-04  John Abd-El-Malek  <jam@chromium.org>
 
-        * editing/InsertParagraphSeparatorCommand.cpp:
-        (WebCore::InsertParagraphSeparatorCommand::getAncestorsInsideBlock): retrieves the list of all the ancestors
-        between the insert node and the outer block.
-        (WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock): uses the list of ancestors to recreate
-        in the new paragraph the same element hierarchy present in the starting paragraph.
-        (WebCore::InsertParagraphSeparatorCommand::doApply): changed the code to handle the general case of insertion
-        in the middle of the paragraph to use the new methods. Changed the handling of the insertion at the beginning and
-        at the end of the paragraph to use the new methods instead of applying the calculated style.
-        * editing/InsertParagraphSeparatorCommand.h: added methods getAncestorsInsideBlock and cloneHierarchyUnderNewBlock.
+        Reviewed by Adam Barth.
 
-2009-09-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+        Fix incorrect setup of DateExtension.
+        https://bugs.webkit.org/show_bug.cgi?id=35710
 
-        Reviewed by Timothy Hatcher.
-
-        Content-type parameters not taken into account when building form-data
-        https://bugs.webkit.org/show_bug.cgi?id=28970
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep):
 
-        existing manual test case extended with new tests
+2010-03-04  Oliver Hunt  <oliver@apple.com>
 
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ResourceView.js:
-        (WebInspector.ResourceView.prototype._refreshFormData):
-        (WebInspector.ResourceView.prototype._refreshParms):
-        * manual-tests/inspector/display-form-data.html:
+        Reviewed by Maciej Stachowiak.
 
-2009-09-25  Yuan Song  <song.yuan@ericsson.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35603
+        SVG incorrectly allows nested <use> elements in a <use> shadow tree
 
-        Reviewed by Darin Adler.
+        Simplify the handling of invalid or missing use-targets by cloning them
+        to empty <g> elements rather than just allowing the <use> element to
+        be copied into the shadow tree, as this violates a number of assumptions
+        in the shadow tree handling code.
 
-        https://bugs.webkit.org/show_bug.cgi?id=14566
+        Tests: svg/custom/use-nested-disallowed-target.svg
+               svg/custom/use-nested-missing-target-added.svg
+               svg/custom/use-nested-missing-target-removed.svg
+               svg/custom/use-nested-missing-target.svg
+               svg/custom/use-nested-notarget.svg
 
-        Raise SECURITY_ERR exception if an attempt is made to change document.domain to an invalid value.
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildPendingResource):
+        (WebCore::SVGUseElement::buildShadowAndInstanceTree):
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree):
 
-        Test: fast/js/invalid-domain-change-throws-exception.html
+2010-03-04  Leandro Pereira  <leandro@profusion.mobi>
 
-        * dom/Document.cpp:
-        (WebCore::Document::setDomain):
-        * dom/Document.h:
-        * dom/Document.idl:
+        Reviewed by Gustavo Noronha Silva.
 
-2009-09-25  Adam Barth  <abarth@webkit.org>
+        Move Cairo-related font code from platform/graphics/gtk to
+        platform/graphics/cairo, so other ports may use them.
+        http://webkit.org/b/35539
 
-        Reviewed by Dimitri Glazkov.
+        * GNUmakefile.am:
+        * platform/graphics/cairo/FontCacheCairo.cpp: Copied from WebCore/platform/graphics/gtk/FontCacheGtk.cpp.
+        * platform/graphics/cairo/FontCustomPlatformData.cpp: Copied from WebCore/platform/graphics/gtk/FontCustomPlatformData.cpp.
+        * platform/graphics/cairo/FontCustomPlatformData.h: Copied from WebCore/platform/graphics/gtk/FontCustomPlatformData.h.
+        * platform/graphics/cairo/FontPlatformData.h: Copied from WebCore/platform/graphics/gtk/FontPlatformData.h.
+        * platform/graphics/cairo/FontPlatformDataCairo.cpp: Copied from WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp.
+        * platform/graphics/cairo/GlyphPageTreeNodeCairo.cpp: Copied from WebCore/platform/graphics/gtk/GlyphPageTreeNodeGtk.cpp.
+        * platform/graphics/cairo/SimpleFontDataCairo.cpp: Copied from WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp.
+        * platform/graphics/gtk/FontCacheGtk.cpp: Removed.
+        * platform/graphics/gtk/FontCustomPlatformData.cpp: Removed.
+        * platform/graphics/gtk/FontCustomPlatformData.h: Removed.
+        * platform/graphics/gtk/FontPlatformData.h: Removed.
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp: Removed.
+        * platform/graphics/gtk/GlyphPageTreeNodeGtk.cpp: Removed.
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp: Removed.
+
+2010-03-04  Evan Stade  <estade@chromium.org>
 
-        [V8] Teach ScheduledAction::execute about isolated worlds
-        https://bugs.webkit.org/show_bug.cgi?id=27703
+        Reviewed by David Levin.
 
-        When setTimeout is called with a string argument in an isolated
-        world, we now compile the string in the isolated world.
+        https://bugs.webkit.org/show_bug.cgi?id=35261
+        [skia] crash when attempting to render certain SVGs
 
-        Last time we tried this change, we got a lot of crashes.  This
-        time we're using a fresh local handle as our context to avoid
-        trouble if the peristent handle gets disposed before we leave
-        the context.
+        This fixes the crash, but the SVG still doesn't render properly.
 
-        Test: fast/dom/timer-clear-interval-in-handler-and-generate-error.html
+        Test: svg/custom/tiling-regular-hexagonal-crash.svg
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImageSingleFrameSkia::create): don't return 0 when
+        the copy fails; instead return a blank bitmap. The caller doesn't
+        check for 0 before dereferencing.
 
-2009-09-25  Paul Godavari  <paul@chromium.org>
+2010-03-04  Tony Chang  <tony@chromium.org>
 
         Reviewed by Darin Fisher.
 
-        Fix a regression in Mac Chromium popup menus, where the user's
-        selection was ignored and the popup became unresponsive.
-        https://bugs.webkit.org/show_bug.cgi?id=29726
-
-        The fix is to notify the popup's client that the popup was hidden,
-        even if the popup has no parent.
-
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::hidePopup):
-
-2009-09-25  Alexander Pavlov  <apavlov@chromium.org>
-
-        Reviewed by Dan Bernstein.
+        Initialize m_isMultipartPayload in other ResourceResponse ctor.
+        In r55451 (bug 35628) I added an extra bool, but only initialized
+        it in one constructor.
+        https://bugs.webkit.org/show_bug.cgi?id=35719
 
-        Enable Pasteboard::writePlainText for Chromium and fix code style nits.
-        https://bugs.webkit.org/show_bug.cgi?id=29734
-
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        (WebCore::Pasteboard::writeURL):
-        * platform/mac/PasteboardMac.mm:
-        (WebCore::Pasteboard::writeSelection):
-        (WebCore::Pasteboard::writePlainText):
-        (WebCore::Pasteboard::writeURL):
-        * platform/qt/PasteboardQt.cpp:
-        (WebCore::Pasteboard::writePlainText):
-
-2009-09-25  Yongjun Zhang  <yongjun.zhang@nokia.com>
-
-        Reviewed by Ariya Hidayat.
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
 
-        https://bugs.webkit.org/show_bug.cgi?id=28876
-        [Qt] reduce peak memory consumption of text decoding.
+2010-03-03  Yuta Kitamura  <yutak@chromium.org>
 
-        Chop large input buffer into small buffers to reduce peak memory
-        during decoding.
+        Reviewed by Alexey Proskuryakov.
 
-        * platform/text/qt/TextCodecQt.cpp:
-        (WebCore::TextCodecQt::decode):
+        Add a new class that stores information about Web Socket handshake request.
 
-2009-09-24  Jon Honeycutt  <jhoneycutt@apple.com>
+        Instances of this class contain the necessary information to send a Web Socket
+        handshake request. In the future, this class will provide request information
+        to the Web Inspector.
 
-        Add a mechanism for automatically halting plug-ins.
+        WebSocketHandshake needs to provide request information
+        https://bugs.webkit.org/show_bug.cgi?id=34784
 
-        Reviewed by Oliver Hunt and Alice Liu.
+        No new tests, since the current tests will suffice (LayoutTests/websocket/*).
 
         * GNUmakefile.am:
-
-        * WebCore.base.exp:
-        Update export of Page constructor.
-
         * WebCore.gypi:
-
         * WebCore.pro:
-
         * WebCore.vcproj/WebCore.vcproj:
-        Add PluginHalter.{h,cpp}, PluginHalterClient.h, and
-        HaltablePlugin.h.
-
         * WebCore.xcodeproj/project.pbxproj:
-        Add files to Mac project.
+        * websockets/WebSocketChannel.cpp:
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::clientHandshakeMessage):
+        (WebCore::WebSocketHandshake::clientHandshakeRequest):
+        * websockets/WebSocketHandshake.h:
+        * websockets/WebSocketHandshakeRequest.cpp: Added.
+        (WebCore::WebSocketHandshakeRequest::WebSocketHandshakeRequest):
+        (WebCore::WebSocketHandshakeRequest::~WebSocketHandshakeRequest):
+        (WebCore::WebSocketHandshakeRequest::addExtraHeaderField):
+        (WebCore::WebSocketHandshakeRequest::headerFields):
+        (WebCore::WebSocketHandshakeRequest::host):
+        * websockets/WebSocketHandshakeRequest.h: Added.
+
+2010-03-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        * loader/EmptyClients.h:
-        Added an empty PluginHalterClient.
-        (WebCore::EmptyPluginHalterClient::shouldHaltPlugin):
-        Return false.
-
-        * page/PluginHalter.cpp: Added.
-        (WebCore::PluginHalter::PluginHalter):
-        (WebCore::PluginHalter::didStartPlugin):
-        Add the object to the plug-in set. If this is the only item in the set,
-        set m_oldestStartTime to this object's time, and start the timer.
-        (WebCore::PluginHalter::didStopPlugin):
-        Remove the plug-in from the set.
-        (WebCore::PluginHalter::timerFired):
-        Find the cut-off time as the current time minus the allowed run time;
-        plug-ins older than this may be halted. Iterate over the plug-ins. Find
-        the object with the oldest start time that is too young to be halted;
-        we'll use its start time to set the timer's next fire time. For all
-        plug-ins that are candidates to be halted, call the
-        PluginHalterClient's shouldHaltPlugin(). If this function returns true,
-        call the plug-in's halt() function. Remove these objects from the set
-        of tracked plug-ins. Call startTimerIfNecessary() to restart the timer.
-        (WebCore::PluginHalter::startTimerIfNecessary):
-        If the timer is set to fire, or the set of tracked plug-ins is empty,
-        return early. Set the timer to fire after the oldest plug-in has run
-        for the allowed run time.
-
-        * page/PluginHalter.h: Added.
-        (WebCore::PluginHalter::setPluginAllowedRunTime):
-
-        * page/PluginHalterClient.h: Added.
-        (WebCore::PluginHalterClient::~PluginHalterClient):
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        Initialize m_pluginHalterClient. Call pluginHalterEnabledStateChanged()
-        to create the PluginHalter if necessary.
-        (WebCore::Page::pluginHalterEnabledStateChanged):
-        If plug-in halting is enabled, create the PluginHalter. If it is
-        disabled, clear it.
-        (WebCore::Page::pluginAllowedRunTimeChanged):
-        If there is a plug-in halter, call its setPluginAllowedRunTime().
-        (WebCore::Page::didStartPlugin):
-        If there is a plug-in halter, call its didStartPlugin().
-        (WebCore::Page::didStopPlugin):
-        If there is a plug-in halter, call its didStopPlugin().
+        Build fix after r55452.
 
-        * page/Page.h:
-        Add a parameter to the Page constructor for the PluginHalterClient.
-        Added declarations for didStartPlugin() and didStopPlugin(), which are
-        called when HaltablePlugins are added to or removed from the page. Adds
-        pluginAllowedRunTimeChanged() and pluginHalterEnabledStateChanged() to
-        notify the Page when these settings are changed. Added members to hold
-        the PluginHalter and the PluginHalterClient.
+        No new tests, this is a build fix.
 
         * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setPluginHalterEnabled):
-        If the enabled state has changed, call the Page's
-        pluginHalterEnabledStateChanged().
-        (WebCore::Settings::setPluginAllowedRunTime):
-        Call the Page's pluginAllowedRunTimeChanged().
-
-        * page/Settings.h:
-        (WebCore::Settings::pluginHalterEnabled):
-        (WebCore::Settings::pluginAllowedRunTime):
-
-        * page/HaltablePlugin.h: Added. Defines an interface for plug-ins that
-        can be automatically halted.
-        (WebCore::HaltablePlugin::~HaltablePlugin):
-
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::dataChanged):
-        Pass a dummy PluginHalterClient.
+        (WebCore::Settings::setDatabasesEnabled):
 
-2009-09-24  Simon Fraser  <simon.fraser@apple.com>
+2010-03-03  Diego Gonzalez  <diego.gonzalez@openbossa.org>
 
-        Reviewed by Dan Bernstein.
-
-        REGRESSION: webkit-transform scale no longer works properly in nightly build
-        https://bugs.webkit.org/show_bug.cgi?id=29730
-        
-        When the initial or final state of a scale animation does not specify a transform,
-        use a default scale of 1, rather than zero.
-
-        Test: compositing/transitions/scale-transition-no-start.html
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::getTransformFunctionValue):
-
-2009-09-24  John Gregg  <johnnyg@google.com>
-
-        Reviewed by Eric Seidel.
-
-        isEnabled switch for notifications (experimental) in Page Settings
-        https://bugs.webkit.org/show_bug.cgi?id=28930
-
-        Adds a run-time flag in Settings object that controls whether
-        to expose desktop notifications.
-
-        No new test, but test code also modified to set this preference.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::webkitNotifications): check preference before returning notifications object
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setExperimentalNotificationsEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::experimentalNotificationsEnabled):
+        Make keyIdentifierForQtKeyCode return the unicode backspace value on Qt PlatformKeyboardEvent
 
-2009-09-24  Dan Bernstein  <mitz@apple.com>
+        LayoutTests:
+            fast/events/key-events-in-input-text.html
+            fast/events/special-key-events-in-input-text.html
 
-        Reviewed by Sam Weinig.
+        [Qt] Return the unicode backspace value in keyIdentifierForQtKeyCode on Qt PlatformKeyboardEvent
+        https://bugs.webkit.org/show_bug.cgi?id=35694
 
-        Fix <rdar://problem/7162000> Crash while trying to
-        calculate the horizontal position of image
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::keyIdentifierForQtKeyCode):
 
-        Test: fast/inline-block/relative-positioned-rtl-crash.html
+2010-03-03  Chad Faragher  <wyck@chromium.org>
 
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced): Corrected an
-        isInline() test to isRenderInline(). This is similar to r41259.
+        Reviewed by Darin Adler.
+        Changed the double-click framework code to pass adjusted page
+        coordinates for zoomed pages.  Added a new test to expose
+        mistreatment of mouse click coordinates during a double-click.
 
-2009-09-24  Jessie Berlin  <jberlin@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=35690
 
-        Reviewed by Timothy Hatcher.
+        Test: fast/events/zoom-dblclick.html
 
-        Fix expanding profile call stacks being broken after sorting.
-        https://bugs.webkit.org/show_bug.cgi?id=26423
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchMouseEvent):
 
-        * inspector/front-end/ProfileDataGridTree.js:
-        (WebInspector.ProfileDataGridNode.prototype.sort):
-        Set shouldRefreshChildren to true on collapsed nodes with children so that expanding it
-        causes the children to be placed in the right positions.
+2010-03-03  David Levin  <levin@chromium.org>
 
-2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+        No review, rolling out r55474.
 
-        Reviewed by Stephanie Lewis.
+        The patch broke fast/frames/sandboxed-iframe-storage.html
 
-        Fixed sudden termination console spew due to too many calls to
-        enableSuddenTermination.
+        Last one (I hope).
         
-        <rdar://problem/7063125> 10A410: Safari logging enableSuddenTermination errors
-
-        * page/DOMWindow.cpp:
-        (WebCore::removeUnloadEventListener):
-        (WebCore::removeAllUnloadEventListeners):
-        (WebCore::removeBeforeUnloadEventListener):
-        (WebCore::removeAllBeforeUnloadEventListeners): Only
-        enableSuddenTermination if the set of listeners is empty *and* this
-        window was in the set. Otherwise, a no-op will cause us to enableSuddenTermination.
-
-2009-09-24  Carol Szabo  <carol.szabo@nokia.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        WebKit returns "" instead of null when getting
-        inexistent, forbidden or invalidly named headers.
-        https://bugs.webkit.org/show_bug.cgi?id=29140
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::getResponseHeader):
-        Changed to return null as it should according to the spec.
-
-2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Add GYP generated files to svn:ignore
-        https://bugs.webkit.org/show_bug.cgi?id=29724
-
-        Adding the following files to the svn:ignore list (all in the
-        WebCore/WebCore.gyp directory)
-
-        WebCore.xcodeproj
-        WebCore.sln
-        WebCore.vcproj
-        WebCore_Debug.rules
-        WebCore_Release.rules
-        WebCore_Release - no tcmalloc.rules
-        WebCore_Purify.rules
-        WebCore.mk
-        WebCore_Debug_rules.mk
-        WebCore_Release_rules.mk
-        WebCore_Release - no tcmalloc_rules.mk
-        WebCore_Purify_rules.mk
-        WebCore.scons
-        WebCore_main.scons
-
-        * WebCore.gyp: Changed property svn:ignore.
-
-2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Unreviewed. Mac build fix.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
-        remove unused parameter from function signature;
-
-2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Oliver Hunt.
-
-        Implement correct horizontal scrollbar behavior for GTKalso on
-        styled scrollbars.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29348
-        [Gtk] Scrollwheel on horizontal scrollbars should slide horizontally
-
-        Test: platform/gtk/scrollbars/overflow-scrollbar-horizontal-wheel-scroll.html
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleWheelEvent): on GTK+, when using the
-        wheel with the pointer on the horizontal scrollbar, scroll
-        horizontally;
-        * platform/PlatformWheelEvent.h:
-        * platform/gtk/WheelEventGtk.cpp:
-        (WebCore::PlatformWheelEvent::swapOrientation): allow adding a
-        vertical scroll to the horizontal one;
-
-2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        StorageNamespace::storageArea() should take in a PassRefPtr<StorageOrigin>
-        https://bugs.webkit.org/show_bug.cgi?id=29290
-
-        Modified StorageNamespace::storageArea() to take in a PassRefPtr<StorageOrigin>
-        per http://webkit.org/coding/RefPtr.html
-
-        No behavior change, so no tests.
-
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::storageArea):
-        * storage/StorageNamespaceImpl.h:
-
-2009-09-24  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Added back enable/disableSuddenTermination() functionality I accidentally
-        removed in my last patch.
-
-        * page/DOMWindow.cpp:
-        (WebCore::addUnloadEventListener):
-        (WebCore::removeUnloadEventListener):
-        (WebCore::removeAllUnloadEventListeners):
-        (WebCore::addBeforeUnloadEventListener):
-        (WebCore::removeBeforeUnloadEventListener):
-        (WebCore::removeAllBeforeUnloadEventListeners):
-        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):
-        (WebCore::DOMWindow::~DOMWindow):
-        (WebCore::DOMWindow::addEventListener):
-        (WebCore::DOMWindow::removeEventListener):
-        (WebCore::DOMWindow::removeAllEventListeners):
-
-2009-09-24  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Steve Falkenburg and Mark Rowe.
-
-        Don't pass -F to GCC on non-mac platforms since it is an darwin only.
-
-        * DerivedSources.make:
-
-2009-09-24  Sam Weinig  <sam@webkit.org>
-
-        Fix windows build.
-
-        * dom/Element.idl:
-
-2009-09-23  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Revert the relevant parts of r47925, and implement an alternate
-        fix (localize the coordinate check to GraphicsContext::clipPath()).
-        This fixes http://crbug.com/21174.
-
-        Covered by LayoutTests/svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html.
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::clipPath):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::currentPathInLocalCoordinates):
-
-2009-09-24  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Merge changes from Mozilla's FTP directory parser.
-        <rdar://problem/7227620> and https://bugs.webkit.org/show_bug.cgi?id=29294
-
-        FTP layout tests not possible at this time.
-        https://bugs.webkit.org/show_bug.cgi?id=29719 tracks making them possible.
-
-        * loader/FTPDirectoryParser.cpp:
-        (WebCore::ParsingFailed):
-        (WebCore::parseOneFTPLine):
-
-2009-09-24  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] re-enable some media tests
-        https://bugs.webkit.org/show_bug.cgi?id=29716
-
-        make canPlayType() return "probably" if mime-type is known
-        and codecs string is not empty. If codecs is empty return
-        "maybe".
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::supportsType):
-
-2009-09-24  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
+        * WebCore.xcodeproj/project.pbxproj:
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29703
-        Add a function to element to check whether it matches a CSS selector
+2010-03-03  David Levin  <levin@chromium.org>
 
-        Implement Element.webkitMatchesSelector.
+        No review, rolling out r55474.
 
-        * css/CSSSelectorList.cpp:
-        (WebCore::forEachTagSelector):
-        (WebCore::forEachSelector):
-        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
-        (WebCore::CSSSelectorList::selectorsNeedNamespaceResolution):
-        * css/CSSSelectorList.h:
-        Moved code to iterate the CSSSelectorList and determine if any
-        selectors need namespace resolution from a static function in
-        Node.cpp to CSSSelectorList so that it can be used by webkitMatchesSelector
-        as well as querySelector/querySelectorAll.
+        The patch broke fast/frames/sandboxed-iframe-storage.html
 
-        * dom/Element.cpp:
-        (WebCore::Element::webkitMatchesSelector):
-        * dom/Element.h: 
-        * dom/Element.idl:
-        Implement the new function. Handles exceptional cases identically to
-        querySelector/querySelectorAll.
+        Unfortunately, (the webkit-patch rollout and) I missed these in r55485.
 
-        * dom/Node.cpp:
-        (WebCore::Node::querySelector):
-        (WebCore::Node::querySelectorAll):
-        Moved selectorsNeedNamespaceResolution to CSSSelectorList from here.
+        * bindings/js/JSDatabaseCallback.cpp: Removed.
+        * bindings/js/JSDatabaseCallback.h: Removed.
+        * bindings/v8/custom/V8DatabaseCallback.cpp: Removed.
+        * bindings/v8/custom/V8DatabaseCallback.h: Removed.
+        * storage/DatabaseCallback.h: Removed.
 
-2009-09-24  Vitaly Repeshko  <vitalyr@chromium.org>
+2010-03-02  Dumitru Daniliuc  <dumi@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        [V8] Fixed bindings build after http://trac.webkit.org/changeset/48701
-        https://bugs.webkit.org/show_bug.cgi?id=29713
+        Fix a bug that could lead to a crash. Some parts of
+        SQLTransaction::checkAndHandleClosedDatabase() should only be run
+        when that method is invoked on the DB thread.
+
+        We cannot test this fix with a test, because the crash happens
+        only when all of the following conditions are met:
+        1. A database is closing.
+        2. A transaction on that database is in progress.
+        3. The transaction is in a state where a statement/transaction
+        success/error callback needs to be invoked (so there's a task for
+        this transaction pending on the main thread).
+        4. The DB thread finished processing all its tasks and called
+        SQLTransactionCoordinator::shutdown() before the main thread go to
+        that task.
+
+        The closest thing we have to a test is running
+        LayoutTests/storage/database-lock-after-reload.html 1000 times in
+        a row. Without the patch, the probability of a crash happening in
+        one of the runs is very high. With the patch, the test should
+        reliably run 1000 times in a row without a single crash.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35624
 
-        Got rid of isWindowEvent in function signatures:
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        (WebCore::V8AbstractEventListener::handleEvent):
-        (WebCore::V8AbstractEventListener::getReceiverObject):
-        * bindings/v8/V8AbstractEventListener.h:
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::callListenerFunction):
-        * bindings/v8/V8LazyEventListener.h:
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::handleEvent):
-        (WebCore::V8WorkerContextEventListener::callListenerFunction):
-        (WebCore::V8WorkerContextEventListener::getReceiverObject):
-        * bindings/v8/V8WorkerContextEventListener.h:
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::callListenerFunction):
-        * bindings/v8/custom/V8CustomEventListener.h:
-
-        Switched to EventTarget methods of adding/removing listeners:
-        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
-        (WebCore::toEventID):
-        (WebCore::ACCESSOR_SETTER):
-
-        * dom/EventTarget.h: Some functions were incorrectly marked
-        as JSC-specific.
-
-2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Color-code watch expression errors with red.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29707
-
-        * inspector/front-end/WatchExpressionsSidebarPane.js:
-        (WebInspector.WatchExpressionsSection.prototype.update):
-        (WebInspector.WatchExpressionTreeElement.prototype.update):
-        * inspector/front-end/inspector.css:
-
-2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Fix formatting for messages derived from resource warnings,
-        couple of drive-by formatting fixes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29705
-
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addMessageToConsole):
-        * inspector/front-end/ConsoleView.js:
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._evaluateAndWrap):
-        * inspector/front-end/WatchExpressionsSidebarPane.js:
-        (WebInspector.WatchExpressionsSection.prototype.update):
-
-2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Implement InspectorController::copyNode(id).
-
-        https://bugs.webkit.org/show_bug.cgi?id=28357
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::copyNode):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
-
-2009-09-24  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY(rollout)
-
-        Roll out r48712 as it is incorrect.
-
-        Overriding getPropertyNames is incorrect.
-
-        * bridge/runtime_array.cpp:
-        * bridge/runtime_array.h:
-
-2009-09-24  Xan Lopez  <xlopez@igalia.com>
-
-        Revert r48697, since it broke key handling notification to GTK+.
-
-        * platform/gtk/KeyEventGtk.cpp:
-        (WebCore::keyIdentifierForGdkKeyCode):
-        (WebCore::singleCharacterString):
-
-2009-09-24  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] GStreamer MediaPlayer is unable to correctly querry duration
-        https://bugs.webkit.org/show_bug.cgi?id=24639
-
-        check duration returned by gst_element_query_duration() only
-        when using GStreamer < 0.10.23.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::duration):
-
-2009-09-24  Benjamin Poulain  <benjamin.poulain@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        The indices of RuntimeArray should be enumerated like for a regular array.
-        https://bugs.webkit.org/show_bug.cgi?id=29005
-
-        * bridge/runtime_array.cpp:
-        (JSC::RuntimeArray::getPropertyNames):
-        * bridge/runtime_array.h:
-
-2009-09-23  Alexander Pavlov  <apavlov@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Introduce Pasteboard::writePlaintext(const String&) so that copying
-        of the inspected elements HTML will be possible in WebInspector.
-        https://bugs.webkit.org/show_bug.cgi?id=29634
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::checkAndHandleClosedDatabase):
 
-        * platform/Pasteboard.h:
-        * platform/android/TemporaryLinkStubs.cpp:
-        (Pasteboard::writePlainText):
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/haiku/PasteboardHaiku.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/mac/PasteboardMac.mm:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/qt/PasteboardQt.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/win/PasteboardWin.cpp:
-        (WebCore::Pasteboard::writeSelection):
-        (WebCore::Pasteboard::writePlainText):
-        * platform/wince/PasteboardWince.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/wx/PasteboardWx.cpp:
-        (WebCore::Pasteboard::writeSelection):
-        (WebCore::Pasteboard::writePlainText):
-        (WebCore::Pasteboard::writeURL):
+2010-03-03  Darin Fisher  <darin@chromium.org>
 
-2009-09-24  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+        Reviewed by Mark Rowe.
 
-        Reviewed by Simon Hausmann.
+        Page should not care about Chromium plug-in implementation details
+        https://bugs.webkit.org/show_bug.cgi?id=35623
 
-        Fix QApp::translate() calls to provide the correct class name without
-        a trailing comma.
+        * WebCore.gypi: Compile PluginViewNone.cpp
+        * page/Page.cpp:
+        (WebCore::Page::privateBrowsingStateChanged): Remove conditional
+        compilation for PLATFORM(CHROMIUM).
 
-        * platform/qt/Localizations.cpp:
-        (WebCore::localizedMediaTimeDescription):
+2010-03-03  David Levin  <levin@chromium.org>
 
-2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+        No review, rolling out r55474.
+        http://trac.webkit.org/changeset/55480
 
-        More build fix: Removed JSSharedWorkerContextCustom.cpp from project
-        files, since it no longer exists in the repository.
+        The patch broke fast/frames/sandboxed-iframe-storage.html
 
+        * Android.jscbindings.mk:
+        * Android.v8bindings.mk:
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
-
-2009-09-24  Geoffrey Garen  <ggaren@apple.com>
-
-        Windows build fix: Declare set/unsetPendingActivity public, so
-        SharedWorkerScriptLoader can call them.
-
-        * dom/ActiveDOMObject.h:
-
-2009-09-24  Geoffrey Garen  <ggaren@apple.com>
-
-        Fixed a bit of the Windows build.
-
-        * workers/SharedWorker.idl: Declare a custom mark function. (I accidentally
-        removed this in my last patch.)
-        * WebCore.xcodeproj/project.pbxproj: Added JSSharedWorkerCustom.cpp back
-        to the build. (I accidentally removed this in my last patch.)
-
-2009-09-23  Geoffrey Garen  <ggaren@apple.com>
-
-        32-bit build fix: restore previous cast that I thought was unnecessary.
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::didSendData):
-        (WebCore::XMLHttpRequest::didReceiveData):
-
-2009-09-23  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bring a little sanity to this crazy EventTarget world of ours
-        https://bugs.webkit.org/show_bug.cgi?id=29701
-
-        Lots of EventTarget refactoring to achieve a single shared implementation
-        that fixes some of the performance and correctness bugs of the many individual
-        implementations, and makes reasoning about EventTargets and EventListeners
-        much easier.
-        
-        The basic design is this:
-            - EventTarget manages a set of EventListeners.
-            - onXXX EventListener attributes forward to standard EventTarget APIs.
-            - Since the onXXX code is repetitive, it is usually done with macros
-              of the form DEFINE_ATTRIBUTE_EVENT_LISTENER(attributeName).
-            - EventTarget provides a shared implementation of dispatchEvent,
-              which subclasses with special event dispatch rules, like Node, override.
-            - To support Node, which lazily instantiates its EventTarget data,
-              EventTarget has no data members, and instead makes a virtual call
-              to get its data from wherever its subclass chose to store it.
-              
-        Code that used to call dispatchEvent, passing an ExceptionCode paratmeter,
-        even though no exception could be thrown, has been changed not to do so,
-        to improve clarity and performance.
-        
-        Code that used to call a special dispatchXXXEvent function, which just
-        turned around and called dispatchEvent, has been changed to call
-        dispatchEvent, to improve clarity and performance.
-
-        * WebCore.base.exp:
-        * WebCore.xcodeproj/project.pbxproj: Another day in the life of a WebKit
-        engineer.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::isObservableThroughDOM): Updated for Node API change. Added
-        "is not in the document but is firing event listeners" as a condition
-        that makes a Node observable in the DOM, so that event listeners firing
-        on removed nodes are not destroyed midstream. (This was a long-standing
-        bug that was somewhat hidden by the old implementation's habit of
-        copying the RegisteredEventListener vector before firing events, which
-        would keep almost all the relevant objects from being destroyed.)
-
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::handleEvent): Removed the isWindowEvent flag
-        because it was one of the most elaborately planned no-ops in the history
-        of software crime, and one of the reasons clients thought they needed more
-        than one dispatchEvent function even though they didn't.
-        * bindings/js/JSEventListener.h:
-
         * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::markChildren):
-        (WebCore::JSMessagePort::markChildren):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::markChildren):
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
-        * bindings/js/JSEventSourceCustom.cpp:
-        * bindings/js/JSMessagePortCustom.cpp:
-        * bindings/js/JSSharedWorkerContextCustom.cpp: Removed.
-        * bindings/js/JSWebSocketCustom.cpp:
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::markChildren):
-        * bindings/js/JSWorkerCustom.cpp:
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::markChildren):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::markChildren): EventListener marking is
-        now autogenerated. Classes that still have custom mark functions for other
-        reasons now call a shared EventTarget API to mark their EventListeners.
-
-        * bindings/objc/ObjCEventListener.h:
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::handleEvent): Bye bye isWindowEvent.
-
-        * bindings/scripts/CodeGeneratorJS.pm: Autogeneration support for
-        marking and invalidating event listeners.
-
-        * dom/CharacterData.cpp:
-        (WebCore::CharacterData::dispatchModifiedEvent):
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::insertBefore):
-        (WebCore::ContainerNode::replaceChild):
-        (WebCore::willRemoveChild):
-        (WebCore::ContainerNode::appendChild):
-        (WebCore::dispatchChildInsertionEvents):
-        (WebCore::dispatchChildRemovalEvents):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
         * dom/Document.cpp:
-        (WebCore::Document::removeAllEventListeners):
-        (WebCore::Document::implicitClose):
-        (WebCore::Document::setFocusedNode):
-        (WebCore::Document::dispatchWindowEvent):
-        (WebCore::Document::dispatchWindowLoadEvent):
-        (WebCore::Document::finishedParsing):
-        * dom/Document.h: Use dispatchEvent directly.
-
-        * dom/Element.h: Moved a few event listener attributes down from Node,
-        since they don't apply to all Nodes, only Elements.
-
-        * dom/EventListener.h: Removed isWindowEvent parameter.
-
-        * dom/EventNames.h: Added the "display" event name, so it works correctly
-        with attribute macros, and for performance.
-
-        * dom/EventTarget.cpp:
-        (WebCore::forbidEventDispatch):
-        (WebCore::allowEventDispatch):
-        (WebCore::eventDispatchForbidden): Made this code (embarrasingly) thread
-        safe, since it's now called on multiple threads. (Currently, we only forbid
-        event dispatch on the main thread. If we ever want to forbid event dispatch
-        on secondary threads, we can improve it then.)
-
-        (WebCore::EventTarget::addEventListener):
-        (WebCore::EventTarget::removeEventListener):
-        (WebCore::EventTarget::setAttributeEventListener):
-        (WebCore::EventTarget::getAttributeEventListener):
-        (WebCore::EventTarget::clearAttributeEventListener):
-        (WebCore::EventTarget::dispatchEvent):
-        (WebCore::EventTarget::fireEventListeners):
-        (WebCore::EventTarget::getEventListeners):
-        (WebCore::EventTarget::removeAllEventListeners):
-        * dom/EventTarget.h:
-        (WebCore::FiringEventEndIterator::FiringEventEndIterator):
-        (WebCore::EventTarget::ref):
-        (WebCore::EventTarget::deref):
-        (WebCore::EventTarget::markEventListeners):
-        (WebCore::EventTarget::invalidateEventListeners):
-        (WebCore::EventTarget::isFiringEventListeners):
-        (WebCore::EventTarget::hasEventListeners): The ONE TRUE IMPLEMENTATION of
-        EventTarget APIs, crafted from an amalgam of all the different versions
-        we used to have. The most significant change here is that we no longer
-        make a copy of an EventListener vector before firing the events in the
-        vector -- instead, we use a reference to the original vector, along with
-        a notification mechanism for the unlikely case when an EventListener is
-        removed from the vector. This substantially reduces malloc, copying, and
-        refcount overhead, and complexity.
-
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::setValueFromRenderer):
-        * dom/MessageEvent.h:
-        (WebCore::MessageEvent::create): Use dispatchEvent directly.
-
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::dispatchMessages):
-        (WebCore::MessagePort::eventTargetData):
-        (WebCore::MessagePort::ensureEventTargetData):
-        * dom/MessagePort.h:
-        (WebCore::MessagePort::setOnmessage):
-        (WebCore::MessagePort::onmessage):
-        * dom/MessagePort.idl: Removed custom EventTarget implementation.
-
-        * dom/MutationEvent.h:
-        (WebCore::MutationEvent::create): Added some default values so callers
-        can construct MutationEvents more easily, without calling a custom dispatch
-        function.
-
-        * dom/Node.cpp:
-        (WebCore::Node::addEventListener):
-        (WebCore::Node::removeEventListener):
-        (WebCore::Node::eventTargetData):
-        (WebCore::Node::ensureEventTargetData):
-        (WebCore::Node::handleLocalEvents):
-        (WebCore::Node::dispatchEvent):
-        (WebCore::Node::dispatchGenericEvent):
-        (WebCore::Node::dispatchSubtreeModifiedEvent):
-        (WebCore::Node::dispatchUIEvent):
-        (WebCore::Node::dispatchKeyEvent):
-        (WebCore::Node::dispatchMouseEvent):
-        (WebCore::Node::dispatchWheelEvent):
-        (WebCore::Node::dispatchFocusEvent):
-        (WebCore::Node::dispatchBlurEvent):
-        * dom/Node.h:
-        (WebCore::Node::preDispatchEventHandler):
-        (WebCore::Node::postDispatchEventHandler):
-        * dom/Node.idl:
-        * dom/NodeRareData.h:
-        (WebCore::NodeRareData::eventTargetData):
-        (WebCore::NodeRareData::ensureEventTargetData): Use the shared EventTarget
-        interface, and call dispatchEvent directly instead of custom dispatchXXXEvent
-        functions that just forwarded to dispatchEvent.
-
-        * dom/RegisteredEventListener.cpp:
-        * dom/RegisteredEventListener.h:
-        (WebCore::RegisteredEventListener::RegisteredEventListener):
-        (WebCore::operator==): This is just a simple struct now, since we no longer
-        do a complicated copy / refCount / isRemoved dance just to honor the rule
-        that an EventListener can be removed during event dispatch.
-
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrameBase::restore): Removed another custom dispatchEvent.
-
-        * html/HTMLBodyElement.cpp:
-        * html/HTMLBodyElement.h: Use the shared EventTarget API.
-
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent):
-        (WebCore::HTMLFormControlElement::checkValidity):
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::handleLocalEvents):
-        (WebCore::HTMLFormElement::prepareSubmit):
-        (WebCore::HTMLFormElement::reset):
-        * html/HTMLFormElement.h: Use the standard dispatchEvent API.
-
-        * html/HTMLFrameSetElement.cpp:
-        * html/HTMLFrameSetElement.h: Use the shared EventTarget API.
-
-        * html/HTMLImageLoader.cpp:
-        (WebCore::HTMLImageLoader::dispatchLoadEvent):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::onSearch):
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::loadInternal):
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::dispatchLoadEvent):
-        (WebCore::HTMLScriptElement::dispatchErrorEvent):
-        * html/HTMLSourceElement.cpp:
-        (WebCore::HTMLSourceElement::errorEventTimerFired):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::notifyFinished): Use the standard dispatchEvent API.
-
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * inspector/InspectorDOMStorageResource.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopLoading):
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
-        (WebCore::HashChangeEventTask::performTask):
-        (WebCore::FrameLoader::pageHidden): No more isWindowEvent.
-
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::handleEvent):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::CallCacheListenerTask::performTask):
-        * loader/appcache/ApplicationCacheHost.cpp:
-        (WebCore::ApplicationCacheHost::notifyDOMApplicationCache):
-        * loader/appcache/ApplicationCacheHost.h:
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::eventTargetData):
-        (WebCore::DOMApplicationCache::ensureEventTargetData):
-        * loader/appcache/DOMApplicationCache.h:
-        * loader/appcache/DOMApplicationCache.idl: Switched to the standard
-        EventTarget API. As a part of this, I switched this class from using a
-        custom internal event name enumeration to using the standard EventNames.
-
-        * notifications/Notification.cpp:
-        (WebCore::Notification::eventTargetData):
-        (WebCore::Notification::ensureEventTargetData):
-        * notifications/Notification.h:
-        (WebCore::Notification::scriptExecutionContext):
-        * notifications/Notification.idl: Switched to the standard EventTarget API.
-
+        (WebCore::Document::postTask):
         * page/DOMWindow.cpp:
-        (WebCore::PostMessageTimer::event):
-        (WebCore::windowsWithUnloadEventListeners):
-        (WebCore::windowsWithBeforeUnloadEventListeners):
-        (WebCore::allowsBeforeUnloadListeners):
-        (WebCore::DOMWindow::dispatchAllPendingBeforeUnloadEvents):
-        (WebCore::DOMWindow::pendingUnloadEventListeners):
-        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Changed the "pending"
-        unload / beforeunload listener tracker just to track which windows had
-        such listeners, instead of actually keeping a copy of the listeners. Now,
-        this code can use the standard EventTarget API.
-
-        (WebCore::DOMWindow::~DOMWindow):
-        (WebCore::DOMWindow::postMessageTimerFired):
-        (WebCore::DOMWindow::addEventListener):
-        (WebCore::DOMWindow::removeEventListener):
-        (WebCore::DOMWindow::dispatchLoadEvent):
-        (WebCore::DOMWindow::dispatchEvent):
-        (WebCore::DOMWindow::removeAllEventListeners):
-        (WebCore::DOMWindow::captureEvents):
-        (WebCore::DOMWindow::releaseEvents):
-        (WebCore::DOMWindow::eventTargetData):
-        (WebCore::DOMWindow::ensureEventTargetData):
+        (WebCore::DOMWindow::openDatabase):
         * page/DOMWindow.h:
-        * page/DOMWindow.idl: Use the standard EventTarget APIs.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::canMouseDownStartSelect):
-        (WebCore::EventHandler::canMouseDragExtendSelect):
-        (WebCore::EventHandler::sendResizeEvent):
-        (WebCore::EventHandler::sendScrollEvent): Use dispatchEvent directly.
-
-        * page/EventSource.cpp:
-        (WebCore::EventSource::endRequest):
-        (WebCore::EventSource::didReceiveResponse):
-        (WebCore::EventSource::parseEventStreamLine):
-        (WebCore::EventSource::stop):
-        (WebCore::EventSource::createMessageEvent):
-        (WebCore::EventSource::eventTargetData):
-        (WebCore::EventSource::ensureEventTargetData):
-        * page/EventSource.h:
-        * page/EventSource.idl: Use the standard EventTarget APIs.
-
-        * page/FocusController.cpp:
-        (WebCore::dispatchEventsOnWindowAndFocusedNode):
-        (WebCore::FocusController::setFocusedFrame):
-        * page/Frame.cpp:
-        (WebCore::Frame::shouldClose):
-        * page/Frame.h:
-        * page/Page.cpp:
-        (WebCore::networkStateChanged):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::valueChanged):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::selectionChanged):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::subtreeHasChanged): Use dispatchEvent.
-
-        * svg/SVGElement.cpp:
-        (WebCore::hasLoadListener): Rewritten for new EventTarget API.
-
-        * svg/SVGElementInstance.cpp:
-        (WebCore::dummyEventTargetData):
-        (WebCore::SVGElementInstance::addEventListener):
-        (WebCore::SVGElementInstance::removeEventListener):
-        (WebCore::SVGElementInstance::removeAllEventListeners):
-        (WebCore::SVGElementInstance::dispatchEvent):
-        (WebCore::SVGElementInstance::eventTargetData):
-        (WebCore::SVGElementInstance::ensureEventTargetData): Use the EventTarget API.
-
-        * svg/SVGElementInstance.h:
-        * svg/SVGImageLoader.cpp:
-        (WebCore::SVGImageLoader::dispatchLoadEvent):
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::dispatchErrorEvent): Use dispatchEvent directly.
-
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::transferEventListenersToShadowTree): Updated for
-        new EventTarget API.
-
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::handleEvent): No more isWindowEvent.
-
-        * websockets/WebSocket.cpp:
-        (WebCore::ProcessWebSocketEventTask::create):
-        (WebCore::ProcessWebSocketEventTask::performTask):
-        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
-        (WebCore::WebSocket::didConnect):
-        (WebCore::WebSocket::didReceiveMessage):
-        (WebCore::WebSocket::didClose):
-        (WebCore::WebSocket::eventTargetData):
-        (WebCore::WebSocket::ensureEventTargetData):
-        * websockets/WebSocket.h:
-        * websockets/WebSocket.idl:
-        * workers/AbstractWorker.cpp:
-        (WebCore::AbstractWorker::eventTargetData):
-        (WebCore::AbstractWorker::ensureEventTargetData):
-        * workers/AbstractWorker.h:
-        * workers/AbstractWorker.idl:
-        * workers/DedicatedWorkerContext.cpp:
-        * workers/DedicatedWorkerContext.h:
-        * workers/DedicatedWorkerContext.idl:
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerConnectTask::performTask):
-        (WebCore::SharedWorkerScriptLoader::load):
-        (WebCore::SharedWorkerScriptLoader::notifyFinished):
-        * workers/SharedWorker.idl:
-        * workers/SharedWorkerContext.cpp:
-        (WebCore::createConnectEvent):
-        * workers/SharedWorkerContext.h:
-        * workers/SharedWorkerContext.idl:
-        * workers/Worker.cpp:
-        (WebCore::Worker::notifyFinished):
-        * workers/Worker.h:
-        * workers/Worker.idl:
+        * page/DOMWindow.idl:
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+        * storage/Database.h:
         * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::eventTargetData):
-        (WebCore::WorkerContext::ensureEventTargetData):
+        (WebCore::WorkerContext::openDatabase):
         * workers/WorkerContext.h:
-        * workers/WorkerContext.idl:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::MessageWorkerContextTask::performTask):
-        (WebCore::MessageWorkerTask::performTask):
-        (WebCore::WorkerExceptionTask::performTask):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
-        (WebCore::XMLHttpRequest::createRequest):
-        (WebCore::XMLHttpRequest::abort):
-        (WebCore::XMLHttpRequest::networkError):
-        (WebCore::XMLHttpRequest::abortError):
-        (WebCore::XMLHttpRequest::didSendData):
-        (WebCore::XMLHttpRequest::didReceiveData):
-        (WebCore::XMLHttpRequest::eventTargetData):
-        (WebCore::XMLHttpRequest::ensureEventTargetData):
-        * xml/XMLHttpRequest.h:
-        * xml/XMLHttpRequest.idl:
-        * xml/XMLHttpRequestProgressEvent.h:
-        (WebCore::XMLHttpRequestProgressEvent::create):
-        * xml/XMLHttpRequestUpload.cpp:
-        (WebCore::XMLHttpRequestUpload::eventTargetData):
-        (WebCore::XMLHttpRequestUpload::ensureEventTargetData):
-        * xml/XMLHttpRequestUpload.h:
-        * xml/XMLHttpRequestUpload.idl: Use new EventTarget API.
-
-2009-09-23  Kent Tamura  <tkent@chromium.org>
 
-        Reviewed by Darin Adler.
+2010-03-03  David Levin  <levin@chromium.org>
 
-        - Support for maxLength of <textarea>
-        - Move numGraphemeClusters() and numCharactersInGraphemeClusters() from InputElement to String.
-        https://bugs.webkit.org/show_bug.cgi?id=29292
+        No review, rolling out r55480.
+        http://trac.webkit.org/changeset/55480
 
-        Test: fast/forms/textarea-maxlength.html
+        The patch broke fast/frames/sandboxed-iframe-storage.html
 
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::sanitizeUserInputValue):
-        (WebCore::InputElement::handleBeforeTextInsertedEvent):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::defaultEventHandler):
-        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
-        (WebCore::HTMLTextAreaElement::sanitizeUserInputValue):
-        (WebCore::HTMLTextAreaElement::maxLength):
-        (WebCore::HTMLTextAreaElement::setMaxLength):
-        * html/HTMLTextAreaElement.h:
-        * html/HTMLTextAreaElement.idl:
-        * platform/text/PlatformString.h:
-        * platform/text/String.cpp:
-        (WebCore::String::numGraphemeClusters):
-        (WebCore::String::numCharactersInGraphemeClusters):
-
-2009-09-23  Martin Robinson  <martin.james.robinson@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
-        https://bugs.webkit.org/show_bug.cgi?id=29654
-
-        Give GDK_Backspace key events the proper text properties.
-
-        Instead of adding new tests, this change removes existing tests
-        from Gtk's skipped list.
-
-        * platform/gtk/KeyEventGtk.cpp:
-        (WebCore::keyIdentifierForGdkKeyCode):
-        (WebCore::singleCharacterString):
-
-2009-09-23  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26989
-        Should allow navigation of top-level openers
-        <rdar://problem/7034025>
-
-        Allow navigation of cross-origin window.opener if it is top-level frame.
-
-        Test: http/tests/security/frameNavigation/cross-origin-opener.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::shouldAllowNavigation):
-
-2009-09-23  Marshall Culpepper  <mculpepper@appcelerator.com>
-
-        Reviewed by Eric Seidel.
-
-        Added $(WebKitLibrariesDir)/include/cairo so cairo.h is found by
-        default when the necessary dependencies are extracted into the
-        WebKitLibrariesDir.
-        https://bugs.webkit.org/show_bug.cgi?id=29661
-
-        * WebCore.vcproj/WebCoreCairo.vsprops:
-
-2009-09-23  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
+        * storage/Database.cpp:
+        * storage/Database.h:
 
-        Crash when website does a history.back() followed by an alert()
-        https://bugs.webkit.org/show_bug.cgi?id=29686
-        rdar://problem/6984996
+2010-03-03  Mark Rowe  <mrowe@apple.com>
 
-        When loading is deferred, we need to defer timer-based loads
-        too, not just networking-driven loads. Otherwise we can get
-        syncronouse navigation while running a script, which leads to
-        crashes and other badness.
+        Reviewed by Geoff Garen.
 
-        This patch includes a manual test; an automated test may be
-        possible some time in the future.
+        Add virtual memory tags for TCMalloc and WebCore's purgeable buffers.
 
-        * dom/Document.cpp:
-        (WebCore::Document::processHttpEquiv): Use scheduleLocationChange
-        instead of scheduleHTTPRedirection to implement the navigation
-        needed for x-frame-options.
+        * platform/mac/PurgeableBufferMac.cpp:
+        (WebCore::PurgeableBuffer::create):  Use the VM tag.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader): Updated for data members with
-        new names and new data members.
-        (WebCore::FrameLoader::setDefersLoading): When turning deferral
-        off, call startRedirectionTimer and startCheckCompleteTimer, since
-        either of them might have been fired and ignored while defersLoading
-        was true.
-        (WebCore::FrameLoader::clear): Updated for replacement of the
-        m_checkCompletedTimer and m_checkLoadCompleteTimer timers.
-        (WebCore::FrameLoader::allAncestorsAreComplete): Added.
-        (WebCore::FrameLoader::checkCompleted): Added code to set
-        m_shouldCallCheckCompleted to false. Changed code that calls
-        startRedirectionTimer to call it unconditionally, since that
-        function now knows when to do work and doesn't expect callers
-        to handle that any more.
-        (WebCore::FrameLoader::checkTimerFired): Added. Replaces the old
-        timer fired callbacks. Calls checkCompleted and checkLoadComplete
-        as appropriate, but not when defersLoading is true.
-        (WebCore::FrameLoader::startCheckCompleteTimer): Added. Replaces
-        the two different calls to start timers before. Only starts the
-        timers if they are needed.
-        (WebCore::FrameLoader::scheduleCheckCompleted): Changed to call
-        startCheckCompleteTimer after setting boolean.
-        (WebCore::FrameLoader::scheduleCheckLoadComplete): Ditto.
-        (WebCore::FrameLoader::scheduleHistoryNavigation): Removed
-        canGoBackOrForward check. The logic works more naturally when
-        we don't do anything until the timer fires.
-        (WebCore::FrameLoader::redirectionTimerFired): Do nothing if
-        defersLoading is true. Also moved canGoBackOrForward check here.
-        (WebCore::FrameLoader::scheduleRedirection): Changed code that
-        calls startRedirectionTimer to do so unconditionally. That
-        function now handles the rules about when to start the timer
-        rather than expecting the caller to do so.
-        (WebCore::FrameLoader::startRedirectionTimer): Added code to
-        handle the case where there is no redirection scheduled,
-        where the timer is already active, or where this is a classic
-        redirection and there is an ancestor that has not yet completed
-        loading.
-        (WebCore::FrameLoader::completed): Call startRedirectionTimer
-        here directly instead of calling a cover named parentCompleted.
-        Hooray! One less function in the giant FrameLoader class!
-        (WebCore::FrameLoader::checkLoadComplete): Added code to set
-        m_shouldCallCheckLoadComplete to false.
-
-        * loader/FrameLoader.h: Replaced the two functions
-        checkCompletedTimerFired and checkLoadCompleteTimerFired with
-        one function, checkTimerFired. Removed the parentCompleted
-        function. Added the startCheckCompleteTimer and
-        allAncestorsAreComplete functions. Replaced the
-        m_checkCompletedTimer and m_checkLoadCompleteTimer data
-        members with m_checkTimer, m_shouldCallCheckCompleted, and
-        m_shouldCallCheckLoadComplete.
-
-        * manual-tests/go-back-after-alert.html: Added.
-        * manual-tests/resources/alert-and-go-back.html: Added.
-
-2009-09-23  David Kilzer  <ddkilzer@apple.com>
-
-        <http://webkit.org/b/29660> Move "Generate 64-bit Export File" build phase script into DerivedSources.make
+2010-03-03  Dumitru Daniliuc  <dumi@chromium.org>
 
-        Reviewed by Mark Rowe.
+        Reviewed by nobody, build fix.
 
-        The "Generate 64-bit Export File" build phase script generated
-        the WebCore.LP64.exp export file used to link 64-bit WebCore.
-        Instead of having a separate build phase script, move its
-        generation into DerivedSources.make where WebCore.exp is
-        generated.
+        Move #include "DatabaseCallback.h" from Database.h to
+        Database.cpp.
 
-        * DerivedSources.make: Added a rule to make WebCore.LP64.exp.
-        Added code to append WebCore.PluginHostProcess.exp to
-        $(WEBCORE_EXPORT_DEPENDENCIES) when WTF_USE_PLUGIN_HOST_PROCESS
-        is set to 1.
-        * WebCore.PluginHostProcess.exp: Renamed from WebCore/WebCore.LP64.exp.
-        * WebCore.xcodeproj/project.pbxproj: Removed the "Generate
-        64-bit Export File" build phase script. Renamed WebCore.LP64.exp
-        to WebCore.PluginHostProcess.exp.
+        * storage/Database.cpp:
+        * storage/Database.h:
 
-2009-09-23  Peter Kasting  <pkasting@google.com>
+2010-03-03  Darin Adler  <darin@apple.com>
 
-        Reviewed by Dimitri Glazkov.
+        Fixed Mac build.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29694
-        [Chromium] Eliminate dependency on gfx::Rect from ImageSkia.
+        * WebCore.xcodeproj/project.pbxproj: Marked a couple of headers "private" so they can
+        be used in the WebKit project.
 
-        * platform/graphics/skia/ImageSkia.cpp:
-        (WebCore::drawResampledBitmap):
+2010-03-03  Alexey Proskuryakov  <ap@apple.com>
 
-2009-09-22  Timothy Hatcher  <timothy@apple.com>
+        Reviewed by Adele Peterson.
 
-        Prevent scrolling multiple elements during latched wheel events.
+        https://bugs.webkit.org/show_bug.cgi?id=35044
+        Crash in XML tokenizer reloading zoom-coords-viewattr-01-b.svg
 
-        Reviewed by Anders Carlsson.
+        I'm often getting a crash even when opening the test for the first time in Safari, but it
+        doesn't seem to crash in DumpRenderTree. Still, I can't think of a stronger way to test for
+        this condition, so no new regression test.
 
-        * page/EventHandler.cpp:
-        (WebCore::scrollAndAcceptEvent):
-        (WebCore::EventHandler::clear):
-        (WebCore::EventHandler::handleWheelEvent):
-        * page/EventHandler.h:
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::scroll):
-        * rendering/RenderBox.h:
+        * dom/XMLTokenizer.cpp: (WebCore::XMLTokenizer::end): Be prepared that parsing remaining
+        input will pause parsing.
 
-2009-09-23  Daniel Bates  <dbates@webkit.org>
+2010-03-03  Dumitru Daniliuc  <dumi@chromium.org>
 
         Reviewed by Adam Barth.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29523
-        
-        Fixes an issue where a JavaScript URL that was URL-encoded twice can bypass the
-        XSSAuditor.
-        
-        The method FrameLoader::executeIfJavaScriptURL decodes the URL escape 
-        sequences in a JavaScript URL before it is eventually passed to the XSSAuditor.
-        Because the XSSAuditor also decodes the URL escape sequences as part of its
-        canonicalization, the double decoding of a JavaScript URL would
-        not match the canonicalization of the input parameters.
-
-        Tests: http/tests/security/xssAuditor/iframe-javascript-url-url-encoded.html
-               http/tests/security/xssAuditor/javascript-link-url-encoded.html
-
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): Moved call to 
-        XSSAuditor::canEvaluateJavaScriptURL into FrameLoader::executeIfJavaScriptURL.
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): Ditto.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::executeIfJavaScriptURL): Modified to call 
-        XSSAuditor::canEvaluateJavaScriptURL on the JavaScript URL before it is
-        decoded.
-
-2009-09-22  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by John Sullivan.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29657
-        Columns don't break properly in positioned elements with a fixed height.  Make sure that
-        a block is still considered to have columns even when the column count is 1 if the column
-        width is non-auto.
-    
-        Added fast/multicol/positioned-with-constrained-height.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::setDesiredColumnCountAndWidth):
-
-2009-09-23  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Rubber-stamped by Simon Hausmann.
-
-        Add a null check for the Document*. In the mirror benchmarking
-        application a crash from a call from JavaScript was observed.
-
-        I was not able to come up with a test case for this issue.
-
-        * platform/qt/CookieJarQt.cpp:
-        (WebCore::cookieJar):
-
-2009-09-23  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix the Qt/Windows build, after the introduction of
-        the page client.
-
-        * plugins/win/PluginViewWin.cpp:
-        (windowHandleForPageClient):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::platformStart):
-
-2009-09-23  Gustavo Noronha Silva  <gns@gnome.org>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] media tests failing after their rework
-        https://bugs.webkit.org/show_bug.cgi?id=29532
-
-        Correctly advertise the mime types used by the common formats used
-        in the tests.
-
-        Tests that regressed, and will pass again:
-
-           media/video-canvas-source.html
-           media/video-controls.html
-           media/video-currentTime-set2.html
-           media/video-dom-autoplay.html
-           media/video-dom-src.html
-           media/video-error-abort.html
-           media/video-load-networkState.html
-           media/video-load-readyState.html
-           media/video-muted.html
-           media/video-no-autoplay.html
-           media/video-pause-empty-events.html
-           media/video-play-empty-events.html
-           media/video-seekable.html
-           media/video-seeking.html
-           media/video-size.html
-           media/video-source-type-params.html
-           media/video-source-type.html
-           media/video-source.html
-           media/video-src-change.html
-           media/video-src-invalid-remove.html
-           media/video-src-remove.html
-           media/video-src-set.html
-           media/video-src-source.html
-           media/video-src.html
-           media/video-timeupdate-during-playback.html
-           media/video-volume.html
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::mimeTypeCache):
-
-2009-09-22  Charles Wei  <charles.wei@torchmobile.com.cn>
-
-        Reviewed by Eric Seidel.
-
-        Fix the crash problem with absolte positioned children in foreignobject
-        htts://bugs.webkit.org/show_bug.cgi?id=26342
-
-        Test: svg/custom/foreignobject-crash-with-absolute-positioned-children.svg
-
-        * rendering/RenderForeignObject.h:
-        (WebCore::RenderForeignObject::isSVGForeignObject):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::containingBlock):
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isSVGForeignObject):
-
-2009-09-22  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        SharedWorkers "name" attribute is now optional.
-        https://bugs.webkit.org/show_bug.cgi?id=28897
-
-        Test: fast/workers/shared-worker-name.html
-
-        * bindings/js/JSSharedWorkerConstructor.cpp:
-        (WebCore::constructSharedWorker):
-        Default 'name' attribute to empty string if it is not provided.
-        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        Default 'name' attribute to empty string if it is not provided.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::matches):
-        Now matches URLs if names are empty strings.
-        (WebCore::DefaultSharedWorkerRepository::getProxy):
-        Pass URL in to SharedWorkerProxy::matches().
-
-2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, another build fix.
-
-        [Chromium] Add another missing include.
-        https://bugs.webkit.org/show_bug.cgi?id=29536
-
-        * inspector/InspectorController.cpp: Added DOMWindow.h include.
-
-2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [Chromium] Add missing include.
-        https://bugs.webkit.org/show_bug.cgi?id=29536
-
-        * inspector/InspectorDOMStorageResource.cpp: Added DOMWindow.h include.
-
-2009-09-22  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Tighten up the ScheduledRedirection machinery to prepare for a bug fix
-        https://bugs.webkit.org/show_bug.cgi?id=29663
-
-        * loader/FrameLoader.cpp:
-        (WebCore::ScheduledRedirection::ScheduledRedirection): Added a boolean,
-        initialized to false, to keep track if the redirection has been
-        communicated to the client.
-        (WebCore::FrameLoader::stopLoading): Tweaked a comment.
-        (WebCore::FrameLoader::cancelRedirection): Removed code to clear
-        m_scheduledRedirection.clear since stopRedirectionTimer does that now.
-        (WebCore::FrameLoader::allChildrenAreComplete): Added.
-        (WebCore::FrameLoader::checkCompleted): Use allChildrenAreComplete
-        function for clarity.
-        (WebCore::FrameLoader::checkCallImplicitClose): Ditto.
-        (WebCore::FrameLoader::scheduleRedirection): Changed to take a PassOwnPtr.
-        (WebCore::FrameLoader::startRedirectionTimer): Added code to set the
-        toldClient flag and not call clientRedirected a second time if it is set.
-        (WebCore::FrameLoader::stopRedirectionTimer): Changed so this can be safely
-        called multiple times and it will call clientRedirectCancelledOrFinished
-        only once.
-
-        * loader/FrameLoader.h: Changed scheduleRedirection to be a PassOwnPtr.
-        Added allChildrenAreComplete function.
-
-2009-09-22  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Migrate Databases tab to InjectedScript /
-        serialized interaction.
-
-        DOMStorage interaction is now serialized into JSON messages
-        and doesn't require quarantined objects.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=28873
-
-        * dom/EventListener.h:
-        (WebCore::EventListener::):
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::selectDOMStorage):
-        (WebCore::InspectorBackend::getDOMStorageEntries):
-        (WebCore::InspectorBackend::setDOMStorageItem):
-        (WebCore::InspectorBackend::removeDOMStorageItem):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::selectDOMStorage):
-        (WebCore::InspectorController::getDOMStorageEntries):
-        (WebCore::InspectorController::setDOMStorageItem):
-        (WebCore::InspectorController::removeDOMStorageItem):
-        (WebCore::InspectorController::getDOMStorageResourceForId):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
-        (WebCore::InspectorDOMStorageResource::bind):
-        (WebCore::InspectorDOMStorageResource::unbind):
-        (WebCore::InspectorDOMStorageResource::startReportingChangesToFrontend):
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        (WebCore::InspectorDOMStorageResource::operator==):
-        * inspector/InspectorDOMStorageResource.h:
-        (WebCore::InspectorDOMStorageResource::cast):
-        (WebCore::InspectorDOMStorageResource::id):
-        (WebCore::InspectorDOMStorageResource::domStorage):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::selectDOMStorage):
-        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
-        (WebCore::InspectorFrontend::didSetDOMStorageItem):
-        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
-        (WebCore::InspectorFrontend::updateDOMStorage):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/DOMStorage.js:
-        (WebInspector.DOMStorage):
-        (WebInspector.DOMStorage.prototype.get id):
-        (WebInspector.DOMStorage.prototype.get domStorage):
-        (WebInspector.DOMStorage.prototype.get isLocalStorage):
-        (WebInspector.DOMStorage.prototype.getEntriesAsync):
-        (WebInspector.DOMStorage.prototype.setItemAsync):
-        (WebInspector.DOMStorage.prototype.removeItemAsync):
-        * inspector/front-end/DOMStorageDataGrid.js:
-        (WebInspector.DOMStorageDataGrid):
-        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
-        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
-        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
-        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
-        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
-        * inspector/front-end/DOMStorageItemsView.js:
-        (WebInspector.DOMStorageItemsView.prototype.update):
-        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
-        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel.prototype.show):
-        (WebInspector.StoragePanel.prototype.reset):
-        (WebInspector.StoragePanel.prototype.selectDOMStorage):
-        (WebInspector.StoragePanel.prototype.updateDOMStorage):
-        (WebInspector.StoragePanel.prototype._domStorageForId):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addDOMStorage):
-        (WebInspector.updateDOMStorage):
-
-2009-09-22  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Fix for XMLHttpRequest.abort() should destroy the response text.
-        https://bugs.webkit.org/show_bug.cgi?id=29658
-        <rdar://problem/5301430>
-
-        Clearing the response text after calling XMLHttpRequest.abort() is necessary
-        per spec and matches Firefox. It is also a potential memory win.
-
-        Test: http/tests/xmlhttprequest/abort-should-destroy-responseText.html
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::abort): Clear the response text making sure to
-        keep the actual ResourceReponse around so that the response status and response
-        status text are kept around.
-
-2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        No review, rolling out r48639.
-        http://trac.webkit.org/changeset/48639
-
-        * bindings/v8/V8GCController.cpp:
-        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
-
-2009-09-22  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Changing the transaction coordinator to (re-)allow multiple read
-        transactions on the same database to run concurrently (without
-        risking a deadlock this time).
-
-        https://bugs.webkit.org/show_bug.cgi?id=29115
-
-        Tests: storage/read-and-write-transactions-dont-run-together.html
-               storage/read-transactions-running-concurrently.html
-
-        * storage/SQLTransaction.h:
-        (WebCore::SQLTransaction::isReadOnly): Returns the type of the
-        transaction.
-        * storage/SQLTransactionCoordinator.cpp:
-        (WebCore::SQLTransactionCoordinator::acquireLock): Changed to
-        allow multiple read transactions on the same DB to run
-        concurrently.
-        (WebCore::SQLTransactionCoordinator::releaseLock): Changed to
-        allow multiple read transactions on the same DB to run
-        concurrently.
-        (WebCore::SQLTransactionCoordinator::shutdown): Renamed the map.
-        * storage/SQLTransactionCoordinator.h:
-
-2009-09-22  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29652
-        Support true system colors for CSS system colors in Chromium/Win.
-
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::cssValueIdToSysColorIndex):
-        (WebCore::RenderThemeChromiumWin::systemColor):
-        * rendering/RenderThemeChromiumWin.h:
-
-2009-09-22  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Fix for <rdar://problem/6925121> SAP: Wrong width calculation in 
-        table with fixed layout
-        -and corresponding-
-        https://bugs.webkit.org/show_bug.cgi?id=29501
+        Adding support for the optional creation callback that could be
+        passed to openDatabase().
 
-        New Tests:
-        * fast/table/fixed-table-with-percent-inside-percent-table.html: Added.
-        * fast/table/fixed-table-with-percent-width-inside-auto-table.html: Added.
-        * fast/table/fixed-table-with-percent-width-inside-div.html: Added.
-        * fast/table/fixed-table-with-percent-width-inside-extra-large-div.html: Added.
-        * fast/table/fixed-table-with-percent-width-inside-fixed-width-table.html: Added.
-        * fast/table/fixed-table-with-small-percent-width.html: Added.
+        Test: storage/open-database-creation-callback.html
 
-        This new quirk is very similar to an existing one that was 
-        implemented in revision 4316.
-        * rendering/FixedTableLayout.cpp:
-        (WebCore::FixedTableLayout::calcPrefWidths):
+        https://bugs.webkit.org/show_bug.cgi?id=34726
 
-2009-09-22  Brian Weinstein  <bweinstein@apple.com>
+        * Android.jscbindings.mk
+        * Android.v8bindings.mk
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::openDatabase):
+        * bindings/js/JSDatabaseCallback.cpp: Added.
+        (WebCore::JSDatabaseCallback::JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::~JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::handleEvent):
+        * bindings/js/JSDatabaseCallback.h: Added.
+        (WebCore::JSDatabaseCallback::create):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::openDatabaseCallback):
+        * bindings/v8/custom/V8DatabaseCallback.cpp: Added.
+        (WebCore::V8DatabaseCallback::V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::~V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::handleEvent):
+        * bindings/v8/custom/V8DatabaseCallback.h: Added.
+        (WebCore::V8DatabaseCallback::create):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::openDatabase):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * storage/Database.cpp:
+        (WebCore::DatabaseCreationCallbackTask::create):
+        (WebCore::DatabaseCreationCallbackTask::performTask):
+        (WebCore::DatabaseCreationCallbackTask::DatabaseCreationCallbackTask):
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+        (WebCore::Database::performCreationCallback):
+        * storage/Database.h:
+        (WebCore::Database::isNew):
+        * storage/DatabaseCallback.h: Added.
+        (WebCore::DatabaseCallback::~DatabaseCallback):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        * workers/WorkerContext.h:
 
-        Reviewed by Timothy Hatcher.
+2010-03-03  Alexander Pavlov  <apavlov@chromium.org>
 
-        List HTTP status code with response headers in resources tab of Web Inspector.
-        http://webkit.org/b/19945
+        Reviewed by Pavel Feldman.
 
-        This patch adds a new top level list in the resources tab, HTTP Information, that 
-        for now, contains the Request Method (GET, POST, etc.) and the Status Code (200, 404, etc.).
-        Additionally, it adds a colored dot next to the requested URL to show the status 
-        (green for success, orange for redirect, red for error).
+        Web Inspector: resources panel only shows uncompressed resource size.
+        https://bugs.webkit.org/show_bug.cgi?id=35403
 
         * English.lproj/localizedStrings.js:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.GzipRule.prototype.doRun):
+        (WebInspector.AuditRules.GzipRule.prototype._shouldCompress):
         * inspector/front-end/ImageView.js:
         (WebInspector.ImageView):
-        * inspector/front-end/Images/errorRedDot.png: Added.
-        * inspector/front-end/Images/successGreenDot.png: Added.
-        * inspector/front-end/Images/warningOrangeDot.png: Added.
         * inspector/front-end/Resource.js:
-        (WebInspector.Resource.StatusTextForCode):
-        * inspector/front-end/ResourceView.js:
-        (WebInspector.ResourceView):
-        (WebInspector.ResourceView.prototype._refreshURL):
-        (WebInspector.ResourceView.prototype._refreshHTTPInformation):
+        (WebInspector.Resource.prototype.get resourceSize):
+        (WebInspector.Resource.prototype.set resourceSize):
+        (WebInspector.Resource.prototype.get transferSize):
+        (WebInspector.Resource.CompareBySize):
+        (WebInspector.Resource.CompareByTransferSize):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.populateSidebar):
+        (WebInspector.ResourceTimeCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.ResourceTransferSizeCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.ResourceTransferSizeCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.ResourceTransferSizeCalculator.prototype._value):
+        (WebInspector.ResourceTransferSizeCalculator.prototype._networkBytes):
+        (WebInspector.ResourceSidebarTreeElement.CompareByDescendingTransferSize):
+        (WebInspector.ResourceGraph.prototype.refreshLabelPositions):
+        (WebInspector.ResourceGraph.prototype.refresh):
         * inspector/front-end/inspector.css:
-
-2009-09-22  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Back list isn't properly updated for fragment changes after a redirect.
-        <rdar://problem/6142803> and https://bugs.webkit.org/show_bug.cgi?id=20355
-
-        Test: fast/loader/fragment-after-redirect-gets-back-entry.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadURL): Properly reset the policy FrameLoadType before
-          consulting the policy delegate for fragment scrolling.
-
-2009-09-22  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Drop down selects get stuck in the non-visible state and cannot be opened.
-        https://bugs.webkit.org/show_bug.cgi?id=29645
-
-        All paths that lead to hiding the popup menu must call popupDidHide on
-        the PopupMenuClient.  This change makes it so by moving all of the
-        hiding logic to PopupListBox::hidePopup.
-
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupContainer::hidePopup):
-        (WebCore::PopupListBox::hidePopup):
-        * platform/chromium/PopupMenuChromium.h:
-
-2009-09-22  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector.log() function not protected if console not yet created
-        https://bugs.webkit.org/show_bug.cgi?id=29336
-        
-        No new tests.  Only affects Web Inspector developers adding logging
-        to their code during development.
-
         * inspector/front-end/inspector.js:
-        (WebInspector.log.isLogAvailable):
-        (WebInspector.log.flushQueue):
-        (WebInspector.log.flushQueueIfAvailable):
-        (WebInspector.log.logMessage):
-        (WebInspector.log):
-
-2009-09-22  Yaar Schnitman  <yaar@chromium.org>
-
-        Reviewed by David Levin.
-
-        Ported chromium.org's webcore.gyp for the webkit chromium port.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29617
-
-        * WebCore.gyp/WebCore.gyp: Added.
-
-2009-09-22  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        [v8] Don't keep clean wrappers artificially alive        
-        We currently keep all DOM node wrappers alive, even when there are
-        no more references to them from JS, in case they have properties
-        that we need to keep around if new JS references are created.
-        This changes the policy to only keep wrappers artificially alive
-        if they have changed since they were created. Empty wrappers are
-        discarded and recreated as needed.
-        https://bugs.webkit.org/show_bug.cgi?id=29330
-
-        * bindings/v8/V8GCController.cpp:
-        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
-
-2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: console.count and console.timeEnd
-        crash when inspector is opened.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29632
-
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addMessageToConsole):
-
-2009-09-22  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed.
-
-        Fix bogus build fix I did last night.
-
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-
-2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        NPAPI/Mac: Don't paint plugins if we don't have a CGContextRef
-
-        * plugins/mac/PluginViewMac.cpp:
-
-2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reivewed by Simon Hausmann.
-
-        Fix the Qt/Mac build after r48604 (Implement new QWebPageClient class)
-
-        There's no QWidget::x11Info() on Mac, and setPlatformPluginWidget()
-        takes a QWidget*, not a QWebPageClient*
-
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::platformStart):
-
-2009-09-21  Adam Barth  <abarth@webkit.org>
-
-        Attempted fix for the V8 build.
-
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-
-2009-09-21  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        Don't re-enter JavaScript after performing access checks
-        https://bugs.webkit.org/show_bug.cgi?id=29531
-
-        Moved the access check slightly later in this functions to avoid
-        re-entering the JavaScript interpreter (typically via toString)
-        after performing the access check.
-
-        I can't really think of a meaningful test for this change.  It's more
-        security hygiene.
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::setLocation):
-        (WebCore::JSDOMWindow::open):
-        (WebCore::JSDOMWindow::showModalDialog):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::setHref):
-        (WebCore::JSLocation::replace):
-        (WebCore::JSLocation::assign):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        (WebCore::if):
-        (CALLBACK_FUNC_DECL):
-        (V8Custom::WindowSetLocation):
-        (V8Custom::ClearTimeoutImpl):
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-09-21  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Make all write transaction start with a BEGIN IMMEDIATE command
-        instead of BEGIN.
-
-        We cannot test this change in a layout test, because in order to
-        test it we need to spawn two database threads and execute
-        transaction steps on these two threads in a very specific order,
-        which seems impossible to do when they share the same main thread
-        (as they would in a layout test). The SQLite docs and the case
-        described in the bug though should be enough proof that we do have
-        a problem here and that this patch will fix it.
-
-        Relevant SQLite documentation:
-        http://www.sqlite.org/lang_transaction.html
-        http://www.sqlite.org/lockingv3.html#locking
-
-        https://bugs.webkit.org/show_bug.cgi?id=29218
-
-        * platform/sql/SQLiteTransaction.cpp:
-        (WebCore::SQLiteTransaction::SQLiteTransaction): Added a readOnly
-        parameter.
-        (WebCore::SQLiteTransaction::begin): Changed to BEGIN IMMEDIATE
-        for write transactions.
-        * platform/sql/SQLiteTransaction.h:
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::openTransactionAndPreflight): Passing
-        the read-only flag to the SQLiteTransaction instance.
-
-2009-09-21  Brady Eidson  <beidson@apple.com>
-
-        Rubberstamped by Mark Rowe.
-
-        * DerivedSources.make: Fix the Xcode build on SnowLeopard.
-
-2009-09-15  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Prevent sleeps in unload handlers.
-        https://bugs.webkit.org/show_bug.cgi?id=29193
-
-        Test: fast/dom/Window/slow_unload_handler.html
-
-        * WebCore.gypi:
-        * bindings/v8/DateExtension.cpp: Added.
-        (WebCore::DateExtension::DateExtension):
-        (WebCore::DateExtension::get):
-        (WebCore::DateExtension::setAllowSleep):
-        (WebCore::DateExtension::GetNativeFunction):
-        (WebCore::DateExtension::weakCallback):
-        (WebCore::DateExtension::GiveEnableSleepDetectionFunction):
-        (WebCore::DateExtension::OnSleepDetected):
-        * bindings/v8/DateExtension.h: Added.
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::createNewContext):
-        (WebCore::V8Proxy::registerExtensionWithV8):
-        (WebCore::V8Proxy::registeredExtensionWithV8):
-        * bindings/v8/V8Proxy.h:
-
-2009-09-21  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Run-time exception in onmessage handler is not forwarded to the
-        worker object.
-        https://bugs.webkit.org/show_bug.cgi?id=28980
-
-        The previous fix was partially reverted due to a reliability build break
-        in chromium. The break happens when an exception is thrown without
-        setting a message. We need to check for this scenario and handle it.
-
-        Tested by worker-close.html.
-
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::reportException):
-
-2009-09-21  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Simon Fraser & Sam Weinig.
+        (WebInspector.updateResource):
 
-        Add ENABLE(ORIENTATION_EVENTS)
-        https://bugs.webkit.org/show_bug.cgi?id=29508
-        
-        See documentation here:
-        http://developer.apple.com/safari/library/documentation/AppleApplications/Reference/SafariWebContent/HandlingEvents/HandlingEvents.html#//apple_ref/doc/uid/TP40006511-SW16
-
-        * DerivedSources.make: Use new WebCore.OrientationEvents.exp file if ENABLE_ORIENTATION_EVENTS.
-        Add ENABLE_ORIENTATION_EVENTS to the new ADDITIONAL_IDL_DEFINES variable that is passed to the IDL
-        code generator. This is because ENABLE_ORIENTATION_EVENTS is not in FEATURE_DEFINES.
-        * WebCore.OrientationEvents.exp: Added.
-        * WebCore.xcodeproj/project.pbxproj: Add WebCore.OrientationEvents.exp.
-        * dom/EventNames.h: Add onorientationchange.
-        * html/HTMLAttributeNames.in: Ditto.
-        * html/HTMLBodyElement.cpp: Handle onorientationchange properly.
-        (WebCore::HTMLBodyElement::parseMappedAttribute):
-        (WebCore::HTMLBodyElement::onorientationchange):
-        (WebCore::HTMLBodyElement::setOnorientationchange):
-        * html/HTMLBodyElement.h: Ditto.
-        * html/HTMLBodyElement.idl: Ditto.
-        * html/HTMLFrameSetElement.cpp: Ditto.
-        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
-        (WebCore::HTMLFrameSetElement::onorientationchange):
-        (WebCore::HTMLFrameSetElement::setOnorientationchange):
-        * html/HTMLFrameSetElement.h: Ditto.
-        * html/HTMLFrameSetElement.idl: Ditto.
-        * page/DOMWindow.cpp: Ditto.
-        (WebCore::DOMWindow::orientation): Calls up the to the Frame for the orientation value.
-        (WebCore::DOMWindow::onorientationchange):
-        (WebCore::DOMWindow::setOnorientationchange):
-        * page/DOMWindow.h: Handle onorientationchange properly.
-        * page/DOMWindow.idl: Ditto.
-        * page/Frame.cpp: Ditto.
-        (WebCore::Frame::Frame):
-        (WebCore::Frame::sendOrientationChangeEvent):
-        * page/Frame.h: Ditto.
-        (WebCore::Frame::orientation):
+2010-03-03  Dan Bernstein  <mitz@apple.com>
 
-2009-09-18  Anders Carlsson  <andersca@apple.com>
+        Build fix.
 
-        Try fixing the build again.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::wndProc):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren):
 
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-03  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: completions are always evaluated against
-        window (discarding call frames).
+        Web Inspector: Get rid of synchronous debuggerEnabled, profilerEnabled calls.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29616
+        https://bugs.webkit.org/show_bug.cgi?id=32331
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getCompletions):
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.profilerWasEnabled):
+        (WebInspector.ProfilesPanel.prototype.profilerWasDisabled):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._enableProfiling):
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
         * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.selectedCallFrameId):
-
-2009-09-21  Brent Fulgham  <bfulgham@webkit.org>
-
-        Unreviewed build fix for Windows (Cairo) target.
-
-        Add stubs for SocketStream classes added in @r47788, which
-        broke the WinCairo build.
-
-        No new tests. (Build failure).
-
-        * WebCore.vcproj/WebCore.vcproj:  Add references to new files
-          to Cairo build, exclude from standard Apple build.
-        * platform/network/curl/SocketStreamError.h: Added.
-        * platform/network/curl/SocketStreamHandle.h: Added.
-        * platform/network/curl/SocketStreamHandleCurl.cpp: Added.
-
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Expose InspectorResource fields.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29537
-
-        * inspector/InspectorResource.cpp:
-        (WebCore::InspectorResource::sourceString):
-        (WebCore::InspectorResource::resourceData):
-        * inspector/InspectorResource.h:
-        (WebCore::InspectorResource::requestHeaderFields):
-        (WebCore::InspectorResource::responseHeaderFields):
-        (WebCore::InspectorResource::responseStatusCode):
-        (WebCore::InspectorResource::requestMethod):
-        (WebCore::InspectorResource::requestFormData):
-
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: JS error drilling down childless node.
-        No need to dispatch double click twice - it is already handled
-        in TreeElement.treeElementDoubleClicked.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22144
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline):
-
-2009-09-21  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Implement new QWebPageClient class and let our classes
-        QWebViewPrivate and QWebGraphicsItemPrivate inherit from it.
-
-        For Qt, platformPageClient() will now return a class derived from
-        the QWebPageClient, so the patch adapts our Qt hooks to go though
-        this class and not depend on the QWebView.
-
-        * WebCore.pro:
-        * platform/Widget.h:
-        * platform/qt/PlatformScreenQt.cpp:
-        (WebCore::screenDepth):
-        (WebCore::screenDepthPerComponent):
-        (WebCore::screenIsMonochrome):
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/qt/QWebPageClient.h: Added.
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::setCursor):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::platformStart):
-
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Evaluating on call frame always returns "undefined".
-
-        https://bugs.webkit.org/show_bug.cgi?id=29613
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.evaluate):
-        (InjectedScript._evaluateAndWrap):
-        (InjectedScript._evaluateOn):
-        (InjectedScript.evaluateInCallFrame):
-
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Exception formatting is broken in console.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29608
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleCommandResult):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.evaluate):
-        (InjectedScript.createProxyObject):
-
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Console object formatting is broken.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29607
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleMessage.prototype._format):
-        * inspector/front-end/ObjectProxy.js:
-        (WebInspector.ObjectProxy.wrapPrimitiveValue):
-
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Crash When Logging an Element Before Opening Inspector
-
-        https://bugs.webkit.org/show_bug.cgi?id=29514
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::populateScriptObjects):
-
-2009-09-21  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Incorrect clipping with accelerated compositing content, and position:fixed
-        https://bugs.webkit.org/show_bug.cgi?id=29347
-        
-        Fix the compositing clipping logic to behave correctly when position:fixed
-        elements clip, by using the new backgroundClipRect() method to determine
-        when we need to clip, and to compute the clipping layer position.
-
-        Test: compositing/overflow/fixed-position-ancestor-clip.html
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::clippedByAncestor):
-
-2009-09-21  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Add back in a special case for window.top in the V8 bindings.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29605
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasEnabled):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasDisabled):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype.canShowSourceLine):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        (WebInspector.ScriptsPanel.prototype._enableDebugging):
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
 
-        Fixes LayoutTests/fast/dom/Window/window-property-shadowing.html in the Chromium port.
+2010-03-03  Eric Carlson  <eric.carlson@apple.com>
 
-        * bindings/scripts/CodeGeneratorV8.pm: Ensure window.top is not marked as read only, as this breaks the shadowing disabling.
+        Reviewed by Adele Peterson.
 
-2009-09-21  Eric Carlson  <eric.carlson@apple.com>
+        Replace 'autobuffer' attribute with 'preload' to align with spec revision 4811.
+        https://bugs.webkit.org/show_bug.cgi?id=35385
+        rdar://problem/7689602
 
-        Reviewed by Brady Eidson.
+        Tests: media/audio-constructor-preload.html
+               media/video-dom-preload.html
 
-        HTMLMediaElement: media file should not reload when page comes out of page cache
-        https://bugs.webkit.org/show_bug.cgi?id=29604
+        * html/HTMLAttributeNames.in: Remove autobuffer, add preload
 
-        Test: media/restore-from-page-cache.html
+        * html/HTMLAudioElement.cpp:
+        (WebCore::HTMLAudioElement::createForJSConstructor): set preload to 'auto' instead of 
+            autobuffer to true.
 
         * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::userCancelledLoad): Do nothing unless the element
-        is still loading. Only fire an 'emptied' event if the readyState is HAVE_NOTHING,
-        otherwise set the network state to NETWORK_IDLE.
-
-2009-09-21  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey "Sean/Shawn/Shaun" Garen.
-
-        Clarify two FIXMEs.
-
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        (WebCore::JSHTMLFormElement::nameGetter):
-
-2009-09-21  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Drop down selects fail to close when a value is selected
-        https://bugs.webkit.org/show_bug.cgi?id=29582
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_preload.
+        (WebCore::HTMLMediaElement::parseMappedAttribute): Deal with 'preload' attribute.
+        (WebCore::HTMLMediaElement::loadResource): Call setPreload() on the newly created MediaPlayer,
+            before calling load() so it can pass the setting through to the media engine.
+        (WebCore::HTMLMediaElement::preload): New.
+        (WebCore::HTMLMediaElement::setPreload): Ditto
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
 
-        Implement PopupListBox::hidePopup, which was previously
-        declared but unimplemented.  Removes the declaration of
-        showPopup since that method is not implemented.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::MediaPlayer): Initialize m_preload.
+        (WebCore::MediaPlayer::load): Pass m_preload to newly created media engine.
+        (WebCore::MediaPlayer::preload): New, return m_preload.
+        (WebCore::MediaPlayer::setPreload): New, set m_preload.
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayer::):
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::setPreload):
 
-        PopupListBox::hidePopup takes care of hiding the popup,
-        by invoking hidePopup on its parent PopupContainer, and
-        then informs the PopupMenuClient that popupDidHide.
-        This mimics the old behavior prior to r48370.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::setPreload): Renamed from setAutoplay, fix logic for preload.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::handleKeyEvent):
-        (WebCore::PopupListBox::abandon):
-        (WebCore::PopupListBox::acceptIndex):
-        (WebCore::PopupListBox::hidePopup):
+2010-03-03  Dan Bernstein  <mitz@apple.com>
 
-2009-09-21  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+        Reviewed by Sam Weinig.
 
-        Rubber-stamped by Simon Hausmann.
+        <rdar://problem/7682756> Assertion failure when replacing the contents of a <select>
 
-        [Qt] Windows build fix.
-        https://bugs.webkit.org/show_bug.cgi?id=29535
+        Test: fast/dom/remove-children-notification-order.html
 
-        * platform/network/qt/DnsPrefetchHelper.cpp: Missing #include "config.h"  added.
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren): Changed to call childrenChanged()
+        before calling removedFromDocument() on each removed child, which matches
+        the order removeChild() does things, and avoids the assertion. This required
+        temporarily storing the removed children in a vector.
+        Also added comments about other discrepancies between this function and
+        removeChild().
 
-2009-09-21  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+2010-03-03  Adam Barth  <abarth@webkit.org>
 
-        Unreviewed make dist build fix. Missing files.
+        Reviewed by Darin Adler.
 
-        * GNUmakefile.am:
+        Document cookieURL and firstPartyForCookies
+        https://bugs.webkit.org/show_bug.cgi?id=35613
 
-2009-09-20  Adam Barth  <abarth@webkit.org>
+        Some folks asked what the cookieURL and the firstPartyForCookies were
+        on IRC.  This patch documents these properties in the code so folks
+        don't have to ask on IRC anymore.
 
-        Reviewed by Maciej Stachowiak.
+        * dom/Document.h:
 
-        Crash when clicking link in unload handler
-        https://bugs.webkit.org/show_bug.cgi?id=29525
+2010-03-03  Arno Renevier  <arno@renevier.net>
 
-        Test that the first navigation always wins when the page tries to start
-        a new navigation in an unload handler.
+        Reviewed by Gustavo Noronha Silva.
 
-        Tests: fast/loader/unload-form-about-blank.html
-               fast/loader/unload-form-post-about-blank.html
-               fast/loader/unload-form-post.html
-               fast/loader/unload-form.html
-               fast/loader/unload-hyperlink.html
-               fast/loader/unload-javascript-url.html
-               fast/loader/unload-reload.html
-               fast/loader/unload-window-location.html
+        [Gtk]: assertion triggered when geolocation getCurrentPosition without an option argument.
+        https://bugs.webkit.org/show_bug.cgi?id=35666
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadURL):
-        (WebCore::FrameLoader::loadWithDocumentLoader):
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::startUpdating):
 
-2009-09-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+2010-03-03  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
         Reviewed by Xan Lopez.
 
-        [GTK] Sometimes crashes when a page is destroyed/loads another URL while playing video
-        https://bugs.webkit.org/show_bug.cgi?id=29496
-
-        Protect the video sink object, and destroy it in an idle callback
-        to hopefully avoid a race condition that leads to a crash.
+        Miscellaneous little fixes for the windows build of webkit-gtk
+        https://bugs.webkit.org/show_bug.cgi?id=35640
 
-        This is already tested by media/video-seekable.html
+        * GNUmakefile.am: dist two new files concerning mathml support.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::idleUnref):
-        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+2010-03-03  Xan Lopez  <xlopez@igalia.com>
 
-2009-09-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        Unreviewed distcheck fix.
 
-        Unreviewed build fix for GTKand a blind one for Qt after r48566.
+        Add new file to the build.
 
         * GNUmakefile.am:
-        * WebCore.pro:
 
-2009-09-19  Sam Weinig  <sam@webkit.org>
+2010-03-03  Antti Koivisto  <koivisto@iki.fi>
 
         Reviewed by Oliver Hunt.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29519
-        Remove JSNameNodeCollection and just use StaticNodeList
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        (WebCore::JSHTMLFormElement::nameGetter):
-        * bindings/js/JSNamedNodesCollection.cpp: Removed.
-        * bindings/js/JSNamedNodesCollection.h: Removed.
-
-2009-09-19  Daniel Bates  <dbates@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29511
+        Make IntPoint usable as a hash key
         
-        Fixes an issue where script code that contains non-ASCII characters may bypass the 
-        XSSAuditor.
-        
-        Before performing a comparison between the script source code and input parameters, we
-        remove all non-ASCII characters, including non-printable ASCII characters from the
-        script source code and input parameters.
-
-        Tests: http/tests/security/xssAuditor/img-onerror-non-ASCII-char.html
-               http/tests/security/xssAuditor/img-onerror-non-ASCII-char-default-encoding.html
-               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2-default-encoding.html
-               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::isNonCanonicalCharacter): Modified to remove all non-ASCII characters,
-        including non-printable ASCII characters.
-
-2009-09-19  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Incorrect animation with scale(0) transform (singular matrix)
-        https://bugs.webkit.org/show_bug.cgi?id=29465
-        
-        Make accelerated scale() and translate() animations go through the component animation
-        path (rather than just matrix animation) to avoid problems with singular scale matrices,
-        and be slightly more efficient.
-
-        Test: compositing/transitions/singular-scale-transition.html
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::getTransformFunctionValue):
-        (WebCore::getValueFunctionNameForTransformOperation):
-
-2009-09-19  Alex Milowski  <alex@milowski.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Adds CSS styling and basic DOM element support for MathML
-
-        * DerivedSources.make:
-          Added user stylesheet and tag factory generation
+        https://bugs.webkit.org/show_bug.cgi?id=35586
 
+        * WebCore.pro:
         * WebCore.xcodeproj/project.pbxproj:
-          Added new DOM element code
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseAttr):
-          Added check for document since stylesheet can be added before there is a document
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::styleForElement):
-          Added check to add MathML user agent stylesheet
-
-        * css/mathml.css: Added.
-          MathML user agent stylesheet
-
-        * dom/Document.cpp:
-        (WebCore::Document::createElement):
-          Added support for creation of MathML DOM objects
-
-        * dom/Node.h:
-        (WebCore::Node::isMathMLElement):
-          Added check method for whether the node is a MathML node
-
-        * mathml: Added.
-        * mathml/MathMLElement.cpp: Added.
-        (WebCore::MathMLElement::MathMLElement):
-        (WebCore::MathMLElement::create):
-        (WebCore::MathMLElement::createRenderer):
-        * mathml/MathMLElement.h: Added.
-        (WebCore::MathMLElement::isMathMLElement):
-          MathML DOM base class
-
-
-        * mathml/MathMLInlineContainerElement.cpp: Added.
-        (WebCore::MathMLInlineContainerElement::MathMLInlineContainerElement):
-        (WebCore::MathMLInlineContainerElement::create):
-        (WebCore::MathMLInlineContainerElement::createRenderer):
-        * mathml/MathMLInlineContainerElement.h: Added.
-          Base class for non-text containers
-
-        * mathml/MathMLMathElement.cpp: Added.
-        (WebCore::MathMLMathElement::MathMLMathElement):
-        (WebCore::MathMLMathElement::create):
-        * mathml/MathMLMathElement.h: Added.
-          Root Math element
-
-        * mathml/mathtags.in: Added.
-          Element list mappings
+        * platform/graphics/IntPointHash.h: Added.
+        (WTF::IntPointHash::hash):
+        (WTF::IntPointHash::equal):
+        (WTF::):
 
-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-          Added MathML name initialization
-2009-09-19  Adam Barth  <abarth@webkit.org>
+2010-03-02  Eric Uhrhane  <ericu@chromium.org>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by David Levin.
 
-        Canvas drawn with data URL image raises SECURITY_ERR when toDataUrl() called.
-        https://bugs.webkit.org/show_bug.cgi?id=29305
+        Move database enable bit fully out of settings
+        This is stage one of a three-stage commit [webkit, then chromium, then
+        webkit again].  In this change I'm adding calls to
+        Database::setIsAvailable inside Settings::setDatabaseEnabled and
+        anywhere else that called it, and switching webkit fully over to using
+        that flag [added in a previous checkin].  Phase two will remove
+        Chromium's use of Settings for the Database, and phase three will remove
+        the Setting for the Database enable entirely, leaving only
+        Database::isAvailable/setIsAvailable.
 
-        We need to special-case data URLs when tainting a canvas because we
-        treat data URLs has having no security origin, unlike other
-        browsers.  The reason we do this is to help sites avoid XSS via data
-        URLs, but that consideration doesn't apply to canvas taint.
+        No new tests; tested by existing storage tests.
 
-        Also, we were previously incorrectly taking document.domain state
-        into account when tainting canvas.
+        https://bugs.webkit.org/show_bug.cgi?id=35310
 
-        Tests: http/tests/security/canvas-remote-read-data-url-image.html
-               http/tests/security/canvas-remote-read-data-url-svg-image.html
-               http/tests/security/canvas-remote-read-remote-image-document-domain.html
+        * WebCore.base.exp: Export Database::setIsAvailable
+        * WebCore.xcodeproj/project.pbxproj: Export needed headers as Private
+        * page/DOMWindow.cpp: Read isAvailable, not Settings::isDatabaseEnabled
+        (WebCore::DOMWindow::openDatabase):
+        * page/Settings.cpp:  Add a call to Database::setIsAvailable.
+        (WebCore::Settings::setDatabasesEnabled):
 
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::checkOrigin):
-        (WebCore::CanvasRenderingContext2D::createPattern):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::taintsCanvas):
-        * page/SecurityOrigin.h:
+2010-03-02  Tony Chang  <tony@chromium.org>
 
-2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+        Reviewed by Darin Fisher.
 
-        Fix stylistic issue raised in code review for previous commit.
+        add a flag to WebURLResponse so we can identify multipart content
+        https://bugs.webkit.org/show_bug.cgi?id=35628
 
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::hasNonZeroTransformOrigin):
-
-2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::isMultipartPayload):
+        (WebCore::ResourceResponse::setIsMultipartPayload):
 
-        Reviewed by Dan Bernstein.
+2010-03-02  Tony Chang  <tony@chromium.org>
 
-        Element is misplaced during opacity transition with certain configuration of transform-origin and clipping
-        https://bugs.webkit.org/show_bug.cgi?id=29495
-        
-        If an element has zero size, but has a transform origin with absolute values,
-        then the transform origin would not be applied because it is implemented via
-        anchorPoint, which is expressed as a fraction of the layer size.
-        
-        Work around this by artificially inflating the size of the backing store when we need to.
+        Not reviewed, test fix.
 
-        Test: compositing/geometry/transfrom-origin-on-zero-size-layer.html
+        Revert r55447 because the new layout test is crashing consistently
+        on Leopard Intel Debug (tests).
+        https://bugs.webkit.org/show_bug.cgi?id=35261
 
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::RenderLayerBacking):
-        Init m_artificiallyInflatedBounds to false.
-        
-        (WebCore::hasNonZeroTransformOrigin):
-        Utility function that describes whether the transform-origin contains non-percentage
-        x or y offsets.
-        
-        (WebCore::RenderLayerBacking::updateCompositedBounds):
-        New wrapper method around setCompositedBounds() that applies the size inflation
-        when necessary, setting the m_artificiallyInflatedBounds as appropriate.
-        
-        (WebCore::RenderLayerBacking::updateAfterLayout): Call updateCompositedBounds().
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Ditto
-        
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Ditto
-        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry): Ditto
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImageSingleFrameSkia::create):
 
-2009-09-18  Antti Koivisto  <antti@apple.com>
+2010-03-02  Adam Barth  <abarth@webkit.org>
 
-        Reviewed by Maciej Stachowiak.
+        Reviewed by Darin Fisher.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29512
-        Don't recalculate style when restoring from the page cache
+        Google Analytics triggers "blocked plugin" UI
+        https://bugs.webkit.org/show_bug.cgi?id=35565
 
-        FrameLoaderClient::forceLayout() also forces style recalc. Instead call FrameView::forceLayout() 
-        directly to update the scrollbars while keeping the existing style.
-        
-        Makes back/forward really fast on complex pages (in cases where page cache works).
+        Just like for running script, we need to distinguish between querying
+        whether plug-ins are enabled and actually blocking a page from
+        instantiating a plugin.  We need to issue different callbacks to the
+        FrameLoaderClient so that the client can inform us that plug-ins are
+        disabled in some cases without showing the "plug-in blocked" UI.
 
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
         * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::commitProvisionalLoad):
-
-2009-09-18  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Implement ES5 Object.defineProperty function
-        https://bugs.webkit.org/show_bug.cgi?id=29503
-
-        Override defineOwnProperty on JSDOMWindowShell to forward appropriately,
-        and then override defineOwnProperty on JSDOMWindow to disallow cross origin
-        defineOwnProperty usage.  We also override defineOwnProperty on QuarantinedObjectWrapper
-        to ensure correct wrapping semantics of quarantined objects.
-
-        One major caveat in this patch is that it currently disallows the use
-        of Object.defineProperty on DOMObjects other than the window due to
-        the significant work involved in correctly propagating attributes and
-        ensuring correct semantics on dom objects.
-
-        Tests: fast/js/Object-defineProperty.html
-               http/tests/security/xss-DENIED-defineProperty.html
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::DOMObject::defineOwnProperty):
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::defineGetter):
-        (WebCore::JSDOMWindow::defineSetter):
-        (WebCore::JSDOMWindow::defineOwnProperty):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::defineOwnProperty):
-        (WebCore::JSDOMWindowShell::defineGetter):
-        (WebCore::JSDOMWindowShell::defineSetter):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::defineGetter):
-        (WebCore::JSLocationPrototype::defineGetter):
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
-        (WebCore::JSQuarantinedObjectWrapper::defineOwnProperty):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
+        (WebCore::FrameLoader::requestObject):
+        (WebCore::FrameLoader::allowPlugins):
+        * loader/FrameLoader.h:
+        (WebCore::):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didNotAllowPlugins):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::substituteMIMETypeFromPluginDatabase):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::writeRawData):
+        * page/Page.cpp:
+        (WebCore::Page::pluginData):
+        * plugins/MimeType.cpp:
+        (WebCore::MimeType::enabledPlugin):
 
-2009-09-18  Alexey Proskuryakov  <ap@apple.com>
+2010-03-02  Andreas Kling  <andreas.kling@nokia.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Simon Hausmann.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29510
-        Active DOM objects should be suspended while a modal dialog is displayed
+        [Qt] Support the HTTP OPTIONS verb (needed for preflight requests)
 
-        * manual-tests/js-timers-beneath-modal-dialog.html: Added a test for JS timers.
+        https://bugs.webkit.org/show_bug.cgi?id=34647
 
-        * page/PageGroupLoadDeferrer.cpp:
-        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
-        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
-        Match other platforms, and make Mac also suspend active DOM objects. Since a page that
-        currently displays a modal dialog cannot go into page cache, there is no danger of suspending
-        an object twice.        
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::start):
 
-2009-09-18  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+2010-03-02  Evan Stade  <estade@chromium.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by David Levin.
 
-        [Qt] Buildfix caused by http://trac.webkit.org/changeset/48513
-        https://bugs.webkit.org/show_bug.cgi?id=29351
+        https://bugs.webkit.org/show_bug.cgi?id=35261
+        [skia] crash when attempting to render certain SVGs
 
-        * bridge/qt/qt_instance.h: createRuntimeObject method renamed to newRuntimeObject.
-        * bridge/runtime.h: Visibility of newRuntimeObject method modified to protected.
+        This fixes the crash, but the SVG still doesn't render properly.
 
-2009-09-18  Yury Semikhatsky  <yurys@chromium.org>
+        Test: svg/custom/tiling-regular-hexagonal-crash.svg
 
-        Reviewed by Timothy Hatcher.
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImageSingleFrameSkia::create): don't return 0 when
+        the copy fails; instead return a blank bitmap. The caller doesn't
+        check for 0 before dereferencing.
 
-        Fix parameter substitutions in console.log().
+2010-03-02  Arno Renevier  <arno@renevier.net>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29366
+        Reviewed by Gustavo Noronha Silva.
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleMessage.prototype._format):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getPrototypes):
-        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
-        * inspector/front-end/utilities.js:
-        ():
-
-2009-09-18  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen and Brady Eidson.
+        [Gtk] use geoclue providers with don't provide update
+        https://bugs.webkit.org/show_bug.cgi?id=35191
 
-        Temporarily remove an assertion that was getting hit when going
-        back to a page in the page cache while a banner in Safari was visible.
-        We should re-enable this once that is fixed. See <rdar://problem/7218118>
+        No new tests, behaviour depends on system.
 
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scheduleRelayout):
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::startUpdating):
 
-2009-09-18  Anders Carlsson  <andersca@apple.com>
+2010-03-02  John Abd-El-Malek  <jam@chromium.org>
 
-        Try fixing the build again.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::wndProc):
+        Reviewed by Darin Adler.
 
-2009-09-18  Anders Carlsson  <andersca@apple.com>
+        Remove unnecessary check.
+        https://bugs.webkit.org/show_bug.cgi?id=35513
 
-        Fix windows build.
-        
-        * platform/win/PopupMenuWin.cpp:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
 
-2009-09-18  Sam Weinig  <sam@webkit.org>
+2010-03-02  Darin Fisher  <darin@chromium.org>
 
-        Reviewed by Gavin 'BearClaw' Barraclough.
+        Fix chromium build bustage.
 
-        Convert another callback type object to store the global object
-        instead of the frame.
+        * page/Page.cpp:
+        (WebCore::Page::privateBrowsingStateChanged): PluginView methods may
+        not be called in the Chromium port.
 
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::create):
-        (WebCore::JSCustomXPathNSResolver::JSCustomXPathNSResolver):
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/JSCustomXPathNSResolver.h:
+2010-03-02  Beth Dakin  <bdakin@apple.com>
 
-2009-09-18  Anders Carlsson  <andersca@apple.com>
+        Reviewed by Darin Adler and Adam Roben.
 
-        Reviewed by Sam Weinig.
+        Fix for <rdar://problem/7485289> WebKit crashes on systems that 
+        don't support CoreAnimation
 
-        https://bugs.webkit.org/show_bug.cgi?id=29332
-        <rdar://problem/7231652> 
-        REGRESSION (r48446): While a <select> popup menu is open, the
-        rest of the WebView doesn't respond to mouse move events.
+        WKCACFLayerRenderer::acceleratedCompositingAvailable() now creates 
+        a dummy HWND so that it can step through the whole setHostWindow() 
+        and createRenderer() process. createRenderer() also calls a new 
+        function, hardwareCapabilitiesIndicateCoreAnimationSupport() which 
+        can only be called  once we have a d3dDevice.
 
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::translatePoint):
-        New helper function that translates a point between HWND coordinates.
-        
-        (WebCore::PopupMenu::show):
-        Protect the PopupMenu if someone removes the <select> in response to a mouse
-        event. Handle WM_HOST_WINDOW_MOUSEMOVE events.
-        
-        (WebCore::PopupMenu::wndProc):
-        in the WM_MOUSEMOVE handler, if the mouse is not over the popup, post a 
-        WM_HOST_WINDOW_MOUSEMOVE event so that the host window (the WebView) gets the
-        mouse move event.
+        setHostWindow() and createRenderer() now both return bools that 
+        indicate whether or not they have succeeded.
 
-2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::hardwareCapabilitiesIndicateCoreAnimationSupport):
+        (WebCore::CoreAnimationTesterWindowWndProc):
+        (WebCore::WKCACFLayerRenderer::acceleratedCompositingAvailable):
+        (WebCore::WKCACFLayerRenderer::shared):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        (WebCore::WKCACFLayerRenderer::setHostWindow):
 
-        Reviewed by Dave Hyatt.
+2010-03-02  Mark Rowe  <mrowe@apple.com>
 
-        Compositing layers are incorrectly positioned after scrolling with position:fixed
-        https://bugs.webkit.org/show_bug.cgi?id=29262
-        
-        When scrolling a page with compositing layers inside a position:fixed element,
-        we need to update the compositing layer positions when the scroll position changes.
+        Rubber-stamped by Jon Honeycutt.
 
-        Test: compositing/geometry/fixed-position.html
+        ScriptDebugServer shouldn't care that Mac does not use PluginView for plug-ins.
 
-        * WebCore.base.exp:
-        Export FrameView::scrollPositionChanged()
-        
-        * page/FrameView.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollPositionChanged):
-        New method that sends the scroll event, and updates compositing layers positions if necessary.
-
-2009-09-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
+        * bindings/js/ScriptDebugServer.cpp:
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::setJavaScriptPaused): Add an empty implementation of setJavaScriptPaused.
 
-        Transformed elements inside position:fixed container are clipped incorrectly
-        https://bugs.webkit.org/show_bug.cgi?id=29346
-        
-        Fix clipping and hit testing on transformed elements inside a position:fixed element.
-        Previously, the code used the overflowClipRect of the parent clip rects, but
-        this is not correct for fixed postion elements. Instead, share code that is
-        already present in calculateRects() to get the correct rect.
+2010-03-02  Mark Rowe  <mrowe@apple.com>
 
-        Test: fast/overflow/position-fixed-transform-clipping.html
+        Rubber-stamped by Jon Honeycutt.
 
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayer):
-        (WebCore::RenderLayer::hitTestLayer):
-        Call the new backgroundClipRect() to get the correct clipRect.
-        
-        (WebCore::RenderLayer::backgroundClipRect):
-        New method, factored out of calculateRects(), that computes the clip rect,
-        doing the right thing for fixed position elements.
-        
-        (WebCore::RenderLayer::calculateRects):
-        Call the new backgroundClipRect() method.
-        
-2009-09-18  Dan Bernstein  <mitz@apple.com>
+        Clean up the build fix r55437 by adding an empty implementation of privateBrowsingStateChanged in PluginViewNone.cpp
 
-        Reviewed by Darin Adler.
-
-        Fix <rdar://problem/7050773> REGRESSION (r40098) Crash at
-        WebCore::RenderBlock::layoutBlock()
-        https://bugs.webkit.org/show_bug.cgi?id=29498
+        * page/Page.cpp:
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::privateBrowsingStateChanged):
 
-        Test: accessibility/nested-layout-crash.html
+2010-03-02  Mark Rowe  <mrowe@apple.com>
 
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::updateBackingStore): Changed to
-            call Document::updateLayoutIgnorePendingStylesheets() instead of
-            calling RenderObject::layoutIfNeeded(). The latter requires that
-            there be no pending style recalc, which allows methods that call
-            Document::updateLayout() to be called during layout without risking
-            re-entry into layout.
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityActionNames]): Null-check
-            m_object after calling updateBackingStore(), since style recalc may
-            destroy the renderer, which destroys the accessibility object and
-            detaches it from the wrapper.
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityFocusedUIElement]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityHitTest:]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityIsIgnored]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
-             Ditto.
-        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityPerformAction:]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
-            Ditto.
-
-2009-09-18  Fumitoshi Ukai  <ukai@chromium.org>
+        Fix the Mac build.
 
-        Reviewed by Simon Hausmann.
+        * page/Page.cpp:
+        (WebCore::Page::privateBrowsingStateChanged): Mac doesn't use WebCore's PluginView class
+        for plug-ins, so provide an empty implementation of privateBrowsingStateChanged for Mac.
 
-        Update Qt build system for Web Socket.
-        https://bugs.webkit.org/show_bug.cgi?id=29270
+2010-03-02  Andy Estes  <aestes@apple.com>
 
-        * WebCore.pro:
-        * platform/network/qt/SocketStreamError.h: Added.
-        * platform/network/qt/SocketStreamHandle.h: Added.
-        * platform/network/qt/SocketStreamHandleSoup.cpp: Added.
+        Reviewed by Maciej Stachowiak.
 
-2009-09-18  Eric Carlson  <eric.carlson@apple.com>
+        Add the capability to create and dispatch a WheelEvent in JavaScript.
+        Ensure the event's default handler is triggered in the same way as it is
+        during a PlatformWheelEvent.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35566
+
+        Test: fast/events/wheelevent-in-scrolling-div.html
+
+        * dom/Node.cpp: Ensure that the default behavior (scrolling) occurs for
+        wheel events originating both from the platform and from
+        JavaScript/ObjC.
+        (WebCore::Node::dispatchWheelEvent): Instantiate new WheelEvent with
+        the graunularity of the PlatformWheelEvent.
+        (WebCore::Node::defaultEventHandler): Add support for mousewheel events.
+        * dom/WheelEvent.cpp: Add three new member variables: m_deltaX, m_deltaY
+        and m_granularity.  m_deltaX and m_deltaY differ from m_wheelDeltaX and
+        m_wheelDeltaY, which are the number of wheel ticks multiplied by 120 for
+        IE compatibility.
+        (WebCore::WheelEvent::WheelEvent): Initialize new member variables.
+        (WebCore::WheelEvent::initWheelEvent): Same.
+        (WebCore::WheelEvent::initWebKitWheelEvent): Same.
+        * dom/WheelEvent.h: See WheelEvent.cpp.
+        (WebCore::WheelEvent::): Add Granularity enum (Pixel, Line, Page).
+        (WebCore::WheelEvent::create): Add new arguments.
+        (WebCore::WheelEvent::deltaX): Amount of scroll in x direction.
+        (WebCore::WheelEvent::deltaY): Amount of scroll in y direction.
+        (WebCore::WheelEvent::granularity): Units of deltaX and deltaY.
+        * dom/WheelEvent.idl: Add initWebKitWheelEvent() to JavaScript.  This is
+        the same as the initWheelEvent ObjC method.  As the DOM Level 3 Events
+        specification is still a working draft and subject to change, prefix
+        'WebKit' to the method signature to indicate experimental support.
+        * page/EventHandler.cpp: Move the scroll handling from
+        handleWheelEvent() to defaultWheelEventHandler(), which is executed on
+        both PlatformWheelEvents and JavaScript WheelEvents.
+        (WebCore::scrollNode): Renamed from scrollAndAcceptEvent().  Remove
+        the PlatformWheelEvent from the argument list and instead return a
+        boolean indicating if the scroll event was accepted.
+        (WebCore::EventHandler::handleWheelEvent): Move scrolling code from here
+        (WebCore::EventHandler::defaultWheelEventHandler): ...to here.
+        * page/EventHandler.h: Add function signature.
+
+2010-03-02  Mark Rowe  <mrowe@apple.com>
 
         Reviewed by Darin Adler.
 
-        NULL check HTMLMediaElement::m_playedTimeRanges.
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29494
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::addPlayedRange): New. Create m_playedTimeRanges if
-        necessary, add range specified.
-        (WebCore::HTMLMediaElement::seek): Use addPlayedRange. 
-        (WebCore::HTMLMediaElement::played): Use addPlayedRange. Change time comparison 
-        to be more readable.
-        (WebCore::HTMLMediaElement::updatePlayState): Ditto.
-        * html/HTMLMediaElement.h:
-
-2009-09-18  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Adele Peterson.
-
-        Follow up fix for https://bugs.webkit.org/show_bug.cgi?id=29276
-        REGRESSION(r48334): WebKit crashes on file select by drag
-
-        Don't use Document.elementFromPoint since it returns null if the point
-        is outside the viewport.  Instead, just hit test ourselves.
-
-        Test: fast/events/drag-file-crash.html
-
-        * page/DragController.cpp:
-        (WebCore::elementUnderMouse):
-        (WebCore::DragController::tryDocumentDrag):
-        (WebCore::DragController::concludeEditDrag):
-
-2009-09-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Each wrapped Objective-C object should use a single RuntimeObjectImp
-        https://bugs.webkit.org/show_bug.cgi?id=29351
-        rdar://problem/7142294
-
-        * WebCore.base.exp: Added a newly-needed exported symbol.
-
-        * bindings/objc/DOMInternal.h: Eliminated unused
-        createWrapperCacheWithIntegerKeys; it has not been needed since the
-        RGBColor wrappers were reworked.
-        * bindings/objc/DOMInternal.mm: Ditto.
-
-        * bridge/objc/objc_instance.h: Made the create function non-inline.
-        * bridge/objc/objc_instance.mm:
-        (createInstanceWrapperCache): Added. Creates an appropriate map table.
-        (ObjcInstance::create): Moved here from header. Uses NSMapGet and
-        NSMapInsert to cache the instance in a map table.
-        (ObjcInstance::~ObjcInstance): Added a call to NSMapRemove to remove
-        the instance from the map table.
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::~QtInstance): Remove unneeded code to remove
-        the instance from cachedObjects, which no longer exists.
-        (JSC::Bindings::QtInstance::newRuntimeObject): Renamed to overload new
-        bottleneck. Caching is now handled by the base class.
-
-        * bridge/runtime.cpp:
-        (JSC::Bindings::Instance::Instance): Initialize m_runtimeObject to 0.
-        (JSC::Bindings::Instance::~Instance): Assert m_runtimeObject is 0.
-        (JSC::Bindings::Instance::createRuntimeObject): Use m_runtimeObject
-        if it's already set. Set m_runtimeObject and call addRuntimeObject
-        if it's not.
-        (JSC::Bindings::Instance::newRuntimeObject): Added. Virtual function,
-        used only by createRuntimeObject.
-        (JSC::Bindings::Instance::willDestroyRuntimeObject): Added.
-        Calls removeRuntimeObject and then clears m_runtimeObject.
-        (JSC::Bindings::Instance::willInvalidateRuntimeObject): Added.
-        Clears m_runtimeObject.
-
-        * bridge/runtime.h: Made createRuntimeObject non-virtual. Added
-        willDestroyRuntimeObject, willInvalidateRuntimeObject,
-        newRuntimeObject, and m_runtimeObject.
-
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::RuntimeObjectImp): Removed addRuntimeObject
-        call, now handled by caller.
-        (JSC::RuntimeObjectImp::~RuntimeObjectImp): Replaced removeRuntimeObject
-        call with willDestroyRuntimeObject call; the latter nows calls
-        removeRuntimeObject.
-        (JSC::RuntimeObjectImp::invalidate): Added willInvalidateRuntimeObject
-        call.
+        Bug 35576: WebKit should tell plug-in instances when private browsing state changes
+        <http://webkit.org/b/35576>
 
-        * bridge/runtime_object.h: Made invalidate non-virtual.
+        Notify plug-in instances when the private browsing state changes to match the behavior of the
+        Mac plug-in code.
 
-2009-09-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        * page/Page.cpp:
+        (WebCore::Page::privateBrowsingStateChanged): Walk the frame tree and notify each PluginView that
+        the private browsing state has changed.
+        * page/Page.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::setPrivateBrowsingEnabled): Notify the page that the private browsing state
+        has changed.
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::privateBrowsingStateChanged): Notify the plug-in instance of the new private
+        browsing state.
+        * plugins/PluginView.h:
 
-        Reviewed by Simon Hausmann.
+2010-03-02  Mark Rowe  <mrowe@apple.com>
 
-        Make PlatformWindow return something else than PlatformWidget
-        https://bugs.webkit.org/show_bug.cgi?id=29085
+        Reviewed by Oliver Hunt.
 
-        Make platformWindow return a PlatformPageClient
-        (for now typedef'ed to PlatformWidget)
+        Bug 30348: Implement private mode for plug-ins on Windows
+        <http://webkit.org/b/30348> / <rdar://problem/7562261>
 
-        Also, change the name of platformWindow to platformPageClient()
+        Rework PluginView::getValue and PluginView::getValueStatic to remove the amount of code that
+        was duplicated across platforms.  getValue and getValueStatic now call in to platform-specific
+        variants that indicate whether they handled the query.  If the query is not handled by the
+        platform-specific variants then the cross-platform handler has a chance to handle it.
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (getPangoLayoutForAtk):
-        * accessibility/win/AXObjectCacheWin.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::platformPageClient):
-        * page/Chrome.cpp:
-        (WebCore::Chrome::platformPageClient):
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::wheelEvent):
-        (WebCore::EventHandler::currentPlatformMouseEvent):
-        (WebCore::EventHandler::sendContextMenuEvent):
-        (WebCore::EventHandler::eventMayStartDrag):
-        * platform/HostWindow.h:
-        * platform/Widget.h:
-        * platform/gtk/PlatformScreenGtk.cpp:
-        (WebCore::getVisual):
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
-        * platform/gtk/PopupMenuGtk.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::platformAddChild):
-        (WebCore::ScrollView::platformRemoveChild):
-        (WebCore::ScrollView::visibleContentRect):
-        * platform/gtk/WidgetGtk.cpp:
-        (WebCore::Widget::setFocus):
-        (WebCore::Widget::setCursor):
-        * platform/qt/PlatformScreenQt.cpp:
-        (WebCore::screenDepth):
-        (WebCore::screenDepthPerComponent):
-        (WebCore::screenIsMonochrome):
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::setCursor):
-        * platform/win/PlatformScreenWin.cpp:
-        (WebCore::monitorInfoForWidget):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::calculatePositionAndSize):
-        (WebCore::PopupMenu::wndProc):
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::nativeWindowForRenderObject):
-        * platform/wx/ScrollbarThemeWx.cpp:
-        (WebCore::ScrollbarThemeWx::paint):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::getValueStatic): Give the platform-specific variant a chance to handle the
+        variable lookup.  If it does not handle it, return an error.
+        (WebCore::PluginView::getValue): Give the platform-specific variant and platform-specific static
+        variant a chance to handle the variable lookup.  If they do not handle it, apply the cross-platform
+        handler.  At the moment the cross-platform code handles NPNVWindowNPObject, NPNVPluginElementNPObject,
+        and NPNVprivateModeBool as they have an identical implementation across ports.
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::platformGetValue): PluginViewNone does not handle any lookups.
+        (WebCore::PluginView::platformGetValueStatic): Ditto.
         * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue):
+        platform-independent implementation.
         * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue):
         * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue): Fix a bug noticed while updating this code.
+        The Qt implementation of the handler for NPNVToolkit was relying on case fall-through
+        to have some values handled by the static handler.  When NPNVprivateModeBool was added
+        it was placed before the default case, interferring with this fall-through.  It now
+        explicitly indicates in this situation that it was not handled.
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue):
         * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue):
 
-2009-09-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+2010-03-02  Anders Carlsson  <andersca@apple.com>
 
-        Reviewed by Simon Hausmann.
-
-        [Qt] Web inspector UI adjustments specific to the Qt platform:
-        - Hide the close button
-        - Hide the dock button
-        - Disable the draggable toolbar
-
-        https://bugs.webkit.org/show_bug.cgi?id=29384
-
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.toolbarDragStart):
-
-2009-09-18  Joerg Bornemann  <joerg.bornemann@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        QtWebKit Windows CE compile fixes
-
-        Exclude certain pure-WINCE specific code paths from the Qt build.
-
-        * platform/graphics/BitmapImage.h:
-        * platform/graphics/FontCache.h:
-        * platform/graphics/MediaPlayer.cpp:
-        * platform/text/TextEncodingRegistry.cpp:
-        (WebCore::buildBaseTextCodecMaps):
-        (WebCore::extendTextCodecMaps):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::stop): Guard this code block with NETSCAPE_PLUGIN_API as
-        the corresponding PluginViewWndProc has the same guard in the header file.
-
-2009-09-18  Steve Block  <steveblock@google.com>
-
-        Reviewed by Dimitri Glazkov.
-
-        Geolocation does not correctly handle Infinity for PositionOptions properties.
-        https://bugs.webkit.org/show_bug.cgi?id=29099
-
-        * bindings/js/JSGeolocationCustom.cpp: Modified.
-        (WebCore::createPositionOptions): Modified. If timeout or maximumAge is positive infinity, applies these values as a special case.
-        * page/PositionOptions.h: Modified.
-        (WebCore::PositionOptions::hasMaximumAge): Added. Determines whether the object has a maximum age.
-        (WebCore::PositionOptions::maximumAge): Modified. Asserts that the object has a maximum age.
-        (WebCore::PositionOptions::clearMaximumAge): Added. Clears the maximum age.
-        (WebCore::PositionOptions::setMaximumAge): Modified. Registers that the maximum age has been set.
-        (WebCore::PositionOptions::PositionOptions): Modified. Registers that the maximum age has been set.
-
-2009-09-17  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Adele Peterson.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29276
-        REGRESSION(r48334): WebKit crashes on file select by drag
+        Reviewed by Sam Weinig.
 
-        Document.elementFromPoint now takes point in client space, not page space.
+        Make the default constructor available to all platforms.
 
-        * page/DragController.cpp:
-        (WebCore::DragController::tryDocumentDrag):
-        (WebCore::DragController::concludeEditDrag):
+        * platform/PlatformKeyboardEvent.h:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/mac/KeyEventMac.mm:
 
-2009-09-17  Albert J. Wong  <ajwong@chromium.org>
+2010-03-02  Jeremy Orlow  <jorlow@chromium.org>
 
         Reviewed by David Levin.
 
-        Reimplement default media UI for Mac Chromium to match the style
-        of the Windows and Linux versions.  Also breaks the dependency
-        on the internal wk* functions that were previously used to
-        render the media controller widgets.
-        https://bugs.webkit.org/show_bug.cgi?id=29161
-
-        No media layout tests are currently enabled in Mac Chromium, so
-        nothing needs rebaselineing, etc.
-
-        This is a recommit of r48438 with a compile fix and merges of
-        recent changes to the file.
-
-        * css/mediaControlsChromium.css:
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::mediaElementParent):
-        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
-        (WebCore::mediaSliderThumbImage):
-        (WebCore::mediaVolumeSliderThumbImage):
-        (WebCore::RenderThemeChromiumMac::paintSliderTrack):
-        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
-        (WebCore::RenderThemeChromiumMac::paintMediaButtonInternal):
-        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize):
-
-2009-09-17  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        The Console scope bar should have a divider between All and the other possible
-        values (Errors, Warnings, Logs). It will look something like:
-        
-        All | Errors Warnings Logs.
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.createDividerElement):
-        (WebInspector.ConsoleView):
-        * inspector/front-end/inspector.css:
-
-2009-09-17  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Remove additional references to JSVoidCallback which no longer exists.
-
-        * DerivedSources.cpp:
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-09-17  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Brady Eidson.
-
-        Remove commented out onhashchange attribute now that it is implemented.
-
-        * page/DOMWindow.idl:
-
-2009-09-17  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/7007541> 
-        CrashTracer: 4800crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
-        
-        Make RuntimeObjectImp more robust against m_instance being a null (which can happen if an OOP plug-in
-        crashes while we're calling into it).
-        
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::RuntimeObjectImp):
-        (JSC::RuntimeObjectImp::~RuntimeObjectImp):
-        (JSC::RuntimeObjectImp::invalidate):
-        (JSC::RuntimeObjectImp::fallbackObjectGetter):
-        (JSC::RuntimeObjectImp::fieldGetter):
-        (JSC::RuntimeObjectImp::methodGetter):
-        (JSC::RuntimeObjectImp::getOwnPropertySlot):
-        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
-        (JSC::RuntimeObjectImp::put):
-        (JSC::RuntimeObjectImp::defaultValue):
-        (JSC::RuntimeObjectImp::getCallData):
-        (JSC::RuntimeObjectImp::getConstructData):
-        (JSC::RuntimeObjectImp::getPropertyNames):
-        * bridge/runtime_object.h:
-        (JSC::RuntimeObjectImp::getInternalInstance):
-
-2009-09-17  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Wrap primitive values (as objects) in InspectorController::wrap.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28983
+        Revert database thread changes that are no longer required
+        https://bugs.webkit.org/show_bug.cgi?id=35519
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::wrapObject): objects of any type will be wrapped into proxies,
-         only object proxies will have objectId.
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions): there is InjectedScript.getCompletionsi
-         that accepts an expression and returns possible completions. This way we don't need to wrap
-         and unwrap the completions result into a proxy object.
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getCompletions):
-        (InjectedScript.evaluate):
-        (InjectedScript._evaluateOn):
-        (InjectedScript.createProxyObject):
-        * inspector/front-end/InjectedScriptAccess.js:
-
-2009-09-17  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Wrap PageTransitionEvents properly for V8's use.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29340
-
-        Fixes Chromium's failures for LayoutTests/fast/events/pageshow-pagehide.html.
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertEventToV8Object): Wrap PageTransitionEvents properly.
-
-2009-09-17  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Hardware-accelerated opacity transition on inline asserts
-        https://bugs.webkit.org/show_bug.cgi?id=29342
-        
-        Remove an erroneous toRenderBox() that could be called on a RenderInline; we can just
-        pass an empty size, because the box size is only required for transform animations.
-
-        Test: compositing/transitions/opacity-on-inline.html
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::startTransition):
-
-2009-09-17  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
+        Jochen Eisinger created 55214 and 55247 to track which database
+        owns which thread.  Dmitry suggested that this could also
+        be done via TLS, though.  After exploring the options, Jochen
+        chose to go the TLS route, so these patches are no longer needed.
 
-        [V8] OwnHandle might get a weak callback after destruction
-        https://bugs.webkit.org/show_bug.cgi?id=29172
-
-        Be sure to clear out weak reference so we don't get a weak callback
-        after we've destructed ourselves.  Also, removed some tricky methods
-        that had no clients.
-
-        * bindings/v8/OwnHandle.h:
-        (WebCore::OwnHandle::clear):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::getThreadID):
 
-2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-03-02  Brady Eidson  <beidson@apple.com>
 
-        Unreviewed, build fix.
+        Reviewed by Sam Weinig.
 
-        [V8] Partial roll out of http://trac.webkit.org/changeset/48455 to
-        fix crashes that started happening in V8Proxy::getEnteredContext().
+        Followup for REGRESSION(r51097) - Unable to log in to statefarm.com
+        <rdar://problem/7672667> and https://bugs.webkit.org/show_bug.cgi?id=35556
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::shouldExecuteAsJavaScript): To more perfectly match Gecko's rule,
+          strip whitespace from the attribute values before comparing to window/onload/onload().
 
-2009-09-17  Chris Fleizach  <cfleizach@apple.com>
+2010-03-02  Chris Fleizach  <cfleizach@apple.com>
 
         Reviewed by Beth Dakin.
 
-        AX: labels of checkboxes should, when hit-tested, return the checkbox
-        https://bugs.webkit.org/show_bug.cgi?id=29335
+        aria-label isn't respected on option elements
+        https://bugs.webkit.org/show_bug.cgi?id=35400
 
-        When an accessibility hit test is done and it hits the label of a control element,
-        the control element should be returned instead of nothing, since the label
-        itself is usually ignored.
+        When aria-label is used on an <option> element, it can take three forms.
+        An option in a multi-select list, a popup button and the menu that is displayed 
+        from the popup button. This patches the three requisite locations so that if
+        aria-label is used, the correct accessibility text is returned.
 
-        Test: accessibility/label-for-control-hittest.html
+        Test: platform/mac/accessibility/option-with-arialabel.html
 
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::stringValue):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::getAttribute):
         * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::correspondingControlForLabelElement):
         * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
-        (WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
-        * accessibility/AccessibilityRenderObject.h:
-
-2009-09-17  Avi Drissman  <avi@chromium.org>
-
-        Reviewed by Dimitri Glazkov, build fix.
-
-        Change to make RenderThemeChromiumMac compile inside of non PLATFORM(MAC).
-        https://bugs.webkit.org/show_bug.cgi?id=29243
-
-        Covered by existing tests.
-
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-
-2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        [V8] Accessing properties/methods of an object, created with document.implementation.createDocumentType
-        creates nodes that have no document (ScriptExecutionContext), which in turn produces NULL-ref crashes.
-        https://bugs.webkit.org/show_bug.cgi?id=26402
-
-        Test: fast/dom/DOMImplementation/detached-doctype.html
-              fast/dom/doctype-event-listener-crash.html
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getEventListener): Added an extra NULL-check.
-
-2009-09-17  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        FontDescription.h includes RenderStyleConstants.h, which violates layering
-        https://bugs.webkit.org/show_bug.cgi?id=29327
-
-        * GNUmakefile.am: Added FontSmoothingMode.h.
-        * WebCore.gypi: Added FontSmoothingMode.h.
-        * WebCore.vcproj/WebCore.vcproj: Added FontSmoothingMode.h.
-        * WebCore.xcodeproj/project.pbxproj: Added FontSmoothingMode.h and made
-            it a private header.
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Get the
-            font smoothing mode via the font description.
-        * css/CSSPrimitiveValueMappings.h: Include FontSmoothingMode.h
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Updated for the rename
-            of FontSmoothing to FontSmoothingMode.
-        (WebCore::CSSPrimitiveValue::operator FontSmoothingMode): Ditto.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty): Get the font smoothing mode
-            via the font description.
-        * platform/graphics/FontDescription.h: Do not include
-            RenderStyleConstants.h.
-        (WebCore::FontDescription::fontSmoothing): Updated for the rename of
-            FontSmoothing to FontSmoothingMode.
-        (WebCore::FontDescription::setFontSmoothing): Ditto.
-        * platform/graphics/FontSmoothingMode.h: Added.
-        (WebCore::FontSmoothingMode): Moved the FontSmoothing enum from
-            RenderStyleConstants here and renamed it to this.
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::fontSmoothing): Removed this getter, since
-            this can be accessed via the font description.
-        * rendering/style/RenderStyleConstants.h: Moved the FontSmoothing enum
-            from here to FontSmoothingMode.h.
-
-2009-09-17  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx 2.9 build fix.
-
-        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
-        (wxGetGdkWindowForDC):
-
-2009-09-16  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Elements appear behind <video> when they should be in front sometimes
-        https://bugs.webkit.org/show_bug.cgi?id=29314
-        
-        r45598 added logic that tests for overlap with <video> to determine when to throw
-        a layer into compositing mode. That logic was incorrect in some cases, and this patch
-        fixes it. When testing overlap, the layer needs to be composited iff some previous layer
-        is composited (which adds a rect to the overlay map), and there is overlap.
-
-        Test: compositing/geometry/video-opacity-overlay.html
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::CompositingState::CompositingState):
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::AccessibilityRenderObject::getAttribute):
+        (WebCore::AccessibilityRenderObject::stringValue):
+        * platform/PopupMenuClient.h:
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::populate):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemAccessibilityText):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderTextControlSingleLine.h:
+        (WebCore::RenderTextControlSingleLine::itemAccessibilityText):
 
-2009-09-17  Avi Drissman  <avi@google.com>
+2010-03-02  Mads Ager  <ager@chromium.org>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Adam Barth.
 
-        Update the Chromium Mac theming files (RenderTheme and Theme) to be
-        up-to-date.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=29243
-        http://crbug.com/19604
+        [V8] V8 should be notified of context disposals
+        https://bugs.webkit.org/show_bug.cgi?id=35526
 
-        Covered by existing tests.
+        Notify V8 of context disposals to allow it to clean up memory from those
+        contexts when idle.  When disposing a context, start a timer that will
+        give V8 an idle notification after a while to force cleanup.  Use a timer
+        to avoid performing an idle notification in the middle of navigation where
+        we know we are not idle.
 
         * WebCore.gypi:
-        * platform/chromium/ThemeChromiumMac.h: Added.
-        (WebCore::ThemeChromiumMac::ThemeChromiumMac):
-        (WebCore::ThemeChromiumMac::~ThemeChromiumMac):
-        (WebCore::ThemeChromiumMac::controlRequiresPreWhiteSpace):
-        * platform/chromium/ThemeChromiumMac.mm: Added.
-        (WebCore::):
-        (WebCore::platformTheme):
-        (WebCore::controlSizeForFont):
-        (WebCore::sizeFromFont):
-        (WebCore::setControlSize):
-        (WebCore::updateStates):
-        (WebCore::inflateRect):
-        (WebCore::checkboxSizes):
-        (WebCore::checkboxMargins):
-        (WebCore::checkboxSize):
-        (WebCore::checkbox):
-        (WebCore::paintCheckbox):
-        (WebCore::radioSizes):
-        (WebCore::radioMargins):
-        (WebCore::radioSize):
-        (WebCore::radio):
-        (WebCore::paintRadio):
-        (WebCore::buttonSizes):
-        (WebCore::buttonMargins):
-        (WebCore::button):
-        (WebCore::paintButton):
-        (WebCore::ThemeChromiumMac::baselinePositionAdjustment):
-        (WebCore::ThemeChromiumMac::controlFont):
-        (WebCore::ThemeChromiumMac::controlSize):
-        (WebCore::ThemeChromiumMac::minimumControlSize):
-        (WebCore::ThemeChromiumMac::controlBorder):
-        (WebCore::ThemeChromiumMac::controlPadding):
-        (WebCore::ThemeChromiumMac::inflateControlPaintRect):
-        (WebCore::ThemeChromiumMac::paint):
-        * platform/graphics/FloatPoint.h:
-        * platform/graphics/FloatRect.h:
-        * platform/graphics/FloatSize.h:
-        * platform/graphics/IntRect.h:
-        * rendering/RenderThemeChromiumMac.h:
-        (WebCore::RenderThemeChromiumMac::supportsControlTints):
-        (WebCore::RenderThemeChromiumMac::scrollbarControlSizeForPart):
-        (WebCore::RenderThemeChromiumMac::supportsSelectionForegroundColors):
-        * rendering/RenderThemeChromiumMac.mm:
-        (-[WebCoreRenderThemeNotificationObserver systemColorsDidChange:]):
-        (-[RTCMFlippedView isFlipped]):
-        (-[RTCMFlippedView currentEditor]):
-        (WebCore::):
-        (WebCore::FlippedView):
-        (WebCore::RenderTheme::themeForPage):
-        (WebCore::RenderThemeChromiumMac::platformActiveListBoxSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionBackgroundColor):
-        (WebCore::RenderThemeChromiumMac::systemFont):
-        (WebCore::convertNSColorToColor):
-        (WebCore::menuBackgroundColor):
-        (WebCore::RenderThemeChromiumMac::systemColor):
-        (WebCore::RenderThemeChromiumMac::isControlStyled):
-        (WebCore::RenderThemeChromiumMac::adjustRepaintRect):
-        (WebCore::RenderThemeChromiumMac::inflateRect):
-        (WebCore::RenderThemeChromiumMac::convertToPaintingRect):
-        (WebCore::RenderThemeChromiumMac::setFontFromControlSize):
-        (WebCore::RenderThemeChromiumMac::paintTextField):
-        (WebCore::RenderThemeChromiumMac::paintCapsLockIndicator):
-        (WebCore::RenderThemeChromiumMac::paintTextArea):
-        (WebCore::RenderThemeChromiumMac::paintMenuList):
-        (WebCore::TopGradientInterpolate):
-        (WebCore::BottomGradientInterpolate):
-        (WebCore::MainGradientInterpolate):
-        (WebCore::TrackGradientInterpolate):
-        (WebCore::RenderThemeChromiumMac::paintMenuListButtonGradients):
-        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
-        (WebCore::RenderThemeChromiumMac::popupInternalPaddingLeft):
-        (WebCore::RenderThemeChromiumMac::popupInternalPaddingRight):
-        (WebCore::RenderThemeChromiumMac::popupInternalPaddingTop):
-        (WebCore::RenderThemeChromiumMac::popupInternalPaddingBottom):
-        (WebCore::RenderThemeChromiumMac::adjustMenuListButtonStyle):
-        (WebCore::RenderThemeChromiumMac::adjustSliderTrackStyle):
-        (WebCore::RenderThemeChromiumMac::adjustSliderThumbStyle):
-        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintSearchField):
-        (WebCore::RenderThemeChromiumMac::setSearchCellState):
-        (WebCore::RenderThemeChromiumMac::adjustSearchFieldStyle):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeChromiumMac::adjustSearchFieldCancelButtonStyle):
-        (WebCore::RenderThemeChromiumMac::adjustSearchFieldDecorationStyle):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldDecoration):
-        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
-        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
-        (WebCore::mediaControllerTheme):
-        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
-        (WebCore::getMediaUIPartStateFlags):
-        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
-        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintMediaRewindButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaReturnToRealtimeButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
-        (WebCore::RenderThemeChromiumMac::paintMediaCurrentTime):
-        (WebCore::RenderThemeChromiumMac::paintMediaTimeRemaining):
-        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
-
-2009-09-16  Daniel Bates  <dbates@webkit.org>
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::disposeContextHandles):
+        * bindings/v8/V8GCForContextDispose.cpp: Added.
+        (WebCore::V8GCForContextDispose::V8GCForContextDispose):
+        (WebCore::V8GCForContextDispose::notifyContextDisposed):
+        (WebCore::V8GCForContextDispose::notifyIdleSooner):
+        (WebCore::V8GCForContextDispose::instance):
+        (WebCore::V8GCForContextDispose::pseudoIdleTimerFired):
+        * bindings/v8/V8GCForContextDispose.h: Added.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::WindowSetTimeoutImpl):
 
-        Reviewed by Darin Adler.
+2010-03-02  Pavel Feldman  <pfeldman@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29306
-        
-        Fixes an issue where an attack that contains accented characters can
-        bypass the XSSAuditor.
-        
-        XSSAuditor::decodeURL used the wrong length for the input string. 
-        When the input string was decoded, the decoded result was truncated.
-        Hence, XSSAuditor was comparing the source code of the script to the 
-        truncated input parameters.
+        Not reviewed: adding missing image files to WebKit.qrc and gypi.
 
-        Test: http/tests/security/xssAuditor/img-onerror-accented-char.html
+        * WebCore.gypi:
+        * inspector/front-end/WebKit.qrc:
 
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::decodeURL):
+2010-03-02  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-2009-09-16  Brady Eidson  <beidson@apple.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Sam Weinig.
+        [Qt] GraphicsLayer: Video element with 3d transform crashes when AC is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=35516
 
-        Explore allowing pages with unload handlers into the Page Cache
-        https://bugs.webkit.org/show_bug.cgi?id=29021
+        No new tests.
 
-        No new tests. (All previous tests continue to pass)
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQt::setContentsToMedia):
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopLoading): If the document is in the page cache, don't fire the unload event.
+2010-03-02  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
-2009-09-16  Adam Barth  <abarth@webkit.org>
+        Reviewed by Xan Lopez.
 
-        Reviewed by Dimitri Glazkov.
+        Use unsigned instead of uint which does not exist on windows
+        https://bugs.webkit.org/show_bug.cgi?id=35546
 
-        [V8] Teach ScheduledAction::execute about isolated worlds
-        https://bugs.webkit.org/show_bug.cgi?id=27703
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getCairoSurfacePixel):
+        (WebCore::getGdkPixbufPixel):
 
-        We now save a handle to the original context.  We use that handle to
-        call the timeout in the right context / world.
+2010-03-02  Kenneth Russell  <kbr@google.com>
 
-        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
-               http/tests/security/isolatedWorld/window-setTimeout-string.html
+        Reviewed by Darin Fisher.
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/ScheduledAction.h:
-        (WebCore::ScheduledAction::ScheduledAction):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
+        Add EnabledAtRuntime attribute to WebGLArray constructors
+        https://bugs.webkit.org/show_bug.cgi?id=35558
+
+        New functionality verified manually in Chromium; not possible to
+        write layout test. Ran WebGL tests in WebKit as well.
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setWebGLEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLRenderingContextEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLArrayBufferEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLByteArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLUnsignedByteArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLShortArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLUnsignedShortArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLIntArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLUnsignedIntArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLFloatArrayEnabled):
+        * page/DOMWindow.idl:
 
-2009-09-16  Adam Barth  <abarth@webkit.org>
+2010-03-02  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        [V8] Teach ScheduledAction::execute about isolated worlds
-        https://bugs.webkit.org/show_bug.cgi?id=27703
-
-        We now save a handle to the original context.  We use that handle to
-        call the timeout in the right context / world.
+        [V8] Fail gracefully if NPN_GetProperty tries to retrieve a property that doesn't exist.
 
-        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
-               http/tests/security/isolatedWorld/window-setTimeout-string.html
+        https://bugs.webkit.org/show_bug.cgi?id=35588
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/ScheduledAction.h:
-        (WebCore::ScheduledAction::ScheduledAction):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
-
-2009-09-16  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Anders Carlsson.
-
-        Add some groups to the xcode project to make the bindings/js/ group
-        a little nicer.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-09-16  Sam Weinig  <sam@webkit.org>
+        Required for passing LayoutTests/plugins/netscape-plugin-property-access-exception.html on Chromium.
 
-        Reviewed by Anders Carlsson.
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_GetProperty): If the result is empty, don't try to convert it to an NPVariant and return false.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29320
-        JS callback objects should store the global object
+2010-03-02  Jian Li  <jianli@chromium.org>
 
-        This just changes the callback objects to store the global object instead
-        of the frame. A follow up patch will change them to store the 'current' 
-        global object instead of the lexical or dynamic.
+        Reviewed by Nate Chapin.
 
-        * DerivedSources.make: Remove unused VoidCallback.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * bindings/js/JSCustomPositionCallback.cpp:
-        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionCallback.h:
-        (WebCore::JSCustomPositionCallback::create):
-        * bindings/js/JSCustomPositionErrorCallback.cpp:
-        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.h:
-        (WebCore::JSCustomPositionErrorCallback::create):
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementCallback.h:
-        (WebCore::JSCustomSQLStatementCallback::create):
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.h:
-        (WebCore::JSCustomSQLStatementErrorCallback::create):
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::Data::Data):
-        (WebCore::JSCustomSQLTransactionCallback::Data::globalObject):
-        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.h:
-        (WebCore::JSCustomSQLTransactionCallback::create):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
-        (WebCore::JSCustomSQLTransactionErrorCallback::create):
-        * bindings/js/JSCustomVoidCallback.cpp:
-        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
-        (WebCore::JSCustomVoidCallback::handleEvent):
-        * bindings/js/JSCustomVoidCallback.h:
-        (WebCore::JSCustomVoidCallback::create):
-        * bindings/js/JSDatabaseCustom.cpp:
-        (WebCore::JSDatabase::changeVersion):
-        (WebCore::createTransaction):
-        (WebCore::JSDatabase::transaction):
-        (WebCore::JSDatabase::readTransaction):
-        * bindings/js/JSGeolocationCustom.cpp:
-        (WebCore::createPositionCallback):
-        (WebCore::createPositionErrorCallback):
-        (WebCore::JSGeolocation::getCurrentPosition):
-        (WebCore::JSGeolocation::watchPosition):
-        * bindings/js/JSSQLTransactionCustom.cpp:
-        (WebCore::JSSQLTransaction::executeSql):
-
-2009-09-15  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
+        [V8] DOMCoreException should be visible as DOMException 
+        https://bugs.webkit.org/show_bug.cgi?id=35552
 
-        <input maxlength=> should restrict only values specified by users.
-        https://bugs.webkit.org/show_bug.cgi?id=21271
+        Fix V8 code generator to use the correct visible name.
 
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::setValueFromRenderer):
-        (WebCore::InputElement::sanitizeValue):
-        (WebCore::InputElement::sanitizeUserInputValue): Rename from constrainValue().
-        (WebCore::InputElement::handleBeforeTextInsertedEvent):
-        (WebCore::InputElement::updateValueIfNeeded):
-        * dom/InputElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setInputType):
-        (WebCore::HTMLInputElement::value):
-        (WebCore::HTMLInputElement::setValue):
-        (WebCore::HTMLInputElement::sanitizeValue):
-        * html/HTMLInputElement.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::constrainValue):
-        * wml/WMLInputElement.h:
-        (WebCore::WMLInputElement::sanitizeValue):
+        * bindings/scripts/CodeGeneratorV8.pm:
 
-2009-09-16  Enrica Casucci  <enrica@apple.com>
+2010-03-02  Brady Eidson  <beidson@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Sam Weinig.
 
-        Reorganizing helper functions in htmlediting.h to group them by type of object they return/operate upon.
-        https://bugs.webkit.org/show_bug.cgi?id=29319
+        REGRESSION(r51097) - Unable to log in to statefarm.com
+        <rdar://problem/7672667> and https://bugs.webkit.org/show_bug.cgi?id=35556
 
-        * editing/IndentOutdentCommand.cpp:
-        Removed implementation of isAtUnsplittableElement.
+        Test: fast/loader/for-window-event-onload-scripts.html
 
-        * editing/IndentOutdentCommand.h:
-        Removed member function isAtUnsplittableElement, because it was not class specific and belonged logically among the helper functions.
+        Match Gecko's rules for executing "for/event" scripts:
+          -If there's only a 'for' attribute, execute it.
+          -If there's only an 'event' attribute, execute it.
+          -If there's a 'for=window' and 'event=onload', execute it.
+          -If there's a 'for=window' and 'event=onload()', execute it.
+          -If there's any other combination of both 'for' and 'event', don't execute it.
 
-        * editing/htmlediting.cpp:
-        (WebCore::isAtUnsplittableElement): added. The code was taken from IndentOutdentCommand.
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::shouldExecuteAsJavaScript):
+        * dom/ScriptElement.h:
 
-        * editing/htmlediting.h:
-        Reordered functions to group them by type of object returned or operate upon.
-        Added comments.
-        Added isAtUnsplittableElement declaration.
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::eventAttributeValue):
+        * html/HTMLScriptElement.h:
 
-2009-09-16  Geoffrey Garen  <ggaren@apple.com>
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::eventAttributeValue):
+        * svg/SVGScriptElement.h:
 
-        Reviewed by Sam Weinig and Anders Carlsson.
+        Add the event attribute name:
+        * html/HTMLAttributeNames.in:
 
-        Removed some vestigial and potentially crashy code that makes consolidating
-        event listeners hard.
 
-        * dom/Node.cpp:
-        (WebCore::Node::addEventListener): No need to limit when event listeners
-        can be added. Other EventTargets don't do this.
-        
-        Also, check for null when accessing document(). Technically, the JS bindings
-        do this check for us, but let's not rely on that.
+2010-03-02  Simon Fraser  <simon.fraser@apple.com>
 
-2009-09-16  Anders Carlsson  <andersca@apple.com>
+        Reviewed by Dan Bernstein.
 
-        Reviewed by Adam Roben.
+        https://bugs.webkit.org/show_bug.cgi?id=35555
+        QuickTime plugin content can spill outside the <object> tag
 
-        <rdar://problem/7155710>
-        HTML selects on windows cause containing window to become inactive when opened
-        
-        Redo the way we handle events when a popup menu is shown, based on
-        http://blogs.msdn.com/oldnewthing/archive/2004/08/20/217684.aspx
+        Set -masksToBounds on the layer that is handed to us by plug-ins, to ensure that sublayers
+        of that layer don't spill outside the <object> contents rect.
         
-        Since a non-active window can't capture the mouse, we use the owning window 
-        (the WebView) as the capture window. We then run a recursive message pump that 
-        forwards all mouse and keyboard events to the popup menu.
-        
-        * platform/PopupMenu.h:
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::PopupMenu):
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::hide):
-        (WebCore::PopupMenu::wndProc):
-
-2009-09-16  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Ada Chan.
-
-        Speculative fix for
-        <rdar://problem/6937089> Crashes at RenderWidget::destroy()
-
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::destroy): Avoid calling renderArena() if node()
-        is null. Add two assertions that can help determine how this crash
-        happens (in particular, whether node() becomes null during destroy() or
-        it is null before destroy() is called).
-
-2009-09-16  Beth Dakin  <bdakin@apple.com>
-
-        Speculative build fix.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-
-2009-09-16  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Fix for <rdar://problem/7083741> Implement a CSS extension to 
-        adjust sub-pixel anti-aliasing for text
-        -and corresponding-
-        https://bugs.webkit.org/show_bug.cgi?id=29291
-
-        Added tests:
-        * fast/css/font-smoothing.html: Added.
-        * fast/css/parsing-webkit-font-smoothing.html: Added.
-
-        This patch adds a new CSS property called -webkit-font-smoothing 
-        that accepts the following as valid input: auto | none | 
-        antialiased | subpixel-antialiased
-
-        Return appropriate computed style for -webkit-font-smoothing
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-
-        Add a case for CSSPropertyWebkitFontSmoothing, and accept valid 
-        input.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-
-        Add mappings for FontSmoothing to the right CSS values.
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator FontSmoothing):
-
-        Add -webkit-font-smoothing
-        * css/CSSPropertyNames.in:
-
-        Set fontSmoothing on the FontDescription.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-
-        Add antialiased and subpixel-antialiased as possible new CSS 
-        values.
-        * css/CSSValueKeywords.in:
-        Store the font smoothing CSS value in the FontDescription.
-        * platform/graphics/FontDescription.h:
-        (WebCore::FontDescription::FontDescription):
-        (WebCore::FontDescription::fontSmoothing):
-        (WebCore::FontDescription::setFontSmoothing):
-        (WebCore::FontDescription::operator==):
-
-        Call setShouldAntialias() and setShouldUseSmoothing() appropriately 
-        based on the CSS fontSmoothing() value.
-        * platform/graphics/mac/FontMac.mm:
-        (WebCore::Font::drawGlyphs):
-        * platform/graphics/win/FontCGWin.cpp:
-        (WebCore::Font::drawGlyphs):
-
-        New function fontSmoothing()
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::fontSmoothing):
-
-        New enum FontSmoothing.
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-
-2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Remove style property if empty string is entered.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29163
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype._onmouseout): fixed null pointer exception
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.applyStyleText): if styletext to apply is empty it will return an array to confirm the property removal
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertyTreeElement.prototype.):
-        (WebInspector.StylePropertyTreeElement.prototype):
-
-2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Always reset m_implicitShorthand to false after parsing
-        background-repeat style property otherwise properties
-        following after it may be erroneously marked as implicit.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28972
-        https://bugs.webkit.org/show_bug.cgi?id=28973
-
-        Test: fast/backgrounds/repeat/margin-shorthand.html
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-
-2009-09-16  Carol Szabo  <carol.szabo@nokia.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Incorrect behavior of XMLHttpRequest::getAllResponseHeaders and
-        XMLHttpRequest::getResponseHeader in the
-        HEADERS_RECEIVED readyState.
-        https://bugs.webkit.org/show_bug.cgi?id=29121
+        Manual test because it relies on QuickTime, and pixel results depend on movie loading timing.
 
-        Tests: http/tests/xmlhttprequest/getAllResponseHeaders.html
-               http/tests/xmlhttprequest/getResponseHeader.html
+        * manual-tests/plugins/object-clipping.html: Added.
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setupContentsLayer):
 
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::getAllResponseHeaders):
-        (WebCore::XMLHttpRequest::getResponseHeader):
-        Changed the minimum valid state from LOADING to HEADERS_RECEIVED.
+2010-03-02  Adam Roben  <aroben@apple.com>
 
-2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+        Export SecurityOrigin::registerURLSchemeAsSecure
 
-        Reviewed by Dimitri Glazkov.
+        Fixes <http://webkit.org/b/35580> <rdar://problem/7706407> Expose
+        SecurityOrigin::registerURLSchemeAsSecure as WebKit SPI
 
-        [V8] Fix style violation in V8AbstractEventListener.
-        https://bugs.webkit.org/show_bug.cgi?id=29303
+        Reviewed by Tim Hatcher.
 
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8AbstractEventListener::operator==):
+        * WebCore.base.exp: Added symbol, sorted file.
 
-2009-09-16  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+2010-03-02  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Add Watch Expression support to inspector
-        https://bugs.webkit.org/show_bug.cgi?id=27514
-
-        Manual test added.
+        Web Inspector: render breakpoints as border images instead of canvas.
 
-        * English.lproj/localizedStrings.js:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions):
-        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
-        (WebInspector.ConsoleView.prototype._enterKeyPressed):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
-        (WebInspector.ObjectPropertiesSection.prototype.update):
-        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
-        (WebInspector.ObjectPropertiesSection.CompareProperties):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
-        (WebInspector.ObjectPropertyTreeElement.prototype.update):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        (WebInspector.ScriptsPanel.prototype.reset):
-        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
-        * inspector/front-end/WatchExpressionsSidebarPane.js: Added.
-        (WebInspector.WatchExpressionsSidebarPane):
-        (WebInspector.WatchExpressionsSidebarPane.prototype.refreshExpressions):
-        (WebInspector.WatchExpressionsSection):
-        (WebInspector.WatchExpressionsSection.prototype.update):
-        (WebInspector.WatchExpressionsSection.prototype.addExpression):
-        (WebInspector.WatchExpressionsSection.prototype.updateExpression):
-        (WebInspector.WatchExpressionsSection.prototype.findAddedTreeElement):
-        (WebInspector.WatchExpressionsSection.prototype.loadSavedExpressions):
-        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
-        (WebInspector.WatchExpressionsSection.CompareProperties):
-        (WebInspector.WatchExpressionTreeElement):
-        (WebInspector.WatchExpressionTreeElement.prototype.update):
-        (WebInspector.WatchExpressionTreeElement.prototype._deleteButtonClicked):
-        (WebInspector.WatchExpressionTreeElement.prototype.startEditing):
-        (WebInspector.WatchExpressionTreeElement.prototype.editingCancelled):
-        (WebInspector.WatchExpressionTreeElement.prototype.applyExpression):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-        * manual-tests/inspector/debugger-watch-expressions.html: Added.
+        https://bugs.webkit.org/show_bug.cgi?id=35535
 
-2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+        * inspector/front-end/Images/breakpointBorder.png: Added.
+        * inspector/front-end/Images/breakpointConditionalBorder.png: Added.
+        * inspector/front-end/Images/breakpointConditionalCounterBorder.png: Added.
+        * inspector/front-end/Images/breakpointCounterBorder.png: Added.
+        * inspector/front-end/Images/programCounterBorder.png: Added.
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._updateExecutionLine):
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame.prototype.resize):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextChunk):
+        * inspector/front-end/textViewer.css:
 
-        Add ENABLE(INSPECTOR)
-        https://bugs.webkit.org/show_bug.cgi?id=29260
+2010-01-28  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        Reviewed by David Kilzer.
+        Reviewed by Ariya Hidayat.
 
-        No new tests. (No change in default behavior.)
-
-        * DerivedSources.make: Use new WebCore.Inspector.exp file if ENABLE_DRAG_SUPPORT.
-        * WebCore.base.exp: Move Inspector only exports to WebCore.Inspector.exp.
-        * WebCore.xcodeproj/project.pbxproj: Add WebCore.Inspector.exp.
-        * bindings/js/JSDOMWindowBase.cpp: Use ENABLE(INSPECTOR) where applicable.
-        (WebCore::JSDOMWindowBase::supportsProfiling):
-        * bindings/js/JSInspectedObjectWrapper.cpp: Wrap entire file in ENABLE(INSPECTOR).
-        * bindings/js/JSInspectorBackendCustom.cpp: Ditto.
-        * bindings/js/JSInspectorCallbackWrapper.cpp: Ditto.
-        * bindings/js/ScriptObject.cpp: Use ENABLE(INSPECTOR) where applicable.
-        * bindings/js/ScriptObject.h: Ditto.
-        * bindings/js/ScriptObjectQuarantine.cpp: Wrap entire file in ENABLE(INSPECTOR).
-        * dom/Document.cpp: Use ENABLE(INSPECTOR) where applicable.
-        (WebCore::Document::recalcStyle):
-        (WebCore::Document::addMessage):
-        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
-        (WebCore::Document::scriptImported):
-        * dom/Document.h: Ditto.
-        * dom/Node.cpp: Ditto.
-        (WebCore::Node::dispatchGenericEvent):
-        * dom/ScriptExecutionContext.h: Ditto.
-        (WebCore::):
-        * html/HTMLDocument.cpp: Ditto.
-        (WebCore::HTMLDocument::createTokenizer):
-        * html/HTMLTokenizer.cpp: Ditto.
-        (WebCore::HTMLTokenizer::write):
-        * inspector/ConsoleMessage.cpp: Ditto.
-        (WebCore::ConsoleMessage::ConsoleMessage):
-        (WebCore::ConsoleMessage::isEqual):
-        * inspector/ConsoleMessage.h: Ditto.
-        * inspector/DOMDispatchTimelineItem.cpp: Wrap entire file in ENABLE(INSPECTOR).
-        * inspector/InspectorBackend.cpp: Ditto.
-        * inspector/InspectorController.cpp: Ditto.
-        * inspector/InspectorDOMAgent.cpp: Ditto.
-        * inspector/InspectorDOMStorageResource.cpp: Ditto.
-        * inspector/InspectorDatabaseResource.cpp: Ditto.
-        * inspector/InspectorFrontend.cpp: Ditto.
-        * inspector/InspectorResource.cpp: Ditto.
-        * inspector/InspectorTimelineAgent.cpp: Ditto.
-        * inspector/TimelineItem.cpp: Ditto.
-        * loader/FrameLoader.cpp: Use ENABLE(INSPECTOR) where applicable.
-        (WebCore::FrameLoader::detachFromParent):
-        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
-        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
-        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
-        (WebCore::FrameLoader::dispatchDidCommitLoad):
-        (WebCore::FrameLoader::dispatchAssignIdentifierToInitialRequest):
-        (WebCore::FrameLoader::dispatchWillSendRequest):
-        (WebCore::FrameLoader::dispatchDidReceiveResponse):
-        (WebCore::FrameLoader::dispatchDidReceiveContentLength):
-        (WebCore::FrameLoader::dispatchDidFinishLoading):
-        * page/Chrome.cpp: Ditto.
-        (WebCore::Chrome::mouseDidMoveOverElement):
-        * page/Console.cpp: Ditto.
-        (WebCore::Console::addMessage):
-        (WebCore::Console::count):
-        (WebCore::Console::profile):
-        (WebCore::Console::profileEnd):
-        (WebCore::Console::time):
-        (WebCore::Console::timeEnd):
-        (WebCore::Console::group):
-        (WebCore::Console::groupEnd):
-        * page/ContextMenuController.cpp: Ditto.
-        (WebCore::ContextMenuController::handleContextMenuEvent):
-        (WebCore::ContextMenuController::contextMenuItemSelected):
-        * page/DOMWindow.cpp: Ditto.
-        (WebCore::DOMWindow::sessionStorage):
-        (WebCore::DOMWindow::localStorage):
-        * page/EventHandler.cpp: Ditto.
-        (WebCore::EventHandler::handleMousePressEvent):
-        * page/FrameView.cpp: Ditto.
-        (WebCore::FrameView::layout):
-        (WebCore::FrameView::paintContents):
-        * page/FrameView.h: Ditto.
-        * page/Page.cpp: Ditto.
-        (WebCore::Page::Page):
-        (WebCore::Page::~Page):
-        * page/Page.h: Ditto.
-        * platform/ContextMenu.cpp: Ditto.
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
-        * platform/ContextMenuItem.h: Ditto.
-        (WebCore::):
-        * storage/Database.cpp: Ditto.
-        (WebCore::Database::openDatabase):
-        * workers/WorkerContext.cpp: Ditto.
-        (WebCore::WorkerContext::importScripts):
-        * xml/XMLHttpRequest.cpp: Ditto.
-        (WebCore::XMLHttpRequest::didFinishLoading):
+        [Qt] Special case Font::floatWidthForComplexText for single space
+        https://bugs.webkit.org/show_bug.cgi?id=33876
 
-2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+        For a single space we can go through the QFontMetric::width routine
+        instead of converting the WebCore::String to a QString and then
+        going through the QTextLine.
 
-        Add ENABLE(CONTEXT_MENUS)
-        https://bugs.webkit.org/show_bug.cgi?id=29225
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::floatWidthForComplexText):
 
-        Reviewed by David Kilzer.
+2010-02-28  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        No new tests. (No change in default behavior.)
-
-        * DerivedSources.make: Use new WebCore.ContextMenus.exp file if ENABLE_CONTEXT_MENUS.
-        * WebCore.base.exp: Move ContextMenu only exports to WebCore.ContextMenus.exp.
-        * WebCore.xcodeproj/project.pbxproj: Add WebCore.ContextMenus.exp.
-        * dom/Node.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
-        (WebCore::Node::defaultEventHandler):
-        * loader/EmptyClients.h: Ditto.
-        * page/ContextMenuController.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
-        * page/EventHandler.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
-        * page/EventHandler.h: Ditto.
-        * page/Page.cpp: Ditto.
-        (WebCore::Page::Page):
-        * page/Page.h: Ditto.
-        * page/mac/EventHandlerMac.mm: Ditto.
-        * page/mac/WebCoreViewFactory.h: Ditto.
-        * platform/ContextMenu.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
-        * platform/LocalizedStrings.h: Use ENABLE(CONTEXT_MENUS) where applicable.
-        * platform/mac/ContextMenuItemMac.mm: Wrap entire file in ENABLE(CONTEXT_MENUS).
-        * platform/mac/ContextMenuMac.mm: Ditto.
-        * platform/mac/LocalizedStringsMac.mm: Use ENABLE(CONTEXT_MENUS) where applicable.
-        * svg/graphics/SVGImage.cpp: Ditto.
-        (WebCore::SVGImage::dataChanged):
-
-2009-09-16  Dave Hyatt  <hyatt@apple.com>
+        Reviewed by Gustavo Noronha.
 
-        Reviewed by Adam Roben.
+        [Gtk] Support private browsing mode in plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=35500
 
-        Clean up invalidation for repainting.  Hoist the dirty rect intersection test in ScrollViewMac up
-        into ScrollView so that all platforms do it.
-        
-        Patch deferred repaints in FrameView::repaintContentRectangle to only add the visible portion of
-        the rectangle for repainting.
+        Integrate the PluginViewQt.cpp changes from r55358 into Gtk+.
 
-        * page/FrameView.cpp:
-        (WebCore::FrameView::repaintContentRectangle):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::repaintContentRectangle):
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::platformRepaintContentRectangle):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::getValue):
 
-2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+2010-03-02  Oliver Hunt  <oliver@apple.com>
 
-        Add ENABLE(DRAG_SUPPORT)
-        https://bugs.webkit.org/show_bug.cgi?id=29233
+        Reviewed by NOBODY (Build fix).
 
-        Reviewed by David Kilzer.
+        Update Qt bridge to new named getter signature
 
-        No new tests. (No change in default behavior.)
-
-        * DerivedSources.make: Use new WebCore.DragSupport.exp file if ENABLE_DRAG_SUPPORT.
-        * WebCore.base.exp: Move Drag Support only exports to WebCore.DragSupport.exp.
-        * WebCore.xcodeproj/project.pbxproj: Add WebCore.DragSupport.exp.
-        * dom/Clipboard.h: Use ENABLE(DRAG_SUPPORT) where applicable.
-        * loader/EmptyClients.h: Ditto.
-        * page/DragController.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * page/EventHandler.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
-        (WebCore::EventHandler::EventHandler):
-        (WebCore::EventHandler::clear):
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::handleMouseReleaseEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        * page/EventHandler.h: Ditto.
-        * page/Page.cpp: Ditto.
-        (WebCore::Page::Page):
-        * page/Page.h: Ditto.
-        * page/mac/DragControllerMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * page/mac/EventHandlerMac.mm: Use ENABLE(DRAG_SUPPORT) where applicable.
-        (WebCore::EventHandler::passSubframeEventToSubframe):
-        * platform/DragData.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * platform/DragImage.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * platform/mac/ClipboardMac.h: Use ENABLE(DRAG_SUPPORT) where applicable.
-        * platform/mac/ClipboardMac.mm: Ditto.
-        * platform/mac/DragDataMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * platform/mac/DragImageMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * rendering/RenderLayer.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
-        (WebCore::RenderLayer::autoscroll):
-        * rendering/RenderObject.cpp: Ditto.
-        * rendering/RenderObject.h: Ditto.
-        * svg/graphics/SVGImage.cpp: Ditto.
-        (WebCore::SVGImage::dataChanged):
-
-2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wxMSW build fix after adding support for high resolution times in Win.
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::lengthGetter):
+        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter):
+        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter):
+        (JSC::Bindings::QtRuntimeConnectionMethod::lengthGetter):
+        * bridge/qt/qt_runtime.h:
 
-        * page/Settings.cpp:
-        * page/Settings.h:
+2010-03-01  Philippe Normand  <pnormand@igalia.com>
 
-2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+        Reviewed by Gustavo Noronha.
 
-        Reviewed by Dimitri Glazkov.
+        [GTK] Move gstreamer-related source files to platform/graphics/gstreamer
+        https://bugs.webkit.org/show_bug.cgi?id=35518
 
-        [V8] Added operator==() to event listeners. This fixes V8 bindings
-        build broken in http://trac.webkit.org/changeset/48402.
-        https://bugs.webkit.org/show_bug.cgi?id=29298
+        Moved GStreamer-related files to platform/graphics/gstreamer so
+        other ports could benefit from this media player implementation.
 
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Now
-        uses JSEventListenerType.
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8AbstractEventListener::operator==): Only compares
-        pointers since we create at most one wrapper for a JS object.
+        * GNUmakefile.am:
+        * platform/graphics/gstreamer/DataSourceGStreamer.cpp: Renamed from WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp.
+        (_do_init):
+        (webkit_data_src_base_init):
+        (webkit_data_src_class_init):
+        (webkit_data_src_reset):
+        (webkit_data_src_init):
+        (webkit_data_src_finalize):
+        (webkit_data_src_change_state):
+        (webkit_data_src_uri_get_type):
+        (webkit_data_src_uri_get_protocols):
+        (webkit_data_src_uri_get_uri):
+        (webkit_data_src_uri_set_uri):
+        (webkit_data_src_uri_handler_init):
+        * platform/graphics/gstreamer/DataSourceGStreamer.h: Renamed from WebCore/platform/graphics/gtk/DataSourceGStreamer.h.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp: Renamed from WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp.
+        (WebCore::greatestCommonDivisor):
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        (WebCore::mediaPlayerPrivateVolumeChangedCallback):
+        (WebCore::notifyVolumeIdleCallback):
+        (WebCore::mediaPlayerPrivateMuteChangedCallback):
+        (WebCore::notifyMuteIdleCallback):
+        (WebCore::bufferingTimeoutCallback):
+        (WebCore::playbackPosition):
+        (WebCore::mediaPlayerPrivateRepaintCallback):
+        (WebCore::MediaPlayerPrivate::create):
+        (WebCore::MediaPlayerPrivate::registerMediaEngine):
+        (WebCore::doGstInit):
+        (WebCore::MediaPlayerPrivate::isAvailable):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::changePipelineState):
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        (WebCore::MediaPlayerPrivate::duration):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::startEndPointTimerIfNeeded):
+        (WebCore::MediaPlayerPrivate::cancelSeek):
+        (WebCore::MediaPlayerPrivate::endPointTimerFired):
+        (WebCore::MediaPlayerPrivate::paused):
+        (WebCore::MediaPlayerPrivate::seeking):
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::volumeChangedCallback):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::networkState):
+        (WebCore::MediaPlayerPrivate::readyState):
+        (WebCore::MediaPlayerPrivate::buffered):
+        (WebCore::MediaPlayerPrivate::processBufferingStats):
+        (WebCore::MediaPlayerPrivate::queryBufferingStats):
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable):
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded):
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::totalBytes):
+        (WebCore::MediaPlayerPrivate::cancelLoad):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::mediaLocationChanged):
+        (WebCore::MediaPlayerPrivate::loadNextLocation):
+        (WebCore::MediaPlayerPrivate::loadStateChanged):
+        (WebCore::MediaPlayerPrivate::sizeChanged):
+        (WebCore::MediaPlayerPrivate::timeChanged):
+        (WebCore::MediaPlayerPrivate::didEnd):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        (WebCore::MediaPlayerPrivate::supportsMuting):
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::muteChangedCallback):
+        (WebCore::MediaPlayerPrivate::muteChanged):
+        (WebCore::MediaPlayerPrivate::loadingFailed):
+        (WebCore::MediaPlayerPrivate::setSize):
+        (WebCore::MediaPlayerPrivate::setVisible):
+        (WebCore::MediaPlayerPrivate::repaint):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::mimeTypeCache):
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        (WebCore::MediaPlayerPrivate::setAutobuffer):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h: Renamed from WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h.
+        (WebCore::MediaPlayerPrivate::pipelineReset):
+        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp: Renamed from WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp.
+        (webkit_video_sink_base_init):
+        (webkit_video_sink_init):
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        (webkit_video_sink_dispose):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (webkit_video_sink_unlock_stop):
+        (webkit_video_sink_stop):
+        (webkit_video_sink_start):
+        (marshal_VOID__MINIOBJECT):
+        (webkit_video_sink_class_init):
+        (webkit_video_sink_new):
+        * platform/graphics/gstreamer/VideoSinkGStreamer.h: Renamed from WebCore/platform/graphics/gtk/VideoSinkGStreamer.h.
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp: Renamed from WebCore/platform/graphics/gtk/WebKitWebSourceGStreamer.cpp.
+        (doInit):
+        (webkit_web_src_base_init):
+        (webkit_web_src_class_init):
+        (webkit_web_src_init):
+        (webKitWebSrcFinalize):
+        (webKitWebSrcSetProperty):
+        (webKitWebSrcGetProperty):
+        (webKitWebSrcStop):
+        (webKitWebSrcStart):
+        (webKitWebSrcChangeState):
+        (webKitWebSrcUriGetType):
+        (webKitWebSrcGetProtocols):
+        (webKitWebSrcGetUri):
+        (webKitWebSrcSetUri):
+        (webKitWebSrcUriHandlerInit):
+        (webKitWebSrcNeedDataMainCb):
+        (webKitWebSrcNeedDataCb):
+        (webKitWebSrcEnoughDataMainCb):
+        (webKitWebSrcEnoughDataCb):
+        (webKitWebSrcSeekMainCb):
+        (webKitWebSrcSeekDataCb):
+        (webKitWebSrcSetFrame):
+        (StreamingClient::StreamingClient):
+        (StreamingClient::~StreamingClient):
+        (StreamingClient::willSendRequest):
+        (StreamingClient::didReceiveResponse):
+        (StreamingClient::didReceiveData):
+        (StreamingClient::didFinishLoading):
+        (StreamingClient::didFail):
+        (StreamingClient::wasBlocked):
+        (StreamingClient::cannotShowURL):
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.h: Renamed from WebCore/platform/graphics/gtk/WebKitWebSourceGStreamer.h.
+
+2010-03-01  Oliver Hunt  <oliver@apple.com>
 
-2009-09-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        Reviewed by Maciej Stachowiak.
 
-        Reviewed by Xan Lopez.
+        Refactor named getter function signature to be in line with indexing getter signature
+        https://bugs.webkit.org/show_bug.cgi?id=35563
 
-        [GTK] Crash when visiting http://flipper.googlelabs.com/
-        https://bugs.webkit.org/show_bug.cgi?id=29293
+        Fix up WebCore to use the new named getter function signature, update the
+        codegenerator to the new calling convention, and fix the custom bindings.
 
-        Check type for being null or empty before looking it up in the
-        hash of supported types.
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::nameGetter):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::objectToStringFunctionGetter):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::nonCachingStaticFunctionGetter):
+        (WebCore::childFrameGetter):
+        (WebCore::namedItemGetter):
+        * bindings/js/JSDataGridColumnListCustom.cpp:
+        (WebCore::JSDataGridColumnList::nameGetter):
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::JSHTMLCollection::nameGetter):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::nameGetter):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        (WebCore::JSHTMLFrameSetElement::nameGetter):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::nonCachingStaticBackFunctionGetter):
+        (WebCore::nonCachingStaticForwardFunctionGetter):
+        (WebCore::nonCachingStaticGoFunctionGetter):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::nonCachingStaticReplaceFunctionGetter):
+        (WebCore::nonCachingStaticReloadFunctionGetter):
+        (WebCore::nonCachingStaticAssignFunctionGetter):
+        * bindings/js/JSMimeTypeArrayCustom.cpp:
+        (WebCore::JSMimeTypeArray::nameGetter):
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::nameGetter):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::JSNodeList::nameGetter):
+        * bindings/js/JSPluginArrayCustom.cpp:
+        (WebCore::JSPluginArray::nameGetter):
+        * bindings/js/JSPluginCustom.cpp:
+        (WebCore::JSPlugin::nameGetter):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectPropertyGetter):
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::nameGetter):
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        (WebCore::JSStyleSheetList::nameGetter):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::lengthGetter):
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::lengthGetter):
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.cpp:
+        (JSC::Bindings::RuntimeObject::fallbackObjectGetter):
+        (JSC::Bindings::RuntimeObject::fieldGetter):
+        (JSC::Bindings::RuntimeObject::methodGetter):
+        * bridge/runtime_object.h:
 
-        Tested by http/tests/loading/redirect-with-no-location-crash.html
+2010-03-01  Oliver Hunt  <oliver@apple.com>
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::supportsType):
+        Reviewed by Gavin Barraclough.
 
-2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+        PropertySlot::getValue(ExecState, unsigned) unnecessarily converts index to an Identifier
+        https://bugs.webkit.org/show_bug.cgi?id=35561
 
-        Reviewed by Sam Weinig.
-        
-        Removed the notion of "disconnected nodes with event listeners" because
-        it was vestigial. The reference cycle it tried to solve was solved another
-        way in https://bugs.webkit.org/show_bug.cgi?id=21260.
+        Update bindings generation and the few manual indexing getters we have to use
+        the new PropertySlot API.
 
-        * dom/Document.cpp:
-        (WebCore::Document::removeAllEventListeners):
-        * dom/Document.h:
-        * dom/Node.cpp:
-        (WebCore::Node::~Node):
-        (WebCore::Node::insertedIntoDocument):
-        (WebCore::Node::removedFromDocument):
-        (WebCore::Node::willMoveToNewOwnerDocument):
-        (WebCore::Node::didMoveToNewOwnerDocument):
-        (WebCore::Node::addEventListener):
-        (WebCore::Node::removeEventListener):
-        (WebCore::Node::clearAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::indexGetter):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::indexGetter):
+        * bridge/runtime_array.h:
 
-2009-09-15  Chris Fleizach  <cfleizach@apple.com>
+2010-03-01  Chris Fleizach  <cfleizach@apple.com>
 
-        Reviewed by Beth Dakin.
+        Reviewed by Darin Adler.
 
-        WAI-ARIA: add support for ranges, including the progressbar, slider, and spinbutton roles
-        https://bugs.webkit.org/show_bug.cgi?id=28841
+        AX: changes to WAI-ARIA grid aren't perceived correctly by VoiceOver
+        https://bugs.webkit.org/show_bug.cgi?id=35514
 
-        Allow certain ARIA roles to change value with AXIncrement and AXDecrement. 
-        Consolidate increment/decrement/changeValue methods. 
+        When a table's DOM is changed and an AX Table is not asked first for its children,
+        it would return wrong information. A table needs to make sure children are up to date in
+        all methods that can be called from the outside.
 
-        Test: accessibility/aria-slider-value-change.html
+        Test: platform/mac/accessibility/stale-table-rows.html
 
+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::cellForColumnAndRow):
         * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::clearChildren):
         * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::increment):
-        (WebCore::AccessibilityRenderObject::decrement):
-        (WebCore::AccessibilityRenderObject::changeValueByPercent):
-        (WebCore::AccessibilityRenderObject::setValue):
-        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        (WebCore::AccessibilityRenderObject::clearChildren):
+        (WebCore::AccessibilityRenderObject::updateChildrenIfNecessary):
+        (WebCore::AccessibilityRenderObject::children):
         * accessibility/AccessibilityRenderObject.h:
-        * accessibility/AccessibilitySlider.cpp:
-        * accessibility/AccessibilitySlider.h:
-        * dom/Element.cpp:
-        (WebCore::Element::updateAfterAttributeChanged):
+        (WebCore::AccessibilityRenderObject::needsToUpdateChildren):
+        (WebCore::AccessibilityRenderObject::setNeedsToUpdateChildren):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::clearChildren):
+        (WebCore::AccessibilityTable::columns):
+        (WebCore::AccessibilityTable::rows):
+        (WebCore::AccessibilityTable::rowHeaders):
+        (WebCore::AccessibilityTable::columnHeaders):
+        (WebCore::AccessibilityTable::cells):
+        (WebCore::AccessibilityTable::columnCount):
+        (WebCore::AccessibilityTable::rowCount):
+        (WebCore::AccessibilityTable::cellForColumnAndRow):
 
-2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+2010-03-01  Jakob Petsovits  <jpetsovits@rim.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Adam Barth.
 
-        Removed the jsEventListeners set from JSDOMGlobalObject, to simplify
-        creation and destruction of JSDOMGlobalObject and event listeners.
-        
-        Added an abstract operator==() to EventListener, to replace the
-        jsEventListeners set's role in determining if two event listeners are
-        equal from the DOM's perspective.
-        
-        Added a type field to EventListener, and casting operations, to support
-        operator==() and other abstract operations.
+        Convert the zoom mode (page vs. text-only) into a proper enum.
+        https://bugs.webkit.org/show_bug.cgi?id=35347
 
+        * GNUmakefile.am:
+        * WebCore.base.exp: Substituted symbols __ZN7WebCore5Frame13setZoomFactorEfNS_8ZoomModeE
+        and __ZN7WebCore8Settings11setZoomModeENS_8ZoomModeE for __ZN7WebCore5Frame13setZoomFactorEfb
+        and __ZN7WebCore8Settings16setZoomsTextOnlyEb, respectively.
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSDesktopNotificationsCustom.cpp:
-        (WebCore::JSNotification::addEventListener):
+        * page/Frame.cpp:
+        (WebCore::Frame::zoomMode):
+        (WebCore::Frame::shouldApplyTextZoom):
+        (WebCore::Frame::shouldApplyPageZoom):
+        (WebCore::Frame::setZoomFactor):
+        * page/Frame.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setZoomMode):
+        * page/Settings.h:
+        (WebCore::Settings::zoomMode):
+        * page/ZoomMode.h: Added.
         (WebCore::):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener):
-        (WebCore::JSEventListener::~JSEventListener):
-        (WebCore::JSEventListener::markJSFunction):
-        (WebCore::JSEventListener::handleEvent):
-        (WebCore::JSEventListener::reportError):
-        (WebCore::JSEventListener::operator==):
-        * bindings/js/JSEventListener.h:
-        (WebCore::JSEventListener::cast):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/objc/ObjCEventListener.h:
-        (WebCore::ObjCEventListener::cast):
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::ObjCEventListener):
-        (WebCore::ObjCEventListener::operator==):
-        * dom/EventListener.h:
-        (WebCore::EventListener::):
-        (WebCore::EventListener::type):
-        (WebCore::EventListener::EventListener):
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::addEventListener):
-        (WebCore::MessagePort::removeEventListener):
-        * dom/Node.cpp:
-        (WebCore::Node::removeEventListener):
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
-        (WebCore::InspectorDOMAgent::mainFrameDocument):
-        (WebCore::InspectorDOMAgent::operator==):
-        * inspector/InspectorDOMAgent.h:
-        (WebCore::InspectorDOMAgent::cast):
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::cast):
-        (WebCore::ImageEventListener::ImageEventListener):
-        (WebCore::ImageEventListener::operator==):
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::addEventListener):
-        (WebCore::DOMApplicationCache::removeEventListener):
-        * notifications/Notification.cpp:
-        (WebCore::Notification::removeEventListener):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::removeEventListener):
-        * page/EventSource.cpp:
-        (WebCore::EventSource::addEventListener):
-        (WebCore::EventSource::removeEventListener):
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::cast):
-        (WebCore::ConditionEventListener::ConditionEventListener):
-        (WebCore::ConditionEventListener::operator==):
-        (WebCore::ConditionEventListener::handleEvent):
-        * workers/AbstractWorker.cpp:
-        (WebCore::AbstractWorker::addEventListener):
-        (WebCore::AbstractWorker::removeEventListener):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::addEventListener):
-        (WebCore::WorkerContext::removeEventListener):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::addEventListener):
-        (WebCore::XMLHttpRequest::removeEventListener):
-        * xml/XMLHttpRequestUpload.cpp:
-        (WebCore::XMLHttpRequestUpload::addEventListener):
-        (WebCore::XMLHttpRequestUpload::removeEventListener):
-
-2009-09-15  Alex Milowski  <alex@milowski.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Added ENABLE_MATHML to feature defines
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2009-09-14  Andrew Richards  <randrew@gmail.com>
-
-        Reviewed by Sam Weinig.
-
-        Document.elementFromPoint() and Document.caretRangeFromPoint() erroneously returning null at points visible only after scrolling.
-        https://bugs.webkit.org/show_bug.cgi?id=29245
-
-        Use visibleContentRect() instead of boundsRect() when checking hit point bounds on viewport.
-
-        * dom/Document.cpp:
-        (WebCore::Document::elementFromPoint):
-        (WebCore::Document::caretRangeFromPoint):
-
-2009-09-15  Jungshik Shin  <jshin@chromium.org>
-
-        Reviewed by Eric Seidel
-
-        http://bugs.webkit.org/show_bug.cgi?id=26660
-
-        Chromium Windows: When rotated, the baseline for a span of complex
-        script is completely misaligned with that of the adjacent 
-        simple script text. It's fixed by not applying the baseline offset for
-        the Skia code path.
-
-        Test: transforms/2d/hindi-rotated.html
-
-        * platform/graphics/chromium/UniscribeHelper.cpp:
-        (WebCore::UniscribeHelper::draw):
-
-2009-09-15  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Pass the PopupMenu pointer to CreateWindowEx and then get it from the LPCREATESTRUCT in
-        the WM_CREATE handler. This way we don't have to first create an zero size window and then size it.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::PopupMenuWndProc):
-
-2009-09-15  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Darin Adler.
-
-        MessageEvent should not be cancelable by default
-        https://bugs.webkit.org/show_bug.cgi?id=27846
-
-        * dom/MessageEvent.cpp:
-        (WebCore::MessageEvent::MessageEvent):
-        Changed constructor to set cancelable=false by default, per the HTML5 spec.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::setCurrentScale):
 
-2009-09-15  Charles Wei  <charles.wei@torchmobile.com.cn>
+2010-03-01  Alex Milowski  <alex@milowski.com>
 
-        Reviewed by George Staikos.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Fix SVG path parsing error if a command starts with dot '.'
-        https://bugs.webkit.org/show_bug.cgi?id=29123
+        Added support for the msubsup element that also handles the msup and msub elements.
 
-        * svg/SVGParserUtilities.cpp:
-        (WebCore::SVGPathParser::parseSVG):
+        Test: mathml/presentation/subsup.xhtml
 
-2009-09-15  Alexander Pavlov  <apavlov@chromium.org>
+        * WebCore.xcodeproj/project.pbxproj:
+        * mathml/MathMLInlineContainerElement.cpp:
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/RenderMathMLSubSup.cpp: Added.
+        (WebCore::RenderMathMLSubSup::RenderMathMLSubSup):
+        (WebCore::RenderMathMLSubSup::addChild):
+        (WebCore::RenderMathMLSubSup::stretchToHeight):
+        (WebCore::RenderMathMLSubSup::nonOperatorHeight):
+        (WebCore::RenderMathMLSubSup::layout):
+        (WebCore::RenderMathMLSubSup::baselinePosition):
+        * mathml/RenderMathMLSubSup.h: Added.
+        (WebCore::RenderMathMLSubSup::hasBase):
+        (WebCore::RenderMathMLSubSup::):
+
+2010-03-01  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Implement conditional breakpoints in the Web Inspector frontend.
-        https://bugs.webkit.org/show_bug.cgi?id=28908
+        Web Inspector: use dejavu sans mono 11px on linux.
 
-        * English.lproj/localizedStrings.js:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/Breakpoint.js:
-        (WebInspector.Breakpoint.prototype.set condition):
-        * inspector/front-end/Popup.js: Added.
-        (WebInspector.Popup):
-        (WebInspector.Popup.prototype.show):
-        (WebInspector.Popup.prototype.hide):
-        (WebInspector.Popup.prototype.get visible):
-        (WebInspector.Popup.prototype.set element):
-        (WebInspector.Popup.prototype.get element):
-        (WebInspector.Popup.prototype.positionElement):
-        (WebInspector.Popup.prototype.set anchor):
-        (WebInspector.Popup.prototype.get anchor):
-        (WebInspector.Popup.prototype.set autoHide):
-        (WebInspector.Popup.prototype._checkNotVisible):
-        (WebInspector.Popup.prototype._keyEventHandler):
-        (WebInspector.Popup.prototype._mouseDownEventHandler):
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype.revealLine):
-        (WebInspector.SourceFrame.prototype._loaded):
-        (WebInspector.SourceFrame.prototype._documentContextMenu):
-        (WebInspector.SourceFrame.prototype._documentMouseDown):
-        (WebInspector.SourceFrame.prototype._editBreakpointCondition.committed):
-        (WebInspector.SourceFrame.prototype._editBreakpointCondition.dismissed):
-        (WebInspector.SourceFrame.prototype._editBreakpointCondition):
-        (WebInspector.SourceFrame.prototype._showBreakpointConditionPopup):
-        (WebInspector.SourceFrame.prototype._createPopupElement):
-        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
-        (WebInspector.SourceFrame.prototype._removeBreakpointFromSource):
-        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded.drawBreakpoint):
-        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector.set currentFocusElement):
-        (WebInspector.set currentPanel):
-        (WebInspector.loaded):
-        (WebInspector.contextMenu):
-        (WebInspector.elementDragStart):
-        (WebInspector.updateResource):
-        (WebInspector.drawLoadingPieChart):
-        (WebInspector.linkifyURLAsNode):
-        (WebInspector.startEditing.getContent):
-        (WebInspector.startEditing.editingCancelled):
-        (WebInspector.startEditing.editingCommitted):
-        * inspector/front-end/utilities.js:
-        (Element.prototype.positionAt):
-        (Element.prototype.offsetRelativeToWindow):
-
-2009-09-14  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Page cache should support pages with unload handlers as an experiment.
-        <rdar://problem/7196485> and https://bugs.webkit.org/show_bug.cgi?id=29021
-
-        For the experiment, only allow pages with unload handlers into the Page Cache on
-        Mac and Windows.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
-
-2009-09-14  Simon Fraser  <simon.fraser@apple.com>
-
-        Fix the change in r48376 to do a null-check to fix a crashing test.
-
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::menuListDefaultEventHandler):
-
-2009-09-14  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        <rdar://problem/7047282> Safari crashes at WebCore::RenderMenuList::adjustInnerStyle() 436
-        
-        Avoid a crash when a mouse event handler on a <select> changes the select from a popup
-        to a list (by setting the 'size' property) inside the event handler.
-
-        Test: fast/forms/select-change-popup-to-listbox-in-event-handler.html
-
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::menuListDefaultEventHandler):
-
-2009-09-14  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        More PopupMenu cleanup.
-        
-        * platform/PopupMenu.h:
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        Call registerClass.
-        
-        (WebCore::PopupMenu::registerClass):
-        Make this a private static member function so it can refer to PopupMenuWndProc.
-        
-        (WebCore::PopupMenu::PopupMenuWndProc):
-        Try to get the PopupMenu and call its wndProc member function.
-        
-        (WebCore::PopupMenu::wndProc):
-        Make this a member function.
+        https://bugs.webkit.org/show_bug.cgi?id=35527
 
-2009-09-14  Brady Eidson  <beidson@apple.com>
-
-        Not reviewed, maybe should've been:
-
-        Cleaning up more Windows-specific fallout from the fix for:
-        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
-
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::WebCoreSynchronousLoader::load): Don't allow empty CFStrings as the stored credentials,
-          as related checks all look at nullity when they really mean to be looking for emptiness. 
-
-2009-09-14  Anders Carlsson  <andersca@apple.com>
-
-        Speculative Qt build fix.
-        
-        * platform/qt/QWebPopup.cpp:
-        (WebCore::QWebPopup::hidePopup):
+        * inspector/front-end/inspector.css:
 
-2009-09-14  Dirk Pranke  <dpranke@chromium.org>
+2010-03-01  Thatcher Ulrich  <tulrich@google.com>
 
         Reviewed by Darin Fisher.
 
-        Fix RenderThemeChromiumWin::determineClassicState so that classic_state
-        matches the state values (and you get a single classic_state value
-        for a given {part,state} value. This change will be tested by a 
-        chromium patch that will land after this.
-
-        This will be tested by code landing downstream on Chromium.org; the
-        code does not execute on webkit.org.
+        Fix chromium iframe shims.  Add another test case to the
+        iframes-shims test.  After r53637, the plugin widget doesn't get
+        moved every paint.  This used to hide the bug that if an iframe
+        gets added, the plugin's cutout rectangles don't get updated until
+        a layout happens.
+        https://bugs.webkit.org/show_bug.cgi?id=35184
 
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::determineClassicState):
-        (WebCore::RenderThemeChromiumWin::getThemeData):
-
-2009-09-14  Anders Carlsson  <andersca@apple.com>
+        * platform/Widget.h:
+        (WebCore::Widget::widgetPositionsUpdated): new virtual method
+            widgetPositionsUpdated() to notify widgets when other widgets on
+            the page have been repositioned.
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::updateWidgetPositions): call widgetPositionsUpdated() on the widgets
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::widgetPositionsUpdated): call widgetPositionsUpdated() on the widget
+        * rendering/RenderWidget.h:
 
-        Reviewed by Adam Roben.
+2010-03-01  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29138
-        Simplify popup menu handling.
+        Reviewed by Holger Freyther.
 
-        * platform/PopupMenuClient.h:
-        Rename hidePopup to popupDidHide.
-        
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::handleKeyEvent):        
-        (WebCore::PopupListBox::abandon):
-        (WebCore::PopupListBox::acceptIndex):
-        Call popupDidHide instead of hidePopup.
-        
-        * platform/gtk/PopupMenuGtk.cpp:
-        (WebCore::PopupMenu::menuUnmapped):
-        Ditto.
-        
-        * platform/mac/PopupMenuMac.mm:
-        (WebCore::PopupMenu::show):
-        Ditto.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::hide):
-        Call popupDidHide.
-        
-        (WebCore::PopupWndProc):
-        Call PopupMenu::hide.
-        
-        * platform/wx/PopupMenuWx.cpp:
-        (WebCore::PopupMenu::OnMenuItemSelected):
-        Call popupDidHide.
-        
-        * rendering/RenderMenuList.cpp:
-        (WebCore::RenderMenuList::hidePopup):
-        (WebCore::RenderMenuList::popupDidHide):
-        * rendering/RenderMenuList.h:
-        Set the "popup is visible" flag in popupDidHide.
-        
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::hidePopup):
-        (WebCore::RenderTextControlSingleLine::popupDidHide):
-        * rendering/RenderTextControlSingleLine.h:
-        Ditto.
+        Dist some mathml related files
 
-2009-09-14  Anders Carlsson  <andersca@apple.com>
+        * GNUmakefile.am:
 
-        Reviewed by David Hyatt.
+2010-03-01  Kenneth Russell  <kbr@google.com>
 
-        - Fix <rdar://problem/7182275>.
+        Reviewed by Oliver Hunt.
 
-        Make sure that the newly created scrollbar's style is up to date.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::~PopupMenu):
-        Call setParent so that the scrollbar's parts are torn down correctly.
-        
-        (WebCore::PopupMenu::show):
-        Call styleChanged.
+        Integer overflow in WebGL arrays
+        https://bugs.webkit.org/show_bug.cgi?id=35241
 
-2009-09-11  Jon Honeycutt  <jhoneycutt@apple.com>
+        Test: fast/canvas/webgl/webgl-array-invalid-ranges.html
 
-        <rdar://problem/7197644> WebKit should broadcast an MSAA event when
-        jumping to a named anchor
+        * bindings/js/JSWebGLArrayBufferConstructor.cpp:
+        (WebCore::constructCanvasArrayBuffer):
+        * bindings/js/JSWebGLArrayBufferConstructor.h:
+        (WebCore::construct):
+        * bindings/js/JSWebGLArrayHelper.h:
+        (WebCore::setWebGLArrayFromArray):
+        * bindings/js/JSWebGLByteArrayConstructor.cpp:
+        (WebCore::constructCanvasByteArray):
+        * bindings/js/JSWebGLFloatArrayConstructor.cpp:
+        (WebCore::constructCanvasFloatArray):
+        * bindings/js/JSWebGLIntArrayConstructor.cpp:
+        (WebCore::constructCanvasIntArray):
+        * bindings/js/JSWebGLShortArrayConstructor.cpp:
+        (WebCore::constructCanvasShortArray):
+        * bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp:
+        (WebCore::constructCanvasUnsignedByteArray):
+        * bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp:
+        (WebCore::constructCanvasUnsignedIntArray):
+        * bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp:
+        (WebCore::constructCanvasUnsignedShortArray):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::toUInt32):
+        * bindings/v8/V8Binding.h:
+        (WebCore::toUInt32):
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::V8WebGLArrayBuffer::constructorCallback):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::constructWebGLArray):
+        (WebCore::getWebGLArrayElement):
+        (WebCore::setWebGLArrayFromArray):
+        (WebCore::setWebGLArray):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::V8WebGLByteArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::V8WebGLFloatArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::V8WebGLIntArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::V8WebGLShortArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedByteArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedIntArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedShortArray::constructorCallback):
+        * html/canvas/WebGLArray.cpp:
+        (WebCore::WebGLArray::setImpl):
+        * html/canvas/WebGLArray.h:
+        (WebCore::WebGLArray::verifySubRange):
+        (WebCore::WebGLArray::clampOffsetAndNumElements):
+        * html/canvas/WebGLArrayBuffer.cpp:
+        (WebCore::WebGLArrayBuffer::create):
+        (WebCore::WebGLArrayBuffer::WebGLArrayBuffer):
+        (WebCore::WebGLArrayBuffer::tryAllocate):
+        * html/canvas/WebGLArrayBuffer.h:
+        * html/canvas/WebGLByteArray.cpp:
+        (WebCore::WebGLByteArray::create):
+        (WebCore::WebGLByteArray::WebGLByteArray):
+        (WebCore::WebGLByteArray::slice):
+        * html/canvas/WebGLByteArray.h:
+        * html/canvas/WebGLFloatArray.cpp:
+        (WebCore::WebGLFloatArray::create):
+        (WebCore::WebGLFloatArray::WebGLFloatArray):
+        (WebCore::WebGLFloatArray::slice):
+        * html/canvas/WebGLFloatArray.h:
+        * html/canvas/WebGLIntArray.cpp:
+        (WebCore::WebGLIntArray::create):
+        (WebCore::WebGLIntArray::WebGLIntArray):
+        (WebCore::WebGLIntArray::slice):
+        * html/canvas/WebGLIntArray.h:
+        * html/canvas/WebGLShortArray.cpp:
+        (WebCore::WebGLShortArray::create):
+        (WebCore::WebGLShortArray::WebGLShortArray):
+        (WebCore::WebGLShortArray::slice):
+        * html/canvas/WebGLShortArray.h:
+        * html/canvas/WebGLUnsignedByteArray.cpp:
+        (WebCore::WebGLUnsignedByteArray::create):
+        (WebCore::WebGLUnsignedByteArray::WebGLUnsignedByteArray):
+        (WebCore::WebGLUnsignedByteArray::slice):
+        * html/canvas/WebGLUnsignedByteArray.h:
+        * html/canvas/WebGLUnsignedIntArray.cpp:
+        (WebCore::WebGLUnsignedIntArray::create):
+        (WebCore::WebGLUnsignedIntArray::WebGLUnsignedIntArray):
+        (WebCore::WebGLUnsignedIntArray::slice):
+        * html/canvas/WebGLUnsignedIntArray.h:
+        * html/canvas/WebGLUnsignedShortArray.cpp:
+        (WebCore::WebGLUnsignedShortArray::create):
+        (WebCore::WebGLUnsignedShortArray::WebGLUnsignedShortArray):
+        (WebCore::WebGLUnsignedShortArray::slice):
+        * html/canvas/WebGLUnsignedShortArray.h:
+
+2010-03-01  Brady Eidson  <beidson@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28899
+        Reviewed by Sam Weinig.
 
-        Reviewed by Adam Roben.
+        REGRESSION: Telling a WebView to go to its current WebHistoryItem is broken.
+        <rdar://problem/7699371> and https://bugs.webkit.org/show_bug.cgi?id=35532
 
-        * accessibility/AXObjectCache.h:
-        (WebCore::AXObjectCache::):
-        Added declaration for handleScrolledToAnchor(). Added a new entry to
-        the enum of accessibility notifications.
+        Test: fast/loader/api-test-go-to-current-back-forward-item.html
 
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
-        Code moved from AccessibilityRenderObject::internalLinkElement() and
-        refactored slightly; walks the tree until it finds a Node (with a
-        renderer) whose accessibility is not ignored.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): If the current item is the same as the target item, don't
+          consider this to be a same document navigation.
 
-        * accessibility/AccessibilityObject.h:
-        Added a declaration for firstAccessibleObjectFromNode().
+        * page/Page.cpp:
+        (WebCore::Page::goToItem): Hard code the "going to the same item as the current item" relationship
+          as a precondition for stopping all loaders, as that will be a new document load.
 
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::internalLinkElement):
-        Code moved to AccessibilityObject::firstAccessibleObjectFromNode().
+2010-03-01  Robert Hogan  <robert@webkit.org>
 
-        * accessibility/chromium/AXObjectCacheChromium.cpp:
-        (WebCore::AXObjectCache::handleScrolledToAnchor):
-        Stubbed.
+        Reviewed by nobody, build fix.
 
-        * accessibility/gtk/AXObjectCacheAtk.cpp:
-        (WebCore::AXObjectCache::handleScrolledToAnchor):
-        Stubbed.
+        Fix --minimal build. Add ENABLE(DATABASE) as compile time condition
+        for building file GeolocationPositionCache.cpp.
 
-        * accessibility/mac/AXObjectCacheMac.mm:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        Add a default case that returns early for notifications that Mac
-        doesn't handle.
-        (WebCore::AXObjectCache::handleScrolledToAnchor):
-        Stubbed.
+        * page/GeolocationPositionCache.cpp:
 
-        * accessibility/win/AXObjectCacheWin.cpp:
-        (WebCore::AXObjectCache::handleScrolledToAnchor):
-        Post an AXScrolledToAnchor notification for the first accessible from
-        the anchor Node.
-        (WebCore::AXObjectCache::postPlatformNotification):
-        If the notification is AXFocusedUIElementChanged, fire an
-        EVENT_OBJECT_FOCUS. If the notification is AXScrolledToAnchor, fire
-        EVENT_SYSTEM_SCROLLINGSTART, matching Firefox.
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-        Code moved to postPlatformNotification().
+2010-03-01  Jakob Petsovits  <jpetsovits@rim.com>
 
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollToAnchor):
-        Call AXObjectCache::handleScrolledToAnchor().
+        Reviewed by Dirk Schulze.
 
-2009-09-14  Anthony Ricaud  <rik@webkit.org>
+        [OpenVG] Implement support for paths
+        https://bugs.webkit.org/show_bug.cgi?id=34366
 
-        Reviewed by Timothy Hatcher.
+        Adds an implementation of the Path class -
+        *almost* complete, but not quite because OpenVG
+        does not provide access to the points in a VGPath
+        unless one keeps track of all the points by
+        themselves, which we decided not to do.
 
-        Cookies are not inspectable after reloading a page
-        https://bugs.webkit.org/show_bug.cgi?id=29222
+        Also hooked up to PainterOpenVG and GraphicsContext.
 
-        Create the cookieTreeElement on initialization instead of when the view is shown.
-        Reset the selected element of the sidebar on reset.
+        Further introduced is SharedResourceOpenVG, which is
+        intended as base class for paths and other OpenVG
+        resources (images, fonts) that WebKit creates as
+        long-lived objects. We are at a slight disadvantage
+        here as WebKit doesn't have the concept of resources
+        belonging to a specific (hardware graphics) context,
+        which is the reason why EGLDisplayOpenVG had to
+        provide a current display singleton; this class is
+        what actually requires that functionality.
 
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel):
-        (WebInspector.StoragePanel.prototype.show):
-        (WebInspector.StoragePanel.prototype.reset):
+        Path::addArcTo() uses code by Yong Li <yoli@rim.com>.
 
+        * platform/graphics/Path.cpp:
+        * platform/graphics/Path.h:
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::beginPath):
+        (WebCore::GraphicsContext::addPath):
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::PainterOpenVG::PainterOpenVG):
+        (WebCore::PainterOpenVG::~PainterOpenVG):
+        (WebCore::PainterOpenVG::transformPath):
+        (WebCore::PainterOpenVG::beginPath):
+        (WebCore::PainterOpenVG::addPath):
+        (WebCore::PainterOpenVG::currentPath):
+        (WebCore::PainterOpenVG::drawPath):
+        * platform/graphics/openvg/PainterOpenVG.h:
+        * platform/graphics/openvg/PathOpenVG.cpp: Added.
+        (WebCore::PlatformPathOpenVG::PlatformPathOpenVG):
+        (WebCore::PlatformPathOpenVG::operator=):
+        (WebCore::PlatformPathOpenVG::~PlatformPathOpenVG):
+        (WebCore::PlatformPathOpenVG::clear):
+        (WebCore::PlatformPathOpenVG::createPath):
+        (WebCore::Path::Path):
+        (WebCore::Path::~Path):
+        (WebCore::Path::operator=):
+        (WebCore::Path::contains):
+        (WebCore::Path::strokeContains):
+        (WebCore::Path::translate):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::strokeBoundingRect):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::clear):
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::hasCurrentPoint):
+        (WebCore::Path::debugString):
+        (WebCore::Path::apply):
+        (WebCore::Path::transform):
+        (WebCore::Path::length):
+        (WebCore::Path::pointAtLength):
+        (WebCore::Path::normalAngleAtLength):
+        * platform/graphics/openvg/PlatformPathOpenVG.h: Added.
+        (WebCore::PlatformPathOpenVG::vgPath):
+        * platform/graphics/openvg/SharedResourceOpenVG.cpp: Added.
+        (WebCore::SharedResourceOpenVG::makeSharedContextCurrent):
+        (WebCore::SharedResourceOpenVG::makeCompatibleContextCurrent):
+        * platform/graphics/openvg/SharedResourceOpenVG.h: Added.
 
-2009-09-14  Brady Eidson  <beidson@apple.com>
+2010-03-01  Pavel Feldman  <pfeldman@chromium.org>
 
-        Windows build fix.
+        Not reviewed, bring English.lproj/locallizedStrings.js back to binary (UTF) mode.
 
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceHandle::receivedCredential):
-        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
-        (WebCore::WebCoreSynchronousLoader::load):
+        * English.lproj/localizedStrings.js:
 
-2009-09-14  Brady Eidson  <beidson@apple.com>
+2010-03-01  Jakob Petsovits  <jpetsovits@rim.com>
 
-        Reviewed by Alexey Proskuryakov.
+        Reviewed by Nikolas Zimmermann.
 
-        Safari 4 cannot be used to update firmware on Linksys routers.
-        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+        [OpenVG] Convert from TransformationMatrix to AffineTransform.
+        https://bugs.webkit.org/show_bug.cgi?id=35445
 
-        In http://trac.webkit.org/changeset/42483, we disabled CFNetwork's session credential storage and 
-        implemented our own in WebCore.
+        Dirk Schulze previously introduced AffineTransform as
+        replacement for most TransformationMatrix occurrences
+        in GraphicsContext & Co., but did not update the OpenVG
+        graphics backend as there's no publicly available way
+        to build it. This commit now takes care of that.
 
-        One feature we lost is that CFNetwork would automatically send previously authenticated credentials
-        with new connections when the paths match, as allowed by RFC 2617 for HTTP Basic and Digest Authentication.  
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::origin):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::isNonRotatedAffineTransformation):
+        (WebCore::PlatformPainterState::PlatformPainterState):
+        (WebCore::PlatformPainterState::applyState):
+        (WebCore::PlatformPainterState::applyTransformation):
+        (WebCore::PainterOpenVG::transformation):
+        (WebCore::PainterOpenVG::concatTransformation):
+        (WebCore::PainterOpenVG::setTransformation):
+        (WebCore::PainterOpenVG::scale):
+        (WebCore::PainterOpenVG::rotate):
+        (WebCore::PainterOpenVG::translate):
+        (WebCore::PainterOpenVG::intersectClipRect):
+        * platform/graphics/openvg/PainterOpenVG.h:
+        * platform/graphics/openvg/VGUtils.cpp:
+        (WebCore::VGMatrix::VGMatrix):
+        (WebCore::VGMatrix::operator AffineTransform):
+        (WebCore::VGMatrix::operator TransformationMatrix):
+        (WebCore::AffineTransform::operator VGMatrix):
+        * platform/graphics/openvg/VGUtils.h:
+        * platform/graphics/transforms/AffineTransform.h:
+
+2010-03-01  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Even though it's optional for User Agents to do this, (some?) Linksys routers rely on this behavior for
-        HTTP Basic Authentication.  So now WebCore's CredentialStorage will track URL paths for Basic credentials.
+        Reviewed by Simon Hausmann.
 
-        We're not making this enhancement for Digest at this time, since we don't know of anything that broke
-        due to the change in Digest behavior.
+        [Qt] Fix segfault when drawing NPAPI plugins on Mac
 
-        Test: http/tests/loading/basic-credentials-sent-automatically.html
-              http/tests/loading/basic-auth-resend-wrong-credentials.html
+        Don't try to get a contexctRef for a null-pixmap. If the pixmap
+        size is 0,0 the private pixmap data has not yet been initialized.
 
-        * WebCore.base.exp:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
+        * plugins/mac/PluginViewMac.cpp:
 
-        * platform/network/Credential.cpp:
-        (WebCore::Credential::isEmpty):
-        * platform/network/Credential.h:
-
-        Add a slightly more full featured CredentialStore that will track URL paths a credential belongs to:
-        * platform/network/CredentialStorage.cpp: Added.
-        (WebCore::protectionSpaceToCredentialMap):
-        (WebCore::originToDefaultCredentialMap):
-        (WebCore::originStringFromURL):
-        (WebCore::CredentialStorage::set):
-        (WebCore::CredentialStorage::get):
-        (WebCore::CredentialStorage::getDefaultAuthenticationCredential):
-        * platform/network/CredentialStorage.h: Added.
-
-        Allow ProtectionSpace to be a hash key:
-        * platform/network/ProtectionSpace.cpp:
-        (WebCore::ProtectionSpace::ProtectionSpace):
-        * platform/network/ProtectionSpace.h:
-        (WebCore::ProtectionSpace::ProtectionSpace):
-        (WebCore::ProtectionSpace::isHashTableDeletedValue):
-        * platform/network/ProtectionSpaceHash.h: Added.
-        (WebCore::ProtectionSpaceHash::hash):
-        (WebCore::ProtectionSpaceHash::equal):
-
-        Allow ResourceHandles to remember the initial credential they used:
-        * platform/network/ResourceHandleInternal.h:
+2010-03-01  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Allow mutable ResourceRequests to update their platform object if HTTP header fields change:
-        * platform/network/ResourceRequestBase.cpp:
-        (WebCore::ResourceRequestBase::addHTTPHeaderField):
+        Reviewed by Simon Hausmann.
 
-        Remove WebCoreCredentialStorage:
-        * platform/network/cf/AuthenticationCF.cpp:
-        * platform/network/cf/AuthenticationCF.h:
-        * platform/network/mac/AuthenticationMac.h:
-        * platform/network/mac/AuthenticationMac.mm:
+        Fix the Qt build on Mac OS X/Cocoa 64-bit
 
-        Change ResourceHandleCFNet to try to use stored credentials on new connections, if appropriate:
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
-          Credential if it does not match the initially used Credential.
-        (WebCore::ResourceHandle::receivedCredential):
-        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge): Only try the ProtectionSpace key'ed
-          Credential if it does not match the initially used Credential.
-        (WebCore::WebCoreSynchronousLoader::load):
-
-        Change ResourceHandleMac to try to use stored credentials on new connections, if appropriate:
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
-          Credential if it does not match the initially used Credential.
-        (WebCore::ResourceHandle::receivedCredential):
-        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Only try the 
-          ProtectionSpace key'ed Credential if it does not match the initially used Credential.
-        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
-
-        Add base64-ability to CString:
-        * platform/text/CString.cpp:
-        (WebCore::CStringBuffer::base64Encode):
-        (WebCore::CString::base64Encode):
-        * platform/text/CString.h:
-        (WebCore::CStringBuffer::create):
-        (WebCore::CStringBuffer::CStringBuffer):
+        Use the proper event/drawing-model guards instead of global 64-bit
+        guard for the NPAPI plugin implementation (view and package).
 
-2009-09-12  Mark Rowe  <mrowe@apple.com>
+        * plugins/mac/PluginPackageMac.cpp: Change guards and fix warning
+        * plugins/mac/PluginViewMac.cpp: Remove 64-bit guard
 
-        Reviewed by Dan Bernstein.
+2010-02-27  Pavel Feldman  <pfeldman@chromium.org>
 
-        Fix <rdar://problem/6954546> Crashes in WebCore::RenderPart::setWidget below FrameLoader::loadPlugin.
+        Reviewed by Timothy Hatcher.
 
-        The calls to FrameLoader::requestObject within RenderPartObject::updateWidget can result in a plug-in
-        being initialized.  This can run cause arbitrary JavaScript to run and may result in the RenderPartObject
-        being detached from the render tree and destroyed, causing a crash like <rdar://problem/6954546>.
+        Web Inspector: disable breakpoint upon Shift-click.
 
-        No test is possible until <rdar://problem/7090444> is fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=35477
 
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::updateWidget): Ensure that we stay alive for the duration of plug-in initialization.
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._format):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._mouseDown):
+        (WebInspector.SourceFrame.prototype._mouseMove):
+        * inspector/front-end/textViewer.css:
 
-2009-09-12  Mark Rowe  <mrowe@apple.com>
+2010-02-28  Alexey Proskuryakov  <ap@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        Add RenderWidgetProtector to simplify protecting a RenderWidget from destruction for the
-        duration of a function.  Deploy it within RenderWidget.
-
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::setWidgetGeometry):
-        (WebCore::RenderWidget::updateWidgetPosition): Use a RefPtr rather than explicitly
-        ref'ing and deref'ing the node.
-        * rendering/RenderWidget.h:
-        * rendering/RenderWidgetProtector.h:
-        (WebCore::RenderWidgetProtector::RenderWidgetProtector):
-        (WebCore::RenderWidgetProtector::~RenderWidgetProtector):
-
-2009-09-14  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Eric Seidel.
-
-        CodeGenerator.pm needs some cleaning up
-        https://bugs.webkit.org/show_bug.cgi?id=29238
-
-        * bindings/scripts/CodeGenerator.pm:
-        (FindParentsRecursively): Removed; its functionality is now handled in
-        AddMethodsConstantsAndAttributesFromParentClasses.
-        (ForAllParents): New function that visits an interface's ancestors and
-        invokes a callback for each one.
-        (AddMethodsConstantsAndAttributesFromParentClasses): Simplified by using
-        ForAllParents.
-        (GetMethodsAndAttributesFromParentClasses): Ditto.
-        (IDLFileForInterface): Factored out previous calls to ScanDirectory into
-        this new function, which returns the filename containing a given IDL
-        interface definition.
-        (ParseInterface): Simplified by using IDLFileForInterface.
-        (ScanDirectory): Removed in lieu of IDLFileForInterface.
-        * bindings/scripts/CodeGeneratorV8.pm: Drop call to
-        FindParentsRecursively and get the list of parents from the
-        AddMethodsConstantsAndAttributesFromParentClasses call instead.
-
-2009-09-14  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Assert hit when dropping a file in QtLauncher
-        https://bugs.webkit.org/show_bug.cgi?id=29242
-
-        Qt's implementation of DropData::asURL does not return a URL encoded string
-        as expected.
-
-        * platform/qt/DragDataQt.cpp:
-        (WebCore::DragData::asURL):
-
-2009-09-13  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix, file was missed during TLS.cpp removal.
+        https://bugs.webkit.org/show_bug.cgi?id=35496
+        <rdar://problem/7663444> Opening newsweek.com and youtube.com has become very slow in debug builds
 
-        * page/wx/FrameWx.cpp: Added.
-        (WebCore::Frame::dragImageForSelection):
-
-2009-09-13  Anthony Ricaud  <rik@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Web Inspector: Add "New Style Rule" to the localizedStrings
-        https://bugs.webkit.org/show_bug.cgi?id=29237
-
-        * English.lproj/localizedStrings.js:
-
-2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        [wx] Implement filesystem functions.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29196
-
-        * platform/wx/FileSystemWx.cpp:
-        (WebCore::fileExists):
-        (WebCore::deleteFile):
-        (WebCore::deleteEmptyDirectory):
-        (WebCore::getFileSize):
-        (WebCore::getFileModificationTime):
-        (WebCore::makeAllDirectories):
-        (WebCore::pathByAppendingComponent):
-        (WebCore::homeDirectoryPath):
-        (WebCore::directoryName):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSRuleSet::getIDRules):
+        (WebCore::CSSRuleSet::getClassRules):
+        (WebCore::CSSRuleSet::getTagRules):
+        Removed consistency checks, as they affect performance too much in this case.
 
-2009-09-12  Kevin Ollivier  <kevino@theolliviers.com>
+2010-02-28  Robert Hogan  <robert@roberthogan.net>
 
-        wx build fixes for wx 2.9.
+        Reviewed by Simon Hausmann.
 
-        * platform/wx/ScrollbarThemeWx.cpp:
-        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
-        (wxGetGdkWindowForDC):
+        [Qt] Support private browsing mode in plugins
 
-2009-09-12  Oliver Hunt  <oliver@apple.com>
+        Add support for NPNVprivateModeBool property in plugins.
 
-        Reviewed by Maciej Stachowiak.
+        See also: https://developer.mozilla.org/En/Supporting_private_browsing_in_plugins
 
-        [ES5] Implement Object.keys
-        https://bugs.webkit.org/show_bug.cgi?id=29170
+        The NPNVprivateModeBool property is supported as scriptable property privateBrowsingEnabled
+        in the test WebKit plugin. The Mac platform also supports a cachedPrivateBrowsingEnabled
+        property implemented in the test plugin. This allows the Layout test
+        plugins/private-browsing-mode.html to retrieve the previous value of NPNVprivateModeBool
+        in the test plugin. Due to the platform-specific overhead required to support this bespoke
+        property it is not implemented as part of this patch, instead a new test,
+        plugins/private-browsing-mode-2.html, is added to ensure that setting and resetting
+        privateBrowsingEnabled works as expected.
 
-        Switch from getPropertyNames to getOwnPropertyNames, and provide custom
-        getPropertyNames to DOMWindow, DOMWindowShell and QuarantinedObjectWrapper
-        in order to ensure correct semantics are maintained.
+        http://bugs.webkit.org/show_bug.cgi?id=33180
 
-        Test: fast/js/Object-keys.html
+        Test: plugins/private-browsing-mode-2.html
 
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::getOwnPropertyNames):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::getOwnPropertyNames):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSHistoryCustom.cpp:
-        (WebCore::JSHistory::getOwnPropertyNames):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::getOwnPropertyNames):
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::getPropertyNames):
-        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyNames):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSStorageCustom.cpp:
-        (WebCore::JSStorage::getOwnPropertyNames):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::getPropertyNames):
-        (JSC::RuntimeObjectImp::getOwnPropertyNames):
-        * bridge/runtime_object.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::getValue):
 
-2009-09-12  Sam Weinig  <sam@webkit.org>
 
-        Reviewed by Anders Carlsson.
+2010-02-27  Joseph Pecoraro  <joepeck@webkit.org>
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29219
-        Document.elementFromPoint() should take page scroll into consideration
+        Reviewed by Timothy Hatcher.
 
-        Test: fast/dom/elementFromPoint-relative-to-viewport.html
+        Web Inspector shouldn't show a white color box for "-webkit-line-break: after-white-space"
+        https://bugs.webkit.org/show_bug.cgi?id=33478
 
-        * dom/Document.cpp:
-        (WebCore::Document::elementFromPoint):
-        (WebCore::Document::caretRangeFromPoint):
+        * inspector/front-end/StylesSidebarPane.js:
 
-2009-09-12  Sam Weinig  <sam@webkit.org>
+2010-02-27  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Maciej Stachowiak.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29217
-        Document.caretRangeFromPoint should take the scroll offset into account before hit testing
-
-        In accordance with the CSSOM View Module spec, Document.caretRangeFromPoint should interpret
-        the point passed to it as relative to the viewport, not the document.
-
-        Test: fast/dom/Document/CaretRangeFromPoint/hittest-relative-to-viewport.html
-
-        * dom/Document.cpp:
-        (WebCore::Document::caretRangeFromPoint):
-
-2009-09-11  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Added some manual tests to show WebGL in action
-        https://bugs.webkit.org/show_bug.cgi?id=29215
-
-        * manual-tests/webgl: Added.
-        * manual-tests/webgl/Earth.html: Added.
-        * manual-tests/webgl/ManyPlanetsDeep.html: Added.
-        * manual-tests/webgl/SpinningBox.html: Added.
-        * manual-tests/webgl/TeapotPerPixel.html: Added.
-        * manual-tests/webgl/TeapotPerVertex.html: Added.
-        * manual-tests/webgl/resources: Added.
-        * manual-tests/webgl/resources/CanvasMatrix.js: Added.
-        * manual-tests/webgl/resources/earthmap1k.jpg: Added.
-        * manual-tests/webgl/resources/mars500x250.png: Added.
-        * manual-tests/webgl/resources/teapot.obj: Added.
-        * manual-tests/webgl/resources/utils3d.js: Added.
- 
-2009-09-10  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        aria definition role spelled wrong "defintion"
-        https://bugs.webkit.org/show_bug.cgi?id=28840
-
-        Test: accessibility/aria-slider-value-change.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::RoleEntry::):
-
-2009-09-11  Erik Arvidsson  <arv@chromium.org>
-
-        Reviewed by Eric Seidel.
+        <rdar://problem/7696607> Links do not respect -webkit-user-drag: none
+        https://bugs.webkit.org/show_bug.cgi?id=35475
 
-        Fixes an assert in Node::isFocusable which was causing crashes in certain cases.
-        https://bugs.webkit.org/show_bug.cgi?id=29210
+        Test: fast/css/user-drag-none.html
 
-        * dom/Node.cpp:
-        (WebCore::Node::isFocusable):
-
-2009-09-11  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Added variants to uniform* and vertexAttrib* calls which take sequence<> in place of CanvasArray
-        https://bugs.webkit.org/show_bug.cgi?id=29139
-        
-        I also added a data() call to each of the CanvasArray subclasses to give back a types pointer
-        to the baseAddress().
-
-        * Configurations/FeatureDefines.xcconfig:
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
-        (WebCore::toArray):
-        (WebCore::):
-        (WebCore::dataFunctionf):
-        (WebCore::dataFunctioni):
-        (WebCore::dataFunctionMatrix):
-        (WebCore::JSCanvasRenderingContext3D::uniform1fv):
-        (WebCore::JSCanvasRenderingContext3D::uniform1iv):
-        (WebCore::JSCanvasRenderingContext3D::uniform2fv):
-        (WebCore::JSCanvasRenderingContext3D::uniform2iv):
-        (WebCore::JSCanvasRenderingContext3D::uniform3fv):
-        (WebCore::JSCanvasRenderingContext3D::uniform3iv):
-        (WebCore::JSCanvasRenderingContext3D::uniform4fv):
-        (WebCore::JSCanvasRenderingContext3D::uniform4iv):
-        (WebCore::JSCanvasRenderingContext3D::uniformMatrix2fv):
-        (WebCore::JSCanvasRenderingContext3D::uniformMatrix3fv):
-        (WebCore::JSCanvasRenderingContext3D::uniformMatrix4fv):
-        (WebCore::JSCanvasRenderingContext3D::vertexAttrib1fv):
-        (WebCore::JSCanvasRenderingContext3D::vertexAttrib2fv):
-        (WebCore::JSCanvasRenderingContext3D::vertexAttrib3fv):
-        (WebCore::JSCanvasRenderingContext3D::vertexAttrib4fv):
-        * html/canvas/CanvasByteArray.h:
-        (WebCore::CanvasByteArray::data):
-        * html/canvas/CanvasFloatArray.h:
-        (WebCore::CanvasFloatArray::data):
-        * html/canvas/CanvasIntArray.h:
-        (WebCore::CanvasIntArray::data):
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        (WebCore::CanvasRenderingContext3D::uniform1fv):
-        (WebCore::CanvasRenderingContext3D::uniform1iv):
-        (WebCore::CanvasRenderingContext3D::uniform2fv):
-        (WebCore::CanvasRenderingContext3D::uniform2iv):
-        (WebCore::CanvasRenderingContext3D::uniform3fv):
-        (WebCore::CanvasRenderingContext3D::uniform3iv):
-        (WebCore::CanvasRenderingContext3D::uniform4fv):
-        (WebCore::CanvasRenderingContext3D::uniform4iv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
-        * html/canvas/CanvasRenderingContext3D.h:
-        * html/canvas/CanvasRenderingContext3D.idl:
-        * html/canvas/CanvasShortArray.h:
-        (WebCore::CanvasShortArray::data):
-        * html/canvas/CanvasUnsignedByteArray.h:
-        (WebCore::CanvasUnsignedByteArray::data):
-        * html/canvas/CanvasUnsignedIntArray.h:
-        (WebCore::CanvasUnsignedIntArray::data):
-        * html/canvas/CanvasUnsignedShortArray.h:
-        (WebCore::CanvasUnsignedShortArray::data):
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::uniform1fv):
-        (WebCore::GraphicsContext3D::uniform2fv):
-        (WebCore::GraphicsContext3D::uniform3fv):
-        (WebCore::GraphicsContext3D::uniform4fv):
-        (WebCore::GraphicsContext3D::uniform1iv):
-        (WebCore::GraphicsContext3D::uniform2iv):
-        (WebCore::GraphicsContext3D::uniform3iv):
-        (WebCore::GraphicsContext3D::uniform4iv):
-        (WebCore::GraphicsContext3D::uniformMatrix2fv):
-        (WebCore::GraphicsContext3D::uniformMatrix3fv):
-        (WebCore::GraphicsContext3D::uniformMatrix4fv):
-        (WebCore::GraphicsContext3D::vertexAttrib1fv):
-        (WebCore::GraphicsContext3D::vertexAttrib2fv):
-        (WebCore::GraphicsContext3D::vertexAttrib3fv):
-        (WebCore::GraphicsContext3D::vertexAttrib4fv):
-
-2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Add ENABLE(WEB_SOCKETS) guards.
-        https://bugs.webkit.org/show_bug.cgi?id=29174
-
-        * bindings/v8/custom/V8WebSocketCustom.cpp:
-
-2009-09-11  Eric Seidel  <eric@webkit.org>
-
-        No review, rolling out r48229.
-        http://trac.webkit.org/changeset/48229
-
-        * WebCore.base.exp:
-        * dom/Clipboard.cpp:
-        (WebCore::Clipboard::Clipboard):
-        (WebCore::Clipboard::sourceOperation):
         * page/DragController.cpp:
-        (WebCore::DragController::DragController):
-        (WebCore::DragController::dragExited):
-        (WebCore::DragController::performDrag):
-        (WebCore::DragController::dragEnteredOrUpdated):
-        (WebCore::DragController::tryDHTMLDrag):
-        (WebCore::DragController::startDrag):
+        (WebCore::DragController::mayStartDragAtEventLocation): Added a node
+        parameter. The image drag check is done against the node, rather than
+        than against the hit test result. This prevents a non-draggable image
+        with an auto-draggable ancestor from being dragged alone. The link drag
+        check now ignores links that are -webkit-user-drag: none.
         * page/DragController.h:
         * page/EventHandler.cpp:
-        (WebCore::EventHandler::updateDragAndDrop):
-        (WebCore::EventHandler::dragSourceMovedTo):
-        (WebCore::EventHandler::handleDrag):
-        * page/EventHandler.h:
+        (WebCore::EventHandler::shouldDragAutoNode): Pass the current node
+        to mayStartDragAtEventLocation().
 
-2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+2010-02-27  Pavel Feldman  <pfeldman@chromium.org>
 
-        Fix the build.
+        Reviewed by Timothy Hatcher.
 
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::typeMismatch):
+        Web Inspector: REGRESSION: hangs when scrolling in Resource pane.
 
-2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35216
 
-        Reviewed by Antti Koivisto.
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype._highlightInChunks):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLines):
 
-        https://bugs.webkit.org/show_bug.cgi?id=27456
-        Added support for static validation of url in
-        ValidityState, for url state inputs.
-        From HTML5 specs:
-        http://www.whatwg.org/specs/web-apps/current-work/#url-state
+2010-02-27  Xan Lopez  <xlopez@igalia.com>
 
-        Test: fast/forms/ValidityState-typeMismatch-url.html
+        Reviewed by Gustavo Noronha.
 
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::typeMismatch):
+        Abort XEmbed plugin initialization if our parent is not anchored
+        in a widget hierarchy. This can happen when the browser window is
+        destroyed while the plugin is being loaded, and will lead to a
+        crash.
 
-2009-09-11  Evan Stade  <estade@chromium.org>
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::platformStart):
 
-        Reviewed by Darin Adler.
+2010-02-26  Pavel Feldman  <pfeldman@chromium.org>
 
-        Revert r47992: Expose functions to change the focus ring color for
-        Linux Chromium.
+        Reviewed by Timothy Hatcher.
 
-        As Darin Fisher has pointed out, there is a better way to do this.
+        Web Inspector: reload inspected page on Cmd+R / Ctrl+R / F5 key event in inspector.
+        Drive-by fix for couple of minor front-end problems.
 
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
-        * rendering/RenderThemeChromiumLinux.h:
+        https://bugs.webkit.org/show_bug.cgi?id=35434
 
-2009-09-11  Alexey Proskuryakov  <ap@webkit.org>
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::reloadPage):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.reloadPage):
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub.prototype.copyText):
+        (.WebInspector.InspectorFrontendHostStub.prototype.canAttachWindow):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._paintLine):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+        (WebInspector.toggleAttach):
 
-        Reviewed by Geoff Garen.
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29207
-        Add checks for using WebCore JS context on secondary threads
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::commonJSGlobalData):
-        Set the new debug-only mainThreadOnly flag.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-2009-09-11  Brian Weinstein  <bweinstein@apple.com>
+        * platform/efl/ScrollbarEfl.cpp: Added.
+        * platform/efl/EventLoopEfl.cpp: Added.
+        * platform/efl/PlatformKeyboardEventEfl.cpp: Added.
+        * platform/efl/DragImageEfl.cpp: Added.
+        * platform/efl/PlatformMouseEventEfl.cpp: Added.
 
-        Reviewed by Timothy Hatcher.
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        The inspector should have scope bars.
-        https://bugs.webkit.org/show_bug.cgi?id=14353
-        
-        Add scope bars to the console, so the user can choose which category
-        of messages they want to see (All, Errors, Warnings, Logs), and they
-        can choose from one or more of {Errors, Warnings, Logs}.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.createFilterElement):
-        (WebInspector.ConsoleView):
-        (WebInspector.ConsoleView.prototype._updateFilter):
-        (WebInspector.ConsoleView.prototype.filter):
-        (WebInspector.ConsoleView.prototype.attach):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-2009-09-11  Yusuke Sato  <yusukes@chromium.org>
+        * platform/efl/CursorEfl.cpp: Added.
+        * platform/efl/LocalizedStringsEfl.cpp: Added.
+        * platform/efl/SearchPopupMenuEfl.cpp: Added.
 
-        Reviewed by Darin Fisher.
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        [Chromium] Complex text doesn't show up with text stroking
-        https://bugs.webkit.org/show_bug.cgi?id=28707
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Added extra NULL checks for HDC. This is the second fix for issue 28707,
-        and the fix is similar to http://trac.webkit.org/changeset/45482.
+        Add EFL port files to page/efl.
+        http://webkit.org/b/35087
 
-        * platform/graphics/chromium/FontChromiumWin.cpp:
-        (WebCore::Font::drawComplexText):
-        * platform/graphics/chromium/UniscribeHelper.cpp:
-        (WebCore::UniscribeHelper::draw):
+        * WebCore/page/efl/DragControllerEfl.cpp: Added.
+        * WebCore/page/efl/FrameEfl.cpp: Added.
+        * WebCore/page/efl/AccessibilityObjectEfl.cpp: Added.
+        * WebCore/page/efl/EventHandlerEfl.cpp: Added.
 
-2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Make ElementTimeControl methods return void and not throw.
-        https://bugs.webkit.org/show_bug.cgi?id=28831
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-        SVG 1.1 erratum:
-        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#elementtimecontrol-interface
+        * WebCore/platform/efl/LoggingEfl.cpp: Added.
+        * WebCore/platform/efl/ScrollbarThemeEfl.cpp: Added.
+        * WebCore/platform/efl/TemporaryLinkStubs.cpp: Added.
+        * WebCore/platform/efl/ScrollViewEfl.cpp: Added.
+        * WebCore/platform/efl/SharedBufferEfl.cpp: Added.
+        * WebCore/platform/efl/DragDataEfl.cpp: Added.
 
-        Test: svg/dom/smil-methods.svg
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        * svg/ElementTimeControl.h: Change return type from bool to void and remove exception argument.
-        * svg/ElementTimeControl.idl: Change return type from bool to void and remove raises claus.
-        * svg/SVGAnimationElement.cpp:
-        (WebCore::SVGAnimationElement::beginElement): Change return type from bool to void and remove exception argument.
-        (WebCore::SVGAnimationElement::beginElementAt): Ditto.
-        (WebCore::SVGAnimationElement::endElement): Ditto.
-        (WebCore::SVGAnimationElement::endElementAt): Ditto.
-        * svg/SVGAnimationElement.h: Ditto.
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-09-11  Chris Marrin  <cmarrin@apple.com>
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-        Reviewed by Oliver Hunt.
+        * WebCore/platform/efl/RenderThemeEfl.cpp: Added.
 
-        Added support for texImage2D which takes CanvasArray
-        https://bugs.webkit.org/show_bug.cgi?id=29191
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext3D::texImage2D):
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::texImage2D):
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-09-11  Steve Falkenburg  <sfalken@apple.com>
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-        Reviewed by Darin Adler.
+        * WebCore/platform/efl/PlatformWheelEventEfl.cpp: Added.
+        * WebCore/platform/efl/FileChooserEfl.cpp: Added.
+        * WebCore/platform/efl/ContextMenuEfl.cpp: Added.
+        * WebCore/platform/efl/PlatformScreenEfl.cpp: Added.
+        * WebCore/platform/efl/WidgetEfl.cpp: Added.
 
-        Allow WebKit clients to opt out of high resolution timers on Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=29192
+2010-02-26  Adam Barth  <abarth@webkit.org>
 
-        * page/Settings.cpp:
-        (WebCore::Settings::setShouldUseHighResolutionTimers): Added.
-        * page/Settings.h: Added getter/setter for shouldUseHighResolutionTimers.
-        (WebCore::Settings::shouldUseHighResolutionTimers): Added.
-        * platform/win/SharedTimerWin.cpp:
-        (WebCore::setSharedTimerFireTime): Don't run high resolution timer code if it is disabled.
+        Reviewed by Darin Fisher.
 
-2009-09-11  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+        Expose an API for ports to add schemes to the mixed content whitelist
+        https://bugs.webkit.org/show_bug.cgi?id=35438
 
-        Reviewed by Adam Barth.
+        Add a notion of a "secure" scheme that doesn't trigger mixed content
+        warnings.  Let folks register new secure schemes in the same way they
+        can register "local" schemes.
 
-        [v8] Share persistent context handles between events        
-        Change events to use a single ref-counted shared persistent handle
-        to the context in which to run, rather than create a new
-        persistent handle for each new event which puts pressure on the
-        gc.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=29077
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isMixedContent):
+        * page/SecurityOrigin.cpp:
+        (WebCore::secureSchemes):
+        (WebCore::SecurityOrigin::registerURLSchemeAsSecure):
+        (WebCore::SecurityOrigin::shouldTreatURLSchemeAsSecure):
+        * page/SecurityOrigin.h:
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/SharedPersistent.h: Added.
-        (WebCore::SharedPersistent::set):
-        (WebCore::SharedPersistent::get):
-        (WebCore::SharedPersistent::disposeHandle):
-        (WebCore::SharedPersistent::create):
-        (WebCore::SharedPersistent::SharedPersistent):
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
-        (WebCore::V8AbstractEventListener::handleEvent):
-        * bindings/v8/V8AbstractEventListener.h:
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
-        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
-        * bindings/v8/V8IsolatedWorld.h:
-        (WebCore::V8IsolatedWorld::context):
-        (WebCore::V8IsolatedWorld::shared_context):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
-        (WebCore::V8Proxy::isContextInitialized):
-        (WebCore::V8Proxy::updateDocumentWrapperCache):
-        (WebCore::V8Proxy::clearDocumentWrapperCache):
-        (WebCore::V8Proxy::disposeContextHandles):
-        (WebCore::V8Proxy::clearForClose):
-        (WebCore::V8Proxy::clearForNavigation):
-        (WebCore::V8Proxy::setSecurityToken):
-        (WebCore::V8Proxy::updateDocument):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::shared_context):
-        (WebCore::V8Proxy::mainWorldContext):
-        (WebCore::V8Proxy::setContextDebugId):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::V8Proxy):
-        (WebCore::V8Proxy::context):
-        (WebCore::V8Proxy::shared_context):
+2010-02-26  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-2009-09-11  Anton Muhin  <antonm@chromium.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by David Levin.
+        [Qt] GraphicsLayerQt: artifacts and wrong transformOrigin
+        This was due to wrong way of applying cache-mode and transformation
+        on a graphics-item with HTML. Cache-mode should be updated
+        when the content type updates, even if it was the same cache-mode
+   
+        https://bugs.webkit.org/show_bug.cgi?id=35382
 
-        Create a real handle (one which would save an object from GC).
-        https://bugs.webkit.org/show_bug.cgi?id=29150
+        Test URL attached to the bug now works correctly.
 
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8ExternalString):
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::computeTransform):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
 
-2009-09-11  Anton Muhin  <antonm@chromium.org>
+2010-02-26  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Reviewed by David Levin.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Inline WebCore::v8String as it only invokes WebCore::v8ExternalString.
-        https://bugs.webkit.org/show_bug.cgi?id=29152
+        Qt/Mac: Revert null timer removal (r51105)
+        https://bugs.webkit.org/show_bug.cgi?id=35396
 
-        * bindings/v8/V8Binding.cpp:
-        * bindings/v8/V8Binding.h:
-        (WebCore::v8String):
+        r51105 removed the null timer event of the carbon event model. This however
+        breaks the flash of many sites.        
 
-2009-09-11  Ariya Hidayat  <ariya.hidayat@nokia.com>
+        Applying patch suggested by Girish Ramakrishnan in bug comment #1.
 
-        Reviewed by Simon Hausmann.
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::nullEventTimerFired):
+        (WebCore::PluginView::mousePosForPlugin):
 
-        Changed URLs from qtsoftware.com to qt.nokia.com, as part of a general
-        renaming.
+2010-02-26  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        * ChangeLog-2009-06-16:
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-09-11  Thiago Macieira  <thiago.macieira@nokia.com>
+        [Qt] Compile error with 3d-canvas
+        Replaced a direct gl call with a getProcAddress call
+        https://bugs.webkit.org/show_bug.cgi?id=35448
 
-        Reviewed by Simon Hausmann.
+        No new tests.
 
-        Use LIBS_PRIVATE on Qt/Mac.
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::blendColor):
 
-        On the Mac, it means "-framework ApplicationServices -framework Carbon
-        -framework AppKit" are no longer part of the default LIBS in Qt
-        applications. This required a lot of fixes where we used Mac-specific
-        code in Qt.
+2010-02-26  Kwang Yul Seo  <skyul@company100.net>
 
-        * WebCore.pro:
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+        [BREWMP] Port EventHandler
+        https://bugs.webkit.org/show_bug.cgi?id=34796
 
-        Reviewed by Eric Seidel.
+        Add platform-specific code required to implement EventHandler.
 
-        Remove duplicated WK_{u,l}cfirst subs from CodeGeneratorV8.pm
-        https://bugs.webkit.org/show_bug.cgi?id=29165
+        * page/brew/EventHandlerBrew.cpp: Added.
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::focusDocumentView):
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        (WebCore::EventHandler::eventActivatedView):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::accessKeyModifiers):
 
-        * bindings/scripts/CodeGeneratorV8.pm: Remove WK_ucfirst and
-        WK_lcfirst, and call the ones in CodeGenerator.pm instead.
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Darin Adler.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-        https://bugs.webkit.org/show_bug.cgi?id=29132
-        Symbian winscw compiler fails compiling WebCore/text/RegularExpression.cpp.
+        * WebCore/platform/efl/ClipboardEfl.cpp: Added.
+        * WebCore/platform/efl/PopupMenuEfl.cpp: Added.
+        * WebCore/platform/efl/SharedTimerEfl.cpp: Added.
+        * WebCore/platform/efl/RenderThemeEfl.h: Added.
+        * WebCore/platform/efl/Language.cpp: Added.
+        * WebCore/platform/efl/CookieJarEfl.cpp: Added.
+        * WebCore/platform/efl/MIMETypeRegistryEfl.cpp: Added.
 
-        Add RegularExpression class qualifier before Private.
+2010-02-26  Robert Kroeger  <rjkroege@chromium.org>
 
-        * platform/text/RegularExpression.cpp:
+        Reviewed by Nate Chapin
 
-2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+        To fire each event handler registered on an SVG node once per
+        event, Chromium needs an implementation of wasCreatedFromMarkup
+        added to V8LazyEventListener.h that matches the one in
+        WebKit/WebCore/bindings/js/JSLazyEventListener.h.
+        
+        This patch adds such a matching implementation of wasCreatedFromMarkup
+        to V8LazyEventListener.h.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=35325
 
-        Reviewed by Darin Adler.
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::wasCreatedFromMarkup):
 
-        https://bugs.webkit.org/show_bug.cgi?id=29131
-        Use a different variadic macro format for Symbian compiler.
-        
-        Use arg... instead of ellipsis in variadic macro.        
+2010-02-26  Arno Renevier  <arno@renevier.net>
 
-        * platform/StaticConstructors.h:
+        Reviewed by Gustavo Noronha Silva.
 
-2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+        [Gtk] use geoclue_position_get_position_async to get geolocation position.
+        https://bugs.webkit.org/show_bug.cgi?id=35355
 
-        Reviewed by Simon Hausmann.
+        No new tests, behaviour depends on system.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28806
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::startUpdating):
+        (WebCore::GeolocationServiceGtk::get_position):
+        * platform/gtk/GeolocationServiceGtk.h:
 
-        [Qt] Make the WebInspector available as a QWidget.
+2010-02-26  Yaar Schnitman  <yaar@chromium.org>
 
-        * WebCore.pro:
+        Chromium Win build fix.
 
-2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+        * WebCore.gyp/WebCore.gyp: Added missing file to action input.
 
-        Unreviewed fix for the Web Inspector with the Qt build.
+2010-02-12  Brett Wilson  <brettw@chromium.org>
 
-        Re-generate the Qt resource file by running
-        WebKitTools/Scripts/generate-qt-inspector-resource
+        Reviewed by Adam Barth.
 
-        * inspector/front-end/WebKit.qrc:
+        Update the Google-URL version of KURL and the V8 bindings to the new
+        behavior of KURL.IsStandard.
 
-2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34859
 
-        Fix the Qt build, remove stray semicolon from function definition.
+        This is covered by fast/dom/Window/invalid-protocol.html
 
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::buffered):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::protocolAccessorSetter):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::setProtocol):
+        (WebCore::KURL::isHierarchical):
 
-2009-09-10  Adam Barth  <abarth@webkit.org>
+2010-02-26  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by NOBODY (Build fix following r55312).
 
-        Detect mixed content
-        https://bugs.webkit.org/show_bug.cgi?id=29003
-
-        Detect some basic kinds of mixed content (HTTP content loaded into an
-        HTTPS context).  This new detection logic isn't perfect, but it's a
-        place to start.
-
-        Tests: http/tests/security/mixedContent/about-blank-iframe-in-main-frame.html
-               http/tests/security/mixedContent/data-url-iframe-in-main-frame.html
-               http/tests/security/mixedContent/data-url-script-in-iframe.html
-               http/tests/security/mixedContent/insecure-css-in-iframe.html
-               http/tests/security/mixedContent/insecure-css-in-main-frame.html
-               http/tests/security/mixedContent/insecure-iframe-in-iframe.html
-               http/tests/security/mixedContent/insecure-iframe-in-main-frame.html
-               http/tests/security/mixedContent/insecure-image-in-iframe.html
-               http/tests/security/mixedContent/insecure-image-in-main-frame.html
-               http/tests/security/mixedContent/insecure-script-in-iframe.html
-               http/tests/security/mixedContent/redirect-http-to-https-iframe-in-main-frame.html
-               http/tests/security/mixedContent/redirect-http-to-https-script-in-iframe.html
-               http/tests/security/mixedContent/redirect-https-to-http-iframe-in-main-frame.html
-               http/tests/security/mixedContent/redirect-https-to-http-script-in-iframe.html
-
-        * loader/DocLoader.cpp:
-        (WebCore::DocLoader::canRequest):
-        (WebCore::DocLoader::requestResource):
-        (WebCore::DocLoader::checkCacheObjectStatus):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::isMixedContent):
-        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
-        (WebCore::FrameLoader::checkIfRunInsecureContent):
-        * loader/FrameLoader.h:
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::willSendRequest):
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapInstance::invokeMethod):
 
-2009-09-10  Mark Rowe  <mrowe@apple.com>
+2010-02-26  Yaar Schnitman  <yaar@chromium.org>
 
-        Fix the Windows build.
+        Reviewed by Dimitri Glazkov.
 
-        Restore platform/mock to the header search path after it was removed in r48270.
+        [V8] Auto-generate and split DerivedSourcesAllInOne.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=33048
 
-        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/scripts/action_derivedsourcesallinone.py: Added.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Removed.
 
-2009-09-08  Timothy Hatcher  <timothy@apple.com>
+2010-02-26  Gavin Barraclough  <barraclough@apple.com>
 
-        Web Inspector: Move the option to create a new style rule under the Styles' gear menu.
+        Reviewed by NOBODY (Build fix following r55312).
 
-        https://bugs.webkit.org/show_bug.cgi?id=29039
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapInstance::invokeMethod):
 
-        Reviewed by Sam Weinig.
+2010-02-26  Alexey Proskuryakov  <ap@apple.com>
 
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane): Add "New Style Rule" option to the gear menu.
-        (WebInspector.StylesSidebarPane.prototype._update): Check instanceof BlankStylePropertiesSection instead.
-        (WebInspector.StylesSidebarPane.prototype._changeSetting): Added. Keeps the color format setting selected
-        while calling the correct action.
-        (WebInspector.StylesSidebarPane.prototype._createNewRule): Creates a new section and edits the selector.
-        (WebInspector.StylesSidebarPane.prototype.addBlankSection): Insert the section in a cleaner way.
-        (WebInspector.StylesSidebarPane.prototype.removeSection): Added. Removes the passed in section.
-        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): Return an empty string if there is no node.
-        (WebInspector.StylePropertiesSection.prototype.expand): Removed the check for _blank.
-        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): No need for the context, the original selector
-        is remembered by the editing code.
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled): Do nothing. The original text is already
-        restored by the editing code.
-        (WebInspector.BlankStylePropertiesSection): Call the StylePropertiesSection constructor with appropriate data.
-        Remove event listener code.
-        (WebInspector.BlankStylePropertiesSection.prototype.expand): Added. Does nothing to prevent expanding.
-        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.callback): Correctly construct the
-        WebInspector.CSSStyleDeclaration. Call editingSelectorCancelled instead of editingCancelled.
-        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted): Renamed from editingCommitted to
-        override the base class.
-        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCancelled): Remove the section.
-        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): Removed event listener code. Removed the delete lines
-        since they were doing nothing (deleting nonexistent properties that exist only on the prototype.) Change prototypes at
-        the end to correctly swtich to a real StylePropertiesSection.
-        * inspector/front-end/inspector.js:
-        (WebInspector.startEditing.editingCancelled): Ceck for null/undefined callbacks.
-        (WebInspector.startEditing.editingCommitted): Ditto.
+        Reviewed by Anders Carlsson.
 
-2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35450
+        Crash when a Java array property accessor raises an exception
 
-        Reviewed by Eric Seidel.
+        Test: java/inaccessible-class.html
 
-        [Qt] Fix comparison between signed and unsigned integer warnings
-        https://bugs.webkit.org/show_bug.cgi?id=29162
+        * bridge/jni/jsc/JNIBridgeJSC.cpp: (JavaField::valueFromInstance): Check if the result
+        is null before interpreting it as an object or array.
 
-        No functional change.
+2010-02-26  Dirk Schulze  <krit@webkit.org>
 
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::findMethodIndex):
-        * platform/MIMETypeRegistry.cpp:
-        (WebCore::initializeSupportedImageMIMETypes):
-        (WebCore::initializeSupportedImageMIMETypesForEncoding):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawFocusRing):
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::duration):
-        (WebCore::ImageDecoderQt::imageAtIndex):
-        * plugins/qt/PluginPackageQt.cpp:
-        (WebCore::PluginPackage::fetchInfo):
+        Reviewed by Nikolas Zimmermann.
 
-2009-09-10  Martin Robinson  <martin.james.robinson@gmail.com>
+        Extend AffineTransform to mapQuad
+        https://bugs.webkit.org/show_bug.cgi?id=35444
 
-        Reviewed by Gustavo Noronha.
+        This makes mapQuad available for AffineTransform. So that platforms
+        can make use of it after the switch from TransformationMatrix to
+        AffineTransform in GraphicsContext.
 
-        Build fix for GTKafter r48267.
+        * platform/graphics/transforms/AffineTransform.cpp:
+        (WebCore::AffineTransform::mapRect): mapRect already did the calculation for mapQuad but gave back the
+                                             boundingBox of the resulting FloatQuad.
+        (WebCore::AffineTransform::mapQuad):
+        * platform/graphics/transforms/AffineTransform.h:
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::buffered):
+2010-02-26  Brady Eidson  <beidson@apple.com>
 
-2009-09-08  John Abd-El-Malek  <jam@chromium.org>
+        Reviewed by Pavel Feldman.
 
-        Reviewed by Dimitri Glazkov.
+        Arrow keys do not scroll source view in Resources pane or Scripts pane.
+        <rdar://problem/7594367> and https://bugs.webkit.org/show_bug.cgi?id=34356
 
-        Remove unneeded define for ActiveX.
-        https://bugs.webkit.org/show_bug.cgi?id=29054
+        Handle vertical scrolling in the Text Viewer:
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer): Listen for the keydown event.
+        (WebInspector.TextViewer.prototype._handleKeyDown): If the event has no modifiers and refers
+          to an arrow key, scroll. The horizontal values were ripped from the default "pixels per scroll line"
+          value in ScrollBar.h.
 
-        * rendering/RenderPartObject.cpp:
-        (WebCore::createClassIdToTypeMap):
-        (WebCore::serviceTypeForClassId):
-        (WebCore::RenderPartObject::updateWidget):
+2010-02-26  Gavin Barraclough  <barraclough@apple.com>
 
-2009-09-10  Mark Rowe  <mrowe@apple.com>
+        Reviewed by Alexey Proskuryakov.
 
-        Rubber-stamped by Sam Weinig.
+        Bug 35401 - Fix handling of errors in handling calls over bridge,
+        where base object bridge-type does not match method bridge-type.
 
-        Don't copy IDL files in to the built framework.
+        The code assumes users will only attempt to invoke a Java method
+        on a Java base object, etc.
+        Add language specific subclasses of RuntimeMethod, and pass the
+        RuntimeMethod into invokeMethod, so we can typecheck before
+        casting.  Throw an exception on type mismatch.
 
+        * WebCore.base.exp:
         * WebCore.xcodeproj/project.pbxproj:
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CRuntimeMethod::CRuntimeMethod):new class to distinguish this type of RuntimeMethod.
+        (JSC::Bindings::CInstance::getMethod): create an appropriate sublclass of RuntimeMethod.
+        (JSC::Bindings::CInstance::invokeMethod): dynamically check the type of the RuntimeMethod.
+        * bridge/c/c_instance.h:
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaRuntimeMethod::JavaRuntimeMethod): new class to distinguish this type of RuntimeMethod.
+        (JavaInstance::getMethod): create an appropriate sublclass of RuntimeMethod.
+        (JavaInstance::invokeMethod): dynamically check the type of the RuntimeMethod.
+        * bridge/jni/jsc/JavaInstanceJSC.h:
+        * bridge/jsc/BridgeJSC.h:
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcRuntimeMethod::ObjcRuntimeMethod): new class to distinguish this type of RuntimeMethod.
+        (ObjcInstance::getMethod): create an appropriate sublclass of RuntimeMethod.
+        (ObjcInstance::invokeMethod): dynamically check the type of the RuntimeMethod.
+        (ObjcInstance::invokeObjcMethod): new method, takes an ObjcMethod* as an argument so that we don't need to dynamically determine the type.
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject): use new invokeObjcMethod method.
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod): pass RuntimeMethod as argument to invokeMethod, rather than its MethodList.
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObject::methodGetter): use new getMethod method.
 
-2009-09-10  Xiaomei Ji  <xji@chromium.org>
+2010-02-26  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Geoff Garen.
 
-        Implment Range.expand().
-        https://bugs.webkit.org/show_bug.cgi?id=27632
+        Make the lookup table generator include an explicit cast to expected
+        type of the function.  We do this because otherwise the blind intptr_t
+        cast that is subsequently applied allows incorrectly typed functions
+        to be inserted into the table, where they will only fail at runtime.
+        This change makes such errors produce a compile time failure.
 
-        Test: fast/dom/Range/range-expand.html
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/scripts/CodeGeneratorJS.pm:
 
-        * dom/Range.cpp:
-        (WebCore::Range::expand):
-        * dom/Range.h:
-        * dom/Range.idl:
+2010-02-26  Alex Milowski  <alex@milowski.com>
 
-2009-09-10  Fumitoshi Ukai  <ukai@chromium.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Alexey Proskuryakov.
+        Added basic support for the munder, munderover, and mover elements.
 
-        WebSocket API implementation.
-        https://bugs.webkit.org/show_bug.cgi?id=28038
-        
-        Add build systems for GNUmakefile.am, WebCore.xcodeproj and
-        WebCore.vcproj.
-        Add websockets directory and WebSocket.idl in qt build system.
-        Tests will be landed once the code is completed and functional.
+        Tests: mathml/presentation/over.xhtml
+               mathml/presentation/under.xhtml
+               mathml/presentation/underover.xhtml
 
-        * DerivedSources.cpp:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
         * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::webSocket):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toWebSocket):
-        * dom/EventTarget.h:
-        * page/DOMWindow.idl:
-        * websockets/WebSocket.cpp:
-        (WebCore::ProcessWebSocketEventTask::create):
-        (WebCore::ProcessWebSocketEventTask::performTask):
-        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
-        (WebCore::isValidProtocolString):
-        (WebCore::WebSocket::connect):
-        (WebCore::WebSocket::send):
-        (WebCore::WebSocket::close):
-        (WebCore::WebSocket::bufferedAmount):
-        (WebCore::WebSocket::addEventListener):
-        (WebCore::WebSocket::removeEventListener):
-        (WebCore::WebSocket::dispatchEvent):
-        (WebCore::WebSocket::didConnect):
-        (WebCore::WebSocket::didReceiveMessage):
-        (WebCore::WebSocket::didClose):
-        (WebCore::WebSocket::dispatchOpenEvent):
-        (WebCore::WebSocket::dispatchMessageEvent):
-        (WebCore::WebSocket::dispatchCloseEvent):
-        * websockets/WebSocket.h:
-        (WebCore::WebSocket::create):
-        (WebCore::WebSocket::):
-        (WebCore::WebSocket::setOnopen):
-        (WebCore::WebSocket::onopen):
-        (WebCore::WebSocket::setOnmessage):
-        (WebCore::WebSocket::onmessage):
-        (WebCore::WebSocket::setOnclose):
-        (WebCore::WebSocket::onclose):
-        (WebCore::WebSocket::toWebSocket):
-        (WebCore::WebSocket::eventListeners):
-        (WebCore::WebSocket::refEventTarget):
-        (WebCore::WebSocket::derefEventTarget):
-        * websockets/WebSocketChannel.cpp: Added.
-        * websockets/WebSocketChannel.h: Added.
-        * websockets/WebSocketChannelClient.h: Added.
-        * websockets/WebSocketHandshake.cpp: Added.
-        * websockets/WebSocketHandshake.h: Added.
-
-2009-09-10  Albert J. Wong  <ajwong@chromium.org>
-
-        No review, windows build fix only.
-        
-        Spurious semicolon causing parse error in chromium build on windows.
-
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::buffered):
-
-2009-09-10  Albert J. Wong  <ajwong@chromium.org>
+        * mathml/MathMLInlineContainerElement.cpp:
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/RenderMathMLUnderOver.cpp: Added.
+        (WebCore::RenderMathMLUnderOver::RenderMathMLUnderOver):
+        (WebCore::RenderMathMLUnderOver::addChild):
+        (WebCore::getOffsetHeight):
+        (WebCore::RenderMathMLUnderOver::stretchToHeight):
+        (WebCore::RenderMathMLUnderOver::layout):
+        (WebCore::RenderMathMLUnderOver::baselinePosition):
+        (WebCore::RenderMathMLUnderOver::nonOperatorHeight):
+        * mathml/RenderMathMLUnderOver.h: Added.
+        (WebCore::RenderMathMLUnderOver::hasBase):
+        (WebCore::RenderMathMLUnderOver::):
+
+2010-02-24  Stephen White  <senorblanco@chromium.org>
 
-        No review, build fix only.
+        Reviewed by Darin Adler.
 
-        Adding in a missed include from the last patch that is breaking the
-        chromium build.
+        This CL implements a simple ad-hoc parser for CSS rgb() values.
+        If it fails, it returns false and the normal lex/yacc parser will
+        be invoked.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=35362
 
-        * rendering/RenderThemeChromiumMac.mm: include TimeRanges.h
+        Covered by fast/canvas/canvas-bg.html, fast/canvas/canvas-bg-zoom.html,
+        and many more.
 
-2009-09-10  Alpha Lam  <hclam@chromium.org>
+        * css/CSSParser.cpp:
+        (WebCore::parseInt):
+        (WebCore::CSSParser::parseColor):
 
-        Reviewed by Eric Carlson.
+2010-02-26  Jarkko Sakkinen  <jarkko.sakkinen@tieto.com>
 
-        HTMLMediaElement buffered attribute should report a list of time ranges
-        https://bugs.webkit.org/show_bug.cgi?id=29041
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Changed MediaPlayerPrivateInterface and MediaPlayer's definition to
-        report a list of buffered time ranges as WebCore::TimeRanges. This
-        change also got rid of the maxTimeBuffered() method.
+        https://bugs.webkit.org/show_bug.cgi?id=35419
+        3D canvas did not update when WTF_USE_ACCELERATED_COMPOSITING
+        was enabled but not from run-time settings. Added run-time 
+        check that compositing is enabled.
 
-        No new tests since this is a API change.
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::markContextChanged):
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::percentLoaded):
-        Use MediaPlaier::buffered() instead of maxTimeBuffered().
-        (WebCore::HTMLMediaElement::buffered):
-        ditto.
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::buffered):
-        Use MediaPlayerPrivateInterface::buffered() instead of maxTimeBuffered().
-        (WebCore::MediaPlayer::buffered):
-        ditto.
-        * platform/graphics/MediaPlayer.h:
-        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/MediaPlayerPrivate.h:
-        ditto.
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        Implements PassRefPtr<TimeRanges> buffered();
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::buffered):
-        Implementation of buffered().
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        Implements PassRefPtr<TimeRanegs> buffered().
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
-        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        Implements PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
-        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/wince/MediaPlayerPrivateWince.h:
-        ditto.
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-        Use buffered() instead of maxTimeBuffered().
-        * rendering/RenderThemeChromiumSkia.cpp:
-        ditto.
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMediaSliderTrack):
-        ditto.
+2010-02-26  Jarkko Sakkinen  <jarkko.sakkinen@tieto.com>
 
-2009-09-10  Cameron McCormack  <cam@mcc.id.au>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Eric Seidel.
+        Compilation failed because functions glSampleCoverage, glBlendEquation
+        and glActiveTexture were not available.
+        https://bugs.webkit.org/show_bug.cgi?id=35423
 
-        Make bindings generators more aware of IDL dependencies
-        https://bugs.webkit.org/show_bug.cgi?id=29114
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3D::activeTexture):
+        (WebCore::GraphicsContext3D::blendEquation):
+        (WebCore::GraphicsContext3D::sampleCoverage):
 
-        Make the JS and ObjC bindings generators able to output dependency
-        rules for DerivedSources.make to consume.  These rules make a given
-        generated binding class file header, JSWhatever.h, depend on Whatever's
-        ancestor interfaces.
+2010-02-26  Jarkko Sakkinen  <jarkko.sakkinen@tieto.com>
+ 
+         Reviewed by Kenneth Rohde Christiansen.
 
-        * DerivedSources.make: Pass --write-dependencies to generate-bindings.pl
-        when generating JS and ObjC bindings.  Include dependency fies that are
-        generated due to that.
-        * bindings/scripts/CodeGenerator.pm: Make
-        AddMethodsConstantsAndAttributesFromParentClasses accumulate a list of
-        the ancestor interfaces that were visited.
-        * bindings/scripts/CodeGeneratorJS.pm: Optionally write out a dependency
-        file.
-        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
-        * bindings/scripts/generate-bindings.pl: Add a --write-dependencies
-        option.
+         https://bugs.webkit.org/show_bug.cgi?id=35380
+         Fixed compilation error when WTF_USE_ACCELERATED_COMPOSITING=0
+ 
+         * css/MediaQueryEvaluator.cpp:
+         (WebCore::transform_3dMediaFeatureEval):
 
-2009-09-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+2010-02-26  Nicholas Young  <nicholas.young@nokia.com>
 
-        Reviewed by Xan Lopez and Dan Winship.
+        Reviewed by Tor Arne Vestbø.
 
-        Give all requests to libsoup, to let it queue, and schedule them
-        itself, instead of throttling the number of requests in WebCore.
+        [Qt] Incorrect painting after a size changed.
+        https://bugs.webkit.org/show_bug.cgi?id=35412
 
-        * platform/network/ResourceRequestBase.cpp:
-        * platform/network/soup/ResourceRequestSoup.cpp:
-        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+        No new tests. Bug fix in backend.
 
-2009-09-10  Jian Li  <jianli@chromium.org>
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivate::paint): Provide the source rectangle, rather than inferring it.
 
-        Reviewed by Eric Seidel.
+2010-02-26  Nicholas Young  <nicholas.young@nokia.com>
 
-        [V8] Make XMLHttpRequest.send handle File object.
-        https://bugs.webkit.org/show_bug.cgi?id=28924
+        Reviewed by Tor Arne Vestbø.
 
-        Test: http/tests/local/send-dragged-file.html
+        [Qt] Incorrect handling of MIME types in Media Player
+        https://bugs.webkit.org/show_bug.cgi?id=35413
 
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        No new tests. Bug fix in backend.
 
-2009-09-10  Zoltan Horvath  <zoltan@webkit.org>
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType): Corrected logic.
 
-        Reviewed by Darin Adler.
+2010-02-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
 
-        Use fastNew and fastDelete instead of operator new and delete for CSSSelector class. 
-        https://bugs.webkit.org/show_bug.cgi?id=25930
+        Reviewed by Xan Lopez.
 
-        Change using of operator new to fastNew and operator delete to
-        fastDeleteSkippingDestructor for CSSSelector class to avoid mismatched function call.
+        https://bugs.webkit.org/show_bug.cgi?id=35418
+        [Gtk] Every table, including layout tables, should be exposed as a table
 
-        This change fixes valgrind's 'mismatched free' notification.
+        This patch exposes layout tables as tables. (Addressing the problematic table
+        hierarchy remains to be done.)
 
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::~CSSParser):
-        (WebCore::CSSParser::createFloatingSelector):
-        * css/CSSSelectorList.cpp:
-        (WebCore::CSSSelectorList::adoptSelectorVector):
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::determineAccessibilityRole):
 
-2009-09-10  Steve Block  <steveblock@google.com>
+2010-02-26  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Darin Adler.
 
-        Geolocation does not correctly handle reentrant calls from callbacks.
-        https://bugs.webkit.org/show_bug.cgi?id=29040
-
-        Tests: fast/dom/Geolocation/reentrant-error.html
-               fast/dom/Geolocation/reentrant-success.html
-
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::handleError): Modified. Call sendError directly, clearing notifier lists before making callback.
-        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Call sendPosition directly, clearing notifier lists before making callback.
-        * page/Geolocation.h: Modified. Deleted sendErrorToXX and sendPositionToXXX methods.
-
-2009-09-10  Erik Arvidsson  <arv@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fixes issue where focused elements did not get blur and focus events when the window was blurred and focused.
-        https://bugs.webkit.org/show_bug.cgi?id=27105
-
-        Test: fast/events/blur-focus-window-should-blur-focus-element.html
-
-        * page/FocusController.cpp:
-        (WebCore::dispatchEventsOnWindowAndFocusedNode):
-        (WebCore::FocusController::setFocused):
-        (WebCore::FocusController::setActive):
-
-2009-09-10  Adam Roben  <aroben@apple.com>
+        XSSAuditor is super super super slow
+        https://bugs.webkit.org/show_bug.cgi?id=35373
 
-        Make the play/pause button in <video> controls indicate the button's
-        action, not the movie state
+        In this patch, we separate the decoding cache for the page's URL and
+        form data.  Previously, we used the same cache for both, which caused
+        us miss the cache every time when the page had form data (because the
+        cache only stored one entry).  When the form data is large, we were
+        wasting a lot of time canonicalizing.
 
-        This matches the Mac behavior, iTunes, and many other media players.
-
-        No test possible.
-
-        Fixes <http://webkit.org/b/29126> Play/pause button in <video>
-        controls shows the wrong image
-
-        Reviewed by Eric Carlson.
-
-        * rendering/RenderMediaControls.cpp:
-        (WebCore::RenderMediaControls::paintMediaControlsPart): Reversed when
-        we show the play vs. pause artwork, so that the button reflects what
-        will happen when you click it, rather than the current state of the
-        movie.
-
-2009-09-09  Steve Block  <steveblock@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Geolocation Coordinates::toString() prints bogus values for unspecified properties.
-        https://bugs.webkit.org/show_bug.cgi?id=29080
-
-        Test: fast/dom/Geolocation/position-string.html
-
-        * GNUmakefile.am: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * WebCore.gypi: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * WebCore.pro: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * WebCore.vcproj/WebCore.vcproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * WebCore.xcodeproj/project.pbxproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * WebCoreSources.bkl: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * page/Coordinates.cpp: Removed.
-        * page/Coordinates.h: Modified. Removes toString method.
-        * page/Coordinates.idl: Modified. Removes toString method.
-        * page/Geoposition.cpp: Removed.
-        * page/Geoposition.h: Modified. Removes toString method.
-        * page/Geoposition.idl: Modified. Removes toString method.
-
-2009-09-09  Steve Block  <steveblock@google.com>
-
-        Reviewed by Adam Barth.
-
-        Correctly applies the Geolocation timeout property.
-        https://bugs.webkit.org/show_bug.cgi?id=27256
-
-        If a timeout is specified, the timer is started as soon as the location acquistion process starts.
-        If a position fix is not obtained within the timeout interval, the position request is cancelled
-        and the error callback (if specified) is invoked. If a position fix is obtained within the timeout
-        interval, the timer is stopped. Permissions are then requested from the user if required. See
-        http://www.w3.org/TR/geolocation-API/#position-options.
-
-        Note that this logic means that the time required to obtain permissions from the user is not
-        included in the timeout interval.
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
 
-        Tests: fast/dom/Geolocation/timeout.html
-               fast/dom/Geolocation/timeout-zero.html
+2010-02-26  Dirk Schulze  <krit@webkit.org>
 
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Takes Geolocation object as parameter.
-        (WebCore::Geolocation::GeoNotifier::hasZeroTimeout): Added. Determines whether this request has a zero timeout.
-        (WebCore::Geolocation::GeoNotifier::startTimerIfNeeded): Renamed from startTimer. Starts the timer if a timeout was specified.
-        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Calls the error callback if specified, and reports the timeout to the Geolocation object.
-        (WebCore::Geolocation::getCurrentPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
-        (WebCore::Geolocation::watchPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
-        (WebCore::Geolocation::requestTimedOut): Added. Cancels a request when it times out.
-        (WebCore::Geolocation::setIsAllowed): Modified. No longer starts timers.
-        (WebCore::Geolocation::sendPosition): Modified. No longer stops timers.
-        (WebCore::Geolocation::stopTimer): Added. Stops the timers for a vector of notifiers.
-        (WebCore::Geolocation::stopTimersForOneShots): Added. Stops the timers for all one-shots.
-        (WebCore::Geolocation::stopTimersForWatchers): Added. Stops the timers for all watchers.
-        (WebCore::Geolocation::stopTimers): Added. Stops the timers for all requests.
-        (WebCore::Geolocation::geolocationServicePositionChanged): Modfified. Stops the timers for all requests.
-        * page/Geolocation.h: Modified.
-        (WebCore::Geolocation::GeoNotifier::create): Modified. Takes Geolocation object as parameter.
+        Reviewed by Nikolas Zimmermann.
 
-2009-09-09  Chris Fleizach  <cfleizach@apple.com>
+        SVGResourceClipper needs to be moved to RenderSVGResourceClipper
+        https://bugs.webkit.org/show_bug.cgi?id=35421
 
-        AX notifications should be an ENUM type instead of strings
-        https://bugs.webkit.org/show_bug.cgi?id=28963
+        Move SVGResourceClipper to RenderSVGResourceClipper. This follows the changes
+        of Masker and helps to clean up the SVG code. Code snippets from SVGClipPathElement
+        and SVGResourceClipper got combined in RenderSVGResourceClipper. DRT results are
+        more readable for clipPath's now. It's possible to see the unit type of clipper, as
+        well as it's childs instead of just one path.
 
-        Build fix for Qt.
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderSVGResource.h:
+        (WebCore::):
+        * rendering/RenderSVGResourceClipper.cpp: Added.
+        (WebCore::RenderSVGResourceClipper::RenderSVGResourceClipper):
+        (WebCore::RenderSVGResourceClipper::~RenderSVGResourceClipper):
+        (WebCore::RenderSVGResourceClipper::invalidateClients):
+        (WebCore::RenderSVGResourceClipper::invalidateClient):
+        (WebCore::RenderSVGResourceClipper::applyResource):
+        (WebCore::RenderSVGResourceClipper::resourceBoundingBox):
+        * rendering/RenderSVGResourceClipper.h: Added.
+        (WebCore::RenderSVGResourceClipper::renderName):
+        (WebCore::RenderSVGResourceClipper::resourceType):
+        (WebCore::RenderSVGResourceClipper::clipPathUnits):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::clipperBoundingBoxForRenderer):
+        (WebCore::SVGRenderBase::deregisterFromResources):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::writeStyle):
+        (WebCore::writeSVGResource):
+        (WebCore::writeResources):
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::svgAttributeChanged):
+        (WebCore::SVGClipPathElement::childrenChanged):
+        (WebCore::SVGClipPathElement::createRenderer):
+        * svg/SVGClipPathElement.h:
+        (WebCore::SVGClipPathElement::isValid):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::invalidateResources):
+        * svg/graphics/SVGResource.h:
+        (WebCore::):
+        (WebCore::SVGResource::isPaintServer):
+        (WebCore::SVGResource::isFilter):
+        (WebCore::SVGResource::isMarker):
+        * svg/graphics/SVGResourceClipper.cpp: Removed.
+        * svg/graphics/SVGResourceClipper.h: Removed.
 
-        * accessibility/AXObjectCache.h:
-        (WebCore::AXObjectCache::postNotification):
-        (WebCore::AXObjectCache::postPlatformNotification):
+2010-02-26  Ben Murdoch  <benm@google.com>
 
-2009-09-08  Chris Fleizach  <cfleizach@apple.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Darin Adler.
+        The element that a touchevent is dispatched to isn't always right
+        https://bugs.webkit.org/show_bug.cgi?id=35431
 
-        AX notifications should be an ENUM type instead of strings
-        https://bugs.webkit.org/show_bug.cgi?id=28963
+        The element that touch events are dispatched on is not always the
+        correct one, as the cached m_touchEventTarget member is only updated
+        when the first element of the PlatformTouchEvent touch list is in the
+        TouchPressed state.
 
-        Moves AX notifications over to an ENUM type instead of
-        using the actual string values that are used on OS X.
+        This patch changes this behavior to dispatch the event to the target
+        of the touch that caused the event to be generated and eliminates the
+        m_touchEventTarget in favour of using the touch target hashmap. It also
+        simplifies the way in which the touchTargets list is generated as we
+        no longer have m_touchEventTarget (which was used previously to build
+        the list). The new behavior matches the observed behavior of the
+        iPhone and Android.
 
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::postNotification):
-        (WebCore::AXObjectCache::selectedChildrenChanged):
-        * accessibility/AXObjectCache.h:
-        (WebCore::AXObjectCache::):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
-        * accessibility/chromium/AXObjectCacheChromium.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * accessibility/gtk/AXObjectCacheAtk.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * accessibility/mac/AXObjectCacheMac.mm:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * accessibility/win/AXObjectCacheWin.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-        * dom/Element.cpp:
-        (WebCore::Element::updateAfterAttributeChanged):
-        * editing/Editor.cpp:
-        (WebCore::Editor::respondToChangedContents):
-        * editing/mac/SelectionControllerMac.mm:
-        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setChecked):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::setInnerTextValue):
+        * page/EventHandler.cpp:
+        (WebCore::assembleTargetTouches): Added. new function to build the
+            targetTouches list. Filters a list of touches (passed) about
+            another given touch.
+        (WebCore::EventHandler::handleTouchEvent): Remove the
+            m_touchEventTarget member, and simplify the generation of the
+            TouchLists that are bundled with the TouchEVent object. Dispatch
+            the event to the target of the touch that caused the event to be
+            fired.
+        * page/EventHandler.h: Remove m_touchEventTarget.
+
+2010-02-26  Dirk Pranke  <dpranke@chromium.org>
 
-2009-09-08  Adam Barth  <abarth@webkit.org>
+        Reviewed by Darin Fisher.
 
-        Reviewed by Eric Seidel.
+        Fix the handling of updates to #hash fragments to check for differences
+        post-canonicalization rather than comparing pre- to post-. Chromium
+        had a bug where we would set the #hash on an about:blank URL and generate
+        an onload event because we thought the URL (not just the fragment) was
+        changing.
 
-        Missing checkout for getSVGDocument()
-        https://bugs.webkit.org/show_bug.cgi?id=29064
+        http://bugs.webkit.org/show_bug.cgi?id=35180
 
-        The V8 code generator didn't understand SVGCheckSecurityDocument.
+        Test: fast/loader/about-blank-hash-change.html
 
-        Tests: http/tests/security/xss-DENIED-getSVGDocument-iframe.html
-               http/tests/security/xss-DENIED-getSVGDocument-object.html
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::hashAccessorSetter):
 
-        * bindings/scripts/CodeGeneratorV8.pm:
+2010-02-26  Zhenyao Mo  <zmo@google.com>
 
-2009-09-09  Cameron McCormack  <cam@mcc.id.au>
+        Reviewed by David Levin.
 
-        Reviewed by Eric Seidel.
+        texImage2D and texSubImage2D taking ImageData ignore flipY and premultiplyAlpha
+        https://bugs.webkit.org/show_bug.cgi?id=34459
 
-        Make SVGStyleElement inherit from SVGLangSpace
-        https://bugs.webkit.org/show_bug.cgi?id=29058
+        Test: fast/canvas/webgl/tex-image-and-sub-image-2d-with-image-data.html
 
-        Required by SVG 1.1 Second Edition:
-        http://dev.w3.org/SVG/profiles/1.1F2/publish/styling.html#InterfaceSVGStyleElement
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::texImage2D): Apply flipY and premultiplyAlpha to the texture data.
+        (WebCore::WebGLRenderingContext::texSubImage2D): Ditto.
+        * platform/graphics/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3D::extractImageData): Extract data from ImageData, applying flipY and premultiplyAlpha.
+        * platform/graphics/GraphicsContext3D.h: Add function extractImageData declaration.
 
-        Test: svg/dom/SVGStyleElement/style-langspace.html
+2010-02-26  Zhenyao Mo  <zmo@google.com>
 
-        * svg/SVGStyleElement.cpp: Drop methods xmlspace and setXmlspace.
-        (WebCore::SVGStyleElement::SVGStyleElement): Add SVGLangSpace()
-        initializer.
-        (WebCore::SVGStyleElement::parseMappedAttribute): Call
-        parseMappedAttribute on SVGLangSpace.
-        * svg/SVGStyleElement.h: Drop xmlspace and setXmlspace declarations.
-        * svg/SVGStyleElement.idl: Drop xmlspace attribute and add SVGLangSpace
-        as a superinterface.
+        Reviewed by David Levin.
 
-2009-09-09  Nate Chapin  <japhet@chromium.org>
+        Set viewport to canvas size upon context creation
+        https://bugs.webkit.org/show_bug.cgi?id=35057
 
-        Reviewed by David Levin.
+        Covered by existing tests, in particular fast/canvas/webgl/gl-get-calls.html
 
-        Remove unnecessary includes and forward declarations in V8Proxy.h
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext): Set the viewport size to match the canvas size.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29111
+2010-02-26  Pavel Feldman  <pfeldman@chromium.org>
 
-        * bindings/v8/V8Proxy.h:
+        Not reviewed: touch InspectorController to force front-end deployment.
 
-2009-07-30  Eric Seidel  <eric@webkit.org>
+        * inspector/InspectorController.cpp:
 
-        Reviewed by Adam Barth.
+2010-02-26  Ilya Tikhonovsky  <loislo@chromium.org>
 
-        Add more position constructors
-        positionBeforeNode, positionAfterNode
-        firstPositionInNode, lastPositionInNode
-        https://bugs.webkit.org/show_bug.cgi?id=25494
+        Reviewed by Pavel Feldman.
 
-        I also added a lastOffsetInNode and deployed it to a couple places.
+        WebInspector: While the current timeline view in DevTools provides a great overview of
+        things happening, we should make it easier to locate the cause of an event,
+        e.g., link to JS where relevant.
+        Caller info support for all kind of Timeline events and new Function Call event will be added.
+        JSC can be patched the same way as it will be done for V8.
 
-        There are no callers to these new constructors yet, but those
-        will be coming in future patches.
+        https://bugs.webkit.org/show_bug.cgi?id=33995
 
-        * dom/Position.cpp:
-        (WebCore::Position::computeOffsetInContainerNode):
-        * dom/Position.h:
-        (WebCore::positionBeforeNode):
-        (WebCore::positionAfterNode):
-        (WebCore::lastOffsetInNode):
-        (WebCore::firstPositionInNode):
-        (WebCore::lastPositionInNode):
-        * editing/ApplyStyleCommand.cpp:
-        * editing/TextIterator.cpp:
-        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
-        * editing/htmlediting.cpp:
-        (WebCore::lastOffsetForEditing):
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::callLocation):
+        * bindings/js/ScriptCallStack.h:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::create):
+        (WebCore::ScriptCallStack::callLocation):
+        * bindings/v8/ScriptCallStack.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::callFunction):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::~InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willCallFunction):
+        (WebCore::InspectorTimelineAgent::didCallFunction):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        (WebCore::InspectorTimelineAgent::instanceCount):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createGenericRecord):
+        (WebCore::TimelineRecordFactory::createFunctionCallData):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover.prototype.hideWhenClicked):
+        (WebInspector.Popover.prototype._positionElement):
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._closeRecordDetails):
+        (WebInspector.TimelinePanel.prototype._onScroll):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordListRow.prototype._createCell):
+        (WebInspector.TimelineRecordListRow.prototype._createRow):
+        (WebInspector.TimelineRecordListRow.prototype._createLinkRow):
+        (WebInspector.TimelineRecordListRow.prototype._generateBubbleContent):
+        (WebInspector.TimelineRecordListRow.prototype._onClick):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.js:
+        (WebInspector.linkifyResourceAsNode):
 
-2009-04-30  Eric Seidel  <eric@webkit.org>
+2010-02-26  Csaba Osztrogonác  <ossy@webkit.org>
 
-        Reviewed by Adam Barth.
+        Unreviewed. Roll-out r55263 because it broke fast/forms/textarea-type-spaces-pretty-diff.html.
+        https://bugs.webkit.org/show_bug.cgi?id=30946
 
-        Rename positionBeforeNode to positionInParentBeforeNode
-        and positionAfterNode to positionInParentAfterNode
-        in preparation for adding a positionBeforeNode
-        which returns a neighbor-anchored position.
-        https://bugs.webkit.org/show_bug.cgi?id=25494
-
-        No functional changes, thus no tests.
-
-        * dom/PositionConstructors.h:
-        (WebCore::positionInParentBeforeNode):
-        (WebCore::positionInParentAfterNode):
-        * dom/PositionIterator.cpp:
-        (WebCore::PositionIterator::operator Position):
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::ApplyStyleCommand::applyInlineStyle):
         * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
-        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
-        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
-        * editing/CreateLinkCommand.cpp:
-        (WebCore::CreateLinkCommand::doApply):
-        * editing/DeleteButtonController.cpp:
-        (WebCore::DeleteButtonController::deleteTarget):
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::DeleteSelectionCommand::initializeStartEnd):
-        (WebCore::updatePositionForNodeRemoval):
-        * editing/InsertLineBreakCommand.cpp:
-        (WebCore::InsertLineBreakCommand::doApply):
-        * editing/InsertListCommand.cpp:
-        (WebCore::InsertListCommand::doApply):
-        * editing/InsertParagraphSeparatorCommand.cpp:
-        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        (WebCore::isWhitespace):
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt):
         * editing/InsertTextCommand.cpp:
         (WebCore::InsertTextCommand::input):
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::positionAtStartOfInsertedContent):
-        (WebCore::ReplaceSelectionCommand::doApply):
-        * editing/VisibleSelection.cpp:
-        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
-        * editing/htmlediting.cpp:
-        (WebCore::firstEditablePositionAfterPositionInRoot):
-        (WebCore::lastEditablePositionBeforePositionInRoot):
-        (WebCore::rangeCompliantEquivalent):
-        (WebCore::positionBeforeContainingSpecialElement):
-        (WebCore::positionAfterContainingSpecialElement):
-        (WebCore::positionBeforeTabSpan):
-
-2009-04-30  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Re-organize position creation functions in preparation for adding more
-        https://bugs.webkit.org/show_bug.cgi?id=25494
-
-        Make position functions inline to avoid ref-churn.
-        Remove startPosition/endPosition as they were only used in one place.
-
-        No functional changes, thus no tests.
-
-        * dom/Position.cpp:
-        * dom/Position.h:
-        (WebCore::positionBeforeNode):
-        (WebCore::positionAfterNode):
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::moveTo):
-        * editing/TypingCommand.cpp:
+        * editing/InsertTextCommand.h:
         * editing/htmlediting.cpp:
         * editing/htmlediting.h:
-        (WebCore::firstDeepEditingPositionForNode):
-        (WebCore::lastDeepEditingPositionForNode):
-        * rendering/RenderObject.cpp:
-
-2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
 
-        Reviewed by Kevin Ollivier.
-        
-        [wx] Add wxSize conversions for IntSize.
-        https://bugs.webkit.org/show_bug.cgi?id=29104
+2010-02-25  Mark Rowe  <mrowe@apple.com>
 
-        * platform/graphics/IntSize.h:
-        * platform/graphics/wx/IntSizeWx.cpp: Added.
-        (WebCore::IntSize::IntSize):
-        (WebCore::IntSize::operator wxSize):
-
-2009-09-09  Yaar Schnitman  <yaar@chromium.org>
-
-        Reviewed by David Levin.
-        
-        Chromium uses its own config.h file that was forked from webkit's config.h.
-        By merging in Chromium's defines, Chromium would again be able to use webkit's
-        config.h.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28882 
-
-        * config.h: Added chromium-specific defines. 
-
-2009-09-09  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Initialize DataTransfer's effectAllowed and dropEffect properties correctly
-        according to HTML5 spec (sec. 7.9.2-7.9.3).
-        https://bugs.webkit.org/show_bug.cgi?id=26700
-        - At the start of a drag operation, the value of effectAllowed should be
-          the string "uninitialized".
-        - At end of dragstart handler, if effectAllowed hasn't been set yet, it
-          should be set to "copy".
-        - on dragenter and dragover event, dropEffect should be initialized to a
-          default value based on the value of effectAllowed.
-        - at end of dragenter and dragover the dropEffect should be set to "none"
-          if the value set by the handler doesn't match the effectAllowed.
-        - on dragleave event, dropEffect should be "none".
-        - on drop event, dropEffect should be the previously negotiated value.
-
-        Test: fast/events/drag-dropeffect.html
-
-        * WebCore.base.exp:
-            Added a parameter to EventHandler::dragSourceMovedTo.
-        * dom/Clipboard.cpp:
-        (WebCore::Clipboard::Clipboard):
-            Initialize m_effectAllowed to "uninitialized".
-        (WebCore::Clipboard::sourceOperation):
-            Treat "uninitialized" as meaning no value has been set.
-        * page/DragController.cpp:
-        (WebCore::DragController::DragController):
-            Initialize new member m_destinationDragOperation.
-        (WebCore::DragController::dragExited):
-            Set m_destinationDragOperation to none on dragExit.
-        (WebCore::DragController::performDrag):
-            Set m_destinationDragOperation to current dropEffect.
-        (WebCore::DragController::dragEnteredOrUpdated):
-            Make sure to clear the operation if drag source doesn't allow it.
-        (WebCore::DragController::tryDHTMLDrag):
-            Set a default value for the dst drag op before sending dragEnter/Over.
-        (WebCore::DragController::startDrag):
-            Clear m_destinationDragOperation at start of drag.
-        * page/DragController.h:
-        (WebCore::DragController::destinationDragOperation):
-            Added new member m_destinationDragOperation, and its public getter.
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::updateDragAndDrop):
-            dropEffect should be 'none' during dropleave handler, per spec.
-        (WebCore::EventHandler::dragSourceMovedTo):
-            Added DragOperation parameter, so the handler sees the current dropEffect.
-        (WebCore::EventHandler::handleDrag):
-            Assume DragOperationEvery for non-DHTML drags.
-        * page/EventHandler.h:
-            Added DragOperation parameter to dragSourceMovedTo().
+        Reviewed by Brady Eidson.
 
-2009-09-09  Dumitru Daniliuc  <dumi@chromium.org>
+        <rdar://problem/7688455> REGRESSION(r55205): Crash inside dispatchEventsOnWindowAndFocusedNode when clicking link from bookmarks view
 
-        Reviewed by Dimitri Glazkov.
+        Null-check the document's page to avoid dereferencing a null page.
 
-        1. Adding support/bindings for read-only transactions.
-        2. Disallowing the SQLITE_*_VIEW and REINDEX operations in the
-        private browsing mode.
-        3. Adding an authorizer test.
+        No regression test is added as this appears to be dependent on an interaction with Safari's bookmarks view that is
+        not testable from within DumpRenderTree.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28918
-
-        Test: storage/test-authorizer.html
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
 
-        * bindings/js/JSDatabaseCustom.cpp:
-        (WebCore::createTransaction): Parses all arguments and executes a
-        transaction.
-        (WebCore::JSDatabase::transaction): Refactored to use
-        createTransaction().
-        (WebCore::JSDatabase::readTransaction): Added to execute read-only
-        transactions using createTransaction().
-        * bindings/v8/custom/V8CustomBinding.h: Added the binding for
-        Database::readTransaction().
-        * bindings/v8/custom/V8DatabaseCustom.cpp:
-        (WebCore::createTransaction): Parses all arguments and executes a
-        transaction.
-        (WebCore::transaction): Refactored to use createTransaction().
-        (WebCore::readTransaction): Added to execute read-only
-        transactions using createTransaction().
-        * storage/Database.cpp:
-        (WebCore::Database::transaction): Added support for read-only
-        transactions.
-        * storage/Database.h: Added support for read-only transactions.
-        * storage/Database.idl: Added support for read-only transactions.
-        * storage/DatabaseAuthorizer.cpp:
-        (WebCore::DatabaseAuthorizer::createTempTable): Make it obvious
-        that the statement will be denied in private browsing mode and
-        read-only transactions.
-        (WebCore::DatabaseAuthorizer::dropTempTable): Same.
-        (WebCore::DatabaseAuthorizer::createTempIndex): Same.
-        (WebCore::DatabaseAuthorizer::dropTempIndex): Same.
-        (WebCore::DatabaseAuthorizer::createTempTrigger): Same.
-        (WebCore::DatabaseAuthorizer::dropTempTrigger): Same.
-        (WebCore::DatabaseAuthorizer::createView): Deny in private
-        browsing mode and read-only transactions.
-        (WebCore::DatabaseAuthorizer::createTempView): Same.
-        (WebCore::DatabaseAuthorizer::dropView): Same.
-        (WebCore::DatabaseAuthorizer::dropTempView): Same.
-        (WebCore::DatabaseAuthorizer::allowReindex): Same.
-        * storage/DatabaseAuthorizer.h:
-        * storage/SQLTransaction.cpp: Added support for read-only
-        transactions.
-        (WebCore::SQLTransaction::create):
-        (WebCore::SQLTransaction::SQLTransaction):
-        (WebCore::SQLTransaction::executeSQL):
-        (WebCore::SQLTransaction::acquireLock):
-        * storage/SQLTransaction.h:
-        * storage/SQLTransactionCoordinator.cpp:
-        (WebCore::SQLTransactionCoordinator::acquireLock): Added a new
-        parameter in preparation for a change that will allow multiple
-        read-only transactions on the same DB to run concurrently.
-        * storage/SQLTransactionCoordinator.h:
+2010-02-25  Oliver Hunt  <oliver@apple.com>
 
-2009-09-09  Dave Hyatt  <hyatt@apple.com>
+        Reviewed by Simon Fraser.
 
-        Reviewed by Adam Roben.
+        Multiple repaints on apple.com
+        https://bugs.webkit.org/show_bug.cgi?id=35409
 
-        https://bugs.webkit.org/show_bug.cgi?id=29102, add support for user stylesheet injection.  This is similar
-        to user script injection but allows for user stylesheets to be added.  The stylesheets are applied immediately
-        to all Frames in the PageGroup.
+        apple.com was triggering the fast scaling path for background images due to
+        repeated repaints as more content came in.  This occured due to a two problems
+        in the logic to detect scaling.  The first is that the main context is flipped
+        on mac so fails the identity or translation check.  We work around this by adding
+        an function that allows the scaling for a flipped CTM.  The other problem was that
+        we were looking at the destination rect size instead of the destination tile size
+        when deciding if the size we were drawn at would cause scaling.
 
-        Added userscripts/simple-stylesheet.html test case.
+        * platform/graphics/transforms/AffineTransform.h:
+        (WebCore::AffineTransform::isIdentityOrTranslationOrFlipped):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
 
-        * WebCore.base.exp:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::CSSStyleSelector):
-        * css/CSSStyleSelector.h:
-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        (WebCore::Document::attach):
-        (WebCore::Document::pageGroupUserSheets):
-        (WebCore::Document::clearPageGroupUserSheets):
-        (WebCore::Document::recalcStyleSelector):
-        * dom/Document.h:
-        * loader/PlaceholderDocument.cpp:
-        (WebCore::PlaceholderDocument::attach):
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::addUserStyleSheet):
-        (WebCore::PageGroup::removeUserContentForWorld):
-        (WebCore::PageGroup::removeAllUserContent):
-        * page/PageGroup.h:
-        (WebCore::PageGroup::userStyleSheets):
-        * page/UserStyleSheet.h: Added.
-        (WebCore::UserStyleSheet::UserStyleSheet):
-        (WebCore::UserStyleSheet::source):
-        (WebCore::UserStyleSheet::url):
-        (WebCore::UserStyleSheet::patterns):
-        (WebCore::UserStyleSheet::worldID):
-        * page/UserStyleSheetTypes.h: Added.
-
-2009-09-09  Carol Szabo  <carol.szabo@nokia.com>
+2010-02-25  Enrica Casucci  <enrica@apple.com>
 
-        Reviewed by Ariya Hidayat.
+        Reviewed by Adele Peterson.
 
-        [Qt] CSS Style -webkit-box-shadow is not rendered correctly on
-        Qt platform
-        https://bugs.webkit.org/show_bug.cgi?id=23291
+        Extra layout on keypress after a space (problem with rebalanceWhitespaceAt in InsertTextCommand).
+        https://bugs.webkit.org/show_bug.cgi?id=30946
+        <rdar://problem/7639184>
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::drawConvexPolygon):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::fillRoundedRect):
-         Added the ability to draw shadows for all these curves.
+        Do text insertion and whitespace rebalancing around the insertion in one step so that there's only one layout.
+        This patch was originally made by Justin Garcia.
+        
+        Test: editing/inserting/rebalance-whitespace-1.html
 
-2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt): No behavior changes here,
+        just pushed the code that determined the extent of whitespace surrounding a position
+        to its own helper function.
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::insertTextIntoNodeAndRebalanceWhitespace): Added.  Find 
+        whitespace surrounding the insertion position, add the text to insert, rebalance that entire
+        string, then insert it into the document.
+        (WebCore::InsertTextCommand::input):
+        * editing/InsertTextCommand.h:
+        * editing/htmlediting.cpp:
+        (WebCore::isWhitespace): Moved from CompositeEditCommand.cpp.
+        (WebCore::extentOfWhitespaceForRebalancingAt): Moved code from rebalanceWhitespaceAt into this helper
+        function.  Obtains the offset of the start and end of whitespace around a particular position.
+        * editing/htmlediting.h:
 
-        Reviewed by Simon Hausmann.
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
 
-        Add the qwebgraphicsitem.cpp to the build system.
+        Reviewed by Anders Carlsson.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28862
+        https://bugs.webkit.org/show_bug.cgi?id=35406
+        <rdar://problem/6945502> Make generic array methods work with JavaArray
 
-        * WebCore.pro:
+        Test: java/array-sort.html
 
-2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+        Made RuntimeArray inherit from JSArray, keeping the promise given in ClassInfo.
 
-        Reviewed by Kevin Ollivier.
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::RuntimeArray):
+        (JSC::RuntimeArray::~RuntimeArray):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::classInfo):
+        (JSC::RuntimeArray::getConcreteArray):
 
-        [wx port] Move functions in TemporaryLinkStubs.cpp out to files where
-        they belong.
+2010-02-25  Dan Bernstein  <mitz@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29088
+        Reviewed by Alexey Proskuryakov.
 
-        * editing/wx/EditorWx.cpp:
-        (WebCore::Editor::showColorPanel):
-        (WebCore::Editor::showFontPanel):
-        (WebCore::Editor::showStylesPanel):
-        * platform/graphics/wx/GraphicsContextWx.cpp:
-        (WebCore::GraphicsContext::setPlatformShadow):
-        (WebCore::GraphicsContext::clearPlatformShadow):
-        (WebCore::GraphicsContext::beginTransparencyLayer):
-        (WebCore::GraphicsContext::endTransparencyLayer):
-        (WebCore::GraphicsContext::clearRect):
-        (WebCore::GraphicsContext::strokeRect):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::GraphicsContext::setMiterLimit):
-        (WebCore::GraphicsContext::setAlpha):
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        * platform/graphics/wx/IconWx.cpp: Added.
-        (WebCore::Icon::~Icon):
-        (WebCore::Icon::createIconForFile):
-        (WebCore::Icon::createIconForFiles):
-        (WebCore::Icon::paint):
-        * platform/graphics/wx/ImageWx.cpp:
-        (WebCore::Image::loadPlatformResource):
-        (WebCore::Image::drawPattern):
-        * platform/wx/CursorWx.cpp:
-        (WebCore::moveCursor):
-        * platform/wx/FileChooserWx.cpp: Added.
-        (WebCore::FileChooser::basenameForWidth):
-        * platform/wx/KURLWx.cpp: Added.
-        (WebCore::KURL::fileSystemPath):
-        * platform/wx/SSLKeyGeneratorWx.cpp: Added.
-        (WebCore::getSupportedKeySizes):
-        (WebCore::signedPublicKeyAndChallengeString):
-        * platform/wx/SearchPopupMenuWx.cpp: Added.
-        (WebCore::SearchPopupMenu::SearchPopupMenu):
-        (WebCore::SearchPopupMenu::saveRecentSearches):
-        (WebCore::SearchPopupMenu::loadRecentSearches):
-        (WebCore::SearchPopupMenu::enabled):
-        * platform/wx/SharedBufferWx.cpp: Added.
-        (WebCore::SharedBuffer::createWithContentsOfFile):
-        * platform/wx/SystemTimeWx.cpp: Added.
-        (WebCore::userIdleTime):
-        * platform/wx/TemporaryLinkStubs.cpp: Removed.
-        * platform/wx/TextBreakIteratorInternalICUWx.cpp: Added.
-        (WebCore::currentSearchLocaleID):
-        (WebCore::currentTextBreakLocaleID):
-        * platform/wx/WidgetWx.cpp:
-        (WebCore::Widget::setIsSelected):
+        Fixed a regression introduced in r44243, which made the assertion in checkListItems()
+        ineffective.
 
-2009-09-09  Steve Block  <steveblock@google.com>
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElementData::checkListItems): Copy the items vector before recomputing it,
+        then assert that the newly-computed vector is equal to the copy.
 
-        Reviewed by Adam Barth.
+2010-02-25  Dirk Schulze  <krit@webkit.org>
 
-        Geolocation incorrectly calls error callback in case of exception in success callback.
-        https://bugs.webkit.org/show_bug.cgi?id=27255
+        Reviewed by Nikolas Zimmermann.
 
-        Test: fast/dom/Geolocation/callback-exception.html
+        SVG's tspan is no member of SVGRenderBase, this can cause crashes on filters
+        https://bugs.webkit.org/show_bug.cgi?id=35354
 
-        * bindings/js/JSCustomPositionCallback.cpp: Modified.
-        (WebCore::JSCustomPositionCallback::handleEvent): Modified. Removed raisedException out param.
-        * bindings/js/JSCustomPositionCallback.h: Modified. Removed raisedException out param from handleEvent method and made handleEvent private.
-        * bindings/js/JSCustomPositionErrorCallback.h: Modified. Made handleEvent private.
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::sendPosition): Modified. No longer call error callback in case of exception in success callback.
-        * page/PositionCallback.h: Modified. Removed raisedException out param from handleEvent method.
+        This makes the base class RenderSVGInline of RenderSVGTSpan and RenderSVGInlineText
+        dependent on SVGBaseRenderer.
+        The SVG spec want as to use the object bounding box of the text root as the bounding box
+        for text-childs. So we search for the text root and use it's bounding box, stroke rect and
+        repaint rect for further calculations.
 
-2009-09-09  Steve Block  <steveblock@google.com>
+        Test: svg/filters/filter-on-tspan.svg
 
-        Reviewed by Darin Adler.
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::objectBoundingBox): Find the text root and give back it's bounding box.
+        (WebCore::RenderSVGInline::strokeBoundingBox): same for stroke rect
+        (WebCore::RenderSVGInline::repaintRectInLocalCoordinates): same for repaint rect
+        * rendering/RenderSVGInline.h:
+        (WebCore::RenderSVGInline::toSVGRenderBase): RenderSVGInline is part of SVGRenderBase now.
+        * rendering/RenderSVGTSpan.h:
+        (WebCore::RenderSVGTSpan::renderName): Removed bounding box code. Was just a hack for filters and maskers.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::findTextRootObject): Search for the text root.
+        * rendering/SVGRenderSupport.h:
+        * svg/graphics/SVGPaintServerGradient.cpp: moved findTextRootObject to SVGRenderSupport
 
-        When Geolocation permission is denied, stops watches as well as one-shots.
-        https://bugs.webkit.org/show_bug.cgi?id=28305.
+2010-02-25  Dirk Schulze  <krit@webkit.org>
 
-        Tests: fast/dom/Geolocation/watch.html
-               fast/dom/Geolocation/permission-denied-stops-watches.html
+        Reviewed by Nikolas Zimmermann.
 
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::setIsAllowed): Modified. Marks the permission error as fatal.
-        (WebCore::Geolocation::handleError): Modified. If the error is fatal, stops watchers as well as one-shots.
-        * page/PositionError.h: Modified.
-        (WebCore::PositionError::setIsFatal): Added. Marks an error as fatal.
-        (WebCore::PositionError::isFatal): Added. Determines whether an error is fatal.
+        Use-element doesn't transform clipPath
+        https://bugs.webkit.org/show_bug.cgi?id=35375
 
-2009-09-09  Roland Steiner  <rolandsteiner@google.com>
+        If the use element is a child of clipPath, any settings on x, y or transform does not
+        transform the clipPath it references.
+        The use-element just misses this transformation in toClipPath.
 
-        Reviewed by Eric Seidel.
+        Test: svg/custom/use-on-clip-path-with-transformation.svg
 
-        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+        * platform/graphics/cairo/PathCairo.cpp: Gtk port translated the path to the wrong direction.
+        (WebCore::Path::translate):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::toClipPath):
 
-        Added getter/setter methods and trivial inline implementations for each.
-        (Note that they are not yet actually used.)
-        Once the Chromium code is changed to use them instead of directly accessing the
-        member variables, the member variables should be made private and cleaned up.
+2010-02-25  Jian Li  <jianli@chromium.org>
 
-        No new tests (no functional behavior changed).
+        Reviewed by Dmitry Titov.
 
-        * platform/chromium/ChromiumDataObject.h:
-        (WebCore::ChromiumDataObject::mainURL):
-        (WebCore::ChromiumDataObject::setMainURL):
-        (WebCore::ChromiumDataObject::mainURLTitle):
-        (WebCore::ChromiumDataObject::setMainURLTitle):
-        (WebCore::ChromiumDataObject::textPlain):
-        (WebCore::ChromiumDataObject::setTextPlain):
-        (WebCore::ChromiumDataObject::textHTML):
-        (WebCore::ChromiumDataObject::setTextHTML):
-        (WebCore::ChromiumDataObject::htmlBaseURL):
-        (WebCore::ChromiumDataObject::setHTMLBaseURL):
-        (WebCore::ChromiumDataObject::content):
-        (WebCore::ChromiumDataObject::releaseContent):
-        (WebCore::ChromiumDataObject::setContent):
-        (WebCore::ChromiumDataObject::contentFileExtension):
-        (WebCore::ChromiumDataObject::setContentFileExtension):
-        (WebCore::ChromiumDataObject::contentFileName):
-        (WebCore::ChromiumDataObject::setContentFileName):
-        (WebCore::ChromiumDataObject::fileNames):
-        (WebCore::ChromiumDataObject::setFileNames):
-        (WebCore::ChromiumDataObject::takeFileNames):
-
-2009-09-08  Pat Bradley  <vincent.bradley@nokia.com>
+        File.type support.
+        https://bugs.webkit.org/show_bug.cgi?id=35361
 
-        Reviewed by Ariya Hidayat.
+        Test: LayoutTests/editing/pasteboard/file-input-files-access.html
 
-        [Qt] locale date displays incorrect date format in symbian.
-        https://bugs.webkit.org/show_bug.cgi?id=29032
+        * html/File.cpp:
+        (WebCore::File::File):
+        * html/File.h:
+        (WebCore::File::type):
+        * html/File.idl:
 
-        strftime() in Symbian does not support #
-        Layout tests cannot be run on Symbian yet, so they are not updated.
+2010-02-25  Alexander Pavlov  <apavlov@chromium.org>
 
-        * runtime/DatePrototype.cpp:
-        (JSC::formatLocaleDate):
+        Reviewed by Pavel Feldman.
 
-2009-09-09  Rohini Ananth <rohini.ananth@nokia.com>
+        Javascript console should not attempt to scroll to end of console if console is not visible
 
-        Reviewed by Simon Hausmann.
+        https://bugs.webkit.org/show_bug.cgi?id=22992
 
-        NPAPI Plugin NPP_AsFile not working on Qt Webkit
-        https://bugs.webkit.org/show_bug.cgi?id=29068
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._scheduleScrollIntoView.scrollIntoView):
+        (WebInspector.ConsoleView.prototype._scheduleScrollIntoView):
+        (WebInspector.ConsoleView.prototype.addMessage):
 
-        * platform/qt/FileSystemQt.cpp:
-        (WebCore::openTemporaryFile)
-        Autoremove property of QTemporaryFile has been set to false. Hence closeFile() just closes and does not delete the file.
-        This solves the deletion of created temp file in PluginStream::destroyStream() before passing to plugin in NPP_AsFile.
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
 
-2009-09-08  Oliver Hunt  <oliver@apple.com>
+        Qt and Gtk build fixes.
 
-        Reviewed by NOBODY (Build fix).
+        * GNUmakefile.am:
+        * WebCore.pro:
+        Added CRuntimeObject.{c,cpp}.
 
-        Remove a few incorrect changes I left in.
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
 
-        * bindings/scripts/CodeGeneratorJS.pm:
+        Windows build fix.
 
-2009-09-08  Oliver Hunt  <oliver@apple.com>
+        * WebCore.vcproj/WebCore.vcproj: Added CRuntimeObject.{c,cpp}.
 
-        Reviewed by Sam Weinig.
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
 
-        Support numeric index getters in bindings
-        https://bugs.webkit.org/show_bug.cgi?id=29067
-
-        Add HasNumericIndexGetter to indicate a non-custom getter that
-        returns a number.  The numeric index getter also uses PropertySlot's
-        setValue rather than setCustomIndex to avoid an additional indirect
-        call.
-
-        * bindings/js/JSCanvasByteArrayCustom.cpp:
-        * bindings/js/JSCanvasFloatArrayCustom.cpp:
-        * bindings/js/JSCanvasIntArrayCustom.cpp:
-        * bindings/js/JSCanvasShortArrayCustom.cpp:
-        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp:
-        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp:
-        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * html/canvas/CanvasByteArray.h:
-        (WebCore::CanvasByteArray::item):
-        * html/canvas/CanvasByteArray.idl:
-        * html/canvas/CanvasFloatArray.h:
-        (WebCore::CanvasFloatArray::get):
-        (WebCore::CanvasFloatArray::item):
-        * html/canvas/CanvasFloatArray.idl:
-        * html/canvas/CanvasIntArray.h:
-        (WebCore::CanvasIntArray::get):
-        (WebCore::CanvasIntArray::item):
-        * html/canvas/CanvasIntArray.idl:
-        * html/canvas/CanvasPixelArray.idl:
-        * html/canvas/CanvasShortArray.h:
-        (WebCore::CanvasShortArray::get):
-        (WebCore::CanvasShortArray::item):
-        * html/canvas/CanvasShortArray.idl:
-        * html/canvas/CanvasUnsignedByteArray.h:
-        (WebCore::CanvasUnsignedByteArray::get):
-        (WebCore::CanvasUnsignedByteArray::item):
-        * html/canvas/CanvasUnsignedByteArray.idl:
-        * html/canvas/CanvasUnsignedIntArray.h:
-        (WebCore::CanvasUnsignedIntArray::get):
-        (WebCore::CanvasUnsignedIntArray::item):
-        * html/canvas/CanvasUnsignedIntArray.idl:
-        * html/canvas/CanvasUnsignedShortArray.h:
-        (WebCore::CanvasUnsignedShortArray::item):
-        * html/canvas/CanvasUnsignedShortArray.idl:
-
-2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix for 2.8.
-
-        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
-        (wxRenderer_DrawScrollbar):
-
-2009-09-08  Jens Alfke  <snej@chromium.org>
+        Reviewed by Geoffrey Garen.
 
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=35394
+        <rdar://problem/7685262> Make passing objects between Java and plug-ins work
 
-        In Mac Chromium, clicking below the last line of an editable area (textarea or
-        contenteditable) should put the caret at the end of the last line, as in Mac Safari.
+        * WebCore.PluginHostProcess.exp: WebKit now subclasses RuntimeObject, so it needed more exports.
 
-        Tests: LayoutTests/editing/selection/click-in-margins-inside-editable-div.html
-               LayoutTests/editing/selection/click-in-padding-with-multiple-line-boxes.html
+        * bridge/runtime_object.cpp:
+        (JSC::Bindings::callRuntimeObject):
+        (JSC::Bindings::callRuntimeConstructor):
+        Assert that a runtime object is passed as function.
 
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings): Change #if PLATFORM_MAC to be Mac-Chrome-inclusive.
+        * bridge/runtime_object.h: Moved RuntimeObject into Bindings namespace, matching other
+        related classes.
 
-2009-09-08  Dave Hyatt  <hyatt@apple.com>
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::toString): Pass rootObject to convertValueToJValue(). It's not needed when
+        constructing a string, but this function now takes it for the sake of Object.
+        (JavaJSObject::convertValueToJObject): Check that object class is JavaRuntimeObject, not
+        just RuntimeObject.
 
-        Reviewed by Mark Rowe.
+        * bridge/jni/jsc/JNIBridgeJSC.cpp:
+        (JavaField::setValueToInstance): Pass rootObject to convertValueToJValue().
+        (JavaArray::setValueAt): Ditto.
 
-        Make sure not to do an early return when a data URL stylesheet successfully loads.  We need to still
-        clear the old cached sheet out of all existing Frames.  Fixes the data URL stylesheet layout test failure.
+        * bridge/jni/jsc/JNIUtilityPrivate.h: convertValueToJValue() now takes a RootObject argument,
+        because one is needed to gcProtect an object ghtat is wrapped into JSObject.
 
-        * page/Page.cpp:
-        (WebCore::Page::userStyleSheetLocationChanged):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: (JSC::Bindings::convertValueToJValue): Convert
+        JavaScript objects to Java JSObject ones. This was already happening in other code paths,
+        which we should change to use common code.
 
-2009-09-08  Sam Weinig  <sam@webkit.org>
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::newRuntimeObject): Create an appropriate RuntimeObject subclass,
+        which is JavaRuntimeObject for Java.
+        (JavaInstance::invokeMethod): Unwrap returned JavaObjects that contain JS objects.
 
-        Fix windows build.
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bridge/c/CRuntimeObject.cpp: Added.
+        (JSC::Bindings::CRuntimeObject::CRuntimeObject):
+        (JSC::Bindings::CRuntimeObject::~CRuntimeObject):
+        (JSC::Bindings::CRuntimeObject::getInternalCInstance):
+        * bridge/c/CRuntimeObject.h: Added.
+        (JSC::Bindings::CRuntimeObject::classInfo):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::newRuntimeObject):
+        * bridge/c/c_instance.h:
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        * bridge/jni/jsc/JavaInstanceJSC.h:
+        * bridge/jni/jsc/JavaRuntimeObject.cpp: Added.
+        (JSC::Bindings::):
+        (JSC::Bindings::JavaRuntimeObject::JavaRuntimeObject):
+        (JSC::Bindings::JavaRuntimeObject::~JavaRuntimeObject):
+        (JSC::Bindings::JavaRuntimeObject::getInternalJavaInstance):
+        * bridge/jni/jsc/JavaRuntimeObject.h: Added.
+        (JSC::Bindings::JavaRuntimeObject::classInfo):
+        * bridge/jsc/BridgeJSC.h:
+        * bridge/objc/ObjCRuntimeObject.h: Added.
+        (JSC::Bindings::ObjCRuntimeObject::classInfo):
+        * bridge/objc/ObjCRuntimeObject.mm: Added.
+        (JSC::Bindings::):
+        (JSC::Bindings::ObjCRuntimeObject::ObjCRuntimeObject):
+        (JSC::Bindings::ObjCRuntimeObject::~ObjCRuntimeObject):
+        (JSC::Bindings::ObjCRuntimeObject::getInternalObjCInstance):
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::newRuntimeObject):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/runtime_root.h:
+        Added RuntimeObject subclasses for each instance type, and use them for type casting.
 
-        * dom/Document.idl:
+2010-02-25  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+        Rubber-stamped by Xan Lopez.
 
-        More robust wx build fix for 2.9.
+        Adopt the same string as the one that is expected by
+        fast/parser/fragment-parser.html for the description used by the
+        <isindex> element.
 
-        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
-        (wxRenderer_DrawScrollbar):
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::searchableIndexIntroduction):
 
-2009-09-08  Sam Weinig  <sam@webkit.org>
+2010-02-25  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27046
-        Implement CSSOM DocumentView.caretRangeFromPoint
-
-        Tests: fast/dom/Document/CaretRangeFromPoint/basic.html
-               fast/dom/Document/CaretRangeFromPoint/replace-element.html
-
-        * dom/Document.cpp:
-        (WebCore::Document::caretRangeFromPoint):
-        * dom/Document.h:
-        * dom/Document.idl:
-
-2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix, generate derived sources earlier in order to make sure
-        they're found by the build system when generating the list of sources to build.
-
-        * wscript:
-
-2009-09-08  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        <iterator> include in V8Proxy.h is spurious and causing ObjC compile issues for Chromium.
-
-        Test: Chromium mac canary build is fixed.
-
-        * bindings/v8/V8Proxy.h: Remove <iterator> include.
-
-2009-09-08  Xan Lopez  <xlopez@igalia.com>
-
-        Unreviewed attempt to fix the GTKbuild.
-
-        * GNUmakefile.am:
-
-2009-09-04  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28987, make the Document cache the page's user stylesheet in
-        parsed form.  Allows the sheet to survive across destruction/re-creation of the CSSStyleSelector.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::CSSStyleSelector):
-        * css/CSSStyleSelector.h:
-        * dom/Document.cpp:
-        (WebCore::Document::attach):
-        (WebCore::Document::pageUserSheet):
-        (WebCore::Document::clearPageUserSheet):
-        (WebCore::Document::recalcStyleSelector):
-        * dom/Document.h:
-        * loader/PlaceholderDocument.cpp:
-        (WebCore::PlaceholderDocument::attach):
-        * page/Page.cpp:
-        (WebCore::Page::userStyleSheetLocationChanged):
-        * page/Settings.cpp:
-        (WebCore::Settings::setUserStyleSheetLocation):
-
-2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Unreviewed buildfix.
-
-        Fix Qt build after 48167, by adding the new cpp/h files
-        added to WebCore.gypi to WebCore.pro as well.
-
-        * WebCore.pro:
-
-2009-09-08  Xan Lopez  <xlopez@igalia.com>
+        Web Inspector: evaluate-on-hover does not work on HTML files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35378
+
+        * inspector/front-end/SourceCSSTokenizer.re2js:
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype.set line):
+        (WebInspector.SourceHTMLTokenizer.prototype._isExpectingAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._isExpectingAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._setExpectingAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._setExpectingAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._attrValueTokenType):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+        * inspector/front-end/SourceJavaScriptTokenizer.js:
+        (WebInspector.SourceJavaScriptTokenizer):
+        * inspector/front-end/SourceJavaScriptTokenizer.re2js:
+        * inspector/front-end/SourceTokenizer.js:
+        (WebInspector.SourceTokenizer.prototype.set condition):
+        (WebInspector.SourceTokenizer.prototype.get condition):
+        (WebInspector.SourceTokenizer.prototype.get subTokenizer):
+        (WebInspector.SourceTokenizer.prototype.getLexCondition):
+        (WebInspector.SourceTokenizer.prototype.setLexCondition):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.set mimeType):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype._highlightInChunks):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLines):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLine):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._paintLine):
+
+2010-02-25  Xan Lopez  <xlopez@igalia.com>
 
         Reviewed by Gustavo Noronha.
 
-        should not pass URI fragments to libsoup
-        https://bugs.webkit.org/show_bug.cgi?id=28687
-
-        Strip the fragment from the URI before passing it to soup, since
-        it forwards it to servers in some cases (like when using a proxy)
-        which confuses them and makes them return 403/404.
+        Simple style cleanups.
 
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::startHttp):
-        (WebCore::):
-
-2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Add QGraphicsScene events support to the Qt platform events.
-
-        * platform/PlatformMouseEvent.h:
-        * platform/PlatformWheelEvent.h:
-        * platform/qt/PlatformMouseEventQt.cpp:
-        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
-        * platform/qt/WheelEventQt.cpp:
-        (WebCore::PlatformWheelEvent::applyDelta):
-        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
-
-2009-09-08  Michael Nordman  <michaeln@google.com>
-
-        Reviewed by Eric Seidel.
-
-        [Chromium] Cleanup: remove a few deprecated methods.
-        https://bugs.webkit.org/show_bug.cgi?id=28960
-
-        No new tests, just syntactic sugar.
-
-        * platform/network/chromium/ResourceRequest.h:
-        * platform/network/chromium/ResourceResponse.h:
-
-2009-09-08  Yongjun Zhang  <yongjun.zhang@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28981
-
-        [Qt] make npapi.h compile in winscw compiler.
-
-        Add XP_SYMBIAN macro to identify Symbian OS; this macro should be used for Symbian
-        specific changes in npapi.h.
-        Undefine XP_WIN when building for Symbian to avoid including Windows specific code.
-
-        * bridge/npapi.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::plugRemovedCallback):
+        (WebCore::plugAddedCallback):
+        (WebCore::PluginView::platformStart):
 
-2009-09-08  Oliver Hunt  <oliver@apple.com>
+2010-02-25  Andreas Kling  <andreas.kling@nokia.com>
 
-        Reviewed by Geoff Garen.
+        Reviewed by Darin Adler.
 
-        Web Inspector assertion failure related to marking
-        https://bugs.webkit.org/show_bug.cgi?id=28997
+        Optimize decoding of Latin-1 text by exploiting the fact that most of it will
+        be ASCII-only data.
 
-        When wrapping the callback the JSInspectorCallbackWrapper creator was using
-        inheritorID for the prototype structure which is unsafe for anything other
-        than a pure JS object.  Instead we now create a new structure, which while
-        inefficient is not problematic as this code is not hit frequently.
+        https://bugs.webkit.org/show_bug.cgi?id=35233
 
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        (WebCore::JSInspectorCallbackWrapper::wrap):
+        * platform/text/TextCodecLatin1.cpp:
+        (WebCore::TextCodecLatin1::decode):
 
-2009-09-08  Kelly Norton  <knorton@google.com>
+2010-02-25  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Add missing extension to the file entry in WebCore.vcproj.
-
-        * WebCore.vcproj/WebCore.vcproj: Added "cpp".
-
-2009-09-08  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        dataTransfer.types() should not return Files if file list is empty in the clipboard.
-        https://bugs.webkit.org/show_bug.cgi?id=28891
-
-        We change the behavior to handle the empty file list in order to match the spec.
-
-        Tested by clipboard-file-access.html.
-
-        * platform/mac/ClipboardMac.mm:
-        (WebCore::addHTMLClipboardTypesForCocoaType):
-        (WebCore::ClipboardMac::types):
-
-2009-09-08  Steve VanDeBogart  <vandebo@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Handle middle click in Chromium like QT
-        https://bugs.webkit.org/show_bug.cgi?id=28696
-
-        Tested by middle-click-onpaste.html.
-
-        * platform/Pasteboard.h:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::getData):
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::Pasteboard):
-        (WebCore::Pasteboard::isSelectionMode):
-        (WebCore::Pasteboard::setSelectionMode):
-        (WebCore::Pasteboard::canSmartReplace):
-        (WebCore::Pasteboard::plainText):
-        (WebCore::Pasteboard::documentFragment):
-        * platform/chromium/PasteboardPrivate.h:
-        (WebCore::PasteboardPrivate::):
-
-2009-09-08  Kelly Norton  <knorton@google.com>
-
-        Reviewed by Eric Seidel.
-
-        WebInspector: Adds a timeline agent to InspectorController that collects
-        high-level timing data about event dispatch, layout, painting and HTML
-        parsing and makes it available to Inspector.
-        https://bugs.webkit.org/show_bug.cgi?id=25503
-
-        * WebCore.gypi:
-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/Document.cpp:
-        (WebCore::Document::recalcStyle):
-        * dom/Document.h:
-        (WebCore::Document::inspectorTimelineAgent):
-        * dom/Node.cpp:
-        (WebCore::Node::dispatchGenericEvent):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::write):
-        * inspector/DOMDispatchTimelineItem.cpp: Added.
-        (WebCore::DOMDispatchTimelineItem::DOMDispatchTimelineItem):
-        (WebCore::DOMDispatchTimelineItem::convertToScriptObject):
-        * inspector/DOMDispatchTimelineItem.h: Added.
-        (WebCore::DOMDispatchTimelineItem::~DOMDispatchTimelineItem):
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::enableTimeline):
-        (WebCore::InspectorBackend::disableTimeline):
-        (WebCore::InspectorBackend::timelineEnabled):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setFrontendProxyObject):
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::resetScriptObjects):
-        (WebCore::InspectorController::enableTimeline):
-        (WebCore::InspectorController::disableTimeline):
-        (WebCore::InspectorController::timelineEnabled):
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::timelineAgent):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::timelineWasEnabled):
-        (WebCore::InspectorFrontend::timelineWasDisabled):
-        (WebCore::InspectorFrontend::addItemToTimeline):
-        * inspector/InspectorFrontend.h:
-        * inspector/InspectorTimelineAgent.cpp: Added.
-        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
-        (WebCore::InspectorTimelineAgent::~InspectorTimelineAgent):
-        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::willLayout):
-        (WebCore::InspectorTimelineAgent::didLayout):
-        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::willPaint):
-        (WebCore::InspectorTimelineAgent::didPaint):
-        (WebCore::InspectorTimelineAgent::willWriteHTML):
-        (WebCore::InspectorTimelineAgent::didWriteHTML):
-        (WebCore::InspectorTimelineAgent::reset):
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
-        (WebCore::InspectorTimelineAgent::currentTimeInMilliseconds):
-        (WebCore::InspectorTimelineAgent::sessionTimeInMilliseconds):
-        * inspector/InspectorTimelineAgent.h: Added.
-        * inspector/TimelineItem.cpp: Added.
-        (WebCore::TimelineItem::TimelineItem):
-        (WebCore::TimelineItem::addToTimeline):
-        (WebCore::TimelineItem::convertToScriptObject):
-        (WebCore::TimelineItem::convertChildrenToScriptArray):
-        (WebCore::TimelineItem::addChildItem):
-        * inspector/TimelineItem.h: Added.
-        (WebCore::):
-        (WebCore::TimelineItem::~TimelineItem):
-        (WebCore::TimelineItem::previous):
-        (WebCore::TimelineItem::releasePrevious):
-        (WebCore::TimelineItem::setEndTime):
-        (WebCore::TimelineItem::type):
-        * inspector/front-end/TimelineAgent.js: Added.
-        (WebInspector.TimelineAgent):
-        (WebInspector.addItemToTimeline):
-        (WebInspector.timelineWasEnabled):
-        (WebInspector.timelineWasDisabled):
-        * inspector/front-end/inspector.html:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        (WebCore::FrameView::paintContents):
-        * page/FrameView.h:
-        (WebCore::FrameView::inspectorTimelineAgent):
-        * page/Page.cpp:
-        (WebCore::Page::inspectorTimelineAgent):
-        * page/Page.h:
-
-2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Fix unused variable warnings
-        https://bugs.webkit.org/show_bug.cgi?id=29018
-
-        No functional change, no tests.
-
-        * history/qt/HistoryItemQt.cpp:
-        (WebCore::HistoryItem::restoreState):
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::putImageData):
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::paintMenuList):
-
-2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        [Qt] Use the declaration order in initializer lists
-        https://bugs.webkit.org/show_bug.cgi?id=29017
+        Web Inspector: make script lines count calculation lazy.
 
-        No functional change, no new tests.
+        https://bugs.webkit.org/show_bug.cgi?id=35392
 
-        * platform/graphics/qt/FontCacheQt.cpp:
-        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
-
-2009-09-08  Kent Tamura  <tkent@chromium.org>
+        * inspector/front-end/Script.js:
+        (WebInspector.Script):
+        (WebInspector.Script.prototype.get linesCount):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._addBreakpoint):
 
-        Reviewed by Eric Seidel.
+2010-02-25  James Choi  <jchoi42@pha.jhu.edu>
 
-        Implement ValidityState::typeMismatch() for <input type=number>.
-        https://bugs.webkit.org/show_bug.cgi?id=28934
+        Reviewed by David Levin.
 
-        Test: fast/forms/ValidityState-typeMismatch-number.html
+        Change hardcoded gcc paths to be Solaris friendly
+        https://bugs.webkit.org/show_bug.cgi?id=35213
 
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::formStringToDouble):
-        * html/HTMLInputElement.h:
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::typeMismatch):
-        * html/ValidityState.h:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * bindings/scripts/IDLParser.pm:
+        * css/make-css-file-arrays.pl:
+        * dom/make_names.pl:
 
-2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+2010-02-25  Xan Lopez  <xlopez@igalia.com>
 
         Reviewed by Gustavo Noronha.
 
-        [Gtk] Another attempt of a buildfix.
-
-        * GNUmakefile.am: Modified. Remove some extra IDL files added in r48153.
-
-2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Workaround Java plugins not drawing themselves properly on first
+        expose by doing a late size-allocate after 'plug-added' has been
+        emitted on the embedding GtkSocket. It's unclear to me if this is
+        a bug in our side or theirs, but this should be pretty safe and
+        fixes the annoyance while we investigate it further.
 
-        Reviewed by Simon Hausmann.
-
-        [Qt] Make cursor set cleaner in QtWebKit Api: eliminate SetCursorEvent hack.
-        https://bugs.webkit.org/show_bug.cgi?id=28865
-
-        Save the QCursor as a property in WidgetQt::setCursor
-        and actually change the cursor in QWebView::event() by making use
-        of the QEvent::DynamicPropertyChange event type.
-        When unsetCursor() is called on the QWidget we can fallback to
-        the cursor set by WebCore.
-
-        Patch by Kenneth Rohde Christiansen <kenneth@webkit.org> and
-                 Antonio Gomes <antonio.gomes@openbossa.org> on 2009-09-07
-
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::setCursor):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::plugAddedCallback):
+        (WebCore::PluginView::platformStart):
 
-2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+2010-02-23  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Reviewed by Gustavo Noronha.
+        Reviewed by Tor Arne Vestbø.
 
-        [Gtk] Buildfix for build error introduced in r48150.
+        Add missing include guards
 
-        * GNUmakefile.am: Modified. Added missing IDL files.
+        * loader/CrossOriginPreflightResultCache.h:
+        * loader/MainResourceLoader.h:
 
-2009-09-08  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+2010-02-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
 
-        [Qt] Buildfix. Build error caused by r48150.
+        [Qt] Restrict the optimization flags for Symbian to release builds.
 
-        * WebCore.pro: missing IDL files added
+        * WebCore.pro:
 
-2009-09-07  Chris Marrin  <cmarrin@apple.com>
+2010-02-25  Jarkko Sakkinen  <jarkko.sakkinen@tieto.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Update Canvas 3D implementation to match spec
-        https://bugs.webkit.org/show_bug.cgi?id=29010
+        Qt WebGL support
 
-        This adds several new CanvasXXXArray classes each of which has a custom constructor
-        and custom getters and setters. Also changed CanvasRenderingContext3D and GraphicsContext3D
-        to match the new and changed API.
+        Adds GraphicsContext3D QtWebKit implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=35153
 
-        * DerivedSources.make:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCanvasArrayBufferConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasArrayBufferConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasFloatArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasFloatArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasFloatArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext3D::bufferData):
-        (WebCore::JSCanvasRenderingContext3D::bufferSubData):
-        (WebCore::JSCanvasRenderingContext3D::texImage2D):
-        (WebCore::JSCanvasRenderingContext3D::texSubImage2D):
-        * bindings/js/JSCanvasShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::canvasArrayBuffer):
-        (WebCore::JSDOMWindow::canvasByteArray):
-        (WebCore::JSDOMWindow::canvasUnsignedByteArray):
-        (WebCore::JSDOMWindow::canvasIntArray):
-        (WebCore::JSDOMWindow::canvasUnsignedIntArray):
-        (WebCore::JSDOMWindow::canvasShortArray):
-        (WebCore::JSDOMWindow::canvasUnsignedShortArray):
-        (WebCore::JSDOMWindow::canvasFloatArray):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext):
-        (WebCore::HTMLCanvasElement::paint):
-        * html/canvas/CanvasArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasArray.idl: Added.
-        * html/canvas/CanvasArrayBuffer.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasArrayBuffer.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasArrayBuffer.idl: Added.
-        * html/canvas/CanvasByteArray.cpp:
-        * html/canvas/CanvasByteArray.h:
-        * html/canvas/CanvasByteArray.idl:
-        * html/canvas/CanvasFloatArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasFloatArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasFloatArray.idl: Added.
-        * html/canvas/CanvasIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasIntArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasIntArray.idl: Added.
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        (WebCore::CanvasRenderingContext3D::CanvasRenderingContext3D):
-        (WebCore::CanvasRenderingContext3D::markContextChanged):
-        (WebCore::CanvasRenderingContext3D::beginPaint):
-        (WebCore::CanvasRenderingContext3D::endPaint):
-        (WebCore::CanvasRenderingContext3D::reshape):
-        (WebCore::CanvasRenderingContext3D::sizeInBytes):
-        (WebCore::CanvasRenderingContext3D::bindTexture):
-        (WebCore::CanvasRenderingContext3D::bufferData):
-        (WebCore::CanvasRenderingContext3D::bufferSubData):
-        (WebCore::CanvasRenderingContext3D::checkFramebufferStatus):
-        (WebCore::CanvasRenderingContext3D::clear):
-        (WebCore::CanvasRenderingContext3D::createBuffer):
-        (WebCore::CanvasRenderingContext3D::createFramebuffer):
-        (WebCore::CanvasRenderingContext3D::createTexture):
-        (WebCore::CanvasRenderingContext3D::createProgram):
-        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
-        (WebCore::CanvasRenderingContext3D::createShader):
-        (WebCore::CanvasRenderingContext3D::deleteBuffer):
-        (WebCore::CanvasRenderingContext3D::deleteFramebuffer):
-        (WebCore::CanvasRenderingContext3D::deleteProgram):
-        (WebCore::CanvasRenderingContext3D::deleteRenderbuffer):
-        (WebCore::CanvasRenderingContext3D::deleteShader):
-        (WebCore::CanvasRenderingContext3D::deleteTexture):
-        (WebCore::CanvasRenderingContext3D::drawArrays):
-        (WebCore::CanvasRenderingContext3D::drawElements):
-        (WebCore::CanvasRenderingContext3D::getBoolean):
-        (WebCore::CanvasRenderingContext3D::getBooleanv):
-        (WebCore::CanvasRenderingContext3D::getBufferParameteri):
-        (WebCore::CanvasRenderingContext3D::getBufferParameteriv):
-        (WebCore::CanvasRenderingContext3D::getFloat):
-        (WebCore::CanvasRenderingContext3D::getFloatv):
-        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteri):
-        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteriv):
-        (WebCore::CanvasRenderingContext3D::getInteger):
-        (WebCore::CanvasRenderingContext3D::getIntegerv):
-        (WebCore::CanvasRenderingContext3D::getProgrami):
-        (WebCore::CanvasRenderingContext3D::getProgramiv):
-        (WebCore::CanvasRenderingContext3D::getProgramInfoLog):
-        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteri):
-        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteriv):
-        (WebCore::CanvasRenderingContext3D::getShaderi):
-        (WebCore::CanvasRenderingContext3D::getShaderiv):
-        (WebCore::CanvasRenderingContext3D::getShaderInfoLog):
-        (WebCore::CanvasRenderingContext3D::getShaderSource):
-        (WebCore::CanvasRenderingContext3D::getTexParameterf):
-        (WebCore::CanvasRenderingContext3D::getTexParameterfv):
-        (WebCore::CanvasRenderingContext3D::getTexParameteri):
-        (WebCore::CanvasRenderingContext3D::getTexParameteriv):
-        (WebCore::CanvasRenderingContext3D::getUniformf):
-        (WebCore::CanvasRenderingContext3D::getUniformfv):
-        (WebCore::CanvasRenderingContext3D::getUniformi):
-        (WebCore::CanvasRenderingContext3D::getUniformiv):
-        (WebCore::CanvasRenderingContext3D::getUniformLocation):
-        (WebCore::CanvasRenderingContext3D::getVertexAttribf):
-        (WebCore::CanvasRenderingContext3D::getVertexAttribfv):
-        (WebCore::CanvasRenderingContext3D::getVertexAttribi):
-        (WebCore::CanvasRenderingContext3D::getVertexAttribiv):
-        (WebCore::CanvasRenderingContext3D::getVertexAttribOffset):
-        (WebCore::CanvasRenderingContext3D::texImage2D):
-        (WebCore::CanvasRenderingContext3D::texParameterf):
-        (WebCore::CanvasRenderingContext3D::texParameteri):
-        (WebCore::CanvasRenderingContext3D::texSubImage2D):
-        (WebCore::CanvasRenderingContext3D::uniform1f):
-        (WebCore::CanvasRenderingContext3D::uniform1fv):
-        (WebCore::CanvasRenderingContext3D::uniform1i):
-        (WebCore::CanvasRenderingContext3D::uniform1iv):
-        (WebCore::CanvasRenderingContext3D::uniform2f):
-        (WebCore::CanvasRenderingContext3D::uniform2fv):
-        (WebCore::CanvasRenderingContext3D::uniform2i):
-        (WebCore::CanvasRenderingContext3D::uniform2iv):
-        (WebCore::CanvasRenderingContext3D::uniform3f):
-        (WebCore::CanvasRenderingContext3D::uniform3fv):
-        (WebCore::CanvasRenderingContext3D::uniform3i):
-        (WebCore::CanvasRenderingContext3D::uniform3iv):
-        (WebCore::CanvasRenderingContext3D::uniform4f):
-        (WebCore::CanvasRenderingContext3D::uniform4fv):
-        (WebCore::CanvasRenderingContext3D::uniform4i):
-        (WebCore::CanvasRenderingContext3D::uniform4iv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
-        (WebCore::CanvasRenderingContext3D::useProgram):
-        (WebCore::CanvasRenderingContext3D::validateProgram):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib1f):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib2f):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib3f):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib4f):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttribPointer):
-        (WebCore::CanvasRenderingContext3D::viewport):
-        * html/canvas/CanvasRenderingContext3D.h:
-        * html/canvas/CanvasRenderingContext3D.idl:
-        * html/canvas/CanvasShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasShortArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasShortArray.idl: Added.
-        * html/canvas/CanvasTexture.cpp:
-        (WebCore::CanvasTexture::CanvasTexture):
-        * html/canvas/CanvasTexture.h:
-        (WebCore::CanvasTexture::isCubeMapRWrapModeInitialized):
-        (WebCore::CanvasTexture::setCubeMapRWrapModeInitialized):
-        * html/canvas/CanvasUnsignedByteArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasUnsignedByteArray.h: Added with properties svn:eol-style and svn:mime-type.
-         * html/canvas/CanvasUnsignedByteArray.idl: Added.
-        * html/canvas/CanvasUnsignedIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasUnsignedIntArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasUnsignedIntArray.idl: Added.
-        * html/canvas/CanvasUnsignedShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasUnsignedShortArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasUnsignedShortArray.idl: Added.
-        * page/DOMWindow.idl:
+        * WebCore.pri:
+        * WebCore.pro:
         * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp: Added.
+        (WebCore::GraphicsContext3DInternal::isValid):
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::~GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::getProcAddress):
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformTexture):
+        (WebCore::GraphicsContext3D::makeContextCurrent):
         (WebCore::GraphicsContext3D::beginPaint):
         (WebCore::GraphicsContext3D::endPaint):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::GraphicsContext3D::activeTexture):
+        (WebCore::GraphicsContext3D::attachShader):
+        (WebCore::GraphicsContext3D::bindAttribLocation):
+        (WebCore::GraphicsContext3D::bindBuffer):
+        (WebCore::GraphicsContext3D::bindFramebuffer):
+        (WebCore::GraphicsContext3D::bindRenderbuffer):
         (WebCore::GraphicsContext3D::bindTexture):
+        (WebCore::GraphicsContext3D::blendColor):
+        (WebCore::GraphicsContext3D::blendEquation):
+        (WebCore::GraphicsContext3D::blendEquationSeparate):
+        (WebCore::GraphicsContext3D::blendFunc):
+        (WebCore::GraphicsContext3D::blendFuncSeparate):
         (WebCore::GraphicsContext3D::bufferData):
         (WebCore::GraphicsContext3D::bufferSubData):
         (WebCore::GraphicsContext3D::checkFramebufferStatus):
+        (WebCore::GraphicsContext3D::clearColor):
+        (WebCore::GraphicsContext3D::clear):
+        (WebCore::GraphicsContext3D::clearDepth):
+        (WebCore::GraphicsContext3D::clearStencil):
+        (WebCore::GraphicsContext3D::colorMask):
+        (WebCore::GraphicsContext3D::compileShader):
+        (WebCore::GraphicsContext3D::copyTexImage2D):
+        (WebCore::GraphicsContext3D::copyTexSubImage2D):
+        (WebCore::GraphicsContext3D::cullFace):
+        (WebCore::GraphicsContext3D::depthFunc):
+        (WebCore::GraphicsContext3D::depthMask):
+        (WebCore::GraphicsContext3D::depthRange):
+        (WebCore::GraphicsContext3D::detachShader):
+        (WebCore::GraphicsContext3D::disable):
+        (WebCore::GraphicsContext3D::disableVertexAttribArray):
         (WebCore::GraphicsContext3D::drawArrays):
         (WebCore::GraphicsContext3D::drawElements):
+        (WebCore::GraphicsContext3D::enable):
+        (WebCore::GraphicsContext3D::enableVertexAttribArray):
+        (WebCore::GraphicsContext3D::finish):
+        (WebCore::GraphicsContext3D::flush):
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3D::framebufferTexture2D):
+        (WebCore::GraphicsContext3D::frontFace):
+        (WebCore::GraphicsContext3D::generateMipmap):
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+        (WebCore::GraphicsContext3D::getAttribLocation):
+        (WebCore::GraphicsContext3D::getContextAttributes):
+        (WebCore::GraphicsContext3D::getError):
+        (WebCore::GraphicsContext3D::getString):
+        (WebCore::GraphicsContext3D::hint):
+        (WebCore::GraphicsContext3D::isBuffer):
+        (WebCore::GraphicsContext3D::isEnabled):
+        (WebCore::GraphicsContext3D::isFramebuffer):
+        (WebCore::GraphicsContext3D::isProgram):
+        (WebCore::GraphicsContext3D::isRenderbuffer):
+        (WebCore::GraphicsContext3D::isShader):
+        (WebCore::GraphicsContext3D::isTexture):
+        (WebCore::GraphicsContext3D::lineWidth):
+        (WebCore::GraphicsContext3D::linkProgram):
+        (WebCore::GraphicsContext3D::pixelStorei):
+        (WebCore::GraphicsContext3D::polygonOffset):
+        (WebCore::GraphicsContext3D::readPixels):
+        (WebCore::GraphicsContext3D::releaseShaderCompiler):
+        (WebCore::GraphicsContext3D::renderbufferStorage):
+        (WebCore::GraphicsContext3D::sampleCoverage):
+        (WebCore::GraphicsContext3D::scissor):
+        (WebCore::GraphicsContext3D::shaderSource):
+        (WebCore::GraphicsContext3D::stencilFunc):
+        (WebCore::GraphicsContext3D::stencilFuncSeparate):
+        (WebCore::GraphicsContext3D::stencilMask):
+        (WebCore::GraphicsContext3D::stencilMaskSeparate):
+        (WebCore::GraphicsContext3D::stencilOp):
+        (WebCore::GraphicsContext3D::stencilOpSeparate):
         (WebCore::GraphicsContext3D::texParameterf):
         (WebCore::GraphicsContext3D::texParameteri):
         (WebCore::GraphicsContext3D::uniform1f):
@@ -23050,6 +12077,8 @@
         (WebCore::GraphicsContext3D::uniformMatrix2fv):
         (WebCore::GraphicsContext3D::uniformMatrix3fv):
         (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::useProgram):
+        (WebCore::GraphicsContext3D::validateProgram):
         (WebCore::GraphicsContext3D::vertexAttrib1f):
         (WebCore::GraphicsContext3D::vertexAttrib1fv):
         (WebCore::GraphicsContext3D::vertexAttrib2f):
@@ -23059,27651 +12088,9499 @@
         (WebCore::GraphicsContext3D::vertexAttrib4f):
         (WebCore::GraphicsContext3D::vertexAttrib4fv):
         (WebCore::GraphicsContext3D::vertexAttribPointer):
-        (WebCore::GraphicsContext3D::getBoolean):
+        (WebCore::GraphicsContext3D::viewport):
         (WebCore::GraphicsContext3D::getBooleanv):
-        (WebCore::GraphicsContext3D::getFloat):
-        (WebCore::GraphicsContext3D::getFloatv):
-        (WebCore::GraphicsContext3D::getInteger):
-        (WebCore::GraphicsContext3D::getIntegerv):
-        (WebCore::GraphicsContext3D::getBufferParameteri):
         (WebCore::GraphicsContext3D::getBufferParameteriv):
-        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteri):
+        (WebCore::GraphicsContext3D::getFloatv):
         (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
-        (WebCore::GraphicsContext3D::getProgrami):
+        (WebCore::GraphicsContext3D::getIntegerv):
         (WebCore::GraphicsContext3D::getProgramiv):
-        (WebCore::GraphicsContext3D::getRenderbufferParameteri):
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
         (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
-        (WebCore::GraphicsContext3D::getShaderi):
         (WebCore::GraphicsContext3D::getShaderiv):
-        (WebCore::GraphicsContext3D::getTexParameterf):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
         (WebCore::GraphicsContext3D::getTexParameterfv):
-        (WebCore::GraphicsContext3D::getTexParameteri):
         (WebCore::GraphicsContext3D::getTexParameteriv):
-        (WebCore::GraphicsContext3D::getUniformf):
         (WebCore::GraphicsContext3D::getUniformfv):
-        (WebCore::GraphicsContext3D::getUniformi):
         (WebCore::GraphicsContext3D::getUniformiv):
-        (WebCore::GraphicsContext3D::getVertexAttribf):
+        (WebCore::GraphicsContext3D::getUniformLocation):
         (WebCore::GraphicsContext3D::getVertexAttribfv):
-        (WebCore::GraphicsContext3D::getVertexAttribi):
         (WebCore::GraphicsContext3D::getVertexAttribiv):
         (WebCore::GraphicsContext3D::getVertexAttribOffset):
         (WebCore::GraphicsContext3D::texImage2D):
         (WebCore::GraphicsContext3D::texSubImage2D):
+        (WebCore::GraphicsContext3D::createBuffer):
+        (WebCore::GraphicsContext3D::createFramebuffer):
+        (WebCore::GraphicsContext3D::createProgram):
+        (WebCore::GraphicsContext3D::createRenderbuffer):
+        (WebCore::GraphicsContext3D::createShader):
+        (WebCore::GraphicsContext3D::createTexture):
+        (WebCore::GraphicsContext3D::deleteBuffer):
+        (WebCore::GraphicsContext3D::deleteFramebuffer):
+        (WebCore::GraphicsContext3D::deleteProgram):
+        (WebCore::GraphicsContext3D::deleteRenderbuffer):
+        (WebCore::GraphicsContext3D::deleteShader):
+        (WebCore::GraphicsContext3D::deleteTexture):
         (WebCore::GraphicsContext3D::sizeInBytes):
+        (WebCore::GraphicsContext3D::synthesizeGLError):
+        (WebCore::GraphicsContext3D::getImageData):
 
-2009-09-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+2010-02-25  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Make m_windowVisible more consistent with the actual visibility of the inspector.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setWindowVisible):
-
-2009-09-07  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed speculative build fix for Snow Leopard.
-
-        * platform/GeolocationService.cpp:
-        (WebCore::createGeolocationServiceNull):
-
-2009-09-07  Steve Block  <steveblock@google.com>
-
-        Reviewed by Adam Barth.
-
-        Adds a mock Geolocation service. This will be used to provide predictable behavior of the
-        Geolocation API for use in LayoutTests. Later changes will integrate the the mock
-        Geolocation service with DumpRenderTree.
-        https://bugs.webkit.org/show_bug.cgi?id=28264
-
-        The mock Geolocation service returns a fixed position or error. This position or error can be
-        set through static methods on the GeolocationService class. The position or error is shared
-        between all instances of the mock Geolocation service.
-
-        Implementation details.
-        The GeolocationService object maintains a pointer to a factory function which it uses to create
-        Geolocation service instances. Each platform implementing Geolocation sets this pointer
-        to the factory function for their platform's implementation. When the mock Geolocation service
-        is activated, the factory function pointer is reset to the factory function for the mock service.
-
-        Test: fast/dom/Geolocation/error.html
-
-        * WebCore.base.exp: Modified. Exports GeolocationServiceMock methods.
-        * GNUMakefile.am: Modified. Added GeolocationServiceMock files.
-        * WebCore.gypi: Modified. Added GeolocationServiceMock files.
-        * WebCore.pro: Modified. Added GeolocationServiceMock files.
-        * WebCore.vcproj/WebCore.vcproj: Modified. Added GeolocationServiceMock files.
-        * WebCore.vcproj/WebCoreCommon.vsprops: Modified. Added mock directory to includes.
-        * WebCore.xcodeproj/project.pbxproj: Modified. Added GeolocationServiceMock files and exports some headers.
-        * WebCoreSources.bkl: Modified. Added GeolocationServiceMock files.
-        * page/ChromeClient.h: Modified. Fixed comment.
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::setIsAllowed): Modified. Fixed error string.
-        * platform/GeolocationService.cpp: Modified.
-        (WebCore::createGeolocationServiceNull): Added. Returns null in place of a Geolocation service. Used to avoid link errors on platforms where Geolocation is not implemented.
-        (WebCore::GeolocationService::create): Added. Uses the factory function pointer to create a Geolocation service implementation.
-        (WebCore::GeolocationService::useMock): Added. Configures the GeolocationServie to use the mock implementation.
-        * platform/GeolocationService.h: Modified.
-        * platform/mock: Added.
-        * platform/mock/GeolocationServiceMock.cpp: Added.
-        (WebCore::GeolocationServiceMock::create): Added. Creates a GeolocationServiceMock object.
-        (WebCore::GeolocationServiceMock::GeolocationServiceMock): Added. Constructor.
-        (WebCore::GeolocationServiceMock::~GeolocationServiceMock): Added. Destructor.
-        (WebCore::GeolocationServiceMock::setPosition): Added. Sets the position that will be returned by the object.
-        (WebCore::GeolocationServiceMock::setError): Added. Sets the error that will be returned by the object.
-        (WebCore::GeolocationServiceMock::startUpdating): Added. GeolocationService implementation. Starts the service.
-        (WebCore::GeolocationServiceMock::stopUpdating): Added. GeolocationService implementation. Stops the service.
-        (WebCore::GeolocationServiceMock::timerFired): Added. Used to provide an asynchronous callback when the service is started.
-        (WebCore::GeolocationServiceMock::makeGeolocationCallbackFromAllInstances): Added. Used to call back when the position or error is updated.
-        (WebCore::GeolocationServiceMock::makeGeolocationCallback): Added. Used to call back when the service starts.
-        (WebCore::GeolocationServiceMock::initStatics): Added. Initializes statics members with constructors.
-        (WebCore::GeolocationServiceMock::cleanUpStatics): Added. Cleans up static members with constructors.
-        * platform/mock/GeolocationServiceMock.h: Added.
-        (WebCore::GeolocationServiceMock::lastPosition): Added. Returns the fixed position.
-        (WebCore::GeolocationServiceMock::lastError): Added. Returns the fixed error.
-        * platform/gtk/GeolocationServiceGtk.cpp: Modified.
-        (WebCore::GeolocationServiceGtk::create): Added. Creates an instance of GeolocationServiceGtk.
-        * platform/gtk/GeolocationServiceGtk.h: Modified.
-        * platform/mac/GeolocationServiceMac.h: Modified.
-        * platform/mac/GeolocationServiceMac.mm: Modified.
-        (WebCore::GeolocationServiceMac::create): Added. Creates an instance of GeolocationServiceMac.
-
-2009-09-07  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28985
-
-        We need to be slightly more careful about how we pick up a script
-        execution context.  In particular, we were getting the wrong document
-        for frames that had been navigated somewhere else.
-
-        In the long term, we should think about a better algorithm for
-        computing the script context.
-
-        Fixes LayoutTests/http/tests/xmlhttprequest/detaching-frame-2.html
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::retrieveFrame):
-
-2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix for 2.8 compilation.
+        Web Inspector: Swap images for activate and deactivate breakpoints.
 
-        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
-        (wxRenderer_DrawScrollbar):
+        https://bugs.webkit.org/show_bug.cgi?id=35383
 
-2009-09-07  Drew Wilson  <atwilson@google.com>
-
-        Unreviewed build fix.
-
-        Reverting r48121 to fix Windows build errors.
-
-        * DerivedSources.cpp:
-        * GNUmakefile.am:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        * dom/EventTarget.cpp:
-        * dom/EventTarget.h:
-        * page/DOMWindow.idl:
-        * websockets/WebSocket.cpp:
-        (WebCore::WebSocket::connect):
-        (WebCore::WebSocket::send):
-        (WebCore::WebSocket::close):
-        (WebCore::WebSocket::bufferedAmount):
-        (WebCore::WebSocket::addEventListener):
-        (WebCore::WebSocket::removeEventListener):
-        (WebCore::WebSocket::dispatchEvent):
-        (WebCore::WebSocket::didConnect):
-        (WebCore::WebSocket::didReceiveMessage):
-        (WebCore::WebSocket::didClose):
-        (WebCore::WebSocket::dispatchOpenEvent):
-        (WebCore::WebSocket::dispatchMessageEvent):
-        (WebCore::WebSocket::dispatchCloseEvent):
-        * websockets/WebSocket.h:
-        (WebCore::WebSocket::create):
-        (WebCore::WebSocket::):
-        (WebCore::WebSocket::setOnopen):
-        (WebCore::WebSocket::onopen):
-        (WebCore::WebSocket::setOnmessage):
-        (WebCore::WebSocket::onmessage):
-        (WebCore::WebSocket::setOnclose):
-        (WebCore::WebSocket::onclose):
-        (WebCore::WebSocket::toWebSocket):
-        (WebCore::WebSocket::refEventTarget):
-        (WebCore::WebSocket::derefEventTarget):
-        * websockets/WebSocketChannel.cpp: Removed.
-        * websockets/WebSocketChannel.h: Removed.
-        * websockets/WebSocketChannelClient.h: Removed.
-        * websockets/WebSocketHandshake.cpp: Removed.
-        * websockets/WebSocketHandshake.h: Removed.
-
-2009-09-07  Drew Wilson  <atwilson@google.com>
-
-        Unreviewed speculative build fix.
-
-        Reverted previous build fix as it didn't fix the problem.
-
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toEventTarget):
-
-2009-09-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Unreviewed, build fix.
-
-        [Qt] Fix build after SHARED_WORKERS are enabled by default (r48131)
-
-        * WebCore.pro:
-
-2009-09-07  Drew Wilson  <atwilson@google.com>
-
-        Unreviewed build fix.
-
-        Temporarily removed depenency between JSEventTarget.cpp and WebSocket.h in an attempt to fix a windows build break.
-
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toEventTarget):
-
-2009-09-07  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Enable SHARED_WORKERS by default.
-        https://bugs.webkit.org/show_bug.cgi?id=28959
-
-        Tests (enabled in a separate patch):
-               fast/workers/shared-worker-constructor.html
-               fast/workers/shared-worker-context-gc.html
-               fast/workers/shared-worker-event-listener.html
-               fast/workers/shared-worker-exception.html
-               fast/workers/shared-worker-frame-lifecycle.html
-               fast/workers/shared-worker-gc.html
-               fast/workers/shared-worker-lifecycle.html
-               fast/workers/shared-worker-load-error.html
-               fast/workers/shared-worker-location.html
-               fast/workers/shared-worker-navigator.html
-               fast/workers/shared-worker-replace-global-constructor.html
-               fast/workers/shared-worker-replace-self.html
-               fast/workers/shared-worker-shared.html
-               fast/workers/shared-worker-simple.html
-               http/tests/workers/shared-worker-importScripts.html
-               http/tests/workers/shared-worker-redirect.html
-               http/tests/xmlhttprequest/workers/shared-worker-close.html
-               http/tests/xmlhttprequest/workers/shared-worker-methods-async.html
-               http/tests/xmlhttprequest/workers/shared-worker-methods.html
-               http/tests/xmlhttprequest/workers/shared-worker-xhr-file-not-found.html
-
-        * config.h: Removed some whitespace/touched the file to force a full rebuild on the build-bots.
-        * Configurations/FeatureDefines.xcconfig:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/build-generated-files.sh:
-        * dom/DOMWindow.idl: Removed unnecessary whitespace to force a rebuild on the build-bots to pickup the flag change.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerScriptLoader::load):
-        Clean up bitrot in SharedWorker code - DenyCrossOriginRedirect is now DenyCrossOriginRequests.
-        * workers/SharedWorkerContext.cpp:
-        (WebCore::SharedWorkerContext::dispatchConnect):
-        Clean up bitrot - updated SharedWorker code to reflect new MessageEvent API.
-
-2009-09-07  Xan Lopez  <xlopez@igalia.com>
-
-        Unreviewed build fix.
-
-        Add new file to sources list.
-
-        * GNUmakefile.am:
-
-2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes for wx SVN trunk. 
-
-        * config.h:
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::RenderThemeWx::paintButton):
-        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
-        (WebCore::drawTextWithSpacing):
-        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
-        (wxRenderer_DrawScrollbar):
-
-2009-09-07  Chris Hills <chaz@chaz6.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Use direct includes for Phonon, not the pretty ones
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-
-2009-09-07  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        WebSocket API implementation.
-        https://bugs.webkit.org/show_bug.cgi?id=28038
-        
-        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
-        Other build systems will be updated once the code is functional.
-        Tests will be landed once the code is completed and functional.
+        * WebCore.gypi:
+        * inspector/front-end/Images/breakpointsActivateButtonGlyph.png: Renamed from WebCore/inspector/front-end/Images/deactivateBreakpointsButtonGlyph.png.
+        * inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png: Renamed from WebCore/inspector/front-end/Images/deactivateBreakpointsDisabledButtonGlyph.png.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
 
-        * DerivedSources.cpp:
-        * GNUmakefile.am:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::webSocket):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toWebSocket):
-        * dom/EventTarget.h:
-        * page/DOMWindow.idl:
-        * websockets/WebSocket.cpp:
-        (WebCore::ProcessWebSocketEventTask::create):
-        (WebCore::ProcessWebSocketEventTask::performTask):
-        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
-        (WebCore::isValidProtocolString):
-        (WebCore::WebSocket::connect):
-        (WebCore::WebSocket::send):
-        (WebCore::WebSocket::close):
-        (WebCore::WebSocket::bufferedAmount):
-        (WebCore::WebSocket::addEventListener):
-        (WebCore::WebSocket::removeEventListener):
-        (WebCore::WebSocket::dispatchEvent):
-        (WebCore::WebSocket::didConnect):
-        (WebCore::WebSocket::didReceiveMessage):
-        (WebCore::WebSocket::didClose):
-        (WebCore::WebSocket::dispatchOpenEvent):
-        (WebCore::WebSocket::dispatchMessageEvent):
-        (WebCore::WebSocket::dispatchCloseEvent):
-        * websockets/WebSocket.h:
-        (WebCore::WebSocket::create):
-        (WebCore::WebSocket::):
-        (WebCore::WebSocket::setOnopen):
-        (WebCore::WebSocket::onopen):
-        (WebCore::WebSocket::setOnmessage):
-        (WebCore::WebSocket::onmessage):
-        (WebCore::WebSocket::setOnclose):
-        (WebCore::WebSocket::onclose):
-        (WebCore::WebSocket::toWebSocket):
-        (WebCore::WebSocket::eventListeners):
-        (WebCore::WebSocket::refEventTarget):
-        (WebCore::WebSocket::derefEventTarget):
-        * websockets/WebSocketChannel.cpp: Added.
-        * websockets/WebSocketChannel.h: Added.
-        * websockets/WebSocketChannelClient.h: Added.
-        * websockets/WebSocketHandshake.cpp: Added.
-        * websockets/WebSocketHandshake.h: Added.
-
-2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+2010-02-25  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
         Reviewed by Xan Lopez.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26854
-        [GTK] Needs API to allow more control over outgoing requests
-
-        Add infrastructure required to provide the new
-        WebKitNetworkResponse object in our API.
-
-        * GNUmakefile.am: Add new files to the build.
-        * platform/network/soup/ResourceRequestSoup.cpp:
-        (WebCore::ResourceRequest::updateFromSoupMessage):
-        * platform/network/soup/ResourceResponse.h:
-        * platform/network/soup/ResourceResponseSoup.cpp: Added.
-        (WebCore::ResourceResponse::toSoupMessage):
-
-2009-09-07  Mads Ager  <ager@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Cleanup document/frame null-checking in V8DOMWindowCustom.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=29009
-
-        Be consistent in document and frame null checks.
-
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::V8Custom::ClearTimeoutImpl):
-
-2009-09-07  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [Soup] Limit the number of connections
-        https://bugs.webkit.org/show_bug.cgi?id=18431
-
-        Increase the maximum number of per host and total connections to
-        similar values than those used by the other modern browsers. Seems
-        to significantly improve page loading time in many cases.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ensureSessionIsInitialized):
-
-2009-09-07  Michael Nordman  <michaeln@google.com>
-
-        Reviewed by Darin Fisher.
-
-        Various minor chromium appcache modifications.
-        https://bugs.webkit.org/show_bug.cgi?id=28960
-
-        No new tests.
-
-        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
-          Fix a null pointer exception.
-        (WebCore::ACCESSOR_GETTER):
-        * platform/network/chromium/ResourceRequest.h:
-          Switch from appCache 'context' to 'host' terminology.
-          Note: leaving the old deprecated accessors in place until the matching
-          change in chrome is landed to use the new accessors.
-        (WebCore::ResourceRequest::ResourceRequest):
-        (WebCore::ResourceRequest::appCacheHostID):
-        (WebCore::ResourceRequest::setAppCacheHostID):
-        (WebCore::ResourceRequest::appCacheContextID):
-        (WebCore::ResourceRequest::setAppCacheContextID):
-        * platform/network/chromium/ResourceResponse.h:
-          Add an appCacheManifestURL getter/setter.
-          Drop the 'get' prefix from the appCacheID getter.
-          Note: leaving the old deprecated 'get' prefixed accessor in place until the matching
-          change in chrome is landed to use the new accessor.
-        (WebCore::ResourceResponse::appCacheID):
-        (WebCore::ResourceResponse::appCacheManifestURL):
-        (WebCore::ResourceResponse::setAppCacheManifestURL):
-        (WebCore::ResourceResponse::getAppCacheID):
-
-2009-09-07  Michael Nordman  <michaeln@google.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28359
-        Cleanup: Undo some accidental changes around DOMApplicationCache.
-        - Restore support for constructing a DOMApplicationCache object with a null frame ptr.
-        - Return a non-null object for window.applicationCache when the feature is disabled.
-        - Simplify the swapCache method.
+        Go back on symlink resolution if we are loading the flash plugin,
+        and the path contains /netscape/, following what Chromium does.
 
-        Test: http/tests/appcache/disabled.html
+        Thanks to Evan Martin for the help on this!
 
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::DOMApplicationCache):
-        (WebCore::DOMApplicationCache::swapCache):
-        (WebCore::DOMApplicationCache::scriptExecutionContext):
-        * loader/appcache/DOMApplicationCache.h:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::applicationCache):
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::load):
 
-2009-09-06  Yael Aharon  <yael.aharon@nokia.com>
+2010-02-25  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Timothy Hatcher.
 
-        hostname and host are mixed up when manipulating anchor elements.
-        https://bugs.webkit.org/show_bug.cgi?id=28954
+        Web Inspector: Scripts panel shows blank source when stopping on a breakpoint on refresh.
 
-        handle the case of port 0.
+        https://bugs.webkit.org/show_bug.cgi?id=35232
 
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::host):
-
-2009-09-06  Erik Arvidsson  <arv@chromium.org>
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.canShowSourceLine):
+        (WebInspector.Panel.prototype.showSourceLine):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.canShowSourceLine):
+        (WebInspector.ResourcesPanel.prototype.showSourceLine):
+        * inspector/front-end/Script.js:
+        (WebInspector.Script):
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype.get searchableViews):
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        (WebInspector.ScriptsPanel.prototype._resourceLoadingFinished):
+        (WebInspector.ScriptsPanel.prototype.addBreakpoint):
+        (WebInspector.ScriptsPanel.prototype.removeBreakpoint):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype.canShowSourceLine):
+        (WebInspector.ScriptsPanel.prototype.showSourceLine):
+        (WebInspector.ScriptsPanel.prototype._scriptOrResourceForURLAndLine):
+        (WebInspector.ScriptsPanel.prototype.showView):
+        (WebInspector.ScriptsPanel.prototype._sourceFrameForScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu.optionCompare):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._addBreakpoint):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector._choosePanelToShowSourceLine):
+        (WebInspector.canShowSourceLine):
+        (WebInspector.showSourceLine):
 
-        Reviewed by Eric Seidel.
+2010-02-25  Ben Murdoch  <benm@google.com>
 
-        Make hidden elements not focusable.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Clean up supportsFocus and isFocusable.
-        supportsFocus now strictly means that the node can be focused by default.
-        This is true for links, form controls and content editable elements for example.
-        isFocusable means that the user can actually focus it.
-        All (2) calls to supportsFocus have been updated to take this into account.
-        
-        Make a elements without href work correctly as well.
+        The target element of a Touch should be the target where that touch originated, not where it is now.
+        https://bugs.webkit.org/show_bug.cgi?id=34585
 
-        https://bugs.webkit.org/show_bug.cgi?id=27099
+        Currently the target of a touch is set to the resulting node of the hit test where the touch currently
+        is. This does not match the behavior of iPhone or Android. This patch uses a hashmap on the EventHandler
+        to keep track of the target element when a touch is first started. This target is then used as the target
+        for subsequent touches with the same id. This matches observed behavior on iPhone and Android.
 
-        Tests: fast/events/click-focus-anchor.html
-               fast/events/tab-focus-anchor.html
-               fast/events/tab-focus-hidden.html
+        Tests:
+        fast/events/touch/touch-target.html: Added.
+        fast/events/touch/basic-single-touch-events.html: Updated.
 
-        * dom/Element.cpp:
-        (WebCore::Element::focus):
-        * dom/Node.cpp:
-        (WebCore::Node::supportsFocus):
-        (WebCore::Node::isFocusable):
-        * dom/Node.h:
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::supportsFocus):
-        (WebCore::HTMLAnchorElement::isMouseFocusable):
-        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
-        * html/HTMLAnchorElement.h:
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::supportsFocus):
-        * html/HTMLAreaElement.h:
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::supportsFocus):
-        * html/HTMLElement.h:
-        * html/HTMLFieldSetElement.cpp:
-        (WebCore::HTMLFieldSetElement::supportsFocus):
-        * html/HTMLFieldSetElement.h:
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::supportsFocus):
-        (WebCore::HTMLFormControlElement::isFocusable):
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::supportsFocus):
-        * html/HTMLFrameElementBase.h:
-        * html/HTMLLegendElement.cpp:
-        (WebCore::HTMLLegendElement::supportsFocus):
-        * html/HTMLLegendElement.h:
-        * html/HTMLOptGroupElement.cpp:
-        (WebCore::HTMLOptGroupElement::supportsFocus):
-        (WebCore::HTMLOptGroupElement::isFocusable):
-        * html/HTMLOptGroupElement.h:
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::supportsFocus):
-        (WebCore::HTMLOptionElement::isFocusable):
-        * html/HTMLOptionElement.h:
         * page/EventHandler.cpp:
-        (WebCore::EventHandler::dispatchMouseEvent):
-        * page/FocusController.cpp:
-        (WebCore::FocusController::advanceFocus):
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::supportsFocus):
-        (WebCore::SVGAElement::isFocusable):
-        * wml/WMLAElement.cpp:
-        (WebCore::WMLAElement::supportsFocus):
-        * wml/WMLAElement.h:
-        * wml/WMLFormControlElement.cpp:
-        (WebCore::WMLFormControlElement::supportsFocus):
-        (WebCore::WMLFormControlElement::isFocusable):
-        * wml/WMLFormControlElement.h:
+        (WebCore::EventHandler::handleTouchEvent): Store the originating target element of a touch in a hashmap
+            so that we can reuse that target for future events caused by that touch. This matches observed behavior
+            on iPhone and Android.
+        * page/EventHandler.h: Add hashmap as a member.
+        * platform/PlatformTouchPoint.h:
+        (WebCore::PlatformTouchPoint::id): Store the touch point id as unsigned.
+        * platform/qt/PlatformTouchPointQt.cpp: 
+        (WebCore::PlatformTouchPoint::PlatformTouchPoint): Cast platform touch id from signed to unsigned. Qt API
+            docs state that it will always be >= 0.
+
+2010-02-24  Antonio Gomes  <tonikitoo@webkit.org>
 
-2009-09-06  Joel Stanley  <joel@jms.id.au>
-
-        Reviewed by Dimitri Glazkov.
-
-        Expose functions to set the caret blink interval for Linux Chromium.
-        Default value is set to that of RenderTheme::caretBlankInterval().
-        Uses caretBlinkIntervalInternal to avoid overriding
-        RenderThemeChromiumSkia::caretBlankInterval to preserve the disabling
-        of blinking caret required for layout tests.
-        https://bugs.webkit.org/show_bug.cgi?id=28931
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
-        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
-        (WebCore::RenderThemeChromiumLinux::caretBlinkIntervalInternal):
-        * rendering/RenderThemeChromiumLinux.h:
-
-2009-09-06  Ada Chan  <adachan@apple.com>
-
-        Remove an extra </File> in WebCore.vcproj.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-09-06  Timothy Hatcher  <timothy@apple.com>
-
-        Adds a persistent setting for color format in the Web Inspector.
+        Reviewed by Simon Fraser.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28889
+        Add a convenient center() method to IntRect
+        https://bugs.webkit.org/show_bug.cgi?id=35346
 
-        Reviewed by Dan Bernstein.
+        As it is a convenience method, and implemention is
+        based on FloatRect's one, patch does not provide a
+        layout test.
 
-        * English.lproj/localizedStrings.js: New strings.
-        * inspector/front-end/Color.js: Minor style fixes.
-        (WebInspector.Color.prototype.toString): Added. Replaces the individual
-        "toFoo" functions. Takes a optional arguments for the color format to return.
-        * inspector/front-end/Images/paneSettingsButtons.png: Added.
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype._changeColorFormat): Update the sections to show
-        the new color format.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay):
-        Use the new toString function on Color.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Use the persistent setting
-        to format colors by default. Add a tooltip for the color swatch.
-        * inspector/front-end/inspector.css: New styles for the settings menu.
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded): Initilize the colorFormat preference.
+        * platform/graphics/IntRect.h:
+        (WebCore::IntRect::center):
 
-2009-09-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-02-25  Andrey Kosyakov  <caseq@chromium.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Pavel Feldman.
 
-        [Qt] Remove Qt v4.6 check from the prefetchDNS implementation
-        https://bugs.webkit.org/show_bug.cgi?id=28993
+        Fake workers implementation that simulates workers using iframe and timer,
+        needed to support workers debugging. Also, a facility to inject scripts into
+        inspected page upon load.
+        https://bugs.webkit.org/show_bug.cgi?id=35148
 
-        * platform/network/qt/DnsPrefetchHelper.cpp:
-        * platform/network/qt/DnsPrefetchHelper.h:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::addScriptToEvaluateOnLoad):
+        (WebCore::InspectorBackend::removeAllScriptsToEvaluateOnLoad):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::addScriptToEvaluateOnLoad):
+        (WebCore::InspectorController::removeAllScriptsToEvaluateOnLoad):
+        * inspector/InspectorController.h:
+        * inspector/front-end/InjectedFakeWorker.js: Added.
+        (InjectedFakeWorker.Worker):
+        (InjectedFakeWorker.FakeWorker):
+        (InjectedFakeWorker.FakeWorker.prototype.postMessage):
+        (InjectedFakeWorker.FakeWorker.prototype.terminate):
+        (InjectedFakeWorker.FakeWorker.prototype._onmessageWrapper):
+        (InjectedFakeWorker.FakeWorker.prototype._dispatchMessage):
+        (InjectedFakeWorker.FakeWorker.prototype._handleException):
+        (InjectedFakeWorker.FakeWorker.prototype._buildWorker):
+        (InjectedFakeWorker.FakeWorker.prototype._setupWorkerContext.handler):
+        (InjectedFakeWorker.FakeWorker.prototype._setupWorkerContext):
+        (InjectedFakeWorker.FakeWorker.prototype._importScripts):
+        (InjectedFakeWorker.FakeWorker.prototype._loadScript):
+        (InjectedFakeWorker.URL):
+        (InjectedFakeWorker.URL.prototype.urlRegEx.split):
+        (InjectedFakeWorker.URL.prototype.mockLocation):
+        (InjectedFakeWorker.URL.prototype.completeWith):
+        (InjectedFakeWorker.URL.prototype.sameOrigin):
+        (InjectedFakeWorker.DOMCoreException.formatError):
+        (InjectedFakeWorker.DOMCoreException):
+        (InjectedFakeWorker.noop):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.setInjectedScriptSource):
+        (.WebInspector.InspectorBackendStub.prototype.addScriptToEvaluateOnLoad):
+        (.WebInspector.InspectorBackendStub.prototype.removeAllScriptsToEvaluateOnLoad):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
 
-2009-09-06  Cameron McCormack  <cam@mcc.id.au>
+2010-02-24  Nicholas Young  <nicholas.young@nokia.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Eric Carlson.
 
-        Drop <definition-src> support
-        https://bugs.webkit.org/show_bug.cgi?id=28991
+        Add mediaPlayerOwningDocument() to MediaPlayerClient.
+        https://bugs.webkit.org/show_bug.cgi?id=35374
 
-        http://dev.w3.org/SVG/profiles/1.1F2/publish/changes.html#FontsChapter
+        No new tests. These are interface changes only.
 
-        * DerivedSources.cpp: Remove references to definition-src.
-        * DerivedSources.make: Ditto.
-        * GNUmakefile.am: Ditto.
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * bindings/objc/DOM.mm:
-        (WebCore::createElementClassMap): Ditto.
-        * bindings/objc/DOMSVG.h: Ditto.
-        * bindings/v8/DerivedSourcesAllInOne.cpp: Ditto.
-        * bindings/v8/V8DOMWrapper.cpp: Ditto.
-        * bindings/v8/V8Index.cpp: Ditto.
-        * bindings/v8/V8Index.h: Ditto.
-        * svg/SVGAllInOne.cpp: Ditto.
-        * svg/SVGDefinitionSrcElement.cpp: Removed.
-        * svg/SVGDefinitionSrcElement.h: Removed.
-        * svg/SVGDefinitionSrcElement.idl: Removed.
-        * svg/SVGFontFaceElement.cpp:
-        (WebCore::SVGFontFaceElement::rebuildFontFace): Don't search for
-        definition-src child.
-        * svg/svgtags.in: Remove definition-src.
-
-2009-09-05  Dimitri Glazkov  <dglazkov@chromium.org>
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerOwningDocument): Implementation for media element.
+        * html/HTMLMediaElement.h:
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerOwningDocument): New virtual method.
 
-        Unreviewed, build fix.
+2010-02-24  Andreas Kling  <andreas.kling@nokia.com>
 
-        [Chromium] Roll out http://trac.webkit.org/changeset/48094, because the
-        logic of retrieving default caret blink interval was incorrect (non-existent)
-        and caused layout test flakiness.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * rendering/RenderThemeChromiumLinux.cpp:
-        * rendering/RenderThemeChromiumLinux.h:
+        Optimized Font::normalizeSpaces() by caching the String::characters()
+        instead of repeatedly calling operator[]
 
-2009-09-05  Jian Li  <jianli@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=35336
 
-        Reviewed by NOBODY (Chromium reliability build break).
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::normalizeSpaces):
 
-        Back up partial change in r48072 in order to fix chromium reliability build break.
+2010-02-24  Jungshik Shin  <jshin@chromium.org>
 
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        Reviewed by David Levin.
 
-2009-09-05  Nicolas Weber  <thakis@chromium.org>
+        [Chromium] Traditional Chinese Chrome on Windows should use PMingLiu instead of Simsun for Han characters
+        https://bugs.webkit.org/show_bug.cgi?id=35319
 
-        Reviewed by Darin Fisher.
+        No visible change in the layout test.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28975
-        Fix file upload on chrome/mac. Images that have "Hide Extension" set,
-        such as screenshots by default, can now be uploaded to sites such as
-        imgur.com.
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::):
 
-        * platform/FileSystem.h:
-        Add pathGetDisplayFileName().
-        * platform/chromium/FileChooserChromium.cpp:
-        (WebCore::FileChooser::basenameForWidth):
-        Call pathGetDisplayFileName() instead of pathGetFileName().
-        * platform/chromium/FileSystemChromiumLinux.cpp:
-        (WebCore::pathGetDisplayFileName):
-        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
-        * platform/chromium/FileSystemChromiumMac.mm:
-        (WebCore::pathGetFileName):
-        Now returns a real filename instead of a presentational one, which
-        fixes the problem addressed by this change.
-        (WebCore::pathGetDisplayFileName):
-        New function that returns a presentational filename; does what
-        pathGetDisplayFileName() did prior to this patch.
-        * platform/chromium/FileSystemChromiumWin.cpp:
-        (WebCore::pathGetDisplayFileName):
-        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
-
-2009-09-05  Joel Stanley  <joel@jms.id.au>
+2010-02-24  Anthony Ricaud  <rik@webkit.org>
 
-        Reviewed by David Levin.
+        Reviewed by Pavel Feldman.
 
-        Expose functions to set the caret blink interval for Linux Chromium.
-        https://bugs.webkit.org/show_bug.cgi?id=28931
+        Web Inspector: Reduce the timer to show the eval popover
+        https://bugs.webkit.org/show_bug.cgi?id=35344
 
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
-        (WebCore::RenderThemeChromiumLinux::caretBlinkInterval):
-        * rendering/RenderThemeChromiumLinux.h:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._mouseMove):
 
-2009-09-04  Dmitry Titov  <dimich@chromium.org>
+2010-02-24  Jay Campan  <jcampan@google.com>
 
         Reviewed by David Levin.
 
-        Prevent UI freeze in case when too many timers are in the timer queue.
-        https://bugs.webkit.org/show_bug.cgi?id=23865
-
-        The fix measures the elapsed time while executing timers. If we have too many
-        timers and it takes significant time to fire, quit the loop and reschedule.
-        This lets the run loop process user input (close the window for example).
-
-        * platform/ThreadTimers.h:
-        * platform/ThreadTimers.cpp:
-        (WebCore::ThreadTimers::sharedTimerFiredInternal):
-        (WebCore::ThreadTimers::fireTimersInNestedEventLoop):
-        Removed functions and members used before to grab a list of all expired timers.
-        Now we fetch one by one, measuring time and quitting the loop if it takes too long.
-        * platform/Timer.cpp:
-        (WebCore::TimerBase::isActive):
-        (WebCore::TimerBase::setNextFireTime):
-        Since timers are now fired one by one, there is no need to keep track of updated timers.
-        * manual-tests/input-starved-by-timers.html: Manual test that attempts to freeze browser by
-        creating of enough timers. It then keeps UI frozen and after 10 seconds starts to drain the timers
-        so the browser un-freezes. This is instead of a regular layout test because we don't have a way
-        to inject an input events via regular run loop in DRT - instead they are directly dispatched by
-        eventSender, which does not reproduce the UI freeze that happens with real input.
-
-2009-09-04  Anders Carlsson  <andersca@apple.com>
+        Don't show the autofill popup when the input text is disabled or read only.
 
-        Reviewed by Adele Peterson.
-
-        <rdar://problem/7201063>
-        
-        Detach any custom scrollbars before detaching the document.
-        
-        * page/Frame.cpp:
-        (WebCore::Frame::setView):
+        Test: manual-tests/chromium/no-autofill-on-readonly.html
 
-2009-09-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35129
 
-                Unreviewed, build fix.
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::autofill):
+        *  manual-tests/chromium/no-autofill-on-readonly.html: Added.
 
-                Remove remaining references to UserStyleSheetLoader after r48075.
+2010-02-24  Dominic Mazzoni  <dmazzoni@chromium.org>
 
-                * WebCore.gypi:
-                * WebCore.xcodeproj/project.pbxproj:
-                * page/qt/FrameQt.cpp:
-                * page/wince/FrameWince.cpp:
+        Reviewed by Jeremy Orlow.
 
-2009-09-04  Michelangelo De Simone  <micdesim@gmail.com>
+        Wraps includes of SVG headers so that it's possible to
+        compile the V8 bindings with SVG disabled, e.g. 'enable_svg=0'.
+        https://bugs.webkit.org/show_bug.cgi?id=35345
 
-                Reviewed by David Levin.
+        No new tests.
 
-                https://bugs.webkit.org/show_bug.cgi?id=28988
-                Minor fix: "novalidate" attribute renamed in "noValidate", according to
-                HTML5 specs:
-                http://www.whatwg.org/specs/web-apps/current-work/#dom-fs-novalidate
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/custom/V8CSSValueCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8SVGElementCustom.cpp:
 
-                * html/HTMLFormElement.cpp:
-                (WebCore::HTMLFormElement::noValidate):
-                (WebCore::HTMLFormElement::setNoValidate):
-                * html/HTMLFormElement.h:
-                * html/HTMLFormElement.idl:
+2010-02-24  Maciej Stachowiak  <mjs@apple.com>
 
-2009-09-04  Dmitry Titov  <dimich@chromium.org>
+        Unreviewed build fix.
 
-        Reviewed by David Levin.
+        Fix gtk build.
 
-        Remove unused line of code from WorkerContext
-        https://bugs.webkit.org/show_bug.cgi?id=28990
+        Include JSC headers as runtime/ instead of JavaScriptCore/
 
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::importScripts):
+        * bindings/js/JSDOMWrapper.h:
+        * bindings/js/ScriptWrappable.h:
 
-2009-09-04  Darin Adler  <darin@apple.com>
+2010-02-24  Maciej Stachowiak  <mjs@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Fix assertion seen when running buildbot.
+        Cache JavaScript wrappers inline in DOM nodes
+        https://bugs.webkit.org/show_bug.cgi?id=35226
 
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::createStructure): Create the structure without
-        the HasDefaultMark bit since this has a custom mark function.
-
-2009-09-04  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28984, remove the remote stylesheet loader on Mac/Qt.
-        Make sure the other code path (now used by everybody) can handle data URLs.
+        <rdar://problem/7664202>
+        
+        7.4% speedup on Dromaeo DOM Core tests.
+        2.3% speedup on Hixie DOM Core tests.
 
-        As per the post on webkit-dev, the ability to work remotely isn't working properly anyway (it doesn't
-        hold up the pending sheet count, so you'd just FOUC on every Web page), and it's extremely unlikely
-        that anybody is relying on this support.
+        This fixes the following things from the last attempt:
+        - Now builds in both debug and release and passes all tests
+        - Properly use a WeakGCPtr, not just a raw pointer, in ScriptWrappable
+        - Properly look in the appropriate per-document or per-world map
+        - Added an assert that would have caught any of the problems I found
+        - Handle clearing the inline cache properly in all cases
         
-        Tor Arne agreed it was ok to disable (he enabled it on the Qt side), and only Mac/Qt were using this
-        code.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::cacheDOMObjectWrapper): Adjust for name changes.
+        (WebCore::forgetDOMNode): Clear wrapper pointer.
+        (WebCore::cacheDOMNodeWrapper): Cache inline too if caching for normal world.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::Document::getWrapperCache): Inlined.
+        (WebCore::domObjectWrapperMapFor): Renamed to start with lowercase. Moved to header to inline.
+        * bindings/js/JSDOMWrapper.h: Added.
+        (WebCore::DOMObject::DOMObject): Factored this out of JSDOMBinding.h to avoid include
+        cycle. I think the class should be renamed, I picked a forward-looking header name because
+        we already have a DOMObject.h
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline): Renamed version of original createWrapper.
+        (WebCore::createWrapper): Call createWrapperInline. Out-of-line version.
+        (WebCore::toJSNewlyCreated): Call createWrapperInline instead of createWrapper.
+        * bindings/js/JSNodeCustom.h: Added.
+        (WebCore::getCachedDOMNodeWrapper): Moved from JSDOMBinding.cpp and moved here,
+        so it could inline everywhere without creating an include cycle. Consider inline
+        cache.
+        (WebCore::toJS): Moved to header to inline.
+        * bindings/js/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::ScriptWrappable): Implement this in the obvious
+        way for JavaScriptCore. (Using a WeakGCPtr).
+        (WebCore::ScriptWrappable::wrapper):
+        (WebCore::ScriptWrappable::setWrapper):
+        (WebCore::ScriptWrappable::clearWrapper):
+        * bindings/scripts/CodeGeneratorJS.pm: Include CustomHeader heaaders
+        in the header, not just the impl file, so they can add inlining.
+        * dom/Node.idl: Add CustomHeader directive.
+        
+        Add new files to build.
 
+        * GNUmakefile.am:
+        * WebCore.gypi:
         * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * dom/Document.cpp:
-        (WebCore::Document::userStyleSheet):
-        * dom/Document.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-        * loader/UserStyleSheetLoader.cpp: Removed.
-        * loader/UserStyleSheetLoader.h: Removed.
-        * page/Frame.cpp:
-        (WebCore::Frame::reapplyStyles):
-        * page/Frame.h:
-        * page/Page.cpp:
-        (WebCore::Page::userStyleSheetLocationChanged):
-        (WebCore::Page::userStyleSheet):
-        * page/mac/FrameMac.mm:
-        * page/qt/FrameQt.cpp:
-
-2009-09-04  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Add "sampling profiler" preference, simplify data display when it's set.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28969
-
-        * inspector/front-end/ProfileDataGridTree.js:
-        (WebInspector.ProfileDataGridNode.prototype.get data.formatMilliseconds):
-        (WebInspector.ProfileDataGridNode.prototype.get data):
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView):
-        * inspector/front-end/inspector.js:
-
-2009-09-04  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Run-time exception in onmessage handler is not forwarded to the worker object.
-        https://bugs.webkit.org/show_bug.cgi?id=28980
-
-        Tested by worker-close.html.
-
-        * bindings/v8/ScriptFunctionCall.cpp:
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::getScriptExecutionContext):
-        (WebCore::reportException):
-        * bindings/v8/V8Utilities.h:
-        (WebCore::getScriptExecutionContext):
-        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-09-04  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Remove unused m_sheet variable and setCSSStyleSheet methods.
-
-        * dom/Document.cpp:
-        * dom/Document.h:
-
-2009-09-04  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by David Hyatt and Adele Peterson.
-
-        (Based on a patch from Adele).
-        
-        Fix <rdar://problem/7185875>.
-        
-        * page/Frame.cpp:
-        (WebCore::Frame::setView):
-        Detach any custom scroll bars from the old view.
-        
-        * page/FrameView.cpp:
-        (WebCore::FrameView::detachCustomScrollbars):
-        Simplify the check (and make it work when body is null) by just checking that the scroll bar owner is
-        not a RenderPart object.
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::destroy):
-        ASSERT that frame() is not null here and also add a null check so that release builds won't crash.
-
-2009-09-04  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Make m_userStyleSheetLoader in Frame an OwnPtr.
-
-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-        (WebCore::Frame::~Frame):
-        * page/Frame.h:
-        * page/mac/FrameMac.mm:
-        (WebCore::Frame::setUserStyleSheetLocation):
-        (WebCore::Frame::setUserStyleSheet):
-
-2009-09-04  Timothy Hatcher  <timothy@apple.com>
-
-        Show color swatches in the Web Inspector before the color text so clicking them will not
-        shift the swatch. Also makes multiple swatches in the single property toggle the color format.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28978
-
-        Reviewed by Darin Adler.
-
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle): Some refactoring to consolidate
-        the processing we do on the property value. This eliminated the old nickname code, since the new
-        WebInspector.Color class handles this. We could also simplify the color regex since more
-        is handled by the Color class. Also no longer uses innerHTML for the linkify code.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processValue): Helper function to
-        process a value given a regex and processor functions. 
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.linkifyURL): Make an anchor for the
-        URL with "url()" syntax surrounding it.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Makes a color, if
-        there was an exception just return a text node.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay.changeTo):
-        Moved from later in the file.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay): Ditto.
-        * inspector/front-end/inspector.css:
-
-2009-09-04  Mark Mentovai  <mark@chromium.org>
 
-        Reviewed by Dave Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28614
 
-        Account for scrollbar state changes that occur during layout.
+2010-02-24  Jochen Eisinger  <jochen@chromium.org>
 
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::updateScrollbars):
+        Reviewed by Jeremy Orlow.
 
-        Perform a layout prior to checking whether the scrollbar modes are
-        off, on, or automatic.  The modes may change during layout.
+        Expose Database object of currently active task on the database thread
+        https://bugs.webkit.org/show_bug.cgi?id=35341
 
-        * WebCore.base.exp:
-        * WebCore.order:
-        * page/Frame.cpp:
-        (WebCore::Frame::createView):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView):
-        (WebCore::FrameView::resetScrollbars):
-        (WebCore::FrameView::layout):
-        * page/FrameView.h:
-        * platform/ScrollView.h:
-
-        Eliminate duplicated (and incorrect) scrollbar mode tracking between
-        FrameView and ScrollView.
-
-2009-09-04  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        hostname and host are mixed up when manipulating anchor elements.
-        https://bugs.webkit.org/show_bug.cgi?id=28954
-
-        Swapped the implementation of host and hostname, and made sure not to return
-        the port number if it is default for the given protocol. 
-        FireFox also avoids returning the protocol number if it is default.
-
-        Test: fast/dom/Element/hostname-host.html
-
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::host):
-        (WebCore::HTMLAnchorElement::hostname):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::isDefaultPortForProtocol):
-        * page/SecurityOrigin.h:
-
-2009-09-04  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Darin Adler and Steve Falkenburg.
-
-        Fix <rdar://problem/7192902>.
-
-        Add the necessary plumbing for having QTMovieWin use WebCore timers.
-        
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::TaskTimer::initialize):
-        Create the timer and call QTMovieWin::setTaskTimerFuncs.
-        
-        (WebCore::TaskTimer::setTaskTimerDelay):
-        Start the timer.
-        
-        (WebCore::TaskTimer::stopTaskTimer):
-        Stop the timer.
-        
-        (WebCore::TaskTimer::fired):
-        Call QTMovieWin::taskTimerFired().
-        
-        (WebCore::MediaPlayerPrivate::load):
-        Initialize the Task timer.
-        
-        * platform/graphics/win/QTMovieWin.cpp:
-        (updateTaskTimer):
-        Call the global stopTaskTimer function and setTaskTimerDelay.
-        
-        (QTMovieWin::taskTimerFired):
-        Make this a member function.
-        
-        (QTMovieWin::setTaskTimerFuncs):
-        Set the global function pointers.
-        
-        (QTMovieWin::initializeQuickTime):
-        (DllMain):
-        No need to use the QT shared timer.
-        * platform/graphics/win/QTMovieWin.h:
-
-2009-09-04  Tony Chang  <tony@chromium.org>
-
-        Reviewed by David Levin.
-
-        Fix Chromium Win compile.  Missing return statement in
-        WebCore::RenderThemeChromiumSkia::paintSliderThumb.
-        https://bugs.webkit.org/show_bug.cgi?id=28974
-
-        No new tests, build fix.
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::getDatabaseOfCurrentTask):
 
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
+2010-02-24  Nicholas Young  <nicholas.young@nokia.com>
 
-2009-09-04  Dimitri Glazkov  <dglazkov@chromium.org>
+        Reviewed by Eric Carlson.
 
-        Unreviewed, build fix.
+        supportsMuting() should be an internal interface between MediaPlayer and MediaPlayerPrivate.
+        https://bugs.webkit.org/show_bug.cgi?id=35327
 
-        [Chromium] Rolling out http://trac.webkit.org/changeset/48035, because it broke
-        the build.
-        https://bugs.webkit.org/show_bug.cgi?id=28696
+        No new tests. Refactoring Only.
 
-2009-09-04  Anders Carlsson  <andersca@apple.com>
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setMuted): Do not check supportsMuting()
+        (WebCore::HTMLMediaElement::updateVolume): Set volume and muted
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::setVolume): Check supportsMuting()
+        (WebCore::MediaPlayer::setMuted): Check supportsMuting()
+        * platform/graphics/MediaPlayer.h: Remove supportsMuting()
 
-        Fix vcproj file.
+2010-02-24  Adam Barth  <abarth@webkit.org>
 
-        * WebCore.vcproj/WebCore.vcproj:
+        Reviewed by Darin Fisher.
 
-2009-09-03  Dave Hyatt  <hyatt@apple.com>
+        [Chromium API] Disambiguate allowJavaScript from didNotAllowScript
+        https://bugs.webkit.org/show_bug.cgi?id=35205
 
-        Reviewed by Adam Roben.
+        For clients that want to show a user interface element when JavaScript
+        was blocked on a page, we need to disambiguate between querying the
+        client for whether JavaScript is enabled from actually failing to
+        execute some script.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28890, make simple user script injection work.
-        
-        This patch adds new API for adding and removing user scripts from page groups.  User scripts
-        are bundled together in isolated worlds (you can have multiple scripts together in the same
-        world).
+        This patch adds a new FrameLoaderClient callback for when WebCore would
+        like to execute JavaScript but fails to because JavaScript is disabled.
 
-        Added userscripts/ directory for holding new tests (along with a simple test of script injection).
+        This patch also touches every client of canExecuteScripts so they can
+        indicate whether we should make this callback.  I was hoping there was
+        a better choke point, but my first two attempts were wrong in subtle
+        ways.  pkasting points out that this will be easy to screw up in the
+        future, so it's better to make all the clients be explicit.
 
-        * WebCore.base.exp:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
+        * WebCore.PluginHostProcess.exp:
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::canExecuteScripts):
+        (WebCore::ScriptController::executeScript):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
         * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        (WebCore::ScriptController::executeScriptInWorld):
         * bindings/js/ScriptController.h:
+        (WebCore::):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setJavaScriptPaused):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
         * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
         * bindings/v8/ScriptController.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::finishedParsing):
-        (WebCore::FrameLoader::dispatchDocumentElementAvailable):
-        * page/Frame.cpp:
-        (WebCore::Frame::injectUserScripts):
-        (WebCore::Frame::injectUserScriptsForWorld):
-        * page/Frame.h:
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::~PageGroup):
-        (WebCore::PageGroup::addUserScript):
-        (WebCore::PageGroup::removeUserContentForWorld):
-        (WebCore::PageGroup::removeAllUserContent):
-        * page/PageGroup.h:
-        (WebCore::PageGroup::userScripts):
-        * page/UserScript.h: Added.
-        (WebCore::UserScript::UserScript):
-        (WebCore::UserScript::source):
-        (WebCore::UserScript::url):
-        (WebCore::UserScript::patterns):
-        (WebCore::UserScript::worldID):
-        (WebCore::UserScript::injectionTime):
-        * page/UserScriptTypes.h: Added.
-        (WebCore::):
-
-2009-09-04  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26402
-        Crashes when using a detached DocumentType node
-
-        Test: fast/dom/DOMImplementation/detached-doctype.html
-
-        DocumentType nodes are the only one that can have null document(), and they can never have
-        children, so they are a degenerate case for NodeLists.
-
-        * dom/Node.cpp:
-        (WebCore::Node::childNodes): Don't try register node list with document if there's no
-        document. Since there are no changes possible for a DocumentType's node list, this is not
-        necessary.
-        (WebCore::Node::registerDynamicNodeList): Ditto.
-        (WebCore::Node::unregisterDynamicNodeList): Ditto. I couldn't find a scenario where this
-        was invoked for a DocumentType node, but I also couldn't prove that it can't be (the
-        de-registration code path that I saw taken was via Node destructor, and that already has
-        a null check for document).
-
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener): Bail out if there is no document (just as we already do
-        if there is no window).
-        (WebCore::JSNode::removeEventListener): Ditto.
-
-2009-09-04  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] loadFinished never emitted
-        https://bugs.webkit.org/show_bug.cgi?id=28935
-
-        Do not report errors right away from
-        ResourceHandle::start. Instead return true and schedule an error
-        to be reported in the handle later. Otherwise WebCore gets
-        confused and thinks the resource never finished loading, making it
-        not emit the finished status.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::startHttp):
         (WebCore::):
-
-2009-09-04  Ben Murdoch  <benm@google.com>
-
-        Reviewed by Eric Seidel.
-
-        [V8] DOM Storage bindings: Event Handler should create StorageEvents
-        https://bugs.webkit.org/show_bug.cgi?id=28942
-        
-        Tests:
-        Causes the following tests that were failing with V8 to pass:
-        * storage/domstorage/localstorage/onstorage-attribute-setwindow.html
-        * storage/domstorage/localstorage/complex-keys.html
-        * storage/domstorage/localstorage/onstorage-attribute-markup.html
-        * storage/domstorage/localstorage/simple-events.html
-        * storage/domstorage/localstorage/onstorage-attribute-set-attribute.html
-        * storage/domstorage/localstorage/index-get-and-set.html
-        * storage/domstorage/sessionstorage/onstorage-attribute-setwindow.html
-        * storage/domstorage/sessionstorage/onstorage-attribute-markup.html
-        * storage/domstorage/sessionstorage/simple-events.html
-        * storage/domstorage/sessionstorage/onstorage-attribute-set-attribute.html
-        * storage/domstorage/sessionstorage/index-get-and-set.html
-
-        Code changes:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertEventToV8Object):  Create StorageEvents.
-        * bindings/v8/custom/V8StorageCustom.cpp:
-        (WebCore::storageGetter): Check if we are retrieving the length property and return the number of items in the object rather than a property named length when invoking the getItem() member of local/sessionStorage.
-
-2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28911
-
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::dispatchOnInjectedScript):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.doEvalInWindow):
-        (WebInspector.ConsoleView.prototype._formatarray):
-        (WebInspector.ConsoleView.prototype._formatnode):
-        * inspector/front-end/DOMAgent.js:
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
-        (WebInspector.ElementsPanel.prototype.searchCanceled):
-        (WebInspector.ElementsPanel.prototype.performSearch):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.dispatch):
-        * inspector/front-end/InjectedScriptAccess.js: Added.
-        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
-        (InjectedScriptAccess._installHandler):
-        * inspector/front-end/MetricsSidebarPane.js:
-        (WebInspector.MetricsSidebarPane.prototype.update):
-        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertiesSection.prototype.update):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
-        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
-        * inspector/front-end/PropertiesSidebarPane.js:
-        (WebInspector.PropertiesSidebarPane.prototype.update):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype.update):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
-        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
-        (WebInspector.StylePropertyTreeElement.prototype):
-        * inspector/front-end/inspector.html:
-
-2009-09-04  Tony Chang  <tony@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Implement <input type="range"> for Chromium Linux by painting
-        the slider and the thumb using skia.
-        https://bugs.webkit.org/show_bug.cgi?id=28928
-
-        Covered by existing tests (we're currently hitting an assert for them).
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::adjustSliderThumbSize):
-        * rendering/RenderThemeChromiumLinux.h:
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::drawVertLine):
-        (WebCore::drawHorizLine):
-        (WebCore::drawBox):
-        (WebCore::RenderThemeChromiumSkia::paintSliderTrack):
-        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
-        * rendering/RenderThemeChromiumSkia.h:
-
-2009-09-04  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        - Implement <input type=color> as a text field.
-        - ValidityState::typeMismatch supports for type=color.
-        https://bugs.webkit.org/show_bug.cgi?id=28966
-
-        Tests: fast/forms/ValidityState-patternMismatch-unsupported.html
-               fast/forms/ValidityState-typeMismatch-color.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::valueMissing):
-        (WebCore::HTMLInputElement::patternMismatch):
-        (WebCore::HTMLInputElement::setInputType):
-        (WebCore::HTMLInputElement::formControlType):
-        (WebCore::HTMLInputElement::saveFormControlState):
-        (WebCore::HTMLInputElement::restoreFormControlState):
-        (WebCore::HTMLInputElement::accessKeyAction):
-        (WebCore::HTMLInputElement::rendererIsNeeded):
-        (WebCore::HTMLInputElement::createRenderer):
-        (WebCore::HTMLInputElement::appendFormData):
-        (WebCore::HTMLInputElement::valueWithDefault):
-        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
-        (WebCore::HTMLInputElement::defaultEventHandler):
-        (WebCore::HTMLInputElement::isRequiredFormControl):
-        (WebCore::HTMLInputElement::dataList):
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::):
-        (WebCore::HTMLInputElement::isTextField):
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::typeMismatch):
-        (WebCore::ValidityState::isValidColorString):
-        * html/ValidityState.h:
-
-2009-09-04  Mads Ager  <ager@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Crash when updating document cache
-        https://bugs.webkit.org/show_bug.cgi?id=28965
-
-        Initialization of a V8 JavaScript context can fail.  When that
-        happens, do not attempt to update the document wrapper cache.
-
-        This code path is exercised by http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html.
-
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
         * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::updateDocument):
-
-2009-09-04  Yaar Schnitman  <yaar@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Two bugs:
-
-        https://bugs.webkit.org/show_bug.cgi?id=25489
-        CSS property background-position is now serialized in shorthand string as
-        background-position-x background-position-y, as the specification requires
-        (See http://www.w3.org/TR/2008/WD-css3-background-20080910/#the-background-position).
-        
-
-        https://bugs.webkit.org/show_bug.cgi?id=26541
-        CSS background-color is now be serialized before other background properties, 
-        as CSS specification requires (See http://dev.w3.org/csswg/cssom/#css-value).  
-
-        An existing layout test that accepted wrong order and skipped position test 
-        had to be modified.
-
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
-
-2009-09-03  Kent Tamura  <tkent@chromium.org>
+        (WebCore::V8Proxy::retrieve):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::evaluateScript):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::controls):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseTag):
+        (WebCore::HTMLTokenizer::processToken):
+        * inspector/InspectorController.cpp:
+        (WebCore::canPassNodeToJavaScript):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isProcessingUserGesture):
+        (WebCore::FrameLoader::open):
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectsInAllWorlds):
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didNotAllowScript):
 
-        Reviewed by David Levin.
+2010-02-24  Adam Barth  <abarth@webkit.org>
 
-        Add support for HTMLTextAreaElement.textLength
-        https://bugs.webkit.org/show_bug.cgi?id=28929
+        Reviewed by Darin Fisher.
 
-        Test: fast/forms/textarea-textlength.html
+        Add call to FrameLoaderClient::allowPlugins everywhere arePluginsEnabled is called
+        https://bugs.webkit.org/show_bug.cgi?id=34997
 
-        * html/HTMLTextAreaElement.h:
-        (WebCore::HTMLTextAreaElement::textLength):
-        * html/HTMLTextAreaElement.idl:
+        If we want to let the FrameLoaderClient override arePluginsEnabled,
+        then we need to call out to the FrameLoaderClient every time we read
+        the setting.
 
-2009-09-03  Alexey Proskuryakov  <ap@apple.com>
+        We don't have testing infrustructure for these changes, which is lame.
+        I'm supposed to fix that in Bug 33991.
 
-        Reviewed by Darin Adler.
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::substituteMIMETypeFromPluginDatabase):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::writeRawData):
+        * page/Page.cpp:
+        (WebCore::Page::pluginData):
+        * plugins/MimeType.cpp:
+        (WebCore::MimeType::enabledPlugin):
 
-        <rdar://problem/7180197>, https://bugs.webkit.org/show_bug.cgi?id=28822
-        REGRESSION(r31231): Creating document with current document's DOCTYPE causes crashes
+2010-02-24  James Robinson  <jamesr@chromium.org>
 
-        Test: fast/dom/DOMImplementation/createDocument-with-used-doctype.html
+        Reviewed by Dmitry Titov.
 
-        * dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createDocument): Even though we
-        cannot raise an exception immediately out of fear of breaking Acid3, we shouldn't use a
-        DocumentType node in two documents.
+        Do not fire focus events while a modal dialog is up.
+        https://bugs.webkit.org/show_bug.cgi?id=33962
 
-2009-09-03  Brady Eidson  <beidson@apple.com>
+        Modifies the FocusController to check the frame's page's defersLoading() flag before firing blur/focus events.
+        This flag is set while a modal dialog (like a window.alert or window.confirm) is up.  Firing the events causes
+        assertion failures, since when the dialog is dismissed the PageGroupLoadDeferrer assumes that no script has run.
 
-        Reviewed by Sam Weinig.
+        Manual tests only as DumpRenderTree does not support modal dialogs
 
-        Page Cache should support pages with Frames.
-        https://bugs.webkit.org/show_bug.cgi?id=13631
+        * manual-tests/modal-dialog-blur-selfclose.html: Added.
+        * manual-tests/modal-dialog-blur.html: Added.
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
 
-        Tests: fast/events/pageshow-pagehide-on-back-cached-with-frames.html
-               fast/loader/frames-with-unload-handlers-in-page-cache.html
+2010-02-24  Dan Bernstein  <mitz@apple.com>
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        Reviewed by Anders Carlsson.
 
-2009-09-03  Steve VanDeBogart  <vandebo@chromium.org>
+        <rdar://problem/7018611> innerHTML applies meta/link/title tags from a detached html element
 
-        Reviewed by Eric Seidel.
+        Test: fast/parser/fragment-parser.html
 
-        Handle middle click in Chromium like QT
-        https://bugs.webkit.org/show_bug.cgi?id=28696
+        Ensure that fragment parsing has no side effects on the fragment’s owner
+        document.
 
-        Tested by middle-click-onpaste.html.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::insertNode): Don’t call
+        dispatchDocumentElementAvailable() for fragments.
+        (WebCore::HTMLParser::handleError): Don’t copy attributes to the owner
+        document’s <html> and <body> elements when a redundant <html> or <body>
+        is encountered while parsing a fragment.
+        (WebCore::HTMLParser::framesetCreateErrorCheck): Don’t change the owner
+        document’s <body> element’s style when parsing a fragment.
+        (WebCore::HTMLParser::createHead): Don’t attach the new <head> to the
+        ownder document of a fragment.
+
+2010-02-24  David Levin  <levin@chromium.org>
 
-        * platform/Pasteboard.h:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::getData):
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::Pasteboard):
-        (WebCore::Pasteboard::isSelectionMode):
-        (WebCore::Pasteboard::setSelectionMode):
-        (WebCore::Pasteboard::canSmartReplace):
-        (WebCore::Pasteboard::plainText):
-        (WebCore::Pasteboard::documentFragment):
-        * platform/chromium/PasteboardPrivate.h:
-        (WebCore::PasteboardPrivate::):
+        Reviewed by Darin Adler.
 
-2009-09-03  Brady Eidson  <beidson@apple.com>
+        Need to create a CanvasSurface base class for HTMLCanvasElement.
+        https://bugs.webkit.org/show_bug.cgi?id=35322
 
-        Reviewed by Sam Weinig.
+        This is an initial step in making the OffscreenCanvas object.
 
-        More partial work towards "Page Cache should support pages with Frames"
-        https://bugs.webkit.org/show_bug.cgi?id=13631
+        No new functionality so no new tests.
 
-        Fix a bug where subframes weren't asked if they were cacheable.
+        * GNUmakefile.am: Added CanvasSurface to the build.
+        * WebCore.gypi: ditto
+        * WebCore.pro: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto
+        * WebCore.xcodeproj/project.pbxproj: ditto
+        * dom/CanvasSurface.cpp: Added.
+        * dom/CanvasSurface.h: Added.
+        * html/HTMLCanvasElement.h: Made HTMLCanvasElement inherit from CanvasSurface.
 
-        No new tests, especially since page caching for frames isn't turned on yet.
-        A layout test will come in my next patch, which enables frames in the page cache.
+2010-02-24  Peter Kasting  <pkasting@google.com>
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        Reviewed by Adam Barth.
 
-2009-09-03  Adam Barth  <abarth@webkit.org>
+        Fix regression in calculating an animated image's start time.
+        https://bugs.webkit.org/show_bug.cgi?id=35115
 
-        Reviewed by eric@webkit.org.
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::startAnimation):
 
-        https://bugs.webkit.org/show_bug.cgi?id=24696
+2010-02-24  Dan Bernstein  <mitz@apple.com>
 
-        Added mixed content methods to FrameLoaderClient.
+        Reviewed by Simon Fraser.
 
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::didDisplayInsecureContent):
-        (WebCore::EmptyFrameLoaderClient::didRunInsecureContent):
-        * loader/FrameLoaderClient.h:
+        <rdar://problem/7682827> Text with :first-letter lingers after being removed
 
-2009-09-03  Kevin Watters  <kevinwatters@gmail.com>
+        Test: fast/css/first-letter-set-text.html
 
-        Reviewed by Kevin Ollivier.
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::setTextInternal): Set this back as the
+        text node’s renderer, as removing the first letter has resets the node’s
+        renderer.
 
-        [wx] Frames support
-        https://bugs.webkit.org/show_bug.cgi?id=19041
+2010-02-24  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-        * page/wx/EventHandlerWx.cpp:
-        (WebCore::EventHandler::passMousePressEventToSubframe):
-        (WebCore::EventHandler::passMouseMoveEventToSubframe):
-        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
-        (WebCore::EventHandler::passWheelEventToWidget):
-        (WebCore::EventHandler::tabsToAllControls):
-        (WebCore::EventHandler::passSubframeEventToSubframe):
-        (WebCore::EventHandler::passMouseDownEventToWidget):
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::nativeWindowForRenderObject):
-        (WebCore::RenderThemeWx::paintButton):
-        (WebCore::RenderThemeWx::paintTextField):
-        (WebCore::RenderThemeWx::paintMenuList):
-        (WebCore::RenderThemeWx::paintMenuListButton):
-        * platform/wx/ScrollbarThemeWx.cpp: Added.
-        (WebCore::ScrollbarTheme::nativeTheme):
-        (WebCore::ScrollbarThemeWx::~ScrollbarThemeWx):
-        (WebCore::ScrollbarThemeWx::scrollbarThickness):
-        (WebCore::ScrollbarThemeWx::hasThumb):
-        (WebCore::ScrollbarThemeWx::buttonSize):
-        (WebCore::ScrollbarThemeWx::backButtonRect):
-        (WebCore::ScrollbarThemeWx::forwardButtonRect):
-        (WebCore::ScrollbarThemeWx::trackRect):
-        (WebCore::ScrollbarThemeWx::paintScrollCorner):
-        (WebCore::ScrollbarThemeWx::paint):
-        * platform/wx/ScrollbarThemeWx.h: Added.
-        (WebCore::ScrollbarThemeWx::hasButtons):
-        * platform/wx/TemporaryLinkStubs.cpp:
-        * platform/wx/wxcode/gtk/scrollbar_render.cpp: Added.
-        (wxStyleForPart):
-        (GetButtonWidget):
-        (wxGetGdkWindowForDC):
-        (wxRenderer_DrawScrollbar):
-        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp: Added.
-        (wxScrollbarPartToHIPressedState):
-        (wxRenderer_DrawScrollbar):
-        * platform/wx/wxcode/scrollbar_render.h: Added.
-        (calcThumbStartAndLength):
-        * platform/wx/wxcode/win/non-kerned-drawing.cpp:
-        (WebCore::drawTextWithSpacing):
-        * platform/wx/wxcode/win/scrollbar_render.cpp: Added.
-        (GraphicsHDC::GraphicsHDC):
-        (GraphicsHDC::~GraphicsHDC):
-        (GraphicsHDC::operator HDC):
-        (getTSStateForPart):
-        (wxRenderer_DrawScrollbar):
-        * webcore-wx.bkl:
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-09-03  Yael Aharon  <yael.aharon@nokia.com>
+        [Qt] Faster cut-off for rectangle fill without shadow.
+        https://bugs.webkit.org/show_bug.cgi?id=35337
 
-        Reviewed by Simon Hausmann.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
 
-        [Qt] Page content is not displayed in case of HTTP status error
-        https://bugs.webkit.org/show_bug.cgi?id=28949
+2010-02-24  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        If the server sent content, show it to the user instead of an error,
-        even if the HTTP status code is not success.
+        Reviewed by nobody, build fix.
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
-        (WebCore::QNetworkReplyHandler::finish):
-        (WebCore::QNetworkReplyHandler::forwardData):
-        (WebCore::QNetworkReplyHandler::resetState):
-        * platform/network/qt/QNetworkReplyHandler.h:
+        [Qt] Corrects build break of QtLauncher on Windows.
+        The VERSION variable was not set anymore while building in trunk.
 
-2009-09-03  Drew Wilson  <atwilson@google.com>
+        * WebCore.pro:
 
-        Reviewed by Dimitri Glazkov.
+2010-02-24  Alexander Pavlov  <apavlov@chromium.org>
 
-        Need to update v8 bindings to support passing multiple ports to postMessage()
-        https://bugs.webkit.org/show_bug.cgi?id=28839
+        Reviewed by Pavel Feldman.
 
-        Added support for passing MessagePortArray to v8 bindings.
+        Web Inspector: Activate/Deactivate breaks does not look consistent with rest of the toolbar.
 
-        New tests that now pass with V8:
-               fast/events/message-port-multi.html
-               fast/workers/worker-context-multi-port.html
-               fast/workers/worker-multi-port.html
+        Fix style and add the new images to the related file sets.
+        https://bugs.webkit.org/show_bug.cgi?id=35307
 
         * WebCore.gypi:
-        Added V8MessageEventCustom.cpp and V8MessagePortCustom.h
-        * bindings/v8/custom/V8CustomBinding.h:
-        Added custom postMessage() handlers for various classes.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::DOMWindowPostMessage):
-        Added custom handler that supports MessagePortArray.
-        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
-        (WebCore::DedicatedWorkerContextPostMessage):
-        Added custom handler that supports MessagePortArray.
-        * bindings/v8/custom/V8MessageEventCustom.cpp: Added.
-        (WebCore::MessageEventPorts):
-        Added getter for ports attribute.
-        (WebCore::MessageEventInitMessageEvent):
-        Added custom handler that supports MessagePortArray.
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::MessagePortPostMessage):
-        Added custom handler that supports MessagePortArray.
-        (WebCore::getMessagePortArray):
-        Added helper function that supports converting from a sequence-like object to a MessagePortArray.
-        * bindings/v8/custom/V8MessagePortCustom.h: Added.
-        Added declaration for getMessagePortArray().
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::WorkerPostMessage):
-        Added custom handler that supports MessagePortArray.
+        * inspector/front-end/Images/deactivateBreakpointsButtonGlyph.png:
+        * inspector/front-end/Images/deactivateBreakpointsDisabledButtonGlyph.png:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
 
-2009-09-03  Drew Wilson  <atwilson@google.com>
+2010-02-24  Xan Lopez  <xlopez@igalia.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Gustavo Noronha.
 
-        Need to update JS bindings and IDL files to support multiple message ports in postMessage()
-        https://bugs.webkit.org/show_bug.cgi?id=28460
+        Get rid of an extra call to
+        setNPWindowIfNeeded. updatePluginWidget already calls this for us
+        if needed.
 
-        Added new toJSSequence() API which validates that a JSValue meets the WebIDL criteria for a sequence.
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::platformStart):
 
-        Tests: fast/events/message-port-multi.html
-               fast/workers/worker-context-multi-port.html
-               fast/workers/worker-multi-port.html
+2010-02-24  Xan Lopez  <xlopez@igalia.com>
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        Added JSMessagePortCustom.h and JSMessageEventCustom.cpp.
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::toJSSequence):
-        Added toJSSequence() API to do validation on sequence-like objects per WebIDL.
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::postMessage):
-        Added custom handler for postMessage() that handles being passed MessagePortArrays.
-        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
-        (WebCore::JSDedicatedWorkerContext::postMessage):
-        Added custom handler for postMessage() that handles being passed MessagePortArrays.
-        * bindings/js/JSMessageEventCustom.cpp: Added.
-        (WebCore::JSMessageEvent::ports):
-        Added custom ports() getter that converts from MessagePortArray to JSArray.
-        (WebCore::JSMessageEvent::initMessageEvent):
-        Added support for passing a MessagePortArray.
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::postMessage):
-        Added custom handler for postMessage() that handles being passed MessagePortArray.
-        (WebCore::fillMessagePortArray):
-        New helper routine that validates/converts from a JS sequence o a WebCore::MessagePortArray.
-        * bindings/js/JSMessagePortCustom.h: Added.
-        * bindings/js/JSWorkerCustom.cpp:
-        (WebCore::JSWorker::postMessage):
-        Added custom handler for postMessage() that handles being passed MessagePortArray.
-        * dom/MessageEvent.cpp:
-        * dom/MessageEvent.h:
-        (WebCore::MessageEvent::ports):
-        Changed ports() to return a MessagePortArray* since this value can be null.
-        * dom/MessageEvent.idl:
-        Updated IDL to match HTML5 spec (now accepts MessagePortArrays instead of a solitary MessagePort).
-        * dom/MessagePort.cpp:
-        * dom/MessagePort.h:
-        * dom/MessagePort.idl:
-        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
-        * workers/DedicatedWorkerContext.cpp:
-        * workers/DedicatedWorkerContext.h:
-        * workers/DedicatedWorkerContext.idl:
-        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
-        * workers/Worker.cpp:
-        * workers/Worker.h:
-        * workers/Worker.idl:
-        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        Reviewed by Gustavo Noronha.
 
-2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+        Try to sanitize a bit the geometry management of plugins.
 
-        Reviewed by Timothy Hatcher.
+        Stop doing contradictory things in updatePluginWidget (we were at
+        the same time pretending the geometry setting was delayed until
+        ::paint and setting the geometry not once but twice) and just set
+        it any time the windowRect or clipRect for the plugin has changed.
 
-        WebInspector: Do not query non-function call frames for function name.
+        This is closer to what the Mac port does, and fixes instances of
+        the plugins not being drawn until the window is resized or
+        scrolled. Other than that all manual and layout tests seems to
+        still work.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28799
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::setNPWindowIfNeeded):
 
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.CallFrameProxy):
-        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+2010-02-23  Geoff Garen  <ggaren@apple.com>
 
-2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Timothy Hatcher.
+        Simplify animation lifetime handling.  Previously we manually
+        determined whether our base element was safe when we unregistered
+        our listener, now we simply ensure that the base element itself
+        registers and unregisters the animation listener.
 
-        Crash after typing "clear" and pressing return in inspector console.
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::create):
+        (WebCore::ConditionEventListener::disconnectAnimation):
+        (WebCore::ConditionEventListener::ConditionEventListener):
+        (WebCore::ConditionEventListener::operator==):
+        (WebCore::ConditionEventListener::handleEvent):
+        (WebCore::SVGSMILElement::eventBaseFor):
+        (WebCore::SVGSMILElement::connectConditions):
+        (WebCore::SVGSMILElement::disconnectConditions):
+        * svg/animation/SVGSMILElement.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=28684
+2010-02-23  Dmitry Titov  <dimich@chromium.org>
 
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._clearConsoleMessages):
-        (InjectedScript._inspectObject):
-        (InjectedScript._ensureCommandLineAPIInstalled):
+        Reviewed by David Levin.
 
-2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+        Chromium: Use V8::TerminateExecution to actually terminate workers.
+        https://bugs.webkit.org/show_bug.cgi?id=35137
 
-        Reviewed by Adam Barth.
+        Test: existing fast/workers/stress-js-execution.html which is currently failing
+        on Mac and Linux bots for Chromium.
 
-        [V8] Squeezed out some performance from string conversion.
-        https://bugs.webkit.org/show_bug.cgi?id=28945
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::forbidExecution):
 
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::WebCoreStringResource::WebCoreStringResource):
-        (WebCore::WebCoreStringResource::~WebCoreStringResource):
-        (WebCore::WebCoreStringResource::data):
-        (WebCore::WebCoreStringResource::length):
-        (WebCore::WebCoreStringResource::atomicString):
-        (WebCore::WebCoreStringResource::string):
-        Avoid calling virtual length method. Be more explicit with
-        external memory computation. Avoid function calls in data and
-        length.
-        (WebCore::):
-        (WebCore::v8StringToWebCoreString):
-        (WebCore::v8StringToAtomicWebCoreString):
-        (WebCore::v8NonStringValueToWebCoreString):
-        (WebCore::v8NonStringValueToAtomicWebCoreString):
-        Avoid extra calls of WebCoreStringResource::toString. When
-        AtomicString is computed pass it immediately when constructing
-        WebCoreStringResource. Use inline buffer for small strings.
-        * bindings/v8/V8Binding.h:
-        (WebCore::v8ValueToWebCoreString):
-        (WebCore::v8ValueToAtomicWebCoreString):
-        (WebCore::toString):
-        Inline dispatch of string vs. non-string values.
+2010-02-23  Enrica Casucci  <enrica@apple.com>
 
-2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+        Reviewed by Simon Fraser.
 
-        Reviewed by Adam Barth.
+        REGRESSION: WebKit crashes when deleting images on blogger.com (34957)
+        <rdar://problem/7651935>
+        https://bugs.webkit.org/show_bug.cgi?id=34957
 
-        [V8] Inlined common case of V8IsolatedWorld::getEntered to speed
-        up V8Proxy lookup.
-        https://bugs.webkit.org/show_bug.cgi?id=28946
+        Fixing a regression introduced with revision 53085. Anchor elements should not be considered
+        in editable content when calculating the position in the parent before the node.
+        
+        Test: editing/execCommand/delete-image-in-anchor.html
 
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::getEnteredImpl):
-        * bindings/v8/V8IsolatedWorld.h:
-        (WebCore::V8IsolatedWorld::getEntered):
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset):
 
-2009-09-03  Kent Tamura  <tkent@chromium.org>
+2010-02-23  Tony Chang  <tony@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        Fix a regression bug that maxLength doesn't work for IME input.
-        https://bugs.webkit.org/show_bug.cgi?id=25253
+        https://bugs.webkit.org/show_bug.cgi?id=34634
+        Pasting a list into the middle of another list item should split the target
+        list item into two separate list items.  This matches the behavior in other
+        browsers.
 
-        Tests: fast/forms/input-maxlength-ime-completed.html
-               fast/forms/input-maxlength-ime-preedit.html
-
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::handleBeforeTextInsertedEvent):
-        * dom/InputElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::defaultEventHandler):
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::defaultEventHandler):
+        Test: editing/pasteboard/paste-list-004.html
 
-2009-09-03  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Eric Seidel.
-
-        Make SVGStyleElement title/media/type setters do something
-        https://bugs.webkit.org/show_bug.cgi?id=28828
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
 
-        Test: svg/dom/style-reflect.html
+2010-02-23  Brady Eidson  <beidson@apple.com>
 
-        * svg/SVGStyleElement.cpp:
-        (WebCore::SVGStyleElement::setXmlspace): Actually change the attribute.
-        (WebCore::SVGStyleElement::setType): Ditto.
-        (WebCore::SVGStyleElement::setMedia): Ditto.
-        (WebCore::SVGStyleElement::setTitle): Ditto.
+        Reviewed by Tim Hatcher and Pavel Feldman.
 
-2009-09-03  Ben Murdoch  <benm@google.com>
+        Regression (r55107) - WebInspector docking is busted.
+        https://bugs.webkit.org/show_bug.cgi?id=35274
 
-        https://bugs.webkit.org/show_bug.cgi?id=28872
-        
-        Fixes a bug where handleEvent() in the V8 Custom SQL Statement Error binding would not return the correct result to WebCore after invoking the callback.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::canAttachWindow): Use the minimum height for this calculation,
+          not the preferred height.
+        (WebCore::InspectorController::attachWindow): attachWindow() shouldn't decide the policy, as it is
+          often called partway through the show or dock procedure after some of the initial conditions have
+          changed. Let the front-end itself and the InspectorClient's make the policy decision at the start
+          of the show/dock operation.
+
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::canAttachWindow):
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
 
-        Test: storage/statement-error-callback.html
+        * inspector/front-end/inspector.js:
+        (WebInspector.toggleAttach): Before attaching, ask the front-end-host if attaching is allowed.
 
-        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
-        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent): Return true from handleEvent() if the callback raised an exception or the callback itself returned true.
+2010-02-23  Mark Rowe  <mrowe@apple.com>
 
-2009-09-03  Maxime Simon  <simon.maxime@gmail.com>
+        Reviewed by Geoff Garen.
 
-        Reviewed by Eric Seidel.
+        <http://webkit.org/b/35287> ImageSourceCG::frameIsCompleteAtIndex returns false for all frames until image has completed loading
 
-        [Haiku] Adding three font-specific files to WebCore:
-        FontCustomPlatformData.cpp, FontCustomPlatformData.h,
-        and FontPlatformData.h
-        https://bugs.webkit.org/show_bug.cgi?id=28131
+        CGImageSourceGetStatusAtIndex claims that all frames of a multi-frame image are incomplete when we've not yet received the
+        complete data for an image that is using an incremental data source (<rdar://problem/7679174>). We work around this by
+        special-casing all frames except the last in an image and treating them as complete if they are present and reported as
+        being incomplete. We do this on the assumption that loading new data can only modify the existing last frame or append new
+        frames. The last frame is only treated as being complete if the image source reports it as such. This ensures that it is
+        truly the last frame of the image rather than just the last that we currently have data for.
 
-        * platform/graphics/haiku/FontCustomPlatformData.cpp: Added.
-        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
-        (WebCore::FontCustomPlatformData::fontPlatformData):
-        (WebCore::createFontCustomPlatformData):
-        * platform/graphics/haiku/FontCustomPlatformData.h: Added.
-        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
-        * platform/graphics/haiku/FontPlatformData.h: Added.
-        (WebCore::FontPlatformData::FontPlatformData):
-        (WebCore::FontPlatformData::font):
-        (WebCore::FontPlatformData::size):
-        (WebCore::FontPlatformData::bold):
-        (WebCore::FontPlatformData::oblique):
-        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
 
-2009-09-02  Brady Eidson  <beidson@apple.com>
+2010-02-23  Enrica Casucci  <enrica@apple.com>
 
         Reviewed by Darin Adler.
 
-        More partial work towards "Page Cache should support pages with Frames"
-        https://bugs.webkit.org/show_bug.cgi?id=13631
-
-        No new tests. (No change in behavior, current tests pass).
-
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::stopLoading): Adopt the new enum form for FrameLoader::stopLoading().
+        Crash in createContextualFragment when inserting a list in a non HTML document.
+        <rdar://problem/7666670>
+        https://bugs.webkit.org/show_bug.cgi?id=35305
+        
+        createFragmentFromMarkup did not handle correctly the case where documentElement is
+        not an HTMLElement. The static cast to HTMLElement was causing createContextualFragment to
+        crash.
+        
+        Test: editing/execCommand/insert-list-xml.xhtml
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopLoading): Take an enum to decide whether to dispatch no unload events,
-          only unload, or unload and pagehide.
-        (WebCore::FrameLoader::closeURL):
-        (WebCore::FrameLoader::scheduleRedirection):
-        (WebCore::FrameLoader::cachePageForHistoryItem): Call pageHidden().
-        (WebCore::FrameLoader::pageHidden): Add to dispatch the pagehide event to all frames in the case
-          where a page is added to the PageCache.
-        * loader/FrameLoader.h:
+        * dom/Element.cpp:
+        (WebCore::Element::createContextualFragment): Added.
+        * dom/Element.h: Added createContextualFragment virtual function.
+        * editing/markup.cpp:
+        (WebCore::createFragmentFromMarkup): Removed static cast to HTMLElement.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::createContextualFragment): Modified to perform only checks
+        that are specific for an HTMLElement object. The rest of the logic has been moved to the
+        corresponding method in the Element class.
 
-        * loader/FrameLoaderTypes.h: Add an UnloadEventPolicy enum.
+2010-02-23  Steve Falkenburg  <sfalken@apple.com>
 
-2009-09-02  Brady Eidson  <beidson@apple.com>
+        Reviewed by Adam Roben.
 
-        Reviewed by Darin Adler.
+        WebCore should stop throwing away the CGImageSourceRef on Windows to improve GIF performance
+        https://bugs.webkit.org/show_bug.cgi?id=35309
 
-        More partial work towards "Page Cache should support pages with Frames"
-        https://bugs.webkit.org/show_bug.cgi?id=13631
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear):
 
-        - More CachedFrame destruction work.
-        - Including related Frame and FrameLoader changes and cleanup.
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
 
-        No new tests. (No change in behavior, current tests pass).
+        Reviewed by Gustavo Noronha Silva.
 
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrameBase::restore): Rebuild up the whole FrameTree when restoring.
-        (WebCore::CachedFrame::CachedFrame): Tear down the entire FrameTree when caching.
-        (WebCore::CachedFrame::destroy): For child frames that are being destroyed while in
-          the PageCache, do lightweight cleanup to:
-          A - Prevent referring to a stale Page object.
-          B - Prevent World Leaks of WebKit objects.
+        Changes references of GOwnPtr to reflect their new place.
+        http://webkit.org/b/35084
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopAllLoaders): stopAllLoaders() should never be called on Frames that are
-          in the PageCache. ASSERT that fact.
-        (WebCore::FrameLoader::open): Remove a bogus release-build workaround, as the comment right above it
-          explains it is not effective, and it'd be better to see the crash locally instead of downstream.
-        (WebCore::FrameLoader::closeAndRemoveChild): Make sure the owner element has a page pointer before
-          referencing it.
-        (WebCore::FrameLoader::detachFromParent): Use the new detachViewsAndDocumentLoader() call
-        (WebCore::FrameLoader::detachViewsAndDocumentLoader): Does lightweight cleanup of client (WebKit) objects.
-        * loader/FrameLoader.h:
+        * WebCore/platform/KURL.cpp
+        * WebCore/platform/TextEncoding.cpp:
+        * WebCore/platform/text/gtk/TextBreakIteratorGtk.cpp: 
+        * WebCore/platform/text/gtk/TextCodecGtk.cpp:
 
-        * page/Frame.cpp:
-        (WebCore::Frame::detachFromPage): Simply clear the Page pointer without doing any other work.
-        (WebCore::Frame::pageDestroyed): Use the new detachFromPage().
-        * page/Frame.h:
+2010-02-23  Brady Eidson  <beidson@apple.com>
 
-2009-09-02  Jungshik Shin  <jshin@chromium.org>
+        Reviewed by Alexey Proskuryakov.
 
-        Reviewed by Dimitri Glazkov
+        HTTP 307 after a 303 after a POST re-sends POST data from the original request.
+        <rdar://problem/7390251> and https://bugs.webkit.org/show_bug.cgi?id=31410
 
-        [Chromium] Add 'icu::' qualifier in preparation for ICU upgrade to 4.2
-        in Chromium. This is to fix a new file added in r28742 since the
-        last patch for this issue.
+        Test: http/tests/loading/307-after-303-after-post.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=28410
+        Remember the last HTTP method send out during a redirect chain for a resource handle:
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::lastHTTPMethod):
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
 
-        No change in the test result.
+        Refer to the last HTTP method used instead of the original method:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+        (WebCore::ResourceHandle::willSendRequest):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::willSendRequest):
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
 
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::TextRunWalker::getNormalizedTextRun):
+2010-02-23  Crystal Zhang  <haizhang@rim.com>
 
-2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+        Unreviewed build fix.
 
-        Unreviewed, build fix.
+        Fix build error when enable plugin proxy: 'toRenderEmbeddedObject' identifier not found.
+        As RenderEmbeddedObject inherits RenderPartObject and 'toRenderEmbeddedObject' belongs
+        to former one.
 
-        [Chromium] Correct a typo to fix bustage, caused by r47991.
-        https://bugs.webkit.org/show_bug.cgi?id=27933
+        * html/HTMLMediaElement.cpp:
 
-        * platform/graphics/skia/ImageBufferSkia.cpp: Changed "Unpremultipled" to "Unmultiplied".
+2010-02-23  Evan Martin  <evan@chromium.org>
 
-2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+        Reviewed by Jeremy Orlow.
 
-        Unreviewed, build fix.
+        [chromium] fix previous SVG-disabling patch
+        https://bugs.webkit.org/show_bug.cgi?id=35298
 
-        [Chromium] Add a missing include to fix bustage, caused by r47991.
-        https://bugs.webkit.org/show_bug.cgi?id=27933
+        * WebCore.gypi: rename variable
+        * WebCore.gyp/WebCore.gyp: actually use the variable
 
-        * platform/graphics/skia/ImageBufferSkia.cpp: Added SkColorPriv include.
+2010-02-23  Michael Lotz <mmlr@mlotz.ch>
 
-2009-09-02  Jian Li  <jianli@chromium.org>
+        Reviewed by David Levin.
 
-        Reviewed by Dimitri Glazkov.
+        [Haiku] Fix conversion from BString to String
+        https://bugs.webkit.org/show_bug.cgi?id=35082
 
-        [Chromium] Implement file support for DragData.
-        https://bugs.webkit.org/show_bug.cgi?id=28896
+        The previous patch to this file was broken (sorry). First of all,
+        the conversion from UTF8 was accidentally removed. Second, for
+        empty strings, we need to point the implementation at StringImpl::empty().
 
-        * platform/chromium/DragDataChromium.cpp:
-        (WebCore::DragData::containsURL):
-        (WebCore::DragData::asURL):
-        (WebCore::DragData::containsCompatibleContent):
+        Covered by existing tests.
 
-2009-09-02  Kevin Watters  <kevinwatters@gmail.com>
+        * platform/text/haiku/StringHaiku.cpp:
+        (WebCore::String::String):
 
-        Reviewed by Kevin Ollivier.
+2010-02-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Protect libcurl shared data with Mutex objects via curl_set_share_opt.
-        https://bugs.webkit.org/show_bug.cgi?id=28920
+        Reviewed by Eric Carlson.
 
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::sharedResourceMutex):
-        (WebCore::curl_lock_callback):
-        (WebCore::curl_unlock_callback):
-        (WebCore::ResourceHandleManager::ResourceHandleManager):
+        [Qt] Prevent the media backend from handling non-audio or -video mime types
 
-2009-09-02  Evan Stade  <estade@chromium.org>
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
 
-        Reviewed by Eric Seidel.
+2010-02-23  Evan Martin  <evan@chromium.org>
 
-        Expose functions to change the focus ring color for Linux Chromium
+        Reviewed by Jeremy Orlow.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28887
+        [chromium] Allow building without SVG
+        https://bugs.webkit.org/show_bug.cgi?id=31522
 
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
-        (WebCore::RenderThemeChromiumLinux::setFocusRingColor):
-        (WebCore::RenderThemeChromiumLinux::platformFocusRingColor):
-        * rendering/RenderThemeChromiumLinux.h:
+        * WebCore.gyp/WebCore.gyp, WebCore.gypi: test enable_svg flag.
+        * bindings/v8/custom/V8SVGDocumentCustom.cpp,
+          bindings/v8/custom/V8SVGPathSegCustom.cpp: test ENABLE(SVG).
 
-2009-09-02  Dirk Schulze  <krit@webkit.org>
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Gustavo Noronha Silva.
 
-        SVG Filter premultiplied color support for getImageDate/putImageData
-        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+        Fixes references to GOwnPtr and GRefPtr so the GTK+ port builds
+        again.
+        http://webkit.org/b/35084
 
-        Patch to get premultiplied color support for Skia on getImageDate/putImageData.
+        * WebCore/platform/gtk/DataObjectGtk.h:
+        * WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
 
-        * platform/graphics/skia/ImageBufferSkia.cpp:
-        (WebCore::getImageData):
-        (WebCore::putImageData):
+2010-02-23  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-2009-09-02  Brady Eidson  <beidson@apple.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Forget to rename openInFrameloader() to open(), which was requested in Darin's review of my last patch.
+        [Qt] Faster cut-off for rectangle drawing without shadow.
+        https://bugs.webkit.org/show_bug.cgi?id=35267
 
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrameBase::restore):
-        (WebCore::CachedFrame::open):
-        * history/CachedFrame.h:
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::restore):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
 
-2009-09-02  Brady Eidson  <beidson@apple.com>
+2010-02-23  Steve Block  <steveblock@google.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Jeremy Orlow.
 
-        In http://trac.webkit.org/changeset/47943 I added new header dependencies to FrameLoader.h.
-        Removing them is a little trouble, but worth it going forward.
-        The pattern of creating a "CachedFrameBase" as the interface CachedFrame provides to FrameLoader
-        was suggested by Darin Adler.
+        Removes redundant Settings::setGeolocationEnabled and Settings::geolocationEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=35242
 
-        No new tests. (No change in behavior)
+        No new tests, removing dead code only.
 
-        Make CachedFrame inherit privately from CachedFrameBase, which becomes the interface FrameLoader uses:
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrameBase::CachedFrameBase):
-        (WebCore::CachedFrameBase::~CachedFrameBase):
-        (WebCore::CachedFrameBase::restore):
-        (WebCore::CachedFrame::CachedFrame):
-        (WebCore::CachedFrame::openInFrameLoader):
-        * history/CachedFrame.h:
-        (WebCore::CachedFrameBase::document):
-        (WebCore::CachedFrameBase::view):
-        (WebCore::CachedFrameBase::domWindow):
-        (WebCore::CachedFrame::create):
-        (WebCore::CachedFrame::documentLoader):
-        (WebCore::CachedFrame::mousePressNode):
-
-        Call the new ::openInFrameLoader() method on the CachedFrame, as CachedFrameBase is now the only
-        thing capable of interacting with FrameLoader::open(CachedFrameBase):
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::restore):
-        * history/CachedPage.h:
-        (WebCore::CachedPage::documentLoader):
-
-        Make ::open(CachedFrame) public, and change it to ::open(CachedFrameBase):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::open):
-        * loader/FrameLoader.h:
+        * page/Settings.cpp:
+        * page/Settings.h:
 
-2009-09-02  Ryosuke Niwa  <rniwa@webkit.org>
+2010-02-23  Ben Murdoch  <benm@google.com>
 
         Reviewed by Eric Seidel.
 
-        Cannot pres Enter to escape from bulleted list when <ul> is a child of <li>.
-        https://bugs.webkit.org/show_bug.cgi?id=24866
-
-        This patch modifies breakOutOfEmptyListItem to break out of a properly nested list
-        (a list to break out of is inside another list item).
+        pageX/Y co-ordinates of TouchEvent should be 0,0
+        https://bugs.webkit.org/show_bug.cgi?id=35239
 
-        When the empty list item appears at the end of another list item, WebKit breaks out of
-        the outer list item, and adds new item below the outer list item.
-        Otherwise, WebKit breaks out of the the inner list item and inserts new paragraph.
+        The co-ordinates attached to a touch event are not used for tracking touch motion, rather the co-ordinates attached to Touches within the touch event should be used. Set the co-ordinates on the event itself to 0 to avoid confusion and match observed iPhone behavior.
 
-        Test: editing/execCommand/break-out-of-empty-list-item.html
-
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Set the pageX/Y and screenX/Y co-ordinates attached to the touch event to 0,0 to match observed behavior on the iPhone.
+        * page/EventHandler.h: Remove now unused members m_firstTouchScreenPos and m_firstTouchPagePos.
 
-2009-09-02  Brady Eidson  <beidson@apple.com>
+2010-02-23  Stephan Aßmus  <superstippi@gmx.de>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Eric Seidel.
 
-        More partial work towards "Page Cache should support pages with Frames"
-        https://bugs.webkit.org/show_bug.cgi?id=13631
+        [Haiku] Various improvements to EventHandlerHaiku.
+        https://bugs.webkit.org/show_bug.cgi?id=34685
 
-        This patch is primarily about the "CachedFrame tree" and making slightly different decisions
-        based on whether a CachedFrame is the main frame or a subframe.
+        Covered by existing tests.
 
-        - Store whether a CachedFrame represents the main frame or a subframe.
-        - "Chop off the frame tree" for the main frame when creating its CachedFrame, as main frames 
-          are reused and need to start new page loads with an empty frame tree.
-        - Reattach the frame tree to the main frame when restoring it.
-        - open() the cached subframes in their respective loaders when restoring.
-        - Properly clear() and destroy() cached subframes.
-        - When committing to a new page load, and after caching the previous page, only clear the
-          FrameView for the main frame.
+        Fix the build by not including PlatformScrollBar.h.
 
-        Note that all of above will eventually be necessary as I continue to land this work in pieces,
-        but doesn't actually change any behavior right now because we still refuse to even *try* to
-        cache pages with frames.
+        * page/haiku/EventHandlerHaiku.cpp:
+        (WebCore::isKeyboardOptionTab):
+            Use the correct keycode for tab keys.
+        (WebCore::EventHandler::focusDocumentView):
+            Use proper locking. In any case, Haiku doesn't append platform
+            widgets to WebCore widgets. But if it did, this implementation
+            would be correct.
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+            Implemented.
+        (WebCore::EventHandler::eventActivatedView):
+            Removed notImplemented() and added note.
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+            Implemented.
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+            Implemented.
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+            Implemented.
+        (WebCore::EventHandler::accessKeyModifiers):
+            Added note.
 
-        No new tests. No change in behavior, and current tests continue to pass.
+2010-02-23  Tony Chang  <tony@chromium.org>
 
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrame::CachedFrame):
-        (WebCore::CachedFrame::restore):
-        (WebCore::CachedFrame::clear):
-        (WebCore::CachedFrame::destroy):
-        * history/CachedFrame.h:
-        (WebCore::CachedFrame::isMainFrame):
+        Not reviewed.
+        Revert r55135 because the layout test is failing on all the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=34634
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::clear):
-        (WebCore::FrameLoader::open):
-        * loader/FrameLoader.h:
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
 
-2009-09-02  Brady Eidson  <beidson@apple.com>
+2010-02-17  Steve Block  <steveblock@google.com>
 
-        No review, build fix.
+        Reviewed by Ariya Hidayat.
 
-        http://trac.webkit.org/changeset/47976 broke the build.  
-        Let's try compiling before we land things, shall we?
+        Adds cache to store Geolocation positions between browser sessions.
+        https://bugs.webkit.org/show_bug.cgi?id=34084
 
-        * platform/graphics/SimpleFontData.cpp:
-        (WebCore::SimpleFontData::SimpleFontData): Order the initialization list correctly.
+        This is required to fully implement the Geolocation maximumAge property.
+        See Bug 30676.
 
-2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+        No new tests, will add tests for maximumAge once complete.
 
-        waf build fixes for Windows/MSVC.
+        * Android.mk: Modified. Added GeolocationPositionCache.cpp
+        * GNUmakefile.am: Modified. Added GeolocationPositionCache.[cpp|h]
+        * WebCore.gypi: Modified. Added GeolocationPositionCache.[cpp|h]
+        * WebCore.pro: Modified. Added GeolocationPositionCache.[cpp|h]
+        * WebCore.vcproj/WebCore.vcproj: Modified. Added GeolocationPositionCache.[cpp|h]
+        * WebCore.xcodeproj/project.pbxproj: Modified. Added GeolocationPositionCache.[cpp|h]
+        * page/GeolocationPositionCache.cpp: Added.
+        (WebCore::GeolocationPositionCache::GeolocationPositionCache):
+        (WebCore::GeolocationPositionCache::~GeolocationPositionCache):
+        (WebCore::GeolocationPositionCache::setCachedPosition):
+        (WebCore::GeolocationPositionCache::cachedPosition):
+        (WebCore::GeolocationPositionCache::setDatabasePath):
+        (WebCore::GeolocationPositionCache::readFromDB):
+        (WebCore::GeolocationPositionCache::writeToDB):
+        * page/GeolocationPositionCache.h: Added.
 
-        * wscript:
+2010-02-23  Yuta Kitamura  <yutak@chromium.org>
 
-2009-09-02  Ben Murdoch  <benm@google.com>
+        Reviewed by Dan Bernstein.
 
-        Unreviewed build fix for Chromium.
+        Fix alignment of vertical-align: text-bottom inside an inline-block.
+        
+        This patch is based on a fix provided by Takahito Hirano.
 
-        Missed #including V8Proxy.h in WebCore/bindings/v8/V8Binding.cpp.
+        display: inline-block + vertical-align: text-bottom causes misalignment.
+        https://bugs.webkit.org/show_bug.cgi?id=30846
 
-        * bindings/v8/V8Binding.cpp: add V8Proxy.h as an include
+        Test: fast/inline-block/inline-block-vertical-align-2.html
 
-2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::verticalPosition): Fixed vpos calculation.
+        We cannot cut corners for inline blocks, since they may have their own
+        text metrics.
 
-        waf build fix, don't define symbols we now grab from other sources.
+2010-02-23  Steve Block  <steveblock@google.com>
 
-        * platform/wx/TemporaryLinkStubs.cpp:
+        Reviewed by David Levin.
 
-2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+        Sets default values of V8 runtime enabler flags to match behavior with JSC
+        https://bugs.webkit.org/show_bug.cgi?id=35095
 
-        Build fixes for PluginViewNone.cpp and a wx build fix for PluginView.cpp.
+        No new tests, modifies a Chromium feature only.
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::stop):
-        * plugins/PluginViewNone.cpp:
-        (WebCore::PluginView::platformDestroy):
+        * bindings/generic/RuntimeEnabledFeatures.cpp: Modified. Sets appcache and geolocation flag defaults to 'on'
+        * storage/Database.cpp: Modified. Sets database flag default to 'on'.
 
-2009-09-02  Charles Wei  <charles.wei@torchmobile.com.cn>
+2010-02-23  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by Eric Seidel.
 
-        Fix the build failure of WebKit for Linux/Qt when WML is enabled
-
-        No test cases needed since this just fixes the build problem.
+        [Haiku] Fix various issues in keyboard event generation.
+        https://bugs.webkit.org/show_bug.cgi?id=34685
 
-        * wml/WMLElement.cpp:
-        (WebCore::WMLElement::create):
-        * wml/WMLTableElement.cpp:
-        (WebCore::WMLTableElement::joinSuperflousColumns):
-        (WebCore::WMLTableElement::padWithEmptyColumns):
+        Covered by existing tests.
 
-2009-09-02 Yong Li <yong.li@torchmobile.com>
+        Fixed backspace keycode.
+        Fixed using the appropriate fields from the Haiku event for mapping
+        to the VK_* codes and added mapping a great deal more codes.
+        Added extraction of modifier key flags.
+        Completed implementation of disambiguateKeyDownEvent()
+        Implemented currentCapsLockState().
 
-        Reviewed by Adam Barth.
+        * platform/haiku/PlatformKeyboardEventHaiku.cpp:
+        (WebCore::keyIdentifierForHaikuKeyCode):
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
 
-        WINCE PORT: use shared buffer for custom font data
-        https://bugs.webkit.org/show_bug.cgi?id=27734
+2010-02-23  Steve Block  <steveblock@google.com>
 
-        Refactored by Joe Mason <joe.mason@torchmobile.com>
+        Reviewed by Darin Adler.
 
-        * loader/CachedFont.cpp:
-        add WINCE to platforms using cached custom data
-        * platform/graphics/opentype/OpenTypeUtilities.cpp:
-        (WebCore::renameFont): implement for WinCE
-        * platform/graphics/opentype/OpenTypeUtilities.h:
-        build fixes
-        * platform/graphics/wince/FontCustomPlatformData.cpp:
-        (WebCore::setCustomFontCache): add accessor
-        (WebCore::createFontCustomPlatformData): change param to SharedBuffer
-        * platform/graphics/wince/FontCustomPlatformData.h:
-        update function signatures 
- 
-2009-09-02 Yong Li <yong.li@torchmobile.com>
+        Adds Client::cancelGeolocationPermissionRequestForFrame and ChromeClient::cancelGeolocationPermissionRequestForFrame
+        https://bugs.webkit.org/show_bug.cgi?id=34962
 
-        Reviewed by Adam Barth.
+        These methods are required so that a Geolocation object can cancel an
+        asynchronous permission request. This allows the chrome client to cancel
+        any UI it is showing for the permission request.
 
-        WINCE PORT: font-related build fixes and minor bugfixes
-        https://bugs.webkit.org/show_bug.cgi?id=27734
+        No new tests, as this is for the purposes of browser UI only.
 
-        * platform/graphics/FontCache.h: declare functions added in https://bugs.webkit.org/show_bug.cgi?id=27509
-        * platform/graphics/GlyphPageTreeNode.cpp:
-        (WebCore::GlyphPageTreeNode::initializePage): fix ambiguous overload error in min/max on Windows
-        * platform/graphics/SimpleFontData.cpp:
-        (WebCore::SimpleFontData::SimpleFontData): initialize member vars
-        * platform/graphics/SimpleFontData.h: disable unused members on Wince to save space 
+        * loader/EmptyClients.h: Modified
+        (WebCore::EmptyChromeClient::cancelGeolocationPermissionRequestForFrame): Added
+        * page/Chrome.cpp: Modified.
+        (WebCore::Chrome::cancelGeolocationPermissionRequestForFrame): Added
+        * page/Chrome.h: Modified.
+        * page/ChromeClient.h: Modified.
+        (WebCore::ChromeClient::cancelGeolocationPermissionRequestForFrame): Added
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::disconnectFrame): Modified. Call cancelGeolocationPermissionRequestForFrame
 
-2009-09-02  Jeremy Orlow  <jorlow@chromium.org>
+2010-02-23  Tony Chang  <tony@chromium.org>
 
-        Reviewed by Adam Barth.
+        Reviewed by Eric Seidel.
 
-        Another pass at releasing the storage mutex.
-        https://bugs.webkit.org/show_bug.cgi?id=28904
+        https://bugs.webkit.org/show_bug.cgi?id=34634
+        Pasting a list into the middle of another list item should split the target
+        list item into two separate list items.  This matches the behavior in other
+        browsers.
 
-        Another pass at releasing the storage mutex (when applicable) when we finish
-        executing JavaScript.  http://dev.w3.org/html5/spec/Overview.html#storage-mutex
-        describes the required behavior.
+        Test: editing/pasteboard/paste-list-004.html
 
-        As it turns out, https://bugs.webkit.org/show_bug.cgi?id=28789 didn't solve
-        the problem correctly.  First of all, I missed that events and timeouts go
-        through a different call path.  Second of all, I didn't consider recursion
-        correctly.  Third of all, my check to see if LocalStorage is alive actually
-        instantiates it if it isn't yet.  Fourth, I forgot DOM_STORAGE guards around
-        it.  So I'm reverting that change completely and doing it more cleanly.
-        Unfortunately, the solution isn't as portable (and thus I've left out the JSC
-        implementation for now).
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
 
-        NOTE: This change now tracks recursion on function callbacks in V8.  I ran this
-        by Mads Ager and Mike Belshe and they seemed to think adding the checks were
-        fine.  Most callbacks are asynchronous and thus wouldn't be nested.  The few
-        scenareos where you can have nested callbacks probably should have always been
-        protected by a recursion guard.
+2010-02-23  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Unfortunately, this can't be tested without a hook added to the layout test
-        controllers since the lock is (by design) not supposed to be observable by
-        JavaScript.  https://bugs.webkit.org/show_bug.cgi?id=28906
+        Reviewed by Laszlo Gombos.
 
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): revert
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): revert
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::runScript):
-            Add releaseStorageMutex call.  A small amount of clean up.
-        (WebCore::V8Proxy::callFunction):
-            Add releaseStorageMutex call.  A small amount of clean up.
-        (WebCore::V8Proxy::releaseStorageMutex):
-            Check to see if localStorage has been instantiated.  If so, tell it to
-            unlock all storage areas.
-        * bindings/v8/V8Proxy.h:
-        * page/PageGroup.h:
-        (WebCore::PageGroup::hasLocalStorage):  Make hasLocalStorage public.
+        [Qt] Correct build problems while building QtWebKit inside Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=34975
 
-2009-09-02  Yong Li  <yong.li@torchmobile.com>
+        * WebCore.pro: Change the condition !standalone_package to !QTDIR_build
 
-        Reviewed by Adam Barth.
+2010-02-23  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        WINCE PORT: Implement ImageBuffer for WINCE
-        Implement Image interface with a light class BufferedImage
-        for rendering ImageBuffer
-        https://bugs.webkit.org/show_bug.cgi?id=28167
+        Reviewed by Ariya Hidayat.
 
-        * platform/graphics/wince/ImageBufferData.h: Added.
-        * platform/graphics/wince/ImageBufferWince.cpp: Added.
+        [Qt] Connect video with accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=35276
+
+        MediaControlPrivate and GraphicsLayer are patched together via
+        a shared PlatformLayer (QGraphicsItem). This patch makes sure that the
+        QGraphicsVideoItem from MediaControl becomes part of the scene 
+        associsated with GraphicsLayer
+
+        Test: http://double.co.nz/video_test/test1.html with AC turned on
+
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::): mediaLayer member
+        (WebCore::GraphicsLayerQtImpl::opaqueArea): video is opaque
+        (WebCore::GraphicsLayerQtImpl::paint): don't paint video
+        (WebCore::GraphicsLayerQtImpl::flushChanges): flush mediaLayer
+        (WebCore::GraphicsLayerQt::setContentsToMedia): notify
+        * platform/graphics/qt/GraphicsLayerQt.h: reimp setContentsToMedia
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): m_compositing
+        (WebCore::MediaPlayerPrivate::paint): don't paint if compositing
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
+        reimp from MediaPlayerPrivateInterface to support AC
+        (WebCore::MediaPlayerPrivate::platformLayer): ditto
+        * platform/graphics/qt/MediaPlayerPrivateQt.h: 
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering): ditto
 
-2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-02-23  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by Eric Seidel.
 
-        Join the various PluginView destructors into one shared implementation
-
-        https://bugs.webkit.org/show_bug.cgi?id=27706
+        Fix various issues in PlatformWheelEventHaiku.
+        https://bugs.webkit.org/show_bug.cgi?id=34685
 
-        The Qt port used to delete the platform plugin widget as the last step.
-        Now this is done before cleaning up the script objects and unloading the
-        plugin package, similar to how the Win port does it.
+        Covered by existing tests.
+        
+        Fixed coding style violations.
+        Synced extracting the correct coordinates with Haiku WebKit implementation.
+        Added extracting modifier key flags.
 
-        * plugins/PluginView.cpp:
-        * plugins/PluginViewNone.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/mac/PluginViewMac.cpp:
-        * plugins/qt/PluginViewQt.cpp:
-        * plugins/win/PluginViewWin.cpp:
+        * platform/haiku/PlatformWheelEventHaiku.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
 
-2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-02-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
         Reviewed by Eric Seidel.
 
-        Share PluginView::init() between ports
-
-        https://bugs.webkit.org/show_bug.cgi?id=27706
-
-        The port-spesific bits are moved to platformStart(), which now returns
-        a bool based on the success of the platformStart.
+        Build fix for PluginView
+        https://bugs.webkit.org/show_bug.cgi?id=35230
 
-        m_hasPendingGeometryChange is now initialized in the initializer list
-        instead of in PluginViewQt's init()
-
-        PluginViewMac (currently used only by the Qt port) used to manually call
-        stop() in the case where an unsupported drawing or event model was detected.
-        This was wrong, as the m_status and m_isStarted fields should be used to
-        guard against doing operations on a plugin in this intermediate state.
+        No new tests, build fix only.
 
         * plugins/PluginView.cpp:
         * plugins/PluginView.h:
         * plugins/PluginViewNone.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/mac/PluginViewMac.cpp:
-        * plugins/qt/PluginViewQt.cpp:
-        * plugins/win/PluginViewWin.cpp:
-
-2009-09-02  Ben Murdoch  <benm@google.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=28737
-        
-        Update JavaScript bindings in JSC and V8 for SQLTransaction to throw exceptions in the right places.
-
-        * bindings/js/JSSQLTransactionCustom.cpp:
-        (WebCore::JSSQLTransaction::executeSql): Throw an exception if no parameters are passed to executeSql().
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8ValueToWebCoreString): Catch an exception if thrown from toString().
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Allow "arrayish objects" to be passed to executeSql.
-
-2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
 
-        WebInspector: Migrate Databases tab to InjectedScript /
-        serialized interaction.
+2010-02-23  Kwang Yul Seo  <skyul@company100.net>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28873
-
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
-        * inspector/front-end/Database.js:
-        (WebInspector.Database.prototype.isDB):
-        (WebInspector.Database.prototype.runWithTableNames.sortingCallback):
-        (WebInspector.Database.prototype.runWithTableNames):
-        (WebInspector.Database.prototype.executeSql):
-        (WebInspector.Database.prototype.executeSql.errorCallback):
-        (WebInspector.Database.prototype.executeSql.queryTransaction):
-        * inspector/front-end/DatabaseQueryView.js:
-        (WebInspector.DatabaseQueryView.prototype._enterKeyPressed):
-        (WebInspector.DatabaseQueryView.prototype._queryFinished):
-        * inspector/front-end/DatabaseTableView.js:
-        (WebInspector.DatabaseTableView):
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel.prototype.selectDatabase):
-        (WebInspector.StoragePanel.prototype.updateDatabaseTables.withTableNames):
-        (WebInspector.StoragePanel.prototype.updateDatabaseTables):
-        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate.withTableNames):
-        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate):
-
-2009-09-02  Pavel Feldman  <pfeldman@chromium.org>
-
-        Not reviewed (trivial followup fix). 
-        
-        Web Inspector: Trivial follow up fix to r47944.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28800
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::nodeForId):
-
-2009-09-01  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by John Sullivan.
-
-        Fixed a bug in handling of isReadOnly, where textareas were casted to HTMLInputElements.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::isReadOnly):
-
-2009-09-01  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
-
-        Reviewed by Timothy Hatcher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28047
-        add utility method to enable logging messages for inspector development
-
-        manual test case added (see below)
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleMessage.prototype.toMessageElement):
-        (WebInspector.ConsoleMessage.prototype.toString):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.log):
-        * manual-tests/inspector/webinspector-log.html: Added.
-        * page/Console.cpp:
-        (WebCore::printMessageSourceAndLevelPrefix):
-        * page/Console.h:
-        (WebCore::):
-
-2009-09-01  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21990
-        When a rare EUC-JP character is present, explicitly (and correctly) labelled EUC-JP document
-        is mistreated as Shift_JIS
-
-        <rdar://problem/5828506> Safari should not try auto-detecting if charset information exists
-
-        WebKit used to unconditionally auto-detect document encoding if it was one of Japanese ones.
-        This didn't really match any browser, and did cause problems on some sites.
-
-        Our detector is very quick to label an EUC-JP page as Shift_JIS if it notices a byte that
-        cannot be part of EUC-JP source. However, such bytes do appear in Web pages sometimes,
-        especially in comments. Also, some valid EUC-JP sequences are not known to it.
-
-        Some pages that are fixed by this change:
-
-        <rdar://problem/5934750> Encoding in incorrect at http://cocodeparis.blog45.fc2.com/. This
-        page has incorrect encoding in title, so no browser displays it 100% fine. We now match
-        Firefox and IE.
-
-        <rdar://problem/6007713> The web page http://www.sf.us.emb-japan.go.jp/top.htm is garbled
-        in Safari. There is a stray byte in comments that was makes charset detector think it can't
-        be EUC-JP.
-
-        <rdar://problem/6965711> A Japanese web page www.nippontv.studiolegend.tv is garbled in
-        Safari. Many comments on this page are encoded as Shift_JIS - IE magically displays that
-        fine in View Source mode (it doesn't seem to have an ability to switch between EUC-JP and
-        Shift_JIS in normal HTML view though).
-
-        Test: fast/encoding/japanese-encoding-mix.html
-
-        * loader/TextResourceDecoder.cpp: (WebCore::TextResourceDecoder::decode): Only invoke auto-
-        detection if there is no solid charset information yet.
-
-2009-09-01  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] FileList cannot be accessed via index in Chromium.
-        https://bugs.webkit.org/show_bug.cgi?id=28883
-
-        Tested by clipboard-file-access.html.
-
-        * WebCore.gypi:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8FileListCustom.cpp: Added.
-
-2009-08-31  Jon Honeycutt  <jhoneycutt@apple.com>
+        Reviewed by Eric Seidel.
 
-        Remove the workaround added in r47316.
+        [BREWMP] Port ScriptController::createScriptInstanceForWidget
+        https://bugs.webkit.org/show_bug.cgi?id=34413
 
-        Reviewed by Sam Weinig.
+        * bindings/js/ScriptControllerBrew.cpp: Added.
+        (WebCore::ScriptController::createScriptInstanceForWidget):
 
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::AXObjectCache):
+2010-02-23  José Millán Soto  <jmillan@igalia.com>
 
-        * accessibility/AXObjectCache.h:
-        Remove the Document argument to the AXObjectCache constructor and the
-        m_document member variable, and replace the no-parameter
-        handleFocusedUIElementChanged() with the two-parameter GTK function.
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Reviewed by Eric Seidel.
 
-        * accessibility/chromium/AXObjectCacheChromium.cpp:
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        [Gtk] Webkit crashes when using orca
+        https://bugs.webkit.org/show_bug.cgi?id=35169
 
-        * accessibility/gtk/AXObjectCacheAtk.cpp:
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Made webkit_accessible_text_get_caret_offset check if end selection
+        node is null.
 
         * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (fallbackObject):
-        Don't pass a null Document when constructing the AXObjectCache.
-
-        * accessibility/mac/AXObjectCacheMac.mm:
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-
-        * accessibility/win/AXObjectCacheWin.cpp:
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-        Get the document from the RenderObject; m_document was removed.
-
-        * dom/Document.cpp:
-        (WebCore::Document::axObjectCache):
-        Don't pass the Document when constructing the AXObjectCache.
-        (WebCore::Document::setFocusedNode):
-        Pass the old and new focused RenderObjects when calling
-        handleFocusedUIElementChanged().
-
-2009-09-01  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Check that InspectorDOMAgent and InspectorFrontend are not null
-        before accessing them in InspectorBackend. They may be null if
-        InspectorController is closed before an asynchronous operation is
-        started.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28800
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getCookies):
-        (WebCore::InspectorBackend::getChildNodes):
-        (WebCore::InspectorBackend::setAttribute):
-        (WebCore::InspectorBackend::removeAttribute):
-        (WebCore::InspectorBackend::setTextNodeValue):
-        (WebCore::InspectorBackend::highlight):
-        (WebCore::InspectorBackend::nodeForId):
-        (WebCore::InspectorBackend::pushNodePathToFrontend):
-        (WebCore::InspectorBackend::addNodesToSearchResult):
-        (WebCore::InspectorBackend::selectDatabase):
-        (WebCore::InspectorBackend::selectDOMStorage):
-        (WebCore::InspectorBackend::inspectorDOMAgent):
-        (WebCore::InspectorBackend::inspectorFrontend):
-        * inspector/InspectorBackend.h:
-
-2009-09-01  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Page Cache should support pages with frames
-        https://bugs.webkit.org/show_bug.cgi?id=13631
-
-        Things learned in the full task that this patch addresses:
-        - The notions of clearing a CachedFrame and destroying a CachedFrame were two concepts that 
-          needed to be managed separately.
-        - Once we start restoring pages with multiple CachedFrames, we'll have to be calling
-          FrameLoader::open(CachedFrame&) multiple times with different CachedFrames, and this process
-          will be guided by the CachedFrames themselves.
-
-        No new tests. (No change in behavior, current layout tests pass)
-        
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrame::CachedFrame):
-        (WebCore::CachedFrame::~CachedFrame):
-        (WebCore::CachedFrame::clear): Only clear pointers out.
-        (WebCore::CachedFrame::destroy): Perform the destructive cleanup work here - Things that shouldn't
-          occur simply by navigating back to a page with a CachedFrame.
-        * history/CachedFrame.h:
-
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::~CachedPage):
-        (WebCore::CachedPage::restore): Call clear() after restoring.
-        (WebCore::CachedPage::clear):
-        (WebCore::CachedPage::destroy):
-        * history/CachedPage.h:
-
-        * history/PageCache.cpp:
-        (WebCore::PageCache::releaseAutoreleasedPagesNow): destroy() CachedPages that are being pruned,
-          instead of clearing them.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::commitProvisionalLoad): Let the CachedPage clear() itself after restoring.
-        (WebCore::FrameLoader::open): Don't ::open() the CachedFrame, as the CachedPage does that now.
-        * loader/FrameLoader.h:  Add the friending so CachedPage and CachedFrame can better guide the process.
-          Even though CachedFrame::restore() isn't used for now, it will be soon.
-
-2009-09-01  Andrei Popescu  <andreip@google.com>
-
-        Reviewed by David Levin.
-
-        Add a "lowMemoryNotification" method to the V8 ScriptController class.
-        This is needed in order to allow the host application (Android Web browser in this case)
-        to call the v8::V8::LowMemoryNotification() method added to V8 in
-        http://code.google.com/p/v8/source/detail?spec=svn2777&r=2725
-        
-        https://bugs.webkit.org/show_bug.cgi?id=28776
-
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::lowMemoryNotification):
-        * bindings/v8/ScriptController.h:
-
-2009-09-01  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        V8 Bindings for WebSocket API.
-        https://bugs.webkit.org/show_bug.cgi?id=28844
-
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::convertToV8Object):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
-        * bindings/v8/V8DOMWrapper.h:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8WebSocketCustom.cpp: Added.
-
-2009-09-01  Peter Kasting  <pkasting@google.com>
-
-        Unreviewed (build fix).
-
-        Missed a "." -> "->" conversion.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
-
-2009-09-01  Peter Kasting  <pkasting@google.com>
-
-        Unreviewed (build fix).
-
-        Try to fix Qt build, take 2.  The Qt code had what looks like a
-        broken virtual function override.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
-        (WebCore::ImageDecoderQt::setData):
-        * platform/graphics/qt/ImageDecoderQt.h:
-
-2009-09-01  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        Uninitialized variable in XSSAuditor
-        https://bugs.webkit.org/show_bug.cgi?id=28874
-
-        One ought to initialize variables before use even when it doesn't
-        matter.  No behavior change.
-
-        * page/XSSAuditor.h:
-        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer):
-
-2009-09-01  Peter Kasting  <pkasting@google.com>
-
-        Unreviewed (build fix).
-
-        Try to fix Qt build.
-
-        * platform/graphics/ImageSource.cpp:
+        (webkit_accessible_text_get_caret_offset):
 
-2009-08-28  Peter Kasting  <pkasting@google.com>
+2010-02-22  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27965
-        Eliminate most of ImageSourceQt.cpp in favor of ImageSource.cpp.
-
-        * WebCore.pro:
-        * platform/graphics/ImageSource.cpp:
-        (WebCore::ImageSource::frameHasAlphaAtIndex):
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::createFrameAtIndex):
-        (WebCore::ImageSource::frameHasAlphaAtIndex):
-        (WebCore::ImageSource::frameIsCompleteAtIndex):
-
-2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Make InjectedScript self-contained (move necessary
-        methods from utilities.js into InjectedScript).
-
-        https://bugs.webkit.org/show_bug.cgi?id=28871
-
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.generateStylesheet):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
-        (InjectedScript._ensureCommandLineAPIInstalled):
-        (InjectedScript.pushNodeToFrontend):
-        (InjectedScript.createProxyObject):
-        (Object.type):
-        (Object.hasProperties):
-        (Object.className):
-        (String.prototype.escapeCharacters):
-        * inspector/front-end/utilities.js:
-
-2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: console log message repeat count double.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28856
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._evaluateOn):
-
-2009-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Mark Rowe.
+        [Haiku] Implemented PopupMenu support.
+        https://bugs.webkit.org/show_bug.cgi?id=35078
 
-        [Gtk] Fix DATALIST build
-        https://bugs.webkit.org/show_bug.cgi?id=28826
+        Covered by existing tests.
 
-        Add ENABLE_DATALIST to FEATURE_DEFINES.
+        The implementation is currently very simple: Added a PopupMenuHaiku
+        class that derives from a native BPopUpMenu. It attaches a BHandler
+        derivative to the BApplication (WebCore main thread) which receives
+        the item invokation and menu hidden events and informs the PopupMenuClient
+        accordingly.
 
-        * GNUmakefile.am:
+        * platform/PopupMenu.h:
+            Changed type of m_menu for Haiku.
+        * platform/haiku/PopupMenuHaiku.cpp:
+        (WebCore::PopupMenuHandler::PopupMenuHandler):
+        (WebCore::PopupMenuHandler::MessageReceived):
+        (WebCore::PopupMenuHaiku::PopupMenuHaiku):
+        (WebCore::PopupMenuHaiku::~PopupMenuHaiku):
+        (WebCore::PopupMenuHaiku::show):
+        (WebCore::PopupMenuHaiku::hide):
+        (WebCore::PopupMenuHaiku::Hide):
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::~PopupMenu):
+            Removed bogus code.
+        (WebCore::PopupMenu::show):
+            Implemented using new PopupMenuHaiku class.
+        (WebCore::PopupMenu::hide):
+            Implemented using new PopupMenuHaiku class.
+        (WebCore::PopupMenu::updateFromElement):
+            Implemented.
+        (WebCore::PopupMenu::itemWritingDirectionIsNatural):
+            Implemented according to Gtk port.
 
-2009-09-01  Cameron McCormack  <cam@mcc.id.au>
+2010-02-22  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by Eric Seidel.
 
-        SVGSVGElement suspend methods argument/return types incorrect
-        https://bugs.webkit.org/show_bug.cgi?id=28860
+        Fix various issues in PlatformMouseEventHaiku.
+        https://bugs.webkit.org/show_bug.cgi?id=34685
 
-        Also fix the style of the argument names.
+        Covered by existing tests.
+        
+        Mapping Haiku button constants (bit field) to WebCore buttons was broken.
+        Extracting event time was broken (supposed to be in seconds).
+        Wrong coordinate was being extracted, needs to be content local.
+        Added extracting modifier key flags.
 
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::suspendRedraw):
-        (WebCore::SVGSVGElement::unsuspendRedraw):
-        * svg/SVGSVGElement.h:
+        * platform/haiku/PlatformMouseEventHaiku.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
 
-2009-09-01  Roland Steiner  <rolandsteiner@google.com>
+2010-02-22  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by Eric Seidel.
 
-        Fix bug 28808:  [Skia] Fix flaky layout test svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html [DEBUG]
-        (https://bugs.webkit.org/show_bug.cgi?id=28808)
-
-        The bug fix adds an explicit check for the validity of the path when it is 
-        transformed into local coordinates. 
-        This was the most suitable place I could find that didn't cause an inordinate 
-        amount of refactoring. Also, it seems pertinent and may also catch other cases 
-        that are not limited to clipping paths.
+        [Haiku] Implement creating and filling platform gradients.
+        https://bugs.webkit.org/show_bug.cgi?id=34683
 
-        TEST: existing svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html
+        Covered by existing tests.
 
-        * platform/graphics/skia/GraphicsContextSkia.cpp: make isPathSkiaSafe accessible
-        (WebCore::):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::currentPathInLocalCoordinates): check Skia safety of path
+        * platform/graphics/Gradient.h:
+            Typedef PlatformGradient to BGradient
+        * platform/graphics/haiku/GradientHaiku.cpp:
+        (WebCore::Gradient::platformDestroy):
+            Delete the cached BGradient object.
+        (WebCore::Gradient::platformGradient):
+            Create a BGradient object according to the type of Gradient.
+            Return the cached object.
+        (WebCore::Gradient::fill):
+            use BView API to fill with the platform gradient.
 
-2009-09-01  Yusuke Sato  <yusukes@chromium.org>
+2010-02-22  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by Eric Seidel.
 
-        [Chromium] Combining Diacritical Marks (U+0300..) are not handled correctly.
-        https://bugs.webkit.org/show_bug.cgi?id=28742 
-
-        Normalize (NFC) a TextRun when the run contains combining diacritical marks
-        so that Skia can pick a correct glyph without relying on GSUB table in a font.
-        This change is for Chromium Linux.
-
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::TextRunWalker::getTextRun): Added.
-        (WebCore::TextRunWalker::getNormalizedTextRun): Added.
-
-        This function is called when the run contains U+0300..U+036F and converts characters in
-        the run to the combined form (NFC) using ICU.
+        Build fix for debug builds of GlyphPageTreeNode.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=34528
 
-2009-09-01  Vitaly Repeshko  <vitalyr@chromium.org>
+        Covered by existing tests.
 
-        Reviewed by Dimitri Glazkov.
+        * platform/graphics/GlyphPageTreeNode.cpp:
+            include <stdio.h> since printf() is used if NDEBUG is not defined.
 
-        [V8] Inlined fast paths of V8DOMWrapper::convertNodeToV8Object and
-        V8Proxy::createWrapperFromCache.
-        https://bugs.webkit.org/show_bug.cgi?id=28848
+2010-02-22  Nate Chapin  <japhet@chromium.org>
 
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertDocumentToV8Object): Special
-        function for document wrapping.
-        (WebCore::V8DOMWrapper::convertNewNodeToV8Object): Slow case of
-        wrapping a new node.
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertNodeToV8Object): Extracted fast
-        path from V8DOMWrapper.cpp.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::createWrapperFromCache): Extracted fast path
-        from V8Proxy.cpp.
-
-2009-09-01  Eric Seidel  <eric@webkit.org>
+        Unreviewed, Chromium build fix.
 
-        No review, windows build fix only.  Clearly I should have read the patch closer. :(
+        Add special case in CodeGeneratorV8.pm for named getters for html plugin-related elements.
 
-        Allow excluding certain plugins from loading
-        https://bugs.webkit.org/show_bug.cgi?id=28677
+        CodeGeneratorV8.pm was relying on HasOverridingNameGetter to hint
+        that a custom named getter was needed. That hint was removed in
+        http://trac.webkit.org/changeset/55104.
 
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::refresh):
+        * bindings/scripts/CodeGeneratorV8.pm:
 
-2009-09-01  Alexander Pavlov  <apavlov@chromium.org>
+2010-02-22  Alexey Proskuryakov  <ap@apple.com>
 
-        Reviewed by Timothy Hatcher.
+        Rubber-stamped by Geoff Garen.
 
-        Implement conditional breakpoints in the Web Inspector backend
-        and add frontend JavaScript stubs.
-        https://bugs.webkit.org/show_bug.cgi?id=28846
+        Rename RuntimeObjectImp to RuntimeObject.
 
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::profiles):
-        (WebCore::InspectorBackend::addBreakpoint):
-        (WebCore::InspectorBackend::updateBreakpoint):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::BreakpointInfo::condition):
-        (WebCore::JavaScriptDebugServer::BreakpointInfo::setCondition):
-        (WebCore::JavaScriptDebugServer::addBreakpoint):
-        (WebCore::JavaScriptDebugServer::breakpointInfo):
-        (WebCore::JavaScriptDebugServer::updateBreakpoint):
-        (WebCore::JavaScriptDebugServer::updateBreakpointInfo):
-        (WebCore::JavaScriptDebugServer::removeBreakpoint):
-        (WebCore::JavaScriptDebugServer::hasBreakpoint):
-        (WebCore::JavaScriptDebugServer::clearBreakpoints):
-        * inspector/JavaScriptDebugServer.h:
-        (WebCore::JavaScriptDebugServer::BreakpointInfo::BreakpointInfo):
-        * inspector/front-end/Breakpoint.js:
-        (WebInspector.Breakpoint):
-        (WebInspector.Breakpoint.prototype.get id):
-        (WebInspector.Breakpoint.prototype.get condition):
-        (WebInspector.Breakpoint.prototype.set condition):
-        * inspector/front-end/BreakpointsSidebarPane.js:
-        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
-        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.addScript):
+        * WebCore.PluginHostProcess.exp:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::getRuntimeObject):
+        (WebCore::runtimeObjectPropertyGetter):
+        (WebCore::runtimeObjectCustomGetOwnPropertySlot):
+        (WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
+        (WebCore::runtimeObjectCustomPut):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::convertValueToJObject):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jsc/BridgeJSC.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        (JSC::Bindings::Instance::newRuntimeObject):
+        * bridge/jsc/BridgeJSC.h:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObject::markChildren):
+        (JSC::Bindings::):
+        (JSC::Bindings::QtRuntimeObject::QtRuntimeObject):
+        (JSC::Bindings::QtInstance::getInstance):
+        (JSC::Bindings::QtInstance::newRuntimeObject):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapRuntimeObject::QtPixmapRuntimeObject):
+        (JSC::Bindings::):
+        (JSC::Bindings::QtPixmapInstance::variantFromObject):
+        (JSC::Bindings::QtPixmapInstance::createRuntimeObject):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::valueRealType):
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObject::RuntimeObject):
+        (JSC::RuntimeObject::~RuntimeObject):
+        (JSC::RuntimeObject::invalidate):
+        (JSC::RuntimeObject::fallbackObjectGetter):
+        (JSC::RuntimeObject::fieldGetter):
+        (JSC::RuntimeObject::methodGetter):
+        (JSC::RuntimeObject::getOwnPropertySlot):
+        (JSC::RuntimeObject::getOwnPropertyDescriptor):
+        (JSC::RuntimeObject::put):
+        (JSC::RuntimeObject::deleteProperty):
+        (JSC::RuntimeObject::defaultValue):
+        (JSC::callRuntimeObject):
+        (JSC::RuntimeObject::getCallData):
+        (JSC::callRuntimeConstructor):
+        (JSC::RuntimeObject::getConstructData):
+        (JSC::RuntimeObject::getOwnPropertyNames):
+        (JSC::RuntimeObject::throwInvalidAccessError):
+        * bridge/runtime_object.h:
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::invalidate):
+        (JSC::Bindings::RootObject::addRuntimeObject):
+        (JSC::Bindings::RootObject::removeRuntimeObject):
+        * bridge/runtime_root.h:
 
-2009-09-01  Marius Renn  <damarvy@gmail.com>
+2010-02-19  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Eric Seidel.
 
-        Added delegate to PluginDatabase to disable loading certain plugins.
-        This is useful when you want to load from the standard plugin
-        directory, but want to exclude certain plugins. Plugins may be
-        excluded early on by name, so that no plugin code is executed (which
-        may have caused a crash).
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::PluginDatabase):
-        (WebCore::PluginDatabase::refresh):
-        * plugins/PluginDatabase.h:
-        (WebCore::PluginDatabase::setClient):
-        * plugins/PluginDatabaseClient.h: Added.
-        (WebCore::PluginDatabaseClient::~PluginDatabaseClient):
-
-2009-08-31  Brady Eidson  <beidson@apple.com>
-
-        Rubberstamped by Sam Weinig
-
-        * WebCore.base.exp: Removed an unneeded symbol export.
-
-2009-08-31  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28466
-        When downloading a file, two GET requests are sent to the HTTP server
-
-        Can't think of a way to test this.
-
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::releaseResources): only nullify the
-        handle's client when it is the ResourceLoader, to support the case
-        in which a download API uses a different client
-
-2009-08-31  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Darin Adler.
+        Avoid recursion when trying to get the size of a PNG; it's unnecessary
+        and in the worst case can lead to heap corruption.
+        https://bugs.webkit.org/show_bug.cgi?id=35167
 
-        Text Fields and Text Areas are reported as read-only by inspect32.exe.
-        https://bugs.webkit.org/show_bug.cgi?id=28854
+        Test: fast/images/bad-png.html
 
-        Added another case in AcccessibiltyRenderObject::isReadOnly to test if text fields
-        and texts areas are read-only.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::isReadOnly):
-        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
-
-2009-08-31  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        fast/workers/worker-lifecycle.html crashes intermittently on snowleopard
-        https://bugs.webkit.org/show_bug.cgi?id=28795
-
-        Changed WorkerContext::close() to no longer stop the worker thread.
-        It is now the parent's responsibility to shut down the worker thread when it is notified that the context is closed.
-
-        * workers/AbstractWorker.cpp:
-        Updated dispatchScriptErrorEvent to pass-through the "handled" value from dispatchEvent(), to allow event handlers added with addEventListener() to mark events as handled.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::workerContextClosed):
-        Now shuts down the worker thread when notified that the context is closed.
-        (WebCore::SharedWorkerProxy::close):
-        Now handles being invoked when the context is already in the process of shutting down.
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::close):
-        No longer calls WorkerThread::stop() to avoid race conditions with shutting down the thread while the parent is still interacting with it.
-        * workers/WorkerContext.h:
-        (WebCore::WorkerContext::isClosing):
-        isClosing() is now public so WorkerRunLoop can call it to determine whether to process tasks.
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::WorkerExceptionTask::performTask):
-        Error events should still be delivered even if the worker thread is closing.
-        Also fixed problem where error events were not dispatched if error handlers were added via addEventListener().
-        (WebCore::WorkerTerminateTask::create):
-        New task that invokes terminateWorkerContext() on the parent thread when the context is closed.
-        (WebCore::WorkerTerminateTask::WorkerTerminateTask):
-        (WebCore::WorkerTerminateTask::performTask):
-        (WebCore::WorkerMessagingProxy::workerContextClosed):
-        Now fires off a WorkerTerminateTask to shut down the thread when the context is closed.
-        * workers/WorkerMessagingProxy.h:
-        WorkerMessagingProxy now overrides workerContextClosed().
-        * workers/WorkerRunLoop.cpp:
-        (WebCore::WorkerRunLoop::runInMode):
-        Now drops tasks on the floor if the WorkerContext is closing.
-
-2009-08-31  Ojan Vafai  <ojan@chromium.org>
-
-        Not reviewed (build fix)
-
-        Build fix for Chromium to match r49707.
-
-        * bindings/v8/ScriptCallFrame.cpp:
-        (WebCore::ScriptCallFrame::ScriptCallFrame):
-        * bindings/v8/ScriptSourceCode.h:
-        (WebCore::ScriptSourceCode::ScriptSourceCode):
-        * platform/KURLGoogle.cpp:
-        (WebCore::KURL::KURL):
-        (WebCore::blankURL):
-
-2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28858
-        Element.baseURI parses xml:base attribute incorrectly
-
-        Test: fast/dom/base-attribute-parsing.xhtml
-
-        * dom/Element.cpp: (WebCore::Element::baseURI): Avoid assertion failure (no change in
-        release mode).
-
-2009-08-31  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reverting http://trac.webkit.org/changeset/47904, because it caused
-        layout test failure.
-
-        Test: fast/dom/Window/new-window-opener.html
-
-2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::decode):
 
-        Reviewed by Darin Adler.
+2010-02-22  Brady Eidson  <beidson@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28852
-        Rename KURL single argument constructor to avoid confusion
+        Reviewed by Tim Hatcher.
 
-        * platform/KURL.h: The constructor that used to be single argument should now be invoked
-        as KURL(ParsedURLString, myString).
+        Disable WebView docking to views that are too small.
+        <rdar://problem/7248409> and https://bugs.webkit.org/show_bug.cgi?id=35254
 
         * WebCore.base.exp:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        * bindings/js/ScriptCallFrame.cpp:
-        (WebCore::ScriptCallFrame::ScriptCallFrame):
-        * bindings/v8/NPV8Object.cpp:
-        (_NPN_EvaluateHelper):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        * css/CSSCursorImageValue.cpp:
-        (WebCore::isSVGCursorIdentifier):
-        * css/CSSImageValue.cpp:
-        (WebCore::CSSImageValue::cachedImage):
-        * css/CSSImportRule.cpp:
-        (WebCore::CSSImportRule::insertedIntoParent):
-        * css/StyleBase.cpp:
-        (WebCore::StyleBase::baseURL):
-        * dom/Document.cpp:
-        (WebCore::Document::initSecurityContext):
-        * dom/Element.cpp:
-        (WebCore::Element::baseURI):
-        * editing/markup.cpp:
-        (WebCore::completeURLs):
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::url):
-        (WebCore::HistoryItem::originalURL):
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
-        * inspector/InspectorResource.cpp:
-        (WebCore::InspectorResource::createCached):
-        * loader/Cache.cpp:
-        (WebCore::Cache::revalidateResource):
-        * loader/DocLoader.cpp:
-        (WebCore::DocLoader::requestResource):
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::getSubresources):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::init):
-        (WebCore::FrameLoader::iconURL):
-        (WebCore::FrameLoader::scheduleLocationChange):
-        (WebCore::FrameLoader::redirectionTimerFired):
-        (WebCore::FrameLoader::loadURLIntoChildFrame):
-        (WebCore::FrameLoader::startRedirectionTimer):
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::resourceForURL):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::startLoadingEntry):
-        (WebCore::ApplicationCacheGroup::addEntry):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
-        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
-        (WebCore::ApplicationCacheStorage::loadCache):
-        (WebCore::ApplicationCacheStorage::manifestURLs):
-        * loader/archive/cf/LegacyWebArchive.cpp:
-        (WebCore::LegacyWebArchive::createResource):
-        (WebCore::LegacyWebArchive::create):
-        * loader/loader.cpp:
-        (WebCore::Loader::load):
-        * notifications/NotificationCenter.h:
-        (WebCore::NotificationCenter::createHTMLNotification):
-        * platform/KURL.cpp:
-        (WebCore::KURL::KURL):
-        (WebCore::blankURL):
-        * platform/KURLHash.h:
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::setData):
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::createQTMovie):
-        * platform/network/cf/ResourceErrorCF.cpp:
-        (WebCore::ResourceError::operator CFErrorRef):
-        * platform/network/cf/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/network/chromium/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::handleLocalReceiveResponse):
-        (WebCore::headerCallback):
-        * platform/network/curl/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/network/mac/ResourceErrorMac.mm:
-        (WebCore::ResourceError::operator NSError*):
-        * platform/network/mac/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/network/qt/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/network/soup/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::filesystemPathFromUrlOrTitle):
-        (WebCore::ClipboardWin::setData):
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::dataChanged):
-        * xml/XSLImportRule.cpp:
-        (WebCore::XSLImportRule::loadSheet):
-        * xml/XSLTProcessor.cpp:
-        (WebCore::docLoaderFunc):
-        Adapt to the change everywhere the single argument constructor was used. I did a very
-        cursory check of whether these locations were using this constructor properly, and didn't
-        notice any obvious mistakes. The new explicit name will hopefully suggest checking this
-        better when refactoring any such code.
-
-2009-08-31  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=28635 [CSS3 
-        Backgrounds and Borders] Add support for 2-keyword values for 
-        background-repeat
-
-        This patch allows background-repeat to take two values by making 
-        background-repeat just like background-position internally. There 
-        is a little extra legwork for background-repeat because the spec 
-        indicates that its computed value should be equivalent to how it 
-        was specified. I keep track of the specified thing by setting the 
-        implicit flag whenever background-repeat is defined with only one 
-        value (since internally, we now store this as 2 values.)
-        
-        Here we can't access the implicit flag, so for backwards-
-        compatibility's sake, we always return one value when that makes 
-        sense.
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::fillRepeatToCSSValue):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-
-        Here we check for the implicit flag and return one value when it is 
-        set.
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
-        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
-        (WebCore::CSSMutableStyleDeclaration::cssText):
-
-        Add support for CSSPropertyBackgroundRepeatX and 
-        CSSPropertyBackgroundRepeatY
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseFillShorthand):
-        (WebCore::CSSParser::parseFillRepeat):
-        (WebCore::CSSParser::parseFillProperty):
-        * css/CSSParser.h:
-
-        Get rid of mappings to RepeatXFill and RepeatYFill since we don't 
-        need those parts of the EFillRepeat enum anymore.
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
-
-        Add CSSPropertyBackgroundRepeatX and CSSPropertyBackgroundRepeatY
-        * css/CSSPropertyLonghand.cpp:
-        (WebCore::initShorthandMap):
-
-        Add background-repeat-x and -y.
-        * css/CSSPropertyNames.in:
-
-        Break repeat into x and y.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        (WebCore::CSSStyleSelector::mapFillRepeatX):
-        (WebCore::CSSStyleSelector::mapFillRepeatY):
-        * css/CSSStyleSelector.h:
-
-        There is no more RepeatXFill. Instead, look for 
-        fillLayer->repeatX() == RepeatFill
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
-
-        Break m_repeat into m_repeatX and m_repeatY
-        * rendering/style/FillLayer.cpp:
-        (WebCore::FillLayer::FillLayer):
-        (WebCore::FillLayer::operator=):
-        (WebCore::FillLayer::operator==):
-        (WebCore::FillLayer::fillUnsetProperties):
-        (WebCore::FillLayer::cullEmptyLayers):
-        * rendering/style/FillLayer.h:
-        (WebCore::FillLayer::repeatX):
-        (WebCore::FillLayer::repeatY):
-        (WebCore::FillLayer::isRepeatXSet):
-        (WebCore::FillLayer::isRepeatYSet):
-        (WebCore::FillLayer::setRepeatX):
-        (WebCore::FillLayer::setRepeatY):
-        (WebCore::FillLayer::clearRepeatX):
-        (WebCore::FillLayer::clearRepeatY):
-        (WebCore::FillLayer::initialFillRepeatX):
-        (WebCore::FillLayer::initialFillRepeatY):
-
-        Again, break backgroundRepeat into backgroundRepeatX and 
-        backgroundRepeatY
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::backgroundRepeatX):
-        (WebCore::InheritedFlags::backgroundRepeatY):
-        (WebCore::InheritedFlags::maskRepeatX):
-        (WebCore::InheritedFlags::maskRepeatY):
-
-        We don't need RepeatXFill or RepeatYFill. Now that we store two 
-        values, they are represented by Repeat-NoRepeat and NoRepeat-
-        Repeat, respectively.
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-
-2009-08-31  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Compositing layer size needs to take into account software reflections on children.
-        https://bugs.webkit.org/show_bug.cgi?id=28837
-        
-        When computing the bounds of a composited layer, take software-rendered
-        reflections into account.
-
-        Test: compositing/reflections/reflection-in-composited.html
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
-
-2009-08-31  Mark Mentovai  <mark@chromium.org>
-
-        Reviewed by Dave Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28614
-
-        Perform a layout prior to checking whether the scrollbar modes are
-        off, on, or automatic.  The modes may change during layout.
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-
-2009-08-31  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector Request Headers Should Show Data Sent With Request
-        https://bugs.webkit.org/show_bug.cgi?id=22920
-
-        Manual test added - see below.
-
-        * English.lproj/localizedStrings.js:
-        * inspector/InspectorResource.cpp:
-        (WebCore::InspectorResource::updateRequest):
-        (WebCore::InspectorResource::createScriptObject):
-        (WebCore::InspectorResource::updateScriptObject):
-        * inspector/InspectorResource.h:
-        * inspector/front-end/Resource.js:
-        (WebInspector.Resource):
-        * inspector/front-end/ResourceView.js:
-        (WebInspector.ResourceView):
-        (WebInspector.ResourceView.prototype._refreshURL):
-        (WebInspector.ResourceView.prototype._refreshQueryString):
-        (WebInspector.ResourceView.prototype._refreshFormData):
-        (WebInspector.ResourceView.prototype._refreshRequestPayload):
-        (WebInspector.ResourceView.prototype._refreshParms):
-        (WebInspector.ResourceView.prototype._toggleURLdecoding):
-        (WebInspector.ResourceView.prototype._getHeaderValue):
-        (WebInspector.ResourceView.prototype._refreshRequestHeaders):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.addResource):
-        (WebInspector.updateResource):
-        * manual-tests/inspector/display-form-data.html: Added.
-
-2009-08-31  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: pass call frames into the frontend as a part of
-        pausedScript event.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28847
-
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didPause):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::pausedScript):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
-        * inspector/front-end/inspector.js:
-        (WebInspector.pausedScript):
-
-2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        [Qt] Un-blacklist Silverlight on Mac
-
-        Does not seem to crash anymore, probably due to how we now handle
-        drawing and event model handshake better.
-
-        * plugins/mac/PluginPackageMac.cpp:
-        (WebCore::PluginPackage::isPluginBlacklisted):
-
-2009-08-31  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28827
-        SVGSVGElement.unsuspendRedraw() shouldn't throw
-
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::unsuspendRedraw):
-        * svg/SVGSVGElement.h:
-        * svg/SVGSVGElement.idl:
-
-2009-08-31  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        - Change the reutrn type of HTMLInputElement::list so that it
-          conforms to the standard.
-        - Add HTMLInputElement::dataList()
-        https://bugs.webkit.org/show_bug.cgi?id=28769
-
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::list):
-        (WebCore::HTMLInputElement::dataList):
-        (WebCore::HTMLInputElement::selectedOption):
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-
-2009-08-31  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Eric Seidel.
-
-        Remove ASSERT(frame) in ResourceHandle::start (ResourceHandleCurl.cpp)
-        https://bugs.webkit.org/show_bug.cgi?id=28802
-
-        Remove ASSERT because the frame could be null if the
-        ResourceHandle is not associated with any frame, e.g. if we are
-        downloading a file.
-        If the frame is not null but the page is null this must be an
-        attempted load from an onUnload handler, so let's just block it.
+        (WebCore::InspectorController::canAttachWindow): Provide a utility for WebKits to make a showWindow()
+          decision based on if attachment would be allowed or not.
+        (WebCore::InspectorController::attachWindow): Don't attach if the view is too small to attach to.
+        * inspector/InspectorController.h:
 
-        * platform/network/curl/ResourceHandleCurl.cpp:
-        (WebCore::ResourceHandle::start):
+2010-02-22  Alexey Proskuryakov  <ap@apple.com>
 
-2009-08-31  Maxime Simon  <simon.maxime@gmail.com>
+        Build fix.
 
-        Reviewed by Eric Seidel.
+        * WebCore.base.exp: Export Instance::newRuntimeObject, it's virtual!
 
-        Build fix for platforms which don't enable DOM_STORAGE.
-        https://bugs.webkit.org/show_bug.cgi?id=28834
+2010-02-22  Alexey Proskuryakov  <ap@apple.com>
 
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
+        Undo a small part of the previous commit.
 
-2009-08-29  Adele Peterson  <adele@apple.com>
+        * bridge/runtime_method.cpp: (JSC::callRuntimeMethod): Let's keep the instance local
+        variable as RefPtr for safety.
 
-        Reviewed by Dan Bernstein.
+2010-02-22  Alexey Proskuryakov  <ap@apple.com>
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=28829
-        Crash in AccessibilityRenderObject::activeDescendant when trying to set aria-activedescendant to something without a renderer
-
-        Test: accessibility/aria-activedescendant-crash.html
-
-        * accessibility/AccessibilityRenderObject.cpp: (WebCore::AccessibilityRenderObject::activeDescendant): Nil check.
+        Reviewed by Darin Adler.
 
-2009-08-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=35260
+        Eliminate __apple_runtime_object
 
-        Reviewed by Oliver Hunt.
+        No change in functionality, so no tests.
 
-        Gtk Build broken for OSX Quartz
-        https://bugs.webkit.org/show_bug.cgi?id=28727
+        * WebCore.base.exp: Don't export Instance::newRuntimeObject, WebKit doesn't need it.
 
-        Check for XP_UNIX instead of GTK or X11 to ease building of the Gtk
-        port in Mac and Unix/Linux.
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLObjectElement.idl:
+        These objects no longer need overriding name getters, as they no longer intercept the
+        __apple_runtime_object property.
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::getValueStatic):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::init):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::pluginInstance): This is no longer static. It was used for callPlugin() in
+        this file, and now it's also used elsewhere when calling plug-in methods.
+        (WebCore::runtimeObjectGetter): Removed. This function was only used by the intercepting
+        name getters.
 
-2009-08-28  Simon Fraser  <simon.fraser@apple.com>
+        * bindings/js/JSPluginElementFunctions.h: Export pluginInstance().
 
-        Reviewed by Dan Bernstein.
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        Take plug-in element's instance directly, without relying on fake attribute lookup.
+        One change resulting from this is that RuntimeObjectImp may not be created in some cases -
+        this code only needs an instance, but the old code had to pass the instance wrapped into
+        RuntimeObjectImp.
 
-        Fix positioning error when a compositing, absolutely-positioned element has an ancestor with opacity.
-        https://bugs.webkit.org/show_bug.cgi?id=28754
-        
-        For absolutely-positioned layers, convertToLayerCoords() jumps to the positioned
-        ancestor, since the layer x and y are relative to that ancestor. However, this could
-        skip over the ancestorLayer, thus giving the wrong result.
+2010-02-22  John Sullivan  <sullivan@apple.com>
         
-        Fix by duplicating the enclosingPositionedAncestor() logic in convertToLayerCoords(),
-        and checking for ancestorLayer along the way. If found, compute offset of both to
-        the enclosingPositionedAncestor() and subtract.
-        
-        This also fixes a positioning bug with abs. positioned elements in reflections,
-        so there is a new reflection test with a pixel result.
-
-        Tests: compositing/geometry/abs-position-inside-opacity.html
-               fast/reflections/abs-position-in-reflection.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::isPositionedContainer):
-        (WebCore::RenderLayer::enclosingPositionedAncestor):
-        (WebCore::RenderLayer::enclosingTransformedAncestor):
-        (WebCore::RenderLayer::convertToLayerCoords):
+        Reviewed by Tim Hatcher.
 
-2009-08-28  Simon Fraser  <simon.fraser@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35256
+        HTMLSelectElement::setSelectedIndexByUser() can trigger unnecessary JS when there is no change to the selected index
 
-        Reviewed by Mark Rowe
+        No new tests because this code path is not used for JS-initiated changes.
 
-        Wrap WebkitCSSTransformValues in the correct class of DOM wrapper.
-        https://bugs.webkit.org/show_bug.cgi?id=27727
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setSelectedIndexByUser):
+        Bail out if the to-be-selected index matches the already-selected index.
 
-        When fetching the DOM wrapper for a WebkitCSSTransformValue (which is a kind of 
-        CSSValueList), we need to ask the value list whether it's a WebkitCSSTransformValue,
-        because there is not a unique enum value for WebkitCSSTransformValue.
+2010-02-22  Enrica Casucci  <enrica@apple.com>
 
-        * bindings/objc/DOMCSS.mm:
-        (kitClass):
+        Reviewed by Dan Bernstein.
 
-2009-08-28  Peter Kasting  <pkasting@google.com>
+        Reproducible crash in WebCore::nextLinePosition on Tweeteorites.com
+        <rdar://problem/7615758>
+        https://bugs.webkit.org/show_bug.cgi?id=35060
 
-        Reviewed by Jan Michael Alonzo.
+        Test: editing/selection/extend-byline-withfloat.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=28308
-        Fix some warnings introduced by r47381.
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition): Skip elements with zero height.
+        (WebCore::nextLinePosition): Skip elements with zero height.
 
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::convertCMYKToRGBA):
-        (WebCore::convertRGBToRGBA):
+2010-02-22  Nate Chapin  <japhet@chromium.org>
 
-2009-08-28  Ada Chan  <adachan@apple.com>
+        Unreviewed, Chromium build fix.
 
-        Reviewed by Adam Roben.
+        * bindings/scripts/CodeGeneratorV8.pm: Compile break due to bad patch merge.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21442
-        Make sure filesystemPathFromUrlOrTitle() returns a string with length
-        <= MAX_PATH - 1.
-
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::filesystemPathFromUrlOrTitle):
-
-2009-08-28  Dumitru Daniliuc  <dumi@chromium.org>
+2010-02-22  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Adding Chromium's VFS for Linux and Mac.
+        [V8] Streamline V8 event listener code. Merge all the variants of
+        V8DOMWrapper::getEventListner() into a single version and generate
+        addEventListener() and removeEventListener() bindings for all objects 
+        except DOMWindow.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28750
+        https://bugs.webkit.org/show_bug.cgi?id=35245
 
+        * Android.v8bindings.mk:
         * WebCore.gypi:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
-        (WebCore::SQLiteFileSystem::openDatabase):
-        (WebCore::SQLiteFileSystem::deleteDatabaseFile):
-        * platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp: Removed.
-        * platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp: Removed.
-        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
-
-2009-08-28  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Made bindings use Node::setOnEvent functions for Node descendants
-        instead of Node::setAttributeEventListener.
-
-        Node::setAttributeEventListener is an internal function and
-        doesn't do the forwarding to DOM window that is required for some
-        HTML elements.
-        https://bugs.webkit.org/show_bug.cgi?id=28709
-
-        Tests added in http://trac.webkit.org/changeset/47326 now pass with V8.
-
         * bindings/scripts/CodeGeneratorV8.pm:
-        Now generates EventListener accessors for Node descendants instead
-        of using custom callbacks.
         * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getEventListener): Moved from V8NodeCustom.cpp.
+        (WebCore::V8DOMWrapper::getEventListener):
         * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Fixed a bug in
-        signature.
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::createHiddenDependency):
-        (WebCore::removeHiddenDependency):
-        Changed signature to accept Handle instead of Local.
-        * bindings/v8/V8Utilities.h:
-        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp: Removed.
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp: Removed.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::addEventListenerCallback):
+        (WebCore::V8DOMWindow::removeEventListenerCallback):
+        * bindings/v8/custom/V8EventSourceCustom.cpp: Removed.
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
         * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        Removed custom callbacks for EventListener accessors.
-
-2009-08-28  Ben Murdoch  <benm@google.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=28803
-        
-        Implements V8CustomVoidCallback reporting any exceptions that were thrown from the callback function.
-
-        * bindings/v8/custom/V8CustomVoidCallback.cpp:
-        (WebCore::invokeCallback): Checks if the callback raised an exception and reports it to WebCore if so.
-
-2009-08-28  Peter Kasting  <pkasting@google.com>
-
-        Not reviewed (build fix).
-
-        * platform/graphics/qt/ImageDecoderQt.cpp: Accidentally added some spaces.
-        (WebCore::ImageDecoder::create):
-        (WebCore::ImageDecoderQt::ImageDecoderQt):
-        * platform/graphics/qt/ImageDecoderQt.h: Make constructor public so factory function can access it (this seemed better than making ImageDecoder a friend).
-
-2009-08-28  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27965
-        Move ImageDecoder creation function to a factory function on
-        ImageDecoder.  This is arguably where it makes the most sense anyway,
-        and it will (soon) allow ImageSourceQt.cpp to have one less dedicated
-        function.
-
-        * platform/graphics/ImageSource.cpp:
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoder::create):
-        * platform/graphics/qt/ImageDecoderQt.h:
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::setData):
-        * platform/image-decoders/ImageDecoder.cpp:
-        * platform/image-decoders/ImageDecoder.h:
-
-2009-08-28  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28785
-        Combine duplicated code from ImageDecoder*.cpp into the main
-        ImageDecoder.cpp.
-
-        * platform/image-decoders/ImageDecoder.cpp:
-        (WebCore::RGBA32Buffer::RGBA32Buffer):
-        (WebCore::RGBA32Buffer::clear):
-        (WebCore::RGBA32Buffer::zeroFill):
-        (WebCore::RGBA32Buffer::copyBitmapData):
-        (WebCore::RGBA32Buffer::setSize):
-        (WebCore::RGBA32Buffer::hasAlpha):
-        (WebCore::RGBA32Buffer::setHasAlpha):
-        (WebCore::RGBA32Buffer::setStatus):
-        (WebCore::RGBA32Buffer::operator=):
-        (WebCore::RGBA32Buffer::width):
-        (WebCore::RGBA32Buffer::height):
-        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
-        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
-        * platform/image-decoders/wx/ImageDecoderWx.cpp:
-
-2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25889
-        [GTK] scrollbar policy for main frame is not implementable
-
-        Override setScrollbarModes to correctly forward scrollbar modes
-        policy changes to client code, via a new platform-specific method,
-        scrollbarsPolicyDidChange.
-
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::scrollbarsPolicyDidChange):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::createScrollbar):
-        * platform/ScrollView.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::setScrollbarModes):
-
-2009-08-28  Cédric Luthi <cedric.luthi@gmail.com>
-
-        Reviewed by Tor Arne Vestbø
-
-        [Qt/Mac] Un-blacklist the QuickTime plugin
-
-        https://bugs.webkit.org/show_bug.cgi?id=28768
-
-        Now that the drawing model is properly negotiated, there is no need the
-        blacklist the QuickTime plugin anymore.
-
-        This revealed a bug in PluginView::performRequest: it should not initiate a
-        request if the plugin has been stopped, which is what happens when a plugin
-        only supports the QuickDraw drawing model.
-
-        * plugins/PluginView.cpp:
-        * plugins/mac/PluginPackageMac.cpp:
-
-2009-08-28  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Set DOM agent document to 0 in InspectorController::close to
-        make DOM agent remove DOM listeners from the inspected document.
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp: Removed.
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        * dom/MessagePort.idl:
+        * dom/Node.idl:
+        * loader/appcache/DOMApplicationCache.idl:
+        * notifications/Notification.idl:
+        * page/EventSource.idl:
+        * svg/SVGElementInstance.idl:
+        * websockets/WebSocket.idl:
+        * workers/AbstractWorker.idl:
+        * workers/WorkerContext.idl:
+        * xml/XMLHttpRequest.idl:
+        * xml/XMLHttpRequestUpload.idl:
 
-        Replace windowVisible checks with m_frontend checks to as inspector
-        window lives in a different process in Chromium while frontend proxy
-        is in the inspected page process.
+2010-02-22  Chris Fleizach  <cfleizach@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28800
+        Reviewed by Beth Dakin.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::inspect):
-        (WebCore::InspectorController::addConsoleMessage):
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::pruneResources):
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
-        (WebCore::InspectorController::identifierForInitialRequest):
-        (WebCore::InspectorController::willSendRequest):
-        (WebCore::InspectorController::didReceiveResponse):
-        (WebCore::InspectorController::didReceiveContentLength):
-        (WebCore::InspectorController::didFinishLoading):
-        (WebCore::InspectorController::didFailLoading):
-        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
-        (WebCore::InspectorController::scriptImported):
-        (WebCore::InspectorController::didOpenDatabase):
-        (WebCore::InspectorController::didUseDOMStorage):
-        (WebCore::InspectorController::addProfile):
-        * inspector/InspectorController.h:
+        AX: AXFocused is not writable like it should be on nodes
+        https://bugs.webkit.org/show_bug.cgi?id=35186
 
-2009-08-28  Mikhail Naganov  <mnaganov@chromium.org>
+        Test: platform/mac/accessibility/element-focus.html
 
-        Reviewed by Timothy Hatcher.
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
 
-        Remove dependency of SummaryBar on WebInspector.resourceCategories.
+2010-02-22  Simon Fraser  <simon.fraser@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28801
+        Reviewed by Dan Bernstein, Darin Adler.
 
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get categories):
-        * inspector/front-end/SummaryBar.js:
-        (WebInspector.SummaryBar):
-        (WebInspector.SummaryBar.prototype.update):
+        Remove addScrolledContentOffset/subtractScrolledContentOffset
+        https://bugs.webkit.org/show_bug.cgi?id=35225
 
-2009-08-28  Pavel Feldman  <pfeldman@chromium.org>
+        Remove RenderLayer's addScrolledContentOffset() and subtractScrolledContentOffset()
+        methods, and instead use the existing scrolledContentOffset(), and use
+        IntSize and IntPoint instead of lots of x, y variables.
+        
+        Added new IntPoint toPoint(const IntSize&) method as a convenience to convert a size to a point,
+        which is needed in a few places.
+        
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDrag): Use the new toPoint() convenience.
+        * platform/graphics/IntPoint.h:
+        (WebCore::toPoint): New convenience method to convert an IntSize to an IntPoint.
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::selectionGapRectsForRepaint):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::offsetForContents):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::size):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::computeRectForRepaint):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::RenderTextControlInnerBlock::positionForPoint):
 
-        Not reviewed (patching in l18n change that was missing due to
-        the git binary diff format).
+2009-02-22  Adam Langley  <agl@google.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28429
+        Reviewed by Darin Fisher.
 
-        * English.lproj/localizedStrings.js:
+        fontconfig on Linux can change the render preferences on a per strike
+        basis (a strike a combination of face and size). Because of this, we
+        need to query fontconfig each time a new FontPlatformData is created
+        for a new size.
 
-2009-08-28  Adam Barth  <abarth@webkit.org>
+        This patch adds support for querying this via ChromiumBridge.
 
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=33065
 
-        Make XSSAuditor go fast
-        https://bugs.webkit.org/show_bug.cgi?id=28667
+        * platform/chromium/ChromiumBridge.h: add getRenderStyleForStrike
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::setupPaint):
+        (WebCore::FontPlatformData::queryStyle):
+          add code to query fontconfig via ChromiumBridge
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
 
-        Make the XSSAuditor go faster by implementing two optimizations:
+2010-02-22  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        1) We avoid canonicalizing scripts that are larger than the page's URL.
-           This saves a bunch of time for large inline scripts.
+        Build fix for make distcheck.
 
-        2) We memoize canonicalizing the page's URL because it's silly to
-           canonicalize repeated for each inline event listener.
+        * GNUmakefile.am:
 
-        These optimizations have a measurable affect on the intl1 page cycler.
+2010-02-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        No behavior change.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::MemoizingURLCanonicalizer::canonicalizeURL):
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::canSetBaseElementURL):
-        (WebCore::XSSAuditor::decodeURL):
-        (WebCore::XSSAuditor::findInRequest):
-        * page/XSSAuditor.h:
+        Fix compiler warning "suggest parentheses around"
+        https://bugs.webkit.org/show_bug.cgi?id=35197
 
-2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+        No new tests as there is no new functionality.
 
-        Unreviewed, build fix.
+        * wml/WMLVariables.cpp:
+        (WebCore::substituteVariableReferences):
 
-        Removed ASSERT_NOT_REACHED, because indeed this ASSERT is reached in
-        fast/canvas/change-context.html. And it's alright to reach it.
+2010-02-22  Gustavo Noronha Silva  <gns@gnome.org>
 
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Removed assertion.
+        Reviewed by Xan Lopez.
 
-2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+        [Soup] loses information related to message flags when converting from/to Resource{Request,Response}
+        https://bugs.webkit.org/show_bug.cgi?id=35093
 
-        Not reviewed.  Build fix for http://trac.webkit.org/changeset/47840
+        Store message flags in WebCore objects, and set them on the
+        SoupMessage, when creating one from them.
 
-        Peter's change forgot one m_decoder->
+        No behaviour change.
 
-        * platform/graphics/ImageSource.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore::ResourceRequest::soupMessageFlags):
+        (WebCore::ResourceRequest::setSoupMessageFlags):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+        * platform/network/soup/ResourceResponse.h:
+        (WebCore::ResourceResponse::soupMessageFlags):
+        (WebCore::ResourceResponse::setSoupMessageFlags):
+        * platform/network/soup/ResourceResponseSoup.cpp:
+        (WebCore::ResourceResponse::toSoupMessage):
+        (WebCore::ResourceResponse::updateFromSoupMessage):
 
-2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-02-22  Steve Block  <steveblock@google.com>
 
-        Unreviewed, build fix.
+        Reviewed by Nate Chapin.
 
-        [V8] Add NULL-check, since the context ain't changeable no more, and
-        thus getContext could return 0.
+        Shared worker types used in globalObjectPrototypeIsDOMWindow are not properly guarded
+        https://bugs.webkit.org/show_bug.cgi?id=35238
 
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Added NULL-check.
+        No new tests, build fix only.
 
-2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::globalObjectPrototypeIsDOMWindow):
 
-        Reviewed by Eric Seidel.
+2010-02-22  Steve Block  <steveblock@google.com>
 
-        dataTransfer.types() should include type "Files" when files are present in the clipboard.
-        https://bugs.webkit.org/show_bug.cgi?id=28780
+        Reviewed by Simon Fraser.
 
-        Add dataTransfer type "Files" to the chromium port.  Add eseidel's
-        patch for same for the mac port.
+        Simplifies calculation of the transform in RenderLayer::paintLayer
+        https://bugs.webkit.org/show_bug.cgi?id=35101
 
-        * platform/chromium/ClipboardChromium.cpp:
+        No new tests, optimization only.
 
-2009-08-27  Chris Marrin  <cmarrin@apple.com>
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
 
-        Reviewed by Simon Fraser.
+2010-02-22  Nicholas Young  <nicholas.young@nokia.com>
 
-        Removed GL_ from all constants, and gl prefix from all calls
-        https://bugs.webkit.org/show_bug.cgi?id=28773
+        Reviewed by Tor Arne Vestbø.
 
-        This was done for the external API in CanvasRenderingContext3D and
-        the internal API in GraphicsContext3D.
+        [Qt] Switching from Phonon to QtMultimedia Backend for Qt 4.7
 
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        * html/canvas/CanvasRenderingContext3D.h:
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
-        * html/canvas/CanvasRenderingContext3D.idl:
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        https://bugs.webkit.org/show_bug.cgi?id=34631
 
-2009-08-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        No new tests. This patch only affects multimedia backend.
 
-        Qt and Gtk build fixes. Not reviewed.
+        * WebCore.pro: Build depends on Qt version.
+        * css/mediaControlsQt.css: Updated media controls.
+        * platform/graphics/MediaPlayer.cpp: Different backend included depending on Qt version.
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp: Added new QtMultimedia Backend.
+        (WebCore::MediaPlayerPrivate::create):
+        (WebCore::MediaPlayerPrivate::registerMediaEngine):
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::cancelLoad):
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        (WebCore::MediaPlayerPrivate::paused):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::seeking):
+        (WebCore::MediaPlayerPrivate::duration):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::buffered):
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable):
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::totalBytes):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::supportsMuting):
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::networkState):
+        (WebCore::MediaPlayerPrivate::readyState):
+        (WebCore::MediaPlayerPrivate::setVisible):
+        (WebCore::MediaPlayerPrivate::mediaStatusChanged):
+        (WebCore::MediaPlayerPrivate::handleError):
+        (WebCore::MediaPlayerPrivate::stateChanged):
+        (WebCore::MediaPlayerPrivate::nativeSizeChanged):
+        (WebCore::MediaPlayerPrivate::queuedSeekTimeout):
+        (WebCore::MediaPlayerPrivate::seekTimeout):
+        (WebCore::MediaPlayerPrivate::positionChanged):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::mutedChanged):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::setSize):
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::MediaPlayerPrivate::repaint):
+        * platform/graphics/qt/MediaPlayerPrivateQt.h: Added new QtMultimedia Backend.
+        (WebCore::MediaPlayerPrivate::isAvailable):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::mediaControlsBaselineOpacity): New method.
+        (WebCore::RenderThemeQt::paintMediaBackground): Background depends on baseline opacity.
+        (WebCore::RenderThemeQt::paintMediaMuteButton): Changed styling.
+        (WebCore::RenderThemeQt::paintMediaCurrentTime): Added current time display.
+        (WebCore::RenderThemeQt::formatMediaControlsCurrentTime): Added time formatting.
+        (WebCore::RenderThemeQt::formatMediaControlsRemainingTime): Added time formatting.
+        (WebCore::RenderThemeQt::paintMediaVolumeSliderTrack): Volume slider added.
+        (WebCore::RenderThemeQt::paintMediaVolumeSliderThumb): Volume slider added.
+        (WebCore::RenderThemeQt::paintMediaSliderTrack): Updated for QtMultimedia.
+        (WebCore::RenderThemeQt::paintMediaSliderThumb): Dropped an unnecessary check.
+        (WebCore::RenderThemeQt::adjustSliderThumbSize): Handle a missing case.
+        * platform/qt/RenderThemeQt.h: Reimplemented a few more methods.
 
-        Add CanvasRenderingContext3D.idl to the build scripts.
+2010-02-22  Alexander Pavlov  <apavlov@chromium.org>
 
-        * GNUmakefile.am:
-        * WebCore.pro:
+        Not reviewed: mac build fix
 
-2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
 
-        Reviewed by Darin Fisher.
+2010-02-22  Alexander Pavlov  <apavlov@chromium.org>
 
-        Release the storage mutex whenever leaving JavaScript execution.
-        https://bugs.webkit.org/show_bug.cgi?id=28789
+        Reviewed by Pavel Feldman.
 
-        http://dev.w3.org/html5/spec/Overview.html#storage-mutex describes the
-        required behavior.  After we leave JavaScript, we must be sure the storage
-        mutex has been released.  At the end of evaluate(), if localStorage has been
-        instantiated, tell it to release any locks that may be applicable.
+        Web Inspector: there should be a way to "deactivate" or "skip" all breakpoints while debugging.
+        https://bugs.webkit.org/show_bug.cgi?id=33217
 
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
+        * English.lproj/localizedStrings.js:
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::hasBreakpoint):
+        (WebCore::ScriptDebugServer::setBreakpointsActivated):
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/v8/ScriptDebugServer.h:
+        (WebCore::ScriptDebugServer::setBreakpointsActivated):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::activateBreakpoints):
+        (WebCore::InspectorBackend::deactivateBreakpoints):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/Images/deactivateBreakpointsButtonGlyph.png: Added.
+        * inspector/front-end/Images/deactivateBreakpointsDisabledButtonGlyph.png: Added.
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.activateBreakpoints):
+        (.WebInspector.InspectorBackendStub.prototype.deactivateBreakpoints):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get breakpointsActivated):
+        (WebInspector.ScriptsPanel.prototype.addBreakpoint):
+        (WebInspector.ScriptsPanel.prototype._stepOutClicked):
+        (WebInspector.ScriptsPanel.prototype._toggleBreakpointsClicked):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/textViewer.css:
 
-2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+2010-02-22  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Oliver Hunt.
+        Rubber-stamped by Sam Weinig and Maciej Stachowiak.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28753
-        <rdar://problem/7173448> Excessive number of threads (and a crash)
-
-        Coalesce DNS prefetch requests to reduce strain on CFHost. Currently, the algorithm is as follows:
-        - when resolver is idle, the first few requests are sent immediately (they may or may not
-        hit the wire);
-        - if there are a few requests in flight already, coalesce all requests for one second;
-        - to avoid pathological cases with lots of links to different sites on a page, only ask
-        CFHost about a handful of names (dropping the rest).
-
-        Coalescing reduces the number of requests dramatically, as prefetchDNS is called for each
-        link, and these tend to have identical host name.
-
-        * platform/network/cf/DNSCFNet.cpp:
-        (WebCore::DNSResolveQueue::DNSResolveQueue):
-        (WebCore::DNSResolveQueue::shared):
-        (WebCore::DNSResolveQueue::add):
-        (WebCore::DNSResolveQueue::decrementRequestCount):
-        (WebCore::DNSResolveQueue::fired):
-        (WebCore::clientCallback):
-        (WebCore::DNSResolveQueue::resolve):
-        (WebCore::prefetchDNS):
+        REGRESSION (r55039): Animation starts from near end when loaded over slow network
+        <http://webkit.org/b/35222> / <rdar://problem/7673523>
 
-2009-08-27  Chris Marrin  <cmarrin@apple.com>
+        Roll out r55039 (related to <http://webkit.org/b/35115>) as it causes animated GIFs
+        to skip intermediate frames when loading over a slower network.
 
-        Reviewed by Simon Fraser.
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::startAnimation):
 
-        Final patch for Canvas 3D support
-        https://bugs.webkit.org/show_bug.cgi?id=28018
+2010-02-22  Maciej Stachowiak  <mjs@apple.com>
 
-        This hooks everything up and provides a working implementation of
-        Canvas 3D. I plumb the creation of the 3D canvas down to GraphicsLayer,
-        passing the opaque context and texture pointers so a Canvas3DLayer can be
-        created (more on that later). It also plumbs changes to the 3D canvas so
-        that Canvas3DLayer can recomposite the results.
-        
-        A 3D Canvas element needs a RenderLayer and compositing layer to render.
-        This is because it renders to an off-screen texture in the GPU and then
-        hands it to a Canvas3DLayer, which is a subclass of CAOpenGLLayer, to
-        render that texture as a 3D quad. This keeps everything in GPU memory to 
-        maximize performance. When a CanvasRenderingContext3D is created it 
-        forces a style recalc which creates the RenderLayer and compositing 
-        layer if needed. 
+        Not reviewed, build fix.
         
-        I repurposed an existing flag which was put in place for animation to accomplish 
-        this. This flag is passed to setNeedsStyleRecalc(), and I renamed it from 
-        AnimationStyleChange to SyntheticStyleChange. It essentially says that you need
-        to do a complete style recalc, even though the style itself has not really
-        changed.
+        Revert the previous change.
         
-        This patch also fixes a couple of bugs discovered when testing with 3d-canvas
-        turned on. I also added a constructor DOMWindow.idl for CanvasRenderingContext3D.
-        This is needed when making a JS wrapper for the object so the prototype 
-        property can be set.
-
-        Test: fast/canvas/change-context.html
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext3D::glDrawElements):
-        * bindings/js/JSCanvasRenderingContextCustom.cpp:
-        (WebCore::toJS):
-        * dom/Element.cpp:
-        (WebCore::Element::recalcStyle):
-        * dom/Node.cpp:
-        (WebCore::Node::setNeedsStyleRecalc):
-        * dom/Node.h:
-        (WebCore::):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext):
-        (WebCore::HTMLCanvasElement::is3D):
-        * html/HTMLCanvasElement.h:
-        * html/canvas/CanvasBuffer.cpp:
-        (WebCore::CanvasBuffer::create):
-        (WebCore::CanvasBuffer::CanvasBuffer):
-        (WebCore::CanvasBuffer::_deleteObject):
-        * html/canvas/CanvasBuffer.h:
-        * html/canvas/CanvasFramebuffer.cpp:
-        (WebCore::CanvasFramebuffer::create):
-        (WebCore::CanvasFramebuffer::CanvasFramebuffer):
-        (WebCore::CanvasFramebuffer::_deleteObject):
-        * html/canvas/CanvasFramebuffer.h:
-        * html/canvas/CanvasObject.cpp:
-        (WebCore::CanvasObject::CanvasObject):
-        (WebCore::CanvasObject::~CanvasObject):
-        (WebCore::CanvasObject::deleteObject):
-        * html/canvas/CanvasObject.h:
-        (WebCore::CanvasObject::context):
-        * html/canvas/CanvasProgram.cpp:
-        (WebCore::CanvasProgram::create):
-        (WebCore::CanvasProgram::CanvasProgram):
-        (WebCore::CanvasProgram::_deleteObject):
-        * html/canvas/CanvasProgram.h:
-        * html/canvas/CanvasRenderbuffer.cpp:
-        (WebCore::CanvasRenderbuffer::create):
-        (WebCore::CanvasRenderbuffer::CanvasRenderbuffer):
-        (WebCore::CanvasRenderbuffer::_deleteObject):
-        * html/canvas/CanvasRenderbuffer.h:
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        (WebCore::CanvasRenderingContext3D::createBuffer):
-        (WebCore::CanvasRenderingContext3D::createFramebuffer):
-        (WebCore::CanvasRenderingContext3D::createTexture):
-        (WebCore::CanvasRenderingContext3D::createProgram):
-        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
-        (WebCore::CanvasRenderingContext3D::createShader):
-        * html/canvas/CanvasRenderingContext3D.h:
-        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
-        * html/canvas/CanvasShader.cpp:
-        (WebCore::CanvasShader::create):
-        (WebCore::CanvasShader::CanvasShader):
-        (WebCore::CanvasShader::_deleteObject):
-        * html/canvas/CanvasShader.h:
-        * html/canvas/CanvasTexture.cpp:
-        (WebCore::CanvasTexture::create):
-        (WebCore::CanvasTexture::CanvasTexture):
-        (WebCore::CanvasTexture::_deleteObject):
-        * html/canvas/CanvasTexture.h:
-        * page/DOMWindow.idl:
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::setNeedsStyleRecalc):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
-        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
-        (WebCore::AnimationController::cancelAnimations):
-        * platform/graphics/GraphicsContext3D.h:
-        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
-        (WebCore::GraphicsContext3D::platformTexture):
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::setContentsToGraphicsContext3D):
-        (WebCore::GraphicsLayer::setGraphicsContext3DNeedsDisplay):
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::~GraphicsContext3D):
-        (WebCore::GraphicsContext3D::reshape):
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        (WebCore::GraphicsLayerCA::):
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
-        (WebCore::GraphicsLayerCA::commitLayerChanges):
-        (WebCore::GraphicsLayerCA::updateContentsGraphicsContext3D):
-        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D):
-        (WebCore::GraphicsLayerCA::setGraphicsContext3DNeedsDisplay):
-        * rendering/RenderHTMLCanvas.cpp:
-        (WebCore::RenderHTMLCanvas::requiresLayer):
-        * rendering/RenderHTMLCanvas.h:
-        (WebCore::RenderHTMLCanvas::isCanvas):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
-        (WebCore::RenderLayerBacking::canUseDirectCompositing):
-        (WebCore::RenderLayerBacking::rendererContentChanged):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
-        (WebCore::RenderLayerCompositor::requiresCompositingForCanvas):
-        * rendering/RenderLayerCompositor.h:
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isCanvas):
-
-2009-08-27  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28751
-        Clean up ImageDecoder*.cpp a bit.
-
-        * platform/image-decoders/ImageDecoder.cpp: Put functions in the same
-          order as in the header file.  Also, since there's already an anonymous
-          namespace in this file, use it to enclose the local helper functions.
-        (WebCore::):
-        (WebCore::ImageDecoder::upperBoundScaledX):
-        (WebCore::ImageDecoder::lowerBoundScaledX):
-        (WebCore::ImageDecoder::scaledY):
-        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
-        (WebCore::RGBA32Buffer::width): Style fix.
-        (WebCore::RGBA32Buffer::height): Style fix.
-        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
-        (WebCore::RGBA32Buffer::copyBitmapData): Ensure m_size is set correctly.
-        (WebCore::RGBA32Buffer::asNewNativeImage): Remove unneeded temp.
-        (WebCore::RGBA32Buffer::operator=): Simplify.
-        * platform/image-decoders/wx/ImageDecoderWx.cpp:
-        (WebCore::RGBA32Buffer::asNewNativeImage): Try and collect spaced-out temps under loop comment to show they're all related.  Use size_t for iterating over elements of a Vector.
-        (WebCore::RGBA32Buffer::width): Style fix.
-        (WebCore::RGBA32Buffer::height): Style fix.
-
-2009-08-27  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28751
-        Clean up ImageSource.* in preparation for more fixes on bug 27965.
-
-        * platform/graphics/ImageSource.cpp: Put functions in the same order as in header file.
-        (WebCore::ImageSource::isSizeAvailable): Shorten.
-        (WebCore::ImageSource::size): Shorten.
-        (WebCore::ImageSource::frameSizeAtIndex): Shorten.
-        (WebCore::ImageSource::repetitionCount): Shorten.
-        (WebCore::ImageSource::frameIsCompleteAtIndex):
-        * platform/graphics/ImageSource.h: Shorten #ifdef section a bit by sharing common typedefs.
+2010-02-21  Maciej Stachowiak  <mjs@apple.com>
 
-2009-08-27  Peter Kasting  <pkasting@google.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Eric Seidel.
+        Cache JavaScript wrappers inline in DOM nodes
+        https://bugs.webkit.org/show_bug.cgi?id=35226
+        <rdar://problem/7664202>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28785
-        Add ImageDecoder.cpp to various build files so platforms will be able to
-        use it.  Move an ENABLE to not cover the whole file, in preparation for
-        adding a bunch of code.  Simplify #ifdefs in ImageDecoder.h to be "Skia
-        vs. everyone else", which also gives new platforms a reasonable default
-        behavior.
+        8.8% speedup on Dromaeo DOM Core tests.
+        3.3% speedup on Hixie DOM Core tests.
+        
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::forgetDOMNode): Clear wrapper pointer.
+        (WebCore::cacheDOMNodeWrapper): Cache inline too if caching for normal world.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWrapperMapFor): 
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::toJS): Remove unneeded argument from getCachedDOMNodeWrapper.
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline): Renamed version of original createWrapper.
+        (WebCore::createWrapper): Call createWrapperInline. Out-of-line version.
+        (WebCore::toJSNewlyCreated): Call createWrapperInline instead of createWrapper.
+        * bindings/js/JSNodeCustom.h: Added.
+        (WebCore::getCachedDOMNodeWrapper): Moved here so it can be inlined.
+        (WebCore::toJS): Moved here so it can be inlined.
+        * bindings/js/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::ScriptWrappable): Implement this in the obvious
+        way for JavaScriptCore.
+        (WebCore::ScriptWrappable::wrapper):
+        (WebCore::ScriptWrappable::setWrapper):
+        (WebCore::ScriptWrappable::clearWrapper):
+        * bindings/scripts/CodeGeneratorJS.pm: Include CustomHeader heaaders
+        in the header, not just the impl file, so they can add inlining.
+        * dom/Node.idl: Add CustomHeader directive.
+        
+        Add new files to build.
 
         * GNUmakefile.am:
         * WebCore.gypi:
+        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
-        * WebCoreSources.bkl:
-        * platform/image-decoders/ImageDecoder.cpp:
-        (WebCore::):
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::RGBA32Buffer::getAddr):
 
-2009-08-27  Antti Koivisto  <antti@apple.com>
+2010-02-22  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Dave Kilzer.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=28784
-        
-        Add an exported method to flush pending repaints.
-
-        * WebCore.base.exp:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layoutIfNeededRecursive):
-        (WebCore::FrameView::flushDeferredRepaints):
-        * page/FrameView.h:
-
-2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
+        Not reviewed: windows build fix.
 
-        Reviewed by Eric Seidel.
-
-        [V8] Expose files from the pasteboard in drop events.
-        https://bugs.webkit.org/show_bug.cgi?id=28782
-
-        Update chromium port to expose dataTransfer.files() as per
-        HTML5 drag drop (Aug 2009 edition).
-
-        * platform/chromium/ClipboardChromium.cpp:
-
-2009-08-27  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Dmitry Glazkov.
-
-        ScriptState now keeps explicit Handle of devtools front-end
-        utility context instead of trying to retrieve it from inspected
-        Frame.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28772
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::ScriptController):
-        * bindings/v8/ScriptController.h:
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/v8/ScriptScope.cpp:
-        (WebCore::ScriptScope::ScriptScope):
-        * bindings/v8/ScriptState.cpp:
-        (WebCore::ScriptState::ScriptState):
-        (WebCore::ScriptState::~ScriptState):
-        (WebCore::scriptStateFromPage):
-        * bindings/v8/ScriptState.h:
-        (WebCore::ScriptState::context):
-        * bindings/v8/ScriptValue.h:
-        (WebCore::ScriptValue::~ScriptValue):
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::frontendScriptState):
-
-2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-21  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Console won't close.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28778
-
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
-        * inspector/front-end/utilities.js:
-        (Node.prototype.isAncestor):
-
-2009-08-27  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Fix a typo in files() causing image drags to have junk file arrays.
-        https://bugs.webkit.org/show_bug.cgi?id=28755
-
-        Test: editing/pasteboard/files-during-page-drags.html
-
-        * platform/mac/ClipboardMac.mm:
-        (WebCore::ClipboardMac::files):
-
-2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
-
-        Not reviewed.  Build fix for Chromium.
-
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-
-2009-08-27  Alexey Proskuryakov  <ap@apple.com>
-
-        Windows build fix.
-
-        * DerivedSources.cpp: Added JSPageTransitionEvent.cpp to DerivedSources.cpp.
-
-2009-08-26  Alexey Proskuryakov  <ap@apple.com>
+        Web Inspector: stop on inline breakpoints on reload.
+        - ScriptBreakpoint struct has been introduced and reused in InspectorController
+          and debug server.
+        - JavaScriptDebugServer was moved to bindings/js and renamed to ScriptDebugServer
+          There were no changes to semantics, only some mechanical changes:
+            - addBreakpoint and updateBreakpoint were merged into setBreakpoint
+            - ScriptDebugServer now operates ScriptBreakpoint instances instead of
+              BreakpointInfo.
+            - It no longer allocates maps and breakpoint info in heap - all done on stack.
+            - JavaScriptDebugListener is now ScriptDebugServer::Listener
+            - Listener methods no longer have ExecState (was unused).
+            - addListener/removeListener pair wuth no page argument removed (was unused).
+        - InspectorController now binds sourceID to url and maintains a map of 'sticky'
+          breakpoints. Whenever script is loaded and there is a sticky breakpoint url matching,
+          breakpoint is being 'restored' synchronously in debug server and pushed to frontend.
+          Front-end no longer stores map of sticky breakpoints.
+            - setBreakpoint/removeBreakpoint/didParseSource trio handle this logic.
+        - A bunch of if(USE_JSC/V8/other) forks removed.
+        - InspectorFrontend now operates primitive types only, got rid of USE_JSC as well.
 
-        Reviewed by Adele Peterson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28758
-        <rdar://problem/6440869> Implement pageshow and pagehide events for b/f cache (28758)
-
-        Tests: fast/events/pageshow-pagehide-on-back-cached.html
-               fast/events/pageshow-pagehide-on-back-uncached.html
-               fast/events/pageshow-pagehide.html
-
-        * loader/FrameLoader.cpp: (WebCore::FrameLoader::stopLoading): Dispatch pagehide event
-        (this function is called both when a document goes away, and when it goes to b/f cache).
-
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Dispatch pagehide right before unload.
-        (WebCore::DOMWindow::dispatchPageTransitionEvent): Do what it takes to add a new event handler
-        that can be installed on Window object.
-        (WebCore::DOMWindow::onpagehide): Ditto.
-        (WebCore::DOMWindow::setOnpagehide): Ditto.
-        (WebCore::DOMWindow::onpageshow): Ditto.
-        (WebCore::DOMWindow::setOnpageshow): Ditto.
-
-        * history/CachedFrame.cpp: (WebCore::CachedFrame::restore): Dispatch pageshow for a page
-        that isn't being restored from cache.
-
-        * dom/PageTransitionEvent.cpp: Added.
-        (WebCore::PageTransitionEvent::PageTransitionEvent):
-        (WebCore::PageTransitionEvent::~PageTransitionEvent):
-        (WebCore::PageTransitionEvent::initPageTransitionEvent):
-        * dom/PageTransitionEvent.h: Added.
-        (WebCore::PageTransitionEvent::create):
-        (WebCore::PageTransitionEvent::isPageTransitionEvent):
-        (WebCore::PageTransitionEvent::persisted):
-        * dom/PageTransitionEvent.idl: Added.
-        Add event class implementation.
-
-        * html/HTMLBodyElement.cpp: (WebCore::HTMLBodyElement::parseMappedAttribute): Support
-        inline listener definition (note that adding listeners to document.body programmatically
-        is not supported, matching Firefox).
-
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose): Dispatch pageshow event right before load event.
-        (WebCore::Document::dispatchPageTransitionEvent): Do what it takes to add a new event for
-        Docuemnt.
-        (WebCore::Document::createEvent): Ditto.
-
-        * dom/Document.h: Added dispatchPageTransitionEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=28799
 
-        * DerivedSources.make:
         * GNUmakefile.am:
+        * WebCore.base.exp:
         * WebCore.gypi:
+        * WebCore.order:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSEventCustom.cpp: (WebCore::toJS):
-        * dom/Event.cpp: (WebCore::Event::isPageTransitionEvent):
-        * dom/Event.h:
-        * dom/EventNames.h:
-        * html/HTMLAttributeNames.in:
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-        Do what it takes to add a new event type.
-
-2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by NOBODY (build fix).
-
-        Adding missing file from previous commit.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28740
-
-        * inspector/front-end/SummaryBar.js: Added.
-        (WebInspector.SummaryBar):
-        (WebInspector.SummaryBar.prototype.get calculator):
-        (WebInspector.SummaryBar.prototype.set calculator):
-        (WebInspector.SummaryBar.prototype.reset):
-        (WebInspector.SummaryBar.prototype.update):
-        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
-        (WebInspector.SummaryBar.prototype._drawSwatch):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
-        (WebInspector.SummaryBar.prototype._fadeOutRect):
-        (WebInspector.SummaryBar.prototype._makeLegendElement):
-
-2009-08-27  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Factor out Factor out summary bar from Resources panel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28740
-
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::isActivation):
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::shared):
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::~ScriptDebugServer):
+        (WebCore::ScriptDebugServer::addListener):
+        (WebCore::ScriptDebugServer::removeListener):
+        (WebCore::ScriptDebugServer::pageCreated):
+        (WebCore::ScriptDebugServer::hasListenersInterestedInPage):
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::removeBreakpoint):
+        (WebCore::ScriptDebugServer::hasBreakpoint):
+        (WebCore::ScriptDebugServer::clearBreakpoints):
+        (WebCore::ScriptDebugServer::setPauseOnExceptionsState):
+        (WebCore::ScriptDebugServer::pauseProgram):
+        (WebCore::ScriptDebugServer::continueProgram):
+        (WebCore::ScriptDebugServer::stepIntoStatement):
+        (WebCore::ScriptDebugServer::stepOverStatement):
+        (WebCore::ScriptDebugServer::stepOutOfFunction):
+        (WebCore::ScriptDebugServer::currentCallFrame):
+        (WebCore::ScriptDebugServer::currentCallFrameState):
+        (WebCore::ScriptDebugServer::dispatchDidParseSource):
+        (WebCore::ScriptDebugServer::dispatchFailedToParseSource):
+        (WebCore::toPage):
+        (WebCore::ScriptDebugServer::detach):
+        (WebCore::ScriptDebugServer::sourceParsed):
+        (WebCore::ScriptDebugServer::dispatchFunctionToListeners):
+        (WebCore::ScriptDebugServer::setJavaScriptPaused):
+        (WebCore::ScriptDebugServer::pauseIfNeeded):
+        (WebCore::ScriptDebugServer::callEvent):
+        (WebCore::ScriptDebugServer::atStatement):
+        (WebCore::ScriptDebugServer::returnEvent):
+        (WebCore::ScriptDebugServer::exception):
+        (WebCore::ScriptDebugServer::willExecuteProgram):
+        (WebCore::ScriptDebugServer::didExecuteProgram):
+        (WebCore::ScriptDebugServer::didReachBreakpoint):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctionsSoon):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::ScriptDebugServer::didAddListener):
+        (WebCore::ScriptDebugServer::didRemoveListener):
+        (WebCore::ScriptDebugServer::didRemoveLastListener):
+        * bindings/js/ScriptDebugServer.h:
+        (WebCore::ScriptDebugServer::Listener::~Listener):
+        (WebCore::ScriptDebugServer::):
+        (WebCore::ScriptDebugServer::pauseOnExceptionsState):
+        (WebCore::ScriptDebugServer::hasListeners):
+        (WebCore::ScriptDebugServer::hasGlobalListeners):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::shared):
+        * bindings/v8/ScriptDebugServer.h:
+        (WebCore::ScriptDebugServer::Listener::~Listener):
+        (WebCore::ScriptDebugServer::addListener):
+        (WebCore::ScriptDebugServer::removeListener):
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::removeBreakpoint):
+        (WebCore::ScriptDebugServer::clearBreakpoints):
+        (WebCore::ScriptDebugServer::):
+        (WebCore::ScriptDebugServer::pauseOnExceptionsState):
+        (WebCore::ScriptDebugServer::setPauseOnExceptionsState):
+        (WebCore::ScriptDebugServer::pauseProgram):
+        (WebCore::ScriptDebugServer::continueProgram):
+        (WebCore::ScriptDebugServer::stepIntoStatement):
+        (WebCore::ScriptDebugServer::stepOverStatement):
+        (WebCore::ScriptDebugServer::stepOutOfFunction):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctionsSoon):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::ScriptDebugServer::currentCallFrameState):
+        (WebCore::ScriptDebugServer::pageCreated):
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::~ScriptDebugServer):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::currentCallFrameCallback):
+        (WebCore::V8InjectedScriptHost::isActivationCallback):
+        * inspector/InjectedScriptHost.cpp:
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::setBreakpoint):
+        (WebCore::InspectorBackend::removeBreakpoint):
+        (WebCore::InspectorBackend::pauseInDebugger):
+        (WebCore::InspectorBackend::stepOverStatementInDebugger):
+        (WebCore::InspectorBackend::stepIntoStatementInDebugger):
+        (WebCore::InspectorBackend::stepOutOfFunctionInDebugger):
+        (WebCore::InspectorBackend::pauseOnExceptionsState):
+        (WebCore::InspectorBackend::setPauseOnExceptionsState):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/ScriptBreakpoint.h: Added.
+        (WebCore::InspectorBreakpoint::InspectorBreakpoint):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebuggerFromFrontend):
+        (WebCore::InspectorController::disableDebugger):
+        (WebCore::InspectorController::resumeDebugger):
+        (WebCore::InspectorController::setBreakpoint):
+        (WebCore::InspectorController::removeBreakpoint):
+        (WebCore::InspectorController::didParseSource):
+        (WebCore::InspectorController::failedToParseSource):
+        (WebCore::InspectorController::didPause):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::restoredBreakpoint):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::resumedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptDebugListener.h: Removed.
+        * inspector/JavaScriptDebugServer.cpp: Removed.
+        * inspector/JavaScriptDebugServer.h: Removed.
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.addBreakpoint):
         * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.reset):
-        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
-        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
-        (WebInspector.ResourcesPanel.prototype._changeSortingFunction):
-        * inspector/front-end/SummaryBar.js: Added.
-        (WebInspector.SummaryBar):
-        (WebInspector.SummaryBar.prototype.get calculator):
-        (WebInspector.SummaryBar.prototype.set calculator):
-        (WebInspector.SummaryBar.prototype.reset):
-        (WebInspector.SummaryBar.prototype.update):
-        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
-        (WebInspector.SummaryBar.prototype._drawSwatch):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
-        (WebInspector.SummaryBar.prototype._fadeOutRect):
-        (WebInspector.SummaryBar.prototype._makeLegendElement):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-
-2009-08-26  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Start adding heap profiler to Inspector (hidden behind a flag.)
-
-        https://bugs.webkit.org/show_bug.cgi?id=28429
-
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel):
-        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
-        (WebInspector.ProfilesPanel.prototype.reset):
-        (WebInspector.ProfilesPanel.prototype.addProfile):
-        (WebInspector.ProfilesPanel.prototype._updateInterface):
-        (WebInspector.ProfilesPanel.prototype._snapshotClicked):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js: added Preferences.heapProfilerPresent flag.
-
-2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Metrics sidebar editing is broken.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28434
-
-        * inspector/front-end/MetricsSidebarPane.js:
-        (WebInspector.MetricsSidebarPane.prototype.update):
-
-2009-08-27  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28767
-
-        Make KURLGoogle.cpp's decodeURLEscapeSequences decode %00 to match
-        KURL.cpp.  This makes the XSSAuditor tests pass when using KURLGoogle.
-
-        * platform/KURLGoogle.cpp:
-        (WebCore::decodeURLEscapeSequences):
-
-2009-08-27  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Build fix, missing functions after r47763.
-
-        * platform/qt/Localizations.cpp:
-        (WebCore::localizedMediaControlElementString):
-        (WebCore::localizedMediaControlElementHelpText):
-        (WebCore::localizedMediaTimeDescription):
-
-2009-08-26  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Removing trailing whitespaces from all storage classes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28075
-
-        * storage/ChangeVersionWrapper.cpp:
-        * storage/Database.cpp:
-        * storage/Database.h:
-        * storage/DatabaseDetails.h:
-        * storage/DatabaseThread.cpp:
-        * storage/DatabaseTracker.cpp:
-        * storage/DatabaseTracker.h:
-        * storage/LocalStorageTask.cpp:
-        * storage/LocalStorageTask.h:
-        * storage/LocalStorageThread.cpp:
-        * storage/LocalStorageThread.h:
-        * storage/OriginQuotaManager.cpp:
-        * storage/OriginUsageRecord.cpp:
-        * storage/OriginUsageRecord.h:
-        * storage/SQLError.h:
-        * storage/SQLResultSetRowList.h:
-        * storage/SQLStatement.cpp:
-        * storage/SQLStatement.h:
-        * storage/SQLStatementCallback.h:
-        * storage/SQLStatementErrorCallback.h:
-        * storage/SQLTransaction.cpp:
-        * storage/SQLTransaction.h:
-        * storage/SQLTransactionCallback.h:
-        * storage/SQLTransactionErrorCallback.h:
-        * storage/Storage.cpp:
-        * storage/Storage.h:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        * storage/StorageAreaImpl.h:
-        * storage/StorageAreaSync.cpp:
-        * storage/StorageAreaSync.h:
-        * storage/StorageEvent.cpp:
-        * storage/StorageEvent.h:
-        * storage/StorageMap.cpp:
-        * storage/StorageMap.h:
-        * storage/StorageNamespaceImpl.cpp:
-        * storage/StorageSyncManager.cpp:
-        * storage/StorageSyncManager.h:
-
-2009-08-26  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28763, flickering when opacity changes.
-
-        Make opacity changes from < 1 to 1 and from 1 to < 1 cause a relayout to happen.  We need
-        to do this in order for overflow information to be properly recomputed.
-
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::diff):
-
-2009-08-26  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
+        (WebInspector.ResourcesPanel.prototype.sourceFrameForResource):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        (WebInspector.ScriptsPanel.prototype.addBreakpoint):
+        (WebInspector.ScriptsPanel.prototype.removeBreakpoint):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * inspector/front-end/inspector.js:
+        (WebInspector.restoredBreakpoint):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        * platform/android/TemporaryLinkStubs.cpp:
 
-        HTMLMediaElement sometimes loses events
-        https://bugs.webkit.org/show_bug.cgi?id=28762
-        <rdar://problem/7172437>
+2010-02-21  Gavin Barraclough  <barraclough@apple.com>
 
-        A media element triggers the resource selection algorithm if 
-        play() is called when the networkState attribute is NETWORK_EMPTY, but
-        it also immediately queues 'play' and either 'waiting' or 'playing' events.
-        One of the steps in preparing to load is to flush pending events, so those 
-        events were lost if the load timer fired quickly enough. Fixed by deleting
-        pending events before scheduling the load timer.
+        Reviewed by Oliver Hunt.
 
-        Test: media/audio-play-event.html
+        Make the UChar owned/ref-counted by StringImpl::CrossThreadRefCounted be const.
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::scheduleLoad):
-            Do nothing if the load timer is already scheduled. Call prepareForLoad so queue of 
-            pending events is flushed immediately.
-        (WebCore::HTMLMediaElement::scheduleNextSourceChild):
-            New, start the load timer without flushing pending events.
-        (WebCore::HTMLMediaElement::load):
-            Call prepareForLoad();
-        (WebCore::HTMLMediaElement::prepareForLoad):
-            New, load setup code moved from loadInternal.
-        (WebCore::HTMLMediaElement::loadInternal):
-            Moved some setup code to prepareForLoad so it can be invoked immediately before
-            arming the load timer.
-        (WebCore::HTMLMediaElement::setNetworkState):
-            Call scheduleNextSourceChild instead of scheduleLoad as the later now clears
-            pending events.
-        * html/HTMLMediaElement.h:
-            Declare scheduleNextSourceChild.
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
 
-2009-08-26  Peter Kasting  <pkasting@google.com>
+2010-02-07  Yuzo Fujishima  <yuzo@google.com>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28751
-        Switch ICO decoder from a Vector of raw pointers to a Vector of
-        OwnPtrs now that that is possible.  Makes code slightly simpler.
-
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::decodeAtIndex):
-        (WebCore::ICOImageDecoder::processDirectory):
-        * platform/image-decoders/ico/ICOImageDecoder.h:
-
-2009-08-26  Dave Hyatt  <hyatt@apple.com>
+        When page-break-{after,before} is set to always, force page breaks even for overflow-specified elements.
+        RenderBlock::inRootBlockContext() was introduced by Changeset 5611. Although it is a reasonable criteria for choosing an optional page break location, it is not for a mandatory page break as specified by http://dev.w3.org/csswg/css3-page/#forced-pg-brk. The method is removed because it is not used anywhere else.
+        Note: this patch makes page break work for overflow-specified elements. For tables and floated elements, more work is needed.
+        https://bugs.webkit.org/show_bug.cgi?id=9526
 
-        Reviewed by Dan Bernstein.
+        Test: printing/page-break-always-for-overflow.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=28718, image inside relpositioned inline doesn't paint.
-        Make sure vertical overflow is still computed across self-painting layers, even though it isn't
-        propagated to parents.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintChildren):
+        * rendering/RenderBlock.h:
 
-        Added fast/repaint/rel-positioned-inline-with-overflow.html
+2010-02-21  Julien Chaffraix  <jchaffraix@webkit.org>
 
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        Reviewed by Eric Seidel.
 
-2009-08-26  David Levin  <levin@chromium.org>
+        Remove auto_ptr usage in WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=35157
 
-        Reviewed by Darin Fisher.
+        The changes consists of:
 
-        ResourceRequestBase::*[Aa]llowHTTPCookies shouldn't mention http.
-        https://bugs.webkit.org/show_bug.cgi?id=28735
+        - Changing auto_ptr arguments or return types to PassOwnPtr.
 
-        Renaming the method to imply its wider implications of affecting cookies
-        over any protocol that supports them.
+        - Replacing local auto_ptr by OwnPtr.
 
-        No change in functionality so no new tests.
+        - Removing now unneeded <memory> inclusion.
 
-        * WebCore.order:
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
-        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
-        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::addProperty):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        (WebCore::workerContextDidReceiveResponse):
+        (WebCore::workerContextDidReceiveData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveData):
+        (WebCore::workerContextDidReceiveAuthenticationCancellation):
+        * loader/WorkerThreadableLoader.h:
+        * loader/icon/IconLoader.cpp:
+        (WebCore::IconLoader::create):
+        * loader/icon/IconLoader.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::separatorItem):
+        * platform/CrossThreadCopier.h:
+        (WebCore::):
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::copyData):
+        (WebCore::HTTPHeaderMap::adopt):
+        * platform/network/HTTPHeaderMap.h:
         * platform/network/ResourceRequestBase.cpp:
         (WebCore::ResourceRequestBase::adopt):
         (WebCore::ResourceRequestBase::copyData):
-        (WebCore::ResourceRequestBase::allowCookies):
-        (WebCore::ResourceRequestBase::setAllowCookies):
-        (WebCore::equalIgnoringHeaderFields):
         * platform/network/ResourceRequestBase.h:
-        (WebCore::ResourceRequestBase::ResourceRequestBase):
-        * platform/network/cf/ResourceRequestCFNet.cpp:
-        (WebCore::ResourceRequest::doUpdatePlatformRequest):
-        (WebCore::ResourceRequest::doUpdateResourceRequest):
-        * platform/network/mac/ResourceRequestMac.mm:
-        (WebCore::ResourceRequest::doUpdateResourceRequest):
-        (WebCore::ResourceRequest::doUpdatePlatformRequest):
-        * platform/network/soup/ResourceRequestSoup.cpp:
-        (WebCore::ResourceRequest::updateFromSoupMessage):
-
-2009-08-26  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Made RenderInline::clippedOverflowRectForRepaint() actually include
-        overflow.
-
-        Test: fast/repaint/inline-overflow.html
-
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::linesVisibleOverflowBoundingBox): Added. Returns
-            the bounding box of all lines’ visible overflow boxes (under the
-            assumption that the first and last lines determine the top and
-            bottom, respectively).
-        (WebCore::RenderInline::clippedOverflowRectForRepaint): Changed to use
-            linesVisibleOverflowBoundingBox() instead of linesBoundingBox().
-        * rendering/RenderInline.h:
-
-2009-08-26  John Gregg  <johnnyg@google.com>
-
-        Reviewed by David Levin.
-
-        minor style correction and include fix for notifications
-        https://bugs.webkit.org/show_bug.cgi?id=28745
-
-        No change in behavior, so no tests.
-
-        * bindings/js/JSDesktopNotificationsCustom.cpp: add include of Error.h
-        * notifications/Notification.cpp: change enum style to InterCaps
-        (WebCore::Notification::Notification):
-        * notifications/NotificationPresenter.h:
-        (WebCore::NotificationPresenter::):
-
-2009-08-25  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        postMessage() spec now supports sending arrays of ports
-        https://bugs.webkit.org/show_bug.cgi?id=26902
-
-        Added support for sending multiple ports at once via postMessage(). JS bindings will be updated in an upcoming patch.
-
-        No new tests, since the new functionality is not exposed via new JS bindings yet, so the old tests suffice.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        Mark MessagePort.h and MessagePortChannel.h as private since they are used by WebKit now.
-        * dom/MessageEvent.cpp:
-        Updated APIs to support passing MessagePortArrays.
-        (WebCore::MessageEvent::MessageEvent):
-        (WebCore::MessageEvent::initMessageEvent):
-        (WebCore::MessageEvent::messagePort):
-        * dom/MessageEvent.h:
-        (WebCore::MessageEvent::create):
-        Now accepts a MessagePortArray parameter instead of a single MessagePort.
-        (WebCore::MessageEvent::ports):
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::postMessage):
-        (WebCore::MessagePort::dispatchMessages):
-        (WebCore::MessagePort::disentanglePorts):
-        Added new static function to extract a MessagePortChannelArray from a MessagePortArray.
-        (WebCore::MessagePort::entanglePorts):
-        Added new static function to generate a MessagePortArray (entangled ports) from a MessagePortChannelArray.
-        * dom/MessagePort.h:
-        * dom/MessagePortChannel.cpp:
-        EventData now contains a MessagePortChannelArray field instead of a single MessagePortChannel.
-        (WebCore::MessagePortChannel::EventData::create):
-        (WebCore::MessagePortChannel::EventData::EventData):
-        * dom/MessagePortChannel.h:
-        (WebCore::MessagePortChannel::EventData::channels):
-        * page/DOMWindow.cpp:
-        (WebCore::PostMessageTimer::PostMessageTimer):
-        (WebCore::PostMessageTimer::event):
-        (WebCore::DOMWindow::postMessage):
-        Now accepts a MessagePortArray parameter instead of a single MessagePort.
-        * page/DOMWindow.h:
-        * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::postMessage):
-        Now accepts a MessagePortArray parameter instead of a single MessagePort.
-        (WebCore::DedicatedWorkerContext::dispatchMessage):
-        * workers/DedicatedWorkerContext.h:
-        * workers/Worker.cpp:
-        (WebCore::Worker::postMessage):
-        Now accepts a MessagePortArray parameter instead of a single MessagePort.
-        (WebCore::Worker::dispatchMessage):
-        * workers/Worker.h:
-        * workers/WorkerContextProxy.h:
-        * workers/WorkerMessagingProxy.cpp:
-        Updated WorkerObjectProxy and WorkerContextProxy API implementations to support sending multiple MessagePorts.
-        (WebCore::MessageWorkerContextTask::create):
-        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
-        (WebCore::MessageWorkerContextTask::performTask):
-        (WebCore::MessageWorkerTask::create):
-        (WebCore::MessageWorkerTask::MessageWorkerTask):
-        (WebCore::MessageWorkerTask::performTask):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerObjectProxy.h:
-        Updated WorkerObjectProxy and WorkerContextProxy APIs to support sending multiple MessagePorts.
-
-2009-08-26  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        SocketStreamHandle interface for WebSocket API
-        https://bugs.webkit.org/show_bug.cgi?id=28037
-
-        Add build systems only for GNUmakefile.am and WebCore.xcodeproj.now.
-        Other build systems will be updated once the code is functional.
-        Tests will be landed once this code is complete and functional.
-
-        * GNUmakefile.am:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/network/SocketStreamErrorBase.cpp: Added.
-        * platform/network/SocketStreamErrorBase.h: Added.
-        * platform/network/SocketStreamHandleBase.cpp: Added.
-        * platform/network/SocketStreamHandleBase.h: Added.
-        * platform/network/SocketStreamHandleClient.h: Added.
-        * platform/network/cf/SocketStreamError.h: Added.
-        * platform/network/cf/SocketStreamHandle.h: Added.
-        * platform/network/cf/SocketStreamHandleCFNet.cpp: Added.
-        * platform/network/soup/SocketStreamError.h: Added.
-        * platform/network/soup/SocketStreamHandle.h: Added.
-        * platform/network/soup/SocketStreamHandleSoup.cpp: Added.
-
-2009-08-26  Mads Ager  <ager@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] setTimeout does not convert non-string argument to string
-        https://bugs.webkit.org/show_bug.cgi?id=28739
-
-        Convert non-string argument to setTimeout to string in the V8
-        bindings.
-
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-
-2009-08-25  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        [ES5] Implement getOwnPropertyDescriptor
-        https://bugs.webkit.org/show_bug.cgi?id=28724
-
-        Implement the WebCore side of getOwnPropertyDescriptor.  This
-        requires a custom implementation of getOwnPropertyDescriptor
-        for every class with a custom implementation of getOwnPropertySlot.
-
-        The bindings generator has been updated to generate appropriate
-        versions of getOwnPropertyDescriptor for the general case where
-        a custom getOwnPropertyDescriptor is not needed.  ES5 is vague
-        about how getOwnPropertyDescriptor should work in the context of
-        "host" functions with polymorphic [[GetOwnProperty]], so it seems
-        okay that occasionally we "guess" what attributes -- eg. determining
-        whether a property is writable.
-
-        Test: fast/js/getOwnPropertyDescriptor.html
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::getOwnPropertyDescriptor):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSHTMLAppletElementCustom.cpp:
-        (WebCore::JSHTMLAppletElement::getOwnPropertyDescriptorDelegate):
-        * bindings/js/JSHTMLEmbedElementCustom.cpp:
-        (WebCore::JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate):
-        * bindings/js/JSHTMLObjectElementCustom.cpp:
-        (WebCore::JSHTMLObjectElement::getOwnPropertyDescriptorDelegate):
-        * bindings/js/JSHistoryCustom.cpp:
-        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
-        * bindings/js/JSNamedNodesCollection.cpp:
-        (WebCore::JSNamedNodesCollection::getOwnPropertyDescriptor):
-        * bindings/js/JSNamedNodesCollection.h:
-        * bindings/js/JSPluginElementFunctions.cpp:
-        (WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
-        * bindings/js/JSPluginElementFunctions.h:
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::getOwnPropertyDescriptorDelegate):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/objc/objc_runtime.h:
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertyDescriptor):
-        * bridge/runtime.h:
-        (JSC::Bindings::Instance::getOwnPropertyDescriptor):
-        * bridge/runtime_array.cpp:
-        (JSC::RuntimeArray::getOwnPropertyDescriptor):
-        * bridge/runtime_array.h:
-        * bridge/runtime_method.cpp:
-        (JSC::RuntimeMethod::getOwnPropertyDescriptor):
-        * bridge/runtime_method.h:
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
-        * bridge/runtime_object.h:
-
-2009-08-26  Vincent Untz <vuntz@gnome.org>
-
-        Reviewed by Xan Lopez.
-
-        GObject checks for NULL (and not 0) in g_object_get, so use that
-        as we were already doing elsewhere to make the compiler happy.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::hasAudio):
-
-2009-08-26  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by David Levin.
-
-        RenderThemeMac.mm has incorrect casting for media control element.
-        https://bugs.webkit.org/show_bug.cgi?id=28730
-
-        MediaControlMuteButtonElement was incorrectly casted to
-        MediaControlPlayButtonElement. This is corrected in this patch.
-
-        No new tests because this is code cleanup and is already covered by existing
-        media layout tests.
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMediaMuteButton):
-
-2009-08-26  Robert Sesek  <rsesek@chromium.org>
-
-        Reviewed by Eric Seidel.
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::copyData):
+        * platform/network/ResourceResponseBase.h:
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::removePendingResource):
+        * svg/SVGDocumentExtensions.h:
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::insertedIntoDocument):
+        * workers/GenericWorkerTask.h:
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::create):
 
-        [Chromium] Multi-value select boxes cannot do non-contiguous selection on Mac
-        https://bugs.webkit.org/show_bug.cgi?id=28670
+2010-02-21  Simon Fraser  <simon.fraser@apple.com>
 
-        Change the condition regarding the key modifier check for non-contiguous
-        selection on a multi-value list from just PLATFORM(MAC) to
-        PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN)).
+        Reviewed by Dan Bernstein.
 
-        No new tests. This patch only changes the condition on which a certain mouse
-        event modifier key is used.
+        https://bugs.webkit.org/show_bug.cgi?id=22215
+        Avoid calling absoluteClippedOverflowRect() so many times
 
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        RenderLayer::updateLayerPositions() computes the clipped overflow rect
+        and the outline bounds for repaint, and then calls repaintAfterLayoutIfNeeded()
+        which can compute the same rects all over again. Avoid this by passing
+        these two rects into repaintAfterLayoutIfNeeded() if known. This measurably
+        reduces the time spent in updateLayerPositions() for some content.
 
-2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        * rendering/RenderObject.h:
 
-        Reviewed by Dan Bernstein
+2010-02-20  Alexey Proskuryakov  <ap@apple.com>
 
-        r47744 causes media/video-controls-with-mutation-event-handler.html to crash
-        https://bugs.webkit.org/show_bug.cgi?id=28732
+        Reviewed by Maciej Stachowiak.
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
-            Don't call setAttribute from the construtor, any registered mutation event 
-            listener will cause a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=35202
+        <rdar://problem/4856597> Calling Java method which accepts Object always passes a null argument
 
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::createVolumeSlider):
-            Set the maxAttr here instead of in the constructor.
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: (JSC::Bindings::convertValueToJValue): Add cases for
+        other JS types.
 
-2009-08-25  Dmitry Titov  <dimich@chromium.org>
+2010-02-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Reviewed by Brady Eidson.
+        Reviewed by Darin Adler.
 
-        Timers from cached pages fire instantly rather than the after the specified timeout delay
-        https://bugs.webkit.org/show_bug.cgi?id=28683
+        Fix compiler warning "suggest parentheses around"
+        https://bugs.webkit.org/show_bug.cgi?id=35197
 
-        Test: fast/dom/Window/timer-resume-on-navigation-back.html
+        No new tests as there is no new functionality.
 
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::restore): Remove duplicated Frame::restore() call, since
-            it should be done only once in FrameLoader::open(cachedFrame)
-        * page/DOMTimer.cpp: Added a debug-only flag and ASSERT to catch out-of-order suspense/restore.
-        (WebCore::DOMTimer::DOMTimer): Ditto.
-        (WebCore::DOMTimer::suspend): Ditto.
-        (WebCore::DOMTimer::resume): Ditto.
-        * page/DOMTimer.h: Ditto.
+        * html/DateComponents.cpp:
+        (WebCore::beforeGregorianStartDate):
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::findPlugin):
 
-2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+2010-02-20  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Reviewed by Simon Fraser.
+        Reviewed by Laszlo Gombos.
 
-        Setting the volume of a media element has no effect if called too early
-        https://bugs.webkit.org/show_bug.cgi?id=28731
+        [Qt] ENABLE_3D_RENDERING should be optional
+        https://bugs.webkit.org/show_bug.cgi?id=35100
 
-        * manual-tests/audio-volume.html: 
-            Added.
+        No new tests: this is a build fix.
 
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::setVolume):
-        (WebCore::MediaPlayerPrivate::setRate):
-            Don't bail if metadata hasn't been loaded, it is fine to set rate and/or
-            volume as soon as the movie has been created.
+        * WebCore.pri: ENABLE_3D_RENDERING is now a proper feature test
 
-2009-08-25  David Levin  <levin@chromium.org>
+2010-02-20  Alexey Proskuryakov  <ap@apple.com>
 
         Reviewed by Maciej Stachowiak.
 
-        DocumentThreadableLoader::getShouldUseCredentialStorage should allow for synchronous callbacks from SubresourceLoader::create.
-        https://bugs.webkit.org/show_bug.cgi?id=28728
-
-        Test: This code path is exercised while running xhr layout tests in chromium.
-
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): When called
-        back synchronously, the loader is 0, so the assert is changed to allow for that.
-        (WebCore::DocumentThreadableLoader::loadRequest): Synchronous callbacks may be
-        done before SubresourceLoader::create finishes, so ensure that any previous loader
-        -- from a preflight request -- is cleared before calling SubresourceLoader::create.
+        https://bugs.webkit.org/show_bug.cgi?id=23742
+        Applet methods can not return arrays to JS
 
-2009-08-25  Mark Rowe  <mrowe@apple.com>
+        * bridge/jni/jsc/JNIBridgeJSC.cpp: (JavaArray::JavaArray): Don't accidentally zero out
+        m_rootObject (that's how PassRefPtr works). Without m_rootObject, we crash quickly.
 
-        Stop installing IDL files in to the framework.
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: (JavaInstance::invokeMethod): Do handle returned arrays.
+        Also, added an ifdef around  code that's only needed on Tiger, and removed a comment saying
+        it can be removed when "new" plugin ships. I doubt that anyone can remember what "new"
+        could refer to back then.
 
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-08-25  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Support for HTMLInputElement::list and HTMLInputElement::selectedOption.
-        https://bugs.webkit.org/show_bug.cgi?id=27756
+2010-02-20  Pavel Feldman  <pfeldman@chromium.org>
 
-        Tests: fast/forms/input-list.html
-               fast/forms/input-selectedoption.html
+        Reviewed by Timothy Hatcher.
 
-        * html/HTMLAttributeNames.in:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        (WebCore::HTMLInputElement::list):
-        (WebCore::HTMLInputElement::selectedOption):
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
+        Web Inspector: re-creating view in ResourcesPanel confuses ScriptsPanel's visibleView logic.
 
-2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35192
 
-        Reviewed by Oliver Hunt.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype.viewRecreated):
 
-        <video> and <audio> controller should be accessible (edit)
-        https://bugs.webkit.org/show_bug.cgi?id=28081
+2010-02-20  Pavel Feldman  <pfeldman@chromium.org>
 
-        Test: accessibility/media-element.html
+        Reviewed by Timothy Hatcher.
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-            Add AccessibilityMediaControls.cpp/.h
+        Web Inspector: need to highlight the evaluated expression used for popovers.
 
-        * accessibility/AXObjectCache.cpp:
-        * accessibility/AXObjectCache.h:
-        (WebCore::AXObjectCache::getOrCreate):
-            Create AccessibilityMediaControl. Update Copyright
+        https://bugs.webkit.org/show_bug.cgi?id=35126
 
-        * accessibility/AccessibilityMediaControls.cpp:
-        * accessibility/AccessibilityMediaControls.h:
-            Added.
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._mouseMove):
+        (WebInspector.SourceFrame.prototype._hidePopup):
+        (WebInspector.SourceFrame.prototype._mouseHover):
+        (WebInspector.SourceFrame.prototype._showPopup.showObjectPopup):
+        (WebInspector.SourceFrame.prototype._showPopup):
+        * inspector/front-end/inspector.css:
 
-        * accessibility/AccessibilityObject.cpp:
-        * accessibility/AccessibilityObject.h:
-            Add isMediaTimeline. Update Copyright.
+2010-02-20  Gustavo Noronha Silva  <gns@gnome.org>
 
-        * accessibility/AccessibilitySlider.h:
-            Make constructor protected instead of private so AccessibilityMediaTimeline can
-            call it.
+        Roll out 55047 because it causes layout, and API tests to fail
 
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
-            Add NSAccessibilityValueDescriptionAttribute to range attributes. 
-        (-[AccessibilityObjectWrapper subrole]):
-            Return NSAccessibilityTimelineSubrole for AccessibilityMediaTimeline.
+2010-02-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        * dom/Node.h:
-            add isMediaControlElement.
+        Reviewed by Xan Lopez.
 
-        * page/mac/WebCoreViewFactory.h:
-        * platform/LocalizedStrings.h:
-        * platform/mac/LocalizedStringsMac.mm:
-        (WebCore::localizedMediaControlElementString): 
-        (WebCore::localizedMediaControlElementHelpText):
-        (WebCore::localizedMediaTimeDescription): 
-            New, return localized media controller strings.
+        [Soup] loses information related to message flags when converting from/to Resource{Request,Response}
+        https://bugs.webkit.org/show_bug.cgi?id=35093
 
-        * platform/gtk/LocalizedStringsGtk.cpp:
-        (WebCore::mediaElementLoadingStateText):
-        (WebCore::mediaElementLiveBroadcastStateText):
-            Move inside of "#if ENABLE(VIDEO)"
-        (WebCore::localizedMediaControlElementString):
-        (WebCore::localizedMediaControlElementHelpText):
-        (WebCore::localizedMediaTimeDescription):
+        Refactor updating of ResourceResponse objects from soup message
+        objects, to avoid code duplication.
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlElement::MediaControlElement):
-            Initialize m_displayType.
-        (WebCore::MediaControlElement::MediaControlElement):
-        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement):
-            Fix style.
-        (WebCore::MediaControlInputElement::MediaControlInputElement):
-            Set m_displayType based on pseudo style ID.
-        (WebCore::MediaControlInputElement::MediaControlInputElement):
-            rename local "o" to "object".
-        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement):
-        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement):
-        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement):
-        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement):
-        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement):
-        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
-        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
-        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
-        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
-        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
-            Update for MediaControlInputElement constructor change.
-        (WebCore::MediaControlTimeDisplayElement::formatTime):
-            New, moved here from RenderMedia so AccessibilityMediaTimeDisplay can use it.
-        (WebCore::MediaControlTimeDisplayElement::setCurrentValue):
-            New, set text to current time.
-        * rendering/MediaControlElements.h:
+        No behaviour change.
 
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::updateControls):
-            Create controls in tab order.
-        (WebCore::RenderMedia::formatTime):
-            Moved to MediaControlTimeDisplayElement::formatTime.
-        (WebCore::RenderMedia::updateTimeDisplay):
-            Call MediaControlTimeDisplayElement::setCurrentValue.
-        * rendering/RenderMedia.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+        * platform/network/soup/ResourceResponseSoup.cpp:
+        (WebCore::ResourceResponse::updateFromSoupMessage):
 
-2009-08-25  Jian Li  <jianli@chromium.org>
+2010-02-20  Alexey Proskuryakov  <ap@apple.com>
 
-        Reviewed by David Levin.
+        Reviewed by Maciej Stachowiak.
 
-        [V8] Fix Canvas layout test failures in Chromium build.
-        https://bugs.webkit.org/show_bug.cgi?id=28720
+        https://bugs.webkit.org/show_bug.cgi?id=35190
+        Don't use system malloc in Java bindings
 
-        The previous fix r47757 does not handle the V8 object conversion correctly.
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: (JavaInstance::invokeMethod): Switched to WTF::Vector.
 
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+2010-02-20  Alexey Proskuryakov  <ap@apple.com>
 
-2009-08-25  Jian Li  <jianli@chromium.org>
+        Reviewed by Maciej Stachowiak.
 
-        Reviewed by David Levin.
+        https://bugs.webkit.org/show_bug.cgi?id=9761
+        LiveConnect string conversion fails for java.lang.Object
 
-        [V8] Fix compiling errors in Chromium build caused by Canvas3D changes from r47752.
-        https://bugs.webkit.org/show_bug.cgi?id=28717
+        Can't test Java in DRT (I wonder why).
 
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: (JSC::Bindings::convertValueToJValue):
+        Added the necessary conversion. Also, removed CONVERT_NULL_TO_EMPTY_STRING dead code.
 
-2009-08-25  Alpha Lam  <hclam@chromium.org>
+2010-02-19  Maciej Stachowiak  <mjs@apple.com>
 
         Reviewed by David Levin.
 
-        [chromium] Implement media volume slider for chromium
-        https://bugs.webkit.org/show_bug.cgi?id=28715
+        Add an ENABLE flag for sandboxed iframes to make it possible to disable it in releases
+        https://bugs.webkit.org/show_bug.cgi?id=35147
 
-        Provided the implementation of the volume slider and its container for
-        chromium port. With this change there will be a usable volume control
-        slider for chromium theme.
+        I made ENABLE(SANDBOX) only control the sandbox attribute itself;
+        I did not ifdef the infrastructure to make sandboxing
+        switchable. This is because the likely concerns about sandboxing
+        are not stability of the infrastructure code, but rather the fact
+        that the security model exposed to authors is still evolving.
 
-        No new tests since this is covered by existing media layout tests.
-
-        * css/mediaControlsChromium.css: CSS style for the volume slider.
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::mediaSliderThumbImage): Returns the image for slider thumb.
-        (WebCore::mediaVolumeSliderThumbImage): Returns the image for volume slider thumb.
-        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Paints the track with one vertical white line.
-        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Adjusts thumb sizes according to the images.
-        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Paints slider thumb image.
-        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Paints volume slider thumb image.
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pri:
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::parseMappedAttribute):
 
-2009-08-25  Chris Marrin  <cmarrin@apple.com>
+2010-02-19  Alexey Proskuryakov  <ap@apple.com>
 
-        Reviewed by Simon Fraser.
+        Reviewed by Maciej Stachowiak.
 
-        Missed checking in 2 Canvas3D files
-        https://bugs.webkit.org/show_bug.cgi?id=28018
+        https://bugs.webkit.org/show_bug.cgi?id=35132
+        <rdar://problem/7664353> Mouse cursor sometimes flickers over Flash content (35132)
 
-        * bindings/js/JSCanvasRenderingContextCustom.cpp: Implements toJS to do proper subclass binding
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp: Argument marshaling for 3D calls
+        * page/EventHandler.cpp: (WebCore::EventHandler::handleMouseMoveEvent): Don't set mouse
+        pointer when above a plug-in or applet to prevent flicker.
 
-2009-08-25  Mads Ager  <ager@chromium.org>
+2010-02-18  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Adam Barth.
 
-        [V8] Exception from JavaScript propagates to main script
-        https://bugs.webkit.org/show_bug.cgi?id=26433
-
-        Make sure that exceptions thrown both at compile time and at
-        runtime in javascript URLs are isolated from the main script.
+        Fix regression in calculating an animated image's start time.
+        https://bugs.webkit.org/show_bug.cgi?id=35115
 
-        Test: fast/dom/javascript-url-exception-isolation.html
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::startAnimation):
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluate):
+2010-02-19  Alexey Proskuryakov  <ap@apple.com>
 
-2009-08-25  Chris Marrin  <cmarrin@apple.com>
+        Reviewed by Geoffrey Garen.
 
-        Reviewed by Simon Fraser.
+        https://bugs.webkit.org/show_bug.cgi?id=35178
+        LiveConnect code uses hand-rolled fprintf logging
 
-        Added all new Canvas3D files to the build
-        https://bugs.webkit.org/show_bug.cgi?id=28018
+        Changed to use LOG, LOG_ERROR and ASSERT.
 
-        This also hooks up CanvasRenderingContext as the common base class for
-        CanvasRenderingContext2D and CanvasRenderingContext3D. And it adds a bit
-        of logic throughout to support the new CanvasRenderingContext3D object.
-        But nothing is hooked up yet.
+        * platform/Logging.cpp:
+        (WebCore::getChannelFromName):
+        * platform/Logging.h:
+        * platform/mac/LoggingMac.mm:
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+        * platform/win/LoggingWin.cpp:
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+        TextConversion channel was (almost) unused, renamed to LiveConnect.
+
+        * platform/text/gtk/TextCodecGtk.cpp: (WebCore::TextCodecGtk::registerEncodingNames):
+        The only use of this channel was in platform specific code, commandeered it for cross-platform
+        needs.
+
+        * bridge/jni/JNIBridge.cpp:
+        * bridge/jni/JNIUtility.cpp:
+        (JSC::Bindings::getJavaVM):
+        (JSC::Bindings::getJNIEnv):
+        (JSC::Bindings::getJNIField):
+        * bridge/jni/JNIUtility.h:
+        (JSC::Bindings::callJNIMethodV):
+        (JSC::Bindings::callJNIStaticMethod):
+        * bridge/jni/jni_jsobject.mm:
+        (completedJavaScriptAccess):
+        (dispatchToJavaScriptThread):
+        (performJavaScriptAccess):
+        (JavaJSObject::invoke):
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::setMember):
+        (JavaJSObject::removeMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::setSlot):
+        (JavaJSObject::toString):
+        (JavaJSObject::createNative):
+        * bridge/jni/jsc/JNIBridgeJSC.cpp:
+        (JavaField::valueFromInstance):
+        (JavaField::setValueToInstance):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::invokeMethod):
+        (JObjectWrapper::JObjectWrapper):
+        (JObjectWrapper::~JObjectWrapper):
 
-        * DerivedSources.make:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore/GNUmakefile.am:
-        * WebCore/WebCore.gypi:
-        * WebCore/WebCoreSources.bkl:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext2D::strokeStyle):
-        (WebCore::JSCanvasRenderingContext2D::setStrokeStyle):
-        (WebCore::JSCanvasRenderingContext2D::fillStyle):
-        (WebCore::JSCanvasRenderingContext2D::setFillStyle):
-        (WebCore::JSCanvasRenderingContext2D::setFillColor):
-        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
-        (WebCore::JSCanvasRenderingContext2D::strokeRect):
-        (WebCore::JSCanvasRenderingContext2D::drawImage):
-        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
-        (WebCore::JSCanvasRenderingContext2D::setShadow):
-        (WebCore::JSCanvasRenderingContext2D::createPattern):
-        (WebCore::JSCanvasRenderingContext2D::putImageData):
-        (WebCore::JSCanvasRenderingContext2D::fillText):
-        (WebCore::JSCanvasRenderingContext2D::strokeText):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::isObservableThroughDOM):
-        * bindings/js/JSDocumentCustom.cpp:
-        * bindings/js/JSHTMLCanvasElementCustom.cpp:
-        (WebCore::JSHTMLCanvasElement::markChildren):
-        * dom/Document.cpp:
-        (WebCore::Document::getCSSCanvasContext):
-        * dom/Document.h:
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext):
-        (WebCore::HTMLCanvasElement::willDraw):
-        (WebCore::HTMLCanvasElement::reset):
-        (WebCore::HTMLCanvasElement::paint):
-        (WebCore::HTMLCanvasElement::is3D):
-        (WebCore::HTMLCanvasElement::context3D):
-        (WebCore::HTMLCanvasElement::texture3D):
-        * html/HTMLCanvasElement.h:
-        (WebCore::HTMLCanvasElement::renderingContext):
-        * html/canvas/CanvasObject.cpp:
-        (WebCore::CanvasObject::~CanvasObject):
-        * html/canvas/CanvasRenderingContext.idl:
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
-        (WebCore::CanvasRenderingContext2D::~CanvasRenderingContext2D):
-        * html/canvas/CanvasRenderingContext2D.h:
-        (WebCore::CanvasRenderingContext2D::is2d):
-        * html/canvas/CanvasRenderingContext2D.idl:
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        * html/canvas/CanvasRenderingContext3D.idl:
+2010-02-19  Dirk Schulze  <krit@webkit.org>
 
-2009-08-25  Dan Bernstein  <mitz@apple.com>
+        Reviewed by Nikolas Zimmermann.
 
-        Reviewed by Anders Carlsson.
+        RenderSVGResourceMasker causes an Assert on Wind builds during DRT
+        https://bugs.webkit.org/show_bug.cgi?id=35182
 
-        REGRESSION (r47630): fast/repaint/background-generated.html is failing
-        https://bugs.webkit.org/show_bug.cgi?id=28704
+        We remove the Assert for now and return earlier, if the HashMap of the Masker
+        does not contain the RenderObject. The RenderObject is an identifiert to get
+        a already calculated mask.
+        A race condition during parsing can cause the invalidation call, before the mask
+        got calculated (only during DRT on Win build bots).
+        The real bug will be fixed with: https://bugs.webkit.org/show_bug.cgi?id=35181
 
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateFillTileSize): Handle SizeNone.
-        * rendering/style/FillLayer.cpp:
-        (WebCore::FillLayer::FillLayer): Initialize the size type to SizeNone.
-        * rendering/style/FillLayer.h:
-        (WebCore::FillSize::FillSize): Changed assignment to initialization and
-            removed redundant assignment to size.
+        * rendering/RenderSVGResourceMasker.cpp:
+        (WebCore::RenderSVGResourceMasker::invalidateClient):
 
-2009-08-25  Yusuke Sato  <yusukes@chromium.org>
+2010-02-18  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Darin Fisher.
 
-        [Chromium] Complex text doesn't show up with text stroking
-        https://bugs.webkit.org/show_bug.cgi?id=28707
-
-        Skip the NULL check of m_hdc if Windows GDI is not in use.
-
-        * platform/graphics/chromium/FontChromiumWin.cpp:
-        (WebCore::Font::drawComplexText):
-
-2009-08-25  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by David Levin.
-
-        Media controls panel does not have a volume control slider
-        https://bugs.webkit.org/show_bug.cgi?id=28241
-
-        Introduced "-webkit-media-controls-volume-slider",
-        "-webkit-media-controls-volume-slider-container" and the supporting
-        implementation. Also added appearances of "media-volume-slider" and
-        "media-volume-slider-container".
-
-        The implementation of the controls are in WebCore::MediaControlElements.
-        Logic to trigger the display of the volume controls are in WebCore::RenderMedia.
-
-        No new tests since this change doesn't have theme implementation and the
-        volume slider is disabled by default.
-
-        * accessibility/AccessibilitySlider.cpp:
-        (WebCore::AccessibilitySlider::orientation): Marks that volume slider is vertical.
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added corresponding CSS values.
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): ditto.
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::): ditto.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ditto.
-        * css/CSSValueKeywords.in: ditto.
-        * css/mediaControls.css: Makes the volume slider disabled by default.
-        * platform/ThemeTypes.h: Defines theme parts for volume slider and its container.
-        (WebCore::):
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement):
-        (WebCore::MediaControlVolumeSliderContainerElement::styleForElement):
-        Adjust the CSS values for "display", "postion", "left" and "top" according to member variables.
-        (WebCore::MediaControlVolumeSliderContainerElement::setVisible): Affects the "display" CSS value.
-        (WebCore::MediaControlVolumeSliderContainerElement::setPosition): Affects the "left" and "top" CSS values.
-        (WebCore::MediaControlVolumeSliderContainerElement::hitTest): Hit testing this element.
-        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
-        (WebCore::MediaControlVolumeSliderElement::defaultEventHandler): Modifies the volume using the slider value, allows dragging.
-        * rendering/MediaControlElements.h:
-        (WebCore::): Added definition for MediaControlVolumeSliderElement and MediaControlVolumeSliderContainerElement.
-        (WebCore::MediaControlVolumeSliderContainerElement::isVisible): Inline getter.
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::styleDidChange): Updates styles for volume container and volume slider.
-        (WebCore::RenderMedia::createVolumeSliderContainer): Creates volume slider container and attach to panel.
-        (WebCore::RenderMedia::createVolumeSlider): Creates volume slider and attach to volume slider container.
-        (WebCore::RenderMedia::updateControls): Updates volume container and volume slider.
-        (WebCore::RenderMedia::updateVolumeSliderContainer): Sets the visibility and position of volume slider container and its child.
-        (WebCore::RenderMedia::forwardEvent):
-        Hit testing the volume slider container and volume slider to toggle the visibility and forward events to slider.
-        * rendering/RenderMedia.h:
-        Added definition for RenderMedia::updateVolumeSliderContainer().
-        * rendering/RenderMediaControls.cpp:
-        (WebCore::RenderMediaControls::paintMediaControlsPart): Not implemented.
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::createThumbStyle): Makes volume slider vertical.
-        (WebCore::RenderSlider::thumbRect): ditto.
-        (WebCore::RenderSlider::mouseEventIsInThumb): ditto.
-        (WebCore::RenderSlider::setValueForPosition): ditto.
-        (WebCore::RenderSlider::positionForOffset): ditto.
-        (WebCore::RenderSlider::currentPosition): ditto.
-        (WebCore::RenderSlider::trackSize): ditto.
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::adjustStyle): Adjust style for volume slider thumb.
-        (WebCore::RenderTheme::paint): Paints volume control parts using theme.
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::paintMediaVolumeSliderContainer): Naive implementation to be overridden.
-        (WebCore::RenderTheme::paintMediaVolumeSliderTrack): ditto.
-        (WebCore::RenderTheme::paintMediaVolumeSliderThumb): ditto.
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::): Constants for volume control parts.
-
-2009-08-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Ariya Hidayat.
+        Make Pasteboard::writeImage() safe against NULL cachedImages, and clean
+        up some code.
+        https://bugs.webkit.org/show_bug.cgi?id=35136
 
-        [Qt/Mac] Use CONFIG+=build_all only when building libraries
-
-        If no configuration is specified when building WebKit we pass the
-        debug_and_release option to QMake which results in Makefiles for
-        both configurations being generated.
-
-        Previously we built both of these configurations by default, for
-        all targets (both the QtWebKit framework/dyldlib and the various
-        executables such as QtLauncher and tests). This makes sense for
-        the libraries, which get the _debug suffix and can be loaded on
-        demand by setting the DYLD_IMAGE_SUFFIX, but for executables we
-        ended up building the same executable twice.
-
-        We now only build one instance of each executable, and since this
-        is a developer build we build the debug-version. Passing either
-        --debug or --release to build-webkit will override this, and
-        even in the default case the release version can still be built
-        by running 'make release' in the the build directory of each
-        target.
-
-        * WebCore.pro:
-
-2009-08-25  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28690
-        Build failure in webkitgtk+-1.1.3
-
-        Do not use deprecated function to unref a pixbuf.
-
-        * platform/gtk/CursorGtk.cpp:
-        (WebCore::Cursor::Cursor):
-
-2009-08-24  Hironori Bono  <hbono@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Fix Bug 27827 "[Chromium] Functions Keys don't work in google spreadsheet".
-        <https://bugs.webkit.org/show_bug.cgi?id=27827>.
-
-        Because of the lack of mappings from GDK key-codes to WebKit key-codes,
-        Chromium cannot send valid key-codes to JavaScript when a user types
-        function keys. This change just copies the mappings from 'KeyEventGtk.cpp'.
-
-        To write layout tests for this issue, added mappings from function-key
-        names to platform-specific key-codes to EventSendingController objects
-        so that eventSender.keyDown() can send function-key events without using
-        platform-specific key codes. (Unfortunately, this eventSender.keyDown() change
-        is only for Mac. So this change adds this new test to Skipped tests for other
-        platforms to prevent this change from crashing the build trees.)
-
-        Test: fast/events/keydown-function-keys.html
-
-       * platform/chromium/KeyCodeConversionGtk.cpp: Add mappings from GDK key-codes
-        to WebKit key-code for function keys.
-        (WebCore::windowsKeyCodeForKeyEvent):
-
-2009-08-24  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Simon Fraser.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=28698
-        Avoid unnecessary transformations for the window resizer rect.
-
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::setFrameRect):
-
-2009-08-24  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        <rdar://problem/7161900> REGRESSION: 100 MB membuster leak on windows due to 47391
-        (DNS prefetching support)
-
-        * platform/network/cf/DNSCFNet.cpp: (WebCore::prefetchDNS): Use a run loop from secondary
-        thread on Windows, because there isn't one on main one.
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::updateRenderer): Shorten some code.
+        * page/DragController.cpp:
+        (WebCore::getImage): Shorten some code.
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage): NULL-check cachedImage().
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeImage): NULL-check cachedImage().
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeImage): NULL-check cachedImage().
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writeImage): NULL-check cachedImage().
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeImage): NULL-check cachedImage().
 
-2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+2010-02-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Reviewed by Darin Adler.
+        Rubberstamped by Noam Rosenthal, who wrote the original code.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28374
-        Cross-scheme requests should not be blocked by appcache rules
+        Make mouse wheel scrolling work when using the GraphicsLayer.
 
-        Test: http/tests/appcache/different-scheme.html
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl):
 
-        * loader/appcache/ApplicationCacheHost.cpp:
-        (WebCore::ApplicationCacheHost::shouldLoadResourceFromApplicationCache):
-        Resources with different schemes can never be loaded from appcache.
+2010-02-19  Nate Chapin  <japhet@chromium.org>
 
-2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+        Reviewed by Dimitri Glazkov.
 
-        Reviewed by Darin Adler and Sam Weinig.
+        [V8] Fix Worker crash regression in r54972
 
-        https://bugs.webkit.org/show_bug.cgi?id=28688
-        REGRESSION(r24994): Cannot create a frame with a javascript URL
+        https://bugs.webkit.org/show_bug.cgi?id=35166
 
-        Test: http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object): Properly unwrap global objects when inside a WorkerContext.
 
-        * bindings/js/JSAttrCustom.cpp: (WebCore::JSAttr::setValue):
-        * bindings/js/JSElementCustom.cpp: (WebCore::allowSettingSrcToJavascriptURL):
-        * bindings/js/JSHTMLFrameElementCustom.cpp: (WebCore::allowSettingJavascriptURL):
-        * bindings/js/JSHTMLIFrameElementCustom.cpp: (WebCore::JSHTMLIFrameElement::setSrc):
-        Omit the checks if there is no document in frame yet.
+2010-02-19  Steve Block  <steveblock@google.com>
 
-2009-08-24  Nate Chapin  <japhet@chromium.org>
+        Not reviewed. Reverts r55020 which causes crashes in Chromium LayoutTests
 
-        Reviewed by Eric Seidel.
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * storage/Database.cpp:
 
-        Fix crash in fast/css/rem-dynamic-scaling.html due to a freed
-        RenderStyle being accessed.
+2010-02-19  Steve Block  <steveblock@google.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28681
+        Reviewed by David Levin.
 
-        * dom/Element.cpp:
-        (WebCore::Element::recalcStyle): Make currentStyle a RefPtr.
+        Sets default values of V8 runtime enabler flags to match behavior with JSC
+        https://bugs.webkit.org/show_bug.cgi?id=35095
 
-2009-08-24  Dan Bernstein  <mitz@apple.com>
+        No new tests, modifies a Chromium feature only.
 
-        Reviewed by Simon Fraser.
+        * bindings/generic/RuntimeEnabledFeatures.cpp: Modified. Sets appcache and geolocation flag defaults to 'on'
+        * storage/Database.cpp: Modified. Sets database flag default to 'on'.
 
-        <rdar://problem/5743105> Long freezing during loading and selecting text
-        of a large table
-        https://bugs.webkit.org/show_bug.cgi?id=14918
+2010-02-19  Alexander Pavlov  <apavlov@chromium.org>
 
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::setSelection): Added calls to
-            beginDeferredRepaints() and endDeferredRepaints() around the
-            invalidation of the selection, in order to better coalesce multiple
-            invalid rectangles.
-
-2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
+        Reviewed by Pavel Feldman.
 
-        WebInspector: Simplify findTreeElement code, get rid of potential infinite loop.
+        WebInspector: Elements panel: Correctly show empty elements' ending tags
+        for XML and HTML documents.
+        https://bugs.webkit.org/show_bug.cgi?id=26315
 
-        https://bugs.webkit.org/show_bug.cgi?id=28680
+        Test: inspector/elements-panel-xhtml-structure.xhtml
 
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
         * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
-        * inspector/front-end/treeoutline.js:
-        (TreeOutline.prototype.getCachedTreeElement):
-        (TreeOutline.prototype.findTreeElement):
-        * inspector/front-end/utilities.js:
-        (isAncestorNode):
-        ():
-
-2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+        (WebInspector.ElementsTreeOutline.prototype.set rootDOMNode):
+        (WebInspector.ElementsTreeOutline.prototype.get isXMLMimeType):
+        (WebInspector.ElementsTreeOutline.prototype._contextMenuEventFired):
+        (WebInspector.ElementsTreeElement.prototype.onexpand):
+        (WebInspector.ElementsTreeElement.prototype.oncollapse):
+        (WebInspector.ElementsTreeElement.prototype.updateTitle.callback):
+        (WebInspector.ElementsTreeElement.prototype.updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
 
-        Reviewed by Timothy Hatcher.
+2010-02-19  Pavel Feldman  <pfeldman@chromium.org>
 
-        WebInspector: Do expand local scope when hitting the break
+        Not reviewed. Chromium build fix: reverting r54997 and r54998.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28678
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::protocolAccessorSetter):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::setProtocol):
+        (WebCore::KURL::isHierarchical):
 
-        * inspector/front-end/ScopeChainSidebarPane.js:
-        (WebInspector.ScopeChainSidebarPane.prototype.update):
+2010-02-17  Philippe Normand  <pnormand@igalia.com>
 
-2009-08-24  Ada Chan  <adachan@apple.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Steve Falkenburg.
+        [GTK] RTP/RTSP streams playback support
+        https://bugs.webkit.org/show_bug.cgi?id=33662
 
-        Make sure we use the current FrameView's frame rect when
-        going back to a cached page.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=28659
+        Added live pipelines support in updateStates().
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::open):
+        * manual-tests/video-rtsp.html: Added.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::updateStates):
 
-2009-08-24  Cameron McCormack  <cam@mcc.id.au>
+2010-02-18  Yaar Schnitman  <yaar@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Modifying <text rotate=""> doesn't clear the corresponding SVGAnimatedNumberList
-        https://bugs.webkit.org/show_bug.cgi?id=28673
-
-        Test: svg/dom/text-rotate-live.html
-
-        * svg/SVGNumberList.cpp:
-        (WebCore::SVGNumberList::parse): Clear the list before adding the parsed
-        numbers.
-
-2009-08-24  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by NOBODY (build fix)
-
-        Turn off ENABLE_3D_CANVAS in the xconfig files.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Only expand local scope when hitting the break
+        Normalize custom ctors for Image, Option, Audio
+        https://bugs.webkit.org/show_bug.cgi?id=34782
 
-        https://bugs.webkit.org/show_bug.cgi?id=28678
-
-        * inspector/front-end/ScopeChainSidebarPane.js:
-        (WebInspector.ScopeChainSidebarPane.prototype.update):
-
-2009-08-24  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        background-size fails to parse if a single length/percentage/auto is followed by a comma
-        https://bugs.webkit.org/show_bug.cgi?id=28674
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFillSize): Added an allowComma parameter,
-            which is set to false when this method consumes a comma. Moved
-            handling of 'contain' and 'cover' from parseFillProperty into this
-            method.
-        (WebCore::CSSParser::parseFillProperty): Set allowComma to true before
-            processing the next value, and pass allowComma to parseFillSize.
-        * css/CSSParser.h:
-
-2009-08-17  Martin Robinson  <martin.james.robinson@gmail.com>
-
-        Reviewed by Gustavo Noronha.
+        Test: fast/js/custom-constructors.html
 
-        [GTK] Support for cursors that are images
-        https://bugs.webkit.org/show_bug.cgi?id=28346
-
-        Added support for cursors which are images for CursorGtk. Added
-        a manual test for this.
-
-        * manual-tests/gtk/cursor-image.html: Added.
-        * manual-tests/gtk/resources/redcursor.cur: Added.
-        * platform/gtk/CursorGtk.cpp:
-        (WebCore::Cursor::Cursor):
-
-2009-08-24  Zan Dobersek  <zandobersek@gmail.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] Integrate GStreamer video with the graphics backend
-        https://bugs.webkit.org/show_bug.cgi?id=16356
-
-        Improves GStreamer backend implementation of MediaPlayerPrivate class.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::mediaPlayerPrivateErrorCallback): Send proper MediaPlayer
-        error for different GStreamer errors to MediaPlayerPrivate.
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Move static
-        initialization boolean to a better place.
-        (WebCore::MediaPlayerPrivate::play):
-        (WebCore::MediaPlayerPrivate::pause):
-        (WebCore::MediaPlayerPrivate::duration): Return if error occured, do not
-        consider the source as stream if duration query failed.
-        (WebCore::MediaPlayerPrivate::currentTime): Return if error occured, use
-        an early return.
-        (WebCore::MediaPlayerPrivate::seek): Return if error occured.
-        (WebCore::MediaPlayerPrivate::setEndTime): Remove implementation since this
-        function doesn't seem to be used anywhere in WebCore.
-        (WebCore::MediaPlayerPrivate::paused):
-        (WebCore::MediaPlayerPrivate::seeking):
-        (WebCore::MediaPlayerPrivate::setRate): Seek to current time when rate is set.
-        (WebCore::MediaPlayerPrivate::maxTimeBuffered): Return if error occured.
-        (WebCore::MediaPlayerPrivate::maxTimeSeekable): Ditto.
-        (WebCore::MediaPlayerPrivate::maxTimeLoaded): Ditto.
-        (WebCore::MediaPlayerPrivate::bytesLoaded):
-        (WebCore::MediaPlayerPrivate::totalBytesKnown):
-        (WebCore::MediaPlayerPrivate::totalBytes): Ditto.
-        (WebCore::MediaPlayerPrivate::updateStates): Return if error occured, update
-        after seek ended with a successful change
-        (WebCore::MediaPlayerPrivate::didEnd): Do not pause the playbin when end is reached.
-        (WebCore::MediaPlayerPrivate::loadingFailed): Update network state with the given error.
-        (WebCore::mimeTypeCache): Gather supported mime types from GStreamer.
-        (WebCore::MediaPlayerPrivate::getSupportedTypes):
-        (WebCore::MediaPlayerPrivate::supportsType):
-        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
-        (WebCore::MediaPlayerPrivate::supportsFullscreen): First step towards fullscreen
-        support.
-        (WebCore::MediaPlayerPrivate::createGSTPlayBin): Use playbin2 instead of playbin,
-        do not set playbin's audio sink.
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_idle_func): Use C+casts, decrease reference count of async
-        queue at the end of the idle function.
-        (webkit_video_sink_render): Increase reference count of async queue.
-        (webkit_video_sink_stop): Remove any idle functions with the sink as data.
-
-2009-08-23  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Remaining new files for Canvas3D
-        https://bugs.webkit.org/show_bug.cgi?id=28018
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        (WebCore::constructAudio):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::constructImage):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::constructHTMLOptionElement):
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::v8HTMLAudioElementConstructorCallback):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::v8HTMLOptionElementConstructorCallback):
+        * html/HTMLAudioElement.cpp:
+        (WebCore::HTMLAudioElement::HTMLAudioElement):
+        (WebCore::HTMLAudioElement::createForJSConstructor):
+        * html/HTMLAudioElement.h:
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::createForJSConstructor):
+        (WebCore::HTMLImageElement::mapToEntry):
+        (WebCore::HTMLImageElement::createRenderer):
+        (WebCore::HTMLImageElement::attach):
+        (WebCore::HTMLImageElement::width):
+        (WebCore::HTMLImageElement::height):
+        (WebCore::HTMLImageElement::naturalHeight):
+        * html/HTMLImageElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::HTMLOptionElement):
+        (WebCore::HTMLOptionElement::createForJSConstructor):
+        (WebCore::HTMLOptionElement::ownerSelectElement):
+        (WebCore::HTMLOptionElement::nonRendererRenderStyle):
+        (WebCore::HTMLOptionElement::disabled):
+        (WebCore::HTMLOptionElement::insertedIntoTree):
+        * html/HTMLOptionElement.h:
 
-        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added Canvas3D method behind an ifdef
-        * html/canvas/CanvasByteArray.cpp: Added. Efficient array of bytes for passing to GL functions
-        * html/canvas/CanvasByteArray.h: Added.
-        * html/canvas/CanvasByteArray.idl: Added.
-        * html/canvas/CanvasNumberArray.cpp: Added. Efficient array of 32 bit floats for passing to GL functions
-        * html/canvas/CanvasNumberArray.h: Added.
-        * html/canvas/CanvasNumberArray.idl: Added.
+2010-02-18  Simon Fraser  <simon.fraser@apple.com>
 
-2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+        No Review.
 
-        Reviewed by Timothy Hatcher.
+        Remove a couple of extraneous spaces that got added to the project file
+        by hand-ending.
 
-        WebInspector: Migrate call frames interaction to the InjectedScript-based schema.
+        * WebCore.xcodeproj/project.pbxproj:
 
-        https://bugs.webkit.org/show_bug.cgi?id=28408
+2010-02-18  Simon Fraser  <simon.fraser@apple.com>
 
-        * inspector/front-end/CallStackSidebarPane.js:
-        (WebInspector.CallStackSidebarPane.prototype.update):
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.doEvalInWindow):
-        (WebInspector.ConsoleTextMessage):
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMAgent.prototype.get domWindow):
-        (InspectorController.openInInspectedWindow):
-        (InspectorController.getCallFrames):
-        (InspectorController.evaluateInCallFrame):
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.reset):
-        (WebInspector.ElementsPanel.prototype.generateStylesheet):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.evaluate):
-        (InjectedScript._evaluateOn):
-        (InjectedScript.openInInspectedWindow):
-        (InjectedScript.getCallFrames):
-        (InjectedScript.evaluateInCallFrame):
-        (InjectedScript._callFrameForId):
-        (InjectedScript._objectForId):
-        (InjectedScript.CallFrameProxy):
-        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertiesSection.prototype._update):
-        * inspector/front-end/ObjectProxy.js:
-        (WebInspector.ObjectPropertyProxy):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
-        * inspector/front-end/ScopeChainSidebarPane.js:
-        (WebInspector.ScopeChainSidebarPane):
-        (WebInspector.ScopeChainSidebarPane.prototype.update):
-        (WebInspector.ScopeVariableTreeElement.prototype.onattach):
-        (WebInspector.ScopeVariableTreeElement.prototype.onexpand):
-        (WebInspector.ScopeVariableTreeElement.prototype.oncollapse):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
-        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
-        (WebInspector.ScriptsPanel.prototype.debuggerPaused.callback):
-        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+        Reviewed by Dan Bernstein.
 
-2009-08-24  Kent Tamura  <tkent@chromium.org>
+        <rdar://problem/7535894> Page contents missing from snapshot on Newsweek.com article
+        
+        Add logic to determine when painting via the software rendering path will give an equivalent
+        result to the accelerated compositing presentation. This tests for the presence of 3D transforms
+        via the existing RenderLayerCompositor::has3DContent() method.
+        
+        * WebCore.base.exp: Export FrameView's isSoftwareRenderable(), paintBehavior() and setPaintBehavior().
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::isSoftwareRenderable): New method.
+        (WebCore::FrameView::paintBehavior): Make this non-inline so that we can reliably export it.
 
-        Reviewed by Eric Seidel.
+2010-02-18  Dan Bernstein  <mitz@apple.com>
 
-        Add support for the placeholder attribute and DOM property of the textarea element.
-        https://bugs.webkit.org/show_bug.cgi?id=21248
-
-        A DOM node for an INPUT element doesn't have a flag for placeholder
-        visibility anymore.  This patch also fixes a bug that a renderer
-        doesn't reflect a corresponding DOM value change.
-
-        Tests: fast/forms/textarea-placeholder-dom-property.html
-               fast/forms/textarea-placeholder-pseudo-style.html
-               fast/forms/textarea-placeholder-set-attribute.html
-               fast/forms/textarea-placeholder-set-value.html
-
-        * css/html.css: Add the default style for placeholder of textarea.
-        * dom/InputElement.cpp: Cleanup for m_placeholderShouldBeVisible removal
-        (WebCore::InputElement::dispatchFocusEvent):
-        (WebCore::InputElement::dispatchBlurEvent):
-        (WebCore::InputElement::placeholderShouldBeVisible):
-        (WebCore::InputElement::updatePlaceholderVisibility):
-        (WebCore::InputElement::setValueFromRenderer):
-        (WebCore::InputElementData::InputElementData):
-        * dom/InputElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::dispatchFocusEvent):
-        (WebCore::HTMLInputElement::dispatchBlurEvent):
-        (WebCore::HTMLInputElement::setValue):
-        (WebCore::HTMLInputElement::placeholderShouldBeVisible):
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::updatePlaceholderVisibility):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        (WebCore::HTMLTextAreaElement::setValue):
-        (WebCore::HTMLTextAreaElement::placeholderShouldBeVisible):
-        (WebCore::HTMLTextAreaElement::updatePlaceholderVisibility):
-        (WebCore::HTMLTextAreaElement::dispatchFocusEvent):
-        (WebCore::HTMLTextAreaElement::dispatchBlurEvent):
-        * html/HTMLTextAreaElement.h:
-        * html/HTMLTextAreaElement.idl:
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::RenderTextControl):
-        (WebCore::RenderTextControl::styleDidChange):
-        (WebCore::RenderTextControl::setInnerTextStyle):
-        (WebCore::RenderTextControl::updatePlaceholderVisibility):
-        * rendering/RenderTextControl.h:
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
-        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
-        (WebCore::RenderTextControlMultiLine::updateFromElement):
-        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
-        (WebCore::RenderTextControlMultiLine::textBaseStyle):
-        * rendering/RenderTextControlMultiLine.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
-        (WebCore::RenderTextControlSingleLine::textBaseStyle):
-        (WebCore::RenderTextControlSingleLine::updateFromElement):
-        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
-        * rendering/RenderTextControlSingleLine.h:
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::dispatchFocusEvent):
-        (WebCore::WMLInputElement::dispatchBlurEvent):
-        (WebCore::WMLInputElement::setValue):
-        (WebCore::WMLInputElement::placeholderShouldBeVisible):
+        Reviewed by John Sullivan.
 
-2009-08-23  Dirk Schulze  <krit@webkit.org>
+        <rdar://problem/7658811> Multiple style recalcs due to getComputedStyle() on “display: none;” element
+        when there are pending style sheets
 
-        Reviewed by Mark Rowe.
+        Test: fast/css/getComputedStyle/pending-stylesheet.html
 
-        Code clean-up and build fix for filters enabled builds. Moved SVGNames.h
-        into #if ENABLE(SVG) for Document.cpp and added SVGNames.h to the other
-        files. They are needed there after r47688.
+        When querying a property of a computed style declaration for a non-rendered element,
+        CSSStyleSelector::styleForElement() was called, and if there were pending style sheet, it
+        would behave as if the lack of renderer is due to FOUC suppression, and set a flag on
+        the document causing it to recalculate style. On the next computed style property access,
+        style would be recalculated for the document, but then the flag would get set again if the
+        element did not have a renderer.
 
         * dom/Document.cpp:
-        * svg/SVGComponentTransferFunctionElement.h:
-        * svg/SVGFELightElement.h:
-        * svg/SVGFEMergeNodeElement.h:
-        * svg/SVGFilterPrimitiveStandardAttributes.h:
-
-2009-08-23  Gustavo Noronha Silva  <gns@gnome.org>
-
-        Unreviewed, build fix for make distcheck on GTK+.
-
-        * GNUmakefile.am: Added files needed for the build.
-        * bindings/js/JSDOMWindowCustom.cpp: Protect SharedWorker include
-        with #if clause.
-        * bindings/js/JSEventTarget.cpp: Dito.
-        * dom/Document.cpp: Dito.
-        * loader/FrameLoader.cpp: Dito.
-
-2009-08-23  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Throws an Error on "null"
-        https://bugs.webkit.org/show_bug.cgi?id=28665
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.evaluate):
-
-2009-08-23  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: REGRESSION Formatting Function in Console is Abbreviated Too Often
-
-        https://bugs.webkit.org/show_bug.cgi?id=28666
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getProperties):
-        (InjectedScript.createProxyObject):
-
-2009-08-22  Martin Robinson  <martin.james.robinson@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] BitmapImage::getGdkPixbuf does not handle alpha channels properly
-        https://bugs.webkit.org/show_bug.cgi?id=28345
-
-        When doing the conversion between cairo_surface_t* and GdkPixbuf*
-        account for the differences in the respective formats' in-memory
-        image format.
-
-        * platform/graphics/gtk/ImageGtk.cpp:
-        (WebCore::getCairoSurfacePixel):
-        (WebCore::getGdkPixbufPixel):
-        (WebCore::BitmapImage::getGdkPixbuf):
-
-2009-08-22  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Make DOM classes start with a reference count of 1, like all other RefCounted
-        
-        Next step: Element, HTMLElement, HTMLAnchorElement, HTMLAppletElement,
-        HTMLAreaElement, HTMLEmbedElement, HTMLFrameElement, HTMLIFrameElement,
-        HTMLObjectElement, HTMLPlugInElement, HTMLPlugInImageElement.
-
-        * DerivedSources.make: Fix error seen every time we build by escaping the $
-        in the build rule, since you have to use $$ for that in make.
-
-        * WebCore.base.exp: Updated.
-
-        * bindings/objc/DOM.mm:
-        Added now-needed include of SVGNames.h.
-
-        * dom/Document.cpp: Added now-needed include of SVGNames.h.
-        (WebCore::Document::createElement): Use create instead of new.
-
+        (WebCore::Document::styleForElementIgnoringPendingStylesheets): Added. Temporarily sets
+        m_ignorePendingStylesheets around the call to CSSStyleSelector::styleForElement().
+        * dom/Document.h:
         * dom/Element.cpp:
-        (WebCore::Element::Element): Added ConstructionType argument so the caller
-        can determine whether this starts with a reference count of either 0 or 1.
-        Later we will remove this again once they are all 1.
-        (WebCore::Element::create): Added.
+        (WebCore::Element::computedStyle): Use Document::styleForElementIgnoringPendingStylesheets().
 
-        * dom/Element.h: Added create and made constructor protected.
+2010-02-18  Dirk Schulze  <krit@webkit.org>
 
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::StyledElement): Added ConstructionType argument.
-        * dom/StyledElement.h: Made many functions protected or private, including
-        the constructor.
-
-        * dom/make_names.pl: Use create to create the base elements HTMLElement,
-        SVGElement, and WMLElement.
+        Reviewed by Nikolas Zimmermann.
 
-        * editing/CreateLinkCommand.cpp:
-        (WebCore::CreateLinkCommand::doApply): Use create instead of new.
-        * editing/UnlinkCommand.cpp:
-        (WebCore::UnlinkCommand::doApply): Ditto.
+        Move SVGResources to Renderers, starting with Masker
+        https://bugs.webkit.org/show_bug.cgi?id=35020
 
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::create): Added.
-        * html/HTMLAnchorElement.h: Made constructor protected and added create.
-        Also made m_rootEditableElementForSelectionOnMouseDown a RefPtr.
+        We have rendering specific code in WebCore/svg/graphics. The goal is to move
+        this code into suitable Renderers. This helps us to clean up the code and makes
+        maintenance easier. It also makes it possible to remove rendering specific code
+        from SVG*Elements into this renderers. So the Renderer contains everything that
+        is needed to use the resource.
+        RenderSVGResource will be the base class for all new resource render classes like
+        RenderSVGResourceMasker, RenderSVGResourceClipper and the other resources.
 
-        * html/HTMLAppletElement.cpp:
-        (WebCore::HTMLAppletElement::create): Added.
-        * html/HTMLAppletElement.h: Made constructor private and added create.
+        This patch starts moving SVGResourceMasker to RenderSVGResourceMasker.
+        Another benefit is the much more useful result in DRT on using masker.
 
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::create): Added.
-        * html/HTMLAreaElement.h: Made constructor private and added create.
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::toRenderSVGResource): Conversion to RenderSVGResource base class.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGResource): Check if renderer is a resource.
+        * rendering/RenderPath.cpp:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGImage.h: Some code clean up according to the webkit style.
+        (WebCore::RenderSVGImage::toSVGRenderBase):
+        (WebCore::RenderSVGImage::renderName):
+        (WebCore::RenderSVGImage::isSVGImage):
+        (WebCore::RenderSVGImage::localToParentTransform):
+        (WebCore::RenderSVGImage::strokeBoundingBox):
+        (WebCore::RenderSVGImage::requiresLayer):
+        (WebCore::RenderSVGImage::localTransform):
+        * rendering/RenderSVGInlineText.h:
+        (WebCore::RenderSVGInlineText::objectBoundingBox): Needed for SVGRenderTreeAsText
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGResource.h: Added.
+        (WebCore::): Base class for all Resource renderers like masker, clipper and others.
+        (WebCore::RenderSVGResource::RenderSVGResource):
+        (WebCore::RenderSVGResource::cast):
+        (WebCore::RenderSVGResource::toRenderSVGResource):
+        (WebCore::RenderSVGResource::isSVGResource): 
+        (WebCore::RenderSVGResource::drawsContents):
+        (WebCore::getRenderSVGResourceById):
+        * rendering/RenderSVGResourceMasker.cpp: Added.
+        (WebCore::RenderSVGResourceMasker::RenderSVGResourceMasker):
+        (WebCore::RenderSVGResourceMasker::~RenderSVGResourceMasker):
+        (WebCore::RenderSVGResourceMasker::invalidateClients): Status of masker changed, remove all clients.
+        (WebCore::RenderSVGResourceMasker::invalidateClient): Status of an object changed, remove pending client.
+        (WebCore::RenderSVGResourceMasker::applyResource): Apply masker to object.
+        (WebCore::RenderSVGResourceMasker::resourceBoundingBox): boundingBox of the resource, depending on the object.
+        (WebCore::RenderSVGResourceMasker::createMaskImage): Creates the mask image, the context gets clipped with.
+        * rendering/RenderSVGResourceMasker.h: Added.
+        (WebCore::MaskerData::MaskerData):
+        (WebCore::RenderSVGResourceMasker::renderName):
+        (WebCore::RenderSVGResourceMasker::maskUnits): Unit of mask for DRT.
+        (WebCore::RenderSVGResourceMasker::maskContentUnits): Unit of childs from mask for DRT.
+        (WebCore::RenderSVGResourceMasker::resourceType):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::destroy): dito.
+        * rendering/RenderSVGText.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::maskerBoundingBoxForRenderer):
+        (WebCore::SVGRenderBase::deregisterFromResources): Unregister object from all it's resources after status changed.
+        * rendering/SVGRenderSupport.h:
+        (WebCore::SVGRenderBase::toSVGRenderBase):
+        (WebCore::SVGRenderBase::strokeBoundingBox):
+        (WebCore::SVGRenderBase::markerBoundingBox):
+        * rendering/SVGRenderTreeAsText.cpp: Update TreeAsText to dump maskers correctly.
+        (WebCore::operator<<):
+        (WebCore::writeSVGResource):
+        (WebCore::writeSVGContainer):
+        (WebCore::writeSVGText):
+        (WebCore::writeSVGInlineText):
+        (WebCore::writeSVGImage):
+        (WebCore::write):
+        (WebCore::writeResourcesToObject):
+        * rendering/SVGRenderTreeAsText.h:
+        * svg/SVGMaskElement.cpp: Update Masker to use the new renderer.
+        (WebCore::SVGMaskElement::svgAttributeChanged):
+        (WebCore::SVGMaskElement::childrenChanged):
+        (WebCore::SVGMaskElement::maskBoundingBox):
+        (WebCore::SVGMaskElement::createRenderer):
+        * svg/SVGMaskElement.h:
+        * svg/SVGStyledElement.cpp: We need to tell the renderer to unregister object, after the status changed.
+        (WebCore::SVGStyledElement::invalidateResources):
+        (WebCore::SVGStyledElement::invalidateResourcesInAncestorChain):
+        * svg/SVGUnitTypes.h: Conversion of integer to SVGUnitType.
+        (WebCore::toUnitType):
+        * svg/graphics/SVGResource.h:
+        (WebCore::):
+        (WebCore::SVGResource::isMarker):
+        * svg/graphics/SVGResourceMasker.cpp: Removed.
+        * svg/graphics/SVGResourceMasker.h: Removed.
 
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::create): Added.
-        * html/HTMLElement.h: Made constructor protected and added create.
-        Made other functions protected and private. Also added inline
-        definition of constructor.
+2010-02-18  Dumitru Daniliuc  <dumi@chromium.org>
 
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::create): Added.
-        * html/HTMLEmbedElement.h: Made constructor private and added create.
-        Made other functions private.
+        Reviewed by Dimitri Glazkov.
 
-        * html/HTMLFrameElement.cpp:
-        (WebCore::HTMLFrameElement::create): Added.
-        (WebCore::HTMLFrameElement::parseMappedAttribute):
-        * html/HTMLFrameElement.h: Made constructor private and added create.
-        Made other functions private.
+        Allow creating/dropping virtual tables when the module is FTS2.
 
-        * html/HTMLFrameElementBase.h: Made functions protected and private.
+        https://bugs.webkit.org/show_bug.cgi?id=34867
 
-        * html/HTMLFrameOwnerElement.cpp:
-        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement): Pass
-        CreateElement so reference count starts at 1.
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::createVTable):
+        (WebCore::DatabaseAuthorizer::dropVTable):
 
-        * html/HTMLFrameOwnerElement.h: Made functions protected and private.
+2010-02-18  Peter Kasting  <pkasting@google.com>
 
-        * html/HTMLIFrameElement.cpp:
-        (WebCore::HTMLIFrameElement::create): Added.
-        * html/HTMLIFrameElement.h: Made constructor private and added create.
-        Made other functions private.
+        Not reviewed, Chromium build fix.
 
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::create): Added.
-        (WebCore::HTMLObjectElement::containsJavaApplet): Changed while loop
-        into a for loop and tweaked formatting.
+        r54963 had a typo in the WebCore.gypi change.
+        https://bugs.webkit.org/show_bug.cgi?id=35003
 
-        * html/HTMLObjectElement.h: Made constructor private and added create.
-        Made other functions private.
+        * WebCore.gypi:
 
-        * html/HTMLPlugInElement.h: Made constructor protected.
-        Made other functions protected and private.
+2010-02-18  Vangelis Kokkevis  <vangelis@chromium.org>
 
-        * html/HTMLPlugInImageElement.h: Made constructor and another function
-        protected.
+        Reviewed by Simon Fraser.
 
-        * html/HTMLTagNames.in: Removed createWithNew from all classes that
-        now have create functions. Moved conditional noscript to a separate
-        paragraph.
+        Changing forward declaration of TimingFunction in GraphicsLayer.h from
+        class to struct to match its actual definition in TimingFunction.h
 
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Use create.
-        (WebCore::HTMLViewSourceDocument::addLink): Ditto.
-        * page/DragController.cpp:
-        (WebCore::documentFragmentFromDragData): Ditto.
+        https://bugs.webkit.org/show_bug.cgi?id=35069
 
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::SVGElement): Pass CreateElementZeroRefCount
-        so reference count still starts at 0. Will change this class later.
-        (WebCore::SVGElement::create): Added.
-        * svg/SVGElement.h: Added create, made constructor protected, and
-        made other functions protected and private. Removed unneeded
-        SVGNames.h include.
 
-        * svg/SVGExternalResourcesRequired.h: Added now-needed SVGNames.h
-        include.
+        * platform/graphics/GraphicsLayer.h:
+           Change forward declaration from: class TimingFunction to:
+           struct TimingFunction
 
-        * svg/SVGStopElement.h: Added now-needed SVGNames.h include.
-        Made functions private.
+2010-02-18  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        * wml/WMLElement.cpp:
-        (WebCore::WMLElement::WMLElement): Pass CreateElementZeroRefCount
-        so reference count still starts at 0. Will change this class later.
-        (WebCore::WMLElement::create): Added.
-        * wml/WMLElement.h: Added create and made constructor protected.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * wml/WMLTagNames.in: Removed createWithNew from WMLElement.
+        [Qt] Minor improvement to hybrid QPixmap
+        https://bugs.webkit.org/show_bug.cgi?id=34507
+        Instead of having toHTMLImageElement which creates a new element,
+        assignToHTMLImageElement would set an existing HTML <img/> element to
+        contain the native QPixmap/QImge.
+        Also made some style fixes.
 
-2009-08-22  Adele Peterson  <adele@apple.com>
+        Additions to existing tests: see WebKit/qt/tests
 
-        Reviewed by Anders Carlsson.
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapWidthField::valueFromInstance): style
+        (JSC::Bindings::QtPixmapHeightField::valueFromInstance): style
+        (JSC::Bindings::QtPixmapAssignToElementMethod::name): assignTo
+        (JSC::Bindings::QtPixmapAssignToElementMethod::invoke): new function
+        (JSC::Bindings::QtPixmapAssignToElementMethod::numParameters): 1
+        (JSC::Bindings::QtPixmapToDataUrlMethod::invoke): style
+        (JSC::Bindings::QtPixmapToStringMethod::invoke): style
+        (JSC::Bindings::QtPixmapInstance::invokeMethod): style
+        (JSC::Bindings::QtPixmapClass::methodsNamed): new func, removed old
+        (JSC::Bindings::QtPixmapInstance::getPropertyNames): ditto
+        (JSC::Bindings::QtPixmapInstance::defaultValue): style
+        (JSC::Bindings::QtPixmapInstance::valueOf): style
+        (JSC::Bindings::QtPixmapInstance::toPixmap): style
+        (JSC::Bindings::QtPixmapInstance::variantFromObject): style
 
-        Fix for <rdar://problem/7161656> Crash in RenderObject::destroy when using custom scrollbars
+2010-02-18  Peter Kasting  <pkasting@google.com>
 
-        Custom scrollbars normally get detached when a document gets detached.  In this case, a crash was happening when the document had gone into the page cache 
-        and then was getting destroyed without proper scrollbar teardown.  This change makes custom scrollbars get detached when the document enters the cache.
+        Not reviewed, bustage fix.
 
-        I couldn't figure out a way to reliably cause this to happen in DRT, since the reproducible case relies on the cache being purged at a particular time.
+        An extraneous line in r54839 broke GIF animation.
 
-        * history/CachedFrame.cpp: (WebCore::CachedFrame::CachedFrame): Detach custom scrollbars when the CachedFrame is created.  
-          They'll get reattached when the document comes out of the page cache.
-        * page/FrameView.cpp: (WebCore::FrameView::~FrameView): Added some asserts to catch this problem earlier in debug builds.
+        * platform/image-decoders/gif/GIFImageReader.cpp:
+        (GIFImageReader::read):
 
-2009-08-22  David Hyatt  <hyatt@apple.com>
+2010-02-18  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by Simon Fraser.
 
-        Make sure self-collapsing blocks that clear floats are still able to collapse their bottom margins with
-        the bottom of their parent blocks.  The old code prevented all collapsing, but all CSS2.1 states is that:
-        "An element that has had clearance applied to it never collapses its top margin with its parent block's bottom margin."
-        
-        The implication is that the bottom margin can still collapse, and the block-inside-inline form of
-        fast/block/margin-collapse/025.html (added as fast/block/margin-collapse/block-inside-inline/025.html) depends
-        on it to get comparable results.
+        <rdar://problem/7650652> REGRESSION: Selection painting issue in bug review textbox
+        https://bugs.webkit.org/show_bug.cgi?id=34946
 
-        Added block-inside-inline tests (a whole slew of them) in fast/block/margin-collapse/block-inside-inline/
+        Test: fast/repaint/selection-gap-overflow-scroll-2.html
 
         * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::MarginInfo::MarginInfo):
-        (WebCore::RenderBlock::collapseMargins):
-        (WebCore::RenderBlock::clearFloatsIfNeeded):
-        (WebCore::RenderBlock::handleBottomOfBlock):
-        * rendering/RenderBlock.h:
-        (WebCore::RenderBlock::MarginInfo::clearMargin):
-        (WebCore::RenderBlock::MarginInfo::canCollapseBottomWithChildren):
+        (WebCore::RenderBlock::paintSelection): localToContainerQuad() adjusts for
+        overflow scroll, but RenderLayer::addBlockSelectionGapsBounds() takes
+        non-scrolled coordinates, so account for that.
 
-2009-08-22  Chris Fleizach  <cfleizach@apple.com>
+2010-02-17  Dumitru Daniliuc  <dumi@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Need to implement ARIA role="listitem" and role="list"
-        https://bugs.webkit.org/show_bug.cgi?id=28606
-
-        Test: platform/mac-snowleopard/accessibility/aria-list-and-listitem.html
-
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::getOrCreate):
-        * accessibility/AccessibilityList.cpp:
-        (WebCore::AccessibilityList::isUnorderedList):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::RoleEntry::):
-
-2009-08-21  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Clean up fill image geometry calculation
-        https://bugs.webkit.org/show_bug.cgi?id=28652
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateFillTileSize): Renamed
-            calculateBackgroundSize() to this. Replaced separate scaledWidth and
-            scaledHeight parameters with a single scaledSize parameter. Renamed
-            parameters and local variables.
-        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Changed
-            to use CSS3 Backgrounds and Borders terminology in comments and
-            local variable names. Renamed, clarified and consolidated some local
-            variables.
-        * rendering/RenderBoxModelObject.h: Made calculateFillTileSize() private.
-
-2009-08-22  Chris Marrin  <cmarrin@apple.com>
-
-        Unreviewed, build fix.
-
-        Backing out http://trac.webkit.org/changeset/47669
-
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        * html/canvas/CanvasRenderingContext2D.h:
-
-2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        Backing out http://trac.webkit.org/changeset/47671 in preparation of
-        rolling out http://trac.webkit.org/changeset/47669.
-
-2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Anders Carlsson.
+        Change the V8 and JSC SQLStatementErrorCallback to interpret
+        'undefined' return values as 'true', as required by the spec.
 
-        Build fix, add CanvasRenderingContext to build systems.
-        https://bugs.webkit.org/show_bug.cgi?id=28018
+        https://bugs.webkit.org/show_bug.cgi?id=35048
 
-        * DerivedSources.make: Added CanvasRenderinContext.
-        * GNUmakefile.am: Ditto.
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * WebCoreSources.bkl: Ditto.
-
-2009-08-21  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        New files implementing GL buffer wrappers, and support to make them platform independent
-        https://bugs.webkit.org/show_bug.cgi?id=28018
-
-        * html/canvas/CanvasBuffer.cpp: Added. Wrapper around GL Buffer object
-        * html/canvas/CanvasBuffer.h: Added.
-        * html/canvas/CanvasBuffer.idl: Added.
-        * html/canvas/CanvasFramebuffer.cpp: Added. Wrapper around GL Framebuffer object
-        * html/canvas/CanvasFramebuffer.h: Added.
-        * html/canvas/CanvasFramebuffer.idl: Added.
-        * html/canvas/CanvasObject.h: Expose m_context
-        * html/canvas/CanvasProgram.cpp: Added. Wrapper around GL Program object
-        * html/canvas/CanvasProgram.h: Added.
-        * html/canvas/CanvasProgram.idl: Added.
-        * html/canvas/CanvasRenderbuffer.cpp: Added. Wrapper around GL Renderbuffer object
-        * html/canvas/CanvasRenderbuffer.h: Added.
-        * html/canvas/CanvasRenderbuffer.idl: Added.
-        * html/canvas/CanvasRenderingContext3D.cpp: Move m_objects hash table from GraphicsContext3D to here
-        * html/canvas/CanvasRenderingContext3D.h:
-        * html/canvas/CanvasShader.cpp: Added. Wrapper around GL Shader object
-        * html/canvas/CanvasShader.h: Added.
-        * html/canvas/CanvasShader.idl: Added.
-        * html/canvas/CanvasTexture.cpp: Added. Wrapper around GL Texture object
-        * html/canvas/CanvasTexture.h: Added.
-        * html/canvas/CanvasTexture.idl: Added.
-        * platform/graphics/GraphicsContext3D.cpp: Removed.
-        * platform/graphics/GraphicsContext3D.h: Move m_objects hash table from here to CanvasRenderingContext3D
-        * platform/graphics/mac/GraphicsContext3DMac.cpp: Implement platform dependent code for GL object creation/destruction
-
-2009-08-21  Darin Adler  <darin@apple.com>
-
-        * WebCore.vcproj/build-generated-files.sh:
-        * make-generated-sources.sh:
-        Removed obsolete code to set up CREATE_HASH_TABLE.
-
-2009-08-21  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        <rdar://problem/7162322> Custom style sheet ignored if UAC is enabled 
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::invokeCallbackHelper):
+        (WebCore::invokeCallback):
+        (WebCore::invokeCallbackTreatUndefinedAsTrue):
+        * bindings/v8/custom/V8CustomVoidCallback.h:
 
-        * platform/win/SharedBufferWin.cpp: (WebCore::SharedBuffer::createWithContentsOfFile): 
-        No need to open the file with write access.  Only read access is needed.
+2010-02-17  Ojan Vafai  <ojan@chromium.org>
 
-2009-08-21  Alexey Proskuryakov  <ap@apple.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Darin Adler.
+        keyboard selection sometimes moves the wrong end of the selection for Win/Linux
+        https://bugs.webkit.org/show_bug.cgi?id=35066
 
-        <rdar://problem/7161454> Leaks seen during http/tests/xmlhttprequest/cross-origin-no-authorization.html
+        On Windows/Linux keyboard based selections should always move the same
+        end of the seleciton. On Mac, lineboundary and documentboundary changes
+        move different ends of the selection depending on which direction your
+        extending.
 
-        Also fixes leaks seen on appcache tests.
+        Test: editing/selection/extend-after-mouse-selection.html
 
-        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::cancel): Work around
-        something that's likely a CFNetwork issue. Note that on Windows, there is no matching API
-        to call, and we do not think that the leak occurs there anyway.
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::positionForPlatform):
+        (WebCore::SelectionController::startForPlatform):
+        (WebCore::SelectionController::endForPlatform):
+        (WebCore::SelectionController::modifyExtendingRight):
+        (WebCore::SelectionController::modifyExtendingForward):
+        (WebCore::SelectionController::modifyMovingForward):
+        (WebCore::SelectionController::modifyExtendingBackward):
+        (WebCore::SelectionController::modifyMovingBackward):
+        * editing/SelectionController.h:
 
-2009-08-21  Dmitry Titov  <dimich@chromium.org>
+2010-02-18  Timothy Hatcher  <timothy@apple.com>
 
-        Reviewed by David Levin.
+        Add "with" to the list of keywords to syntax highlight.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28650
-        Remove cross-thread code from CrossOriginPreflightResultCache.
-        Removed mutexes, atomic initializer and string copy.
+        http://webkit.org/b/35123
 
-        No new tests, the worker tests cover this.
+        Reviewed by Pavel Feldman.
 
-        * loader/CrossOriginPreflightResultCache.cpp:
-        (WebCore::addToAccessControlAllowList):
-        (WebCore::CrossOriginPreflightResultCache::shared):
-        (WebCore::CrossOriginPreflightResultCache::appendEntry):
-        (WebCore::CrossOriginPreflightResultCache::canSkipPreflight):
-        (WebCore::CrossOriginPreflightResultCache::empty):
-        * loader/CrossOriginPreflightResultCache.h:
+        * inspector/front-end/SourceJavaScriptTokenizer.js:
+        (WebInspector.SourceJavaScriptTokenizer): Add "width" to _keywords.
+        * inspector/front-end/SourceJavaScriptTokenizer.re2js:
+        (WebInspector.SourceJavaScriptTokenizer): Ditto.
 
-2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+2010-02-17  Peter Kasting  <pkasting@google.com>
 
-        Reviewed by Jan Alonzo.
+        Reviewed by Adam Barth.
 
-        Buildfix after http://trac.webkit.org/changeset/47655.
+        Rework PNG-in-ICO decoding to copy the decoded framebuffer into the ICO
+        decoder, making the logic less crazy and more like the other decoders.
+        https://bugs.webkit.org/show_bug.cgi?id=28751
 
-        * html/HTMLFormControlElement.h:
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::RGBA32Buffer::operator=):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::frameBufferAtIndex):
+        (WebCore::ICOImageDecoder::decodeAtIndex):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::operator=):
+        * platform/image-decoders/skia/ImageDecoderSkia.cpp:
+        (WebCore::RGBA32Buffer::operator=):
 
-2009-08-19  Joseph Pecoraro  <joepeck@webkit.org>
+2010-02-18  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Inspector: Improve Cookie DataGrid to Show Hidden Data
-        https://bugs.webkit.org/show_bug.cgi?id=28269
-
-          Removed Custom Bindings
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        * inspector/InspectorBackend.cpp:
-
-          Made Non-Custom Bindings in the Backend
-
-        (WebCore::InspectorBackend::getCookies):
-        (WebCore::InspectorBackend::deleteCookie):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::deleteCookie):
-        * inspector/InspectorController.h:
+        Web Inspector: multiple popovers on screen at the same time.
 
-          Build the Cookie ScriptObjects, handles using document.cookie in
-          case the platform hasn't implemented raw cookie access.
+        https://bugs.webkit.org/show_bug.cgi?id=35105
 
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::getCookies):
-        (WebCore::InspectorDOMAgent::buildObjectForCookie):
-        (WebCore::InspectorDOMAgent::buildArrayForCookies):
-        * inspector/InspectorDOMAgent.h:
-
-          Complete the Asynchronous Calls
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover.prototype.show):
+        (WebInspector.Popover.prototype.hide):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._showPopup):
 
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::didGetCookies):
-        * inspector/InspectorFrontend.h:
+2010-02-18  Pavel Feldman  <pfeldman@chromium.org>
 
-          Asynchronous Functions to get Cookie Data
+        Reviewed by Timothy Hatcher.
 
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.Cookies.getCookiesAsync):
-        (WebInspector.Cookies.buildCookiesFromString): fallback behavior
+        Web Inspector: Expand Object.__proto__ properly.
 
-          Refactor to use the Asynchronous Functions
+        https://bugs.webkit.org/show_bug.cgi?id=35113
 
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView):
-        (WebInspector.CookieItemsView.prototype.get statusBarItems):
-        (WebInspector.CookieItemsView.prototype.update.callback):
-        (WebInspector.CookieItemsView.prototype.update):
-        (WebInspector.CookieItemsView.prototype.simpleDataGridForCookies):
-        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
-
-          Cleaned/Commented Related Code
-
-        (InspectorController.searchCanceled):
+        * inspector/front-end/EventListenersSidebarPane.js:
         * inspector/front-end/InjectedScript.js:
-        * platform/Cookie.h:
-        * English.lproj/localizedStrings.js: the new strings that were supposed to have gone in last time
-
-2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Adele Peterson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28145
-        Add support for novalidate/formnovalidate attribute, from HTML5 specs:
-        http://www.whatwg.org/specs/web-apps/current-work/#attr-fs-novalidate
-
-        Tests: fast/forms/formnovalidate-attribute.html
-               fast/forms/novalidate-attribute.html
-
-        * html/HTMLAttributeNames.in: added novalidate, formnovalidate
-        * html/HTMLButtonElement.idl: formnovalidate attribute exposed
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::formNoValidate): attribute getter
-        (WebCore::HTMLFormControlElement::setFormNoValidate): attribute setter
-        * html/HTMLFormControlElement.h:
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::novalidate): attribute getter
-        (WebCore::HTMLFormElement::setNovalidate): attribute setter
-        * html/HTMLFormElement.h:
-        * html/HTMLFormElement.idl: novalidate attribute exposed
-        * html/HTMLInputElement.idl: formNoValidate attribute exposed
-
-2009-08-21  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        Rendering changes to complete
-        [CSS3 Backgrounds and Borders] Add support for the "contain" value for
-        background-size
-        https://bugs.webkit.org/show_bug.cgi?id=27573
-        and
-        [CSS3 Backgrounds and Borders] Add support for the "cover" value for
-        background-size
-        https://bugs.webkit.org/show_bug.cgi?id=27574
-
-        Test: fast/backgrounds/size/contain-and-cover.html
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
-        * rendering/RenderObject.cpp:
-        (WebCore::mustRepaintFillLayers):
-
-2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Adele Peterson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27452
-        Add support for checkValidity() method and invalid event, from HTML5
-        specs:
-        http://www.whatwg.org/specs/web-apps/current-work/#dom-form-checkvalidity
-
-        Tests: fast/events/invalid-001.html
-               fast/events/invalid-002.html
-               fast/events/invalid-003.html
-               fast/events/invalid-004.html
-               fast/events/invalid-005.html
-               fast/forms/checkValidity-001.html
-               fast/forms/checkValidity-002.html
-               fast/forms/checkValidity-003.html
-               fast/forms/checkValidity-004.html
-
-        * dom/Document.idl: oninvalid event handler
-        * dom/Element.idl: ditto
-        * dom/EventNames.h: added invalid event
-        * dom/Node.cpp:
-        (WebCore::Node::oninvalid): ditto
-        (WebCore::Node::setOninvalid): ditto
-        * dom/Node.h: ditto
-        * html/HTMLAttributeNames.in: oninvalid attribute
-        * html/HTMLButtonElement.idl: added checkValidity() method
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::parseMappedAttribute): parses oninvalid
-        * html/HTMLFieldSetElement.idl: added checkValidity() method
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::checkValidity): checkValidity()
-        implementation
-        * html/HTMLFormControlElement.h:
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::checkValidity): checkValidity() implementation
-        for form elements
-        * html/HTMLFormElement.h: checkValidity() definition
-        * html/HTMLFormElement.idl: added checkValidity() method
-        * html/HTMLInputElement.idl: added checkValidity() method
-        * html/HTMLSelectElement.idl: added checkValidity() method
-        * html/HTMLTextAreaElement.idl: added checkValidity() method
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::oninvalid): oninvalid event handler
-        (WebCore::DOMWindow::setOninvalid): ditto
-        * page/DOMWindow.h: ditto
-        * page/DOMWindow.idl: ditto
-
-2009-08-21  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27571 [CSS3 
-        Backgrounds and Borders] Add support for the "round" value for 
-        background-repeat
-        -and-
-        https://bugs.webkit.org/show_bug.cgi?id=27570 [CSS3 Backgrounds and 
-        Borders] Add support for the "space" value for background-repeat
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFillProperty):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
-        * css/CSSValueKeywords.in:
-        * rendering/style/FillLayer.h:
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
+        (injectedScriptConstructor):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        * inspector/front-end/inspector.js:
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
 
-2009-08-21  Chris Marrin  <cmarrin@apple.com>
+2010-02-18  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Adam Barth.
 
-        New files for Canvas 3D feature
-        https://bugs.webkit.org/show_bug.cgi?id=28018
-
-        This is all the new files for implementing Canvas 3D. None of them are hooked up and
-        are not even included in the build yet. This incorporates the reviews from Simon
-        and Ollie for these files.
-
-        * bindings/js/JSCanvasNumberArrayCustom.cpp: Added. Custom JS binding to do implicit conversion from JS Array
-        * html/CanvasObject.cpp: Added. Base class for all GL object containers
-        * html/CanvasObject.h: Added.
-        * html/CanvasRenderingContext.cpp: Added. Base class for CanvasRenderingContext2D and CanvasRenderingContext3D
-        * html/CanvasRenderingContext.h: Added.
-        * html/CanvasRenderingContext.idl: Added.
-        * html/CanvasRenderingContext3D.cpp: Added. 3D context returned from Canvas.getContext()
-        * html/CanvasRenderingContext3D.h: Added.
-        * html/CanvasRenderingContext3D.idl: Added.
-        * platform/graphics/GraphicsContext3D.cpp: Added. Platform interface between CanvasRenderingContext3D and 3D graphics engine
-        * platform/graphics/GraphicsContext3D.h: Added.
-        * platform/graphics/mac/Canvas3DLayer.h: Added. CALayer subclass to composite 3D canvas
-        * platform/graphics/mac/Canvas3DLayer.mm: Added.
-        * platform/graphics/mac/GraphicsContext3DMac.cpp: Added. Mac specific interface (OpenGL based)
-
-2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+        [V8] Merge the DOMWindow and WorkerContext object wrapping code paths,
+        and use a faster method of disambiguating between the types of contexts.
 
-        No Review.
+        https://bugs.webkit.org/show_bug.cgi?id=35009
 
-        Another Windows build fix.
+        * bindings/scripts/CodeGeneratorV8.pm: Remove logic determining whether we need to
+            handle the WorkerContext case.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::globalObjectPrototypeIsDOMWindow):
+        (WebCore::V8DOMWrapper::instantiateV8Object): Merge instantiateV8Object paths.
+        * bindings/v8/V8DOMWrapper.h:
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::diffTextDecorations):
+2010-02-12  Brett Wilson  <brettw@chromium.org>
 
-2009-08-21  David Hyatt  <hyatt@apple.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Simon Fraser.
+        Update the Google-URL version of KURL and the V8 bindings to the new
+        behavior of KURL.IsStandard.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28625, focus rings don't respect the non-strict mode
-        line box shrinking quirk.  Make sure outlines don't extend outside the lineTop and lineBottom
-        of the root line box.
+        https://bugs.webkit.org/show_bug.cgi?id=34859
 
-        Covered by existing tests.
+        This is covered by fast/dom/Window/invalid-protocol.html
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::addFocusRingRects):
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::addFocusRingRects):
-        (WebCore::RenderInline::paintOutline):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::protocolAccessorSetter):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::setProtocol):
+        (WebCore::KURL::isHierarchical):
 
-2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+2010-02-18  Xan Lopez  <xlopez@igalia.com>
 
-        No Review.
+        Reviewed by Gustavo Noronha.
 
-        Windows build fix.
+        Remove some duplication between PluginView and Widget methods, and
+        move the setSelfVisible calls to the parent class.
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::setTextDecorationProperty): Made it static
-        (WebCore::diffTextDecorations): Made it static
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
 
-2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+2010-02-18  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Darin Adler.
 
-        execCommand("Underline") uses CSS even when styleWithCSS has been turned off
-        https://bugs.webkit.org/show_bug.cgi?id=23892
+        <rdar://problem/7655195> Switch Leopard back to using CGShading to avoid CGGradient leaks
 
-        This patch adds support for u and s in StyleChange and addInlineStyleIfNeeded so that
-        WebKit does not use CSS to decorate texts when styleWithCSS is set to false.
+        Define USE_CG_SHADING on for Tiger and Leopard, and use it to toggle the methods
+        used for Core Graphics gradient drawing.
 
-        * css/CSSValueList.cpp:
-        (WebCore::CSSValueList::copy): Added.
-        * css/CSSValueList.h: Added copy.
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::StyleChange::applyUnderline):
-        (WebCore::StyleChange::applyLineThrough):
-        (WebCore::StyleChange::StyleChange): Added a boolean trimTextDecorations argument.
-        (WebCore::StyleChange::init): Ditto.
-        (WebCore::StyleChange::extractTextStyles): Handles text decorations.
-        (WebCore::getPropertiesNotInComputedStyle): Handles text decorations properly.
-        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Adds u and s if needed.
+        * platform/graphics/Gradient.h:
+        * platform/graphics/cg/GradientCG.cpp:
+        (WebCore::Gradient::platformDestroy):
+        (WebCore::Gradient::paint):
 
-2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+2010-02-18  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Inspector: Rename "Databases" Panel as "Storage"
-        https://bugs.webkit.org/show_bug.cgi?id=28620
-
-          Updated enum from "DatabasesPanel" to "StoragePanel" and wherever it was used.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::specialPanelForJSName): string to display StoragePanel can be either "databases" or "storage"
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::showPanel):
-
-          Updated All Direct Access from WebInspector.panels.databases to WebInspector.panels.storage,
-          any DatabasesPanel constructors and appropriate function names.
-
-        * inspector/front-end/DOMStorageDataGrid.js:
-        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
-        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
-        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
-        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
-        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
-        * inspector/front-end/DOMStorageItemsView.js:
-        (WebInspector.DOMStorageItemsView.prototype.update):
-        * inspector/front-end/DatabaseQueryView.js:
-        (WebInspector.DatabaseQueryView.prototype._queryFinished):
-        * inspector/front-end/DatabaseTableView.js:
-        (WebInspector.DatabaseTableView.prototype._queryFinished):
-        * inspector/front-end/inspector.js:
-        (WebInspector._createPanels): updated string that comes from hiddenPanels to be "databases" or "storage"
-        (WebInspector.showStoragePanel):
-        (WebInspector.selectDatabase):
-        (WebInspector.selectDOMStorage):
-        (WebInspector.addDatabase):
-        (WebInspector.addDOMStorage):
+        Web Inspector: on-hover evaluation renders nodes and arrays as strings.
 
-          Renamed some files and Updated Accordingly.
+        https://bugs.webkit.org/show_bug.cgi?id=35103
 
-        * inspector/front-end/StoragePanel.js: Renamed from WebCore/inspector/front-end/DatabasesPanel.js.
-        * inspector/front-end/Images/storageIcon.png: Renamed from WebCore/inspector/front-end/Images/databasesIcon.png.
-        * inspector/front-end/WebKit.qrc: use new file names
-        * inspector/front-end/inspector.css: use new images name and class names
-        * inspector/front-end/inspector.html: use new file name
-        * WebCore.gypi: use new file names
-
-          Miscellaneous Updates.
-
-        * English.lproj/localizedStrings.js: Updated Tooltip from "Databases" to "Storage"
-
-2009-08-21  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        [Haiku] Adding three font-specific files to WebCore:
-        FontCacheHaiku.cpp, FontHaiku.cpp, and SimpleFontDataHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28131
-
-        * platform/graphics/haiku/FontCacheHaiku.cpp: Added.
-        (WebCore::FontCache::platformInit):
-        (WebCore::FontCache::getFontDataForCharacters):
-        (WebCore::FontCache::getSimilarFontPlatformData):
-        (WebCore::FontCache::getLastResortFallbackFont):
-        (WebCore::FontCache::createFontPlatformData):
-        (WebCore::FontCache::getTraitsInFamily):
-        * platform/graphics/haiku/FontHaiku.cpp: Added.
-        (charUnicodeToUTF8HACK):
-        (WebCore::Font::canReturnFallbackFontsForComplexText):
-        (WebCore::Font::drawGlyphs):
-        (WebCore::Font::drawComplexText):
-        (WebCore::Font::floatWidthForComplexText):
-        (WebCore::Font::selectionRectForComplexText):
-        (WebCore::Font::offsetForPositionForComplexText):
-        * platform/graphics/haiku/SimpleFontDataHaiku.cpp: Added.
-        (WebCore::SimpleFontData::platformInit):
-        (WebCore::SimpleFontData::platformCharWidthInit):
-        (WebCore::SimpleFontData::platformDestroy):
-        (WebCore::SimpleFontData::smallCapsFontData):
-        (WebCore::SimpleFontData::containsCharacters):
-        (WebCore::SimpleFontData::determinePitch):
-        (WebCore::SimpleFontData::platformWidthForGlyph):
-
-2009-08-21  Philippe Beauchamp  <philippe.beauchamp@gmail.com>
-
-        Reviewed by Adam Roben.
-
-        Middle click panning icon is offset by 3 pixels
-        https://bugs.webkit.org/show_bug.cgi?id=28611
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._showPopup.showObjectPopup):
 
-        * platform/ScrollView.cpp:
-        panIconSizeLength initialized to 20 instead of 16 to match icon dimension (2 pixels offset)
-        * platform/win/CursorWin.cpp:
-        (WebCore::middlePanningCursor):
-        Hotspot initialized to (8,8) instead of (7,7) (one pixel offset)
-        
-2009-08-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-02-18  Brady Eidson  <beidson@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Sam Weinig.
 
-        [Qt] Remove inspector resources for Symbian
-        https://bugs.webkit.org/show_bug.cgi?id=28610
+        Particularly constructed WebFrames can try to access a null HistoryItem
+        <rdar://problem/7638892> and https://bugs.webkit.org/show_bug.cgi?id=35063
 
-        Based on an idea from Simon Hausmann.
+        Test: fast/loader/api-test-new-window-data-load-base-url.html
 
-        * WebCore.pro:
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateBackForwardListForFragmentScroll): We have a known case where a fragment scroll
+          might take place with a null m_currentItem. updateBackForwardListClippedAtTarget() will either move m_currentItem 
+          to m_previousItem then create a new m_currentItem...  or it will do nothing. So we either have both an m_currentItem 
+          and m_previousItem, or we have neither.  In the case where we have no m_previousItem, return early.
 
-2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+2010-02-18  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        Inspector: Remove Unused Variable
-        https://bugs.webkit.org/show_bug.cgi?id=28616
+        [V8] Correctly handle the case where the event field on the
+        global object is a v8::Object, but not a DOM wrapper.
 
-        * inspector/front-end/Resource.js:
-        (WebInspector.Resource.prototype._checkWarning):
-
-2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=34899
 
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Console Array Formatter Shows Extra Properties
-        https://bugs.webkit.org/show_bug.cgi?id=28615
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._formatarray): do not ignore hasOwnProperties
-
-2009-08-21  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27574 [CSS3 
-        Backgrounds and Borders] Add support for the "contain" value for 
-        background-size
-        -and-
-        https://bugs.webkit.org/show_bug.cgi?id=27573 [CSS3 Backgrounds and 
-        Borders] Add support for the "cover" value for background-size
-
-        Return contain or cover when appropriate, and otherwise do what we 
-        used to do.
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-
-        Accept contain and cover as valid values for background-size.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFillProperty):
+        Test: fast/dom/Window/window-event-override-no-crash.html
 
-        Handle setting the size and the sizeLength if appropriate.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::mapFillSize):
-
-        Added new keywords contain and cover.
-        * css/CSSValueKeywords.in:
-
-        Use just sizeLength instead of size to match old behavior.
-        * page/animation/AnimationBase.cpp:
-        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
-        * rendering/RenderObject.cpp:
-        (WebCore::mustRepaintFillLayers):
-
-        The variable m_sizeType is an EBackgroundSize, and m_sizeLength is 
-        a LengthSize (the equivalent of what m_size used to be). I got rid 
-        of m_sizeSet and made isSizeSet() dynamic. I also defined a new 
-        struct, FillSize that can be used to set or get m_size and 
-        m_sizeLength both at once. 
-        * rendering/style/FillLayer.cpp:
-        (WebCore::FillLayer::FillLayer):
-        (WebCore::FillLayer::operator=):
-        (WebCore::FillLayer::operator==):
-        (WebCore::FillLayer::fillUnsetProperties):
-        * rendering/style/FillLayer.h:
-        (WebCore::FillSize::FillSize):
-        (WebCore::FillSize::operator==):
-        (WebCore::FillSize::operator!=):
-        (WebCore::FillLayer::sizeLength):
-        (WebCore::FillLayer::size):
-        (WebCore::FillLayer::isSizeSet):
-        (WebCore::FillLayer::setSizeType):
-        (WebCore::FillLayer::setSizeLength):
-        (WebCore::FillLayer::setSize):
-        (WebCore::FillLayer::clearSize):
-        (WebCore::FillLayer::initialFillSizeType):
-        (WebCore::FillLayer::initialFillSizeLength):
-        (WebCore::FillLayer::initialFillSize):
-
-        This is all boiler-plate stuff to adjust to the new size() vs. 
-        sizeType() vs. sizeLength() distinction.
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::backgroundSizeType):
-        (WebCore::InheritedFlags::backgroundSizeLength):
-        (WebCore::InheritedFlags::maskSize):
-        (WebCore::InheritedFlags::setBackgroundSize):
-        (WebCore::InheritedFlags::setBackgroundSizeLength):
-        (WebCore::InheritedFlags::setMaskSize):
-
-        Definition for EBackgroundSizeType.
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-
-2009-08-21  Ariya Hidayat  <ariya.hidayat@nokia.com>
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::isValidDOMObject):
+        (WebCore::V8DOMWrapper::isWrapperOfType):
+        * bindings/v8/V8DOMWrapper.h:
 
-        Not reviewed, build fix after r47580.
+2010-02-18  Pavel Feldman  <pfeldman@chromium.org>
 
-        [Qt] Adjust the files.
+        Not reviewed, Qt build fix.
 
         * inspector/front-end/WebKit.qrc:
 
-2009-08-20  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Enable various "grouping" ARIA roles
-        https://bugs.webkit.org/show_bug.cgi?id=28486
-
-        Test: platform/mac/accessibility/aria-grouping-roles.html
-
-        * accessibility/AccessibilityObject.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        * page/mac/WebCoreViewFactory.h:
-        * platform/LocalizedStrings.h:
-        * platform/mac/LocalizedStringsMac.mm:
-
-2009-08-20  David Levin  <levin@chromium.org>
-
-        Unreviewed trivial comment fix.
-
-        Update a bug link in a comment due to bugzilla amnesia.
-
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::setResourceToRevalidate):
-
-2009-08-20  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by David Levin.
-
-        HTML5 media elements do not fire waiting events correctly
-        https://bugs.webkit.org/show_bug.cgi?id=28335
-
-        Fire the waiting event before seeking, and fix a case where firing of
-        the seeked event is missed when the ready state is changed during
-        a seek.
-
-        Added video-waiting-seeking.html into manual tests because not
-        all platforms allow seeking into non-buffered ranges.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::setReadyState): add support for
-        waiting event when seeking.
-        (WebCore::HTMLMediaElement::finishSeek): send seeked event
-        whenever seeking finishes.
-        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): dispatch to
-        new function.
-        * html/HTMLMediaElement.h:
-        * manual-tests/video-waiting-seeking.html: Added.
-
-2009-08-20  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by John Sullivan.
-
-        Fix more cases of
-        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
-        the console with certain content
-
-        If the border box is empty, simply avoid painting instead of trying to
-        clip to the empty path.
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::paint):
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::paint):
-
-2009-08-20  Jeremy Orlow  <jorlow@chromium.org>
-
-        Build fix.  Forgot a svn add for a patch I landed.  :-(
-
-        * storage/SQLTransactionClient.cpp: Added.
-        (WebCore::SQLTransactionClient::didCommitTransaction):
-        (WebCore::SQLTransactionClient::didExecuteStatement):
-        (WebCore::SQLTransactionClient::didExceedQuota):
-        * storage/SQLTransactionClient.h: Added.
-
-2009-08-20  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Added a client to SQLTransaction. In addition to being a place to
-        get notifications about certain events in a transaction, it is
-        also an abstraction layer that allows us to plug in different
-        implementations for each port for how transactions interract with
-        the main DB. For example, WebCore's default implementation will
-        make direct calls to DatabaseTracker's methods. At the same time,
-        Chromium's implementation will send IPCs to the browser process
-        whenever a transaction needs something from the main DB.
+2010-02-18  Pavel Feldman  <pfeldman@chromium.org>
 
-        All storage tests pass.
+        Reviewed by Timothy Hatcher.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27967
+        Web Inspector: Implement evaluate-on-hover for scripts panel.
 
-        * GNUmakefile.am:
+        https://bugs.webkit.org/show_bug.cgi?id=35003
+ 
         * WebCore.gypi:
-        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/Database.cpp:
-        (WebCore::Database::transactionClient):
-        * storage/Database.h:
-        * storage/DatabaseThread.cpp:
-        (WebCore::DatabaseThread::DatabaseThread):
-        * storage/DatabaseThread.h:
-        (WebCore::DatabaseThread::transactionClient):
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::runCurrentStatement):
-        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
-        (WebCore::SQLTransaction::postflightAndCommit):
-        * storage/SQLTransactionClient.cpp: Added.
-        * storage/SQLTransactionClient.h: Added.
-
-2009-08-20  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Steve Falkenburg.
-
-        Fix of <https://bugs.webkit.org/show_bug.cgi?id=24793>
-        Auto scroll speed is faster than in IE, Firefox.
-        
-        Changed pan scrolling speed to match Firefox's algorithm.
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::adjustedScrollDelta):
-        (WebCore::RenderLayer::panScrollFromPoint):
-
-2009-08-20  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fix for assert in Chromium page cycler:  drawRect() was re-using
-        an SkPaint, but not resetting it before calling
-        PlatformGraphicsSkia::setupPaintForFilling() a second time.  This
-        CL fixes drawRect(), and re-enables the assert.
-        http://bugs.webkit.org/show_bug.cgi?id=28172
-        http://crbug.com/19797
-
-        Covered by Chromium page cycler tests.
-
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::drawRect):
-        (PlatformContextSkia::setupPaintCommon):
-
-2009-08-20  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        <rdar://problem/7159016> Popup menus don't disappear when you click outside the window.
-        
-        Revert r47535 which introduced this.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupWndProc):
-
-2009-08-20  David Levin  <levin@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Crashes on sites with lots of images
-        https://bugs.webkit.org/show_bug.cgi?id=28473
-
-        The problem is that m_resourceToRevalidate::m_isBeingRevalidated is false while
-        CachedResource is still referring to it, so it may get deleted before
-        Cache::revalidationSucceeded calls CachedResource::clearResourceToRevalidate.
+        * inspector/front-end/Images/gearButtonGlyph.png: Added.
+        * inspector/front-end/Images/popoverArrows.png: Added.
+        * inspector/front-end/Images/popoverBackground.png: Added.
+        * inspector/front-end/Images/thumbActiveHoriz.png: Added.
+        * inspector/front-end/Images/thumbActiveVert.png: Added.
+        * inspector/front-end/Images/thumbHoriz.png: Added.
+        * inspector/front-end/Images/thumbHoverHoriz.png: Added.
+        * inspector/front-end/Images/thumbHoverVert.png: Added.
+        * inspector/front-end/Images/thumbVert.png: Added.
+        * inspector/front-end/Images/trackHoriz.png: Added.
+        * inspector/front-end/Images/trackVert.png: Added.
+        * inspector/front-end/Popup.js:
+        (WebInspector.Popup):
+        (WebInspector.Popup.prototype.show):
+        (WebInspector.Popup.prototype.hide):
+        (WebInspector.Popup.prototype._positionElement):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._createViewerIfNeeded):
+        (WebInspector.SourceFrame.prototype._scroll):
+        (WebInspector.SourceFrame.prototype._mouseDown):
+        (WebInspector.SourceFrame.prototype._mouseUp):
+        (WebInspector.SourceFrame.prototype._mouseMove):
+        (WebInspector.SourceFrame.prototype._mouseOut):
+        (WebInspector.SourceFrame.prototype._resetHoverTimer):
+        (WebInspector.SourceFrame.prototype._hidePopup):
+        (WebInspector.SourceFrame.prototype._mouseHover):
+        (WebInspector.SourceFrame.prototype._showPopup.showTextPopup):
+        (WebInspector.SourceFrame.prototype._showPopup.showObjectPopup):
+        (WebInspector.SourceFrame.prototype._showPopup.evaluateCallback):
+        (WebInspector.SourceFrame.prototype._showPopup):
+        (WebInspector.HoverPropertiesSection):
+        (WebInspector.HoverPropertiesSection.prototype.update):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype._lex):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._paintLine):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspectorSyntaxHighlight.css:
+        * inspector/front-end/popover.css: Added.
 
-        * loader/Cache.cpp:
-        (WebCore::Cache::revalidateResource): Added assert to verify the resource
-        being revalidated is physically in the cache.
-        (WebCore::Cache::revalidationSucceeded): Changed to do one call to switch from the revalidating
-        resource to the revalidated resource.  This allows for proper lifetime management of the
-        revalidated resource. Added assert to verify that the revalidatingResource is in the cache.
-        (WebCore::Cache::pruneDeadResources): Don't remove items from the cache that are in the
-        process of being validated (or else they can get added twice: Once through the normal mechanism
-        and then again during revalidateResource).
+2010-02-18  Ben Murdoch  <benm@google.com>
 
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::CachedResource):
-        (WebCore::CachedResource::isSafeToMakePurgeable):
-        Changed m_isBeingRevalidated to m_proxyResource to allow finding out
-        who the validating resource (or proxy) is.
-
-        (WebCore::CachedResource::~CachedResource): Removed code to handle m_resourceToRevalidate
-        being non-zero because this shouldn't be possible due to checks in canDelete. Added asserts
-        as well.
-        (WebCore::CachedResource::setResourceToRevalidate): Adjusted for the change to m_proxyResource
-        and added a comment about the assert.
-        (WebCore::CachedResource::clearResourceToRevalidate):
-        Only clean up the resourceToRevalidate if it hasn't gotten a new proxy resource.
-        * loader/CachedResource.h:
-        (WebCore::CachedResource::setInCache): Don't clear m_proxyResource because the resource
-        is still being referred to by it and the code it robust to this being switched to a new proxy
-        resource without it being cleared first.
-        (WebCore::CachedResource::canDelete): Changed m_isBeingRevalidated to m_proxyResource.
+        Reviewed by Jeremy Orlow.
 
-2009-08-20  Xiaomei Ji  <xji@chromium.org>
+        [v8] Complete upstreaming of V8 Touch Event bindings
+        https://bugs.webkit.org/show_bug.cgi?id=35094
 
-        Reviewed by Eric Seidel.
+        No new tests required.
 
-        Fix "Chromium RTL autocomplete popup is not layout correctly".
-        https://bugs.webkit.org/show_bug.cgi?id=27889
-
-        The complete fix of the issue consists 2 parts: the patch in webkit
-        and the patch in Chromium's own code.
-
-        This webkit patch only affects Chromium autofill. It
-        1. introduces a new flag in WebCore::PopupContainerSettings to
-           distinguish whether the width of the drop-down should be restricted
-           or not.
-           For autofill, the width of the drop-down is restricted to
-           be the same as that of the input field (the new flag is set in
-           Chromium's own code). But width is not restricted for <select> (same as before).
-        2. introduce a new flag in WebCore::PopContainerSettings to
-           indicate what heuristics to use when displaying text in drop-down menu.
-           For autofill, use drop-down item's directionality to display drop-down items.
-           Previously, drop-down item is displayed in the its first strong
-           directional character's directionality.
-           (drop-down item's directionality is set in Chromium's own code.
-           It is set the same as the directionality of the element. 
-           For autofill, it is the same directionality as that of the input field.)
-           For <select>, still use the text's first strong directional character's
-           directionality to display the text.
-
-
-        Since the patch only affects the chromium client, not webcore part or
-        other clients. No automatic tests is possible.
-
-        * manual-tests/autofill-popup-width-and-item-direction.html: Added.
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::):
-        (WebCore::PopupListBox::paintRow): If list box width is restricted and 
-        an item is longer to fit in a list box, truncate it and draw part of the text and append ellipses.
-        (WebCore::PopupListBox::layout): Restrict width of list box if applicable.
-        * platform/chromium/PopupMenuChromium.h: 
-        (WebCore::PopupItem::PopupItem): style change.
-        (WebCore::PopupContainerSettings::): Add 2 new flags in PopupContainerSetting to 
-        distinguish whether to restrict width of list box and 
-        in what directionality to display the text in drop-down.
+        * bindings/v8/V8Index.cpp: Add generated touch event headers.
 
-2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+2010-02-18  Steve Block  <steveblock@google.com>
 
-        Reviewed by Adele Peterson.
+        Reviewed by Jeremy Orlow.
 
-        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28504>. 
-        Pan Scrolling can scroll while showing the middlePanScroll icon.
-        
-        Fixed an off by one error between RenderLayer::panScrollFromPoint and EventHandler::updatePanScrollState. 
-        In RenderLayer::panScrollFromPoint, we were setting the icon to be an arrow if the difference between the start
-        of the pan scroll and the current mouseposition is > 15. However, in EventHandler::updatePanScrollState, we would
-        set our amount to scroll to 0 only if the difference in mouse position is < 15. I made this check a <= 15, to fix
-        the off by one error.
+        Updates Android V8 build to use DerivedSourcesAllInOne.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=35083
 
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::panScrollFromPoint):
+        No new tests, build fix only.
 
-2009-08-20  David Hyatt  <hyatt@apple.com>
+        * Android.derived.v8bindings.mk:
+        * Android.v8bindings.mk:
 
-        Reviewed by Dan Bernstein.
+2010-02-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Pull the code in layoutBlockChildren for handling a normal flow block child into a helper method,
-        layoutBlockChild.
+        Reviewed by Xan Lopez.
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlockChildren):
-        (WebCore::RenderBlock::layoutBlockChild):
-        * rendering/RenderBlock.h:
+        fast/frames/iframe-reparenting.html crashing on GTK Debug bots
+        https://bugs.webkit.org/show_bug.cgi?id=35081
 
-2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+        Check that the client is alive after every call to it, since any
+        of them could cause the load to be cancelled, and the client to go
+        away.
 
-        Reviewed by Adam Roben.
+        This is much better than protecting a specific subclass of
+        ResourceHandleClient (ResourceLoader), which makes us fail when
+        any other client is used.
 
-        Made subframeForHitTargetNode a public static method, so WebView can call it
-        during hit testing.
+        Test: fast/frames/iframe-reparenting.html
 
-        * page/EventHandler.cpp:
-        (WebCore::subframeForHitTestResult):
-        (WebCore::EventHandler::subframeForTargetNode):
-        * page/EventHandler.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl):
 
-2009-08-20  Brent Fulgham  <bfulgham@webkit.org>
+2010-02-18  Ben Murdoch  <benm@google.com>
 
-        Rubberstamped by Kevin Ollivier.
+        Reviewed by Nate Chapin.
 
-        Check for null bundle before attempting to use it.
+        [v8] [Android] V8 bindings for touch events are missing.
+        https://bugs.webkit.org/show_bug.cgi?id=33795
 
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::certificatePath): Add null check on return of
-          CFBundleGetBundleWithIdentifier.
+        No new tests as this just enables touch events in V8. Existing touch tests suffice.
 
-2009-08-20  David Hyatt  <hyatt@apple.com>
+        * WebCore.gypi: Add Touch idl files.
+        * bindings/scripts/CodeGeneratorV8.pm: Add TouchList to typeCanFailConversion map.
+        * bindings/v8/DOMObjectsInclude.h: Add touch headers.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Add touch generated bindings.
+        * bindings/v8/V8Index.h: Add touch DOM object types.
+        * bindings/v8/custom/V8EventCustom.cpp: Add conversion of event to touch event.
+        * Android.derived.jscbindings.mk: Add the touch derived sources to the makefile.
+        * Android.derived.v8bindings.mk: Add the touch derived sources to the makefile.
 
-        Reviewed by Dan Bernstein.
+2010-02-18  William Chan  <willchan@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28497, images and inline replaced elements don't propagate overflow properly on a line.
+        Reviewed by Adam Barth.
 
-        Added fast/repaint/inline-block-overflow.html and updated another test.
+        https://bugs.webkit.org/show_bug.cgi?id=35071
+        Disable loader limiting of requests per host for the chromium port.
 
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeBoxesHorizontally):
-        (WebCore::InlineFlowBox::computeVerticalOverflow):
-        Make sure to still propagate the border box of the replaced element as layout overflow when overflow clip is set on the
-        replaced element.  Make sure to use the InlineBox x/y positions instead of the RenderBox x/y, since the position of the
-        RenderBox has not been updated to the new values yet.
-        
-        * rendering/RenderLineBoxList.cpp:
-        (WebCore::RenderLineBoxList::paint):
-        Don't use the root line box's overflow.  Use the actual line box overflow values instead.  In the case of an inline
-        with a layer, our overflow didn't propagate to the root line, so we always need to use our values.
+        No tests because we're only changing a constant.
 
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::layout):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::layout):
-        Make sure to clear shadow overflow when doing layout of replaced elements, so that we don't leave a stale overflow
-        value around if a box-shadow goes away.
+        * platform/network/chromium/ResourceRequest.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
 
-2009-08-20  Dmitry Titov  <dimich@chromium.org>
+2010-02-18  Xan Lopez  <xlopez@igalia.com>
 
-        Another attempt to fix Chromium build.
+        Reviewed by Eric Seidel.
 
-        * WebCore.gypi: now use the correct name of the image file.
+        [Linux] Webkit incompatible with Java plugins
+        https://bugs.webkit.org/show_bug.cgi?id=24912
 
-2009-08-20  Dan Bernstein  <mitz@apple.com>
+        The NP Version supported by WebKit is at the moment hardcoded in
+        PluginPackage.cpp (to 24), but not all backends actually implement
+        the methods needed to claim this. Introduce a new method to be
+        implemented by each backend where the maximum supported version
+        can be specified, and set the GTK+ port NPVersion to 19. This
+        fixes an instantaneous crasher in the Sun Java NPAPI plugin.
 
-        Make the Windows build even fixeder
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::initializeBrowserFuncs):
+        * plugins/PluginPackage.h:
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::NPVersion):
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::PluginPackage::NPVersion):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::NPVersion):
+        * plugins/symbian/PluginPackageSymbian.cpp:
+        (WebCore::PluginPackage::NPVersion):
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::NPVersion):
 
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        (WebCore::GraphicsContextPlatformPrivate::flush):
+2010-02-17  Dmitry Titov  <dimich@chromium.org>
 
-2009-08-20  Dmitry Titov  <dimich@chromium.org>
+        Reviewed by David Levin, Darin Fisher, Simon Hausmann.
 
-        Not reviewed, Chromium build fix.
+        When a live iframe element is moved between pages, it still depends on the old page.
+        https://bugs.webkit.org/show_bug.cgi?id=34382
 
-        * WebCore.gypi: add new Webinspector image files (localStorage.png and sessionStorage.png)
+        Test: fast/frames/iframe-reparenting-new-page.html
 
-2009-08-20  Dan Bernstein  <mitz@apple.com>
-
-        Windows build fix after the last change
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::setName):
+        Move the code setting the frame name into a separate function.
 
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        (WebCore::GraphicsContext::GraphicsContext):
-        (WebCore::GraphicsContext::releaseWindowsContext):
-        (WebCore::GraphicsContext::drawWindowsBitmap):
+        (WebCore::HTMLFrameElementBase::setNameAndOpenURL):
+        (WebCore::HTMLFrameElementBase::updateOnReparenting):
+        Called on the frame that was just re-parented and inserted into another Document.
+        Simply invoke Frame::transferChildFrameToNewDocument(...);
 
-2009-08-20  Dan Bernstein  <mitz@apple.com>
+        (WebCore::HTMLFrameElementBase::insertedIntoDocument):
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLFrameOwnerElement.h:
+        (WebCore::HTMLFrameOwnerElement::setName):
+        Make this a virtual function, to be able to reach it via Frame::m_ownerElement.
 
-        Reviewed by Geoffrey Garen.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::adoptFrame):
+        * loader/FrameLoaderClient.h:
+        Add a new method, didTransferChildFrameToNewDocument().
+        It compliments createFrame() in that a frame which was re-parented
+        in DOM and potentially changes Page, should notify the WebKit
+        implementation about potential ownership change.
+        Many embedders assume that Page owns all the Frames, or at least
+        all Frames are destroyed before 'their' Page is destroyed. Obviously, if Frame
+        can be transferred to another Page, the embedders should be notified.
 
-        Replace many manually-released CFTypeRefs with RetainPtrs
-        https://bugs.webkit.org/show_bug.cgi?id=28498
+        * page/Frame.cpp:
+        (WebCore::Frame::transferChildFrameToNewDocument):
+        Added, makes actual adjustments for Frame - resets the Page,
+        updates the frame tree and frame name, calls to FrameLoaderClient
+        to update external objects and recurses into children.
+        Can only be used on child frames.
 
-        * platform/graphics/cg/ColorCG.cpp:
-        (WebCore::createCGColor):
-        * platform/graphics/cg/GradientCG.cpp:
-        (WebCore::Gradient::platformGradient):
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::platformContext):
-        (WebCore::GraphicsContext::applyStrokePattern):
-        (WebCore::GraphicsContext::applyFillPattern):
-        (WebCore::GraphicsContext::setPlatformShadow):
-        (WebCore::GraphicsContext::setURLForRect):
-        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
-        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
-        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::BitmapImage::checkForSolidColor):
-        (WebCore::Image::drawPattern):
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::ImageSource::setData):
-        (WebCore::ImageSource::isSizeAvailable):
-        (WebCore::ImageSource::frameSizeAtIndex):
-        (WebCore::ImageSource::repetitionCount):
-        (WebCore::ImageSource::createFrameAtIndex):
-        (WebCore::ImageSource::frameDurationAtIndex):
-        * platform/graphics/cg/PDFDocumentImage.cpp:
-        (WebCore::PDFDocumentImage::dataChanged):
-        * platform/graphics/cg/PathCG.cpp:
-        (WebCore::createScratchContext):
-        (WebCore::Path::contains):
-        * platform/graphics/mac/FontCustomPlatformData.cpp:
-        (WebCore::createFontCustomPlatformData):
-        * platform/graphics/mac/GraphicsContextMac.mm:
-        (WebCore::GraphicsContext::drawFocusRing):
-        * platform/graphics/mac/ImageMac.mm:
-        (WebCore::BitmapImage::getTIFFRepresentation):
-        * platform/mac/ClipboardMac.mm:
-        (WebCore::cocoaTypeFromMIMEType):
-        (WebCore::MIMETypeFromCocoaType):
-        * platform/mac/WebCoreNSStringExtras.mm:
-        (stringEncodingForResource):
-        * platform/network/mac/FormDataStreamMac.mm:
-        (WebCore::advanceCurrentStream):
-        (WebCore::setHTTPBody):
-        * platform/text/mac/TextCodecMac.cpp:
-        (WebCore::TextCodecMac::encode):
+        * page/Frame.h:
 
-2009-08-20  Shinichiro Hamaji  <hamaji@chromium.org>
+2010-02-17  Tony Chang  <tony@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        Output actual values of counters in showTree
-        https://bugs.webkit.org/show_bug.cgi?id=28481
-
-        No new tests because this patch just improves debugging outputs.
-
-        * rendering/CounterNode.cpp:
-        (WebCore::showTreeAndMark):
+        Copying and pasting into a contenteditable area can create <div>s surrounded by <span>s
+        https://bugs.webkit.org/show_bug.cgi?id=26937
 
-2009-08-20  Eric Carlson  <eric.carlson@apple.com>
+        This happens because of a span added when we copy that is used to
+        preserve styles.  To avoid this, when we paste, make sure to apply
+        the styles to the span's children and then remove the style span.
 
-        Reviewed by NOBODY (build fix).
-
-        Add file missed in last check-in.
-
-        * html/HTMLAttributeNames.in:
-
-2009-08-19  Timothy Hatcher  <timothy@apple.com>
+        This change is covered by existing layout tests.
 
-        Adds new icons to the Web Inspector for Local Storage,
-        Session Storage and Cookies.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans):
+        (WebCore::ReplaceSelectionCommand::copyStyleToChildren):
+        * editing/ReplaceSelectionCommand.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=28470
+2010-02-17  Tony Chang  <tony@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.addDOMStorage):
-        (WebInspector.DOMStorageSidebarTreeElement):
-        * inspector/front-end/Images/cookie.png:
-        * inspector/front-end/Images/domStorage.png: Removed.
-        * inspector/front-end/Images/localStorage.png: Added.
-        * inspector/front-end/Images/sessionStorage.png: Added.
-        * inspector/front-end/inspector.css:
-
-2009-08-20  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        HTML5 media elements must fire 'loadend' progress event
-        https://bugs.webkit.org/show_bug.cgi?id=28419
-
-        * dom/EventNames.h:
-            Define loadend.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseMappedAttribute):
-            Deal with onloadend.
-        (WebCore::HTMLMediaElement::loadInternal):
-            Post 'loadend' immediately after 'abort'.
-        (WebCore::HTMLMediaElement::noneSupported):
-            Post 'loadend' immediately after 'error'.
-        (WebCore::HTMLMediaElement::mediaEngineError):
-            Ditto.
-        (WebCore::HTMLMediaElement::setNetworkState):
-            Post 'loadend' immediately after 'load'.
-        (WebCore::HTMLMediaElement::userCancelledLoad):
-            Post 'loadend' immediately after 'abort'.
-
-2009-08-20  Ryosuke Niwa  <rniwa@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=34914
+        When pasting absolute font sizes into a content editable area with
+        page zoom, adjust the font sizes to be the same after page zoom is
+        applied.
 
-        Reviewed by Darin Adler.
-
-        REGESSION(r45316), Crash: WebKit crashes in Google Sites when indenting a table
-        https://bugs.webkit.org/show_bug.cgi?id=28474
-
-        This patch fixes a crash when indenting at right after a table.
-        The bug was caused by Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node());
-        where node() is equal to blockNode. Because blockNode is the enclosing block node, this patch changes it to
-        enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()->parentNode());
-
-        Test: editing/execCommand/indent-right-after-table.html
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::indentRegion): Fixed so that blockNode != endOfCurrentParagraph.deepEquivalent().node()
-
-2009-08-20  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by David Levin.
-
-        Render disabled mute button during an error or if no audio is present.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28475
-
-        Covered by existing layout tests:
-        media/video-controls-visible-audio-only.html
-        media/video-no-audio.html
-
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
-
-2009-08-20  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/7154605> Loading page with 1px wide <select> makes the
-        toolbar go blank
-        and
-        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
-        the console with certain content
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMenuListButtonGradients): Return early
-        if the rectangle is empty. Use RenderStyle::getBorderRadiiForRect() to
-        adjust the radii in case the sides of the rectangle are smaller than sum
-        of the radii, so that the gradient background matches the border (which
-        already uses getBorderRadiiForRect()). Check if bottomGradient is empty
-        to avoid clipping to an empty path.
-        (WebCore::RenderThemeMac::paintMenuListButton): Moved a
-        GraphicContext::save() down to avoid a save/restore imbalance in the
-        early return case.
-
-        * rendering/RenderThemeSafari.cpp: Made the same changes.
-        (WebCore::RenderThemeSafari::paintMenuListButtonGradients):
-        (WebCore::RenderThemeSafari::paintMenuListButton):
-
-2009-08-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Gustavo Noronha.
+        Test: editing/pasteboard/page-zoom.html
 
-        [Gtk][REGRESSION] XHR test failures after r45558
-        https://bugs.webkit.org/show_bug.cgi?id=27143
-
-        Disable sniffing if it's explicitly requested. Updated patch
-        originally by Gustavo Noronha.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::statusWillBeHandledBySoup):
-        (WebCore::gotHeadersCallback):
-        (WebCore::contentSniffedCallback):
-        (WebCore::gotChunkCallback):
-        (WebCore::startHttp):
-
-2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Swap the pixels since QImage expect ARGB while ImageData
-        stores them as RGBA.
-
-        This fixes the fast/canvas/canvas-copyPixels.html test.
-
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::putImageData):
-
-2009-08-20  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
-
-        Reviewed by David Levin.
-
-        [v8] Use atomic string caching for createElement
-        Extend atomic string caching to createElement.  Fix a bug in idl
-        parser that caused incorrect parsing if a function argument
-        attribute list contained a comma.
-        https://bugs.webkit.org/show_bug.cgi?id=28449
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/scripts/IDLParser.pm:
-        * bindings/v8/V8Binding.h:
-        (WebCore::v8ValueToAtomicWebCoreStringWithNullCheck):
-        * dom/Document.idl:
-
-2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Not reviewed, build fix after r47515.
-
-        [Qt] There is no Phonon::MediaObject::hasAudio() function.
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::hasAudio): Assume true.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::negateStyleRulesThatAffectAppearance):
 
-2009-08-20  Darin Fisher  <darin@chromium.org>
+2010-02-17  Tony Chang  <tony@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28483
-        The V8 ScriptController's cleanupScriptObjectsForPlugin should take a
-        Widget* instead of void* to avoid the need for manual casting to Widget*
-        at the callsite.
+        https://bugs.webkit.org/show_bug.cgi?id=34737
+        Copying styled list items then pasting into a list
+        should work the same as copying unstyle list items:
+        it shouldn't indent an extra level, but styles should
+        be copied.
 
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
-        * bindings/v8/ScriptController.h:
+        Small cleanups to insertAsListItems to make variable names
+        more descriptive.
 
-2009-08-19  David Levin  <levin@chromium.org>
+        Test: editing/pasteboard/paste-list-003.html
 
-        Unreviewed speculative build fix for qt.
-
-        * page/OriginAccessEntry.cpp:
-
-2009-08-19  Aaron Boodman  <aa@chromium.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to
-        specify a more granular policy for cross-origin XHR access.
-
-        Tests: http/tests/xmlhttprequest/origin-whitelisting-all.html
-               http/tests/xmlhttprequest/origin-whitelisting-exact-match.html
-               http/tests/xmlhttprequest/origin-whitelisting-https.html
-               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses-with-subdomains.html
-               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses.html
-               http/tests/xmlhttprequest/origin-whitelisting-subdomains.html
-
-        * WebCore.base.exp: Export methods to manipulate origin access whitelists to enable
-        testing via layout tests.
-
-        * WebCore.xcodeproj/project.pbxproj: Add OriginAccessEntry.*
-        * GNUmakefile.am: Ditto.
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCoreSources.blk: Ditto.
-
-        * page/SecurityOrigin.h: Implement origin access whitelists.
-        (WebCore::originAccessMap): Static getter for access whitelists.
-        (WebCore::SecurityOrigin::canRequest): Modify request checking logic to check whitelists.
-        (WebCore::SecurityOrigin::whiteListAccessFromOrigin): Add an entry to a whitelist.
-        (WebCore::SecurityOrigin::resetOriginAccessWhiteLists): Clear all the whitelists.
-
-        * page/OriginAccessEntry.h: Added. An entry in an origin access whitelist.
-        * page/OriginAccessEntry.cpp: Ditto.
-
-2009-08-19  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Non-precomp headers build fix.
-
-        * platform/image-decoders/ImageDecoder.cpp:
-
-2009-08-19  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Disable a bad SKIA assert
-        https://bugs.webkit.org/show_bug.cgi?id=28482
-
-        In http://trac.webkit.org/changeset/47386/ an assert was "fixed" in SKIA code. 
-        When this was pulled into Chromium, it started breaking the page cycler. 
-        Disable it again until we can figure out what's going on.
-
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintCommon):
-
-2009-08-19  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        queryCommandState('underline') returns false if the selected text is also bold and italic
-        https://bugs.webkit.org/show_bug.cgi?id=11022
-
-        This patch modifies stateStrikethrough and stateUnderline to use the value -webkit-text-decorations-in-effect
-        instead of text-decoration.  Because text-decoration only retrieves explicit styling at the node on which
-        the query was sent, we need to use -webkit-text-decorations-in-effect to include decorations added by ancestors
-        and also u, s, and strike tags.
-
-        Test: editing/style/text-decoration-state.html
-
-        * editing/EditorCommand.cpp:
-        (WebCore::stateStrikethrough): Use -webkit-test-decorations-in-effect instead of text-decoration.
-        (WebCore::stateUnderline): Ditto.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
 
-2009-08-19  Anders Carlsson  <andersca@apple.com>
+2010-02-17  Kwang Yul Seo  <skyul@company100.net>
 
-        Reviewed by Darin Adler.
+        Reviewed by Eric Seidel.
 
-        - Fix <rdar://problem/7155710>
-        HTML selects on windows cause containing window to become inactive when opened.
+        [BREWMP] Port PlatformKeyboardEvent
+        https://bugs.webkit.org/show_bug.cgi?id=34794
 
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        Pass SWP_NOACTIVATE to SetWindowPos, remove AW_ACTIVATE from AnimateWindow and pass
-        SW_SHOWNOACTIVATE to ShowWindow.
-        
-        (WebCore::PopupWndProc):
-        Prevent mouse activation from activating the window.
+        Retrieve the type, key code, text and modifiers from BREW's keyboard event.
 
-2009-08-19  Simon Fraser  <simon.fraser@apple.com>
+        * platform/PlatformKeyboardEvent.h:
+        * platform/brew/PlatformKeyboardEventBrew.cpp: Added.
+        (WebCore::keyIdentifierForBrewKeyCode):
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::singleCharacterString):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
 
-        Reviewed by Darin Adler.
+2010-02-17  Hayato Ito  <hayato@chromium.org>
 
-        Images flash as you hover them on http://www.atebits.com/scribbles/
-        <rdar://problem/7143958>
-        
-        Tag images with the device colorspace with the colorspace of the main display, rather than
-        GenericRGB, so that composited images color-match those rendered via Core Graphics.
-        
-        Covered by LayoutTests/compositing/color-matching/image-color-matching.html
+        Reviewed by Eric Seidel.
 
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setContentsToImage):
+        Support CSS page-break-inside with a value of 'avoid'.
 
-2009-08-19  Anders Carlsson  <andersca@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34080
 
-        Reviewed by David Hyatt and Dan Bernstein.
+        Test: printing/page-break-inside.html
 
-        - Fix <rdar://problem/7152589> Stylable scrollbar corners aren't working.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintChildren):
 
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView):
-        Initialize m_scrollCorner.
+2010-02-17  Fumitoshi Ukai  <ukai@chromium.org>
 
-        (WebCore::FrameView::~FrameView):
-        Assert that m_scrollCorner is null.
+        Reviewed by Alexey Proskuryakov.
 
-        (WebCore::FrameView::detachCustomScrollbars):
-        Destroy m_scrollCorner.
+        WebSocket bufferedAmount should not be 0 when send after close.
+        https://bugs.webkit.org/show_bug.cgi?id=34633
 
-        (WebCore::FrameView::invalidateScrollCorner):
-        Invalidate the scroll corner.
-        
-        (WebCore::FrameView::updateScrollCorner):
-        Create/destroy the scroll corner.
-        
-        (WebCore::FrameView::paintScrollCorner):
-        Paint the scroll corner.
-        
-        * page/FrameView.h:
-        (WebCore::FrameView::isFrameViewScrollCorner):
-        Return whether a RenderScrollbarPart is the frame view scroll corner.
-        
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-        Go ahead and update the scroll corner.
-        
-        (WebCore::ScrollView::setScrollbarsSuppressed):
-        Pass the scroll corner rect to invalidateRect.
+        Fixed bug in webkit r54694.  check m_client after it calls user
+        callback, because user callback may call close(), which would
+        call onclose event handler.
         
-        (WebCore::ScrollView::scrollCornerRect):
-        Return the scroll corner rect.
-        
-        * platform/ScrollView.h:
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::RenderScrollbarPart::imageChanged):
-        If this scrollbar part is the frame view scroll corner, invalidate it.
-
-2009-08-19  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        SVG feComponentTransfer needs to be implemented
-        [https://bugs.webkit.org/show_bug.cgi?id=27768]
-
-        Implementation of SVG Filter feComponentTransfer.
-
-        There is already a test case
-        Test: svg/W3C-SVG-1.1/filters-comptran-01-b.svg
-
-        * platform/graphics/filters/FEComponentTransfer.cpp:
-        (WebCore::identity):
-        (WebCore::table):
-        (WebCore::discrete):
-        (WebCore::linear):
-        (WebCore::gamma):
-        (WebCore::FEComponentTransfer::apply):
+        Test: websocket/tests/bufferedAmount-after-close.html
 
-2009-08-19  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        <rdar://problem/7141522> Incorrect layout of product table at henry.com
-
-        Test: fast/block/basic/quirk-percent-height-table-cell.html
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::calcPercentageHeight): Tweak the quirk that allows
-        percentage-height children of auto-height blocks to look for an ancestor
-        with non-auto height and compute their height based on it. The change is
-        that if that ancestor is a table cell, it is ignored and the percent
-        height computes to zero (just like in strict mode). This matches Firefox
-        and IE.
+        * websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::WebSocket):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didClose):
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::WebSocketChannel):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::bufferedAmount):
+        (WebCore::WebSocketChannel::didClose):
+        (WebCore::WebSocketChannel::didReceiveData):
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketChannelClient.h:
+        (WebCore::WebSocketChannelClient::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::workerContextDidClose):
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.h:
 
-2009-08-19  Jungshik Shin  <jshin@chromium.org>
+2010-02-17  Yuzo Fujishima  <yuzo@google.com>
 
         Reviewed by Eric Seidel.
 
-        Add 'icu::' qualifier when refering to ICU C+names to the other
-        file with this issue missed in the previous check-in.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28410
+        In diffing render styles, consider all pseudo style changes.
+        Without this patch, only :before and :after are considered. This is the cause of the following bug.
+        https://bugs.webkit.org/show_bug.cgi?id=32187
 
-        No change in the test result.
+        Test: fast/css/first-letter-first-line-hover.html
 
-        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        * dom/Node.cpp:
+        (WebCore::Node::diff):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::hasAnyPublicPseudoStyles):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
         (WebCore::):
 
-2009-08-19  Peter Kasting  <pkasting@google.com>
-
-        Unreviewed (build fix for Skia).
-
-        https://bugs.webkit.org/show_bug.cgi?id=28268
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawLine):
-
-2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+2010-02-17  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        [CAIRO] Remove setFont indirection
-        https://bugs.webkit.org/show_bug.cgi?id=28453
-
-        Remove the indirection and just set the font in Font::drawGlyphs.
-
-        * platform/graphics/SimpleFontData.h:
-        * platform/graphics/cairo/FontCairo.cpp:
-        (WebCore::Font::drawGlyphs):
-        * platform/graphics/gtk/FontPlatformData.h:
-        (WebCore::FontPlatformData::scaledFont):
-        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
-        (WebCore::FontPlatformData::~FontPlatformData):
-        * platform/graphics/gtk/FontPlatformDataPango.cpp:
-        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
-        * platform/graphics/gtk/SimpleFontDataPango.cpp:
-        * platform/graphics/win/FontPlatformData.h:
-        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
-        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        [BREWMP] Add WebCore::prefetchDNS
+        https://bugs.webkit.org/show_bug.cgi?id=34873
 
-2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
+        DNS prefetching is not implemented because the maximum number
+        of UDP sockets is quite small in most BREW devices.
 
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: When adding style selector, generate default name based
-        on id / class / type.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28468
-
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode):
-
-2009-08-19  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Rename combinedOverflow to visibleOverflow, since that's what it actually represents.
-
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::nodeAtPoint):
-        (WebCore::InlineFlowBox::paint):
-        * rendering/InlineFlowBox.h:
-        (WebCore::InlineFlowBox::topvisibleOverflow):
-        (WebCore::InlineFlowBox::bottomvisibleOverflow):
-        (WebCore::InlineFlowBox::leftvisibleOverflow):
-        (WebCore::InlineFlowBox::rightvisibleOverflow):
-        (WebCore::InlineFlowBox::visibleOverflowRect):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlock):
-        (WebCore::RenderBlock::paint):
-        (WebCore::RenderBlock::floatRect):
-        (WebCore::RenderBlock::nodeAtPoint):
-        * rendering/RenderBlock.h:
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlock::layoutInlineChildren):
-        (WebCore::RenderBlock::matchedEndLine):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::clippedOverflowRectForRepaint):
-        * rendering/RenderBox.h:
-        (WebCore::RenderBox::visibleOverflowRect):
-        (WebCore::RenderBox::topvisibleOverflow):
-        (WebCore::RenderBox::bottomvisibleOverflow):
-        (WebCore::RenderBox::leftvisibleOverflow):
-        (WebCore::RenderBox::rightvisibleOverflow):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::localBoundingBox):
-        * rendering/RenderLineBoxList.cpp:
-        (WebCore::RenderLineBoxList::paint):
-        (WebCore::RenderLineBoxList::hitTest):
-        * rendering/RenderOverflow.h:
-        (WebCore::RenderOverflow::visibleOverflowRect):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::shouldPaint):
-        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout):
-        (WebCore::RenderTable::paint):
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        * platform/network/brew/DNSBrew.cpp: Added.
+        (WebCore::prefetchDNS):
 
-2009-08-19  Eric Carlson  <eric.carlson@apple.com>
+2010-02-17  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        Sound button appears in controller with movies that have no audio
-        https://bugs.webkit.org/show_bug.cgi?id=28464
+        Introduces new Icon loading interface in order to support
+        asynchronous loading.
+        https://bugs.webkit.org/show_bug.cgi?id=32054
 
-        Test: media/video-no-audio.html
+        It's hard for Chromium port to load an icon inside
+        Icon::createIconForFiles() because of sanbox and multi-process
+        architecture. So this change adds a method to request an icon to
+        Chrome class, and makes FileChooser receives an Icon instance
+        asynchronously.  Synchronous loading also works with the new interface.
 
-        * html/HTMLMediaElement.cpp:
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::hasAudio):
-            Added hasAudio.
+        Because all ports don't have implementations of Chrome::iconForFiles()
+        yet, FileChooser tries to load an Icon synchronously with
+        Icon::createIconForFiles(), then tries to load an Icon asynchronously
+        with Chrome::iconForFiles() if Icon::createIconForFiles() returns 0.
 
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::hasAudio):
-        (WebCore::MediaPlayer::hasVideo):
-            Make const.
-        (WebCore::MediaPlayer::hasAudio):
-            Added hasAudio.
+        The existing Icon::createIconForFiles() implementations should be
+        moved to Chrome::iconForFiles(). We're going to remove
+        Icon::createIconForFiles().
 
-        * platform/graphics/MediaPlayerPrivate.h:
-            Add hasAudio.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::hasAudio):
-            Ditto.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::hasAudio):
-            Ditto.
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::hasAudio):
-            Ditto.
-
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::hasAudio):
-            Ditto.
-
-        * platform/graphics/win/QTMovieWin.h:
-        * platform/graphics/win/QTMovieWin.cpp:
-        (QTMovieWin::hasAudio):
-            Ditto.
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlMuteButtonElement::disabled):
-            New, return true if media element doesn't have audio.
-        (WebCore::MediaControlMuteButtonElement::rendererIsNeeded):
-            Renderer is not needed if element has no audio.
-        * rendering/MediaControlElements.h:
-        (WebCore::MediaControlInputElement::disabled):
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::getMediaUIPartStateFlags):
-            Return MediaUIPartDisabledFlag if node is disabled.
-            
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::iconForFiles): Add an empty implementation.
+        * page/Chrome.cpp:
+        (WebCore::Chrome::iconForFiles): Delegate to ChromeClient::iconForFiles().
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::iconForFiles): Add a declaration as a pure virtual method.
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::FileChooser): Use loadIcon().
+        (WebCore::FileChooser::chooseFiles): ditto.
+        (WebCore::FileChooser::loadIcon): Added.
+        (WebCore::FileChooser::iconLoaded): Added.
+        * platform/FileChooser.h: Add two methods to FileChooserClient; repaint() and iconForFiles().
+        * platform/graphics/Icon.h: Add a FIXME comment.
+        * platform/graphics/gtk/IconGtk.cpp: ditto.
+        * platform/graphics/mac/IconMac.mm: ditto.
+        * platform/graphics/qt/IconQt.cpp: ditto.
+        * platform/graphics/win/IconWin.cpp: ditto.
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::iconForFiles): Delegate to Chrome::iconForFiles().
+        (WebCore::RenderFileUploadControl::click): Use chrome().
+        (WebCore::RenderFileUploadControl::chrome):
+        * rendering/RenderFileUploadControl.h:
+        (WebCore::RenderFileUploadControl::repaint):
 
-2009-08-19  Michelangelo De Simone  <micdesim@gmail.com>
+2010-02-17  Mark Rowe  <mrowe@apple.com>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27357
-        Removed the two unnecessary overridden willValidate() methods introduced
-        in r47444.
-
-        * html/HTMLKeygenElement.h:
-        * html/HTMLObjectElement.h:
-
-2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Allow dumping dangling nodes to the console.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28458
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        * inspector/InspectorBackend.cpp:
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::clearConsoleMessages):
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::releaseDanglingNodes):
-        (WebCore::InspectorDOMAgent::startListening):
-        (WebCore::InspectorDOMAgent::stopListening):
-        (WebCore::InspectorDOMAgent::handleEvent):
-        (WebCore::InspectorDOMAgent::bind):
-        (WebCore::InspectorDOMAgent::unbind):
-        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
-        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
-        (WebCore::InspectorDOMAgent::discardBindings):
-        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
-        (WebCore::InspectorDOMAgent::buildObjectForNode):
-        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::setDetachedRoot):
-        (WebCore::InspectorFrontend::childNodeCountUpdated):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._formatnode):
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMAgent.prototype._setDetachedRoot):
-        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
-        (WebInspector.setDetachedRoot):
-        (WebInspector.childNodeCountUpdated):
-        (InspectorController.pushNodeToFrontend):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.pushNodeToFrontend):
-        (InjectedScript.createProxyObject):
-
-2009-08-19  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27464
-        Implement application cache online whitelist wildcard flag
-
-        Test: http/tests/appcache/whitelist-wildcard.html
-
-        A "*" in NETWORK section means that network loading needn't be blocked.
-
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::isURLInOnlineWhitelist):
-        * loader/appcache/ApplicationCache.h:
-        (WebCore::ApplicationCache::setAllowsAllNetworkRequests):
-        (WebCore::ApplicationCache::allowsAllNetworkRequests):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::openDatabase):
-        (WebCore::ApplicationCacheStorage::store):
-        (WebCore::ApplicationCacheStorage::loadCache):
-        * loader/appcache/ManifestParser.cpp:
-        (WebCore::parseManifest):
-        * loader/appcache/ManifestParser.h:
-
-2009-08-19  Brady Eidson <beidson@apple.com>
-
-        Reviewed by Kevin Decker.
-
-        <rdar://problem/7042555> Loading certain pages on Tiger will start a spurious download
-        
-        Get rid of method swizzling entirely. This created problems when lower level
-        Foundation code would call into our own swizzled method.
-        
-        * platform/network/mac/ResourceHandleMac.mm: 
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): 
-        * platform/network/mac/WebCoreURLResponse.h:
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (-[NSURLResponse adjustMIMETypeIfNecessary]):
-
-2009-08-19  Adam Roben  <aroben@apple.com>
-
-        Fix linker warnings on Windows
-
-        Reviewed by Anders Carlsson.
-
-        Fixes <http://webkit.org/b/28462> WebCore causes linker warnings on
-        Windows about multiply-defined JSHTMLDataListElement symbols
-
-        * WebCore.vcproj/WebCore.vcproj: Exclude JSHTMLDataListElement.cpp
-        from the build (just like we do for the other generated bindings
-        files) so that we don't get warnings about multiply-defined symbols in
-        JSHTMLDataListElement.cpp and DerivedSources.cpp. Also removed
-        duplicate versions of JSSVGElementWrapperFactory.cpp, and let VS
-        reorder a few files.
-
-2009-08-19  Jungshik Shin  <jshin@chromium.org>
-
-        Reviewed by Eric Seidel
-
-        Add 'icu::' qualifier when refering to ICU C+names.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28410
-
-        No change in the test result.
-
-        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
-        (WebCore::fontContainsCharacter):
-
-2009-08-19  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Cleanup from my patch thet rewrote overflow.  Remove unused member variables from RenderTableSection and
-        move the addition of overflow from children into a separate pass after the height of the section has been
-        set.  This prevents the RenderOverflow struct from being aggressively allocated for all table sections.
-        (Not a a correctness issue, just a memory issue.)
-
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::RenderTableSection):
-        (WebCore::RenderTableSection::layoutRows):
-        * rendering/RenderTableSection.h:
-
-2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Xan Lopez.
-
-        [Gtk] Remove bogus dependency rules for built sources that derive
-        from HTMLTagNames.in, HTMLAttributeNames.in and xmlattrs.in. The
-        header files should be generated regardless of whether the source
-        file changed or not. We should only rely on the *.in files being
-        changed.
-
-        * GNUmakefile.am:
-
-2009-08-18  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        convert FormatBlock candidate tag list from if chain to hash lookup
-        https://bugs.webkit.org/show_bug.cgi?id=28448
+        Bug 35065: Delay between page loading and animated GIF playing
+        <http://webkit.org/b/35065> / <rdar://problem/7109548>
 
-        No behavior change, just cleanup.
+        BitmapImage::startAnimation was adding the current frame duration to the desired start time
+        of the frame for every time it was called.  If the function then bailed out due to not having
+        sufficient data to render the frame, this would lead to the desired start time of the frame
+        being pushed out multiple times.  On an animated GIF that took mulitple seconds to load this
+        could happen many times for a single frame, resulting in the start time of the second frame
+        of the animation being pushed out by as much as five seconds.
 
-        * editing/htmlediting.cpp:
-        (WebCore::validBlockTag):
-        * editing/htmlediting.h:
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::startAnimation): Change the order of the code slightly so that the
+        desired start time is only updated after determining that we have sufficient data to handle
+        the next frame.
 
-2009-08-19  Mike Fenton  <mike.fenton@torchmobile.com>
+2010-02-17  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by Eric Seidel.
 
-        Update GraphicsContextSkia's version of drawLine to make use of the shared
-        adjustLineToPixelBoundaries function and elimination overlapping code.
+        Implemented homeDirectoryPath() and listDirectory() on the Haiku platform.
+        https://bugs.webkit.org/show_bug.cgi?id=34687
 
-        https://bugs.webkit.org/show_bug.cgi?id=28268
+        Covered by existing tests.
 
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawLine):
+        * platform/haiku/FileSystemHaiku.cpp:
+        (WebCore::homeDirectoryPath): Implemented
+        (WebCore::listDirectory): Implemented
 
-2009-08-18  Mike Fenton  <mike.fenton@torchmobile.com>
+2010-02-17  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        Style fixes based on cpp_style.py and WebKit Style guide for
-        GraphicsContextSkia.cpp
-
-        https://bugs.webkit.org/show_bug.cgi?id=28268
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::drawFocusRing):
-        (WebCore::GraphicsContext::roundToDevicePixels):
-        (WebCore::GraphicsContext::setLineDash):
-        (WebCore::GraphicsContext::setPlatformShadow):
-
-2009-08-18  Alexey Proskuryakov  <ap@webkit.org>
+        [BREWMP] Port userIdleTime
+        https://bugs.webkit.org/show_bug.cgi?id=34259
 
-        Reviewed by Maciej Stachowiak.
+        Return an arbitrarily high userIdleTime so that releasing pages from the page
+        cache isn't postponed.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28446
-        Custom request headers shouldn't be sent with cross-origin preflight request
+        * platform/brew/SystemTimeBrew.cpp: Added.
+        (WebCore::userIdleTime):
 
-        Tests: http/tests/xmlhttprequest/access-control-preflight-headers-async.html
-               http/tests/xmlhttprequest/access-control-preflight-headers-sync.html
+2010-02-17  Dirk Schulze  <krit@webkit.org>
 
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
-        Don't copy headers to OPTIONS request. The spec is vague about this, but the intention was
-        that they shouldn't be sent, and Firefox doesn't send them.
+        Rolling out r54909. Breaks SL and Win.
 
-2009-08-18  John Gregg  <johnnyg@google.com>
+2010-02-17  Dumitru Daniliuc  <dumi@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        V8 Bindings for Desktop Notifications feature.
-        https://bugs.webkit.org/show_bug.cgi?id=28271
+        Fix Chromium's bindings for Database.transaction(): a 'null'
+        callback should be treated as no callback.
 
-        * WebCore.gypi: 
-        added notification files to build (all still behind a flag that's not on)
-        * bindings/scripts/CodeGeneratorV8.pm:
-        added special case in DOMWindow/AppCache style for named event handlers
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/V8Proxy.h:
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8NotificationCenterCustom.cpp: Added.
-        * notifications/Notification.h:
-        made event handler routines public (as they are in DOMWindow, eg) for
-        binding access.
-        * notifications/NotificationCenter.idl:
-        needed to make methods V8Custom to support different behaviors in 
-        worker/page context in chromium. 
-        * workers/WorkerThread.h:
-        (WebCore::WorkerThread::getNotificationPresenter):
-        (WebCore::WorkerThread::setNotificationPresenter):
-        needed to make these methods public as well so chromium can inject
-        the notification presenter into the worker thread.
-
-2009-08-13  Maciej Stachowiak  <mjs@apple.com>
+        Test: storage/null-callbacks.html
 
-        Reviewed by Sam Weinig.
+        https://bugs.webkit.org/show_bug.cgi?id=35047
 
-        - Implement HTML5 nav element
-        https://bugs.webkit.org/show_bug.cgi?id=27937
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::createTransaction):
 
-        <nav> should behave essentially the same as <div> for parsing
-        etc. This is implemented by the changes below.
-        
-        Tests: fast/html/nav-element.html
+2010-02-17  Dirk Schulze  <krit@webkit.org>
 
-        * css/html.css:
-        * editing/htmlediting.cpp:
-        (WebCore::validBlockTag):
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::tagPriority):
-        (WebCore::blockTagList):
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::getNode):
-        * html/HTMLTagNames.in:
+        Reviewed by Nikolas Zimmermann.
 
-2009-08-18  Anders Carlsson  <andersca@apple.com>
+        Move SVGResources to Renderers, starting with Masker
+        https://bugs.webkit.org/show_bug.cgi?id=35020
 
-        Reviewed by Adele Peterson, David Hyatt and Dan Bernstein.
+        We have rendering specific code in WebCore/svg/graphics. The goal is to move
+        this code into suitable Renderers. This helps us to clean up the code and makes
+        maintenance easier. It also makes it possible to remove rendering specific code
+        from SVG*Elements into this renderers. So the Renderer contains everything that
+        is needed to use the resource.
+        RenderSVGResource will be the base class for all new resource render classes like
+        RenderSVGResourceMasker, RenderSVGResourceClipper and the other resources.
 
-        - Fix <rdar://problem/7152727>
-
-        If a page has custom scroll bars, they will not update correctly when the window is activated/deactivated.
-        
-        * page/FrameView.cpp:
-        (WebCore::FrameView::hasCustomScrollbars):
-        Check if the frame view or any of its subviews have custom scroll bars.
-        
-        (WebCore::FrameView::updateControlTints):
-        Go ahead and update control tints if the frame view has custom scroll bars.
-        
-        * page/FrameView.h:
-
-2009-08-18  Mark Rowe  <mrowe@apple.com>
-
-        Roll out r47477 as it introduced assertion failures and crashes on the build bots.
+        This patch starts moving SVGResourceMasker to RenderSVGResourceMasker.
+        Another benefit is the much more useful result in DRT on using masker.
 
+        * Android.mk:
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/Database.cpp:
-        * storage/Database.h:
-        * storage/DatabaseThread.cpp:
-        (WebCore::DatabaseThread::DatabaseThread):
-        * storage/DatabaseThread.h:
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::runCurrentStatement):
-        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
-        (WebCore::SQLTransaction::postflightAndCommit):
-        * storage/SQLTransactionClient.cpp: Removed.
-        * storage/SQLTransactionClient.h: Removed.
-
-2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding the SharedTimer file for WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=28126
-
-        * platform/haiku/SharedTimerHaiku.cpp: Added.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::toRenderSVGResource): Conversion to RenderSVGResource base class.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGResource): Check if renderer is a resource.
+        * rendering/RenderPath.cpp:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGImage.h: Some code clean up according to the webkit style.
+        (WebCore::RenderSVGImage::toSVGRenderBase):
+        (WebCore::RenderSVGImage::renderName):
+        (WebCore::RenderSVGImage::isSVGImage):
+        (WebCore::RenderSVGImage::localToParentTransform):
+        (WebCore::RenderSVGImage::strokeBoundingBox):
+        (WebCore::RenderSVGImage::requiresLayer):
+        (WebCore::RenderSVGImage::localTransform):
+        * rendering/RenderSVGInlineText.h:
+        (WebCore::RenderSVGInlineText::objectBoundingBox): Needed for SVGRenderTreeAsText
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGResource.h: Added.
+        (WebCore::): Base class for all Resource renderers like masker, clipper and others.
+        (WebCore::RenderSVGResource::RenderSVGResource):
+        (WebCore::RenderSVGResource::cast):
+        (WebCore::RenderSVGResource::toRenderSVGResource):
+        (WebCore::RenderSVGResource::isSVGResource): 
+        (WebCore::RenderSVGResource::drawsContents):
+        (WebCore::getRenderSVGResourceById):
+        * rendering/RenderSVGResourceMasker.cpp: Added.
+        (WebCore::RenderSVGResourceMasker::RenderSVGResourceMasker):
+        (WebCore::RenderSVGResourceMasker::~RenderSVGResourceMasker):
+        (WebCore::RenderSVGResourceMasker::invalidateClients): Status of masker changed, remove all clients.
+        (WebCore::RenderSVGResourceMasker::invalidateClient): Status of an object changed, remove pending client.
+        (WebCore::RenderSVGResourceMasker::applyResource): Apply masker to object.
+        (WebCore::RenderSVGResourceMasker::resourceBoundingBox): boundingBox of the resource, depending on the object.
+        (WebCore::RenderSVGResourceMasker::createMaskImage): Creates the mask image, the context gets clipped with.
+        * rendering/RenderSVGResourceMasker.h: Added.
+        (WebCore::MaskerData::MaskerData):
+        (WebCore::RenderSVGResourceMasker::renderName):
+        (WebCore::RenderSVGResourceMasker::maskUnits): Unit of mask for DRT.
+        (WebCore::RenderSVGResourceMasker::maskContentUnits): Unit of childs from mask for DRT.
+        (WebCore::RenderSVGResourceMasker::resourceType):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::destroy): dito.
+        * rendering/RenderSVGText.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::maskerBoundingBoxForRenderer):
+        (WebCore::SVGRenderBase::deregisterFromResources): Unregister object from all it's resources after status changed.
+        * rendering/SVGRenderSupport.h:
+        (WebCore::SVGRenderBase::toSVGRenderBase):
+        (WebCore::SVGRenderBase::strokeBoundingBox):
+        (WebCore::SVGRenderBase::markerBoundingBox):
+        * rendering/SVGRenderTreeAsText.cpp: Update TreeAsText to dump maskers correctly.
+        (WebCore::operator<<):
+        (WebCore::writeSVGResource):
+        (WebCore::writeSVGContainer):
+        (WebCore::writeSVGText):
+        (WebCore::writeSVGInlineText):
+        (WebCore::writeSVGImage):
+        (WebCore::write):
+        (WebCore::writeResourcesToObject):
+        * rendering/SVGRenderTreeAsText.h:
+        * svg/SVGMaskElement.cpp: Update Masker to use the new renderer.
+        (WebCore::SVGMaskElement::svgAttributeChanged):
+        (WebCore::SVGMaskElement::childrenChanged):
+        (WebCore::SVGMaskElement::maskBoundingBox):
+        (WebCore::SVGMaskElement::createRenderer):
+        * svg/SVGMaskElement.h:
+        * svg/SVGStyledElement.cpp: We need to tell the renderer to unregister object, after the status changed.
+        (WebCore::SVGStyledElement::invalidateResources):
+        (WebCore::SVGStyledElement::invalidateResourcesInAncestorChain):
+        * svg/SVGUnitTypes.h: Conversion of integer to SVGUnitType.
+        (WebCore::toUnitType):
+        * svg/graphics/SVGResource.h:
         (WebCore::):
-        (WebCore::SharedTimerHaiku::SharedTimerHaiku):
-        (WebCore::SharedTimerHaiku::~SharedTimerHaiku):
-        (WebCore::SharedTimerHaiku::instance):
-        (WebCore::SharedTimerHaiku::start):
-        (WebCore::SharedTimerHaiku::stop):
-        (WebCore::SharedTimerHaiku::Filter):
-        (WebCore::setSharedTimerFiredFunction):
-        (WebCore::setSharedTimerFireTime):
-        (WebCore::stopSharedTimer):
+        (WebCore::SVGResource::isMarker):
+        * svg/graphics/SVGResourceMasker.cpp: Removed.
+        * svg/graphics/SVGResourceMasker.h: Removed.
 
-2009-08-18  Mark Rowe  <mrowe@apple.com>
+2010-02-17  Kenneth Russell  <kbr@google.com>
 
-        Release build fix.
-
-        * xml/XMLHttpRequest.cpp: Sprinkle some #ifndef NDEBUG around.
-        (WebCore::XMLHttpRequest::XMLHttpRequest):
-        (WebCore::XMLHttpRequest::~XMLHttpRequest):
-
-2009-08-18  Aaron Boodman  <aa@chromium.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28412: Leak of WebCore::XMLHttpRequest object during layout tests.
-
-        No new tests: Already covered by existing tests.
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::XMLHttpRequest): Add instrumentation for this kind of leak.
-        (WebCore::XMLHttpRequest::~XMLHttpRequest): Ditto.
-        (WebCore::XMLHttpRequest::createRequest): Only setPendingActivity() if we actually started a request. Also,
-        restore a call to nonCacheRequestInFlight() that got lost in a recent refactor.
-
-2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Dimitri Glazkov.
+        Refactor texImage2D and texSubImage2D taking Image to use common code
+        https://bugs.webkit.org/show_bug.cgi?id=34458
 
-        Added a client to SQLTransaction. In addition to being a place to
-        get notifications about certain events in a transaction, it is
-        also an abstraction layer that allows us to plug in different
-        implementations for each port for how transactions interract with
-        the main DB. For example, WebCore's default implementation will
-        make direct calls to DatabaseTracker's methods. At the same time,
-        Chromium's implementation will send IPCs to the browser process
-        whenever a transaction needs something from the main DB.
+        Merged the Safari and Chromium code which extracts the data from
+        Image objects into common entry points on GraphicsContext3D. This
+        immediately fixes the following three problems:
+          - Chromium not implementing texSubImage2D taking Image.
+          - Safari not obeying the flipY parameter to texImage2D or
+            texSubImage2D taking Image.
+          - Safari not obeying the premultipyAlpha parameter to texImage2D
+            or texSubImage2D taking Image.
+        Added new test verifying the behavior of texImage2D and
+        texSubImage2D and the flipY parameter. The premultiplyAlpha
+        parameter can not be tested yet as the implementation is not yet
+        spec compliant. This will be fixed in a follow-on bug.
 
-        All storage tests pass.
+        Ran all WebGL demos in demo repository on Safari and Chromium;
+        textures are now the right way up in both browsers, and
+        transparent textures in Particles demo now look correct in Safari.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27967
+        Test: fast/canvas/webgl/tex-image-and-sub-image-2d-with-image.html
 
-        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
         * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/Database.cpp:
-        (WebCore::Database::transactionClient):
-        * storage/Database.h:
-        * storage/DatabaseThread.cpp:
-        (WebCore::DatabaseThread::DatabaseThread):
-        * storage/DatabaseThread.h:
-        (WebCore::DatabaseThread::transactionClient):
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::runCurrentStatement):
-        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
-        (WebCore::SQLTransaction::postflightAndCommit):
-        * storage/SQLTransactionClient.cpp: Added.
-        * storage/SQLTransactionClient.h: Added.
-
-2009-08-18  Julie Parent  <jparent@chromium.org>
-
-        Not reviewed, build fix for Chromium.
-
-        Final change for v8 corresponding to http://trac.webkit.org/changeset/47469.
+        * platform/graphics/GraphicsContext3D.cpp: Added.
+        (WebCore::GraphicsContext3D::extractImageData):
+        (WebCore::GraphicsContext3D::processImageData):
+        (WebCore::GraphicsContext3D::premultiplyAlpha):
+        (WebCore::GraphicsContext3D::unmultiplyAlpha):
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::):
+        * platform/graphics/cg/GraphicsContext3DCG.cpp: Added.
+        (WebCore::GraphicsContext3D::getImageData):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+        * platform/graphics/skia/GraphicsContext3DSkia.cpp: Added.
+        (WebCore::GraphicsContext3D::getImageData):
 
-        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp: Added missing using statment
+2010-02-17  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-2009-08-18  Julie Parent  <jparent@chromium.org>
+        Reviewed by Ariya Hidayat.
 
-        Not reviewed, build fix for Chromium.
+        [Qt] GraphicsLayer: support perspective and 3D transforms
+        https://bugs.webkit.org/show_bug.cgi?id=34960
 
-       More corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+        New tests: http://webkit.org/blog-files/3d-transforms/perspective-by-example.html
 
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::updateTransform):
+        (WebCore::GraphicsLayerQtImpl::setBaseTransform):
+        (WebCore::GraphicsLayerQtImpl::computeTransform):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        (WebCore::TransformAnimationQt::~TransformAnimationQt):
 
-2009-08-18  Julie Parent  <jparent@chromium.org>
+2010-02-17  Peter Kasting  <pkasting@google.com>
 
-        Not reviewed, build fix for Chromium.
+        Unreviewed, build fix.
 
-        Make corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+        Fix crashes due to an omitted line in r54839.
 
-        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::decodingFailed):
 
-2009-08-18  Dan Bernstein  <mitz@apple.com>
+2010-02-17  Alok Priyadarshi  <alokp@chromium.org>
 
-        Build fix.
+        Reviewed by Ariya Hidayat.
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::getIdentifierValue):
+        Bug 34900: Implement accelerated compositing for chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=34900
 
-2009-08-18  Darin Adler  <darin@apple.com>
+        Do not exclude files needed for accelerated compositing. In fact there is no need to exclude these files.
+        These files are already guarded with WTF_USE_ACCELERATED_COMPOSITING flag.
 
-        Reviewed by Sam Weinig.
+        * WebCore.gyp/WebCore.gyp: Removed GraphicsLayer.cpp, RenderLayerBacking.cpp,
+        and RenderLayerCompositor.cpp from excluded list.
 
-        More work on making DOM classes start with reference count of 1
-        https://bugs.webkit.org/show_bug.cgi?id=28068
+2010-02-17  Jian Li  <jianli@chromium.org>
 
-        Some related clean-up and preparation steps so the subsequent
-        patches will be as small as possible.
+        Reviewed by Darin Fisher.
 
-        * WebCore.base.exp: Sorted this file.
+        [chromium] Remove the obsolete chromium interface for handling DownloadURL.
+        https://bugs.webkit.org/show_bug.cgi?id=34982
 
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityDescription):
-        Use nameAttr instead of the name function.
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::hasData):
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ChromiumDataObject.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::setData):
 
-        * bindings/js/JSHTMLFrameElementCustom.cpp:
-        (WebCore::JSHTMLFrameElement::setSrc):
-        Use srcAttr instead of the src function.
+2010-02-17  Dan Bernstein  <mitz@apple.com>
 
-        * bindings/js/JSHTMLIFrameElementCustom.cpp:
-        (WebCore::JSHTMLIFrameElement::setSrc):
-        Use srcAttr instead of the src function.
+        Reviewed by Darin Adler.
 
-        * bindings/objc/DOM.mm: Sorted includes.
-        * dom/Document.cpp: Ditto.
+        <rdar://problem/7645569> REGRESSION (r51324): Incorrect marker rects for blocks that span multiple columns
 
-        * dom/StyledElement.cpp: Made invalidateStyleAttribute inline.
-        * dom/StyledElement.h: Ditto.
+        * manual-tests/match-marker-rects.html: Added.
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintTextMatchMarker): Use the text renderer rather
+        than its ancestor block for the local-to-absolute transformation.
+        (WebCore::InlineTextBox::computeRectForReplacementMarker): Ditto.
 
-        * dom/make_names.pl: Changed default of createWithNew to 0.
-        Eventually all elements will be created with create instead of new.
+2010-02-17 Gustavo Noronha Silva <gustavo.noronha@collabora.co.uk>
 
-        * html/HTMLTagNames.in:
-        * svg/svgtags.in:
-        * wml/WMLTagNames.in:
-        Added createWithNew for every tag. We'll remove it as we convert
-        element classes to use create.
-
-        * html/HTMLAppletElement.h: Removed unneeded forward declarations.
-        * html/HTMLFrameElement.h: Ditto.
-
-        * html/HTMLEmbedElement.cpp: Removed many attribute get and
-        set functions.
-        * html/HTMLEmbedElement.h: Ditto.
-        * html/HTMLIFrameElement.cpp: Ditto.
-        * html/HTMLIFrameElement.h: Ditto.
-        * html/HTMLObjectElement.cpp: Ditto.
-        * html/HTMLObjectElement.h: Ditto.
-        * html/HTMLPlugInElement.cpp: Ditto.
-        * html/HTMLPlugInElement.h: Ditto.
-
-        * html/HTMLFrameElementBase.cpp: Removed many attribute get and
-        set functions.
-        (WebCore::HTMLFrameElementBase::location): Changed to use
-        srcAttr instead of src.
-        * html/HTMLFrameElementBase.h: Removed many attribute get and set
-        functions.
-
-        * loader/MediaDocument.cpp:
-        (WebCore::MediaDocument::replaceMediaElementTimerFired):
-        Use srcAttr and typeAttr instead of setSrc and setType.
-        * loader/PluginDocument.cpp:
-        (WebCore::PluginTokenizer::createDocumentStructure): Ditto.
+        Reviewed by Xan Lopez.
 
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::updateWidget): Use nameAttr instead
-        of name -- this avoids an extra AtomicString round trip and a little
-        ref count churn too.
+        Does not send an Accept header for subresources, causing some sites to break
+        https://bugs.webkit.org/show_bug.cgi?id=33242
 
-2009-08-18  Drew Wilson  <atwilson@google.com>
+        Set */* as the Accept header when downloading resources
+        that did not set an Accept header. This behaviour is similar to
+        the one adopted by Chromium.
 
-        Reviewed by David Levin.
+        Test: http/tests/misc/image-checks-for-accept.html
 
-        SharedWorkers need to support loading.
-        https://bugs.webkit.org/show_bug.cgi?id=28342
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
 
-        Added loader support to shared workers, and refactored worker tests to also test SharedWorkers
+2010-02-17  Marcus Bulach  <bulach@chromium.org>
 
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::postTaskToLoader):
-        Forwards load requests to an arbitrary document from the list of worker's documents.
-        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
-        Posts responses back to the shared worker thread.
+        Reviewed by Jeremy Orlow.
 
-2009-08-18  Ryosuke Niwa  <rniwa@webkit.org>
+        Fixes initialization order of members for GeolocationServiceChromium.
+        https://bugs.webkit.org/show_bug.cgi?id=35034
 
-        Reviewed by Darin Adler.
+        * platform/chromium/GeolocationServiceChromium.cpp:
 
-        StyleChange::init needs clean up before fixing the bug 23892
-        https://bugs.webkit.org/show_bug.cgi?id=27749
+2010-02-17  Xan Lopez  <xlopez@igalia.com>
 
-        This patch simplifies StyleChange::init by removing the iteration on CSS properties,
-        and adding functions reconcileTextDecorationProperties and extractTextStyle to handle the style.
+        Reviewed by Gustavo Noronha.
 
-        Because there is a bug in how text decorations are processes in getPropertiesNotInComputedStyle,
-        this patch simplifies the treatment in order to preserve the original behavior of WebKit.
-        However, the current implementation is not best (adds redundant text-decorations) and we should fix it later.
+        [Linux] Webkit incompatible with Java plugins
+        https://bugs.webkit.org/show_bug.cgi?id=24912
 
-        No test is added since there is no change in behavior.
+        Resolve symlinks before trying to load plugins as modules, since
+        GModule won't do it.
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::StyleChange::init): Uses getPropertiesNotInComputedStyle instead of iterating through the properties
-        (WebCore::StyleChange::reconcileTextDecorationProperties): Removes -webkit-text-decorations-in-effects and redundant "none"
-        (WebCore::getIdentifierValue): Obtains the identifier of a CSSPrimitiveValue
-        (WebCore::StyleChange::extractTextStyles): Converts properties in style to m_apply* and removes the property
-        (WebCore::getPropertiesNotInComputedStyle): Fixed a bug with how text decorations are treated
+        Based on original work by Gustavo Noronha.
 
-2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::load):
 
-        Reviewed by Dimitri Glazkov.
+2010-02-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Fixing a DB file naming bug in Chromium. The origin should come
-        before the DB name in the file name.
+        Reviewed by Xan Lopez.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28331
+        Protect the resource loader object from disappearing during
+        parseDataUrl.
 
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::fullPathForDatabase):
+        Tested by testdownload API test.
 
-2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl):
 
-        Reviewed by Eric Seidel.
+2010-02-17  Marcus Bulach  <bulach@chromium.org>
 
-        [Haiku] Adding four image-specific files to WebCore:
-        IconHaiku.cpp, ImageBufferData.h, ImageBufferHaiku.cpp, ImageHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28130
-
-        * platform/graphics/Icon.h:
-        * platform/graphics/haiku/IconHaiku.cpp: Added.
-        (WebCore::Icon::~Icon):
-        (WebCore::Icon::createIconForFile):
-        (WebCore::Icon::createIconForFiles):
-        (WebCore::Icon::paint):
-        * platform/graphics/haiku/ImageBufferData.h: Added.
-        * platform/graphics/haiku/ImageBufferHaiku.cpp: Added.
-        (WebCore::ImageBufferData::ImageBufferData):
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::~ImageBuffer):
-        (WebCore::ImageBuffer::context):
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        (WebCore::ImageBuffer::toDataURL):
-        (WebCore::ImageBuffer::image):
-        (WebCore::ImageBuffer::platformTransformColorSpace):
-        * platform/graphics/haiku/ImageHaiku.cpp: Added.
-        (WebCore::FrameData::clear):
-        (WebCore::Image::loadPlatformResource):
-        (WebCore::BitmapImage::initPlatformData):
-        (WebCore::BitmapImage::invalidatePlatformData):
-        (WebCore::BitmapImage::draw):
-        (WebCore::Image::drawPattern):
-        (WebCore::BitmapImage::checkForSolidColor):
-        (WebCore::BitmapImage::getBBitmap):
+        Reviewed by Jeremy Orlow.
 
-2009-08-18  Beth Dakin  <bdakin@apple.com>
+        Implements GeolocationServices for Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=32068
 
-        Reviewed by Dan Bernstein.
+        This is part of implementing Geolocation framework for Chromium. Existing layout tests should pass.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27575 [CSS3 
-        Backgrounds and Borders] Drop the prefix from background-size
+        * WebCore.gypi:
+        * page/Geolocation.h:
+        * platform/GeolocationService.h:
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseFillProperty):
-        (WebCore::cssPropertyID):
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * page/animation/AnimationBase.cpp:
-        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
-        (WebCore::ensurePropertyMap):
+2010-02-17  Steve Block  <steveblock@google.com>
 
-2009-08-18  Drew Wilson  <atwilson@google.com>
+        Reviewed by Ariya Hidayat.
 
-        Reviewed by David Levin.
+        Adds missing platform and feature guards to V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=34987
 
-        SharedWorkers need to forward exceptions to parent documents
-        https://bugs.webkit.org/show_bug.cgi?id=28320
+        No new tests, build fix only.
 
-        Changed SharedWorkerProxy to have individual mutexes (so workers can interact with their parent documents without contention).
+        * bindings/v8/V8Proxy.cpp: Modified. Adds CHROMIUM guards and uses PlatformBridge in place of ChromiumBridge
+        * bindings/v8/V8Proxy.h: Modified. Adds CHROMIUM guards and uses PlatformBridge in place of ChromiumBridge
+        * bindings/v8/custom/V8DocumentCustom.cpp: Modified. Adds XPATH guards
 
-        Updated SharedWorkerProxy to forward exceptions/console messages to all parent documents.
+2010-02-17  Steve Block  <steveblock@google.com>
 
-        * bindings/js/JSSharedWorkerConstructor.cpp:
-        Cleaned up bitrot - added missing include.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::postExceptionTask):
-        Callback used to deliver exceptions to a document.
-        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
-        Forwards exceptions to all parent documents for presentation to the user.
-        (WebCore::postConsoleMessageTask):
-        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
-        Forwards console messages to all parent documents for presentation to the user.
-        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
-        Grabs the mutex before accessing workerDocuments.
-        (WebCore::SharedWorkerProxy::documentDetached):
-        Grabs the mutex before accessing workerDocuments.
-
-2009-08-18  Anders Carlsson  <andersca@apple.com>
+        Reviewed by Ariya Hidayat.
 
-        Reviewed by Adele Peterson.
+        Include WebCore's npruntime.h for Android in V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=35002
 
-        <rdar://problem/7135588> HTMLMediaElement should ask WebPolicyLoadDelegate before loading resource
-        
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::isSafeToLoadURL):
-        Call FrameLoaderClient::shouldLoadMediaElementURL.
-        
-        * loader/FrameLoaderClient.h:
-        (WebCore::FrameLoaderClient::shouldLoadMediaElementURL):
-        Return true by default.
+        Currently, the V8 bindings include bindings/npruntime.h, which is a
+        Chromium-specific file outside of the WebKit tree.
 
-2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+        No new tests, build fix only.
 
-        Reviewed by Dimitri Glazkov.
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/NPV8Object.h:
+        * bindings/v8/V8NPObject.h:
+        * bindings/v8/V8NPUtils.h:
+        * bindings/v8/npruntime_impl.h:
+        * bindings/v8/npruntime_priv.h:
 
-        openDatabase() should not execute any SQL statement on the
-        database it's trying to open, unless there are no other open
-        handles to the same database. Otherwise, we might run into a
-        deadlock.
+2010-01-07  Philippe Normand  <pnormand@igalia.com>
 
-        Test: storage/open-database-while-transaction-in-progress.html
+        Reviewed by Gustavo Noronha Silva.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28207
+        [GStreamer] Should handle BUFFERING messages
+        https://bugs.webkit.org/show_bug.cgi?id=30004
 
-        * storage/Database.cpp:
-        (WebCore::Database::performOpenAndVerify):
+        Initial support for on-disk buffering of videos. This works only
+        for Quicktime and flv though.
 
-2009-08-18  Dirk Schulze  <krit@webkit.org>
+        * css/mediaControlsGtk.css:
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::paintMediaSliderTrack): Draw the
+        buffering status in the media controls.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback): Defer buffering
+        messages handling to processBufferingStats().
+        (WebCore::bufferingTimeoutCallback): Closure called periodically
+        during the on-disk buffering process.
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): New instance
+        variables and create playbin2 here instead of doing it in load().
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate): New instance
+        variables.
+        (WebCore::MediaPlayerPrivate::load): Simply set uri on playbin2
+        instead of creating the pipeline and setting uri all together.
+        (WebCore::MediaPlayerPrivate::processBufferingStats): Start a new
+        timeout source if the player is starting on-disk buffering.
+        (WebCore::MediaPlayerPrivate::queryBufferingStats): Method called
+        200ms during on-disk buffering to update the maxTimeLoaded and few
+        other private variables.
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable):
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded):
+        (WebCore::MediaPlayerPrivate::bytesLoaded): Fixed implementations
+        regarding buffering.
+        (WebCore::MediaPlayerPrivate::totalBytes): Improved logging.
+        (WebCore::MediaPlayerPrivate::updateStates): Start playback if it
+        was internally paused at beginning of on-disk buffering and set
+        ready/network states depending on the state of the on-disk
+        buffering process.
+        (WebCore::MediaPlayerPrivate::didEnd): Emit durationChanged.
+        (WebCore::MediaPlayerPrivate::setAutobuffer): Edit playbin2 flags
+        property depending on autoBuffer value.
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin): Don't set uri
+        there, it is now done in load().
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h: New methods
+        and instance variables.
+
+2010-02-16  Chris Evans  <cevans@chromium.org>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Adam Barth.
 
-        SVG Filter feBlend implementation missing
-        [https://bugs.webkit.org/show_bug.cgi?id=28133]
+        Add a new setting which gives the option of assigning every file:///
+        to its own unique domain.
 
-        Implementation of SVG Filter feBlend.
+        https://bugs.webkit.org/show_bug.cgi?id=34778
 
-        FilterEffect.cp needed changes to optimize the rendering. With the old code
-        we drew a subEffect on the current FilterEffect by drawImage, got the PixelArray,
-        cleared the drawing area, drew the next FilterEffect with drawImage and picked this
-        PixelArray again. This was unefficient and slow. Now we calculate the requested area
-        of the subEffect and ask the FilterEffect's ImageBuffer for the PixelArray directly,
-        without any drawing operations on GraphicsContext.
+        Test: Pending in forthcoming separate change due to non-trivial
+        dependencies.
 
-        There is already a test case
-        Test: svg/W3C-SVG-1.1/filters-blend-01-b.svg
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext): Place file:/// URI documents
+        into their own unique domains if the new setting requires it.
+        * page/Settings.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::setAllowFileAccessFromFileURLs): Simple setter.
+        * page/SecurityOrigin.h:
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::makeUnique): Add simple ability to force an
+        origin to be considered unique.
 
-        * html/canvas/CanvasPixelArray.h:
-        (WebCore::CanvasPixelArray::set):
-        (WebCore::CanvasPixelArray::get):
-        * platform/graphics/filters/FEBlend.cpp:
-        (WebCore::unknown):
-        (WebCore::normal):
-        (WebCore::multiply):
-        (WebCore::screen):
-        (WebCore::darken):
-        (WebCore::lighten):
-        (WebCore::FEBlend::apply):
-        * platform/graphics/filters/FEBlend.h:
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::calculateDrawingIntRect):
-        * platform/graphics/filters/FilterEffect.h:
-
-2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-16  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Fix array formatter followup: node formatter.
+        Web Inspector: drosera/demo.js not syntax highlighted correctly.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28427
+        https://bugs.webkit.org/show_bug.cgi?id=35008
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._format):
+        * inspector/front-end/SourceTokenizer.js:
+        (WebInspector.SourceTokenizer.Registry):
+        (WebInspector.SourceTokenizer.Registry.prototype.getTokenizer):
 
-2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-16  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Metrics sidebar broken
-
-        https://bugs.webkit.org/show_bug.cgi?id=28434
-
-        * inspector/front-end/MetricsSidebarPane.js:
-
-2009-08-18  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28432
-        String::createCFString() returns a non-retained empty string
-
-        No known change in functionality, so no test.
-
-        * platform/text/cf/StringCF.cpp: (WebCore::String::createCFString): Retain the CFSTR result.
-    
-2009-08-18  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28326> DRT on Windows doesn't support 
-        LayoutTestController::setQuota or print a callback on UIDelegate::exceededDatabaseQuota.
-        
-        Removed an early return that can cause deleteOrigin or deleteAllDatabases to fail when
-        it doesn't have to.
-
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::deleteOrigin):
-
-2009-08-18  Michelangelo De Simone  <micdesim@gmail.com>
+        Web Inspector: prefer smooth scrolling to instant highlight.
 
-        Reviewed by Adele Peterson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27357
-        Support for :valid and :invalid CSS selectors, from HTML5 specs.
-        http://www.whatwg.org/specs/web-apps/current-work/#selector-valid
+        https://bugs.webkit.org/show_bug.cgi?id=34978
 
-        Tests: fast/css/pseudo-invalid-001.html
-               fast/css/pseudo-invalid-002.html
-               fast/css/pseudo-valid-001.html
-               fast/css/pseudo-valid-002.html
-               fast/css/pseudo-valid-003.html
-               fast/css/pseudo-valid-004.html
-               fast/css/pseudo-valid-005.html
-               fast/css/pseudo-valid-006.html
-               fast/css/pseudo-valid-007.html
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer):
+        (WebInspector.TextViewer.prototype._scroll):
+        (WebInspector.TextChunk):
+        (WebInspector.TextChunk.prototype._createRow):
+        * inspector/front-end/textViewer.css:
 
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): extracts new pseudo-classes
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::canShareStyleWithElement): Make sure we don't share style between
-form controls that have different validity states.
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
-        style associated to new pseudo-classes
-        * dom/Element.h:
-        (WebCore::Element::willValidate): pushed up in hierarchy
-        (WebCore::Element::isValidFormControlElement): checks for valid form
-        control elements (wraps ValidityState::valid())
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::willValidate): minor clean up
-        (WebCore::HTMLFormControlElement::isValidFormControlElement): ditto
-        * html/HTMLFormControlElement.h:
-        * html/HTMLKeygenElement.h:
-        (WebCore::HTMLKeygenElement::willValidate): added
-        * html/HTMLObjectElement.h:
-        (WebCore::HTMLObjectElement::willValidate): added
-        * html/HTMLObjectElement.idl:
+2010-02-16  Yael Aharon  <yael.aharon@nokia.com>
 
-2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Nikolas Zimmermann.
 
-        Reviewed by Timothy Hatcher.
+        SVG not rendered as background-image from data URI
+        https://bugs.webkit.org/show_bug.cgi?id=33630
 
-        WebInspector: Fix array formatter.
+        When the background image is an SVG image, and it is smaller than the area
+        it is supposed to fill, we were using renderSubTreeToImage to draw it.
+        That call was not going through all the drawing phases, and so the SVG itself
+        would not be drawn.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28427
+        Test: svg/css/background-image-svg.html
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._formatarray):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::nativeImageForCurrentFrame):
 
-2009-08-17  Joe Mason  <joe.mason@torchmobile.com>
+2010-02-16  Bryan Yeung  <bryeung@chromium.org>
 
-        Reviewed by George Staikos
+        Reviewed by Nikolas Zimmermann.
 
-        Replace repeated string of PLATFORM(FOO) with a single define
-        https://bugs.webkit.org/show_bug.cgi?id=27734
+        Remove the bounds on stroke width and miter for the skia platform.
+        https://bugs.webkit.org/show_bug.cgi?id=34954
 
-        * loader/CachedFont.cpp:
-        (WebCore::CachedFont::~CachedFont):
-        (WebCore::CachedFont::ensureCustomFontData):
-        (WebCore::CachedFont::platformDataFromCustomData):
-        (WebCore::CachedFont::allClientsRemoved):
+        Test: svg/custom/stroke-width-large.svg
 
-2009-08-16  David Hyatt  <hyatt@apple.com>
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintForStroking):
 
-        Reviewed by Dan Bernstein.
+2010-02-16  MORITA Hajime  <morrita@gmail.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=20329, shadows and reflections incorrectly
-        considered part of scrollable overflow.
+        Reviewed by Nikolas Zimmermann.
 
-        This patch takes the engine's concept of overflow and splits it into two types:
-        layout overflow and visual overflow.
-        
-        Layout overflow is about other boxes that spill out of an enclosing box,  For example,
-        in the inline flow case a tall image could spill out of a line box. Examples of 
-        visual overflow are shadows, text stroke (and eventually outline and
-        border-image).
-
-        Three objects tracked overflow before this patch: RenderBlock had 
-        m_overflowLeft/Top/Width/Height variables.  RootInlineBox had an Overflow*
-        that also had four overflow values.  Finally RenderReplaced elements tracked shadow/reflection
-        overflow using a map that cached four values.
-        
-        This patch takes all of these different overflow models and unifies them into a single
-        new class called RenderOverflow.   This class is now a member variable in RenderBox and
-        InlineFlowBoxes.  It is only allocated if overflow actually exists.  Instead of tracking
-        four values, it tracks eight: left/top/right/bottom for layout overflow and 
-        left/top/right/bottom for visual overflow.
-        
-        Overflow computation is now done after layout is finished rather than during layout
-        (when child objects can be churning and moving around).  A number of layout tests progressed
-        by deferring overflow computation to a separate pass.
-        
-        All inline flow boxes now track overflow (and not just the root line box).  This allows
-        repainting of line boxes to actually be tight and bail early if the overflow rect of a box
-        doesn't intersect.  The old code always visited all object on a line if the root line box
-        intersected at all.
-        
-        Line box overflow no longer propagates across self-painting layers.  This fixes a number of
-        issues with incorrect scrollbars appearing when relative positioned inlines were used in a page.
-        
-        Layer bounds have been modified to exclude visual overflow.  The width/height members only really
-        have one reason for continued existence, and that is that they happen to be used in repaint()
-        when an overflow clip object's height isn't accurate.  In this case, the bounds should exclude
-        visual overflow anyway, so this change tightens that repaint up.
-        
-        Root lines have renamed m_selectionTop/Bottom to m_lineTop/Bottom and positionForPoint methods have
-        been changed to use these instead of relying on overflow (which was totally wrong).
+        REGRESSION: SVG text disappaears after double click
+        https://bugs.webkit.org/show_bug.cgi?id=34880
 
-        Significant changes have been made to the "almost strict mode" line box quirk where objects with no
-        text children have no effect on the height of a line.  Instead of making the height() of the objects
-        variable and dependent on overflow, the objects now have their full height and get placed on
-        the baseline properly.  They simply don't contribute to overflow above lineTop/Bottom.
-        
-        Reflections are no longer considered overflow of any kind.  Because reflections have their own layers,
-        it is not necessary to treat them as visual or layout overflow in the RenderObject tree.  The end result
-        of not incorporating them into RenderOverflow is that they have no effect on scrolling.  transparencyClipBox
-        has been extended to support fully reflecting the entire clip box when a reflection exists.  This fixes
-        numerous repaint bugs in transparent objects with reflections when the transparent objects had self-painting
-        sublayers.
+        Tests: svg/text/selection-doubleclick.svg
+               svg/text/selection-tripleclick.svg
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::getUpperLeftCorner):
-        * editing/visible_units.cpp:
-        (WebCore::previousLinePosition):
-        (WebCore::nextLinePosition):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::adjustViewSize):
-        (WebCore::FrameView::adjustPageHeight):
-        * rendering/InlineBox.cpp:
-        (WebCore::InlineBox::height):
-        * rendering/InlineBox.h:
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::adjustPosition):
-        (WebCore::InlineFlowBox::placeBoxesHorizontally):
-        (WebCore::InlineFlowBox::placeBoxesVertically):
-        (WebCore::InlineFlowBox::computeVerticalOverflow):
-        (WebCore::InlineFlowBox::nodeAtPoint):
-        (WebCore::InlineFlowBox::paint):
-        * rendering/InlineFlowBox.h:
-        (WebCore::InlineFlowBox::InlineFlowBox):
-        (WebCore::InlineFlowBox::topCombinedOverflow):
-        (WebCore::InlineFlowBox::bottomCombinedOverflow):
-        (WebCore::InlineFlowBox::leftCombinedOverflow):
-        (WebCore::InlineFlowBox::rightCombinedOverflow):
-        (WebCore::InlineFlowBox::combinedOverflowRect):
-        (WebCore::InlineFlowBox::topLayoutOverflow):
-        (WebCore::InlineFlowBox::bottomLayoutOverflow):
-        (WebCore::InlineFlowBox::leftLayoutOverflow):
-        (WebCore::InlineFlowBox::rightLayoutOverflow):
-        (WebCore::InlineFlowBox::layoutOverflowRect):
-        (WebCore::InlineFlowBox::topVisualOverflow):
-        (WebCore::InlineFlowBox::bottomVisualOverflow):
-        (WebCore::InlineFlowBox::leftVisualOverflow):
-        (WebCore::InlineFlowBox::rightVisualOverflow):
-        (WebCore::InlineFlowBox::visualOverflowRect):
-        (WebCore::InlineFlowBox::setHorizontalOverflowPositions):
-        (WebCore::InlineFlowBox::setVerticalOverflowPositions):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paint):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::RenderBlock):
-        (WebCore::RenderBlock::layout):
-        (WebCore::RenderBlock::layoutBlock):
-        (WebCore::RenderBlock::addOverflowFromBlockChildren):
-        (WebCore::RenderBlock::handleBottomOfBlock):
-        (WebCore::RenderBlock::layoutBlockChildren):
-        (WebCore::RenderBlock::paint):
-        (WebCore::RenderBlock::fillInlineSelectionGaps):
-        (WebCore::RenderBlock::floatRect):
-        (WebCore::RenderBlock::lowestPosition):
-        (WebCore::RenderBlock::rightmostPosition):
-        (WebCore::RenderBlock::leftmostPosition):
-        (WebCore::RenderBlock::addOverhangingFloats):
-        (WebCore::RenderBlock::nodeAtPoint):
-        (WebCore::RenderBlock::positionForPointWithInlineChildren):
-        (WebCore::RenderBlock::layoutColumns):
-        (WebCore::getHeightForLineCount):
-        * rendering/RenderBlock.h:
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
-        (WebCore::RenderBlock::computeVerticalPositionsForLine):
-        (WebCore::RenderBlock::layoutInlineChildren):
-        (WebCore::RenderBlock::matchedEndLine):
-        (WebCore::RenderBlock::addOverflowFromInlineChildren):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::destroy):
-        (WebCore::RenderBox::clippedOverflowRectForRepaint):
-        (WebCore::RenderBox::localCaretRect):
-        (WebCore::RenderBox::addShadowAndReflectionOverflow):
-        (WebCore::RenderBox::addOverflowFromChild):
-        (WebCore::RenderBox::addLayoutOverflow):
-        (WebCore::RenderBox::addVisualOverflow):
-        (WebCore::RenderBox::clearLayoutOverflow):
-        * rendering/RenderBox.h:
-        (WebCore::RenderBox::combinedOverflowRect):
-        (WebCore::RenderBox::topCombinedOverflow):
-        (WebCore::RenderBox::bottomCombinedOverflow):
-        (WebCore::RenderBox::leftCombinedOverflow):
-        (WebCore::RenderBox::rightCombinedOverflow):
-        (WebCore::RenderBox::layoutOverflowRect):
-        (WebCore::RenderBox::topLayoutOverflow):
-        (WebCore::RenderBox::bottomLayoutOverflow):
-        (WebCore::RenderBox::leftLayoutOverflow):
-        (WebCore::RenderBox::rightLayoutOverflow):
-        (WebCore::RenderBox::visualOverflowRect):
-        (WebCore::RenderBox::topVisualOverflow):
-        (WebCore::RenderBox::bottomVisualOverflow):
-        (WebCore::RenderBox::leftVisualOverflow):
-        (WebCore::RenderBox::rightVisualOverflow):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock):
-        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
-        (WebCore::RenderFlexibleBox::layoutVerticalBox):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPosition):
-        (WebCore::RenderLayer::localBoundingBox):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateRootLayerPosition):
-        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
-        * rendering/RenderLineBoxList.cpp:
-        (WebCore::RenderLineBoxList::paint):
-        (WebCore::RenderLineBoxList::hitTest):
-        * rendering/RenderListItem.cpp:
-        (WebCore::RenderListItem::positionListMarker):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::RenderObject):
-        * rendering/RenderObject.h:
-        * rendering/RenderOverflow.h: Added.
-        (WebCore::RenderOverflow::RenderOverflow):
-        (WebCore::RenderOverflow::topLayoutOverflow):
-        (WebCore::RenderOverflow::bottomLayoutOverflow):
-        (WebCore::RenderOverflow::leftLayoutOverflow):
-        (WebCore::RenderOverflow::rightLayoutOverflow):
-        (WebCore::RenderOverflow::topVisualOverflow):
-        (WebCore::RenderOverflow::bottomVisualOverflow):
-        (WebCore::RenderOverflow::leftVisualOverflow):
-        (WebCore::RenderOverflow::rightVisualOverflow):
-        (WebCore::RenderOverflow::setTopLayoutOverflow):
-        (WebCore::RenderOverflow::setBottomLayoutOverflow):
-        (WebCore::RenderOverflow::setLeftLayoutOverflow):
-        (WebCore::RenderOverflow::setRightLayoutOverflow):
-        (WebCore::RenderOverflow::setTopVisualOverflow):
-        (WebCore::RenderOverflow::setBottomVisualOverflow):
-        (WebCore::RenderOverflow::setLeftVisualOverflow):
-        (WebCore::RenderOverflow::setRightVisualOverflow):
-        (WebCore::RenderOverflow::layoutOverflowRect):
-        (WebCore::RenderOverflow::visualOverflowRect):
-        (WebCore::RenderOverflow::combinedOverflowRect):
-        (WebCore::RenderOverflow::move):
-        (WebCore::RenderOverflow::addLayoutOverflow):
-        (WebCore::RenderOverflow::addVisualOverflow):
-        (WebCore::RenderOverflow::resetLayoutOverflow):
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::layout):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::~RenderReplaced):
-        (WebCore::RenderReplaced::layout):
-        (WebCore::RenderReplaced::shouldPaint):
-        (WebCore::RenderReplaced::positionForPoint):
-        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
-        * rendering/RenderReplaced.h:
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::RenderScrollbarPart::layout):
-        (WebCore::RenderScrollbarPart::paintIntoRect):
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::layout):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout):
-        (WebCore::RenderTable::paint):
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::layoutRows):
-        * rendering/RenderTableSection.h:
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::positionForPoint):
-        (WebCore::RenderText::localCaretRect):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::layout):
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::addHighlightOverflow):
-        (WebCore::RootInlineBox::adjustPosition):
-        (WebCore::RootInlineBox::verticallyAlignBoxes):
-        (WebCore::RootInlineBox::selectionTop):
-        * rendering/RootInlineBox.h:
-        (WebCore::RootInlineBox::RootInlineBox):
-        (WebCore::RootInlineBox::nextRootBox):
-        (WebCore::RootInlineBox::prevRootBox):
-        (WebCore::RootInlineBox::lineTop):
-        (WebCore::RootInlineBox::lineBottom):
-        (WebCore::RootInlineBox::selectionBottom):
-        (WebCore::RootInlineBox::selectionHeight):
-        (WebCore::RootInlineBox::floats):
-        (WebCore::RootInlineBox::floatsPtr):
-        (WebCore::RootInlineBox::setLineTopBottomPositions):
         * rendering/SVGRootInlineBox.cpp:
-        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+        (WebCore::SVGRootInlineBoxPaintWalker::mayHaveSelection):
+        Use InlineTextBox::selectionStartEnd() instead of
+        RenderObject::selectionStartEnd() because latter may span multiple
+        comparing startPos and endPos is irrelevant in some cases.
+        former selectionStartEnd() is for single line and comparing
+        startPos and endPos will make sense.
 
-2009-08-18  Alexey Proskuryakov  <ap@apple.com>
+2010-02-16  Jessie Berlin  <jberlin@webkit.org>
 
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28431
-        <rdar://problem/7137610> Application Cache doesn't work with HTTP authentication
+        Reviewed by Timothy Hatcher.
 
-        Test: http/tests/appcache/auth.html
+        Inspector should display Array lengths in the property lists.
+        https://bugs.webkit.org/show_bug.cgi?id=20695
 
-        * loader/appcache/ApplicationCacheGroup.h:
-        (WebCore::ApplicationCacheGroup::shouldUseCredentialStorage): If appcache is enabled,
-        always allow it to use stored credentials (we can't ask WebKit client, and maybe we
-        shouldn't ask it, because it's not a document that's loading these resources).
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        For objects of type 'array' (which includes Arrays, NodeLists, and HTMLCollections), make the length of the object available via propertyLength on the proxy object.
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        For properties that have propertyLength defined, append it to the displayed description.
 
-2009-08-18  Anders Carlsson  <andersca@apple.com>
+2010-02-16  Yusuke Sato  <yusukes@chromium.org>
 
-        Reviewed by John Sullivan and David Hyatt.
+        Reviewed by Dimitri Glazkov.
 
-        Fix <rdar://problem/7147996>
+        [Chromium] OpenType font with CFF glyphs is not handled correctly on Windows XP
+        https://bugs.webkit.org/show_bug.cgi?id=34735
 
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setHasHorizontalScrollbar):
-        (WebCore::ScrollView::setHasVerticalScrollbar):
-        Update the style of the scroll bars.
+        Use 0xFFFF as invalidGlyph when fontData is a OpenType font with CFF glyphs.
         
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::RenderScrollbar):
-        Calculate the size of the scrollbar and set it as the frame size.
-
-2009-08-18  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        HTMLMediaElement should fire 'progress' event before 'load'
-        https://bugs.webkit.org/show_bug.cgi?id=28314
-
-        Test: media/progress-event-at-least-one.html
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::setNetworkState):
-            Schedule 'progress' event before 'load'.
-
-2009-08-18  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
+        Test: fast/css/font-face-opentype.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=28415
-        Set svn:eol-style CRLF on all .sln and .vcproj files that don't already
-        have it.
-
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCoreGenerated.vcproj:
-
-2009-08-18  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Need to extend DumpRenderTree to expose number of worker threads
-        https://bugs.webkit.org/show_bug.cgi?id=28292
-
-        Expose WorkerThread::workerThreadCount() for DumpRenderTree so we can write worker lifecycle tests.
-
-        Tests: fast/workers/shared-worker-lifecycle.html-disabled
-               fast/workers/worker-lifecycle.html
-
-        * WebCore.base.exp:
-        Exported WorkerThread::workerThreadCount().
-        * WebCore.xcodeproj/project.pbxproj:
-        * workers/WorkerThread.cpp:
-        Added tracking of the number of worker threads.
-        (WebCore::threadCountMutex):
-        (WebCore::WorkerThread::workerThreadCount):
-        (WebCore::WorkerThread::WorkerThread):
-        (WebCore::WorkerThread::~WorkerThread):
-        * workers/WorkerThread.h:
-
-2009-08-18  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Unreviewed, build fix.
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillBMPGlyphs):
 
-        [Qt] Add new files I forgot to add in r47424.
+2010-02-16  Darin Adler  <darin@apple.com>
 
-2009-08-18  Markus Goetz <Markus.Goetz@nokia.com>
+        * page/MediaCanStartListener.h: Fixed license.
 
-        Reviewed by Ariya Hidayat.
+2010-02-16  Darin Adler  <darin@apple.com>
 
-        [Qt] Implement prefetchDNS() function.
+        Reviewed by Sam Weinig.
 
-        * WebCore.pro:
-        * platform/qt/TemporaryLinkStubs.cpp:
+        Generalize delayed plug-in start for background tabs for use for other media
+        https://bugs.webkit.org/show_bug.cgi?id=34981
 
-2009-08-18  Kent Tamura  <tkent@chromium.org>
+        Also did some simple cleanup of HTMLMediaElement to get ready to make it
+        a client of the same mechanism.
 
-        Reviewed by Eric Seidel.
+        * WebCore.base.exp: Added Page::setCanStartMedia and resorted.
+        * WebCore.xcodeproj/project.pbxproj: Added MediaCanStartListener.h.
 
-        Support for parsing <datalist> element and generating HTMLDataListElement nodes.
-        https://bugs.webkit.org/show_bug.cgi?id=26915
+        * html/HTMLAudioElement.h: Added an implementation of isVideo since that
+        is now a pure virtual function in HTMLMediaElement. Also made tagPriority
+        private.
 
-        Tests: fast/forms/datalist-nonoption-child.html
-               fast/forms/datalist.html
+        * html/HTMLMediaElement.h: Made it clearer that HTMLMediaElement is an
+        abstract base class by making its constructor protected and making the
+        isVideo function a pure virtual function.
 
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/build-generated-files.sh:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * css/html.css:
-        * html/CollectionType.h:
-        (WebCore::):
-        * html/HTMLCollection.cpp:
-        (WebCore::HTMLCollection::itemAfter):
-        * html/HTMLDataListElement.cpp: Added.
-        (WebCore::HTMLDataListElement::HTMLDataListElement):
-        (WebCore::HTMLDataListElement::~HTMLDataListElement):
-        (WebCore::HTMLDataListElement::checkDTD):
-        (WebCore::HTMLDataListElement::options):
-        * html/HTMLDataListElement.h: Added.
-        * html/HTMLDataListElement.idl: Added.
-        * html/HTMLElement.cpp:
-        (WebCore::inlineTagList):
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::isAffectedByResidualStyle):
-        * html/HTMLTagNames.in:
-
-2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+        * page/Page.cpp:
+        (WebCore::Page::Page): Updated for name change from m_canStartPlugins
+        to m_canStartMedia.
+        (WebCore::Page::addMediaCanStartListener): Renamed and added an assertion.
+        (WebCore::Page::removeUnstartedMedia): Ditto.
+        (WebCore::Page::setCanStartMedia): Renamed plugin to media and moved
+        the code here from PageWin.cpp. The main change from the one in PageWin.cpp
+        is that this function calls mediaCanStart rather than explicitly calling a
+        combination of start and dispatchDidFailToStartPlugin on a PluginView.
 
-        Reviewed by Eric Seidel.
+        * page/Page.h: Re-sorted forward class declarations. Renamed the plugin
+        starting functions to media starting names and changed types from
+        PluginView to MediaCanStartListener.
 
-        -webkit-box-orient:horizontal doesn't work on <button> tag
-        https://bugs.webkit.org/show_bug.cgi?id=34445
+        * page/MediaCanStartListener.h: Added.
 
-        Make a flexible button's anonymous child flexible and pass the
-        parent's box-orient to the anonymous child.
+        * page/win/PageWin.cpp: Moved setCanStartPlugins to the platform-independent
+        Page.cpp file so it can be used for more than just Windows plug-ins.
 
-        Also, added a renderName for anonymous flexible boxes.
+        * plugins/PluginView.cpp: Sorted includes.
+        (WebCore::PluginView::startOrAddToUnstartedList): Use addMediaCanStartListener.
+        (WebCore::PluginView::mediaCanStart): Added. Called when the page decides that
+        media can start. Contains the code that used to be in Page::setCanStartPlugins.
+        (WebCore::PluginView::removeFromUnstartedListIfNecessary): Use
+        removeMediaCanStartListener.
 
-        Test: fast/flexbox/box-orient-button.html
+        * plugins/PluginView.h: Adopted MediaCanStartListener.
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::createAnonymousBlock):
-        * rendering/RenderBlock.h:
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::addChild):
-        (WebCore::RenderButton::setupInnerStyle):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::renderName):
+2010-02-16  Simon Fraser  <simon.fraser@apple.com>
 
-2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+        Reviewed by Dan Bernstein.
 
-        Reviewed by Dave Hyatt.
-        
-        Render -webkit-mask via compositing layers when possible
-        https://bugs.webkit.org/show_bug.cgi?id=28414
-        
-        Implement accelerated compositing of -webkit-mask, when combined
-        with already-composited content.
-        
-        RenderLayerBacking now creates an additional GraphicsLayer for the mask contents,
-        and sets this as the mask on another GraphicsLayer via the setMaskLayer() method.
-        GraphicsLayerCA then applies the mask using -[CALayer setMask:].
-        
-        The enum values for GraphicsLayerPaintingPhase were renamed to avoid the
-        confusion with "mask", and a new value, GraphicsLayerPaintMask, was added which
-        indicates that just the mask is painting.
+        https://bugs.webkit.org/show_bug.cgi?id=34999
+        Compositing layers inside overflow:scroll divs are not always updated on scrolling
         
-        When painting the composited mask, we need to paint with the normal compositing
-        mode rather than CompositeDestinationIn, so InlineFlowBox and RenderBox now consult
-        layer()->hasCompositedMask() to pick the mode. If the mask is composited, they no longer
-        need to make transparency layers.
-        
-        We no longer have to throw video rendering into software because of masks.
-        
-        When a masked element has composited descendants, that element needs to
-        become composited so that the mask can be applied via compositing.
+        When RenderLayer::scrollToOffset() updates compositing layer positions, it needs
+        to start updating at its stacking context rather than just its compositing ancestor.
+        The stacking context is guaranteed to contain all descendants of the overflow
+        layer, including those that are not direct descendants of the overflow layer in stacking
+        (and therefore compositing) order.
 
-        Tests: compositing/masks/masked-ancestor.html
-               compositing/masks/simple-composited-mask.html
+        Test: compositing/overflow/scroll-ancestor-update.html
 
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::GraphicsLayer):
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::maskLayer):
-        (WebCore::GraphicsLayer::setMaskLayer):
-        (WebCore::GraphicsLayer::paintingPhase):
-        (WebCore::GraphicsLayer::setPaintingPhase):
-        * platform/graphics/GraphicsLayerClient.h:
-        (WebCore::):
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        (WebCore::GraphicsLayerCA::):
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setMaskLayer):
-        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
-        (WebCore::GraphicsLayerCA::commitLayerChanges):
-        (WebCore::GraphicsLayerCA::updateMaskLayer):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::paintMask):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintMaskImages):
         * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::hasCompositedMask):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::hasCompositedMask):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::~RenderLayerBacking):
-        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::updateForegroundLayer):
-        (WebCore::RenderLayerBacking::updateMaskLayer):
-        (WebCore::RenderLayerBacking::paintingPhaseForPrimaryLayer):
-        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
-        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
-        (WebCore::RenderLayerBacking::paintIntoLayer):
-        (WebCore::RenderLayerBacking::paintContents):
-        * rendering/RenderLayerBacking.h:
-        (WebCore::RenderLayerBacking::hasMaskLayer):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
-        (WebCore::RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing):
-        * rendering/RenderLayerCompositor.h:
-
-2009-08-17  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Layer content misplaced with compositing, z-index and overflow
-        https://bugs.webkit.org/show_bug.cgi?id=28361
-        
-        The foreground GraphicsLayer (used to render element foreground when the element has 
-        negative z-order children) was misplaced when there is a clipping layer (which clips
-        children). The foreground layer is parented under the clipping layer so that the foreground
-        depth-sorts with the layer's children, so its geometry needs to be computed relative to
-        that clipping layer.
-        
-        Also clarified some FIXME comments, and corrected a debug-only layer name.
-
-        Test: compositing/geometry/clipping-foreground.html
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::updateSublayerList):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::updateForegroundLayer):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-
-2009-08-17  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Fix leaks of SVGElementInstance seen during regression tests.
-
-        r47313 made TreeShared types start with a ref-count of 1, but SVGElementInstance was mistakenly
-        not updated to have a create method that adopted the initial reference.  This lead to the instances
-        of SVGElementInstance allocated by SVGUseElement being leaked.
-
-        * svg/SVGElementInstance.h:
-        (WebCore::SVGElementInstance::create):
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::buildPendingResource):
-        (WebCore::SVGUseElement::buildInstanceTree):
-        (WebCore::SVGUseElement::handleDeepUseReferencing):
-
-2009-08-17  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Some cleanup towards https://bugs.webkit.org/show_bug.cgi?id=13631
-        Page Cache should support pages with frames.
-
-        - Re-factor all remaining page cache code out of DocumentLoader, as CachedPage/CacheFrame loads
-          are solely the responsibility of FrameLoader.
-        - Enhance some page cache related Logging to help development.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::identifierForInitialRequest):
-
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::DocumentLoader):
-        * loader/DocumentLoader.h:
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::commitProvisionalLoad):
-        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
-        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::isLoadingFromCachedPage):
-
-2009-08-17  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Moved implementation of isAfterContent to RenderObject
-        (as inline method to avoid potential performance regressions).
-
-        BUG 28376 -  [Cleanup] isAfterContent() implemented twice, should be member of RenderObject
-        (https://bugs.webkit.org/show_bug.cgi?id=28376)
-
-        * rendering/RenderBox.cpp:
-        * rendering/RenderBox.h:
-        * rendering/RenderInline.cpp:
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isAfterContent):
-
-2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Assertion failure in WebCore::RenderHTMLCanvas::layout
-        https://bugs.webkit.org/show_bug.cgi?id=12052
-
-        Don't handle run-in if the element is not a block element.
-
-        Test: fast/runin/nonblock-runin.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::handleRunInChild):
-
-2009-08-17  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
-
-        Reviewed by Darin Adler.
+        (WebCore::RenderLayer::scrollToOffset):
 
-        Fix createImageData to raise the NOT_SUPPORTED_ERR exception when
-        either of the arguments are not finite.
+2010-02-16  Dan Bernstein  <mitz@apple.com>
 
-        According to
-        http://www.whatwg.org/specs/web-apps/current-work/#pixel-manipulation:
-        "If any of the arguments to createImageData() or getImageData() are
-        infinite or NaN, or if the createImageData()  method is invoked with
-        only one argument but that argument is null, the method must instead
-        raise a NOT_SUPPORTED_ERR  exception."
+        Reviewed by Simon Fraser.
 
-        Test: http://philip.html5.org/tests/canvas/suite/tests/2d.imageData.create.nonfinite.html
+        Allow FloatRect::center() to return fractional coordinates. It was
+        mistakenly converting to integers.
 
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::createImageData):
-        * html/canvas/CanvasRenderingContext2D.h:
-        * html/canvas/CanvasRenderingContext2D.idl:
+        * platform/graphics/FloatRect.h:
+        (WebCore::FloatRect::center):
 
-2009-08-17  Jeremy Orlow  <jorlow@chromium.org>
+2010-02-16  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Oliver Hunt.
 
-        Add a way to release the storage lock
-        https://bugs.webkit.org/show_bug.cgi?id=28411
+        https://bugs.webkit.org/show_bug.cgi?id=34964
+        Leaks tool reports false memory leaks due to Rope implementation.
 
-        Two scripts within the same origin that are accessing LocalStorage must not do
-        it simultaneously, according to the spec.  There are some cases, however, where
-        a script might want to override this behavior.  navigator.getStorageUpdates()
-        was added for this reason:
-        http://dev.w3.org/html5/spec/Overview.html#manually-releasing-the-storage-mutex
+        Renamed cUStringImpl::size() to UStringImpl::size()UStringImpl::length()
+        (matches WebCore::StringImpl).
 
-        Add this function to navigator and hook it up to DOM Storage.
+        * bridge/jni/jsc/JavaStringJSC.h:
+        (JSC::Bindings::JavaStringImpl::length):
+        * platform/text/AtomicString.cpp:
+        (WebCore::AtomicString::add):
+        (WebCore::AtomicString::find):
 
-        * page/Navigator.cpp:
-        (WebCore::Navigator::getStorageUpdates):
-        * page/Navigator.h:
-        * page/Navigator.idl:
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::unlock):
-        * storage/StorageNamespaceImpl.h:
+2010-02-15  Jon Honeycutt  <jhoneycutt@apple.com>
 
-2009-08-17  Mark Rowe  <mrowe@apple.com>
+        <rdar://problem/7288853> Message about missing plugin does not specify
+        the type or download link for download
 
-        Build fix.
+        Reviewed by Mark Rowe.
 
-        CFNetwork isn't present in the framework search path on Mac OS X so we can't directly include its headers.
-        We include CoreServices.h, the umbrella framework that contains CFNetwork, from the prefix header which
-        results in the CFNetwork headers being included on Mac OS X.  CoreServices.h doesn't include CFNetwork.h on
-        Windows though so we explicitly include this header from the prefix header when on Windows.
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::findPlugin):
+        Only update the mimeType out param if we find a plug-in for the file
+        extension.
 
-        * WebCorePrefix.h:
-        * platform/network/cf/DNSCFNet.cpp: Remove #include that is no longer needed.
+2010-02-16  Simon Fraser  <simon.fraser@apple.com>
 
-2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+        Build fix for Tiger.
 
-        Trying a better build fix (the previous one broke Leopard bots, although it did build for me).
+        Add #if USE(ACCELERATED_COMPOSITING) around the call to mediaPlayerRenderingModeChanged().
+        
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
 
-        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFNetwork.h instead.
+2010-02-16  Csaba Osztrogonác  <ossy@webkit.org>
 
-2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+        Reviewed by Eric Carlson.
 
-        Trying to fix Windows build.
+        Buildfix for r54826.
 
-        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFHost.h.
+        HTMLMediaElement class defined by HTMLMediaElement.h in #if ENABLE(VIDEO) block,
+        it should be in #if ENABLE(VIDEO) block in rendering/RenderLayerBacking.cpp too.
 
-2009-08-17  Peter Kasting  <pkasting@google.com>
+        * rendering/RenderLayerBacking.cpp: Missing #if ENABLE(VIDEO) guard added.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
 
-        Reviewed by Steve Falkenburg.
+2010-02-16  Julie Parent  <jparent@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27323
-        Only add Cygwin to the path when it isn't already there.  This avoids
-        causing problems for people who purposefully have non-Cygwin versions of
-        executables like svn in front of the Cygwin ones in their paths.
+        Unreviewed: Chromium build fix.
 
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/WebCoreGenerated.vcproj:
+        http://trac.webkit.org/changeset/54823 introduced an unused variable.  Remove it.
 
-2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::create):
 
-        Reviewed by Geoff Garen.
+2010-02-16  Mark Rowe  <mrowe@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28401
-        Add support for DNS prefetching with CFNetwork
+        Reviewed by Alexey Proskuryakov.
 
-        This is just an optimization, no behavior change, so no tests.
+        Bug 34974: Leak of ScheduledAction during layout tests
+        <https://bugs.webkit.org/show_bug.cgi?id=34974>
 
-        * platform/network/cf/DNSCFNet.cpp:
-        (WebCore::clientCallback):
-        (WebCore::prefetchDNS):
-        Use async CFHostStartInfoResolution() for implementation.
+        ScheduledAction::create was returning a raw pointer which was threaded down through to an OwnPtr in DOMTimer.
+        If any of the code paths in between hit an error case and returned early the raw pointer would be leaked.  We
+        can avoid this by passing it as a PassOwnPtr.  This will ensure that the ScheduledAction is cleaned up should
+        an error case be hit.
 
-2009-08-17  Aaron Boodman  <aa@chromium.org>
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setTimeout): Store the newly-created ScheduledAction in an OwnPtr and then hand it off
+        as the function argument.
+        (WebCore::JSDOMWindow::setInterval): Ditto.
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::setTimeout): Ditto.
+        (WebCore::JSWorkerContext::setInterval): Ditto.
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create): Return a PassOwnPtr.
+        * bindings/js/ScheduledAction.h:
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::DOMTimer): Update argument type.
+        (WebCore::DOMTimer::install): Ditto.
+        * page/DOMTimer.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setTimeout): Ditto.
+        (WebCore::DOMWindow::setInterval): Ditto.
+        * page/DOMWindow.h:
 
-        Reviewed by Alexey Proskuryakov.
+2010-02-16  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28313: Combine ThreadableLoaderOptions::crossOriginRequestPolicy and
-        ThreadableLoaderOptions::crossOriginRedirectPolicy since they are always set the same way.
+        Reviewed by David Hyatt.
 
-        Also, tightened up behavior of XMLHttpRequest with cross-origin redirects and access control. We have not implemented
-        redirects access control, so we should never redirect across origins. But in two edge cases, we were:
+        SVG units don't stay consistently sized on zoom
+        https://bugs.webkit.org/show_bug.cgi?id=14004
+
+        Large step towards making WebKit an usable SVG viewer.
+
+        Make zooming into SVG documents work as expected, in both standalone and XHTML/SVG compound documents.
+        SVG applies a global scale to the document, whereas CSS zooms all individual length units (on full-page-zoom).
+        Scaling has to be avoided for all SVG specific CSS properties (already works) and for some selected CSS
+        properties shared between CSS & SVG that explicitely need a different treatment in the context of SVG.
+        To name a few: font-size, letter-spacing, etc. should stay invariant under zoom in SVG document fragments.
+
+        Some new rules regarding zooming:
+        - "Zoom text only" should never affect SVG documents, neither text nor content should zoom.
+          This option doesn't make much sense for SVG, so it's wise to avoid side-effects and disable it.
+          In compound documents the SVG would stay as-is and only text of surrounding XHTML content would zoom.
+
+        - "Full page zoom" is the only zoom mode affecting SVG. (Panning only works in standalone documents.)
+
+        Cover all mentioned cases above by a new set of layout tests.
+
+        Tests: svg/zoom/page/absolute-sized-document-no-scrollbars.svg
+               svg/zoom/page/absolute-sized-document-scrollbars.svg
+               svg/zoom/page/relative-sized-document-scrollbars.svg
+               svg/zoom/page/zoom-coords-viewattr-01-b.svg
+               svg/zoom/page/zoom-foreignObject.svg
+               svg/zoom/page/zoom-hixie-mixed-008.xml
+               svg/zoom/page/zoom-hixie-mixed-009.xml
+               svg/zoom/page/zoom-hixie-rendering-model-004.xhtml
+               svg/zoom/page/zoom-svg-float-border-padding.xml
+               svg/zoom/text/absolute-sized-document-no-scrollbars.svg
+               svg/zoom/text/absolute-sized-document-scrollbars.svg
+               svg/zoom/text/relative-sized-document-scrollbars.svg
+               svg/zoom/text/zoom-coords-viewattr-01-b.svg
+               svg/zoom/text/zoom-foreignObject.svg
+               svg/zoom/text/zoom-hixie-mixed-008.xml
+               svg/zoom/text/zoom-hixie-mixed-009.xml
+               svg/zoom/text/zoom-hixie-rendering-model-004.xhtml
+               svg/zoom/text/zoom-svg-float-border-padding.xml
+
+        * css/CSSStyleSelector.cpp: Blacklist certain properties not to be zoomed for SVG elements.
+        (WebCore::CSSStyleSelector::styleForDocument): Don't zoom font-sizes.
+        (WebCore::CSSStyleSelector::applyProperty): Ditto (+ letter/word-spacing).
+        (WebCore::CSSStyleSelector::setFontSize): Ditto.
+        (WebCore::CSSStyleSelector::getComputedSizeFromSpecifiedSize): Never apply text zoom to SVG.
+        * css/CSSStyleSelector.h:
+        * css/SVGCSSStyleSelector.cpp: -webkit-shadow + SVG was incorrectly respecting zoom factor.
+        (WebCore::CSSStyleSelector::applySVGProperty):
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldApplyTextZoom): Remove SVG special cases.
+        (WebCore::Frame::shouldApplyPageZoom): Ditto.
+        (WebCore::Frame::setZoomFactor): Don't force setZoomsTextOnly() - SVG now uses FPZ as well.
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::calcReplacedWidth): CSSPropertyWidth is explicitely not scaled by CSSStyleSelector, fix that for outermost <svg> elements.
+        (WebCore::RenderSVGRoot::calcReplacedHeight): Ditto for CSSPropertyHeight.
+        (WebCore::RenderSVGRoot::layout): Simplify & cleanup code, take advantage of new calcWidth/Height functionality, no need to scale anything here.
+        (WebCore::RenderSVGRoot::paint): Use parentOriginToBorderBox() instead of duplicating code.
+        (WebCore::RenderSVGRoot::calcViewport): Simplify code.
+        (WebCore::RenderSVGRoot::localToBorderBoxTransform): Calculate viewBoxToViewTransformation() against unscaled width()/height() values.
+        * rendering/RenderSVGRoot.h:
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport): Cleanup & document function.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::currentScale): Return pageZoomFactor(), not just the zoomFactor() - as we want to ignore text-only zoom.
+        (WebCore::SVGSVGElement::setCurrentScale): Pass isTextOnly=false to setZoomFactor().
 
-        * Asynchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
-          authorization headers) to a resource on origin A.
-        * Synchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
-          authorization headers) to another resource on origin B (this time sending access control authorization headers).
+2010-02-16  Julie Parent  <jparent@chromium.org>
 
-        Test: http/tests/xmlhttprequest/access-control-and-redirects.html
+        Unreviewed: Chromium build fix.
 
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::willSendRequest): Refactor redirect checking code into shared location.
-        (WebCore::DocumentThreadableLoader::loadRequest): Ditto.
-        (WebCore::DocumentThreadableLoader::isAllowedRedirect): Ditto.
-        * loader/DocumentThreadableLoader.h:
-        * loader/ThreadableLoader.h:
-        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Remove ThreadableLoaderOptions::crossOriginRedirectPolicy.
-        * page/EventSource.cpp:
-        (WebCore::EventSource::connect): Ditto.
-        * workers/Worker.cpp: Ditto.
-        (WebCore::Worker::Worker): Ditto.
-        * workers/WorkerContext.cpp: Ditto.
-        (WebCore::WorkerContext::importScripts): Ditto.
-        * workers/WorkerScriptLoader.cpp:
-        (WebCore::WorkerScriptLoader::loadSynchronously): Ditto.
-        (WebCore::WorkerScriptLoader::loadAsynchronously): Ditto.
-        * workers/WorkerScriptLoader.h: 
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::createRequest): Ditto.
+        https://bugs.webkit.org/show_bug.cgi?id=34998
 
-2009-08-17  Adam Langley  <agl@google.com>
+        Move include of JavaScriptProfile.h behind if (USE_JSC).
 
-        Reviewed by Dan Bernstein (relanding of r47157).
+        * inspector/InspectorController.cpp:
 
-        Fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
+2010-02-16  Alexey Proskuryakov  <ap@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28172
+        Reviewed by Geoffrey Garen and Kevin Decker.
 
-        This was originally fixed in r47157, however it triggered a bug in
-        Skia which caused Chromium Linux to fail layout tests in debug mode.
-        It was reverted in r47189 while we sorted it out.
+        https://bugs.webkit.org/show_bug.cgi?id=34989
+        <rdar://problem/7417965> Cursor disappears on scroll bars that are over plugin content
 
-        The Skia bug was fixed in Skia's r321 [1] and rolled into Chromium in
-        Chromium's r23523. This is a reland of the original patch.
+        * html/HTMLPlugInElement.cpp: (WebCore::HTMLPlugInElement::defaultEventHandler): Added some
+        comments about the way we pass events down to plug-ins.
 
-        No new tests because it's a just typo fix.
+2010-02-16  Simon Fraser  <simon.fraser@apple.com>
 
-        [1] http://code.google.com/p/skia/source/detail?r=321
+        Reviewed by Eric Carlson.
 
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintCommon):
+        With hardware acceleration turned off, video frames never display if poster
+        image is specified
+        https://bugs.webkit.org/show_bug.cgi?id=34965
+        
+        HTMLVideoElement's m_shouldDisplayPosterImage was never updated after
+        the movie supplied its first video frame, so the poster would continue to show.
+        
+        Fixed by calling updatePosterImage() from mediaPlayerRepaint(), which is called
+        each time a new frame is available. updatePosterImage() is cheap.
+        
+        Also made updatePosterImage() virtual on HTMLMediaElement to avoid a number of
+        ugly casts.
 
-2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        Test: manual-tests/media-elements/video-replaces-poster.html
 
-        Reviewed by Xan Lopez.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::noneSupported): Call updatePosterImage() without video check.
+        (WebCore::HTMLMediaElement::setNetworkState): Ditto.
+        (WebCore::HTMLMediaElement::setReadyState): Ditto.
+        (WebCore::HTMLMediaElement::mediaPlayerRepaint): Call udpatePosterImage().
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::updatePosterImage): Make this an empty virtual
+        method on the base class.
+        * html/HTMLVideoElement.h: Override updatePosterImage().
 
-        Protect ResourceHandle for g_file_query_info_async call, using the
-        same technique we already use for HTTP requests that take the soup
-        path.
+2010-02-16  Simon Fraser  <simon.fraser@apple.com>
 
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
-        (WebCore::ResourceHandle::~ResourceHandle):
-        (WebCore::finishedCallback):
-        (WebCore::):
+        Build fix for platforms without ACCELERATED_COMPOSITING defined.
 
-2009-08-17  Dan Bernstein  <mitz@apple.com>
+        mediaPlayerRenderingModeChanged() is only available when ACCELERATED_COMPOSITING is defined.
+        
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
 
-        Reviewed by Darin Adler.
+2010-02-16  Simon Fraser  <simon.fraser@apple.com>
 
-        REGRESSION (r47255): MediaWiki's (including Wikipedia) navigation pane
-        appears below the main content
-        https://bugs.webkit.org/show_bug.cgi?id=28350
+        Reviewed by Eric Carlson.
 
-        A particular version of the MediaWiki software detects WebKit through
-        user agent sniffing and imports a style sheet called KHTMLFixes.css,
-        which contains a single rule that was meant to work around some KHTML
-        bug, but currently has the sole effect of causing the float containing
-        the main article content to extend all the way to the left and thus push
-        down the left navigation pane.
+        Autoplaying video with poster doesn't reliably show up
+        https://bugs.webkit.org/show_bug.cgi?id=34966
+        
+        A timing issue with compositing updates when replacing the poster image
+        with the video could cause the video to not display.
+        
+        Fix by making video layer hook up more similar to WebGL etc, by having the
+        video kick off a recalcStyle() via a SyntheticStyleChange. This requires
+        vending a PlaformLayer* from the media player, up through the element.
 
-        * css/CSSImportRule.cpp:
-        (WebCore::CSSImportRule::setCSSStyleSheet): If site specific hacks are
-        enabled, check if the imported style sheet is the MediaWiki
-        KHTMLFixes.css. If so, remove the offending rule.
+        Test: media/video-replaces-poster.html
 
-2009-08-17  Brent Fulgham  <bfulgham@webkit.org>
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerRenderingModeChanged): Use setNeedsStyleRecalc()
+        to kick off a compositing update.
 
-        Reviewed by Kevin Ollivier.
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::platformLayer): Export the media engine's layer.
 
-        Correct crash when processing local cancelled requests.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::platformLayer): Method to vend the media layer.
+        (WebCore::MediaPlayer::platformLayer):
 
-        No new tests. Existing fast/images/favicon-as-image.html
-        displays the problem.
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerRenderingModeChanged): New client callback
+        to indicate that the rendering mode changed. The element uses this to kick off a
+        recalcStyle.
 
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::writeCallback): Add check for m_cancelled after
-          performing local-file processing.
-        (WebCore::ResourceHandleManager::downloadTimerCallback): Add
-          check for m_cancelled after performing local-file processing.
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::platformLayer): Method to vend the media layer.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h: Ditto
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieLayer): No longer parent the layer directly
+        via setContentsToMedia().
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged): Ditto.
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering): Tell the client that the
+        rendering mode changed.
+        (WebCore::MediaPlayerPrivate::platformLayer): Method to vend the media layer.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): Call setContentsToMedia()
+        here.
 
-2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h: Add platformLayer().
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::platformLayer): Method to vend the media layer.
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering): Call mediaPlayerRenderingModeChanged()
+        (WebCore::MediaPlayerPrivate::createLayerForMovie): Don't parent the layer ourselves any more.
 
-        Unreviewed. Reverts 47371, since it breaks GTK+.
+        * rendering/RenderVideo.h: videoGraphicsLayer() is no longer needed.
+        * rendering/RenderVideo.cpp: Ditto.
 
-        * platform/graphics/ImageSource.cpp:
-        (WebCore::ImageSource::setData):
-        * platform/image-decoders/ImageDecoder.cpp: Removed.
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::ImageDecoder::ImageDecoder):
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::convertCMYKToRGBA):
-        (WebCore::convertRGBToRGBA):
-        (WebCore::JPEGImageDecoder::outputScanlines):
-        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
-        * platform/image-decoders/png/PNGImageDecoder.cpp:
-        (WebCore::PNGImageDecoder::headerAvailable):
-        (WebCore::PNGImageDecoder::rowAvailable):
+2010-02-12  Peter Kasting  <pkasting@google.com>
 
-2009-08-17  Yong Li  <yong.li@torchmobile.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Adam Treat.
+        Code cleanup in ImageDecoders; no functional change.
+        https://bugs.webkit.org/show_bug.cgi?id=28751
 
-        Allow image decoders to down-sample the image directly
-        to scaled output buffer. This can be enabled/disabled by
-        macro ENABLE(IMAGE_DECODER_DOWN_SAMPLING).
-        Only JPEG and PNG decoders are modified to support it now.
-        https://bugs.webkit.org/show_bug.cgi?id=28308
+        * Make code mostly comply with the style guide (switch indenting, use of
+          "!" vs. "== 0", don't unnecessarily wrap lines, etc.)
+        * Eliminate m_allDataReceived in ICO/BMP decoders since it's in the
+          base ImageDecoder class
+        * Remove some useless or wrong comments, add others
+        * Wrap comments at 80 columns (most already were) for
+          consistency/readability
+        * Avoid casts by using correct variable types
+        * Consistent naming of decode() function/args
+        * Shorter code in some places
+        * Make declaration and definition order match
 
-        * platform/graphics/ImageSource.cpp:
-        (WebCore::ImageSource::setData):
-        * platform/image-decoders/ImageDecoder.cpp: Added.
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::forceLoadEverything):
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::create):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::setSize):
         * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::):
         (WebCore::ImageDecoder::ImageDecoder):
-        (WebCore::ImageDecoder::setMaxNumPixels):
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::BMPImageDecoder):
+        (WebCore::BMPImageDecoder::setData):
+        (WebCore::BMPImageDecoder::isSizeAvailable):
+        (WebCore::BMPImageDecoder::frameBufferAtIndex):
+        (WebCore::BMPImageDecoder::decode):
+        (WebCore::BMPImageDecoder::decodeHelper):
+        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/image-decoders/bmp/BMPImageDecoder.h:
+        (WebCore::BMPImageDecoder::readUint32):
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::BMPImageReader):
+        (WebCore::BMPImageReader::decodeBMP):
+        (WebCore::BMPImageReader::readInfoHeaderSize):
+        (WebCore::BMPImageReader::processInfoHeader):
+        (WebCore::BMPImageReader::readInfoHeader):
+        (WebCore::BMPImageReader::isInfoHeaderValid):
+        (WebCore::BMPImageReader::processBitmasks):
+        (WebCore::BMPImageReader::processColorTable):
+        (WebCore::BMPImageReader::processRLEData):
+        (WebCore::BMPImageReader::processNonRLEData):
+        * platform/image-decoders/bmp/BMPImageReader.h:
+        (WebCore::BMPImageReader::readUint32):
+        (WebCore::BMPImageReader::pastEndOfImage):
+        (WebCore::BMPImageReader::readCurrentPixel):
+        (WebCore::BMPImageReader::getComponent):
+        (WebCore::BMPImageReader::getAlpha):
+        (WebCore::BMPImageReader::setI):
+        (WebCore::BMPImageReader::setRGBA):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::GIFImageDecoder):
+        (WebCore::GIFImageDecoder::setData):
+        (WebCore::GIFImageDecoder::isSizeAvailable):
+        (WebCore::GIFImageDecoder::frameCount):
+        (WebCore::GIFImageDecoder::frameBufferAtIndex):
+        (WebCore::GIFImageDecoder::clearFrameBufferCache):
+        (WebCore::GIFImageDecoder::sizeNowAvailable):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::frameComplete):
+        (WebCore::GIFImageDecoder::decode):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        (WebCore::GIFImageDecoder::):
+        (WebCore::GIFImageDecoder::filenameExtension):
+        * platform/image-decoders/gif/GIFImageReader.cpp:
+        (GIFImageReader::do_lzw):
+        (GIFImageReader::read):
+        * platform/image-decoders/gif/GIFImageReader.h:
+        (GIFImageReader::~GIFImageReader):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::ICOImageDecoder):
+        (WebCore::ICOImageDecoder::~ICOImageDecoder):
+        (WebCore::ICOImageDecoder::setData):
+        (WebCore::ICOImageDecoder::isSizeAvailable):
+        (WebCore::ICOImageDecoder::frameSizeAtIndex):
+        (WebCore::ICOImageDecoder::frameCount):
+        (WebCore::ICOImageDecoder::frameBufferAtIndex):
+        (WebCore::ICOImageDecoder::compareEntries):
+        (WebCore::ICOImageDecoder::setDataForPNGDecoderAtIndex):
+        (WebCore::ICOImageDecoder::decode):
+        (WebCore::ICOImageDecoder::decodeDirectory):
+        (WebCore::ICOImageDecoder::decodeAtIndex):
+        (WebCore::ICOImageDecoder::processDirectoryEntries):
+        (WebCore::ICOImageDecoder::readDirectoryEntry):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        (WebCore::ICOImageDecoder::readUint16):
+        (WebCore::ICOImageDecoder::readUint32):
         * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::convertCMYKToRGBA):
-        (WebCore::convertRGBToRGBA):
-        (WebCore::JPEGImageDecoder::outputScanlines):
-        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::):
+        (WebCore::JPEGImageReader::JPEGImageReader):
+        (WebCore::JPEGImageReader::skipBytes):
+        (WebCore::JPEGImageReader::decode):
+        (WebCore::error_exit):
+        (WebCore::fill_input_buffer):
+        (WebCore::term_source):
+        (WebCore::JPEGImageDecoder::setData):
         (WebCore::JPEGImageDecoder::setSize):
+        (WebCore::JPEGImageDecoder::frameBufferAtIndex):
+        (WebCore::JPEGImageDecoder::jpegComplete):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::filenameExtension):
         * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::decodingFailed):
+        (WebCore::decodingWarning):
+        (WebCore::headerAvailable):
+        (WebCore::rowAvailable):
+        (WebCore::pngComplete):
+        (WebCore::PNGImageReader::PNGImageReader):
+        (WebCore::PNGImageReader::close):
+        (WebCore::PNGImageReader::decode):
+        (WebCore::PNGImageReader::createInterlaceBuffer):
+        (WebCore::PNGImageDecoder::setData):
+        (WebCore::PNGImageDecoder::frameBufferAtIndex):
         (WebCore::PNGImageDecoder::headerAvailable):
         (WebCore::PNGImageDecoder::rowAvailable):
+        (WebCore::PNGImageDecoder::pngComplete):
+        (WebCore::PNGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.h:
+        (WebCore::PNGImageDecoder::filenameExtension):
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::setDecodedImage):
 
-2009-08-17  Simon Fraser  <simon.fraser@apple.com>
-
-        Build fix: fix float literals to avoid casting warnings.
-
-        * rendering/MediaControlElements.cpp:
-
-2009-08-17  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Use OwnPtrs for GraphicsLayers
-        https://bugs.webkit.org/show_bug.cgi?id=28399
-
-        Convert RenderLayerBacking and RenderLayerCompositor to use OwnPtrs
-        for their references to GraphicsLayers.
-
-        * platform/graphics/GraphicsLayer.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayer::create):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::RenderLayerBacking):
-        (WebCore::RenderLayerBacking::createGraphicsLayer):
-        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::updateInternalHierarchy):
-        (WebCore::RenderLayerBacking::updateClippingLayers):
-        (WebCore::RenderLayerBacking::updateForegroundLayer):
-        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
-        * rendering/RenderLayerBacking.h:
-        (WebCore::RenderLayerBacking::graphicsLayer):
-        (WebCore::RenderLayerBacking::clippingLayer):
-        (WebCore::RenderLayerBacking::ancestorClippingLayer):
-        (WebCore::RenderLayerBacking::foregroundLayer):
-        (WebCore::RenderLayerBacking::parentForSublayers):
-        (WebCore::RenderLayerBacking::childForSuperlayers):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::~RenderLayerCompositor):
-        (WebCore::RenderLayerCompositor::rootPlatformLayer):
-        (WebCore::RenderLayerCompositor::didMoveOnscreen):
-        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
-        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
-        * rendering/RenderLayerCompositor.h:
-
-2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Reset InjectedScript styles cache on document change.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28390
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::resetInjectedScript):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::setDocument):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._reset):
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        * rendering/MediaControlElements.cpp: Removed unneeded include of CString.h,
-        resorted includes, renamed "doc" to "document" and fixed formatting.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Removed functions now unneeded due to use of Reflect to create
-        language bindings.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
-        Get at usemap attribute directly.
-
-        * editing/DeleteButtonController.cpp:
-        (WebCore::DeleteButtonController::createDeletionUI):
-        Get at id attribute directly.
-        * editing/EditorCommand.cpp:
-        (WebCore::executeInsertHorizontalRule): Ditto.
-
-        * html/HTMLDocument.cpp:
-        (WebCore::HTMLDocument::dir): Get at dir attribute of body directly.
-        (WebCore::HTMLDocument::setDir): Ditto.
-
-        * html/HTMLElement.cpp: Deleted unused functions.
-        * html/HTMLElement.h: Ditto.
-
-        * html/HTMLImageElement.cpp: Deleted unused functions.
-        (WebCore::HTMLImageElement::alt): Changed to return const AtomicString&.
-        (WebCore::HTMLImageElement::addSubresourceAttributeURLs): Changed to
-        get at usemap attribute directly, but added a FIXME because although
-        it is what the old code did, it looks to not be entirely correct.
-
-        * html/HTMLImageElement.h: Deleted unused functions.
-
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::altDisplayString): Get at alt attribute directly.
-
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::imageMap): Get at usemap attribute directly.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::createGraphicsLayer): Get at id attribute
-        directly.
-        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): Removed
-        explicit HTMLNames namespace qualification.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        * dom/Document.cpp:
-        (WebCore::Document::setFocusedNode): Removed unneeded calls
-        to RefPtr::get.
-
-2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Discard DOM Node bindings on any document change.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28389
-
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::setDocument):
-
-2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Improve Cookie DataGrid to Show Hidden Data
-        https://bugs.webkit.org/show_bug.cgi?id=28269
-
-        * English.lproj/localizedStrings.js: DataGrid Headers "Name", "Value", "Size", ...
-        * WebCore.gypi: added missing files
-
-          Implemented Bindings for InspectorController.deleteCookie(name)
-
-        * inspector/InspectorBackend.idl:
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::cookies):
-        (WebCore::JSInspectorBackend::deleteCookie):
-
-          v8 Bindings Stubs
-
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-          Removed WebInspector.Cookie
-
-        * inspector/front-end/Cookie.js: Removed.
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/WebKit.qrc:
-
-          Improved DataGrid and Kept Fallback Behavior for Platforms that don't
-          yet provide access to raw cookies.
-
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView):
-        (WebInspector.CookieItemsView.prototype.get statusBarItems):
-        (WebInspector.CookieItemsView.prototype.update):
-        (WebInspector.CookieItemsView.prototype.buildCookies):
-        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
-        (WebInspector.CookieItemsView.prototype.fallbackUpdate.callback):
-        (WebInspector.CookieItemsView.prototype.fallbackUpdate):
-        (WebInspector.CookieItemsView.prototype.fallbackBuildCookiesFromString):
-        (WebInspector.CookieItemsView.prototype.fallbackDataGridForCookies):
-        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
-
-          Interaction with the page through Injected Script (for fallback behavior)
-
-        * inspector/front-end/DOMAgent.js:
-        (InspectorController.getCookies):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.setStyleProperty): style fix
-        (InjectedScript.getCookies):
-
-          Allow alignment of text inside DataGrids.
-
-        * inspector/front-end/DataGrid.js:
-        (WebInspector.DataGrid):
-        (WebInspector.DataGridNode.prototype.createCell):
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
-        * inspector/front-end/inspector.css:
-
-          Added deleteCookie(., ., String name)
-          Modified getRawCookies to return a bool to know if its implemented
-
-        * platform/CookieJar.h:
-
-
-          Implemented deleteCookie for Macs
-
-        * platform/mac/CookieJar.mm:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-
-          Stub Implementations for Other Platforms
-
-        * platform/haiku/CookieJarHaiku.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/network/chromium/CookieJarChromium.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/network/curl/CookieJarCurl.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/network/soup/CookieJarSoup.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/network/win/CookieJarWin.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/qt/CookieJarQt.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-
-2009-08-17  Adam Treat  <adam.treat@torchmobile.com>
-
-        Blind build fix for Leopard.
-
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::adjustLineToPixelBoundaries):
-
-2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Style fixes based on cpp_style.py and WebKit Style guide for
-        GraphicsContextCG.cpp
-
-        https://bugs.webkit.org/show_bug.cgi?id=28268
-
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::GraphicsContext::drawEllipse):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::drawConvexPolygon):
-        (WebCore::GraphicsContext::applyStrokePattern):
-        (WebCore::GraphicsContext::drawPath):
-        (WebCore::GraphicsContext::clipOut):
-        (WebCore::GraphicsContext::clipOutEllipseInRect):
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::clipToImageBuffer):
-        (WebCore::GraphicsContext::setPlatformShadow):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::GraphicsContext::roundToDevicePixels):
-        (WebCore::GraphicsContext::drawLineForText):
-        (WebCore::GraphicsContext::setURLForRect):
-        (WebCore::GraphicsContext::setImageInterpolationQuality):
-        (WebCore::GraphicsContext::imageInterpolationQuality):
-        (WebCore::GraphicsContext::setPlatformTextDrawingMode):
-        (WebCore::GraphicsContext::setCompositeOperation):
-
-2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Style fixes based on cpp_style.py and WebKit Style guide for
-        GraphicsContext.cpp/h, GraphicsContextCairo.cpp and GraphicsContextQt.cpp.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28268
-
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::save):
-        (WebCore::GraphicsContext::restore):
-        (GraphicsContext::drawText):
-        (GraphicsContext::initFocusRing):
-        (GraphicsContext::focusRingBoundingRect):
-        (GraphicsContext::drawImage):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::toCairoOperator):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Change HTMLAreaElement to use OwnArrayPtr
-        https://bugs.webkit.org/show_bug.cgi?id=28386
-
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::HTMLAreaElement): Removed unneeded initializer.
-        (WebCore::HTMLAreaElement::~HTMLAreaElement): Removed unneeded delete call.
-        (WebCore::HTMLAreaElement::parseMappedAttribute): Use the set function
-        instead of deletion followed by assignment.
-        * html/HTMLAreaElement.h: Use OwnArrayPtr.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Fix Windows build.
-
-        * dom/make_names.pl: Add back cast to (void*) needed on Windows.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Move noResize from HTMLFrameElementBase to HTMLFrameElement
-        https://bugs.webkit.org/show_bug.cgi?id=28384
-
-        * html/HTMLFrameElement.cpp:
-        (WebCore::HTMLFrameElement::HTMLFrameElement): Initialize m_noResize.
-        (WebCore::HTMLFrameElement::parseMappedAttribute): Set m_noResize to true
-        here if noresizeAttr is changed. This code was moved here from
-        HTMLFrameElementBase, but I added some FIXME comments.
-        (WebCore::HTMLFrameElement::setNoResize): Set the attribute based on
-        boolean argument. Moved here from HTMLFrameElementBase.
-
-        * html/HTMLFrameElement.h: Moved noResize, setNoResize, and m_noResize
-        here from HTMLFrameElementBase.
-
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase): Removed m_noResize.
-        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Removed code to parse
-        noresizeAttr.
-
-        * html/HTMLFrameElementBase.h: Removed noResize, setNoResize, and m_noResize.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Tweak HTMLFrameElementBase so that m_URL can be private
-        https://bugs.webkit.org/show_bug.cgi?id=28385
-
-        * html/HTMLFrameElement.cpp:
-        (WebCore::HTMLFrameElement::rendererIsNeeded): Removed m_URL argument.
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::isURLAllowed): Use m_URL instead of
-        taking an argument.
-        (WebCore::HTMLFrameElementBase::openURL): Removed m_URL argument.
-        * html/HTMLFrameElementBase.h: Removed argument from isURLAllowed function.
-        * html/HTMLIFrameElement.cpp:
-        (WebCore::HTMLIFrameElement::rendererIsNeeded): Removed m_URL argument.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        HTMLViewSourceDocument should use smart pointers
-        https://bugs.webkit.org/show_bug.cgi?id=28378
-
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::HTMLViewSourceDocument): Don't initialize
-        pointers any more since RefPtr starts 0 by default.
-        (WebCore::HTMLViewSourceDocument::createContainingTable): Use more specific
-        types for local variables.
-        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Return a PassRefPtr,
-        and use a RefPtr of a more specific type for a local variable.
-        (WebCore::HTMLViewSourceDocument::addLine): Use more specific types for local
-        variables, and use RefPtr as well.
-        (WebCore::HTMLViewSourceDocument::addLink): Return a PassRefPtr, and use a
-        RefPtr of a more specific type for a local variable.
-
-        * html/HTMLViewSourceDocument.h: Change return types to PassRefPtr and
-        data member types to RefPtr.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        DOM attribute getter/setter functions should use const AtomicString& type
-        https://bugs.webkit.org/show_bug.cgi?id=25425
-
-        Convert 4 more classes. These are classes I am going to make other changes
-        to soon, so it's good to have this use of Reflect in the IDL out of the way.
-
-        * html/HTMLEmbedElement.idl: Use Reflect for many attributes.
-        * html/HTMLFrameElement.idl: Ditto.
-        * html/HTMLIFrameElement.idl: Ditto.
-        * html/HTMLObjectElement.idl: Ditto.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Script to create element factory needs changes to accommodate calling create
-        https://bugs.webkit.org/show_bug.cgi?id=28379
-
-        * dom/make_names.pl: Tweak formatting. Remove lots of unneeded quotes
-        around names used inside {}. Added new createWithNew property for tags
-        that makes the factory use a create function instead of calling new.
-        Renamed functions with initialize in their name to have default in their
-        name, since they return an array full of default values and don't themselves
-        initialize anything.
-
-2009-08-16  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        StyledElement should use ASCIICType instead of having its own toHex function
-        https://bugs.webkit.org/show_bug.cgi?id=28377
-
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::addCSSColor): Use isASCIIHexDigit and toASCIIHexValue.
-
-2009-08-16  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        execCommand("InsertHorizontalRule") inserts a broken <hr> element
-        https://bugs.webkit.org/show_bug.cgi?id=28375
-
-        * editing/EditorCommand.cpp:
-        (WebCore::executeInsertHorizontalRule): Create an HTMLHRElement
-        instead of just an HTMLElement.
-
-2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] <option> element & 'onpick' events - history navigation is broken
-        https://bugs.webkit.org/show_bug.cgi?id=28371
-
-        After selecting an option element with an 'onpick' event associated with a 'go' task,
-        the navigation is executed. When going back in history, the same 'onpick' event is fired
-        again. Fix that problem, add wml/option-element-onpick-recursion.html covering the bug.
-
-        Test: wml/option-element-onpick-recursion.html
-
-        * wml/WMLOptionElement.cpp:
-        (WebCore::WMLOptionElement::handleIntrinsicEventIfNeeded):
-        * wml/WMLSelectElement.cpp:
-        (WebCore::WMLSelectElement::WMLSelectElement):
-        (WebCore::WMLSelectElement::selectInitialOptions):
-        * wml/WMLSelectElement.h:
-        (WebCore::WMLSelectElement::initialized):
-
-2009-08-16  Anthony Ricaud  <rik@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector Resource filtering: keyboard Navigation always uses ALL resources
-        https://bugs.webkit.org/show_bug.cgi?id=28231
-        
-        Determine if a resource is selectable on user action.
-        
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable):
+2010-02-16  Csaba Osztrogonác  <ossy@webkit.org>
 
-2009-08-16  David Kilzer  <ddkilzer@apple.com>
+        [Qt] Unreviewed buildfix.
 
-        <http://webkit.org/b/28355> Replace MAX()/MIN() macros with type-safe std::max()/min() templates
+        * WebCore.pro: Missing backslash added.
 
-        Reviewed by Dan Bernstein.
+2010-02-16  Mikhail Naganov  <mnaganov@chromium.org>
 
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (AXAttributeStringSetSpelling): Changed MIN() to min().
-        * platform/graphics/mac/FontMacATSUI.mm:
-        (WebCore::Font::selectionRectForComplexText): Changed MAX() to
-        max() and MIN() to min().
-        (WebCore::Font::floatWidthForComplexText): Ditto.
-        * platform/graphics/mac/SimpleFontDataMac.mm: Added using
-        std::max statement.
-        (WebCore::SimpleFontData::platformInit): Changed MAX() to max().
-        * platform/text/mac/TextCodecMac.cpp:
-        (WebCore::TextCodecMac::decode): Changed MIN() to min().
+        Reviewed by Pavel Feldman.
 
-2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        Move JSC-specific wrappers for Profile and ProfileNode to bindings/js.
 
-        Reviewed by George Staikos.
+        https://bugs.webkit.org/show_bug.cgi?id=34848
 
-        [WML] Cleanup WMLIntrinsicEventHandling code
-        https://bugs.webkit.org/show_bug.cgi?id=28358
-
-        Remove superflous "Event* evt" parameter from executeTask() methods. It's a leftover from the initial WML merge.
-
-        * wml/WMLAnchorElement.cpp:
-        (WebCore::WMLAnchorElement::defaultEventHandler):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::defaultEventHandler):
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::executeTask):
-        * wml/WMLGoElement.h:
-        * wml/WMLIntrinsicEventHandler.cpp:
-        (WebCore::WMLIntrinsicEventHandler::triggerIntrinsicEvent):
-        * wml/WMLPrevElement.cpp:
-        (WebCore::WMLPrevElement::executeTask):
-        * wml/WMLPrevElement.h:
-        * wml/WMLRefreshElement.cpp:
-        (WebCore::WMLRefreshElement::executeTask):
-        * wml/WMLRefreshElement.h:
-        * wml/WMLTaskElement.h:
-
-2009-08-16  Pavel Feldman  <pfeldman@chromium.org>
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JavaScriptProfile.cpp: Added.
+        (WebCore::profileCache):
+        (WebCore::getTitleCallback):
+        (WebCore::getHeadCallback):
+        (WebCore::getUniqueIdCallback):
+        (WebCore::focus):
+        (WebCore::exclude):
+        (WebCore::restoreAll):
+        (WebCore::finalize):
+        (WebCore::ProfileClass):
+        (WebCore::toJS):
+        * bindings/js/JavaScriptProfile.h: Added.
+        * bindings/js/JavaScriptProfileNode.cpp: Added.
+        (WebCore::profileNodeCache):
+        (WebCore::getFunctionName):
+        (WebCore::getURL):
+        (WebCore::getLineNumber):
+        (WebCore::getTotalTime):
+        (WebCore::getSelfTime):
+        (WebCore::getNumberOfCalls):
+        (WebCore::getChildren):
+        (WebCore::getVisible):
+        (WebCore::getCallUID):
+        (WebCore::finalize):
+        (WebCore::ProfileNodeClass):
+        (WebCore::toJS):
+        * bindings/js/JavaScriptProfileNode.h: Added.
+        * inspector/JavaScriptProfile.cpp: Removed.
+        * inspector/JavaScriptProfile.h: Removed.
+        * inspector/JavaScriptProfileNode.cpp: Removed.
+        * inspector/JavaScriptProfileNode.h: Removed.
 
-        Reviewed by Timothy Hatcher.
+2010-02-16  Alexander Pavlov  <apavlov@chromium.org>
 
-        WebInspector: A handful of DOMAgent-related fixes and cleanups.
+        Reviewed by Pavel Feldman.
 
-        - renamed elementId to nodeId in operations on nodes.
-        - added load listeners to frame owners in InspectorDOMAgent.
-        - removed InspectorController::inspectedWindowScriptObjectCleared event.
-        - preserved isViaInspector flag for 'via inspector' marker to survive styles update.
-        - removed contentDocument-related logic from ElementsPanel since it is handled in
-            the InspectorDOMAgent.
-        - removed DOM listeners unregistration and corresponding events from InspectorController.
-        - made this.styles 'private' in ElementsPanel.
-        - added TODO for the handleCopy processing.
+        Web Inspector: Elements Panel: Limit the number of initially loaded element children
+        https://bugs.webkit.org/show_bug.cgi?id=34421
 
-        https://bugs.webkit.org/show_bug.cgi?id=28356
+        Test: inspector/elements-panel-limited-children.html
 
-        * WebCore.order:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getChildNodes):
-        (WebCore::InspectorBackend::setTextNodeValue):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::startListening):
-        (WebCore::InspectorDOMAgent::stopListening):
-        (WebCore::InspectorDOMAgent::handleEvent):
-        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
-        (WebCore::InspectorDOMAgent::getChildNodes):
-        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
-        (WebCore::InspectorDOMAgent::setTextNodeValue):
-        (WebCore::InspectorDOMAgent::buildObjectForNode):
-        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
-        (WebCore::InspectorDOMAgent::innerParentNode):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorFrontend.cpp:
-        * inspector/InspectorFrontend.h:
+        * English.lproj/localizedStrings.js:
         * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMDocument.prototype.addEventListener):
-        (WebInspector.DOMDocument.prototype.removeEventListener):
-        (WebInspector.DOMDocument.prototype._fireDomEvent):
-        (WebInspector.DOMAgent.prototype.getChildNodesAsync.mycallback):
-        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
-        (WebInspector.DOMAgent.prototype._setChildNodes):
-        (WebInspector.CSSStyleDeclaration.parseRule):
-        (WebInspector.childNodeInserted):
-        (WebInspector.childNodeRemoved):
+        (WebInspector.DOMNode.prototype._insertChild):
         * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel):
-        (WebInspector.ElementsPanel.prototype.reset):
-        (WebInspector.ElementsPanel.prototype.addStyleChange):
-        (WebInspector.ElementsPanel.prototype.removeStyleChange):
-        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
-        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
-        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes):
         * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.set rootDOMNode):
-        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        (WebInspector.ElementsTreeOutline.prototype.createTreeElementFor):
+        (WebInspector.ElementsTreeOutline.prototype.revealAndSelectNode):
         (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.get expandedChildrenLimit):
+        (WebInspector.ElementsTreeElement.prototype.set expandedChildrenLimit):
+        (WebInspector.ElementsTreeElement.prototype.get expandedChildCount):
+        (WebInspector.ElementsTreeElement.prototype.showChild):
+        (WebInspector.ElementsTreeElement.prototype.insertChildElement):
+        (WebInspector.ElementsTreeElement.prototype.moveChild):
         (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
         (WebInspector.ElementsTreeElement.prototype._updateChildren):
-        (WebInspector.ElementsTreeElement.prototype.onexpand):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.addStyleSelector):
-        (InjectedScript._serializeRule):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertiesSection):
-        * inspector/front-end/inspector.js:
-        (WebInspector.set hoveredDOMNode):
-        * inspector/front-end/treeoutline.js:
-        (TreeOutline.prototype.findTreeElement):
-        * inspector/front-end/utilities.js:
-        (Node.prototype.enclosingNodeOrSelfWithNodeNameInArray):
-        (Node.prototype.enclosingNodeOrSelfWithClass):
-        (isAncestorNode):
-        (firstCommonNodeAncestor):
-        (traverseNextNode):
-        (traversePreviousNode):
+        (WebInspector.ElementsTreeElement.prototype.adjustCollapsedRange):
+        (WebInspector.ElementsTreeElement.prototype.handleLoadAllChildren):
         ():
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
-        * page/android/InspectorControllerAndroid.cpp:
-
-2009-08-15  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        Optimize updateFillImages() to not add/remove clients every time
-        https://bugs.webkit.org/show_bug.cgi?id=28334
-
-        Optimize the case where old and new just have a single layer pointing to the same (or no)
-        image.
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::updateFillImages):
-
-2009-08-15  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Implement animations of multiple text-shadows and -webkit-box-shadows.
-        https://bugs.webkit.org/show_bug.cgi?id=28266
-        
-        Test: transitions/multiple-shadow-transitions.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::PropertyWrapperShadow::equals):
-        (WebCore::PropertyWrapperShadow::blend):
-
-2009-08-15  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Make transitions work for position and size of multiple backgrounds and masks.
-        https://bugs.webkit.org/show_bug.cgi?id=28266
-        
-        Make background-position, background-size, -webkit-mask-position and -webkit-mask-size
-        properties animatable with multiple backgrounds, rather than just animating the first one.
-
-        Tests: transitions/multiple-background-size-transitions.html
-               transitions/multiple-background-transitions.html
-               transitions/multiple-mask-transitions.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::FillLayerPropertyWrapperBase::FillLayerPropertyWrapperBase):
-        (WebCore::FillLayerPropertyWrapperBase::~FillLayerPropertyWrapperBase):
-        (WebCore::FillLayerPropertyWrapperGetter::FillLayerPropertyWrapperGetter):
-        (WebCore::FillLayerPropertyWrapperGetter::equals):
-        (WebCore::FillLayerPropertyWrapper::FillLayerPropertyWrapper):
-        (WebCore::FillLayerPropertyWrapper::blend):
-        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
-        (WebCore::FillLayersPropertyWrapper::equals):
-        (WebCore::FillLayersPropertyWrapper::blend):
-        (WebCore::ensurePropertyMap):
-        * rendering/style/FillLayer.h:
-        (WebCore::FillLayer::setXPosition):
-        (WebCore::FillLayer::setYPosition):
-        (WebCore::FillLayer::setSize):
-
-2009-08-15  George Staikos  <george.staikos@torchmobile.com>
-
-        Reviewed by Jan Alonzo.
-
-        Don't crash in fieldset code when WML is enabled.
-        https://bugs.webkit.org/show_bug.cgi?id=28012
-
-        Test: fast/wml/html-fieldset-crash.html
-
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::findLegend): ++brackets
-
-2009-08-15  Sam Weinig  <sam@webkit.org>
-
-        Try and enable EventSource on Windows.
-
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/build-generated-files.sh:
-
-2009-08-15  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Setting attribute event listeners to the body does not set them on the window
-        https://bugs.webkit.org/show_bug.cgi?id=28343
-
-        Tests: fast/dom/Window/HTMLBodyElement-window-eventListener-attributes.html
-               fast/dom/Window/HTMLFrameSetElement-window-eventListener-attributes.html
-
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::setOnblur): Use setWindowAttributeEventListener instead of setAttributeEventListener.
-        (WebCore::HTMLBodyElement::setOnerror): Ditto.
-        (WebCore::HTMLBodyElement::setOnfocus): Ditto.
-        (WebCore::HTMLBodyElement::setOnload): Ditto.
-        (WebCore::HTMLBodyElement::setOnbeforeunload): Ditto.
-        (WebCore::HTMLBodyElement::setOnmessage): Ditto.
-        (WebCore::HTMLBodyElement::setOnoffline): Ditto.
-        (WebCore::HTMLBodyElement::setOnonline): Ditto.
-        (WebCore::HTMLBodyElement::setOnresize): Ditto.
-        (WebCore::HTMLBodyElement::setOnstorage): Ditto.
-        (WebCore::HTMLBodyElement::setOnunload): Ditto.
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::setOnblur): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnerror): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnfocus): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnload): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnbeforeunload): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnmessage): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnoffline): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnonline): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnresize): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnstorage): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnunload): Ditto.
-
-2009-08-15  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Fix up some IDL comments.
-
-        * html/HTMLBodyElement.idl:
-        * html/HTMLFrameSetElement.idl:
-
-2009-08-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+        * inspector/front-end/inspector.css:
 
-        Reviewed by Sam Weinig.
+2010-02-16  Ismail Donmez  <ismail@namtrac.org>
 
-        Added implementation of the EventSource object that enables
-        server-sent events from HTML5.
-        http://dev.w3.org/html5/eventsource/
-        https://bugs.webkit.org/show_bug.cgi?id=14997
+        Reviewed by Pavel Feldman.
 
-        Tests: fast/eventsource/eventsource-attribute-listeners.html
-               fast/eventsource/eventsource-constructor.html
-               http/tests/eventsource/eventsource-bad-mime-type.html
-               http/tests/eventsource/eventsource-parse-event-stream.html
-               http/tests/eventsource/eventsource-reconnect.html
-               http/tests/eventsource/eventsource-status-code-states.html
-               http/tests/eventsource/workers/eventsource-simple.html
+        Fix compilation with inspector disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=32724
 
-        * Configurations/FeatureDefines.xcconfig:
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::eventSource):
-        * bindings/js/JSEventSourceConstructor.cpp: Added.
-        (WebCore::):
-        (WebCore::JSEventSourceConstructor::JSEventSourceConstructor):
-        (WebCore::constructEventSource):
-        (WebCore::JSEventSourceConstructor::getConstructData):
-        * bindings/js/JSEventSourceConstructor.h: Added.
-        (WebCore::JSEventSourceConstructor::classInfo):
-        * bindings/js/JSEventSourceCustom.cpp: Added.
-        (WebCore::JSEventSource::markChildren):
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::eventSource):
-        * dom/EventNames.h:
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toEventSource):
-        * dom/EventTarget.h:
-        * page/DOMWindow.idl:
-        * page/EventSource.cpp: Added.
-        (WebCore::EventSource::EventSource):
-        (WebCore::EventSource::~EventSource):
-        (WebCore::EventSource::connect):
-        (WebCore::EventSource::endRequest):
-        (WebCore::EventSource::scheduleReconnect):
-        (WebCore::EventSource::reconnectTimerFired):
-        (WebCore::EventSource::url):
-        (WebCore::EventSource::readyState):
-        (WebCore::EventSource::close):
-        (WebCore::EventSource::scriptExecutionContext):
-        (WebCore::EventSource::addEventListener):
-        (WebCore::EventSource::removeEventListener):
-        (WebCore::EventSource::dispatchEvent):
-        (WebCore::EventSource::didReceiveResponse):
-        (WebCore::EventSource::didReceiveData):
-        (WebCore::EventSource::didFinishLoading):
-        (WebCore::EventSource::didFail):
-        (WebCore::EventSource::didFailRedirectCheck):
-        (WebCore::EventSource::parseEventStream):
-        (WebCore::EventSource::parseEventStreamLine):
-        (WebCore::EventSource::dispatchGenericEvent):
-        (WebCore::EventSource::dispatchMessageEvent):
-        (WebCore::EventSource::stop):
-        * page/EventSource.h: Added.
-        (WebCore::EventSource::create):
-        (WebCore::EventSource::):
-        (WebCore::EventSource::setOnopen):
-        (WebCore::EventSource::onopen):
-        (WebCore::EventSource::setOnmessage):
-        (WebCore::EventSource::onmessage):
-        (WebCore::EventSource::setOnerror):
-        (WebCore::EventSource::onerror):
-        (WebCore::EventSource::toEventSource):
-        (WebCore::EventSource::eventListeners):
-        (WebCore::EventSource::refEventTarget):
-        (WebCore::EventSource::derefEventTarget):
-        * page/EventSource.idl: Added.
-        * workers/WorkerContext.idl:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::inspectorTimelineAgent):
 
-2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-16  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Minor DOMAgent bugfixes.
+        Web Inspector: turn off line wrapping in source view.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28177
+        https://bugs.webkit.org/show_bug.cgi?id=34935
 
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::nodeForId):
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMAgent):
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype.markAndRevealRange):
+        (WebInspector.TextViewer.prototype._paintLine):
+        * inspector/front-end/textViewer.css:
+        * inspector/front-end/utilities.js:
 
-2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-16  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Evaluating objects while on a breakpoint dumps string
-        representation instead of live object. 
-
-        https://bugs.webkit.org/show_bug.cgi?id=28280
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions.this._evalInInspectedWindow):
-        (WebInspector.ConsoleView.prototype.completions):
-        (WebInspector.ConsoleView.prototype._reportCompletions):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame.delayedEvaluation):
-        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
-        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
-
-2009-08-15  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding two new files to WebCore/platform/haiku:
-        LocalizedStringsHaiku.cpp and LoggingHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28129
-
-        * platform/haiku/LocalizedStringsHaiku.cpp: Added.
-        (WebCore::submitButtonDefaultLabel):
-        (WebCore::inputElementAltText):
-        (WebCore::resetButtonDefaultLabel):
-        (WebCore::defaultLanguage):
-        (WebCore::searchableIndexIntroduction):
-        (WebCore::fileButtonChooseFileLabel):
-        (WebCore::fileButtonNoFileSelectedLabel):
-        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
-        (WebCore::contextMenuItemTagDownloadLinkToDisk):
-        (WebCore::contextMenuItemTagCopyLinkToClipboard):
-        (WebCore::contextMenuItemTagOpenImageInNewWindow):
-        (WebCore::contextMenuItemTagDownloadImageToDisk):
-        (WebCore::contextMenuItemTagCopyImageToClipboard):
-        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
-        (WebCore::contextMenuItemTagCopy):
-        (WebCore::contextMenuItemTagGoBack):
-        (WebCore::contextMenuItemTagGoForward):
-        (WebCore::contextMenuItemTagStop):
-        (WebCore::contextMenuItemTagReload):
-        (WebCore::contextMenuItemTagCut):
-        (WebCore::contextMenuItemTagPaste):
-        (WebCore::contextMenuItemTagNoGuessesFound):
-        (WebCore::contextMenuItemTagIgnoreSpelling):
-        (WebCore::contextMenuItemTagLearnSpelling):
-        (WebCore::contextMenuItemTagSearchWeb):
-        (WebCore::contextMenuItemTagLookUpInDictionary):
-        (WebCore::contextMenuItemTagOpenLink):
-        (WebCore::contextMenuItemTagIgnoreGrammar):
-        (WebCore::contextMenuItemTagSpellingMenu):
-        (WebCore::contextMenuItemTagShowSpellingPanel):
-        (WebCore::contextMenuItemTagCheckSpelling):
-        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
-        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
-        (WebCore::contextMenuItemTagFontMenu):
-        (WebCore::contextMenuItemTagBold):
-        (WebCore::contextMenuItemTagItalic):
-        (WebCore::contextMenuItemTagUnderline):
-        (WebCore::contextMenuItemTagOutline):
-        (WebCore::contextMenuItemTagWritingDirectionMenu):
-        (WebCore::contextMenuItemTagDefaultDirection):
-        (WebCore::contextMenuItemTagLeftToRight):
-        (WebCore::contextMenuItemTagRightToLeft):
-        (WebCore::contextMenuItemTagInspectElement):
-        (WebCore::searchMenuNoRecentSearchesText):
-        (WebCore::searchMenuRecentSearchesText):
-        (WebCore::searchMenuClearRecentSearchesText):
-        (WebCore::unknownFileSizeText):
-        (WebCore::AXWebAreaText):
-        (WebCore::AXLinkText):
-        (WebCore::AXListMarkerText):
-        (WebCore::AXImageMapText):
-        (WebCore::AXHeadingText):
-        (WebCore::imageTitle):
-        (WebCore::contextMenuItemTagTextDirectionMenu):
-        (WebCore::AXButtonActionVerb):
-        (WebCore::AXTextFieldActionVerb):
-        (WebCore::AXRadioButtonActionVerb):
-        (WebCore::AXCheckedCheckBoxActionVerb):
-        (WebCore::AXUncheckedCheckBoxActionVerb):
-        (WebCore::AXLinkActionVerb):
-        (WebCore::AXDefinitionListTermText):
-        (WebCore::AXDefinitionListDefinitionText):
-        * platform/haiku/LoggingHaiku.cpp: Added.
-        (WebCore::InitializeLoggingChannelsIfNecessary):
-
-2009-08-15  Darin Adler  <darin@apple.com>
-
-        Fix GTK build.
+        Web Inspector: let search iterate over views in Resources
+        and keep the view in Scripts.
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (fallbackObject): Pass 0 for document. Should be OK at least for now.
+        https://bugs.webkit.org/show_bug.cgi?id=34968
 
-2009-08-15  Darin Adler  <darin@apple.com>
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.jumpToNextSearchResult):
+        (WebInspector.Panel.prototype.jumpToPreviousSearchResult):
+        (WebInspector.Panel.prototype.showSourceLineForURL):
+        (WebInspector.Panel.prototype.searchIteratesOverViews):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get _resources):
+        (WebInspector.ResourcesPanel.prototype.searchIteratesOverViews):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.showingLastSearchResult):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+        (WebInspector.focusSearchField):
 
-        Fix Qt build.
+2010-02-16  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        * dom/XMLTokenizerQt.cpp: Use create functions instead of calling new
-        directly to make CDATASection and Comment nodes.
+        Reviewed by Ariya Hidayat.
 
-2009-08-14  Darin Adler  <darin@apple.com>
+        [Qt] canvas clipping is buggy
+        https://bugs.webkit.org/show_bug.cgi?id=32405
 
-        Reviewed by Sam Weinig.
+        Apparently the bug was in GraphicsContext::roundToDevicePixels, we
+        didn't take unto accounts rotation, so the device pixels were rounded
+        incorrectly. The new formula is a 1:1 copy from GraphicsContextCG so
+        it should be rather safe
 
-        Make DOM classes start with a reference count of 1, like all other RefCounted
-        https://bugs.webkit.org/show_bug.cgi?id=28068
+        Test: http://glimr.rubyforge.org/cake/canvas.html#Polaroids now looks right
 
-        First half, everything except for element classes.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::roundToDevicePixels): Copy the formula from
+        GraphicsContextCG
 
-        * GNUmakefile.am: Removed DocPtr.h.
-        * WebCore.gypi: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
+2010-02-16  Yury Semikhatsky  <yurys@chromium.org>
 
-        * dom/Attr.cpp:
-        (WebCore::Attr::Attr): Added a call to createTextChild here so callers don't
-        have to call it explicitly.
-        (WebCore::Attr::create): Added.
-        (WebCore::Attr::setValue): Changed to take AtomicString.
-        (WebCore::Attr::cloneNode): Use create.
+        Not Reviewed, build fix.
 
-        * dom/Attr.h: Added a create function. Made the constructor private,
-        and a lot of other functions private as well.
+        * platform/graphics/FloatRect.h:
+        (WebCore::FloatRect::center): make conversion from float to int explicit so that compiler
+        doesn't complain about that.
 
-        * dom/Attribute.cpp:
-        (WebCore::Attribute::createAttrIfNeeded): Use Attr::create.
+2010-02-15  Dan Bernstein  <mitz@apple.com>
 
-        * dom/CDATASection.cpp:
-        (WebCore::CDATASection::create): Added.
-        (WebCore::CDATASection::cloneNode): Use create.
-        (WebCore::CDATASection::virtualCreate): Ditto.
+        Reviewed by Simon Fraser.
 
-        * dom/CDATASection.h: Added a create function. Made everything private.
-        Removed unneeded destructor declaration.
+        <rdar://problem/7645609> [webView selectionRect] API is broken for multicolumn layout
 
-        * dom/CharacterData.cpp:
-        (WebCore::CharacterData::CharacterData): Replaced the multiple constructors
-        with a single one that takes ConstructionType.
+        Refine the fix for https://bugs.webkit.org/show_bug.cgi?id=34923 by using the center of
+        a quad’s bounding box, rather than its top left, as the reference point passed to
+        offsetFromContainer(). This ensures that if a sliver off the top of the selection rect is in
+        one column, but most of it is on another column, the single rect we return will be for the
+        second column.
 
-        * dom/CharacterData.h: Made more functions be protected and private.
-        Made m_data be private.
+        * platform/graphics/FloatRect.h:
+        (WebCore::FloatRect::center): Added.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localToContainerQuad): Use the center instead of the top left.
 
-        * dom/Comment.cpp:
-        (WebCore::Comment::Comment): Got rid of an extra constructor.
-        (WebCore::Comment::create): Added.
-        (WebCore::Comment::cloneNode): Call create.
+2010-02-15  MORITA Hajime  <morrita@gmail.com>
 
-        * dom/Comment.h: Added a create function. Made everything private.
+        Reviewed by Nikolas Zimmermann.
 
-        * dom/ContainerNode.cpp:
-        (WebCore::dispatchChildInsertionEvents): Use RefPtr instead of DocPtr.
-        (WebCore::dispatchChildRemovalEvents): Ditto.
+        SVG text refactor: reduce paint specific callbacks on SVGTextChunkWalker
 
-        * dom/ContainerNode.h: Made the constructor protected and passed
-        ConstructionType instead of an isElement boolean.
+        https://bugs.webkit.org/show_bug.cgi?id=34831
 
-        * dom/DocPtr.h: Removed.
+        No new tests, no change of functionality.
 
-        * dom/Document.cpp:
-        (WebCore::Document::Document): Simplified the code that sets m_document
-        since it's no longer a smart pointer.
-        (WebCore::Document::removedLastRef): Use explicit calls to selfOnlyRef
-        and selfOnlyDeref instead of a DocPtr in here.
-        (WebCore::Document::~Document): Simplified the code that sets m_document
-        since it's no longer a smart pointer.
-        (WebCore::Document::createDocumentFragment): Call create.
-        (WebCore::Document::createTextNode): Ditto.
-        (WebCore::Document::createComment): Ditto.
-        (WebCore::Document::createCDATASection): Ditto.
-        (WebCore::Document::createProcessingInstruction): Ditto.
-        (WebCore::Document::createEntityReference): Ditto.
-        (WebCore::Document::createEditingTextNode): Ditto.
-        (WebCore::Document::importNode): Call Attr::create.
-        (WebCore::Document::createAttributeNS): Ditto.
-
-        * dom/Document.h: Call adoptRef. Made a lot of functions private and
-        protected and sorted them so public functions come first.
-
-        * dom/DocumentFragment.cpp:
-        (WebCore::DocumentFragment::create): Added.
-        (WebCore::DocumentFragment::cloneNode): Call create.
-        * dom/DocumentFragment.h: Added create.
-
-        * dom/DocumentType.cpp:
-        (WebCore::DocumentType::DocumentType): Pass type to Node constructor.
-        (WebCore::DocumentType::cloneNode): Use create.
-        * dom/DocumentType.h:
-        (WebCore::DocumentType::create): Call adoptRef.
-
-        * dom/EditingText.cpp:
-        (WebCore::EditingText::create): Added.
-        * dom/EditingText.h: Added a create function. Made everything private.
+        * rendering/SVGCharacterLayoutInfo.h:
+        (WebCore::SVGTextChunkWalker::SVGTextChunkWalker):
+        Removed setupBackground(), setupFill(), setupFillSelection(),
+        setupStroke(), setupStrokeSelection(), setupForeground()
+        and associated member variables.
+        
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::setupBackground):
+        renamed from chunkSetupBackgroundCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::setupFill):
+        renamed from chunkSetupFillCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::setupFillSelection):
+        renamed from chunkSetupFillSelectionCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::setupStroke):
+        renamed from chunkSetupStrokeCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::setupStrokeSelection):
+        renamed from chunkSetupStrokeSelectionCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::setupForeground):
+        renamed from chunkSetupForegroundCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::paintChunk):
+        renamed from chunkPortionCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkPortionCallback):
+        extracted from walkTextChunks.
+        (WebCore::SVGRootInlineBox::paint):
+        follow SVGTextChunkWalker change.
+        (WebCore::SVGRootInlineBox::walkTextChunks):
+        moved paint some specific code to SVGRootInlineBoxPaintWalker::chunkPortionCallback().
+        
+2010-02-15  Dan Bernstein  <mitz@apple.com>
+
+        Try to fix the Chromium build.
 
-        * dom/Element.cpp:
-        (WebCore::Element::Element): Pass CreateElementZeroRefCount to preserve
-        the zero reference count behavior for classes derived from Element.
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::convertToPaintingRect):
 
-        * dom/EntityReference.cpp:
-        (WebCore::EntityReference::create): Added.
-        (WebCore::EntityReference::cloneNode): Call create.
-        * dom/EntityReference.h: Added create. Made everything private.
+2010-02-14  Gavin Barraclough  <barraclough@apple.com>
 
-        * dom/Node.cpp:
-        (WebCore::Node::initialRefCount): Added. Inline helper function for
-        the constructor.
-        (WebCore::Node::isContainer): Ditto.
-        (WebCore::Node::isElement): Ditto.
-        (WebCore::Node::isText): Ditto.
-        (WebCore::Node::Node): Changed to take a construction type argument.
-        Since m_document is now a normal pointer, added a call to selfOnlyRef.
-        (WebCore::Node::~Node): Ditto, but selfOnlyDeref.
-        (WebCore::Node::setDocument): Added selfOnlyRef/Deref calls.
-        (WebCore::Node::appendTextContent): Use the data function instead of
-        calling nodeValue functions, which do the same thing in a roundabout way.
-
-        * dom/Node.h: Made the constructor protected and replaced the multiple
-        arguments iwth a single ConstructionType argument. Sorted the public
-        things first.
-
-        * dom/Notation.h: Made most things private.
-        * dom/Notation.cpp: Removed extra constructor.
+        Reviewed by Darin Adler.
 
-        * dom/ProcessingInstruction.cpp:
-        (WebCore::ProcessingInstruction::create): Added.
-        (WebCore::ProcessingInstruction::cloneNode): Call create.
-        * dom/ProcessingInstruction.h: Added create function. Made many other
-        members private.
-
-        * dom/Range.cpp:
-        (WebCore::Range::processContents): Use DocumentFragment::create.
-
-        * dom/Text.cpp:
-        (WebCore::Text::Text): Updated for base class change.
-        (WebCore::Text::create): Added.
-        (WebCore::Text::splitText): Changed to not require access to m_data.
-        (WebCore::Text::cloneNode): Call create.
-        (WebCore::Text::createRenderer): Call dataImpl.
-        (WebCore::Text::attach): Call data.
-        (WebCore::Text::recalcStyle): Call dataImpl.
-        (WebCore::Text::virtualCreate): Call create.
-        (WebCore::Text::createWithLengthLimit): Call create.
-        (WebCore::Text::formatForDebugger): Call data.
-
-        * dom/Text.h: Added a create function. Made many other members private.
-        Renamed createNew to virtualCreate.
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Many false leaks in release builds due to PtrAndFlags
 
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::enterText): Call Text::create.
+        PtrAndFlags has now been removed; remove forwarding header.
 
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::cdataBlock): Call CDATASection::create.
-        (WebCore::XMLTokenizer::comment): Call Comment::create.
+        * ForwardingHeaders/wtf/PtrAndFlags.h: Removed.
 
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::deleteInsignificantText):
-        Call data instead of string.
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
 
-        * editing/CreateLinkCommand.cpp:
-        (WebCore::CreateLinkCommand::doApply): Call Text::create.
+        Reviewed by Geoff Garen.
 
-        * editing/EditorCommand.cpp:
-        (WebCore::executeInsertNode): Call DocumentFragment::create.
+        Bug 34952 - String lengths in UString should be unsigned.
+        This matches WebCore::StringImpl, and better unifies behaviour throughout JSC.
 
-        * editing/SplitTextNodeCommand.cpp:
-        (WebCore::SplitTextNodeCommand::doApply): Call Text::create.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
 
-        * editing/markup.cpp:
-        (WebCore::appendStartMarkup): Call data instead of nodeValue.
+2010-02-15  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        * html/HTMLDocument.h:
-        (WebCore::HTMLDocument::create): Call adoptRef.
+        Reviewed by Xan Lopez.
 
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::createContextualFragment): Call DocumentFragment::create.
-        (WebCore::replaceChildrenWithFragment): Call data instead of string.
-        (WebCore::replaceChildrenWithText): Call Text::create.
-        (WebCore::HTMLElement::setInnerText): Call DocumentFragment::create and
-        Text::create.
-        (WebCore::HTMLElement::setOuterText): Call Text::create.
+        [GTK] Crashes when going back to a page that has data: URIs, with page cache enabled
+        https://bugs.webkit.org/show_bug.cgi?id=34944
 
-        * html/HTMLKeygenElement.cpp:
-        (WebCore::HTMLKeygenElement::HTMLKeygenElement): Call Text::create.
+        Set the URL in the newly created response, when parsing data:
+        URIs.
 
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::setText): Call Text::create.
+        Test: fast/harness/page-cache-crash-on-data-urls.html
 
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::textCreateErrorCheck): Call Text::create.
-        (WebCore::HTMLParser::commentCreateErrorCheck): Call Comment::create.
-        (WebCore::HTMLParser::handleIsindex): Call Text::create.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl):
 
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::addText): Call Text::create.
+2010-02-15  Dan Bernstein  <mitz@apple.com>
 
-        * html/HTMLViewSourceDocument.h:
-        (WebCore::HTMLViewSourceDocument::create): Call adoptRef.
+        Reviewed by Simon Fraser.
 
-        * loader/FTPDirectoryDocument.cpp:
-        (WebCore::FTPDirectoryTokenizer::appendEntry): Call Text::create.
-        (WebCore::FTPDirectoryTokenizer::createTDForFilename): Call Text::create.
-
-        * loader/FTPDirectoryDocument.h:
-        (WebCore::FTPDirectoryDocument::create): Call adoptRef.
-        * loader/ImageDocument.h:
-        (WebCore::ImageDocument::create): Ditto.
-        * loader/MediaDocument.h:
-        (WebCore::MediaDocument::create): Ditto.
-        * loader/PlaceholderDocument.h:
-        (WebCore::PlaceholderDocument::create): Ditto.
-        * loader/PluginDocument.h:
-        (WebCore::PluginDocument::create): Ditto.
-        * loader/TextDocument.h:
-        (WebCore::TextDocument::create): Ditto.
+        <rdar://problem/7647300> Incorrect client rects for blocks the span multiple columns and their descendants
+        https://bugs.webkit.org/show_bug.cgi?id=34923
 
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::didFinishLoading): Use RefPtr instead of DocPtr.
-        (WebCore::Loader::Host::didFail): Ditto.
+        Test: fast/multicol/client-rects.html
 
-        * platform/TreeShared.h:
-        (WebCore::TreeShared::TreeShared): Added an initialRefCount argument,
-        defaulting to 1. Node still sometimes initializes it to 0 instead for now.
+        In column layout, a different transform applies to different points in
+        the block and its descendants, depending on their y coordinate within the
+        block. offsetFromContainer() used to return the offset that applied to
+        the origin. With this change, it returns the offset that applies to a
+        given reference point. When mapping a quad from local to absolute
+        coordinates, the top left of the quad’s bounding box is used as that
+        reference point.
 
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::layout): Pass the caret’s origin as the
+        reference point to offsetFromContainer().
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustForColumns): Adds the offset between the
+        given point and its image under the column paint-time transform to the
+        given offset. Used by offsetFromContainer() where it had previously used
+        adjustRectForColumns(), which takes a rect and operates less efficiently.
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer): Pass the transformed point as
+        the reference point to offsetFromContainer().
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint): Pass a point to
+        offsetFromContainer().
+        (WebCore::RenderBox::offsetFromContainer): Use adjustForColumns() instead
+        of adjustRectForColumns(), and use the reference point to get the right
+        adjustment for the point of interest, instead of the origin, in case this
+        box spans multiple columns.
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::offsetFromContainer): Ditto. Actually apply the
+        column offset to the computation, which previously this function didn’t
+        do.
+        (WebCore::RenderInline::mapLocalToContainer): Pass the transformed point
+        as the reference point to offsetFromContainer().
+        (WebCore::RenderInline::mapAbsoluteToLocalPoint): Pass a point to
+        offsetFromContainer().
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::mapLocalToContainer): Apply column adjustment,
+        based on the reference point, to the transform if needed.
+        (WebCore::RenderObject::localToContainerQuad): Initialize the
+        TransformState with the top left corner of the quad’s bounding box. It
+        is later used as the reference point when deciding on which column to
+        base the calculations.
+        (WebCore::RenderObject::offsetFromContainer): Adjust for columns.
+        (WebCore::RenderObject::offsetFromAncestorContainer): Pass the origin
+        as the reference point to offsetFromContainer().
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::adjustForColumns): Added.
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::offsetFromContainer): Pass the reference
+        point through.
+        * rendering/RenderTableCell.h:
         * rendering/RenderText.cpp:
-        (WebCore::RenderText::originalText): Use dataImpl instead of string.
-
-        * rendering/RenderTextFragment.cpp:
-        (WebCore::RenderTextFragment::originalText): Use dataImpl instead of string.
-        (WebCore::RenderTextFragment::previousCharacter): Ditto.
-
-        * svg/SVGDocument.h:
-        (WebCore::SVGDocument::create): Use adoptRef.
-
-        * svg/SVGElementInstance.cpp:
-        (WebCore::SVGElementInstance::SVGElementInstance): Updated to take a
-        PassRefPtr.
-
-        * svg/SVGElementInstance.h: Made everything private.
-
-        * wml/WMLDocument.h:
-        (WebCore::WMLDocument::create): Called adoptRef.
-
-        * xml/XPathNamespace.cpp:
-        (WebCore::XPathNamespace::XPathNamespace): Take AtomicString arguments.
-        * xml/XPathNamespace.h: Made everything private.
-
-        * xml/XSLTProcessor.cpp:
-        (WebCore::createFragmentFromSource): Use DocumentFragment::create and
-        Text::create.
-
-2009-08-13  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Part of <rdar://problem/6218721> No MSAA focus events fired for Webkit
-        nightly (20866)
-
-        https://bugs.webkit.org/show_bug.cgi?id=20866
-
-        Reviewed by Oliver Hunt.
-
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::AXObjectCache):
-        Changed to take a pointer to its owner document. This is used by
-        AXObjectCache::handleFocusedUIElementChanged().
-        (WebCore::AXObjectCache::focusedUIElementForPage):
-        Code moved from AccessibilityRenderObject::focusedUIElement(). Modified
-        to be a static function and to take a pointer to a Page.
-        (WebCore::AXObjectCache::platformGenerateAXID):
-        Moved the code to generate the next AXID from getAXID() to here. Added
-        a #if to make this non-WIN only, because Windows has its own
-        implementation.
-        (WebCore::AXObjectCache::getAXID):
-        Ensure that we generate a positive AXID, ranging from 1 to LONG_MAX.
-
-        * accessibility/AXObjectCache.h:
-        Add a declaration for Document and Page. Removed the declaration of
-        AccessibilityObject, because we include the header. Reordered the
-        declaration of Node alphabetically. Moved the typedef for AXID to
-        AccessibilityObject. Removed some trailing whitespace. Added a member
-        variable to hold a pointer to the owner Document.
-        (WebCore::AXObjectCache::AXObjectCache):
-        Changed to take a pointer to its owner Document.
-        (WebCore::AXObjectCache::focusedUIElementForPage):
-        Added; code moved from AccessiblityRenderObject::focusedUIElement().
-        Returns the focused element with respect to accessibility.
-        (WebCore::AXObjectCache::platformGenerateAXID):
-        Declare a function to generate an AXID.
-        (WebCore::AXObjectCache::objectFromAXID):
-        Return the AccessibilityObject with the given AXID.
-
-        * accessibility/AccessibilityObject.h:
-        Moved the typedef for AXID from AXObjectCache to here. Made the m_id
-        member use the typedef.
-        (WebCore::AccessibilityObject::axObjectID):
-        Changed the return type to use the typedef.
-        (WebCore::AccessibilityObject::setAXObjectID):
-        Changed the argument type to use the typedef.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        Removed some unneeded #includes.
-        (WebCore::AccessibilityRenderObject::focusedUIElement):
-        Moved the code to AXObjectCache::focusedUIElementForPage(), which we now
-        call.
-
-        * accessibility/win/AXObjectCacheWin.cpp:
-        (WebCore::AXObjectCache::platformGenerateAXID):
-        Ensure that we generate an AXID that is in the range 1 to LONG_MAX.
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-        If the Document has no Page, return. If the Page has not focused
-        element (respecting accessibility), return. Assert that the
-        accessibility of the focused element is not ignored, and that the
-        object's AXID will be negative and fit into a LONG when negated.
-        Broadcast a focus event for the object.
-
-        * dom/Document.cpp:
-        (WebCore::Document::axObjectCache):
-        Pass this when creating the AXObjectCache.
-        (WebCore::Document::setFocusedNode):
-        Call AXObjectCache::handleFocusedUIElementChanged() on Windows.
-
-2009-08-14  Jiahua Huang  <jhuangjiahua@gmail.com>
-
-        Reviewed by Jan Alonzo.
-
-        [gtk] Pasteboard/GtkClipboard can't handle the "text/html" target.
-        https://bugs.webkit.org/show_bug.cgi?id=27028
-
-        Remove the improper set of enum WebKitWebViewTargetInfo
-        by grabbing the target infos via m_helper.
-
-        * manual-tests/gtk/copy-htmltext.html: Added.
-        * platform/Pasteboard.h:
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::clipboard_get_contents_cb):
-        * platform/gtk/PasteboardHelper.h:
-
-2009-08-14  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Fix an assertion when bringing up the Inspector.
-        https://bugs.webkit.org/show_bug.cgi?id=28318
-        
-        The fix for bug 28295 assumed that image clients count the number of times
-        addClient/removeClient is called. That was true for CachedResource clients,
-        but not StyleGeneratedImage clients, which pass the call onto CSSImageGeneratorValue.
-        
-        Fix by making CSSImageGeneratorValue count the number of times a client is
-        added/removed.
-
-        * css/CSSCanvasValue.cpp:
-        (WebCore::CSSCanvasValue::canvasChanged):
-        (WebCore::CSSCanvasValue::canvasResized):
-        * css/CSSImageGeneratorValue.cpp:
-        (WebCore::CSSImageGeneratorValue::addClient):
-        (WebCore::CSSImageGeneratorValue::removeClient):
-        (WebCore::CSSImageGeneratorValue::getImage):
-        * css/CSSImageGeneratorValue.h:
-
-2009-08-14  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Kevin Ollivier.
-
-        Correct libcurl crash when downloading local files.
-        https://bugs.webkit.org/show_bug.cgi?id=28312
-
-        No new tests. Test is covered by fast/encoding/char-encoding-mac.html.
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::handleLocalReceiveResponse): New static function that
-          performs the local setting of valid URL and firing didReceiveResponse.
-          This code was moved from writeCallback.
-        (WebCore::writeCallback): Move local file handling to static function
-          (above) and use the function instead.
-        (WebCore::readCallback): Add check
-          for responseFired, and handle as a local file if it was not.
-
-2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        [Haiku] Fix RenderThemeHaiku build.
-        https://bugs.webkit.org/show_bug.cgi?id=28307
-
-        * platform/haiku/RenderThemeHaiku.cpp: Included RenderThemeHaiku.h
-        instead of RenderTheme.h.
-        (WebCore::RenderThemeHaiku::paintCheckbox): Removed the wrong 'virtual'
-        before the function.
-        (WebCore::RenderThemeHaiku::paintRadio): Removed the wrong 'virtual'
-        before the function.
-        * platform/haiku/RenderThemeHaiku.h: Corrected wrong function definitions.
-
-2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        [Haiku] Adding SharedBufferHaiku to WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=28309
-
-        * platform/haiku/SharedBufferHaiku.cpp: Added.
-        (WebCore::SharedBuffer::createWithContentsOfFile):
-        * platform/haiku/TemporaryLinkStubs.cpp: Removed unnecessary headers
-        and functions.
-        (WebCore::signedPublicKeyAndChallengeString):
-        (WebCore::getSupportedKeySizes):
-
-2009-08-14  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Ensure we're getting the right v8 context in the V8 DOMWindowEvent custom getter.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28311
+        (WebCore::RenderText::absoluteRectsForRange): Map (the origin of) each
+        rect to absolute coordinates individually.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::convertToPaintingRect): Pass a point to
+        offsetFromContainer().
 
-        This should fix Chromium failing LayoutTests/fast/events/set-event-in-another-frame.html.
+2010-02-12  Alexey Proskuryakov  <ap@apple.com>
 
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-
-2009-08-14  Aaron Boodman  <aa@chromium.org>
+        Reviewed by Kevin Decker.
 
-        Reviewed by Alexey Proskuryakov.
+        <rdar://problem/7130641> Browser objects identity is not preserved by Safari
 
-        BUG 28134: Move the remaining parts of Access Control from XMLHttpRequest to ThreadableDocumentLoader.
-        https://bugs.webkit.org/show_bug.cgi?id=28134
-
-        No new tests added since Access Control was already well tested and this is a pure refactor.
-
-        * loader/DocumentThreadableLoader.cpp: Move a lot of the access control code from XHR in, preserving its
-        basic strategy. Also, modify the synchronous path to not be a special case, but reuse more of the async
-        path.
-
-        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Go through the async path and pass additional flags.
-        (WebCore::DocumentThreadableLoader::create): Group enum params into an options struct.
-        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Ditto.
-        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest): Brought mostly from XHR.
-        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight): Ditto.
-        (WebCore::DocumentThreadableLoader::willSendRequest): Handle preflight case.
-        (WebCore::DocumentThreadableLoader::didReceiveResponse): Ditto.
-        (WebCore::DocumentThreadableLoader::didFinishLoading): Ditto.
-        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): Ditto.
-        (WebCore::DocumentThreadableLoader::preflightSuccess): Preflight handling.
-        (WebCore::DocumentThreadableLoader::preflightFailure): Ditto.
-        (WebCore::DocumentThreadableLoader::loadRequest): Common request function that handles async/sync.
-        * loader/DocumentThreadableLoader.h: Group enum params into an options struct.
-        * loader/ThreadableLoader.cpp: Ditto.
-        (WebCore::ThreadableLoader::create): Ditto.
-        (WebCore::ThreadableLoader::loadResourceSynchronously): Ditto.
-        * loader/ThreadableLoader.h: Ditto.
-        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Ditto.
-        * loader/WorkerThreadableLoader.cpp: Ditto.
-        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):Ditto.
-        (WebCore::WorkerThreadableLoader::loadResourceSynchronously): Ditto.
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge): Ditto.
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader): Ditto.
-        * loader/WorkerThreadableLoader.h: Ditto.
-        (WebCore::WorkerThreadableLoader::create): Ditto.
-        * platform/CrossThreadCopier.h: Allow ThreadableLoaderOptions to be copied across threads.
-        (WebCore::):
-        * workers/WorkerScriptLoader.cpp: More enum->struct grouping.
-        (WebCore::WorkerScriptLoader::loadSynchronously): More enum->struct grouping.
-        (WebCore::WorkerScriptLoader::loadAsynchronously): More enum->struct grouping.
-        * xml/XMLHttpRequest.cpp: Remove all the access control code and some supporting state.
-        (WebCore::XMLHttpRequest::XMLHttpRequest): Ditto.
-        (WebCore::XMLHttpRequest::createRequest): Ditto.
-        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
-        (WebCore::XMLHttpRequest::didReceiveResponse): Ditto.
-        (WebCore::XMLHttpRequest::didReceiveData): Ditto.
-        * xml/XMLHttpRequest.h: Ditto.
-
-2009-08-14  Darin Adler  <darin@apple.com>
+        Test: plugins/netscape-browser-object-identity.html
 
-        Reviewed by Sam Weinig.
+        * bridge/runtime_root.h: (JSC::Bindings::RootObject::addInvalidationCallback):
+        RootObject can now call out during invalidation, making it possible for other code to know
+        when this happens.
 
-        Rename the confusing isObject(<class>) to inherits(<class>).
-        It still works on non-objects, returning false.
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::InvalidationCallback::~InvalidationCallback): Empty destructor,
+        in cpp file since it's virtual.
+        (JSC::Bindings::RootObject::invalidate): Invoke invalidation callbacks.
 
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toEventTarget):
-        * bindings/js/JSGeolocationCustom.cpp:
-        (WebCore::createPositionCallback):
-        (WebCore::createPositionErrorCallback):
-        * bindings/js/JSNodeFilterCustom.cpp:
-        (WebCore::toNodeFilter):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::send):
-        * bindings/js/JSXSLTProcessorCustom.cpp:
-        (WebCore::JSXSLTProcessor::importStylesheet):
-        (WebCore::JSXSLTProcessor::transformToFragment):
-        (WebCore::JSXSLTProcessor::transformToDocument):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::callObjCFallbackObject):
-        * bridge/runtime_method.cpp:
-        (JSC::callRuntimeMethod):
-        Updated to new name, inherits, from old name, isObject.
+        * bridge/NP_jsobject.cpp:
+        (ObjectMap): Keep a JSObject->NPObject map for each RootObject. It somewhat cleaner to
+        keep it outside RootObject, because (1) it is agnostic of what kinds of objects can wrap
+        JSObject, and (2) out of process NPAPI implementation also keeps its corresponding map
+        separately, due to supporting per-instance granularity (as opposed to per-RootObject here).
+        (jsDeallocate): Remove the corresponding map entry.
+        (_NPN_CreateScriptObject): Try to fetch existing object from the map, incrementing refcount.
 
-2009-08-14  Yael Aharon  <yael.aharon@nokia.com>
+2010-02-15  Philippe Normand  <pnormand@igalia.com>
 
-        Reviewed by Simon Hausmann.
+        Rubber-stamped by Gustavo Noronha Silva.
 
-        Allow Qt API to list and to remove URL schemes that were registered as
-        local URL schemes.
-        [Qt] Allow applications to register their own local URL scheme.
-        https://bugs.webkit.org/show_bug.cgi?id=28240
+        Removed redefine of LOG_VERBOSE. This should not have commited in
+        the first place.
 
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::removeURLSchemeRegisteredAsLocal):
-        (WebCore::SecurityOrigin::localURLSchemes):
-        * page/SecurityOrigin.h:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
 
-2009-08-14  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-15  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Wrap console objects late (in the frontend) so that injected
-        script was already in place.
+        Web Inspector: incorrect syntax highlighting as HTML in a script tag.
+        We were preserving initial lexer state upon entering other tags while in <script>
+        but were not doing it for <script tag itself. As a result, nested script
+        tags were failing to highlight.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28297
+        https://bugs.webkit.org/show_bug.cgi?id=34934
 
-        * inspector/ConsoleMessage.cpp:
-        (WebCore::ConsoleMessage::ConsoleMessage):
-        * inspector/ConsoleMessage.h:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addMessageToConsole):
-        (WebCore::InspectorController::startGroup):
-        (WebCore::InspectorController::setFrontendProxyObject):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::InspectorFrontend):
-        (WebCore::InspectorFrontend::addMessageToConsole):
-        * inspector/InspectorFrontend.h:
-
-2009-08-13  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix logic in RenderObject::updateFillImages() that led to incorrect client
-        counts if an image was used twice in the background-image property.
-        https://bugs.webkit.org/show_bug.cgi?id=28295
-
-        Test: fast/backgrounds/multiple-backgrounds-assert.html
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::updateFillImages):
-        Simplify the logic to call addClient()/removeClient() for every background
-        image, but go through the new layers first to avoid removing all the
-        clients of an image.
-
-2009-08-13  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Devirtualise marking
-        https://bugs.webkit.org/show_bug.cgi?id=28294
-
-        Make sure we override the JSObject createStructure method on those
-        objects that have custom marking routines.
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-
-2009-08-13  Darin Adler  <darin@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        Follow-up to earlier work to remove dependencies on JavaScriptCore.
-
-        * ForwardingHeaders/parser/Parser.h: Removed.
-        * inspector/JavaScriptDebugServer.cpp: Removed now-unneeded includes
-        of Parser.h.
-
-2009-08-13  Dan Bernstein  <mitz@apple.com>
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
 
-        Reviewed by Eric Seidel.
-
-        'box-orient: block-axis' behaves like 'box-orient: horizontal', causes
-        an assertion failure in debug builds
-        https://bugs.webkit.org/show_bug.cgi?id=28279
-
-        Test: fast/flexbox/block-axis.html
-
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::operator EBoxOrient): Map block-axis to
-        vertical.
-
-2009-08-13  Simon Fraser  <simon.fraser@apple.com>
+2010-02-15  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        Fix crash when removing reflection on an absolutely-positioned image.
-        https://bugs.webkit.org/show_bug.cgi?id=28289
-        
-        Make sure we clean up the reflection layer when removing the reflection,
-        so that the RenderLayer tree does not contain pointers to deleted layers.
-
-        Test: fast/reflections/reflected-img-crash.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::~RenderLayer):
-        (WebCore::RenderLayer::styleChanged):
-        (WebCore::RenderLayer::removeReflection):
-        * rendering/RenderLayer.h:
-
-2009-08-13  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        misalignment because of float:left of <div> tag
-        https://bugs.webkit.org/show_bug.cgi?id=15869
-
-        One section of http://edgar.sec.gov site draws to the right of the rest
-        of the content
-        <rdar://problem/7135951>
-
-        Tests: fast/block/float/avoidance-percent-width-compat.html
-               fast/block/float/avoidance-percent-width-strict.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::getClearDelta): Changed to apply the same float
-            avoidance logic in strict mode and in compatibility mode, which
-            matches Firefox and IE. Changed to compute and use the computed
-            width of the child, instead of ignoring non-fixed widths.
-
-2009-08-13  Steve Block  <steveblock@google.com>
-
-        Reviewed by Darin Adler.
-
-        Geolocation PositionOptions does not use correct default values.
-        https://bugs.webkit.org/show_bug.cgi?id=27254
+        Add a progress-indicator logging channel to WebCore, and convert the old WebKit Logging
+        messages over to WebCore-style.
 
-        Sets the correct default values for the properties of the PositionOptions object
-        passed to Geolocation methods. See http://www.w3.org/TR/geolocation-API/.
+        No new tests. (Logging changes only)
 
-        Also adds checking to throw an exception if arguments of the incorrect type are
-        passed to Geolocation methods. Adds a layout test to test this. This test should
-        pass on all platforms where Geolocation is implemented.
-
-        Test: fast/dom/Geolocation/argument-types.html
-
-        * bindings/js/JSGeolocationCustom.cpp:
-        (WebCore::createPositionCallback): Added. Creates the callback.
-        (WebCore::createPositionErrorCallback): Added. Creates the calback.
-        (WebCore::createPositionOptions): Added. Creates the PositionOptions object, setting defaults where required.
-        (WebCore::JSGeolocation::getCurrentPosition): Modified. Now uses above helper functions.
-        (WebCore::JSGeolocation::watchPosition): Modified. Now uses above helper functions.
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Asserts that PositionOptions object is present.
-        (WebCore::Geolocation::GeoNotifier::startTimer): Modified. Only starts timer if timeout has been set.
-        * page/PositionOptions.h:
-        (WebCore::PositionOptions::create): Modified. Creates object with default values.
-        (WebCore::PositionOptions::timeout): Modified. Uses correct type.
-        (WebCore::PositionOptions::hasTimeout): Added. Determines whether a timeout has been set.
-        (WebCore::PositionOptions::setTimeout): Modified. Uses correct type.
-        (WebCore::PositionOptions::maximumAge): Modified. Uses correct type.
-        (WebCore::PositionOptions::setMaximumAge): Modified. Uses correct type.
-        (WebCore::PositionOptions::PositionOptions): Modified. Creates object with default values.
-
-2009-08-13  David Levin  <levin@chromium.org>
-
-        Unreviewed chromium build fix.
-
-        [Chromium] Let CodeGeneratorV8.pm know that RGBColor is ref-counted.
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-
-2009-08-13  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Merge error in SharedWorker code
-        https://bugs.webkit.org/show_bug.cgi?id=28277
-
-        Fixed merge error that prevents WebKit from compiling with SHARED_WORKERS enabled.
-        No new tests needed.
-
-        * workers/DefaultSharedWorkerRepository.cpp:
-        Removed duplicated functions.
+        * loader/ProgressTracker.cpp:
+        (WebCore::ProgressTracker::progressStarted):
+        (WebCore::ProgressTracker::progressCompleted):
+        (WebCore::ProgressTracker::finalProgressComplete):
+        (WebCore::ProgressTracker::incrementProgress):
 
-2009-08-13  Kyle Prete  <kylep@chromium.org>
+        * platform/Logging.cpp:
+        (WebCore::):
+        (WebCore::getChannelFromName):
+        * platform/Logging.h:
 
-        Reviewed by Dave Levin.
+2010-02-15  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Chromium: Show a "Playback Disabled" button on media error.
-        https://bugs.webkit.org/show_bug.cgi?id=28196
-        Use a disabled play button when the media file cannot be played.
+        Reviewed by Simon Hausmann.
 
-        No new tests needed. Covered by LayoutTests/media/video-empty-source.html
+        [Qt] QtWebkit bridge: enable passing a QWebElement to a signal/slot/property
+        https://bugs.webkit.org/show_bug.cgi?id=34901
 
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+        When a signal/slot/property is of type QWebElement, it can seamlessly
+        connect with JS objects that hold a WebCore element.
 
-2009-08-13  Mark Rowe  <mrowe@apple.com>
-
-        Try and fix the Qt build.
+        New tests, see WebKit/qt/ChangeLog
 
         * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtWebElementRuntime::create): A proxy to QWebElement
+        constructor
+        (JSC::Bindings::QtWebElementRuntime::get): A proxy to
+        QWebElement::element
+        (JSC::Bindings::convertValueToQVariant): handle QWebElement
+        (JSC::Bindings::convertQVariantToValue): handle QWebElement
 
-2009-08-13  Zan Dobersek  <zandobersek@gmail.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] Drag and drop support
-        https://bugs.webkit.org/show_bug.cgi?id=23642
-
-        Utilizes functions that are being called upon drag and drop actions.
-        Uses different GTK clipboards that hold different types
-        of drag data - images, HTML markup, text, URL, URL label.
-        Also clears each clipboard before setting new data to it.
-
-        No new tests - despite some implementations, no new functionality
-        is added until implementations of the GTK drag and drop protocol
-        in WebKit part.
-
-        * platform/gtk/ClipboardGtk.cpp:
-        (WebCore::ClipboardGtk::ClipboardGtk):
-        (WebCore::ClipboardGtk::~ClipboardGtk):
-        (WebCore::getCachedImage):
-        (WebCore::ClipboardGtk::declareAndWriteDragImage):
-        (WebCore::ClipboardGtk::writeURL):
-        (WebCore::ClipboardGtk::writeRange):
-        * platform/gtk/ClipboardGtk.h: ClipboardGdk -> ClipboardGtk
-
-2009-08-13  Darin Adler  <darin@apple.com>
-
-        Reviewed by David Levin.
-
-        JavaScriptCore tweaks to get ready for the parser arena
-        https://bugs.webkit.org/show_bug.cgi?id=28243
+2010-02-15  Pavel Feldman  <pfeldman@chromium.org>
 
-        * ForwardingHeaders/runtime/CollectorHeapIterator.h: Removed.
+        Not reviewed, Chromium build fix (force conversion of property names to
+        strings in Web Inspector's injected script).
 
-        * WebCore.xcodeproj/project.pbxproj: Exposed a couple header
-        files as Private that are now needed to compile Mac WebKit.
-
-        * bindings/js/JSAudioConstructor.cpp:
-        * bindings/js/JSDOMBinding.cpp:
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        * bindings/js/JSHTMLInputElementCustom.cpp:
-        * bindings/js/JSHistoryCustom.cpp:
-        * bindings/js/JSImageConstructor.cpp:
-        * bindings/js/JSLazyEventListener.cpp:
-        * bindings/js/JSLocationCustom.cpp:
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        * bindings/js/JSOptionConstructor.cpp:
-        * bindings/js/JSWebSocketConstructor.cpp:
-        * bindings/js/JSWebSocketCustom.cpp:
-        * bindings/js/JSWorkerConstructor.cpp:
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        * bridge/jni/jni_jsobject.mm:
-        Updated includes.
-
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::sourceParsed):
-        Change to not assert if this is called with no listeners.
-        I don't think this was guaranteed before, and we now use
-        this code path when recompiling. Slightly less efficient,
-        but this is a one-time cost when turning on the debugger.
-        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
-        Change to call Debugger::recompileAllJSFunctions.
-
-2009-08-13  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        <rdar://problem/7138591> and https://bugs.webkit.org/show_bug.cgi?id=28260
-        onhashchange property cannot be set from javascript.
-
-        Test: fast/loader/onhashchange-attribute-listeners.html
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
 
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::onhashchange):
-        (WebCore::HTMLBodyElement::setOnhashchange):
-        * html/HTMLBodyElement.h:
-        * html/HTMLBodyElement.idl:
+2010-02-15  Pavel Feldman  <pfeldman@chromium.org>
 
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::onhashchange):
-        (WebCore::HTMLFrameSetElement::setOnhashchange):
-        * html/HTMLFrameSetElement.h:
-        * html/HTMLFrameSetElement.idl:
+        Not reviewed: touch InspectorController in order to kick win bot tests
+        with new injected script contents.
 
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::onhashchange):
-        (WebCore::DOMWindow::setOnhashchange):
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-
-2009-08-13  Mark Rowe  <mrowe@apple.com>
+        * inspector/InspectorController.cpp:
 
-        Reviewed by Geoff Garen.
+2010-02-14  Pavel Feldman  <pfeldman@chromium.org>
 
-        Fix leaks of RGBColor instances from below SVGColor::rgbColor.
+        Reviewed by Timothy Hatcher.
 
-        * svg/SVGColor.cpp:
-        (WebCore::SVGColor::rgbColor): Return a PassRefPtr to ensure that the newly-allocated
-        RGBColor is cleaned up by the caller.
-        * svg/SVGColor.h:
+        Web Inspector: highlight actual search match in elements panel.
 
-2009-08-13  Pavel Feldman  <pfeldman@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=34251
 
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Migrate to DOMAgent (serialized access to DOM).
-
-        https://bugs.webkit.org/show_bug.cgi?id=28177
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::highlightDOMNode):
-        (WebCore::JSInspectorBackend::nodeForId):
-        (WebCore::JSInspectorBackend::idForNode):
-        (WebCore::JSInspectorBackend::wrapObject):
-        (WebCore::JSInspectorBackend::unwrapObject):
-        (WebCore::JSInspectorBackend::pushNodePathToFrontend):
-        (WebCore::JSInspectorBackend::selectDatabase):
-        (WebCore::JSInspectorBackend::selectDOMStorage):
-        * bindings/js/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/js/ScriptObjectQuarantine.h:
-        * bindings/js/ScriptValue.cpp:
-        (WebCore::ScriptValue::isObject):
-        * bindings/js/ScriptValue.h:
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/v8/ScriptObjectQuarantine.h:
-        * bindings/v8/ScriptValue.h:
-        (WebCore::ScriptValue::isObject):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * inspector/ConsoleMessage.cpp:
-        (WebCore::ConsoleMessage::ConsoleMessage):
-        * inspector/ConsoleMessage.h:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::clearMessages):
-        (WebCore::InspectorBackend::loaded):
-        (WebCore::InspectorBackend::highlight):
-        (WebCore::InspectorBackend::nodeForId):
-        (WebCore::InspectorBackend::idForNode):
-        (WebCore::InspectorBackend::wrapObject):
-        (WebCore::InspectorBackend::unwrapObject):
-        (WebCore::InspectorBackend::pushNodePathToFrontend):
-        (WebCore::InspectorBackend::addNodesToSearchResult):
-        (WebCore::InspectorBackend::selectDatabase):
-        (WebCore::InspectorBackend::selectDOMStorage):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        (WebCore::InspectorController::focusNode):
-        (WebCore::InspectorController::addMessageToConsole):
-        (WebCore::InspectorController::clearConsoleMessages):
-        (WebCore::InspectorController::startGroup):
-        (WebCore::InspectorController::scriptObjectReady):
-        (WebCore::InspectorController::setFrontendProxyObject):
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::wrapObject):
-        (WebCore::InspectorController::unwrapObject):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::setDocument):
-        (WebCore::InspectorDOMAgent::handleEvent):
-        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
-        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
-        (WebCore::InspectorDOMAgent::nodeForId):
-        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
-        (WebCore::InspectorDOMAgent::buildObjectForNode):
-        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
-        (WebCore::InspectorDOMAgent::innerParentElement):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::bind):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::clearConsoleMessages):
-        (WebCore::InspectorFrontend::updateFocusedNode):
-        (WebCore::InspectorFrontend::setDocument):
-        (WebCore::InspectorFrontend::selectDatabase):
-        (WebCore::InspectorFrontend::selectDOMStorage):
-        (WebCore::InspectorFrontend::addNodesToSearchResult):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.clearMessages):
-        (WebInspector.ConsoleView.prototype.completions):
-        (WebInspector.ConsoleView.prototype._reportCompletions):
-        (WebInspector.ConsoleView.prototype._messagesClicked):
-        (WebInspector.ConsoleView.prototype.doEvalInWindow.evalCallback):
-        (WebInspector.ConsoleView.prototype.doEvalInWindow):
-        (WebInspector.ConsoleView.prototype._format):
-        (WebInspector.ConsoleView.prototype._formatfunction):
-        (WebInspector.ConsoleView.prototype._formatdate):
-        (WebInspector.ConsoleView.prototype._formatregexp):
-        (WebInspector.ConsoleView.prototype._formatnode):
-        (WebInspector.ConsoleView.prototype._formatobject):
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMNode):
-        (WebInspector.DOMNode.prototype._renumber):
-        (WebInspector.DOMDocument):
-        (WebInspector.DOMAgent):
-        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
-        (WebInspector.DOMAgent.prototype.setAttributeAsync):
-        (WebInspector.DOMAgent.prototype.removeAttributeAsync):
-        (WebInspector.DOMAgent.prototype.setTextNodeValueAsync):
-        (WebInspector.DOMAgent.prototype.nodeForId):
-        (WebInspector.DOMAgent.prototype._setDocument):
-        (WebInspector.DOMAgent.prototype._setChildNodes):
-        (WebInspector.DOMAgent.prototype._bindNodes):
-        (WebInspector.DOMAgent.prototype._childNodeInserted):
-        (WebInspector.CSSStyleDeclaration):
-        (WebInspector.CSSStyleDeclaration.parseRule):
-        (WebInspector.setDocument):
-        (InspectorController.getStyles):
-        (InspectorController.getComputedStyle):
-        (InspectorController.getInlineStyle):
-        (InspectorController.applyStyleText):
-        (InspectorController.setStyleText):
-        (InspectorController.toggleStyleEnabled):
-        (InspectorController.applyStyleRuleText):
-        (InspectorController.addStyleSelector):
-        (InspectorController.setStyleProperty):
-        (InspectorController.getPrototypes):
-        (InspectorController.getProperties):
-        (InspectorController.setPropertyValue):
-        (InspectorController.evaluate):
-        (InspectorController.addInspectedNode):
-        (InspectorController.performSearch):
-        (InspectorController.searchCanceled):
         * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
         (WebInspector.ElementsPanel.prototype.searchCanceled):
         (WebInspector.ElementsPanel.prototype.performSearch):
-        (WebInspector.ElementsPanel.prototype._updateMatchesCount):
-        (WebInspector.ElementsPanel.prototype._updateMatchesCountSoon):
         (WebInspector.ElementsPanel.prototype.addNodesToSearchResult):
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode.restoreHighlightToHoveredNode):
-        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
-        (WebInspector.ElementsTreeElement.prototype.updateChildren):
-        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        (WebInspector.ElementsPanel.prototype.jumpToNextSearchResult):
+        (WebInspector.ElementsPanel.prototype.jumpToPreviousSearchResult):
+        (WebInspector.ElementsPanel.prototype._highlightCurrentSearchResult):
+        (WebInspector.ElementsPanel.prototype._hideSearchHighlights):
         * inspector/front-end/InjectedScript.js:
-        (InjectedScript.applyStyleRuleText):
-        (InjectedScript.addStyleSelector):
-        (InjectedScript._doesSelectorAffectNode):
-        (InjectedScript._serializeRule):
-        (InjectedScript._serializeStyle):
-        (InjectedScript.getProperties):
-        (InjectedScript.evaluate):
-        (InjectedScript.addInspectedNode):
-        (InjectedScript.performSearch.addNodesToResults):
-        (InjectedScript.performSearch.matchExactItems):
-        (InjectedScript.performSearch.matchExactId.addNodesToResults.call):
-        (InjectedScript.performSearch.matchExactId):
-        (InjectedScript.performSearch):
-        (InjectedScript.performSearch.matchExactTagNames):
-        (InjectedScript.performSearch.matchExactAttributeNames):
-        (InjectedScript.performSearch.matchPartialTagNames):
-        (InjectedScript.performSearch.matchStartOfTagNames):
-        (InjectedScript.performSearch.matchPartialTagNamesAndAttributeValues):
-        (InjectedScript.performSearch.matchPartialAttributeValues):
-        (InjectedScript.performSearch.matchStyleSelector):
-        (InjectedScript.performSearch.matchPlainText):
-        (InjectedScript.performSearch.matchXPathQuery):
-        (InjectedScript.performSearch.finishedSearching):
-        (InjectedScript.performSearch.processChunk):
-        (InjectedScript.searchCanceled):
-        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
-        (InjectedScript._ensureCommandLineAPIInstalled):
-        (InjectedScript._resolveObject):
-        (InjectedScript._nodeForId):
-        (InjectedScript._objectForId):
-        (InjectedScript._createProxyObject):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
-        (WebInspector.ObjectPropertyTreeElement.prototype.update):
-        * inspector/front-end/ObjectProxy.js:
-        (WebInspector.ObjectProxy):
-        (WebInspector.ObjectPropertyProxy):
-        * inspector/front-end/PropertiesSidebarPane.js:
-        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
-        (WebInspector.PropertiesSidebarPane.prototype.update):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype.update.callback):
-        (WebInspector.StylesSidebarPane.prototype.update):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
-        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted.callback):
-        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
-        (WebInspector.StylePropertyTreeElement.prototype):
-        * inspector/front-end/inspector.js:
-        (WebInspector._updateHoverHighlight):
-        (WebInspector.loaded):
-        (WebInspector.clearConsoleMessages):
-        (WebInspector.selectDatabase):
-        (WebInspector.selectDOMStorage):
-        (WebInspector.updateFocusedNode):
-        (WebInspector.addNodesToSearchResult):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.findSearchMatches):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._paintLine):
+        * inspector/front-end/textViewer.css:
         * inspector/front-end/utilities.js:
-        (Object.proxyType):
-        * storage/Storage.h:
-        (WebCore::Storage::frame):
-
-2009-08-13  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Geoff Garen.
-
-        Fix leaks of RGBColor instances from below CSSPrimitiveValue::getRGBColorValue.
+2010-02-14  Pavel Feldman  <pfeldman@chromium.org>
 
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::getRGBColorValue): Return a PassRefPtr to ensure that the
-        newly-allocated RGBColor is cleaned up by the caller.
-        * css/CSSPrimitiveValue.h:
-
-2009-08-13  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by David Hyatt.
-
-        wrong font size when css font-family includes monospace
-        https://bugs.webkit.org/show_bug.cgi?id=19161
-
-        Firefox only uses fixed-width default size for exactly "font-family: monospace;".
-        WebKit has historically used fixed-width default size any time a
-        font-family includes monospace in the fallback list.
-
-        This patch corrects WebKit's behavior to match Firefox.
-        I also had to fix a bug in WebKit's font-family fallback behavior where
-        child elements would inherit parts of their parents fallback lists.
-
-        This patch is mostly just replacing all cases where we used to check for:
-        fontDescription.genericFontFamily() == MonospaceFamily
-        with:
-        fontDescription.useFixedDefaultSize()
-
-        Tests: fast/css/getComputedStyle/computed-style-font-family-monospace.html
-               fast/css/getComputedStyle/font-family-fallback-reset.html
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-           Deploy useFixedDefaultSize().  Also fix the bug where child
-           FontDescriptions would carry part of the parent font-family fallback list.
-        (WebCore::CSSStyleSelector::checkForGenericFamilyChange):
-           It's no longer alright to just check genericFontFamily(),
-           we have to check to make sure the changed style has a matching useFixedDefaultSize().
-        * platform/graphics/FontDescription.h:
-        (WebCore::FontDescription::useFixedDefaultSize):
-           Only use the fixed default size if we have one font family and it is "monospace".
-           "-webkit-monospace" is the internal representation of the CSS identifier "monospace".
-
-2009-08-13  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+        Reviewed by Timothy Hatcher.
 
-        Reviewed by Dimitri Glazkov.
+        Web Inspector: XPathResult objects are not expanded in console.
 
-        [v8] Fix atomic string externalization crash.
-        Atomic string externalization assumes that all non-empty strings
-        can be externalized which is untrue on 64-bit.  This change fixed
-        that.
+        https://bugs.webkit.org/show_bug.cgi?id=34926
 
-        https://bugs.webkit.org/show_bug.cgi?id=28215
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
+        (WebInspector.ObjectPropertiesSection.CompareProperties):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/Section.js:
+        (WebInspector.Section):
+        * inspector/front-end/inspector.css:
 
-        This bug causes loads of test crashes, no need to add new tests
-        specifically for this.
+2010-02-10  Philippe Normand  <pnormand@igalia.com>
 
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8StringToAtomicWebCoreString):
+        Reviewed by Gustavo Noronha Silva.
 
-2009-08-13  George Staikos  <george.staikos@torchmobile.com>
+        [Gtk] wrong video aspect ratio
+        https://bugs.webkit.org/show_bug.cgi?id=34790
 
-        Rubberstamped by Darin Adler.
+        Fixed natural size calculation regarding pixel aspect ratio and
+        display aspect ratio.
 
-        Use ASSERT_UNUSED instead of UNUSED_PARAM
+        Test: media/video-display-aspect-ratio.html
 
-        * wml/WMLAnchorElement.cpp:
-        (WebCore::WMLAnchorElement::deregisterTask):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::deregisterTask):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::greatestCommonDivisor):
+        (WebCore::MediaPlayerPrivate::naturalSize):
 
-2009-08-13  Steve Block  <steveblock@google.com>
+2010-02-14  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Darin Adler.
 
-        Fixes a couple of bugs in SecurityOrigin::createFromDatabaseIdentifier.
-        https://bugs.webkit.org/show_bug.cgi?id=28262
+        HTML5 iframe sandbox bypass of window.top.location navigation via <form target="_top">
+        https://bugs.webkit.org/show_bug.cgi?id=33277
 
-        No new tests possible.
-
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
+        submitForm wasn't respecting shouldAllowNavigation.  Instead of calling
+        the wrapper function, we need to call shouldAllowNavigation because we
+        need to handle the "frame not found" case differently than the
+        "navigation denied" case.
 
-2009-08-13  Dirk Schulze  <krit@webkit.org>
+        Test: http/tests/security/sandboxed-iframe-form-top.html
 
-        Reviewed by Eric Seidel.
-
-        [CAIRO] getImageData fails on a given rect bigger than the image rect
-
-        The destination image and the source image was mixed up on creating the
-        imageData.
-
-        This is just a clean up and doesn't affect the current behavior. It's not
-        possible to test this failure in a LayoutTest. Only canvas uses getImageData
-        at the moment and returns before calling getImageData, if the image rect does
-        not contain the requested rect.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm):
 
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::getImageData):
+2010-02-14  Kent Tamura  <tkent@chromium.org>
 
-2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+        No review. Touch RenderRuny*.cpp to fix Chromium/Windows build bot.
 
-        Reviewed by Eric Seidel.
+        * rendering/RenderRuby.cpp: Add a comment for #endf.
+        * rendering/RenderRubyBase.cpp: Add a comment for #endf.
+        * rendering/RenderRubyRun.cpp: Add a comment for #endf.
+        * rendering/RenderRubyText.cpp: Add a comment for #endf.
 
-        [Haiku] Adding RenderTheme to WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=28258
-
-        * platform/haiku/RenderThemeHaiku.cpp: Added.
-        (WebCore::RenderThemeHaiku::create):
-        (WebCore::RenderTheme::themeForPage):
-        (WebCore::RenderThemeHaiku::RenderThemeHaiku):
-        (WebCore::RenderThemeHaiku::~RenderThemeHaiku):
-        (WebCore::supportsFocus):
-        (WebCore::RenderThemeHaiku::supportsFocusRing):
-        (WebCore::RenderThemeHaiku::platformActiveSelectionBackgroundColor):
-        (WebCore::RenderThemeHaiku::platformInactiveSelectionBackgroundColor):
-        (WebCore::RenderThemeHaiku::platformActiveSelectionForegroundColor):
-        (WebCore::RenderThemeHaiku::platformInactiveSelectionForegroundColor):
-        (WebCore::RenderThemeHaiku::platformTextSearchHighlightColor):
-        (WebCore::RenderThemeHaiku::systemFont):
-        (WebCore::RenderThemeHaiku::paintCheckbox):
-        (WebCore::RenderThemeHaiku::setCheckboxSize):
-        (WebCore::RenderThemeHaiku::paintRadio):
-        (WebCore::RenderThemeHaiku::setRadioSize):
-        (WebCore::RenderThemeHaiku::adjustMenuListStyle):
-        (WebCore::RenderThemeHaiku::paintMenuList):
-        * platform/haiku/RenderThemeHaiku.h: Added.
-        (WebCore::RenderThemeHaiku::supportsHover):
-
-2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+2010-02-13  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Timothy Hatcher.
 
-        [Haiku] Remove the "m_point" code from ContextMenuHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28256
+        Web Inspector: cache created row, span and text elements
+        in TextView to improve scroller performance on debug build.
 
-        * platform/haiku/ContextMenuHaiku.cpp:
-        (WebCore::ContextMenuReceiver::ContextMenuReceiver):
-        (WebCore::ContextMenu::ContextMenu):
-        (WebCore::ContextMenu::appendItem):
-        (WebCore::ContextMenu::insertItem):
+        https://bugs.webkit.org/show_bug.cgi?id=34921
 
-2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.set visible):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer):
+        (WebInspector.TextViewer.prototype.freeCachedElements):
+        (WebInspector.TextViewer.prototype._buildChunks):
+        (WebInspector.TextViewer.prototype._makeLineAChunk):
+        (WebInspector.TextViewer.prototype._paintLine):
+        (WebInspector.TextViewer.prototype._releaseLines):
+        (WebInspector.TextViewer.prototype._appendSpan):
+        (WebInspector.TextViewer.prototype._appendTextNode):
+        (WebInspector.TextChunk):
+        (WebInspector.TextChunk.prototype.set expanded):
+        (WebInspector.TextChunk.prototype._lineNumberText):
+        (WebInspector.TextChunk.prototype._createRow):
+
+2010-02-13  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Inspector: Show Hidden Cookie Data
-        https://bugs.webkit.org/show_bug.cgi?id=28185
-
-          Added new file Cookie.h to the WebCore XCode
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-          InspectorController.cookies() binding
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::cookies):
-        * inspector/InspectorBackend.idl:
-
-          Struct for static Cookie information
-          (name, value, path, domain, expires, httpOnly, secure, session)
-
-        * platform/Cookie.h: Added.
-        (WebCore::Cookie::Cookie):
-        
-          Getter for the a list of raw Cookies
-          getRawCookies(., ., out Vector<Cookie>)
-        
-        * platform/CookieJar.h:
-
-          Implementation of getRawCookies for the mac platform.
-
-        * platform/mac/CookieJar.mm:
-        (WebCore::getRawCookies):
-
-          Stub other CookieJar implementations to satisfy the interface.
+        Refactor parsing/serialization functions in HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=34852
 
-        * platform/haiku/CookieJarHaiku.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/chromium/CookieJarChromium.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/curl/CookieJarCurl.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/soup/CookieJarSoup.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/win/CookieJarWin.cpp:
-        (WebCore::getRawCookies):
-        * platform/qt/CookieJarQt.cpp:
-        (WebCore::getRawCookies):
-
-2009-08-13  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Add a new gesture in Web Inspector to remove breakpoints
-        https://bugs.webkit.org/show_bug.cgi?id=19131
+        - Rename formStringToDouble() to parseToDoubleForNumberType()
+        - Rename formStringToDateComponents() to parseToDateComponents()
+        - Rename formStringFromDouble() to serializeForNumberType()
+        - Add serializeForDateTimeTypes()
+          The code is moved from setValueAsDate() and setDateValue().
+        - Add serialize()
         
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._documentMouseDown):
+        parseToDouble() is the top-level function to parse a
+        type-dependent string and return a double
+        value. parseToDoubleForNumber() and parseToDateComponents()
+        functions are helper functions for it. serialize() is the
+        top-level function to serialize a double value to a type-dependent
+        string, and serializeForNumberType() and
+        serializeForDateTimeTypes() are helper functions for it.
 
-2009-08-13  Norbert Leser  <norbert.leser@nokia.com>
-
-        Reviewed by Simon Hausmann.
+        No tests because of no functional changes.
 
-        Symbian target components (library and executable files)
-        require Unique Identifiers (i.e., UID3).
-        These identifiers are defined in the respective project
-        file, conditionally for "symbian" platform.
-
-        * WebCore.pro:
-
-2009-08-13  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        wrong calculation of overflow size for flexbox and table
-        https://bugs.webkit.org/show_bug.cgi?id=28064
-
-        RenderFlexibleBox and RenderTable were using the width of overflow
-        to update height of overflow, so height became wrong value and
-        width was not updated. As the corresponding code of RenderBlock
-        was sane, I factored it out and used from RenderFlexibleBox and
-        RenderTable.
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::updateOverflowWithShadowAndReflection): created from code of layoutBlock
-        (WebCore::RenderBlock::layoutBlock):
-        * rendering/RenderBlock.h:
-        * rendering/RenderFlexibleBox.cpp: use updateOverflowWithShadowAndReflection
-        (WebCore::RenderFlexibleBox::layoutBlock):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout): use updateOverflowWithShadowAndReflection
-
-2009-08-13  Mark Rowe  <mrowe@apple.com>
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::stepMismatch):
+        (WebCore::HTMLInputElement::getAllowedValueStep):
+        (WebCore::HTMLInputElement::parseToDouble):
+        (WebCore::HTMLInputElement::valueAsDate):
+        (WebCore::HTMLInputElement::setValueAsDate):
+        (WebCore::HTMLInputElement::setValueAsNumber):
+        (WebCore::HTMLInputElement::serializeForDateTimeTypes):
+        (WebCore::HTMLInputElement::serialize):
+        (WebCore::HTMLInputElement::serializeForNumberType):
+        (WebCore::HTMLInputElement::parseToDoubleForNumberType):
+        (WebCore::HTMLInputElement::parseToDateComponents):
+        * html/HTMLInputElement.h:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::valueFromElement):
+        (WebCore::RenderSlider::updateFromElement):
+        (WebCore::RenderSlider::setValueForPosition):
 
-        Revert r47185, the fix for <https://bugs.webkit.org/show_bug.cgi?id=28185>, as it broke the
-        Windows build in a non-obvious manner.
+2010-01-05  Ojan Vafai  <ojan@chromium.org>
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * inspector/InspectorBackend.idl:
-        * platform/Cookie.h: Removed.
-        * platform/CookieJar.h:
-        * platform/haiku/CookieJarHaiku.cpp:
-        (WebCore::setCookies):
-        (WebCore::cookies):
-        * platform/mac/CookieJar.mm:
-        * platform/network/chromium/CookieJarChromium.cpp:
-        * platform/network/curl/CookieJarCurl.cpp:
-        * platform/network/soup/CookieJarSoup.cpp:
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        * platform/network/win/CookieJarWin.cpp:
-        * platform/qt/CookieJarQt.cpp:
+        Reviewed by Dan Bernstein.
 
-2009-08-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
+        Improve text control intrinsic widths.
+        https://bugs.webkit.org/show_bug.cgi?id=25566
+        https://bugs.webkit.org/show_bug.cgi?id=25581
+        https://bugs.webkit.org/show_bug.cgi?id=25958
 
-        Not reviewed: build fix (for r47192), adding new file from
-        https://bugs.webkit.org/show_bug.cgi?id=28174
+        For Mac fonts that have invalid avgCharWidth entries in the OS/2 table,
+        fallback to the Safari 4- behavior of using the width of a zero. For other
+        fonts, make Mac match Windows (and thus IE) metrics.
 
-        * inspector/front-end/StatusBarButton.js: Added.
+        Lucida Grande is hard-coded to match MS Shell Dlg for inputs and
+        Courier New for textareas in order to match Safari Win, Firefox and, in
+        some cases IE (IE uses different default fonts depending on encoding).
 
-2009-08-13  Mikhail Naganov  <mnaganov@chromium.org>
+        The only case where we still don't match Windows is if no font-size is
+        set. The default font-size for form controls on the Mac is smaller and
+        thus text-control widths will be slightly smaller.
 
-        Reviewed by Timothy Hatcher.
+        No new tests. Covered by existing tests.
 
-        Introduced StatusBarButton class that encapsulates glyphs support.
-        Views updated accordingly.
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::):
+        (WebCore::RenderTextControl::hasValidAvgCharWidth):
+        (WebCore::RenderTextControl::getAvgCharWidth):
+        (WebCore::RenderTextControl::calcPrefWidths):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::scaleEmToUnits):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::getAvgCharWidth):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::getAvgCharWidth):
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+        * rendering/RenderTextControlSingleLine.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=28174
+2010-02-11  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView):
-        (WebInspector.CookieItemsView.prototype.get statusBarItems): Updated to retrieve DOM element from StatusBarButton instance (here and in similar getters below.)
-        (WebInspector.CookieItemsView.prototype.hide):
-        (WebInspector.CookieItemsView.prototype.update):
-        * inspector/front-end/DOMStorageItemsView.js:
-        (WebInspector.DOMStorageItemsView):
-        (WebInspector.DOMStorageItemsView.prototype.get statusBarItems):
-        (WebInspector.DOMStorageItemsView.prototype.hide):
-        (WebInspector.DOMStorageItemsView.prototype.update):
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel):
-        (WebInspector.ElementsPanel.prototype.get statusBarItems):
-        (WebInspector.ElementsPanel.prototype.hide):
-        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
-        * inspector/front-end/Panel.js:
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView):
-        (WebInspector.ProfileView.prototype.get statusBarItems):
-        (WebInspector.ProfileView.prototype._updatePercentButton):
-        (WebInspector.ProfileView.prototype._focusClicked):
-        (WebInspector.ProfileView.prototype._excludeClicked):
-        (WebInspector.ProfileView.prototype._resetClicked):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel):
-        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
-        (WebInspector.ProfilesPanel.prototype.setRecordingProfile):
-        (WebInspector.ProfilesPanel.prototype._updateInterface):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
-        (WebInspector.ResourcesPanel.prototype.reset):
-        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        (WebInspector.ScriptsPanel.prototype.get statusBarItems):
-        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
-        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
-        * inspector/front-end/StatusBarButton.js: Added.
-        (WebInspector.StatusBarButton):
-        (WebInspector.StatusBarButton.prototype._clicked):
-        (WebInspector.StatusBarButton.prototype.get disabled):
-        (WebInspector.StatusBarButton.prototype.set disabled):
-        (WebInspector.StatusBarButton.prototype.get title):
-        (WebInspector.StatusBarButton.prototype.set title):
-        (WebInspector.StatusBarButton.prototype.get toggled):
-        (WebInspector.StatusBarButton.prototype.set toggled):
-        (WebInspector.StatusBarButton.prototype.get visible):
-        (WebInspector.StatusBarButton.prototype.set visible):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.css: For uniformity, class names are always used to identify status bar buttons. Also, fixed "Reload" button style to use glyphs.
-        * inspector/front-end/inspector.html:
-
-2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Simon Hausmann.
+        [Qt] Unnecessary QBrush construction for doing a solid color stroke
+        https://bugs.webkit.org/show_bug.cgi?id=34874
 
-        [Qt] Add shadow support in GraphicsContext::fillRect().
+        Use the similar trick like in r54347, i.e. use the special brush for
+        solid color to avoid expensive QBrush constructor.
 
         * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::fillRect): Paint shadow if necessary.
-        (WebCore::GraphicsContext::setPlatformShadow): Inverse y offset.
-
-2009-08-13  David Levin  <levin@chromium.org>
-
-        Unreviewed build fix for Chromium Linux.
-
-        Rollback r47157 as this broke debug tests of Chromium Linux.
-
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintCommon):
-
-2009-08-13  David Levin  <levin@chromium.org>
-
-        Unreviewed build fix for chromium.
-
-        The chromium build broke due to r47185 which added
-        a cookies array to inspector/InspectorBackend.idl.
-
-        * bindings/v8/custom/V8CustomBinding.h: Added the declaration for the cookies callback.
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL(InspectorBackendCookies)): Stubbed out an implementation
-         for the cookies callback.
-
-2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Show Hidden Cookie Data
-        https://bugs.webkit.org/show_bug.cgi?id=28185
-
-          Added new file Cookie.h to the WebCore XCode
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-          InspectorController.cookies() binding
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::cookies):
-        * inspector/InspectorBackend.idl:
-
-          Struct for static Cookie information
-          (name, value, path, domain, expires, httpOnly, secure, session)
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
 
-        * platform/Cookie.h: Added.
-        (WebCore::Cookie::Cookie):
-        
-          Getter for the a list of raw Cookies
-          getRawCookies(., ., out Vector<Cookie>)
-        
-        * platform/CookieJar.h:
+2010-02-11  Darin Fisher  <darin@chromium.org>
 
-          Implementation of getRawCookies for the mac platform.
+        Reviewed by Jeremy Orlow.
 
-        * platform/mac/CookieJar.mm:
-        (WebCore::getRawCookies):
+        Pass the Document along to the ChromiumBridge cookie methods.
 
-          Stub other CookieJar implementations to satisfy the interface.
+        https://bugs.webkit.org/show_bug.cgi?id=34878
 
-        * platform/haiku/CookieJarHaiku.cpp:
-        (WebCore::getRawCookies):
+        * platform/chromium/ChromiumBridge.h:
         * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
         (WebCore::getRawCookies):
-        * platform/network/curl/CookieJarCurl.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/soup/CookieJarSoup.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/win/CookieJarWin.cpp:
-        (WebCore::getRawCookies):
-        * platform/qt/CookieJarQt.cpp:
-        (WebCore::getRawCookies):
-
-2009-08-08  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Cookies in Storage Panel
-        https://bugs.webkit.org/show_bug.cgi?id=27202
-
-          Data Structure for a Cookie. Just Key/Value for Now:
-
-        * inspector/front-end/Cookie.js: Added.
-        (WebInspector.Cookie):
-        (WebInspector.Cookie.prototype.get key):
-        (WebInspector.Cookie.prototype.set key):
-        (WebInspector.Cookie.prototype.get value):
-        (WebInspector.Cookie.prototype.set value):
-
-          A Storage View for Cookies.  Allows for Refresh/Delete:
-
-        * inspector/front-end/CookieItemsView.js: Added.
-        (WebInspector.CookieItemsView):
-        (WebInspector.CookieItemsView.prototype.get statusBarItems): refresh and delete buttons
-        (WebInspector.CookieItemsView.prototype.show):
-        (WebInspector.CookieItemsView.prototype.hide):
-        (WebInspector.CookieItemsView.prototype.update):
-        (WebInspector.CookieItemsView.prototype.buildCookies): parses the inspected window's document.cookie string
-        (WebInspector.CookieItemsView.prototype.dataGridForCookies): creates a datagrid for cookies
-        (WebInspector.CookieItemsView.prototype._deleteButtonClicked): attempt at deleting the cookie (not flawless)
-        (WebInspector.CookieItemsView.prototype._refreshButtonClicked): rebuild the datagrid
-
-          Include a SidebarSection Section in the Databases Panel:
-
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel):
-        (WebInspector.DatabasesPanel.prototype.show): calls populateInterface
-        (WebInspector.DatabasesPanel.prototype.populateInterface): adds cookies if they don't exist
-        (WebInspector.DatabasesPanel.prototype.reset): remove cookie specific parts
-        (WebInspector.DatabasesPanel.prototype.addCookies): add cookies sidebar tree element
-        (WebInspector.DatabasesPanel.prototype.showCookies): sets the visible view to a CookiesItemView
-        (WebInspector.CookieSidebarTreeElement):
-        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
-        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle): just "Cookies" at the moment
-        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
-        (WebInspector.CookieSidebarTreeElement.prototype.get subtitle): no subtitle yet
-        (WebInspector.CookieSidebarTreeElement.prototype.set subtitle):
-
-          New "Cookies" Image for the Sidebar:
-
-        * inspector/front-end/Images/cookie.png: Added.
-        * inspector/front-end/inspector.css:
-
-          Include the Added Files where appropriate:
-
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-
-2009-08-12  George Wright  <george.wright@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Add SQLTransactionCoordinator.[h,cpp] to WebCore.pro.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28246
-
-        * WebCore.pro:
-
-2009-08-12  George Staikos  <george.staikos@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Mark unused variables to avoid compile failures in -Werror.
-
-        * wml/WMLAnchorElement.cpp:
-        (WebCore::WMLAnchorElement::deregisterTask):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::deregisterTask):
-
-2009-08-12  Charles Wei  <charles.wei@torchmobile.com.cn>
-
-        Reviewed by Niko Zimmermann.
-
-        This is to add WCSS marquee support , which is defined by OMA and is an extension for CSS2, 
-        It extends CSS display with "display:-wap-marquee;-wap-marquee-dir:xxx;-wap-marquee-speed:xxx;-wap-marquee-style:xxx"
-        Minor fixes by Eric Seidel and George Staikos.
-        https://bugs.webkit.org/show_bug.cgi?id=23727
-
-        No new tests, the tests have already been landed at LayoutTests/fast/wcss/
-
-        * WebCore.pro:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * css/CSSValueKeywords.in:
-        * css/WCSSPropertyNames.in: Added.
-        * css/WCSSValueKeywords.in: Added.
-        * rendering/RenderMarquee.cpp:
-        (WebCore::RenderMarquee::start):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::createObject):
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-
-2009-08-12  George Wright  <george.wright@torchmobile.com>
-
-        Reviewed by David Hyatt.
-
-        Update the canvas renderer's intrinsic size with the zoomed
-        lengths and ensure the intrinsic size is correct when setting
-        an initial style.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26908
-
-        Test: fast/canvas/canvas-zoom.html
-
-        * rendering/RenderHTMLCanvas.cpp:
-        (WebCore::RenderHTMLCanvas::canvasSizeChanged):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::styleDidChange):
-
-2009-08-12  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by Simon Fraser.
-
-        Fix regression for dragging the media controller thumb.
-        https://bugs.webkit.org/show_bug.cgi?id=28211
-
-        Modified the conditions for rejecting events on the media controller
-        to only rejecting mouse events not from the left button.
-
-        Test: media/controls-drag-timebar.html
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlTimelineElement::defaultEventHandler):
-
-2009-08-12  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Eric Seidel.
+        (WebCore::deleteCookie):
 
-        Fixing a deadlock caused by two transactions that run on two
-        different database handles for the same DB. Adding a per-DB thread
-        transaction coordinator that allows the DB thread to run only one
-        transaction per DB file at any given time.
+2010-02-12  Eric Seidel  <eric@webkit.org>
 
-        Adding a regression test for this bug.
+        No review, rolling out r54694.
+        http://trac.webkit.org/changeset/54694
+        https://bugs.webkit.org/show_bug.cgi?id=34633
 
-        Test: storage/multiple-transactions-on-different-handles.html
+        This appears to have caused crashes on the Leopard bot.  See
+        bug 34898.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27966
+        * websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::WebSocket):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didClose):
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::WebSocketChannel):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::bufferedAmount):
+        (WebCore::WebSocketChannel::didClose):
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketChannelClient.h:
+        (WebCore::WebSocketChannelClient::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::workerContextDidClose):
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.h:
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * storage/Database.cpp:
-        (WebCore::Database::transactionCoordinator):
-        * storage/Database.h:
-        * storage/DatabaseThread.cpp:
-        (WebCore::DatabaseThread::DatabaseThread):
-        * storage/DatabaseThread.h:
-        (WebCore::DatabaseThread::transactionCoordinator):
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::SQLTransaction):
-        (WebCore::SQLTransaction::debugStepName):
-        (WebCore::SQLTransaction::performNextStep):
-        (WebCore::SQLTransaction::aquireLock):
-        (WebCore::SQLTransaction::lockAquired):
-        (WebCore::SQLTransaction::cleanupAfterSuccessCallback):
-        (WebCore::SQLTransaction::cleanupAfterTransactionErrorCallback):
-        * storage/SQLTransaction.h:
-        * storage/SQLTransactionCoordinator.cpp: Added.
-        * storage/SQLTransactionCoordinator.h: Added.
+2010-02-12  Gavin Barraclough  <barraclough@apple.com>
 
-2009-08-12  Darin Adler  <darin@apple.com>
+        Reviewed by Sam Weinig.
 
-        Reviewed by Geoff Garen.
+        Workers' EventListeners should be removed before JSGlobalData is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=34903
 
-        Custom properties on DOM objects are lost after GC (as demonstrated by the gc-9.html test)
-        https://bugs.webkit.org/show_bug.cgi?id=28194
+        (Patch co-developed with Alexey Proskuryakov).
 
-        * GNUmakefile.am: Added the two new source files.
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * WebCoreSources.bkl: Ditto.
+        Since http://trac.webkit.org/changeset/54460 the EventListeners registered by a
+        worker thread are not removed until after the thread's JSGlobalData has been
+        destroyed.  This is slightly worrisome since the JSEventListener contains
+        JSObject*s, which will be dangling once the heap is destroyed.  The
+        JSEventListeners may also reference the worker thread's normal world, which
+        again it makes no sense to keep around after the JSGlobalData is freed.
 
-        * bindings/js/JSCSSRuleListCustom.cpp: Added.
-        (WebCore::JSCSSRuleList::markChildren): Call markDOMObjectWrapper
-        on rules in the list.
+        Remove all event listeners immediately prior to tearing down the JSGlobalData.
 
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        (WebCore::JSCSSStyleDeclaration::markChildren): Added. Call
-        markDOMObjectWrapper on the CSSValue objects that are owned by the
-        declaration as values of the properties.
+        https://bugs.webkit.org/show_bug.cgi?id=34728 addressed the symptoms of this
+        problem, and it is probably cleaner to make the client data's normal world no
+        longer be a member (since it is a ref-counted object), however they should be
+        no requirement to 'detatch' – it makes no sense for anyone to be referencing
+        the world after the JSGlobalData has gone away (the world's purpose is to hold
+        wrapper objects in the JSGlobalData's heap).  Keep the restructuring that makes
+        the normal world no longer be a member, but remove the detach mechanism this
+        patch added & replace with stronger ASSERTs.
 
         * bindings/js/JSDOMBinding.cpp:
-        (WebCore::isObservableThroughDOM): Added code to handle some
-        cases where nodes are observable because they own objects that
-        in turn have custom properties.
-
-        * bindings/js/JSDOMBinding.h: Fix a typo in the header.
-
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::markChildren): Added call to markDOMObjectWrapper
-        for implementation and styleSheets.
-
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::JSElement::markChildren): Added. Calls markDOMObjectWrapper
-        for attributes and style.
-
-        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added.
-        (WebCore::JSHTMLCanvasElement::markChildren): Call markDOMObjectWrapper
-        on the rendering context.
-
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::JSStyleSheet::markChildren): Call markDOMObjectWrapper on
-        items in the stylesheet.
-
-        * bindings/js/JSStyleSheetListCustom.cpp:
-        (WebCore::JSStyleSheetList::markChildren): Added. Calls
-        markDOMObjectWrapper on stylesheets in the list.
-
-        * css/CSSRuleList.idl: Added CustomMarkFunction.
-        * css/CSSStyleDeclaration.idl: Ditto.
-        * css/StyleSheetList.idl: Ditto.
-        * dom/Element.idl: Ditto.
-        * html/HTMLCanvasElement.idl: Ditto.
-
-        * dom/Element.h: Made everything private that could be.
-        Added access to the attributeMap that does returns
-        the existing map without doing any of the lazy-updating work. This
-        is needed to get at the existing attributes during garbage collection
-        without having side effects.
-
-        * html/HTMLCanvasElement.h: Cleaned up the header a bit, making
-        members private. Added renderingContext2D function for use in
-        JSHTMLCanvasElement::markChildren.
-
-2009-08-12  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Fixes two bugs about Pan Scrolling - Scrolling with middle mouse button doesn't 
-        work in Expanded view on reader.google.com, and Can enter auto scroll from a non-scrollable area.
-        https://bugs.webkit.org/show_bug.cgi?id=28023
-        https://bugs.webkit.org/show_bug.cgi?id=24794
-        
-        Added a new method to RenderBox seeing if the Box can be scrolled and actually has something to
-        scroll, and use that for pan scrolling.
-
-        Test: platform/win/fast/events/panScroll-nested-divs.html
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMouseDraggedEvent):
-        (WebCore::EventHandler::updateAutoscrollRenderer):
-        (WebCore::EventHandler::handleMousePressEvent):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::canBeScrolledAndHasScrollableArea):
-        * rendering/RenderBox.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollByRecursively):
-
-2009-08-12  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Fix of <rdar://6728361> Mouse wheel scrolling on a page with expanded drop down 
-        list detaches drop down.
-
-        Added a function for Windows PopupMenu's to return their class name.
-
-         * platform/PopupMenu.h:
-         * platform/win/PopupMenuWin.cpp:
-         (WebCore::PopupMenu::popupClassName):
-
-2009-08-12  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Dan Bernstein.
-
-        WINCE PORT: Color and Gradient
-        https://bugs.webkit.org/show_bug.cgi?id=27511
-
-        * platform/graphics/wince/ColorWince.cpp: Added.
-        * platform/graphics/wince/GradientWince.cpp: Added.
-
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28172
-
-        No new tests because it's a just typo fix.
-
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintCommon):
-
-2009-08-12  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27458
-        Support for the :default CSS pseudoclass, as per HTML5 spec.
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/interactive-elements.html#selector-default
-
-        Tests: fast/css/pseudo-default-001.html
-               fast/css/pseudo-default-002.html
-               fast/css/pseudo-default-003.html
-               fast/css/pseudo-default-004.html
-
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): pseudoDefault
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::canShareStyleWithElement): sharing stuff is
-        aware that only one default button can be present in a form
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
-        the :default CSS pseudoclass
-        * dom/Element.h:
-        (WebCore::Element::isDefaultButtonForForm): new method to determine
-        whether a FormControl is a default button for a given form
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::isDefaultButtonForForm): ditto
-        * html/HTMLFormControlElement.h:
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::defaultButton): extracts the default button
-        from the form
-        * html/HTMLFormElement.h:
-
-2009-08-12  David Levin  <levin@chromium.org>
-
-        No review, rolling out r47106.
-        https://bugs.webkit.org/show_bug.cgi?id=28215
-
-        This patch relied on a new version of v8 which is not available
-        in chromium yet.
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8StringToAtomicWebCoreString):
-
-2009-08-12  Steve Block  <steveblock@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Bug 26993 : Geolocation::requestPermission()
-        https://bugs.webkit.org/show_bug.cgi?id=26993
-
-        Second patch to allow the Geolocation permission request to chrome to be asynchronous
-        or synchronous. Fixes a bug where callbacks were called twice when permissions
-        are granted synchronously.
-
-        No new tests required.
-
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::setIsAllowed): Modified. Calls makeSuccessCallbacks() rather than geolocationServicePositionChanged().
-        (WebCore::Geolocation::geolocationServicePositionChanged): Modified. Updated logic to avoid repeated callbacks when permissions are granted synchronously.
-        (WebCore::Geolocation::makeSuccessCallbacks): Added. Calls success callbacks.
-        * page/Geolocation.h: Modified. Adds makeSuccessCallbacks().
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::WebCoreJSClientData::~WebCoreJSClientData):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadShutdownStartTask::performTask):
 
-2009-08-12  Anders Carlsson  <andersca@apple.com>
+2010-02-12  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Sam Weinig.
 
-        <rdar://problem/6952336>
-        CrashTracer: [USER] 3 crashes in Safari at com.apple.WebCore • WebCore::SecurityOrigin::canAccess const 27
-
-        Make sure to set the security origin before calling dispatchWindowObjectAvailable.
-        
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-
-2009-08-12  Xiaomei Ji  <xji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fix [Chromium] drop down menu letter selection, skip selections
-        https://bugs.webkit.org/show_bug.cgi?id=28205
-
-        Not auto-testable since it is chromim platform specific code, and it involves sending a keyboard 
-        event to the popup, which is not possible (eventSender sends the key
-        events through webview, we want to go through the webwidget).
-
-        * manual-tests/keyboard_select_elements_with_same_beginning.html: Added.
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::isCharacterTypeEvent): style change.
-        (WebCore::PopupListBox::handleKeyEvent): typeAheadFind should be called only when the event is
-        a character type event to avoid calling twice for English.
-        (WebCore::PopupListBox::typeAheadFind): remove unnecessary checking of isCharacterTypeEvent() since the whole function is only called under that condition.
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding GraphicsContext to WebCore/platform/graphics/haiku.
-        https://bugs.webkit.org/show_bug.cgi?id=28130
-
-        * platform/graphics/haiku/GraphicsContextHaiku.cpp: Added.
-        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
-        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
-        (WebCore::GraphicsContext::GraphicsContext):
-        (WebCore::GraphicsContext::~GraphicsContext):
-        (WebCore::GraphicsContext::platformContext):
-        (WebCore::GraphicsContext::savePlatformState):
-        (WebCore::GraphicsContext::restorePlatformState):
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::GraphicsContext::drawEllipse):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::drawConvexPolygon):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::fillRoundedRect):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::beginPath):
-        (WebCore::GraphicsContext::addPath):
-        (WebCore::GraphicsContext::clip):
-        (WebCore::GraphicsContext::drawFocusRing):
-        (WebCore::GraphicsContext::drawLineForText):
-        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
-        (WebCore::GraphicsContext::roundToDevicePixels):
-        (WebCore::GraphicsContext::beginTransparencyLayer):
-        (WebCore::GraphicsContext::endTransparencyLayer):
-        (WebCore::GraphicsContext::clearRect):
-        (WebCore::GraphicsContext::strokeRect):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::GraphicsContext::setMiterLimit):
-        (WebCore::GraphicsContext::setAlpha):
-        (WebCore::GraphicsContext::setCompositeOperation):
-        (WebCore::GraphicsContext::clipOut):
-        (WebCore::GraphicsContext::clipToImageBuffer):
-        (WebCore::GraphicsContext::getCTM):
-        (WebCore::GraphicsContext::translate):
-        (WebCore::GraphicsContext::origin):
-        (WebCore::GraphicsContext::rotate):
-        (WebCore::GraphicsContext::scale):
-        (WebCore::GraphicsContext::clipOutEllipseInRect):
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::concatCTM):
-        (WebCore::GraphicsContext::setPlatformShouldAntialias):
-        (WebCore::GraphicsContext::setImageInterpolationQuality):
-        (WebCore::GraphicsContext::setURLForRect):
-        (WebCore::GraphicsContext::setPlatformFont):
-        (WebCore::GraphicsContext::setPlatformStrokeColor):
-        (WebCore::GraphicsContext::getHaikuStrokeStyle):
-        (WebCore::GraphicsContext::setPlatformStrokeStyle):
-        (WebCore::GraphicsContext::setPlatformStrokeThickness):
-        (WebCore::GraphicsContext::setPlatformFillColor):
-        (WebCore::GraphicsContext::clearPlatformShadow):
-        (WebCore::GraphicsContext::setPlatformShadow):
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Modifying WebCore/platform/graphics files to allow Haiku port.
-        https://bugs.webkit.org/show_bug.cgi?id=28128
-
-        * platform/graphics/BitmapImage.h: Adding getBBitmap() function.
-        * platform/graphics/Color.h: rgb_color is the Color struct in Haiku.
-        * platform/graphics/FloatPoint.h: BPoint is the Point class in Haiku.
-        * platform/graphics/FloatRect.h: BRect is the Rect class in Haiku.
-        * platform/graphics/GraphicsContext.cpp: 
-        * platform/graphics/GraphicsContext.h: BView is the PlatformGraphicsContext
-        class for Haiku. Adding getHaikuStrokeStyle() function.
-        * platform/graphics/Icon.h: Adding an empty Icon() constructor because
-        this class isn't implemented for the moment.
-        * platform/graphics/ImageSource.h: BBitmap is the native bitmap class 
-        for Haiku.
-        * platform/graphics/IntPoint.h: BPoint is the Point class in Haiku.
-        * platform/graphics/IntRect.h: BRect is the Rect class in Haiku.
-        * platform/graphics/IntSize.h: BSize is the Size class in Haiku.
-        * platform/graphics/Path.h: BRegion is the Path class in Haiku.
-        * platform/graphics/Pattern.h: Adding the GraphicsDef.h header and the 
-        native pattern type.
-        * platform/graphics/SimpleFontData.h: Adding Haiku's Font.h header.
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding modification to the WebCore/platform/ files to allow
-        the Haiku port.
-        https://bugs.webkit.org/show_bug.cgi?id=28128
-
-        * platform/ContextMenuItem.h: BMenu is the PlatformMenuItemDescription
-        class of Haiku.
-        * platform/Cursor.h: BCursor is the Cursor class of Haiku.
-        * platform/DragData.h: Use a BMessage as DragDataRef.
-        * platform/DragImage.h: Use a BBitmap as DragImageRef.
-        * platform/PlatformKeyboardEvent.h: Use BMessage as event vehicle.
-        * platform/PlatformMenuDescription.h: BMenu is the 
-        PlatformMenuDescription class of Haiku.
-        * platform/PlatformMouseEvent.h: Use BMessage as event vehicle.
-        * platform/PlatformWheelEvent.h: Use BMessage as event vehicle.
-        * platform/PopupMenu.h: Adding a m_menu attribute for Haiku.
-        * platform/Widget.h: BView is the PlatformWidget class of Haiku.
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Tiny modifications on WebCore files to allow Haiku port.
-        https://bugs.webkit.org/show_bug.cgi?id=28128
-
-        * bindings/js/ScriptControllerHaiku.cpp: Style cleanup.
-        * loader/CachedFont.cpp: Haiku behaves like Qt, Gtk, or Chromium,
-        so many PLATFORM(HAIKU) were added to these functions.
-        (WebCore::CachedFont::~CachedFont):
-        (WebCore::CachedFont::ensureCustomFontData):
-        (WebCore::CachedFont::platformDataFromCustomData):
-        (WebCore::CachedFont::allClientsRemoved):
-        * page/EventHandler.cpp: Like the mac and Qt port, Haiku doesn't need the
-        invertSenseOfTabsToLinks() function.
-        * page/haiku/DragControllerHaiku.cpp: Style cleanup.
-        * platform/image-decoders/ImageDecoder.h: For image decoding Haiku
-        behaves like Cairo or Wx, (not like Skia).
-        (WebCore::RGBA32Buffer::getAddr):
-        * platform/text/PlatformString.h: Adding the String(BString&) and BString()
-        methods specific to Haiku.
-        * platform/text/UnicodeRange.h: Haiku needs to include stdint.h.
-        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp:
-        (WebCore::currentSearchLocaleID): Missing function.
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding the ScrollbarTheme files.
-        https://bugs.webkit.org/show_bug.cgi?id=28125
-
-        * platform/haiku/ScrollbarThemeHaiku.cpp: Added.
-        (buttonWidth):
-        (WebCore::ScrollbarTheme::nativeTheme):
-        (WebCore::ScrollbarThemeHaiku::ScrollbarThemeHaiku):
-        (WebCore::ScrollbarThemeHaiku::~ScrollbarThemeHaiku):
-        (WebCore::ScrollbarThemeHaiku::scrollbarThickness):
-        (WebCore::ScrollbarThemeHaiku::hasButtons):
-        (WebCore::ScrollbarThemeHaiku::hasThumb):
-        (WebCore::ScrollbarThemeHaiku::backButtonRect):
-        (WebCore::ScrollbarThemeHaiku::forwardButtonRect):
-        (WebCore::ScrollbarThemeHaiku::trackRect):
-        (WebCore::ScrollbarThemeHaiku::paintScrollbarBackground):
-        (WebCore::ScrollbarThemeHaiku::paintButton):
-        (WebCore::ScrollbarThemeHaiku::paintThumb):
-        * platform/haiku/ScrollbarThemeHaiku.h: Added.
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding eight simple files to WebCore/platform/graphics/haiku.
-        https://bugs.webkit.org/show_bug.cgi?id=28122
-
-        * platform/graphics/haiku/ColorHaiku.cpp: Added.
-        (WebCore::Color::Color):
-        (WebCore::Color::operator rgb_color):
-        (WebCore::focusRingColor):
-        * platform/graphics/haiku/FloatPointHaiku.cpp: Added.
-        (WebCore::FloatPoint::FloatPoint):
-        (WebCore::FloatPoint::operator BPoint):
-        * platform/graphics/haiku/FloatRectHaiku.cpp: Added.
-        (WebCore::FloatRect::FloatRect):
-        (WebCore::FloatRect::operator BRect):
-        * platform/graphics/haiku/GradientHaiku.cpp: Added.
-        (WebCore::Gradient::platformDestroy):
-        (WebCore::Gradient::platformGradient):
-        (WebCore::Gradient::fill):
-        * platform/graphics/haiku/IntPointHaiku.cpp: Added.
-        (WebCore::IntPoint::IntPoint):
-        (WebCore::IntPoint::operator BPoint):
-        * platform/graphics/haiku/IntRectHaiku.cpp: Added.
-        (WebCore::IntRect::IntRect):
-        (WebCore::IntRect::operator BRect):
-        * platform/graphics/haiku/IntSizeHaiku.cpp: Added.
-        (WebCore::IntSize::IntSize):
-        (WebCore::IntSize::operator BSize):
-        * platform/graphics/haiku/PathHaiku.cpp: Added.
-        (WebCore::Path::Path):
-        (WebCore::Path::~Path):
-        (WebCore::Path::operator=):
-        (WebCore::Path::hasCurrentPoint):
-        (WebCore::Path::contains):
-        (WebCore::Path::translate):
-        (WebCore::Path::boundingRect):
-        (WebCore::Path::moveTo):
-        (WebCore::Path::addLineTo):
-        (WebCore::Path::addQuadCurveTo):
-        (WebCore::Path::addBezierCurveTo):
-        (WebCore::Path::addArcTo):
-        (WebCore::Path::closeSubpath):
-        (WebCore::Path::addArc):
-        (WebCore::Path::addRect):
-        (WebCore::Path::addEllipse):
-        (WebCore::Path::clear):
-        (WebCore::Path::isEmpty):
-        (WebCore::Path::debugString):
-        (WebCore::Path::apply):
-        (WebCore::Path::transform):
-        (WebCore::Path::strokeBoundingRect):
-
-2009-08-12  Lyon Chen  <lyon.chen@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        WINCE PORT: Implement Keygen for WINCE
-        https://bugs.webkit.org/show_bug.cgi?id=27543
-
-        * platform/wince/KeygenWince.cpp: Added.
-
-2009-08-12  Brent Fulgham  <bfulgham@webkit.org>
-
-        Rubber-stamped by Kevin Ollivier.
-
-        Handle crash in wx due to null value passed to strlen in
-        the CString constructor.
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::certificatePath):  Check for null return from getenv
-        and use default CString constructor instead.
-
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        WINCE PORT: simple stubs to make it build for WINCE
-        https://bugs.webkit.org/show_bug.cgi?id=27543
-
-        * platform/wince/DragDataWince.cpp: Added.
-        * platform/wince/DragImageWince.cpp: Added.
-        * platform/wince/EditorWince.cpp: Added.
-        * platform/wince/KURLWince.cpp: Added.
-
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        WINCEPORT: FileSystem and FileChooser
-        https://bugs.webkit.org/show_bug.cgi?id=27543
-
-        * platform/wince/FileChooserWince.cpp: Added.
-        * platform/wince/FileSystemWince.cpp: Added.
-
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from WebCore::StringImpl.
 
-        WINCE PORT: implement Cursor for WINCE. There's no real cursor on most
-        WinMob devices. We pass the cursor info to application, which so that 
-        can determine what to do.
-        https://bugs.webkit.org/show_bug.cgi?id=27543
+        These break the OS X Leaks tool.  Use a bits stolen from the refCount to hold the
+        'InTable' and 'HasTerminatingNullCharacter' flags, along with the string type
+        (fixes a leak where the string data is allocated at the address (this + 1), and is
+        misinterpreted as being an internal buffer).
 
-        * platform/wince/CursorWince.cpp: Added.
-
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by George Staikos.
+        * WebCore.base.exp:
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::createWithTerminatingNullCharacter):
+        (WebCore::StringImpl::crossThreadString):
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::):
+        (WebCore::StringImpl::hasTerminatingNullCharacter):
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+        (WebCore::StringImpl::ref):
+        (WebCore::StringImpl::deref):
+        (WebCore::StringImpl::hasOneRef):
+        (WebCore::StringImpl::operator new):
+        (WebCore::StringImpl::bufferOwnership):
+        * storage/OriginUsageRecord.cpp:
+        (WebCore::OriginUsageRecord::addDatabase):
+        (WebCore::OriginUsageRecord::markDatabase):
+
+2010-02-12  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Repaint bug on Text selection in foreignObject
+        https://bugs.webkit.org/show_bug.cgi?id=16939
+
+        Tests: svg/overflow/overflow-on-foreignObject.svg
+               svg/text/foreignObject-text-clipping-bug.xml
+
+        Selecting text contained in <foreignObject> leads to artefacts. Same for zooming/panning.
+        RenderForeignObject contained old legacy code returning FloatRect() for repaintRectInLocalCoordinates,
+        which is obviously wrong. Fixing that leads to even more problems, as the underlying RenderBlock
+        did not reflect the x/y translation set on the <foreignObject>. This is problematic, as laying out
+        positioned objects in the XHTML subtree depends on proper size/location values of the frameRect.
+
+        Correctly clip on overflow="hidden". overflow="scroll" & friends are not yet supported, see lengthy
+        comment in RenderSVGBlock why we either need RenderLayer for RenderForeignObject or need to rework
+        overflow handling to avoid RenderLayer.
+
+        SVGForeignObjectElement uses a hacky custom solution to synchronize CSS width/height properties with
+        the SVG width/height attributes. Remove all of that code and just implement calcWidth/calcHeight in
+        RenderForeignObject, grabbing the right values from SVGForeignObjectElement::width/height upon layout.
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::paint): Clip properly to the actual bounds of the foreignObject, respecting that x/y translation is handled by RenderBlock now.
+        (WebCore::RenderForeignObject::clippedOverflowRectForRepaint): Added missing function, forward to SVGRenderBase just like all other SVG renderers.
+        (WebCore::RenderForeignObject::computeRectForRepaint): Remove manual implementation, forward to SVGRenderBase.
+        (WebCore::RenderForeignObject::localToParentTransform): Respect x/y translation here _after_ applying localTransform().
+        (WebCore::RenderForeignObject::calcWidth): Override RenderBlock::calcWidth to grab width() from SVGForeignObjectElement.
+        (WebCore::RenderForeignObject::calcHeight): Override RenderBlock::calcHeight to grab height() from SVGForeignObjectElement.
+        (WebCore::RenderForeignObject::layout): Calculate viewport once and cache it. Push x/y location down to RenderBlock - analogous to RenderSVGText.
+        (WebCore::RenderForeignObject::nodeAtFloatPoint): Adapt to x/y translation changes (map through localTransform, not localToParentTransform). Respect overflow clipping.
+        (WebCore::RenderForeignObject::mapLocalToContainer): Set useTransforms=true, to avoid assertions when selecting text in foreign objects.
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::objectBoundingBox): Return cached m_viewport.
+        (WebCore::RenderForeignObject::strokeBoundingBox): Ditto.
+        (WebCore::RenderForeignObject::repaintRectInLocalCoordinates): Ditto.
+        * rendering/RenderSVGBlock.cpp:
+        (WebCore::RenderSVGBlock::setStyle): Cleanup code, move setHasOverflowClip() overrides in updateBoxModelInfoFromStyle where it belongs.
+        (WebCore::RenderSVGBlock::updateBoxModelInfoFromStyle): Added to force setting setHasOverflowClip(false).
+        * rendering/RenderSVGBlock.h:
+        * svg/SVGForeignObjectElement.cpp: Kill a lot of custom code - it was just plain wrong to utilize CSS to push width/height information down to RenderBlock.
+        (WebCore::SVGForeignObjectElement::svgAttributeChanged):
 
-        WINCE PORT: MIMETypeRegistry
-        https://bugs.webkit.org/show_bug.cgi?id=27543
+2010-02-12  Dan Bernstein  <mitz@apple.com>
 
-        * platform/wince/MIMETypeRegistryWince.cpp: Added.
+        Reviewed by Simon Fraser.
 
-2009-08-12  Joe Mason  <joe.mason@torchmobile.com>
+        <rdar://problem/7609268> REGRESSION (r50301): Problem selecting text in a Devanagari website
+        https://bugs.webkit.org/show_bug.cgi?id=34865
 
-        Reviewed by George Staikos.
+        Test: fast/text/glyph-reordering.html
 
-        WINCE PORT: Pasteboard and SearchPopupMenu
-        https://bugs.webkit.org/show_bug.cgi?id=27543
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun):
+        (WebCore::ComplexTextController::ComplexTextRun::setIsNonMonotonic): Added. Sets m_isMonotonic
+        and populates m_glyphEndOffsets with the end offsets of each glyph’s corresponding character range.
+        (WebCore::ComplexTextController::advance): For non-monotonic runs, use endOffsetAt() to get
+        glyphs’ end offsets.
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Check for monotonicity and call
+        setIsNonMonotonic() if needed.
+        * platform/graphics/mac/ComplexTextController.h:
+        (WebCore::ComplexTextController::ComplexTextRun::lastIndexAt): Added this getter.
+        (WebCore::ComplexTextController::ComplexTextRun::isMonotonic): Ditto.
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Initialize m_isMonotonic.
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Ditto.
 
-        * platform/wince/PasteboardWince.cpp: Added.
-        * platform/wince/SearchPopupMenuWince.cpp: Added.
+2010-02-12  Alexey Proskuryakov  <ap@apple.com>
 
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
+        Reviewed by David Levin.
 
-        Reviewed by George Staikos.
+        https://bugs.webkit.org/show_bug.cgi?id=34866
+        Leopard Debug Bot crashed on fast/forms/old-names.html
 
-        WINCE PORT: Add SharedTimerWince.cpp and SystemTimeWince.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27543
+        * html/HTMLFormCollection.cpp: (WebCore::HTMLFormCollection::formCollectionInfo): Removed
+        a misplaced checkConsistency() call. We are not looking at cache content at this point, and
+        caches will be reset on next access.
 
-        * platform/wince/SharedTimerWince.cpp: Added.
-        * platform/wince/SystemTimeWince.cpp: Added.
+2010-02-12  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-08-12  Mark Mentovai  <mark@chromium.org>
+        Reviewed by Timothy Hatcher.
 
-        Reviewed by Darin Adler.
+        Web Inspector: restore highlighting animation, bring back
+        keyboard navigation, beautify search results.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28204
-        Allow C+exceptions to be disabled in WebCore's V8 Mac build.
+        https://bugs.webkit.org/show_bug.cgi?id=34853
 
-        * WebCorePrefix.h:
-        Only undefine |try| and |catch| when building Objective-C[++],
-        leaving the C+library definitions intact for C++.
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer):
+        (WebInspector.TextViewer.prototype.highlightLine):
+        * inspector/front-end/textViewer.css:
 
-2009-08-12  Nate Chapin  <japhet@chromium.org>
+2010-02-12  Anton Muhin  <antonm@chromium.org>
 
         Reviewed by Adam Barth.
 
-        Add a Custom Setter for DOMWindowEvent in the V8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=27719
+        [v8] handle to the document can only own Objects, not Values
+        https://bugs.webkit.org/show_bug.cgi?id=34854
 
-        Tests: fast/events/set-event-in-another-frame.html
-               fast/events/set-event-to-null.html
-
-        * bindings/scripts/CodeGeneratorV8.pm: Clean up custom getter/setter code, 
-            as it currently doesn't support a custom getter 
-            and a v8-specific custom setter simultaneously.
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * page/DOMWindow.idl:
-
-2009-08-12  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Adam Treat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27965
-        Merge wx/ImageSourceWx.cpp into ImageSource.cpp.  No changes to
-        ImageSource.cpp were needed, so this just deletes ImageSourceWx.cpp.
-
-        * WebCore.gypi:
-        * WebCoreSources.bkl:
-        * platform/graphics/wx/ImageSourceWx.cpp: Removed.
-        * webcore-wx.bkl:
-
-2009-08-12  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Dave Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27933
-        Build fix after r47099.
-
-        * platform/graphics/skia/ImageBufferSkia.cpp:
-        (WebCore::getImageData):
-        (WebCore::putImageData):
-
-2009-08-08  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Adam Treat.
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::updateDocumentWrapper):
+        (WebCore::V8DOMWindowShell::updateDocumentWrapperCache):
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::toV8):
 
-        WINCE PORT: Implement Path for WINCE. Most code can be
-        reused for other ports that don't have native path support
-        https://bugs.webkit.org/show_bug.cgi?id=28188
+2010-02-12  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Written also by George Staikos (including quadCurve() and bezier())
+        Reviewed by Holger Freyther.
 
-        * platform/graphics/wince/PathWince.cpp: Added.
-        * platform/graphics/wince/PlatformPathWince.cpp: Added.
-        * platform/graphics/wince/PlatformPathWince.h: Added.
-        * platform/graphics/wince/WinceGraphicsExtras.h: Added.
+        Replaced stray CRLF with LF.
 
-2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::suggestedValue):
+        * wml/WMLInputElement.h:
 
-        "Double-click to add" new style button does not always show up [quick fix]
-        https://bugs.webkit.org/show_bug.cgi?id=28187
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+        Reviewed by Tor Arne Vestbø.
 
-2009-08-12  Crystal Zhang <crystal.zhang@torchmobile.com>
+        [Qt] Make qtlauncher and qgvlauncher use the generated headers
+        path to make sure they are correctly generated.
 
-        Reviewed by George Staikos.
+        * WebCore.pro:
 
-        WINCE PORT: MediaPlayerProxy and MediaPlayerPrivate
-        https://bugs.webkit.org/show_bug.cgi?id=28178
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        * platform/graphics/wince/MediaPlayerPrivateWince.h: Added.
-        * platform/graphics/wince/MediaPlayerProxy.cpp: Added.
-        * platform/graphics/wince/MediaPlayerProxy.h: Added.
+        Reviewed by Tor Arne Vestbø.
 
-2009-08-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        [Qt] Ensure relative paths in generated .pri files to ensure that
+        a source package with pre-generated derived sources can be compiled.
 
-        Reviewed by Eric Seidel.
+        - Re-add a separate headers.pri file for WEBKIT_API_HEADERS
+        - Rename the generated headers.pri to classheaders.pri to avoid
+        confusion with the one generated by synqt since they don't have the
+        same content.
+        - Remove private headers list variable from classheaders.pri
+        - Use $$PWD in classheaders.pri
+        - Remove classheaders.pri from the installed files
 
-        HTML 5 database and LocalStorage is not persistent on the Symbian port of QtWebKit
-        https://bugs.webkit.org/show_bug.cgi?id=28175
+        * WebCore.pro:
 
-        Call QDir::toNativeSeparators() before the path is passed to the OS.
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Based on work by David Leong.
-        
-        * platform/qt/FileSystemQt.cpp:
-        (WebCore::pathByAppendingComponent):
+        Reviewed by Tor Arne Vestbø.
 
-2009-08-12  Dirk Schulze  <krit@webkit.org>
+        [Qt] Manually add support for the install target on Symbian.
 
-        Reviewed by Ariya Hidayat.
+        This is required to copy the headers over the ones in Qt.
 
-        Minor build-fix for SVG Filter. Use getUnmultipliedImageData instead
-        of getImageData. This changed since r47099.
+        * WebCore.pro:
 
-        * platform/graphics/filters/FEColorMatrix.cpp:
-        (WebCore::FEColorMatrix::apply):
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-2009-08-12  Viet-Trung Luu  <viettrungluu@gmail.com>
+        Reviewed by Tor Arne Vestbø.
 
-        Reviewed by Dimitri Glazkov.
+        [Qt] Minor fixes on QtWebKit headers generation.
 
-        Explicitly set control tints for Chromium/Mac, since the controls'
-        NSCell(s) lack an NSView and hence their tint isn't updated
-        automatically when the application is activated/deactivated.
-        https://bugs.webkit.org/show_bug.cgi?id=28108
-        http://crbug.com/18199
+        - Adds QtWebKit to the generated headers destination path
+        - Improve compatibility with MinGW
 
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::updateNSCellControlTint):
-        (WebCore::RenderThemeChromiumMac::paintCheckbox):
-        (WebCore::RenderThemeChromiumMac::paintRadio):
-        (WebCore::RenderThemeChromiumMac::paintButton):
-        (WebCore::RenderThemeChromiumMac::paintMenuList):
-        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintSearchField):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+        * WebCore.pro:
 
-2009-08-12  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+2010-02-11  Fumitoshi Ukai  <ukai@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Alexey Proskuryakov.
 
-        [V8] Fix atomic string externalization crash.
-        Atomic string externalization assumes that all non-empty strings
-        can be externalized which is untrue on 64-bit.  This change fixed
-        that.
+        WebSocket ignores HttpOnly cookies, but should use in Handshake.
+        https://bugs.webkit.org/show_bug.cgi?id=34289
 
-        https://bugs.webkit.org/show_bug.cgi?id=28215
+        Test: websocket/tests/cookies/httponly-cookie.pl
 
-        This bug causes loads of test crashes, no need to add new tests
-        specifically for this.
+        * platform/CookieJar.h: add cookieRequestHeaderFieldValue()
+        * platform/chromium/ChromiumBridge.h:
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/mac/CookieJar.mm:
+        (WebCore::cookies):
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/android/CookieJarAndroid.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::clientHandshakeMessage): use cookieRequestHeaderFieldValue() instead of cookies() to include HttpOnly cookies.
 
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8StringToAtomicWebCoreString):
+2010-02-16  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
 
-2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+        Reviewed by Gustavo Noronha Silva.
 
-        Reviewed by Holger Freyther.
+        Notify about size changes in the WebKit GStreamer source.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34881
 
-        [Qt] Fix box-shadow painting in r47103. The edge should not be blurry.
-        Also optimize by not having to save and restore painter state.
+        * platform/graphics/gtk/WebKitWebSourceGStreamer.cpp:
+        (webkit_web_src_init):
+        (StreamingClient::didReceiveResponse):
+        * platform/graphics/gtk/WebKitWebSourceGStreamer.h:
+        This makes sure that other GStreamer elements know about the
+        size and on-disk buffering actually works.
+        Only notify about size changes if gst-plugins-base before
+        0.10.27 is used, because from that version onwards this is
+        automatically handled.
+        
+        If appsrc 0.10.27 or later is used, set the min-percent property
+        to 20% to allow more time to pass between the need-data signal
+        and starvation of the pipeline.
+        
+        Also reset the size when stopping the source and send EOS
+        on seeking failures. 
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::fillRect):
+2010-02-11  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Adam Treat.
+        [Qt] Use clipRegion instead of clipPath to save lots of CPU cycles.
 
-        [Qt] Fix coding style in GraphicsContextQt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=32375
 
         * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::toQtCompositionMode):
-        (WebCore::toQtLineCap):
-        (WebCore::toQtLineJoin):
-        (WebCore::GraphicsContextPlatformPrivate::p):
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::drawConvexPolygon):
-        (WebCore::GraphicsContext::pen):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::clipPath):
-        (WebCore::GraphicsContext::drawFocusRing):
-        (WebCore::GraphicsContext::beginTransparencyLayer):
-        (WebCore::GraphicsContext::endTransparencyLayer):
-        (WebCore::GraphicsContext::clearRect):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::GraphicsContext::setMiterLimit):
-        (WebCore::GraphicsContext::setAlpha):
         (WebCore::GraphicsContext::clipOut):
         (WebCore::GraphicsContext::clipOutEllipseInRect):
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::setPlatformStrokeColor):
-        (WebCore::GraphicsContext::setPlatformStrokeStyle):
-        (WebCore::GraphicsContext::setPlatformStrokeThickness):
-
-2009-08-12  Szabo Carol  <carol.szabo@nokia.com>
-
-        Reviewed by Simon Hausmann and Ariya Hidayat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23291
-
-        [Qt] Partial support for -webkit-box-shadow. Blur is not support and
-        the shadow still does not go well with border radius.
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::fillRect):
-
-2009-08-12  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        Use AM_V_GEN in a few more places, for less noisy builds.
 
-        * GNUmakefile.am:
+2010-02-11  Yuzo Fujishima  <yuzo@google.com>
 
-2009-08-12  Dirk Schulze  <krit@webkit.org>
+        Reviewed by Shinichiro Hamaji.
 
-        Reviewed by Oliver Hunt.
+        Rename underscored identifiers in WebCore/css/CSSParser.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=34877
+        Also fix whitespace erros that surface due to the above fix.
 
-        SVG Filter premultiplied color support for getImageDate/putImageData
-        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+        This doesn't change the code logic. Hence no new tests are required.
 
-        Some SVG Filters need premultiplied ImageData for the calculation. Therefore getImageData
-        and putImageData of ImageBuffer need support for premultiplied colors.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
 
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::getImageData):
-        (WebCore::CanvasRenderingContext2D::putImageData):
-        * platform/graphics/ImageBuffer.h:
-        (WebCore::):
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::getImageData):
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::putImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::getImageData):
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::putImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::getImageData):
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::putImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        * platform/graphics/skia/ImageBufferSkia.cpp:
-        (WebCore::getImageData):
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::putImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        * platform/graphics/wx/ImageBufferWx.cpp:
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        * svg/graphics/SVGResourceMasker.cpp:
-        (WebCore::SVGResourceMasker::applyMask):
-
-2009-08-12  Mikhail Naganov  <mnaganov@chromium.org>
+2010-02-11  Joseph Pecoraro  <joepeck@webkit.org>
 
         Reviewed by Timothy Hatcher.
 
-        Changed Number.bytesToString to support low-resolution output.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28146
-
-        * inspector/front-end/utilities.js:
-        (Number.bytesToString):
-
-2009-08-12  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+        Web Inspector: Focusing a resource in the inspector should default to content not header
+        https://bugs.webkit.org/show_bug.cgi?id=34861
 
-        Reviewed by Simon Hausmann.
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings.prototype._load): changed initial default to content tab
 
-        Add support for hooking BeginPaint/EndPaint on 64Bit Windows
+2010-02-11  Joseph Pecoraro  <joepeck@webkit.org>
 
-        Webkit uses the runtime patching trick explained by "Feng Yuan" for
-        hooking these paint functions. It currently supports only 32bit assembly
-        code. This patch adds support for 64Bit version. Since inline-assemblies
-        are not supported for 64Bit, we have use a seperate .asm file.
-
-        * WebCore.pro:
-        * plugins/win/PaintHooks.asm: Added.
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::hookedBeginPaint):
-        (WebCore::PluginView::hookedEndPaint):
-        (WebCore::hook):
-
-2009-08-11  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Make it harder to misuse try* allocation routines
-        https://bugs.webkit.org/show_bug.cgi?id=27469
-
-        Add forwarding header for PossiblyNull type, and add missing null check
-        to ImageBuffer creation.
-
-        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-
-2009-08-11  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Restrict use of FuncDeclNode & FuncExprNode to the parser.
-        https://bugs.webkit.org/show_bug.cgi?id=28209
-
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
-            Function signature change.
-
-2009-08-11  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Adam Treat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27965
-        Merge skia/ImageSourceSkia.cpp into ImageSource.cpp.
-
-        * WebCore.gypi: Remove deleted file, plus a file that was deleted a while back.
-        * platform/graphics/ImageSource.cpp:
-        (WebCore::ImageSource::setData): Use slightly shorter syntax.
-        (WebCore::ImageSource::filenameExtension): Use shorter syntax.
-        (WebCore::ImageSource::createFrameAtIndex): Remove redundant call, clarify comments, reject all empty images.
-        (WebCore::ImageSource::frameHasAlphaAtIndex): Clarify comments, use shorter syntax.
-        * platform/graphics/skia/ImageSourceSkia.cpp: Removed.
+        Reviewed by Timothy Hatcher.
 
-2009-08-11  Drew Wilson  <atwilson@google.com>
+        Web Inspector: Editing Styles Cannot Tab Backwards from a New Style Item
+        https://bugs.webkit.org/show_bug.cgi?id=34872
 
-        Reviewed by David Levin.
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.update): triggers afterUpdate
+        (WebInspector.StylePropertiesSection.prototype.afterUpdate): factored out _afterUpdate handling
 
-        SharedWorkers do not exit when the last parent document exits
-        https://bugs.webkit.org/show_bug.cgi?id=28170
+2010-02-11  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-        Prevents Documents from being suspended/placed in the page cache if they are associated with shared workers.
+        Reviewed by Eric Seidel.
 
-        Added vector cache instead of nested hash tables for SharedWorker repository.
+        Add roundedIntSize() convenience method converting FloatSize to IntSize, just like roundedIntPoint() converting FloatPoint to IntPoint.
 
-        Added SharedWorkerRepository::documentDetached API.
+        * platform/graphics/FloatSize.h:
+        (WebCore::roundedIntSize):
 
-        * dom/Document.cpp:
-        (WebCore::Document::detach):
-        Notifies SharedWorkerRepository when the document is closing.
-        * loader/FrameLoader.cpp:
-        Updated FrameLoader to not cache the Document if it is associated with a SharedWorker (since we can't suspend workers yet, we need to shut them down).
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::create):
-        (WebCore::SharedWorkerProxy::isClosing):
-        Renamed from closing().
-        (WebCore::SharedWorkerProxy::matches):
-        Added manual equality function to replace old hash lookup.
-        (WebCore::SharedWorkerProxy::isDocumentInWorkerDocuments):
-        Checks to see if a document is in the worker's list of documents. Used to determine if page is suspendable.
-        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
-        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
-        Added tracking of the worker's list of documents for lifecycle purposes.
-        (WebCore::SharedWorkerProxy::documentDetached):
-        Shuts down the proxy when the last associated document is detached.
-        (WebCore::SharedWorkerProxy::close):
-        Marks the proxy as closed so it is no longer shared with new instances.
-        (WebCore::SharedWorkerProxy::workerContextDestroyed):
-        Removes the proxy from the repository/frees the proxy when the associated SharedWorkerContext is destroyed.
-        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
-        closing()->isClosing()
-        (WebCore::SharedWorkerRepository::documentDetached):
-        (WebCore::SharedWorkerRepository::hasSharedWorkers):
-        Used by FrameLoader to determine if a page has shared workers and so cannot be suspended/cached.
-        (WebCore::DefaultSharedWorkerRepository::hasSharedWorkers):
-        (WebCore::DefaultSharedWorkerRepository::removeProxy):
-        Invoked by workerContextDestroyed() to remove a SharedWorkerProxy from the repository.
-        (WebCore::DefaultSharedWorkerRepository::documentDetached):
-        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
-        (WebCore::DefaultSharedWorkerRepository::getProxy):
-        * workers/DefaultSharedWorkerRepository.h:
-        * workers/SharedWorkerRepository.h:
-
-2009-08-11  Chris Fleizach  <cfleizach@apple.com>
+2010-02-11  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Bug 28200 - ListMarker should be included as part of the text value to parse
-        https://bugs.webkit.org/show_bug.cgi?id=28200
+        Fix two issues on maxLength.
+        https://bugs.webkit.org/show_bug.cgi?id=34783
 
-        When returning text through the marker range attributes, the list marker text should
-        also be included. It isn't included by default because a TextIterator is used which
-        only looks at Nodes for text. A list marker does not have a corresponding node,
-        so its text is not returned through accessibility. That is, until now.
+        - ValidityState.tooLong behavior was inconsistent with UIs of
+        <input> and <textarea>. tooLong checked Unicode code point length
+        though the UIs checks grapheme cluster length.
 
-        Test: platform/mac/accessibility/string-range-contains-listmarker.html
+        - Setting HTMLTextAreaElement::value didn't update the dirty flag.
 
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::listMarkerTextForRange):
-        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
-        * accessibility/AccessibilityObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]):
-        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
-        * rendering/RenderListItem.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::tooLong): Use numGraphemeClusters() instead of length().
+        * html/HTMLTextAreaElement.cpp:
+          Rename setValue() to setNonDirtyValue(), and introduce setValue()
+          which calls setNonDirtyValue() and sets the dirty flag.
+        (WebCore::HTMLTextAreaElement::childrenChanged):
+        (WebCore::HTMLTextAreaElement::reset):
+        (WebCore::HTMLTextAreaElement::setValue):
+        (WebCore::HTMLTextAreaElement::setNonDirtyValue):
+        (WebCore::HTMLTextAreaElement::setDefaultValue):
+        (WebCore::HTMLTextAreaElement::tooLong): Use numGraphemeClusters() instead of length().
+        * html/HTMLTextAreaElement.h:
 
-        Make markerText() public so that accessibility code can access it.
+2010-02-11  Fumitoshi Ukai  <ukai@chromium.org>
 
-2009-08-11  Peter Kasting  <pkasting@google.com>
+        Reviewed by Alexey Proskuryakov.
 
-        Reviewed by Adam Treat.
+        WebSocket bufferedAmount should not be 0 when send after close.
+        https://bugs.webkit.org/show_bug.cgi?id=34633
 
-        https://bugs.webkit.org/show_bug.cgi?id=27965
-        Move cairo/ImageSourceCairo.cpp to ImageSource.cpp in preparation for
-        merging most of the other ImageSource*.cpp files with it.
+        Test: websocket/tests/bufferedAmount-after-close.html
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * platform/graphics/ImageSource.cpp: Copied from WebCore/platform/graphics/cairo/ImageSourceCairo.cpp.
-        * platform/graphics/cairo/ImageSourceCairo.cpp: Removed.
+        * websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::WebSocket):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didClose):
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::WebSocketChannel):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::bufferedAmount):
+        (WebCore::WebSocketChannel::didClose):
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketChannelClient.h:
+        (WebCore::WebSocketChannelClient::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::workerContextDidClose):
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.h:
 
-2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
+2010-02-11  Fumitoshi Ukai  <ukai@chromium.org>
 
-        Reviewed by Adam Roben.
+        Reviewed by Alexey Proskuryakov.
 
-        Cairo-based Windows port does not handle the https protocol.
-        https://bugs.webkit.org/show_bug.cgi?id=28171.
+        WebSocket in Worker failed to close
+        https://bugs.webkit.org/show_bug.cgi?id=34785
 
-        No new tests needed.  Existing https tests show this failure
-        for WinCairo builds.
+        Tests: websocket/tests/workers/close-in-shared-worker.html
+               websocket/tests/workers/close-in-worker.html
 
-        * WebCore.vcproj/WebCoreCURL.vsprops: Add a few preprocessor
-          definitions for SSL support in cURL.
-        * platform/network/curl/ResourceHandleManager.h: Add new
-          certificate path member variable.
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::certificateBundlePath): New method to retrieve the
-          proper certificate resource bundle path.
-        (WebCore::ResourceHandleManager::initializeHandle): Check for
-          the resource bundle and use if available to activate SSL
-          support.
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::close):
 
-2009-08-11  Maxime Simon  <simon.maxime@gmail.com>
+2010-02-11  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        [Haiku] Use Clipboard::create() instead of the constructor of Clipboard.
-        https://bugs.webkit.org/show_bug.cgi?id=28127
-
-        * editing/haiku/EditorHaiku.cpp:
-        (WebCore::Editor::newGeneralClipboard):
-        * page/haiku/EventHandlerHaiku.cpp:
-        (WebCore::EventHandler::passWheelEventToWidget):
-        (WebCore::EventHandler::createDraggingClipboard):
-        * platform/haiku/ClipboardHaiku.cpp: Style cleanup. There were many whitespace end of lines.
-        (WebCore::ClipboardHaiku::ClipboardHaiku):
-        (WebCore::ClipboardHaiku::clearAllData):
-        (WebCore::ClipboardHaiku::getData):
-        (WebCore::ClipboardHaiku::setData):
-        (WebCore::ClipboardHaiku::types):
-        (WebCore::ClipboardHaiku::dragLocation):
-        (WebCore::ClipboardHaiku::dragImage):
-        (WebCore::ClipboardHaiku::setDragImage):
-        (WebCore::ClipboardHaiku::dragImageElement):
-        (WebCore::ClipboardHaiku::createDragImage):
-        (WebCore::ClipboardHaiku::declareAndWriteDragImage):
-        (WebCore::ClipboardHaiku::writeURL):
-        (WebCore::ClipboardHaiku::writeRange):
-        (WebCore::ClipboardHaiku::hasData):
-        * platform/haiku/DragDataHaiku.cpp:
-        (WebCore::DragData::createClipboard):
-
-2009-08-11  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by NOBODY (build break).
-
-        Speculative GTK build fix
-
-        * GNUmakefile.am:
-        Added missing .idl file, and added notifications directory to IDL_PATH.
-
-2009-08-11  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by NOBODY (build break).
-
-        Speculative Windows build fix
-
-        * WebCore.vcproj/WebCore.vcproj:
-        Added missing build steps for non-debug targets.
-
-2009-08-11  Drew Wilson <atwilson@google.com>
-
-        Reviewed by NOBODY (build break)
-
-        Speculative build fix for Qt build.
-
-        * WebCore.pro: Added /notifications to include path
-
-2009-08-11  John Gregg  <johnnyg@google.com>
+        [BREWMP] Add dummy Cursor
+        https://bugs.webkit.org/show_bug.cgi?id=34672
 
-        Reviewed by Maciej Stachowiak.
-
-        Desktop Notifications API
-        https://bugs.webkit.org/show_bug.cgi?id=25463
-
-        Adds an implementation of desktop notifications, behind the compile-time
-        flag ENABLE(NOTIFICATIONS).  This code simply relays calls on the JavaScript
-        API through a NotificationProvider interface, which must provide the services
-        to actually notify the user and manage the desktop.  This provider is injected
-        into WebKit through the ChromeClient for normal page contexts and through the
-        WorkerThread for worker contexts.
-
-        A permissions API is defined on a per-origin basis, which allows a web page
-        to check if its origin is allowed to show desktop notifications, and to request
-        permission for its origin.
-
-        * Configurations/FeatureDefines.xcconfig:
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        * bindings/js/JSDesktopNotificationsCustom.cpp: Added.
-        (WebCore::JSNotificationCenter::requestPermission):
-        (WebCore::JSNotification::addEventListener):
-        (WebCore::JSNotification::removeEventListener):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toNotification):
-        * dom/EventTarget.h:
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::notificationPresenter):
-        * notifications: Added.
-        * notifications/Notification.cpp: Added.
-        (WebCore::Notification::Notification):
-        (WebCore::Notification::~Notification):
-        (WebCore::Notification::show):
-        (WebCore::Notification::cancel):
-        (WebCore::Notification::ondisplay):
-        (WebCore::Notification::setOndisplay):
-        (WebCore::Notification::onerror):
-        (WebCore::Notification::setOnerror):
-        (WebCore::Notification::onclose):
-        (WebCore::Notification::setOnclose):
-        (WebCore::Notification::getAttributeEventListener):
-        (WebCore::Notification::setAttributeEventListener):
-        (WebCore::Notification::clearAttributeEventListener):
-        (WebCore::Notification::dispatchDisplayEvent):
-        (WebCore::Notification::dispatchErrorEvent):
-        (WebCore::Notification::dispatchCloseEvent):
-        (WebCore::Notification::addEventListener):
-        (WebCore::Notification::removeEventListener):
-        (WebCore::Notification::handleEvent):
-        (WebCore::Notification::dispatchEvent):
-        * notifications/Notification.h: Added.
-        (WebCore::Notification::create):
-        (WebCore::Notification::isHTML):
-        (WebCore::Notification::url):
-        (WebCore::Notification::contents):
-        (WebCore::Notification::scriptExecutionContext):
-        (WebCore::Notification::toNotification):
-        (WebCore::Notification::refEventTarget):
-        (WebCore::Notification::derefEventTarget):
-        * notifications/Notification.idl: Added.
-        * notifications/NotificationCenter.cpp: Added.
-        (WebCore::NotificationCenter::NotificationCenter):
-        (WebCore::NotificationCenter::checkPermission):
-        (WebCore::NotificationCenter::requestPermission):
-        * notifications/NotificationCenter.h: Added.
-        (WebCore::NotificationCenter::create):
-        (WebCore::NotificationCenter::createHTMLNotification):
-        (WebCore::NotificationCenter::createNotification):
-        (WebCore::NotificationCenter::context):
-        (WebCore::NotificationCenter::presenter):
-        * notifications/NotificationCenter.idl: Added.
-        * notifications/NotificationContents.h: Added.
-        (WebCore::NotificationContents::NotificationContents):
-        (WebCore::NotificationContents::icon):
-        (WebCore::NotificationContents::title):
-        (WebCore::NotificationContents::body):
-        * notifications/NotificationPresenter.h: Added.
-        (WebCore::NotificationPresenter::):
-        (WebCore::NotificationPresenter::~NotificationPresenter):
-        * page/Chrome.cpp:
-        (WebCore::Chrome::notificationPresenter):
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::clear):
-        (WebCore::DOMWindow::webkitNotifications):
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-        * page/Page.h:
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::~WorkerContext):
-        (WebCore::WorkerContext::webkitNotifications):
-        * workers/WorkerContext.h:
-        * workers/WorkerContext.idl:
-        * workers/WorkerThread.h:
-        (WebCore::WorkerThread::getNotificationPresenter):
-        (WebCore::WorkerThread::setNotificationPresenter):
-
-2009-08-11  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Console Drawer is Toggling instead of Staying Open
-        https://bugs.webkit.org/show_bug.cgi?id=28115
-
-        * inspector/front-end/Drawer.js:
-        (WebInspector.Drawer.prototype.showView): ensures the drawer will be open and showing the provided view
-        * inspector/front-end/inspector.js:
-        (WebInspector.showConsole): usees the new showView to guarantee the Drawer will be open
-        (WebInspector.showChanges): uses the new showView guarantee the Drawer will be open
+        * platform/brew/CursorBrew.cpp: Added.
+        (WebCore::Cursor::Cursor):
+        (WebCore::Cursor::~Cursor):
+        (WebCore::Cursor::operator=):
+        (WebCore::dummyCursor):
+        (WebCore::pointerCursor):
+        (WebCore::crossCursor):
+        (WebCore::handCursor):
+        (WebCore::moveCursor):
+        (WebCore::iBeamCursor):
+        (WebCore::waitCursor):
+        (WebCore::helpCursor):
+        (WebCore::eastResizeCursor):
+        (WebCore::northResizeCursor):
+        (WebCore::northEastResizeCursor):
+        (WebCore::northWestResizeCursor):
+        (WebCore::southResizeCursor):
+        (WebCore::southEastResizeCursor):
+        (WebCore::southWestResizeCursor):
+        (WebCore::westResizeCursor):
+        (WebCore::northSouthResizeCursor):
+        (WebCore::eastWestResizeCursor):
+        (WebCore::northEastSouthWestResizeCursor):
+        (WebCore::northWestSouthEastResizeCursor):
+        (WebCore::columnResizeCursor):
+        (WebCore::rowResizeCursor):
+        (WebCore::verticalTextCursor):
+        (WebCore::cellCursor):
+        (WebCore::contextMenuCursor):
+        (WebCore::noDropCursor):
+        (WebCore::copyCursor):
+        (WebCore::progressCursor):
+        (WebCore::aliasCursor):
+        (WebCore::noneCursor):
+        (WebCore::notAllowedCursor):
+        (WebCore::zoomInCursor):
+        (WebCore::zoomOutCursor):
+        (WebCore::middlePanningCursor):
+        (WebCore::eastPanningCursor):
+        (WebCore::northPanningCursor):
+        (WebCore::northEastPanningCursor):
+        (WebCore::northWestPanningCursor):
+        (WebCore::southPanningCursor):
+        (WebCore::southEastPanningCursor):
+        (WebCore::southWestPanningCursor):
+        (WebCore::westPanningCursor):
+        (WebCore::grabCursor):
+        (WebCore::grabbingCursor):
 
-2009-08-11  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+2010-02-11  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by George Staikos.
+        Reviewed by Dimitri Glazkov.
 
-        [WML] WMLPageState is not allowed to store the active card, it needs to be done per document
-        https://bugs.webkit.org/show_bug.cgi?id=28180
-
-        Don't store the active WMLCardElement in WMLPageState, but in WMLDocument.
-        Otherwhise this may lead to crashes related to intrinsic event exeuction.
-
-        Unfortunately select elements aren't testable by the layout tests, so adding
-        a new manual test reproducing the crash.
-
-        * manual-tests/wml/select-onpick-event-crash.wml: Added.
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::determineActiveCard):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::defaultEventHandler):
-        * wml/WMLDocument.cpp:
-        (WebCore::WMLDocument::finishedParsing):
-        * wml/WMLDocument.h:
-        (WebCore::WMLDocument::activeCard):
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::executeTask):
-        * wml/WMLPageState.cpp:
-        (WebCore::WMLPageState::WMLPageState):
-        * wml/WMLPageState.h:
-        * wml/WMLPrevElement.cpp:
-        (WebCore::WMLPrevElement::executeTask):
-        * wml/WMLRefreshElement.cpp:
-        (WebCore::WMLRefreshElement::executeTask):
-
-2009-08-07  Peter Kasting  <pkasting@google.com>
+        [V8] Add back in a fast path for v8 object wrapping
+        when it's not possible we're in a WorkerContext (the fast
+        path is important for performance).
 
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=34805
 
-        https://bugs.webkit.org/show_bug.cgi?id=28073
-        Treat icons with no bit count and no color count as 256-color for
-        purposes of quality ranking.  Also fix a couple cases of a style
-        violation.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8ObjectInWorkerContext):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8DOMWrapper.h:
 
-        Test: fast/images/icon-0colors.html
+2010-02-11  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::processDirectory):
-        (WebCore::ICOImageDecoder::readDirectoryEntry):
+        Reviewed by Dirk Schulze.
 
-2009-08-11  Drew Wilson  <atwilson@google.com>
+        Small cleanups in SVG render tree code.
+        Centralize calls to inflateShadow(), in SVGRenderSupport::computeRectForRepaint,
+        instead of spreading them around the subclasses. All classes should inherit
+        protected from SVGRenderBase, made it consistent.
+        
+        Doesn't affect layout tests.
 
-        Reviewed by David Levin.
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::computeRectForRepaint):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::computeRectForRepaint):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::computeRectForRepaint):
+        (WebCore::RenderSVGText::layout):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::computeRectForRepaint):
+        * rendering/SVGRootInlineBox.h:
 
-        Need to refactor WorkerObjectProxy.
-        https://bugs.webkit.org/show_bug.cgi?id=28136
+2010-02-11  David Hyatt  <hyatt@apple.com>
 
-        Added WorkerReportingProxy for reporting worker state (exceptions, console messages, thread exited) to the parent.
+        Reviewed by Dan Bernstein.
 
-        Existing tests are sufficient, as this is only a refactoring.
+        https://bugs.webkit.org/show_bug.cgi?id=34857
+        Move InlineIterator and BidiRun into new files so subclasses can access them.
 
         * GNUmakefile.am:
-        Added WorkerReportingProxy.h to build.
         * WebCore.gypi:
-        Added WorkerReportingProxy.h to build.
+        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
-        Added WorkerReportingProxy.h to build.
         * WebCore.xcodeproj/project.pbxproj:
-        Added WorkerReportingProxy.h to build.
-        * workers/DedicatedWorkerContext.cpp:
-        * workers/DedicatedWorkerContext.h:
-        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
-        * workers/DedicatedWorkerThread.cpp:
-        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
-        Changed constructor to pass WorkerReportingProxy to base class.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        Updated SharedWorkerProxy to implement WorkerReportingProxy interface.
-        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
-        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
-        (WebCore::SharedWorkerProxy::workerContextClosed):
-        (WebCore::SharedWorkerProxy::workerContextDestroyed):
-        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
-        Now passes in WorkerReportingProxy when creating SharedWorkerThread.
-        * workers/SharedWorkerContext.cpp:
-        * workers/SharedWorkerContext.h:
-        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
-        * workers/SharedWorkerThread.cpp:
-        (WebCore::SharedWorkerThread::create):
-        (WebCore::SharedWorkerThread::SharedWorkerThread):
-        Passes WorkerReportingProxy to base class constructor.
-        * workers/SharedWorkerThread.h:
-        Constructor now takes a WorkerReportingProxy.
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::~WorkerContext):
-        Moved code that calls workerContextDestroyed() into base class so shared workers share this functionality.
-        (WebCore::WorkerContext::close):
-        Now notifies WorkerReportingProxy when the thread is closing.
-        (WebCore::WorkerContext::reportException):
-        Reports exceptions via WorkerReportingProxy.
-        (WebCore::WorkerContext::addMessage):
-        Reports console messages via WorkerReportingProxy.
-        * workers/WorkerContext.h:
-        * workers/WorkerObjectProxy.h:
-        (WebCore::WorkerObjectProxy::workerContextClosed):
-        Default empty implementation for dedicated workers.
-        * workers/WorkerReportingProxy.h: Added.
-        Base interface that contains APIs moved from WorkerObjectProxy.
-        (WebCore::WorkerReportingProxy::~WorkerReportingProxy):
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThread::WorkerThread):
-        Updated constructor to accept a WorkerReportingProxy.
-        * workers/WorkerThread.h:
-        (WebCore::WorkerThread::workerReportingProxy):
-
-2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by NOBODY (build fix).
-
-        Fix the Qt build after r47022.
-
-        Use the new markChildren() pattern for marking aggregate/child objects.
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtRuntimeObjectImp::markChildren):
-        (JSC::Bindings::QtInstance::markAggregate):
-        * bridge/qt/qt_instance.h:
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
-        * bridge/qt/qt_runtime.h:
-
-2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Fix the build on the Qt build bot by making the generated JS bindings
-        files depend on the code generator itself.
-
-        * WebCore.pro:
-
-2009-08-07  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Sam Weinig
-
-        Stack overflow crash in JavaScript garbage collector mark pass
-        https://bugs.webkit.org/show_bug.cgi?id=12216
-
-        Make WebCore use the new iterative marking logic.
-
-        Tests: fast/js/nested-object-gc.html
-
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::markChildren):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::markChildren):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::markDOMNodesForDocument):
-        (WebCore::markActiveObjectsForContext):
-        (WebCore::markDOMObjectWrapper):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::markChildren):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::markChildren):
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::markChildren):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::markChildren):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
-        (WebCore::JSDedicatedWorkerContext::markChildren):
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::markChildren):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::markJSFunction):
-        * bindings/js/JSEventListener.h:
-        * bindings/js/JSMessageChannelCustom.cpp:
-        (WebCore::JSMessageChannel::markChildren):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::markChildren):
-        * bindings/js/JSNavigatorCustom.cpp:
-        (WebCore::JSNavigator::markChildren):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::markChildren):
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::markAggregate):
-        * bindings/js/JSNodeFilterCondition.h:
-        * bindings/js/JSNodeFilterCustom.cpp:
-        (WebCore::JSNodeFilter::markChildren):
-        * bindings/js/JSNodeIteratorCustom.cpp:
-        (WebCore::JSNodeIterator::markChildren):
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::markChildren):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::markChildren):
-        * bindings/js/JSSharedWorkerCustom.cpp:
-        (WebCore::JSSharedWorker::markChildren):
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::JSStyleSheet::markChildren):
-        * bindings/js/JSTreeWalkerCustom.cpp:
-        (WebCore::JSTreeWalker::markChildren):
-        * bindings/js/JSWebSocketCustom.cpp:
-        (WebCore::JSWebSocket::markChildren):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::markChildren):
-        * bindings/js/JSWorkerCustom.cpp:
-        (WebCore::JSWorker::markChildren):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::markChildren):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::markChildren):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/EventListener.h:
-        (WebCore::EventListener::markJSFunction):
-        (WebCore::markIfNotNull):
-        * dom/NodeFilter.h:
-        (WebCore::NodeFilter::markAggregate):
-        * dom/NodeFilterCondition.h:
-        (WebCore::NodeFilterCondition::markAggregate):
-        * dom/RegisteredEventListener.h:
-        (WebCore::markEventListeners):
-        * page/DOMWindow.h:
-        * workers/WorkerContext.h:
-
-2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Renamed all V8 NPN_ functions to _NPN_ to match JSC and make them "private".
-        https://bugs.webkit.org/show_bug.cgi?id=28089
-
-        Rename all the NPN_foo functions to _NPN_foo so that they can't directly be
-        called by mistake.  This roughly matches the way JSC does it, which is an
-        additional advantage.
-
-        * bindings/v8/NPV8Object.cpp:
-        (npCreateV8ScriptObject):
-        (_NPN_Invoke):
-        (_NPN_InvokeDefault):
-        (_NPN_Evaluate):
-        (_NPN_EvaluateHelper):
-        (_NPN_GetProperty):
-        (_NPN_SetProperty):
-        (_NPN_RemoveProperty):
-        (_NPN_HasProperty):
-        (_NPN_HasMethod):
-        (_NPN_SetException):
-        (_NPN_Enumerate):
-        (_NPN_Construct):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::clearScriptObjects):
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
-        * bindings/v8/V8NPObject.cpp:
-        (npObjectInvokeImpl):
-        (npObjectGetProperty):
-        (npObjectIndexedPropertyGetter):
-        (npObjectGetIndexedProperty):
-        (npObjectSetProperty):
-        (npObjectIndexedPropertySetter):
-        (npObjectSetIndexedProperty):
-        (weakNPObjectCallback):
-        (createV8ObjectForNPObject):
-        (forgetV8ObjectForNPObject):
-        * bindings/v8/V8NPUtils.cpp:
-        (getStringIdentifier):
-        * bindings/v8/npruntime.cpp:
-        * bindings/v8/npruntime_impl.h:
-
-2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Brady Eidson.
-
-        Change ___Storage.key() to match current spec behavior.
-        https://bugs.webkit.org/show_bug.cgi?id=28112
-
-        The current WebStorage spec says that ___Storage.key() should return null when
-        the index is out of bounds, rather than an exception.  A bunch of logic can be
-        simplified after this change.
-
-        * bindings/js/JSStorageCustom.cpp:
-        (WebCore::JSStorage::getPropertyNames):
-        * bindings/v8/custom/V8StorageCustom.cpp:
-        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
-        * storage/Storage.cpp:
-        (WebCore::Storage::key):
-        * storage/Storage.h:
-        * storage/Storage.idl:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::key):
-        * storage/StorageAreaImpl.h:
-        * storage/StorageMap.cpp:
-        (WebCore::StorageMap::key):
-        * storage/StorageMap.h:
-
-2009-08-07  Michael Nordman  <michaeln@google.com>
-
-        Reviewed by Darin Fisher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28087
-
-        Mods for a chrome specific impl of ApplicationCacheHost.
-
-        * The public section of the interface is the same, but we use
-        PLATFORM(CHROMIUM) to identify which parts of the private
-        section are shared. The chrome specific internals are encapsulated
-        in a seperate ApplicationCacheHostInternal class. WebCore common
-        code only contains a forward reference to this class.
-
-        * Cleanup a couple of stale comments.
-
-        * Have window.applicationCache return null to script when the
-        feature is disabled in the preferences.
-        
-        No new tests.
-
-        * loader/appcache/ApplicationCacheHost.cpp:
-        * loader/appcache/ApplicationCacheHost.h:
-        (WebCore::ApplicationCacheHost::documentLoader):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::applicationCache):
-
-2009-08-10  Crystal Zhang  <crystal.zhang@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Implement GraphicsContext::fillRoundRect() for WINCE port
-        https://bugs.webkit.org/show_bug.cgi?id=27842
-
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/wince/GraphicsContextWince.cpp:
-        (WebCore::rectCenterPoint):
-        (WebCore::GraphicsContext::fillRoundedRect):
-        (WebCore::GraphicsContext::drawRoundCorner):
-
-2009-08-10  Anthony Ricaud  <rik@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector Resources / Graphs should support filtering
-        https://bugs.webkit.org/show_bug.cgi?id=20629
-
-        Introduces a filter bar for resources.
-
-        Thanks to Matt Lilek for the CSS scope bar.
-
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.createFilterElement):
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.categoryOrder.filter):
-        (WebInspector.ResourcesPanel.prototype._updateFilter):
-        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
-
-2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
-
-        Unreviewed build correction after http://trac.webkit.org/changeset/46978
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::ResourceHandleManager::initializeHandle):  Correct
-         deprecated removeRef to new removeFragmentIdentifier.
-
-2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Justin Garcia.
-
-        Background color formatting lost on enter
-        https://bugs.webkit.org/show_bug.cgi?id=20348
-
-        This patch makes background color be preserved during editing.
-        In particular, editingStyleAtPosition would include the background color when obtaining styles.
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::): Added CSSPropertyBackgroundColor to editingStyleProperties
-
-2009-08-10  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Stop sending QEvent::CursorChange to Qt for mouse move.
-
-        Verify if the cursor didn't change in WidgetQt::setCursor,
-        just like the mac port does.
-
-        Thanks to Adriano Rezendo for spotting and debugging the
-        issue.
-
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::setCursor):
-
-2009-08-10  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28165
-        Application cache maximum size cannot be set before the database is opened
-
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::vacuumDatabaseFile): Open appcache database if it isn't
-        open yet.
+        * rendering/BidiRun.cpp: Added.
+        (WebCore::BidiRun::destroy):
+        (WebCore::throw):
+        (WebCore::BidiRun::operator delete):
+        * rendering/BidiRun.h: Added.
+        (WebCore::BidiRun::BidiRun):
+        (WebCore::BidiRun::next):
+        * rendering/InlineIterator.h: Added.
+        (WebCore::InlineIterator::InlineIterator):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        (WebCore::bidiNext):
+        (WebCore::bidiFirst):
+        (WebCore::InlineIterator::increment):
+        (WebCore::InlineIterator::atEnd):
+        (WebCore::InlineIterator::current):
+        (WebCore::InlineIterator::direction):
+        (WebCore::InlineBidiResolver::increment):
+        (WebCore::InlineBidiResolver::appendRun):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::appendRunsForObject):
+        (WebCore::RenderBlock::requiresLineBox):
 
-2009-08-10  Vitaly Repeshko  <vitalyr@quad.spb.corp.google.com>
+2010-02-11  Steve Block  <steveblock@google.com>
 
         Reviewed by Dimitri Glazkov.
 
-        [V8] Fix memory leak in node event listeners. See http://crbug.com/17400.
-        https://bugs.webkit.org/show_bug.cgi?id=28156
+        Fixes CodeGeneratorV8.pm to include the header for the indexer type when using setCollectionIndexedGetter()
+        https://bugs.webkit.org/show_bug.cgi?id=34836
 
-        * bindings/scripts/CodeGeneratorV8.pm: Custom event handler accessors now apply to all Node descendants.
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8AbstractEventListener::isObjectListener): Added virtual method to detect listeners that have weak references to JS objects.
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/V8ObjectEventListener.cpp:
-        * bindings/v8/V8ObjectEventListener.h:
-        (WebCore::V8ObjectEventListener::isObjectListener):
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::removeHiddenDependency):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8ElementCustom.cpp:
-        * bindings/v8/custom/V8NodeCustom.cpp: Moved custom accessors from V8ElementCustom.cpp.
-        (WebCore::toEventType):
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::getEventListener): Made static.
+        setCollectionIndexedGetter() uses getIndexedPropertyOfCollection(),
+        which in turn uses toV8() with the indexer type, which is declared in
+        the header for the indexer type.
 
-2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+        No new tests, build fix only.
 
-        Reviewed by Darin Fisher.
+        * bindings/scripts/CodeGeneratorV8.pm:
 
-        Cleanup DOM Storage namespace shutdown code usage of security origin.
-        https://bugs.webkit.org/show_bug.cgi?id=28094
-
-        If a storage namespace is not explicitly closed, be sure to do so on
-        destruction of the object.  In addition, the close call should wait
-        on the background thread finishing its syncing.  (Not doing so is actually
-        a regression from the original LocalStorage code.)
-
-        There's no point to passing in the SecurityOrigin when copying a storage
-        area since what was passed in is exactly what is stored within each
-        storage area.  In addition, the non-copy constructor should take in a
-        PassRefPtr rather than a pointer since that pointer was only passed into
-        the constuctor for RefPtr's anyway.
-
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::StorageAreaImpl):
-        (WebCore::StorageAreaImpl::copy):
-        * storage/StorageAreaImpl.h:
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
-        (WebCore::StorageNamespaceImpl::~StorageNamespaceImpl):
-        (WebCore::StorageNamespaceImpl::copy):
-        (WebCore::StorageNamespaceImpl::close):
-        * storage/StorageNamespaceImpl.h:
-
-2009-08-10  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+2010-02-11  Pavel Feldman  <pfeldman@chromium.org>
 
-        Not reviewed, build fix.
+        Reviewed by Timothy Hatcher.
 
-        Rename ref() to fragmentIdentifier() in the wml/ subdirectory.
+        Web Inspector: split source code into chunks in order to improve text
+        viewer performance on large files.
 
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::determineActiveCard):
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::executeTask):
-        * wml/WMLPageState.cpp:
-        (WebCore::WMLPageState::canAccessDeck):
+        https://bugs.webkit.org/show_bug.cgi?id=34816
 
-2009-08-10  Steve Falkenburg  <sfalken@apple.com>
+        This change brings back SourceFrame's canvas+style magic, restores line
+        wrapping and makes things a lot like they used to be.
+        It removes TextEditor for now and renames NativeTextViewer into TextViewer.
+        TextViewer is no longer derived from TextEditor.
+        This TextViewer is still based on TextEditorModel, no iframes are involved.
 
-        Windows build fix.
+        Instead of creating div per line, TextViewer splits source code into 50 line
+        chunks. Upon scroll event, visible chunks are sharded into lines and individual
+        lines are highlighted. Whenever highlighted region gets outside of the visible
+        area, highlight spans are thrown away and region is replaced with the original
+        plain text chunk.
 
-        Exclude JSMedia.cpp from build since it is included in DerivedSources.cpp.
-        Fixes linker warnings.        
-        
-        Corrected spelling of JSInspectorBackend.cpp.
-        
-        Other changes related to actually using a Visual Studio to open/save the vcproj file.
+        Complex stuff:
+        - Whenever there is a need to manipulate individual lines (add message bubble /
+        set breakpoint / reveal / etc.), individual chunks for such lines are created.
+        - There is also an implicit machinery that is maintaining selection when it
+        goes beyond the visible area.
+        - Search occurrences are implemented as artificial spans interweaving
+        highlighting markup.
 
+        * WebCore.gypi:
         * WebCore.vcproj/WebCore.vcproj:
-
-2009-08-10  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Anders Carlsson.
-
-        Remove a dead #define.
-
-        * bindings/js/JSDOMBinding.cpp:
-
-2009-08-10  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [Chromium] Update KURLGoogle for ref* method renames in
-        http://trac.webkit.org/changeset/46978.
-        https://bugs.webkit.org/show_bug.cgi?id=28084
-
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::ACCESSOR_SETTER): Renamed ref and setRef to fragmentIdentifier and
-            setFragmentIdentifier, respectively.
-        * platform/KURLGoogle.cpp: Ditto, plus all other ref* method names.
-
-2009-08-10  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        [Gtk] Unreviewed. Fix the nit as suggested by Darin in bug #28144
-        for r46989.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::finishedCallback):
-
-2009-08-10  John Kjellberg  <john.kjellberg@power.alstom.com>
-
-        Reviewed by Darin Adler.
-
-        Memory leak in error handling code for SOUP interface
-        https://bugs.webkit.org/show_bug.cgi?id=28144
-
-        Freed memory leaked in error handling code for soup requests.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::finishedCallback):
-        (WebCore::):
-
-2009-08-10  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Provide graceful handling of the situation when an embedder invokes
-        visited link update methods before a Page constructor has been called.
-        https://bugs.webkit.org/show_bug.cgi?id=28149
-
-        * page/Page.cpp:
-        (WebCore::Page::allVisitedStateChanged): Added a null-check for allPages.
-        (WebCore::Page::visitedStateChanged): Ditto.
-
-2009-08-10  Xan Lopez  <xlopez@igalia.com>
-
-        Fix GTKbuild.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::):
-
-2009-08-10  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Remove the redundant, Windows CE-only GlyphBuffer::advnaceData()
-
-        * platform/graphics/GlyphBuffer.h: Removed advanceData().
-        * platform/graphics/wince/GraphicsContextWince.cpp:
-        (WebCore::GraphicsContext::drawText): Changed to use advances(from)
-            instead of advanceData() from.
-
-2009-08-10  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        Remove workaround for older libsoup versions.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::fillResponseFromMessage):
-
-2009-08-10  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        Let startHttp validate the URI instead of doing it, with potential
-        crashes, in ::start.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::startHttp):
-
-2009-08-10  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        When empty <input> is focused, getSelection() exposes shadow tree nodes
-        https://bugs.webkit.org/show_bug.cgi?id=15903
-
-        Test: fast/forms/shadow-tree-exposure.html
-
-        * page/DOMSelection.cpp:
-        (WebCore::selectionShadowAncestor): Added.
-        (WebCore::DOMSelection::anchorNode): Return the parent of the shadow
-        ancestor if the selection is in a shadow tree. Matches Firefox.
-        (WebCore::DOMSelection::anchorOffset): Return the index of the shadow
-        ancestor if the selection is in a shadow tree. Matches Firefox.
-        (WebCore::DOMSelection::focusNode): Ditto.
-        (WebCore::DOMSelection::focusOffset): Ditto.
-        (WebCore::DOMSelection::baseNode): More of the same, but since this
-        is a WebKit-invented property, it does not match Firefox.
-        (WebCore::DOMSelection::baseOffset): Ditto.
-        (WebCore::DOMSelection::extentNode): Ditto.
-        (WebCore::DOMSelection::extentOffset): Ditto.
-        (WebCore::DOMSelection::isCollapsed): Return true even when the
-        selection is a range, if the selection is in the shadow tree.
-        Matches Firefox. Also changed behavior when called and the frame
-        is gone to return true instead of false which makes more sense.
-        (WebCore::DOMSelection::empty): Use clear() just like the other
-        selection-clearing function in this file does.
-        (WebCore::DOMSelection::getRangeAt): Return a range that starts
-        and ends before the shadow ancestor. Matches Firefox.
-
-2009-08-10  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Make all status bar button images glyph-based.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28124
-
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel):
-        * inspector/front-end/Images/clearConsoleButtonGlyph.png: Added.
-        * inspector/front-end/Images/clearConsoleButtons.png: Removed.
-        * inspector/front-end/Images/consoleButtonGlyph.png: Added.
-        * inspector/front-end/Images/consoleButtons.png: Removed.
-        * inspector/front-end/Images/dockButtonGlyph.png: Added.
-        * inspector/front-end/Images/dockButtons.png: Removed.
-        * inspector/front-end/Images/enableButtons.png: Removed.
-        * inspector/front-end/Images/enableOutlineButtonGlyph.png: Added.
-        * inspector/front-end/Images/enableSolidButtonGlyph.png: Added.
-        * inspector/front-end/Images/excludeButtonGlyph.png: Added.
-        * inspector/front-end/Images/excludeButtons.png: Removed.
-        * inspector/front-end/Images/focusButtonGlyph.png: Added.
-        * inspector/front-end/Images/focusButtons.png: Removed.
-        * inspector/front-end/Images/largerResourcesButtonGlyph.png: Added.
-        * inspector/front-end/Images/largerResourcesButtons.png: Removed.
-        * inspector/front-end/Images/nodeSearchButtonGlyph.png: Added.
-        * inspector/front-end/Images/nodeSearchButtons.png: Removed.
-        * inspector/front-end/Images/pauseOnExceptionButtonGlyph.png: Added.
-        * inspector/front-end/Images/pauseOnExceptionButtons.png: Removed.
-        * inspector/front-end/Images/percentButtonGlyph.png: Added.
-        * inspector/front-end/Images/percentButtons.png: Removed.
-        * inspector/front-end/Images/recordButtonGlyph.png: Added.
-        * inspector/front-end/Images/recordButtons.png: Removed.
-        * inspector/front-end/Images/recordToggledButtonGlyph.png: Added.
-        * inspector/front-end/Images/reloadButtonGlyph.png: Added.
-        * inspector/front-end/Images/reloadButtons.png: Removed.
-        * inspector/front-end/Images/undockButtonGlyph.png: Added.
-        * inspector/front-end/Panel.js:
-        (WebInspector.Panel.prototype.createStatusBarButton):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
+        * inspector/front-end/NativeTextViewer.js: Removed.
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.set visible):
+        (WebInspector.SourceFrame.prototype.set executionLine):
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype.addBreakpoint):
+        (WebInspector.SourceFrame.prototype.removeBreakpoint):
+        (WebInspector.SourceFrame.prototype.addMessage):
+        (WebInspector.SourceFrame.prototype.clearMessages):
+        (WebInspector.SourceFrame.prototype.sizeToFitContentHeight):
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype.highlightLine):
+        (WebInspector.SourceFrame.prototype._createViewerIfNeeded):
+        (WebInspector.SourceFrame.prototype.markAndRevealRange):
+        (WebInspector.SourceFrame.prototype.clearMarkedRange):
+        (WebInspector.SourceFrame.prototype._breakpointChanged):
+        (WebInspector.SourceFrame.prototype._updateExecutionLine):
+        (WebInspector.SourceFrame.prototype._addMessageToSource):
+        (WebInspector.SourceFrame.prototype._addExistingBreakpointsToSource):
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame.prototype._removeBreakpointFromSource):
+        (WebInspector.SourceFrame.prototype._mouseDown):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.committed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.dismissed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._showBreakpointConditionPopup):
+        (WebInspector.SourceFrame.prototype._createConditionElement):
+        (WebInspector.SourceFrame.prototype._keyDown):
+        (WebInspector.SourceFrame.prototype.resize):
+        (WebInspector.SourceFrame.prototype._drawProgramCounterInContext):
+        (WebInspector.SourceFrame.prototype._drawProgramCounterImageIfNeeded):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded.drawBreakpoint):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView):
+        (WebInspector.SourceView.prototype._removeBreakpoint):
+        (WebInspector.SourceView.prototype.searchCanceled):
+        (WebInspector.SourceView.prototype._jumpToSearchResult):
+        * inspector/front-end/TextEditor.js: Removed.
+        * inspector/front-end/TextViewer.js: Added.
+        (WebInspector.TextViewer):
+        (WebInspector.TextViewer.prototype.set mimeType):
+        (WebInspector.TextViewer.prototype.get textModel):
+        (WebInspector.TextViewer.prototype.revealLine):
+        (WebInspector.TextViewer.prototype.addDecoration):
+        (WebInspector.TextViewer.prototype.removeDecoration):
+        (WebInspector.TextViewer.prototype.markAndRevealRange):
+        (WebInspector.TextViewer.prototype.highlightLine):
+        (WebInspector.TextViewer.prototype._textChanged):
+        (WebInspector.TextViewer.prototype._createChunkRow):
+        (WebInspector.TextViewer.prototype._makeLineAChunk):
+        (WebInspector.TextViewer.prototype._indexChunks):
+        (WebInspector.TextViewer.prototype._highlightChanged):
+        (WebInspector.TextViewer.prototype._scroll):
+        (WebInspector.TextViewer.prototype.setCoalescingUpdate):
+        (WebInspector.TextViewer.prototype._repaintAll):
+        (WebInspector.TextViewer.prototype._chunkForOffset):
+        (WebInspector.TextViewer.prototype._chunkNumberForLine):
+        (WebInspector.TextViewer.prototype._chunkStartLine):
+        (WebInspector.TextViewer.prototype._restoreChunks):
+        (WebInspector.TextViewer.prototype._repaint):
+        (WebInspector.TextViewer.prototype._getSelection):
+        (WebInspector.TextViewer.prototype._restoreSelection):
+        (WebInspector.TextViewer.prototype._selectionToPosition):
+        (WebInspector.TextViewer.prototype._createLineRow):
+        (WebInspector.TextViewer.prototype._paintLine):
+        (WebInspector.TextViewer.prototype._createSpan):
+        (WebInspector.TextViewer.prototype._createLink):
+        (WebInspector.TextViewer.prototype._rewriteHref):
+        (WebInspector.TextViewer.prototype._markRange):
+        (WebInspector.TextViewer.prototype._decimalDigits):
+        (WebInspector.TextViewer.prototype.resize):
         * inspector/front-end/WebKit.qrc:
         * inspector/front-end/inspector.css:
         * inspector/front-end/inspector.html:
+        * inspector/front-end/textEditor.css: Removed.
+        * inspector/front-end/textViewer.css: Added.
+        * inspector/front-end/utilities.js:
+        (Node.prototype.traverseNextTextNode):
+        (Node.prototype.rangeBoundaryForOffset):
 
-2009-08-07  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        KURL ref() methods should be fragmentIdentifier() methods 
-        https://bugs.webkit.org/show_bug.cgi?id=28084
-
-        In addition to the renames, also took the chance to replace all use of:
-        setRef(String());
-        with:
-        removeFragmentIdentifier();
-
-        * platform/KURL.cpp:
-        (WebCore::KURL::fragmentIdentifier):
-        (WebCore::KURL::hasFragmentIdentifier):
-        (WebCore::KURL::setFragmentIdentifier):
-        (WebCore::KURL::removeFragmentIdentifier):
-        (WebCore::KURL::prettyURL):
-        (WebCore::equalIgnoringFragmentIdentifier):
-        * platform/KURL.h:
-
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::setHash): Rework with new names, and to use the new equalIgnoringNullity() method.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::internalLinkElement):
-        * css/CSSCursorImageValue.cpp:
-        (WebCore::isSVGCursorIdentifier):
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::isCurrentDocument):
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::hash):
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::isURLAllowed):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-        (WebCore::FrameLoader::gotoAnchor):
-        (WebCore::FrameLoader::scheduleLocationChange):
-        (WebCore::FrameLoader::scrollToAnchor):
-        (WebCore::FrameLoader::shouldReload):
-        (WebCore::FrameLoader::urlsMatchItem):
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::resourceForURL):
-        (WebCore::ApplicationCache::resourceForRequest):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::cacheForMainRequest):
-        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest):
-        (WebCore::ApplicationCacheGroup::selectCache):
-        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::didReceiveResponse):
-        (WebCore::ApplicationCacheGroup::didFail):
-        (WebCore::ApplicationCacheGroup::addEntry):
-        * loader/appcache/ApplicationCacheResource.h:
-        (WebCore::ApplicationCacheResource::create):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::findOrCreateCacheGroup):
-        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
-        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
-        * loader/appcache/ManifestParser.cpp:
-        (WebCore::parseManifest):
-        * page/Location.cpp:
-        (WebCore::Location::hash):
-        * page/Page.cpp:
-        (WebCore::Page::goToItem):
-        * rendering/RenderPartObject.cpp:
-        (WebCore::isURLAllowed):
-        * workers/WorkerLocation.cpp:
-        (WebCore::WorkerLocation::hash):
-
-2009-08-10  Andy Shaw <andy.shaw@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix endless loop when the application is quit by a secondary thread during a sync xml http request.
-
-        Replace the m_finished state variable and the call to QCoreApplication::processEvents() with
-        a dedicated QEventLoop, that can be terminated from within WebCoreSynchronousLoader as well
-        as from Qt through its knowledge of globally registered eventloops.
-
-        There is no unit test for this bug as it would require exporting additional symbols and
-        introduce the synchronous loader as global variable just for the test.
-
-        * platform/network/qt/ResourceHandleQt.cpp:
-        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
-        (WebCore::WebCoreSynchronousLoader::didFail):
-        (WebCore::WebCoreSynchronousLoader::waitForCompletion):
-
-2009-08-10  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Make properties inspection serialized.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28078
-
-        * inspector/front-end/DOMAgent.js:
-        (InspectorController.getPrototypes):
-        (InspectorController.getProperties):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getPrototypes):
-        (InjectedScript.getProperties):
-        (InjectedScript.setPropertyValue):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectRef):
-        (WebInspector.ObjectPropertyRef):
-        (WebInspector.ObjectPropertiesSection.prototype.onpopulate):
-        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
-        (WebInspector.ObjectPropertiesSection.prototype.update):
-        (WebInspector.ObjectPropertiesSection.prototype._update):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onattach):
-        (WebInspector.ObjectPropertyTreeElement.prototype.update):
-        * inspector/front-end/PropertiesSidebarPane.js:
-        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
-        (WebInspector.PropertiesSidebarPane.prototype.update):
-
-2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] wml.css lacks <pre> support
-        https://bugs.webkit.org/show_bug.cgi?id=28135
-
-        Add <pre> support for WML.
-        Extended fast/wml/text-emphasis.wml to cover <pre> support.
-
-        * css/wml.css: <pre> section copied from html.css
-
-2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix non-WML enabled builds. Remove ENABLE(WML) guards around the switch cases 'FrameLoadTypeBackWMLDeckNotAccessible'.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::isBackForwardLoadType):
-        (WebCore::FrameLoader::restoreDocumentState):
-        (WebCore::FrameLoader::transitionToCommitted):
-        (WebCore::FrameLoader::loadItem):
-
-2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] Deck access control is completly broken
-        https://bugs.webkit.org/show_bug.cgi?id=27721
-
-        Rewrite WML deck access control, actually works now standalone and within LayoutTests.
-        Added several new layout tests covering local & remote access support.
-
-        In order to detect WML task execution failures from within the WML layout tests a new
-        method Console::lastWMLErrorMessage() has been added, returning the last recorded WML
-        error message. Change WML log messages to dump to InspectorClient, just like it's done
-        for HTML - we used to behave like JSMessageSource, which is wrong.
-
-        Tests: http/tests/wml/access-target-domain-deny.html
-               http/tests/wml/access-target-path-deny.html
-               http/tests/wml/access-target.html
-               wml/access-target-deny.html
-               wml/access-target.html
-
-        * inspector/ConsoleMessage.h:
-        (WebCore::ConsoleMessage::source): Added public method to fetch the message source type.
-        (WebCore::ConsoleMessage::message): Added public method to access the error message.
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::consoleMessages): Added for Console::lastWMLErrorMessage(), to be able to crawl through the list of dumped messages.
-        * loader/FrameLoader.cpp: Recognize 'FrameLoadTypeBackWMLDeckNotAccessible', all guarded by ENABLE(WML).
-        (WebCore::isBackForwardLoadType):
-        (WebCore::FrameLoader::restoreDocumentState):
-        (WebCore::FrameLoader::transitionToCommitted):
-        (WebCore::FrameLoader::loadItem):
-        * loader/FrameLoaderTypes.h:
-        (WebCore::): Add new load type 'FrameLoadTypeBackWMLDeckNotAccessible', behaving like FrameLoadTypeBack plus WML specific information.
-        * page/Console.cpp:
-        (WebCore::Console::addMessage): Don't dump WML messages using ChromeClient (as it's done for JSMessageSource), but go through InspectorController.
-        (WebCore::Console::lastWMLErrorMessage): Crawl InspectorController::consoleMssages() to look up the last WML error message, if present.
-        * page/Console.h:
-        * page/Console.idl: Add "[DontEnum] DOMString lastWMLErrorMessage()".
-        * wml/WMLAccessElement.cpp: Store path/domain as member variables and pass them to WMLPageState once in insertedIntoDocument().
-        (WebCore::WMLAccessElement::parseMappedAttribute):
-        (WebCore::WMLAccessElement::insertedIntoDocument):
-        * wml/WMLAccessElement.h:
-        * wml/WMLCardElement.cpp: Handle 'FrameLoadTypeBackWMLDeckNotAccessible' as deck-entry method. Report WML error in current deck.
-        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
-        * wml/WMLDocument.cpp: Enable deck-access control in finishedParsing. Take care of method name changes in WMLPageState.
-        (WebCore::WMLDocument::finishedParsing):
-        (WebCore::WMLDocument::initialize):
-        * wml/WMLErrorHandling.cpp: Never report 'WMLErrorDeckNotAccessible' messages through the tokenizer, that would alter the page into error state.
-        (WebCore::reportWMLError):
-        * wml/WMLPageState.cpp: Completly rewrote access path/domain parsing & deck-access control, strictly following the WML spec. All covered by tests.
-        (WebCore::WMLPageState::WMLPageState):
-        (WebCore::normalizedHostName):
-        (WebCore::hostFromURL):
-        (WebCore::urlForHistoryItem):
-        (WebCore::tryAccessHistoryURLs):
-        (WebCore::WMLPageState::processAccessControlData):
-        (WebCore::WMLPageState::resetAccessControlData):
-        (WebCore::WMLPageState::canAccessDeck):
-        (WebCore::WMLPageState::hostIsAllowedToAccess):
-        (WebCore::WMLPageState::pathIsAllowedToAccess):
-        * wml/WMLPageState.h:
-
-2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        FrameLoadType / WebFrameLoadType enums are out of sync
-        https://bugs.webkit.org/show_bug.cgi?id=28132
-
-        Modify FrameLoadType enum to match the order of WebFrameLoadType in WebFramePrivate.h / IWebFramePrivate.idl.
-        The mac/win public API exposes the old 'FrameLoadTypeReloadAllowingStaleData' value, which resides between
-        'FrameLoadTypeReload' and 'FrameLoadTypeSame'. Work around this problem, by assigning 'FrameLoadTypeSame = FrameLoadTypeReload 2'.
-
-        Add a note to the FrameLoadType enum to keep it in sync with WebFramePrivate.h & IWebFramePrivate.idl.
-
-        * loader/FrameLoaderTypes.h:
-        (WebCore::):
-
-2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] manual-tests/wml/onevent-prev.wml crashes
-        https://bugs.webkit.org/show_bug.cgi?id=27722
-
-        Fix intrinsic event execution, leading to crashes.
-        First finish parsing the document, then execute the events. Not the other way round.
-        -> exposes bugs all over the WML layout tests, which relied on that quirk.
-
-        Fixes manual-tests/wml/onevent-prev.wml.
-
-        * wml/WMLDocument.cpp:
-        (WebCore::WMLDocument::WMLDocument):
-        (WebCore::WMLDocument::finishedParsing):
-        (WebCore::WMLDocument::initialize):
-        * wml/WMLDocument.h:
-
-2009-08-08  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [Chromium] Update WebCore.gyp to add ImageBuffer.cpp,
-        introduced by http://trac.webkit.org/changeset/46956.
-        https://bugs.webkit.org/show_bug.cgi?id=27844
-
-        * WebCore.gypi: Added ImageBuffer.cpp.
-
-2009-08-08  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Rubber-stamped by Jan Michael Alonzo.
-
-        Add [DontEnum] to WML specific initializeWMLPageState/resetWMLPageState methods, to assure
-        fast/dom/Window/window-properties.html doesn't show any differences when WML is enabled.
-
-        * dom/Document.idl:
-
-2009-08-08  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        SVG Filter need feColorMatrix implementation
-        [https://bugs.webkit.org/show_bug.cgi?id=27711]
-
-        Adds the filter effect feColorMatrix to SVG filters. 
-
-        There is already a test in the w3c directory.
-        Test: svg/W3C-SVG-1.1/filters-color-01-b.svg
-
-        * platform/graphics/filters/FEColorMatrix.cpp:
-        (WebCore::matrix):
-        (WebCore::saturate):
-        (WebCore::huerotate):
-        (WebCore::luminance):
-        (WebCore::FEColorMatrix::apply):
-
-2009-08-08  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Build fix for Tiger.
-        https://bugs.webkit.org/show_bug.cgi?id=27844
-
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-
-2009-08-08  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        This is an initial implementation for linearRGB and sRGB support for all
-        platforms. Some platforms like Cg support different color spaces
-        natively, others like Qt, Cairo and Skia do not. This patch uses the
-        native implementation of platforms if possible and offers a common version
-        if not.
-
-        Different color spaces are used in SVG Filters. Nearly every Filter test 
-        case is a test for this patch and will be enabled, once Filters are enabled.
-        https://bugs.webkit.org/show_bug.cgi?id=27844
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::drawTextInternal):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::createImageBuffer):
-        * platform/graphics/GeneratedImage.cpp:
-        (WebCore::GeneratedImage::drawPattern):
-        * platform/graphics/ImageBuffer.cpp: Added.
-        (WebCore::ImageBuffer::transformColorSpace):
-        * platform/graphics/ImageBuffer.h:
-        (WebCore::):
-        (WebCore::ImageBuffer::create):
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::platformTransformColorSpace):
-        * platform/graphics/cairo/ImageCairo.cpp:
-        (WebCore::Image::drawPattern):
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/graphics/chromium/TransparencyWin.cpp:
-        (WebCore::TransparencyWin::OwnedBuffers::OwnedBuffers):
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::getEffectContext):
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::platformTransformColorSpace):
-        * platform/graphics/qt/PathQt.cpp:
-        (WebCore::Path::strokeContains):
-        (WebCore::Path::strokeBoundingRect):
-        * platform/graphics/skia/ImageBufferSkia.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::platformTransformColorSpace):
-        * platform/graphics/skia/SkiaUtils.cpp:
-        (WebCore::scratchContext):
-        * platform/graphics/wx/ImageBufferWx.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarThemeMac::paint):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::drawMaskerContent):
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::buildPattern):
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::nativeImageForCurrentFrame):
-        * svg/graphics/SVGPaintServerGradient.cpp:
-        (WebCore::createMaskAndSwapContextForTextGradient):
-        * svg/graphics/SVGPaintServerPattern.cpp:
-        (WebCore::SVGPaintServerPattern::setup):
-        * svg/graphics/SVGResourceFilter.cpp:
-        (WebCore::SVGResourceFilter::prepareFilter):
-        (WebCore::SVGResourceFilter::applyFilter):
-        * svg/graphics/SVGResourceMasker.cpp:
-        (WebCore::SVGResourceMasker::applyMask):
-        * svg/graphics/filters/SVGFETile.cpp:
-        (WebCore::FETile::apply):
-
-2009-08-08  Xan Lopez  <xlopez@igalia.com>
-
-        Roll out r46928, since it wasn't done in accordance with the
-        agreed naming.
-
-        * bindings/gdom/GdomDOMObject.cpp: Removed.
+2010-02-11  Csaba Osztrogonác  <ossy@webkit.org>
 
-2009-08-08  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        Reviewed by Tor Arne Vestbø.
 
-        Reviewed by Xan Lopez.
+        [Qt] ENABLE_RUBY flag was restored by r54649, but default value wasn't added for Qt port.
+        https://bugs.webkit.org/show_bug.cgi?id=34698
 
-        [Gtk] Enable accessibility in Gtk DRT
-        https://bugs.webkit.org/show_bug.cgi?id=25989
+        * WebCore.pri: Add ENABLE_RUBY=1 as default setting.
 
-        Add SPI to get the focused accessible element to be used by DRT.
+2010-02-11  Steve Block  <steveblock@google.com>
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_focused_element):
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.h:
+        Reviewed by Jeremy Orlow.
 
-2009-08-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        Updates Android V8 Makefile to generate Notifications and WebSockets headers required by V8DOMWrapper.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=34815
 
-        Gtk build fix - add html/canvas to the binding generator's include path
+        No new tests, build fix only.
 
-        * GNUmakefile.am:
+        * Android.derived.v8bindings.mk:
 
-2009-08-07  Oliver Hunt  <oliver@apple.com>
+2010-02-11  Steve Block  <steveblock@google.com>
 
-        Another attempt to fix windows.
+        Reviewed by Jeremy Orlow.
 
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
+        Updates Android V8 Makefile to generate XPath header required by V8Proxy.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=34814
 
-2009-08-07  Oliver Hunt  <oliver@apple.com>
+        No new tests, build fix only.
 
-        Windows build fix
+        * Android.derived.v8bindings.mk:
 
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-08-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Gtk build fix - add html/canvas to the include path.
-
-        * GNUmakefile.am:
+2010-02-11  Steve Block  <steveblock@google.com>
 
-2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+        Reviewed by Nate Chapin.
 
-        Prospective build fix for Qt following r46937.
+        Update Android V8 Makefile to generate Inspector headers required by V8 ScriptObject.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=34806
 
-        * WebCore.pro:
+        No new tests, build fix only.
 
-2009-08-07  Yong Li  <yong.li@torchmobile.com>
+        * Android.derived.v8bindings.mk:
 
-        WINCE PORT: store only width for GlyphBufferAdvance, to save space on low-memory devices
-        https://bugs.webkit.org/show_bug.cgi?id=27734
+2010-02-11  Steve Block  <steveblock@google.com>
 
-        * platform/graphics/GlyphBuffer.h:
-        (WebCore::GlyphBuffer::advanceAt):
-        (WebCore::GlyphBuffer::advanceData):
-        (WebCore::GlyphBuffer::add):
+        Reviewed by David Levin.
 
-2009-08-07  Yong Li  <yong.li@torchmobile.com>
+        Guards SVG code in V8 bindings with ENABLE(SVG)
+        https://bugs.webkit.org/show_bug.cgi?id=34812
 
-        Reviewed by Eric Seidel.
+        Also updates Android V8 Makefile to generate required SVG headers.
 
-        WINCE PORT: pass unrecognized glyphs to GDI to handle
-        https://bugs.webkit.org/show_bug.cgi?id=27734
+        No new tests, build fix only.
 
-        * platform/graphics/FontFastPath.cpp:
-        (WebCore::Font::glyphDataForCharacter):
+        * Android.derived.v8bindings.mk:
+        * bindings/v8/custom/V8CSSValueCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::toV8):
 
-2009-08-07  Chris Marrin  <cmarrin@apple.com>
+2010-02-08  Maciej Stachowiak  <mjs@apple.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Cameron Zwarich.
 
-        Move Canvas related file to a subdirectories
-        https://bugs.webkit.org/show_bug.cgi?id=28026
+        Restore ENABLE_RUBY flag so vendors can ship with Ruby disabled if they choose.
+        https://bugs.webkit.org/show_bug.cgi?id=34698
 
+        * Configurations/FeatureDefines.xcconfig:
         * DerivedSources.make:
         * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/CanvasGradient.cpp: Removed.
-        * html/CanvasGradient.h: Removed.
-        * html/CanvasGradient.idl: Removed.
-        * html/CanvasPattern.cpp: Removed.
-        * html/CanvasPattern.h: Removed.
-        * html/CanvasPattern.idl: Removed.
-        * html/CanvasPixelArray.cpp: Removed.
-        * html/CanvasPixelArray.h: Removed.
-        * html/CanvasPixelArray.idl: Removed.
-        * html/CanvasRenderingContext2D.cpp: Removed.
-        * html/CanvasRenderingContext2D.h: Removed.
-        * html/CanvasRenderingContext2D.idl: Removed.
-        * html/CanvasStyle.cpp: Removed.
-        * html/CanvasStyle.h: Removed.
-        * html/canvas: Added.
-        * html/canvas/CanvasGradient.cpp: Copied from WebCore/html/CanvasGradient.cpp.
-        * html/canvas/CanvasGradient.h: Copied from WebCore/html/CanvasGradient.h.
-        * html/canvas/CanvasGradient.idl: Copied from WebCore/html/CanvasGradient.idl.
-        * html/canvas/CanvasPattern.cpp: Copied from WebCore/html/CanvasPattern.cpp.
-        * html/canvas/CanvasPattern.h: Copied from WebCore/html/CanvasPattern.h.
-        * html/canvas/CanvasPattern.idl: Copied from WebCore/html/CanvasPattern.idl.
-        * html/canvas/CanvasPixelArray.cpp: Copied from WebCore/html/CanvasPixelArray.cpp.
-        * html/canvas/CanvasPixelArray.h: Copied from WebCore/html/CanvasPixelArray.h.
-        * html/canvas/CanvasPixelArray.idl: Copied from WebCore/html/CanvasPixelArray.idl.
-        * html/canvas/CanvasRenderingContext2D.cpp: Copied from WebCore/html/CanvasRenderingContext2D.cpp.
-        * html/canvas/CanvasRenderingContext2D.h: Copied from WebCore/html/CanvasRenderingContext2D.h.
-        * html/canvas/CanvasRenderingContext2D.idl: Copied from WebCore/html/CanvasRenderingContext2D.idl.
-        * html/canvas/CanvasStyle.cpp: Copied from WebCore/html/CanvasStyle.cpp.
-        * html/canvas/CanvasStyle.h: Copied from WebCore/html/CanvasStyle.h.
-
-2009-08-07  Szabo Carol  <carol.szabo@nokia.com>
-
-        Reviewed by David Hyatt.
-
-        QtWebkit ignores letter-spacing and word-spacing styles.
-        QtWebkit handles custom letter-spacing and word-spacing in the native QFont
-        class, but the values for these options are not not passed on from
-        the platform independent part of the Font class.
-        Fixed QtWebkit behavior by applying the options to QFont when it is
-        returned via Font::font()
-
-        http://bugs.webkit.org/show_bug.cgi?id=27988
-
-        LayoutTests:
-        fast/css/word-space-extra.html
-        css2.1/t1604-c542-letter-sp-00-b-a.html
-        css2.1/t1604-c541-word-sp-01-b-a.html
-        css1/text_properties/word_spacing.html
-        
-        * platform/graphics/qt/FontQt.cpp:
-        (WebCore::Font::font):
-
-2009-08-07  Nicolas Weber  <thakis@chromium.org>
+        * html/HTMLTagNames.in: Make the ruby-related tag names conditional.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject): ifdef the code that would create ruby elements.
+        * rendering/RenderObject.h: ditto above
+        * rendering/RenderRuby.cpp: ifdef this whole file
+        * rendering/RenderRuby.h: ditto
+        * rendering/RenderRubyBase.cpp: ditto
+        * rendering/RenderRubyBase.h: ditto
+        * rendering/RenderRubyRun.cpp: ditto
+        * rendering/RenderRubyRun.h: ditto
+        * rendering/RenderRubyText.cpp: ditto
+        * rendering/RenderRubyText.h: ditto
+
+2010-02-11  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Use correct highlight color for listboxes and completion popups.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28090
-
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        Rename activeListBoxSelectionBackgroundColor to
-        platformActiveListBoxSelectionBackgroundColor, so that it actually
-        overrides a virtual method.
-
-2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Added a fourth bunch of Haiku-specific files for WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=26988
-
-        * platform/haiku/PasteboardHaiku.cpp: Added.
-        (WebCore::Pasteboard::Pasteboard):
-        (WebCore::Pasteboard::generalPasteboard):
-        (WebCore::Pasteboard::writeSelection):
-        (WebCore::Pasteboard::canSmartReplace):
-        (WebCore::Pasteboard::plainText):
-        (WebCore::Pasteboard::documentFragment):
-        (WebCore::Pasteboard::writeURL):
-        (WebCore::Pasteboard::writeImage):
-        (WebCore::Pasteboard::clear):
-        * platform/haiku/PlatformKeyboardEventHaiku.cpp: Added.
-        (WebCore::keyIdentifierForHaikuKeyCode):
-        (WebCore::windowsKeyCodeForKeyEvent):
-        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
-        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
-        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
-        * platform/haiku/PlatformMouseEventHaiku.cpp: Added.
-        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
-        * platform/haiku/PlatformWheelEventHaiku.cpp: Added.
-        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
-
-2009-08-07  Nicolas Weber  <thakis@chromium.org>
-
-        Teach WebKit how to decode jpegs in cmyk and ycck color spaces.
-        Heavily inspired by Firefox's take on this issue.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27909
+        Step attribute support for date&time types.
+        https://bugs.webkit.org/show_bug.cgi?id=30847
 
-        Reviewed by Eric Seidel.
-
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::JPEGImageReader::decode):
-        Tell jpeglib to convert ycck to cmyk and keep cmyk.
-        (WebCore::convertCMYKToRGBA):
-        Added function to convert cmyk to rgb.
-        (WebCore::convertRGBToRGBA):
-        Extracted existing conversion logic into its own function.
-        (WebCore::JPEGImageDecoder::outputScanlines):
-        Call convertCMYKToRGBA for cmyk images, convertRGBToRGBA for rgb
-        images.
-
-2009-08-07  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        SharedWorkers should be shared
-        https://bugs.webkit.org/show_bug.cgi?id=28058
-
-        Added tracking of shared workers to the SharedWorkerRepository.
-
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::create):
-        Changed SharedWorkerProxy to derive from ThreadSafeShared, as it needs to outlive the repository (if closed while some documents are still loading).
-        (WebCore::SharedWorkerProxy::thread):
-        (WebCore::SharedWorkerProxy::closing):
-        Added flag used to determine whether the worker has closed itself while loading.
-        (WebCore::SharedWorkerProxy::url):
-        (WebCore::SharedWorkerProxy::name):
-        Proxy now tracks worker URL and name to allow validity checks per section 4.8.3 of the WebWorkers spec.
-        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
-        (WebCore::SharedWorkerProxy::addToDocumentSet):
-        Added API to track the document set for a worker to allow worker shutdown. Currently does nothing.
-        (WebCore::SharedWorkerScriptLoader::SharedWorkerScriptLoader):
-        Renamed SharedWorkerLoader to be SharedWorkerScriptLoader for clarity.
-        (WebCore::SharedWorkerScriptLoader::load):
-        (WebCore::SharedWorkerScriptLoader::notifyFinished):
-        (WebCore::DefaultSharedWorkerRepository::instance):
-        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
-        Now handles "worker already loaded" case.
-        (WebCore::SharedWorkerRepository::connect):
-        Delegates to DefaultSharedWorkerRepository::connectToWorker
-        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
-        Added code to track the SharedWorkerProxy in a map, and to handle the "worker already loaded" case.
-        (WebCore::DefaultSharedWorkerRepository::getProxy):
-        Atomic get-or-create operation on the internal tracking HashMap.
-        * workers/DefaultSharedWorkerRepository.h:
-        * workers/SharedWorker.cpp:
-        (WebCore::SharedWorker::SharedWorker):
-        * workers/SharedWorkerRepository.h:
-        Removed instance() API and made constructor private to prevent instantiation.
-        (WebCore::SharedWorkerRepository::SharedWorkerRepository):
-
-2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Added four Haiku-specific files for WebCore:
-        PopupMenuHaiku.cpp, ScreenHaiku.cpp,
-        SearchPopupMenuHaiku.cpp and SoundHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28080
-
-        * platform/haiku/PopupMenuHaiku.cpp: Added.
-        (WebCore::PopupMenu::PopupMenu):
-        (WebCore::PopupMenu::~PopupMenu):
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::hide):
-        (WebCore::PopupMenu::updateFromElement):
-        (WebCore::PopupMenu::itemWritingDirectionIsNatural):
-        * platform/haiku/ScreenHaiku.cpp: Added.
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
-        (WebCore::screenDepth):
-        (WebCore::screenDepthPerComponent):
-        (WebCore::screenIsMonochrome):
-        * platform/haiku/SearchPopupMenuHaiku.cpp: Added.
-        (WebCore::SearchPopupMenu::SearchPopupMenu):
-        (WebCore::SearchPopupMenu::saveRecentSearches):
-        (WebCore::SearchPopupMenu::loadRecentSearches):
-        (WebCore::SearchPopupMenu::enabled):
-        * platform/haiku/SoundHaiku.cpp: Added.
-        (WebCore::systemBeep):
-
-2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Added two Haiku-specific files to WebCore:
-        TemporaryLinkStubs.cpp and WidgetHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28080
-
-        * platform/haiku/TemporaryLinkStubs.cpp: Added.
-        (loadResourceIntoArray):
-        (WebCore::historyContains):
-        (WebCore::supportedKeySizes):
-        (WebCore::signedPublicKeyAndChallengeString):
-        (WebCore::userIdleTime):
-        (WebCore::callOnMainThread):
-        (WebCore::SharedBuffer::createWithContentsOfFile):
-        (WebCore::KURL::fileSystemPath):
-        (WebCore::getSupportedKeySizes):
-        * platform/haiku/WidgetHaiku.cpp: Added.
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::~Widget):
-        (WebCore::Widget::frameRect):
-        (WebCore::Widget::setFrameRect):
-        (WebCore::Widget::setFocus):
-        (WebCore::Widget::setCursor):
-        (WebCore::Widget::show):
-        (WebCore::Widget::hide):
-        (WebCore::Widget::paint):
-        (WebCore::Widget::setIsSelected):
-
-2009-08-07  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
+        - Add implementation for ValidityState.stepMismatch, stepUp() and
+          stepDown() for date, datetime, datetime-local, month, time, week types.
+        - Fix string representation of DateComponents.
 
-        [V8] Fix the problem that isAttribute is set to false for onerror and
-        onmessage in worker custom code.
-        https://bugs.webkit.org/show_bug.cgi?id=28083
+        Tests: fast/forms/ValidityState-stepMismatch.html
+               fast/forms/input-stepup-stepdown.html
 
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_SETTER):
-
-2009-08-07  Vitaly Repeshko  <vitalyr@quad.spb.corp.google.com>
-
-        Reviewed by Dimitri Glazkov.
-
-        V8 bindings: speed up lookupDOMWrapper by using new V8 API function.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28071
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::lookupDOMWrapper):
-
-2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Justin Garcia.
-
-        selectionHasStyle doesn't handle text-specific properties properly
-        https://bugs.webkit.org/show_bug.cgi?id=27858
-
-        This patch modifies selectionHasStyle so that it returns TrueTriState when text styles
-        (text-decoration, font-style, font-weight, & color) are present in all text nodes,
-        regardless of whether the style is also present in their ancestor nodes or not.
-        e.g. New behavior concludes that <b><i>hello</i><i>world</i></b> has italic style.
-
-        WebKit now applies the text styles (bold, italic, etc) if the specified style was not present on
-        at least one text node, rather than at the beginning of selection except on Mac.
-        On Mac, WebKit applies the text style if the style was not present at the beginning of style.
-
-        Test: editing/execCommand/toggle-compound-styles.html
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::getPropertiesNotInComputedStyle): bug fix, must use copy instead of makeMutable for a mutable style.
-        * editing/Editor.cpp:
-        (WebCore::):
-        (WebCore::triStateOfStyleInComputedStyle): Added a boolean type to ignore text-specific styles
-        (WebCore::Editor::selectionHasStyle): Ignores text-specific styles for all but text nodes
-        * editing/EditorCommand.cpp:
-        (WebCore::executeToggleStyle): Uses selectionHasStyle instead of selectionStartHasStyle
-
-2009-08-07  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Do not register V8 error message listener in WorkerContextExecutionProxy.
-        https://bugs.webkit.org/show_bug.cgi?id=28082
-
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
-
-2009-08-07  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Eric Seidel.
-
-        Cairo-based Windows port does not handle cookies properly
-        https://bugs.webkit.org/show_bug.cgi?id=27414
-
-        curl handles cookies by itself, so using WinINet functions
-        to get and set cookies is wrong.
-
-        Replace CookieJarWin.cpp with CookieJarCurl.cpp so that
-        cookies can be implemented later once curl provides an API to
-        get and set cookies.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-08-07  Michael Nordman  <michaeln@google.com>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28074
-
-        V8 bindings for the window.applicationCache attribute.
-
-        * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp: Added.
-
-2009-08-07  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Right click on timeline of media controls panel cause seek
-        https://bugs.webkit.org/show_bug.cgi?id=27920
-
-        Add a test simulate the behavior of seeking by right clicking
-        on the time bar of media controls while playing.
-
-        * media/controls-right-click-on-timebar-expected.txt: Added.
-        * media/controls-right-click-on-timebar.html: Added.
-
-2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+        * html/HTMLInputElement.cpp:
+          - Change monthDefaultMaximum so that DateComponents::m_year doesn't overflow.
+        (WebCore::HTMLInputElement::stepBase):
+        (WebCore::HTMLInputElement::stepMismatch):
+        (WebCore::HTMLInputElement::getStepParameters):
+        (WebCore::HTMLInputElement::getAllowedValueStep):
+        (WebCore::HTMLInputElement::applyStep):
+          Renamed from applyStepForNumberOrRange(), and add support for other types.
+        (WebCore::HTMLInputElement::stepUp): Rename applyStepForNumberOrRange().
+        (WebCore::HTMLInputElement::stepDown): Rename applyStepForNumberOrRange().
+        (WebCore::HTMLInputElement::setValueAsDate): Use setDateValue().
+        (WebCore::HTMLInputElement::setDateValue):
+          A helper function to make the best representation of DateComponents.
+        (WebCore::HTMLInputElement::setValueAsNumber):  Use setDateValue().
+        * html/HTMLInputElement.h:
 
-        Reviewed by Justin Garcia.
+2010-02-10  Oliver Hunt  <oliver@apple.com>
 
-        deprecatedCopyInheritableProperties must be replaced by two different functions
-        https://bugs.webkit.org/show_bug.cgi?id=28057
+        Reviewed by Gavin Barraclough.
 
-        This patch deletes deprecatedInheritableProperties and modifies call callees to call either editingStyleAtPosition
-        or prepareEditingStyleToApplyAt. The concept of editing style is introduced in this patch,
-        which consists of all CSS properties need to be preserved under editing operations.
+        postMessage does not send ImageData
+        https://bugs.webkit.org/show_bug.cgi?id=34825
 
-        No test is added since this patch does not change any behavior.
+        Implement serialisation of ImageData, and for testing reasons
+        expose the ImageData constructor (which should already have
+        been exposed).
 
-        * css/CSSComputedStyleDeclaration.cpp: Removed deprecatedCopyInheritableProperties
-        * css/CSSComputedStyleDeclaration.h: Removed deprecatedCopyInheritableProperties
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::):
-        (WebCore::editingStyleAtPosition): Obtains the editing-specific computed style at the position
-        (WebCore::prepareEditingStyleToApplyAt): Removes redundant editing styles at the specified position
-        (WebCore::removeStylesAddedByNode): Removes the style derived from the specified node
-        * editing/ApplyStyleCommand.h:
-        (WebCore::):
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::moveParagraphs): Uses editingStyleAtPosition
-        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Uses editingStyleAtPosition
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::removeEnclosingAnchorStyle): Uses removeStyleOfNode
-        (WebCore::DeleteSelectionCommand::saveTypingStyleState): Uses editingStyleAtPosition
-        (WebCore::DeleteSelectionCommand::calculateTypingStyleAfterDelete): Uses prepareEditingStyleToApplyAt
-        * editing/EditCommand.cpp:
-        * editing/EditCommand.h:
-        * editing/InsertParagraphSeparatorCommand.cpp:
-        (WebCore::InsertParagraphSeparatorCommand::calculateStyleBeforeInsertion): Uses editingStyleAtPosition
-        (WebCore::InsertParagraphSeparatorCommand::applyStyleAfterInsertion): Uses prepareEditingStyleToApplyAt
-        * editing/RemoveFormatCommand.cpp:
-        (WebCore::RemoveFormatCommand::doApply): Uses editingStyleAtPosition
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::handleStyleSpansBeforeInsertion): Uses editingStyleAtPosition
-        (WebCore::ReplaceSelectionCommand::handleStyleSpans): Uses editingStyleAtPosition and prepareEditingStyleToApplyAt
-        (WebCore::ReplaceSelectionCommand::doApply): Uses prepareEditingStyleToApplyAt
-        * editing/markup.cpp:
-        (WebCore::removeEnclosingMailBlockquoteStyle): Uses removeStyleOfNode
-        (WebCore::removeDefaultStyles): Uses prepareEditingStyleToApplyAt
-        (WebCore::createMarkup): Uses editingStyleAtPosition
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedImageData::create):
+        (WebCore::SerializedImageData::width):
+        (WebCore::SerializedImageData::height):
+        (WebCore::SerializedImageData::data):
+        (WebCore::SerializedImageData::SerializedImageData):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SharedSerializedData::asImageData):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::TeardownTreeWalker::convertIfTerminal):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::asImageData):
+        * html/canvas/CanvasPixelArray.h:
+        (WebCore::CanvasPixelArray::data):
+        * page/DOMWindow.idl:
 
-2009-08-07  Steve Block  <steveblock@google.com>
+2010-02-10  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Darin Adler.
 
-        Bug 27250: Geolocation callback function IDL files are superfluous
-        https://bugs.webkit.org/show_bug.cgi?id=27250
-
-        The objects for the Geolocation success and error callbacks are created 'manually' in
-        WebCore/bindings/js/JSGeolocationCustom.cpp. Furthermore, the callback interfaces are 
-        marked 'NoInterfaceObject' in the W3C spec, so the prototype should not
-        appear on the window object. Hence IDL files for these callbacks are not required.
+        Address last round of review comments on r53607
+        https://bugs.webkit.org/show_bug.cgi?id=33940
 
-        See http://www.w3.org/TR/geolocation-API/#geolocation_interface and
-        http://www.w3.org/TR/WebIDL/#NoInterfaceObject.
-
-        No new tests required.
-
-        * DerivedSources.make: Modified. Removed reference to IDL files.
-        * WebCore.gypi: Modified. Removed reference to IDL files.
-        * WebCore.xcodeproj/project.pbxproj: Modified. Removed reference to IDL files.
-        * page/PositionCallback.idl: Removed.
-        * page/PositionErrorCallback.idl: Removed.
-
-2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by David Levin.
+        Mostly renaming and cleaning up.
 
-        Build fix for Qt when ENABLE_VIDEO = 0.  This was necessitated by r46890 which
-        put the idl files back into play regardless of compile time defines.
-
-        * html/TimeRanges.idl:
-
-2009-08-07  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Coding style patches for RenderThemeQt.cpp based on results from cpp_style.py.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28050
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::baselinePosition):
-        (WebCore::inflateButtonRect):
-        (WebCore::RenderThemeQt::supportsFocus):
-        (WebCore::RenderThemeQt::applyTheme):
-
-2009-08-07  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Prevent RenderThemeQt AdjustStyle based calls for TextField, MenuList and MenuListButton
-        from discarding style colour.
-
-        Add tests and remove tests from platform/qt/Skipped that now pass.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28050
-
-        Tests: fast/forms/menulist-style-color.html
-               fast/forms/text-style-color.html
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::adjustTextFieldStyle):
-        (WebCore::RenderThemeQt::adjustMenuListStyle):
-        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
-
-2009-08-07  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22495
-        [V8] Re-land http://trac.webkit.org/changeset/46821, now that
-        http://trac.webkit.org/changeset/46874 re-landed
-
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::create):
+        (WebCore::CSSStyleSheet::createInline):
+        * css/StyleBase.cpp:
+        (WebCore::StyleBase::baseURL):
+        * css/StyleSheet.cpp:
+        (WebCore::StyleSheet::StyleSheet):
+        * css/StyleSheet.h:
+        (WebCore::StyleSheet::href):
+        (WebCore::StyleSheet::setFinalURL):
+        (WebCore::StyleSheet::finalURL):
+        * dom/Document.cpp:
+        (WebCore::Document::updateBaseURL):
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+        * xml/XSLImportRule.cpp:
+        (WebCore::XSLImportRule::loadSheet):
+        * xml/XSLStyleSheet.h:
+        (WebCore::XSLStyleSheet::create):
+        (WebCore::XSLStyleSheet::createInline):
+        * xml/XSLStyleSheetLibxslt.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet):
+        (WebCore::XSLStyleSheet::parseString):
+        (WebCore::XSLStyleSheet::loadChildSheets):
+        * xml/XSLStyleSheetQt.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet):
 
-2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+2010-02-10  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Reviewed by Darin Adler and George Staikos.
+        Reviewed by Ariya Hidayat.
 
-        Add rectToRect convenience function which returns the TransformationMatrix
-        which maps the 'from' rectangle to the 'to' rectangle.
+        [Qt] GraphicsLayer: somtimes the item flickers at the end of an animation
+        This is because we try to delete the animation when finished: that is
+        unnecessary. WebCore manages the animation's lifecycle and makes sure
+        to call the right function when the animation can be deleted.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28067
+        https://bugs.webkit.org/show_bug.cgi?id=34761
 
-        No tests as this would require binding the method to js and since it is static
-        that doesn't seem possible.  Please check the math.
+        No new tests.
 
-        * platform/graphics/transforms/TransformationMatrix.cpp:
-        (WebCore::TransformationMatrix::rectToRect):
-        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQt::addAnimation): No need to delete here
+        (WebCore::GraphicsLayerQt::removeAnimationsForProperty): deleteLater
 
-2009-08-07  Brady Eidson  <beidson@apple.com>
+2010-02-10  Kevin Ollivier  <kevino@theolliviers.com>
 
-        Reviewed by Darin Adler.
+        [wx] Build fix for wxMac/Cocoa.
 
-        Implement the HTML5 hashchange event.
-        https://bugs.webkit.org/show_bug.cgi?id=21605
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp: Removed.
+        * platform/wx/wxcode/mac/carbon/fontprops.mm: Copied from WebCore/platform/wx/wxcode/mac/carbon/fontprops.cpp.
+        * wscript:
 
-        Test: fast/loader/hashchange-event.html
+2010-02-10  Jon Honeycutt  <jhoneycutt@apple.com>
 
-        * dom/EventNames.h: Add "hashchange"
-        * html/HTMLAttributeNames.in: Add "onhashchange"
+        REGRESSION(24929): PDF page doesn't load in background tab
 
-        * loader/FrameLoader.cpp:
-        (WebCore::HashChangeEventTask::create):
-        (WebCore::HashChangeEventTask::performTask):
-        (WebCore::HashChangeEventTask::HashChangeEventTask):
-        (WebCore::FrameLoader::scrollToAnchor): When an anchor navigation is completed and the
-          new fragment identifier is different from the old one, queue a hash change event
-          on the Document.
-
-        Add a window event listener for the hashchange event if onhashchange is encountered:
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::parseMappedAttribute): 
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        Reviewed by Dan Bernstein.
 
-        Add a new string utility method that gives "null and empty are equivalent" behavior:
-        * platform/text/PlatformString.h:
-        (WebCore::equalIgnoringNullity):
-        * platform/text/StringImpl.cpp:
-        (WebCore::equalIgnoringNullity):
-        * platform/text/StringImpl.h:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::startOrAddToUnstartedList):
+        Only delay loading of the plug-in if we'll kick off our own load of the
+        plug-in data later, in start().
 
-2009-08-07  Jessie Berlin  <jberlin@apple.com>
+2010-02-10  Enrica Casucci  <enrica@apple.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Simon Fraser.
 
-        Add the initial implementation of the ability to resize the columns in
-        a DataGrid in the Web Inspector. Enables that functionality in both the
-        Profile View and in the Local Storage View.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26182
+        Crash in WebKit!WebCore::RenderTextControlSingleLine::createInnerTextStyle doing anything in Safari after sitting on a page with 3D site        
+        <rdar://problem/7557201>
+        https://bugs.webkit.org/show_bug.cgi?id=34823
         
-        In this version, resizing a column can change the width of at most two
-        columns (the columns to the left and right of the resizer being dragged).
+        No tests added because the code is exercised by the existing tests.
         
-        Possible changes in future patches:
+        The root cause was the fact that we were not releasing a reference that was held by CA.
+        In debug builds we had an assert in the destructor of WKCACFLayer.
         
-        1) Be able to specify the minimum size of a column and the maximum size
-           of a column. If the minimum size is equal to the maximum size, the
-           column can't be resized.
-        2) Make the behavior more in line with the following description:
-        
-        Everything before the column that is resized stays fixed size. The
-        resized column changes sizes. The other columns except the last stay
-        the same size. And the last column adjusts to fit with a minimum size.
-        If the last column is already the minimum, the next to last column
-        shrinks, etc.
-        
-        3) Make it possible to scale the column sizes appropriately when the
-           Web Inspector window gets resized.
-        
-        * inspector/front-end/DOMStorageItemsView.js:
-        (WebInspector.DOMStorageItemsView.prototype.update):
-        Once the DataGrid is added to the DOM, update the widths of the
-        DataGrid in order to put the resizers in place.
-        (WebInspector.DOMStorageItemsView.prototype.resize):
-        Update the widths of the DataGrid in order to correctly adjust the
-        positions of the resizers.
-        
-        * inspector/front-end/DataGrid.js:
-        (WebInspector.DataGrid):
-        Store column groups whose widths can later be changed when the columns
-        are resized by the user.
-        Also, keep track of whether the widths of the columns have been
-        initialized.
-        (WebInspector.DataGrid.prototype.updateWidths):
-        Create the resizers for the columns.
-        (WebInspector.DataGrid.prototype._clickInDataTable):
-        Didn't actually change anything in this method, just added a comma to
-        the end of the function.
-        (WebInspector.DataGrid.prototype._startResizerDragging):
-        Store the resizer that is currently dragging.
-        (WebInspector.DataGrid.prototype._resizerDragging):
-        Constrain the area that the resizer can be dragged to the column to
-        it's left and right, with some padding added to make sure that the
-        neighboring columns don't disappear.
-        (WebInspector.DataGrid.prototype._endResizerDragging):
-        
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.resize):
-        Resize the view.
-        (WebInspector.DatabasesPanel.prototype._updateSidebarWidth):
-        ditto.
-        
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView.prototype.show):
-        Now that the DataGrid is actually attached to the DOM, update the
-        widths of the DataGrid in order to put the resizers in place.
-        (WebInspector.ProfileView.prototype.resize):
-        Update the widths of the DataGrid in order to correctly adjust the
-        positions of the resizers.
-        
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.resize):
-        Resize the view.
-        (WebInspector.ProfilesPanel.prototype._updateSidebarWidth):
-        ditto.
-        
-        * inspector/front-end/inspector.css:
-        Add in a style rule for a resizer in the Data Grid.
-
-2009-08-07  Simon Hausmann  <simon.hausmann@nokia.com>
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::GraphicsLayerCACF::~GraphicsLayerCACF):
 
-        Reviewed by Tor Arne Vestbø.
+2010-02-10  Kwang Yul Seo  <skyul@company100.net>
 
-        Back out r46847 and fix the Qt build system to always generate
-        all the JS binding files from IDL files. The generated files
-        have #if feature guards, so the #ifs are not needed in the
-        files using them.
+        Reviewed by Eric Seidel.
 
-        * WebCore.pro:
-        * bindings/js/JSEventTarget.cpp:
-        * bindings/js/JSWorkerContextBase.cpp:
-        * bindings/js/WorkerScriptController.cpp:
+        [BREWMP] Typedef DragImageRef
+        https://bugs.webkit.org/show_bug.cgi?id=34791
 
-2009-08-07  Shinichiro Hamaji  <hamaji@chromium.org>
+        Use IImage* as it is the BREW's image type.
 
-        Reviewed by Adele Peterson.
+        * platform/DragImage.h:
 
-        Cannot scroll for box-reflect:right
-        https://bugs.webkit.org/show_bug.cgi?id=27979
+2010-02-10  Beth Dakin  <bdakin@apple.com>
 
-        Update m_overflowLeft an m_overflowWidth for reflection just like
-        m_overflowTop and m_overflowHeight.
+        Reviewed by Simon Fraser and Darin Adler.
 
-        Test: fast/reflections/reflection-overflow-scroll.html
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=34185 REGRESSION: 
+        Mask not invalidating
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlock):
+        SVGMaskElement is the only class that keeps a HashMap of canvas 
+        resources rather than just a pointer to a resource. This 
+        patch makes SVGMaskElement invalidate all of its resources in the 
+        HashMap instead of just one.
 
-2009-08-06  Shinichiro Hamaji  <hamaji@chromium.org>
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::svgAttributeChanged):
+        (WebCore::SVGMaskElement::childrenChanged):
+        (WebCore::SVGMaskElement::invalidateCanvasResources):
+        * svg/SVGMaskElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::invalidateResourcesInAncestorChain):
+        (WebCore::SVGStyledElement::invalidateCanvasResources):
+        * svg/SVGStyledElement.h:
 
-        Reviewed by Adam Barth.
+2010-02-10  Stephan Aßmus  <superstippi@gmx.de>
 
-        box-shadow's spread is ignored with <table>
-        https://bugs.webkit.org/show_bug.cgi?id=28017
+        Reviewed by David Levin.
 
-        Use RenderStyle::getBoxShadowExtent just like RenderBlock.
+        Fixes to rect conversion and image rendering on Haiku
+        https://bugs.webkit.org/show_bug.cgi?id=34684
 
-        Test: fast/box-shadow/box-shadow-overflow-scroll.html
+        Covered by existing tests.
 
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout):
+        The changes to the rect conversions are indeed correct. In Haiku (to stay
+        compatibly with BeOS), a BRect specifies the left/top and bottom/right pixel
+        *indices*, even though the values are floating point. So a rectangle covering
+        just one pixel would be specified as BRect(0, 0, 0, 0). In WebCore and other
+        frame works, such rectangles would be expressed as 0, 0, 1, 1. In WebCore, the
+        width and height of rectangles refer to the distance between pixels, while on
+        Haiku, a one pixel rect has indeed a width and height of 0, as confusing as
+        that may be.
 
-2009-08-06  Joseph Pecoraro  <joepeck02@gmail.com>
+        The part of the patch that affects
+        WebCore/platform/graphics/haiku/ImageHaiku.cpp also implements the drawing
+        methods more correctly. Image observers are notified, and pattern drawing takes
+        the "phase" into account which makes scrolled backgrounds render correctly.
+        Transformations are still not supported, since the Haiku drawing backend itself
+        does not yet support them.
 
-        Reviewed by Timothy Hatcher.
+        Use OwnPtr when creating the BBitmap to avoid future leaks with early returns.
 
-        Inspector: NodeLists Don't Display Well in the Console
-        https://bugs.webkit.org/show_bug.cgi?id=28061
+        Convert the bitmap data to non pre-multiplied until Haiku supports drawing
+        pre-multiplied bitmaps.
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._format): Specific check if the object is a NodeList, display as an "array"
+        * platform/graphics/haiku/FloatRectHaiku.cpp: Fixed conversion
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::BitmapImage::draw): Fixed placement, notify observers
+        (WebCore::Image::drawPattern): Implemented using "phase" to fix scrolling, notify observers
+        * platform/graphics/haiku/IntRectHaiku.cpp: Fixed conversion
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp: Fixed conversion
 
-2009-08-06  Yusuke Sato  <yusukes@chromium.org>
+2010-02-10  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by David Levin.
 
-        Chromium Linux: add support for @font-face
-        https://bugs.webkit.org/show_bug.cgi?id=28015
-        
-        * loader/CachedFont.cpp:
-        (WebCore::CachedFont::~CachedFont):
-        (WebCore::CachedFont::ensureCustomFontData):
-        (WebCore::CachedFont::platformDataFromCustomData):
-        (WebCore::CachedFont::allClientsRemoved):
+        Clean up unused member var and initialization in Document
+        https://bugs.webkit.org/show_bug.cgi?id=34820
 
-        Modified #ifdefs so that chromium linux can load remote fonts.
+        Remove unused m_secureForms member variable in Document.
         
-        * platform/graphics/chromium/FontCustomPlatformData.cpp:
-        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
-        (WebCore::FontCustomPlatformData::fontPlatformData):
-        (WebCore::createFontCustomPlatformData):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
 
-        Create SkTypeface for a web font by calling SkTypeface::CreateFromStream function.
-        
-        (WebCore::RemoteFontStream::RemoteFontStream):
-        (WebCore::RemoteFontStream::~RemoteFontStream):
-        (WebCore::RemoteFontStream::rewind):
-        (WebCore::RemoteFontStream::read):
+2010-02-10  Kevin Watters  <kevinwatters@gmail.com>
 
-        New class that implements SkStream interface and wraps wtf's SharedBuffer.
-        
-        * platform/graphics/chromium/FontCustomPlatformData.h:
-        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+        Reviewed by Kevin Ollivier.
 
-        Added member variables for Linux.
+        [wx] Add Windows complex text support and Mac support for containsCharacters.
         
-2009-08-06  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Fix JPEGImageDecoder.cpp compile error on WinCE
-        https://bugs.webkit.org/show_bug.cgi?id=28051
-
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-
-2009-08-06  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Reviewed by Eric Seidel.
-
-        Adding WebCore support for the waf build system for wx.
+        https://bugs.webkit.org/show_bug.cgi?id=34759
         
-        https://bugs.webkit.org/show_bug.cgi?id=27619
-
-        * wscript: Added.
-
-2009-08-06  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed revert.
-
-        http://bugs.webkit.org/show_bug.cgi?id=27879
-
-        Revert 46877 because it broke GTK.
-
-        * platform/graphics/wince/GraphicsContextWince.cpp:
-
-2009-08-06  Chris Fleizach  <cfleizach@apple.com>
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/wx/FontPlatformData.h:
+        (WebCore::FontPlatformData::roundsGlyphAdvances):
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::useGDI):
+        (WebCore::FontPlatformData::hfont):
+        * platform/graphics/wx/FontWx.cpp:
+        (WebCore::Font::canReturnFallbackFontsForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        (WebCore::SimpleFontData::scriptFontProperties):
+        (WebCore::SimpleFontData::initGDIFont):
+        (WebCore::SimpleFontData::platformCommonDestroy):
+        (WebCore::SimpleFontData::widthForGDIGlyph):
+        * platform/wx/wxcode/fontprops.h:
+        * platform/wx/wxcode/gtk/fontprops.cpp:
+        (wxFontContainsCharacters):
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (wxFontContainsCharacters):
+        * platform/wx/wxcode/win/fontprops.cpp:
+        (wxFontContainsCharacters):
+        * platform/wx/wxcode/win/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * wscript:
 
+2010-02-10  Kwang Yul Seo  <skyul@company100.net>
         Reviewed by Eric Seidel.
 
-        Bug 27956 - AX: roleValue should be cached for performance
-        https://bugs.webkit.org/show_bug.cgi?id=27956
-
-        Caches the role value of an accessibility object instead of calculating it everytime.
-        The changes gained a 5% speedup using VoiceOver to navigate a webpage.
-
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::handleAriaRoleChanged):
+        [BREWMP] Add dummy Frame::dragImageForSelection
+        https://bugs.webkit.org/show_bug.cgi?id=34792
 
-        Use generic role setter instead of specific ARIA role setter.
-
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::AccessibilityObject):
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::headingLevel):
-
-        Make headingLevel into instance method so that it can *safely* be called in the constructor.
-
-        (WebCore::AccessibilityObject::setRoleValue):
-        (WebCore::AccessibilityObject::roleValue):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
-        (WebCore::AccessibilityRenderObject::headingLevel):
-        (WebCore::AccessibilityRenderObject::intValue):
-        (WebCore::AccessibilityRenderObject::updateAccessibilityRole):
-        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (AXAttributeStringSetHeadingLevel):
-
-2009-08-06  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
-
-        Reviewed by Adam Barth.
-
-        Change Noncopyable inheriting to public
-        http://bugs.webkit.org/show_bug.cgi?id=27879
-
-        Since Noncopyable is inherited from FastAllocBase, Noncopyable's
-        inheriting has been changed to public.
-
-        * platform/graphics/wince/GraphicsContextWince.cpp:
-
-2009-08-06  Mark Rowe  <mrowe@apple.com>
-
-        Rubber-stamped by Sam Weinig.
+        Add FrameBrew.cpp which contains a dummy implementation of
+        Frame::dragImageForSelection.
 
-        Add explicit dependencies for our build verification scripts to ensure that they always run after linking has completed.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-08-05  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler.
+        * page/brew/FrameBrew.cpp: Added.
+        (WebCore::Frame::dragImageForSelection):
 
-        Implement the matchMedium method on the Media interface described in the CSSOM View Module.
-        https://bugs.webkit.org/show_bug.cgi?id=22495
-        
-        Add a new Media interface, obtainable via the AbstractView, that can
-        evaluate queries via its matchesMedium() method.
+2010-02-10  Kevin Ollivier  <kevino@theolliviers.com>
 
-        Test: fast/media/matchmedium-query-api.html
+        [wx] Build fix. Switch drawPattern to Image class like other platforms.
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        Add Media.* files to the build.
-
-        * css/Media.cpp: Added.
-        (WebCore::Media::Media):
-        (WebCore::Media::type):
-        (WebCore::Media::matchMedium):
-        * css/Media.h: Added.
-        (WebCore::Media::create):
-        (WebCore::Media::document):
-        * css/Media.idl: Added.
-        Media::matchMedium() uses a MediaQueryEvaluator() to test the query.
-
-        * page/AbstractView.idl:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::media):
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-        Add a readonly attribute for Media.
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::Image::drawPattern):
 
-2009-08-06  Michelangelo De Simone  <micdesim@gmail.com>
+2010-02-10  Chris Marrin  <cmarrin@apple.com>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27455
-        Support for a custom validation message in ValidityState and related
-        form controls.
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#dom-cva-setcustomvalidity
-
-        Tests: fast/forms/ValidityState-customError-001.html
-               fast/forms/ValidityState-customError-002.html
-               fast/forms/ValidityState-customError-003.html
-               fast/forms/ValidityState-customError-004.html
-
-        * html/HTMLButtonElement.idl: setCustomValidity DOM method
-        * html/HTMLFieldSetElement.idl: ditto
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::setCustomValidity): ditto
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::valueMissing): moved down
-        * html/HTMLInputElement.idl: ditto
-        * html/HTMLSelectElement.idl: ditto
-        * html/HTMLTextAreaElement.idl:
-        * html/ValidityState.h:
-        (WebCore::ValidityState::setCustomErrorMessage): method to set custom
-        validation message
-        (WebCore::ValidityState::customError): validation flag
-
-2009-08-06  Mark Rowe  <mrowe@apple.com>
-
-        Bring a little order to our otherwise out of control lives.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-08-06  Mark Rowe  <mrowe@apple.com>
-
-        Stop copying .idl files in to the framework resources directory.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-08-06  Mark Rowe  <mrowe@apple.com>
-
-        Fix the build some more.
-
-        Add JSWebSocket.cpp and JSWebSocket.h to the Xcode project, and move the WebSocket-related
-        files and groups in to the appropriate locations.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-08-06  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Add WebSocket.idl
-        https://bugs.webkit.org/show_bug.cgi?id=27209
-
-        Add WebSocket.idl in WebCore/websockets/.
-        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
-        Other build systems will be updated once the code is functional.
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSWebSocketConstructor.cpp: Added.
-        * bindings/js/JSWebSocketConstructor.h: Added.
-        * bindings/js/JSWebSocketCustom.cpp: Added.
-        * websockets/WebSocket.cpp: Added.
-        * websockets/WebSocket.h: Added.
-        * websockets/WebSocket.idl: Added.
-
-2009-08-06  Jian Li  <jianli@chromium.org>
+        Added CA_PRINT_TREE functionality to WKCACFLayer implementation
+        https://bugs.webkit.org/show_bug.cgi?id=34779
+        
+        I've tried to duplicate the look of the output on Mac, but
+        it's not quite the same. It shows all the useful information though.
+        It is enabled by setting the environment variable CA_PRINT_TREE=1
+        
+        * platform/graphics/win/WKCACFLayer.cpp:Implementation of printTree
+        (WebCore::WKCACFLayer::isTransformLayer):
+            Moved function to cpp file because it needs to use the function form
+            of kCACFTransformLayer because the DLL is delay loaded, and that function
+            can only be called from the cpp file.
+        (WebCore::WKCACFLayer::sublayerAtIndex):
+        (WebCore::printIndent):
+        (WebCore::printTransform):
+        (WebCore::WKCACFLayer::printTree):Prints from this layer down
+        (WebCore::WKCACFLayer::printLayer):Prints this layer and recursively calls sublayers
+        * platform/graphics/win/WKCACFLayer.h:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::WKCACFLayerRenderer):
+        (WebCore::WKCACFLayerRenderer::createRenderer):Adds a name to the root layers
+        (WebCore::WKCACFLayerRenderer::render):Calls printTree when CA_PRINT_TREE is 1
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        
+2010-02-10  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Adam Barth.
 
-        [V8] Style cleaning for WorkerContextExecutionProxy.
-        https://bugs.webkit.org/show_bug.cgi?id=27997
+        Change V8DOMWrapper::lookupDOMWrapper() and configureTemplate()
+        to not use V8ClassIndex.
 
-        Cleanup WorkerContextExecutioonProxy related files to follow
-        WebKit coding styles after all V8 binding codes are upstreamed.
-        1) Lower-case the first letter of remaining functins in class
-           WorkerContextExecutionProxy. Update the V8 code generator
-           and all other references accordingly.
-        2) Integrate getConstructor from WorkerContextExecutionProxy
-           to V8DOMWrapper.
-        3) Other misc changes, like removing trailing whitespaces and
-           sorting the include files.
+        https://bugs.webkit.org/show_bug.cgi?id=34768
 
         * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
         * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getConstructorForContext):
-        (WebCore::V8DOMWrapper::convertToV8Object):
         * bindings/v8/V8DOMWrapper.h:
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::~V8WorkerContextEventListener):
-        (WebCore::V8WorkerContextEventListener::handleEvent):
-        (WebCore::V8WorkerContextEventListener::reportError):
-        (WebCore::V8WorkerContextEventListener::getReceiverObject):
-        * bindings/v8/V8WorkerContextObjectEventListener.cpp:
-        (WebCore::weakObjectEventListenerCallback):
+        * bindings/v8/V8Proxy.cpp:
         * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::handleConsoleMessage):
-        (WebCore::WorkerContextExecutionProxy::dispose):
-        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
-        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
-        (WebCore::WorkerContextExecutionProxy::convertEventToV8Object):
-        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
-        (WebCore::WorkerContextExecutionProxy::convertWorkerContextToV8Object):
-        (WebCore::WorkerContextExecutionProxy::toV8):
-        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
-        (WebCore::WorkerContextExecutionProxy::removeEventListener):
-        * bindings/v8/WorkerContextExecutionProxy.h:
-        (WebCore::WorkerContextExecutionProxy::context):
-        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-08-06  Darin Adler  <darin@apple.com>
-
-        Fix Mac Leopard debug build.
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::equalIgnoringCase): Removed meaningless assertion; an unsigned
-        is always >= 0 and checking causes a warning in the newer versions of gcc.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
 
-2009-08-06  Adam Barth  <abarth@webkit.org>
+2010-02-10  Nate Chapin  <japhet@chromium.org>
 
-        Unreview rollout.
+        Reviewed by Dimitri Glazkov.
 
-        Revert 46840 because it broke the reliability tests.
+        [V8] Handle the possibility that ScheduledAction::execute() may
+        retrieve a null V8Proxy* even if not in a WorkerContext (e.g., if
+        JS was disallowed).
 
         * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
         (WebCore::ScheduledAction::execute):
-        * bindings/v8/ScheduledAction.h:
-        (WebCore::ScheduledAction::ScheduledAction):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
-
-2009-08-06  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed rollout.
-
-        Revert 46840 in preparation to revert 46838, which broke the reliability tests.
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::updateDocumentWrapperCache):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::mainWorldContext):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::context):
-
-2009-08-06  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: move style-related utilities into InjectedScript.
-
-        http://bugs.webkit.org/show_bug.cgi?id=27939
-
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.CSSStyleDeclaration):
-        (WebInspector.CSSStyleDeclaration.prototype.isPropertyImplicit):
-        (WebInspector.CSSStyleDeclaration.prototype.styleTextWithShorthands):
-        (WebInspector.CSSStyleDeclaration.prototype.getLonghandProperties):
-        (WebInspector.CSSStyleDeclaration.prototype.getShorthandPriority):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.applyStyleText):
-        (InjectedScript.toggleStyleEnabled):
-        (InjectedScript._serializeStyle):
-        (InjectedScript._getUniqueStyleProperties):
-        (InjectedScript._getLonghandProperties):
-        (InjectedScript._getShorthandPriority):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype._update):
-        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
-        (WebInspector.StylePropertiesSection.prototype.onpopulate):
-        (WebInspector.StylePropertyTreeElement.prototype.get priority):
-        (WebInspector.StylePropertyTreeElement.prototype.get value):
-        (WebInspector.StylePropertyTreeElement.prototype):
-        * inspector/front-end/utilities.js:
-
-2009-08-06  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Unreviewed build fix, add #ifdef guards around
-        inclusions of shared worker specific files.
-
-        * bindings/js/JSEventTarget.cpp:
-        * bindings/js/JSWorkerContextBase.cpp:
-        * bindings/js/WorkerScriptController.cpp:
-
-2009-08-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        cssgrammar.cpp fails to compile with RVCT compiler
-        https://bugs.webkit.org/show_bug.cgi?id=27952
-
-        * css/CSSGrammar.y: Do not convert to String to get rid of the stray
-        memory allocation 
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::equalIgnoringCase):
-        * platform/text/StringImpl.h: 
-        (WebCore::equalIgnoringCase): Add charactersEqualIgnoringCase
-          function that works with a character pointer and length
-
-2009-08-06  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Created first working implementation of SharedWorkers (execution only, no sharing).
-        https://bugs.webkit.org/show_bug.cgi?id=27927
-
-        Added initial implementations of SharedWorkerThread and SharedWorkerContext.
-        No v8 bindings yet.
-
-        * DerivedSources.cpp:
-        Added shared worker files.
-        * DerivedSources.make:
-        Added shared worker files.
-        * GNUmakefile.am:
-        Added shared worker files.
-        * WebCore.gypi:
-        Added shared worker files.
-        * WebCore.pro:
-        Added shared worker files.
-        * WebCore.vcproj/WebCore.vcproj:
-        Added shared worker files.
-        * WebCore.xcodeproj/project.pbxproj:
-        Added shared worker files.
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        Added code to convert from EventTarget to correct JS class.
-        (WebCore::toEventTarget):
-        Added code to cast from JS object to appropriate EventTarget impl class.
-        * bindings/js/JSSharedWorkerConstructor.cpp:
-        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
-        (WebCore::constructSharedWorker):
-        Tweaked the constructor code to pass in the lexical global object like normal workers.
-        * bindings/js/JSSharedWorkerContextCustom.cpp: Added.
-        (WebCore::JSSharedWorkerContext::mark):
-        Custom marking of the onconnect handler.
-        * bindings/js/JSWorkerContextBase.cpp:
-        (WebCore::toJSSharedWorkerContext):
-        (WebCore::toJSWorkerContext):
-        Added proper conversion to the correct WorkerContext derived class.
-        * bindings/js/JSWorkerContextBase.h:
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::initScript):
-        Updated WorkerScriptController to create the correct type of binding object (JSSharedWorkerContext vs JSDedicatedWorkerContext)
-        * bindings/scripts/CodeGeneratorV8.pm:
-        Added support for SharedWorkerContext.
-        * bindings/v8/DOMObjectsInclude.h:
-        Added shared worker bindings files.
-        * dom/EventNames.h:
-        Added connect event.
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toSharedWorkerContext):
-        Added API for casting to new derived class (SharedWorkerContext).
-        * dom/EventTarget.h:
-        * workers/AbstractWorker.cpp:
-        (WebCore::AbstractWorker::resolveURL):
-        Moved code that resolves/validates URLs to base class so it can be shared between dedicated/shared workers.
-        * workers/AbstractWorker.h:
-        * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::logException):
-        Refactored exception handling code - moved onerror handling to base class.
-        * workers/DedicatedWorkerContext.h:
-        (WebCore::DedicatedWorkerContext::isDedicatedWorkerContext):
-        * workers/SharedWorker.cpp:
-        (WebCore::SharedWorker::SharedWorker):
-        Changed constructor to fire up worker thread.
-        * workers/SharedWorker.h:
-        * workers/SharedWorkerContext.cpp: Added.
-        (WebCore::SharedWorkerContext::SharedWorkerContext):
-        (WebCore::SharedWorkerContext::~SharedWorkerContext):
-        (WebCore::SharedWorkerContext::logException):
-        (WebCore::SharedWorkerContext::addMessage):
-        Placeholder methods until we add support for sending exceptions/messages to console.
-        (WebCore::SharedWorkerContext::dispatchConnect):
-        (WebCore::SharedWorkerContext::thread):
-        * workers/SharedWorkerContext.h: Added.
-        (WebCore::SharedWorkerContext::create):
-        (WebCore::SharedWorkerContext::isSharedWorkerContext):
-        (WebCore::SharedWorkerContext::toSharedWorkerContext):
-        (WebCore::SharedWorkerContext::setOnconnect):
-        (WebCore::SharedWorkerContext::onconnect):
-        (WebCore::SharedWorkerContext::name):
-        * workers/SharedWorkerContext.idl: Added.
-        * workers/SharedWorkerRepository.h: Added.
-        (WebCore::SharedWorkerRepository::~SharedWorkerRepository):
-        * workers/DefaultSharedWorkerRepository.cpp: Added.
-        Implementation of core singleton class that will be used to implement sharing.
-        (WebCore::SharedWorkerProxy::setThread):
-        Proxy object used to handle resource loading for a given shared worker.
-        (WebCore::SharedWorkerProxy::postTaskToLoader):
-        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
-        Placeholder routines until we implement loading.
-        (WebCore::SharedWorkerConnectTask::create):
-        Creates a task to fire off a connect event on the worker thread.
-        (WebCore::SharedWorkerConnectTask::SharedWorkerConnectTask):
-        (WebCore::SharedWorkerConnectTask::performTask):
-        (WebCore::SharedWorkerLoader::SharedWorkerLoader):
-        Added helper object to load the initial script for the worker.
-        (WebCore::SharedWorkerLoader::load):
-        (WebCore::SharedWorkerLoader::notifyFinished):
-        (WebCore::SharedWorkerRepository::instance):
-        (WebCore::DefaultSharedWorkerRepository::instance):
-        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
-        Fires off the worker thread once the script is loaded.
-        (WebCore::SharedWorkerRepository::connect):
-        (WebCore::DefaultSharedWorkerRepository::DefaultSharedWorkerRepository):
-        (WebCore::DefaultSharedWorkerRepository::~DefaultSharedWorkerRepository):
-        * workers/DefaultSharedWorkerRepository.h: Added.
-        * workers/SharedWorkerThread.cpp: Added.
-        (WebCore::SharedWorkerThread::create):
-        (WebCore::SharedWorkerThread::SharedWorkerThread):
-        (WebCore::SharedWorkerThread::~SharedWorkerThread):
-        (WebCore::SharedWorkerThread::createWorkerContext):
-        * workers/SharedWorkerThread.h: Added.
-        * workers/Worker.cpp:
-        (WebCore::Worker::Worker):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
-        * workers/WorkerContext.h:
-        (WebCore::WorkerContext::isSharedWorkerContext):
-        (WebCore::WorkerContext::isDedicatedWorkerContext):
-        Added APIs to determine the type of a given context.
-
-2009-08-06  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by David Hyatt.
-
-        Added ENABLE_3D_CANVAS flag to build, default to off
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2009-08-06  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
-
-        Reviewed by Simon Hausmann.
 
-        [Qt] windowsKeyCodeForKeyEvent fix
+2010-02-10  Kenneth Russell  <kbr@google.com>
 
-        Fix windowsKeyCodeForKeyEvent to determine wheter the event comes from the keypad.
-
-        * platform/qt/PlatformKeyboardEventQt.cpp:
-        (WebCore::windowsKeyCodeForKeyEvent):
-        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
-
-2009-08-06  George Staikos  <george.staikos@torchmobile.com>
-
-        Rubber-stamped by Ariya Hidayat.
-
-        Remove the dead wince/ directory that should never have gone in.
-
-        * svg/graphics/wince: Removed.
-        * svg/graphics/wince/SVGResourceFilterWince.cpp: Removed.
-
-2009-08-06  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Extract style editing into a separate file that is
-        going to be loaded in page context.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27939
-
-        * inspector/front-end/InjectedScript.js: Added.
-        (InjectedScript.applyStyleText):
-        (InjectedScript.setStyleText):
-        (InjectedScript.toggleStyleEnabled):
-        (InjectedScript.setStyleRule):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted.callback):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
-        (WebInspector.StylePropertyTreeElement.prototype.):
-        (WebInspector.StylePropertyTreeElement.prototype):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-
-2009-08-06  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by David Levin.
-
-        [V8] Remove bug-bait V8Proxy::context()
-        https://bugs.webkit.org/show_bug.cgi?id=27826
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::updateDocumentWrapperCache):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::mainWorldContext):
-        * bindings/v8/V8Proxy.h:
-
-2009-08-06  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed attempt to fix the Chromium Linux build.  This function is
-        not used.
-
-        * bindings/v8/OwnHandle.h:
-
-2009-08-06  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        [V8] Teach ScheduledAction::execute about isolated worlds
-        https://bugs.webkit.org/show_bug.cgi?id=27703
-
-        We now save a weak handle to the original context.  We use that handle
-        to call the timeout in the right context / world.
+        Reviewed by Oliver Hunt.
 
-        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
-               http/tests/security/isolatedWorld/window-setTimeout-string.html
+        Remove automatic viewport resizing
+        https://bugs.webkit.org/show_bug.cgi?id=34766
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/ScheduledAction.h:
-        (WebCore::ScheduledAction::ScheduledAction):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
+        Removed automatic viewport resizing per conclusions on the WebGL
+        mailing list. Added test verifying new behavior and updated a
+        couple of previous tests failing after this change.
 
-2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+        Test: fast/canvas/webgl/viewport-unchanged-upon-resize.html
 
-        Unreviewed, build fix.
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::reshape):
 
-        [V8] Revert http://trac.webkit.org/changeset/46821, which was
-        landed to supplement http://trac.webkit.org/changeset/46816, but
-        now that the latter is reverted, the former needs the same.
+2010-02-10  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-08-05  Joseph Pecoraro  <joepeck02@gmail.com>
+        [Qt] Implement image interpolation quality.
 
-        Reviewed by Timothy Hatcher.
+        https://bugs.webkit.org/show_bug.cgi?id=34629
 
-        Color is only reported in rgb() format; should toggle between rgb() and hex
-        https://bugs.webkit.org/show_bug.cgi?id=13516
-
-          New Class to Parse and Change Between Color Representations:
-
-        * inspector/front-end/Color.js: Added.
-        (WebInspector.Color):
-
-          Representations of Colors in Raw Form. (May be Lazy Loaded):
-
-        (WebInspector.Color.prototype.get shorthex):
-        (WebInspector.Color.prototype.get hex):
-        (WebInspector.Color.prototype.set hex):
-        (WebInspector.Color.prototype.get rgb):
-        (WebInspector.Color.prototype.set rgb):
-        (WebInspector.Color.prototype.get hsl):
-        (WebInspector.Color.prototype.set hsl):
-        (WebInspector.Color.prototype.get nickname):
-        (WebInspector.Color.prototype.set nickname):
-        (WebInspector.Color.prototype.get rgba):
-        (WebInspector.Color.prototype.set rgba):
-        (WebInspector.Color.prototype.get hsla):
-        (WebInspector.Color.prototype.set hsla):
-
-          Helpers and Standard String Representations:
-
-        (WebInspector.Color.prototype.hasShortHex):
-        (WebInspector.Color.prototype.toRgb):
-        (WebInspector.Color.prototype.toHsl):
-        (WebInspector.Color.prototype.toShortHex):
-        (WebInspector.Color.prototype.toHex):
-        (WebInspector.Color.prototype.toRgba):
-        (WebInspector.Color.prototype.toHsla):
-        (WebInspector.Color.prototype.toNickname):
-
-          Conversion Functions to Determine Other Representations:
-          My Sources for all algorithms and sample data:
-          Wikipedia: http://en.wikipedia.org/wiki/HSV_color_space
-          CSS Specification: http://www.w3.org/TR/css3-color/#hsla-color
-
-        (WebInspector.Color.prototype.rgbToHex):
-        (WebInspector.Color.prototype.hexToRgb):
-        (WebInspector.Color.prototype.rgbToHsl):
-        (WebInspector.Color.prototype.hslToRgb.hueToRgb):
-        (WebInspector.Color.prototype.hslToRgb):
-        (WebInspector.Color.prototype.rgbaToHsla):
-        (WebInspector.Color.prototype.hslaToRgba):
-
-          Called from the constructor, attempts to parse and will throw an error
-          if it cannot parse.  If simple then the "hex" value is guarenteed.
-          If advanced then both the "rgba" and "hsla" are guarenteed.  If it is
-          a nickname in any way (e.g. "transparent", "black") then this is
-          guarenteed to be set as well.
-
-        (WebInspector.Color.prototype.parse):
-
-          Clicking on the swatch will rotate through Color Representations.
-            Simple:   rgb -> hsl -> nickname? -> shorthex? -> hex -> (loop around)
-            Advanced: rgba -> hsla -> nickname? -> (loop around)
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
 
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.value.):
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+2010-02-10  Eric Seidel  <eric@webkit.org>
 
-          Load Color.js:
+        No review, Mac build fix.
 
-        * inspector/front-end/inspector.html:
+        Crash in Flash at http://www.cctv.com/
+        https://bugs.webkit.org/show_bug.cgi?id=34673
 
-2009-08-05  John Abd-El-Malek  <jam@chromium.org>
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::getValueStatic):
 
-        Reviewed by Dimitri Glazkov.
+2010-02-10  Gustavo Noronha Silva  <gns@gnome.org>
 
-        Support setting event listeners for message ports in the worker process.
+        Reviewed by Xan Lopez.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28004
+        [GTK] Hits assertion on history back, with page cache enabled, in specific conditions
+        https://bugs.webkit.org/show_bug.cgi?id=34773
 
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::retrieve):
-        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
-        * bindings/v8/WorkerContextExecutionProxy.h:
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        When unsetting the adjustments from a ScrollView, also disconnect
+        them from the Scrollbars.
 
-2009-08-05  Stephen White  <senorblanco@chromium.org>
+        Test: fast/frames/frame-crash-with-page-cache.html
 
-        Reviewed by Dimitri Glazkov.
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::setGtkAdjustments):
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::~ScrollbarGtk):
+        (ScrollbarGtk::detachAdjustment):
+        * platform/gtk/ScrollbarGtk.h:
 
-        http://bugs.webkit.org/show_bug.cgi?id=28022
+2010-02-09  Alexey Proskuryakov  <ap@apple.com>
 
-        Minor fix for media code on chromium/skia.
+        Reviewed by Geoffrey Garen.
 
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack):
+        https://bugs.webkit.org/show_bug.cgi?id=34490
+        WebCore::ImageEventSender::dispatchPendingEvents() crashes in certain conditions
 
-2009-08-05  Darin Adler  <darin@apple.com>
+        Test: fast/images/destroyed-image-load-event.html
 
-        Reviewed by Dan Bernstein.
+        * ForwardingHeaders/wtf/ValueCheck.h: Added.
 
-        Client side image maps did not handle zoom correctly.
-        Client side image maps did not handle border and padding correctly.
+        * loader/ImageLoader.cpp:
+        (WTF::ValueCheck): Special case value check for ImageLoader - it's allocated inside elements,
+        so check the owner instead.
+        (WebCore::ImageEventSender::hasPendingEvents): Added a debugging aid for ImageLoader destructor.
+        (WebCore::ImageLoader::~ImageLoader): Assert that we're not going to leave dangling pointers
+        in ImageEventSender.
+        (WebCore::ImageLoader::setImage): Cancel events that could be dispatched for the previous
+        image. The only client using this method that I could find was DeleteButton, which doesn't
+        care about load events for the new image, so I didn't add any code for firing those.
+        (WebCore::ImageLoader::setLoadingImage): This method only existed to confuse readers -
+        there wasn't any meaningful code shared (callers just undid most assignments made there).
+        Merged the logic into callers.
+        (WebCore::ImageLoader::updateFromElement): We're forgetting the old image, so forget its
+        old events, too.
+        (WebCore::ImageLoader::notifyFinished): This can be called from setImage(), in which case
+        no one is going to dispatch the event "soon". So, don't queue it.
+        (WebCore::ImageEventSender::dispatchPendingEvents): Call checkConsistency(). This didn't
+        help catch this particuar bug, but seems like a useful check anyway.
+
+        * loader/ImageLoader.h: Removed setLoadingImage().
+
+2010-02-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Mac build fix. Unreviewed.
 
-        Test: fast/images/image-map-zoom.html
+        * WebCore.xcodeproj/project.pbxproj:
+        Add PluginViewNone.cpp to the Mac project.
 
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::nodeAtPoint): Compute the values to pass in to the map
-        element using the content box and the effective zoom.
+2010-02-10  Adam Roben  <aroben@apple.com>
 
-2009-08-05  Alexey Proskuryakov  <ap@apple.com>
+        Optimize ImageBuffer::toDataURL's CG implementation
 
-        Reviewed by Oliver Hunt.
+        There was some unused code that could have been removed in r31830 when
+        this function was changed not to flip the CG image anymore.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28027
-        <rdar://7064428> Files with accents in names are submitted incorrectly due to use of
-        precomposed Unicode
+        Fixes <http://webkit.org/b/34808> ImageBuffer::toDataURL allocates
+        unnecessary memory under CoreGraphics
 
-        * platform/network/mac/FormDataStreamMac.mm: (WebCore::setHTTPBody): Use getFileSize() from
-        FileSystem.h instead of custom code for getting file size. This adds path normalization
-        necessary with some file systems on Mac. This also loses a S_IFMT check, which didn't seem
-        important anyway.
+        Reviewed by Sam Weinig.
 
-2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::toDataURL): Don't allocate an unused CGImageRef
+        and buffer, and switch to the new overload of base64Encode that
+        doesn't require us to copy all the image data into a Vector first.
 
-        Unreviewed, build fix.
+        * platform/text/Base64.cpp:
+        (WebCore::base64Encode):
+        * platform/text/Base64.h:
+        Added an overload that takes a raw data pointer and length, just like
+        we have for base64Decode. The overload that takes a Vector as input
+        just calls through to the new overload.
 
-        [V8] Include Media into V8 bindings.
+2010-02-10  Dan Bernstein  <mitz@apple.com>
 
-        * bindings/v8/DOMObjectsInclude.h: Added Media include.
-        * bindings/v8/DerivedSourcesAllInOne.cpp: Added V8Media include.
-        * bindings/v8/V8Index.cpp: Added decl for V8Media.
-        * bindings/v8/V8Index.h: Added V8Media include.
+        Reviewed by Dave Hyatt.
 
-2009-08-04  Jon Honeycutt  <jhoneycutt@apple.com>
+        Complete the fix for <rdar://problem/7577604> Drag and Drop: background elements are bleeding through
+        https://bugs.webkit.org/show_bug.cgi?id=34546
 
-        Fix Windows layout test crashes.
+        * manual-tests/drag-image-table-part-decorations.html:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paint): Don’t paint collapsed borders if this object shouldn’t
+        paint within the current painting root.
 
-        PluginView::removeFromUnstartedListIfNecessary() would try to remove
-        any unstarted PluginView from the Page's set of unstarted plug-ins,
-        regardless of why the PluginView wasn't started. If we tried to start a
-        plug-in, but it failed to start, we would hit an assertion in
-        Page::removeUnstartedPlugin() that asserts that we would only modify the
-        unstarted plug-ins set if we were not currently starting plug-ins.
+2010-02-08  Jon Honeycutt  <jhoneycutt@apple.com>
 
-        Fix this by having PluginView track whether it's waiting to be started,
-        and to check this before trying to remove itself from the Page's
-        unstarted plug-ins set.
+        <rdar://problem/7436875> Crash in Flash when visiting
+        http://www.cctv.com/default.shtml (WER ID 819298200) [watson 2502260]
 
         Reviewed by Darin Adler.
 
-        * page/Page.cpp:
-        (WebCore::Page::removeUnstartedPlugin):
-        Assert that the passed PluginView is in the unstarted set.
+        Test: platform/win/plugins/plugin-delayed-destroy.html
+
+        * bridge/NP_jsobject.cpp:
+        (_NPN_Evaluate):
+        If Flash calls this to evaluate a script that destroys the PluginView,
+        we crash when returning to Flash code. Before evaluating the script,
+        call PluginView::keepAlive() to hold a ref to this instance (and release
+        it asynchronously).
 
         * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
-        Set that we are not waiting to be started.
-        (WebCore::PluginView::startOrAddtoUnstartedList):
-        Set that we are waiting to be started.
-        (WebCore::PluginView::removeFromUnstartedListIfNecessary):
-        Check not whether we are started, but whether we are waiting to be
-        started.
+        (WebCore::instanceMap):
+        Return a map from the NPP to the PluginView.
+        (WebCore::PluginView::~PluginView):
+        Assert that the keep alive timer is not running; remove ourselves from
+        the instance map.
+        (WebCore::PluginView::performRequest):
+        The parent Frame is now a RefPtr; use .get().
+        (WebCore::PluginView::status):
+        Ditto.
+        (WebCore::PluginView::didReceiveResponse):
+        Ditto.
         (WebCore::PluginView::PluginView):
+        Add the view to the instance map.
+        (WebCore::PluginView::lifeSupportTimerFired):
+        Deref the PluginView.
+        (WebCore::PluginView::keepAlive):
+        Ref the PluginView, then start a time to release the reference
+        asynchronously.
+        (WebCore::PluginView::keepAlive):
+        Find the PluginView in the map, and call its keepAlive() function.
 
         * plugins/PluginView.h:
+        Made m_parentFrame a RefPtr, so that it will remain valid when the
+        keep alive timer fires.
+        (WebCore::PluginView::parentFrame):
+        Use .get().
 
-2009-08-05  Jeremy Orlow  <jorlow@chromium.org>
-
-       Fix DOM Storage memory leak
-       https://bugs.webkit.org/show_bug.cgi?id=28029
-
-       Forgot to use adoptRef in one place.  This caused the = operator to
-       increment the ref count when it shouldn't have, so StorageAreaImpl's were
-       never freed.
-
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::storageArea):
-
-2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [Chromium] Let CodeGeneratorV8.pm know that Media is ref-counted.
-
-        * bindings/scripts/CodeGeneratorV8.pm: Added Media check to IsRefPtrType.
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        Use .get().
+        (WebCore::PluginView::handleKeyboardEvent):
+        Use .get().
+        (WebCore::PluginView::handleMouseEvent):
+        Use .get().
 
-2009-08-05  Darin Adler  <darin@apple.com>
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::keepAlive):
+        Stubbed.
 
-        Reviewed by David Levin.
+2010-02-10  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
 
-        Use checked casts for render tree
-        https://bugs.webkit.org/show_bug.cgi?id=23522
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Last patch. Makes all the casts of RenderObject use checked
-        casts instead of using static_cast directly.
+        Support frameset flattening
+        https://bugs.webkit.org/show_bug.cgi?id=32717
 
-        * accessibility/AccessibilityListBox.cpp:
-        (WebCore::AccessibilityListBox::visibleChildren):
-        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
-        * accessibility/AccessibilityListBoxOption.cpp:
-        (WebCore::AccessibilityListBoxOption::elementRect):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::textUnderElement):
-        (WebCore::AccessibilityRenderObject::stringValue):
-        (WebCore::AccessibilityRenderObject::titleUIElement):
-        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        * accessibility/AccessibilitySlider.cpp:
-        (WebCore::AccessibilitySliderThumb::elementRect):
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::updatePlaceholderVisibility):
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::scrollToSelection):
-        (WebCore::SelectElement::recalcStyle):
-        (WebCore::SelectElement::setRecalcListItems):
-        (WebCore::SelectElement::menuListDefaultEventHandler):
-        (WebCore::SelectElement::listBoxDefaultEventHandler):
-        * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply):
-        * html/HTMLAppletElement.cpp:
-        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::reset):
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::updateWidget):
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::attach):
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::defaultEventHandler):
-        * html/HTMLIFrameElement.cpp:
-        (WebCore::HTMLIFrameElement::attach):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::defaultEventHandler):
-        (WebCore::HTMLInputElement::addSearchResult):
-        (WebCore::HTMLInputElement::onSearch):
-        * html/HTMLLIElement.cpp:
-        (WebCore::HTMLLIElement::parseMappedAttribute):
-        (WebCore::HTMLLIElement::attach):
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::setReadyState):
-        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged):
-        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
-        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
-        (WebCore::HTMLMediaElement::mediaPlayerGraphicsLayer):
-        (WebCore::HTMLMediaElement::defaultEventHandler):
-        (WebCore::HTMLMediaElement::finishParsingChildren):
-        * html/HTMLOListElement.cpp:
-        (WebCore::HTMLOListElement::parseMappedAttribute):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::updateWidget):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::defaultEventHandler):
-        * page/DragController.cpp:
-        (WebCore::DragController::concludeEditDrag):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::selectCursor):
-        (WebCore::EventHandler::capsLockStateMayHaveChanged):
-        * page/Frame.cpp:
-        (WebCore::Frame::ownerRenderer):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::detachCustomScrollbars):
-        * page/wince/FrameWince.cpp:
-        (WebCore::computePageRectsForFrame):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeBoxesHorizontally):
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlTimelineElement::defaultEventHandler):
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlock::findNextLineBreak):
-        * rendering/RenderCounter.cpp:
-        (WebCore::planCounter):
-        * rendering/RenderFrameSet.cpp:
-        (WebCore::RenderFrameSet::computeEdgeInfo):
-        (WebCore::RenderFrameSet::setIsResizing):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::contentsBox):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateBacking):
-        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
-        * rendering/RenderListItem.cpp:
-        (WebCore::previousListItem):
-        (WebCore::RenderListItem::explicitValueChanged):
-        * rendering/RenderObject.cpp:
-        (WebCore::updateListMarkerNumbers):
-        * rendering/RenderObjectChildList.cpp:
-        (WebCore::updateListMarkerNumbers):
-        (WebCore::invalidateCountersInContainer):
-        * rendering/RenderScrollbarTheme.cpp:
-        (WebCore::RenderScrollbarTheme::minimumThumbLength):
-        (WebCore::RenderScrollbarTheme::backButtonRect):
-        (WebCore::RenderScrollbarTheme::forwardButtonRect):
-        (WebCore::RenderScrollbarTheme::trackRect):
-        (WebCore::RenderScrollbarTheme::constrainTrackRectToTrackPieces):
-        (WebCore::RenderScrollbarTheme::paintScrollbarBackground):
-        (WebCore::RenderScrollbarTheme::paintTrackBackground):
-        (WebCore::RenderScrollbarTheme::paintTrackPiece):
-        (WebCore::RenderScrollbarTheme::paintButton):
-        (WebCore::RenderScrollbarTheme::paintThumb):
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderThumbElement::defaultEventHandler):
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::determineSliderThumbState):
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintSliderThumb):
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderThemeSafari::paintSliderThumb):
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::determineSliderThumbState):
-        * rendering/SVGCharacterLayoutInfo.cpp:
-        (WebCore::SVGCharacterLayoutInfo::addLayoutInformation):
-        * rendering/SVGRootInlineBox.cpp:
-        (WebCore::findSVGRootObject):
-        * rendering/TextControlInnerElements.cpp:
-        (WebCore::RenderTextControlInnerBlock::nodeAtPoint):
-        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::attach):
-        * svg/SVGMarkerElement.cpp:
-        (WebCore::SVGMarkerElement::canvasResource):
-        * svg/SVGTextContentElement.cpp:
-        (WebCore::rootInlineBoxForTextContentElement):
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::defaultEventHandler):
-        Use checked casts.
+        Add support for enabling/disabling FrameSet Flattening on the Mac port.
 
-        * rendering/RenderApplet.h:
-        * rendering/RenderCounter.h:
-        * rendering/RenderFieldset.h:
-        * rendering/RenderFileUploadControl.h:
-        * rendering/RenderFrame.h:
-        * rendering/RenderFrameSet.h:
-        * rendering/RenderHTMLCanvas.h:
-        * rendering/RenderListBox.h:
-        * rendering/RenderListItem.h:
-        * rendering/RenderListMarker.h:
-        * rendering/RenderMedia.h:
-        * rendering/RenderMenuList.h:
-        * rendering/RenderPart.h:
-        * rendering/RenderPartObject.h:
-        * rendering/RenderPath.h:
-        * rendering/RenderSVGContainer.h:
-        * rendering/RenderSVGRoot.h:
-        * rendering/RenderSVGTextPath.h:
-        * rendering/RenderSVGViewportContainer.h:
-        * rendering/RenderScrollbar.h:
-        * rendering/RenderSlider.h:
-        * rendering/RenderTextControlMultiLine.h:
-        * rendering/RenderTextControlSingleLine.h:
-        * rendering/RenderVideo.h:
-        Added a checked cast. Also made most members protected or private.
+        * WebCore.base.exp:
 
-        * rendering/RenderBlock.h:
-        * rendering/RenderInline.h:
-        * rendering/RenderReplaced.h:
-        * rendering/RenderSVGBlock.h:
-        * rendering/RenderSVGImage.h:
-        * rendering/RenderSVGInlineText.h:
-        * rendering/RenderSVGText.h:
-        * rendering/RenderTextControl.h:
-        Made most members protected or private.
+2010-02-10  Jeremy Orlow  <jorlow@chromium.org>
 
-        * rendering/RenderInline.cpp:
-        * rendering/RenderSVGContainer.cpp:
-        * rendering/RenderSVGHiddenContainer.cpp:
-        * rendering/RenderSVGImage.cpp:
-        * rendering/RenderSVGRoot.cpp:
-        Removed unneeded destructor.
+        Revert 54599 because it breaks a lot of tests on Windows Chrome
 
-        * rendering/RenderSVGHiddenContainer.h:
-        Removed unneeded virtual function overrides that did the same as
-        the default and base class.
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._insertChild):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.revealAndSelectNode):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        ():
+        * inspector/front-end/inspector.css:
 
-        * rendering/RenderSVGViewportContainer.cpp:
-        (WebCore::RenderSVGViewportContainer::paint): Updated to use m_viewport
-        directly instead of using a function call.
-        (WebCore::RenderSVGViewportContainer::applyViewportClip): Ditto.
-        (WebCore::RenderSVGViewportContainer::viewportTransform): Ditto.
-        (WebCore::RenderSVGViewportContainer::localToParentTransform): Ditto.
-        (WebCore::RenderSVGViewportContainer::pointIsInsideViewportClip): Ditto.
+2010-02-10  Adam Roben  <aroben@apple.com>
 
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::pseudoForScrollbarPart): Changed switch statement to use cases for
-        all values instead of using a default case.
+        Fix bad paths in WebCore.vcproj
 
-        * rendering/RenderTreeAsText.cpp:
-        (WebCore::operator<<): Removed dependency on casting to types that don't
-        have any public members we need to get at. Instead, use function names to
-        identify the type rather than doing so much overloading. Changed to use
-        checked casts.
-        (WebCore::write): Ditto.
+        These were harmless in VS2005, but cause project conversion errors in
+        VS2010 RC.
 
-        * rendering/SVGRenderSupport.cpp:
-        (WebCore::renderSubtreeToImage): Changed to use a checked cast and also
-        added a comment about the fact that the code does not do sufficient type
-        checking before doing the cast.
+        Fixes <http://webkit.org/b/34801>.
 
-        * rendering/SVGRenderTreeAsText.cpp:
-        (WebCore::writeRenderSVGTextBox): Renamed this from operator<<.
-        (WebCore::writeSVGInlineTextBoxes): Renamed this from writeSVGInlineText.
-        (WebCore::writeSVGText): Renamed this from write.
-        (WebCore::writeSVGInlineText): Ditto.
-        (WebCore::writeSVGImage): Ditto.
-        * rendering/SVGRenderTreeAsText.h: Updated for name changes. Removed
-        unneeded default arguments.
+        Reviewed by Dan Bernstein.
 
-2009-08-05  Peter Kasting  <pkasting@google.com>
+        * WebCore.vcproj/WebCore.vcproj: Removed leading "." from paths to
+        JSHTMLFrameSetElement.{cpp,h}.
 
-        Reviewed by Sam Weinig.
+2010-02-10  Julien Chaffraix  <jchaffraix@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27851
-        Fix a pair of compiler warnings on the GTK Linux buildbot.
+        Not reviewed (build fix).
 
-        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
-        (WebCore::BMPImageDecoder::processFileHeader): Don't use multi-character constants, they're not portable.
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::setSize): Simpler code that also doesn't compare signed with unsigned.
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont): Return a
+        SimpleFontData here.
 
-2009-08-05  Peter Kasting  <pkasting@google.com>
+2010-02-10 Julien Chaffraix  <jchaffraix@pleyo.com>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26460
-        Return multiple icon entries from the ICO decoder as separate frames,
-        sorted by decreasing quality (much like the CG ICO decoder does).
-
-        As a result of this change, we can eliminate the Skia-specific setData()
-        hack that the Chromium port used to select the desired icon size -- now
-        callers can just enumerate the frames and ask for the data from the one
-        they like.
-        
-        Under the hood, the ICO decoder now keeps vectors for a number of things
-        (including directory entries and image decoders) where it used to have
-        single members.  However, callers (that I have seen) will only request
-        one frame from the icon, so practically there aren't going to be lots of
-        instantiated image decoders.
-
-        * platform/graphics/ImageSource.h: Move |m_decoder| back to private now that Skia no longer needs to access it.
-        * platform/graphics/cairo/ImageSourceCairo.cpp:
-        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
-        * platform/graphics/skia/ImageSourceSkia.cpp:
-        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
-        (WebCore::ImageSource::setData): Remove function to ask for a particular icon size.
-        * platform/graphics/skia/ImageSourceSkia.h: Removed.
-        * platform/graphics/wx/ImageSourceWx.cpp:
-        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::ICOImageDecoder):
-        (WebCore::ICOImageDecoder::~ICOImageDecoder): Delete all instantiated per-frame decoders.
-        (WebCore::ICOImageDecoder::setData): Send data to all instantiated per-frame decoders.
-        (WebCore::ICOImageDecoder::isSizeAvailable): Use size from icon directory instead of PNG decoder (if applicable) so we can report it without decoding the PNG frames.
-        (WebCore::ICOImageDecoder::size): Report frame-specific size if BMP decoder is calling.  Otherwise, use size from icon directory instead of PNG decoder (if applicable).
-        (WebCore::ICOImageDecoder::frameSizeAtIndex): Implement.
-        (WebCore::ICOImageDecoder::setSize): Sanity check value if BMP decoder is calling.
-        (WebCore::ICOImageDecoder::frameCount): Implement.
-        (WebCore::ICOImageDecoder::frameBufferAtIndex): Sanity check size for PNG frames.
-        (WebCore::ICOImageDecoder::compareEntries): Add utility function for sorting entries.
-        (WebCore::ICOImageDecoder::setDataForPNGDecoderAtIndex): Factor out utility function for passing correct data blob to a PNG decoder.
-        (WebCore::ICOImageDecoder::decodeWithCheckForDataEnded): Split decode() into two pieces.
-        (WebCore::ICOImageDecoder::decodeDirectory): The first part of the old decode().
-        (WebCore::ICOImageDecoder::decodeAtIndex): The second part of the old decode(), split off so we avoid decoding an entry until it's requested.
-        (WebCore::ICOImageDecoder::processDirectory): Add resizing of internal data structures based on directory contents.
-        (WebCore::ICOImageDecoder::processDirectoryEntries): Sort entries by quality.
-        (WebCore::ICOImageDecoder::imageTypeAtIndex): Return type to caller instead of setting a member.
-        * platform/image-decoders/ico/ICOImageDecoder.h:
-
-2009-08-05  Szabo Carol  <carol.szabo@nokia.com>
+        Bug 23287 -  Avoid using FontPlatformData outside the FontCache
 
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27942
+        No functional change, only refactored the code using FontPlatformData to use SimpleFontData.
 
-        Test: fast/forms/select-reset-multiple-selections-4-single-selection.html
+        This change leaves the class FontCached as it needs some thoughts and more refactoring.
 
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::reset):
-           Added HTML 4.01 compliant handling of broken webpages that
-           specify more than one selected option for single selection SELECT
-           element, in a manner that emulates Firefox and is similar to IE 7
+        * css/CSSFontFaceSource.cpp:
+        (WebCore::CSSFontFaceSource::getFontData): Call getCachedFontData with the 2 parameters directly.
+        * css/CSSFontSelector.cpp:
+        (WebCore::fontDataForGenericFamily): Ditto.
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontCache::getCachedFontData): This method is meant to replace getCachedFontPlatformData
+        that was moved in the private section of the class. It calls getCachedFontPlatformData and cache
+        the returned FontPlatformData if it is not null.
+        (WebCore::FontCache::getFontData): Updated to use the new getCachedFontData.
+        * platform/graphics/FontCache.h: Updated several methods to return a SimpleFontData in lieu of a
+        FontPlatformData. Moved some method in the private sections.
 
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/gtk/FontCacheGtk.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/haiku/FontCacheHaiku.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/wince/FontCacheWince.cpp:
+        * platform/graphics/wx/FontCacheWx.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        Updated all the previous platform methods to return a SimpleFontData.
 
-2009-08-05  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::FontCache::getSimilarFontPlatformData): Updated to return a SimpleFontData.
+        (WebCore::FontCache::getLastResortFallbackFont): Ditto. Also refactored the code
+        and moved a DEFINE_STATIC_LOCAL where it is needed.
 
-        Reviewed by Simon Hausmann.
+2010-02-10  Alexander Pavlov  <apavlov@chromium.org>
 
-        WebCore.pro bugfix
+        Reviewed by Pavel Feldman.
 
-        Fix the gperf lines to properly include the string.h header at compilation with gperf version 3.0.3 and newer.
+        Web Inspector: Elements Panel: Limit the number of initially loaded element children
+        https://bugs.webkit.org/show_bug.cgi?id=34421
 
-        * WebCore.pro:
+        Test: inspector/elements-panel-limited-children.html
 
-2009-08-05  Chris Fleizach  <cfleizach@apple.com>
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._insertChild):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.createTreeElementFor):
+        (WebInspector.ElementsTreeOutline.prototype.revealAndSelectNode):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.get expandedChildrenLimit):
+        (WebInspector.ElementsTreeElement.prototype.set expandedChildrenLimit):
+        (WebInspector.ElementsTreeElement.prototype.get expandedChildCount):
+        (WebInspector.ElementsTreeElement.prototype.showChild):
+        (WebInspector.ElementsTreeElement.prototype.insertChildElement):
+        (WebInspector.ElementsTreeElement.prototype.moveChild):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        (WebInspector.ElementsTreeElement.prototype.adjustCollapsedRange):
+        (WebInspector.ElementsTreeElement.prototype.handleLoadAllChildren):
+        ():
+        * inspector/front-end/inspector.css:
 
-        Fix Tiger build breakage.
+2010-02-10  Mikhail Naganov  <mnaganov@chromium.org>
 
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        Reviewed by Pavel Feldman.
 
-2009-08-04  Simon Hausmann  <hausmann@webkit.org>
+        Remove several #if USE(JSC) branches. Introduce ScriptDebugServer class for
+        making JavaScriptDebugServer engine-agnostic.
 
-        Prospective build fix for Qt build bot: Fix dependency of HTMLNames.cpp
-        to both source files, HTMLTagNames.in and HTMLAttributeNames.in
+        https://bugs.webkit.org/show_bug.cgi?id=34795
 
+        * GNUmakefile.am:
+        * WebCore.gypi:
         * WebCore.pro:
-
-2009-08-04  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Keypress should exit from pan scrolling mode.
-        https://bugs.webkit.org/show_bug.cgi?id=28005
-
-        Change the logic from only exiting pan scrolling on escape to exiting on any key press,
-        making it easier for users to back out of an accidental pan scroll.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::keyEvent):
-        
-2009-08-04  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Simon Fraser.
-
-        REGRESSION (r45064): Drop caret remains in text control after the mouse exits
-        https://bugs.webkit.org/show_bug.cgi?id=26787
-
-        Add back missing dragController()->clear() call.
-
-        * manual-tests/drag-caret.html: Added.
-        * page/DragController.cpp:
-        (WebCore::DragController::tryDocumentDrag):
-
-2009-08-04  Chris Fleizach  <cfleizach@apple.com>
-
-        Bug 27994 - WAI-ARIA: aria-valuetext needs to be implemented
-        https://bugs.webkit.org/show_bug.cgi?id=27994
-
-        Forgot to commit attribute names.
-
-        * html/HTMLAttributeNames.in:
-
-2009-08-04  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 27994 - WAI-ARIA: aria-valuetext needs to be implemented
-        https://bugs.webkit.org/show_bug.cgi?id=27994
-
-        Test: platform/mac/accessibility/aria-valuetext.html
-
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::valueDescription):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::valueDescription):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-        * html/HTMLAttributeNames.in:
-
-2009-08-04  Michael Nordman  <michaeln@google.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27821
-
-        No new features, no new tests. Existing layout tests pass.
-
-        * WebCore.base.exp:
-
-        Export AppliationCacheGroup::storeCopyOfCache
-
         * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/ScriptDebugServer.cpp: Added.
+        (WebCore::ScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctionsSoon):
+        * bindings/js/ScriptDebugServer.h: Added.
+        * bindings/v8/ScriptDebugServer.cpp: Added.
+        (WebCore::ScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctionsSoon):
+        * bindings/v8/ScriptDebugServer.h: Added.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        * page/Console.cpp:
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
 
-        Restore DOMApplicationCache.h and ApplicationCacheHost.h to 'project' headers
-        instead of 'private' headers since they're no longer in the DocumentLoader.h
-        include graph.
-
-        * html/HTMLHtmlElement.cpp:
-        (WebCore::HTMLHtmlElement::insertedIntoDocument):
-
-        Reinstate the test for manifest.isNull instead of .isEmtpty().
-        Added a FIXME to revisit once the spec gets clarified.
-        
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::DocumentLoader):
-        (WebCore::DocumentLoader::mainReceivedError):
-        (WebCore::DocumentLoader::detachFromFrame):
-        * loader/DocumentLoader.h:
-        (WebCore::DocumentLoader::applicationCacheHost):
-
-        ApplicationCacheHost is held in an OwnPtr<> by DocumentLoader. This was done
-        for compile time friendliness, it results in a smaller include graph for files
-        dependent on DocumentLoader.h.
-
-        * loader/FrameLoader.cpp:
-        * loader/MainResourceLoader.cpp:
-        * loader/ResourceLoader.cpp:
-
-        Cleanup ussage of ENABLE(xxx) around includes, generally remove those guards.
-        This was done for readability at the include site. The included files contain appropriate guards,
-        so they're not needed at the include site.
-
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::selectCache):
-        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::update):
-        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
-        (WebCore::ApplicationCacheGroup::manifestNotFound):
-        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
-        (WebCore::ApplicationCacheGroup::startLoadingEntry):
-        (WebCore::CallCacheListenerTask::create):
-        (WebCore::CallCacheListenerTask::performTask):
-        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
-        (WebCore::ApplicationCacheGroup::postListenerTask):
-        * loader/appcache/ApplicationCacheGroup.h:
-
-        Use ApplicationCachHost defined constants, no longer depends on DOMApplicationCache.
-
-        * loader/appcache/ApplicationCacheHost.cpp:
-        (WebCore::ApplicationCacheHost::ApplicationCacheHost):
-        (WebCore::ApplicationCacheHost::setDOMApplicationCache):
-        (WebCore::ApplicationCacheHost::notifyEventListener):
-        (WebCore::ApplicationCacheHost::status):
-        * loader/appcache/ApplicationCacheHost.h:
-        (WebCore::ApplicationCacheHost::):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::storeCopyOfCache):
-        * loader/appcache/ApplicationCacheStorage.h:
-
-        Merge recently added transferApplicationCache and pre-existing storeCopyOfCache methods.
-
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::status):
-        (WebCore::DOMApplicationCache::addEventListener):
-        (WebCore::DOMApplicationCache::removeEventListener):
-        (WebCore::DOMApplicationCache::callListener):
-        (WebCore::DOMApplicationCache::toEventType):
-        (WebCore::DOMApplicationCache::toEventID):
-        * loader/appcache/DOMApplicationCache.h:
-        (WebCore::DOMApplicationCache::setAttributeEventListener):
-        (WebCore::DOMApplicationCache::getAttributeEventListener):
-        (WebCore::DOMApplicationCache::clearAttributeEventListener):
-        (WebCore::DOMApplicationCache::callEventListener):
-        (WebCore::DOMApplicationCache::setOnchecking):
-        (WebCore::DOMApplicationCache::onchecking):
-        (WebCore::DOMApplicationCache::setOnerror):
-        (WebCore::DOMApplicationCache::onerror):
-        (WebCore::DOMApplicationCache::setOnnoupdate):
-        (WebCore::DOMApplicationCache::onnoupdate):
-        (WebCore::DOMApplicationCache::setOndownloading):
-        (WebCore::DOMApplicationCache::ondownloading):
-        (WebCore::DOMApplicationCache::setOnprogress):
-        (WebCore::DOMApplicationCache::onprogress):
-        (WebCore::DOMApplicationCache::setOnupdateready):
-        (WebCore::DOMApplicationCache::onupdateready):
-        (WebCore::DOMApplicationCache::setOncached):
-        (WebCore::DOMApplicationCache::oncached):
-        (WebCore::DOMApplicationCache::setOnobsolete):
-        (WebCore::DOMApplicationCache::onobsolete):
-
-        Use ApplicationCachHost defined constants for Status and EventIDs.
-
-2009-08-04  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Revert r46421 and r46769, which appear to have totally hosed the v8 bindings.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27719
-
-        * bindings/v8/V8AbstractEventListener.cpp: Revert r46421.
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp: Revert r46769.
-        (WebCore::ACCESSOR_GETTER):
-
-2009-08-04  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 27993 - AXSliders are missing required attributes and actions
-        https://bugs.webkit.org/show_bug.cgi?id=27993
-
-        Expose appropriate actions and attributes for sliders.
-
-        Test: platform/mac/accessibility/slider-supports-actions.html
-
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::orientation):
-        * accessibility/AccessibilityObject.h:
-        (WebCore::):
-        * accessibility/AccessibilitySlider.cpp:
-        (WebCore::AccessibilitySlider::orientation):
-        * accessibility/AccessibilitySlider.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityActionNames]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-
-2009-08-04  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Fix an assert in WebCoreStringResource that causes worker script
-        evaluation failed.
-        https://bugs.webkit.org/show_bug.cgi?id=27996
-
-        The fix is to check for the same thread, instead of the main thread.
-        This is because Chromium's workers use v8 in a single thread that is
-        not the main thread.
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::WebCoreStringResource::WebCoreStringResource):
-        (WebCore::WebCoreStringResource::~WebCoreStringResource):
-        (WebCore::WebCoreStringResource::atomicString):
-
-2009-08-04  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Add support for transitions/animations of text-indent.
-
-        Test: transitions/text-indent-transition.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap):
-
-2009-08-04  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Add support for transitions of min- and max-width, and min- and max-height.
-        https://bugs.webkit.org/show_bug.cgi?id=27990
-
-        Test: transitions/min-max-width-height-transitions.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap):
-
-2009-08-04  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 27964 - WAI-ARIA: radio button does not determine its label from text content
-        https://bugs.webkit.org/show_bug.cgi?id=27964
-
-        ARIA radio buttons also need to use the text inside of them, like buttons and other roles.
-        Also fixed an issue where an extra space was being appended to some ARIA labels.
-
-        Test: platform/mac/accessibility/aria-radiobutton-text.html
-
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::ariaAccessibilityName):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::ariaAccessibilityName):
-        (WebCore::AccessibilityRenderObject::ariaLabeledByAttribute):
-        (WebCore::AccessibilityRenderObject::title):
-        (WebCore::AccessibilityRenderObject::ariaDescribedByAttribute):
-        * accessibility/AccessibilityRenderObject.h:
-
-2009-08-04  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Missed a place that expects window.event to be hidden when it shouldn't be.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27719
-
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_GETTER): window.event is no longer hidden.
-
-2009-08-03  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        Bug 27958 - WAI-ARIA: Implement 'aria-required' attribute.
-        https://bugs.webkit.org/show_bug.cgi?id=27958
-
-        Test: platform/mac/accessibility/aria-required.html
-
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::isRequired):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::isRequired):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-        * html/HTMLAttributeNames.in:
-
-2009-08-04  Jakub Wieczorek  <faw217@gmail.com>
+2009-10-06  Yongjun Zhang  <yongjun.zhang@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Add QWebPluginDatabase API to the Qt API.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        * WebCore.pro:
-
-2009-08-04  Ariya Hidayat  <ariya.hidayat@nokia.com>
+        Make JObjectWrapper::ref() and deref() public accessible to derefIfNull().
 
-        Reviewed by Adam Treat.
+        Will be reverted when the following winscw compiler bug is fixed.
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812
 
-        [Qt] PlusDarker is not supported. Fall back to CompositionMode_Darken
-        (as it is the closest match) instead of CompositionMode_SourceOver.
+        https://bugs.webkit.org/show_bug.cgi?id=28054
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::toQtCompositionMode):
+        * bridge/jni/jsc/JavaInstanceJSC.h:
+        * bridge/jni/v8/JavaInstanceV8.h:
 
-2009-08-04  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+2010-02-10  Yaar Schnitman  <yaar@chromium.org>
 
         Reviewed by Adam Barth.
 
-        [v8] Fix crash when converting empty v8 string to atomic webkit string.
-        https://bugs.webkit.org/show_bug.cgi?id=27975
-
-        collection-null-like-arguments.html tests for this.
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8StringToAtomicWebCoreString):
-
-2009-08-04  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        selectionHasStyle needs clean up to fix Bug 27858
-        https://bugs.webkit.org/show_bug.cgi?id=27865
-
-        This patch cleans up selectionStartHasStyle and selectionHasStyle.
-        No test is added because the patch does not change any behavior.
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::getPropertiesNotInComputedStyle): Used in triStateOfStyleInComputedStyle but will be used here as well
-        * editing/ApplyStyleCommand.h: Added the prototype of getPropertiesNotInComputedStyle
-        * editing/Editor.cpp:
-        (WebCore::triStateOfStyleInComputedStyle): Determines if the specified style is present in the specified computed style.
-        (WebCore::Editor::selectionStartHasStyle): Uses triStateOfStyleInComputedStyle
-        (WebCore::Editor::selectionHasStyle): Uses triStateOfStyleInComputedStyle instead of updateState
-
-2009-08-03  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by David Levin.
-
-        Fix MessagePort construction in worker process.  Also make the other object constructions match this.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27906
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertToV8Object):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::setDOMException):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::ToV8Object):
-
-2009-08-03  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
-
-        Reviewed by David Levin.
-
-        [V8] Cache atomic strings in externalized v8 strings
-        https://bugs.webkit.org/show_bug.cgi?id=27762
+        Simplified RuntimeEnabledFeatures and corresponding v8 generated code
+        https://bugs.webkit.org/show_bug.cgi?id=34667
 
+        * WebCore.gypi:
+        * bindings/generic/RuntimeEnabledFeatures.cpp: Added.
+        (WebCore::RuntimeEnabledFeatures::audioEnabled):
+        (WebCore::RuntimeEnabledFeatures::htmlMediaElementEnabled):
+        (WebCore::RuntimeEnabledFeatures::htmlAudioElementEnabled):
+        (WebCore::RuntimeEnabledFeatures::htmlVideoElementEnabled):
+        (WebCore::RuntimeEnabledFeatures::mediaErrorEnabled):
+        (WebCore::RuntimeEnabledFeatures::sharedWorkerEnabled):
+        (WebCore::RuntimeEnabledFeatures::webSocketEnabled):
+        (WebCore::RuntimeEnabledFeatures::openDatabaseEnabled):
+        * bindings/generic/RuntimeEnabledFeatures.h: Added.
+        (WebCore::RuntimeEnabledFeatures::setLocalStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::localStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::setSessionStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::sessionStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::setWebkitNotificationsEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitNotificationsEnabled):
+        (WebCore::RuntimeEnabledFeatures::setApplicationCacheEnabled):
+        (WebCore::RuntimeEnabledFeatures::applicationCacheEnabled):
+        (WebCore::RuntimeEnabledFeatures::setGeolocationEnabled):
+        (WebCore::RuntimeEnabledFeatures::geolocationEnabled):
+        (WebCore::RuntimeEnabledFeatures::setIndexedDBEnabled):
+        (WebCore::RuntimeEnabledFeatures::indexedDBEnabled):
+        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
+        * bindings/scripts/CodeGenerator.pm:
         * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::WebCoreStringResource::WebCoreStringResource):
-        (WebCore::WebCoreStringResource::~WebCoreStringResource):
-        (WebCore::WebCoreStringResource::data):
-        (WebCore::WebCoreStringResource::length):
-        (WebCore::WebCoreStringResource::webcoreString):
-        (WebCore::WebCoreStringResource::atomicString):
-        (WebCore::WebCoreStringResource::toStringResource):
-        (WebCore::v8StringToWebCoreString):
-        (WebCore::v8StringToAtomicWebCoreString):
-        (WebCore::v8ValueToWebCoreString):
-        (WebCore::v8ValueToAtomicWebCoreString):
-        * bindings/v8/V8Binding.h:
-        (WebCore::):
-        * dom/Document.idl:
-
-2009-08-03  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: DOM Storage Live Updating Should Not Affect Tabbing
-        https://bugs.webkit.org/show_bug.cgi?id=27957
-
-        * inspector/front-end/DOMStorageDataGrid.js:
-        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode): disable storage event listener
-        (WebInspector.DOMStorageDataGrid.prototype._startEditing): disable storage event listener
-        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled): enable storage event listener
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype._unregisterStorageEventListener): quick return if no listener
-
-2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        [Qt] Consolidate common gcc flags to WebKit.pri
-        https://bugs.webkit.org/show_bug.cgi?id=27934
-
-        * WebCore.pro:
-
-2009-08-03  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Chromium code sometimes isn't sandboxed and needs to access the FS.
-        https://bugs.webkit.org/show_bug.cgi?id=27954
-
-        These changes are the WebKit side of http://codereview.chromium.org/159778 which
-        aims to make LocalStorage persistent.
-
-        This change runs all FileSystem routines through the ChromiumBridge so that
-        WebKitClients can handle them if they choose to.  For now, the only such client
-        will be the one running in the browser process.
-
-        It also adds a method called sandboxEnabled to the Chromium bridge so that the
-        SQLite file system code can shift its behavior depending on whether we're
-        inside a sandbox or not.
-
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/FileSystemChromium.cpp:
-        (WebCore::deleteFile):
-        (WebCore::deleteEmptyDirectory):
-        (WebCore::getFileModificationTime):
-        (WebCore::directoryName):
-        (WebCore::pathByAppendingComponent):
-        (WebCore::makeAllDirectories):
-        (WebCore::fileExists):
-        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
-        (WebCore::SQLiteFileSystem::openDatabase):
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
-        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
-
-2009-08-03  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by David Levin.
-
-        [chromium] Implement media slider for chromium
-        https://bugs.webkit.org/show_bug.cgi?id=27859
-
-        Implemented the media slider for chromium port. The implementation
-        is using Skia for drawing the thumb and buffered region instead of
-        using any native system controls so different platforms would have
-        the same look and feel.
-
-        No new tests because this is covered by existing tests.
-
-        * css/mediaControlsChromium.css:
-        * rendering/RenderThemeChromiumSkia.cpp:
-        * rendering/RenderThemeChromiumSkia.h:
-        * rendering/RenderThemeChromiumWin.cpp:
-
-2009-07-27  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26460
-        Plumbing and cleanup in advance of returning multiple frames from the
-        ICOImageDecoder:
-        * Make ImageDecoder::frameCount() return a size_t like
-          ImageSource::frameCount() and BitmapImage::frameCount() already do.
-        * Add ImageDecoder::frameSizeAtIndex() alongside size(), to report the
-          size of a particular frame.  Hook all the
-          ImageSource::frameSizeAtIndex() implementations to this.  No
-          ImageDecoder implements this yet; that will come in my next change.
-
-        * platform/graphics/cairo/ImageSourceCairo.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::frameCount): returns size_t.
-        * platform/graphics/qt/ImageDecoderQt.h: frameCount() returns size_t.
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
-        * platform/graphics/skia/ImageSourceSkia.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
-        * platform/graphics/win/ImageCGWin.cpp:
-        (WebCore::BitmapImage::drawFrameMatchingSourceSize): frameCount() returns size_t.
-        * platform/graphics/win/ImageCairoWin.cpp:
-        (WebCore::BitmapImage::drawFrameMatchingSourceSize): frameCount() returns size_t.
-        * platform/graphics/wx/ImageSourceWx.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::ImageDecoder::size): Clarify comment.
-        (WebCore::ImageDecoder::frameSizeAtIndex): Add.
-        (WebCore::ImageDecoder::frameCount): returns size_t.
-        (WebCore::ImageDecoder::frameBufferAtIndex): Remove unneeded param name.
-        * platform/image-decoders/gif/GIFImageDecoder.cpp:
-        (WebCore::GIFImageDecoder::frameCount): returns size_t.
-        (WebCore::GIFImageDecoder::frameBufferAtIndex): frameCount() returns size_t.
-        * platform/image-decoders/gif/GIFImageDecoder.h: frameCount() returns size_t.
-
-2009-08-03  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Fix a bug that could cause an ASSERT to fail incorrectly, leading
-        to a renderer crash in Chromium.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27947
-
-        All tests in storage/ pass.
-
-        * platform/sql/SQLiteTransaction.cpp:
-        (WebCore::SQLiteTransaction::~SQLiteTransaction):
-        (WebCore::SQLiteTransaction::begin):
-
-2009-08-03  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Based on work by Yael Aharon.
-
-        Implement keyboard event forwarding for windowless plugins
-        for the Qt port.
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::dispatchNPEvent):
-        (WebCore::setSharedXEventFields):
-        (WebCore::setXKeyEventSpecificFields):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-
-2009-08-03  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Make Bottom "Drawer" More Extensible To Support Other Views
-        https://bugs.webkit.org/show_bug.cgi?id=27928
-
-        * English.lproj/localizedStrings.js:
-
-          "Show changes view", "Hide changes view", "Clear changes log", "%d style change", "%d style changes"
-
-        * inspector/front-end/ChangesView.js: Added.
-        (WebInspector.ChangesView):
-        (WebInspector.ChangesView.prototype._clearButtonClicked):
-        (WebInspector.ChangesView.prototype._toggleChangesButtonClicked):
-        (WebInspector.ChangesView.prototype.attach):
-        (WebInspector.ChangesView.prototype.show):
-        (WebInspector.ChangesView.prototype.hide):
-
-          To be a new view to show Changes made via the inspector.  DOM, CSS, or otherwise.
-
-        * inspector/front-end/Console.js: Removed.
-
-          Sliding View aspect moved to Drawer.js.  The "console" itself has moved to ConsoleView.js
-
-        * inspector/front-end/ConsoleView.js: Added.
-
-          Little has changed from its move from Console.js other then support for working with the Drawer.
-
-        * inspector/front-end/Drawer.js: Added.
-        (WebInspector.Drawer):
-        (WebInspector.Drawer.prototype.get visibleView):
-        (WebInspector.Drawer.prototype.set visibleView):
-        (WebInspector.Drawer.prototype.show.animationFinished):
-        (WebInspector.Drawer.prototype.show):
-        (WebInspector.Drawer.prototype.hide.animationFinished):
-        (WebInspector.Drawer.prototype.hide):
-        (WebInspector.Drawer.prototype._safelyRemoveChildren):
-        (WebInspector.Drawer.prototype._startStatusBarDragging):
-        (WebInspector.Drawer.prototype._statusBarDragging):
-        (WebInspector.Drawer.prototype._endStatusBarDragging):
-
-          Allow for multiple views inside the Sliding Drawer.
-
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel):
-        (WebInspector.ElementsPanel.prototype.renameSelector):
-        (WebInspector.ElementsPanel.prototype.addStyleChange):
-        (WebInspector.ElementsPanel.prototype.removeStyleChange):
-        (WebInspector.ElementsPanel.prototype.generateStylesheet):
-
-          Starting work on the "Changes" Panel. The ability to generate a Stylesheet from Styles added via the Inspector.
+        * bindings/v8/RuntimeEnabledFeatures.cpp: Removed.
+        * bindings/v8/RuntimeEnabledFeatures.h: Removed.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
 
-        * inspector/front-end/Images/styleIcon.png: Added.
+2010-02-09  Alexander Pavlov  <apavlov@chromium.org>
 
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertiesSection.prototype.isInspectorStylesheet):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
-        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal):
-        (WebInspector.StylePropertyTreeElement.prototype):
+        Reviewed by Pavel Feldman.
 
-          Interface with ElementsPanel for generating a Stylesheet of Changes.
+        Web Inspector: Add two basic categories for the Audits panel
+        https://bugs.webkit.org/show_bug.cgi?id=32930
 
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AuditCategories.js: Added.
+        (WebInspector.AuditCategories.PagePerformance):
+        (WebInspector.AuditCategories.PagePerformance.prototype.initialize):
+        (WebInspector.AuditCategories.NetworkUtilization):
+        (WebInspector.AuditCategories.NetworkUtilization.prototype.initialize):
+        * inspector/front-end/AuditLauncherView.js:
+        (WebInspector.AuditLauncherView.prototype.updateResourceTrackingState):
+        (WebInspector.AuditLauncherView.prototype._createLauncherUI):
+        (WebInspector.AuditLauncherView.prototype.show):
+        * inspector/front-end/AuditRules.js: Added.
+        (WebInspector.AuditRules.arrayAsUL):
+        (WebInspector.AuditRules.getDomainToResourcesMap):
+        (WebInspector.AuditRules.evaluateInTargetWindow):
+        (WebInspector.AuditRules.GzipRule):
+        (WebInspector.AuditRules.GzipRule.prototype.doRun):
+        (WebInspector.AuditRules.GzipRule.prototype._isCompressed):
+        (WebInspector.AuditRules.GzipRule.prototype._shouldCompress):
+        (WebInspector.AuditRules.CombineExternalResourcesRule):
+        (WebInspector.AuditRules.CombineExternalResourcesRule.prototype.doRun):
+        (WebInspector.AuditRules.CombineJsResourcesRule):
+        (WebInspector.AuditRules.CombineCssResourcesRule):
+        (WebInspector.AuditRules.MinimizeDnsLookupsRule):
+        (WebInspector.AuditRules.MinimizeDnsLookupsRule.prototype.doRun):
+        (WebInspector.AuditRules.ParallelizeDownloadRule):
+        (WebInspector.AuditRules.ParallelizeDownloadRule.prototype.doRun):
+        (WebInspector.AuditRules.UnusedCssRule):
+        (WebInspector.AuditRules.UnusedCssRule.prototype._getUnusedStylesheetRatioMessage):
+        (WebInspector.AuditRules.UnusedCssRule.prototype._getUnusedTotalRatioMessage):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        (WebInspector.AuditRules.CacheControlRule):
+        (WebInspector.AuditRules.CacheControlRule.prototype.InfoCheck.1.FailCheck.0.WarningCheck.1.SevereCheck.2.doRun):
+        (WebInspector.AuditRules.CacheControlRule.prototype.handleNonCacheableResources):
+        (WebInspector.AuditRules.CacheControlRule.prototype._cacheableAndNonCacheableResources):
+        (WebInspector.AuditRules.CacheControlRule.prototype.execCheck):
+        (WebInspector.AuditRules.CacheControlRule.prototype.freshnessLifetimeGreaterThan):
+        (WebInspector.AuditRules.CacheControlRule.prototype.responseHeader):
+        (WebInspector.AuditRules.CacheControlRule.prototype.hasResponseHeader):
+        (WebInspector.AuditRules.CacheControlRule.prototype.isCompressible):
+        (WebInspector.AuditRules.CacheControlRule.prototype.isPubliclyCacheable):
+        (WebInspector.AuditRules.CacheControlRule.prototype.responseHeaderMatch):
+        (WebInspector.AuditRules.CacheControlRule.prototype.hasExplicitExpiration):
+        (WebInspector.AuditRules.CacheControlRule.prototype._isExplicitlyNonCacheable):
+        (WebInspector.AuditRules.CacheControlRule.prototype.isCacheableResource):
+        (WebInspector.AuditRules.BrowserCacheControlRule):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype.handleNonCacheableResources):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype.runChecks):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype._missingExpirationCheck):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype._varyCheck):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype._oneMonthExpirationCheck):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype._oneYearExpirationCheck):
+        (WebInspector.AuditRules.ProxyCacheControlRule):
+        (WebInspector.AuditRules.ProxyCacheControlRule.prototype.runChecks):
+        (WebInspector.AuditRules.ProxyCacheControlRule.prototype._questionMarkCheck):
+        (WebInspector.AuditRules.ProxyCacheControlRule.prototype._publicCachingCheck):
+        (WebInspector.AuditRules.ProxyCacheControlRule.prototype._setCookieCacheableCheck):
+        (WebInspector.AuditRules.ImageDimensionsRule):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.routine.hasDimension):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.routine.hasWidth):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.routine.hasHeight):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.CssInHeadRule):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun.routine.allViews):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.StylesScriptsOrderRule):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.CookieRuleBase):
+        (WebInspector.AuditRules.CookieRuleBase.prototype.doRun.resultCallback):
+        (WebInspector.AuditRules.CookieRuleBase.prototype.doRun):
+        (WebInspector.AuditRules.CookieRuleBase.prototype.mapResourceCookies):
+        (WebInspector.AuditRules.CookieRuleBase.prototype._callbackForResourceCookiePairs):
+        (WebInspector.AuditRules.CookieSizeRule):
+        (WebInspector.AuditRules.CookieSizeRule.prototype._average):
+        (WebInspector.AuditRules.CookieSizeRule.prototype._max):
+        (WebInspector.AuditRules.CookieSizeRule.prototype.processCookies):
+        (WebInspector.AuditRules.CookieSizeRule.prototype.processCookies.avgSizeSorter):
+        (WebInspector.AuditRules.StaticCookielessRule):
+        (WebInspector.AuditRules.StaticCookielessRule.prototype.processCookies):
+        (WebInspector.AuditRules.StaticCookielessRule.prototype._collectorCallback):
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._constructCategories):
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        (WebInspector.AuditsPanel.prototype.show):
+        (WebInspector.AuditsPanel.prototype._updateLauncherViewControls):
+        (WebInspector.AuditCategory):
+        (WebInspector.AuditCategory.prototype.get id):
+        (WebInspector.AuditCategory.prototype.get ruleCount):
+        (WebInspector.AuditCategory.prototype.runRules):
+        (WebInspector.AuditCategory.prototype._ensureInitialized):
+        (WebInspector.AuditCategoryResult):
         * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.css: Refactored to allow for multiple views in the drawer.
-        * inspector/front-end/inspector.html: Refactored to allow for multiple views in the drawer.
-
+        * inspector/front-end/audits.css:
+        * inspector/front-end/inspector.html:
         * inspector/front-end/inspector.js:
-        (WebInspector.get styleChanges):
-        (WebInspector.set styleChanges):
-        (WebInspector._updateChangesCount):
         (WebInspector.loaded):
+        (WebInspector.addPanelToolbarIcon):
         (WebInspector.documentKeyDown):
-        (WebInspector.showConsole):
-        (WebInspector.showChanges):
-
-          Support for the drawer and "styles changed icon" similar to the "errors and warnings" icons.
-
-2009-08-03  Dean McNamee  <deanm@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Correct an assert on a PassRefPtr in the v8 svg bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=27951
-
-        * bindings/v8/V8SVGPODTypeWrapper.h:
-        (WebCore::V8SVGDynamicPODTypeWrapper::V8SVGDynamicPODTypeWrapper):
-
-2009-08-03  Dirk Pranke  <dpranke@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27748
-        crash w/ stack overflow when same CSS file loaded repeatedly
-
-        Fix crash caused by a stack overflow when repeatedly loading very large
-        CSS files. CSSRuleData in CSSStyleSelector.h destroyed itself 
-        recursively rather than iteratively.
 
-        Test: fast/css/large-list-of-rules-crash.html
-
-        * css/CSSStyleSelector.h:
-        (WebCore::CSSRuleData::~CSSRuleData):
-        (WebCore::CSSRuleDataList::~CSSRuleDataList):
-
-2009-08-03  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Make the DRT APIs to pause transitions and animations work for accelerated animations
-        <https://bugs.webkit.org/show_bug.cgi?id=27627>
-        <rdar://problem/6442932>
-
-        Fix the 'pauseAnimationAtTimeOnElementWithId' and 'pauseTransitionAtTimeOnElementWithId' APIs
-        available to LayoutTests to work with accelerated animations and transitions. Done by sending
-        the pause time down to the GraphicsLayer, and using it to stop time on the layer.
-        
-        I also added an assertion to check that the animation has actually started when we
-        try to pause it, to check that the pause time we compute is valid. This revealed a number
-        of tests that tried to pause before animations started, required some amount of test fixing.
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::freezeAtTime):
-        * page/animation/AnimationBase.h:
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::pauseAnimationAtTime):
-        (WebCore::CompositeAnimation::pauseTransitionAtTime):
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::suspendAnimations):
-        * platform/graphics/GraphicsLayer.h:
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::suspendAnimations):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::suspendAnimations):
-        * rendering/RenderLayerBacking.h:
-
-2009-08-03  Tony Chang  <tony@chromium.org>
+2010-02-10  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Darin Adler.
 
-        Fix Chromium build by removing PluginView.h from Page.cpp.
-        Chromium doesn't use PluginView and the pointer is never
-        dereferenced so the header doesn't need to be included.
-        https://bugs.webkit.org/show_bug.cgi?id=27946
-
-        No new tests because this is a build fix.
-
-        * page/Page.cpp:
-
-2009-08-03  Eric Carlson  <eric.carlson@apple.com>
-
-        One more build fix after https://bugs.webkit.org/show_bug.cgi?id=46720.
-
-        Unreviewed.
+        Freeze sandbox attributes on creation
+        https://bugs.webkit.org/show_bug.cgi?id=34184
 
-        * WebCoreSources.bkl:
+        This is how the spec works now.
 
-2009-08-03  Eric Carlson  <eric.carlson@apple.com>
-
-        Build fix after https://bugs.webkit.org/show_bug.cgi?id=46720.
-
-        Unreviewed.
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-08-03  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 27943: Need to implement ARIA role="radiogroup"
-        https://bugs.webkit.org/show_bug.cgi?id=27943
-
-        Test: platform/mac/accessibility/aria-radiogroup.html
-
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::isRadioGroup):
-        (WebCore::AccessibilityObject::selectedRadioButton):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::selectedRadioButton):
-        (WebCore::RoleEntry::):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper roleDescription]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-
-2009-08-03  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        HTMLInputElement is not controllable by assistive technologies
-        https://bugs.webkit.org/show_bug.cgi?id=27941
-
-        Test: accessibility/input-slider.html
-
-        * WebCore.xcodeproj/project.pbxproj:
-            Add AccessibilitySlider.cpp/.h
-
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::getOrCreate):
-            Create AccessibilitySlider and AccessibilitySliderThumb.
-
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::increment):
-        (WebCore::AccessibilityObject::decrement):
-            Add default, do nothing, base class methods.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
-            Correct typo.
-
-        * accessibility/AccessibilitySlider.cpp: Added.
-        (WebCore::AccessibilitySlider::AccessibilitySlider):
-        (WebCore::AccessibilitySlider::create):
-        (WebCore::AccessibilitySlider::children):
-        (WebCore::AccessibilitySlider::addChildren):
-        (WebCore::AccessibilitySlider::getAttribute):
-        (WebCore::AccessibilitySlider::valueForRange):
-        (WebCore::AccessibilitySlider::maxValueForRange):
-        (WebCore::AccessibilitySlider::minValueForRange):
-        (WebCore::AccessibilitySlider::changeValue):
-        (WebCore::AccessibilitySlider::setValue):
-        (WebCore::AccessibilitySlider::increment):
-        (WebCore::AccessibilitySlider::decrement):
-        (WebCore::AccessibilitySlider::element):
-        (WebCore::AccessibilitySliderThumb::AccessibilitySliderThumb):
-        (WebCore::AccessibilitySliderThumb::create):
-        (WebCore::AccessibilitySliderThumb::elementRect):
-        (WebCore::AccessibilitySliderThumb::size):
-        * accessibility/AccessibilitySlider.h: Added.
-        (WebCore::AccessibilitySlider::~AccessibilitySlider):
-        (WebCore::AccessibilitySlider::roleValue):
-        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
-        (WebCore::AccessibilitySlider::isSlider):
-        (WebCore::AccessibilitySlider::canSetValueAttribute):
-        (WebCore::AccessibilitySliderThumb::~AccessibilitySliderThumb):
-        (WebCore::AccessibilitySliderThumb::roleValue):
-        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
-        (WebCore::AccessibilitySliderThumb::setParentObject):
-        (WebCore::AccessibilitySliderThumb::parentObject):
-
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (RoleEntry::):
-            SliderThumbRole -> NSAccessibilityValueIndicatorRole
-        (-[AccessibilityObjectWrapper roleDescription]):
-            Return role description for NSAccessibilitySliderRole and NSAccessibilityValueIndicatorRole.
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-            Minor coding style correction.
-        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]):
-            If attachement view handles press action, don't also call object wrapper.
-        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
-            New, call object's increment() method.
-        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
-            New, call object's decrement() method.
-        (-[AccessibilityObjectWrapper accessibilityPerformAction:]):
-            Respond to NSAccessibilityIncrementAction and NSAccessibilityDecrementAction.
-
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::thumbRect):
-            Factor logic out of layout so AccessibilitySliderThumb can get thumb location/size.
-        (WebCore::RenderSlider::layout):
-            Move code to thumbRect().
-        * rendering/RenderSlider.h:
-
-2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        Build fix if Netscape plugin support is turned off
-        https://bugs.webkit.org/show_bug.cgi?id=27940
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::stop): Do not call NPN_MemFree if NPAPI is
-        disabled
-        * plugins/PluginViewNone.cpp:
-        (WebCore::PluginView::platformStart): Empty stub.
-
-2009-07-31  Joe Mason  <joe.mason@torchmobile.com>
-
-        Reviewed by George Staikos.
+        Test: fast/frames/sandboxed-iframe-forms-dynamic.html
 
-        WINCE port: LOAD_WITH_ALTERED_SEARCH_PATH param of LoadLibraryEx not supported on WINCE
-        https://bugs.webkit.org/show_bug.cgi?id=27917
-
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::load): use LoadLibrary instead of LoadLibraryEx
-
-2009-08-02  Adam Barth  <abarth@webkit.org>
-        Reviewed by Darin Adler.
-
-        SVGElementInstance::scriptExecutionContext should call document() instead of scriptExecutionContext()
-
-        https://bugs.webkit.org/show_bug.cgi?id=27932
-
-        There's no reason to pay for a virtual function call in this case.  We
-        can just call document() directly because we know that element is a
-        Node*.
-
-        * svg/SVGElementInstance.cpp:
-        (WebCore::SVGElementInstance::scriptExecutionContext):
-
-2009-08-02  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        JSNodeCustom should call document() instead of scriptExecutionContext()
-        https://bugs.webkit.org/show_bug.cgi?id=27931
-
-        We want to call document() because it's in inline function, instead of
-        scriptExecutionContext() because it's a virtual function.  If we have a
-        Node*, then we know that the virtual function will always return the
-        document anyway.
-
-        There are more instance of this bug, but I'd like to start with a small
-        patch and work up.
-
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::toJSDOMGlobalObject):
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-
-2009-08-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Anders Carlsson.
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::canExecuteScripts):
+        * bindings/generic/BindingDOMWindow.h:
+        (WebCore::::createWindow):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * dom/Document.cpp:
+        * dom/Document.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::requestObject):
+        (WebCore::FrameLoader::shouldAllowNavigation):
+        (WebCore::FrameLoader::updateSandboxFlags):
+        * page/SecurityOrigin.cpp:
+        * page/SecurityOrigin.h:
 
-        Share implementation of PluginView::userAgent() and userAgentStatic()
+2010-02-09  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27706
+        Rubber-stamped by Kenneth Rohde Christiansen.
 
-        Differences to the original implementation are as follows:
-        
-            - The Win port used to return 0 for userAgentStatic, but now
-              returns the quirk mode MozillaUserAgent as the other ports.
+        [Qt] Remove old, outdated unused code block.
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::userAgent):
-        (WebCore::PluginView::userAgentStatic):
-        * plugins/PluginViewNone.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/mac/PluginViewMac.cpp:
-        * plugins/qt/PluginViewQt.cpp:
-        * plugins/win/PluginViewWin.cpp:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
 
-2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-02-09  Chris Guillory  <ctguil@google.com>
 
-        Reviewed by Anders Carlsson.
+        Reviewed by Darin Fisher.
 
-        Unregister plugin from PluginMainThreadScheduler if NPP_New fails
+        [Chromium] Notify ChromeClientChromium of state change notifications.
         
-        https://bugs.webkit.org/show_bug.cgi?id=27706
-        
-        Since the plugin has not been started yet (m_isStarted is not set),
-        calling stop() will not have any affect, so we manually unregister
-        in start() before returning.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
+        https://bugs.webkit.org/show_bug.cgi?id=34464
 
-2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Anders Carlsson.
-
-        Join the various versions of PluginView::stop() into one shared implementation
-
-        https://bugs.webkit.org/show_bug.cgi?id=27706
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::toChromeClientChromium):
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * page/chromium/ChromeClientChromium.h:
 
-        The platform-dependent bits are now ifdef'ed in the shared implementation,
-        using the XP_ defines (XP_WIN, XP_MACOSX, XP_UNIX) from npapi.h
-        
-        Differences to the original implementation are as follows:
+2010-02-09  Kwang Yul Seo  <skyul@company100.net>
 
-            - The Qt port unregistered the plugin before calling NP_SetWindow
-              with a 0 window handle. Now it's done after (similar to Win)
+        Reviewed by Adam Barth.
 
-            - The GTK and Qt ports unregistered the plugin before clearing
-              the m_npWindow.ws_info struct. Now it's done after.
-              
-            - The Win port constructed the DropAllLocks after unsubclassing
-              the window. Now it's done before.
-              
-            - The Mac, Qt, and GTK ports did not pass a NPSavedData struct
-              to NP_Destroy (like the Win port). Now all ports do.
+        [BREWMP] Port PlatformMouseEvent
+        https://bugs.webkit.org/show_bug.cgi?id=34600
 
-            - The Win port did not call PluginView::setCurrentPluginView()
-              before calling to NP-functions. Now it does.     
+        Retrieve the event type, position, key modifiers, time stamp
+        and click count from AEEEvent.
 
-        * plugins/PluginView.cpp:
-        * plugins/PluginViewNone.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/mac/PluginViewMac.cpp:
-        * plugins/qt/PluginViewQt.cpp:
-        * plugins/win/PluginViewWin.cpp:
+        * platform/PlatformMouseEvent.h:
+        * platform/brew/PlatformMouseEventBrew.cpp: Added.
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
 
-2009-07-30  Joseph Pecoraro  <joepeck02@gmail.com>
+2010-02-09  Avi Drissman  <avi@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Inspector: let me *edit* css styles in the web inspector.
-        https://bugs.webkit.org/show_bug.cgi?id=27124
-
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel): added property stylesheet pointing to 1 stylesheet added to the page if needed
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype.update): handle blank sections
-        (WebInspector.StylesSidebarPane.prototype.addBlankSection): blank section in the correct position
-        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): helper to get a nice selector for the selectd node
-        (WebInspector.StylePropertiesSection):
-        (WebInspector.StylePropertiesSection.prototype.expand):
-        (WebInspector.StylePropertiesSection.prototype.isPropertyInherited):
-        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
-        (WebInspector.StylePropertiesSection.prototype.addNewBlankProperty):
-        (WebInspector.StylePropertiesSection.prototype._dblclickEmptySpace): easily create new properties
-        (WebInspector.StylePropertiesSection.prototype._dblclickSelector):
-        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): allow for editing selectors
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
-        (WebInspector.StylePropertiesSection.prototype._doesSelectorAffectSelectedNode): helper to check if a selector applies to the selected node
-        (WebInspector.BlankStylePropertiesSection.prototype._dblclick):
-        (WebInspector.BlankStylePropertiesSection.prototype.startEditing):
-        (WebInspector.BlankStylePropertiesSection.prototype.editingCancelled):
-        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
-        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): morph into a StylePropertiesSection
-        (WebInspector.StylePropertyTreeElement.prototype):
-        (WebInspector.StylePropertyTreeElement.prototype.):
-        * inspector/front-end/inspector.css:
+        [Chromium] RenderTheme does not draw focus rings on SL for checkboxes, radio buttons
+        https://bugs.webkit.org/show_bug.cgi?id=34544
 
-2009-07-31  Anton Muhin  <antonm@chromium.org>
+        Covered by layout tests when run on SL.
 
-        Reviewed by Adam Barth.
+        * platform/chromium/ThemeChromiumMac.mm:
+        (-[TCMVisibleView _focusRingVisibleRect]):
+        (-[TCMVisibleView _focusRingClipAncestor]):
+        (FocusIndicationFix::currentOSHasSetFocusRingStyleInBitmapBug):
+        (FocusIndicationFix::swizzleFocusView):
+        (FocusIndicationFix::ScopedFixer::ScopedFixer):
+        (FocusIndicationFix::ScopedFixer::~ScopedFixer):
+        (+[NSView TCMInterposing_focusView]):
+        (WebCore::paintCheckbox):
+        (WebCore::paintRadio):
+        (WebCore::paintButton):
 
-        [v8] check if proxy is present before invoking a handler
-        https://bugs.webkit.org/show_bug.cgi?id=27883 
+2010-02-09  Anton Muhin  <antonm@chromium.org>
 
-        Do not invoke handler function if proxy is null pointer (that would lead to access violation
-        anyway)
+        Reviewed by Nate Chapin.
 
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::callListenerFunction):
+        [v8] Check if returned wrapper is empty before operating on it.
+        https://bugs.webkit.org/show_bug.cgi?id=34746
 
-2009-08-01  Pavel Feldman  <pfeldman@chromium.org>
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8SVGDocumentCustom.cpp:
+        (WebCore::toV8):
 
-        Reviewed by Timothy Hatcher.
+2010-02-09  Mikhail Naganov  <mnaganov@chromium.org>
 
-        Web Inspector: Reimplement Elements Panel so that its
-        interaction with DOM is serialized.
+        Reviewed by Pavel Feldman.
 
-        This is a first cut wuth read support for DOM elements
-        tree as well as some limited editing. No properties, no
-        styles, no search capabilities are implemented yet.
-        Set Preferences.useDOMAgent to true in order to try it
-        out, otherwise disabled by default.
+        Continuing debugger and profiler unforking: narrow scope of JSC-specific ifdefs.
+        Also, enable JAVASCRIPT_DEBUGGER explicitly in features, it appears to be required
+        for really enabling it in V8 bindings generation.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27771
+        https://bugs.webkit.org/show_bug.cgi?id=34706
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
+        * inspector/InjectedScriptHost.idl:
         * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getChildNodes):
-        (WebCore::InspectorBackend::setAttribute):
-        (WebCore::InspectorBackend::removeAttribute):
-        (WebCore::InspectorBackend::setTextNodeValue):
+        (WebCore::InspectorBackend::currentCallFrame):
+        (WebCore::InspectorBackend::getProfile):
         * inspector/InspectorBackend.h:
         * inspector/InspectorBackend.idl:
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::windowScriptObjectAvailable):
-        (WebCore::InspectorController::setFrontendProxyObject):
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
         * inspector/InspectorController.h:
-        (WebCore::InspectorController::domAgent):
-        * inspector/InspectorDOMAgent.cpp: Added.
-        * inspector/InspectorDOMAgent.h: Added.
         * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::resumedScript):
+        (WebCore::InspectorFrontend::profilerWasEnabled):
+        (WebCore::InspectorFrontend::profilerWasDisabled):
+        (WebCore::InspectorFrontend::didGetProfile):
         * inspector/InspectorFrontend.h:
-        * inspector/front-end/Callback.js: Added.
-        * inspector/front-end/DOMAgent.js: Added.
-        * inspector/front-end/ElementsPanel.js:
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
-
-2009-08-01  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Adele Peterson.
-
-        isContentEditable function in htmlediting.* must be removed
-        https://bugs.webkit.org/show_bug.cgi?id=27870
-
-        This patch removes isContentEditable function in htmlediting.cpp and
-        replaces all usage by calling Node::isContentEditable or its derivatives.
+        * page/Console.idl:
 
-        * editing/AppendNodeCommand.cpp: ditto
-        (WebCore::AppendNodeCommand::AppendNodeCommand): ditto
-        * editing/IndentOutdentCommand.cpp: ditto
-        (WebCore::IndentOutdentCommand::outdentParagraph): ditto
-        * editing/InsertNodeBeforeCommand.cpp: ditto
-        (WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand): ditto
-        * editing/htmlediting.cpp: ditto
-        (WebCore::enclosingNodeWithTag): ditto
-        (WebCore::enclosingNodeOfType): ditto
-        (WebCore::canMergeLists): ditto
-        * editing/htmlediting.h: Updated prototype
+2010-02-09  Gavin Barraclough  <barraclough@apple.com>
 
-2009-08-01  John Abd-El-Malek  <jam@chromium.org>
+        Rubber Stamped by Geoff Garen.
 
-        Reviewed by Adam Barth.
-
-        Fix a message port handle always getting marked as reachable once it gets entangled.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27824
-
-        No tests since this only arises with the Chromium multi-process message port implementation
-        which isn't in this repostiory.
-
-        * bindings/v8/V8GCController.cpp:
-        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
+        Rename StringBuilder::release && JSStringBuilder::releaseJSString
+        to 'build()'.
 
-2009-07-31  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Adam Barth.
-
-        Fix Geolocation permission problem
-        https://bugs.webkit.org/show_bug.cgi?id=26993
-
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::requestPermission):
-
-2009-07-31  Norbert Leser  <norbert.leser@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        Added project properties as needed by symbian platform
-
-        * WebCore.pro:
-
-2009-07-31  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Holger Freyther.
-
-        Fix compiler warning.
-
-        Initialize member variables in the correct order.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-
-2009-07-31  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Windows build fix!
-
-        Unreviewed.
-
-        * page/win/PageWin.cpp:
-
-2009-07-31  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Mac build fix.
-
-        Unreviewed.
-
-        * page/Page.cpp:
-        Move setCanStartPlugins() from here...
-        * page/win/PageWin.cpp:
-        (WebCore::Page::setCanStartPlugins):
-        ... to here.
-
-2009-07-29  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        <rdar://problem/5698113> Safari shouldn't auto-activate plug-ins in
-        background tabs (make Win consistent with Mac)
+        * bindings/js/ScriptString.h:
+        (WebCore::ScriptString::operator+=):
 
-        https://bugs.webkit.org/show_bug.cgi?id=27855
+2010-02-09  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Anders Carlsson.
 
-        * loader/FrameLoaderClient.h:
-        (WebCore::FrameLoaderClient::dispatchDidFailToStartPlugin):
-        Declare a new function to dispatch failures to start plug-ins.
-
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        Initialize new member variable.
-        (WebCore::Page::addUnstartedPlugin):
-        Add the PluginView to the set of unstarted plug-ins.
-        (WebCore::Page::removeUnstartedPlugin):
-        Remove the PluginView from the set of unstarted plug-ins.
-        (WebCore::Page::setCanStartPlugins):
-        If we can now start plug-ins, iterate the set of unstarted plug-ins,
-        starting them. If a plug-in fails to start, dispatch a failed-to-start-
-        plug-in error. Clear the list of unstarted plug-ins.
-
-        * page/Page.h:
-        Added m_canStartPlugins to track whether we can currently start
-        plug-ins. Added m_unstartedPlugins to keep track of plug-ins in the
-        page that are waiting to be started.
-        (WebCore::Page::canStartPlugins):
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
-        m_mimeType is now a WebCore::String, so we call .utf8(). If NPP_New()
-        fails, set m_status to reflect this; this used to be set by init(), but
-        start() will not be called by init() if we are delaying start().
-        If NPP_New() succeeds, set m_status to reflect this, and call
-        platformStart().
-        (WebCore::PluginView::startOrAddToUnstartedList):
-        If we cannot start plug-ins, add this view to the Page's list of
-        unstarted plug-ins and return true. Otherwise, call start() and return
-        the result.
-        (WebCore::PluginView::removeFromUnstartedListIfNecessary):
-        If we've been started or we don't have a Page, return early. Remove
-        ourselves from the Page's list of unstarted plug-ins.
-        (WebCore::PluginView::bindingInstance):
-        If we haven't been started yet, return 0. This matches the Mac
-        behavior.
-        (WebCore::PluginView::setParameters):
-        If we find the "plug-ins page" parameter, record it; it may be used if
-        we fail to start the plug-in.
-        (WebCore::PluginView::PluginView):
-        Initialize new members m_haveUpdatedPluginWidget. Initialize m_mimeType
-        with mimeType directly; m_mimeType is now a WebCore::String.
-
-        * plugins/PluginView.h:
-        Made start() public, so Page can call it when we start unstarted
-        plug-ins. Changed m_mimeType from CString to String and added
-        m_pluginsPage; these are needed by dispatchDidFailToStartPlugin().
-        (WebCore::PluginView::pluginsPage):
-        Added for dispatchDidFailToStartPlugin().
-        (WebCore::PluginView::mimeType):
-        Ditto.
-        (WebCore::PluginView::url):
-        Ditto.
+        <rdar://problem/7400160> Netscape plug-ins are not instantiated on property access if there are pending stylesheets
+        https://bugs.webkit.org/show_bug.cgi?id=34776
 
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::platformStart):
-        Stubbed.
+        Tests: plugins/instance-available-before-stylesheets-loaded-object.html
+               plugins/instance-available-before-stylesheets-loaded.html
 
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::platformStart):
-        Stubbed.
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::renderWidgetForJSBindings): Call
+        updateLayoutIgnorePendingStylesheets() before checking for a renderer. 
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::renderWidgetForJSBindings): Ditto.
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::platformStart):
-        Stubbed.
+2010-02-09  Alejandro G. Castro  <alex@igalia.com>
 
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        Use m_haveUpdatedPluginWidget to ensure that we will call MoveWindow()
-        and SetWindowRgn() to position the plug-in and set its clip rect if an
-        earlier call to updatePluginWidget() was made before
-        setPlatformPluginWidget() was called to set the plug-in's HWND.
-        (WebCore::PluginView::~PluginView):
-        Call removeFromUnstartedListIfNecessary() to remove the plug-in from
-        the unstarted list if the plug-in is destroyed before it is started.
-        (WebCore::PluginView::init):
-        Call startOrAddtoUnstartedList to start the plug-in or, if plug-ins
-        cannot be started, to add it to the list of plug-ins waiting to be
-        started. Set m_status to indicate success; this is also set by start(),
-        but that may be delayed, and we don't want the loader to dispatch a
-        failed-to-start-plug-in error when we return from init().
-        (WebCore::PluginView::platformStart):
-        Added; code moved from init(). This is now called by start() to perform
-        any platform-specific tasks that need to take place after the plug-in
-        has started. Added a call to updatePluginWidget() to ensure we position
-        the plug-in and set its clip rect after the plug-in has started.
-        Removed the setting of m_status; start() does this before calling this
-        function (and we assert this at the head of the function).
+        Reviewed by Darin Adler.
 
-2009-07-30  Darin Adler  <darin@apple.com>
+        Problems navigating by caret in links whose text wraps onto
+        subsequent lines.
+        https://bugs.webkit.org/show_bug.cgi?id=25676
 
-        Reviewed by David Levin.
+        We should not search ahead if we are not in the last element.
 
-        Use checked casts for render tree
-        https://bugs.webkit.org/show_bug.cgi?id=23522
+        * dom/Position.cpp:
 
-        Next step: Add casts for all the RenderTable classes and use them everywhere.
+2010-02-09  Dirk Schulze  <krit@webkit.org>
 
-        Also added a few uses in places that were still using static_cast.
-        Also made some virtual member functions private.
-        Also changed RenderTable::m_tableLayout to use OwnPtr.
+        Reviewed by Nikolas Zimmermann.
 
-        * accessibility/AccessibilityTable.cpp:
-        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
-        (WebCore::AccessibilityTable::addChildren):
-        (WebCore::AccessibilityTable::cellForColumnAndRow):
-        * accessibility/AccessibilityTableCell.cpp:
-        (WebCore::AccessibilityTableCell::parentTable):
-        (WebCore::AccessibilityTableCell::rowIndexRange):
-        (WebCore::AccessibilityTableCell::columnIndexRange):
-        (WebCore::AccessibilityTableCell::titleUIElement):
-        * accessibility/AccessibilityTableColumn.cpp:
-        (WebCore::AccessibilityTableColumn::headerObject):
-        * accessibility/AccessibilityTableRow.cpp:
-        (WebCore::AccessibilityTableRow::parentTable):
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::DeleteSelectionCommand::removeNode):
-        * editing/TextIterator.cpp:
-        (WebCore::shouldEmitTabBeforeNode):
-        (WebCore::shouldEmitNewlinesBeforeAndAfterNode):
-        * html/HTMLTableCellElement.cpp:
-        (WebCore::HTMLTableCellElement::parseMappedAttribute):
-        * html/HTMLTableColElement.cpp:
-        (WebCore::HTMLTableColElement::parseMappedAttribute):
-        * page/Frame.cpp:
-        (WebCore::Frame::searchForLabelsAboveCell):
-        * page/mac/FrameMac.mm:
-        (WebCore::Frame::searchForNSLabelsAboveCell):
-        * rendering/AutoTableLayout.cpp:
-        (WebCore::AutoTableLayout::recalcColumn):
-        (WebCore::AutoTableLayout::fullRecalc):
-        (WebCore::shouldScaleColumns):
-        * rendering/FixedTableLayout.cpp:
-        (WebCore::FixedTableLayout::calcWidthArray):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::calcPrefWidths):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::calcPercentageHeight):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::addChild):
-        (WebCore::RenderObject::containingBlock):
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::collapsedBottomBorder):
-        * rendering/RenderTableCol.cpp:
-        (WebCore::RenderTableCol::table):
-        * rendering/RenderTableRow.cpp:
-        (WebCore::RenderTableRow::addChild):
-        (WebCore::RenderTableRow::layout):
-        (WebCore::RenderTableRow::paint):
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::addChild):
-        (WebCore::RenderTableSection::layoutRows):
-        (WebCore::RenderTableSection::lowestPosition):
-        (WebCore::RenderTableSection::rightmostPosition):
-        (WebCore::RenderTableSection::leftmostPosition):
-        (WebCore::RenderTableSection::paintObject):
-        (WebCore::RenderTableSection::recalcCells):
-        * rendering/RenderTreeAsText.cpp:
-        (WebCore::operator<<):
-        (WebCore::writeTextRun):
-        Use checked casts.
+        More optimization for AffineTransform with SVG
+        https://bugs.webkit.org/show_bug.cgi?id=34774
+
+        Some optimizations to safe unnecessary summations and multiplications.
+        Optimize AffineTransform to handle an identity or translation matrix
+        more efficient.
+        Added translationRight to avoid multiplications of matrices as much as
+        possible.
+
+        No tests added, no change of functionality.   
+
+        * platform/graphics/transforms/AffineTransform.cpp:
+        (WebCore::AffineTransform::inverse):
+        (WebCore::AffineTransform::translate):
+        (WebCore::AffineTransform::translateRight):
+        * platform/graphics/transforms/AffineTransform.h:
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::translationForAttributes):
+        (WebCore::RenderForeignObject::localToParentTransform):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::localToBorderBoxTransform):
+        (WebCore::RenderSVGRoot::localToRepaintContainerTransform):
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::applyTextLengthCorrectionToTextChunk):
 
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::styleDidChange): Updated to use OwnPtr.
-        (WebCore::RenderTable::addChild): Use checked cast.
-        (WebCore::RenderTable::layout): Ditto.
-        (WebCore::RenderTable::setCellWidths): Ditto.
-        (WebCore::RenderTable::paintObject): Ditto.
-        (WebCore::RenderTable::splitColumn): Ditto.
-        (WebCore::RenderTable::appendColumn): Ditto.
-        (WebCore::RenderTable::colElement): Ditto.
-        (WebCore::RenderTable::recalcSections): Ditto.
-        (WebCore::RenderTable::outerBorderBottom): Ditto.
-        (WebCore::RenderTable::outerBorderLeft): Ditto.
-        (WebCore::RenderTable::outerBorderRight): Ditto.
-        (WebCore::RenderTable::sectionAbove): Ditto.
-        (WebCore::RenderTable::sectionBelow): Ditto.
-
-        * rendering/RenderTable.h: Added checked cast. Made virtual
-        functions private. Changed m_tableLayout to be a OwnPtr.
-
-        * rendering/RenderTableCell.h: Added checked cast.
-        * rendering/RenderTableCol.h: Ditto. Made virtual functions private.
-        * rendering/RenderTableRow.h: Ditto.
-        * rendering/RenderTableSection.h: Ditto.
-
-2009-07-31  Brady Eidson  <beidson@apple.com>
+2010-02-09  Dirk Schulze  <krit@webkit.org>
 
-        Reviewed by John Sullivan.
+        Reviewed by Nikolas Zimmermann.
 
-        <rdar://problem/6973106> and https://bugs.webkit.org/show_bug.cgi?id=27896
-        Favicons are still loaded when automatic image loading is disabled.
+        SVG patterns with some scale patternTransform are not displayed correctly for small elements
+        https://bugs.webkit.org/show_bug.cgi?id=25484
 
-        People who want to avoid loading images generally want to avoid loading all images.
+        SVG Pattern size was clipped to the size of the target, if the pattern is bigger than the target. This
+        causes problems, if the patternTransform scales the pattern. This patch deletes the clipping.
 
-        Test: http/tests/misc/favicon-loads-with-images-disabled.html
+        Tests: svg/custom/pattern-excessive-malloc.svg
+               svg/custom/pattern-size-bigger-than-target-size.svg
+               svg/custom/pattern-skew-transformed.svg
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::startIconLoader): After committing the URL mapping, don't actually 
-          perform the load if images shouldn't be loading.
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
 
-2009-07-31  Simon Fraser  <simon.fraser@apple.com>
+2010-02-09  Darin Adler  <darin@apple.com>
 
-        Reviewed by Anders Carlsson.
-        
-        Accelerated animations stutter on pages with lots of animations and 3d transforms
-        https://bugs.webkit.org/show_bug.cgi?id=27884
-        
-        This patch changes the strategy for synchronizing painting view the view,
-        and compositing layer updates. Previously the strategy was to disable screen
-        updates between the time we updated the layer tree, and painted the view. That
-        left screen updates disabled for too long (hundreds of milliseconds) in some
-        cases, causing animation stutter.
-        
-        The new strategy is to batch up changes to the CA layer tree, and commit them
-        all at once just before painting happens (referred to as a "sync" in the code).
-        GraphicsLayerCA now keeps a bitmask of changed properties, and then migrates
-        the values stored in GraphicsLayer into the CA layer tree at commit time.
-        
-        Compositing layers are then synced in FrameView::paintContents(). However, not
-        all style/layout changes will result in painting; to deal with style changes that
-        touch only compositing properties, we set up a runloop observer that takes care
-        of comitting layer changes when no painting happens.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleDidChange): Fixed typo in comment.
 
-        * WebCore.base.exp: Export FrameView::syncCompositingStateRecursive()
+2010-02-09  MORITA Hajime  <morrita@gmail.com>
 
-        * loader/EmptyClients.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive()
-        * page/ChromeClient.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive()
+        Reviewed by Nikolas Zimmermann.
 
-        * page/FrameView.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::syncCompositingStateRecursive): syncCompositingState() on the
-        view and all subviews. Like layoutIfNeededRecursive(). If layout is pending, does not
-        sync and returns false, since we only want to sync when layout is done.
-        
-        (WebCore::FrameView::paintContents): syncCompositingState() before painting.
+        SVG selection text foreground colour does not respect user settings
+        https://bugs.webkit.org/show_bug.cgi?id=15997
 
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::endAnimation):
-        Call animationPaused() to notify the graphics layers about animation pausing.
-        
-        * platform/graphics/FloatPoint3D.h:
-        (WebCore::operator==):
-        (WebCore::operator!=): 
-        Add missing comparison operators.
-        
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::setOpacity):
-        (WebCore::GraphicsLayer::setBackgroundColor): Simple setters no longer care about animation info.
+        Add two subphases SVGTextPaintSubphaseGlyphFillSelection and
+        SVGTextPaintSubphaseGlyphStrokeSelection for painting selected
+        text on SVG. Selected texts are painted with style from
+        getCachedPseudoStyle() instead of style().
         
-        (WebCore::GraphicsLayer::paintGraphicsLayerContents): Null-check client.
-        
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::AnimationValue:):
-        (WebCore::TransformAnimationValue:):
-        (WebCore::KeyframeValueList:):
-        (WebCore::KeyframeValueList::insert):
-        Cleaned up versions of FloatValue and TransformValue, used to store information
-        about keyframes values.
-
-        (WebCore::GraphicsLayer::contentsRect):
-        (WebCore::GraphicsLayer::setContentsRect):
-        ContentsRect is now a simple setter.
-        
-        (WebCore::GraphicsLayer::addAnimation):
-        (WebCore::GraphicsLayer::removeAnimationsForProperty):
-        (WebCore::GraphicsLayer::removeAnimationsForKeyframes):
-        (WebCore::GraphicsLayer::pauseAnimation):
-        Simplified animation api.
-        
-        (WebCore::GraphicsLayer::setGeometryOrientation):
-        (WebCore::GraphicsLayer::geometryOrientation):
-        setGeometryOrientation is now just a normal member variable.
-        
-        (WebCore::GraphicsLayer::contentsOrientation): add a getter.
-        (WebCore::GraphicsLayer::syncCompositingState): Entry into the layer sync code.
-        
-        * platform/graphics/GraphicsLayerClient.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive)
+        Tests: svg/text/selection-styles.xhtml
 
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        Lots of cleanup and refactoring. Main points:
-        - Layer changes are all batched, and only committed to the CA layer on syncCompositingState().
-        - Bitmask is used to store which properties have changed. More efficient than before.
-        - Simpler animation interface; simple setters are no longer confounded with animations.
-        - Refactored code that creates CA animations, and stores which animations are running.
-
-        * platform/graphics/transforms/TransformOperations.h:
-        (WebCore::TransformOperations::size):
-        (WebCore::TransformOperations::at): Useful accessors for size and indexed access.
+        * rendering/SVGCharacterLayoutInfo.h:
+        (WebCore::SVGTextChunkWalker::SVGTextChunkWalker):
+        (WebCore::SVGTextChunkWalker::setupFillSelection):
+        (WebCore::SVGTextChunkWalker::setupStrokeSelection):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::mayHaveSelection):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupFillSelectionCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupStrokeSelectionCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::activePaintServer):
+        (WebCore::SVGRootInlineBox::paint):
+        (WebCore::SVGRootInlineBox::walkTextChunks):
+        * rendering/SVGInlineTextBox.h:
+        (WebCore::):        
+        Add callback hooks and its implementation for handle new
+        subphases.
         
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerBacking.cpp:
-        Renamed 'contentsLayer' to 'foregroundLayer' to avoid confusion with GraphicsLayer's
-        contentsLayer.
-        Adapt to GraphicsLayer's simpler animation API.
-        Pass animation pausing through to the graphics layers.
-        contentsBox() is no longer a callback via GraphicsLayerClient.
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::chunkSelectionStartEnd):
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        Split box text into selected part and non-selected part, and use
+        separate subphases to paint them.
         
-        * rendering/RenderLayerCompositor.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::setCompositingLayersNeedRebuild):
-        (WebCore::RenderLayerCompositor::scheduleSync):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        scheduleViewUpdate() is no longer required. Instead, we plumb through "compositingLayerSync"
-        notifications, which travel up to WebKit and set up a runloop observer.
+        * svg/SVGFont.cpp:
+        (WebCore::SVGTextRunWalker::walk):
+        Relax ASSERT() condition to accept a part of text.
         
-2009-07-30  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by David Levin.
-
-        Guard needs //'s between #endif and ENABLE(DATAGRID)
-        https://bugs.webkit.org/show_bug.cgi?id=27862
-
-        Compiling this file causes a build break without this change.
-
-        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::applyStrokeStyleToContext):
+        (WebCore::SVGPaintServer::setup):
+        * svg/graphics/SVGPaintServer.h:
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerGradient.h:
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/SVGPaintServerPattern.h:
+        * svg/graphics/SVGPaintServerSolid.cpp:
+        (WebCore::SVGPaintServerSolid::setup):
+        * svg/graphics/SVGPaintServerSolid.h:
+        Change setup() signature to accept RenderStyle instead of always
+        using RenderObject::style().
+
+2010-02-09  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        No scroll bars are displayed for standalone SVG image
+        https://bugs.webkit.org/show_bug.cgi?id=11225
+
+        Height and width defined for svg element are not honored
+        https://bugs.webkit.org/show_bug.cgi?id=24033
+
+        SVG file does not pan and has no scroll bars
+        https://bugs.webkit.org/show_bug.cgi?id=24448
+
+        Adapt to SVG 1.1 errata to change the overflow handling:
+        Replace "svg { overflow: hidden }"  by "svg:not(:root) { overflow: hidden }" to allow standalone SVG documents to contain scrolllbars.
+        Agreed by SVG WG to make this the default behaviour, already implemented by Opera & FireFox (partial support).
+
+        Add new tests in svg/overflow covering all special SVG css overflow handling rules on inner/outer svg elements.
+
+        Tests: svg/overflow/overflow-on-inner-svg-element-defaults.svg
+               svg/overflow/overflow-on-inner-svg-element.svg
+               svg/overflow/overflow-on-outermost-svg-element-defaults.svg
+               svg/overflow/overflow-on-outermost-svg-element-ignore-attribute-1.svg
+               svg/overflow/overflow-on-outermost-svg-element-ignore-attribute-2.svg
+               svg/overflow/overflow-on-outermost-svg-element-ignore-attribute-3.svg
+               svg/overflow/overflow-on-outermost-svg-element-in-xhtml-auto.xhtml
+               svg/overflow/overflow-on-outermost-svg-element-in-xhtml-defaults.xhtml
+               svg/overflow/overflow-on-outermost-svg-element-in-xhtml-hidden.xhtml
+               svg/overflow/overflow-on-outermost-svg-element-in-xhtml-scroll.xhtml
+               svg/overflow/overflow-on-outermost-svg-element-in-xhtml-visible.xhtml
+
+        * css/svg.css: Change default <svg> overflow rule to only apply to inner <svg> elements.
+        * page/FrameView.cpp: 
+        (WebCore::FrameView::layout): Only apply overflow rules for non-standalone SVG documents.
+        * rendering/RenderSVGRoot.cpp: Remove all calls to isOverflowHidden - it's always the case for the outermost SVG element, see spec + errata.
+        (WebCore::RenderSVGRoot::paint): Always clip to initial viewport size.
+        (WebCore::RenderSVGRoot::computeRectForRepaint): Ditto.
+        (WebCore::RenderSVGRoot::nodeAtPoint): Simplify.
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::applyViewportClip): Use isOverflowHidden() instead of a manual oveflow query and clip in float precision.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::isOverflowHidden): Simplify implementation, assure the function is not called anymore for RenderSVGRoot objects.
 
-2009-07-31  Greg Bolsinga  <bolsinga@apple.com>
+2010-02-09  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        Geolocation clean up when no longer updating
-        https://bugs.webkit.org/show_bug.cgi?id=27888
-
-        When Geolocation::disconnectFrame() is called, need to call 
-        Document::setUsingGeolocation(false) to mirror the true call 
-        when it is set up.
-
-        When handling an error, and there are no more listeners, call
-        GeolocationService::stopUpdating().
-
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::disconnectFrame):
-        (WebCore::Geolocation::handleError):
-
-2009-07-31  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by George Staikos.
-
-        Consolidate GeoLocation code to send positions and errors
-        https://bugs.webkit.org/show_bug.cgi?id=27863
-        
-        Create helper methods that will send positions and errors to either
-        one shots or watchers.
-
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::sendError):
-        (WebCore::Geolocation::sendErrorToOneShots):
-        (WebCore::Geolocation::sendErrorToWatchers):
-        (WebCore::Geolocation::sendPosition):
-        (WebCore::Geolocation::sendPositionToOneShots):
-        (WebCore::Geolocation::sendPositionToWatchers):
-        * page/Geolocation.h:
+        [BREWMP] Port KURL::fileSystemPath
+        https://bugs.webkit.org/show_bug.cgi?id=34516
 
-2009-07-31  Xan Lopez  <xlopez@igalia.com>
+        Convert a file URL to a file path by prefixing
+        AEEFS_HOME_DIR to access files relative to the current
+        module directory in a case-sensitive manner.
 
-        Roll out previous change as it might be causing some weirdness in
-        the bots.
+        As IWeb "file:" engine opens files in BREW's application-relative
+        file namespace, we follow the same policy here.
 
-        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
-        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/brew/KURLBrew.cpp: Added.
+        (WebCore::KURL::fileSystemPath):
 
-2009-07-31  Xan Lopez  <xlopez@igalia.com>
+2010-02-09  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Reviewed by Mark Rowe.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Fix compiler warning.
-        https://bugs.webkit.org/show_bug.cgi?id=27851
+        [Qt] the above website does not render properly when in compositing mode
+        https://bugs.webkit.org/show_bug.cgi?id=34681
 
-        GCC does not like multi-character character constants, so use the
-        explicit numerical value of 'BM' in the enum.
+        http://media.24ways.org/2009/15/spinner-alt.html now renders correctly
 
-        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
-        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::MaskEffectQt::MaskEffectQt): implement mask as
+        QGraphicsEffect
+        (WebCore::MaskEffectQt::draw): reimp
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl): init the effect
+        (WebCore::GraphicsLayerQtImpl::paint): no need for drawContents
+        (WebCore::GraphicsLayerQtImpl::flushChanges): make sure to update the
+        mask layer, not just the actual children
 
-2009-07-30  Brady Eidson  <beidson@apple.com>
+2010-02-09  Kwang Yul Seo  <skyul@company100.net>
 
-        Reviewed by Mark Rowe, but Dan Bernstein also reviewed and asked thoughtful questions.
+        Reviewed by Laszlo Gombos.
 
-        <rdar://problem/7106968> and https://bugs.webkit.org/show_bug.cgi?id=27868
-        http://www.ruthhuntcandy.com/ goes into infinite refresh in WebKit, works in others.
-        
-        Test: http/tests/misc/meta-refresh-stray-single-quote.html
+        [BREWMP] Fix macro redefinition error in BREWMP simulator build.
+        https://bugs.webkit.org/show_bug.cgi?id=34738
 
-        * platform/network/HTTPParsers.cpp:
-        (WebCore::parseHTTPRefresh): Allow for a stray quote character at the start of the URL string.
+        Remove warning: 'FAR' macro redefinition.
 
-2009-07-30  Mark Rowe  <mrowe@apple.com>
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
 
-        Reviewed by Adele Peterson and Jon Honeycutt.
+2010-02-07  Yuzo Fujishima  <yuzo@google.com>
 
-        Fix <https://bugs.webkit.org/show_bug.cgi?id=27828> for Mac.
-        Bug 27828: Title attribute is not respected on option elements
+        Reviewed by Dan Bernstein.
 
-        No tests added as it is not clear how to test a tool tip from DumpRenderTree.
+        Fix the following bugs:
+        https://bugs.webkit.org/show_bug.cgi?id=18926 - dt:after generate a line break. Boost documentation page renders poorly
+        https://bugs.webkit.org/show_bug.cgi?id=7276 - Most W3C padding related tests fail
 
-        * platform/PopupMenuClient.h: Add a method for retrieving the tool tip of an item.
-        * platform/mac/PopupMenuMac.mm:
-        (WebCore::PopupMenu::populate): Set the tool tip of the menu item to that of the represented item.
-        * rendering/RenderMenuList.cpp:
-        (WebCore::RenderMenuList::itemToolTip): Expose the title attribute of the element as the tool tip.
-        * rendering/RenderMenuList.h:
-        * rendering/RenderTextControlSingleLine.h:
-        (WebCore::RenderTextControlSingleLine::itemToolTip): Return an empty string, indicating no tool tip, for
-        the popup menu in RenderTextControlSingleLine.
+        Tests: fast/css/inline-element-line-break.html
+               fast/css/pseudo-element-line-break.html
 
-2009-07-30  Xiaomei Ji  <xji@chromium.org>
-
-        Reviewed by Dan Bernstein.
+        findNextLineBreak() unconditionally allowed lines to break between elements when no other line breaking opportunity had been found,
+        but that was unnecessary and led to incorrect layout. Disallow that kind of line breaks.
 
-        Remove ChromeClientChromium::setToolTip().
-        https://bugs.webkit.org/show_bug.cgi?id=27861
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
 
-        This patch is just to remove a temporarily introduced overloaded empty
-        virtual function. No test is needed.
+2010-02-09  Shinichiro Hamaji  <hamaji@chromium.org>
 
-        * page/chromium/ChromeClientChromium.h:
+        Reviewed by Darin Adler.
 
-2009-07-30  Michael Nordman  <michaeln@google.com>
+        Provide a way to get total number of pages to be printed
+        https://bugs.webkit.org/show_bug.cgi?id=34699
 
-        Reviewed by Darin Fisher.
+        Test: printing/numberOfPages.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=27821
+        * WebCore.base.exp:
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::pageNumberForElement):
+        (WebCore::PrintContext::numberOfPages):
+        * page/PrintContext.h:
+        (WebCore::PrintContext::pageRects):
 
-        ApplicationCacheHost refactoring.
-        
-        1) Better encapsulate the interfaces between webcore common code
-        and the appcache system within a new class ApplicationCacheHost.
+2010-02-08  Dominic Cooney  <dominicc@google.com>
 
-        2) Use that interface throughout the loader system, replacing inline appcache logic.
+        Reviewed by Adam Barth.
 
-        3) Implement the interface in terms of webcore's appcache system.
+        [V8] Move Element custom methods into generic bindings
 
-        4) Add the new files to various makefiles.
+        This patch moves the security checks in setAttribute,
+        setAttributeNode, setAttributeNS and setAttributeNodeNS from
+        V8ElementCustom into the generic bindings so that they can be
+        reused in other bindings. This is in a similar vein to
+        <https://bugs.webkit.org/attachment.cgi?id=45872>.
 
-        5) Implement protocolHostAndPortAreEqual() in KURLGoogle.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=34554
 
-        No new features, no new tests. The existing layout tests all pass.
+        LayoutTests: None
 
-        * GNUmakefile.am:
-        * WebCore.base.exp:
         * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLHtmlElement.cpp:
-        (WebCore::HTMLHtmlElement::insertedIntoDocument):
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::DocumentLoader):
-        (WebCore::DocumentLoader::~DocumentLoader):
-        (WebCore::DocumentLoader::mainReceivedError):
-        (WebCore::DocumentLoader::detachFromFrame):
-        (WebCore::DocumentLoader::setPrimaryLoadComplete):
-        * loader/DocumentLoader.h:
-        (WebCore::DocumentLoader::applicationCacheHost):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
-        (WebCore::FrameLoader::loadResourceSynchronously):
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::didReceiveResponse):
-        (WebCore::MainResourceLoader::didReceiveData):
-        (WebCore::MainResourceLoader::didFinishLoading):
-        (WebCore::MainResourceLoader::didFail):
-        (WebCore::MainResourceLoader::load):
-        * loader/MainResourceLoader.h:
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::load):
-        (WebCore::ResourceLoader::willSendRequest):
-        (WebCore::ResourceLoader::didReceiveResponse):
-        (WebCore::ResourceLoader::didFail):
-        * loader/ResourceLoader.h:
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::selectCache):
-        (WebCore::ApplicationCacheGroup::selectCacheWithoutManifestURL):
-        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::disassociateDocumentLoader):
-        (WebCore::ApplicationCacheGroup::update):
-        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
-        (WebCore::ApplicationCacheGroup::manifestNotFound):
-        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
-        (WebCore::ApplicationCacheGroup::startLoadingEntry):
-        (WebCore::ApplicationCacheGroup::associateDocumentLoaderWithCache):
-        (WebCore::CallCacheListenerTask::create):
-        (WebCore::CallCacheListenerTask::performTask):
-        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
-        (WebCore::ApplicationCacheGroup::postListenerTask):
-        * loader/appcache/ApplicationCacheGroup.h:
-        * loader/appcache/ApplicationCacheHost.cpp: Added.
-        * loader/appcache/ApplicationCacheHost.h: Added.
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::transferApplicationCache):
-        * loader/appcache/ApplicationCacheStorage.h:
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::DOMApplicationCache):
-        (WebCore::DOMApplicationCache::disconnectFrame):
-        (WebCore::DOMApplicationCache::applicationCacheHost):
-        (WebCore::DOMApplicationCache::status):
-        (WebCore::DOMApplicationCache::update):
-        (WebCore::DOMApplicationCache::swapCache):
-        (WebCore::DOMApplicationCache::addEventListener):
-        (WebCore::DOMApplicationCache::removeEventListener):
-        (WebCore::DOMApplicationCache::dispatchEvent):
-        (WebCore::DOMApplicationCache::callListener):
-        (WebCore::DOMApplicationCache::toEventName):
-        (WebCore::DOMApplicationCache::toEventType):
-        * loader/appcache/DOMApplicationCache.h:
-        (WebCore::DOMApplicationCache::):
-        (WebCore::DOMApplicationCache::setAttributeEventListener):
-        (WebCore::DOMApplicationCache::getAttributeEventListener):
-        (WebCore::DOMApplicationCache::clearAttributeEventListener):
-        (WebCore::DOMApplicationCache::callEventListener):
-        (WebCore::DOMApplicationCache::setOnchecking):
-        (WebCore::DOMApplicationCache::onchecking):
-        (WebCore::DOMApplicationCache::setOnerror):
-        (WebCore::DOMApplicationCache::onerror):
-        (WebCore::DOMApplicationCache::setOnnoupdate):
-        (WebCore::DOMApplicationCache::onnoupdate):
-        (WebCore::DOMApplicationCache::setOndownloading):
-        (WebCore::DOMApplicationCache::ondownloading):
-        (WebCore::DOMApplicationCache::setOnprogress):
-        (WebCore::DOMApplicationCache::onprogress):
-        (WebCore::DOMApplicationCache::setOnupdateready):
-        (WebCore::DOMApplicationCache::onupdateready):
-        (WebCore::DOMApplicationCache::setOncached):
-        (WebCore::DOMApplicationCache::oncached):
-        (WebCore::DOMApplicationCache::setOnobsolete):
-        (WebCore::DOMApplicationCache::onobsolete):
-        (WebCore::DOMApplicationCache::~DOMApplicationCache):
-        * platform/KURLGoogle.cpp:
-        (WebCore::protocolHostAndPortAreEqual):
+        * bindings/generic/BindingElement.h: Added.
+        (WebCore::::setAttribute):
+        (WebCore::::setAttributeNode):
+        (WebCore::::setAttributeNS):
+        (WebCore::::setAttributeNodeNS):
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::V8Element::setAttributeCallback):
+        (WebCore::V8Element::setAttributeNodeCallback):
+        (WebCore::V8Element::setAttributeNSCallback):
+        (WebCore::V8Element::setAttributeNodeNSCallback):
 
-2009-07-30  Chris Fleizach  <cfleizach@apple.com>
+2010-02-08  Hayato Ito  <hayato@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Bug 27854 - crash at WebCore::AXObjectCache::notificationPostTimerFired
-        https://bugs.webkit.org/show_bug.cgi?id=27854
-
-        AccessibilityObjects need to be retained while waiting to fire their notifications, otherwise
-        they can disappear and then lead to crashes.
-       
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::notificationPostTimerFired):
-        (WebCore::AXObjectCache::postNotification):
-        * accessibility/AXObjectCache.h:
+        Schedule a loading request when there are many in-flight requests beyond
+        the limit to avoid forever page loading.
 
-2009-07-30  Simon Fraser  <simon.fraser@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=31227
 
-        Minor change to earlier commit suggested by Darin Adler.
-        Use the variable rather than dereferencing 'it' again.
+        Test: http/tests/loading/load-javascript-after-many-xhrs.html
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests):
 
-2009-07-30  Simon Fraser  <simon.fraser@apple.com>
+2010-02-08  David Levin  <levin@chromium.org>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by Gavin Barraclough.
 
-        Animation with a timing function property in a keyframe eats CPU
-        https://bugs.webkit.org/show_bug.cgi?id=27856
-        <rdar://problem/7104476> Animation demo uses lots of CPU
-        
-        Don't include animation-timing-function in the list of properties to
-        animate in a keyframe animation, because this property is not animated;
-        instead, it describes the timing function to apply to this keyframe.
-        
-        This prevents the animation code from thinking that there's a property
-        that it has to software-animate, and thus firing the animation timer frequently.
-        
-        Not testable because there is no visible impact.
+        REGRESSION (before r54472): Various tests in fast/workers are crashing on the buildbot.
+        https://bugs.webkit.org/show_bug.cgi?id=34728
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::keyframeStylesForAnimation): Don't add
-        CSSPropertyWebkitAnimationTimingFunction to the list of properties to animate.
+        The core part of the fix is to change WebCoreJSClientData::m_normalWorld
+        from DOMWrapperWorld to RefPtr<DOMWrapperWorld> so that the DOMWrapperWorld
+        is really ref counted.
 
-        * page/animation/KeyframeAnimation.cpp
-        (WebCore::KeyframeAnimation::getKeyframeAnimationInterval): Add a comment
+        No new tests because current tests sufficiently cover this as evidenced as
+        the buildbot crashes.
 
-2009-07-30  Mike Fenton  <mike.fenton@torchmobile.com>
-
-         Reviewed by Adam Treat.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld): Made this robust to m_globalData
+        being 0.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::create): Made this class follow the standard
+        create pattern for RefCounted classes.
+        (WebCore::DOMWrapperWorld::detachFromGlobalData): Since this class can
+        now outlive JSGlobalData, this method tells it to stop using its JSGlobalData.
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData): Adjusted due to
+        m_normalWorld being a RefPtr.
+        (WebCore::WebCoreJSClientData::~WebCoreJSClientData): Ditto (and added
+        asserts for the FIXME).
+        (WebCore::WebCoreJSClientData::normalWorld): Ditto.
+        * bindings/js/ScriptController.cpp:
+        (WebCore::IsolatedWorld::create): Made the constructor protected.
+        (WebCore::IsolatedWorld::IsolatedWorld): Made the constructor protected, so
+        that code would have to use the create method.
 
-         Apply colour style to buttons that use Theme settings in Qt.
+2010-02-08  Kinuko Yasuda  <kinuko@chromium.org>
 
-         https://bugs.webkit.org/show_bug.cgi?id=27814
+        Reviewed by David Levin.
 
-         * platform/qt/RenderThemeQt.cpp:
-         (WebCore::RenderThemeQt::adjustButtonStyle):
+        Remove special utf-8 tag from Chromium cilpboard code because
+        we now have the corresponding code in generic clipboard framework
+        code in chromium (since it's needed by other places than in Web
+        page rendering) and no longer need the separate workaround code in
+        WebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=34567
 
-=== End merge of nitro-extreme branch 2009-07-30 ===
+        Test: (for regression) editing/pasteboard
 
-2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::writeRange):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::documentFragment):
 
-        Reviewed by Sam Weinig.
+2010-02-08  Darin Adler  <darin@apple.com>
 
-        Make WebCore compile with the new JS number representation.
+        Reviewed by Dan Bernstein.
 
-        * ForwardingHeaders/runtime/JSAPIValueWrapper.h: Added.
-        * ForwardingHeaders/runtime/JSNumberCell.h: Removed.
-        * bindings/js/ScriptEventListener.cpp:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/c/c_instance.cpp:
+        Crash due to layout not done in case involving removal of absolute positioning
+        https://bugs.webkit.org/show_bug.cgi?id=34734
+        rdar://problem/7588280
 
-=== Start merge of nitro-extreme branch 2009-07-30 ===
+        Test: fast/dynamic/position-change-layout.html
 
-2009-07-30  Dean McNamee  <deanm@chromium.org>
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleDidChange): Call markContainingBlocksForLayout in
+        a case where the object already needs layout, but might have a new containing
+        block and so needs to mark the new containing block.
 
-        Reviewed by Dimitri Glazkov.
+2010-02-08  Charlie Reis  <creis@chromium.org>
 
-        Don't try to hash member function pointers, instead use a precomputed value based on the field.
-        https://bugs.webkit.org/show_bug.cgi?id=27843
+        Reviewed by Darin Adler.
 
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8SVGPODTypeWrapper.h:
-        (WebCore::PODTypeWrapperCacheInfo::PODTypeWrapperCacheInfo):
-        (WebCore::PODTypeWrapperCacheInfo::operator==):
-        (WebCore::PODTypeWrapperCacheInfoHash::hash):
-        (WebCore::V8SVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
+        onbeforeunload not called at window close + frame or iframe focused
+        https://bugs.webkit.org/show_bug.cgi?id=27481
+        
+        Chromium and WebKit on Windows will now fire beforeunload handlers
+        even if an inner frame is focused.  
 
-2009-07-30  Xan Lopez  <xlopez@igalia.com>
+        Layout tests aren't able to test this bug, since it requires closing
+        the actual browser window, not calling window.close().  Instead,
+        test with WebCore/manual-tests/onbeforeunload-focused-iframe.html.
 
-        Reviewed by Simon Fraser.
+        * manual-tests/onbeforeunload-focused-iframe.html: Added.
+        * manual-tests/resources/focused-iframe.html: Added.
 
-        Fix compiler warning.
+2010-02-08  Alexey Proskuryakov  <ap@apple.com>
 
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::menuListDefaultEventHandler):
+        Addressing review feedback.
 
-2009-07-29  Matt Perry  <mpcomplete@chromium.org>
+        * bridge/c/c_instance.h: Removed argument name.
 
-        Reviewed by Adam Barth.
+2010-02-08  Alexey Proskuryakov  <ap@apple.com>
 
-        Add a way to register V8 extensions for Isolated Worlds only.
-        https://bugs.webkit.org/show_bug.cgi?id=27785
+        Reviewed by Darin Adler.
 
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluateInNewWorld):
-        (WebCore::ScriptController::evaluateInNewContext):
-        * bindings/v8/ScriptController.h:
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::evaluate):
-        * bindings/v8/V8IsolatedWorld.h:
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluateInNewWorld):
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::createNewContext):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::registerExtensionWithV8):
-        (WebCore::V8Proxy::registerExtension):
-        * bindings/v8/V8Proxy.h:
+        https://bugs.webkit.org/show_bug.cgi?id=34727
+        Assertion crashes and freezes when plug-in property access results in an exception
 
-2009-07-30  Mike Fenton  <mike.fenton@torchmobile.com>
+        Test: plugins/netscape-plugin-property-access-exception.html
 
-         Reviewed by Adam Treat.
+        * bridge/c/c_instance.h: Made moveGlobalExceptionToExecState public, since it also need to
+        be called from CField.
 
-         Add previously defined out support to PopupMenuQt for marking entries as
-         disabled and for selecting the desired item.
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance): Call moveGlobalExceptionToExecState(). Without
+        this, not only didn't we get exceptions, but we also got an assertion failure because of
+        dangling global exception on next call into plug-in.
+        (JSC::Bindings::CField::setValueToInstance): Ditto.
 
-         https://bugs.webkit.org/show_bug.cgi?id=27772
+2010-02-08  Dirk Schulze  <krit@webkit.org>
 
-         * platform/qt/PopupMenuQt.cpp:
-         (WebCore::PopupMenu::populate):
+        Unreviewed build fix of ChromiumWin.
 
-2009-07-30  Darin Adler  <darin@apple.com>
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::):
+        (WebCore::TransparencyWin::setupLayerForOpaqueCompositeLayer):
+        (WebCore::TransparencyWin::setupTransformForKeepTransform):
+        * platform/graphics/chromium/TransparencyWin.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::):
 
-        Reviewed by David Levin.
+2010-02-05  Dumitru Daniliuc  <dumi@chromium.org>
 
-        Use checked casts for render tree
-        https://bugs.webkit.org/show_bug.cgi?id=23522
+        Reviewed by Jeremy Orlow.
 
-        Next step: Add new toRenderWidget cast and use it everywhere.
+        Adding a way to get the set of all open database handles pointing
+        to a given database.
+        https://bugs.webkit.org/show_bug.cgi?id=34619
 
-        Use checked casts in all the places that were using static_cast
-        but there is a checked cast available.
+        Sometimes we need to be able to close all handles to a database as
+        soon as possible (to delete the DB file, for example).
 
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::stringValue):
-        (WebCore::AccessibilityRenderObject::widget):
-        (WebCore::AccessibilityRenderObject::widgetForAttachmentView):
-        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (getPangoLayoutForAtk):
-        * dom/Document.cpp:
-        (WebCore::widgetForNode):
-        (WebCore::Document::setFocusedNode):
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::findWidgetRenderer):
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::defaultEventHandler):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
-        * html/HTMLPlugInElement.cpp:
-        (WebCore::HTMLPlugInElement::defaultEventHandler):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadSubframe):
-        * loader/PluginDocument.cpp:
-        (WebCore::PluginTokenizer::writeRawData):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::hitTestResultAtPoint):
-        (WebCore::subframeForTargetNode):
-        (WebCore::EventHandler::handleWheelEvent):
-        * page/Frame.cpp:
-        (WebCore::isFrameElement):
-        * page/PrintContext.cpp:
-        (WebCore::PrintContext::computePageRects):
-        * page/android/EventHandlerAndroid.cpp:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        * page/chromium/EventHandlerChromium.cpp:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        * page/chromium/FrameChromium.cpp:
-        (WebCore::computePageRectsForFrame):
-        * page/gtk/EventHandlerGtk.cpp:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        * page/haiku/EventHandlerHaiku.cpp:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        (WebCore::EventHandler::passSubframeEventToSubframe):
-        * page/win/FrameWin.cpp:
-        (WebCore::computePageRectsForFrame):
-        * page/wx/EventHandlerWx.cpp:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::getCachedImage):
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writeImage):
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::Pasteboard::writeImage):
-        * platform/mac/PasteboardMac.mm:
-        (WebCore::Pasteboard::writeImage):
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::getCachedImage):
-        * platform/qt/PasteboardQt.cpp:
-        (WebCore::Pasteboard::writeImage):
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::getCachedImage):
-        * platform/win/PasteboardWin.cpp:
-        (WebCore::Pasteboard::writeImage):
-        * rendering/InlineBox.h:
-        (WebCore::InlineBox::boxModelObject):
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::splitInlines):
-        (WebCore::RenderInline::addChildToContinuation):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateImageContents):
-        * rendering/TextControlInnerElements.cpp:
-        (WebCore::RenderTextControlInnerBlock::positionForPoint):
-        Use checked cast instead of static_cast.
-        
-        * rendering/RenderWidget.h: Added toRenderWidget.
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::getOpenDatabases):
+        * storage/DatabaseTracker.h:
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        (WebCore::DatabaseTracker::addOpenDatabase):
+        (WebCore::DatabaseTracker::removeOpenDatabase):
+        (WebCore::DatabaseTracker::getOpenDatabases):
 
-2009-07-30  Yong Li  <yong.li@torchmobile.com>
+2010-02-08  Dirk Schulze  <krit@webkit.org>
 
-        Reviewed by George Staikos.
+        Unreviewed windows build-fix.
 
-        WINCE PORT: some files modified to build for WINCE
-        https://bugs.webkit.org/show_bug.cgi?id=27816
+        * page/win/FrameCGWin.cpp:
+        (WebCore::drawRectIntoContext):
 
-        * accessibility/AccessibilityObject.h:
-        * page/win/EventHandlerWin.cpp:
-        (WebCore::EventHandler::createDraggingClipboard):
-        * platform/win/PlatformMouseEventWin.cpp:
-        (WebCore::messageToEventType):
-        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
-        * platform/win/PlatformScreenWin.cpp:
-        (WebCore::deviceInfoForWidget):
-        (WebCore::screenIsMonochrome):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::paint):
-        (WebCore::registerPopup):
-        (WebCore::PopupWndProc):
+2010-02-08  Dirk Schulze  <krit@webkit.org>
 
-2009-07-30  Yong Li  <yong.li@torchmobile.com>
+        Reviewed by Nikolas Zimmermann.
 
-        Reviewed by George Staikos.
+        Add back an AffineTransform class for use by SVG
+        https://bugs.webkit.org/show_bug.cgi?id=33750
 
-        WINCE PORT: modified graphics files
-        https://bugs.webkit.org/show_bug.cgi?id=27779
+        This adds back AffineTransform. This saves additional 4% memory consumption
+        on the 50k rects stress test: https://bugs.webkit.org/attachment.cgi?id=46721
+        It also makes it possible to optimize the calculations internally of
+        AffineTransform to the needs of 2D transformations (the second benefit for SVG,
+        which uses transformations relative often at the moment.
+        Everything that is 2D related (like images, patterns, gradients, fonts), uses
+        AffineTransform now.
 
-        * platform/graphics/BitmapImage.h:
-        (WebCore::BitmapImage::mayFillWithSolidColor):
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::multiply):
+        (WebCore::JSSVGMatrix::inverse):
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        * bindings/js/JSSVGPODTypeWrapper.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::V8SVGMatrix::multiplyCallback):
+        (WebCore::V8SVGMatrix::inverseCallback):
+        (WebCore::V8SVGMatrix::rotateFromVectorCallback):
+        * html/HTMLCanvasElement.cpp: Changed to AffineTransform now
+        (WebCore::HTMLCanvasElement::baseTransform):
+        * html/HTMLCanvasElement.h:
+        * platform/graphics/FloatPoint.cpp:
+        (WebCore::FloatPoint::matrixTransform):
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::setGradientSpaceTransform):
+        (WebCore::Gradient::setPlatformGradientSpaceTransform):
         * platform/graphics/Gradient.h:
-        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::Gradient::gradientSpaceTransform):
         * platform/graphics/GraphicsContext.h:
-        * platform/graphics/ImageSource.h:
-        * platform/graphics/MediaPlayer.cpp:
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::drawTiled):
+        * platform/graphics/Image.h:
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::ImageBuffer::baseTransform):
         * platform/graphics/Path.h:
+        * platform/graphics/Pattern.cpp:
+        (WebCore::Pattern::setPatternSpaceTransform):
         * platform/graphics/Pattern.h:
-        * platform/graphics/transforms/Matrix3DTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::blend):
-        * platform/graphics/transforms/MatrixTransformOperation.cpp:
-        (WebCore::MatrixTransformOperation::blend):
+        (WebCore::Pattern::create):
+        (WebCore::Pattern::tileImage):
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill):
+        (WebCore::setPlatformStroke):
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cairo/PathCairo.cpp:
+        * platform/graphics/cairo/PatternCairo.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/PathCG.cpp:
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/haiku/PathHaiku.cpp:
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/PathQt.cpp:
+        * platform/graphics/qt/PatternQt.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::setPlatformGradientSpaceTransform):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/PathSkia.cpp:
+        * platform/graphics/skia/PatternSkia.cpp:
+        (WebCore::Pattern::platformPattern):
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::windowsCanHandleTextDrawing):
+        * platform/graphics/transforms/AffineTransform.cpp:
+        (WebCore::AffineTransform::makeIdentity): needed by some parts of WebCore
+        (WebCore::AffineTransform::scale): Didn't scale the complete matrix
+        (WebCore::AffineTransform::translate): Didn't respect other transformations
+        (WebCore::AffineTransform::shear): direct calculation, no extra multiply of matrices
+        (WebCore::AffineTransform::map):
+        (WebCore::AffineTransform::mapPoint):
+        (WebCore::AffineTransform::mapRect):
+        * platform/graphics/transforms/AffineTransform.h:
+        (WebCore::AffineTransform::isIdentityOrTranslation):
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::toAffineTransform):
         * platform/graphics/transforms/TransformationMatrix.h:
-        (WebCore::TransformationMatrix::operator*):
-        * platform/graphics/win/IconWin.cpp:
-        (WebCore::Icon::createIconForFile):
-        (WebCore::Icon::createIconForFiles):
-        (WebCore::Icon::paint):
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::drawGDIGlyphs):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/wince/FontWince.cpp:
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::drawBitmapPattern):
+        * platform/graphics/wince/ImageBufferWince.cpp:
+        (WebCore::):
+        (WebCore::BufferedImage::drawPattern):
+        * platform/graphics/wince/PathWince.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/wince/PlatformPathWince.cpp:
+        (WebCore::drawPolygons):
+        (WebCore::PathPolygon::transform):
+        (WebCore::PlatformPathElement::transform):
+        (WebCore::PlatformPath::strokePath):
+        (WebCore::PlatformPath::fillPath):
+        (WebCore::PlatformPath::transform):
+        * platform/graphics/wince/PlatformPathWince.h:
+        (WebCore::):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::drawPattern):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/wx/PathWx.cpp:
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::paintMozillaGtkWidget):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localTransform):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleData::RenderBoxModelScaleData):
+        (WebCore::RenderBoxModelScaleData::transform):
+        (WebCore::RenderBoxModelScaleData::setTransform):
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::translationForAttributes):
+        (WebCore::RenderForeignObject::localToParentTransform):
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::localTransform):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localTransform):
+        (WebCore::RenderObject::localToParentTransform):
+        (WebCore::RenderObject::absoluteTransform):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::localToParentTransform):
+        (WebCore::RenderPath::localTransform):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGHiddenContainer.h:
+        (WebCore::RenderSVGHiddenContainer::absoluteTransform):
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::localToParentTransform):
+        (WebCore::RenderSVGImage::localTransform):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::localToBorderBoxTransform):
+        (WebCore::RenderSVGRoot::localToRepaintContainerTransform):
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        (WebCore::RenderSVGRoot::absoluteTransform):
+        (WebCore::RenderSVGRoot::localTransform):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.h:
+        (WebCore::RenderSVGText::localToParentTransform):
+        (WebCore::RenderSVGText::localTransform):
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::localToParentTransform):
+        (WebCore::RenderSVGTransformableContainer::localTransform):
+        (WebCore::RenderSVGTransformableContainer::calculateLocalTransform):
+        * rendering/RenderSVGTransformableContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::markerBoundaries):
+        (WebCore::RenderSVGViewportContainer::markerContentTransformation):
+        (WebCore::RenderSVGViewportContainer::viewportTransform):
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        (WebCore::RenderSVGViewportContainer::absoluteTransform):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGCharacterLayoutInfo.cpp:
+        (WebCore::SVGChar::characterTransform):
+        * rendering/SVGCharacterLayoutInfo.h:
+        (WebCore::SVGTextChunkWalker::operator()):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::calculateGlyphBoundaries):
+        (WebCore::SVGInlineTextBoxClosestCharacterToPositionWalker::chunkPortionCallback):
+        (WebCore::SVGInlineTextBoxSelectionRectWalker::chunkPortionCallback):
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        (WebCore::SVGInlineTextBox::paintDecoration):
+        * rendering/SVGMarkerLayoutInfo.h:
+        (WebCore::MarkerLayout::MarkerLayout):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::applyTransformToPaintInfo):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * rendering/SVGRenderTreeAsText.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkPortionCallback):
+        (WebCore::applyTextLengthCorrectionToTextChunk):
+        (WebCore::SVGRootInlineBox::buildLayoutInformation):
+        * rendering/TransformState.cpp:
+        (WebCore::TransformState::applyTransform):
+        * rendering/TransformState.h:
+        * svg/GradientAttributes.h:
+        (WebCore::GradientAttributes::gradientTransform):
+        (WebCore::GradientAttributes::setGradientTransform):
+        * svg/PatternAttributes.h:
+        (WebCore::PatternAttributes::patternTransform):
+        (WebCore::PatternAttributes::setPatternTransform):
+        * svg/SVGAnimateMotionElement.cpp:
+        (WebCore::SVGAnimateMotionElement::resetToBaseValue):
+        (WebCore::SVGAnimateMotionElement::calculateAnimatedValue):
+        (WebCore::SVGAnimateMotionElement::applyResultsToTarget):
+        * svg/SVGAnimateMotionElement.h:
+        * svg/SVGAnimateTransformElement.cpp:
+        * svg/SVGAnimateTransformElement.h:
+        * svg/SVGElement.h:
+        (WebCore::SVGElement::supplementalTransform):
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::viewBoxToViewTransform):
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGLocatable.cpp:
+        (WebCore::SVGLocatable::getCTM):
+        (WebCore::SVGLocatable::getScreenCTM):
+        (WebCore::SVGLocatable::getTransformToElement):
+        * svg/SVGLocatable.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::viewBoxToViewTransform):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGMatrix.idl:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/SVGPreserveAspectRatio.cpp:
+        (WebCore::SVGPreserveAspectRatio::getCTM):
+        * svg/SVGPreserveAspectRatio.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::viewport):
+        (WebCore::SVGSVGElement::createSVGMatrix):
+        (WebCore::SVGSVGElement::createSVGTransformFromMatrix):
+        (WebCore::SVGSVGElement::getCTM):
+        (WebCore::SVGSVGElement::getScreenCTM):
+        (WebCore::SVGSVGElement::viewBoxToViewTransform):
+        * svg/SVGSVGElement.h:
+        * svg/SVGStyledLocatableElement.cpp:
+        (WebCore::SVGStyledLocatableElement::getCTM):
+        (WebCore::SVGStyledLocatableElement::getScreenCTM):
+        * svg/SVGStyledLocatableElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::getCTM):
+        (WebCore::SVGStyledTransformableElement::getScreenCTM):
+        (WebCore::SVGStyledTransformableElement::animatedLocalTransform):
+        (WebCore::SVGStyledTransformableElement::supplementalTransform):
+        * svg/SVGStyledTransformableElement.h:
+        (WebCore::SVGStyledTransformableElement::isStyledTransformable):
+        (WebCore::SVGStyledTransformableElement::toPathData):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGInlineTextBoxQueryWalker::chunkPortionCallback):
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::getScreenCTM):
+        (WebCore::SVGTextElement::getCTM):
+        (WebCore::SVGTextElement::animatedLocalTransform):
+        (WebCore::SVGTextElement::supplementalTransform):
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPathElement.cpp:
+        * svg/SVGTransform.cpp:
+        (SVGTransform::SVGTransform):
+        (SVGTransform::matrix):
+        (SVGTransform::setMatrix):
+        * svg/SVGTransform.h:
+        * svg/SVGTransformDistance.cpp:
+        (WebCore::SVGTransformDistance::SVGTransformDistance):
+        (WebCore::SVGTransformDistance::scaledDistance):
+        (WebCore::SVGTransformDistance::isZero):
+        * svg/SVGTransformDistance.h:
+        * svg/SVGTransformList.cpp:
+        (SVGTransformList::createSVGTransformFromMatrix):
+        (SVGTransformList::concatenate):
+        (SVGTransformList::valueAsString):
+        * svg/SVGTransformList.h:
+        * svg/SVGTransformable.cpp:
+        (WebCore::SVGTransformable::getCTM):
+        (WebCore::SVGTransformable::getScreenCTM):
+        (WebCore::SVGTransformable::parseTransformValue):
+        * svg/SVGTransformable.h:
+        (WebCore::SVGTransformable::):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::gradientTransform):
+        (WebCore::SVGPaintServerGradient::setGradientTransform):
+        (WebCore::clipToTextMask):
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerGradient.h:
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::patternTransform):
+        (WebCore::SVGPaintServerPattern::setPatternTransform):
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/SVGPaintServerPattern.h:
+        * svg/graphics/SVGResourceClipper.cpp:
+        (WebCore::SVGResourceClipper::applyClip):
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::markerTransformation):
+        (WebCore::SVGResourceMarker::draw):
+        * svg/graphics/SVGResourceMarker.h:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
 
-2009-07-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+2010-02-08  Stephen White  <senorblanco@chromium.org>
 
-        Reviewed by Ariya Hidayat.
+        Reviewed by Dimitri Glazkov.
 
-        Improve efficiency by rewriting code doing three hash table
-        lookups, which can be replaced by just one as pointed out
-        by Darin Adler.
+        Make an inline function containing a static var out-of-line.  This is
+        a workaround for Xcode 3.1 bug radar 7070016.  We tripped on this in
+        deviceRGBColorSpaceRef on the Chromium canaries.  This is a proactive
+        fix for the same problem in sRGBColorSpaceRef().
 
-        Though being slightly less clear, this should be considerable
-        faster.
+        https://bugs.webkit.org/show_bug.cgi?id=34663
 
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::remove):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
 
-2009-07-30  Antonio Gomes   <antonio.gomes@openbossa.org>
+2010-02-08  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by Gustavo Noronha.
+        Reviewed by Dimitri Glazkov.
 
-        [Gtk] Code cleanup in MediaPlayerPrivateGStreamer.cpp|h and VideoSinkGStreamer.cpp|h (Part 2)
-        https://bugs.webkit.org/show_bug.cgi?id=27651
+        [V8] Unify the WorkerContext V8 object wrapping code with
+        the standard V8 object wrapping code.
 
-        Removed unneeded includes (gdk.h and gtk.h) and added glib.h and cairo.h instead.
+        https://bugs.webkit.org/show_bug.cgi?id=34658
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::V8NotificationCenter::createHTMLNotificationCallback):
+        (WebCore::V8NotificationCenter::createNotificationCallback):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::toV8):
 
-2009-07-30  Antonio Gomes   <antonio.gomes@openbossa.org>
+2010-02-08  Kwang Yul Seo  <skyul@company100.net>
 
-        Reviewed by Gustavo Noronha.
+        Reviewed by Darin Adler.
 
-        [Gtk] Code cleanup in MediaPlayerPrivateGStreamer.cpp|h and VideoSinkGStreamer.cpp|h (Part 1)
-        https://bugs.webkit.org/show_bug.cgi?id=27651
+        Use fastStrDup instead of strdup
+        https://bugs.webkit.org/show_bug.cgi?id=33943
 
-        Fixed many code style issues pointed by WebKitTools/Scripts/modules/cpplint.py
-        No functionality change at all.
+        Replace strdup/free with fastStrDup/fastFree.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        * platform/graphics/gtk/VideoSinkGStreamer.h:
+        * bridge/IdentifierRep.h:
+        (WebCore::IdentifierRep::IdentifierRep):
+        * bridge/jni/JNIBridge.cpp:
+        (JavaMethod::~JavaMethod):
+        (appendClassName):
+        (JavaMethod::signature):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::~ResourceHandleManager):
+        (WebCore::ResourceHandleManager::setCookieJarFileName):
+        (WebCore::ResourceHandleManager::initializeHandle):
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::~PluginStream):
+        (WebCore::PluginStream::startStream):
+        * xml/XSLTProcessorLibxslt.cpp:
+        (WebCore::xsltParamArrayFromParameterMap):
+        (WebCore::freeXsltParamArray):
 
-2009-07-30  Jakub Wieczorek  <faw217@gmail.com>
+2010-02-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Allow to explicitly choose a preferred plugin for a mimetype.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        When the preferred plugin is set for a specific MIME type, it will be
-        always picked up, regardless of its version, quirks etc.
-
-        Client applications may want to use that API to resolve mimetype
-        ambiguity in a custom way, rather than in the default way that is
-        currently used in WebKit.
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::pluginForMIMEType):
-        (WebCore::PluginDatabase::MIMETypeForExtension):
-        (WebCore::PluginDatabase::setPreferredPluginForMIMEType): Added.
-        (WebCore::PluginDatabase::remove):
-        (WebCore::PluginDatabase::clear):
-        * plugins/PluginDatabase.h:
-
-2009-07-30  Jakub Wieczorek  <faw217@gmail.com>
-
-        [Qt] Fix build with Qt 4.4 after r46535.
-
-        * platform/network/qt/ResourceHandleQt.cpp:
-
-2009-07-30  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Video elements fires another "load" event when attached to DOM
-        https://bugs.webkit.org/show_bug.cgi?id=27623
-
-        Test: media/media-load-event.html
+        Fix Qt build on Windows.
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::insertedIntoDocument):
-            Only schedule load when element's network state is NETWORK_EMPTY.
-
-2009-07-30  Anton Muhin  <antonm@chromium.org>
+        nmake fails to pick the right cpp file, so we have to
+        rename the file to to a unique name.
 
-        Reviewed by David Levin.
-
-        Cache v8 strings when converting from WebCore::String to v8 string.
-        https://bugs.webkit.org/show_bug.cgi?id=27655
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8String): now just immediately calls v8ExternalString
-        (WebCore::enableStringImplCache): enables caching of conversions from WebCore::StringImpl to
-        v8::String
-        (WebCore::makeExternalString): utilty function to create external v8::String out of
-        WebCore::String
-        (WebCore::getStringCache): static function to access string cache
-        (WebCore::cachedStringCallback): callback for weak handles of v8::Strings stored in the
-        cache
-        (WebCore::v8ExternalString): if caching enabled, checks if there is already v8::String for
-        the given WebCore::StringImpl.  If present, returns it, otherwise creates a new v8 external
-        string.
-        * bindings/v8/V8Binding.h:
-
-2009-07-30  Xan Lopez  <xlopez@igalia.com>
+        * WebCore.pro:
+        * platform/graphics/qt/FontCustomPlatformDataQt.cpp: Renamed from WebCore/platform/graphics/qt/FontCustomPlatformData.cpp.
 
-        Reviewed by Maciej Stachowiak.
+2010-02-08  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=25535
-        [GTK] object:state-changed:checked events missing for radio buttons and checkboxes
+        Reviewed by Dirk Schulze.
 
-        Implement state-changed:checked for radio buttons and checkboxes.
+        All SVG *-expected.txt files contain wrong results
+        https://bugs.webkit.org/show_bug.cgi?id=34703
 
-        * accessibility/gtk/AXObjectCacheAtk.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setChecked):
+        Finally dump meaningful information for SVG layout tests.
+        Use 'absoluteClippedOverflowRect' which goes through the same code paths used
+        to actually calculate repaint rects etc - instead of the legacy CSS-unaware
+        code path that mapped 'repaintRectInLocalCoordinates' through 'absoluteTransform'.
+        Remove absoluteTransform() - a long standing TODO, finally not needed anymore.
 
-2009-07-30  Xan Lopez  <xlopez@igalia.com>
+        Despite SVGRenderTreeAsText, SVGPaintServerGradient was also using absoluteTransform().
+        Rewrite the code in question, fixing svg/W3C-SVG-1.1/pserver-grad-08-b.svg alignment issues
+        when scaling/panning text using gradient on stroke/fill. Affects some other gradient tests as well.
 
-        Forgot the 'break'.
+        As we're now dumping clipped overflow rects any problems with repaint rects will become
+        immediate visible - it turns out we're not supporting the overflow rules on the outermost <svg>
+        element properly (repaint rects and bounding boxes need to take special SVG overflow rules into account).
+        Fixing that magically gives pixel-perfect clipped overflow rects for all types of shapes/text/containers.
 
-        * platform/ContextMenu.cpp:
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        Note: This will break any overriden platform-specific SVG results, need to wait for build bots in order to update them.
 
-2009-07-30  Xan Lopez  <xlopez@igalia.com>
+        * rendering/RenderObject.cpp: Remove absoluteTransform() method, centralize overflow query code in SVGRenderSupport::isOverflowHidden().
+        * rendering/RenderObject.h: Remove absoluteTransform() method.
+        * rendering/RenderSVGHiddenContainer.h: Ditto.
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint): Use SVGRenderSupport::isOverflowHidden() to query SVG overflow mode.
+        (WebCore::RenderSVGRoot::computeRectForRepaint): Respect SVG overflow rules here: clip repaintRect against overflow rect _before_ passing
+                                                         along to RenderBox. This is the key issue behind wrong absoluteClippedOverflowRect() values.
+        (WebCore::RenderSVGRoot::nodeAtPoint): Use SVGRenderSupport::isOverflowHidden() to query SVG overflow mode.
+        * rendering/RenderSVGRoot.h: Remove absoluteTransform(). Don't expose viewportSize() anymore.
+        * rendering/RenderSVGText.cpp: 
+        (WebCore::RenderSVGText::strokeBoundingBox): Fix default stroke width to 1. This was the only wrong place -> fixes repaint rects for stroked text.
+        * rendering/RenderSVGViewportContainer.cpp: Remove absoluteTransform() method.
+        (WebCore::RenderSVGViewportContainer::pointIsInsideViewportClip): Use SVGRenderSupport::isOverflowHidden() to query SVG overflow mode.
+        * rendering/RenderSVGViewportContainer.h: Remove absoluteTransform() method.
+        * rendering/SVGRenderSupport.cpp: Refactored overflow queries in one place, centralizing SVG specific assumptions about overflowX/Y.
+        (WebCore::SVGRenderBase::isOverflowHidden):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRenderTreeAsText.cpp: Dump absoluteClippedOverflowRect() instead of absoluteTransform().mapRect(repaintRectInLocalCoordinates()).
+        (WebCore::writePositionAndStyle): Affects all layout tests dumping render trees.
+        * svg/graphics/SVGPaintServerGradient.cpp: Rewrite Gradient on text fill/stroke support on Cg, to avoid using absoluteTransform().
+        (WebCore::absoluteTransformForRenderer):
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        (WebCore::clipToTextMask):
+        (WebCore::SVGPaintServerGradient::setup):
 
-        Try to fix Mac build.
+2010-02-07  Daniel Bates  <dbates@webkit.org>
 
-        * platform/ContextMenu.cpp:
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        Reviewed by Darin Adler.
 
-2009-07-29  Xan Lopez  <xlopez@igalia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34402
 
-        Reviewed by Adam Barth.
+        Implements all of the numeric CSS3 list-style-types as per
+        section 4.3 of the CSS3 Lists module <http://www.w3.org/TR/css3-lists/#numeric>.
 
-        Add missing enumeration value to switch.
+        Test: fast/lists/w3-css3-list-styles-numeric.html
 
-        * platform/ContextMenu.cpp:
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSValueKeywords.in:
+        * inspector/front-end/SourceCSSTokenizer.re2js:
+        * platform/text/CharacterNames.h: Added constant hyphenMinus.
+        * rendering/RenderListMarker.cpp:
+        (WebCore::): Defined enum SequenceType.
+        (WebCore::toAlphabeticOrNumeric): Added.
+        (WebCore::toAlphabetic): Modified to call WebCore::toAlphabeticOrNumeric.
+        (WebCore::toNumeric): Added.
+        (WebCore::listMarkerSuffix):
+        (WebCore::listMarkerText):
+        (WebCore::RenderListMarker::paint):
+        (WebCore::RenderListMarker::calcPrefWidths):
+        (WebCore::RenderListMarker::getRelativeMarkerRect):
+        * rendering/style/RenderStyle.h:
+        (WebCore::):
+        * rendering/style/RenderStyleConstants.h: Added numeric list style types
+        and fixed indent level for the enum values.
+        (WebCore::):
 
-2009-07-29  Jian Li  <jianli@chromium.org>
+2010-02-07  Ismail Donmez  <ismail@namtrac.org>
 
         Reviewed by Darin Adler.
 
-        Workers need to throw an exception when presented with invalid URLs.
-        https://bugs.webkit.org/show_bug.cgi?id=27770
-
-        Tests covered by worker-constructor.html and worker-redirect.html.
+        Include wtf/StringExtras.h for strdup definition, which
+        is needed for WinCE.
 
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::constructWorker):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * workers/Worker.cpp:
-        (WebCore::Worker::Worker):
-        * workers/Worker.h:
-        (WebCore::Worker::create):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::importScripts):
-        * workers/WorkerScriptLoader.cpp:
-        (WebCore::WorkerScriptLoader::loadSynchronously):
-        (WebCore::WorkerScriptLoader::loadAsynchronously):
-        (WebCore::WorkerScriptLoader::createResourceRequest):
-        * workers/WorkerScriptLoader.h:
-
-2009-07-29  Brady Eidson  <beidson@apple.com>
+        * bridge/IdentifierRep.h:
 
-        Reviewed by Darin Adler.
+2010-02-07  Pavel Feldman  <pfeldman@chromium.org>
 
-        (REGRESSION: r46039) Should restore previous connections-per-host limit for non-http(s) hosts
-        https://bugs.webkit.org/show_bug.cgi?id=27822 and <rdar://problem/7091659>
+        Reviewed by Timothy Hatcher.
 
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::servePendingRequests): For non-http(s) hosts, restore the previous behavior of 
-          only limiting connections while parsing and still trying to figure out stylesheet urls.
+        Web Inspector: Fragment-held Elements Not Shown in Inspector.
 
-2009-07-29  Yong Li  <yong.li@torchmobile.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34680
 
-        Reviewed by George Staikos.
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
 
-        WINCE PORT: Add WebCore/page/wince/FrameWince.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27729
+2010-02-07  Jian Li  <jianli@chromium.org>
 
-        * page/wince/FrameWince.cpp: Added.
+        Reviewed by Darin Fisher.
 
-2009-07-29  Ryosuke Niwa  <rniwa@webkit.org>
+        [chromium] Change chromium interface to handle DownloadURL format.
+        https://bugs.webkit.org/show_bug.cgi?id=34655
 
-        Reviewed by Justin Garcia.
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::hasData):
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ChromiumDataObject.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::setData):
 
-        REGRESSION(r46370-46426): /editing/style/remove-underline-from-stylesheet.html fails
-        https://bugs.webkit.org/show_bug.cgi?id=27809
+2010-02-06  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        The patch primarily rebaselines the tests but also fixes the bug in currentlyHasStyle.
-        To determine that a particular text decoration is present, currentlyHasStyle should refer to
-        -webkit-text-decorations-in-effect to take care of styles set by u, s, strike tags and ancestors' CSS.
-        We also need to update layout to accommodate the changes made within ApplyStyleCommand.
+        No review, rolling out r54364.
+        http://trac.webkit.org/changeset/54364
+        https://bugs.webkit.org/show_bug.cgi?id=34464
 
-        * editing/ApplyStyleCommand.cpp: ditto
-        (WebCore::StyleChange::currentlyHasStyle): ditto
+        Introduced asserts in layout tests, needs more testing
+        locally.
 
-2009-07-29  Yong Li  <yong.li@torchmobile.com>
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * page/chromium/ChromeClientChromium.h:
 
-        Reviewed by George Staikos.
+2010-02-06  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        WINCE PORT: changes to platform/text files
-        https://bugs.webkit.org/show_bug.cgi?id=27715
+        Reviewed by Adam Barth.
 
-        * platform/text/String.cpp:
-        (WebCore::String::format):
-        * platform/text/TextEncoding.cpp:
-        (WebCore::TextEncoding::encode):
-        * platform/text/TextEncodingRegistry.cpp:
-        (WebCore::buildBaseTextCodecMaps):
-        (WebCore::extendTextCodecMaps):
+        Using inlines and function-level statics don't mix, according to gcc.
+        https://bugs.webkit.org/show_bug.cgi?id=34663
 
-2009-07-29  Yong Li  <yong.li@torchmobile.com>
+        De-inline deviceRGBColorSpaceRef to avoid gcc-bug landmines.
 
-        Reviewed by Adam Roben.
+        It appears that the initialization check, generated by gcc doesn't account
+        for a possibility that the function may be inlined, resulting in lazy
+        initialization failure for more than one inlined instance of the function.
 
-        FIX: HDC leaks in PopupMenuWin.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27817
+        No behavior change, so no new tests.
 
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::~PopupMenu):
-        (WebCore::PopupMenu::paint):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::deviceRGBColorSpaceRef):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
 
-2009-07-29  Darin Adler  <darin@apple.com>
+2010-02-05  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        Illegal values for <ol start> cause list numbering start at 0 (should start at 1)
-        https://bugs.webkit.org/show_bug.cgi?id=27810
-
-        Test: fast/lists/ol-start-parsing.html
-
-        * html/HTMLOListElement.cpp:
-        (WebCore::HTMLOListElement::parseMappedAttribute): Check the result of toInt
-        and use the value 1 if it failed to parse. Before we were getting toInt's default
-        behavior, which is to return 0.
-
-2009-07-29  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Added foundation work to allow a testing infrastructure for the Web
-        Inspector.
-
-        * inspector/InspectorClient.h:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::scriptObjectReady): Tell the testing
-        harness that the window object is ready.
-        * loader/EmptyClients.h: Empty class support for SVG.
-        (WebCore::EmptyInspectorClient::inspectorWindowObjectCleared):
-
-2009-07-29  Chris Fleizach  <cfleizach@apple.com>
-
-        Build fix for windows after landing
-        Bug 27807 - AX: move re-usable code into more common areas for other platforms
-   
-        Apparently bzero doesn't exist on windows.
-
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
-
-2009-07-29  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Justin Garcia.
-
-        Bug 27807 - AX: move re-usable code into more common areas for other platforms
-        https://bugs.webkit.org/show_bug.cgi?id=27807
-
-        Moves some accessibility code that was in the Mac file to a more common place so 
-        it can be used by other platforms. 
-        This includes:
-           Making TextMarkerData from a VisiblePosition.
-           Making a VisiblePosition from TextMarkerData.
-           Finding the anchor accessibility object for an arbitrary Node.
+        Added an ASSERT to catch an implausible but theoretically possible leak.
+        
+        In theory, if malloc allocated a UChar buffer directly after a StringImpl,
+        the StringImpl might incorrecly assume that the UChar buffer was inline,
+        and fail to delete it.
+        
+        This ASSERT is somewhat academic, since we don't use the same allocator
+        in debug builds, but oh well.
 
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::visiblePositionForTextMarkerData):
-        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
-        * accessibility/AXObjectCache.h:
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::anchorElementForNode):
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::visiblePositionForIndex):
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (textMarkerForVisiblePosition):
-        (visiblePositionForTextMarker):
-        (AXAttributedStringAppendText):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::createUninitialized):
+        * platform/text/StringImpl.h: Separated the inline buffer StringImpl
+        constructor from the out-of-line buffer StringImpl constructor. Made
+        the former ASSERT that its buffer was indeed inline, and the latter ASSERT
+        that its buffer was indeed not inline.
 
-2009-07-29  Dan Bernstein  <mitz@apple.com>
+2010-02-05  Chris Marrin  <cmarrin@apple.com>
 
         Reviewed by Simon Fraser.
 
-        Inset box shadows are incorrectly accounted for in visual overflow
-        computations
-        https://bugs.webkit.org/show_bug.cgi?id=27811
-
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeBoxesHorizontally): Use
-            getBoxShadowHorizontalExtent().
-        (WebCore::InlineFlowBox::placeBoxesVertically): Use
-            getBoxShadowVerticalExtent(). Removed duplicate code to get the
-            text-shadow overflow.
-        (WebCore::InlineFlowBox::paint): Use getBoxShadowHorizontalExtent().
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::overflowHeight): Use
-            getBoxShadowVerticalExtent().
-        (WebCore::RenderBlock::overflowWidth): Use
-            getBoxShadowHorizontalExtent().
-        (WebCore::RenderBlock::overflowLeft): Ditto.
-        (WebCore::RenderBlock::overflowTop): Use getBoxShadowVerticalExtent().
-        (WebCore::RenderBlock::overflowRect): Use getBoxShadowExtent().
-        (WebCore::RenderBlock::layoutBlock): Ditto.
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock): Ditto.
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::calculateRects): Exclude inset shadows.
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Use
-            getBoxShadowHorizontalExtent() and getBoxShadowVerticalExtent().
-        (WebCore::RenderObject::adjustRectForOutlineAndShadow): Exclude inset
-            shadows.
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Ditto.
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::setTextShadow): Also assert that text-shadows are
-            not inset.
-        (WebCore::RenderStyle::getBoxShadowExtent): Added. Excludes inset
-            shadows.
-        (WebCore::RenderStyle::getBoxShadowHorizontalExtent): Ditto.
-        (WebCore::RenderStyle::getBoxShadowVerticalExtent): Ditto.
-        * rendering/style/RenderStyle.h:
-
-2009-07-29  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix crash when an element with display: table-row is composited (e.g. via a 3d-transform)
-        https://bugs.webkit.org/show_bug.cgi?id=27796
+        Fixed changed virtual function in GraphicsLayerCACF and call order issues
+        https://bugs.webkit.org/show_bug.cgi?id=34348
         
-        Avoid repainting when a layer becomes composited if the renderer is not parented
-        yet, because it makes no sense to do so.
+        The correct virtual function in GraphicsLayerCACF is now being
+        called. We also fixed an issue in QTMovieWin where the size
+        of the movie was not being set correctly because the call order
+        was changed.
         
-        If the table row is a repaint container, default to the RenderBox implementation
-        of clippedOverflowRectForRepaint(), because we cannot hand off the repaint rect
-        computation to something that is above the repaint container.
+        I also changed the order of a couple of calls in QTMovieWin to account
+        for changed calling order from the logic above.
 
-        Test: fast/table/table-row-compositing-repaint-crash.html
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::repaintOnCompositingChange):
-        * rendering/RenderTableRow.cpp:
-        (WebCore::RenderTableRow::clippedOverflowRectForRepaint):
-
-2009-07-29  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27791
-        307 redirects of POSTs should use POST, not GET
-
-        Test: http/tests/loading/redirect-methods.html
-
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::willSendRequest):
-
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+        * platform/graphics/win/GraphicsLayerCACF.cpp:Update to new virtual function API
+        (WebCore::GraphicsLayerCACF::setContentsToMedia):
+        (WebCore::GraphicsLayerCACF::updateContentsMedia):
+        * platform/graphics/win/GraphicsLayerCACF.h:Update to new virtual function API
+        (WebCore::GraphicsLayerCACF::):
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::cacheMovieScale):Fix a bug where ratio was computed wrong because it was using integer math
+        (QTMovieWinPrivate::task):Compute movie scale before computing movie size so values are correct
+        (QTMovieWinPrivate::setSize):Move movie size update to updateMovieSize()
+        (QTMovieWinPrivate::updateMovieSize):Wrap size update in a new call so it can be used from multiple places
 
-2009-07-29  Chris Marrin  <cmarrin@apple.com>
+2010-02-05  Enrica Casucci  <enrica@apple.com>
 
         Reviewed by Simon Fraser.
 
-        Adding -webkit-animation-play-state back in
-        https://bugs.webkit.org/show_bug.cgi?id=26867
-
-        We've decided to keep -webkit-animation-play-state. So this
-        just adds back in the code from https://bugs.webkit.org/show_bug.cgi?id=22907.
-
-        Test: animations/play-state.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseAnimationPlayState):
-        (WebCore::CSSParser::parseAnimationProperty):
-        * css/CSSParser.h:
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        (WebCore::CSSStyleSelector::mapAnimationPlayState):
-        * css/CSSStyleSelector.h:
-        * platform/animation/Animation.h:
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-
-2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        Expose the default plugin directories and the current directory set of
-        the plugin database as public API.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        * plugins/PluginDatabase.h:
-        (WebCore::PluginDatabase::pluginDirectories):
-
-2009-07-29  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by David Levin.
-
-        [chromium] Font size for current time display in media controls panel
-        is affected by body font size.
-        https://bugs.webkit.org/show_bug.cgi?id=27799
-
-        Fixing the problem of rendering by explicitly setting the font size
-        for the time displays.
-
-        No new tests since this is covered by existing media tests.
-
-        * css/mediaControlsChromium.css:
-
-2009-07-29  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by David Levin.
-
-        Update WebCore/page/ContextMenuController.cpp to conform to WebKit
-        Style Guidelines as identified by cpp_style.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27613
-
-        * page/ContextMenuController.cpp:
-        (WebCore::openNewWindow):
-        (WebCore::ContextMenuController::contextMenuItemSelected):
-
-2009-07-29  Dean McNamee  <deanm@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Removed unused wrapCPointer/extractCPointer from the v8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=27805
-
-        * bindings/v8/V8DOMWrapper.h:
-
-2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        Expose the PluginDatabase::pluginForMIMEType() function as public API.
-        https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        It can be used to determine the appropriate plugin for a mime type,
-        without guessing the mimetype from the extension.
-
-        * plugins/PluginDatabase.h:
-
-2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Adam Treat.
-
-        Allow to enable/disable particular plugin packages.
-        https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        Disabled plugins will not be picked up when looking for a plugin
-        supporting the requested mimetypes.
-
-        Client applications may want to use that API to disable specific
-        plugins.
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::pluginForMIMEType):
-        (WebCore::PluginDatabase::MIMETypeForExtension):
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::PluginPackage):
-        (WebCore::PluginPackage::setEnabled):
-        * plugins/PluginPackage.h:
-        (WebCore::PluginPackage::isEnabled):
-
-2009-07-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        [WML] Running WML tests in random order multiple times exposes subtle bugs
-        https://bugs.webkit.org/show_bug.cgi?id=27801
-
-        Remove superflous assertions regarding the parent node. Under certain circumstances
-        these can even fire (related to garbage collection while destructing). Fixes random order
-        WML tests (run-webkit-tests fast/wml wml http/tests/wml fast/wml ... --random)
-
-        The wml/enter-first-card-with-events.html test relied on a bug in our implementation of
-        WMLPageState::reset() - the history stack should still contain the current card afterwards.
-        Fix that bug by preserving the first item in BackForwardList::clearWMLPageHistory().
-
-        * history/BackForwardList.cpp: Preserve first item in history stack, as demanded by the spec.
-        (WebCore::BackForwardList::clearWMLPageHistory):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::insertedIntoDocument):
-        (WebCore::WMLDoElement::removedFromDocument):
-        * wml/WMLNoopElement.cpp:
-        (WebCore::WMLNoopElement::insertedIntoDocument):
-        * wml/WMLOnEventElement.cpp:
-        (WebCore::eventHandlingParent):
-        * wml/WMLPostfieldElement.cpp:
-        (WebCore::WMLPostfieldElement::insertedIntoDocument):
-        (WebCore::WMLPostfieldElement::removedFromDocument):
-        * wml/WMLSetvarElement.cpp:
-        (WebCore::WMLSetvarElement::insertedIntoDocument):
-        (WebCore::WMLSetvarElement::removedFromDocument):
-        * wml/WMLTaskElement.cpp:
-        (WebCore::WMLTaskElement::insertedIntoDocument):
-        (WebCore::WMLTaskElement::removedFromDocument):
-        * wml/WMLTimerElement.cpp:
-        (WebCore::WMLTimerElement::insertedIntoDocument):
-        (WebCore::WMLTimerElement::removedFromDocument):
-
-2009-07-29  Yongjun Zhang  <yongjun.zhang@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26848
-        [Qt] ResourceHandle::willLoadFromCache needs to be implemented QtWebKit.
+        Horizontal scrollbar works in reverse at milliondollarcu.be
+        <rdar://problem/7556121>
+        https://bugs.webkit.org/show_bug.cgi?id=33848
+        
+        Added a manual test.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadItem):
-        * platform/network/ResourceHandle.h:
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::willLoadFromCache):
-        * platform/network/curl/ResourceHandleCurl.cpp:
-        (WebCore::ResourceHandle::willLoadFromCache):
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::willLoadFromCache):
-        * platform/network/qt/ResourceHandleQt.cpp:
-        (WebCore::ResourceHandle::willLoadFromCache):
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::):
+        * manual-tests/win: Added.
+        * manual-tests/win/horizontal-scroll-composited.html: Added.
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::setScrollFrame):
+        (WebCore::WKCACFLayerRenderer::setRootChildLayer):
 
-2009-07-29  Alpha Lam  <hclam@chromium.org>
+2010-02-05  Ryan Leavengood  <leavengood@gmail.com>
 
         Reviewed by David Levin.
 
-        Media control panel for <video> in MediaDocument is mis-placed
-        https://bugs.webkit.org/show_bug.cgi?id=27798
-
-        Fixing a rendering problem: When <video> is displayed in MediaDocument,
-        the media control panel overlaps with the video by 16 pixels.
-
-        No new tests as this is covered by existing media tests.
-
-        * css/mediaControlsChromium.css:
-
-2009-07-29  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed build fix for Chromium.  Those last two patches weren't
-        independent despite the clean merge.
-
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
-
-2009-07-29  Avi Drissman  <avi@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        ImageSourceCG makes bad data refs (race condition causes blank images)
-        https://bugs.webkit.org/show_bug.cgi?id=27777
-
-        Make ImageSourceCG guarantee that the lifetime of the SharedBuffer that
-        backs the CFDataRef will be long enough.
-
-        No new tests, as this fixes a bug with a race condition that is
-        difficult to trigger.
-
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::ImageSource::setData):
-
-2009-07-29  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Console should show completions for the command line APIs
-        https://bugs.webkit.org/show_bug.cgi?id=27696
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._reportCompletions): Adds properties from _inspectorCommandLineAPI to 
-        completions when available.
-        * inspector/front-end/utilities.js:
-        (Object.properties): Added.
-        (Object.sortedProperties):
-
-2009-07-29  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Refactor the first step of layout in RenderFlexibleBox.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27704
-
-        No new tests as this change is just a refactoring.
-
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::gatherFlexChildrenInfo):
-        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
-        (WebCore::RenderFlexibleBox::layoutVerticalBox):
-
-2009-07-29  Kent Tamura  <tkent@chromium.org>
+        Implementation of GlyphPage::fill() for Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=34527
 
-        Reviewed by Nikolas Zimmermann.
-
-        Fix a bug that HTMLOptionElement::value() returns an incorrect
-        value in a case that the element has a label attribute and no
-        value attribute.
-        https://bugs.webkit.org/show_bug.cgi?id=27760
-
-        Test: fast/forms/option-value-and-label.html
+        Covered by existing tests.
 
-        * dom/OptionElement.cpp:
-        (WebCore::OptionElement::collectOptionLabelOrText):
-        (WebCore::OptionElement::collectOptionInnerText):
-        (WebCore::OptionElement::normalizeText):
-        (WebCore::OptionElement::collectOptionTextRespectingGroupLabel):
-        (WebCore::OptionElement::collectOptionValue):
-        * dom/OptionElement.h:
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::text):
-        * wml/WMLOptionElement.cpp:
-        (WebCore::WMLOptionElement::text):
+        * platform/graphics/haiku/GlyphPageTreeNodeHaiku.cpp
 
-2009-07-29  Adam Barth  <abarth@webkit.org>
+2010-01-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Dave Hyatt.
 
-        [V8] Fix isolated world wrappers for event handlers
-        https://bugs.webkit.org/show_bug.cgi?id=27533
+        Implement flattening of framesets
+        https://bugs.webkit.org/show_bug.cgi?id=32717
 
-        Instead of getting the context from the frame, we cache the context
-        when the listener is created so that we get the context for the right
-        world.
+        The following patch, builds ontop of Antti Koivisto's frameset
+        flattening code from the iPhone source, which itself is based on
+        the old Nokia Series 60 source.
 
-        Test: http/tests/security/isolatedWorld/click-event.html
+        Layout tests have been added to test the functionality and the original
+        code which has then been fixed to make these pass, as well as support
+        frameset grids.
 
-        * WebCore.gypi:
-        * bindings/v8/OwnHandle.h: Added.
-        (WebCore::OwnHandle::OwnHandle):
-        (WebCore::OwnHandle::~OwnHandle):
-        (WebCore::OwnHandle::get):
-        (WebCore::OwnHandle::set):
-        (WebCore::OwnHandle::release):
-        (WebCore::OwnHandle::adopt):
-        (WebCore::OwnHandle::swap):
-        (WebCore::OwnHandle::clear):
-        (WebCore::OwnHandle::makeWeak):
-        (WebCore::OwnHandle::weakCallback):
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
-        (WebCore::V8AbstractEventListener::handleEvent):
-        * bindings/v8/V8AbstractEventListener.h:
-        * bindings/v8/V8DOMWrapper.h:
+        Tests: fast/frames/flattening/frameset-flattening-advanced.html
+               fast/frames/flattening/frameset-flattening-grid.html
+               fast/frames/flattening/frameset-flattening-simple.html
+               fast/frames/flattening/frameset-flattening-subframe-resize.html
+               fast/frames/flattening/frameset-flattening-subframesets.html
 
-2009-07-29  Adam Barth  <abarth@webkit.org>
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::scheduleRelayout):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setFrameSetFlatteningEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::frameSetFlatteningEnabled):
+        * rendering/RenderFrame.cpp:
+        (WebCore::RenderFrame::layoutWithFlattening):
+        * rendering/RenderFrame.h:
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::layout):
+        (WebCore::RenderFrameSet::positionFramesWithFlattening):
+        (WebCore::RenderFrameSet::flattenFrameSet):
+        (WebCore::RenderFrameSet::userResize):
+        * rendering/RenderFrameSet.h:
 
-        Reviewed by Dimitri Glazkov.
+2010-02-05  Simon Fraser  <simon.fraser@apple.com>
 
-        [V8] Teach V8Proxy::context about isolated worlds
-        https://bugs.webkit.org/show_bug.cgi?id=27701
+        Reviewed by Dan Bernstein.
 
-        Change V8Proxy::context(Frame*) to understand isolated worlds.  Audit
-        all callers of this method to make sure they want isolated worlds.  In
-        cases where we really want the main world, I've changed the call to
-        V8Proxy::mainWorldContext(Frame*).
+        Changing display type of parent of input on focus causes input field to not receive key events
+        https://bugs.webkit.org/show_bug.cgi?id=34620
+        <rdar://problem/7584572>
         
-        The main visible change is to the document.open method when called with
-        more than two arguments.  This design seems more likely to lead to
-        future correct code.
-
-        Test: http/tests/security/isolatedWorld/document-open.html
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::processingUserGesture):
-        (WebCore::ScriptController::evaluate):
-        (WebCore::ScriptController::bindToWindowObject):
-        (WebCore::ScriptController::collectGarbage):
-        (WebCore::createScriptObject):
-        (WebCore::ScriptController::createScriptObjectForPluginElement):
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::handleEvent):
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getConstructor):
-        (WebCore::V8DOMWrapper::setHiddenWindowReference):
-        (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        (WebCore::V8DOMWrapper::convertWindowToV8Object):
-        * bindings/v8/V8Helpers.cpp:
-        (WebCore::toV8Context):
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::context):
-        (WebCore::V8Proxy::mainWorldContext):
-        (WebCore::V8Proxy::bindJsObjectToWindow):
-        * bindings/v8/V8Proxy.h:
-
-2009-07-29  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
-
-        Reviewed by Simon Hausmann.
-
-        Fix the Qt build, add missing file.
-
-        * WebCore.pro:
-
-2009-07-28  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Speculative fix for <rdar://problem/7005077> WER: Crash in
-        WebCore::PluginStream::destroyStream+279 (1310510882)
-
-        Reviewed by Oliver Hunt.
-
-        * plugins/PluginStream.cpp:
-        (WebCore::PluginStream::destroyStream):
-        Move the "protector" RefPtr out of the block that dispatches
-        notifications and into the function level; if NPN_DestroyStream were
-        called from NPP_NewStream as the comment warns, we would be deleted at
-        the end of the block.
+        When layout affects a text input, the RenderTextControl gets destroyed and
+        recreated, which in turn makes a new innerTextElement. However, if the text field was
+        focused, the VisibleSelection is left pointing to the old innerTextElement, so text
+        input no longer works.
+        
+        The fix is to call updateFocusAppearanceSoon() when attaching the input element,
+        which will update the selection if necessary.
 
-2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+        Test: fast/forms/restore-selection-after-layout.html
 
-        Inspector: Tab Through the DOM Storage DataGrid when Editing
+        * dom/Document.h: Add a paramter to updateFocusAppearanceSoon() and a member variable,
+        m_updateFocusAppearanceRestoresSelection, to store its value until the timer fires.
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Initialize m_updateFocusAppearanceRestoresSelection
+        (WebCore::Document::updateFocusAppearanceSoon): New restorePreviousSelection parameter.
+        (WebCore::Document::updateFocusAppearanceTimerFired): Pass m_updateFocusAppearanceRestoresSelection down.
+        * dom/Element.cpp:
+        (WebCore::Element::attach): Call updateFocusAppearanceSoon() with false.
+        * dom/Element.h: The updateFocusAppearanceSoonAfterAttach() was undefined.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach): Call document()->updateFocusAppearanceSoon() with true.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27746
+2010-02-05  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        * inspector/front-end/DOMStorageDataGrid.js:
-        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode): refactored to directly edit and select a column
-        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
-        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted.moveToNextIfNeeded): handles moveDirection on a commit
-        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted): uses moveToNext to traverse appropriately
-
-2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Inspector: Create New DOM Storage Items via DataGrid
+        Web Inspector: simplify cookies view, introduce DataGrid::autoSizeColumns.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27322
+        https://bugs.webkit.org/show_bug.cgi?id=34646
 
-        Reviewed by Timothy Hatcher.
-
-        * inspector/front-end/DOMStorageDataGrid.js:
-        (WebInspector.DOMStorageDataGrid.prototype._startEditing): click anyway means creationNode
-        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted): fix unintended globals
-        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow): creationNode is special case
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.show):
+        (WebInspector.CookieItemsView.prototype._update):
+        (WebInspector.CookieItemsView.prototype._updateWithCookies):
+        (WebInspector.CookieItemsView.prototype._filterCookiesForDomain):
+        (WebInspector.CookieItemsView.prototype._createDataGrid):
+        (WebInspector.CookieItemsView.prototype._populateDataGrid.expiresCompare):
+        (WebInspector.CookieItemsView.prototype._populateDataGrid):
+        (WebInspector.CookieItemsView.prototype._createSimpleDataGrid):
+        (WebInspector.CookieItemsView.prototype._populateSimpleDataGrid):
+        (WebInspector.CookieItemsView.prototype._deleteCookieCallback):
+        (WebInspector.CookieItemsView.prototype._refreshButtonClicked):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
         * inspector/front-end/DataGrid.js:
-        (WebInspector.DataGrid.prototype.addCreationNode): maintain a quick ref to the single creationNode
-        (WebInspector.CreationDataGridNode): new type of node
-        (WebInspector.CreationDataGridNode.prototype.makeNormal): convert to a normal node
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage): add a creationNode to the GridData
-
-2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Inspector: Automatically Refresh DOM Storage Grids on "storage" event
-
-        https://bugs.webkit.org/show_bug.cgi?id=27400
-
-        Reviewed by Timothy Hatcher.
-
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.show): trigger adding the listener
-        (WebInspector.DatabasesPanel.prototype.reset): trigger removing the listener
-        (WebInspector.DatabasesPanel.prototype._registerStorageEventListener): register the listener on the inspected window
-        (WebInspector.DatabasesPanel.prototype._unregisterStorageEventListener): unregister the listener on the inspected window
-        (WebInspector.DatabasesPanel.prototype._storageEvent): handle the storage event
-
-2009-07-28  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Inspector should support inspect() in the command line.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19874
-        rdar://problem/6070225
-
-        Reviewed by Timothy Hatcher.
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled.inspectObject):
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.revealAndSelectDomStorage): Added.
-        (WebInspector.DatabasesPanel.prototype.revealAndSelectDatabase): Added.
-        (WebInspector.DatabasesPanel.prototype.showDatabase): 
-
-2009-07-28  Keishi Hattori  <casey.hattori@gmail.com>
-
-        The rest of: Web Inspector: Add inspected node using public console API.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27758
-
-        Reviewed by Timothy Hatcher.
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled): Removed _inspectorCommandLineAPI._addInspectedNode.
-        (WebInspector.Console.prototype.addInspectedNode): Added.
+        (WebInspector.DataGrid):
+        (WebInspector.DataGrid.prototype.autoSizeColumns):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView.prototype._queryFinished):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.dataGridForResult):
 
-2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-04  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Accept autocomplete on 'End' key pressed.
+        Web Inspector: group cookies by frame, show total
+        cookies size, allow sorting cookie table.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27447.
+        https://bugs.webkit.org/show_bug.cgi?id=34617
 
-        * inspector/front-end/TextPrompt.js:
-        (WebInspector.TextPrompt.prototype.handleKeyEvent):
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype._updateWithCookies):
+        (WebInspector.CookieItemsView.prototype._cookiesForDomain):
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._createNodes):
+        (WebInspector.CookieItemsView.prototype._sortData.localeCompare):
+        (WebInspector.CookieItemsView.prototype._sortData.numberCompare):
+        (WebInspector.CookieItemsView.prototype._sortData.expiresCompare):
+        (WebInspector.CookieItemsView.prototype._sortData):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.showCookies):
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        (WebInspector.CookieSidebarTreeElement.prototype.get subtitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.set subtitle):
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
 
-2009-07-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-02-05  Maxime Simone  <simon.maxime@gmail.com>
 
         Reviewed by David Levin.
 
-        [Qt] Build fix after r46502
-        https://bugs.webkit.org/show_bug.cgi?id=27789
-
-        * WebCore.pro: Remove StorageArea.cpp
-
-2009-07-28  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Follow-on fix to r35582.  Replace main thread assertions with WebCoreObjCScheduleDeallocateOnMainThread
-        in -dealloc overrides in DOMObject subclasses.
-
-        * bindings/scripts/CodeGeneratorObjC.pm:
-
-2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        [WML] WML*Element classes mostly implement insertedIntoDocument(), not removedFromDocument()
-        https://bugs.webkit.org/show_bug.cgi?id=27786
-
-        WML*Element classes mostly implement insertedIntoDocument(), not removedFromDocument().
-        The only case where this is relevant in WML is error handling. The parsed WML
-        tree fragment is inserted in an XHTML compound error document. This requires
-        removedFromDocument() to be correctly implemented otherwhise we run into
-        trouble (visible when using run-webkit-tests fast/wml --random).
-
-        * wml/WMLAnchorElement.cpp:
-        (WebCore::WMLAnchorElement::registerTask):
-        (WebCore::WMLAnchorElement::deregisterTask):
-        * wml/WMLAnchorElement.h:
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::removedFromDocument):
-        (WebCore::WMLDoElement::registerTask):
-        (WebCore::WMLDoElement::deregisterTask):
-        * wml/WMLDoElement.h:
-        * wml/WMLEventHandlingElement.cpp:
-        (WebCore::WMLEventHandlingElement::registerDoElement):
-        (WebCore::WMLEventHandlingElement::deregisterDoElement):
-        * wml/WMLEventHandlingElement.h:
-        * wml/WMLFieldSetElement.cpp:
-        (WebCore::WMLFieldSetElement::removedFromDocument):
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::registerPostfieldElement):
-        (WebCore::WMLGoElement::deregisterPostfieldElement):
-        * wml/WMLGoElement.h:
-        * wml/WMLIntrinsicEventHandler.cpp:
-        (WebCore::WMLIntrinsicEventHandler::deregisterIntrinsicEvent):
-        * wml/WMLIntrinsicEventHandler.h:
-        * wml/WMLOnEventElement.cpp:
-        (WebCore::eventHandlingParent):
-        (WebCore::WMLOnEventElement::registerTask):
-        (WebCore::WMLOnEventElement::deregisterTask):
-        * wml/WMLOnEventElement.h:
-        * wml/WMLPostfieldElement.cpp:
-        (WebCore::WMLPostfieldElement::removedFromDocument):
-        * wml/WMLPostfieldElement.h:
-        * wml/WMLSetvarElement.cpp:
-        (WebCore::WMLSetvarElement::removedFromDocument):
-        * wml/WMLSetvarElement.h:
-        * wml/WMLTaskElement.cpp:
-        (WebCore::WMLTaskElement::removedFromDocument):
-        (WebCore::WMLTaskElement::registerVariableSetter):
-        (WebCore::WMLTaskElement::deregisterVariableSetter):
-        (WebCore::WMLTaskElement::storeVariableState):
-        * wml/WMLTaskElement.h:
-        * wml/WMLTimerElement.cpp:
-        (WebCore::WMLTimerElement::removedFromDocument):
-        * wml/WMLTimerElement.h:
-
-2009-07-28  David Levin  <levin@chromium.org>
-
-        Suggested by Drew Wilson.
-
-        Speculative gtk build fix, follow up to:
-        https://bugs.webkit.org/show_bug.cgi?id=27697
+        More robust conversion from BString to String for Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=34527
 
-        * GNUmakefile.am:
+        Covered by existing tests.
 
-2009-07-28  Dan Bernstein  <mitz@apple.com>
+        * platform/text/haiku/StringHaiku.cpp: Fixed include order, Improved coversion from BString.
 
-        Reviewed by Simon Fraser.
+2010-02-05  Steve Falkenburg  <sfalken@apple.com>
 
-        [CSS3 Backgrounds and Borders] Drop the prefix from the border-radius
-        properties
-        https://bugs.webkit.org/show_bug.cgi?id=27578
+        Reviewed by Adam Roben.
 
-        [CSS3 Backgrounds and Borders] Handle the / and 4 values in
-        border-radius
-        https://bugs.webkit.org/show_bug.cgi?id=27584
+        Windows build fix.
 
-        Test: fast/borders/border-radius-parsing.html
+        * WebCore.vcproj/WebCore.make:
 
-        Dropped the -webkit- prefix from the individual corner border-radius
-        properties. Added border-radius with the / and 4-value syntax, and
-        maintained -webkit-border-radius with legacy 2-value syntax.
+2010-02-05  Csaba Osztrogonác  <ossy@webkit.org>
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (computedProperties): Removed Webkit prefix.
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue): Removed Webkit prefix from the
-            single-corner properties. Call out to parseBorderRadius() to parse
-            border-radius and -webkit-border-radius. 
-        (WebCore::completeBorderRadii): Added this helper function that
-            completes the values for all four corners when fewer than four are
-            specified.
-        (WebCore::CSSParser::parseBorderRadius): Added.
-        (WebCore::cssPropertyID): Map -webkit-border-*-*-radius to the
-            unprefixed property.
-        * css/CSSParser.h:
-        * css/CSSPropertyLonghand.cpp:
-        (WebCore::initShorthandMap): Removed the Webkit prefix. Added an entry
-            for border-radius. Kept the entry for -webkit-border-radius.
-        * css/CSSPropertyNames.in: Removed the -webkit- prefix from the
-            single-corenr properties. Added border-radius. Kept
-            -webkit-border-radius because of its conflicting syntax.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty): Removed the Webkit prefix.
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap): Ditto.
+        Reviewed by Dirk Schulze.
+        Rubber-stamped by Kenneth Rohde Christiansen.
 
-2009-07-28  Drew Wilson  <atwilson@google.com>
+        [Qt] Modifying SVG path dumping to equal to other ports
+        https://bugs.webkit.org/show_bug.cgi?id=33784
 
-        Reviewed by David Levin.
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::debugString): Path dumping style is aproached to Mac.
 
-        Refactored dedicated-worker-specific code from WorkerThread into DedicatedWorkerThread class.
+2010-02-05  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
 
-        WorkerThread needs to be refactored to separate out dedicated-worker functionality.
-        https://bugs.webkit.org/show_bug.cgi?id=27697
+        Reviewed by Gustavo Noronha.
 
-        This is just a refactoring, so existing tests suffice.
+        Add a GStreamer HTTP/HTTPS source, using WebKit infrastructure
+        https://bugs.webkit.org/show_bug.cgi?id=34317
 
         * GNUmakefile.am:
-        Added DedicatedWorkerThread.h/.cpp
-        * WebCore.gypi:
-        Added DedicatedWorkerThread.h/.cpp
-        * WebCore.pro:
-        Added DedicatedWorkerThread.h/.cpp
-        * WebCore.vcproj/WebCore.vcproj:
-        Added DedicatedWorkerThread.h/.cpp
-        * WebCore.xcodeproj/project.pbxproj:
-        Added DedicatedWorkerThread.h/.cpp
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-        Removed code to track pending activity - this is handled by DedicatedWorkerContext::importScripts() now.
-        * bindings/v8/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-        Removed code to track pending activity - this is handled by DedicatedWorkerContext::importScripts() now.
-        * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
-        (WebCore::DedicatedWorkerContext::addMessage):
-        Forwards console messages to parent document.
-        (WebCore::DedicatedWorkerContext::importScripts):
-        Now sends the updated pending activity status after importing scripts.
-        (WebCore::DedicatedWorkerContext::thread):
-        Helper routine that casts WorkerThread to DedicatedWorkerThread.
-        * workers/DedicatedWorkerContext.h:
-        (WebCore::DedicatedWorkerContext::create):
-        * workers/DedicatedWorkerThread.cpp: Added.
-        (WebCore::DedicatedWorkerThread::create):
-        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
-        (WebCore::DedicatedWorkerThread::~DedicatedWorkerThread):
-        (WebCore::DedicatedWorkerThread::createWorkerContext):
-        Implementation of the base class factory method to create the appropriate worker context.
-        (WebCore::DedicatedWorkerThread::runEventLoop):
-        Reports pending activity before running the event loop.
-        * workers/DedicatedWorkerThread.h: Added.
-        (WebCore::DedicatedWorkerThread::workerObjectProxy):
-        Moved from base class.
-        * workers/WorkerContext.cpp:
-        * workers/WorkerContext.h:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::WorkerMessagingProxy::startWorkerContext):
-        Now creates DedicatedWorkerThread.
-        (WebCore::WorkerMessagingProxy::workerThreadCreated):
-        Now is passed a DedicatedWorkerThread.
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThread::WorkerThread):
-        Moved workerObjectProxy param into derived class constructor.
-        (WebCore::WorkerThread::workerThread):
-        (WebCore::WorkerThread::runEventLoop):
-        Moved the event loop execution into a virtual function so DedicatedWorkerThread could report pending activity first.
-        * workers/WorkerThread.h:
-        (WebCore::WorkerThread::workerContext):
-
-2009-07-28  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Fix V8NPUtils' handling of UTF8 identifiers.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27782
-
-        * bindings/v8/V8NPUtils.cpp:
-        (getStringIdentifier): Treat the input string as UTF8 instead of ASCII,
-            since NPN_GetStringIdentifier() is expecting UTF8.
-
-2009-07-28  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Misc cleanup in DOM Storage.
-        https://bugs.webkit.org/show_bug.cgi?id=27517
-
-        The StorageAreaImpl changes are all for Chromium.  Because the DOM Storage implementation
-        runs in a different process from where the Frame object lives, Chromium passes in NULL
-        for the sourceFrame.  This affects events and handling privateBrowsing.  Chromium's
-        incognito mode does not use the private browsing setting, so that's not a concern.  As for
-        events, I've decided to simply disable them for now.
-
-        The StorageNamespaceImpl changes get rid of a stale comment (path is .copy'ed for thread-
-        safety) and to add an assert that .copy is only ever called on a SessionStorage namespace.
-
-        Also cleaned up tailing whitespace in several parts of StorageAreaImpl.cpp
-
-        * storage/StorageArea.cpp: Removed.  (It was empty anyway.)
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::privateBrowsingEnabled): Factored out the check.
-        (WebCore::StorageAreaImpl::setItem): Make frame optional.
-        (WebCore::StorageAreaImpl::removeItem): ditto
-        (WebCore::StorageAreaImpl::clear): ditto
-        (WebCore::StorageAreaImpl::dispatchStorageEvent): Disable in Chromium for now.
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl): Remove stale comment.
-        (WebCore::StorageNamespaceImpl::copy): Add assert that it's SessionStorage.
-
-2009-07-28  Alpha Lam  <hclam@google.com>
-
-        Reviewed by David Levin.
-
-        [chromium] Default UI controls for <video> has rendering problems
-        https://bugs.webkit.org/show_bug.cgi?id=27669
-
-        Fixes the bug that <video> in MediaDocument is 1 pixel tall if
-        it is playing an audio file by changing the style to be 32px
-        tall.
-
-        Also fixes a problem of default styled audio tag that hides the
-        all the time digits by expanding the width to 300px.
-
-        Changed the size and position of the current time and remaining
-        display to give enough space for the hour digit to be shown.
-
-        There are no new tests provided because this is already covered
-        by existing tests.
-
-        * css/mediaControlsChromium.css:
-
-2009-07-28  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Fix style in PluginPackage and PluginDatabase.
-        Part of https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::refresh):
-        (WebCore::PluginDatabase::findPlugin):
-        * plugins/PluginDatabase.h:
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::~PluginPackage):
-        (WebCore::PluginPackage::freeLibrarySoon):
-        (WebCore::PluginPackage::freeLibraryTimerFired):
-        (WebCore::PluginPackage::unloadWithoutShutdown):
-        (WebCore::PluginPackage::initializeBrowserFuncs):
-        * plugins/PluginPackage.h:
-
-2009-07-28  Anantanarayanan Iyengar  <ananta@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27769
-        The V8 bindings function V8Proxy::createNewContext can be 
-        called during frame shutdown where the activeDocumentLoader
-        function in FrameLoader can return NULL. Added a check for the
-        same.
-
-        No new tests added as this is an edge case where the V8 
-        bindings code is reentered via NPAPI during shutdown. It is 
-        difficult to write a consistently reproducible test for this.
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::createNewContext):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        (WebCore::doGstInit):
+        * platform/graphics/gtk/WebKitWebSourceGStreamer.cpp:
+        * platform/graphics/gtk/WebKitWebSourceGStreamer.h:
+        Add a GStreamer HTTP/HTTPS source, using the WebKit infrastructure.
+        This makes sure that referer, cookies, authentication information
+        and all kinds of other context are passed to GStreamer for websites
+        like Vimeo or YouTube.
 
-2009-07-28  Ivan Posva  <iposva@chromium.org>
+2010-02-05  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Associate the CanvasPixelData backing store with the
-        indexed properties of the wrapper object.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27773
-
-        No new tests: Relying on existing Canvas tests.
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::convertToV8Object):
-
-2009-07-28  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        Nuke all references to JSWorkerContextBase.lut.h, it was removed
-        back in April.
-
-        * GNUmakefile.am:
+        [V8] Clean up code for getting a v8::FunctionTemplate.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34606
 
-2009-07-28  Robert Agoston  <Agoston.Robert@stud.u-szeged.hu>
+        * bindings/scripts/CodeGeneratorV8.pm: Making GetTemplate() public
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::configureTemplate):
+        * bindings/v8/V8DOMWrapper.cpp: Remove getTemplate(), use V8ClassIndex::getTemplate() instead.
+        (WebCore::V8DOMWrapper::getConstructor):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+        * bindings/v8/V8Index.cpp: Remove duplicate caching of FunctionTemplates.
+        (WebCore::V8ClassIndex::getTemplate):
+        * bindings/v8/V8Index.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::v8HTMLAudioElementConstructorCallback):
+        (WebCore::V8HTMLAudioElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.h:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.h:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::v8HTMLOptionElementConstructorCallback):
+        (WebCore::V8HTMLOptionElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::createInjectedScriptHostV8Wrapper):
 
-        Reviewed by Simon Hausmann.
+2010-02-05  Siddharth Mathur  <siddharth.mathur@nokia.com>
 
-        Fixed references to script generate-webkitversion.pl, and
-        removed duplicated generate-webkitversion.pl
+        Reviewed by Ariya Hidayat.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27158
+        [Qt] Build break in QtWebkit on Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=34597
 
-        * WebCore.pro:
-        * platform/generate-webkitversion.pl: Removed.
+        * plugins/PluginView.h:
 
-2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-05  Yury Semikhatsky  <yurys@chromium.org>
 
-        Reviewed by Dmitry Glazkov.
+        Reviewed by Pavel Feldman.
 
-        Web Inspector: encapsulate ScriptState into the ScriptObject, get rid of
-        InspectorJSONObject.
+        - Use SerializedScriptValue for passing data between injected script and
+        inspector frontend.
+        - Remove custom JSON implementation from the instpector utility script.
+        - Make sure that only objects created in the same ScriptState can be values
+        of ScriptObject/Array properties and arguments to ScriptFunctionCall. We don't
+        want ScriptObjects to leak between contexts.
+        - Use ScriptState of the 'this' object in ScriptFunctionCall instead of passing
+        it as additional parameter.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27766
+        https://bugs.webkit.org/show_bug.cgi?id=33592
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::reportDidDispatchOnInjectedScript):
         * bindings/js/ScriptArray.cpp:
-        (WebCore::ScriptArray::ScriptArray):
         (WebCore::ScriptArray::set):
-        (WebCore::ScriptArray::length):
-        (WebCore::ScriptArray::createNew):
-        * bindings/js/ScriptArray.h:
         * bindings/js/ScriptFunctionCall.cpp:
-        (WebCore::ScriptFunctionCall::construct):
+        (WebCore::ScriptFunctionCall::ScriptFunctionCall):
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/js/ScriptFunctionCall.h:
         * bindings/js/ScriptObject.cpp:
-        (WebCore::ScriptObject::ScriptObject):
         (WebCore::ScriptObject::set):
-        (WebCore::ScriptObject::createNew):
-        (WebCore::ScriptGlobalObject::get):
-        * bindings/js/ScriptObject.h:
-        * bindings/js/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::serialize):
+        (WebCore::ScriptValue::deserialize):
+        * bindings/js/ScriptValue.h:
         * bindings/v8/ScriptArray.cpp:
-        (WebCore::ScriptArray::ScriptArray):
         (WebCore::ScriptArray::set):
-        (WebCore::ScriptArray::length):
-        (WebCore::ScriptArray::createNew):
-        * bindings/v8/ScriptArray.h:
         * bindings/v8/ScriptFunctionCall.cpp:
-        (WebCore::ScriptFunctionCall::construct):
+        (WebCore::ScriptFunctionCall::ScriptFunctionCall):
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/v8/ScriptFunctionCall.h:
         * bindings/v8/ScriptObject.cpp:
-        (WebCore::ScriptObject::ScriptObject):
         (WebCore::ScriptObject::set):
-        (WebCore::ScriptObject::createNew):
-        (WebCore::ScriptGlobalObject::get):
-        * bindings/v8/ScriptObject.h:
-        (WebCore::ScriptObject::ScriptObject):
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * inspector/ConsoleMessage.cpp:
-        (WebCore::ConsoleMessage::addToConsole):
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::bind):
-        * inspector/InspectorDatabaseResource.cpp:
-        (WebCore::InspectorDatabaseResource::bind):
+        * bindings/v8/ScriptState.h:
+        * bindings/v8/ScriptValue.cpp:
+        (WebCore::ScriptValue::serialize):
+        (WebCore::deserialize):
+        * bindings/v8/ScriptValue.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::reportDidDispatchOnInjectedScriptCallback):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::dispatch):
+        (WebCore::InjectedScript::callFrames):
+        (WebCore::InjectedScript::wrapForConsole):
+        (WebCore::InjectedScript::releaseWrapperObjectGroup):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::reportDidDispatchOnInjectedScript):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::didEvaluateForTestInFrontend):
         * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::InspectorFrontend):
         (WebCore::InspectorFrontend::newScriptArray):
         (WebCore::InspectorFrontend::newScriptObject):
-        (WebCore::InspectorFrontend::addMessageToConsole):
-        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::populateFrontendSettings):
+        (WebCore::InspectorFrontend::updateConsoleMessageExpiredCount):
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount):
         (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::didGetResourceContent):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setAttachedWindow):
+        (WebCore::InspectorFrontend::addRecordToTimeline):
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::setRecordingProfile):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::setDocument):
+        (WebCore::InspectorFrontend::setDetachedRoot):
+        (WebCore::InspectorFrontend::setChildNodes):
+        (WebCore::InspectorFrontend::childNodeCountUpdated):
+        (WebCore::InspectorFrontend::childNodeInserted):
+        (WebCore::InspectorFrontend::childNodeRemoved):
+        (WebCore::InspectorFrontend::attributesUpdated):
+        (WebCore::InspectorFrontend::didRemoveNode):
+        (WebCore::InspectorFrontend::didGetChildNodes):
+        (WebCore::InspectorFrontend::didApplyDomChange):
+        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        (WebCore::InspectorFrontend::didGetCookies):
+        (WebCore::InspectorFrontend::didDispatchOnInjectedScript):
         (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
         (WebCore::InspectorFrontend::addDOMStorage):
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
+        (WebCore::InspectorFrontend::didSetDOMStorageItem):
+        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
+        (WebCore::InspectorFrontend::updateDOMStorage):
+        (WebCore::InspectorFrontend::addNodesToSearchResult):
+        (WebCore::InspectorFrontend::contextMenuItemSelected):
+        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        (WebCore::InspectorFrontend::callSimpleFunction):
         * inspector/InspectorFrontend.h:
-        * inspector/InspectorJSONObject.cpp: Removed.
-        * inspector/InspectorJSONObject.h: Removed.
-        * inspector/InspectorResource.cpp:
-        (WebCore::populateHeadersObject):
-        (WebCore::InspectorResource::createScriptObject):
-        (WebCore::InspectorResource::updateScriptObject):
-
-2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] Variable substitution recursion seems to have bugs
-        https://bugs.webkit.org/show_bug.cgi?id=27726
-
-        Allow <setvar> elements to depend on the value specified by preceeding <setvar> elements.
-        Required by the specification - assure it only works in linear order. A setvar element may
-        not depend on the variable state of a following setvar element, only the previous ones.
-
-        Extend wml/variable-reference-valid.html layout test to cover these cases.
-
-        * wml/WMLTaskElement.cpp:
-        (WebCore::WMLTaskElement::storeVariableState):
-
-2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] Page title doesn't update after variable substitution, if it contained variables
-        https://bugs.webkit.org/show_bug.cgi?id=27725
-
-        Fix bug in containsVariableReference() function, we we're decreasing the nameEndPosition
-        too much, leading to a bug with 1-char variable names, which were not detected properly.
-
-        Extend wml/variable-reference-valid.html layout test to cover 1-char variable names.
-        Also fixes manual-tests/wml/task-refresh-in-anchor.wml, which happened to use 1-char variable names.
-
-        * wml/WMLVariables.cpp:
-        (WebCore::containsVariableReference):
-
-2009-07-28  Robert Hogan  <robert@roberthogan.net>
-
-        Reviewed by Simon Hausmann.
-
-        Add WebKit version API to Qt.
-
-        Get the current version of WebKit from WebKit/mac/Configurations/Version.xcconfig
-        at compile time and make it available to webkit ports through WebKitVersion.h.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27158
-
-        * WebCore.pro: Call generate-webkitversion.pl
-
-2009-07-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Unreviewed make dist build fix.
-
-        * GNUmakefile.am:
-
-2009-07-28  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Replace hardcoded separator text with proper separator.
-        Also adjusts include order as per style guidelines.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27763
-
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::populate):
-
-2009-07-28  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Steve Falkenburg.
-
-        Add output directory for VS pre-build steps to enable out-of-tree builds
-
-        https://bugs.webkit.org/show_bug.cgi?id=27700
-
-        The tmp.obj file is now placed in the intermediate build directory.
-
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-
-2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Add inspected node using public console API.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27758
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype.addInspectedNode):
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
-        (WebInspector.ElementsPanel):
-
-2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] <do> elements with a <noop> task shouldn't be exposed to the user
-        https://bugs.webkit.org/show_bug.cgi?id=27724
-
-        Fix WMLNoopElement to disable it's parent WMLDoElement, as required by the spec.
-        Moved manual-tests/wml/task-noop-in-do.wml to LayoutTests/fast/wml/task-noop-in-do.wml.
-
-        * manual-tests/wml/task-noop-in-do.wml: Removed.
-        * wml/WMLNoopElement.cpp:
-        (WebCore::WMLNoopElement::insertedIntoDocument):
-
-2009-07-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Disable some compiler warnings for the win build
-        https://bugs.webkit.org/show_bug.cgi?id=27709
-
-        * WebCore.pro: Move the msvc options to WebKit.pri
-
-2009-07-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Tor Arne Vestbø
-
-        Make equality checks for logging channel names ignore casing.
-
-        * platform/Logging.cpp:
-        (WebCore::getChannelFromName):
-
-2009-07-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Xan Lopez.
-
-        [Gtk] Refactor ResourceHandleSoup - make start* functions static
-        https://bugs.webkit.org/show_bug.cgi?id=27687
-
-        * platform/network/ResourceHandle.h:
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::startData):
-        (WebCore::startHttp):
-        (WebCore::):
-
-2009-07-28  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25415
-        [GTK][ATK] Please implement support for get_text_at_offset
-
-        Do not cache the pango layout in the object, since the layout of
-        the page can change between calls.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-
-2009-07-23  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Simplify management of Nodes in weak handles callbacks.
-        https://bugs.webkit.org/show_bug.cgi?id=27628
-
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::weakNodeCallback):
-
-2009-07-28  Brian Weinstein  <bweinstein@apple.com>
-
-        Rubber-stamped by David Levin.
-
-        Fix error handling of GetIconInfo (returns a bool).
-
-        * platform/win/DragImageWin.cpp:
-        (WebCore::createDragImageIconForCachedImage):
-
-2009-07-27  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        Fix of <rdar://5015949> Drag Icon is not produced for over sized images.
-        
-        Implemented the createDragImageIconForCachedImage function by using the Windows 
-        SHFILEINFO structure.
-
-        * platform/win/DragImageWin.cpp:
-        (WebCore::createDragImageIconForCachedImage):
-
-2009-07-25  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by David Levin.
-
-        [V8] Split up V8DOMMap.cpp by class
-        https://bugs.webkit.org/show_bug.cgi?id=27685
-
-        No behavior change.  Just copy-and-paste.
-
-        * WebCore.gypi:
-        * bindings/v8/ChildThreadDOMData.cpp: Added.
-        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
-        (WebCore::ChildThreadDOMData::getStore):
-        * bindings/v8/ChildThreadDOMData.h: Added.
-        * bindings/v8/DOMData.cpp: Added.
-        (WebCore::DOMData::DOMData):
-        (WebCore::DOMData::getCurrent):
-        (WebCore::DOMData::getCurrentMainThread):
-        (WebCore::DOMData::handleWeakObject):
-        (WebCore::DOMData::ensureDeref):
-        (WebCore::DOMData::derefObject):
-        (WebCore::DOMData::derefDelayedObjects):
-        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
-        (WebCore::DOMData::removeObjectsFromWrapperMap):
-        * bindings/v8/DOMData.h: Added.
-        (WebCore::):
-        * bindings/v8/DOMDataStore.cpp: Added.
-        (WebCore::DOMDataStore::DOMDataStore):
-        (WebCore::DOMDataStore::~DOMDataStore):
-        (WebCore::DOMDataStore::allStores):
-        (WebCore::DOMDataStore::allStoresMutex):
-        (WebCore::DOMDataStore::getDOMWrapperMap):
-        (WebCore::forget):
-        (WebCore::DOMDataStore::weakDOMObjectCallback):
-        (WebCore::DOMDataStore::weakActiveDOMObjectCallback):
-        (WebCore::DOMDataStore::weakNodeCallback):
-        (WebCore::DOMDataStore::weakSVGElementInstanceCallback):
-        (WebCore::DOMDataStore::weakSVGObjectWithContextCallback):
-        * bindings/v8/DOMDataStore.h: Added.
-        (WebCore::DOMDataStore::):
-        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
-        (WebCore::DOMDataStore::InternalDOMWrapperMap::forgetOnly):
-        (WebCore::DOMDataStore::domData):
-        (WebCore::DOMDataStore::domNodeMap):
-        (WebCore::DOMDataStore::domObjectMap):
-        (WebCore::DOMDataStore::activeDomObjectMap):
-        (WebCore::DOMDataStore::domSvgElementInstanceMap):
-        (WebCore::DOMDataStore::domSvgObjectWithContextMap):
-        * bindings/v8/MainThreadDOMData.cpp: Added.
-        (WebCore::MainThreadDOMData::MainThreadDOMData):
-        (WebCore::MainThreadDOMData::getStore):
-        * bindings/v8/MainThreadDOMData.h: Added.
-        * bindings/v8/ScopedDOMDataStore.cpp: Added.
-        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
-        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
-        * bindings/v8/ScopedDOMDataStore.h: Added.
-        * bindings/v8/StaticDOMDataStore.cpp: Added.
-        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
-        * bindings/v8/StaticDOMDataStore.h: Added.
-        * bindings/v8/V8DOMMap.cpp:
-
-2009-07-27  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/7091036> REGRESSION: Microsoft Messenger crashes during file send/receive due to use of WebKit on non-main thread
-
-        Add a method for detecting if we're being used within Microsoft Messenger.
-
-        * WebCore.base.exp: Export applicationIsMicrosoftMessenger and sort existing entries.
-        * platform/mac/RuntimeApplicationChecks.h:
-        * platform/mac/RuntimeApplicationChecks.mm:
-        (WebCore::applicationIsMicrosoftMessenger):
-
-2009-07-27  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Implement EventListener::reportError for V8 event listeners in worker context. 
-        https://bugs.webkit.org/show_bug.cgi?id=27731
-
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::reportError):
-        * bindings/v8/V8WorkerContextEventListener.h:
-
-2009-07-27  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Eric Seidel and David Levin.
-
-        Re-apply chromium/skia border fix (originally landed in r46157,
-        reverted in r46363), since it was not the cause of the reliability
-        failures in Chromium.
-
-        http://bugs.webkit.org/show_bug.cgi?id=27388
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawLine):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintForStroking):
-
-2009-07-27  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Justin Garcia.
-
-        createMarkup does not handle CSS properly
-        https://bugs.webkit.org/show_bug.cgi?id=27660
-
-        This patch isolates code that creates markup for styles in addStyleMarkup
-        It also makes all presentational elements (u, s, strike, i, em, b, strong) special ancestor in createMarkup
-        so that we can assume no text decoration style is passed to addStyleMarkup.
-
-        * editing/markup.cpp:
-        (WebCore::propertyMissingOrEqualToNone): Changed the first argument from CSSMutableStyleDecleration to CSSStyleDeclaration
-        (WebCore::isElementPresentational): Used to be elementHasTextDecorationProperty, now supports presentational tags
-        (WebCore::addStyleMarkup): Adds markup for style span and div
-        (WebCore::createMarkup): Uses isElementPresentational and addStyleMarkup
-
-2009-07-27  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        fix more obvious global object lookups
-        https://bugs.webkit.org/show_bug.cgi?id=27745
-
-        No new tests for these changes.  I believe in many cases
-        testing to be impossible.  Lack of testing justification next to
-        each change below.  The remaining pieces of bug 27634 will all
-        need tests.
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::updateDocument): not testable.
-        * bindings/js/JSDataGridColumnListCustom.cpp:
-        (WebCore::JSDataGridColumnList::nameGetter): no testing for this incomplete feature.
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::handleEvent): would require outer frame to trigger an event in the inner frame
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS): covered by other tests, always correct to pass the globalObject through.
-        * bindings/js/JSHTMLElementCustom.cpp:
-        (WebCore::JSHTMLElement::pushEventHandlerScope): unclear when this could be triggered.
-        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
-        (WebCore::JSHTMLOptionsCollection::remove): toJS seems superfluous here to begin with.
-        * bindings/js/JSLazyEventListener.cpp:
-        (WebCore::JSLazyEventListener::parseCode): would require outer frame to trigger inner frame event.
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::jsObjectForPluginElement): only used for NPAPI binding, unclear how to test.
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener): unclear how to test.
-        * bindings/js/ScriptObject.cpp:
-        (WebCore::ScriptGlobalObject::set): unclear how to test/inspector only.
-        * bindings/js/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject): unclear how to test.
-        * bindings/objc/DOMInternal.mm:
-        (-[WebScriptObject _initializeScriptDOMNodeImp]): unclear how to test.
-
-2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] 'title' attribute handling not correct for <a> / <anchor> elements
-        https://bugs.webkit.org/show_bug.cgi?id=27720
-
-        Unify title() implementation in WMLElement instead of several copies of the same logic.
-        We forgot WMLAnchorElement/WMLAElement, that lead to bugs. Fixes hovering links in the
-        WML manual-test suite.
-
-        * wml/WMLCardElement.cpp:
-        * wml/WMLCardElement.h:
-        * wml/WMLElement.cpp:
-        (WebCore::WMLElement::title):
-        * wml/WMLElement.h:
-        * wml/WMLOptGroupElement.cpp:
-        * wml/WMLOptGroupElement.h:
-        * wml/WMLSelectElement.cpp:
-        * wml/WMLSelectElement.h:
-
-2009-07-27  Adam Treat  <adam.treat@torchmobile.com>
-
-        Speculative build fix for Windows and WinCE.
-
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::load):
-
-2009-07-27  Ojan Vafai  <ojan@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27474
-        Fixes crashes due to renderer getting destroyed in updateLayout.
-        We need to call updateLayout before we call into the renderer.
-        Removed the updateLayout call from RenderTextControl and moved it
-        into the calling sites.
-        
-        Also changes updateLayout to updateLayoutIgnorePendingStylesheets so
-        this works with pending stylesheets. Unfortunately, this seems to be
-        untestable. Loading an external stylesheet and then having an inline
-        script hit this code did not result in an pending stylesheets.
-        
-        The are other cases of this bug in the rendering code. I'll file a 
-        followup bug to audit the calls to updateLayout.
-
-        Test: fast/dom/text-control-crash-on-select.html
-
-        * dom/Document.h:
-        (WebCore::Document::inStyleRecalc): Added so the ASSERTs in updateFocusAppearance
-            and setSelectionRange could deal with cases of reentrancy into updateLayout
-            calls. This happens in a couple layout tests.
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::updateSelectionRange):
-        * html/HTMLInputElement.cpp:
-        (WebCore::isTextFieldWithRendererAfterUpdateLayout):
-        (WebCore::HTMLInputElement::setSelectionStart):
-        (WebCore::HTMLInputElement::setSelectionEnd):
-        (WebCore::HTMLInputElement::select):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::rendererAfterUpdateLayout):
-        (WebCore::HTMLTextAreaElement::setSelectionStart):
-        (WebCore::HTMLTextAreaElement::setSelectionEnd):
-        (WebCore::HTMLTextAreaElement::select):
-        (WebCore::HTMLTextAreaElement::setSelectionRange):
-        (WebCore::HTMLTextAreaElement::updateFocusAppearance):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::setSelectionRange):
-
-2009-07-27  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Dave Levin.
-
-        [V8] Remove parameterless frame/window retrieval methods from V8Proxy.
-        https://bugs.webkit.org/show_bug.cgi?id=27737
-
-        Refactoring, no new behavior, covered by existing tests.
-
-        * bindings/v8/ScriptCallStack.cpp:
-        (WebCore::ScriptCallStack::ScriptCallStack):
-        * bindings/v8/V8NPUtils.cpp:
-        (convertV8ObjectToNPVariant): Ditto.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::retrieve): Ditto.
-        (WebCore::V8Proxy::canAccessPrivate): Ditto.
-        * bindings/v8/V8Proxy.h: Removed parameterless retrieveWindow/retrieveProxy decls.
-        * bindings/v8/custom/V8DatabaseCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Changed to use V8Proxy::retrieveFrameForCurrentContext().
-        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-
-2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] 'onpick' intrinsic event handling missing
-        https://bugs.webkit.org/show_bug.cgi?id=27723
-
-        Trigger 'onpick' intrinsic events from WMLOptionElement::setSelectedState().
-        All was in place, just forgot to enable the relevant code.
-
-        Fixes manual-tests/wml/select-onpick-event.wml
-        Test: wml/option-element-onpick.html
-
-        * wml/WMLOptionElement.cpp:
-        (WebCore::WMLOptionElement::setSelectedState):
-
-2009-07-27  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27735
-        Give a helpful name to JSLock constructor argument
-
-        * bindings/js/GCController.cpp:
-        (WebCore::collect):
-        (WebCore::GCController::gcTimerFired):
-        (WebCore::GCController::garbageCollectNow):
-        * bindings/js/JSCustomPositionCallback.cpp:
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.cpp:
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSCustomVoidCallback.cpp:
-        (WebCore::JSCustomVoidCallback::handleEvent):
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::handleEvent):
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::currentCallFrame):
-        (WebCore::JSInspectorBackend::profiles):
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::acceptNode):
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::executeFunctionInContext):
-        * bindings/js/ScriptArray.cpp:
-        (WebCore::ScriptArray::set):
-        (WebCore::ScriptArray::createNew):
-        * bindings/js/ScriptCachedFrameData.cpp:
-        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
-        (WebCore::ScriptCachedFrameData::restore):
-        (WebCore::ScriptCachedFrameData::clear):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        (WebCore::ScriptController::clearWindowShell):
-        (WebCore::ScriptController::initScript):
-        (WebCore::ScriptController::updateDocument):
-        (WebCore::ScriptController::bindingRootObject):
-        (WebCore::ScriptController::windowScriptNPObject):
-        (WebCore::ScriptController::jsObjectForPluginElement):
-        (WebCore::ScriptController::clearScriptObjects):
-        * bindings/js/ScriptControllerMac.mm:
-        (WebCore::ScriptController::windowScriptObject):
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
-        * bindings/js/ScriptFunctionCall.cpp:
-        (WebCore::ScriptFunctionCall::appendArgument):
-        (WebCore::ScriptFunctionCall::call):
-        (WebCore::ScriptFunctionCall::construct):
-        * bindings/js/ScriptObject.cpp:
-        (WebCore::ScriptObject::set):
-        (WebCore::ScriptObject::createNew):
-        (WebCore::ScriptGlobalObject::set):
-        (WebCore::ScriptGlobalObject::get):
-        (WebCore::ScriptGlobalObject::remove):
-        * bindings/js/ScriptObjectQuarantine.cpp:
-        (WebCore::quarantineValue):
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/js/ScriptValue.cpp:
-        (WebCore::ScriptValue::getString):
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::initScript):
-        (WebCore::WorkerScriptController::evaluate):
-        * bindings/objc/WebScriptObject.mm:
-        (-[WebScriptObject callWebScriptMethod:withArguments:]):
-        (-[WebScriptObject evaluateWebScript:]):
-        (-[WebScriptObject setValue:forKey:]):
-        (-[WebScriptObject valueForKey:]):
-        (-[WebScriptObject removeWebScriptKey:]):
-        (-[WebScriptObject stringRepresentation]):
-        (-[WebScriptObject webScriptValueAtIndex:]):
-        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
-        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
-        * bridge/NP_jsobject.cpp:
-        (_NPN_InvokeDefault):
-        (_NPN_Invoke):
-        (_NPN_Evaluate):
-        (_NPN_GetProperty):
-        (_NPN_SetProperty):
-        (_NPN_RemoveProperty):
-        (_NPN_HasProperty):
-        (_NPN_HasMethod):
-        (_NPN_Enumerate):
-        (_NPN_Construct):
-        * bridge/c/c_class.cpp:
-        (JSC::Bindings::CClass::~CClass):
-        (JSC::Bindings::CClass::methodsNamed):
-        (JSC::Bindings::CClass::fieldNamed):
-        * bridge/c/c_instance.cpp:
-        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
-        (JSC::Bindings::CInstance::invokeMethod):
-        (JSC::Bindings::CInstance::invokeDefaultMethod):
-        (JSC::Bindings::CInstance::invokeConstruct):
-        (JSC::Bindings::CInstance::getPropertyNames):
-        * bridge/c/c_runtime.cpp:
-        (JSC::Bindings::CField::valueFromInstance):
-        (JSC::Bindings::CField::setValueToInstance):
-        * bridge/c/c_utility.cpp:
-        (JSC::Bindings::convertValueToNPVariant):
-        (JSC::Bindings::convertNPVariantToValue):
-        * bridge/jni/jni_class.cpp:
-        (JavaClass::JavaClass):
-        (JavaClass::~JavaClass):
-        * bridge/jni/jni_instance.cpp:
-        (JavaInstance::stringValue):
-        * bridge/jni/jni_jsobject.mm:
-        (JavaJSObject::call):
-        (JavaJSObject::eval):
-        (JavaJSObject::getMember):
-        (JavaJSObject::setMember):
-        (JavaJSObject::removeMember):
-        (JavaJSObject::getSlot):
-        (JavaJSObject::setSlot):
-        (JavaJSObject::toString):
-        (JavaJSObject::convertValueToJObject):
-        (JavaJSObject::convertJObjectToValue):
-        * bridge/jni/jni_objc.mm:
-        (JSC::Bindings::dispatchJNICall):
-        * bridge/jni/jni_runtime.cpp:
-        (JavaMethod::signature):
-        * bridge/jni/jni_runtime.h:
-        (JSC::Bindings::JavaString::JavaString):
-        (JSC::Bindings::JavaString::_commonInit):
-        (JSC::Bindings::JavaString::~JavaString):
-        (JSC::Bindings::JavaString::UTF8String):
-        * bridge/jni/jni_utility.cpp:
-        (JSC::Bindings::convertValueToJValue):
-        * bridge/objc/objc_instance.mm:
-        (ObjcInstance::moveGlobalExceptionToExecState):
-        (ObjcInstance::invokeMethod):
-        (ObjcInstance::invokeDefaultMethod):
-        (ObjcInstance::setValueOfUndefinedField):
-        (ObjcInstance::getValueOfUndefinedField):
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::ObjcField::valueFromInstance):
-        (JSC::Bindings::ObjcField::setValueToInstance):
-        * bridge/objc/objc_utility.mm:
-        (JSC::Bindings::convertValueToObjcValue):
-        (JSC::Bindings::convertNSStringToString):
-        (JSC::Bindings::convertObjcValueToValue):
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtRuntimeObjectImp::removeFromCache):
-        (JSC::Bindings::QtInstance::~QtInstance):
-        (JSC::Bindings::QtInstance::getQtInstance):
-        (JSC::Bindings::QtInstance::createRuntimeObject):
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertValueToQVariant):
-        (JSC::Bindings::convertQVariantToValue):
-        (JSC::Bindings::QtRuntimeMetaMethod::call):
-        (JSC::Bindings::QtRuntimeConnectionMethod::call):
-        (JSC::Bindings::QtConnectionObject::execute):
-        * bridge/runtime.cpp:
-        (JSC::Bindings::Instance::createRuntimeObject):
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addScriptProfile):
-        * inspector/JavaScriptCallFrame.cpp:
-        (WebCore::JavaScriptCallFrame::evaluate):
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::getTotalTime):
-        (WebCore::getSelfTime):
-        (WebCore::getTotalPercent):
-        (WebCore::getSelfPercent):
-        (WebCore::getNumberOfCalls):
-        (WebCore::getChildren):
-        (WebCore::getParent):
-        (WebCore::getHead):
-        (WebCore::getVisible):
-        (WebCore::getCallUID):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
-        (WebCore::getString):
-        (WebCore::PluginView::performRequest):
-        (WebCore::PluginView::bindingInstance):
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::dispatchNPEvent):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::init):
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::dispatchNPEvent):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::init):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::dispatchNPEvent):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::stop):
-
-2009-07-27  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        WINCE PORT: Make plugin work for WINCE
-        https://bugs.webkit.org/show_bug.cgi?id=27713
-
-        * plugins/win/PluginDatabaseWin.cpp:
-        (SHGetValue):
-        (PathRemoveFileSpec):
-        (WebCore::addWindowsMediaPlayerPluginDirectory):
-        (WebCore::addMacromediaPluginDirectories):
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::load):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::registerPluginView):
-        (WebCore::PluginView::wndProc):
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paintWindowedPluginIntoContext):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setParent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::init):
-
-2009-07-27  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Inspector: Tab Through Element Attributes and CSS Properties When Editing
-
-        https://bugs.webkit.org/show_bug.cgi?id=27673
-
-        Reviewed by Timothy Hatcher.
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement):
-        (WebInspector.ElementsTreeElement.prototype._startEditing): refactored parameter
-        (WebInspector.ElementsTreeElement.prototype._addNewAttribute): refactored to remove excess
-        (WebInspector.ElementsTreeElement.prototype._triggerEditAttribute): provide an attribute name and this will start editing it
-        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted.moveToNextAttributeIfNeeded): move between attributes
-        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertiesSection.prototype.onpopulate):
-        (WebInspector.StylePropertiesSection.prototype.findTreeElementWithName): search through treeElements for a style property name
-        (WebInspector.StylePropertiesSection.prototype.addNewBlankProperty): initialize a blank property for adding new properties
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle): add references to the name and value elements
-        (WebInspector.StylePropertyTreeElement.prototype.):
-        (WebInspector.StylePropertyTreeElement.prototype):
+        (WebCore::InspectorFrontend::scriptState):
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        (injectedScriptConstructor.):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.prototype.methodName.myCallback):
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.prototype.methodName):
+        (InjectedScriptAccess._installHandler):
         * inspector/front-end/inspector.js:
-        (WebInspector.startEditing.editingCommitted): include the move direction as a parameter to the commit callback
-        (WebInspector.startEditing.element.handleKeyEvent): handle the tab key to specify the move direction
-        (WebInspector.startEditing):
-
-2009-07-27  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Add mapping FontWeight to QFont::Weight values as requested via FIXME.
-        https://bugs.webkit.org/show_bug.cgi?id=27663
-
-        * platform/graphics/qt/FontCacheQt.cpp:
-        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
-        * platform/graphics/qt/FontPlatformData.h:
-        (WebCore::FontPlatformData::toQFontWeight):
-        * platform/graphics/qt/FontPlatformDataQt.cpp:
-        (WebCore::FontPlatformData::FontPlatformData):
-
-2009-07-27  Jakub Wieczorek  <faw217@gmail.com>
-
-         Reviewed by Adam Treat.
-
-         When clearing the plugin database, clear also the timestamp map.
-
-         https://bugs.webkit.org/show_bug.cgi?id=27651
-
-         Currently, if we clear the database, it will still think that it is up
-         to date with the plugin directories so refreshing the database again
-         after changing the search paths may not work.
-
-         * plugins/PluginDatabase.cpp:
-         (WebCore::PluginDatabase::clear):
-
-2009-07-27  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by David Levin.
-
-        Add in trivial implementation of FontPlatformData::description() for
-        linux to fix build bustage in chromium.
-
-        Fix chromium linux build by adding missing function implementation.
-        https://bugs.webkit.org/show_bug.cgi?id=27732
-
-        Tested with a build of chromium on linux.
-
-        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
-        (WebCore::FontPlatformData::description):
-        * platform/graphics/chromium/FontPlatformDataLinux.h:
-
-2009-07-27  Brent Fulgham  <bfulgham@webkit.org>
-
-        Build correct, no review.
-
-        Final correction for WinCairo builds.
-        CoreServices only exists in Apple builds, but
-        some of its internal includes (e.g., <windows.h>) are needed
-        for other Windows targets.
-
-        * WebCorePrefix.h: When building for WinCairo, make sure
-          to include <windows.h>, <stdio.h>, and <ConditionalMacros.h>
-
-2009-07-27  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25552
-        Added new "pattern" attribute to HTMLInputElement and validation code
-        (validity.patternMismatch) as per HTML5 specs.
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#attr-input-pattern
-
-        Tests: fast/forms/ValidityState-002.html
-               fast/forms/ValidityState-patternMismatch-001.html
-               fast/forms/ValidityState-patternMismatch-002.html
-               fast/forms/ValidityState-patternMismatch-003.html
-               fast/forms/ValidityState-patternMismatch-004.html
-               fast/forms/ValidityState-patternMismatch-005.html
-               fast/forms/ValidityState-patternMismatch-006.html
-               fast/forms/ValidityState-patternMismatch-007.html
-               fast/forms/pattern-attribute-001.html
-               fast/forms/pattern-attribute-002.html
-               fast/forms/pattern-attribute-003.html
-
-        * html/HTMLAttributeNames.in: pattern attribute
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::patternMismatch): method definition
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::patternMismatch): validation method
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-        * html/ValidityState.h:
-        (WebCore::ValidityState::patternMismatch): validation flag
-
-2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] Manual WML tests aren't properly working
-        https://bugs.webkit.org/show_bug.cgi?id=27718
-
-        Fix file paths in the manual WML layout tests, remove unneeded tests (already covered by DRT tests).
-        Add missing resources directory and test image. Reformat all testcases to a common style.
-        Add new StartTests.wml file, which should be used as starting point to crawl through the manual tests.
-
-        Filing bugs soon for all tests exposing bugs (7 in total).
-
-        * manual-tests/wml/StartTests.wml: Added.
-        * manual-tests/wml/a-br-element.wml:
-        * manual-tests/wml/a-element.wml:
-        * manual-tests/wml/a-img-element.wml:
-        * manual-tests/wml/access-target.wml:
-        * manual-tests/wml/anchor-br-element.wml:
-        * manual-tests/wml/anchor-element.wml:
-        * manual-tests/wml/anchor-img-element.wml:
-        * manual-tests/wml/card-newcontext-attr.wml:
-        * manual-tests/wml/card-onenterbackward.wml:
-        * manual-tests/wml/card-onenterforward.wml:
-        * manual-tests/wml/card-ontimer.wml:
-        * manual-tests/wml/card-title-attr.wml: Removed.
-        * manual-tests/wml/deck-access-control.wml:
-        * manual-tests/wml/go-element.wml: Removed.
-        * manual-tests/wml/input-emptyok.wml: Removed.
-        * manual-tests/wml/input-format.wml:
-        * manual-tests/wml/onevent-go.wml:
-        * manual-tests/wml/onevent-noop.wml:
-        * manual-tests/wml/onevent-prev.wml:
-        * manual-tests/wml/onevent-refresh.wml:
-        * manual-tests/wml/onevent-shadow.wml:
-        * manual-tests/wml/postfield-get.wml: Removed.
-        * manual-tests/wml/postfield-post.wml: Removed.
-        * manual-tests/wml/resources: Added.
-        * manual-tests/wml/resources/smiley.png: Added.
-        * manual-tests/wml/select-element.wml:
-        * manual-tests/wml/select-onpick-event.wml:
-        * manual-tests/wml/setvar-element.wml:
-        * manual-tests/wml/targetdeck.wml:
-        * manual-tests/wml/task-go-in-anchor.wml:
-        * manual-tests/wml/task-noop-in-do.wml:
-        * manual-tests/wml/task-noop-in-onevent.wml: Removed.
-        * manual-tests/wml/task-prev-in-anchor.wml:
-        * manual-tests/wml/task-refresh-in-anchor.wml:
-        * manual-tests/wml/template-go.wml:
-        * manual-tests/wml/template-onevent.wml: Removed.
-        * manual-tests/wml/template-ontimer.wml:
-        * manual-tests/wml/timer.wml:
-        * manual-tests/wml/variable-substitution.wml:
-
-2009-07-27  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix a regression introduced in r42671, which caused the js event 
-        object to be hidden (some websites depend on being able to access it).
-
-        https://bugs.webkit.org/show_bug.cgi?id=27719
-
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler): Make the event object visible to javascript, instead of hidden.
-
-2009-07-27  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Removing a no-op block of code in DatabaseTracker.cpp that
-        should've been removed in the patch for bug 26054.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27666
-
-        All tests in WebCore/storage pass.
-
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::fullPathForDatabase): Removed a no-op
-        block of code that was moved to SQLiteFileSystem.cpp and should
-        have been removed from DatabaseTracker.cpp
-
-2009-07-27  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        Fix error handling in dedicated worker and worker context.
-        https://bugs.webkit.org/show_bug.cgi?id=27525
-
-        The following problems have been fixed:
-        1) The uncaught runtime script error is not reported using the
-        WorkerGlobalScope object's onerror attribute.
-        2) If the error is still not handled afterwards (onerror attribute
-        is not defined as a function or it returns true), the error should
-        be reported back to the associated Worker object by firing an
-        ErrorEvent.
-        3) If the error is still not handled by the associated Worker
-        object, the error should be reported to the user.
-
-        Test: fast/workers/worker-script-error.html
-
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::reportError):
-        * bindings/js/JSEventListener.h:
-        * dom/EventListener.h:
-        (WebCore::EventListener::reportError): adds a function to call
-        EventListener as a function with 3 arguments to report an error.
-        * workers/AbstractWorker.cpp:
-        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
-        * workers/AbstractWorker.h:
-        * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::reportException):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
-        * workers/WorkerContext.h:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::WorkerExceptionTask::performTask):
-        * workers/WorkerMessagingProxy.h:
-
-2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] History handling / page cache / loading is buggy and depends on several hacks
-        https://bugs.webkit.org/show_bug.cgi?id=27707
-
-        Redesign WML history/loading handling. In detail:
-
-        - Remove FrameLoader::setForceReloadWmlDeck(). WML used to force a special loading behaviour
-          by calling this method from WMLGoElement & friends - instead teach FrameLoader to detect
-          WML content itself.
-
-          WML content is usually a standalone WML document (isWMLDocument()=true) or as special case
-          an XHTML document which embeds a WML document (that's the way the WML layout tests work).
-          Force WML loading behaviour even for XHTML document which embed WML documents. This only
-          applies to our layout tests, not for any real world site. Though it gives us a perfect
-          way to test the WML loading code even when we're not operating on a standalone WML document.
-
-          Whenever a WMLCardElement is inserted into the document it will check wheter it's inserted
-          in a standalone WML document or wheter the main frame document is different. If it differs
-          the main frame documents' "containsWMLContent" property is set to true.
-
-          -> Make FrameLoader::shouldReload() use the new frameContainsWMLContent() method, which
-             checks if the associated frame document is a WML document or wheter it contains WML content.
-
-        - Change FrameLoader::loadItem() to use the new frameContainsWMLContent() method for 'shouldScroll'
-          detection. WML documents (or those containing WML content) always want new loads even for in-page
-          navigation. No "scroll to anchor" mechanism should apply.
-
-        - Modify FrameLoader::canCachePageContainingThisFrame() to check for !frameContainsWMLContent().
-          WML pages should never be cached, potential security problem due the use of variables (per spec).
-
-        Add two new WML tests which were broken before, testing onenterforward/onenterbackward event handling
-        and history navigation (<prev/> task).
-
-        Tests: wml/enter-card-with-events.html
-               wml/enter-first-card-with-events.html
-
-        * dom/Document.cpp: Initialize new 'm_containsWMLContent' property.
-        (WebCore::Document::Document):
-        * dom/Document.h: Add new helper methods and 'm_containsWMLContent" variable (explained above).
-        (WebCore::Document::setContainsWMLContent):
-        (WebCore::Document::containsWMLContent):
-        * history/BackForwardList.cpp:
-        (WebCore::BackForwardList::clearWMLPageHistory): Renamed from clearWmlPageHistory() & slight cleanup.
-        * history/BackForwardList.h:
-        * loader/FrameLoader.cpp: Rework WML loading behaviour (explained above).
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::frameContainsWMLContent):
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::shouldReload):
-        (WebCore::FrameLoader::loadItem):
-        * loader/FrameLoader.h:
-        * wml/WMLCardElement.cpp: 
-        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded): No need anymore to manually track history length.
-        (WebCore::WMLCardElement::insertedIntoDocument): Handle setting containsWMLContent on the main frame document.
-        * wml/WMLGoElement.cpp: 
-        (WebCore::WMLGoElement::executeTask): Remove call to FrameLoader::setForceReloadWmlDeck()
-        * wml/WMLPageState.cpp: Remove 'm_historyLength' - no need anymore to track history length on our own.
-        (WebCore::WMLPageState::WMLPageState):
-        (WebCore::WMLPageState::dump):
-        (WebCore::WMLPageState::reset):
-        * wml/WMLPageState.h:
-
-2009-07-27  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Adam Roben.
-
-        Fix Chromium build breakage introduced in 46388.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27705
-
-        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
-        (WebCore::FontPlatformData::description):
-        * platform/graphics/chromium/FontPlatformDataChromiumWin.h:
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
 
-2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-02-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Add some more debug logging to PluginViewMac.
-
-        * plugins/mac/PluginViewMac.cpp:
+        [Qt] Generate convenience headers (QWebView, etc) using qmake
 
-2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        In Qt this is done using syncqt, but we use a pro-file instead
+        that generates makefile-rules for each of the extra headers.
 
-        Reviewed by Jan Michael Alonzo.
+        These extra headers are installed alongside the normal headers.
 
-        Remove dead code from the GTK NPAPI implementation.
+        * WebCore.pro: Use headers.pri based on DerivedSources instead
+        of the one previously checked in in the source tree.
 
-        * plugins/gtk/PluginViewGtk.cpp:
+2010-02-05  Mikhail Naganov  <mnaganov@chromium.org>
 
-2009-07-27  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+        Reviewed by Pavel Feldman.
 
-        Reviewed by Simon Hausmann.
+        Enable JAVASCRIPT_DEBUGGER in chromium port.
 
-        [Qt] Buildfix on Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=27702
+        https://bugs.webkit.org/show_bug.cgi?id=34638
 
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::hookedEndPaint):
-            Constraint of (*endPaint) operand modified from "g" to "m" (memory) in inline 
-            assembly, because with "g" constraint, wrong assembly code generated.
+        * page/Console.cpp:
+        * page/Console.h:
+        * page/Console.idl:
 
-2009-07-27  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-05  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebCore bindings: Implement ScriptArray bindings.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27691
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/ScriptArray.cpp: Added.
-        (WebCore::ScriptArray::ScriptArray):
-        (WebCore::handleException):
-        (WebCore::ScriptArray::set):
-        (WebCore::length):
-        (WebCore::ScriptArray::createNew):
-        * bindings/js/ScriptArray.h: Added.
-        (WebCore::ScriptArray::ScriptArray):
-        (WebCore::ScriptArray::jsArray):
-        * bindings/v8/ScriptArray.cpp: Added.
-        (WebCore::ScriptArray::ScriptArray):
-        (WebCore::ScriptArray::set):
-        (WebCore::ScriptArray::length):
-        (WebCore::ScriptArray::createNew):
-        * bindings/v8/ScriptArray.h: Added.
-        (WebCore::ScriptArray::ScriptArray):
-        (WebCore::ScriptArray::~ScriptArray):
-
-2009-07-27  Brent Fulgham  <bfulgham@webkit.org>
-
-        Build correct, no review.
+        Web Inspector: Tab width for javascript source is 8, should be 4
 
-        Change in r46407 broke Apple Windows build.
-        Switch to WinCairo-only test, to avoid any
-        other platform break.
+        https://bugs.webkit.org/show_bug.cgi?id=31248
 
-        * WebCorePrefix.h: 
-
-2009-07-26  Brent Fulgham  <bfulgham@webkit.org>
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel.prototype.set replaceTabsWithSpaces):
+        (WebInspector.TextEditorModel.prototype._innerSetText):
+        (WebInspector.TextEditorModel.prototype._replaceTabsIfNeeded):
 
-        Build correct, no review.
+2010-02-05  Tony Chang  <tony@chromium.org>
 
-        Change in r46407 broke Apple Windows build.
+        Reviewed by Eric Seidel.
 
-        * WebCorePrefix.h: Use WTF_PLATFORM_CG to decide if
-          CoreServices.h should be included.
+        https://bugs.webkit.org/show_bug.cgi?id=24872
+        When pasting a list into another list should not indent another level.
+        If the cursor is at the beginning of the line, it should insert the
+        list items before the current list item.  If the cursor is at the end
+        of the line, it should insert the list items after the current list item.
 
-2009-07-26  Brent Fulgham  <bfulgham@webkit.org>
+        This matches Firefox and IE and makes the common activity of reordering a list
+        work as expected.
 
-        Build correction, no review.
+        This also adds a small helper method (isListItem) to htmlediting.h.
 
-        Change in r46195 broke WinCairo build.
+        Test: editing/pasteboard/paste-list-002.html
 
-        * WebCorePrefix.h: CoreServices should be ignored
-          for non-Apple build.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
+        * editing/ReplaceSelectionCommand.h:
+        * editing/htmlediting.cpp:
+        (WebCore::isListItem):
+        (WebCore::appendedSublist):
+        * editing/htmlediting.h:
 
-2009-07-26  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-04  Mark Rowe  <mrowe@apple.com>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: Implement the breakpoints sidebar pane.
-        This change adds simple UI support into the existing
-        BreakpointSidebarPane.
+        Build fix.  Remove a symbol corresponding to an inline function from the linker export
+        file to prevent a weak external failure.
 
-        https://bugs.webkit.org/show_bug.cgi?id=11175
+        * WebCore.base.exp: Remove symbol.
+        * WebCore.xcodeproj/project.pbxproj: Accommodate rename of script.
 
-        * inspector/front-end/Breakpoint.js:
-        (WebInspector.Breakpoint.prototype.set enabled):
-        (WebInspector.Breakpoint.prototype.get label):
-        (WebInspector.Breakpoint.prototype.get id):
-        * inspector/front-end/BreakpointsSidebarPane.js:
-        (WebInspector.BreakpointsSidebarPane):
-        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
-        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
-        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement.labelClicked):
-        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
-        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        (WebInspector.ScriptsPanel.prototype.scriptOrResourceForID):
-        * inspector/front-end/inspector.css:
-
-2009-07-16  Shinichiro Hamaji  <hamaji@chromium.org>
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Canvas: rotation of 'no-repeat' pattern still has small error
-        https://bugs.webkit.org/show_bug.cgi?id=26749
-
-        Use 1<<22 as steps of no-repeat pattern to make the error less
-        than 0.5.  The previous value may cause 1 pixel errors.
-
-        Add another test to show this bug clearly.
-        Also add png expected image which was missing in the previous patch.
-
-        Test: fast/canvas/image-pattern-rotate.html
-
-        * platform/graphics/cg/PatternCG.cpp:
-        (WebCore::Pattern::createPlatformPattern):
+        Updated to use new WeakGCPtr::clear interface.
 
-2009-07-25  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Darin Adler.
-
-        Windows build break due to warning C4819
-        https://bugs.webkit.org/show_bug.cgi?id=27416
-
-        Disable C4819 warning to fix build.
-
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-07-25  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Kevin McCullough.
-
-        Inspector: Keyboard Shortcuts to Switch Panels
-        https://bugs.webkit.org/show_bug.cgi?id=27286
-
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded): save a list of the order of the panels
-        (WebInspector.documentKeyDown): handle the keyboard shortcuts to traverse the panels
-
-2009-07-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by George Staikos.
-
-        [Qt] Fix build break after r46369
-        https://bugs.webkit.org/show_bug.cgi?id=27680
-
-        * WebCore.pro:
-
-2009-07-25  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] Variable substitution is buggy
-        https://bugs.webkit.org/show_bug.cgi?id=27677
-
-        Substitute variables upon attach() time instead of insertedIntoDocument(). Otherwhise variable substitution
-        won't work during inter-deck jumps (same URL, different fragment). Covered by new test fast/wml/newcontext-same-deck.html.
-
-        * dom/Text.cpp:
-        (WebCore::Text::attach):
-        * dom/Text.h:
-
-2009-07-25  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] WMLDoElement doesn't update its RenderButton object upon attach()
-        https://bugs.webkit.org/show_bug.cgi?id=27676
-
-        WMLDoElement needs to implement attach() and call updateFromElement() on its associated RenderButton.
-        Mimics HTMLButtonElement/HTMLFormControlElement behaviour and fixes several painting/styling issues covered by existing tests in fast/wml.
-
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::attach):
-        * wml/WMLDoElement.h:
-
-2009-07-25  Pavel Feldman  <pfeldman@chromium.org>
-
-        Fix Windows build breakage introduced in 46390.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        Inspector: Properties Should be Sorted more Naturally
-        https://bugs.webkit.org/show_bug.cgi?id=27329
-
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertiesSection.prototype.update): use the displaySort when showing properties
-        (WebInspector.ObjectPropertiesSection.prototype._displaySort): alphaNumerical sort
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate): use the displaySort when showing properties
-        * inspector/front-end/utilities.js:
-        (Object.sortedProperties): allow for an optional sorting function in Object.sortedProperties
-
-2009-07-24  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Split InspectorController into InspectorController
-        and InspectorBackend. Everything frontend needs from InspectorController
-        will slowly migrate into the InspectorBackend.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27541
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSInspectorBackendCustom.cpp: Added.
-        (WebCore::JSInspectorBackend::highlightDOMNode):
-        (WebCore::JSInspectorBackend::search):
-        (WebCore::JSInspectorBackend::databaseTableNames):
-        (WebCore::JSInspectorBackend::inspectedWindow):
-        (WebCore::JSInspectorBackend::setting):
-        (WebCore::JSInspectorBackend::setSetting):
-        (WebCore::JSInspectorBackend::wrapCallback):
-        (WebCore::JSInspectorBackend::currentCallFrame):
-        (WebCore::JSInspectorBackend::profiles):
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/js/JSInspectorControllerCustom.cpp: Removed.
-        * bindings/js/ScriptObject.cpp:
-        (WebCore::ScriptGlobalObject::set):
-        * bindings/js/ScriptObject.h:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/ScriptObject.cpp:
-        (WebCore::ScriptGlobalObject::set):
-        * bindings/v8/ScriptObject.h:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorControllerCustom.cpp: Removed.
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        (WebCore::InspectorController::windowScriptObjectAvailable):
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::inspectorBackend):
-        * inspector/InspectorBackend.cpp: Added.
-        * inspector/InspectorBackend.h: Added.
-        (WebCore::InspectorBackend::create):
-        (WebCore::InspectorBackend::inspectorController):
-        * inspector/InspectorBackend.idl: Added.
-        * inspector/InspectorController.idl: Removed.
-        * inspector/front-end/Resource.js:
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        * page/Page.h:
-
-2009-07-25  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Update WebCore/page/Frame.cpp/h to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27654
-
-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-        (WebCore::Frame::~Frame):
-        (WebCore::Frame::setDocument):
-        (WebCore::Frame::firstRectForRange):
-        (WebCore::createRegExpForLabels):
-        (WebCore::Frame::searchForLabelsBeforeElement):
-        (WebCore::Frame::matchLabelsAgainstElement):
-        (WebCore::Frame::selectionLayoutChanged):
-        (WebCore::Frame::setZoomFactor):
-        (WebCore::Frame::reapplyStyles):
-        (WebCore::Frame::isContentEditable):
-        (WebCore::Frame::computeAndSetTypingStyle):
-        (WebCore::Frame::selectionStartStylePropertyValue):
-        (WebCore::Frame::selectionComputedStyle):
-        (WebCore::Frame::applyEditingStyleToBodyElement):
-        (WebCore::Frame::removeEditingStyleFromBodyElement):
-        (WebCore::Frame::applyEditingStyleToElement):
-        (WebCore::Frame::selectionBounds):
-        (WebCore::Frame::currentForm):
-        (WebCore::Frame::revealSelection):
-        (WebCore::Frame::styleForSelectionStart):
-        (WebCore::Frame::setSelectionFromNone):
-        (WebCore::Frame::findString):
-        (WebCore::Frame::markAllMatchesForText):
-        (WebCore::Frame::setMarkedTextMatchesAreHighlighted):
-        (WebCore::Frame::clearFormerDOMWindow):
-        (WebCore::Frame::unfocusWindow):
-        (WebCore::Frame::respondToChangedSelection):
-        (WebCore::Frame::documentAtPoint):
-        * page/Frame.h:
-        (WebCore::Frame::create):
-        (WebCore::Frame::displayStringModifiedByEncoding):
-        (WebCore::Frame::pageZoomFactor):
-        (WebCore::Frame::textZoomFactor):
-
-2009-07-24  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Add functions to print the glyph page trees for debugging
-        https://bugs.webkit.org/show_bug.cgi?id=27671
-
-        * platform/graphics/FontData.h: Defined a description() method.
-
-        * platform/graphics/GlyphPageTreeNode.cpp:
-        (WebCore::GlyphPageTreeNode::showSubtree): Added. Prints the node and
-            its descendants.
-        (showGlyphPageTrees): Added. Prints all glyph page trees.
-        (showGlyphPageTree): Added. Prints the glyph page tree for a given page.
-        * platform/graphics/GlyphPageTreeNode.h:
-
-        * platform/graphics/SegmentedFontData.cpp:
-        (WebCore::SegmentedFontData::description): Added.
-
-        * platform/graphics/SegmentedFontData.h:
-        * platform/graphics/SimpleFontData.cpp:
-        (WebCore::SimpleFontData::description): Added. Uses the platform data
-            as the description for non-svg, non-custom fonts.
-        * platform/graphics/SimpleFontData.h:
-
-        * platform/graphics/gtk/FontPlatformData.h:
-        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
-        * platform/graphics/gtk/FontPlatformDataPango.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
-
-        * platform/graphics/mac/FontPlatformData.h:
-        * platform/graphics/mac/FontPlatformDataMac.mm:
-        (WebCore::FontPlatformData::description): Added. Returns the
-            description of the CGFont, the size and the synthetic style flags,
-            if set.
-
-        * platform/graphics/qt/FontPlatformData.h:
-        * platform/graphics/qt/FontPlatformDataQt.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
-
-        * platform/graphics/win/FontPlatformData.h:
-        * platform/graphics/win/FontPlatformDataWin.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
-
-        * platform/graphics/wince/FontPlatformData.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
-        * platform/graphics/wince/FontPlatformData.h:
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::invalidateJSFunction):
 
-        * platform/graphics/wx/FontPlatformData.h:
-        * platform/graphics/wx/FontPlatformDataWx.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
 
-2009-07-24  Mads Ager  <ager@chromium.org>
+        Build fix: Added a forwarding header.
 
-        Reviewed by Adam Barth.
+        * ForwardingHeaders/runtime/WeakGCPtr.h: Added.
 
-        SVG and XPath memory leaks in V8 bindings
-        https://bugs.webkit.org/show_bug.cgi?id=27488
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
 
-        Add proper 'create' methods to SVGPodTypeWrappers and
-        XPathNSResolvers in the V8 bindings to avoid memory leaks.
+        Reviewed by Alexey Proskuryakov and Darin Adler.
 
-        Introduce convertToV8Object methods that accept PassRefPtrs and
-        clean up the use of get() and release() on RefPtrs.
+        REGRESSION (r52082): Missing event handlers on JQuery demo page (33383)
+        https://bugs.webkit.org/show_bug.cgi?id=33383
+        <rdar://problem/7559449>
         
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        (WebCore::V8DOMWrapper::convertEventToV8Object):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
-        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
-        * bindings/v8/V8SVGPODTypeWrapper.h:
-        (WebCore::V8SVGPODTypeWrapperCreatorForList::create):
-        (WebCore::V8SVGPODTypeWrapperCreatorForList::V8SVGPODTypeWrapperCreatorForList):
-        (WebCore::V8SVGStaticPODTypeWrapper::create):
-        (WebCore::V8SVGStaticPODTypeWrapper::V8SVGStaticPODTypeWrapper):
-        (WebCore::V8SVGStaticPODTypeWrapperWithPODTypeParent::create):
-        (WebCore::V8SVGStaticPODTypeWrapperWithPODTypeParent::V8SVGStaticPODTypeWrapperWithPODTypeParent):
-        (WebCore::V8SVGStaticPODTypeWrapperWithParent::create):
-        (WebCore::V8SVGStaticPODTypeWrapperWithParent::V8SVGStaticPODTypeWrapperWithParent):
-        (WebCore::V8SVGDynamicPODTypeWrapper::create):
-        (WebCore::V8SVGDynamicPODTypeWrapper::V8SVGDynamicPODTypeWrapper):
-        (WebCore::V8SVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ClientRectListCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
-        (WebCore::V8CustomXPathNSResolver::create):
-        * bindings/v8/custom/V8CustomXPathNSResolver.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::getItem):
-        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::ACCESSOR_GETTER):
-        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
-        (WebCore::toV8):
-        * bindings/v8/custom/V8NodeListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
-        (WebCore::toV8):
-        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-24  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        Fix of <rdar://6310538> Middle-click panning should be springloaded while dragging
-        https://bugs.webkit.org/show_bug.cgi?id=21794
+        There were two bugs here:
         
-        Create two new booleans to determine whether we have done a springloaded pan scroll, and update
-        the name of setPanScrollCursor to updatePanScrollState to more accurately describe what the function
-        does. 
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::EventHandler): Initialized two new booleans.
-        (WebCore::EventHandler::autoscrollTimerFired):
-        (WebCore::EventHandler::updatePanScrollState): Renamed from setPanScrollCursor.
-        (WebCore::EventHandler::stopAutoscrollTimer): Clear the pan scrolling in progress flag.
-        (WebCore::EventHandler::handleMouseReleaseEvent): Clear the pan scrolling button pressed flag.
-        * page/EventHandler.h:
-
-2009-07-24  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27657
-        Add more wince port files to WebCore
-
-        Written by Yong Li  <yong.li@torchmobile.com> and Lyon Chen <lyon.chen@torchmobile.com>
-
-        * loader/icon/wince/IconDatabaseWince.cpp: Added.
-        * rendering/RenderThemeWince.cpp: Added.
-        * rendering/RenderThemeWince.h: Added.
-        * storage/wince/DatabaseThreadWince.cpp: Added.
-        * storage/wince/DatabaseThreadWince.h: Added.
-        * storage/wince/LocalStorageThreadWince.cpp: Added.
-        * storage/wince/LocalStorageThreadWince.h: Added.
-        * svg/graphics/wince/SVGResourceFilterWince.cpp: Added.
-
-2009-07-24  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Justin Garcia.
-
-        execCommand('underline') can modify DOM outside of the contentEditable area
-        https://bugs.webkit.org/show_bug.cgi?id=24333
-
-        highestAncestorWithTextDecoration stops at the closest unsplittable element so that if text-decoration is applied
-        outside of it, we don't accidently modify the style attribute.
-
-        Tests: editing/style/textdecoration-outside-of-rooteditable.html
-               editing/style/textdecoration-outside-of-unsplittable-element.html
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::StyleChange::init):
-        (WebCore::highestAncestorWithTextDecoration):
-
-2009-07-24  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27639
-
-        Fixes false positives when evaluating certain strings that only contain 
-        non-canonical characters.
-
-        Test: http/tests/security/xssAuditor/script-tag-safe.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::isNonCanonicalCharacter):
-        (WebCore::XSSAuditor::findInRequest):
-
-2009-07-24  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Changed WorkerContext destructor to not access possibly-freed WorkerThread.
-
-        Failed assertion in WorkerContext::~WorkerContext().
-        https://bugs.webkit.org/show_bug.cgi?id=27665
-
-       * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::~DedicatedWorkerContext):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::~WorkerContext):
-        Removed assertion that relies on WorkerThread still being alive (moved to DedicatedWorkerContext destructor).
-
-2009-07-24  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Adam Barth.
-
-        Updated code generator to properly generate bindings for WorkerContext exposed functions.
-
-        Storing a reference to WorkerContext.postMessage() and calling it later yields a TypeError
-        https://bugs.webkit.org/show_bug.cgi?id=27419
-
-        Test: fast/workers/worker-call.html
-
-        * bindings/js/JSWorkerContextBase.cpp:
-        (WebCore::toJSDedicatedWorkerContext):
-        (WebCore::toJSWorkerContext):
-        Functions that convert from JSValue to the appropriate WorkerContext/DedicatedWorkerContext object.
-        * bindings/js/JSWorkerContextBase.h:
-        Added toJS*WorkerContext APIs.
-        * bindings/scripts/CodeGeneratorJS.pm:
-        Added code to appropriately check the passed-in this object when invoking functions at global scope.
-
-2009-07-24  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Adam Barth.
-
-        Refactor WorkerContext to move DedicatedWorker-specific APIs into DedicatedWorkerContext
-        https://bugs.webkit.org/show_bug.cgi?id=27420
-
-        No new tests as the existing tests already provide sufficient coverage (this is just a refactoring with no new functionality).
-
-        * DerivedSources.cpp:
-        Added JSDerivedWorkerContext.cpp
-        * DerivedSources.make:
-        Added DerivedWorkerContext files
-        * GNUmakefile.am:
-        Added DerivedWorkerContext files
-        * WebCore.gypi:
-        Added DerivedWorkerContext files
-        * WebCore.pro:
-        Added DerivedWorkerContext files
-        * WebCore.vcproj/WebCore.vcproj:
-        Added DerivedWorkerContext files
-        * WebCore.xcodeproj/project.pbxproj:
-        Added DerivedWorkerContext files
-        * bindings/js/JSDedicatedWorkerContextCustom.cpp: Added.
-        (WebCore::JSDedicatedWorkerContext::mark):
-        Custom mark function for onmessage event handler.
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        Supports conversion to JSDedicatedWorkerContext.
-        (WebCore::toEventTarget):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::mark):
-        Moved onmessage mark handling into DedicatedWorkerContext.
-        * bindings/js/WorkerScriptController.cpp:
-        Added appropriate casts to DedicatedWorkerContext for postMessage().
-        (WebCore::WorkerScriptController::initScript):
-        Manually sets up the prototype chain for the worker context.
-        * bindings/scripts/CodeGeneratorJS.pm:
-        Changed special case code for WorkerContext to be triggered by new IsWorkerContext attribute.
-        * bindings/scripts/CodeGeneratorV8.pm:
-        Changed hard-coded tests for WorkerContext to support DedicatedWorkerContext.
-        * bindings/v8/DOMObjectsInclude.h:
-        Added DedicatedWorkerContext.h
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        Added V8DedicatedWorkerContext.cpp
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        Added code to reserve extra fields for V8DedicatedWorkerContext.
-        * bindings/v8/V8Index.cpp:
-        Now includes V8DedicatedWorkerContext.h in addition to V8WorkerContext.h
-        * bindings/v8/V8Index.h:
-        Added DedicatedWorkerContext as a non-node wrapper type.
-        Removed WORKERCONTEXT as a valid template type.
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
-        Creates DedicatedWorkerContext instead of WorkerContext.
-        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
-        Returns DedicatedWorkerContext instead of WorkerContext.
-        (WebCore::WorkerContextExecutionProxy::retrieve):
-        Refactored to deal with DedicatedWorkerContext.
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp: Added.
-        Moved onmessage code from V8WorkerContextCustom.cpp
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        Moved onmessage code to V8DedicatedWorkerContextCustom.cpp
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toDedicatedWorkerContext):
-        * dom/EventTarget.h:
-        * workers/DedicatedWorkerContext.cpp: Added.
-        Moved DedicatedWorker-only APIs from WorkerContext.
-        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
-        (WebCore::DedicatedWorkerContext::~DedicatedWorkerContext):
-        (WebCore::DedicatedWorkerContext::reportException):
-        (WebCore::DedicatedWorkerContext::postMessage):
-        (WebCore::DedicatedWorkerContext::dispatchMessage):
-        * workers/DedicatedWorkerContext.h: Added.
-        Moved DedicatedWorker-only APIs from WorkerContext.
-        (WebCore::DedicatedWorkerContext::create):
-        (WebCore::DedicatedWorkerContext::toDedicatedWorkerContext):
-        (WebCore::DedicatedWorkerContext::setOnmessage):
-        (WebCore::DedicatedWorkerContext::onmessage):
-        * workers/DedicatedWorkerContext.idl: Added.
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::~WorkerContext):
-        Moved code that notifies parent that worker is closing down into DedicatedWorkerContext.
-        * workers/WorkerContext.h:
-        (WebCore::WorkerContext::isClosing):
-        Exposed closing flag as an API so derived classes can access it.
-        * workers/WorkerContext.idl:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::MessageWorkerContextTask::performTask):
-        Calls into DedicatedWorkerContext to handle message.
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThread::workerThread):
-        Creates a DedicatedWorkerContext when the thread starts up.
-
-2009-07-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Move more callers to using 3 argument toJS
-        https://bugs.webkit.org/show_bug.cgi?id=27661
-
-        No functional changes, thus no tests.
-        These are all the places where we can't yet pass the
-        correct globalObject because we don't have or don't know the right one.
-
-        * bindings/js/JSCustomPositionCallback.cpp:
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.cpp:
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::acceptNode):
-
-2009-07-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Fix the last of the x-frame constructor calls to have the right prototype chains
-        https://bugs.webkit.org/show_bug.cgi?id=27645
-
-        Fix the last few constructors to use their stored globalObject pointer when
-        constructing objects instead of the lexicalGlobalObject().
-
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::constructAudio):
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::constructImage):
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::construct):
-        * bindings/js/JSOptionConstructor.cpp:
-        (WebCore::constructHTMLOptionElement):
-        * bindings/js/JSWebKitPointConstructor.cpp:
-        (WebCore::constructWebKitPoint):
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::constructWorker):
-
-2009-07-24  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Cleanup exception handling in worker evaluation code.
-        https://bugs.webkit.org/show_bug.cgi?id=27282
-
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::evaluate):
-        * bindings/v8/WorkerContextExecutionProxy.h:
-        (WebCore::WorkerContextExecutionState::WorkerContextExecutionState):
-        * bindings/v8/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-        (WebCore::WorkerScriptController::setException):
-
-2009-07-24  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by David Levin.
-
-        Reverting r46157, since it may be causing problems with Chromium
-        reliability (see http://crbug.com/17569).
-
-        https://bugs.webkit.org/show_bug.cgi?id=27388
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawLine):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintForStroking):
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        REGRESSION: inspector seems broken in ToT WebKit
-        https://bugs.webkit.org/show_bug.cgi?id=27646
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
-
-2009-07-24  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Add the shadow style member to the ShadowData constructor and ==
-        operator
-
-        * rendering/style/ShadowData.cpp:
-        (WebCore::ShadowData::ShadowData):
-        (WebCore::ShadowData::operator==):
-
-2009-07-24  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        [V8] More V8 bindings changes to use ErrorEvent.
-        https://bugs.webkit.org/show_bug.cgi?id=27630
-
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertEventToV8Object):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-
-2009-07-24  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Dave Hyatt.
-
-        Clean up dependencies on Apple support libraries for non-Apple build.
-        http://bugs.webkit.org/show_bug.cgi?id=27532.
-
-        * platform/graphics/win/SimpleFontDataWin.cpp: Conditionalize references
-          to ApplicationServices.h and WebKitSystemInterface.h
-
-2009-07-24  Dan Bernstein  <mitz@apple.com>
-
-        Another attempted build fix 
-
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-
-2009-07-24  Dan Bernstein  <mitz@apple.com>
-
-        Attempted build fix
-
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::toJS):
-
-2009-07-24  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Build fix for 64 bit Linux.
-
-        int64_t is long on Linux 64 bit and not long long, thus
-        getFileSize with a int64_t out value fails to build.
-
-        Use a temporary to work around the problem.
-
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::spaceNeeded):
-
-2009-07-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Update all CREATE_DOM_*_WRAPPER callers to pass globalObject
-        https://bugs.webkit.org/show_bug.cgi?id=27644
-
-        This is another attempt at making the change for bug 27634 smaller.
-        I included the changes to make_names.pl as well as any file which
-        used CREATE_DOM_*_WRAPPER macros.
-
-        The changes to the construct* functions are what fix the cases in
-        fast/dom/constructed-objects-prototypes.html
-
-        The changes to passing globalObject through CREATE_* are what fix
-        fast/dom/prototype-inheritance-2.html
-
-        * bindings/js/JSCDATASectionCustom.cpp:
-        (WebCore::toJSNewlyCreated): pass globalObject.
-        * bindings/js/JSCSSRuleCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSCSSValueCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSDOMBinding.h: updated macros to pass globalObject.
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::JSElement::setAttributeNode): use globalObject() for wrapping return value.
-        (WebCore::JSElement::setAttributeNodeNS): use globalObject() for wrapping return value.
-        (WebCore::toJSNewlyCreated): pass globalObject.
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::JSEvent::clipboardData): pass globalObject.
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems): use globalObject() for wrapping returned collection items.
-        (WebCore::callHTMLCollection): use globalObject() for wrapping returned collection items.
-        (WebCore::JSHTMLCollection::item): use globalObject() for wrapping returned collection items.
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSImageDataCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::createWrapper): pass globalObject.
-        * bindings/js/JSSVGPathSegCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSTextCustom.cpp:
-        (WebCore::toJSNewlyCreated): pass globalObject.
-        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
-        (WebCore::constructWebKitCSSMatrix): use constructors globalObject when constructing
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::constructXMLHttpRequest): use constructors globalObject when constructing
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::constructXSLTProcessor): use constructors globalObject when constructing
-        * dom/make_names.pl:
-            Pass globalObject through CREATE_* macros and various support functions.
-
-2009-07-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Update CodeGeneratorJS.pm to support passing JSDOMGlobalObject* to toJS calls
-        https://bugs.webkit.org/show_bug.cgi?id=27643
-
-        This is an attempt to make this change as small as possible.
-        I started by including all changes to CodeGeneratorJS.pm from bug 27634,
-        and then made the minimal amount of other changes needed to support that change.
-
-        Most toJS implementations ignore their passed JSDOMGlobalObject.
-        There are stub 2-argument toJS, toJSNewlyCreated implementations to help compiling.
-        All places where it is not clear what we should pass as the global object
-        (or where the global object is simply not available, like for some SVG bindings)
-        we pass deprecatedGlobalObjectForPrototype instead.
-
-        * bindings/js/JSCDATASectionCustom.cpp:
-        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
-        * bindings/js/JSCSSRuleCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSCSSValueCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::setDOMException): pass the wrong globalObject for now
-        * bindings/js/JSDOMBinding.h:
-            Pass the wrong global object to the CREATE_ macros for now.
-            In the next change we'll come back and pass the correct one.
-            That will require changes to make_names.pl.
-        (WebCore::DOMObjectWithGlobalPointer::scriptExecutionContext):
-        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
-        (WebCore::DOMObjectWithGlobalPointer::~DOMObjectWithGlobalPointer):
-        (WebCore::createDOMObjectWrapper):
-        (WebCore::getDOMObjectWrapper):
-        (WebCore::createDOMNodeWrapper):
-        (WebCore::getDOMNodeWrapper):
-        (WebCore::toJS): added to convert 2 arg calls to 3 arg calls to limit the scope of this change.
-        (WebCore::toJSNewlyCreated):
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::toJS): DOMWindow always uses its own prototype chain.
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSEventTarget.h:
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSImageDataCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::createWrapper): pass globalObject to toJS(Document*) to avoid recursion
-        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::toJS): pass globalObject along
-        * bindings/js/JSSVGMatrixCustom.cpp:
-        (WebCore::JSSVGMatrix::inverse): pass wrong globalObject for now.
-        (WebCore::JSSVGMatrix::rotateFromVector): pass wrong globalObject for now.
-        * bindings/js/JSSVGPathSegCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSSVGPathSegListCustom.cpp:
-            All of these methods need a globalObject, but most SVG binding don't have
-            space for one, so we just pass the lexicalGlobalObject for now.
-        (WebCore::JSSVGPathSegList::initialize):
-        (WebCore::JSSVGPathSegList::getItem):
-        (WebCore::JSSVGPathSegList::insertItemBefore):
-        (WebCore::JSSVGPathSegList::replaceItem):
-        (WebCore::JSSVGPathSegList::removeItem):
-        (WebCore::JSSVGPathSegList::appendItem):
-        * bindings/js/JSSVGPointListCustom.cpp:
-        (WebCore::finishGetter): pass wrong globalObject for now.
-        (WebCore::finishSetter):
-        (WebCore::finishSetterReadOnlyResult):
-        * bindings/js/JSSVGTransformListCustom.cpp:
-        (WebCore::finishGetter): pass wrong globalObject for now.
-        (WebCore::finishSetter):
-        (WebCore::finishSetterReadOnlyResult):
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSTextCustom.cpp:
-        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
-        * bindings/js/JSWorkerContextBase.cpp:
-        (WebCore::toJS): WorkerContext always uses its own prototype chain since it's a GlobalObject subclass.
-        * bindings/js/JSWorkerContextBase.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-            All generated toJS calls now pass a globalObject.
-            All generated toJS implementations now expect a globalObject.
-            Simplified all the slot casts by using a "castedThis" local.
-            SVG bindings which don't have a globalObject() accessor pass the deprecated lexicalGlobalObject instead.
-            Simplified printing of constructor objects using a $constructorClassName variable.
-            All generated constructor functions follow the construct$className form to match the custom constructors.
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        typing "document.__proto__" in inspector throws exception
-        https://bugs.webkit.org/show_bug.cgi?id=27169
-
-        * inspector/front-end/utilities.js:
-        (Object.type):
-
-2009-07-24  Andrei Popescu  <andreip@google.com>
-
-        Reviewed by Anders Carlsson.
-
-        ApplicationCache should have size limit
-        https://bugs.webkit.org/show_bug.cgi?id=22700
-
-        https://lists.webkit.org/pipermail/webkit-dev/2009-May/007560.html
-
-        This change implements a mechanism for limiting the maximum size of
-        the application cache file. When this size is reached, a ChromeClient
-        callback is invoked asynchronously and the saving of the last (failed)
-        cache is retried automatically.
+        1. A stale wrapper would invalidate a node's event listeners, even if
+        the node had a fresh wrapper keeping it alive.
         
-        This change also extends the ApplicationCacheStorage API by allowing
-        a client to query or modify the application cache without having to
-        load any resources into memory.
-
-        Test: http/tests/appcache/max-size.html
-
-        * WebCore.base.exp:
-        Exports the symbols required by the DumpRenderTree test application.
-        * loader/EmptyClients.h:
-        Adds empty implementation of the new ChromeClient methods.
-        * loader/appcache/ApplicationCache.cpp:
-        * loader/appcache/ApplicationCache.h:
-        Adds the ability to calculate the approximate size of an ApplicationCache object.
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        * loader/appcache/ApplicationCacheGroup.h:
-        Invokes the ChromeClient callback when the storage layer runs out of space.
-        After the callback is invoked, we re-attempt to store the newest cache,
-        in case the ChromeClient has freed some space.
-        * loader/appcache/ApplicationCacheResource.cpp:
-        * loader/appcache/ApplicationCacheResource.h:
-        Adds the ability to calculate the approximate size of an ApplicationCacheResource object.
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        * loader/appcache/ApplicationCacheStorage.h:
-        Enforces a maximum size for the application cache file.
-        * page/ChromeClient.h:
-        Adds a new callback, invoked when the ApplicationCacheStorage reports that it has
-        reached the maximum size for its database file.
-        * platform/sql/SQLiteDatabase.cpp:
-        * platform/sql/SQLiteDatabase.h:
-        Adds a new method that allows querying for the amount of unused space inside the
-        application cache database file.
-
-2009-07-24  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25415
-        [GTK][ATK] Please implement support for get_text_at_offset
-
-        Use TextEncoding facilities to convert between UTF16 and UTF8
-        instead of rolling our own solution.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (convertUniCharToUTF8):
-
-2009-07-24  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25415
-        [GTK][ATK] Please implement support for get_text_at_offset
-
-        Fix confusion in g_substr between length in bytes and length in
-        characters. Was causing crashes in some situations when dealing
-        with non-ASCII text encoded as UTF8.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (g_substr):
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Impossible to add an attribute to a node without attributes
-        https://bugs.webkit.org/show_bug.cgi?id=21108
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement):
-        (WebInspector.ElementsTreeElement.prototype.set hovered):
-        (WebInspector.ElementsTreeElement.prototype.toggleNewButton):
-        (WebInspector.ElementsTreeElement.prototype.ondblclick):
-        (WebInspector.ElementsTreeElement.prototype._startEditing):
-        (WebInspector.ElementsTreeElement.prototype._addNewAttribute):
-        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
-        * inspector/front-end/inspector.css:
-
-2009-07-24  Keishi Hattori  <casey.hattori@gmail.com>
+        The fix for this is for an event listener to keep a WeakGCPtr back-pointer
+        to the wrapper it expects to mark it. The wrapper destructor checks this
+        back-pointer, and only invalidates the event listener in the case of a match.
 
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Adds support for Firebug's magic $0 variable to access inspected node
-        https://bugs.webkit.org/show_bug.cgi?id=17907
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled): Added _inspectorCommandLineAPI.{
-            _inspectedNodes, _addInspectedNode, $0, $1, $n}
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged): Stores the inspected node history
-            in _inspectorCommandLineAPI._inspectedNodes
-        (WebInspector.ElementsPanel):
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Dragging a resource in the sidebar should drag it's URL
-        https://bugs.webkit.org/show_bug.cgi?id=14410
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Double click on a resource in the sidebar should open that resource in Safari
-        https://bugs.webkit.org/show_bug.cgi?id=14409
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick): open a resource url
-
-2009-07-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Xan Lopez.
-
-        Bump pango version requirement to 1.12 and remove unnecessary #ifdefs.
-
-        * platform/graphics/gtk/FontGtk.cpp:
-        (WebCore::getDefaultPangoLayout):
-        * platform/graphics/gtk/FontPlatformDataPango.cpp:
-        (WebCore::FontPlatformData::FontPlatformData):
-        * platform/gtk/Language.cpp:
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Missing UIString and other localizedString.js fixes
-        https://bugs.webkit.org/show_bug.cgi?id=27288
-
-        * English.lproj/localizedStrings.js:
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Should Syntax Highlight JSON
-        https://bugs.webkit.org/show_bug.cgi?id=27503
-
-        * inspector/front-end/SourceView.js:
-        (WebInspector.SourceView.prototype._contentLoaded):
-
-2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Update WebCore/page/DOMTimer.cpp/h to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27624
-
-        * page/DragController.cpp:
-        (WebCore::DragController::~DragController):
-        (WebCore::documentFragmentFromDragData):
-        (WebCore::DragController::dragEnded):
-        (WebCore::DragController::dragEntered):
-        (WebCore::DragController::dragExited):
-        (WebCore::DragController::dragUpdated):
-        (WebCore::DragController::performDrag):
-        (WebCore::asFileInput):
-        (WebCore::DragController::tryDocumentDrag):
-        (WebCore::DragController::delegateDragSourceAction):
-        (WebCore::DragController::concludeEditDrag):
-        (WebCore::DragController::canProcessDrag):
-        (WebCore::DragController::tryDHTMLDrag):
-        (WebCore::DragController::mayStartDragAtEventLocation):
-        (WebCore::getCachedImage):
-        (WebCore::getImage):
-        (WebCore::prepareClipboardForImageDrag):
-        (WebCore::dragLocForDHTMLDrag):
-        (WebCore::DragController::startDrag):
-        (WebCore::DragController::doImageDrag):
-        (WebCore::DragController::doSystemDrag):
-        (WebCore::DragController::placeDragCaret):
-
-2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Update WebCore/page/Chrome.cpp to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27608
-
-        * page/Chrome.cpp:
-        (WebCore::Chrome::runBeforeUnloadConfirmPanel):
-        (WebCore::Chrome::runJavaScriptAlert):
-        (WebCore::Chrome::runJavaScriptConfirm):
-        (WebCore::Chrome::runJavaScriptPrompt):
-        (WebCore::Chrome::shouldInterruptJavaScript):
-        (WebCore::Chrome::setToolTip):
-        (WebCore::Chrome::requestGeolocationPermissionForFrame):
-        (WebCore::ChromeClient::generateReplacementFile):
-        (WebCore::ChromeClient::paintCustomScrollbar):
-
-2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Update WebCore/page/Coordinates.cpp to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27614
-
-        * page/Coordinates.cpp:
-        (WebCore::Coordinates::toString):
-
-2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Update WebCore/page/DOMSelection.cpp/h to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27614
-
-        * page/DOMSelection.cpp:
-        (WebCore::DOMSelection::setBaseAndExtent):
-        (WebCore::DOMSelection::modify):
-        (WebCore::DOMSelection::addRange):
-        (WebCore::DOMSelection::deleteFromDocument):
-        * page/DOMSelection.h:
-
-2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Update WebCore/page/DOMTimer.cpp/h to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27618
-
-        * page/DOMTimer.cpp:
-        (WebCore::DOMTimer::DOMTimer):
-        (WebCore::DOMTimer::~DOMTimer):
-        (WebCore::DOMTimer::fired):
-        (WebCore::DOMTimer::suspend):
-        (WebCore::DOMTimer::resume):
-        (WebCore::DOMTimer::canSuspend):
-        * page/DOMTimer.h:
-        (WebCore::DOMTimer::minTimerInterval):
-        (WebCore::DOMTimer::setMinTimerInterval):
-
-2009-07-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Classes call DOMObject::mark() explicitly, should call DOMObjectWithGlobal::mark() instead
-        https://bugs.webkit.org/show_bug.cgi?id=27641
-
-        Nothing uses globalObject() yet, but this was causing crashes
-        in the patch for bug 27634.  This is covered by fast/dom/gc-6.html.
+        2. Conversely, a stale wrapper would not invalidate a node's event
+        listeners soon enough, if its destructor didn't have a chance to run
+        before an event fired on the node. (This can only happen in cases where
+        we've made some other error and failed to mark a wrapper that was circuitously
+        observable in the DOM. But we know we have edge case bugs like this, and
+        we don't want them to be crashes.)
+        
+        The fix for this is to check the wrapper back-pointer before firing the
+        event listener. As long as the the wrapper back-pointer is not null,
+        it's safe to fire the listener. 
 
-        I decided to change these to Base:: instead of DOMObjectWithGlobal::
-        for future-proofing.  All autogenerated classes use a typedef Base
-        to avoid bugs like these.  Sadly C+does not have a built-in super:: we could use.
+        * ForwardingHeaders/runtime/WeakGCPtr.h: Added. Appease build gods.
 
-        * WebCore.xcodeproj/project.pbxproj:
         * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::mark):
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
         * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::mark):
-        * bindings/js/JSMessageChannelCustom.cpp:
-        (WebCore::JSMessageChannel::mark):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::mark):
-        * bindings/js/JSNamedNodesCollection.cpp:
-        (WebCore::JSNamedNodesCollection::getOwnPropertySlot):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::mark):
-        * bindings/js/JSNodeFilterCustom.cpp:
-        (WebCore::JSNodeFilter::mark):
-        * bindings/js/JSNodeIteratorCustom.cpp:
-        (WebCore::JSNodeIterator::mark):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::mark):
-        * bindings/js/JSTreeWalkerCustom.cpp:
-        (WebCore::JSTreeWalker::mark):
-
-2009-07-22  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Make most DOMObjects hold onto a JSDOMGlobalObject*
-        https://bugs.webkit.org/show_bug.cgi?id=27588
-
-        This change is almost entirely plumbing.  Only one functional
-        change as part of this all (window.document.constructor has the correct prototype)
-        Changes are detailed below.
-
-        inner.document.constructor is fixed because all properties on the window
-        object are created with the correct globalObject (instead of the lexical one).
-        Since all objects now carry a globalObject pointer, when document creates
-        HTMLDocumentConstructor it now has the right globalObject to use.
-
-        Tests:
-          fast/dom/prototype-inheritance.html
-          fast/dom/prototype-inheritance-2.html
-
-        * bindings/js/DOMObjectWithSVGContext.h:
-        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
-            Update the comment and add an ignored globalObject argument.
-        * bindings/js/JSDOMBinding.h:
-            Pass a globalObject to all DOMObjects during creation.  Currently it's the wrong global object.
-            Once toJS is passed a globalObject it will be the right one.
-        (WebCore::createDOMObjectWrapper):
-        (WebCore::createDOMNodeWrapper):
-        * bindings/js/JSDOMGlobalObject.h:
-        (WebCore::JSDOMGlobalObject::globalObject): Makes binding generation easier.
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
         * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::history): JSHistory is now passed a globalObject, but since it has no custom constructor it doesn't use it.
-        (WebCore::JSDOMWindow::location): JSLocation is now passed a globalObject, but since it has no custom constructor it doesn't use it.
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::location): JSLocation is now passed a globalObject, but since it has no custom constructor it doesn't use it.
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
-        * bindings/js/JSHTMLCollectionCustom.cpp: Re-factoring needed to pass globalObject to JSNamedNodesCollection constructor.
-        (WebCore::getNamedItems):
-        (WebCore::callHTMLCollection):
-        (WebCore::JSHTMLCollection::canGetItemsForName):
-        (WebCore::JSHTMLCollection::nameGetter):
-        (WebCore::JSHTMLCollection::item):
-        (WebCore::JSHTMLCollection::namedItem):
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        (WebCore::JSHTMLFormElement::nameGetter):
-        * bindings/js/JSNamedNodesCollection.cpp:
-             Now passed globalObject.  This is tested by inner.document.forms.testForm.
-             The passed globalObject is still wrong until toJS is fixed.
-        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection):
-        * bindings/js/JSNamedNodesCollection.h:
-        * bindings/js/JSSharedWorkerConstructor.cpp:
-             Add DOMConstructorObject missed by http://trac.webkit.org/changeset/45938
-             This class is not compiled by default, so not testable.
-        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
-        * bindings/js/JSSharedWorkerConstructor.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-             Make all bindings objects carry a globalObject pointer using DOMObjectWithGlobalPointer.
-             SVG bindings which need a context() pointer do not have enough space for globalObject() too.
-             WorkerContext does not need a globalObject (it is one), so special case it.
-             Make all .constructor calls use the stored globalObject().  This is what fixes window.document.constructor.
-             Make all constructors inherit from DOMConstructorObject for consistency.  Since the auto-bound constructors
-             override createStructure anyway, there is no functional change here.  Just completing work started in r45938.
-
-2009-07-23  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        WebCore has a few places that don't gracefully handle a null request returned from willSendRequest.
-        https://bugs.webkit.org/show_bug.cgi?id=27595
-
-        Test: http/tests/misc/will-send-request-returns-null-on-redirect.html
-        
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::removeResource): Null-check the request URL.
-        
-        * platform/network/cf/ResourceHandleCFNet.cpp: Ditto, and return null instead of creating an empty one.
-        (WebCore::willSendRequest):
-
-2009-07-23  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 27633 - AXLoadComplete can be fired off to frequently
-        https://bugs.webkit.org/show_bug.cgi?id=27633
-
-        An integration issue left out some curly braces.
-
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-
-2009-07-23  Darin Adler  <darin@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        URL appears in back/forward button menu instead of title for items with custom representation
-        https://bugs.webkit.org/show_bug.cgi?id=27586
-        rdar://problem/5060337
-
-        * WebCore.base.exp: Exported DocumentLoader::setTitle for use by Mac WebKit.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::didChangeTitle): Tightened code to check if the document
-        loader is the correct one; previously this would never happen because we'd
-        commit the load before any title changes could be registered, but now we can
-        encounter a case where we get a title during a provisional load.
-
-2009-07-23  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        [CSS3 Backgrounds and Borders] Add support for inset box shadows
-        https://bugs.webkit.org/show_bug.cgi?id=27582
-
-        Test: fast/box-shadow/inset.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::valueForShadow): Set the ShadowValue’s shadow style to 'inset'
-            as needed.
-
-        * css/CSSParser.cpp:
-        (WebCore::ShadowParseContext::ShadowParseContext): Added style and allowStyle
-            members. Initialize the allowStyle member.
-        (WebCore::ShadowParseContext::commitValue): Pass the style value to the
-            ShadowValue constructor. Reset allowStyle.
-        (WebCore::ShadowParseContext::commitLength): Update allowStyle.
-        (WebCore::ShadowParseContext::commitColor): Ditto.
-        (WebCore::ShadowParseContext::commitStyle): Added. Sets the style member and
-            updates the state.
-        (WebCore::CSSParser::parseShadow): Parse the 'inset' keyword.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty): Get the style value from the
-            shadow value and pass it to the ShadowData constructor.
-
-        * css/ShadowValue.cpp:
-        (WebCore::ShadowValue::ShadowValue): Added style.
-        (WebCore::ShadowValue::cssText): Added style.
-
-        * css/ShadowValue.h:
-        (WebCore::ShadowValue::create): Added style.
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::blendFunc): Added a blend function for shadow styles. When blending
-            between normal and inset shadows, all intermediate values map to normal.
-        (WebCore::PropertyWrapperShadow::blend): Added normal style to the default
-            shadow.
-            
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::paintBoxShadow): Added a shadow style parameter,
-            which is passed through to RenderBoxModelObject::paintBoxShadow().
-
-        (WebCore::InlineFlowBox::paintBoxDecorations): Paint inset shadows on top of
-            the background.
-
-        * rendering/InlineFlowBox.h:
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintBoxDecorations): Paint inset shadows on top of the
-            background.
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintBoxShadow): Added a shadow style
-            parameter, and code to paint inset shadows.
-
-        * rendering/RenderBoxModelObject.h:
-
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::paintBoxDecorations): Paint inset shadows on top of
-            the background.
-
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::paintBoxDecorations): Ditto.
-
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::paintBoxDecorations): Ditto.
-
-        * rendering/style/ShadowData.h:
-        Added a ShadowStyle enum.
-        (WebCore::ShadowData::ShadowData): Add and initialize a style member.
+        (WebCore::JSDOMWindow::markChildren):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener): Updated to pass a wrapper
+        to the JSEventListener constructor.
 
-2009-07-23  Simon Fraser  <simon.fraser@apple.com>
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::initializeJSFunction):
+        (WebCore::JSEventListener::invalidateJSFunction):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        (WebCore::JSEventListener::isolatedWorld):
+        (WebCore::JSEventListener::wrapper):
+        (WebCore::JSEventListener::setWrapper):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::createJSAttributeEventListener): Implemented the back-pointer
+        described above. Refactored the jsFunction() accessor to return 0 if
+        the wrapper back-pointer is 0.
 
-        Fix the build with UNUSED_PARAM(frame) for when ENABLE(3D_RENDERING) is not defined.
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::markChildren):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::markChildren):
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren):
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener): Updated to pass a wrapper
+        to the JSEventListener constructor.
 
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::transform_3dMediaFeatureEval):
 
-2009-07-23  Simon Fraser  <simon.fraser@apple.com>
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Updated to pass a wrapper
+        to the JSEventListener constructor.
+        (WebCore::getEventListenerHandlerBody): Updated for the fact that jsFunction()
+        is no longer a virtual accessor on the EventHandler base class.
 
-        Reviewed by Adele Peterson.
+        * bindings/scripts/CodeGeneratorJS.pm: Updated for the fact that jsFunction()
+        is no longer a virtual accessor on the EventHandler base class. Added a "JS"
+        to invalidateEventListeners and markEventListeners to clarify that these
+        actions are for JS event listeners only. Added a wrapper parameter to
+        invalidateEventListeners for the back-pointer check explained above.
 
-        3d-transforms media query needs to look check that accelerated compositing is enabled
-        https://bugs.webkit.org/show_bug.cgi?id=27621
-        
-        When evaluating a media query with '-webkit-transform-3d', we need to check the
-        runtime switch that toggles accererated compositing, and therefore 3D.
-        
-        No test because we can't disable the pref dynamically in DRT.
+        * dom/EventListener.h:
+        (WebCore::EventListener::invalidateJSFunction): ditto
 
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::transform_3dMediaFeatureEval):
+        * dom/EventTarget.h:
+        (WebCore::EventTarget::markJSEventListeners):
+        (WebCore::EventTarget::invalidateJSEventListeners): ditto
 
-2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
+2010-02-04  Tony Chang  <tony@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        execCommand('underline') can't remove <U> underlines
-        https://bugs.webkit.org/show_bug.cgi?id=20215
-
-        This patch adds support for u, s, and strike to implicitlyStyledElementShouldBeRemovedWhenApplyingStyle so that
-        WebKit can remove those presentational tags when necessary.
-        It also modifies StyleChange::init not to add "text-decoration: none".  Not only is this style meaningless
-        (does not override inherited styles) but it was also causing WebKit to generate extra spans with this style.
+        https://bugs.webkit.org/show_bug.cgi?id=25002
+        When inserting a new paragraph, avoid nesting empty divs.  When
+        pasting near the end of a paragraph, this prevents each paste
+        command for getting nested one level deeper.
 
-        * css/CSSValueList.cpp:
-        (WebCore::CSSValueList::hasValue): True if the property contains the specified value
-        * css/CSSValueList.h: Updated prototype
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::StyleChange::init): No longer adds "text-decoration: none"
-        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle): Supports text-decoration-related elements
+        Test: editing/inserting/paragraph-outside-nested-divs.html
 
-2009-07-23  Jessie Berlin  <jberlin@apple.com>
-        
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27554
-        Expose the value of text-overflow in getComputedStyle.
-
-        Test: fast/css/getComputedStyle/getComputedStyle-text-overflow.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        Add text-overflow to the list of computedProperties.
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        Return the value of the text-overflow property.
-
-2009-07-23  Yongjun Zhang  <yongjun.zhang@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27510
-
-        [S60 QtWebKit] Don't put some intermediate generated files into the final mmp project
-        file for linking. This is a temporary workaround for qmake bug in Symbian port, should 
-        be reverted after qmake is fixed.
-
-        * WebCore.pro:
-
-2009-07-23  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Fix an assert in running workers in Chrome.
-        https://bugs.webkit.org/show_bug.cgi?id=27620
-
-        The fix is to change V8DOMMap::removeAllDOMObjectsInCurrentThreadHelper
-        to do not call removeObjectsFromWrapperMap for certain types of DOM
-        objects that exist only in main thread.
-
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
-
-2009-07-23  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27572
-        Implement support for background-attachment:local.
-
-        Added new test fast/overflow/overflow-with-local-attachment.html.
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFillProperty):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator EFillAttachment):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::mapFillAttachment):
-        * css/CSSValueKeywords.in:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
-        * rendering/style/FillLayer.h:
-        (WebCore::FillLayer::attachment):
-        (WebCore::FillLayer::setAttachment):
-        (WebCore::FillLayer::hasFixedImage):
-        (WebCore::FillLayer::initialFillAttachment):
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::backgroundAttachment):
-        (WebCore::InheritedFlags::maskAttachment):
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::highestVisuallyEquivalentDiv):
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
 
-2009-07-23  Ryosuke Niwa  <rniwa@webkit.org>
+2010-02-04  Dumitru Daniliuc  <dumi@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        copyInheritableProperties and removeComputedInheritablePropertiesFrom should be deprecated
-        https://bugs.webkit.org/show_bug.cgi?id=27325
-
-        This patch deprecates copyInheritableProperties because it has been used for two different purposes:
-        1.  Calculating the typing style.
-        2.  Moving HTML subtrees and seeking to remove redundant styles.
-        These tasks should be broken out into two separate functions.  New code should not use this function.
-
-        It deletes removeComputedInheritablePropertiesFrom because it hasn't been used anywhere.
-
-        There is no test since the patch does not change any behavior.
-
-        * css/CSSComputedStyleDeclaration.cpp: removeComputedInheritablePropertiesFrom has been removed
-        (WebCore::CSSComputedStyleDeclaration::deprecatedCopyInheritableProperties): has been renamed from copyInheritableProperties
-        * css/CSSComputedStyleDeclaration.h: ditto
-        * editing/DeleteSelectionCommand.cpp: ditto
-        (WebCore::removeEnclosingAnchorStyle): ditto
-        (WebCore::DeleteSelectionCommand::saveTypingStyleState): ditto
-        * editing/EditCommand.cpp: ditto
-        (WebCore::EditCommand::styleAtPosition): ditto
-        * editing/RemoveFormatCommand.cpp: ditto
-        (WebCore::RemoveFormatCommand::doApply): ditto
-        * editing/ReplaceSelectionCommand.cpp: ditto
-        (WebCore::handleStyleSpansBeforeInsertion): ditto
-        (WebCore::ReplaceSelectionCommand::handleStyleSpans): ditto
-        * editing/markup.cpp: ditto
-        (WebCore::removeEnclosingMailBlockquoteStyle): ditto
-        (WebCore::removeDefaultStyles): ditto
-        (WebCore::createMarkup): ditto
-
-2009-07-22  Pierre d'Herbemont  <pdherbemont@apple.com>
+        1. Fix a bug in SQLiteTransaction: do not assume that COMMIT always
+        succeeds.
+        2. Jump straight to the transaction error callback when a
+        statement fails in a way that makes sqlite automatically rollback
+        the transaction.
+        3. Fix the code that handles the "quota reached" failure, as it is
+        one of the failures that lead to an automatic transaction
+        rollback.
 
-        Reviewed by Simon Fraser.
-
-        Audio element at default width shouldn't have time field.
-        https://bugs.webkit.org/show_bug.cgi?id=27589
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlTimeDisplayElement::setVisible): Make sure we don't
-        forget to remember the visibility if there is no renderer.
-
-2009-07-23  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27598 Clean up the 
-        AccessibilityObject class
-
-        Mostly this is just moving empty stubs into the header rather than 
-        muddying the cpp file with them. A few functions were made pure 
-        virtual.
-
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::isARIAControl):
-        (WebCore::AccessibilityObject::clickPoint):
-        (WebCore::AccessibilityObject::documentFrameView):
-        (WebCore::AccessibilityObject::actionVerb):
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::intValue):
-        (WebCore::AccessibilityObject::layoutCount):
-        (WebCore::AccessibilityObject::doAccessibilityHitTest):
-        (WebCore::AccessibilityObject::focusedUIElement):
-        (WebCore::AccessibilityObject::firstChild):
-        (WebCore::AccessibilityObject::lastChild):
-        (WebCore::AccessibilityObject::previousSibling):
-        (WebCore::AccessibilityObject::nextSibling):
-        (WebCore::AccessibilityObject::parentObjectIfExists):
-        (WebCore::AccessibilityObject::observableObject):
-        (WebCore::AccessibilityObject::linkedUIElements):
-        (WebCore::AccessibilityObject::titleUIElement):
-        (WebCore::AccessibilityObject::ariaRoleAttribute):
-        (WebCore::AccessibilityObject::isPresentationalChildOfAriaRole):
-        (WebCore::AccessibilityObject::ariaRoleHasPresentationalChildren):
-        (WebCore::AccessibilityObject::roleValue):
-        (WebCore::AccessibilityObject::ariaAccessiblityName):
-        (WebCore::AccessibilityObject::ariaLabeledByAttribute):
-        (WebCore::AccessibilityObject::ariaDescribedByAttribute):
-        (WebCore::AccessibilityObject::accessibilityDescription):
-        (WebCore::AccessibilityObject::ariaSelectedTextDOMRange):
-        (WebCore::AccessibilityObject::axObjectCache):
-        (WebCore::AccessibilityObject::axObjectID):
-        (WebCore::AccessibilityObject::setAXObjectID):
-        (WebCore::AccessibilityObject::anchorElement):
-        (WebCore::AccessibilityObject::actionElement):
-        (WebCore::AccessibilityObject::boundingBoxRect):
-        (WebCore::AccessibilityObject::selectedTextRange):
-        (WebCore::AccessibilityObject::selectionStart):
-        (WebCore::AccessibilityObject::selectionEnd):
-        (WebCore::AccessibilityObject::url):
-        (WebCore::AccessibilityObject::selection):
-        (WebCore::AccessibilityObject::stringValue):
-        (WebCore::AccessibilityObject::title):
-        (WebCore::AccessibilityObject::helpText):
-        (WebCore::AccessibilityObject::textUnderElement):
-        (WebCore::AccessibilityObject::text):
-        (WebCore::AccessibilityObject::textLength):
-        (WebCore::AccessibilityObject::selectedText):
-        (WebCore::AccessibilityObject::accessKey):
-        (WebCore::AccessibilityObject::widget):
-        (WebCore::AccessibilityObject::widgetForAttachmentView):
-        (WebCore::AccessibilityObject::setFocused):
-        (WebCore::AccessibilityObject::setSelectedText):
-        (WebCore::AccessibilityObject::setSelectedTextRange):
-        (WebCore::AccessibilityObject::setValue):
-        (WebCore::AccessibilityObject::setSelected):
-        (WebCore::AccessibilityObject::makeRangeVisible):
-        (WebCore::AccessibilityObject::childrenChanged):
-        (WebCore::AccessibilityObject::addChildren):
-        (WebCore::AccessibilityObject::hasChildren):
-        (WebCore::AccessibilityObject::selectedChildren):
-        (WebCore::AccessibilityObject::visibleChildren):
-        (WebCore::AccessibilityObject::visiblePositionRange):
-        (WebCore::AccessibilityObject::visiblePositionRangeForLine):
-        (WebCore::AccessibilityObject::boundsForVisiblePositionRange):
-        (WebCore::AccessibilityObject::setSelectedVisiblePositionRange):
-        (WebCore::AccessibilityObject::visiblePositionForPoint):
-        (WebCore::AccessibilityObject::nextVisiblePosition):
-        (WebCore::AccessibilityObject::previousVisiblePosition):
-        (WebCore::AccessibilityObject::visiblePositionForIndex):
-        (WebCore::AccessibilityObject::indexForVisiblePosition):
-        (WebCore::AccessibilityObject::index):
-        (WebCore::AccessibilityObject::doAXRangeForLine):
-        (WebCore::AccessibilityObject::doAXRangeForIndex):
-        (WebCore::AccessibilityObject::doAXStringForRange):
-        (WebCore::AccessibilityObject::doAXBoundsForRange):
-        (WebCore::AccessibilityObject::updateBackingStore):
-
-2009-07-23  Brian Weinstein  <bweinstein@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34280
 
-        Reviewed by David Hyatt.
-
-        Fix of <rdar://4877658> Dragging from the area between the horizontal/vertical scrollbars when status bar is showing starts a selection and autoscroll.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMousePressEvent):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::wheelEvent):
-        * platform/ScrollView.h:
-
-2009-07-23  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27581
-        Drop the prefix from the box-shadow property.
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::ShadowParseContext::commitLength):
-        (WebCore::cssPropertyID):
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap):
-
-2009-07-22  Viet-Trung Luu  <viettrungluu@gmail.com>
-
-        Reviewed by David Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27289
-        When a mouse click occurs on a scrollbar without a preceding mouse move
-        onto it, the release isn't handled correctly (since
-        EventHandler::m_lastScrollbarUnderMouse isn't set on mouse down, but
-        only on mouse move). (Side comment: That scrollbar-handling code
-        in EventHandler is ugly. It should be fixed properly.)
-
-        Tests: scrollbars/scrollbar-miss-mousemove.html
-               scrollbars/scrollbar-miss-mousemove-disabled.html
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        (WebCore::EventHandler::updateLastScrollbarUnderMouse):
-        * page/EventHandler.h:
-
-2009-07-23  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by David Levin.
-
-        Update WebCore/page/BarInfo.cpp to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27606
-
-        * page/BarInfo.cpp:
-        (WebCore::BarInfo::visible):
-
-2009-07-23  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by David Levin.
-
-        Update WebCore/page/Console.cpp to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27606
-
-        * page/Console.cpp:
-        (WebCore::printMessageSourceAndLevelPrefix):
-        (WebCore::Console::profile):
-        (WebCore::Console::time):
-
-2009-07-23  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Fix crashes with the QObject bindings after garbage collection.
-
-        There is one QtInstance per wrapped QObject, and that QtInstance keeps
-        references to cached JSObjects for slots. When those objects get
-        deleted due to GC, then they becoming dangling pointers.
-
-        When a cached member dies, it is now removed from the QtInstance's
-        cache.
-
-        As we cannot track the lifetime of the children, we have to remove
-        them from QtInstance alltogether. They are not cached and were
-        only used for mark(), but we _want_ them to be subject to gc.
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::~QtInstance): Minor coding style cleanup,
-        use qDeleteAll().
-        (JSC::Bindings::QtInstance::removeCachedMethod): New function, to
-        clean m_methods and m_defaultMethod.
-        (JSC::Bindings::QtInstance::mark): Avoid marking already marked objects.
-        (JSC::Bindings::QtField::valueFromInstance): Don't save children for
-        marking.
-        * bridge/qt/qt_instance.h: Declare removeCachedMethod.
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtRuntimeMethod::~QtRuntimeMethod): Call removeCachedMethod
-        with this on the instance.
-
-2009-07-23  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27599
-        'const unsigned' in return value
-
-        Remove const modifier from unsigned return value, as it does not
-        make sense.
-
-        * dom/ErrorEvent.h:
-
-2009-07-22  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by David Levin.
-
-        Bug 22784: Improve keyboard navigation of Select elements.
-        Home/End and PageUp/PageDn buttons do not do anything in drop down lists,
-        on non-Mac platforms.
-        https://bugs.webkit.org/show_bug.cgi?id=22784
-        http://code.google.com/p/chromium/issues/detail?id=4576
-
-        New test: LayoutTests/fast/forms/select-popup-pagekeys.html
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::isAutoCommitOn):
+        * platform/sql/SQLiteDatabase.h:
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::begin):
+        (WebCore::SQLiteTransaction::commit):
+        (WebCore::SQLiteTransaction::rollback):
+        (WebCore::SQLiteTransaction::transactionWasRolledBackBySqlite):
+        * platform/sql/SQLiteTransaction.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::runStatements):
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::handleCurrentStatementError):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
 
-        * dom/SelectElement.cpp:
-        (WebCore::nextValidIndex): 
-        New utility fn for traversing items of a select's list.
-        (WebCore::SelectElement::menuListDefaultEventHandler):
-        Added code to handle Home/End and PageUp/PageDn when ARROW_KEYS_POP_MENU is false.
+2010-02-04  Peter Kasting  <pkasting@google.com>
 
-2009-07-23  Xan Lopez  <xlopez@igalia.com>
+        Not reviewed, rollback.
 
-        Reviewed by Mark Rowe.
+        Rollback r54387, it doesn't fix builds and Chromium doesn't want this behavior.
 
-        Fix a couple of compiler warnings.
+        * platform/chromium/ScrollbarThemeChromiumMac.h:
 
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (copySurface):
-        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
-        (WebCore::SimpleFontData::containsCharacters):
+2010-02-04  Stephen White  <senorblanco@chromium.org>
 
-2009-07-22  Simon Hausmann  <simon.hausmann@nokia.com>
+        Unreviewed, build fix.
 
-        Rubber-stamped by David Levin.
+        Fix for Chromium/Mac after palindromic scrollbar change (54345).
 
-        Enable HTML5 Datagrid defines for the Qt build.
+        Covered by many layout tests.
 
-        * WebCore.pro:
+        * platform/chromium/ScrollbarThemeChromiumMac.h:
+        (WebCore::ScrollbarThemeChromiumMac::maxOverlapBetweenPages):
 
-2009-07-22  Adam Barth  <abarth@webkit.org>
+2010-02-04  Clemmitt Sigler  <cmsigler@gmail.com>
 
         Reviewed by David Levin.
 
-        [V8] Make Node wrappers go fast
-        https://bugs.webkit.org/show_bug.cgi?id=27597
-
-        Profiles indicate we're spending a lot of time asking whether we're on
-        the main thread when looking up DOM wrappers for Nodes, but there isn't
-        much point in doing that work because Nodes only exist on the main
-        thread.  I've also added an assert to keep us honest in this regard.
-
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::):
-        (WebCore::getDOMNodeMap):
-        (WebCore::DOMData::getCurrent):
-        (WebCore::DOMData::getCurrentMainThread):
-
-2009-07-22  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Remove unneeded virtual destructor from ScriptSourceProvider
-        https://bugs.webkit.org/show_bug.cgi?id=27563
-
-        * bindings/js/ScriptSourceProvider.h:
-
-2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        execCommand('underline' / 'strikeThrough') doesn't work properly with multiple styles in text-decoration
-        https://bugs.webkit.org/show_bug.cgi?id=27476
-
-        executeStrikethrough and executeUnderline were toggling between "line-through" / "underline" and "none".
-        This patch adds executeToggleStyleInList that toggles a style in CSSValueList instead of toggling the entire value.
-        It modifies CSSComputedStyleDeclaration to return CSSValueList instead of CSSPrimitiveValue for text decorations,
-        and adds removeAll member function to CSSValueList.
-
-        Tests: editing/execCommand/toggle-text-decorations.html
-               fast/css/getComputedStyle/getComputedStyle-text-decoration.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::renderTextDecorationFlagsToCSSValue): Creates a CSSValueList
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Returns a CSSValueList instead of CSSValue
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue): Text decorations are space separated instead of comma separated
-        * css/CSSValueList.cpp:
-        (WebCore::CSSValueList::removeAll): Removes all values that match the specified value
-        * css/CSSValueList.h:
-        * editing/EditorCommand.cpp:
-        (WebCore::applyCommandToFrame): Apply style to a frame using specified command
-        (WebCore::executeApplyStyle): Uses applyCommandToFrame
-        (WebCore::executeToggleStyleInList): Uses applyCommandToFrame
-        (WebCore::executeToggleStyle): Toggles a style in CSSValueList
-        (WebCore::executeStrikethrough): Uses executeToggleStyleInList
-        (WebCore::executeUnderline): Uses executeToggleStyleInList
-
-2009-07-22  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27174
-        And
-        https://bugs.webkit.org/show_bug.cgi?id=26938
+        WebKitGTK doesn't build GtkLauncher when --enable-mathml is specified.
+        Updated WebCore/GNUmakefile.am to include needed files in build.
         
-        Code cleanup. Implements support for detecting attacks transformed by 
-        PHP Magic Quotes/PHP addslashes().
-
-        Tests: http/tests/security/xssAuditor/script-tag-addslashes-backslash.html
-               http/tests/security/xssAuditor/script-tag-addslashes-double-quote.html
-               http/tests/security/xssAuditor/script-tag-addslashes-null-char.html
-               http/tests/security/xssAuditor/script-tag-addslashes-single-quote.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::isInvalidCharacter):
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::normalize): Decodes HTML entities, removes backslashes,
-        and removes control characters that could otherwise cause a discrepancy between
-        the source code of a script and the outgoing HTTP parameters.
-        (WebCore::XSSAuditor::decodeURL):
-        (WebCore::XSSAuditor::decodeHTMLEntities):
-        (WebCore::XSSAuditor::findInRequest):
-        * page/XSSAuditor.h:
-
-2009-07-22  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Null deref in JSObject::mark due to null xhr wrapper
-        https://bugs.webkit.org/show_bug.cgi?id=27565
-
-        Make event target binding for appcache and xhr behave in the same way as
-        it does for all other events.
-
-        No test as I couldn't make a testcase which was remotely reliable.
-
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-
-2009-07-22  Mads Ager  <ager@chromium.org>
-
-        Reviewed by David Levin.
-
-        Inform V8 of the amount of WebCore string memory it is keeping alive.
-        https://bugs.webkit.org/show_bug.cgi?id=27537
-
-        V8 uses external strings that are backed by WebCore strings. Since
-        the external strings themselves are small, V8 has no way of
-        knowing how much memory it is actually holding on to. With this
-        change, we inform V8 of the amount of WebCore string data it is
-        holding on to with external strings.
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::WebCoreStringResource::WebCoreStringResource):
-        (WebCore::WebCoreStringResource::~WebCoreStringResource):
-
-2009-07-22  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27562
-        Add the finalized versions of background-clip and background-origin.  Remove background-clip from
-        the background shorthand and have it be auto-set based off background-origin's value.
-
-        Three new tests added in fast/backgrounds/size
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseFillShorthand):
-        (WebCore::CSSParser::parseFillProperty):
-        * css/CSSPropertyLonghand.cpp:
-        (WebCore::initShorthandMap):
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * css/CSSValueKeywords.in:
-
-2009-07-22  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Hook up V8 bindings for DataGrid elements.
-        https://bugs.webkit.org/show_bug.cgi?id=27383
-        http://code.google.com/p/chromium/issues/detail?id=16730
-
-        Tests: Enhanced LayoutTests/fast/dom/HTMLDataGridElement/*
-        to handle exceptions, check appropriate JS prototypes, and
-        test column-list's item() method as well as array-indexing.
-
-        * WebCore.gypi: Added new source files.
-        * bindings/scripts/CodeGeneratorV8.pm: Made GenerateBatchedAttributeData put #if's around conditional attributes.
-        * bindings/v8/DOMObjectsInclude.h: #include DataGrid headers.
-        * bindings/v8/V8DOMWrapper.cpp: Add bindings from HTML tags to datagrid templates.
-        (WebCore::V8DOMWrapper::getTemplate): Customize datagrid template.
-        * bindings/v8/V8DataGridDataSource.cpp: Added. (Based on JSDataGridDataSource)
-        (WebCore::V8DataGridDataSource::V8DataGridDataSource):
-        (WebCore::V8DataGridDataSource::~V8DataGridDataSource):
-        * bindings/v8/V8DataGridDataSource.h: Added. (Based on JSDataGridDataSource)
-        (WebCore::V8DataGridDataSource::create):
-        (WebCore::V8DataGridDataSource::isJSDataGridDataSource):
-        (WebCore::V8DataGridDataSource::jsDataSource):
-        (WebCore::asV8DataGridDataSource):
-        * bindings/v8/V8GCController.h: Added new handle type "DATASOURCE".
-        * bindings/v8/V8Index.h: Conditionalize datagrid stuff.
-        * bindings/v8/custom/V8CustomBinding.h: Declare more accessors. Conditionalize.
-        * bindings/v8/custom/V8DataGridColumnListCustom.cpp: Added.
-        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Fill in dataSource accessors.
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-
-2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=34387
 
-        pushDownTextDecorationStyleAroundNode needs clean up
-        https://bugs.webkit.org/show_bug.cgi?id=27556
-
-        Cleaned up. pushDownTextDecorationStyleAroundNode traverses tree vertically from highestAncestor to targetNode
-        While traversing, it will apply the specified style to all nodes but targetNode.
-        i.e. the style is applies to all ancestor nodes and their siblings of targetNode.
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::ApplyStyleCommand::pushDownTextDecorationStyleAroundNode): Cleaned up and added comments
-        * editing/ApplyStyleCommand.h: Updated prototype
-
-2009-07-22  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by David Kilzer.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27323
-        Handle any type of line endings in WebCore/css/*CSSPropertyNames.in.
-
-        * DerivedSources.make:
-        * css/makeprop.pl:
-        * css/makevalues.pl:
-
-2009-07-22  Paul Godavari  <paul@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Chromium has a build break after removal of JSRGBColor bindings
-        https://bugs.webkit.org/show_bug.cgi?id=27548
-
-        Fix a build break in Chromium V8 after the JSRGBColor bindings change:
-        https://bugs.webkit.org/show_bug.cgi?id=27242
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-
-2009-07-22  Adam Langley  <agl@google.com>
-
-        Reviewed by Darin Fisher.
-
-        Chromium Linux: add static functions to FontPlatformData which allow
-        for setting the global font rendering preferences.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27513
-        http://code.google.com/p/chromium/issues/detail?id=12179
-
-        This should not affect any layout tests.
-
-        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
-        (WebCore::FontPlatformData::setHinting):
-        (WebCore::FontPlatformData::setAntiAlias):
-        (WebCore::FontPlatformData::setSubpixelGlyphs):
-        (WebCore::FontPlatformData::setupPaint):
-        * platform/graphics/chromium/FontPlatformDataLinux.h:
-
-2009-07-22  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Move Inspector panels creation into a function to make possible introducing
-        custom panels.
-
-        * inspector/front-end/inspector.js:
-        (WebInspector._createPanels):
-        (WebInspector.loaded):
-
-2009-07-22  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Print console command message upon evaluate
-        selection request; Handle errors in evaluation request
-        properly.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27535
-
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
-
-2009-07-22  Xan Lopez  <xlopez@igalia.com>
-
-        Attempt to fix the GTKbuild.
-
-        * GNUmakefile.am:
-
-2009-07-21  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Fix the Qt build.
-
-        * WebCore.pro: Add RGBColor.cpp to the build, remove JSRGBColor.
-
-2009-07-21  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27494
-
-        Fixes an issue that can cause a crash or unexpected behavior when calling
-        WebCore::ScriptSourceCode::source on a cached script.
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/CachedScriptSourceProvider.h: Modified to inherit from 
-        WebCore::ScriptSourceCode.
-        (WebCore::CachedScriptSourceProvider::source):
-        (WebCore::CachedScriptSourceProvider::CachedScriptSourceProvider):
-        * bindings/js/ScriptSourceCode.h:
-        (WebCore::ScriptSourceCode::ScriptSourceCode): Separated out source provider and
-        rewrote to use WebCore::ScriptSourceProvider.
-        (WebCore::ScriptSourceCode::source):
-        * bindings/js/ScriptSourceProvider.h: Added.
-        (WebCore::ScriptSourceProvider::ScriptSourceProvider):
-        (WebCore::ScriptSourceProvider::~ScriptSourceProvider):
-        * bindings/js/StringSourceProvider.h: Modified to inherit from 
-        WebCore::ScriptSourceCode.
-        (WebCore::StringSourceProvider::StringSourceProvider):
-
-2009-07-21  Sam Weinig  <sam@webkit.org>
-
-        Another attempt to fix the Windows build.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-07-21  Sam Weinig  <sam@webkit.org>
-
-        Attempt to fix the Windows build.
-
-        * DerivedSources.cpp:
-
-2009-07-21  Sam Weinig  <sam@webkit.org>
-
-        Attempt to fix the GTK build.
-
-        * GNUmakefile.am:
-
-2009-07-21  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Autogenerate Objective-C binding implementation for RGBColor.
-
-        No functionality change.
-
-        * WebCore.xcodeproj/project.pbxproj: 
-        * bindings/objc/DOMRGBColor.mm: Removed.
-        * bindings/scripts/CodeGeneratorObjC.pm: Add logic to convert from
-        WebCore::Color to NSColor*.
-        * css/RGBColor.idl:
-
-2009-07-21  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27242
-        JSC bindings should use an auto-bound RGBColor class instead of hand-rolled JSRGBColor
-
-        Move the JSC and Objective-C bindings onto using the RGBColor object instead
-        of just an unsigned int. The JSC bindings are now completely autogenerated for
-        this class. (Also removes the last lut from WebCore).
+        No new tests.
 
-        * DerivedSources.make:
         * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSRGBColor.cpp: Removed.
-        * bindings/js/JSRGBColor.h: Removed.
-        * bindings/objc/DOM.mm:
-        (-[DOMRGBColor _color]):
-        * bindings/objc/DOMRGBColor.mm:
-        (-[DOMRGBColor dealloc]):
-        (-[DOMRGBColor finalize]):
-        (-[DOMRGBColor red]):
-        (-[DOMRGBColor green]):
-        (-[DOMRGBColor blue]):
-        (-[DOMRGBColor alpha]):
-        (-[DOMRGBColor color]):
-        * bindings/scripts/CodeGenerator.pm:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bindings/scripts/CodeGeneratorObjC.pm:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseColor):
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::getRGBColorValue):
-        * css/CSSPrimitiveValue.h:
-        (WebCore::CSSPrimitiveValue::getRGBA32Value):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
-        * css/RGBColor.cpp:
-        (WebCore::RGBColor::alpha):
-        * css/RGBColor.h:
-        (WebCore::RGBColor::color):
-        (WebCore::RGBColor::RGBColor):
-        * css/RGBColor.idl:
-        * page/DOMWindow.idl:
-        * svg/SVGColor.cpp:
-        (WebCore::SVGColor::rgbColor):
-        * svg/SVGColor.h:
 
-2009-07-21  Jian Li  <jianli@chromium.org>
+2010-02-04  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by David Levin.
 
-        Implement AbstractWorker::dispatchScriptErrorEvent by generating an ErrorEvent.
-        https://bugs.webkit.org/show_bug.cgi?id=27515
-
-        * workers/AbstractWorker.cpp:
-        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
-
-2009-07-21  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Move m_context out of generator into a superclass
-        https://bugs.webkit.org/show_bug.cgi?id=27521
-
-        Mostly this is removing code from CodeGeneratorJS
-        and instead using a DOMObjectWithSVGContext superclass in JSDOMBinding.h.
-
-        DOMObjectWithSVGContext.h is its own file so that WebKit doesn't need to
-        know about SVGElement.h (WebKit includes JSDOMBinding.h for some reason).
-
-        I also removed context pointer from SVGZoomEvent since it was never used.
-
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/DOMObjectWithSVGContext.h: Added.
-        (WebCore::DOMObjectWithSVGContext::context):
-        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/CodeGeneratorJS.pm:
-
-2009-07-21  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        REGRESSION (r46142):  editing/execCommand/19087.html & editing/execCommand/19653-1.html fail in Windows build
-        https://bugs.webkit.org/show_bug.cgi?id=27480
-
-        Because m_anchorType : 2 is treated as a signed integer by cl.exe, anchorType() wasn't returning the correct value.
-        We made m_anchorType unsigned so that anchorType() returns the correct value.
-
-        * dom/Position.h:
-        (WebCore::Position::anchorType): statically cast to AnchorType
-
-2009-07-21  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Add V8 bindings for onerror in WorkerContext.
-        https://bugs.webkit.org/show_bug.cgi?id=27518
-
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-
-2009-07-21  Jian Li  <jianli@chromium.org>
-
-        Fix the incorrect patch being landed for bug 27516 that has already been reviewed.
-        https://bugs.webkit.org/show_bug.cgi?id=27516
-
-        * workers/WorkerContext.h:
-        (WebCore::WorkerContext::setOnerror):
-        (WebCore::WorkerContext::onerror):
-        * workers/WorkerContext.idl:
-
-2009-07-21  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        Add onerror to WorkerContext.
-        https://bugs.webkit.org/show_bug.cgi?id=27516
-
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::mark):
-        * workers/WorkerContext.h:
-        (WebCore::WorkerContext::setOnerror):
-        (WebCore::WorkerContext::onerror):
-        * workers/WorkerContext.idl:
-
-2009-07-21  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by George Staikos.
+        Misc coding style fixes in Haiku port code.
+        https://bugs.webkit.org/show_bug.cgi?id=34527
 
-        https://bugs.webkit.org/show_bug.cgi?id=27509
-        Add font-related files for the WinCE port.
+        No tests needed.
 
-        Written by Yong Li <yong.li@torchmobile.com>
+        * platform/haiku/ContextMenuItemHaiku.cpp: Trailing white space, NULL -> 0
+        * platform/haiku/DragImageHaiku.cpp: Trailing white space.
+        * platform/haiku/FileChooserHaiku.cpp: Sorted headers.
+        * platform/haiku/LocalizedStringsHaiku.cpp: Needed to include NotImplemented.h
 
-        * platform/graphics/wince/FontCacheWince.cpp: Added.
-        * platform/graphics/wince/FontCustomPlatformData.cpp: Added.
-        * platform/graphics/wince/FontCustomPlatformData.h: Added.
-        * platform/graphics/wince/FontPlatformData.cpp: Added.
-        * platform/graphics/wince/FontPlatformData.h: Added.
-        * platform/graphics/wince/FontWince.cpp: Added.
-        * platform/graphics/wince/GlyphPageTreeNodeWince.cpp: Added.
-        * platform/graphics/wince/SimpleFontDataWince.cpp: Added.
+2010-02-04  Enrica Casucci  <enrica@apple.com>
 
-2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
+        Reviewed by Csaba Osztrogonac.
 
-        Fix the Windows build, and update the comment on top now that wx uses WebCorePrefix.h too.
+        Fixed crash on QT introduced with the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=34609
 
-        * WebCorePrefix.h:
-
-2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
-
-        WebCorePrefix.h build fixes for non-Mac and wx / CURL builds.
-
-        * WebCorePrefix.h:
-
-2009-07-21  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        All DOMConstructorObjects should hold a pointer to the JSDOMGlobalObject
-        https://bugs.webkit.org/show_bug.cgi?id=27478
-
-        This is just moving code.
-        I've added two new classes: DOMObjectWithGlobalPointer and DOMConstructorWithDocument.
-
-        DOMObjectWithGlobalPointer is a new baseclass for DOMConstructorObject.
-        (It's a baseclass because eventually all DOMObjects will have a global pointer, but
-        I'll be moving them onto DOMObjectWithGlobalPointer in stages.)
-
-        DOMConstructorWithDocument is a new baseclass for the 3 constructor objects
-        which require a backpointer to the Document to function.  I made this a subclass of
-        DOMConstructorObject to make clear that most constructors can hold no-such assumptions
-        about having a back-pointer to the Document (since many constructors can be used from Workers).
-
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::JSAudioConstructor::JSAudioConstructor):
-        * bindings/js/JSAudioConstructor.h:
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::globalObject):
-        (WebCore::DOMObjectWithGlobalPointer::scriptExecutionContext):
-        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
-        (WebCore::DOMObjectWithGlobalPointer::mark):
-        (WebCore::DOMConstructorObject::DOMConstructorObject):
-        (WebCore::DOMConstructorWithDocument::document):
-        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::JSImageConstructor):
-        * bindings/js/JSImageConstructor.h:
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
-        * bindings/js/JSMessageChannelConstructor.h:
-        * bindings/js/JSOptionConstructor.cpp:
-        (WebCore::JSOptionConstructor::JSOptionConstructor):
-        * bindings/js/JSOptionConstructor.h:
-        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
-        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
-        * bindings/js/JSWebKitPointConstructor.cpp:
-        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
-        * bindings/js/JSXMLHttpRequestConstructor.h:
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
-
-2009-07-21  James Hawkins  <jhawkins@google.com>
-
-        Reviewed by David Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27453
-        Initialize isInt when creating a CSSParserValue for a function.
-
-        No change in behavior, so no tests.
-
-        * css/CSSFunctionValue.cpp:
-        (WebCore::CSSFunctionValue::parserValue):
-
-2009-07-20  Jens Alfke  <snej@google.com>
- 
-         Reviewed by David Levin.
- 
-         Bug 27448: [Chromium] On Mac, arrow keys should cause Select to pop up its menu.
-         Mac build of Chromium doesn't follow Mac HI guidelines to pop up the menu when
-         an arrow key is pressed.
-         https://bugs.webkit.org/show_bug.cgi?id=27448
- 
-         No new tests; affects only control response to user input.
- 
-         * dom/SelectElement.cpp:
-         Changed definition of ARROW_KEYS_POP_MENU to make it true in Mac Chromium,
-         so it will behave compatibly with Mac HI guidelines on pop-up menus.
-         It's not possible to have PLATFORM(MAC) be true in the Mac build of Chromium.
- 
-2009-07-21  Paul Godavari  <paul@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        [Chromium] popup menus can crash when the selected index is -1
-        https://bugs.webkit.org/show_bug.cgi?id=27275
-
-        Crash reports from users indicate a crash can occur when PopupListBox::isSelectableItem
-        is passed an index of less than 0 (which is possible under certain circumstances). This
-        change prevents such a value from causing a crash by enforcing valid index values passed
-        by all callers of isSelectableItem. isSelectableItem is now a private method of
-        PopupListBox, as there are no external callers.
-
-        Also cleaned up a small amount of code for style and grammar errors.
-
-        No automatic test is provided since we cannot send events to the child window used by
-        the popup menu.
-
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::acceptIndex):
-        (WebCore::PopupListBox::selectIndex):
-        (WebCore::PopupListBox::isSelectableItem):
-        (WebCore::PopupListBox::selectPreviousRow):
-
-2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix. Don't include winsock2.h on wx, it conflicts with wx's inclusion of winsock.
-
-        * platform/network/curl/ResourceHandleManager.h:
-
-2009-07-21  Adam Roben  <aroben@apple.com>
-
-        Roll out r46153, r46154, and r46155
-
-        These changes were causing build failures and assertion failures on
-        Windows.
-
-        * ForwardingHeaders/wtf/PossiblyNull.h: Removed.
-        * platform/graphics/cg/ImageBufferCG.cpp:
-
-2009-07-21  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Implement ErrorEvent API.
-        https://bugs.webkit.org/show_bug.cgi?id=27387
-
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * dom/ErrorEvent.cpp: Added.
-        * dom/ErrorEvent.h: Added.
-        * dom/ErrorEvent.idl: Added.
-        * dom/Event.cpp:
-        (WebCore::Event::isErrorEvent):
-        * dom/Event.h:
-
-2009-07-21  Priit Laes  <plaes@plaes.org>
+        The test has been added with the original patch.
+        
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::writePlainText): Added missing allocation of m_writeData.
 
-        Reviewed by Gustavo Noronha.
+2010-02-04  Christian Dywan  <christian@twotoasts.de>
 
-        [Gtk] Searching in thepiratebay.org doesn't work with more than 1 word
-        https://bugs.webkit.org/show_bug.cgi?id=24602
+        Reviewed by Xan Lopez.
 
-        Remove workaround required for <=libsoup-2.26.1
+        Conditionalize third party cookie policy for libsoup 2.29.90.
 
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::setCookies):
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS):
         * platform/network/soup/ResourceHandleSoup.cpp:
         (WebCore::restartedCallback):
+        (WebCore::startHttp):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        (WebCore::ResourceRequest::updateFromSoupMessage):
 
-2009-07-21  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by David Levin.
+2010-02-04  Christian Dywan  <christian@twotoasts.de>
 
-        V8IsolatedWorld keeps a handle to a disposed context
-        https://bugs.webkit.org/show_bug.cgi?id=27397
+        Rubber-stamped by Gustavo Noronha Silva.
 
-        Make a copy of the context handle before making it weak.  We don't want
-        to make the original handle weak because we want it to survive for the
-        length of the V8IsolatedWorld::evaluate method.
+        Add ENABLE(VIDEO) guards around freeOwnedGPtr<GstElement> implementation.
 
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * platform/gtk/GOwnPtrGtk.cpp:
 
-2009-07-21  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-04  Alexey Proskuryakov  <ap@apple.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Darin Adler.
 
-        Web Inspector: Add ability to evaluate selection while on break point.
+        Assertion failure in CheckedRadioButtons::removeButton when using jQuery 1.4.1
+        https://bugs.webkit.org/show_bug.cgi?id=34520
 
-        https://bugs.webkit.org/show_bug.cgi?id=27502
+        Test: fast/dom/HTMLInputElement/cloned-input-checked-state.html
 
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._loaded):
-        (WebInspector.SourceFrame.prototype._documentKeyDown):
+        * dom/Element.cpp: (WebCore::Element::cloneElementWithoutChildren): Copy non-attribute
+        properties before attributes. Otherwise, copying "checked" attribute would make the cloned
+        node checked, unchecking original (they share a name, and are thus in the same radio group).
+        We do want the original to be unchecked, but we also want to know its original state in
+        HTMLInputElement::copyNonAttributeProperties().
 
-2009-07-21  Pavel Feldman  <pfeldman@chromium.org>
+        * html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::copyNonAttributeProperties):
+        Use setChecked instead of plain assignment to prevent m_checked getting out of sync with
+        checkedRadioButtons. Also, copy field related to default checked state, so that m_checked
+        won't be overridden when copying attributes.
 
-        Reviewed by Timothy Hatcher.
+2010-02-04  Kevin Ollivier  <kevino@theolliviers.com>
 
-        WebInspector: Special case ConsolePanel opening since
-        it is a 'fast view'.
+        [wx] Build fix after addition of Clipboard::writePlainText method.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27493
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::writePlainText):
+        * platform/wx/ClipboardWx.h:
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setWindowVisible):
+2010-02-04  Enrica Casucci  <enrica@apple.com>
 
-2009-07-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Eric Seidel.
+        REGRESSION: Dragging plain text into a styled text region does not acquire the correct style info.
+        <rdar://problem/7595685>
+        https://bugs.webkit.org/show_bug.cgi?id=34609
 
-        Fix Qt code to follow the WebKit Coding Style.
+        Test: editing/pasteboard/drop-inputtext-acquires-style.html
 
-        * platform/graphics/qt/FontQt.cpp:
-        (WebCore::qstring):
-        (WebCore::fixSpacing):
-        * platform/graphics/qt/FontQt43.cpp:
-        (WebCore::generateComponents):
-        (WebCore::Font::offsetForPositionForComplexText):
-        (WebCore::cursorToX):
-        * platform/graphics/qt/GradientQt.cpp:
-        (WebCore::Gradient::platformGradient):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::toQtFillRule):
-        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
-        (WebCore::GraphicsContext::~GraphicsContext):
-        (WebCore::GraphicsContext::getCTM):
-        (WebCore::GraphicsContext::concatCTM):
-        (WebCore::GraphicsContext::getWindowsContext):
-        * platform/graphics/qt/IconQt.cpp:
-        (WebCore::Icon::paint):
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ReadContext::read):
-        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
-        (WebCore::ImageDecoderQt::setData):
-        * platform/graphics/qt/ImageQt.cpp:
-        (WebCore::Image::drawPattern):
-        (WebCore::BitmapImage::draw):
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::frameDurationAtIndex):
-        (WebCore::ImageSource::frameHasAlphaAtIndex):
-        (WebCore::ImageSource::frameIsCompleteAtIndex):
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::create):
-        (WebCore::MediaPlayerPrivate::bytesLoaded):
-        (WebCore::MediaPlayerPrivate::updateStates):
-        * platform/graphics/qt/PathQt.cpp:
-        (WebCore::Path::addArcTo):
-        (WebCore::Path::isEmpty):
-        * platform/graphics/qt/TransformationMatrixQt.cpp:
-        (WebCore::TransformationMatrix::operator QTransform):
+        The dragging code did not distinguish the case of dragging the content of an input control
+        as a special case. The markup placed in the pasteboard included the style information.
+        I've modified the Clipboard class interface adding a new method writePlainText to match the
+        behavior of the copy and cut commands and modified the drag code to detect the special case.
+        I've modified all the platform specific implementations of the Clipboard class.
+        
+        * dom/Clipboard.h: Added writePlainText pure virtual function.
+        * editing/Editor.cpp:
+        (WebCore::Editor::cut): Renamed nodeIsTextFormControl to isNodeInTextFormControl.
+        (WebCore::Editor::copy): Renamed nodeIsTextFormControl to isNodeInTextFormControl.
+        * editing/htmlediting.cpp:
+        (WebCore::isNodeInTextFormControl): Added, after removing the implementation with the old name
+        in Editor.cpp
+        * editing/htmlediting.h:
+        * page/DragController.cpp:
+        (WebCore::DragController::startDrag):
+        * platform/Pasteboard.h:
+        * platform/android/ClipboardAndroid.cpp:
+        (WebCore::ClipboardAndroid::writePlainText): Added.
+        * platform/android/ClipboardAndroid.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::writePlainText): Added.
+        * platform/chromium/ClipboardChromium.h:
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::writePlainText): Added.
+        * platform/gtk/ClipboardGtk.h:
+        * platform/haiku/ClipboardHaiku.cpp:
+        (WebCore::ClipboardHaiku::writePlainText): Added.
+        * platform/haiku/ClipboardHaiku.h:
+        * platform/mac/ClipboardMac.h:
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::writePlainText): Added.
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writePlainText): Added helper function.
         * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::ClipboardQt):
-        (WebCore::ClipboardQt::clearData):
-        (WebCore::ClipboardQt::clearAllData):
-        (WebCore::ClipboardQt::getData):
-        (WebCore::ClipboardQt::setData):
-        (WebCore::ClipboardQt::setDragImage):
-        (WebCore::getCachedImage):
-        (WebCore::ClipboardQt::declareAndWriteDragImage):
-        (WebCore::ClipboardQt::writeURL):
-        (WebCore::ClipboardQt::writeRange):
-        (WebCore::ClipboardQt::hasData):
+        (WebCore::ClipboardQt::writePlainText): Added.
         * platform/qt/ClipboardQt.h:
-        * platform/qt/ContextMenuItemQt.cpp:
-        (WebCore::ContextMenuItem::action):
-        (WebCore::ContextMenuItem::title):
-        * platform/qt/CursorQt.cpp:
-        (WebCore::westPanningCursor):
-        (WebCore::notAllowedCursor):
-        * platform/qt/DragDataQt.cpp:
-        (WebCore::DragData::containsFiles):
-        (WebCore::DragData::asFilenames):
-        (WebCore::DragData::asPlainText):
-        (WebCore::DragData::asFragment):
-        * platform/qt/DragImageQt.cpp:
-        (WebCore::createDragImageIconForCachedImage):
-        * platform/qt/FileSystemQt.cpp:
-        (WebCore::getFileSize):
-        (WebCore::unloadModule):
-        * platform/qt/Localizations.cpp:
-        (WebCore::contextMenuItemTagShowSpellingPanel):
-        * platform/qt/MIMETypeRegistryQt.cpp:
-        (WebCore::):
-        * platform/qt/PasteboardQt.cpp:
-        (WebCore::Pasteboard::Pasteboard):
-        (WebCore::Pasteboard::writeSelection):
-        (WebCore::Pasteboard::plainText):
-        * platform/qt/PlatformKeyboardEventQt.cpp:
-        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
-        * platform/qt/PlatformMouseEventQt.cpp:
-        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::populate):
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::fallbackStyle):
-        (WebCore::inflateButtonRect):
-        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
-        (WebCore::RenderThemeQt::paintButton):
-        (WebCore::RenderThemeQt::paintMenuList):
-        (WebCore::RenderThemeQt::applyTheme):
-        (WebCore::WorldMatrixTransformer::WorldMatrixTransformer):
-        (WebCore::RenderThemeQt::paintMediaBackground):
-        (WebCore::RenderThemeQt::paintMediaFullscreenButton):
-        * platform/qt/RenderThemeQt.h:
-        * platform/qt/ScreenQt.cpp:
-        (WebCore::screenRect):
-        (WebCore::usableScreenRect):
-        * platform/qt/ScrollbarQt.cpp:
-        (WebCore::Scrollbar::contextMenu):
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::scPart):
-        (WebCore::scrollbarPart):
-        * platform/qt/ScrollbarThemeQt.h:
-        * platform/qt/SharedBufferQt.cpp:
-        (WebCore::SharedBuffer::createWithContentsOfFile):
-        * platform/qt/TemporaryLinkStubs.cpp:
-        (PluginDatabase::defaultPluginDirectories):
-        (PluginDatabase::getPluginPathsInDirectories):
-        (PluginDatabase::isPreferredPluginDirectory):
-        (WebCore::getSupportedKeySizes):
-        (WebCore::signedPublicKeyAndChallengeString):
-        (WebCore::userIdleTime):
-        (WebCore::prefetchDNS):
-        * platform/text/qt/StringQt.cpp:
-        (WebCore::String::String):
-        * platform/text/qt/TextBoundaries.cpp:
-        * platform/text/qt/TextBreakIteratorQt.cpp:
-        (WebCore::TextBreakIterator::following):
-        (WebCore::TextBreakIterator::preceding):
-        (WebCore::WordBreakIteratorQt::first):
-        (WebCore::WordBreakIteratorQt::next):
-        (WebCore::WordBreakIteratorQt::previous):
-        (WebCore::CharBreakIteratorQt::first):
-        (WebCore::CharBreakIteratorQt::next):
-        (WebCore::CharBreakIteratorQt::previous):
-        (WebCore::characterBreakIterator):
-        * plugins/qt/PluginPackageQt.cpp:
-        (WebCore::PluginPackage::fetchInfo):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::userAgentStatic):
-        (WebCore::PluginView::handlePostReadFile):
-        (WebCore::PluginView::init):
-
-2009-07-21  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by David Levin.
-
-        Added a first bunch of Haiku-specific files for WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=26988
-
-        * platform/haiku/ClipboardHaiku.cpp: Added.
-        (WebCore::ClipboardHaiku::ClipboardHaiku):
-        (WebCore::ClipboardHaiku::clearData):
-        (WebCore::ClipboardHaiku::clearAllData):
-        (WebCore::ClipboardHaiku::getData):
-        (WebCore::ClipboardHaiku::setData):
-        (WebCore::ClipboardHaiku::types):
-        (WebCore::ClipboardHaiku::files):
-        (WebCore::ClipboardHaiku::dragLocation):
-        (WebCore::ClipboardHaiku::dragImage):
-        (WebCore::ClipboardHaiku::setDragImage):
-        (WebCore::ClipboardHaiku::dragImageElement):
-        (WebCore::ClipboardHaiku::setDragImageElement):
-        (WebCore::ClipboardHaiku::createDragImage):
-        (WebCore::ClipboardHaiku::declareAndWriteDragImage):
-        (WebCore::ClipboardHaiku::writeURL):
-        (WebCore::ClipboardHaiku::writeRange):
-        (WebCore::ClipboardHaiku::hasData):
-        * platform/haiku/ClipboardHaiku.h: Added.
-        (WebCore::ClipboardHaiku::create):
-        (WebCore::ClipboardHaiku::~ClipboardHaiku):
-        * platform/haiku/CookieJarHaiku.cpp: Added.
-        (WebCore::setCookies):
-        (WebCore::cookies):
-        (WebCore::cookiesEnabled):
-        * platform/haiku/CursorHaiku.cpp: Added.
-        (WebCore::Cursor::Cursor):
-        (WebCore::Cursor::~Cursor):
-        (WebCore::Cursor::operator=):
-        (WebCore::pointerCursor):
-        (WebCore::moveCursor):
-        (WebCore::crossCursor):
-        (WebCore::handCursor):
-        (WebCore::iBeamCursor):
-        (WebCore::waitCursor):
-        (WebCore::helpCursor):
-        (WebCore::eastResizeCursor):
-        (WebCore::northResizeCursor):
-        (WebCore::northEastResizeCursor):
-        (WebCore::northWestResizeCursor):
-        (WebCore::southResizeCursor):
-        (WebCore::southEastResizeCursor):
-        (WebCore::southWestResizeCursor):
-        (WebCore::westResizeCursor):
-        (WebCore::northSouthResizeCursor):
-        (WebCore::eastWestResizeCursor):
-        (WebCore::northEastSouthWestResizeCursor):
-        (WebCore::northWestSouthEastResizeCursor):
-        (WebCore::columnResizeCursor):
-        (WebCore::rowResizeCursor):
-        (WebCore::verticalTextCursor):
-        (WebCore::cellCursor):
-        (WebCore::contextMenuCursor):
-        (WebCore::noDropCursor):
-        (WebCore::copyCursor):
-        (WebCore::progressCursor):
-        (WebCore::aliasCursor):
-        (WebCore::noneCursor):
-        (WebCore::notAllowedCursor):
-        (WebCore::zoomInCursor):
-        (WebCore::zoomOutCursor):
-        (WebCore::grabCursor):
-        (WebCore::grabbingCursor):
-
-2009-07-21  Albert Astals Cid <aacid@kde.org>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Change #error line not to have a ' (single quote)
-
-        * DerivedSources.cpp:
-
-2009-07-21  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by David Levin.
-
-        Add ENABLE_RUBY to list of build options
-        https://bugs.webkit.org/show_bug.cgi?id=27324
-
-        Added flag ENABLE_RUBY:
-
-        * Configurations/FeatureDefines.xcconfig:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/build-generated-files.sh:
-
-2009-07-21  James Hawkins  <jhawkins@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27467
-        Return an empty path in PlatformContextSkia::currentPathInLocalCoordinates
-        if matrix.invert() fails.  This prevents the use of an uninitialized
-        value in inverseMatrix.
-
-        No new tests added.  Run
-        LayoutTests/svg/dynamic-updates/SVGMarkerElement-dom-markerHeight-attr.html
-        under valgrind and notice there are no errors.
-
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::currentPathInLocalCoordinates):
-
-2009-07-21  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27388
-
-        Fix dotted and dashed borders on Chromium/skia.  This follows
-        the logic in the Cg path, so results are much closer to Safari now 
-        (some tests won't be exactly the same due to font layout differences).
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawLine):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintForStroking):
-
-2009-07-20  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Make it harder to misuse try* allocation routines
-        https://bugs.webkit.org/show_bug.cgi?id=27469
-
-        Add forwarding header for PossiblyNull type, and add missing null check
-        to ImageBuffer creation.
-
-        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-
-2009-07-20  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Guard access to installedMediaEngines()[0].
-
-        https://bugs.webkit.org/show_bug.cgi?id=27479
-        http://code.google.com/p/chromium/issues/detail?id=16541
-
-        Else where in the file, installedMediaEngines is always checked for
-        being empty because access. This patch adds a case which missed that
-        check.
-
-        This triggered a crash in Chromium:
-            http://www.yakeze.com/chat/example-chromium-crash/
-
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::load):
-
-2009-07-20  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Allow search entries to render with a CSS border if the RenderTheme
-        doesn't paint them.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27466
-        http://code.google.com/p/chromium/issues/detail?id=16958
-
-        <input type="search"> is very much like a text entry except that,
-        currently, if the RenderTheme doesn't deal with it, nothing is
-        rendered. With this patch, the default CSS border is rendered if the
-        RenderTheme requests it.
-
-        This will affect many layout tests, but only for Chromium Linux and
-        those results are not currently in the WebKit tree.
-
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::paintBorderOnly):
-
-2009-07-17  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Switch to faster methods to access internal fields.
-        https://bugs.webkit.org/show_bug.cgi?id=27372
-
-        Minor refactoring.
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
-        (WebCore::V8DOMWrapper::setDOMWrapper):
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
-        (WebCore::V8DOMWrapper::convertToNativeObject):
-        (WebCore::V8DOMWrapper::convertToNativeEvent):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ClipboardCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-20  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Chromium Linux: cache Harfbuzz faces.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27473
-
-        Previously, we recreated the Harfbuzz face for each script-run. With
-        this patch, we keep the Harfbuzz face in the FontPlatformData (created
-        as needed) and so they will persist for the duration of the
-        FontPlatformData.
-
-        Shouldn't affect any layout tests. Results in a significant win on the
-        intl2 page cycler time.
-
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::TextRunWalker::~TextRunWalker):
-        (WebCore::TextRunWalker::setupFontForScriptRun):
-        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
-        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::~RefCountedHarfbuzzFace):
-        (WebCore::FontPlatformData::FontPlatformData):
-        (WebCore::FontPlatformData::harfbuzzFace):
-        * platform/graphics/chromium/FontPlatformDataLinux.h:
-        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::create):
-        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::face):
-        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::RefCountedHarfbuzzFace):
-        * platform/graphics/chromium/HarfbuzzSkia.h: Added.
-
-2009-07-20  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Simon Fraser.
-
-        REGRESSION (r46142): Need to remove showTreeThisForThis
-        https://bugs.webkit.org/show_bug.cgi?id=27475
-
-        Removes showTreeThisForThis
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::appendParagraphIntoNode):
-
-2009-07-19  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Refactoring of indentRegion to fix bugs 26816 and 25317
-        https://bugs.webkit.org/show_bug.cgi?id=26816
-        https://bugs.webkit.org/show_bug.cgi?id=25317
-        https://bugs.webkit.org/show_bug.cgi?id=23995 (partially)
-
-        This patch implements appendParagraphIntoNode, a simpler specialized version of moveParagraph
-        and replaces all calls inside indentRegion. The following is the new behavior of indentRegion.
-
-        1. We try to indent as many wrapping nodes as possible.
-           e.g. when indenting "hello" in <div>hello</div>, we try to indent div as well.
-        2. We do not delete any wrapping elements
-           With moveParagraph, we used to remove all wrapping nodes, and replaced with a blockquote.
-           This was causing https://bugs.webkit.org/show_bug.cgi?id=23995 for indentation.
-           With appendParagraphIntoNode, we can preserve all wrapping nodes.
-        3. We only split the tree until the closest block node instead of until the root editable node.
-           This behavioral change fixes the bug 25317.
-        4. When multiple paragraphs are indented, we indent the highest common ancestor within the selection.
-           e.g. when a list is a child node of a div, and the entire div is intended,
-                we enclose the div by a single blockquote.
-
-        Note that new behavior is more consistent with that of Internet Explorer and Firefox.
-        To demonstrate this, the following tests are added.
-
-        Tests: editing/execCommand/indent-div-inside-list.html
-               editing/execCommand/indent-nested-blockquotes.html
-               editing/execCommand/indent-nested-div.html
-               editing/execCommand/indent-second-paragraph-in-blockquote.html
-
-        * editing/IndentOutdentCommand.cpp: prepareBlockquoteLevelForInsertion is removed
-        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): uses appendParagraphIntoNode now
-        (WebCore::IndentOutdentCommand::indentIntoBlockquote): uses appendParagraphIntoNode now
-        (WebCore::IndentOutdentCommand::appendParagraphIntoNode): removes a paragraph and appends it to a new node
-        (WebCore::IndentOutdentCommand::removeUnnecessaryLineBreakAt): removes a break element at the specified position
-        (WebCore::IndentOutdentCommand::indentRegion): exhibits the described behavior
-        * editing/IndentOutdentCommand.h: updated prototype
-
-2009-07-20  Dan Bernstein  <mitz@apple.com>
-
-        Try to fix release builds after r46136
-
-        * dom/Element.cpp:
-
-2009-07-17  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Media Controls: We are specifying the text height, where it is unneeded and the slider is 2px off.
-        https://bugs.webkit.org/show_bug.cgi?id=27380
-
-        Adjust the margin of the slider and remove useless height specification to fix alignement of the media controls.
-
-        * css/mediaControlsQT.css:
-
-2009-07-20  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27468
-        Back out r46060, which caused problems for some Apple developers.
-
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/WebCoreGenerated.vcproj:
-
-2009-07-20  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        When loading a custom view into a frame, the old document is still
-        around
-        <rdar://problem/5145841>
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::writePlainText): Added.
+        * platform/win/ClipboardWin.h:
 
-        Safari fires onload before PDF is loaded into the browser
-        <rdar://problem/6618869>
+2010-02-04  Steve Block  <steveblock@google.com>
 
-        Test: fast/loader/non-html-load-event.html
+        Reviewed by Nate Chapin.
 
-        * GNUmakefile.am: Added PlaceholderDocument.{cpp,h}
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * WebCoreSources.bkl: Ditto.
-        * dom/Document.h:
-        (WebCore::Document::setStyleSelector): Added this protected accessor for
-            PlaceholderDocument to use.
-        * dom/Element.cpp:
-        (WebCore::Element::clientWidth): Check whether the document has a
-            renderer.
-        (WebCore::Element::clientHeight): Ditto.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin): Create a PlaceholderDocument for frames
-            that do not use an HTML view. Do not nullify the content size in
-            that case.
-        (WebCore::FrameLoader::transitionToCommitted): For frames that do not
-            use an HTML view, call receivedFirstData(), which sets up the
-            frame with a new PlaceHolderDocument.
-        * loader/PlaceholderDocument.cpp: Added.
-        (WebCore::PlaceholderDocument::attach): Sets up the style selector but
-            does not create a RenderView.
-        * loader/PlaceholderDocument.h: Added.
-        (WebCore::PlaceholderDocument::create):
-        (WebCore::PlaceholderDocument::PlaceholderDocument):
-
-2009-07-20  Chris Marrin  <cmarrin@apple.com>
+        Fix bug in V8 convertNPVariantToJValue when converting float and double types
+        https://bugs.webkit.org/show_bug.cgi?id=34593
 
-        Reviewed by Simon Fraser.
+        No new tests, build fix only.
 
-        Handle opacity and opacity animations on transform layers in Leopard
-        https://bugs.webkit.org/show_bug.cgi?id=27398
+        * bridge/jni/v8/JNIUtilityPrivate.cpp: Modified.
+        (JSC::Bindings::convertNPVariantToJValue): Modified. Use correct members of 'result' enum.
 
-        This makes two changes, and only for Leopard. 
+2010-02-04  Chris Guillory  <chris.guillory@google.com>
 
-        First, whenever opacity is changed on a layer I propagate the 
-        change into the content layer and all the children if the layer 
-        on which opacity is set is a transform layer (preserve3D is true). 
-        The opacity set is the accumulated opacity from this layer
-        and all its direct ancestor transform layers. Second, I turn off all 
-        hardware opacity animation.
-
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::accumulatedOpacity):
-        (WebCore::GraphicsLayer::distributeOpacity):
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::setOpacityInternal):
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setPreserves3D):
-        (WebCore::GraphicsLayerCA::setOpacity):
-        (WebCore::GraphicsLayerCA::animateFloat):
-        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
-        (WebCore::GraphicsLayerCA::setOpacityInternal):
-        (WebCore::GraphicsLayerCA::updateOpacityOnLayer):
-
-2009-07-20  Yong Li  <yong.li@torchmobile.com>
+        Reviewed by Darin Fisher.
 
-        Reviewed by Adam Roben.
+        [Chromium] Notify ChromeClientChromium of AccessibilityObject state
+        change notifications.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34464
 
-        https://bugs.webkit.org/show_bug.cgi?id=27349
-        Add GraphicsContext implementation for the WinCE port.
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::toChromeClientChromium):
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * page/chromium/ChromeClientChromium.h:
 
-        Written by Yong Li <yong.li@torchmobile.com>, George Staikos <george.staikos@torchmobile.com> and Lyon Chen <lyon.chen@torchmobile.com>
-        with trivial style fixes by Adam Treat <adam.treat@torchmobile.com>
+2010-02-04  Stephen White  <senorblanco@chromium.org>
 
-        * platform/graphics/wince/GraphicsContextWince.cpp: Added.
+        Unreviewed, build fix for Chromium.
 
-2009-07-20  Dumitru Daniliuc  <dumi@chromium.org>
+        Revert r54341 ("[v8] Remove clear method from DOM object maps"),
+        since it causes the worker tests to fail on Chromium.
 
-        Reviewed by Dimitri Glazkov.
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/DOMDataStore.h:
+        (WebCore::ChunkedTable::clear):
+        (WebCore::ChunkedTable::clearEntries):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::clear):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::ChunkedTableTraits::clear):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
+        (WebCore::removeAllDOMObjectsInCurrentThread):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::WeakReferenceMap::clear):
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
 
-        Adding the Win SQLite VFS implementation for Chromium, and stubs
-        for the Mac and Linux VFSs.
+2010-02-04  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26940
+        Reviewed by Xan Lopez.
 
-        * WebCore.gypi:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Added.
+        [GTK] Crashes when an invalid hostname is pre-fetched
+        https://bugs.webkit.org/show_bug.cgi?id=34602
 
-2009-07-20  Xan Lopez  <xlopez@igalia.com>
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS): NULL-check the SoupURI that is created
+        from the hostname; that will happen for invalid hostnames.
 
-        Reviewed by Gustavo Noronha.
+2010-02-04  José Millán Soto  <jmillan@igalia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27097
-        [Gtk] Segfault when examining an object of ROLE_TABLE via at-spi
+        Reviewed by Xan Lopez.
 
-        Check that an object is a RenderObject before trying to access its
-        renderer and related node.
+        [Gtk] webkitgtk crashed when Orca open
+        https://bugs.webkit.org/show_bug.cgi?id=34463
 
         * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_role):
-
-2009-07-20  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] font cache reworking
-        https://bugs.webkit.org/show_bug.cgi?id=27265
-
-        Reimplemented Qt's FontCache in a way that follows the shared one.
-        Now we can release its elements when those became inactive.
-        FontFallbackList had been changed to be able to hold WebCore fonts in its list and to be able to release a FontData what is in the cache.
-
-        No change in behavior, so no tests.
-
-        * platform/graphics/qt/FontCacheQt.cpp:
-        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
-        (WebCore::FontPlatformDataCacheKey::isHashTableDeletedValue):
-        (WebCore::FontPlatformDataCacheKey::): Key type for the cache of FontPlatformData objects.
-        It can be constructed from a FontPlatformData or from a FontDescription. The keys have to be consistent
-        with FontPlatformData::FontPlatformData(const FontDescription&) - if we create the same
-        FontPlatformData from two FontDescription then we have to create the same key from them, and vica versa.
-        (WebCore::FontPlatformDataCacheKey::operator==):
-        (WebCore::FontPlatformDataCacheKey::hash):
-        (WebCore::FontPlatformDataCacheKey::computeHash):
-        (WebCore::FontPlatformDataCacheKey::hashTableDeletedSize):
-        (WebCore::FontPlatformDataCacheKeyHash::hash):
-        (WebCore::FontPlatformDataCacheKeyHash::equal):
-        (WebCore::FontPlatformDataCacheKeyTraits::emptyValue):
-        (WebCore::FontPlatformDataCacheKeyTraits::constructDeletedValue):
-        (WebCore::FontPlatformDataCacheKeyTraits::isDeletedValue):
-        (WebCore::FontCache::getCachedFontPlatformData): Get a FontDescription and returns a FontPlatformData.
-        (WebCore::FontCache::getCachedFontData): Get a FontPlatformData and returns a SimpleFontData.
-        (WebCore::FontCache::releaseFontData): Get a SimpleFontData and releases it from the cache. Also releases the appropriate FontPlatformData.
-        (WebCore::FontCache::purgeInactiveFontData): Frees inactive elements.
-        (WebCore::FontCache::invalidate): Frees all inactive elements (call purgeInactiveFontData with default argument)
-        * platform/graphics/qt/FontFallbackListQt.cpp:
-        (WebCore::FontFallbackList::releaseFontData):
-        (WebCore::FontFallbackList::fontDataAt):
-        * platform/graphics/qt/FontPlatformData.h:
-        (WebCore::FontPlatformData::family): Getter. It is needed for FontPlatformDataCacheKey.
-        (WebCore::FontPlatformData::bold): Ditto.
-        (WebCore::FontPlatformData::italic): Ditto.
-        (WebCore::FontPlatformData::smallCaps): Ditto.
-        (WebCore::FontPlatformData::pixelSize): Ditto.
-        * platform/graphics/qt/FontPlatformDataQt.cpp:
-        (WebCore::FontPlatformData::FontPlatformData): Set m_bold.
-
-2009-07-20  Xan Lopez  <xlopez@igalia.com>
+        (textForObject):
+        Checking if render objects are texts before calling toRenderText
 
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26716
-        [Gtk] Each XMLHttpRequest leaks memory.
-
-        Free the SoupURI we create to check the URI. Fix suggested by John
-        Kjellberg.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::):
-
-2009-07-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        [Qt] On Symbian link against system sqlite3
-        https://bugs.webkit.org/show_bug.cgi?id=27368
-
-        Add an option to force linking against system sqlite3
-        by adding system-sqlite to the CONFIG variable.
-
-        The Symbian specific part of this patch is contributed by 
-        Norbert Leser.
-
-        * WebCore.pro:
-
-2009-07-20  Xan Lopez  <xlopez@igalia.com>
+2010-02-04  Xan Lopez  <xlopez@igalia.com>
 
         Reviewed by Gustavo Noronha.
 
-        Change the glib version check to check for the first unstable
-        release with g_mapped_file_unref. Otherwise this would be useless
-        until 2.22 is released, a few months from now.
+        Set first party URI in all SoupMessages. This allows libsoup to
+        implement a "no third party cookies" policy in case it wants
+        to. Also start a non-JSC-specific, gtk-specific GOwnPtr module and
+        use it for SoupURI.
 
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::setCookies):
         * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ResourceHandle::startHttp):
-
-2009-07-20  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by and done with Tor Arne Vestbø.
-
-        Fix fast/css/pseudo-required-optional-*.html in the Qt build
-        after r46062.
-
-        These tests triggered a bug in RenderThemeQt where we did not fall back
-        to the unstyled painting of text areas and input fields when they have
-        a styled background.
-
-        Our re-implementation of isControlStyled incorrectly only checked the
-        border for determining whether to style or not. The base-implementation
-        performs the same check, but also includes the background. Removing
-        our implementation fixes the appearance.
-
-        * platform/qt/RenderThemeQt.cpp: Removed isControlStyled reimplementation.
-        * platform/qt/RenderThemeQt.h: Ditto.
-
-2009-07-20  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Rubber-stamped by Tor Arne Vestbø.
-
-        Add missing (sorted) header files to the HEADERS variable in the qmake
-        .pro file for improved completion in IDEs.
-
-        * WebCore.pro:
-
-2009-07-19  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by David Levin.
-
-        [V8] Factor V8ConsoleMessage out of V8Proxy
-        https://bugs.webkit.org/show_bug.cgi?id=27421
-
-        No behavior change.
-
-        * WebCore.gypi:
-        * bindings/v8/V8ConsoleMessage.cpp: Added.
-        (WebCore::V8ConsoleMessage::V8ConsoleMessage):
-        (WebCore::V8ConsoleMessage::dispatchNow):
-        (WebCore::V8ConsoleMessage::dispatchLater):
-        (WebCore::V8ConsoleMessage::processDelayed):
-        (WebCore::V8ConsoleMessage::handler):
-        * bindings/v8/V8ConsoleMessage.h: Added.
-        (WebCore::V8ConsoleMessage::Scope::Scope):
-        (WebCore::V8ConsoleMessage::Scope::~Scope):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::logInfo):
-        (WebCore::reportUnsafeAccessTo):
-        (WebCore::V8Proxy::runScript):
-        (WebCore::V8Proxy::callFunction):
-        (WebCore::V8Proxy::newInstance):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::processConsoleMessages):
-
-2009-07-19  Rob Buis  <rwlbuis@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        Remove unused member variable.
-
-        * svg/SVGPolyElement.h:
-
-2009-07-19  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        HTMLAudioElement: constructor should set "autobuffer" attribute
-        https://bugs.webkit.org/show_bug.cgi?id=27422
-
-        Test: media/audio-constructor-autobuffer.html
+        (WebCore::restartedCallback):
+        (WebCore::startHttp):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        (WebCore::ResourceRequest::updateFromSoupMessage):
 
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::constructAudio):
-            Set 'autobuffer' attribute.
+2010-02-04  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-07-19  Thierry Bastian <thierry.bastian@nokia.com>
+        Reviewed by Timothy Hatcher.
 
-        Reviewed by Simon Hausmann.
+        Web Inspector: group cookies by domains, not frame's domains.
 
-        Fix the Qt build with mingw.
+        https://bugs.webkit.org/show_bug.cgi?id=34599
 
-        * WebCore.pro: Don't use MSVC commandline options to disable warnings
-        with mingw.
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype._cookiesForDomain):
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+        (WebInspector._addCookieDomain):
 
-2009-07-19  Adam Barth  <abarth@webkit.org>
+2010-02-04  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by David Levin.
+        Reviewed by Dimitri Glazkov.
 
-        [V8] Phase 2: Remove event listener methods from V8Proxy
-        https://bugs.webkit.org/show_bug.cgi?id=27415
+        [V8] Delete V8CustomBinding.h and all references to V8Custom
 
-        No behavior change.
+        https://bugs.webkit.org/show_bug.cgi?id=32638
 
-        * bindings/v8/V8ObjectEventListener.cpp:
-        (WebCore::weakObjectEventListenerCallback):
-        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::disconnectEventListeners):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::eventListeners):
-        (WebCore::V8Proxy::objectListeners):
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/V8Utilities.cpp:
         * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
-        (WebCore::getEventListener):
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::~V8EventListener):
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * bindings/v8/custom/V8CoordinatesCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h: Removed.
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
         * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
         * bindings/v8/custom/V8ElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8EventSourceConstructor.cpp:
+        * bindings/v8/custom/V8EventSourceCustom.cpp:
+        * bindings/v8/custom/V8GeolocationCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::v8HTMLAudioElementConstructorCallback):
+        (WebCore::V8HTMLAudioElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::v8HTMLOptionElementConstructorCallback):
+        (WebCore::V8HTMLOptionElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
         * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeFilterCustom.cpp:
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
         * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
         * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::getEventListener):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
         * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::getEventListener):
         * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Gustavo Noronha.
-
-        [Gtk] soup/ResourceHandleSoup.cpp:533: error: 'g_mapped_file_free' was not declared in this scope
-        https://bugs.webkit.org/show_bug.cgi?id=27230
-
-        Use g_mapped_file_unref for GLIB version 2.22 onwards.
 
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ResourceHandle::startHttp):
-
-2009-07-18  Dan Bernstein  <mitz@apple.com>
+2010-02-04  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-        Reviewed by Anders Carlsson.
-
-        Add spread radius support to -webkit-box-shadow
-        https://bugs.webkit.org/show_bug.cgi?id=27417
-        rdar://problem/7072267
-
-        Test: fast/box-shadow/spread.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::valueForShadow): Added a property ID parameter and used it to
-            include the spread length for box-shadow but not for text-shadow.
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-            Pass the property ID to valueForShadow().
-
-        * css/CSSParser.cpp:
-        (WebCore::ShadowParseContext::ShadowParseContext): Added property,
-            spread, and allowSpread members. Added a property ID parameter to
-            the constructor. Initialize the property and allowSpread members.
-        (WebCore::ShadowParseContext::allowLength): Added allowSpread.
-        (WebCore::ShadowParseContext::commitValue): Pass the spread value to
-            the ShadowValue constructor. Reset allowSpread.
-        (WebCore::ShadowParseContext::commitLength): Allow spread after blur
-            for the box-shadow property.
-        (WebCore::ShadowParseContext::commitColor): Reset allowSpread.
-        (WebCore::CSSParser::parseShadow): Pass the property ID to
-            ShadowParseContext().
+        Reviewed by Simon Hausmann.
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty): Get the spread value from
-            the shadow value and pass it to the ShadowData constructor.
+        [Qt] Unnecessary QBrush construction for doing a solid fill
+        https://bugs.webkit.org/show_bug.cgi?id=34559
 
-        * css/ShadowValue.cpp:
-        (WebCore::ShadowValue::ShadowValue): Added spread.
-        (WebCore::ShadowValue::cssText): Added spread.
+        Use the similar trick like r37421, i.e. use the special brush for
+        solid color to avoid creating QBrush again and again.
 
-        * css/ShadowValue.h:
-        (WebCore::ShadowValue::create): Added spread.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::setPlatformFillColor):
 
-        * page/animation/AnimationBase.cpp:
-        (WebCore::blendFunc): Blend the spread value.
-        (WebCore::PropertyWrapperShadow::blend): Added 0 spread to the default
-            shadow.
+2010-02-04  Dan Bernstein  <mitz@apple.com>
 
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeBoxesHorizontally): Account for spread in
-            the visual overflow calculations.
-        (WebCore::InlineFlowBox::placeBoxesVertically): Ditto.
-        (WebCore::InlineFlowBox::paint): Ditto.
+        Reviewed by Simon Fraser.
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::overflowHeight): Ditto.
-        (WebCore::RenderBlock::overflowWidth): Ditto.
-        (WebCore::RenderBlock::overflowLeft): Ditto.
-        (WebCore::RenderBlock::overflowTop): Ditto.
-        (WebCore::RenderBlock::overflowRect): Ditto.
-        (WebCore::RenderBlock::layoutBlock): Ditto.
+        REGRESSION (r53718): When scrolling a tall window by page, the overlap between pages is too big
+        https://bugs.webkit.org/show_bug.cgi?id=34371
 
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintBoxShadow): Inflate the shadow-
-            casting rect by the shadow spread value. Adjust border radii if
-            necessary.
+        Allow ScrollbarTheme to cap the overlap between pages, and set a cap of
+        40 in ScrollbarThemeMac.
 
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock): Account for spread in the
-            visual overflow calculations.
+        * WebCore.base.exp: Export Scrollbar::maxOverlapBetweenPages().
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance): Use Scrollbar methods instead of
+        constants, and cap the scroll distance if needed.
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars): Ditto.
+        (WebCore::ScrollView::wheelEvent): Ditto.
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::maxOverlapBetweenPages): Added. Returns the
+        value from the native scrollbar theme.
+        * platform/Scrollbar.h: Replaced scroll amount constants with static methods.
+        (WebCore::Scrollbar::pixelsPerLineStep): Replaces cScrollbarPixelsPerLineStep.
+        (WebCore::Scrollbar::minFractionToStepWhenPaging): Replaces cFractionToStepWhenPaging.
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::maxOverlapBetweenPages): A base implementation
+        that returns the largest int.
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Use Scrollbar methods instead of
+        constants.
+        * platform/haiku/PlatformWheelEventHaiku.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Use Scrollbar methods instead of
+        constants.
+        * platform/mac/ScrollbarThemeMac.h:
+        (WebCore::ScrollbarThemeMac::maxOverlapBetweenPages): An override
+        that returns 40.
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Use
+        Scrollbar::pixelsPerLineStep() instead of cScrollbarPixelsPerLineStep.
+        * platform/wx/MouseWheelEventWx.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Use Scrollbar methods instead of
+        constants.
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::OnScrollWinEvents): Use Scrollbar
+        methods instead of constants, and cap the scroll distance if needed.
         * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::calculateRects): Ditto.
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Account for spread.
-        (WebCore::RenderObject::adjustRectForOutlineAndShadow): Ditto.
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout): Ditto.
 
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Ditto.
-
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::setTextShadow): Assert that text shadows do not
-            have spread.
+2010-02-04  No'am Rosenthal  <noam.rosenthal@nokia.com>
 
-        * rendering/style/ShadowData.cpp:
-        (WebCore::ShadowData::ShadowData): Added spread.
-        (WebCore::ShadowData::operator==): Compare spread.
-        * rendering/style/ShadowData.h:
-        (WebCore::ShadowData::ShadowData): Added spread.
-
-2009-07-18  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Jan Alonzo.
-
-        Minor FrameLoader.cpp cleanup
-        https://bugs.webkit.org/show_bug.cgi?id=27406
-
-        No behavior change.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::executeIfJavaScriptURL):
-
-2009-07-18  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Fisher.
+        Reviewed by Ariya Hidayat.
 
-        [V8] Move event listener methods from V8Proxy to V8EventListenerList
-        https://bugs.webkit.org/show_bug.cgi?id=27408
+        [Qt] Tuning and optimizations to GraphicsLayerQt. Reduce unnecessary
+        recaching, remove QTimer::singleShot and QPixmap::scaled, more
+        accurate strategy of handling transform operation blends. Rotating a
+        bordered-table, for example, now runs at 50FPS instead of 40FPS on Maemo5.
 
-        Move some event listener code out of V8Proxy and into the event
-        listener list.
+        https://bugs.webkit.org/show_bug.cgi?id=34062
 
-        I'd like to remove these methods from V8Proxy entirely and just expose
-        getters for the lists themselves, but I'll do that in a follow up
-        patch.
+        This is tested by https://bugs.webkit.org/show_bug.cgi?id=34450, fps measurements.
 
-        * bindings/v8/V8EventListenerList.cpp:
-        (WebCore::V8EventListenerList::findWrapper):
-        * bindings/v8/V8EventListenerList.h:
-        (WebCore::V8EventListenerList::findOrCreateWrapper):
-        * bindings/v8/V8ObjectEventListener.cpp:
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::findV8EventListener):
-        (WebCore::V8Proxy::findOrCreateV8EventListener):
-        (WebCore::V8Proxy::removeV8EventListener):
-        (WebCore::V8Proxy::findObjectEventListener):
-        (WebCore::V8Proxy::findOrCreateObjectEventListener):
-        (WebCore::V8Proxy::removeObjectEventListener):
-        * bindings/v8/V8Proxy.h:
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::flushChanges): Fine-tune caching
+        (WebCore::TransformAnimationQt::TransformAnimationQt): transform bugs
+        (WebCore::OpacityAnimationQt::updateState): style change
 
-2009-07-18  Jeremy Orlow  <jorlow@chromium.org>
+2010-02-04  Pavel Feldman  <pfeldman@chromium.org>
 
-        Rubber stamped by Adam Barth.
+        Reviewed by Timothy Hatcher.
 
-        Revert https://bugs.webkit.org/show_bug.cgi?id=27383
-        https://bugs.webkit.org/show_bug.cgi?id=27407
+        Web Inspector: Cookies for resources are not shown in storage panel.
 
-        Revert Jens' patch.  I believe he forgot to include a file.
+        https://bugs.webkit.org/show_bug.cgi?id=34594
 
-        * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/V8DataGridDataSource.cpp: Removed.
-        * bindings/v8/V8DataGridDataSource.h: Removed.
-        * bindings/v8/V8GCController.h:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::getCookies):
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::cachedResource):
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::requestURL):
 
-2009-07-17  Daniel Bates  <dbates@intudata.com>
+2010-02-04  Anton Muhin  <antonm@chromium.org>
 
         Reviewed by Adam Barth.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=27405
-
-        Fixes an issue when decoding HTML entities with an unknown named entity that 
-        caused null-characters to be inserted into the decoded result.
-
-        Test: http/tests/security/xssAuditor/link-onclick-ampersand.html
-              http/tests/security/xssAuditor/javascript-link-ampersand.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::decodeHTMLEntities): Added check to conditional so that
-        non-zero entity values are not inserted during decoding process.
-
-2009-07-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        <http://webkit.org/b/18363> [GTK] Combo boxes cannot be opened pressing space
-
-        Reviewed by Holger Freyther.
-
-        Add Gtk to platforms that want to open the menulist using the
-        spacebar.
-
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::menuListDefaultEventHandler):
-
-2009-07-17  Mario Sanchez Prada  <msanchez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25523
-        [GTK] The text displayed by push buttons is not exposed to assistive technologies
-
-        Add new public method text() to RenderButton and use it from
-        AccessibilityRenderObject::stringValue().
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::stringValue):
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::text):
-        * rendering/RenderButton.h:
-
-2009-07-17  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Restore proxy retrieval
-        https://bugs.webkit.org/show_bug.cgi?id=27369
-
-        No new tests are needed.
 
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::instantiateV8Object):
+        [v8] Remove clear method from DOM object maps
+        https://bugs.webkit.org/show_bug.cgi?id=34530
 
-2009-07-17  Yael Aharon  <yael.aharon@nokia.com>
+        No new tests. Should be covered by existent testing infrastructure.
 
-        Reviewed by George Staikos.
+        * bindings/v8/DOMData.h:
+        * bindings/v8/DOMDataStore.h:
+        * bindings/v8/V8DOMMap.cpp:
+        * bindings/v8/V8DOMMap.h:
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
 
-        https://bugs.webkit.org/show_bug.cgi?id=27351
-        Added platform "Symbian" to WEBCORE_NAVIGATOR_PLATFORM
-        Use uname to find the correct platform for Linux.
+2010-02-04  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        * page/NavigatorBase.cpp:
-        (WebCore::NavigatorBase::platform):
+        Reviewed by Xan Lopez.
 
-2009-07-17  Jens Alfke  <snej@chromium.org>
+        [Gtk] Check if the renderer() exists in textForObject.
 
-        Reviewed by Dimitri Glazkov.
+        This is fixing a crash in the textForObject method. It can
+        happen when inspecting AtkObjects in the accerciser, then
+        navigating to a new page and still inspecting the old tree.
 
-        Hook up V8 bindings for DataGrid elements.
-        https://bugs.webkit.org/show_bug.cgi?id=27383
-        http://code.google.com/p/chromium/issues/detail?id=16730
-
-        Tests: Enhanced LayoutTests/fast/dom/HTMLDataGridElement/*
-        to handle exceptions, check appropriate JS prototypes, and
-        test column-list's item() method as well as array-indexing.
-
-        * WebCore.gypi: Added new source files.
-        * bindings/scripts/CodeGeneratorV8.pm: Made GenerateBatchedAttributeData put #if's around conditional attributes.
-        * bindings/v8/DOMObjectsInclude.h: #include DataGrid headers.
-        * bindings/v8/V8DOMWrapper.cpp: Add bindings from HTML tags to datagrid templates.
-        (WebCore::V8DOMWrapper::getTemplate): Customize datagrid template.
-        * bindings/v8/V8DataGridDataSource.cpp: Added. (Based on JSDataGridDataSource)
-        (WebCore::V8DataGridDataSource::V8DataGridDataSource):
-        (WebCore::V8DataGridDataSource::~V8DataGridDataSource):
-        * bindings/v8/V8DataGridDataSource.h: Added. (Based on JSDataGridDataSource)
-        (WebCore::V8DataGridDataSource::create):
-        (WebCore::V8DataGridDataSource::isJSDataGridDataSource):
-        (WebCore::V8DataGridDataSource::jsDataSource):
-        (WebCore::asV8DataGridDataSource):
-        * bindings/v8/V8GCController.h: Added new handle type "DATASOURCE".
-        * bindings/v8/V8Index.h: Conditionalize datagrid stuff.
-        * bindings/v8/custom/V8CustomBinding.h: Declare more accessors. Conditionalize.
-        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Fill in dataSource accessors.
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-
-2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
+        In this case the AccessibilityObjectWrapperAtk was still
+        valid but the included renderer() was returning 0. Add a
+        check for the accObject->renderer() before trying to use
+        the result.
 
-        Reviewed by Darin Fisher.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (textForObject):
 
-        StorageArea should only contain methods we intend to proxy.
-        https://bugs.webkit.org/show_bug.cgi?id=27181
+2010-02-04  Yury Semikhatsky  <yurys@chromium.org>
 
-        Right now, StorageAreaSync takes in a StorageArea* and calls methods
-        like importItem.  Really, StorageAreaSync should be operating directly
-        on StorageAreaImpl* and those methods should be removed from StorageArea
-        since StorageAreaSync should never be attached to anything other than a
-        StorageAreaImpl.
+        Reviewed by Pavel Feldman.
 
-        This was pointed out in the review for
-        https://bugs.webkit.org/show_bug.cgi?id=27072
+        Provide strongly typed C++ interface for inspector's injected script.
 
-        Also clean up StorageNamespaceImpl to operate directly on
-        StorageAreaImpl.  Also, get rid of the factory for StorageArea
-        since nothing should ever create a StorageArea directly.
+        https://bugs.webkit.org/show_bug.cgi?id=33616
 
         * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/StorageArea.cpp: Removed.
-        * storage/StorageArea.h:
-        (WebCore::StorageArea::~StorageArea):
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::copy):
-        * storage/StorageAreaImpl.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::create):
-        (WebCore::StorageAreaSync::StorageAreaSync):
-        * storage/StorageAreaSync.h:
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::copy):
-        (WebCore::StorageNamespaceImpl::storageArea):
-        * storage/StorageNamespaceImpl.h:
-
-2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Add v8 implementation for DOM Storage ScriptObjectQuarantine.
-        https://bugs.webkit.org/show_bug.cgi?id=27327
-
-        Wrap the storage object with a generic object as is done elsewhere in
-        the file (but continue to hit a NOTIMPLEMENTED if DOM_STORAGE is not
-        enabled.
-
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-
-2009-07-17  Mads Ager  <ager@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27394
-        Fix access to global object wrappers after navigation of their
-        frame in the V8 bindings.  This fixes selenium test failures.
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::updateDocument):
-
-2009-07-17  Mark Rowe  <mrowe@apple.com>
-
-        Fix the 32-bit build by removing implicit float <-> double conversions.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::constrainedAttachedWindowHeight):
-
-2009-07-17  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Fix of <rdar://problem/5712795> Win: Cannot change the height of the docked Web Inspector (14272)
-        https://bugs.webkit.org/show_bug.cgi?id=14272
-        
-        Moved preference setting for attached inspector height and inspector height calculation from
-        WebInspectorClient.mm into InspectorController.cpp, to make this code cross-platform and enable
-        Windows resizing of attached inspector.
-
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * inspector/InjectedScript.cpp: Added.
+        (WebCore::InjectedScript::InjectedScript):
+        (WebCore::InjectedScript::dispatch):
+        (WebCore::InjectedScript::callFrames):
+        (WebCore::InjectedScript::wrapAndStringifyForConsole):
+        (WebCore::InjectedScript::releaseWrapperObjectGroup):
+        * inspector/InjectedScript.h: Added.
+        (WebCore::InjectedScript::InjectedScript):
+        (WebCore::InjectedScript::~InjectedScript):
+        (WebCore::InjectedScript::hasNoValue):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptForId):
+        (WebCore::InjectedScriptHost::releaseWrapperObjectGroup):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
         * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::injectedScriptForNodeId):
         * inspector/InspectorController.h:
+        (WebCore::InspectorController::frontendScriptState):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
 
-2009-07-17  Dan Bernstein  <mitz@apple.com>
-
-        Another attempt at fixing the build after r46063
-
-        * WebCore.xcodeproj/project.pbxproj: Made ExceptionCode.h a private
-            header, because it is now included from htmlediting.h, which is
-            a private header.
-
-2009-07-17  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27396
-        Moving cursor in Thai text sometimes jumps over two characters
-
-        Test: editing/text-iterator/thai-cursor-movement.html
-
-        * platform/text/TextBreakIteratorICU.cpp: (WebCore::cursorMovementIterator): Added a special
-        case for five Thai characters, matching ICU/CLDR changes.
-
-2009-07-14  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Some constructor objects exposed on Window have the wrong prototype chain
-        https://bugs.webkit.org/show_bug.cgi?id=27276
-
-        Several Constructor classes were already being passed a global object
-        during construction, but they were ignoring it for prototype lookup.
-        I've fixed those to use the passed global object instead.
-
-        Most of these Constructor classes should just be auto-generated, but I
-        refrained from changing them over to auto-gen in this patch.
-
-        Fixed CodeGeneratorJS to pass a global object to getDOMConstructor when
-        available, otherwise default to deprecatedGlobalObjectForPrototype(exec)
-        to match existing behavior.
-
-        Test: fast/dom/prototype-inheritance.html
+2010-02-04  Philippe Normand  <pnormand@igalia.com>
 
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::JSAudioConstructor::JSAudioConstructor): use the existing globalObject pointer for prototype lookup
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::deprecatedGlobalObjectForPrototype): Make it easy to detect where the wrong global object is being used.
-        (WebCore::deprecatedGetDOMStructure):
-        * bindings/js/JSDOMGlobalObject.h: remove error-prone getDOMConstructor, require passing JSDOMGlobalObject*
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::webKitPoint): pass "this" for the global object.
-        (WebCore::JSDOMWindow::webKitCSSMatrix): pass "this" for the global object.
-        (WebCore::JSDOMWindow::xsltProcessor): pass "this" for the global object.
-        (WebCore::JSDOMWindow::worker): pass "this" for the global object.
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::JSImageConstructor): use the existing globalObject pointer for prototype lookup
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor): use the existing globalObject pointer for prototype lookup
-        * bindings/js/JSOptionConstructor.cpp:
-        (WebCore::JSOptionConstructor::JSOptionConstructor): use the existing globalObject pointer for prototype lookup
-        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
-        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor): add new globalObject parameter and use it
-        * bindings/js/JSWebKitCSSMatrixConstructor.h:
-        * bindings/js/JSWebKitPointConstructor.cpp:
-        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor): add new globalObject parameter and use it
-        * bindings/js/JSWebKitPointConstructor.h:
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::JSWorkerConstructor::JSWorkerConstructor): add new globalObject parameter and use it
-        * bindings/js/JSWorkerConstructor.h:
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor): use the existing globalObject pointer for prototype lookup
-         -- XMLHttpRequest constructor was also missing a length.  Added one.
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
-        * bindings/js/JSXSLTProcessorConstructor.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
+        Rubber stamped by Xan Lopez.
 
-2009-07-17  Dan Bernstein  <mitz@apple.com>
+        Missing include, build fix after landing of patch from the bug 34435.
 
-        Build fix
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
 
-        * editing/htmlediting.cpp:
-        (WebCore::visiblePositionBeforeNode):
-        (WebCore::visiblePositionAfterNode):
+2010-02-02  Philippe Normand  <pnormand@igalia.com>
 
-2009-07-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        Reviewed by Gustavo Noronha Silva.
 
-        Gtk build fix for symbol lookup error.
+        [Gtk] libsoup critical warning in media player http cookies injection code
+        https://bugs.webkit.org/show_bug.cgi?id=34435
 
-        Move AbstractWorker from SHARED_WORKERS to WORKERS as Worker derives from it now
-        Changed in http://trac.webkit.org/changeset/46048
+        Fixed the critical warning and refactored the
+        User-Agent/Referer/cookies injection code, in that order. Previous
+        order (cookies first) was wrong because if cookies injection could
+        not be done neither the User-Agent nor Referer were injected. Also
+        started a non-JSC-specific, gtk-specific GOwnPtr module.
 
         * GNUmakefile.am:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        * platform/gtk/GOwnPtrGtk.cpp: Added.
+        (WTF::SoupURI):
+        (WTF::GstElement):
+        * platform/gtk/GOwnPtrGtk.h: Added.
 
-2009-07-17  Ryosuke Niwa  <ryosuke.niwa@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        htmlediting.cpp needs more utility functions to fix the bug 26816
-        https://bugs.webkit.org/show_bug.cgi?id=27038
-
-        In order to fix the bug 26816, we need several utility functions be added to htmlediting.cpp
-
-        No tests because functions haven't been used anywhere yet.
-
-        * dom/Range.cpp:
-        (WebCore::Range::create):
-        (WebCore::Range::comparePoint): added const qualifier
-        (WebCore::Range::compareNode): added const qualifier
-        * dom/Range.h:
-        * editing/htmlediting.cpp:
-        (WebCore::unsplittableElementForPosition): find the enclosing unsplittable element (editing root & table cell)
-        (WebCore::positionBeforeNode): added ASSERT(node)
-        (WebCore::positionAfterNode): added ASSERT(node)
-        (WebCore::visiblePositionBeforeNode):
-        (WebCore::visiblePositionAfterNode):
-        (WebCore::createRange): create a range object from two visible positions
-        (WebCore::extendRangeToWrappingNodes): extend range to include nodes that starts and ends at the boundaries
-        (WebCore::canMergeLists): typo
-        (WebCore::indexForVisiblePosition): added const qualifier
-        (WebCore::isVisiblyAdjacent): typo
-        (WebCore::isNodeVisiblyContainedWithin): determine if a node is inside a range or within the visible boundaries of the range
-        * editing/htmlediting.h:
-
-2009-07-17  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25551
-        Added support for the "required" attribute, the valueMissing flag
-        to the ValidityState object and :required/:optional CSS pseudoclasses.
-        Part of HTML5 sec. Forms specs.
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#attr-input-required
-
-        Tests: fast/css/pseudo-required-optional-001.html
-               fast/css/pseudo-required-optional-002.html
-               fast/css/pseudo-required-optional-003.html
-               fast/css/pseudo-required-optional-004.html
-               fast/css/pseudo-required-optional-005.html
-               fast/css/pseudo-required-optional-006.html
-               fast/forms/ValidityState-valueMissing-001.html
-               fast/forms/ValidityState-valueMissing-002.html
-               fast/forms/ValidityState-valueMissing-003.html
-               fast/forms/ValidityState-valueMissing-004.html
-               fast/forms/ValidityState-valueMissing-005.html
-               fast/forms/ValidityState-valueMissing-006.html
-               fast/forms/ValidityState-valueMissing-007.html
-               fast/forms/ValidityState-valueMissing-008.html
-               fast/forms/ValidityState-valueMissing-009.html
-               fast/forms/required-attribute-001.html
-               fast/forms/required-attribute-002.html
-
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): pseudoRequired/pseudoOptional
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::): ditto
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ditto
-        * dom/Element.h:
-        (WebCore::Element::isOptionalFormControl): check for optional controls
-        (WebCore::Element::isRequiredFormControl): check for required controls
-        * html/HTMLAttributeNames.in: required attribute
-        * html/HTMLButtonElement.h:
-        (WebCore::HTMLButtonElement::isOptionalFormControl): ditto
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::required): requiredAttr getter
-        (WebCore::HTMLFormControlElement::setRequired): requiredAttr setter
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::valueMissing): method definition
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::valueMissing): validation code
-        (WebCore::HTMLInputElement::isRequiredFormControl): ditto
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::isOptionalFormControl): ditto
-        * html/HTMLInputElement.idl: required DOM attribute
-        * html/HTMLSelectElement.h:
-        (WebCore::HTMLSelectElement::isOptionalFormControl): ditto
-        * html/HTMLTextAreaElement.h:
-        (WebCore::HTMLTextAreaElement::valueMissing): validation code
-        (WebCore::HTMLTextAreaElement::isOptionalFormControl): ditto
-        (WebCore::HTMLTextAreaElement::isRequiredFormControl): ditto
-        * html/HTMLTextAreaElement.idl: required DOM attribute
-        * html/ValidityState.cpp:
-        * html/ValidityState.h:
-        (WebCore::ValidityState::valueMissing): validation flag
-
-2009-07-17  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27390 CSS custom 
-        cursor hotspots should work in quirks mode
-        - and corresponding <rdar://problem/6554340>
-
-        Enable hotspots in quirks mode.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-
-        Update this manual test to reflect the fact that hotspots are now 
-        expected to work in quirks mode.
-        * manual-tests/css3-cursor-fallback-quirks.html:
-
-2009-07-17  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Steve Falkenburg.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27323
-        Only add Cygwin to the path when it isn't already there.  This avoids
-        causing problems for people who purposefully have non-Cygwin versions of
-        executables like svn in front of the Cygwin ones in their paths.
-
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/WebCoreGenerated.vcproj:
-
-2009-07-17  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27384
-        Random crashes in appcache/update-cache.html test
-
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::didReceiveResponse): Reorder code to avoid using a handle
-        after canceling it.
-
-2009-07-17  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Need to refactor Worker to derive from AbstractWorker
-        https://bugs.webkit.org/show_bug.cgi?id=26948
-
-        Changed Worker to derive from AbstractWorker, which involved moving
-        AbstractWorker files from being wrapped by ENABLE_SHARED_WORKERS to
-        ENABLE_WORKERS.
-
-        Removed obsolete functionality from the JS/V8 bindings that is now
-        inherited from AbstractWorker.
-
-        * WebCore.pro:
-        Moved AbstractWorker files out of SHARED_WORKERS section and into WORKERS.
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
-        * bindings/js/JSWorkerCustom.cpp:
-        Removed obsolete event listener code (now in base class)
-        (WebCore::JSWorker::mark):
-        No longer need to explicitly mark event listeners (handled by base class).
-        * bindings/v8/V8Index.h:
-        Moved AbstractWorker lines out of SHARED_WORKERS section and into WORKERS.
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
-        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
-        * bindings/v8/custom/V8CustomBinding.h:
-        Moved AbstractWorker lines out of SHARED_WORKERS section and into WORKERS.
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        Removed obsolete event listener code that now lives in the base class.
-        (WebCore::V8WorkerConstructor): Cleaned up legacy style nits.
-        * workers/AbstractWorker.cpp:
-        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
-        * workers/AbstractWorker.h:
-        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
-        * workers/Worker.cpp:
-        Removed event listener code (now in base class).
-        (WebCore::Worker::Worker): Now derives from AbstractWorker.
-        (WebCore::Worker::notifyFinished): Calls dispatchLoadErrorEvent on base class.
-        * workers/Worker.h:
-        Removed APIs that now live in the base class.
-        * workers/Worker.idl:
-        Now derives from AbstractWorker.
-        Removed APIs that live in the base class, and added a GenerateToJS flag.
-
-2009-07-17  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27379
-        Absolutely-positioned elements with a scrollbar wrap prematurely.  Make sure to include
-        the vertical scrollbar width for overflow:scroll elements.
-
-        Added fast/css/positioned-overflow-scroll.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::calcPrefWidths):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::calcPrefWidths):
-
-2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Need a DOM_STORAGE guard in DerivedSroucesAllInOne.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27375
-
-        In https://bugs.webkit.org/show_bug.cgi?id=27360 I added Storage.cpp
-        and StorageEvent.cpp.  Unfortunately, until later this afternoon,
-        DOM_STORAGE is not turned on by default in Chromium, and so these two
-        files are never generated.  This breaks the compile.
-
-        There are no other instances of guards in the file, which puzzles me...
-        but I think adding guards is the right way to go about this.
-
-        * bindings/v8/DerivedSourcesAllInOne.cpp:  Added the guard.
-
-2009-07-17  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26496
-
-        Let WebCore always enforce the connection-per-host limit itself.
-
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::servePendingRequests):
-
-2009-07-17  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by David Hyatt.
-
-        Some transitions don't work correctly on Leopard
-        https://bugs.webkit.org/show_bug.cgi?id=27356
-
-        We only have code to do component animation using valueFunction.
-        So on Leopard we always need to do matrix animation in hardware.
-        This fix ensures that. 
-
-        This is currently not testable because it appears only in the
-        hardware animation and we can't yet do pixel tests while 
-        hardware animating.
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::animateTransform):
-
-2009-07-17  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK+] Crash in screenAvailable due a null Widget*
-
-        JSDOMWindow::open called screenAvailableRect(0). The other
-        Screen methods can be called with a null widget as well, fix the
-        crashing test by checking for null.
-
-        In screenRect and screenAvailableRect it is not tried to use
-        a default screen as the existing implementation didn't try either
-        in case of not having a toplevel widget.
-
-        LayoutTests/fast/frames/crash-removed-iframe.html caused a crash.
-
-        * platform/gtk/PlatformScreenGtk.cpp:
-        (WebCore::getVisual): New method to get a visual or return zero.
-        (WebCore::screenDepth): Use getVisual.
-        (WebCore::screenDepthPerComponent): Use getVisual.
-        (WebCore::screenIsMonochrome): Use screenDepth which will do the null checking
-        (WebCore::screenRect): Check for !widget.
-        (WebCore::screenAvailableRect): Check for !widget.
-
-2009-07-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Fix the include path for the Symbian port
-        https://bugs.webkit.org/show_bug.cgi?id=27358
-
-        * WebCore.pro:
-
-2009-07-17  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
-
-        Reviewed by Simon Hausmann.
-
-        Make it possible to set the plugin directories from the DRT.
-        Part of https://bugs.webkit.org/show_bug.cgi?id=27215
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::installedPlugins): Now optionally takes
-        a populate argument, so we can avoid loading system plugins from the
-        DRT and thus avoid their strerr errors that can make tests fail.
-        (WebCore::PluginDatabase::clear): Make it possible to clear the
-        database. Called from setPluginDirectories.
-        * plugins/PluginDatabase.h:
-        (WebCore::PluginDatabase::setPluginDirectories): Make public
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        PluginViewMac: Stop the plugin when loading fails
-
-        Also, prevent event propagation when in the stopped state
-
-        * plugins/mac/PluginViewMac.cpp:
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        PluginViewMac: Allow query and set of drawing and event models
-
-        We now support querying and setting of the drawing and event model,
-        but we still only support the CoreGraphics drawing model, and the
-        Carbon event model.
-
-        If unsupported drawing or event models are detected we show the
-        missing-plugin icon.
-
-        * plugins/PluginView.cpp:
-        * plugins/PluginView.h:
-        * plugins/mac/PluginViewMac.cpp:
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Initialize two PluginView members using memset
-
-        m_npWindow is used on all platforms, not just for XP_UNIX,
-        so always initialize it. m_npCgContext on the other hand
-        is only used for XP_MACOSX.
-
-        * plugins/PluginView.cpp:
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Add more debug logging in PluginView
-
-        * plugins/PluginView.cpp: Add debug for setValue
-        * plugins/gtk/PluginViewGtk.cpp: Add debug for getValue
-        * plugins/mac/PluginViewMac.cpp: Add debug for getValue and more
-        * plugins/qt/PluginViewQt.cpp: Add debug for getValue
-        * plugins/win/PluginViewWin.cpp: Add debug for getValue
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Use same license in PluginDebug.cpp as in the original PluginDebug.h
-
-        * plugins/PluginDebug.cpp: Use license from PluginDebug.h
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Add more debugging functionality for the WebCore NPAPI layer
-
-        * GNUmakefile.am: Add PluginDebug.cpp
-        * WebCore.gypi: Add PluginDebug.cpp
-        * WebCore.pro: Add PluginDebug.cpp
-        * WebCore.vcproj/WebCore.vcproj: Add PluginDebug.cpp
-        * WebCoreSources.bkl: Add PluginDebug.cpp
-        * plugins/PluginDebug.h: Move errorStrings to PluginDebug.cpp
-        * plugins/PluginDebug.cpp: New file
-
-2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by David Levin.
-
-        Fix Chromium build with DOM_STORAGE enabled.
-        https://bugs.webkit.org/show_bug.cgi?id=27360
-
-        2 minor changes as noted below:
-
-        * bindings/v8/DerivedSourcesAllInOne.cpp: Add the generated .cpp files.
-        * storage/StorageAreaImpl.cpp:  #include "DOMWindow.h"
-
-2009-07-16  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by David Levin.
-
-        Add --web-sockets flag and ENABLE_WEB_SOCKETS define.
-        https://bugs.webkit.org/show_bug.cgi?id=27206
-        
-        Add ENABLE_WEB_SOCKETS
-
-        * Configurations/FeatureDefines.xcconfig: add ENABLE_WEB_SOCKETS
-        * GNUmakefile.am: add ENABLE_WEB_SOCKETS
-        * WebCore.vcproj/WebCoreCommon.vsprops: add ENABLE_WEB_SOCKETS
-        * WebCore.vcproj/build-generated-files.sh: add ENABLE_WEB_SOCKETS
-
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        Added a third bunch of Haiku-specific files for WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=26952
-
-        Adding five files, EventLoopHaiku.cpp, FileChooserHaiku.cpp,
-        FileSystemHaiku.cpp, KeyboardCodes.h and MIMETypeRegistryHaiku.cpp
-
-        * platform/haiku/EventLoopHaiku.cpp: Added.
-        (WebCore::EventLoop::cycle):
-        * platform/haiku/FileChooserHaiku.cpp: Added.
-        (WebCore::FileChooser::FileChooser):
-        (WebCore::FileChooser::basenameForWidth):
-        * platform/haiku/FileSystemHaiku.cpp: Added.
-        (WebCore::fileSystemRepresentation):
-        (WebCore::homeDirectoryPath):
-        (WebCore::openTemporaryFile):
-        (WebCore::closeFile):
-        (WebCore::writeToFile):
-        (WebCore::unloadModule):
-        (WebCore::listDirectory):
-        * platform/haiku/KeyboardCodes.h: Added.
-        * platform/haiku/MIMETypeRegistryHaiku.cpp: Added.
-        (WebCore::):
-        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
-
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        Added a second bunch of Haiku-specific files for WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=26952
-
-        Adding four files, ContextMenuHaiku.cpp, ContextMenuItemHaiku.cpp,
-        DragDataHaiku.cpp and DragImageHaiku.cpp
-
-        * platform/haiku/ContextMenuHaiku.cpp: Added.
-        (WebCore::ContextMenuReceiver::ContextMenuReceiver):
-        (WebCore::ContextMenuReceiver::HandleMessage):
-        (WebCore::ContextMenuReceiver::Result):
-        (WebCore::ContextMenu::ContextMenu):
-        (WebCore::ContextMenu::~ContextMenu):
-        (WebCore::ContextMenu::appendItem):
-        (WebCore::ContextMenu::itemCount):
-        (WebCore::ContextMenu::insertItem):
-        (WebCore::ContextMenu::platformDescription):
-        (WebCore::ContextMenu::setPlatformDescription):
-        * platform/haiku/ContextMenuItemHaiku.cpp: Added.
-        (ContextMenuItem::ContextMenuItem):
-        (ContextMenuItem::~ContextMenuItem):
-        (ContextMenuItem::releasePlatformDescription):
-        (ContextMenuItem::type):
-        (ContextMenuItem::setType):
-        (ContextMenuItem::action):
-        (ContextMenuItem::setAction):
-        (ContextMenuItem::title):
-        (ContextMenuItem::setTitle):
-        (ContextMenuItem::platformSubMenu):
-        (ContextMenuItem::setSubMenu):
-        (ContextMenuItem::setChecked):
-        (ContextMenuItem::setEnabled):
-        (ContextMenuItem::enabled):
-        * platform/haiku/DragDataHaiku.cpp: Added.
-        (WebCore::DragData::canSmartReplace):
-        (WebCore::DragData::containsColor):
-        (WebCore::DragData::containsFiles):
-        (WebCore::DragData::asFilenames):
-        (WebCore::DragData::containsPlainText):
-        (WebCore::DragData::asPlainText):
-        (WebCore::DragData::asColor):
-        (WebCore::DragData::createClipboard):
-        (WebCore::DragData::containsCompatibleContent):
-        (WebCore::DragData::containsURL):
-        (WebCore::DragData::asURL):
-        (WebCore::DragData::asFragment):
-        * platform/haiku/DragImageHaiku.cpp: Added.
-        (WebCore::dragImageSize):
-        (WebCore::deleteDragImage):
-        (WebCore::scaleDragImage):
-        (WebCore::dissolveDragImageToFraction):
-        (WebCore::createDragImageFromImage):
-        (WebCore::createDragImageIconForCachedImage):
-
-2009-07-16  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Darin Fisher and Brett Wilson.
-
-        Refactor Skia implementation of gradients and patterns.
-
-        http://bugs.webkit.org/show_bug.cgi?id=26618
-
-        The following layout tests were breaking on Chromium/Linux:
-
-        LayoutTests/svg/custom/js-late-gradient-creation.svg (bad baseline PNG)
-        LayoutTests/svg/custom/js-late-gradient-and-object.creation.svg
-        LayoutTests/svg/custom/js-late-pattern-creation.svg (bad baseline PNG)
-        LayoutTests/svg/custom/js-late-pattern-and-object-creation.svg
-
-        I could've fixed these the easy way, by copying the same 5
-        lines of code we use everywhere we need patterns or gradients, but
-        I decided to fix it the hard way:  by refactoring the code so that
-        PlatformContextSkia::setupPaintForFilling() and
-        PlatformContextSkia::setupPaintForStroking() do the right thing,
-        and also handle gradients and patterns.
-        
-        This required pushing the gradients and patterns set in 
-        (generic) GraphicsContext::setFillPattern() and friends down into
-        PlatformContextSkia.  For this, I followed the setPlatformXXX()
-        pattern used elsewhere in GraphicsContext, and stubbed them out on
-        the other platforms with #if !PLATFORM(SKIA).  This also required
-        pushing changes to the gradientSpaceTransform from the Gradient into 
-        GradientSkia.
-
-        Since it's a Skia context, I decided to cache the values as
-        SkShaders.  There were existing m_pattern and m_gradient SkShaders,
-        but they were unused, and whose use was ambiguous, so I
-        replaced them with one SkShader each for filling and stroking.
-
-        * platform/graphics/Gradient.cpp:
-        (WebCore::Gradient::setGradientSpaceTransform):
-        (WebCore::Gradient::setPlatformGradientSpaceTransform):
-        * platform/graphics/Gradient.h:
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::setStrokePattern):
-        (WebCore::GraphicsContext::setFillPattern):
-        (WebCore::GraphicsContext::setStrokeGradient):
-        (WebCore::GraphicsContext::setFillGradient):
-        (WebCore::GraphicsContext::setPlatformFillGradient):
-        (WebCore::GraphicsContext::setPlatformFillPattern):
-        (WebCore::GraphicsContext::setPlatformStrokeGradient):
-        (WebCore::GraphicsContext::setPlatformStrokePattern):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/skia/GradientSkia.cpp:
-        (WebCore::Gradient::setPlatformGradientSpaceTransform):
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::setPlatformFillGradient):
-        (WebCore::GraphicsContext::setPlatformFillPattern):
-        (WebCore::GraphicsContext::setPlatformStrokeGradient):
-        (WebCore::GraphicsContext::setPlatformStrokePattern):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::strokeRect):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::State::State):
-        (PlatformContextSkia::State::~State):
-        (PlatformContextSkia::drawRect):
-        (PlatformContextSkia::setupPaintCommon):
-        (PlatformContextSkia::setupPaintForFilling):
-        (PlatformContextSkia::setupPaintForStroking):
-        (PlatformContextSkia::setFillColor):
-        (PlatformContextSkia::setStrokeColor):
-        (PlatformContextSkia::setStrokeShader):
-        (PlatformContextSkia::setFillShader):
-        * platform/graphics/skia/PlatformContextSkia.h:
-        * platform/graphics/skia/SkiaFontWin.cpp:
-        (WebCore::skiaDrawText):
-        (WebCore::paintSkiaText):
-        * svg/graphics/SVGPaintServer.cpp:
-        (WebCore::SVGPaintServer::teardown):
-
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+2010-02-04  Mikhail Naganov  <mnaganov@chromium.org>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Timothy Hatcher.
 
-        Added Haiku-specific files for WebCore/platform/image-decoders/.
-        https://bugs.webkit.org/show_bug.cgi?id=26949
+        Put JSC-specific debugger & profiler code under "USE(JSC)" defines.
+        The plan is to enable "JAVASCRIPT_DEBUGGER" in Chromium and then
+        make this code engine-agnostic.
 
-        Adding a new file, ImageDecoderHaiku.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=34531
 
-        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp: Added.
-        (WebCore::RGBA32Buffer::RGBA32Buffer):
-        (WebCore::RGBA32Buffer::clear):
-        (WebCore::RGBA32Buffer::zeroFill):
-        (WebCore::RGBA32Buffer::copyBitmapData):
-        (WebCore::RGBA32Buffer::setSize):
-        (WebCore::RGBA32Buffer::asNewNativeImage):
-        (WebCore::RGBA32Buffer::hasAlpha):
-        (WebCore::RGBA32Buffer::setHasAlpha):
-        (WebCore::RGBA32Buffer::setStatus):
-        (WebCore::RGBA32Buffer::operator=):
-        (WebCore::RGBA32Buffer::width):
-        (WebCore::RGBA32Buffer::height):
+        * inspector/InjectedScriptHost.cpp:
+        * inspector/InjectedScriptHost.h:
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptCallFrame.cpp:
+        * inspector/JavaScriptCallFrame.h:
+        * inspector/JavaScriptDebugListener.h:
+        * inspector/JavaScriptDebugServer.cpp:
+        * inspector/JavaScriptDebugServer.h:
+        * inspector/JavaScriptProfile.cpp:
+        * inspector/JavaScriptProfile.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        * inspector/JavaScriptProfileNode.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
 
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+2010-02-03  Nicholas Young  <nicholas.young@nokia.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Eric Carlson.
 
-        Added Haiku-specific files for WebCore/page/.
-        https://bugs.webkit.org/show_bug.cgi?id=26949
+        Defer formatting of times displayed on media controls to the current theme.
+        https://bugs.webkit.org/show_bug.cgi?id=34405
 
-        Adding three new files, DragControllerHaiku.cpp, EventHandlerHaiku.cpp
-        and FrameHaiku.cpp
+        No new tests needed. Refactoring Only.
 
-        * page/haiku/DragControllerHaiku.cpp: Added.
-        (WebCore::DragController::isCopyKeyDown):
-        (WebCore::DragController::dragOperation):
-        (WebCore::DragController::maxDragImageSize):
-        (WebCore::DragController::cleanupAfterSystemDrag):
-        * page/haiku/EventHandlerHaiku.cpp: Added.
-        (WebCore::isKeyboardOptionTab):
-        (WebCore::EventHandler::invertSenseOfTabsToLinks):
-        (WebCore::EventHandler::tabsToAllControls):
-        (WebCore::EventHandler::focusDocumentView):
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        (WebCore::EventHandler::passMouseDownEventToWidget):
-        (WebCore::EventHandler::eventActivatedView):
-        (WebCore::EventHandler::passSubframeEventToSubframe):
-        (WebCore::EventHandler::passWheelEventToWidget):
-        (WebCore::EventHandler::createDraggingClipboard):
-        (WebCore::EventHandler::passMousePressEventToSubframe):
-        (WebCore::EventHandler::passMouseMoveEventToSubframe):
-        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
-        (WebCore::EventHandler::accessKeyModifiers):
-        * page/haiku/FrameHaiku.cpp: Added.
-        (WebCore::Frame::dragImageForSelection):
-
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
+        * rendering/MediaControlElements.cpp: Removed formatTime()
+        (WebCore::MediaControlTimeDisplayElement::setCurrentValue): No longer sets inner text
+        * rendering/MediaControlElements.h:
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateTimeDisplay): Asks the theme to format the time display elements
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::formatMediaControlsTime): new virtual method
+        (WebCore::RenderTheme::formatMediaControlsCurrentTime): new virtual method
+        (WebCore::RenderTheme::formatMediaControlsRemainingTime): new virtual method
+        * rendering/RenderTheme.h:
 
-        Added Haiku-specific files for WebCore/editing/.
-        https://bugs.webkit.org/show_bug.cgi?id=26949
+2010-02-03  Steve Falkenburg  <sfalken@apple.com>
 
-        Adding one new file, EditorHaiku.cpp
+        Windows Debug_All build fix.
 
-        * editing/haiku/EditorHaiku.cpp: Added.
-        (WebCore::Editor::newGeneralClipboard):
+        * platform/graphics/win/WKCACFLayer.cpp:
 
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+2010-02-03  Brady Eidson  <beidson@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Alexey Proskuryakov.
 
-        Added Haiku-specific files for WebCore/bindings/js/.
-        https://bugs.webkit.org/show_bug.cgi?id=26949
+        REGRESSION (r51644): WebCore/manual-tests/linkjump-1.html fails
+        <rdar://problem/7595694> and https://bugs.webkit.org/show_bug.cgi?id=34550
 
-        Adding a new file, ScriptControllerHaiku.cpp
+        Tests: fast/loader/document-with-fragment-url-1.html
+               fast/loader/document-with-fragment-url-2.html
+               fast/loader/document-with-fragment-url-3.html
+               fast/loader/document-with-fragment-url-4.html
 
-        * bindings/js/ScriptControllerHaiku.cpp: Added.
-        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * platform/KURL.cpp:
+        (WebCore::KURL::init): When resolving new URL from an empty reference relative to an absolute URL,
+          any fragment identifier from the absolute URL should be removed from the resulting resolution.
 
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        Added Haiku-specific files for WebCore/platform/text/.
-        https://bugs.webkit.org/show_bug.cgi?id=26949
+        [BREWMP] Port TextBreakIteratorInternalICU
+        https://bugs.webkit.org/show_bug.cgi?id=34515
 
-        Adding two new files, StringHaiku.cpp
-        and TextBreakIteratorInternalICUHaiku.cpp
+        Port TextBreakIteratorInternalICU.
 
-        * platform/text/haiku/StringHaiku.cpp: Added.
-        (WebCore::String::String):
-        (WebCore::String::operator BString):
-        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp: Added.
+        * platform/text/brew/TextBreakIteratorInternalICUBrew.cpp: Added.
+        (WebCore::currentSearchLocaleID):
         (WebCore::currentTextBreakLocaleID):
 
-2009-07-16  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Sends the basename of a selected file for non-multipart form submission.
-        <https://bugs.webkit.org/show_bug.cgi?id=26505>
-
-        Test: fast/forms/get-file-upload.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::appendFormData):
-
-2009-07-16  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by David Levin.
-
-        [V8] Centralize hidden property names
-        https://bugs.webkit.org/show_bug.cgi?id=27359
-
-        No behavior change.  Just moving these names to a central location.
-        I'll move the rest of our hidden property names as I sweep though the
-        bindings.
-
-        * WebCore.gypi:
-        * bindings/v8/V8HiddenPropertyName.cpp: Added.
-        (WebCore::V8HiddenPropertyName::objectPrototype):
-        (WebCore::V8HiddenPropertyName::isolatedWorld):
-        * bindings/v8/V8HiddenPropertyName.h: Added.
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
-        (WebCore::V8IsolatedWorld::getEntered):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::getHiddenObjectPrototype):
-        (WebCore::V8Proxy::installHiddenObjectPrototype):
-
-2009-07-16  Dan Bernstein  <mitz@apple.com>
+2010-02-03  Adele Peterson  <adele@apple.com>
 
         Reviewed by Simon Fraser.
 
-        REGRESSION (r41238) Repainted portion of a scaled image does not line up with full image
-        https://bugs.webkit.org/show_bug.cgi?id=26747
-        rdar://problem/7009243
-
-        Test: fast/repaint/background-misaligned.html
-
-        * platform/graphics/Image.cpp:
-        (WebCore::Image::drawTiled): Moved a variable definition closer to where
-        it is used.
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::BitmapImage::draw): In the subimage code path, compute a
-        pixel-aligned source rect, because the subiamge is always pixel-aligned
-        in source space, and adjust the destination rect to preserve the
-        source -> destination mapping. Clip to the (original) destination rect
-        to prevent bleeding out.
+        Fix for <rdar://problem/7594212> 
+        https://bugs.webkit.org/show_bug.cgi?id=34549 - CSS counters crash at http://www.w3.org/TR/css3-content/
+        CrashTracer: [USER] 20 crashes in Safari at com.apple.WebCore: WebCore::CounterNode::insertAfter + 319
 
-2009-07-16  Jeremy Orlow  <jorlow@chromium.org>
+        Test: fast/css/counters/counter-before-selector-crash.html
 
-        Reviewed by Adam Barth.
-
-        Add a sessionStorageEnabled setting to the settings class.
-        https://bugs.webkit.org/show_bug.cgi?id=27318
-
-        Allow LocalStorage to be enabled without enabling SessionStorage at
-        runtime.  There is a settings class setting for localStorage, but not
-        for sessionStorage.  We want to be able to test one of these features
-        without necessarily enabling the other.
-
-        SessionStorage defaults to true so as to not change behavior and
-        because there really aren't any security concerns around SessionStorage
-        (unlike LocalsStorage).  The flag is needed in Chromium only because
-        we want to enable the compile time flag in the default build, but don't
-        want it on by default until it's been thoroughly tested.
-
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::sessionStorage):  Check the new flag
-        (WebCore::DOMWindow::localStorage):  A bit of cleanup
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):  Default the flag to true
-        (WebCore::Settings::setSessionStorageEnabled):  Add the new flag
-        * page/Settings.h:
-        (WebCore::Settings::sessionStorageEnabled):  Get the new flag
-
-2009-07-16  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed.
+        * rendering/RenderCounter.cpp: (WebCore::updateCounters): nil check.
 
-        Revert 45987.  Tests did not pass on Windows.
+2010-02-03  Adele Peterson  <adele@apple.com>
 
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::appendFormData):
-
-2009-07-16  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Added SHARED_WORKER flag to Windows build files, as well as associated .ccp/.h files.
-        Added missing V8 bindings to the AllInOne file
-
-        https://bugs.webkit.org/show_bug.cgi?id=27321
-
-        * WebCore.vcproj/WebCore.vcproj:
-        Added missing files to build.
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        Added missing V8 bindings (V8AbstractWorker.cpp and V8SharedWorker.cpp)
-        * DerivedSources.cpp
-        Added missing JS bindings (JSAbstractWorker.cpp and JSSharedWorker.cpp)
-
-2009-07-16  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by David Levin.
-
-        Add a getter in MessagePortChannel for the PlatformMessagePortChannel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27337
-
-        * dom/MessagePortChannel.h:
-        (WebCore::MessagePortChannel::channel):
-
-2009-07-16  Xiaomei Ji  <xji@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Fix tooltip does not get its directionality from its element's directionality.
-        https://bugs.webkit.org/show_bug.cgi?id=24187
-
-        Per mitz's suggestion in comment #6, while getting the plain-text 
-        title, we also get the directionality of the title. How to handle 
-        the directionality is up to clients. Clients could ignore it, 
-        or use attribute or unicode control characters to display the title
-        as what they want.
-
-        WARNING: NO TEST CASES ADDED OR CHANGED
-
-        * WebCore.base.exp: Replace 2 names due to signature change.
-        * loader/EmptyClients.h: 
-        (WebCore::EmptyChromeClient::setToolTip): Add direction as 2nd parameter.
-        * page/Chrome.cpp:
-        (WebCore::Chrome::setToolTip): Calculate tooltip direction as well and pass it to client to take care when display tooltip.
-        * page/ChromeClient.h: Add direction as 2nd parameter to pure virtual function setToolTip().
-        * page/chromium/ChromeClientChromium.h:
-        (WebCore::ChromeClientChromium::setToolTip): Add setToolTip() 
-        temprarily to make chromium compile after pick up this webkit patch.
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::spellingToolTip): Besides getting the 
-        spelling tooltip, get its directionality as well.
-        (WebCore::HitTestResult::title): Besides getting the title, 
-        get its directionality as well.
-        * rendering/HitTestResult.h: Add 2 more methods.
-
-2009-07-16  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Oliver Hunt.
-
-        [CAIRO] pattern of a canvas-element changes after modifications on canvas-element
-        https://bugs.webkit.org/show_bug.cgi?id=20578
-
-        Copy pixel image in ImageBuffer::image() just like CG and Skia glue.
-
-        Test: fast/canvas/canvas-pattern-modify.html
-
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (copySurface):
-        (WebCore::ImageBuffer::image):
-
-2009-07-16  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27353
-        Images mispositioned because of bug in percentage-based relative positioning.
-
-        Added fast/css/nested-floating-relative-position-percentages.html
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::relativePositionOffsetX):
-
-2009-07-16  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Sends the basename of a selected file for non-multipart form submission.
-        <https://bugs.webkit.org/show_bug.cgi?id=26505>
-
-        Test: fast/forms/get-file-upload.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::appendFormData):
-
-2009-07-16  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Video size sometimes jumps just after the video starts loading
-        https://bugs.webkit.org/show_bug.cgi?id=27352
-
-        Ensure that the media player is at or after the 'HaveMetadata' state so that
-        the instrinsic size is known before we create the layer for video. This avoids
-        a flash caused by computing the video rect using the default intrinsic size, and then
-        re-computing it when that size changes.
-        
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::isReadyForRendering):
-        (WebCore::MediaPlayerPrivate::updateStates):
-        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
-
-2009-07-16  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Antti Koivisto.
-        Patch by Brady Eidson and Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26496
-        <rdar://problem/7065391> Microsoft Outlook Web Access fails because XHR stream connection blocks script loading/revalidation
-
-        After refreshing a page and when all CachedResources on that page are in validation mode, they got an exemption
-        from the connection-per-host limit.  Removing that exemption makes the test case load smoothly after reloads.
-
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::servePendingRequests): Remove the resourceIsCacheValidator exemption to the connection-per-host limit.
-
-2009-07-16  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] V8IsolatedWorld::evaluate needs to call didCreateIsolatedScriptContext
-        https://bugs.webkit.org/show_bug.cgi?id=27335
-
-        evaluateInNewContext makes this delegate call.  evaluateInNewWorld
-        needs to make the same call.  This does not appear to be testable with
-        our current technology.
-
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::evaluate):
-
-2009-07-15  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix a typo: application/atom=xml -> application/atom+xml.
-
-        * dom/ProcessingInstruction.cpp:
-        (WebCore::ProcessingInstruction::checkStyleSheet):
-
-2009-07-16  Dean McNamee  <deanm@chromium.org>
-
-        Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27292
-        Improve handling of <canvas> path operations on an empty path.
-        Implement Skia's Path::hasCurrentPoint().
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::lineTo):
-        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
-        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
-        * platform/graphics/skia/PathSkia.cpp:
-        (WebCore::Path::hasCurrentPoint):
-
-2009-07-15  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Setting white-space and word-wrap via CSS in textarea doesn't override the wrap attribute
-        https://bugs.webkit.org/show_bug.cgi?id=26254
-
-        Make it so that setting white-space and word-wrap via CSS
-        overrides the wrap attribute.
-
-        This involves having the shadow div in the textarea inherit
-        the CSS from its parent instead of hard-coding it in
-        RenderTextControlMultiline.
-        
-        Committer note: Earlier I reverted this change because I did it incorrectly
-        by leaving out css/html.css. In the patch, the filename was the old name
-        css/html4.css and that led to my error.
-
-        * css/html.css:
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
-
-2009-07-15  James Hawkins  <jhawkins@google.com>
-
-        Reviewed by Adam Barth.
-
-        [V8] Remove a local variable that is shadowing a function parameter.
-        https://bugs.webkit.org/show_bug.cgi?id=27309
-
-        No test required as this modification does not change the current behavior.
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-
-2009-07-15  Adam Langley  <agl@google.com>
-
-        No review: reverting previous change.
-
-        Revert r45959:
-
-        2009-07-15  Dumitru Daniliuc  <dumi@chromium.org>
-        Reviewed by Dimitri Glazkov.
-
-        Adding the Win SQLite VFS implementation for Chromium.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26940
-
-
-        The Chromium side of this patch was landed in 20839, but broke the build. It
-        was reverted in r20840. Thus, I'm reverting this side of the patch too.
-
-        * WebCore.gypi:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Removed.
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Removed.
-
-2009-07-15  David Levin  <levin@chromium.org>
-
-        Layout test fix, reverting previous change.
-
-        Reverting r45962 as it caused several layout test failures.
-
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
-
-2009-06-08  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Setting white-space and word-wrap via CSS in textarea doesn't override the wrap attribute
-        https://bugs.webkit.org/show_bug.cgi?id=26254
-
-        Make it so that setting white-space and word-wrap via CSS
-        overrides the wrap attribute.
-
-        This involves having the shadow div in the textarea inherit
-        the CSS from its parent instead of hard-coding it in
-        RenderTextControlMultiline.
-
-        * css/html4.css:
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
-
-2009-07-15  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Adding the Win SQLite VFS implementation for Chromium.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26940
-
-        * platform/chromium/ChromiumBridge.h:
-        * platform/sql/chromium: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Added.
-
-2009-07-15  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        Bug 25151 - workers that fail to load scripts not firing error event.
-        https://bugs.webkit.org/show_bug.cgi?id=25151
-
-        This fixes the problem that an error event is not fired when the worker
-        script fails to load. Some reasons this may occur are an invalid URL for
-        the worker script or a cross-origin redirect.
-
-        We also moves the code to complete the URL and check its origin from
-        Worker constructor to WorkerScriptLoader loading functions in order to
-        move the exception throwing logic out of the scope of Worker constructor.
-        Due to this change, we also remove the output ExceptionCode parameter
-        in the worker constructor. Corresponding JS/V8 binding codes have been
-        updated to reflect this change.
-
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::constructWorker):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * workers/Worker.cpp:
-        (WebCore::Worker::Worker):
-        (WebCore::Worker::notifyFinished):
-        * workers/Worker.h:
-        (WebCore::Worker::create):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::importScripts):
-        * workers/WorkerScriptLoader.cpp:
-        (WebCore::toCrossOriginRedirectPolicy):
-        (WebCore::WorkerScriptLoader::loadSynchronously):
-        (WebCore::WorkerScriptLoader::loadAsynchronously):
-        (WebCore::notifyLoadErrorTask):
-        (WebCore::WorkerScriptLoader::createResourceRequest):
-        (WebCore::WorkerScriptLoader::didFail):
-        (WebCore::WorkerScriptLoader::didFailRedirectCheck):
-        (WebCore::WorkerScriptLoader::didReceiveAuthenticationCancellation):
-        (WebCore::WorkerScriptLoader::notifyError):
-        * workers/WorkerScriptLoader.h:
-        (WebCore::):
-        (WebCore::WorkerScriptLoader::url):
-
-2009-07-15  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        text-shadow is not drawn for text with transparent colour
-        https://bugs.webkit.org/show_bug.cgi?id=21374
+        Reviewed by Brady Eidson.
 
-        Test: fast/text/shadow-translucent-fill.html
+        Initialize the variable in the last checkin to false.  I didn't realize DRT relies on this being false.  
+        So ports that want visited link tracking need to set that flag.
 
-        * rendering/InlineTextBox.cpp:
-        (WebCore::paintTextWithShadows): If the text fill color is not opaque,
-        paint all shadows separately from the text, by casting them from
-        clipped-out opaque text.
+        * page/PageGroup.cpp:
 
-2009-07-15  Adam Treat  <adam.treat@torchmobile.com>
+2010-02-03  Adele Peterson  <adele@apple.com>
 
-        Fix the Qt build.
+        Reviewed by Brady Eidson.
 
-        * html/HTMLAreaElement.cpp:
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=34547
+        static shouldTrackVisitedLinks is not initialized
 
-2009-07-15  Jeremy Orlow  <jorlow@chromium.org>
+        For ports that don't call into WebKit to initialize this, 
+        we should initialize to true so they get the visited link behavior by default.
 
-        Reviewed by Darin Fisher.
+        * page/PageGroup.cpp:
 
-        Cleanup DOM Storage dependencies.
-        https://bugs.webkit.org/show_bug.cgi?id=27180
-
-        DOM Storage had several unnecessary (and probably unintended)
-        dependencies.  This patch replaces many includes of header files with
-        forward declaration of classes, making some destructors explicit, and
-        taking some factories out of the header files.
-
-        This will allow things like StorageAreaSync to take a StorageAreaImpl*
-        (as it should) rather than a StorageArea* which previously weren't
-        possible because the dependencies were such a tangled mess.
-
-        * storage/LocalStorageTask.cpp:
-        (WebCore::LocalStorageTask::~LocalStorageTask):
-        * storage/LocalStorageTask.h:
-        * storage/Storage.cpp:
-        (WebCore::Storage::~Storage):
-        * storage/Storage.h:
-        * storage/StorageArea.cpp:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        * storage/StorageAreaImpl.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::~StorageAreaSync):
-        * storage/StorageAreaSync.h:
-        * storage/StorageEvent.cpp:
-        (WebCore::StorageEvent::create):
-        (WebCore::StorageEvent::StorageEvent):
-        * storage/StorageEvent.h:
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        * storage/StorageNamespaceImpl.h:
-        * storage/StorageSyncManager.cpp:
-        (WebCore::StorageSyncManager::~StorageSyncManager):
-        * storage/StorageSyncManager.h:
-
-2009-07-15  Chris Marrin  <cmarrin@apple.com>
+2010-02-03  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Simon Fraser.
 
-        Incorrect animation when trying to duplicate effect of transform-origin
-        https://bugs.webkit.org/show_bug.cgi?id=27310
-
-        The bug is that matrix animation is being used when animating
-        a list of transform functions that match in the from and to states.
-        This sometimes works. But because of the way CA does matrix animation
-        function lists like the one shown in the testcase animate incorrectly.
-
-        This fixes the bug by always doing component animation
-        as long as the function lists match. This allows CA
-        to animate the components and then recompose the result
-        into the correct matrix.
-
-        Test: animations/transform-origin-vs-functions.html
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::animateTransform):
-
-2009-07-15  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by David Levin.
-
-        Upstream the V8NPObject and NPV8Object build changes for WebCore.gypi.
-
-        Add upstreamed V8 bindings files into WebCore.gypi so they can be seen
-        downstream
-        https://bugs.webkit.org/show_bug.cgi?id=27274
-
-        Changes the build file for chromium.  Test built the chromium tree
-        to verify.
-
-        * WebCore.gypi:
-
-2009-07-15  Mark Rowe  <mrowe@apple.com>
-
-        I like it when the code compiles.
-
-        * WebCore.base.exp:
-
-2009-07-15  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Renamed parseURL to deprecatedParseURL.
-
-        * bindings/js/JSAttrCustom.cpp:
-        (WebCore::JSAttr::setValue): Renamed.
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::allowSettingSrcToJavascriptURL): Renamed.
-        * bindings/js/JSHTMLFrameElementCustom.cpp:
-        (WebCore::allowSettingJavascriptURL): Renamed.
-        * bindings/js/JSHTMLIFrameElementCustom.cpp:
-        (WebCore::JSHTMLIFrameElement::setSrc): Renamed.
-        * bindings/objc/DOM.mm:
-        (-[DOMElement _getURLAttribute:]): Renamed.
-        * bindings/objc/DOMHTML.mm:
-        (-[DOMHTMLDocument _createDocumentFragmentWithMarkupString:baseURLString:]): Renamed.
-        * bindings/v8/custom/V8CustomBinding.cpp:
-        (WebCore::allowSettingFrameSrcToJavascriptUrl): Renamed.
-        * css/CSSHelper.cpp:
-        (WebCore::deprecatedParseURL): Renamed.
-        * css/CSSHelper.h: Renamed and updated comment.
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::defaultEventHandler): Renamed.
-        (WebCore::HTMLAnchorElement::parseMappedAttribute): Renamed.
-        * html/HTMLBaseElement.cpp:
-        (WebCore::HTMLBaseElement::parseMappedAttribute): Renamed.
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::parseMappedAttribute): Renamed.
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::parseMappedAttribute): Renamed.
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::parseMappedAttribute): Renamed.
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Renamed.
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::parseMappedAttribute): Renamed.
-        * html/HTMLImageLoader.cpp:
-        (WebCore::HTMLImageLoader::sourceURI): Renamed.
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::parseMappedAttribute): Renamed.
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::parseMappedAttribute): Renamed.
-        * html/HTMLTableElement.cpp:
-        (WebCore::HTMLTableElement::parseMappedAttribute): Renamed.
-        * html/HTMLTablePartElement.cpp:
-        (WebCore::HTMLTablePartElement::parseMappedAttribute): Renamed.
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::parseTag): Renamed.
-        * html/PreloadScanner.cpp:
-        (WebCore::PreloadScanner::processAttribute): Renamed.
-        (WebCore::PreloadScanner::emitCSSRule): Renamed.
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::declareAndWriteDragImage): Renamed.
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writeImage): Renamed.
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::declareAndWriteDragImage): Renamed.
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::ClipboardWin::declareAndWriteDragImage): Renamed.
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::absoluteImageURL): Renamed.
-        (WebCore::HitTestResult::absoluteMediaURL): Renamed.
-        (WebCore::HitTestResult::absoluteLinkURL): Renamed.
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::defaultEventHandler): Renamed.
-        * svg/SVGImageLoader.cpp:
-        (WebCore::SVGImageLoader::sourceURI): Renamed.
-        * wml/WMLAElement.cpp:
-        (WebCore::WMLAElement::defaultEventHandler): Renamed.
-        * wml/WMLImageLoader.cpp:
-        (WebCore::WMLImageLoader::sourceURI): Renamed.
-
-2009-07-15  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        CSSHelper.h's parseURL is a function that no one should ever call
-        Part 1: Eliminate callers in the CSS parser.
-        https://bugs.webkit.org/show_bug.cgi?id=26599
-
-        Test: fast/css/uri-token-parsing.html
-
-        * css/CSSHelper.h: Added a comment explaining why nobody should ever call this
-        function. A FIXME suggests a next step, which would be to rename it deprecatedParseURL.
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue): Removed unneeded call to parseURL;
-        CSSParser::text already takes care of parsing the URI token syntax, and the
-        parseURL function does no good.
-        (WebCore::CSSParser::parseContent): Ditto.
-        (WebCore::CSSParser::parseFillImage): Ditto.
-        (WebCore::CSSParser::parseFontFaceSrc): Ditto.
-        (WebCore::CSSParser::parseBorderImage): Ditto.
-        (WebCore::isCSSWhitespace): Added. Helper function that makes the text function
-        easier to read.
-        (WebCore::CSSParser::text): Tweak logic so that leading and trailing whitespace
-        are both trimmed before removing the quote marks. Changed to use the
-        isCSSWhitespace, isASCIIHexDigit, and toASCIIHexValue functions for clarity.
-
-        * css/CSSParser.h: Removed stray "public:" in this header.
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::substring): Optimized the case where the substring covers
-        the entire string, so we just share the StringImpl instead of making a new one.
-        This case came up in earlier versions of the CSS parser changes above.
-        (WebCore::StringImpl::substringCopy): Streamlined the logic here and made it
-        not call substring any more. Before, this was relying on the substring function
-        always making a copy of any non-empty substring.
+        <rdar://problem/7577604> Drag and Drop: background elements are bleeding through
+        https://bugs.webkit.org/show_bug.cgi?id=34546
 
-2009-07-15  Darin Adler  <darin@apple.com>
+        * manual-tests/drag-image-table-part-decorations.html: Added.
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations): Bail out if this object shouldn’t
+        paint within the current painting root.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintBoxDecorations): Ditto.
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell): Ditto.
+        (WebCore::RenderTableCell::paintBoxDecorations): Ditto.
 
-        Reviewed by John Sullivan.
+2010-02-03  Nate Chapin  <japhet@chromium.org>
 
-        After double-clicking a word, using Shift-arrow to select behaves unpredictably
-        https://bugs.webkit.org/show_bug.cgi?id=27177
-        rdar://problem/7034324
+        Unreviewed, Chromium mac build fix.
 
-        Test: editing/selection/extend-selection-after-double-click.html
+        [V8] Remove unused V8Proxy* variable from generated wrapping code.
 
-        The bug was due to the m_lastChangeWasHorizontalExtension flag, which was not
-        being cleared in many cases where it should have been.
+        * bindings/scripts/CodeGeneratorV8.pm:
 
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::setSelection): Set m_lastChangeWasHorizontalExtension
-        to false. This catches all sorts of cases that don't flow through the modify function.
-        Before, the flag would reflect the last call to the modify function, which was not
-        necessarily the last selection change.
-        (WebCore::SelectionController::willBeModified): Rearrange function for clarity.
-        Remove code that sets m_lastChangeWasHorizontalExtension; that is now handled elsewhere. 
-        (WebCore::SelectionController::modify): Call setLastChangeWasHorizontalExtension after
-        setSelection when setting up a trial selection controller, since setSelection now
-        clears that flag. Also changed both trial selection controller cases to set the flag,
-        although it's not strictly necessary in both cases. Added code to set
-        m_lastChangeWasHorizontalExtension when extending the selection, which used to be
-        handled in willBeModified. Now we need to do it after the selection change.
-
-2009-07-15  Jeremy Orlow  <jorlow@chromium.org>
+2010-02-03  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Need to update DOM Storage files in GYPI file.
-        https://bugs.webkit.org/show_bug.cgi?id=27317
-
-        Need to update DOM Storage files in the GYPI file.  They're pretty out
-        of date and we're on the path towards enabling them for everyone!
-
-        * WebCore.gypi:
-
-2009-07-15  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26794
-        Make Yacc-generated parsers to use fastMalloc/fastFree.
+        [V8] Use toV8() to wrap in the custom bindings, and remove
+        the old wrapping code from V8DOMWrapper.
         
-        Define YYMALLOC and YYFREE to fastMalloc and fastFree
-        respectively.
-
-        * css/CSSGrammar.y:
-        * xml/XPathGrammar.y:
-
-2009-07-15  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27193
-        Don't run in to anonymous blocks.  No other browsers do this, and our implementation of run-in
-        is effectively broken as a result.
-
-        No new tests. Changed fast/runin/001.html and fast/runin/generated.html to match new behavior.
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::handleRunInChild):
-
-2009-07-15  Yuzo Fujishima  <yuzo@google.com>
-
-        Reviewed by Darin Adler.
-
-        Test: fast/js/instanceof-operator.html
-
-        Fix for: Bug 25205 -  XMLHttpRequest instance is not an instanceof XMLHttpRequest
-        https://bugs.webkit.org/show_bug.cgi?id=25205
-
-        In addition to for XMLHttpRequest, this also fixes for:
-        - Audio
-        - Image
-        - MessageChannel
-        - Option
-        - WebKitCSSMatrix
-        - WebKitPoint
-        - Worker
-        - XSLTProcessor
-
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::JSAudioConstructor::JSAudioConstructor):
-        * bindings/js/JSAudioConstructor.h:
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMConstructorObject::createStructure):
-        (WebCore::DOMConstructorObject::DOMConstructorObject):
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::JSImageConstructor):
-        * bindings/js/JSImageConstructor.h:
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
-        * bindings/js/JSMessageChannelConstructor.h:
-        * bindings/js/JSOptionConstructor.cpp:
-        (WebCore::JSOptionConstructor::JSOptionConstructor):
-        * bindings/js/JSOptionConstructor.h:
-        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
-        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
-        * bindings/js/JSWebKitCSSMatrixConstructor.h:
-        * bindings/js/JSWebKitPointConstructor.cpp:
-        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
-        * bindings/js/JSWebKitPointConstructor.h:
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
-        * bindings/js/JSWorkerConstructor.h:
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
-        * bindings/js/JSXMLHttpRequestConstructor.h:
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
-        * bindings/js/JSXSLTProcessorConstructor.h:
-
-2009-07-15  Kai Br�ning  <kai@granus.net>
-
-        Reviewed by Dave Hyatt.
-
-        CSS21 attribute selectors not dynamic for xml.
-        https://bugs.webkit.org/show_bug.cgi?id=25072
-
-        Moved the relevant test in StyledElement::attributeChanged()
-        to a new function Element::recalcStyleIfNeededAfterAttributeChanged()
-        so it can be called from both StyledElement::attributeChanged()
-        and Element::attributeChanged().
-        Refactored Element::attributeChanged() into
-        Element::updateAfterAttributeChanged() and
-        Element::recalcStyleIfNeededAfterAttributeChanged(), which are called
-        separately from StyledElement::attributeChanged().
-
-        Test: fast/css/attribute-selector-dynamic.xml
-
-        * dom/Element.cpp:
-        (WebCore::Element::attributeChanged):
-        (WebCore::Element::updateAfterAttributeChanged):
-        (WebCore::Element::recalcStyleIfNeededAfterAttributeChanged):
-        * dom/Element.h:
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::attributeChanged):
-
-2009-07-15  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Layout test failures for drawImage in Canvas
-        https://bugs.webkit.org/show_bug.cgi?id=27311
-
-        Fixing several canvas layout tests failures due to a
-        missing return statement in CanvasRenderingContext2DDrawImage() which
-        was accidentally removed in r45929.
-
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-
-2009-07-15  Robert Hogan  <robert@roberthogan.net>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26969
-
-        If the httpMethod() of the request passed to SubresourceLoader::create is not
-        supported by the client we must expect to call didFail() while m_loader is still null.
-
-        * loader/DocumentThreadableLoader.cpp:
-        (DocumentThreadableLoader::didFail):Changed.
-
-2009-07-15  Mark Rowe  <mrowe@apple.com>
-
-        Fix the Mac build.
-
-        * WebCore.base.exp:
-        * css/MediaQueryEvaluator.cpp:
-        * rendering/SVGRenderTreeAsText.cpp:
-        * rendering/style/SVGRenderStyle.cpp:
-        * svg/graphics/SVGPaintServer.cpp:
-
-2009-07-07  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] drawImage method of HTMLCanvasElement to accept HTMLVideoElement as argument
-        https://bugs.webkit.org/show_bug.cgi?id=27170
-
-        Changed CanvasRenderingContext2DDrawImage() to accept HTMLVideoElement
-        as a parameter of drawImage() for HTMLCanvasElement.
-
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-
-2009-07-15  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Fix isolated world constructors
-        https://bugs.webkit.org/show_bug.cgi?id=27287
-
-        Don't enter V8Proxy::m_context before creating DOM constructors.
-        Instead, use getWrapperContext to get the right context.
-
-        After this patch, all my tests pass.  I'll enable the feature
-        downstream and land the tests.
+        https://bugs.webkit.org/show_bug.cgi?id=32563
 
         * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/ScriptObject.cpp:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
         * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getConstructor):
-        (WebCore::V8DOMWrapper::lookupDOMWrapper):
-        * bindings/v8/V8DOMWrapper.h:
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::evaluate):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::createWrapperFromCache):
-        (WebCore::V8Proxy::isContextInitialized):
-        (WebCore::V8Proxy::disposeContextHandles):
-        (WebCore::V8Proxy::installDOMWindow):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::getHiddenObjectPrototype):
-        (WebCore::V8Proxy::installHiddenObjectPrototype):
-        * bindings/v8/V8Proxy.h:
-
-2009-07-15  Antonio Gomes   <antonio.gomes@openbossa.org>
-
-        Reviewed by Darin Adler.
-
-        useless null-check statement in visible_units.cpp@logicalStartOfLine
-        https://bugs.webkit.org/show_bug.cgi?id=27154
-
-        Simple fix.
-
-        * editing/visible_units.cpp:
-        (WebCore::logicalStartOfLine): Doubled honorEditableBoundaryAtOrAfter() call removed.
-
-2009-07-15  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27304
-        WebKit should provide usage and eligibility information about the page cache.
-
-        * WebCore.base.exp:
-
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrame::childFrameCount):
-        * history/CachedFrame.h:
-
-        * history/PageCache.cpp:
-        (WebCore::PageCache::frameCount):
-        (WebCore::PageCache::autoreleasedPageCount):
-        * history/PageCache.h:
-        (WebCore::PageCache::pageCount):
-
-2009-07-15  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by David Levin.
-
-        Chromium's canvas forgets its context after fillText again
-        https://bugs.webkit.org/show_bug.cgi?id=27293
-
-        No new tests because the test for this was already added in
-        https://bugs.webkit.org/show_bug.cgi?id=26436
-
-        * platform/graphics/chromium/TransparencyWin.cpp:
-        (WebCore::TransparencyWin::compositeTextComposite):
-
-2009-07-14  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27283
-
-        Implement the new 'rem' unit from CSS3.
-
-        Added some rem-* tests in fast/css.
-
-        * css/CSSGrammar.y:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::validUnit):
-        (WebCore::unitFromString):
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::lex):
-        * css/CSSParserValues.cpp:
-        (WebCore::CSSParserValue::createCSSValue):
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::computeLengthInt):
-        (WebCore::CSSPrimitiveValue::computeLengthIntForLength):
-        (WebCore::CSSPrimitiveValue::computeLengthShort):
-        (WebCore::CSSPrimitiveValue::computeLengthFloat):
-        (WebCore::CSSPrimitiveValue::computeLengthDouble):
-        (WebCore::CSSPrimitiveValue::cssText):
-        (WebCore::CSSPrimitiveValue::parserValue):
-        * css/CSSPrimitiveValue.h:
-        (WebCore::CSSPrimitiveValue::):
-        (WebCore::CSSPrimitiveValue::isUnitTypeLength):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::initForStyleResolve):
-        (WebCore::convertToLength):
-        (WebCore::CSSStyleSelector::applyProperty):
-        (WebCore::CSSStyleSelector::mapFillSize):
-        (WebCore::CSSStyleSelector::mapFillXPosition):
-        (WebCore::CSSStyleSelector::mapFillYPosition):
-        (WebCore::CSSStyleSelector::createTransformOperations):
-        * css/CSSStyleSelector.h:
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::device_heightMediaFeatureEval):
-        (WebCore::device_widthMediaFeatureEval):
-        (WebCore::heightMediaFeatureEval):
-        (WebCore::widthMediaFeatureEval):
-        * css/WebKitCSSMatrix.cpp:
-        (WebCore::WebKitCSSMatrix::setMatrixValue):
-        * css/tokenizer.flex:
-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        * dom/Document.h:
-        (WebCore::Document::usesRemUnits):
-        (WebCore::Document::setUsesRemUnits):
-        * dom/Element.cpp:
-        (WebCore::Element::recalcStyle):
-        * rendering/SVGRenderTreeAsText.cpp:
-        (WebCore::writeStyle):
-        * rendering/style/SVGRenderStyle.cpp:
-        (WebCore::SVGRenderStyle::cssPrimitiveToLength):
-        * svg/graphics/SVGPaintServer.cpp:
-        (WebCore::applyStrokeStyleToContext):
-        (WebCore::dashArrayFromRenderingStyle):
-        * svg/graphics/SVGPaintServer.h:
-
-2009-07-15  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        Remove extraneous qualifier, accidentally added in http://trac.webkit.org/changeset/45884.
-
-        * bindings/v8/V8DOMWrapper.h: Removed extraneous qualifier.
-
-2009-07-15  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        [V8] Update bindings for ValiditeState patch.
-        https://bugs.webkit.org/show_bug.cgi?id=19562
-
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-
-2009-07-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Cleanup - Remove obsolete code from the make system
-        https://bugs.webkit.org/show_bug.cgi?id=27299
-
-        * WebCore.pro:
-
-2009-07-15  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        Fix the build without media elements.
-
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::absoluteMediaURL): Add #if ENABLE(VIDEO)
-        markers around the body of the method.
-
-2009-07-14  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Move storeLastActivePanel out of the
-        ifdef ENABLE_JAVASCRIPT_DEBUGGER section in IDL;
-        Add default panel for the first opening of the
-        WebInspector.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27263
-
-        * inspector/InspectorController.cpp:
-        (InspectorController::setWindowVisible):
-        * inspector/InspectorController.idl:
-
-2009-07-14  Darin Adler  <darin@apple.com>
-
-        Try to fix Windows build.
-
-        * bindings/scripts/CodeGeneratorCOM.pm: Add Reflect and ReflectURL support.
-
-2009-07-14  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        HTMLMediaElement::supportsFullscreen() should return false
-        https://bugs.webkit.org/show_bug.cgi?id=27284
-
-        (Reverting a part of 45875)
-
-        HTMLVideoElement::supportsFullscreen() will properly do the
-        job, and check if the backend supports fullscreen.
-
-        HTMLVideoElement is the only subclass to support fullscreen
-        (conditionnaly). HTMLAudioElement fullscreen is not supported
-        and is a different kind of fullscreen, if it comes to be wanted.
-
-        No test can be done currently given that none of the media
-        backends support fullscreen.
-
-        * html/HTMLMediaElement.cpp:
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::supportsFullscreen):
-
-2009-07-14  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dimitri Glazkov.
-
-        Next step in making DOM attribute getter/setters consistently use AtomicString
-        https://bugs.webkit.org/show_bug.cgi?id=25425
-
-        This covers eight DOM classes, and for each one of the classes:
-
-        - Changes the IDL to use the Reflect syntax for all simple cases.
-        - Removes unused functions in the classes, mainly newly unused ones that were
-          used for reflection before.
-        - Removes unneeded explicitly defined destructors.
-        - Explicitly declares destructors as virtual.
-        - Removes unneeded includes.
-        - Makes members protected or private rather than public where possible.
-        - Renames "doc" to "document".
-        - Tweaks formatting to match our latest style in a few places.
-        - Improves some FIXME comments.
-
-        Over time we'll want to do this for all HTML DOM classes.
-
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::HTMLAnchorElement):
-        * html/HTMLAnchorElement.h:
-        (WebCore::HTMLAnchorElement::endTagRequirement):
-        (WebCore::HTMLAnchorElement::tagPriority):
-        * html/HTMLAnchorElement.idl:
-        * html/HTMLAppletElement.cpp:
-        * html/HTMLAppletElement.h:
-        * html/HTMLAppletElement.idl:
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::parseMappedAttribute):
-        * html/HTMLAreaElement.h:
-        (WebCore::HTMLAreaElement::endTagRequirement):
-        (WebCore::HTMLAreaElement::tagPriority):
-        * html/HTMLAreaElement.idl:
-        * html/HTMLBRElement.cpp:
-        (WebCore::HTMLBRElement::parseMappedAttribute):
-        * html/HTMLBRElement.h:
-        * html/HTMLBRElement.idl:
-        * html/HTMLBaseElement.cpp:
-        (WebCore::HTMLBaseElement::HTMLBaseElement):
-        (WebCore::HTMLBaseElement::removedFromDocument):
-        (WebCore::HTMLBaseElement::process):
-        * html/HTMLBaseElement.h:
-        * html/HTMLBaseElement.idl:
-        * html/HTMLBaseFontElement.cpp:
-        (WebCore::HTMLBaseFontElement::HTMLBaseFontElement):
-        * html/HTMLBaseFontElement.h:
-        (WebCore::HTMLBaseFontElement::endTagRequirement):
-        (WebCore::HTMLBaseFontElement::tagPriority):
-        * html/HTMLBaseFontElement.idl:
-        * html/HTMLBlockquoteElement.cpp:
-        (WebCore::HTMLBlockquoteElement::HTMLBlockquoteElement):
-        * html/HTMLBlockquoteElement.h:
-        (WebCore::HTMLBlockquoteElement::tagPriority):
-        * html/HTMLBlockquoteElement.idl:
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::HTMLBodyElement):
-        (WebCore::HTMLBodyElement::addSubresourceAttributeURLs):
-        * html/HTMLBodyElement.h:
-        (WebCore::HTMLBodyElement::endTagRequirement):
-        (WebCore::HTMLBodyElement::tagPriority):
-        * html/HTMLBodyElement.idl:
-        Made changes as described above.
-
-        * loader/FrameLoader.cpp: Removed unneeded include of HTMLAnchorElement.h.
-
-2009-07-14  Steve Falkenburg  <sfalken@apple.com>
-
-        Reorganize JavaScriptCore headers into:
-        API: include/JavaScriptCore/
-        Private: include/private/JavaScriptCore/
-
-        Reviewed by Darin Adler.
-
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/build-generated-files.sh:
-
-2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
-
-        Reviewed by Darin Adler.
-
-        Change all Noncopyable inheriting visibility to public.
-        https://bugs.webkit.org/show_bug.cgi?id=27225
-
-        Change all Noncopyable inheriting visibility to public because
-        it is needed to the custom allocation framework (bug #20422).
-
-        * bindings/js/GCController.h:
-        * bindings/js/WorkerScriptController.h:
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::):
-        * bridge/runtime.h:
-        * css/CSSSelector.h:
-        * css/CSSSelectorList.h:
-        * css/CSSStyleSelector.h:
-        * dom/ClassNames.h:
-        * dom/MessagePortChannel.h:
-        * dom/XMLTokenizerLibxml2.cpp:
-        * dom/XMLTokenizerScope.h:
-        * editing/ReplaceSelectionCommand.cpp:
-        * editing/SelectionController.h:
-        * editing/TextIterator.cpp:
-        * history/PageCache.h:
-        * html/CanvasRenderingContext2D.h:
-        * html/HTMLParser.h:
-        * html/HTMLParserQuirks.h:
-        * html/PreloadScanner.h:
-        * loader/Cache.h:
-        * loader/CrossOriginPreflightResultCache.h:
-        * loader/FrameLoader.h:
-        * loader/ProgressTracker.h:
-        * loader/ThreadableLoader.h:
-        * loader/appcache/ApplicationCacheGroup.h:
-        * loader/archive/ArchiveResourceCollection.h:
-        * loader/icon/IconDatabase.h:
-        * loader/icon/IconLoader.h:
-        * loader/icon/PageURLRecord.h:
-        * loader/loader.h:
-        * page/ContextMenuController.h:
-        * page/EventHandler.h:
-        * page/FrameTree.h:
-        * page/Page.h:
-        * page/PageGroup.h:
-        * page/PageGroupLoadDeferrer.h:
-        * page/mac/EventHandlerMac.mm:
-        * platform/AutodrainedPool.h:
-        * platform/ContextMenu.h:
-        * platform/EventLoop.h:
-        * platform/HostWindow.h:
-        * platform/Pasteboard.h:
-        * platform/PurgeableBuffer.h:
-        * platform/RunLoopTimer.h:
-        * platform/ThreadGlobalData.h:
-        * platform/ThreadTimers.h:
-        * platform/Timer.h:
-        * platform/TreeShared.h:
-        * platform/graphics/FontData.h:
-        * platform/graphics/GlyphWidthMap.h:
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/ImageBuffer.h:
-        * platform/graphics/ImageSource.h:
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/skia/GraphicsContextPlatformPrivate.h:
-        * platform/graphics/skia/PlatformContextSkia.h:
-        * platform/graphics/win/QTMovieWin.cpp:
-        * platform/mac/LocalCurrentGraphicsContext.h:
-        * platform/network/FormDataBuilder.h:
-        * platform/network/ResourceHandleInternal.h:
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        * platform/text/StringBuffer.h:
-        * platform/text/TextCodec.h:
-        * platform/win/WindowMessageBroadcaster.h:
-        * rendering/CounterNode.h:
-        * rendering/LayoutState.h:
-        * rendering/RenderFrameSet.h:
-        * rendering/RenderView.h:
-        * rendering/TransformState.h:
-        * svg/SVGAnimatedProperty.h:
-        * svg/SynchronizableTypeWrapper.h:
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerRunLoop.cpp:
-        * xml/XPathExpressionNode.h:
-        * xml/XPathParser.h:
-        * xml/XPathPredicate.h:
-        * xml/XPathStep.h:
-
-2009-07-14  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Fails to save document state when navigating away from a page with a
-        reference fragment.
-        https://bugs.webkit.org/show_bug.cgi?id=27281
-
-        Test: fast/history/saves-state-after-fragment-nav.html
-
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::isCurrentDocument): Use equalIgnoringRef
-        to compare URLs.
-
-2009-07-14  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Sam Weinig.
-
-        Inspector: Remove Unintended Global Variables
-        https://bugs.webkit.org/show_bug.cgi?id=27203
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertyTreeElement.prototype.update):
-        * inspector/front-end/inspector.js:
-        (WebInspector.animateStyle):
-
-2009-07-14  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Adele Peterson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19562
-        Added build stuff and stub for the ValidityState class, part of HTML5
-        section Forms:
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#validitystate
-
-        Test: fast/forms/ValidityState-001.html
-
-        * DerivedSources.cpp: Inclusion of ValidityState files
-        * DerivedSources.make: ditto
-        * GNUmakefile.am: ditto
-        * WebCore.gypi: ditto
-        * WebCore.pro: ditto
-        * WebCore.vcproj/WebCore.vcproj: ditto
-        * WebCore.xcodeproj/project.pbxproj: ditto
-        * WebCoreSources.bkl: ditto
-        * html/HTMLButtonElement.idl: validity attribute
-        * html/HTMLFieldSetElement.idl: ditto
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::validity): ValidityState getter
-        * html/HTMLFormControlElement.h: ditto
-        * html/HTMLInputElement.idl: validity attribute
-        * html/HTMLSelectElement.idl: ditto
-        * html/HTMLTextAreaElement.idl: ditto
-        * html/ValidityState.cpp: Added.
-        (WebCore::ValidityState::ValidityState):
-        (WebCore::ValidityState::valid): validation flag
-        * html/ValidityState.h: Added.
-        (WebCore::ValidityState::create): validation flag
-        (WebCore::ValidityState::control): ditto
-        (WebCore::ValidityState::valueMissing): ditto
-        (WebCore::ValidityState::typeMismatch): ditto
-        (WebCore::ValidityState::patternMismatch): ditto
-        (WebCore::ValidityState::tooLong): ditto
-        (WebCore::ValidityState::rangeUnderflow): ditto
-        (WebCore::ValidityState::rangeOverflow): ditto
-        (WebCore::ValidityState::stepMismatch): ditto
-        (WebCore::ValidityState::customError): ditto
-        * html/ValidityState.idl: Added.
-
-2009-07-14  Ryosuke Niwa  <rniwa@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Outdenting a line inside a blockquote tag does nothing
-        https://bugs.webkit.org/show_bug.cgi?id=25316
-
-        The bug was caused by the code checking whether the blockquote is created by WebKit or not.
-        We simply remove this code to be consistent with Firefox and Internet Explorer.
-        Also, enclosingBlockFlow == enclosingNode in outdentParagraph isn't a sufficient condition to insert
-        the placeholder before the enclosingNode because there could be contents before the current paragraph.
-        Instead, we should split the enclosingNode (which is a blockquote) at the starting position of outdentation.
-        It turned out that this solves the bug 25315 also: https://bugs.webkit.org/show_bug.cgi?id=25315
-
-        Test: editing/execCommand/outdent-regular-blockquote.html
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::isIndentBlockquote): no longer checks whether a blockquote is created by WebKit or not.
-        (WebCore::IndentOutdentCommand::outdentParagraph): takes care of the case enclosingBlockFlow == enclosingNode
-
-2009-07-14  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Fix isolated world wrappers for Node prototypes
-        https://bugs.webkit.org/show_bug.cgi?id=27277
-
-        This change does two things:
-
-        1) We bypass the wrapper cache in the isolated world.  This is because
-           the wrapper template cache has prototypes that lead to the main
-           world.  We can add a template cache for the isolated world if
-           performance warrants.
-
-        2) We introduce a smarter way to grab the wrapper context for a frame
-           that is aware that proxy <-> context do not stand in one-to-one
-           correspondence.  This generalizes our solution for the node wrapper
-           case to prototypes.
-
-        The net result is that Node wrappers get the right prototypes.  As
-        before, tests to follow.
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::setHiddenWindowReference):
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-        (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        (WebCore::V8DOMWrapper::convertWindowToV8Object):
-        (WebCore::V8DOMWrapper::getWrapperContext):
         * bindings/v8/V8DOMWrapper.h:
-
-2009-07-14  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Fix isolated world wrappers for Nodes
-        https://bugs.webkit.org/show_bug.cgi?id=27271
-
-        Previously, we keepy a pointer to the DOMMap on V8Proxy, but this
-        caused us to miss the branch in V8DOMMap.cpp for isolated worlds.
-
-        I have tests, but I can't land them until I get this feature under
-        control.
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::V8Proxy):
-
-2009-07-14  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Fix isolated world crash on getting window.location
-        https://bugs.webkit.org/show_bug.cgi?id=27268
-
-        I have a test for this locally, but it requires a compile-time hack to
-        run.  Once I get the feature's stability under control, we can turn the
-        feature on and add the tests.
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::setHiddenWindowReference):
-        * bindings/v8/V8IsolatedWorld.h:
-        (WebCore::V8IsolatedWorld::context):
-
-2009-07-14  Brent Fulgham  <bfulgham@webkit.org>
-
-        Correct failing tests after r45875.  The original patch did not
-        test the m_player member for null, causing crashes.  This will
-        happen fairly frequently in real use.  Was this original patch
-        ever tested?
-        https://bugs.webkit.org/show_bug.cgi?id=27246
-
-        Test via existing media tests.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::supportsFullscreen): Check for null pointer.
-        (WebCore::HTMLMediaElement::supportsSave): Check for null pointer.
-
-2009-07-14  Avi Drissman  <avi@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Explicitly mark the HTML generated for the Mac as being UTF-8 encoded.
-        The Windows clipboard format is explicitly documented as being UTF-8,
-        and all Linux apps assume UTF-8. On the Mac, though, unless otherwise
-        indicated, Windows-1252 is assumed, which is wrong.
-
-        Bug: https://bugs.webkit.org/show_bug.cgi?id=27262
-
-        No new tests.
-
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::writeRange):
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writeSelection):
-
-2009-07-14  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Upstream V8NPObject.h and V8NPObject.cpp.
-        https://bugs.webkit.org/show_bug.cgi?id=27103
-
-        This just upstreams the files from the chromium code base. Only
-        minor changes to formatting and similar were done, so no testing
-        is required because nothing really changed.  Code verified to compile.
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::bindToWindowObject):
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        * bindings/v8/V8NPObject.cpp: Added.
-        (npObjectInvokeImpl):
-        (npObjectMethodHandler):
-        (npObjectInvokeDefaultHandler):
-        (weakTemplateCallback):
-        (npObjectGetProperty):
-        (npObjectNamedPropertyGetter):
-        (npObjectIndexedPropertyGetter):
-        (npObjectGetNamedProperty):
-        (npObjectGetIndexedProperty):
-        (npObjectSetProperty):
-        (npObjectNamedPropertySetter):
-        (npObjectIndexedPropertySetter):
-        (npObjectSetNamedProperty):
-        (npObjectSetIndexedProperty):
-        (weakNPObjectCallback):
-        (createV8ObjectForNPObject):
-        (forgetV8ObjectForNPObject):
-        * bindings/v8/V8NPObject.h: Added.
-        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-
-
-2009-07-14  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Add HTMLMediaElement::supportSave() and a
-        HitTestResult::absoluteMediaURL() functions
-        https://bugs.webkit.org/show_bug.cgi?id=27246
-
-        Added an implementation of supportsSave() into HTMLMediaElement
-        that delegates to MediaPlayerPrivateImpl so that the media engine
-        is able to signal whether or not a media source supports saving.
-
-        Also added a function to HitTestResult that allows for retrieval
-        of the currentSrc associated with the "hit" media element. 
-        
-        These functions are just pipeing with no visible UI change so there
-        are no related layout test changes.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::supportsFullscreen): 
-        (WebCore::HTMLMediaElement::supportsSave):
-        * html/HTMLMediaElement.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::supportsSave):
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen):
-        (WebCore::MediaPlayerPrivateInterface::supportsSave):
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::altDisplayString):
-        (WebCore::HitTestResult::absoluteMediaURL):
-        * rendering/HitTestResult.h:
-
-2009-07-14  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Implement Reflect and ReflectURL attribute support.
-        https://bugs.webkit.org/show_bug.cgi?id=27273
-
-        * bindings/scripts/CodeGeneratorV8.pm: Added support for Reflect and ReflectURL attributes.
-
-2009-07-14  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27266
-        Add hasCurrentPoint() to WebCore::Path.
-        This fixes Skia-based Chromium regression caused by the fix for
-        https://bugs.webkit.org/show_bug.cgi?id=27187.
-        For Skia, the new method always returns 'true', pending actual implementation.
-        This means Chromium still will differ from Gecko behavior, but at least its Canvas
-        will not be completely broken.
-
-        Existing Canvas Layout Tests should pass in Chromium after this change.
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::lineTo): insteand of Path::isEmpty() test for hasCurrentPoint().
-        (WebCore::CanvasRenderingContext2D::quadraticCurveTo): ditto.
-        (WebCore::CanvasRenderingContext2D::bezierCurveTo): ditto.
-
-        * platform/graphics/Path.h:
-        * platform/graphics/cairo/PathCairo.cpp:
-        (WebCore::Path::hasCurrentPoint):
-        * platform/graphics/cg/PathCG.cpp:
-        (WebCore::Path::isEmpty):
-        (WebCore::Path::hasCurrentPoint):
-        * platform/graphics/qt/PathQt.cpp:
-        (WebCore::Path::hasCurrentPoint):
-        * platform/graphics/skia/PathSkia.cpp:
-        (WebCore::Path::hasCurrentPoint):
-        * platform/graphics/wx/PathWx.cpp:
-        (WebCore::Path::hasCurrentPoint):
-        All these files add a Path::hasCurrentPoint() for various platforms.
-
-2009-07-14  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        Upstream RGBColor from src.chromium.org.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27133
-
-        * WebCore.gypi: Add RGBColor
-        * css/RGBColor.cpp: Added.
-        (WebCore::RGBColor::create):
-        (WebCore::RGBColor::red):
-        (WebCore::RGBColor::green):
-        (WebCore::RGBColor::blue):
-        * css/RGBColor.h: Added.
-        (WebCore::RGBColor::RGBColor):
-
-2009-07-10  Matt Perry  <mpcomplete@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        [V8] Rename the didCreate/DestroyScriptContext calls to make it
-        clear that that those refer to the frame's contxt.  Add another
-        similar call for when creating contexts via evaluateInNewContext.
-        https://bugs.webkit.org/show_bug.cgi?id=27104
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::disposeContextHandles):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::didCreateScriptContextForFrame):
-        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContextForFrame):
-        (WebCore::EmptyFrameLoaderClient::didCreateIsolatedScriptContext):
-        * loader/FrameLoaderClient.h:
-
-2009-07-14  Brent Fulgham  <bfulgham@webkit.org>
-
-        Revert http://trac.webkit.org/changeset/45864 after
-        breaking of Windows build.
-
-        * storage/LocalStorageTask.cpp:
-        * storage/LocalStorageTask.h:
-        * storage/Storage.cpp:
-        * storage/Storage.h:
-        * storage/StorageArea.cpp:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        * storage/StorageAreaImpl.h:
-        * storage/StorageAreaSync.cpp:
-        * storage/StorageAreaSync.h:
-        * storage/StorageEvent.cpp:
-        * storage/StorageEvent.h:
-        (WebCore::StorageEvent::create):
-        (WebCore::StorageEvent::StorageEvent):
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        * storage/StorageNamespaceImpl.h:
-        * storage/StorageSyncManager.cpp:
-        * storage/StorageSyncManager.h:
-
-2009-07-11  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Cleanup DOM Storage dependencies.
-        https://bugs.webkit.org/show_bug.cgi?id=27180
-
-        DOM Storage had several unnecessary (and probably unintended)
-        dependencies.  This patch replaces many includes of header files with
-        forward declaration of classes, making some destructors explicit, and
-        taking some factories out of the header files.
-
-        This will allow things like StorageAreaSync to take a StorageAreaImpl*
-        (as it should) rather than a StorageArea* which previously weren't
-        possible because the dependencies were such a tangled mess.
-
-        * storage/LocalStorageTask.cpp:
-        (WebCore::LocalStorageTask::~LocalStorageTask):
-        * storage/LocalStorageTask.h:
-        * storage/Storage.cpp:
-        (WebCore::Storage::~Storage):
-        * storage/Storage.h:
-        * storage/StorageArea.cpp:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        * storage/StorageAreaImpl.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::~StorageAreaSync):
-        * storage/StorageAreaSync.h:
-        * storage/StorageEvent.cpp:
-        (WebCore::StorageEvent::create):
-        (WebCore::StorageEvent::StorageEvent):
-        * storage/StorageEvent.h:
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        * storage/StorageNamespaceImpl.h:
-        * storage/StorageSyncManager.cpp:
-        (WebCore::StorageSyncManager::~StorageSyncManager):
-        * storage/StorageSyncManager.h:
-
-
-2009-07-14  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by David Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26983
-
-        Check to make sure the view is attached to a frame() in the visibleContentsResized()
-        method as it can be triggered before the view is attached by Frame::createView(...)
-        setting various values such as setScrollBarModes(...) for example.  An ASSERT is
-        triggered when a view is layout before being attached to a frame().
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::visibleContentsResized):
-        * page/FrameView.h:
-
-2009-07-14  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: show last opened panel when invoking inspector.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27263
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        (WebCore::InspectorController::setWindowVisible):
-        (WebCore::InspectorController::storeLastActivePanel):
-        (WebCore::InspectorController::specialPanelForJSName):
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::Setting::Setting):
-        * inspector/InspectorController.idl:
-        * inspector/front-end/inspector.js:
-        (WebInspector.set currentPanel):
-        (WebInspector.loaded):
-
-2009-07-14  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Speed up access to NodeList length.
-        https://bugs.webkit.org/show_bug.cgi?id=27264
-
-        That's a minimal alternation of the code.
-
-        * bindings/v8/custom/V8NodeListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER): 1) use AtomicString for comparison, 2) use
-        v8::Integer::New instead of v8::Number::New.
-
-2009-07-14  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Do not do unnecessary conversions from v8::Handle<v8::Value> to
-        v8::Handle<v8::Object> and accompanying changes.
-        https://bugs.webkit.org/show_bug.cgi?id=26953
-
-        Three things:
-
-        1) do not cast from v8::Value to v8::Object if unnecessary---casts are cheap,
-        but are not free (they check for emptiness of handle);
-        2) inline conversion from wrapper to node;
-        3) simplify case to an ASSERT.
-
-        This is just a refactoring, so no new tests are needed.
-
-        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8NodeFilterCondition.cpp:
         * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::convertToSVGPODTypeImpl):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::convertDOMWrapperToNative):
-        (WebCore::V8Proxy::convertToNativeObject):
-        (WebCore::V8Proxy::convertToNativeEvent):
+        * bindings/v8/WorkerContextExecutionProxy.h
         * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::toCanvasStyle):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomBinding.cpp:
-        (WebCore::V8Custom::GetTargetFrame):
+        * bindings/v8/custom/V8CustomPositionCallback.cpp:
+        * bindings/v8/custom/V8CustomPositionErrorCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
         * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::V8Custom::ClearTimeoutImpl):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
         * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-14  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Straight quotes should match fancy quotes in in-page search
-        https://bugs.webkit.org/show_bug.cgi?id=27217
-
-        Tests: fast/text/find-quotes.html
-
-        * editing/TextIterator.cpp:
-        (WebCore::foldQuoteMark): Added.
-        (WebCore::foldQuoteMarks): Added.
-        (WebCore::SearchBuffer::SearchBuffer): Call foldQuoteMarks on the target string.
-        (WebCore::SearchBuffer::append): Call foldQuoteMarks on characters as they are
-        added to the search buffer.
-
-        * platform/text/CharacterNames.h: Added more quotation mark character names.
-        Sorted character names with the sort tool.
-
-2009-07-13  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: handle debugger shortcuts while on source frame or on
-        script file selector.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27224
-
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._loaded):
-
-2009-07-13  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Use standard HashCountedSet instead of a hand rolled one
-        in HTMLDocument.
-
-        * html/HTMLDocument.cpp:
-        (WebCore::addItemToMap):
-        (WebCore::removeItemFromMap):
-        * html/HTMLDocument.h:
-
-2009-07-13  Erik Arvidsson  <arv@chromium.org>
-
-        Reviewed by Darin Adler and Maciej Stachowiak.
-
-        Implement HTML5 draggable
-        https://bugs.webkit.org/show_bug.cgi?id=26262
-
-        This adds support for the HTML5 draggable attribute and its DOM binding. It maps the draggable property
-        to the CSS properties -webkit-user-drag and -webkit-user-select respectively.
-
-        Spec: http://www.whatwg.org/specs/web-apps/current-work/multipage/editing.html#the-draggable-attribute
-
-        Test: fast/html/draggable.html
-
-        * css/html.css:
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::draggable):
-        * html/HTMLAnchorElement.h:
-        * html/HTMLAttributeNames.in:
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::draggable):
-        (WebCore::HTMLElement::setDraggable):
-        * html/HTMLElement.h:
-        * html/HTMLElement.idl:
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::draggable):
-        * html/HTMLImageElement.h:
-
-2009-07-13  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Image rendered as layer contents looks different from image rendered via CG.
-        <rdar://problem/7048830> 
-        
-        Fix a visible color profile difference between between images rendered via Core Graphics
-        and those rendered via a compositing layer, by assigning the GenericRGB profile to
-        untagged images (which come through as having the DeviceRGB profile) when they are set
-        as layer contents.
-
-        Test: compositing/color-matching/image-color-matching.html
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setContentsToImage):
-
-2009-07-13  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27220
-        Assertion failure in createSearcher() (usearch_open() status is U_USING_DEFAULT_WARNING)
-
-        * editing/TextIterator.cpp:
-        (WebCore::createSearcher): Add U_USING_DEFAULT_WARNING as a possible status code
-        in the assertion. Affects only the assertion.
-
-2009-07-13  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26925
-        <rdar://problem/7027850> URL Fragment Breaks Application Cache Loads
-
-        Test: http/tests/appcache/main-resource-hash.html
-
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::resourceForURL):
-        (WebCore::ApplicationCache::resourceForRequest):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::cacheForMainRequest):
-        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest):
-        (WebCore::ApplicationCacheGroup::selectCache):
-        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::didReceiveResponse):
-        (WebCore::ApplicationCacheGroup::didFail):
-        (WebCore::ApplicationCacheGroup::addEntry):
-        Remove URL fragment at appcache code borders.
-
-        * loader/appcache/ApplicationCacheResource.h:
-        (WebCore::ApplicationCacheResource::create):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::findOrCreateCacheGroup):
-        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
-        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
-        Assert that there is no URL fragment in URL at key points in appcache code.
-
-2009-07-13  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27166
-        rdar://problem/7015857
-        Find for strings composed entirely of spaces doesn't work
-
-        Test: fast/text/find-spaces.html
-
-        * editing/TextIterator.cpp:
-        (WebCore::findPlainText): Removed unneeded special case.
-        The empty string case already works correctly.
-
-2009-07-13  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Kevin Decker.
-
-        Remove NPPVpluginPrivateModeBool, it was removed from the spec.
-        
-        * bridge/npapi.h:
-
-2009-07-13  Feng Qian  <feng@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27237
-
-        Make V8DOMMap.h compiling with gcc option -Werror=non=virtual-dtor.  
-
-        * bindings/v8/V8DOMMap.h:
-        (WebCore::WeakReferenceMap::WeakReferenceMap):
-        (WebCore::WeakReferenceMap::~WeakReferenceMap):
-
-2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Remove an accidental add of bidi.(cpp|h) to WebCore.gypi.
-
-        * WebCore.gypi: Removed bidi.cpp and bidi.h
-
-2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Update WebCore.gyp in preparation to hooking it up.
-
-        * WebCore.gypi: Added files that were mid-stream while switching over.
-
-2009-07-13  Dmitry Titov  <dimich@chromium.org>
-
-        Not reviewed, another small fix for Chromium build.
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-
-2009-07-13  Dmitry Titov  <dimich@chromium.org>
-
-        Not reviewed, fix Chromium build bustage.
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::JavaScriptConsoleMessage::addToPage):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::handleConsoleMessage):
-
-2009-07-13  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27234
-        <rdar://problem/7054356>
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
 
-        Add null page check in HTMLDocument::hasFocus.
+2010-02-03  Sam Weinig  <sam@webkit.org>
 
-        Test: fast/dom/HTMLDocument/hasFocus-frameless-crash.html
+        Reviewed by Anders Carlsson.
 
-        * html/HTMLDocument.cpp:
-        (WebCore::HTMLDocument::hasFocus): Add page null check.
-        (WebCore::HTMLDocument::createTokenizer): Cleanup page null check.
+        Fix drawing buttons in viewless WebKit.
 
-2009-07-13  Dan Bernstein  <mitz@apple.com>
+        * platform/mac/ThemeMac.mm:
+        (WebCore::paintButton): If there is no view, make sure to flip the
+        context so that the button is drawn correctly.
 
-        Reviewed by Darin Adler.
+2010-02-03  Yael Aharon  <yael.aharon@nokia.com>
 
-        Disable continuous spell checking in the inspector
-        https://bugs.webkit.org/show_bug.cgi?id=27131
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * inspector/front-end/inspector.html: Added spellcheck="false" to the
-            main-panels and console-prompt containers.
+        [Qt] WebSockets : Buffer the data in WebKit instead of QtNetwork
+        https://bugs.webkit.org/show_bug.cgi?id=34425
 
-2009-07-13  Adam Langley  <agl@google.com>
+        Reverting r54279, it was a misunderstanding.
 
-        Reviewed by Eric Seidel.
+        * platform/network/qt/SocketStreamHandlePrivate.h:
+        * platform/network/qt/SocketStreamHandleQt.cpp:
+        (WebCore::SocketStreamHandlePrivate::SocketStreamHandlePrivate):
+        (WebCore::SocketStreamHandlePrivate::send):
+        (WebCore::SocketStreamHandlePrivate::close):
 
-        Chromium Linux: fix assertion when rendering google.com.kh
+2010-02-03  Drew Wilson  <atwilson@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26924
+        Reviewed by Alexey Proskuryakov.
 
-        Some shapers (i.e. Khmer) will produce cluster logs which report that
-        /no/ code points contributed to certain glyphs. Because of this, we
-        take any code point which contributed to the glyph in question, or any
-        subsequent glyph.  If we run off the end, then we take the last code
-        point.
+        SharedWorkerScriptLoader should not be an ActiveDOMObject
+        https://bugs.webkit.org/show_bug.cgi?id=34513
 
-        Added LayoutTests/fast/text/international/khmar-selection.html
+        Test: Existing tests suffice (fixes test downstream in Chrome).
 
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::Font::offsetForPositionForComplexText):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerScriptLoader::SharedWorkerScriptLoader):
+        Changed to no longer derive from ActiveDOMObject (handles its own refcounting).
+        (WebCore::SharedWorkerScriptLoader::load):
+        Now increments own refcount when a load is pending.
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        Changed to decrement refcount when load is complete.
+        * workers/WorkerScriptLoaderClient.h:
+        Documentation change about reliability of notifyFinished() when used from worker context.
 
-2009-07-13  Dan Bernstein  <mitz@apple.com>
+2010-02-03  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Timothy Hatcher.
 
-        spellcheck="false" is ignored
-        <rdar://problem/7054177>
+        Web Inspector: Inspector renders blank scripts on reloading the webpage.
 
-        * editing/Editor.cpp:
-        (WebCore::markMisspellingsOrBadGrammar): Moved code to check the
-            spellcheck attribute from here...
-        (WebCore::Editor::spellCheckingEnabledInFocusedNode): ...to here.
-        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges): Bail out
-            if spell chcking is disabled by the spellcheck attribute.
-        * editing/Editor.h:
+        https://bugs.webkit.org/show_bug.cgi?id=34537
 
-2009-07-13  Brent Fulgham  <bfulgham@webkit.org>
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
 
-        Reviewed by Adam Roben.
+2010-02-03  Yury Semikhatsky  <yurys@chromium.org>
 
-        Add new configuration flag for redistributable Windows build.
-        https://bugs.webkit.org/show_bug.cgi=27087
-        
-        * WebCore.vcproj/WebCore.vcproj: Add new WinCairo.vsprops to
-          Debug_Cairo and Release_Cairo builds.
-        * config.h: Check for presence of WIN_CAIRO and select appropriate
-          configuration.  Defaults to standard Apple build.
+        Reviewed by Pavel Feldman.
 
-2009-07-13  Peter Kasting  <pkasting@google.com>
+        Provide strongly typed C++ interface for inspector's injected script.
 
-        https://bugs.webkit.org/show_bug.cgi?id=19562
-        Back out previous patch for this bug (too many problems).
+        https://bugs.webkit.org/show_bug.cgi?id=33616
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLButtonElement.idl:
-        * html/HTMLFieldSetElement.idl:
-        * html/HTMLFormControlElement.cpp:
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::form):
-        * html/HTMLInputElement.idl:
-        * html/HTMLSelectElement.idl:
-        * html/HTMLTextAreaElement.idl:
-        * html/ValidityState.cpp: Removed.
-        * html/ValidityState.h: Removed.
-        * html/ValidityState.idl: Removed.
-
-2009-07-13  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Add HTMLAllCollection to WebCore.gypi.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27223
-
-        * WebCore.gypi: Add HTMLAllCollection.
-
-2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        [V8] Add a missing check for constructor call in WebKitCSSMatrixConstructor.
-        https://bugs.webkit.org/show_bug.cgi?id=27218
-
-        Test: fast/css/matrix-as-function-crash.html
-
-        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Added a check for constructor call.
-
-2009-07-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Unreviewed make dist build fix.
-
-        * GNUmakefile.am:
-
-2009-07-13  Cédric Luthi  <cedric.luthi@gmail.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix NPWindow clip rect in PluginViewMac
-
-        The rect should be in window-coordinates. This bug can be observed
-        with Flash 10 here: http://www.permadi.com/tutorial/cursorTracker/
-
-        * plugins/mac/PluginViewMac.cpp:
-
-2009-07-13  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Ariya Hidayat.
-
-        Fix Qt implementation of WebCore::directoryName to return the absolute
-        directory name instead of the base file name.
-
-        * platform/qt/FileSystemQt.cpp:
-        (WebCore::directoryName):
-
-2009-07-13  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Ariya Hidayat.
-
-        Fix WebCore::Path::isEmpty() for the Qt port to return true
-        if there is no element in the path.
-
-        QPainterPath::isEmpty() returns also true if there is one single
-        MoveTo element inside, which makes sense but doesn't patch Webcore's
-        is-empty definition.
-
-        * platform/graphics/qt/PathQt.cpp:
-        (WebCore::Path::isEmpty): Use elementCount() == 0.
-
-2009-07-13  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Upstream fixes to NPV8Object.cpp that make ~30 layout tests pass.
-        https://bugs.webkit.org/show_bug.cgi?id=27127
-
-        There were a number of bugs introduced during the last upstreaming
-        effort that broke around 30 layout tests.  This fixes those bugs.
-        It also has compile fixes to match the recent cutting apart of
-        V8Proxy.
-
-        * bindings/v8/NPV8Object.cpp:
-        (freeV8NPObject):
-        (npCreateV8ScriptObject):
-        (NPN_Invoke):
-        (NPN_InvokeDefault):
-        (NPN_EvaluateHelper):
-        (NPN_SetException):
-        (NPN_Construct):
-
-2009-07-13  Mads Ager  <ager@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Fix memory leak in the V8 binding layer. 
-        https://bugs.webkit.org/show_bug.cgi?id=27163
-
-        Reinitializing the context is not necessary when clearing the proxy for navigation
-        and it will lead us to hold on to an empty context for each frame.
-
-        Test for empty context instead of empty global object handle when
-        updating the document for a context.
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::clearForNavigation):
-        (WebCore::V8Proxy::updateDocument):
-
-2009-07-13  John Gregg  <johnnyg@google.com>
-
-        Reviewed by David Levin.
-
-        Correct the logic to determine if a V8 callback returns a value.
-        https://bugs.webkit.org/show_bug.cgi?id=27155
-
-        * bindings/v8/custom/V8CustomVoidCallback.cpp:
-        (WebCore::invokeCallback):
-        - Don't crash if result.IsEmpty().
-
-2009-07-13  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Add ENABLE(SHARED_WORKERS) flag and define SharedWorker APIs
-        https://bugs.webkit.org/show_bug.cgi?id=26932
-
-        Initial IDL definition and bindings for SharedWorkers.
-
-        * Configurations/FeatureDefines.xcconfig:
-        Added new files for SharedWorker support.
-        * DerivedSources.make:
-        Added new files for SharedWorker support.
-        * GNUmakefile.am:
-        Added new files for SharedWorker support.
-        * WebCore.gypi:
-        Added new files for SharedWorker support.
-        * WebCore.pro:
-        Added new files for SharedWorker support.
-        * WebCore.xcodeproj/project.pbxproj:
-        Added new files for SharedWorker support.
-        * bindings/js/JSAbstractWorkerCustom.cpp: Added.
-        (WebCore::JSAbstractWorker::mark):
-        Custom mark handler that marks the event listeners.
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        (WebCore::JSAbstractWorker::toJS):
-        Custom toJS handler which differentiates between various subclasses.
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::sharedWorker):
-        SharedWorker constructor (only enabled when SHARED_WORKERS is
-        enabled).
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        Added support for converting to/from SharedWorkers.
-        * bindings/js/JSSharedWorkerConstructor.cpp: Added.
-        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
-        (WebCore::constructSharedWorker):
-        (WebCore::JSSharedWorkerConstructor::getConstructData):
-        * bindings/js/JSSharedWorkerConstructor.h: Added.
-        (WebCore::JSSharedWorkerConstructor::classInfo):
-        * bindings/js/JSSharedWorkerCustom.cpp: Added.
-        (WebCore::JSSharedWorker::mark):
-        Custom mark function that marks the internal MessagePort.
-        * bindings/v8/DOMObjectsInclude.h:
-        Updated to include new header files.
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp: Added.
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        V8 handlers for add/removeEventListener().
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8SharedWorkerCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        Custom constructor for SharedWorker.
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toSharedWorker):
-        * dom/EventTarget.h:
-        * page/DOMWindow.idl:
-        * workers/AbstractWorker.cpp: Added.
-        (WebCore::AbstractWorker::AbstractWorker):
-        Common base class for SharedWorker and (soon) Worker. The functions below were copied from Worker.cpp.
-        This is the first step in refactoring Worker to derive from AbstractWorker to enable code sharing.
-        (WebCore::AbstractWorker::~AbstractWorker):
-        (WebCore::AbstractWorker::addEventListener):
-        (WebCore::AbstractWorker::removeEventListener):
-        (WebCore::AbstractWorker::dispatchEvent):
-        (WebCore::AbstractWorker::dispatchLoadErrorEvent):
-        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
-        * workers/AbstractWorker.h: Added.
-        Definitions of functionality shared by Worker.h and SharedWorker.h. In a future patch, Worker will derive from AbstractWorker.
-        (WebCore::AbstractWorker::scriptExecutionContext):
-        (WebCore::AbstractWorker::setOnerror):
-        (WebCore::AbstractWorker::onerror):
-        (WebCore::AbstractWorker::eventListeners):
-        (WebCore::AbstractWorker::refEventTarget):
-        (WebCore::AbstractWorker::derefEventTarget):
-        * workers/AbstractWorker.idl: Added.
-        * workers/SharedWorker.cpp: Added.
-        (WebCore::SharedWorker::SharedWorker):
-        (WebCore::SharedWorker::~SharedWorker):
-        * workers/SharedWorker.h: Added.
-        (WebCore::SharedWorker::create):
-        (WebCore::SharedWorker::port):
-        (WebCore::SharedWorker::toSharedWorker):
-        * workers/SharedWorker.idl: Added.
-
-2009-07-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Cleanup - Remove prf install target
-        https://bugs.webkit.org/show_bug.cgi?id=27191
-
-        qtwebkit.prf has been removed; this cleans up the related
-        install target as well.
-
-        * WebCore.pro: Remove prf install target
-
-2009-07-12  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Facebook Chat is broken due to XSS auditor
-        https://bugs.webkit.org/show_bug.cgi?id=27179
-
-        Instead of just using the script's URL as to detect an XSS attack, we
-        now use a bit of context before the URL.  In particular, we use the
-        bytes from the beginning of the attribute name to the end of the
-        attribute value.  In virtually all injection attacks, the attacker
-        would need to supply the attribute name as well as the attribute value.
-        However, in the Facebook false positive, the attribute name is not
-        present in the URL.
-
-        Tests: http/tests/security/xssAuditor/script-tag-src-redirect-safe.html
-               http/tests/security/xssAuditor/script-tag-with-source-double-quote.html
-               http/tests/security/xssAuditor/script-tag-with-source-no-quote.html
-
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::parseTag):
-        * html/HTMLTokenizer.h:
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        * page/XSSAuditor.h:
-
-2009-07-12  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Refactor ConsoleMessage to add MessageType attribute.
-        https://bugs.webkit.org/show_bug.cgi?id=20625
-
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::printErrorMessage):
-        * dom/Document.cpp:
-        (WebCore::Document::reportException):
-        (WebCore::Document::addMessage):
-        * dom/Document.h:
-        * dom/ScriptExecutionContext.h:
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::reportErrorToConsole):
-        * inspector/ConsoleMessage.cpp:
-        (WebCore::ConsoleMessage::ConsoleMessage):
-        (WebCore::ConsoleMessage::addToConsole):
-        (WebCore::ConsoleMessage::isEqual):
-        * inspector/ConsoleMessage.h:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * inspector/InjectedScript.cpp: Added.
+        (WebCore::InjectedScript::InjectedScript):
+        (WebCore::InjectedScript::dispatch):
+        (WebCore::InjectedScript::callFrames):
+        (WebCore::InjectedScript::wrapAndStringify):
+        (WebCore::InjectedScript::releaseWrapperObjectGroup):
+        * inspector/InjectedScript.h: Added.
+        (WebCore::InjectedScript::InjectedScript):
+        (WebCore::InjectedScript::~InjectedScript):
+        (WebCore::InjectedScript::hasNoValue):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptForId):
+        (WebCore::InjectedScriptHost::releaseWrapperObjectGroup):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addMessageToConsole):
-        (WebCore::InspectorController::startGroup):
-        (WebCore::InspectorController::endGroup):
-        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
-        (WebCore::InspectorController::addStartProfilingMessageToConsole):
-        (WebCore::InspectorController::count):
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::injectedScriptForNodeId):
         * inspector/InspectorController.h:
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype.addMessage):
-        (WebInspector.ConsoleMessage): Added type property.
-        (WebInspector.ConsoleMessage.prototype.toMessageElement):
-        (WebInspector.ConsoleMessage.prototype.toString):
-        (WebInspector.ConsoleMessage.prototype.isEqual):
-        (WebInspector.ConsoleCommandResult):
-        (WebInspector.ConsoleGroup.prototype.addMessage):
-        (WebInspector.ConsoleGroup.prototype._titleClicked):
-        * inspector/front-end/Resource.js:
-        (WebInspector.Resource.prototype._addTip):
-        (WebInspector.Resource.prototype._checkWarning):
-        * inspector/front-end/inspector.css: Changed ".console-group-title-level" to ".console-group-title"
-        * inspector/front-end/inspector.js:
-        (WebInspector.addMessageToConsole):
-        * loader/DocLoader.cpp:
-        (WebCore::DocLoader::printAccessDeniedMessage):
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::addMessageToConsole):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::reportLocalLoadFailed):
-        (WebCore::FrameLoader::shouldAllowNavigation):
-        * page/ChromeClient.h:
-        * page/Console.cpp:
-        (WebCore::printMessageSourceAndLevelPrefix):
-        (WebCore::Console::addMessage):
-        (WebCore::Console::error):
-        (WebCore::Console::log):
-        (WebCore::Console::dir):
-        (WebCore::Console::trace):
-        (WebCore::Console::assertCondition):
-        (WebCore::Console::timeEnd):
-        (WebCore::Console::warn):
-        * page/Console.h: Added MessageType enum.
-        (WebCore::):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::postMessageTimerFired):
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        * svg/SVGDocumentExtensions.cpp:
-        (WebCore::SVGDocumentExtensions::reportWarning):
-        (WebCore::SVGDocumentExtensions::reportError):
-        * wml/WMLErrorHandling.cpp:
-        (WebCore::reportWMLError):
-        * workers/GenericWorkerTask.h: Added GenericWorkerTask8 for the extra argument.
-        (WebCore::GenericWorkerTask8::create):
-        (WebCore::GenericWorkerTask8::GenericWorkerTask8):
-        (WebCore::GenericWorkerTask8::performTask):
-        (WebCore::createCallbackTask):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::addMessage):
-        (WebCore::WorkerContext::importScripts):
-        * workers/WorkerContext.h:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::postConsoleMessageTask):
-        (WebCore::WorkerMessagingProxy::postConsoleMessageToWorkerObject):
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerObjectProxy.h:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::reportUnsafeUsage):
-        (WebCore::XMLHttpRequest::didFinishLoading):
-        * xml/XSLTProcessor.cpp:
-        (WebCore::XSLTProcessor::parseErrorFunc):
-
-2009-07-12  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Upstream UndetectableHTMLCollection.idl as HTMLAllCollection.idl.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27132
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * dom/HTMLAllCollection.idl: Added.
-
-2009-07-12  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Inspector: Duplicate Computation in Autocompletion
-        https://bugs.webkit.org/show_bug.cgi?id=26778
-
-        * inspector/front-end/TextPrompt.js:
-        (WebInspector.TextPrompt.prototype._completionsReady):
-
-2009-07-12  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27196
-        Rename bidi.cpp to RenderBlockLineLayout.cpp and remove bidi.h
-
-        * GNUmakefile.am: Updated.
-        * WebCore.gypi: Updated.
-        * WebCore.pro: Updated.
-        * WebCore.vcproj/WebCore.vcproj: Updated.
-        * WebCore.xcodeproj/project.pbxproj: Updated.
-        * WebCoreSources.bkl: Updated.
-        * rendering/RenderBlock.h: Removed unnecessary forward declaration and
-            updated comments.
-        * rendering/RenderBlockLineLayout.cpp: Copied from WebCore/rendering/bidi.cpp.
-            Removed unnecessary #include statements.
-        (WebCore::BidiRun::BidiRun): Moved here from bidi.h.
-        (WebCore::RenderBlock::layoutInlineChildren): Removed outdated comment.
-        * rendering/bidi.cpp: Removed.
-        * rendering/bidi.h: Removed.
-
-2009-07-12  Dan Bernstein  <mitz@apple.com>
-
-        - Windows build fix
-
-        * platform/graphics/cg/PDFDocumentImage.cpp:
-        (WebCore::PDFDocumentImage::dataChanged):
-
-2009-07-12  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - Image cleanup
-
-        * platform/graphics/BitmapImage.cpp:
-        (WebCore::BitmapImage::destroyDecodedData): Use the data() accessor
-        instead of the m_data member.
-        (WebCore::BitmapImage::dataChanged): Ditto.
-        * platform/graphics/Image.h: Re-ordered #includes and class
-        declarations. Removed the drawPatternCallback() declaration. Made member
-        variables private.
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::drawPatternCallback): Changed this from a member function to a
-        static function.
-        * platform/graphics/cg/PDFDocumentImage.cpp:
-        (WebCore::PDFDocumentImage::dataChanged): Use the data() accessor
-        instead of the m_data member.
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::dataChanged): Ditto.
-
-2009-07-12  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27189
-        
-        Fixes insufficient check in XSSAuditor::canSetBaseElementURL that caused 
-        XSSAuditor to incorrectly block HTML Base elements whose base path coincided 
-        with the URL of the page.
-
-        Test: http/tests/security/xssAuditor/base-href-safe3.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canSetBaseElementURL): Changed conditional to only call 
-        XSSAuditor::findInRequest() if the host in the page URL disagrees with the host 
-        in the base element URL.
-
-2009-07-12  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Text searching with ICU should take the user's default locale into account
-        https://bugs.webkit.org/show_bug.cgi?id=27184
-        rdar://problem/6812121
-
-        No simple way to test this since it's dependent on user locale.
-        After this, the user's default locale is used only on Mac.
-
-        * editing/TextIterator.cpp:
-        (WebCore::createSearcher): Pass result of the currentSearchLocaleID
-        function as the locale.
-
-        * platform/text/TextBreakIteratorInternalICU.h: Added declaration of
-        currentSearchLocaleID function.
-
-        * platform/text/android/TextBreakIteratorInternalICU.cpp:
-        (WebCore::currentSearchLocaleID): Added. Returns the empty string.
-        * platform/text/chromium/TextBreakIteratorInternalICUChromium.cpp:
-        (WebCore::currentSearchLocaleID): Ditto.
-        * platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp:
-        (WebCore::currentSearchLocaleID): Ditto.
-
-        * platform/text/mac/TextBreakIteratorInternalICUMac.mm:
-        (WebCore::textBreakLocalePreference): Added. Returns the value of
-        the AppleTextBreakLocale preference.
-        (WebCore::topLanguagePreference): Added. Returns the value of the
-        first item in the AppleLanguages preference.
-        (WebCore::canonicalLanguageIdentifier): Added. Cover for the
-        CFLocaleCreateCanonicalLanguageIdentifierFromString function.
-        (WebCore::getLocale): Added. Transfers the locale from a CFStringRef
-        into a buffer.
-        (WebCore::getSearchLocale): Added. Calls topLanguagePreference,
-        canonicalLanguageIdentifier, and getLocale.
-        (WebCore::currentSearchLocaleID): Added. Calls getSearchLocale once.
-        (WebCore::getTextBreakLocale): Changed to call
-        textBreakLocalePreference, topLanguagePreference,
-        canonicalLanguageIdentifier, and getLocale.
-
-        * platform/text/win/TextBreakIteratorInternalICUWin.cpp:
-        (WebCore::currentSearchLocaleID): Added. Returns the empty string.
-        * platform/wx/TemporaryLinkStubs.cpp:
-        (WebCore::currentSearchLocaleID): Ditto.
-
-2009-07-12  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25415
-        [GTK][ATK] Please implement support for get_text_at_offset
-
-        Create a PangoLayout that properly represents the visual
-        appearance of the text in the web page so that the line boundary
-        modes of getText{At,Before,After}Offset work correctly.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (UTF16ToUTF8):
-        (g_substr):
-        (convertUniCharToUTF8):
-        (getPangoLayoutForAtk):
-
-2009-07-11  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Bug 27187 - Match Gecko behaviour for canvas path mutation APIs on an empty path
-        <https://bugs.webkit.org/show_bug.cgi?id=27187>
-
-        Simple API change, check for the empty path and add appropriate point if necessary.
-
-        Test: fast/canvas/canvas-modify-emptyPath.html
-
-        * Info.plist:
-        * WebCore.xcodeproj/project.pbxproj:
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::lineTo):
-        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
-        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
-
-2009-07-11  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Antti Koivisto.
-
-        HTMLMediaElement.canPlayType "maybe" and "probably" reversed
-        https://bugs.webkit.org/show_bug.cgi?id=27186
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::supportsType):
-            Return "probably" if type has codecs parameter.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::supportsType):
-            Ditto.
-
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::supportsType):
-            Ditto.
-
-2009-07-11  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        A worker-thread inspired follow-up for:
-        https://bugs.webkit.org/show_bug.cgi?id=26496 and <rdar://problem/7046520>
-        REGRESSION: XHR stream connection blocks iFrame loading and resource downloading
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Don't perform the XHR compensation when the XHR
-          is running on a worker thread. Accessing the global Cache data structures from a non-main thread is
-          not currently supported.
-
-2009-07-11  Simon Fraser  <simon.fraser@apple.com>
-
-        Enable support for accelerated compositing and 3d transforms on Leopard.
-        <https://bugs.webkit.org/show_bug.cgi?id=20166>
-        <rdar://problem/6120614>
-
-        Reviewed by Oliver Hunt.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2009-07-11  Simon Hausmann  <hausmann@webkit.org>
-
-        Fix the Qt build after r45724.
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtRuntimeObjectImp::QtRuntimeObjectImp):
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtRuntimeMethod::QtRuntimeMethod):
-
-2009-07-10  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26921
-
-        Implements support for HTML entities, so XSSAuditor can protect against attacks
-        encoded with HTML entities.
-
-        Tests: http/tests/security/xssAuditor/inline-event-HTML-entities.html
-               http/tests/security/xssAuditor/javascript-link-HTML-entities-control-char.html
-               http/tests/security/xssAuditor/javascript-link-HTML-entities-named.html
-               http/tests/security/xssAuditor/javascript-link-HTML-entities-null-char.html
-               http/tests/security/xssAuditor/javascript-link-HTML-entities.html
-               http/tests/security/xssAuditor/link-onclick-entities.html
-               http/tests/security/xssAuditor/script-tag-entities.html
-               http/tests/security/xssAuditor/script-tag-with-source-entities.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::decodeURL): Modified to call WebCore::XSSAuditor::decodeHTMLEntities
-        to decode HTML entities.
-        (WebCore::XSSAuditor::decodeHTMLEntities): Added method to decode HTML entities.
-        (WebCore::XSSAuditor::findInRequest):
-        * page/XSSAuditor.h:
-
-2009-07-10  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 27007: Build fixes when ICONDATABASE is disabled
-
-        <https://bugs.webkit.org/show_bug.cgi?id=27007>
-
-        Reviewed by Sam Weinig.
-
-        * WebCore.xcodeproj/project.pbxproj: Added IconDatabaseNone.cpp
-        to the project.
-        * loader/icon/IconDatabase.cpp: Added
-        #if ENABLE(ICONDATABASE)/#endif macro guard.
-        * loader/icon/IconDatabase.h: Removed three public methods from
-        #if ENABLE(ICONDATABASE)/#endif macro so that they may be
-        stubbed out in IconDatabaseNone.cpp.
-        * loader/icon/IconDatabaseNone.cpp: Added
-        #if !ENABLE(ICONDATABASE)/#endif macro guard.
-        (WebCore::IconDatabase::importIconURLForPageURL): Added.
-        (WebCore::IconDatabase::importIconDataForIconURL): Added.
-        (WebCore::IconDatabase::shouldStopThreadActivity): Added.
-
-2009-07-10  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27151
-
-        Fixes issue where JavaScript URLs that contain null- and non-null control characters can
-        bypass XSSAuditor.
-
-        Tests: http/tests/security/xssAuditor/javascript-link-control-char.html
-               http/tests/security/xssAuditor/javascript-link-null-char.html
-               http/tests/security/xssAuditor/javascript-link.html
-
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): Separated out logic for JavaScript URLs from 
-        inline scripts. For JavaScript URLs, calls XSSAuditor::canEvaluateJavaScriptURL.
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): Made similar changes to evaluate() as in
-        bindings/js/ScriptController.cpp.
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL): Separated out logic for JavaScript URLs
-        into its own method.
-        * page/XSSAuditor.h:
-
-2009-07-10  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by David Kilzer.
-
-        WebKit needs a style linting tool
-        https://bugs.webkit.org/show_bug.cgi?id=25884
-
-        Fix bunch of style issues by autofix of cpplint.
-        This patch is created to demonstrate the autofix of cpplint.py.
-
-        No new testcases because it's a style fix
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseMediaQuery):
-        (WebCore::CSSParser::validUnit):
-        (WebCore::CSSParser::parseValue):
-        (WebCore::skipCommaInDashboardRegion):
-        (WebCore::CSSParser::parseDashboardRegions):
-        (WebCore::ShadowParseContext::commitValue):
-        (WebCore::ShadowParseContext::commitLength):
-        (WebCore::ShadowParseContext::commitColor):
-        (WebCore::BorderImageParseContext::commitNumber):
-        (WebCore::BorderImageParseContext::commitWidth):
-        (WebCore::BorderImageParseContext::commitRule):
-        (WebCore::BorderImageParseContext::commitBorderImage):
-        (WebCore::CSSParser::lex):
-        (WebCore::CSSParser::text):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * css/MediaList.cpp:
-        (WebCore::MediaList::deleteMedium):
-        * css/MediaQuery.h:
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::parseAspectRatio):
-        * css/MediaQueryEvaluator.h:
-        * css/MediaQueryExp.h:
-        (WebCore::MediaQueryExp::operator==):
-        * css/WebKitCSSMatrix.h:
-        * dom/Comment.h:
-        * dom/Document.cpp:
-        (WebCore::Document::setFocusedNode):
-        * dom/Document.h:
-        (WebCore::Document::setHasDashboardRegions):
-        * dom/DocumentFragment.cpp:
-        (WebCore::DocumentFragment::nodeName):
-        * dom/DocumentFragment.h:
-        * dom/DynamicNodeList.h:
-        * dom/EditingText.h:
-        * dom/Element.cpp:
-        (WebCore::Element::dispatchAttrAdditionEvent):
-        * dom/NamedAttrMap.cpp:
-        (WebCore::NamedNodeMap::item):
-        * dom/Node.cpp:
-        (WebCore::Node::nodeValue):
-        (WebCore::Node::nodeIndex):
-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::create):
-        * dom/Notation.h:
-        * dom/ProcessingInstruction.h:
-        * dom/Range.cpp:
-        (WebCore::Range::processContents):
-        * dom/StyledElement.cpp:
-        (WebCore::toHex):
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::PendingCallbacks::PendingStartElementNSCallback::~PendingStartElementNSCallback):
-        (WebCore::PendingCallbacks::PendingStartElementNSCallback::call):
-        (WebCore::PendingCallbacks::):
-        (WebCore::OffsetBuffer::readOutBytes):
-        (WebCore::handleElementNamespaces):
-        (WebCore::handleElementAttributes):
-        (WebCore::attributesStartElementNsHandler):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::attributesStartElementNsHandler):
-        (WebCore::XMLTokenizer::parseStartElement):
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::ApplyStyleCommand::applyInlineStyle):
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::DeleteSelectionCommand::removeNode):
-        * editing/Editor.cpp:
-        (WebCore::Editor::pasteAsPlainText):
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::directionOfEnclosingBlock):
-        * editing/SmartReplaceICU.cpp:
-        (WebCore::addAllCodePoints):
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::icon):
-        (WebCore::HistoryItem::adoptVisitCounts):
-        * html/CanvasStyle.cpp:
-        (WebCore::CanvasStyle::applyFillColor):
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::setActive):
-        (WebCore::HTMLAnchorElement::isLiveLink):
-        * html/HTMLAppletElement.h:
-        * html/HTMLAudioElement.h:
-        * html/HTMLBRElement.h:
-        * html/HTMLBaseElement.h:
-        * html/HTMLBaseFontElement.h:
-        * html/HTMLDListElement.h:
-        * html/HTMLDirectoryElement.h:
-        * html/HTMLFieldSetElement.cpp:
-        (WebCore::HTMLFieldSetElement::HTMLFieldSetElement):
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::reset):
-        * html/HTMLHRElement.cpp:
-        (WebCore::HTMLHRElement::parseMappedAttribute):
-        * html/HTMLHeadElement.h:
-        * html/HTMLHtmlElement.h:
-        * html/HTMLImageElement.h:
-        (WebCore::HTMLImageElement::setLoadManually):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::selection):
-        * html/HTMLIsIndexElement.h:
-        * html/HTMLMarqueeElement.cpp:
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::):
-        * html/HTMLMenuElement.h:
-        * html/HTMLMetaElement.h:
-        * html/HTMLModElement.h:
-        * html/HTMLOListElement.h:
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::childrenChanged):
-        * html/HTMLParamElement.h:
-        * html/HTMLQuoteElement.h:
-        * html/HTMLStyleElement.h:
-        * html/HTMLTableCaptionElement.h:
-        * html/HTMLTableCellElement.h:
-        * html/HTMLTableColElement.h:
-        * html/HTMLTableSectionElement.cpp:
-        (WebCore::HTMLTableSectionElement::deleteRow):
-        * html/HTMLTitleElement.h:
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::parseNonHTMLText):
-        (WebCore::HTMLTokenizer::parseEntity):
-        (WebCore::HTMLTokenizer::parseTag):
-        (WebCore::HTMLTokenizer::write):
-        * html/HTMLUListElement.h:
-        * html/HTMLVideoElement.h:
-        * html/TimeRanges.h:
-        (WebCore::TimeRanges::Range::Range):
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::enableResourceTracking):
-        (WebCore::InspectorController::disableResourceTracking):
+        (WebCore::InspectorController::frontendScriptState):
         * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::newInspectorJSONObject):
-        * page/Console.cpp:
-        (WebCore::Console::addMessage):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::selectCursor):
-        (WebCore::EventHandler::defaultKeyboardEventHandler):
-        * page/Frame.cpp:
-        (WebCore::Frame::jsDefaultStatusBarText):
-        * page/android/DragControllerAndroid.cpp:
-        (WebCore::DragController::dragOperation):
-        * page/android/EventHandlerAndroid.cpp:
-        (WebCore::EventHandler::tabsToAllControls):
-        (WebCore::EventHandler::eventActivatedView):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        * page/gtk/DragControllerGtk.cpp:
-        (WebCore::DragController::dragOperation):
-        * page/qt/DragControllerQt.cpp:
-        * page/win/DragControllerWin.cpp:
-        (WebCore::DragController::isCopyKeyDown):
-        * page/win/FrameWin.h:
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::mouseEventOffsetToThumb):
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::setVerticalAlignLength):
-        (WebCore::InheritedFlags::setUnicodeBidi):
-        (WebCore::InheritedFlags::setCursor):
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-        * rendering/style/SVGRenderStyleDefs.h:
-        * rendering/style/StyleInheritedData.h:
-        (WebCore::StyleInheritedData::operator!=):
-        * storage/DatabaseTask.h:
-        * svg/GradientAttributes.h:
-        * svg/LinearGradientAttributes.h:
-        * svg/PatternAttributes.h:
-        * svg/RadialGradientAttributes.h:
-        * svg/SVGAnimatedPathData.h:
-        * svg/SVGAnimatedPoints.h:
-        * svg/SVGAnimationElement.h:
-        * svg/SVGClipPathElement.h:
-        * svg/SVGElementInstance.h:
-        * svg/SVGFEBlendElement.cpp:
-        (WebCore::SVGFEBlendElement::build):
-        * svg/SVGFEBlendElement.h:
-        * svg/SVGFEColorMatrixElement.cpp:
-        (WebCore::SVGFEColorMatrixElement::build):
-        * svg/SVGFEComponentTransferElement.cpp:
-        (WebCore::SVGFEComponentTransferElement::build):
-        * svg/SVGFECompositeElement.cpp:
-        (WebCore::SVGFECompositeElement::build):
-        * svg/SVGFEDiffuseLightingElement.cpp:
-        (WebCore::SVGFEDiffuseLightingElement::build):
-        * svg/SVGFEDisplacementMapElement.cpp:
-        (WebCore::SVGFEDisplacementMapElement::build):
-        * svg/SVGFEDistantLightElement.h:
-        * svg/SVGFEFloodElement.cpp:
-        (WebCore::SVGFEFloodElement::build):
-        * svg/SVGFEFloodElement.h:
-        * svg/SVGFEFuncAElement.h:
-        * svg/SVGFEFuncBElement.h:
-        * svg/SVGFEFuncGElement.h:
-        * svg/SVGFEFuncRElement.h:
-        * svg/SVGFEGaussianBlurElement.cpp:
-        (WebCore::SVGFEGaussianBlurElement::build):
-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::build):
-        * svg/SVGFEMergeElement.cpp:
-        (WebCore::SVGFEMergeElement::build):
-        * svg/SVGFEOffsetElement.cpp:
-        (WebCore::SVGFEOffsetElement::build):
-        * svg/SVGFEPointLightElement.h:
-        * svg/SVGFESpecularLightingElement.cpp:
-        (WebCore::SVGFESpecularLightingElement::build):
-        * svg/SVGFESpotLightElement.h:
-        * svg/SVGFETileElement.cpp:
-        (WebCore::SVGFETileElement::build):
-        * svg/SVGLineElement.cpp:
-        (WebCore::SVGLineElement::parseMappedAttribute):
-        * svg/SVGList.h:
-        * svg/SVGListTraits.h:
-        (WebCore::):
-        * svg/SVGMPathElement.h:
-        * svg/SVGMetadataElement.h:
-        * svg/SVGParserUtilities.cpp:
-        (WebCore::SVGPathParser::parseSVG):
-        (WebCore::SVGPathParser::calculateArc):
-        * svg/SVGPathElement.h:
-        * svg/SVGPathSegClosePath.h:
-        * svg/SVGSVGElement.h:
-        * svg/SVGSetElement.h:
-        * svg/SVGSwitchElement.h:
-        * svg/SVGTextPathElement.cpp:
-        (WebCore::SVGTextPathElement::parseMappedAttribute):
-        * svg/SVGTextPathElement.h:
-        * svg/SVGTitleElement.h:
-        * svg/SVGTransformable.cpp:
-        (WebCore::):
-        * svg/SVGViewSpec.cpp:
-        (WebCore::):
-        * svg/animation/SMILTime.cpp:
-        (WebCore::operator+):
-        (WebCore::operator-):
-        (WebCore::operator*):
-        * svg/animation/SVGSMILElement.h:
-        * svg/graphics/SVGResource.cpp:
-        (WebCore::clientMap):
-        * wml/WMLPostfieldElement.cpp:
-        (WebCore::WMLPostfieldElement::value):
-        * wml/WMLSetvarElement.cpp:
-        (WebCore::WMLSetvarElement::value):
-        * workers/WorkerRunLoop.cpp:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::dropProtection):
-        * xml/XPathPath.h:
-
-2009-07-10  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7049066>.
-        Update SnowLeopard media controller layout.
-
-        * css/mediaControlsQT.css:
-            Update for new layout.
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::movieLoadType):
-            Added to replace isStreaming.
-        * html/HTMLMediaElement.h:
-            Declare movieLoadType, remove isStreaming.
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlStatusDisplayElement::update):
-            Use movieLoadType instead of isStreaming.
-        (WebCore::MediaControlTimelineContainerElement::rendererIsNeeded):
-            MediaControlElement is the base class, not HTMLInputElement.
-        (WebCore::MediaControlStatusDisplayElement::rendererIsNeeded):
-            Ditto.
-        (WebCore::MediaControlRewindButtonElement::rendererIsNeeded):
-            Don't display rewind button for live streams.
-        (WebCore::MediaControlReturnToRealtimeButtonElement::rendererIsNeeded):
-            MediaControlInputElement is the base class, not HTMLInputElement.
-        * rendering/MediaControlElements.h:
-
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::getMediaUIPartStateFlags):
-            New, return wkDrawMediaUIPart flags.
-        (WebCore::RenderThemeMac::paintMediaFullscreenButton):
-        (WebCore::RenderThemeMac::paintMediaMuteButton):
-        (WebCore::RenderThemeMac::paintMediaPlayButton):
-        (WebCore::RenderThemeMac::paintMediaSeekBackButton):
-        (WebCore::RenderThemeMac::paintMediaSeekForwardButton):
-        (WebCore::RenderThemeMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeMac::paintMediaSliderThumb):
-        (WebCore::RenderThemeMac::paintMediaRewindButton):
-        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton):
-        (WebCore::RenderThemeMac::paintMediaControlsBackground):
-        (WebCore::RenderThemeMac::paintMediaCurrentTime):
-        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
-            Use getMediaUIPartStateFlags.
-
-2009-07-10  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Adele Peterson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19562
-        Added build stuff and stub for the ValidityState class, part of HTML5
-        section Forms:
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#validitystate
-
-        Test: fast/forms/ValidityState-001.html
-
-        * DerivedSources.cpp: Fix aimed to include ValidityState files
-        * DerivedSources.make: ditto
-        * GNUmakefile.am: ditto
-        * WebCore.gypi: ditto
-        * WebCore.pro: ditto
-        * WebCore.vcproj/WebCore.vcproj: ditto
-        * WebCore.xcodeproj/project.pbxproj: ditto
-        * WebCoreSources.bkl: ditto
-        * html/HTMLButtonElement.idl: "validity" attribute
-        * html/HTMLFieldSetElement.idl: ditto
-        * html/HTMLFormControlElement.cpp: object getter
-        (WebCore::HTMLFormControlElement::validity):
-        * html/HTMLFormControlElement.h: ditto
-        * html/HTMLInputElement.idl: "validity" attribute
-        * html/HTMLSelectElement.idl: ditto
-        * html/HTMLTextAreaElement.idl: ditto
-        * html/ValidityState.cpp: Added.
-        (WebCore::ValidityState::ValidityState):
-        (WebCore::ValidityState::valid): validation flag
-        * html/ValidityState.h: Added.
-        (WebCore::ValidityState::create): creation routine
-        (WebCore::ValidityState::control): ValidityState's parent getter
-        (WebCore::ValidityState::valueMissing): validation flag
-        (WebCore::ValidityState::typeMismatch): ditto
-        (WebCore::ValidityState::patternMismatch): ditto
-        (WebCore::ValidityState::tooLong): ditto
-        (WebCore::ValidityState::rangeUnderflow): ditto
-        (WebCore::ValidityState::rangeOverflow): ditto
-        (WebCore::ValidityState::stepMismatch): ditto
-        (WebCore::ValidityState::customError): ditto
-        * html/ValidityState.idl: Added.
-
-2009-07-10  Brady Eidson  <beidson@apple.com>
-
-        Style cleanup over my last patch.
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::~XMLHttpRequest):
-
-2009-07-10  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        * inspector/JavaScriptCallFrame.cpp:
-        (WebCore::JavaScriptCallFrame::dynamicGlobalObject):
-        * inspector/JavaScriptCallFrame.h: New helper method, used below.
-
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::detach): In the special case
-        where we detach from a window currently executing JavaScript,
-        manually tear down our representation of the JavaScript
-        call stack, since we won't get any more callbacks from JavaScriptCore
-        to automatically tear it down. It's too bad that WebCore is
-        responsible for this kind of tracking -- in the future, it would
-        be nice if more of the breakpoint handling was inside of JavaScriptCore.
-
-2009-07-10  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Antti Koivisto.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26496 and <rdar://problem/7046520>
-        REGRESSION: XHR stream connection blocks iFrame loading and resource downloading
-
-        With this test we ended up going over the maximum-connections-per-host limit that CFNetwork expected.
-        When that happened, the first request that was over the limit ended up in a bizarre state where it 
-        wasn't fully serviced until after the long running XHR was complete.
-
-        Loader and Loader::Host work together to try to not exceed the max-connection limit but non-cache
-        resources - such as XHR - could still end up causing this limit to be exceeded.
-
-        This fix adds a workaround specifically for XHR while we hash out a more thorough solution that will
-        handle this at the resource handle level.
-
-        * loader/loader.cpp:
-        (WebCore::Loader::nonCacheRequestInFlight):
-        (WebCore::Loader::nonCacheRequestComplete):
-        (WebCore::Loader::Host::Host):
-        (WebCore::Loader::Host::nonCacheRequestInFlight):
-        (WebCore::Loader::Host::nonCacheRequestComplete):
-        (WebCore::Loader::Host::servePendingRequests): Take nonCacheRequestsInFlight into account.
-        * loader/loader.h:
-        (WebCore::Loader::Host::processingResource): Take nonCacheRequestsInFlight into account.
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::XMLHttpRequest):
-        (WebCore::XMLHttpRequest::~XMLHttpRequest): 
-        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Bump the nonCacheRequestInFlight count.
-        (WebCore::XMLHttpRequest::didFail): Decrement that count if the Loader was notified.
-        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
-
-2009-07-10  Antti Koivisto  <antti@apple.com>
-
-        Try to unbreak non-Mac build.
-
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::formDidFocus):
-        (WebCore::ChromeClient::formDidBlur):
-
-2009-07-10  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        The rest of the fix for <rdar://problem/7038831> REGRESSION (TOT): 
-        In Mail, a crash occurs at WebCore::Widget::afterMouseDown() after 
-        clicking To Do's close box
-
-        Make the Widget* in passMouseDownEventToWidget() a RefPtr.
-
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::passMouseDownEventToWidget):
-
-2009-07-10  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        rename getDOMStructure calls w/o JSGlobalObject* to deprecatedGetDOMStructure
-        https://bugs.webkit.org/show_bug.cgi?id=27157
+        (WebCore::InspectorFrontend::addConsoleMessage):
 
-        This is the first step to fixing
-        https://bugs.webkit.org/show_bug.cgi?id=27088
+2010-02-03  Andras Becsi  <abecsi@webkit.org>
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::deprecatedGetDOMStructure):
-        (WebCore::createDOMObjectWrapper):
-        (WebCore::createDOMNodeWrapper):
-        * bindings/js/JSNamedNodesCollection.cpp:
-        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection):
-        * bindings/js/JSRGBColor.cpp:
-        (WebCore::JSRGBColor::JSRGBColor):
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
-        * bridge/runtime_array.cpp:
-        (JSC::RuntimeArray::RuntimeArray):
-        * bridge/runtime_method.cpp:
-        (JSC::RuntimeMethod::RuntimeMethod):
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::RuntimeObjectImp):
-
-2009-07-10  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Antti Koivisto.
-
-        Add delegate methods about focus and blur and state change
-        https://bugs.webkit.org/show_bug.cgi?id=27153
-
-        Call the appropriate new ChromeClient methods for focus and blur.
-
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::dispatchFocusEvent):
-        (WebCore::HTMLFormControlElement::dispatchBlurEvent):
-        * html/HTMLFormControlElement.h:
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::formDidFocus):
-        (WebCore::EmptyChromeClient::formDidBlur):
-        * page/ChromeClient.h:
-
-2009-07-10  Steve Falkenburg  <sfalken@apple.com>
-
-        <rdar://problem/7048741> REGRESSION: Error about missing SwMenuX.dll opening pages with Shockwave
-        
-        Use altered search path while loading plug-ins. This modifies the DLL search order
-        to look in the directory containing the plug-in even if a call to SetDllDirectory
-        was previously made. Use of SetDllDirectory removes the current directory from the search path,
-        breaking the previous strategy for locating any dependent DLLs of the plug-in.
-        
-        Reviewed by Jon Honeycutt.
-
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::load): Use LoadLibraryEx with LOAD_WITH_ALTERED_SEARCH_PATH
-
-2009-07-10  Adam Roben  <aroben@apple.com>
-
-        Sort all our Xcode projects
-
-        Accomplished using sort-Xcode-project-file.
-
-        Requested by Dave Kilzer.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-07-10  Adam Langley  <agl@google.com>
-
-        Reviewed by Darin Fisher.
-
-        Chromium Linux: use disabled images for disabled widgets.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27106
-
-        Previously, checkboxes and radio controls rendered the same even if disabled.
-        The Chromium side of this change is r20224.
-
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
-        (WebCore::RenderThemeChromiumSkia::paintRadio):
-
-2009-07-10  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by John Sullivan.
-
-        Fix crash when changing the zoom level in http://iphone.akamai.com/
-        <rdar://problem/7029077>
-
-        RenderLayerBacking's paintIntoLayer() method called updateLayerListsIfNeeded(),
-        which could potentially destroy that compositing layer, causing a crash.
-        Prevent this from happening by not doing a compositing update from paintIntoLayer().
-
-        The existing updateLayerListsIfNeeded() was renamed to updateCompositingAndLayerListsIfNeeded(),
-        and still does the compositing update. The new updateLayerListsIfNeeded() does not touch
-        compositing layers, and is still called from paintIntoLayer().
-        
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayer):
-        (WebCore::RenderLayer::hitTestLayer):
-        (WebCore::RenderLayer::updateLayerListsIfNeeded):
-        (WebCore::RenderLayer::updateCompositingAndLayerListsIfNeeded):
-        * rendering/RenderLayer.h:
-
-2009-07-10  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Darin Adler.
-
-        Need to remove UsesManualToJSImplementation() in favor of CustomToJS.
-        https://bugs.webkit.org/show_bug.cgi?id=27010
-
-        Added support for CustomToJS IDL attribute to replace the hard-coded class list in UsesManualToJSImplementation().
-
-        This is just a cleanup of existing functionality, so existing LayoutTests adequately cover this patch.
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-        Removed UsesManualToJSImplementation(), added support for CustomToJS attribute.
-        * css/CSSRule.idl:
-        * css/CSSValue.idl:
-        * css/StyleSheet.idl:
-        * dom/Document.idl:
-        * dom/Event.idl:
-        * dom/Node.idl:
-        * html/ImageData.idl:
-        * svg/SVGElementInstance.idl:
-        * svg/SVGPathSeg.idl:
-        Added CustomToJS attribute to all the above IDL files.
-
-2009-07-10  Dan Bernstein  <mitz@apple.com>
-
-        - fix the build by reverting the ill-advised r45711
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollToAnchor):
-
-2009-07-09  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        Updated WebCore.base.exp to add some needed functions.
-
-        * WebCore.base.exp:
-
-2009-07-10  Dan Bernstein  <mitz@apple.com>
-
-        - address a review comment from Simon Fraser which I forgot to include
-          in the last check-in
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollToAnchor): Pass true to getRect() for
-        maximum transform friendliness!
-
-2009-07-10  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=27137
-          <rdar://problem/7043124> REGRESSION (r44311): Reproducible crash due
-          to infinite recursion into FrameLoader::gotoAnchor() ->
-          FrameView::layout()
-
-        Test: fast/loader/goto-anchor-infinite-layout.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::gotoAnchor): Moved the code to update layout,
-        find the renderer to scroll to, and scroll from here to methods on
-        FrameView, and replaced it with a call to
-        FrameView::maintainScrollPositionAtAnchor().
-        (WebCore::FrameLoader::completed): Call maintainScrollPositionAtAnchor()
-        instead of setLockedToAnchor().
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView): Removed initialization of
-        m_lockedToAnchor.
-        (WebCore::FrameView::reset): Reset m_maintainScrollPositionAnchor instead
-        of m_lockedToAnchor.
-        (WebCore::FrameView::layout): Removed the code related to scrolling to
-        the anchor from here, because scrolling can trigger events which
-        invalidate the layout, and as such, belongs with the post-layout tasks.
-        (WebCore::FrameView::maintainScrollPositionAtAnchor): Added. When called
-        with a node scrolls the view to the top of that node and maintains it
-        scrolled to the top of the node during subsequent layouts, until
-        this function is called with 0 or other things trigger scrolling.
-        (WebCore::FrameView::scrollRectIntoViewRecursively): Reset
-        m_maintainScrollPositionAnchor.
-        (WebCore::FrameView::setScrollPosition): Ditto.
-        (WebCore::FrameView::scrollToAnchor): Added. Scrolls to the top of
-        m_maintainScrollPositionAnchor, if it is set.
-        (WebCore::FrameView::performPostLayoutTasks): Call scrollToAnchor().
-        (WebCore::FrameView::setWasScrolledByUser): Reset
-        m_maintainScrollPositionAnchor.
-
-        * page/FrameView.h: Removed lockedToAnchor(), setLockedToAnchor(),
-        and m_lockedToAnchor. Added maintainScrollPositionAtAnchor() and
-        m_maintainScrollPositionAnchor.
-
-2009-07-04  Sriram Yadavalli  <sriram.yadavalli@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26439
-
-        QtWebKit fails in loading www.nytimes.com in Windows/Linux
-
-        QNetworkReplyHandler is ignoring content associated with 401 error.
-        This causes the XHR response handling to fail.
-
-        Simon: Added also ProxyAuthenticationRequiredError, to handle the same
-        case when going through proxies, as suggested by Prasanth.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
-
-2009-07-10  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Enable HTML 5 Messaging to fix message channel Qt DRT failures in
-        fast/events.
-
-        * WebCore.pro:
-
-2009-07-09  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        added InlineBox::isLeaf()
-        firstLeafChild()/lastLeafChild() not virtual and not callable on InlineBox anymore.
-        firstLeafChild()/lastLeafChild() will no longer return a node outside of the given subtree.   
-        Removed firstLeafChildAfterBox()/lastLeafChildBeforeBox()
-        Removed potentially quadratic behavior if all nodes before/after a given box are empty InlineFlowBoxes
-
-        Currently, these methods are called on RootInlineBox objects only, so above changes should not have
-        any observable effect (only the removal of the square performance behavior could apply, 
-        but the conditions for that are probably of a rather theoretical nature).
-
-        * rendering/InlineBox.cpp:
-        (WebCore::InlineBox::nextLeafChild):
-        (WebCore::InlineBox::prevLeafChild):
-        * rendering/InlineBox.h:
-        (WebCore::InlineBox::isLeaf):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::firstLeafChild):
-        (WebCore::InlineFlowBox::lastLeafChild):
-        * rendering/InlineFlowBox.h:
-        (WebCore::InlineFlowBox::firstChild):
-        (WebCore::InlineFlowBox::lastChild):
-        (WebCore::InlineFlowBox::isLeaf):
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::closestLeafChildForXPos):
-
-2009-07-09  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Added InlineBox::baselinePosition() and lineHeight() methods
-        (adapted remaining code accordingly to use those methods)
-
-        No change in functionality.
-
-        * rendering/InlineBox.h:
-        (WebCore::InlineBox::baselinePosition):
-        (WebCore::InlineBox::lineHeight):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
-        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
-        (WebCore::InlineFlowBox::placeBoxesVertically):
-
-2009-07-09  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 27142 - canPlayType() should return empty string for unsupported content
-        <https://bugs.webkit.org/show_bug.cgi?id=27142>
-
-        Return "" instead of "no" for unsupport media types. 
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::canPlayType):
-
-2009-07-09  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Implement the part of HTML5 spec that deals with parsing of <rp> and <rt> tags
-        in that their end tags are optional if followed by <rp>/<rt>.
-
-        Also specify a new accessibility role "annotation" for <rp> and <rt>.
-
-        Affected code parts are not enclosed in #IF ENABLE(RUBY), since the parsing
-        is not affected by whether ruby is rendered properly or not (in fact, it may 
-        be more profound without ruby layouting, since the contents of <rp> are not hidden).
-
-        Test: fast/ruby/parse-rp.html
-
-        * accessibility/AccessibilityObject.h:
-        (WebCore::):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::roleValue):
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::endTagRequirement):
-        (WebCore::HTMLElement::tagPriority):
-        (WebCore::inlineTagList):
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::rpCreateErrorCheck):
-        (WebCore::HTMLParser::rtCreateErrorCheck):
-        (WebCore::HTMLParser::getNode):
-        * html/HTMLParser.h:
-        * html/HTMLTagNames.in:
-
-2009-07-09  Dmitry Titov  <dimich@chromium.org>
-
-        Not reviewed, fix for previous commit.
-
-        The change http://trac.webkit.org/changeset/45695 did not correctly
-        enabled GTL and QT build flags. This caused layout tests failure.
-        This is speculative fix for those failures.
-
-        * GNUmakefile.am: added ENABLE_CHANNEL_MESSAGING flag.
-        * WebCore.pro: ditto.
-        * page/DOMWindow.idl: touched to cause recompile.
-        * workers/WorkerContext.idl: ditto.
-
-2009-07-09  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26903
-
-        Turned on CHANNEL_MESSAGING by default because the MessageChannel API
-        is now implemented for Web Workers and is reasonably stable.
-
-        Tests: fast/events/message-channel-gc-2.html
-               fast/events/message-channel-gc-3.html
-               fast/events/message-channel-gc-4.html
-               fast/events/message-channel-gc.html
-               fast/events/message-channel-listener-circular-ownership.html
-               fast/events/message-port-clone.html
-               fast/events/message-port-constructor-for-deleted-document.html
-               fast/events/message-port-deleted-document.html
-               fast/events/message-port-deleted-frame.html
-               fast/events/message-port-inactive-document.html
-               fast/events/message-port-no-wrapper.html
-               fast/events/message-port.html
-               fast/workers/worker-cloneport.html
-               fast/workers/worker-messageport-gc.html
-               fast/workers/worker-messageport.html
-
-        * Configurations/FeatureDefines.xcconfig: Turned on ENABLE_CHANNEL_MESSAGING.
-        * WebCore/WebCore.vcproj/WebCoreCommon.vsprops: ditto.
-        * WebCore/WebCore.vcproj/build-generated-files.sh: ditto.
-        * WebCore/page/DOMWindow.idl: touch the file to cause re-generation of headers.
-        * WebCore/workers/WorkerContext.idl: ditto.
-
-
-2009-07-09  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Full page zoom breaks remaining and elapsed time display in the <video> controller.
-        https://bugs.webkit.org/show_bug.cgi?id=27123
-
-        We are changing the size of the time remaining and time elapsed field, to
-        automatically hide them, when the controller is too short.
-
-        Because we toggle the size between 0 and the previous value of the
-        controller, we miss any width change that may occur during full page zoom,
-        and we fail to restore a correct width.
-
-        This change fixes that problem by using a cloned style on which we
-        set the width to 0, and restoring the previous style when going back to
-        the normal width.
-
-        We take care about properly using the cloned style or the pseudo style,
-        by overriding styleForElement().
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlElement::styleForElement):
-        (WebCore::MediaControlElement::attach):
-        (WebCore::MediaControlElement::updateStyle):
-        (WebCore::MediaControlInputElement::styleForElement):
-        (WebCore::MediaControlInputElement::attach):
-        (WebCore::MediaControlInputElement::updateStyle):
-        (WebCore::MediaControlTimeDisplayElement::MediaControlTimeDisplayElement):
-        (WebCore::MediaControlTimeDisplayElement::styleForElement):
-        (WebCore::MediaControlTimeDisplayElement::setVisible):
-        * rendering/MediaControlElements.h:
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::shouldShowTimeDisplayControls): Make sure
-        we take in account the zoom level when deciding if we should hide the 
-        ellapsed and remaining time.
-
-2009-07-09  Michael Nordman  <michaeln@google.com>
-
-        Reviewed by Darin Adler.
-
-        Fix chromium build bustage due to Widget being a RefCounted class.
-        https://bugs.webkit.org/show_bug.cgi?id=27139
-
-        * platform/chromium/PopupMenuChromium.cpp:
-        * platform/chromium/PopupMenuChromium.h:
-
-2009-07-09  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 27130 - Need to implement ARIA role="toolbar"
-        https://bugs.webkit.org/show_bug.cgi?id=27130
-
-        Test: platform/mac/accessibility/aria-toolbar.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::RoleEntry::):
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper roleDescription]):
-
-2009-07-09  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        [Chromium] Upstream WebCore.gypi, the project file for Chromium build.
-        https://bugs.webkit.org/show_bug.cgi?id=27135
-
-        * WebCore.gypi: Added.
-
-2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        A more robust fix for <rdar://problem/6930280> Reproducible crash at
-        USA Today photo gallery
-
-        Reviewed by Steve Falkenburg.
-
-        * plugins/win/PluginMessageThrottlerWin.cpp:
-        (WebCore::PluginMessageThrottlerWin::messageThrottleTimerFired):
-        Protect the PluginView from destruction before calling its window proc.
-
-2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        <rdar://problem/6978804> WER #16: Repro Access Violation in
-        WebCore::PluginView::bindingInstance (1310178023)
-
-        Reviewed by Darin Adler.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::bindingInstance):
-        Protect the PluginView from destruction before calling NPN_GetValue. If
-        the renderer for the PluginView was destroyed during the call, and the
-        PluginView's ref count is now 1, return null.
-
-2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Speculative fix for <rdar://problem/6991251> WER #13: Crash in
-        WebKit!WebCore::PluginView::performRequest+203 (1311461169)
-
-        Reviewed by Darin Adler.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::performRequest):
-        Protect the PluginView from destruction before performing a load.
-        Removed some trailing whitespace.
-
-2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Build fix.
-
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
-
-2009-07-09  Beth Dakin and Jon Honeycutt <bdakin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Make Widget RefCounted to fix or make fixable:
-
-        <rdar://problem/7038831> REGRESSION (TOT): In Mail, a crash occurs 
-        at WebCore::Widget::afterMouseDown() after clicking To Do's close 
-        box
-        <rdar://problem/6978804> WER #16: Repro Access Violation in 
-        WebCore::PluginView::bindingInstance (1310178023)
-        -and-
-        <rdar://problem/6991251> WER #13: Crash in WebKit!
-        WebCore::PluginView::performRequest+203 (1311461169) 
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::createPlugin):
-        Changed to return PassRefPtr
-        (WebCore::EmptyFrameLoaderClient::createJavaAppletWidget):
-        Ditto.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadSubframe):
-        (WebCore::FrameLoader::loadPlugin):
-        Make the widget variable a RefPtr. Use .get() when passing it to
-        RenderPart::setWidget().
-        (WebCore::FrameLoader::createJavaAppletWidget):
-        Make the widget variable a RefPtr.
-
-        * loader/FrameLoader.h:
-        Changed the return type of createJavaAppletWidget().
-
-        * loader/FrameLoaderClient.h:
-        Change the return types of createPlugin() and 
-        createJavaAppletWidget().
-
-        * page/Frame.cpp:
-        (WebCore::Frame::createView):
-        No need to call .get() since setWidget() takes a RefPtr.
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layoutIfNeededRecursive):
-        children() now returns a HashSet of RefPtrs.
-
-        * page/FrameView.h:
-        Remove inheritance from RefCounted; we pick this up from ScrollView
-        through Widget.
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::addChild):
-        addChild() now takes a PassRefPtr and m_children now keeps a 
-        HashSet of RefPtrs.
-
-        * platform/ScrollView.h:
-        ScrollView constructor is now protected.
-        (WebCore::ScrollView::children):
-        m_children is now a HashSet of RefPtrs.
-
-        * platform/Scrollbar.h:
-        Remove inheritance from RefCounted; we pick this up from ScrollView
-        through Widget.
-
-        * platform/Widget.h:
-        Inherit from RefCounted. Cleaned up some whitespace. Make m_widget 
-        a RefPtr.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::create):
-        Adopt the PluginView when returning it.
-
-        * plugins/PluginView.h:
-        Changed create() to return a PassRefPtr.
-
-        * rendering/RenderApplet.cpp:
-        Receive result in a RefPtr when calling createJavaAppletWidget().
-
-        * rendering/RenderPart.cpp:
-        (WebCore::RenderPart::setWidget): 
-        setWidget() now takes a PassRefPtr. Also removed the manual ref of 
-        FrameViews. This is handled by having m_widget be a RefPtr. Removed 
-        deleteWidget().
-
-        * rendering/RenderPart.h:
-        Removed override of deleteWidget().
-
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::destroy):
-        (WebCore::RenderWidget::setWidget):
-        (WebCore::RenderWidget::paint):
-        (WebCore::RenderWidget::setOverlapTestResult):
-        (WebCore::RenderWidget::updateWidgetPosition):
-        Use .get().
-        (WebCore::RenderWidget::clearWidget):
-        Don't call deleteWidget(). It was removed. 
-
-        * rendering/RenderWidget.h:
-        Removed deleteWidget(). Made m_widget a RefPtr.
-        (WebCore::RenderWidget::widget):
-        Use .get().
+        Unreviewed build fix.
 
-2009-07-09  Chris Fleizach  <cfleizach@apple.com>
+        [Qt] Roll-out r54281 because it broke the build on the Qt Release bot.
+
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::State::State):
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl):
+        (WebCore::GraphicsLayerQtImpl::setBaseTransform):
+        (WebCore::GraphicsLayerQtImpl::drawContents):
+        (WebCore::GraphicsLayerQtImpl::notifyChange):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        (WebCore::GraphicsLayerQt::setNeedsDisplayInRect):
+        (WebCore::applyTimingFunction):
+        (WebCore::webkitAnimationToQtAnimationValue):
+        (WebCore::AnimationQtBase::updateState):
+        (WebCore::AnimationQt::updateCurrentTime):
+        (WebCore::TransformAnimationQt::TransformAnimationQt):
+        (WebCore::TransformAnimationQt::~TransformAnimationQt):
+        (WebCore::TransformAnimationQt::applyFrame):
+        (WebCore::TransformAnimationQt::updateState):
+        (WebCore::OpacityAnimationQt::updateState):
+        (WebCore::GraphicsLayerQt::pauseAnimation):
+
+2010-02-02  Bryan Yeung  <bryeung@google.com>
 
         Reviewed by Darin Adler.
 
-        Bug 27129 - AX: possible assertion for a non-native image in accessibility
-        https://bugs.webkit.org/show_bug.cgi?id=27129 
-
-        It's possible for an image that is not really an image to assert, because its renderer
-        is turned into a RenderImage.
-
-        Test: accessibility/non-native-image-crash.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        (WebCore::RoleEntry::):
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper roleDescription]):
-
-2009-07-09  Simon Fraser  <simon.fraser@apple.com>
-
-        Build fix for SnowLeopard.
-        
-        Avoid using the contentsTransform methods if not on Leopard, because
-        we don't need to call them.
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::updateContentsTransform):
-        * platform/graphics/mac/WebLayer.mm:
-        (-[WebLayer setNeedsDisplayInRect:]):
-        * platform/graphics/mac/WebTiledLayer.mm:
-        (-[WebTiledLayer setNeedsDisplayInRect:]):
-
-2009-07-09  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        Improve the appearance of text in compositing layers when -[CALayer geometryFlipped]
-        is not available.
-        <rdar://problem/6120614>
-
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::setContentsOrientation):
-        (WebCore::GraphicsLayer::contentsOrientation):
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::GraphicsLayer):
-        Add a m_contentsOrientation member and getter/setter to control whether
-        the contents of this layer have a transform applied to them before display.
-
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        New method to return the default contents orientation.
+        Avoid using an invalidated KURL object in baseURI.
 
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::flipTransform):
-        Convenience method to return a transform with a Y flip.
-
-        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
-        (WebCore::GraphicsLayerCA::setSize):
-        After the size changes we have to update the contentsTransform.
-
-        (WebCore::GraphicsLayerCA::setGeometryOrientation):
-        (WebCore::GraphicsLayerCA::geometryOrientation):
-        If -setGeometryFlipped: is not available, use a children transform.
-        
-        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
-        Tiled layers have issues with flipped contentsTransform, so just use
-        top-down drawing for them. Call updateContentsTransform() to set the
-        new contents transform after swapping layers.
-        
-        (WebCore::GraphicsLayerCA::defaultContentsOrientation):
-        Use bottom-up when -geometryFlipped is not available, otherwise top-down.
-        
-        (WebCore::GraphicsLayerCA::updateContentsTransform):
-        Set the layer contents transform based on contentsOrientation().
-
-        (WebCore::GraphicsLayerCA::setContentsLayer):
-        We have to manually flip contents layers if we're not using -geometryFlipped.
-        
-        * platform/graphics/mac/WebLayer.h:
-        * platform/graphics/mac/WebLayer.mm:
-        Do early return if layerContents is nil. Flip the CTM if the layer has
-        bottom-up coordinates, so that CG sees a CTM with no flip.
-        Do the CGContextRestoreGState() after drawing the debug indicator.
-        
-        (-[WebLayer setNeedsDisplayInRect:]):
-        * platform/graphics/mac/WebTiledLayer.mm:
-        (-[WebTiledLayer setNeedsDisplayInRect:]):
-        Need to map the dirty rect through the contentsTransform.
-
-2009-07-09  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Geoff Garen.
-
-        <rdar://problem/6921671> Visit counter shouldn't be incremented by redirects.
-
-        Can't test this functionality with layout tests.
-
-        * WebCore.base.exp:
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::recordVisitAtTime):
-        (WebCore::HistoryItem::visited):
-        * history/HistoryItem.h:
-        Only increase visit count if explicitly told to. Now, some visits change last access time,
-        but do not increase visit count.
-
-2009-07-09  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7046098> MediaControllerThemeQT requires QuickTime 7.6.3
-
-        Require QuickTime 7.6.3 or higher to enable the new media controller UI.
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::mediaControllerTheme):
+        https://bugs.webkit.org/show_bug.cgi?id=34492
 
-2009-07-09  Sam Weinig  <sam@webkit.org>
+        This change fixes baseURI for Chromium (where the KURL implementation
+        does not allow invalid KURLs to carry relative paths).  This is
+        regression tested by
+        LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
 
-        Reviewed by Beth Dakin.
-
-        Remove incorrect comment.
-
-        * page/MouseEventWithHitTestResults.h:
-
-2009-07-09  Mads Ager  <ager@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Update the V8 bindings codegenerator to use the RGBColor::create
-        method to handle refcounts for RGBColor objects correctly.
-        
-       * bindings/scripts/CodeGeneratorV8.pm: Use RGBColor::create to create RGBColor objects.
-
-2009-07-09  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Crash in RenderMedia::styleDidChange.
-        <rdar://problem/7044313> CrashTracer: quicklook crashed generating thumbnail for page with 
-        media element (RenderMedia::styleDidChange 115)
-
-        Speculative fix for crash in styleDidChange. Null check controller elements before tell
-        them to update style.
-
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::styleDidChange):
-
-2009-07-09  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Move V8DOMWrapper to its own file
-        https://bugs.webkit.org/show_bug.cgi?id=27121
-
-        * bindings/v8/V8DOMWrapper.cpp: Added.
-        (WebCore::GetToStringName):
-        (WebCore::ConstructorToString):
-        (WebCore::V8DOMWrapper::convertSVGElementInstanceToV8Object):
-        (WebCore::V8DOMWrapper::convertSVGObjectWithContextToV8Object):
-        (WebCore::V8DOMWrapper::domObjectHasJSWrapper):
-        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
-        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMObject):
-        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::convertToV8Object):
-        (WebCore::V8DOMWrapper::setHiddenWindowReference):
-        (WebCore::V8DOMWrapper::domWrapperType):
-        (WebCore::V8DOMWrapper::convertToNativeObjectImpl):
-        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
-        (WebCore::V8DOMWrapper::lookupDOMWrapper):
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNodeHelper):
-        (WebCore::V8DOMWrapper::wrapNativeNodeFilter):
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-        (WebCore::V8DOMWrapper::setDOMWrapper):
-        (WebCore::V8DOMWrapper::maybeDOMWrapper):
-        (WebCore::V8DOMWrapper::isDOMEventWrapper):
-        (WebCore::V8DOMWrapper::isWrapperOfType):
-        (WebCore::V8DOMWrapper::htmlElementType):
-        (WebCore::V8DOMWrapper::svgElementType):
-        (WebCore::V8DOMWrapper::convertEventToV8Object):
-        (WebCore::):
-        (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
-        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
-        (WebCore::V8DOMWrapper::convertDOMImplementationToV8Object):
-        (WebCore::V8DOMWrapper::convertStyleSheetToV8Object):
-        (WebCore::V8DOMWrapper::convertCSSValueToV8Object):
-        (WebCore::V8DOMWrapper::convertCSSRuleToV8Object):
-        (WebCore::V8DOMWrapper::convertWindowToV8Object):
-        * bindings/v8/V8DOMWrapper.h: Added.
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
-        (WebCore::V8DOMWrapper::wrapCPointer):
-        (WebCore::V8DOMWrapper::extractCPointer):
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
-        (WebCore::V8DOMWrapper::convertToV8Object):
-        (WebCore::V8DOMWrapper::convertToNativeObject):
-        (WebCore::V8DOMWrapper::convertToNativeEvent):
-        (WebCore::V8DOMWrapper::extractCPointerImpl):
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-        * bindings/v8/V8Proxy.cpp:
-        * bindings/v8/V8Proxy.h:
-
-2009-07-09  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adele Peterson.
+        This is a re-application of this patch since it was mistakenly identified as
+        the cause of a big chromium test regression and rolled out in r54264.
 
-        Crash in setFocusedFrame.
-        <rdar://7032869> Crashing in setFocusedFrame on blogger.com.
-
-        Speculative fix for crasher in setFocusedFrame.  Make sure to ref both frames and fire
-        the events only after the local member has been updated.
-
-        * page/FocusController.cpp:
-        (WebCore::FocusController::setFocusedFrame):
-
-2009-07-09  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Possible crashes when mouse clicks not dispatched because range input destroyed while 
-        thumb is being dragged (e.g. scrub to end of movie)
-        <rdar://problem/7037494> 
-        https://bugs.webkit.org/show_bug.cgi?id=27101
-
-        Some shadow nodes "capture" all mouse events from mouseDown to mouseUp so they continue to 
-        get mouse events even when the mouse is moved outside of the node. This is done by putting
-        EventHandler into a mode where it sends all mouse events to the node regardless of the
-        actual mouse position. The mode is set on mouseDown and cleared on mouseUp but if the
-        node is deleted while in this mode, the mouseUp is never sent and EventHandler continues
-        to try to send events to the deleted node. This sometimes results in a crash, and sometimes
-        in a page that doesn't respond to click events.
-
-        Tests: fast/forms/search-delete-while-cancel-button-clicked.html
-               fast/forms/slider-delete-while-dragging-thumb.html
-               media/audio-delete-while-slider-thumb-clicked.html
-               media/audio-delete-while-step-button-clicked.html
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlSeekButtonElement::detach):
-            New, call setCapturingMouseEventsNode if capturing mouse events.
-        * rendering/MediaControlElements.h:
-            Declare detach().
+        * dom/Element.cpp:
+        (WebCore::Element::baseURI):
 
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderThumbElement::detach):
-            New, call setCapturingMouseEventsNode if capturing mouse events.
+2010-02-02  Joel Stanley  <joel@jms.id.au>
 
-        * rendering/TextControlInnerElements.cpp:
-        (WebCore::SearchFieldCancelButtonElement::detach):
-            New, call setCapturingMouseEventsNode if capturing mouse events.
-        * rendering/TextControlInnerElements.h:
-            Declare detach().
+        Reviewed by David Levin.
 
-2009-07-09  Yury Semikhatsky  <yurys@chromium.org>
+        [Chromium] Make setCaretBlinkInterval static.
+        https://bugs.webkit.org/show_bug.cgi?id=31704
 
-        Reviewed by Dimitri Glazkov.
+        This is so it can be called from the newly exposed Chromium API setter
+        method.
 
-        Enter the Frame's context before creating new objects in setContextDebugId.
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * rendering/RenderThemeChromiumLinux.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=27112
+2010-02-02  Yael Aharon  <yael.aharon@nokia.com>
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::setContextDebugId):
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-07-09  Simon Hausmann  <hausmann@webkit.org>
+        [Qt] WebSockets : Buffer the data in WebKit instead of QtNetwork
+        https://bugs.webkit.org/show_bug.cgi?id=34425
 
-        Fix the Qt build.
+        Buffer the sent data in SocketStreamHandlePrivate instead of relying on
+        the network layer to do it. This is more robust and more consistent with how 
+        Qt's HTTP stack works.
+        Close the socket in SocketStreamHandlePrivate::close() regardless of its state.
 
-        * WebCore.pro: Add new storage impl files to the build.
+        No new tests, since no new functionality is introduced.
 
-2009-07-08  Adam Barth  <abarth@webkit.org>
+        * platform/network/qt/SocketStreamHandlePrivate.h:
+        * platform/network/qt/SocketStreamHandleQt.cpp:
+        (WebCore::SocketStreamHandlePrivate::SocketStreamHandlePrivate):
+        (WebCore::SocketStreamHandlePrivate::send):
+        (WebCore::SocketStreamHandlePrivate::close):
+        (WebCore::SocketStreamHandlePrivate::socketBytesWritten):
 
-        Rubber stamped by Eric Seidel.
+2010-02-03  Shinichiro Hamaji  <hamaji@chromium.org>
 
-        [V8] Move DOM wrapper functions in V8Proxy to V8DOMWrapper
-        https://bugs.webkit.org/show_bug.cgi?id=27107
+        Unreviewed revert of r54259 as it seems to break chromium's unit tests.
+        The tests pass with r54257 but fail with r54260.
+        As r54258 and r54260 don't touch code, I'm reverting this change.
 
-        This patch is just renaming.  Code motion will occur next.
+        [V8] Generate toV8 conversion helpers, a la JSC bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=32563
 
-        * bindings/scripts/CodeGeneratorV8.pm:
         * bindings/v8/ScriptController.cpp:
         (WebCore::ScriptController::processingUserGesture):
         (WebCore::createScriptObject):
         (WebCore::ScriptController::createScriptObjectForPluginElement):
         * bindings/v8/ScriptObject.cpp:
         (WebCore::ScriptGlobalObject::set):
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
         * bindings/v8/V8AbstractEventListener.cpp:
         (WebCore::V8AbstractEventListener::handleEvent):
-        (WebCore::V8AbstractEventListener::getReceiverObject):
-        * bindings/v8/V8Collection.cpp:
-        (WebCore::toOptionsCollectionSetter):
         * bindings/v8/V8Collection.h:
         (WebCore::getV8Object):
+        (WebCore::toNativeCollection):
         (WebCore::getNamedPropertyOfCollection):
-        (WebCore::nodeCollectionNamedPropertyGetter):
+        (WebCore::collectionNamedPropertyGetter):
         (WebCore::getIndexedPropertyOfCollection):
-        (WebCore::nodeCollectionIndexedPropertyGetter):
+        (WebCore::collectionIndexedPropertyGetter):
         (WebCore::nodeCollectionIndexedPropertyEnumerator):
         (WebCore::collectionIndexedPropertyEnumerator):
         (WebCore::collectionStringOrNullIndexedPropertyGetter):
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::DOMData::handleWeakObject):
-        (WebCore::DOMData::removeObjectsFromWrapperMap):
-        * bindings/v8/V8GCController.cpp:
-        (WebCore::enumerateDOMObjectMap):
-        (WebCore::DOMObjectVisitor::visitDOMWrapper):
-        (WebCore::GCPrologueVisitor::visitDOMWrapper):
-        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
-        * bindings/v8/V8Helpers.cpp:
-        (WebCore::wrapNPObject):
-        * bindings/v8/V8NodeFilterCondition.cpp:
-        (WebCore::V8NodeFilterCondition::acceptNode):
-        * bindings/v8/V8Proxy.cpp:
+        (WebCore::collectionStringIndexedPropertyGetter):
+        (WebCore::setCollectionIndexedGetter):
+        (WebCore::setCollectionNamedGetter):
+        (WebCore::setCollectionStringOrNullIndexedGetter):
+        (WebCore::setCollectionStringIndexedGetter):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::updateDocumentWrapperCache):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::downcastSVGPathSeg):
         (WebCore::V8DOMWrapper::convertSVGElementInstanceToV8Object):
         (WebCore::V8DOMWrapper::convertSVGObjectWithContextToV8Object):
-        (WebCore::V8DOMWrapper::domObjectHasJSWrapper):
-        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
-        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMObject):
-        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::getConstructor):
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8Proxy::retrieveWindow):
-        (WebCore::V8Proxy::updateDocumentWrapperCache):
-        (WebCore::V8Proxy::clearForNavigation):
-        (WebCore::V8Proxy::installDOMWindow):
-        (WebCore::setDOMExceptionHelper):
         (WebCore::V8DOMWrapper::convertToV8Object):
-        (WebCore::V8DOMWrapper::setHiddenWindowReference):
-        (WebCore::V8DOMWrapper::domWrapperType):
-        (WebCore::V8DOMWrapper::convertToNativeObjectImpl):
-        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
-        (WebCore::V8DOMWrapper::lookupDOMWrapper):
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNodeHelper):
-        (WebCore::V8DOMWrapper::wrapNativeNodeFilter):
         (WebCore::V8DOMWrapper::instantiateV8Object):
-        (WebCore::V8DOMWrapper::setDOMWrapper):
-        (WebCore::V8DOMWrapper::maybeDOMWrapper):
         (WebCore::V8DOMWrapper::isDOMEventWrapper):
-        (WebCore::V8DOMWrapper::isWrapperOfType):
         (WebCore::V8DOMWrapper::htmlElementType):
         (WebCore::V8DOMWrapper::svgElementType):
         (WebCore::V8DOMWrapper::convertEventToV8Object):
+        (WebCore::):
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object):
         (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
         (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
         (WebCore::V8DOMWrapper::convertDOMImplementationToV8Object):
         (WebCore::V8DOMWrapper::convertStyleSheetToV8Object):
         (WebCore::V8DOMWrapper::convertCSSValueToV8Object):
         (WebCore::V8DOMWrapper::convertCSSRuleToV8Object):
         (WebCore::V8DOMWrapper::convertWindowToV8Object):
-        (WebCore::V8Proxy::bindJsObjectToWindow):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
-        (WebCore::V8DOMWrapper::wrapCPointer):
-        (WebCore::V8DOMWrapper::extractCPointer):
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
+        (WebCore::V8DOMWrapper::convertNamedNodeMapToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
         (WebCore::V8DOMWrapper::convertToV8Object):
-        (WebCore::V8DOMWrapper::convertToNativeObject):
-        (WebCore::V8DOMWrapper::convertToNativeEvent):
-        (WebCore::V8DOMWrapper::extractCPointerImpl):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
         (WebCore::V8DOMWrapper::instantiateV8Object):
-        (WebCore::V8Proxy::constructDOMObject):
-        (WebCore::toV8):
-        * bindings/v8/V8SVGPODTypeWrapper.h:
-        (WebCore::V8SVGPODTypeUtil::toSVGPODType):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::retrieve):
-        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
-        (WebCore::WorkerContextExecutionProxy::GetConstructor):
-        (WebCore::WorkerContextExecutionProxy::ToV8Object):
-        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
-        (WebCore::WorkerContextExecutionProxy::toV8):
-        * bindings/v8/custom/V8AttrCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::acceptNode):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException):
         * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::toV8):
-        (WebCore::toCanvasStyle):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ClientRectListCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8ClipboardCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomBinding.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::V8Custom::GetTargetFrame):
+        (WebCore::toV8Object):
+        (WebCore::V8CanvasRenderingContext2D::createPatternCallback):
+        * bindings/v8/custom/V8CustomPositionCallback.cpp:
+        (WebCore::V8CustomPositionCallback::handleEvent):
+        * bindings/v8/custom/V8CustomPositionErrorCallback.cpp:
+        (WebCore::V8CustomPositionErrorCallback::handleEvent):
         * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
         (WebCore::V8CustomSQLStatementCallback::handleEvent):
         * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
@@ -50713,9354 +21590,2149 @@ form controls that have different validity states.
         * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
         (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
         * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::V8DOMWindow::openCallback):
+        (WebCore::V8DOMWindow::indexedPropertyGetter):
+        (WebCore::V8DOMWindow::namedPropertyGetter):
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
         (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::V8Custom::ClearTimeoutImpl):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        * bindings/v8/custom/V8DatabaseCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8Document::evaluateCallback):
+        (WebCore::V8Document::getCSSCanvasContextCallback):
+        (WebCore::V8Document::implementationAccessorGetter):
         * bindings/v8/custom/V8DocumentLocationCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
+        (WebCore::V8Document::locationAccessorGetter):
         * bindings/v8/custom/V8ElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
+        (WebCore::V8Element::setAttributeNodeCallback):
+        (WebCore::V8Element::setAttributeNodeNSCallback):
         * bindings/v8/custom/V8EventCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
+        (WebCore::V8Event::dataTransferAccessorGetter):
+        (WebCore::V8Event::clipboardDataAccessorGetter):
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::V8HTMLAllCollection::callAsFunctionCallback):
         * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8Custom::v8HTMLAudioElementConstructorCallback):
         * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
         * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
         (WebCore::getNamedItems):
         (WebCore::getItem):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8HTMLCollection::callAsFunctionCallback):
         * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
+        (WebCore::V8HTMLDocument::namedPropertyGetter):
+        (WebCore::V8HTMLDocument::allAccessorGetter):
         * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
+        (WebCore::V8HTMLFormElement::indexedPropertyGetter):
+        (WebCore::V8HTMLFormElement::namedPropertyGetter):
         * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
+        (WebCore::V8HTMLFrameSetElement::namedPropertyGetter):
         * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8Custom::v8HTMLImageElementConstructorCallback):
         * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_SETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
+        (WebCore::V8HTMLOptionsCollection::indexedPropertyGetter):
         * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::V8HTMLSelectElement::namedPropertyGetter):
+        (WebCore::V8HTMLSelectElement::indexedPropertyGetter):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::createInjectedScript):
+        (WebCore::V8InjectedScriptHost::nodeForIdCallback):
+        (WebCore::V8InjectedScriptHost::databaseForIdCallback):
         * bindings/v8/custom/V8MessageChannelConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8MessageChannel::constructorCallback):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::portsAccessorGetter):
         * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8NavigatorCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8NamedNodeMap::indexedPropertyGetter):
+        (WebCore::V8NamedNodeMap::namedPropertyGetter):
         * bindings/v8/custom/V8NodeIteratorCustom.cpp:
         (WebCore::toV8):
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8NodeListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGLengthCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8NodeList::namedPropertyGetter):
+        (WebCore::V8NodeList::callAsFunctionCallback):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::V8NotificationCenter::createHTMLNotificationCallback):
+        (WebCore::V8NotificationCenter::createNotificationCallback):
         * bindings/v8/custom/V8SVGMatrixCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8StorageCustom.cpp:
-        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
-        (WebCore::storageGetter):
-        (WebCore::storageSetter):
-        (WebCore::storageDeleter):
+        (WebCore::V8SVGMatrix::multiplyCallback):
+        (WebCore::V8SVGMatrix::inverseCallback):
+        (WebCore::V8SVGMatrix::rotateFromVectorCallback):
         * bindings/v8/custom/V8StyleSheetListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8StyleSheetList::namedPropertyGetter):
         * bindings/v8/custom/V8TreeWalkerCustom.cpp:
-        (WebCore::toV8):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::SetTimeoutOrInterval):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::toV8Object):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toV8Object):
         * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Make sure we can click outside the slider thumb and start dragging.
-        https://bugs.webkit.org/show_bug.cgi?id=26229
-
-        Previously we were assuming that if the thumb hasn't been clicked, we
-        wouldn't issue any value change upon dragging.
-
-        We need to handle the two different cases:
-        - Clicked in the thumb, we need to make sure the cursor is always pointing
-        the same slider thumb point.
-        - Clicked outside, the cursor should always be pointing to the center of
-        the thumb.
-
-        For simplicity, we don't remember the original point of the mouse down,
-        but a vector between that point and the thumb.
-
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderThumbElement::SliderThumbElement):
-        (WebCore::SliderThumbElement::defaultEventHandler):
-        (WebCore::RenderSlider::mouseEventVectorToThumb): Utility function.
-        * rendering/RenderSlider.h:
-
-2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27100
-        <rdar://problem/7042621>
-
-        Don't display "loading" in the <video> controller when
-        there is no src specified.
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlStatusDisplayElement::update): The only
-        way to find out if we have an element is currentSrc(). networkState()
-        will always report LOADING according to the spec.
-
-2009-07-08  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        [V8] Move V8GCController functions to their own file
-        https://bugs.webkit.org/show_bug.cgi?id=27102
-
-        * bindings/v8/V8GCController.cpp: Added.
-        * bindings/v8/V8GCController.h: Added.
-        * bindings/v8/V8Proxy.cpp:
-        * bindings/v8/V8Proxy.h:
+        (WebCore::V8XSLTProcessor::transformToFragmentCallback):
+        (WebCore::V8XSLTProcessor::transformToDocumentCallback):
 
-2009-07-08  Jeremy Orlow  <jorlow@chromium.org>
+2010-02-03  Mikhail Naganov  <mnaganov@chromium.org>
 
-        Reviewed by Darin Fisher.
-
-        Split StorageArea and StorageNamespace into an interface and implementation.
-        https://bugs.webkit.org/show_bug.cgi?id=27072
+        Reviewed by Pavel Feldman.
 
-        I need to split StorageNamespace and StorageArea into an interface and
-        implementation.  In a later patch, I'll implement a proxy interface
-        that'll run inside the Chromium renderer process.
+        Start unforking debugger and profiler code.
 
-        Additionally, fix the alphabetical ordering of files I recently added
-        in the project files.
+        Remove custom implementation of Console.
+        Add 'ScriptProfiler' and 'ScriptProfile' types.
+        Start migration to engine-neutral types in InspectorController.
 
-        This is a continuation of other refactoring work:
-        https://bugs.webkit.org/show_bug.cgi?id=25376
+        https://bugs.webkit.org/show_bug.cgi?id=34481
 
         * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.gypi:
+        * WebCore.pro:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::create):
-        * storage/StorageArea.h:
-        (WebCore::StorageArea::~StorageArea):
-        * storage/StorageAreaImpl.cpp: Copied from WebCore/storage/StorageArea.cpp.
-        (WebCore::StorageAreaImpl::create):
-        (WebCore::StorageAreaImpl::~StorageAreaImpl):
-        (WebCore::StorageAreaImpl::StorageAreaImpl):
-        (WebCore::StorageAreaImpl::copy):
-        (WebCore::StorageAreaImpl::length):
-        (WebCore::StorageAreaImpl::key):
-        (WebCore::StorageAreaImpl::getItem):
-        (WebCore::StorageAreaImpl::setItem):
-        (WebCore::StorageAreaImpl::removeItem):
-        (WebCore::StorageAreaImpl::clear):
-        (WebCore::StorageAreaImpl::contains):
-        (WebCore::StorageAreaImpl::importItem):
-        (WebCore::StorageAreaImpl::securityOrigin):
-        (WebCore::StorageAreaImpl::close):
-        (WebCore::StorageAreaImpl::blockUntilImportComplete):
-        (WebCore::StorageAreaImpl::dispatchStorageEvent):
-        * storage/StorageAreaImpl.h: Copied from WebCore/storage/StorageArea.h.
-        * storage/StorageAreaSync.h:
-        * storage/StorageNamespace.cpp:
-        (WebCore::StorageNamespace::localStorageNamespace):
-        (WebCore::StorageNamespace::sessionStorageNamespace):
-        * storage/StorageNamespace.h:
-        (WebCore::StorageNamespace::~StorageNamespace):
-        * storage/StorageNamespaceImpl.cpp: Copied from WebCore/storage/StorageNamespace.cpp.
-        (WebCore::StorageNamespaceImpl::localStorageNamespace):
-        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
-        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
-        (WebCore::StorageNamespaceImpl::~StorageNamespaceImpl):
-        (WebCore::StorageNamespaceImpl::copy):
-        (WebCore::StorageNamespaceImpl::storageArea):
-        (WebCore::StorageNamespaceImpl::close):
-        * storage/StorageNamespaceImpl.h: Copied from WebCore/storage/StorageNamespace.h.
-
-2009-07-08  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        [V8] Move garbage collector related functions from V8Proxy to V8GCController
-        https://bugs.webkit.org/show_bug.cgi?id=26967
-
-        This patch just moves the functions around in V8Proxy.  We'll actually
-        move them to a separate file in another patch.
-
-        * bindings/v8/NPV8Object.cpp:
-        (freeV8NPObject):
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::~ScheduledAction):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::gcProtectJSWrapper):
-        (WebCore::ScriptController::gcUnprotectJSWrapper):
-        * bindings/v8/ScriptInstance.cpp:
-        (WebCore::V8ScriptInstance::clear):
-        (WebCore::V8ScriptInstance::set):
-        * bindings/v8/ScriptValue.h:
-        (WebCore::ScriptValue::ScriptValue):
-        (WebCore::ScriptValue::operator=):
-        (WebCore::ScriptValue::clear):
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::disposeListenerObject):
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::~V8LazyEventListener):
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
-        * bindings/v8/V8NodeFilterCondition.cpp:
-        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
-        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8GCController::registerGlobalHandle):
-        (WebCore::V8GCController::unregisterGlobalHandle):
-        (WebCore::V8GCController::gcProtect):
-        (WebCore::V8GCController::gcUnprotect):
-        (WebCore::V8Proxy::destroyGlobal):
-        (WebCore::V8Proxy::updateDocumentWrapper):
-        (WebCore::V8Proxy::clearDocumentWrapper):
-        (WebCore::V8Proxy::disposeContextHandles):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::):
-        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::V8EventListener):
-
-2009-07-08  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26918
-        
-        Prevents injection of HTML Base tag.
-
-        Tests: http/tests/security/xssAuditor/base-href-control-char.html
-               http/tests/security/xssAuditor/base-href-null-char.html
-               http/tests/security/xssAuditor/base-href-safe.html
-               http/tests/security/xssAuditor/base-href-safe2.html
-               http/tests/security/xssAuditor/base-href-scheme-relative.html
-               http/tests/security/xssAuditor/base-href.html
-
-        * html/HTMLBaseElement.cpp:
-        (WebCore::HTMLBaseElement::parseMappedAttribute):
-        (WebCore::HTMLBaseElement::process): Modified to call XSSAuditor::canSetBaseElementURL
-        to determine if it is safe to use base element URL.
-        * html/HTMLBaseElement.h: Added field m_hrefAttrValue to store unparsed base element URL.
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canSetBaseElementURL):
-        * page/XSSAuditor.h:
-
-2009-07-08  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Upstream V8 npruntime bindings.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27094
-
-        * bindings/v8/npruntime.cpp: Upstreamed from src.chromium.org.
-        (StringKey::operator==):
-        (StringKey::StringKeyHash::hash):
-        (StringKey::StringKeyHash::equal):
-        (StringKeyHashTraits::constructDeletedValue):
-        (StringKeyHashTraits::isDeletedValue):
-        (getStringIdentifierMap):
-        (getIntIdentifierMap):
-        * bindings/v8/npruntime_impl.h: Upstreamed from src.chromium.org.
-        * bindings/v8/npruntime_internal.h: Upstreamed from src.chromium.org.
-        * bindings/v8/npruntime_priv.h: Upstreamed from src.chromium.org.
-
-2009-07-08  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Extending the PlatformFileHandle definition from PLATFORM(WIN) to
-        PLATFORM(WIN_OS)
-
-        https://bugs.webkit.org/show_bug.cgi?id=27013
-
-        * platform/FileSystem.h:
-
-2009-07-08  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=27071
-        
-        Resolves issue when HTTP parameters contain null- and  non-null-control- characters.
-
-        Tests: http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event-null-char.html
-               http/tests/security/xssAuditor/embed-tag-control-char.html
-               http/tests/security/xssAuditor/embed-tag-null-char.html
-               http/tests/security/xssAuditor/embed-tag.html
-               http/tests/security/xssAuditor/link-onclick-control-char.html
-               http/tests/security/xssAuditor/link-onclick-null-char.html
-               http/tests/security/xssAuditor/object-embed-tag-control-char.html
-               http/tests/security/xssAuditor/object-embed-tag-null-char.html
-               http/tests/security/xssAuditor/object-embed-tag.html
-               http/tests/security/xssAuditor/object-tag.html
-               http/tests/security/xssAuditor/script-tag-post-control-char.html
-               http/tests/security/xssAuditor/script-tag-post-null-char.html
-               http/tests/security/xssAuditor/script-tag-with-source-control-char.html
-               http/tests/security/xssAuditor/script-tag-with-source-null-char.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::isNonNullControlCharacter): Called by XSSAuditor::decodeURL.
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::decodeURL): Added parameters matchNullCharacters,
-        and matchNonNullControlCharacters.
-        (WebCore::XSSAuditor::findInRequest): Added parameters matchNullCharacters,
-        and matchNonNullControlCharacters.
-        * page/XSSAuditor.h:
-
-2009-07-08  Marc-Antoine Ruel  <maruel@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Add DerivesSourcesAllInOne.cpp to help with release windows compilation.
-        https://bugs.webkit.org/show_bug.cgi?id=27093
-
-        This is specific for v8, no change in behavior.
-
-        * bindings/v8/DerivedSourcesAllInOne.cpp: Added.
-
-2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27086
-
-        Make sure the Media controller doesn't fade in for no reason.
-        This is happening because a update() call to the controller
-        panel may reset the opacity to 1.0, given that it reloads the
-        style.
-
-        We also add a different fade in and fade out time to soften
-        the fade out effect.
-
-        No test case because this depends on how the movie is loaded.
-
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::RenderMedia):
-        (WebCore::RenderMedia::updateControls):
-        (WebCore::RenderMedia::updateControlVisibility): Simplify
-        , and make sure we stop the timer if there is no animation
-        to do.
-        (WebCore::RenderMedia::opacityAnimationTimerFired): 
-        * rendering/RenderMedia.h:
-
-2009-07-08  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 27081: Wrap RunLoopTimerCF.cpp in PLATFORM(MAC) && HAVE(RUNLOOP_TIMER)
-
-        <https://bugs.webkit.org/show_bug.cgi?id=27081>
-
-        Reviewed by Timothy Hatcher.
-
-        * platform/cf/RunLoopTimerCF.cpp: This code is only used on
-        Mac OS X when HAVE(RUNLOOP_TIMER) is enabled, so wrap the code
-        in that macro as well.
-
-2009-07-08  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Add -[WebView _isProcessingUserGesture]
-        https://bugs.webkit.org/show_bug.cgi?id=27084
-
-        Rename FrameLoader::userGestureHint() to FrameLoader::isProcessingUserGesture()
-        for clarity.
-
-        * WebCore.base.exp: Add WebCore::FrameLoader::isProcessingUserGesture()
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::processingUserGesture):
-        * loader/FrameLoader.cpp: 
-        (WebCore::FrameLoader::requestFrame):
-        (WebCore::FrameLoader::isProcessingUserGesture):
-        * loader/FrameLoader.h:
-
-2009-07-08  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed (an earlier version) by Geoff Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27090
-        Remove lockBackForwardList argument from HTMLFormElement::submit()
-
-        No change in behavior, so no tests.
-
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        (WebCore::JSHTMLFormElement::submit):
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::submit):
-        * html/HTMLFormElement.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::submitForm):
-        (WebCore::FrameLoader::scheduleFormSubmission):
-        * loader/FrameLoader.h:
-        Don't pass lockBackForwardList around when it's known to be false.
-
-2009-07-08  Marc-Antoine Ruel  <maruel@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Fix V8 idl codegen to use unique constant names
-        <https://bugs.webkit.org/show_bug.cgi?id=27089>
-
-        Embed the interface name in the global constant names so coagulating all
-        the .cc files into one compile unit works with V8 bindings.
-
-        Nothing added; Still compiles and pass tests.
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-
-2009-07-08  Brent Fulgham  <bfulgham@webkit.org>
-
-        Build fix: Add missing #includes for Windows (cURL) build.
-        The <winsock2.h> and <windows.h> headers were not being
-        included in Windows cURL builds.
-
-        * platform/network/ResourceHandleInternal.h:
-        * platform/network/curl/ResourceHandleManager.h:
-
-2009-07-08  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by David Kilzer.
-
-        WebKit needs a style linting tool
-        https://bugs.webkit.org/show_bug.cgi?id=25884
-
-        Fix bunch of style issues in WebCore/rendering.
-        This patch is created to demonstrate cpplint.py.
-
-        No testcase because it's just a style fixes.
-
-        * rendering/AutoTableLayout.cpp:
-        (WebCore::AutoTableLayout::recalcColumn):
-        (WebCore::AutoTableLayout::layout):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeEllipsisBox):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paintTextMatchMarker):
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlTimelineElement::defaultEventHandler):
-        * rendering/MediaControlElements.h:
-        * rendering/RenderArena.cpp:
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::startDelayUpdateScrollInfo):
-        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
-        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
-        (WebCore::RenderBlock::positionNewFloats):
-        (WebCore::RenderBlock::newLine):
-        (WebCore::RenderBlock::floatBottom):
-        (WebCore::RenderBlock::leftBottom):
-        (WebCore::RenderBlock::rightBottom):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::calcReplacedWidthUsing):
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::layoutLegend):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::FlexBoxIterator::FlexBoxIterator):
-        (WebCore::FlexBoxIterator::reset):
-        (WebCore::FlexBoxIterator::first):
-        (WebCore::FlexBoxIterator::next):
-        (WebCore::RenderFlexibleBox::layoutVerticalBox):
-        * rendering/RenderFrameSet.cpp:
-        (WebCore::borderStartEdgeColor):
-        * rendering/RenderFrameSet.h:
-        * rendering/RenderImage.cpp:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateVisibilityStatus):
-        (WebCore::RenderLayer::calculateClipRects):
-        (WebCore::RenderLayer::calculateRects):
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::panScroll):
-        * rendering/RenderMarquee.cpp:
-        (WebCore::RenderMarquee::updateMarqueeStyle):
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::updateControls):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::drawLineForBoxSide):
-        (WebCore::RenderObject::localCaretRect):
-        * rendering/RenderSVGImage.cpp:
-        (WebCore::RenderSVGImage::adjustRectsForAspectRatio):
-        * rendering/RenderSlider.h:
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::outerBorderBottom):
-        * rendering/RenderTableCol.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::itemIsSeparator):
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::supportsHover):
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::supportsFocusRing):
-        * rendering/SVGCharacterLayoutInfo.cpp:
-        (WebCore::SVGCharacterLayoutInfo::addStackContent):
-        * rendering/SVGCharacterLayoutInfo.h:
-        * rendering/TextControlInnerElements.h:
-        * rendering/bidi.cpp:
-        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
-
-2009-07-07  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Reduce complexity of lifetime management in DynamicNodeList caches
-        <https://bugs.webkit.org/show_bug.cgi?id=27068>
-
-        Switch the Cache object used by DynamicNodeList into a normal
-        refcounted object rather than having a weird flag controlled
-        refcounting system, where positive refcount did not automatically
-        imply the cache object would actually still be live.
-
-        * dom/DynamicNodeList.cpp:
-        (WebCore::DynamicNodeList::DynamicNodeList):
-        (WebCore::DynamicNodeList::~DynamicNodeList):
-        (WebCore::DynamicNodeList::Caches::Caches):
-        (WebCore::DynamicNodeList::Caches::create):
-        * dom/DynamicNodeList.h:
-        * dom/Node.cpp:
-        (WebCore::Node::childNodes):
-        (WebCore::Node::getElementsByTagNameNS):
-        (WebCore::Node::getElementsByName):
-        (WebCore::Node::getElementsByClassName):
-        (WebCore::NodeListsNodeData::invalidateCaches):
-        (WebCore::NodeListsNodeData::isEmpty):
-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::NodeListsNodeData):
-
-2009-07-07  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-        
-        -webkit-perspective should be a Length
-        https://bugs.webkit.org/show_bug.cgi?id=27066
-        
-        -webkit-perspective should not take a magic valueless number, but should
-        be a normal Length value which responds to zooming. Treat valueless numbers
-        as pixels for backward compatibility.
-        
-        Test: transforms/3d/general/perspective-units.html
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-
-2009-07-07  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27047
-
-        We need to make sure that when we reattach, we also reattach
-        the children in every MediaControlElement. Else we may end up
-        having no remaining or elapsed time.
-
-        We have to handle that, because we are using a special shadow
-        tree in the DOM, and that we are ourselves handling
-        attaching/detaching the renderer.
-
-        The strategy here is to try to implement ::attach(), and try
-        to reuse as much code as we can from the super class, including
-        children attachement.
-
-        Test: media/controls-after-reload.html
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlElement::styleForElement): Code factoring.
-        (WebCore::MediaControlElement::rendererIsNeeded): Code factoring.
-        (WebCore::MediaControlElement::attach): Implement attach
-        and call super class so that children are also attached.
-        (WebCore::MediaControlElement::updateStyle): Use attach()
-        (WebCore::MediaControlInputElement::styleForElement): Code factoring.
-        (WebCore::MediaControlInputElement::rendererIsNeeded): Code factoring.
-        (WebCore::MediaControlInputElement::attach): See above.
-        (WebCore::MediaControlInputElement::updateStyle): Use attach()
-        * rendering/MediaControlElements.h:
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::updateControls): Directly run attach() on
-        the m_panel, which is a root node for our shadow tree.
-
-2009-07-07  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Repaint issue after layer drops out of composited mode.
-        <https://bugs.webkit.org/show_bug.cgi?id=27022>
-
-        RenderLayers cache repaint rects in the form of m_repaintRect and m_outlineBox,
-        and expect these to stay valid from one style change to the next. These rects
-        are relative to the repaint container, so if a layer stops being composited,
-        we need to recompute them.
-        
-        Test: compositing/repaint/layer-repaint-rects.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::computeRepaintRects):
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateBacking):
-
-2009-07-07  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt and Darin Adler.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=26963
-          <rdar://problem/7030998> Reproducible crash at
-          FontCache::getFontData() when a custom font is used in a pseudo-style
-
-        Test: fast/css/pseudo-cache-stale.html
-
-        * dom/Element.cpp:
-        (WebCore::Element::pseudoStyleCacheIsInvalid): Added. Given the old
-        style and the new style, goes over cached pseudo-styles in the old
-        style and re-resolves the same style types off the new style. If any of
-        the new pseudo-styles is different from the currently cached
-        corresponding style, returns true. Otherwise, returns false.
-        (WebCore::Element::recalcStyle): Validate the pseudo-style cache before
-        deciding to keep the existing style.
-        * dom/Element.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::uncachedFirstLineStyle): Added this version that
-        returns an uncached first-line style based off the given style.
-        (WebCore::RenderObject::getUncachedPseudoStyle): Added the 'ownStyle'
-        parameter.
-        * rendering/RenderObject.h:
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::getPseudoStyleCache): Added. Returns the cached
-        pseudo-styles in the passed-in vector.
-        * rendering/style/RenderStyle.h:
-
-2009-07-07  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=27042
-          <rdar://problem/7010981> Incomplete painting of newly created floats
-
-        Tests: fast/repaint/float-in-new-block-with-layout-delta.html
-               fast/repaint/float-new-in-block.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlockChildren): If the child has never been
-        laid out before, paint its overhanging floats in addition to itself.
-        * rendering/RenderBlock.h:
-        (WebCore::RenderBlock::FloatWithRect::FloatWithRect): Added and
-        initialized a boolean everHadLayout member.
-        * rendering/bidi.cpp:
-        (WebCore::RenderBlock::layoutInlineChildren): Paint floats that have
-        never been laid out before and did not move from (0, 0).
-
-2009-07-07  Brady Eidson  <beidson@apple.com>
-
-        Contributions from both Darin Adler and Brady Eidson.
-        Reviewed by Darin Adler.
-
-        <rdar://problem/7024039> REGRESSION (r42158): Back-forward navigation does not work correctly on nytimes.com
-
-        In r42158 we lost some exclusions to making back/forward items for subframe navigations when a main frame
-        navigation was still in progress.
-
-        This patch makes things even better than it used to be by:
-        - Locking back/forward history at the time the navigation is scheduled, not after the load has committed.
-        - Locking back/forward history if *any* ancestor frame is still loading instead of just the main frame.
-
-        Test: fast/loader/subframe-navigate-during-main-frame-load.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::submitForm): Move out the history locking logic into a standalone function so it can be
-          used from multiple sites.
-        (WebCore::mustLockBackForwardList): Returns true if any ancestor frame is still loading.
-        (WebCore::FrameLoader::scheduleLocationChange): Respect mustLockBackForwardList() in addition to the passed in
-          lockBackForwardList flag.
-        (WebCore::FrameLoader::scheduleFormSubmission): Ditto.
-
-2009-07-07  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Upstream DOMObjectsInclude.h from src.chromium.org.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27035
-
-        * bindings/v8/DOMObjectsInclude.h: Added.
-
-2009-07-07  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by David Levin.
-
-        Relanding r45559, which was rolled back at r45574.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26857
-
-        * bindings/scripts/CodeGeneratorV8.pm: Updated a function name in auto-generated bindings.
-        * bindings/v8/V8Binding.cpp: Moved from src.chromium.org.
-        * bindings/v8/V8Binding.h: Contents moved from src.chromium.org.
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::handleConsoleMessage):
-        (WebCore::V8Proxy::compileScript):
-        (WebCore::V8Proxy::sourceName):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::handleConsoleMessage):
-        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
-        (WebCore::NAMED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
-        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-07  Gregory Hughes  <gfhughesVO+webkit@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        AX: Some webpages do not send AXLoadComplete
-        https://bugs.webkit.org/show_bug.cgi?id=26995
-
-        When sending the AXLayoutComplete notification it is possible
-        that the AXObjectCache was cleared, resulting in no valid
-        object to send the notification to. This fix ensures that an
-        AX object is created and cached if one does not already exist.
-
-        Not able to add a test because notifications get sent after the layout test is completed.
-
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-
-2009-07-06  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27015
-
-        Make sure that the CSS properties letter-spacing, word-spacing,
-        line-height, text-transform, text-indent, text-shadow,
-        text-decoration and color do not affect the media element controls,
-        that display text.
-
-        Controls that display text are only present in when the theme
-        MediaControllerThemeQT is being used.
-
-        Test: media/controls-styling.html
-
-        * css/mediaControlsQT.css:
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlElement::updateStyle): Special case for
-        text-decoration. text-decoration can't be overriden from CSS, because
-        text-decoration is additive for historical reasons.
-
-2009-07-07  Albert Wong  <ajwong@chromium.org>
-
-        Not reviewed, Chromium build fix.
-
-        Add in missing header fix syntax issue that crept into last patch.
-        https://bugs.webkit.org/show_bug.cgi?id=27027
-
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
-
-2009-07-07  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Make use of geometry information to decide which layers become composited.
-
-        <rdar://problem/7011947>
-        <https://bugs.webkit.org/show_bug.cgi?id=27021>
-        
-        In addition to looking at painting order, also, optionally, take layer
-        overlap into account when deciding which RenderLayers need to be composited.
-
-        No testcase because DRT doesn't dump which layers are composited.
-        
-        * page/FrameView.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::updateCompositingLayers):
-        Removed the unused CompositingUpdate parameter, and just do an early return
-        when there is no view.
-        
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::rendererContentChanged):
-        (WebCore::RenderLayer::dirtyZOrderLists):
-        (WebCore::RenderLayer::dirtyNormalFlowList):
-        (WebCore::RenderLayer::styleChanged):
-        (WebCore::RenderLayer::mustOverlapCompositedLayers):
-        (WebCore::RenderLayer::setMustOverlapCompositedLayers):
-        Change "overlay" to "overlap" for consistency with the use of "overlap"
-        elsewhere.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-        compositingLayersNeedUpdate() renamed to compositingLayersNeedRebuild().
-        
-        (WebCore::RenderLayerBacking::startAnimation):
-        (WebCore::RenderLayerBacking::startTransition):
-        Tell the compositor that we started an accelerated animation or transition.
-        
-        * rendering/RenderLayerCompositor.h:
-        (WebCore::RenderLayerCompositor::compositingLayersNeedRebuild):
-        Renamed, since it's explicitly about changes in hierarchy now.
-        
-        (WebCore::RenderLayerCompositor::setCompositingConsultsOverlap):
-        (WebCore::RenderLayerCompositor::compositingConsultsOverlap):
-        New getter and setter for whether compositing should take overlap into account.
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
-        Add m_compositingConsultsOverlap, re-order some member variables.
-        
-        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
-        Whitespace cleanup and method rename.
-        
-        (WebCore::RenderLayerCompositor::setCompositingLayersNeedRebuild):
-        Method and variable renaming.
-        
-        (WebCore::RenderLayerCompositor::updateCompositingLayers):
-        Now we have to run through the layer hierarchy every time if looking
-        at overlap, because changes in layout can now alter compositing behavior.
-        We minimize work by tracking whether we actually need to change the layer
-        hierarchy via needLayerRebuild.
-        
-        (WebCore::RenderLayerCompositor::updateBacking):
-        3D transforms turn off overlap mode.
-        
-        (WebCore::RenderLayerCompositor::layerWasAdded):
-        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
-        Method rename.
-        
-        (WebCore::RenderLayerCompositor::addToOverlapMap):
-        (WebCore::RenderLayerCompositor::overlapsCompositedLayers):
-        Utility methods to add a layer to the overlapMap (computing the absolute
-        bounding box only if we haven't already done so), and testing the map
-        entries.
-        
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        If a layer would composite only because it comes after other compositing
-        layers in the painting order, then consult the overlap map to determine whether
-        it overlaps, and thus actually needs to composite.
-        
-        Add layers to the map when they must be composited.
-        
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        Only do re-parenting work if the updateHierarchy flag is set.
-        
-        (WebCore::RenderLayerCompositor::didStartAcceleratedAnimation):
-        When we start an accelerated transition or animation, we stop looking at
-        overlap because we can no longer guarantee correct front-to-back ordering while the
-        accelerated animation is running.
-
-        (WebCore::RenderLayerCompositor::needsToBeComposited):
-        Method renames.
-        
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::setMaximalOutlineSize):
-        Add comment indicating that this could be optimized.
-
-2009-07-14  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Speed up creation of V8 wrappers for DOM nodes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26882
-
-        This patch doesn't require new tests as it a set of refactorings
-        to speed up wrapper creation.  
-
-        * bindings/v8/V8Proxy.cpp:
-        * bindings/v8/V8Proxy.h:
-
-2009-07-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] textarea height property works only if other property are defined
-        https://bugs.webkit.org/show_bug.cgi?id=18984
-
-        Let WebCore handle textarea's metrics instead of readjusting it RenderthemeGtk.
-
-        Test: fast/forms/textarea-metrics.html
-
-        * platform/gtk/RenderThemeGtk.cpp:
-        * platform/gtk/RenderThemeGtk.h:
-
-2009-07-07  Ben Murdoch  <benm@google.com>
-
-        Reviewed by Antti Koivisto.
-
-        HTML5 Database becomes locked if a transaction is in progress when the page is refreshed.
-        https://bugs.webkit.org/show_bug.cgi?id=25711
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=25711 where web
-        storage databases could become locked until the browser is shut
-        down if the page is refreshed whilst a transaction is in progress.
-
-        Test: storage/database-lock-after-reload.html
-
-        * storage/Database.cpp:
-        (WebCore::Database::Database):
-        (WebCore::Database::close): add code to inform the database thread we've closed the database.
-        (WebCore::Database::performOpenAndVerify): add code to inform the database thread we've opened a database.
-        * storage/Database.h:
-        (WebCore::Database::opened): return true iff the underlying sqlite database has been opened but not closed.
-        * storage/DatabaseThread.cpp:
-        (WebCore::DatabaseThread::databaseThread): Before the database thread terminates, close any databases that ran transactions in this thread.
-        (WebCore::DatabaseThread::recordDatabaseOpen): Records a database that executed a transaction in this thread.
-        (WebCore::DatabaseThread::recordDatabaseClosed): Removes a database from the set of open databases.
-        * storage/DatabaseThread.h:
-        (WebCore::DatabaseThread::getThreadID): return the thread id for the database thread.
-
-2009-07-07  Jiahua Huang  <jhuangjiahua@gmail.com>
-
-        Reviewed by Jan Alonzo.
-
-        [Gtk] Paste of rich text from firefox results garbled markup
-        https://bugs.webkit.org/show_bug.cgi?id=26791
-
-        Fix problem with UTF-16 clipboard pasted.
-
-        * manual-tests/gtk/paste-richtext-from-firefox.html: Added.
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::Pasteboard::documentFragment):
-
-2009-07-07  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Change 'Continue debug' shortcut from F5 to F8 for consistency with Firebug.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23849
-
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-
-2009-07-06  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Update RenderThemeChromiumMac for wkDrawMediaUIPart and wkDrawMediaSlider API
-        change.
-
-        Fix compile RenderThemeChromiumMac.mm due to API changes from r45572
-        https://bugs.webkit.org/show_bug.cgi?id=27018
-
-        This is mainly an API change update to fix the chromium compile.  It
-        also has a small fix of a typo in RenderThemeMac.mm.
-
-        Compilation against the head of chromium trunk passed.  Since this is
-        a compile fix, that should be sufficient.
-
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::):
-        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
-        * rendering/RenderThemeMac.mm:
-        (WebCore::):
-
-2009-07-06  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 27002: Build fix when DASHBOARD_SUPPORT is disabled with -Wunused-parameter
-
-        <https://bugs.webkit.org/show_bug.cgi?id=27002>
-
-        Reviewed by Geoff Garen.
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::prepareGradientForDashboard):
-        Mark gradient as an unused parameter when DASHBOARD_SUPPORT is
-        disabled.
-
-2009-07-06  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 27001: Fix improper use of PassRefPtr<Node> to RefPtr<Node>
-
-        <https://bugs.webkit.org/show_bug.cgi?id=27001>
-
-        Reviewed by Geoff Garen.
-
-        PassRefPtr<> should only be used for arguments to functions that
-        take ownership of the object, or as return values from functions
-        that relinquish ownership of the object.
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::increaseSelectionListLevelOrdered): Changed
-        stack-allocated PassRefPtr<Node> to RefPtr<Node> and call
-        release() on returned object.
-        (WebCore::Editor::increaseSelectionListLevelUnordered): Ditto.
-
-2009-07-06  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7035474> Make new media controller UI default on SnowLeopard
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::mediaControllerTheme):
-            New media controller UI is enabled by default on SnowLeopard.
-
-2009-07-06  Nate Chapin  <japhet@chromium.org>
-
-        Unreviewed, build fix.
-
-        Roll out r45559 to fix Chromium canary.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26857
-
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSConsoleCustom.cpp:
+        * bindings/js/ScriptProfile.h: Added.
+        * bindings/js/ScriptProfiler.cpp: Added.
+        (WebCore::ScriptProfiler::start):
+        (WebCore::ScriptProfiler::stop):
+        * bindings/js/ScriptProfiler.h: Added.
         * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8Binding.cpp: Removed.
-        * bindings/v8/V8Binding.h:
-        (WebCore::toInt32):
-        (WebCore::toWebCoreString):
-        (WebCore::fromWebCoreString):
-        (WebCore::toWebCoreStringWithNullCheck):
-        (WebCore::isUndefinedOrNull):
-        (WebCore::v8Boolean):
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::handleConsoleMessage):
-        (WebCore::V8Proxy::compileScript):
-        (WebCore::V8Proxy::sourceName):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::handleConsoleMessage):
-        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
-        (WebCore::NAMED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
-        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-06  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/7008093> Media controller can’t be used to scrub when movie is 
-        narrow — track is too narrow
-
-        Do not show media controller time display elements when the a movie is too narrow.
-
-        * platform/mac/WebCoreSystemInterface.h:
-        * platform/mac/WebCoreSystemInterface.mm:
-            The 'state' parameter to wkDrawMediaUIPart is now an unsigned bitfield.
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlTimeDisplayElement::MediaControlTimeDisplayElement):
-            Give current time and time remaining controls a common base class.
-        (WebCore::MediaControlTimeDisplayElement::setVisible):
-            New method, hide and show the element.
-        * rendering/MediaControlElements.h:
-
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::RenderMedia):
-            Initialize m_previousVisible.
-        (WebCore::RenderMedia::layout):
-            Show/hide the time display elements as the movie width changes.
-        (WebCore::RenderMedia::createCurrentTimeDisplay):
-        (WebCore::RenderMedia::createTimeRemainingDisplay):
-            Base class is now MediaControlTimeDisplayElement, not MediaControlElement.
-        (WebCore::RenderMedia::shouldShowTimeDisplayControls):
-            New, decide if time display elements should be visible or not.
-        * rendering/RenderMedia.h:
-
-        * rendering/RenderThemeMac.mm:
+        * bindings/v8/ScriptProfile.h: Added.
+        (WebCore::ScriptProfile::create):
+        (WebCore::ScriptProfile::~ScriptProfile):
+        (WebCore::ScriptProfile::title):
+        (WebCore::ScriptProfile::uid):
+        (WebCore::ScriptProfile::ScriptProfile):
+        * bindings/v8/ScriptProfiler.cpp: Added.
+        (WebCore::ScriptProfiler::start):
+        (WebCore::ScriptProfiler::stop):
+        * bindings/v8/ScriptProfiler.h: Added.
+        * bindings/v8/custom/V8ConsoleCustom.cpp: Removed.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::endGroup):
+        (WebCore::InspectorController::show):
+        (WebCore::InspectorController::setDOMStorageItem):
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        (WebCore::InspectorController::createProfileHeader):
+        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::searchingForNodeInPage):
+        * page/Console.cpp:
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+        * page/Console.h:
         (WebCore::):
-        (WebCore::RenderThemeMac::paintMediaFullscreenButton):
-        (WebCore::RenderThemeMac::paintMediaMuteButton):
-        (WebCore::RenderThemeMac::paintMediaPlayButton):
-        (WebCore::RenderThemeMac::paintMediaSeekBackButton):
-        (WebCore::RenderThemeMac::paintMediaSeekForwardButton):
-        (WebCore::RenderThemeMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeMac::paintMediaSliderThumb):
-        (WebCore::RenderThemeMac::paintMediaRewindButton):
-        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton):
-        (WebCore::RenderThemeMac::paintMediaControlsBackground):
-        (WebCore::RenderThemeMac::paintMediaCurrentTime):
-        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
-            The 'state' parameter to wkDrawMediaUIPart is now an unsigned bitfield.
-
-2009-07-06  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 27000: Minor clean up to runtime_root.{cpp|h}
-
-        <https://bugs.webkit.org/show_bug.cgi?id=27000>
-
-        Reviewed by Geoff Garen.
-
-        * bridge/runtime_root.cpp: Added blank line between license and
-        the first #include statement.
-        * bridge/runtime_root.h: Added comment to #endif.
-
-2009-07-06  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        generalize the special height treatment for SVG (to be re-used for ruby):
-            renamed InlineBox::m_isSVG to m_hasVirtualHeight
-            renamed InlineBox::isSVG() to hasVirtualHeight()
-            renamed InlineBox::setIsSVG() to setHasVirtualHeight()
-
-        * rendering/InlineBox.cpp:
-        (WebCore::InlineBox::height):
-        * rendering/InlineBox.h:
-        (WebCore::InlineBox::InlineBox):
-        (WebCore::InlineBox::isText):
-        (WebCore::InlineBox::setIsText):
-        (WebCore::InlineBox::isSVGRootInlineBox):
-        (WebCore::InlineBox::hasVirtualHeight):
-        (WebCore::InlineBox::setHasVirtualHeight):
-        (WebCore::InlineBox::virtualHeight):
-        * rendering/RenderSVGInline.cpp:
-        (WebCore::RenderSVGInline::createFlowBox):
-        * rendering/RenderSVGInlineText.cpp:
-        (WebCore::RenderSVGInlineText::createTextBox):
-        * rendering/RenderSVGText.cpp:
-        (WebCore::RenderSVGText::createRootBox):
-        * rendering/SVGInlineFlowBox.h:
-        (WebCore::SVGInlineFlowBox::virtualHeight):
-        * rendering/SVGInlineTextBox.h:
-        (WebCore::SVGInlineTextBox::virtualHeight):
-        * rendering/SVGRootInlineBox.h:
-        (WebCore::SVGRootInlineBox::virtualHeight):
-
-2009-07-06  Alice Liu  <alice.liu@apple.com>
-
-        Reviewed by Darin Adler.
-
-        REGRESSION(r45285): focus rings are black on windows safari
-        https://bugs.webkit.org/show_bug.cgi?id=26821
-        <rdar://problem/7018252>
-
-        Add a mechanism for setting a custom focus ring color, and relocate the 
-        determination of focus ring color to base class RenderTheme.
-
-        No new tests.  Already-existing tests run in pixel mode would have caught this regression
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue): Move the responsibility
-        of determining focus color to base class RenderTheme.
-        * rendering/RenderTheme.cpp:
-        (WebCore::customFocusRingColor): Added static local.
-        (WebCore::RenderTheme::setCustomFocusRingColor): Added
-        (WebCore::RenderTheme::focusRingColor): Use custom color over platform color.
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::platformFocusRingColor): default implementation, black color
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderTheme::themeForPage): Circumstances that lead to returning the RenderThemeWin
-        are the same under which we want to use the focus ring color from SafariTheme.
-        (WebCore::RenderThemeSafari::platformFocusRingColor): Renamed from focusRingColor
-        * rendering/RenderThemeSafari.h:
-
-        Renaming focusRingColor to platformFocusRingColor in these files:
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::platformFocusRingColor):
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::platformFocusRingColor):
-        * rendering/RenderThemeChromiumSkia.h:
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::platformFocusRingColor):
-
-        Cleanup leftover from removal of WebCore::Color in r45285 in these files:
-        * WebCore.order:
-        * platform/graphics/Color.h:
-
-2009-07-06  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by David Hyatt.
-
-        Bug 15135: REGRESSION (r19843-r19850): Changing a flexbox's
-        contents makes its container scroll to the top
-        https://bugs.webkit.org/show_bug.cgi?id=15135
-
-        Delay updateing scroll bar of descendants of flexbox until their
-        positions are determined.  In this way we can prevent descendants
-        of flexible boxes from changing positions of their scrollbars
-        using tentative positions.
-
-        Test: fast/flexbox/repaint-scrollbar.html
+        (WebCore::Console::create):
+        (WebCore::Console::profiles):
+        * page/Console.idl:
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::startDelayUpdateScrollInfo):
-        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
-        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
-        (WebCore::RenderBlock::layoutBlock):
-        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
-        * rendering/RenderBlock.h:
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
-        (WebCore::RenderFlexibleBox::layoutVerticalBox):
-
-2009-07-06  Hironori Bono  <hbono@chromium.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Make unconfirmed IME text affect textarea's value.
-        This matches input and contentEditable elements as well
-        IE and Firefox.
-
-        This fixes https://bugs.webkit.org/show_bug.cgi?id=25061.
-
-        Input elements would go down this code path because it
-        would always get a null compositionNode from frame->editor().
-        Special casing compositionNodes is wrong because we explicitly
-        want unconfirmed IME input in the textarea's value (assuming we
-        want to match IE and Firefox here).
-
-        This change is originally created by Ojan Vafai <ojan@chromium.org> and
-        I just changed its manual tests with an automated test on his behalf.
-
-        Test: platform/mac/editing/input/text-control-ime-input.html
-
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::text):
-        (WebCore::RenderTextControl::textWithHardLineBreaks):
-
-2009-07-06  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Add the ability for wheel events to latch to a node.
-        
-        * WebCore.base.exp:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::EventHandler):
-        (WebCore::EventHandler::clear):
-        (WebCore::EventHandler::handleWheelEvent):
-        * page/EventHandler.h:
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::wheelEvent):
-        * platform/mac/WebCoreSystemInterface.h:
-        * platform/mac/WebCoreSystemInterface.mm:
-
-2009-07-06  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix a bunch of layout test crahses in Chromium caused by a bad usage of DEFINE_STATIC_LOCAL.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26997
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8ValueToWebCoreString): Use a regular static declaration instead of DEFINE_STATIC_LOCAL.
-
-2009-07-06  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: suggest global properties based on async evaluation.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26976
-
-        Before this change, empty string was evaluated to the global object
-        (or scope chain object) synchronously. This is now fixed and global
-        object is evaluated using the same control flow.
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype.completions):
-        (WebInspector.Console.prototype._evalInInspectedWindow):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype._variablesInScope):
-
-2009-07-06  Ojan Vafai  <ojan@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fix crash when indenting in an empty table cell.
-        https://bugs.webkit.org/show_bug.cgi?id=26872
-
-        The crash is that we would call splitTreeToNode where the node
-        and the nodeToSplitTo were the same node.
-
-        Test: editing/execCommand/indent-empty-table-cell.html
-
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::splitTreeToNode):
-        Added an assert in that node and nodeToSplitTo
-        are different nodes to make this assumption explicit.
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::isAtUnsplittableElement):
-        (WebCore::IndentOutdentCommand::indentRegion):
-        * editing/IndentOutdentCommand.h:
-
-2009-07-06  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by David Levin.
-
-        Upstream V8Binding and update some function names.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26857
-
-        * bindings/scripts/CodeGeneratorV8.pm: Update function names in auto-generated files.
-        * bindings/v8/V8Binding.cpp: Upstreamed from src.chromium.org.
-        * bindings/v8/V8Binding.h: Upstreamed from src.chromium.org.
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::handleConsoleMessage):
-        (WebCore::V8Proxy::compileScript):
-        (WebCore::V8Proxy::sourceName):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::handleConsoleMessage):
-        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
-        (WebCore::NAMED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
-        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-06  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Jan Alonzo.
-
-        Use soup's content sniffing
-        https://bugs.webkit.org/show_bug.cgi?id=26982
-
-        Drop our hackish content sniffing code, and use the new libsoup
-        feature to do that job for us.
-
-        Testing this is in a cross-platform way is not obvious or possible
-        while we are using platform-specific code for sniffing.
-
-        * platform/network/ResourceHandleInternal.h:
-        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::gotHeadersCallback):
-        (WebCore::contentSniffedCallback):
-        (WebCore::gotChunkCallback):
-        (WebCore::ResourceHandle::startHttp):
-
-2009-07-05  Antonio Gomes  <antonio.gomes@openbossa.org>
+2010-02-02  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Darin Adler.
 
-        REGRESSION (r40499): fast/dom/cssTarget-crash.html fails
-        https://bugs.webkit.org/show_bug.cgi?id=20342
-
-        Re-added code removed by commit r40499.
-        Without this, both Qt and Mac were crashing while running the test.
-
-        Note that this does not entirely fix the bug. It fixes the WebCore
-        crash, but the test no longer seems to work due to loader changes.
-        So this patch does not reenable the test. The test probably has to
-        be rewritten.
-
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::removedFromDocument): Re-added code to
-        set the CSS target of the document to 0.
-
-2009-07-05  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser.
+        Fix a bug that changes for some constraint attributes doesn't
+        update validation CSS selectors.
+        https://bugs.webkit.org/show_bug.cgi?id=31716
 
-        https://bugs.webkit.org/show_bug.cgi?id=26943
+        - Rename HTMLFormControlElement::updateValidity() to setNeedsValidityCheck()
+        - Introduce HTMLFormControlElement::setNeedsWillValidate()
+        - Introduce HTMLFormControlElement::m_hasName to make willValidate()
+          work in parseMappedAttribute().
+        - We need to call setNeedsValidityCheck() when HTMLInputElement::step or
+          HTMLTextAreaElement::maxLength is changed.
 
-        When one transition finishes slightly before another the longer
-        one will fire a second time. This is because the second
-        ImplicitAnmation object is culled too early, before its final
-        RenderStyle is in place. This is done by cleanupFinishedAnimations()
-        so I got rid of that method completely and now cleanup each
-        transition or animation at the point where I am setting the final
-        style, or when I detect that the transition or animation has been
-        terminated early (which happens when you remove it from the style).
-
-        Test: transitions/extra-transition.html
-
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateTransitions):
-        (WebCore::CompositeAnimation::updateKeyframeAnimations):
-        (WebCore::CompositeAnimation::animate):
-        * page/animation/CompositeAnimation.h:
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::getTimeToNextEvent):
-        Avoid a divide by zero if m_animation->duration() is zero, which can happen
-        if the duration is changed to zero while the animation is running.
-
-2009-07-05  Simon Fraser  <simon.fraser@apple.com>
-
-        Revert the previous commit because it broke the
-        animations/transition-and-animation-1.html
-        testcase.
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::getTimeToNextEvent):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateTransitions):
-        (WebCore::CompositeAnimation::updateKeyframeAnimations):
-        (WebCore::CompositeAnimation::animate):
-        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
-        * page/animation/CompositeAnimation.h:
-
-2009-07-05  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26943
-
-        When one transition finishes slightly before another the longer
-        one will fire a second time. This is because the second 
-        ImplicitAnmation object is culled too early, before its final
-        RenderStyle is in place. This is done by cleanupFinishedAnimations()
-        so I got rid of that method completely and now cleanup each 
-        transition or animation at the point where I am setting the final
-        style, or when I detect that the transition or animation has been
-        terminated early (which happens when you remove it from the style).
-
-        Test: transitions/extra-transition.html
-
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateTransitions):
-        (WebCore::CompositeAnimation::updateKeyframeAnimations):
-        (WebCore::CompositeAnimation::animate):
-        * page/animation/CompositeAnimation.h:
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::getTimeToNextEvent):
-        Avoid a divide by zero if m_animation->duration() is zero, which can happen
-        if the duration is changed to zero while the animation is running.
-
-2009-07-05  Lars Knoll  <lars.knoll@nokia.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26843
-
-        Fix run-time crashes in JavaScriptCore with the Metrowerks compiler on Symbian.
-
-        The Metrowerks compiler on the Symbian platform moves the globally
-        defined Hashtables into read-only memory, despite one of the members
-        being mutable. This causes crashes at run-time due to write access to
-        read-only memory.
-
-        Avoid the use of const with this compiler by introducing the
-        JSC_CONST_HASHTABLE macro.
-
-        Based on idea by Norbert Leser.
-
-        * bindings/scripts/CodeGeneratorJS.pm: Use JSC_CONST_HASHTABLE for hash tables
-        define in the bindings.
-
-2009-07-05  Rob Buis  <rwlbuis@gmail.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 26897 - Dynamic SVG images do not display correctly
-        https://bugs.webkit.org/show_bug.cgi?id=26897
-
-        Use repaint() to fix a rendering problem with a SVG image embedded in xhtml.
-
-        Test: svg/custom/createImageElement2.xhtml
-
-        * rendering/RenderSVGImage.cpp:
-        (WebCore::RenderSVGImage::imageChanged):
-
-2009-07-05  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26960
-        [Gtk] caret offset not updated when selecting text
-
-        Report the caret offset from the end of the selection so it works
-        correctly for multi-char selections too (ie, anything that is not
-        the zero width caret).
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_text_get_caret_offset):
-
-2009-07-05  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Unreviewed link fix for Qt.
-
-        Fix Qt link error by adding two new localized strings
-
-        In r45474 two new strings got added to LocalizedStrings.h add
-        the definition of them to Qt.
-
-        * platform/qt/Localizations.cpp:
-        (WebCore::mediaElementLoadingStateText):
-        (WebCore::mediaElementLiveBroadcastStateText):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        (WebCore::HTMLFormControlElement::insertedIntoTree):
+        (WebCore::HTMLFormControlElement::removedFromTree):
+        (WebCore::HTMLFormControlElement::formDestroyed):
+        (WebCore::HTMLFormControlElement::willValidate): Avoids function calls.
+        (WebCore::HTMLFormControlElement::setNeedsWillValidateCheck):
+        (WebCore::HTMLFormControlElement::setNeedsValidityCheck):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::disabled): Move the code from .cpp.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        (WebCore::HTMLTextAreaElement::setValue):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
 
-2009-07-03  Darin Adler  <darin@apple.com>
+2010-02-02  Roland Steiner  <rolandsteiner@chromium.org>
 
         Reviewed by Adele Peterson.
 
-        REGRESSION (r44670-r44680): Typing is suprisingly slow in password field on reddit.com
-        https://bugs.webkit.org/show_bug.cgi?id=26959
-        rdar://problem/7029882
-
-        The code to handle iteration boundaries was malfunctioning when the boundary was
-        at the edge of a shadow tree. This happens all the time with <input> elements.
-
-        It's not immediately obvious how to make a regression test for this since the
-        symptom was a performance problem, not incorrect behavior. I'll add a test if I
-        figure out a way to make one.
-
-        * editing/TextIterator.cpp:
-        (WebCore::parentCrossingShadowBoundaries): Renamed from parentOrShadowParent.
-        (WebCore::depthCrossingShadowBoundaries): Updated for name change.
-        (WebCore::nextInPreOrderCrossingShadowBoundaries): Added.
-        (WebCore::previousInPostOrderCrossingShadowBoundaries): Added.
-        (WebCore::setUpFullyClippedStack): Updated for name change.
-        (WebCore::TextIterator::TextIterator): Updated for name change. Use
-        nextInPreOrderCrossingShadowBoundaries instead of Range::pastLastNode to fix the bug.
-        (WebCore::TextIterator::advance): Updated for name change.
-        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
-        Tweaked formatting.
-        (WebCore::SimplifiedBackwardsTextIterator::advance): Ditto. Changed code that
-        initializes m_pastStartNode to use previousInPostOrderCrossingShadowBoundaries.
-        (WebCore::SimplifiedBackwardsTextIterator::handleNonTextNode): Tweaked formatting.
-        (WebCore::SimplifiedBackwardsTextIterator::exitNode): Ditto.
-
-2009-07-03  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Background audio stops playing when JS GC runs
-        https://bugs.webkit.org/show_bug.cgi?id=26956
-        
-        Ensure we keep the Audio object around while it is playing, so that it
-        doesn't get collected.
-        
-        Not testable because there's no way to know whether the audio keeps
-        playing without holding a reference to it.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::isObservableThroughDOM):
-
-2009-07-02  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26814
-        [Gtk] Caret-moved events are not issued for the correct offset
-        when text is selected forward
-
-        Report the caret offset from the end of the selection, otherwise
-        we'll report the same offset when moving the caret while
-        modififying the selection (eg, with Shift Right).
-
-        * editing/gtk/SelectionControllerGtk.cpp:
-        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
-
-2009-07-02  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26815
-        [Gtk] text-selection-changed events are not issued for the correct
-        object when the selection spans multiple objects
-
-        Get the focused node from the end of the selection, not the start,
-        so we can detect when we cross object boundaries.
-
-        * editing/gtk/SelectionControllerGtk.cpp:
-        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
-
-2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26947
-
-        Fix the media controls hit tests. They may lose click events.
-
-        Test cases already covered in the video-controls-zoomed tests.
-
-        Don't trust wkHitTestMediaUIPart for the tests. We are accurate enough.
-
-        * rendering/RenderThemeMac.h: Remove hitTestMediaControlPart.
-        * rendering/RenderThemeMac.mm: Remove hitTestMediaControlPart.
-
-2009-07-02  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Eric Seidel.
-
-        RenderBlock and RenderInline have confusingly named object creation methods:
-        RenderBlock::createRootBox/createRootInlineBox
-        RenderInline::createFlowBox/createInlineFlowBox
-        where the 2nd method in both cases just calls the first and then appends the created object.
-        I therefore renamed those methods to something IMHO more informative:
+        Bug 34198 -  Ruby text should not inherit line-height
+        (https://bugs.webkit.org/show_bug.cgi?id=34198)
         
-        createRootBox()         -> createRootInlineBox()
-        createRootInlineBox()   -> createAndAppendRootInlineBox();
-        createFlowBox()         -> createInlineFlowBox();
-        createInlineFlowBox()   -> createAndAppendInlineFlowBox();
-
-        https://bugs.webkit.org/show_bug.cgi?id=26828
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::createRootInlineBox):
-        (WebCore::RenderBlock::createAndAppendRootInlineBox):
-        * rendering/RenderBlock.h:
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::createInlineFlowBox):
-        (WebCore::RenderInline::createAndAppendInlineFlowBox):
-        * rendering/RenderInline.h:
-        * rendering/RenderSVGInline.cpp:
-        (WebCore::RenderSVGInline::createInlineFlowBox):
-        * rendering/RenderSVGInline.h:
-        * rendering/RenderSVGText.cpp:
-        (WebCore::RenderSVGText::createRootInlineBox):
-        * rendering/RenderSVGText.h:
-        * rendering/bidi.cpp:
-        (WebCore::createInlineBoxForRenderer):
-
-2009-07-02  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Fix typo in the resource panel enabler caption.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26753
-
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-
-2009-07-02  Erik Arvidsson  <arv@chromium.org>
-
-        Reviewed by Adam Roben.
-
-        [Win] HTML5 Drag and drop, dragend is not fired when pressing Esc
-        https://bugs.webkit.org/show_bug.cgi?id=26699
-
-        * manual-tests/drag-escape.html: Added.
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::dragSourceEndedAt):
-
-2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser. 
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26944
-
-        Make sure we support full page zoom in video controls.
-
-        This is tracked by a the video-controls-zoom test case.
-
-        * css/mediaControlsQT.css: Make sure we don't have any inherited margin.
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlElement::updateStyle): Propagate the style to the innertext.
-        * rendering/RenderThemeMac.mm: Adjust the painting rect.
-        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
-        (WebCore::RenderThemeMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeMac::paintMediaCurrentTime):
-        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
-
-2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Fix the Gtk build after r45474. The localized strings should
-        have been added there.
-
-        * platform/gtk/LocalizedStringsGtk.cpp:
-        (WebCore::mediaElementLoadingStateText):
-        (WebCore::mediaElementLiveBroadcastStateText):
-
-2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26939
-
-        Media controller is rendered badly at http://www.mozilla.com/en-US/firefox/video/firefox-3.5.html
-
-        We fix two things:
-        - We use px instead of em, because px is used everywhere else
-        and because 0.09em hit the font size limit.
-        - We use -webkit-box instead of inline-block because in strict mode
-        inline-block has a different behavior.
-
-        Test: media/controls-strict.html
-
-        * css/mediaControlsQT.css:
-
-2009-07-02  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        TextIterator should use hasOverflowClip when checking for overflow instead of looking at the style.
-        https://bugs.webkit.org/show_bug.cgi?id=26942
-
-        * editing/TextIterator.cpp:
-        (WebCore::fullyClipsContents):
-
-2009-07-02  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dave Hyatt.
-
-        Fix for <rdar://problem/5230700>
-        Remove local .xhtml file workaround
-
-        * platform/network/mac/ResourceResponseMac.mm:
-        (WebCore::ResourceResponse::platformLazyInit): Work around is no longer necessary.
-
-2009-07-02  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Sort, add functions used by WebKit.
-        
-        * WebCore.base.exp:
-
-2009-07-02  Brady Eidson  <beidson@apple.com>
-
-        Rubberstamped by Sam Weinig.
-
-        More of <rdar://problem/6969425> Safari 4.0 doesn't recognize text/plain files if their extension is unknown.
-
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (webNSURLResponseMIMEType): Give Tiger a chance to query the UTI machinery.
-
-2009-07-02  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Chromium Linux: fix complex text rendering with line break characters.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26935
-
-        If the CSS white-space property is inhibiting line breaking, we might
-        find end-of-line characters rendered via the complex text path. Fonts
-        don't provide glyphs for these code points so, if we find one, we
-        simulate the space glyph being interposed in this case.  Because the
-        input is variable-length per code point, we walk the input in step
-        with the output.
-
-        Covered by:
-            LayoutTests/fast/text/international/bidi-linebreak-002.html
-            LayoutTests/fast/text/international/bidi-linebreak-003.html
-            LayoutTests/fast/text/international/hindi-whitespace.html
-
-        * platform/graphics/chromium/HarfbuzzSkia.cpp:
-        (WebCore::stringToGlyphs):
-
-2009-07-02  Victor Wang  <victorw@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26521
-        Expose file size to chromium.
-
-        Implement getFileSize() for Chromium.
-
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/FileSystemChromium.cpp:
-        (WebCore::getFileSize):
-
-2009-07-02  Nate Chapin  <japhet@chromium.org>
-
-        Unreviewed, build fix.
-
-        * bindings/v8/V8SVGPODTypeWrapper.h: Lost a space in nested template argument list.
-
-2009-07-02  Simon Fraser  <simon.fraser@apple.com>
-
-        Build fix: add missing #include.
-
-        * platform/mac/ThemeMac.mm:
-
-2009-07-02  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        <rdar://problem/7028682> ThemeMac::paintRadio() throws Obj-C exceptions when zoomed
-
-        Add BEGIN_BLOCK_OBJC_EXCEPTIONS/END_BLOCK_OBJC_EXCEPTIONS guards around code
-        that can possibly throw Objective-C exceptions when drawing Mac form controls.
-
-        * platform/mac/ThemeMac.mm:
-        (WebCore::paintCheckbox):
-        (WebCore::paintRadio):
-        (WebCore::paintButton):
-        (WebCore::ThemeMac::inflateControlPaintRect):
-
-2009-07-02  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by David Levin.
-
-        Upstream V8SVGPODTypeWrapper.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26907
-
-        * bindings/scripts/CodeGeneratorV8.pm: Update function being renamed in V8SVGPODTypeWrapper.h.
-        * bindings/v8/V8SVGPODTypeWrapper.h: Upstreamed from src.chromium.org.
-
-2009-07-02  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Adds an abstraction layer between the DB classes and the file
-        system, which allows us to add our own logic for storing, opening,
-        deleting, etc. databases.
+        Resetting line-height to 'normal' in the default UA style sheet.
+        Adding layout-test to check for this.
 
-        The patch was tested using the tests in WebCore/storage.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26054
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/sql/SQLiteDatabase.cpp:
-        (WebCore::SQLiteDatabase::open): Delegating the job of opening DB files to SQLiteFileSystem to allow use of custom VFSs.
-        * platform/sql/SQLiteFileSystem.cpp: Added.
-        * platform/sql/SQLiteFileSystem.h: Added.
-        * platform/win/FileSystemWin.cpp:
-        (WebCore::directoryName): Implemented.
-        * storage/Database.cpp:
-        (WebCore::Database::databaseSize): The code that returns the size of a DB file moved to SQLiteFileSystem.
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::DatabaseTracker): Added the ability to register a custom SQLite VFS.
-        (WebCore::DatabaseTracker::trackerDatabasePath): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::openTrackerDatabase): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::originPath): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::fullPathForDatabase): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::usageForDatabase): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::deleteOrigin): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::deleteDatabaseFile): DB file-related operations moved to SQLiteFileSystem.
-        * storage/OriginUsageRecord.cpp:
-        (WebCore::OriginUsageRecord::diskUsage): DB file-related operations moved to SQLiteFileSystem.
-
-2009-07-02  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Always clip replaced elements to border radii.
-        https://bugs.webkit.org/show_bug.cgi?id=26933
-
-        Make sure to always clip replaced elements to border radii, even when overflow is visible.
-        Stop defaulting those elements to overflow:hidden in the UA sheet, since it is now no longer
-        necessary.
-
-        Covered by existing tests (since the UA default changing keeps the behavior exactly the same).
+        Test: fast/ruby/ruby-line-height.html
 
         * css/html.css:
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::paint):
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::paint):
-
-2009-07-02  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Simon Fraser.
-
-        convertFromScrollbarToContainingView and friends should be in ScrollView
-        https://bugs.webkit.org/show_bug.cgi?id=26929
-
-        This is breaking Chromium's build because PopupMenuChromium inherits
-        from ScrollView, but these functions are pure virtual in it.  I could
-        put it directly in PopupMenuChromium, but that seems a bit silly since
-        the functions are fairly generic.
-
-        Passes existing layout tests.
-
-        * page/FrameView.cpp:  Remove the 4 functions Hyatt just added
-        (IntRect WebCore::FrameView::convertFromScrollbarToContainingView):
-        (IntRect WebCore::FrameView::convertFromContainingViewToScrollBar):
-        (IntPoint WebCore::FrameView::convertFromScrollbarToContainingView):
-        (IntPoint WebCore::FrameView::convertFromContainingViewToScrollBar):
-        * page/FrameView.h: ditto
-        * platform/ScrollView.cpp:  Move the 4 functions from FrameView here
-        (IntRect WebCore::ScrollView::convertFromScrollbarToContainingView):
-        (IntRect WebCore::ScrollView::convertFromContainingViewToScrollBar):
-        (IntPoint WebCore::ScrollView::convertFromScrollbarToContainingView):
-        (IntPoint WebCore::ScrollView::convertFromContainingViewToScrollBar):
-        * platform/ScrollView.h: ditto
 
-2009-07-02  Dirk Pranke  <dpranke@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=26088 - TransparencyWin 
-        doesn't handle errors well at all; revise it to fail silently 
-        (drawing nothing), and bulletproof FontChromiumWin to handle the
-        failure accordingly.
-
-        Tests: fast/text/text-large-negative-letter-spacing-with-opacity.html
-               fast/text/text-letter-spacing.html
-
-        * platform/graphics/chromium/FontChromiumWin.cpp:
-        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
-        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
-        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::TransparencyAwareGlyphPainter):
-        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::~TransparencyAwareGlyphPainter):
-        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::drawGlyphs):
-        (WebCore::Font::drawGlyphs):
-        (WebCore::Font::drawComplexText):
-        * platform/graphics/chromium/TransparencyWin.cpp:
-        (WebCore::TransparencyWin::TransparencyWin):
-        (WebCore::TransparencyWin::setupLayerForNoLayer):
-        (WebCore::TransparencyWin::setupLayerForOpaqueCompositeLayer):
-        (WebCore::TransparencyWin::setupLayerForWhiteLayer):
-        (WebCore::TransparencyWin::setupTransformForKeepTransform):
-        (WebCore::TransparencyWin::setupTransformForScaleTransform):
-        (WebCore::TransparencyWin::initializeNewContext):
-        (WebCore::TransparencyWin::compositeOpaqueComposite):
-        (WebCore::TransparencyWin::compositeTextComposite):
-        (WebCore::TransparencyWin::makeLayerOpaque):
-        * platform/graphics/chromium/TransparencyWin.h:
-        (WebCore::TransparencyWin::platformContext):
+2010-02-02  James Robinson  <jamesr@chromium.org>
 
-2009-07-02  Eric Carlson  <eric.carlson@apple.com>
-
-        Change #import to #include to fix non-ObjC builds.
-
-        * rendering/MediaControlElements.cpp:
-
-2009-07-02  Anders Carlsson  <andersca@apple.com>
-
-        Build fix.
-        
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (mimeTypeFromUTITree):
-
-2009-07-02  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Fix for bug 22119, clicks in the scrollbars of transformed content don't work.  Add new
-        conversion methods for going across parent/child widget boundaries that can be implemented
-        by the FrameView and ScrollbarClient to be transform-aware.
-
-        Test cases added in platform/mac/fast/forms and platform/mac/fast/overflow.
-
-        * WebCore.base.exp:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::convertFromScrollbarToContainingView):
-        (WebCore::FrameView::convertFromContainingViewToScrollbar):
-        (WebCore::FrameView::convertFromRenderer):
-        (WebCore::FrameView::convertToRenderer):
-        (WebCore::FrameView::convertToContainingView):
-        (WebCore::FrameView::convertFromContainingView):
-        * page/FrameView.h:
-        * platform/ScrollView.h:
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::convertToContainingView):
-        (WebCore::Scrollbar::convertFromContainingView):
-        * platform/Scrollbar.h:
-        * platform/ScrollbarClient.h:
-        (WebCore::ScrollbarClient::convertFromScrollbarToContainingView):
-        (WebCore::ScrollbarClient::convertFromContainingViewToScrollbar):
-        * platform/Widget.cpp:
-        (WebCore::Widget::convertFromContainingWindow):
-        (WebCore::Widget::convertToContainingWindow):
-        (WebCore::Widget::convertFromRootToContainingWindow):
-        (WebCore::Widget::convertFromContainingWindowToRoot):
-        (WebCore::Widget::convertToContainingView):
-        (WebCore::Widget::convertFromContainingView):
-        * platform/Widget.h:
-        * platform/graphics/IntPoint.h:
-        (WebCore::IntPoint::move):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::convertFromRootToContainingWindow):
-        (WebCore::Widget::convertFromContainingWindowToRoot):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::isPointInOverflowControl):
-        * rendering/RenderDataGrid.cpp:
-        (WebCore::RenderDataGrid::convertFromScrollbarToContainingView):
-        (WebCore::RenderDataGrid::convertFromContainingViewToScrollbar):
-        * rendering/RenderDataGrid.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::convertFromScrollbarToContainingView):
-        (WebCore::RenderLayer::convertFromContainingViewToScrollbar):
-        (WebCore::RenderLayer::scrollbarOffset):
-        (WebCore::RenderLayer::hitTestOverflowControls):
-        * rendering/RenderLayer.h:
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::isPointInOverflowControl):
-        (WebCore::RenderListBox::convertFromScrollbarToContainingView):
-        (WebCore::RenderListBox::convertFromContainingViewToScrollbar):
-        * rendering/RenderListBox.h:
-
-2009-07-02  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt and Simon Fraser.
+        Reviewed by Dmitry Titov.
 
-        - fix <rdar://problem/6933052> SPOD playing video in a div with a box
-          shadow
+        Add a null check for image, which might be NULL if tileSize is empty
+        https://bugs.webkit.org/show_bug.cgi?id=34510
 
-        Test: fast/box-shadow/transform-fringing.html
+        Test: fast/gradients/crash-on-1px-border.html
 
         * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintBoxShadow): Clip out the
-        box even if it has an opaque background, but in that case, inset the
-        clip path by 1 pixel, to avoid antialiasing artifacts.
-        Do not inset the clip rect by 1 pixel if the CTM is purely a
-        translation.
-        Move the shadow-casting path away in the non-rounded-rect case (it
-        was already being done in the rounded-rect case), to avoid a black
-        fringe when the CTM is not purely a translation.
-
-2009-07-02  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        <rdar://problem/6969425> Safari 4.0 doesn't recognize text/plain files if their extension is unknown.
-
-        Walk the CoreTypes UTI tree for extensions with unknown MIME types, using the first MIME type found.
-
-        For many types of text files (such as source code files) this ends up being text/plain.
-
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Tweak the logging output.
-
-        * platform/network/mac/WebCoreURLResponse.h:
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (mimeTypeFromUTITree): 
-        (webNSURLResponseMIMEType): Use mimeTypeFromUTITree() to find a UTI-based MIME type for this file's extension.
-        (-[NSURLResponse _webcore_reportedMIMEType]): Return the actual MIME type that CFNetwork gave us.
-
-2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/6518119>
-
-        Add a rewind button and hide the timeline for live broadcasts when
-        in MediaUI mode.
-
-        * css/CSSPrimitiveValueMappings.h: 
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Add the new pseudo element.
-
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): Ditto.
-        * css/CSSSelector.h: 
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): Ditto.
-
-        * css/CSSValueKeywords.in: Ditto.
-        * css/mediaControls.css: Ditto.
-        * css/mediaControlsQT.css: Ditto.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::rewind): New.
-        (WebCore::HTMLMediaElement::returnToRealTime): New.
-        (WebCore::HTMLMediaElement::isStreaming): New.
-        * html/HTMLMediaElement.h:
-
-        * page/mac/WebCoreViewFactory.h: Declare mediaElementLoadingStateText and mediaElementLiveBroadcastStateText.
-
-        * platform/LocalizedStrings.h: Add localized media state messages.
-
-        * platform/ThemeTypes.h: Add the new pseudo element.
-
-        * platform/mac/LocalizedStringsMac.mm: 
-        (WebCore::mediaElementLoadingStateText): Add localized media state.
-        (WebCore::mediaElementLiveBroadcastStateText): Ditto.
-
-        * platform/mac/WebCoreSystemInterface.h: Change BOOL param wkDrawMediaUIPart to an int to support
-           multiple states.
-        * platform/mac/WebCoreSystemInterface.mm: Ditto.
-
-        * rendering/MediaControlElements.cpp: 
-        (WebCore::MediaControlElement::MediaControlElement): Deal with new elements.
-        (WebCore::MediaControlElement::attachToParent): Ditto.
-        (WebCore::MediaControlElement::update): Ditto.
-        (WebCore::MediaControlElement::updateStyle): Ditto.
-        (WebCore::MediaControlTimelineContainerElement::MediaControlTimelineContainerElement): Ditto.
-        (WebCore::MediaControlTimelineContainerElement::rendererIsNeeded): Ditto.
-        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement): Ditto.
-        (WebCore::MediaControlStatusDisplayElement::update): Ditto.
-        (WebCore::MediaControlStatusDisplayElement::rendererIsNeeded): Ditto.
-        (WebCore::MediaControlInputElement::MediaControlInputElement): Ditto.
-        (WebCore::MediaControlInputElement::attachToParent): Ditto.
-        (WebCore::MediaControlInputElement::updateStyle): Ditto.
-        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement): Ditto.
-        (WebCore::MediaControlRewindButtonElement::defaultEventHandler): Ditto.
-        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement): Ditto.
-        (WebCore::MediaControlReturnToRealtimeButtonElement::defaultEventHandler): Ditto.
-        (WebCore::MediaControlReturnToRealtimeButtonElement::rendererIsNeeded): Ditto.
-        (WebCore::MediaControlTimelineElement::defaultEventHandler): Ditto.
-        (WebCore::MediaControlTimelineElement::update): Ditto.
-        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): Ditto.
-        * rendering/MediaControlElements.h: Ditto.
-
-        * rendering/RenderMedia.cpp: 
-        (WebCore::RenderMedia::styleDidChange): Deal with the new elements.
-        (WebCore::RenderMedia::createPanel): Ditto.
-        (WebCore::RenderMedia::createRewindButton): Ditto.
-        (WebCore::RenderMedia::createReturnToRealtimeButton): Ditto.
-        (WebCore::RenderMedia::createStatusDisplay): Ditto.
-        (WebCore::RenderMedia::createTimelineContainer): Ditto.
-        (WebCore::RenderMedia::createCurrentTimeDisplay): Ditto.
-        (WebCore::RenderMedia::createTimeRemainingDisplay): Ditto.
-        (WebCore::RenderMedia::updateControls): Ditto.
-        (WebCore::RenderMedia::forwardEvent): Ditto.
-        * rendering/RenderMedia.h:
-
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::paint): Deal with the new elements.
-
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::paintMediaRewindButton): Deal with the new elements.
-        (WebCore::RenderTheme::paintMediaReturnToRealtimeButton): Ditto.
-        (WebCore::RenderTheme::paintMediaControlsBackground): Ditto.
-
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMediaRewindButton): Deal with the new elements.
-        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton): Ditto.
-        (WebCore::RenderThemeMac::paintMediaControlsBackground): Ditto.
-
-        * rendering/style/RenderStyleConstants.h: Add constants for the new elements.
-
-2009-07-01  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Small refactoring of MessagePortChannel so that PlatformMessagePortChannel
-        may be defined at the WebKit layer.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26905
-
-        * dom/MessageChannel.cpp:
-        (WebCore::MessageChannel::MessageChannel):
-        * dom/MessagePortChannel.cpp:
-        * dom/MessagePortChannel.h:
-        * dom/default/PlatformMessagePortChannel.cpp:
-        (WebCore::MessagePortChannel::createChannel):
-        (WebCore::MessagePortChannel::create):
-        (WebCore::MessagePortChannel::MessagePortChannel):
-        (WebCore::MessagePortChannel::~MessagePortChannel):
-
-2009-07-01  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        <video> fails to show on http://camendesign.com/code/video_for_everybody
-        <rdar://problem/7026010>
-        https://bugs.webkit.org/show_bug.cgi?id=26919
-
-        Fix an issue introduced in r44961. In that revision we changed to only update
-        compositing layer geometry when all siblings had been laid out (i.e. we pushed
-        the updates one level down). However, that left out the root layer, so this
-        fix ensures that the root layer geometry gets updated at the end.
-
-        Test: compositing/geometry/root-layer-update.html
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-
-2009-07-01  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein
-        
-        <rdar://problem/7026010> <video> fails to show on http://camendesign.com/code/video_for_everybody
-
-        First part of fix: when outline width changes, don't to a synchronous
-        layer update right away, but just set the flag to say that compositing
-        layers need updating. The synchronous layer update left the layer geometries
-        out of whack when it happened in the middle of layout (e.g. when inside ::first-letter).
-        
-        Test: compositing/geometry/outline-change.html
-
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::setMaximalOutlineSize):
-
-2009-07-01  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26842
-        Build fix when ENABLE_DATABASE is off
-
-        Move Database.h into ENABLE(DATABASE) guard so toggling ENABLE_DATABASE
-        off does not break builds.
-
-        * bindings/js/ScriptObjectQuarantine.cpp:
-
-2009-07-01  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26899
-        
-        Modified XSSAuditor::decodeURL to only remove null characters so that 
-        it is consistent with the behavior of HTMLTokenizer and prevents 
-        injected scripts that contain control characters. 
-
-        Tests: http/tests/security/xssAuditor/script-tag-control-char.html
-               http/tests/security/xssAuditor/script-tag-null-char.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::decodeURL): Modified to only remove null characters. 
-        * page/XSSAuditor.h: Reverted naming of third argument of method XSSAuditor::decodeURL
-        from allowControlCharacters back to allowNullCharacters.
-        * platform/network/ResourceResponseBase.cpp: Reverted back to rev #45003.
-        (WebCore::isControlCharacter):
-        * platform/network/ResourceResponseBase.h: Reverted back to rev #45003.  
-
-2009-07-01  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        - supported keyboard shortcuts compatible with Firebug in Scripts Debugger:
-        F5, Ctrl+/ (win,lin), Command+/ (mac) - continue
-        F10, Ctrl+' (win, lin), Command+' (mac) - step over
-        F11, Ctrl+; (win, lin), Command+; (mac) - step into
-        Shift+F11, Ctrl+Shift+; (win, lin), Command+Shift+; (mac) - step out
-
-        - added call stack navigation shortcuts:
-        Ctrl+. - next call frame
-        Ctrl+, - previouse call frame
-
-        https://bugs.webkit.org/show_bug.cgi?id=23849
-
-        * inspector/front-end/CallStackSidebarPane.js:
-        (WebInspector.CallStackSidebarPane):
-        (WebInspector.CallStackSidebarPane.prototype.handleKeyEvent):
-        (WebInspector.CallStackSidebarPane.prototype._selectNextCallFrameOnStack):
-        (WebInspector.CallStackSidebarPane.prototype._selectPreviousCallFrameOnStack):
-        (WebInspector.CallStackSidebarPane.prototype._selectedPlacardByIndex):
-        (WebInspector.CallStackSidebarPane.prototype._selectedCallFrameIndex):
-        * inspector/front-end/KeyboardShortcut.js: Added.
-        (WebInspector.KeyboardShortcut):
-        (WebInspector.KeyboardShortcut.makeKey):
-        (WebInspector.KeyboardShortcut.makeKeyFromEvent):
-        (WebInspector.KeyboardShortcut.makeKeyFromCodeAndModifiers_):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        (WebInspector.ScriptsPanel.prototype.handleKeyEvent):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-
-2009-07-01  Daniel Erat  <derat@google.com>
-
-        Reviewed by David Levin.
-
-        Chromium Linux: Move the scrollbar thumb on middle-click.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26910
-        http://code.google.com/p/chromium/issues/detail?id=11976
-
-        Tested by building Chrome and checking that the scrollbar moves as expected.
-
-        * platform/chromium/ScrollbarThemeChromium.cpp:
-        * platform/chromium/ScrollbarThemeChromium.h:
-        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
-        * platform/chromium/ScrollbarThemeChromiumLinux.h:
-        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
-        * platform/chromium/ScrollbarThemeChromiumWin.h:
-
-2009-07-01  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Add a preference/setting to toggle whether content sniffing is enabled for file URLs.
-
-        * WebCore.base.exp:
-
-        * page/Settings.cpp:
-        (WebCore::Settings::setLocalFileContentSniffingEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::localFileContentSniffingEnabled):
-
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start):
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
-
-2009-07-01  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 26909: aria-label needs to be supported
-        https://bugs.webkit.org/show_bug.cgi?id=26909
-
-        Test: accessibility/aria-label.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityDescription):
-        * html/HTMLAttributeNames.in:
-
-2009-07-01  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        More datagrid columns work.  Make sure columns cache both a style for the column header as well
-        as a style for the column background (behind the cells).
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
 
-        Hook up to CSSStyleSelector methods for obtaining the pseudo styles for columns (stubbed out and
-        unimplemented).
+2010-02-02  Kent Tamura  <tkent@chromium.org>
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::pseudoStyleForDataGridColumn):
-        (WebCore::CSSStyleSelector::pseudoStyleForDataGridColumnHeader):
-        * css/CSSStyleSelector.h:
-        * html/DataGridColumn.h:
-        (WebCore::DataGridColumn::setColumnList):
-        (WebCore::DataGridColumn::columnStyle):
-        (WebCore::DataGridColumn::setColumnStyle):
-        (WebCore::DataGridColumn::headerStyle):
-        (WebCore::DataGridColumn::setHeaderStyle):
-        * rendering/RenderDataGrid.cpp:
-        (WebCore::RenderDataGrid::recalcStyleForColumn):
-        (WebCore::RenderDataGrid::columnStyle):
-        (WebCore::RenderDataGrid::headerStyle):
-        (WebCore::RenderDataGrid::paintColumnHeaders):
-        * rendering/RenderDataGrid.h:
-
-2009-07-01  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Oliver Hunt.
-        
-        <rdar://problem/7009870> After <audio> movie finishes playing, Pause button fails to change 
-        back to Play button
-
-        Grab onto the current time when QTKit "ended" notification fires and use it as 
-        duration from that point on as QuickTime sometimes refuses to play all the way to
-        the time it reports for duration and buffered. HTMLMediaElement assumes that there
-        more to play in this situation and tries to restart playback, endlessly.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-            Rename m_duration to m_reportedDuration. Declare m_cachedDuration.
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-            Rename m_duration to m_reportedDuration. Initialize m_cachedDuration.
-        (WebCore::MediaPlayerPrivate::duration):
-            Return m_cachedDuration once it has been set.
-        (WebCore::MediaPlayerPrivate::updateStates):
-            Rename m_duration to m_reportedDuration.
-        (WebCore::MediaPlayerPrivate::didEnd):
-            Set m_cachedDuration to currentTime().
-
-2009-07-01  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        Bug 26900: AX: Manual spell check with Command-; does not bring up suggestions
-        https://bugs.webkit.org/show_bug.cgi?id=26900
-
-        Editable web areas should have a clickpoint that uses where the selection is.
-
-        Test: accessibility/editable-webarea-context-menu-point.html
-
-        * accessibility/AccessibilityObject.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::clickPoint):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-
-2009-07-01  David Levin  <levin@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Remove unused code in SVGTransformList and SVGTransformDistance
-        <https://bugs.webkit.org/show_bug.cgi?id=26891>
-
-        * svg/SVGTransformDistance.cpp:
-        (WebCore::SVGTransformDistance::SVGTransformDistance):
-        * svg/SVGTransformList.cpp:
-        * svg/SVGTransformList.h:
-
-2009-07-01  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Begin stubbing out functions for layout, painting and style/geometry caching on columns.  Not enough
-        is implemented for this to do much of anything yet, but it should help keep patch sizes down. :)
-
-        * html/DataGridColumn.cpp:
-        (WebCore::DataGridColumn::columnChanged):
-        * html/DataGridColumn.h:
-        (WebCore::DataGridColumn::setId):
-        (WebCore::DataGridColumn::setLabel):
-        (WebCore::DataGridColumn::setType):
-        (WebCore::DataGridColumn::setSortable):
-        (WebCore::DataGridColumn::setSortDirection):
-        (WebCore::DataGridColumn::setColumnList):
-        (WebCore::DataGridColumn::style):
-        (WebCore::DataGridColumn::setStyle):
-        (WebCore::DataGridColumn::rect):
-        (WebCore::DataGridColumn::setRect):
-        * html/DataGridColumnList.cpp:
-        (WebCore::DataGridColumnList::DataGridColumnList):
-        (WebCore::DataGridColumnList::setDataGridNeedsLayout):
-        (WebCore::DataGridColumnList::add):
-        (WebCore::DataGridColumnList::remove):
-        (WebCore::DataGridColumnList::move):
-        (WebCore::DataGridColumnList::clear):
-        (WebCore::DataGridColumnList::primaryColumnChanged):
-        * html/DataGridColumnList.h:
-        (WebCore::DataGridColumnList::create):
-        (WebCore::DataGridColumnList::dataGrid):
-        (WebCore::DataGridColumnList::clearDataGrid):
-        * html/HTMLDataGridColElement.cpp:
-        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
-        (WebCore::HTMLDataGridColElement::findDataGridAncestor):
-        (WebCore::HTMLDataGridColElement::insertedIntoTree):
-        (WebCore::HTMLDataGridColElement::removedFromTree):
-        * html/HTMLDataGridColElement.h:
-        (WebCore::HTMLDataGridColElement::dataGrid):
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
-        (WebCore::HTMLDataGridElement::~HTMLDataGridElement):
-        * rendering/RenderDataGrid.cpp:
-        (WebCore::RenderDataGrid::styleDidChange):
-        (WebCore::RenderDataGrid::recalcStyleForColumns):
-        (WebCore::RenderDataGrid::recalcStyleForColumn):
-        (WebCore::RenderDataGrid::styleForColumn):
-        (WebCore::RenderDataGrid::layout):
-        (WebCore::RenderDataGrid::layoutColumns):
-        (WebCore::RenderDataGrid::paintColumnHeaders):
-        (WebCore::RenderDataGrid::paintColumnHeader):
-        * rendering/RenderDataGrid.h:
-        (WebCore::RenderDataGrid::renderName):
-        (WebCore::RenderDataGrid::canHaveChildren):
-
-2009-07-01  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26807
-        
-        Fixes this address by checking whether frame->document()->decoder() is null. 
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::findInRequest):
-
-2009-07-01  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26885
-
-        Correctly reset history length to '0', not '1'. Old relict from early WML days.
-        Add some new WML testcases covering the use of history length (by onenterforward event handling)
-
-        Tests: wml/onenterforward-event.html
-               wml/onenterforward-inline-event.html
-               wml/ontimer-event.html
- 
-        * wml/WMLPageState.cpp:
-        (WebCore::WMLPageState::reset):
-
-2009-07-01  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Make sure setting attributes on dcol elements properly updates the corresponding DataGridColumn object.
-
-        Added new test in fast/dom/HTMLDataGridElement.
-
-        * html/HTMLDataGridColElement.cpp:
-        (WebCore::HTMLDataGridColElement::parseMappedAttribute):
-        * html/HTMLDataGridColElement.h:
-
-2009-07-01  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        <rdar://problem/6998524> REGRESSION (r44474): Form text field has focus ring, looks focused,
-        even though the field is not actually focused for keyboard input
-        
-        Add the concept of whether or not the Page is focused by adding a boolean to the focusController.  This allows the
-        focused frame and focused node to both be cached and changed programmatically even when the Page itself doesn't
-        actually happen to have focus at that time.
-
-        * WebCore.base.exp:
-        * page/FocusController.cpp:
-        (WebCore::FocusController::FocusController):
-        (WebCore::FocusController::setFocusedFrame):
-        (WebCore::FocusController::setFocused):
-        (WebCore::FocusController::setActive):
-        * page/FocusController.h:
-        (WebCore::FocusController::isFocused):
-
-2009-07-01  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Move some API headers from WebCore.pro to headers.pri so that they
-        get installed when running make install from the build directory.
-
-        * WebCore.pro:
-
-2009-07-01  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Rubber-stamped by Ariya Hidayat.
-
-        Ran WebKitTools/Scripts/generate-qt-inspector-resource to update the
-        qrc file with new png files from the web inspector.
-
-        * inspector/front-end/WebKit.qrc:
-
-2009-06-30  Mark Rowe  <mrowe@apple.com>
-
-        Land some code that has a hope of compiling.
-
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::imageSourceOptions):
-
-2009-06-30  Stephanie Lewis  <slewis@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Flip back on block caching. Throwing away block data, while 
-        a perceived memory win, is a performance hit in cases where we 
-        are repainting large images (i.e. backgrounds) frequently 
-        (i.e. a flash video playing on top).  
-        <rdar://problem/6933515> REGRESSION(L-SL): Large JPEG images are 
-        decoded on drawing, slowing down painting of sites that frequently 
-        repaint e.g. because of Flash (pandora.com, Starcraft 2)
-
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::imageSourceOptions):
-
-2009-06-30  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - Rename html4.css to html.css, since we target HTML5 now
-        https://bugs.webkit.org/show_bug.cgi?id=26873
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::loadFullDefaultStyle):
-        * css/html.css: Copied from css/html4.css.
-        * css/html4.css: Removed.
-        * css/themeWin.css:
-        * platform/Theme.h:
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
-        * rendering/RenderTheme.h:
-
-2009-06-30  Zan Dobersek  <zandobersek@gmail.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] Drag and drop support
-        https://bugs.webkit.org/show_bug.cgi?id=23642
-
-        Define DragImageRef as GdkPixbuf and implement essential
-        functions which manipulate drag images.
-
-        * platform/DragImage.h:
-        * platform/gtk/DragImageGtk.cpp:
-        (WebCore::dragImageSize):
-        (WebCore::deleteDragImage):
-        (WebCore::scaleDragImage):
-        (WebCore::createDragImageFromImage):
-
-2009-06-30  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        StorageNamespace.cpp build issue
-        https://bugs.webkit.org/show_bug.cgi?id=26859
-
-        Moved #endif //ENABLE(DOM_STORAGE) position
-        so that the build doesn't fail.
-        The namespace WebCore was started after the #if ENABLE(DOM_STORAGE)
-        but closed after the #endif.
-
-        * storage/StorageNamespace.cpp:
-
-2009-06-30  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/7020825> HTMLMediaElement should not assume seeking is only possible in 
-        buffered time ranges
-
-        * html/HTMLMediaElement.cpp:
-            Don't ASSERT if the network state goes to Idle when when the ready state is 
-            HaveEnoughData or higher, it is perfectly legal.
-        (WebCore::HTMLMediaElement::setReadyState): 
-            Don't clear m_seeking after posting a 'seeking' event.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::seek):
-            Do nothing when asked to seek to the same time we are already seeking to. Check requested
-            seek time against maxTimeSeekable, not maxTimeLoaded.
-        (WebCore::MediaPlayerPrivate::doSeek):
-            Don't bother stopping a movie that isn't playing. Minor cleanup to make the code more readable.
-        (WebCore::MediaPlayerPrivate::seekTimerFired):
-            Check requested seek time against maxTimeSeekable, not maxTimeLoaded.
-        (WebCore::MediaPlayerPrivate::updateStates):
-            A streaming movie has as much data as it needs once it reaches "playable", so 
-            set the ready state to HaveFutureData. A movie with metadata doesn't drop back 
-            to "have nothing" when seeking. A streaming movie doesn't use the network when paused.
-        (WebCore::MediaPlayerPrivate::timeChanged):
-            It may not be possible to seek to a specific time in a streamed movie but when seeking 
-            in a streaming movie QuickTime sets the time to closest time possible and posts a  
-            timechanged notification, so update m_seekTo so we can detect when the seek completes.
-
-2009-06-30  Steve Falkenburg  <sfalken@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=26860
-
-        Reviewed by Sam Weinig.
-
-        Blacklist Yahoo Application State plug-in for versions prior to 1.0.0.6.
-        Earlier versions cause corruption crashes.
-
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::isPluginBlacklisted):
-
-2009-06-30  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7005207> <video> in canvas broken with ACCEL_COMPOSITING
-        
-        Fix drawImage of video in CanvasRenderingContext2D when
-        accelerated compositing is enabled. This is done by
-        adding a new paint method to HTMLVideoElement that
-        is only called from canvas, which will create the software
-        renderer if necessary, but otherwise calls the regular
-        paint method. Meanwhile, add logic to the software video
-        renderer so that it can be created without calling repaint
-        every time it sees a new frame.
-        
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::drawImage):
-        * html/HTMLVideoElement.cpp:
-        (WebCore::HTMLVideoElement::paintCurrentFrameInContext):
-        * html/HTMLVideoElement.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::paintCurrentFrameInContext):
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::paintCurrentFrameInContext):
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::createQTMovie):
-        (WebCore::MediaPlayerPrivate::createQTVideoRenderer):
-        (WebCore::MediaPlayerPrivate::currentRenderingMode):
-        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
-        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
-        (WebCore::MediaPlayerPrivate::paintCurrentFrameInContext):
-
-2009-06-30  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26858
-
-        Get <dcol> elements reflected into the datagrid's column list.  Make sure columns get added/removed
-        properly.  (Attribute changes are still not caught.  That is coming in a separate patch.)
-
-        Added fast/dom/HTMLDataGridElement/DataGridColumns-dom.html
-
-        * html/DataGridColumn.h:
-        (WebCore::DataGridColumn::create):
-        (WebCore::DataGridColumn::setColumnList):
-        (WebCore::DataGridColumn::DataGridColumn):
-        * html/DataGridColumnList.cpp:
-        (WebCore::DataGridColumnList::add):
-        (WebCore::DataGridColumnList::remove):
-        (WebCore::DataGridColumnList::clear):
-        * html/DataGridColumnList.h:
-        * html/HTMLDataGridColElement.cpp:
-        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
-        (WebCore::HTMLDataGridColElement::findDatagridAncestor):
-        (WebCore::HTMLDataGridColElement::ensureColumn):
-        (WebCore::HTMLDataGridColElement::insertedIntoTree):
-        (WebCore::HTMLDataGridColElement::removedFromTree):
-        (WebCore::HTMLDataGridColElement::sortable):
-        (WebCore::HTMLDataGridColElement::setSortable):
-        * html/HTMLDataGridColElement.h:
-        (WebCore::HTMLDataGridColElement::column):
-        (WebCore::HTMLDataGridColElement::setColumn):
-        (WebCore::HTMLDataGridColElement::datagrid):
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::setDataSource):
-        (WebCore::HTMLDataGridElement::dataSource):
-
-2009-06-30  Jeremy Orlow (jorlow@chromium.org)
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26852
-
-        Fix some minor build issues in the v8 bindings.
-
-        * bindings/v8/custom/V8StorageCustom.cpp:
-        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
-        (WebCore::storageGetter):
-        (WebCore::storageSetter):
-        (WebCore::storageDeleter):
-        * storage/StorageArea.cpp:
-
-2009-06-30  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Chromium Linux: use different fonts for each script run.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26853
-
-        Previously, when rendering complex text, we picked a single font which
-        could render all the glyphs needed for the run. However, this meant
-        that sometimes lines were rendered with, for example, [LATIN, THAI,
-        LATIN] and we could end up with a different font for the Latin parts
-        than for lines without Thai in them.
-
-        With this patch, we pick a font for each script run.
-
-        This change is covered by existing layout tests.
-
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::Font::drawGlyphs):
-        (WebCore::TextRunWalker::TextRunWalker):
-        (WebCore::TextRunWalker::~TextRunWalker):
-        (WebCore::TextRunWalker::nextScriptRun):
-        (WebCore::TextRunWalker::fontPlatformDataForScriptRun):
-        (WebCore::TextRunWalker::setupFontForScriptRun):
-        (WebCore::TextRunWalker::allocHarfbuzzFont):
-        (WebCore::setupForTextPainting):
-        (WebCore::Font::drawComplexText):
-        (WebCore::Font::floatWidthForComplexText):
-        (WebCore::Font::offsetForPositionForComplexText):
-        (WebCore::Font::selectionRectForComplexText):
-        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
-        (WebCore::FontPlatformData::setupPaint):
-
-2009-06-30  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt, Dan Bernstein.
-        
-        <rdar://problem/6191676> Redraw issues scrolling overflow:scroll div with compositing
-
-        There are two parts to this fix. First, if a compositing layer has overflow clipping
-        or a mask, then the compositing layer does not need to be sized to encompass all
-        non-composited children.
-        
-        Second, when scrolling, we have to back up to the compositing ancestor and have
-        it reposition descendant compositing layers, because overflow doesn't follow
-        the z-order tree.
-        
-        Test: compositing/overflow/overflow-scroll.html
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        Pass the UpdateCompositingLayers flag when updating layers after layout, so that
-        we can reposition compositing layers if we're not about to do a layer rebuild.
-        
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPositions):
-        Only update compositing layers if the flag is set.
-        
-        (WebCore::RenderLayer::scrollToOffset):
-        Do compositing layer updates from the compositing ancestor in one fell swoop.
-
-        * rendering/RenderLayer.h:
-        Replace the unused FullUpdate flag with one that allows us to specify whether
-        compositing layers should be updated.
-        
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-        * rendering/RenderLayerBacking.h:
-        New param that we can pass to updateCompositingDescendantGeometry to control
-        whether the update goes deep.
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
-        We can return earlier if this is not a self-painting layer.
-        If the layer has overflow clip or a mask, then the composited bounds are just the
-        local bounds, excluding descendants.
-        
-        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry):
-        * rendering/RenderLayerCompositor.h:
-        Renamed from updateCompositingChildrenGeometry, and added a flag that allows
-        us to do a deep update.
-
-2009-06-30  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26764
-        Uncaught NOT_FOUND_ERR: DOMException 8 loading empty text file
-
-        Test: fast/parser/empty-text-resource.html
-
-        * loader/TextDocument.cpp: (WebCore::TextTokenizer::finish): Create document tree if it
-        hasn't been created yet.
-
-2009-06-30  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Renamed scrollbarUnderPoint to scrollbarAtPoint.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::hitTestResultAtPoint):
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollbarAtPoint):
-        * platform/ScrollView.h:
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::handleMouseDownEvent):
-        (WebCore::PopupListBox::handleMouseMoveEvent):
-
-2009-06-30  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        <rdar://problem/6960286> CrashTracer: [REGRESSION] 1120 crashes in Safari at com.apple.WebCore WebCore::JSLazyEventListener::parseCode const 62
-
-        <select> elements and other elements the produce popups can keep their popups
-        live across a page load.  If this occurs and the <select> element has an
-        onchange handler it is possible to get into a state where we try to execute
-        JS on a page that no longer has an execution context. 
-
-        * bindings/js/JSLazyEventListener.cpp:
-        (WebCore::JSLazyEventListener::parseCode):
-          Be paranoid and add a null check, but assert as well because we shouldn't
-          actually get to this point.
-        * rendering/RenderMenuList.cpp:
-        (WebCore::RenderMenuList::valueChanged):
-
-2009-06-30  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=25435>
-
-        Added support for sending MessagePorts to/from Workers via postMessage().
-
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::messageChannel):
-        Exposes MessageChannel constructor WorkerContext.
-        * bindings/js/JSWorkerCustom.cpp:
-        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        Now correctly handles being instantiated from within a Worker.
-       * platform/CrossThreadCopier.h:
-        (WebCore::GenericWorkerTaskTraits<PassOwnPtr>):
-        Added support for passing PassOwnPtr as argument to GenericWorkerTask
-       * workers/GenericWorkerTask.h:
-        (WebCore::):
-        * workers/Worker.cpp:
-        (WebCore::Worker::postMessage):
-        Now handles disentangling/entangling MessagePorts sent to/from via postMessage.
-        (WebCore::Worker::dispatchMessage):
-        * workers/Worker.h:
-        * workers/Worker.idl:
-        Added an optional MessagePort argument to postMessage()
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::hasPendingActivity):
-        Workers now report pending activity whenever there are remotely entangled ports.
-        (WebCore::WorkerContext::postMessage):
-        Now handles disentangling/entangling MessagePorts sent to/from via postMessage.
-        (WebCore::WorkerContext::dispatchMessage):
-        * workers/WorkerContext.h:
-        * workers/WorkerContext.idl:
-        Added an optional MessagePort argument to postMessage()
-        * workers/WorkerContextProxy.h:
-        * workers/WorkerMessagingProxy.cpp:
-        Updated messaging infrastructure to transport an optional MessagePort/MessagePortChannel.
-        (WebCore::MessageWorkerContextTask::create):
-        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
-        (WebCore::MessageWorkerContextTask::performTask):
-        (WebCore::MessageWorkerTask::create):
-        (WebCore::MessageWorkerTask::MessageWorkerTask):
-        (WebCore::MessageWorkerTask::performTask):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
-        * workers/WorkerMessagingProxy.h:
-        Added additional postMessage() API that accepts a MessagePort
-        * workers/WorkerObjectProxy.h:
-        Added additional postMessage() API that accepts a MessagePort
-
-2009-06-30  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Chromium: Add complex text support on Linux.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25068
-
-        This patch adds complex text support on Linux using Harfbuzz. It's not
-        the fastest code possible: some caching of font tables will certainly
-        be required. However, it's probably the simplest code that works.
-
-        This will require checking in new baselines in the Chromium tree for
-        those layout tests which now pass.
-
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::Font::drawGlyphs):
-        (WebCore::truncateFixedPointToInteger):
-        (WebCore::TextRunWalker::TextRunWalker):
-        (WebCore::TextRunWalker::~TextRunWalker):
-        (WebCore::TextRunWalker::reset):
-        (WebCore::TextRunWalker::setXOffsetToZero):
-        (WebCore::TextRunWalker::rtl):
-        (WebCore::TextRunWalker::setBackwardsIteration):
-        (WebCore::TextRunWalker::nextScriptRun):
-        (WebCore::TextRunWalker::glyphs):
-        (WebCore::TextRunWalker::length):
-        (WebCore::TextRunWalker::xPositions):
-        (WebCore::TextRunWalker::advances):
-        (WebCore::TextRunWalker::width):
-        (WebCore::TextRunWalker::logClusters):
-        (WebCore::TextRunWalker::numCodePoints):
-        (WebCore::TextRunWalker::widthOfFullRun):
-        (WebCore::TextRunWalker::allocHarfbuzzFont):
-        (WebCore::TextRunWalker::deleteGlyphArrays):
-        (WebCore::TextRunWalker::createGlyphArrays):
-        (WebCore::TextRunWalker::expandGlyphArrays):
-        (WebCore::TextRunWalker::shapeGlyphs):
-        (WebCore::TextRunWalker::setGlyphXPositions):
-        (WebCore::setupForTextPainting):
-        (WebCore::fontPlatformDataForTextRun):
-        (WebCore::Font::drawComplexText):
-        (WebCore::Font::floatWidthForComplexText):
-        (WebCore::glyphIndexForXPositionInScriptRun):
-        (WebCore::Font::offsetForPositionForComplexText):
-        (WebCore::Font::selectionRectForComplexText):
-        * platform/graphics/chromium/HarfbuzzSkia.cpp: Added.
-        (WebCore::SkiaScalarToHarfbuzzFixed):
-        (WebCore::stringToGlyphs):
-        (WebCore::glyphsToAdvances):
-        (WebCore::canRender):
-        (WebCore::getOutlinePoint):
-        (WebCore::getGlyphMetrics):
-        (WebCore::getFontMetric):
-        (WebCore::harfbuzzSkiaGetTable):
-
-2009-06-30  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7019799> Slow loading MediaDocument can fall back to plug-in unnecessarily
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::updateStates):
-            Always fall back to a plug-in if m_hasUnsupportedTracks is set.
-        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
-            Set m_hasUnsupportedTracks if we disable a track.
-
-2009-06-30  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix inverted if/else that's causing a layout test in src.chromium.org to fail.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26820
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::GCPrologueVisitor::visitDOMWrapper): if (port2), not if (!port2).
-
-2009-06-30  Dan Bernstein  <mitz@apple.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Dave Hyatt.
+        rangeOverflow/rangeUnderflow support for type=datetime, datetime-local,
+        month, time and week
+        https://bugs.webkit.org/show_bug.cgi?id=34483
 
-        - fix <rdar://problem/6946611> REGRESSION (r30673): Shade10:" D_Snap
-          to Grid" window is clipping
+        Tests: fast/forms/ValidityState-rangeOverflow.html
+               fast/forms/ValidityState-rangeUnderflow.html
 
-        Added an app-specific quirk to revert the behavior of <link> elements
-        to the way it was before r30673, namely that if the rel attribute
-        is not "stylesheet" but the type attribute contains "text/css", the
-        link behaves as a stylesheet link.
+        * html/HTMLInputElement.cpp:
+          Defines the hard limits for the types as double values.
+        (WebCore::HTMLInputElement::rangeUnderflow): Supports the types.
+        (WebCore::HTMLInputElement::rangeOverflow): Supports the types.
+        (WebCore::HTMLInputElement::minimum): Supports the types.
+        (WebCore::HTMLInputElement::maximum): Supports the types.
 
-        * WebCore.base.exp: Exported setTreatsAnyTextCSSLinkAsStylesheet().
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::process): Check
-            Settings::treatsAnyTextCSSLinkAsStylesheet() and if true, allow a
-            style sheet link if the type contains "text/css".
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-            Initialize m_treatsAnyTextCSSLinkAsStylesheet.
-        (WebCore::Settings::setTreatsAnyTextCSSLinkAsStylesheet): Added.
-        * page/Settings.h:
-        (WebCore::Settings::treatsAnyTextCSSLinkAsStylesheet): Added.
+2010-02-02  Fumitoshi Ukai  <ukai@chromium.org>
 
-2009-06-30  Adrien Nader  <camaradetux@gmail.com>
+        Reviewed by Alexey Proskuryakov.
 
-        Reviewed by Xan Lopez.
+        WebSocket set pending activity to avoid unexpected GC.
+        https://bugs.webkit.org/show_bug.cgi?id=34014
 
-        Fix typo in GNUMakefile.am: it reads WebCOre instead of WebCore.
+        Test: websocket/tests/websocket-pending-activity.html
 
-        * GNUmakefile.am:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect): set pending activity until it receives didClose. 
+        (WebCore::WebSocket::contextDestroyed): check socket is already closed.
+        (WebCore::WebSocket::stop): close the connection and unset pending activity when it stops.
+        (WebCore::WebSocket::didClose): unset pending activity.
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData): protect this while it processes received data.
 
-2009-06-30  Jan Michael Alonzo  <jmalonzo@webkit.org>
+2010-02-02  Gustavo Noronha Silva  <gns@gnome.org>
 
-        Reviewed by Xan Lopez.
+        No review, rolling out r54261.
+        http://trac.webkit.org/changeset/54261
+        https://bugs.webkit.org/show_bug.cgi?id=34435
 
-        [Gtk] Turn on ENABLE_DATAGRID so we can run the layout tests.
+        Causes crashes on release builds
 
         * GNUmakefile.am:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        * platform/gtk/GOwnPtrGtk.cpp: Removed.
+        * platform/gtk/GOwnPtrGtk.h: Removed.
 
-2009-06-30  Raju Kunnath  <raju.kunnath@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=26752>
-
-        [Qt] Windows release build issue with Qt4.5 due to -GL flag on msvc2005 and msvc2008. 
-
-        * WebCore.pro: Removed -GL compiler option for win32-msvc2005|win32-msvc2008.
-
-2009-06-30  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        Initialize member variables in the right order. Fixes compiler
-        warning.
-
-        * platform/image-decoders/bmp/BMPImageReader.cpp:
-        (WebCore::BMPImageReader::BMPImageReader):
-
-2009-06-29  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26831
-        Fix compiler warning in WorkerLoaderProxy.h
-
-        Forward declaration of a class within a class is not allowed,
-        since the compiler can't know if the declaration is legal at that
-        point. This gives the following compiler warning:
-
-        ../../WebCore/workers/WorkerLoaderProxy.h:40: warning: declaration
-        "class WebCore::ScriptExecutionContext::Task" does not declare
-        anything
-
-        Include the full ScriptExecutionHeader header instead.
-
-        * workers/WorkerLoaderProxy.h:
-
-2009-06-29  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        Remove unused function.
-
-        * plugins/gtk/PluginPackageGtk.cpp:
-
-2009-06-29  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Change RenderLayer::updateLayerPositions() to use a bitmask instead of two
-        boolean arguments. FullUpdate is unused at present, but will be used soon.
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPositions):
-        (WebCore::RenderLayer::scrollToOffset):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::):
-
-2009-06-29  Nate Chapin  <japhet@chromium.org>
+2010-02-02  David Levin  <levin@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
+        No review, rolling out r54245.
+        http://trac.webkit.org/changeset/54245
+        https://bugs.webkit.org/show_bug.cgi?id=34492
 
-        Fix one more bad merge in V8Proxy.
+        This patch seems to have broken thousands of chromium tests on
+        Windows (and since it was for chromium, I'm rolling it out).
 
-        https://bugs.webkit.org/show_bug.cgi?id=26819
+        * dom/Element.cpp:
+        (WebCore::Element::baseURI):
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::setDOMException): setDOMExceptionHelper() instead of convertToV8Object().
+2010-02-02  Steve Falkenburg  <sfalken@apple.com>
 
-2009-06-29  Sam Weinig  <sam@webkit.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by Mark Rowe.
+        Copyright year updating for Windows version resources should be automatic
+        https://bugs.webkit.org/show_bug.cgi?id=34503
 
-        Remove more unused scons support.
+        * WebCore.vcproj/QTMovieWin.rc:
 
-        * SConstruct: Removed.
+2010-02-02  Dimitri Glazkov  <dglazkov@chromium.org>
 
-2009-06-29  Sam Weinig  <sam@webkit.org>
+        No review, rolling out r54257.
+        http://trac.webkit.org/changeset/54257
+        https://bugs.webkit.org/show_bug.cgi?id=34491
 
-        Reviewed by Dave Hyatt.
+        [Chromium] broke thousands of Win tests and a few of Linux tests.
 
-        Fix some incorrect create functions.
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::applyAntiAliasedClipPaths):
+        * platform/graphics/skia/PlatformContextSkia.h:
 
-        * html/DataGridColumn.h:
-        (WebCore::DataGridColumn::create):
-        * html/DataGridColumnList.h:
-        (WebCore::DataGridColumnList::create):
+2010-02-02  Philippe Normand  <pnormand@igalia.com>
 
-2009-06-29  Sam Weinig  <sam@webkit.org>
+        Reviewed by Gustavo Noronha Silva.
 
-        Reviewed by Dave Hyatt.
+        [Gtk] libsoup critical warning in media player http cookies injection code
+        https://bugs.webkit.org/show_bug.cgi?id=34435
 
-        Remove initialize method from DataGridDataSource and add
-        DOMDataGridDataSource.
+        Fixed the critical warning and refactored the
+        User-Agent/Referer/cookies injection code, in that order. Previous
+        order (cookies first) was wrong because if cookies injection could
+        not be done neither the User-Agent not Referer were injected. Also
+        started a non-JSC-specific, gtk-specific GOwnPtr module.
 
         * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSDataGridDataSource.cpp:
-        * bindings/js/JSDataGridDataSource.h:
-        * bindings/js/JSHTMLDataGridElementCustom.cpp:
-        (WebCore::JSHTMLDataGridElement::setDataSource):
-        * html/DOMDataGridDataSource.cpp: Added.
-        (WebCore::DOMDataGridDataSource::DOMDataGridDataSource):
-        (WebCore::DOMDataGridDataSource::~DOMDataGridDataSource):
-        * html/DOMDataGridDataSource.h: Added.
-        (WebCore::DOMDataGridDataSource::create):
-        (WebCore::DOMDataGridDataSource::isDOMDataGridDataSource):
-        (WebCore::asDOMDataGridDataSource):
-        * html/DataGridDataSource.h:
-        (WebCore::DataGridDataSource::isDOMDataGridDataSource):
-        (WebCore::DataGridDataSource::isJSDataGridDataSource):
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
-        (WebCore::HTMLDataGridElement::setDataSource):
-        (WebCore::HTMLDataGridElement::dataSource):
-        * html/HTMLDataGridElement.h:
-
-2009-06-29  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix a couple of bad merge items from my previous V8Proxy patch.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26813
-
-        * bindings/v8/V8Collection.h:
-        (WebCore::nodeCollectionNamedPropertyGetter):  Fix a bad function name that slipped through.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::setDOMException):  Fix a bad merge that caused a couple of lines of extraneous, breaking code to get in.
-
-2009-06-29  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26706
-
-        Fixed crash due to dereference of m_toStyle
-
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::isTargetPropertyEqual):
-
-2009-06-29  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7014813> Ask media engine if a movie is streamed or downloaded.
-
-        * WebCore.base.exp: 
-            Export _wkQTMovieGetType
-
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::hasSingleSecurityOrigin):
-            Move to keep with other non-callback functions.
-        (WebCore::MediaPlayer::movieLoadType):
-            New, returns the movie type.
-        * platform/graphics/MediaPlayer.h:
-            Declare MovieLoadType enum and movieLoadType method.
-
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::movieLoadType):
-            Default implementation of movieLoadType
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::createQTMovie):
-            Don't base m_isStreaming on protocol, there are other types of streaming movies.
-        (WebCore::MediaPlayerPrivate::maxTimeBuffered):
-            Don't assume all streams are unbuffered.
-        (WebCore::MediaPlayerPrivate::updateStates):
-            Update m_isStreaming once we have metadata.
-        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
-            Tracks that are disabled to begin with shouldn't be included in m_enabledTrackCount.
-        (WebCore::MediaPlayerPrivate::movieLoadType):
-            New, return movie type.
-
-        * platform/mac/WebCoreSystemInterface.h:
-        * platform/mac/WebCoreSystemInterface.mm:
-            Add wkQTMovieGetType.
-
-2009-06-29  Alice Liu  <alice.liu@apple.com>
-
-        Fixed <rdar://problem/6930280> Reproducible crash at USA Today photo gallery
-
-        Reviewed by Anders Carlsson.
-
-        No test added because the crash requires a flash plugin
-
-        * plugins/win/PluginMessageThrottlerWin.cpp:
-        Rely on the hWnd of the plugin to tell us whether the PluginView has 
-        been deleted during execution of its wndProc.
-        (WebCore::PluginMessageThrottlerWin::messageThrottleTimerFired):
-
-2009-06-29  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26811
-         [Chromium] Remove a flag and functions used to enable workers in runtime.
-
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        * bindings/v8/WorkerContextExecutionProxy.h:
-
-2009-06-29  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-        
-        <rdar://problem/6976712> Text antialiasing problems when rendering into compositing layers.
-        
-        Improve the appearance of text in compositing layers by making use of
-        CA's layer geometry flipping, rather that doing it ourselves with a flip
-        transform. This allows CG to use font autohinting in the layer text.
-
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::setGeometryOrientation):
-        (WebCore::GraphicsLayer::geometryOrientation):
-        New methods to set whether this layer uses flipped geometry.
-        
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setGeometryOrientation):
-        (WebCore::GraphicsLayerCA::geometryOrientation):
-        Subclass in order to call into CA
-        
-        (WebCore::GraphicsLayerCA::setContentsLayer):
-        Now that CA is doing the geometry flipping, we no longer need to flip the content
-        layers for image and video manually
-        
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
-        Turn on flipping on the root layer.
-
-2009-06-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26246
-
-        Implement most WML specific <select> element features.
-        Add 'iname' / 'ivalue' support and support variable references.
-
-        Add two tests covering most select/variable related functionality.
-        Needs more tests when adding full 'iname' / 'ivalue' support (used in conjuction with onpick).
-
-        Tests: http/tests/wml/post-data-to-server.html
-               wml/select-element-variables.html
-
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::optionCount): Refactored from HTMLSelectElement::length() for use within HTML & WML.
-        * dom/SelectElement.h:
-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::length): Use new SelectElement::optionCount() function. (no functional changes for HTML).
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded): Activated commented code taking care of WMLSelectElement initialization.
-        * wml/WMLSelectElement.cpp: Add a bunch of new code handling WML specific feature processing.
-        (WebCore::WMLSelectElement::title):
-        (WebCore::WMLSelectElement::formControlName):
-        (WebCore::WMLSelectElement::defaultEventHandler):
-        (WebCore::WMLSelectElement::selectInitialOptions):
-        (WebCore::WMLSelectElement::calculateDefaultOptionIndices):
-        (WebCore::WMLSelectElement::selectDefaultOptions):
-        (WebCore::WMLSelectElement::initializeVariables):
-        (WebCore::WMLSelectElement::updateVariables):
-        (WebCore::WMLSelectElement::parseIndexValueString):
-        (WebCore::WMLSelectElement::valueStringToOptionIndices):
-        (WebCore::WMLSelectElement::optionIndicesToValueString):
-        (WebCore::WMLSelectElement::optionIndicesToString):
-        (WebCore::WMLSelectElement::name):
-        (WebCore::WMLSelectElement::value):
-        (WebCore::WMLSelectElement::iname):
-        (WebCore::WMLSelectElement::ivalue):
-        * wml/WMLSelectElement.h:
-
-2009-06-29  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Put <datagrid> behind an ifdef.
-
-        * Configurations/FeatureDefines.xcconfig:
-        * bindings/js/JSDataGridColumnListCustom.cpp:
-        * bindings/js/JSDataGridDataSource.cpp:
-        * bindings/js/JSDataGridDataSource.h:
-        * bindings/js/JSHTMLDataGridElementCustom.cpp:
-        * html/DataGridColumn.cpp:
-        * html/DataGridColumn.h:
-        * html/DataGridColumn.idl:
-        * html/DataGridColumnList.cpp:
-        * html/DataGridColumnList.h:
-        * html/DataGridColumnList.idl:
-        * html/DataGridDataSource.h:
-        * html/HTMLDataGridCellElement.cpp:
-        * html/HTMLDataGridCellElement.h:
-        * html/HTMLDataGridCellElement.idl:
-        * html/HTMLDataGridColElement.cpp:
-        * html/HTMLDataGridColElement.h:
-        * html/HTMLDataGridColElement.idl:
-        * html/HTMLDataGridElement.cpp:
-        * html/HTMLDataGridElement.h:
-        * html/HTMLDataGridElement.idl:
-        * html/HTMLDataGridRowElement.cpp:
-        * html/HTMLDataGridRowElement.h:
-        * html/HTMLDataGridRowElement.idl:
-        * html/HTMLTagNames.in:
-        * page/DOMWindow.idl:
-        * rendering/RenderDataGrid.cpp:
-        * rendering/RenderDataGrid.h:
-
-2009-06-29  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Ariya Hidayat and Adam Roben.
-
-        Fix compilation with MINGW. Ported MSVC inline assembly to
-        GNU inline assembly. Also fixed casting errors where gcc
-        refused to cast a pointer-to-function to a pointer-to-object,
-        without an intermediate cast to a non-pointer type.
-
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::hookedBeginPaint):
-        (WebCore::PluginView::hookedEndPaint):
-        (WebCore::hook):
-        (WebCore::setUpOffscreenPaintingHooks):
-
-2009-06-26  John Sullivan  <sullivan@apple.com>
-
-        Added Speech submenu to context menu on Mac when there's a non-editable selection
-        (it was already present when there's an editable selection). 
-        Also added support for disabling "Stop Speaking" when there is no speaking to stop.
-
-        Reviewed by Tim Hatcher.
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyContextMenuClient::isSpeaking):
-        implemented this new virtual function to return false
-        
-        * page/ContextMenuClient.h:
-        declared this new pure virtual function
-        
-        * platform/ContextMenu.cpp:
-        (WebCore::ContextMenu::populate):
-        insert Speech item (after a separator) on Mac when there's selected non-editable text
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
-        enable Stop Speaking item only if the context menu client returns true for isSpeaking()
-
-2009-06-28  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=26783
-          <rdar://problem/7014543> REGRESSION (r45296): Subfolders not displayed
-          in MobileMe iDisk Web App
-
-        Test: added a case to fast/dom/Element/scrollWidth.html
-
-        Ensure that scroll{Width, Height} is greater or equal to
-        client{Width, Height}.
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::scrollWidth):
-        (WebCore::RenderBox::scrollHeight):
-
-2009-06-27  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26780
-        
-        Do not make compositing layers for non-self-painting RenderLayers,
-        since these exist only to push a clip onto the clipping stack. If such
-        a layer gets compositied for some other reason, it should not paint.
-        
-        Also ensure that we update composited layer positions correctly
-        inside overflow:scroll layers. We can't assume that the contents
-        are child layers, so we have to go up to the compositing ancestor,
-        and tell it to update all its child layer positions as we do 
-        after layout.
-
-        Tests: compositing/layers-inside-overflow-scroll.html
-               compositing/self-painting-layers.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollToOffset):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::paintIntoLayer):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
-        (WebCore::RenderLayerCompositor::needsToBeComposited):
-
-2009-06-28  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
-
-        Reviewed by Eric Seidel.
-
-        PurgeableBuffer #defines leave out functions on gtk MacOSX 10.4 build
-        https://bugs.webkit.org/show_bug.cgi?id=23057
-
-        Define these functions for Gtk as well.
-
-        * platform/PurgeableBuffer.h:
-
-2009-06-28  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Update CodeGeneratorV8.pm to match the new api for V8Proxy.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26765
-
-        * bindings/scripts/CodeGeneratorV8.pm: Match the current version of V8Proxy.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        * platform/gtk/GOwnPtrGtk.cpp: Added.
+        (WTF::SoupURI):
+        (WTF::GstElement):
+        * platform/gtk/GOwnPtrGtk.h: Added.
 
-2009-06-28  Nicolas Sylvain  <nsylvain@chromium.org>
+2010-02-02  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        If loading a font fails because of the sandbox, we ask the browser process to 
-        try to load it by calling ensureFontLoaded. If it still fails after 
-        ensureFontLoaded, we hit a ASSERT_NOT_REACHED. 
-
-        This case happens once in a while during browser shutdown. The browser will 
-        queue a message to the renderer to shutdown, and will then stop answering sync 
-        messages from the renderer. If the renderer is still loading a page during this 
-        time, it might try to call the browser process to ask to load a font. The 
-        browser process will ignore the request, and the font will fail to load, even 
-        after the second try. 
-
-        This is unfortunate, but there is no real risk here, since the renderer will be 
-        going away as soon as it processes another message. 
-
-        This can't be layout tested as it depends on the sandbox. 
-
-        https://bugs.webkit.org/show_bug.cgi?id=26743 
-
-        * platform/graphics/chromium/FontChromiumWin.cpp:
-        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
-        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
-        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
-
-2009-06-28  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=15457
-
-        Test: plugins/netscape-plugin-map-data-to-src.html
-
-        Fix problems with Real or WMP plugins not displaying because "data" was set
-        on the OBJECT tag instead of "src".  This is based on what Firefox does, see
-        http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsObjectFrame.cpp#3045
-
-        * rendering/RenderPartObject.cpp:
-        (WebCore::mapDataParamToSrc):
-        (WebCore::RenderPartObject::updateWidget):
-
-2009-06-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Jan Alonzo.
-
-        [Qt] Build fix after r45290
-        https://bugs.webkit.org/show_bug.cgi?id=26769
-
-        * WebCore.pro:
-
-2009-06-27  Emilio Pozuelo Monfort  <pochu27@gmail.com>
-
-        Reviewed by Jan Alonzo.
-
-        [GTK] Don't use deprecated GTKsymbols.
-        https://bugs.webkit.org/show_bug.cgi?id=26583
-
-        * plugins/gtk/gtk2xtbin.c:
-        (gtk_xtbin_class_init):
-        (gtk_xtbin_new):
-        (gtk_xtbin_destroy):
-
-2009-06-27  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26780
-        
-        Fix up previous change. When computeCompositingRequirements() determines
-        that the current layer is composited, it needs to inform its parent
-        by setting compositingState.m_subtreeIsCompositing() to true. That didn't
-        always happen after the previous patch. Clarified the logic here.
-        
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::CompositingState::CompositingState):
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-
-2009-06-27  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26780
-        
-        First part: fix the RenderLayer::hasCompositingDescendant() flag to be set
-        correctly.
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        Do not unconditionally set compositingState.m_subtreeIsCompositing, because
-        that can clobber the value from an earlier sibling. Add some more comments.
-        
-        Remove a final use of Vector iterators.
-        
-        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
-        Move the normalFlowList() processing outside the test for isStackingContext().
-
-2009-06-27  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser and Antti Koivisto.
-
-        - make paintFillLayerExtended() non-virtual and remove its clipY and
-          clipH parameters
-
-        These parameters were computed and passed along to
-        paintFillLayerExtended in order to vertically constrain the rect fill to
-        the damage rect, because Qt cannot paint tall rectangles (see
-        <http://websvn.kde.org/?view=rev&revision=42721>). Since the damage rect
-        is passed along in the PaintInfo, the extra parameters are redundant,
-        and the intersection can just take place in paintFillLayerExtended().
-
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::paintFillLayers):
-        (WebCore::InlineFlowBox::paintFillLayer):
-        (WebCore::InlineFlowBox::paintBoxDecorations):
-        (WebCore::InlineFlowBox::paintMask):
-        * rendering/InlineFlowBox.h:
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintRootBoxDecorations):
-        (WebCore::RenderBox::paintBoxDecorations):
-        (WebCore::RenderBox::paintMask):
-        (WebCore::RenderBox::paintMaskImages):
-        (WebCore::RenderBox::paintFillLayers):
-        (WebCore::RenderBox::paintFillLayer):
-        * rendering/RenderBox.h:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        * rendering/RenderBoxModelObject.h:
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::paintBoxDecorations):
-        (WebCore::RenderFieldset::paintMask):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::paintBoxDecorations):
-        (WebCore::RenderTable::paintMask):
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
-        (WebCore::RenderTableCell::paintMask):
-
-2009-06-27  Ryosuke Niwa  <rniwa@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26762
-
-        Clean up for IndentOutdentCommand::indentRegion, and solved most of problems related to the bug 21712.
-        https://bugs.webkit.org/show_bug.cgi?id=21712
-
-        Added few utility functions to htmlediting.h/cpp
-
-        isVisibilyAdjacent checks whether the first position is visibly next to the second position.
-        i.e. there is no visible node between the first and second positions
-
-        canMergeLists checks whether two lists can be merged.
-        It checks the type of list, the editing boundary, and adjacency of the lists.
-
-        Tests: editing/execCommand/indent-nested-lists-1.html
-               editing/execCommand/indent-nested-lists-2.html
-               editing/execCommand/indent-nested-lists-3.html
-               editing/execCommand/indent-nested-lists-4.html
-               editing/execCommand/indent-nested-lists-5.html
-               editing/execCommand/indent-nested-lists-6.html
-               editing/execCommand/indent-nested-lists-7.html
-               editing/execCommand/outdent-nested-lists-1.html
-               editing/execCommand/outdent-nested-lists-2.html
-               editing/execCommand/outdent-nested-lists-3.html
-               editing/execCommand/outdent-nested-lists-4.html
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion):
-        (WebCore::IndentOutdentCommand::tryIndentingAsListItem):
-        (WebCore::IndentOutdentCommand::indentIntoBlockquote):
-        (WebCore::IndentOutdentCommand::indentRegion):
-        * editing/IndentOutdentCommand.h:
-        * editing/htmlediting.cpp:
-        (WebCore::enclosingListChild):
-        (WebCore::canMergeLists):
-        (WebCore::isVisibilyAdjacent):
-        * editing/htmlediting.h:
-
-2009-06-27  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Fix completion when iterating options using Tab.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26722
-
-        * inspector/front-end/TextPrompt.js:
-        (WebInspector.TextPrompt.prototype._completionsReady):
-
-2009-06-27  Gustavo Noronha Silva  <gns@gnome.org>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25889
-        [GTK] scrollbar policy for main frame is not implementable
-
-        Override visibleContentRect to handle GTK+'s case, in which
-        scrollbars or equivalent decoration are painted by the parent
-        widget.
-
-        * platform/ScrollView.cpp:
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::visibleContentRect):
-
-2009-06-27  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26708
-        
-        Fix addresses false negatives with respect to scheme relative paths, iFrame JavaScript URLs,
-        and UTF-7 encoded payloads.   
-
-        Tests: http/tests/security/xssAuditor/http-equiv-utf-7-encoded.html
-               http/tests/security/xssAuditor/iframe-javascript-url.html
-               http/tests/security/xssAuditor/script-tag-utf-7-encoded.html
-               http/tests/security/xssAuditor/script-tag-with-source-relative-scheme.html
-
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptHandler): Moved XSSAuditor check to HTMLTokenizer::parseTag.
-        (WebCore::HTMLTokenizer::parseTag):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadSubframe): Modified to inform XSSAuditor of parent frame so
-        as to compare against iFrame javascript URL.
-        * page/XSSAuditor.cpp: Removed method XSSAuditor::isControlCharacter. Instead, exposed method
-        isControlCharacter in ResourceResponseBase.cpp.
-        (WebCore::XSSAuditor::XSSAuditor):
-        (WebCore::XSSAuditor::decodeURL): Modified to decode string using specified encoder.
-        (WebCore::XSSAuditor::findInRequest): Generalized to arbitrary frame so as to prevent execution
-        of iFrame javascript URL.
-        * page/XSSAuditor.h: Added field m_parentFrame.
-        * platform/network/ResourceResponseBase.cpp:
-        (WebCore::isControlCharacter):
-        * platform/network/ResourceResponseBase.h:
-
-2009-06-27  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 26771: Canvas is incorrectly tainted when drawing from a video element that uses <source> elements
-
-        The drawImage(<video>) logic naively assumes that it just needs
-        to check the src attribute of the video element when in fact it
-        needs to look at the url that is being played instead.  Failure
-        to do this means that video provided through source elements 
-        taints the canvas.
-
-        Test: media/video-canvas-source.html
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::checkOrigin):
-        (WebCore::CanvasRenderingContext2D::drawImage):
-        * html/CanvasRenderingContext2D.h:
-
-2009-06-26  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26695
+        [V8] Use toV8() to wrap in the custom bindings, and remove
+        the old wrapping code from V8DOMWrapper.
         
-        Added the ability to do scrollbar hit testing in EventHandler, changed the
-        signature of a PlatformWheelEvent constructor, and changed scrollbarUnderMouse
-        to scrollbarUnderPoint, and updated all calls to that function.        
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::hitTestResultAtPoint):
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        * page/EventHandler.h:
-        (WebCore::):
-        * platform/PlatformWheelEvent.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollbarUnderPoint):
-        * platform/ScrollView.h:
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::handleMouseDownEvent):
-        (WebCore::PopupListBox::handleMouseMoveEvent):
-        * platform/win/WheelEventWin.cpp:
-        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        https://bugs.webkit.org/show_bug.cgi?id=32563
 
-
-2009-06-26  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        <rdar://problem/7011924> Opacity transitions should not trigger hardware compositing mode
-        
-        Don't go into compositing mode just for opacity transitions, but they will be
-        hardware acclerated if we're already compositing.
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
-        (WebCore::RenderLayerCompositor::requiresCompositingForTransform):
-        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
-        * rendering/RenderLayerCompositor.h:
-
-2009-06-26  Simon Fraser  <simon.fraser@apple.com>
-
-        Rubber-stamped by Dave Levin
-
-        Rename ioCompState to compositingState to better match WebCore coding style.
-        
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-
-2009-06-26  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        - revert unintentional project changes from r45277
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-06-26  Mark Rowe  <mrowe@apple.com>
-
-        Fix the Windows build.
-
-        * WebCore.vcproj/WebCore.vcproj: Remove ColorSafari.cpp as
-        the file was deleted from SVN.
-
-2009-06-26  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26766
-
-        Change to use array indexing rather than Vector enumerators; the former
-        are preferred style.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::hasNonCompositingContent):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
-        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
-        (WebCore::RenderLayerCompositor::layerHas3DContent):
-
-2009-06-26  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        - fix <rdar://problem/6961476> REGRESSION (r42043): scrollWidth reported
-          as 1 px
-
-        Test: fast/dom/Element/scrollWidth.html
-
-        Changed scrollWidth and scrollHeight to use the same logic for
-        visible overflow boxes that is used for clipped overflow boxes. In
-        particular, borders are not included and
-        {leftmost,rightmost,lowest}Position() are used. This logic matches IE8.
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::scrollWidth):
-        (WebCore::RenderBox::scrollHeight):
-
-2009-06-26  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 26725: aria-hidden, aria-disabled, aria-readonly need to be implemented
-        https://bugs.webkit.org/show_bug.cgi?id=26725
-
-        Tests: accessibility/aria-disabled.html
-               accessibility/aria-hidden.html
-               accessibility/aria-readonly.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::ariaIsHidden):
-        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        (WebCore::AccessibilityRenderObject::isEnabled):
-        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
-        * accessibility/AccessibilityRenderObject.h:
-        * html/HTMLAttributeNames.in:
-
-2009-06-26  Brett Wilson  <brettw@chromium.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26759
-
-        GIFImageDecoder is broken.
-
-        Make the GIFImageDecoder.repetitionCount function const to match the
-        base class. The mismatched definitions were causing the function to not
-        get called.
-
-        * platform/image-decoders/gif/GIFImageDecoder.cpp:
-        (WebCore::GIFImageDecoder::repetitionCount):
-        * platform/image-decoders/gif/GIFImageDecoder.h:
-
-2009-06-26  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
-
-        Additional fix for https://bugs.webkit.org/show_bug.cgi?id=26651
-
-        The flag should always default to true to avoid it getting set
-        to false in a build with accelerated compositing turned off
-        and then disabling accelerated compositing when subsequently
-        running a build with it turned on.
-
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-
-2009-06-26  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Followup for the fix for <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
-
-        Now that other MIME type correction stuff is in our swizzled method, Tiger needs it too!
-
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
-        * platform/network/mac/WebCoreURLResponse.h:
-
-2009-06-26  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26732
-
-        For the final step of https://bugs.webkit.org/show_bug.cgi?id=25376,
-        combine LocalStorage and SessionStorage into StorageNamespace. The
-        synching code (for LocalStorage) has already been removed, so these
-        classes are now very similar.  All they do is essentially contain a
-        logical grouping of origins that are attached to specific contexts
-        (be it PageGroups for LocalStorage and Page for SessionStorage).
-
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * page/Chrome.cpp:
-        (WebCore::Chrome::createWindow):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::localStorage):
-        * page/DOMWindow.h:
-        * page/Page.cpp:
-        (WebCore::Page::sessionStorage):
-        (WebCore::Page::setSessionStorage):
-        * page/Page.h:
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::localStorage):
-        * page/PageGroup.h:
-        * storage/LocalStorage.cpp: Removed.
-        * storage/LocalStorage.h: Removed.
-        * storage/LocalStorageTask.cpp:
-        * storage/LocalStorageThread.cpp:
-        * storage/SessionStorage.cpp: Removed.
-        * storage/SessionStorage.h: Removed.
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::create):
-        (WebCore::StorageArea::StorageArea):
-        (WebCore::StorageArea::copy):
-        (WebCore::StorageArea::length):
-        (WebCore::StorageArea::key):
-        (WebCore::StorageArea::getItem):
-        (WebCore::StorageArea::setItem):
-        (WebCore::StorageArea::removeItem):
-        (WebCore::StorageArea::clear):
-        (WebCore::StorageArea::contains):
-        (WebCore::StorageArea::importItem):
-        (WebCore::StorageArea::close):
-        (WebCore::StorageArea::dispatchStorageEvent):
-        * storage/StorageArea.h:
-        (WebCore::):
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::scheduleFinalSync):
-        * storage/StorageNamespace.cpp: Copied from WebCore/storage/LocalStorage.cpp.
-        (WebCore::localStorageNamespaceMap):
-        (WebCore::StorageNamespace::localStorageNamespace):
-        (WebCore::StorageNamespace::sessionStorageNamespace):
-        (WebCore::StorageNamespace::StorageNamespace):
-        (WebCore::StorageNamespace::~StorageNamespace):
-        (WebCore::StorageNamespace::copy):
-        (WebCore::StorageNamespace::storageArea):
-        (WebCore::StorageNamespace::close):
-        * storage/StorageNamespace.h: Copied from WebCore/storage/LocalStorage.h.
-
-2009-06-26  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by David Levin.
-
-        Upstream V8Proxy.  This involved updating a lot of function and variable names to match WebKit style, hence the large size.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26623
-
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::~ScheduledAction):
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/ScriptCallStack.cpp:
-        (WebCore::ScriptCallStack::ScriptCallStack):
         * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::isSafeScript):
-        (WebCore::ScriptController::gcProtectJSWrapper):
-        (WebCore::ScriptController::gcUnprotectJSWrapper):
-        (WebCore::ScriptController::processingUserGesture):
-        (WebCore::ScriptController::evaluate):
-        (WebCore::ScriptController::setEventHandlerLineNumber):
-        (WebCore::ScriptController::bindToWindowObject):
-        (WebCore::ScriptController::collectGarbage):
-        (WebCore::ScriptController::haveInterpreter):
-        (WebCore::createScriptObject):
-        (WebCore::ScriptController::createScriptObjectForPluginElement):
-        * bindings/v8/ScriptInstance.cpp:
-        (WebCore::V8ScriptInstance::clear):
-        (WebCore::V8ScriptInstance::set):
         * bindings/v8/ScriptObject.cpp:
-        (WebCore::ScriptGlobalObject::set):
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/v8/ScriptScope.cpp:
-        (WebCore::ScriptScope::ScriptScope):
-        * bindings/v8/ScriptValue.h:
-        (WebCore::ScriptValue::ScriptValue):
-        (WebCore::ScriptValue::operator=):
-        (WebCore::ScriptValue::clear):
         * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        (WebCore::V8AbstractEventListener::handleEvent):
-        (WebCore::V8AbstractEventListener::disposeListenerObject):
-        (WebCore::V8AbstractEventListener::getReceiverObject):
-        * bindings/v8/V8Collection.cpp:
-        (WebCore::toOptionsCollectionSetter):
         * bindings/v8/V8Collection.h:
-        (WebCore::getV8Object):
-        (WebCore::getNamedPropertyOfCollection):
-        (WebCore::nodeCollectionNamedPropertyGetter):
-        (WebCore::getIndexedPropertyOfCollection):
-        (WebCore::nodeCollectionIndexedPropertyGetter):
-        (WebCore::nodeCollectionIndexedPropertyEnumerator):
-        (WebCore::collectionIndexedPropertyEnumerator):
-        (WebCore::collectionStringOrNullIndexedPropertyGetter):
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::weakDOMObjectCallback):
-        (WebCore::DOMData::removeObjectsFromWrapperMap):
-        * bindings/v8/V8Helpers.cpp:
-        (WebCore::wrapNPObject):
-        (WebCore::toV8Context):
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::~V8LazyEventListener):
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        (WebCore::V8LazyEventListener::callListenerFunction):
-        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
         * bindings/v8/V8NodeFilterCondition.cpp:
-        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
-        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
-        (WebCore::V8NodeFilterCondition::acceptNode):
-        * bindings/v8/V8ObjectEventListener.cpp:
-        (WebCore::weakObjectEventListenerCallback):
-        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
-        * bindings/v8/V8Proxy.cpp: Added.
-        * bindings/v8/V8Proxy.h:
-        (WebCore::):
-        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
-        (WebCore::V8Proxy::):
-        (WebCore::V8Proxy::V8Proxy):
-        (WebCore::V8Proxy::frame):
-        (WebCore::V8Proxy::inlineCode):
-        (WebCore::V8Proxy::setInlineCode):
-        (WebCore::V8Proxy::timerCallback):
-        (WebCore::V8Proxy::setTimerCallback):
-        (WebCore::V8Proxy::setEventHandlerLineNumber):
-        (WebCore::V8Proxy::finishedWithEvent):
-        (WebCore::V8Proxy::wrapCPointer):
-        (WebCore::V8Proxy::extractCPointer):
-        (WebCore::V8Proxy::convertDOMWrapperToNative):
-        (WebCore::V8Proxy::convertDOMWrapperToNode):
-        (WebCore::V8Proxy::convertToV8Object):
-        (WebCore::V8Proxy::convertToNativeObject):
-        (WebCore::V8Proxy::convertToNativeEvent):
-        (WebCore::V8Proxy::context):
-        (WebCore::V8Proxy::extractCPointerImpl):
-        (WebCore::V8Proxy::utilityContext):
-        (WebCore::V8Proxy::constructDOMObject):
-        (WebCore::throwError):
-        (WebCore::toV8):
-        * bindings/v8/V8Utilities.h:
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::retrieve):
-        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
-        (WebCore::WorkerContextExecutionProxy::GetConstructor):
-        (WebCore::WorkerContextExecutionProxy::ToV8Object):
-        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
-        (WebCore::WorkerContextExecutionProxy::toV8):
-        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
-        (WebCore::WorkerContextExecutionProxy::evaluate):
-        (WebCore::WorkerContextExecutionProxy::runScript):
-        * bindings/v8/custom/V8AttrCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/V8Proxy.cpp:
         * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::toV8):
-        (WebCore::toCanvasStyle):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ClientRectListCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8ClipboardCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomBinding.cpp:
-        (WebCore::allowSettingFrameSrcToJavascriptUrl):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::V8Custom::GetTargetFrame):
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::V8EventListener):
-        (WebCore::V8EventListener::~V8EventListener):
-        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomPositionCallback.cpp:
+        * bindings/v8/custom/V8CustomPositionErrorCallback.cpp:
         * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
-        (WebCore::V8CustomSQLStatementCallback::handleEvent):
         * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
-        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
         * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
-        (WebCore::V8CustomSQLTransactionCallback::handleEvent):
         * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
-        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/v8/custom/V8CustomVoidCallback.cpp:
-        (WebCore::V8CustomVoidCallback::handleEvent):
-        (WebCore::invokeCallback):
-        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
-        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/v8/custom/V8DOMParserConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        (WebCore::convertBase64):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::createWindow):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::V8Custom::ClearTimeoutImpl):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        * bindings/v8/custom/V8DatabaseCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
         * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8DocumentLocationCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
         * bindings/v8/custom/V8ElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
         * bindings/v8/custom/V8EventCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
         * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::getItem):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
         * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
         * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
         * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_SETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
         * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        (WebCore::NAMED_ACCESS_CHECK):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
         * bindings/v8/custom/V8MessageChannelConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
         * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8NavigatorCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8NodeIteratorCustom.cpp:
-        (WebCore::toV8):
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8NodeListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGLengthCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
         * bindings/v8/custom/V8SVGMatrixCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8StyleSheetListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
         * bindings/v8/custom/V8TreeWalkerCustom.cpp:
-        (WebCore::toV8):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::SetTimeoutOrInterval):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
         * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
 
-2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+2010-02-02  Garret Kelly  <gdk@chromium.org>
 
-        Reviewed by Tim Hatcher.
+        Reviewed by David Levin.
 
-        <rdar://problem/7011047> Profiler shows the record button 'on' even
-        though it's finished
+        When using the Skia graphics context, the beginTransparencyLayer call
+        currently creates a new layer, but does not keep the current
+        compositing mode for use when merging the created layer back onto the
+        rest of the context. This patch fixes that.
+        https://bugs.webkit.org/show_bug.cgi?id=34491
 
-        I consolidated the creation of the user initiated profile name into
-        its own function and then called it from console::profile instead of
-        calling startUserInitiatedProfiling().  This way we don't call
-        toggleRecordButton() which turns on the record button.
+        fast/backgrounds/svg-as-mask.html is affected by this change in Chromium,
+        but not fixed. This is the first of a series of patches to fix it.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
-        (WebCore::InspectorController::startUserInitiatedProfiling):
-        (WebCore::InspectorController::stopUserInitiatedProfiling):
-        * inspector/InspectorController.h:
-        * page/Console.cpp:
-        (WebCore::Console::profile):
-        (WebCore::Console::profileEnd):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::beginTransparencyLayer):
+        * platform/graphics/skia/PlatformContextSkia.h:
 
-2009-06-26  Jeremy Moskovich  <jeremy@chromium.org>
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26691
-
-        Cleanup: Move focusRingColor to RenderTheme.
+        Use WTF::getLocalTime instead of localtime_r in FTPDirectoryDocument
+        https://bugs.webkit.org/show_bug.cgi?id=34409
 
-        Most of this CL involves deleting files and removing dead code.
+        Platform guards for localtime_r are not needed because we already have
+        WTF::getLocalTime which does the same thing.
 
-        focusRingColor() is now defined in RenderTheme rather than in
-        misc. places on each port.  The default color is specified as
-        black in renderTheme and ports can override it in their own
-        custom renderThemes.
-
-        Behavior should be identical except for the following cases,
-        this lists platform and what the focus ring color used to be
-        before this cl and the file where it used to be defined:
-
-        Android - red
-        WebCore/platform/android/TemporaryLinkStubs.cpp
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::processFileDateString):
+        * loader/FTPDirectoryParser.cpp:
+        (WebCore::gmtimeQt):
 
-        Cairo - aqua focus ring color - 0xFF7DADD9
-        WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+2010-02-02  Adam Roben  <aroben@apple.com>
 
-        wx - red
-        WebCore/platform/wx/TemporaryLinkStubs.cpp
+        Copy WebCore's bindings generation scripts to the PrivateHeaders
+        directory on Mac
 
-        QT - black
-        WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+        This will allow other projects to use these scripts.
 
-        Manual test: manual-tests/focusringcolor-change-on-theme-change.html
+        Fixes <http://webkit.org/b/34498>.
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
-        * manual-tests/focusringcolor-change-on-theme-change.html: Added.
-        * platform/android/TemporaryLinkStubs.cpp:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        * platform/graphics/chromium/ColorChromium.cpp: Removed.
-        * platform/graphics/chromium/ColorChromiumMac.mm: Removed.
-        * platform/graphics/mac/ColorMac.h:
-        * platform/graphics/mac/ColorMac.mm:
-        (WebCore::oldAquaFocusRingColor):
-        (WebCore::setUsesTestModeFocusRingColor):
-        (WebCore::usesTestModeFocusRingColor):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawFocusRing):
-        * platform/graphics/win/ColorSafari.cpp: Removed.
-        * platform/wx/TemporaryLinkStubs.cpp:
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::focusRingColor):
-        * rendering/RenderTheme.h:
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::focusRingColor):
-        (WebCore::RenderThemeChromiumMac::systemColor):
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::focusRingColor):
-        * rendering/RenderThemeChromiumSkia.h:
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::focusRingColor):
-        (WebCore::RenderThemeMac::systemColor):
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::makeRGBAFromCGColor):
-        (WebCore::RenderThemeSafari::focusRingColor):
-        * rendering/RenderThemeSafari.h:
-
-2009-06-26  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by David Levin.
+        Reviewed by Mark Rowe.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26761
-        [Chromium] Enable Dedicated Workers in Chromium.
+        * WebCore.xcodeproj/project.pbxproj: Added the bindings generation
+        scripst to the Copy Headers phase, and marked them as Private.
 
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        Remove the check that prevented workers from being created w/o a command-line switch.
-        The flag itself and methods will be removed in a subsequent patch, after
-        corresponding change in Chromium.
+2010-02-02  Adam Roben  <aroben@apple.com>
 
-2009-06-26  Jessie Berlin  <jberlin@apple.com>
+        Copy WebCore's bindings generation scripts to a more sensible location
 
-        Reviewed by Mark Rowe.
-        
-        Fix: https://bugs.webkit.org/show_bug.cgi?id=26723
-        Where the m_mouseDown event was never being set on windows, so the
-        client X and Y coordinates were always being reported as zero in a
-        dragstart handler.
+        Part of Bug 34496: Clean up WebCore's IDL/script copying
+        <https://bugs.webkit.org/show_bug.cgi?id=34496>
 
-        Test: editing/selection/drag-start-event-client-x-y.html
+        Reviewed by Steve Falkenburg.
 
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMousePressEvent):
-        Set the m_mouseDown event when the mouse press is handled.
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::mouseDown):
-        Removed now redundant setting of m_mouseDown.
+        * WebCore.vcproj/WebCore.make:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+        Instead of copying to obj/WebKit/DOMInterfaces, copy to obj/WebCore/scripts.
 
-2009-06-26  Brady Eidson  <beidson@apple.com>
+2010-02-02  Adam Roben  <aroben@apple.com>
 
-        Tiger build fix
+        Rename the scripts used to copy WebCore's bindings generation scripts
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (swizzleMIMETypeMethodIfNecessary):
+        Part of Bug 34496: Clean up WebCore's IDL/script copying
+        <https://bugs.webkit.org/show_bug.cgi?id=34496>
 
-2009-06-26  Alexey Proskuryakov  <ap@webkit.org>
+        Reviewed by Steve Falkenburg.
 
-        Reviewed by Sam Weinig.
+        * WebCore.vcproj/MigrateScripts: Renamed from WebCore/WebCore.vcproj/MigrateIDLAndScripts.
+        * WebCore.vcproj/migrate-scripts.sh: Renamed from WebCore/WebCore.vcproj/migrate-idls.sh.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26681
-        Problem updating applicationCache when server returns 304
-        
-        Improve the fix, make the test pass on Tiger.
+        * WebCore.vcproj/WebCoreGenerated.vcproj: Updated for renames.
 
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::didReceiveResponse): Fix another code path to remove the
-        current item from list.
+2010-02-02  Adam Roben  <aroben@apple.com>
 
-        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::start): On Tiger,
-        conditional requests that cannot be cached by network layer cause errors with default cache
-        policy.
+        Stop copying IDL files into $(WebKitOutputDir)
 
-2009-06-26  Brady Eidson  <beidson@apple.com>
+        No one uses these anymore (as of r52921).
 
-        Reviewed by Sam Weinig
+        Part of Bug 34496: Clean up WebCore's IDL/script copying
+        <https://bugs.webkit.org/show_bug.cgi?id=34496>
 
-        <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
+        Reviewed by Steve Falkenburg.
 
-        When we disabled content sniffing for file urls we lost knowledge of many file extensions that we
-        didn't intend to lose.  Turns out the CoreTypes UTI database doesn't know about every extension Gatekeeper
-        knew about.
+        * WebCore.vcproj/MigrateIDLAndScripts: Don't copy the IDL files
+        anymore. Keep copying the scripts, though, since other projects
+        (outside of the WebKit repository) do use those.
 
-        By comparing CoreTypes' database to Gatekeepers, this patch adds a hardcoded list of file extension to MIME
-        type mappings that are missing in CoreType's database.
+2010-02-02  Bryan Yeung  <bryeung@google.com>
 
-        Test: platform/mac/fast/loader/file-url-mimetypes.html
+        Reviewed by Darin Adler.
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Move the MIME Type swizzling code to
-          WebCoreURLResponse.
-
-        * platform/network/mac/ResourceResponseMac.mm:
-        (WebCore::ResourceResponse::platformLazyInit): _webcore_MIMEType -> MIMEType, as we now have only one place
-          where we do all MIMEType correction.
-
-        * platform/network/mac/WebCoreURLResponse.h: Remove _webcore_MIMEType, as it is now folded into the swizzled
-          implementation of MIMEType.
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (createBinaryExtensionsSet):
-        (createExtensionToMIMETypeMap):
-        (swizzleMIMETypeMethodIfNecessary):
-        (webNSURLResponseMIMEType): If it's a file URL and there's no MIME type, see if the extension exists in the 
-          extension -> MIME type map before turning to the default MIME type.  Also roll in what was previously
-          implemented in _webcore_MIMEType.
+        Avoid using an invalidated KURL object in baseURI.
 
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::~SVGImage): Tweak this ASSERT - SVGImages might get destroyed without ever having a client.
+        https://bugs.webkit.org/show_bug.cgi?id=34492
 
-2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+        This change fixes baseURI for Chromium (where the KURL implementation
+        does not allow invalid KURLs to carry relative paths).  This is
+        regression tested by
+        LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
 
-        Reviewed by Simon Fraser.
+        * dom/Element.cpp:
+        (WebCore::Element::baseURI):
 
-        Show the fullscreen button only if the backend has support for it.
+2010-02-02  Alexey Proskuryakov  <ap@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26661
+        Reviewed by Darin Adler.
 
-        No test since this is not reachable via the DOM.
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        <rdar://problem/7594601> Crash in mangleme in WebCore::Element::getAttribute
 
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::supportsFullscreen): new
-        * html/HTMLVideoElement.h:
-        (WebCore::HTMLVideoElement::supportsFullscreen): new
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::supportsFullscreen): new
-        (WebCore::MediaPlayer::supportsFullscreen): new
-        * platform/graphics/MediaPlayer.h: new
-        * platform/graphics/MediaPlayerPrivate.h: new
-        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen): new
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): new
-        * rendering/MediaControlElements.h:
+        Test: fast/forms/misplaced-img-form-registration.html
 
-2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::registerImgElement): Assert that the same image isn't added
+        to vector again.
+        (WebCore::HTMLFormElement::removeImgElement): Similarly, assert that we're removing something
+        that's actually registered.
 
-        Reviewed by Simon Fraser.
+        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::~HTMLImageElement): If parser fails
+        to insert the image element, then there will be no removed from tree notification either,
+        need to unregister right away.
 
-        <rdar://problem/7007776> Controller doesn't automatically update counters when file
-        is playing ( http://www.jazzguitar.be/mp3/Michael%20Lewis%20-%20SSSJ.mp3 )
+2010-02-02  Alexander Pavlov  <apavlov@chromium.org>
 
-        Update the time display when the movie time changes.
+        Reviewed by Pavel Feldman.
 
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::updateControls):
+        Web Inspector: Eliminate some of the platform flavor-specific stylesheet selectors
 
-2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+        Extract OS version into WebInspector.platformFlavor
+        https://bugs.webkit.org/show_bug.cgi?id=34469
 
-        Reviewed by Simon Fraser.
+        * inspector/front-end/InspectorBackendStub.js:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub.prototype.platform):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.pendingDispatches.0.URLRegExp.i.get platform):
+        (WebInspector.get platformFlavor):
+        (WebInspector._detectPlatformFlavor):
+        (WebInspector.loaded):
+        (WebInspector.toolbarDragStart):
+        (WebInspector.isMac):
 
-        https://bugs.webkit.org/show_bug.cgi?id=26659
+2010-02-02  Steve Block  <steveblock@google.com>
 
-        Support hidding a control bar element from the Media element controller.
+        Reviewed by Ariya Hidayat.
 
-        Update layout tests since the fullscreen button no longer has a renderer.
+        Adds utility functions for converting between JavaInstance and NPAPI types
+        https://bugs.webkit.org/show_bug.cgi?id=34468
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaTextDisplayElement::update): call updateStyle() so everything
-        is updated properly.
-        (WebCore::MediaControlInputElement::MediaControlInputElement):
-        (WebCore::MediaControlInputElement::update): call updateStyle()
-        (WebCore::MediaControlInputElement::updateStyle): create the renderer properly
-        or not depending on what rendererIsNeeded() return.
-        * rendering/MediaControlElements.h:
+        This is required by Android for injecting objects into V8 JavaScript.
 
-2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+        No new tests, added utility functions only.
 
-        Reviewed by Oliver Hunt.
+        * Android.v8bindings.mk: Modified. Added JavaNPObjectV8.cpp
+        * bridge/jni/v8/JavaNPObjectV8.cpp: Added.
+        (JSC::Bindings::AllocJavaNPObject):
+        (JSC::Bindings::FreeJavaNPObject):
+        (JSC::Bindings::):
+        (JSC::Bindings::JavaInstanceToNPObject):
+        (JSC::Bindings::ExtractJavaInstance):
+        (JSC::Bindings::JavaNPObjectHasMethod):
+        (JSC::Bindings::JavaNPObjectInvoke):
+        (JSC::Bindings::JavaNPObjectHasProperty):
+        (JSC::Bindings::JavaNPObjectGetProperty):
+        * bridge/jni/v8/JavaNPObjectV8.h: Added.
 
-        <rdar://problem/6968137> Profiler title numbers increment even after a
-        reload.
+2010-02-02  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
-        - Now the numbers are reset when the profiles are.
+        Reviewed by Ariya Hidayat.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
+        [Qt] Symbian plugins include a wrong header file for QPixmap
+        https://bugs.webkit.org/show_bug.cgi?id=34475
 
-2009-06-26  Adele Peterson  <adele@apple.com>
+        * plugins/symbian/PluginViewSymbian.cpp:
 
-        Reviewed by Darin Adler.
+2010-02-02  Pavel Feldman  <pfeldman@chromium.org>
 
-        Fix for <rdar://problem/7000796>
-        REGRESSION(34681): Breaking up quoted text makes new, unquoted text blue after certain steps; repros with some messages
+        Reviewed by Timothy Hatcher.
 
-        Test: editing/inserting/break-blockquote-after-delete.html
+        Web Inspector: URLs are not syntax-higlighted as links in source view.
 
-        Keep track of whether the typing style should be preserved after the TypingCommand is applied.  When adding onto an open
-        typing command, keep that flag up to date.
+        This change enables linkifier in the NativeTextViewer. It adds
+        "linkify" and "a_node" parse states into the highlighter in order
+        to detect links and distinguish between resource and external ones.
+        Contains drive-by fix for the webkit-html-* styles and moves them to the
+        common location.
 
-        In this case, an InsertParagraphSeparatorInQuotedContent command, which should not preserve typing style, 
-        was following an open Delete command, which does preserve the typing style.  So we were applying the original
-        typing style (from before the delete, so blue text) to the cursor in the unquoted area after breaking up the blockquote.
+        https://bugs.webkit.org/show_bug.cgi?id=34364
 
-        * editing/TypingCommand.cpp:
-        (WebCore::TypingCommand::TypingCommand):
-        (WebCore::TypingCommand::typingAddedToOpenCommand):
-        (WebCore::TypingCommand::insertTextRunWithoutNewlines):
-        (WebCore::TypingCommand::insertLineBreak):
-        (WebCore::TypingCommand::insertParagraphSeparator):
-        (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
-        (WebCore::TypingCommand::deleteKeyPressed):
-        (WebCore::TypingCommand::forwardDeleteKeyPressed):
-        (WebCore::TypingCommand::deleteSelection):
-        (WebCore::TypingCommand::updatePreservesTypingStyle):
-        * editing/TypingCommand.h: (WebCore::TypingCommand::preservesTypingStyle):
+        * inspector/front-end/NativeTextViewer.js:
+        (WebInspector.NativeTextViewer):
+        (WebInspector.NativeTextViewer.prototype._createSpan):
+        (WebInspector.NativeTextViewer.prototype._createLink):
+        (WebInspector.NativeTextViewer.prototype._rewriteHref):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype._createEditorIfNeeded):
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype._isExpectingAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._isExpectingAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._setExpectingAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._setExpectingAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._stringToken):
+        (WebInspector.SourceHTMLTokenizer.prototype._attrValueTokenType):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._contentLoaded):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspectorSyntaxHighlight.css:
 
-2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+2010-02-02  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Ariya Hidayat.
 
-        Add support for saving and loading of QWebHistory to and from a QByteArray.
+        [Qt] Install libraries and headers in package builds
+        https://bugs.webkit.org/show_bug.cgi?id=34325
 
-        This includes streaming operators for QWebHistory. for convenience.
+        Add the QtWebKit libraries to the installable items, except on
+        Symbian where the libraries are always linked in their final
+        destination.
 
-        New autotests that test QWebHistory and QWebHistoryItem serialization.
+        Also include the headers generated by syncqt in the installation.
 
         * WebCore.pro:
-        * history/HistoryItem.h:
-        (WebCore::HistoryItem::dailyVisitCounts):
-        (WebCore::HistoryItem::weeklyVisitCounts):
-        * history/qt/HistoryItemQt.cpp: Added.
-        (WebCore::HistoryItem::restoreState):
-        (WebCore::HistoryItem::saveState):
 
-2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+2010-02-02  Kavita Kanetkar  <kkanetkar@chromium.org>
 
-        Reviewed by Simon Hausmann.
-
-        Add support for QDataStream operators to String and IntPoint.
-
-        * platform/graphics/IntPoint.h:
-        (WebCore::operator<<):
-        (WebCore::operator>>):
-        * platform/text/PlatformString.h:
-        * platform/text/qt/StringQt.cpp:
-        (WebCore::operator<<):
-        (WebCore::operator>>):
-
-2009-06-26  Ben Murdoch  <benm@google.com>
+        Reviewed by Dmitry Titov.
 
-        Reviewed by Darin Fisher.
+        [V8] Raising an exception while setting timeout/interval from a detached frame
+        https://bugs.webkit.org/show_bug.cgi?id=34453
+        This fixes the issue/failing test mentioned in Chromium bug:
+        http://code.google.com/p/chromium/issues/detail?id=32671
 
-        Add #if ENABLE(DOM_STORAGE) to the V8 custom bindings for local/session storage.
-        https://bugs.webkit.org/show_bug.cgi?id=26757
 
-        * bindings/v8/custom/V8StorageCustom.cpp
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::WindowSetTimeoutImpl):
 
-2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        Test: platform/qt/fast/events/event-sender-keydown-frame.html
-
-        Bug 20303: [Qt] Key events are not working in frames.
+        [BREWMP] Port Screen
+        https://bugs.webkit.org/show_bug.cgi?id=34299
 
-        Merge scrolling handling code in qt and win port, move it to
-        EventHandler.
+        Get the screen size and depth from the main display bitmap.
 
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::scrollRecursively):
-        * page/EventHandler.h:
+        * platform/brew/ScreenBrew.cpp: Added.
+        (WebCore::getDisplayInfo):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
 
-2009-06-26  Rob Buis  <rwlbuis@gmail.com>
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26682
-        Bug 26682: It should be possible to add image to SVG DOM programmatically (using JavaScript)
-
-        Make sure the xlink:href animated property setting syncs the corresponding attribute with the right namespace.
-
-        Test: svg/custom/createImageElement.svg
-
-        * svg/SVGAnimatedProperty.h:
-        (WebCore::synchronizeProperty):
-
-2009-06-26  Takeshi Yoshino  <tyoshino@google.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Bug 26156: In view-source mode, always render the contents using HTMLViewSourceDocument
-        https://bugs.webkit.org/show_bug.cgi?id=26156
-
-        When in view-source mode, render the contents using HTMLViewSourceDocument
-        regardless it's applicable for any plugin or not.
-
-        Chromium tells WebCore to render the contents of specified URL when
-        view-source: prefix is added to the URL. But currently, DOMImplementation
-        ignores inViewSourceMode() when the MIME type is indicating that the contents
-        are neither texts nor HTML family documents.
-
-        For example, we can check the contents of asf file without launching media
-        player. Rendering contents for view-source:-specified input is not what user
-        expects.
-
-        http://code.google.com/p/chromium/issues/detail?id=10545
-
-        I want to fix this issue by this patch. IMHO, regardless of this Chromium
-        specific issue, I think we should force use of HTMLViewSourceDocument when
-        inViewSourceMode() is specified.
-
-        Test: fast/frames/viewsource-on-image-file.html
-
-        * dom/DOMImplementation.cpp:
-        (WebCore::DOMImplementation::createDocument):
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::createTokenizer):
-        * html/HTMLViewSourceDocument.h:
+        [BREWMP] Port LocalizedStrings
+        https://bugs.webkit.org/show_bug.cgi?id=34257
 
-2009-06-26  Xan Lopez  <xlopez@igalia.com>
+        Port LocalizedStrings to BREWMP.
 
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25529
-        [Gtk] Expected states not exposed to assistive technologies
-
-        Add support for VISIBLE, EDITABLE and SENSITIVE states.
+        * platform/brew/LocalizedStringsBrew.cpp: Added.
+        (WebCore::submitButtonDefaultLabel):
+        (WebCore::inputElementAltText):
+        (WebCore::resetButtonDefaultLabel):
+        (WebCore::defaultLanguage):
+        (WebCore::searchableIndexIntroduction):
+        (WebCore::fileButtonChooseFileLabel):
+        (WebCore::fileButtonNoFileSelectedLabel):
+        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
+        (WebCore::contextMenuItemTagDownloadLinkToDisk):
+        (WebCore::contextMenuItemTagCopyLinkToClipboard):
+        (WebCore::contextMenuItemTagOpenImageInNewWindow):
+        (WebCore::contextMenuItemTagDownloadImageToDisk):
+        (WebCore::contextMenuItemTagCopyImageToClipboard):
+        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
+        (WebCore::contextMenuItemTagCopy):
+        (WebCore::contextMenuItemTagGoBack):
+        (WebCore::contextMenuItemTagGoForward):
+        (WebCore::contextMenuItemTagStop):
+        (WebCore::contextMenuItemTagReload):
+        (WebCore::contextMenuItemTagCut):
+        (WebCore::contextMenuItemTagPaste):
+        (WebCore::contextMenuItemTagNoGuessesFound):
+        (WebCore::contextMenuItemTagIgnoreSpelling):
+        (WebCore::contextMenuItemTagLearnSpelling):
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::contextMenuItemTagOpenLink):
+        (WebCore::contextMenuItemTagIgnoreGrammar):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckSpelling):
+        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagFontMenu):
+        (WebCore::contextMenuItemTagBold):
+        (WebCore::contextMenuItemTagItalic):
+        (WebCore::contextMenuItemTagUnderline):
+        (WebCore::contextMenuItemTagOutline):
+        (WebCore::contextMenuItemTagWritingDirectionMenu):
+        (WebCore::contextMenuItemTagDefaultDirection):
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+        (WebCore::contextMenuItemTagInspectElement):
+        (WebCore::searchMenuNoRecentSearchesText):
+        (WebCore::searchMenuRecentSearchesText):
+        (WebCore::searchMenuClearRecentSearchesText):
+        (WebCore::unknownFileSizeText):
+        (WebCore::AXWebAreaText):
+        (WebCore::AXLinkText):
+        (WebCore::AXListMarkerText):
+        (WebCore::AXImageMapText):
+        (WebCore::AXHeadingText):
+        (WebCore::imageTitle):
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+        (WebCore::AXButtonActionVerb):
+        (WebCore::AXTextFieldActionVerb):
+        (WebCore::AXRadioButtonActionVerb):
+        (WebCore::AXCheckedCheckBoxActionVerb):
+        (WebCore::AXUncheckedCheckBoxActionVerb):
+        (WebCore::AXLinkActionVerb):
+        (WebCore::AXMenuListPopupActionVerb):
+        (WebCore::AXMenuListActionVerb):
+        (WebCore::AXDefinitionListTermText):
+        (WebCore::AXDefinitionListDefinitionText):
+        (WebCore::validationMessageValueMissingText):
+        (WebCore::validationMessageTypeMismatchText):
+        (WebCore::validationMessagePatternMismatchText):
+        (WebCore::validationMessageTooLongText):
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+        (WebCore::validationMessageStepMismatchText):
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (setAtkStateSetFromCoreObject):
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Darin Adler.
+        [BREWMP] Port systemBeep
+        https://bugs.webkit.org/show_bug.cgi?id=33601
 
-        "Pointer to incomplete class type is not allowed" error with RVCT
-        https://bugs.webkit.org/show_bug.cgi?id=26721
+        Implement systemBeep with IShell_Beep.
 
-        Based on Norbert Leser's work.
+        * platform/brew/SoundBrew.cpp: Added.
+        (WebCore::systemBeep):
 
-        * dom/Document.cpp:
-        (WebCore::Document::setFocusedNode):
-        * dom/Node.cpp:
-        (WebCore::Node::dispatchMouseEvent):
-        * dom/Node.h: Remove the default value for PassRefPtr<Event> args,
-        to eliminate dependency on the Event class definition
+2010-02-02  Shinichiro Hamaji  <hamaji@chromium.org>
 
-2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Maciej Stachowiak.
+        [Win] Utilize PrintContext to share the printing code with other ports
+        https://bugs.webkit.org/show_bug.cgi?id=34312
 
-        [Qt] Build fix after r45183
-        https://bugs.webkit.org/show_bug.cgi?id=26748
+        No new tests as this is just a small refactoring.
 
-        * WebCore.pro:
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-2009-06-25  Alexey Proskuryakov  <ap@webkit.org>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Darin Adler.
+        [BREWMP] Add conversions between IntPoint and AEEPoint
+        https://bugs.webkit.org/show_bug.cgi?id=34194
 
-        https://bugs.webkit.org/show_bug.cgi?id=26681
-        <rdar://problem/7003461> Problem updating applicationCache when server returns 304
+        Make it easy to convert between IntPoint and AEEPoint.
 
-        Test: http/tests/appcache/update-cache.html
+        * platform/graphics/IntPoint.h:
+        * platform/graphics/brew/IntPointBrew.cpp: Added.
+        (WebCore::IntPoint::IntPoint):
+        (WebCore::IntPoint::operator AEEPoint):
 
-        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::didReceiveResponse):
-        We're already done with the resource, don't try to load it again.
+2010-02-02  Steve Block  <steveblock@google.com>
 
-2009-06-25  Simon Fraser  <simon.fraser@apple.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Oliver Hunt.
-        
-        <rdar://problem/6990481>
-        
-        Handle perspective computation on non-layer objects.
+        Adds virtual destructors for AbstractWeakReferenceMap and AbstractWeakReferenceMap::Visitor
+        https://bugs.webkit.org/show_bug.cgi?id=34434
 
-        Test: transforms/3d/general/perspective-non-layer.html
+        No new tests, build fix only.
 
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::getTransformFromContainer):
+        * bindings/v8/V8DOMMap.h: Modified.
+        (WebCore::AbstractWeakReferenceMap::~AbstractWeakReferenceMap): Added.
+        (WebCore::AbstractWeakReferenceMap::Visitor::~Visitor): Added.
 
-2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+2010-02-02  Avi Drissman  <avi@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26653
+        Sync up Chromium Mac render theme to Mac render theme
+        https://bugs.webkit.org/show_bug.cgi?id=34340
 
-        Use flex box in the mediaControls.css style, to nicely scale if a button gets
-        dynamically added or removed.
-
-        Media tests results are affected by this changes.
-
-        * css/mediaControls.css:
-        * css/mediaControlsQT.css:
+        Covered by existing layout tests.
 
-2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+        * platform/chromium/ThemeChromiumMac.mm:
+        (WebCore::updateStates):
+        (WebCore::checkbox):
+        (WebCore::paintCheckbox):
+        (WebCore::radio):
+        (WebCore::paintRadio):
+        (WebCore::listButtonSizes):
+        (WebCore::setupButtonCell):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeChromiumMac::controlSize):
+        (WebCore::ThemeChromiumMac::minimumControlSize):
+        (WebCore::ThemeChromiumMac::controlBorder):
+        (WebCore::ThemeChromiumMac::paint):
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (-[WebCoreRenderThemeNotificationObserver initWithTheme:WebCore::]):
+        (WebCore::convertNSColorToColor):
+        (WebCore::RenderThemeChromiumMac::systemColor):
+        (WebCore::RenderThemeChromiumMac::isControlStyled):
+        (WebCore::RenderThemeChromiumMac::adjustRepaintRect):
+        (WebCore::RenderThemeChromiumMac::convertToPaintingRect):
+        (WebCore::RenderThemeChromiumMac::paintCapsLockIndicator):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
+        (WebCore::RenderThemeChromiumMac::adjustMenuListStyle):
+        (WebCore::RenderThemeChromiumMac::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumMac::paintSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintSearchField):
+        (WebCore::RenderThemeChromiumMac::setSearchFieldSize):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
+        (WebCore::RenderThemeChromiumMac::popupButton):
+        (WebCore::RenderThemeChromiumMac::sliderThumbHorizontal):
+        (WebCore::RenderThemeChromiumMac::sliderThumbVertical):
 
-        Reviewed by Darin Fisher.
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26724
+        Reviewed by Eric Seidel.
 
-        Move relavent part of setDefaultFontSize from RenderThemeChromiumWin
-        up into RenderThemeChromiumSkia.
+        [BREWMP] Port Logging
+        https://bugs.webkit.org/show_bug.cgi?id=34300
 
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::setDefaultFontSize):
-        * rendering/RenderThemeChromiumSkia.h:
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::setDefaultFontSize):
-        * rendering/RenderThemeChromiumWin.h:
+        Log calls to notImplemented() by default.
 
-2009-06-25  Matt Perry  <mpcomplete@chromium.org>
+        * platform/brew/LoggingBrew.cpp: Added.
+        (WebCore::InitializeLoggingChannelsIfNecessary):
 
-        Reviewed by Darin Fisher.
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26733
+        Reviewed by Eric Seidel.
 
-        Add V8-only methods to FrameLoaderClient that V8 can use to send
-        out notifications when it creates/destroys a script context.
+        [BREWMP] Port FileChooser
+        https://bugs.webkit.org/show_bug.cgi?id=34261
 
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::didCreateScriptContext):
-        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContext):
-        * loader/FrameLoaderClient.h:
-        (WebCore::FrameLoaderClient::didCreateScriptContext):
-        (WebCore::FrameLoaderClient::didDestroyScriptContext):
+        Port FileChooser to BREWMP.
 
-2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+        * platform/brew/FileChooserBrew.cpp: Added.
+        (WebCore::FileChooser::basenameForWidth):
 
-        Reviewed by David Levin.
+2010-02-01  Zoltan Horvath  <zoltan@webkit.org>
 
-        Correct a few typos that snuck in when I was reformatting CodeGeneratorV8.pm
-        to match WebKit style.
+        Reviewed by Darin Adler.
 
-        * bindings/scripts/CodeGeneratorV8.pm: Corrected lots of typos.
+        Allow custom memory allocation control for IconDatabaseClient class
+        https://bugs.webkit.org/show_bug.cgi?id=33252
 
-2009-06-25  Adam Langley  <agl@google.com>
+        Inherits the following struct from Noncopyable because it is 
+        instantiated by 'new' and no need to be copyable:
 
-        TBRed: fix for Chromium tree.
+        class name               - instantiated at: WebCore/'location'
+        class IconDatabaseClient - loader/icon/IconDatabase.cpp:89
 
-        Add missing include for r45199.
+        * loader/icon/IconDatabaseClient.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=26736
+2010-02-01  Kwang Yul Seo  <skyul@company100.net>
 
-        r45199 added a reference to throwError without including V8Proxy.h
+        Reviewed by Eric Seidel.
 
-        * bindings/v8/WorkerScriptController.cpp:
+        [BREWMP] Port MIMETypeRegistry
+        https://bugs.webkit.org/show_bug.cgi?id=34220
 
-2009-06-25  Adam Langley  <agl@google.com>
+        Port MIMETypeRegistry with an extension map as other ports do.
 
-        TBRed: fix for Chromium tree.
+        * platform/brew: Added.
+        * platform/brew/MIMETypeRegistryBrew.cpp: Added.
+        (WebCore::):
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
 
-        https://bugs.webkit.org/show_bug.cgi?id=26735
+2010-02-01  Dmitry Titov  <dimich@chromium.org>
 
-        Fix V8IsolatedWorld to point to the correct include file.
+        Not reviewed, revert r54194 that fails new test on Qt and Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=34382
 
-        The deprecated v8_index.h was removed from the Chromium tree in r19291
-        and upstreamed into WebKit with r45193. However V8IsolatedWorld
-        slipped in between the cracks and broke the build.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::setNameAndOpenURL):
+        (WebCore::HTMLFrameElementBase::insertedIntoDocument):
+        * html/HTMLFrameElementBase.h:
+        * page/Frame.cpp:
+        * page/Frame.h:
 
-        * bindings/v8/V8IsolatedWorld.h: update with new header location.
+2010-02-01  Shinichiro Hamaji  <hamaji@chromium.org>
 
-2009-06-25  Chris Marrin  <cmarrin@apple.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+        Provide a way to get page number with layoutTestController
+        https://bugs.webkit.org/show_bug.cgi?id=33840
 
-        https://bugs.webkit.org/show_bug.cgi?id=26651
-        
-        Preference is named "WebKitAcceleratedCompositingEnabled"
-        and is a boolean value. When false, prevents compositing layers from
-        being created, which prevents hardware animation from running.
-        Also forces video to do software rendering. Added a cache for
-        the flag in RenderLayerCompositing and made it all work
-        on-the-fly when the flag is changed while a page is loaded.
+        Test: printing/page-break-always.html
 
         * WebCore.base.exp:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::updateCompositingLayers):
-        * page/Settings.cpp:
-        (WebCore::setNeedsReapplyStylesInAllFrames):
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setAcceleratedCompositingEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::acceleratedCompositingEnabled):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::hasAcceleratedCompositing):
-        (WebCore::RenderLayer::updateTransform):
-        (WebCore::RenderLayer::currentTransform):
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateLayerTransform):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
-        (WebCore::RenderLayerCompositor::enableCompositingMode):
-        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
-        (WebCore::RenderLayerCompositor::updateCompositingLayers):
-        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::needsToBeComposited):
-        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
-        * rendering/RenderLayerCompositor.h:
-        (WebCore::RenderLayerCompositor::hasAcceleratedCompositing):
-        * rendering/RenderObject.h:
-        (WebCore::makeMatrixRenderable):
-
-2009-06-25  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Bug 26701: Implement the missing code for "FIXME: Need to return an
-        exception" in WorkerScriptController::evaluate for v8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=26701
-
-        * bindings/v8/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-
-2009-06-25  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Upstream V8Index.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26495
-
-        * bindings/v8/V8Index.cpp: Added.
-        (WebCore::V8ClassIndex::GetFactory): Moved from src.chromium.org.
-        (WebCore::V8ClassIndex::GetCache): Moved from src.chromium.org.
-        * bindings/v8/V8Index.h:
-        (WebCore::V8ClassIndex::): Moved from src.chromium.org.
-        (WebCore::V8ClassIndex::ToInt): Moved from src.chromium.org.
-        (WebCore::V8ClassIndex::FromInt): Moved from src.chromium.org.
-
-2009-06-25  Adam Langley  <agl@google.com>
-
-        Reviewed by Darin Fisher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26529
-
-        This is hopefully the last step before our renderers can run
-        cleanly in a chroot.
-
-        WebKit needs to be able to ask for the correct font to use in
-        the case that the current font doesn't include glyphs for
-        certain code points. Currently we make a fontconfig call in our
-        WebKit port to handle this.
-
-        This patch changes this so that the call is sent our via
-        ChromiumBridge.
-
-        http://codereview.chromium.org/132007
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::pageRect): Added a getter function.
+        (WebCore::PrintContext::computePageRects): Move its logic into computePageRectsWithPageSize.
+        (WebCore::PrintContext::computePageRectsWithPageSize): Factored out from computePageRects for pageNumberForElement.
+        (WebCore::enclosingBoxModelObject): Added for pageNumberForElement.
+        (WebCore::PrintContext::pageNumberForElement): Added for testing.
+        * page/PrintContext.h:
 
-        This should not affect any layout tests.
+2010-02-01  Kwang Yul Seo  <skyul@company100.net>
 
-        * platform/chromium/ChromiumBridge.h:
-        * platform/graphics/chromium/FontCacheLinux.cpp:
-        (WebCore::FontCache::getFontDataForCharacters):
-
-2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+        Reviewed by Eric Seidel.
 
-        Reviewed by David Levin.
+        [BREWMP] Add conversions between IntSize and AEESize
+        https://bugs.webkit.org/show_bug.cgi?id=34197
 
-        https://bugs.webkit.org/show_bug.cgi?id=26566
-        Upstream these files from the chromium v8 code.  No tests were
-        affected because this is essentially a code move.
+        Make it easy to convert between IntSize and AEESize.
 
-        * bindings/v8/NPV8Object.cpp: Added.
-        (allocV8NPObject):
-        (freeV8NPObject):
-        (listFromVariantArgs):
-        (npIdentifierToV8Identifier):
-        (npCreateV8ScriptObject):
-        (NPN_Invoke):
-        (NPN_InvokeDefault):
-        (NPN_Evaluate):
-        (NPN_EvaluateHelper):
-        (NPN_GetProperty):
-        (NPN_SetProperty):
-        (NPN_RemoveProperty):
-        (NPN_HasProperty):
-        (NPN_HasMethod):
-        (NPN_SetException):
-        (NPN_Enumerate):
-        (NPN_Construct):
-        * bindings/v8/NPV8Object.h: Added.
-        (PrivateIdentifier::):
-        * bindings/v8/V8NPUtils.cpp: Added.
-        (convertV8ObjectToNPVariant):
-        (convertNPVariantToV8Object):
-        (getStringIdentifier):
-        * bindings/v8/V8NPUtils.h: Added.
-
-2009-06-25  Shinichiro Hamaji  <hamaji@chromium.org>
+        * platform/graphics/IntSize.h:
+        * platform/graphics/brew/IntSizeBrew.cpp: Added.
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator AEESize):
+
+2010-02-01  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for Pattern transformations in Chromium/Skia.  This required 
+        reworking Pattern a bit to be more like the Gradient implementation.
+        In particular, it now holds an m_pattern reference to the
+        platform-specific implementation, and passes along changes to the
+        m_patternSpaceTransformation, in the same way that Gradient does for
+        m_gradientSpaceTransformation.  This is necessary since Skia creates the
+        platform-specific pattern (SkShader) once, rather than recreating it
+        on each draw.
+        For platforms other than Skia, m_pattern is unused, they will
+        continue to use the static createPlatformPattern(), and the new
+        notification functions are stubbed out.  Other platforms can switch to
+        the new implementation if they so choose.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24534 
+
+        Covered by svg/custom/pattern-y-offset.svg,
+        svg/custom/pattern-cycle-detection.svg, and many more.
+
+        * platform/graphics/Pattern.cpp:
+        (WebCore::Pattern::Pattern):
+        Initializer for m_pattern.
+        (WebCore::Pattern::~Pattern):
+        call platformDestroy().
+        (WebCore::Pattern::setPatternSpaceTransform):
+        Pass along the transform via setPlatformPatternSpaceTransform().
+        (WebCore::Pattern::platformDestroy):
+        (WebCore::Pattern::setPlatformPatternSpaceTransform):
+        Stub implementations for non-skia platforms.
+        * platform/graphics/Pattern.h:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformFillPattern):
+        (WebCore::GraphicsContext::setPlatformStrokePattern):
+        Call platformPattern() instead of static version.
+        Since Pattern now owns its SkShader, no need to unref here.
+        * platform/graphics/skia/PatternSkia.cpp:
+        (WebCore::Pattern::platformDestroy):
+        Unref the SkShader on destroy.
+        (WebCore::Pattern::platformPattern):
+        Create the platform pattern (SkShader) once, and cache it.
+        (WebCore::Pattern::setPlatformPatternSpaceTransform):
+        Set the shader's local matrix from the m_patternSpaceTransformation.
+
+2010-02-01  Daniel Bates  <dbates@webkit.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Adam Barth.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26436
+        https://bugs.webkit.org/show_bug.cgi?id=27312
 
-        Windows Chromium bug fix: save context of destination canvas in
-        TransparencyWin::compositeTextComposite() before the function
-        modifies the context.
+        Implements support for full page blocking via the X-XSS-Protection header.
 
-        Test: fast/canvas/translate-text.html
+        Tests: http/tests/security/xssAuditor/full-block-base-href.html
+               http/tests/security/xssAuditor/full-block-get-from-iframe.html
+               http/tests/security/xssAuditor/full-block-iframe-javascript-url.html
+               http/tests/security/xssAuditor/full-block-iframe-no-inherit.php
+               http/tests/security/xssAuditor/full-block-javascript-link.html
+               http/tests/security/xssAuditor/full-block-link-onclick.html
+               http/tests/security/xssAuditor/full-block-object-tag.html
+               http/tests/security/xssAuditor/full-block-post-from-iframe.html
+               http/tests/security/xssAuditor/full-block-script-tag-with-source.html
+               http/tests/security/xssAuditor/full-block-script-tag.html
+               http/tests/security/xssAuditor/malformed-xss-protection-header.html
 
-        * platform/graphics/chromium/TransparencyWin.cpp:
-        (WebCore::TransparencyWin::compositeTextComposite):
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::shouldFullPageBlockForXSSProtectionHeader): Added.
+        (WebCore::XSSAuditor::findInRequest): Modified to call method
+        XSSAuditor::shouldFullPageBlockForXSSProtectionHeader.
+        * page/XSSAuditor.h: Defined method shouldFullPageBlockForXSSProtectionHeader
+        and fixed misspelled words in large comment block.
 
-2009-06-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+2010-02-01  Kwang Yul Seo  <skyul@company100.net>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Eric Seidel.
 
-        Show the filename and first line for "(program)" in the Profiler/Debugger
-        https://bugs.webkit.org/show_bug.cgi?id=25475
+        [BREWMP] Port SharedTimer with IShell_SetTimerEx.
+        https://bugs.webkit.org/show_bug.cgi?id=33599
 
-        Add support to associate a sourceURL with an eval()'d string
-        via a @sourceURL comment.  Currently the sourceURL is only available
-        in the script debugger, not in the console or profiler, but it's
-        most needed in the script debugger.
+        As fireTime passed in setSharedTimerFireTime is the absolute time,
+        we must calcalute the interval by subtracting currentTime() from
+        fireTime and pass the result to ISHELL_SetTimerEx.
 
-        * English.lproj/localizedStrings.js: added new "(program): %s" string
-        * inspector/front-end/Script.js:
-        (WebInspector.Script): if no sourceURL is available for the Script,
-        search for a comment of the form //@ sourceURL=(url) to use
-        as the sourceURL instead.
-        * manual-tests/inspector/named-evals.html: Added.
+        * platform/brew/SharedTimerBrew.cpp: Added.
+        (WebCore::invokeCallback):
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
 
-2009-06-25  John Gregg  <johnnyg@google.com>
+2010-02-01  Shinichiro Hamaji  <hamaji@chromium.org>
 
-        Reviewed by Sam Weinig.
+        [Chromium] Unreviewed attempt to fix the chromium build.
 
-        Bug 23721: Changing dropdown's selectedIndex within onchange handler fires another onchange
-        https://bugs.webkit.org/show_bug.cgi?id=23721
+        Corresponding change: http://trac.webkit.org/changeset/54182
 
-        onchange events fire when a SELECT element has
-        focus and the selectedIndex is updated by script in some way--either
-        during another onchange, onkeypress, onfocus, or timer--and then
-        focus is lost. 
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        * bindings/v8/ScriptController.h:
 
-        Fixed by making a separate method for user-driven selectedIndex 
-        changes, leaving scripts to use one which doesn't cause onchange to
-        be queued.
-        
-        Test: fast/forms/select-script-onchange.html
-
-        * dom/SelectElement.cpp: check if the pending change is user driven
-        before calling onchange
-        (WebCore::SelectElement::menuListOnChange):
-        (WebCore::SelectElement::setSelectedIndex):
-        * dom/SelectElement.h: store whether the pending change is user driven
-        (WebCore::SelectElementData::userDrivenChange):
-        (WebCore::SelectElementData::setUserDrivenChange):
-        * html/HTMLSelectElement.cpp: split into two methods -- script version
-        [non-user-driven] corresponds to IDL defined property name
-        (WebCore::HTMLSelectElement::setSelectedIndex):
-        (WebCore::HTMLSelectElement::setSelectedIndexByUser):
-        * html/HTMLSelectElement.h: 
-        * rendering/RenderMenuList.cpp: use ByUser method when coming through
-        the renderer
-        (WebCore::RenderMenuList::valueChanged):
+2010-02-01  Dmitry Titov  <dimich@chromium.org>
 
-2009-06-25  Jeremy Orlow  <jorlow@chromium.org>
+        Reviewed by David Levin.
 
-        Reviewed by Darin Fisher.
+        When a live iframe element is moved between pages, it still depends on the old page.
+        https://bugs.webkit.org/show_bug.cgi?id=34382
 
-        https://bugs.webkit.org/show_bug.cgi?id=26698
+        Test: fast/frames/iframe-reparenting-new-page.html
 
-        Combined LocalStorageArea and SessionStorageArea into StorageArea since
-        (after my other refactorings) there are no longer substantial
-        differences between the two.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::setName):
+        Move the code setting the frame name into a separate function.
 
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/LocalStorage.cpp:
-        (WebCore::LocalStorage::storageArea):
-        * storage/LocalStorage.h:
-        * storage/LocalStorageArea.cpp: Removed.
-        * storage/LocalStorageArea.h: Removed.
-        * storage/SessionStorage.cpp:
-        (WebCore::SessionStorage::copy):
-        (WebCore::SessionStorage::storageArea):
-        * storage/SessionStorage.h:
-        * storage/SessionStorageArea.cpp: Removed.
-        * storage/SessionStorageArea.h: Removed.
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::createLocalStorage):
-        (WebCore::StorageArea::StorageArea):
-        (WebCore::StorageArea::createSessionStorage):
-        (WebCore::StorageArea::copy):
-        (WebCore::StorageArea::setItem):
-        (WebCore::StorageArea::removeItem):
-        (WebCore::StorageArea::clear):
-        (WebCore::StorageArea::scheduleFinalSync):
-        (WebCore::StorageArea::blockUntilImportComplete):
-        (WebCore::StorageArea::dispatchStorageEvent):
-        * storage/StorageArea.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::StorageAreaSync):
-        (WebCore::StorageAreaSync::scheduleFinalSync):
-        (WebCore::StorageAreaSync::syncTimerFired):
-        (WebCore::StorageAreaSync::performImport):
-        * storage/StorageAreaSync.h:
-        * storage/StorageSyncManager.h:
+        (WebCore::HTMLFrameElementBase::setNameAndOpenURL):
+        (WebCore::HTMLFrameElementBase::updateLiveFrame):
+        Update frame tree, reset page in the contentFrame and re-set the name.
 
-2009-06-25  Dan Bernstein  <mitz@apple.com>
+        (WebCore::HTMLFrameElementBase::insertedIntoDocument): 
+        * html/HTMLFrameElementBase.h:
 
-        Reviewed by Darin Adler.
+        * page/Frame.cpp:
+        (WebCore::Frame::setPage):
+        * page/Frame.h: Add setPage method. It is only currently used when iframe is
+                        moved between pages (so the ASSERT(m_ownerElement).
 
-        - fix https://bugs.webkit.org/show_bug.cgi?id=26671
-          <rdar://problem/7001880> Safari 4.0 crashes in
-          WebCore::DOMTimer::fired()
+2010-02-01  Brady Eidson  <beidson@apple.com>
 
-        Test: fast/dom/style-sheet-candidate-remove-unrendered-document.html
+        Reviewed by Tim Hatcher.
 
-        When a "style sheet candidate" element is removed from a document,
-        call Document::removeStyleSheetCandidateNode() regardless of whether
-        the document is rendered. Otherwise, the document's style sheet
-        candidate set can end up containing stale references.
+        Add common IRC ports to port blocking.
+        <rdar://problem/7593895> and https://bugs.webkit.org/show_bug.cgi?id=34451
 
-        * dom/ProcessingInstruction.cpp:
-        (WebCore::ProcessingInstruction::removedFromDocument):
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::removedFromDocument):
-        * html/HTMLStyleElement.cpp:
-        (WebCore::HTMLStyleElement::removedFromDocument):
+        * platform/KURL.cpp:
+        (WebCore::portAllowed):
 
-2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-01-29  Jeremy Orlow  <jorlow@chromium.org>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Nate Chapin.
 
-        Update CodeGeneratorV8.pm to sync up with the changes downstream.
+        [V8] Add compile time guards for IndexedDB custom functions
+        https://bugs.webkit.org/show_bug.cgi?id=34368
 
-        * bindings/scripts/CodeGeneratorV8.pm: Added HTMLFrameSetElement check,
-          FileList as a ref-counted type, and DataGridColumn as typeCanFailConversion.
+        * bindings/v8/custom/V8IDBRequestCustom.cpp:
+        * bindings/v8/custom/V8IndexedDatabaseRequestCustom.cpp:
 
-2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-01-29  Gavin Barraclough  <barraclough@apple.com>
 
-        Unreviewed, build fix.
+        Reviewed by Sam Weinig + Oliver Hunt.
 
-        Add FileList.h include to fix Chromium build.
+        Bug 34346 - With JSC bindings, make processingUserGesture work with events in Isolated Worlds
 
-        * platform/chromium/ClipboardChromium.cpp: Added FileList.h include.
+        Change HTMLMediaElement methods that require checking whether the event is a user gesture to
+        be passed a boolean.  This may be passed from the JSC bindings (where we have an exec state),
+        or read from the event.  Add a Flag to the IDL to mark this information is required.
 
-2009-06-25  Joseph Pecoraro  <joepeck02@gmail.com>
+        * WebCore.Video.exp:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::processingUserGesture):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::domWindowAllowPopUp):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::processingUserGestureEvent):
+        (WebCore::ScriptController::anyPageIsProcessingUserGesture):
+        * bindings/js/ScriptController.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Event.cpp:
+        (WebCore::Event::isUserEvent):
+        * dom/Event.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::removedFromDocument):
+        (WebCore::HTMLMediaElement::load):
+        (WebCore::HTMLMediaElement::play):
+        (WebCore::HTMLMediaElement::pause):
+        (WebCore::HTMLMediaElement::beginScrubbing):
+        (WebCore::HTMLMediaElement::documentDidBecomeActive):
+        (WebCore::HTMLMediaElement::webkitEnterFullScreen):
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isProcessingUserGesture):
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::allowPopUp):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlSeekButtonElement::defaultEventHandler):
 
-        Reviewed by Jan Alonzo.
+2010-02-01  Andreas Kling  <andreas.kling@nokia.com>
 
-        Bug 26489: Web Inspector: Typo in DatabaseQuery Error Message
-        https://bugs.webkit.org/show_bug.cgi?id=26489
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Fixed a Typo in a Web Inspector error message.
+        [Qt] Use the fallback style on Maemo 5
 
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/DatabaseQueryView.js:
-        (WebInspector.DatabaseQueryView.prototype._queryError):
+        https://bugs.webkit.org/show_bug.cgi?id=34376
 
-2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::fallbackStyle):
+        (WebCore::RenderThemeQt::qStyle):
+        (WebCore::RenderThemeQt::setPaletteFromPageClientIfExists):
+        * platform/qt/RenderThemeQt.h:
 
-        Fix the Qt build, add missing StorageAreaSync files to the build.
+2010-02-01  Kavita Kanetkar  <kkanetkar@chromium.org>
 
-        * WebCore.pro:
+        Reviewed by Nate Chapin.
 
-2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+        [V8] Making V8 generated classes' GetTemplate() function public
+        https://bugs.webkit.org/show_bug.cgi?id=34026
 
-        Reviewed by and done with Tor Arne Vestbø.
+        * bindings/scripts/CodeGeneratorV8.pm: Generated code need not depend on V8CustomBinding.h, made GetTemplate() signature public.
 
-        Fix shortcut keyboard handling with plugins on the Qt/Mac build.
+2010-02-01  Steve Block  <steveblock@google.com>
 
-        When we receive shortcut events like Ctrl+V then the text in the QKeyEvent is
-        empty. If we're asked to disambiguate the event into a Char keyboard event,
-        we try to detect this situation and still set the text, to ensure that the
-        general event handling sends a key press event after this disambiguation.
+        Reviewed by Ariya Hidayat.
 
-        * platform/qt/PlatformKeyboardEventQt.cpp:
-        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        Adds V8-specific JNI bridge classes
+        https://bugs.webkit.org/show_bug.cgi?id=34166
 
-2009-06-25  Eric Seidel  <eric@webkit.org>
+        This is the V8 equivalent of bridge/jni/jsc/JNIBridgeJSC.
 
-        Build fix only, no review.
+        No new tests, build fix only.
 
-        Add FileList.h and NotImplemented.h includes in an attempt to fix bots.
+        * Android.v8bindings.mk: Modified. Added JNIBridge.cpp and JNIBridgeV8.cpp
+        * bridge/Bridge.h: Modified. Added missing include for Noncopyable.h
+        * bridge/jni/v8/JNIBridgeV8.cpp: Added.
+        (JavaField::JavaField):
+        * bridge/jni/v8/JNIBridgeV8.h: Added.
+        (JSC::Bindings::JavaField::name):
+        (JSC::Bindings::JavaField::type):
+        (JSC::Bindings::JavaField::getJNIType):
 
-        * platform/gtk/ClipboardGtk.cpp:
-        * platform/qt/ClipboardQt.cpp:
-        * platform/win/ClipboardWin.cpp:
-        * platform/wx/ClipboardWx.cpp:
+2010-02-01  Steve Block  <steveblock@google.com>
 
-2009-05-21  Eric Seidel  <eric@webkit.org>
+        Reviewed by Ariya Hidayat.
 
-        Reviewed by Maciej Stachowiak.
+        Adds V8-specific JNI utility functions.
+        https://bugs.webkit.org/show_bug.cgi?id=33901
 
-        Expose files in the clipboard in ondrop events
-        https://bugs.webkit.org/show_bug.cgi?id=25916
+        This is the V8 equivalent of bridge/jni/jsc/JNIUtilityPrivate.
 
-        Make it possible for applications like gmail to implement
-        drag and drop of attachments onto email messages.
+        No new tests, build fix only.
 
-        This patch exposes an event.dataTransfer.files accessor
-        on the drop event.  No information is exposed during dragover.
-        This follows the HTML 5 drag and drop security model:
-        http://www.w3.org/TR/html5/editing.html#security-risks-in-the-drag-and-drop-model
-        The test http/tests/security/clipboard/clipboard-file-access.html
-        verifies this behavior.
+        * Android.v8bindings.mk: Modified. Add JNIUtilityPrivate.cpp
+        * bridge/jni/v8/JNIUtilityPrivate.cpp: Added.
+        (JSC::Bindings::convertNPVariantToJValue):
+        (JSC::Bindings::convertJValueToNPVariant):
+        * bridge/jni/v8/JNIUtilityPrivate.h: Added.
 
-        Internet Explorer shows historical documentation of supporting
-        getData('File') as a way of exposing files on the pasteboard.  The current version of their docs:
-        http://msdn.microsoft.com/en-us/library/ms537658(VS.85).aspx
-        has removed this reference (as far as I can tell IE never implemented it)
-        I have a printed copy of that URL from 2008 on my desk describing getData('File') in IE.
-        IE does not follow the HTML5 clipboard security model and always allows access to the full clipboard, even on dragover.
+2010-02-01  Steve Block  <steveblock@google.com>
 
-        I choose not to use IE's getData('File') and instead added .files
-        so that the accessor could have a type, matching WebKit's existing
-        .files accessor on HTMLInputElement.
+        Reviewed by Ariya Hidayat.
 
-        Mozilla has equivalent file access:
-        event.dataTransfer.mozGetDataAt("application/x-moz-file", 0);
-        which also does not return a typed value.
-        https://developer.mozilla.org/En/DragDrop/Recommended_Drag_Types#Dragging_Files
+        Adds V8 version of JavaClass
+        https://bugs.webkit.org/show_bug.cgi?id=33898
 
-        This is only implemented for Mac WebKit.  All other platforms (including Apple's Win WebKit)
-        have incomplete Clipboard implementations and will require experts from those platforms
-        to add this functionality.  Right now they all have Clipboard*::files() methods which call notImplemented();
+        This is the V8 equivalent of bridge/jni/jsc/JavaClassJSC
 
-        Test: http/tests/security/clipboard/clipboard-file-access.html
+        No new tests, build fix only.
 
-        * dom/Clipboard.h:
-        * dom/Clipboard.idl:
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::files):
-        * platform/chromium/ClipboardChromium.h:
-        * platform/gtk/ClipboardGtk.cpp:
-        (WebCore::ClipboardGtk::files):
-        * platform/gtk/ClipboardGtk.h:
-        * platform/mac/ClipboardMac.h:
-        * platform/mac/ClipboardMac.mm:
-        (WebCore::absoluteURLsFromPasteboardFilenames):
-        (WebCore::absoluteURLsFromPasteboard):
-        (WebCore::ClipboardMac::files):
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::files):
-        * platform/qt/ClipboardQt.h:
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::ClipboardWin::files):
-        * platform/win/ClipboardWin.h:
-        * platform/wx/ClipboardWx.cpp:
-        (WebCore::ClipboardWx::files):
-        * platform/wx/ClipboardWx.h:
+        * Android.v8bindings.mk: Modified. Added JavaClassV8.cpp
+        * bridge/jni/v8/JavaClassV8.cpp: Added.
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        (JavaClass::methodsNamed):
+        (JavaClass::fieldNamed):
+        * bridge/jni/v8/JavaClassV8.h: Added.
 
-2009-06-25  Eric Seidel  <eric@webkit.org>
+2010-02-01  Steve Block  <steveblock@google.com>
 
-        No review, only completing revert of r45144.
+        Reviewed by Ariya Hidayat.
 
-        Add back files deleted by r45144.
+        Adds V8 version of JavaInstance
+        https://bugs.webkit.org/show_bug.cgi?id=33951
 
-        * storage/LocalStorageArea.cpp: Added.
-        (WebCore::LocalStorageArea::create):
-        (WebCore::LocalStorageArea::LocalStorageArea):
-        (WebCore::LocalStorageArea::scheduleFinalSync):
-        (WebCore::LocalStorageArea::itemChanged):
-        (WebCore::LocalStorageArea::itemRemoved):
-        (WebCore::LocalStorageArea::areaCleared):
-        (WebCore::LocalStorageArea::blockUntilImportComplete):
-        (WebCore::LocalStorageArea::dispatchStorageEvent):
-        * storage/LocalStorageArea.h: Added.
-        * storage/SessionStorageArea.cpp: Added.
-        (WebCore::SessionStorageArea::copy):
-        (WebCore::SessionStorageArea::SessionStorageArea):
-        (WebCore::SessionStorageArea::itemChanged):
-        (WebCore::SessionStorageArea::itemRemoved):
-        (WebCore::SessionStorageArea::areaCleared):
-        (WebCore::SessionStorageArea::blockUntilImportComplete):
-        (WebCore::SessionStorageArea::dispatchStorageEvent):
-        * storage/SessionStorageArea.h: Added.
-        (WebCore::SessionStorageArea::create):
+        This is the V8 equivalent of bridge/jni/jsc/JavaInstanceJSC.
+        Also fixes a typo in a comment in JavaInstanceJSC.cpp.
 
-2009-06-25  Eric Seidel  <eric@webkit.org>
+        No new tests, build fix only.
 
-        No review, reverting r45144 only.
+        * Android.v8bindings.mk: Modified. Added JavaInstanceV8.cpp
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Modified.
+        (JavaInstance::invokeMethod): Modified. Fixed comment
+        * bridge/jni/v8/JavaInstanceV8.cpp: Added.
+        (JavaInstance::JavaInstance):
+        (JavaInstance::~JavaInstance):
+        (JavaInstance::getClass):
+        (JavaInstance::invokeMethod):
+        (JObjectWrapper::JObjectWrapper):
+        (JObjectWrapper::~JObjectWrapper):
+        * bridge/jni/v8/JavaInstanceV8.h: Added.
+        (JSC::Bindings::JObjectWrapper::instance):
+        (JSC::Bindings::JObjectWrapper::setInstance):
+        (JSC::Bindings::JObjectWrapper::ref):
+        (JSC::Bindings::JObjectWrapper::deref):
+        (JSC::Bindings::JavaInstance::javaInstance):
+        (JSC::Bindings::JavaInstance::begin):
+        (JSC::Bindings::JavaInstance::end):
+        (JSC::Bindings::JavaInstance::virtualBegin):
+        (JSC::Bindings::JavaInstance::virtualEnd):
 
-        Roll out r45144 after 18 test failures appeared on the bots.
-        https://bugs.webkit.org/show_bug.cgi?id=26698
+2010-02-01  Dumitru Daniliuc  <dumi@chromium.org>
 
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/LocalStorage.cpp:
-        (WebCore::LocalStorage::storageArea):
-        * storage/LocalStorage.h:
-        * storage/SessionStorage.cpp:
-        (WebCore::SessionStorage::copy):
-        (WebCore::SessionStorage::storageArea):
-        * storage/SessionStorage.h:
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::StorageArea):
-        (WebCore::StorageArea::~StorageArea):
-        (WebCore::StorageArea::setItem):
-        (WebCore::StorageArea::removeItem):
-        (WebCore::StorageArea::clear):
-        * storage/StorageArea.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::StorageAreaSync):
-        (WebCore::StorageAreaSync::scheduleFinalSync):
-        (WebCore::StorageAreaSync::syncTimerFired):
-        (WebCore::StorageAreaSync::performImport):
-        * storage/StorageAreaSync.h:
-        * storage/StorageSyncManager.h:
+        Reviewed by Eric Seidel.
 
-2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
+        Making sure that all in-progress transactions are rolled back on
+        the database thread before they're destroyed. Otherwise,
+        SQLiteTransaction's destructor will try to do a rollback and that
+        would cause an assertion failure, if the object is not destroyed
+        on the DB thread.
 
-        Reviewed by Darin Fisher.
+        https://bugs.webkit.org/show_bug.cgi?id=34152
 
-        https://bugs.webkit.org/show_bug.cgi?id=26698
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::stop):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::notifyDatabaseThreadIsShuttingDown):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCoordinator.cpp:
+        (WebCore::SQLTransactionCoordinator::shutdown):
 
-        Combined LocalStorageArea and SessionStorageArea into StorageArea since
-        (after my other refactorings) there are no longer substantial
-        differences between the two.
+2010-02-01  Sam Weinig  <sam@webkit.org>
 
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/LocalStorage.cpp:
-        (WebCore::LocalStorage::storageArea):
-        * storage/LocalStorage.h:
-        * storage/LocalStorageArea.cpp: Removed.
-        * storage/LocalStorageArea.h: Removed.
-        * storage/SessionStorage.cpp:
-        (WebCore::SessionStorage::copy):
-        (WebCore::SessionStorage::storageArea):
-        * storage/SessionStorage.h:
-        * storage/SessionStorageArea.cpp: Removed.
-        * storage/SessionStorageArea.h: Removed.
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::createLocalStorage):
-        (WebCore::StorageArea::StorageArea):
-        (WebCore::StorageArea::createSessionStorage):
-        (WebCore::StorageArea::copy):
-        (WebCore::StorageArea::setItem):
-        (WebCore::StorageArea::removeItem):
-        (WebCore::StorageArea::clear):
-        (WebCore::StorageArea::scheduleFinalSync):
-        (WebCore::StorageArea::blockUntilImportComplete):
-        (WebCore::StorageArea::dispatchStorageEvent):
-        * storage/StorageArea.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::StorageAreaSync):
-        (WebCore::StorageAreaSync::scheduleFinalSync):
-        (WebCore::StorageAreaSync::syncTimerFired):
-        (WebCore::StorageAreaSync::performImport):
-        * storage/StorageAreaSync.h:
-        * storage/StorageSyncManager.h:
+        Reviewed by Beth Dakin.
 
-2009-06-24  Dan Bernstein  <mitz@apple.com>
+        Fix EXPERIMENTAL_SINGLE_VIEW_MODE build.
 
-        Reviewed by Simon Fraser.
+        * page/EventHandler.h:
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::currentNSEvent):
+        (WebCore::EventHandler::currentKeyboardEvent):
+        (WebCore::EventHandler::mouseDown):
+        (WebCore::EventHandler::mouseDragged):
+        (WebCore::EventHandler::mouseUp):
+        (WebCore::EventHandler::mouseMoved):
+        (WebCore::EventHandler::keyEvent):
+        (WebCore::EventHandler::wheelEvent):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::eventMayStartDrag):
+        (WebCore::EventHandler::sendFakeEventsAfterWidgetTracking):
 
-        - fix <rdar://problem/7001817> REGRESSION (r41902): Base position track
-          at UCSC Genome Browser doesn't work because image map prevents img
-          from hit-testing
+2010-02-01  Nate Chapin  <japhet@chromium.org>
 
-        Test: fast/replaced/image-map-2.html
+        Unreviewed, Chromium build fix.
 
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::nodeAtPoint): Do not reset 'inside' to false if
-        the image map failed the hit test.
+        Failed to properly add new files for http://trac.webkit.org/changeset/54150.
 
-2009-06-22  Adam Barth  <abarth@webkit.org>
+        * bindings/v8/custom/V8BarInfoCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSRuleCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSValueCustom.cpp: Added.
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp: Added.
+        * bindings/v8/custom/V8DOMSelectionCustom.cpp: Added.
+        * bindings/v8/custom/V8HTMLElementCustom.cpp: Added.
+        * bindings/v8/custom/V8SVGDocumentCustom.cpp: Added.
+        * bindings/v8/custom/V8SVGElementCustom.cpp: Added.
+        * bindings/v8/custom/V8SVGPathSegCustom.cpp: Added.
+        * bindings/v8/custom/V8ScreenCustom.cpp: Added.
+        * bindings/v8/custom/V8StyleSheetCustom.cpp: Added.
+        * bindings/v8/custom/V8WebGLArrayCustom.cpp: Added.
 
-        Reviewed by Dimitri Glazkov.
+2010-01-27  Matt Perry  <mpcomplete@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26366
+        Reviewed by Eric Seidel.
 
-        Refactor V8DOMMap to support isolated worlds.
+        Add support for addUserScript to chromium port.
 
         * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluateInNewWorld):
+        (WebCore::ScriptController::evaluateInWorld):
         * bindings/v8/ScriptController.h:
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
-        (WebCore::DOMDataStore::allStores):
-        (WebCore::DOMDataStore::allStoresMutex):
-        (WebCore::DOMDataStore::domData):
-        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
-        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
-        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
-        (WebCore::):
-        (WebCore::MainThreadDOMData::MainThreadDOMData):
-        (WebCore::MainThreadDOMData::getStore):
-        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
-        (WebCore::ChildThreadDOMData::getStore):
-        (WebCore::DOMDataStore::DOMDataStore):
-        (WebCore::DOMDataStore::~DOMDataStore):
-        (WebCore::DOMDataStoreHandle::DOMDataStoreHandle):
-        (WebCore::DOMDataStoreHandle::~DOMDataStoreHandle):
-        (WebCore::forget):
-        (WebCore::getDOMNodeMap):
-        (WebCore::getDOMObjectMap):
-        (WebCore::getActiveDOMObjectMap):
-        (WebCore::getDOMSVGElementInstanceMap):
-        (WebCore::getDOMSVGObjectWithContextMap):
-        (WebCore::DOMData::getCurrent):
-        (WebCore::DOMData::handleWeakObject):
-        (WebCore::DOMData::ensureDeref):
-        (WebCore::weakDOMObjectCallback):
-        (WebCore::weakActiveDOMObjectCallback):
-        (WebCore::weakNodeCallback):
-        (WebCore::weakSVGElementInstanceCallback):
-        (WebCore::weakSVGObjectWithContextCallback):
-        (WebCore::DOMData::derefObject):
-        (WebCore::DOMData::derefDelayedObjects):
-        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
-        (WebCore::DOMData::removeObjectsFromWrapperMap):
-        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
-        (WebCore::visitDOMNodesInCurrentThread):
-        (WebCore::visitDOMObjectsInCurrentThread):
-        (WebCore::visitActiveDOMObjectsInCurrentThread):
-        (WebCore::visitDOMSVGElementInstancesInCurrentThread):
-        (WebCore::visitSVGObjectsInCurrentThread):
-        * bindings/v8/V8DOMMap.h:
-        (WebCore::DOMDataStoreHandle::getStore):
-        * bindings/v8/V8IsolatedWorld.cpp: Added.
-        (WebCore::getIsolatedWorldKey):
-        (WebCore::contextWeakReferenceCallback):
-        (WebCore::V8IsolatedWorld::evaluate):
-        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
-        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
-        (WebCore::V8IsolatedWorld::getEntered):
-        * bindings/v8/V8IsolatedWorld.h: Added.
-        (WebCore::V8IsolatedWorld::getDOMDataStore):
-
-2009-06-24  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Bug 26604: Search doesn't work in Web Inspector Profiler
-        https://bugs.webkit.org/show_bug.cgi?id=26604
-
-        Seems like search was damaged in revision 42808.
-
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView.prototype.refresh):
-        Here and in other functions: nodes we're searching in are profile data grid
-        nodes, so there is no more need for '_dataGridNode' references.
-        (WebInspector.ProfileView.prototype.searchCanceled):
-        (WebInspector.ProfileView.prototype.performSearch.matchesQuery):
-        Fixed accidental semicolon that caused 'matchesQuery' always return true.
-        (WebInspector.ProfileView.prototype.performSearch):
-        To perform search correctly in the case of bottom up tree, we need to populate
-        the tree, because there's no 1-to-1 correspondence between profile nodes and
-        data grid nodes in this case.
-        (WebInspector.ProfileView.prototype._jumpToSearchResult):
 
-2009-06-24  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        <rdar://problem/6450239&6574516>
-    
-        Fix flashing issues caused by compositing layers rendering content before
-        a deferred layout has happened. Because the -viewWillDraw machinery doesn't
-        work for composited layers, we need to use scheduleViewUpdate() to queue
-        up a layout via the run loop observer in WebKit, whenever we know we
-        are going to be painting soon.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
-        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
-
-2009-06-24  David Levin  <levin@chromium.org>
-
-        Fix all builds.
-
-        * ForwardingHeaders/wtf/FastAllocBase.h: Added.
-
-2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26658
-
-        Split the syncing portions of LocalStorageArea into StorageAreaSync.
-        This name will make more sense in the next patch (in this set) when
-        LocalStorageArea and SessionStorageArea are merged to become simply
-        StorageArea.  (Thus the synching portion of StorageArea is in
-        StorageAreaSync.)
-
-        This looks like a big patch, but really all it's doing is splitting
-        code and patching split-related things up.
-
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/LocalStorageArea.cpp:
-        (WebCore::LocalStorageArea::create):
-        (WebCore::LocalStorageArea::LocalStorageArea):
-        (WebCore::LocalStorageArea::scheduleFinalSync):
-        (WebCore::LocalStorageArea::itemChanged):
-        (WebCore::LocalStorageArea::itemRemoved):
-        (WebCore::LocalStorageArea::areaCleared):
-        (WebCore::LocalStorageArea::blockUntilImportComplete):
-        * storage/LocalStorageArea.h:
-        * storage/LocalStorageTask.cpp:
-        (WebCore::LocalStorageTask::LocalStorageTask):
-        * storage/LocalStorageTask.h:
-        (WebCore::LocalStorageTask::createImport):
-        (WebCore::LocalStorageTask::createSync):
-        * storage/LocalStorageThread.cpp:
-        (WebCore::LocalStorageThread::scheduleImport):
-        (WebCore::LocalStorageThread::scheduleSync):
-        * storage/LocalStorageThread.h:
-        * storage/SessionStorageArea.cpp:
-        (WebCore::SessionStorageArea::blockUntilImportComplete):
-        * storage/SessionStorageArea.h:
-        * storage/StorageArea.h:
-        * storage/StorageAreaSync.cpp: Copied from WebCore/storage/LocalStorageArea.cpp.
-        * storage/StorageAreaSync.h: Copied from WebCore/storage/LocalStorageArea.h.
-        * storage/StorageSyncManager.cpp:
-        (WebCore::StorageSyncManager::scheduleImport):
-        (WebCore::StorageSyncManager::scheduleSync):
-        * storage/StorageSyncManager.h:
-
-2009-06-24  Adam Treat  <adam.treat@torchmobile.com>
-
-        Fix Qt build.
-
-        * WebCore.pro:
-
-2009-06-24  David Levin  <levin@chromium.org>
-
-        Reviewed by David Hyatt.
-
-        Bug 26696: Member functions in DataGridColumnList should return pointers instead of PassRefPtr.
-        https://bugs.webkit.org/show_bug.cgi?id=26696
-
-        * html/DataGridColumnList.cpp:
-        (WebCore::DataGridColumnList::itemWithName):
-        (WebCore::DataGridColumnList::add):
-        * html/DataGridColumnList.h:
-        (WebCore::DataGridColumnList::item):
-        (WebCore::DataGridColumnList::primaryColumn):
-        (WebCore::DataGridColumnList::sortColumn):
-
-2009-06-24  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dave "Messy" Hyatt.
-
-        Little bit of style cleanup.
-
-        * html/DataGridColumn.cpp:
-        * html/DataGridColumn.h:
-        * html/DataGridColumn.idl:
-        * html/DataGridColumnList.cpp:
-        * html/DataGridColumnList.h:
-        * html/DataGridColumnList.idl:
-        * html/HTMLDataGridCellElement.cpp:
-        * html/HTMLDataGridCellElement.h:
-        * html/HTMLDataGridCellElement.idl:
-        * html/HTMLDataGridColElement.cpp:
-        * html/HTMLDataGridColElement.h:
-        * html/HTMLDataGridColElement.idl:
-        * html/HTMLDataGridElement.h:
-        * html/HTMLDataGridElement.idl:
-        * html/HTMLDataGridRowElement.cpp:
-        * html/HTMLDataGridRowElement.h:
-        * html/HTMLDataGridRowElement.idl:
-
-2009-06-24  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 26668: AX: need a way to retrieve the language for an element
-        
-        Provides a way to retrieve the language associated with a specific accessibility element.
-
-        Test: accessibility/language-attribute.html
-
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::language):
-        * accessibility/AccessibilityObject.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::language):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-
-2009-06-24  Brady Eidson  <beidson@apple.com>
+2010-02-01  Eric Carlson  <eric.carlson@apple.com>
 
         Reviewed by Dan Bernstein.
-        
-        <rdar://problem/6893811> Instead of downloading files linked from Google Earth, file contents displayed in browser window as text.
 
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (createBinaryExtensionsSet): Add '.kmz' to the list of known-to-be-binary extensions.
+        https://bugs.webkit.org/show_bug.cgi?id=34448
+        <rdar://problem/7598130>
 
-2009-06-24  Nicolas Weber  <thakis@chromium.org>
+        RenderVideo::intrinsicSizeChanged infinite recursion
 
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26685
-        Accomodate for backwards-incompatible skia api changes.
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::clearRect):
-        (WebCore::GraphicsContext::setCompositeOperation):
-        * platform/graphics/skia/ImageBufferSkia.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/graphics/skia/ImageSkia.cpp:
-        (WebCore::paintSkBitmap):
-        (WebCore::Image::drawPattern):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::State::State):
-        (PlatformContextSkia::setupPaintCommon):
-        (PlatformContextSkia::setXfermodeMode):
-        (PlatformContextSkia::applyClipFromImage):
-        * platform/graphics/skia/PlatformContextSkia.h:
-        * platform/graphics/skia/SkiaUtils.cpp:
-        (WebCore::):
-        (WebCore::WebCoreCompositeToSkiaComposite):
-        * platform/graphics/skia/SkiaUtils.h:
-
-2009-06-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Gtk build fix. Add files that were added in r45093 and r45096
+        * rendering/RenderImage.h:
+        (WebCore::RenderImage::intrinsicSizeChanged): Make protected instead of private so it can
+            be called by RenderVideo.
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::intrinsicSizeChanged): Call RenderMedia::intrinsicSizeChanged, not
+            RenderVideo::intrinsicSizeChanged.
+        (WebCore::RenderVideo::imageChanged): Call RenderMedia::imageChanged instead of 
+            RenderImage::imageChanged.
 
-        * GNUmakefile.am:
+2010-02-01  Nate Chapin  <japhet@chromium.org>
 
-2009-06-24  Brady Eidson  <beidson@apple.com>
+        Reviewed by Dimitri Glazkov.
 
-        Fix 64-bit SnowLeopard build.
+        [V8] Generate toV8() converter for most WebCore->V8 conversions,
+        and defined custom converters in their respective V8<class>Custom.cpp.
 
-        * html/DataGridColumnList.cpp:
-        (WebCore::DataGridColumnList::remove):
-        (WebCore::DataGridColumnList::move):
+        Old converters in V8DOMWrapper will be deleted in a later patch.
 
-2009-06-24  Rob Buis  <rwlbuis@gmail.com>
+        https://bugs.webkit.org/show_bug.cgi?id=32563
 
-        Reviewed by Eric Seidel.
+        * Android.v8bindings.mk:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/custom/V8BarInfoCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSRuleCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSValueCustom.cpp: Added.
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp: Added.
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ConsoleCustom.cpp:
+        * bindings/v8/custom/V8DOMSelectionCustom.cpp: Added.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLElementCustom.cpp: Added.
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        * bindings/v8/custom/V8SVGDocumentCustom.cpp: Added.
+        * bindings/v8/custom/V8SVGElementCustom.cpp: Added.
+        * bindings/v8/custom/V8SVGPathSegCustom.cpp: Added.
+        * bindings/v8/custom/V8ScreenCustom.cpp: Added.
+        * bindings/v8/custom/V8StyleSheetCustom.cpp: Added.
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.cpp: Added.
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * dom/make_names.pl: Add options to generate wrapper factory for V8 bindings.
+
+2010-02-01  Alexander Pavlov  <apavlov@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26392
-        Bug 26392: In html, modification of xlink:href of an newly inserted svg image does not work.
-        https://bugs.webkit.org/show_bug.cgi?id=26328
-        Bug 26328: changing href attribute of svg images does not work when changing display attribute as well
+        Reviewed by Pavel Feldman.
 
-        React to href updates even when there is no renderer, i.e. display=none.
+        Web Inspector: lazy-load textual resources to avoid UI hangup
+        https://bugs.webkit.org/show_bug.cgi?id=34332
 
-        Tests: svg/custom/js-update-image-and-display.svg
-               svg/custom/js-update-image-and-display2.svg
-               svg/custom/js-update-image-and-display3.svg
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._innerSelectContentTab):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.show):
+        (WebInspector.SourceView.prototype.contentTabSelected):
 
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::svgAttributeChanged):
+2010-02-01  Brady Eidson  <beidson@apple.com>
 
-2009-06-24  David Hyatt  <hyatt@apple.com>
+        Reviewed by Adele Peterson.
 
-        Reviewed by Sam Weinig.
+        Crash in Safari opening new tabs to "same page"
+        <rdar://problem/7593857> and https://bugs.webkit.org/show_bug.cgi?id=34444
 
-        https://bugs.webkit.org/show_bug.cgi?id=26687
+        Test: fast/loader/crash-copying-backforwardlist.html
 
-        Add basic back-end column support to datagrid.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): Null check currentItem().
 
-        Added fast/dom/HTMLDataGridElement/ column tests.
+        * page/Page.cpp:
+        (WebCore::Page::goToItem): Ditto.
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/DataGridColumn.cpp: Added.
-        (WebCore::DataGridColumn::setPrimary):
-        * html/DataGridColumn.h: Added.
-        (WebCore::DataGridColumn::create):
-        (WebCore::DataGridColumn::id):
-        (WebCore::DataGridColumn::setId):
-        (WebCore::DataGridColumn::label):
-        (WebCore::DataGridColumn::setLabel):
-        (WebCore::DataGridColumn::type):
-        (WebCore::DataGridColumn::setType):
-        (WebCore::DataGridColumn::sortable):
-        (WebCore::DataGridColumn::setSortable):
-        (WebCore::DataGridColumn::sortDirection):
-        (WebCore::DataGridColumn::setSortDirection):
-        (WebCore::DataGridColumn::primary):
-        (WebCore::DataGridColumn::detachFromColumnList):
-        (WebCore::DataGridColumn::DataGridColumn):
-        * html/DataGridColumn.idl: Added.
-        * html/DataGridColumnList.cpp: Added.
-        (WebCore::DataGridColumnList::~DataGridColumnList):
-        (WebCore::DataGridColumnList::itemWithName):
-        (WebCore::DataGridColumnList::add):
-        (WebCore::DataGridColumnList::remove):
-        (WebCore::DataGridColumnList::move):
-        (WebCore::DataGridColumnList::clear):
-        (WebCore::DataGridColumnList::primaryColumnChanged):
-        * html/DataGridColumnList.h: Added.
-        (WebCore::DataGridColumnList::create):
-        (WebCore::DataGridColumnList::length):
-        (WebCore::DataGridColumnList::item):
-        (WebCore::DataGridColumnList::primaryColumn):
-        (WebCore::DataGridColumnList::sortColumn):
-        * html/DataGridColumnList.idl: Added.
-        * html/HTMLDataGridColElement.cpp:
-        (WebCore::HTMLDataGridColElement::sortable):
-        (WebCore::HTMLDataGridColElement::setSortable):
-        (WebCore::HTMLDataGridColElement::sortDirection):
-        (WebCore::HTMLDataGridColElement::setSortDirection):
-        * html/HTMLDataGridColElement.h:
-        * html/HTMLDataGridColElement.idl:
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
-        * html/HTMLDataGridElement.h:
-        (WebCore::HTMLDataGridElement::columns):
-        * html/HTMLDataGridElement.idl:
-        * rendering/RenderDataGrid.cpp:
-        (WebCore::RenderDataGrid::paintObject):
-        (WebCore::RenderDataGrid::paintColumnHeaders):
-        (WebCore::RenderDataGrid::rebuildColumns):
-        * rendering/RenderDataGrid.h:
-        (WebCore::RenderDataGrid::gridElement):
-
-2009-06-24  Jessie Berlin  <jberlin@apple.com>
+2010-02-01  Kevin Watters  <kevinwatters@gmail.com>
 
-        Reviewed by Adam Roben.
+        Reviewed by Kevin Ollivier.
 
-        Partially fixes: https://bugs.webkit.org/show_bug.cgi?id=24735
-        (<rdar://problem/5015942>)
-        Where on windows it was not possible to set an element as the drag
-        image using setDragImage on the dataTransfer object.
-        
-        Does not "fix" the case of dragging a link where the default link image
-        is still used, even when the -webkit-user-drag is set to "element". This
-        is the same behavior as is found on OS X.
+        [wx] Remove unused file that doesn't seem to belong to the port.
         
-        Added a manual test because it is not possible to check that what is
-        contained in the image snapshot is indeed the requested element.
-
-        * dom/Clipboard.h:
-        (WebCore::Clipboard::dragImageElement):
-        Made getting the raw pointer from the RefPtr a const operation.
-        * manual-tests/drag-with-div-or-image-as-data-image.html: Added.
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::ClipboardWin::createDragImage):
-        Get an image of the rendered element and its subtree.
-
-2009-06-24  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26683
-        Fix Chromium build bustage: Add custom binding for HTMLDataGridElement.dataSource
-
-        This change just adds a stub implementation for now to help fix the build.
+        https://bugs.webkit.org/show_bug.cgi?id=34445
 
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Added.
+        * platform/wx/KeyEventWin.cpp: Removed.
 
-2009-06-24  David Kilzer  <ddkilzer@apple.com>
+2010-02-01  Eric Carlson  <eric.carlson@apple.com>
 
-        Build fixes for ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+        Reviewed by Adele Peterson.
 
-        Reviewed by Adam Roben.
+        Fullscreen API should be on HTMLVideoElement
+        https://bugs.webkit.org/show_bug.cgi?id=34438
+        
+        Move fullscreen DOM APIs from HTMLMediaElement to HTMLVideoElement.
 
         * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::deliverNotification): Removed
-        ExceptionCode parameter from togglePlayState().
-        (WebCore::HTMLMediaElement::initialURL): Don't convert a KURL
-        object to a String when assigning to a KURL variable.
-
-2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Save memory by not storing attribute values in member variables, if not absolutely needed.
-        Also fixes bugs where we're substituting variables too early (noticeable with the upcoming <select> element).
-
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::parseMappedAttribute):
-        (WebCore::WMLDoElement::label):
-        * wml/WMLDoElement.h:
-        * wml/WMLFieldSetElement.cpp:
-        (WebCore::WMLFieldSetElement::insertedIntoDocument):
-        * wml/WMLFieldSetElement.h:
-        * wml/WMLOptGroupElement.cpp:
-        (WebCore::WMLOptGroupElement::title):
-        (WebCore::WMLOptGroupElement::parseMappedAttribute):
-        (WebCore::WMLOptGroupElement::groupLabelText):
-        * wml/WMLOptGroupElement.h:
-        * wml/WMLPostfieldElement.cpp:
-        (WebCore::WMLPostfieldElement::name):
-        (WebCore::WMLPostfieldElement::value):
-        (WebCore::WMLPostfieldElement::encodeData):
-        * wml/WMLPostfieldElement.h:
-        * wml/WMLSetvarElement.cpp:
-        (WebCore::WMLSetvarElement::parseMappedAttribute):
-        (WebCore::WMLSetvarElement::name):
-        (WebCore::WMLSetvarElement::value):
-        * wml/WMLSetvarElement.h:
-        * wml/WMLTimerElement.cpp:
-        (WebCore::WMLTimerElement::parseMappedAttribute):
-        (WebCore::WMLTimerElement::insertedIntoDocument):
-        (WebCore::WMLTimerElement::timerFired):
-        (WebCore::WMLTimerElement::start):
-        (WebCore::WMLTimerElement::value):
-        * wml/WMLTimerElement.h:
-
-2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Adam Roben.
-
-        Forgot to initialize m_task member variable. Results in crashes sometimes.
-
-        * wml/WMLAnchorElement.cpp:
-        (WebCore::WMLAnchorElement::WMLAnchorElement):
-
-2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Not reviewed. Forgot to include within last patch.
-
-        * manual-tests/wml/card-title-attr.wml: Added.
-
-2009-06-24  Wajahat Siddiqui <wajahatmeister@gmail.com>
- 
-        Reviewed by Nikolas Zimmermann.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26474
-        Adding WML <card> title attribute handling.
-
-        * wml/WMLElement.h: marking parseValueSubstitutingVariableReferences and parseValueForbiddingVariableReferences as const
-        * wml/WMLElement.cpp:
-        * wml/WMLCardElement.h: 
-        (WebCore::WMLCardElement::title):
-        * wml/WMLCardElement.cpp:
-        * wml/manual-test/card-title-attr.wml: Manual test  
- 
-2009-06-24  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix the build without ENABLE_VIDEO.
-
-        * html/CanvasRenderingContext2D.cpp: Add #if ENABLE guards.
-        * html/CanvasRenderingContext2D.h: Ditto.
-
-2009-06-24  Siddhartha Chattopadhyay  <sidchat@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26200 which I introduced earlier. I had
-        the smartReplace set TRUE initially, which was wrong since the purpose of this call is
-        to just replace the selection, and place the caret at the end of the selection it replaced.
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
-        * manual-tests/textarea-caret-position-after-auto-spell-correct.html: Added.
-
-2009-06-24  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        Don't use an unsigned int for intervalInMS because we sometimes initialize
-        it with a negative value.
-
-        * platform/wx/SharedTimerWx.cpp:
-        (WebCore::setSharedTimerFireTime):
-
-2009-06-24  Eric Seidel  <eric@webkit.org>
-
-        No review, build fix only.
-
-        The previous checkin had an improper merge.  This fixes the build.
-
-        * page/DragController.cpp:
-        (WebCore::DragController::tryDocumentDrag):
-
-2009-06-05  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25922
-        JS setting dropEffect = "none" causes tryDHTMLDrag
-        to return DragOperationNone.  Which is also the value
-        tryDHTMLDrag previously used to indicate JS did not
-        want to handle the drag.
-
-        Make it possible for the DragController::try* methods
-        to return a bool to indicate if javascript accepted
-        or rejected the drag event, separate from the DragOperation.
-
-        Tests:
-        - fast/events/drag-to-navigate.html
-        - fast/events/prevent-drag-to-navigate.html
-
-        * page/DragController.cpp:
-        (WebCore::DragController::dragEnteredOrUpdated):
-        (WebCore::DragController::tryDocumentDrag):
-        (WebCore::defaultOperationForDrag):
-        (WebCore::DragController::tryDHTMLDrag):
-        * page/DragController.h:
-
-2009-06-23  Oliver Hunt  <oliver@apple.com> and Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Sam Weinig and Dave Hyatt.
-
-        <rdar://problem/6164797> Add Canvas API to allow drawing of <video> frames
-        <https://bugs.webkit.org/show_bug.cgi?id=25920>
-
-        Add support for drawing the contents of the video element to the canvas
-        in accordance with the current HTML5 draft.
-
-        Test: media/video-canvas.html
-
-        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext2D::drawImage):
-          Standard custom bindings stuff we need to do for all canvas methods.
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::size): Helper function for finding the size of a video element
-        (WebCore::CanvasRenderingContext2D::checkOrigin): moved up in the file.
-        (WebCore::CanvasRenderingContext2D::drawImage): The various overloads of HTML5's drawImage(<video>)
-        * html/CanvasRenderingContext2D.h:
         * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::hasSingleSecurityOrigin):
-          hasSingleSecurityOrigin is needed for security, currently all implementations are trivial
-          as we force QT to maintain a single origin.
+        * html/HTMLMediaElement.idl:
         * html/HTMLVideoElement.cpp:
-        (WebCore::HTMLVideoElement::paint): 
-            Paint routine on video so we don't have to look at MediaPlayer directly
+        (WebCore::HTMLVideoElement::paint): Removed outdated FIXME.
+        (WebCore::HTMLVideoElement::paintCurrentFrameInContext): Ditto.
+        (WebCore::HTMLVideoElement::webkitEnterFullScreen): Moved from HTMLMediaElement.
+        (WebCore::HTMLVideoElement::webkitExitFullScreen): Ditto.
+        (WebCore::HTMLVideoElement::webkitSupportsFullscreen): Ditto.
+        (WebCore::HTMLVideoElement::webkitDisplayingFullscreen): Ditto.
         * html/HTMLVideoElement.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::hasSingleSecurityOrigin):
-        (WebCore::MediaPlayer::hasSingleSecurityOrigin):
-            Default implementations of hasSingleSecurityOrigin
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
-            A video may need a player now even if it is not visible.
-        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
-            Always return true due to restrictions we've placed on QT.
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::paint):
-            Jump through some hoops to allow windows QT to draw to an intermediate buffer.
-            In the long term we'd like to cache the HDC, but this will do for now.
-        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
-            As for Mac we force QT to only allow same origin loads.
-
-2009-06-23  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Chromium: Fix crash with inherited font-size in <option>
-
-        https://bugs.webkit.org/show_bug.cgi?id=26656
-        http://code.google.com/p/chromium/issues/detail?id=14853
+        * html/HTMLVideoElement.idl:
 
-        In r42597 (https://bugs.webkit.org/show_bug.cgi?id=25244), I changed
-        the <select> handing for Chromium to fix a rendering bug. However,
-        although the font-size is correctly ignored, getRowHeight wasn't
-        updated and so was calculating the height of the rows in an
-        inconsistent manner. This can lead to a crash.
+2010-02-01  Pavel Feldman  <pfeldman@chromium.org>
 
-        * manual-tests/optgroup-empty-and-nested.html: adding test case for crash
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::getRowHeight):
-
-2009-06-23  Brady Eidson  <beidson@apple.com>
-
-        Patch by Antti Koivisto.
-        Reviewed by Brady Eidson.
+        Reviewed by Timothy Hatcher.
 
-        <rdar://problem/6988010> Failed resources not reloaded when built against Tiger SDK
+        Web Inspector: Syntax highlighting in source view of
+        Resources pane stops half-way.
 
-        A latent bug that cache revalidation uncovered.  When a CachedResource failed to load,
-        it should always be revalidated upon reload.
+        There were two problems here: (1) styles for html highlighter were not
+        added into the css file (they used to be injected manually in the
+        SourceFrame before). (2) 'Tag' needed to be lexer's state, not parser's.
+        Otherwise unbalanced quotes in the text nodes were matching too match
+        into the string tokens.
 
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::canUseCacheValidator):
-        (WebCore::CachedResource::mustRevalidate):
+        https://bugs.webkit.org/show_bug.cgi?id=34359
 
-2009-06-23  Dan Bernstein  <mitz@apple.com>
+        * inspector/front-end/NativeTextViewer.js:
+        (WebInspector.NativeTextViewer.prototype._createLineDivs):
+        (WebInspector.NativeTextViewer.prototype._lineHeight):
+        (WebInspector.NativeTextViewer.prototype.initFontMetrics):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._createEditorIfNeeded):
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype.initFontMetrics):
+        (WebInspector.TextEditor.prototype._registerShortcuts):
+        * inspector/front-end/inspectorSyntaxHighlight.css:
+
+2010-02-01  Ben Murdoch  <benm@google.com>
 
         Reviewed by Darin Adler.
 
-        - fix <rdar://problem/6634228> Crash in [NSScroller mouseDown:] beneath
-          EventHandler::passMouseDownEventToWidget()
+        ScriptCallFrame's do not get line numbers/source id's if the caller is unkown.
+        https://bugs.webkit.org/show_bug.cgi?id=34335
 
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::passMouseDownEventToWidget): Surround the
-        -mouseDown: call with calls to Widget::beforeMouseDown() and
-        Widget::afterMouseDown(), which prevent the widget's view hierarchy from
-        being removed from its parent view while the scroller is tracking the
-        mouse.
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack): If the caller is unknown, the line number and source information is still availble so pass it to the ScriptCallFrame being constructed.
 
-2009-06-23  Sam Weinig  <sam@webkit.org>
+2010-02-01  Dirk Schulze  <krit@webkit.org>
 
-        Reviewed by Dave Hyatt.
+        Reviewed by Simon Fraser.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26516
-        Add initial implementation of DataGridDataSource
+        Add back an AffineTransform class for use by SVG
+        https://bugs.webkit.org/show_bug.cgi?id=33750
 
-        - Initial implementation only supports the initialize callback function.
+        These are the first steps on reimplementing AffineTransform. Unlike
+        the old affine code, this one is platform independent like TransformationMatrix.
+        AffineTransform has the benefit, that it stores just 6 doubles instead of
+        16 in TransformationMatrix. The calculations of transformations are not that
+        complex and can improve the memory usage and speed of SVG.
+        AffineTransform can be used by HTML Canvas3D or SVG, since they are 2D related (at
+        least for the moment).
+        HTML Canvas is the first that makes use of the new AffineTransform. Next patches
+        will introduce the affine code to SVG.
 
-        Test: fast/dom/HTMLDataGridElement/DataGridDataSource-basic.html
+        No new tests. The new AffineTransformation code is tested by fast/canvas.
 
-        * WebCore.xcodeproj/project.pbxproj:
+        * Android.mk:
         * GNUmakefile.am:
+        * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSDataGridDataSource.cpp: Added.
-        (WebCore::JSDataGridDataSource::JSDataGridDataSource):
-        (WebCore::JSDataGridDataSource::~JSDataGridDataSource):
-        (WebCore::JSDataGridDataSource::initialize):
-        * bindings/js/JSDataGridDataSource.h: Added.
-        (WebCore::JSDataGridDataSource::create):
-        (WebCore::JSDataGridDataSource::isJSDataGridDataSource):
-        (WebCore::JSDataGridDataSource::jsDataSource):
-        (WebCore::asJSDataGridDataSource):
-        * bindings/js/JSHTMLDataGridElementCustom.cpp: Added.
-        (WebCore::JSHTMLDataGridElement::listener):
-        (WebCore::JSHTMLDataGridElement::setListener):
-        * html/DataGridDataSource.h: Added.
-        (WebCore::DataGridDataSource::~DataGridDataSource):
-        (WebCore::DataGridDataSource::isJSDataGridDataSource):
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
-        (WebCore::HTMLDataGridElement::setDataSource):
-        (WebCore::HTMLDataGridElement::initializationTimerFired):
-        * html/HTMLDataGridElement.h:
-        (WebCore::HTMLDataGridElement::dataSource):
-        * html/HTMLDataGridElement.idl:
-
-2009-06-23  Ryosuke Niwa  <rniwa@google.com>
-
-        Reviewed by Justin Garcia.
-
-        Undo the changeset 21212 to fix the regression bug 14062.
-        The changeset 21212 attempted to fix rdar://problem/5002441.
-        The changeset 21212 modified InsertTextCommand::input so as to convert
-        all spaces in text to non-breaking spaces for rdar://problem/5002441.
-        However, the bug was originally caused by rebalanceWhitespaceAt
-        and this workaround introduced a regression bug 14062.
-        Because rebalanceWhitespaceAt appears to behave correctly now,
-        the workaround introduced in 21212 is no longer needed.
-
-        Test: editing/inserting/space-after-removeformat.html
-
-        * editing/InsertTextCommand.cpp:
-        (WebCore::InsertTextCommand::input):
-
-2009-06-23  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26523 <col> 
-        elements width can't be changed with javascript
-
-        This patch both fixes setting the width attribute directly in 
-        JavaScript, and setting the width on the style attribute. 
-
-        * html/HTMLTableColElement.cpp:
-        (WebCore::HTMLTableColElement::parseMappedAttribute): If we have a 
-        new width, call setNeedsLayoutAndPrefWidthsRecalc()
-
-        Call calcPrefWidths() on the table cols.
-        * rendering/AutoTableLayout.cpp:
-        (WebCore::AutoTableLayout::recalcColumn):
-        * rendering/FixedTableLayout.cpp:
-        (WebCore::FixedTableLayout::calcWidthArray):
-        
-        Call layoutIfNeeded on the table cols.
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout):
-
-        * rendering/RenderTableCol.cpp:
-        (WebCore::RenderTableCol::clippedOverflowRectForRepaint): Use new 
-        table() convenience function.
-        (WebCore::RenderTableCol::calcPrefWidths): Just call 
-        setPrefWidthsDirty(false) on ourself and our children.
-        (WebCore::RenderTableCol::table):
-        * rendering/RenderTableCol.h:
-
-2009-06-23  Ojan Vafai  <ojan@chromium.org>
-
-        Reviewed by Dan Bernstein.
-
-        Add logic to CSSStyleDeclaration::diff to deal with font-sizes that are 
-        keyword values. When diff is called on a CSSStyleDeclaration, we check
-        the keywordSize to see if font-size matches a keyword value.
-        
-        This ensures that when we diff a CSSMutableStyleDeclaration returned from
-        copyInheritableProperties on a CSSComputedStyleDeclaration that we 
-        correctly identify matching font-sizes.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26279
-
-        Test: editing/inserting/font-size-clears-from-typing-style.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::cssPropertyMatches):
-        * css/CSSComputedStyleDeclaration.h:
-        * css/CSSStyleDeclaration.cpp:
-        (WebCore::CSSStyleDeclaration::cssPropertyMatches):
-        (WebCore::CSSStyleDeclaration::diff):
-        * css/CSSStyleDeclaration.h:
-
-2009-06-23  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6994790> CrashTracer: [USER] 8 crashes in Mail trying to
-        add a blank line to pasted Facebook content (under
-        CompositeEditCommand::positionAvoidingSpecialElementBoundary)
-
-        - Just added null checks and I will create a new bug to prevent the
-        bad behavior.
-
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
-
-2009-06-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Build fix.
-
-        Wrap shouldDoSoftwarePaint() in #if USE(ACCELERATED_COMPOSITING) to avoid warning when 
-        ACCELERATED_COMPOSITING is not defined.
-
-        * rendering/RenderLayer.cpp:
-
-2009-06-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=24863
-        
-        Fix reflection painting on elements with compositing layers.
-
-        Test: compositing/reflections/reflection-on-composited.html
-
-        * rendering/RenderLayer.h:
-        Add a new PaintLayerPaintingReflection flag which is set while painting inside
-        reflections.
-        (WebCore::RenderLayer::setPaintingInsideReflection):
-        Add a setter so that RenderLayerBacking can call it.
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::shouldDoSoftwarePaint):
-        Utility to clarify the logic of when a composited layer should do a software paint.
-        
-        (WebCore::RenderLayer::paintLayer):
-        Use shouldDoSoftwarePaint() to determine when to software-paint a reflected layer.
-        Remove transform-related tests from the reflection-painting if test because they appear
-        to be unnecessary.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::paintIntoLayer):
-        Add the code to paint reflections to the composited layer painting method.
-        
-        * rendering/RenderReplica.cpp:
-        (WebCore::RenderReplica::paint):
-        Set the PaintLayerPaintingReflection flag.
-
-2009-06-23  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26643
-        Memory cache should respect Cache-Control: no-store
-        
-        Make resources with Cache-Control: no-store uncacheable in the memory cache.
-        They get evicted immediately when all clients are gone and are always
-        reloaded from the server.
-
-        Conforms to RFC2616 14.9.2 and seems also match Firefox behavior.
-
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::removeClient):
-        (WebCore::CachedResource::canUseCacheValidator):
-        (WebCore::CachedResource::mustRevalidate):
-        * platform/network/ResourceResponseBase.cpp:
-        (WebCore::ResourceResponseBase::ResourceResponseBase):
-        (WebCore::ResourceResponseBase::parseCacheControlDirectives):
-        (WebCore::ResourceResponseBase::cacheControlContainsNoStore):
-        * platform/network/ResourceResponseBase.h:
-
-2009-06-23  Brady Eidson  <beidson@apple.com>
-
-        Windows build fix.
-
-        * platform/graphics/win/QTMovieWin.cpp:
-        (QTMovieWin::play):
-        (QTMovieWin::pause):
-        (QTMovieWin::setRate):
-        (QTMovieWin::setCurrentTime):
-
-2009-06-23  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        <rdar://problem/6902203> REGRESSION: 'Return' insertion point incorrect
-        after manually quoting blank line then hitting return
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::scale):
+        (WebCore::CanvasRenderingContext2D::rotate):
+        (WebCore::CanvasRenderingContext2D::translate):
+        (WebCore::CanvasRenderingContext2D::transform):
+        (WebCore::CanvasRenderingContext2D::setTransform):
+        (WebCore::CanvasRenderingContext2D::isPointInPath):
+        (WebCore::CanvasRenderingContext2D::willDraw):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/cairo/TransformationMatrixCairo.cpp:
+        (WebCore::AffineTransform::operator cairo_matrix_t):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getAffineCTM):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/cg/TransformationMatrixCG.cpp:
+        (WebCore::AffineTransform::operator CGAffineTransform):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/haiku/PathHaiku.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        (WebCore::AffineTransform::operator QTransform):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getAffineCTM):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/skia/TransformationMatrixSkia.cpp:
+        (WebCore::AffineTransform::operator SkMatrix):
+        * platform/graphics/transforms/AffineTransform.cpp: Added.
+        (WebCore::affineTransformDecompose):
+        (WebCore::affineTransformCompose):
+        (WebCore::AffineTransform::AffineTransform):
+        (WebCore::AffineTransform::reset):
+        (WebCore::AffineTransform::setMatrix):
+        (WebCore::AffineTransform::isIdentity):
+        (WebCore::AffineTransform::det):
+        (WebCore::AffineTransform::isInvertible):
+        (WebCore::AffineTransform::inverse):
+        (WebCore::AffineTransform::multiply):
+        (WebCore::AffineTransform::multLeft):
+        (WebCore::AffineTransform::rotate):
+        (WebCore::AffineTransform::scale):
+        (WebCore::AffineTransform::translate):
+        (WebCore::AffineTransform::scaleNonUniform):
+        (WebCore::AffineTransform::rotateFromVector):
+        (WebCore::AffineTransform::flipX):
+        (WebCore::AffineTransform::flipY):
+        (WebCore::AffineTransform::shear):
+        (WebCore::AffineTransform::skew):
+        (WebCore::AffineTransform::skewX):
+        (WebCore::AffineTransform::skewY):
+        (WebCore::makeMapBetweenRects):
+        (WebCore::AffineTransform::map):
+        (WebCore::AffineTransform::mapPoint):
+        (WebCore::AffineTransform::mapRect):
+        (WebCore::AffineTransform::blend):
+        (WebCore::AffineTransform::toTransformationMatrix):
+        * platform/graphics/transforms/AffineTransform.h: Added.
+        (WebCore::AffineTransform::a):
+        (WebCore::AffineTransform::setA):
+        (WebCore::AffineTransform::b):
+        (WebCore::AffineTransform::setB):
+        (WebCore::AffineTransform::c):
+        (WebCore::AffineTransform::setC):
+        (WebCore::AffineTransform::d):
+        (WebCore::AffineTransform::setD):
+        (WebCore::AffineTransform::e):
+        (WebCore::AffineTransform::setE):
+        (WebCore::AffineTransform::f):
+        (WebCore::AffineTransform::setF):
+        (WebCore::AffineTransform::operator== ):
+        (WebCore::AffineTransform::operator!=):
+        (WebCore::AffineTransform::operator*=):
+        (WebCore::AffineTransform::operator*):
+        (WebCore::AffineTransform::setMatrix):
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getAffineCTM):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        (WebCore::AffineTransform::operator wxGraphicsMatrix):
 
-        If the insertion point is both the begining and ending visible position
-        then we need to insert at the end instead of the begining, which is what
-        would normally happen if the insertion point was as the begining.
+2010-01-29  Philippe Normand  <pnormand@igalia.com>
 
-        * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply):
+        Reviewed by Eric Carlson.
 
-2009-06-23  Brady Eidson  <beidson@apple.com>
+        [GTK] set playbin mute property depending on volume value
+        https://bugs.webkit.org/show_bug.cgi?id=31586
 
-        Reviewed by Sam Weinig, and looked over by Eric Carlson.
+        New API in MediaPlayer for mute control. 3 new methods are
+        introduced:
 
-        <rdar://problem/6980466> Media elements should provide option for changing pitch correction
+        - bool supportsMuting() const;
+        - bool muted() const;
+        - void setMuted(bool);
 
-        Introduce a new boolean property to HTMLMediaElement called webkitPreservesPitch for script to control this.
+        Platform MediaPlayer implementations can support it easily if the
+        underlying sound daemon/API supports muting (eg. not only setting
+        volume to 0) like PulseAudio for instance on Linux. At the moment
+        the only player supporting this new API is the
+        MediaPlayerPrivateGStreamer.
 
         * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::HTMLMediaElement): Currently the platforms that have a flexible pitch preservation 
-          property (Quicktime on Mac and Win) have had it on by default, so continue that default for now.
-        (WebCore::HTMLMediaElement::loadResource):
-        (WebCore::HTMLMediaElement::webkitPreservesPitch):
-        (WebCore::HTMLMediaElement::setWebkitPreservesPitch):
+        (WebCore::HTMLMediaElement::setMuted):
+        (WebCore::HTMLMediaElement::mediaPlayerVolumeChanged):
+        (WebCore::HTMLMediaElement::mediaPlayerMuteChanged):
         * html/HTMLMediaElement.h:
-        * html/HTMLMediaElement.idl:
-
         * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::setPreservesPitch):
+        (WebCore::NullMediaPlayerPrivate::supportsMuting):
+        (WebCore::NullMediaPlayerPrivate::setMuted):
         (WebCore::MediaPlayer::MediaPlayer):
-        (WebCore::MediaPlayer::preservesPitch):
-        (WebCore::MediaPlayer::setPreservesPitch):
+        (WebCore::MediaPlayer::muted):
+        (WebCore::MediaPlayer::supportsMuting):
+        (WebCore::MediaPlayer::setMuted):
+        (WebCore::MediaPlayer::volumeChanged):
+        (WebCore::MediaPlayer::muteChanged):
         * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerMuteChanged):
         * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::setPreservesPitch):
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateInterface::supportsMuting):
+        (WebCore::MediaPlayerPrivateInterface::setMuted):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateVolumeChangedCallback):
+        (WebCore::notifyVolumeIdleCallback):
+        (WebCore::mediaPlayerPrivateMuteChangedCallback):
+        (WebCore::notifyMuteIdleCallback):
         (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::createQTMovie): Rework to allow recreation of the movie with almost the
-          exact same attributes as before, with pitch preservation being the difference.
-        (WebCore::MediaPlayerPrivate::setPreservesPitch): Recreate the QTMovie if the flag actually changes.
-        (WebCore::MediaPlayerPrivate::updateStates): Restore current time and rate if this is a recreated movie.
-        (WebCore::MediaPlayerPrivate::timeChanged): Clear the time-to-be-restored, as this callback means it
-          has been effectively overwritten.
-
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::load):
-        (WebCore::MediaPlayerPrivate::setPreservesPitch):
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
-        * platform/graphics/win/QTMovieWin.cpp:
-        (QTMovieWinPrivate::QTMovieWinPrivate):
-        (QTMovieWinPrivate::~QTMovieWinPrivate):
-        (QTMovieWinPrivate::task): Restore current time and rate if this is a re-created movie.
-        (QTMovieWin::play): Clear the time-to-be-restored, as this effectively overwrites it.
-        (QTMovieWin::pause): Ditto.
-        (QTMovieWin::setRate): Ditto.
-        (QTMovieWin::setCurrentTime): Ditto.
-        (QTMovieWin::setPreservesPitch): Recreate the Movie if the flag actually changes.
-        (QTMovieWin::load): Rework to allow recreation of the Movie with similar state as the movie before it, 
-          but changing the pitch preservation flag.
-        * platform/graphics/win/QTMovieWin.h:
-
-2009-06-23  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/6998286> Crash after leaving page with <video>
-        
-        Don't try to post events after going into the page cache.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::documentWillBecomeInactive): Cancel pending events and stop
-        event timers so we won't try to post events after going into the cache.
-
-2009-06-23  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Brady Eidson.
-
-        Simplify the interaction between LocalStorageArea/SessionStorageArea
-        and StorageArea by creating a "blockUntilImportComplete()" function
-        rather than bouncing back and forth between the child and parent
-        classes in a somewhat unintuitive manner.
-
-        This patch also paves the way for LocalStorageArea and
-        SessionStorageArea being merged into one.  It's part of several in a
-        set which are separating syncing (to disk) code from the rest of the
-        implementation so that local storage and session storage's code can be
-        unified.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25376
-
-        * storage/LocalStorageArea.cpp:
-        (WebCore::LocalStorageArea::blockUntilImportComplete):
-        * storage/LocalStorageArea.h:
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::length):
-        (WebCore::StorageArea::key):
-        (WebCore::StorageArea::getItem):
-        (WebCore::StorageArea::setItem):
-        (WebCore::StorageArea::removeItem):
-        (WebCore::StorageArea::clear):
-        (WebCore::StorageArea::contains):
-        * storage/StorageArea.h:
-        (WebCore::StorageArea::blockUntilImportComplete):
-
-2009-06-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        First part of https://bugs.webkit.org/show_bug.cgi?id=26652
-        
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paint):
-        (WebCore::RenderLayer::paintLayer):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::):
-        * rendering/RenderReplica.cpp:
-        (WebCore::RenderReplica::paint):
-        Replace the 3 boolean params to RenderLayer::paintLayer() with a bit mask for readability.
-        
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::paintIntoLayer):
-        (WebCore::RenderLayerBacking::paintContents):
-        * rendering/RenderLayerBacking.h:
-        Remove the unused 'haveTransparency' param to paintIntoLayer().
-
-2009-06-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6997929> Assertion at WebCore::RenderLayer::updateClipRects with hardware acceleration
-
-        The updatingControlTints() painting pass goes through compositing layer boundaries,
-        so we need to ensure we don't cache clip rects computed with the wrong root by
-        setting temporaryClipRects to true.
-        
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayer):
-        
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
-        Remove a printf that I left in by mistake.
-
-2009-06-23  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Darin Adler.
-
-        WebCore side of <rdar://problem/6946094>.
-        
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::ClipboardWin::setExternalDataObject):
-        * platform/win/ClipboardWin.h:
-
-2009-06-23  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26650
-
-        Add setFormContentType and setFormData since it is awkward for Chromium
-        to use setFormInfoFromRequest to set the underlying members.  Also, add
-        a clearChildren method that Chromium needs.  These methods are used as
-        part of the Chromium code that serializes a HistoryItem for storing in
-        the browser's session history.
-
-        * history/HistoryItem.cpp:
-        * history/HistoryItem.h:
-
-2009-06-23  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6978938> Need HTML 5 event attributes for media elements
-
-        Test: media/event-attributes.html
-
-        * html/HTMLAttributeNames.in: Add media event attribute names.
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseMappedAttribute): Handle media event attributes.
-
-2009-06-23  Thiago Macieira  <thiago.macieira@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix Qt build with Phonon.
-
-        The #include <phonon> header no longer exists. And the <Phonon> or
-        <Phonon/Phonon> headers have never existed (neither for us nor for the
-        Phonon sources). You have to select each and every header that you do
-        want now.
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-
-2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Remove duplicated code in Qt & GTK logging initialization
-
-        We now share the getChannelFromName() function in Logging.cpp
-
-        * platform/gtk/LoggingGtk.cpp:
-        * platform/qt/LoggingQt.cpp:
-
-2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Rename the plugin logging channel to plural form 'Plugins'
-
-        This matches both the other logging channel names, as well as the
-        WebKit logging channel used by Safari/Mac for plugins.
-
-        * platform/Logging.cpp:
-        * platform/Logging.h:
-        * platform/gtk/LoggingGtk.cpp:
-        * platform/mac/LoggingMac.mm:
-        * platform/qt/LoggingQt.cpp:
-        * platform/win/LoggingWin.cpp:
-        * plugins/PluginDebug.h:
-        * plugins/gtk/PluginPackageGtk.cpp:
-        * plugins/mac/PluginPackageMac.cpp:
-        * plugins/mac/PluginViewMac.cpp:
-        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::volumeChangedCallback):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::supportsMuting):
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::muteChangedCallback):
+        (WebCore::MediaPlayerPrivate::muteChanged):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
 
-2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-02-01  Henry Haverinen  <henry.haverinen@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Fix NPAPI mouse translation issues on Mac
-
-        The WindowRef we pass to the plugin refers to the the top level window,
-        so the x and y positions have to be relative to this position, but we
-        have to manually compensate for title bar decorations and other parents
-        of the QWebView since contentsToWindow() only traverses to the QWebView.
-
-        Previously we did this compensation when passing on mouse coordinates to
-        the plugin, which caused various issues with translations such as not
-        being able to close the Flash settings dialog, or the hand cursor not
-        appearing over links.
-
-        We now do the compensation as part of the call to NPP_SetWindow, and
-        then pass mouse coordinates in global context without any compensation,
-        similar to how both Safari and Mozilla does it.
-
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::globalMousePosForPlugin):
-
-2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Rubber-stamped by Simon Hausmann.
+        [Qt] Build without SSL support is broken
 
-        [Qt] Resolve absolute path to library install_name manually
+        Added missing #ifdefs for OpenSSL support and one null-pointer
+        check for the socket.
 
-        Since our target.path is set to the Qt directory (to be able
-        to do 'make install') the 'absolute_library_soname' option
-        to QMake did not do the right thing.
+        https://bugs.webkit.org/show_bug.cgi?id=34416
 
-        We now compute the absolute path manually using DESTDIR.
-
-        * WebCore.pro:
-
-2009-06-22  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/6991146> Scrollbars in hardware layers don't change to the
-        inactive look in background windows
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayer):
-        Don't short-circuit the "painting" pass that is used to udpate control tints.
-
-2009-06-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26567
-        Upstream V8 bindings code generator. With this change, also added interface ancestor
-        traversal to IDL parser, which is necessary for V8 bindings. The traversal is used
-        to determine whether an interface is a Node to facilitate proper casting and storage
-        in V8DOMMap.
-
-        * bindings/scripts/CodeGenerator.pm: Added parent traversal sub, needed
-            by V8 bindings.
-        * bindings/scripts/CodeGeneratorV8.pm: Added.
-        * bindings/scripts/IDLParser.pm: Modified to allow limited parsing for
-            parent traversal cases.
-
-2009-06-22  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        Add event handler attribute getter/setters to HTMLFrameSetElement
-        as specified in HTML 5.  These match the ones on HTMLBodyElement.
-
-        * dom/Node.h:
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
-        (WebCore::HTMLFrameSetElement::onblur):
-        (WebCore::HTMLFrameSetElement::setOnblur):
-        (WebCore::HTMLFrameSetElement::onerror):
-        (WebCore::HTMLFrameSetElement::setOnerror):
-        (WebCore::HTMLFrameSetElement::onfocus):
-        (WebCore::HTMLFrameSetElement::setOnfocus):
-        (WebCore::HTMLFrameSetElement::onload):
-        (WebCore::HTMLFrameSetElement::setOnload):
-        (WebCore::HTMLFrameSetElement::onbeforeunload):
-        (WebCore::HTMLFrameSetElement::setOnbeforeunload):
-        (WebCore::HTMLFrameSetElement::onmessage):
-        (WebCore::HTMLFrameSetElement::setOnmessage):
-        (WebCore::HTMLFrameSetElement::onoffline):
-        (WebCore::HTMLFrameSetElement::setOnoffline):
-        (WebCore::HTMLFrameSetElement::ononline):
-        (WebCore::HTMLFrameSetElement::setOnonline):
-        (WebCore::HTMLFrameSetElement::onresize):
-        (WebCore::HTMLFrameSetElement::setOnresize):
-        (WebCore::HTMLFrameSetElement::onstorage):
-        (WebCore::HTMLFrameSetElement::setOnstorage):
-        (WebCore::HTMLFrameSetElement::onunload):
-        (WebCore::HTMLFrameSetElement::setOnunload):
-        * html/HTMLFrameSetElement.h:
-        * html/HTMLFrameSetElement.idl:
-
-2009-06-22  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
-        https://bugs.webkit.org/show_bug.cgi?id=25425
-
-        * bindings/scripts/CodeGeneratorJS.pm: Added handling for ReflectURL.
-        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
-
-        * dom/Element.cpp:
-        (WebCore::Element::getURLAttribute): Added. For use implementing getters
-        for ReflectURL.
-        * dom/Element.h: Added getURLAttribute.
-
-        * html/HTMLImageElement.idl: Use Reflect and ReflectURL.
-
-2009-06-22  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Bug 26626: Make WorkerContextExecutionProxy::toV8Object handle exception
-        objects.
-        https://bugs.webkit.org/show_bug.cgi?id=26626
-
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::ToV8Object):
-
-2009-06-22  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Add RenderDataGrid to the build.  Give it some basic default styling (that more or less matches a listbox).  It has a default size
-        of 300x150.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * css/html4.css:
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::createRenderer):
-        * html/HTMLDataGridElement.h:
-        * html/HTMLDataGridElement.idl:
-        * rendering/RenderDataGrid.cpp: Added.
-        (WebCore::RenderDataGrid::RenderDataGrid):
-        (WebCore::RenderDataGrid::~RenderDataGrid):
-        (WebCore::RenderDataGrid::calcPrefWidths):
-        (WebCore::RenderDataGrid::paintObject):
-        (WebCore::RenderDataGrid::valueChanged):
-        (WebCore::RenderDataGrid::invalidateScrollbarRect):
-        (WebCore::RenderDataGrid::isActive):
-        * rendering/RenderDataGrid.h: Added.
-        (WebCore::RenderDataGrid::renderName):
-        (WebCore::RenderDataGrid::canHaveChildren):
-        (WebCore::RenderDataGrid::scrollbarCornerPresent):
-
-2009-06-22  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26430
-        <rdar://problem/6944442> Elements jump around when they become composited (WWDC checkers demo)
-        <rdar://problem/6989006> Lots of time spent in RenderLayerCompositor::calculateCompositedBounds()
-            during window resize when using hardware layers
-        
-        Fix an ordering dependency which caused the compositing position of a layer
-        to be affected by some later sibling, which affected the compositing ancestor's
-        composited bounds.
-        
-        The fix is to only update the compositing positions of layers in some subtree
-        when updateAfterLayout() has been called on all the layers in that subtree,
-        from the ancestor down.
-        
-        Also cache the composited bounds of a RenderLayerBacking, now that we can
-        guarantee that those bounds are accurate.
-        
-        Test: compositing/sibling-positioning.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPositions):
-        (WebCore::RenderLayer::hitTestLayer):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::RenderLayerBacking):
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
-        (WebCore::RenderLayerBacking::paintContents):
-        (WebCore::RenderLayerBacking::compositedBounds):
-        (WebCore::RenderLayerBacking::setCompositedBounds):
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateBacking):
-        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
-        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
-        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
-        * rendering/RenderLayerCompositor.h:
-
-2009-06-22  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        First step in https://bugs.webkit.org/show_bug.cgi?id=25376
-
-        Add StorageSyncManager.cpp/h
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-
-        In preparation for combining SessionStorage and LocalStorage into a
-        single StorageManager, move the syncing bits out of LocalStorage and
-        into its own class.
-
-        The next step is to combine LocalStorageArea and SessionStorageArea
-        into one.  Then SessionStorage and LocalStorage can be combined.
-
-        Note that combining them will cut down on code paths that must be
-        proxied, eliminate virtual dispatch, and allow Chromium to (eventually)
-        write historical sessionStorage to disk when memory is getting tight.
-
-        Also remove a couple bits of cruft including code for quotas which is
-        unnecessary (since a meta-data db is unnecessary since you can just
-        count bytes as you read the local storage databases into memory).
-
-        * storage/LocalStorage.cpp:
-        (WebCore::LocalStorage::LocalStorage):
-        (WebCore::LocalStorage::storageArea):
-        (WebCore::LocalStorage::close):
-        * storage/LocalStorage.h:
-        * storage/LocalStorageArea.cpp:
-        (WebCore::LocalStorageArea::LocalStorageArea):
-        (WebCore::LocalStorageArea::scheduleFinalSync):
-        (WebCore::LocalStorageArea::syncTimerFired):
-        (WebCore::LocalStorageArea::performImport):
-        * storage/LocalStorageArea.h:
-        (WebCore::LocalStorageArea::create):
-        * storage/LocalStorageTask.cpp:
-        (WebCore::LocalStorageTask::performTask):
-        * storage/LocalStorageTask.h:
-        (WebCore::LocalStorageTask::):
-        (WebCore::LocalStorageTask::createImport):
-        * storage/LocalStorageThread.cpp:
-        * storage/LocalStorageThread.h:
-        * storage/SessionStorage.h:
-        * storage/StorageSyncManager.cpp: Copied from WebCore/storage/LocalStorage.cpp.
-        (WebCore::StorageSyncManager::create):
-        (WebCore::StorageSyncManager::StorageSyncManager):
-        (WebCore::StorageSyncManager::fullDatabaseFilename):
-        (WebCore::StorageSyncManager::close):
-        (WebCore::StorageSyncManager::scheduleImport):
-        (WebCore::StorageSyncManager::scheduleSync):
-        * storage/StorageSyncManager.h: Copied from WebCore/storage/LocalStorage.h.
-        (WebCore::):
-
-2009-06-22  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26622
-        Add ChromiumDataObject::copy()
-
-        * platform/chromium/ChromiumDataObject.cpp:
-        * platform/chromium/ChromiumDataObject.h:
-
-2009-06-22  Timothy Hatcher  <timothy@apple.com>
-
-        Add a silhouette image for the enable view of the Resource panel.
-
-        Reviewed by Kevin McCullough.
-
-        * inspector/front-end/Images/resourcesSilhouette.png: Added.
-        * inspector/front-end/inspector.css:
+        * platform/network/qt/SocketStreamHandlePrivate.h:
+        * platform/network/qt/SocketStreamHandleQt.cpp:
+        (WebCore::SocketStreamHandlePrivate::SocketStreamHandlePrivate):
+        (WebCore::SocketStreamHandlePrivate::send):
 
-2009-06-22  Kyle Prete  <kylep@chromium.org>
+2010-02-01  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26552
-        Add V8 JS bindings for Audio Constructor.
-
-        * bindings/v8/custom/V8CustomBinding.h:
-        Added a callback declaration for audio ctor to macro.
-        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
-        Added the whole file.
-
-2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26600
-        StringImpl::copy() no longer copies empty string correctly
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::ustring): Changed method calling syntax to look less like calling a
-        static method.
-        (WebCore::StringImpl::copy): Reverted part of r41917 that caused the problem.
+        Reviewed by Timothy Hatcher.
 
-2009-06-22  Xiaomei Ji  <xji@chromium.org>
+        Web Inspector: Fix rest of the NativeTextViewer (line numbers,
+        conditional breakpoints, selection).
+
+        * inspector/front-end/NativeTextViewer.js:
+        (WebInspector.NativeTextViewer):
+        (WebInspector.NativeTextViewer.prototype._updatePreferredSize):
+        (WebInspector.NativeTextViewer.prototype._registerMouseListeners):
+        (WebInspector.NativeTextViewer.prototype._mouseDown):
+        (WebInspector.NativeTextViewer.prototype._contextMenu):
+        (WebInspector.NativeTextViewer.prototype._lineForMouseEvent):
+        (WebInspector.NativeTextViewer.prototype._lineHeight):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype._registerMouseListeners):
+        (WebInspector.TextEditor.prototype._offsetToLine):
+        (WebInspector.TextEditor.prototype._lineHeight):
+        (WebInspector.TextEditor.prototype.reveal):
+        (WebInspector.TextEditor.prototype._paint):
+        (WebInspector.TextEditor.prototype._updateDivDecorations):
+        (WebInspector.TextEditor.prototype._paintSelection):
+
+2010-02-01  Steve Block  <steveblock@google.com>
 
-        Reviewed by Eric Seidel
+        Reviewed by Ariya Hidayat.
 
-        Not auto-testable since it involves sending a keyboard event to
-        the popup, which is not possible (eventSender sends the key
-        events through webview, we want to go through the webwidget).
+        Adds implementation of JavaString for V8.
+        https://bugs.webkit.org/show_bug.cgi?id=33953
 
-        This patch is one part of the fix for issue "keyboard selection in
-        Hebrew select element does not work in Windows". The other part of the
-        fix is in chromium's webkit/glue layer.
-        https://bugs.webkit.org/show_bug.cgi?id=25899
+        No new tests, build fix only.
 
-        * manual-tests/keyboard_select_non_english.html: Added.
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::isCharacterTypeEvent): Added. Check whether the event is a 
-        character type event. "Char" in Windows or "KeyDown" in Mac is character
-        type event.
-        (WebCore::PopupListBox::typeAheadFind): Since m_lastCharTime is used to
-        indicate whether user types multiple characters continuely as a search
-        prefix or not, it should be only assigned when the event is character 
-        type event. 
+        * bridge/jni/JNIBridge.h: Modified. Include JavaStringV8.h for V8
+        * bridge/jni/v8: Added.
+        * bridge/jni/v8/JavaStringV8.h: Added.
+        (JSC::Bindings::JavaStringImpl::init):
+        (JSC::Bindings::JavaStringImpl::UTF8String):
+        (JSC::Bindings::JavaStringImpl::uchars):
+        (JSC::Bindings::JavaStringImpl::length):
 
-2009-06-22  Kevin McCullough  <kmccullough@apple.com>
+2010-02-01  Alex Milowski  <alex@milowski.com>
 
         Reviewed by Darin Adler.
 
-        <rdar://problem/6115819> Notify of profile start in console
+        Added compile time debug support for mathml layout (block boundary & baseline)
 
-        Put a message in the console that announces that a profile has started,
-        similar to how a console message announces that a profile has finished.
+        * mathml/RenderMathMLBlock.cpp:
+        (WebCore::RenderMathMLBlock::stretchToHeight):
+        (WebCore::RenderMathMLBlock::paint):
+        * mathml/RenderMathMLBlock.h:
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addProfile): Use renamed function.
-        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
-        Renamed.
-        (WebCore::InspectorController::addStartProfilingMessageToConsole):
-        New function that logs the message about the profile starting.
-        (WebCore::InspectorController::startUserInitiatedProfiling): Ditto
-        * inspector/InspectorController.h:
-        * inspector/front-end/ProfilesPanel.js: Print the "run" of the profile's
-        title if there are multiple profiles, and take into account the fact
-        that titles are displayed twice as much now.
-        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
-        * page/Console.cpp:
-        (WebCore::Console::profile): Call new function.
+2010-02-01  Philippe Normand  <pnormand@igalia.com>
 
-2009-06-22  David Hyatt  <hyatt@apple.com>
+        Rubber stamped by Xan Lopez.
 
-        Reviewed by Sam Weinig.
+        Fixed compilation warning about unsigned vs signed comparison.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26615
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::paint):
 
-        Add IDL interface for datagrid cell elements.  Add a few more properties to the datagrid itself that
-        correspond to ones you find on <select> elements.
+2010-01-31  Kent Tamura  <tkent@chromium.org>
 
-        Add an expanded property to row elements.
+        Unreviewed. Revert r54112 and r54124 because of Windows build error.
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
+        * Android.mk:
         * GNUmakefile.am:
+        * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLAttributeNames.in:
-        * html/HTMLDataGridCellElement.cpp: Added.
-        (WebCore::HTMLDataGridCellElement::HTMLDataGridCellElement):
-        (WebCore::HTMLDataGridCellElement::label):
-        (WebCore::HTMLDataGridCellElement::setLabel):
-        (WebCore::HTMLDataGridCellElement::focused):
-        (WebCore::HTMLDataGridCellElement::setFocused):
-        (WebCore::HTMLDataGridCellElement::checked):
-        (WebCore::HTMLDataGridCellElement::setChecked):
-        (WebCore::HTMLDataGridCellElement::indeterminate):
-        (WebCore::HTMLDataGridCellElement::setIndeterminate):
-        (WebCore::HTMLDataGridCellElement::progress):
-        (WebCore::HTMLDataGridCellElement::setProgress):
-        * html/HTMLDataGridCellElement.h: Added.
-        (WebCore::HTMLDataGridCellElement::endTagRequirement):
-        (WebCore::HTMLDataGridCellElement::tagPriority):
-        * html/HTMLDataGridCellElement.idl: Added.
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::autofocus):
-        (WebCore::HTMLDataGridElement::setAutofocus):
-        (WebCore::HTMLDataGridElement::disabled):
-        (WebCore::HTMLDataGridElement::setDisabled):
-        (WebCore::HTMLDataGridElement::size):
-        (WebCore::HTMLDataGridElement::setSize):
-        * html/HTMLDataGridElement.h:
-        * html/HTMLDataGridElement.idl:
-        * html/HTMLDataGridRowElement.cpp:
-        (WebCore::HTMLDataGridRowElement::checkDTD):
-        (WebCore::HTMLDataGridRowElement::expanded):
-        (WebCore::HTMLDataGridRowElement::setExpanded):
-        * html/HTMLDataGridRowElement.h:
-        * html/HTMLDataGridRowElement.idl:
-        * html/HTMLElementsAllInOne.cpp:
-        * html/HTMLTagNames.in:
-
-2009-06-22  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Add event handler attribute getter/setters to HTMLBodyElement
-        as specified in HTML 5.
-
-        - Removes erroneous inclusion of the onresize and onunload event
-        handler attributes in Element and Document.
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::scale):
+        (WebCore::CanvasRenderingContext2D::rotate):
+        (WebCore::CanvasRenderingContext2D::translate):
+        (WebCore::CanvasRenderingContext2D::transform):
+        (WebCore::CanvasRenderingContext2D::setTransform):
+        (WebCore::CanvasRenderingContext2D::isPointInPath):
+        (WebCore::CanvasRenderingContext2D::willDraw):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        * platform/graphics/cairo/PathCairo.cpp:
+        * platform/graphics/cairo/TransformationMatrixCairo.cpp:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        * platform/graphics/cg/PathCG.cpp:
+        * platform/graphics/cg/TransformationMatrixCG.cpp:
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        * platform/graphics/haiku/PathHaiku.cpp:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/qt/PathQt.cpp:
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        * platform/graphics/skia/PathSkia.cpp:
+        * platform/graphics/skia/TransformationMatrixSkia.cpp:
+        * platform/graphics/transforms/AffineTransform.cpp: Removed.
+        * platform/graphics/transforms/AffineTransform.h: Removed.
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        * platform/graphics/wx/PathWx.cpp:
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        (WebCore::TransformationMatrix::operator wxGraphicsMatrix):
 
-        * dom/Document.cpp:
-        (WebCore::Document::getWindowAttributeEventListener):
-        * dom/Document.h:
-        * dom/Document.idl:
-        * dom/Element.idl:
-        * dom/Node.cpp:
-        * dom/Node.h: onblur, onerror, onfocus, and onload all need to be declared
-        virtual, since their behavior for HTMLBodyElement differs from the base
-        implementation.
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::onblur):
-        (WebCore::HTMLBodyElement::setOnblur):
-        (WebCore::HTMLBodyElement::onerror):
-        (WebCore::HTMLBodyElement::setOnerror):
-        (WebCore::HTMLBodyElement::onfocus):
-        (WebCore::HTMLBodyElement::setOnfocus):
-        (WebCore::HTMLBodyElement::onload):
-        (WebCore::HTMLBodyElement::setOnload):
-        (WebCore::HTMLBodyElement::onbeforeunload):
-        (WebCore::HTMLBodyElement::setOnbeforeunload):
-        (WebCore::HTMLBodyElement::onmessage):
-        (WebCore::HTMLBodyElement::setOnmessage):
-        (WebCore::HTMLBodyElement::onoffline):
-        (WebCore::HTMLBodyElement::setOnoffline):
-        (WebCore::HTMLBodyElement::ononline):
-        (WebCore::HTMLBodyElement::setOnonline):
-        (WebCore::HTMLBodyElement::onresize):
-        (WebCore::HTMLBodyElement::setOnresize):
-        (WebCore::HTMLBodyElement::onstorage):
-        (WebCore::HTMLBodyElement::setOnstorage):
-        (WebCore::HTMLBodyElement::onunload):
-        (WebCore::HTMLBodyElement::setOnunload):
-        * html/HTMLBodyElement.h:
-        * html/HTMLBodyElement.idl:
-
-2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
+2010-01-31  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26601
-        Remove disabled code for appcache dynamic entries
-
-        This also removes code for DOM 3 Core DOMStringList, which we don't use for anything else yet.
-
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSDOMStringListCustom.cpp: Removed.
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMStringListCustom.cpp: Removed.
-        * dom/DOMStringList.cpp: Removed.
-        * dom/DOMStringList.h: Removed.
-        * dom/DOMStringList.idl: Removed.
-        * dom/StaticStringList.cpp: Removed.
-        * dom/StaticStringList.h: Removed.
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache):
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::addResource):
-        * loader/appcache/ApplicationCache.h:
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
-        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
-        * loader/appcache/ApplicationCacheResource.cpp:
-        (WebCore::ApplicationCacheResource::dumpType):
-        * loader/appcache/ApplicationCacheResource.h:
-        (WebCore::ApplicationCacheResource::):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::storeUpdatedType):
-        * loader/appcache/DOMApplicationCache.cpp:
-        * loader/appcache/DOMApplicationCache.h:
-        * loader/appcache/DOMApplicationCache.idl:
-        * page/DOMWindow.idl:
-
-2009-06-22  Steve Falkenburg  <sfalken@apple.com>
-
-        Windows build fix.
-
-        * DerivedSources.cpp:
-        * html/HTMLElementsAllInOne.cpp:
-
-2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by John Sullivan.
-
-        <rdar://problem/6956606> REGRESSION (S4Beta -> Final): After the password is input,
-        Japanese can't be input.
-
-        WebKit uses a per-frame input context for most editable fields, and application's global
-        context for password fields, manually controlling secure input state and the list of available
-        input sources.
-
-        We were setting TSMDocument property to disable non-Roman input methods after focus changed
-        to a password field, but before selection was updated. This resulted in the property being
-        applied to a wrong TSMDocument in some cases, because TSMGetActiveDocument() uses input
-        context cached by +[NSApplication updateWindows], we change context based on selection,
-        not on focus.
-
-        * page/mac/FrameMac.mm: (WebCore::Frame::setUseSecureKeyboardEntry): Since there is only one
-        context that we use for password fields - the global one - there is no need to get the active
-        one.
-
-2009-06-22  David Levin  <levin@chromium.org>
-
-        Reviewed by David Hyatt and Eric Seidel.
-
-        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
-        https://bugs.webkit.org/show_bug.cgi?id=26326
-
-        Test: scrollbars/scrollbar-crash-on-refresh.html
-
-        * dom/Document.cpp:
-        (WebCore::Document::detach):
-        Gives the FrameView a change to do any necessary cleanup on
-        Document::detach() which is where the renderArena gets detroyed.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::detachCustomScrollbars):
-        Gets rid of any custom scrollbars (if the docment supplied them).
-        * page/FrameView.h:
-        * platform/Scrollbar.h:
-        (WebCore::Scrollbar::isCustomScrollbar):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::destroy):
-        Removed the check for document()->frame().  If frame() is 0 in this code,
-        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
-        * rendering/RenderScrollbar.h:
-        (WebCore::RenderScrollbar::isCustomScrollbar):
-
-2009-06-22  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=23606
-          <rdar://problem/6537777> CSS gradient not repainted when image load
-          completes
-
-        Test: fast/repaint/background-generated.html
-
-        * rendering/RenderObject.cpp:
-        (WebCore::mustRepaintFillLayers): Return true if the layer does not
-        specify a size and the image uses the container size.
-
-2009-06-22  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26607
-
-        Add IDL for HTMLDataGridRowElement.
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLAttributeNames.in:
-        * html/HTMLDataGridColElement.cpp:
-        (WebCore::HTMLDataGridColElement::primary):
-        (WebCore::HTMLDataGridColElement::setPrimary):
-        * html/HTMLDataGridColElement.h:
-        * html/HTMLDataGridColElement.idl:
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::checkDTD):
-        (WebCore::HTMLDataGridElement::multiple):
-        (WebCore::HTMLDataGridElement::setMultiple):
-        * html/HTMLDataGridElement.h:
-        * html/HTMLDataGridElement.idl:
-        * html/HTMLDataGridRowElement.cpp: Added.
-        (WebCore::HTMLDataGridRowElement::HTMLDataGridRowElement):
-        (WebCore::HTMLDataGridRowElement::selected):
-        (WebCore::HTMLDataGridRowElement::setSelected):
-        (WebCore::HTMLDataGridRowElement::focused):
-        (WebCore::HTMLDataGridRowElement::setFocused):
-        * html/HTMLDataGridRowElement.h: Added.
-        (WebCore::HTMLDataGridRowElement::tagPriority):
-        * html/HTMLDataGridRowElement.idl: Added.
-        * html/HTMLTagNames.in:
-
-2009-06-19  Yael Aharon <yael.aharon@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26556
-
-        Fix a crash in case that the QNetworkReply::readReady signal is
-        "stuck" in deferred mode due to JavaScript alert, and in the meantime,
-        QNetworkreply::finished signal is received and processed before
-        QNetworkReply::readReady is processed.
-
-        * manual-tests/qt/unload-alert.html: Added.
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::setLoadMode):
-        (WebCore::QNetworkReplyHandler::finish):
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-        (WebCore::QNetworkReplyHandler::forwardData):
-        (WebCore::QNetworkReplyHandler::start):
-        (WebCore::QNetworkReplyHandler::sendQueuedItems):
-        * platform/network/qt/QNetworkReplyHandler.h:
-        (WebCore::QNetworkReplyHandler::):
-
-2009-06-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Fix the Qt build.
+        Limit the scope of packing alignment to avoid MSVC C4103 warning.
+        https://bugs.webkit.org/show_bug.cgi?id=34390
 
-        * WebCore.pro:
-
-2009-06-21  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
-        https://bugs.webkit.org/show_bug.cgi?id=25425
-
-        * bindings/scripts/CodeGeneratorJS.pm: Tweaked mechanism for includes to be a bit
-        more consistent and to make SVGElement.h be included in the header rather than in
-        every implementation file that includes the header. Added code to use getAttribute
-        and setAttribute directly when the [Reflect] extended attribute is used.
-
-        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
-
-        * html/HTMLElement.idl: Used [Reflect] for all the attributes in this class that
-        reflect content attributes. Restricting this to one class for now to keep the
-        patch small and start out slowly.
-
-2009-06-21  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26596
-        Only expose event handler attributes to elements and documents.
-
-        Test: fast/dom/event-attribute-availability.html
-
-        * dom/Document.idl:
-        * dom/Element.idl:
-        * dom/Node.cpp:
-        * dom/Node.h:
-        * dom/Node.idl:
-
-2009-06-21  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26580
-        
-        Fix to enable XSSAuditor on child windows.
-        
-        Test: http/tests/security/xssAuditor/link-opens-new-window.html
-        
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::XSSAuditor):
-        (WebCore::XSSAuditor::isEnabled):
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        * page/XSSAuditor.h: Removed method setXSSAuditorEnabled, and field m_isEnabled.
-        Moved implementation of isEnabled to XSSAuditor.cpp and changed implementation
-        to query Settings.
-
-2009-06-21  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY.
-
-        Speculative windows build fix (idea by Mark Rowe).
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-06-21  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY (Speculative gtk build fix).
-
-        * GNUmakefile.am:
-
-2009-06-21  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY.
-
-        Speculative tiger build fix and a windows build fix.
-        More fixes may still be in order.
-
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * dom/default/PlatformMessagePortChannel.h:
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
-
-2009-06-21  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY (Speculative tiger build fix).
-
-        * dom/default/PlatformMessagePortChannel.h:
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::~MessagePortQueue):
-
-2009-06-21  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=26448>
-        
-        Added optimized GC for MessagePorts when the entangled port is run by the same thread.
-        Fixed bug in isProxyFor() that was not properly throwing an exception when trying to clone the entangled port.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::markActiveObjectsForContext):
-        Now marks remotely entangled ports as in-use, in addition to those with pending activity.
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::mark):
-        Now checks if the entangled port is local (run by same thread) and if so mark()s it.
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::postMessage):
-        (WebCore::MessagePort::disentangle):
-        Removes cloned ports from the ScriptExecutionContext - this allows cloned ports to be GC'd as otherwise they look like remotely entangled ports.
-        (WebCore::MessagePort::start):
-        (WebCore::MessagePort::locallyEntangledPort):
-        Added API for fetching the entangled port if it is run by the same thread
-        * dom/MessagePort.h:
-        * dom/MessagePortProxyWrapper.h:
-        * dom/default/MessagePortProxy.cpp:
-        (WebCore::MessagePortProxyWrapper::locallyEntangledPort):
-        Added API for fetching the entangled port if it is run by the same thread        
-        (WebCore::MessagePortProxy::hasPendingActivity):
-        Changed definition of hasPendingActivity() to be stricter - only returns true if there are pending messages.
-        (WebCore::MessagePortProxy::locallyEntangledPort):
-        * dom/default/MessagePortProxy.h:
-
-2009-06-21  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=25043>
-        Removed obsolete MessagePort.startConversation(), active and onclose APIs.
-
-        Refactored MessagePortProxy into MessagePortChannel and a platform-dependent PlatformMessagePortChannel
-        implementation. Modified APIs to simplify cross-process implementations by moving the messaging code
-        entirely into the platform-dependent proxy.
-
-        Created a thread-safe default PlatformMessagePortChannel implementation.
-
-        Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how
-        cross-thread MessagePorts work.
-        
-        * GNUMakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-            Added MessagePortChannel/PlatformMessagePortChannel files.
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::mark):
-            Changed ports to not mark their entangled pair as reachable, per the spec.
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        * dom/MessageChannel.cpp:
-        (WebCore::MessageChannel::MessageChannel):
-            Updated to use PlatformMessagePortChannel::createChannel() to entangle the ports.
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::MessagePort):
-        (WebCore::MessagePort::~MessagePort):
-        (WebCore::MessagePort::postMessage):
-        (WebCore::MessagePort::disentangle):
-        (WebCore::MessagePort::messageAvailable):
-        (WebCore::MessagePort::start):
-        (WebCore::MessagePort::close):
-        (WebCore::MessagePort::entangle):
-        (WebCore::MessagePort::contextDestroyed):
-        (WebCore::MessagePort::dispatchMessages):
-        (WebCore::MessagePort::setOnmessage):
-        (WebCore::MessagePort::hasPendingActivity):
-            Changed these APIs to delegate to new PlatformMessagePortChannel APIs.
-        * dom/MessagePort.h:
-            Renamed isQueueOpen() to started().
-        * dom/MessagePort.idl:
-            Removed startConversation and onclose.
-        * dom/MessagePortProxy.h: Removed.
-        * dom/MessagePortChannel.cpp: Added.
-        (WebCore::MessagePortChannel::EventData::create):
-        (WebCore::MessagePortChannel::EventData::EventData):
-        (WebCore::MessagePortChannel::~MessagePortChannel):
-        * dom/MessagePortChannel.h: Added.
-        (WebCore::MessagePortChannel::EventData::message):
-        (WebCore::MessagePortChannel::EventData::channel):
-            Changed EventData to hold a reference to a MessagePortChannel object instead of a MessagePort to enable cross-thread messaging.
-        (WebCore::MessagePortChannel::MessagePortChannel):
-        (WebCore::MessagePortChannel::create):        
-        * dom/ScriptExecutionContext.cpp:
-        (WebCore:ScriptExecutionContext::dispatchMessagePortEvents):
-            Renamed isQueueOpen() to started().
-        * dom/default/PlatformMessagePortChannel.cpp: Added.
-        (WebCore::MessagePortChannel::entangleIfOpen):
-        (WebCore::MessagePortChannel::disentangle):
-        (WebCore::MessagePortChannel::postMessageToRemote):
-        (WebCore::MessagePortChannel::tryGetMessageFromRemote):
-        (WebCore::MessagePortChannel::close):
-        (WebCore::MessagePortChannel::isConnectedTo):
-        (WebCore::MessagePortChannel::hasPendingActivity):
-        (WebCore::PlatformMessagePortChannel::PlatformMessagePortChannel):
-        (WebCore::PlatformMessagePortChannel::~PlatformMessagePortChannel):
-        (WebCore::PlatformMessagePortChannel::createChannel):
-        (WebCore::PlatformMessagePortChannel::entangleIfOpen):
-        (WebCore::PlatformMessagePortChannel::disentangle):
-        (WebCore::PlatformMessagePortChannel::setRemotePort):
-        (WebCore::PlatformMessagePortChannel::remotePort):
-        (WebCore::PlatformMessagePortChannel::entangledChannel):
-        (WebCore::PlatformMessagePortChannel::setEntangledChannel):
-        (WebCore::PlatformMessagePortChannel::postMessageToRemote):
-        (WebCore::PlatformMessagePortChannel::tryGetMessageFromRemote):
-        (WebCore::PlatformMessagePortChannel::isConnectedTo):
-        (WebCore::PlatformMessagePortChannel::close):
-        (WebCore::PlatformMessagePortChannel::closeInternal):
-        (WebCore::PlatformMessagePortChannel::hasPendingActivity):
-        * dom/default/PlatformMessagePortChannel.h: Added.
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::create):
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::appendAndCheckEmpty):
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::isEmpty):
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::MessagePortQueue):
-        * page/DOMWindow.cpp:
-        (WebCore::PostMessageTimer::PostMessageTimer):
-            Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how cross-thread MessagePorts work.
-        (WebCore::PostMessageTimer::event):
-        (WebCore::DOMWindow::postMessage):
-        (WebCore::DOMWindow::postMessageTimerFired):
-
-2009-06-21  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=15383
-          <rdar://problem/5682745> resize: vertical does not restrict to vertical
-          resize
-
-        Test: fast/css/resize-single-axis.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::resize): Ignore movement along the non-resizing
-        axis.
+        Use pack(push, 16) and pack(pop) to limit the scope of packing
+        alignment change.
 
-2009-06-21  Sam Weinig  <sam@webkit.org>
+        * bindings/js/JSSVGPODTypeWrapper.h:
 
-        Reviewed by Eric Seidel
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26578
-        event.currentTarget for listener registered on window should point to the window object like in Firefox
-
-        Test: fast/events/event-trace.html
-
-        * dom/Node.cpp:
-        (WebCore::Node::dispatchGenericEvent): Make the DOMWindow the currentTarget when events are dispatched
-        to it. We previously used the document because DOMWindow was not yet an EventTarget.
-
-2009-06-21  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=9694
-          resize value not compared
-
-        Test: fast/css/resize-value-compared.html
-
-        * rendering/style/StyleRareInheritedData.cpp:
-        (WebCore::StyleRareInheritedData::operator==): Compare the resize
-        member.
-
-2009-06-19  Alice Liu  <alice.liu@apple.com>
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=26568 
-        Repro crash animating GIF if previously used in a closed window's back/forward list
-        Also filed as <rdar://problem/6978362>
-
-        Reviewed by Maciej Stachowiak.
-
-        Can't test this bug with an automated layout test since it requires b/f caching 
-        * manual-tests/animated-gif-bfcache-crash.html: Added.
-        * manual-tests/resources/containsAnimatedGif.html: Added.
-
-        Adding checks for hostWindow() since there is no guarantee that the Page is alive
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollRectIntoViewRecursively):
-        (WebCore::ScrollView::contentsToScreen):
-        (WebCore::ScrollView::screenToContents):
-        (WebCore::ScrollView::wheelEvent):
-
-2009-06-20  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26554
-        Shadowing of top and parent
-
-        * page/DOMWindow.idl:
-
-2009-06-20  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix <https://bugs.webkit.org/show_bug.cgi?id=15106>.
-        Bug 15106: REGRESSION: Can't drag text as element when user-select is set to none
-
-        We allow selections to begin within an element that has -webkit-user-select: none set,
-        unless the element is draggable as dragging should take priority over starting a selection.
-
-        Test: editing/selection/user-drag-element-and-user-select-none.html
-
-        * dom/Node.cpp:
-        (WebCore::Node::canStartSelection):
-
-2009-06-20  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Bug 26528: REGRESSION (r44674): Assertion in TextIterator::pushFullyClippedState while counting matches for "a" on apple.com
-        https://bugs.webkit.org/show_bug.cgi?id=26528
-        rdar://problem/6985329
-
-        * editing/TextIterator.cpp:
-        (WebCore::TextIterator::handleReplacedElement): When entering a text control,
-        start at the top of the shadow tree (by calling shadowTreeRootNode). Also
-        remove assumption that innerTextElement will never be 0 since RenderTextControl
-        doesn't really guarantee this.
-
-2009-06-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by NOBODY.
-
-        Speculative Qt build fix - add HTMLDataGridColElement to the build script.
-
-        * WebCore.pro:
-
-2009-06-19  Adam Barth  <abarth@webkit.org>
+2010-01-31  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26561
-
-        Remove a memcpy by retrieving the already existing copy of a string
-        instead of making a new one.
-
-        * bindings/js/ScriptSourceCode.h:
-        (WebCore::ScriptSourceCode::ScriptSourceCode):
-        (WebCore::ScriptSourceCode::source):
-        * bindings/js/StringSourceProvider.h:
-        (WebCore::StringSourceProvider::source):
-
-2009-06-19  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Steve Falkenburg.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26488
-        No Support for Single Finger or Two Finger Panning in Windows 7
-        
-        The code in WebCore allows us to interpret a Pan gesture as
-        a mousewheel event, and we are able to reuse the scrolling code.
-        Another constructor was created in WheelEventWin which takes data
-        better suited to the pan guesture than what was currently there. 
-        
-        Unable to add tests to simulate touch behavior/gestures.
-
-        * platform/PlatformWheelEvent.h:
-        * platform/win/WheelEventWin.cpp:
-
-2009-06-19  Chris Marrin  <cmarrin@apple.com>
-
-        Fixed a build error, which only shows up in the i386 compile
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::animateTransform):
-
-2009-06-19  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/6988385> REGRESSION: In full page video player, movie's
-        video track becomes detached from its controller.
-        
-        When in the media document, the MediaPlayer should not report that it
-        is capable of hardware acceleration, because it renders via a QTMovieView
-        which is already accelerated.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
-
-2009-06-19  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Adding XSSAuditor.cpp to the wx build.
-
-        * WebCoreSources.bkl:
-
-2009-06-19  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26544
-
-        If I am doing a Matrix hardware animation and any matrix is singular, I revert to software.
-        This is not really testable, since we can't see what the hardware animation is doing.
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::animateTransform):
-
-2009-06-19  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-        
-        An additional fix for Bug 26532: Native functions do not correctly unlink
-        from optimised callsites when they're collected
-        <https://bugs.webkit.org/show_bug.cgi?id=26532> | <rdar://problem/6625385>
-
-        Use "NativeFunctionWrapper" instead of "PrototypeFunction" in cross-frame
-        accessors, so the type of object you get to wrap a function is the same,
-        regardless of whether the access to the function is cross-frame.
-        
-        This is faster and more idiomatic than what we had before. It also would
-        have avoided Bug 26532 because it would have prevented a conflicting
-        PrototypeFunction from being allocated to wrap postMessage, where a
-        NativeFunctionWrapper had been allocated previously.
-        
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::objectToStringFunctionGetter):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::nonCachingStaticFunctionGetter):
-        * bindings/js/JSHistoryCustom.cpp:
-        (WebCore::nonCachingStaticBackFunctionGetter):
-        (WebCore::nonCachingStaticForwardFunctionGetter):
-        (WebCore::nonCachingStaticGoFunctionGetter):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::nonCachingStaticReplaceFunctionGetter):
-        (WebCore::nonCachingStaticReloadFunctionGetter):
-        (WebCore::nonCachingStaticAssignFunctionGetter):
-
-2009-06-19  Simon Fraser  <simon.fraser@apple.com>
+        Fix valueAsNumber calculation for type=month.
+        https://bugs.webkit.org/show_bug.cgi?id=34304
 
-        Reviewed by John Sullivan
+        valueAsNumber calculation for type=month which was checked in as
+        r53893 was the number of milliseconds since UNIX epoch, and it was
+        wrong. The correct way is the number months since UNIX epoch.
 
-        <rdar://problem/6953673> Crash in RenderLayerCompositor::setCompositingParent
-        
-        Fix a crash that could occur in complex content due to timing issues
-        when doing a partial layer tree rebuild which is required when painting;
-        setCompositingParent() could be called with a parent which has not been made
-        compositing yet.
-
-2009-06-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Build fix. Adding missing HTMLDataGrid* files to the build.
-
-        * GNUmakefile.am:
-
-2009-06-19  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26460 part three
-        Make BMPImageReader a standalone class that is used by ICOImageDecoder
-        and BMPImageDecoder to decode individual BMPs within a file.  These
-        decoders now inherit directly from ImageDecoder.
-        
-        This also makes these decoders decode on-demand in isSizeAvailable() and
-        frameBufferAtIndex(), like the other decoders, instead of when setData()
-        is called, like before.  This should provide a speedup on pages
-        containing BMPs that aren't immediately onscreen.
-
-        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
-        (WebCore::BMPImageDecoder::BMPImageDecoder):
-        (WebCore::BMPImageDecoder::setData):
-        (WebCore::BMPImageDecoder::isSizeAvailable):
-        (WebCore::BMPImageDecoder::frameBufferAtIndex):
-        (WebCore::BMPImageDecoder::decodeWithCheckForDataEnded):
-        (WebCore::BMPImageDecoder::decode):
-        (WebCore::BMPImageDecoder::processFileHeader):
-        * platform/image-decoders/bmp/BMPImageDecoder.h:
-        (WebCore::BMPImageDecoder::readUint32):
-        * platform/image-decoders/bmp/BMPImageReader.cpp:
-        (WebCore::BMPImageReader::BMPImageReader):
-        (WebCore::BMPImageReader::decodeBMP):
-        (WebCore::BMPImageReader::readInfoHeaderSize):
-        (WebCore::BMPImageReader::processInfoHeader):
-        (WebCore::BMPImageReader::readInfoHeader):
-        (WebCore::BMPImageReader::processBitmasks):
-        (WebCore::BMPImageReader::processColorTable):
-        (WebCore::BMPImageReader::processRLEData):
-        (WebCore::BMPImageReader::processNonRLEData):
-        (WebCore::BMPImageReader::setFailed):
-        * platform/image-decoders/bmp/BMPImageReader.h:
-        (WebCore::BMPImageReader::readUint16):
-        (WebCore::BMPImageReader::readUint32):
-        (WebCore::BMPImageReader::setBuffer):
-        (WebCore::BMPImageReader::setData):
-        (WebCore::BMPImageReader::):
-        (WebCore::BMPImageReader::pastEndOfImage):
-        (WebCore::BMPImageReader::readCurrentPixel):
-        (WebCore::BMPImageReader::setRGBA):
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::ICOImageDecoder):
-        (WebCore::ICOImageDecoder::setData):
-        (WebCore::ICOImageDecoder::isSizeAvailable):
-        (WebCore::ICOImageDecoder::size):
-        (WebCore::ICOImageDecoder::frameBufferAtIndex):
-        (WebCore::ICOImageDecoder::decodeWithCheckForDataEnded):
-        (WebCore::ICOImageDecoder::decode):
-        (WebCore::ICOImageDecoder::processDirectory):
-        (WebCore::ICOImageDecoder::processDirectoryEntries):
-        (WebCore::ICOImageDecoder::readDirectoryEntry):
-        (WebCore::ICOImageDecoder::processImageType):
-        * platform/image-decoders/ico/ICOImageDecoder.h:
-        (WebCore::ICOImageDecoder::readUint16):
-        (WebCore::ICOImageDecoder::readUint32):
-
-2009-06-19  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26555
-
-        Fix the Chromium canary bot.  Turns out ScriptSourceCode doesn't have
-        the same API in V8 and JSC.
-
-        * WebCore/bindings/js/ScriptController.cpp:
-        * WebCore/bindings/js/ScriptSourceCode.h:
-        * WebCore/bindings/v8/ScriptController.cpp:
-        * WebCore/page/XSSAuditor.cpp:
-        * WebCore/page/XSSAuditor.h:
-
-2009-06-19  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26547
-        
-        Implement the IDL interface for HTMLDataGridColElement.
-
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLAttributeNames.in:
-        * html/HTMLDataGridColElement.cpp: Added.
-        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
-        (WebCore::HTMLDataGridColElement::label):
-        (WebCore::HTMLDataGridColElement::setLabel):
-        (WebCore::HTMLDataGridColElement::type):
-        (WebCore::HTMLDataGridColElement::setType):
-        (WebCore::HTMLDataGridColElement::sortable):
-        (WebCore::HTMLDataGridColElement::setSortable):
-        (WebCore::HTMLDataGridColElement::sortDirection):
-        (WebCore::HTMLDataGridColElement::setSortDirection):
-        (WebCore::HTMLDataGridColElement::selected):
-        (WebCore::HTMLDataGridColElement::setSelected):
-        * html/HTMLDataGridColElement.h: Added.
-        (WebCore::HTMLDataGridColElement::endTagRequirement):
-        (WebCore::HTMLDataGridColElement::tagPriority):
-        * html/HTMLDataGridColElement.idl: Added.
-        * html/HTMLDataGridElement.h:
-        * html/HTMLElementsAllInOne.cpp:
-        * html/HTMLTagNames.in:
-        * page/DOMWindow.idl:
-
-2009-06-19  Chris Evans  <scarybeasts@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        There is no new test because this cannot be tested deterministically.
-        I've not been able to cause a crash at all in the test framework, but
-        I have verified that this is happening in the wild and that the patch
-        fixes the likely cause in the debugger.
-
-        * loader/TextResourceDecoder.cpp: careful not to iterate off the end
-          of our input buffer looking for the end of the comment.
-
-2009-06-19  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26536
-
-        Fix external-script-URL-location.html and
-        write-external-script-open.html LayoutTests.
-
-        implicitOpen is called from several places.  We need to setXSSAuditor
-        each time, so I moved the call inside implicitOpen.
-
-        * dom/Document.cpp:
-        (WebCore::Document::open):
-        (WebCore::Document::implicitOpen):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-
-2009-06-19  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by David Levin.
-
-        Use WebCore::multipleFileUploadText() in Chromium to fix a problem
-        that Chromium shows only the first filename even if a user selects
-        multiple files for <input type=file multiple>.
-        <https://bugs.webkit.org/show_bug.cgi?id=26502>
-
-        * platform/chromium/FileChooserChromium.cpp:
-        (WebCore::FileChooser::basenameForWidth):
-
-2009-06-19  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        - fix <rdar://problem/6967596> Safari hung using 100% CPU when I tried
-          to look up a word in Dictionary using command-control-d
-
-        Test: editing/selection/move-by-line-005.html
-
-        The root cause of this bug was searchAheadForBetterMatch() continuing
-        past the first rendered text object after the given object. While we
-        want to skip non-rendered text and empty containers, when we encounter
-        rendered text object, we must return a text box for that object.
-
-        * dom/Position.cpp:
-        (WebCore::searchAheadForBetterMatch):
-
-2009-06-19  Jungshik Shin  <jshin@chromium.org>
-
-        Reviewed by David Levin
-
-        https://bugs.webkit.org/show_bug.cgi?id=25657
+        * html/DateComponents.cpp:
+        (WebCore::DateComponents::setMonthsSinceEpoch):
+        (WebCore::DateComponents::monthsSinceEpoch):
+        * html/DateComponents.h: Declare setMonthsSinceEpoch() and monthsSinceEpoch().
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseToDouble):
+          Switch to monthsSinceEpoch() for type=MONTH.
+        (WebCore::HTMLInputElement::valueAsDate):
+          Add code with millisecondsSinceEpoch() for MONTH because
+          parseToDouble() changed its behavior.
+        (WebCore::HTMLInputElement::setValueAsNumber):
+          Use setMonthsSinceEpoch() for MONTH.
 
-        Chromium Linux port does not handle non-BMP characters properly.
-        It's fixed with a 'UTF-16 iterator macro' to extract Unicode
-        codepoints out of a UTF-16 input string.
+2010-01-31  Dan Bernstein  <mitz@apple.com>
 
-        A manual test is added for non-BMP character rendering,
-        which we can use until a small freely-distributable font
-        covering non-BMP is added to the Webkit source tree.
+        Reviewed by Timothy Hatcher.
 
+        Web Inspector: REGRESSION: Numbers in bubbles are vertically off-center
+        https://bugs.webkit.org/show_bug.cgi?id=34398
 
-        * platform/graphics/chromium/FontCacheLinux.cpp:
-        (WebCore::FontCache::getFontDataForCharacters):
-        * manual-tests/non-bmp.html: Added.
+        * inspector/front-end/inspector.css: Specify line-height: normal for
+        ".console-message .bubble" and ".sidebar-tree-item .status .bubble".
 
-2009-06-19  Pavel Feldman  <pfeldman@chromium.org>
+2010-01-28  Ojan Vafai  <ojan@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Darin Adler.
 
-        V8 Bindings: return proper state from the script stack.
+        Implement CSSOM Range.getClientRects for collapsed selections
+        https://bugs.webkit.org/show_bug.cgi?id=34239
 
-        https://bugs.webkit.org/show_bug.cgi?id=26512
+        When getting the quads for a range on a text node, allow returning
+        zero width quads. This leaves the case of collapsed selections inside
+        elements still not fixed, but no worse.
 
-        * bindings/v8/ScriptCallStack.cpp:
-        (WebCore::ScriptCallStack::ScriptCallStack):
-        * bindings/v8/ScriptCallStack.h:
-        (WebCore::ScriptCallStack::state):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::selectionRect):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteQuadsForRange):
 
-2009-06-19  Jessie Berlin  <jberlin@apple.com>
+2010-01-31  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Simon Fraser.
 
-        Windows build fix.
-        
-        * platform/graphics/cg/PatternCG.cpp:
-        (WebCore::Pattern::createPlatformPattern):
-
-2009-06-19  Yael Aharon  <yael.aharon@nokia.com>
+        Animated scaling of background-image is too slow
+        https://bugs.webkit.org/show_bug.cgi?id=33808
 
-        Reviewed by Simon Hausmann.
-        Build fix after 44825.
+        Implement a version of the RenderImage animated scaling optimisation
+        for background images. Due to the possibility of arbitrary transforms
+        being applied to containing elements we explicitly check the current
+        CTM of the context for scaling or rotation.
 
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::isSizeAvailable):
-        * platform/graphics/qt/ImageDecoderQt.h:
-
-2009-06-18  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 26426: Canvas: rotation of 'no-repeat' pattern is weird
-        <https://bugs.webkit.org/show_bug.cgi?id=26426>
-
-        Use 1<<23-1 as steps of no-repeat patterns instead of 100000000.0f.
-        The original number cannot be represented by mantissa of float
-        (23bit) so that it caused some error.
-
-        Test: fast/canvas/image-object-in-canvas.html:
-
-        * platform/graphics/cg/PatternCG.cpp:
-        (WebCore::Pattern::createPlatformPattern):
-
-2009-06-19  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed attempt to fix the Chromium build.
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::ScriptController):
-        (WebCore::ScriptController::evaluate):
-        * bindings/v8/ScriptController.h:
-        (WebCore::ScriptController::xssAuditor):
-        * bindings/v8/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawTiledImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::isIdentityOrTranslation):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleData::RenderBoxModelScaleData):
+        (WebCore::RenderBoxModelScaleData::~RenderBoxModelScaleData):
+        (WebCore::RenderBoxModelScaleData::hiqhQualityRepaintTimer):
+        (WebCore::RenderBoxModelScaleData::size):
+        (WebCore::RenderBoxModelScaleData::setSize):
+        (WebCore::RenderBoxModelScaleData::lastPaintTime):
+        (WebCore::RenderBoxModelScaleData::setLastPaintTime):
+        (WebCore::RenderBoxModelScaleData::useLowQualityScale):
+        (WebCore::RenderBoxModelScaleData::transform):
+        (WebCore::RenderBoxModelScaleData::setTransform):
+        (WebCore::RenderBoxModelScaleData::setUseLowQualityScale):
+        (WebCore::RenderBoxModelScaleObserver::boxModelObjectDestroyed):
+        (WebCore::RenderBoxModelScaleObserver::highQualityRepaintTimerFired):
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
+        (WebCore::RenderBoxModelObject::highQualityRepaintTimerFired):
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
 
-2009-06-18  Adam Barth  <abarth@webkit.org>
+2010-01-31  Dirk Schulze  <krit@webkit.org>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Simon Fraser.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26199
+        Add back an AffineTransform class for use by SVG
+        https://bugs.webkit.org/show_bug.cgi?id=33750
 
-        Added an experimental reflective XSS filter.  The filter is disabled by
-        default.
+        These are the first steps on reimplementing AffineTransform. Unlike
+        the old affine code, this one is platform independent like TransformationMatrix.
+        AffineTransform has the benefit, that it stores just 6 doubles instead of
+        16 in TransformationMatrix. The calculations of transformations are not that
+        complex and can improve the memory usage and speed of SVG.
+        AffineTransform can be used by HTML Canvas3D or SVG, since they are 2D related (at
+        least for the moment).
+        HTML Canvas is the first that makes use of the new AffineTransform. Next patches
+        will introduce the affine code to SVG.
 
-        Test: http/tests/security/xssAuditor/script-tag.html
+        No new tests. The new AffineTransformation code is tested by fast/canvas.
 
+        * Android.mk:
         * GNUmakefile.am:
-        * WebCore.base.exp:
+        * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::ScriptController):
-        (WebCore::ScriptController::evaluate):
-        * bindings/js/ScriptController.h:
-        (WebCore::ScriptController::xssAuditor):
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
-        * dom/Tokenizer.h:
-        (WebCore::Tokenizer::xssAuditor):
-        (WebCore::Tokenizer::setXSSAuditor):
-        (WebCore::Tokenizer::Tokenizer):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptHandler):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-        (WebCore::FrameLoader::requestObject):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setXSSAuditorEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::xssAuditorEnabled):
-        * page/XSSAuditor.cpp: Added.
-        (WebCore::isControlCharacter):
-        (WebCore::XSSAuditor::XSSAuditor):
-        (WebCore::XSSAuditor::~XSSAuditor):
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::decodeURL):
-        (WebCore::XSSAuditor::findInRequest):
-        * page/XSSAuditor.h: Added.
-        (WebCore::XSSAuditor::isEnabled):
-        (WebCore::XSSAuditor::setXSSAuditorEnabled):
-
-2009-06-18  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        feOffset and objectBoundingBox
-        [https://bugs.webkit.org/show_bug.cgi?id=26441]
-
-        If we use objectBoundingBox for primitiveUnits, the fractions given
-        to dx or dy of feOffset must be multiplied with the referenced objects
-        objectBoundingBox size.
-
-        Test: svg/filters/feOffset.svg
-
-        * svg/graphics/filters/SVGFEOffset.cpp:
-        (WebCore::FEOffset::apply):
-
-2009-06-18  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        feTile implementation missing
-        [https://bugs.webkit.org/show_bug.cgi?id=26419]
-
-        Implementation of feTile, a pattern effect for SVG filters. It was
-        necessary to modify FilterEffect since source inputs need a secial
-        logic and we have to identify if an effect is a source input.
-
-        Tests: svg/batik/filters/feTile.svg
-               svg/filters/feTile.svg
-
-        * platform/graphics/filters/FilterEffect.h:
-        (WebCore::FilterEffect::isSourceInput):
-        * platform/graphics/filters/SourceAlpha.h:
-        (WebCore::SourceAlpha::isSourceInput):
-        * platform/graphics/filters/SourceGraphic.h:
-        (WebCore::SourceGraphic::isSourceInput):
-        * svg/graphics/filters/SVGFETile.cpp:
-        (WebCore::FETile::apply):
-
-2009-06-18  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        feMerge implementation
-        [https://bugs.webkit.org/show_bug.cgi?id=26480]
-
-        Added feMerge to the SVG Filter system.
-
-        Test: svg/filters/feMerge.svg
-
-        * svg/graphics/filters/SVGFEMerge.cpp:
-        (WebCore::FEMerge::uniteChildEffectSubregions):
-        (WebCore::FEMerge::apply):
-        * svg/graphics/filters/SVGFEMerge.h:
-
-2009-06-18  Mark Rowe  <mrowe@apple.com>
-
-        Speculative Windows build fix.
-
-        * page/win/FrameCGWin.cpp: Add missing #include.
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Dave Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26425
-        Final refactorings, picking up a few places where BitmapInfo
-        could be used.
-
-        * page/win/FrameCGWin.cpp:
-        (WebCore::imageFromRect):
-        * platform/win/CursorWin.cpp:
-        (WebCore::Cursor::Cursor):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::paint):
-
-2009-06-18  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 26522: In DOM mode, VoiceOver reads some mouseover text on web sites strangely
-        https://bugs.webkit.org/show_bug.cgi?id=26522
-
-        Test: accessibility/non-data-table-cell-title-ui-element.html
-
-        * accessibility/AccessibilityTableCell.cpp:
-        (WebCore::AccessibilityTableCell::titleUIElement):
-
-2009-06-18  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix after recent RenderTheme changes.
-
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::RenderThemeWx::~RenderThemeWx):
-        (WebCore::RenderTheme::themeForPage):
-
-2009-06-18  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26460 part two
-        Attempt to minimize diff of following functional change by first landing
-        non-functional change to:
-        * Make readUintX() public and static (since they will need to be once
-          BMPImageReader is included in *ImageDecoder via composition rather
-          than inheritance).  Add wrappers in each class so callers can be
-          simpler.  In the next patch, these wrappers will be beefed up slightly
-          and the callers will get even simpler.
-        * Change direct setting of m_failed to use setFailed(), since in the
-          next patch much of this code won't even have direct access to m_failed
-        * Add a helper function in ICOImageDecoder to determine the image type
-          instead of simply doing it inline
-        * Rewrap lines that used to be <=80 cols and slipped over it during the
-          original landing of these decoders
-        * Other misc. changes, e.g. adding constructor definitions, reordering
-          functions, changing RGBA32Buffer& to RGBA32Buffer*, etc. that have no
-          functional effect but minimize the subsequent diff for readability
-
-
-        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
-        (WebCore::BMPImageDecoder::BMPImageDecoder):
-        (WebCore::BMPImageDecoder::processFileHeader):
-        * platform/image-decoders/bmp/BMPImageDecoder.h:
-        (WebCore::BMPImageDecoder::readUint32):
-        * platform/image-decoders/bmp/BMPImageReader.cpp:
-        (WebCore::BMPImageReader::decodeBMP):
-        (WebCore::BMPImageReader::getInfoHeaderSize):
-        (WebCore::BMPImageReader::processInfoHeader):
-        (WebCore::BMPImageReader::readInfoHeader):
-        (WebCore::BMPImageReader::processBitmasks):
-        (WebCore::BMPImageReader::processColorTable):
-        (WebCore::BMPImageReader::processRLEData):
-        (WebCore::BMPImageReader::processNonRLEData):
-        * platform/image-decoders/bmp/BMPImageReader.h:
-        (WebCore::BMPImageReader::readUint16Helper):
-        (WebCore::BMPImageReader::readUint32Helper):
-        (WebCore::BMPImageReader::):
-        (WebCore::BMPImageReader::readUint16):
-        (WebCore::BMPImageReader::readUint32):
-        (WebCore::BMPImageReader::readCurrentPixel):
-        (WebCore::BMPImageReader::getComponent):
-        (WebCore::BMPImageReader::setI):
-        (WebCore::BMPImageReader::setRGBA):
-        (WebCore::BMPImageReader::fillRGBA):
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::ICOImageDecoder):
-        (WebCore::ICOImageDecoder::isSizeAvailable):
-        (WebCore::ICOImageDecoder::size):
-        (WebCore::ICOImageDecoder::decodeImage):
-        (WebCore::ICOImageDecoder::processDirectory):
-        (WebCore::ICOImageDecoder::processDirectoryEntries):
-        (WebCore::ICOImageDecoder::isBetterEntry):
-        (WebCore::ICOImageDecoder::processImageType):
-        * platform/image-decoders/ico/ICOImageDecoder.h:
-        (WebCore::ICOImageDecoder::readUint16):
-        (WebCore::ICOImageDecoder::readUint32):
-
-2009-06-18  Peter Kasting  <pkasting@google.com>
-
-        Fix build bustage.
-
-        * platform/image-decoders/gif/GIFImageDecoder.h:
-
-2009-06-18  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/6940880> REGRESSION: Breakpoints don't break in 64-bit
-
-        Convert intptr_t to Strings so that we don't loose bits in the
-        conversion to JS.  Previously they were being put into 32bit ints.
-
-        * inspector/InspectorController.cpp: Convert the String back to an
-        intptr_t.
-        (WebCore::InspectorController::addBreakpoint):
-        (WebCore::InspectorController::removeBreakpoint):
-        * inspector/InspectorController.h:
-        * inspector/InspectorController.idl: Use strings in JS to avoid 32bit
-        truncation.
-        * inspector/InspectorFrontend.cpp: Make the intptr_t into a String.
-        (WebCore::InspectorFrontend::parsedScriptSource):
-        * platform/text/PlatformString.h: Implemented the necessary conversion
-        functions to be able to convert to and from an intptr_t.
-        * platform/text/String.cpp: Ditto.
-        (WebCore::String::toIntPtrStrict):
-        (WebCore::String::toIntPtr):
-        (WebCore::charactersToIntPtrStrict):
-        (WebCore::charactersToIntPtr):
-        * platform/text/StringImpl.cpp: Ditto.
-        (WebCore::StringImpl::toIntPtrStrict):
-        (WebCore::StringImpl::toIntPtr):
-        * platform/text/StringImpl.h: Ditto.
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Final cleanups in this refactoring:
-        (1) Move WindowsBitmap implementation from CG-specific file to
-            the platform-common GraphicsContextWin.cpp, since it is
-            equally useful on both platforms.
-        (2) Revise the TransformationMatrix logic as suggested by
-            Adam Roben in his review comments to Part #2 of this
-            refactoring.
-
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        * platform/graphics/win/GraphicsContextWin.cpp:
-        (WebCore::GraphicsContext::WindowsBitmap::WindowsBitmap):
-        (WebCore::GraphicsContext::WindowsBitmap::~WindowsBitmap):
-        (WebCore::GraphicsContext::createWindowsBitmap):
-        (WebCore::GraphicsContext::getWindowsContext):
-        (WebCore::GraphicsContextPlatformPrivate::scale):
-        (WebCore::GraphicsContextPlatformPrivate::rotate):
-        (WebCore::GraphicsContextPlatformPrivate::translate):
-        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
-
-2009-06-18  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26460 part one
-        Make isSizeAvailable non-const, since it's not logically const (it
-        triggers lazy decoding), and simplify all the implementations (without
-        changing behavior; just make less verbose).  Remove some other
-        inappropriate consts, which enables the removal of all the mutable
-        declarations in the decoders.
-
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::ImageDecoder::isSizeAvailable):
-        (WebCore::ImageDecoder::setSize): Make public to avoid needing a friend declaration in the JPEG decoder, and because the ICO/BMP decoders will soon need this.
-        * platform/image-decoders/gif/GIFImageDecoder.cpp:
-        (WebCore::GIFImageDecoder::isSizeAvailable):
-        (WebCore::GIFImageDecoder::repetitionCount):
-        (WebCore::GIFImageDecoder::decode):
-        * platform/image-decoders/gif/GIFImageDecoder.h:
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::isSizeAvailable):
-        * platform/image-decoders/ico/ICOImageDecoder.h:
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::JPEGImageDecoder::isSizeAvailable):
-        (WebCore::JPEGImageDecoder::decode):
-        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
-        * platform/image-decoders/png/PNGImageDecoder.cpp:
-        (WebCore::PNGImageDecoder::isSizeAvailable):
-        (WebCore::PNGImageDecoder::decode):
-        * platform/image-decoders/png/PNGImageDecoder.h:
-        * platform/image-decoders/xbm/XBMImageDecoder.cpp:
-        (WebCore::XBMImageDecoder::isSizeAvailable):
-        (WebCore::XBMImageDecoder::frameBufferAtIndex):
-        (WebCore::XBMImageDecoder::decode):
-        * platform/image-decoders/xbm/XBMImageDecoder.h: Rename decodeXBM() to decode() for consistency with the JPEG/PNG decoders, and in the future the ICO/BMP decoders.
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Move some common functions out of platform files and into
-        the common implementation.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26425.
-        Add a new platform context method (flush) so that the
-        getWindowsContext method can be consolidated into the common
-        GraphicsContextWin.cpp file.
-         
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::scale):
+        (WebCore::CanvasRenderingContext2D::rotate):
+        (WebCore::CanvasRenderingContext2D::translate):
+        (WebCore::CanvasRenderingContext2D::transform):
+        (WebCore::CanvasRenderingContext2D::setTransform):
+        (WebCore::CanvasRenderingContext2D::isPointInPath):
+        (WebCore::CanvasRenderingContext2D::willDraw):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
         * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
-        (WebCore::GraphicsContextPlatformPrivate::flush):
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/cairo/TransformationMatrixCairo.cpp:
+        (WebCore::AffineTransform::operator cairo_matrix_t):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getAffineCTM):
         * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
-        (WebCore::GraphicsContextPlatformPrivate::flush):
-        * platform/graphics/win/GraphicsContextCGWin.cpp: Remove
-          getWindowContext method.
-        * platform/graphics/win/GraphicsContextCairoWin.cpp: Remove
-          getWindowContext method and fillWithClearColor methods.
-        * platform/graphics/win/GraphicsContextWin.cpp:
-        (WebCore::fillWithClearColor): Moved from *CairoWin.cpp
-        (WebCore::GraphicsContext::getWindowsContext): Moved
-          from *CairoWin.cpp
-
-2009-06-18  Ojan Vafai  <ojan@chromium.org>
-
-        Reviewed by Oliver Hunt.
-
-        Remove code that I accidentally committed in r44811.
-
-        * editing/markup.cpp:
-        (WebCore::createMarkup):
-
-2009-06-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        <rdar://problem/6983207> Non-layer content is not re-rendered when transition
-        starts sometimes (with hardware acceleration).
-        
-        When deciding which RenderLayers should be composited, when a layer goes into
-        compositing mode we repaint the old location. However, we did that before
-        we'd looked at all the factors that may force a layer to composite, so missed
-        some cases. Fix by doing the repaint once we really know whether it's going
-        to composite.
-
-        Test: compositing/repaint/become-overlay-composited-layer.html
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-
-2009-06-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined, and
-        the Tiger build where QTMovieLayer does not exist.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
-        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
-        (WebCore::MediaPlayerPrivate::currentRenderingMode):
-        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
-        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
-        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
-
-2009-06-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::currentRenderingMode):
-        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
-        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
-
-2009-06-17  Erik Arvidsson  <arv@chromium.org>
-
-        Reviewed by Adele Peterson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=15189
-        Adds the HTML5 input event support for textarea.
-        
-        Also, moves the oninput attribute parse handling to HTMLElement so that
-        it can be set on any HTML element so that bubbling events can be handled
-        using HTML attribute handlers.
-
-        Test: fast/forms/textarea-input-event.html
-
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::parseMappedAttribute):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
-
-2009-06-18  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Share code between filterEffects
-        [https://bugs.webkit.org/show_bug.cgi?id=26479]
-
-        Share more code of filter effects. The imageBuffer creation can move to
-        FilterEffect ant every effect asks for the GraphicsContext. Move the
-        drawingRect calculation to FilterEffect.
-
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::calculateDrawingRect):
-        (WebCore::FilterEffect::getEffectContext):
-        * platform/graphics/filters/FilterEffect.h:
-        * platform/graphics/filters/SourceGraphic.cpp:
-        (WebCore::SourceGraphic::apply):
-        * svg/graphics/filters/SVGFEFlood.cpp:
-        (WebCore::FEFlood::apply):
-        * svg/graphics/filters/SVGFEOffset.cpp:
-        (WebCore::FEOffset::apply):
-
-2009-06-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26499
-        
-        Support hardware-accelerationed rendering of video elements.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::mediaPlayerSawUnsupportedTracks):
-        (WebCore::HTMLMediaElement::mediaPlayerRepaint):
-        Just move these methods to group the render-related methods together.
-        
-        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
-        Call out method to ask the RenderLayerCompositor if presentation of this video
-        can be acclerated. It might say no, if, for example, the video has a reflection.
-        
-        (WebCore::HTMLMediaElement::mediaPlayerGraphicsLayer):
-        Fetch the GraphicsLayer from the RenderVideo that will host the movie layer.
-        
-        * html/HTMLMediaElement.h:
-        Reordered the rendering-related methods, and added two methods related to video
-        acceleration.
-        
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::acceleratedRenderingStateChanged):
-        Called by the rendering system when it determines that the video must go into, or
-        fall off of the hardware-accelerated path.
-        
-        (WebCore::MediaPlayer::supportsAcceleratedRendering):
-        Method to say whether the media engine supports accelerated rendering.
-        
-        * platform/graphics/MediaPlayer.h:
-        (WebCore::MediaPlayerClient::mediaPlayerRepaint):
-        (WebCore::MediaPlayerClient::mediaPlayerSizeChanged):
-        Moved.
-        
-        (WebCore::MediaPlayerClient::mediaPlayerRenderingCanBeAccelerated):
-        (WebCore::MediaPlayerClient::mediaPlayerGraphicsLayer):
-        New methods to ask the client if the rendering system can support accelerated
-        rendering, and to get a GraphicsLayer to plug the movie layer into.
-        
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::supportsAcceleratedRendering):
-        (WebCore::MediaPlayerPrivateInterface::acceleratedRenderingStateChanged):
-        Forwarding methods from MediaPlayer.
-        
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        Some new methods related to using a QTMovieLayer, and to simplify the rendering mode logic.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
-        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
-        Methods to create and destroy the QTMovieLayer.
-        
-        (WebCore::MediaPlayerPrivate::currentRenderingMode):
-        (WebCore::MediaPlayerPrivate::preferredRenderingMode):
-        Methods to clarify the code that decides which of the 3 rendering modes to use.
-        
-        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
-        Changed to use the new rendering mode methods.
-        
-        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
-        Destroy the layer if we have one.
-        
-        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
-        Small utility method.
-        
-        (WebCore::MediaPlayerPrivate::updateStates):
-        Move the call to setUpVideoRendering() to before we send out the state notifications,
-        so that we will have created the rendering objects already.
-        
-        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
-        Return true if we have QTMovieLayer.
-        
-        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
-        We've been told that we went into or out of accelerated mode; maybe reset
-        the renderer, and set the layer if we have to.
-        
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::rendererContentChanged):
-        We may need to udpate compositing layers if the video went into accelerated mode.
-        
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::canUseDirectCompositing):
-        Add smarts to deal with video, which allows us to avoid extra backing store.
-        
-        (WebCore::RenderLayerBacking::contentsBox):
-        Use the videoBox to use the content layer for video layers.
-        
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
-        Poke the RenderVideo if the state changed.
-        
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        Handle an edge case when the video element itself is a stacking context
-        because of opacity or transform.
-        
-        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
-        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
-        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
-        Allow video to throw us into compositing mode if the media engine supports it.
-        
-        * rendering/RenderLayerCompositor.h:
-        New methods related to video.
-        
-        * rendering/RenderVideo.h:
-        * rendering/RenderVideo.cpp:
-        (WebCore::RenderVideo::updatePlayer):
-        Call rendererContentChanged() to give the compositor a change to throw the video into
-        compositing mode.
-        
-        (WebCore::RenderVideo::supportsAcceleratedRendering):
-        (WebCore::RenderVideo::acceleratedRenderingStateChanged):
-        (WebCore::RenderVideo::videoGraphicsLayer):
-        Methods to allow the MediaPlayer to do rendering-related stuff via the media element.
-
-2009-06-18  Rob Buis  <rwlbuis@gmail.com>
-
-        Reviewed by Niko.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26385
-        Root SVG element is not checked on requiredFeatures, requiredExtension like other elements
-
-        Also do the isValid check for outer <svg>.
-
-        Test: svg/custom/outer-svg-unknown-feature.svg
-
-        * svg/SVGDocument.cpp:
-        (WebCore::SVGDocument::childShouldCreateRenderer):
-        * svg/SVGDocument.h:
-
-2009-06-18  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        - fix <rdar://problem/6913221> REGRESSION (Safari 3-4): Search field on
-          apple.com cuts entered text
-
-        Test: fast/forms/search-vertical-alignment.html
-
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::layout): Vertically center the
-            the search field's inner block.
-
-2009-06-18  Janne Koskinen  <janne.p.koskinen@digia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix compilation with Symbian WINSCW compiler, which produced
-        multiple definitions of the CSSPrimitiveValue conversion operators.
-
-        It turns out that they are defined inline but not declared inline.
-
-        Adding the inline keyword to the declaration fixes the build.
-
-        * css/CSSPrimitiveValue.h:
-
-2009-06-18  Markus Goetz <Markus.Goetz@nokia.com>
-
-        Reviewed by Simon Hausman.
-
-        Clarify in docs how to compile with debug information.
-
-        * WebCore.pro:
-
-2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] When writing an URL to the clipboard, save the corresponding title
-        in the mime data as well.
-
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::writeURL):
-
-2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
-
-        [Qt] Fix build. Add HTMLDataGridElement.
-
-        * WebCore.pro:
-
-2009-06-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Gtk build fix.
-
-        Add HTMLDataGridElement header and IDL to the build script.
-
-        * GNUmakefile.am:
-
-2009-06-18  Chris Evans  <scarybeasts@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        Fix 8-digit long hex entities. Fixes bug 26454
-        https://bugs.webkit.org/show_bug.cgi?id=26454
-
-        Test: fast/parser/eightdigithexentity.html
-
-        * html/HTMLTokenizer.cpp: fix off-by-ones.
-
-2009-06-18  David Levin  <levin@chromium.org>
-
-        Fix chromium linux build.
-
-        Fixes a mistake that happened during the complicated merge for
-        landing r44775, r44776, r44777.
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::create):
-
-2009-06-17  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26499
-        
-        First step to making video rendering be hardware-accelerated:
-        make <video> elements get self-painting RenderLayers, and add
-        an isVideo() virtual method to RenderObject.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::setReadyState):
-        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged):
-        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
-        (WebCore::RenderLayer::isSelfPaintingLayer):
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isVideo):
-        * rendering/RenderVideo.h:
-        (WebCore::RenderVideo::requiresLayer):
-        (WebCore::RenderVideo::isVideo):
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Adam Roben.
-
-        Refactor a few common routines in the various Windows ports
-        and reduce some duplicated code.
-
-        (1) Create TransformationMatrix XFORM casting operator, and
-            switch various XFORM structure uses to utilize it.
-        (2) Push concatCTM call to GraphicsContextWin now that the
-            TransformationMatrix can directly create XFORM (rather
-            than converting to CGAffineTransform/cairo_matrix_t first.)
-
-        * WebCore.vcproj/WebCore.vcproj: Add new BitmapInfo structure.
-        * platform/graphics/transforms/TransformationMatrix.h:
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        * platform/graphics/win/GraphicsContextCairoWin.cpp:
-        * platform/graphics/win/GraphicsContextWin.cpp:
-        (WebCore::GraphicsContextPlatformPrivate::scale):
-        (WebCore::GraphicsContextPlatformPrivate::rotate):
-        (WebCore::GraphicsContextPlatformPrivate::translate):
         (WebCore::GraphicsContextPlatformPrivate::concatCTM):
-        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
-        (WebCore::TransformationMatrix::operator XFORM): New operator
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Non-CG Windows build fix after @r44758.
-
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderTheme::themeForPage):
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Adam Roben.
-
-        Refactor a few common routines in the various Windows ports
-        and reduce some duplicated code.
-        https://bugs.webkit.org/show_bug.cgi?id=26425.
-
-        Refactor use of BITMAPINFO for the new BitmapInfo structure.
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * platform/win/BitmapInfo.cpp: Added.
-        (WebCore::bitmapInfoForSize):
-        (WebCore::BitmapInfo::create):
-        (WebCore::BitmapInfo::createBottomUp):
-        * platform/win/BitmapInfo.h: Added.
-        * platform/graphics/win/GraphicsContextCairoWin.cpp:
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
-        (WebCore::TransformationMatrix::operator XFORM): New operator
-        * platform/win/DragImageCGWin.cpp:
-        (WebCore::allocImage):
-        * platform/win/DragImageCairoWin.cpp:
-        (WebCore::allocImage):
-        * platform/win/PasteboardWin.cpp:
-        (WebCore::Pasteboard::writeImage):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::paint):
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Remove unnecessary 6th parameter from SOFT_LINK_OPTIONAL
-
-        Reviewed by Mark Rowe.
-
-        * platform/graphics/win/ColorSafari.cpp: Removed the 6th parameter and
-        an unnecessary parameter name.
-        * platform/win/SoftLinking.h: Removed the unused 6th parameter.
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Make Settings::shouldPaintNativeControls default to true
-
-        This matches the default up in WebKit (that was changed in r43318).
-
-        Fixes Bug 26493: REGRESSION (r44758): First tab always uses Mac-style
-        form controls
-        <https://bugs.webkit.org/show_bug.cgi?id=26493>
-
-        Reviewed by Darin Adler and Dave Hyatt.
-
-        No test possible since DRT always uses Mac-style form controls.
-
-        * page/Settings.cpp: Changed the initial value of
-        gShouldPaintNativeControls to true.
-
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderTheme::themeForPage): Added a FIXME about the design
-        flaw here involving querying Settings before it's been initialized.
-
-2009-06-17  David Levin  <levin@chromium.org>
-
-        Fix chromium windows build.
-
-        A mistake that happened during the complicated merge for
-        landing r44775, r44776, r44777.
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/cg/TransformationMatrixCG.cpp:
+        (WebCore::AffineTransform::operator CGAffineTransform):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/haiku/PathHaiku.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        (WebCore::AffineTransform::operator QTransform):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/skia/TransformationMatrixSkia.cpp:
+        (WebCore::AffineTransform::operator SkMatrix):
+        * platform/graphics/transforms/AffineTransform.cpp: Added.
+        (WebCore::affineTransformDecompose):
+        (WebCore::affineTransformCompose):
+        (WebCore::AffineTransform::AffineTransform):
+        (WebCore::AffineTransform::reset):
+        (WebCore::AffineTransform::setMatrix):
+        (WebCore::AffineTransform::isIdentity):
+        (WebCore::AffineTransform::det):
+        (WebCore::AffineTransform::isInvertible):
+        (WebCore::AffineTransform::inverse):
+        (WebCore::AffineTransform::multiply):
+        (WebCore::AffineTransform::multLeft):
+        (WebCore::AffineTransform::rotate):
+        (WebCore::AffineTransform::scale):
+        (WebCore::AffineTransform::translate):
+        (WebCore::AffineTransform::scaleNonUniform):
+        (WebCore::AffineTransform::rotateFromVector):
+        (WebCore::AffineTransform::flipX):
+        (WebCore::AffineTransform::flipY):
+        (WebCore::AffineTransform::shear):
+        (WebCore::AffineTransform::skew):
+        (WebCore::AffineTransform::skewX):
+        (WebCore::AffineTransform::skewY):
+        (WebCore::makeMapBetweenRects):
+        (WebCore::AffineTransform::map):
+        (WebCore::AffineTransform::mapPoint):
+        (WebCore::AffineTransform::mapRect):
+        (WebCore::AffineTransform::blend):
+        * platform/graphics/transforms/AffineTransform.h: Added.
+        (WebCore::AffineTransform::a):
+        (WebCore::AffineTransform::setA):
+        (WebCore::AffineTransform::b):
+        (WebCore::AffineTransform::setB):
+        (WebCore::AffineTransform::c):
+        (WebCore::AffineTransform::setC):
+        (WebCore::AffineTransform::d):
+        (WebCore::AffineTransform::setD):
+        (WebCore::AffineTransform::e):
+        (WebCore::AffineTransform::setE):
+        (WebCore::AffineTransform::f):
+        (WebCore::AffineTransform::setF):
+        (WebCore::AffineTransform::operator== ):
+        (WebCore::AffineTransform::operator!=):
+        (WebCore::AffineTransform::operator*=):
+        (WebCore::AffineTransform::operator*):
+        (WebCore::AffineTransform::setMatrix):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getAffineCTM):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        (WebCore::AffineTransform::operator wxGraphicsMatrix):
 
-        * rendering/RenderThemeChromiumWin.h:
-        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
-        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
+2010-01-31  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-06-17  Eric Carlson  <eric.carlson@apple.com>
+        Reviewed by Timothy Hatcher.
 
-        Reviewed by Simon Fraser.
+        Web Inspector: [REGRESSION] Breakpoint source line is not displayed
+        in the breakpoint manager.
 
-        <rdar://problem/6981193> Crash in MediaControlInputElement::attachToParent
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaTextDisplayElement::attachToParent): NULL check element renderer or parent renderer.
-        (WebCore::MediaControlInputElement::attachToParent): Ditto.
+2010-01-31  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-06-17  David Hyatt  <hyatt@apple.com>
+        Reviewed by Timothy Hatcher.
 
-        Fix Windows build.  There's no HTMLDataGridElement.cpp file yet.
+        Web Inspector: Introduce NativeTextViewer.
 
-        * html/HTMLElementsAllInOne.cpp:
+        This change handles rendering highlighted text, using browser's
+        selection/drag/drop/click logic. Breakpoint decorations and
+        program counter is working.
 
-2009-06-17  David Hyatt  <hyatt@apple.com>
+        Todo: line numbers are painted 'under' the text when scrolling
+        horizontally, search is not yet implemented.
 
-        Reviewed by Adam Roben and Anders Carlsson.
+        https://bugs.webkit.org/show_bug.cgi?id=34391
 
-        Stub out the HTMLDataGridElement.
-
-        * DerivedSources.make:
+        * WebCore.gypi:
         * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::adjustRenderStyle):
-        * editing/htmlediting.cpp:
-        (WebCore::canHaveChildrenForEditing):
-        * html/HTMLDataGridElement.h: Added.
-        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
-        (WebCore::HTMLDataGridElement::tagPriority):
-        * html/HTMLDataGridElement.idl: Added.
-        * html/HTMLElement.cpp:
-        (WebCore::inlineTagList):
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::isAffectedByResidualStyle):
-        * html/HTMLTagNames.in:
-
-2009-06-17  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY (chromium build fix).
-
-        Fix typo in previous changes.
-
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
-
-2009-06-17  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26148
-        Remove common code from RenderThemeChromiumWin that is shared with
-        RenderThemeChromiumSkia.
-
-        Also move supportsControlTints to RenderThemeChromiumLinux since it
-        is linux specific.
-
-        There are no tests changed because this just removes functions with
-        duplicate implementations between the base and derived classes.
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::supportsControlTints):
-        * rendering/RenderThemeChromiumLinux.h:
-        * rendering/RenderThemeChromiumSkia.cpp:
-        * rendering/RenderThemeChromiumSkia.h:
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::):
-        (WebCore::getNonClientMetrics):
-        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
-        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
-        (WebCore::RenderThemeChromiumWin::systemFont):
-        (WebCore::RenderThemeChromiumWin::paintCheckbox):
-        (WebCore::RenderThemeChromiumWin::paintRadio):
-        (WebCore::RenderThemeChromiumWin::paintSliderThumb):
-        (WebCore::RenderThemeChromiumWin::caretBlinkIntervalInternal):
-        * rendering/RenderThemeChromiumWin.h:
-
-2009-06-17  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26148
-        Move RenderThemeChromiumSkia into its own file.  This is purely a code move.
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        * rendering/RenderThemeChromiumLinux.h:
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::):
-        (WebCore::setSizeIfAuto):
-        (WebCore::mediaElementParent):
-        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
-        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
-        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
-        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::supportsHover):
-        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
-        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
-        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
-        (WebCore::RenderThemeChromiumSkia::systemFont):
-        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
-        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
-        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
-        (WebCore::RenderThemeChromiumSkia::paintRadio):
-        (WebCore::RenderThemeChromiumSkia::setRadioSize):
-        (WebCore::brightenColor):
-        (WebCore::paintButtonLike):
-        (WebCore::RenderThemeChromiumSkia::paintButton):
-        (WebCore::RenderThemeChromiumSkia::paintTextField):
-        (WebCore::RenderThemeChromiumSkia::paintTextArea):
-        (WebCore::RenderThemeChromiumSkia::paintSearchField):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
-        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
-        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
-        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
-        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
-        (WebCore::RenderThemeChromiumSkia::paintMenuList):
-        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
-        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
-        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
-        * rendering/RenderThemeChromiumSkia.h:
-        (WebCore::RenderThemeChromiumSkia::supportsControlTints):
+        * inspector/front-end/DivBasedTextViewer.js: Added.
+        (WebInspector.DivBasedTextViewer):
+        (WebInspector.DivBasedTextViewer.prototype._textChanged):
+        (WebInspector.DivBasedTextViewer.prototype._createLineDivs):
+        (WebInspector.DivBasedTextViewer.prototype._updatePreferredSize):
+        (WebInspector.DivBasedTextViewer.prototype._scroll):
+        (WebInspector.DivBasedTextViewer.prototype._registerMouseListeners):
+        (WebInspector.DivBasedTextViewer.prototype._registerKeyboardListeners):
+        (WebInspector.DivBasedTextViewer.prototype._registerClipboardListeners):
+        (WebInspector.DivBasedTextViewer.prototype._paintSelection):
+        (WebInspector.DivBasedTextViewer.prototype._positionDivDecoration):
+        (WebInspector.DivBasedTextViewer.prototype._mouseDown):
+        (WebInspector.DivBasedTextViewer.prototype._contextMenu):
+        (WebInspector.DivBasedTextViewer.prototype._caretForMouseEvent):
+        (WebInspector.DivBasedTextViewer.prototype._paintLine):
+        (WebInspector.DivBasedTextViewer.prototype._createSpan):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.clearMessages):
+        (WebInspector.SourceFrame.prototype.sizeToFitContentHeight):
+        (WebInspector.SourceFrame.prototype._createEditorIfNeeded):
+        (WebInspector.SourceFrame.prototype._addMessageToSource):
+        (WebInspector.SourceFrame.prototype.resize):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype.setDivDecoration):
+        (WebInspector.TextEditor.prototype._registerMouseListeners):
+        (WebInspector.TextEditor.prototype._registerKeyboardListeners):
+        (WebInspector.TextEditor.prototype._registerClipboardListeners):
+        (WebInspector.TextEditor.prototype.reveal):
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype.revalidateDecorationsAndPaint):
+        (WebInspector.TextEditor.prototype._updatePreferredSize):
+        (WebInspector.TextEditor.prototype.resize):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype._paintLine):
+        (WebInspector.TextEditor.prototype._contextMenu):
+        (WebInspector.TextEditor.prototype._caretForMouseEvent):
+        (WebInspector.TextEditor.prototype._changeFont):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter.prototype._lex):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/textEditor.css:
 
-2009-06-17  Albert J. Wong  <ajwong@chromium.org>
+2010-01-31  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26148
-        Extract RenderThemeChromiumSkia out of RenderThemeChromiumLinux.  This
-        is mostly a code shuffle.  The non-suffle changes are:
-           1) Creation of a caretBlinkIntervalInternal.
-           2) Moving of some inline functions into the implementation files.
-           3) Changing of defaultGUIFont into a static class constant from a
-              static function.  Also the type is changed to String.
-           4) Changing of defaultFontSize into a static class constant from a
-              static variable in the file scope.
-           5) The static supportsFocus function was collapsed into
-              supportsFocusRing.
-           6) Split the extraDefaultStyleSheet into Skia and Linux versions.
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
-        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
-        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
-        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::supportsHover):
-        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
-        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
-        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
-        (WebCore::RenderThemeChromiumSkia::systemFont):
-        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
-        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
-        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
-        (WebCore::RenderThemeChromiumSkia::paintRadio):
-        (WebCore::RenderThemeChromiumSkia::setRadioSize):
-        (WebCore::RenderThemeChromiumSkia::paintButton):
-        (WebCore::RenderThemeChromiumSkia::paintTextField):
-        (WebCore::RenderThemeChromiumSkia::paintTextArea):
-        (WebCore::RenderThemeChromiumSkia::paintSearchField):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
-        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
-        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
-        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
-        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
-        (WebCore::RenderThemeChromiumSkia::paintMenuList):
-        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
-        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
-        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
-        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
-        (WebCore::RenderThemeChromiumLinux::systemColor):
-        (WebCore::RenderThemeChromiumLinux::extraDefaultStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
-        * rendering/RenderThemeChromiumLinux.h:
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Add a SOFT_LINK_OPTIONAL macro
-
-        This macro is useful when soft-linking functions that are present in
-        only some versions of a particular library (e.g., APIs added in
-        Windows Vista that aren't available on Windows XP).
-
-        Reviewed by Ada Chan.
-
-        * platform/graphics/win/ColorSafari.cpp:
-        (WebCore::focusRingColor):
-        Use the SoftLinking.h macros instead of doing the soft-link ourselves.
-        Also removed an unused call to focusRingColor.isValid().
-
-        * platform/win/SoftLinking.h: Added SOFT_LINK_OPTIONAL.
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Gustavo Noronha.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26470.
-        The use of zero-width or zero-height rectangles in generating
-        gradients caused Windows Cairo to crash, and webkitgtk to
-        produce invalid images.
-
-        We now test for NaN in the phase argument, which is calculated
-        using fmodf and can blow up when the width/height values passed
-        are zero.
-
-        Test: fast/gradients/border-image-gradient-sides-and-corners.html
+        [Qt] Enable FAST_MOBILE_SCROLLING on Qt embedded platforms
+        https://bugs.webkit.org/show_bug.cgi?id=34168
 
-        * platform/graphics/cairo/ImageCairo.cpp:
-        (WebCore::Image::drawPattern):
+        Enable FAST_MOBILE_SCROLLING for Qt on Maemo 5, Linux embedded
+        and Symbian
 
-2009-06-17  Ojan Vafai  <ojan@chromium.org>
+        * WebCore.pro:
 
-        Reviewed by Dimitri Glazkov.
+2010-01-31  Yury Semikhatsky  <yurys@chromium.org>
 
-        If loading a font fails because of the sandbox, we ask the browser process to
-        try to load it by calling ensureFontLoaded. If it still fails after
-        ensureFontLoaded, we hit a ASSERT_NOT_REACHED.
+        Reviewed by Pavel Feldman.
 
-        This case happens once in a while during browser shutdown. The browser will
-        queue a message to the renderer to shutdown, and will then stop answering sync
-        messages from the renderer. If the renderer is still loading a page during this
-        time, it might try to call the browser process to ask to load a font. The
-        browser process will ignore the request, and the font will fail to load, even
-        after the second try.
+        Make ScriptState destructor protected since all non-empty
+        ScriptStates are managed by GC. Remove obsolete constructor.
 
-        This is unfortunate, but there is no real risk here, since the renderer will be
-        going away as soon as it processes another message.
-        
-        This can't be layout tested as it depends on the sandbox.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26484
+        https://bugs.webkit.org/show_bug.cgi?id=34266
 
-        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
-        (WebCore::fontContainsCharacter):
+        * bindings/v8/ScriptState.cpp:
+        * bindings/v8/ScriptState.h:
 
-2009-06-17  Eric Carlson  <eric.carlson@apple.com>
+2010-01-30  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26482
-        <rdar://problem/6978590> When setting playback rate to 0, the audio element stops 
-        playing (doesn't resume later)
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::setRate): Always set the rate, even when "paused".
-
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::setRate): Ditto.
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Add all the generated JS*.cpp files back to WebCore.vcproj
-
-        They are not compiled by the vcproj directly. Instead they are
-        compiled as part of DerivedSources.cpp. Having them listed in the
-        vcproj makes them be included in Project Find, etc.
-
-        Rubber-stamped in advance by Steve Falkenburg.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-06-17  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Don't fire redundant 'change' events for a file upload form.
-        https://bugs.webkit.org/show_bug.cgi?id=26471
-
-        * platform/FileChooser.cpp:
-        (WebCore::FileChooser::chooseFiles): Suppress change event if the
-        existing selected files and the incoming selected files are equal.
-        (WebCore::FileChooser::chooseIcon): Returns 0 if there is no selected
-        files.
-
-2009-06-17  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23155
-        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
-
-        * platform/KeyboardCodes.h:
-
-2009-06-17  George Staikos  <george.staikos@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23155
-        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::getWindowsContext):
-        * platform/win/SystemTimeWin.cpp:
-        (WebCore::userIdleTime):
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Speculative Mac build fix
-
-        * page/Page.h: Forward-declare RenderTheme instead of including
-        RenderTheme.h so that we don't need to make RenderTheme.h a private
-        header for WebKit's benefit.
-
-        * editing/SelectionController.cpp:
-        * rendering/InlineTextBox.cpp:
-        * rendering/RenderObject.cpp:
-        Added #includes of RenderTheme.h.
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Speculative Mac build fix
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderTheme::create): Added.
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Speculative Mac build fix
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderTheme::themeForPage): Remove the name of an unused
-        parameter.
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Speculative Mac build fix
-
-        * page/Page.cpp:
-        (WebCore::Page::Page): Change the initializer order to match the
-        declaration order.
-
-2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
-
-        Reviewed by Simon Hausmann.
-
-        Follow up to bug https://bugs.webkit.org/show_bug.cgi?id=26278
-        Patch that make WebCore have a RenderTheme per page
-
-        Make the Qt implementation of RenderTheme create a theme per page,
-        and use the QStyle associated with the view of each page, in order
-        to make the QWidget setStyle() method work as advertised.
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::RenderThemeQt):
-        (WebCore::RenderThemeQt::qStyle):
-        (WebCore::findFrameLineWidth):
-        (WebCore::inflateButtonRect):
-        (WebCore::RenderThemeQt::adjustRepaintRect):
-        (WebCore::RenderThemeQt::isControlStyled):
-        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
-        (WebCore::RenderThemeQt::setButtonPadding):
-        (WebCore::RenderThemeQt::paintButton):
-        (WebCore::RenderThemeQt::paintTextField):
-        (WebCore::RenderThemeQt::setPopupPadding):
-        * platform/qt/RenderThemeQt.h:
-
-2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
-
-        Reviewed by Dave Hyatt and Adam Roben.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26278
-        Patch that make WebCore have a RenderTheme per page
-
-
-        Create a different RenderTheme per page, so that RenderTheme has
-        access to page specific theming. This is needed for the Qt port, as Qt
-        supports setting the theme (style) per widget.
-
-        This change was suggested and discussed with Dave Hyatt.
-
-        More detailed:
+        Use CGGradient on Leopard and later, since it's faster than CGShading
+        https://bugs.webkit.org/show_bug.cgi?id=34384
 
-        1) Create a theme per page or one global one, depending on the needs
-           of the platform.
-        2) Add an accesser to the theme from RenderObject.
-        3) Change all uses of the theming to access the theme through
-           RenderObject, using the global default theme as fallback, when the
-           document of RenderObject has no page.
-           When we don't have access to a RenderObject, use the default theme.
-        4) Modify all RenderTheme platform implementations to work with the
-           above changes, still creating only one global theme.
+        Use CGGradient on Leopard and later, rather than CGShading, for
+        performance.
 
+        * platform/graphics/Gradient.h:
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::sortStopsIfNecessary): Utility method to sort stops.
+        Did not call this from getColor() to avoid overhead of a function call.
 
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::boundingBoxRect):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::loadFullDefaultStyle):
-        (WebCore::CSSStyleSelector::styleForElement):
-        (WebCore::CSSStyleSelector::adjustRenderStyle):
-        (WebCore::CSSStyleSelector::applyProperty):
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::setActive):
-        (WebCore::ContainerNode::setHovered):
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::focusedOrActiveStateChanged):
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::parseMappedAttribute):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setChecked):
-        (WebCore::HTMLInputElement::setIndeterminate):
-        * page/Frame.cpp:
-        (WebCore::Frame::selectionLayoutChanged):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::updateControlTints):
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        * page/Page.h:
-        (WebCore::Page::theme):
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::paintRow):
-        * platform/gtk/RenderThemeGtk.cpp:
-        (WebCore::RenderThemeGtk::create):
-        (WebCore::RenderTheme::themeForPage):
-        (WebCore::RenderThemeGtk::RenderThemeGtk):
-        (WebCore::RenderThemeGtk::~RenderThemeGtk):
-        (WebCore::RenderThemeGtk::gtkEntry):
-        (WebCore::RenderThemeGtk::gtkTreeView):
-        * platform/gtk/RenderThemeGtk.h:
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::create):
-        (WebCore::RenderTheme::themeForPage):
-        * platform/qt/RenderThemeQt.h:
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::paint):
-        * rendering/RenderMediaControls.cpp:
-        (WebCore::determineState):
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::RenderThemeWx::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paintTextMatchMarker):
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlInputElement::hitTest):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::theme):
-        * rendering/RenderObject.h:
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::adjustStyle):
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::defaultTheme):
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeChromiumLinux.h:
-        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeChromiumWin.h:
-        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
-        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderThemeSafari::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeSafari.h:
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeWin.h:
-
-2009-06-17  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/6974175> ASSERT in JITStubs.cpp at appsaccess.apple.com
-
-        JSDOMWindowCustom was using PropertySlot::putValue, however this interface
-        appears to be fundaementally incorrect - PropertySlots are only used to get
-        values, all puts use PutPropertySlot.  However PutPropertySlot cannot be
-        used in the fashion desired here - it only reports the caching type of a
-        write that has been performed.
-
-        (This caused a bug where the put should have triggered a transition, and
-        failed to do so.)
-
-        Removing the faulty case from the optimization leads to a ~0.5% progression
-        on in-browser SunSpider (presumably the very first case was not being hit
-        often, and the simplification here is beneficial).
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::put):
-
-2009-06-17  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY, layout tests fix.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26326
-        This reverts commit r44751.
-
-        Once that change was checked scrollbars/scrollbar-orientation.html started
-        crashing on Windows.
-
-        * dom/Document.cpp:
-        (WebCore::Document::detach):
-        * page/FrameView.cpp:
-        * page/FrameView.h:
-        * platform/Scrollbar.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::destroy):
-        * rendering/RenderScrollbar.h:
-
-2009-06-16  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        In ImageSource::setData, delete the old m_encoder before replacing it with a new one.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26458
-
-        * platform/graphics/wx/ImageSourceWx.cpp:
-        (WebCore::ImageSource::setData):
-
-2009-06-16  David Levin  <levin@chromium.org>
-
-        Reviewed by David Hyatt.
-
-        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
-        https://bugs.webkit.org/show_bug.cgi?id=26326
-
-        Test: scrollbars/scrollbar-crash-on-refresh.html
+        * platform/graphics/cg/GradientCG.cpp:
+        (WebCore::Gradient::platformDestroy): Use CGGradientRelease() post-Tiger.
+        (WebCore::Gradient::platformGradient): Create and return a CGGradientRef post-Tiger.
+        (WebCore::Gradient::fill): Call new paint() method.
+        (WebCore::Gradient::paint): New convenence method that avoids testing
+        isRadial() in a bunch of other places.
 
-        * dom/Document.cpp:
-        (WebCore::Document::detach):
-        Gives the FrameView a change to do any necessary cleanup on
-        Document::detach() which is where the renderArena gets detroyed.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::detachCustomScrollbars):
-        Gets rid of any custom scrollbars (if the docment supplied them).
-        * page/FrameView.h:
-        * platform/Scrollbar.h:
-        (WebCore::Scrollbar::isCustomScrollbar):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::destroy):
-        Removed the check for document()->frame().  If frame() is 0 in this code,
-        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
-        * rendering/RenderScrollbar.h:
-        (WebCore::RenderScrollbar::isCustomScrollbar):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillPath): Call the gradient's paint() method.
+        (WebCore::GraphicsContext::strokePath): Ditto
+        (WebCore::GraphicsContext::fillRect): Ditto
+        (WebCore::GraphicsContext::strokeRect): Ditto
 
-2009-06-16  Brian Weinstein  <bweinstein@apple.com>
+2010-01-30  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Adele Peterson.
 
-        Fix of <rdar://6967547> Ctrl-C copies null value erasing text in clipboard in Safari.
-        This patch kept the way events were firing as they were before, and Windows events are
-        consistent with Mac.       
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::tryDHTMLCopy): Added check for canCopy() before clearing PasteBoard
-        (WebCore::Editor::tryDHTMLCut): Added check for canCut() before clearing PasteBoard
-
-2009-06-16  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        <rdar://problem/6660037> CrashTracer: [USER] 46 crashes in Safari at com.apple.WebCore • WebCore::CachedCSSStyleSheet::addClient 53
+        Do color animations on premultiplied colors
+        https://bugs.webkit.org/show_bug.cgi?id=34383
         
-        When revalidating a resource, calling addClient() on one client might cause another to get removed.
-        
-        - made CachedResource::addClient() non-virtual and added virtual didAddClient()
-        - in CachedResource::switchClientsToRevalidatedResource() add all clients to the client set of the revalidated resource first
-        - check if the client is still in the set before invoking didAddClient() for it
-        
-        No test case, I didn't manage to construct one. You need some combination of 304 revalidation, stylesheets that
-        reference each other via @imports and reloading.
+        Convert colors to premultiplied alpha before interpolating them,
+        then convert the result back to non-premultiplied. This gives better
+        results when animating from transparent colors.
 
-        * WebCore.base.exp:
-        * loader/CachedCSSStyleSheet.cpp:
-        (WebCore::CachedCSSStyleSheet::didAddClient):
-        * loader/CachedCSSStyleSheet.h:
-        * loader/CachedFont.cpp:
-        (WebCore::CachedFont::didAddClient):
-        * loader/CachedFont.h:
-        * loader/CachedImage.cpp:
-        (WebCore::CachedImage::didAddClient):
-        * loader/CachedImage.h:
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::addClient):
-        (WebCore::CachedResource::addClientToSet):
-        (WebCore::CachedResource::switchClientsToRevalidatedResource):
-        * loader/CachedResource.h:
-        * loader/CachedScript.cpp:
-        (WebCore::CachedScript::didAddClient):
-        * loader/CachedScript.h:
-        * loader/CachedXSLStyleSheet.cpp:
-        (WebCore::CachedXSLStyleSheet::didAddClient):
-        * loader/CachedXSLStyleSheet.h:
-
-2009-06-16  Simon Fraser  <simon.fraser@apple.com>
-
-        No Review
-
-        Fix code inside an #ifdef that draws the video framerate.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::paint):
-
-2009-06-16  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
+        Test: transitions/color-transition-premultiplied.html
 
-        Bug 26456: Hook up V8 bindings for Worker's importScripts functionality.
-        https://bugs.webkit.org/show_bug.cgi?id=26456
-
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp: Fixed missing exception code
-          handling in Worker constructor for V8 bindings.
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Update of https://bugs.webkit.org/show_bug.cgi?id=26353.
-        Provide an assignment operator to avoid improper reference
-        counts on the Cairo font objects.  This brings the Windows
-        Cairo port in line with the GTKport.
-
-        * platform/graphics/win/FontPlatformData.h:
-        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
-        (WebCore::FontPlatformData::FontPlatformData):
-        (WebCore::FontPlatformData::operator=):
-
-2009-06-16  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Fix for <rdar://problem/6890126> Theme code should fetch the MediaControlElementType from 
-        the MediaControlInputElement, rather than computing it again
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::percentLoaded): New, utility function for controller implementation.
-        * html/HTMLMediaElement.h:
-
-        * rendering/MediaControlElements.h:
-        (WebCore::MediaControlInputElement::displayType): New, return m_displayType.
-
-        * rendering/RenderMediaControls.cpp:
-        (WebCore::RenderMediaControls::paintMediaControlsPart): Stop using MediaPlayer object, get button
-        state from the button itself and get movie state from HTMLMediaElement.
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMediaMuteButton): Get state from button instead of MediaPlayer.
-        (WebCore::RenderThemeMac::paintMediaPlayButton): Ditto.
-
-2009-06-16  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        Bug 26450: Rename values of enum RedirectOriginCheck to make them
-        clearer.
-        https://bugs.webkit.org/show_bug.cgi?id=26450
-
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::create):
-        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
-        (WebCore::DocumentThreadableLoader::willSendRequest):
-        * loader/DocumentThreadableLoader.h:
-        * loader/ThreadableLoader.cpp:
-        (WebCore::ThreadableLoader::create):
-        (WebCore::ThreadableLoader::loadResourceSynchronously):
-        * loader/ThreadableLoader.h:
-        * workers/Worker.cpp:
-        (WebCore::Worker::Worker):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::importScripts):
-        * loader/WorkerThreadableLoader.cpp:
-        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
-        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
-        * loader/WorkerThreadableLoader.h:
-        (WebCore::WorkerThreadableLoader::create):
-        * workers/WorkerScriptLoader.cpp:
-        (WebCore::WorkerScriptLoader::loadSynchronously):
-        (WebCore::WorkerScriptLoader::loadAsynchronously):
-        * workers/WorkerScriptLoader.h:
-        (WebCore::WorkerContext::importScripts):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
-
-2009-06-16  Tony Chang  <tony@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Fix a UMR in WebCore::BitStack by initializing new memory to 0.
-        https://bugs.webkit.org/show_bug.cgi?id=26449
-        No new tests, covered by purify.
-
-        * editing/TextIterator.cpp:
-        (WebCore::BitStack::push):
-
-2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Xan Lopez.
-
-        Test: fast/multicol/columns-shorthand-parsing.html 
-
-        Fixes https://bugs.webkit.org/show_bug.cgi?id=26453.
-        Null Cairo contextwill crash Windows Cairo build.
-
-        * platform/graphics/win/GraphicsContextCairoWin.cpp:
-        (WebCore::GraphicsContextPlatformPrivate::syncContext):
-          Add a check for null context before attempting to
-          retrieve the Cairo surface.
-
-2009-06-16  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26447
-        Fix animated GIF breakage in Cairo/wx ports.
-
-        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
-        (WebCore::RGBA32Buffer::copyBitmapData):
-        (WebCore::RGBA32Buffer::operator=):
-        * platform/image-decoders/wx/ImageDecoderWx.cpp:
-        (WebCore::RGBA32Buffer::copyBitmapData):
-        (WebCore::RGBA32Buffer::operator=):
-
-2009-06-16  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by John Sullivan
-        
-        <rdar://problem/6937882>
-        
-        Tweak "time remaining" and "time elapsed" fields in the overlay video controller.
-
-        * css/mediaControlsQT.css:
-
-2009-06-16  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Adam Barth and David Levin.
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
 
-        Bug 26146: Change to use ThreadableLoader to load the worker script
-        in order to check URL origin for redirection.
-        https://bugs.webkit.org/show_bug.cgi?id=26146
+2010-01-30  Gustavo Noronha Silva  <gns@gnome.org>
 
-        Test: http/tests/workers/worker-redirect.html
+        Build fixes needed for make distcheck.
 
         * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * workers/Worker.cpp:
-        (WebCore::Worker::Worker):
-        (WebCore::Worker::notifyFinished):
-        * workers/Worker.h:
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::importScripts):
-        * workers/WorkerImportScriptsClient.cpp: Removed.
-        * workers/WorkerImportScriptsClient.h: Removed.
-        * workers/WorkerScriptLoader.cpp: Renamed from workers/WorkerImportScriptsClient.cpp.
-          This to make it more generic so worker script loading could use it.
-        (WebCore::WorkerScriptLoader::loadSynchronously):
-        (WebCore::WorkerScriptLoader::loadAsynchronously):
-        (WebCore::WorkerScriptLoader::didFinishLoading):
-        (WebCore::WorkerScriptLoader::didFail):
-        (WebCore::WorkerScriptLoader::didFailRedirectCheck):
-        (WebCore::WorkerScriptLoader::didReceiveAuthenticationCancellation):
-        (WebCore::WorkerScriptLoader::notifyFinished):
-        * workers/WorkerScriptLoader.h: Renamed from workers/WorkerImportScriptsClient.h.
-          This to make it more generic so worker script loading could use it.
-        * workers/WorkerScriptLoaderClient.h: Added.
-
-2009-06-16  Brent Fulgham  <bfulgham@gmail.com>
-
-        Reviewed by Darin Adler.
 
-        Use consistent GUID comparison functions.
-        https://bugs.webkit.org/show_bug.cgi?id=26427
+2010-01-29  Mark Rowe  <mrowe@apple.com>
 
-        * platform/win/WCDataObject.cpp:
-        (WebCore::WCDataObject::QueryInterface):
-
-2009-06-16  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        Fix compiler warning.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_class_init):
+        Stop copying an IDL file in to the framework wrapper.
 
-2009-08-07  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27424
-
-        * WebKit/gtk/gdom/ConvertToGCharPrivate.h: Added.
-        (copyAsGChar): added to help GObject bindings convert various types to glib's gchar* 
-
-2009-06-16  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
+        * WebCore.xcodeproj/project.pbxproj:
 
-        Remove dummy AtkStreamableContent implementation.
+2010-01-29  Mark Rowe  <mrowe@apple.com>
 
-        It's completely empty, we'll add it back (and conditionally
-        instead of unconditionally) when it does something.
+        Sort Xcode projects.
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (GetAtkInterfaceTypeFromWAIType):
-        (getInterfaceMaskFromObject):
+        * WebCore.xcodeproj/project.pbxproj:
 
-== Rolled over to ChangeLog-2009-06-16 ==
+== Rolled over to ChangeLog-2010-01-29 ==
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog-2010-01-29 b/src/3rdparty/webkit/WebCore/ChangeLog-2010-01-29
new file mode 100644
index 0000000000..cce11252b5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ChangeLog-2010-01-29
@@ -0,0 +1,98486 @@
+2010-01-29  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build.
+
+        Disable ENABLE_INDEXED_DATABASE since it is "completely non-functional".
+
+        As the comment in FeatureDefines.xcconfig notes, the list of feature defines
+        needs to be kept in sync across the various files.  The default values also
+        need to be kept in sync between these files and build-webkit.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-01-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Timeout for client-based Geolocation shouldn't start until user gives consent
+        https://bugs.webkit.org/show_bug.cgi?id=34352
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::startRequest): Don't start timer if we're blocked on user consent.
+        (WebCore::Geolocation::setIsAllowed): Start timer after user gives consent.
+
+2010-01-29  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [OpenVG] Implement more graphics primitives
+        https://bugs.webkit.org/show_bug.cgi?id=34339
+
+        Adds lines, arcs, ellipses, polygons and rounded
+        rectangles to PainterOpenVG and GraphicsContext.
+
+        Rounded rects support by Eli Fidler <efidler@rim.com>.
+
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::PainterOpenVG::drawRect):
+        (WebCore::PainterOpenVG::drawRoundedRect):
+        (WebCore::PainterOpenVG::drawLine):
+        (WebCore::PainterOpenVG::drawArc):
+        (WebCore::PainterOpenVG::drawEllipse):
+        (WebCore::PainterOpenVG::drawPolygon):
+        * platform/graphics/openvg/PainterOpenVG.h:
+
+2010-01-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        A first step towards the Indexed Database API
+        https://bugs.webkit.org/show_bug.cgi?id=34342
+
+        Flesh out the first part of Indexed Database API.
+        Currently only compiles with v8 + chromium for now.
+        Completely non-functional, but it seems best to do
+        this in chunks.
+
+        No tests because nothing works yet.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setIndexedDatabaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::indexedDatabaseEnabled):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::IndexedDBEnabled):
+        * bindings/v8/custom/V8IDBRequestCustom.cpp: Added.
+        (WebCore::V8IDBRequest::resultAccessorGetter):
+        * bindings/v8/custom/V8IndexedDatabaseRequestCustom.cpp: Added.
+        (WebCore::V8IndexedDatabaseRequest::openCallback):
+        * dom/EventNames.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::indexedDB):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * storage/IDBDatabaseError.h: Added.
+        (WebCore::IDBDatabaseError::create):
+        (WebCore::IDBDatabaseError::~IDBDatabaseError):
+        (WebCore::IDBDatabaseError::code):
+        (WebCore::IDBDatabaseError::setCode):
+        (WebCore::IDBDatabaseError::message):
+        (WebCore::IDBDatabaseError::setMessage):
+        (WebCore::IDBDatabaseError::IDBDatabaseError):
+        * storage/IDBDatabaseError.idl: Added.
+        * storage/IDBDatabaseException.h: Added.
+        (WebCore::IDBDatabaseException::create):
+        (WebCore::IDBDatabaseException::~IDBDatabaseException):
+        (WebCore::IDBDatabaseException::code):
+        (WebCore::IDBDatabaseException::setCode):
+        (WebCore::IDBDatabaseException::message):
+        (WebCore::IDBDatabaseException::setMessage):
+        (WebCore::IDBDatabaseException::IDBDatabaseException):
+        * storage/IDBDatabaseException.idl: Added.
+        * storage/IDBRequest.cpp: Added.
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::~IDBRequest):
+        (WebCore::IDBRequest::abort):
+        (WebCore::IDBRequest::eventTargetData):
+        (WebCore::IDBRequest::ensureEventTargetData):
+        * storage/IDBRequest.h: Added.
+        (WebCore::IDBRequest::create):
+        (WebCore::IDBRequest::readyState):
+        (WebCore::IDBRequest::error):
+        (WebCore::IDBRequest::result):
+        (WebCore::IDBRequest::scriptExecutionContext):
+        (WebCore::IDBRequest::toIDBRequest):
+        (WebCore::IDBRequest::refEventTarget):
+        (WebCore::IDBRequest::derefEventTarget):
+        * storage/IDBRequest.idl: Added.
+        * storage/IndexedDatabaseRequest.cpp: Added.
+        (WebCore::IndexedDatabaseRequest::IndexedDatabaseRequest):
+        (WebCore::IndexedDatabaseRequest::~IndexedDatabaseRequest):
+        (WebCore::IndexedDatabaseRequest::open):
+        * storage/IndexedDatabaseRequest.h: Added.
+        (WebCore::IndexedDatabaseRequest::create):
+        (WebCore::IndexedDatabaseRequest::request):
+        * storage/IndexedDatabaseRequest.idl: Added.
+
+2010-01-29  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Drag and Drop: Windows uses "stop" sign as cursor when dragging
+        https://bugs.webkit.org/show_bug.cgi?id=34305
+        <rdar://problem/7589672>
+
+        Add a FIXME for the code that needs to be changed to support full
+        custom cursors.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDrag):
+
+2010-01-29  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by darin@apple.com.
+
+        Fix the issue that both main frome and iframe are
+        focused if window.onblur calls window.focus.
+        https://bugs.webkit.org/show_bug.cgi?id=31692
+
+        The problem is caused by the focused frame in FocusController
+        is messed up if window.onblur calls window.focus:
+        When user clicks iframe to switch focus from main frame to iframe,
+        FocusController::setFocusedFrame fires onblur event, which calls
+        window.focus and then calls setFocusedFrame again to switch back.
+        This messes up the old focused frame and new focused frame and
+        leaves the FocusController confused. As a result, controlls
+        in both main frame and iframe look like get focused.
+
+        To fix it, add a flag to FocusController and do no switch the focused
+        frame when FocusController is in the middle of changing the focused frame. 
+
+        Test: fast/events/change-frame-focus.html
+
+        * page/FocusController.cpp:
+        (WebCore::FocusController::FocusController):
+        (WebCore::FocusController::setFocusedFrame):
+        * page/FocusController.h:
+        (WebCore::FocusController::focusedFrame):
+        (WebCore::FocusController::isActive):
+        (WebCore::FocusController::isFocused):
+
+2010-01-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7441982> REGRESSION (TOT): Adobe CS4: Installer alerts are displayed as
+        blank windows
+
+        We probably shouldn't be deferring loads below modal dialogs and alerts, because that's not
+        what being modal means. But making such a change for general Web content would require fixes
+        in other parts of code, which I'm not ready to implement right now, so making it application
+        specific.
+
+        * page/Page.cpp: (WebCore::Page::setDefersLoading): Do nothing if load deferring is not
+        enabled in page settings.
+
+        * WebCore.base.exp:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setLoadDeferringEnabled):
+        * page/Settings.h: (WebCore::Settings::loadDeferringEnabled):
+        Add the ability for client to disable page deferring (still enabled by default).
+
+        * platform/mac/RuntimeApplicationChecks.h:
+        * platform/mac/RuntimeApplicationChecks.mm: (WebCore::applicationIsAdobeInstaller):
+        Added a bundle ID test for Adobe installer.
+
+2010-01-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::startUpdating):
+
+2010-01-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Client-based Geolocation starts updating before getting consent from the user
+        https://bugs.webkit.org/show_bug.cgi?id=34343
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::startRequest): Pass notifier instead of options to startUpdating.
+        (WebCore::Geolocation::setIsAllowed): Add the observer or notify of error for deferred startUpdating.
+        (WebCore::Geolocation::startUpdating): Pass notifier instead of options, since we may need to call it if we fail to get user consent.
+        Defer adding the observer if we don't yet have user consent, since this could kick off
+        server-based wifi Geolocation requests.
+        * page/Geolocation.h:
+
+2010-01-28  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Crash when posting a notification for a detached object
+
+        https://bugs.webkit.org/show_bug.cgi?id=34309
+        <rdar://problem/7409759>
+
+        Reviewed by Darin Adler.
+
+        Test: platform/win/accessibility/detached-object-notification-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::document):
+        Null check m_renderer. This is the bug fix; the other changes in the
+        patch are for the test.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        Map AXValueChanged to EVENT_OBJECT_VALUECHANGED, so we'll post a
+        notification when AXValueChanged is posted. Receiving an event of this
+        type tells us that the test passed.
+
+2010-01-29  Darin Fisher  <darin@chromium.org>
+
+        Okayed by Oliver Hunt.
+
+        Rollout r53949, r53951 and r54013 due to a Chromium regression that it
+        causes.  Somehow this code change is triggering an endless repaint loop.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33808
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawTiledImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::isIdentityOrTranslation):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
+
+2010-01-29  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add gdb helper methods for Ranges like we have for VisibleSelections.
+        https://bugs.webkit.org/show_bug.cgi?id=34308
+
+        No new tests, these are only for debugging.
+
+        * dom/Position.cpp:
+        (WebCore::Position::showTreeForThis):
+        * dom/Range.cpp:
+        (showTree):
+        * dom/Range.h:
+
+2010-01-29  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        V8 implementation of MessageEvent.initMessageEvent() does not set source correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=34292
+
+        Test: fast/events/init-events.html will pass in Chrome now.
+
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::initMessageEventCallback):
+        Now properly extracts the reference to the DOMWindow object from the passed-in window parameter.
+
+2010-01-29  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] Android needs functionality in the ChromeClient to be informed when touch events are and are not needed by the webpage.
+        https://bugs.webkit.org/show_bug.cgi?id=34215
+
+        Add a function on the ChromeClient that WebCore can use to inform the platform when it needs touch events. This way the platform can optimise by not forwarding the events if they are not required.
+
+        No new tests as the only implementation is specific to Android.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Check if this is the top level document and if so, stop forwarding touch events.
+        (WebCore::Document::addListenerTypeIfNeeded): Inform the ChromeClient it should start forwarding touch events and guard touch event code properly.
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): If the document uses touch events, inform the ChromeClient to start forwarding them.
+        (WebCore::CachedFrame::CachedFrame): If the document uses touch events, inform the ChromeClient to stop forwarding them, as the document is being put into the page cache.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::needTouchEvents): Add an empty implementation.
+        * page/ChromeClient.h: Add the needTouchEvents() function.
+
+2010-01-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix toolbar gradient to match the window's titlebar on Snow Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=34320
+
+        * inspector/front-end/inspector.css:
+
+2010-01-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix MacOS X version detection
+
+        MacOS X version can have 2 or 3 segments.
+        https://bugs.webkit.org/show_bug.cgi?id=34322
+
+        * inspector/front-end/inspector.js:
+        (WebInspector._detectPlatform):
+
+2010-01-29  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [OpenVG] Implement a basic GraphicsContext on top of a new PainterOpenVG class
+        https://bugs.webkit.org/show_bug.cgi?id=33405
+
+        PainterOpenVG provides painter state management that works
+        on a single (EGL) context, and apart from painter state
+        implements a single drawing operation (for now), drawRect().
+
+        It is a generic painter class that cooperates with
+        SurfaceOpenVG to enable robust surface/context switching
+        (given that EGL doesn't notify us if somebody switches
+        the surface/context behind our backs), and provides
+        painting operations close to OpenVG's way of working
+        that GraphicsContext, Path, Image, Font and other WebKit
+        platform classes can use to draw on.
+
+        Initial code for state management and OpenVG scissoring by
+        Eli Fidler <efidler@rim.com>. VGRect/VGMatrix and the bulk
+        of the transformations code by Adam Treat <atreat@rim.com>.
+        Preliminary drawFocusRing() implementation by Yong Li <yoli@rim.com>.
+
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp: Added.
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::~GraphicsContext):
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::savePlatformState):
+        (WebCore::GraphicsContext::restorePlatformState):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::beginPath):
+        (WebCore::GraphicsContext::addPath):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineDash):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        (WebCore::GraphicsContext::canvasClip):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::scale):
+        (WebCore::GraphicsContext::rotate):
+        (WebCore::GraphicsContext::translate):
+        (WebCore::GraphicsContext::origin):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+        * platform/graphics/openvg/PainterOpenVG.cpp: Added.
+        (WebCore::isNonRotatedAffineTransformation):
+        (WebCore::toVGCapStyle):
+        (WebCore::toVGJoinStyle):
+        (WebCore::toVGFillRule):
+        (WebCore::colorToVGColor):
+        (WebCore::setVGSolidColor):
+        (WebCore::PlatformPainterState::PlatformPainterState):
+        (WebCore::PlatformPainterState::copyPaintState):
+        (WebCore::PlatformPainterState::applyState):
+        (WebCore::PlatformPainterState::applyBlending):
+        (WebCore::PlatformPainterState::applyTransformationMatrix):
+        (WebCore::PlatformPainterState::applyScissorRect):
+        (WebCore::PlatformPainterState::applyStrokeStyle):
+        (WebCore::PlatformPainterState::strokeDisabled):
+        (WebCore::PlatformPainterState::fillDisabled):
+        (WebCore::PainterOpenVG::PainterOpenVG):
+        (WebCore::PainterOpenVG::~PainterOpenVG):
+        (WebCore::PainterOpenVG::begin):
+        (WebCore::PainterOpenVG::end):
+        (WebCore::PainterOpenVG::destroyPainterStates):
+        (WebCore::PainterOpenVG::applyState):
+        (WebCore::PainterOpenVG::blitToSurface):
+        (WebCore::PainterOpenVG::transformationMatrix):
+        (WebCore::PainterOpenVG::concatTransformationMatrix):
+        (WebCore::PainterOpenVG::setTransformationMatrix):
+        (WebCore::PainterOpenVG::compositeOperation):
+        (WebCore::PainterOpenVG::setCompositeOperation):
+        (WebCore::PainterOpenVG::opacity):
+        (WebCore::PainterOpenVG::setOpacity):
+        (WebCore::PainterOpenVG::strokeThickness):
+        (WebCore::PainterOpenVG::setStrokeThickness):
+        (WebCore::PainterOpenVG::strokeStyle):
+        (WebCore::PainterOpenVG::setStrokeStyle):
+        (WebCore::PainterOpenVG::setLineDash):
+        (WebCore::PainterOpenVG::setLineCap):
+        (WebCore::PainterOpenVG::setLineJoin):
+        (WebCore::PainterOpenVG::setMiterLimit):
+        (WebCore::PainterOpenVG::strokeColor):
+        (WebCore::PainterOpenVG::setStrokeColor):
+        (WebCore::PainterOpenVG::fillColor):
+        (WebCore::PainterOpenVG::setFillColor):
+        (WebCore::PainterOpenVG::antialiasingEnabled):
+        (WebCore::PainterOpenVG::setAntialiasingEnabled):
+        (WebCore::PainterOpenVG::scale):
+        (WebCore::PainterOpenVG::rotate):
+        (WebCore::PainterOpenVG::translate):
+        (WebCore::PainterOpenVG::intersectScissorRect):
+        (WebCore::PainterOpenVG::intersectClipRect):
+        (WebCore::PainterOpenVG::drawRect):
+        (WebCore::PainterOpenVG::save):
+        (WebCore::PainterOpenVG::restore):
+        * platform/graphics/openvg/PainterOpenVG.h: Added.
+        (WebCore::PainterOpenVG::):
+        (WebCore::PainterOpenVG::surface):
+        * platform/graphics/openvg/SurfaceOpenVG.cpp:
+        (WebCore::SurfaceOpenVG::SurfaceOpenVG):
+        (WebCore::SurfaceOpenVG::~SurfaceOpenVG):
+        (WebCore::SurfaceOpenVG::makeCurrent):
+        (WebCore::SurfaceOpenVG::makeCompatibleCurrent):
+        (WebCore::SurfaceOpenVG::setActivePainter):
+        (WebCore::SurfaceOpenVG::activePainter):
+        * platform/graphics/openvg/SurfaceOpenVG.h:
+        (WebCore::SurfaceOpenVG::):
+        * platform/graphics/openvg/VGUtils.cpp: Added.
+        (WebCore::VGMatrix::VGMatrix):
+        (WebCore::VGMatrix::operator TransformationMatrix):
+        (WebCore::TransformationMatrix::operator VGMatrix):
+        (WebCore::VGRect::VGRect):
+        (WebCore::VGRect::operator FloatRect):
+        (WebCore::FloatRect::operator VGRect):
+        * platform/graphics/openvg/VGUtils.h:
+        (WebCore::VGMatrix::toVGfloat):
+        (WebCore::VGRect::toVGfloat):
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2010-01-29  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Vimeo HTML5 player doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=34327
+
+        Send Referer when requesting media over HTTP.
+
+        Test: http/tests/media/video-referer.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+
+2010-01-29  Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Speed up the WebCore::String -> QString conversion
+
+        Use QString(const QChar *, int len) constructor instead of QString::fromUtf16 to
+        avoid BOM checks and byteswapping.
+
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fieldNamed):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2010-01-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Source view displays text using wrong fonts
+        https://bugs.webkit.org/show_bug.cgi?id=34269
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype._initFont):
+        * inspector/front-end/inspector.js:
+
+2010-01-29  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Apple trailers don't play anymore
+        https://bugs.webkit.org/show_bug.cgi?id=34316
+
+        Fake QuickTime when accessing movie trailers.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+
+2010-01-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: migrate to tokenizer-based highlighting in the Elements panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34273
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/CSSSourceSyntaxHighlighter.js: Removed.
+        * inspector/front-end/DOMSyntaxHighlighter.js: Added.
+        (WebInspector.DOMSyntaxHighlighter):
+        (WebInspector.DOMSyntaxHighlighter.prototype.createSpan):
+        (WebInspector.DOMSyntaxHighlighter.prototype.syntaxHighlightNode):
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/JavaScriptSourceSyntaxHighlighter.js: Removed.
+        * inspector/front-end/SourceCSSTokenizer.js:
+        (WebInspector.SourceCSSTokenizer):
+        (WebInspector.SourceCSSTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceCSSTokenizer.re2js:
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+        * inspector/front-end/SourceJavaScriptTokenizer.js:
+        (WebInspector.SourceJavaScriptTokenizer):
+        (WebInspector.SourceJavaScriptTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceJavaScriptTokenizer.re2js:
+        * inspector/front-end/SourceSyntaxHighlighter.js: Removed.
+        * inspector/front-end/SourceTokenizer.js: Added.
+        (WebInspector.SourceTokenizer):
+        (WebInspector.SourceTokenizer.prototype.set line):
+        (WebInspector.SourceTokenizer.prototype.set condition):
+        (WebInspector.SourceTokenizer.prototype.get condition):
+        (WebInspector.SourceTokenizer.prototype.hasCondition):
+        (WebInspector.SourceTokenizer.prototype.getLexCondition):
+        (WebInspector.SourceTokenizer.prototype.setLexCondition):
+        (WebInspector.SourceTokenizer.prototype._charAt):
+        (WebInspector.SourceTokenizer.Registry):
+        (WebInspector.SourceTokenizer.Registry.getInstance):
+        (WebInspector.SourceTokenizer.Registry.prototype.getTokenizer):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.set mimeType):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2010-01-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: No need to render background sources
+        when performing search.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34263
+
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView):
+        (WebInspector.ScriptView.prototype.show):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.set visible):
+        (WebInspector.SourceFrame.prototype.set executionLine):
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype.clearMessages):
+        (WebInspector.SourceFrame.prototype.sizeToFitContentHeight):
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype._createEditorIfNeeded):
+        (WebInspector.SourceFrame.prototype.setSelection):
+        (WebInspector.SourceFrame.prototype.clearSelection):
+        (WebInspector.SourceFrame.prototype._contextMenu.addConditionalBreakpoint):
+        (WebInspector.SourceFrame.prototype._contextMenu):
+        (WebInspector.SourceFrame.prototype._toggleBreakpoint):
+        (WebInspector.SourceFrame.prototype.resize):
+        (WebInspector.BreakpointLineNumberDecorator):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView):
+        (WebInspector.SourceView.prototype.show):
+        (WebInspector.SourceView.prototype.hide):
+        (WebInspector.SourceView.prototype.resize):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel):
+        (WebInspector.TextEditorModel.prototype.set changeListener):
+        (WebInspector.TextEditorModel.prototype.setText):
+
+2010-01-29  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove ScriptState::frame which is only used for reporting exceptions
+        in some cases in a way that diverges from the regular exception reporting in
+        v8 bindings.
+
+        Cache ScriptState directly on v8::Context instead of providing
+        implementations specific for isolated worlds and ScriptController.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34266
+
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptState.cpp:
+        (WebCore::mainWorldScriptState):
+        * bindings/js/ScriptState.h:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::clearWindowShell):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        (WebCore::ScriptScope::success):
+        * bindings/v8/ScriptScope.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::ScriptState::forContext):
+        (WebCore::ScriptState::current):
+        (WebCore::ScriptState::weakReferenceCallback):
+        (WebCore::mainWorldScriptState):
+        (WebCore::scriptStateFromPage):
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::EmptyScriptState::EmptyScriptState):
+        (WebCore::EmptyScriptState::~EmptyScriptState):
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/V8IsolatedContext.cpp:
+        * bindings/v8/V8IsolatedContext.h:
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        (WebCore::reportException):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::V8NodeIterator::nextNodeCallback):
+        (WebCore::V8NodeIterator::previousNodeCallback):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::V8TreeWalker::parentNodeCallback):
+        (WebCore::V8TreeWalker::firstChildCallback):
+        (WebCore::V8TreeWalker::lastChildCallback):
+        (WebCore::V8TreeWalker::nextNodeCallback):
+        (WebCore::V8TreeWalker::previousNodeCallback):
+        (WebCore::V8TreeWalker::nextSiblingCallback):
+        (WebCore::V8TreeWalker::previousSiblingCallback):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::injectedScriptForNodeId):
+
+2010-01-29  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add FrameLoaderClient::allowImages method to allow the client to
+        overrule image loading policy on a per frame basis.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34225
+
+        For completeness, this patch also adds Settings::areImagesEnabled.
+        This is different from loadsImagesAutomatically as is explained in
+        Settings.h.
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::requestImage):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::allowImages):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageTokenizer::writeRawData):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setImagesEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::areImagesEnabled):
+
+2010-01-28  Nicholas Young  <nicholas.young@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Prefer provided video element width/height properties to hard coded
+        defaults for intrinsic size when natural video size is unavailable.
+        https://bugs.webkit.org/show_bug.cgi?id=34302
+
+        No new tests needed.
+
+        * rendering/RenderVideo.cpp: Attempt to use width/height properties
+        (WebCore::RenderVideo::RenderVideo):
+        * rendering/RenderVideo.h: More appropriate constructor signature
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        MessageEvent.data should not be repeated deserialised
+        https://bugs.webkit.org/show_bug.cgi?id=34311
+
+        Cache the result of deserialising the event data
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/MessageEvent.idl:
+
+2010-01-28  Hayato Ito  <hayato@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Change CSS 'page-break-inside' property from inherited one to non-inherited one because CSS specification defines so.
+
+        Note: Currently, the 'page-break-inside' property is used only when parsing the CSS. That property is not used when rendering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34195
+
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::NonInheritedFlags::operator==):
+        (WebCore::InheritedFlags::setBitDefaults):
+        (WebCore::InheritedFlags::pageBreakInside):
+        (WebCore::InheritedFlags::setPageBreakInside):
+        * rendering/style/StyleInheritedData.cpp:
+        (WebCore::StyleInheritedData::StyleInheritedData):
+        (WebCore::StyleInheritedData::operator==):
+        * rendering/style/StyleInheritedData.h:
+
+2010-01-28  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        ApplicationCache events should be deferred until after Document onload has fired.
+        https://bugs.webkit.org/show_bug.cgi?id=29690
+
+        Test: http/tests/appcache/deferred-events.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::handledOnloadEvents):  Tells the ApplicationCacheHost to stop deferring events.
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::ApplicationCacheHost): Initialize m_isDeferringEvents to true.
+        (WebCore::ApplicationCacheHost::notifyDOMApplicationCache): Depending, defer or raise the event.
+        (WebCore::ApplicationCacheHost::stopDeferringEvents): Raise any deferred events and reset the flag.
+        * loader/appcache/ApplicationCacheHost.h: Declare new data members and method.
+
+2010-01-28  Kavita Kanetkar  <kkanetkar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Generate header declaration for custom constructor callbacks
+        https://bugs.webkit.org/show_bug.cgi?id=33680
+
+        Added handling of 'CanBeConstructed' and 'OmitConstructor' and a new extended attribute
+        CustomConstructor'.
+
+        Deleted implementation .cpp files for corresponding 'CanBeConstructed'
+        extended attributes. These are now generated via CodeGeneratorV8.pm
+        Treating 'OmitConstructor' and 'CustomConstructor' to be the same in
+        CodeGeneratorJS.pm
+        Cleaned idls that had 'CustomConstructor' and 'OmitConstructor' together, and
+        same with CustomConstructor and CanBeConstructed.
+
+        * Android.v8bindings.mk:
+        * WebCore.gypi: Removed deps for classes being generated.
+        * bindings/scripts/CodeGeneratorJS.pm: OmitConstructor and CustomConstructor have the same behavior in generator.
+        * bindings/scripts/CodeGeneratorV8.pm: Generating the callbacks for constructors.
+        * bindings/v8/V8DOMWrapper.cpp: Removed manual calls to SetCallHandler() for constructor callbacks.
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/custom/V8CustomBinding.h: Removed manual declarations of constructor callbacks.
+        * bindings/v8/custom/V8DOMParserConstructor.cpp:
+        * bindings/v8/custom/V8EventSourceConstructor.cpp:
+        (WebCore::V8EventSource::constructorCallback):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::V8MessageChannel::constructorCallback):
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::V8SharedWorker::constructorCallback):
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::V8WebGLArrayBuffer::constructorCallback):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::V8WebGLByteArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::V8WebGLFloatArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::V8WebGLIntArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::V8WebGLShortArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedByteArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedIntArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedShortArray::constructorCallback):
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        (WebCore::V8WebKitCSSMatrix::constructorCallback):
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        (WebCore::V8WebKitPoint::constructorCallback):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::V8WebSocket::constructorCallback):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::V8Worker::constructorCallback):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::V8XMLHttpRequest::constructorCallback):
+        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
+        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp: Deleted the file. Implementation now being generated.
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp: Deleted the file. Implementation now being generated.
+        (WebCore::V8XSLTProcessor::constructorCallback): Deleted the file. Implementation now being generated.
+        * css/WebKitCSSMatrix.idl: Added CustomConstructor attribute.
+        * dom/MessageChannel.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLArrayBuffer.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLByteArray.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLFloatArray.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLIntArray.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLShortArray.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLUnsignedByteArray.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLUnsignedIntArray.idl: Added CustomConstructor attribute.
+
+2010-01-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Add stub for AXObjectCache::contentChanged when HAVE(ACCESSIBILITY) is not defined
+        https://bugs.webkit.org/show_bug.cgi?id=34271
+
+        No new tests, build fix only.
+
+        * accessibility/AXObjectCache.cpp: Modified. Added HAVE(ACCESSIBILITY) guards around contentChanged
+        * accessibility/AXObjectCache.h: Modified.
+        (WebCore::AXObjectCache::contentChanged): Added stub
+
+2010-01-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Use long long rather than int64 in V8Binding.h
+        https://bugs.webkit.org/show_bug.cgi?id=34270
+
+        No new tests, build fix only.
+
+        * bindings/v8/V8Binding.h: Modified.
+        (WebCore::toInt64): Returns long long
+
+2010-01-28  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by David Levin.
+
+        Unused variable in ThemeMac (followup to change 49103).
+        https://bugs.webkit.org/show_bug.cgi?id=34274
+
+        Covered by existing tests.
+
+        * platform/mac/ThemeMac.mm:
+        (WebCore::setupButtonCell):
+
+2010-01-28  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Huge plain text pastes are slow
+        <rdar://problem/5195056>
+        https://bugs.webkit.org/show_bug.cgi?id=34237
+
+        No new tests. It is a performance improvement.
+
+        The performance of the plain text paste is now linear.
+        We treat as a special case, a fragment that has been
+        created from plain text. Finding VisiblePositions and
+        applying style is greatly simplified, given the nature of
+        the fragment.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/markup.cpp:
+        (WebCore::isPlainTextMarkup):
+        * editing/markup.h:
+
+2010-01-28  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Initialize DOM Storage's quota's current length parameter when we clone it.
+        https://bugs.webkit.org/show_bug.cgi?id=34294
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::copy):
+
+2010-01-28  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix after r53411 on WinCairo.
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::frameCount):
+
+2010-01-28  Nayan Kumar K  <nayankk@gmail.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Fix for compilation error in WML enabled build introduced because of the changeset 53514.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34254
+
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::WMLDocument):
+
+2010-01-28  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Eric Seidel.
+
+        Update to CSS to remove unnecessary line-height settings
+
+        * css/mathml.css:
+
+2010-01-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Add missing includes for HashMap/HashSet
+        https://bugs.webkit.org/show_bug.cgi?id=34276
+
+        No new tests, build fix only.
+
+        * platform/KURL.cpp: Modified. Include HashMap.h
+        * platform/network/CredentialStorage.cpp: Modified. Include HashMap.h and HashSet.h
+        * platform/network/ProtectionSpaceHash.h: Modified. Include HashTraits.h
+
+2010-01-28  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        Pass cookies to the GStreamer HTTP source
+        https://bugs.webkit.org/show_bug.cgi?id=34003
+
+        Test: http/tests/media/video-cookie.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        When using an appropiate GStreamer HTTP source element, pass
+        the cookies for the media URI to it. This fixes playback of
+        the YouTube HTML5 videos.
+
+2010-01-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix after r54022.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::createStructure):
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapRuntimeObjectImp::createStructure):
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+
+2010-01-28  Adam Roben  <aroben@apple.com>
+
+        Fix an assertion beneath SerializedScriptValue::deserialize on 32-bit
+        builds (e.g., on Windows)
+
+        Passing a JSValue to toRef on 32-bit builds can perform an allocation,
+        so we need to make sure we hold a JSLock when that occurs.
+
+        Reviewed by Oliver Hunt.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValueData::serialize):
+        (WebCore::SerializedScriptValueData::deserialize):
+        Moved JSLocks from here...
+
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::deserialize):
+        ...to this higher level, from which toRef can be called.
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        DOM Objects shouldn't all require custom mark functions
+        https://bugs.webkit.org/show_bug.cgi?id=34291
+
+        Make DOMObjectWithGlobalPointer use an anonymous slot to store the global object
+        reference.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::globalObject):
+        (WebCore::DOMObjectWithGlobalPointer::scriptExecutionContext):
+        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Simplify anonymous slot implementation
+        https://bugs.webkit.org/show_bug.cgi?id=34282
+
+        Update the WebCore JS DOM bindings to correctly pass and
+        propagate the anonymous slot count information.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2010-01-27  Evan Martin  <evan@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] hebrew vowel marks incorrectly positioned
+        https://bugs.webkit.org/show_bug.cgi?id=34234
+
+        Fix glyph metrics computation such that the glyph offsets
+        are correct, so we can now make use of them.
+
+        Test: fast/text/international/hebrew-vowels.html
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::createGlyphArrays): initialize per-glyph
+        offset table.
+        (WebCore::TextRunWalker::setGlyphXPositions): use per-glyph
+        offsets.
+        * platform/graphics/chromium/HarfbuzzSkia.cpp:
+        (WebCore::getGlyphMetrics): fix metrics computation such that
+        per-glyph offsets are computed correctly.
+
+2010-01-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        [Qt] Build fix if websockets support is turned off after r53947.
+
+        * WebCore.pro:
+
+2010-01-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r54012.
+        http://trac.webkit.org/changeset/54012
+        https://bugs.webkit.org/show_bug.cgi?id=34266
+
+        Introduced 33 crashes in V8 traversal/ tests.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptState.cpp:
+        * bindings/js/ScriptState.h:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        (WebCore::ScriptController::currentScriptState):
+        (WebCore::ScriptController::clearWindowShell):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        (WebCore::ScriptScope::success):
+        * bindings/v8/ScriptScope.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::scriptStateFromPage):
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::ScriptState::frame):
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/V8IsolatedContext.cpp:
+        (WebCore::V8IsolatedContext::scriptState):
+        * bindings/v8/V8IsolatedContext.h:
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        (WebCore::reportException):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::V8NodeIterator::nextNodeCallback):
+        (WebCore::V8NodeIterator::previousNodeCallback):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::V8TreeWalker::parentNodeCallback):
+        (WebCore::V8TreeWalker::firstChildCallback):
+        (WebCore::V8TreeWalker::lastChildCallback):
+        (WebCore::V8TreeWalker::nextNodeCallback):
+        (WebCore::V8TreeWalker::previousNodeCallback):
+        (WebCore::V8TreeWalker::nextSiblingCallback):
+        (WebCore::V8TreeWalker::previousSiblingCallback):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::injectedScriptForNodeId):
+
+2010-01-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Fix missing forward-declarations and includes in V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=34272
+
+        No new tests, build fix only.
+
+        * bindings/v8/ScriptController.h: Modified. Forward-declare NPObject
+        * bindings/v8/V8DOMWindowShell.cpp: Modified. Include CString.h and PlatformBridge.h
+        * bindings/v8/V8DOMWrapper.h: Modified. Forward-declare V8Proxy
+
+2010-01-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove ScriptState::frame which is only used for reporting exceptions
+        in some cases in a way that diverges from the regular exception reporting in
+        v8 bindings.
+        
+        Cache ScriptState directly on v8::Context instead of providing
+        implementations specific for isolated worlds and ScriptController.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34266
+
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptState.cpp:
+        (WebCore::mainWorldScriptState):
+        * bindings/js/ScriptState.h:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        (WebCore::ScriptScope::success):
+        * bindings/v8/ScriptScope.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::ScriptState::forContext):
+        (WebCore::ScriptState::current):
+        (WebCore::ScriptState::empty):
+        (WebCore::ScriptState::weakReferenceCallback):
+        (WebCore::mainWorldScriptState):
+        (WebCore::scriptStateFromPage):
+        * bindings/v8/ScriptState.h:
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/V8IsolatedContext.cpp:
+        * bindings/v8/V8IsolatedContext.h:
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        (WebCore::reportException):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::V8NodeIterator::nextNodeCallback):
+        (WebCore::V8NodeIterator::previousNodeCallback):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::V8TreeWalker::parentNodeCallback):
+        (WebCore::V8TreeWalker::firstChildCallback):
+        (WebCore::V8TreeWalker::lastChildCallback):
+        (WebCore::V8TreeWalker::nextNodeCallback):
+        (WebCore::V8TreeWalker::previousNodeCallback):
+        (WebCore::V8TreeWalker::nextSiblingCallback):
+        (WebCore::V8TreeWalker::previousSiblingCallback):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::injectedScriptForNodeId):
+
+2010-01-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        Remove XSSAuditor false positive for Google Translate
+        https://bugs.webkit.org/show_bug.cgi?id=34242
+
+        Google translate takes a base URL as a parameter, causing a false
+        positive in the XSS filter.  This patch removes the false positive by
+        allowing direct injections into the href property of the base tag.
+
+        Test: http/tests/security/xssAuditor/base-href-direct.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+
+2010-01-28  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Save additional memory in SVG*Element classes, by introducing SVGElementRareData
+        https://bugs.webkit.org/show_bug.cgi?id=34268
+
+        Introduce SVGElementRareData, to remove the need to store any members in SVGElement/SVGStyledElement.
+        This saves some additional MB for the svg-node-count-vs-scroll.xhtml testcase.
+
+        SVGElementRareData works just like NodeRareData. Unlike ElementRareData, we're not inheriting from
+        NodeRareData in SVG, as we don't need all the rare data stored there, unlike Element.
+
+        * GNUmakefile.am: Add SVGElementRareData.h to build.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * dom/Node.cpp: Use Nodes bitfield to keep track wheter a SVGElement has a SVGElementRareData object associated.
+        (WebCore::Node::Node):
+        * dom/Node.h: Add m_hasRareSVGData flag, merged with the existing bitfield, 10 bits remaining now.
+        (WebCore::Node::hasRareSVGData):
+        * svg/SVGAnimateMotionElement.cpp: SVGElement::instancesForElement() now returns a const-reference to the HashMap instead of copying.
+        (WebCore::SVGAnimateMotionElement::applyResultsToTarget):
+        * svg/SVGAnimateTransformElement.cpp: Ditto.
+        (WebCore::SVGAnimateTransformElement::applyResultsToTarget):
+        * svg/SVGAnimationElement.cpp: Ditto.
+        (WebCore::SVGAnimationElement::setTargetAttributeAnimatedValue):
+        * svg/SVGElement.cpp: Move the element instances HashSet and two cursor-related pointers into SVGElementRareData.
+        (WebCore::SVGElement::SVGElement):
+        (WebCore::SVGElement::~SVGElement):
+        (WebCore::SVGElement::rareSVGData): Modelled just like Node::rareData().
+        (WebCore::SVGElement::ensureRareSVGData): Dito.
+        (WebCore::SVGElement::accessDocumentSVGExtensions):
+        (WebCore::SVGElement::mapInstanceToElement): Route call through SVGElementRareData.
+        (WebCore::SVGElement::removeInstanceMapping): Ditto.
+        (WebCore::SVGElement::instancesForElement): Ditto.
+        (WebCore::SVGElement::setCursorElement): Ditto.
+        (WebCore::SVGElement::setCursorImageValue): Ditto.
+        * svg/SVGElement.h:
+        * svg/SVGElementInstance.cpp: Ditto.
+        (WebCore::SVGElementInstance::invalidateAllInstancesOfElement):
+        * svg/SVGElementRareData.h: Added. Based on NodeRareData - works exactly the same.
+        (WebCore::SVGElementRareData::SVGElementRareData):
+        (WebCore::SVGElementRareData::rareDataMap):
+        (WebCore::SVGElementRareData::rareDataFromMap):
+        (WebCore::SVGElementRareData::elementInstances):
+        (WebCore::SVGElementRareData::instanceUpdatesBlocked):
+        (WebCore::SVGElementRareData::setInstanceUpdatesBlocked):
+        (WebCore::SVGElementRareData::cursorElement):
+        (WebCore::SVGElementRareData::setCursorElement):
+        (WebCore::SVGElementRareData::cursorImageValue):
+        (WebCore::SVGElementRareData::setCursorImageValue):
+        * svg/SVGStyledElement.cpp: Move m_instancesUpdatesBlocked into SVGElementRareData.
+        (WebCore::SVGStyledElement::SVGStyledElement):
+        (WebCore::SVGStyledElement::instanceUpdatesBlocked):
+        (WebCore::SVGStyledElement::setInstanceUpdatesBlocked):
+        * svg/SVGStyledElement.h:
+        * svg/SVGUseElement.cpp: Adapt to element instances changes, now passed as const-reference.
+        (WebCore::dumpInstanceTree):
+
+2010-01-28  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Expand the NotificationPresenter::checkPermission() interface to send the full
+        URL of the requesting context, as well as a pointer to the document if that
+        context was a document.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34238
+
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::NotificationCenter):
+        (WebCore::NotificationCenter::checkPermission):
+        Pass the full URL and document from the requesting context when calling
+        NotificationPresenter::checkPermission().
+        
+        * notifications/NotificationPresenter.h:
+        (WebCore::NotificationPresenter::):
+        Expand interface.
+
+2010-01-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Video can overlap position:fixed element when scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=32180
+        
+        When the scroll position changes, and we're using overlap to decide what gets composited,
+        then we need to re-evaluate what gets compositing when scrolling in case fixed postion elements
+        overlap composited elements (e.g. video).
+
+        Test: compositing/geometry/video-fixed-scrolling.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        (WebCore::FrameView::scrollPositionChanged): Annotate the calls to updateCompositingLayers()
+        with the type of change that occurred.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateCompositingAndLayerListsIfNeeded): Ditto.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers): For scroll changes, check
+        for hierarchy update if m_compositingConsultsOverlap is true, and do
+        a geometry update. For other changes, always check for hierarchy updates.
+
+2010-01-27  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for user stylesheet bugs where they get parsed using the wrong compatibility mode.  This was a regression
+        caused from Safari 3 -> 4 by the Acid3 fixes to create a real DOCTYPE in the DOM.
+
+        This patch makes style selector creation lazy, so that the selector isn't built unless someone asks for it.
+
+        In order to avoid creating the style selector before the compatibility mode has been determined, document
+        style is now created without having a dependence on an instantiated style selector.  The creation of the style
+        is now done as a static method on CSSStyleSelector called styleForDocument, and a couple of font-related
+        functions have been made static as well so that they can be used by this method.
+
+        m_styleSelector on Document is now an OwnPtr.
+
+        Added userscripts/mixed-case-stylesheet.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForDocument):
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::checkForGenericFamilyChange):
+        (WebCore::CSSStyleSelector::setFontSize):
+        (WebCore::CSSStyleSelector::getComputedSizeFromSpecifiedSize):
+        (WebCore::CSSStyleSelector::fontSizeForKeyword):
+        * css/CSSStyleSelector.h:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::createStyleSelector):
+        (WebCore::Document::attach):
+        (WebCore::Document::setVisuallyOrdered):
+        (WebCore::Document::recalcStyleSelector):
+        * dom/Document.h:
+        (WebCore::Document::styleSelector):
+        (WebCore::Document::visuallyOrdered):
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::determineParseMode):
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+
+2010-01-28  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Rename ISODateTime.{cpp,h} to DateComponents.{cpp,h}
+        https://bugs.webkit.org/show_bug.cgi?id=34245
+
+        No functional changes.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/DateComponents.cpp: Copied from WebCore/html/ISODateTime.cpp.
+        (WebCore::DateComponents::maxWeekNumberInYear):
+        (WebCore::DateComponents::parseYear):
+        (WebCore::DateComponents::addDay):
+        (WebCore::DateComponents::addMinute):
+        (WebCore::DateComponents::parseTimeZone):
+        (WebCore::DateComponents::parseMonth):
+        (WebCore::DateComponents::parseDate):
+        (WebCore::DateComponents::parseWeek):
+        (WebCore::DateComponents::parseTime):
+        (WebCore::DateComponents::parseDateTimeLocal):
+        (WebCore::DateComponents::parseDateTime):
+        (WebCore::DateComponents::setMillisecondsSinceMidnightInternal):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForDateInternal):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForDate):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForDateTime):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForDateTimeLocal):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForMonth):
+        (WebCore::DateComponents::setMillisecondsSinceMidnight):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForWeek):
+        (WebCore::DateComponents::millisecondsSinceEpochForTime):
+        (WebCore::DateComponents::millisecondsSinceEpoch):
+        (WebCore::DateComponents::toStringForTime):
+        (WebCore::DateComponents::toString):
+        * html/DateComponents.h: Copied from WebCore/html/ISODateTime.h.
+        (WebCore::DateComponents::DateComponents):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseToDouble):
+        (WebCore::HTMLInputElement::valueAsDate):
+        (WebCore::HTMLInputElement::setValueAsDate):
+        (WebCore::HTMLInputElement::setValueAsNumber):
+        (WebCore::HTMLInputElement::formStringToDateComponents):
+        * html/HTMLInputElement.h:
+        * html/ISODateTime.cpp: Removed.
+        * html/ISODateTime.h: Removed.
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2010-01-28  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Use platform-specific monospace fonts in the Web Inspector
+
+        Move the OS version detection code into the frontend,
+        add custom CSS monospace styles for known platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=34040
+
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::platform):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.releaseWrapperObjectGroup):
+        (.WebInspector.InspectorBackendStub.prototype.setInjectedScriptSource):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._createConditionElement):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.URLRegExp.i.get platform):
+        (WebInspector._detectPlatform):
+
+2010-01-28  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Simplify views logic in Profiler panel, and fix the problem described in the issue.
+        Remove image from Welcome view.
+        Preserve border on status bar-like buttons in Welcome view on window deactivation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34201
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.show):
+        (WebInspector.ProfilesPanel.prototype.reset):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showView):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/WelcomeView.js:
+        (WebInspector.WelcomeView):
+        * inspector/front-end/inspector.css:
+
+2010-01-18  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Speed up KURL to QUrl conversion
+        https://bugs.webkit.org/show_bug.cgi?id=33873
+
+        The WebCore::String::utf8 method will use the generic WebCore::TextCodec
+        and then call the encode method on it. In QtWebKit this class is implemented
+        around the QTextCodec class. Instead of going the generic codec way we treat
+        the WebCore::String as a QString (no copying) and then use the built-in
+        QString::toUtf8 to do the conversion.
+
+        * platform/qt/KURLQt.cpp:
+        (WebCore::KURL::operator QUrl):
+
+2010-01-28  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Android] [Qt] Touch event page co-ordinates are incorrect when touch is received in an iframe.
+        https://bugs.webkit.org/show_bug.cgi?id=34162
+
+        The pageX/pageY co-ordinates of a touch event should be relative to the containing frame, not the main frame. This change implements that and also updates the existing touch-inside-iframe test to also examine the page co-ordinates.
+
+        * dom/Touch.cpp:
+        (WebCore::Touch::Touch): Remove dead code.
+        * dom/Touch.h: Remove dead code.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Rename framePoint to pagePoint, as it seems a clearer name. Also adjust the pagePoint to be relative to the touch target element's containing frame rather than the main frame.
+        * platform/PlatformTouchEvent.h: Rename Android specific constructor parameter to better reflect it's contents.
+        * platform/PlatformTouchPoint.h: Ditto.
+        * platform/android/PlatformTouchEventAndroid.cpp: Ditto.
+        * platform/android/PlatformTouchPointAndroid.cpp: Ditto.
+
+2010-01-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Simplify isActivation method.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34161
+
+        Test: WebCore/manual-tests/inspector/debugger-scopes-inspection.html
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::isActivation):
+
+2010-01-27  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        rangeOverflow/rangeUnderflow support for type=date
+        https://bugs.webkit.org/show_bug.cgi?id=34209
+
+        Add DATE type support to rangeUnderflow(), rangeOverflow(),
+        minimum(), and maximum() of HTMLInputElement.
+        In order to unify parsing code for value, min, and max strings,
+        introduce parseToDouble() function and it is called by
+        valueAsDate() and valueAsNumber() too.
+
+        Tests: fast/forms/ValidityState-rangeOverflow-date.html
+               fast/forms/ValidityState-rangeUnderflow-date.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow): Support DATE type, and use parseToDouble().
+        (WebCore::HTMLInputElement::rangeOverflow): ditto.
+        (WebCore::HTMLInputElement::minimum): ditto.
+        (WebCore::HTMLInputElement::maximum): ditto.
+        (WebCore::HTMLInputElement::doubleValueFor): Added.
+        (WebCore::HTMLInputElement::valueAsDate): Use parseToDouble().
+        (WebCore::HTMLInputElement::valueAsNumber): Use parseToDouble().
+        * html/HTMLInputElement.h: Declare parseToDouble().
+
+2010-01-27  Darin Fisher  <darin@chromium.org>
+
+        Fix chromium build bustage (take 2).
+
+        * bindings/scripts/CodeGeneratorV8.pm: Really treat V8CustomGetter like CustomGetter in all cases.
+
+2010-01-27  Darin Fisher  <darin@chromium.org>
+
+        Fix chromium build bustage.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Treat V8CustomGetter like CustomGetter in all cases.
+
+2010-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        MessageEvent.data should deserialize in the context of the MessageEvent's global object
+        https://bugs.webkit.org/show_bug.cgi?id=34227
+
+        Make ScriptValue deserialisation support the provision of a specific global
+        object to use when creating new objects.  This then allows us to make
+        MessageEvent.data and PopStateEvent.state deserialize in the correct
+        context.
+
+        Test: fast/dom/Window/window-postmessage-clone-frames.html
+
+        * bindings/js/JSPopStateEventCustom.cpp:
+          Remove custom implementation of state getter
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
+        (WebCore::DeserializingTreeWalker::createOutputArray):
+        (WebCore::DeserializingTreeWalker::createOutputObject):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::SerializedScriptValueData::deserialize):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/scripts/CodeGeneratorJS.pm:
+          Update bindings generation to pass the correct global object, and to
+          treat "any" as synonymous with SerializedValue.
+        * dom/PopStateEvent.idl:
+
+2010-01-27  Nicholas Young  <nicholas.young@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Make media controls fade in/out transition duration configurable on a theme level.
+        https://bugs.webkit.org/show_bug.cgi?id=34196
+
+        No new tests needed (I hope).
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::RenderMedia): Removed constant from contructor - the initial value is meaningless.
+        (WebCore::RenderMedia::updateControlVisibility): Get fade in/out duration from theme.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::mediaControlsFadeInDuration): New virtual method.
+        (WebCore::RenderTheme::mediaControlsFadeOutDuration): New virtual method.
+
+2010-01-27  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Tests that when a page removes an iframe that sleeps in its unload handler and
+        terminates its JS execution, the outer page's JS continues running.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34226
+
+        Tests: fast/dom/Window/slow-unload-handler-only-frame-is-stopped.html
+               fast/dom/Window/slow-unload-handler.html
+
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::OnSleepDetected):
+
+2010-01-27  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add valueAsNumber support for type=datetime-local.
+        https://bugs.webkit.org/show_bug.cgi?id=34200
+
+        Implement necessary methods of ISODateTime, and call them from
+        HTMLInputElement.
+
+        Test: fast/forms/input-valueasnumber-datetimelocal.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsNumber):
+        (WebCore::HTMLInputElement::setValueAsNumber):
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForDateTimeLocal):
+          Implemented.  Just call setMillisecondsSinceEpochForDateTime().
+        (WebCore::ISODateTime::millisecondsSinceEpochForTime):
+          Accept to be called for m_type=DateTimeLocal.
+        (WebCore::ISODateTime::toString): Add DateTimeLocal support.
+        * html/ISODateTime.h: Declare new methods.
+
+2010-01-27  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows Debug_All build fix.
+
+        * platform/graphics/win/WKCACFLayer.cpp:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+
+2010-01-27  Evan Martin  <evan@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] complex text draws newlines as bells
+        https://bugs.webkit.org/show_bug.cgi?id=34186
+
+        Revert r45496 -- once we've got a glyph array, it is too late to normalize
+        because we could have had multiple codepoints combine into one glyph.  The
+        Uniscribe code it mentions it's duplicating uses the log cluster map to fix
+        this.
+
+        Instead, we just normalize the input text if it contains any non-ascii-space
+        whitespace.
+
+        This fixes fast/text/international/hindi-whitespace, which currently has an
+        incorrect baseline containing a square box glyph.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::getTextRun):
+        (WebCore::TextRunWalker::getNormalizedTextRun):
+        * platform/graphics/chromium/HarfbuzzSkia.cpp:
+        (WebCore::stringToGlyphs):
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSRuleSet::getIDRules):
+        (WebCore::CSSRuleSet::getClassRules):
+        (WebCore::CSSRuleSet::getTagRules):
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+        * dom/CheckedRadioButtons.cpp:
+        (WebCore::CheckedRadioButtons::checkedButtonForGroup):
+        (WebCore::CheckedRadioButtons::removeButton):
+        * editing/markup.cpp:
+        (WebCore::shouldAddNamespaceAttr):
+        (WebCore::appendNamespace):
+        (WebCore::appendStartMarkup):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::namedItems):
+        (WebCore::HTMLCollection::nextNamedItem):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::formCollectionInfo):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::collectionInfo):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::servePendingRequests):
+        (WebCore::Loader::nonCacheRequestInFlight):
+        (WebCore::Loader::nonCacheRequestComplete):
+        (WebCore::Loader::cancelRequests):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::getAnimatedStyle):
+        (WebCore::CompositeAnimation::setAnimating):
+        (WebCore::CompositeAnimation::timeToNextService):
+        (WebCore::CompositeAnimation::getAnimationForProperty):
+        (WebCore::CompositeAnimation::suspendAnimations):
+        (WebCore::CompositeAnimation::resumeAnimations):
+        (WebCore::CompositeAnimation::isAnimatingProperty):
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::numberOfActiveAnimations):
+        Added checkConsistency checks before lookups in HashMaps with AtomicStringImpl* keys.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removedLastRef): Clear m_elementsById map, because removeAllChildren()
+        doesn't always update it correctly when called during docuemnt destruction.
+        (WebCore::Document::getElementById): Added checkConsistency().
+        (WebCore::Document::removeElementById): Ditto.
+        (WebCore::Document::removeImageMap): Ditto.
+        (WebCore::Document::getImageMap): Ditto.
+        (WebCore::Document::nameCollectionInfo): Ditto.
+        * dom/Document.h:
+        (WebCore::Document::collectionInfo): Ditto.
+
+        * html/CollectionCache.cpp:
+        (WebCore::CollectionCache::checkConsistency):
+        * html/CollectionCache.h:
+        Added a checkConsistency() method that checks both HashMaps in the cache.
+
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::~TreeShared): Assert that m_refCount is null. Since Nodes can be
+        destroyed with operator delete (as done in ContainerNodeAlgorithms), this is important to check.
+        (WebCore::TreeShared::deref): Assert that m_refCount isn't already negative.
+
+2010-01-27  Brian Tarricone  <brian@kakai.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [gtk] Add support for windowless NPAPI plugins
+
+        Much of this is a translation of how the Qt backend does this,
+        modified for Gtk.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18831
+
+        No new tests; there is already a windowless test in the tree.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::getRootWindow):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::inputEventState):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::handleFocusInEvent):
+        (WebCore::PluginView::handleFocusOutEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::getPluginDisplay):
+        (WebCore::plug_removed_cb):
+        (WebCore::getVisualAndColormap):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2010-01-27  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        [v8] minor cosmetic fix in V8 bindings codegenerator
+        https://bugs.webkit.org/show_bug.cgi?id=34224
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2010-01-27  Darin Fisher  <darin@chromium.org>
+
+        Fix Chromium build bustage.
+
+        * rendering/RenderBoxModelObject.cpp: Add wtf/CurrentTime.h include.
+
+2010-01-26  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Brady Eidson and David Levin.
+
+        Chains of history items representing same-document navigation need to
+        always remember that association
+
+        https://bugs.webkit.org/show_bug.cgi?id=33224
+
+        Replace HistoryItem's Document pointer with a DocumentSequenceNumber.
+        During session history traversal, if the current HistoryItem and the
+        target HistoryItem have the same DocumentSequenceNumber, then it means
+        that the current Document should remain.
+
+        NOTE: To support Chromium's serialization of HistoryItems, I generate
+        DocumentSequenceNumbers that are unique across application launches.
+        DocumentSequenceNumbers are generated using a counter initialized with
+        the time of day.
+
+        Test: fast/loader/stateobjects/document-destroyed-navigate-back.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/HistoryItem.cpp:
+        (WebCore::generateDocumentSequenceNumber):
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        (WebCore::HistoryItem::setStateObject):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::setDocumentSequenceNumber):
+        (WebCore::HistoryItem::documentSequenceNumber):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateWithinDocument):
+        (WebCore::FrameLoader::loadItem):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateBackForwardListForFragmentScroll):
+        (WebCore::HistoryController::pushState):
+        (WebCore::HistoryController::replaceState):
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        * page/History.cpp:
+        (WebCore::History::stateObjectAdded):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2010-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Animated scaling of background-image is too slow
+        https://bugs.webkit.org/show_bug.cgi?id=33808
+
+        Implement a version of the RenderImage animated scaling optimisation
+        for background images.  Due to the possibility of arbitrary transforms
+        being applied to containing elements we explicitly check the current
+        CTM of the context for scaling or rotation.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawTiledImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::isIdentityOrTranslation):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleData::RenderBoxModelScaleData):
+        (WebCore::RenderBoxModelScaleData::~RenderBoxModelScaleData):
+        (WebCore::RenderBoxModelScaleData::size):
+        (WebCore::RenderBoxModelScaleData::time):
+        (WebCore::RenderBoxModelScaleData::useLowQualityScale):
+        (WebCore::RenderBoxModelScaleData::hiqhQualityRepaintTimer):
+        (WebCore::RenderBoxModelScaleData::setSize):
+        (WebCore::RenderBoxModelScaleData::setTime):
+        (WebCore::RenderBoxModelScaleData::setUseLowQualityScale):
+        (WebCore::RenderBoxModelScaleObserver::boxModelObjectDestroyed):
+        (WebCore::RenderBoxModelScaleObserver::highQualityRepaintTimerFired):
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
+        (WebCore::RenderBoxModelObject::highQualityRepaintTimerFired):
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
+
+2010-01-27  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Enable websockets support in QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=34180
+
+        Connected between SocketStreamHandle and QTcpSocket/QSslSocket
+        to enable support for websockets.
+        Proxy authentication is not yet supported.
+        SSL certificate errors are ignored while this is under development.
+
+        * WebCore.pro:
+        * platform/network/qt/SocketStreamHandle.h:
+        * platform/network/qt/SocketStreamHandlePrivate.h: Added.
+        * platform/network/qt/SocketStreamHandleQt.cpp:
+        (WebCore::SocketStreamHandlePrivate::SocketStreamHandlePrivate):
+        (WebCore::SocketStreamHandlePrivate::~SocketStreamHandlePrivate):
+        (WebCore::SocketStreamHandlePrivate::socketConnected):
+        (WebCore::SocketStreamHandlePrivate::socketReadyRead):
+        (WebCore::SocketStreamHandlePrivate::send):
+        (WebCore::SocketStreamHandlePrivate::close):
+        (WebCore::SocketStreamHandlePrivate::socketSentdata):
+        (WebCore::SocketStreamHandlePrivate::socketClosed):
+        (WebCore::SocketStreamHandlePrivate::socketError):
+        (WebCore::SocketStreamHandlePrivate::socketClosedCallback):
+        (WebCore::SocketStreamHandlePrivate::socketErrorCallback):
+        (WebCore::SocketStreamHandlePrivate::socketSslErrors):
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::~SocketStreamHandle):
+        (WebCore::SocketStreamHandle::platformSend):
+        (WebCore::SocketStreamHandle::platformClose):
+
+2010-01-27  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Support getting integer-named properties using indexing notation on document object
+        https://bugs.webkit.org/show_bug.cgi?id=34211
+
+        Add indexed property getter to HTMLDocument to support getting
+        elements with integer names using indexing notation on document.
+
+        Test: fast/dom/HTMLDocument/get-iframe-with-integer-name.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::V8HTMLDocument::indexedPropertyGetter):
+
+2010-01-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Instead of relying on Object.prototype.toString result use JSObject::isActivationObject
+        to check if a scope node is a JSActivation. Object.prototype.toString for JSActivation
+        will call JSActivation::toThisObject whose result depends on the current call stack.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34161
+
+        Test: WebCore/manual-tests/inspector/debugger-scopes-inspection.html
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::isActivation):
+        * inspector/InjectedScriptHost.idl:
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor.):
+        * manual-tests/inspector/debugger-scopes-inspection.html: Added.
+
+2010-01-27 Anton Muhin <antonm@google.com>
+        Review by Adam Barth.
+
+        Implement Node map in intrusive way for better speed.
+        https://bugs.webkit.org/show_bug.cgi?id=33957
+
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::get):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::set):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::removeIfPresent):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::contains):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::visit):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::clear):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::allocateTableEntry):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::freeTableEntry):
+        * bindings/v8/DOMDataStore.h:
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::IntrusiveDOMWrapperMap):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::clearEntry):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::clearEntries):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::visitEntries):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::TableChunk::TableChunk):
+        (WebCore::DOMDataStore::domNodeMap):
+        * bindings/v8/StaticDOMDataStore.cpp:
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        * bindings/v8/StaticDOMDataStore.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::AbstractWeakReferenceMap::AbstractWeakReferenceMap):
+        (WebCore::AbstractWeakReferenceMap::weakReferenceCallback):
+        (WebCore::WeakReferenceMap::WeakReferenceMap):
+        (WebCore::WeakReferenceMap::set):
+        (WebCore::WeakReferenceMap::visit):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object):
+        (WebCore::getWrapper):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+
+2010-01-27  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add key event mappings for numpad keys for Gtk and Chromium/Gtk.
+        http://bugs.webkit.org/show_bug.cgi?id=28247
+
+        Test: fast/events/keydown-numpad-keys.html
+
+        * platform/chromium/KeyCodeConversionGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2010-01-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: migrate from SourceFrame to SourceFrame2.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34171
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * inspector/InspectorFrontendHost.cpp:
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/InspectorBackendStub.js:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._innerSelectContentTab):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.getResourceContent):
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView):
+        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._sidebarResizeDrag):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.set executionLine):
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype.addBreakpoint):
+        (WebInspector.SourceFrame.prototype.removeBreakpoint):
+        (WebInspector.SourceFrame.prototype.addMessage):
+        (WebInspector.SourceFrame.prototype.clearMessages):
+        (WebInspector.SourceFrame.prototype.sizeToFitContentHeight):
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype.findSearchMatches):
+        (WebInspector.SourceFrame.prototype._collectRegexMatches):
+        (WebInspector.SourceFrame.prototype.setSelection):
+        (WebInspector.SourceFrame.prototype._incrementMessageRepeatCount):
+        (WebInspector.SourceFrame.prototype._addExistingMessagesToSource):
+        (WebInspector.SourceFrame.prototype._addMessageToSource):
+        (WebInspector.SourceFrame.prototype._addExistingBreakpointsToSource):
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame.prototype._removeBreakpointFromSource):
+        (WebInspector.SourceFrame.prototype._contextMenu.addConditionalBreakpoint):
+        (WebInspector.SourceFrame.prototype._contextMenu):
+        (WebInspector.SourceFrame.prototype._toggleBreakpoint):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.committed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.dismissed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._showBreakpointConditionPopup):
+        (WebInspector.SourceFrame.prototype._createConditionElement):
+        (WebInspector.SourceFrame.prototype._keyDown):
+        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
+        (WebInspector.SourceFrame.prototype._breakpointChanged):
+        (WebInspector.SourceFrame.prototype.resize):
+        (WebInspector.BreakpointLineNumberDecorator):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.decorate):
+        (WebInspector.BreakpointLineNumberDecorator.prototype._paintBreakpoint):
+        (WebInspector.BreakpointLineNumberDecorator.prototype._paintProgramCounter):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.mouseDown):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.contextMenu):
+        (WebInspector.ExecutionLineDecorator):
+        (WebInspector.ExecutionLineDecorator.prototype.decorate):
+        * inspector/front-end/SourceFrame2.js: Removed.
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView):
+        (WebInspector.SourceView.prototype.show):
+        (WebInspector.SourceView.prototype.resize):
+        (WebInspector.SourceView.prototype.setupSourceFrameIfNeeded):
+        (WebInspector.SourceView.prototype._contentLoaded):
+        (WebInspector.SourceView.prototype.performSearch.findSearchMatches):
+        (WebInspector.SourceView.prototype.performSearch):
+        (WebInspector.SourceView.prototype._jumpToSearchResult):
+        (WebInspector.SourceView.prototype._sourceFrameSetupFinished):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype._mouseDown):
+        (WebInspector.TextEditor.prototype._copy.delayCopy):
+        (WebInspector.TextEditor.prototype._copy):
+        (WebInspector.TextEditor.prototype._cut):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2010-01-27  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] For removing ICU, implement IDN support by means of libidn
+        https://bugs.webkit.org/show_bug.cgi?id=31470
+
+        In order to avoid a new dependency, 
+        IDN support now based on GLib for the GLib unicode backend.
+
+        * platform/KURL.cpp:
+        (WebCore::appendEncodedHostname):
+
+2010-01-27  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] For package builds use the .def files on Symbian
+
+        * WebCore.pro:
+
+2010-01-27  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Avoid watch expressions duplication
+        https://bugs.webkit.org/show_bug.cgi?id=33996
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSidebarPane.prototype._settingsLoaded):
+
+2010-01-27  Marcus Bulach  <bulach@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adds EventSource bindings for V8
+        https://bugs.webkit.org/show_bug.cgi?id=33695
+
+        No new tests (existing layout tests for EventSource should pass).
+
+        * Android.v8bindings.mk:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8EventSourceConstructor.cpp: Added.
+        * bindings/v8/custom/V8EventSourceCustom.cpp: Added.
+
+2010-01-27  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Meta-methods can't be introspected using ES5 API
+        https://bugs.webkit.org/show_bug.cgi?id=34087
+
+        Add getOwnPropertyDescriptor() and getOwnPropertyNames() reimplementations.
+
+        Tests are in WebKit/qt/tests/qwebframe
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::getOwnPropertyDescriptor):
+        (JSC::Bindings::QtRuntimeMetaMethod::getOwnPropertyNames):
+        (JSC::Bindings::QtRuntimeConnectionMethod::getOwnPropertyDescriptor):
+        (JSC::Bindings::QtRuntimeConnectionMethod::getOwnPropertyNames):
+        * bridge/qt/qt_runtime.h:
+
+2010-01-27  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix a crash when trying to indent a block element that was contained
+        in a list.  This was happening because enclosingBlock() in
+        htmlediting.cpp can return the current the same Node when a block
+        element (like an <hr> or a <table>) is passed in.  This causes
+        the indent command to think that it is not in a list item.
+
+        Work around this by checking to see if enclosingBlock returned the
+        same Node.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32390
+
+        Test: editing/execCommand/indent-block-in-list.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem):
+
+2010-01-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Add the "d" suffix to QtWebKit's dll on Windows.
+
+        * WebCore.pro:
+
+2010-01-27  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix a bug where dispatchDocumentElementAvailable was fired for fragment parsing on XML documents.
+        https://bugs.webkit.org/show_bug.cgi?id=33920
+
+        Tests: userscripts/script-not-run-for-fragments.html
+               userscripts/script-run-at-start.html
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+
+2010-01-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Improve SourceHTMLTokenizer so that it treats script tag well.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34177
+
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype._isAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._isAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._setAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._setAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._stringToken):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+
+2010-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: nuke quarantine wrappers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34203
+
+        * Android.jscbindings.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSInspectedObjectWrapper.cpp: Removed.
+        * bindings/js/JSInspectedObjectWrapper.h: Removed.
+        * bindings/js/JSInspectorCallbackWrapper.cpp: Removed.
+        * bindings/js/JSInspectorCallbackWrapper.h: Removed.
+        * bindings/js/JSQuarantinedObjectWrapper.cpp: Removed.
+        * bindings/js/JSQuarantinedObjectWrapper.h: Removed.
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Revert r53899 (HashMap<AtomicStringImpl*, Value> key checks) and subsequent build fixes,
+        because they make SVG tests crash in release builds.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSRuleSet::getIDRules):
+        (WebCore::CSSRuleSet::getClassRules):
+        (WebCore::CSSRuleSet::getTagRules):
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+        * dom/CheckedRadioButtons.cpp:
+        (WebCore::CheckedRadioButtons::checkedButtonForGroup):
+        (WebCore::CheckedRadioButtons::removeButton):
+        * dom/ContainerNodeAlgorithms.h:
+        (WebCore::removeAllChildrenInContainer):
+        * dom/Document.cpp:
+        (WebCore::Document::getElementById):
+        (WebCore::Document::removeElementById):
+        (WebCore::Document::removeImageMap):
+        (WebCore::Document::getImageMap):
+        (WebCore::Document::nameCollectionInfo):
+        * dom/Document.h:
+        (WebCore::Document::collectionInfo):
+        * editing/markup.cpp:
+        (WebCore::shouldAddNamespaceAttr):
+        (WebCore::appendNamespace):
+        (WebCore::appendStartMarkup):
+        * html/CollectionCache.cpp:
+        * html/CollectionCache.h:
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::namedItems):
+        (WebCore::HTMLCollection::nextNamedItem):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::formCollectionInfo):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::collectionInfo):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::servePendingRequests):
+        (WebCore::Loader::nonCacheRequestInFlight):
+        (WebCore::Loader::nonCacheRequestComplete):
+        (WebCore::Loader::cancelRequests):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::getAnimatedStyle):
+        (WebCore::CompositeAnimation::setAnimating):
+        (WebCore::CompositeAnimation::timeToNextService):
+        (WebCore::CompositeAnimation::getAnimationForProperty):
+        (WebCore::CompositeAnimation::suspendAnimations):
+        (WebCore::CompositeAnimation::resumeAnimations):
+        (WebCore::CompositeAnimation::isAnimatingProperty):
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::numberOfActiveAnimations):
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::~TreeShared):
+        (WebCore::TreeShared::deref):
+
+2010-01-25  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        autobuffer value not forwarded media element to MediaPlayer
+        https://bugs.webkit.org/show_bug.cgi?id=33889
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): Forward autobuffer
+        value to MediaPlayer instance.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load): Forward autobuffer and
+        preservesPitch values to newly created platform media player instance.
+
+2010-01-25  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Gtk] media/video-reverse-play-duration.html fails on and off on Gtk buildbots
+        https://bugs.webkit.org/show_bug.cgi?id=34086
+
+        Cache media duration and fix didEnd() in case of reverse
+        playback. When EOS was reached but in case of reverse playback the
+        position is not always 0. So to not confuse the HTMLMediaElement
+        we synchronize position and duration values.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::duration):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::didEnd):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        * WebCore.xcodeproj/project.pbxproj: Actually land the change to add ContainerNodeAlgorithms.h
+        (it's "svn resolved", not "svn revert"!).
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
+
+        * WebCore.xcodeproj/project.pbxproj: Added ContainerNodeAlgorithms.h to the project to make
+        it easier to search for.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSRuleSet::getIDRules):
+        (WebCore::CSSRuleSet::getClassRules):
+        (WebCore::CSSRuleSet::getTagRules):
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+        * dom/CheckedRadioButtons.cpp:
+        (WebCore::CheckedRadioButtons::checkedButtonForGroup):
+        (WebCore::CheckedRadioButtons::removeButton):
+        * dom/Document.cpp:
+        (WebCore::Document::getElementById):
+        (WebCore::Document::removeElementById):
+        (WebCore::Document::removeImageMap):
+        (WebCore::Document::getImageMap):
+        (WebCore::Document::nameCollectionInfo):
+        * dom/Document.h:
+        (WebCore::Document::collectionInfo):
+        * editing/markup.cpp:
+        (WebCore::shouldAddNamespaceAttr):
+        (WebCore::appendNamespace):
+        (WebCore::appendStartMarkup):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::namedItems):
+        (WebCore::HTMLCollection::nextNamedItem):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::formCollectionInfo):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::collectionInfo):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::servePendingRequests):
+        (WebCore::Loader::nonCacheRequestInFlight):
+        (WebCore::Loader::nonCacheRequestComplete):
+        (WebCore::Loader::cancelRequests):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::getAnimatedStyle):
+        (WebCore::CompositeAnimation::setAnimating):
+        (WebCore::CompositeAnimation::timeToNextService):
+        (WebCore::CompositeAnimation::getAnimationForProperty):
+        (WebCore::CompositeAnimation::suspendAnimations):
+        (WebCore::CompositeAnimation::resumeAnimations):
+        (WebCore::CompositeAnimation::isAnimatingProperty):
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::numberOfActiveAnimations):
+        Added checkConsistency checks before lookups in HashMaps with AtomicStringImpl* keys.
+
+        * dom/ContainerNodeAlgorithms.h: (WebCore::removeAllChildrenInContainer): Be sure to notify
+        about removed child nodes that can be deleted immediately.
+
+        * html/CollectionCache.cpp:
+        (WebCore::CollectionCache::checkConsistency):
+        * html/CollectionCache.h:
+        Added a checkConsistency() method that checks both HashMaps in the cache.
+
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::~TreeShared): Assert that m_refCount is null. Since Nodes can be
+        destroyed with operator delete (as done in ContainerNodeAlgorithms), this is important to check.
+        (WebCore::TreeShared::deref): Assert that m_refCount isn't already negative.
+
+2010-01-26  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29564
+
+        [Qt] Fixes an issue where the height of <button>- and
+        <input type="button">- elements are fixed to the height of the
+        button label font plus padding. That is, the CSS height property
+        is being ignored.
+
+        Instead, we should honor the user-specified height, if appropriate
+        for the platform and context. Notice, the Mac ports do not honor the
+        height for <input type="button"> elements unless a border and/or
+        background is also specified.
+
+        Test: fast/css/button-height.html
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+
+2010-01-26  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enable the Audits panel via a shortcut (Cmd/Ctrl+Alt+A)
+        https://bugs.webkit.org/show_bug.cgi?id=34158
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2010-01-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsNumber support except type=datetime-local.
+        https://bugs.webkit.org/show_bug.cgi?id=32696
+
+        Tests: fast/forms/input-valueasnumber-date.html
+               fast/forms/input-valueasnumber-datetime.html
+               fast/forms/input-valueasnumber-month.html
+               fast/forms/input-valueasnumber-number.html
+               fast/forms/input-valueasnumber-range.html
+               fast/forms/input-valueasnumber-time.html
+               fast/forms/input-valueasnumber-unsupported.html
+               fast/forms/input-valueasnumber-week.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsNumber):
+          According to the specification, we should return NaN for invalid values.
+        (WebCore::HTMLInputElement::setValueAsNumber):
+          According to the specification, throws NOT_SUPPORTED_ERR for Infinitiy or NaN,
+          and throws INVALID_STATE_ERR for unsupported types.
+        (WebCore::HTMLInputElement::formStringToDouble):
+          According to the step 14 of Real Number in the specification, we
+          should round -0 to 0.
+        * html/HTMLInputElement.h: Declare valueAsNumber() and setValueAsNumber().
+        * html/HTMLInputElement.idl: Add valueAsNumber.
+
+2010-01-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make sure there is a lock on serialize in SerializedScriptValueData, since type errors can be created when
+        exceptions are thrown.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValueData::serialize):
+
+2010-01-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add Date type support for Objective-C binding.
+        https://bugs.webkit.org/show_bug.cgi?id=32810
+
+        The Date type in IDLs is mapped to NSTimeInterval in Objective-C.
+
+        * bindings/objc/DOMInternal.h: Add kit() and core() for NSTimeInterval.
+        * bindings/scripts/CodeGenerator.pm: Make Date a primitive type.
+        * bindings/scripts/CodeGeneratorJS.pm: Move some code for the CodeGeenrator.pm change.
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * bindings/scripts/CodeGeneratorV8.pm: Move some code for the CodeGeenrator.pm change.
+        * html/HTMLInputElement.idl: Remove Objective-C exclusion for valueAsDate.
+
+2010-01-26  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempt to fix Tiger build.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write): Use UNUSED_PARAM macros to prevent compiler warning on targets without accelerated compositing.
+
+2010-01-26  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Incorrect boolean expression in isMailBlockquote() (WebCore/htmlediting.cpp)
+        https://bugs.webkit.org/show_bug.cgi?id=34156
+
+        No new tests (minor code change).
+
+        * editing/htmlediting.cpp:
+        (WebCore::isMailBlockquote):
+
+2010-01-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Levin.
+
+        Handle broken images more correctly in the open-source image decoders.
+        https://bugs.webkit.org/show_bug.cgi?id=33747
+
+        No tests since Safari doesn't use these decoders and there's already a
+        broken-image test in the tree.
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::createFrameAtIndex): No need to check isSizeAvailable() since size() is now always safe.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::size): Don't assert that the bitmap is valid; we don't need a complete successful decode to be able to give info about the size.
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::setSize): Don't set the frame to complete on failure, since it's not complete, but empty, and callers can better handle empty frames.
+        * platform/image-decoders/skia/ImageDecoderSkia.cpp:
+        (WebCore::RGBA32Buffer::setSize): Don't set the frame to complete on failure, since it's not complete, but empty, and callers can better handle empty frames.
+
+2010-01-26  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Synchronize Qt/Gtk build systems with Mac/Win, should fix Qt compilation. Gtk results still pending.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2010-01-26  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Attempt to fix V8 - change SetterMethod function signatures, just like it has been done for JSSVGPODTypeWrapper.
+
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+
+2010-01-26  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Revert Base.xcconfig changes, was not meant to be committed.
+
+        * Configurations/Base.xcconfig:
+
+2010-01-26  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        SVG consumes way too much memory to store animated properties in the DOM
+        https://bugs.webkit.org/show_bug.cgi?id=34188
+
+        Shrink WebCore library size to 75% (measured in debug builds) and reduce SVG memory usage to <25%.
+        Adding Oliver testcase as manual-tests/svg-node-count-vs-scroll.xhtml, which creates an arbitary number of
+        rects (50.000 <rect> elements added to the DOM by default) - memory usage down to 111M from 503M (RPRVT).
+        The SVG DOM side is almost fine, still some optimizations possible, that will be implemented soon - next
+        target is the SVG render tree, there are plenty of possibilities to reduce memory usage there.
+
+        Redesign the way we store animated properties in the individual SVG*Element files. Short story: In order
+        to support SVG DOM through the bindings (e.g. JS) we need to associate SVGAnimatedProperty objects with
+        the SVGElement object that created it - we used to store this pointer directly in the SVGAnimatedProperty.
+        This means, every SVGAnimatedProperty stored in a SVGRectElement, stored a pointer to the SVGRectElement, resulting
+        in excessive memory usage. This is now properly implemented, without wasting tons of memory. Unfortunately this
+        requires touching all SVG*Element files.
+
+        Detailed list of changes:
+        - Remove template bloat by not specializing class templates for each attributeName/tagName combination. Instead
+          SVGAnimatedProperty is a non-specialized template class now, only depending on the AnimatedType (ie. SVGLength for SVGAnimatedLength)
+          -> This heavily reduces the generated code, thus shrinking WebCore size. I hope we can build windows again without SVGAllInOne.cpp
+
+        - Remove "exportStrings" / "exportString" handling from make_names.pl - SVG defined string literals for each QualifiedName,
+          in order to use template specialization based on "const char*" parameters. All that bloat is gone, so there's no need for it anymore.
+
+        - Redesign SVGAnimatedProperty so it does not need any back-pointers to the SVGElement that created it
+
+        - Don't actually store the XML DOM attribute name associated with a SVG DOM property in SVGAnimatedProperty, move the associatedAttributeName()
+          function inside the macro declaration and just return the passed macro parameter DOMAttribute there, storing is inefficient and useless.
+
+        - Remove SynchronizablePropertyController, which was living in SVGElement as member variable, keeping a HashMap<AttributeName, SVGAnimatedProperty>.
+          It was needed before to lookup a SVGAnimatedProperty for a XML DOM attribute, in order to synchronize SVG <-> XML dom properties/attributes.
+          Instead just add a "synchronizeProperty(const QualifiedName&)" method to all SVG*Element classes. As each SVG*Element class knows about its
+          animated properties it can just ask them to synchronize themselves - no need for any dynamic lookups anymore.
+
+        - Remove SynchronizableTypeWrapper which added more complexity for the sake of SVG <-> XML DOM synchronization, all replaced by synchronizeProperty.
+
+        - Pass around any POD objects as const references, instead of copying them for no reason.
+
+        - Clean up SVGAnimatedProperty, splitting up into SVGAnimatedProperty/PropertySynchronizer/PropertyTraits.
+
+        - Remove baseValue/setBaseValue code from SVGDocumentExtensions, not needed anymore.
+
+        ... and tons of changes to all SVG*Element classes, adapting to the new way of handling animated properties.
+
+        * GNUmakefile.am: Remove Synchronizable* from build, add new SVGAnimatedPropertySynchronizer/Traits files
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSSVGPODTypeWrapper.h: Change synchronization callback signatures, as we pass around const-references now.
+        * dom/Element.cpp: Let updateAnimatedSVGAttribute take a QualifiedName instead of pure Strings.
+        (WebCore::Element::getAttribute):
+        (WebCore::Element::hasAttributes):
+        * dom/Element.h:
+        (WebCore::Element::updateAnimatedSVGAttribute):
+        (WebCore::Element::attributes):
+        * dom/make_names.pl: Remove SVG specific "exportString" / "exportStrings" functionality, see above.
+        * html/HTMLAttributeNames.in: Remove "exportString" tag from "className" attribute.
+        * manual-tests/svg-node-count-vs-scroll.xhtml: Added. Can be used to verify memory consumption with a lot of DOM objects.
+        * mathml/mathattrs.in: MathML doesn't need "exportStrings" - remove it.
+        * mathml/mathtags.in: Ditto.
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        (WebCore::SVGAElement::synchronizeProperty):
+        * svg/SVGAElement.h:
+        * svg/SVGAllInOne.cpp: Remove SynchronizablePropertyController.cpp
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::SVGAltGlyphElement):
+        (WebCore::SVGAltGlyphElement::synchronizeProperty):
+        * svg/SVGAltGlyphElement.h:
+        * svg/SVGAnimateTransformElement.cpp:
+        (WebCore::SVGAnimateTransformElement::applyResultsToTarget):
+        * svg/SVGAnimatedProperty.h: Rewritten, see above for details.
+        (WebCore::SVGAnimatedPropertyTearOff::create):
+        (WebCore::SVGAnimatedPropertyTearOff::setBaseVal):
+        (WebCore::SVGAnimatedPropertyTearOff::setAnimVal):
+        (WebCore::SVGAnimatedPropertyTearOff::baseVal):
+        (WebCore::SVGAnimatedPropertyTearOff::animVal):
+        (WebCore::SVGAnimatedPropertyTearOff::associatedAttributeName):
+        (WebCore::SVGAnimatedPropertyTearOff::SVGAnimatedPropertyTearOff):
+        (WebCore::SVGAnimatedPropertyTearOff::~SVGAnimatedPropertyTearOff):
+        (WebCore::SVGAnimatedProperty::~SVGAnimatedProperty):
+        (WebCore::SVGAnimatedProperty::SVGAnimatedProperty):
+        (WebCore::SVGAnimatedProperty::value):
+        (WebCore::SVGAnimatedProperty::baseValue):
+        (WebCore::SVGAnimatedProperty::setValue):
+        (WebCore::SVGAnimatedProperty::setBaseValue):
+        (WebCore::SVGAnimatedProperty::shouldSynchronize):
+        (WebCore::SVGAnimatedProperty::setShouldSynchronize):
+        * svg/SVGAnimatedPropertySynchronizer.h: Added.
+        (WebCore::):
+        * svg/SVGAnimatedPropertyTraits.h: Added.
+        (WebCore::):
+        * svg/SVGAnimatedTemplate.h: Move SVGAnimatedPropertyTraits into its own file.
+        (WebCore::SVGAnimatedTemplate::forgetWrapper):
+        (WebCore::lookupOrCreateWrapper):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::SVGAnimationElement):
+        (WebCore::SVGAnimationElement::synchronizeProperty):
+        * svg/SVGAnimationElement.h:
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::SVGCircleElement):
+        (WebCore::SVGCircleElement::synchronizeProperty):
+        * svg/SVGCircleElement.h:
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::SVGClipPathElement):
+        (WebCore::SVGClipPathElement::synchronizeProperty):
+        * svg/SVGClipPathElement.h:
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        (WebCore::SVGComponentTransferFunctionElement::SVGComponentTransferFunctionElement):
+        (WebCore::SVGComponentTransferFunctionElement::parseMappedAttribute):
+        (WebCore::SVGComponentTransferFunctionElement::synchronizeProperty):
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        (WebCore::SVGCursorElement::synchronizeProperty):
+        * svg/SVGCursorElement.h:
+        * svg/SVGDefsElement.cpp:
+        (WebCore::SVGDefsElement::SVGDefsElement):
+        (WebCore::SVGDefsElement::synchronizeProperty):
+        * svg/SVGDefsElement.h:
+        * svg/SVGDocumentExtensions.h:
+        * svg/SVGElement.cpp: Adapt to synchronization changes: use synchronizeProperty() call, instead of SynchronizablePropertyController.
+        (WebCore::SVGElement::updateAnimatedSVGAttribute):
+        * svg/SVGElement.h: Don't store SynchronizablePropertyController anymore, it's gone.
+        (WebCore::SVGElement::synchronizeProperty):
+        (WebCore::SVGElement::setSynchronizedSVGAttributes):
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::SVGEllipseElement):
+        (WebCore::SVGEllipseElement::synchronizeProperty):
+        * svg/SVGEllipseElement.h:
+        * svg/SVGExternalResourcesRequired.cpp:
+        * svg/SVGExternalResourcesRequired.h:
+        * svg/SVGFEBlendElement.cpp:
+        (WebCore::SVGFEBlendElement::SVGFEBlendElement):
+        (WebCore::SVGFEBlendElement::synchronizeProperty):
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::SVGFEColorMatrixElement):
+        (WebCore::SVGFEColorMatrixElement::synchronizeProperty):
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEComponentTransferElement.cpp:
+        (WebCore::SVGFEComponentTransferElement::SVGFEComponentTransferElement):
+        (WebCore::SVGFEComponentTransferElement::synchronizeProperty):
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFECompositeElement.cpp:
+        (WebCore::SVGFECompositeElement::SVGFECompositeElement):
+        (WebCore::SVGFECompositeElement::parseMappedAttribute):
+        (WebCore::SVGFECompositeElement::synchronizeProperty):
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::SVGFEDiffuseLightingElement):
+        (WebCore::SVGFEDiffuseLightingElement::synchronizeProperty):
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDisplacementMapElement.cpp:
+        (WebCore::SVGFEDisplacementMapElement::SVGFEDisplacementMapElement):
+        (WebCore::SVGFEDisplacementMapElement::synchronizeProperty):
+        * svg/SVGFEDisplacementMapElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::SVGFEGaussianBlurElement):
+        (WebCore::SVGFEGaussianBlurElement::synchronizeProperty):
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        (WebCore::SVGFEImageElement::synchronizeProperty):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFELightElement.cpp:
+        (WebCore::SVGFELightElement::SVGFELightElement):
+        (WebCore::SVGFELightElement::synchronizeProperty):
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEMergeNodeElement.cpp:
+        (WebCore::SVGFEMergeNodeElement::SVGFEMergeNodeElement):
+        (WebCore::SVGFEMergeNodeElement::synchronizeProperty):
+        * svg/SVGFEMergeNodeElement.h:
+        * svg/SVGFEMorphologyElement.cpp:
+        (WebCore::SVGFEMorphologyElement::SVGFEMorphologyElement):
+        (WebCore::SVGFEMorphologyElement::synchronizeProperty):
+        * svg/SVGFEMorphologyElement.h:
+        * svg/SVGFEOffsetElement.cpp:
+        (WebCore::SVGFEOffsetElement::SVGFEOffsetElement):
+        (WebCore::SVGFEOffsetElement::synchronizeProperty):
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::SVGFESpecularLightingElement):
+        (WebCore::SVGFESpecularLightingElement::synchronizeProperty):
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFETileElement.cpp:
+        (WebCore::SVGFETileElement::SVGFETileElement):
+        (WebCore::SVGFETileElement::synchronizeProperty):
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETurbulenceElement.cpp:
+        (WebCore::SVGFETurbulenceElement::SVGFETurbulenceElement):
+        (WebCore::SVGFETurbulenceElement::synchronizeProperty):
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        (WebCore::SVGFilterElement::synchronizeProperty):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::SVGFilterPrimitiveStandardAttributes):
+        (WebCore::SVGFilterPrimitiveStandardAttributes::synchronizeProperty):
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        * svg/SVGFitToViewBox.cpp:
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGFontElement.cpp:
+        (WebCore::SVGFontElement::SVGFontElement):
+        (WebCore::SVGFontElement::synchronizeProperty):
+        * svg/SVGFontElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        (WebCore::SVGForeignObjectElement::synchronizeProperty):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGElement.cpp:
+        (WebCore::SVGGElement::SVGGElement):
+        (WebCore::SVGGElement::synchronizeProperty):
+        * svg/SVGGElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        (WebCore::SVGGradientElement::synchronizeProperty):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        (WebCore::SVGImageElement::synchronizeProperty):
+        * svg/SVGImageElement.h:
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::SVGLineElement):
+        (WebCore::SVGLineElement::synchronizeProperty):
+        * svg/SVGLineElement.h:
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::SVGLinearGradientElement):
+        (WebCore::SVGLinearGradientElement::synchronizeProperty):
+        * svg/SVGLinearGradientElement.h:
+        * svg/SVGList.h: Adapt to const-reference changes.
+        (WebCore::SVGPODListItem::setValue):
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        (WebCore::SVGMPathElement::synchronizeProperty):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        (WebCore::SVGMarkerElement::synchronizeProperty):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        (WebCore::SVGMaskElement::synchronizeProperty):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::SVGPathElement):
+        (WebCore::SVGPathElement::synchronizeProperty):
+        * svg/SVGPathElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        (WebCore::SVGPatternElement::synchronizeProperty):
+        * svg/SVGPatternElement.h:
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::SVGPolyElement):
+        (WebCore::SVGPolyElement::svgAttributeChanged):
+        (WebCore::SVGPolyElement::synchronizeProperty):
+        * svg/SVGPolyElement.h:
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::SVGRadialGradientElement):
+        (WebCore::SVGRadialGradientElement::synchronizeProperty):
+        * svg/SVGRadialGradientElement.h:
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::SVGRectElement):
+        (WebCore::SVGRectElement::synchronizeProperty):
+        * svg/SVGRectElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        (WebCore::SVGSVGElement::synchronizeProperty):
+        * svg/SVGSVGElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        (WebCore::SVGScriptElement::synchronizeProperty):
+        * svg/SVGScriptElement.h:
+        * svg/SVGStopElement.cpp:
+        (WebCore::SVGStopElement::SVGStopElement):
+        (WebCore::SVGStopElement::synchronizeProperty):
+        * svg/SVGStopElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::SVGStyledElement):
+        (WebCore::SVGStyledElement::parseMappedAttribute):
+        (WebCore::SVGStyledElement::synchronizeProperty):
+        * svg/SVGStyledElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::SVGStyledTransformableElement):
+        (WebCore::SVGStyledTransformableElement::synchronizeProperty):
+        * svg/SVGStyledTransformableElement.h:
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::SVGSwitchElement):
+        (WebCore::SVGSwitchElement::synchronizeProperty):
+        * svg/SVGSwitchElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        (WebCore::SVGSymbolElement::synchronizeProperty):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::SVGTRefElement):
+        (WebCore::SVGTRefElement::synchronizeProperty):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::SVGTextContentElement):
+        (WebCore::SVGTextContentElement::synchronizeProperty):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::SVGTextElement):
+        (WebCore::SVGTextElement::synchronizeProperty):
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::SVGTextPathElement):
+        (WebCore::SVGTextPathElement::synchronizeProperty):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGTextPositioningElement.cpp:
+        (WebCore::SVGTextPositioningElement::SVGTextPositioningElement):
+        (WebCore::SVGTextPositioningElement::synchronizeProperty):
+        * svg/SVGTextPositioningElement.h:
+        * svg/SVGURIReference.cpp:
+        * svg/SVGURIReference.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        (WebCore::SVGUseElement::synchronizeProperty):
+        * svg/SVGUseElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        (WebCore::SVGViewElement::synchronizeProperty):
+        * svg/SVGViewElement.h:
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        * svg/SVGViewSpec.h:
+        (WebCore::SVGViewSpec::contextElement):
+        * svg/SynchronizablePropertyController.cpp: Removed.
+        * svg/SynchronizablePropertyController.h: Removed.
+        * svg/SynchronizableTypeWrapper.h: Removed.
+        * svg/svgattrs.in: Remove "exportStrings" tag.
+        * svg/svgtags.in: Ditto.
+        * svg/xlinkattrs.in:
+
+2010-01-26  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7169464> REGRESSION (r47444): PLT is 1% slower due to implementation of :valid and :invalid CSS selectors
+        https://bugs.webkit.org/show_bug.cgi?id=34029
+
+        If we never hit the valid or invalid selectors for a particular document, 
+        then we'll skip the validity checks when deciding about style sharing.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        
+        * dom/Document.cpp: (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Document::considerValidity):
+        (WebCore::Document::setConsiderValidity):
+
+2010-01-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Revert 53797 as it seems to be causing crashes.
+        https://bugs.webkit.org/show_bug.cgi?id=34153
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::useSlowRepaints):
+        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        * platform/ScrollView.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::destroy):
+
+2010-01-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Steve Falkenburg.
+
+        DumpRenderTree silently crashes at the end of the run because geolocationControllerClient pointer is 0.
+        https://bugs.webkit.org/show_bug.cgi?id=34191
+
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::~GeolocationController): Add check for m_client being 0.
+        (WebCore::GeolocationController::addObserver): Ditto.
+        (WebCore::GeolocationController::removeObserver): Ditto.
+        (WebCore::GeolocationController::lastPosition): Ditto.
+
+2010-01-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Enhance externalRepresentation() to make it more useful for layer debugging
+        https://bugs.webkit.org/show_bug.cgi?id=34143
+
+        Enhance externalRepresentation() to output additional information about layers when certain flags are passed.
+        The new flags allow you to show all layers (not just those that would paint), to the structure of the z-order
+        and normal flow lists, and to show which layers are composited.
+
+        * WebCore.base.exp: The signature of externalRepresentation() changed.
+
+        * platform/text/TextStream.h: Add operator<<(void*)
+        * platform/text/TextStream.cpp: Implement operator<<(void*)
+
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayer.cpp:
+        (showLayerTree): New method outside the WebCore namespace, for ease of calling from gdb.
+
+        * rendering/RenderTreeAsText.h: New behavior flags for externalRepresentation().
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write): Output compositing information if requested. Also clean up some -1/1 magic
+        numbers with an enum.
+        (WebCore::writeLayers): If requested, show layer nesting via the z-order and normal flow lists.
+        (WebCore::externalRepresentation): New arguments
+
+2010-01-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed an off-by-one error.
+
+        * rendering/break_lines.cpp:
+        (WebCore::shouldBreakAfter):
+
+2010-01-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Avoid reloading iframe on re-parenting between documents.
+        https://bugs.webkit.org/show_bug.cgi?id=32848
+
+        Achieved by setting a flag on iframe element when it is a target of document.adoptNode(node) operation.
+        The flag prevents unload/load cycle and is reset once element is attached to a new document.
+        If iframe is adopted but not actually inserted into the tree, it gets unloaded by async timer
+        once JS yields, to avoid having active content in non-attached iframe.
+
+        Test: fast/frames/iframe-reparenting.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::adoptNode): If the adopted node is iframe, set a remainsAliveOnRemovalFromTree on it.
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase):
+        (WebCore::HTMLFrameElementBase::attach): Skip actual loading of the frame if it has remainsAliveOnRemovalFromTree flag. Reset the flag.
+        (WebCore::HTMLFrameElementBase::willRemove): Skip unloading the frame if it has remainsAliveOnRemovalFromTree flag set.
+        (WebCore::HTMLFrameElementBase::setRemainsAliveOnRemovalFromTree): Set the flag, start the async timer to check if the frame was actually attached.
+        (WebCore::HTMLFrameElementBase::checkAttachedTimerFired):
+        * html/HTMLFrameOwnerElement.h:
+        (WebCore::HTMLFrameOwnerElement::willRemove): Move from private to protected, since it is conditionally called in HTMLFrameElementBase::willRemove now.
+
+2010-01-26  Adam Roben  <aroben@apple.com>
+
+        No review, rolling out r53861.
+        http://trac.webkit.org/changeset/53861
+        https://bugs.webkit.org/show_bug.cgi?id=33224
+
+        Caused 2 regression tests to fail.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        (WebCore::Document::registerHistoryItem):
+        (WebCore::Document::unregisterHistoryItem):
+        * dom/Document.h:
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        (WebCore::HistoryItem::setStateObject):
+        (WebCore::HistoryItem::setDocument):
+        (WebCore::HistoryItem::documentDetached):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::document):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateWithinDocument):
+        (WebCore::FrameLoader::loadItem):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateBackForwardListForFragmentScroll):
+        (WebCore::HistoryController::pushState):
+        (WebCore::HistoryController::replaceState):
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        * page/History.cpp:
+        (WebCore::History::stateObjectAdded):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2010-01-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/7576663> Crash caused by anonymous list item
+        https://bugs.webkit.org/show_bug.cgi?id=34183
+
+        Test: fast/lists/anonymous-items.html
+
+        enclosingList() and previousListItem() were DOM-based, but in order to work with anonymous
+        list items, they need to work with rthe render tree.
+
+        * rendering/RenderListItem.cpp:
+        (WebCore::isList): Factored out.
+        (WebCore::enclosingList): Added this variant that takes a RenderObject.
+        (WebCore::previousListItem): Changed to travers the render tree.
+        (WebCore::RenderListItem::calcValue): Use the RenderObject version of enclosingList()
+        (WebCore::RenderListItem::setExplicitValue): Added an assertion.
+        (WebCore::RenderListItem::clearExplicitValue): Ditto.
+
+2010-01-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Crash in WebKit!WebCore::RenderMenuList::itemStyle
+        https://bugs.webkit.org/show_bug.cgi?id=34182
+        <rdar://7087757>
+        
+        Added bounds checks in RenderMenuList to make sure we are
+        not making an out of bounds check in a vector once an option
+        element has been deleted. If we are out of bounds, we fall back to
+        a default value and return early, and in the case of itemStyle, we use a 
+        previous option's style, if it is available.
+
+        * manual-tests/select-delete-item.html: Added.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemText): If out of bounds check, return early.
+        (WebCore::RenderMenuList::itemToolTip): Ditto.
+        (WebCore::RenderMenuList::itemIsEnabled): Ditto.
+        (WebCore::RenderMenuList::itemStyle): If out of bounds check, try using the 0th index
+            option style, then fall back to the select's style if that option doesn't exist.
+        (WebCore::RenderMenuList::itemBackgroundColor): If out of bounds check, return early.
+        (WebCore::RenderMenuList::itemIsSeparator): Ditto.
+        (WebCore::RenderMenuList::itemIsLabel): Ditto.
+        (WebCore::RenderMenuList::itemIsSelected): Ditto.
+
+2010-01-25  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Some methods in JSC JNI bridge need more error checking of results from JNI.
+        https://bugs.webkit.org/show_bug.cgi?id=34149
+
+        In JNIUtility.h, callJNIMethodV<jobject> might return null (from CallObjectMethodV, via
+        JNICaller<jobject>::callV) if an exception is thrown.  All clients of callJNIMethodV<jobject>
+        that are calling methods on the returned object should null check first.
+
+        * bridge/jni/JNIBridge.cpp:
+        (JavaField::JavaField):
+        (JavaMethod::JavaMethod):
+        * bridge/jni/JNIUtility.h:
+        (JSC::Bindings::):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::stringValue):
+
+2010-01-26  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Windows build references non-existent include paths
+        https://bugs.webkit.org/show_bug.cgi?id=34175
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2010-01-26  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Chains of history items representing same-document navigation need to
+        always remember that association
+
+        https://bugs.webkit.org/show_bug.cgi?id=33224
+
+        Replace HistoryItem's Document pointer with a DocumentSequenceNumber.
+        During session history traversal, if the current HistoryItem and the
+        target HistoryItem have the same DocumentSequenceNumber, then it means
+        that the current Document should remain.
+
+        NOTE: To support Chromium's serialization of HistoryItems, I generate
+        DocumentSequenceNumbers that are unique across application launches.
+        DocumentSequenceNumbers are generated using a counter initialized with
+        the time of day.
+
+        Test: fast/loader/stateobjects/document-destroyed-navigate-back.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/HistoryItem.cpp:
+        (WebCore::generateDocumentSequenceNumber):
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        (WebCore::HistoryItem::setStateObject):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::setDocumentSequenceNumber):
+        (WebCore::HistoryItem::documentSequenceNumber):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateWithinDocument):
+        (WebCore::FrameLoader::loadItem):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateBackForwardListForFragmentScroll):
+        (WebCore::HistoryController::pushState):
+        (WebCore::HistoryController::replaceState):
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        * page/History.cpp:
+        (WebCore::History::stateObjectAdded):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2010-01-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add ability for image maps to be focused via tabbing
+        https://bugs.webkit.org/show_bug.cgi?id=17513
+
+        Test: fast/events/tab-imagemap.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::focusedImageMapUIElement):
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        * accessibility/AXObjectCache.h:
+        * accessibility/AccessibilityImageMapLink.h:
+        (WebCore::AccessibilityImageMapLink::areaElement):
+        (WebCore::AccessibilityImageMapLink::mapElement):
+        (WebCore::AccessibilityImageMapLink::isImageMapLink):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isImageMapLink):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::getPath):
+        (WebCore::HTMLAreaElement::getRect):
+        (WebCore::HTMLAreaElement::imageElement):
+        (WebCore::HTMLAreaElement::isKeyboardFocusable):
+        (WebCore::HTMLAreaElement::isFocusable):
+        (WebCore::HTMLAreaElement::dispatchBlurEvent):
+        (WebCore::HTMLAreaElement::updateFocusAppearance):
+        (WebCore::HTMLAreaElement::supportsFocus):
+        * html/HTMLAreaElement.h:
+        * html/HTMLMapElement.cpp:
+        (WebCore::HTMLMapElement::imageElement):
+        * html/HTMLMapElement.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::drawFocusRingToContext):
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paint):
+        (WebCore::RenderImage::paintFocusRings):
+        (WebCore::RenderImage::imageMap):
+        * rendering/RenderImage.h:
+        * rendering/RenderReplaced.h:
+
+2010-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add support for breakpoints, messages and search into the SourceFrame2.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34165
+
+        * inspector/front-end/SourceFrame2.js:
+        (WebInspector.SourceFrame2):
+        (WebInspector.SourceFrame2.prototype.get executionLine):
+        (WebInspector.SourceFrame2.prototype.set executionLine):
+        (WebInspector.SourceFrame2.prototype.revealLine):
+        (WebInspector.SourceFrame2.prototype.addBreakpoint):
+        (WebInspector.SourceFrame2.prototype.removeBreakpoint):
+        (WebInspector.SourceFrame2.prototype.sizeToFitContentHeight):
+        (WebInspector.SourceFrame2.prototype.setContent):
+        (WebInspector.SourceFrame2.prototype.findSearchMatches):
+        (WebInspector.SourceFrame2.prototype.setSelection):
+        (WebInspector.SourceFrame2.prototype._addMessageToSource):
+        (WebInspector.SourceFrame2.prototype._addExistingBreakpointsToSource):
+        (WebInspector.SourceFrame2.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame2.prototype._removeBreakpointFromSource):
+        (WebInspector.SourceFrame2.prototype._contextMenu.addConditionalBreakpoint):
+        (WebInspector.SourceFrame2.prototype._contextMenu):
+        (WebInspector.SourceFrame2.prototype._toggleBreakpoint):
+        (WebInspector.SourceFrame2.prototype._editBreakpointCondition.committed):
+        (WebInspector.SourceFrame2.prototype._editBreakpointCondition.dismissed):
+        (WebInspector.SourceFrame2.prototype._editBreakpointCondition):
+        (WebInspector.SourceFrame2.prototype._showBreakpointConditionPopup):
+        (WebInspector.SourceFrame2.prototype._createConditionElement):
+        (WebInspector.SourceFrame2.prototype._keyDown):
+        (WebInspector.SourceFrame2.prototype._evalSelectionInCallFrame):
+        (WebInspector.SourceFrame2.prototype._breakpointChanged):
+        (WebInspector.SourceFrame2.prototype.resize):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.decorate):
+        (WebInspector.BreakpointLineNumberDecorator.prototype._paintBreakpoint):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.mouseDown):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.contextMenu):
+        (WebInspector.ExecutionLineDecorator.prototype.decorate):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype.set mimeType):
+        (WebInspector.TextEditor.prototype.set readOnly):
+        (WebInspector.TextEditor.prototype.setDivDecoration):
+        (WebInspector.TextEditor.prototype.reveal):
+        (WebInspector.TextEditor.prototype.packAndRepaintAll):
+        (WebInspector.TextEditor.prototype._updateSize):
+        (WebInspector.TextEditor.prototype.updateCanvasSize):
+        (WebInspector.TextEditor.prototype.repaintAll):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype._repaintOnScroll):
+        (WebInspector.TextEditor.prototype._mouseDown):
+        (WebInspector.TextEditor.prototype._contextMenu):
+        (WebInspector.TextEditor.prototype._caretForMouseEvent):
+        (WebInspector.TextEditor.prototype._columnForOffset):
+        (WebInspector.TextEditor.prototype._handleNavigationKey):
+        (WebInspector.TextEditor.prototype._positionDivDecoration):
+        (WebInspector.TextEditor.prototype._replaceSelectionWith):
+        (WebInspector.TextEditor.prototype.setCoalescingUpdate):
+        (WebInspector.TextEditor.prototype._handleUndo):
+        (WebInspector.TextEditor.prototype._handleRedo):
+        (WebInspector.TextEditor.prototype._changeFont):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.set mimeType):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/textEditor.css:
+
+2010-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add methods for getting resource content from within frontend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34163
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getResourceContent):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetResourceContent):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorFrontendHost.cpp:
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.getResourceContent):
+        * inspector/front-end/InspectorFrontendHostStub.js:
+
+2010-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: added null check into the timeline agent getter.
+
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::retrieve):
+
+2010-01-26  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific classes from bridge/jni/JNIBridge to bridge/jni/jsc/JNIBridgeJSC
+        https://bugs.webkit.org/show_bug.cgi?id=33958
+
+        This allows bridge/jni/JNIBridge to be used with both JSC and V8.
+        A later change will add the V8 equivalent of these JSC-specific classes.
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk: Modified. Added JNIBridgeJSC.cpp
+        * GNUmakefile.am: Modified. Added JNIBridgeJSC.h
+        * WebCore.xcodeproj/project.pbxproj: Modified. Added JNIBridgeJSC.[cpp|h]
+        * bridge/jni/JNIBridge.cpp: Modified. Moved JavaField and JavaArray to JNIBridgeJSC.cpp
+        (appendClassName): Modfied. Guard calls to JSLock
+        (JavaMethod::signature): Modfied. Guard calls to JSLock
+        * bridge/jni/JNIBridge.h: Modified. Moved JavaField and JavaArray to JNIBridgeJSC.h
+        * bridge/jni/jsc/JNIBridgeJSC.cpp: Copied from WebCore/bridge/jni/JNIBridge.cpp.
+        * bridge/jni/jsc/JNIBridgeJSC.h: Copied from WebCore/bridge/jni/JNIBridge.h.
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: Modified. Include JNIBridgeJSC.h
+        * bridge/jni/jsc/JavaClassJSC.h: Modified. Include JNIBridgeJSC.h
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Modified. Include JNIBridgeJSC.h
+
+2010-01-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Unreviewed build fix.
+
+        [Qt] Fix Windows build when sqlite is not available.
+
+        * WebCore.pri:
+        * WebCore.pro:
+
+2010-01-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] JavaScript prompt is currently broken.
+        https://bugs.webkit.org/show_bug.cgi?id=30914
+
+        Remove the manual test case in favor of an automated
+        test case in WebKit/qt/tests/qwebpage.
+
+        * manual-tests/qt/java-script-prompt.html: Removed.
+
+2010-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement HTML and CSS highlighters.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34144
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/JavaScriptTokenizer.js: Removed.
+        * inspector/front-end/JavaScriptTokenizer.re2js: Removed.
+        * inspector/front-end/SourceCSSTokenizer.js: Added.
+        (WebInspector.SourceCSSTokenizer):
+        (WebInspector.SourceCSSTokenizer.prototype._stringToken):
+        (WebInspector.SourceCSSTokenizer.prototype._isPropertyValue):
+        (WebInspector.SourceCSSTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceCSSTokenizer.re2js: Added.
+        * inspector/front-end/SourceHTMLTokenizer.js: Added.
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype._stringToken):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js: Added.
+        * inspector/front-end/SourceJavaScriptTokenizer.js: Added.
+        (WebInspector.SourceJavaScriptTokenizer):
+        (WebInspector.SourceJavaScriptTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceJavaScriptTokenizer.re2js: Added.
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLines):
+        (WebInspector.TextEditorHighlighter.Tokenizer):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.set line):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.set condition):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.get condition):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.hasCondition):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.getLexCondition):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.setLexCondition):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype._charAt):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2010-01-26  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        REGRESSION(r53835): Fix editing/pasteboard/paste-noscript-xhtml.xhtml
+        https://bugs.webkit.org/show_bug.cgi?id=34157
+
+        Pass the FragmentScriptingPermission correctly through to the DOM
+        and disallow scripting elements in parseEndElement(), similar to
+        the libxml tokenizer change in r53835.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::handleElementNamespaces):
+        (WebCore::handleElementAttributes):
+        (WebCore::XMLTokenizer::parseStartElement):
+        (WebCore::XMLTokenizer::parseEndElement):
+
+2010-01-26  Garret Kelly  <gdk@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add missing declaration for the feMorphology SVG element.
+        https://bugs.webkit.org/show_bug.cgi?id=34151
+
+        * bindings/v8/V8DOMWrapper.cpp:
+
+2010-01-26  Andras Becsi  <abecsi@inf.u-szeged.hu>
+
+        Unreviewed build fix.
+
+        [Qt] Build fix after API changes in r53835.
+
+        No new tests needed.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::parseXMLDocumentFragment):
+
+2010-01-22  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make storage events match the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=30546
+
+        This meat of the patch I just posted is very simple.  It's just making events
+        asynchronous, not posting them to the frame that generated them, passing a null
+        for the key when issuing a clear storage event, and making the events
+        non-cancelable/non-bubbleable...all of which are clearly stated in the spec.
+
+        The asynchronous and not posting to the frame that generated them forced me to
+        re-write all the layout tests that dealt with storage events.  There's a lot of
+        code there, but I tried to be fairly careful to ensure that test coverage did
+        not shrink in any area.
+
+        Tests: storage/domstorage/events/basic-body-attribute.html
+               storage/domstorage/events/basic-setattribute.html
+               storage/domstorage/events/basic.html
+               storage/domstorage/events/case-sensitive.html
+               storage/domstorage/events/documentURI.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::enqueueStorageEvent):
+        (WebCore::Document::storageEventTimerFired):
+        * dom/Document.h:
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::StorageEvent):
+        * storage/StorageEvent.idl:
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch):
+
+2010-01-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7573493> Error with line break inside ?&raquo; pair of characters.
+        https://bugs.webkit.org/show_bug.cgi?id=17475
+
+        Test: fast/text/line-break-after-question-mark.html
+
+        Instead of unconditionally allowing lines to break after a question mark, which was intended
+        to mimic Internet Explorer, apply the Unicode line breaking behavior after a question mark,
+        with one exception in the ASCII range to match IE, namely not allowing a line break between
+        a question mark and a vertical line.
+
+        * rendering/break_lines.cpp:
+        (WebCore::shouldBreakAfter): Added a next character parameter. Changed to consult a table
+        for the question mark case in order to keep it fast and not require a text break iterator in
+        the ASCII case.
+        (WebCore::nextBreakablePosition): Pass the next character to shouldBreakAfter.
+
+2010-01-25  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dan Bernstein.
+
+        Mac scrollbar thumbs were drawn with the wrong size.
+        https://bugs.webkit.org/show_bug.cgi?id=34049
+
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::ScrollbarThemeChromiumMac::paint):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+
+2010-01-25  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Cleanup unwanted tags after pasting.
+        https://bugs.webkit.org/show_bug.cgi?id=34148
+        
+        Test: editing/pasteboard/paste-noscript-xhtml.xhtml
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeNS):
+        * dom/Element.h:
+        * dom/XMLTokenizer.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::handleElementNamespaces):
+        (WebCore::handleElementAttributes):
+        (WebCore::XMLTokenizer::startElementNs):
+        (WebCore::XMLTokenizer::endElementNs):
+        (WebCore::parseXMLDocumentFragment):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::createContextualFragment):
+
+2010-01-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        A WebGeolocationControllerClient is leaked for every WebView
+        https://bugs.webkit.org/show_bug.cgi?id=34145
+
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::~GeolocationController):
+        * page/GeolocationControllerClient.h:
+
+2010-01-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed bug in positioning of scroll layer within the
+        parent root layer.
+        https://bugs.webkit.org/show_bug.cgi?id=33847
+        
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::setScrollFrame):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+
+2010-01-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        An image remains accessible via form.property syntax after being removed from document.
+
+        Fix crashing regression tests (tables/mozilla/bugs/bug4527.html et al.)
+
+        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::insertedIntoTree): Remove incorrect
+        assertions added in the previous patch - it's mot true that m_for is always a parent; table
+        parsing can reparent the image element, but m_form still needs to be set.
+
+2010-01-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        An image remains accessible via form.property syntax after being removed from document.
+
+        Tests: fast/forms/removed-image-as-property.html
+               fast/forms/reparented-image-as-property.html
+
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::~HTMLImageElement): This is called during GC - not a good time
+        to make observable changes to DOM.
+        (WebCore::HTMLImageElement::insertedIntoTree): This is the right place to do any work that
+        depends on connectedness to some ancestor. We still allow for m_form to be set via constructor,
+        which happens during parsing.
+        (WebCore::HTMLImageElement::removedFromTree): Ditto.
+
+        * html/HTMLImageElement.h: Added removedFromTree/insertedIntoTree, moved removedFromDocument
+        and insertedIntoDocument to private section, as they shouldn't be called directly.
+
+2010-01-25  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34073
+
+        Fixes misspelled words in comments.
+
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::addChildren):
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper detach]):
+        (AXAttributeStringSetElement):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::completeURL):
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertySlot):
+        * bindings/js/JSSVGPODTypeWrapper.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_SetException):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::invokeMethod):
+        (JObjectWrapper::JObjectWrapper):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::addFontFaceRule):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        (WebCore::CSSStyleSelector::sortMatchedRules):
+        (WebCore::CSSStyleSelector::applyDeclarations):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * dom/Document.cpp:
+        (WebCore::Document::updateLayoutIgnorePendingStylesheets):
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        * dom/Element.cpp:
+        (WebCore::Element::updateFocusAppearance):
+        * dom/Element.h:
+        * dom/MessagePortChannel.h:
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::receivedTarget):
+        * dom/Node.cpp:
+        (WebCore::Node::isFocusable):
+        (WebCore::Node::shadowAncestorNode):
+        * dom/Node.h:
+        * dom/Position.cpp:
+        (WebCore::Position::upstream):
+        * dom/Position.h:
+        * dom/Range.cpp:
+        (WebCore::Range::processContents):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::addCSSColor):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::reconcileTextDecorationProperties):
+        (WebCore::StyleChange::extractTextStyles):
+        (WebCore::prepareEditingStyleToApplyAt):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializeStartEnd):
+        * editing/Editor.cpp:
+        (WebCore::Editor::learnSpelling):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._format):
+        * loader/Cache.cpp:
+        (WebCore::Cache::pruneLiveResources):
+        (WebCore::Cache::pruneDeadResources):
+        * loader/Cache.h:
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::makePurgeable):
+        * loader/CachedResource.h:
+        * loader/CachedResourceHandle.h:
+        * loader/DocumentLoader.h:
+        * loader/FTPDirectoryParser.cpp:
+        (WebCore::parseOneFTPLine):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::didExplicitOpen):
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didCancel):
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::spaceNeeded):
+        * notifications/NotificationPresenter.h:
+        (WebCore::NotificationPresenter::):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationController::updateAnimations):
+        * platform/LinkHash.cpp:
+        (WebCore::cleanPath):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::calculateDrawingMode):
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::offsetForPosition):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::ensureStructuralLayer):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::doSeek):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+        (WebCore::MediaPlayerPrivate::hasAvailableVideoFrame):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::registerExtendedEncodingNames):
+        * platform/text/TextEncodingDetectorICU.cpp:
+        (WebCore::detectTextEncoding):
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::calcEffectiveWidth):
+        (WebCore::AutoTableLayout::layout):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcAbsoluteHorizontalValues):
+        (WebCore::RenderBox::calcAbsoluteVerticalValues):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        (WebCore::RenderBox::calcAbsoluteVerticalReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::stateChanged):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::mapLocalToContainer):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::buildTextChunks):
+        * rendering/TransformState.cpp:
+        (WebCore::TransformState::flattenWithTransform):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::suggestedValue):
+
+2010-01-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Suggested by Darin Adler.
+
+        Fixed a spelling error, tightened up some grammar.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::forgetDOMObject):
+        (WebCore::forgetDOMNode):
+
+2010-01-25  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Instead of adding inspector methods to the inspected global objects
+        use private implementation visible from inspector code only.
+        https://bugs.webkit.org/show_bug.cgi?id=34089
+
+        Test: inspector/inspected-objects-not-overriden.html
+
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+
+2010-01-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: don't show headers/content tabs in scripts view.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34083
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype.set headersVisible):
+        (WebInspector.ResourceView.prototype._selectContentTab):
+        (WebInspector.ResourceView.prototype._innerSelectContentTab):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.showResource):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * inspector/front-end/inspector.css:
+
+2010-01-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Reduce the size of the library when compiling for Maemo5
+        https://bugs.webkit.org/show_bug.cgi?id=34050
+
+        Exclude the Web Inspector's qrc file in the Maemo5 build, just
+        like we do for the Symbian build. Saves about ~900k.
+
+        * WebCore.pro:
+
+2010-01-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] In the StyledPainter determine the style from the Render and Scrollbar theme instead of from the paint device
+        https://bugs.webkit.org/show_bug.cgi?id=34054
+
+        Getting the style from the painter's paint device is a hack that breaks when
+        the paint device's style is different than the style that is used when
+        calculating the metries earlier when there is no painter available.
+
+        This change moves us closer to always using the same style.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::StylePainter::StylePainter):
+        (WebCore::StylePainter::init):
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::paintTextField):
+        (WebCore::RenderThemeQt::paintMenuList):
+        (WebCore::RenderThemeQt::paintMenuListButton):
+        (WebCore::RenderThemeQt::paintSliderTrack):
+        (WebCore::RenderThemeQt::paintMediaMuteButton):
+        (WebCore::RenderThemeQt::paintMediaPlayButton):
+        (WebCore::RenderThemeQt::paintMediaSliderTrack):
+        (WebCore::RenderThemeQt::paintMediaSliderThumb):
+        * platform/qt/RenderThemeQt.h:
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::paint):
+        (WebCore::ScrollbarThemeQt::hitTest):
+        (WebCore::ScrollbarThemeQt::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeQt::scrollbarThickness):
+        (WebCore::ScrollbarThemeQt::thumbLength):
+        (WebCore::ScrollbarThemeQt::trackPosition):
+        (WebCore::ScrollbarThemeQt::trackLength):
+        (WebCore::ScrollbarThemeQt::paintScrollCorner):
+        (WebCore::ScrollbarThemeQt::style):
+        * platform/qt/ScrollbarThemeQt.h:
+
+2010-01-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] In RenderThemeQt determine the QStyle from the page client instead of the page's view
+        https://bugs.webkit.org/show_bug.cgi?id=34053
+
+        * platform/qt/QWebPageClient.h: Add function to return the style.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::qStyle): Determine the style from the page client instead of the page's view.
+
+2010-01-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Christiansen.
+
+        [Qt] Clean up code to determine palette from page client in RenderThemeQt
+        https://bugs.webkit.org/show_bug.cgi?id=34052
+
+        Use the RenderTheme's associated page instead of going through the
+        render tree and the document.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::setPaletteFromPageClientIfExists):
+        (WebCore::RenderThemeQt::initializeCommonQStyleOptions):
+        * platform/qt/RenderThemeQt.h:
+
+2010-01-25  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Phone backup support for QtWebkit for Symbian devices.
+        https://bugs.webkit.org/show_bug.cgi?id=34077
+
+        * WebCore.pro:
+
+2010-01-25  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        Do not render the full frame when there is some elements with fixed positioning
+        https://bugs.webkit.org/show_bug.cgi?id=33150
+
+        Do not render the full frame when there is some elements with fixed positioning
+        https://bugs.webkit.org/show_bug.cgi?id=33150
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::useSlowRepaints):
+        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped):
+        (WebCore::FrameView::registerFixedPositionedObject):
+        (WebCore::FrameView::unregisterFixedPositionedObject):
+        (WebCore::FrameView::scrollContentsFastPath):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::scrollContentsFastPath):
+        * platform/ScrollView.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::destroy):
+
+2010-01-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add support for addMessage/clearMessages to SourceFrame2.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33904
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/SourceFrame2.js:
+        (WebInspector.SourceFrame2):
+        (WebInspector.SourceFrame2.prototype.addMessage):
+        (WebInspector.SourceFrame2.prototype.clearMessages):
+        (WebInspector.SourceFrame2.prototype._incrementMessageRepeatCount):
+        (WebInspector.SourceFrame2.prototype._addExistingMessagesToSource):
+        (WebInspector.SourceFrame2.prototype._addMessageToSource):
+        (WebInspector.SourceFrame2.prototype.resize):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype.setDivDecoration):
+        (WebInspector.TextEditor.prototype._lineHeight):
+        (WebInspector.TextEditor.prototype._highlightChanged):
+        (WebInspector.TextEditor.prototype.packAndRepaintAll):
+        (WebInspector.TextEditor.prototype._updateSize):
+        (WebInspector.TextEditor.prototype._repaintAll):
+        (WebInspector.TextEditor.prototype._paint):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype._mouseOut):
+        (WebInspector.TextEditor.prototype._updateDivDecorations):
+        (WebInspector.TextEditor.prototype._positionDivDecoration):
+        (WebInspector.TextEditor.prototype._paintSelection):
+        (WebInspector.TextEditor.prototype._replaceSelectionWith):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter.prototype.updateHighlight):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/textEditor.css: Added.
+
+2010-01-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Replace split pane with tabbed pane in resource
+        contents view.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32453
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype.attach):
+        (WebInspector.ResourceView.prototype.show):
+        (WebInspector.ResourceView.prototype._selectTab):
+        (WebInspector.ResourceView.prototype._selectHeadersTab):
+        (WebInspector.ResourceView.prototype._selectContentTab):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.showResource):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings.prototype._load):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView):
+        * inspector/front-end/inspector.css:
+
+2010-01-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Media element duration changes to zero after playing in reverse
+        https://bugs.webkit.org/show_bug.cgi?id=34041
+
+        Test: media/video-reverse-play-duration.html
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::didEnd): QTKit's ended notification fires at time zero when 
+        playing in reverse, so don't reset duration in that case.
+
+2010-01-24  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Content with heavily nested residual style is so slow, it seems like a hang
+        https://bugs.webkit.org/show_bug.cgi?id=34059
+        <rdar://problem/7292906>
+        
+        Test cast: fast/parser/residual-style-hang.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks):
+        Limit the number of iterations of the main loop to 5.
+        
+        The reason this limit is necessary is that otherwise, N misnested open tags followed
+        by N misnested close tags will cause O(N^2) of work due to cloning and attaching subtrees;
+        at a fixed limit, the cost is at worst O(N).
+        
+        The code that was in the loop originally ran exactly once - the loop was added in
+        r21472 to fix <https://bugs.webkit.org/show_bug.cgi?id=13603>. I have verified that
+        with the iteration limit, the bug is still fixed, both with the original test case
+        and with the layout tests tht were added.
+
+2010-01-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=week.
+        https://bugs.webkit.org/show_bug.cgi?id=33986
+
+        Introduce ISODateTime::setMillisecondsSinceEpochForWeek() and add
+        Week type support to ISODateTime::toString().
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsDate): Avoid default:.
+        (WebCore::HTMLInputElement::setValueAsDate):
+          Add WEEK type handling and avoid default:.
+        * html/ISODateTime.cpp:
+        (WebCore::offsetTo1stWeekStart):
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForWeek):
+        (WebCore::ISODateTime::millisecondsSinceEpoch):
+        (WebCore::ISODateTime::toString):
+          Add Week type support and avoid default:.
+        * html/ISODateTime.h:
+
+2010-01-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Object Serialization assumes deserialization will always occur in the context of a webpage
+        https://bugs.webkit.org/show_bug.cgi?id=34056
+        rdar://7573833
+
+        Added ClassInfo to JSDOMGlobalObject and make the window and worker class info
+        inherit from it.  With this in place we're able to determine whether a given
+        global object is a DOMGlobalObject, and then use that information to avoid
+        attempting to deserialize types that require the presence of the DOM.
+
+        No test as all global objects in webkit inherit from JSDOMGlobalObject.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::classInfo):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::):
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+
+2010-01-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34047
+        <rdar://problem/7573699>
+        Media element "endedPlayback" logic doesn't match spec
+
+        Test: media/video-timeupdate-reverse-play.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::ended): The 'ended' attribute should only be true when playback
+        rate is positive.
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Always schedule a 'timeupdate' event when
+        the media engine signals a time discontinuity, scheduleTimeupdateEvent will only queue an event
+        if one hasn't already been posted for the current movie time.
+        (WebCore::HTMLMediaElement::endedPlayback): Update to match the spec logic.
+
+2010-01-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Video that loads inside reflection doesn't get reflected
+        https://bugs.webkit.org/show_bug.cgi?id=34046
+        
+        ensureCloneLayers() made an incorrect assumption that if a clone of the primaryLayer
+        exists already, then the structural layer and content layer can just be returned.
+        However, this doesn't account for the situation where a content layer may have
+        been create after the clone tree was last updated.
+        
+        Fix by always creating the structural and clone layers on demand.
+
+        Test: compositing/reflections/load-video-in-reflection.html
+
+        * platform/graphics/mac/GraphicsLayerCA.h: Added utility method, findOrMakeClone().
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::findOrMakeClone): Utility that efficiently finds
+        or creates a layer in a LayerMap.
+        (WebCore::GraphicsLayerCA::ensureCloneLayers): Always look for or clone the
+        structural and content layers, rather than relying on whether there's a primary
+        layer clone already.
+
+2010-01-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement support for FileList cloning in postMessage
+        https://bugs.webkit.org/show_bug.cgi?id=34048
+
+        Support passing FileList through postMessage APIs.  Basically
+        mechanical task in line with other terminals in the object
+        graph.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedFileList::create):
+        (WebCore::SerializedFileList::length):
+        (WebCore::SerializedFileList::item):
+        (WebCore::SerializedFileList::SerializedFileList):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SharedSerializedData::asFileList):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::TeardownTreeWalker::convertIfTerminal):
+            Rearrange these functions to not use 'default:' handling
+            so that the compiler will actually tell us when we're
+            not handling cases.
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::asFileList):
+
+2010-01-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Inject inspector script directly into the inspected context. All the
+        communication between the script and the frontend is serialized into
+        JSON strings. It allows to get rid of object quarantines in Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32554
+
+        Test: inspector/console-log-before-inspector-open.html
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::databaseForId):
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::JSInjectedScriptHost::selectDatabase):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/js/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::globalState):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/js/ScriptValue.cpp:
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::globalState):
+        * bindings/v8/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/v8/ScriptValue.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::releaseWrapperObjectGroup):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::setInjectedScriptSource):
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::injectedScriptForNodeId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.requestClearMessages):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged.InjectedScriptAccess.get addInspectedNode):
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        (injectedScriptConstructor.):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess):
+        (InjectedScriptAccess.getDefault):
+        (get InjectedScriptAccess):
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.prototype.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype.update.inlineStyleCallback):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2010-01-22  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by David Hyatt.
+
+        Added support for RenderMathMLBlock base object and isRenderMathMLBlock()
+        method on RenderObject. 
+
+        Added support for text elements and updated tag and attribute names
+
+        Also, updated the stylesheet added files to the project
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/mathml.css:
+        * mathml/MathMLInlineContainerElement.cpp:
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/MathMLTextElement.cpp: Added.
+        (WebCore::MathMLTextElement::MathMLTextElement):
+        (WebCore::MathMLTextElement::create):
+        (WebCore::MathMLTextElement::createRenderer):
+        * mathml/MathMLTextElement.h: Added.
+        * mathml/RenderMathMLBlock.cpp: Added.
+        (WebCore::RenderMathMLBlock::RenderMathMLBlock):
+        (WebCore::RenderMathMLBlock::styleDidChange):
+        (WebCore::RenderMathMLBlock::isChildAllowed):
+        (WebCore::RenderMathMLBlock::makeBlockStyle):
+        (WebCore::RenderMathMLBlock::nonOperatorHeight):
+        (WebCore::RenderMathMLBlock::stretchToHeight):
+        * mathml/RenderMathMLBlock.h: Added.
+        (WebCore::RenderMathMLBlock::isRenderMathMLBlock):
+        (WebCore::RenderMathMLBlock::isRenderMathMLOperator):
+        (WebCore::RenderMathMLBlock::isRenderMathMLRow):
+        (WebCore::RenderMathMLBlock::isRenderMathMLMath):
+        (WebCore::RenderMathMLBlock::hasBase):
+        (WebCore::toRenderMathMLBlock):
+        * mathml/mathattrs.in: Added.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isRenderMathMLBlock):
+
+2010-01-22  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Ensures that the 'selected' attribute of an <option> is correct
+        https://bugs.webkit.org/show_bug.cgi?id=32641
+
+        Adds a check in OptionElement::selected() that checks if list items need to be recalculated and does so if needed,
+        so the attribute is up to date more often.  Also gets rid of most of the recalcStyle() side effects.
+
+         Our behavior now matches Firefox 3.5 and IE8 after the </select> is parsed.
+
+         Tests: fast/forms/HTMLOptionElement_selected2.html
+                fast/forms/HTMLOptionElement_selected3.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::setOptionsChangedOnRenderer):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::restoreFormControlState):
+        (WebCore::SelectElement::reset):
+        (WebCore::SelectElement::typeAheadFind):
+        * dom/SelectElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::selected):
+        (WebCore::HTMLOptionElement::insertedIntoTree):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcStyle):
+        (WebCore::HTMLSelectElement::recalcListItemsIfNeeded):
+        * html/HTMLSelectElement.h:
+        * wml/WMLSelectElement.cpp:
+        (WebCore::WMLSelectElement::recalcStyle):
+
+2010-01-22  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Need to handle WebGLUnsignedByteArray as method argument for V8 binding
+        https://bugs.webkit.org/show_bug.cgi?id=33929
+
+        V8 code generator does not have associated tests
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2010-01-22  Elliot Glaysher  <erg@chromium.org>
+
+        Reviewed by David Levin.
+
+        Chromium: theme selection colors to match gtk theme
+        Add functions to RenderThemeChromiumLinux to change the selection color
+        according to the current GTK+ theme.
+
+        Since the change is to the Chromium WebKit API layer, testing is done
+        in Chromium's test shell (see Chromium side of this patch:
+        http://codereview.chromium.org/554004)
+
+        https://bugs.webkit.org/show_bug.cgi?id=33921
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumLinux::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumLinux::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumLinux::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumLinux::setSelectionColors):
+        * rendering/RenderThemeChromiumLinux.h: Adds static members.
+
+2010-01-22  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Remove the Bakefile build system, which is no longer being used.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34022
+
+        * WebCoreSources.bkl: Removed.
+        * webcore-base.bkl: Removed.
+        * webcore-wx.bkl: Removed.
+
+2010-01-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Adler.
+
+        Remove unnecessary copy of zlib.
+        https://bugs.webkit.org/show_bug.cgi?id=34028
+
+        * platform/image-decoders/zlib: Removed.
+        * platform/image-decoders/zlib/adler32.c: Removed.
+        * platform/image-decoders/zlib/compress.c: Removed.
+        * platform/image-decoders/zlib/crc32.c: Removed.
+        * platform/image-decoders/zlib/crc32.h: Removed.
+        * platform/image-decoders/zlib/deflate.c: Removed.
+        * platform/image-decoders/zlib/deflate.h: Removed.
+        * platform/image-decoders/zlib/gzio.c: Removed.
+        * platform/image-decoders/zlib/infback.c: Removed.
+        * platform/image-decoders/zlib/inffast.c: Removed.
+        * platform/image-decoders/zlib/inffast.h: Removed.
+        * platform/image-decoders/zlib/inffixed.h: Removed.
+        * platform/image-decoders/zlib/inflate.c: Removed.
+        * platform/image-decoders/zlib/inflate.h: Removed.
+        * platform/image-decoders/zlib/inftrees.c: Removed.
+        * platform/image-decoders/zlib/inftrees.h: Removed.
+        * platform/image-decoders/zlib/mozzconf.h: Removed.
+        * platform/image-decoders/zlib/trees.c: Removed.
+        * platform/image-decoders/zlib/trees.h: Removed.
+        * platform/image-decoders/zlib/uncompr.c: Removed.
+        * platform/image-decoders/zlib/zconf.h: Removed.
+        * platform/image-decoders/zlib/zlib.h: Removed.
+        * platform/image-decoders/zlib/zutil.c: Removed.
+        * platform/image-decoders/zlib/zutil.h: Removed.
+
+2010-01-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34025
+        Enable client-based Geolocation abstraction for Mac, Windows AppleWebKit targets.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+
+2010-01-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Race condition in video setup can force videos into software mode
+        https://bugs.webkit.org/show_bug.cgi?id=34034
+
+        We used to call setUpVideoRendering() unconditionally from
+        acceleratedRenderingStateChanged(); this could happen before the movie had any
+        data, and thus force the movie into software rendering mode.
+        
+        Fix by returning early from setUpVideoRendering() if isReadyForRendering() returns false,
+        which also allows us to remove some other checks for being ready to render.
+        
+        Timing dependent, hard to make a test for.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToMedia): Optimize to do an early return
+        if passing in the same layer that is already being used.
+        
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering): Return without doing anything
+        if not ready to render.
+        (WebCore::MediaPlayerPrivate::updateStates): No need to call isReadyForRendering()
+        any more, since setUpVideoRendering() does that.
+        (WebCore::MediaPlayerPrivate::setVisible): No need to check the ready state; this
+        is equivalent to the check inside of setUpVideoRendering().
+
+2010-01-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r53110): Find My iPhone message dialog is offset from original position once it gets focus
+        https://bugs.webkit.org/show_bug.cgi?id=33821
+
+        Fix an issue with the geometry of fixed position, composited layers inside other
+        composited layers. If we called convertToLayerCoords() on a fixed layer with an ancestor
+        layer which is not the root, then we assumed that the fixed layer had a positioning root.
+        However, this is not always the case, since the fixed layer may have a compositing ancestor
+        which is not a fixed container.
+        
+        Test: compositing/geometry/fixed-in-composited.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::isFixedPositionedContainer): Utility function to test whether a layer acts
+        as a fixed position container.
+        
+        (WebCore::RenderLayer::convertToLayerCoords): When called on a fixed position layer
+        for an ancestor layer that is not the root, compute the correct offsets by looking for
+        the fixed position container, and computing offsets relative to that. If the ancestorLayer
+        is the fixed position container, fall through to the existing code that is shared
+        with absolutely positioned layers.
+
+2010-01-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        webkitConvertPointFromNodeToPage doesn't take into account most recent transform style
+        https://bugs.webkit.org/show_bug.cgi?id=34023
+
+        Be sure to call updateLayoutIgnorePendingStylesheets() before doing point mapping,
+        to apply any style changes since the last layout.
+
+        Test: fast/dom/Window/webkitConvertPointUpdateLayout.html
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitConvertPointFromNodeToPage): Call updateLayoutIgnorePendingStylesheets().
+        (WebCore::DOMWindow::webkitConvertPointFromPageToNode): Ditto.
+
+2010-01-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Use stale cache data when going back and forward but not using WebCore’s page cache
+        https://bugs.webkit.org/show_bug.cgi?id=33993
+        <rdar://problem/7383392>
+
+        No tests since this is a performance change.
+
+        * loader/CachePolicy.h:
+        (WebCore::): Add CachePolicyAllowStale.
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::checkForReload): Never reload in the case of
+        CachePolicyAllowStale.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::subresourceCachePolicy): Return CachePolicyAllowStale
+        if the main resource is being loaded to allow stale data.
+        (WebCore::FrameLoader::addExtraFieldsToRequest): Use ReturnCacheDataElseLoad
+        on back/forward loads - needed when going back of forward to a page with frames.
+
+2010-01-22  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: JavaScript Error in DOMAgent.js:375 (_attributesUpdated)
+        https://bugs.webkit.org/show_bug.cgi?id=33915
+
+        Errors were caused by the fact that Element::attributes calls Element::setAttribute to
+        synchronized the styleAttr. The fix is to simply check the synchronizing style attribute
+        flag.
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttribute): Checked for case where styleAttr is being synchronized.
+
+2010-01-22  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Update r53711 for GraphicsLayer method rename.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::createLayerForMovie): Rename from change setContentsToVideo.
+
+2010-01-22  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add BlobConstructor to DOMWindow.
+        https://bugs.webkit.org/show_bug.cgi?id=33982
+
+        * page/DOMWindow.idl:
+
+2010-01-22  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Adam Roben.
+        
+        Commit files that were supposed to be part of r53696, but weren't
+        landed.
+
+        * English.lproj/localizedStrings.js:
+        * manual-tests/debugger-caught-uncaught-exceptions.html: Added.
+
+2010-01-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        When scrolling by page, hold back 1/8th of the visible size instead of
+        40 px.
+        https://bugs.webkit.org/show_bug.cgi?id=32595
+
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/Scrollbar.h:
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::OnScrollWinEvents):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+
+2010-01-22  Peter Kasting  <pkasting@google.com>
+
+        Not reviewed, backout.
+
+        Back out r52673, which caused several regressions.
+        https://bugs.webkit.org/show_bug.cgi?id=32533
+
+        * platform/PopupMenuClient.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::selectIndex):
+        (WebCore::PopupListBox::clearSelection):
+        (WebCore::PopupListBox::hidePopup):
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::menuUnmapped):
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::popupDidHide):
+        * platform/qt/QtAbstractWebPopup.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::hide):
+        * platform/wx/PopupMenuWx.cpp:
+        (WebCore::PopupMenu::OnMenuItemSelected):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::popupDidHide):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::popupDidHide):
+        * rendering/RenderTextControlSingleLine.h:
+
+2010-01-22  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        Revert r53693 because it broke scrolling of pages with fixed elements on
+        Mac OS X.
+
+        * page/FrameView.cpp:
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        * platform/ScrollView.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::destroy):
+
+2010-01-22  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34008
+        Assertion failure in KURL::setProtocol when running DOM Fuzzer
+
+        Test: fast/dom/Window/invalid-protocol.html
+
+        * bindings/js/JSLocationCustom.cpp: (WebCore::JSLocation::setProtocol): Raise an exception
+        if KURL::setProtocol fails.
+
+        * html/HTMLAnchorElement.cpp: (WebCore::HTMLAnchorElement::setProtocol): Move argument
+        tweaking logic into KURL. This way, the ':' trick applies to both JSLocation and
+        HTMLAnchorElement, matching IE (but not Firefox). IE behavior is more permissive, and even
+        more logical in my opinion.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::iconURL): Assert that setting protocol
+        succeeded.
+
+        * platform/KURL.cpp: (WebCore::KURL::setProtocol): Remove everything past ':', if present.
+        Return false if the protocol to set is not valid.
+        (WebCore::isValidProtocol): Made this work correctly for empty strings.
+
+        * platform/KURL.h: isValidProtocol() is now static in KURL.cpp, it's only used in setProtocol().
+
+        * platform/KURLGoogle.cpp: 
+        (WebCore::KURL::setProtocol): Always return true. This should hopefully prevent Chromium build
+        breakage, alhough tests will likely fail.
+        (WebCore::isValidProtocol): Removed, as this isn't used at the moment.
+
+        * websockets/WebSocketHandshake.cpp: (WebCore::WebSocketHandshake::httpURLForAuthenticationAndCookies):
+        Assert that setting protocol succeeded.
+
+2010-01-22  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/7373568>
+        https://bugs.webkit.org/show_bug.cgi?id=34007
+        Implement hardware acceleration of video compositing on Windows
+
+        Internally we still have QuickTime render to a bitmap, but frames are then composited
+        with the page using an accelerated renderer.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_newFrameAvailable.
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate): Call tearDownVideoRendering.
+        (WebCore::MediaPlayerPrivate::cancelLoad): Call tearDownVideoRendering.
+        (WebCore::MediaPlayerPrivate::updateStates): Call setUpVideoRendering once the movie 
+            is ready to draw.
+        (WebCore::MediaPlayerPrivate::isReadyForRendering): New, utility function returns true 
+            only when movie is ready to render.
+        (WebCore::MediaPlayerPrivate::setSize): Remember the size as we need it when rendering 
+            in accelerated mode.
+        (WebCore::MediaPlayerPrivate::setVisible): Call setUpVideoRendering when made visible.
+        (WebCore::MediaPlayerPrivate::paint): Do nothing when rendering to a layer. Move frame 
+            rate drawing code to paintCompleted.
+        (WebCore::MediaPlayerPrivate::paintCompleted): New, clear m_newFrameAvailable and, when 
+            built with DRAW_FRAME_RATE, draw framerate.
+        (WebCore::MediaPlayerPrivate::movieNewImageAvailable): Set m_newFrameAvailable, trigger 
+            repaint differently when drawing to a layer.
+        (WebCore::MediaPlayerPrivate::currentRenderingMode): New, return the current rendering mode.
+        (WebCore::MediaPlayerPrivate::preferredRenderingMode): New, return preferred rendering mode
+            (render to a layer whenever possible).
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering): New, tear down current rendering mode 
+            and set up new mode when necessary.
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering): New, noop unless rendering to a layer.
+        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering): New.
+        (WebCore::MediaPlayerPrivate::paintContents): New, callback from compositing layer when it
+            is time to draw the current frame.
+        (WebCore::MediaPlayerPrivate::createLayerForMovie): New, allocate a layer for the movie.
+        (WebCore::MediaPlayerPrivate::destroyLayerForMovie): New, delete movie layer.
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering): New, return true unless the 
+            movie is not ready to render.
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged): New, deal with change in 
+            accelerated rendering state.
+        (WebCore::MediaPlayerPrivate::notifySyncRequired): New, callback from compositing layer 
+            when it wants to schedule a redraw.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        (WebCore::MediaPlayerPrivate::notifyAnimationStarted):
+        (WebCore::MediaPlayerPrivate::showDebugBorders):
+        (WebCore::MediaPlayerPrivate::showRepaintCounter):
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::getCurrentFrameInfo):
+            New, return information about the offscreen render buffer.
+        (QTMovieWin::initializeQuickTime):
+        * platform/graphics/win/QTMovieWin.h:
+
+2010-01-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        The Chromium WebKit API needs to expose storage event related data
+        https://bugs.webkit.org/show_bug.cgi?id=33985
+
+        This change is not visible to layoutTests/web pages.
+
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::setItem): return the old value
+        (WebCore::StorageAreaImpl::removeItem): return the old value
+        (WebCore::StorageAreaImpl::clear): return whether there was anything to clear
+        * storage/StorageAreaImpl.h:
+
+2010-01-22  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        An element that doesn't validate and an invalid element shouldn't share style
+        https://bugs.webkit.org/show_bug.cgi?id=34010
+
+        Test: fast/css/pseudo-invalid-novalidate-001.html
+
+        * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::canShareStyleWithElement): 
+          Separate the check for willValidate from the check for isValidFormControlElement.
+        * html/HTMLFormControlElement.h: The validity method doesn't need to be virtual.
+
+2010-01-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash in fast/dom/Window/window-properties if Geolocation enabled
+        https://bugs.webkit.org/show_bug.cgi?id=34013
+        
+        Add null check to fix Geolocation crash in fast/dom/Window/window-properties.
+        
+        * page/Geolocation.cpp:
+        (WebCore::createGeoposition):
+
+2010-01-22  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Object.getOwnPropertyDescriptor(window) returns descriptors for properties in the prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=33948
+
+        Even though prototype properties are proxied by JSDOMWindow::getOwnPropertySlot(),
+        that proxying should not be performed by JSDOMWindow::getOwnPropertyDescriptor().
+
+        This makes getOwnPropertyDescriptor() consistent with getOwnPropertyNames().
+
+        Test: fast/dom/Window/window-property-descriptors.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+
+2010-01-22  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Save the QWebPageClient instead of the ownerWidget in QtAbstractWebPopup
+        
+        The QWebPageClient is required for the QtFallbackWebPopup. QtFallbackWebPopup will
+        need it to create a QGraphicsProxyWidget (in a future commit) for the 
+        QGraphicsWebView's web popup.
+
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::QtAbstractWebPopup):
+        (WebCore::QtAbstractWebPopup::popupDidHide):
+        (WebCore::QtAbstractWebPopup::valueChanged):
+        (WebCore::QtAbstractWebPopup::itemType):
+        * platform/qt/QtAbstractWebPopup.h:
+        (WebCore::QtAbstractWebPopup::itemText):
+        (WebCore::QtAbstractWebPopup::itemToolTip):
+        (WebCore::QtAbstractWebPopup::itemIsEnabled):
+        (WebCore::QtAbstractWebPopup::itemCount):
+        (WebCore::QtAbstractWebPopup::pageClient):
+        (WebCore::QtAbstractWebPopup::font):
+
+2010-01-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Qt "build" fix.
+
+        * WebCore.pro: Fix warning about missing header file that isn't present anymore.
+
+2010-01-22  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Update copy of the source whenever playbin2's source property
+        changes.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        Connect to the notify::source signal and update the source
+        element pointer from there. This makes sure that we never
+        store a pointer to an old source element.
+
+2010-01-22  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Caught exceptions still pause the debugger.
+        <https://bugs.webkit.org/show_bug.cgi?id=28622>.
+
+        Turn the pauseOnExceptions variable from a bool to an int, because we now have
+        3 states, in an enum: DontPauseOnExceptions, PauseOnAllExceptions, and
+        PauseOnUncaughtExceptions. The status button for pausing on exceptions is now
+        a tri-state button, which cycles from Don't pause (no background) to Pause on All
+        (blue background) to Pause on Uncaught (purple background).
+
+        Also added the ability for a status button to have more than 2 states, and added
+        style rules for a CSS three state button.
+
+        Added a manual test, manual-tests/debugger-caught-uncaught-exceptions.html, that
+        generates caught and uncaught exceptions.
+
+        * English.lproj/localizedStrings.js: Added updated Action / Click to Action text.
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::pauseOnExceptions): Changed from a bool to an int.
+        (WebCore::InspectorBackend::setPauseOnExceptions): Ditto.
+        * inspector/InspectorBackend.h: Ditto.
+        * inspector/InspectorBackend.idl: Ditto.
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::JavaScriptDebugServer): Changed from bool to PauseOnExceptionsState.
+        (WebCore::JavaScriptDebugServer::setPauseOnExceptions): Ditto.
+        (WebCore::JavaScriptDebugServer::exception): Updated logic to see if we are breaking
+            on uncaught exceptions, and check if we have a handler.
+        * inspector/JavaScriptDebugServer.h:
+        (WebCore::JavaScriptDebugServer::): Changed from bool to PauseOnExceptionsState.
+        (WebCore::JavaScriptDebugServer::pauseOnExceptions): Ditto.
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.pauseOnExceptionsState): Changed from returning false to returning 0 (stub function).
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton): Updated to new text/new cycling of variables.
+        (WebInspector.ScriptsPanel.prototype._togglePauseOnExceptions): Updated to new text/new cycling of variables.
+        * inspector/front-end/StatusBarButton.js:
+        (WebInspector.StatusBarButton): Added the option for a different number of states.
+        (WebInspector.StatusBarButton.prototype.set toggled): Added rules to toggle on/off with multiple states.
+        * inspector/front-end/inspector.css: Added rules for toggled-1 and toggled-2.
+        * manual-tests/debugger-caught-uncaught-exceptions.html: Added.
+
+2010-01-22  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [Android] Android platform specific PlatformTouchEvent and PlatformTouchPoint implementations are not upstream.
+        https://bugs.webkit.org/show_bug.cgi?id=33719
+
+        Add the Android specific files and update the Android makefile.
+
+        No new tests as this is all Android-specific code.
+
+        * Android.mk: Add Touch event related files to the makefile.
+        * platform/PlatformTouchEvent.h: Add Android constructor.
+        * platform/PlatformTouchPoint.h: Ditto.
+        * platform/android/PlatformTouchEventAndroid.cpp: Added.
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent): Android implementation.
+        * platform/android/PlatformTouchPointAndroid.cpp: Added.
+        (WebCore::PlatformTouchPoint::PlatformTouchPoint): Android implementation.
+
+2010-01-22  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Do not render the full frame when there is some elements with fixed positioning
+        https://bugs.webkit.org/show_bug.cgi?id=33150
+
+        The RenderObjects with fixed position register to the view
+        to be taken into account while scrolling.
+        The scrolling code update specifically those elements after blitting the pixels.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::registerFixedPositionedObject):
+        (WebCore::FrameView::unregisterFixedPositionedObject):
+        (WebCore::FrameView::scrollContentsFastPath):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::scrollContentsFastPath):
+        * platform/ScrollView.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::destroy):
+
+2010-01-22  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Adding ScriptWrappable into WebCore.
+        This allows to associate custom information when Node
+        gets wrapped into JavaScript wrapper.
+
+        [v8, dom] Add a pointer field to C++ Node class
+        https://bugs.webkit.org/show_bug.cgi?id=32430
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptWrappable.h: Added.
+        (WebCore::ScriptWrappable::ScriptWrappable):
+        * bindings/v8/ScriptWrappable.h: Added.
+        (WebCore::ScriptWrappable::ScriptWrappable):
+        (WebCore::ScriptWrappable::wrapper):
+        (WebCore::ScriptWrappable::setWrapper):
+        (WebCore::ScriptWrappable::clearWrapper):
+        * dom/Node.h:
+
+2010-01-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Add stub implementation of dispatchOnInjectedScript method so that
+        Chromium source can compile against it and the main fix for the bug
+        28622 can be landed without breaking Chromium build.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28622
+
+        * inspector/InspectorBackend.h:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+
+2010-01-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Dmitry Titov.
+
+        ENABLE(DATABASE) guard is missing in ScriptExecutionContext::~ScriptExecutionContext
+        https://bugs.webkit.org/show_bug.cgi?id=33990
+
+        Add missing ENABLE(DATABASE) guard.
+
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+
+2010-01-22  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] GObject DOM bindings
+        https://bugs.webkit.org/show_bug.cgi?id=33590
+
+        * bindings/scripts/generate-bindings.pl:
+
+2010-01-22  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] GObject DOM bindings
+        https://bugs.webkit.org/show_bug.cgi?id=33590
+
+        Rename FEATURE_DEFINES_JAVASCRIPT to FEATURE_DEFINES and remove
+        the hardcoded LANGUAGE_JAVASCRIPT=1, in preparation for its use by
+        the GObject DOM bindings.
+
+        * GNUmakefile.am:
+
+2010-01-22  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7568696> Zoom applied to embedded SVG incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=33988
+
+        Test: svg/custom/text-zoom.xhtml
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement): Initialize m_scale.
+        (WebCore::SVGSVGElement::currentScale): If this is the document element,
+        return the frame’s zoom factor. Otherwise, return m_scale.
+        (WebCore::SVGSVGElement::setCurrentScale): If this is the document element,
+        set the frame’s zoom factor. Otherwise, set m_scale and mark for layout.
+        * svg/SVGSVGElement.h: Added m_scale member.
+
+2010-01-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] Add allowPlugins callback to allow per-site enabling of plugins
+        https://bugs.webkit.org/show_bug.cgi?id=33974
+
+        Add a callback into the FrameLoaderClient to let the embedder enable or
+        disable plugins on a per-site basis.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestObject):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::allowPlugins):
+
+2010-01-21  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25501
+        Remove empty font tags when applying a style to a content editable
+        region.
+
+        Test: editing/execCommand/change-font.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::isEmptyFontTag):
+
+2010-01-21  Joe Mason  <jmason@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Promote pow argument to double to resolve ambiguous overload (compile fix for RVCT 4.0)
+        https://bugs.webkit.org/show_bug.cgi?id=33952
+
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::gamma):
+
+2010-01-21  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        [Android] bindings/v8/ScriptController.cpp needs to include
+        PlatformBridge.h instead of ChromiumBridge.h so that it can
+        be used on both Chromium and Android.
+        https://bugs.webkit.org/show_bug.cgi?id=33673
+
+        Add "static NPObject* pluginScriptableObject(Widget*);" method
+        to PlatformBridge.h
+        Include PlatformBridge.h from ScriptController.cpp.
+
+        No new tests, just platform code.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * platform/android/PlatformBridge.h:
+
+2010-01-21  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        history.back() for same-document history traversals isn't synchronous as the specification states.
+        <rdar://problem/7535011> and https://bugs.webkit.org/show_bug.cgi?id=33538
+
+        In resolving https://bugs.webkit.org/show_bug.cgi?id=25570, all history.back()/forward()/go() navigations
+        were made asynchronous. That doesn't agree with the HTML5 spec and might have been overreaching for fixing
+        that particular bug. In working with the new history state APIs I noticed some things that should've been
+        possible were not possible because of this change.
+
+        The change in loading behavior is well covered via modifications to previous tests.
+
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation): Determine beforehand if the traversal is
+          a same-document navigation. If it is, perform the load directly instead of scheduling it.
+
+2010-01-21  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Don't allow Phonon's invisible video widget to keep the app running.
+        https://bugs.webkit.org/show_bug.cgi?id=33842
+
+        The change made in r38223 should not be limited to Qt < 4.5 only.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+
+2010-01-21  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=datetime.
+        https://bugs.webkit.org/show_bug.cgi?id=33939
+
+        Introduce ISODateTime::setMillisecondsSinceEpochForDateTime() and add
+        DateTime type support to ISODateTime::toString().
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValueAsDate):
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForDate):
+         Set Invalid to m_type.
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForDateTime):
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForMonth):
+         Set Invalid to m_type.
+        (WebCore::ISODateTime::setMillisecondsSinceMidnight):
+         Set Invalid to m_type.
+        (WebCore::ISODateTime::toString):
+         Support DateTime type. This always produces UTC representation.
+        * html/ISODateTime.h:
+
+2010-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed <rdar://problem/7562574> ASSERT in WebCore::removeWrapper() at the
+        end of run-webkit-tests
+        
+        This was an ASSERT-only bug, introduced by isolated worlds, which
+        created the novelty of a wrapper that might outlive its wrapper cache.
+        
+        When a wrapper outlived its wrapper cache, both the wrapper's destructor
+        and the wrapper cache's destructor would claim to have uncached the wrapper,
+        causing an ASSERT to fire.
+        
+        The solution is to distinguish between operations that logically add and
+        remove cache entries, and operations that delete whole caches. We track
+        when a cache entry is logically added, and when it's logically removed,
+        independent of whether the actual cache still exists.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::willCacheWrapper):
+        (WebCore::didUncacheWrapper): New names for these functions to help
+        explain what they track.
+
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld): Don't claim to uncache
+        all the wrappers in the world; we're deleting the cache, not managing its
+        entries.
+
+        (WebCore::cacheDOMObjectWrapper):
+        (WebCore::forgetDOMObject):
+        (WebCore::forgetDOMNode):
+        (WebCore::cacheDOMNodeWrapper):
+        (WebCore::forgetAllDOMNodesForDocument):
+        (WebCore::forgetWorldOfDOMNodesForDocument):
+        (WebCore::takeWrappers):
+        (WebCore::updateDOMNodeDocument): Updated for renames.
+
+2010-01-21  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Sam Weinig.
+
+        SVG JS bindings "context" pointer needs to move onto binding impls
+        https://bugs.webkit.org/show_bug.cgi?id=27243
+
+        Rewrite SVG DOM JSC bindings to use a global DOMObject <-> SVGElement context map, similar to V8's approach.
+        This allows us to remove DOMObjectWithSVGContext and make all SVG JS objects use DOMObjectWithGlobalPointer.
+        We're fitting again in JS_CELL_SIZE, and there's no need to special case SVG anymore.
+
+        Not adding a new test, as we have yet to identify how to test that we're passing around correct global objects.
+        For now this is just a code cleanup which lets me continue making progress in that area of the code.
+
+        * GNUmakefile.am: Add new DOMObjectWithSVGContext.h to build.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/DOMObjectWithSVGContext.h: Removed.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::setDOMException): Add comment, that passing 0 context is intentional.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::createDOMObjectWrapper): Add to JSSVGContextCache, when creating wrappers.
+        (WebCore::getDOMObjectWrapper): Add assertion guarding the JSSVGContextCache is in-sync with the passed context.
+        * bindings/js/JSSVGContextCache.h: Added. Maps DOMObjects to SVGElements - just like V8 approachs to this problem.
+        (WebCore::JSSVGContextCache::wrapperMap):
+        (WebCore::JSSVGContextCache::addWrapper):
+        (WebCore::JSSVGContextCache::forgetWrapper):
+        (WebCore::JSSVGContextCache::propagateSVGDOMChange): 
+        (WebCore::JSSVGContextCache::svgContextForDOMObject):
+        * bindings/js/JSSVGLengthCustom.cpp: Retrieve context from cache, instead of taking it from the JS* class.
+        (WebCore::JSSVGLength::value):
+        (WebCore::JSSVGLength::convertToSpecifiedUnits):
+        * bindings/js/JSSVGMatrixCustom.cpp Ditto.:
+        (WebCore::JSSVGMatrix::multiply):
+        (WebCore::JSSVGMatrix::inverse):
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        * bindings/js/JSSVGPODListCustom.h: Ditto.
+        (WebCore::JSSVGPODListCustom::finishGetter):
+        (WebCore::JSSVGPODListCustom::finishSetter):
+        (WebCore::JSSVGPODListCustom::finishSetterReadOnlyResult):
+        (WebCore::JSSVGPODListCustom::clear):
+        (WebCore::JSSVGPODListCustom::initialize):
+        * bindings/js/JSSVGPODTypeWrapper.h: Ditto.
+        (WebCore::JSSVGDynamicPODTypeWrapper::commitChange):
+        (WebCore::JSSVGStaticPODTypeWrapper::commitChange):
+        (WebCore::JSSVGStaticPODTypeWrapperWithPODTypeParent::commitChange):
+        (WebCore::JSSVGStaticPODTypeWrapperWithParent::commitChange):
+        (WebCore::JSSVGPODTypeWrapperCreatorForList::create):
+        (WebCore::JSSVGPODTypeWrapperCreatorForList::commitChange):
+        * bindings/js/JSSVGPathSegCustom.cpp: Ditto.
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegListCustom.cpp: Ditto.
+        (WebCore::JSSVGPathSegList::clear):
+        (WebCore::JSSVGPathSegList::initialize):
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        (WebCore::JSSVGPathSegList::appendItem):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * svg/SVGAngle.h: Remove unneeded associatedAttributeName() method.
+        * svg/SVGPreserveAspectRatio.h: Ditto.
+        * svg/SVGTransform.h: Ditto.
+
+2010-01-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix, add missing header.
+
+        * dom/ScriptExecutionContext.cpp:
+
+2010-01-21  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        -webkit-mask-box-image draws a box while loading
+        https://bugs.webkit.org/show_bug.cgi?id=33979
+        <rdar://problem/7378662>
+        
+        Don't render masked elements until the mask images are fully loaded.
+
+        Test: http/tests/misc/slow-loading-mask.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintMaskImages): Check that all mask images (both the single mask-box-image,
+        and the possibly multiple mask-image) are fully loaded before allowing the masked content to render.
+        If they are not fully loaded, use a fully transparent transparency layer.
+        
+        * rendering/style/FillLayer.h:
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::imagesAreLoaded): New utility function that returns true if the image
+        in every FillLayer is loaded.
+
+2010-01-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        REGRESSION (r52795): New message created in response to mailto: URL has random character in message body
+        rdar://problem/7565902
+
+        This regression affects the Mac OS X Mail application.
+        I was not able to find a simple way to create a regression test.
+
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::SharedBuffer): Initialize m_size to 0 as in the other constructors.
+
+2010-01-21  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Script tags are copied and pasted, making cross-domain attacks possible.
+        https://bugs.webkit.org/show_bug.cgi?id=33970
+
+        Tests: editing/pasteboard/paste-noscript-svg.html
+               editing/pasteboard/paste-visible-script.html
+
+        We remove the content and the attributes of every script tag before
+        pasting into the destination.
+        
+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeMap): Now we are removing xlink:href
+        if it contains javascript protocol.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::parseToken): We strip all the script tag attributes
+        we are parsing to create a fragment to paste.
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::HTMLTokenizer):
+        (WebCore::HTMLTokenizer::scriptHandler): Removes the script text after it was parsed.
+        * html/HTMLTokenizer.h:
+
+2010-01-21  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        <use> with % lengths does not update on window resize
+        https://bugs.webkit.org/show_bug.cgi?id=14639
+
+        appendChild broken for symbol-use
+        https://bugs.webkit.org/show_bug.cgi?id=24802
+
+        Test: svg/custom/relative-sized-shadow-tree-content-with-symbol.xhtml
+              svg/custom/svg/custom/relative-sized-use-on-symbol.xhtml
+
+        Fix reaction on window size changes for relative sized elements within <symbol> elements.
+        Don't evaluate SVGUseElement width/height attributes in order to propagate them to the shadow tree,
+        instead just propagate the attribute values itself so "100%" remains "100%" instead of being evaluated
+        to an absolute pixel value in the parent <svg> user-space.
+
+        Needs another fix in SVGStyledElement::childrenChanged(), which is a regression from my last <use>
+        patch, that hasn't been detected, as the use-dynamic-append.svg testcase was broken.
+
+        The combination of all the last <use> patches finally fixes the peepo.co.uk website, which was broken by several bugs for years.
+
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::childrenChanged): Need to mark shadow trees needing recalcs, even when parsing.
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::svgAttributeChanged): Don't reclone for width/height attribute changes, just propagate them down the render tree
+        (WebCore::updateContainerSize): Added helper function, updating the width/height attributes in the shadow tree.
+        (WebCore::SVGUseElement::updateContainerSizes):
+        (WebCore::SVGUseElement::buildShadowAndInstanceTree): Update container width/height after shadow tree creation, instead of doing it inbetween.
+        (WebCore::SVGUseElement::buildShadowTree): Don't alter width/height attributes here anymore.
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree): Ditto.
+        (WebCore::SVGUseElement::expandSymbolElementsInShadowTree): Ditto.
+        * svg/SVGUseElement.h:
+
+2010-01-21  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33972
+        Assertion failure in FrameLoader::checkLoadComplete()
+
+        I couldn't make a test for this, after trying rather hard. I'm not too worried, because such
+        a test has to depend on details of current implementation so intimately that it would become
+        ineffective very quickly anyway.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::stopAllLoaders): Stop the check timer, we
+        don't need it after aborting load.
+
+2010-01-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Buildfix for r53646.
+
+        * bindings/js/SerializedScriptValue.cpp: path of JSLock.h fixed.
+
+2010-01-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed buildfix after r53644.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::scroll): missing HAVE(ACCESSIBILITY) guard added.
+
+2010-01-21  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by David Levin.
+
+        Unnecessary call to HistoryItem::targetItem in HistoryController::pushState
+        https://bugs.webkit.org/show_bug.cgi?id=33969
+
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::pushState): Remove unnecessary code.
+
+2010-01-21  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Chromium build fix. Add AccessibilityScrollbar.h and .cpp to WebCore.gypi
+
+        * WebCore.gypi:
+
+2010-01-21  Albert J. Wong  <ajwong@chromium.org>
+
+        [chromium] Unreviewed build fix.
+
+        Fix possible use of initialized variable warning in release mode.
+
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::ZigZag::Deserializer::doDeserialize):
+
+2010-01-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix after r53644.
+
+        * WebCore.pro: accessibility/AccessibilityScrollbar.cpp and accessibility/AccessibilityScrollbar.h added.
+
+2010-01-21  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make sure to do a JSLock before deserialization of script values, since they can heap allocate.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValueData::deserialize):
+
+2010-01-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=33923 REGRESSION 
+        (Safari 4): AXValueChanged no longer sent for text area scrollbars
+        -and corresponding-
+        <rdar://problem/6942686>
+
+        New class AccessibilityScrollbar inherits directly from 
+        AccessibilityObject.
+        * accessibility/AccessibilityScrollbar.cpp: Added.
+        (WebCore::AccessibilityScrollbar::AccessibilityScrollbar):
+        (WebCore::AccessibilityScrollbar::create):
+        (WebCore::AccessibilityScrollbar::valueForRange):
+        * accessibility/AccessibilityScrollbar.h: Added.
+        (WebCore::AccessibilityScrollbar::setScrollbar):
+        (WebCore::AccessibilityScrollbar::roleValue):
+        (WebCore::AccessibilityScrollbar::accessibilityIsIgnored):
+        (WebCore::AccessibilityScrollbar::size):
+        (WebCore::AccessibilityScrollbar::elementRect):
+        (WebCore::AccessibilityScrollbar::parentObject):
+
+        AXObjectCache::getOrCreate() now has a case for ScrollBarRole, 
+        which will create a new AccessibilityScrollbar. I also added a new 
+        version of postNotification() that does not require a renderer. The 
+        old postNotification() calls the new one.
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::postNotification):
+        * accessibility/AXObjectCache.h:
+
+        When AX is enabled, getOrCreate an AccessibilityScrollbar and send 
+        a notification.
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::scroll):
+
+        Fix project files.
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+
+2010-01-21  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Add changes missing from r53595, without which Chromium has no database.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33966
+
+        No new tests - fixes database layout tests in Chromium.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+
+2010-01-21  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Adam Treat.
+
+        Don't call vgGetError()/eglGetError() repeatedly
+        https://bugs.webkit.org/show_bug.cgi?id=33959
+
+        For vgGetError(), I missed the part of the spec where
+        it says that calling that function clears the error
+        and subsequent calls will return VG_NO_ERROR again.
+
+        For eglGetError(), the specification doesn't mention
+        that kind of behavior, and interpretations seem to
+        differ between EGL implementations (even within
+        Khronos: the OpenVG reference implementation doesn't
+        reset the error code - and even mentions the difference
+        to vgGetError() in a comment - whereas the online
+        OpenGL ES API document explicitly specifies clearing
+        the error code).
+
+        It thus makes sense not to call either of the two
+        error functions more than once for checking a single
+        EGL/OpenVG call. This patch adapts assertions to
+        accommodate for this behavior, and also needs to
+        change surface creation methods as they previously
+        relied on multiple calls of eglGetError().
+
+        * platform/graphics/openvg/EGLDisplayOpenVG.cpp:
+        (WebCore::EGLDisplayOpenVG::sharedPlatformSurface):
+        (WebCore::EGLDisplayOpenVG::createPbufferSurface):
+        * platform/graphics/openvg/EGLDisplayOpenVG.h:
+        * platform/graphics/openvg/EGLUtils.h:
+        * platform/graphics/openvg/SurfaceOpenVG.cpp:
+        (WebCore::SurfaceOpenVG::SurfaceOpenVG):
+        * platform/graphics/openvg/SurfaceOpenVG.h:
+        * platform/graphics/openvg/VGUtils.h:
+
+2010-01-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Hit testing on composited plugins is broken
+        https://bugs.webkit.org/show_bug.cgi?id=33927
+        <rdar://problem/7559069>
+
+        RenderWidget::paint()'s strategy of moving widgets at paint time, using tx and ty, was flawed
+        because tx,ty are not always root-relative, especially when painting into compositing layers.
+        This would move widgets to the wrong location, which caused hit testing issues.
+        
+        Widgets are usually positioned by layout. The one time this was not true was scrolling fixed-position
+        elements, so we now reposition widgets after scrolling too.
+        
+        There was a related problem, which was that widgets expect the graphics context to be set up for
+        root-relative painting. To fix this, adjust the CTM and the paintRect when the widget's frameRect
+        is in a different coordinate system to the painting offset.
+        
+        Test: plugins/mouse-events-fixedpos.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollPositionChanged): Update widget positions, to handle widgets in fixed position
+        elements, but only if we're not already inside of layout.
+
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::GraphicsContext::translate): Add a translate() convenience method that takes a FloatSize.
+
+        * platform/graphics/IntSize.h:
+        (WebCore::IntSize::isZero): Add a convenience method for testing for a zero size.
+
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::paint): Adjust a comment.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint): Detect when the widget's frame is in a different coordinate system
+        to painting, and adjust the CTM and paintRect in that case.
+
+2010-01-21  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        [Android] bindings/v8/NPV8Object.cpp does not compile on Android
+        https://bugs.webkit.org/show_bug.cgi?id=33608
+
+        Use the standard WebKit header in bridge/npruntime.h.
+        Include PlatformBridge.h instead of ChroimiumBridge.h.
+        Add popupsAllowed() method to PlatformBridge.h on Android.
+        Add ARRAYSIZE_UNSAFE to PlatformBridge.h on Android.
+
+        No new tests, fixing the build.
+
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_Evaluate):
+        * bindings/v8/NPV8Object.h:
+        * platform/android/PlatformBridge.h:
+
+2010-01-21  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        Add PlatformBridge.h header and a typedef to give ChromiumBridge a new name: PlatformBridge.
+        https://bugs.webkit.org/show_bug.cgi?id=33917
+
+        No new tests needed, this is just to allow other methods to call ChromiumBridge
+        using the new 'PlatformBridge' name.
+
+        * platform/chromium/PlatformBridge.h: Added.
+
+2010-01-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix after r53625.
+
+        Cleanup MediaPlayer and MediaPlayerPrivateInterface to remove dead methods
+        https://bugs.webkit.org/show_bug.cgi?id=30106
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintMediaSliderTrack):
+
+2010-01-21  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        [Android] bindings/v8/V8DOMWrapper.h[cpp] are missing guards for XPATH and XSLT features
+        https://bugs.webkit.org/show_bug.cgi?id=33944
+
+        Inside V8DOMWrapper.h[cpp], the code for XPATH and XSLT features is not guarded
+        by the appropriate #if ENABLE(feature) macros. Add the missing guards.
+        V8DOMWrapper.cpp includes ChromiumBridge.h for no reason. Remove the include.
+
+        No new tests needed, functionality not changed.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8DOMWrapper.h:
+
+2010-01-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Intermittent crash when media element is adopted by another document
+        https://bugs.webkit.org/show_bug.cgi?id=33919
+        rdar://problem/7557527
+        
+        Test: media/adopt-node-crash.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::willMoveToNewOwnerDocument): Unregister for
+        document callbacks.
+        (WebCore::HTMLMediaElement::didMoveToNewOwnerDocument): Register for
+        document callbacks.
+        * html/HTMLMediaElement.h:
+
+2010-01-21  Adam Roben  <aroben@apple.com>
+
+        More Windows build fixing
+
+        * WebCore.vcproj/WebCore.vcproj: Copy bridge/jsc in the post-build
+        event of all configurations, not just Debug.
+
+2010-01-21  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix incorrect dependency to QtXmlPatterns in generated include/QtWebKit/QtWebKit header
+
+        The generated file includes QtXmlPatterns/QtXmlPatterns, which is neither used/required by
+        the public QtWebKit API nor will it be available if Qt is configured with -no-xmlpatterns.
+
+        * WebCore.pro: Trick syncqt to believe that xmlpatterns is not a dependency, so that it's not
+        included in the generated file. It'll still be used and linked to with this trick.
+
+2010-01-21  Steve Block  <steveblock@google.com>
+
+        Unreviewed build fix.
+
+        Copy BridgeJSC.h to generated headers on Windows
+
+        No new tests, build fix only.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2010-01-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Cleanup MediaPlayer and MediaPlayerPrivateInterface to remove dead methods
+        https://bugs.webkit.org/show_bug.cgi?id=30106
+
+        No new tests, only dead code was removed.
+
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::doSeek):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/wince/MediaPlayerPrivateWince.h:
+
+2010-01-21  Iain Campbell <iain.campbell@accenture.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Simplify the qmake code for freezing QtWebKit on Symbian.
+
+        * WebCore.pro:
+
+2010-01-21  Steve Block  <steveblock@google.com>
+
+        Unreviewed speculative build fix for Windows.
+
+        Adds missing include path for JSCBridge.h on Windows, added in http://trac.webkit.org/changeset/53620
+
+        No new tests, build fix only.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2010-01-21  Steve Block  <steveblock@google.com>
+
+        Unreviewed build fix.
+
+        Adds missing include path for JSCBridge.h, added in http://trac.webkit.org/changeset/53620
+
+        No new tests, build fix only.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2010-01-21  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Move bridge interfaces Field, Class, Instance and Array from Bridge to BridgeJSC
+        https://bugs.webkit.org/show_bug.cgi?id=33589
+
+        These interfaces use JSC-specific types, so are moved out of Bridge.h to allow the file to
+        be used with both JSC and V8.
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk: Modified. Removed Bridge.cpp and added BridgeJSC.cpp
+        * GNUmakefile.am: Modified. Removed Bridge.cpp and added BridgeJSC.[cpp|h]
+        * WebCore.pro: Modified. Removed Bridge.cpp and added BridgeJSC.[cpp|h]
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removed Bridge.cpp and added BridgeJSC.[cpp|h]
+        * WebCoreSources.bkl: Modified. Removed Bridge.cpp and added BridgeJSC.cpp
+        * bridge/Bridge.cpp: Removed.
+        * bridge/Bridge.h: Modfied. Moved Field, Class, Instance and Array interfaces to BridgeJSC.h
+        * bridge/jsc: Added.
+        * bridge/jsc/BridgeJSC.cpp: Copied from WebCore/bridge/Bridge.cpp.
+        * bridge/jsc/BridgeJSC.h: Copied from WebCore/bridge/Bridge.h.
+
+2010-01-21  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Fixes style in WebCore/bridge/jni/JNIBridge
+        https://bugs.webkit.org/show_bug.cgi?id=33914
+
+        No new tests, style fixes only.
+
+        * bridge/jni/JNIBridge.cpp:
+        * bridge/jni/JNIBridge.h:
+
+2010-01-13  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] handle media redirections
+        https://bugs.webkit.org/show_bug.cgi?id=33539
+
+        Media redirections support.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::mediaLocationChanged):
+        (WebCore::MediaPlayerPrivate::loadNextLocation):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        (WebCore::MediaPlayerPrivate::pipelineReset):
+
+2010-01-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Implement GraphicsLayer for accelerated layer compositing
+        https://bugs.webkit.org/show_bug.cgi?id=33514
+
+        No new tests: tests in LayoutTests/compositing are now relevant for
+        QtWebkit!
+
+        * WebCore.pro: added accelerated-compositing related files 
+        * platform/graphics/GraphicsLayer.h: define Qt-specific implementation           of GraphicsLayer
+        * platform/graphics/qt/GraphicsLayerQt.cpp: Added.
+        (WebCore::GraphicsLayerQtImpl::): Implementation of GraphicsLayer with
+        a QGraphicsItem
+        (WebCore::GraphicsLayerQtImpl::ContentData::ContentData): save 
+        pixmap/color info for directly composited content
+        (WebCore::GraphicsLayerQtImpl::State::State): save info for syncing
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl): ctor
+        (WebCore::GraphicsLayerQtImpl::~GraphicsLayerQtImpl): dtor
+        (WebCore::GraphicsLayerQtImpl::setBaseTransform): set Qt
+        transformation in the way WebCore wants it
+        (WebCore::GraphicsLayerQtImpl::opaqueArea): calculate opaque area
+        based on info we have
+        (WebCore::GraphicsLayerQtImpl::boundingRect): reimp QGraphicsItem
+        (WebCore::GraphicsLayerQtImpl::paint): reimp QGraphicsItem
+        (WebCore::GraphicsLayerQtImpl::drawContents): draw HTML/Pixmap/Color
+        (WebCore::GraphicsLayerQtImpl::notifyChange): let WebCore know
+        something has changed
+        (WebCore::GraphicsLayerQtImpl::flushChanges): Make the changes appear
+        on screen by setting them to QGraphicsItems
+        (WebCore::GraphicsLayerQtImpl::notifyAnimationStarted): let WebCore
+        know the QAnimation started
+        (WebCore::GraphicsLayerQt::GraphicsLayerQt): ctor
+        (WebCore::GraphicsLayerQt::~GraphicsLayerQt): dtor
+        (WebCore::GraphicsLayer::create): hook for WebCore to know we're
+        implementing compositing
+        (WebCore::GraphicsLayer::compositingCoordinatesOrientation): hook for
+        WebCore to know we use a top-down system
+        (WebCore::GraphicsLayerQt::setNeedsDisplay): update the display
+        (WebCore::GraphicsLayerQt::setNeedsDisplayInRect): udpate part of the
+        display
+        (WebCore::GraphicsLayerQt::setName): reimp
+        (WebCore::GraphicsLayerQt::setParent): reimp
+        (WebCore::GraphicsLayerQt::setChildren): reimp
+        (WebCore::GraphicsLayerQt::addChild): reimp
+        (WebCore::GraphicsLayerQt::addChildAtIndex): reimp
+        (WebCore::GraphicsLayerQt::addChildAbove): reimp
+        (WebCore::GraphicsLayerQt::addChildBelow): reimp
+        (WebCore::GraphicsLayerQt::replaceChild): reimp
+        (WebCore::GraphicsLayerQt::removeFromParent): reimp
+        (WebCore::GraphicsLayerQt::setMaskLayer): reimp
+        (WebCore::GraphicsLayerQt::setPosition): reimp
+        (WebCore::GraphicsLayerQt::setAnchorPoint): reimp
+        (WebCore::GraphicsLayerQt::setSize): reimp
+        (WebCore::GraphicsLayerQt::setTransform): reimp
+        (WebCore::GraphicsLayerQt::setChildrenTransform): reimp
+        (WebCore::GraphicsLayerQt::setPreserves3D): reimp
+        (WebCore::GraphicsLayerQt::setMasksToBounds): reimp
+        (WebCore::GraphicsLayerQt::setDrawsContent): reimp
+        (WebCore::GraphicsLayerQt::setBackgroundColor): reimp
+        (WebCore::GraphicsLayerQt::clearBackgroundColor): reimp
+        (WebCore::GraphicsLayerQt::setContentsOpaque): reimp
+        (WebCore::GraphicsLayerQt::setBackfaceVisibility): reimp
+        (WebCore::GraphicsLayerQt::setOpacity): reimp
+        (WebCore::GraphicsLayerQt::setContentsRect): reimp
+        (WebCore::GraphicsLayerQt::setContentsToImage): reimp
+        (WebCore::GraphicsLayerQt::setContentsBackgroundColor): reimp
+        (WebCore::GraphicsLayerQt::setGeometryOrientation): reimp
+        (WebCore::GraphicsLayerQt::setContentsOrientation): reimp
+        (WebCore::GraphicsLayerQt::distributeOpacity): reimp
+        (WebCore::GraphicsLayerQt::accumulatedOpacity): reimp
+        (WebCore::GraphicsLayerQt::syncCompositingState): reimp
+        (WebCore::GraphicsLayerQt::nativeLayer): reimp (QGraphicsItem*)
+        (WebCore::GraphicsLayerQt::platformLayer): reimp (QGraphicsItem*)
+        (WebCore::solveEpsilon): copy from AnimationBase.cpp
+        (WebCore::solveCubicBezierFunction): copy from AniamtionBase.cpp
+        (WebCore::applyTimingFunction): use WebCore's timing and not Qt's
+        (WebCore::webkitAnimationToQtAnimationValue): safely figure out
+        animation values
+        (WebCore::AnimationQtBase::AnimationQtBase): base class for Qt-based
+        Webcore-initiated animations
+        (WebCore::AnimationQtBase::updateState): notify when an animation
+        starts
+        (WebCore::AnimationQtBase::duration): reimp QAbstractAnimation
+        (WebCore::AnimationQt:::AnimationQtBase):
+        (WebCore::AnimationQt::updateCurrentTime): realize keyframes from
+        progress
+        (WebCore::TransformAnimationQt::TransformAnimationQt): ctor
+        (WebCore::TransformAnimationQt::~TransformAnimationQt): dtor
+        (WebCore::TransformAnimationQt::applyFrame): set the actual QTransform
+        based on WebCore TransformOperations
+        (WebCore::TransformAnimationQt::updateState): change cache mode
+        (WebCore::OpacityAnimationQt::OpacityAnimationQt):
+        (WebCore::OpacityAnimationQt::applyFrame): change item's opacity
+        (WebCore::OpacityAnimationQt::updateState):
+        (WebCore::GraphicsLayerQt::addAnimation): convert WebCore Animation to
+        Qt Animation
+        (WebCore::GraphicsLayerQt::removeAnimationsForProperty):
+        (WebCore::GraphicsLayerQt::removeAnimationsForKeyframes):
+        (WebCore::GraphicsLayerQt::pauseAnimation):
+        (WebCore::GraphicsLayerQt::suspendAnimations):
+        (WebCore::GraphicsLayerQt::resumeAnimations):
+        * platform/graphics/qt/GraphicsLayerQt.h: Added.
+        * platform/qt/QWebPageClient.h: virtual functions for QGraphicsWebView
+        compositing
+        (QWebPageClient::setRootGraphicsLayer): let QGraphicsWebView know that
+        compositing has started/ended
+        (QWebPageClient::markForSync): let QGraphicsWebView know the
+        compositing layers need to sync, either soon or with the next update
+
+2010-01-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Adding QPixmap/QImage support for the Qt hybrid layer
+        Allows accesing QPixmap and QImage based arguments from Qt signals,
+        slots and properties
+        This is done by an intermediate object that can be turned into
+        web-based objects by calling either toHTMLImageElement() or
+        toDataURL()
+        https://bugs.webkit.org/show_bug.cgi?id=32461
+
+        Tests are in WebKit/qt/tests/hybridPixmap
+
+        * WebCore.pro:
+        * bridge/qt/qt_pixmapruntime.cpp: Added.
+        (JSC::Bindings::QtPixmapWidthField::name): "width"
+        (JSC::Bindings::QtPixmapWidthField::valueFromInstance): width of
+        pixmap
+        (JSC::Bindings::QtPixmapWidthField::setValueToInstance): nothing
+        (JSC::Bindings::QtPixmapHeightField::name): "height"
+        (JSC::Bindings::QtPixmapHeightField::valueFromInstance): height of
+        pixmap
+        (JSC::Bindings::QtPixmapHeightField::setValueToInstance): nothing
+        (JSC::Bindings::QtPixmapRuntimeMethod::numParameters): 0
+        (JSC::Bindings::QtPixmapCreateElementMethod::name): toHTMLImageElement
+        (JSC::Bindings::QtPixmapCreateElementMethod::invoke): creates an HTML
+        element from the QPixmap
+        (JSC::Bindings::QtPixmapToDataUrlMethod::name): "toDataURL"
+        (JSC::Bindings::QtPixmapToDataUrlMethod::invoke): encodes the image to
+        a base64 data url
+        (JSC::Bindings::QtPixmapToStringMethod::name): "toString"
+        (JSC::Bindings::QtPixmapToStringMethod::invoke): [Qt Native Pixmap
+        w,h]
+
+        (JSC::Bindings::QtPixmapRuntimeObjectImp::createStructure):
+        runtime-object broilerplate
+        (JSC::Bindings::QtPixmapRuntimeObjectImp::classInfo): ditto
+        (JSC::Bindings::QtPixmapRuntimeObjectImp::QtPixmapRuntimeObjectImp):
+        ditto
+        (JSC::Bindings::): ditto
+        (JSC::Bindings::QtPixmapClass::QtPixmapClass): class for the
+        intermediate pixmap-holder 
+        (JSC::Bindings::QtPixmapInstance::getClass): ditto
+        (JSC::Bindings::QtPixmapInstance::invokeMethod): ditto
+        (JSC::Bindings::QtPixmapClass::methodsNamed): toHTMLImageElement,
+        toDataURL
+        (JSC::Bindings::QtPixmapClass::fieldNamed): width, height
+        (JSC::Bindings::QtPixmapInstance::getPropertyNames):
+                toHTMLImageElement, toDataURL, width, height
+        (JSC::Bindings::QtPixmapInstance::defaultValue): nothing
+        (JSC::Bindings::QtPixmapInstance::valueOf): toString
+        (JSC::Bindings::data): holds a QVariant of type QImage/QPixmap
+        (JSC::Bindings::QtPixmapInstance::width): width of the image/pixmap
+        (JSC::Bindings::QtPixmapInstance::height): height of the image/pixmap
+        (JSC::Bindings::QtPixmapInstance::toPixmap): converts to a QPixmap
+        (JSC::Bindings::QtPixmapInstance::toImage): converts to a QImage
+        (JSC::Bindings::QtPixmapInstance::variantFromObject): makes sure this
+        is the right type of object, and creates a QVariant
+        (JSC::Bindings::QtPixmapInstance::createRuntimeObject): creates a new
+        intermediate pixmap holder from a QVariant
+        (JSC::Bindings::QtPixmapInstance::canHandle): returns true if a
+        QPixmap/QImage is required
+        * bridge/qt/qt_pixmapruntime.h: Added.
+        * bridge/qt/qt_runtime.cpp: hooks for the bridge
+        (JSC::Bindings::convertValueToQVariant): handle QPixmap/QImage if the
+        object is the intermediate pixmap holder or an HTMLImageElement
+        (JSC::Bindings::convertQVariantToValue): creates the intermediate
+        object from a QVariant of type QImage/QPixmap
+
+2010-01-21  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Custom select popups.
+        https://bugs.webkit.org/show_bug.cgi?id=33418
+
+        Optimization of the WebCore support to combobox popup delegate.
+
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::QtAbstractWebPopup):
+        (WebCore::QtAbstractWebPopup::itemType):
+        * platform/qt/QtAbstractWebPopup.h:
+        (WebCore::QtAbstractWebPopup::):
+        (WebCore::QtAbstractWebPopup::itemText):
+        (WebCore::QtAbstractWebPopup::itemToolTip):
+        (WebCore::QtAbstractWebPopup::itemIsEnabled):
+        (WebCore::QtAbstractWebPopup::itemCount):
+        (WebCore::QtAbstractWebPopup::view):
+        (WebCore::QtAbstractWebPopup::geometry):
+        (WebCore::QtAbstractWebPopup::currentIndex):
+        (WebCore::QtAbstractWebPopup::font):
+
+2010-01-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Stylesheet href property shows redirected URL unlike other browsers
+        https://bugs.webkit.org/show_bug.cgi?id=33683
+
+        Teach StyleSheet the difference between original and final URLs in
+        redirect chains.  Unfortunately, StyleSheet needs to know both of these
+        URLs.  The original URL is needed for the href property and the final
+        URL is needed as the baseURL.
+
+        This change required touching a lot of lines of code because we need to
+        plumb this information to the StyleSheet object.  I audited all
+        existing clients of href() and setHref() to see whether they wanted the
+        original or final URLs.  I then updated the clients (except the JS
+        bindings themselves) to use the correct accessor.
+
+        Test: http/tests/security/stylesheet-href-redirect.html
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet):
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSImportRule.h:
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::create): 
+        (WebCore::CSSStyleSheet::createInline): Added a new constructor to deal
+        with "inline" style sheets that don't have a distinct original and
+        final URL.
+        * css/StyleBase.cpp:
+        (WebCore::StyleBase::baseURL): This code wants to use the final URL,
+        not the original URL.  Updated it to grab the baseURL directly.
+        * css/StyleSheet.cpp:
+        (WebCore::StyleSheet::StyleSheet):
+        * css/StyleSheet.h:
+        (WebCore::StyleSheet::href):
+        (WebCore::StyleSheet::setBaseURL): This function really just updates
+        the base URL of the style sheet, so I made it more explicit.
+        (WebCore::StyleSheet::putativeBaseURL): We need an accessor for the
+        base URL, but baseURL is already taken.
+        * dom/Document.cpp:
+        (WebCore::Document::updateBaseURL):
+        (WebCore::Document::pageUserSheet):
+        (WebCore::Document::pageGroupUserSheets):
+        (WebCore::Document::elementSheet):
+        (WebCore::Document::mappedElementSheet):
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+        (WebCore::ProcessingInstruction::setCSSStyleSheet):
+        (WebCore::ProcessingInstruction::setXSLStyleSheet):
+        * dom/ProcessingInstruction.h:
+        * dom/StyleElement.cpp:
+        (WebCore::StyleElement::createSheet):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+        * html/HTMLLinkElement.h:
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::didAddClient):
+        (WebCore::CachedCSSStyleSheet::checkNotify): This code now passes both
+        the original and final URL into setCSSStyleSheet so that the style
+        sheet can have both.
+        * loader/CachedResourceClient.h:
+        (WebCore::CachedResourceClient::setCSSStyleSheet):
+        (WebCore::CachedResourceClient::setXSLStyleSheet):
+        * loader/CachedXSLStyleSheet.cpp:
+        (WebCore::CachedXSLStyleSheet::didAddClient):
+        (WebCore::CachedXSLStyleSheet::checkNotify): I don't have any direct
+        evidence that we need to change the XSLStyleSheet behavior, which is
+        why I wasn't able to add a test for the behavior.  However, the objects
+        are parallel enough that it seemed like the right thing to do.
+        * xml/XSLImportRule.cpp:
+        (WebCore::XSLImportRule::setXSLStyleSheet):
+        (WebCore::XSLImportRule::loadSheet):
+        * xml/XSLImportRule.h:
+        * xml/XSLStyleSheet.h:
+        (WebCore::XSLStyleSheet::create):
+        (WebCore::XSLStyleSheet::createEmbedded):
+        * xml/XSLStyleSheetLibxslt.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet):
+        (WebCore::XSLStyleSheet::parseString):
+        (WebCore::XSLStyleSheet::loadChildSheets):
+        * xml/XSLStyleSheetQt.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet):
+        * xml/XSLTProcessorLibxslt.cpp:
+        (WebCore::xsltStylesheetPointer):
+        * xml/XSLTProcessorQt.cpp:
+        (WebCore::XSLTProcessor::transformToString):
+
+2010-01-20  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use xmlStrdup instead of strdup for consistency in Libxml2.
+        https://bugs.webkit.org/show_bug.cgi?id=33935
+
+        Remove the direct use of strdup.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::PendingCallbacks::appendErrorCallback):
+        (WebCore::PendingCallbacks::):
+        (WebCore::XMLTokenizer::error):
+
+2010-01-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Insufficient repaint issues with html embedded in foreignObject
+        https://bugs.webkit.org/show_bug.cgi?id=16318
+
+        Final part of fix -- now we render the selection rect of list
+        markers in a transformed context.
+
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::localSelectionRect):
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderListMarker.h:
+
+2010-01-20  Daniel Bates  <dbates@webkit.org>
+
+        No review, rolling out 53591.
+        http://trac.webkit.org/changeset/53591
+        https://bugs.webkit.org/show_bug.cgi?id=29564
+
+        Rolling out the change committed in change set 53591
+        <http://trac.webkit.org/changeset/53591> because it caused
+        a regression of test /fast/replaced/table-percent-height.html
+        on the Qt bot.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+
+2010-01-20  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Disable the "seatbelt" coordinate validation functions in the
+        Skia graphics layer.  We believe all the underlying bugs have
+        been fixed, but just in case we're being overly optimistic, this
+        leaves in the code for an easy revert.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33908
+        Exercised by many layout tests.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+
+2010-01-20  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=date.
+        https://bugs.webkit.org/show_bug.cgi?id=33911
+
+        Introduce ISODateTime::setMillisecondsSinceEpochForDate() and add Date
+        type support to ISODateTime::toString().
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValueAsDate):
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForDate):
+        (WebCore::ISODateTime::toString):
+        * html/ISODateTime.h:
+
+2010-01-20  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Simon Hausmann.
+
+        Touch Events are not sent to iframes
+        https://bugs.webkit.org/show_bug.cgi?id=33894
+
+        Fix the touch event handler so it does not bail out early if the main frame document does not have any touch listeners registered, as there may be embedded iframes that have registered for touch events.
+
+        Test: fast/events/touch/touch-inside-iframe.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Instead of looking at the document of the main frame to see if touch event listeners are registered, look at the document of the target element to account for iframes.
+
+2010-01-20  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove an assertion that is not valid in some detached iframes cases.
+        https://bugs.webkit.org/show_bug.cgi?id=33827
+
+        Test: http/tests/appcache/detached-iframe.html
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::DOMApplicationCache):
+
+2010-01-20  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Refactoring and plumbing to get the HTML5 SQL Database API accessible to
+        web workers.  No new functionality is exposed yet; this just gets the
+        infrastructure in place.  It touches a lot of files in small ways; here
+        are the main changes:
+
+        1) Database members and methods move from Document up to
+        ScriptExecutionContext.  Each of Document and WorkerContext must
+        implement a few virtual methods where the Database code requires
+        differentiation.
+        2) Worker thread shutdown got changed a bunch to handle Database cleanup
+        and thread synchronization issues.  Database cleanup tasks need to post
+        some cleanup tasks to the JavaScript thread.  However, since database
+        cleanup may happen due to the destruction of the WorkerThread, I added a
+        handshake [involving WorkerThreadShutdownStartTask,
+        WorkerThreadShutdownFinishTask, and a DatabaseTaskSynchronizer] between
+        the Database thread and WorkerThread that cleans up all the Database
+        stuff before the WorkerThread's runLoop can exit.
+        3) The runtime enabler for the Database moved to a static variable
+        accessible through Database::isAvailable, following the model used by
+        WebSocket.
+        4) Worker threads don't run their JavaScript on the Main thread, so
+        Database code that differentiated between the Main thread and the
+        Database thread now need to deal with a third possibility.
+        5) Most of the other changes have to do with having a
+        ScriptExecutionContext pointer instead of a Document pointer when
+        dealing with a Database.  In many cases it's just a string replacement,
+        but in some it required the creation of a new virtual function [e.g.
+        databaseExceededQuota, isDatabaseReadOnly]
+
+        https://bugs.webkit.org/show_bug.cgi?id=22725
+
+        No new tests; in a future patch I'll add JSC and V8 bindings and new
+        layout tests to exercise them.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::OpenDatabaseEnabled):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::isDatabaseReadOnly):
+        (WebCore::Document::databaseExceededQuota):
+        (WebCore::Document::isContextThread):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::databaseThread):
+        (WebCore::ScriptExecutionContext::addOpenDatabase):
+        (WebCore::ScriptExecutionContext::removeOpenDatabase):
+        (WebCore::ScriptExecutionContext::stopDatabases):
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::setHasOpenDatabases):
+        (WebCore::ScriptExecutionContext::hasOpenDatabases):
+        (WebCore::ScriptExecutionContext::Task::isCleanupTask):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        * storage/Database.cpp:
+        (WebCore::Database::setIsAvailable):
+        (WebCore::Database::isAvailable):
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::DerefContextTask::create):
+        (WebCore::DerefContextTask::performTask):
+        (WebCore::DerefContextTask::isCleanupTask):
+        (WebCore::Database::~Database):
+        (WebCore::Database::openAndVerifyVersion):
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::ContextRemoveOpenDatabaseTask::create):
+        (WebCore::ContextRemoveOpenDatabaseTask::performTask):
+        (WebCore::ContextRemoveOpenDatabaseTask::isCleanupTask):
+        (WebCore::ContextRemoveOpenDatabaseTask::ContextRemoveOpenDatabaseTask):
+        (WebCore::Database::close):
+        (WebCore::Database::performOpenAndVerify):
+        (WebCore::Database::scheduleTransaction):
+        (WebCore::Database::scheduleTransactionStep):
+        (WebCore::DeliverPendingCallbackTask::create):
+        (WebCore::DeliverPendingCallbackTask::performTask):
+        (WebCore::DeliverPendingCallbackTask::DeliverPendingCallbackTask):
+        (WebCore::Database::scheduleTransactionCallback):
+        (WebCore::Database::transactionClient):
+        (WebCore::Database::transactionCoordinator):
+        (WebCore::Database::tableNames):
+        (WebCore::Database::securityOrigin):
+        * storage/Database.h:
+        (WebCore::Database::scriptExecutionContext):
+        * storage/DatabaseTask.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        (WebCore::DatabaseThread::~DatabaseThread):
+        (WebCore::DatabaseThread::requestTermination):
+        (WebCore::DatabaseThread::databaseThread):
+        (WebCore::DatabaseThread::unscheduleDatabaseTasks):
+        * storage/DatabaseThread.h:
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::canEstablishDatabase):
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase):
+        * storage/DatabaseTracker.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::executeSQL):
+        * storage/SQLTransactionClient.cpp:
+        (WebCore::SQLTransactionClient::didCommitTransaction):
+        (WebCore::SQLTransactionClient::didExecuteStatement):
+        (WebCore::SQLTransactionClient::didExceedQuota):
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        (WebCore::DatabaseTracker::canEstablishDatabase):
+        (WebCore::DatabaseTracker::addOpenDatabase):
+        (WebCore::TrackerRemoveOpenDatabaseTask::create):
+        (WebCore::TrackerRemoveOpenDatabaseTask::performTask):
+        (WebCore::TrackerRemoveOpenDatabaseTask::TrackerRemoveOpenDatabaseTask):
+        (WebCore::DatabaseTracker::removeOpenDatabase):
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase):
+        * storage/chromium/SQLTransactionClientChromium.cpp:
+        (WebCore::NotifyDatabaseChangedTask::create):
+        (WebCore::NotifyDatabaseChangedTask::performTask):
+        (WebCore::NotifyDatabaseChangedTask::NotifyDatabaseChangedTask):
+        (WebCore::SQLTransactionClient::didCommitTransaction):
+        (WebCore::SQLTransactionClient::didExecuteStatement):
+        (WebCore::SQLTransactionClient::didExceedQuota):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        (WebCore::WorkerContext::isContextThread):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::clearScript):
+        (WebCore::WorkerContext::thread):
+        (WebCore::WorkerContext::isDatabaseReadOnly):
+        (WebCore::WorkerContext::databaseExceededQuota):
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::runInMode):
+        (WebCore::WorkerRunLoop::Task::performTask):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::workerThread):
+        (WebCore::WorkerThreadShutdownFinishTask::create):
+        (WebCore::WorkerThreadShutdownFinishTask::performTask):
+        (WebCore::WorkerThreadShutdownFinishTask::isCleanupTask):
+        (WebCore::WorkerThreadShutdownStartTask::create):
+        (WebCore::WorkerThreadShutdownStartTask::performTask):
+        (WebCore::WorkerThreadShutdownStartTask::isCleanupTask):
+        (WebCore::WorkerThread::stop):
+
+2010-01-20  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket: Request-URI should not be empty when no tralling slash in host
+        https://bugs.webkit.org/show_bug.cgi?id=33689
+
+        Test: websocket/tests/url-no-trailing-slash.html
+
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::resourceName):
+
+2010-01-20  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29564
+
+        [Qt] Fixes an issue where the height of <button>- and
+        <input type="button">- elements are fixed to the height of the
+        button label font plus padding. That is, the CSS height property
+        is being ignored.
+
+        Instead, we should honor the user-specified height, if appropriate
+        for the platform and context. Notice, the Mac ports do not honor the
+        height for <input type="button"> elements unless a border and/or
+        background is also specified.
+
+        Test: fast/css/button-height.html
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+
+2010-01-20  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Assertion failure calling history.pushState within popstate event handler.
+        https://bugs.webkit.org/show_bug.cgi?id=33830
+
+        Test: fast/loader/stateobjects/pushstate-within-popstate-handler-assert.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateWithinDocument): Remove the ASSERT and invalid part of the comment.
+
+2010-01-20  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        Crash on dispatching SVG mouse events
+        https://bugs.webkit.org/show_bug.cgi?id=33841
+
+        Return early SVGUseElement::instanceForShadowTreeElement if m_targetElementInstance is zero.
+        This only happens if the SVGUseElement has just been removed from the document and EventHandler
+        tries to dispatch a mouseout event to the corresponding SVGElementInstance. This is not testable
+        using DRT unfortunately, so we have to add another manual testcase for that.
+
+        Tests: manual-tests/use-crash-on-mouse-hover.svg
+
+        * manual-tests/svg-crash-hovering-use.svg: Added.
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::instanceForShadowTreeElement): Add ASSERT(!inDocument()) when returning 0 here if m_targetElementInstance is 0.
+
+2010-01-20  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Timeline reset button doesn't clean timeline if the panel is scrolled down.
+        The overview pane also stay dirty after reset.
+        https://bugs.webkit.org/show_bug.cgi?id=33829
+
+        * inspector/front-end/TimelineGrid.js:
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+
+2010-01-20  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33930
+        Crash in JSDOMWindowBase::crossDomainAccessErrorMessage when accessing a detached sandboxed frame
+
+        Test: http/tests/security/detached-sandboxed-frame-access.html
+
+        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::crossDomainAccessErrorMessage):
+        Changed the way we discover the url to match what the actual check does. Both old and new
+        code correctly fetch the URL of the current window displayed in frame, but going via
+        DOMWindowShell avoids crashing on null DOMWindow::m_frame pointer.
+
+2010-01-20  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Support SerializedScriptValue.
+        https://bugs.webkit.org/show_bug.cgi?id=32920
+        http://crbug.com/30620
+
+        Initial implementation of SerializedScriptValue which is used to
+        to create a serialized representation of JavaScript objects.  This
+        representation is needed for structured clones and worker messages.
+
+        * WebCore.gypi: Added SerializedScriptValue.cpp.
+        * bindings/scripts/CodeGeneratorV8.pm: Removed conversion to string before using SerializedScriptValue.
+        * bindings/v8/SerializedScriptValue.cpp: Added.
+        (WebCore::):
+        (WebCore::ZigZag::encode):
+        (WebCore::ZigZag::decode):
+        (WebCore::Writer::Writer):
+        (WebCore::Writer::writeUndefined):
+        (WebCore::Writer::writeNull):
+        (WebCore::Writer::writeTrue):
+        (WebCore::Writer::writeFalse):
+        (WebCore::Writer::writeString):
+        (WebCore::Writer::writeInt32):
+        (WebCore::Writer::writeNumber):
+        (WebCore::Writer::endComposite):
+        (WebCore::Writer::data):
+        (WebCore::Writer::doWriteUint32):
+        (WebCore::Writer::append):
+        (WebCore::Writer::ensureSpace):
+        (WebCore::Writer::fillHole):
+        (WebCore::Writer::charAt):
+        (WebCore::Serializer::Serializer):
+        (WebCore::Serializer::serialize):
+        (WebCore::Serializer::StateBase::~StateBase):
+        (WebCore::Serializer::StateBase::nextState):
+        (WebCore::Serializer::StateBase::setNextState):
+        (WebCore::Serializer::StateBase::composite):
+        (WebCore::Serializer::StateBase::StateBase):
+        (WebCore::Serializer::State::composite):
+        (WebCore::Serializer::State::tag):
+        (WebCore::Serializer::State::State):
+        (WebCore::Serializer::StackCleaner::StackCleaner):
+        (WebCore::Serializer::StackCleaner::~StackCleaner):
+        (WebCore::Serializer::ArrayState::ArrayState):
+        (WebCore::Serializer::ArrayState::done):
+        (WebCore::Serializer::ArrayState::advance):
+        (WebCore::Serializer::ObjectState::ObjectState):
+        (WebCore::Serializer::ObjectState::done):
+        (WebCore::Serializer::ObjectState::advance):
+        (WebCore::Serializer::ObjectState::nextProperty):
+        (WebCore::Serializer::doSerialize):
+        (WebCore::Serializer::push):
+        (WebCore::Serializer::top):
+        (WebCore::Serializer::pop):
+        (WebCore::Serializer::checkComposite):
+        (WebCore::Reader::Reader):
+        (WebCore::Reader::isEof):
+        (WebCore::Reader::read):
+        (WebCore::Reader::readTag):
+        (WebCore::Reader::readString):
+        (WebCore::Reader::readInt32):
+        (WebCore::Reader::readNumber):
+        (WebCore::Reader::doReadUint32):
+        (WebCore::Deserializer::Deserializer):
+        (WebCore::Deserializer::deserialize):
+        (WebCore::Deserializer::doDeserialize):
+        (WebCore::Deserializer::push):
+        (WebCore::Deserializer::pop):
+        (WebCore::Deserializer::stackDepth):
+        (WebCore::Deserializer::element):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/v8/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::createFromWire):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toWireString):
+
+        Updated uses of SerializedScriptValue:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::postMessageCallback):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::V8DedicatedWorkerContext::postMessageCallback):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::pushStateCallback):
+        (WebCore::V8History::replaceStateCallback):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::initMessageEventCallback):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::V8MessagePort::postMessageCallback):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::V8Worker::postMessageCallback):
+
+2010-01-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix crash in geolocation when observers change during iteration.
+
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::positionChanged): Copy observers to vector while iterating.
+        (WebCore::GeolocationController::errorOccurred): Copy observers to vector while iterating.
+
+2010-01-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Insufficient repaint issues with html embedded in foreignObject
+        https://bugs.webkit.org/show_bug.cgi?id=16318
+
+        Partial fix for selection repaint in foreignObject, basically we
+        just need to make sure foreignObject correctly applies the svg
+        transform to the selection rect.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintSelection):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::mapLocalToContainer):
+        * rendering/RenderForeignObject.h:
+
+2010-01-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY.
+
+        <rdar://problem/7557695> REGRESSION(r53445-r53449): Many new memory leaks (33867)
+
+        Revert r53447, since this caused leaks.
+
+        * WebCore.base.exp:
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::operator new):
+        (WebCore::StringImpl::operator delete):
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::createWithTerminatingNullCharacter):
+        (WebCore::StringImpl::crossThreadString):
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::hasTerminatingNullCharacter):
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+        (WebCore::StringImpl::):
+        * storage/OriginUsageRecord.cpp:
+        (WebCore::OriginUsageRecord::addDatabase):
+        (WebCore::OriginUsageRecord::markDatabase):
+
+2010-01-20  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Implement File and Blob interfaces as defined in File API spec.
+        https://bugs.webkit.org/show_bug.cgi?id=32912
+
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * Android.mk:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/objc/DOMHTML.h:
+        * bindings/objc/PublicDOMInterfaces.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Binding.h:
+        (WebCore::toInt64):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::sendCallback):
+        * html/File.cpp:
+        (WebCore::File::File):
+        * html/File.h:
+        (WebCore::File::create):
+        (WebCore::File::name):
+        (WebCore::File::fileName):
+        (WebCore::File::fileSize):
+        * html/File.idl:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
+        * xml/XMLHttpRequest.h:
+
+2010-01-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA popup buttons spoken as simply 'button'
+        https://bugs.webkit.org/show_bug.cgi?id=33922
+
+        Test: platform/mac/accessibility/aria-popup.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::actionElement):
+        (WebCore::AccessibilityRenderObject::determineAriaRoleAttribute):
+        * html/HTMLAttributeNames.in:
+
+2010-01-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        CrossThreadCopier needs to support ThreadSafeShared better.
+        https://bugs.webkit.org/show_bug.cgi?id=33698
+
+        Now the copier is able to handle types that derive from ThreadSafeShared.
+
+        No change functionality so no new tests.
+
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::cancel): Remove unnecessary cast.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::clearClientWrapper): Ditto.
+        * loader/WorkerThreadableLoader.h:
+        Change to use the derived class instead of the ThreadSafeShared version.
+        * platform/CrossThreadCopier.cpp:
+        Add the new template parameter throughout the classes and adjust the class that 
+        handles ThreadSafeShared to allow for derived types.
+        * platform/CrossThreadCopier.h:
+        Add another template parameter to be able to detect classes that derive 
+        from ThreadSafeShared.
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        Removed unnecessary casts and changed a type to use the derived class instead of
+        the ThreadSafeShared version.
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::Peer):
+        (WebCore::workerContextDidSend):
+        (WebCore::workerContextDidGetBufferedAmount):
+        (WebCore::workerContextDidConnect):
+        (WebCore::workerContextDidReceiveMessage):
+        (WebCore::workerContextDidClose):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::setWebSocketChannel):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::mainThreadCreateWebSocketChannel):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::bufferedAmount):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::clearClientWrapper):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::setMethodNotCompleted):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::waitForMethodCompletion):
+        * websockets/WorkerThreadableWebSocketChannel.h:
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::create): Changed a type to use the
+        derived class instead of the ThreadSafeShared version.
+
+2010-01-20  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7086565> Crash in WebCore::PlugInView::dispatchNPEvent
+
+        Reviewed by Sam Weinig.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::handleEvent):
+        Ref the PluginView to protect it from deletion while calling into the
+        plug-in.
+
+2010-01-20  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: accSelect() is not implemented
+
+        https://bugs.webkit.org/show_bug.cgi?id=33918
+        <rdar://problem/7436861>
+
+        Reviewed by Darin Adler.
+
+        Test: platform/win/accessibility/selection-and-focus.html
+
+        * accessibility/AccessibilityMenuListOption.cpp:
+        (WebCore::AccessibilityMenuListOption::setSelected):
+        Return early if the object is not selectable.
+
+2010-01-20  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Fix chromium build, introduced a copy&paste error.
+
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+
+2010-01-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6579204> Exception thrown when opening a <select> pop-up that
+        uses a web font
+        https://bugs.webkit.org/show_bug.cgi?id=23911
+
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::populate): Use the (bold) system font if an NSFont cannot
+        be obtained.
+
+2010-01-19  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Alexey Proskuryakov. 
+
+        svg/custom/use-instanceRoot-event-bubbling.xhtml is flakey
+        https://bugs.webkit.org/show_bug.cgi?id=33835
+
+        mouseEvent fires mutiple times in svg/custom/use-instanceRoot-as-event-target.xhtml
+        https://bugs.webkit.org/show_bug.cgi?id=32519
+
+        Test: svg/custom/use-instanceRoot-event-listener-liveness.xhtml
+
+        Stabilize <use> scripting support - use tests are reliable now (tested using --repeach-each 50 --random -p)
+
+        Do not reclone trees anymore because of event listener changes, instead keep correspondingElement & shadowTreeElement
+        synchronized for each SVGElementInstance - any mutations on any event listeners are live, and take immediate effect,
+        w/o having to rely on a reclone - this was the root of several race conditions making the <use> tests flakey.
+
+        Fix SVGUseElement::instanceRoot() to force shadow tree creation, even if it was not attached so far - we can't wait
+        for finishedParsing() to be called which would recalculate the document style and attach the shadow tree as result.
+        This is now matching Operas behaviour.
+
+        Optimize createAttributeEventListener() to not create event listeners if the supplied Attribute isNull() - otherwhise
+        DOM calls like removeAttribute("onclick") cause a temporary JSEventListener to be created, added to the event listener
+        cache and removed afterwards.
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Return early if the supplied attribute is null as discussed with Geoffrey.
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Ditto.
+        * dom/Node.cpp: Synchronize event listeners with all element instances, instead of marking the use elements to reclone.
+        (WebCore::instancesForSVGElement):
+        (WebCore::tryAddEventListener):
+        (WebCore::Node::addEventListener): When adding a listener, get a list of element instances and add it their as well.
+        (WebCore::tryRemoveEventListener):
+        (WebCore::Node::removeEventListener): Ditto for removals, but with special logic for listeners created from markup (see comments)
+        * svg/SVGElementInstance.cpp: Cleaned up, removing unncessary checks of correspondingElement() - there is an ASSERT in the ctor.
+        (WebCore::SVGElementInstance::invalidateAllInstancesOfElement):
+        (WebCore::SVGElementInstance::scriptExecutionContext):
+        (WebCore::SVGElementInstance::addEventListener):
+        (WebCore::SVGElementInstance::removeEventListener):
+        (WebCore::SVGElementInstance::removeAllEventListeners):
+        (WebCore::SVGElementInstance::eventTargetData):
+        (WebCore::SVGElementInstance::ensureEventTargetData):
+        * svg/SVGUseElement.cpp: Call document()->updateLayoutIgnorePendingStylesheets() to force shadow tree creation, just like CSSStyleDecl works.
+        (WebCore::SVGUseElement::instanceRoot):
+
+2010-01-20  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move local utility class DocumentWeakReference entirely from Document.h into Document.cpp
+        since it is only used there. It is a followup for http://trac.webkit.org/changeset/53345.
+
+        No new tests since no change in functionality.
+
+        * dom/Document.cpp: Move definitions of the methods into declaration of the class, remove 'inline'.
+        * dom/Document.h: Replace DocumentWeakReference declaration with a forward declaration.
+
+2010-01-20  Oliver Hunt  <oliver@apple.com>
+
+        No review, rolling out r53561.
+        http://trac.webkit.org/changeset/53561
+        https://bugs.webkit.org/show_bug.cgi?id=16318
+
+        broke selection repaint for transformed text in html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintSelection):
+        * rendering/RenderForeignObject.cpp:
+        * rendering/RenderForeignObject.h:
+
+2010-01-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Insufficient repaint issues with html embedded in foreignObject
+        https://bugs.webkit.org/show_bug.cgi?id=16318
+
+        Partial fix for selection repaint in foreignObject, basically we
+        just need to make sure foreignObject correctly applies the svg
+        transform to the selection rect.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintSelection):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::mapLocalToContainer):
+        * rendering/RenderForeignObject.h:
+
+2010-01-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix for !ENABLE(SVG).
+
+        * rendering/TrailingFloatsRootInlineBox.h:
+        (WebCore::TrailingFloatsRootInlineBox::TrailingFloatsRootInlineBox):
+
+2010-01-20  David Levin  <levin@chromium.org>
+
+        No review, rolling out r53552.
+        http://trac.webkit.org/changeset/53552
+        https://bugs.webkit.org/show_bug.cgi?id=32554
+
+        Caused lots of fast/profile test failures.
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::databaseForId):
+        (WebCore::JSInjectedScriptHost::inspectedWindow):
+        (WebCore::JSInjectedScriptHost::wrapCallback):
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::wrapObject):
+        (WebCore::JSInjectedScriptHost::unwrapObject):
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::JSInjectedScriptHost::selectDatabase):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/js/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::state):
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObject.h:
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::inspectedWindowCallback):
+        (WebCore::V8InjectedScriptHost::wrapCallbackCallback):
+        (WebCore::V8InjectedScriptHost::wrapObjectCallback):
+        (WebCore::V8InjectedScriptHost::unwrapObjectCallback):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::wrapObject):
+        (WebCore::InjectedScriptHost::unwrapObject):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        (WebCore::InspectorController::releaseWrapperObjectGroup):
+        (WebCore::InspectorController::resetInjectedScript):
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.requestClearMessages):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._formatarray):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        (InjectedScript.toggleStyleEnabled):
+        (InjectedScript._serializeRule):
+        (InjectedScript._serializeStyle):
+        (InjectedScript.getProperties):
+        (InjectedScript.setPropertyValue):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.getCallFrames):
+        (InjectedScript._inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._resolveObject):
+        (InjectedScript._window):
+        (InjectedScript._objectForId):
+        (InjectedScript.createProxyObject):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        (Object.type):
+        (String.prototype.escapeCharacters):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype.update.inlineStyleCallback):
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        (WebInspector.ObjectProxy.getPropertiesAsync):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2010-01-20  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Renames jni_runtime.[cpp|h] to JNIBridge.[cpp|h]
+        https://bugs.webkit.org/show_bug.cgi?id=33899
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk: Modified. Removes jni_runtime.cpp and adds JNIBridge.cpp
+        * GNUmakefile.am: Modified. Removes jni_runtime.h and adds JNIBridge.h
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removes jni_runtime.[cpp|h] and adds JNIBridge.[cpp|h]
+        * bridge/jni/JNIBridge.cpp: Copied from WebCore/bridge/jni/jni_runtime.cpp.
+        * bridge/jni/JNIBridge.h: Copied from WebCore/bridge/jni/jni_runtime.h.
+        * bridge/jni/jni_jsobject.mm: Modified. Updated to include JNIBridge.h
+        * bridge/jni/jni_runtime.cpp: Removed.
+        * bridge/jni/jni_runtime.h: Removed.
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: Modified. Updated to include JNIBridge.h
+        * bridge/jni/jsc/JavaClassJSC.cpp: Modified. Removed superfluous include
+        * bridge/jni/jsc/JavaClassJSC.h: Modified. Updated to include JNIBridge.h
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Modified. Updated to include JNIBridge.h
+
+2010-01-20  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33913
+        Crash under Media::matchMedium in detached frame
+
+        Also took the opportunity to fix JS bindings for the Media object.
+
+        Test: fast/media/lifetime.html
+
+        * css/Media.h:
+        (WebCore::Media::create): Take and store a Frame pointer, like other similar objects do.
+        (WebCore::Media::disconnectFrame): Zero out the frame pointer (this is called from
+        DOMWindow::clear()).
+
+        * css/Media.cpp:
+        (WebCore::Media::Media): Updated to storing Frame pointer.
+        (WebCore::Media::type): Ditto.
+        (WebCore::Media::matchMedium): Removed null check for document element - every document has
+        one. Also, every Frame has a document, so we only need to check for m_frame being zero.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::markChildren):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+        (WebCore::DOMWindow::media):
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::optionalMedia):
+        Make sure there's only one Media object per window, and keep its wrapper alive.
+
+2010-01-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler and Adam Roben.
+
+        Feature defines are difficult to maintain on Windows builds
+        https://bugs.webkit.org/show_bug.cgi?id=33883
+
+        FeatureDefines.vsprops are now maintained in a way similar to
+        Configurations/FeatureDefines.xcconfig, with the added advantage
+        of having a single FeatureDefines file across all projects.
+
+        * Configurations/FeatureDefines.xcconfig: Add comments about keeping feature definitions in sync.
+        * WebCore.vcproj/MigrateIDLAndScripts: Remove reference to file that no longer exists.
+        * WebCore.vcproj/QTMovieWin.vcproj: Add FeatureDefines.vsprops inherited property sheet.
+        * WebCore.vcproj/WebCore.vcproj: Add FeatureDefines.vsprops inherited property sheet.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Remove ENABLE_ preprocessor definitions.
+        * WebCore.vcproj/WebCoreGenerated.vcproj: Added Cairo configuration for selecting proper features.
+        * WebCore.vcproj/WebCoreMediaQT.vsprops: Remove ENABLE_VIDEO. This is picked up from FeatureDefines.vsprops.
+        * WebCore.vcproj/build-generated-files.sh: Pick up features from FeatureDefines.vsprops or FeatureDefinesCairo.vsprops.
+
+2010-01-20  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Inject inspector script directly into the inspected context. All the
+        communication between the script and the frontend is serialized into
+        JSON strings. It allows to get rid of object quarantines in Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32554
+
+        Test: inspector/console-log-before-inspector-open.html
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::databaseForId):
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::JSInjectedScriptHost::selectDatabase):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/js/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::state):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/js/ScriptValue.cpp:
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/v8/ScriptValue.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::releaseWrapperObjectGroup):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::setInjectedScriptSource):
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::injectedScriptForNodeId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.requestClearMessages):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged.InjectedScriptAccess.get addInspectedNode):
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        (injectedScriptConstructor.):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess):
+        (InjectedScriptAccess.getDefault):
+        (get InjectedScriptAccess):
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.prototype.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype.update.inlineStyleCallback):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2010-01-20  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=time.
+        https://bugs.webkit.org/show_bug.cgi?id=33825
+
+        Introduce ISODateTime::setMillisecondsSinceMidnight() and add a
+        SecondFormat parameter to ISODateTime::toString(). The main code
+        logic for type=time is implemented in
+        setMillisecondsSinceMidnightInternal() and toStringForTime()
+        because the logic is going to be used for other types.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValueAsDate):
+        * html/ISODateTime.cpp:
+        (WebCore::positiveFmod):
+        (WebCore::ISODateTime::setMillisecondsSinceMidnightInternal):
+        (WebCore::ISODateTime::setMillisecondsSinceMidnight):
+        (WebCore::ISODateTime::toStringForTime):
+        (WebCore::ISODateTime::toString):
+        * html/ISODateTime.h:
+        (WebCore::ISODateTime::):
+
+2010-01-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix for r53547.
+
+        * WebCore.pri:
+
+2010-01-20  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Simon Hausmann.
+
+        The touchcancel event is not supported.
+        https://bugs.webkit.org/show_bug.cgi?id=33598
+
+        This change adds support for the touchcancel event in WebCore and adds a test.
+
+        Test: fast/events/touch/send-oncancel-event.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGestureEvent): Considers touchcancel with the other touch events when working out if the event is a user gesture.
+        * dom/Document.cpp:
+        (WebCore::Document::addListenerTypeIfNeeded): Adds a check to consider ontouchcancel a touch event listener.
+        * dom/Document.h: Add the touchcancel attribute event listener.
+        * dom/Document.idl: ditto.
+        * dom/Element.h: ditto.
+        * dom/Element.idl: ditto.
+        * dom/EventNames.h: Adds touchcancel as an event name.
+        * html/HTMLAttributeNames.in:Adds touchcancel as an HTML attribute name.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute): Parses the ontouchcancel attribute.
+        * page/DOMWindow.h: Adds the touchcancel attribute event listener.
+        * page/DOMWindow.idl: ditto.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Add code to detect and dispatch touchcancel events.
+        * platform/PlatformTouchEvent.h:
+        (WebCore::): Add TouchCancel as a touch event type.
+        * platform/PlatformTouchPoint.h:
+        (WebCore::PlatformTouchPoint::): Add TouchCanceled as a touch point state.
+
+2010-01-20  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make extraCompilers for generated sources depend on their scripts
+
+        * DerivedSources.pro:
+        * WebCore.pri:
+
+2010-01-20  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [Chromium][V8] Fix null pointer dereference in V8Proxy::retrieve().
+        https://bugs.webkit.org/show_bug.cgi?id=33886
+
+        This is equivalent to r53433, and fix a crash by
+        LayoutTests/http/tests/appcache/destroyed-iframe.html.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieve): Check if context is null.
+
+2010-01-20  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Optimize resize event handling for hidden views
+        https://bugs.webkit.org/show_bug.cgi?id=33803
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.resize):
+        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
+        * inspector/front-end/AuditsPanel.js:
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.updateSidebarWidth):
+        (WebInspector.Panel.prototype.resize):
+        * inspector/front-end/PanelEnablerView.js:
+        (WebInspector.PanelEnablerView):
+        (WebInspector.PanelEnablerView.prototype.show):
+        (WebInspector.PanelEnablerView.prototype.resize):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.show):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype.showView):
+        (WebInspector.ProfilesPanel.prototype.closeVisibleView):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype.updateMainViewWidth):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype.get visibleView):
+        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.updateMainViewWidth):
+        * inspector/front-end/WelcomeView.js:
+        (WebInspector.WelcomeView):
+        (WebInspector.WelcomeView.prototype.show):
+        (WebInspector.WelcomeView.prototype.resize):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.windowResize):
+
+2010-01-20  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Fixes style in WebCore/bridge/Bridge
+        https://bugs.webkit.org/show_bug.cgi?id=33839
+
+        No new tests, style fixes only.
+
+        * bridge/Bridge.cpp: Modified.
+        * bridge/Bridge.h: Modified.
+        * bridge/c/c_instance.cpp: Modified.
+        (JSC::Bindings::CInstance::invokeMethod): Modified. Use renamed m_rootObject member
+        (JSC::Bindings::CInstance::invokeDefaultMethod): Modified. Use renamed m_rootObject member
+        (JSC::Bindings::CInstance::invokeConstruct): Modified. Use renamed m_rootObject member
+        * bridge/jni/jni_runtime.cpp: Modified.
+        (JavaArray::JavaArray): Modified. Use renamed m_rootObject member
+        (JavaArray::rootObject): Modified. Use renamed m_rootObject member
+        * bridge/objc/objc_instance.mm: Modified.
+        (ObjcInstance::invokeMethod): Modified. Use renamed m_rootObject member
+        (ObjcInstance::invokeDefaultMethod): Modified. Use renamed m_rootObject member
+        (ObjcInstance::getValueOfUndefinedField): Modified. Use renamed m_rootObject member
+        * bridge/objc/objc_runtime.mm: Modified.
+        (JSC::Bindings::ObjcArray::valueAt): Modified. Use renamed m_rootObject member
+        * bridge/qt/qt_runtime.cpp: Modified.
+        (JSC::Bindings::::rootObject): Modified. Use renamed m_rootObject member
+
+2010-01-20  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33885
+
+        Fixes style errors exposed by the style bot in the patch
+        for bug #33770. Moreover, fixes all style errors reported
+        by check-webkit-style.
+
+        No functionality was changed. So, no new tests.
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Fixes style in WebCore/bridge/JNIUtility
+        https://bugs.webkit.org/show_bug.cgi?id=33870
+
+        No new tests, style fixes only.
+
+        * bridge/jni/JNIUtility.cpp:
+        * bridge/jni/JNIUtility.h:
+
+2010-01-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        On Linux link QtWebKit with -no-undefined to catch build breakages due to missing
+        files in the .pro file, resulting in unresolved symbols.
+
+        * WebCore.pro:
+
+2010-01-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make it possible to link with -no-undefined.
+
+        * WebCore.pro: Add missing explicit dependency to libXrender due to the
+        use of XRenderFindVisualFormat in the X11 plugin code.
+
+2010-01-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add missing files to the build.
+
+        * WebCore.pro:
+
+2010-01-20  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] computePageRectsForFrame seems to be unnecessary
+        https://bugs.webkit.org/show_bug.cgi?id=33881
+
+        * WebCore.gypi: Removed FrameChromium.h
+        * page/chromium/FrameChromium.cpp: Removed computePageRectsForFrame.
+        * page/chromium/FrameChromium.h: Removed.
+
+2010-01-20  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 33266 - WebCore::InlineFlowBox::determineSpacingForFlowBoxes ReadAV@NULL (43c64e8abbda6766e5f5edbd254c2d57)
+        (https://bugs.webkit.org/show_bug.cgi?id=33266)
+        
+        Ruby did not handle malformed cases correctly when the ruby base was in
+        block flow. Changed the code to handle all possible cases.
+        Also, added some simplification methods to RenderBlock.
+
+        Tests: fast/ruby/ruby-illegal-1.html
+               fast/ruby/ruby-illegal-2.html
+               fast/ruby/ruby-illegal-3.html
+               fast/ruby/ruby-illegal-4.html
+               fast/ruby/ruby-illegal-5.html
+               fast/ruby/ruby-illegal-6.html
+               fast/ruby/ruby-illegal-7.html
+               fast/ruby/ruby-illegal-combined.html
+               fast/ruby/rubyDOM-insert-rt-block-1.html
+               fast/ruby/rubyDOM-insert-rt-block-2.html
+               fast/ruby/rubyDOM-insert-rt-block-3.html
+               fast/ruby/rubyDOM-remove-rt-block-1.html
+               fast/ruby/rubyDOM-remove-rt-block-2.html
+               fast/ruby/rubyDOM-remove-rt-block-3.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::moveAllChildrenTo): useful for anonymous block manipulation
+        (WebCore::RenderBlock::removeChild): making use of moveAllChildrenTo
+        * rendering/RenderBlock.h:
+        * rendering/RenderRubyBase.cpp:
+        (WebCore::RenderRubyBase::hasOnlyWrappedInlineChildren):
+        (WebCore::RenderRubyBase::moveChildren):
+        (WebCore::RenderRubyBase::moveInlineChildren):
+        (WebCore::RenderRubyBase::moveBlockChildren):
+        (WebCore::RenderRubyBase::mergeBlockChildren):
+        * rendering/RenderRubyBase.h:
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::addChild):
+        (WebCore::RenderRubyRun::removeChild):
+
+2010-01-19  Dan Bernstein  <mitz@apple.com>
+
+        Build fix after r53514
+
+        * WebCore.base.exp: Removed threadGlobalData(), which was inlined in r53514.
+
+2010-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Avoid calling NSEqualRects() on the garbage rect obtained
+        by calling -frame on a null view.
+
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::setFrameRect):
+
+2010-01-19  Maciej Stachowiak  <mjs@apple.com>
+
+        Unreviewed build fix.
+
+        Remove currentWorld from the exports file again, since it is now inline.
+
+        * WebCore.base.exp:
+
+2010-01-19  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Part of <http://webkit.org/b/28622>.
+        Caught exceptions still pause the debugger.
+        
+        Update JavaScriptDebugServer::exception to take a hasHandler parameter,
+        so later we can differentiate between a caught and an uncaught exception.
+        
+        This just adds a new parameter, no behavior is changed.
+
+        No change in functionality, so no tests.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::exception):
+        * inspector/JavaScriptDebugServer.h:
+
+2010-01-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Inline functions that are hot in DOM manipulation
+        https://bugs.webkit.org/show_bug.cgi?id=33820
+
+        (3% speedup on Dromaeo DOM Core tests)
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::currentWorld): Inlined.
+        (WebCore::jsString): Inlined String& overload and split off slow case.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsStringSlowCase): Slow case for the above.
+        * dom/Document.h:
+        (WebCore::Document::isHTMLDocument): Use a bit and an inline method
+        instead of a virtual method, since this is so hot and size of Document
+        is not a prime concern.
+        (WebCore::Document::create): Adapt for above.
+        (WebCore::Document::createXHTML): ditto
+        * dom/Document.cpp:
+        (WebCore::Document::Document): ditto
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::HTMLDocument): ditto
+        * html/HTMLDocument.h: ditto
+        * loader/PlaceholderDocument.h:
+        (WebCore::PlaceholderDocument::PlaceholderDocument): ditto
+        * svg/SVGDocument.cpp:
+        (WebCore::SVGDocument::SVGDocument): ditto
+        * dom/Element.h:
+        (WebCore::Element::attributes): Inlined.
+        (WebCore::Element::updateId): Inlined.
+        * dom/Element.cpp: (Remove inlined methods.)
+        * dom/NamedAttrMap.h:
+        (WebCore::NamedNodeMap::getAttributeItem): Inlined and split off slow case.
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::getAttributeItemSlowCase): Slow case for the above.
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::didInsertDOMNode): Inlined so the fast case
+        early exit doesn't incur a function call.
+        (WebCore::InspectorController::didRemoveDOMNode): ditto
+        (WebCore::InspectorController::didModifyDOMAttr): ditto
+        * platform/ThreadGlobalData.h:
+        (WebCore::threadGlobalData): Inlined.
+        * platform/ThreadGlobalData.cpp: (Removed inline methods).
+        * platform/Timer.h:
+        (WebCore::TimerBase::isActive): Inlined.
+        * platform/Timer.cpp: (Removed inline methods).
+        * WebCore.xcodeproj/project.pbxproj: Install new heares.
+        * WebCore.base.exp: Add appropriate exports.
+
+2010-01-19  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Chromium build fix.
+
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Call correct function.
+
+2010-01-17  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: The child <option> elements of a non-multiple <select> are not
+        exposed
+
+        https://bugs.webkit.org/show_bug.cgi?id=33773
+        <rdar://problem/7550556>
+
+        Reviewed by Alice Liu.
+
+        This exposes the child <option> elements in a format similar to
+        Firefox's: the <select> element has one child, a hidden list object,
+        and this list has as its children the <option> elements.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Add new files to project.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        If the element is a RenderMenuList, create an AccessibilityMenuList.
+        (WebCore::AXObjectCache::getOrCreate):
+        Add new types to create by role value.
+
+        * accessibility/AccessibilityMenuList.cpp: Added.
+        (WebCore::AccessibilityMenuList::AccessibilityMenuList):
+        Call the base class constructor. Assert that the RenderObject passed
+        is a RenderMenuList.
+        (WebCore::AccessibilityMenuList::press):
+        Show or hide the popup menu.
+        (WebCore::AccessibilityMenuList::addChildren):
+        Create an AccessibilityMenuListPopup. If the platform ignores its
+        accessibility, remove it from the object cache and return early.
+        Otherwise, set its parent object to this object, add it to our list of
+        children, and tell it to add its children.
+        (WebCore::AccessibilityMenuList::childrenChanged):
+        Tell our child hidden list that its children changed.
+        (WebCore::AccessibilityMenuList::isCollapsed):
+        Return whether the popup menu is visible.
+
+        * accessibility/AccessibilityMenuList.h: Added.
+        (WebCore::AccessibilityMenuList::create):
+        Adopt and return a new RenderMenuList.
+        (WebCore::AccessibilityMenuList::isMenuList):
+        (WebCore::AccessibilityMenuList::roleValue):
+        (WebCore::AccessibilityMenuList::accessibilityIsIgnored):
+        (WebCore::AccessibilityMenuList::canSetFocusAttribute):
+
+        * accessibility/AccessibilityMenuListOption.cpp: Added.
+        (WebCore::AccessibilityMenuListOption::AccessibilityMenuListOption):
+        Initialize the pointer to our parent popup menu.
+        (WebCore::AccessibilityMenuListOption::setElement):
+        Assert that the element is an <option> element.
+        (WebCore::AccessibilityMenuListOption::actionElement):
+        Return our element.
+        (WebCore::AccessibilityMenuListOption::parentObject):
+        Return our parent popup menu.
+        (WebCore::AccessibilityMenuListOption::isEnabled):
+        Return true if the element itself is enabled.
+        (WebCore::AccessibilityMenuListOption::isVisible):
+        Return true if the popup is visible, or return true if the popup is
+        collapsed but the element is selected.
+        (WebCore::AccessibilityMenuListOption::isOffScreen):
+        Return true if the object is invisible.
+        (WebCore::AccessibilityMenuListOption::isSelected):
+        (WebCore::AccessibilityMenuListOption::setSelected):
+        (WebCore::AccessibilityMenuListOption::nameForMSAA):
+        Return the <option> element's text.
+        (WebCore::AccessibilityMenuListOption::canSetSelectedAttribute):
+        Return true if enabled.
+        (WebCore::AccessibilityMenuListOption::elementRect):
+        Return the AccessibilityMenuList's rect.
+
+        * accessibility/AccessibilityMenuListOption.h: Added.
+        (WebCore::AccessibilityMenuListOption::create):
+        Adopt and return a new AccessibilityMenuListOption.
+        (WebCore::AccessibilityMenuListOption::setParent):
+        (WebCore::AccessibilityMenuListOption::isMenuListOption):
+        (WebCore::AccessibilityMenuListOption::roleValue):
+        (WebCore::AccessibilityMenuListOption::canHaveChildren):
+        (WebCore::AccessibilityMenuListOption::size):
+
+        * accessibility/AccessibilityMenuListPopup.cpp: Added.
+        (WebCore::AccessibilityMenuListPopup::AccessibilityMenuListPopup):
+        Initialize the pointer to our parent list.
+        (WebCore::AccessibilityMenuListPopup::isVisible):
+        Return false; we're never considered visible.
+        (WebCore::AccessibilityMenuListPopup::isOffScreen):
+        Return true if the popup is collapsed.
+        (WebCore::AccessibilityMenuListPopup::parentObject):
+        Return our parent AccessibilityMenuList.
+        (WebCore::AccessibilityMenuListPopup::isEnabled):
+        Return true if our parent is enabled.
+        (WebCore::AccessibilityMenuListPopup::menuListOptionAccessibilityObject):
+        If the element is an <option> element, create a list item for it, and
+        set the object's element to this element.
+        (WebCore::AccessibilityMenuListPopup::press):
+        Call our parent's press() function to show or hide the popup menu.
+        (WebCore::AccessibilityMenuListPopup::addChildren):
+        Walk the select element's children, and create list items for them. Add
+        them to our list of children.
+        (WebCore::AccessibilityMenuListPopup::childrenChanged):
+        If any of our children have been detached from the document, remove
+        them from the AXObjectCache and from our child list.
+        (WebCore::AccessibilityMenuListPopup::setMenuList):
+
+        * accessibility/AccessibilityMenuListPopup.h: Added.
+        (WebCore::AccessibilityMenuListPopup::create):
+        Adopt and return an AccessibilityMenuListPopup.
+        (WebCore::AccessibilityMenuListPopup::isMenuListPopup):
+        (WebCore::AccessibilityMenuListPopup::elementRect):
+        (WebCore::AccessibilityMenuListPopup::size):
+        (WebCore::AccessibilityMenuListPopup::roleValue):
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::actionVerb):
+        Add the menuListAction and menuListPopupAction verbs.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        Add new roles.
+        (WebCore::AccessibilityObject::isMenuList):
+        Stubbed.
+        (WebCore::AccessibilityObject::isMenuListHiddenList):
+        Stubbed.
+        (WebCore::AccessibilityObject::isMenuListOption):
+        Stubbed.
+        (WebCore::AccessibilityObject::isVisible):
+        Stubbed.
+
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ignore the new object type.
+
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ditto.
+
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ditto.
+
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ditto.
+
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Allow the new object types.
+
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ignore the new object type.
+
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        If the object is an AccessibilityMenuListHiddenList or
+        AccessibilityMenuListOption, include it.
+
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::disabled):
+        Call ownElementDisabled().
+
+        * html/HTMLOptionElement.h:
+        (WebCore::HTMLOptionElement::ownElementDisabled):
+        Return the base class implementation of disabled, which returns
+        whether this <option> itself is disabled.
+
+        * platform/LocalizedStrings.h:
+        Declare new localized string functions.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::AXMenuListPopupActionVerb):
+        Stubbed.
+        (WebCore::AXMenuListActionVerb):
+        Stubbed.
+
+        * platform/haiku/LocalizedStringsHaiku.cpp:
+        (WebCore::AXMenuListPopupActionVerb):
+        Stubbed.
+        (WebCore::AXMenuListActionVerb):
+        Stubbed.
+
+        * platform/mac/LocalizedStringsMac.mm:
+        (WebCore::AXMenuListPopupActionVerb):
+        Call the view factory's method.
+        (WebCore::AXMenuListActionVerb):
+        Ditto.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::AXMenuListPopupActionVerb):
+        Stubbed.
+        (WebCore::AXMenuListActionVerb):
+        Stubbed.
+
+        * platform/wx/LocalizedStringsWx.cpp:
+        (WebCore::AXMenuListPopupActionVerb):
+        Stubbed.
+        (WebCore::AXMenuListActionVerb):
+        Stubbed.
+
+2010-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Support reflections on WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=33754
+
+        Support reflections of WebGL content, by ensuring that when the Canvas3DLayer containing the
+        WebGL content gets displayed, we correctly copy its content to the clone layers.
+        
+        Test: compositing/webgl/webgl-reflection.html
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::didDisplay): Give the didDisplay() client method a parameter
+        which is the layer that displayed.
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer display]): Override -[CALayer display], and call the client didDisplay().
+        * platform/graphics/mac/GraphicsLayerCA.h: didDisplay() takes a PlatformLayer parameter.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::~GraphicsLayerCA): We need to clear the layer owner on the content
+        layer, since we're setting it for WebGL layers now.
+        
+        (WebCore::GraphicsLayerCA::didDisplay): Handle didDisplay() calls for the content layer,
+        as well as the main layer now, getting the correct layer to copy contents from, and using
+        the correct clone map.
+        
+        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D): Set the layer owner for WebGL
+        layers, because we need the didDisplay() callback.
+
+        * platform/graphics/mac/WebLayer.mm:
+        (-[WebLayer display]): didDisplay() takes a layer argument.
+        * platform/graphics/mac/WebTiledLayer.mm:
+        (-[WebTiledLayer display]): ditto.
+
+2010-01-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7555330> <http://webkit.org/b/33770> dataFunctionMatrix leaks the array allocated by toArray
+
+        Rework toArray to extract elements in to a vector rather than handing out raw pointers.  This prevents
+        callers from forgetting to free the memory, and gives them the option of using stack buffers for
+        sufficiently small allocations.
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::texSubImage2D):
+        (WebCore::toVector):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+
+2010-01-19  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Another crazy counters bug
+        https://bugs.webkit.org/show_bug.cgi?id=11031
+
+        This patch actually provides for counter updating when the style
+        of a renderer changes.
+
+        Tests: fast/css/counters/counter-increment-002.html
+               fast/css/counters/counter-reset-000.html
+               fast/css/counters/counter-reset-002.html
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::RenderCounter::rendererStyleChanged):
+        This function is added to update the counter hierarchy in 
+        response to changes to the style of a renderer.
+        * rendering/RenderCounter.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleDidChange):
+        For changes that may include the counter directives added a
+        call to RenderCounter::rendererStyleChanged.
+
+2010-01-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed. Build fixes for make distcheck - missing files.
+
+        * GNUmakefile.am:
+
+2010-01-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33850
+        Attr.childNodes does not get updated after DOM mutations
+
+        Test: fast/dom/Attr/child-nodes-cache.html
+
+        * dom/Node.cpp: (WebCore::Node::notifyLocalNodeListsAttributeChanged): If the node is an
+        attribute, then changing it shouldn't take the shortcut that only resets a subset of caches.
+
+2010-01-19  John Sullivan  <sullivan@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=33854
+        Would like a variant of WebHTMLRepresentation's searchForLabelsBeforeElement that returns 
+        more info about where the result was found
+
+        Reviewed by Darin Adler.
+
+        No new tests. This just adds a couple of out parameters for the benefit of WebKit clients.
+
+        * WebCore.base.exp:
+        Updated mangled signature for export.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::searchForLabelsAboveCell):
+        Now fills in an out parameter with the number of characters from the start of the cell.
+        (WebCore::Frame::searchForLabelsBeforeElement):
+        Now fills in an out parameter with the distance as a number of characters, and another
+        with a bool for whether the result was in a table cell above the current cell (otherwise
+        it was found in the text before this element and after the previous element or start of form).
+
+        * page/Frame.h:
+        Updated signatures.
+
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::searchForNSLabelsAboveCell):
+        Same as above. This is a parallel copy of the function using Mac-specific data structures.
+        (WebCore::Frame::searchForLabelsBeforeElement):
+        Ditto
+
+2010-01-19  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [OpenVG] Add (EGL) surface/context management
+        https://bugs.webkit.org/show_bug.cgi?id=33403
+
+        The foundations for a new OpenVG port.
+
+        OpenVG is not tied to EGL per se, EGL just happens to be
+        the only usable backend for OpenVG state and painting
+        at the time of writing.
+
+        The purpose of the SurfaceOpenVG class is to provide
+        an EGL-independent interface for OpenVG-specific code.
+        The EGLDisplayOpenVG class takes care of keeping track
+        of EGL displays, surfaces and contexts. It also makes
+        sure that all created contexts are interoperable, and
+        that different surfaces use a single context if possible.
+
+        * platform/graphics/openvg/EGLDisplayOpenVG.cpp: Added.
+        (WebCore::displayManagers):
+        (WebCore::EGLDisplayOpenVG::currentSurface):
+        (WebCore::EGLDisplayOpenVG::registerPlatformSurface):
+        (WebCore::EGLDisplayOpenVG::unregisterPlatformSurface):
+        (WebCore::EGLDisplayOpenVG::setCurrentDisplay):
+        (WebCore::EGLDisplayOpenVG::current):
+        (WebCore::EGLDisplayOpenVG::forDisplay):
+        (WebCore::EGLDisplayOpenVG::EGLDisplayOpenVG):
+        (WebCore::EGLDisplayOpenVG::~EGLDisplayOpenVG):
+        (WebCore::EGLDisplayOpenVG::setDefaultPbufferConfig):
+        (WebCore::EGLDisplayOpenVG::defaultPbufferConfig):
+        (WebCore::EGLDisplayOpenVG::setDefaultWindowConfig):
+        (WebCore::EGLDisplayOpenVG::defaultWindowConfig):
+        (WebCore::EGLDisplayOpenVG::sharedPlatformSurface):
+        (WebCore::EGLDisplayOpenVG::createPbufferSurface):
+        (WebCore::EGLDisplayOpenVG::surfaceForWindow):
+        (WebCore::EGLDisplayOpenVG::surfacesCompatible):
+        (WebCore::EGLDisplayOpenVG::destroySurface):
+        (WebCore::EGLDisplayOpenVG::contextForSurface):
+        * platform/graphics/openvg/EGLDisplayOpenVG.h: Added.
+        (WebCore::EGLDisplayOpenVG::display):
+        * platform/graphics/openvg/EGLUtils.h: Added.
+        (toEGLErrorConstant):
+        * platform/graphics/openvg/SurfaceOpenVG.cpp: Added.
+        (WebCore::SurfaceOpenVG::currentSurface):
+        (WebCore::SurfaceOpenVG::SurfaceOpenVG):
+        (WebCore::SurfaceOpenVG::~SurfaceOpenVG):
+        (WebCore::SurfaceOpenVG::isValid):
+        (WebCore::SurfaceOpenVG::width):
+        (WebCore::SurfaceOpenVG::height):
+        (WebCore::SurfaceOpenVG::sharedSurface):
+        (WebCore::SurfaceOpenVG::makeCurrent):
+        (WebCore::SurfaceOpenVG::makeCompatibleCurrent):
+        (WebCore::SurfaceOpenVG::flush):
+        * platform/graphics/openvg/SurfaceOpenVG.h: Added.
+        (WebCore::SurfaceOpenVG::eglDisplay):
+        (WebCore::SurfaceOpenVG::eglSurface):
+        (WebCore::SurfaceOpenVG::eglContext):
+        * platform/graphics/openvg/VGUtils.h: Added.
+        (toVGErrorConstant):
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Renames jni_utility and jni_utility_private to JNIUtility and JNIUtilityPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=33843
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk:
+        * Android.v8bindings.mk:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bridge/jni/JNIUtility.cpp: Copied from WebCore/bridge/jni/jni_utility.cpp.
+        * bridge/jni/JNIUtility.h: Copied from WebCore/bridge/jni/jni_utility.h.
+        * bridge/jni/jni_jsobject.mm:
+        * bridge/jni/jni_objc.mm:
+        * bridge/jni/jni_runtime.cpp:
+        * bridge/jni/jni_runtime.h:
+        * bridge/jni/jni_utility.cpp: Removed.
+        * bridge/jni/jni_utility.h: Removed.
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: Copied from WebCore/bridge/jni/jsc/jni_utility_private.cpp.
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/JNIUtilityPrivate.h: Copied from WebCore/bridge/jni/jsc/jni_utility_private.h.
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        * bridge/jni/jsc/JavaStringJSC.h:
+        * bridge/jni/jsc/jni_utility_private.cpp: Removed.
+        * bridge/jni/jsc/jni_utility_private.h: Removed.
+        * platform/android/GeolocationServiceBridge.cpp:
+        * platform/android/GeolocationServiceBridge.h:
+        * platform/android/TemporaryLinkStubs.cpp:
+
+2010-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Occasional crash when interacting with page with reflected WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=33863
+        
+        If updateCompositingLayers() was called with an updateRoot that was a reflection layer,
+        then we would determine that the layer does not require compositing, and tear down its
+        backing (without clearing replicaLayer() on the source layer's GraphicsLayer).
+        
+        Fix by changing requiresCompositingLayer() on a reflection layer to always give the
+        same answer for a reflection and its original.
+        
+        Also add various belt-and-brances code and null checks to ensure that if we ever end up
+        with a non-composited reflection layer, we won't crash.
+        
+        No new tests, because the crash depends on timing issues that are hard to reproduce in a test.
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::replicaLayer): Make this public so we can use it in an assertion.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking): Clear the source layer's replica layer
+        pointer if tearing down backing store of a reflection.
+        
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Null-check reflection->backing().
+        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry): Null-check reflection->backing().
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry): reflection->backing().
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer): If being called for a reflection layer,
+        use the source layer to answer the question.        
+
+2010-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Some composited reflections incorrectly positioned
+        https://bugs.webkit.org/show_bug.cgi?id=33856
+        
+        When setting the position of the replicated layer inside the reflection, we need to take
+        into account the bounds of the original layer, and the replica layer to get the
+        reflection in the right place.
+
+        Tests: compositing/reflections/nested-reflection-transformed2.html
+               compositing/reflections/reflection-positioning2.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+
+2010-01-19  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION: Infinite recursion in Position::getInlineBoxAndOffset()
+        https://bugs.webkit.org/show_bug.cgi?id=33864
+        <rdar://problem/7552959>
+        
+        Regression has been introduced by changeset 53085.
+        The original fix had to be limited to editable content.
+
+        Test: editing/selection/selection-applet.html
+
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset):
+
+2010-01-19  Kristian Amlie <kristian.amlie@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix qmake warning with qmake in Qt for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=33786
+
+        * WebCore.pro: Use QMAKE_LFLAGS instead of MMP_RULES.
+
+2010-01-19  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33851
+
+        Fixes an issue in the Apple Mac port where ScrollView::platformVisibleContentRect
+        returns the rectangle of the document within the content view of
+        the scroll view (i.e. the rectangle not including scrollbars) when
+        the parameter includeScrollbars == true
+
+        Currently, this behavior contradicts both the comment in ScrollView.h
+        for method visibleContentRect as well as the behavior in
+        ScrollView::visibleContentRect() for a platform-independent scroll view.
+
+        Instead, it should return the rectangle whose dimensions include
+        the scrollbars.
+
+        Also, removes some extra whitespace at the end of the lines.
+
+        No tests included because we cannot test this using either DRT
+        or a manual test.
+
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformVisibleContentRect): If includeScrollbars == true
+        then return the rectangle whose dimensions are that of
+        the frame (i.e. -[NSScrollView frame]).
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Fixes style in WebCore/bridge/jni/jsc/JavaClassJSC
+        https://bugs.webkit.org/show_bug.cgi?id=33819
+
+        No new tests, style fixes only.
+
+        * bridge/jni/jsc/JavaClassJSC.cpp: Modified.
+        * bridge/jni/jsc/JavaClassJSC.h: Modified.
+
+2010-01-19  Jaime Yap  <jaimeyap@google.com>
+
+        Reviewed by Pavel Feldman.
+        
+        Refactors the TimelineRecordFactory and InspectorTimelineAgent to support reporting data
+        when closing a record. Also includes grabbing the start and end line number for parse HTML
+        records as a reference use case for the above refactor
+
+        Tests updated:
+            inspector/timeline-parse-html-expected.txt
+            inspector/timeline-layout-expected.txt
+            inspector/timeline-recalculate-styles-expected.txt
+
+        https://bugs.webkit.org/show_bug.cgi?id=33853
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willDispatchEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didInstallTimer):
+        (WebCore::InspectorTimelineAgent::didRemoveTimer):
+        (WebCore::InspectorTimelineAgent::willFireTimer):
+        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::willEvaluateScript):
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        (WebCore::InspectorTimelineAgent::didMarkTimeline):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::TimelineRecordEntry::TimelineRecordEntry):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createEventDispatchData):
+        (WebCore::TimelineRecordFactory::createGenericTimerData):
+        (WebCore::TimelineRecordFactory::createTimerInstallData):
+        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeData):
+        (WebCore::TimelineRecordFactory::createXHRLoadData):
+        (WebCore::TimelineRecordFactory::createEvaluateScriptData):
+        (WebCore::TimelineRecordFactory::createMarkTimelineData):
+        (WebCore::TimelineRecordFactory::createResourceSendRequestData):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseData):
+        (WebCore::TimelineRecordFactory::createResourceFinishData):
+        (WebCore::TimelineRecordFactory::createPaintData):
+        (WebCore::TimelineRecordFactory::createParseHTMLData):
+        * inspector/TimelineRecordFactory.h:
+
+2010-01-19 Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30883
+        [Gtk] Implement AtkText for HTML elements which contain text
+
+        Moves the text assembling functionality from getPangoLayoutForAtk to
+        textForObject, which webkit_accessible_text_get_text now falls back on
+        when it comes up empty.
+
+        Adds a check in textForObject so that we don't double-add newlines
+        when we have a BR.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (textForObject):
+        (getPangoLayoutForAtk):
+        (webkit_accessible_text_get_text):
+
+2010-01-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        error events don't fire if no <source> elements passed to media engine
+        https://bugs.webkit.org/show_bug.cgi?id=33855
+
+        Test: media/video-source-error-no-candidate.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectMediaResource): Only bail early if
+        there is no 'src' attribute and no <source> child elements at all.
+
+2010-01-19  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33822
+
+        REGRESSION(r53273): Fixes redefinition of XFORM error when building
+        WebKit using Qt Windows with the MinGW compiler.
+ 
+        Note, MinGW has a slightly different declaration of the struct XFORM
+        from that in the Microsoft SDK. So, we need to substitute an alternative
+        typedef for XFORM when compiling with MinGW.
+
+        No functionality was changed. So, no new tests.
+
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2010-01-19  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for crash on large TransparencyWin allocation.  The fix is
+        to leave m_layerValid false when the allocPixels of
+        OwnedBuffers::m_referenceBitmap fails.  Then TransparencyWin won't
+        attempt to use it.
+
+        Will be covered by a new unit test in Chromium's test_shell_tests (when
+        this is rolled into Chromium).
+
+        https://bugs.webkit.org/show_bug.cgi?id=33844
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::initializeNewContext):
+        Early return when m_referenceBitmap or its pixels is NULL, leaving
+        m_layerValid false.
+
+2010-01-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        video.networkState remains NETWORK_LOADING indefinitely when no <source> element was able to be loaded
+        https://bugs.webkit.org/show_bug.cgi?id=33744
+
+        Test: media/video-source-none-supported.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadNextSourceChild): Call waitForSourceChange if
+            there are no valid source elements.
+        (WebCore::HTMLMediaElement::waitForSourceChange): New, set networkState to NETWORK_NO_SOURCE.
+        (WebCore::HTMLMediaElement::setNetworkState): Call waitForSourceChange if the movie
+            hasn't reached HAVE_METADATA and there are no more <source> elements to try.
+        * html/HTMLMediaElement.h: Declare waitForSourceChange.
+
+2010-01-19  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33408
+
+        Implements an optimization to ignore fixed background images
+        (i.e. background-attachment: fixed) when a page does not contain
+        any fixed position elements so as to allow fast repaints (via bit
+        blit) when scrolling a page.
+
+        Currently, if a page has elements that specify either a fixed
+        background or a fixed position then we perform a slow repaint
+        (i.e disable blitting) so as to avoid rendering artifacts.
+        However, on low-powered/mobile devices slow repaints can cause
+        noticeable delays when scrolling a page with a fixed background
+        image. By sacrificing support for fixed background images when
+        there are no fixed elements on the page and with come care, we
+        don't need to force slow repaints and can avoid rendering artifacts.
+        Hence, on such devices we can improve the responsiveness of
+        scrolling a page with a fixed background image.
+
+        Note, this optimization is only enabled if the WebKit is built
+        with FAST_MOBILE_SCROLLING enabled.
+
+        Tests: fast/fast-mobile-scrolling/fixed-position-element.html
+               fast/fast-mobile-scrolling/no-fixed-position-elements.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        Disable fixed background attachment if we can blit on scroll.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+
+2010-01-19  Dave Hyatt  <hyatt@apple.com>
+
+        Build bustage fix.  Land modified WebCore.base.exp file that includes export of currentWorld().
+
+        * WebCore.base.exp:
+
+2010-01-19  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crash in Page::backForwardList when using History object from a detached window
+        <rdar://problem/7556252> and https://bugs.webkit.org/show_bug.cgi?id=33828
+
+        Test: fast/loader/stateobjects/state-api-on-detached-frame-crash.html
+
+        * page/History.cpp:
+        (WebCore::History::stateObjectAdded): Do an early return when detached. The spec
+          doesn't really cover expected behavior and we already do something similar in 
+          other places, such as in History::length().
+
+2010-01-19  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        Revert r53467. Browser crashes on opening inspector if there
+        are messages in console.
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::databaseForId):
+        (WebCore::JSInjectedScriptHost::inspectedWindow):
+        (WebCore::JSInjectedScriptHost::wrapCallback):
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::wrapObject):
+        (WebCore::JSInjectedScriptHost::unwrapObject):
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::JSInjectedScriptHost::selectDatabase):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObject.h:
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::inspectedWindowCallback):
+        (WebCore::V8InjectedScriptHost::wrapCallbackCallback):
+        (WebCore::V8InjectedScriptHost::wrapObjectCallback):
+        (WebCore::V8InjectedScriptHost::unwrapObjectCallback):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::wrapObject):
+        (WebCore::InjectedScriptHost::unwrapObject):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        (WebCore::InspectorController::releaseWrapperObjectGroup):
+        (WebCore::InspectorController::resetInjectedScript):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.requestClearMessages):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._formatarray):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        (InjectedScript.toggleStyleEnabled):
+        (InjectedScript._serializeRule):
+        (InjectedScript._serializeStyle):
+        (InjectedScript.getProperties):
+        (InjectedScript.setPropertyValue):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.getCallFrames):
+        (InjectedScript._inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._resolveObject):
+        (InjectedScript._window):
+        (InjectedScript._objectForId):
+        (InjectedScript.createProxyObject):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        (Object.type):
+        (String.prototype.escapeCharacters):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype.update.inlineStyleCallback):
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        (WebInspector.ObjectProxy.getPropertiesAsync):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2010-01-19  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Inject inspector script directly into the inspected context. All the
+        communication between the script and the frontend is serialized into
+        JSON strings. It allows to get rid of object quarantines in Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32554
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::databaseForId):
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::JSInjectedScriptHost::selectDatabase):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/js/ScriptValue.cpp:
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/v8/ScriptValue.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::releaseWrapperObjectGroup):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::setInjectedScriptSource):
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::injectedScriptForNodeId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.requestClearMessages):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged.InjectedScriptAccess.get addInspectedNode):
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        (injectedScriptConstructor.):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess):
+        (InjectedScriptAccess.getDefault):
+        (get InjectedScriptAccess):
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.prototype.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype.update.inlineStyleCallback):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Unreviewed build fix.
+
+        Fixes Windows build due to http://trac.webkit.org/changeset/53464
+        Updates WebCore.vcproj to reflect renaming of runtime.[cpp|h] to Bridge.[cpp|h]
+
+        No new tests, build fix only.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Renames WebCore/bridge/runtime.[cpp|h] to WebCore/bridge/Bridge.[cpp|h]
+        https://bugs.webkit.org/show_bug.cgi?id=33801
+
+        runtime.[cpp|h] contains general interface classes for use in the bridge,
+        so Bridge is a more appropriate name than runtime.
+
+        No new tests, renaming only.
+
+        * Android.jscbindings.mk:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        * bindings/js/ScriptControllerGtk.cpp:
+        * bindings/js/ScriptControllerHaiku.cpp:
+        * bindings/js/ScriptControllerMac.mm:
+        * bindings/js/ScriptControllerQt.cpp:
+        * bindings/js/ScriptControllerWin.cpp:
+        * bindings/js/ScriptControllerWx.cpp:
+        * bindings/js/ScriptInstance.h:
+        * bindings/objc/WebScriptObject.mm:
+        * bridge/Bridge.cpp: Copied from WebCore/bridge/runtime.cpp.
+        * bridge/Bridge.h: Copied from WebCore/bridge/runtime.h.
+        * bridge/c/c_class.h:
+        * bridge/c/c_instance.h:
+        * bridge/c/c_runtime.h:
+        * bridge/jni/jni_instance.h:
+        * bridge/objc/objc_runtime.h:
+        * bridge/qt/qt_class.h:
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        * bridge/qt/qt_runtime.h:
+        * bridge/runtime.cpp: Removed.
+        * bridge/runtime.h: Removed.
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.h:
+        * bridge/runtime_root.cpp:
+        * bridge/testbindings.cpp:
+        * bridge/testbindings.mm:
+        * bridge/testqtbindings.cpp:
+        * page/win/FrameWin.cpp:
+        * platform/graphics/wince/MediaPlayerProxy.cpp:
+        * plugins/PluginView.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/symbian/PluginViewSymbian.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2010-01-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
+
+        Test: fast/workers/worker-gc2.html
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController): Removed some
+        ASSERTs that have moved to JavaScriptCore.
+
+2010-01-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Reverting r53455, breaks 2 javascriptcore tests.
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
+
+2010-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
+
+        Test: fast/workers/worker-gc2.html
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController): Removed some
+        ASSERTs that have moved to JavaScriptCore.
+
+2010-01-18  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33089
+
+        Implements all of the alphabetic CSS3 list-style-types as per
+        section 4.4 of the CSS3 Lists module <http://www.w3.org/TR/css3-lists/#alphabetic>.
+
+        Test: fast/lists/w3-css3-list-styles-alphabetic.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Updated comment to include
+        added list-style-types.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added new list style types,
+        alphabetized enums, and removed indent to conform to the WebKit Code Style Guidelines.
+        * css/CSSValueKeywords.in:
+        * inspector/front-end/CSSSourceSyntaxHighlighter.js:
+        (WebInspector.CSSSourceSyntaxHighlighter): Added new list style types
+        and alphabetized array valueKeywords.
+        * platform/text/CharacterNames.h: Added constant ethiopicPrefaceColon.
+        * rendering/RenderListMarker.cpp:
+        (WebCore::toAlphabetic):
+        (WebCore::listMarkerSuffix): Added.
+        (WebCore::listMarkerText):
+        (WebCore::RenderListMarker::paint): Modified to call WebCore::listMarkerSuffix.
+        (WebCore::RenderListMarker::calcPrefWidths): Ditto.
+        (WebCore::RenderListMarker::getRelativeMarkerRect): Ditto.
+        * rendering/style/RenderStyle.h:
+        (WebCore::):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2010-01-18  Daniel Bates  <dbates@webkit.org>
+
+        Unreviewed, fix misspelling of the word maximum in comment.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::maximum):
+
+2010-01-18  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        <rdar://problem/7476957> REGRESSION (r49567): Business widget list does not line up: too tall due to line height rounding change
+
+        Reverted r49567.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::lineHeight):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::computedLineHeight):
+
+2010-01-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific implementation of JavaString to a private implementation class.
+        https://bugs.webkit.org/show_bug.cgi?id=33558
+
+        Also modifies JavaField::name and JavaMethod::name to return const JavaString&, rather than UString::Rep*,
+        which is JSC-specific. This allows this code to be used with both JSC and V8, as required by Android.
+
+        No new tests, refactoring only.
+
+        * WebCore.xcodeproj/project.pbxproj: Modified. Added JavaStringJSC.h
+        * bridge/jni/jni_class.cpp: Modified.
+        (JavaClass::JavaClass): Modified. Updates call sites of JavaField::name and JavaMethod::name.
+        * bridge/jni/jni_runtime.h: Modified.
+        (JSC::Bindings::JavaString::JavaString): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaString::UTF8String): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaString::uchars): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaString::length): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaString::operator UString): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaField::name): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaMethod::name): Modified. Pass through to implementation.
+        * bridge/jni/jsc/JavaStringJSC.h: Added.
+        (JSC::Bindings::JavaStringImpl::~JavaStringImpl):
+        (JSC::Bindings::JavaStringImpl::init):
+        (JSC::Bindings::JavaStringImpl::UTF8String):
+        (JSC::Bindings::JavaStringImpl::uchars):
+        (JSC::Bindings::JavaStringImpl::length):
+        (JSC::Bindings::JavaStringImpl::uString):
+
+2010-01-18  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Darin Adler.
+
+        Skip an error after invalid blocks in a CSS expression.
+        https://bugs.webkit.org/show_bug.cgi?id=33650
+
+        * css/CSSGrammar.y:
+
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler & Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from WebCore::StringImpl.
+
+        These break the OS X Leaks tool.  Move the management of null-terminated copies
+        out from StringImpl to String, and use a bit stolen from the refCount to hold the
+        'InTable' flag.
+
+        * platform/sql/SQLiteFileSystem.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/SQLiteStatement.cpp:
+        (WebCore::SQLiteStatement::prepare):
+        * platform/sql/SQLiteStatement.h:
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::copyWithNullTermination):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::crossThreadString):
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+
+2010-01-18  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Rewrite SVG <use> support in a modern-fashion
+        https://bugs.webkit.org/show_bug.cgi?id=33776
+
+        Tests: svg/custom/relative-sized-deep-shadow-tree-content.xhtml
+               svg/custom/relative-sized-shadow-tree-content.xhtml
+
+        Fixes: svg/W3C-SVG-1.1/animate-elem-30-t.svg (animated circle sometimes takes wrong path)
+
+        Rewrite <use> support in less intrusive way. Try hard to avoid recloning where possible, and do it lazily.
+        Introduce RenderSVGShadowTreeRootContainer as special renderer for SVGUseElement, that now manages the
+        render tree, instead of SVGUseElement manually hacking around it's own renderer from the DOM side.
+
+        Instead of recloning the whole shadow tree for every attribute change (DOM setAttribute / SVG DOM changes / CSS changes / childrenChanged()...)
+        just notify the RenderSVGShadowTreeRootContainer that it's supposed to reclone the tree upon the next updateFromElement() call.
+
+        updateFromElement() is fired from SVGUseElement::attach() / recalcStyle(), as it's done for HTMLFormControlElement/HTMLMediaElement, thus
+        lazily recloning the shadow tree if necessary.
+
+        Animations for <use> elements was a real performance bottlenck as the tree got recloned on every attribute change. Reclones are _completly_
+        avoided for animations now - the SVGAnim*Element classes already updated the instances of an element manually, though that resulted in a reclone
+        nontheless, and thus killing performance. <use> elements can only be recloned through mutations of the elements that they reference to.
+        For example referencing a <rect> element from a <use> element and scripting the <rect> element (setAttribute, or child tree mutations etc.).
+        We reclone instead of trying to synchronize trees - as it's currenty implemented - because it's very hard to do it right.
+
+        Any DOM / SVG DOM / CSS change on the <use> element don't reclone the tree anymore, this is a huge speed benefit.
+        x/y attribute changes are correctly handled in the render tree now (by an additional local transformation), now percentual values work
+        as expected, and resize on window changes - affecting lots of testcases.
+
+        The <use> implementation is much safer now, not doing any mutations synchronously from svgAttributeChanged etc.
+        Remove hack to force garbage collection on SVGElementInstance destruction - can't reproduce it anymore.
+
+        * Android.mk: Add new files to build.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * rendering/RenderSVGShadowTreeRootContainer.cpp: Added. This is the rendered now created by SVGUseElement.
+        (WebCore::RenderSVGShadowTreeRootContainer::RenderSVGShadowTreeRootContainer):
+        (WebCore::RenderSVGShadowTreeRootContainer::~RenderSVGShadowTreeRootContainer):
+        (WebCore::RenderSVGShadowTreeRootContainer::updateStyle): Used form SVGUseElement to request style recalculations for the shadow tree renderers
+        (WebCore::RenderSVGShadowTreeRootContainer::updateFromElement): Used from SVGUseElement attach/recalcStyle to eventually request shadow tree updates.
+        (WebCore::RenderSVGShadowTreeRootContainer::styleDidChange): Used to propage style updates across shadow tree boundaries.
+        * rendering/RenderSVGShadowTreeRootContainer.h: Added.
+        (WebCore::RenderSVGShadowTreeRootContainer::markShadowTreeForRecreation): Marks the shadow tree for a reclone, next time updateFromElement is used.
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::calculateLocalTransform): Take containerTranslation() into account, supplied by RenderSVGSDhadowTreeContainer.
+        * rendering/SVGShadowTreeElements.cpp: Added. This is the root element of the SVG shadow tree residing as (hidden) child of SVGUseElement (DOM wise).
+        (WebCore::SVGShadowTreeContainerElement::SVGShadowTreeContainerElement):
+        (WebCore::SVGShadowTreeContainerElement::~SVGShadowTreeContainerElement):
+        (WebCore::SVGShadowTreeContainerElement::containerTranslation): Used from calculateLocalTransform() to take x/y translation into account for shadow tree container elements.
+        (WebCore::SVGShadowTreeRootElement::SVGShadowTreeRootElement):
+        (WebCore::SVGShadowTreeRootElement::~SVGShadowTreeRootElement):
+        (WebCore::SVGShadowTreeRootElement::attachElement): Used by RenderSVGShadowTreeRootContainer, instead of attach(), as we're a shadow tree root node.
+        * rendering/SVGShadowTreeElements.h: Added. This is the root element of each SVG shadow sub-tree (whenever a <use> element is expanded in the shadow tree).
+        (WebCore::SVGShadowTreeContainerElement::isShadowTreeContainerElement): Return true here.
+        (WebCore::SVGShadowTreeContainerElement::setContainerOffset): Used from SVGUseElement to propagate x/y translation values set on <use> elements in the shadow tree.
+        (WebCore::SVGShadowTreeRootElement::isShadowNode): Identify us as shadow node.
+        (WebCore::SVGShadowTreeRootElement::shadowParentNode): Ditto. Return actual shadow parent node (== corresponding use element).
+        * svg/SVGElement.cpp: Shrink size of all SVG*Elements, by removing the m_shadowParent parent. SVGShadowTreeRootElement is the new base class for shadow tree.
+        (WebCore::SVGElement::SVGElement):
+        (WebCore::SVGElement::eventParentNode): Call virtual shadowParentNode() method, instead of accessing m_shadowParent.
+        * svg/SVGElement.h: Remove isShadowNode() / shadowParentNode() / setShadowParentNode().
+        * svg/SVGElementInstance.cpp: Remove the hack, calling garbage collection before destruction. Can't reproduce this anymore, let's see what the bots say.
+        (WebCore::SVGElementInstance::SVGElementInstance): Remove now unnecessary m_needsUpdate flag.
+        (WebCore::SVGElementInstance::invalidateAllInstancesOfElement): Don't invalidate if instance updates are blocked (see SVGStyledElement changes)
+        * svg/SVGElementInstance.h: Remove m_needsUpdate, and forgetWrapper() method.
+        * svg/SVGGElement.h:
+        (WebCore::SVGGElement::isShadowTreeContainerElement): Add new virtual method here returning false by default, SVGShadowTreeContainerElement will override it.
+        * svg/SVGStyledElement.cpp: Remove gElementsWithInstanceUpdatesBlocked HashSet tracking the state of instancesUpdatesBlocked() per SVGStyledElement - make it a member variable.
+        * svg/SVGStyledElement.h: Add inline getter/setters around m_instanceUpdatesBlocked.
+        (WebCore::SVGStyledElement::instanceUpdatesBlocked):
+        (WebCore::SVGStyledElement::setInstanceUpdatesBlocked):
+        * svg/SVGUseElement.cpp: Full rewrite of <use> support, a detailed discussion would blow the ChangeLog - see short version above.
+        (WebCore::SVGUseElement::SVGUseElement):
+        (WebCore::SVGUseElement::instanceRoot):
+        (WebCore::SVGUseElement::insertedIntoDocument):
+        (WebCore::SVGUseElement::removedFromDocument):
+        (WebCore::SVGUseElement::svgAttributeChanged):
+        (WebCore::updateContainerOffset):
+        (WebCore::SVGUseElement::updateContainerOffsets):
+        (WebCore::SVGUseElement::recalcStyle):
+        (WebCore::dumpInstanceTree):
+        (WebCore::SVGUseElement::buildPendingResource):
+        (WebCore::SVGUseElement::buildShadowAndInstanceTree):
+        (WebCore::SVGUseElement::createRenderer):
+        (WebCore::updateFromElementCallback):
+        (WebCore::SVGUseElement::attach):
+        (WebCore::SVGUseElement::detach):
+        (WebCore::SVGUseElement::toClipPath):
+        (WebCore::SVGUseElement::buildInstanceTree):
+        (WebCore::SVGUseElement::handleDeepUseReferencing):
+        (WebCore::SVGUseElement::buildShadowTree):
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree):
+        (WebCore::SVGUseElement::expandSymbolElementsInShadowTree):
+        (WebCore::SVGUseElement::instanceForShadowTreeElement):
+        (WebCore::SVGUseElement::invalidateShadowTree):
+        (WebCore::SVGUseElement::transferUseAttributesToReplacedElement):
+        * svg/SVGUseElement.h:
+        (WebCore::SVGUseElement::isPendingResource):
+
+2010-01-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=month.
+        https://bugs.webkit.org/show_bug.cgi?id=33021
+
+        Introduce ISODateTime::setMillisecondsSinceEpochForMonth() and
+        toString() for the Month type, and HTMLInputElement::setValueAsDate()
+        calls them.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValueAsDate):
+        * html/ISODateTime.cpp:
+        (WebCore::beforeGregorianStartDate):
+        (WebCore::ISODateTime::addDay): Use beforeGregorianStartDate().
+        (WebCore::ISODateTime::parseMonth): Use beforeGregorianStartDate().
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForDateInternal):
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForMonth):
+        (WebCore::ISODateTime::toString): Implement only for the Month type.
+        * html/ISODateTime.h:
+
+2010-01-18  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Script attributes are copied and pasted, making cross-domain attacks possible (30019)
+        <rdar://problem/6008809>
+        https://bugs.webkit.org/show_bug.cgi?id=30019
+
+        When we create the document fragment from a markup string,
+        either to perform a paste operation or a drag and drop, we
+        want to remove all the event handlers and any attribute that contain
+        a value that leads to code execution.
+        The HTMLParser class is now aware of the needs of stripping these attributes.
+        I've modified the call to createMarkupString for every platform.
+
+        Test: editing/pasteboard/paste-noscript.html
+
+        * WebCore.base.exp:
+        * dom/Element.cpp:
+        (WebCore::isEventHandlerAttribute):
+        (WebCore::Element::setAttributeMap):
+        * dom/Element.h:
+        * dom/MappedAttributeEntry.h:
+        (WebCore::):
+        * editing/markup.cpp:
+        (WebCore::createFragmentFromMarkup):
+        * editing/markup.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::createContextualFragment):
+        * html/HTMLElement.h:
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::HTMLParser):
+        (WebCore::HTMLParser::parseToken):
+        * html/HTMLParser.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::HTMLTokenizer):
+        (WebCore::parseHTMLDocumentFragment):
+        * html/HTMLTokenizer.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asFragment):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asFragment):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::fragmentFromCF_HTML):
+        (WebCore::fragmentFromHTML):
+
+2010-01-18  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=33816>        
+        Crashes in Geolocation code due to refcounting, observer balance issues.
+        
+        Hold a ref to the GeoNotifier while dispatching a callback. The code was
+        copying a data member to avoid accessing a freed this ptr, but was still
+        using the this ptr.
+        
+        Geolocation::removeObserver calls are not always balanced with addObserver.
+        Instead of asserting and continuing, don't try to remove non-existant
+        observers.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::GeoNotifier::timerFired): Protect notifier.
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::removeObserver): Change ASSERT into an if with early return.
+
+2010-01-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33815
+        Crash when using DOMTimer from a detached frame
+
+        Test: fast/dom/Window/timer-null-script-execution-context.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Make setTimer and setInterval raise an exception. It is not specified in HTML5, but both
+        IE and Firefox do raise an exception in this situation, although different ones.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setTimeout): Raise INVALID_ACCESS_ERR if script execution context is
+        null (meaning that the window is detached).
+        (WebCore::DOMWindow::setInterval): Ditto.
+        (WebCore::DOMWindow::clearTimeout): Silently return early if there is no script execution
+        context.
+        (WebCore::DOMWindow::clearInterval): Ditto.
+        Raise INVALID_ACCESS_ERR if script execution context is null (meaning .
+
+2010-01-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific version of JavaClass from bridge/jni/jni_class to bridge/jni/jsc/JavaClassJSC
+        https://bugs.webkit.org/show_bug.cgi?id=33561
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk: Modified. Removed jni_class.cpp and added JavaClassJSC.cpp
+        * GNUmakefile.am: Modified. Removed jni_class.h and added JavaClassJSC.h
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removed jni_class.[cpp|h] and added JavaClassJSC.[cpp|h]
+        * bridge/jni/jni_class.cpp: Removed.
+        * bridge/jni/jni_class.h: Removed.
+        * bridge/jni/jsc/JavaClassJSC.cpp: Copied from WebCore/bridge/jni/jni_class.cpp.
+        * bridge/jni/jsc/JavaClassJSC.h: Copied from WebCore/bridge/jni/jni_class.h.
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Modified. Includes JavaClassJSC.h
+
+2010-01-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Fix style in WebCore/bridge/jni/jsc/JavaInstanceJSC.[cpp|h]
+        https://bugs.webkit.org/show_bug.cgi?id=33792
+
+        No new tests, style fixes only.
+
+        * bridge/jni/jni_runtime.cpp: Modified.
+        (JavaField::dispatchValueFromInstance): Modified. Updated to use renamed JavaInstance::m_instance
+        (JavaField::dispatchSetValueToInstance): Modified. Updated to use renamed JavaInstance::m_instance
+        (JavaArray::JavaArray): Modified. Updated to use renamed JavaInstance::m_instance
+        * bridge/jni/jni_runtime.h: Modified.
+        (JSC::Bindings::JavaArray::javaArray): Modified. Updated to use renamed JavaInstance::m_instance
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Modified. Fixed style
+        * bridge/jni/jsc/JavaInstanceJSC.h: Modified. Fixed style
+
+2010-01-18  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30073
+        Moved reshape to HTMLCanvasElement::reset and have it always
+        set the size to the canvas width and height attrs.
+
+        This is not testable with LayoutTests, so I instead added logic
+        to the demo at:
+
+        https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/demos/webkit/SpinningBox.html
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::reset):
+        (WebCore::HTMLCanvasElement::paint):
+
+2010-01-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33813
+        <rdar://problem/7545104> Crash when using DOMApplicationCache from a destroyed frame
+
+        Test: http/tests/appcache/destroyed-frame.html
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::scriptExecutionContext): Return null when there is no frame.
+
+2010-01-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r53420): incomplete repaint of bottom of bugs.webkit.org comment field
+        https://bugs.webkit.org/show_bug.cgi?id=33809
+
+        Test: fast/repaint/trailing-floats-root-line-box-overflow.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Copy bottom overflow from the last
+        root box to the trailing floats box, which is becoming the last root box. This is
+        needed because painting code assumes that the last line in a block is the one with the
+        lowest overflow bottom.
+
+2010-01-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed trivial buildfix. (r53429)
+
+        * WebCore.pri: missing XMLNS_NAMES added.
+
+2010-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Removed unnecessary use of scriptExecutionContext() when creating a JS event listener.
+        https://bugs.webkit.org/show_bug.cgi?id=33811
+
+        This change simplifies a bunch of code, and also reduces
+        the number of places that use the difficult-to-understand and possibly
+        crashy-null scriptExecutionContext() idiom.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSEventListener.h:
+        (WebCore::createJSAttributeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2010-01-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33787
+        Add constants for more XML strings
+
+        No change in functionality, so no tests.
+
+        * WebCore/xml/xmlnsattrs.in: Added a new file for xmlns namespace and attribute - 
+        XMLNames.{h,cpp} are auto-generated, and I dodn't see a reasonable way to extend it.
+
+        * platform/text/AtomicString.cpp: (WebCore::AtomicString::init):
+        * platform/text/AtomicString.h:
+        Added atomic strings for "xml" and "xmlns".
+
+        * page/Frame.cpp: (WebCore::Frame::Frame): Call XMLNSNames::init().
+
+        * dom/Attr.cpp: (WebCore::Attr::setPrefix):
+        * dom/Document.cpp:
+        (WebCore::Document::hasPrefixNamespaceMismatch):
+        (WebCore::Document::createAttributeNS):
+        * dom/Node.cpp:
+        (WebCore::Node::checkSetPrefix):
+        (WebCore::Node::isDefaultNamespace):
+        (WebCore::Node::lookupNamespaceURI):
+        (WebCore::Node::lookupNamespacePrefix):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::handleElementNamespaces):
+        * editing/markup.cpp:
+        (WebCore::shouldAddNamespaceAttr):
+        (WebCore::appendNamespace):
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::nodeMatchesBasicTest):
+        (WebCore::XPath::Step::nodesInAxis):
+        Use the new constants.
+
+        * Android.derived.mk:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Added the new files to projects.
+
+2010-01-18  Anders Carlsson  <andersca@apple.com>
+
+        Fix !ENABLE(3D_CANVAS) build.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::is3DCanvas):
+
+2010-01-18  Timothy Hatcher  <timothy@apple.com>
+
+        Adjust the scroll position when doing a full page zoom, so the content
+        stays in relatively the same position.
+
+        <rdar://problem/6150099> Zooming should keep the page content in the same place
+
+        Reviewed by Oliver Hunt.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setZoomFactor): Apply the zoom percent difference to
+        the scroll position, only when doing a full page zoom.
+
+2010-01-18  Adam Roben  <aroben@apple.com>
+
+        Add SecurityOrigin::{set,is}DomainRelaxationForbiddenForURLScheme and
+        respect it
+
+        WebCore part of fixing <http://webkit.org/b/33806>
+        <rdar://problem/7552837> Would like API to disallow setting of
+        document.domain for pages with certain URL schemes
+
+        Test: http/tests/security/setDomainRelaxationForbiddenForURLScheme.html
+
+        Reviewed by Sam Weinig.
+
+        * WebCore.base.exp: Export
+        SecurityOrigin::setDomainRelaxationForbiddenForURLScheme.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setDomain): If domain relaxation is forbidden for
+        our security origin's scheme, throw an exception and don't allow
+        the domain to be set.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::schemesForbiddenFromDomainRelaxation): Added. Returns a
+        global set of schemes.
+        (WebCore::SecurityOrigin::setDomainRelaxationForbiddenForURLScheme):
+        Add or remove the scheme to schemesForbiddenFromDomainRelaxation, as
+        appropriate.
+        (WebCore::SecurityOrigin::isDomainRelaxationForbiddenForURLScheme):
+        Returns true if the scheme is in schemesForbiddenFromDomainRelaxation.
+
+        * page/SecurityOrigin.h: Added
+        {set,is}DomainRelaxationForbiddenForURLScheme.
+
+2010-01-18  Dan Bernstein  <mitz@apple.com>
+
+        Address review comments on the last change
+
+        * rendering/TrailingFloatsRootInlineBox.h:
+        (WebCore::TrailingFloatsRootInlineBox::TrailingFloatsRootInlineBox):
+
+2010-01-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6892207> REGRESSION (Safari 4): Menus at sciencedirect.com push the main article context down the page
+        <rdar://problem/7546035> Second right floated image misplacment
+        https://bugs.webkit.org/show_bug.cgi?id=33245
+
+        Test: fast/dynamic/float-in-trailing-whitespace-after-last-line-break-2.html
+
+        When the last line of a block contains a line break and there are floats
+        after the line break, it is incorrect to put those floats in the last line’s
+        floats vector (along with floats from before the break). Instead, create
+        an additional line box (a TrailingFloatsRootInlineBox) and put those floats
+        in its floats vector. 
+
+        * WebCore.vcproj/WebCore.vcproj: Added TrailingFloatsRootInlineBox.h
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::markLinesDirtyInVerticalRange): Added an optional
+        parameter, which is the highest line to dirty.
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Create a TrailingFloatsRootInlineBox
+        for the floats occurring after the line break on the last line.
+        (WebCore::RenderBlock::determineStartPosition): Prevent dirtying of lines
+        above the first dirty line.
+        * rendering/TrailingFloatsRootInlineBox.h: Added.
+        (WebCore::TrailingFloatsRootInlineBox::TrailingFloatsRootInlineBox): Call
+        setHasVirtualHeight().
+        (WebCore::TrailingFloatsRootInlineBox::virtualHeight): Return 0.
+
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Eeeep! reverting r53416 & r53417, more to be done to fix windows.
+
+        * WebCore.base.exp:
+        * platform/sql/SQLiteFileSystem.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/SQLiteStatement.cpp:
+        (WebCore::SQLiteStatement::prepare):
+        * platform/sql/SQLiteStatement.h:
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::charactersWithNullTermination):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::operator new):
+        (WebCore::StringImpl::operator delete):
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::createWithTerminatingNullCharacter):
+        (WebCore::StringImpl::crossThreadString):
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::hasTerminatingNullCharacter):
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+        (WebCore::StringImpl::):
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::createGlobalData):
+        * storage/OriginUsageRecord.cpp:
+        (WebCore::OriginUsageRecord::addDatabase):
+        (WebCore::OriginUsageRecord::markDatabase):
+
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix).
+
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::createGlobalData):
+
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from WebCore::StringImpl.
+
+        These break the OS X Leaks tool.  Move the management of null-terminated copies
+        out from StringImpl to String, and use a bit stolen from the refCount to hold the
+        'InTable' flag.
+
+        * platform/sql/SQLiteFileSystem.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/SQLiteStatement.cpp:
+        (WebCore::SQLiteStatement::prepare):
+        * platform/sql/SQLiteStatement.h:
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::copyWithNullTermination):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::crossThreadString):
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+
+2010-01-18  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Made root compositing layer scroll rather than scroll parent.
+        https://bugs.webkit.org/show_bug.cgi?id=32279
+        
+        There's some general cleanup here so the frames, bounds and
+        positions of all the associated layers are correct.
+        I also changed API of setScrollFrame to use an IntRect.
+
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::WKCACFLayerRenderer):
+        (WebCore::WKCACFLayerRenderer::setScrollFrame):
+        (WebCore::WKCACFLayerRenderer::setRootChildLayer):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+        (WebCore::WKCACFLayerRenderer::resize):
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+
+2010-01-18  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        WebInspector: Timeline panel scrolling speed can be 2 times faster.
+        https://bugs.webkit.org/show_bug.cgi?id=33794
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.calculateWindow):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+
+2010-01-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific version of JavaInstance from bridge/jni/jni_instance to bridge/jni/jsc/JavaInstanceJSC
+        https://bugs.webkit.org/show_bug.cgi?id=33672
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk: Modified. Removed jni_instance.cpp and added JavaInstanceJSC.cpp
+        * GNUmakefile.am: Modified. Removed jni_instance.h and added JavaInstanceJSC.h
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removed jni_instance.[cpp|h] and added JavaInstanceJSC.[cpp|h]
+        * bindings/js/ScriptControllerMac.mm: Modified. Includes JavaInstanceJSC.h
+        * bridge/jni/jni_instance.cpp: Removed.
+        * bridge/jni/jni_instance.h: Removed.
+        * bridge/jni/jni_runtime.h: Modified. Includes JavaInstanceJSC.h
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Copied from WebCore/bridge/jni/jni_instance.cpp.
+        * bridge/jni/jsc/JavaInstanceJSC.h: Copied from WebCore/bridge/jni/jni_instance.h.
+
+2010-01-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Barth.
+
+        Simplify image decoders slightly by using OwnPtr instead of raw pointers
+        and eliminating a basically-useless wrapper class in the GIF decoder.
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::~ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::internalReadImage):
+        (WebCore::ImageDecoderQt::failRead):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::GIFImageDecoder):
+        (WebCore::GIFImageDecoder::~GIFImageDecoder):
+        (WebCore::GIFImageDecoder::setData):
+        (WebCore::GIFImageDecoder::frameCount):
+        (WebCore::GIFImageDecoder::repetitionCount):
+        (WebCore::GIFImageDecoder::decode):
+        (WebCore::GIFImageDecoder::decodingHalted):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::gifComplete):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::JPEGImageDecoder):
+        (WebCore::JPEGImageDecoder::~JPEGImageDecoder):
+        (WebCore::JPEGImageDecoder::setData):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::PNGImageDecoder):
+        (WebCore::PNGImageDecoder::~PNGImageDecoder):
+        (WebCore::PNGImageDecoder::setData):
+        (WebCore::PNGImageDecoder::decode):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+        * platform/image-decoders/png/PNGImageDecoder.h:
+
+2010-01-18  Daniel Cheng  <dcheng@google.com>
+
+        Reviewed by Adam Roben.
+
+        DataTransfer interface broken on Windows--types member is always
+        undefined, and getData() does not work.
+        https://bugs.webkit.org/show_bug.cgi?id=30527
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::addMimeTypesForFormat): pass FORMATETC as a const ref.
+        (WebCore::ClipboardWin::types): fix calls to IEnumFORMATETC.
+        (WebCore::ClipboardWin::hasData): fix calls to IEnumFORMATETC.
+
+2010-01-18  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Don't show Profiles welcome screen on panel switch,
+        if a profile view is shown.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33799
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.show):
+
+2010-01-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Force qmake to generate a single makefile for DerivedSources.pro
+
+        * DerivedSources.pro:
+
+2010-01-18  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add support for enabling navigator.geolocation at runtime in the V8 bindings.
+        Adds the [EnabledAtRuntime] modifier to the navigator IDL.
+        https://bugs.webkit.org/show_bug.cgi?id=33467
+
+        * WebCore.gypi:
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setGeolocationEnabled):
+        (WebCore::RuntimeEnabledFeatures::geolocationEnabled):
+        * bindings/v8/custom/V8NavigatorCustom.cpp: Added.
+        (WebCore::V8Navigator::GeolocationEnabled):
+        * page/Navigator.cpp:
+        (WebCore::Navigator::geolocation):
+        * page/Navigator.idl:
+
+2010-01-18  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Improve Resources panel performance for lots of resources
+
+        DOM properties are extracted into const's, comparisons are faster.
+        https://bugs.webkit.org/show_bug.cgi?id=33790
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.CompareByStartTime):
+        (WebInspector.Resource.CompareByResponseReceivedTime):
+        (WebInspector.Resource.CompareByEndTime):
+        (WebInspector.Resource.CompareByDuration):
+        (WebInspector.Resource.CompareByLatency):
+        (WebInspector.Resource.CompareBySize):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceGraph.prototype.refreshLabelPositions):
+
+2010-01-18  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33726
+
+        Following up on changes made with respect to bug #33498, we should
+        fix the the style errors found by the style bot.
+        
+        Moreover, this fixes all the style errors found by check-webkit-style
+        except the use of an underline in the variable name _niflags. We should
+        fix this in a second run through for all the other variables names that
+        contain an underline because there are many.
+
+        No functionality was changed. So, no new tests.
+
+        * rendering/style/SVGRenderStyle.h:
+        (WebCore::SVGRenderStyle::create):
+        (WebCore::SVGRenderStyle::copy):
+        (WebCore::SVGRenderStyle::operator!=):
+        (WebCore::SVGRenderStyle::hasStroke):
+        (WebCore::SVGRenderStyle::hasFill):
+        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
+        (WebCore::SVGRenderStyle::InheritedFlags::operator!=):
+        (WebCore::SVGRenderStyle::NonInheritedFlags::operator==):
+        (WebCore::SVGRenderStyle::NonInheritedFlags::operator!=):
+        (WebCore::SVGRenderStyle::NonInheritedFlags::):
+        (WebCore::SVGRenderStyle::):
+        (WebCore::SVGRenderStyle::setBitDefaults):
+
+2010-01-18  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] DOMWrapperMap::Visitor needs virtual destructor
+        https://bugs.webkit.org/show_bug.cgi?id=33675
+
+        Add protected virtual dtor to DOMWrapperMap::Visitor. See bug for further discussion.
+
+        No new tests needed, functionality not changed.
+
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::DOMWrapperMap::Visitor::~Visitor): Added.
+
+2010-01-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Symbian build fix.
+
+        If we don't link with def files, then we have to pass EXPORTUNFROZEN,
+        so that the build system still creates the .dso files in
+        release/armv5/lib and we can actually link against the created QtWebKit
+        dlls.
+
+        Thanks Iain for the help!
+
+        * WebCore.pro:
+
+2010-01-17  Srinidhi Shreedhara  <srinidhi.shreedhara@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] [Symbian] SetWindow call in npapi plugin does not happen when the cooridnates are negative
+        https://bugs.webkit.org/show_bug.cgi?id=33573
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded): Remove tests for negative
+        coordinates for early return.
+
+2010-01-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r52449): SVG mask wrongly clipped when not at origin for recent nightly build
+        https://bugs.webkit.org/show_bug.cgi?id=33782
+
+        Test: svg/custom/transformedMaskFails.svg
+
+        When computing the bounds for elements in a mask, we iterate through
+        all of our children requesting their repaint bounds using
+        repaintRectInLocalCoordinates(), but we were not converting that
+        rect into our own coordinate system, thus leading to an incorrect
+        repaint rect.  This patch simply adds the missing localToParent
+        transform.
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2010-01-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Avoid slow access to AX objects on attribute access when AX is off
+        https://bugs.webkit.org/show_bug.cgi?id=33779
+
+        ~4% Dromaeo attributes test speedup
+
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged): Don't do expensive lookup of
+        AX object cache unless accessibility is on and an AX-related attribute is
+        changed.
+
+2010-01-17  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] On Win and GTK, we need to manually apply the transforms when falling back
+        to GDI / GDK drawing, but this is not needed on Mac since we always use CG there.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=33730
+
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::paintButton):
+
+2010-01-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] GtkWebKit incompatible with rgba colormaps
+        https://bugs.webkit.org/show_bug.cgi?id=20736
+
+        Fix GTK theme rendering onto drawables with RGBA colormaps. Now
+        each type of colormap has its own collection of GtkWidgets.
+
+        This fix does not introduce any functionality changes, so does not
+        includes new tests.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::RenderThemeGtk):
+        (WebCore::RenderThemeGtk::~RenderThemeGtk):
+        (WebCore::RenderThemeGtk::partsForDrawable):
+        (WebCore::adjustMozillaStyle):
+        (WebCore::setMozillaState):
+        (WebCore::paintMozillaGtkWidget):
+        (WebCore::setToggleSize):
+        (WebCore::RenderThemeGtk::setCheckboxSize):
+        (WebCore::RenderThemeGtk::paintCheckbox):
+        (WebCore::RenderThemeGtk::setRadioSize):
+        (WebCore::RenderThemeGtk::paintRadio):
+        (WebCore::RenderThemeGtk::paintButton):
+        (WebCore::RenderThemeGtk::adjustMenuListStyle):
+        (WebCore::RenderThemeGtk::paintMenuList):
+        (WebCore::RenderThemeGtk::adjustTextFieldStyle):
+        (WebCore::RenderThemeGtk::paintTextField):
+        (WebCore::RenderThemeGtk::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeGtk::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeGtk::paintSearchFieldCancelButton):
+        * platform/gtk/RenderThemeGtk.h:
+        * platform/gtk/gtk2drawing.c:
+        (moz_gtk_use_theme_parts):
+        (ensure_window_widget):
+        (setup_widget_prototype):
+        (ensure_button_widget):
+        (ensure_hpaned_widget):
+        (ensure_vpaned_widget):
+        (ensure_toggle_button_widget):
+        (ensure_button_arrow_widget):
+        (ensure_checkbox_widget):
+        (ensure_radiobutton_widget):
+        (ensure_scrollbar_widget):
+        (ensure_spin_widget):
+        (ensure_scale_widget):
+        (ensure_entry_widget):
+        (moz_gtk_get_combo_box_inner_button):
+        (moz_gtk_get_combo_box_button_inner_widgets):
+        (ensure_combo_box_widgets):
+        (moz_gtk_get_combo_box_entry_inner_widgets):
+        (moz_gtk_get_combo_box_entry_arrow):
+        (ensure_combo_box_entry_widgets):
+        (ensure_handlebox_widget):
+        (ensure_toolbar_widget):
+        (ensure_toolbar_separator_widget):
+        (ensure_tooltip_widget):
+        (ensure_tab_widget):
+        (ensure_progress_widget):
+        (ensure_statusbar_widget):
+        (ensure_frame_widget):
+        (ensure_menu_bar_widget):
+        (ensure_menu_bar_item_widget):
+        (ensure_menu_popup_widget):
+        (ensure_menu_item_widget):
+        (ensure_image_menu_item_widget):
+        (ensure_menu_separator_widget):
+        (ensure_check_menu_item_widget):
+        (ensure_tree_view_widget):
+        (ensure_tree_header_cell_widget):
+        (ensure_expander_widget):
+        (ensure_scrolled_window_widget):
+        (moz_gtk_checkbox_get_metrics):
+        (moz_gtk_radio_get_metrics):
+        (moz_gtk_splitter_get_metrics):
+        (moz_gtk_toggle_paint):
+        (moz_gtk_scrollbar_button_paint):
+        (moz_gtk_scrollbar_trough_paint):
+        (moz_gtk_scrollbar_thumb_paint):
+        (moz_gtk_spin_paint):
+        (moz_gtk_spin_updown_paint):
+        (moz_gtk_scale_paint):
+        (moz_gtk_scale_thumb_paint):
+        (moz_gtk_gripper_paint):
+        (moz_gtk_hpaned_paint):
+        (moz_gtk_vpaned_paint):
+        (moz_gtk_caret_paint):
+        (moz_gtk_treeview_paint):
+        (moz_gtk_tree_header_cell_paint):
+        (moz_gtk_tree_header_sort_arrow_paint):
+        (moz_gtk_treeview_expander_paint):
+        (moz_gtk_expander_paint):
+        (moz_gtk_combo_box_paint):
+        (moz_gtk_downarrow_paint):
+        (moz_gtk_combo_box_entry_button_paint):
+        (moz_gtk_container_paint):
+        (moz_gtk_toggle_label_paint):
+        (moz_gtk_toolbar_paint):
+        (moz_gtk_toolbar_separator_paint):
+        (moz_gtk_tooltip_paint):
+        (moz_gtk_resizer_paint):
+        (moz_gtk_frame_paint):
+        (moz_gtk_progressbar_paint):
+        (moz_gtk_progress_chunk_paint):
+        (moz_gtk_get_tab_thickness):
+        (moz_gtk_tab_paint):
+        (moz_gtk_tabpanels_paint):
+        (moz_gtk_tab_scroll_arrow_paint):
+        (moz_gtk_menu_bar_paint):
+        (moz_gtk_menu_popup_paint):
+        (moz_gtk_menu_separator_paint):
+        (moz_gtk_menu_item_paint):
+        (moz_gtk_menu_arrow_paint):
+        (moz_gtk_check_menu_item_paint):
+        (moz_gtk_window_paint):
+        (moz_gtk_get_widget_border):
+        (moz_gtk_get_combo_box_entry_button_size):
+        (moz_gtk_get_tab_scroll_arrow_size):
+        (moz_gtk_get_downarrow_size):
+        (moz_gtk_get_toolbar_separator_width):
+        (moz_gtk_get_expander_size):
+        (moz_gtk_get_treeview_expander_size):
+        (moz_gtk_get_menu_separator_height):
+        (moz_gtk_get_scalethumb_metrics):
+        (moz_gtk_get_scrollbar_metrics):
+        (moz_gtk_images_in_menus):
+        (moz_gtk_widget_paint):
+        (moz_gtk_get_scrollbar_widget):
+        (moz_gtk_shutdown):
+        (moz_gtk_destroy_theme_parts_widgets):
+        * platform/gtk/gtkdrawing.h:
+
+2010-01-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Cache JS string values made from DOM strings (Dromaeo speedup)
+        https://bugs.webkit.org/show_bug.cgi?id=33768
+        <rdar://problem/7353576>
+
+        Added a new cache for JSString values that are created from Strings or AtomicStrings
+        in the DOM. It's common for the same string to be retrieved from the DOM repeatedly,
+        and it is wasteful to make a new JS-level string value every time.
+        
+        The string cache is per-world, and thus thread-safe and not a
+        vector for accidental information exchange.
+        
+        ~30% speedup on Dromaeo Attributes test, also substantially helps other Dromaeo DOM tests.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsStringCache): Helper function to get the string cache for the current world.
+        (WebCore::jsString): Some new overloads including the caching version.
+        (WebCore::stringWrapperDestroyed): Finalizer callback - remove from relevant caches.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::jsString): Prototype new overloads (and define a few inline).
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::type): Explicitly make a UString.
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument): Ditto.
+        * WebCore.base.exp: Add new JSString overloads that WebCore gets to see.
+
+2010-01-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Markers are getting culled incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=33767
+
+        Use applyTransformToPaintInfo to transform the paintInfo, otherwise
+        the paint rect is not updated leading to incorrect culling.
+
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::draw):
+
+2010-01-15  John Sullivan  <sullivan@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=33751 and <rdar://problem/7538330>
+        Zip code field is misidentified as street address because id attribute isn't checked.
+
+        Reviewed by Darin Adler
+
+        No new tests. I believe this code is used only by Safari AutoFill, but in any case
+        it does not affect page rendering or anything else at the WebCore/WebKit level.
+
+        * page/Frame.cpp:
+        (WebCore::matchLabelsAgainstString):
+        New function, split out from matchLabelsAgainstElement.
+        (WebCore::Frame::matchLabelsAgainstElement):
+        Now calls matchLabelsAgainstString for the id attribute if no match is found for the name attribute.
+        
+        * page/mac/FrameMac.mm:
+        (WebCore::matchLabelsAgainstString):
+        Same as above. This is a parallel copy of the function using Mac-specific data structures.
+        (WebCore::Frame::matchLabelsAgainstElement):
+        Ditto.
+
+2010-01-16  Timothy Hatcher  <timothy@apple.com>
+
+        Use String.trim() instead of a regex in the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33765
+
+        Reviewed by George Staikos.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.performSearch): Use .trim().
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression): Ditto.
+        * inspector/front-end/ProfileView.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame): Ditto.
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype): Ditto.
+        * inspector/front-end/utilities.js:
+        (String.prototype.trimLeadingWhitespace): Removed.
+        (String.prototype.trimTrailingWhitespace): Removed.
+        (String.prototype.trimWhitespace): Removed.
+
+2010-01-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Copying TransformationMatrix consumed a lot of cpu time while scroll with cursor over content
+        https://bugs.webkit.org/show_bug.cgi?id=33766
+
+        Make localToParentTransform return by reference to avid copy overhead.
+        This is a little gnarly in places as it means we need to be able to 
+        return temporary values in a few implementations, so we have to add
+        class fields to hold them, heppily the classes that these effect are
+         sufficiently uncommon for this to be okay.
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::localToParentTransform):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localTransform):
+        (WebCore::RenderObject::localToParentTransform):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::localToParentTransform):
+        (WebCore::RenderPath::nodeAtFloatPoint):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::localToParentTransform):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.h:
+        (WebCore::RenderSVGText::localToParentTransform):
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::localToParentTransform):
+        * rendering/RenderSVGTransformableContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        * rendering/RenderSVGViewportContainer.h:
+
+2010-01-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt and Alexey Proskuryakov.
+
+        ValidityState can hold a stale pointer to control
+        https://bugs.webkit.org/show_bug.cgi?id=33729
+        rdar://problem/7545114
+
+        Test: fast/forms/ValidityState-removed-control.html
+
+        * html/HTMLFormControlElement.h: Use OwnPtr instead of
+        RefPtr to point to the ValidityState object.
+
+        * html/ValidityState.cpp: Use a constant instead of a
+        macro for the email validation regular expression.
+        (WebCore::ValidityState::validationMessage): Use
+        m_control instead of control function; we don't need
+        a function for this. Also marked const.
+        (WebCore::ValidityState::typeMismatch): Ditto.
+        Fixed some minor style problems.
+        (WebCore::ValidityState::rangeUnderflow): Ditto.
+        (WebCore::ValidityState::rangeOverflow): Ditto.
+        (WebCore::ValidityState::stepMismatch): Ditto.
+        (WebCore::ValidityState::valid): Ditto.
+        (WebCore::ValidityState::isValidEmailAddress):
+        Changed local variable names for clarity. Got rid of
+        an unneeded global variable.
+
+        * html/ValidityState.h: Removed RefCounted as a base
+        class, deriving from Noncopyable instead. Changed
+        creation to use PassOwnPtr instead of PassRefPtr.
+        Eliminated unneeded control function. Added ref and
+        deref functions that forward the reference counting
+        to the control. Moved constructor here and made it
+        inline.
+
+2010-01-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33752
+        Assertion failure when getting a href attribute with prefix
+
+        This was due to a temporary change made in 2005 (r9639) - checks in checkSetPrefix were
+        disabled during introduction of QualifiedName, but never re-enabled.
+
+        Tests: fast/dom/bad-href-attribute.html
+               fast/dom/node-prefix-setter-namespace-exception.html
+
+        * dom/Attr.cpp: (WebCore::Attr::setPrefix):
+        * dom/Element.cpp: (WebCore::Element::setPrefix):
+        * dom/Node.cpp: (WebCore::Node::checkSetPrefix):
+        Re-enabled the checks. Also, changed the prefix setter to treat "" as null, matching Firefox
+        (DOM 3 Core spec says this behavior is implementation defined).
+
+2010-01-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7536748> and https://bugs.webkit.org/show_bug.cgi?id=33571
+        History traversals to a new document do not get the popstate event
+
+        State objects now live-on in their HistoryItem indefinitely.
+        This means any back/forward navigation might result in a popstate event, not just to 
+        pre-existing documents as was previously the case.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::documentDetached): State objects are held beyond Document lifetime.
+       
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin): If there is a pending state object for this Frame load, pass it
+          on to the Document after the Document is created.
+        (WebCore::FrameLoader::transitionToCommitted): If the current history item has a state object,
+          set it as the FrameLoad's pending state object.
+        * loader/FrameLoader.h:
+        
+        * page/Page.cpp:
+        (WebCore::Page::goToItem): Remove a now-invalid ASSERT.
+
+2010-01-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein and Adele Peterson.
+
+        Support reflections on composited layers
+        https://bugs.webkit.org/show_bug.cgi?id=31885
+        
+        Implement reflections (via -webkit-box-reflect:) on compositing layers.
+        
+        We add to the GraphicsLayer the notion of having a replica, and being a replicated layer.
+        The replica layer is not parented in the tree, but referenced by another layer.
+        RenderLayerBacking sets this up when it finds RenderLayers for reflections.
+        
+        GraphicsLayerCA implements rendering of replica layers by cloning CA layers,
+        and copying their properties, including animations and contents. Deep reflections
+        are supported by a hash of clone layers on each GraphicsLayerCA, indexed by
+        the path down the tree to each replica instance.
+        
+        When GraphicsLayerCA properties are changed, in most cases the clones must also
+        be updated.
+
+        Tests: compositing/masks/direct-image-mask.html
+               compositing/reflections/animation-inside-reflection.html
+               compositing/reflections/compositing-change-inside-reflection.html
+               compositing/reflections/deeply-nested-reflections.html
+               compositing/reflections/masked-reflection-on-composited.html
+               compositing/reflections/nested-reflection-anchor-point.html
+               compositing/reflections/nested-reflection-animated.html
+               compositing/reflections/nested-reflection-mask-change.html
+               compositing/reflections/nested-reflection-on-overflow.html
+               compositing/reflections/nested-reflection-opacity.html
+               compositing/reflections/nested-reflection-size-change.html
+               compositing/reflections/nested-reflection-transformed.html
+               compositing/reflections/nested-reflection-transition.html
+               compositing/reflections/nested-reflection.html
+               compositing/reflections/reflection-opacity.html
+               compositing/reflections/reflection-ordering.html
+               compositing/reflections/reflection-positioning.html
+               compositing/reflections/transform-inside-reflection.html
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::isReplicated): Returns true when this layer has a replicated layer.
+        (WebCore::GraphicsLayer::replicatedLayerPosition):
+        (WebCore::GraphicsLayer::setReplicatedLayerPosition): The position of the replica layer must be 
+        special-cased; we cannot just copy the position of the original.
+        (WebCore::GraphicsLayer::didDisplay): Method that indicates that the contents of the layer changed,
+        which gives us a chance to update clone layers.
+        (WebCore::GraphicsLayer::replicaLayer): reference to the replica layer.
+        (WebCore::GraphicsLayer::replicatedLayer): reference to the layer that this (replica) layer is replicating.
+        (WebCore::GraphicsLayer::setReplicatedLayer):
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        (WebCore::GraphicsLayer::setReplicatedByLayer): Hook up a replica with its replicated layer.
+        (WebCore::GraphicsLayer::dumpProperties):
+
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::primaryLayer): Returns a CALayer, since structural layers may not be WebLayers.
+        (WebCore::GraphicsLayerCA::isReplicatedRootClone): Given a cloneID (string representation of the path to a clone
+        down the tree, which is a bitstring of 1 (replica), or 0 (non-replica)), returns true if this ID represents the
+        root of a replica tree.
+        (WebCore::GraphicsLayerCA::primaryLayerClones): Returns a pointer to the hash map of clones of the primary layers.
+
+        (WebCore::GraphicsLayerCA::ReplicaState::ReplicaState): Small struct used to track original/clone branching
+        down the tree during recursion, to build cloneID paths.
+
+        (WebCore::GraphicsLayerCA::hasCloneLayers): returns true if this layer has clone layers.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::~GraphicsLayerCA): remove the clone layers.
+        (WebCore::GraphicsLayerCA::setChildren): call noteSublayersChanged() since we may have to update replicas too.
+        (WebCore::GraphicsLayerCA::addChild): ditto
+        (WebCore::GraphicsLayerCA::addChildAtIndex): ditto
+        (WebCore::GraphicsLayerCA::addChildBelow): ditto
+        (WebCore::GraphicsLayerCA::addChildAbove): ditto
+        (WebCore::GraphicsLayerCA::replaceChild): ditto
+        (WebCore::GraphicsLayerCA::removeFromParent): ditto
+        (WebCore::GraphicsLayerCA::setMaskLayer): call propagateLayerChangeToReplicas()
+        (WebCore::GraphicsLayerCA::setReplicatedLayer): note replica changed.
+        (WebCore::GraphicsLayerCA::setReplicatedByLayer): ditto
+        (WebCore::GraphicsLayerCA::moveOrCopyAllAnimationsForProperty): Enhanced to allow moving or copying animations.
+        (WebCore::GraphicsLayerCA::moveOrCopyAnimationsForProperty): Ditto.
+        (WebCore::GraphicsLayerCA::setContentsToImage): call noteSublayersChanged()
+        (WebCore::GraphicsLayerCA::setContentsToVideo): call noteSublayersChanged()
+        (WebCore::GraphicsLayerCA::didDisplay): here is our chance to copy updated contents to clone layers.
+        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
+        (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers): pre-order commit, for things that need to be
+            committed before we recurse on children.
+        (WebCore::GraphicsLayerCA::commitLayerChangesAfterSublayers): post-order commit, for things that need to be
+            committed after we recurse on children, like clones.
+        (WebCore::GraphicsLayerCA::updateLayerNames): New method to match the other 'update' methods.
+        (WebCore::GraphicsLayerCA::updateSublayerList): Insert replica layers into the hierarchy.
+        (WebCore::GraphicsLayerCA::updateLayerPosition): update clones.
+        (WebCore::GraphicsLayerCA::updateLayerSize): ditto
+        (WebCore::GraphicsLayerCA::updateAnchorPoint): ditto
+        (WebCore::GraphicsLayerCA::updateTransform): ditto
+        (WebCore::GraphicsLayerCA::updateChildrenTransform): ditto
+        (WebCore::GraphicsLayerCA::updateMasksToBounds): ditto
+        (WebCore::GraphicsLayerCA::updateContentsOpaque): ditto
+        (WebCore::GraphicsLayerCA::updateBackfaceVisibility): ditto
+        (WebCore::GraphicsLayerCA::updateStructuralLayer): call ensureStructuralLayer()
+        (WebCore::moveAnimation): utility to move a CAAnimation from one layer to another.
+        (WebCore::GraphicsLayerCA::ensureStructuralLayer): refactored code which creates enclosing CALayers for reflection
+        flattening, or CATransformLayers for preserve-3d.
+        (WebCore::GraphicsLayerCA::structuralLayerPurpose): indicates why we need a structural layer.
+        (WebCore::GraphicsLayerCA::updateLayerDrawsContent): update clones
+        (WebCore::GraphicsLayerCA::updateContentsImage): ditto
+        (WebCore::GraphicsLayerCA::updateContentsRect): ditto
+        (WebCore::GraphicsLayerCA::updateMaskLayer): ditto
+        (WebCore::GraphicsLayerCA::updateReplicatedLayers): This is where we ask for the tree of layers for the replica
+        and its children, and attach them as sublayers.
+        (WebCore::GraphicsLayerCA::ReplicaState::cloneID): Build a bitstring from the array of original/clone values; this
+        string serves to identify clones in the hash map.
+        (WebCore::GraphicsLayerCA::replicatedLayerRoot): Request the tree of clone layers, set its position and transform,
+        and return it.
+        (WebCore::GraphicsLayerCA::setAnimationOnLayer): update clones
+        (WebCore::GraphicsLayerCA::removeAnimationFromLayer): ditto
+        (WebCore::GraphicsLayerCA::pauseAnimationOnLayer): ditto
+        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D): udpate sublayers.
+        (WebCore::GraphicsLayerCA::suspendAnimations): update clones.
+        (WebCore::GraphicsLayerCA::resumeAnimations): ditto
+        (WebCore::GraphicsLayerCA::animatedLayerClones): return the hash map for clones of the appropriate layer for the given property.
+        (WebCore::GraphicsLayerCA::ensureCloneLayers): create and return clones for the CALayers for this layer.
+        (WebCore::GraphicsLayerCA::removeCloneLayers): clear out the clone layers.
+        (WebCore::GraphicsLayerCA::positionForCloneRootLayer): the root of a clonal subtree needs its position and transform to be special-cased,
+        since it doesn't just copy those properties from the original.
+        (WebCore::GraphicsLayerCA::propagateLayerChangeToReplicas): push the change flags onto the replica.
+        (WebCore::GraphicsLayerCA::fetchCloneLayers): recurse down sublayers, creating clones of the CALayers along the way, and returning
+        the root of the clone tree.
+        (WebCore::copyAnimation): utility to copy an animation from one layer to another. Animations can be shared between layers.
+        (WebCore::GraphicsLayerCA::cloneLayer): utility to clone a CALayer, copying those properties which GraphicsLayerCA makes use of
+        (WebCore::GraphicsLayerCA::setOpacityInternal): push opacity changes to clones.
+        (WebCore::GraphicsLayerCA::updateOpacityOnLayer): ditto
+        (WebCore::GraphicsLayerCA::noteSublayersChanged): set the ChildrenChanged flag, and proprate changes to the replica, if any.
+
+        * platform/graphics/mac/WebLayer.mm:
+        (-[WebLayer display]): override -display so we know when to update the contents of clone layers
+
+        * platform/graphics/mac/WebTiledLayer.mm:
+        (-[WebTiledLayer display]): ditto.
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::isReflection): New method that returns true if the renderer is a replica.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer): initialize m_isReflection
+        (WebCore::RenderLayer::updateReflectionStyle): call setIsReflection
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer): Put a name on the reflection layer.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): Hook up the GraphicsLayers for the reflection.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Reflection overrides preserve-3d (you have to flatten to reflect).
+        Also hook up updating the reflection layer geometry, and the relica position.
+        
+        (WebCore::RenderLayerBacking::paintIntoLayer): We no longer paint the reflection in software.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements): Hook reflection layers into the compositing logic.
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering): No longer have to push video into software if it's reflected.
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Update the bounds of the reflection layer.
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry): ditto
+        (WebCore::RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing): a compositing descendant forces
+        a reflection ancestor to composite now.
+        (WebCore::RenderLayerBacking::containsPaintedContent): Reflection layers don't paint anything.
+        (WebCore::RenderLayerBacking::isDirectlyCompositedImage): No need to fall out of direct compositing mode
+        for masks or reflections any more.
+        (WebCore::RenderLayerBacking::paintIntoLayer): No need to paint the reflection manually now.
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isReplica):
+        * rendering/RenderReplica.h:
+        (WebCore::RenderReplica::isReplica):
+        New method used to determine if a render is a replica.
+
+2010-01-15  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        CSS2.1 Counters not updated when new elements are inserted in the DOM.
+        https://bugs.webkit.org/show_bug.cgi?id=32884
+
+        Test: fast/css/counters/adding-nodes.html
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::insertAfter):
+        Modified to handle the addition of nodes with children. Needed when formerly 
+        root nodes become descendants of a new node.
+        * rendering/RenderCounter.cpp:
+        (WebCore::makeCounterNode):
+        Changed to handle the case when root counter nodes lose their root 
+        status as a result of a new root counter node creation. 
+        (WebCore::destroyCounterNodeWithoutMapRemoval):
+        Refactored more code into destroyCounterNodeChildren and renamed the
+        function according to its new action.
+        (WebCore::RenderCounter::destroyCounterNodes):
+        Simplified to share more code with the new destroyCounterNode.
+        (WebCore::RenderCounter::destroyCounterNode):
+        Added to allow for selective counterNode destruction.
+        (WebCore::RenderCounter::rendererSubtreeAttached):
+        Added to refresh counter values in response to DOM changes.
+        For renderers with no attached counters the execution time of this
+        function cannot be discerned in comparison with the time needed to
+        add a node or change the style of a node.
+        (WebCore::updateCounters):
+        Helper function for rendererSubtreeAttached. Updates the counters
+        attached to a Renderer in response to the renderer or its ancestors
+        being attached to the renderer tree.
+        * rendering/RenderCounter.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::addChild):
+        Changed to update counter values if needed.
+
+2010-01-15  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        Original patch by David Ronis <david.ronis@mcgill.ca>
+
+        Upgrade 1.1.17->1.1.18 fails: GTK_WIDGET_TOPLEVEL' was not declared in this scope
+        https://bugs.webkit.org/show_bug.cgi?id=33486
+
+        Deprecated symbols replaced for gtk+ versions over 2.18.
+
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual):
+        (WebCore::screenRect):
+
+2010-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bad DOM performance in large SVG files
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Improve the performance of the early culling check by avoiding save/restore
+        of graphics state in culled case.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2010-01-15  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r53344.
+        http://trac.webkit.org/changeset/53344
+        https://bugs.webkit.org/show_bug.cgi?id=32920
+
+        Broke the Chromium Mac builder.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/SerializedScriptValue.cpp: Removed.
+        * bindings/v8/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::postMessageCallback):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::V8DedicatedWorkerContext::postMessageCallback):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::pushStateCallback):
+        (WebCore::V8History::replaceStateCallback):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::initMessageEventCallback):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::V8MessagePort::postMessageCallback):
+        * bindings/v8/custom/V8PopStateEventCustom.cpp:
+        (WebCore::V8PopStateEvent::initPopStateEventCallback):
+        (WebCore::V8PopStateEvent::stateAccessorGetter):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::V8Worker::postMessageCallback):
+
+2010-01-15  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        history.length does not return number of elements in history list
+        https://bugs.webkit.org/show_bug.cgi?id=24472
+
+        Test: fast/history/history-length.html
+
+        * page/Page.cpp:
+        (WebCore::Page::getHistoryLength):
+
+2010-01-15  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Need to ensure that Document::postTask does not provide the Task with a dangling pointer to destroyed Document
+        https://bugs.webkit.org/show_bug.cgi?id=31633
+
+        Don't see a way to add test for it, we don't have a way to reproduce the issue currently.
+
+        * dom/Document.cpp:
+        (WebCore::DocumentWeakReference::DocumentWeakReference):
+        (WebCore::DocumentWeakReference::document):
+        (WebCore::DocumentWeakReference::clear):
+        (WebCore::Document::Document): Create a weak reference to this Document.
+        (WebCore::Document::~Document): Clear the weak pointer, preventing further execution of tasks.
+        (WebCore::PerformTaskContext::PerformTaskContext):
+        (WebCore::performTask): Check if the documentWeakReference is cleared by Document destructor - in this case do not run the task.
+        (WebCore::Document::postTask):
+        * dom/Document.h:
+        (WebCore::DocumentWeakReference::create):
+
+2010-01-15  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Support SerializedScriptValue.
+        https://bugs.webkit.org/show_bug.cgi?id=32920
+        http://crbug.com/30620
+
+        Initial implementation of SerializedScriptValue which is used to
+        to create a serialized representation of JavaScript objects.  This
+        representation is needed for structured clones and worker messages.
+
+        * WebCore.gypi: Added SerializedScriptValue.cpp.
+        * bindings/scripts/CodeGeneratorV8.pm: Removed conversion to string before using SerializedScriptValue.
+        * bindings/v8/SerializedScriptValue.cpp: Added.
+        (WebCore::):
+        (WebCore::ZigZag::encode):
+        (WebCore::ZigZag::decode):
+        (WebCore::Writer::Writer):
+        (WebCore::Writer::writeUndefined):
+        (WebCore::Writer::writeNull):
+        (WebCore::Writer::writeTrue):
+        (WebCore::Writer::writeFalse):
+        (WebCore::Writer::writeString):
+        (WebCore::Writer::writeInt32):
+        (WebCore::Writer::writeNumber):
+        (WebCore::Writer::endComposite):
+        (WebCore::Writer::data):
+        (WebCore::Writer::doWriteUint32):
+        (WebCore::Writer::append):
+        (WebCore::Writer::ensureSpace):
+        (WebCore::Writer::fillHole):
+        (WebCore::Writer::charAt):
+        (WebCore::Serializer::Serializer):
+        (WebCore::Serializer::serialize):
+        (WebCore::Serializer::StateBase::~StateBase):
+        (WebCore::Serializer::StateBase::nextState):
+        (WebCore::Serializer::StateBase::setNextState):
+        (WebCore::Serializer::StateBase::composite):
+        (WebCore::Serializer::StateBase::StateBase):
+        (WebCore::Serializer::State::composite):
+        (WebCore::Serializer::State::tag):
+        (WebCore::Serializer::State::State):
+        (WebCore::Serializer::StackCleaner::StackCleaner):
+        (WebCore::Serializer::StackCleaner::~StackCleaner):
+        (WebCore::Serializer::ArrayState::ArrayState):
+        (WebCore::Serializer::ArrayState::done):
+        (WebCore::Serializer::ArrayState::advance):
+        (WebCore::Serializer::ObjectState::ObjectState):
+        (WebCore::Serializer::ObjectState::done):
+        (WebCore::Serializer::ObjectState::advance):
+        (WebCore::Serializer::ObjectState::nextProperty):
+        (WebCore::Serializer::doSerialize):
+        (WebCore::Serializer::push):
+        (WebCore::Serializer::top):
+        (WebCore::Serializer::pop):
+        (WebCore::Serializer::checkComposite):
+        (WebCore::Reader::Reader):
+        (WebCore::Reader::isEof):
+        (WebCore::Reader::read):
+        (WebCore::Reader::readTag):
+        (WebCore::Reader::readString):
+        (WebCore::Reader::readInt32):
+        (WebCore::Reader::readNumber):
+        (WebCore::Reader::doReadUint32):
+        (WebCore::Deserializer::Deserializer):
+        (WebCore::Deserializer::deserialize):
+        (WebCore::Deserializer::doDeserialize):
+        (WebCore::Deserializer::push):
+        (WebCore::Deserializer::pop):
+        (WebCore::Deserializer::stackDepth):
+        (WebCore::Deserializer::element):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/v8/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::createFromWire):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toWireString):
+
+        Updated uses of SerializedScriptValue:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::postMessageCallback):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::V8DedicatedWorkerContext::postMessageCallback):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::pushStateCallback):
+        (WebCore::V8History::replaceStateCallback):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::initMessageEventCallback):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::V8MessagePort::postMessageCallback):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::V8Worker::postMessageCallback):
+
+2010-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dirk Schulze.
+
+        Bad DOM performance in large SVG files
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Add an early return when we go to paint a RenderPath that
+        isn't in the current clip.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
+
+2010-01-15  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Make Geolocation::suspend/resume public.
+        https://bugs.webkit.org/show_bug.cgi?id=33679
+
+        These were made private in Bug 32499, but are required by Android to be public.
+
+        No new tests, build fix only.
+
+        * page/Geolocation.cpp: Modified
+        (WebCore::Geolocation::suspend): Added back in
+        (WebCore::Geolocation::resume): Added back in
+        * page/Geolocation.h: Modified. Make suspend and resume public
+
+2010-01-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Set pointer cursor when over a breakpoint in the BreakpointsSidebarPane
+
+        https://bugs.webkit.org/show_bug.cgi?id=33713
+
+        * inspector/front-end/inspector.css:
+
+2010-01-15  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Generate more of the custom behaviors that the v8 bindings attach to v8 FunctionTemplates.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::getToStringName):
+        (WebCore::constructorToString):
+        (WebCore::getToStringTemplate):
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::createNewContext):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+
+2010-01-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r53331.
+        http://trac.webkit.org/changeset/53331
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Broke fast/borders/svg-as-border-image-3.html. Don't give up,
+        Oliver! You are really, really close.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2010-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Bad DOM performance in large SVG files
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Add an early return when we go to paint a RenderPath that
+        isn't in the current clip.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2010-01-15  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        Use OS(MAC_OS_X) instead of PLATFORM(MAC) when determining navigator.platform
+
+        https://bugs.webkit.org/show_bug.cgi?id=33711
+
+        * page/NavigatorBase.cpp:
+
+2010-01-14  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Compiler warning: comparisons like 'X<=Y<=Z' do not have their mathematical meaning
+        https://bugs.webkit.org/show_bug.cgi?id=33575
+
+        Patch from Magnus Boman <captain.magnus@gmail.com>
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache): fix compiler warnings.
+
+2010-01-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Add welcome screen to Profiles pane to provide some instructions for novices.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19268
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileType.prototype.get welcomeMessage):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType.prototype.get welcomeMessage):
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.show):
+        (WebInspector.ProfilesPanel.prototype.registerProfileType):
+        (WebInspector.ProfilesPanel.prototype._addWelcomeMessage.messageButtonClicked):
+        (WebInspector.ProfilesPanel.prototype._addWelcomeMessage):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype.closeVisibleView):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/WelcomeView.js: Added.
+        (WebInspector.WelcomeView):
+        (WebInspector.WelcomeView.prototype._windowResized):
+        (WebInspector.WelcomeView.prototype.addMessage):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2010-01-13  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt/Win] Flash in QGraphicsWebView does not process hover correctly.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=33591
+        
+        Mouse hover does not work as expected with the flash in some sites.
+        - http://www.bbc.co.uk/ Hover over the map
+        - http://www.barbie.com/ Hover over the menu items (Games, Videos)
+        The problem appears to be that Flash queries NPNVnetscapeWindow on every
+        mouse hover. I do not how flash uses this value but returning 0 when flash
+        is in windowless mode solves the problem (When using QGraphicsWebView we
+        inject wmode opaque, thereby putting the plugin in windowless mode).
+
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+
+2010-01-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for Peer class
+        https://bugs.webkit.org/show_bug.cgi?id=33670
+
+        Inherits the following class from Noncopyable because it is 
+        instantiated by 'new' and no need to be copyable:
+
+        class name - instantiated at: WebCore/'location'
+        class Peer - websockets/WebSocketChannelClient.h:38
+
+        * websockets/WorkerThreadableWebSocketChannel.h:
+
+2010-01-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Allow custom memory allocation control for GraphicsContextPlatformPrivate class
+        https://bugs.webkit.org/show_bug.cgi?id=33669
+
+        Inherits the following class from Noncopyable because it is 
+        instantiated by 'new' and no need to be copyable:
+
+        class name                           - instantiated at: WebCore/'location'
+        class GraphicsContextPlatformPrivate - platform/graphics/qt/GraphicsContextQt.cpp:254
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+
+2010-01-14  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        history.pushState should clear the entire forward history
+        https://bugs.webkit.org/show_bug.cgi?id=33160
+
+        Test: fast/loader/stateobjects/pushstate-clears-forward-history.html
+
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::addItem):
+        (WebCore::BackForwardList::pushStateItem):
+        * history/BackForwardList.h:
+
+2010-01-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        Make naming & behaviour of UString[Impl] methods more consistent.
+        https://bugs.webkit.org/show_bug.cgi?id=33702
+
+        WebCore change reflecting UString method name change computedHash() -> existingHash().
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::AtomicString::add):
+        (WebCore::AtomicString::find):
+
+2010-01-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6020083> -webkit-gradient slows down scrolling when page has horizontal scrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=19650
+
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern): Added call to adjustParametersForTiledDrawing(),
+        letting the generator substitute the parameters with visually-equivalent values that
+        are more efficient.
+        * platform/graphics/Generator.h:
+        (WebCore::Generator::adjustParametersForTiledDrawing): Added a base class implementation
+        that does nothing.
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::adjustParametersForTiledDrawing): Added. If the gradient is a horizontal
+        or vertical linear gradient, changes to use a 1-pixel tall (or wide) tile.
+        * platform/graphics/Gradient.h:
+
+2010-01-14  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Platform Symbian specific:
+        Added time-based optimization (-Otime) and increased optimization level to -O3,
+        conditionally for RVCT compiler (for ARM), for increasing performance
+        (primarily affecting JavaScript execution).
+        Default settings are -Ospace and -O2.
+
+        No new tests needed because no new funtionality is introduced,
+        only potential regression on existing tests needs to be evaluated.
+
+        * WebCore.pro:
+
+2010-01-14  Jungshik Shin  <jshin@chromium.org>
+
+        Unreviewed, attempted build fix on chromium.
+
+        Fix a Chromium build failure due to an unused variable in V8 binding.(part 2)
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::getNamedPropertyOfCollection):
+
+2010-01-14  Jungshik Shin  <jshin@chromium.org>
+
+        Unreviewed, attempted build fix on chromium.
+
+        Fix a Chromium build failure due to an unused variable in V8 binding. 
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::getIndexedPropertyOfCollection):
+
+2010-01-14  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed, attempted build fix.
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+
+2010-01-14  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Barth.
+
+        Simplify image decoders by making downsampling functions available at
+        all times, allowing much duplicated logic to be collapsed.
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::prepareScaleDataIfNecessary):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::scaledSize):
+        (WebCore::ImageDecoder::setMaxNumPixels):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::sizeNowAvailable):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::frameComplete):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::setSize):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2010-01-14  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] Remove obsolete CF related files from gyp build.
+        https://bugs.webkit.org/show_bug.cgi?id=33002
+
+        * WebCore.gypi:
+
+2010-01-14  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Barth.
+
+        Decoding images to scaled output buffers resulted in garbage for
+        no-alpha PNGs and CMYK JPEGs.
+        https://bugs.webkit.org/show_bug.cgi?id=33624
+        
+        No layout test since I don't have access to a platform that scales the
+        output buffers.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2010-01-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Fix an assertion that was causing test crashes. Filed a bug
+        about the weirdness that causes this assertion (inconsistencies 
+        between DragOperationMove and DragOperationGeneric).
+
+        * dom/Clipboard.cpp:
+        (WebCore::dragOpFromIEOp):
+        (WebCore::Clipboard::setDestinationOperation):
+
+2010-01-14  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=33498 REGRESSION: 
+        svg/css/circle-in-mask-with-shadow.svg failing pixel tests
+        -and corresponding-
+        <rdar://problem/7544176>
+
+        This change makes repaintRectInLocalCoordinates return a rect that 
+        is -webkit-svg-shadow-aware.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::repaintRectInLocalCoordinates):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::inflateForShadow):
+        * rendering/style/SVGRenderStyle.h:
+
+2010-01-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Drag and Drop source/destination code needs cleanup.
+        <https://bugs.webkit.org/show_bug.cgi?id=33691>.
+        
+        Cleaned up some Drag and Drop code that deals with getting
+        source and destination operations, and added some ASSERTS to make
+        sure we don't get in bad states.
+
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::sourceOperation): Make this return the operation itself.
+        (WebCore::Clipboard::destinationOperation): Ditto.
+        (WebCore::Clipboard::setSourceOperation): Add an assert to make sure we're valud.
+        (WebCore::Clipboard::setDestinationOperation): Ditto.
+        * dom/Clipboard.h:
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDHTMLDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDrag):
+
+2010-01-14  Timothy Hatcher  <timothy@apple.com>
+
+        Make the Web Inspector's JavaScript debugger work with isolated worlds.
+        Console evaluation is not performed in the correct world yet, tracked
+        by bug http://webkit.org/b/33692.
+
+        http://webkit.org/b/33690
+
+        Reviewed by Adam Roben.
+
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::restore): Attach the debugger to
+        any window shell, not just for the debugger world.
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell): Detach the debugger, and
+        reattach to all window shells, not just for the debugger world.
+        (WebCore::ScriptController::initScript): Attach the debugger to
+        any window shell, not just for the debugger world.
+        (WebCore::ScriptController::attachDebugger): Changed to loop through
+        all the window shells and call the new overloaded attachDebugger.
+        (WebCore::ScriptController::attachDebugger): Added. An overload that
+        takes a window shell to attach the debugger to. Has most of the
+        logic from the original attachDebugger.
+        * bindings/js/ScriptController.h: Added the new attachDebugger.
+
+2010-01-14  Adam Roben  <aroben@apple.com>
+
+        Make Cache::requestResource return 0 if the resource's load fails
+        immediately
+
+        Fixes <rdar://problem/7543406> <http://webkit.org/b/33687>
+        window.onload never fires if page contains a <script src=foo> whose
+        load is cancelled by resource load delegate returning null from
+        willSendRequest
+
+        Test: fast/loader/onload-willSendRequest-null-for-script.html
+
+        Reviewed by Dave Hyatt.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource): Moved code to handle immediate load
+        failure out of the "cache is disabled" block so that it will run even
+        when the cache is enabled.
+
+2010-01-14  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by mitz@webkit.org.
+
+        Fix for crash with gradient on table cell.  Pass the correct
+        background object down to
+        RenderBoxModelObject::paintFillLayerExtended().  This also allowed a
+        rework of the fix to bug 18445 by passing the correct RenderObject
+        from RenderBox::paintRootBoxDecorations() down to
+        RenderBoxModelObject::paintFillLayerExtended().
+        https://bugs.webkit.org/show_bug.cgi?id=28426
+
+        Covered by new layout test:  LayoutTests/fast/gradients/crash-on-tr.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintFillLayers):
+        (WebCore::RenderBox::paintFillLayer):
+        * rendering/RenderBox.h:
+        Plumb through the correct background RenderObject.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        Use the passed-in background RenderObject (if present) when painting background images.  Remove the previous fix for bug 18445.
+        * rendering/RenderBoxModelObject.h:
+        Plumb through the correct background RenderObject.
+        * rendering/RenderTableCell.cpp:
+        Pass in the correct backgroundObject to paintFillLayers().
+
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+
+2010-01-14  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Standardize the rest of the v8 bindings on toNative() wherever possible.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33677
+
+        * bindings/v8/NPV8Object.cpp:
+        (v8ObjectToNPObject): Special case for converting NPObjects, since there aren't genereated bindings for them.
+        * bindings/v8/NPV8Object.h:
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/V8Collection.cpp:
+        * bindings/v8/V8Collection.h:
+        (WebCore::toNativeCollection): Special case for converting V8Collections, since there aren't genereated bindings for them.
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+
+2010-01-14  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: don't stretch checkboxes
+        https://bugs.webkit.org/show_bug.cgi?id=28631
+
+        Make the default size for checkboxes/radio buttons also the maximum
+        size.
+
+        Based on patch by Adam Langley.
+
+        Test: fast/css/non-standard-checkbox-size.html
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::center):
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+
+2010-01-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Follow up to <https://bugs.webkit.org/show_bug.cgi?id=33635>.
+        
+        Now that dropEffect and effectAllowed are guaranteed to not be
+        null, change null checks into asserts to make sure we are returning
+        a proper DragOperation value.
+
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::sourceOperation): Change null check to assert.
+        (WebCore::Clipboard::destinationOperation): Ditto.
+
+2010-01-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        [DnD] effectAllowed and dropEffect can be set to bogus values.
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=33635>.
+        
+        Test to make aure dropEffect and effectAllowed are being set to valid values
+        when they are being set (list of valid values given by HTML5 specification).
+        
+        Also, drive by change to initialize dropEffect to none (as described in spec).
+
+        Test: fast/events/bogus-dropEffect-effectAllowed.html
+
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard): Initialize m_dropEffect to "none".
+        (WebCore::Clipboard::setDropEffect): Check if dropEffect is being set to a valid value.
+        (WebCore::Clipboard::setEffectAllowed): Check if effectAllowed is being set to a valid value.
+
+2010-01-14  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Infinite recursion in RuntimeObjectImp::getOwnPropertyNames()
+        https://bugs.webkit.org/show_bug.cgi?id=33371
+
+        RuntimeObjectImp should not reimplement getPropertyNames();
+        move the implementation to getOwnPropertyNames().
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertyNames):
+        * bridge/runtime_object.h:
+
+2010-01-14  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add ENABLE(XSLT) guard to TransformSourceLibxslt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=33665
+
+        TransformSource is available only when ENABLE(XSLT) guard is true.
+
+        * dom/TransformSourceLibxslt.cpp:
+
+2010-01-14  Adam Roben  <aroben@apple.com>
+
+        Treat all synchronous loads equally in FrameLoader::loadSubframe
+
+        Only loads of the empty URL or about:blank were being treated as
+        synchronous loads. But other loads can be synchronous (e.g., when we
+        receive a null ResourceRequest from requestFromDelegate or when a
+        policy decision of "ignore" is made). We now treat those loads the
+        same way we treated empty URLs and about:blank.
+
+        Fixes <rdar://problem/7533333> <http://webkit.org/b/33533>
+        window.onload never fires if page contains an <iframe> with a bad
+        scheme or whose load is cancelled by returning null from resource load
+        delegate's willSendRequest
+
+        Tests: fast/loader/onload-bad-scheme-for-frame.html
+               fast/loader/onload-policy-ignore-for-frame.html
+               fast/loader/onload-willSendRequest-null-for-frame.html
+
+        Reviewed by Brady Eidson.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+          - Detect synchronous loads by checking the subframe's loader's
+            state, rather than by checking its URL
+          - Removed unnecessary call to completed(), since checkCompleted()
+            will call completed() if needed (the call to completed() was added
+            first and wasn't removed when the call to checkCompleted() was
+            added in r8316)
+          - Added more comments about the strange thing this function does
+            with the subframe's loader
+
+2010-01-14  Diego Gonzalez  <diego.gonzalez@openbossa.org>
+
+        Reviewed by Kenneth Christiansen.
+
+        [Qt] Missing fileSystemPath() method in Qt KURL implementation
+        https://bugs.webkit.org/show_bug.cgi?id=33614
+
+        No new tests.
+
+        * platform/qt/KURLQt.cpp:
+        (WebCore::KURL::fileSystemPath):
+
+2010-01-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33652
+        REGRESSION: Frames stop appearing after browsing for a while
+
+        <rdar://problem/7308312> REGRESSION: iBench gets slower after several runs
+
+        I do not know how not creating renderers for frames could make iBench slower, but it did.
+
+        Test: fast/frames/cached-frame-counter.html
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame): A frame that's cached is moved away from Page,
+        so decrement frame count here.
+        (WebCore::CachedFrame::open): Increase frame count when a frame is restored.
+
+        * history/CachedFrame.h: Remove unneeded forward declarations.
+
+        * history/CachedPage.h: Ditto.
+
+        * history/CachedPage.cpp: (WebCore::CachedPage::restore): Assert that page frame count is
+        zero prior to restoring a page from b/f cache.
+        
+        * page/Page.cpp: (WebCore::Page::checkFrameCountConsistency): A debug-only method to
+        check that frame count stored in Page matches the number of frames in frame tree.
+
+        * page/Page.h:
+        (WebCore::Page::decrementFrameCount): Assert that frame count is positive.
+        (WebCore::Page::frameCount): Call checkFrameCountConsistency().
+
+2010-01-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fixes.
+        Add forward declarations and additional includes of windows.h.
+
+        * platform/Cursor.h: Add forward declaration of HCURSOR. Move destructor implementation into cpp.
+        * platform/graphics/transforms/TransformationMatrix.h: Add forward declaration of XFORM. Remove windows.h include.
+        * platform/graphics/win/TransformationMatrixWin.cpp: Add include of windows.h.
+        * platform/win/CursorWin.cpp: Moved destructor of SharedCursor here.
+        (WebCore::SharedCursor::~SharedCursor): Moved here.
+        * platform/win/EventLoopWin.cpp: Add include of windows.h.
+        * platform/win/SystemInfo.cpp: Add include of windows.h.
+
+2010-01-14  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Switch the custom V8 bindings to use class toNative() functions.
+
+        Refactoring, so no new tests.
+
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * bindings/v8/custom/V8CoordinatesCustom.cpp:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8GeolocationCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8PopStateEventCustom.cpp:
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+
+2010-01-14  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Enable DOM clipboard and drag-and-drop access
+        https://bugs.webkit.org/show_bug.cgi?id=30623
+
+        Add DataObjectGtk, a container for pasteboard and drag-and-drop data.
+
+        No new tests, because functionality has not changed.
+
+        * GNUmakefile.am:
+        * platform/gtk/DataObjectGtk.cpp: Added.
+        (WebCore::DataObjectGtk::text):
+        (WebCore::DataObjectGtk::markup):
+        (WebCore::DataObjectGtk::setText):
+        (WebCore::DataObjectGtk::setMarkup):
+        (WebCore::DataObjectGtk::files):
+        (WebCore::DataObjectGtk::url):
+        (WebCore::DataObjectGtk::urlLabel):
+        (WebCore::DataObjectGtk::hasURL):
+        (WebCore::DataObjectGtk::clear):
+        (WebCore::DataObjectGtk::forClipboard):
+        * platform/gtk/DataObjectGtk.h: Added.
+        (WebCore::DataObjectGtk::create):
+        (WebCore::DataObjectGtk::uriList):
+        (WebCore::DataObjectGtk::image):
+        (WebCore::DataObjectGtk::setRange):
+        (WebCore::DataObjectGtk::setURIList):
+        (WebCore::DataObjectGtk::setImage):
+        (WebCore::DataObjectGtk::setDragContext):
+        (WebCore::DataObjectGtk::hasText):
+        (WebCore::DataObjectGtk::hasMarkup):
+        (WebCore::DataObjectGtk::hasURIList):
+        (WebCore::DataObjectGtk::hasImage):
+        (WebCore::DataObjectGtk::dragContext):
+
+2010-01-14  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        WebInspector: Scrolling of Timeline Page was broken by fix for bug 33470.
+        https://bugs.webkit.org/show_bug.cgi?id=33666
+
+        * inspector/front-end/inspector.css:
+
+2010-01-14  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Unreviewed fix of builds with the --no-svg switch.
+
+        * WebCore.pri:
+
+2010-01-14  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Unreviewed build fix on Windows.
+
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2010-01-14  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Enable scrolling optimization for pages with embedded widgets
+
+        https://bugs.webkit.org/show_bug.cgi?id=33373
+
+        Added a basic manual test for scrolling of embedded QWidgets.
+
+        * manual-tests/qt/qtplugin-scrolling.html: Added.
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::setParent):
+        * platform/ScrollView.h:
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::platformInit):
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::invalidateRect):
+
+2009-12-09  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GStreamer] Check return values of gst_element_set_state()
+        https://bugs.webkit.org/show_bug.cgi?id=30000
+
+        Check for state change failure when going from READY/NULL to
+        PAUSED or PLAYING. Also refactored the common code of play() and
+        pause() to a new private method of the player.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::changePipelineState):
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2010-01-14  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r53248.
+        http://trac.webkit.org/changeset/53248
+        https://bugs.webkit.org/show_bug.cgi?id=32641
+
+        Caused 2 tests to crash on various bots:
+        fast/dom/HTMLSelectElement/listbox-select-reset.html and
+        fast/forms/listbox-typeahead-scroll.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::recalcStyle):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::restoreFormControlState):
+        (WebCore::SelectElement::reset):
+        (WebCore::SelectElement::typeAheadFind):
+        * dom/SelectElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::selected):
+        (WebCore::HTMLOptionElement::insertedIntoTree):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcStyle):
+        * html/HTMLSelectElement.h:
+        * wml/WMLSelectElement.cpp:
+        (WebCore::WMLSelectElement::recalcStyle):
+
+2010-01-14  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        [Android] [Qt] The document.createEvent API does not support touch events.
+        https://bugs.webkit.org/show_bug.cgi?id=33605
+
+        Test: fast/events/touch/create-touch-event.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent): add creation of a TouchEvent when the "TouchEvent" argument is supplied.
+
+2010-01-14  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Ensures that the 'selected' attribute of an <option> is correct
+        https://bugs.webkit.org/show_bug.cgi?id=32641
+
+        Adds a check in OptionElement::selected() that checks if list items need to be recalculated and does so if needed,
+        so the attribute is up to date more often.  Also gets rid of most of the recalcStyle() side effects.
+
+         Our behavior now matches Firefox 3.5 and IE8 after the </select> is parsed.
+
+         Tests: fast/forms/HTMLOptionElement_selected2.html
+                fast/forms/HTMLOptionElement_selected3.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::setOptionsChangedOnRenderer):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::restoreFormControlState):
+        (WebCore::SelectElement::reset):
+        (WebCore::SelectElement::typeAheadFind):
+        * dom/SelectElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::selected):
+        (WebCore::HTMLOptionElement::insertedIntoTree):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcStyle):
+        (WebCore::HTMLSelectElement::recalcListItemsIfNeeded):
+        * html/HTMLSelectElement.h:
+        * wml/WMLSelectElement.cpp:
+        (WebCore::WMLSelectElement::recalcStyle):
+
+2010-01-14  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Allow custom memory allocation control for TransparencyLayer class
+        https://bugs.webkit.org/show_bug.cgi?id=33585
+
+        Inherits the following class from FastAllocBase because it is 
+        instantiated by 'new':
+
+        class name              - instantiated at: WebCore/'location'
+        class TransparencyLayer - platform/graphics/qt/GraphicsContextQt.cpp:906
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+
+2010-01-14  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Allow custom memory allocation control for FontPlatformDataPrivate class
+        https://bugs.webkit.org/show_bug.cgi?id=33583
+
+        Inherits the following class from Noncopyable because it is 
+        instantiated by 'new' and no need to be copyable:
+
+        class name                    - instantiated at: WebCore/'location'
+        class FontPlatformDataPrivate - platform/graphics/qt/FontPlatformData.h:70
+
+        * platform/graphics/qt/FontPlatformData.h:
+
+2010-01-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] un-needed seeks
+        https://bugs.webkit.org/show_bug.cgi?id=33532
+
+        Avoid un-needed seeks. Don't seek at current playback position and
+        don't update the rate if it is already set to target value.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::setRate):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2010-01-14  Eric Seidel  <eric@webkit.org>
+
+        No review.  Tiger build fix after http://trac.webkit.org/changeset/53238.
+
+        Need to implement WebGLContextAttributes
+        https://bugs.webkit.org/show_bug.cgi?id=31169
+
+        Fix a build break when ENABLE(3D_CANVAS) is disabled.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext): UNUSED_PARAM(attrs) when 3D_CANVAS is disabled.
+
+2010-01-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: use hidden text area for clipboard in order to
+        workaround windows setData bug.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33633
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype._copy):
+        * inspector/front-end/inspector.css:
+
+2010-01-13  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Slow named property lookup on DOMWindow because of missing fast case
+        https://bugs.webkit.org/show_bug.cgi?id=33584
+
+        Add fast case checks to V8 named property getter on DOMWindow
+        objects.  If the property is not in the DOM there is no reason to
+        search the DOM for all occurrences.
+
+        Covered by layout tests.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::namedPropertyGetter):
+
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7403736> REGRESSION (r49963,r49965): 8% Dromaeo Core DOM test regression
+
+        Adding isolated worlds support to the JSC bindings introduced a regression due to
+        additional map lookups.  Add a mechanism to quickly detect that a lookup is for the
+        'normal' world, and add fast paths to a couple of methods to check the normal world
+        first.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::Document::getWrapperCache):
+        (WebCore::DOMWrapperWorld::DOMWrapperWorld):
+        (WebCore::forgetDOMObject):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::isNormal):
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::IsolatedWorld::IsolatedWorld):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::createWrapperCache):
+        * dom/Document.h:
+
+2010-01-13  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Need to implement WebGLContextAttributes
+        https://bugs.webkit.org/show_bug.cgi?id=31169
+
+        Added the WebGLContextAttributes class and custom JavaScript
+        bindings to accept a native object as the second argument to
+        getContext("experimental-webgl") per the WebGL specification.
+        Added GraphicsContext3D::Attributes struct to isolate DOM and
+        graphics layers. Added getContextAttributes() to
+        WebGLRenderingContext. Added test case ensuring that context
+        attributes can be passed down and returned. Tested in Safari and
+        Chromium. The attributes will be hooked up to the creation of the
+        OpenGL context in bug 33416.
+
+        Test: fast/canvas/webgl/context-attributes.html
+
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSHTMLCanvasElementCustom.cpp:
+        (WebCore::JSHTMLCanvasElement::getContext):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/v8/DOMData.cpp:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * html/HTMLCanvasElement.h:
+        * html/HTMLCanvasElement.idl:
+        * html/canvas/CanvasContextAttributes.cpp: Added.
+        (WebCore::CanvasContextAttributes::CanvasContextAttributes):
+        (WebCore::CanvasContextAttributes::~CanvasContextAttributes):
+        * html/canvas/CanvasContextAttributes.h: Added.
+        * html/canvas/WebGLContextAttributes.cpp: Added.
+        (WebCore::WebGLContextAttributes::create):
+        (WebCore::WebGLContextAttributes::WebGLContextAttributes):
+        (WebCore::WebGLContextAttributes::~WebGLContextAttributes):
+        (WebCore::WebGLContextAttributes::alpha):
+        (WebCore::WebGLContextAttributes::setAlpha):
+        (WebCore::WebGLContextAttributes::depth):
+        (WebCore::WebGLContextAttributes::setDepth):
+        (WebCore::WebGLContextAttributes::stencil):
+        (WebCore::WebGLContextAttributes::setStencil):
+        (WebCore::WebGLContextAttributes::antialias):
+        (WebCore::WebGLContextAttributes::setAntialias):
+        (WebCore::WebGLContextAttributes::premultipliedAlpha):
+        (WebCore::WebGLContextAttributes::setPremultipliedAlpha):
+        (WebCore::WebGLContextAttributes::attributes):
+        * html/canvas/WebGLContextAttributes.h: Added.
+        * html/canvas/WebGLContextAttributes.idl: Added.
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::create):
+        (WebCore::WebGLRenderingContext::getContextAttributes):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::getContextAttributes):
+
+2010-01-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Windows build.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+
+2010-01-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Transition followed by animation fails to run the animation sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=33563
+
+        If a transition was closely followed by an animation, it was possible for the cleanup
+        after the end of the transition to kill the animation.
+        
+        Fix this by including the keyframes name (or empty string for transitions) in the labels
+        used to identify CAAnimations on layers.
+        
+        No test because this was a subtle timing issue that is hard to reproduce in a layout test.
+
+        * platform/graphics/mac/GraphicsLayerCA.h: Some new methods and signature changes.
+        
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::animationIdentifier): Pass the keyframes name, since this is included in the identifier string now.
+        (WebCore::moveAllAnimationsForProperty): Pass the keyframes name.
+        (WebCore::GraphicsLayerCA::moveAnimationsForProperty): Try to move both transition- and animation-related
+        CAAnimations, using the list of running animations to get the keyframe names for the latter.
+
+        (WebCore::GraphicsLayerCA::ensureStructuralLayer): moveAnimation renamed to moveAnimationsForProperty
+        and takes the keyframes name.
+
+        (WebCore::GraphicsLayerCA::updateLayerAnimations): Pass keyframes name down (or "" for transitions).
+        (WebCore::GraphicsLayerCA::setAnimationOnLayer): Pass keyframes name down.
+        (WebCore::GraphicsLayerCA::removeAnimationFromLayer): Pass keyframes name down.
+        (WebCore::GraphicsLayerCA::pauseAnimationOnLayer): Pass keyframes name down.
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer): Pass keyframes name down.
+
+2010-01-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix shadow drawing to do the correct computations using the base coordinate space
+        https://bugs.webkit.org/show_bug.cgi?id=33629
+        
+        Shadows draw using the CGContext base CTM, so we need to convert the shadow offet
+        and size from user CTM into into base CTM coordinates, via the matix obtained from wkGetUserToBaseCTM().
+
+        Test: compositing/shadows/shadow-drawing.html
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2010-01-13  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        SVGClipPathElement shouldn't resolve style manually
+        https://bugs.webkit.org/show_bug.cgi?id=33647
+
+        Build renderers for SVGClipPathElement, so we can query the style from the renderer
+        instead of re-resolving style on every clip path resource invalidation.
+
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::createRenderer):
+        (WebCore::SVGClipPathElement::canvasResource):
+        * svg/SVGClipPathElement.h:
+        (WebCore::SVGClipPathElement::isValid):
+
+2010-01-13  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector does not update the DOM tree when attributes change.
+        https://bugs.webkit.org/show_bug.cgi?id=20162
+
+        * dom/Element.cpp: Moves callbacks to InspectorController directly into setAttribute
+        and removeAttribute and removes the existing call sites. This makes it possible to
+        see attribute modifications.
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::dispatchAttrRemovalEvent):
+        (WebCore::Element::dispatchAttrAdditionEvent):
+        (WebCore::Element::removeAttribute):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._setAttributesPayload): Clear existing attributes.
+        (WebInspector.DOMAgent.prototype._didApplyDomChange): Updated call site and fixed style.
+        (WebInspector.DOMAgent.prototype._attributesUpdated): Added.
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._attributesUpdated): Added.
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes): Updated call site.
+        * inspector/front-end/ElementsTreeOutline.js: Renamed _updateTitle to updateTitle.
+        (WebInspector.ElementsTreeElement.prototype.onattach): Updated updateTitle call site.
+        (WebInspector.ElementsTreeElement.prototype._textNodeEditingCommitted): Ditto.
+        (WebInspector.ElementsTreeElement.prototype._editingCancelled): Ditto.
+
+2010-01-13  Carol Szabo <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        CounterNode::nextInPreOrderAfterChildren(stayWithin) does not stay within.
+        https://bugs.webkit.org/show_bug.cgi?id=33625
+
+        No new tests because the fix should affect strictly performance.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::nextInPreOrderAfterChildren):
+
+2010-01-13  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        Window size changes are not propagated down the render tree
+        https://bugs.webkit.org/show_bug.cgi?id=33643
+
+        Test: svg/custom/relative-sized-content.xhtml
+
+        * rendering/RenderSVGContainer.cpp: Fix incorrect markParents=true usage, leading to unnecessary relayouts.
+        (WebCore::RenderSVGContainer::layout): Use new layoutChildren() method.
+        (WebCore::RenderSVGContainer::paint): Fix indention.
+        * rendering/RenderSVGHiddenContainer.cpp: Fix incorrect markParents=true usage.
+        (WebCore::RenderSVGHiddenContainer::layout): Use new layoutChildren() helper.
+        * rendering/RenderSVGRoot.cpp: Refactor existing code to layout children in SVGRenderSupport::layoutChildren.
+        (WebCore::RenderSVGRoot::layout): Make children relayouting depend on width/height changes, if the outermost svg uses relative viewport sizes.
+        * rendering/SVGRenderSupport.cpp: Add central place handling child layout, skips relayouting non-relative sized children as benefit.
+        (WebCore::SVGRenderBase::layoutChildren): This methods contains the actual changes.
+        * rendering/SVGRenderSupport.h:
+        * svg/SVGGElement.h: Remove dead code.
+        * svg/SVGSVGElement.h: Make hasRelativeValues() public to remove the need for friendship declarations.
+        * svg/SVGStyledElement.h: Change default return value for hasRelativeValues() to false, as it was intended.
+        (WebCore::SVGStyledElement::hasRelativeValues): Make it public, to be usable from SVGRenderSupport.
+        * svg/SVGSymbolElement.h: Remove dead code.
+        * svg/SVGUseElement.cpp: Implement hasRelativeValues() - it was simply missing here.
+        (WebCore::SVGUseElement::hasRelativeValues):
+        * svg/SVGUseElement.h:
+
+2010-01-13  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix websocket/tests/worker/worker-simple.html crash on Leopard Intel Debug (Tests) builder
+        https://bugs.webkit.org/show_bug.cgi?id=33581
+
+        unref m_workerContext when websocket is disconnected, so that avoid
+        keeping reference to workerContext longer than worker thread runs.
+
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::disconnect):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::waitForMethodCompletion):
+
+2010-01-12  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: selected, selectable, extended selectable, and multiple
+        selectable states are not reported
+
+        https://bugs.webkit.org/show_bug.cgi?id=33574
+        <rdar://problem/7536826>
+
+        Reviewed by Darin Adler.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isMultiSelectable):
+        Use the correct function name - the function name overriden by
+        and used in AccessiblityRenderObject.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkStateSetFromCoreObject):
+        Update for function rename.
+        (webkit_accessible_selection_select_all_selection):
+        Ditto.
+
+2010-01-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Move more of the selection and caret painting code from Frame to SelectionController.
+        https://bugs.webkit.org/show_bug.cgi?id=33619
+
+        Helpful preparation step for a bug fix I am working on.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController): Initialize new data members.
+        Note that m_caretVisible starts as true for the drag caret controller to match the
+        old behavior for painting.
+        (WebCore::SelectionController::setSelection): Changed to call selectionLayoutChanged
+        in its new name and location.
+        (WebCore::SelectionController::paintCaret): Added checks that were formerly done
+        at the Frame level. Tweaked formatting and changed to use early return as well.
+        (WebCore::SelectionController::focusedOrActiveStateChanged): Updated for call
+        moved into this class.
+        (WebCore::SelectionController::updateAppearance): Moved the
+        Frame::selectionLayoutChanged function here. Had to rename it because the word
+        "layout" is usedfor other purposes in this function.
+        (WebCore::SelectionController::setCaretVisible): Moved here from Frame.
+        (WebCore::SelectionController::clearCaretRectIfNeeded): Ditto.
+        (WebCore::SelectionController::caretBlinkTimerFired): Ditto.
+
+        * editing/SelectionController.h: Added new functions. Moved conditional function
+        out of class definition for clarity. Removed unneeded == and != operators.
+        Removed unneeded use of bit fields.
+
+        * page/Frame.cpp: Moved functions to SelectionController.
+        (WebCore::Frame::Frame): Removed initialization of moved data members.
+
+        * page/Frame.h: Removed things moved to SelectionController as well as unneeded
+        forward declaration of Timer class template.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout): Updated for new location of function.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintCaret): Ditto.
+
+2010-01-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7532544>
+        
+        Expose new method on WebKitSystemInterface, WKGetUserToBaseCTM(), which will
+        be used for a shadow drawing fix.
+
+        * WebCore.base.exp:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2010-01-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix shadow drawing to do the correct computations using the base coordinate space
+        https://bugs.webkit.org/show_bug.cgi?id=33629
+
+        Step 1: do some renames in setPlatformShadow():
+            size -> offset
+            width -> xOffset
+            height -> yOffset
+        
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2010-01-13  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Move getSessionStorageNamespace from WebKitClient to WebViewClient
+        https://bugs.webkit.org/show_bug.cgi?id=33492
+
+        * page/Page.cpp:
+        (WebCore::Page::sessionStorage):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        * storage/StorageNamespace.h:
+        (WebCore::StorageNamespace::~StorageNamespace):
+
+2010-01-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Repaint bug dragging a star shape with a dash stroke
+        https://bugs.webkit.org/show_bug.cgi?id=33406
+
+        Calculation of repaint rects for RenderPath objects was wrong. We must take the
+        union of strokeBoundingBox and objectBoundingBox, since the strokeBoundingBox
+        must not contain the objectBoundingBox. This is mainly visible on dash-arrays for
+        strokes.
+
+        Test: svg/custom/js-repaint-rect-on-path-with-stroke.svg
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::strokeBoundingBox):
+
+2010-01-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix. Make the XFORM operator work on wx port.
+
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * wscript:
+
+2010-01-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce SourceFrame2 with basic breakpoint / execution line
+        rendering capabilities.
+
+        Contains a drive-by naming fix (lineNumberOffset and lineNumberToOffset were
+        too close to each other, but were unrelated).
+
+        https://bugs.webkit.org/show_bug.cgi?id=33618
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/SourceFrame2.js: Added.
+        (WebInspector.SourceFrame2):
+        (WebInspector.SourceFrame2.prototype.set text):
+        (WebInspector.SourceFrame2.prototype.get executionLine):
+        (WebInspector.SourceFrame2.prototype.set executionLine):
+        (WebInspector.SourceFrame2.prototype.revealLine):
+        (WebInspector.SourceFrame2.prototype._toggleBreakpoint):
+        (WebInspector.SourceFrame2.prototype.resize):
+        (WebInspector.BreakpointLineNumberDecorator):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.decorate):
+        (WebInspector.BreakpointLineNumberDecorator.prototype._paintBreakpoint):
+        (WebInspector.BreakpointLineNumberDecorator.prototype._paintProgramCounter):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.mouseDown):
+        (WebInspector.ExecutionLineDecorator):
+        (WebInspector.ExecutionLineDecorator.prototype.decorate):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype.get textModel):
+        (WebInspector.TextEditor.prototype.set readOnly):
+        (WebInspector.TextEditor.prototype.set lineNumberDecorator):
+        (WebInspector.TextEditor.prototype.set lineDecorator):
+        (WebInspector.TextEditor.prototype.selectionRange):
+        (WebInspector.TextEditor.prototype._offsetToLine):
+        (WebInspector.TextEditor.prototype._lineToOffset):
+        (WebInspector.TextEditor.prototype.reveal):
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype._updateSize):
+        (WebInspector.TextEditor.prototype.updateCanvasSize):
+        (WebInspector.TextEditor.prototype._repaintAll):
+        (WebInspector.TextEditor.prototype._paintLines):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype.paintLineNumbers):
+        (WebInspector.TextEditor.prototype._paintCurrentLine):
+        (WebInspector.TextEditor.prototype._mouseDown):
+        (WebInspector.TextEditor.prototype._caretForMouseEvent):
+        (WebInspector.TextEditor.prototype._keyDown):
+        (WebInspector.TextEditor.prototype._handleNavigationKey):
+        (WebInspector.TextEditor.prototype._textInput):
+        (WebInspector.TextEditor.prototype._updateCursor):
+        (WebInspector.TextEditor.prototype._paintSelection):
+        (WebInspector.TextEditor.prototype._initFont):
+
+2010-01-13  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Generate a function in the V8 bindings to convert v8 objects
+        to native WebCore objects.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Generate and use toNative().
+        * bindings/v8/V8Binding.cpp: Remove manually defined conversion helprs.
+        (WebCore::getElementStringAttr):
+        (WebCore::setElementStringAttr):
+        * bindings/v8/V8Binding.h: Remove manually defined conversion helprs.
+        * bindings/v8/V8SVGPODTypeWrapper.h: Still need a manually defined coversion helper for SVGPODTypes.
+        (WebCore::V8SVGPODTypeWrapper::toNative):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::V8WebGLRenderingContext::getProgramParameterCallback):
+        (WebCore::V8WebGLRenderingContext::getShaderParameterCallback):
+        (WebCore::V8WebGLRenderingContext::getUniformCallback):
+
+2010-01-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        REGRESSION (r49268): DHTML drag not allowed unless event.dataTransfer.effectAllowed
+        is set (differs from HTML5).
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=33607> and <rdar://7507114>.
+
+        If no effectAllowed is set in the dragStart operation, we should default to
+        uninitialized instead of none, so the user doesn't have to manually set the
+        effectAllowed to enable drag and drop.
+
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+
+2010-01-13  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32495
+
+        font-size:small with background-color causes text to get clipped.  Make sure to only paint within the lineTop/lineBottom of
+        a line for quirky inline flow boxes that didn't contribute to the overall height of the line. 
+        
+        Added fast/backgrounds/quirks-mode-line-boxes-backgrounds.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+
+2010-01-13  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Refactoring DatabaseAuthorizer to use a CaseFoldingHash function
+        for the set of whitelisted sqlite functions, and fixing some
+        indenting issues.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33612
+
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::allowFunction):
+        * storage/DatabaseAuthorizer.h:
+
+2010-01-13  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        RenderObject::nextInPreOrderAfterChildren(RenderObject* stayWithin) does not stay within
+        https://bugs.webkit.org/show_bug.cgi?id=33600
+
+        No new tests as this fix affects mainly performance.
+        No test has been found yet that could evidence the bug in the layout
+        of a page, but the fix to bug 32884 exposes this bug on some pages
+        such as http://www.w3.org/Style/CSS/Test/CSS2.1/current/html4/counters-scope-implied-001.htm
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::nextInPreOrderAfterChildren):
+
+2010-01-13  Jeremy Orlow  <jorlow@chromium.org>
+
+        No reviewer.  More or less a build fix.  My 53180 broke some 
+        stuff on the Chromium port so I'm reverting.
+
+        * page/Page.cpp:
+        (WebCore::Page::sessionStorage):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        * storage/StorageNamespace.h:
+        (WebCore::StorageNamespace::~StorageNamespace):
+
+2010-01-13  Steve Block  <steveblock@google.com>
+
+        Update appendClassName in jni_runtime.cpp to use WebCore::StringBuilder, rather than JSC::StringBuilder.
+        https://bugs.webkit.org/show_bug.cgi?id=33586
+
+        Avoiding the JSC version of StringBuilder allows this file to be used with both JSC and V8 on Android.
+
+        No new tests, refactoring only.
+
+        * bridge/jni/jni_runtime.cpp: Modified.
+        (JavaMethod::signature): Modified. Use WebCore::StringBuilder.
+
+2010-01-13  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Some objects in the global scope are not completed
+        https://bugs.webkit.org/show_bug.cgi?id=19119
+
+        Use Object.getOwnPropertyNames instead of for-in to provide completions, since
+        Object.getOwnPropertyNames reports both enumerable and non-enumerable properties.
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._getPropertyNames):
+        (InjectedScript.getCompletions):
+
+2010-01-13  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Android] [Qt] The JSC ScriptController does not consider Touch Events user gestures.
+        https://bugs.webkit.org/show_bug.cgi?id=33597
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGestureEvent): Add the touch event types (touchstart, touchmove and touchend) to the set of events that are considered user gestures.
+
+2010-01-13  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        [Qt] REGRESSION(53187) Touchevent related tests fail
+
+        https://bugs.webkit.org/show_bug.cgi?id=33602
+
+        Pass the ENABLE_TOUCH_EVENTS to the IDL generators.
+
+        * WebCore.pri:
+
+2010-01-13  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        WebInspector: Timeline panel scrolling speed can be increased.
+        https://bugs.webkit.org/show_bug.cgi?id=33579
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+
+2010-01-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Split the build process in two different .pro files.
+        This allows qmake to be run once all source files are available.
+
+        * DerivedSources.pro: Added.
+        * WebCore.pri: Added. Contains common logic between source generation and compilation.
+        * WebCore.pro: Moved source generation to DerivedSources.pro.
+
+2010-01-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Scrolling editor to the 20Kth line is not smooth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33587
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype._highlightChanged):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype._highlightInChunks):
+        (WebInspector.TextEditorHighlighter.prototype.updateHighlight):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLines):
+        (WebInspector.TextEditorHighlighter.prototype._lex):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel.prototype._setLine):
+        (WebInspector.TextEditorModel.prototype.setAttribute):
+        (WebInspector.TextEditorModel.prototype.getAttribute):
+        (WebInspector.TextEditorModel.prototype.removeAttribute):
+
+2010-01-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix the build on Windows.
+
+        PluginViewWin.cpp requires the conversion operator from TransformationMatrix to XFORM.
+
+        * WebCore.pro: Build TransformationMatrixWin.cpp.
+        * platform/graphics/transforms/TransformationMatrix.h: Enable the conversion operator to XFORM.
+
+2010-01-13  Miikka Heikkinen <miikka.heikkinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt/Symbian] Added missing vendor information to qtwebkit.sis
+
+        This information is necessary to Symbian sign the package.
+
+        http://bugreports.qt.nokia.com/browse/QTBUG-7290
+
+        * WebCore.pro:
+
+2010-01-11  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Move getSessionStorageNamespace from WebKitClient to WebViewClient
+        https://bugs.webkit.org/show_bug.cgi?id=33492
+
+        * page/Page.cpp:
+        (WebCore::Page::sessionStorage):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        * storage/StorageNamespace.h:
+        (WebCore::StorageNamespace::~StorageNamespace):
+
+2010-01-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Adding a list of whitelisted sqlite functions that users are
+        allowed to use.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33549
+
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::authorizerFunction):
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::DatabaseAuthorizer):
+        (WebCore::DatabaseAuthorizer::addWhitelistedFunctions):
+        (WebCore::DatabaseAuthorizer::allowFunction):
+        * storage/DatabaseAuthorizer.h:
+
+2010-01-12  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt][WebSocket] SocketStreamHandleSoup.cpp is misnamed
+        https://bugs.webkit.org/show_bug.cgi?id=33077
+
+        * WebCore.pro:
+        * platform/network/qt/SocketStreamHandleQt.cpp: Copied from WebCore/platform/network/qt/SocketStreamHandleSoup.cpp.
+        * platform/network/qt/SocketStreamHandleSoup.cpp: Removed.
+
+2010-01-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        position:fixed and transform on same element breaks fixed behavior
+        https://bugs.webkit.org/show_bug.cgi?id=31283
+
+        Fix interactions of transforms and fixed positioning, namely that fixed position
+        elements with a transformed ancestor are positioned relative to that ancestor,
+        and an element with both a transform and fixed position respects that positioning.
+        
+        Test: transforms/2d/transform-fixed-container.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint):
+        Transforms should not unconditionally stop the propagation of the 'fixed' flag to ancestors,
+        but only if the transformed element is not itself fixed.
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::convertToLayerCoords):
+        Fix this method to behave correctly for fixed position layers whose container is not
+        the root, but some other (probably transformed) ancestor. In that case, we can fall into
+        the "position: absolute" code path.
+
+2010-01-12  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix an assert being triggered by how the Chromium port sets the
+        replacing flag for error pages.  This was caused by r53143.
+
+        Covered by existing Chromium UI tests.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+
+2010-01-12  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [ES5] Implement Object.getOwnPropertyNames
+        https://bugs.webkit.org/show_bug.cgi?id=32242
+
+        Add new argument to reimplementations of getPropertyNames()
+        and getOwnPropertyNames(), and update the JS bindings generator.
+
+        Test: fast/js/Object-getOwnPropertyNames.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getPropertyNames):
+        (WebCore::JSDOMWindow::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getPropertyNames):
+        (WebCore::JSDOMWindowShell::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyNames):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getPropertyNames):
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::getOwnPropertyNames):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertyNames):
+        * bridge/runtime_array.h:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getPropertyNames):
+        (JSC::RuntimeObjectImp::getOwnPropertyNames):
+        * bridge/runtime_object.h:
+
+2010-01-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Safari shows an unneeded horizontal scrollbar on many websites.
+        Fixes <rdar://6321041> and <http://webkit.org/b/33555>.
+        
+        If a div has no children, and its height or width are 0, we can ignore
+        it in our calculation of lowest, rightmost, and leftmost positions. This
+        calculation was causing horizontal scrollbars to be drawn when they weren't needed.
+
+        Test: fast/block/positioning/absolute-positioning-no-scrollbar.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lowestPosition): Added check for no children and width or height 0.
+        (WebCore::RenderBlock::rightmostPosition): Ditto.
+        (WebCore::RenderBlock::leftmostPosition): Ditto.
+
+2010-01-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Optimize WebInspector.TimelineGrid.prototype.updateDividers()
+
+        DOM element property access and modification are slow and should be done as lazily as possible.
+        https://bugs.webkit.org/show_bug.cgi?id=33536
+
+        * inspector/front-end/TimelineGrid.js:
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        (WebInspector.TimelineGrid.prototype._setDividerAndBarLeft):
+
+2010-01-12  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=33550 REGRESSION: -
+        webkit-svg-shadow with opacity still over-clipped
+
+        We need to call inflateForShadow() on the repaintRect before we 
+        clip for opacity or we will over-clip.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+2010-01-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Update all-in-one derived sources for Geolocation.
+
+        * DerivedSources.cpp: Add JSCoordinates.cpp, JSGeolocation.cpp, JSGeoposition.cpp, JSPositionError.cpp
+
+2010-01-12  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove static const ints from V8CustomBinding.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=33547
+
+        * bindings/scripts/CodeGeneratorV8.pm: Generate and use custom 
+            internal field indices from lists of custom internal fields.
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/NPV8Object.h:
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp: Remove a bunch of now unnecessary
+            manually calls to setInternalFieldCount().
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/V8IsolatedContext.cpp:
+        * bindings/v8/V8IsolatedContext.h:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h: Remove the static const ints.
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+
+2010-01-12  Darin Fisher  <darin@chromium.org>
+
+        Fixing chromium build bustage.
+
+        * bindings/v8/custom/V8PopStateEventCustom.cpp: Add V8Proxy.h include.
+
+2010-01-12  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add V8 bindings for PopStateEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=33546
+        
+        This is covered by existing tests for PopStateEvent.
+
+        * WebCore.gypi:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8PopStateEventCustom.cpp: Added.
+        (WebCore::V8PopStateEvent::initPopStateEventCallback):
+        (WebCore::V8PopStateEvent::stateAccessorGetter):
+
+2010-01-12  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds source length to ParseHTMLRecords in the inspector timeline.
+        https://bugs.webkit.org/show_bug.cgi?id=33548
+
+        Test: inspector/timeline-parse-html.html
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        * inspector/InspectorTimelineAgent.h:
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createParseHTMLRecord):
+        * inspector/TimelineRecordFactory.h:
+
+2010-01-12  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=31597
+
+        Make ICU's text breakiterator and string search use Chrome's UI
+        language instead of 'en-US' or the OS UI language.
+
+        As long as the webkit layout tests are run in en-US locale, there'd be 
+        no visible change.
+
+        * platform/text/chromium/TextBreakIteratorInternalICUChromium.cpp:
+        (UILanguage):
+        (WebCore::currentSearchLocaleID):
+        (WebCore::currentTextBreakLocaleID):
+
+2010-01-12  Beth Dakin  <bdakin@apple.com>
+
+        Rubber-stamped by Dave Hyatt.
+
+        This patch changes the name of -webkit-shadow to -webkit-svg-shadow 
+        to avoid giving a custom property an overly-general name.
+        <rdar://problem/7534590>
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseShadow):
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/SVGCSSPropertyNames.in:
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+
+2010-01-12  Peter Kasting  <pkasting@google.com>
+
+        Not reviewed, build fix.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2010-01-12  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add a null check in case of an event handler with invalid syntax.
+
+        Should make fast/js/invalid-syntax--for-function.html not crash in
+        Chromium's test shell.
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::callListenerFunction): Check the listener object before using it.
+
+2010-01-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove XBM support from the open-source image decoders.
+        https://bugs.webkit.org/show_bug.cgi?id=27823
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::create):
+        * platform/image-decoders/xbm: Removed.
+        * platform/image-decoders/xbm/XBMImageDecoder.cpp: Removed.
+        * platform/image-decoders/xbm/XBMImageDecoder.h: Removed.
+
+2010-01-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33540
+        Make it possible to build in debug mode with assertions disabled
+
+        * dom/Element.cpp: (WebCore::Element::getURLAttribute):
+        * dom/SelectElement.cpp: (WebCore::SelectElementData::checkListItems):
+        * editing/TextIterator.cpp:
+        * loader/Cache.cpp: (WebCore::Cache::removeFromLRUList):
+        * rendering/RenderArena.cpp: (WebCore::RenderArena::free):
+
+2010-01-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler and Simon Fraser.
+
+        rdar://problem/5684062
+        https://bugs.webkit.org/show_bug.cgi?id=23094
+        Flash of white when switching from poster image to video playback
+        
+        https://bugs.webkit.org/show_bug.cgi?id=23140
+        <video> poster should scale like a video frame
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState): Only call updatePosterImage from one place
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::HTMLVideoElement): m_shouldShowPosterImage -> m_shouldDisplayPoster.
+        (WebCore::HTMLVideoElement::createRenderer): Always create a RenderVideo.
+        (WebCore::HTMLVideoElement::attach): Call updatePosterImage before checking to see if we
+            should display the poster image. renderer() is never a RenderImage, don't need to check.
+            m_shouldShowPosterImage -> m_shouldDisplayPoster.
+        (WebCore::HTMLVideoElement::detach): m_shouldShowPosterImage -> m_shouldDisplayPoster.
+        (WebCore::HTMLVideoElement::parseMappedAttribute): Cache poster attribute when it is set since
+            it is checked frequently. m_shouldShowPosterImage -> m_shouldDisplayPoster.
+        (WebCore::HTMLVideoElement::updatePosterImage): Don't bother looking at the network state, 
+            display the poster as long as the attribute is valid and the media engine says it hasn't
+            rendered a video frame. m_shouldShowPosterImage -> m_shouldDisplayPoster.
+        (WebCore::HTMLVideoElement::hasAvailableVideoFrame): New, ask the media engine if a video frame
+            is available to render.
+        * html/HTMLVideoElement.h:
+        (WebCore::HTMLVideoElement::poster):
+        (WebCore::HTMLVideoElement::shouldDisplayPoster):
+
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::updateRenderer): Call setCachedImage for render video too.
+
+        * manual-tests/video-player.html: Remove bit-rot from manual test so it works again.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::hasAvailableVideoFrame): New, ask the media engine if a video frame
+            is available to render.
+
+        * platform/graphics/MediaPlayer.h: Prototype for hasAvailableVideoFrame.
+        * platform/graphics/MediaPlayerPrivate.h: Ditto.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h: Declare hasAvailableVideoFrame, declare
+            all bool variables to aid packing.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm: 
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_videoFrameHasDrawn. Cleanup
+            floating point initializers to match coding guidelines.
+        (WebCore::MediaPlayerPrivate::load): Initialize m_videoFrameHasDrawn.
+        (WebCore::MediaPlayerPrivate::hasAvailableVideoFrame): New.
+        (WebCore::MediaPlayerPrivate::repaint): Set m_videoFrameHasDrawn.
+
+        (WebCore::RenderImage::paintReplaced): Split part out into paint method.
+        (WebCore::RenderImage::paint): New.
+        * rendering/RenderImage.h: Declare paint. Make isWidthSpecified and isHeightSpecified protected
+            instead of private so RenderVideo can use them.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::RenderMedia): Inherit from RenderImage, not RenderReplaced
+        (WebCore::RenderMedia::destroy): Ditto.
+        (WebCore::RenderMedia::styleDidChange): Ditto.
+        (WebCore::RenderMedia::layout): Ditto.
+        (WebCore::RenderMedia::lowestPosition): Ditto.
+        (WebCore::RenderMedia::rightmostPosition): Ditto.
+        (WebCore::RenderMedia::leftmostPosition): Ditto.
+        * rendering/RenderMedia.h: Declare isImage and isRenderImage.
+
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::intrinsicSizeChanged): New, call RenderVideo::intrinsicSizeChanged
+            when displaying a poster so it is sized correctly.
+        (WebCore::RenderVideo::imageChanged): Override so we can cache the image's intrisic size and
+        use it when we also know the movie's intrinsic size but still need to draw the poster.
+        (WebCore::RenderVideo::videoBox): Use the poster's intrinsic size when drawing the poster,
+        use the movie's intrinsic size when drawing frames.
+        (WebCore::RenderVideo::paintReplaced): Call RenderImage::paint when drawing the poster.
+        (WebCore::RenderVideo::videoElement): New.
+        (WebCore::RenderVideo::updatePlayer):
+        * rendering/RenderVideo.h:
+        (WebCore::RenderVideo::minimumReplacedHeight): Added.
+
+2010-01-12  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix a crash in Chromium when receiving multipart/x-mixed-replace data.
+        If we stop a multipart load after ResourceLoader::didReceiveResponse
+        but before ResourceLoader::didReceiveData, we have a NULL document
+        loader because it has been moved back to the provisional state.  New
+        loads that happen after this will dereference the NULL document
+        loader.
+
+        Work around this by moving the provisional document loader back as
+        the document loader when the request is stopped.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31446
+
+        Test: http/tests/multipart/multipart-wait-before-boundary.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+
+2010-01-12  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebKit returns incorrect match count when first string match is on an element with user-select-none style
+        https://bugs.webkit.org/show_bug.cgi?id=33508
+        <rdar://problem/7482143>
+
+        If we use VisiblePosition to calculate the start of the new search range,
+        we skip all the nodes with user-select-none style, producing an incorrect
+        match count.
+        
+        No new tests: there are no API's available to Javascript to verify the
+        number of matches found.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::markAllMatchesForText): Changed to use the end of the previous
+        result range as the start of the new search range.
+
+2010-01-12  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Changed ".sidebar" style to allow v-scroll to appear in
+        "Profiles" panel sidebar.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33470
+
+        No new tests -- no code changed.
+
+        * inspector/front-end/inspector.css:
+
+2010-01-12  Adam Roben  <aroben@apple.com>
+
+        Windows accelerated compositing build fix after r53110
+
+        * plugins/PluginWidget.h:
+        (WebCore::PluginWidget::platformLayer): Define platformLayer() for
+        non-Mac platforms that have accelerated compositing turned on. It
+        would probably be better to make PluginWidget not be used at all on
+        non-Mac platforms, but this fix is much simpler.
+
+2010-01-12  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Support injection of inspector scripts into the inspected context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33523
+
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::WeakReferenceCallback):
+        (WebCore::createInjectedScriptHostV8Wrapper):
+        (WebCore::createInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+
+2010-01-12  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        Form Reset : Press Back Button and Reset , TextareaElemnt is not set to Default Value
+        https://bugs.webkit.org/show_bug.cgi?id=31539
+
+        Added manual test: manual-tests/textarea-reset-default-value.html.
+
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::restoreFormControlState): set the value, rather than default value of a text area when restoring its state. This allows resetting a form with a textarea to work correctly after its state has been restored.
+        * manual-tests/resources/textarea-form-back-on-submit.html: Added.
+        * manual-tests/textarea-reset-default-value.html: Added.
+
+2010-01-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] WebCore::Path allocates QPainterPath unnecessarily on the heap
+        https://bugs.webkit.org/show_bug.cgi?id=33466
+
+        WebCore::Path is a pointer to a PlatformPath. In case of Qt that's a
+        QPainterPath, which itself is a pointer to the elements (QVector).
+        That creates unecessary allocations in PathQt.cpp.
+
+        Replaced the "PlatformPath* m_path;" with a PlatformPathPtr, which
+        is a plain QPainterPath.
+
+        * platform/graphics/Path.h:
+        (WebCore::Path::platformPath):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::drawFilledShadowPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::addPath):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::clipOut):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::~Path):
+        (WebCore::Path::operator=):
+        (WebCore::Path::contains):
+        (WebCore::Path::strokeContains):
+        (WebCore::Path::translate):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::strokeBoundingRect):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::clear):
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::debugString):
+        (WebCore::Path::apply):
+        (WebCore::Path::transform):
+
+2010-01-12  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] XSL stylesheets can load documents from a different origin
+
+        https://bugs.webkit.org/show_bug.cgi?id=33423
+
+        * xml/XSLTProcessorQt.cpp:
+        (WebCore::XSLTUriResolver::XSLTUriResolver):
+        (WebCore::XSLTUriResolver::resolve):
+        (WebCore::XSLTProcessor::transformToString):
+
+2010-01-12  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30883
+        [Gtk] Implement AtkText for HTML elements which contain text
+
+        Tweak/correction: Eliminate a needless variable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_caret_offset):
+
+2010-01-12  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Allow creating injected script for the inspected script state. The InjectedScript is
+        cached on the inspected ExecState global object and will be garbage collected when the
+        object is collected. Each InjectedScript object is assigned unique id.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33469
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+        (WebCore::JSDOMGlobalObject::setInjectedScript):
+        (WebCore::JSDOMGlobalObject::injectedScript):
+        * bindings/js/JSDOMGlobalObject.h: InjectedScript is cached on the global object as a
+        field that is not visible from the inspected code. This InjectedScript should be alive as long as
+        the global object is alive and should be accessible from Web Inspector's native code.
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::createInjectedScript): Creates injected script using the lexical global object of the
+        inspected ScriptState. Reference to the object is stored on the global DOM object.
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::injectedScriptForId):
+        (WebCore::InjectedScriptHost::discardInjectedScripts): This method is expected to be called when the
+        the InjectedScript are no longer needed. In particular, this should be called before frame navigation. 
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::setInjectedScriptSource): This allows to provide injected script source.
+        The source may be loaded in a platform specific way.
+
+2010-01-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix handling of unusual kana sequences in search
+        https://bugs.webkit.org/show_bug.cgi?id=33506
+
+        * editing/TextIterator.cpp:
+        (WebCore::composedVoicedSoundMark): Removed unnnecessary case for a
+        non-kana-letter character. This function only works for kana letters.
+        (WebCore::SearchBuffer::isBadMatch): Fixed voiced sound mark code to
+        properly handle cases where one character has a shorter list of
+        combining voiced sound marks than the other.
+
+2010-01-11  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Clear m_acceptedIndexOnAbandon flag when user accepts the selected index.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33499
+
+        TEST: manual-tests/chromium/onchange-reload-popup.html
+        It should be covered by the above test. The current
+        test shell does not support sending keyboard events to popup
+        list so use manual test for it.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::acceptIndex):
+
+2010-01-11  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] Debug bots crashing in plugins/iframe-shims.html
+        https://bugs.webkit.org/show_bug.cgi?id=33472
+
+        Call computeOffsetInContainerNode() instead of
+        offsetInContainerNode(), since we are not sure this is always
+        parent-anchored.
+
+        plugins/iframe-shims.html no longer ASSERTS
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (objectAndOffsetUnignored):
+
+2010-01-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33455
+        Allows plugins to participate in accelerated compositing
+
+        For plugins using the CoreAnimation rendering mode, host their CALayers in the
+        accelerated compositing layer tree.
+        
+        This requires making normal flow RenderLayers for RenderEmbeddedObjects when they represent
+        a plugin using this mode.
+        
+        * WebCore.base.exp: Export Node::setNeedsStyleRecalc() for use by WebKit.
+        * WebCore.xcodeproj/project.pbxproj: Re-order files for sorting.
+
+        * rendering/RenderEmbeddedObject.h:
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::requiresLayer): Make a layer if the plugin is using
+        accelerated compositing mode.
+        (WebCore::RenderEmbeddedObject::allowsAcceleratedCompositing): Asks whether the plugin has
+        a layer, via PluginWidget.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
+        (WebCore::RenderLayer::isSelfPaintingLayer):
+        RenderEmbeddedObjects should be normal flow layers, and self-painting layers.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        Parent the plugin's layer in the GraphicsLayer when updating the layer configuration.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForPlugin):
+        RenderEmbeddedObjects that allow accelerated compositing trip accelerated compositing mode
+        for the page.
+
+2010-01-11  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed an uninitialized PluginView member (m_mode) which wasn't
+        set when constructed with a null PluginPackage*
+
+        https://bugs.webkit.org/show_bug.cgi?id=33468
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+
+2010-01-11  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG radialGradient example radial-gradient-with-outstanding-focalPoint.svg fails
+        https://bugs.webkit.org/show_bug.cgi?id=32201
+
+        This patch moves every focalPoint that lies outside the circle defined by the radial
+        gradients central point and its radius to stay inside this circle, as demanded by the
+        SVG 1.1 specification.
+        We use r * 0.99 as maximum radius for the aforementioned circle, when determining where
+        the focalPoint is lying, to achieve compatibility with Firefox.
+
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+
+2010-01-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33493
+        Log redirect details to Network channel
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+        Log response code and Location header field value. Also, removed a redundant null check.
+
+2010-01-11  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=33491 REGRESSION: 
+        Many SVG -webkit-shadow tests are currently failing (in the pixel 
+        tests)
+        -and-
+        <rdar://problem/7501200>
+
+        The real fix here is to call inflateForShadow() on the repaintRect 
+        in prepareToRenderSVGContent(). But in order to do that, I had to 
+        move inflateForShadow() to a different class since functions in 
+        SVGRenderBase cannot call each other. inflateForShadow() now exists 
+        in SVGRenderStyle which I think makes some sense because a similar 
+        function that returns a box shadow's extent exists on RenderStyle.
+
+        Now call inflateForShadow() through the SVGRenderStyle.
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::computeRectForRepaint):
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::computeRectForRepaint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::computeRectForRepaint):
+
+        No longer implement inflateForShadow() here.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent): Call new 
+        inflateForShadow() through the SVGRenderStyle
+        * rendering/SVGRenderSupport.h:
+
+        Implementation of inflateForShadow() now lives here.
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::getSVGShadowExtent):
+        (WebCore::SVGRenderStyle::inflateForShadow):
+        * rendering/style/SVGRenderStyle.h:
+
+2010-01-11  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Rewrite relative URLs in the ElementsTreeOutline to make them navigable
+
+        Targets for "src" and "href" attribute values in the Elements outline tree
+        are rewritten to full URLs whenever possible.
+        https://bugs.webkit.org/show_bug.cgi?id=33024
+
+        Test: inspector/elements-panel-rewrite-href.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._rewriteAttrHref):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
+        * inspector/front-end/inspector.js:
+
+2010-01-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Attempt to fix windows builds, by removing the no-longer existant JSSVGPointListCustom.cpp from JSBindingsAllInOne.cpp.
+
+        * bindings/js/JSBindingsAllInOne.cpp:
+
+2010-01-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Adam Roben & Dirk Schulze.
+
+        svg <text> fails to update when setting x/y
+        https://bugs.webkit.org/show_bug.cgi?id=22384
+
+        Introduce JSSVGPODListCustom, refactoring the existing custom code for SVG POD type lists.
+        (Currently SVGTransformList/SVGPointList was handled correctly, and SVGLengthList/SVGNumberList not)
+
+        Remove the need for custom JSSVG*List.cpp implementations, but instead tweak CodeGeneratorJS.pm,
+        to call into the new JSSVGPODListCustom methods. Fixes dynamic updates of the SVGTextElement
+        'rotate' & 'x'/'y' SVG DOM properties.
+
+        Tests: svg/custom/text-xy-updates-SVGList.xhtml
+               svg/dynamic-updates/SVGTextElement-svgdom-rotate-prop.html
+  
+        * Android.jscbindings.mk: Remove old files from build, add the new header.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSSVGPODListCustom.h: Copied from bindings/js/JSSVGTransformListCustom.cpp. Refactored code to be sharable between all JSSVG*List classes.
+        (WebCore::JSSVGPODListCustom::finishGetter):
+        (WebCore::JSSVGPODListCustom::finishSetter):
+        (WebCore::JSSVGPODListCustom::finishSetterReadOnlyResult):
+        (WebCore::JSSVGPODListCustom::clear):
+        (WebCore::JSSVGPODListCustom::initialize):
+        (WebCore::JSSVGPODListCustom::getItem):
+        (WebCore::JSSVGPODListCustom::insertItemBefore):
+        (WebCore::JSSVGPODListCustom::replaceItem):
+        (WebCore::JSSVGPODListCustom::removeItem):
+        (WebCore::JSSVGPODListCustom::appendItem):
+        * bindings/js/JSSVGPointListCustom.cpp: Removed.
+        * bindings/js/JSSVGTransformListCustom.cpp: Removed.
+        * bindings/scripts/CodeGeneratorJS.pm: Forward any SVGList call on POD list types to the new JSSVGPODListCustom.
+        * svg/SVGNumberList.cpp: Make SVGNumberList a SVGPODList, instead of a SVGList, to make dynamic updates work.
+        (WebCore::SVGNumberList::SVGNumberList):
+        * svg/SVGNumberList.h:
+        * svg/SVGPointList.idl: Remove JSCCustom markers everywhere.
+        * svg/SVGTransformList.idl: Ditto.
+
+2010-01-08  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Cannot focus on an empty editable span in a non editable div.
+        https://bugs.webkit.org/show_bug.cgi?id=33411
+        <rdar://problem/5982901>
+
+        We now allow to set the focus inside an empty inline element if it is the only
+        editable element inside non-editable content.
+
+        * dom/Position.cpp:
+        (WebCore::Position::isCandidate): Extended to allow positions in inline elements when
+        at the border between editable and non editable content.
+        (WebCore::Position::getInlineBoxAndOffset): Modified to be able to calculate the caret
+        position inside an empty inline.
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): When merging, we don't always find a break
+        element, since now an editable inline is a VisiblePosition if it is at editability boundary.
+        * editing/VisibleSelection.h: Updated comment on the use of Position member variables
+        instead of VisiblePosition.
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionLayoutChanged): Changed to avoid multiple calls to upstream and
+        downstream on the same position.
+
+2010-01-06  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [V8] IsRefPtrType() in CodeGeneratorV8.pm increases maintenance burden.
+        https://bugs.webkit.org/show_bug.cgi?id=32994
+
+        Refactoring, covered by existings tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Reversed testing for ref-counted objects,
+            since there's a much smaller (and more stable) set of non-ref-counted ones.
+
+2010-01-06  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes the fact that timeline panel results are skewed by the use of DOM mutation events.
+        https://bugs.webkit.org/show_bug.cgi?id=32846
+
+        Instead of using DOM mutation events in InspectorDOMAgent, InspectorController is now called
+        directly when the DOM is mutated.
+
+        * dom/ContainerNode.cpp: Calls InspectorController directly when child nodes are added/removed.
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Element.cpp: Calls InspectorController directly when attributes are added/removed.
+        (WebCore::Element::dispatchAttrRemovalEvent):
+        (WebCore::Element::dispatchAttrAdditionEvent):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didInsertDOMNode):
+        (WebCore::InspectorController::didRemoveDOMNode):
+        (WebCore::InspectorController::didModifyDOMAttr):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::didInsertDOMNode):
+        (WebCore::InspectorDOMAgent::didRemoveDOMNode):
+        (WebCore::InspectorDOMAgent::didModifyDOMAttr):
+        * inspector/InspectorDOMAgent.h:
+
+2010-01-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION: Japanese text search ignores small vs. large and voicing mark differences
+        https://bugs.webkit.org/show_bug.cgi?id=30437
+        rdar://problem/7214058
+
+        Test: fast/text/find-kana.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::isKanaLetter): Added.
+        (WebCore::isSmallKanaLetter): Added.
+        (WebCore::composedVoicedSoundMark): Added.
+        (WebCore::isCombiningVoicedSoundMark): Added.
+        (WebCore::containsKanaLetters): Added.
+        (WebCore::normalizeCharacters): Added.
+        (WebCore::SearchBuffer::SearchBuffer): Initialize the data members
+        m_targetRequiresKanaWorkaround and m_normalizedTarget.
+        (WebCore::SearchBuffer::isBadMatch): Added. Checks for matches that
+        ICU's default collation considers correct, but we consider incorrect.
+        (WebCore::SearchBuffer::search): Added code to call isBadMatch and
+        move to the next match with usearch_next if the result is true.
+
+2010-01-11  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30883
+        [Gtk] Implement AtkText for HTML elements which contain text
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.h
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (objectAndOffsetUnignored):
+        (webkit_accessible_text_get_caret_offset):
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (SelectionController::notifyAccessibilityForSelectionChange)
+
+        Adjust the caret offset and object with focus to reflect the
+        unignored parent of the static text object which contains the
+        caret. This is necessary because the static text objects are
+        no longer being exposed to ATs.
+
+2010-01-11  Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Antti Koivisto.
+
+        Touchevent coordinates are incorrect after page zoom and page scroll
+        https://bugs.webkit.org/show_bug.cgi?id=32899
+
+        Test: fast/events/touch-coords-in-zoom-and-scroll.html
+
+        * dom/Touch.cpp:
+        (WebCore::contentsX):
+        (WebCore::contentsY):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent):
+
+2010-01-11  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Have "Paste and Match Style" fire the dom paste event.
+        https://bugs.webkit.org/show_bug.cgi?id=30639
+
+        Test: editing/execCommand/paste-and-match-style-event.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::pasteAsPlainText):
+
+2010-01-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Rollout renderpath culling as it once again breaks pixel tests.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::nodeAtFloatPoint):
+
+2010-01-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allows plugins to participate in accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=33455
+
+        Part 1: rename setContentsToVideo() on GraphicsLayer to setContentsToMedia()
+        to make it more general. Rename associated enums and methods similarly.
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setContentsToMedia):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToMedia):
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        (WebCore::GraphicsLayerCA::updateContentsMediaLayer):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
+
+2010-01-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Nikolas Zimmerman.
+
+        Bad DOM performance in large SVG files
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Cull RenderPaths before passing on to the underlying graphics system.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::nodeAtFloatPoint):
+
+2010-01-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add defensive initialization of iframe sandbox flags
+        https://bugs.webkit.org/show_bug.cgi?id=32368
+
+        We now initialize the SecurityOrigin's sandbox state directly duing
+        construction.  This lets us properly set the isUnique bit.
+
+        Tests: http/tests/security/sandboxed-iframe-origin-add.html
+               http/tests/security/sandboxed-iframe-origin-remove.html
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::create):
+        (WebCore::SecurityOrigin::setSandboxFlags):
+        * page/SecurityOrigin.h:
+
+2010-01-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Inspect Element selects the wrong element.
+        Drive-by fix that focuses dom tree upon settting focuesDOMNode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33449
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.setDocument.selectLastSelectedNode):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        * inspector/front-end/treeoutline.js:
+        (TreeElement.prototype.select):
+
+2010-01-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce support for flexible line height in the text editor.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33431
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype._offsetToLineNumber):
+        (WebInspector.TextEditor.prototype._lineNumberToOffset):
+        (WebInspector.TextEditor.prototype._lineHeight):
+        (WebInspector.TextEditor.prototype.reveal):
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype._selectionChanged):
+        (WebInspector.TextEditor.prototype._updateSize):
+        (WebInspector.TextEditor.prototype._paintLines):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype._paintLineNumbers):
+        (WebInspector.TextEditor.prototype._paintCurrentLine):
+        (WebInspector.TextEditor.prototype._scroll):
+        (WebInspector.TextEditor.prototype._repaintOnScroll):
+        (WebInspector.TextEditor.prototype._caretForMouseEvent):
+        (WebInspector.TextEditor.prototype._handleNavigationKey):
+        (WebInspector.TextEditor.prototype._updateCursor):
+        (WebInspector.TextEditor.prototype._invalidateHighlight):
+        (WebInspector.TextEditor.prototype._paintSelection):
+        (WebInspector.TextEditor.prototype._initFont):
+        (WebInspector.TextCursor.prototype.setTextLineHeight):
+
+2010-01-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not repaint line numbers while editing within line.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33427
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype._selectionChanged):
+        (WebInspector.TextEditor.prototype._repaintAll):
+        (WebInspector.TextEditor.prototype._paintLines):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype._paintLineNumbers):
+        (WebInspector.TextEditor.prototype._updateCursor):
+        (WebInspector.TextEditor.prototype._copy):
+
+2010-01-10  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed whitespace fixes.
+
+        * html/HTMLFrameOwnerElement.cpp:
+        (WebCore::HTMLFrameOwnerElement::setSandboxFlags):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::updateSandboxFlags):
+        * loader/FrameLoader.h:
+
+2010-01-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Unify origin sandbox flag with m_noAccess in SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=32372
+
+        It turns out the SandboxOrigin bit is slightly different than the
+        unique origin concept because the sandbox bit is inherited by iframes.
+        These concepts are separate in the spec, so I think it's ok to keep
+        them separate in the implementation as well.
+
+        No new tests because there is no behavior change.
+
+        * dom/Document.cpp:
+        (WebCore::Document::cookie):
+        (WebCore::Document::setCookie):
+        * loader/CrossOriginAccessControl.cpp:
+        (WebCore::passesAccessControlCheck):
+        * page/SecurityOrigin.cpp:
+        (WebCore::schemesWithUniqueOrigins):
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canAccess):
+        (WebCore::SecurityOrigin::canRequest):
+        (WebCore::SecurityOrigin::taintsCanvas):
+        (WebCore::SecurityOrigin::setSandboxFlags):
+        (WebCore::SecurityOrigin::toString):
+        (WebCore::SecurityOrigin::registerURLSchemeAsNoAccess):
+        (WebCore::SecurityOrigin::shouldTreatURLSchemeAsNoAccess):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::canAccessDatabase):
+        (WebCore::SecurityOrigin::canAccessStorage):
+        (WebCore::SecurityOrigin::canAccessCookies):
+        (WebCore::SecurityOrigin::isUnique):
+
+2010-01-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        ScriptController::isEnabled needs to be renamed
+        https://bugs.webkit.org/show_bug.cgi?id=32063
+
+        Rename ScriptController::isEnabled to
+        ScriptController::canExecuteScripts to reflect what the method actually
+        means.  This is a trivial change, but it involved touching a lot of
+        call sites.
+
+        * WebCore.PluginHostProcess.exp:
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::canExecuteScripts):
+        (WebCore::ScriptController::executeScript):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        (WebCore::ScriptController::executeScriptInWorld):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieve):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::evaluateScript):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::controls):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseTag):
+        (WebCore::HTMLTokenizer::processToken):
+        * inspector/InspectorController.cpp:
+        (WebCore::canPassNodeToJavaScript):
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isProcessingUserGesture):
+        (WebCore::FrameLoader::open):
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectsInAllWorlds):
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld):
+
+2010-01-09  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Inspector font for errors is ugly on non-OSX platforms
+        https://bugs.webkit.org/show_bug.cgi?id=33340
+
+        * css/view-source.css: Add a fallback to sans-serif on a CSS
+        selector that previously only listed Lucida Grande.
+
+2010-01-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        <rdar://problem/7525778> Font fallback kills SVG kerning
+        https://bugs.webkit.org/show_bug.cgi?id=33400
+
+        Test: platform/mac/fast/text/sticky-typesetting-features.html
+
+        Cache font attributes separately for different typesetting features.
+
+        * platform/graphics/SimpleFontData.h: Replaced single-element caches
+        with maps.
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::disableLigatures): Added an ATSUStyle parameter.
+        (WebCore::initializeATSUStyle): Look up the ATSUStyle in the map and
+        initialize if necessary. Return the ATSUStyle.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersATSUI):
+        Use the ATSUStyle returned from initializeATSUStyle().
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformDestroy): Destroy the ATSUStyles in the
+        map.
+        (WebCore::SimpleFontData::getCFStringAttributes): Look up the attributes
+        dictionary in the map and initialize if necessary.
+
+2010-01-08  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.  Fix namespace indent for SecurityOrigin.h.
+
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::domainWasSetInDOM):
+        (WebCore::SecurityOrigin::protocol):
+        (WebCore::SecurityOrigin::host):
+        (WebCore::SecurityOrigin::domain):
+        (WebCore::SecurityOrigin::port):
+        (WebCore::SecurityOrigin::canLoadLocalResources):
+        (WebCore::SecurityOrigin::setSandboxFlags):
+        (WebCore::SecurityOrigin::isSandboxed):
+        (WebCore::SecurityOrigin::canAccessDatabase):
+        (WebCore::SecurityOrigin::canAccessStorage):
+        (WebCore::SecurityOrigin::):
+
+2010-01-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dmitry Titov.
+
+        bindings/v8/DOMData is missing a virtual destructor
+        https://bugs.webkit.org/show_bug.cgi?id=33390
+
+        DOMData is the base class for ChildThreadDOMData and MainThreadDOMData classes
+        but it does not have a virtual destructor. While this isn't currently causing
+        any leaks, since there are no instances of ChildThreadDOMData or
+        MainThreadDOMData that are manipulated via a DOMData pointer, the ARM GCC
+        compiler generates the following compilation error:
+
+        "/WebCore/bindings/v8/DOMData.h:45: error: 'class WebCore::DOMData' has virtual
+        functions and accessible non-virtual destructor"
+
+        We therefore need to add a virtual destructor to DOMData.
+
+        * bindings/v8/DOMData.cpp:
+        (WebCore::DOMData::~DOMData):
+        * bindings/v8/DOMData.h:
+
+2010-01-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33417
+
+        Cleans up style errors exposed by the patch for bug #33198.
+
+        No functionality was changed. So, no new tests.
+
+        * platform/graphics/SimpleFontData.h:
+        * plugins/PluginPackage.cpp:
+
+2010-01-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WebGL canvas paints background color twice
+        https://bugs.webkit.org/show_bug.cgi?id=33361
+
+        Clean up some logic around "directly composited" content: some images, video, and WebGL.
+
+        We previously set the GraphicsLayer background color to the CSS background color
+        in some cases where the box has no other decorations. However, the content 
+        layer's bounds do not correspond with the background box in many cases,
+        and we could end up both painting the background color, and setting it on the layer.
+        
+        Simplify this logic to never use layer background colors, and thus skip allocating
+        backing store only when the element has no visible box decorations.
+
+        Tests: compositing/images/direct-image-background-color.html
+               compositing/reflections/simple-composited-reflections.html
+               compositing/video/video-background-color.html
+               compositing/webgl/webgl-background-color.html
+               compositing/webgl/webgl-blending.html
+
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::is3DCanvas): Utility to determine if a RenderObject is a canvas with WebGL
+        (WebCore::RenderLayerBacking::RenderLayerBacking): Remove m_hasDirectlyCompositedContent.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): canUseDirectCompositing()
+        is renamed to isDirectlyCompositedImage() and only applies to images now. 
+        No longer set layer background color.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Just use hasPaintedContent()
+        as the argument to setDrawsContent().
+        (WebCore::hasBoxDecorationsOrBackground): Renamed.
+        (WebCore::RenderLayerBacking::hasNonCompositingContent):
+        (WebCore::hasBoxDecorationsOrBackgroundImage): Renamed from hasBoxDecorations().
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): Moved test for
+        hasOverflowControls() into hasNonCompositingContent() and removed the FIXME comment.
+        (WebCore::RenderLayerBacking::containsPaintedContent): New method that decides
+        if the layer (and its non-composited children) has any content that must be painted into backing store.
+        (WebCore::RenderLayerBacking::isDirectlyCompositedImage): Renamed from canUseDirectCompositing()
+        and reduced to only apply to images.
+        (WebCore::RenderLayerBacking::rendererContentChanged): 3D canvas no longer falls under the
+        canUseDirectCompositing() scope.
+
+2010-01-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Use member initialization syntax instead of assignment for member variables of Document used
+        for determining minimum layout delay.
+        https://bugs.webkit.org/show_bug.cgi?id=33316
+
+        No new tests, style change only.
+
+        * dom/Document.cpp: Modified.
+        (WebCore::Document::Document): Modified. Use initializer list for m_startTime, m_overMinimumLayoutThreshold and m_extraLayoutDelay.
+
+2010-01-08  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Passing array that is too large to set method of WebGLArrays does not throw an exception
+        https://bugs.webkit.org/show_bug.cgi?id=33352
+
+        Added needed range checks to JSC and V8 custom bindings. Expanded
+        preexisting test suite for WebGLArrays and updated its expected
+        results. Tested in WebKit and Chromium.
+
+        Test: fast/canvas/webgl/array-set-out-of-bounds.html
+
+        * bindings/js/JSWebGLArrayHelper.h:
+        (WebCore::setWebGLArrayFromArray):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::setWebGLArrayFromArray):
+
+2010-01-08  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32962
+        HTML tags are wrongfully parsed when setting innerHTML of a SCRIPT element
+
+        Also fixed the same for STYLE elements.
+
+        Tests: fast/dom/css-innerHTML.html
+               fast/dom/script-innerHTML-x.xhtml
+               fast/dom/script-innerHTML.html
+
+        * html/HTMLElement.cpp: (WebCore::HTMLElement::setInnerHTML): Don't parse JS or CSS as HTML,
+        matching Firefox.
+
+2010-01-08  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32757 Repaint bug 
+        with -webkit-shadow on svg shapes
+        -and-
+        <rdar://problem/7389149>
+
+        Inflate the repaintRect for the shadow using its extent.
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::computeRectForRepaint):
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::computeRectForRepaint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::repaintRectInLocalCoordinates):
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::computeRectForRepaint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::getSVGShadowExtent):
+        (WebCore::SVGRenderBase::inflateForShadow):
+        * rendering/SVGRenderSupport.h:
+
+2010-01-08  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebGLArray subclasses do the wrong conversion in indexSetter
+        https://bugs.webkit.org/show_bug.cgi?id=33350
+
+        Test: fast/canvas/webgl/array-setters.html
+
+        * bindings/js/JSWebGLFloatArrayCustom.cpp:
+        (WebCore::JSWebGLFloatArray::indexSetter):
+        * bindings/js/JSWebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedIntArray::indexSetter):
+
+2010-01-08  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Delegation client
+        https://bugs.webkit.org/show_bug.cgi?id=32826
+
+        Factory related code removed from QtAbstractWebPopup. Popups are now created
+        by ChromeClientQt.
+        Popup content information struct added to class QtAbstractWebPopup.
+        PopupMenuClient is now hidden from higher layers.
+        QtAbstractWebPopup now receives content information and font as parameters
+        of method populate.
+        QtFallbackWebPopup moved to WebKit/qt/WebCoreSupport.
+
+        * WebCore.pro:
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::getItems):
+        (WebCore::PopupMenu::show):
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::QtAbstractWebPopup):
+        (WebCore::QtAbstractWebPopup::popupDidHide):
+        (WebCore::QtAbstractWebPopup::valueChanged):
+        * platform/qt/QtAbstractWebPopup.h:
+        (WebCore::QtAbstractWebPopup::Item::):
+        * platform/qt/QtFallbackWebPopup.cpp: Removed.
+        * platform/qt/QtFallbackWebPopup.h: Removed.
+
+2010-01-08  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Darin Adler.
+
+        Skip invalid blocks in CSS property declarations.
+        https://bugs.webkit.org/show_bug.cgi?id=31231
+        https://bugs.webkit.org/show_bug.cgi?id=26619
+
+        This patch makes the CSS parser skip property declarations containing invalid blocks.
+
+        Test: fast/css/parsing-error-recovery.html
+
+        * css/CSSGrammar.y:
+
+2010-01-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: CSS content not returned correctly in AX
+        https://bugs.webkit.org/show_bug.cgi?id=33308
+
+        Test: platform/mac/accessibility/css-content-attribute.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::textUnderElement):
+
+2010-01-08  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Implement full-screen video for Windows
+        https://bugs.webkit.org/show_bug.cgi?id=31318
+        
+        This is mostly support logic for taking video
+        into and out of full-screen. It also contains the
+        QTMovieWin piece which adds support for the actual
+        full-screen window itself. Events from the window
+        are sent to the FullscreenVideosController for handling.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::addData):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        (WebCore::MediaPlayerPrivate::platformMedia):
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::QTMovieWinPrivate):
+        (QTMovieWin::initializeQuickTime):
+        (QTMovieWin::_handleMessages):
+        (QTMovieWin::enterFullscreen):
+        (QTMovieWin::exitFullscreen):
+        * platform/graphics/win/QTMovieWin.h:
+
+2010-01-08  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix a regression that removed a call to
+        FrameLoaderClient::didDestroyScriptContextForFrame.
+        https://bugs.webkit.org/show_bug.cgi?id=33347
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::disposeContextHandles):
+
+2010-01-08  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        WebKit plugins are not rendered during printing.
+        https://bugs.webkit.org/show_bug.cgi?id=33022.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintWindowedPluginIntoContext): Tell
+          cairo printing surface to flush so that blank regions do
+          not write over the plugin's paint operations.
+        * rendering/RenderLayer.cpp: Build fix.
+        (WebCore::RenderLayer::beginTransparencyLayers): Correct
+          method signature missing for ColorSpace.
+
+2010-01-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION(52819?): AXLoadComplete and AXLayoutComplete causes 4 tests fail on Snow Leopard Debug bot
+        https://bugs.webkit.org/show_bug.cgi?id=33300
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilitySetPostedNotificationCallback:withContext:]):
+        (-[AccessibilityObjectWrapper accessibilityPostedNotification:]):
+
+2010-01-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Regex-based syntax highlighting is slow.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33330
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/JavaScriptHighlighterScheme.js: Removed.
+        * inspector/front-end/JavaScriptTokenizer.js: Added.
+        (WebInspector.JavaScriptTokenizer):
+        (WebInspector.JavaScriptTokenizer.prototype.set line):
+        (WebInspector.JavaScriptTokenizer.prototype.getCondition):
+        (WebInspector.JavaScriptTokenizer.prototype.setCondition):
+        (WebInspector.JavaScriptTokenizer.prototype._charAt):
+        (WebInspector.JavaScriptTokenizer.prototype.nextToken):
+        * inspector/front-end/JavaScriptTokenizer.re2js: Added.
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype._lex):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2010-01-07  Mike Belshe  <mbelshe@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix Spdy casing to match style guide.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33326
+
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::wasFetchedViaSPDY):
+        (WebCore::ResourceResponse::setWasFetchedViaSPDY):
+
+2010-01-07  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32987
+
+        Added ENABLE_XHTMLMP flag. Disabled by default.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * config.h:
+
+2010-01-07  Stephanie Lewis  <slewis@apple.com>
+
+        Rolled out http://trac.webkit.org/changeset/52778 due to rolling
+        out http://trac.webkit.org/changeset/52756
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::layout):
+        (WebCore::SelectionController::recomputeCaretRect):
+        (WebCore::SelectionController::invalidateCaretRect):
+        (WebCore::SelectionController::paintCaret):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::attach):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach):
+        * page/Frame.cpp:
+        (WebCore::Frame::revealSelection):
+
+2010-01-07  Stephanie Lewis  <slewis@apple.com>
+
+        Rollout http://trac.webkit.org/changeset/52756 due to a large performance regression.
+
+        * dom/Document.cpp:
+        (WebCore::Document::updateLayout):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        (WebCore::SelectionController::setSelection):
+        * editing/SelectionController.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::setCaretVisible):
+        (WebCore::Frame::selectionLayoutChanged):
+        (WebCore::Frame::caretBlinkTimerFired):
+        (WebCore::Frame::selectionBounds):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::needsLayout):
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix a crash seen on the buildbots.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase): Don't disable specific
+        function tracking here; it's too late, as some specific functions
+        may already have been tracked in the base class constructor.
+
+2010-01-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        SVGTextElement & friends need to implement svgAttributeChanged
+        https://bugs.webkit.org/show_bug.cgi?id=33284
+
+        Implement svgAttributeChanged() for SVGTextElement & SVGTRefElement. As <text> element contain children,
+        childrenChanged() has to be implemented as well for SVGTextElement.
+
+        Simplify SVGTransformable::parseTransformAttribute() code, clearing lists in the beginning
+        and on error case, after parsing - previously the calling site had to take care of that.
+
+        Tests: svg/dynamic-updates/SVGTRefElement-dom-href-attr.html
+               svg/dynamic-updates/SVGTextElement-dom-transform-attr.html
+               svg/dynamic-updates/SVGTextElement-svgdom-transform-prop.html
+
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::parseMappedAttribute):
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::parseMappedAttribute):
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::parseMappedAttribute):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::svgAttributeChanged):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::parseMappedAttribute):
+        (WebCore::SVGTextElement::svgAttributeChanged):
+        (WebCore::SVGTextElement::childrenChanged):
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPositioningElement.cpp:
+        (WebCore::SVGTextPositioningElement::svgAttributeChanged):
+        * svg/SVGTextPositioningElement.h:
+        * svg/SVGTransformable.cpp:
+        (WebCore::SVGTransformable::parseTransformAttribute):
+        * svg/SVGTransformable.h:
+
+2010-01-07  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Padding in popup menu gets lost with styled <select> in Windows.
+        Fixes <rdar://7285538>, and <http://webkit.org/b/33235>.
+
+        [Win] Support padding-right on selects when webkit-appearance is off. Added a test
+        case for narrow selects with -webkit-appearance: none, and padding left and right to
+        show that both types of padding are honored.
+
+        * manual-tests/select-webkit-appearance-off-narrow-select.html: Added.
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::calculatePositionAndSize): Use clientPaddingRight instead of a hardcoded constant.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::clientPaddingRight): If webkit-appearance is off, use padding-right instead of
+        the hardcoded constant.
+
+2010-01-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33057
+        REGRESSION(r49365): typeof(xhr.responseText) != "string" in Windows
+
+        <rdar://problem/7296920> REGRESSION: WebKit fails to start PeaceKeeper benchmark
+
+        * config.h: Define JS_EXPORTCLASS. I'm not sure why this isn't done in JSC globally for all
+        possible clients, but keeping the current design for now.
+
+2010-01-07  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Jon Honeycutt.
+
+        Account for scale and current context position (as well as page
+        position) in the device context world transform passed to
+        plugins.  This is especially important for print surface DPI.
+        http://bugs.webkit.org/show_bug.cgi?id=32909.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintWindowedPluginIntoContext): Revise
+          world context handling to include scaling and translation
+          already set for the CTM.
+
+2010-01-07  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Generate V8 bindings header declarations for named and indexed accessors.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Better build fix: use 'this->structure()', since 'structure' is a
+        PassRefPtr, and therefore null.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: avoid a name conflict by using the local 'structure' instead
+        of the member 'structure()'.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+
+2010-01-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix.
+
+        Add RenderEmbeddedObject.h/cpp to all the build systems.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Safari memory usage skyrockets using new Google AdWords interface
+        https://bugs.webkit.org/show_bug.cgi?id=33343
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase): Disabled specific function
+        tracking for the window object, since there's no way to do direct
+        method calls on the window object; they all go through the window shell.
+
+2010-01-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Kevin Decker, Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33338
+        Create a renderer for <object> and <embed>
+        
+        Add RenderEmbeddedObject, which derives from RenderPartObject, and is created for <object> and <embed>.
+        Instances of RenderPartObject are now only allocated for iframes.
+        
+        Move object/embed-related code from RenderPartObject to RenderEmbeddedObject.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Add RenderEmbeddedObject.h/cpp
+        
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::createRenderer): Create a RenderEmbeddedObject.
+        (WebCore::HTMLEmbedElement::updateWidget): Use toRenderEmbeddedObject()
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::createRenderer): Make a RenderEmbeddedObject for the plugin-proxy case.
+        (WebCore::HTMLMediaElement::finishParsingChildren): Use toRenderEmbeddedObject() in the plugin-proxy code.
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::createRenderer): Make a RenderEmbeddedObject
+        (WebCore::HTMLObjectElement::updateWidget): Use toRenderEmbeddedObject()
+
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::addWidgetToUpdate):
+        (WebCore::FrameView::removeWidgetToUpdate):
+        (WebCore::FrameView::updateWidgets):
+        Objects in the m_widgetUpdateSet are only ever RenderEmbeddedObjects.
+        
+        * rendering/RenderEmbeddedObject.cpp: Added.
+        * rendering/RenderEmbeddedObject.h: Added.
+        Most of the code moved from RenderPartObject.
+        
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isEmbeddedObject): New method.
+
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::RenderPart): Initialize m_hasFallbackContent here, rather than in the derived classes.
+        * rendering/RenderPart.h: Comments.
+        
+        * rendering/RenderPartObject.h:
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::RenderPartObject): Clean up, code moved to base class, and removed object/embed-specific code.
+        (WebCore::RenderPartObject::layout): Removed object/embed-specific code.
+
+2010-01-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33338
+        Create a renderer for <object> and <embed>
+
+        First part of this change: renderPartObject->updateWidget() is a no-op for iframe elements,
+        so we don't need to call it here, and can thus remove the attach() override entirely.
+
+        * html/HTMLIFrameElement.cpp:
+        * html/HTMLIFrameElement.h:
+
+2009-01-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Migrate to canvas-based text viewer / editor that scales.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33001
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/JavaScriptHighlighterScheme.js: Added.
+        (WebInspector.JavaScriptHighlighterScheme):
+        * inspector/front-end/KeyboardShortcut.js:
+        * inspector/front-end/TextEditor.js: Added.
+        (WebInspector.TextEditor):
+        (WebInspector.TextSelectionModel):
+        (WebInspector.TextCursor):
+        * inspector/front-end/TextEditorHighlighter.js: Added.
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype._lex):
+        * inspector/front-end/TextEditorModel.js: Added.
+        (WebInspector.TextRange):
+        (WebInspector.TextRange.prototype.clone):
+        (WebInspector.TextEditorModel):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2010-01-07  Christian Sejersen  <christian.webkit@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        document.title does not replace or remove space characters
+        https://bugs.webkit.org/show_bug.cgi?id=27032
+
+        Test: fast/dom/Document/document-title-get.html
+
+        * dom/Document.cpp: 
+        (WebCore::Document::Document): 
+        Initialization of m_rawTitle
+        (WebCore::canonicalizedTitle): 
+        Moved from DocumentLoader.cpp with minor edits
+        (WebCore::Document::updateTitle): 
+        Ensures the title is canonicalized
+        (WebCore::Document::setTitle): 
+        Uses m_rawTitle instaed of m_title 
+        (WebCore::Document::removeTitle): 
+        Uses m_rawTitle instead of m_title
+        
+        * dom/Document.h: 
+        Added m_rawTitle that stores the passed in title, m_title now stores the 
+        canonicalized title
+        
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::setTitle): 
+        The title passed in is now canonicalized in Document.cpp
+
+2010-01-07  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Darin Adler.
+
+        Allow leading/trailing space for CSS nth-*() and lang().
+        https://bugs.webkit.org/show_bug.cgi?id=17248
+
+        For pseudo-classes :nth-*() and :lang(), space must be allowed after '(' and before ')'.
+        See the bug comments for why we don't allow space at other places.
+
+        * css/CSSGrammar.y:
+
+2010-01-07  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: contentEditable DIVs are not AX accessible
+        https://bugs.webkit.org/show_bug.cgi?id=33325
+
+        Test: accessibility/contenteditable-hidden-div.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
+
+2010-01-07  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.  Resolve merge conflict.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setContextDebugId):
+
+2010-01-07  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r52847.
+        http://trac.webkit.org/changeset/52847
+        https://bugs.webkit.org/show_bug.cgi?id=33232
+
+        Might have caused a perf regression.  I'm rolling this out to see if it
+        heals the perf bot.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::updateSecurityOrigin):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        * bindings/v8/V8IsolatedContext.cpp:
+        (WebCore::V8IsolatedContext::V8IsolatedContext):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::~V8Proxy):
+        (WebCore::V8Proxy::handleOutOfMemory):
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::clearForClose):
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::currentContext):
+        (WebCore::V8Proxy::setContextDebugId):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::windowShell):
+        * bindings/v8/WorldContextHandle.cpp:
+        (WebCore::WorldContextHandle::adjustedContext):
+
+2010-01-07  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * WebCore.xcodeproj/project.pbxproj: Made TypesettingFeatures.h private.
+
+2010-01-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added Font::typesettingFeatures() and deployed it
+
+        No change in funcitonality
+
+        * WebCore.xcodeproj/project.pbxproj: Added TypesettingFeatures.h.
+        * platform/graphics/Font.h:
+        (WebCore::Font::typesettingFeatures): Added. Determines the typesetting
+            features from the text redndering mode.
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::canUseGlyphCache): Use typesettingFeatures().
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/TypesettingFeatures.h: Added.
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::disableLigatures): Take TypesettingFeatures instead of
+            TextRenderingMode.
+        (WebCore::initializeATSUStyle): Ditto.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersATSUI):
+            Use typesettingFeatures().
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):
+            Ditto.
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes): Take
+            TypesettingFeatures instead of TextRenderingMode.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak): Use TypesettingFeatures().
+
+2010-01-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r52900.
+        http://trac.webkit.org/changeset/52900
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Broke over 30 SVG pixel tests.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2010-01-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Kenneth Rohde Christiansen.
+
+        [Qt] The library version number of the first package release is 4.7.0.
+
+        * WebCore.pro:
+
+2010-01-07  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Allow the application to override online/offline network status
+        https://bugs.webkit.org/show_bug.cgi?id=32684
+
+        Added API to NetworkStateNotifier for forcing network status.
+
+        * platform/network/NetworkStateNotifier.h:
+        * platform/network/qt/NetworkStateNotifierPrivate.h:
+        * platform/network/qt/NetworkStateNotifierQt.cpp:
+        (WebCore::NetworkStateNotifierPrivate::NetworkStateNotifierPrivate):
+        (WebCore::NetworkStateNotifierPrivate::onlineStateChanged):
+        (WebCore::NetworkStateNotifierPrivate::networkAccessPermissionChanged):
+        (WebCore::NetworkStateNotifier::updateState):
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+        (WebCore::NetworkStateNotifier::setNetworkAccessAllowed):
+
+2010-01-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix linkage against Qt mobility API bearer management module
+
+        Use the documented .pro file syntax to link against the correct
+        library and (more importantly) get the include paths correct.
+
+        * WebCore.pro:
+
+2010-01-07  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33272
+        'abort' event still fired as a progress event
+
+        rdar://6710625
+        Test media/video-error-abort.html doesn't work
+
+        Test: http/tests/media/video-error-abort.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::scheduleEvent): Incorporate code from enqueueEvent.
+        (WebCore::HTMLMediaElement::loadInternal): Fix 'abort' event firing logic missed
+        in https://bugs.webkit.org/show_bug.cgi?id=30513. Change order of initialization 
+        to match spec wording.
+        * html/HTMLMediaElement.h: Remove enqueueEvent prototype.
+
+2010-01-07  Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Antti Koivisto.
+
+        Wrong state and TouchLists in TouchEvents
+        https://bugs.webkit.org/show_bug.cgi?id=32878
+
+        Touch events changed to match the API and semantics of iPhone and
+        Android. Each new touch point press dispatches a touchstart event with
+        the pressed touch point(s) in the changedTouches list, and a release
+        dispatches a touchend event with the released touch point(s) in
+        changedTouches. Moved points dispatch a touchmove event, with the moved
+        points in changedTouches. Old behaviour emitted only one touchstart when
+        the first point was pressed and one touchend when the last point was
+        released, and any events in between were touchmoves. New presses or
+        releases could only be detected by comparing the lists touches and
+        changedTouches.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent):
+        * page/EventHandler.h:
+
+2010-01-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove COM code generation stuff.
+        https://bugs.webkit.org/show_bug.cgi?id=32854
+
+        Remove the followings:
+        - CodeGeenratorCOM.pm, COM code generator,
+        - "#if !defined(LANGUAGE_COM) || !LANGUAGE_COM" in IDL files, and
+        - UUID attributes in IDL files.
+
+        * bindings/scripts/CodeGeneratorCOM.pm: Removed.
+        * css/CSSCharsetRule.idl:
+        * css/CSSFontFaceRule.idl:
+        * css/CSSImportRule.idl:
+        * css/CSSMediaRule.idl:
+        * css/CSSPageRule.idl:
+        * css/CSSPrimitiveValue.idl:
+        * css/CSSRule.idl:
+        * css/CSSRuleList.idl:
+        * css/CSSStyleDeclaration.idl:
+        * css/CSSStyleRule.idl:
+        * css/CSSStyleSheet.idl:
+        * css/CSSUnknownRule.idl:
+        * css/CSSValue.idl:
+        * css/CSSValueList.idl:
+        * css/Counter.idl:
+        * css/MediaList.idl:
+        * css/RGBColor.idl:
+        * css/Rect.idl:
+        * css/StyleSheet.idl:
+        * css/StyleSheetList.idl:
+        * css/WebKitCSSKeyframeRule.idl:
+        * css/WebKitCSSKeyframesRule.idl:
+        * css/WebKitCSSTransformValue.idl:
+        * dom/Attr.idl:
+        * dom/CDATASection.idl:
+        * dom/CharacterData.idl:
+        * dom/Comment.idl:
+        * dom/DOMImplementation.idl:
+        * dom/Document.idl:
+        * dom/DocumentFragment.idl:
+        * dom/DocumentType.idl:
+        * dom/Element.idl:
+        * dom/Entity.idl:
+        * dom/EntityReference.idl:
+        * dom/Event.idl:
+        * dom/EventListener.idl:
+        * dom/EventTarget.idl:
+        * dom/NamedNodeMap.idl:
+        * dom/Node.idl:
+        * dom/NodeList.idl:
+        * dom/Notation.idl:
+        * dom/ProcessingInstruction.idl:
+        * dom/Text.idl:
+        * html/HTMLAnchorElement.idl:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLAreaElement.idl:
+        * html/HTMLBRElement.idl:
+        * html/HTMLBaseElement.idl:
+        * html/HTMLBaseFontElement.idl:
+        * html/HTMLBlockquoteElement.idl:
+        * html/HTMLBodyElement.idl:
+        * html/HTMLButtonElement.idl:
+        * html/HTMLCanvasElement.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLDListElement.idl:
+        * html/HTMLDirectoryElement.idl:
+        * html/HTMLDivElement.idl:
+        * html/HTMLDocument.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFieldSetElement.idl:
+        * html/HTMLFontElement.idl:
+        * html/HTMLFormElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLFrameSetElement.idl:
+        * html/HTMLHRElement.idl:
+        * html/HTMLHeadElement.idl:
+        * html/HTMLHeadingElement.idl:
+        * html/HTMLHtmlElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLImageElement.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLIsIndexElement.idl:
+        * html/HTMLLIElement.idl:
+        * html/HTMLLabelElement.idl:
+        * html/HTMLLegendElement.idl:
+        * html/HTMLLinkElement.idl:
+        * html/HTMLMapElement.idl:
+        * html/HTMLMarqueeElement.idl:
+        * html/HTMLMenuElement.idl:
+        * html/HTMLMetaElement.idl:
+        * html/HTMLModElement.idl:
+        * html/HTMLOListElement.idl:
+        * html/HTMLObjectElement.idl:
+        * html/HTMLOptGroupElement.idl:
+        * html/HTMLOptionElement.idl:
+        * html/HTMLOptionsCollection.idl:
+        * html/HTMLParagraphElement.idl:
+        * html/HTMLParamElement.idl:
+        * html/HTMLPreElement.idl:
+        * html/HTMLQuoteElement.idl:
+        * html/HTMLScriptElement.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLStyleElement.idl:
+        * html/HTMLTableCaptionElement.idl:
+        * html/HTMLTableCellElement.idl:
+        * html/HTMLTableColElement.idl:
+        * html/HTMLTableElement.idl:
+        * html/HTMLTableRowElement.idl:
+        * html/HTMLTableSectionElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        * html/HTMLTitleElement.idl:
+        * html/HTMLUListElement.idl:
+
+2010-01-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Adds the ability to increase the delay used when scheduling layout.
+        https://bugs.webkit.org/show_bug.cgi?id=32875
+
+        No new tests possible.
+
+        * dom/Document.cpp: Modified.
+        (WebCore::Document::Document): Modified. Initializes extra layout delay to zero.
+        (WebCore::Document::minimumLayoutDelay): Modified. Adds extra layout delay when calculating minimum layout delay.
+        * dom/Document.h: Modified.
+        (WebCore::Document::setExtraLayoutDelay): Added. Sets the extra layout delay.
+
+2010-01-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Some IDL files lack "," separators for extended attributes.
+        https://bugs.webkit.org/show_bug.cgi?id=33190
+
+        To find such mistakes, IDLParser.pm rejects whitespace characters in
+        extended attribute names.
+
+        * bindings/scripts/IDLParser.pm:
+          parseExtendedAttributes rejects whitespace in a name.
+        * css/WebKitCSSTransformValue.idl: Add missing ",".
+        * dom/EventTarget.idl: ditto.
+
+2010-01-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix an issue that CodeGeneratorV8.pm doesnt handle HasIndexGetter of
+        WebKitCSSTransformValue.idl correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=33193
+
+        CodeGeneratorV8.pm doesn't handle inheritance very well and it
+        tried to refer v8WebKitCSSTransformValueIndexedPropertyGetter(),
+        which does not exist. Because WebKitCSSTransformValue inherits
+        CSSValueList and CSSValueList already has HadIndexGetter, we don't
+        need to do anything for WebKitCSSTransformValue about HasIndexGetter.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+          Reset $hasGetter for WebKitCSSTransformValue.
+
+2010-01-07  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Do not return strings whose handles are in near death state (that means
+        they might be GCed) or just empty.
+        https://bugs.webkit.org/show_bug.cgi?id=31180
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ExternalString):
+
+2010-01-06  MORITA Hajime  <morrita@gmail.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG background color on selected text goes wrong when text has
+        gradient stroke.
+        https://bugs.webkit.org/show_bug.cgi?id=33069
+
+        Introduced SVGTextPaintSubphase like as PaintPhase on html painting,
+        and paint background and foreground in separate subphase.
+        
+        Test: svg/text/selection-background-color.xhtml
+        
+        * rendering/SVGCharacterLayoutInfo.h:
+        (WebCore::SVGTextChunkWalker::SVGTextChunkWalker):
+        Added m_setupBackgroundCallback, m_setupForegroundCallback
+        (WebCore::SVGTextChunkWalker::setupBackground):
+        (WebCore::SVGTextChunkWalker::setupForeground):
+        Added.
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        pass SVGTextPaintInfo instead of SVGPaintServer
+        * rendering/SVGInlineTextBox.h:
+        (WebCore::SVGTextPaintSubphase):
+        (WebCore::SVGTextPaintInfo::SVGTextPaintInfo):
+        Added.
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::walkTextChunks):
+        Invoke setupBackground() and setupForeground()
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupBackgroundCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupForegroundCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::activePaintServer):        
+        Added.
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupFillCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupStrokeCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkPortionCallback):
+        (WebCore::SVGRootInlineBox::paint):
+        
+2010-01-06  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make windowsKeyCodeForKeyEvent() return correct key code for
+        numeric-pad arrow keys.
+        https://bugs.webkit.org/show_bug.cgi?id=33250
+
+        Test: fast/events/keydown-numpad-keys.html
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-10-18 Patrick Gansterer <paroga@paroga.com>
+
+        Reviewed by Dirk Schulze.
+
+        Improve DOM performance in large SVG files.
+        Check the dirty area before painting a path, which prevents unnecessary
+        clipping and changes to the GraphicsContext.
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2010-01-06  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Use a static HashMap for HTMLElement::tagPriority().
+        https://bugs.webkit.org/show_bug.cgi?id=33269
+
+        The prior code compares AtomicStringImpl pointers 18 times at
+        worst. This change avoids it.
+
+        No new tests because this is just a refactoring.
+
+        * html/HTMLElement.cpp:
+        (WebCore::Empty1IntHashTraits): A HashTraits to return 1 as the empty value.
+        (WebCore::initializeTagPriorityMap): Initialization of a static HashMap.
+        (WebCore::HTMLElement::tagPriority): Use the static HashMap created by initializeTagPriorityMap().
+        * html/HTMLElement.h:
+        (WebCore::HTMLElement::HTMLElement): Add an assertion about non-null localName().
+
+2010-01-06  Mike Belshe  <mike@belshe.com>
+
+        Add a flag to the ResourceResponse for tracking if a request was
+        fetched via SPDY.  This is plumbed through so that we can inform
+        a webpage via JavaScript if it was fecthed via the experimental
+        SPDY protocol.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33186
+
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::wasFetchedViaSpdy):
+        (WebCore::ResourceResponse::setWasFetchedViaSpdy):
+
+2010-01-06  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Treat.
+
+        [Qt] RenderTheme: Missing support for native sliders
+
+        https://bugs.webkit.org/show_bug.cgi?id=33122
+
+        Implement painting of native slider controls in RenderTheme
+        and unskip a couple of layout tests that are passing after
+        this change.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintSliderTrack):
+        (WebCore::RenderThemeQt::adjustSliderTrackStyle):
+        (WebCore::RenderThemeQt::paintSliderThumb):
+        (WebCore::RenderThemeQt::adjustSliderThumbStyle):
+        (WebCore::RenderThemeQt::supportsFocus):
+        (WebCore::RenderThemeQt::adjustSliderThumbSize):
+        * platform/qt/RenderThemeQt.h:
+
+2010-01-06  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        Reviewed by Darin Adler.
+
+        Adjust incorrect comments after r40534.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markActiveObjectsForContext):
+
+2010-01-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix for chromium.
+        Add "bool V8WorkerContext::WebSocketEnabled()"
+
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::V8WorkerContext::WebSocketEnabled):
+
+2010-01-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix.
+        remove wrong assertion
+
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::Bridge):
+
+2010-01-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add WebSocket feature in Worker
+        https://bugs.webkit.org/show_bug.cgi?id=32214
+
+        Introduce ThreadableWebSocketChannel interface and add
+        WorkerThreadableWebSocketChannel for Worker.
+        WorkerThreadableWebSocketChannel uses WebSocketChannel in the
+        main thread, which is managed by Peer and communicated via Bridge.
+
+        Test: websocket/tests/workers/worker-simple.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebSocketConstructor.h:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::webSocket):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::V8Custom::v8WebSocketConstructorCallback):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * platform/CrossThreadCopier.cpp:
+        (WebCore::::copy):
+        * platform/CrossThreadCopier.h:
+        (WebCore::):
+        * websockets/ThreadableWebSocketChannel.cpp: Added.
+        * websockets/ThreadableWebSocketChannel.h: Added.
+        * websockets/ThreadableWebSocketChannelClientWrapper.h: Added.
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::didReceiveMessage):
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.h:
+        (WebCore::WebSocketChannel::refThreadableWebSocketChannel):
+        (WebCore::WebSocketChannel::derefThreadableWebSocketChannel):
+        * websockets/WebSocketChannelClient.h:
+        * websockets/WebSocketHandshake.h:
+        * websockets/WorkerThreadableWebSocketChannel.cpp: Added.
+        * websockets/WorkerThreadableWebSocketChannel.h: Added.
+        * workers/WorkerContext.idl:
+
+2010-01-06  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Darin Adler.
+
+        Modified EventSource event-stream parser to support a single CR as line ending.
+        https://bugs.webkit.org/show_bug.cgi?id=33207
+
+        * page/EventSource.cpp:
+        (WebCore::EventSource::EventSource):
+        (WebCore::EventSource::parseEventStream):
+        * page/EventSource.h:
+
+2010-01-06  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30883
+        [Gtk] Implement AtkText for HTML elements which contain text
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getInterfaceMaskFromObject):
+        (getPangoLayoutForAtk):
+        (webkit_accessible_text_get_text):
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+
+2010-01-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7488126> With text-rendering: optimizelegibility, sometimes lines run too long
+        https://bugs.webkit.org/show_bug.cgi?id=32794
+
+        Test: platform/mac/fast/text/line-breaking-with-kerning.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak): When kerning is enabled, include
+        the trailing space when measuring a word, then subtract its width. This
+        accounts for kerning between the last glyph of the word and the following space.
+
+2010-01-06  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Simon Fraser
+
+        Second step of:
+        <rdar://problem/6398111> Integrate hardware layers with out-of-process plug-ins layer hosting mechanism
+
+        * Plugins/Hosted/WebHostedNetscapePluginView.h: Expose the CALayer of the plugin by adding -pluginLayer method.
+        * Plugins/Hosted/WebHostedNetscapePluginView.mm:
+        (-[WebHostedNetscapePluginView pluginLayer]): Added.
+        * Plugins/WebNetscapePluginView.h: Expose the CALayer of the plugin by adding -pluginLayer method.
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView pluginLayer]): Added.
+
+2010-01-06  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r52877.
+        http://trac.webkit.org/changeset/52877
+        https://bugs.webkit.org/show_bug.cgi?id=33243
+
+        I screwed up landing this patch and only partially applied the patch I
+        was trying to land.
+
+        * bindings/ScriptControllerBase.cpp:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::executeScriptInWorld):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::updateSecurityOrigin):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::ScriptController::mainWorldWindowShell):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::clearForClose):
+        (WebCore::ScriptController::destroyWindowShell):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::proxy):
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        (WebCore::ScriptController::evaluateInWorld):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::create):
+        (WebCore::V8DOMWindowShell::V8DOMWindowShell):
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+
+2010-01-06  Eric Seidel  <eric@webkit.org>
+
+        Unreviewed.  Rolling back in a change I should not have rolled out.
+
+        The original commit http://trac.webkit.org/changeset/52862
+        was rolled out again in http://trac.webkit.org/changeset/52871
+        but I now believe that rollout to be in error.
+        My sincerest apologies for the churn.
+
+        Fix the bug in previous commit: we shouldn't finish
+        decoding if "sizeOnly" is true.
+        https://bugs.webkit.org/show_bug.cgi?id=33258
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::decode):
+
+2010-01-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [v8] Let ScriptController have more than one windowShell
+        https://bugs.webkit.org/show_bug.cgi?id=33243
+
+        This patch lets ScriptController have more than one windowShell.  We're
+        currently only using one of them (for the main world), but this patch
+        lets us use other ones for isolated worlds soon.
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeScriptInWorld):
+        * bindings/js/ScriptController.cpp:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::createWorld):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::updateSecurityOrigin):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::mainWorldWindowShell):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::clearForClose):
+        (WebCore::ScriptController::destroyWindowShell):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        (WebCore::ScriptController::globalObject):
+        (WebCore::ScriptController::proxy):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::create):
+        (WebCore::V8DOMWindowShell::V8DOMWindowShell):
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+
+2010-01-06  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build.
+
+        * WebCore.base.exp: Export symbols WebKit would like to use.
+        * plugins/PluginWidget.h:
+        (WebCore::PluginWidget::PluginWidget): Redeclare a constructor.
+
+2010-01-06  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Eric Carlson.
+        
+        First step toward:
+        <rdar://problem/6398111> Integrate hardware layers with out-of-process plug-ins layer hosting mechanism
+        
+        Small refactoring moving the PluginWidget class from WebKit to WebCore.          
+        * WebCore.xcodeproj/project.pbxproj: Added new source files and a "mac" group; exposes PluginWidget.h as a "Private" role
+        * platform/Widget.h: Added isPluginWidget(). 
+        (WebCore::Widget::isPluginWidget):
+        * plugins/PluginWidget.h: Added.
+        (WebCore::PluginWidget::isPluginWidget): Added as an interim solution until Mac plug-ins inheirt from PluginView.
+        * plugins/mac/PluginWidgetMac.mm: Added.
+        (WebCore::PluginWidget::invalidateRect): Added. Extracted from the old WebKit/FrameLoaderClientMac version of PluginWidget
+        
+2010-01-06  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52862.
+        http://trac.webkit.org/changeset/52862
+        https://bugs.webkit.org/show_bug.cgi?id=33258
+
+        Caused svg/W3C-SVG-1.1/linking-a-01-b.svg to crash on the
+        Leopard Release builder.
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::decode):
+
+2010-01-06  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Revert the part of my last commit touching Base.xcconfig, was not meant to be commited.
+
+        * Configurations/Base.xcconfig:
+
+2010-01-05  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Generate header declarations for V8 binding security checks
+        and delete V8CustomBinding.cpp
+
+        * Android.v8bindings.mk: Removed V8CustomBinding.cpp.
+        * WebCore.gypi: Removed V8CustomBinding.cpp.
+        * bindings/scripts/CodeGeneratorV8.pm: Generate security check declarations.
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::getTargetFrame): Moved from V8CustomBinding.cpp.
+        (WebCore::reportUnsafeJavaScriptAccess):
+        (WebCore::V8DOMWindowShell::createNewContext):
+        (WebCore::V8DOMWindowShell::setLocation): Moved from V8CustomBinding.cpp.
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::downcastSVGPathSeg): Moved from V8CustomBinding.cpp.
+        (WebCore::V8DOMWrapper::convertSVGObjectWithContextToV8Object):
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/custom/V8CustomBinding.cpp: Removed.
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::locationAccessorSetter):
+        (WebCore::V8DOMWindow::namedSecurityCheck):
+        (WebCore::V8DOMWindow::indexedSecurityCheck):
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        (WebCore::V8Document::locationAccessorSetter):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::indexedSecurityCheck):
+        (WebCore::V8History::namedSecurityCheck):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::indexedSecurityCheck):
+        (WebCore::V8Location::namedSecurityCheck):
+
+2010-01-06  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Marker code is buggy: referencePoint translation is off
+        https://bugs.webkit.org/show_bug.cgi?id=33012
+
+        Rewrite marker code, as it had many issues:
+        - Correct refX/refY handling (covered by new marker-referencePoint.svg test)
+        - Calculate marker bounds on layout time, instead of paint time, to deliver correct repaint rects
+        - Cleanup RenderPath code, which was cluttered by marker stuff (outlay in SVGMarkerLayoutInfo)
+        - Fix SVGResource assuming that there is only one resource per resource type per element. Markers
+          can have three different resources of the same type (three markers, start/mid/end markers)
+
+        Filed bug 33115 (PathElementAddQuadCurveToPoint not handled for <marker>), which was just a TODO in the code before.
+
+        Fixes all svg/custom/marker*.svg tests, that use dynamic updates (propagation failed before).
+        Test: svg/custom/marker-referencePoint.svg
+              svg/custom/marker-opacity.svg
+              svg/custom/marker-strokeWidth-changes.svg
+
+        * Android.mk: Add SVGMarkerData.h / SVGMarkerLayoutInfo.(cpp,h) to build.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * page/FrameView.cpp: Notify RenderSVGRoot children about viewport size changes, just like it's handled for <body> in HTML.
+        (WebCore::FrameView::layout): This is important, as marker bounding boxes may depend on the current viewport size through relative coordinates used in <svg>.
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::markerBoundingBox): Calculates and caches marker boundaries in the layout() phase.
+        (WebCore::RenderPath::repaintRectInLocalCoordinates): Use the cached marker bounding box during paint() time.
+        (WebCore::RenderPath::setPath): Clear marker boundaries upon path changes.
+        (WebCore::RenderPath::paint): Use SVGMarkerLayoutInfo::drawMarkers() instead of the local drawMarkersIfNeeded() function, which is gone now.
+        (WebCore::RenderPath::calculateMarkerBoundsIfNeeded): Utilized by markerBoundingBox() to request SVGResourceMarker objects and calculate their boundaries.
+        * rendering/RenderPath.h: Store SVGMarkerLayoutInfo objects, and rename m_markerBounds to m_cachedLocalMarkerBBox for consistency.
+        (WebCore::RenderPath::path): Inline this accessor.
+        * rendering/RenderSVGContainer.h: Make paint() public (to be used from SVGResourceMarker), all other methods protected (to be used from RenderSVGViewportContainer).
+        * rendering/RenderSVGViewportContainer.cpp: Remove useless paint() override, as the comment in the code indicated.
+        (WebCore::RenderSVGViewportContainer::markerBoundaries): Maps the marker contents repaintRectInLocalCoordinates() into the final coordinate system (see code).
+        (WebCore::RenderSVGViewportContainer::markerContentTransformation): Add marker-specific helper method, allowing to make viewportTransform() private again.
+        * rendering/RenderSVGViewportContainer.h: Marking viewportTransform() private, it's never meant to be used outside this renderer.
+        * rendering/SVGMarkerData.h: Added. Refactored from existing RenderPath code, preserving original copyrights.
+        (WebCore::SVGMarkerData::): Helper struct for SVGMarkerLayoutInfo.
+        (WebCore::SVGMarkerData::origin): Holds the final computed destination of a marker.
+        (WebCore::SVGMarkerData::marker): Holds a pointer to the associated SVGResourceMarker object, which we're aiming to layout.
+        (WebCore::SVGMarkerData::currentAngle): Calculates the current angle for a certain marker type (start/mid/end) based upon the computed inslope/outslope values.
+        (WebCore::SVGMarkerData::updateTypeAndMarker): Helper method.
+        (WebCore::SVGMarkerData::updateOutslope): Ditto.
+        (WebCore::SVGMarkerData::updateMarkerDataForPathElement): Does the actual inslope/outslope calculation.
+        (WebCore::SVGMarkerData::updateInslope): Helper method.
+        * rendering/SVGMarkerLayoutInfo.cpp: Added. New approach to build marker layout info, this time correct during layout() time instead of paint() time.
+        (WebCore::SVGMarkerLayoutInfo::SVGMarkerLayoutInfo):
+        (WebCore::SVGMarkerLayoutInfo::~SVGMarkerLayoutInfo):
+        (WebCore::processStartAndMidMarkers): Static helper method used to visit each path element in order to calculate inslopes/outslopes (-> orientation angles)
+        (WebCore::SVGMarkerLayoutInfo::calculateBoundaries): Build list of MarkerLayout objects, used to query boundaries, and to paint markers during drawMarkers().
+        (WebCore::SVGMarkerLayoutInfo::drawMarkers): Cheap method walking existing MarkerLayout vector, drawing the individual RenderSVGViewportContainer of the markers.
+        (WebCore::SVGMarkerLayoutInfo::addLayoutedMarker): Helper method.
+        * rendering/SVGMarkerLayoutInfo.h: Added.
+        (WebCore::MarkerLayout::MarkerLayout): Helper struct storing a pair of SVGResourceMarker* and a TranformationMatrix.
+        (WebCore::SVGMarkerLayoutInfo::markerData): Public helper methods returning references to private member variables, used from processStartAndMidMarkers.
+        (WebCore::SVGMarkerLayoutInfo::midMarker): Ditto.
+        (WebCore::SVGMarkerLayoutInfo::elementIndex): Ditto.
+        * svg/SVGMarkerElement.cpp: Adopt to name change: setRef() -> setReferencePoint(). setMarker() -> setRenderer()
+        (WebCore::SVGMarkerElement::~SVGMarkerElement): Remove obsolete detach() hack, fixed by SVGUseElement changes.
+        (WebCore::SVGMarkerElement::canvasResource): Add ASSERT(renderer()) to clarify that canvasResource() is only meant to used after renderer creation.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::~SVGSVGElement): Remove obsolete detach() hack, fixed by SVGUseElement changes.
+        * svg/SVGUseElement.cpp: Rework buildPendingResource() to remove SVGSVGElement/SVGMarkerElement detach() hacks (called manually from destructors), see below.
+        (WebCore::SVGUseElement::buildPendingResource): Always detach() the shadow tree root element, before destructing it - this caused the regression with this patch before.
+        * svg/graphics/SVGResource.cpp: Instead of maintaining a global hashmap between SVGStyledElements and an array of possible SVGResources, use a HashSet of SVGResources
+                                        and directly scan the already existing list of clients for a certain SVGResource. This wrong approach has been introduced over two years
+                                        ago, making the assumption that there's only one resource type per element. Though markers can provide three resources of the same type
+                                        per element (all SVGResourceMarker objects, but in different rules: start/mid/end marker). That information is only available while painting.
+        (WebCore::resourceSet): Add global static HashSet<SVGResource*>.
+        (WebCore::SVGResource::SVGResource): Add us to the resourceSet.
+        (WebCore::SVGResource::~SVGResource): Remove us from resourceSet.
+        (WebCore::SVGResource::removeClient): Traverse all SVGResource clients and remove the passed SVGStyledElement from the client list (invoked by SVGStyledElement destructor).
+        (WebCore::SVGResource::addClient): Remove the offending part of the old approach, making the wrong assumption regarding resource types.
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::SVGResourceMarker):
+        (WebCore::SVGResourceMarker::markerTransformation): Create TransformationMatrix in the local marker content (RenderSVGViewportContainer) coordinate system, to position a marker.
+        (WebCore::SVGResourceMarker::draw): Simplify marker drawing a lot: used the passing TransformationMatrix (cached in SVGMarkerLayoutInfo) to draw the marker content renderer.
+        (WebCore::SVGResourceMarker::externalRepresentation): Adopt to refX/refY -> referencePoint changes.
+        * svg/graphics/SVGResourceMarker.h: Store a FloatPoint m_referecePoint instead of two refX/refY float values.
+        (WebCore::SVGResourceMarker::setRenderer): Renamed from setMarker().
+        (WebCore::SVGResourceMarker::setReferencePoint): Renamed from setRef().
+        (WebCore::SVGResourceMarker::referencePoint): New accessor replacing refX() / refY().
+
+2010-01-06  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG feImage support
+        https://bugs.webkit.org/show_bug.cgi?id=31905
+
+        This implements the SVG Filter effect feImage with support of fragment urls.
+        It also includes a bug fix for feComposite. feComposite didn't cover values
+        bigger than 255 correctly on composite oeprator arithmetic.
+
+        Tests: There are already many feImage tests in trunk. They just needed updated
+               pixel test results.
+               The feComposite bug is covered by svg/W3C-SVG-1.1/filters-composite-02-b.svg
+               and depends on feImage.
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::arithmetic):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderSVGImage.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::requestImageResource):
+        (WebCore::SVGFEImageElement::parseMappedAttribute):
+        (WebCore::SVGFEImageElement::notifyFinished):
+        (WebCore::SVGFEImageElement::build):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFEImageElement.idl:
+        * svg/SVGPreserveAspectRatio.cpp:
+        (WebCore::SVGPreserveAspectRatio::transformRect):
+        * svg/SVGPreserveAspectRatio.h:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        (WebCore::FEImage::FEImage):
+        (WebCore::FEImage::create):
+        (WebCore::FEImage::apply):
+        * svg/graphics/filters/SVGFEImage.h:
+
+2010-01-06  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Fix the bug in previous commit: we shouldn't finish
+        decoding if "sizeOnly" is true.
+        https://bugs.webkit.org/show_bug.cgi?id=33258
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::decode):
+
+2010-01-06  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52855.
+        http://trac.webkit.org/changeset/52855
+        https://bugs.webkit.org/show_bug.cgi?id=33222
+
+        Caused 6 layout tests to fail on Mac
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::substituteResourceDeliveryTimerFired):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        * loader/ResourceLoader.cpp:
+        * loader/ResourceLoader.h:
+
+2010-01-06  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Let ReourceLoader deliver segmented data
+        when loading resource from a SharedBuffer object.
+        https://bugs.webkit.org/show_bug.cgi?id=33222
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::substituteResourceDeliveryTimerFired):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveData):
+        * loader/ResourceLoader.h:
+
+2010-01-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed trivial Qt build fix.
+
+        Prefix the phonon includes with phonon/ to avoid conflicts with the S60
+        audio routing API ( http://wiki.forum.nokia.com/index.php/Audio_Routing_API ).
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+
+2010-01-05  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Moving v8::HandleScope up above declaration of v8::Local to fix a
+        Chromium startup crash.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setContextDebugId):
+
+2010-01-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] Move V8DOMWindowShell to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=33232
+
+        This patch moves V8DOMWindow shell to ScriptController, where the
+        window shells live in JSC land.  The next step will be to allow for
+        more than one window shell per script controller.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::updateSecurityOrigin):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::ScriptController::mainWorldWindowShell):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::clearForClose):
+        (WebCore::ScriptController::destroyWindowShell):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::~V8DOMWindowShell):
+        * bindings/v8/V8DOMWindowShell.h:
+        (WebCore::V8DOMWindowShell::localHandleForContext):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        * bindings/v8/V8IsolatedContext.cpp:
+        (WebCore::V8IsolatedContext::V8IsolatedContext):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::~V8Proxy):
+        (WebCore::V8Proxy::handleOutOfMemory):
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::currentContext):
+        (WebCore::V8Proxy::setContextDebugId):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorldContextHandle.cpp:
+        (WebCore::WorldContextHandle::adjustedContext):
+
+2010-01-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement HTML5 <header> and <footer> elements.
+        https://bugs.webkit.org/show_bug.cgi?id=32943
+
+        <header> and <footer> should behave the same as <nav>, <section>,
+        <article>, and <aside>. The HTML parser doesn't need to restrict
+        the nesting of header/footer elements.
+
+        Tests: fast/html/footer-element.html
+               fast/html/header-element.html
+
+        * css/html.css: Add header/footer as block elements.
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag): Add headerTag and footerTag.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority): Returns 5 for headerTag and footerTag.
+        (WebCore::blockTagList): Add headerTag and footerTag.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError): Rename isHeaderTag() to isHeadingTag()
+        (WebCore::HTMLParser::getNode): Add headerTag and footerTag.
+        (WebCore::HTMLParser::isHeadingTag): Renamed from isHeaderTag().
+        * html/HTMLParser.h:
+          - Rename isHeaderTag() to isHeadingTag()
+          - Remove non-existing popNestedHeaderTag().
+        * html/HTMLTagNames.in: Add header and footer.
+
+2010-01-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        CDATA sections are merged into Text nodes when normalize() is used
+        https://bugs.webkit.org/show_bug.cgi?id=33191
+
+        Test: fast/dom/Node/normalize-with-cdata.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::normalize): Use nodeType instead of isTextNode.
+
+2010-01-05  James Robinson  <jamesr@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Typing in Google Wave repaints the whole screen
+        https://bugs.webkit.org/show_bug.cgi?id=32295
+
+        Marks a RenderBlock without block children for layout and painting when it has no line boxes only if it has inline immediate children.
+        The existing logic uses the existence of line boxes as a dirty flag to indicate that line boxes need to be regenerated.  This heuristic
+        fails when the RenderBlock does not have any in-flow children at all, causing the RenderBlock to get unnecessarily marked for layout and
+        painting.  This is particularly bad for common scrollbar manipulation tricks like putting one positioned div inside another - this
+        structure caused the entire outer div's bounds to get scheduled for a paint whenever there was any mutation of any descendant.
+
+        Test: LayoutTests/fast/repaint/block-no-inline-children.html (only shows up in pixel tests)
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2010-01-05  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Cleans up line box clearing when a RenderBlock loses its last child.
+        https://bugs.webkit.org/show_bug.cgi?id=33228
+
+        The 'fullLayout' flag in RenderBlock::layoutInlineChildren() is pretty vague, hopefully this will be easier for the next person to figure out.
+
+
+        No new tests.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2010-01-05  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Provide the "documentURL" property for documents and frame owner elements
+
+        This is necessary to determine owner document URLs for nodes (all nodes have
+        the top-level document set as ownerDocument).
+        https://bugs.webkit.org/show_bug.cgi?id=33025
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+
+2010-01-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Barth.
+
+        Public GIF decoder should stop decoding when allocation fails
+        https://bugs.webkit.org/show_bug.cgi?id=33231
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        * platform/image-decoders/gif/GIFImageReader.cpp:
+        (GIFImageReader::output_row):
+        (GIFImageReader::do_lzw):
+        (GIFImageReader::read):
+        * platform/image-decoders/gif/GIFImageReader.h:
+
+2010-01-05  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Make PNG image decoder work with segmented SharedBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=33213
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::create):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::isAllDataReceived):
+        (WebCore::ImageDecoder::setData):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::PNGImageReader):
+        (WebCore::PNGImageReader::close):
+        (WebCore::PNGImageReader::currentBufferSize):
+        (WebCore::PNGImageReader::setComplete):
+        (WebCore::PNGImageReader::decode):
+        (WebCore::PNGImageDecoder::decode):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::pngComplete):
+
+2010-01-05  Adam Barth  <abarth@webkit.org>
+
+        Rubber stamped by Dimitri Glazkov.
+
+        Fix namespace indent for ScriptController.
+
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::proxy):
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        (WebCore::ScriptController::xssAuditor):
+        (WebCore::ScriptController::setProcessingTimerCallback):
+        (WebCore::ScriptController::setPaused):
+        (WebCore::ScriptController::isPaused):
+        (WebCore::ScriptController::sourceURL):
+        (WebCore::ScriptController::evaluateInWorld):
+
+2010-01-05  Rachel Petterson  <rlp@google.com>
+
+        Reviewed by Simon Fraser.
+
+        Implement most cases of texImage2D and texSubImage2D
+        https://bugs.webkit.org/show_bug.cgi?id=31562
+        
+        This fix is with Chris Marrin  <cmarrin@apple.com>.
+        Also bug: https://bugs.webkit.org/show_bug.cgi?id=31493
+
+        From Chris:
+        This implements all cases except HTMLVideoElement. It changes
+        the bindings to accept all parameter forms of the call. Then
+        it plumbs the calls through WebGLRenderingContext down to
+        GraphicsContext3D for the actual implementation.
+
+        From Rachel:
+        This implements texImage2D for chromium. It also implements the V8
+        bindings for texSubImage2D and updates the V8 bindings for texImage2D.
+
+        Tests: fast/canvas/webgl/texImage2DImageDataTest.html
+                  fast/canvas/webgl/texImageTest.html
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::texImage2D):
+        (WebCore::JSWebGLRenderingContext::texSubImage2D):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::texImage2D):
+        (WebCore::WebGLRenderingContext::texSubImage2D):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::imageToTexture):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+
+2010-01-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Part of <https://bugs.webkit.org/show_bug.cgi?id=32568>.
+        Web Inspector: Context Menus should be used in more places.
+        
+        Add context menus to handle the interaction with breakpoints in the Source Frame. Currently
+        we use left click to add/disable/remove breakpoints, and left click to edit (for conditional
+        breakpoints), but this is hard to discover and behaves differently than Xcode.
+        
+        Change the behavior to be more like Xcode, left click adds a breakpoint if there isn't one, and
+        removes it if there is one.
+        
+        On the context menu, if there is no breakpoint there, we have Add Breakpoint, and Add Conditional
+        Breakpoint. If there is a breakpoint there, we add entries for Edit Breakpoint (edit
+        the condition), Remove Breakpoint, and Enable/Disable Breakpoint (based on the current state).
+
+        * English.lproj/localizedStrings.js: Added localized context menu entries.
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._documentContextMenu.addAndEditBreakpoint):
+        (WebInspector.SourceFrame.prototype._documentContextMenu): Added context menu entries and handlers.
+        (WebInspector.SourceFrame.prototype._documentMouseDown): Changed left click behavior (Add -> Remove).
+
+2010-01-05  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        AX: need a way to get the progress of a webpage load
+        https://bugs.webkit.org/show_bug.cgi?id=33221
+
+        Test: platform/mac/accessibility/estimated-progress.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::estimatedLoadingProgress):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::estimatedLoadingProgress):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2010-01-05  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Drag & drop layout tests fail even when run manually
+        https://bugs.webkit.org/show_bug.cgi?id=33055
+
+        No new tests. Fix 3 layout tests when run manually.
+        fast/events/drag-and-drop.html
+        fast/events/drag-and-drop-dataTransfer-types-nocrash.html
+        fast/events/drag-and-drop-fire-drag-dragover.html
+        Running these tests in DRT will be fixed in 31332.
+
+        * page/qt/DragControllerQt.cpp:
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        Cleanup the drag operation if it failed to complete,
+        Otherwise, new drag operations will not be possible.
+
+2010-01-05  Gustavo Noronha Silva <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Based on idea and original patch by Evan Martin.
+
+        Remove libWebCore intermediate library, to improve link time.
+
+        [GTK] Build time must be reduced
+        https://bugs.webkit.org/show_bug.cgi?id=32921
+
+        * GNUmakefile.am:
+
+2010-01-05  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Move allowSetting{Frame}SrcToJavascriptUrl from V8Custom to BindingSecurity and
+        remove the v8-specific pieces.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33182
+
+        * bindings/BindingSecurity.h:
+        (WebCore::::allowSettingFrameSrcToJavascriptUrl): Moved from V8CustomBinding.cpp.
+        (WebCore::::allowSettingSrcToJavascriptURL): Moved from V8CustomBinding.cpp.
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        (WebCore::V8Attr::valueAccessorSetter):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::V8Element::setAttributeCallback):
+        (WebCore::V8Element::setAttributeNodeCallback):
+        (WebCore::V8Element::setAttributeNSCallback):
+        (WebCore::V8Element::setAttributeNodeNSCallback):
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::V8HTMLFrameElement::srcAccessorSetter):
+        (WebCore::V8HTMLFrameElement::locationAccessorSetter):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::V8HTMLIFrameElement::srcAccessorSetter):
+
+2010-01-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Separate DOMWrapperWorld from V8IsolatedWorld
+        https://bugs.webkit.org/show_bug.cgi?id=33087
+
+        This change separate DOMWrapperWorld and IsolatedWorld from
+        V8IsolatedWorld.  I've also renamed V8IsolatedWorld to
+        V8IsolatedContext in preparation for having more than one context in a
+        single isolated world.
+
+        This patch moves us closer to two goals:
+        1) Matching the structure of the JSC implementation of isolated worlds.
+        2) Letting scripts running in isolated contexts see into other iframes
+           (which requires having more than one context in an isolated world.)
+
+        * WebCore.gypi:
+        * bindings/v8/DOMWrapperWorld.cpp: Added.
+        (WebCore::DOMWrapperWorld::DOMWrapperWorld):
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/DOMWrapperWorld.h: Added.
+        (WebCore::DOMWrapperWorld::create):
+        * bindings/v8/IsolatedWorld.cpp: Added.
+        (WebCore::IsolatedWorld::IsolatedWorld):
+        (WebCore::IsolatedWorld::~IsolatedWorld):
+        * bindings/v8/IsolatedWorld.h: Added.
+        (WebCore::IsolatedWorld::create):
+        (WebCore::IsolatedWorld::count):
+        (WebCore::IsolatedWorld::domDataStore):
+        * bindings/v8/MainThreadDOMData.cpp:
+        (WebCore::MainThreadDOMData::getMainThreadStore):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::currentScriptState):
+        * bindings/v8/ScriptState.cpp:
+        * bindings/v8/ScriptState.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8IsolatedContext.cpp: Copied from WebCore/bindings/v8/V8IsolatedWorld.cpp.
+        (WebCore::V8IsolatedContext::contextWeakReferenceCallback):
+        (WebCore::V8IsolatedContext::V8IsolatedContext):
+        (WebCore::V8IsolatedContext::destroy):
+        (WebCore::V8IsolatedContext::~V8IsolatedContext):
+        (WebCore::V8IsolatedContext::scriptState):
+        * bindings/v8/V8IsolatedContext.h: Copied from WebCore/bindings/v8/V8IsolatedWorld.h.
+        (WebCore::V8IsolatedContext::getEntered):
+        (WebCore::V8IsolatedContext::world):
+        * bindings/v8/V8IsolatedWorld.cpp: Removed.
+        * bindings/v8/V8IsolatedWorld.h: Removed.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::context):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorldContextHandle.cpp:
+        (WebCore::WorldContextHandle::WorldContextHandle):
+
+2010-01-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Move createWindow into generic bindings so it can be shared with JSC
+        https://bugs.webkit.org/show_bug.cgi?id=33201
+
+        This patch moves createWindow from V8-specific code into the generic
+        bindings so that is can be re-used by the JavaScriptCore bindings.  I
+        haven't actually moved the JSC bindings over to using this yet.
+
+        Also, I organized the generic bindings a bit more as it's becoming
+        clearer how things are going to shape up.  There are still some
+        question marks, but hopefully the answers will become clear as we
+        progress.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/generic/BindingDOMWindow.h: Added.
+        (WebCore::::createWindow):
+        * bindings/generic/BindingSecurity.h: Renamed from WebCore/bindings/BindingSecurity.h.
+        (WebCore::BindingSecurity::BindingSecurity):
+        (WebCore::::canAccessWindow):
+        (WebCore::::canAccessFrame):
+        (WebCore::::checkNodeSecurity):
+        * bindings/generic/BindingSecurityBase.cpp: Renamed from WebCore/bindings/BindingSecurityBase.cpp.
+        (WebCore::BindingSecurityBase::getDOMWindow):
+        (WebCore::BindingSecurityBase::getFrame):
+        (WebCore::BindingSecurityBase::canAccess):
+        * bindings/generic/BindingSecurityBase.h: Renamed from WebCore/bindings/BindingSecurityBase.h.
+        * bindings/generic/GenericBinding.h: Renamed from WebCore/bindings/GenericBinding.h.
+        (WebCore::):
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::showModalDialogCallback):
+        (WebCore::V8DOMWindow::openCallback):
+        * bindings/v8/specialization/V8BindingDOMWindow.h: Added.
+        (WebCore::V8BindingDOMWindow::storeDialogArgs):
+        * bindings/v8/specialization/V8BindingState.cpp: Renamed from WebCore/bindings/v8/V8BindingState.cpp.
+        (WebCore::::Only):
+        (WebCore::::getActiveWindow):
+        (WebCore::::immediatelyReportUnsafeAccessTo):
+        * bindings/v8/specialization/V8BindingState.h: Renamed from WebCore/bindings/v8/V8BindingState.h.
+        (WebCore::):
+
+2010-01-05  Dominic Mazzoni  <dmazzoni@google.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32571
+
+        For an object with an aria role of "checkbox" or "radiobutton",
+        Use the "aria-checked" attribute to determine if it's checked.
+
+        Test: accessibility/aria-checkbox-checked.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isChecked):
+
+2010-01-05  Yong Li  <yoli@rim.com>
+
+        Reviewed by Adam Roben.
+
+        Fix build warnings blindly
+        https://bugs.webkit.org/show_bug.cgi?id=33178
+
+        * platform/SharedBuffer.cpp:
+        * platform/SharedBuffer.h:
+        (WebCore::SharedBuffer::append):
+
+2010-01-05  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * platform/SharedBuffer.cpp:
+
+2010-01-05  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fix an obvious bug and build errors in previous commit (r52795)
+        https://bugs.webkit.org/show_bug.cgi?id=33178
+
+        * platform/SharedBuffer.h:
+        (WebCore::SharedBuffer::isEmpty):
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::maybeTransferPlatformData):
+
+2010-01-04  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Let SharedBuffer use a group of memory segments internally.
+        It will merge the segments into a flat consecutive buffer only when
+        necessary.
+        https://bugs.webkit.org/show_bug.cgi?id=33178
+
+        * platform/SharedBuffer.cpp:
+        (WebCore::allocateSegment):
+        (WebCore::freeSegment):
+        (WebCore::SharedBuffer::SharedBuffer):
+        (WebCore::SharedBuffer::~SharedBuffer):
+        (WebCore::SharedBuffer::adoptVector):
+        (WebCore::SharedBuffer::size):
+        (WebCore::SharedBuffer::data):
+        (WebCore::SharedBuffer::append):
+        (WebCore::SharedBuffer::clear):
+        (WebCore::SharedBuffer::copy):
+        (WebCore::SharedBuffer::buffer):
+        (WebCore::SharedBuffer::getSomeData):
+        * platform/SharedBuffer.h:
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::maybeTransferPlatformData):
+        * platform/haiku/SharedBufferHaiku.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/qt/SharedBufferQt.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/win/SharedBufferWin.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+
+2010-01-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed trivial Symbian build fix
+
+        * plugins/symbian/PluginViewSymbian.cpp: Add missing HostWindow.h inclusion
+
+2010-01-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix broken export macros in package builds.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33202
+
+        Always define QT_MAKEDLL unless we're doing a static
+        build or we're building inside of Qt. When building
+        inside of Qt the correct define is pulled from qbase.pri.
+
+        * WebCore.pro:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Fisher.
+
+        Reorganize, document and rename OS() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33198
+
+        Adapt to name changes. Also fixed a few incorrect OS checks.
+
+        * accessibility/AccessibilityObject.h:
+        * config.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::platform):
+        * loader/CachedFont.cpp:
+        * loader/FTPDirectoryDocument.cpp:
+        * loader/FTPDirectoryParser.cpp:
+        * page/EventHandler.cpp:
+        * page/Frame.cpp:
+        (WebCore::Frame::setUseSecureKeyboardEntry):
+        * page/NavigatorBase.cpp:
+        (WebCore::NavigatorBase::platform):
+        * page/Page.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * page/chromium/DragControllerChromium.cpp:
+        (WebCore::DragController::isCopyKeyDown):
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::accessKeyModifiers):
+        * page/win/EventHandlerWin.cpp:
+        (WebCore::EventHandler::createDraggingClipboard):
+        * platform/FileSystem.h:
+        * platform/KeyboardCodes.h:
+        * platform/PurgeableBuffer.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::writeRange):
+        * platform/chromium/ClipboardUtilitiesChromium.cpp:
+        * platform/chromium/ClipboardUtilitiesChromium.h:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PlatformKeyboardEventChromium.cpp:
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::layout):
+        (WebCore::PopupMenu::show):
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::mayFillWithSolidColor):
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/FontCache.cpp:
+        (WebCore::alternateFamilyName):
+        * platform/graphics/FontCache.h:
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore::GlyphBuffer::advanceAt):
+        (WebCore::GlyphBuffer::add):
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/IntRect.h:
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/graphics/Path.h:
+        * platform/graphics/Pattern.h:
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/cg/ColorCG.cpp:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/chromium/FontCustomPlatformData.h:
+        * platform/graphics/chromium/FontPlatformData.h:
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        * platform/graphics/opentype/OpenTypeUtilities.h:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getWindowsContext):
+        * platform/graphics/qt/ImageQt.cpp:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::PlatformContextSkia):
+        (PlatformContextSkia::save):
+        (PlatformContextSkia::restore):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/win/IconWin.cpp:
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::filenameToString):
+        (WebCore::filenameFromString):
+        (WebCore::filenameForDisplay):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        * platform/network/curl/ResourceHandleManager.cpp:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+        * platform/text/String.cpp:
+        (WebCore::String::format):
+        (WebCore::String::number):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+        * platform/text/TextStream.cpp:
+        * platform/text/TextStream.h:
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+        * platform/win/PlatformMouseEventWin.cpp:
+        (WebCore::messageToEventType):
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::deviceInfoForWidget):
+        (WebCore::screenIsMonochrome):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::paint):
+        (WebCore::PopupMenu::registerClass):
+        (WebCore::PopupMenu::PopupMenuWndProc):
+        (WebCore::PopupMenu::wndProc):
+        * platform/win/SystemTimeWin.cpp:
+        (WebCore::userIdleTime):
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::unloadModule):
+        * plugins/PluginDatabase.cpp:
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::compareFileVersion):
+        * plugins/PluginPackage.h:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/win/PluginDatabaseWin.cpp:
+        (WebCore::addWindowsMediaPlayerPluginDirectory):
+        (WebCore::addMacromediaPluginDirectories):
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::registerPluginView):
+        (WebCore::PluginView::wndProc):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paintIntoTransformedContext):
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::platformStart):
+
+2010-01-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add ARIA "Live Region" support
+        https://bugs.webkit.org/show_bug.cgi?id=33117
+
+        Tests: platform/mac/accessibility/aria-liveregions-attributes.html
+               platform/mac/accessibility/aria-liveregions-notifications.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::contentChanged):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::isChildOfARIALiveRegion):
+        (WebCore::AccessibilityObject::supportsARIALiveRegion):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::contentChanged):
+        (WebCore::AccessibilityObject::ariaLiveRegionStatus):
+        (WebCore::AccessibilityObject::ariaLiveRegionRelevant):
+        (WebCore::AccessibilityObject::ariaLiveRegionAtomic):
+        (WebCore::AccessibilityObject::ariaLiveRegionBusy):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::elementAttributeValue):
+        (WebCore::AccessibilityRenderObject::contentChanged):
+        (WebCore::AccessibilityRenderObject::childrenChanged):
+        (WebCore::AccessibilityRenderObject::ariaLiveRegionStatus):
+        (WebCore::AccessibilityRenderObject::ariaLiveRegionRelevant):
+        (WebCore::AccessibilityRenderObject::ariaLiveRegionAtomic):
+        (WebCore::AccessibilityRenderObject::ariaLiveRegionBusy):
+        * accessibility/AccessibilityRenderObject.h:
+        (WebCore::AccessibilityRenderObject::areChildrenDirty):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AccessibilityObjectWrapper.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilitySetPostedNotificationCallback:]):
+        (-[AccessibilityObjectWrapper accessibilityPostedNotification:]):
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged):
+        * html/HTMLAttributeNames.in:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setText):
+
+2010-01-04  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Adopt a more conservative approach for loading CSS cross-origin. When
+        loading CSS cross-origin, it must be start with valid CSS if the MIME
+        type is broken.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29820
+
+        Test: http/tests/security/cross-origin-css.html
+        Test: http/tests/security/cross-origin-css-in-xml.xml
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet): Enforce stricter load
+        requirements for cross-origin loads.
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet): Enforce stricter load
+        requirements for cross-origin loads.
+        * css/CSSStyleSheet.h:
+        * css/CSSStyleSheet.cpp:
+        * css/CSSParser.cpp:
+        * css/CSSGrammar.y:
+        * css/CSSParser.h:
+        Add ability to tell whether the CSS parse started with a syntactically
+        valid CSS rule.
+        * loader/CachedCSSStyleSheet.h:
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::sheetText): Add ability to return
+        whether the MIME type was acceptable for CSS.
+        (WebCore::CachedCSSStyleSheet::canUseSheet): If requested, return
+        whether the MIME type was valid or not.
+        * dom/ProcessingInstruction.cpp
+        (WebCore::ProcessingInstruction::setCSSStyleSheet): Make use of strict
+        mode explicit and add comment.
+
+2010-01-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6655695> REGRESSION: VoiceOver is not highlighting some web elements correctly
+        <rdar://problem/7397558> REGRESSION: AXImages inside of AXLink cause AXLink to have wrong bounds
+
+        Test: accessibility/dimensions-include-descendants.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::boundingBoxRect): Use absoluteFocusRingQuads()
+        for non-text renderers. The focus ring encompasses descendants, which is
+        what we want for the accessibility indicator.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteFocusRingQuads): Added.
+        * rendering/RenderObject.h:
+
+2010-01-04  Ojan Vafai  <ojan@ojanmacpro.sfo.corp.google.com>
+
+        Reviewed by Dan Bernstein.
+
+        Remove unnecessary division by a constant in SimpleFontDataMac.mm.
+        https://bugs.webkit.org/show_bug.cgi?id=33189
+
+        This was added in http://trac.webkit.org/changeset/8104 and seems like
+        it was just there to match the previously private function which we no
+        longer use.
+
+        No new tests. No change in behavior.
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+
+2010-01-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Selection-related code needs stricter rules about how it relates to layout
+        https://bugs.webkit.org/show_bug.cgi?id=32882
+
+        Covered by existing tests along with the new assertions.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle): Make sure that m_inStyleRecalc is
+        already false by the time post-attach callbacks are done so that
+        layout triggered inside those callbacks can work properly.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::layout): Added code to trigger a
+        layout when it's needed.
+        (WebCore::SelectionController::recomputeCaretRect): Removed unneeded
+        code to do nothing when FrameView is 0. Added an assertion that layout
+        is not needed at the time the function is called.
+        (WebCore::SelectionController::invalidateCaretRect): Added code to
+        trigger a layout when it's needed.
+        (WebCore::SelectionController::paintCaret): Added an assertion that
+        layout is not needed at the time the function is called.
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::shouldAutofocus): Added. Helper function that expresses
+        the rule for which form control elements should auto-focus.
+        (WebCore::focusPostAttach): Added. Called post-attach to focus an
+        element if we discover it should be focused during attach.
+        (WebCore::HTMLFormControlElement::attach): Refactored code for
+        which elements need auto-focus into a separate function. Instead
+        of focusing right away, use the focusPostAttach function to focus
+        after attach is done. Also added calls to suspendPostAttachCallbacks
+        and resumePostAttachCallbacks so post-attach callbacks happen late
+        enough. Before, they could run inside the base attach function.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach): Added calls to
+        suspendPostAttachCallbacks and resumePostAttachCallbacks so
+        post-attach callbacks happen late enough
+
+        * page/Frame.cpp:
+        (WebCore::Frame::revealSelection): Added code to trigger a layout
+        when it's needed.
+
+2010-01-04  Gavin Barraclough <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33163
+        Use WTF's string hashing functions from StringImpl.
+
+        * ForwardingHeaders/wtf/StringHashFunctions.h: Added.
+        * platform/text/StringHash.h:
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::computeHash):
+
+2010-01-04  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Qt build fix. Unreviewed.
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::postNotification):
+
+2010-01-04  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: <select> elements should broadcast value change events
+
+        https://bugs.webkit.org/show_bug.cgi?id=33088
+
+        <rdar://problem/7332364>
+
+        Reviewed by Darin Adler.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::postNotification):
+        If the post type is async, follow the old code path; otherwise, call
+        postPlatformNotification().
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        Added a new accessibility notification, AXMenuListValueChanged. Added
+        a new parameter to postNotification() to specify whether the post should
+        be synchronous or asynchronous.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        If the WebCore notification is AXMenuListValueChanged, broadcast an
+        EVENT_OBJECT_VALUECHANGE event.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::setSelectedIndex):
+        When the selected index of a RenderMenuList is changed, call
+        RenderMenuList::didSetSelectedIndex().
+
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::RenderMenuList):
+        Initialize new member
+        (WebCore::RenderMenuList::didSetSelectedIndex):
+        If the selected index has changed, post AXMenuListValueChanged to the
+        object synchronously.
+
+        * rendering/RenderMenuList.h:
+        Declare didSetSelectedIndex(), and add a member to hold the last
+        selected index.
+
+2010-01-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added missing null check in BarInfo code.
+
+        Test: fast/dom/Window/BarInfo-after-frame-removed.html
+
+        * page/BarInfo.cpp:
+        (WebCore::BarInfo::visible): Added null check. A few other
+        cleanups.
+
+2010-01-04  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Jon Honeycutt.
+
+        Delete an empty and unused JavaScript file.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/InspectorControllerStub.js: Removed.
+
+2010-01-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, add a couple include dirs to the build.
+
+        * wscript:
+
+2010-01-04  Dan Bernstein  <mitz@apple.com>
+
+        Windows build fix
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+
+2010-01-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Repaint issues in text input under a scale transform
+        https://bugs.webkit.org/show_bug.cgi?id=32086
+        
+        When doing a subtree layout we have to look up the container chain to see if there
+        are any properties, such as transforms or reflections, that mean that we are unable
+        to use layoutState.
+
+        Test: fast/repaint/subtree-layoutstate-transform.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout): Call canUseLayoutStateForSubtree() to determine
+        whether it's OK to use layoutState.
+        
+        * rendering/RenderView.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::canUseLayoutStateForSubtree): New method that reports whether it's
+        OK to use layoutState when doing a subtree layout from the given root.
+
+2010-01-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Reentrancy problem with selection in some edge cases.
+        https://bugs.webkit.org/show_bug.cgi?id=32842
+        rdar://problem/7449974
+
+        Test: fast/forms/selection-layout-reentry-strange-case.html
+
+        Move the selection display update process done in the
+        selectionLayoutChanged function into the layout timer
+        instead of doing it immediately when selection changes occur.
+
+        * dom/Document.cpp:
+        (WebCore::Document::updateLayout): Changed this to use the
+        definition of needsLayout from FrameView rather than rolling
+        its own.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        Initialize m_needsDisplayUpdate to false.
+        (WebCore::SelectionController::setSelection): Call
+        the new setNeedsDisplayUpdate function instead of the old
+        badly named Frame::selectionLayoutChanged function.
+        (WebCore::SelectionController::setNeedsDisplayUpdate):
+        Set m_needsDisplayUpdate. If it is just becoming true, then
+        call FrameView::scheduleRelayout.
+
+        * editing/SelectionController.h: Added setNeedsDisplayUpdate,
+        needsDisplayUpdate, and m_needsDisplayUpdate.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setCaretVisible): Call setNeedsDisplayUpdate.
+        (WebCore::Frame::selectionLayoutChanged): Call
+        setNeedsDisplayUpdate to set it to false, since this is the
+        function that performs "selection display update". Later I want
+        to rename this function. Also added a global reentrancy check
+        since that's the easiest way I could think of to prevent infinite
+        recursion in the case where recomputeCaretRect ends up triggering
+        a layout. As a side effect, fixed theoretical problems in
+        TEXT_CARET builds by improving the ifdef.
+        (WebCore::Frame::caretBlinkTimerFired): Loosen assertions a
+        bit. Later we might want to decouple caret rect from caret state
+        a bit more and add these assertions back.
+        (WebCore::Frame::selectionBounds): Call Document::updateLayout.
+        This function is for external clients and they do not currently
+        do anything to make sure layout is up to date.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::needsLayout): Add a new clause, since
+        we need a call to layout if needsDisplayUpdate is true.
+
+2010-01-04  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Correct debug assertion (and possible runtime errors) by
+        checking validity of bitmap settings used to create
+        the Windows Cairo contexts.
+        https://bugs.webkit.org/show_bug.cgi?id=33164.
+
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        (WebCore::createCairoContextWithHDC): Check validity of selected
+          OBJ_BITMAP retrieved, and only create 32-bit context when
+          a valid bitmap is provided.
+
+2010-01-04  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, revert r52745 and r52746 on behalf of Nikolas Zimmermann, as discussed on IRC.
+        Patch produced by 'git revert' and then reverting back ChangeLog files.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::setPath):
+        (WebCore::RenderPath::path):
+        (WebCore::RenderPath::paint):
+        (WebCore::):
+        (WebCore::DrawMarkersData::DrawMarkersData):
+        (WebCore::drawMarkerWithData):
+        (WebCore::updateMarkerDataForElement):
+        (WebCore::drawStartAndMidMarkers):
+        (WebCore::RenderPath::drawMarkersIfNeeded):
+        * rendering/RenderPath.h:
+        (WebCore::RenderPath::markerBoundingBox):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::paint):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGMarkerData.h: Removed.
+        * rendering/SVGMarkerLayoutInfo.cpp: Removed.
+        * rendering/SVGMarkerLayoutInfo.h: Removed.
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::SVGResource::SVGResource):
+        (WebCore::ResourceSet::ResourceSet):
+        (WebCore::clientMap):
+        (WebCore::SVGResource::~SVGResource):
+        (WebCore::SVGResource::removeClient):
+        (WebCore::SVGResource::addClient):
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::SVGResourceMarker):
+        (WebCore::SVGResourceMarker::setMarker):
+        (WebCore::SVGResourceMarker::setRef):
+        (WebCore::SVGResourceMarker::draw):
+        (WebCore::SVGResourceMarker::cachedBounds):
+        (WebCore::SVGResourceMarker::externalRepresentation):
+        * svg/graphics/SVGResourceMarker.h:
+        (WebCore::SVGResourceMarker::refX):
+        (WebCore::SVGResourceMarker::refY):
+
+2010-01-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Ada Chan and Mark Rowe.
+
+        Updated copyright string
+
+        * Info.plist:
+        * WebCore.vcproj/QTMovieWin.rc:
+
+2010-01-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX: any DIV with an aria role should not be ignored
+        https://bugs.webkit.org/show_bug.cgi?id=33090
+
+        Test: platform/mac/accessibility/aria-divs-not-ignored.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+
+2010-01-04  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Generate declarations for V8 runtime enablers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33156
+
+        * bindings/scripts/CodeGeneratorV8.pm: Generate runtime enabler declarations.
+        * bindings/v8/custom/V8CustomBinding.h: Remove manual declarations of runtime enablers.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8WebSocketCustom.cpp: Remove closeCallback(), which isn't actually being used.
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+
+2010-01-04  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Forgot to add SVGMarkerData.h / SVGMarkerLayoutInfo.(cpp,h) to Chromium build.
+
+        * WebCore.gypi:
+
+2010-01-04  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Marker code is buggy: referencePoint translation is off
+        https://bugs.webkit.org/show_bug.cgi?id=33012
+
+        Rewrite marker code, as it had many issues:
+        - Correct refX/refY handling (covered by new marker-referencePoint.svg test)
+        - Calculate marker bounds on layout time, instead of paint time, to deliver correct repaint rects
+        - Cleanup RenderPath code, which was cluttered by marker stuff (outlay in SVGMarkerLayoutInfo)
+        - Fix SVGResource assuming that there is only one resource per resource type per element. Markers
+          can have three different resources of the same type (three markers, start/mid/end markers)
+
+        Filed bug 33115 (PathElementAddQuadCurveToPoint not handled for <marker>), which was just a TODO in the code before.
+
+        Fixes all svg/custom/marker*.svg tests, that use dynamic updates (propagation failed before).
+        Test: svg/custom/marker-referencePoint.svg
+              svg/custom/marker-opacity.svg
+
+        * Android.mk: Add SVGMarkerData.h / SVGMarkerLayoutInfo.(cpp,h) to build.
+        * GNUmakefile.am: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * page/FrameView.cpp: Notify RenderSVGRoot children about viewport size changes, just like it's handled for <body> in HTML.
+        (WebCore::FrameView::layout): This is important, as marker bounding boxes may depend on the current viewport size through relative coordinates used in <svg>.
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::markerBoundingBox): Calculates and caches marker boundaries in the layout() phase.
+        (WebCore::RenderPath::repaintRectInLocalCoordinates): Use the cached marker bounding box during paint() time.
+        (WebCore::RenderPath::setPath): Clear marker boundaries upon path changes.
+        (WebCore::RenderPath::paint): Use SVGMarkerLayoutInfo::drawMarkers() instead of the local drawMarkersIfNeeded() function, which is gone now.
+        (WebCore::RenderPath::calculateMarkerBoundsIfNeeded): Utilized by markerBoundingBox() to request SVGResourceMarker objects and calculate their boundaries.
+        * rendering/RenderPath.h: Store SVGMarkerLayoutInfo objects, and rename m_markerBounds to m_cachedLocalMarkerBBox for consistency.
+        (WebCore::RenderPath::path): Inline this accessor.
+        * rendering/RenderSVGContainer.h: Make paint() public (to be used from SVGResourceMarker), all other methods protected (to be used from RenderSVGViewportContainer).
+        * rendering/RenderSVGViewportContainer.cpp: Remove useless paint() override, as the comment in the code indicated.
+        (WebCore::RenderSVGViewportContainer::markerBoundaries): Maps the marker contents repaintRectInLocalCoordinates() into the final coordinate system (see code).
+        (WebCore::RenderSVGViewportContainer::markerContentTransformation): Add marker-specific helper method, allowing to make viewportTransform() private again.
+        * rendering/RenderSVGViewportContainer.h: Marking viewportTransform() private, it's never meant to be used outside this renderer.
+        * rendering/SVGMarkerData.h: Added. Refactored from existing RenderPath code, preserving original copyrights.
+        (WebCore::SVGMarkerData::): Helper struct for SVGMarkerLayoutInfo.
+        (WebCore::SVGMarkerData::origin): Holds the final computed destination of a marker.
+        (WebCore::SVGMarkerData::marker): Holds a pointer to the associated SVGResourceMarker object, which we're aiming to layout.
+        (WebCore::SVGMarkerData::currentAngle): Calculates the current angle for a certain marker type (start/mid/end) based upon the computed inslope/outslope values.
+        (WebCore::SVGMarkerData::updateTypeAndMarker): Helper method.
+        (WebCore::SVGMarkerData::updateOutslope): Ditto.
+        (WebCore::SVGMarkerData::updateMarkerDataForPathElement): Does the actual inslope/outslope calculation.
+        (WebCore::SVGMarkerData::updateInslope): Helper method.
+        * rendering/SVGMarkerLayoutInfo.cpp: Added. New approach to build marker layout info, this time correct during layout() time instead of paint() time.
+        (WebCore::SVGMarkerLayoutInfo::SVGMarkerLayoutInfo):
+        (WebCore::SVGMarkerLayoutInfo::~SVGMarkerLayoutInfo):
+        (WebCore::processStartAndMidMarkers): Static helper method used to visit each path element in order to calculate inslopes/outslopes (-> orientation angles)
+        (WebCore::SVGMarkerLayoutInfo::calculateBoundaries): Build list of MarkerLayout objects, used to query boundaries, and to paint markers during drawMarkers().
+        (WebCore::SVGMarkerLayoutInfo::drawMarkers): Cheap method walking existing MarkerLayout vector, drawing the individual RenderSVGViewportContainer of the markers.
+        (WebCore::SVGMarkerLayoutInfo::addLayoutedMarker): Helper method.
+        * rendering/SVGMarkerLayoutInfo.h: Added.
+        (WebCore::MarkerLayout::MarkerLayout): Helper struct storing a pair of SVGResourceMarker* and a TranformationMatrix.
+        (WebCore::SVGMarkerLayoutInfo::markerData): Public helper methods returning references to private member variables, used from processStartAndMidMarkers.
+        (WebCore::SVGMarkerLayoutInfo::midMarker): Ditto.
+        (WebCore::SVGMarkerLayoutInfo::elementIndex): Ditto.
+        * svg/SVGMarkerElement.cpp: Adopt to name change: setRef() -> setReferencePoint(). setMarker() -> setRenderer()
+        (WebCore::SVGMarkerElement::canvasResource): Add ASSERT(renderer()) to clarify that canvasResource() is only meant to used after renderer creation.
+        * svg/graphics/SVGResource.cpp: Instead of maintaining a global hashmap between SVGStyledElements and an array of possible SVGResources, use a HashSet of SVGResources
+                                        and directly scan the already existing list of clients for a certain SVGResource. This wrong approach has been introduced over two years
+                                        ago, making the assumption that there's only one resource type per element. Though markers can provide three resources of the same type
+                                        per element (all SVGResourceMarker objects, but in different rules: start/mid/end marker). That information is only available while painting.
+        (WebCore::resourceSet): Add global static HashSet<SVGResource*>.
+        (WebCore::SVGResource::SVGResource): Add us to the resourceSet.
+        (WebCore::SVGResource::~SVGResource): Remove us from resourceSet.
+        (WebCore::SVGResource::removeClient): Traverse all SVGResource clients and remove the passed SVGStyledElement from the client list (invoked by SVGStyledElement destructor).
+        (WebCore::SVGResource::addClient): Remove the offending part of the old approach, making the wrong assumption regarding resource types.
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::SVGResourceMarker):
+        (WebCore::SVGResourceMarker::markerTransformation): Create TransformationMatrix in the local marker content (RenderSVGViewportContainer) coordinate system, to position a marker.
+        (WebCore::SVGResourceMarker::draw): Simplify marker drawing a lot: used the passing TransformationMatrix (cached in SVGMarkerLayoutInfo) to draw the marker content renderer.
+        (WebCore::SVGResourceMarker::externalRepresentation): Adopt to refX/refY -> referencePoint changes.
+        * svg/graphics/SVGResourceMarker.h: Store a FloatPoint m_referecePoint instead of two refX/refY float values.
+        (WebCore::SVGResourceMarker::setRenderer): Renamed from setMarker().
+        (WebCore::SVGResourceMarker::setReferencePoint): Renamed from setRef().
+        (WebCore::SVGResourceMarker::referencePoint): New accessor replacing refX() / refY().
+
+2010-01-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix standalone package builds.
+
+        * WebCore.pro: Moved logic for detecting standalone builds to WebKit.pri. Set DESTDIR for package builds.
+
+2010-01-04  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29048
+        [Qt] make RenderStyle.h compile in winscw compiler.
+
+        Change compareEqual to a macro in Winscw compiler to get around "illegal operand" 
+        error when compareEqual is defined as template.
+
+        The compiler bug is reported at:
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=10447
+
+        * rendering/style/RenderStyle.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix some PLATFORM(*_ENDIAN) uses to CPU()
+        https://bugs.webkit.org/show_bug.cgi?id=33148
+
+        * platform/image-decoders/bmp/BMPImageReader.h:
+        (WebCore::BMPImageReader::readUint16):
+        (WebCore::BMPImageReader::readUint32):
+        (WebCore::BMPImageReader::readCurrentPixel):
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Reorganize, document and rename CPU() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33145
+
+        * page/NavigatorBase.cpp:
+        * platform/text/AtomicString.cpp:
+        (WebCore::equal):
+        * platform/text/StringHash.h:
+        (WebCore::StringHash::equal):
+
+2009-12-22  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] G_OBJECT() cast is not necessary for signals connection and properties access
+        https://bugs.webkit.org/show_bug.cgi?id=32661
+
+        Reverted the SENTINEL / NULL crap :) Hopefully the style-bot won't
+        complain about NULL usage in g_object_{get,set} anymore.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+
+2010-01-04  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Eric Seidel.
+
+        Updated license to match recommended header license.
+
+        * mathml/MathMLElement.cpp:
+        * mathml/MathMLElement.h:
+        * mathml/MathMLInlineContainerElement.cpp:
+        * mathml/MathMLInlineContainerElement.h:
+        * mathml/MathMLMathElement.cpp:
+        * mathml/MathMLMathElement.h:
+
+2010-01-04  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVGResources don't invalidate if target object changes attributes
+        https://bugs.webkit.org/show_bug.cgi?id=33091
+
+        It's neccessary to invalidate all resources of an object, if the attributes of this
+        target change. Otherwise the saved resource data (like ImageBuffers) don't match
+        to the new object properties. 
+
+        Test: svg/custom/resource-invalidate-on-target-update.svg
+
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::svgAttributeChanged):
+        (WebCore::SVGStyledElement::invalidateResources):
+        * svg/SVGStyledElement.h:
+
+2010-01-03  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Index validation code must always copy client data
+        https://bugs.webkit.org/show_bug.cgi?id=32748
+
+        Client data must always be copied during bufferData and
+        bufferSubData calls, because otherwise the data the GL uses to
+        draw may differ from that checked by the index validation code.
+
+        Test: fast/canvas/webgl/index-validation-copies-indices.html
+
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        (WebCore::WebGLBuffer::associateBufferData):
+        (WebCore::WebGLBuffer::associateBufferSubData):
+        * html/canvas/WebGLBuffer.h:
+
+2010-01-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Implement CookieJarChromium::cookiesEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=33123
+
+        Call out to ChromiumBridge to find out if cookies are enabled.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::cookiesEnabled):
+
+2010-01-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Remove evaluateInNewContext (it's useless)
+        https://bugs.webkit.org/show_bug.cgi?id=33068
+
+        This function has no clients and makes life complicated.  Isolated
+        worlds won out over NewContext and there's not really any going back
+        now.
+
+        No new tests because this is all minus lines.
+
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+
+2010-01-03  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Remove out of date commented out attributes in IDLs. We have implemented onpopstate.
+
+        * html/HTMLBodyElement.idl:
+        * html/HTMLFrameSetElement.idl:
+        * page/DOMWindow.idl:
+
+2010-01-03  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Mark more filter effect as alphaImage if possible
+        https://bugs.webkit.org/show_bug.cgi?id=33111
+
+        Mark more effects as alphaImage if the previous effect is a
+        alphaImage. This can reduce the calculation on the next effect
+        like feGaussianBlur.
+        
+        Test: This changes don't affect any LayoutTests and can't be tested
+              somehow, since the changes are 'invisible'.
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2010-01-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Scrollbar of overflow:scroll div in compositing layer fails to render
+        https://bugs.webkit.org/show_bug.cgi?id=32439
+        
+        When deciding whether a RenderLayer needs backing store, check whether it has
+        overflow controls that need painting.
+
+        Test: compositing/overflow/scrollbar-painting.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hasOverflowControls):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
+
+2009-12-31  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] context menu overriding API is very limited
+        https://bugs.webkit.org/show_bug.cgi?id=27546
+
+        Only show font menu items in rich text areas in the GTK+ port.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+
+2009-12-31  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] context menu overriding API is very limited
+        https://bugs.webkit.org/show_bug.cgi?id=27546
+
+        Don't show spell checking menu items in text areas in the GTK+ port.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+
+2009-12-31  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7503279> REGRESSION (r47440): Incomplete repaint at macworldexpo.com
+        https://bugs.webkit.org/show_bug.cgi?id=33067
+
+        Test: fast/repaint/table-cell-overflow.html
+
+        * rendering/RenderTableCell.h:
+        (WebCore::RenderTableCell::hasVisibleOverflow): Added.
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows): Set m_hasOverflowingCell if
+        any cell has visible overflow, like it was before r47440.
+
+2009-12-31  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Do not include Frame.h under WebCore/html/canvas
+        https://bugs.webkit.org/show_bug.cgi?id=33082
+
+        No new tests, as there is no new functionality.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+
+2009-12-30  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Delete ResourceRequest::securityInfo
+        https://bugs.webkit.org/show_bug.cgi?id=26847
+
+        * platform/network/chromium/ResourceRequest.h:
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove unused code from V8DOMWrapper.
+
+        * bindings/v8/V8DOMWrapper.cpp: Removed code that I added but it's no longer used.
+        * bindings/v8/V8DOMWrapper.h: Ditto.
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Generate configuring undetectable collection.
+        https://bugs.webkit.org/show_bug.cgi?id=33063
+
+        Refactoring, covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added GenerateImplementationMasqueradeAsUndefined.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Touched to keep IB-based builds happy.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed hand-configuring.
+
+2009-12-30  Zelidrag Hornung  <zelidrag@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added ability for PopupMenuClient to signal when
+        a) selection changed, and
+        b) weather suggested value should be accepted when popup menu closes
+
+        No new tests since this new functionality (autocomplete suggestions)
+        is intentionally hidden from everything else than renderer.
+
+        * platform/PopupMenuClient.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::selectIndex):
+        (WebCore::PopupListBox::clearSelection):
+        (WebCore::PopupListBox::hidePopup):
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::menuUnmapped):
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QtFallbackWebPopup.cpp:
+        (WebCore::QtFallbackWebPopup::hidePopup):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::hide):
+        * platform/wx/PopupMenuWx.cpp:
+        (WebCore::PopupMenu::OnMenuItemSelected):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::popupDidHide):
+        * rendering/RenderMenuList.h:
+        (WebCore::RenderMenuList::selectionChanged):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::popupDidHide):
+        * rendering/RenderTextControlSingleLine.h:
+        (WebCore::RenderTextControlSingleLine::selectionChanged):
+
+2009-12-30  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Auto-generate V8 bindings header declarations for
+        property accessor getter/setters, and remove a couple of
+        unnecessarily custom bindings that weren't properly declared
+        custom anyway.
+
+        * Android.v8bindings.mk: Remove V8NavigatorCustom.cpp.
+        * WebCore.gypi: Remove V8NavigatorCustom.cpp.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * bindings/v8/custom/V8CoordinatesCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        * bindings/v8/custom/V8NavigatorCustom.cpp: Removed.
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Touch DerivedSourcesAllInOne to avoid clobbering IB-based builds.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Added a line-break.
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Generate configuring of call-as-function callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=33061
+
+        Refactoring, covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added GenerateHeaderCustomCall and
+            GenerateImplementationCustomCall.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed all hand-configuring of call-as-function
+            callbacks.
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::V8HTMLAppletElement::callAsFunctionCallback): Added.
+        (WebCore::V8HTMLEmbedElement::callAsFunctionCallback): Added.
+        (WebCore::V8HTMLObjectElement::callAsFunctionCallback): Added.
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.h: Removed.
+
+2009-12-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [v8] Move world-specific state out of V8Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=33034
+
+        This is the first step towards unifying the V8 implementation of
+        isolated worlds with the JSC implementation.  We need an object to
+        encapulate all the world-specific bindings state.  Previoulsy, we used
+        V8Proxy for this purpose (along with a million other things), but
+        there's a one-to-one mapping between V8Proxy objects and Frame objects.
+
+        This patch takes the world-specific state and moves it to a new object,
+        affectionately called V8DOMWindowShell.  This object is the moral
+        equivalent of JSDOMWindowShell but with more data members because life
+        is more complicated in V8-land.
+
+        This patch is almost entirely code motion.  Future patches will clean
+        up this class as we use it to represent window shells in isolated
+        worlds as well as the main world.
+
+        * WebCore.gypi:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::updateSecurityOrigin):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/v8/V8DOMWindowShell.cpp: Added.
+        (WebCore::handleFatalErrorInV8):
+        (WebCore::reportFatalErrorInV8):
+        (WebCore::reportUnsafeJavaScriptAccess):
+        (WebCore::V8DOMWindowShell::create):
+        (WebCore::V8DOMWindowShell::V8DOMWindowShell):
+        (WebCore::V8DOMWindowShell::isContextInitialized):
+        (WebCore::V8DOMWindowShell::disposeContextHandles):
+        (WebCore::V8DOMWindowShell::destroyGlobal):
+        (WebCore::V8DOMWindowShell::clearForClose):
+        (WebCore::V8DOMWindowShell::clearForNavigation):
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+        (WebCore::V8DOMWindowShell::createNewContext):
+        (WebCore::V8DOMWindowShell::installDOMWindow):
+        (WebCore::V8DOMWindowShell::updateDocumentWrapper):
+        (WebCore::V8DOMWindowShell::clearDocumentWrapper):
+        (WebCore::V8DOMWindowShell::updateDocumentWrapperCache):
+        (WebCore::V8DOMWindowShell::clearDocumentWrapperCache):
+        (WebCore::V8DOMWindowShell::setSecurityToken):
+        (WebCore::V8DOMWindowShell::updateDocument):
+        (WebCore::V8DOMWindowShell::updateSecurityOrigin):
+        (WebCore::V8DOMWindowShell::getHiddenObjectPrototype):
+        (WebCore::V8DOMWindowShell::installHiddenObjectPrototype):
+        (WebCore::V8DOMWindowShell::createWrapperFromCacheSlowCase):
+        * bindings/v8/V8DOMWindowShell.h: Added.
+        (WebCore::V8DOMWindowShell::context):
+        (WebCore::V8DOMWindowShell::createWrapperFromCache):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructorForContext):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::~V8Proxy):
+        (WebCore::V8Proxy::handleOutOfMemory):
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::clearForClose):
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::setContextDebugId):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::windowShell):
+        (WebCore::V8Proxy::extensions):
+
+2009-12-30  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVGResourceClipper needs to invalidate content
+        https://bugs.webkit.org/show_bug.cgi?id=33054
+
+        Added invalidate() to SVGResourceClipper to reset clipData
+        and drawing area after attribute changes.
+
+        This fixes two LayoutTests.
+
+        * svg/graphics/SVGResourceClipper.cpp:
+        (WebCore::SVGResourceClipper::resetClipData):
+        (WebCore::SVGResourceClipper::invalidate):
+        * svg/graphics/SVGResourceClipper.h:
+
+2009-12-30  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+         [Qt] RenderThemeQt::applyTheme is a misnomer and is suboptimally coded.
+        https://bugs.webkit.org/show_bug.cgi?id=33035
+
+        This patch:
+        - renames RenderThemeQt::applyTheme to initializeCommonQStyleOptions,
+        - extracts the palette initialization code to a separate function in order to
+        provide for readable pointer checking and moves this code up in the function to
+        allow for future changes to the palette brushes needed for bug 30173,
+        - optimizes some of the code in the function for readability, speed and size.
+        - fixes some minor style issues
+
+        No new tests because code behavior is not changed.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::paintTextField):
+        (WebCore::RenderThemeQt::paintMenuList):
+        (WebCore::RenderThemeQt::paintMenuListButton):
+        (WebCore::initPaletteFromPageClientIfExists):
+        (WebCore::RenderThemeQt::initializeCommonQStyleOptions):
+        * platform/qt/RenderThemeQt.h:
+
+2009-12-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] It should be possible to disable inspector
+        https://bugs.webkit.org/show_bug.cgi?id=32724
+
+        This makes the r48430 available for other ports as well.
+        No new tests, as there is no new functionality.
+
+        * inspector/InjectedScriptHost.idl: Guard the interface with
+        INSPECTOR guard.
+
+        * inspector/InspectorBackend.idl: Ditto.
+
+        * inspector/InspectorFrontendHost.idl: Ditto.
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Generate configuring of all indexers.
+        https://bugs.webkit.org/show_bug.cgi?id=33031
+
+        Refactorig, covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added generation of indexers for
+            special cases.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed custom tempalte configuration of
+            indexers.
+        * bindings/v8/custom/V8CustomBinding.h: Added decls for Applet, Embed, and Object
+            elements (these will be generated, too -- later.)
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::npObjectIndexedGetter): Moved common code to a separate method.
+        (WebCore::npObjectIndexedSetter): Ditto.
+        (WebCore::INDEXED_PROPERTY_GETTER): Added custom handlers for Applet, Embed, and Object
+          all calling the common method.
+        (WebCore::INDEXED_PROPERTY_SETTER): Ditto.
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Generate configuring of all named property getters/setters/enumerators.
+        https://bugs.webkit.org/show_bug.cgi?id=32996
+
+        Refactoring, covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added generation of named property handlers
+            for special cases (See bug for more info).
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed custom template configuration of named
+            property handlers.
+        * bindings/v8/custom/V8CustomBinding.h: Added decls for Applet, Embed, and Object
+            elements (these will be generated, too -- later.)
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::npObjectNamedGetter): Moved common code to a separate method.
+        (WebCore::npObjectNamedSetter): Ditto.
+        (WebCore::NAMED_PROPERTY_GETTER): Added custom handlers for Applet, Embed, and Object
+          all calling the common method.
+        (WebCore::NAMED_PROPERTY_SETTER): Ditto.
+
+2009-12-30  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix PluginView::handlePostReadFile().
+        https://bugs.webkit.org/show_bug.cgi?id=33052
+
+        The function should actually rewrite the given file to the buffer.
+
+        This change fixes http/tests/plugins/post-url-file.html, which can be unskipped
+        now along with other passing http/plugins tests.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handlePostReadFile):
+
+2009-12-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber stamped by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32121
+        [Qt] Revert "Implement ImageDecoderQt::clearFrameBufferCache()" from r52516.
+
+        The implementation appears to either run into an ASSERT
+        or leak memory at runtime as the m_buffer, m_reader may
+        already exist. The bug was reopened and we do have a plan now.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-12-30  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add support for Symbian def files
+
+        * WebCore.pro:
+
+2009-12-30  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Qt/Symbian build fix.
+
+        Don't build network state notifier support when building inside of Qt.
+        Otherwise the Qt build depends on an external module that itself depends
+        on Qt again.
+
+        * WebCore.pro:
+
+2009-12-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] Use current isolated world's context for ScriptCallStack.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33016
+
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::state):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        (WebCore::ScriptController::currentScriptState):
+        (WebCore::ScriptController::clearWindowShell):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::scriptState):
+        * bindings/v8/V8IsolatedWorld.h:
+
+2009-12-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Turn off DataGrid support by default.
+
+        No new tests, as there is no new functionality.
+
+        * WebCore.pro:
+
+2009-12-29  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Detailed boundingBoxes in SVG Renderer
+        https://bugs.webkit.org/show_bug.cgi?id=32815
+
+        Add new bounding boxes for strokes, filters, masker and clipper in SVG.
+        These new bounding boxes help to fix repaintRectInLocalCoordinates.
+        We calculate the smallest repaint rect considering the new bounding boxes
+        now, filters get the correct paint area, masker clip the mask image size
+        to the visible area of the target.
+
+        Tests: Many tests need an update. The changes in repaintRectInLocalCoordinates
+               affect the LayoutTests.     
+
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::strokeBoundingBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::toSVGRenderBase):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::strokeBoundingBox):
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::setPath):
+        * rendering/RenderPath.h:
+        (WebCore::RenderPath::markerBoundingBox):
+        * rendering/RenderSVGBlock.h:
+        (WebCore::RenderSVGBlock::toSVGRenderBase):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::strokeBoundingBox):
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout):
+        (WebCore::RenderSVGImage::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::toSVGRenderBase):
+        (WebCore::RenderSVGImage::strokeBoundingBox):
+        * rendering/RenderSVGInline.h:
+        (WebCore::RenderSVGInline::objectBoundingBox):
+        (WebCore::RenderSVGInline::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGModelObject.h:
+        (WebCore::RenderSVGModelObject::toSVGRenderBase):
+        * rendering/RenderSVGRoot.h:
+        (WebCore::RenderSVGRoot::strokeBoundingBox):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::strokeBoundingBox):
+        (WebCore::RenderSVGText::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGText.h:
+        (WebCore::RenderSVGText::toSVGRenderBase):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::~SVGRenderBase):
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        (WebCore::SVGRenderBase::clipperBoundingBoxForRenderer):
+        (WebCore::SVGRenderBase::maskerBoundingBoxForRenderer):
+        * rendering/SVGRenderSupport.h:
+        (WebCore::SVGRenderBase::toSVGRenderBase):
+        (WebCore::SVGRenderBase::strokeBoundingBox):
+        (WebCore::SVGRenderBase::markerBoundingBox):
+        * rendering/SVGRootInlineBox.h:
+        (WebCore::SVGRootInlineBox::toSVGRenderBase):
+        (WebCore::SVGRootInlineBox::objectBoundingBox):
+        (WebCore::SVGRootInlineBox::repaintRectInLocalCoordinates):
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::filterBoundingBox):
+        * svg/SVGFilterElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::maskBoundingBox):
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGMaskElement.h:
+        * svg/graphics/SVGResourceClipper.cpp:
+        (WebCore::SVGResourceClipper::clipperBoundingBox):
+        * svg/graphics/SVGResourceClipper.h:
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::filterBoundingBox):
+        (WebCore::shouldProcessFilter):
+        (WebCore::SVGResourceFilter::prepareFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::maskerBoundingBox):
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/SVGResourceMasker.h:
+
+2009-12-29  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Adam Barth.
+
+        Add Android hook to NetworkStateNotifier class
+        so that the Java side can notify WebCore when the
+        network state changes.
+        https://bugs.webkit.org/show_bug.cgi?id=32871
+
+        No new tests required, this is platform code.
+
+        * platform/network/NetworkStateNotifier.h:
+        * platform/network/android/NetworkStateNotifierAndroid.cpp: Added.
+        (WebCore::NetworkStateNotifier::networkStateChange):
+
+2009-12-29  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52630.
+        http://trac.webkit.org/changeset/52630
+
+        Change caused layout tests failures and crashes.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::setPath):
+        (WebCore::RenderPath::path):
+        (WebCore::RenderPath::paint):
+        (WebCore::):
+        (WebCore::DrawMarkersData::DrawMarkersData):
+        (WebCore::drawMarkerWithData):
+        (WebCore::updateMarkerDataForElement):
+        (WebCore::drawStartAndMidMarkers):
+        (WebCore::RenderPath::drawMarkersIfNeeded):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::paint):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGMarkerLayoutInfo.cpp: Removed.
+        * rendering/SVGMarkerLayoutInfo.h: Removed.
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::SVGResource::SVGResource):
+        (WebCore::ResourceSet::ResourceSet):
+        (WebCore::clientMap):
+        (WebCore::SVGResource::~SVGResource):
+        (WebCore::SVGResource::removeClient):
+        (WebCore::SVGResource::addClient):
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::SVGResourceMarker):
+        (WebCore::SVGResourceMarker::setMarker):
+        (WebCore::SVGResourceMarker::setRef):
+        (WebCore::SVGResourceMarker::draw):
+        (WebCore::SVGResourceMarker::cachedBounds):
+        (WebCore::SVGResourceMarker::externalRepresentation):
+        * svg/graphics/SVGResourceMarker.h:
+        (WebCore::SVGResourceMarker::refX):
+        (WebCore::SVGResourceMarker::refY):
+
+2009-12-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Move the focus ring rect array, width and offset out of GraphicsContext
+        https://bugs.webkit.org/show_bug.cgi?id=33028
+
+        * platform/graphics/GraphicsContext.cpp: Removed initFocusRing(),
+        clearFocusRing(), focusRingBoundingRect(), addFocusRingRect(),
+        focusRingWidth(), focusRingOffset(), and focusRingRects().
+        * platform/graphics/GraphicsContext.h: Ditto. Added the focus ring rect
+        vector, width and offset as parameters to drawFocusRing().
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState): Cleaned up style.
+        (WebCore::GraphicsContextPrivate::GraphicsContextPrivate): Removed
+        m_focusRingRects, m_focusRingWidth and m_focusRingOffset.
+        * platform/graphics/IntRect.cpp:
+        (WebCore::unionRect): Added this helper function.
+        * platform/graphics/IntRect.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): 
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addFocusRingRects): Updated for new prototype.
+        Added empty rect checks that were previously done in
+        GraphicsContext::addFocusRingRect().
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::addFocusRingRects): Ditto.
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addFocusRingRects): Ditto.
+        (WebCore::RenderInline::paintOutline): Collect focus ring rects into a
+        vector and pass it to drawFocusRing(). Use unionRect() instead of
+        focusRingBoundingRect().
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::paintOutline): Ditto.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::addFocusRingRects): Changed to take a
+        Vector<IntRect> to which the rects are added.
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::addFocusRingRects): Updated for new prototype.
+        Added empty rect check that was previously done in
+        GraphicsContext::addFocusRingRect().
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::addFocusRingRects): Updated for new prototype.
+        Added empty rect check that was previously done in
+        GraphicsContext::addFocusRingRect().
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::addFocusRingRects): Updated for new prototype.
+        Added empty rect check that was previously done in
+        GraphicsContext::addFocusRingRect().
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::addFocusRingRects): Updated for new prototype.
+        Added empty rect check that was previously done in
+        GraphicsContext::addFocusRingRect().
+        * rendering/RenderTextControl.h:
+
+2009-12-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        1. Changes the order in which some functions are called to match
+        the pre-r52536 order. Namely, when a new Database object is
+        created, DatabaseTracker::addOpenDatabase() is called in the
+        constructor, before doing anything else related to that database
+        (like trying to get a file handle to the database
+        file). Chromium's implementation depends on this ordering.
+        2. Changes Database::performOpenAndVerify() to close the open
+        handle to the database file immediately if the database version
+        does not match the expected one. The current behavior is to add
+        the Database object to a DatabaseThread collection and let the
+        database thread close the handle when it's destroyed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33005
+
+        All LayoutTests/storage tests pass in clean WebKit and Chromium
+        clients.
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase): Notify DatabaseTracker and
+        Document that a Database object is about to be destroyed (when a
+        database file cannot be opened, or its version doesn't match the
+        expected one).
+        (WebCore::Database::Database): Notify DatabaseTracker and Document
+        that a new Database object was created.
+        (WebCore::Database::performOpenAndVerify): If a database version
+        does not match the expected one, immediately close the open file
+        handle to the database file.
+
+2009-12-29  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Marker code is buggy: referencePoint translation is off
+        https://bugs.webkit.org/show_bug.cgi?id=33012
+
+        Rewrite marker code, as it was buggy:
+        - Correct refX/refY handling (covered by new marker-referencePoint.svg test)
+        - Calculate marker bounds on layout time, instead of paint time, to deliver correct repaint rects
+        - Cleanup RenderPath code, which was cluttered by marker stuff (outlay in SVGMarkerLayoutInfo)
+        - Fix SVGResource assuming that there is only one resource per resource type per element. Markers
+          can have three different resources of the same type (three markers, start/mid/end markers)
+
+        Fixes all svg/custom/marker*.svg tests, that use dynamic updates (propagation failed before).
+        Test: svg/custom/marker-referencePoint.svg
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::setPath):
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::calculateMarkerBoundsIfNeeded):
+        * rendering/RenderPath.h:
+        (WebCore::RenderPath::path):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::markerContentTransformation):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGMarkerLayoutInfo.cpp: Added.
+        (WebCore::SVGMarkerLayoutInfo::SVGMarkerLayoutInfo):
+        (WebCore::SVGMarkerLayoutInfo::~SVGMarkerLayoutInfo):
+        (WebCore::SVGMarkerLayoutInfo::initialize):
+        (WebCore::updateMarkerDataForElement):
+        (WebCore::recordMarkerData):
+        (WebCore::processStartAndMidMarkers):
+        (WebCore::SVGMarkerLayoutInfo::calculateBoundaries):
+        (WebCore::SVGMarkerLayoutInfo::drawMarkers):
+        * rendering/SVGMarkerLayoutInfo.h: Added.
+        (WebCore::MarkerData::):
+        (WebCore::MarkerData::MarkerData):
+        (WebCore::MarkerLayout::MarkerLayout):
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::resourceSet):
+        (WebCore::SVGResource::SVGResource):
+        (WebCore::SVGResource::~SVGResource):
+        (WebCore::SVGResource::removeClient):
+        (WebCore::SVGResource::addClient):
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::SVGResourceMarker):
+        (WebCore::SVGResourceMarker::markerBoundaries):
+        (WebCore::SVGResourceMarker::markerTransformation):
+        (WebCore::SVGResourceMarker::draw):
+        (WebCore::SVGResourceMarker::externalRepresentation):
+        * svg/graphics/SVGResourceMarker.h:
+        (WebCore::SVGResourceMarker::setRenderer):
+        (WebCore::SVGResourceMarker::setReferencePoint):
+        (WebCore::SVGResourceMarker::referencePoint):
+
+2009-12-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix UI nits in the Audits panel.
+        https://bugs.webkit.org/show_bug.cgi?id=32932
+
+        * inspector/front-end/AuditLauncherView.js:
+        (WebInspector.AuditLauncherView.prototype._selectAllClicked):
+        (WebInspector.AuditLauncherView.prototype._createCategoryElement):
+        (WebInspector.AuditLauncherView.prototype._createLauncherUI.handleSelectAllClick):
+        (WebInspector.AuditLauncherView.prototype._createLauncherUI):
+        * inspector/front-end/AuditResultView.js:
+        (WebInspector.AuditResultView):
+        (WebInspector.AuditRuleResultPane):
+        * inspector/front-end/audits.css:
+
+2009-12-29  Johnny Ding  <jnd@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32863
+        Make NodeList support call-as-function
+
+        Test: fast/dom/NodeList/nodelist-item-call-as-function.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::V8NodeList::callAsFunctionCallback):
+
+2009-12-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Typed text in table not correctly redrawn on page with compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=32874
+        
+        Use the same test in RenderTableCell::computeRectForRepaint() that we use elsewhere
+        to decide when to use layoutState, which is to test for layoutStateEnabled()
+        and no repaint container.
+
+        Not possible to make a repaint test that exercises the problem, so no test.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::computeRectForRepaint):
+
+2009-12-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Discard port from cookie domain when matching cookies.
+
+        WebKit cookies do not hold the port information, so we should match only hostnames.
+        https://bugs.webkit.org/show_bug.cgi?id=31787
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+
+2009-12-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix warnings in MediaPlayerPrivatePhonon.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=33019
+
+        No new tests as there is no new functionality.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::totalTimeChanged):
+
+2009-12-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement HTML5 <aside> element.
+        https://bugs.webkit.org/show_bug.cgi?id=32943
+
+        <aside> should behave the same as <nav>, <section>, and <article>.
+
+        Test: fast/html/aside-element.html
+
+        * css/html.css: Add aside as a block element.
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag): Add asideTag.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority): Returns 5 for asideTag.
+        (WebCore::blockTagList): Add asideTag.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode): Add asideTag.
+        * html/HTMLTagNames.in: Add aside.
+
+2009-12-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=33003
+
+        No new tests as there is no new functionality.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::toRenderSVGContainer):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setTextShadow):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-12-28  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        On Android, ResourceHandle instances make use of a pointer to a
+        ResourceLoaderAndroid pointer. This needs to be stored in order to later cancel
+        the load, if necessary. Since this pointer is an internal implementation
+        details of ResourceHandle on Android, it needs to be stored in the
+        ResourceHandleInternal class. This patch adds this pointer.
+        https://bugs.webkit.org/show_bug.cgi?id=32873
+
+        No new tests needed, this is platform-specific code.
+
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+
+2009-12-28  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove the macro ENABLE(XHTMLMP) for noscriptAreateErrorCheck in HTMLParser,
+        since with XHTMLMP enabled, it's not checking create Errors,  and then contents inside 
+        <noscript> are always parsed and rendered.
+        https://bugs.webkit.org/show_bug.cgi?id=32706
+
+        Tests: fast/parser/noscript-with-javascript-disabled.html
+               fast/parser/noscript-with-javascript-enabled.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode):
+
+2009-12-28  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fixed isKeypadEvent behavior for Mac to correctly report keyLocation
+        as DOM_KEY_LOCATION_NUMPAD for numeric pad key events.
+        https://bugs.webkit.org/show_bug.cgi?id=28247
+
+        Test: fast/events/keydown-numpad-keys.html
+
+        * platform/mac/KeyEventMac.mm:
+        (WebCore::isKeypadEvent):
+
+2009-12-28  Mike Moretti  <webkit9@mordent.com>
+
+        Reviewed by Darin Adler.
+
+        Fix bug 28245 - problem with inserting a span into a long text block causing a crash because of a null string
+
+        Test: fast/dom/insert-span-into-long-text-bug-28245.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2009-12-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Follow Apple's decision to disable HTML DataGrid by default.
+
+        * GNUmakefile.am:
+
+2009-12-28  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix warnings when generating files using gperf. The warnings are
+        currently harmless, but some changes in the build system may make
+        them fatal.
+
+        [GTK] Build time must be reduced
+        https://bugs.webkit.org/show_bug.cgi?id=32921
+
+        * GNUmakefile.am:
+
+2009-12-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Fix build break for Qt 4.4
+        https://bugs.webkit.org/show_bug.cgi?id=30327
+
+        No new tests, as there is no new functionality.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clipOut): Use intersected() instead of
+        operator &, which was only introduced in Qt version 4.5.
+
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::paintScrollCorner): Pass ColorSpace
+        argument to fillColor() introduced in r50760
+
+2009-12-28  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement HTML5 <article> element.
+        https://bugs.webkit.org/show_bug.cgi?id=32936
+
+        <article> should behave the same as <nav> and <section>.
+
+        Test: fast/html/article-element.html
+
+        * css/html.css: Add article as a block element.
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag): Add articleTag.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority): Returns 5 for articleTag.
+        (WebCore::blockTagList): Add articleTag.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode): Add articleTag.
+        * html/HTMLTagNames.in: Add article.
+
+2009-12-27  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Support upload progress events in XMLHttpRequest
+        https://bugs.webkit.org/show_bug.cgi?id=32969
+
+        Make QNetworkReplyHandler report the upload progress to the client.
+
+        Already covered by tests:
+        http/tests/xmlhttprequest/upload-onload-event.html
+        http/tests/xmlhttprequest/upload-onloadstart-event.html
+        http/tests/xmlhttprequest/upload-progress-events.html
+        http/tests/xmlhttprequest/upload-onprogress-event.html
+
+        which have been unskipped.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::uploadProgress):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2009-12-27  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG: Stop rendering of objects with empty mask and filter content
+        https://bugs.webkit.org/show_bug.cgi?id=32968
+
+        It's not neccessary to continue rendering of an object and its' childs
+        if the mask clips the complete content away.
+        The same for filters, if the filter rendering is discontinued or either
+        width or height are zero.
+        We might also stop rendering if repaintRectInLocalCoordinates is empty.
+        But it needs to be fixed first.
+
+        Test: svg/custom/empty-mask.svg
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::paint):
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGMaskElement.h:
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::prepareFilter):
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::SVGResourceMasker):
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/SVGResourceMasker.h:
+
+2009-12-27  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] Spell Check Suggestions (Do not work)
+        https://bugs.webkit.org/show_bug.cgi?id=30908
+
+        * platform/gtk/ContextMenuItemGtk.cpp:
+        (WebCore::ContextMenuItem::ContextMenuItem):
+        (WebCore::ContextMenuItem::title):
+        (WebCore::ContextMenuItem::setTitle): Implement the 'title' member
+        and set the title from the native menu item.
+
+2009-12-27  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Mask result wrong, if two different objects call the same mask id
+        https://bugs.webkit.org/show_bug.cgi?id=32787
+
+        At the moment we create one resource per maskId. Some resources (like mask)
+        create ImageBuffers and depends on the properties of the RenderObject,
+        thus we can't use it for a second object.
+        This patch stores multiple mask resources for one maskId and different
+        RenderObject can use the same maskId.
+        Clipper, Filter and Patterns also need to store multiple resources later.
+
+        Test: svg/custom/mask-on-multiple-objects.svg
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::drawMarkersIfNeeded):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::selfWillPaint):
+        * rendering/RenderSVGGradientStop.cpp:
+        (WebCore::RenderSVGGradientStop::styleDidChange):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::selfWillPaint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeRenderResources):
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::canvasResource):
+        * svg/SVGClipPathElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::canvasResource):
+        * svg/SVGFilterElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::canvasResource):
+        * svg/SVGGradientElement.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::svgAttributeChanged):
+        (WebCore::SVGMaskElement::childrenChanged):
+        (WebCore::SVGMaskElement::canvasResource):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::canvasResource):
+        * svg/SVGPatternElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::invalidateResourcesInAncestorChain):
+        * svg/SVGStyledElement.h:
+        (WebCore::SVGStyledElement::canvasResource):
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::getPaintServerById):
+        (WebCore::SVGPaintServer::fillPaintServer):
+        (WebCore::SVGPaintServer::strokePaintServer):
+        * svg/graphics/SVGPaintServer.h:
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::getResourceById):
+        * svg/graphics/SVGResource.h:
+        * svg/graphics/SVGResourceClipper.cpp:
+        (WebCore::getClipperById):
+        * svg/graphics/SVGResourceClipper.h:
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::getFilterById):
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::getMarkerById):
+        * svg/graphics/SVGResourceMarker.h:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::getMaskerById):
+        * svg/graphics/SVGResourceMasker.h:
+
+2009-12-27  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Cleanup RenderPath code, related to markers. Pass around
+        PaintInfo objects instead of GraphicsContext directly, to
+        avoid having to recreate a new PaintInfo object in
+        SVGResourceMarker::draw().
+
+        No layout test changes.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        (WebCore::DrawMarkersData::DrawMarkersData):
+        (WebCore::drawMarkerWithData):
+        (WebCore::drawStartAndMidMarkers):
+        (WebCore::RenderPath::drawMarkersIfNeeded):
+        * rendering/RenderPath.h:
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::draw):
+        * svg/graphics/SVGResourceMarker.h:
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        WinCE buildfix (added missing header)
+
+        * platform/text/wince/TextBreakIteratorWince.cpp:
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        Buildfix after r50760 and some style fixes.
+
+        * rendering/RenderThemeWince.cpp:
+        (WebCore::RenderThemeWince::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWince::paintSliderTrack):
+        (WebCore::RenderThemeWince::paintSliderThumb):
+        (WebCore::RenderThemeWince::paintMediaMuteButton):
+        (WebCore::RenderThemeWince::paintMediaPlayButton):
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Barth.
+
+        WinCE buildfixes (missing headers and unsupported HWND_MESSAGE)
+
+        * platform/wince/MIMETypeRegistryWince.cpp:
+        * platform/wince/SearchPopupMenuWince.cpp:
+        * platform/wince/SharedTimerWince.cpp:
+        (WebCore::initializeOffScreenTimerWindow):
+
+2009-12-26  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52554.
+        http://trac.webkit.org/changeset/52554
+
+        https://bugs.webkit.org/show_bug.cgi?id=32955
+        The original change was covered under
+        https://bugs.webkit.org/show_bug.cgi?id=32913
+
+        r52554 was itself a rollout of r52536.
+        However it caused two layout tests to fail on Leopard:
+        storage/open-database-while-transaction-in-progress.html
+        svg/W3C-SVG-1.1/filters-conv-01-f.svg (no clue why?)
+
+        So I'm rolling out the rollout in an attempt to get the bots green.
+        r52554 did not explain why it was rolled out, so I do not know
+        what might fail for Chromium after this change.  I warned the folks
+        in #chromium that it was coming.
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+
+2009-12-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7483622> REGRESSION (r47255): Extra Large Amount of Empty Space
+        https://bugs.webkit.org/show_bug.cgi?id=32690
+
+        Test: fast/block/float/clear-to-fit.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::getClearDelta): Only clear floats as needed to
+        fit the child on the line.
+
+2009-12-25  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement HTML5 section element.
+        https://bugs.webkit.org/show_bug.cgi?id=32936
+
+        <section> should behave the same as <nav>.
+
+        Test: fast/html/section-element.html
+
+        * css/html.css: Add section as a block element.
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag): Add sectionTag.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority): Returns 5 for sectionTag.
+        (WebCore::blockTagList): Add sectionTag.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode): Add sectionTag.
+        * html/HTMLTagNames.in: Add section.
+
+2009-12-25  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32938
+
+        Cleans up XSSAuditor.
+
+        Currently, we pass various parameters through to XSSAuditor::findInRequest
+        that are used to determine how to decode the HTTP input parameters so that
+        we can perform a match against the script source. Instead, we have defined
+        a structure XSSAuditor::FindTask that can hold all of these parameters.
+
+        No functionality was changed. So, no new tests.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluate): Modified to use struct
+        XSSAuditor::FindTask.
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL): Ditto.
+        (WebCore::XSSAuditor::canCreateInlineEventListener): Ditto.
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc): Ditto.
+        (WebCore::XSSAuditor::canLoadObject): Ditto.
+        (WebCore::XSSAuditor::canSetBaseElementURL): Ditto.
+        (WebCore::XSSAuditor::findInRequest): Ditto.
+        * page/XSSAuditor.h:
+        (WebCore::XSSAuditor::FindTask::FindTask): Added.
+
+2009-12-25  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        DOMWindow is missing lots of SVG* constructor objects
+        https://bugs.webkit.org/show_bug.cgi?id=20430
+
+        Expose all implemented SVG 1.1 constructors.
+
+        Test: svg/custom/global-constructors.js
+
+        * bindings/v8/V8Index.cpp: Add missing includes for SVGFontFaceElement & SVGMissingGlyphElement
+        * bindings/v8/V8Index.h: Add misisng SVGFontFaceElement & SVGMissingGlyphElement declarations.
+        * page/DOMWindow.idl: Add a bunch of new SVG object ctors.
+        * svg/SVGAnimatedPathData.idl: Add OmitConstructor flag, as this is a SVG MI class, which is not exposable at the moment.
+        * svg/SVGAnimatedPoints.idl: Ditto.
+
+2009-12-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        AuditsPanel for Web Inspector (hidden, no preset audits).
+
+        https://bugs.webkit.org/show_bug.cgi?id=31665
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AuditLauncherView.js: Added.
+        (WebInspector.AuditLauncherView.categorySortFunction):
+        (WebInspector.AuditLauncherView):
+        (WebInspector.AuditLauncherView.prototype.updateResourceTrackingState):
+        (WebInspector.AuditLauncherView.prototype._setAuditRunning):
+        (WebInspector.AuditLauncherView.prototype._launchButtonClicked.profilingFinishedCallback):
+        (WebInspector.AuditLauncherView.prototype._launchButtonClicked):
+        (WebInspector.AuditLauncherView.prototype._selectAllClicked):
+        (WebInspector.AuditLauncherView.prototype._categoryClicked):
+        (WebInspector.AuditLauncherView.prototype._createCategoryElement):
+        (WebInspector.AuditLauncherView.prototype._createLauncherUI):
+        (WebInspector.AuditLauncherView.prototype._updateButton):
+        (WebInspector.AuditLauncherView.prototype.resize):
+        * inspector/front-end/AuditResultView.js: Added.
+        (WebInspector.AuditResultView.entrySortFunction):
+        (WebInspector.AuditResultView):
+        (WebInspector.AuditCategoryResultPane):
+        (WebInspector.AuditRuleResultPane):
+        (WebInspector.AuditRuleResultPane.prototype._decorateRuleResult):
+        (WebInspector.AuditRuleResultChildSection):
+        (WebInspector.AuditRuleResultChildSection.prototype.set title):
+        (WebInspector.AuditRuleResultChildSection.prototype.expand):
+        * inspector/front-end/AuditsPanel.js: Added.
+        (WebInspector.AuditsPanel):
+        (WebInspector.AuditsPanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.AuditsPanel.prototype.get statusBarItems):
+        (WebInspector.AuditsPanel.prototype.get mainResourceLoadTime):
+        (WebInspector.AuditsPanel.prototype.set mainResourceLoadTime):
+        (WebInspector.AuditsPanel.prototype.get mainResourceDOMContentTime):
+        (WebInspector.AuditsPanel.prototype.set mainResourceDOMContentTime):
+        (WebInspector.AuditsPanel.prototype.get categoriesById):
+        (WebInspector.AuditsPanel.prototype.get visibleView):
+        (WebInspector.AuditsPanel.prototype._constructCategories):
+        (WebInspector.AuditsPanel.prototype._executeAudit.ruleResultReadyCallback):
+        (WebInspector.AuditsPanel.prototype._executeAudit):
+        (WebInspector.AuditsPanel.prototype._auditFinishedCallback):
+        (WebInspector.AuditsPanel.prototype.initiateAudit.initiateAuditCallback):
+        (WebInspector.AuditsPanel.prototype.initiateAudit):
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        (WebInspector.AuditsPanel.prototype._didMainResourceLoad):
+        (WebInspector.AuditsPanel.prototype.showResults):
+        (WebInspector.AuditsPanel.prototype.showLauncherView):
+        (WebInspector.AuditsPanel.prototype.showView):
+        (WebInspector.AuditsPanel.prototype.show):
+        (WebInspector.AuditsPanel.prototype.attach):
+        (WebInspector.AuditsPanel.prototype.resize):
+        (WebInspector.AuditsPanel.prototype.updateMainViewWidth):
+        (WebInspector.AuditsPanel.prototype._updateLauncherViewControls):
+        (WebInspector.AuditsPanel.prototype._clearButtonClicked):
+        (WebInspector.AuditsPanel.prototype._closeVisibleView):
+        (WebInspector.AuditCategory):
+        (WebInspector.AuditCategory.prototype.get id):
+        (WebInspector.AuditCategory.prototype.get displayName):
+        (WebInspector.AuditCategory.prototype.get ruleCount):
+        (WebInspector.AuditCategory.prototype.addRule):
+        (WebInspector.AuditCategory.prototype.runRules):
+        (WebInspector.AuditRule):
+        (WebInspector.AuditRule.prototype.get id):
+        (WebInspector.AuditRule.prototype.get displayName):
+        (WebInspector.AuditRule.prototype.run):
+        (WebInspector.AuditRule.prototype.doRun):
+        (WebInspector.AuditRule.prototype.getValue):
+        (WebInspector.AuditCategoryResult):
+        (WebInspector.AuditCategoryResult.prototype.addEntry):
+        (WebInspector.AuditRuleResult):
+        (WebInspector.AuditRuleResult.prototype.appendChild):
+        (WebInspector.AuditRuleResult.prototype.set type):
+        (WebInspector.AuditRuleResult.prototype.get type):
+        (WebInspector.AuditsSidebarTreeElement):
+        (WebInspector.AuditsSidebarTreeElement.prototype.onattach):
+        (WebInspector.AuditsSidebarTreeElement.prototype.onselect):
+        (WebInspector.AuditsSidebarTreeElement.prototype.get selectable):
+        (WebInspector.AuditsSidebarTreeElement.prototype.refresh):
+        (WebInspector.AuditResultSidebarTreeElement):
+        (WebInspector.AuditResultSidebarTreeElement.prototype.onselect):
+        (WebInspector.AuditResultSidebarTreeElement.prototype.get selectable):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/audits.css: Added.
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.updateResource):
+
+2009-12-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement Edit Inner HTML action.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32924
+
+        * English.lproj/localizedStrings.js:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::pushNodePathToFrontendCallback):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::pushNodePathToFrontend):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.show):
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodesSoon):
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        (WebInspector.ElementsTreeElement.prototype._startEditingAsHTML.commit):
+        (WebInspector.ElementsTreeElement.prototype._startEditingAsHTML.dispose):
+        (WebInspector.ElementsTreeElement.prototype._startEditingAsHTML):
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getNodePropertyValue):
+        (InjectedScript.setOuterHTML):
+        (InjectedScript.performSearch.addNodesToResults):
+        (InjectedScript._inspectObject):
+        (InjectedScript._copy):
+        (InjectedScript.pushNodeToFrontend):
+        * inspector/front-end/InjectedScriptAccess.js:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorFrontendHostStub.prototype.windowUnloading):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.keyDownEventListener):
+        (WebInspector.startEditing):
+
+2009-12-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Console should force long URLs to wrap
+        https://bugs.webkit.org/show_bug.cgi?id=32927
+
+        * inspector/front-end/inspector.css: Added "word-wrap: break-word;" to
+        the #console-messages rule.
+
+2009-12-24  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed Chromium test fix by reverting r52536.
+
+        Do not a new Database pointer to any structure until its version has been verified
+        https://bugs.webkit.org/show_bug.cgi?id=32913
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+
+2009-12-24  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for WebKit bug 29968 - Selecting text with text-overflow ellipsis
+        should not show cut off text
+        https://bugs.webkit.org/show_bug.cgi?id=29968
+
+        Also fixes the issue on both Mac OS X and Windows where the highlight
+        would extend only partway into the ellipsis based on the size of the
+        characters being truncated.
+
+        Test: editing/selection/select-text-overflow-ellipsis.html
+
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        When the ellipsis have been selected, paints them with the color for
+        selected text.
+        (WebCore::EllipsisBox::selectionRect):
+        Returns the selection rect for the ellipsis text.
+        (WebCore::EllipsisBox::paintSelection):
+        Paints the selection highlight around the ellipsis text.
+
+        * rendering/EllipsisBox.h:
+        (WebCore::EllipsisBox::EllipsisBox):
+        Default the selection state of the EllipsisBox to SelectionNone.
+        (WebCore::EllipsisBox::setSelectionState):
+        Allow the selection state to be explicitly set by the InlineTextBox
+        that it is associated with, since the selection state depends on the
+        position of the selection within the truncated text.
+        (WebCore::EllipsisBox::selectionState):
+        Return the cached selection state.
+        
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::selectionState):
+        If the text is truncated and the selection extends into the truncation
+        where there are ellipsis, set the selection state on the EllipsisBox.
+        (WebCore::paintTextWithShadows):
+        Allow for an upper bound to be specified on the maximum length of the
+        text to be painted.
+        (WebCore::InlineTextBox::paint):
+        Make sure the text that is drawn gets appropriately truncated. This was
+        not an issue before on Mac OS X because it wasn't necessary to draw the
+        selected text separately (the selected text had the same color as the
+        non-selected text).
+        (WebCore::InlineTextBox::paintSelection):
+        If the text is being truncated, let whatever is being painted in the
+        space after the truncated text paint its own highlight. 
+        
+        * rendering/InlineTextBox.h:
+        (WebCore::InlineTextBox::truncation):
+        Allow RenderText to access the truncation status.
+        
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::selectionRectForRepaint):
+        Make sure that any ellipsis box that falls within the selection also
+        gets repainted.
+
+2009-12-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add Settings.js class that would manage
+        frontend settings.
+
+        This change:
+        - Splits preferences and settings
+        - Pushes settings to the frontend on load
+        - Stores settings on each change
+        - Stores showInheritedStyles as setting.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32832
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::saveFrontendSettings):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::populateFrontendSettings):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorFrontendHost.cpp:
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype._settingsLoaded):
+        (WebInspector.EventListenersSidebarPane.prototype):
+        ():
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub):
+        (.WebInspector.InspectorBackendStub.prototype.saveFrontendSettings):
+        (.WebInspector.InspectorBackendStub.prototype.releaseWrapperObjectGroup):
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub):
+        (.WebInspector.InspectorFrontendHostStub.prototype.hiddenPanels):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._createStatusbarButtons):
+        (WebInspector.ResourcesPanel.prototype._settingsLoaded):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        (WebInspector.ResourcesPanel.prototype._setLargerResources):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        * inspector/front-end/Settings.js: Added.
+        (WebInspector.populateFrontendSettings):
+        (WebInspector.Settings):
+        (WebInspector.Settings.prototype._load):
+        (WebInspector.Settings.prototype._installSetting):
+        (WebInspector.Settings.prototype._get):
+        (WebInspector.Settings.prototype._set):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._settingsLoaded):
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylesSidebarPane.prototype._changeSetting):
+        (WebInspector.StylesSidebarPane.prototype._changeColorFormat):
+        (WebInspector.StylePropertiesSection.showInheritedToggleFunction):
+        (WebInspector.StylePropertiesSection):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSidebarPane.prototype._settingsLoaded):
+        (WebInspector.WatchExpressionsSidebarPane.prototype.refreshExpressions):
+        (WebInspector.WatchExpressionsSection):
+        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-12-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] console's clear command does not work.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32897
+
+        Test: inspector/console-clear.html
+
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::clearConsoleMessages):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype.requestClearConsoleMessages):
+        (WebInspector.ConsoleView.prototype.clearConsoleMessages):
+        (WebInspector.ConsoleView.prototype._clearButtonClicked):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.clearConsoleMessages):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        * inspector/front-end/InjectedScriptAccess.js:
+        * inspector/front-end/inspector.js:
+        (WebInspector.clearConsoleMessages):
+        (WebInspector.reset):
+
+2009-12-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Console dumps strings in escaped form.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32488
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._formatIndividualValue):
+
+2009-12-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32905
+        With Pinyin Simplified IM, a wrong character is deleted from google.com suggestion
+
+        Test: platform/mac/editing/input/selection-change-closes-typing.html
+
+        * editing/Editor.cpp: (WebCore::Editor::confirmComposition): If this function wasn't allowed
+        to change selection, it needs to close the current typing command - otherwise, its idea of
+        selection would be used for future typing.
+
+2009-12-23  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        PlatformContextSkia::beginLayerClippedToImage() needs to clip outside of the image.
+        
+        This method should limit the current painting window to the bounds of the given
+        image, but it did not. Due to this bug, unnecessary contents were rendered in
+        some (limited) situations.
+
+        [Skia] PlatformContextSkia::beginLayerClippedToImage does not clip outside of the image
+        https://bugs.webkit.org/show_bug.cgi?id=32817
+        
+        No new tests, because this is a fix of an existing test which is currently failing in
+        Chromium.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::beginLayerClippedToImage): Add clipRect() call.
+
+2009-12-23  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Eric Seidel.
+
+        Remove all references to "GenerateConstructor", as this is the default behaviour now.
+
+        * css/CSSCharsetRule.idl:
+        * css/CSSFontFaceRule.idl:
+        * css/CSSImportRule.idl:
+        * css/CSSMediaRule.idl:
+        * css/CSSPageRule.idl:
+        * css/CSSPrimitiveValue.idl:
+        * css/CSSRule.idl:
+        * css/CSSRuleList.idl:
+        * css/CSSStyleDeclaration.idl:
+        * css/CSSStyleRule.idl:
+        * css/CSSStyleSheet.idl:
+        * css/CSSValue.idl:
+        * css/CSSValueList.idl:
+        * css/CSSVariablesDeclaration.idl:
+        * css/CSSVariablesRule.idl:
+        * css/Counter.idl:
+        * css/Media.idl:
+        * css/MediaList.idl:
+        * css/RGBColor.idl:
+        * css/Rect.idl:
+        * css/StyleSheet.idl:
+        * css/StyleSheetList.idl:
+        * css/WebKitCSSKeyframeRule.idl:
+        * css/WebKitCSSKeyframesRule.idl:
+        * css/WebKitCSSTransformValue.idl:
+        * dom/Attr.idl:
+        * dom/BeforeLoadEvent.idl:
+        * dom/CDATASection.idl:
+        * dom/CharacterData.idl:
+        * dom/ClientRect.idl:
+        * dom/ClientRectList.idl:
+        * dom/Clipboard.idl:
+        * dom/Comment.idl:
+        * dom/CompositionEvent.idl:
+        * dom/DOMCoreException.idl:
+        * dom/DOMImplementation.idl:
+        * dom/Document.idl:
+        * dom/DocumentFragment.idl:
+        * dom/DocumentType.idl:
+        * dom/Element.idl:
+        * dom/Entity.idl:
+        * dom/EntityReference.idl:
+        * dom/ErrorEvent.idl:
+        * dom/Event.idl:
+        * dom/EventException.idl:
+        * dom/KeyboardEvent.idl:
+        * dom/MessageEvent.idl:
+        * dom/MessagePort.idl:
+        * dom/MouseEvent.idl:
+        * dom/MutationEvent.idl:
+        * dom/NamedNodeMap.idl:
+        * dom/Node.idl:
+        * dom/NodeFilter.idl:
+        * dom/NodeIterator.idl:
+        * dom/NodeList.idl:
+        * dom/Notation.idl:
+        * dom/OverflowEvent.idl:
+        * dom/PageTransitionEvent.idl:
+        * dom/PopStateEvent.idl:
+        * dom/ProcessingInstruction.idl:
+        * dom/ProgressEvent.idl:
+        * dom/Range.idl:
+        * dom/RangeException.idl:
+        * dom/Text.idl:
+        * dom/TextEvent.idl:
+        * dom/Touch.idl:
+        * dom/TouchEvent.idl:
+        * dom/TouchList.idl:
+        * dom/TreeWalker.idl:
+        * dom/UIEvent.idl:
+        * dom/WebKitAnimationEvent.idl:
+        * dom/WebKitTransitionEvent.idl:
+        * dom/WheelEvent.idl:
+        * html/DataGridColumn.idl:
+        * html/DataGridColumnList.idl:
+        * html/File.idl:
+        * html/FileList.idl:
+        * html/HTMLAllCollection.idl:
+        * html/HTMLAnchorElement.idl:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLAreaElement.idl:
+        * html/HTMLAudioElement.idl:
+        * html/HTMLBRElement.idl:
+        * html/HTMLBaseElement.idl:
+        * html/HTMLBaseFontElement.idl:
+        * html/HTMLBlockquoteElement.idl:
+        * html/HTMLBodyElement.idl:
+        * html/HTMLButtonElement.idl:
+        * html/HTMLCanvasElement.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLDListElement.idl:
+        * html/HTMLDataGridCellElement.idl:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.idl:
+        * html/HTMLDataListElement.idl:
+        * html/HTMLDirectoryElement.idl:
+        * html/HTMLDivElement.idl:
+        * html/HTMLDocument.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFieldSetElement.idl:
+        * html/HTMLFontElement.idl:
+        * html/HTMLFormElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLFrameSetElement.idl:
+        * html/HTMLHRElement.idl:
+        * html/HTMLHeadElement.idl:
+        * html/HTMLHeadingElement.idl:
+        * html/HTMLHtmlElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLImageElement.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLIsIndexElement.idl:
+        * html/HTMLLIElement.idl:
+        * html/HTMLLabelElement.idl:
+        * html/HTMLLegendElement.idl:
+        * html/HTMLLinkElement.idl:
+        * html/HTMLMapElement.idl:
+        * html/HTMLMarqueeElement.idl:
+        * html/HTMLMediaElement.idl:
+        * html/HTMLMenuElement.idl:
+        * html/HTMLMetaElement.idl:
+        * html/HTMLModElement.idl:
+        * html/HTMLOListElement.idl:
+        * html/HTMLObjectElement.idl:
+        * html/HTMLOptGroupElement.idl:
+        * html/HTMLOptionElement.idl:
+        * html/HTMLParagraphElement.idl:
+        * html/HTMLParamElement.idl:
+        * html/HTMLPreElement.idl:
+        * html/HTMLQuoteElement.idl:
+        * html/HTMLScriptElement.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLSourceElement.idl:
+        * html/HTMLStyleElement.idl:
+        * html/HTMLTableCaptionElement.idl:
+        * html/HTMLTableCellElement.idl:
+        * html/HTMLTableColElement.idl:
+        * html/HTMLTableElement.idl:
+        * html/HTMLTableRowElement.idl:
+        * html/HTMLTableSectionElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        * html/HTMLTitleElement.idl:
+        * html/HTMLUListElement.idl:
+        * html/HTMLVideoElement.idl:
+        * html/ImageData.idl:
+        * html/MediaError.idl:
+        * html/TextMetrics.idl:
+        * html/canvas/CanvasNumberArray.idl:
+        * html/canvas/CanvasRenderingContext.idl:
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * html/canvas/WebGLRenderingContext.idl:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorFrontendHost.idl:
+        * page/PositionError.idl:
+        * plugins/MimeType.idl:
+        * plugins/MimeTypeArray.idl:
+        * plugins/Plugin.idl:
+        * plugins/PluginArray.idl:
+        * storage/Storage.idl:
+        * storage/StorageEvent.idl:
+        * svg/SVGAngle.idl:
+        * svg/SVGColor.idl:
+        * svg/SVGComponentTransferFunctionElement.idl:
+        * svg/SVGException.idl:
+        * svg/SVGFEBlendElement.idl:
+        * svg/SVGFEColorMatrixElement.idl:
+        * svg/SVGFECompositeElement.idl:
+        * svg/SVGFEDisplacementMapElement.idl:
+        * svg/SVGFEFloodElement.idl:
+        * svg/SVGFEMorphologyElement.idl:
+        * svg/SVGFETurbulenceElement.idl:
+        * svg/SVGGradientElement.idl:
+        * svg/SVGLength.idl:
+        * svg/SVGMarkerElement.idl:
+        * svg/SVGPaint.idl:
+        * svg/SVGPathSeg.idl:
+        * svg/SVGPreserveAspectRatio.idl:
+        * svg/SVGRenderingIntent.idl:
+        * svg/SVGTextContentElement.idl:
+        * svg/SVGTextPathElement.idl:
+        * svg/SVGTransform.idl:
+        * svg/SVGUnitTypes.idl:
+        * svg/SVGZoomAndPan.idl:
+        * workers/AbstractWorker.idl:
+        * workers/WorkerLocation.idl:
+        * xml/DOMParser.idl:
+        * xml/XMLHttpRequestException.idl:
+        * xml/XMLHttpRequestProgressEvent.idl:
+        * xml/XMLHttpRequestUpload.idl:
+        * xml/XMLSerializer.idl:
+        * xml/XPathEvaluator.idl:
+        * xml/XPathException.idl:
+        * xml/XPathExpression.idl:
+        * xml/XPathResult.idl:
+
+2009-12-23  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        A new database should be registered with the Document,
+        DatabaseTracker and DatabaseThread only after it was successfully
+        opened and its version was successfully verified.
+
+        Fixes a regression introduced by
+        http://trac.webkit.org/changeset/52530.
+
+        LayoutTests/storage/open-database-while-transaction-in-progress.html
+        should pass again (or rather, it should pass again when run after
+        open-database-set-empty-version.html).
+
+        https://bugs.webkit.org/show_bug.cgi?id=32913
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+
+2009-12-23  David Levin  <levin@chromium.org>
+
+        REGRESSION (r52494): Assertion failure in Frame::caretBlinkTimerFired() (selection()->isCaret())
+        https://bugs.webkit.org/show_bug.cgi?id=32903
+
+        No review but ok'ed by Darin Adler. Rolling out r52494 due to above regression.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        (WebCore::SelectionController::setSelection):
+        * editing/SelectionController.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::setCaretVisible):
+        (WebCore::Frame::selectionLayoutChanged):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::needsLayout):
+
+2009-12-23  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Reverse JS GenerateConstructor logic
+        https://bugs.webkit.org/show_bug.cgi?id=32910
+
+        Make 'GenerateConstructor' the default setting for all classes, defined in IDL files. The flag is now obsolete and
+        can be removed from all IDL files in a follow-up patch. Add new 'OmitConstructor' flag, that allows to restore the
+        old default behaviour: do not generate JSFoobarConstructor class.
+
+        No change in functionality, despite the fact that we're generating a lot more constructors now, as they have to
+        be exposed through DOMWindow.idl -- this can be done per affected class in follow-up patches. Especially the SVG
+        classes have to be exposed, most of them are missing JS constructors so far.
+
+        As side effect HTMLOptionsCollection is now correctly exposing its constructor, thus fixing a test in fast/dom/wrapper-classes.html
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * css/CSSUnknownRule.idl:
+        * css/WebKitCSSMatrix.idl:
+        * dom/EventListener.idl:
+        * dom/EventTarget.idl:
+        * dom/MessageChannel.idl:
+        * html/TimeRanges.idl:
+        * html/ValidityState.idl:
+        * html/VoidCallback.idl:
+        * html/canvas/CanvasGradient.idl:
+        * html/canvas/CanvasPattern.idl:
+        * html/canvas/CanvasPixelArray.idl:
+        * html/canvas/WebGLActiveInfo.idl:
+        * html/canvas/WebGLArray.idl:
+        * html/canvas/WebGLArrayBuffer.idl:
+        * html/canvas/WebGLBuffer.idl:
+        * html/canvas/WebGLByteArray.idl:
+        * html/canvas/WebGLFloatArray.idl:
+        * html/canvas/WebGLFramebuffer.idl:
+        * html/canvas/WebGLIntArray.idl:
+        * html/canvas/WebGLProgram.idl:
+        * html/canvas/WebGLRenderbuffer.idl:
+        * html/canvas/WebGLShader.idl:
+        * html/canvas/WebGLShortArray.idl:
+        * html/canvas/WebGLTexture.idl:
+        * html/canvas/WebGLUniformLocation.idl:
+        * html/canvas/WebGLUnsignedByteArray.idl:
+        * html/canvas/WebGLUnsignedIntArray.idl:
+        * html/canvas/WebGLUnsignedShortArray.idl:
+        * inspector/JavaScriptCallFrame.idl:
+        * loader/appcache/DOMApplicationCache.idl:
+        * notifications/Notification.idl:
+        * notifications/NotificationCenter.idl:
+        * page/AbstractView.idl:
+        * page/BarInfo.idl:
+        * page/Console.idl:
+        * page/Coordinates.idl:
+        * page/DOMSelection.idl:
+        * page/DOMWindow.idl:
+        * page/EventSource.idl:
+        * page/Geolocation.idl:
+        * page/Geoposition.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * page/Navigator.idl:
+        * page/Screen.idl:
+        * page/WebKitPoint.idl:
+        * page/WorkerNavigator.idl:
+        * storage/Database.idl:
+        * storage/SQLError.idl:
+        * storage/SQLResultSet.idl:
+        * storage/SQLResultSetRowList.idl:
+        * storage/SQLTransaction.idl:
+        * websockets/WebSocket.idl:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/SharedWorker.idl:
+        * workers/SharedWorkerContext.idl:
+        * workers/Worker.idl:
+        * workers/WorkerContext.idl:
+        * xml/XMLHttpRequest.idl:
+        * xml/XPathNSResolver.idl:
+        * xml/XSLTProcessor.idl:
+
+2009-12-23  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        "Refused to execute a JavaScript script" error when embedding SWF with
+        a URL that is also a query parameter
+        https://bugs.webkit.org/show_bug.cgi?id=32908
+
+        Don't block direct injections into the object src attribute unless
+        there's an illegal character (like < or ") in the URL.  This change
+        lets some very unusual vulnerabilities through the filter but removes a
+        false positive that we've seen several times.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadObject):
+
+2009-12-23  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Remove pointers to a database that failed to open from the
+        DatabaseTracker and Document.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32885
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+
+2009-12-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7487164> First line of text cannot be selected
+        https://bugs.webkit.org/show_bug.cgi?id=32749
+
+        Test: fast/text/remove-zero-length-run.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionLineBox): Changed code that assumed that if a box was being
+            removed, it was the only box in the RenderText. Instead, correctly preserve the list of
+            text boxes.
+        (WebCore::RenderText::checkConsistency): Updated for earlier rename.
+
+2009-12-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for newlines turning into missing-gyphs when using SVG fonts
+
+        https://bugs.webkit.org/show_bug.cgi?id=32710
+
+        Font::drawText() has three code paths:
+
+          - drawTextUsingSVGFont()
+          - drawSimpleText()
+          - drawComplexText()
+
+        The latter two both have logic to replace newlines and tabs, as well
+        as a few other control characters that are considered spaces, with
+        spaces, before actually drawing the text. Previously the SVG font
+        path did not have this kind of logic.
+
+        This change introduces two helper functions in Font to do this space
+        replacement, which are then used for the simple path, the SVG path,
+        and the Qt implementation of the complex path.
+
+        Test: svg/custom/svg-fonts-in-html-linebreaks.html
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::normalizeSpaces): Helper function
+        * platform/graphics/Font.h:
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter): Use helper
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::fromRawDataWithoutRef): Rename from "qstring"
+        (WebCore::Font::drawComplexText): Use helper
+        (WebCore::Font::floatWidthForComplexText): Use helper
+        (WebCore::Font::offsetForPositionForComplexText): Use helper
+        (WebCore::Font::selectionRectForComplexText): Use helper
+        * platform/text/CharacterNames.h: Add enum for 0x0020
+        * svg/SVGFont.cpp: Use helper to fix bug
+        (WebCore::SVGTextRunWalker::walk):
+
+2009-12-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate getter support.
+        https://bugs.webkit.org/show_bug.cgi?id=32876
+
+        To implement the valueAsDate getter,
+        - Add a method to calculate milliseconds from 1970-01-01 to ISODateTime.
+        - Introduce m_type field to ISODateTime.
+
+        Tests: fast/forms/input-valueasdate-date.html
+               fast/forms/input-valueasdate-datetime.html
+               fast/forms/input-valueasdate-datetimelocal.html
+               fast/forms/input-valueasdate-month.html
+               fast/forms/input-valueasdate-time.html
+               fast/forms/input-valueasdate-week.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsDate):
+          Implement it with ISODateTime::millisecondsSinceEpoch().
+        (WebCore::HTMLInputElement::formStringToISODateTime):
+          Early exit for a null String. This avoids assertion failures in ISODateTime::parse*().
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::parseMonth): Sets m_type.
+        (WebCore::ISODateTime::parseDate): ditto.
+        (WebCore::ISODateTime::parseWeek): ditto.
+        (WebCore::ISODateTime::parseTime): ditto.
+        (WebCore::ISODateTime::parseDateTimeLocal): ditto.
+        (WebCore::ISODateTime::parseDateTime): ditto.
+        (WebCore::ISODateTime::millisecondsSinceEpochForTime): Added.
+        (WebCore::ISODateTime::millisecondsSinceEpoch): Added.
+        * html/ISODateTime.h:
+        (WebCore::ISODateTime::ISODateTime):
+        (WebCore::ISODateTime::invalidMilliseconds):
+
+2009-12-22  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32799
+
+        Renames enums in RenderStyleConstants::EListStyleType to conform to
+        the WebKit Code Style Guidelines.
+
+        No functionality was changed. So, no new tests.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EListStyleType):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::styleDidChange):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::listMarkerText):
+        (WebCore::RenderListMarker::paint):
+        (WebCore::RenderListMarker::calcPrefWidths):
+        (WebCore::RenderListMarker::updateMargins):
+        (WebCore::RenderListMarker::getRelativeMarkerRect):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::initialListStyleType):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-12-22  James Su  <suzhe@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Keyboard shortcut in dropdown not working.
+        https://bugs.webkit.org/show_bug.cgi?id=32008
+
+        Consider PlatformKeyboardEvent::Char type event as character type
+        event on all platforms. It fixes the "type ahead find" feature
+        of the popup listbox on Linux and Mac platforms.
+
+        Merge the case-sensitive type ahead find fix from
+        WebCore/dom/SelectElement.cpp. See
+        https://bugs.webkit.org/show_bug.cgi?id=29103
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::isCharacterTypeEvent):
+
+2009-12-22  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] The "Search" input type is not rendered correctly when styled.
+        https://bugs.webkit.org/show_bug.cgi?id=32417
+
+        There are no new tests because only pixel tests may be affected by
+        this change and those changes can only be done on the build bot.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintSearchField):
+        Since currently we paint the Search control as a QLineEdit, I have
+        deferred painting to WebCore, as in the case of the text input so 
+        that the painting is consistent.
+
+2009-12-22  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32121
+        [Qt] implement ImageDecoderQt::clearFrameBufferCache().
+       
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::initializeDecoder):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-12-22  Nayan Kumar K  <nayankk@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix assert failure with WML pages having 'Refresh' task in
+        'onenterforward' event.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30989
+
+        Writing Layout test is not possible. Please refer to the discussion
+        in bug id #30989. A sample test case is attached in BugZilla.
+
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        ASSERTION FAILED: m_numNodeListCaches
+        https://bugs.webkit.org/show_bug.cgi?id=19526
+        <rdar://problem/7431572>
+
+        Test: fast/dom/NodeList/adoptNode-node-list-cache.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::setDocument): Call removeNodeListCache on the old
+        document and addNodeListCache on the new one if moving a node that
+        has node lists.
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        First cut at fixing Windows build.
+
+        * WebCorePrefix.cpp: Touch it.
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Turn off datagrid by default, at least for all platforms Apple ships.
+        The datagrid implementation isn't ready for general web use yet.
+
+        * Configurations/FeatureDefines.xcconfig: Turn off datagrid by default.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Ditto.
+        * WebCore.vcproj/build-generated-files.sh: Ditto.
+        * page/DOMWindow.idl: Sorted things here to touch the file to give
+        the Windows build a slightly better chance of success.
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Dan Bernstein.
+
+        * page/FrameView.h: Removed incorrect comment.
+
+2009-12-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: simplify highlighter definition.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32869
+
+        * inspector/front-end/CSSSourceSyntaxHighlighter.js:
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        * inspector/front-end/JavaScriptSourceSyntaxHighlighter.js:
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.):
+        (WebInspector.JavaScriptSourceSyntaxHighlighter):
+        * inspector/front-end/SourceSyntaxHighlighter.js:
+        (WebInspector.SourceSyntaxHighlighter.prototype.lex):
+        * inspector/front-end/utilities.js:
+        ():
+
+2009-12-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Reentrancy problem with selection in some edge cases.
+        https://bugs.webkit.org/show_bug.cgi?id=32842
+        rdar://problem/7449974
+
+        Test: fast/forms/selection-layout-reentry-strange-case.html
+
+        Move the selection display update process done in the
+        selectionLayoutChanged function into the layout timer
+        instead of doing it immediately when selection changes occur.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        Initialize m_needsDisplayUpdate to false.
+        (WebCore::SelectionController::setSelection): Call
+        the new setNeedsDisplayUpdate function instead of the old
+        badly named Frame::selectionLayoutChanged function.
+        (WebCore::SelectionController::setNeedsDisplayUpdate):
+        Set m_needsDisplayUpdate. If it is just becoming true, then
+        call FrameView::scheduleRelayout.
+
+        * editing/SelectionController.h: Added setNeedsDisplayUpdate,
+        needsDisplayUpdate, and m_needsDisplayUpdate.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setCaretVisible): Call setNeedsDisplayUpdate.
+        (WebCore::Frame::selectionLayoutChanged): Call
+        setNeedsDisplayUpdate to set it to false, since this is the
+        function that performs "selection display update". Later I want
+        to rename this function.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::needsLayout): Add a new clause, since
+        we need a call to layout if needsDisplayUpdate is true.
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Allocate RemoteFontStream on the heap
+        https://bugs.webkit.org/show_bug.cgi?id=32850
+
+        RemoteFontStream is allocated on the stack, so its memory is freed
+        immediately when FontCustomPlatformData::createFontCustomPlatformData
+        returns. 
+
+        SkTypeface::CreateFromStream increments the reference count, but it keeps
+        the pointer to the memory allocated on the stack which is not valid
+        anymore.
+
+        RemoteFontStream is a descendant of SkRefCount and SkRefCount::unref
+        invokes SkDELETE(this) internally once the reference count reaches zero.
+        This means that SkRefCount-ed instances must be allocated on the heap.
+
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::createFontCustomPlatformData):
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        when condition COMPILER(RVCT) is fulfilled, we are trying to free a pointer to array allocated on the stack
+        https://bugs.webkit.org/show_bug.cgi?id=32861
+
+        Don't free the pointer for COMPILER(RVCT).
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::error):
+
+2009-12-22  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Remove no longer necessary experimental single view #ifdefs from Widget and
+        ScrollView.
+
+        * page/Chrome.h:
+        * page/mac/ChromeMac.mm:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/Widget.cpp:
+        * platform/Widget.h:
+        * platform/mac/ScrollViewMac.mm:
+        * platform/mac/WidgetMac.mm:
+
+2009-12-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not lose original request for non-main resource redirects.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32678
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::appendRedirect):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+
+2009-12-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Use ASSERT instead of assert in image-decoders
+        https://bugs.webkit.org/show_bug.cgi?id=32852
+
+        Other decoders use WTF's ASSERT macro.
+        Follow this convention.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+
+2009-12-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Use vsnprintf instead of vasprintf for RVCT.
+        https://bugs.webkit.org/show_bug.cgi?id=32851
+
+        RVCT does not support vasprint, so use vsnprintf instead.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::error):
+
+2009-12-21  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Invalid url should raise SYNTAX_ERR exception.
+        https://bugs.webkit.org/show_bug.cgi?id=32700
+
+        Check url is valid in WebSocket::connect.
+        Also log the detailed reason of websocket failures to console.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::encodeProtocolString):
+        (WebCore::WebSocket::connect):
+
+2009-12-21  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make sure that we check for the right thread.
+
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCScheduleDeallocateOnMainThread):
+
+2009-12-21  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION(4.0.4-ToT): Indent deletes non highlighted text in gmail.
+        <rdar://problem/7489326>
+        https://bugs.webkit.org/show_bug.cgi?id=32843
+        
+        The fix for 7442387 did not handle the case where the end of paragraph
+        is not a descendant of the computed outer block.
+        Updated editing/execCommand/indent-with-style2.html to cover this case too.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement): 
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32831
+        Replace UString::Rep implementation, following introduction of ropes to JSC.
+
+        * ForwardingHeaders/runtime/UStringImpl.h: Added.
+            - add forwarding header.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::ustring):
+            - order of arguments to UString::Rep constructor for shared strings changed.
+
+2009-12-18  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam barth.
+
+        Generate V8 bindings non-constructor callback declarations 
+        in CodeGeneratorV8.pm instead of manually declaring them in
+        V8CustomBinding.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32638
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * bindings/v8/custom/V8ConsoleCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        * bindings/v8/custom/V8DOMParserConstructor.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8GeolocationCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.h: Added.
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        * bindings/v8/custom/V8NodeFilterCustom.cpp:
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
+        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp:
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+
+2009-12-21  Nate Chapin  <japhet@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Revert r52446 due to crashiness.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32839
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+        (WebCore::FrameLoader::stopAllLoaders):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        (WebCore::FrameLoader::pageHidden):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::suppressOpenerInNewFrame):
+        * loader/Request.cpp:
+        (WebCore::Request::Request):
+        (WebCore::Request::~Request):
+        * loader/Request.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * loader/SubresourceLoader.h:
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::cancelRequests):
+        (WebCore::Loader::Host::servePendingRequests):
+        (WebCore::Loader::Host::cancelPendingRequests):
+        (WebCore::Loader::Host::cancelRequests):
+
+2009-12-19  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add support for V8 Date binding.
+        https://bugs.webkit.org/show_bug.cgi?id=32699
+
+        This implements the same behavior as the recent change of
+        CodeGeneratorJS.pm and JSDOMBinding.cpp.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+          Produce toWebCoreDate() or v8DateOrNull() for Date type.
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::toWebCoreDate):
+          Converts a JavaScript object to a double representing Date.
+        (WebCore::v8DateOrNull):
+          Converts a double representing Date to a JavaScript Date object or null.
+        * bindings/v8/V8Binding.h: Declare toWebCoreDate() and v8DateOrNull().
+        * html/HTMLInputElement.idl: Delete V8_BINGIN exclusion for valueAsDate.
+
+2009-12-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Renamed m_sel to m_selection. Used do-webcore-rename.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection):
+        (WebCore::SelectionController::nodeWillBeRemoved):
+        (WebCore::SelectionController::willBeModified):
+        (WebCore::SelectionController::directionOfEnclosingBlock):
+        (WebCore::SelectionController::modifyExtendingRight):
+        (WebCore::SelectionController::modifyExtendingForward):
+        (WebCore::SelectionController::modifyMovingRight):
+        (WebCore::SelectionController::modifyMovingForward):
+        (WebCore::SelectionController::modifyExtendingLeft):
+        (WebCore::SelectionController::modifyExtendingBackward):
+        (WebCore::SelectionController::modifyMovingLeft):
+        (WebCore::SelectionController::modifyMovingBackward):
+        (WebCore::SelectionController::modify):
+        (WebCore::SelectionController::expandUsingGranularity):
+        (WebCore::SelectionController::xPosForVerticalArrowNavigation):
+        (WebCore::SelectionController::setBase):
+        (WebCore::SelectionController::setExtent):
+        (WebCore::SelectionController::layout):
+        (WebCore::SelectionController::caretRenderer):
+        (WebCore::SelectionController::invalidateCaretRect):
+        (WebCore::SelectionController::paintCaret):
+        (WebCore::SelectionController::debugRenderer):
+        (WebCore::SelectionController::contains):
+        (WebCore::SelectionController::selectAll):
+        (WebCore::SelectionController::formatForDebugger):
+        (WebCore::SelectionController::showTreeForThis):
+        * editing/SelectionController.h:
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        Let the script do its thing. Made sure no tests broke.
+
+2009-12-21  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Inconsistent use of counterName and identifier in CSS counter code and loss of information about the counter type.
+        https://bugs.webkit.org/show_bug.cgi?id=31814
+
+        No new tests because there are no functional changes in this patch.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::CounterNode):
+        (WebCore::CounterNode::computeCountInParent):
+        (WebCore::showTreeAndMark):
+        * rendering/RenderCounter.cpp:
+        (WebCore::planCounter):
+        (WebCore::findPlaceForCounter):
+        (WebCore::makeCounterNode):
+        (WebCore::RenderCounter::originalText):
+        Changed to use identifier instead of counterName and actsAsReset or hasResetType, as appropriate instead of isReset.
+        * rendering/CounterNode.h:
+        (WebCore::CounterNode::actsAsReset):
+        (WebCore::CounterNode::hasResetType):
+
+2009-12-21  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler and Nikolas Zimmermann.
+
+        Speed-up SVG Masking
+        https://bugs.webkit.org/show_bug.cgi?id=32738
+
+        This patch makes SVG Masking faster. The luminance calculaton of the ImageBuffer,
+        that is created by pixel manipulation, got optimized. The ImageBuffer and it's
+        luminance is created once now, not on every call of applyMask.
+        The size of the intermediate ImageBuffer depends on the visible area now and is
+        clipped by the mask rect.
+        
+        The patch doesn't change functionality so no new tests needed.
+        The new ImageBuffer handling in Mask causes two updates of test results. The pixel
+        tests and LayoutTests pass, but the checksum doesn't match.
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+
+2009-12-21  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fix assertion failure when dragging an SVG image.
+        https://bugs.webkit.org/show_bug.cgi?id=32511
+
+        Test: fast/images/drag-svg-as-image.html
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::filenameExtension): Return "svg"
+        * svg/graphics/SVGImage.h:
+
+2009-12-17  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] G_OBJECT() cast is not necessary for signals connection and properties access
+        https://bugs.webkit.org/show_bug.cgi?id=32661
+
+        Removed useless calls to the G_OBJECT() macro and replaced NULL
+        occurences with a SENTINEL macro.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+
+2009-12-21  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        If an image load is started during an unload or beforeunload event, run it
+        asynchronously (and allow it to outlive its page) so navigation can continue 
+        while the load completes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30457
+
+        Tests: http/tests/navigation/image-load-in-beforeunload-handler.html
+               http/tests/navigation/image-load-in-unload-handler.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadRequest): 
+        * loader/FrameLoader.cpp: Rename m_unloadEventBeingDispatched to m_isDispatchingUnloadEvent.
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+        (WebCore::FrameLoader::stopAllLoaders):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy): Set m_isDispatchingBeforeUnloadEvent.
+        (WebCore::FrameLoader::pageHidden):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::isDispatchingUnloadFamilyEvent): Added.
+        * loader/Request.cpp:
+        (WebCore::Request::Request): Add OutlivePagePolicy to constructor parameters
+        * loader/Request.h:
+        (WebCore::): Add OutlivePagePolicy enum.
+        (WebCore::Request::shouldOutlivePage): Added.
+        (WebCore::Request::frame): Added.
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create): Change one of the security checks to an outlive page check.
+        * loader/SubresourceLoader.h:
+        * loader/loader.cpp:
+        (WebCore::Loader::load): Add OutlivePagePolicy to Request constructor call,
+             ensure requests that should outlive page are done asynchronously.
+        (WebCore::Loader::cancelRequests): Remove ending ASSERT since it will now be hard to predict how
+             many requests might possibly outlive a cancel in every case.
+        (WebCore::Loader::Host::servePendingRequests): Use the correct frame in the case of a request outliving its page.
+        (WebCore::Loader::Host::cancelPendingRequests): Ensure we don't cancel request that should outlive their page.
+        (WebCore::Loader::Host::cancelRequests): Ensure we don't cancel request that should outlive their page.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Fix Windows build warnings
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude SVG files from the build that
+        are compiled via SVGAllInOne.cpp.
+
+2009-12-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Can’t copy outer html of selected node.
+        Also adds "Copy as HTML" context menu item.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32802
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentCanCopy):
+
+2009-12-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Web Inspector: extract syntax highlighters into separate files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32803
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/CSSSourceSyntaxHighlighter.js: Added.
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        * inspector/front-end/JavaScriptSourceSyntaxHighlighter.js: Added.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter):
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.):
+        * inspector/front-end/SourceFrame.js:
+        * inspector/front-end/SourceSyntaxHighlighter.js: Added.
+        (WebInspector.SourceSyntaxHighlighter):
+        (WebInspector.SourceSyntaxHighlighter.prototype.createSpan):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.processChunk):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.moveToNextLine):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process):
+        (WebInspector.SourceSyntaxHighlighter.prototype.lex):
+        (WebInspector.SourceSyntaxHighlighter.prototype.appendNonToken):
+        (WebInspector.SourceSyntaxHighlighter.prototype.syntaxHighlightNode):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-12-18  Julien Chaffraix  <jchaffraix@pleyo.com>
+
+        Reviewed by Darin Adler.
+
+        defersLoading is disabled in current libcURL.
+        https://bugs.webkit.org/show_bug.cgi?id=32707
+
+        Basically this change reverts r49577 that was totally wrong.
+        According to curlver.h, LIBCURL_VERSION_NUM is a
+        "6-digit (24 bits) hexadecimal number".
+
+        The check should be against 0x071200 (7.18) as it was originally the case.
+
+       * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle): Use the right check.
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::setDefersLoading): Ditto. Also removed a print
+        to use a LOG_ERROR instead.
+ 
+2009-12-20  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add support for JavaScriptCore Date binding.
+        https://bugs.webkit.org/show_bug.cgi?id=32698
+
+        This is needed for HTMLInputElement::valueAsDate and
+        HTMLTimeElement::valueAsDate.
+
+        A Date instance is mapped to a double value in C++.
+        - If null or undefined is set to a JavaScript property, C++ setter
+          function receives NaN.
+        - If a getter C++ function returns NaN or infinity, a JavaScript
+          property returns null.
+
+        Test: fast/forms/input-valueasdate.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsDateOrNull): Implement the above.
+        (WebCore::valueToDate): ditto.
+        * bindings/js/JSDOMBinding.h: Declare them.
+        * bindings/scripts/CodeGeneratorJS.pm: Produce jsDateOrNull() or
+          valueToDate() for Date type.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsDate): Temporal implementation.
+        (WebCore::HTMLInputElement::setValueAsDate): ditto.
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl: Declare valueAsDate.
+
+2009-12-20  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Introduce the followings:
+          - ::-webkit-inner-spin-button pseudo CSS selector
+          - ::-webkit-outer-spin-button pseudo CSS selector
+          - new appearance type: inner-spin-button
+          - new appearance type: outer-spin-button
+        They're going to be used for <input type=number> UI.
+        https://bugs.webkit.org/show_bug.cgi?id=31821
+
+        Inner-spin-button will be used for Windows, and outer-spin-button
+        will be used for Mac. A spin-button will represent a pair of an
+        increasing button part and a decreasing button part. SpinUpState,
+        which is defined in ThemeTypes.h, will be used to distinguish
+        these two parts.
+
+        The outer-spin-button implementation will use NSStepperCell.
+        NSStepperCell represents the pair of the parts and we can't draw them
+        independently. So a spin-button also represents the pair of the parts.
+
+        This change has no tests.  The following changes with tests will cover.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * css/CSSValueKeywords.in:
+        * css/html.css:
+        * platform/ThemeTypes.h:
+        (WebCore::ControlState): Add SpinUpState.
+        (WebCore::ControlPart): Add InnerSpinButtonPart and OuterSpinButtonPart.
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::adjustInnerSpinButtonStyle): Add an empty implementation.
+        (WebCore::RenderTheme::adjustOuterSpinButtonStyle): Add an empty implementation.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintInnerSpinButton): Add an empty implementation.
+        (WebCore::RenderTheme::paintOuterSpinButton): Add an empty implementation.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::PseudoId): Add INNER_SPIN_BUTTON and OUTER_SPIN_BUTTON.
+
+2009-12-20  Nayan Kumar K  <nayankk@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for compilation errors in WML module, due to the changeset #52314.
+        https://bugs.webkit.org/show_bug.cgi?id=32786
+
+        No new tests, this is compilation error fix.
+
+        * wml/WMLDocument.cpp:
+        * wml/WMLPageState.cpp:
+        * wml/WMLPageState.h:
+
+2009-12-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/7487689> REGRESSION (r52203): Inspector console uses
+        Monaco on Snow Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=32775
+
+        * inspector/front-end/inspector.css: Use the default monospace family
+        and size.
+
+2009-12-20  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Remove more GTK+ and GLib headers from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=32795
+
+        Remove most GTK+ and GLib includes from WebCore headers.
+
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        * platform/gtk/PasteboardHelper.h:
+        * platform/gtk/RenderThemeGtk.cpp:
+        * platform/gtk/RenderThemeGtk.h:
+        * platform/gtk/ScrollbarGtk.cpp:
+        * platform/gtk/ScrollbarThemeGtk.h:
+        * platform/gtk/gtk2drawing.c:
+        * platform/gtk/gtkdrawing.h:
+
+2009-12-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] build fixes after recent changes.
+
+        * bindings/BindingSecurityBase.cpp: Removed V8 header in common code.
+        * platform/wx/ContextMenuWx.cpp: Added missing header.
+        * plugins/mac/PluginViewMac.cpp: Added missing header.
+
+2009-12-20  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Hopefully fix the assertion we are hitting by not forcing updating
+        the state of scrollbars when setting the adjustments. This was
+        leading to a premature layout.
+
+        fast/dom/open-and-close-by-DOM.html
+        fast/dom/Window/closure-access-after-navigation-window.html
+        fast/harness/use-page-cache.html
+
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::setGtkAdjustments):
+
+2009-12-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Web Inspector: Constrain the number of messages the inspector shows.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20919
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::updateConsoleMessageExpiredCount):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateConsoleMessageExpiredCount):
+
+2009-12-20  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Android needs implementation of setCookies, cookies and cookiesEnabled functions.
+        https://bugs.webkit.org/show_bug.cgi?id=32559
+
+        Add implementation of the cookie functions.
+        Fix a crash caused by dereferencing a 0 MainResourceLoader pointer
+        in ResourceHandle::start().
+
+        No new tests, this is platform code.
+
+        * platform/android/PlatformBridge.h:
+        * platform/network/android/AuthenticationChallenge.h: Added.
+        * platform/network/android/CookieJarAndroid.cpp: Added.
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
+        * platform/network/android/ResourceHandleAndroid.cpp:
+        (WebCore::ResourceHandle::start):
+
+2009-12-19  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52395.
+        http://trac.webkit.org/changeset/52395
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGMaskElement.h:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/SVGResourceMasker.h:
+
+2009-12-19  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r52399.
+        http://trac.webkit.org/changeset/52399
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+
+2009-12-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Added a missing "not".
+
+        Test: http/tests/security/xss-DENIED-window-open-javascript-url.html
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+
+2009-12-19  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Invalid url should raise SYNTAX_ERR exception.
+        https://bugs.webkit.org/show_bug.cgi?id=32700
+
+        Check url is valid in WebSocket::connect.
+        Also log the detailed reason of websocket failures to console.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+
+2009-12-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: Up/down arrow keys do not step numeric CSS property values
+        https://bugs.webkit.org/show_bug.cgi?id=32776
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown): Call the focused element’s
+        handleKeyEvent method.
+
+2009-12-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Speed-up SVG Masking
+        https://bugs.webkit.org/show_bug.cgi?id=32738
+
+        This patch makes SVG Masking faster. At the moment we create a new ImageBuffer
+        and copy the complete pixel array. That is rather inefficient. This patch
+        uses the mask image directly.
+        It also bounds the direct pixel manipultation to the viewable area to minimize
+        the calculation of the mask.
+
+        No change in functionality. So no new test.
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGMaskElement.h:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/SVGResourceMasker.h:
+
+2009-12-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Add tests to check filter, mask, clip, opacity and marker ordering
+        https://bugs.webkit.org/show_bug.cgi?id=14010
+
+        The right ordering for applying effects on objects in SVG is filters,
+        clipper/masker and opacity. This patch fixes the order of filter and
+        clipper/masker. Opacity and marker need another test.
+        This change is according to the SVG Specification:
+        http://www.w3.org/TR/SVG11/render.html#Elements
+
+        Test: svg/filters/filter-clip.svg
+
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+2009-12-19  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Revert my attempt at making --disable-geolocation work; it is
+        more complicated than I anticipated.  (It passed on the build bots
+        because they build with --enable-geolocation.)
+
+        * GNUmakefile.am:
+
+2009-12-19  MORITA Hajime  <morrita@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        WebCore::Range::surroundContents NULL pointer crash.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31684
+
+        Test: fast/dom/Range/31684.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::surroundContents):
+        throw exception when parentOfNewParent->parentNode() is NULL.
+
+2009-12-19  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Don't use an icon for all spelling guess menu items.
+
+        * platform/gtk/ContextMenuItemGtk.cpp:
+        (WebCore::gtkStockIDFromContextMenuAction):
+
+2009-12-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Missing \.
+
+        * GNUmakefile.am:
+
+2009-12-19  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Make --disable-geolocation and --disable-svg work, by conditionally
+        building the relevant files.
+
+        * GNUmakefile.am:
+
+2009-12-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Simon Fraser.
+
+        Add a comment about some confusing code that otherwise would look like
+        it might be a bug.
+        https://bugs.webkit.org/show_bug.cgi?id=32534
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+
+2009-12-18  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Messed up the XCode file, trying to fix.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-18  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed, fix typos in WebCore.xcodeproj.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-18  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        SVGAngle / SVGPreserveAspectRatio should be POD types
+        https://bugs.webkit.org/show_bug.cgi?id=32758
+
+        Convert SVGAngle / SVGPreserveAspectRatio to be non-refcounted types, just
+        like it has been done for SVGMatrix / SVGLength before.
+
+        This patch prepares removing the special DOMObjectWithSVGContext hack.
+        No change in functionality, thus no new tests.
+
+        * WebCore.xcodeproj/project.pbxproj: Add SVGNames.h to the 'Copy Generated Headers' phase, and set SVGAngle/SVGPreserveAspectRatio role to 'Private', so WebKit can access it.
+        * bindings/scripts/CodeGenerator.pm: Recognize SVGAngle / SVGPreserveAspectRatio as new POD-types (similar to SVGLength)
+        * bindings/scripts/CodeGeneratorJS.pm: Ditto. 
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        * bindings/v8/V8Index.h: Ditto.
+        * rendering/RenderSVGImage.cpp: All following changes, modify SVGAngle/SVGPreserveAspectRatio access, as they are non-refcounted now.
+        (WebCore::RenderSVGImage::adjustRectsForAspectRatio):
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderSVGImage.h:
+        * svg/SVGAngle.h:
+        * svg/SVGAngle.idl:
+        * svg/SVGAnimatedTemplate.h:
+        (WebCore::):
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        (WebCore::SVGFEImageElement::parseMappedAttribute):
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::viewBoxToViewTransform):
+        (WebCore::SVGFitToViewBox::parseMappedAttribute):
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        (WebCore::SVGImageElement::parseMappedAttribute):
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        (WebCore::SVGMarkerElement::parseMappedAttribute):
+        (WebCore::SVGMarkerElement::setOrientToAuto):
+        (WebCore::SVGMarkerElement::setOrientToAngle):
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPreserveAspectRatio.cpp:
+        (WebCore::SVGPreserveAspectRatio::parsePreserveAspectRatio):
+        (WebCore::SVGPreserveAspectRatio::getCTM):
+        * svg/SVGPreserveAspectRatio.h:
+        (WebCore::SVGPreserveAspectRatio::parsePreserveAspectRatio):
+        * svg/SVGPreserveAspectRatio.idl:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        (WebCore::SVGSVGElement::createSVGAngle):
+        (WebCore::SVGSVGElement::inheritViewAttributes):
+        * svg/SVGSVGElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        (WebCore::SVGViewSpec::setPreserveAspectRatioString):
+        (WebCore::SVGViewSpec::parseViewSpec):
+
+2009-12-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Chromium build fix, no review.
+
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+
+2009-12-18  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix, no review.
+
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::createFontPlatformData): Correct my typo
+          on the CG build.
+
+2009-12-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make DatabaseTrackerChromium::removeOpenDatabase() send and IPC on
+        the main thread when a database is being closed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32627
+
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        (WebCore::removeOpenDatabaseOnMainThread):
+        (WebCore::DatabaseTracker::removeOpenDatabase):
+
+2009-12-18  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix, no review.
+
+        * page/win/FrameCairoWin.cpp: Add missing include.
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::createFontPlatformData): Conditionalize
+          Safari-only call.
+
+2009-12-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Move some code related to database closing from the destructor to
+        the close() method. This would allow us to do things such as post
+        tasks to other threads when a database closes, which cannot be
+        done now, because we cannot increment the ref count to a database
+        object when we're in its destructor.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32626
+
+        * storage/Database.cpp:
+        (WebCore::Database::~Database):
+        (WebCore::Database::close):
+
+2009-12-18  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        REGRESSION(r52233): MSAA: Accessibility role of lists is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=32736
+
+        Reviewed by Adam Roben.
+
+        Test: platform/win/accessibility/list-role.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::roleValueForMSAA):
+        Return roleValue(), rather than m_role, as subclasses may override it.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::roleValueForMSAA):
+        Fallback to roleValue(), rather than m_role, as it may be overriden.
+
+2009-12-17  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility role of list items is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=32688
+
+        Reviewed by Adam Roben.
+
+        Test: platform/win/accessibility/list-item-role.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        Add a ListItemRole to the enum.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::msaaRoleForRenderer):
+        Return the role for the RenderObject, or UnknownRole if unknown.
+        (WebCore::AccessibilityRenderObject::roleValueForMSAA):
+        Call msaaRoleForRenderer() to get the role. If it is UnknownRole, fall
+        back to m_role.
+
+2009-12-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash when accessing webkitTransition property after setting webkitTransitionProperty with invalid value.
+        https://bugs.webkit.org/show_bug.cgi?id=31559
+        
+        Fix an array bounds error when accessing the CSS value for a shorthand property that takes
+        a comma-separated list, after the list for one of the component properties has been set to a different length.
+
+        Test: fast/css/shorthand-mismatched-list-crash.html
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
+
+2009-12-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Remove WebCore.ClientBasedGeolocation.exp from Sources, and remove two IDL files from Resources.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-18  Sam Weinig  <sam@webkit.org>
+
+        Fix mac Geolocation build.
+
+        * DerivedSources.make:
+        * WebCore.ClientBasedGeolocation.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Geolocation.h:
+        * page/GeolocationError.h:
+        (WebCore::GeolocationError::GeolocationError):
+        * page/GeolocationPosition.h:
+
+2009-12-18  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes <http://webkit.org/b/32613>.
+        REGRESSION (r52008): Middle-clicking on a linked image starts a pan scroll,
+        but should follow the link instead.
+
+        The node itself isn't the only possible node that can be a link (that was the
+        original check), any of its ancestors could be links as well, we need to climb
+        up the tree to see. Created a new function (enclosingAnchorNode), that finds a
+        node's enclosing anchor element (if it exists), that we can share between RenderLayer
+        and Node, and also added tests that test pan scrolling behavior in image maps.
+
+        Tests: platform/win/fast/events/panScroll-image-no-scroll.html
+               platform/win/fast/events/panScroll-imageMap-href-no-scroll.html
+               platform/win/fast/events/panScroll-imageMap-noHref-scroll.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::enclosingAnchorNode):
+        (WebCore::Node::defaultEventHandler):
+        * dom/Node.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTest):
+
+2009-12-18  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] RemoveDashboard support. It's useless.
+
+        * GNUmakefile.am:
+
+2009-12-18  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] context menu overriding API is very limited
+        https://bugs.webkit.org/show_bug.cgi?id=27546
+
+        Omit SearchWeb from the context menu in the GTK+ port.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+
+2009-12-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add export the new symbol in WebCoreSystemInterface.
+
+        * WebCore.base.exp:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2009-12-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Forward declare NSMutableArray when not compiling for Objective-C.
+
+        * platform/mac/WebCoreSystemInterface.h:
+
+2009-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32720
+        Replace UString addition/append with use of JSC::StringBuilder.
+
+        * ForwardingHeaders/runtime/StringBuilder.h: Added.
+        * bindings/js/ScriptString.h:
+        (WebCore::ScriptString::operator+=):
+        * bridge/jni/jni_runtime.cpp:
+        (appendClassName):
+        (JavaMethod::signature):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
+
+2009-12-18  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Index validation for drawElements examines too many indices
+        https://bugs.webkit.org/show_bug.cgi?id=32692
+
+        Test: fast/canvas/webgl/bug-32692.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::validateIndexArrayPrecise):
+
+2009-12-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Update WebKitSystemInterface for <rdar://problem/7237059>.        
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        GTK build fix
+
+        * plugins/gtk/PluginViewGtk.cpp: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix
+
+        * platform/chromium/PopupMenuChromium.cpp: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix
+
+        * html/HTMLLinkElement.cpp: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Qt build fix
+
+        * platform/qt/RenderThemeQt.cpp:
+        * plugins/qt/PluginDataQt.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        Added #includes.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        V8 build fix
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        GTK (and others?) build fix
+
+        * platform/text/StringImpl.h: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Reduce #includes in a few high-use headers
+
+        Removed unnecessary #includes in these headers:
+          - Frame.h
+          - FrameWin.h
+          - Node.h
+          - Page.h
+          - StringImpl.h
+
+        The rest of the patch is all adding #includes to source files that now
+        require them.
+
+        Fixes <http://webkit.org/b/32718>.
+
+        Rubber-stamped by Anders Carlsson.
+
+        * dom/Node.h:
+        * page/Frame.h:
+        * page/Page.h:
+        * page/win/FrameWin.h:
+        * platform/text/StringImpl.h:
+        Removed unnecessary #includes.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * dom/Document.cpp:
+        * dom/InputElement.cpp:
+        * dom/Node.cpp:
+        * dom/SelectElement.cpp:
+        * editing/EditorCommand.cpp:
+        * html/HTMLFormControlElement.cpp:
+        * html/HTMLFormElement.cpp:
+        * html/HTMLMediaElement.cpp:
+        * html/HTMLParser.cpp:
+        * html/HTMLTextAreaElement.cpp:
+        * html/HTMLVideoElement.cpp:
+        * inspector/InspectorController.cpp:
+        * loader/FrameLoader.cpp:
+        * loader/HistoryController.cpp:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        * page/Console.cpp:
+        * page/EventHandler.cpp:
+        * page/Frame.cpp:
+        * page/FrameView.cpp:
+        * page/Navigator.cpp:
+        * page/PageGroup.cpp:
+        * page/Settings.cpp:
+        * page/mac/EventHandlerMac.mm:
+        * platform/KURL.h:
+        * platform/ScrollbarThemeComposite.cpp:
+        * platform/cf/BinaryPropertyList.cpp:
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        * platform/mac/PopupMenuMac.mm:
+        * platform/mac/WidgetMac.mm:
+        * platform/network/cf/DNSCFNet.cpp:
+        * platform/text/StringImpl.cpp:
+        * platform/win/FileSystemWin.cpp:
+        * platform/win/PlatformScreenWin.cpp:
+        * platform/win/PopupMenuWin.cpp:
+        * platform/win/WidgetWin.cpp:
+        * plugins/PluginView.cpp:
+        * plugins/win/PluginViewWin.cpp:
+        * rendering/InlineTextBox.cpp:
+        * rendering/RenderBox.cpp:
+        * rendering/RenderFileUploadControl.cpp:
+        * rendering/RenderInline.cpp:
+        * rendering/RenderLayerCompositor.cpp:
+        * rendering/RenderObject.cpp:
+        * rendering/RootInlineBox.cpp:
+        * storage/DatabaseTracker.cpp:
+        * storage/DatabaseTracker.h:
+        * storage/SQLTransactionClient.cpp:
+        * svg/graphics/SVGImage.cpp:
+        Added now-needed #includes.
+
+2009-12-18  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Implemented isId as specified by DOM Level 3. See detailed description below.
+        https://bugs.webkit.org/show_bug.cgi?id=5578
+
+        Added isId property and implementation:
+        Tests: dom/xhtml/level3/core/attrisid01-07.xhtml
+               fast/dom/Element/attrisid-extra01.html
+        * dom/Attr.cpp:
+        (WebCore::Attr::isId):
+        * dom/Attr.h:
+        * dom/Attr.idl:
+
+        Replaced instances of HTMLNames::idAttr with Element::idAttributeName()
+        for the reason that id attribute name could be customized to a different
+        string other than "id". A test case is associated to each code change.
+        * dom/Document.cpp:
+        (WebCore::Document::getElementById): Test: fast/dom/Element/id-in-getelement01.html
+        * dom/Element.cpp: Tests: dom/xhtml/level3/core/attrisid01-07.xhtml
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::setAttributeMap):
+        (WebCore::Element::insertedIntoDocument):
+        (WebCore::Element::removedFromDocument):
+        (WebCore::Element::formatForDebugger):
+        (WebCore::Element::rareIDAttributeName):
+        * dom/Element.h: Added function idAttributeName().
+        (WebCore::Element::idAttributeName):
+        * dom/ElementRareData.h: Added member variable to store customized id name in ElementRareData.
+        (WebCore::ElementRareData::ElementRareData):
+        * dom/NamedAttrMap.cpp: Tests: dom/xhtml/level3/core/attrisid01-07.xhtml
+        (WebCore::NamedNodeMap::setNamedItem):
+        (WebCore::NamedNodeMap::removeNamedItem):
+        (WebCore::NamedNodeMap::setAttributes):
+        * dom/Node.cpp: Removed ASSERT as it may not hold any more.
+        (WebCore::Node::querySelector):
+        * dom/SelectorNodeList.cpp: Removed ASSERT as it may not hold any more.
+        (WebCore::createSelectorNodeList):
+        * dom/StyledElement.cpp: Tests: dom/xhtml/level3/core/attrisid01-07.xhtml
+        (WebCore::StyledElement::parseMappedAttribute):
+        * editing/DeleteButtonController.cpp: Test: fast/dom/Element/id-in-deletebutton.html
+        (WebCore::DeleteButtonController::createDeletionUI):
+        * editing/EditorCommand.cpp: Test: fast/dom/Element/id-in-insert-hr.html
+        (WebCore::executeInsertHorizontalRule):
+        * html/HTMLAppletElement.cpp: Test: fast/dom/Element/id-in-applet.html
+        (WebCore::HTMLAppletElement::parseMappedAttribute):
+        (WebCore::HTMLAppletElement::createRenderer):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::checkForNameMatch): Test: fast/forms/select-namedItem.html
+        (WebCore::HTMLCollection::updateNameCache): Test: fast/dom/collection-namedItem-via-item.html
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::ensureColumn): Test: fast/dom/HTMLDataGridElement/DataGridColumns-dom.html
+        (WebCore::HTMLDataGridColElement::parseMappedAttribute): Test: fast/dom/HTMLDataGridElement/DataGridColumns-dom-attributes.html
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLFormCollection.cpp: Test: fast/dom/Element/id-in-formcollection.html
+        (WebCore::HTMLFormCollection::getNamedFormItem):
+        (WebCore::HTMLFormCollection::nextNamedItem):
+        (WebCore::HTMLFormCollection::updateNameCache):
+        * html/HTMLFrameElementBase.cpp: Test: fast/dom/Element/id-in-frame.html
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        (WebCore::HTMLFrameElementBase::setNameAndOpenURL):
+        * html/HTMLImageElement.cpp: Test: fast/dom/Element/id-in-deletebutton.html
+        (WebCore::HTMLImageElement::parseMappedAttribute):
+        * html/HTMLMapElement.cpp: Test: fast/dom/Element/id-in-map.html
+        (WebCore::HTMLMapElement::parseMappedAttribute):
+        * html/HTMLNameCollection.cpp: Test: fast/dom/Element/id-in-frameset.html
+        (WebCore::HTMLNameCollection::itemAfter):
+        * html/HTMLObjectElement.cpp: Test: fast/dom/HTMLDocument/object-by-name-or-id.html
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * html/HTMLParamElement.cpp: Test: fast/dom/Element/id-in-param.html
+        (WebCore::HTMLParamElement::parseMappedAttribute):
+        * loader/CachedFont.cpp: Test: svg/custom/acid3-test-77.html
+        (WebCore::CachedFont::getSVGFontById):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer): Debug-only code
+        * rendering/SVGRenderTreeAsText.cpp: Test: svg/text/text-gradient-positioning.svg
+        (WebCore::writeRenderResources):
+        * svg/SVGElement.cpp: Test: svg/custom/acid3-test-77.html
+        (WebCore::SVGElement::insertedIntoDocument):
+        * svg/SVGStyledElement.cpp: Test: svg/custom/js-update-image-and-display.svg
+        (WebCore::SVGStyledElement::isKnownAttribute):
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::parseMappedAttribute):
+
+2009-12-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Clean up the qmake build system to distinguish between trunk builds and package builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=32716
+
+        Introduce standalone_package as config that is set when QTDIR_build is set or when
+        the directory for the generated files is present.
+
+        Renamed uses of QTDIR_build that apply to generic package builds to use standalone_package.
+        Others remain as they are specific to building inside Qt.
+
+        * WebCore.pro:
+
+2009-12-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix the build on Symbian.
+
+        Use QFont::lastRestortFamily() instead of QFont::lastRestortFont(),
+        which is a missing symbol in Qt 4.6.0 on Symbian.
+
+        Functionally they should be equivalent, according to the source.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont):
+
+2009-12-18  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] segfault during controls initialization if not GTK theme is present.
+        https://bugs.webkit.org/show_bug.cgi?id=32705
+
+        Create empty images for the controls if no GTK theme is set.
+
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getThemeIconFileName):
+        (WebCore::loadImageFromFile):
+
+2009-12-18  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r38898): Using the up arrow in a textarea gets "stuck"
+        at the beginning.
+        https://bugs.webkit.org/show_bug.cgi?id=31920
+
+        Moving up from a position after the end of the previous lines
+        should use UPSTREAM affinity to render the caret in the previous
+        line.
+
+        Test: editing/selection/wrapped-line-caret-3.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint):
+
+2009-12-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::stepMismatch() uses ambiguous overload of pow()
+        https://bugs.webkit.org/show_bug.cgi?id=32675
+
+        Use the double constant 2.0 instead of static_cast<double>(2).
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::stepMismatch):
+
+2009-12-17  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 32357: SVG test case crashes WebKit (invalid font URL)
+        https://bugs.webkit.org/show_bug.cgi?id=32357
+
+        Added check for NULL return value from DocLoader::requestFont()
+
+        * svg/SVGFontFaceUriElement.cpp:
+        (WebCore::SVGFontFaceUriElement::loadFont):
+
+2009-12-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        marquee with display:inline causes crash
+        https://bugs.webkit.org/show_bug.cgi?id=32374
+
+        Test: fast/inline/inline-marquee-crash.html
+
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::start):
+        (WebCore::HTMLMarqueeElement::stop):
+        (WebCore::HTMLMarqueeElement::suspend):
+        (WebCore::HTMLMarqueeElement::resume):
+        (WebCore::HTMLMarqueeElement::renderMarquee):
+        * html/HTMLMarqueeElement.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::styleChanged):
+
+2009-12-17  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for inspector's classes
+        https://bugs.webkit.org/show_bug.cgi?id=32660                               
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and no need to be copyable:                                           
+
+        class name                  - instantiated at:  WebCore/'location'
+
+        class JavaScriptDebugServer - inspector/JavaScriptDebugServer.cpp:72
+        class ConsoleMessage        - inspector/InspectorController.cpp:329 
+        class InspectorController   - page/Page.cpp:119
+
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.h:
+        * inspector/JavaScriptDebugServer.h:
+
+2009-12-17  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes HTMLInputElement::stepMismatch() to avoid ambiguous overload of pow().
+        https://bugs.webkit.org/show_bug.cgi?id=32675
+
+        Build fix only, no new tests.
+
+        * html/HTMLInputElement.cpp: Modified.
+        (WebCore::HTMLInputElement::stepMismatch): Cast first argument of pow to double to force 'double pow(double, int)'
+
+2009-12-17  Marc-Antoine Ruel  <maruel@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix link failure on LTCG builds on Windows for chromium port.
+
+        Reenable SVGAllInOne.cpp. This required some fixups.
+
+        Namely, there was conflicts in constants between HTMLNames and
+        SVGNames, and conflicts between static functions names.
+
+        No new tests as functionality has not changed.
+
+        * WebCore.gyp/WebCore.gyp:
+        * svg/SVGAllInOne.cpp:
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::rebuildFontFace):
+        * svg/SVGGlyphElement.cpp:
+        (WebCore::SVGGlyphElement::invalidateGlyphCache):
+        (WebCore::SVGGlyphElement::buildGlyphIdentifier):
+        * svg/SVGHKernElement.cpp:
+        (WebCore::SVGHKernElement::insertedIntoDocument):
+        (WebCore::SVGHKernElement::removedFromDocument):
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::type):
+        (WebCore::SVGStyleElement::setType):
+        (WebCore::SVGStyleElement::media):
+        (WebCore::SVGStyleElement::setMedia):
+        (WebCore::SVGStyleElement::title):
+        (WebCore::SVGStyleElement::setTitle):
+        (WebCore::SVGStyleElement::parseMappedAttribute):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::mapAttributeToCSSProperty):
+        (WebCore::SVGStyledElement::cssPropertyIdForSVGAttributeName):
+        * svg/SVGStyledElement.h:
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix VI
+
+        * svg/animation/SMILTimeContainer.h: Added now-needed #include.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix V
+
+        * platform/KURLGoogle.cpp: Added now-needed #include.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix IV
+
+        * loader/CrossOriginPreflightResultCache.h: Added now-needed
+        #includes.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix III
+
+        * platform/graphics/Font.h: Added now-needed #include.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix II
+
+        * dom/EventTarget.h: Added now-needed #include.
+
+2009-12-17  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for js bindings
+        https://bugs.webkit.org/show_bug.cgi?id=32655
+
+        Inherits the following classes from Noncopyable because these are instantiated 
+        by 'new' and no need to be copyable:
+
+        class name                  - instantiated at:  WebCore/'location'
+
+        class ScriptCachedFrameData - history/CachedFrame.cpp:117
+        class WebCoreJSClientData   - bindings/js/JSDOMWindowBase.cpp:162
+        class ScheduledAction       - bindings/js/ScheduledAction.cpp:58
+
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptCachedFrameData.h:
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix
+
+        * dom/QualifiedName.h: Added now-needed #include of HashTraits.h
+        (which itself #includes HashFunctions.h).
+
+2009-12-17  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Incorrect Doctype.
+
+        REGRESSION(4.0.4-TOT):Web Inspector: Incorrect Doctype
+        https://bugs.webkit.org/show_bug.cgi?id=32671
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+
+2009-12-17  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Adam Roben.
+
+        Don't include all JSC headers everywhere
+        https://bugs.webkit.org/show_bug.cgi?id=32663
+
+        Remove HashMap HashSet and OwnPtr includes from PlatformString.h.
+        Reduces code size of Gtk build by another 5%.
+
+        * platform/text/PlatformString.h:
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Mac/Qt build fixes
+
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        * platform/qt/Localizations.cpp:
+        Added missing #includes.
+
+2009-12-17  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Adam Roben.
+
+        Don't include all JSC headers everywhere
+        https://bugs.webkit.org/show_bug.cgi?id=32663
+
+        PlatformString.h included almost all of JSC via runtime/Identifier.h.
+        This patch gets rid of this include by forward-declaring the required
+        classes instead.
+        This reduces the build size of the object files on a Gtk debug build
+        by 10%. The resulting libwebkit.so gets 5% smaller.
+
+        No new tests as it's just a build improvement.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        include math.h here (it used to be pulled by JSC)
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+
+2009-12-17  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Xan Lopez.
+
+        Always use all WebCore include paths in GtkWebKit.
+
+        With this patch, I can disable all optional features and still build.
+
+        * GNUmakefile.am:
+
+2009-12-17  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Added WebPageSerializer to WebKit API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31737
+
+        * platform/text/StringBuilder.cpp: Added methods to make StringBuilder even more useful for large scale string concatenation.
+        (WebCore::StringBuilder::clear):
+        (WebCore::StringBuilder::length):
+        * platform/text/StringBuilder.h:
+
+2009-12-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Add controls for playing html5 video.
+        https://bugs.webkit.org/show_bug.cgi?id=26304
+
+        Media controls UI, first step. This patch was written by Zan
+        Dobersek. In addition I fixed the compilation errors and
+        re-enabled some of the media tests involving the controls UI.
+
+        * GNUmakefile.am:
+        * css/mediaControlsGtk.css: Added.
+        * platform/graphics/Image.h:
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getThemeIconFileName):
+        (WebCore::loadResourceSharedBuffer):
+        (WebCore::loadImageFromFile):
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::Image::loadPlatformThemeIcon):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::getMediaElementFromRenderObject):
+        (WebCore::getIconNameForTextDirection):
+        (WebCore::RenderThemeGtk::initMediaStyling):
+        (WebCore::RenderThemeGtk::RenderThemeGtk):
+        (WebCore::RenderThemeGtk::~RenderThemeGtk):
+        (WebCore::supportsFocus):
+        (WebCore::RenderThemeGtk::baselinePosition):
+        (WebCore::paintMozWidget):
+        (WebCore::setToggleSize):
+        (WebCore::RenderThemeGtk::adjustSliderThumbSize):
+        (WebCore::RenderThemeGtk::gtkContainer):
+        (WebCore::RenderThemeGtk::platformColorsDidChange):
+        (WebCore::RenderThemeGtk::extraMediaControlsStyleSheet):
+        (WebCore::paintMediaButton):
+        (WebCore::RenderThemeGtk::paintMediaFullscreenButton):
+        (WebCore::RenderThemeGtk::paintMediaMuteButton):
+        (WebCore::RenderThemeGtk::paintMediaPlayButton):
+        (WebCore::RenderThemeGtk::paintMediaSeekBackButton):
+        (WebCore::RenderThemeGtk::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeGtk::paintMediaSliderTrack):
+        (WebCore::RenderThemeGtk::paintMediaSliderThumb):
+        * platform/gtk/RenderThemeGtk.h:
+
+2009-12-17  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] support navigator.onLine and ononline/onoffline events.
+        https://bugs.webkit.org/show_bug.cgi?id=32555
+
+        Hooked up Bearer Management to NetworkStateNotifier. This solution is available 
+        only if QtMobility's Bearer Management is installed.
+
+        * WebCore.pro:
+        * platform/network/NetworkStateNotifier.h:
+        * platform/network/qt/NetworkStateNotifierPrivate.h: Added.
+        * platform/network/qt/NetworkStateNotifierQt.cpp: Added.
+        (WebCore::NetworkStateNotifierPrivate::NetworkStateNotifierPrivate):
+        (WebCore::NetworkStateNotifierPrivate::onlineStateChanged):
+        (WebCore::NetworkStateNotifierPrivate::~NetworkStateNotifierPrivate):
+        (WebCore::NetworkStateNotifier::updateState):
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2009-12-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Switch to 11px as default for source-code in WebKit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32646
+
+        * inspector/front-end/inspector.css:
+
+2009-12-17  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Symbian build fix: Don't include QtXml/qxmlstream.h but omit the prefix, to
+        make sure we pick up the header file from QtCore. That is where the implementation
+        is compiled.
+
+        * dom/XMLTokenizer.h:
+
+2009-12-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] WebKit GTK needs a wrapper for ref counted glib/gobject structs
+        https://bugs.webkit.org/show_bug.cgi?id=21599
+
+        Add GRefPtr support for GTK types to WebCore, as JSC does not link against
+        GTK+. Also convert PopupMenu::m_poup from a raw pointer to a GRefPtr.
+
+        No new tests as functionality has not changed.
+
+        * GNUmakefile.am:
+        * platform/PopupMenu.h:
+        * platform/gtk/GRefPtrGtk.cpp: Added.
+        (WTF::refGPtr):
+        (WTF::derefGPtr):
+        * platform/gtk/GRefPtrGtk.h: Added.
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        (WebCore::PopupMenu::menuRemoveItem):
+
+2009-12-17  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Advice links to source code in CPU profiler to open in debugger,
+        not in resources tab.
+
+        Also work around the case when resources are disabled, but scripts are present.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32610
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.updateMainViewWidth):
+        (WebInspector.Panel.prototype.canShowSourceLineForURL):
+        (WebInspector.Panel.prototype.showSourceLineForURL):
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.createCell):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.canShowSourceLineForURL):
+        (WebInspector.ResourcesPanel.prototype.showSourceLineForURL):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.scriptForURL):
+        (WebInspector.ScriptsPanel.prototype.canShowSourceLineForURL):
+        (WebInspector.ScriptsPanel.prototype.showSourceLineForURL):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector._choosePanelToShowSourceLineForURL):
+        (WebInspector.canShowSourceLineForURL):
+        (WebInspector.showSourceLineForURL):
+
+2009-12-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] display FPS stats for video element
+        https://bugs.webkit.org/show_bug.cgi?id=32560
+
+        Display FPS statistics if WEBKIT_DEBUG environment variable
+        contains the Media log category. This feature requires a very
+        recent (>= 0.10.18) version of gst-plugins-bad.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-11  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GStreamer] Should emit {networkState,readyState,volume,time,size,rate,duration}Changed signals
+        https://bugs.webkit.org/show_bug.cgi?id=30377
+
+        Emit volumeChanged and durationChanged upon notification from
+        GStreamer.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::mediaPlayerPrivateVolumeCallback):
+        (WebCore::notify_volume_idle_cb):
+        (WebCore::MediaPlayerPrivate::didEnd):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-12-16  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] segfault during volume notification
+        https://bugs.webkit.org/show_bug.cgi?id=32603
+
+        Emit volumeChanged and durationChanged upon notification from
+        GStreamer. Also don't reset the volume property on playbin, it is
+        not needed as it is 1.0 by default both on playbin and in the
+        MediaPlayer.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::mediaPlayerPrivateVolumeChangedCallback):
+        (WebCore::notifyVolumeIdleCallback):
+        (WebCore::doGstInit):
+        (WebCore::MediaPlayerPrivate::isAvailable):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::didEnd):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        (WebCore::mimeTypeCache):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-12-17  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Xan Lopez.
+
+        gtk: always use standard include paths, regardless of settings.
+        WebKit style is to wrap the body of a header in #if ENABLE(FOO),
+        so they're always safe to include whether the features are enabled or
+        not.
+
+        This fixes building with --disable-database and other flags.
+
+        * GNUmakefile.am:
+
+2009-12-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Build fixes for make distcheck.
+
+        * GNUmakefile.am:
+
+2009-12-17  Philippe Normand  <pnormand@igalia.com>
+
+        Rubber-stamped by Gustavo Noronha Silva.
+
+        Trivial WebKit coding style fix.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-12-15 MORITA Hajime <morrita@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 28306: double-clicking a word inside <b> beside newline select two words
+        https://bugs.webkit.org/show_bug.cgi?id=28306
+        
+        SimplifiedBackwardsTextIterator missed trailing whitespaces just
+        before folding line-break, which is used to detect word
+        boundaries. This fix checks strings on RenderText and expand text
+        range on SimplifiedBackwardsTextIterator to include trailing
+        whitespaces if availble.
+
+        Test: editing/selection/doubleclick-beside-cr-span.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::collapsedSpaceLength):
+        (WebCore::maxOffsetIncludingCollapsedSpaces):
+        (WebCore::SimplifiedBackwardsTextIterator::advance):
+
+2009-12-16  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix flakiness in WebSocket handshake console message.
+        https://bugs.webkit.org/show_bug.cgi?id=32598
+
+        In chromium, LayoutTests/websocket/tests/handshake-error.html is
+        flaky, because it outputs the following console message several times:
+          CONSOLE MESSAGE: line 0: Unexpected response code:101
+        Update m_mode in WebSocketHandshake correctly: Once it finds
+        error in handshake message, set m_mode to Failed and don't try
+        reading handshake message again.  If handshake message is not yet
+        fully received, set m_mode to Incomplete, so next didReceiveData()
+        will try to check handshake message again.
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::readServerHandshake):
+
+2009-12-16  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility role of text nodes is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=32631
+        <rdar://problem/7369084>
+
+        Reviewed by Alice Liu.
+
+        Test: platform/win/accessibility/text-role.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        Add a new role to the enum.
+        (WebCore::AccessibilityObject::roleValueForMSAA):
+        Declare a function to return the accessibility role for MSAA; the base
+        implementation returns the old role value.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
+        Initialize m_roleForMSAA.
+        (WebCore::AccessibilityRenderObject::roleValueForMSAA):
+        If m_roleForMSAA has been set, return it. If the renderer is a
+        RenderText, set the role to EditableTextRole to match IE and Firefox.
+        Otherwise, set the role for MSAA to the old role value.
+
+        * accessibility/AccessibilityRenderObject.h:
+        Add a member to hold the role for MSAA, and declare an override of
+        roleValueForMSAA().
+
+2009-12-16  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52206.
+        http://trac.webkit.org/changeset/52206
+        https://bugs.webkit.org/show_bug.cgi?id=31187
+
+        This broke pixel tests on Mac.  Presumably the code in
+        ImageCG is wrong here.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::drawTiled):
+        * platform/graphics/Image.h:
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawBitmapPattern):
+        * platform/graphics/wince/ImageBufferWince.cpp:
+        (WebCore::):
+        (WebCore::BufferedImage::drawPattern):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::drawPattern):
+        (WebCore::Image::drawPattern):
+
+2009-12-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32637
+        [V8] Generate most named property getters.
+
+        Covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added generation of SetNamedPropertyHandler call.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed now-generated SetNamedPropertyHandler callsites.
+
+2009-12-16  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Implement combobox delegate for Qt
+        https://bugs.webkit.org/show_bug.cgi?id=32550
+
+        Abstract popup menu factory.
+
+        A static method from QtAbstractPopupMenu is used to create its instances. If a factory
+        has been suplied to class QtAbstractPopupMenu the factory will be used to create the
+        objects. If not an instance of QtFallbackPopupMenu will be created.
+
+        The objective is to make it easy to replace the combobox popup at WebCore layer providing
+        support to the combobox popup delegation API. Future patches will make it possible to
+        replace the combobox popup at WebKit layer.
+
+        No behavior changes.
+
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::setFactory):
+        (WebCore::QtAbstractWebPopup::create):
+        * platform/qt/QtAbstractWebPopup.h:
+        * platform/qt/QtFallbackWebPopup.cpp:
+
+2009-12-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Disable debug variants of WebKit frameworks.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-16  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Right clicking in a table cell creates a selection that extends into the next cell.
+        <rdar://problem/5565465>
+        https://bugs.webkit.org/show_bug.cgi?id=32622
+        
+        Avoid extending the selection to the next cell if we start from an empty cell.
+
+        Test: editing/selection/empty-cell-right-click.html
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed): Replaced the code that check for empty table cell
+        with a call to the new function.
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity): Extends the
+        selection only if we are not starting from an empty table cell.
+        * editing/htmlediting.cpp:
+        (WebCore::isEmptyTableCell): Added a function since this check is performed now in two places.
+        * editing/htmlediting.h: Added isEmptyTableCell declaration.
+
+2009-12-16  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        feMerge crahses if feMergeNodes attribute in is empty
+        https://bugs.webkit.org/show_bug.cgi?id=32489
+
+        SVGFEMergeElement only stored pointers to all effects of it's nodes
+        in a list. But it should store the RefPtr otherwise the effects get
+        dereferenced and WebKit crashes.
+        I also made a short clean-up in SVGFilterBuilder. No change in
+        functionality.
+
+        Test: I updated svg/custom/empty-merge.svg to cover this problem.
+
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::build):
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::FEMerge):
+        (WebCore::FEMerge::create):
+        (WebCore::FEMerge::mergeInputs):
+        (WebCore::FEMerge::setMergeInputs):
+        * svg/graphics/filters/SVGFEMerge.h:
+        * svg/graphics/filters/SVGFilterBuilder.cpp:
+        (WebCore::SVGFilterBuilder::add):
+
+2009-12-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Part of <http://webkit.org/b/32568>.
+        Web Inspector: Context Menus should be used in more places.
+        
+        Add a context menu entry in the console to clear the console. This
+        is only shown when there is no user selection of text, because if
+        there is selection of the text, then we want to give the user the Copy +
+        Spell Check context menu that they are used to.
+
+        * English.lproj/localizedStrings.js: Added "Clear Console".
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._handleContextMenuEvent):
+
+2009-12-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=32621>.
+        Web Inspector: [REGRESSION (52095-52100)] Resources filter disappears when switching 
+        from / to resources panel.
+
+        Changed style in sidebar-resizer-vertical, because if the min-height was 100%, we start
+        to cover the scope bar.
+
+        * inspector/front-end/inspector.css:
+
+2009-12-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Switch all indexers to be generated.
+        https://bugs.webkit.org/show_bug.cgi?id=32569
+
+        Covered by existing tests.
+
+        * WebCore.gypi: Remove V8FileListCustom.cpp and V8ClientRecListCustom.cpp,
+            as they are now generated.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Remove customization of ClientRectList,
+            FileList, and DataGridColumnList templates.
+        * bindings/v8/custom/V8ClientRectListCustom.cpp: Removed.
+        * bindings/v8/custom/V8CustomBinding.h: Remove custom indexer getter decls.
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp: Remove indexer getter definition.
+        * bindings/v8/custom/V8FileListCustom.cpp: Removed.
+
+2009-12-16  anton muhin  <antonm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        [dom] make dom/Node.cpp compile if DUMP_NODE_STATISTICS is on
+        https://bugs.webkit.org/show_bug.cgi?id=32617
+
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics):
+
+2009-12-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] There is no such thing as HTMLSelectElementCollection.
+        https://bugs.webkit.org/show_bug.cgi?id=32616
+
+        Refactoring, covered by existing tests.
+
+        * WebCore.gypi: Removed V8HTMLSelectElementCollectionCustom.cpp
+        * bindings/v8/V8Collection.h: Removed one-off template.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Renamed all references to HTMLSelectElementCollection
+            to HTMLSelectElement.
+        * bindings/v8/custom/V8CustomBinding.h: Renamed custom indexer decls.
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp: Removed.
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp: Moved code as-is from
+            V8HTMLSelectElementCollectionCustom.cpp
+
+2009-12-16  Dan Winship  <danw@gnome.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Content-Encoding support
+
+        https://bugs.webkit.org/show_bug.cgi?id=25855
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp): Don't force "Accept-Encoding: identity" any
+        more
+
+2009-12-16  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Darin Adler.
+
+        Get rid of the phase argument to Image::drawPattern.
+        https://bugs.webkit.org/show_bug.cgi?id=31187
+
+        The argument can be expressed equally well as part of the
+        patternTransform. All backends but the Qt one did exactly that
+        manually anyway.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::drawTiled):
+        * platform/graphics/Image.h:
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawBitmapPattern):
+        * platform/graphics/wince/ImageBufferWince.cpp:
+        (WebCore::):
+        (WebCore::BufferedImage::drawPattern):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::drawPattern):
+        (WebCore::Image::drawPattern):
+
+2009-12-16  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Performance problems with index validation code for drawElements
+        https://bugs.webkit.org/show_bug.cgi?id=32466
+
+        Added a cache of the maximum index for each element type to
+        WebGLBuffer, querying it before iterating through the indices in
+        the client-side copy of the buffer's data. Hoisted checks of the
+        size of the element array itself into validateElementArraySize to
+        avoid duplicating code.
+
+        The performance improvement has been measured with manual tests.
+        Existing layout tests cover the index validation functionality
+        and continue to pass as before.
+
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        (WebCore::WebGLBuffer::associateBufferData):
+        (WebCore::WebGLBuffer::associateBufferSubData):
+        (WebCore::WebGLBuffer::getCachedMaxIndex):
+        (WebCore::WebGLBuffer::setCachedMaxIndex):
+        (WebCore::WebGLBuffer::clearCachedMaxIndices):
+        * html/canvas/WebGLBuffer.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::validateElementArraySize):
+        (WebCore::WebGLRenderingContext::validateIndexArrayConservative):
+        (WebCore::WebGLRenderingContext::validateIndexArrayPrecise):
+        (WebCore::WebGLRenderingContext::validateRenderingState):
+        (WebCore::WebGLRenderingContext::drawElements):
+        * html/canvas/WebGLRenderingContext.h:
+
+2009-12-16  Zelidrag Hornung  <zelidrag@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32261
+        Added ability to separate the autocomplete suggestion previewing from
+        the actual accepting of the suggested value in HTMLInputElement.
+        This element (it's single line text incarnation) can now
+        be put in suggestion mode where renderer might display the suggested
+        value without making it automatically exposed to JavaScript.
+
+        No new tests. This new methods are not exposed yet. It's use will be
+        platform specific. PopupMenu and Chromium specific changes will be
+        separated based on Darin Adler's comments.
+
+        * dom/InputElement.h:
+        (WebCore::InputElementData::suggestedValue):
+        (WebCore::InputElementData::setSuggestedValue):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::suggestedValue):
+        (WebCore::HTMLInputElement::setSuggestedValue):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        * html/HTMLInputElement.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::suggestedValue):
+        * wml/WMLInputElement.h:
+
+2009-12-16  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make Elements tree, properties section and resources
+        view monospace.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32609
+
+        * inspector/front-end/ElementsPanel.js:
+        * inspector/front-end/PropertiesSection.js:
+        (WebInspector.PropertiesSection):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        * inspector/front-end/inspector.css:
+
+2009-12-16  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        sourceGraphic wrong if positive x,y is >0 and objectBB is selected on Filter
+        https://bugs.webkit.org/show_bug.cgi?id=32575
+
+        On SVG Filters, the rest of the source graphic gets clipped to the filter
+        rest. This helps us to minimize the size of intermediate ImageBuffers. If
+        the position moves to the right or to the bottom, we have to adjust the
+        GraphicContext of this intermediate ImageBuffer.
+        This patch fixes the adjustment of the context, according to the clipping.
+
+        Test: svg/filters/filter-source-position.svg
+
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::prepareFilter):
+
+2009-12-16  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        CrashTracer: [USER] 1 crash in Safari at com.apple.WebCore: WebCore::endsOfNodeAreVisuallyDistinctPositions + 115
+        <rdar://problem/7467108>
+        https://bugs.webkit.org/show_bug.cgi?id=32590
+
+        If the element is a button there is no need to look at the children to calculate the caret position.
+        
+        Test: editing/selection/button-right-click.html
+
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset): Avoid calling recursively this method,
+        when starting from a button element.
+
+2009-12-16  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Implement combobox delegate for Qt
+        https://bugs.webkit.org/show_bug.cgi?id=32550
+
+        Refactoring of class QWebPopup.
+
+        Class QWebPopup has been split in QtAbstractWebPopup and QtFallbackWebPopup.
+        Both new classes are now in corresponding files and files QWebPopup.* have been removed.
+
+        Custom combo popup classes will inherit from QtAbstractWebPopup. It is not the public API as it is
+        in WebCore and will not be visible by users of QtWebKit. It will be used in implementation of
+        public QtWebKit combobox popup delegation API.
+
+        Class QtFallbackWebPopup inherits from QtAbstractWebPopup and implements the currently used combobox popup.
+        It needs to be improved to provide standard features that are missing like style or indentation.
+
+        No behavior changes.
+
+        * WebCore.pro:
+        * platform/PopupMenu.h:
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        * platform/qt/QWebPopup.cpp: Removed.
+        * platform/qt/QWebPopup.h: Removed.
+        * platform/qt/QtAbstractWebPopup.cpp: Added.
+        (WebCore::QtAbstractWebPopup::QtAbstractWebPopup):
+        (WebCore::QtAbstractWebPopup::~QtAbstractWebPopup):
+        (WebCore::QtAbstractWebPopup::client):
+        * platform/qt/QtAbstractWebPopup.h: Added.
+        * platform/qt/QtFallbackWebPopup.cpp: Added.
+        (WebCore::QtFallbackWebPopup::QtFallbackWebPopup):
+        (WebCore::QtFallbackWebPopup::show):
+        (WebCore::QtFallbackWebPopup::populate):
+        (WebCore::QtFallbackWebPopup::showPopup):
+        (WebCore::QtFallbackWebPopup::hidePopup):
+        (WebCore::QtFallbackWebPopup::activeChanged):
+        * platform/qt/QtFallbackWebPopup.h: Added.
+        (WebCore::QtFallbackWebPopup::hide):
+
+2009-12-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: beautify HTTP info section.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32583
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._refreshURL):
+        (WebInspector.ResourceView.prototype._refreshHTTPInformation):
+        * inspector/front-end/inspector.css:
+
+2009-12-13  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix crash when encountering illegal HTML within a continuation inside <ruby>.
+        (https://bugs.webkit.org/show_bug.cgi?id=32316)
+
+        Avoid having the anonymous blocks utilized in the ruby renderers being
+        re-used as continuation blocks.
+        Avoid having ruby runs collected as "leftover blocks".
+
+        Test: fast/ruby/ruby-illegal.html
+
+        * rendering/RenderRuby.h:
+        (WebCore::RenderRubyAsInline::removeLeftoverAnonymousBlock): mustn't be called
+        (WebCore::RenderRubyAsInline::isRuby): made private
+        (WebCore::RenderRubyAsInline::renderName): made private
+        (WebCore::RenderRubyAsInline::createsAnonymousWrapper): return true
+        (WebCore::RenderRubyAsBlock::removeLeftoverAnonymousBlock): mustn't be called
+        (WebCore::RenderRubyAsBlock::isRuby): made private
+        (WebCore::RenderRubyAsBlock::renderName): made private
+        (WebCore::RenderRubyAsBlock::createsAnonymousWrapper): return true
+        * rendering/RenderRubyRun.h:
+        (WebCore::RenderRubyRun::removeLeftoverAnonymousBlock): avoid
+        (WebCore::RenderRubyRun::isRubyRun): made private
+        (WebCore::RenderRubyRun::renderName): made private
+        (WebCore::RenderRubyRun::createsAnonymousWrapper): return true
+
+2009-12-15  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Rename skipCanLoadCheck to skipSecurityCheck in a bunch of places in WebCore/loader.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32529
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestUserCSSStyleSheet):
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::load):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::load):
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::load):
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        (WebCore::DocumentThreadableLoader::preflightSuccess):
+        (WebCore::DocumentThreadableLoader::loadRequest):
+        * loader/DocumentThreadableLoader.h:
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+        * loader/Request.cpp:
+        (WebCore::Request::Request):
+        * loader/Request.h:
+        (WebCore::Request::shouldDoSecurityCheck):
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * loader/SubresourceLoader.h:
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::Host::servePendingRequests):
+        * loader/loader.h:
+
+2009-12-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7470452> Safari/Chromium crashes on complicated @font-face rule
+        https://bugs.webkit.org/show_bug.cgi?id=32257
+
+        Test: fast/css/font-face-unused-source-loaded.html
+
+        The loading of a font resource caused a CSSFontFace that had the resource in one of its
+        sources, but wasn’t using it (due to using an earlier source) to invalidate its
+        CSSSegmentedFontFaces. This caused FontData for the active source (the one that did not just
+        finish loading) to be deleted, but that went unnoticed by Font::operator==(), since the
+        corresponding FontFallbackLists were not in the loading state. The fix is for CSSFontFace to
+        ignore loads from unused sources.
+
+        * css/CSSFontFace.cpp:
+        (WebCore::CSSFontFace::fontLoaded): Bail out if the loaded source is not the active source.
+        (WebCore::CSSFontFace::getFontData): Set m_activeSource to the source that supplied the
+            FontData.
+        * css/CSSFontFace.h:
+        (WebCore::CSSFontFace::CSSFontFace): Initialize m_activeSource.
+
+2009-12-15  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Cannot load flash files from a local file.
+        https://bugs.webkit.org/show_bug.cgi?id=32572
+
+        When loading the main resource and its mime type is application/octet-stream,
+        use the file extenstion to check if it is a supported plugin.
+
+        No new tests were added since any existing swf file can be used as a manual test.
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        * loader/MainResourceLoader.h:
+        * plugins/PluginDatabase.h:
+
+2009-12-15  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=18498>.
+        REGRESSION: Tips are not shown for resources anymore.
+        
+        As discussed in the bug, Tips are not coming back, and the feature
+        will be moved to the audits panel. This patch is to remove the Tips
+        code and the resources that it needed.
+
+        * WebCore.gypi: Removed tips files.
+        * inspector/front-end/Images/tipBalloon.png: Removed.
+        * inspector/front-end/Images/tipBalloonBottom.png: Removed.
+        * inspector/front-end/Images/tipIcon.png: Removed.
+        * inspector/front-end/Images/tipIconPressed.png: Removed.
+        * inspector/front-end/Resource.js: Removed tips code.
+        (WebInspector.Resource.prototype.set finished): 
+        * inspector/front-end/WebKit.qrc: Removed tips files.
+        * inspector/front-end/inspector.css: Removes tips style rules.
+        
+2009-12-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Display request headers for main resource
+        having redirects.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32577
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource):
+        (WebCore::InspectorResource::appendRedirect):
+        (WebCore::InspectorResource::createCached):
+        (WebCore::InspectorResource::updateRequest):
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::create):
+
+2009-12-15  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=32578>.
+        Web Inspector: No Need for ?="" now that we have context menus.
+        
+        Remove the toggleNewAttributeButton function and callers to it, as
+        we don't need this behavior anymore, now that we have context menus.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.set hovered):
+        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton):
+        (WebInspector.ElementsTreeElement.prototype._startEditing):
+
+2009-12-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Generate trivial named property getters.
+        https://bugs.webkit.org/show_bug.cgi?id=32562
+
+        Covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added GenerateImplementationNamedPropertyGetter.
+        * bindings/v8/V8Collection.h:
+        (WebCore::getNamedPropertyOfCollection): Fixed a booboo by using AtomicString like we're supposed to.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed code that's now generated.
+
+2009-12-15  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Part of <http://webkit.org/b/32568>.
+        New Web Inspector: The Context Menu should be used in more places.
+        
+        Add support for context menu entries for editing and deleting elements
+        in the datagrid. This gives support to deleting cookies, and editing and
+        deleting session storage and local storage.
+
+        * English.lproj/localizedStrings.js: Added "Edit" and "Add New" entries (delete was already there)
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid): Added context menu listener.
+        (WebInspector.DataGrid.prototype._contextMenuInDataTable):
+
+2009-12-15  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Don't allow default framebuffer to be mutated
+        https://bugs.webkit.org/show_bug.cgi?id=32391
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::framebufferRenderbuffer):
+        (WebCore::WebGLRenderingContext::framebufferTexture2D):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::bindFramebuffer):
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for FontPlatformDataCacheKey class
+        https://bugs.webkit.org/show_bug.cgi?id=32552
+
+        Inherits the following struct from FastAllocBase because it is instantiated by 'new':
+
+        struct name                     - instantiated at: WebCore/'location'
+        struct FontPlatformDataCacheKey - platform/graphics/FontCache.cpp:118
+
+        * platform/graphics/FontCache.cpp:
+
+2009-12-15  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Bug 31090 - [Chromium] Add DownloadURL format to Chromium clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=31090
+
+        The proposal to whatwg can be found here:
+        http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-August/022118.html
+
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::hasData):
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ChromiumDataObject.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::):
+        (WebCore::clipboardTypeFromMIMEType):
+        (WebCore::ClipboardChromium::setData):
+
+2009-12-15  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: implement treegrid
+        https://bugs.webkit.org/show_bug.cgi?id=31299
+
+        Test: platform/mac/accessibility/aria-treegrid.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityARIAGrid.h:
+        (WebCore::AccessibilityARIAGrid::supportsSelectedRows):
+        * accessibility/AccessibilityARIAGridRow.cpp:
+        (WebCore::AccessibilityARIAGridRow::isARIATreeGridRow):
+        (WebCore::AccessibilityARIAGridRow::disclosedRows):
+        (WebCore::AccessibilityARIAGridRow::disclosedByRow):
+        * accessibility/AccessibilityARIAGridRow.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        (WebCore::AccessibilityObject::isARIATreeGridRow):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isMultiSelectable):
+        (WebCore::AccessibilityRenderObject::setIsExpanded):
+        (WebCore::AccessibilityRenderObject::setSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        (WebCore::AccessibilityRenderObject::selectedChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilityTable.h:
+        (WebCore::AccessibilityTable::supportsSelectedRows):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for EmptyEditorClient and EmptyInspectorClient
+        https://bugs.webkit.org/show_bug.cgi?id=32557
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class name                 - instantiated at: WebCore/'location'
+        class EmptyEditorClient    - svg/graphics/SVGImage.cpp:230
+        class EmptyInspectorClient - svg/graphics/SVGImage.cpp:241
+
+        * loader/EmptyClients.h:
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore/inspector directory's classes
+        https://bugs.webkit.org/show_bug.cgi?id=32556
+
+        Inherits the following class from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class name                   - instantiated at: WebCore/'location'
+        class InspectorFrontend      - inspector/InspectorController.cpp:538
+        class InspectorTimelineAgent - inspector/InspectorController.cpp:1097
+
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorTimelineAgent.h:
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore/platform/network directory's classes
+        https://bugs.webkit.org/show_bug.cgi?id=32553
+
+        Inherits the following class from Noncopyable because it is instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name                      - instantiated at: WebCore/'location'
+
+        struct CrossThreadResourceResponseData - platform/network/ResourceResponseBase.cpp:109
+
+        Inherits the following classes from FastAllocBase because these are
+        instantiated by 'new':
+
+        class ResourceResponseBase - (its child class) platform/network/ResourceResponseBase.cpp:90
+        class ResourceRequestBase  - (its child class) loader/DocumentThreadableLoader.cpp:88
+
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/ResourceResponseBase.h:
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for AnimationControllerPrivate and FillLayerPropertyWrapperGetter
+        https://bugs.webkit.org/show_bug.cgi?id=32549
+
+        Inherits AnimationControllerPrivate and FillLayerPropertyWrapperGetter
+        classes from Noncopyable because these are instantiated by 'new' and no need to be copyable:
+
+        class/struct name              - instantiated at: WebCore/'location'
+
+        AnimationControllerPrivate     - page/animation/AnimationController.cpp:439
+        FillLayerPropertyWrapperGetter - (its child class) page/animation/AnimationBase.cpp:464
+
+        * page/animation/AnimationBase.cpp:
+        * page/animation/AnimationControllerPrivate.h:
+
+2009-12-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not lose HTTP redirect information, display it
+        in the Resources Panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32551
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource):
+        (WebCore::InspectorResource::appendRedirect):
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::releaseScriptObject):
+        (WebCore::InspectorResource::type):
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::):
+        (WebCore::InspectorResource::Changes::setAll):
+        * inspector/front-end/inspector.js:
+        (WebInspector._addResource):
+        (WebInspector.updateResource):
+
+2009-12-15  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Followup for direct signals and slots connections in QNetworkReplyHandler
+        https://bugs.webkit.org/show_bug.cgi?id=32113
+
+        For Qt versions prior to 4.6.1 we will need to use QueuedConnection
+        for the signal and slot connection to avoid running into a bug in.
+
+        Add a comment that we want to remove one signal to forward
+        queued items when moving our minimum requirements.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-12-14  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add manual test for JavaScript prompt corner case
+        https://bugs.webkit.org/show_bug.cgi?id=30914
+
+        The patch is based on the work done by Gupta Manish.
+
+        Verify behavior of the JavaScript prompt function. Currently
+        Qt is not behaving like other WebKit ports and Firefox in
+        regards to accepting the prompt but not entering a text.
+
+        * manual-tests/qt/java-script-prompt.html: Added.
+
+2009-12-15  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Moving list populate methods from PopupMenuQt to QWebPopup.
+        
+        In preparation to future implementation of a delegation API for the combobox.
+
+        * platform/PopupMenu.h:
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        * platform/qt/QWebPopup.cpp:
+        (WebCore::QWebPopup::show):
+        (WebCore::QWebPopup::populate):
+        * platform/qt/QWebPopup.h:
+        (WebCore::QWebPopup::hide):
+
+2009-12-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Extract WebInspector.Section from WebInspector.PropertiesSection.
+        https://bugs.webkit.org/show_bug.cgi?id=32523
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/PropertiesSection.js:
+        (WebInspector.PropertiesSection):
+        * inspector/front-end/Section.js: Added.
+        (WebInspector.Section):
+        (WebInspector.Section.prototype.get title):
+        (WebInspector.Section.prototype.set title):
+        (WebInspector.Section.prototype.get subtitle):
+        (WebInspector.Section.prototype.set subtitle):
+        (WebInspector.Section.prototype.get expanded):
+        (WebInspector.Section.prototype.set expanded):
+        (WebInspector.Section.prototype.get populated):
+        (WebInspector.Section.prototype.set populated):
+        (WebInspector.Section.prototype.expand):
+        (WebInspector.Section.prototype.collapse):
+        (WebInspector.Section.prototype.toggleExpanded):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-12-15  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52140.
+        http://trac.webkit.org/changeset/52140
+        https://bugs.webkit.org/show_bug.cgi?id=31299
+
+        The commit broke the Leopard bots and unfortunately
+        Chris wasn't around to fix them, so I'm rolling the change
+        out after 3 hours so that the bots can roll green again. :)
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityARIAGrid.h:
+        * accessibility/AccessibilityARIAGridRow.cpp:
+        * accessibility/AccessibilityARIAGridRow.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isMultiSelect):
+        (WebCore::AccessibilityRenderObject::setIsExpanded):
+        (WebCore::AccessibilityRenderObject::setSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaTreeSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        (WebCore::AccessibilityRenderObject::selectedChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilityTable.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+
+2009-12-14  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove dead code from FontPlatformDataQt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=32540
+
+        In r51758 the code that used familyNames was removed
+        and we should remove the creation of the familyNames
+        as well.
+
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-12-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebCore part of <rdar://problem/7173515> Use LOGFONT support in Core
+        Graphics when available
+
+        When using a version of Core Graphics with LOGFONT support, this fixes
+        <rdar://problem/5764844> First-time launch is painfully slow due to font
+        plist creation
+        and <rdar://problem/6576281> 12px synthetic-italics Tahoma text is less
+        readable in Safari than in Firefox/IE due to poorly-spaced letters
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs): No longer call drawGDIGlyphs for stroked
+        text.
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::createGDIFont): Added a synthesizeItalic parameter. When set
+        to true, if italics are desired but the best match lacks italics,
+        creates and returns a synthetic italics font.
+        (WebCore::FontCache::createFontPlatformData): Ask to synthesize italics
+        if needed.
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData): Updated an
+        assertion, and changed to create the CGFont from the LOGFONT.
+        (WebCore::createFontCustomPlatformData): Changed cgFont to be a
+        RetainPtr. Do not create a CGFont from the font data if it can be
+        created from the LOGFONT in fontPlatformData().
+        * platform/graphics/win/FontDatabase.cpp:
+        (WebCore::populateFontDatabase): Avoid font database work if fonts are
+        not going to be looked up by name.
+        * platform/graphics/win/FontPlatformDataCGWin.cpp:
+        (WebCore::FontPlatformData::platformDataInit): Create the CGFont from
+        a LOGFONT based on the HFONT.
+
+2009-12-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: implement treegrid
+        https://bugs.webkit.org/show_bug.cgi?id=31299
+
+        Test: platform/mac/accessibility/aria-treegrid.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityARIAGrid.h:
+        (WebCore::AccessibilityARIAGrid::supportsSelectedRows):
+        * accessibility/AccessibilityARIAGridRow.cpp:
+        (WebCore::AccessibilityARIAGridRow::isARIATreeGridRow):
+        (WebCore::AccessibilityARIAGridRow::disclosedRows):
+        (WebCore::AccessibilityARIAGridRow::disclosedByRow):
+        * accessibility/AccessibilityARIAGridRow.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isARIATreeGridRow):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isMultiSelectable):
+        (WebCore::AccessibilityRenderObject::setIsExpanded):
+        (WebCore::AccessibilityRenderObject::setSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        (WebCore::AccessibilityRenderObject::selectedChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilityTable.h:
+        (WebCore::AccessibilityTable::supportsSelectedRows):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+
+2009-12-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7460655> REGRESSION (r47255): Content shifted down at software.opensuse.org
+        https://bugs.webkit.org/show_bug.cgi?id=32382
+
+        Test: fast/block/float/in-margin.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::getClearDelta): Floats that do not intrude into the line (because
+        they are in the margin) do not need to be cleared.
+
+2009-12-14  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Pressing backspace inside a table cell erases all empty rows below it.
+        <rdar://problem/5565461>
+        https://bugs.webkit.org/show_bug.cgi?id=32526
+
+        No deletion is performed when the caret selection is on an empty table cell.
+        
+        Test: editing/deleting/delete-empty-table.html
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed): Added check for empty table cells in
+        case of caret selection.
+
+2009-12-14  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Darin Adler.
+
+        [Android] Android needs ResourceHandle implementation
+        https://bugs.webkit.org/show_bug.cgi?id=32515
+
+        Adds implementation of ResourceHandle on Android.
+
+        No new tests needed, this is platform-specific code, so existing
+        tests are sufficient.
+
+        * platform/network/android/ResourceHandleAndroid.cpp: Added.
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::ResourceHandle::bufferedData):
+        (WebCore::ResourceHandle::supportsBufferedData):
+        (WebCore::ResourceHandle::setDefersLoading):
+        (WebCore::ResourceHandle::willLoadFromCache):
+        (WebCore::ResourceHandle::loadsBlocked):
+        (WebCore::SyncLoader::SyncLoader):
+        (WebCore::SyncLoader::~SyncLoader):
+        (WebCore::SyncLoader::didReceiveResponse):
+        (WebCore::SyncLoader::didReceiveData):
+        (WebCore::SyncLoader::didFail):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        * platform/network/android/ResourceLoaderAndroid.h: Added.
+        (WebCore::ResourceLoaderAndroid::~ResourceLoaderAndroid):
+        (WebCore::ResourceLoaderAndroid::ResourceLoaderAndroid):
+
+2009-12-14  Marco Martin  <notmart@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        In the Scrollbar painting of the Qt theme integration,
+        intersects any previous clip rects with the one needed to paint the scrollbar.
+        This fixes the painting in QGraphicsview, when the parent of the widget that 
+        paints the QWebPage has the QGraphicsItem::ItemClipsChildrenToShape set and
+        a piece of the scrollbar should be cipped away
+        https://bugs.webkit.org/show_bug.cgi?id=30366
+
+        No new tests.
+
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::paint):
+
+2009-12-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Generate bindings for trivial indexers.
+        https://bugs.webkit.org/show_bug.cgi?id=32455
+
+        Covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+            Added detecting indexers and generating code for them.
+        * bindings/v8/V8Collection.h: Removed code that's now generated.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Ditto.
+
+2009-12-14  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31660
+        REGRESSION (r49394): Image load event fires before the document fragment is attached.
+
+        Test: fast/images/image-load-event-in-fragment.html
+
+        We cannot fire load events immediately after parsing a fragment - an element inserted via
+        innerHTML or equivalent should be reachable via getElementById() by the time its load event
+        fires.
+
+        * dom/Document.cpp: (WebCore::Document::implicitClose): Call dispatchPendingBeforeLoadEvents()
+        and dispatchPendingLoadEvents() individually. I'm not sure why these calls are here, just
+        preserving existing behavior.
+
+        * dom/XMLTokenizer.cpp: (WebCore::XMLTokenizer::write):
+        * html/HTMLTokenizer.cpp: (WebCore::HTMLTokenizer::write):
+        Load events for elements that have just been parsed cannot be dispatched yet, we should give
+        the elements a chance to be inserted into a document first. There is no compatibility baggage
+        for beforeload, so it seems OK to dispatch it right away.
+
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvents):
+        (WebCore::ImageLoader::dispatchPendingLoadEvents):
+        * loader/ImageLoader.h:
+        Separated dispatchPendingEvents() into individual functions for each event kind.
+
+2009-12-14  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        Add FloatQuad::isRectilinear() to check whether it can be represented as FloatRect.
+        https://bugs.webkit.org/show_bug.cgi?id=30442
+
+        This enables optimizations for distinguishing between
+        arbitrary FloatQuads and rectilinear ones.
+
+        * platform/graphics/FloatQuad.cpp:
+        (WebCore::FloatQuad::isRectilinear):
+        * platform/graphics/FloatQuad.h:
+
+2009-12-14  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Add support for keyboard modifiers to TouchEvent
+
+        https://bugs.webkit.org/show_bug.cgi?id=32482
+
+        Similar to other ui events with keyboard state, get the alt, shift,
+        meta and ctrl modifiers straight from the platform event.
+
+        * dom/TouchEvent.cpp:
+        (WebCore::TouchEvent::TouchEvent):
+        (WebCore::TouchEvent::initTouchEvent):
+        * dom/TouchEvent.h:
+        (WebCore::TouchEvent::create):
+        * dom/TouchEvent.idl:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent):
+        * platform/PlatformTouchEvent.h:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+        (WebCore::PlatformTouchEvent::shiftKey):
+        (WebCore::PlatformTouchEvent::ctrlKey):
+        (WebCore::PlatformTouchEvent::altKey):
+        (WebCore::PlatformTouchEvent::metaKey):
+        * platform/qt/PlatformTouchEventQt.cpp:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+
+2009-12-14  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] crash when clicking "Sign out" in GMail
+        https://bugs.webkit.org/show_bug.cgi?id=32300
+
+        When the ResourceLoader cancels the handle we have to make sure not to access
+        the resource handle afterwards again.
+        This complete r29515
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-12-14  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Implement InjectedScript.evaluateOnSelf() that evaluates functions in the InjectedScript context.
+        https://bugs.webkit.org/show_bug.cgi?id=32517
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluateOnSelf):
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-12-14  Nayan Kumar K  <nayankk@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for compilation errors in WML enabled builds.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32481
+
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::setValueForUser):
+        * wml/WMLInputElement.h:
+
+2009-12-14  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Darin Adler.
+
+        [Android] Android needs ResourceError, ResourceResponse and
+        ResourceRequest implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=32522
+
+        Add implementation of ResourceError, ResourceResponse and ResourceRequest.
+        No new tests needed, the existing tests should be sufficient.
+
+        * platform/network/android/ResourceError.h: Added.
+        (WebCore::ResourceError::ResourceError):
+        * platform/network/android/ResourceRequest.h: Added.
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::setUserGesture):
+        (WebCore::ResourceRequest::getUserGesture):
+        * platform/network/android/ResourceResponse.h: Added.
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::doUpdateResourceResponse):
+
+2009-12-14  Sam Weinig  <sam@webkit.org>
+
+        Fix the build.
+
+        * page/Geolocation.cpp:
+        * page/Geolocation.h:
+
+2009-12-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32499
+        Add client based Geolocation provider
+
+        Add first cut of a client based Geolocation provider. This is guarded by
+        ENABLE(CLIENT_BASED_GEOLOCATION) and is off by default for now. This adds a
+        GeolocationControllerClient interface that no-one currently implements,
+        but will in a subsequent patch.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * page/Geolocation.cpp:
+        (WebCore::createGeopositionFromGeolocationPosition):
+        (WebCore::createPositionErrorFromGeolocationError):
+        (WebCore::Geolocation::Geolocation):
+        (WebCore::Geolocation::~Geolocation):
+        (WebCore::Geolocation::disconnectFrame):
+        (WebCore::Geolocation::lastPosition):
+        (WebCore::Geolocation::startRequest):
+        (WebCore::Geolocation::fatalErrorOccurred):
+        (WebCore::Geolocation::requestTimedOut):
+        (WebCore::Geolocation::clearWatch):
+        (WebCore::Geolocation::handleError):
+        (WebCore::Geolocation::positionChanged):
+        (WebCore::Geolocation::makeSuccessCallbacks):
+        (WebCore::Geolocation::errorOccurred):
+        (WebCore::Geolocation::geolocationServicePositionChanged):
+        (WebCore::Geolocation::geolocationServiceErrorOccurred):
+        (WebCore::Geolocation::startUpdating):
+        (WebCore::Geolocation::stopUpdating):
+        * page/Geolocation.h:
+        * page/GeolocationController.cpp: Added.
+        (WebCore::GeolocationController::GeolocationController):
+        (WebCore::GeolocationController::~GeolocationController):
+        (WebCore::GeolocationController::addObserver):
+        (WebCore::GeolocationController::removeObserver):
+        (WebCore::GeolocationController::positionChanged):
+        (WebCore::GeolocationController::errorOccurred):
+        (WebCore::GeolocationController::lastPosition):
+        * page/GeolocationController.h: Added.
+        * page/GeolocationControllerClient.h: Added.
+        (WebCore::GeolocationControllerClient::~GeolocationControllerClient):
+        * page/GeolocationError.h: Added.
+        (WebCore::GeolocationError::):
+        (WebCore::GeolocationError::create):
+        (WebCore::GeolocationError::code):
+        (WebCore::GeolocationError::message):
+        * page/GeolocationPosition.h: Added.
+        (WebCore::GeolocationPosition::create):
+        (WebCore::GeolocationPosition::timestamp):
+        (WebCore::GeolocationPosition::latitude):
+        (WebCore::GeolocationPosition::longitude):
+        (WebCore::GeolocationPosition::accuracy):
+        (WebCore::GeolocationPosition::altitude):
+        (WebCore::GeolocationPosition::altitudeAccuracy):
+        (WebCore::GeolocationPosition::heading):
+        (WebCore::GeolocationPosition::speed):
+        (WebCore::GeolocationPosition::canProvideAltitude):
+        (WebCore::GeolocationPosition::canProvideAltitudeAccuracy):
+        (WebCore::GeolocationPosition::canProvideHeading):
+        (WebCore::GeolocationPosition::canProvideSpeed):
+        (WebCore::GeolocationPosition::GeolocationPosition):
+        * page/Geoposition.h:
+        (WebCore::Geoposition::create):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        * page/Page.h:
+        (WebCore::Page::geolocationController):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+
+2009-12-14  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Adler.
+
+        Test that an image's size is valid before reading it.
+
+        Previously, an image that failed to load (m_failed == true) would
+        trigger an assertion failure when WebKit tried to get its size.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32176
+        http://code.google.com/p/chromium/issues/detail?id=28566
+
+        Test: fast/images/size-failure.html
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::createFrameAtIndex):
+
+2009-12-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7458272> REGRESSION (r50470) Reproducible ASSERT in
+        RenderWidget::setWidgetGeometry()
+
+        Test: fast/forms/defer-updateFromElement.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::updateFromElementCallback): Added this post-attach callback
+        that invokes updateFromElement().
+        (WebCore::HTMLFormControlElement::recalcStyle): Instead of calling
+        updateFromElement(), enqueue a post-attach (in this case, post-style
+        recalc) callback to do it. updateFromElement() can cause the selection
+        to change, and in turn trigger synchronous layout, so it must not be
+        called during style recalc.
+
+2009-12-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [regression] inspector deletes nodes when editing css.
+
+        Now all the treeoutlines are focusable, sections and their titles
+        are also focusable. Change contains couple of drive-by fixes such as
+        canceling of the attribute edit nuking attr info and maintaining proper
+        selection while deleting nodes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32460
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.handleShortcut):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._promptKeyDown):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype._keyDown):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView):
+        (WebInspector.DatabaseQueryView.prototype._promptKeyDown):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.get defaultFocusedElement):
+        (WebInspector.ElementsPanel.prototype.handleShortcut):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline):
+        (WebInspector.ElementsTreeOutline.prototype._keyDown):
+        (WebInspector.ElementsTreeElement.prototype._textNodeEditingCommitted):
+        (WebInspector.ElementsTreeElement.prototype._editingCancelled):
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.show):
+        (WebInspector.Panel.prototype.get defaultFocusedElement):
+        * inspector/front-end/PropertiesSection.js:
+        (WebInspector.PropertiesSection):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get defaultFocusedElement):
+        (WebInspector.ScriptsPanel.prototype.handleShortcut):
+        * inspector/front-end/SidebarPane.js:
+        (WebInspector.SidebarPane):
+        (WebInspector.SidebarPane.prototype.toggleExpanded):
+        (WebInspector.SidebarPane.prototype._onTitleKeyDown):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.documentCanCopy):
+        (WebInspector.documentCopy):
+        (WebInspector._searchFieldManualFocus):
+        (WebInspector._searchKeyDown):
+        (WebInspector.startEditing.cleanUpAfterEditing):
+        (WebInspector.startEditing.keyDownEventListener):
+        (WebInspector.startEditing):
+        * inspector/front-end/treeoutline.js:
+        (TreeOutline):
+        (TreeOutline._removeChildAtIndex):
+        (TreeOutline.prototype._treeKeyDown):
+        (TreeElement.prototype.deselect):
+        * inspector/front-end/utilities.js:
+        ():
+
+2009-12-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Guard all of JSC's wrapper cache-related members on Document.
+
+        * dom/Document.cpp:
+        (WebCore::Document::createWrapperCache): Widened the guards to the whole method.
+        * dom/Document.h: Added JSC guards to wrapper cache-related members.
+
+2009-12-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        AX: there's an infinite loop going on for some webpages - facebook.com
+        https://bugs.webkit.org/show_bug.cgi?id=32501
+
+        The problem is that parentObjectUnignored() cannot be called
+        while in accessibilityIsIgnored, because it leads to
+        recursiveness. Specifically, there were checks to determine
+        if an object was within a ARIA tree. That check should
+        1) be moved to all platforms, and 2) not call parentObjectUnignored().
+
+        Test: accessibility/hang-in-isignored.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isAllowedChildOfTree):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+
+2009-12-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6293979> Adopt shared control drawing for <video> controls on Leopard and Windows
+
+        Use MediaControllerThemeQuickTime on Leopard.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme):
+
+2009-12-14  Adam Roben  <aroben@apple.com>
+
+        Move QuartzCore-related build settings into a vsprops file
+
+        Fixes <http://webkit.org/b/32518>
+
+        Reviewed by Dan Bernstein.
+
+        * WebCore.vcproj/WebCore.vcproj: Let VS reformat the files list, added
+        WebCoreQuartzCore.vsprops to the non-Cairo configurations, moved all
+        other QuartzCore-related build settings from here...
+        * WebCore.vcproj/WebCoreQuartzCore.vsprops: ...to here.
+
+2009-12-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        handling scripts can block UI
+        https://bugs.webkit.org/show_bug.cgi?id=27612
+
+        Break execution of external scrips to smaller chunks. 
+        No new tests since no new functionality was introduced.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::HTMLTokenizer):
+        (WebCore::HTMLTokenizer::reset):
+        (WebCore::HTMLTokenizer::notifyFinished):
+        (WebCore::HTMLTokenizer::executeExternalScriptsIfReady):
+        (WebCore::HTMLTokenizer::executeExternalScriptsTimerFired):
+        (WebCore::HTMLTokenizer::continueExecutingExternalScripts):
+        * html/HTMLTokenizer.h:
+
+2009-12-03  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Connect QNetworkReply via direct connections.
+        https://bugs.webkit.org/show_bug.cgi?id=32113
+
+        In the past we have switched from auto connections to queued
+        connections to get some more stability. The problem with the
+        Queued connections is latency. Even when running simple loading
+        tests the time it takes to runs highly varies and by using
+        direct connections these tests produce a stable result.
+
+        We will have to look out for crashes coming from within the
+        QNetworkAccessManager due this patch and address them then.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-12-14  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] QtWebKit should use QImageReader::setQuality(49)
+        https://bugs.webkit.org/show_bug.cgi?id=30740
+
+        Using QImageReader::setQuality(49) will influence the JPEG
+        decoder of Qt to use the JDCT_IFAST routines for decompressing. This
+        is showing a 5% improvement in a reduction that decodes all images
+        used during the page loading test. The libjpeg documentation mentions
+        that the IFAST routine is not as accurate as other routines but in
+        our tests we couldn't see a difference.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Changed GC from mark-sweep to mark-allocate.
+
+        * ForwardingHeaders/runtime/WeakGCMap.h: Added.
+        * bindings/js/GCController.cpp:
+        (WebCore::collect):
+        (WebCore::GCController::gcTimerFired):
+        (WebCore::GCController::garbageCollectNow): Updated for rename.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::removeWrappers):
+        (WebCore::hasCachedDOMObjectWrapperUnchecked):
+        (WebCore::hasCachedDOMObjectWrapper):
+        (WebCore::hasCachedDOMNodeWrapperUnchecked):
+        (WebCore::forgetDOMObject):
+        (WebCore::forgetDOMNode):
+        (WebCore::isObservableThroughDOM):
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markDOMObjectWrapper):
+        (WebCore::markDOMNodeWrapper):
+        * bindings/js/JSDOMBinding.h: Changed DOM wrapper maps to be WeakGCMaps.
+        Don't ASSERT that an item must be in the WeakGCMap when its destructor
+        runs, since it might have been overwritten in the map first.
+
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::toJS): Changed Document from a DOM object wrapper to a DOM node
+        wrapper, to simplify some code.
+
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::JSInspectedObjectWrapper):
+        (WebCore::JSInspectedObjectWrapper::~JSInspectedObjectWrapper):
+        * bindings/js/JSInspectorCallbackWrapper.cpp: Use a WeakGCMap for these
+        wrappers.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren): Updated for WeakGCMap and Document using
+        a DOM node wrapper instead of a DOM object wrapper.
+
+        * bindings/js/JSSVGPODTypeWrapper.h:
+        (WebCore::JSSVGDynamicPODTypeWrapperCache::wrapperMap):
+        (WebCore::JSSVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
+        (WebCore::JSSVGDynamicPODTypeWrapperCache::forgetWrapper):
+        (WebCore::::~JSSVGDynamicPODTypeWrapper): Shined a small beam of sanity light
+        on this code. Use hashtable-based lookup in JSSVGPODTypeWrapper.h instead
+        of linear lookup through iteration, since that's what hashtables were
+        invented for. Make JSSVGPODTypeWrapper.h responsible for reomving itself
+        from the table, instead of its JS wrapper, to decouple these objects from
+        GC, and because these objects are refCounted, not solely owned by their
+        JS wrappers.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.h: Adopted changes above.
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Removed an incorrect #ifdef.
+
+        * bindings/js/GCController.cpp:
+
+2009-12-13  Charles Reis  <creis@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Refactor some security code out of V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=32326
+
+        No new tests. There should be no functionality changes in this patch,
+        since it is only refactoring code.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/BindingSecurity.h: Added.
+        (WebCore::BindingSecurity::BindingSecurity):
+        (WebCore::::canAccessWindow):
+        (WebCore::::canAccessFrame):
+        (WebCore::::checkNodeSecurity):
+        * bindings/BindingSecurityBase.cpp: Added.
+        (WebCore::BindingSecurityBase::getDOMWindow):
+        (WebCore::BindingSecurityBase::getFrame):
+        (WebCore::BindingSecurityBase::canAccessWindow):
+        * bindings/BindingSecurityBase.h: Added.
+        * bindings/GenericBinding.h: Added.
+        (WebCore::):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isSafeScript):
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8BindingState.cpp: Added.
+        (WebCore::::Only):
+        (WebCore::::getActiveWindow):
+        (WebCore::::immediatelyReportUnsafeAccessTo):
+        * bindings/v8/V8BindingState.h: Added.
+        (WebCore::):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::reportUnsafeAccessTo):
+        (WebCore::reportUnsafeJavaScriptAccess):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::allowSettingFrameSrcToJavascriptUrl):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+
+2009-11-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement initializeMaximumHTTPConnectionCountPerHost.
+        https://bugs.webkit.org/show_bug.cgi?id=31849
+
+        Qt allows to have three connections per host on Symbian, for
+        every other platform the limit is set to six connections per
+        host but the default implementation will only schedule four
+        connections per host.
+        In a manual test we seem to get the best loading speed by
+        going with Qt's limit and schedule two more jobs to allow Qt
+        to prepare them.
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+
+2009-12-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7341364> Crash at HTMLParser::popOneBlockCommon() after
+        handling misnested residual style tags
+
+        Test: fast/parser/residual-style-close-ref-clone.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks): Gave the
+        block stack a strong reference to the cloned residual style element. 
+
+2009-12-13  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Reverting changes from http://trac.webkit.org/changeset/49585 to fix:
+        <rdar://problem/7382815> REGRESSION (4.0.4-TOT): Home photo slider is too narrow at http://www.ziprealty.com/
+        https://bugs.webkit.org/show_bug.cgi?id=32078
+
+        * css/CSSPrimitiveValue.cpp: (WebCore::CSSPrimitiveValue::cssText):
+
+2009-12-08  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add code to allow toggling ATSUI/Core Text rendering at runtime in ComplexTextController.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        The goal here is to allow for a zero runtime hit for ports that decide to select
+        the API at compile time.
+        When both USE(ATSUI) and USE(CORE_TEXT) are true, the API is toggled
+        at runtime.  Core Text is used for OS Versions >= 10.6.
+
+        No test since this is already covered by existing pixel tests.
+
+        * platform/graphics/SimpleFontData.h:  Change #ifdef to define getNSFont() on Chrome/Mac .
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::shouldUseATSUIAPI): Cache decision about which API to use.
+        (WebCore::ComplexTextController::ComplexTextRun::indexAt):
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Stub function to call through
+        to ATSUI/Core text variants.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): The actual work for object construction
+        is delegate to createTextRunFromFontDataATSUI/createTextRunFromFontDataCoreText.
+        * platform/graphics/mac/ComplexTextController.h:
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): Small style fix.
+        (WebCore::ComplexTextController::ComplexTextRun::createTextRunFromFontDataATSUI):
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersATSUI):
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun):
+        (WebCore::ComplexTextController::ComplexTextRun::createTextRunFromFontDataCoreText):
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):
+
+2009-12-13  Eric Carlson  <eric.carlson@apple.com>
+
+        No review, rolling out r52059 until I can generate new Tiger
+        test results.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme):
+
+2009-12-12  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Fix the EXPERIMENTAL_SINGLE_VIEW_MODE build.
+
+        * Configurations/WebCore.xcconfig:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clearDragState):
+        * page/mac/DragControllerMac.mm:
+        (WebCore::DragController::isCopyKeyDown):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::eventActivatedView):
+        * platform/PlatformKeyboardEvent.h:
+        * platform/PlatformMouseEvent.h:
+        * platform/PlatformWheelEvent.h:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/mac/KeyEventMac.mm:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/mac/PlatformMouseEventMac.mm:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::show):
+        * platform/mac/WidgetMac.mm:
+
+2009-12-12  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Fix the !ENABLE(VIDEO) build.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
+
+2009-12-12  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Fix the !ENABLE(DATABASE) build.
+
+        * storage/SQLTransactionClient.cpp:
+        * storage/SQLTransactionClient.h:
+        * storage/SQLTransactionCoordinator.cpp:
+        * storage/SQLTransactionCoordinator.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+
+2009-12-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6293979> Adopt shared control drawing for <video> controls on Leopard and Windows
+
+        Use MediaControllerThemeQuickTime on Leopard.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme):
+
+2009-12-12  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Errors in WebGL[T]Array set() and get() methods
+        https://bugs.webkit.org/show_bug.cgi?id=32456
+
+        Test: fast/canvas/webgl/bug-32456.html
+
+        * bindings/js/JSWebGLFloatArrayCustom.cpp:
+        (WebCore::JSWebGLFloatArray::set):
+        * bindings/js/JSWebGLIntArrayCustom.cpp:
+        (WebCore::JSWebGLIntArray::set):
+        * bindings/js/JSWebGLShortArrayCustom.cpp:
+        (WebCore::JSWebGLShortArray::set):
+        * bindings/js/JSWebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedByteArray::set):
+        * bindings/js/JSWebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedIntArray::set):
+        * bindings/js/JSWebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedShortArray::set):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::setWebGLArray):
+        * html/canvas/WebGLFloatArray.idl:
+        * html/canvas/WebGLUnsignedIntArray.idl:
+
+2009-12-12  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update WebGL tests to released versions
+        https://bugs.webkit.org/show_bug.cgi?id=32457
+
+        * manual-tests/webgl/Earth.html:
+        * manual-tests/webgl/ManyPlanetsDeep.html:
+        * manual-tests/webgl/SpinningBox.html:
+        * manual-tests/webgl/TeapotPerPixel.html:
+        * manual-tests/webgl/TeapotPerVertex.html:
+        * manual-tests/webgl/resources/CanvasMatrix.js:
+        (CanvasMatrix4.prototype.getAsWebGLFloatArray):
+        * manual-tests/webgl/resources/utils3d.js:
+        (initWebGL.gl.console.window.console.log):
+        (initWebGL):
+        (loadShader):
+        (makeBox):
+        (makeSphere):
+        (processLoadObj):
+        (doLoadObj):
+        (doLoadImageTexture):
+
+2009-12-12  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Dirk Schulze.
+
+        Remove the include to SVGFEDisplacementMap.h, it's not needed at all.
+
+        * platform/graphics/filters/FEComponentTransfer.h:
+
+2009-12-12  Christian Dywan  <christian@twotoasts.de>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Only include SVGFEDisplacementMap.h if SVG is enabled.
+
+        * platform/graphics/filters/FEComponentTransfer.h:
+
+2009-12-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [Cairo][Qt] Alpha blending in SVG filters is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=32427
+
+        This patch is a follow-up to:
+        http://trac.webkit.org/changeset/51950
+        It fixes the alpha blending for Cairo and Qt on SVG Filters.
+
+        Covered by: * LayoutTests/svg/filters/feGaussianBlur.svg
+                    * LayoutTests/svg/filters/feComposite.svg
+                     and others.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+
+2009-12-11  Eric Roman  <eroman@chromium.org>
+
+        Unreviewed build fix.
+
+        [V8] Add a method on ScriptController to get it compiling after http://trac.webkit.org/changeset/52033.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::anyPageIsProcessingUserGesture):
+        * bindings/v8/ScriptController.h:
+
+2009-12-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Change bindings to catch up with http://trac.webkit.org/changeset/52033.
+
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Added retrieval of calling frame and passing
+          to the submit method.
+
+2009-12-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Put -umbrella linker flag into a variable so that it can be overridden.
+
+        * Configurations/WebCore.xcconfig:
+
+2009-12-11  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        body with display:inline causes crash
+        https://bugs.webkit.org/show_bug.cgi?id=32371
+
+        Tests: fast/inline/inline-body-crash.html
+               fast/inline/inline-body-with-scrollbar-crash.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::createScrollbar):
+        (WebCore::FrameView::layout):
+
+2009-12-11  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig.
+
+        https://webkit.org/b/22851 - Remove defunct FIXME.
+
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::HTMLPlugInElement): This flag was removed completely
+          from the HTMLFrameOwnerElement chain of classes.
+
+2009-12-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Small refactoring to get rid of some extra unneeded selection-related work
+        in RenderLayer::scrollToOffset and separate caret and range selection
+        logic in FrameView::layout. This may be useful later when changing how
+        the range selection logic works to fix layout reentrancy problems.
+
+        * page/Frame.cpp: Removed invalidateSelection.
+        * page/Frame.h: Ditto.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout): Call SelectionController::setNeedsLayout
+        and Frame::selectionLayoutChanged instead of calling
+        Frame::invalidateSelection, which was just a function that called
+        both of those others.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset): Call
+        SelectionController::setNeedsLayout instead of calling
+        Frame::invalidateSelection. This call site only needs the caret-related
+        work in that first function, not the other work formerly done by
+        Frame::invalidateSelection. The caret works outside the normal
+        painting and rendering system, and the range selection highlight is
+        more or less inside it and doesn't need special handling when scrolling.
+
+2009-12-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7342725> and https://webkit.org/b/32383
+        Selecting article text at sfgate.com results in spurious back/forward entries
+
+        If an iframe had a form and that form is submitted by javascript, IE and Opera don't add back/forward entries.
+        
+        In the case where the frame was added dynamically via createElement(), Firefox would like to add a back entry
+        but has a bug that prevents this.
+
+        Therefore by a bizarre coincidence, WebKit is the loner and the only engine affected by sfgate.com's technique.
+
+        This patch changes us to willfully match IE and Opera and fixes sfgate.com in the process.
+
+        Tests: http/tests/navigation/dynamic-iframe-dynamic-form-back-entry.html
+               http/tests/navigation/parsed-iframe-dynamic-form-back-entry.html
+
+        Capture whether the form was submitted by javascript:
+        * loader/FormState.cpp:
+        (WebCore::FormState::FormState):
+        (WebCore::FormState::create):
+        * loader/FormState.h:
+        (WebCore::FormState::formSubmissionTrigger):
+
+        When deciding the value of the lockBackForwardList variable, take formSubmissionTrigger() into account:
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+
+        Rearrange the public HTMLFormElement::submit() method to be called only from DOM or JS bindings,
+        and figure out the rest of the parameters for an internal submit() call including the formSubmissionTrigger:
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::submit):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::prepareSubmit):
+        (WebCore::HTMLFormElement::submit):
+        * html/HTMLFormElement.h:
+
+2009-12-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32445
+        REGRESSION: http://www.mcafee.com/japan/ displays unstyled
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+        Add a quirk for mcafee.com/japan (http or https, with or without www).
+
+2009-12-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Make PlatformWheelEvent.h private instead of project.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Support reflections on composited layers
+        https://bugs.webkit.org/show_bug.cgi?id=31885
+        
+        First part of supporting composited reflections on compositing layers.
+        
+        Rename the m_transformLayer member variable to m_structuralLayer, since it
+        will get used both for transform layers (for preserve-3d) and to hold a flattening
+        layer related to reflections, both of which have similar requirements, and are
+        mutually exclusive.
+
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        primaryLayer(), hostLayerForSublayers() and layerForSuperlayer() all now return
+        a CALayer, since m_structuralLayer isn't always a WebLayer.
+        
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        updateLayerPreserves3D() renamed to updateStructuralLayer()
+        
+        (WebCore::GraphicsLayerCA::updateLayerNames):
+        New "update" method for updating layer names.
+        
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+        m_transformLayer -> m_structuralLayer. Also minor refactor to only
+        allocate newSublayers in one place.
+        
+        (WebCore::GraphicsLayerCA::updateLayerSize):
+        (WebCore::GraphicsLayerCA::removeAnimationFromLayer):
+        (WebCore::GraphicsLayerCA::hostLayerForSublayers):
+        (WebCore::GraphicsLayerCA::layerForSuperlayer):
+        m_transformLayer -> m_structuralLayer
+        
+        (WebCore::GraphicsLayerCA::updateStructuralLayer):
+        Call ensureStructuralLayer() which handles any deltas to the
+        structural layer type.
+        
+        (WebCore::GraphicsLayerCA::ensureStructuralLayer):
+        Handle changes to the structural layer requirements
+        
+        (WebCore::GraphicsLayerCA::structuralLayerPurpose):
+        Return an enum describing the purpose of the structural layer; for now
+        this only returns NoStructuralLayer or StructuralLayerForPreserves3D, but
+        will in future also have a value related to reflections.
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix for platforms where ACCELERATED_COMPOSITING is not defined.
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::pauseAnimation):
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * platform/graphics/win/WKCACFLayerRenderer.cpp: Removed #include of
+        non-existent header.
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix, no review.
+
+        Build fix for platforms where ACCELERATED_COMPOSITING is not defined.
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::startAnimation):
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix, no review.
+
+        Build fix for platforms where ACCELERATED_COMPOSITING is not defined.
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::startAnimation):
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Negative values for animation-delay are ignored (treated as zero)
+        https://bugs.webkit.org/show_bug.cgi?id=26150
+        
+        When we get the m_startTime for an animation or transition, subtract any negative
+        delay so the animation/transition behaves like it started in the past, per spec.
+
+        Tests: animations/negative-delay.html
+               transitions/negative-delay.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Accelerated transitions broken when mixed with paused animations
+        https://bugs.webkit.org/show_bug.cgi?id=32387
+
+        Synchronization of a mixture of accelerated and software animations occurs via
+        a callback from GraphicsLayerCA, which ends up in
+        AnimationControllerPrivate::receivedStartTimeResponse(). The time passed in is
+        the exact time at which the accelerated animations started, so is used as the
+        start time for all animations and transitions which are marked as waiting.
+
+        The bug was that the callback called when re-starting animations that were
+        paused sent back an old time value, but this was used to start normal
+        transitions. Therefore the transition would start with a stale start time, and
+        thus end prematurely.
+
+        The fix is to change the way that GraphicsLayerCA handles paused animations.
+        Rather than setting the beginTime of the animation, it uses a beginTime of 0
+        and a timeOffset that gets passed down. Thus the callbacks always come with
+        beginTime for 'now'.
+
+        Also clarify the role of AnimationBase::endAnimation() by splitting it into
+        pauseAnimation() and endAnimation(), and pass down timeOffsets, rather than
+        beginTimes when starting and pausing.
+
+        Manual test only, because the bug requires a non-trivial combination of
+        animation pausing and transitions which take time, and the bug only shows in
+        pixel results.
+        
+        * manual-tests/animation/transitions-and-paused-animations.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::startAnimation):
+        (WebCore::AnimationBase::pauseAnimation):
+        (WebCore::AnimationBase::endAnimation):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::~ImplicitAnimation):
+        (WebCore::ImplicitAnimation::startAnimation):
+        (WebCore::ImplicitAnimation::endAnimation):
+        (WebCore::ImplicitAnimation::onAnimationEnd):
+        * page/animation/ImplicitAnimation.h:
+        (WebCore::ImplicitAnimation::pauseAnimation):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::~KeyframeAnimation):
+        (WebCore::KeyframeAnimation::startAnimation):
+        (WebCore::KeyframeAnimation::pauseAnimation):
+        (WebCore::KeyframeAnimation::endAnimation):
+        (WebCore::KeyframeAnimation::onAnimationEnd):
+        * page/animation/KeyframeAnimation.h:
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::addAnimation):
+        (WebCore::GraphicsLayer::pauseAnimation):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::LayerAnimation::LayerAnimation):
+        (WebCore::GraphicsLayerCA::AnimationProcessingAction::AnimationProcessingAction):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::addAnimation):
+        (WebCore::GraphicsLayerCA::removeAnimationsForKeyframes):
+        (WebCore::GraphicsLayerCA::pauseAnimation):
+        (WebCore::GraphicsLayerCA::updateLayerAnimations):
+        (WebCore::GraphicsLayerCA::setAnimationOnLayer):
+        (WebCore::GraphicsLayerCA::pauseAnimationOnLayer):
+        (WebCore::GraphicsLayerCA::createAnimationFromKeyframes):
+        (WebCore::GraphicsLayerCA::createTransformAnimationsFromKeyframes):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        (WebCore::RenderLayerBacking::animationPaused):
+        * rendering/RenderLayerBacking.h:
+
+2009-12-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes <http://webkit.org/b/32399>.
+        Pan Scrolling Jumps out of frames if the initial location is in a frame that can't be scrolled.
+        
+        When we initially figure out the layer that we should begin scrolling, don't try to jump out
+        of frames/iFrames to look at the owner document. We don't want to jump out of frames, so we
+        don't need that logic anymore.
+        
+        Added a test to make sure that we don't pan scroll if we start to scroll in an empty
+        iFrame that has a scrollable owner document.
+
+        Test: platform/win/fast/events/panScroll-no-iframe-jump.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::defaultEventHandler):
+
+2009-12-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes <http://webkit.org/b/32303>.
+        Middle-mouse button not firing mousedown DOM event when autoscroll happens.
+        
+        This fix moves the pan scrolling code into Node.cpp, as part of the default event handler.
+        We get two wins out of this:
+            1) Mousedown DOM events are now fired before pan scrolling.
+            2) Calling event.preventDefault() on a middle mouse button will now prevent pan scrolling.
+        
+        Added tests to show that middle mousedown DOM events are fired when panscrolling happens, and
+        that when event.preventDefault is called, pan scrolling doesn't happen.
+
+        Tests: platform/win/fast/events/panScroll-event-fired.html
+               platform/win/fast/events/panScroll-preventDefault.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::defaultEventHandler): Moved pan scrolling starting code to here.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::startPanScrolling): Function to initialize scrolling variables and start timer.
+        (WebCore::EventHandler::handleMousePressEvent): From here.
+        * page/EventHandler.h:
+
+2009-12-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Delay load DLLs for accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=31856
+        
+        Change calls that use the data export symbols from
+        QuartzCore to use the functions in QuartzCoreInterface.
+        This allows QuartzCore to be delay loaded.
+
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::GraphicsLayerCACF::GraphicsLayerCACF):
+        (WebCore::GraphicsLayerCACF::updateLayerPreserves3D):
+        (WebCore::GraphicsLayerCACF::updateContentsImage):
+        * platform/graphics/win/WKCACFLayer.cpp:
+        (WebCore::toCACFLayerType):
+        (WebCore::toCACFContentsGravityType):
+        (WebCore::fromCACFContentsGravityType):
+        (WebCore::toCACFFilterType):
+        (WebCore::fromCACFFilterType):
+        (WebCore::WKCACFLayer::create):
+        (WebCore::WKCACFLayer::WKCACFLayer):
+        (WebCore::WKCACFLayer::setContentsGravity):
+        (WebCore::WKCACFLayer::contentsGravity):
+        (WebCore::WKCACFLayer::setMagnificationFilter):
+        (WebCore::WKCACFLayer::magnificationFilter):
+        (WebCore::WKCACFLayer::setMinificationFilter):
+        (WebCore::WKCACFLayer::minificationFilter):
+        * platform/graphics/win/WKCACFLayer.h:
+        (WebCore::WKCACFLayer::):
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::acceleratedCompositingAvailable):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+
+2009-12-11  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Adds an Android-specific implementation of initializeMaximumHTTPConnectionCountPerHost.
+        https://bugs.webkit.org/show_bug.cgi?id=31810
+
+        * platform/network/ResourceRequestBase.cpp: Modified. Disable default implementation
+            of initializeMaximumHTTPConnectionCountPerHost for Android.
+        * platform/network/android: Added.
+        * platform/network/android/ResourceRequestAndroid.cpp: Added.
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost): Android-specific implementation.
+
+2009-12-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Add acceptTypes() method to FileChooser.
+        https://bugs.webkit.org/show_bug.cgi?id=32429
+
+        This method returns an 'accept' attribute value of the
+        corresponding INPUT element. A ChromeClient::runOpenPanel()
+        implementation can refer it through a FileChooser instance to
+        support type-restricted file selecting.
+
+        This makes no user-visible changes for now.
+
+        * platform/FileChooser.h:
+        (WebCore::FileChooser::acceptTypes):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::acceptTypes):
+        * rendering/RenderFileUploadControl.h:
+
+2009-12-11  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Changed PopupMenuChromium to keep the value selected from
+        keyboard when popup is closed.
+
+        The problem is Chromium does not fire the onchange event
+        when the popup is closed if an item is selected via
+        keyboard by typing the first char of the item. This makes
+        chromium popup not having consistent behaviours and also
+        behaves differently from other major browsers.
+        Calling popup->hide() instead of popup->hidePopup() in
+        PopupMenu fixes the issues as it does extra step to check
+        whethere there is a keyboard selection changed when closing
+        the popup.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32403
+    
+        TEST: add a manual test as the current layout test shell
+        does not support sending keyboard events to popup list.
+
+        * manual-tests/chromium/select-close-popup-value-change.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupMenu::hide):
+
+2009-12-11  anton muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] refactor WeakReferenceMap.
+        Move common bits of functionality to reduce duplication.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32389
+
+        Should be covered by buildbots.
+
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::WrapperMapObjectRemover::visitDOMWrapper):
+        (WebCore::DOMData::handleWeakObject):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::weakDOMObjectCallback):
+        (WebCore::DOMDataStore::weakActiveDOMObjectCallback):
+        (WebCore::DOMDataStore::weakNodeCallback):
+        (WebCore::DOMDataStore::weakSVGElementInstanceCallback):
+        (WebCore::DOMDataStore::weakSVGObjectWithContextCallback):
+        * bindings/v8/DOMDataStore.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::visitDOMNodesInCurrentThread):
+        (WebCore::visitDOMObjectsInCurrentThread):
+        (WebCore::visitActiveDOMObjectsInCurrentThread):
+        (WebCore::visitDOMSVGElementInstancesInCurrentThread):
+        (WebCore::visitSVGObjectsInCurrentThread):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::WeakReferenceMap::removeIfPresent):
+        (WebCore::WeakReferenceMap::clear):
+        (WebCore::WeakReferenceMap::visit):
+
+2009-12-11  anton muhin  <antonm@chromium.org>
+        Reviewed by Adam Barth.
+
+        [v8] in Debug builds create an additional handle scope
+        when doing debug build checks.
+        https://bugs.webkit.org/show_bug.cgi?id=32335
+
+        Should be covered by buildbots.
+
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
+
+2009-12-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not use ContextMenuItem as value type in custom
+        context menu implementation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32411
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        (WebCore::JSInspectorFrontendHost::showContextMenu):
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::showContextMenu):
+        (WebCore::InspectorFrontendHost::contextMenuCleared):
+        * inspector/InspectorFrontendHost.h:
+        (WebCore::InspectorFrontendHost::MenuProvider::create):
+        (WebCore::InspectorFrontendHost::MenuProvider::~MenuProvider):
+        (WebCore::InspectorFrontendHost::MenuProvider::disconnect):
+        (WebCore::InspectorFrontendHost::MenuProvider::populateContextMenu):
+        (WebCore::InspectorFrontendHost::MenuProvider::contextMenuCleared):
+        (WebCore::InspectorFrontendHost::MenuProvider::MenuProvider):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::ContextMenuController):
+        (WebCore::ContextMenuController::clearContextMenu):
+        (WebCore::ContextMenuController::showContextMenu):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/ContextMenuController.h:
+        * page/ContextMenuProvider.h: Added.
+        (WebCore::ContextMenuProvider::~ContextMenuProvider):
+        * page/ContextMenuSelectionHandler.h: Removed.
+
+2009-12-11  Simon Hausmann  <hausmann@webkit.org>, Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Antti Koivisto.
+
+        Basic cross-platform implementation of mapping platform touch events
+        to JavaScript touch events.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32114
+
+        Test: fast/events/basic-touch-events.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent):
+        * page/EventHandler.h:
+
+2009-12-11  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's EmptyFrameLoaderClient
+        https://bugs.webkit.org/show_bug.cgi?id=32110
+
+        Inherits the following class from Noncopyable because it is
+        instantiated by 'new' and no need to be copyable:
+
+        class name              - instantiated at: WebCore/'location'
+
+        class EmptyFrameLoaderClient - svg/graphics/SVGImage.cpp:229
+
+        * loader/FrameLoaderClient.h:
+
+2009-12-11  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for 3 classes in WebCore's svg and loader directory
+        https://bugs.webkit.org/show_bug.cgi?id=32106
+
+        Inherits the following classes from Noncopyable because these are instantiated 
+        by 'new' and no need to be copyable:
+
+        class/struct name            - instantiated at: WebCore/'location'
+
+        class EmptyContextMenuClient - instantiated at: svg/graphics/SVGImage.cpp:232
+        class EmptyDragClient        - instantiated at: svg/graphics/SVGImage.cpp:237
+        class SVGImageChromeClient   - instantiated at: svg/graphics/SVGImage.cpp:243
+
+        * svg/graphics/SVGImage.cpp:
+        * loader/EmptyClients.h:
+
+2009-12-11  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        The values of RuntimeArray are not enumerable
+        https://bugs.webkit.org/show_bug.cgi?id=29005
+
+        The indices of RuntimeArray should be enumerated like for a regular array.
+
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertyNames):
+        * bridge/runtime_array.h:
+
+2009-12-11  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] ImageDecoderQt: Fix retrieval of image file extensions
+
+        QImageReader only allows retrieving the format() before actually reading the image.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32428
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::internalDecodeSize):
+
+2009-12-11  Simon Hausmann  <hausmann@webkit.org>, Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Antti Koivisto.
+
+        Added interfaces for touch event support in JavaScript.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32114
+
+        The Touch, TouchEvent and TouchList interfaces come straight from
+        Android's copy of WebKit (eclaire branch).
+
+        The PlatformTouchEvent and PlatformTouchPoint code was written by
+        us.
+
+        No new tests added, we are just adding interfaces
+        with this patch.
+
+        * WebCore.pro:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * dom/Document.cpp:
+        (WebCore::Document::addListenerTypeIfNeeded):
+        * dom/Document.h:
+        (WebCore::Document::):
+        * dom/Document.idl:
+        * dom/Element.h:
+        * dom/Element.idl:
+        * dom/Event.cpp:
+        (WebCore::Event::isTouchEvent):
+        * dom/Event.h:
+        * dom/EventNames.h:
+        * dom/Touch.cpp: Added.
+        (WebCore::contentsX):
+        (WebCore::contentsY):
+        (WebCore::Touch::Touch):
+        (WebCore::Touch::updateLocation):
+        * dom/Touch.h: Added.
+        (WebCore::Touch::create):
+        (WebCore::Touch::frame):
+        (WebCore::Touch::target):
+        (WebCore::Touch::identifier):
+        (WebCore::Touch::clientX):
+        (WebCore::Touch::clientY):
+        (WebCore::Touch::screenX):
+        (WebCore::Touch::screenY):
+        (WebCore::Touch::pageX):
+        (WebCore::Touch::pageY):
+        * dom/Touch.idl: Added.
+        * dom/TouchEvent.cpp: Added.
+        (WebCore::TouchEvent::TouchEvent):
+        (WebCore::TouchEvent::initTouchEvent):
+        * dom/TouchEvent.h: Added.
+        (WebCore::TouchEvent::create):
+        (WebCore::TouchEvent::touches):
+        (WebCore::TouchEvent::targetTouches):
+        (WebCore::TouchEvent::changedTouches):
+        (WebCore::TouchEvent::TouchEvent):
+        (WebCore::TouchEvent::isTouchEvent):
+        * dom/TouchEvent.idl: Added.
+        * dom/TouchList.cpp: Added.
+        (WebCore::TouchList::item):
+        * dom/TouchList.h: Added.
+        (WebCore::TouchList::create):
+        (WebCore::TouchList::length):
+        (WebCore::TouchList::append):
+        (WebCore::TouchList::TouchList):
+        * dom/TouchList.idl: Added.
+        * html/HTMLAttributeNames.in:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * platform/PlatformTouchEvent.h: Added.
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+        (WebCore::PlatformTouchEvent::touchPoints):
+        * platform/PlatformTouchPoint.h: Added.
+        (WebCore::PlatformTouchPoint::):
+        (WebCore::PlatformTouchPoint::id):
+        (WebCore::PlatformTouchPoint::state):
+        (WebCore::PlatformTouchPoint::screenPos):
+        (WebCore::PlatformTouchPoint::pos):
+        * platform/qt/PlatformTouchEventQt.cpp: Added.
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+        * platform/qt/PlatformTouchPointQt.cpp: Added.
+        (WebCore::PlatformTouchPoint::PlatformTouchPoint):
+
+2009-12-11  Grace Kloba  <klobag@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        [Android] Add detachHistoryItem() to AndroidWebHistoryBridge. And the constructor takes
+        HistoryItem* now. As AndroidWebHistoryBridge holds a dumb pointer of HistoryItem and
+        HistoryItem holds a RefPtr of AndroidWebHistoryBridge, the dumb pointer needs to be cleared
+        when HistoryItem is deleted to avoid potential crash.
+        https://bugs.webkit.org/show_bug.cgi?id=32251
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::~HistoryItem):
+        * history/android/AndroidWebHistoryBridge.h:
+        (WebCore::AndroidWebHistoryBridge::AndroidWebHistoryBridge):
+        (WebCore::AndroidWebHistoryBridge::detachHistoryItem):
+
+
+2009-12-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Log WebSocket error to Web Inspector console.
+        https://bugs.webkit.org/show_bug.cgi?id=32165
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didOpen):
+        (WebCore::WebSocketChannel::appendToBuffer):
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::readServerHandshake):
+        (WebCore::WebSocketHandshake::readHTTPHeaders):
+        (WebCore::WebSocketHandshake::checkResponseHeaders):
+
+2009-12-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Mixed content shouldn't trigger for plug-ins without URLs
+        https://bugs.webkit.org/show_bug.cgi?id=32384
+
+        These plug-ins cannot be controlled by active network attackers, so
+        there's no reason to trigger a mixed content warning.
+
+        Test: http/tests/security/mixedContent/empty-url-plugin-in-frame.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isMixedContent):
+
+2009-12-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32140
+        REGRESSION(r50072): Mailman administrative functionality is broken
+
+        Test: http/tests/misc/percent-sign-in-form-field-name.html
+
+        * platform/network/FormDataBuilder.cpp: (WebCore::appendQuotedString): Don't encode percent
+        sign, we never had a good reason to do that.
+
+2009-12-10  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove getPropertyAttributes() from JavaScript bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31933
+
+        The functionality is provided by getOwnPropertyDescriptor().
+
+        * WebCore.order:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * page/DOMWindow.idl:
+
+2009-12-10  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Changed WebGLRenderingContext to synthesize GL errors rather than
+        raising JavaScript exceptions. Removed internal getError() calls
+        after each graphics call. The GraphicsContext3D maintains the
+        synthetic exceptions because only it has complete information
+        about certain conditions requiring them to be raised.
+
+        Based on idea from Ilmari Heikkinen, added create3DDebugContext()
+        to webgl-test.js and changed the WebGL layout tests expecting
+        error conditions to use it. Updated expected.txt files, which now
+        implicitly test the OpenGL error as it is part of the exception's
+        message.
+
+        Added new targeted test covering aspects of synthetic errors as
+        well as regression tests for bugs uncovered during its development.
+
+        Test: fast/canvas/webgl/error-reporting.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::sizeInBytes):
+        (WebCore::WebGLRenderingContext::activeTexture):
+        (WebCore::WebGLRenderingContext::attachShader):
+        (WebCore::WebGLRenderingContext::bindAttribLocation):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bindFramebuffer):
+        (WebCore::WebGLRenderingContext::bindRenderbuffer):
+        (WebCore::WebGLRenderingContext::bindTexture):
+        (WebCore::WebGLRenderingContext::bufferData):
+        (WebCore::WebGLRenderingContext::bufferSubData):
+        (WebCore::WebGLRenderingContext::compileShader):
+        (WebCore::WebGLRenderingContext::createShader):
+        (WebCore::WebGLRenderingContext::detachShader):
+        (WebCore::WebGLRenderingContext::disableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        (WebCore::WebGLRenderingContext::drawElements):
+        (WebCore::WebGLRenderingContext::enableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::framebufferRenderbuffer):
+        (WebCore::WebGLRenderingContext::framebufferTexture2D):
+        (WebCore::WebGLRenderingContext::getActiveAttrib):
+        (WebCore::WebGLRenderingContext::getActiveUniform):
+        (WebCore::WebGLRenderingContext::getBufferParameter):
+        (WebCore::WebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::getProgramParameter):
+        (WebCore::WebGLRenderingContext::getProgramInfoLog):
+        (WebCore::WebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::WebGLRenderingContext::getShaderParameter):
+        (WebCore::WebGLRenderingContext::getShaderInfoLog):
+        (WebCore::WebGLRenderingContext::getShaderSource):
+        (WebCore::WebGLRenderingContext::getTexParameter):
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getUniformLocation):
+        (WebCore::WebGLRenderingContext::getVertexAttrib):
+        (WebCore::WebGLRenderingContext::linkProgram):
+        (WebCore::WebGLRenderingContext::shaderSource):
+        (WebCore::WebGLRenderingContext::texImage2D):
+        (WebCore::WebGLRenderingContext::texSubImage2D):
+        (WebCore::WebGLRenderingContext::uniform1f):
+        (WebCore::WebGLRenderingContext::uniform1fv):
+        (WebCore::WebGLRenderingContext::uniform1i):
+        (WebCore::WebGLRenderingContext::uniform1iv):
+        (WebCore::WebGLRenderingContext::uniform2f):
+        (WebCore::WebGLRenderingContext::uniform2fv):
+        (WebCore::WebGLRenderingContext::uniform2i):
+        (WebCore::WebGLRenderingContext::uniform2iv):
+        (WebCore::WebGLRenderingContext::uniform3f):
+        (WebCore::WebGLRenderingContext::uniform3fv):
+        (WebCore::WebGLRenderingContext::uniform3i):
+        (WebCore::WebGLRenderingContext::uniform3iv):
+        (WebCore::WebGLRenderingContext::uniform4f):
+        (WebCore::WebGLRenderingContext::uniform4fv):
+        (WebCore::WebGLRenderingContext::uniform4i):
+        (WebCore::WebGLRenderingContext::uniform4iv):
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::validateProgram):
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore::WebGLRenderingContext::cleanupAfterGraphicsCall):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+        (WebCore::GraphicsContext3D::getError):
+        (WebCore::GraphicsContext3D::synthesizeGLError):
+
+2009-12-10  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for assert on Chrome/skia with SVG Filters enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=32394
+
+        Covered by LayoutTests/svg/W3C-SVG-1.1/filters-tile-01-b.svg and others.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+
+2009-12-10  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(4.0.4-42a12): With 2 highlighted lines of text in gmail/hotmail selecting Bold selects other 2 edit buttons automatically.
+        <rdar://problem/7442065>
+        https://bugs.webkit.org/show_bug.cgi?id=32285
+
+        When examining the styles of the nodes after the first in a range selection, we take into
+        cosideration differences in style of txt nodes only.
+        
+        Test: editing/execCommand/queryCommandState-02.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::selectionHasStyle):
+
+2009-12-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crash in XMLTokenizer::popCurrentNode if window.close() is called during parsing
+        https://bugs.webkit.org/show_bug.cgi?id=31576
+
+        Add a RefCounted wrapper object around xmlParserCtxtPtr so we can
+        maintain it's lifetime more effectively.
+
+        Test: fast/parser/xhtml-close-while-parsing.xhtml
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::popCurrentNode):
+        * dom/XMLTokenizer.h:
+        (WebCore::XMLParserContext::context):
+        (WebCore::XMLParserContext::XMLParserContext):
+        (WebCore::XMLTokenizer::context):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLParserContext::createStringParser):
+        (WebCore::XMLParserContext::createMemoryParser):
+        (WebCore::XMLParserContext::~XMLParserContext):
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::initializeParserContext):
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::XMLTokenizer::lineNumber):
+        (WebCore::XMLTokenizer::columnNumber):
+        (WebCore::XMLTokenizer::stopParsing):
+        (WebCore::parseXMLDocumentFragment):
+        (WebCore::parseAttributes):
+
+2009-12-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: debugger shortcuts don't work when
+        Search field or Console drawer has focus.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32392
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.documentKeyUp):
+        (WebInspector.searchKeyDown):
+
+2009-12-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Events created in isolated worlds may fire in main world.
+        https://bugs.webkit.org/show_bug.cgi?id=32386
+
+        Test: http/tests/security/isolatedWorld/events.html
+
+        * WebCore.gypi: Added WorldContextHandle.
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Added WorldContextHandle params.
+        * bindings/v8/SharedPersistent.h: Fixed a few style/include issues.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Added WorldContextHandle params.
+        (WebCore::V8AbstractEventListener::handleEvent): Adjusted context retrieval to use WorldContextHandle.
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Ditto.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::worldContext): Added WorldContextHandle params.
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper): Ditto.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener): Ditto.
+        (WebCore::V8LazyEventListener::prepareListenerObject): Adjusted context retrieval to use WorldContextHandle.
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::create): Added WorldContextHandle params.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::context): Refactored to use mainWorldContext();
+        (WebCore::V8Proxy::mainWorldContext): Added.
+        (WebCore::toV8Context): Changed to use WorldContextHandle.
+        * bindings/v8/V8Proxy.h: Added mainWorldContext decl.
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException): Added an extra check to avoid crashes during frame teardown.
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener): Added WorldContextHandle params.
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create): Added WorldContextHandle params.
+        * bindings/v8/WorldContextHandle.cpp: Added.
+        * bindings/v8/WorldContextHandle.h: Added.
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener): Added WorldContextHandle params.
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create): Added WorldContextHandle params.
+
+2009-12-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Pass more information about a plug-in to the PluginHalterDelegate
+
+        Reviewed by Adam Roben.
+
+        * loader/EmptyClients.h:
+        Remove this unused class.
+
+        * page/HaltablePlugin.h:
+        Add new functions to return the plug-in's name and whether it is
+        windowed.
+
+        * page/PluginHalter.cpp:
+        (WebCore::PluginHalter::timerFired):
+        Pass new arguments to the client.
+
+        * page/PluginHalterClient.h:
+        Add new parameters.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::pluginName):
+        Return the name from the PluginPackage.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::isWindowed):
+
+2009-12-09  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes <http://webkit.org/b/31738>.
+        Web Inspector: Console Scope Bar should be on top of console when Console is a Panel.
+        
+        When the console is set to be shown as a full panel, move the scope bar to the top
+        where it looks best. When it is only shown as a drawer, move it to the bottom, where
+        it originally was. This takes up less space as a drawer, and makes it more discoverable
+        and usable when it is the full panel.
+
+        * inspector/front-end/ConsolePanel.js:
+        (WebInspector.ConsolePanel.prototype.show): Move filter bar to top.
+        (WebInspector.ConsolePanel.prototype.hide): Move filter bar back to bottom.
+        * inspector/front-end/inspector.css:
+
+2009-12-10  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dirk Schulze.
+
+        Fix for alpha blending in SVG Filters on Chromium/skia.
+        https://bugs.webkit.org/show_bug.cgi?id=32378
+
+        Covered by LayoutTests/svg/filters/feGaussianBlur.svg and others.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+
+2009-12-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add context menu actions for DOM tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32348
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ContextMenu.js:
+        (WebInspector.ContextMenu):
+        (WebInspector.ContextMenu.prototype.show):
+        (WebInspector.ContextMenu.prototype.appendItem):
+        (WebInspector.ContextMenu.prototype.appendSeparator):
+        (WebInspector.ContextMenu.prototype._itemSelected):
+        (WebInspector.contextMenuItemSelected):
+        (WebInspector.contextMenuCleared):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmouseout):
+        (WebInspector.ElementsTreeOutline.prototype.populateContextMenu):
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+        (WebInspector.ElementsTreeElement.prototype._startEditingFromEvent):
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        (WebInspector.ElementsTreeElement.prototype._populateTextContextMenu):
+        (WebInspector.ElementsTreeElement.prototype._startEditing):
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.ondblclick):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._toggleURLdecoding):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.js:
+        (WebInspector.contextMenuEventFired):
+        * inspector/front-end/treeoutline.js:
+        (TreeElement.treeElementDoubleClicked):
+
+2009-12-09  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        Filters contain some leaks in untested code
+        https://bugs.webkit.org/show_bug.cgi?id=32325
+
+        Fix obvious leak in SVGFE*Lighting classes. Implement the create() idiom for 
+        all classes in svg/graphics, that were missing it. The lighting filters aren't
+        implemented so far, but the associated FilterEffect objects are build, which created
+        these leaks.
+
+        This removes the SVG related failures in the leaks bot.
+
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::findLights):
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDistantLightElement.cpp:
+        (WebCore::SVGFEDistantLightElement::lightSource):
+        * svg/SVGFEDistantLightElement.h:
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEPointLightElement.cpp:
+        (WebCore::SVGFEPointLightElement::lightSource):
+        * svg/SVGFEPointLightElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::findLights):
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFESpotLightElement.cpp:
+        (WebCore::SVGFESpotLightElement::lightSource):
+        * svg/SVGFESpotLightElement.h:
+        * svg/graphics/filters/SVGDistantLightSource.h:
+        (WebCore::DistantLightSource::create):
+        (WebCore::DistantLightSource::DistantLightSource):
+        * svg/graphics/filters/SVGFEDiffuseLighting.cpp:
+        (WebCore::FEDiffuseLighting::FEDiffuseLighting):
+        (WebCore::FEDiffuseLighting::create):
+        (WebCore::FEDiffuseLighting::setLightSource):
+        * svg/graphics/filters/SVGFEDiffuseLighting.h:
+        * svg/graphics/filters/SVGFESpecularLighting.cpp:
+        (WebCore::FESpecularLighting::FESpecularLighting):
+        (WebCore::FESpecularLighting::create):
+        (WebCore::FESpecularLighting::setLightSource):
+        * svg/graphics/filters/SVGFESpecularLighting.h:
+        * svg/graphics/filters/SVGLightSource.h:
+        * svg/graphics/filters/SVGPointLightSource.h:
+        (WebCore::PointLightSource::create):
+        (WebCore::PointLightSource::PointLightSource):
+        * svg/graphics/filters/SVGSpotLightSource.h:
+        (WebCore::SpotLightSource::create):
+        (WebCore::SpotLightSource::SpotLightSource):
+
+2009-12-10  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Chromium] SporeViewer demo doesn't work in Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=32364
+
+        Test: fast/canvas/webgl/bug-32364.html
+
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+
+2009-12-09  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32346 SVG property 
+        -webkit-shadow should apply shadow on the result after compositing
+        -and corresponding-
+        <rdar://problem/7389404>
+
+        Set a transparency layer when setting a shadow to apply the shadow 
+        to the composite.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+
+2009-12-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32332
+        WebSocket events should be dispatched synchronously
+
+        Updated websocket/tests/simple to test for the new behavior.
+
+        When Web Sockets API says that events should be queued for async dispatch, it means something
+        different. We should keep this in mind when dealing with other HTML5-related specs.
+
+        The model for HTML5 is that code running in response to network events (e.g. WebSocket or
+        XMLHttpRequest algorithms) runs in a separate thread of execution, and thus needs to post
+        async events as its only way to communicate with client code. As long as network events are
+        queued themselves (as they are in WebKit), there is no need to queue JS events for async
+        dispatch.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+
+2009-12-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32355
+        Assertion failure when opening a WebSocket connection
+
+        I couldn't make a reliable test for this. Once the test from bug 32299 is landed, it
+        will provide partial coverage, as I was frequently seeing the assertion failure with it.
+
+        * platform/network/SocketStreamHandleBase.cpp: (WebCore::SocketStreamHandleBase::send):
+        It's not an error if zero is returned from platformSend() - it just means that nothing could
+        be pushed down to the network layer, and all data was queued for later.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback): This will no longer happen with SocketStream,
+        but a client can potentially destroy the handle from any callback, so we need to check that
+        this didn't happen.
+        (WebCore::SocketStreamHandle::writeStreamCallback): Ditto.
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Roll out 51919 and 51920. They were incorrect and unnecessary right now.
+
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCScheduleDeallocateOnMainThread):
+        * platform/network/mac/NetworkStateNotifierMac.cpp:
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Adds wtf/StdLibExtras.h include for DEFINE_STATIC_LOCAL in V8 ScriptState.
+        https://bugs.webkit.org/show_bug.cgi?id=32330
+
+        Build fix only, no new tests.
+
+        * bindings/v8/ScriptState.cpp: Modified. Adds wtf/StdLibExtras.h include.
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Adds ENABLE(INSPECTOR) guards around script binding methods that use types
+        defined only when INSPECTOR is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=32328
+
+        Build fix only, no new tests.
+
+        * bindings/js/ScriptValue.cpp: Modified. Added ENABLE(INSPECTOR) guard to ScriptValue::quarantineValue.
+        * bindings/v8/ScriptObject.cpp: Modified. Added ENABLE(INSPECTOR) guard to some overloads of ScriptGlobalObject::set.
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds Android Makefiles for building with V8.
+        Also updates existing Android Makefiles with latest additions.
+        https://bugs.webkit.org/show_bug.cgi?id=32278
+
+        Build fix only, no new tests.
+
+        * Android.derived.jscbindings.mk: Modified.
+        * Android.derived.mk: Modified.
+        * Android.derived.v8bindings.mk: Added.
+        * Android.jscbindings.mk: Modified.
+        * Android.mk: Modified.
+        * Android.v8bindings.mk: Added.
+
+2009-12-09  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 32338 - [Chromium] Fix Chromium builder by including missing GeolocationServiceChromium
+        https://bugs.webkit.org/show_bug.cgi?id=32338
+
+        Fix build break: re-include file dropped out by merge in http://trac.webkit.org/changeset/51681/trunk/WebCore/WebCore.gypi
+
+        * WebCore.gypi: Add missing GeolocationServiceChromium.cpp
+
+2009-12-09  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Brady Eidson.
+
+        Fixed a typo in http://trac.webkit.org/changeset/51644 that broke
+        the QWebPage autotest.
+
+        No new test required.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateToDifferentDocument):
+
+2009-12-09  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Eric Seidel.
+
+        Exclude JSSVG*.cpp generated files from --minimal and --no-svg builds.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32286
+
+        * WebCore.pro:
+
+2009-12-09  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Carlson.
+
+        Ogg mimetypes are incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=27113
+
+        The ogg extension is handled by audio/ogg instead of
+        application/ogg. See
+        http://wiki.xiph.org/MIME_Types_and_File_Extensions
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::TypeExtensionPair::):
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Use the current run loop instead of the main runloop for the NetworkStateNotifier.
+
+        * platform/network/mac/NetworkStateNotifierMac.cpp:
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Use isMainThread() helper instead of pthread_main_np() != 0.
+
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCScheduleDeallocateOnMainThread):
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add some #ifdefs to allow us to experiment with a single NSView mac WebKit.
+
+        * page/Chrome.h:
+        * page/EventHandler.h:
+        * page/mac/ChromeMac.mm:
+        * page/mac/DragControllerMac.mm:
+        (WebCore::DragController::dragOperation):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::eventLoopHandleMouseDragged):
+        (WebCore::EventHandler::eventActivatedView):
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::focusDocumentView):
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::createDraggingClipboard):
+        (WebCore::isKeyboardOptionTab):
+        (WebCore::EventHandler::invertSenseOfTabsToLinks):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::needsKeyboardEventDisambiguationQuirks):
+        (WebCore::EventHandler::accessKeyModifiers):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/Widget.cpp:
+        * platform/Widget.h:
+        * platform/mac/ScrollViewMac.mm:
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::setCursor):
+        (WebCore::Widget::paint):
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setIsSelected):
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+
+2009-12-09  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium build fix.
+
+        No new tests.
+
+        * bindings/v8/DOMData.cpp
+        * bindings/v8/V8DOMWrapper.cpp
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+
+2009-12-09  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Isolated world reuse failure
+        https://bugs.webkit.org/show_bug.cgi?id=32306
+
+        Fixed bug introduced in r51407: (http://trac.webkit.org/changeset/51407) which caused layout test
+        LayoutTests/http/tests/security/isolatedWorld/world-reuse.html to fail.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::contextDebugId):
+
+2009-12-09  Patrick Scott  <phanna@email.unc.edu>
+
+        Fix the build with ENABLE_ORIENTATION_EVENTS
+        https://bugs.webkit.org/show_bug.cgi?id=32321
+
+        * page/Frame.cpp:
+        (WebCore::Frame::sendOrientationChangeEvent):
+
+2009-12-09  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium tickmarks in scrollbar now UX approved.
+        https://bugs.webkit.org/show_bug.cgi?id=32069
+
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::ScrollbarThemeChromiumMac::paint):
+
+2009-12-09  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Delay load DLLs for accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=31856
+        
+        Add logic to turn off accelerated compositing if d3d9 or QuartzCore
+        DLLs are not present.
+        
+        This patch also changes the WKCACFLayerRenderer to be a pointer.
+        This allows me to have a create() method which will not create it when
+        accelerated compositing is disabled because of missing DLLs. It 
+        avoids having to do so many checks. I also made WebViewWndProc 
+        a member function to allow several methods to be made protected, which
+        allows me to avoid doing availability checks there as well.
+
+        * platform/graphics/win/WKCACFLayer.cpp:
+        * platform/graphics/win/WKCACFLayer.h:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        * rendering/RenderLayerBacking.cpp:
+
+2009-12-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Rename dom/ClassNames to SpaceSplitString and update build files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32250
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::matchRules):
+        * dom/ClassNames.cpp: Removed.
+        * dom/ClassNames.h: Removed.
+        * dom/ClassNodeList.h:
+        * dom/NamedMappedAttrMap.h:
+        (WebCore::NamedMappedAttrMap::classNames):
+        * dom/SpaceSplitString.cpp: Copied from WebCore/dom/ClassNames.cpp.
+        (WebCore::SpaceSplitStringData::createVector):
+        (WebCore::SpaceSplitStringData::containsAll):
+        * dom/SpaceSplitString.h: Copied from WebCore/dom/ClassNames.h.
+        (WebCore::SpaceSplitStringData::SpaceSplitStringData):
+        (WebCore::SpaceSplitString::SpaceSplitString):
+        (WebCore::SpaceSplitString::set):
+        (WebCore::SpaceSplitString::containsAll):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::classNames):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::setRel):
+
+2009-12-09  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Enable SVG filters in Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=32323
+
+        Covered by SVG filter layout tests.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-12-09  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::functionForUniform):
+
+2009-12-08  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        WebSocket allow space (U+0020) in sub protocol name.
+        https://bugs.webkit.org/show_bug.cgi?id=32266
+
+        Test: websocket/tests/sub-protocol-with-space.html
+
+        * websockets/WebSocket.cpp:
+        (WebCore::isValidProtocolString):
+
+2009-12-08  Peterson Trethewey  <petersont@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Implement WebGLUniformLocation and change API to use it.
+        https://bugs.webkit.org/show_bug.cgi?id=31173
+
+        Test: fast/canvas/webgl/uniform-location.html
+
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::getProgramParameter):
+        (WebCore::JSWebGLRenderingContext::getUniform):
+        (WebCore::functionForUniform):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toWebGLUniformLocation):
+        (WebCore::):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::isFunctionToCallForAttribute):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getUniformLocation):
+        (WebCore::WebGLRenderingContext::uniform1f):
+        (WebCore::WebGLRenderingContext::uniform1fv):
+        (WebCore::WebGLRenderingContext::uniform1i):
+        (WebCore::WebGLRenderingContext::uniform1iv):
+        (WebCore::WebGLRenderingContext::uniform2f):
+        (WebCore::WebGLRenderingContext::uniform2fv):
+        (WebCore::WebGLRenderingContext::uniform2i):
+        (WebCore::WebGLRenderingContext::uniform2iv):
+        (WebCore::WebGLRenderingContext::uniform3f):
+        (WebCore::WebGLRenderingContext::uniform3fv):
+        (WebCore::WebGLRenderingContext::uniform3i):
+        (WebCore::WebGLRenderingContext::uniform3iv):
+        (WebCore::WebGLRenderingContext::uniform4f):
+        (WebCore::WebGLRenderingContext::uniform4fv):
+        (WebCore::WebGLRenderingContext::uniform4i):
+        (WebCore::WebGLRenderingContext::uniform4iv):
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLUniformLocation.cpp: Added.
+        (WebCore::WebGLUniformLocation::create):
+        (WebCore::WebGLUniformLocation::WebGLUniformLocation):
+        * html/canvas/WebGLUniformLocation.h: Added.
+        (WebCore::WebGLUniformLocation::~WebGLUniformLocation):
+        (WebCore::WebGLUniformLocation::program):
+        (WebCore::WebGLUniformLocation::location):
+        * html/canvas/WebGLUniformLocation.idl: Added.
+
+2009-12-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix assertion failure in WebCore::RenderBlock::startDelayUpdateScrollInfo
+
+        startDelayUpdateScrollInfo calls a function that can end up calling
+        startDelayUpdateScrollInfo again. However, it's static state is
+        inconsistent when this happens leading to an assertion failure (or
+        probably a memory leak if assertions are off).
+
+        Thanks to Robert Swiecki for the test case.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32172
+        http://code.google.com/p/chromium/issues/detail?id=28880
+
+        Test: fast/css/recursive-delay-update-scroll.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
+
+2009-12-08  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebCore source level debugging on Windows not reliable in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=32297
+
+        Customized pdb file name/location for WebCore static library.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops: Add ProgramDataBaseFileName.
+
+2009-12-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Mac plugins support.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32236
+
+        * platform/FileSystem.h:
+        * platform/cf/BinaryPropertyList.h:
+        * platform/network/curl/ResourceHandleManager.cpp:
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::fileExists):
+        (WebCore::unloadModule):
+        (WebCore::wxDirTraverserNonRecursive::wxDirTraverserNonRecursive):
+        (WebCore::wxDirTraverserNonRecursive::OnFile):
+        (WebCore::wxDirTraverserNonRecursive::OnDir):
+        (WebCore::listDirectory):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::nativeWindowFor):
+        (WebCore::cgHandleFor):
+        (WebCore::topLevelOffsetFor):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::globalMousePosForPlugin):
+        * plugins/wx/PluginDataWx.cpp: Added.
+        (WebCore::PluginData::initPlugins):
+        (WebCore::PluginData::refresh):
+        * wscript:
+
+2009-12-08  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Navigating to a cached page can result in accessing a destroyed HTMLInputElement.
+        <rdar://problem/6856662> and https://webkit.org/b/32293
+
+        Test: fast/loader/input-element-page-cache-crash.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Make sure to unregister for the activation
+          callback after the new m_autocomplete setting has been stored so the unregistration actually
+          takes place.
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by David Levin.
+
+        Revert and reopen "Add asserts to RefCounted to make sure ref/deref happens on the right thread."
+        It may have caused massive increase of reported leaks on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * ForwardingHeaders/wtf/ThreadVerifier.h: Removed.
+        * loader/icon/IconRecord.cpp:
+        (WebCore::IconRecord::IconRecord):
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::SharedBuffer):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+
+2009-12-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium: support custom WebCore context menu items in Chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32277
+
+        * platform/ContextMenu.h:
+        * platform/ContextMenuItem.h:
+        (WebCore::PlatformMenuItemDescription::PlatformMenuItemDescription):
+        * platform/chromium/ContextMenuChromium.cpp:
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::itemCount):
+        (WebCore::ContextMenu::insertItem):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::itemWithAction):
+        (WebCore::ContextMenu::itemAtIndex):
+        (WebCore::ContextMenu::platformDescription):
+        * platform/chromium/ContextMenuItemChromium.cpp:
+        (WebCore::ContextMenuItem::ContextMenuItem):
+        (WebCore::ContextMenuItem::releasePlatformDescription):
+        (WebCore::ContextMenuItem::type):
+        (WebCore::ContextMenuItem::action):
+        (WebCore::ContextMenuItem::title):
+        (WebCore::ContextMenuItem::checked):
+        (WebCore::ContextMenuItem::enabled):
+        (WebCore::ContextMenuItem::setType):
+        (WebCore::ContextMenuItem::setAction):
+        (WebCore::ContextMenuItem::setTitle):
+        (WebCore::ContextMenuItem::setChecked):
+        (WebCore::ContextMenuItem::setEnabled):
+
+2009-12-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium Linux: set default scrollbar colours.
+
+        This is so that layout tests have sane defaults for the scrollbar
+        colours, even if the API user doesn't set any.
+
+        This is a fix due to r51827.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32287
+
+        This is very well covered by existing layout tests.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+
+2009-12-08  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/7397808> Crash occurs at 
+        RenderObject::containingBlock() as I type in the Google Search 
+        field (during page load)
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::insideVisibleArea): ownerRenderer() needs to be 
+        null checked.
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * loader/icon/IconRecord.cpp:
+        (WebCore::IconRecord::IconRecord): Disable thread verification for this class because of its cross-thread use in IconDatabase.
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::SharedBuffer): Ditto.
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Disable thread verification for this class, add FIXME to enforce proper usage via crossThreadString.
+        * ForwardingHeaders/wtf/ThreadVerifier.h: Added.
+
+2009-12-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Adam Barth.
+
+        Inform the NotificationCenter when its window goes away in the same
+        manner as other DOMWindow fields, and prevent invalid operations on
+        it after that happens.
+
+        As part of this, change the V8 bindings for notifications to call
+        through the NotificationCenter rather than doing those operations
+        itself.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31886
+
+        Test: fast/notifications/notification-after-close.html
+
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        * notifications/NotificationCenter.h:
+        (WebCore::NotificationCenter::createHTMLNotification):
+        (WebCore::NotificationCenter::createNotification):
+        (WebCore::NotificationCenter::disconnectFrame):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+
+2009-12-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fixed block selection gap repainting in table cells
+
+        Test: fast/repaint/block-selection-gap-in-table-cell.html
+
+        This recently-introduced regression exposed the fact that
+        RenderTableCell did not override offsetFromContainer() to adjust for
+        the fact that table cells’ coordinates are relative to the table
+        section, not the table row. With this fixed, RenderTableCell no longer
+        needs to override mapLocalToContainer() and mapAbsoluteToLocalPoint(),
+        since the base class implementations of those use offsetFromContainer().
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::offsetFromContainer):
+        * rendering/RenderTableCell.h:
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sane way to force a rebuild on all win slaves, according to Adam Roben.
+
+        * WebCorePrefix.h:
+
+2009-12-08  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * loader/loader.cpp:
+        (WebCore::cachedResourceTypeToTargetType):
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Touch svgtags.in to eventually fix the win debug build.
+
+        * svg/svgtags.in:
+
+2009-12-08  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32167
+        Update the ResourceRequest::RequestType.  This previously
+        was specific to Chromium.  Moved into ResourceRequestBase, enabling
+        more specificity about the type (which is otherwise only known to the
+        loader), and also making this information available to all platforms.
+        Any platform with a network layer which can utilize this information
+        may want to use it for prioritization.
+
+        Note to Chromium glue: TargetIsSubResource renamed to TargetIsSubresource.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Loader):
+        (WebCore::CachedResourceTypeToTargetType):
+        (WebCore::Loader::Host::servePendingRequests):
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::):
+        (WebCore::ResourceRequestBase::targetType):
+        (WebCore::ResourceRequestBase::setTargetType):
+        (WebCore::ResourceRequestBase::ResourceRequestBase):
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+
+2009-12-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Adds Makefiles for Android port.
+        https://bugs.webkit.org/show_bug.cgi?id=31325
+
+        Build system change only. No tests possible.
+
+        * Android.derived.jscbindings.mk: Added.
+        * Android.derived.mk: Added.
+        * Android.jscbindings.mk: Added.
+        * Android.mk: Added.
+        * WebCorePrefix.h: Modified. Sets up some flags and adds a header required for building on Android.
+
+2009-12-08  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Xan Lopez.
+
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS): Conditionalize prefetching on
+        the libSoup version.
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Win.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * bindings/scripts/CodeGeneratorCOM.pm: Touch file to assure a world rebuild. Hopefully.
+
+2009-12-08  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        CSS Counter Nesting still does not work according to the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=31723
+
+        Test: fast/css/counters/nesting.html
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        Replaced the faulty counter insertion algorithm with one that works.
+
+2009-12-08  John Sullivan  <sullivan@apple.com>
+
+        Add isAutofilled getter to match existing setter.
+
+        Reviewed by Ada Chan.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isAutofilled]):
+        Implemented new cover function.
+        
+        * bindings/objc/DOMPrivate.h:
+        Declared new cover function.
+
+2009-12-08  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Create a TextBreakIterator implementation based on GLib (without ICU)
+        https://bugs.webkit.org/show_bug.cgi?id=31469
+
+        Added a TextBreakIterator implementation based on GLib and pango,
+        which allows compiling WebCore without ICU.
+
+        * GNUmakefile.am:
+        * platform/text/gtk/TextBreakIteratorGtk.cpp: Added.
+        (WebCore::):
+        (WebCore::setUpIterator):
+        (WebCore::characterBreakIterator):
+        (WebCore::cursorMovementIterator):
+        (WebCore::wordBreakIterator):
+        (WebCore::lineBreakIterator):
+        (WebCore::sentenceBreakIterator):
+        (WebCore::textBreakFirst):
+        (WebCore::textBreakLast):
+        (WebCore::textBreakNext):
+        (WebCore::textBreakPrevious):
+        (WebCore::textBreakPreceding):
+        (WebCore::textBreakFollowing):
+        (WebCore::textBreakCurrent):
+        (WebCore::isTextBreak):
+
+2009-12-08  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Change the way cookies are retrieved in the WebInspector frontend.
+
+        Moved the cookie filtering from the native code into the frontend so that
+        all cookies can be retrieved regardless of the associated domain
+        (required for certain audits to run.)
+        https://bugs.webkit.org/show_bug.cgi?id=32160
+
+        Test: inspector/cookie-resource-match.html
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::getCookies):
+        * inspector/InspectorController.h:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype._cookiesForDomain):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.Cookies.cookieMatchesResourceURL):
+        (WebInspector.Cookies.cookieDomainMatchesResourceDomain):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        (WebInspector.Resource.prototype.get documentURL):
+        (WebInspector.Resource.prototype.set documentURL):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Touch svgtags.in, in order to force SVGNames.* regeneration. Praying for gtk bot to be fixed :-)
+
+        * svg/svgtags.in:
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Trying to force a rebuild on the Gtk slave. If that doesn't work, someone must force a rebuild from scratch.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-12-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: provide custom context menu in the front-end window.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32200
+
+        * English.lproj/localizedStrings.js:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        (WebCore::JSInspectorFrontendHost::showContextMenu):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::contextMenuItemSelected):
+        (WebCore::InspectorFrontend::contextMenuCleared):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::showContextMenu):
+        (WebCore::InspectorFrontendHost::contextMenuItemSelected):
+        (WebCore::InspectorFrontendHost::contextMenuCleared):
+        * inspector/InspectorFrontendHost.h:
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::create):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::~MenuSelectionHandler):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::disconnect):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::contextMenuItemSelected):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::contextMenuCleared):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::MenuSelectionHandler):
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/ContextMenu.js: Added.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.documentContextMenu):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::ContextMenuController):
+        (WebCore::ContextMenuController::clearContextMenu):
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+        (WebCore::ContextMenuController::showContextMenu):
+        (WebCore::ContextMenuController::createContextMenu):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/ContextMenuController.h:
+        * page/ContextMenuSelectionHandler.h: Added.
+        (WebCore::ContextMenuSelectionHandler::ContextMenuSelectionHandler):
+        (WebCore::ContextMenuSelectionHandler::~ContextMenuSelectionHandler):
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * platform/ContextMenuItem.h:
+
+2009-12-08  Andras Becsi  <abecsi@inf.u-szeged.hu>
+
+        Rubber-stamped by Kenneth Rohde Christiansen.
+
+        [Qt] Build fix of duplicated platform/graphics/filters/FEGaussianBlur.cpp in WebCore.pro after enabled svg filters.
+
+        No new tests needed.
+        * WebCore.pro:
+
+2009-12-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add a function to show render tree for debugging
+        https://bugs.webkit.org/show_bug.cgi?id=31288
+
+        No new tests because this just adds a function for debugging.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::showRenderObject):
+        (WebCore::RenderObject::showRenderTreeAndMark):
+        (showRenderTree):
+        * rendering/RenderObject.h:
+
+2009-12-07  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement NamedPropertyEnumerator and IndexedPropertyEnumerator for
+        V8 NPObject. This should make the object enumerable and fix the
+        enumeration issue in layout test plugins/netscape-enumerate.html.
+
+        Also fix some existing style issues per webkit style guidelines.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32254
+
+        Test: plugins/netscape-enumerate.html
+
+        * bindings/v8/V8NPObject.cpp:
+        (npObjectInvokeImpl):
+        (npObjectInvokeDefaultHandler):
+        (npObjectGetProperty):
+        (npObjectPropertyEnumerator):
+        (npObjectNamedPropertyEnumerator):
+        (npObjectIndexedPropertyEnumerator):
+        (createV8ObjectForNPObject):
+
+2009-12-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fragments now make WebSocket URL parsing fail.
+        https://bugs.webkit.org/show_bug.cgi?id=32144
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+
+2009-12-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix wrong length parsing in WebSocket.
+        https://bugs.webkit.org/show_bug.cgi?id=32203
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * WebCore.pro:
+
+2009-12-07  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: theme scrollbars to match GTK theme.
+        Add functions to RenderThemeChromiumLinux to change the scrollbar
+        color.
+
+        Since the change is to the Chromium WebKit API layer, testing will
+        be in Chromium's test shell.
+        http://bugs.webkit.org/show_bug.cgi?id=32048
+
+        Patch from Markus Gutschke <markus@chromium.org>.
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::saturateAndBrighten):
+        (WebCore::outlineColor):
+        (WebCore::ScrollbarThemeChromiumLinux::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::setScrollbarColors):
+        * rendering/RenderThemeChromiumLinux.h:
+        (WebCore::RenderThemeChromiumLinux::thumbInactiveColor):
+        (WebCore::RenderThemeChromiumLinux::thumbActiveColor):
+        (WebCore::RenderThemeChromiumLinux::trackColor):
+
+2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Doesn't respect Content-Disposition for downloads, and provides no way for apps to do that
+        https://bugs.webkit.org/show_bug.cgi?id=32247
+
+        Allow creating a ResourceResponse from a SoupMessage.
+
+        Covered by API test.
+
+        * platform/network/soup/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        * platform/network/soup/ResourceResponseSoup.cpp:
+        (WebCore::ResourceResponse::updateFromSoupMessage):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Reverting problematic patch, causing errors.
+
+        Revert r51789 (Avoid zero division during SVGPaintServerPattern::setup()). Crashes on all Windows slaves.
+        Reopen bug https://bugs.webkit.org/show_bug.cgi?id=29912.
+
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-12-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add support for HTMLInputElement::stepUp() and stepDown() for
+        type=number and type=range.
+        https://bugs.webkit.org/show_bug.cgi?id=27451
+
+        Our implementation of stepUp() and stepDown() rounds the resultant
+        value to conform to the step value.
+        Change the number-string conversion method for RenderSlider to be
+        consistent with type=number.
+
+        Tests: fast/forms/input-step-number.html
+               fast/forms/input-step-range.html
+               fast/forms/input-step-unsupported.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow): Unify the code for NUMBER and RANGE.
+        (WebCore::HTMLInputElement::rangeOverflow): Unify the code for NUMBER and RANGE.
+        (WebCore::HTMLInputElement::minimum): Renamed from rangeMinimum(), and support for NUMBER.
+        (WebCore::HTMLInputElement::maximum): Renamed from rangeMaximum(), and support for NUMBER.
+        (WebCore::HTMLInputElement::stepBase):
+        (WebCore::HTMLInputElement::stepMismatch): Use stepBase().
+        (WebCore::HTMLInputElement::applyStepForNumberOrRange):
+        (WebCore::HTMLInputElement::stepUp):
+        (WebCore::HTMLInputElement::stepDown):
+        (WebCore::HTMLInputElement::formStringFromDouble):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::stepUp):
+        (WebCore::HTMLInputElement::stepDown):
+        * html/HTMLInputElement.idl: Add stepUp() and stepDown().
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange): Sync with rangeMinimum()/rangeMaximum() renaming.
+        (WebCore::RenderSlider::updateFromElement): Use formStringFromDouble().
+        (WebCore::RenderSlider::setValueForPosition): Use formStringFromDouble().
+
+2009-12-07  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: Chromium build fix try 2 (dumb error).
+
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::getString):
+
+2009-12-07  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: Chromium build fix.
+
+        Fix Chromium build break caused by an added dependency from
+        ScriptControllerBase to JSDOMWindowShell, and an API change in
+        ScriptValue.
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::getString):
+
+2009-12-07  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(4.0.4-42a12): Indent does not work for twice modified with background text in gmail.
+        <rdar://problem/7442387>
+        https://bugs.webkit.org/show_bug.cgi?id=32233
+        
+        Fixes problem in re-creating the correct hierarchy under the new block.
+        Added extensive testing to cover all the cases.
+
+        Test: editing/execCommand/indent-with-style2.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Force JS binding regeneration, eventually fixing the broken tests on the bots.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Try to fix mac builds by touching svgtags.in - I only tried from-scratch builds.
+
+        * svg/svgtags.in:
+
+2009-12-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32184
+        Handle out-of-memory conditions with JSC Ropes with a JS exception, rather than crashing.
+        Switch from using fastMalloc to tryFastMalloc, pass an ExecState to record the exception on.
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::toHTMLCanvasStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::initialize):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        * bindings/js/ScriptValue.h:
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * page/Console.cpp:
+        (WebCore::Console::addMessage):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        Turn on (SVG) Filters support, by default.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        Only enable filters on mac for now, skipped all affected tests on the other platforms.
+        Will enable them one after another, to minimize breakage.
+
+        * Configurations/FeatureDefines.xcconfig: Enable FILTERS build flag.
+
+2009-12-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that KURL rejects a host name which has an IPv4 address
+        inside an IPv6 form like [::127.0.0.1].
+        https://bugs.webkit.org/show_bug.cgi?id=29913
+
+        * platform/KURL.cpp:
+        (WebCore::characterClassTable): Add IPv6Char to '.'.
+
+2009-12-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7443417> - Closing a window opened with "New windows open with: Same Page" results in crash in ::~HistoryItem
+
+        The HistoryItem copy constructor has one very specific use case - to support the feature of a WebView copying another WebView's
+        BackForwardList.  That constructor wasn't initializing its m_document pointer, leading to this crash in the destructor.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::~HistoryItem): Change the setDocument(0) to an ASSERT that the document is already 0. A HistoryItem cannot
+          outlive its Document and Documents will always clear the back-pointer in their ::detach() method.
+        (WebCore::HistoryItem::HistoryItem): Missed the m_document initializer in the copy constructor. Also remove an invalid assertion
+          about the original items m_cachedPage object (which is irrelevant to the copy).
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove partial SharedScript implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=32237
+        The patch was obtained by running "git revert" command and then un-reverting WebCore/ChangeLog.
+
+        * DerivedSources.make:
+        * SharedScript/SharedScriptContext.cpp: Removed.
+        * SharedScript/SharedScriptContext.h: Removed.
+        * SharedScript/SharedScriptContext.idl: Removed.
+        * SharedScript/SharedScriptController.h: Removed.
+        * SharedScript/WebKitSharedScript.cpp: Removed.
+        * SharedScript/WebKitSharedScript.h: Removed.
+        * SharedScript/WebKitSharedScript.idl: Removed.
+        * SharedScript/WebKitSharedScriptRepository.cpp: Removed.
+        * SharedScript/WebKitSharedScriptRepository.h: Removed.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * dom/EventTarget.cpp:
+        * dom/EventTarget.h:
+        * dom/ScriptExecutionContext.h:
+
+2009-12-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32226
+        Random crashes in WebSocket tests on Leopard Debug builbot
+
+        * platform/network/SocketStreamHandleBase.cpp: (WebCore::SocketStreamHandleBase::close):
+        Make sure the object still exists when setting m_state.
+
+2009-12-07  Shiki Okasaka  <shiki@google.com>
+
+        Reviewed by Dirk Schulze.
+
+        Avoid zero division during SVGPaintServerPattern::setup()
+        https://bugs.webkit.org/show_bug.cgi?id=29912
+
+        Fix zero division bugs in SVGPaintServerPattern::setup() that occurred
+        if the tile of a pattern was bigger than the pattern and the pattern
+        size was < 0.5, and if the attribute overflow was set to visible.
+
+        Test: svg/custom/small-pattern.html
+
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-12-07  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] WebCore::WebGLArrayBufferInternal::byteLengthAttrGetter NULL pointer
+        https://bugs.webkit.org/show_bug.cgi?id=31889
+
+        Fixed bug in handling of zero-argument constructor call.
+
+        Test: fast/canvas/webgl/bug-31889.html
+
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-12-07  Gyuyoung Kim  <gyuyoung@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32024
+        [GTK] WebKit does not compile without JAVASCRIPT_DEBUGGER
+
+        Fix build errors when javascript-debugger is disabled on GTK
+
+        * GNUmakefile.am:
+
+2009-12-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed <rdar://problem/7437820> Weird selection artifacts
+
+        Tests: fast/repaint/block-selection-gap-stale-cache-2.html
+               fast/repaint/block-selection-gap-stale-cache.html
+
+        Instead of caching the block selection gaps’ bounds in the RenderView at setSelection()
+        time, cache them in each RenderLayer at paint time. This prevents the cache from getting
+        stale due to layout changes and overflow scrolling.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint): Account for overflow scroll.
+        (WebCore::RenderBlock::paintSelection): Update the enclosing layer’s selection gaps bounds.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::addBlockSelectionGapsBounds): Added. Updates the selection gaps
+        bounds to include the given rect.
+        (WebCore::RenderLayer::clearBlockSelectionGapsBounds): Added. Recursively clears the cached
+        selection gaps bounds.
+        (WebCore::RenderLayer::repaintBlockSelectionGaps): Added. Recursively invalidates the
+        selection gaps bounds.
+        * rendering/RenderLayer.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Clear the layer-level selection gaps bounds instead
+        of the view-level cache.
+        (WebCore::RenderView::clearSelection): Changed to call repaintBlockSelectionGaps().
+        * rendering/RenderView.h:
+
+2009-12-07  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Fixed whitelist comment and removed useless (tags, sdp) mimetypes
+        from it. Also, GStreamer doesn't handle directly SMIL.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-12-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Eliminate the segfaults which occur when accessing the text interface now
+        implemented by text controls.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+
+2009-12-07  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Turn the MediaPlayer supported types blacklist into a whitelist
+
+        [GTK] REGRESSION: webkit thinks it can render PDFs
+        https://bugs.webkit.org/show_bug.cgi?id=32183
+
+        Covered by API test.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-12-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25524
+        [Gtk] Expose the title attribute to assistive technologies
+
+        Expose 'alt' attribute from images as accessible name.
+        Expose the 'title' core HTML attribute as accessible description.
+        This is a modified version of the original fix submitted by Mario Sanchez Prada,
+        adjusted so that it doesn't impact other platforms.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_name):
+        (webkit_accessible_get_description):
+
+2009-12-07  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix support for generic font families
+
+        By not propagating the resolved font family in FontCacheQt and
+        only concidering the font description we ended up passing the
+        generic font families to Qt directly. Since most systems don't
+        have a mapping for these font families we ended up using the
+        default font in most cases.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        * platform/graphics/qt/FontPlatformData.h:
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+
+2009-12-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Object.getOwnPropertyDescriptor() allows cross-frame access
+        https://bugs.webkit.org/show_bug.cgi?id=32119
+
+        Make all implementations of getOwnPropertyDescriptor that have
+        cross domain restrictions simply fail immediately on cross domain
+        access, rather than trying to mimic the behaviour of normal
+        property access.
+
+        Test: http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-12-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific functions from jni_utility and moves them to new jsc/jni_utility_private files.
+        https://bugs.webkit.org/show_bug.cgi?id=32157
+
+        Build fix only, no new tests.
+
+        * WebCore.xcodeproj/project.pbxproj: Modified. Add jni_utility_private.[cpp|h].
+        * bridge/jni/jni_instance.cpp: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_jsobject.mm: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_objc.mm: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_runtime.cpp: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_utility.cpp: Modified. Removed convertValueToJValue and convertArrayInstanceToJavaArray.
+        * bridge/jni/jni_utility.h: Modified. Removed convertValueToJValue and dispatchJNICall.
+        * bridge/jni/jsc: Added.
+        * bridge/jni/jsc/jni_utility_private.cpp: Added.
+        (JSC::Bindings::convertArrayInstanceToJavaArray):
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/jni_utility_private.h: Added. Header for convertValueToJValue and dispatchJNICall.
+        * platform/android/TemporaryLinkStubs.cpp: Modified. Include jni_utility_private.h for JSC.
+
+2009-12-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        texImage2D pixel junk for transparency
+        https://bugs.webkit.org/show_bug.cgi?id=32188
+
+        Use kCGBlendModeCopy when drawing an image to the intermediate context
+        used to create a GL texture.
+
+        No test as we don't currently have any mechanism to retrieve pixel data
+        from the webgl context.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::imageToTexture):
+
+2009-12-03  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Advertize audio/ogg correctly and refactored mime-type cache
+        building.
+
+        [GTK] Recognize oga as audio/ogg
+        https://bugs.webkit.org/show_bug.cgi?id=31990
+
+        Test: media/media-can-play-ogg.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-12-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32175
+        REGRESSION: websocket/tests/url-parsing.html is crashing on Leopard Bot
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback): Call platformClose() to unschedule both
+        streams, guaranteeing that there will be no callbacks after SocketStreamHandle is destroyed.
+        (WebCore::SocketStreamHandle::writeStreamCallback): Edited a comment a bit.
+
+2009-12-05  Adam Langley  <agl@google.com>
+
+        Reviewed by Adam Barth.
+
+        Check that a CSS format() argument is of a valid type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31815
+        http://code.google.com/p/chromium/issues/detail?id=28582
+
+        Test: fast/css/url-format-non-string.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFontFaceSrc):
+
+2009-12-04  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: make rounded borders heavier.
+
+        Skia draws its rounded corners differently from the other ports.
+        Whereas they have anti-aliased clipping regions, Skia only has 1-bit
+        regions. (Which is technically more correct, but somewhat unhelpful
+        for us.) Instead, with Skia we use a layer and collect all the
+        clipping paths in effect. When the state is popped, we paint
+        transparency outside the clipping paths and merge the layer down.
+
+        This appears to cause rounded borders to look a little thin, which is
+        addressed in this patch.
+
+        This is well covered by existing tests but will require new baselines
+        in the Chromium tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31778
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+
+2009-12-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7441571> Hardware-backed layers are skipped when printing
+        
+        When printing, set the PaintBehaviorFlattenCompositingLayers flag so that compositing layers
+        paint. This also causes 3D transforms to be flattened to 2D.
+
+        Test: printing/compositing-layer-printing.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+
+2009-12-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Fix up some issues in my SVGListTraits change from yesterday.
+
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-04  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: chromium build fix.
+
+        Fix Chromium build break caused by moving of isDefaultPortForProtocol() and
+        portAllowed() into KURL.h/KURL.cpp.  Cloning code.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::isDefaultPortForProtocol):
+        (WebCore::portAllowed):
+
+2009-12-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Remove suppress highlight when restoring selected node.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32152
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.setDocument.selectNode):
+        (WebInspector.ElementsPanel.prototype.setDocument.selectLastSelectedNode):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+
+2009-12-04  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Gradient SVG animation demonstrates tearing at animation extremes
+        https://bugs.webkit.org/show_bug.cgi?id=11929
+
+        The focalPoint of a radial gradient is temporarly substracted by
+        the centralPoint, if the focalPoint is not in the radius of the
+        gradient. This is needed to calculate a new postion of the focalPoint
+        according to the specification. But the new focalPoint needs to be
+        moved by the centralPoint after this calculation, which is not the case
+        at the moment. This patch fixes this issue. It was also introduced a
+        deviation of maximal 0.2% for Cairo to get around the fixed point numbers
+        in Cairo.
+
+        W3C-SVG-1.1/pservers-grad-13-b needed an update. The missing adjustment
+        of the new focalPoint caused wrong results for the last three tests.
+
+        Test: svg/custom/radial-gradient-with-outstanding-focalPoint.svg
+
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+
+2009-12-04  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Do not use WebCore::String::String(const UChar*, int length) to convert
+        short v8 strings.
+
+        Plus added string traits.
+        https://bugs.webkit.org/show_bug.cgi?id=31415
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::):
+        (WebCore::v8StringToWebCoreString):
+
+2009-12-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: AX: buttons now extremely repetitive
+        https://bugs.webkit.org/show_bug.cgi?id=32164
+
+        Test: platform/mac/accessibility/button-shouldnot-have-axvalue.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isButton):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2009-12-04  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Check whether the right side of a string append is non-empty
+        https://bugs.webkit.org/show_bug.cgi?id=32151
+
+        Especially beneficial for CachedScript::script() method
+        which usually appends an empty string returned by flush()
+        to its m_script member. m_script is often hundreds of kbytes
+        which is duplated without reason.
+
+        * platform/text/String.cpp:
+        (WebCore::String::append):
+
+2009-12-04  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Mail.app crashes when indenting table pasted from Numbers.app.
+        <rdar://problem/7209507>
+        https://bugs.webkit.org/show_bug.cgi?id=32166
+
+        Test: LayoutTests/editing/execCommand/indent-partial-table.html
+        
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Added test to verify that the end of the paragraph
+        after the selection has not been moved.
+
+2009-12-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32085
+        WebSocket should block the same ports that are blocked for resource loading
+
+        Test: websocket/tests/url-parsing.html
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::localURLSchemes):
+        * page/SecurityOrigin.h:
+        Move isDefaultPortForProtocol() to KURL, because that's a better place for it (SecurityOrigin
+        is not even in WebCore/platform directory).
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+        (WebCore::HTMLAnchorElement::setHost):
+        (WebCore::HTMLAnchorElement::setPort):
+        Updated for the new location of isDefaultPortForProtocol().
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::protocolIs): In an assertion, compare to "javascript" case-insensitively,
+        since the function doesn't require lower case input.
+        (WebCore::isDefaultPortForProtocol): Moved from SecurityOrigin.
+        (WebCore::portAllowed): Moved from ResourceHandle.
+        * platform/KURL.h:
+
+        * platform/network/ResourceHandle.cpp: (WebCore::ResourceHandle::create): Updated for the
+        new location of portAllowed().
+
+        * websockets/WebSocket.cpp: (WebCore::WebSocket::connect): Per the spec, raise a SECURITY_ERR
+        if trying to connect to a blocked port.
+
+2009-12-04  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] WebKit crashes when loading certain SVG images
+        https://bugs.webkit.org/show_bug.cgi?id=29443
+
+        Remove FontFallbackListQt and rely on the common FontFallbackList
+        to handle the fonts. FontCache and FontPlatformData have been
+        updated to work with the common FontFallbackList.
+
+        In the previous implementation, FontPlatformDataCacheKey
+        was a clone of FontPlatformData with the hashing
+        capabilities added in order to use it as a key in the cache's
+        hashmap. FontPlatformData has been modified to handle the hashing
+        function directly so the data are not copied twice in memory.
+
+        FontFallbackList::fontDataAt() from FontFallbackListQt was a copy of
+        code from FontCache::getFontData() and FontFallbackList::fontDataAt().
+        The behavior is similar except currFamily->family().length() was
+        not tested and the fallback fonts selector were not used.
+
+        Existing tests cover the change.
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/qt/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        Removed. We now use the implementation from FontFallbackList.cpp
+        * platform/graphics/qt/FontPlatformData.h:
+        Add hashing capabilities to be able to use the data with the FontCache.
+        This was previously done in FontCacheQt.cpp
+        (WebCore::FontPlatformDataPrivate::FontPlatformDataPrivate):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::family):
+        (WebCore::FontPlatformData::bold):
+        (WebCore::FontPlatformData::italic):
+        (WebCore::FontPlatformData::smallCaps):
+        (WebCore::FontPlatformData::pixelSize):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::operator==):
+        (WebCore::FontPlatformData::hash):
+
+2009-12-04  Adam Treat  <atreat@rim.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix wrong assert that was only working through sheer luck.
+        https://bugs.webkit.org/show_bug.cgi?id=32162
+
+        * platform/text/BidiContext.cpp:
+        (WebCore::BidiContext::create):
+
+2009-12-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Allow removing 'qrc' as a local security origin scheme
+
+        * page/SecurityOrigin.cpp:
+
+2009-12-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CollectionCache
+        https://bugs.webkit.org/show_bug.cgi?id=32109
+
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new':
+
+        struct name            - instantiated at: WebCore/'location'
+
+        struct CollectionCache - dom/Document.cpp:4029
+
+        * html/CollectionCache.h:
+
+2009-12-04  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes a crashing bug in Geolocation when a watch is cleared from some callbacks. 
+        https://bugs.webkit.org/show_bug.cgi?id=32111
+
+        In Geolocation::GeoNotifier::timerFired, a JS callback may be invoked if a
+        fatal error was registered on this GeoNotifier or if this request has timed
+        out. If the request is a watch, and is cleared by a call to clearWatch in the
+        callback, the GeoNotifier object will be destroyed. We must therefore cache the
+        m_geolocation member to allow us to call Geolocation::fatalErrorOccurred or
+        Geolocation::requestTimedOut.
+
+        Tests: fast/dom/Geolocation/permission-denied-already-clear-watch.html
+               fast/dom/Geolocation/timeout-clear-watch.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Cache the m_geolocation member before invoking the JS callback.
+
+2009-12-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for 2 classes of the platform directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        Inherits the following class from Noncopyable because it is instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name         - instantiated at: WebCore/'location'
+
+        class SharedTimer         - (its child class) workers/WorkerRunLoop.cpp:91
+
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new':
+
+        class TransformOperations - rendering/style/RenderStyle.h:1175
+
+        Noncopyable.h's include added to SharedTimer.h.
+
+        * platform/SharedTimer.h:
+        * platform/graphics/transforms/TransformOperations.h:
+
+2009-12-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK]Enable DNS prefetching
+        https://bugs.webkit.org/show_bug.cgi?id=23846
+
+        Enable DNS prefetching.
+
+        Based on a patch by José Millán.
+
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS):
+
+2009-12-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for the svg directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name           - instantiated at: WebCore/'location'
+
+        struct ResourceSet          - svg/graphics/SVGResource.cpp:148
+        class SVGFontData           - css/CSSFontFaceSource.cpp:156
+        class SVGDocumentExtensions - dom/Document.cpp:3962
+        class SVGViewSpec           - svg/SVGSVGElement.cpp:191
+
+        * svg/SVGDocumentExtensions.h:
+        * svg/SVGFontData.h:
+        * svg/SVGViewSpec.h:
+        * svg/graphics/SVGResource.cpp:
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: aria-activedescendant doesn't work as intended
+        https://bugs.webkit.org/show_bug.cgi?id=32100
+
+        Fixes a number of issues regarding the "tree" role and aria-activedescendant.
+        1. The indexes were being reported incorrectly by treeitems.
+        2. aria-activedescendant changes were not being sent to the containing item.
+        3. The tree's selected rows need to consult aria-activedescendant.
+        4. Since a tree changes what it returns as its children (it returns its rows)
+           the mac-specific array indexing methods need to correctly handle the tree case.
+
+        Tests: platform/mac/accessibility/aria-tree-activedescendant.html
+               platform/mac/accessibility/aria-tree-index-of-items.html
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::shouldFocusActiveDescendant):
+        (WebCore::AccessibilityRenderObject::activeDescendant):
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        (WebCore::AccessibilityRenderObject::ariaTreeSelectedRows):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+
+2009-12-03  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for the xml directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        Inherits the following class from Noncopyable because it is instantiated 
+        by 'new' and no need to be copyable:
+
+        class/struct name               - instantiated at: WebCore/'location'
+
+        struct XMLHttpRequestStaticData - xml/XMLHttpRequest.cpp:134
+
+        Inherits the following classes from FastAllocBase because these are instantiated by 'new':
+
+        class NodeTest                  - xml/XPathGrammar.y:258
+        class NodeSet                   - xml/XPathValue.cpp:52
+        struct EvaluationContext        - xml/XPathExpressionNode.cpp:40
+
+        * xml/XMLHttpRequest.cpp:
+        * xml/XPathExpressionNode.h:
+        * xml/XPathNodeSet.h:
+        * xml/XPathStep.h:
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        New History changes do not compile for Chromium/V8
+        https://bugs.webkit.org/show_bug.cgi?id=32148
+
+        Existing tests suffice (just trying to get code to compile).
+
+        * WebCore.gypi:
+        Added V8HistoryCustom.cpp and other missing files.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added custom handlers for History.pushState()/replaceState().
+        * bindings/v8/custom/V8HistoryCustom.cpp: Added.
+        Added custom handlers for History.pushState()/replaceState().
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        Stubbed out this routine for now - will implement in the future.
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        OwnPtr<XBLBindingManager> Document::m_bindingManager;
+        https://bugs.webkit.org/show_bug.cgi?id=32147
+
+        The document actually owns the bindingManager.  That's what the code
+        should say.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        * dom/Document.h:
+        (WebCore::Document::bindingManager):
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        OwnPtr<Tokenizer> Document::m_tokenizer;
+        https://bugs.webkit.org/show_bug.cgi?id=32145
+
+        The document actually owns the tokenizer.  That's what the code should say.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removedLastRef):
+        (WebCore::Document::~Document):
+        (WebCore::Document::cancelParsing):
+        (WebCore::Document::implicitOpen):
+        (WebCore::Document::implicitClose):
+        * dom/Document.h:
+        (WebCore::Document::tokenizer):
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        OwnPtr<RenderArena> Document::m_renderArena;
+        https://bugs.webkit.org/show_bug.cgi?id=32146
+
+        The document owns the renderArena.  That's what the code should say.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Also, removed a redundant initialization
+        of the tokenizer that I missed in my previous patch.
+        (WebCore::Document::~Document):
+        (WebCore::Document::attach):
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        (WebCore::Document::renderArena):
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Rolling back r51633 because it causes a chromium perf regression.
+
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        The code should say that Document owns DocLoader
+        https://bugs.webkit.org/show_bug.cgi?id=32143
+
+        It's the truth.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        * dom/Document.h:
+        (WebCore::Document::docLoader):
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        AX: VO just says "term" on many web sites
+        https://bugs.webkit.org/show_bug.cgi?id=32139
+
+        Test: platform/mac/accessibility/definition-list-term.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper subrole]):
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Implement WAI-ARIA scrollbar role and related property aria-orientation
+        https://bugs.webkit.org/show_bug.cgi?id=32126
+
+        Test: accessibility/aria-scrollbar-role.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isScrollbar):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::valueForRange):
+        (WebCore::AccessibilityRenderObject::orientation):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-12-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed <rdar://problem/7401617> Selection painting issue in hardware-
+        accelerated layers
+        which is another part of https://bugs.webkit.org/show_bug.cgi?id=23628
+        Fix selection painting to do container-relative repaints
+
+        Test: fast/repaint/block-selection-gap-in-composited-layer.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint): Compute and paint
+        gap rects in the coordinate space of the repaint container.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect): Added a
+        FIXME.
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Map block selection gap rects from
+        the repaint container’s coordinate space to the view’s coordinate space
+        before adding them to the cached selection bounds.
+        (WebCore::RenderView::clearSelection): Changed to use
+        repaintRectangleInViewAndCompositedLayers() so that the selection rect
+        is invalidated in composited layers as well.
+
+2009-12-03  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 32066 - Add enable geolocation flag to WebCore::Settings for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=32066
+
+        Adds geolocationEnabled in Settings for runtime control of geolocaiton features. This defaults to ON
+        as it is intended as a development and testing aid, not a user control. To completely remove geolocation
+        from a given port, the compile time ENABLE_GEOLOCATION should still be used.
+        Adding placeholder GeolocationServiceChromium implementation, as this is required to allows
+        ENABLE_GEOLOCATION to be defined (in turn required for testing), even though this patch does not
+        make that the default just yet.
+
+        * WebCore.gypi:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Add new m_geolocationEnabled flag default value
+        (WebCore::Settings::setGeolocationEnabled): Setter for  m_geolocationEnabled flag
+        * page/Settings.h:
+        (WebCore::Settings::geolocationEnabled):  Add m_geolocationEnabled flag
+        * platform/chromium/GeolocationServiceChromium.cpp: Added.
+        (WebCore::GeolocationServiceChromium::GeolocationServiceChromium): Place holder GeolocationServiceChromium)
+        (WebCore::createGeolocationService): factory function, only required when ENABLED(GEOLOCATION) is true
+
+2009-12-03  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by John Sullivan.
+
+        SpinTracer: 349 spins in Mail at WebCore::Editor::advanceToNextMisspelling(bool)
+        <rdar://problem/7198592>
+        https://bugs.webkit.org/show_bug.cgi?id=32129
+
+        Fixed the way the next paragraph is calculated.
+        I've added a repro case in Safari and attached it to the Bugzilla bug.
+
+        * editing/Editor.cpp:
+        (WebCore::findFirstMisspellingOrBadGrammarInRange): Changed the way we move to the
+        next paragraph in the loop.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        No wonder editing WebCore.exp repeatedly while I worked on this patch never seemed to stick.
+
+        Long live our auto-generated overlords that I didn't know about...  
+
+        * WebCore.base.exp:
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r51627): 3 SVG tests are failing
+        https://bugs.webkit.org/show_bug.cgi?id=32117
+
+        Null checking Items in the SVGList is insufficient as items may
+        be floats, etc so add SVGListTraits::isNull and add appropriate
+        specializations.
+
+        Test: svg/dom/svglist-exception-on-out-bounds-error.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGListTypeOperations::isNull):
+        (WebCore::SVGList::initialize):
+        (WebCore::SVGList::insertItemBefore):
+        (WebCore::SVGList::replaceItem):
+        (WebCore::SVGList::appendItem):
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        No review - release build fix.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::documentDetached):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        No review - release build fix.
+
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::pushState):
+
+2009-12-03  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Multiple Undos removes the last posted comment and/or the ones before it.
+        <rdar://problem/6557066>
+        https://bugs.webkit.org/show_bug.cgi?id=32079
+        
+        The fix consists in preventing Undos and Redos to be applied to elements that
+        are no longer editable. We do not attempt to remove the commands from the queue.
+        It is a relatively simple fix that comes with a little extra overhead for the apply
+        and unapply methods where we are now performing the editability check.
+
+        Test: editing/undo/undo-indent-noneditable.html
+
+        * editing/AppendNodeCommand.cpp:
+        (WebCore::AppendNodeCommand::doApply):
+        (WebCore::AppendNodeCommand::doUnapply):
+        * editing/DeleteFromTextNodeCommand.cpp:
+        (WebCore::DeleteFromTextNodeCommand::doApply):
+        (WebCore::DeleteFromTextNodeCommand::doUnapply):
+        * editing/InsertIntoTextNodeCommand.cpp:
+        (WebCore::InsertIntoTextNodeCommand::doApply):
+        (WebCore::InsertIntoTextNodeCommand::doUnapply):
+        * editing/InsertNodeBeforeCommand.cpp:
+        (WebCore::InsertNodeBeforeCommand::doApply):
+        (WebCore::InsertNodeBeforeCommand::doUnapply):
+        * editing/JoinTextNodesCommand.cpp:
+        (WebCore::JoinTextNodesCommand::doApply):
+        (WebCore::JoinTextNodesCommand::doUnapply):
+        * editing/MergeIdenticalElementsCommand.cpp:
+        (WebCore::MergeIdenticalElementsCommand::doApply):
+        (WebCore::MergeIdenticalElementsCommand::doUnapply):
+        * editing/RemoveNodeCommand.cpp:
+        (WebCore::RemoveNodeCommand::doApply):
+        (WebCore::RemoveNodeCommand::doUnapply):
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::executeApply):
+        (WebCore::SplitElementCommand::doUnapply):
+        * editing/SplitTextNodeCommand.cpp:
+        (WebCore::SplitTextNodeCommand::doApply):
+        (WebCore::SplitTextNodeCommand::doUnapply):
+        * editing/WrapContentsInDummySpanCommand.cpp:
+        (WebCore::WrapContentsInDummySpanCommand::doUnapply):
+        (WebCore::WrapContentsInDummySpanCommand::doReapply):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7214236> and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        Tests: fast/loader/stateobjects/document-destroyed-navigate-back.html
+               fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html
+               fast/loader/stateobjects/popstate-after-load-complete-addeventlistener.html
+               fast/loader/stateobjects/popstate-after-load-complete-body-attribute.html
+               fast/loader/stateobjects/popstate-after-load-complete-window-attribute.html
+               fast/loader/stateobjects/pushstate-object-types.html
+               fast/loader/stateobjects/pushstate-then-replacestate.html
+               fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html
+               fast/loader/stateobjects/replacestate-then-pushstate.html
+               http/tests/loading/state-object-security-exception.html
+
+        Derived sources and project file changes:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am
+        * WebCore.pro
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Add the new PopStateEvent:
+        * dom/PopStateEvent.cpp: Added.
+        (WebCore::PopStateEvent::PopStateEvent):
+        (WebCore::PopStateEvent::initPopStateEvent):
+        * dom/PopStateEvent.h: Added.
+        (WebCore::PopStateEvent::create):
+        (WebCore::PopStateEvent::isPopStateEvent):
+        (WebCore::PopStateEvent::state):
+        * dom/PopStateEvent.idl: Added.
+        * bindings/js/JSPopStateEventCustom.cpp: Added.
+        (WebCore::JSPopStateEvent::initPopStateEvent):
+        (WebCore::JSPopStateEvent::state):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * dom/Event.cpp:
+        (WebCore::Event::isPopStateEvent):
+        * dom/Event.h:
+        * dom/EventNames.h:
+
+        Add the "onpopstate" attribute:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLBodyElement.idl:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+        Add pushState and replaceState management to the loader and history machinery:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::pushState):
+        (WebCore::JSHistory::replaceState):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateForSameDocumentNavigation): Augmented from "scrollToAnchor()", combining
+          both the same-document fragment scroll case with the new same-document state object activation case.
+        (WebCore::HistoryController::pushState):
+        (WebCore::HistoryController::replaceState):
+        * loader/HistoryController.h:
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::addItem): Use insertItemAfterCurrent.
+        (WebCore::BackForwardList::insertItemAfterCurrent): Optionally insert the item without clearing the forward
+          list, as pushStateItem might've selectively cleared only certain items, with the bulk of the forward list
+          meant to remain.
+        (WebCore::BackForwardList::pushStateItem): Clear the forward list *only* for the state item's document, then 
+          insert the new item.
+        (WebCore::BackForwardList::removeItem):
+        * history/BackForwardList.h:
+        * page/History.cpp:
+        (WebCore::History::urlForState):
+        (WebCore::History::stateObjectAdded):
+        * page/History.h:
+        * page/History.idl:
+
+        Let HistoryItems and Documents associate with each other, as well as letting HistoryItems contain state objects:
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        (WebCore::HistoryItem::setStateObject):
+        (WebCore::HistoryItem::setDocument):
+        (WebCore::HistoryItem::documentDetached):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::stateObject):
+        (WebCore::HistoryItem::document):
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Notify all back/forward history items owned by this Document that it
+          is going away.
+        (WebCore::Document::registerHistoryItem): Manage the list of back/forward history items this document owns.
+        (WebCore::Document::unregisterHistoryItem): Ditto.
+        * dom/Document.h:
+
+        Add the ability for Documents, DocumentLoaders, and FrameLoaderClients to be notified when a Documents
+        URL changes as the result of pushState(), replaceState(), or a popstate navigation:
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): If there's a pending state object, dispatch the popstate event.
+        (WebCore::Document::updateURLForPushOrReplaceState):
+        (WebCore::Document::statePopped): If loading is complete, dispatch the popstate event. Otherwise, set 
+          the pending state object.
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::replaceRequestURLForSameDocumentNavigation):
+        * loader/DocumentLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidChangeStateObjectForPageForFrame):
+
+        Change handling of "loading a HistoryItem" to distinguish between new-Document navigations and same-Document
+        navigations, combining the old concept of anchor scrolls with the new concept of state object navigations:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadInSameDocument):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::navigateWithinDocument):
+        (WebCore::FrameLoader::navigateToDifferentDocument):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * page/Page.cpp:
+        (WebCore::Page::goToItem): Changed to allow state object activations to pass through without the load stopping.
+
+2009-12-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: chromium build fix.
+        r51621 changed JS bindings only, broke v8's.
+
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/v8/ScriptFunctionCall.h:
+
+2009-12-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Attributes and NamedNodeMaps aren't tracked correctly and may be prematurely garbage-collected.
+        https://bugs.webkit.org/show_bug.cgi?id=32094
+
+        Covered by existing test: LayoutTests/fast/dom/Attr/access-after-element-destruction.html
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertNamedNodeMapToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-12-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Chromium: Add support for settings containing ":"
+
+        https://bugs.webkit.org/show_bug.cgi?id=32118
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection):
+
+2009-12-03  Rafael Antognolli  <antognolli@profusion.mobi>, Kenneth Christiansen <kenneth@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        repaint events from outside the viewport aren't received
+        https://bugs.webkit.org/show_bug.cgi?id=32081
+
+        When using a tiled backing store for painting, you need to receive
+        event from outside the viewport. Setting the viewport to the size
+        of the contents is not an option if you want to make use of WebCore's
+        infrastructure for drawing scrollbars etc.
+
+        A new property, paintsEntireContents, has been introduced for the
+        above use-case. It is settable, as tiling will be optional for Qt,
+        and for the not yet upstreamed EFL port, there will be two different
+        views, where only one of them are tiled.
+
+        No change in behavior, so no new tests added.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::setPaintsEntireContents):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::paintsEntireContents):
+
+2009-11-23  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Switch Chrome/Mac to use Core Text APIs rather than ATSUI APIs.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        No test since this is already covered by existing pixel tests.
+
+        * platform/graphics/SimpleFontData.h: Change #ifdef to define getNSFont() on Chrome/Mac .
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp: Provide forward declarations
+        of Core Text functions that are public on 10.6 but SPI on 10.5.
+
+2009-12-03  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Simplify the settings support in inspector controller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32076
+
+        Test: inspector/settings-set-get.html
+
+        * WebCore.Inspector.exp:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * inspector/InspectorClient.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::setting):
+        (WebCore::InspectorController::setSetting):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::attachWindow):
+        (WebCore::InspectorController::setAttachedWindowHeight):
+        (WebCore::InspectorController::storeLastActivePanel):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::showWindow):
+        (WebCore::InspectorController::enableResourceTracking):
+        (WebCore::InspectorController::disableResourceTracking):
+        (WebCore::InspectorController::ensureResourceTrackingSettingsLoaded):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebuggerFromFrontend):
+        (WebCore::InspectorController::disableDebugger):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::setting):
+        (WebCore::InspectorFrontendHost::setSetting):
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyInspectorClient::populateSetting):
+        (WebCore::EmptyInspectorClient::storeSetting):
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] notifyHistoryItemChanged() should pass a pointer to the HistoryItem that changed.
+        https://bugs.webkit.org/show_bug.cgi?id=31915
+
+        No change in functionality so no new tests required.
+
+        * history/HistoryItem.cpp:
+        (WebCore::defaultNotifyHistoryItemChanged): Update this function to pass the HistoryItem that is being changed.
+        (WebCore::HistoryItem::setAlternateTitle): Update call to notifyHistoryItemChanged to include the new parameter.
+        (WebCore::HistoryItem::setURLString): ditto.
+        (WebCore::HistoryItem::setOriginalURLString): ditto.
+        (WebCore::HistoryItem::setReferrer): ditto.
+        (WebCore::HistoryItem::setTitle): ditto.
+        (WebCore::HistoryItem::setTarget): ditto.
+        (WebCore::HistoryItem::setDocumentState): On Android, add a call to notifyHistoryItemChanged. See bug for a discussion of why this is needed.
+        (WebCore::HistoryItem::clearDocumentState): ditto.
+        (WebCore::HistoryItem::setIsTargetItem): ditto.
+        (WebCore::HistoryItem::addChildItem): ditto.
+        (WebCore::HistoryItem::setFormInfoFromRequest): ditto.
+        * history/HistoryItem.h: Update signature of notifyHistoryItemChanged.
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] The FrameLoaderClient is unaware of BackForwardList changes.
+        https://bugs.webkit.org/show_bug.cgi?id=31914
+
+        This change adds three new methods on the FrameLoaderClient interface to receive notifications when the BackForwardList changes.
+
+        No new tests required. Functionality on all platforms upstream remains the same. Android is the first platform to make use of these callbacks.
+
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::addItem): Execute the callback.
+        (WebCore::BackForwardList::goBack): ditto.
+        (WebCore::BackForwardList::goForward): ditto.
+        (WebCore::BackForwardList::goToItem): ditto.
+        (WebCore::BackForwardList::setCapacity): dito.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidAddBackForwardItem): Add an empty implementation for the callback that does nothing.
+        (WebCore::EmptyFrameLoaderClient::dispatchDidRemoveBackForwardItem): ditto.
+        (WebCore::EmptyFrameLoaderClient::dispatchDidChangeBackForwardIndex): ditto.
+        * loader/FrameLoaderClient.h:
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] Upstream WebCore/history/android: Require some platform specific state attached to HistoryItem.
+        https://bugs.webkit.org/show_bug.cgi?id=31913
+
+        Android stores information such as the zoom scale factor and bridge back to the Java counterpart with HistoryItem.
+
+        No new tests required as this is Android specific code.
+
+        * history/HistoryItem.h: Add Android specific member data to HistoryItem.
+        * history/android: Added.
+        * history/android/AndroidWebHistoryBridge.h: Added.
+        * history/android/HistoryItemAndroid.cpp: Added, provides implementation for Android specific member functions in HistoryItem.
+        (WebCore::HistoryItem::bridge): Added.
+        (WebCore::HistoryItem::setBridge): Added.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        NULL ptr in SVGPathSegList::getPathSegAtLength()
+        https://bugs.webkit.org/show_bug.cgi?id=30313
+
+        Add exception checks to SVGPathSegList's implementation to catch (and propagate) exceptions.
+        Add null checks to SVGList's content manipulation functions to prevent
+        null values from entering the list in the first place.
+
+        Test: svg/dom/svgpath-out-of-bounds-getPathSeg.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGList::initialize):
+        (WebCore::SVGList::insertItemBefore):
+        (WebCore::SVGList::replaceItem):
+        (WebCore::SVGList::appendItem):
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::getPathSegAtLength):
+        * svg/SVGPathElement.h:
+        * svg/SVGPathElement.idl:
+        * svg/SVGPathSegList.cpp:
+        (WebCore::SVGPathSegList::getPathSegAtLength):
+        (WebCore::SVGPathSegList::toPathData):
+        (WebCore::SVGPathSegList::createAnimated):
+        * svg/SVGPathSegList.h:
+
+2009-12-02  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Sanitize web fonts using the OTS library 
+        https://bugs.webkit.org/show_bug.cgi?id=31106
+
+        Add support for OpenType sanitizer (OTS). It parses OpenType files (from @font-face)
+        and attempts to validate and sanitize them. We hope this reduces the attack surface
+        of the system font libraries.
+
+        * WebCore.gyp/WebCore.gyp: Added dependency to (chromium_src_dir)/third_party/ots/ library.
+        * WebCore.gypi: Added new files below.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * platform/graphics/chromium/FontCustomPlatformData.cpp: Validate and transcode a web font.
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/FontCustomPlatformData.cpp: Ditto.
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/opentype/OpenTypeSanitizer.cpp: Added.
+        (WebCore::OpenTypeSanitizer::sanitize):
+        * platform/graphics/opentype/OpenTypeSanitizer.h: Added.
+        (WebCore::OpenTypeSanitizer::OpenTypeSanitizer):
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Web Inspector frontend heap allocates ScriptFunctionCall which is unsafe
+        https://bugs.webkit.org/show_bug.cgi?id=32098
+
+        Fix is simply to make the ScriptFunctionCall stack allocated as nature intended.
+        Doing this required adding an appendArgument(char*) to ScriptFunctionCall so
+        that an explicit String cast would not be necessary.
+
+        To prevent something like this happening again in future i've added private
+        operator new implementations to ScriptFunctionCall making this type of mistake
+        produce errors when compiling.
+
+        Test case: Inspector tests now pass with GC on every alloc enabled.
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/js/ScriptFunctionCall.h:
+        (WebCore::ScriptFunctionCall::operator new):
+        (WebCore::ScriptFunctionCall::operator new[]):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setAttachedWindow):
+        (WebCore::InspectorFrontend::addRecordToTimeline):
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::setRecordingProfile):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::setDocument):
+        (WebCore::InspectorFrontend::setDetachedRoot):
+        (WebCore::InspectorFrontend::setChildNodes):
+        (WebCore::InspectorFrontend::childNodeCountUpdated):
+        (WebCore::InspectorFrontend::childNodeInserted):
+        (WebCore::InspectorFrontend::childNodeRemoved):
+        (WebCore::InspectorFrontend::attributesUpdated):
+        (WebCore::InspectorFrontend::didRemoveNode):
+        (WebCore::InspectorFrontend::didGetChildNodes):
+        (WebCore::InspectorFrontend::didApplyDomChange):
+        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        (WebCore::InspectorFrontend::didGetCookies):
+        (WebCore::InspectorFrontend::didDispatchOnInjectedScript):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
+        (WebCore::InspectorFrontend::didSetDOMStorageItem):
+        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
+        (WebCore::InspectorFrontend::updateDOMStorage):
+        (WebCore::InspectorFrontend::addNodesToSearchResult):
+        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        * inspector/InspectorFrontend.h:
+
+2009-12-02  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32072, clean up invalid @-rule error handling so that we
+        pass more CSS test suite stuff.  Make the grammar stop enforcing the ordering of @namespace vs.
+        @variables vs. @import.  Just let the parser handle that instead.  This simplifies the grammar and
+        makes error handling deal with more cases correctly.
+
+        Added fast/css/namespaces/namespaces-invalid-at-rules.xml
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::parseRule):
+        (WebCore::CSSParser::createCharsetRule):
+        (WebCore::CSSParser::createImportRule):
+        (WebCore::CSSParser::createMediaRule):
+        (WebCore::CSSParser::createKeyframesRule):
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::addNamespace):
+        (WebCore::CSSParser::createVariablesRule):
+        * css/CSSParser.h:
+
+2009-12-02  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Safari/Chromium for Windows fails to load CJK WebFonts
+        https://bugs.webkit.org/show_bug.cgi?id=31804
+        
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        (WebCore::renameAndActivateFont): Load a remote font even if the font has 2 or more faces.
+
+2009-12-02  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium: Need tickmarks in scrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=32069
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/chromium/ScrollbarThemeChromiumMac.h: Added.
+        * platform/chromium/ScrollbarThemeChromiumMac.mm: Added.
+
+2009-11-13  Timothy Hatcher  <timothy@apple.com>
+
+        Expose a function to set the value of an input element on behalf of the user.
+        This function will dispatch the change event so the page is notified when autofill
+        happens. Also dispatch a change event when a select element is changed by autofill.
+
+        <rdar://problem/6760590> Would like a way to detect a login form AutoFill from JavaScript
+
+        Reviewed by Darin Adler.
+
+        * WebCore.xcodeproj/project.pbxproj: Added the DOMHTMLInputElementPrivate.h header.
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLSelectElement _activateItemAtIndex:]): Call setSelectedIndexByUser instead so
+        a change event is fired. This method is called by Safari autofill.
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode): Use dispatchFormControlChangeEvent instead
+        of dispatching the change event directly to be consistent.
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLInputElement::setValueForUser): Added. Calls setValue with the sendChangeEvent
+        (WebCore::HTMLInputElement::setValue): Added the optional sendChangeEvent argument. Mimics setChecked.
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl: Added setValueForUser for non-JS languages.
+        * html/InputElement.h: Added setValueForUser.
+
+2009-12-02  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: DOM tree selection disappears upon page refresh.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31142
+
+        Test: inspector/elements-panel-selection-on-refresh.html
+
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::pushNodeByPathToFrontend):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::releaseDOMAgent):
+        (WebCore::InspectorController::resetScriptObjects):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::~InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::reset):
+        (WebCore::InspectorDOMAgent::setDocument):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::nodeForPath):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._renumber):
+        (WebInspector.DOMAgent.prototype._setDocument):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.setDocument.selectDefaultNode):
+        (WebInspector.ElementsPanel.prototype.setDocument.selectLastSelectedNode):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.pushNodeByPathToFrontend):
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-12-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32045, make sure escape sequences work with
+        all the @-rules we support.  When escape sequences are present, the lexical scanner
+        just returns a generic token name: ATKEYWORD.  We have to process the escape sequences
+        and then recheck against the rules we support with the final processed name.  If we
+        find a match, we mutate the token value to the appropriate rule name token, e.g.,
+        NAMESPACE_SYM.
+
+        Added fast/css/namespaces/namespaces-escapes.xml
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::lex):
+        (WebCore::CSSParser::recheckAtKeyword):
+        (WebCore::CSSParser::text):
+        * css/CSSParser.h:
+
+2009-12-02  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.:w
+
+        Allow to skip thread checks when accessing DOMDataStore for processes
+        which run V8 in single thread mode.
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        Should be covered by buildbots.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMDataStore):
+        (WebCore::enableFasterDOMStoreAccess):
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+        * bindings/v8/V8DOMMap.h:
+
+2009-12-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Code clean up: remove ScriptObjectQuarantine.* as a whole.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32060
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/ScriptObjectQuarantine.cpp: Removed.
+        * bindings/js/ScriptObjectQuarantine.h: Removed.
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp: Removed.
+        * bindings/v8/ScriptObjectQuarantine.h: Removed.
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::quarantineValue):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorFrontend.cpp:
+
+2009-12-02  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket handshake check query component of URL
+        https://bugs.webkit.org/show_bug.cgi?id=31617
+
+        Tests: websocket/tests/url-with-credential.html
+               websocket/tests/url-with-empty-query.html
+               websocket/tests/url-with-fragment.html
+               websocket/tests/url-with-query-for-no-query.html
+               websocket/tests/url-with-query.html
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::query): returns a null if query is not specified and returns an empty if query is specified but empty.
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::resourceName): added. add query component to path if specified.
+        (WebCore::WebSocketHandshake::clientLocation):
+        (WebCore::WebSocketHandshake::clientHandshakeMessage):
+
+2009-12-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Incorrect code in WebGLRenderingContext.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=32046
+
+        Fix incorrect code that happened to work. != has higher precendence than &.
+        The simplest fix is to remove the "!= 0" which violates WebKit style
+        guidelines anyway.
+
+        Also added periods to few comments in the same function.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::validateIndexArray):
+
+2009-12-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Change [Reflect] to [ConvertNullToNullString, Reflect] for min, max,
+        pattern and step attributes of HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=31708
+
+        * html/HTMLInputElement.idl:
+
+2009-12-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: implement support for ARIA drag and drop
+        https://bugs.webkit.org/show_bug.cgi?id=32007
+
+        Test: platform/mac/accessibility/aria-drag-drop.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::supportsARIADropping):
+        (WebCore::AccessibilityObject::supportsARIADragging):
+        (WebCore::AccessibilityObject::isARIAGrabbed):
+        (WebCore::AccessibilityObject::setARIAGrabbed):
+        (WebCore::AccessibilityObject::determineARIADropEffects):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::supportsARIADropping):
+        (WebCore::AccessibilityRenderObject::supportsARIADragging):
+        (WebCore::AccessibilityRenderObject::isARIAGrabbed):
+        (WebCore::AccessibilityRenderObject::setARIAGrabbed):
+        (WebCore::AccessibilityRenderObject::determineARIADropEffects):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+        * html/HTMLAttributeNames.in:
+
+2009-12-01  Adam Barth  <abarth@webkit.org>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21288
+
+        Unreviewed port of @sandbox to V8.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isEnabled):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+
+2009-12-01  Patrik Persson  <patrik.j.persson@ericsson.com>
+
+        Reviewed by Darin Adler.
+
+        Implement HTML5 sandbox attribute for iframes.
+        http://www.w3.org/TR/html5/text-level-semantics.html#attr-iframe-sandbox
+        https://bugs.webkit.org/show_bug.cgi?id=21288
+
+        Tests: fast/frames/sandboxed-iframe-attribute-parsing.html
+               fast/frames/sandboxed-iframe-forms.html
+               fast/frames/sandboxed-iframe-navigation-allowed.html
+               fast/frames/sandboxed-iframe-navigation-parent.html
+               fast/frames/sandboxed-iframe-navigation-targetlink.html
+               fast/frames/sandboxed-iframe-navigation-windowopen.html
+               fast/frames/sandboxed-iframe-plugins.html
+               fast/frames/sandboxed-iframe-scripting.html
+               fast/frames/sandboxed-iframe-storage.html
+               http/tests/security/sandboxed-iframe-document-cookie.html
+               http/tests/security/sandboxed-iframe-modify-self.html
+               http/tests/security/xss-DENIED-sandboxed-iframe.html
+               http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow.html
+               http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-without-wildcard.html
+               http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied.html
+
+        * bindings/js/JSDOMWindowCustom.cpp: sandboxing navigation
+        (WebCore::createWindow):
+        * bindings/js/ScriptController.cpp: sandboxing scripts
+        (WebCore::ScriptController::isEnabled):
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv):
+        (WebCore::Document::cookie): raise exception when accessed from sandbox
+        (WebCore::Document::setCookie): raise exception when accessed from sandbox
+        (WebCore::Document::initSecurityContext): updae sandbox status
+        (WebCore::Document::updateSandboxFlags):
+        * dom/Document.h:
+        * dom/Document.idl:
+        * html/HTMLAppletElement.cpp: sandboxing applets
+        (WebCore::HTMLAppletElement::createRenderer):
+        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
+        (WebCore::HTMLAppletElement::canEmbedJava):
+        * html/HTMLAppletElement.h:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLFrameOwnerElement.cpp: management of sandbox flags as stated in attribute
+        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement):
+        (WebCore::HTMLFrameOwnerElement::setSandboxFlags):
+        * html/HTMLFrameOwnerElement.h:
+        (WebCore::HTMLFrameOwnerElement::sandboxFlags):
+        * html/HTMLIFrameElement.cpp: sandbox attribute parsing
+        (WebCore::parseSandboxAttribute):
+        (WebCore::HTMLIFrameElement::parseMappedAttribute):
+        * html/HTMLIFrameElement.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::getCookies):
+        * loader/CrossOriginAccessControl.cpp:
+        (WebCore::passesAccessControlCheck):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::init):
+        (WebCore::FrameLoader::submitForm): sandboxing forms
+        (WebCore::FrameLoader::requestObject): sandboxing plugins
+        (WebCore::FrameLoader::shouldAllowNavigation): sandboxing navigation
+        (WebCore::FrameLoader::updateSandboxFlags): propagation of sandbox flags
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::ownerElementSandboxFlagsChanged):
+        (WebCore::FrameLoader::isSandboxed):
+        (WebCore::FrameLoader::sandboxFlags):
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+        * page/DOMWindow.cpp: disable storage and databases in sandboxed frames
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::localStorage):
+        (WebCore::DOMWindow::openDatabase):
+        * page/SecurityOrigin.cpp: added sandboxing status
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canAccess):
+        (WebCore::SecurityOrigin::canRequest):
+        (WebCore::SecurityOrigin::toString):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::setSandboxFlags):
+        (WebCore::SecurityOrigin::isSandboxed):
+        (WebCore::SecurityOrigin::canAccessDatabase):
+        (WebCore::SecurityOrigin::canAccessStorage):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-12-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by David Kilzer.
+
+        ARIA: support a way to create a static text object
+        https://bugs.webkit.org/show_bug.cgi?id=32030
+
+        Test: accessibility/aria-text-role.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::stringValue):
+        (WebCore::AccessibilityRenderObject::isDescendantOfBarrenParent):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::text):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-12-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Inspector crashes when collecting on every allocation
+        https://bugs.webkit.org/show_bug.cgi?id=32044
+
+        The crash is caused by the prototype wrapper object getting collected
+        when allocating the object that is going to use it as a prototype.
+        Because the only reference to the prototype wrapper is through the
+        new object's Structure it does not get marked automatically.
+
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap):
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        Add SVG animation test framework with 'snapshot' functionality
+        https://bugs.webkit.org/show_bug.cgi?id=31897
+
+        Add 'sampleSVGAnimationForElementAtTime' method to the LayoutTestController,
+        for the use within the new SVG animation test framework (LayoutTests/svg/animations/)
+
+        layoutTestController.sampleAnimationAtTime(<svg animation id>, <absolute time>, <svg element id>);
+        to sample a svg animateMotion/animateColor/animate/set element at certain times.
+
+        After the desired SVG animation starts and calling the method above, it's immediately forwarded to
+        the desired sampling time. After JS returns from the 'sampleSVGAnimationForElementAtTime' method
+        a callback is fired used to sample the animation value at the target time. It's modelled similar
+        to the CSS animation/transition testing framework, inspired by
+        LayoutTests/animations/animation-test-helpers.js.
+
+        Though it has been extended to integrate within the fast/js/js-test-* framework, that's used for
+        the SVG dynamic-updates tests, to simplify test creation, by utilizing script-tests/* only.
+
+        Adding a simple testcase testing the DRT methods, it will soon be extended to test animVal/baseVal
+        interaction, while animating.
+
+        Test: svg/animations/animVal-basics.html
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::sampleAnimationAtTime):
+        * svg/SVGDocumentExtensions.h:
+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::SMILTimeContainer):
+        (WebCore::SMILTimeContainer::sampleAnimationAtTime):
+        (WebCore::SMILTimeContainer::updateAnimations):
+        * svg/animation/SMILTimeContainer.h:
+
+2009-12-01  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add convenience methods to Element and QualifiedName that take
+        char* instead of AtomicString, in preparation for removing the
+        implicit conversion between the two types (30187).
+        https://bugs.webkit.org/show_bug.cgi?id=31749
+
+        * dom/Element.cpp:
+        (WebCore::Element::setCStringAttribute):  Equivalent to setAttribute.
+        * dom/Element.h:
+        * dom/QualifiedName.cpp:
+        (WebCore::QualifiedName::init):  Shared impl of both constructors
+        (WebCore::QualifiedName::QualifiedName):  New c'tor taking char*.
+        * dom/QualifiedName.h:
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::CaseFoldingCStringTranslator):  Enables lookup by C string
+        (WebCore::HTTPHeaderMap::get):  New variant that takes C string
+        (WebCore::HTTPHeaderMap::contains):  New variant that takes C string
+        (WebCore::HTTPHeaderMap::add):  New variant that takes C string
+        * platform/network/HTTPHeaderMap.h:
+        (WebCore::HTTPHeaderMap::get):
+        (WebCore::HTTPHeaderMap::add):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::httpHeaderField):  New variant that takes C string
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::setHTTPHeaderField):  Use symbolic names for headers
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::httpHeaderField):  New variant that takes C string
+        * platform/network/ResourceResponseBase.h:
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        More Windows build fix.
+
+        * platform/network/cf/CredentialStorageCFNet.cpp:
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/CredentialStorageCFNet.cpp: Include RetainPtr.h.
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32036
+        Implement CredentialStorage::getFromPersistentStorage for CFNetwork
+
+        * platform/network/cf/CredentialStorageCFNet.cpp:
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+
+2009-12-01  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32001
+
+        Added missing localized strings (that I left out of the patch for bug #21554):
+        %d × %d pixels
+        %d × %d pixels (Natural: %d × %d pixels)
+
+        Also, changed formatting of these stings to conform with existing ones (added
+        a space on both sides of the multiply sign).
+
+        * English.lproj/localizedStrings.js: Added stings.
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+
+2009-12-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for bug 32032, empty namespaces should be allowed in @namespace directives in CSS.
+
+        Added fast/css/namespaces/namespaces-empty.xml
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addNamespace):
+        (WebCore::CSSStyleSheet::determineNamespace):
+
+2009-12-01  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Escape key in the Search Field should be more User Friendly
+        https://bugs.webkit.org/show_bug.cgi?id=32005
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded): add mousedown listener on the search field
+        (WebInspector.searchFieldManualFocus): user clicked to focus on the search field
+        (WebInspector.searchKeyDown): handle escape
+
+2009-12-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by David Kilzer.
+
+        @namespace directives need to use "maybe_space" in the "maybe_ns_prefix" portion of the grammar to match
+        the spec.  Not doing so prevent comments from being used immmediately after the namespace prefix.
+
+        Added fast/css/namespaces-comments.xml
+
+        * css/CSSGrammar.y:
+
+2009-12-01  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Reloading WebInspector from context menu is closing it instead of reloading.
+        https://bugs.webkit.org/show_bug.cgi?id=32004
+
+        When reloading WebInspector, don't delete its m_page.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+
+2009-12-01  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adds V8 bindings for Geolocation.
+        https://bugs.webkit.org/show_bug.cgi?id=30206
+
+        Also adds Geolocation files to Chrome build files.
+
+        * WebCore.gyp/WebCore.gyp: Modified. Corrects list of Geolocation IDL files.
+        * WebCore.gypi: Modified. Adds Geolocation files.
+        * bindings/v8/DOMObjectsInclude.h: Modified. Adds Geolocation includes.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Modified. Adds Geolocation files.
+        * bindings/v8/V8Index.cpp: Modified. Includes Geolocation generated headers.
+        * bindings/v8/V8Index.h: Modified. Adds Geolocation types to DOM_OBJECT_TYPES.
+        * bindings/v8/custom/V8CoordinatesCustom.cpp: Added. Handles optional properties.
+        * bindings/v8/custom/V8CustomBinding.h: Modified. Declares callbacks and getters.
+        * bindings/v8/custom/V8CustomPositionCallback.cpp: Added.
+        (WebCore::V8CustomPositionCallback::V8CustomPositionCallback): Added. Constructor.
+        (WebCore::V8CustomPositionCallback::~V8CustomPositionCallback): Added. Destructor.
+        (WebCore::V8CustomPositionCallback::handleEvent): Added. Invokes callback.
+        * bindings/v8/custom/V8CustomPositionCallback.h: Added.
+        (WebCore::V8CustomPositionCallback::create): Added. Factory method.
+        * bindings/v8/custom/V8CustomPositionErrorCallback.cpp: Added.
+        (WebCore::V8CustomPositionErrorCallback::V8CustomPositionErrorCallback): Added. Constructor.
+        (WebCore::V8CustomPositionErrorCallback::~V8CustomPositionErrorCallback): Added. Destructor.
+        (WebCore::V8CustomPositionErrorCallback::handleEvent): Added. Invokes callback.
+        * bindings/v8/custom/V8CustomPositionErrorCallback.h: Added.
+        (WebCore::V8CustomPositionErrorCallback::create): Added. Factory method.
+        * bindings/v8/custom/V8GeolocationCustom.cpp: Added.
+        (WebCore::throwTypeMismatchException): Added. Throws a type mismatch error.
+        (WebCore::createPositionCallback): Added. Handles type checking for successCallback argument.
+        (WebCore::createPositionErrorCallback): Added. Handles type checking for errorCallback argument.
+        (WebCore::createPositionOptions): Added. Handles type checking for positionOptions argument.
+
+2009-12-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Provide a way to get ScriptState for the inspected page.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32020
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::scriptStateFromPage):
+
+2009-12-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Changed mallocs to fastMallocs and frees to fastFrees in GraphicsContext3D. Also added error returns
+        https://bugs.webkit.org/show_bug.cgi?id=30778
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
+        (WebCore::imageToTexture):
+
+2009-12-01  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Don't crash in DOMWindow event getter in OOM situations
+        https://bugs.webkit.org/show_bug.cgi?id=32017
+
+        Add missing null handle checks in DOMWindow event property
+        accessors.  V8Proxy::context(frame) can return a null handle in
+        OOM situations either if failing to initialize a context or if an
+        OOM is handled gracefully and javascript is disabled.
+
+        No new tests because we don't have a good way to test
+        out-of-memory bugs.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-12-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Updated HTMLCanvasElement to accept "experimental-webgl" as the context name.
+        https://bugs.webkit.org/show_bug.cgi?id=31672
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+
+2009-12-01  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Not reviewed: chromium build fix, added missing import.
+
+        * inspector/InspectorFrontendHost.cpp:
+
+2009-12-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: fix windows build via unexcluding generated files from
+        project.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-12-01  Mark Rowe  <mrowe@apple.com>
+
+        Stop copying IDL files in to the WebCore framework wrapper.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build by making the Xcode project compatible with Xcode 2.4.
+
+        This was probably broken by hand-editing the project file as Xcode itself
+        knows how to keep project files to a backwards-compatible subset of its format.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: windows build fix (bad vcproj in r51528).
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-11-27  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Split InspectorBackend into three parts: backend,
+        injected script host and frontend host.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31888
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSInspectorBackendCustom.cpp: Removed.
+        * bindings/js/JSInspectorFrontendHostCustom.cpp: Added.
+        (WebCore::JSInspectorFrontendHost::search):
+        (WebCore::JSInspectorFrontendHost::setting):
+        (WebCore::JSInspectorFrontendHost::setSetting):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/js/ScriptObject.h:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObject.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp: Removed.
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InjectedScriptHost.cpp: Added.
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::~InjectedScriptHost):
+        (WebCore::InjectedScriptHost::copyText):
+        (WebCore::InjectedScriptHost::nodeForId):
+        (WebCore::InjectedScriptHost::wrapObject):
+        (WebCore::InjectedScriptHost::unwrapObject):
+        (WebCore::InjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::InjectedScriptHost::addNodesToSearchResult):
+        (WebCore::InjectedScriptHost::currentCallFrame):
+        (WebCore::InjectedScriptHost::databaseForId):
+        (WebCore::InjectedScriptHost::selectDatabase):
+        (WebCore::InjectedScriptHost::selectDOMStorage):
+        (WebCore::InjectedScriptHost::reportDidDispatchOnInjectedScript):
+        (WebCore::InjectedScriptHost::inspectorDOMAgent):
+        (WebCore::InjectedScriptHost::inspectorFrontend):
+        * inspector/InjectedScriptHost.h: Added.
+        (WebCore::InjectedScriptHost::create):
+        (WebCore::InjectedScriptHost::inspectorController):
+        (WebCore::InjectedScriptHost::disconnectController):
+        * inspector/InjectedScriptHost.idl: Added.
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::InspectorBackend):
+        (WebCore::InspectorBackend::storeLastActivePanel):
+        (WebCore::InspectorBackend::toggleNodeSearch):
+        (WebCore::InspectorBackend::resourceTrackingEnabled):
+        (WebCore::InspectorBackend::debuggerEnabled):
+        (WebCore::InspectorBackend::enableDebugger):
+        (WebCore::InspectorBackend::disableDebugger):
+        (WebCore::InspectorBackend::addBreakpoint):
+        (WebCore::InspectorBackend::updateBreakpoint):
+        (WebCore::InspectorBackend::removeBreakpoint):
+        (WebCore::InspectorBackend::pauseInDebugger):
+        (WebCore::InspectorBackend::resumeDebugger):
+        (WebCore::InspectorBackend::stepOverStatementInDebugger):
+        (WebCore::InspectorBackend::stepIntoStatementInDebugger):
+        (WebCore::InspectorBackend::stepOutOfFunctionInDebugger):
+        (WebCore::InspectorBackend::pauseOnExceptions):
+        (WebCore::InspectorBackend::setPauseOnExceptions):
+        (WebCore::InspectorBackend::profilerEnabled):
+        (WebCore::InspectorBackend::enableProfiler):
+        (WebCore::InspectorBackend::disableProfiler):
+        (WebCore::InspectorBackend::startProfiling):
+        (WebCore::InspectorBackend::stopProfiling):
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        (WebCore::InspectorBackend::currentCallFrame):
+        (WebCore::InspectorBackend::highlightDOMNode):
+        (WebCore::InspectorBackend::hideDOMNodeHighlight):
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        (WebCore::InspectorBackend::didEvaluateForTestInFrontend):
+        (WebCore::InspectorBackend::nodeForId):
+        * inspector/InspectorBackend.h:
+        (WebCore::InspectorBackend::create):
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::inspectorFrontendHost):
+        (WebCore::InspectorController::injectedScriptHost):
+        * inspector/InspectorFrontendHost.cpp: Added.
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::loaded):
+        (WebCore::InspectorFrontendHost::attach):
+        (WebCore::InspectorFrontendHost::detach):
+        (WebCore::InspectorFrontendHost::closeWindow):
+        (WebCore::InspectorFrontendHost::windowUnloading):
+        (WebCore::InspectorFrontendHost::setAttachedWindowHeight):
+        (WebCore::InspectorFrontendHost::moveWindowBy):
+        (WebCore::InspectorFrontendHost::localizedStringsURL):
+        (WebCore::InspectorFrontendHost::hiddenPanels):
+        (WebCore::InspectorFrontendHost::platform):
+        (WebCore::InspectorFrontendHost::port):
+        (WebCore::InspectorFrontendHost::addResourceSourceToFrame):
+        (WebCore::InspectorFrontendHost::addSourceToFrame):
+        * inspector/InspectorFrontendHost.h: Added.
+        (WebCore::InspectorFrontendHost::create):
+        (WebCore::InspectorFrontendHost::inspectorController):
+        (WebCore::InspectorFrontendHost::disconnectController):
+        * inspector/InspectorFrontendHost.idl: Added.
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype._deleteCookieCallback):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype.setAttributeAsync):
+        (WebInspector.DOMAgent.prototype.removeAttributeAsync):
+        (WebInspector.DOMAgent.prototype.setTextNodeValueAsync):
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.EventListeners.getEventListenersForNodeAsync):
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorage.prototype.getEntries):
+        (WebInspector.DOMStorage.prototype.setItem):
+        (WebInspector.DOMStorage.prototype.removeItem):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.getTableNames):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.hide):
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode.restoreHighlightToHoveredNode):
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
+        ():
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.performSearch.addNodesToResults):
+        (InjectedScript.getCallFrames):
+        (InjectedScript._callFrameForId):
+        (InjectedScript._clearConsoleMessages):
+        (InjectedScript._inspectObject):
+        (InjectedScript._copy):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._window):
+        (InjectedScript._nodeForId):
+        (InjectedScript._objectForId):
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/InspectorBackendStub.js: Added.
+        (.WebInspector.InspectorBackendStub):
+        (.WebInspector.InspectorBackendStub.prototype.wrapCallback):
+        (.WebInspector.InspectorBackendStub.prototype.platform):
+        (.WebInspector.InspectorBackendStub.prototype.port):
+        (.WebInspector.InspectorBackendStub.prototype.closeWindow):
+        (.WebInspector.InspectorBackendStub.prototype.attach):
+        (.WebInspector.InspectorBackendStub.prototype.detach):
+        (.WebInspector.InspectorBackendStub.prototype.storeLastActivePanel):
+        (.WebInspector.InspectorBackendStub.prototype.clearMessages):
+        (.WebInspector.InspectorBackendStub.prototype.searchingForNode):
+        (.WebInspector.InspectorBackendStub.prototype.search):
+        (.WebInspector.InspectorBackendStub.prototype.toggleNodeSearch):
+        (.WebInspector.InspectorBackendStub.prototype.setAttachedWindowHeight):
+        (.WebInspector.InspectorBackendStub.prototype.moveByUnrestricted):
+        (.WebInspector.InspectorBackendStub.prototype.addResourceSourceToFrame):
+        (.WebInspector.InspectorBackendStub.prototype.addSourceToFrame):
+        (.WebInspector.InspectorBackendStub.prototype.getResourceDocumentNode):
+        (.WebInspector.InspectorBackendStub.prototype.highlightDOMNode):
+        (.WebInspector.InspectorBackendStub.prototype.hideDOMNodeHighlight):
+        (.WebInspector.InspectorBackendStub.prototype.inspectedWindow):
+        (.WebInspector.InspectorBackendStub.prototype.loaded):
+        (.WebInspector.InspectorBackendStub.prototype.localizedStringsURL):
+        (.WebInspector.InspectorBackendStub.prototype.windowUnloading):
+        (.WebInspector.InspectorBackendStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorBackendStub.prototype.debuggerEnabled):
+        (.WebInspector.InspectorBackendStub.prototype.enableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.disableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.resourceTrackingEnabled):
+        (.WebInspector.InspectorBackendStub.prototype.enableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.disableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.addBreakpoint):
+        (.WebInspector.InspectorBackendStub.prototype.removeBreakpoint):
+        (.WebInspector.InspectorBackendStub.prototype.updateBreakpoint):
+        (.WebInspector.InspectorBackendStub.prototype.pauseInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.pauseOnExceptions):
+        (.WebInspector.InspectorBackendStub.prototype.setPauseOnExceptions):
+        (.WebInspector.InspectorBackendStub.prototype.resumeDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.profilerEnabled):
+        (.WebInspector.InspectorBackendStub.prototype.enableProfiler):
+        (.WebInspector.InspectorBackendStub.prototype.disableProfiler):
+        (.WebInspector.InspectorBackendStub.prototype.startProfiling):
+        (.WebInspector.InspectorBackendStub.prototype.stopProfiling):
+        (.WebInspector.InspectorBackendStub.prototype.getProfileHeaders):
+        (.WebInspector.InspectorBackendStub.prototype.getProfile):
+        (.WebInspector.InspectorBackendStub.prototype.takeHeapSnapshot):
+        (.WebInspector.InspectorBackendStub.prototype.databaseTableNames):
+        (.WebInspector.InspectorBackendStub.prototype.stepIntoStatementInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.stepOutOfFunctionInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.stepOverStatementInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.setSetting):
+        (.WebInspector.InspectorBackendStub.prototype.dispatchOnInjectedScript):
+        (.WebInspector.InspectorBackendStub.prototype.releaseWrapperObjectGroup):
+        (.WebInspector.InspectorBackendStub.prototype.setting):
+        * inspector/front-end/InspectorControllerStub.js:
+        * inspector/front-end/InspectorFrontendHostStub.js: Added.
+        (.WebInspector.InspectorFrontendHostStub):
+        (.WebInspector.InspectorFrontendHostStub.prototype.platform):
+        (.WebInspector.InspectorFrontendHostStub.prototype.port):
+        (.WebInspector.InspectorFrontendHostStub.prototype.closeWindow):
+        (.WebInspector.InspectorFrontendHostStub.prototype.attach):
+        (.WebInspector.InspectorFrontendHostStub.prototype.detach):
+        (.WebInspector.InspectorFrontendHostStub.prototype.search):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setAttachedWindowHeight):
+        (.WebInspector.InspectorFrontendHostStub.prototype.moveWindowBy):
+        (.WebInspector.InspectorFrontendHostStub.prototype.addResourceSourceToFrame):
+        (.WebInspector.InspectorFrontendHostStub.prototype.addSourceToFrame):
+        (.WebInspector.InspectorFrontendHostStub.prototype.loaded):
+        (.WebInspector.InspectorFrontendHostStub.prototype.localizedStringsURL):
+        (.WebInspector.InspectorFrontendHostStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setSetting):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setting):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._enableProfiling):
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        (WebInspector.ResourcesPanel.prototype._enableResourceTracking):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        (WebInspector.ScriptsPanel.prototype.attachDebuggerWhenShown):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype.canShowResource):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        (WebInspector.ScriptsPanel.prototype._enableDebugging):
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
+        (WebInspector.ScriptsPanel.prototype._togglePauseOnExceptions):
+        (WebInspector.ScriptsPanel.prototype._togglePause):
+        (WebInspector.ScriptsPanel.prototype._stepOverClicked):
+        (WebInspector.ScriptsPanel.prototype._stepIntoClicked):
+        (WebInspector.ScriptsPanel.prototype._stepOutClicked):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.setupSourceFrameIfNeeded):
+        (WebInspector.SourceView.prototype.performSearch.findSearchMatches):
+        (WebInspector.SourceView.prototype.performSearch):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._changeColorFormat):
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.notifyDone):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.loadSavedExpressions):
+        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.pendingDispatches.0.get platform):
+        (WebInspector.get port):
+        (WebInspector.set currentPanel):
+        (WebInspector._createPanels):
+        (WebInspector._loadPreferences):
+        (WebInspector.set attached):
+        (WebInspector._updateHoverHighlight):
+        (WebInspector.loaded):
+        (windowLoaded):
+        (WebInspector.windowUnload):
+        (WebInspector.close):
+        (WebInspector.toolbarDrag):
+        (WebInspector.UIString):
+
+2009-11-30  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        css2.1/t1205-c566-list-stl-00-e-ag.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=23264
+        css2.1/t1205-c565-list-pos-00-b.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=23263
+
+        Ignore whitespaces after list markers.
+        Rendering of this was already done for the case where inside=false.
+        This fixes the rendering of inside=true case and calcInlinePrefWidths.
+
+        Test: fast/lists/calc-width-with-space.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2009-11-30  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed Chromium build fix introduced by r51212
+
+        Fix scriptStateFromNode and ScriptStateFromPage to take DOMWrapperWorld
+        as the first argument.
+        Move mainThreadNormalWorld() to ScriptState.{h,cpp}.
+        Add debuggerWorld() and pluginWorld() in ScriptState.h.
+
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        (WebCore::scriptStateFromPage):
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/ScriptState.h:
+        (WebCore::debuggerWorld):
+        (WebCore::pluginWorld):
+
+2009-11-30  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Can focus but not type into content editable block that contains only non-editable content.
+        <rdar://problem/5982901>
+        https://bugs.webkit.org/show_bug.cgi?id=31750
+        
+        The goal is to change the way we choose a visible position
+        after hit detection, by preferring a visually equivalent editable
+        position if available. By doing this, it is possible to add content
+        to an editable block that initially contains only non editable elements.
+
+        Test: editing/selection/mixed-editability-10.html
+
+        * WebCore.base.exp: Changed to match the new signature of downstream
+        and upstream in the Position class.
+        * dom/Position.cpp:
+        (WebCore::Position::atEditingBoundary): Added.
+        (WebCore::Position::upstream): Modified to allow to cross the boundary
+        between editable and non editable content if required.
+        (WebCore::Position::downstream): Modified to allow to cross the boundary
+        between editable and non editable content if required.
+        (WebCore::Position::isCandidate): Modified to qualify as candidates positions
+        that are at the editability boundary.
+        (WebCore::Position::getInlineBoxAndOffset): Modified to retrieve the inline box
+        to be used in calculating the caret rectangle.
+        * dom/Position.h:
+        (WebCore::Position::):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::atEditingBoundary): Added.
+        (WebCore::PositionIterator::isCandidate): Modified to qualify as candidates positions
+        that are at the editability boundary.
+        * dom/PositionIterator.h:
+        * editing/htmlediting.cpp:
+        (WebCore::firstEditablePositionAfterPositionInRoot): Modified to accept not only
+        descendants of the editable container, but the container itself.
+        (WebCore::lastEditablePositionBeforePositionInRoot): Modified to accept not only
+        descendants of the editable container, but the container itself.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createVisiblePosition): Added logic to prefer an editable position,
+        if available.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::isAllCollapsibleWhitespace): Added.
+        * rendering/RenderText.h:
+
+2009-11-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, add header needed for wx build.
+
+        * css/CSSFontFaceSrcValue.cpp:
+
+2009-11-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by David Kilzer.
+
+        <rdar://problem/7424387> WebCore binary missing symbols when built for x86_64 from a machine that cannot run x86_64 binaries
+
+        The check for whether WTF_USE_PLUGIN_HOST_PROCESS is defined occurs under the native architecture of the build machine.
+        If that is 32-bit then WTF_USE_PLUGIN_HOST_PROCESS will not be defined.  We work around this by forcing the check to
+        be performed against the x86_64 architecture.
+
+        * DerivedSources.make:
+
+2009-11-30  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32000 Crash in 
+        Safari caused by extreme column-gap and column-width values 
+        -and corresponding-
+        <rdar://problem/7425433>
+
+        Prevent desiredColumnCount from being less than 1 since it is used 
+        as a divisor.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcColumnWidth):
+
+2009-11-30  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31659
+        Connection must be closed in case of Web Socket handshake error
+
+        The network connection was closed, but the close event wasn't dispatched.
+
+        Tested by websocket/tests/handshake-error.html, which is un-skipped now.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::SocketStreamHandle::platformClose):
+        Call client didHandle() method. This looks strange in CFNetwork implementation, because
+        it's the client that asked to close the stream, so it shouldn't need the callback. It makes
+        more sense in cross-process implementation, because closing is async there.
+
+2009-11-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31859 - Make world selection for JSC IsolatedWorlds automagical.
+
+        WebCore presently has to explicitly specify the world before entering into JSC,
+        which is a little fragile (particularly since property access via a
+        getter/setter might invoke execution). Instead derive the current world from
+        the lexical global object.
+
+        Remove the last uses of mainThreadCurrentWorld(), so the world is always obtained via
+        currentWorld().  Switch this to obtain the world from the ExecsState's lexical global
+        object instead.  Remove the call/construct/evaluate 'InWorld' methods, since these
+        are no longer necessary.
+
+        * WebCore.base.exp:
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h:
+        (WebCore::JSCallbackData::JSCallbackData):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::currentWorld):
+        (WebCore::mainThreadNormalWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::updateDocument):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::open):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        (WebCore::scriptStateFromPage):
+        * bindings/js/ScriptState.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_Construct):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        * dom/NodeFilter.h:
+        (WebCore::NodeFilter::acceptNode):
+        * dom/NodeIterator.h:
+        (WebCore::NodeIterator::nextNode):
+        (WebCore::NodeIterator::previousNode):
+        * dom/TreeWalker.h:
+        (WebCore::TreeWalker::parentNode):
+        (WebCore::TreeWalker::firstChild):
+        (WebCore::TreeWalker::lastChild):
+        (WebCore::TreeWalker::previousSibling):
+        (WebCore::TreeWalker::nextSibling):
+        (WebCore::TreeWalker::previousNode):
+        (WebCore::TreeWalker::nextNode):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::didEvaluateForTestInFrontend):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+
+2009-11-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        All HTML5 media element events should be regular events
+        https://bugs.webkit.org/show_bug.cgi?id=30513
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectMediaResource):
+        (WebCore::HTMLMediaElement::noneSupported):
+        (WebCore::HTMLMediaElement::mediaEngineError):
+        (WebCore::HTMLMediaElement::setNetworkState):
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+            Call scheduleEvent instead of scheduleProgressEvent.
+        (WebCore::HTMLMediaElement::progressEventTimerFired):
+            Call scheduleEvent instead of scheduleProgressEvent. Call renderer->updateFromElement
+            after scheduling a 'progress' event so the controller will update download
+            progress indicator.
+        * html/HTMLMediaElement.h:
+            Remove scheduleProgressEvent prototype.
+
+2009-11-30  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Wrong console output for Regexp escape sequence
+        https://bugs.webkit.org/show_bug.cgi?id=31538
+
+        Updated inspector/console-format.html
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createDividerElement): style issues.
+        (WebInspector.ConsoleView.createFilterElement): style issues.
+        (WebInspector.ConsoleView): added _customFormatters table.
+        (WebInspector.ConsoleView.prototype.updateMessageRepeatCount): style isses.
+        (WebInspector.ConsoleView.prototype._incrementErrorWarningCount): style issues.
+        (WebInspector.ConsoleView.prototype._format): simplified delegation to formatter logic.
+        (WebInspector.ConsoleView.prototype._formatobject):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._printArray):
+        (WebInspector.ConsoleMessage.prototype._format): commented and broke down the algorithm into parts.
+        (WebInspector.ConsoleMessage.prototype._formatWithSubstitutionString.append): handle substitution string formatting.
+        (WebInspector.ConsoleMessage.prototype._formatIndividualValue): handling individual value formatting.
+        (WebInspector.ConsoleCommandResult):
+        * inspector/front-end/InjectedScript.js: simplified regex formatting.
+        * inspector/front-end/inspector.js:
+        (WebInspector.linkifyStringAsFragment): converted new RegExp to literal for performance benefits.
+        * inspector/front-end/utilities.js: 
+        (Element.prototype.hasStyleClass): update inaccurate comment.
+        (String.prototype.trimURL): converted new RegExp to literal for performance benefits.
+
+2009-11-30  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Clean up V8 bindings for CSSStyleDeclaration and CSSVariableDeclaration
+        https://bugs.webkit.org/show_bug.cgi?id=31895
+
+        No new tests. This is already covered by:
+                fast/dom/CSSStyleDeclaration/css-computed-style-item.html
+                fast/dom/CSSStyleDeclaration/css-style-item.html
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::collectionStringIndexedPropertyGetter):
+        (WebCore::setCollectionStringIndexedGetter):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds include of wtf/StdLibExtras.h for DEFINE_STATIC_LOCAL in V8 ScriptController.
+        https://bugs.webkit.org/show_bug.cgi?id=31932
+
+        Build fix only, no new tests.
+
+        * bindings/v8/ScriptController.cpp: Modified. Adds include of wtf/StdLibExtras.h.
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds PassOwnPtr include to ScriptExecutionContext.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31929
+
+        Build fix only, no new tests.
+
+        * dom/ScriptExecutionContext.h: Modified. Adds PassOwnPtr include.
+
+2009-11-30  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        REGRESSION (r49757): masking-mask-01-b.svg rendered incorrectly
+        [https://bugs.webkit.org/show_bug.cgi?id=31980]
+
+        It turns out, that we did not handle maskUnits="userSpaceOnUse"
+        correctly. We just need to move the context of the maskImage
+        if maskContentUnits="objectBoundingBox". The context gets scaled
+        on this unit combination, so we have to substract the position of
+        the targetRect. On userSpaceOnUse the position just depends on the
+        position of the mask element.
+        I added a test with some senseless and reasonable values for size
+        and postion of the mask and it's contents. I also used every
+        combination of maskUnits and maskContentUnits to be sure, that it
+        is fixed this time.
+
+        Test: svg/custom/mask-with-all-units.svg
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds ENABLE(INSPECTOR) guards around DOMWindow::inspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=31928
+
+        Build fix only, no new tests.
+
+        * page/DOMWindow.cpp: Modified. Adds ENABLE(INSPECTOR) guards around DOMWindow::inspectorTimelineAgent.
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds SHARED_WORKERS guards to V8 WorkerContextExecutionProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=31926
+
+        Build fix only, no new tests.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+
+2009-11-30  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Chrome::contentsSizeChanged() is called when the content size has not changed
+        https://bugs.webkit.org/show_bug.cgi?id=31978
+
+        Do not trigger contentsSizeChaned() is the new size is the same as the old one.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setContentsSize):
+
+2009-11-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix some compiler warnings seen on QtWebKit/Mac
+        https://bugs.webkit.org/show_bug.cgi?id=31962
+
+        No new tests as there is no functional change.
+
+        * platform/network/ResourceHandle.h: Make destructor virtual as 
+        after r50772 ResourceHandle has virtual functions.
+
+        * plugins/mac/PluginPackageMac.cpp: 
+        (WebCore::PluginPackage::fetchInfo): Fix typo WTF is a namespace
+        not a label
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded): Add l to the format
+        specifier
+
+2009-11-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Add new headers to sources list.
+
+        * GNUmakefile.am:
+
+2009-11-30  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Mac Plugins : Get context menu to work in QGraphicsView
+        
+        Flash expects the value in record.where to be the global position for
+        displaying the context menu.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31979
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds PLATFORM(CHROMIUM) guards around memory usage code in V8GCController.
+        https://bugs.webkit.org/show_bug.cgi?id=31925
+
+        This code uses ChromiumBridge and Chromium-specific constant values not
+        appropriate for other platforms such as Android.
+
+        Build fix only, no new tests.
+
+        * bindings/v8/V8GCController.cpp: Modified. Adds PLATFORM(CHROMIUM) around Chromium-specific code.
+
+2009-11-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix.
+
+        Correct draw signature used in ImageCairoWin.cpp.
+
+        * platform/graphics/win/ImageCairoWin.cpp:
+        (WebCore::BitmapImage::getHBITMAPOfSize):
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize):
+
+2009-11-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        postMessage should serialize File objects
+        https://bugs.webkit.org/show_bug.cgi?id=31955
+
+        Update SerializedScriptValue to include support for
+        File objects in the serialized object graph.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::asString):
+
+2009-11-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Optimize the hierarchy rebuilding of compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=31879
+        
+        When updating the compositing layer hierarchy, instead of removing all
+        child layers and then re-adding them one by one, build a vector of child
+        layers, and set them in one go.
+        
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::setChildren): New method that takes a Vector of child
+        GraphicsLayers.
+        
+        * platform/graphics/mac/GraphicsLayerCA.h: Override setChildren().
+        * platform/graphics/win/GraphicsLayerCACF.h: Ditto.
+        * platform/graphics/mac/GraphicsLayerCA.mm: 
+        (WebCore::GraphicsLayerCA::setChildren): Implement setChildren() to 
+        set the bit that notes that sublayers changed.
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::GraphicsLayerCACF::setChildren): Implement setChildren() to 
+        udpate sublayers, with a note that this is not efficient.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        When updating compositing layers, use the faster updateLayerTreeGeometry() if
+        we know that no layer hierarchy changes are needed, and, at the root, use
+        the vector returned from rebuildCompositingLayerTree() to attach the root
+        layer.
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Changed to
+        collect child layers into Vectors of GraphicsLayers, which can be set as
+        layer children in one go.
+        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry): Split out from
+        rebuildCompositingLayerTree() for simplicity, and called when we just need to
+        update layer geometry, without doing any reparenting.
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31971
+
+        Updated comment to reflect latest XSSAuditor bindings.
+
+        No functionality was changed. So, no new tests.
+
+        * page/XSSAuditor.h:
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31969
+
+        Removes unnecessary #include files.
+
+        No functionality was changed. So, no new tests.
+
+        * css/CSSComputedStyleDeclaration.cpp: Removed include CachedImage.h, and
+        Pair.h
+        * css/CSSCursorImageValue.cpp: Removed include RenderStyle.h
+        * css/CSSFontFaceSrcValue.cpp: Removed include Node.h
+        * css/CSSFontSelector.cpp: Removed include NodeList.h
+        * css/CSSGradientValue.cpp: Removed include GraphicsContext.h, ImageBuffer.h
+        * css/CSSImageValue.cpp: Removed include RenderStyle.h
+        * css/CSSImportRule.cpp: Removed include MediaList.h
+        * css/CSSMutableStyleDeclaration.cpp: Removed include CSSProperty.h
+        * css/CSSRule.cpp: Removed include CSSStyleSheet.h
+        * css/CSSStyleSelector.cpp: Removed include CSSFontFace.h,
+        CSSFontFaceSource.h, and CSSProperty.h
+        * page/EventSource.h: Removed include EventListener.h
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31965
+
+        Removed #include KeyframeList.h from CSSStyleSelector.h. Instead,
+        forward declared it.
+
+        As a side effect, we need to #include KeyframeList.h in
+        RenderLayerBacking.cpp.
+
+        No functionality was changed. So, no new tests.
+
+        * css/CSSStyleSelector.cpp:
+        * css/CSSStyleSelector.h: Removed #include KeyframeList.h
+        * rendering/RenderLayerBacking.cpp: Added #include KeyframeList.h
+
+2009-11-29  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Continue to search for matching node in the case where multiple nodes
+        have the same id.
+        https://bugs.webkit.org/show_bug.cgi?id=31428
+
+        Test: fast/dom/Element/id-in-node-list-index01.html
+
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicNodeList::itemWithName):
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31966
+
+        Removed #include RenderStyle.h from file KeyframeAnimation.h. Instead,
+        forward declared it.
+
+        No functionality was changed. So, no new tests.
+
+        * page/animation/KeyframeAnimation.cpp:
+        * page/animation/KeyframeAnimation.h:
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Unreviewed, fix change log entry date.
+
+        For some reason, bugzilla-tool did not update the date in the change
+        log entry for my last commit (r51468). So, this commit fixes the date
+        of that entry.
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31964
+
+        Removed #include StringImpl, StyleImage. Instead, forward declared them.
+        Also, we can substitute #include <wtf/PassRefPtr.h> for #include PlatformString.h,
+        since it seems we only really used it to include PassRefPtr.h.
+
+        No functionality was changed. So, no new tests.
+
+        * rendering/style/ContentData.h:
+
+2009-11-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for classes of the rendering and storage directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31906
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name               - instantiated at: WebCore/'location'
+
+        class SQLTransactionClient      - storage/DatabaseThread.cpp:45
+        class SQLTransactionCoordinator - storage/DatabaseThread.cpp:46
+        class OriginUsageRecord         - storage/OriginQuotaManager.cpp:66
+        class DatabaseTracker           - storage/DatabaseTracker.cpp:62
+        class ScrollbarTheme            - (its child class) rendering/RenderScrollbarTheme.cpp:35
+        class RenderSelectionInfoBase   - (its child class) rendering/RenderView.cpp:310
+        class RenderOverflow            - rendering/RenderBox.cpp:2846
+
+        Inherits the following classes from FastAllocBase because these are instantiated by 'new':
+
+        struct FillLayer                - css/CSSStyleSelector.cpp:197
+        struct ShadowData               - rendering/style/ShadowData.cpp:35
+        class CounterContent            - css/CSSStyleSelector.cpp:4111
+
+        * platform/ScrollbarTheme.h:
+        * rendering/RenderOverflow.h:
+        * rendering/RenderSelectionInfo.h:
+        * rendering/style/CounterContent.h:
+        * rendering/style/FillLayer.h:
+        * rendering/style/ShadowData.h:
+        * storage/DatabaseTracker.h:
+        * storage/OriginUsageRecord.h:
+        * storage/SQLTransactionClient.h:
+        * storage/SQLTransactionCoordinator.h:
+
+2009-11-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Sify compose button alerts error
+        https://bugs.webkit.org/show_bug.cgi?id=31394
+
+        Test: http/tests/security/calling-versus-current.html
+
+        We're supposed to use the calling context for security checks.  In JSC
+        land, this is the lexicalGlobalObject.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::canAccessPrivate):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed Chromium build fix introduced by r51428.
+
+        [Chromium] Ignore line-height CSS property for PushButton
+        https://bugs.webkit.org/show_bug.cgi?id=31712
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustButtonStyle):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed Chromium test fix by reverting r51413.
+
+        [v8] Do not check the thread when accessing DOMDataStore
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+
+2009-11-27  Daniel Bates  <dbates@webkit.org>
+
+        Unreviewed, comment fix.
+
+        Corrected misspelling of the word "implemented".
+
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-11-27  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31940
+
+        Makes the error messages more descriptive when we refuse to load an object/embed or
+        refuse to load from the document base URL.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadObject): Changed console message to be more descriptive.
+        (WebCore::XSSAuditor::canSetBaseElementURL): Ditto.
+
+2009-11-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        This is a WebCore part of the fix that allows to view plugin
+        resources loaded by plugins.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31832
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::addLength):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+
+2009-11-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Instead of generating negative identifiers for cached resources in
+        InspectorController and extending identifier type from 'unsigned long' to 'long
+        long' reuse progress tracker from the inspected page to generate those
+        identifiers. It guarantees that InspectorResources have unique ids since
+        all of them are generated by that progress tracker.
+
+        Added a couple new overloaded methods to Script* objects that accept
+        long and unsigned long arguments. These types of argumens have already
+        been passed as long long.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31921
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/js/ScriptFunctionCall.h:
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/js/ScriptObject.h:
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/v8/ScriptFunctionCall.h:
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/v8/ScriptObject.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::getTrackedResource):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache): Use inspected page's ProgressTracker to generate unique identifiers for cached resources in InspectorController.
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource):
+        (WebCore::InspectorResource::createCached):
+        * inspector/InspectorResource.h: Change InspectorResource identifier type from 'long long' to 'unsigned long'.
+        (WebCore::InspectorResource::create):
+        (WebCore::InspectorResource::identifier):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createResourceSendRequestRecord):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseRecord):
+        (WebCore::TimelineRecordFactory::createResourceFinishRecord):
+
+2009-11-26  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Assertion failure in RenderBlock::positionForPointWithInlineChildren when running fast/inline/relative-positioned-overflow.html
+        https://bugs.webkit.org/show_bug.cgi?id=29966
+
+        When an empty inline element is clicked, the root inline box has
+        no leaf children. Use the renderer of a normal child instead.
+
+        This change resolves Windows port's assertion failure in a layout test.
+        Also, this fixes the behavior when a user drags the mouse from an
+        empty inline element to above texts.
+
+        Test: editing/selection/last-empty-inline.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+
+2009-11-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Ignore line-height CSS property specified to push buttons on
+        Windows and Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=31712
+
+        LayoutTests/fast/forms/control-restrict-line-height.html checks that the
+        following controls should ignore line-height CSS property.
+         - <select>
+         - <input type=button>
+         - <input type=search>
+        This change addresses the <input type=button> issue with Chromium/Windows
+        and Chromium/Linux.
+        
+        * rendering/RenderThemeChromiumSkia.cpp: Implement adjustButtonStyle() to ignore line-height.
+        * rendering/RenderThemeChromiumSkia.h: Declare adjustButtonStyle().
+
+2009-11-26  Kinuko Yasuda  <kinuko@chromium.com>
+
+        Reviewed by Eric Seidel.
+
+        Remove the special charset meta tag in the clipboard so that
+        copy-and-paste with interchange breaklines/spaces works correctly
+        within WebKit.
+
+        No new tests.  Layout tests that involve copy-and-paste with
+        interchange breaklines (like editing/pasteboard/paste-line-endings-00?)
+        should pass on Mac/Chromium with this fix.
+
+        * platform/chromium/ClipboardChromium.cpp:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::documentFragment):
+
+2009-11-26  İsmail Dönmez  <ismail@namtrac.org>
+
+        Reviewed by Eric Seidel.
+
+        Compile with QT_NO_WHEELEVENT defined.
+
+        * platform/qt/WheelEventQt.cpp:
+        (WebCore::PlatformWheelEvent::applyDelta):
+
+2009-11-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        No new tests as there is no functional change.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp: Change the
+          path for GOwnPtr.h.
+        * platform/text/TextEncoding.cpp: Ditto.
+        * platform/text/gtk/TextCodecGtk.cpp: Ditto.
+
+2009-11-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Not reviewed. Build fix: revert r51421.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::addLength):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+
+2009-11-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        This is a WebCore part of the fix that allows to view plugin
+        resources loaded by plugins.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31832
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h: Remove unused DocumentLoader parameters from inspector methods.
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::addLength): Update loading end time when new data are received.
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didFailToLoad): Notify InspectorController about the failure.
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+
+2009-11-26  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21554
+
+        Implements support for hovering over <img> src to display the height and width of that image
+        in a tooltip. Displays both the displayable and natural dimensions of the image.
+
+        Test: inspector/elements-img-tooltip.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode): Added.
+        (WebInspector.ElementsTreeElement.prototype._updateTitle.callback):
+        (WebInspector.ElementsTreeElement.prototype._updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy.getPropertiesAsync): Added.
+        * inspector/front-end/inspector.js:
+        (WebInspector.linkifyURLAsNode): Added tooltipText argument.
+        (WebInspector.linkifyURL): Ditto.
+
+2009-11-26  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix after drawPattern API change.
+
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-11-26  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Use an internal field instead of hidden property to speedup lookup
+        of entered isolated world.
+
+        Plus some inlinings.
+        https://bugs.webkit.org/show_bug.cgi?id=31884
+
+        Covered by layout tests + manual running of some benchmarks as
+        content scripts.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::getEntered):
+        (WebCore::V8IsolatedWorld::getGlobalObject):
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-11-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Corrects build break on Windows.
+
+        Rename platform/text/qt/TextBoundaries.cpp to TextBoundariesQt.cpp since
+        platform/text/TextBoundaries.cpp was compiled instead when compiling with nmake.
+
+        * WebCore.pro:
+        * platform/text/qt/TextBoundariesQt.cpp: Renamed from WebCore/platform/text/qt/TextBoundaries.cpp.
+        (WebCore::findNextWordFromIndex):
+        (WebCore::findWordBoundary):
+
+2009-11-26  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Do not check if the thread is main or not when accessing DOMDataStore as currently in Chromium WebKit is used in main thread only.
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        Covered by layout tests and buildbots.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+
+2009-11-26  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Mac Plugins : Pass mouse position relative to the fake window
+        
+        When using off-screen rendering, we need to pass mouse events relative
+        to the fake window instead of the global position.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31794
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-11-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Use QNetworkReply::rawHeaderPairs
+        https://bugs.webkit.org/show_bug.cgi?id=31826
+
+        The QNetworkReply is internally storing the HTTP headers
+        as a list of pairs. Currently we have to ask the QNetworkReply
+        to put all header names into a QStringList. Afterwards we will
+        iterate over this QStringList and ask the QNetworkReply to
+        give us the value for this header name. The current Qt implementation
+        is doing a linear to find the header value.
+
+        Use a new API to directly access the list of pairs and push
+        this into WebCore. This avoids doing some allocations and doing
+        linear searches from within a loop.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-11-21  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add Qt specific information of RenderPart
+        https://bugs.webkit.org/show_bug.cgi?id=31203
+
+        The WebCore::Widget of the RenderPart (RenderWidget) might be
+        backed with a platform widget. Print both the WebCore::Widget
+        and platform widget state. In the above bug we had a problem
+        that the WebCore::Widget was invisible but the QWidget was
+        visible.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<): Add special case for RenderPart
+
+2009-11-17  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Call Widget::setSelfVisible from hide/show
+        https://bugs.webkit.org/show_bug.cgi?id=31203
+
+        Call Widget::setSelfVisible from Widget::show and
+        Widget::hide and use isParentVisible to decide
+        if the widget should be shown. This way client
+        code can rely on isVisible.
+
+        Change PluginViewQt::show, PluginViewQt::hide to
+        call the base class as it is doing the right thing
+        now. Add an assert verify that platfomWidget and
+        platformPluginWidget are the same.
+
+        * manual-tests/qt/qtplugin.html: Modify manual test
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+
+2009-11-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix compilation of REQUEST_DEBUG debug code
+        https://bugs.webkit.org/show_bug.cgi?id=31850
+
+        In r47907 the single parameter KURL constructor to parse
+        from a WebCore::String was replaced with a two parameter
+        constructor. I think in this debug case parsing the urls
+        again is no problem and I have changed the code to use the
+        two parameter version.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didFinishLoading):
+
+2009-11-26  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Avoid using JavaScript objects as context data
+        https://bugs.webkit.org/show_bug.cgi?id=31873
+
+        Change the context "data" from a JavaScript object holding the two properties type and value to
+        a string holding type and value separated by a comma.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::setContextDebugId):
+        (WebCore::V8Proxy::contextDebugId):
+
+2009-11-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Implement canSetValueAttribute in the API, the clean-up part.
+        https://bugs.webkit.org/show_bug.cgi?id=31894
+
+        * accessibility/chromium/AccessibilityObjectWrapper.h: Added RefCounted decl.
+        (WebCore::AccessibilityObjectWrapper::AccessibilityObjectWrapper): Removed mis-refcountingness.
+
+2009-11-25  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Off-by-one error in index validation for drawElements and drawArrays
+        https://bugs.webkit.org/show_bug.cgi?id=31891
+
+        Fixed computation of number of elements for bound array objects.
+
+        Test: fast/canvas/webgl/index-validation.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+
+2009-11-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Update SharedScript to use eventNames() instead of EventNames()
+        https://bugs.webkit.org/show_bug.cgi?id=31890
+
+        * SharedScript/WebKitSharedScript.cpp:
+        (WebCore::LoadEventTask::performTask):
+
+2009-11-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7409331> Windows: Support closed caption in <video> element
+
+        Enable closed captions in QuickTime/Windows media engine.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+            New, all through to m_qtMovie.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+            Make all but the destructor private since MediaPlayer call through the media
+            engine interface.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::disableUnsupportedTracks):
+            Use handy new constants for QuickTime track types.
+        (QTMovieWin::hasClosedCaptions):
+        (QTMovieWin::setClosedCaptionsVisible):
+            New, closed caption support.
+        * platform/graphics/win/QTMovieWin.h:
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+            Deal with closed caption buttons.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::shouldRenderMediaControlPart):
+            New, don't ask the media engine if it has closed captions unless the Safari theme will
+            be able to render the button.
+        (WebCore::RenderThemeWin::paintMediaToggleClosedCaptionsButton):
+            New.
+        * rendering/RenderThemeWin.h:
+
+2009-11-25  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by David Levin.
+
+        MessagePorts always look remotely entangled even when closed.
+        https://bugs.webkit.org/show_bug.cgi?id=31698
+
+        Tests: Existing tests suffice, Chromium soak test passes now.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Removed kMessagePortEntangledPortIndex which is no longer used.
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GCPrologueVisitor::visitDOMWrapper):
+        Simplified GC code to reflect the Chromium MessagePort implementation
+        (locallyEntangledPort() always returns false).
+        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
+        Cleaned up epilogue code to handle the case where the port gets closed
+        in mid-GC (due to the parent context being freed).
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::MessagePort):
+        (WebCore::MessagePort::close):
+        Now sets the closed flag.
+        (WebCore::MessagePort::disentanglePorts):
+        Updated to use new isCloned() API instead of relying on isEntangled(), which was incorrect.
+        * dom/MessagePort.h:
+        Added a m_closed flag and updated isEntangled() to check it.
+        (WebCore::MessagePort::isEntangled):
+        Now returns false if the port has been closed.
+        (WebCore::MessagePort::isCloned):
+        Added new API to differentiate between cloned and closed ports (closed ports can still be passed to postMessage).
+
+2009-11-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix crash of QtWebKit on any page with Flash when compiled with MinGW.
+
+        Fix inline assembly, don't dereference the function pointer twice.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+
+2009-11-22  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Remove the Referer header when redirecting to a non-secure site
+        https://bugs.webkit.org/show_bug.cgi?id=31785
+
+        This makes Qt pass two tests introduced in r50226.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-11-25  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        The select elements do not reflect the actual choice the user makes.
+        https://bugs.webkit.org/show_bug.cgi?id=31831
+
+        Handle the drawing of the listboxes in Android code.
+
+        No new features, just fixing an Android problem. Existing layout tests are sufficient.
+
+        * platform/android/RenderThemeAndroid.cpp:
+        (WebCore::theme):
+        (WebCore::RenderThemeAndroid::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeAndroid::platformActiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeAndroid::platformInactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeAndroid::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeAndroid::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeAndroid::adjustButtonStyle):
+        (WebCore::RenderThemeAndroid::paintTextArea):
+        (WebCore::RenderThemeAndroid::adjustListboxStyle):
+        * platform/android/RenderThemeAndroid.h:
+
+2009-11-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Load InspectorResource mime type from CachedResource for 304 responses
+
+        For network libraries that do not merge cache data into 304 ResourceResponses,
+        the mime type for cached resources is unknown.
+        https://bugs.webkit.org/show_bug.cgi?id=31868
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateResponse):
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::type):
+
+2009-11-25  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Android is missing implementation of SSL Key generator functions.
+        https://bugs.webkit.org/show_bug.cgi?id=31825
+
+        This change adds the PlatformBridge class to platform/android.
+        PlarformBridge is used to access the embedding layer for things
+        such as key generator, cookies, plugins, etc.
+
+        No new tests required, this is platform code.
+
+        * platform/android/PlatformBridge.h: Added.
+        * platform/android/SSLKeyGeneratorAndroid.cpp: Added.
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+
+2009-11-25  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] use gst_init_check() instead of gst_init()
+        https://bugs.webkit.org/show_bug.cgi?id=31864
+
+        Use gst_init_check() instead of gst_init() to prevent eventual
+        unexpected exit of the application.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::isAvailable):
+
+2009-11-25  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Some tests are crashing from time to time
+        https://bugs.webkit.org/show_bug.cgi?id=31866
+
+        Make sure we do not notify the client of a finished load, if the
+        load has been cancelled, or the client is gone.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-11-24  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [Android] Upstream Android changes to WebCore/bridge/jni
+        https://bugs.webkit.org/show_bug.cgi?id=31824
+
+        No new tests required as no new functionality.
+
+        * bridge/jni/jni_class.cpp:
+        (JavaClass::JavaClass): Add calls to delete allocated references, to avoid potential leaks.
+        * bridge/jni/jni_instance.cpp: Add an Android include path.
+        * bridge/jni/jni_instance.h: Add getter/setter for JObjectWrapper::_instance and make the JavaInstance ctor and member variables protected. Both needed for the Android port, see bug for discussion.
+        (JSC::Bindings::JObjectWrapper::instance): Added.
+        (JSC::Bindings::JObjectWrapper::setInstance): Added.
+        * bridge/jni/jni_runtime.cpp:
+        (JavaMethod::JavaMethod): Delete an allocated reference to avoid a potential leak.
+        * bridge/jni/jni_utility.h:
+        (JSC::Bindings::callJNIMethodV): Delete an allocated reference to avoid a potential leak.
+
+2009-11-24  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for classes of the plugins and rendering directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31827
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name               - instantiated at: WebCore/'location'
+
+        class PluginRequest             - plugins/PluginView.cpp:521
+        class PluginMainThreadScheduler - plugins/PluginMainThreadScheduler.cpp:34
+        class PluginDatabase            - plugins/PluginDatabase.cpp:50
+        struct MimeClassInfo            - plugins/PluginInfoStore.cpp:50
+        struct PluginInfo               - plugins/PluginInfoStore.cpp:40
+        class RenderArena               - dom/Document.cpp:1401
+        class RenderImageScaleData      - rendering/RenderImage.cpp:149
+        class TableLayout               - (its child class) rendering/RenderTable.cpp:82
+        struct ColumnInfo               - rendering/RenderBlock.cpp:3590
+        struct FloatingObject           - rendering/RenderBlock.cpp:2300
+        struct MaxMargin                - rendering/RenderBlock.cpp:4794
+        class RenderMarquee             - rendering/RenderLayer.cpp:3277
+
+        * plugins/PluginData.h:
+        * plugins/PluginDatabase.h:
+        * plugins/PluginMainThreadScheduler.h:
+        * plugins/PluginView.h:
+        * rendering/RenderArena.h:
+        * rendering/RenderBlock.cpp:
+        * rendering/RenderBlock.h:
+        * rendering/RenderImage.cpp:
+        * rendering/RenderMarquee.h:
+        * rendering/TableLayout.h:
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Initial implementation of WebKitSharedScript and SharedScriptContext
+        https://bugs.webkit.org/show_bug.cgi?id=31569
+
+        No new tests since there are no bindings yet (soon to come).
+
+        * DerivedSources.make: Add WebKitSharedScript and SharedScriptContext to a list of idl files.
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Notify WebKitSharedScriptRepository that document is detaching.
+        * dom/EventTarget.cpp: Add new casting methods, since the new types are EventTargets.
+        (WebCore::EventTarget::toWebKitSharedScript):
+        (WebCore::EventTarget::toSharedScriptContext):
+        * dom/EventTarget.h: Ditto
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::isSharedScriptContext): New virtual method, since there is a new type of context.
+
+        * SharedScript/SharedScriptContext.cpp: Added. Similar to WorkerContext, but w/o threading.
+        (WebCore::SharedScriptContext::SharedScriptContext):
+        (WebCore::SharedScriptContext::~SharedScriptContext):
+        (WebCore::SharedScriptContext::clearScript):
+        (WebCore::SharedScriptContext::virtualURL):
+        (WebCore::SharedScriptContext::virtualCompleteURL):
+        (WebCore::SharedScriptContext::reportException):
+        (WebCore::SharedScriptContext::addMessage):
+        (WebCore::SharedScriptContext::resourceRetrievedByXMLHttpRequest):
+        (WebCore::SharedScriptContext::scriptImported):
+        (WebCore::SharedScriptContext::matches):
+        (WebCore::SharedScriptContext::addToDocumentsList):
+        (WebCore::SharedScriptContext::destructionTimerFired):
+        (WebCore::SharedScriptContext::removeFromDocumentList):
+        (WebCore::SharedScriptContext::load):
+        (WebCore::SharedScriptContext::postTask):
+        (WebCore::SharedScriptContext::eventTargetData):
+        (WebCore::SharedScriptContext::ensureEventTargetData):
+        (WebCore::SharedScriptContext::scriptExecutionContext):
+        * SharedScript/SharedScriptContext.h: Added.
+        (WebCore::SharedScriptContext::create):
+        (WebCore::SharedScriptContext::isSharedScriptContext):
+        (WebCore::SharedScriptContext::userAgent):
+        (WebCore::SharedScriptContext::toSharedScriptContext):
+        (WebCore::SharedScriptContext::self):
+        (WebCore::SharedScriptContext::script):
+        (WebCore::SharedScriptContext::loaded):
+        (WebCore::SharedScriptContext::name):
+        (WebCore::SharedScriptContext::refEventTarget):
+        (WebCore::SharedScriptContext::derefEventTarget):
+        (WebCore::SharedScriptContext::refScriptExecutionContext):
+        (WebCore::SharedScriptContext::derefScriptExecutionContext):
+        * SharedScript/SharedScriptContext.idl: Added.
+
+        * SharedScript/SharedScriptController.h: 
+        Added. Empty implementation of a ScriptController, will come later as part of bindings. Needed to compile.
+
+        * SharedScript/WebKitSharedScript.cpp: Added. EventTarget-based DOM object.
+        (WebCore::WebKitSharedScript::WebKitSharedScript):
+        (WebCore::WebKitSharedScript::~WebKitSharedScript):
+        (WebCore::WebKitSharedScript::setContext):
+        (WebCore::LoadEventTask::create): Fires asynchronous 'load' event when underlying SharedScriptContext is initialized.
+        (WebCore::LoadEventTask::performTask):
+        (WebCore::LoadEventTask::LoadEventTask):
+        (WebCore::WebKitSharedScript::scheduleLoadEvent):
+        * SharedScript/WebKitSharedScript.h: Added.
+        (WebCore::WebKitSharedScript::create):
+        (WebCore::WebKitSharedScript::scriptExecutionContext):
+        (WebCore::WebKitSharedScript::toWebKitSharedScript):
+        (WebCore::WebKitSharedScript::context):
+        (WebCore::WebKitSharedScript::refEventTarget):
+        (WebCore::WebKitSharedScript::derefEventTarget):
+        (WebCore::WebKitSharedScript::eventTargetData):
+        (WebCore::WebKitSharedScript::ensureEventTargetData):
+        * SharedScript/WebKitSharedScript.idl: Added.
+
+        * SharedScript/WebKitSharedScriptRepository.cpp: Added. Implements a list of running SharedScriptContexts.
+        (WebCore::ScriptLoader::ScriptLoader): The helper class to load an initial script of SharedScriptContext.
+        (WebCore::ScriptLoader::load):
+        (WebCore::ScriptLoader::notifyFinished):
+        (WebCore::WebKitSharedScriptRepository::instance): Repository has a static global instance.
+        (WebCore::WebKitSharedScriptRepository::connect):
+        (WebCore::WebKitSharedScriptRepository::documentDetached): Called from Document::detach().
+        (WebCore::WebKitSharedScriptRepository::removeSharedScriptContext): Called from ~SharedScriptContext().
+        (WebCore::WebKitSharedScriptRepository::connectToSharedScript):
+        (WebCore::WebKitSharedScriptRepository::getSharedScriptContext):
+        * SharedScript/WebKitSharedScriptRepository.h: Added.
+        (WebCore::WebKitSharedScriptRepository::WebKitSharedScriptRepository):
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Implement accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=27314
+        
+        This part of the checkin adds the Windows specific GraphicsLayer support files.
+        It provides the interface between GraphicsLayer and CACF. It also deals with
+        the compositing loop, and provides the plumbing to pass the root layer up to
+        WebView.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::syncCompositingStateRecursive):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/win/GraphicsLayerCACF.cpp: Added.
+        * platform/graphics/win/GraphicsLayerCACF.h: Added.
+        * platform/graphics/win/WKCACFContextFlusher.cpp: Added.
+        * platform/graphics/win/WKCACFContextFlusher.h: Added.
+        * platform/graphics/win/WKCACFContextFlusherWin.cpp: Added.
+        * platform/graphics/win/WKCACFLayer.cpp: Added.
+        * platform/graphics/win/WKCACFLayer.h: Added.
+        * platform/graphics/win/WKCACFLayerWindow.cpp: Added.
+        * platform/graphics/win/WKCACFLayerWindow.h: Added.
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Do error checking of parameter to createShader
+        https://bugs.webkit.org/show_bug.cgi?id=31808
+
+        Test: fast/canvas/webgl/invalidPassedParams.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::createShader):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+
+2009-11-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Ignore line-height CSS property specified to a search field on
+        Windows and Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=31820
+
+        LayoutTests/fast/forms/control-restrict-line-height.html checks that the
+        following controls should ignore line-height CSS property.
+         - <select>
+         - <input type=button>
+         - <input type=search>
+        This change addresses the <input type=search> issue with Chromium/Windows
+        and Chromium/Linux.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldStyle): Implement this to ignore line-height.
+        * rendering/RenderThemeChromiumSkia.h: Declare adjustSearchFieldStyle().
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+
+        Stylistic fix: indent the member var initialisation.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+
+2009-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31848 - Remove uses of mainThreadCurrentWorld, and of currentWorld using a globalData.
+
+        These methods get the world from the global data rather than from an execstate.
+        If the current world is always read from an exec state then it can be read
+        from the global object, and world entry can become automagical, rather than
+        being explicitly set by an EnterDOMWrapperWorld.
+
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::currentWorld):
+        (WebCore::DOMObjectWrapperMapFor):
+        (WebCore::hasCachedDOMObjectWrapper):
+        (WebCore::getCachedDOMObjectWrapper):
+        (WebCore::cacheDOMObjectWrapper):
+        (WebCore::hasCachedDOMNodeWrapper):
+        (WebCore::getCachedDOMNodeWrapper):
+        (WebCore::cacheDOMNodeWrapper):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::getDOMObjectWrapper):
+        (WebCore::createDOMNodeWrapper):
+        (WebCore::getDOMNodeWrapper):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::history):
+        (WebCore::JSDOMWindow::location):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        (WebCore::toJS):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        (WebCore::createWrapper):
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection):
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Also, don't include the wrong one!
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Include the proper WKSI header.
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        SVGUseElement::toClipPath can crash
+        <rdar://problem/7385270>
+
+        Null-test m_shadowTreeRootElement again, because the call to buildPendingResource() may not
+        actually initialize it.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::toClipPath):
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Windows build fix.
+
+        * page/win/FrameCGWin.cpp:
+        (WebCore::imageFromRect):
+        (WebCore::imageFromSelection):
+
+2009-11-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Not reviewed. Revert r51351 until a new WebKitSupportLibrary is available.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        * platform/graphics/win/QTMovieWin.h:
+        * rendering/RenderMediaControls.cpp:
+        * rendering/RenderThemeWin.cpp:
+        * rendering/RenderThemeWin.h:
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31844
+        SocketStreamHandleCFNet should support CONNECT proxy credentials
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/CredentialStorage.h:
+        * platform/network/mac/CredentialStorageMac.mm: Added.
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+        * platform/network/cf/CredentialStorageCFNet.cpp: Added.
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+        Add support for fetching credentials from persistent storage (CFNet version is currently
+        a stub).
+
+        * bindings/js/JSWebSocketCustom.cpp: Removed an unneeded include.
+
+        * platform/network/cf/SocketStreamHandle.h:
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::createStreams):
+        (WebCore::getStoredCONNECTProxyCredentials):
+        (WebCore::authenticationSchemeFromAuthenticationMethod):
+        (WebCore::SocketStreamHandle::addCONNECTCredentials):
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        Check if connection attempt was resulted in 407, and try stored credentials if it did.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * WebCore.base.exp:
+        Updated WKSI.
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Find highlight is drawn incorrectly on pages with compositing layers
+        <rdar://problem/7413925>
+        
+        Part 2: Add a new bit to the PaintBehavior flags, PaintBehaviorFlattenCompositingLayers,
+        and pass that down when painting into an image.
+        
+        When set, it forces painting of compositing layers to go down a software paint path
+        when all layers are painted, irrespective of compositing status, and where
+        3d transforms are flattened to 2d. When doing this, we also need to use temporary
+        clip rects for layers which are normally composited.
+        
+        * page/FrameView.h:
+        (WebCore::FrameView::paintBehavior):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::imageFromRect):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::renderableTransform):
+        (WebCore::expandClipRectForDescendantsAndReflection):
+        (WebCore::transparencyClipBox):
+        (WebCore::RenderLayer::beginTransparencyLayers):
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::paintsWithTransparency):
+        (WebCore::RenderLayer::paintsWithTransform):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        * rendering/RenderObject.h:
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Find highlight is drawn incorrectly on pages with compositing layers
+        <rdar://problem/7413925>
+        
+        Part 1: Rename PaintRestriction to PaintBehavior, and make it a bitmask, in
+        preparation for adding a new flag related to painting into an image.
+        
+        PaintBehaviorSelectionOnly and PaintBehaviorForceBlackText are now separate flags.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::paintContents):
+        (WebCore::FrameView::setPaintBehavior):
+        * page/FrameView.h:
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::selectionImage):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint):
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderObject.h:
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+
+2009-11-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7409331> Windows: Support closed caption in <video> element
+
+        Enable closed captions in QuickTime/Windows media engine.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::hasClosedCaptions):
+        (QTMovieWin::setClosedCaptionsVisible):
+        * platform/graphics/win/QTMovieWin.h:
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintMediaToggleClosedCaptionsButton):
+        * rendering/RenderThemeWin.h:
+
+2009-11-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [Chromium] Renderer hang when using www.expedia.com
+        https://bugs.webkit.org/show_bug.cgi?id=31822
+
+        Test: http/tests/cache/subresource-failover-to-network.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadResourceSynchronously): Use the originalRequest
+        when inheriting cache policy.  This matches SubresourceLoader::create.
+
+2009-11-23  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Change get... calls to latest spec
+        https://bugs.webkit.org/show_bug.cgi?id=30091
+
+        Removed old versions of get calls on WebGLRenderingContext and
+        added new ones per spec returning "any". New code simplifies
+        GraphicsContext3D and fixes previously unimplemented routines.
+        Added custom JS and V8 bindings. Added exhaustive test case
+        exercising all new code paths. Updated preexisting test cases for
+        new APIs. Fixed preexisting bugs in WebKit's and Chrome's WebGL
+        implementations.
+
+        Ran WebGL layout tests in WebKit (clean) and Chrome (couple of
+        preexisting known failures) and manual WebGL tests in both
+        browsers.
+
+        Test: fast/canvas/webgl/gl-object-get-calls.html
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        (WebCore::):
+        (WebCore::getObjectParameter):
+        (WebCore::getProgramParameterHelper):
+        (WebCore::JSWebGLRenderingContext::getBufferParameter):
+        (WebCore::JSWebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::JSWebGLRenderingContext::getParameter):
+        (WebCore::JSWebGLRenderingContext::getProgramParameter):
+        (WebCore::JSWebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::JSWebGLRenderingContext::getShaderParameter):
+        (WebCore::JSWebGLRenderingContext::getTexParameter):
+        (WebCore::JSWebGLRenderingContext::getUniform):
+        (WebCore::JSWebGLRenderingContext::getVertexAttrib):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::):
+        (WebCore::getObjectParameter):
+        (WebCore::getProgramParameter):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::CanvasObject):
+        (WebCore::CanvasObject::setObject):
+        (WebCore::CanvasObject::deleteObject):
+        * html/canvas/CanvasObject.h:
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::create):
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        * html/canvas/WebGLBuffer.h:
+        * html/canvas/WebGLGetInfo.cpp: Added.
+        (WebCore::WebGLGetInfo::WebGLGetInfo):
+        (WebCore::WebGLGetInfo::~WebGLGetInfo):
+        (WebCore::WebGLGetInfo::getType):
+        (WebCore::WebGLGetInfo::getBool):
+        (WebCore::WebGLGetInfo::getFloat):
+        (WebCore::WebGLGetInfo::getLong):
+        (WebCore::WebGLGetInfo::getString):
+        (WebCore::WebGLGetInfo::getUnsignedLong):
+        (WebCore::WebGLGetInfo::getWebGLBuffer):
+        (WebCore::WebGLGetInfo::getWebGLFloatArray):
+        (WebCore::WebGLGetInfo::getWebGLFramebuffer):
+        (WebCore::WebGLGetInfo::getWebGLIntArray):
+        (WebCore::WebGLGetInfo::getWebGLProgram):
+        (WebCore::WebGLGetInfo::getWebGLRenderbuffer):
+        (WebCore::WebGLGetInfo::getWebGLTexture):
+        (WebCore::WebGLGetInfo::getWebGLUnsignedByteArray):
+        * html/canvas/WebGLGetInfo.h: Added.
+        (WebCore::WebGLGetInfo::):
+        * html/canvas/WebGLRenderbuffer.cpp:
+        (WebCore::WebGLRenderbuffer::create):
+        (WebCore::WebGLRenderbuffer::WebGLRenderbuffer):
+        * html/canvas/WebGLRenderbuffer.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLStateRestorer::WebGLStateRestorer):
+        (WebCore::WebGLStateRestorer::~WebGLStateRestorer):
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+        (WebCore::WebGLRenderingContext::activeTexture):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bindFramebuffer):
+        (WebCore::WebGLRenderingContext::bindRenderbuffer):
+        (WebCore::WebGLRenderingContext::bindTexture):
+        (WebCore::WebGLRenderingContext::getBufferParameter):
+        (WebCore::WebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::getProgramParameter):
+        (WebCore::WebGLRenderingContext::getProgramInfoLog):
+        (WebCore::WebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::WebGLRenderingContext::getShaderParameter):
+        (WebCore::WebGLRenderingContext::getShaderInfoLog):
+        (WebCore::WebGLRenderingContext::getShaderSource):
+        (WebCore::WebGLRenderingContext::getString):
+        (WebCore::WebGLRenderingContext::getTexParameter):
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getVertexAttrib):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::getBooleanParameter):
+        (WebCore::WebGLRenderingContext::getFloatParameter):
+        (WebCore::WebGLRenderingContext::getIntParameter):
+        (WebCore::WebGLRenderingContext::getLongParameter):
+        (WebCore::WebGLRenderingContext::getUnsignedLongParameter):
+        (WebCore::WebGLRenderingContext::getWebGLFloatArrayParameter):
+        (WebCore::WebGLRenderingContext::getWebGLIntArrayParameter):
+        (WebCore::WebGLRenderingContext::getWebGLUnsignedByteArrayParameter):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLTexture.cpp:
+        (WebCore::WebGLTexture::create):
+        (WebCore::WebGLTexture::WebGLTexture):
+        * html/canvas/WebGLTexture.h:
+        * manual-tests/webgl/resources/utils3d.js:
+        (initWebGL):
+        (loadShader):
+        (Framerate.prototype.snapshot):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::bindRenderbuffer):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+
+2009-11-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * WebCore.vcproj/QTMovieWin.vcproj: Add additional search path for QuickTime SDK.
+
+2009-11-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] GStreamer-CRITICAL's (and other warnings) on <video>
+        https://bugs.webkit.org/show_bug.cgi?id=26354
+
+        Implemented MediaPlayerPrivate::isAvailable by checking the
+        presence of the playbin2 GStreamer element.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::isAvailable):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-24  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        When building up the pango layout from text boxes, only append a
+        newline char after verifying there are no more boxes on this line.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+
+2009-11-24  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Keyboard Shortcut to Clear Console Messages
+        https://bugs.webkit.org/show_bug.cgi?id=31780
+
+        All Platforms:  Ctrl+L  = Clear Console Messages
+        Mac Only:       Cmd+K   = Clear Console Messages
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView): create shortcuts
+        (WebInspector.ConsoleView.prototype._promptKeyDown): handle shortcuts
+        * inspector/front-end/KeyboardShortcut.js:
+        (WebInspector.KeyboardShortcut.makeKey): convenience conversion of "a-z" character to keyCode
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel): style fixes for keyboard shortcuts
+
+2009-11-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: touch inspector controller in order to
+        kick win bot inspector deploy. rs=aroben.
+
+        * inspector/InspectorController.cpp:
+
+2009-11-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement expandable compartments on timeline panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31796
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype._setWindowPosition):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._addToRecordsWindow):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordListRow.prototype.dispose):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        (WebInspector.TimelineRecordGraphRow.prototype._onClick):
+        (WebInspector.TimelineRecordGraphRow.prototype.dispose):
+        * inspector/front-end/inspector.css:
+
+2009-11-24  Mark Rowe  <mrowe@apple.com>
+
+        Fix production builds where the source tree may be read-only.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Include "config.h" to meet Coding Style Guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=31792
+
+        No new tests as there is no new functionality.
+
+        * platform/graphics/win/IntPointWin.cpp:
+        * platform/graphics/win/IntRectWin.cpp:
+        * platform/graphics/win/IntSizeWin.cpp:
+        * platform/network/chromium/ResourceRequest.cpp:
+        * platform/win/PlatformMouseEventWin.cpp:
+
+2009-11-23  Jian Li  <jianli@chromium.org>
+
+        Reviewed by NOBODY (Chromium build fix).
+
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-11-23  Aaron Golden  <agolden@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Prevent ResourceHandleMac's version of ResourceHandle::receivedCredential from stripping
+        identity and certificate information from a WebCore::Credential when receivedCredential
+        needs to modify the credential's persistence.
+
+        Adding a new constructor Credential(const Credential& original, CredentialPersistence)
+        that copies every field from original except for persistence.
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::Credential):
+        * platform/network/Credential.h:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::receivedCredential):
+
+2009-11-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Part 2/3 of <rdar://problem/7377477> REGRESSION: Many web pages fail to render after interesting script runs in isolated world
+
+        Some clients of the JavaScriptCore API expect to be able to make callbacks over the JSC API,
+        and for this to automagically cause execution to take place in the world associated with the
+        global object associated with the ExecState (JSContextRef) passed.  However this is not how
+        things work - the world must be explicitly set within WebCore.
+
+        Making this work just for API calls to evaluate & call will be a far from perfect solution,
+        since direct (non-API) use of JSC still relies on WebCore setting the current world correctly.
+        A better solution would be to make this all work automagically all throughout WebCore, but this
+        will require more refactoring.
+
+        Add references from the JSDOMWindowShell and the JSDOMGlobalObject to the world that owns them,
+        so that we can get to the world from the lexical global object of an ExecState.  In the long-term
+        we should switch over to using this approach for all cases we want to get a world from an exec state.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::WebCoreJSClientData::beginningExecution):
+        (WebCore::WebCoreJSClientData::completedExecution):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::world):
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::world):
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::initScript):
+
+2009-11-23  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add range checks to rendering calls in WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=31239
+
+        I am now tracking the size of the data in each CanvasBuffer object
+        and keeping track of the buffer size of each active vertex attrib.
+        In drawArrays and drawElements I make sure no attempt is made to
+        access elements outside the valid buffer ranges. The test at:
+
+            http://cs.helsinki.fi/u/ilmarihe/c3d/functions/drawArraysOutOfBounds.html
+
+        no longer crashes.
+
+        I also added all the WebGL enumerations to GraphicsContext3D to use them in the validation checks
+
+        Tests: fast/canvas/webgl/drawArraysOutOfBounds.html
+               fast/canvas/webgl/drawElementssOutOfBounds.html
+
+        * bindings/js/JSWebGLArrayCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::bufferData):
+        (WebCore::JSWebGLRenderingContext::bufferSubData):
+        (WebCore::JSWebGLRenderingContext::texSubImage2D):
+        * html/canvas/WebGLArrayBuffer.cpp:
+        (WebCore::WebGLArrayBuffer::create):
+        (WebCore::WebGLArrayBuffer::data):
+        * html/canvas/WebGLArrayBuffer.h:
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        (WebCore::WebGLBuffer::associateBufferData):
+        (WebCore::WebGLBuffer::associateBufferSubData):
+        (WebCore::WebGLBuffer::byteLength):
+        * html/canvas/WebGLBuffer.h:
+        (WebCore::WebGLBuffer::elementArrayBuffer):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+        (WebCore::WebGLRenderingContext::sizeInBytes):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bufferData):
+        (WebCore::WebGLRenderingContext::bufferSubData):
+        (WebCore::WebGLRenderingContext::createShader):
+        (WebCore::WebGLRenderingContext::disableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::validateIndexArray):
+        (WebCore::WebGLRenderingContext::validateRenderingState):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        (WebCore::WebGLRenderingContext::drawElements):
+        (WebCore::WebGLRenderingContext::enableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::isFramebuffer):
+        (WebCore::WebGLRenderingContext::isProgram):
+        (WebCore::WebGLRenderingContext::isRenderbuffer):
+        (WebCore::WebGLRenderingContext::isShader):
+        (WebCore::WebGLRenderingContext::isTexture):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::validateProgram):
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+        (WebCore::WebGLRenderingContext::detachAndRemoveAllObjects):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore::WebGLRenderingContext::VertexAttribState::VertexAttribState):
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLShader.cpp:
+        (WebCore::WebGLShader::create):
+        (WebCore::WebGLShader::WebGLShader):
+        * html/canvas/WebGLShader.h:
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::createShader):
+
+2009-11-23  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        JSC bindings for HasIndexGetter generates incorrect code (affects
+        MediaList and CSSStyleDeclaration).
+        This cleans up the edge cases for indexing out of range for style and
+        computed style objects to return an empty string according to the spec.
+        MediaList now returns null when indexed out of range.
+        https://bugs.webkit.org/show_bug.cgi?id=31683
+
+        Tests: fast/dom/CSSStyleDeclaration/css-computed-style-item.html
+               fast/dom/CSSStyleDeclaration/css-style-item.html
+               fast/dom/StyleSheet/css-medialist-item.html
+
+        * bindings/scripts/CodeGeneratorJS.pm: If IndexGetterReturnsString then
+                we do not check the length before calling the item function.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::item):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::item):
+        * css/CSSStyleDeclaration.idl:
+
+2009-11-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        DocumentMarkers need to be educated about transforms
+        https://bugs.webkit.org/show_bug.cgi?id=31751
+        
+        Find highlight is incorrect with transforms
+        <rdar://problem/6358394>
+
+        Allow callers to specify that Frame::selectionTextRects() takes transforms into account
+        when computing the set of rects that encompass a selection. For transformed elemenets, the
+        selection rect will be the bounding box of the selected content.
+        
+        Fix DocumentMarkers to cache rects in absolute coordinates, rather than painting coordinates.
+        
+        Test: editing/selection/transformed-selection-rects.html
+        
+        * WebCore.base.exp:
+        Frame::selectionTextRects() has a new parameter.
+        
+        * dom/Document.cpp:
+        (WebCore::Document::setRenderedRectForMarker):
+        * dom/Document.h:
+        Pass the marker as a const reference.
+        
+        * dom/Range.h:
+        * dom/Range.cpp:
+        (WebCore::Range::textQuads):
+        Add a new method, textQuads(), which returns a list of quads, respecting transforms.
+        
+        * page/Frame.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionTextRects):
+        Add a new parameter, respectTransforms, and when that is RespectTransforms, use the quad
+        method to get quads for ranges, and then take their bounding boxes.
+
+        * rendering/InlineTextBox.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        (WebCore::InlineTextBox::computeRectForReplacementMarker):
+        (WebCore::InlineTextBox::paintDocumentMarkers):
+        (WebCore::InlineTextBox::textPos):
+        (WebCore::InlineTextBox::offsetForPosition):
+        
+        Pass DocumentMarkers as a const references.
+        Convert the argument to setRenderedRectForMarker() into absolute coordinates.
+        
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::selectionBounds):
+
+2009-11-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Cairo] support blurred test-shadow
+        [https://bugs.webkit.org/show_bug.cgi?id=31797]
+
+        Support for blurred text-shadows on Cairo. This patch
+        reuses the code of blurred box-shadows, introduced in
+        bug 26102. For a full textshadow support, a filters enabled
+        build is needed.
+
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-11-23  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Change incorrect calls to the constructor "EventNames()" to the correct accessor
+        "eventNames()". This saves ~100 AtomicString lookups each time.
+        https://bugs.webkit.org/show_bug.cgi?id=31811
+
+        * dom/EventNames.h:  Make constructor private to prevent this from happening again.
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore):  EventNames() --> eventNames()
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::checkValidity):  EventNames() --> eventNames()
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):  EventNames() --> eventNames()
+        (WebCore::FrameLoader::pageHidden):  EventNames() --> eventNames()
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):  EventNames() --> eventNames()
+
+2009-11-23  Adam Langley  <agl@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Chromium Linux: Limit the stroke width and mitre limit.
+
+        Limit the stroke width and mitre limit that we'll pass into Skia to
+        avoid overflowing Skia's uint16_t glyph widths.
+
+        http://code.google.com/p/chromium/issues/detail?id=28250
+        https://bugs.webkit.org/show_bug.cgi?id=31747
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (scalarBound):
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31812
+        WebSocket code uses RefPtr::get() where it shouldn't
+
+        No change in funcitonality, just coding style correction.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::~WebSocket):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::bufferedAmount):
+        (WebCore::WebSocketChannel::close):
+        (WebCore::WebSocketChannel::disconnect):
+        (WebCore::WebSocketChannel::didOpen):
+        (WebCore::WebSocketChannel::didClose):
+        (WebCore::WebSocketChannel::didReceiveData):
+        (WebCore::WebSocketChannel::didFail):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::pacExecutionCallbackMainThread): pacExecutionCallbackMainThread
+        is static, so it can't use member variables directly.
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31748
+        Make WebSocketHandleCFNet respect proxy auto-configuration files via CFProxySupport
+
+        * platform/network/cf/SocketStreamHandle.h: Removed names from some void* arguments, since
+        they didn't carry useful information.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle): When we need an http-style URL, we actually
+        always need https.
+        (WebCore::SocketStreamHandle::scheduleStreams): Factored out from constructor, since streams
+        only get scheduled after PAC is fetched and executed asynchronously.
+        (WebCore::SocketStreamHandle::copyPACExecutionDescription): Return a description for event
+        source.
+        (WebCore::MainThreadPACCallbackInfo::MainThreadPACCallbackInfo): Forward callback to main thread.
+        (WebCore::SocketStreamHandle::pacExecutionCallback): Ditto.
+        (WebCore::SocketStreamHandle::pacExecutionCallbackMainThread): Ditto. To avoid code duplication,
+        we make the call even on Mac.
+        (WebCore::SocketStreamHandle::executePACFileURL): Make an async call to CFNetworkExecuteProxyAutoConfigurationURL.
+        (WebCore::SocketStreamHandle::removePACRunLoopSource): Once PAC execution is done or aborted,
+        we need to get rid of the event source.
+        (WebCore::SocketStreamHandle::chooseProxy): Use stored m_httpsURL.get.
+        (WebCore::SocketStreamHandle::chooseProxyFromArray): Factored out from chooseProxy - the
+        array may come directly from system configuration, or from PAC.
+        (WebCore::SocketStreamHandle::chooseProxy): Tiger version of this function is now completely
+        separate.
+        (WebCore::SocketStreamHandle::~SocketStreamHandle): Run loop source should be destroyed
+        before we get to the destructor.
+        (WebCore::SocketStreamHandle::platformClose): Destroy the run loop source, if PAC execution
+        is still in progress.
+
+2009-11-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Don't leak the CGImage we create when drawing a sub image.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+
+2009-11-23  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Don't crash when OOM in creating isolated world
+        https://bugs.webkit.org/show_bug.cgi?id=31805
+
+        We need to add some more null checks to avoid crashing.  No new tests
+        because we don't have a good way to test out-of-memory bugs.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        * bindings/v8/V8Proxy.h:
+
+2009-11-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        This is the implementation of the filterRes attribute. It
+        helps the SVG developer to set the quality of a filter by
+        giving the width or height of filter.
+        This patch also sets the filter resolution to lower values
+        if a intermediate ImageBuffer size is bigger than the given
+        maximal size.
+        The maximal size is set to 5000x5000 by default. This is a
+        subjectiv decission. Everthing greater than this values gets
+        sensible slower. Values of 10000x10000 crashed on WebKitGtk.
+        For mobil devices a maximum size of 100x100 or 200x200 seems
+        to be reasonable.
+        The important fact on filter resolution is, that the output
+        size is still the size given by the <filter> element.
+
+        Tests: svg/filters/big-sized-filter-2.svg
+               svg/filters/big-sized-filter.svg
+               svg/filters/filterRes.svg
+
+        * platform/graphics/FloatRect.cpp:
+        (WebCore::FloatRect::scale): Add the abbility to scale a rect by x and y.
+        * platform/graphics/FloatRect.h:
+        (WebCore::FloatRect::scale): Add the abbility to scale a rect by x and y.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::createPlatformShadow): Use scaledSubRegion for
+        calculation.
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::FEBlend::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::FEComponentTransfer::apply): Use scaledSubRegion for effect intern
+        calculations.
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/Filter.h: Add the abbility to change the quality
+        of a filter output.
+        (WebCore::Filter::filterResolution):
+        (WebCore::Filter::setFilterResolution):
+        (WebCore::Filter::calculateEffectSubRegion): Calculates the correct subRegion
+        as well as the scaledSubRegion. It also searches for the biggest effect size.
+        We have to change the filter resolution, if one intermediate ImageBuffer size
+        doesn't fit in the maximal image size.
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::calculateDrawingIntRect): Use scaledSubRegion to get
+        the right part of a previous effect result.
+        (WebCore::FilterEffect::calculateDrawingRect): Use scaledSubRegion to get
+        the right part of a previous effect result.
+        (WebCore::FilterEffect::getEffectContext): Use scaledSubRegion to create
+        a new intermediate ImageBuffer for the result of the current effect.
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::scaledSubRegion): The scaled subRegion of a the
+        filter effect.
+        (WebCore::FilterEffect::setScaledSubRegion):
+        (WebCore::FilterEffect::effectBoundaries): The original values of the
+        EffectElement for a second subRegion calculation.
+        (WebCore::FilterEffect::setEffectBoundaries):
+        * platform/graphics/filters/ImageBufferFilter.cpp:
+        (WebCore::ImageBufferFilter::ImageBufferFilter): Set the scale factor to one.
+        * platform/graphics/filters/ImageBufferFilter.h:
+        (WebCore::ImageBufferFilter::maxImageSize):
+        (WebCore::ImageBufferFilter::calculateEffectSubRegion):
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::calculateEffectRect): Use scaledSubRegion for effect
+        intern calculations.
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::calculateEffectRect): Use scaledSubRegion for effect
+        intern calculations.
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::parseMappedAttribute): Parse filterRes attribute.
+        (WebCore::SVGFilterElement::buildFilter): Give SVGResourceFilter the current
+        filterResolution.
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes): Save
+        values to effectBoundaries of the filter effect
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        (WebCore::shouldProcessFilter): Return signal if a neccessary value is zero.
+        (WebCore::SVGResourceFilter::fitsInMaximumImageSize): Checks if the given size
+        fits into the maximal image size, modifys scale factors if not and return a
+        bool: fits.
+        (WebCore::SVGResourceFilter::prepareFilter): Scale the SourceImage to
+        filterResolution (given by FilterElement or calculated on to big image sizes).
+        Set the scale level to SVGFilter.
+        (WebCore::SVGResourceFilter::applyFilter): Don't apply filters if shouldProcessFilter
+        is wrong.
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::setFilterResolution): FilterResolution of FilterElement.
+        (WebCore::SVGResourceFilter::setHasFilterResolution): Does FilterElement provides
+        a FilterResolution?
+        (WebCore::SVGResourceFilter::scaleX): Current scale factor for horizontal.
+        (WebCore::SVGResourceFilter::scaleY): Current scale factor for vertical.
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply): Use scaledSubRegion for effect intern calculations.
+        Kernel values are scaled to current filter resolution too.
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply): Use scaledSubRegion for effect intern calculations.
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply): Use scaledSubRegion for effect intern calculations.
+        Kernel values are scaled to current filter resolution too.
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply): Use scaledSubRegion for effect intern calculations.
+        Kernel values are scaled to current filter resolution too.
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply): Use scaledSubRegion for effect intern calculations.
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply): Use scaledSubRegion for effect intern calculations.
+        * svg/graphics/filters/SVGFilter.cpp:
+        (WebCore::SVGFilter::calculateEffectSubRegion): Calculate subRegion for LayoutTests,
+        scaledSubRegion according to the current filterResolution and get the maximal image size.
+        * svg/graphics/filters/SVGFilter.h:
+        (WebCore::SVGFilter::effectBoundingBoxMode): Original values of the FilterElement. 
+        (WebCore::SVGFilter::filterRegion): Use virtual for clarification.
+        (WebCore::SVGFilter::sourceImageRect): Use virtual for clarification.
+        (WebCore::SVGFilter::maxImageSize): Get the maximal image size.
+
+2009-11-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Wrong runtime instance objects of wrapped QObjects may be used if
+        the wrapped object died before the gc removed the instance.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31681
+
+        Before using a cached instance, verify that its wrapped QObject is
+        still alive.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getQtInstance):
+        * bridge/qt/qt_instance.h:
+        (JSC::Bindings::QtInstance::hashKey):
+
+2009-11-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        ARIA: support aria-flowto
+        https://bugs.webkit.org/show_bug.cgi?id=31762
+
+        Test: platform/mac/accessibility/aria-flowto.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::ariaOwnsElements):
+        (WebCore::AccessibilityObject::supportsARIAFlowTo):
+        (WebCore::AccessibilityObject::ariaFlowToElements):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::linkedUIElements):
+        (WebCore::AccessibilityRenderObject::supportsARIAFlowTo):
+        (WebCore::AccessibilityRenderObject::ariaFlowToElements):
+        * accessibility/AccessibilityRenderObject.h:
+        * html/HTMLAttributeNames.in:
+
+2009-11-22  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Build fix for WML enabled builds.
+        Adopt WebCore API changes.
+
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::defaultEventHandler):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce sidebar background on timeline panel in order
+        to prevent it from flickering on scroll.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31789
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.setSidebarWidth):
+        (WebInspector.TimelinePanel.prototype._onScroll):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        * inspector/front-end/inspector.css:
+
+2009-11-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Reimplement TimelinePanel to make it fast:
+        - Extract grid and overview into separate files
+        - Make timeline create only divs for visible rows
+
+        https://bugs.webkit.org/show_bug.cgi?id=31784
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.createInterface):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.set calculator):
+        * inspector/front-end/TimelineGrid.js: Added.
+        (WebInspector.TimelineGrid):
+        (WebInspector.TimelineGrid.prototype.get itemsGraphsElement):
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        (WebInspector.TimelineGrid.prototype.addEventDivider):
+        (WebInspector.TimelineGrid.prototype.setScrollAndDividerTop):
+        * inspector/front-end/TimelineOverviewPane.js: Added.
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype._onCheckboxClicked):
+        (WebInspector.TimelineOverviewPane.prototype.update):
+        (WebInspector.TimelineOverviewPane.prototype.setSidebarWidth):
+        (WebInspector.TimelineOverviewPane.prototype.updateMainViewWidth):
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        (WebInspector.TimelineOverviewPane.prototype._resizeWindow):
+        (WebInspector.TimelineOverviewPane.prototype._windowResizeDragging):
+        (WebInspector.TimelineOverviewPane.prototype._dragWindow):
+        (WebInspector.TimelineOverviewPane.prototype._windowDragging):
+        (WebInspector.TimelineOverviewPane.prototype._resizeWindowLeft):
+        (WebInspector.TimelineOverviewPane.prototype._resizeWindowRight):
+        (WebInspector.TimelineOverviewPane.prototype._setWindowPosition):
+        (WebInspector.TimelineOverviewPane.prototype._endWindowDragging):
+        (WebInspector.TimelineOverviewCalculator):
+        (WebInspector.TimelineOverviewCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineOverviewCalculator.prototype.reset):
+        (WebInspector.TimelineOverviewCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineOverviewCalculator.prototype.get boundarySpan):
+        (WebInspector.TimelineOverviewCalculator.prototype.formatValue):
+        (WebInspector.TimelineCategoryTreeElement):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineCategoryGraph):
+        (WebInspector.TimelineCategoryGraph.prototype.get graphElement):
+        (WebInspector.TimelineCategoryGraph.prototype.addChunk):
+        (WebInspector.TimelineCategoryGraph.prototype.clearChunks):
+        (WebInspector.TimelineCategoryGraph.prototype.set dimmed):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype.setSidebarWidth):
+        (WebInspector.TimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.TimelinePanel.prototype.resize):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype.show):
+        (WebInspector.TimelinePanel.prototype._onScroll):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._adjustScrollPosition):
+        (WebInspector.TimelineCategory):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.get boundarySpan):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-11-22  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Disable access to file:/// directory listings
+        https://bugs.webkit.org/show_bug.cgi?id=31329
+
+        Deny access to directory listings. This needs doing in WebKit for
+        WebKit clients that do permit top-level navigation to file:///dir.
+        This matches Firefox, plus the existing Safari implementation (which
+        does not support any directory access at all). It will fix the
+        LayoutTest named below for Chromium.
+
+        Test: fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html
+
+        * page/SecurityOrigin.cpp: Deny access to directory listings.
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canRequest):
+
+2009-11-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Support Ctrl+P and Ctrl+N, Readline keyboard shortcuts in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=31400
+
+        Handle the following when on a Mac:
+
+          Ctrl+P = Previous (like Up arrow)
+          Ctrl+N = Next (like Down arrow)
+
+        No longer rerun autocompletion when just pushing a modifier key
+        like Control, Alt, Shift, or Meta.
+
+        Improved arrow key behavior with Multiline code in the Console, with the following behavior:
+
+          Up   = Previous Command if on First Line (caret moves to the end of the first line)
+                 otherwise default caret movement in text.
+          Down = Next Command if on Last Line (caret naturally moves to the end)
+                 otherwise default caret movement in text.
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.handleKeyEvent): handle new keyboard shortcuts
+        (WebInspector.TextPrompt.prototype.isCaretOnFirstLine): check if the caret is on the top line
+        (WebInspector.TextPrompt.prototype.isCaretOnLastLine): check if the caret is on the bottom line
+        (WebInspector.TextPrompt.prototype._upKeyPressed):
+        (WebInspector.TextPrompt.prototype._downKeyPressed):
+        (WebInspector.TextPrompt.prototype._moveBackInHistory):
+        (WebInspector.TextPrompt.prototype._moveForwardInHistory):
+
+2009-11-21  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds a tooltip containing the full url of the resource to each element
+        in the Resources panel so that it is possible to quickly see the query
+        parameters.
+        https://bugs.webkit.org/show_bug.cgi?id=19103
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.refresh):
+        Set the tooltip to be the resource's url.
+
+2009-11-21  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        CSSKeyframesRule::findRule() and deleteRule() should accept 'from' and 'to' as well as percentages
+        https://bugs.webkit.org/show_bug.cgi?id=31588
+        
+        In WebKitCSSKeyframesRule::findRuleIndex(), map 'from' to 0% an 'to' to 100%
+        so that findRule() and deleteRule() work with these keywords.
+
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::WebKitCSSKeyframesRule::findRuleIndex):
+
+2009-11-21  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31647
+
+        Changed KeyboardEvent::m_keyEvent from a raw pointer to an OwnPtr.
+
+        No functionality was changed. So, no new tests.
+
+        * dom/KeyboardEvent.cpp:
+        (WebCore::KeyboardEvent::~KeyboardEvent):
+        * dom/KeyboardEvent.h: Changed m_keyEvent to OwnPtr.
+        (WebCore::KeyboardEvent::keyEvent):
+
+2009-11-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for aria-owns
+        https://bugs.webkit.org/show_bug.cgi?id=31702
+
+        Re-organized how accessibilityAttributeNames are returned so 
+        that it's possible for an element to add an attribute based on 
+        a dynamic value. In this case, we only want to add AXOwn if the 
+        element actually supports aria-owns.
+  
+        Test: platform/mac/accessibility/aria-owns.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::supportsARIAOwns):
+        (WebCore::AccessibilityObject::ariaOwnsElements):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaOwnsElements):
+        (WebCore::AccessibilityRenderObject::supportsARIAOwns):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-11-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7414396> Leopard & Tiger: Support closed caption in <video> element
+
+        * css/mediaControls.css:
+            Define closed caption toggle button.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+            Create closed caption toggle button in display order.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+            Don't require MediaControllerThemeQuickTime theme for captions toggle button.
+            No need to check if the movie has video, a closed captions track is a video
+            track.
+
+2009-11-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Running code in the Console that ends with a
+        single line comment no longer produces a parse error.
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+
+2009-11-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for 'math' role
+        https://bugs.webkit.org/show_bug.cgi?id=31706
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2009-11-20  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        NPN_ReloadPlugins does not reload the page even if reloadPages is true.
+        https://bugs.webkit.org/show_bug.cgi?id=30460
+
+        Replace call to PluginDatabase::installedPlugins()->refresh() with Page::refreshPlugins().
+        It already refreshes plugins and reloads pages when necessary.
+
+        Tests: plugins/reloadplugins-and-pages.html
+               plugins/reloadplugins-no-pages.html
+
+        * plugins/PluginInfoStore.cpp:
+        (WebCore::refreshPlugins):
+
+2009-11-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://7409188> WebKit needs to be able to serialize and deserialize objects.
+
+        Expose WebCore object serialization to WebKit.
+
+        * WebCore.base.exp:
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/js/SerializedScriptValue.h:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31741>.
+        Web Inspector: User Entered Data on the console should show up no matter what filters.
+        
+        Always show .console-user-command-result, no matter what the filter say
+        we should do with the other classes.
+
+        * inspector/front-end/inspector.css:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31700>.
+        Web Inspector: isMac should be in one central location + Cached.
+        
+        We should cache the value of isMac, and make the indexOf call in one
+        single location, because we are calling it from multiple places, and saving
+        the result can save us time, and make the call sites simpler.
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleKeyEvent):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+        (WebInspector.isMac):
+
+2009-11-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Removed .DS_Store accidentally added in last (r51245).
+
+2009-11-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add Console Only Layout Mode
+        https://bugs.webkit.org/show_bug.cgi?id=30282
+
+        Adds a Console Panel, which allows for a Full size Console. This
+        extends the Drawer to the size of a Panel. This also fixes previous
+        resize issues with the Drawer.
+
+        * inspector/front-end/ConsolePanel.js: added.
+        (WebInspector.ConsolePanel):
+        (WebInspector.ConsolePanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.ConsolePanel.prototype.show):
+        (WebInspector.ConsolePanel.prototype.hide):
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer):
+        (WebInspector.Drawer.prototype.set visibleView):
+        (WebInspector.Drawer.prototype.get savedHeight): access the saved height of the variable console.
+        (WebInspector.Drawer.prototype.show.animationFinished):
+        (WebInspector.Drawer.prototype.show):
+        (WebInspector.Drawer.prototype.hide.animationFinished):
+        (WebInspector.Drawer.prototype.hide):
+        (WebInspector.Drawer.prototype.resize): resize appropriately if full/non-full
+        (WebInspector.Drawer.prototype.enterPanelMode):
+        (WebInspector.Drawer.prototype.exitPanelMode):
+        (WebInspector.Drawer.prototype.immediatelyExitPanelMode):
+        (WebInspector.Drawer.prototype._cancelAnimationIfNeeded):
+        (WebInspector.Drawer.prototype._animateDrawerHeight.animationFinished):
+        (WebInspector.Drawer.prototype._animateDrawerHeight):
+        (WebInspector.Drawer.prototype._animationDuration):
+        (WebInspector.Drawer.prototype._startStatusBarDragging):
+        (WebInspector.Drawer.prototype._statusBarDragging):
+        (WebInspector.Drawer.prototype._endStatusBarDragging):
+
+        Miscellaneous changes and cleanup.
+
+        * English.lproj/localizedStrings.js: "Console" toolbar title.
+        * inspector/front-end/ConsoleView.js: removed unnecessary element reordering  
+        * inspector/front-end/Images/consoleIcon.png: added.
+        * inspector/front-end/inspector.css: added icon.
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels): create console panel
+        (WebInspector.windowResize): resize drawer if necessary
+        (WebInspector.documentKeyDown): esc should not toggle the console when in panel mode
+        (WebInspector.animateStyle): start animation interval, returns the interval key
+        (WebInspector.toggleAttach): resize drawer if necessary
+        (WebInspector.showConsolePanel): restore the panel when the inspector restarts
+        (WebInspector.showProfileForURL): style fix
+
+        Restore the panel when the inspector restarts.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+
+        Build files.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/WebKit.qrc:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31699>.
+        Web Inspector: Should Cache Values of InspectorController.platform() and port().
+
+        Refactor the Inspector to cache the value of InspectorController.platform
+        and InspectorController.port, because those need to call into C++, they are
+        being called more and more as we add platform specific keyboard shortcuts, and
+        they shouldn't change in the lifecycle of the Web Inspector.
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleKeyEvent):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.js:
+        (WebInspector.get platform):
+        (WebInspector.get port):
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.toolbarDragStart):
+
+2009-11-20  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed build fix for filters enabled builds.
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-11-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7389945> QTKit based media engine should not claim to support 
+        fullscreen on Leopard
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+            Only return true on SnowLeopard for now.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+            No need to special case MediaFullscreenButtonPart as the default implementation 
+            asks the media engine if it supports fullscreen.
+
+2009-11-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        Patch by Yongjun Zhang <yongjun.zhang@nokia.com> and
+                 Girish Ramakrishnan <girish@forwardbias.in>
+        
+        [Qt] Implement support for rendering plugins on Qt/Mac when a page is used
+        without a QWebView or when inside QGraphicsWebView.
+        
+        Currently, the code provides the cgcontext of the PlatformPluginWidget to
+        the plugin. This approach does not work when we are printing, or using
+        QWebFrame::render() to render to a QImage/QPixmap since the plugin ends
+        up drawing on the QWebView (i.e platformPluginWidget's cgcontext) instead
+        of the QPaintDevice's context.
+        
+        To solve all cases and keep the code simple, we render the plugin to an
+        offscreen pixmap in all cases. This way, the plugin always renders to the
+        CGContext of the pixmap and we then use QPainter to blit the pixmap into
+        the QPaintDevice. We also create a fake window and set it's WindowRef in
+        NPWindow. Only with this WindowRef does Flash paint correctly to the QPixmap.
+        
+        Now, that's the theory. In practice, ATM, mouse events do not work when using
+        the fake window. So, setPlatformPluginWidget() is still called when using QWebView
+        so that there are no regressions after this patch. Once we get mouse events
+        working, setPlatformPluginWidget will be removed.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31183
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::invalidateRect):
+
+2009-11-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Resync Resources Backend and Frontend
+        https://bugs.webkit.org/show_bug.cgi?id=31705
+
+        * inspector/front-end/Resource.js: resync enum values with backend
+        (WebInspector.Resource.prototype._mimeTypeIsConsistentWithType): return false if all else fails, not true in all cases
+
+2009-11-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Android port lacks configuration in Platform.h and config.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31671
+
+        Build change only. No new tests possible.
+
+        * config.h: Modified. Added Android-specific configuration.
+
+2009-11-20  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Change default stylesheet to reset text indentation for ruby elements by default.
+        (https://bugs.webkit.org/show_bug.cgi?id=31247)
+
+        Test: fast/ruby/ruby-text-indent.html
+
+        * css/html.css: reset text-indent on <ruby> and <rt> elements
+
+2009-11-19  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes <http://webkit.org/b/22754>.
+        Web Inspector: Keyboard shortcut for Element finder.
+
+        Use Command + Shift + C as a shortcut for Node Search, to 
+        match the Firebug shortcut to do the same thing.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleKeyEvent):
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31690
+        Make SocketStreamHandleCFNet work on Windows
+
+        * WebCore.vcproj/WebCore.vcproj: Added LoaderRunLoopCF.
+
+        * platform/network/ResourceHandle.h: Removed loaderRunLoop().
+
+        * platform/network/cf/LoaderRunLoopCF.cpp: Added.
+        (WebCore::emptyPerform):
+        (WebCore::runLoaderThread):
+        (WebCore::loaderRunLoop):
+        * platform/network/cf/LoaderRunLoopCF.h: Added.
+        Moved the run loop that we use for CFNetwork from ResourceHandle to its own file, because
+        it's needed for more than just resource loading.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp: Use loaderRunLoop() from its new location.
+
+        * platform/network/cf/DNSCFNet.cpp: (WebCore::DNSResolveQueue::resolve): Ditto.
+
+        * platform/network/cf/SocketStreamHandle.h: Added static callbacks for forwarding events to
+        main thread.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle): Use loaderRunLoop() on Windows instead of
+        inoperable main run loop.
+
+        (WebCore::MainThreadEventCallbackInfo::MainThreadEventCallbackInfo): 
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        (WebCore::SocketStreamHandle::readStreamCallbackMainThread):
+        (WebCore::SocketStreamHandle::writeStreamCallbackMainThread):
+        Forward stream events to main thread on Windows.
+
+2009-11-19  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Quick style fix.
+        https://bugs.webkit.org/show_bug.cgi?id=27777
+
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::paintTickmarks):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaButton):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+      
+       Build fix. No review needed.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * platform/graphics/qt/StillImageQt.cpp:
+        (WebCore::StillImage::draw):
+        * platform/graphics/qt/StillImageQt.h:
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsButton):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::paintMissingPluginIcon):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::getHBITMAPOfSize):
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31321 Make -webkit-
+        color-correction work with untagged images
+
+        Image's draw(), drawPattern(), and fillWithSolidColor() functions 
+        now take a ColorSpace. A bunch of classes inherit from Image, so 
+        draw() and drawPattern() functions there must also take a 
+        ColorSpace.
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::fillWithSolidColor):
+        (WebCore::Image::drawTiled):
+        * platform/graphics/Image.h:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::draw):
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::draw):
+        * platform/graphics/cg/PDFDocumentImage.h:
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
+        * svg/graphics/SVGImage.h:
+
+        All of the drawImage() functions and drawTiled() functions of 
+        GraphicsContext now take a ColorSpace.
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawImage):
+        (WebCore::GraphicsContext::drawTiledImage):
+        * platform/graphics/GraphicsContext.h:
+
+        This is where the actual work is done.
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::imageWithColorSpace): New static function that returns a 
+        copy of the given image in the given ColorSpace *IF* we should use 
+        the given ColorSpace. We will ignore the color space if the image 
+        is tagged and return 0. 
+        (WebCore::BitmapImage::draw): Now takes a ColorSpace and uses it to 
+        call imageWithColorSpace(). 
+        (WebCore::Image::drawPattern): Same.
+
+        Attempt to keep all ports building. 
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/skia/BitmapImageSingleFrameSkia.h:
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImageSingleFrameSkia::draw):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+
+        Callers of GraphicsContext's drawImage() and drawTiled() functions 
+        now need to send a ColorSpace.
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paint):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::paintNinePieceImage):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintResizer):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-11-19  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Properly create a CGImageRef on non-PLATFORM(MAC).
+        https://bugs.webkit.org/show_bug.cgi?id=27777
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::sharedBufferGetBytesAtPosition):
+        (WebCore::sharedBufferRelease):
+        (WebCore::ImageSource::setData):
+        * platform/graphics/cg/ImageSourceCG.h:
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged):
+
+2009-11-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        -webkit-user-drag: element Drag images include overflow decorations from incorrect nodes
+        https://bugs.webkit.org/show_bug.cgi?id=31656
+
+        Make sure we're a child of the painting root before drawing overflow features.
+
+        * manual-tests/user-drag-with-decorations.html: Added.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paint):
+
+2009-11-19  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempt to fix Chromium build.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart): Add new enum values for Show/HideClosedCaptionButton to make it compile.
+
+2009-11-19  Rahul Kuchhal  <kuchhal@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Do not assert when a high number is used for roman numerals in lists.
+        https://bugs.webkit.org/show_bug.cgi?id=31652
+
+        Test: fast/lists/ol-start-roman.html
+
+        * rendering/RenderListMarker.cpp:
+        (WebCore::toRoman): Increase the char array size.
+
+2009-11-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Add translatable strings to cover validationMessage, after
+        r51172. Already covered by existing test.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::validationMessageValueMissingText):
+        (WebCore::validationMessageTypeMismatchText):
+        (WebCore::validationMessagePatternMismatchText):
+        (WebCore::validationMessageTooLongText):
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+        (WebCore::validationMessageStepMismatchText):
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(FLOAT_H) guard
+        https://bugs.webkit.org/show_bug.cgi?id=31661
+
+        WebCore has a dependency on float.h, there is
+        no need to guard float.h.
+
+        No new tests as there is no functional change.
+
+        * html/HTMLInputElement.cpp: Remove include directive
+        for float.h as it is included in MathExtras.h already.
+
+2009-11-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Instrumentation should account for painting in compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=31674
+
+        Add calls to InspectorTimelineAgent for painting into compositing layers,
+        which is not accounted for in FrameView::paintContents().
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        Avoid fetching the FrameView multiple times.
+        
+        (WebCore::inspectorTimelineAgent):
+        (WebCore::RenderLayerBacking::paintContents):
+
+2009-11-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7035231>
+        Support closed caption in <video> element
+
+        Test: media/media-captions.html
+
+        * WebCore.base.exp:
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaControl::controlTypeName):
+            Define ShowClosedCaptionsButton and HideClosedCaptionsButton.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+            Add MediaToggleClosedCaptionsButtonPart.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+            Define and match mediaControlsToggleClosedCaptionsButton.
+
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+            Define and match PseudoMediaControlsToggleClosedCaptions.
+
+        * css/CSSValueKeywords.in:
+            Define and use media-toggle-closed-captions-button.
+
+        * css/mediaControls.css:
+        * css/mediaControlsQuickTime.css:
+            Add webkit-media-controls-toggle-closed-captions-button.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): 
+            Initialize m_closedCaptionsVisible.
+        (WebCore::HTMLMediaElement::loadInternal): 
+            Set m_closedCaptionsVisible to false.
+        (WebCore::HTMLMediaElement::hasClosedCaptions): 
+        (WebCore::HTMLMediaElement::closedCaptionsVisible): 
+        (WebCore::HTMLMediaElement::setClosedCaptionsVisible): 
+            New, captions internal methods.
+        (WebCore::HTMLMediaElement::setWebkitClosedCaptionsVisible): 
+        (WebCore::HTMLMediaElement::webkitClosedCaptionsVisible): 
+        (WebCore::HTMLMediaElement::webkitHasClosedCaptions): 
+            New, captions DOM API.
+
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+            Declare methods needed for captions API.
+
+        * platform/ThemeTypes.h:
+            Add MediaToggleClosedCaptionsButtonPart.
+
+        * platform/android/LocalizedStringsAndroid.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+            Add empty implmentations.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::NullMediaPlayerPrivate::setClosedCaptionsVisible):
+            New, empty implementations of media engine closed caption functions.
+        (WebCore::MediaPlayer::hasClosedCaptions):
+        (WebCore::MediaPlayer::setClosedCaptionsVisible):
+            New, call media engine closed caption functions.
+
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivateInterface::setClosedCaptionsVisible):
+            Declare new media engine methods.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+            New, QTKit implementation of closed caption methods.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+            Add help text for ShowClosedCaptionsButton and HideClosedCaptionsButton.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+            Declare and initialize wkQTMovieHasClosedCaptions and wkQTMovieSetShowClosedCaptions.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            Deal with MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON.
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCaptionsButtonElement):
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::defaultEventHandler):
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::updateDisplayType):
+            New, implement the closed caption toggle button,
+
+        * rendering/MediaControlElements.h:
+            Define MediaShowClosedCaptionsButton and MediaHideClosedCaptionsButton,
+            declare MediaControlToggleClosedCaptionsButtonElement.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange):
+        (WebCore::RenderMedia::createToggleClosedCaptionsButton):
+        (WebCore::RenderMedia::createStatusDisplay):
+        (WebCore::RenderMedia::updateControls):
+        (WebCore::RenderMedia::forwardEvent):
+        * rendering/RenderMedia.h:
+            Deal with m_toggleClosedCaptionsButton.
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paint):
+            Deal with MediaToggleClosedCaptionsButtonPart.
+
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeMac.h:
+            Declare paintMediaToggleClosedCaptionsButton.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaToggleClosedCaptionsButton):
+            New.
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+            Don't render captions toggle button unless we are using the new theme, the
+            movie has captions, and the movie is in a <video> element since we currently
+            rely on QTKit to render the captions.
+
+        * rendering/style/RenderStyleConstants.h:
+            Define MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON.
+
+2009-11-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add missing header.
+
+        * platform/wx/LocalizedStringsWx.cpp:
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31634
+        Ignore realm for proxy protection spaces
+
+        Only affects WebSocket proxy authentication, cannot be tested in DRT.
+
+        * platform/network/ProtectionSpace.cpp:
+        (WebCore::operator==):
+        * platform/network/ProtectionSpaceHash.h:
+        (WebCore::ProtectionSpaceHash::hash):
+
+2009-11-19  Olivier Goffart  <ogoffart@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Normalize signal and slot signatures.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+
+2009-11-19  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Store cookie domains in the WebInspector object
+
+        The cookie domains have been moved from StoragePanel into WebInspector.
+        Also, the document URLs are now passed inside the WebInspector.addResource()
+        payload rather than pushed directly from InspectorController.
+        https://bugs.webkit.org/show_bug.cgi?id=31627
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.addCookieDomain):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.addCookieDomain):
+        (WebInspector.reset):
+
+2009-11-19  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the other part of platform directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31585
+
+        Inherits the following classes from FastAllocBase because these are
+        instantiated by 'new':
+
+        class RegularExpression    - instantiated at: WebCore/page/Frame.cpp:415
+        class TransformationMatrix - instantiated at: WebCore/rendering/TransformState.cpp:62
+        class Path                 - instantiated at: WebCore/html/HTMLAreaElement.cpp:73
+        class FontPlatformData     - instantiated at: WebCore/platform/graphics/qt/FontCacheQt.cpp:188
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and no need to be copyable:
+
+        class Cursors                         - instantiated at: WebCore/platform/qt/CursorQt.cpp:146
+        class NetworkStateNotifier            - instantiated at: WebCore/platform/network/NetworkStateNotifier.cpp:37
+        struct CrossThreadResourceRequestData - instantiated at: WebCore/platform/network/ResourceRequestBase.cpp:71
+
+        class ImageDecoder - its child class is instantiated at: WebCore/platform/graphics/qt/ImageDecoderQt.cpp:46
+        class MediaPlayerPrivateInterface - its child class is instantiated at: WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:119
+
+        * platform/graphics/MediaPlayerPrivate.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/qt/FontPlatformData.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/image-decoders/ImageDecoder.h:
+        * platform/network/NetworkStateNotifier.h:
+        * platform/network/ResourceRequestBase.h:
+        * platform/qt/CursorQt.cpp:
+        * platform/text/RegularExpression.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r51172.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::validationMessageValueMissingText):
+        (WebCore::validationMessageTypeMismatchText):
+        (WebCore::validationMessagePatternMismatchText):
+        (WebCore::validationMessageTooLongText):
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+        (WebCore::validationMessageStepMismatchText):
+
+2009-11-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed <rdar://problem/7398987> Assertion failure in
+        RenderLayer::updateClipRects when a plug-in’s enclosing layer is
+        enclosed by a transformed layer
+
+        Tests: fast/layers/clip-rects-transformed-2.html
+               fast/layers/clip-rects-transformed.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::clippingRoot): Added. Finds the nearest ancestor
+        that is either transformed or composited. During painting and hit
+        testing, when a transformed or composited layer is hit, it becomes the
+        new root layer, which ultimately gets passed to calculateRects().
+        (WebCore::RenderLayer::childrenClipRect): Pass the clipping root as the
+        root layer to calculateRects(), and return the bounding box of the
+        transformed rectangle.
+        (WebCore::RenderLayer::selfClipRect): Ditto.
+        * rendering/RenderLayer.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove support for Qt v4.3 or older versions
+        https://bugs.webkit.org/show_bug.cgi?id=29469
+
+        No new tests as there is no change if compiled with 
+        Qt v4.4 or later version.
+
+        * WebCore.pro:
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::EntityResolver::resolveUndeclaredEntity):
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::startDocument):
+        (WebCore::XMLTokenizer::parseDtd):
+        * platform/graphics/qt/FontQt.cpp:
+        * platform/graphics/qt/FontQt43.cpp: Removed.
+        * platform/graphics/qt/ImageQt.cpp:
+        * platform/network/ResourceHandleInternal.h:
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        (WebCore::ResourceHandle::setDefersLoading):
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/qt/ResourceRequestQt.cpp:
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::clearData):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookieJar):
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::keyIdentifierForQtKeyCode):
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/text/qt/TextBoundaries.cpp:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        * plugins/qt/PluginDataQt.cpp:
+        (WebCore::PluginData::initPlugins):
+
+2009-11-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <https://bugs.webkit.org/show_bug.cgi?id=27959>.
+        Support for validationMessage attribute, as per HTML5 specs.
+
+        Test: fast/forms/validationMessage.html
+
+        * html/HTMLButtonElement.idl: validationMessage attribute
+        * html/HTMLFieldSetElement.idl: validationMessage attribute
+        * html/HTMLFormControlElement.cpp:
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.idl: validationMessage attribute
+        * html/HTMLSelectElement.idl: validationMessage attribute
+        * html/HTMLTextAreaElement.idl: validationMessage attribute
+        * html/ValidityState.cpp: new method to retrieve pertinent localized text
+        * html/ValidityState.h:
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/android/LocalizedStringsAndroid.cpp:
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        * platform/haiku/LocalizedStringsHaiku.cpp:
+        * platform/mac/LocalizedStringsMac.mm:
+        * platform/wx/LocalizedStringsWx.cpp:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        Fix a typo. Remove the trailing semicolon
+        from an include directive after r51137.
+
+        No new tests as there is no functional change.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r51159.
+
+        Include float.h for DBL_MANT_DIG. Not sure why this
+        is not a problem for other ports.
+
+        * html/HTMLInputElement.cpp:
+
+2009-11-19  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 31574 -  Crashing bug when removing <ruby> element
+        (https://bugs.webkit.org/show_bug.cgi?id=31574)
+
+        Cause of the bug:
+        1.) RenderBlock::destroy() of the RenderRubyRun called destroyLeftoverChildren()
+        2.) that called destroy() of the RenderRubyBase(), which in RenderObject::destroy() calls remove()
+        3.) remove() is being redirected as parent()->removeChild() in RenderObject.h
+        4.) this triggers the special handling of child removal in RenderRubyRun that
+            causes it to destroy itself
+        5.) On returning from all this the renderer crashes when accessing a member
+            or virtual function on this now illegal object.
+
+        I therefore added a flag that tracks if the ruby run is being destroyed.
+        If so, avoid doing the special handling in removeChild that caused this.
+        It's not the most elegant solution, but the easiest to implement without
+        touching unrelated code. Also, it's self-documenting.
+
+        Test: fast/ruby/ruby-remove.html
+
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::RenderRubyRun):
+        (WebCore::RenderRubyRun::destroy):
+        (WebCore::RenderRubyRun::removeChild):
+        * rendering/RenderRubyRun.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove WTF_USE_JAVASCRIPTCORE_BINDINGS as it is no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=31643
+
+        No new tests as there is no functional change.
+
+        * WebCore.pro:
+
+2009-11-18  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Implement TextBoundaries for WINCE port.
+        https://bugs.webkit.org/show_bug.cgi?id=27371
+
+        * platform/text/wince/TextBoundariesWince.cpp: Added.
+
+2009-11-18  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Implement TextBreakIterator for WINCE port.
+        https://bugs.webkit.org/show_bug.cgi?id=27371
+
+        * platform/text/wince/TextBreakIteratorWince.cpp: Added.
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add support for ValidityState.typeMismatch for the following INPUT types:
+          date datetime datetime-local month time week
+        https://bugs.webkit.org/show_bug.cgi?id=31342
+
+        Tests: fast/forms/ValidityState-typeMismatch-date.html
+               fast/forms/ValidityState-typeMismatch-datetime.html
+               fast/forms/ValidityState-typeMismatch-datetimelocal.html
+               fast/forms/ValidityState-typeMismatch-month.html
+               fast/forms/ValidityState-typeMismatch-time.html
+               fast/forms/ValidityState-typeMismatch-week.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::formStringToISODateTime): Check the type
+          validity of the specified type and string using the ISODateTime class.
+        * html/HTMLInputElement.h:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch): Check the type validity
+          for date, datetime, datetime-local, month, time and week with
+          HTMLInputElemtn::formStringToISODateTime()
+
+2009-11-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix REGRESSION (r47022): Performance of DocumentFragment.appendChild is 1000x slower sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=31237
+        
+        Also speeds up Dromaeo DOM Core tests by 1.31x.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren): Change marking algorithm to avoid O(N^2) behavior. The subtree
+        mark bit was no longer effective; instead I changed things so only a node that has no ancestors
+        with wrappers would do marking; there should be only one in the typical case (the root of the
+        detached subtree).
+        * dom/Node.cpp:
+        (WebCore::Node::Node): Remove now useless m_inSubtreeMark bit and related functions.
+        * dom/Node.h: ditto
+
+2009-11-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Get rid of the redundant strokeType and fillType data members on
+        a GraphicsContext as well as the FillOrStrokeType enum. Use
+        null pointers instead.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokeColor): Null out the pattern
+        and gradient.
+        (WebCore::GraphicsContext::setFillColor): Ditto.
+        (WebCore::GraphicsContext::setStrokePattern): Null out the graident.
+        (WebCore::GraphicsContext::setFillPattern): Ditto.
+        (WebCore::GraphicsContext::setStrokeGradient): Null out the pattern.
+        (WebCore::GraphicsContext::setFillGradient): Ditto.
+
+        * platform/graphics/GraphicsContextPrivate.h: Remove all that stuff.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill): Use null checks on fillPattern and
+        fillGraident instead of a switch statement.
+        (WebCore::setPlatformStroke): Ditto.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::applyStrokePattern): Removed unneeded get.
+        (WebCore::GraphicsContext::applyFillPattern): Ditto.
+        (WebCore::calculateDrawingMode): Use fillPattern and strokePattern
+        to see if there is a pattern instead of fillType and strokeType.
+        (WebCore::GraphicsContext::drawPath): Use fillGradient, strokeGradient,
+        fillPattern, and strokePattern instead of fillType and strokeType.
+        (WebCore::GraphicsContext::fillPath): Added FIXME about color space that
+        is used in the pattern and gradient case probably erroneously. Moved
+        gradient code inside an if statement. Streamlined pattern code and
+        use an if statement. No switch any more.
+        (WebCore::GraphicsContext::strokePath): Ditto.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+        (WebCore::GraphicsContext::strokeRect): Ditto.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath): Use null checks on fillPattern and
+        fillGraident instead of a switch statement.
+        (WebCore::GraphicsContext::strokePath): Ditto.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::fillPath): Removed unneeded check of fillType.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Support for step attribute and ValidityStae.stepMismatch for
+        type=number and range.  stepMismatch will be false if the
+        difference between the current value and a multiple of the step
+        value is very small.
+
+        Change the behavior of RenderSlider so that it always has a value
+        rounded to the step attribute value.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31331
+
+        Tests: fast/forms/ValidityState-stepMismatch-number.html
+               fast/forms/ValidityState-stepMismatch-range.html
+               fast/forms/ValidityState-stepMismatch-unsupported.html
+               fast/forms/input-step.html
+
+        * html/HTMLAttributeNames.in: Add "step".
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::stepMismatch):
+        (WebCore::HTMLInputElement::getStepParameters):
+        (WebCore::HTMLInputElement::getAllowedValueStep):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl: Add "step".
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::stepMismatch): Forward to HTMLInputElement::stepMismatch().
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::clampValue):
+
+2009-11-18  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Need to ASSERT(isMainThread()) in ThreadShared methods.
+        https://bugs.webkit.org/show_bug.cgi?id=31637
+
+        Added ASSERT(IsMainThread()) to all following methods:
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::TreeShared):
+        (WebCore::TreeShared::~TreeShared):
+        (WebCore::TreeShared::ref):
+        (WebCore::TreeShared::deref):
+        (WebCore::TreeShared::setParent):
+        (WebCore::TreeShared::parent):
+
+2009-11-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Eric Seidel.
+
+        Add plugin visibility manual test
+
+        https://bugs.webkit.org/show_bug.cgi?id=31542
+
+        * manual-tests/plugins/windowed.html:
+        * manual-tests/plugins/windowless.html:
+
+2009-11-18  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector - remember last script displayed in Scripts panel
+        https://bugs.webkit.org/show_bug.cgi?id=27552
+
+        Manual test added
+        
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.showScript):
+        (WebInspector.ScriptsPanel.prototype.showResource):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        (WebInspector.ScriptsPanel.prototype._goBack):
+        (WebInspector.ScriptsPanel.prototype._goForward):
+        * manual-tests/inspector/remember-last-script.html: Added.
+
+2009-11-18  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Win chromium is slow to draw transparent texts
+        https://bugs.webkit.org/show_bug.cgi?id=31258
+
+        Create bounded transparency layers instead of just clipping.
+
+        No new tests because this is just a performance improvement.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+
+2009-11-18  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Add support for displaying deleteButton.
+        https://bugs.webkit.org/show_bug.cgi?id=31560
+
+        Test: LayoutTests/editing/deleting/5408255.html
+
+        * WebCore.qrc:
+        * platform/graphics/qt/ImageQt.cpp:
+        (loadResourcePixmap):
+
+2009-11-18  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix Qt build without JavaScript debugger.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31575
+
+        * page/Console.idl:
+
+2009-11-18  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24971
+        And
+        <rdar://problem/7138265>
+
+        Fixes an issue where setting the height of a table row programmatically
+        (via JavaScript) causes the table to be improperly rendered because the
+        height of each row in the table is not recalculated with respect to the
+        CSS height property.
+
+        In particular, programmatically setting the height of some table row causes
+        the rows of that table to be rendered with a height equal to the minimum
+        height required by the cells in that row, regardless of any specified cell
+        heights. Instead, when RenderTableSection::recalcCells is called, the height
+        of each row should be set to the CSS height property just as we do in
+        RenderTableSection::addChild.
+
+        Test: fast/table/row-height-recalc2.html
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::setRowHeightToRowStyleHeightIfNotRelative): Added.
+        (WebCore::RenderTableSection::addChild): Moved code that set row height into
+        method WebCore::setRowHeightToRowStyleHeightIfNotRelative.
+        (WebCore::RenderTableSection::recalcCells): Modified to call
+        WebCore::setRowHeightToRowStyleHeightIfNotRelative.
+
+2009-11-18  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the part of platform directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31473
+
+        Inherits the following classes from FastAllocBase because these are
+        instantiated by 'new':
+
+        class  AnimationList         - instantiated at WebCore/rendering/style/StyleRareNonInheritedData.cpp:85
+        class  Color                 - instantiated at WebCore/rendering/RenderTheme.cpp:48
+        struct Length                - instantiated at WebCore/platform/Length.cpp:103
+        class  PlatformKeyboardEvent - instantiated at WebCore/dom/KeyboardEvent.cpp:63
+        class  ContextMenuItem       - instantiated at WebCore/platform/ContextMenu.cpp:70
+        class  DeprecatedPtrList     - instantiated at WebCore/rendering/RenderBlock.cpp:2284
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and no need to be copyable:
+
+        class  GraphicsContextPrivate - instantiated at WebCore/platform/graphics/GraphicsContext.cpp:78
+        class  FontCache              - instantiated at WebCore/platform/graphics/qt/FontCacheQt.cpp:43
+        struct MediaPlayerFactory     - instantiated at WebCore/platform/graphics/MediaPlayer.cpp:163
+        class  DeprecatedPtrListNode  - instantiated at WebCore/platform/DeprecatedPtrListImpl.cpp:53
+
+        * platform/ContextMenuItem.h:
+        * platform/DeprecatedPtrList.h:
+        * platform/DeprecatedPtrListImpl.cpp:
+        * platform/Length.h:
+        * platform/PlatformKeyboardEvent.h:
+        * platform/animation/AnimationList.h:
+        * platform/graphics/Color.h:
+        * platform/graphics/FontCache.h:
+        * platform/graphics/GraphicsContextPrivate.h:
+        * platform/graphics/MediaPlayer.cpp:
+
+2009-11-18  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31186
+
+        Renames RenderTextControl::m_edited and RenderTextControl::m_userEdited to
+        m_wasChangedSinceLastChangeEvent and m_lastChangeWasUserEdit, respectively.
+        These are more descriptive names so as to clear an ambiguity surrounding
+        their usage. Also, renames associated setters and getters so that they
+        coincide with the renamed fields.
+
+        No functionality was changed. So, no tests were included.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setLastChangeWasUserEdit): Formerly named setUserEdited.
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::wasChangedSinceLastChangeEvent): Formerly named isEdited.
+        (WebCore::RenderTextControl::setChangedSinceLastChangeEvent): Formerly named setEdited.
+        (WebCore::RenderTextControl::lastChangeWasUserEdit): Formerly named setUserEdited.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-18  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove V8CanvasPixelArrayCustom.cpp because it is no longer used by V8.
+        https://bugs.webkit.org/show_bug.cgi?id=31499
+
+        No new tests, just a build cleanup.
+
+        * WebCore.gypi:
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp: Removed.
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-11-18  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Enable wx plugin support using the Windows implementation as a base.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31636
+
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::GraphicsContext::inTransparencyLayer):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::getWindowsContext):
+        (WebCore::GraphicsContext::releaseWindowsContext):
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::unloadModule):
+        (WebCore::listDirectory):
+        * plugins/PluginDatabase.cpp:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::snapshot):
+        * wscript:
+
+2009-11-18  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] Add shared timer and sound utilities to platform/android
+        https://bugs.webkit.org/show_bug.cgi?id=31584
+
+        No new tests required, this is platform specific code.
+
+        * platform/android/SharedTimerAndroid.cpp: Added.
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
+        * platform/android/SoundAndroid.cpp: Added.
+        (WebCore::systemBeep):
+
+2009-11-18  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix profile tree nodes loss after focus / restore actions.
+
+        Focusing on a node is currently implemented via nodes reattaching
+        with some caching involved. It seems that not all code was updated
+        to handle this scenario correctly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31553
+
+        * inspector/front-end/BottomUpProfileDataGridTree.js:
+        (WebInspector.BottomUpProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._restore):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._sharedPopulate):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._willHaveChildren):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.insertChild):
+        (WebInspector.DataGridNode.prototype._detach):
+        (WebInspector.DataGridNode.prototype.savePosition):
+        (WebInspector.DataGridNode.prototype.restorePosition):
+        * inspector/front-end/TopDownProfileDataGridTree.js:
+        (WebInspector.TopDownProfileDataGridTree.prototype.focus):
+        (WebInspector.TopDownProfileDataGridTree.prototype.restore):
+
+2009-11-18  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QWebPageClient.h needs in some cases QCursor, but it does not
+        include it 
+        https://bugs.webkit.org/show_bug.cgi?id=31527
+
+        No new tests as this is just a coding style fix that affects the 
+        build of some not yet submitted patches (i.e. for bug 30173).
+
+        * platform/qt/QWebPageClient.h:
+
+2009-11-18  Nicolas Roard   <nicolas@roard.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        InspectorTimelineAgent.h should be guarded by ENABLE(INSPECTOR)
+        https://bugs.webkit.org/show_bug.cgi?id=31504
+
+        * inspector/InspectorTimelineAgent.h:Added the guard.
+
+2009-11-18  Jens Alfke  <snej@chromium.org>
+
+        Build fix to my previous checkin, for Windows Chromium
+
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::PropertySynchronizer::synchronize): Fix implicit-conversion error on AtomicString.
+
+2009-11-18  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Directly Access <head> Instead of Searching for It
+        https://bugs.webkit.org/show_bug.cgi?id=31641
+        
+        Changed old access of the head element (document.getElementsByTagName)
+        to just use the document.head accessor.
+
+        * inspector/front-end/FontView.js:
+        (WebInspector.FontView):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.addStyleSelector):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.js:
+        (windowLoaded):
+
+2009-11-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix two Geolocation assertions.
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::requestGeolocationPermissionForFrame): No need to use PageGroupLoadDeferrer since this
+        is not called from JS. 
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::Watchers::set): The PassRefPtr was getting nulled out, so we need to put it in
+        a RefPtr first.
+
+2009-11-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Case sensitive file system build fix.
+
+        * platform/network/Credential.h: It's not WTF, just wtf.
+
+2009-11-18  Aaron Golden  <agolden@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add support for certificates to WebCore::Credential so we can convert between NSURLCredential
+        objects and WebCore::Credential objects without losing certificate information.
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::Credential):  Adding a constructor that takes an identity argument and a certificate chain argument
+        (WebCore::Credential::isEmpty):  Modifying isEmpty to support certificate based credentials (which don't have a username or password)
+        (WebCore::Credential::identity): Accessor for the m_identity property
+        (WebCore::Credential::certificates): Accessor for the m_certificates property
+        (WebCore::Credential::type):  Accessor for the m_type property
+        (WebCore::operator==):  Modifying == to compare the identity and certificate chains of certificate based credentials.
+        * platform/network/Credential.h:  Adding new fields to WebCore::Credential to support certificate based credentials.
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac):  Modifying the mac() conversion method to correctly convert certificate based WebCore::Credential objects.
+        (WebCore::core):  Modifying the core() conversion method to correctly convert certificate based NSURLCredential objects.
+
+2009-11-18  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Reverting r50919 that has introduced a non-thread-safe refcounting in ScriptExecutionContext::postTaskToMainThread.
+        https://bugs.webkit.org/show_bug.cgi?id=31615
+
+        * dom/Document.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::ScriptExecutionContextTaskTimer::fired):
+        (WebCore::PerformTaskContext::PerformTaskContext):
+        (WebCore::performTask):
+        (WebCore::Document::postTask):
+        * dom/ScriptExecutionContext.cpp:
+        * dom/ScriptExecutionContext.h:
+
+2009-11-18  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Eliminate unnecessary String-->AtomicString conversions from generated V8 bindings,
+        by causing the right v8-to-WebCore conversion function to be called for every parameter.
+        This no longer requires any IDL metadata, so I've removed the [HintAtomic] annotations.
+        To enforce correctness, I added a mode that disables implicit
+        String-->AtomicString conversions while compiling the generated bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31168
+
+        * bindings/scripts/CodeGeneratorV8.pm:  Generate usage of V8Parameter class.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:  Enable NO_IMPLICIT_ATOMICSTRING.
+        * bindings/v8/V8Binding.h:  Add V8Parameter class.
+        * css/WebKitCSSKeyframesRule.h:  Make AtomicString conversions explicit.
+        * dom/Document.idl:  Remove obsolete [HintAtomic] annotation.
+        * platform/text/AtomicString.h:  Added NO_IMPLICIT_ATOMICSTRING option.
+        * svg/SVGAnimatedTemplate.h:  Change some return types to String to avoid implicit conversion.
+        * svg/SVGAnimatedProperty.h: Adapt to changed return types in SVGAnimatedTemplate.
+
+2009-11-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Move FillOrStrokeType out of public header.
+
+        * platform/graphics/GraphicsContext.h: Updated copyright date to cover
+        some years we published Apple changes, sorted forward declarations,
+        removed FillOrStrokeType enum.
+        * platform/graphics/GraphicsContextPrivate.h: Updated copyright date
+        to cover some years we published Apple changes, sorted includes,
+        moved FillOrStrokeType enum here.
+
+2009-11-18  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Add Settings for WebKitShowDebugBorders and WebKitShowRepaintCounter
+        https://bugs.webkit.org/show_bug.cgi?id=31601
+
+        These are used to debug accelerated compositing layers. I removed
+        the platform specific code from GraphicsLayerCA.mm and added calls
+        to GraphicsLayerClient to get it from the higher levels. The values 
+        now get cached in RenderLayerCompositing and are queried from there
+        by RenderLayerBacking (which implements the GraphicsLayerClient interface).
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setShowDebugBorders):
+        (WebCore::Settings::setShowRepaintCounter):
+        * page/Settings.h:
+        (WebCore::Settings::showDebugBorders):
+        (WebCore::Settings::showRepaintCounter):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::showDebugBorders):
+        (WebCore::GraphicsLayer::showRepaintCounter):
+        * platform/graphics/GraphicsLayerClient.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::showDebugBorders):
+        (WebCore::RenderLayerBacking::showRepaintCounter):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingFlags):
+        * rendering/RenderLayerCompositor.h:
+        (WebCore::RenderLayerCompositor::showDebugBorders):
+        (WebCore::RenderLayerCompositor::showRepaintCounter):
+
+2009-11-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Get rid of metrics and properties sidebars'
+        flickering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31629
+
+        * inspector/front-end/MetricsSidebarPane.js:
+        * inspector/front-end/PropertiesSidebarPane.js:
+
+2009-11-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes <http://webkit.org/b/31606>.
+        Web Inspector: Enter/Return key should enter edit mode for Editable Fields.
+        
+        This implements Enter starting editing mode in an editable DataGrid. If the
+        DataGrid is editable and the user hits return, startEditing the first child
+        of the selected node. Also refactored some editing functions to take an 
+        event target instead of the event itself, because the functions only needed
+        the target. Lastly, added had return in editing mode stop propogation, because
+        when enter was hit to confirm text, it would propagate back to the datagrid
+        and try to start editing again.
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype._ondblclick):
+        (WebInspector.DataGrid.prototype._startEditing):
+        (WebInspector.DataGrid.prototype.handleKeyEvent):
+        (WebInspector.DataGrid.prototype.dataGridNodeFromEvent):
+        (WebInspector.DataGrid.prototype._mouseDownInDataTable):
+        (WebInspector.DataGrid.prototype._clickInDataTable):
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.element.handleKeyEvent):
+        (WebInspector.startEditing):
+
+2009-11-18  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        HTMLAnchorElement is inconsistent with its internal handling of the value returned for the href attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=31593
+
+        Test: fast/dom/HTMLAnchorElement/set-href-attribute-whitespace.html
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::href): Add call to deprecatedParseURL.
+
+2009-11-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Touch InspectorController so that frontend
+        JS files are deployed on Windows.
+
+        * inspector/InspectorController.cpp:
+
+2009-11-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: clone timeline records array instead of
+        copying reference on invalidate all.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31596
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.invalidateAllItems):
+
+2009-11-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Elements don't drop out of compositing layers when animation ends
+        https://bugs.webkit.org/show_bug.cgi?id=31613
+        <rdar://problem/7402913>
+
+        Avoid setting the mustOverlapCompositedLayers flag on RenderLayers which
+        are compositing anyway for other reasons. Doing so can cause those layers
+        to stay in compositing mode even after animations finish, because needsToBeComposited()
+        continues to return true.
+        
+        No new tests because it's not possible to determine which elements are in
+        compositing layers from DRT output.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-11-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Mac Plugins: Remove null timer
+        
+        A null timer was used to send mouse move events. Instead, we now use
+        move events to send nullEvent. This brings down CPU usage by 20-30%.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31624
+
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-11-18  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] WebKit crashes when loading certain SVG images
+
+        Check if the familly exist before creating the PlatformData from it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29443
+
+        Test: svg/text/text-font-invalid.html
+
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::fontDataAt):
+
+2009-11-17  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix crash in Chromium/Mac where dropdowns weren't dismissed correctly
+        after navigation.
+        https://bugs.webkit.org/show_bug.cgi?id=31609
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::showExternal): Set parent for external
+        dropdowns, so that |PopupListBox::hidePopup()| can successfully notify
+        its parent's client.
+
+2009-11-17  Hayato Ito  <hayato@google.com>
+
+        Reviewed by Darin Adler.
+
+        Avoid infinite mutual recursion when deeply nested tags are loaded
+        https://bugs.webkit.org/show_bug.cgi?id=30651
+
+        Test: fast/parser/block-nesting-cap-table.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::parseToken):
+        (WebCore::tagPriorityOfNode):
+        (WebCore::HTMLParser::limitBlockDepth):
+        (WebCore::HTMLParser::insertNodeAfterLimitBlockDepth):
+        (WebCore::HTMLParser::insertNode):
+        * html/HTMLParser.h:
+
+2009-11-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        Final clean-ups for minor coding standard violations.
+        https://bugs.webkit.org/show_bug.cgi?id=26102.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+
+2009-11-17  Johnny Ding  <jnd@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        In all valid script tags for JavaScript, the event handler in <script...for> should not get executed.
+        https://bugs.webkit.org/show_bug.cgi?id=31567
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::shouldExecuteAsJavaScript):
+
+2009-11-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make DRT show web inspector for tests in inspector/ folder.
+        - Updated DRT to show/close inspector for all tests under /inspector
+        - Introduced LayoutTestController::setTimelineProfilingEnabled and
+          WebInspector::setTimelineProfilingEnabled beside setJavaScriptProfilingEnabled
+        - Removed reload on each inspector test
+        - Renamed fast/inspector to fast/inspector-support in order not to trigger
+        inspector for those.
+        - Reimplemented timeline tests in order to get rid of reload there.
+        - Moved tests that don't require harness into the fast group.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31472
+
+        * WebCore.Inspector.exp:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+
+2009-11-17  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] Android is missing the implementation of the GeolocationService iface.
+        https://bugs.webkit.org/show_bug.cgi?id=31554
+
+        No new tests required as this is platform specific code.
+
+        * platform/android/GeolocationServiceAndroid.cpp: Added.
+        (WebCore::GeolocationServiceAndroid::create):
+        (WebCore::GeolocationServiceAndroid::GeolocationServiceAndroid):
+        (WebCore::GeolocationServiceAndroid::startUpdating):
+        (WebCore::GeolocationServiceAndroid::stopUpdating):
+        (WebCore::GeolocationServiceAndroid::suspend):
+        (WebCore::GeolocationServiceAndroid::resume):
+        (WebCore::GeolocationServiceAndroid::newPositionAvailable):
+        (WebCore::GeolocationServiceAndroid::newErrorAvailable):
+        (WebCore::GeolocationServiceAndroid::timerFired):
+        (WebCore::GeolocationServiceAndroid::isPositionMovement):
+        (WebCore::GeolocationServiceAndroid::isPositionMoreAccurate):
+        (WebCore::GeolocationServiceAndroid::isPositionMoreTimely):
+        * platform/android/GeolocationServiceAndroid.h: Added.
+        (WebCore::GeolocationServiceAndroid::~GeolocationServiceAndroid):
+        (WebCore::GeolocationServiceAndroid::lastPosition):
+        (WebCore::GeolocationServiceAndroid::lastError):
+        * platform/android/GeolocationServiceBridge.cpp: Added.
+        (WebCore::):
+        (WebCore::GeolocationServiceBridge::GeolocationServiceBridge):
+        (WebCore::GeolocationServiceBridge::~GeolocationServiceBridge):
+        (WebCore::GeolocationServiceBridge::start):
+        (WebCore::GeolocationServiceBridge::stop):
+        (WebCore::GeolocationServiceBridge::setEnableGps):
+        (WebCore::GeolocationServiceBridge::newLocationAvailable):
+        (WebCore::GeolocationServiceBridge::newErrorAvailable):
+        (WebCore::GeolocationServiceBridge::toGeoposition):
+        (WebCore::GeolocationServiceBridge::startJavaImplementation):
+        (WebCore::GeolocationServiceBridge::stopJavaImplementation):
+        * platform/android/GeolocationServiceBridge.h: Added.
+
+2009-11-16  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewd build fix.
+
+        - Fix typo in WebCore.vcproj.
+        - Intlude limits.h for INT_MAX.
+        - Enclose with parenthesis to suspress warning.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::addDay):
+
+2009-11-16  Robin Dunn  <robin@alldunn.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Make sure wx scrollbar drawing code factors in transforms when switching backends,
+        fix calcs for scrollbar length, and tweak the Mac scrollbar tracking rects.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31570
+
+        * platform/wx/ScrollbarThemeWx.cpp:
+        (WebCore::ScrollbarThemeWx::minimumThumbLength):
+        (WebCore::ScrollbarThemeWx::splitTrack):
+        (WebCore::ScrollbarThemeWx::forwardButtonRect):
+        * platform/wx/ScrollbarThemeWx.h:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/scrollbar_render.h:
+        (calcThumbStartAndLength):
+        * platform/wx/wxcode/win/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-11-16  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Levin.
+
+        Introduce WebCore::ISODateTime class.
+        https://bugs.webkit.org/show_bug.cgi?id=31340
+
+        This class represents a value of date/time types of the HTML5 INPUT
+        element, and has some parsing methods for ISO 8601.
+
+        This change has no tests because the class is not used yet.
+
+        * GNUmakefile.am: Add ISODateTime.cpp and ISODateTime.h.
+        * WebCore.gypi: ditto.
+        * WebCore.pro: ditto.
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * WebCore.xcodeproj/project.pbxproj: ditto.
+        * WebCoreSources.bkl: ditto.
+        * html/ISODateTime.cpp: Added. Implementation of WebCore::ISODateTime class.
+        (WebCore::isLeapYear):
+        (WebCore::maxDayOfMonth):
+        (WebCore::dayOfWeek):
+        (WebCore::ISODateTime::maxWeekNumberInYear):
+        (WebCore::countDigits):
+        (WebCore::toInt):
+        (WebCore::ISODateTime::parseYear): Private helper for parseDate() and parseWeek().
+        (WebCore::ISODateTime::addDay): Private helper for parseTimeZone().
+        (WebCore::ISODateTime::addMinute): ditto.
+        (WebCore::ISODateTime::parseTimeZone): Private helper for parseDateTime().
+        (WebCore::ISODateTime::parseMonth): Parser for <input type=month>.
+        (WebCore::ISODateTime::parseDate): Parser for <input type=date>.
+        (WebCore::ISODateTime::parseWeek): Parser for <input type=week>.
+        (WebCore::ISODateTime::parseTime): Parser for <input type=time>.
+        (WebCore::ISODateTime::parseDateTimeLocal): Parser for <input type=datetime-local>.
+        (WebCore::ISODateTime::parseDateTime): Parser for <input type=datetime>.
+        * html/ISODateTime.h: Added.  Declare WebCore::ISODateTime class.
+        (WebCore::ISODateTime::ISODateTime):
+        (WebCore::ISODateTime::millisecond):
+        (WebCore::ISODateTime::second):
+        (WebCore::ISODateTime::minute):
+        (WebCore::ISODateTime::hour):
+        (WebCore::ISODateTime::monthDay):
+        (WebCore::ISODateTime::month):
+        (WebCore::ISODateTime::fullYear):
+        (WebCore::ISODateTime::week):
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Fix a typo in previous commit.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: #ifdef, not #if.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Fix a typo in previous commit.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Tiger build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Define CFN_EXPORT, as this macro was named
+        differently in Tiger CFNetwork.
+
+2009-11-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [KURLGoogle] setHostAndPort doesn't handle arguments without port correctly.
+
+        Fix a bug in the code that was dormant until http://trac.webkit.org/changeset/50784.
+
+        Covered by existing test: LayoutTests/fast/dom/HTMLAnchorElement/set-href-attribute-host.html
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::setHostAndPort): Added handling of arguments without port specified.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Jon Honeycutt.
+
+        A better Windows build fix
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::SocketStreamHandle::createStreams):
+        Use a macro that inserts __declspec(dllimport) when appropriate for CFNetwork imports.
+
+2009-11-16  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Rename protocolIsValid to isValidProtocol.
+        https://bugs.webkit.org/show_bug.cgi?id=31503
+
+        This name change was suggested in https://bugs.webkit.org/show_bug.cgi?id=29972#c19.
+
+        No new tests since no new functionality was introduced.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::setProtocol):
+        * platform/KURL.cpp:
+        (WebCore::isValidProtocol):
+        * platform/KURL.h:
+        * platform/KURLGoogle.cpp:
+        (WebCore::isValidProtocol):
+
+2009-11-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: aria-labelledby duplicates some of its WAI-ARIA label
+        https://bugs.webkit.org/show_bug.cgi?id=31565
+
+        Test: accessibility/aria-labelledby-overrides-label.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::hasTextAlternative):
+        (WebCore::AccessibilityRenderObject::exposesTitleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-11-16  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Handle the case of a null NPObject* in NPN_SetException in
+        the V8 bindings.  This allow out of process plugins calling
+        NPN_SetException to just send null instead of sending an
+        NPObject* that would be an address in a different 
+        process's memory space.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31561
+
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_SetException): Allow null NPObject* and just throw a general error.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::SocketStreamHandle::createStreams):
+        Disable CONNECT proxies on Windows until WebKitSupportLibrary includes support for those.
+
+2009-11-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] ASSERT failure while running DRT
+        https://bugs.webkit.org/show_bug.cgi?id=30978
+
+        Add needed Structure typeInfo flags to QtRuntimeObjectImpl and QtRuntimeMethod.
+        These flags are needed after r49649, where HasDefaultmark was changed to OverrideMarkChildren.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::createStructure):
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+
+2009-11-16  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the build.  Land a file that was missing from r51049.
+
+        * bindings/js/JSWebGLArrayHelper.h: Copied from WebCore/html/canvas/WebGLByteArray.idl.
+        (WebCore::setWebGLArrayFromArray):
+
+2009-11-16  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update API of WebGLArray and friends
+        https://bugs.webkit.org/show_bug.cgi?id=31175
+
+        * bindings/js/JSWebGLArrayCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSWebGLArrayHelper.h: Added.
+        (WebCore::setWebGLArrayFromArray):
+        * bindings/js/JSWebGLByteArrayCustom.cpp:
+        (WebCore::JSWebGLByteArray::set):
+        * bindings/js/JSWebGLFloatArrayCustom.cpp:
+        (WebCore::JSWebGLFloatArray::set):
+        * bindings/js/JSWebGLIntArrayCustom.cpp:
+        (WebCore::JSWebGLIntArray::set):
+        * bindings/js/JSWebGLShortArrayCustom.cpp:
+        (WebCore::JSWebGLShortArray::set):
+        * bindings/js/JSWebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedByteArray::set):
+        * bindings/js/JSWebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedIntArray::set):
+        * bindings/js/JSWebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedShortArray::set):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::constructWebGLArray):
+        (WebCore::getWebGLArrayElement):
+        (WebCore::setWebGLArrayFromArray):
+        (WebCore::setWebGLArray):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * html/canvas/WebGLArray.cpp:
+        (WebCore::WebGLArray::WebGLArray):
+        (WebCore::WebGLArray::~WebGLArray):
+        (WebCore::WebGLArray::setImpl):
+        * html/canvas/WebGLArray.h:
+        (WebCore::WebGLArray::isByteArray):
+        (WebCore::WebGLArray::isUnsignedByteArray):
+        (WebCore::WebGLArray::isShortArray):
+        (WebCore::WebGLArray::isUnsignedShortArray):
+        (WebCore::WebGLArray::isIntArray):
+        (WebCore::WebGLArray::isUnsignedIntArray):
+        (WebCore::WebGLArray::isFloatArray):
+        (WebCore::WebGLArray::buffer):
+        (WebCore::WebGLArray::baseAddress):
+        (WebCore::WebGLArray::byteOffset):
+        * html/canvas/WebGLArray.idl:
+        * html/canvas/WebGLArrayBuffer.cpp:
+        (WebCore::WebGLArrayBuffer::create):
+        (WebCore::WebGLArrayBuffer::WebGLArrayBuffer):
+        (WebCore::WebGLArrayBuffer::data):
+        (WebCore::WebGLArrayBuffer::byteLength):
+        (WebCore::WebGLArrayBuffer::~WebGLArrayBuffer):
+        * html/canvas/WebGLArrayBuffer.h:
+        * html/canvas/WebGLByteArray.cpp:
+        (WebCore::WebGLByteArray::create):
+        (WebCore::WebGLByteArray::byteLength):
+        (WebCore::WebGLByteArray::slice):
+        (WebCore::WebGLByteArray::set):
+        * html/canvas/WebGLByteArray.h:
+        (WebCore::WebGLByteArray::isByteArray):
+        (WebCore::WebGLByteArray::data):
+        (WebCore::WebGLByteArray::set):
+        (WebCore::WebGLByteArray::get):
+        (WebCore::WebGLByteArray::item):
+        * html/canvas/WebGLByteArray.idl:
+        * html/canvas/WebGLFloatArray.cpp:
+        (WebCore::WebGLFloatArray::create):
+        (WebCore::WebGLFloatArray::WebGLFloatArray):
+        (WebCore::WebGLFloatArray::length):
+        (WebCore::WebGLFloatArray::byteLength):
+        (WebCore::WebGLFloatArray::slice):
+        (WebCore::WebGLFloatArray::set):
+        * html/canvas/WebGLFloatArray.h:
+        (WebCore::WebGLFloatArray::isFloatArray):
+        (WebCore::WebGLFloatArray::data):
+        (WebCore::WebGLFloatArray::set):
+        (WebCore::WebGLFloatArray::get):
+        (WebCore::WebGLFloatArray::item):
+        * html/canvas/WebGLFloatArray.idl:
+        * html/canvas/WebGLIntArray.cpp:
+        (WebCore::WebGLIntArray::create):
+        (WebCore::WebGLIntArray::WebGLIntArray):
+        (WebCore::WebGLIntArray::length):
+        (WebCore::WebGLIntArray::byteLength):
+        (WebCore::WebGLIntArray::slice):
+        (WebCore::WebGLIntArray::set):
+        * html/canvas/WebGLIntArray.h:
+        (WebCore::WebGLIntArray::isIntArray):
+        (WebCore::WebGLIntArray::data):
+        (WebCore::WebGLIntArray::set):
+        (WebCore::WebGLIntArray::get):
+        (WebCore::WebGLIntArray::item):
+        * html/canvas/WebGLIntArray.idl:
+        * html/canvas/WebGLShortArray.cpp:
+        (WebCore::WebGLShortArray::create):
+        (WebCore::WebGLShortArray::WebGLShortArray):
+        (WebCore::WebGLShortArray::length):
+        (WebCore::WebGLShortArray::byteLength):
+        (WebCore::WebGLShortArray::slice):
+        (WebCore::WebGLShortArray::set):
+        * html/canvas/WebGLShortArray.h:
+        (WebCore::WebGLShortArray::isShortArray):
+        (WebCore::WebGLShortArray::data):
+        (WebCore::WebGLShortArray::set):
+        (WebCore::WebGLShortArray::get):
+        (WebCore::WebGLShortArray::item):
+        * html/canvas/WebGLShortArray.idl:
+        * html/canvas/WebGLUnsignedByteArray.cpp:
+        (WebCore::WebGLUnsignedByteArray::create):
+        (WebCore::WebGLUnsignedByteArray::WebGLUnsignedByteArray):
+        (WebCore::WebGLUnsignedByteArray::length):
+        (WebCore::WebGLUnsignedByteArray::byteLength):
+        (WebCore::WebGLUnsignedByteArray::slice):
+        (WebCore::WebGLUnsignedByteArray::set):
+        * html/canvas/WebGLUnsignedByteArray.h:
+        (WebCore::WebGLUnsignedByteArray::isUnsignedByteArray):
+        (WebCore::WebGLUnsignedByteArray::data):
+        (WebCore::WebGLUnsignedByteArray::set):
+        (WebCore::WebGLUnsignedByteArray::get):
+        (WebCore::WebGLUnsignedByteArray::item):
+        * html/canvas/WebGLUnsignedByteArray.idl:
+        * html/canvas/WebGLUnsignedIntArray.cpp:
+        (WebCore::WebGLUnsignedIntArray::create):
+        (WebCore::WebGLUnsignedIntArray::WebGLUnsignedIntArray):
+        (WebCore::WebGLUnsignedIntArray::length):
+        (WebCore::WebGLUnsignedIntArray::byteLength):
+        (WebCore::WebGLUnsignedIntArray::slice):
+        (WebCore::WebGLUnsignedIntArray::set):
+        * html/canvas/WebGLUnsignedIntArray.h:
+        (WebCore::WebGLUnsignedIntArray::isUnsignedIntArray):
+        (WebCore::WebGLUnsignedIntArray::data):
+        (WebCore::WebGLUnsignedIntArray::set):
+        (WebCore::WebGLUnsignedIntArray::get):
+        (WebCore::WebGLUnsignedIntArray::item):
+        * html/canvas/WebGLUnsignedIntArray.idl:
+        * html/canvas/WebGLUnsignedShortArray.cpp:
+        (WebCore::WebGLUnsignedShortArray::create):
+        (WebCore::WebGLUnsignedShortArray::WebGLUnsignedShortArray):
+        (WebCore::WebGLUnsignedShortArray::length):
+        (WebCore::WebGLUnsignedShortArray::byteLength):
+        (WebCore::WebGLUnsignedShortArray::slice):
+        (WebCore::WebGLUnsignedShortArray::set):
+        * html/canvas/WebGLUnsignedShortArray.h:
+        (WebCore::WebGLUnsignedShortArray::isUnsignedShortArray):
+        (WebCore::WebGLUnsignedShortArray::data):
+        (WebCore::WebGLUnsignedShortArray::set):
+        (WebCore::WebGLUnsignedShortArray::get):
+        (WebCore::WebGLUnsignedShortArray::item):
+        * html/canvas/WebGLUnsignedShortArray.idl:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Declare constants as extern "C".
+
+2009-11-15  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Enable support for webkit-box-shadow in Cairo builds.
+        https://bugs.webkit.org/show_bug.cgi?id=26102.
+
+        Covered by existing fast/box-shadow tests.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:  Add
+          support for fillRect shadows.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Don't try to include a file that's not
+        in WebKitSupportLibrary.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31494
+        Add unauthenticated proxy support to SocketStreamHandleCFNet
+
+        Cannot be tested in DRT.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::chooseProxy): Fetch proxy information from OS.
+        (WebCore::SocketStreamHandle::createStreams): Apply it to the newly created streams.
+
+2009-11-14  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Broken back/forward after using ErrorPageExtension to set error page
+        https://bugs.webkit.org/show_bug.cgi?id=30573
+
+        Make FrameLoader::checkLoadCompleteForThisFrame method
+        to check for any working DocumentLoader instance (through
+        activeDocumentLoader()) instead of only checking for
+        'm_provisionalDocumentLoader' in order to decide to if
+        it is going to reset of not the back and forward history.
+        after an error page has been loaded.
+
+        Test: LayoutTests/fast/history/back-forward-reset-after-error-handling.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+
+2009-11-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Need to implement ARIA role="directory"
+        https://bugs.webkit.org/show_bug.cgi?id=31516
+
+        Test: platform/mac/accessibility/aria-directory.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::isOrderedList):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::createARIARoleMap):
+
+2009-11-15  Dave Tapuska  <dtapuska@rim.com>
+
+        Reviewed by George Staikos.
+        
+        Compare UChars single unit at a time as opposed to the uint32_t
+        approach as casting to unaligned addresses may cause a bus failure
+        on ARMv5 and below. This change replicates the same defines that
+        exists in AtomicString.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=31475
+        
+        * platform/text/StringHash.h:
+        (WebCore::StringHash::equal):
+
+2009-11-15  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Wrap some SVG code in V8DOMWrapper with an ENABLE(SVG) test.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31490
+
+        * bindings/v8/V8DOMWrapper.cpp:
+
+2009-11-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Haiku] Build fix. The FileChooser constructor doesn't need to be redefined.
+
+        * platform/haiku/FileChooserHaiku.cpp:
+
+2009-11-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Haiku] Build fix. ColorSpace name had a wrong CamelCase.
+
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+
+2009-11-15  Daniel Bates  <dbates@webkit.org>
+
+        No review, rolling out r50999.
+        http://trac.webkit.org/changeset/50999
+
+        Need to fix some issues in the Windows build. Missed some places where
+        RenderTextControl::isEdited is called.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setUserEdited):
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::isEdited):
+        (WebCore::RenderTextControl::setEdited):
+        (WebCore::RenderTextControl::isUserEdited):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-15  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31186
+
+        Renames RenderTextControl::m_edited and RenderTextControl::m_userEdited to
+        m_wasChangedSinceLastChangeEvent and m_lastChangeWasUserEdit, respectively.
+        These are more descriptive names so as to clear an ambiguity surrounding
+        their usage. Also, renames associated setters and getters so that they
+        coincide with the renamed fields.
+
+        No functionality was changed. So, no tests were included.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setLastChangeWasUserEdit): Formerly named setUserEdited.
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::wasChangedSinceLastChangeEvent): Formerly named isEdited.
+        (WebCore::RenderTextControl::setChangedSinceLastChangeEvent): Formerly named setEdited.
+        (WebCore::RenderTextControl::lastChangeWasUserEdit): Formerly named setUserEdited.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-14  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6946165> Would like to be able to specify the number of visible lines when using -webkit-line-clamp
+
+        Test: fast/overflow/line-clamp.html
+
+        * css/CSSComputedStyleDeclaration.cpp: (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Updated to handle different types of values.
+        * css/CSSParser.cpp: (WebCore::CSSParser::parseValue): ditto.
+        * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::applyProperty): ditto.
+
+        * rendering/RenderFlexibleBox.cpp: (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        Use the line count value if available.  Otherwise, convert the percentage to the line count, as we did before.  Also,
+        if there is anchor as the last child box, still allow adding the ellipsis.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively): Call isNone on the LineClampValue to see if the line-clamp property has been set.
+        (WebCore::RenderLayer::scrollRectToVisible): ditto.
+
+        * WebCore.xcodeproj/project.pbxproj: Added LineClampValue.h
+        * rendering/style/LineClampValue.h: Added.
+        (WebCore::LineClampValue::LineClampValue):
+        (WebCore::LineClampValue::value):
+        (WebCore::LineClampValue::isPercentage):
+        (WebCore::LineClampValue::isNone):
+        (WebCore::LineClampValue::operator==):
+        (WebCore::LineClampValue::operator!=):
+        * rendering/style/RenderStyleConstants.h: (WebCore::): Define ELineClampType enum for percentage or line count.
+
+        * rendering/style/RenderStyle.h: Use LineClampValue.
+        (WebCore::InheritedFlags::lineClamp):
+        (WebCore::InheritedFlags::setLineClamp):
+        (WebCore::InheritedFlags::initialLineClamp):
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2009-11-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7287487> 
+        Do not use QuickTime version to detect media controller theme
+
+        * WebCore.base.exp: Export wkMediaControllerThemeAvailable
+        * platform/mac/WebCoreSystemInterface.h: Ditto.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme): Use wkMediaControllerThemeAvailable instead of the
+        QuickTime version to see if it is possible to use MediaControllerThemeQuickTime.
+
+2009-11-14  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        - Recognizes date/datetime/datetime-local/month/time/week types of INPUT element.
+          They have no dedicated UI and no type validation for now.
+        - Clean up setInputType() and formControlType() of HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=29004
+
+        Test: fast/forms/input-type-change3.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueMissing):
+        (WebCore::HTMLInputElement::patternMismatch):
+        (WebCore::HTMLInputElement::tooLong):
+        (WebCore::createTypeMap):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::createFormControlTypes):
+        (WebCore::HTMLInputElement::formControlType):
+        (WebCore::HTMLInputElement::saveFormControlState):
+        (WebCore::HTMLInputElement::restoreFormControlState):
+        (WebCore::HTMLInputElement::accessKeyAction):
+        (WebCore::HTMLInputElement::rendererIsNeeded):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::appendFormData):
+        (WebCore::HTMLInputElement::isTextField):
+        (WebCore::HTMLInputElement::valueWithDefault):
+        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::isRequiredFormControl):
+        (WebCore::HTMLInputElement::dataList):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::):
+
+2009-11-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: checkbox does not determine its label from text content
+        https://bugs.webkit.org/show_bug.cgi?id=31456
+
+        Test: accessibility/aria-checkbox-text.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::title):
+
+2009-11-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Fix build to catch up with http://trac.webkit.org/changeset/50973.
+        This is just enough changes to unbreak the port.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::initContextIfNeeded):
+        * loader/FrameLoaderClient.h:
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix for Chromium build.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::dispatchDidClearWindowObjectInWorld):
+        Provide an empty implementation of this method because I don't know
+        what it is supposed to do on Chromium.
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix for Chromium build.
+
+        * loader/FrameLoader.h: Make dispatchDidClearWindowObjectsInAllWorlds()
+        public, as Chromium's V8Proxy calls it.
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix to Chromium build.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds): 
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix for Chromium build.
+
+        * platform/text/TextBoundaries.cpp: Use longer path to refer to Unicode.h.
+
+2009-11-13  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed partial build fix for Chromium.  Should fix failure #4.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::initContextIfNeeded):
+
+2009-11-13  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed partial build fix for Chromium.
+
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::getAllWorlds):
+
+2009-11-13  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix Windows and Chromium builds after http://trac.webkit.org/changeset/50977.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        * WebCore.gypi: Rename TextBoundariesICU -> TextBoundaries
+        * WebCore.vcproj/WebCore.vcproj: Rename TextBoundariesICU -> TextBoundaries
+
+2009-11-12  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        LocalStorage quota should include key sizes in its count
+        https://bugs.webkit.org/show_bug.cgi?id=31451
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::setItem):
+            Count keys in the quota when adding a new item.
+        (WebCore::StorageMap::removeItem):
+            Remove the key's length from the quota if we're removing the item.
+        (WebCore::StorageMap::importItem):
+            Assume that we're adding things for the first time.
+            Count keys in the quota.
+
+2009-11-13  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        Moving TextBoundariesICU.cpp to TextBoundaries.cpp
+        by removing the direct ICU dependency and replacing it
+        with WTF functions and WebCore's own TextBreakIterator
+        abstractions.
+
+        * GNUmakefile.am:
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        * platform/text/TextBoundaries.cpp: Added.
+        (WebCore::findNextWordFromIndex):
+        (WebCore::findWordBoundary):
+        * platform/text/TextBoundariesICU.cpp: Removed.
+        * platform/text/TextBreakIterator.h:
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::textBreakLast):
+        (WebCore::textBreakPrevious):
+
+2009-11-13  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        WebCore::externalRepresentation should update layout before getting render object
+        https://bugs.webkit.org/show_bug.cgi?id=31459
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::externalRepresentation):
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Tell FrameLoaderClient when window objects in isolated worlds are
+        cleared
+
+        Fixes <http://webkit.org/b/31124> Tell the WebFrameLoadDelegate when
+        window objects in isolated worlds are cleared
+
+        Test: http/tests/security/isolatedWorld/didClearWindowObject.html
+
+        Reviewed by Dave Hyatt.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::WebCoreJSClientData::getAllWorlds): Added. Copies all the
+        worlds in m_worldSet to the passed-in Vector.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds): Added. Calls through to
+        WebCoreJSClientData.
+        (WebCore::ScriptController::initScript): Changed to call
+        FrameLoader::dispatchDidClearWindowObjectInWorld.
+
+        * bindings/js/ScriptController.h: Added getAllWorlds.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidClearWindowObjectInWorld):
+        Updated for FrameLoaderClient change.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::receivedFirstData):
+        (WebCore::FrameLoader::begin):
+        Changed to call dispatchDidClearWindowObjectsInAllWorlds.
+
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectsInAllWorlds):
+        Added. Retrieves all the worlds, then calls through to
+        dispatchDidClearWindowObjectInWorld for each one.
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld): Replaces
+        dispatchWindowObjectAvailable. Calls up to the client, then, if the
+        world is the mainThreadNormalWorld(), tells the Inspector about it,
+        too.
+
+        * loader/FrameLoader.h: Replaced dispatchWindowObjectAvailable with
+        dispatchDidClearWindowObjectInWorld. Added
+        dispatchDidClearWindowObjectsInAllWorlds.
+
+        * loader/FrameLoaderClient.h: Replaced windowObjectCleared with
+        dispatchDidClearWindowObjectForWorld.
+
+2009-11-13  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix SVG context assignment for pod types.
+        https://bugs.webkit.org/show_bug.cgi?id=31497
+
+        I broke this in r50958.
+
+        Tested by svg/custom/viewport-update2.svg.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-11-13  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Bring the platform/android files inline with Android 2.0
+        https://bugs.webkit.org/show_bug.cgi?id=31423
+
+        No new tests required: these are all Android-specific files.
+
+        * platform/android/ClipboardAndroid.cpp:
+        (WebCore::ClipboardAndroid::files):
+        * platform/android/ClipboardAndroid.h:
+        * platform/android/FileChooserAndroid.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+        (WebCore::fileButtonChooseFileLabel):
+        * platform/android/KeyEventAndroid.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/android/LocalizedStringsAndroid.cpp:
+        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
+        (WebCore::contextMenuItemTagDownloadLinkToDisk):
+        (WebCore::contextMenuItemTagCopyLinkToClipboard):
+        (WebCore::contextMenuItemTagOpenImageInNewWindow):
+        (WebCore::contextMenuItemTagDownloadImageToDisk):
+        (WebCore::contextMenuItemTagCopyImageToClipboard):
+        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
+        (WebCore::contextMenuItemTagCopy):
+        (WebCore::contextMenuItemTagGoBack):
+        (WebCore::contextMenuItemTagGoForward):
+        (WebCore::contextMenuItemTagStop):
+        (WebCore::contextMenuItemTagReload):
+        (WebCore::contextMenuItemTagCut):
+        (WebCore::contextMenuItemTagPaste):
+        (WebCore::contextMenuItemTagNoGuessesFound):
+        (WebCore::contextMenuItemTagIgnoreSpelling):
+        (WebCore::contextMenuItemTagLearnSpelling):
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::contextMenuItemTagOpenLink):
+        (WebCore::contextMenuItemTagIgnoreGrammar):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckSpelling):
+        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagFontMenu):
+        (WebCore::contextMenuItemTagBold):
+        (WebCore::contextMenuItemTagItalic):
+        (WebCore::contextMenuItemTagUnderline):
+        (WebCore::contextMenuItemTagOutline):
+        (WebCore::contextMenuItemTagWritingDirectionMenu):
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+        (WebCore::contextMenuItemTagDefaultDirection):
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+        (WebCore::searchableIndexIntroduction):
+        (WebCore::resetButtonDefaultLabel):
+        (WebCore::submitButtonDefaultLabel):
+        (WebCore::inputElementAltText):
+        * platform/android/RenderThemeAndroid.cpp:
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeAndroid::baselinePosition):
+        (WebCore::RenderThemeAndroid::paintButton):
+        (WebCore::adjustMenuListStyleCommon):
+        (WebCore::RenderThemeAndroid::paintCombo):
+        * platform/android/ScreenAndroid.cpp:
+        * platform/android/ScrollViewAndroid.cpp:
+        (WebCore::ScrollView::platformOffscreenContentRectangle):
+        * platform/android/TemporaryLinkStubs.cpp:
+        (JSC::Bindings::dispatchJNICall):
+        * platform/android/WidgetAndroid.cpp:
+        (WebCore::Widget::setFrameRect):
+
+2009-11-13  Norbert Leser  <norbert.leser&nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Added macros for USERINCLUDE paths within symbian blocks
+        to guarantee inclusion of respective header files from local path
+        first (to avoid clashes with same names of header files in system include path).
+
+        * WebCore.pro:
+
+2009-11-13  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Implement composition events introduced in DOM Level 3.
+        This change adds a new IDL which defines the composition events, adds a class which
+        implements the composition events, and sends the composition events according to
+        the specification.
+        https://bugs.webkit.org/show_bug.cgi?id=26310
+
+        Test: fast/events/ime-composition-events-001.html
+
+        * DerivedSources.make: Added CompositionEvent so we can compile "CompositionEvent.idl".
+        * GNUmakefile.am: Added "CompositionEvent.{cpp,h,idl}".
+        * WebCore.gypi: ditto.
+        * WebCore.pro: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * WebCore.xcodeproj/project.pbxproj: Added "CompositionEvent.{cpp,h,idl}" and "JSCompositionEvent.{cpp,h}".
+        * WebCoreSources.bkl: Added "JSCompositionEvent.{cpp,h}".
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS): Call isCompositionEvent() to create the CompositionEvent wrapper.
+        * bindings/v8/DOMObjectsInclude.h: Added "JSCompositionEvent.h".
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Added "JSCompositionEvent.cpp".
+        * bindings/v8/V8DOMWrapper.cpp: Call isCompositionEvent() to identify an event as a CompositionEvent.
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        * bindings/v8/V8Index.cpp: Added "V8CompositionEvent.h".
+        * bindings/v8/V8Index.h: Added V8Index::COMPOSITIONEVENT.
+        * dom/CompositionEvent.cpp: Implements the CompositionEvent class.
+        (WebCore::CompositionEvent::CompositionEvent):
+        (WebCore::CompositionEvent::~CompositionEvent):
+        (WebCore::CompositionEvent::initCompositionEvent):
+        (WebCore::CompositionEvent::isCompositionEvent):
+        * dom/CompositionEvent.h: Declares the CompositionEvent class.
+        (WebCore::CompositionEvent::create):
+        (WebCore::CompositionEvent::data):
+        * dom/CompositionEvent.idl: Added the IDL of DOM CompositionEvent.
+        * dom/Event.cpp:
+        (WebCore::Event::isCompositionEvent): Added a method to identify an event is a CompositionEvent.
+        * dom/Event.h:
+        * dom/EventNames.h: Added composition{start,update,end} to eventNames.
+        * editing/Editor.cpp:
+        (WebCore::Editor::confirmComposition): Sent a CompositionEnd event.
+        (WebCore::Editor::setComposition): Sent a Composition{Start,Update,End} event.
+
+2009-11-13  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a link error in unofficial GCC 4.4 builds on Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=31477
+
+        * bindings/v8/V8Binding.cpp:  Add explicit instantiations of v8StringToWebCoreString template.
+
+2009-11-13  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix Debug build after http://trac.webkit.org/changeset/50960.
+
+        The CounterNode class does not support all methods necessary to efficiently update the counter tree as needed per CSS2.1
+        https://bugs.webkit.org/show_bug.cgi?id=31213
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+        * rendering/RenderCounter.cpp:
+        (WebCore::destroyCounterNodeChildren):
+
+2009-11-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [CAIRO] shadow support for Canvas and SVG
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+
+        We currently fill a path with solid color instead of filling
+        a clipping path. This causes problems on some composite operators,
+        since Cairo modifies the area outside the path.
+        This fixes the behavior of WebKitGtk on fast/canvas/canvas-composite-alpha.html
+
+        Thanks to Benjamin Otte for tracking the bug down.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill):
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's DatabaseTracker implementation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31440
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * storage/DatabaseTracker.h:
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase):
+        * storage/chromium/QuotaTracker.cpp:
+        (WebCore::QuotaTracker::updateDatabaseSize):
+        * storage/chromium/QuotaTracker.h:
+
+2009-11-13  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        The CounterNode class is missing some basic tree navigation methods common in other WebKit trees such as the rendering tree
+        https://bugs.webkit.org/show_bug.cgi?id=31213
+        Added tree navigation methods that permit full implementation of CSS2.1
+        counter feature without using recursion proportional to the counter
+        tree depth.
+        No new tests because I did not find any bug that is fixed by this
+        commit yet, this just reduces the size of the patch for 11031 and
+        helps respond to some concerns regarding that patch.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::CounterNode):
+
+        (WebCore::CounterNode::nextInPreOrderAfterChildren):
+        (WebCore::CounterNode::nextInPreOrder):
+        Added to support non-recursive tree traversal necessary for
+        efficient full implementation of CSS2.1 counters.
+
+        (WebCore::CounterNode::lastDescendant):
+        (WebCore::CounterNode::previousInPreOrder):
+        Moved this methods such that they occupy a place similar to that of
+        identically named methods on the render tree. This allows for their
+        broader use needed in full implementation of CSS2.1 counters.
+
+        (WebCore::CounterNode::resetRenderer):
+        (WebCore::CounterNode::resetRenderers):
+        (WebCore::CounterNode::recount):
+        (WebCore::CounterNode::insertAfter):
+        (WebCore::CounterNode::removeChild):
+        Changed such that insertion/removal of a counter, triggers not only
+        recalculation of PrefixWidths, but also reassesment of values in
+        counter nodes. This is the basis full implementation of CSS2.1
+        counters. It does not change current behavior by much because of
+        changes needed to the recalculation algorithm, but those are comming
+        in the patch for 11031.
+        (WebCore::showTreeAndMark):
+        * rendering/CounterNode.h:
+        * rendering/RenderCounter.cpp:
+        (WebCore::counter):
+        Only changed argument type to prepare for implementation of Darin
+        Adler's recommendation for the patch to 11031.
+
+        (WebCore::RenderCounter::invalidate):
+        (WebCore::destroyCounterNodeChildren):
+        (WebCore::RenderCounter::destroyCounterNodes):
+        * rendering/RenderCounter.h:
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::invalidateCountersInContainer):
+        (WebCore::RenderObjectChildList::invalidateCounters):
+        * rendering/RenderObjectChildList.h:
+        Added the ability to restrict invalidation to counters with a given
+        identifier.
+        Also invalidated counters that are on the child container itself
+        which were missed by the previous algorithm, but were a valid case.
+
+2009-11-13  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Protect SVG animated properties from destruction in bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31474
+
+        See http://crbug.com/26719.
+
+        Tested by LayoutTests/svg/custom/js-update-transform-addition.svg
+        under Valgrind.
+
+        Made sure we keep a reference to SVG properties while setting a
+        context:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::withSVGContext):
+
+2009-11-13  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        [CAIRO] shadow support for Canvas and SVG.
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+
+        Incorporate Benjamin Otte's recommendations to avoid
+        a buffer overrun, and small performance improvement.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::copyContextProperties): Correctly size output
+         storage for cairo_get_dash to avoid buffer overrun.
+        (WebCore::drawPathShadow): Prefer cairo_fill_extents
+         to slower cairo_stroke_extents when not drawing shadows.
+
+2009-11-13  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Do not register Chromium's HTML5 DB VFS as the default
+        VFS. Otherwise, other sqlite DB users in the same process will
+        stop working.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31462
+
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+
+2009-11-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle): Explicitly cast "-1" to CFOptionFlags,
+        avoiding a sign mismatch warning.
+
+2009-11-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Release build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        Use ASSERT_UNUSED for unused stream parameter.
+
+2009-11-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31441
+        Implement SocketStreamHandleCFNet
+
+        Existing WebSocket tests now pass on Mac. No proxy support yet.
+
+        * platform/network/SocketStreamHandleClient.h:
+        * platform/network/cf/SocketStreamHandle.h:
+        (WebCore::SocketStreamHandle::shouldUseSSL):
+        (WebCore::SocketStreamHandle::refAuthenticationClient):
+        (WebCore::SocketStreamHandle::derefAuthenticationClient):
+        (WebCore::SocketStreamHandle::):
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::chooseProxy):
+        (WebCore::SocketStreamHandle::createStreams):
+        (WebCore::SocketStreamHandle::copyCFStreamDescription):
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        (WebCore::SocketStreamHandle::~SocketStreamHandle):
+        (WebCore::SocketStreamHandle::platformSend):
+        (WebCore::SocketStreamHandle::platformClose):
+        (WebCore::SocketStreamHandle::receivedCredential):
+        (WebCore::SocketStreamHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::SocketStreamHandle::receivedCancellation):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: preload status bar button glyphs
+        in order to prevent them from flickering (take 2).
+
+        https://bugs.webkit.org/show_bug.cgi?id=31439
+
+        * inspector/front-end/inspector.js:
+        (preloadImages):
+
+2009-11-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Chromium: [REGRESSION] Crash while stopping on a breakpoint.
+        Rolling back r50890.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31467
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::canAccessPrivate):
+
+2009-11-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [CAIRO] shadow support for Canvas and SVG
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+        
+        This is the fix of a regression, caused by the shadow patch
+        from the bug above. Reinserted the save and restore calls
+        that were accidently removed by the previous patch.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill):
+        (WebCore::setPlatformStroke):
+
+2009-11-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Reverting r50908 since it makes inspector tests
+        time out.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31439
+
+        * inspector/front-end/inspector.js:
+
+2009-11-13  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enable 'console.profile()' and 'console.profileEnd()'
+        regardless of JAVASCRIPT_DEBUGGER.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31293
+
+        * WebCore.gypi:
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::profile):
+        (WebCore::JSConsole::profileEnd):
+        * bindings/v8/custom/V8ConsoleCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * page/Console.idl:
+
+2009-11-12  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY.
+
+        Chromium build fix.
+
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::evaluateInWorld): Add a dummy
+         method which isn't called in chromium to make things compile.
+
+2009-11-12  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Adam Barth.
+        
+        The document-open.html test was flaky at times. The test invokes the layout test plugin
+        which in its destroy stream handler opens a new document. This basically tears down the
+        stream and the associated plugin instance, which causes a crash when the plugin stream
+        dereferences an invalid m_client pointer which points to the PluginView instance which
+        is invalid at this time. Fix is to set the m_client pointer to NULL in the stop function
+        and check for the same.
+       
+        https://bugs.webkit.org/show_bug.cgi?id=31067
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::stop):
+        (WebCore::PluginStream::destroyStream):
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Renaming some parameters passed to DB-related methods to better
+        indicate their purpose.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31449
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-11-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transformed reflected elements are clipped inside element with opacity
+        https://bugs.webkit.org/show_bug.cgi?id=30957
+        
+        transparencyClipBox() attemped to minimize the size of the transparency layer by mapping
+        each clip rect into painting space before taking the unions. This, however, did not work
+        correctly with combinations of reflections and transforms. Fixed by unioning the
+        clipRect and mapping through transforms along the way.
+        
+        Also leave some #ifdeffed code in beginTransparencyLayers() that makes it easy to see
+        where the transparency layers are.
+
+        Test: fast/reflections/opacity-reflection-transform.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::expandClipRectForDescendantsAndReflection):
+        (WebCore::transparencyClipBox):
+        (WebCore::RenderLayer::beginTransparencyLayers):
+
+2009-11-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        Improve SecurityOrigin::toString comment
+        https://bugs.webkit.org/show_bug.cgi?id=31041
+
+        * page/SecurityOrigin.h:
+
+2009-11-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        externalRepresentation should take Frame as the argument
+        https://bugs.webkit.org/show_bug.cgi?id=31393
+
+        No new tests as this is just a refactoring.
+
+        * WebCore.base.exp:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::externalRepresentation):
+        * rendering/RenderTreeAsText.h:
+
+2009-11-12  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] The Android specific files in page/Android are out of date.
+        https://bugs.webkit.org/show_bug.cgi?id=31437
+
+        No tests required.
+
+        * page/android/DragControllerAndroid.cpp:
+        (WebCore::DragController::dragOperation): Added.
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        * page/android/EventHandlerAndroid.cpp:
+        (WebCore::EventHandler::accessKeyModifiers): Added.
+        * page/android/InspectorControllerAndroid.cpp: Removed.
+
+2009-11-12  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        [CAIRO] shadow support for Canvas and SVG.
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+
+        Implement Canvas/SVG shadow support for Cairo.  This patch
+        uses the filter code from SVG Filters.  That means that it is
+        necessary to activate filters to see the shadows.
+
+        Test: fast/canvas/canvas-shadow.html
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj: Add new ImageBufferFilter files.
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (GraphicsContext::calculateShadowBufferDimensions): New helper routine.
+        (WebCore::setPlatformFill):
+        (WebCore::setPlatformStroke):
+        (WebCore::copyContextProperties):
+        (WebCore::drawPathShadow):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::createPlatformShadow):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw): Add filter effect.
+        * platform/graphics/filters/Filter.h: Correct 'const' signatures.
+        * platform/graphics/filters/ImageBufferFilter.cpp: Added.
+        * platform/graphics/filters/ImageBufferFilter.h: Added.
+        * svg/graphics/filters/SVGFilter.cpp: Correct 'const' signatures.
+        * svg/graphics/filters/SVGFilter.h: Correct 'const' signatures.
+
+2009-11-12  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add postTaskToMainThread to ScriptExecutionContext.
+        Move the code to post task to the main thread into a new method on ScriptExecutionContext,
+        to use as a helper implementation of the virtual ScriptExecutionContext::postTask(Task) in
+        contexts that live on the main thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31427
+
+        No new tests - simply moving the code.
+
+        * dom/Document.cpp:
+        (WebCore::Document::postTask):
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::ScriptExecutionContextTaskTimer::fired):
+        (WebCore::PerformTaskData::PerformTaskData):
+        (WebCore::PerformTaskData::performTask):
+        (WebCore::ScriptExecutionContext::postTaskToMainThread):
+        * dom/ScriptExecutionContext.h:
+
+2009-11-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix crash when removing compositing layers when GC is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=31429
+
+        Workaround <rdar://problem/7390716> by special-casing the removal
+        of all sublayers when GC is enabled.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::safeSetSublayers):
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+
+2009-11-12  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        The last of the V8 binding optimizations.
+        - Replace string-valued element accessors with a shared getter/setter function.
+        - Change error handling flow of control to avoid extra branches and function calls.
+        https://bugs.webkit.org/show_bug.cgi?id=31443
+        
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::getElementStringAttr):  Body of string-valued Element getter function.
+        (WebCore::setElementStringAttr):  Body of string-valued Element setter function.
+        * bindings/v8/V8Binding.h:
+
+2009-11-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/7267951>
+        Canvas methods should reject uses of NaN and Infinity.
+
+        Test: fast/canvas/canvas-with-illegal-args.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::scale):
+        (WebCore::CanvasRenderingContext2D::rotate):
+        (WebCore::CanvasRenderingContext2D::translate):
+        (WebCore::CanvasRenderingContext2D::transform):
+        (WebCore::CanvasRenderingContext2D::setTransform):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: profile timeline panel, fix obvious problems.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31432
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._setWindowPosition):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.get minimumBoundary):
+        (WebInspector.TimelineCalculator.prototype.get maximumBoundary):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        (WebInspector.TimelineGraph):
+        (WebInspector.TimelineGraph.prototype.refresh):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.hasStyleClass):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: preload status bar button glyphs
+        in order to prevent them from flickering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31439
+
+        * inspector/front-end/inspector.js:
+        (preloadImages):
+
+2009-11-12  Adam Roben  <aroben@apple.com>
+
+        Replace worldIDs with world objects
+
+        Part of <http://webkit.org/b/31414> Implement new SPI for dealing with
+        user scripts/stylesheets and isolated worlds
+
+        Reviewed by Sam Weinig.
+
+        Covered by existing tests.
+
+        * WebCore.base.exp: Update exported symbols to match what now exists
+        and is needed by WebKit.
+
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute): Updated for function rename.
+
+        * bindings/js/ScriptController.cpp: Removed code that dealt with
+        worldIDs.
+        (WebCore::ScriptController::createWorld): Added. Returns a new world
+        suitable for use on the main thread.
+        (WebCore::ScriptController::executeScriptInWorld): Renamed from
+        executeScriptInIsolatedWorld, since this works just fine with a
+        "normal" world.
+
+        * bindings/js/ScriptController.h: Added createWorld, removed functions
+        that took worldIDs, renamed executeScriptInIsolatedWorld to
+        executeScriptInWorld.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScripts):
+        (WebCore::Frame::injectUserScriptsForWorld):
+        Updated for changes to UserScriptMap and ScriptController.
+
+        * page/Frame.h: Changed injectUserScriptsForWorld to take a
+        DOMWrapperWorld* instead of a worldID.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScriptToWorld):
+        (WebCore::PageGroup::addUserStyleSheetToWorld):
+        (WebCore::PageGroup::removeUserScriptFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetFromWorld):
+        (WebCore::PageGroup::removeUserScriptsFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
+        * page/PageGroup.h:
+        Changed these functions to take a DOMWrapperWorld* instead of a
+        worldID. Also updated for changes to UserScript and UserStyleSheet.
+
+        * page/UserScript.h:
+        * page/UserStyleSheet.h: Changed not to hold a worldID, since it was
+        never used.
+
+        * page/UserScriptTypes.h:
+        * page/UserStyleSheetTypes.h: Changed UserScriptMap and
+        UserStyleSheetMap to use a RefPtr<DOMWrapperWorld> instead of a
+        worldID as their key type.
+
+
+2009-11-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31260>.
+        Web Inspector: Main Resources Other than HTML are mis-detected.
+        
+        Even if the resource is a main resource, look at its CachedResource type, 
+        because it might be an image, stylesheet, or JavaScript file, and we
+        want to show them all correctly.
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::cachedResourceType): Move this method out so it can be called in multiple places.
+        (WebCore::InspectorResource::type): 
+        * inspector/InspectorResource.h:
+
+2009-11-12  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Table-driven setup for V8 binding template callback functions. 100k in code savings.
+        https://bugs.webkit.org/show_bug.cgi?id=31420
+
+        * bindings/scripts/CodeGeneratorV8.pm:  Change generated ConfigureXXXTemplate fn
+            to call configureTemplate().
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::configureTemplate):  New function; does all the standard configuration work.
+        (WebCore::createCallback):  De-inlined wrapper for FunctionTemplate creation.
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::batchConfigureAttributes):  Just wrapped the very long fn parameter list.
+        (WebCore::batchConfigureCallbacks):  New function, used by configureTemplate.
+        (WebCore::batchConfigureConstants):  Just wrapped the very long fn parameter list.
+        * bindings/v8/V8Proxy.h:
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Unreviewed, fix Chromium build after http://trac.webkit.org/changeset/50876.
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+
+2009-11-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7388969> Add DOM API for fullscreen video
+        
+        DOM API for fullscreen <video>.
+
+        Tests: media/media-fullscreen-inline.html
+               media/media-fullscreen-not-in-document.html
+
+        * dom/EventNames.h:
+            Add webkitbeginfullscreen and webkitendfullscreen.
+
+        * html/HTMLAttributeNames.in:
+            Add onwebkitbeginfullscreen and onwebkitendfullscreen.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+            Deal with onwebkitbeginfullscreen and onwebkitendfullscreen.
+        (WebCore::HTMLMediaElement::enterFullscreen):
+            Schedule webkitbeginfullscreenEvent event, don't set m_isFullscreen unless we
+            actually do enter fullscreen.
+        (WebCore::HTMLMediaElement::exitFullscreen):
+            Schedule webkitendfullscreenEvent event.
+        (WebCore::HTMLMediaElement::webkitEnterFullScreen):
+        (WebCore::HTMLMediaElement::webkitExitFullScreen):
+        (WebCore::HTMLMediaElement::webkitSupportsFullscreen):
+        (WebCore::HTMLMediaElement::webkitDisplayingFullscreen):
+            New, access to fullscreen properties and methods.
+
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+            Declare methods needed for fullscreen API.
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::supportsFullscreen):
+            Return false if a movie does not have video.
+
+        * page/DOMWindow.h:
+            Add webkitbeginfullscreen and webkitendfullscreen.
+
+2009-11-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Sify compose button alerts error
+        https://bugs.webkit.org/show_bug.cgi?id=31394
+
+        Test: http/tests/security/calling-versus-current.html
+
+        We're supposed to use the calling context for security checks.  In JSC
+        land, this is the lexicalGlobalObject.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::canAccessPrivate):
+
+2009-11-12  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30291
+
+        Fixes an issue where the returned drop effect is incorrect when
+        effectAllowed == "uninitialized".
+
+        According to section 7.9.2 of the HTML 5 spec.
+        <http://dev.w3.org/html5/spec/Overview.html#the-dragevent-and-datatransfer-interfaces>
+        when effectAllowed = "uninitialized" the resulting dropEffect should be the
+        user-specified dropEffect (i.e. "copy", "move", "link") and "none" for any
+        other case.
+        
+        No test cases are included because we have an existing test case from
+        bug #24731.
+
+        * dom/Clipboard.cpp:
+        (WebCore::dragOpFromIEOp): Added case for op == "uninitialized".
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not highlight node on refresh.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31419
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Minor timeline fixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31417
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype._updateDetails):
+        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+
+2009-11-12  Alexey Proskuryakov  <ap@apple.com>
+
+        SnowLeopard build fix.
+
+        Renamed initWithClient to initWithAuthenticationClient.
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (-[WebCoreAuthenticationClientAsChallengeSender initWithAuthenticationClient:]):
+        (WebCore::AuthenticationChallenge::setAuthenticationClient):
+
+2009-11-12  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ARIA: add alert type roles
+        https://bugs.webkit.org/show_bug.cgi?id=31392
+
+        Test: platform/mac/accessibility/aria-alerts.html
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2009-11-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31386
+        Make Mac AuthenticationChallenge usable from cross-platform code
+
+        No change in behavior, so no tests.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::clearAuthentication):
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        Don't store m_currentCFChallenge, which was only used for a single assertion. Unlike the
+        NSURLConnection case, CF challenge doesn't carry a sender with it, so the copy in web challenge
+        is identical.
+
+        * platform/network/cf/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::setAuthenticationClient): Added a setter to match the new
+        Mac interface. Previously, one had to create a new AuthenticationChallenge to replace client.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Fixed assertions after removal
+        of m_currentCFChallenge. Also, there is no need to set client now, as it's guaranteed to
+        be already set.
+
+        * platform/network/mac/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::m_sender): Explained the existence of this member to the
+        best of my understanding.
+        (WebCore::AuthenticationChallenge::m_nsChallenge): Renamed from m_macChallenge to prevent
+        confusion with "mac" and "web" challenges in ResourceHandleInternal.
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCoreAuthenticationClientAsChallengeSender): Added a Obj-C wrapper for AuthenticationClient,
+        making it possible to use the latter with NSURLAuthenticationChallenge.
+        (WebCore::AuthenticationChallenge::AuthenticationChallenge): Updated for m_macChallenge ->
+        m_nsChallenge renaming.
+        (WebCore::AuthenticationChallenge::setAuthenticationClient): Wrap the client in Obj-C and
+        set it as sender (or unset, if client is null).
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCoreResourceHandleAsDelegate) WebCoreResourceHandleAsDelegate no longer doubles as
+        authentication challenge sender.
+        (WebCore::ResourceHandle::~ResourceHandle): A navigation can happen underneath an
+        authentication sheet.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Form m_currentWebChallenge
+        using the new setAuthenticationClient() method.
+        (WebCore::ResourceHandle::didCancelAuthenticationChallenge): Fixed an incorrect assertion.
+        Since didCancelAuthenticationChallenge is called by connection, the passed challenge is
+        the original Mac one, not the one we created for use with authentication sheet. I don't
+        know when a connection would cancel authentication in practice, so I haven't tested this.
+
+2009-11-12  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: breakpoint sidebar entries should allow click over entire list item
+        https://bugs.webkit.org/show_bug.cgi?id=31411
+
+        No new tests; no new functionality, small usability change. 
+
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement.breakpointClicked):
+
+2009-11-12  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: breakpoints in named evals are not restored after a reload
+        https://bugs.webkit.org/show_bug.cgi?id=31375
+
+        Manual test added
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        * manual-tests/inspector/bp-in-named-eval-after-reload.html: Added.
+
+2009-11-12  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Custom printing shrink factors
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+
+        This reverts commit r49769. The public API for this needs to be reviewed
+        before its inclusion in Qt.
+
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::begin):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+
+2009-11-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Resource errors/warnings not shown in the Resource tree.
+
+        Error/Warning bubbles are not displayed next to the resource in the 
+        Resources panel if those occur before the resource is attached to the tree.
+        https://bugs.webkit.org/show_bug.cgi?id=31404
+
+        Test: manual-tests/inspector/styled-error-bubbles-in-scripts.html
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
+
+2009-11-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        Follow-up of r50726, don't block the UI thread when calling
+        gst_element_get_state(). Also fixed a compilation warning and some
+        static casts.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::playbackPosition):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::setRate):
+
+2009-11-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        don't pause pipeline if already paused, same for play()
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+
+2009-11-12  Kinuko Yasuda  <kinuko@google.com>
+
+        Reviewed by David Levin.
+
+        Support Gtk scrollwheel behavior for horizontal scrollbars on Linux
+        Chromium too.
+        https://bugs.webkit.org/show_bug.cgi?id=31292
+
+        No new tests. (Corresponding test for Gtk+ is
+        platform/gtk/scrollbars/overflow-scrollbar-horizontal-wheel-scroll.html)
+
+        * page/EventHandler.cpp:
+        * page/chromium/EventHandlerChromium.cpp:
+
+2009-11-12  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Prevent text inside a multi-column block from being split into columns.
+        
+        If the tentative height of a multi-column block was too small, we need to
+        expand the block height and try to layout again, in order to prevent text
+        from being split into different columns.
+
+        CSS Multicolumn text is split awkwardly
+        https://bugs.webkit.org/show_bug.cgi?id=22249
+
+        Test: fast/multicol/single-line.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutColumns):
+        * rendering/RenderBlock.h:
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::setTruncatedAt):
+        (WebCore::RenderView::setMinimumColumnHeight):
+        (WebCore::RenderView::minimumColumnHeight):
+
+2009-11-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that RenderFileUploadControl isn't initialized with multiple files.
+        https://bugs.webkit.org/show_bug.cgi?id=31195
+
+        Test: fast/forms/input-file-re-render.html
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::RenderFileUploadControl):
+
+2009-11-09  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixing Chromium's POSIX VFS implementation, by adding the required
+        "used file descriptors" logic.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31275
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+
+2009-11-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        need to implement aria tree roles
+        https://bugs.webkit.org/show_bug.cgi?id=31284
+
+        Tests: platform/mac/accessibility/aria-multiselectable.html
+               platform/mac/accessibility/aria-tree.html
+
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::accessibilityIsIgnored):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::ariaTreeRows):
+        (WebCore::AccessibilityObject::ariaTreeItemContent):
+        (WebCore::AccessibilityObject::ariaTreeItemDisclosedRows):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        (WebCore::AccessibilityObject::isTree):
+        (WebCore::AccessibilityObject::isTreeItem):
+        (WebCore::AccessibilityObject::setIsExpanded):
+        (WebCore::AccessibilityObject::canSetExpandedAttribute):
+        (WebCore::AccessibilityObject::hierarchicalLevel):
+        (WebCore::AccessibilityObject::setSelectedRows):
+        (WebCore::AccessibilityObject::performDefaultAction):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::hierarchicalLevel):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isExpanded):
+        (WebCore::AccessibilityRenderObject::setElementAttributeValue):
+        (WebCore::AccessibilityRenderObject::elementAttributeValue):
+        (WebCore::AccessibilityRenderObject::setIsExpanded):
+        (WebCore::AccessibilityRenderObject::isSelected):
+        (WebCore::AccessibilityRenderObject::setSelected):
+        (WebCore::AccessibilityRenderObject::setSelectedRows):
+        (WebCore::createARIARoleMap):
+        (WebCore::AccessibilityRenderObject::canSetExpandedAttribute):
+        (WebCore::AccessibilityRenderObject::ariaTreeSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        (WebCore::AccessibilityRenderObject::selectedChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (RoleEntry::):
+        (-[AccessibilityObjectWrapper subrole]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+        (-[AccessibilityObjectWrapper accessibilityPerformShowMenuAction]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+        * html/HTMLAttributeNames.in:
+
+2009-11-11  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix after @r50760 with ENABLE_FILTERS.
+
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::apply): Supply ColorSpace to fillRect.
+        * svg/graphics/filters/SVGFEFlood.cpp: Supply ColorSpace argument
+          to fillRect.
+
+2009-11-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix WebSocket frame parser of frame_type with high-order bit set.
+        https://bugs.webkit.org/show_bug.cgi?id=30668
+
+        If buffer is smaller than frame's length, it should break the loop
+        instead of reading next byte.
+
+        Tests: websocket/tests/frame-length-longer-than-buffer.html
+               websocket/tests/frame-length-skip.html
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-11-11  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [chromium] Remove t2embed.dll functions from FontCustomPlatformData.cpp for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=31345
+
+        Remove dependency on t2embed.dll so that Chromium for Windows can start even if t2embed.dll cannot be accessed.
+
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData): Remove TTDeleteEmbeddedFont() call. Always use RemoveFontMemResourceEx().
+        (WebCore::FontCustomPlatformData::fontPlatformData): Remove TTGetNewFontName() call.
+        (WebCore::createFontCustomPlatformData): Remove TTLoadEmbeddedFont() call. Always use AddFontMemResourceEx() via renameAndActivateFont() in opentype/OpenTypeUtility.h. Remove EOTStream class as well.
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::Font::drawComplexText):
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Windows build fix. No review needed. 
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31382
+        Make -webkit-color-correction work with shadows
+
+        From canvas, just send DeviceColorSpace to setShadow() for now. 
+        Will fix soon when I address https://bugs.webkit.org/show_bug.cgi?id=31319
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setShadow):
+        (WebCore::CanvasRenderingContext2D::applyShadow):
+
+        setShadow() and setPlatformShadow() now take a ColorSpace.
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setShadow):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::createCGColorWithColorSpace): New helper to create a 
+        color in a ColorSpace.
+        (WebCore::setCGFillColor): Call new helper.
+        (WebCore::setCGStrokeColor): Call new helper.
+        (WebCore::GraphicsContext::setPlatformShadow): Call new helper.
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+        Send appropriate ColorSpace to setShadow().
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::paintTextWithShadows):
+        (WebCore::InlineTextBox::paintDecoration):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+        Attempt to keep ports building.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-11-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Print the file text of a file upload control in DumpRenderTree for ease of tests.
+        https://bugs.webkit.org/show_bug.cgi?id=31195
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        (WebCore::RenderFileUploadControl::fileTextValue):
+        * rendering/RenderFileUploadControl.h:
+        (WebCore::RenderFileUploadControl::isFileUploadControl):
+        (WebCore::toRenderFileUploadControl):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isFileUploadControl):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+
+2009-11-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        DOM Wrappers for some nodes may not be marked.
+        https://bugs.webkit.org/show_bug.cgi?id=31380
+
+        Some markChildren methods are calling getCachedDOMNodeWrapper, which will find
+        the wrapper for the current world only.  This means that wrappers may be GC'ed
+        prematurely, and properties lost.
+
+        Move to a model more like markDOMObjectWrapper, mark wrappers for all worlds.
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::markChildren):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markDOMNodeWrapper):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::markChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::markChildren):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::markChildren):
+
+2009-11-11  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        bindings/js/ScriptObject.cpp is missing and ENABLE(INSPECTOR) guard.
+        https://bugs.webkit.org/show_bug.cgi?id=31384
+
+        No functionality change so no tests required.
+
+        * bindings/js/ScriptObject.cpp: Add ENABLE(INSPECTOR) guard around the JSInspectorBackend.h include.
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        The Big De-Inlining. 450k code size reduction (32-bit x86.)
+        - Various inline functions in V8Binding.h made non-inline.
+        - Some renaming for consistency.
+        - New function createRawTemplate().
+        https://bugs.webkit.org/show_bug.cgi?id=31383
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8DOMWrapperToNative):
+        (WebCore::v8ValueToWebCoreString):
+        (WebCore::v8ValueToAtomicWebCoreString):
+        (WebCore::toInt32):
+        (WebCore::toWebCoreString):
+        (WebCore::toWebCoreStringWithNullCheck):
+        (WebCore::toAtomicWebCoreStringWithNullCheck):
+        (WebCore::toWebCoreStringWithNullOrUndefinedCheck):
+        (WebCore::isUndefinedOrNull):
+        (WebCore::v8Boolean):
+        (WebCore::v8UndetectableString):
+        (WebCore::v8StringOrNull):
+        (WebCore::v8StringOrUndefined):
+        (WebCore::v8StringOrFalse):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8ExternalString):
+        (WebCore::createRawTemplate):  New function.
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8DOMWrapperTo):
+        (WebCore::v8DOMWrapperToNode):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        More V8 de-inlining (outlining?) Abstracted a chunk of boilerplate code from every
+        event-listener setter into a new subroutine transferHiddenDependency().
+        https://bugs.webkit.org/show_bug.cgi?id=31377
+
+        * bindings/scripts/CodeGeneratorV8.pm:  Replace boilerplate with call to transferHiddenDependency().
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::transferHiddenDependency):  New.
+        * bindings/v8/V8Utilities.h:  Declaration of transferHiddenDependency.
+
+2009-11-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        If we are on Windows, don't try and get the kCGColorSpaceSRGB ColorSpace,
+        because there is a CG bug preventing this from working.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef):
+
+2009-11-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Check that if Storage panel exists before calling its methods
+
+        https://bugs.webkit.org/show_bug.cgi?id=31343
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDatabase):
+        (WebInspector.addCookieDomain):
+        (WebInspector.addDOMStorage):
+        (WebInspector.updateDOMStorage):
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        De-inline convertNodeToV8Object(), which expands to a lot of asm code and is inlined 136
+        times in the generated V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31368
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):  Moved body here from .h file
+        * bindings/v8/V8DOMWrapper.h:  Removed inline method body.
+
+2009-11-11  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Display the correct summary in the web inspector for the shorthands
+        border-color, border-width, border-style, margin, and padding.
+        https://bugs.webkit.org/show_bug.cgi?id=7987
+
+        Test: fast/css/shorthands-four-values.html
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::get4Values):
+        Display the summary information in the same way the shorthand would be
+        specified in a css rule.
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Make V8 bindings return NULL handles instead of calling v8::Undefined(). This has equivalent
+        meaning to the caller, saves code, and appears to save a few cycles at runtime too.
+        https://bugs.webkit.org/show_bug.cgi?id=31367
+
+        * bindings/scripts/CodeGeneratorV8.pm: Change "v8::Undefined()" to "v8::Handle<v8::Value>()"
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Optimize V8 getDOMNodeMap(), a hot function in Dromaeo DOM tests, by increasing inlining.
+
+        * bindings/v8/DOMData.cpp:
+        (WebCore::DOMData::getCurrent):  Moved getCurrentMainThread to MainThreadDOMData::getCurrent
+            so it can be inlined by its caller.
+        * bindings/v8/DOMData.h:
+        * bindings/v8/MainThreadDOMData.cpp:
+        (WebCore::MainThreadDOMData::getCurrent):  Moved here from DOMData.cpp.
+        (WebCore::MainThreadDOMData::getMainThreadStore):  Added UNLIKELY macro to improve codegen.
+        (WebCore::MainThreadDOMData::getCurrentMainThreadStore):  Combination of getCurrentMainThread
+            and getStore, which inline both calls together.
+        * bindings/v8/MainThreadDOMData.h:
+        (WebCore::MainThreadDOMData::getStore):  Broke out nonvirtual getMainThreadStore for inlineability.
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):  Call new getCurrentMainThreadStore, which is faster.
+
+2009-11-11  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add methods to KURLGoogle.cpp declared in http://trac.webkit.org/changeset/50784 but not defined when using KURLGoogle.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31357
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::isSchemeFirstChar):
+        (WebCore::isSchemeChar):
+        (WebCore::KURL::hasPort):
+        (WebCore::KURL::removePort):
+        (WebCore::protocolIsValid):
+
+2009-11-11  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix, no reviewed.
+
+        Correct setPlatformFillColor and setPlatformStrokeColor calls
+        to match new ColorSpace-supporting signatures.
+
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:  Add the
+          color space to the set[...]Color calls.
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31327
+        Clean up SocketStreamHandleClient interface
+
+        No change in behavior.
+
+        * platform/network/SocketStreamHandleClient.h: Removed willOpenStream and willSendData.
+        (WebCore::SocketStreamHandleClient::willOpenStream): Removed. This is currently not used by
+        the only client (WebSocketChannel), and it's not clear what this callback's semantics
+        should be.
+        (WebCore::SocketStreamHandleClient::willSendData): Ditto.
+        (WebCore::SocketStreamHandleClient::receivedCancellation): Removed, because it was misplaced.
+        For ResourceHandle, this method is called when the user cancels authentication sheet,
+        not when something happens with the stream.
+
+        * websockets/WebSocketChannel.h: Some WebSocketChannel methods were virtual without any
+        reason. Also, added didReceiveAuthenticationChallenge/didCancelAuthenticationChallenge.
+
+        * websockets/WebSocketChannel.cpp: Adjusted for the above change. Authentication-related
+        callbacks have no real implementation yet.
+
+2009-11-11  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for the part of page directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31350
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and these are no need to be copyable:
+
+        class DragController         - instantiated at: WebCore/page/Page.cpp:107
+        class FocusController        - instantiated at: WebCore/page/Page.cpp:109
+        class Settings               - instantiated at: WebCore/page/Page.cpp:116
+        class PluginHalter           - instantiated at: WebCore/page/Page.cpp:160
+        struct ScheduledEvent        - instantiated at: WebCore/page/FrameView.cpp:1275
+        class UserScript             - instantiated at: WebCore/page/PageGroup.cpp:208
+        struct EventHandlerDragState - instantiated at: WebCore/page/EventHandler.cpp:182
+        class XSSAuditor             - instantiated at: WebCore/bindings/js/ScriptController.cpp:70
+        class UserStyleSheet         - instantiated at: WebCore/page/PageGroup.cpp:222
+
+        Inherits PropertyWrapperBase class from Noncopyable because (its child class) 
+        PropertyWrapper is instantiated by 'new' in 
+        WebCore/page/animation/AnimationBase.cpp:564 it is no need to be copyable.
+
+        * page/DragController.h:
+        * page/EventHandler.h:
+        * page/FocusController.h:
+        * page/FrameView.cpp:
+        * page/PluginHalter.h:
+        * page/Settings.h:
+        * page/UserScript.h:
+        * page/UserStyleSheet.h:
+        * page/XSSAuditor.h:
+        * page/animation/AnimationBase.cpp:
+
+2009-11-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31323
+        Fix a few compiler warnings
+
+        No new tests as there is no new functionality.
+
+        * editing/htmlediting.cpp:
+        (WebCore::isRenderedAsNonInlineTableImageOrHR): Use explicit
+        parentheses to silence gcc 4.4 -Wparentheses warnings
+
+2009-11-11  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Set m_hasPendingGeometryChange to true by default, so that
+        at least one call to NPP_SetWindow is executed, which is
+        needed by the DRT plugin testing framework.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+
+2009-11-11  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Rubber-stamped by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31348
+        [Qt] Remove unnecessary LUT creator from WebCore.pro
+
+        * WebCore.pro:
+
+2009-11-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Introduce a function for querying the input method status
+        in QWebPageClient.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-11-11  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Black artifacts in youtube.com/html5
+
+        Paint the video to the given size. It's the job of the callers to keep
+        track of aspect ratio. RenderVideo.cpp does it for the <video>
+        element.
+        https://bugs.webkit.org/show_bug.cgi?id=30925
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-11-11  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30901
+        [Gtk] Need to de-lint the Atk a11y code
+
+        Cleaned up some missed capitalization style-guideline violations.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-11-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Make the default style background color valid.
+        Currently the color is transparent but invalid, this causes
+        list boxes in QtWebKit to be drawn with a black background
+        since r49242.
+        https://bugs.webkit.org/show_bug.cgi?id=31295
+
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::initialBackgroundColor):
+        * rendering/style/StyleBackgroundData.cpp:
+        (WebCore::StyleBackgroundData::StyleBackgroundData):
+
+2009-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Simplify the ownership model for worlds - rather than having a pair of weak references
+        between DOMWrapperWorld and ScriptController/ScriptCachedFrameData, give the latter an
+        ref pointer to the former.  This reduces complexity & cost of the caching entries in the
+        back forward cache.
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::forgetDocument):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptCachedFrameData.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/js/ScriptController.h:
+
+2009-11-10  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        rename counter to makeCounterNode in RenderCounter.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=31289
+
+        No new test because this is just a small refactoring.
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        (WebCore::makeCounterNode):
+        (WebCore::RenderCounter::originalText):
+
+2009-11-10  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30754
+
+        Patch 2 of 2.
+
+        Removed method EventHandler::dragSourceMovedTo, since it is no longer
+        needed. This method fired a drag event whenever the mouse moved, but
+        section 7.9.4 of the HTML 5 spec. defines the drag-and-drop processing
+        model independent of when the mouse moves. See "Among other changes..."
+        in the change log for patch 1 for more details.
+
+        * WebCore.DragSupport.exp:
+        * page/EventHandler.cpp: Removed method EventHandler::dragSourceMovedTo.
+        (WebCore::EventHandler::handleDrag): Updated comment about reentrancy issue.
+        * page/EventHandler.h:
+
+2009-11-10  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30754
+
+        Patch 1 of 2.
+
+        As per Section 7.9.4 of the HTML 5 spec. <http://dev.w3.org/html5/spec/Overview.html#drag-and-drop-processing-model>,
+        the drag event should always fire before the dragover event.
+
+        In fixing this bug, this patch also makes our drag processing model
+        conform to the HTML 5 spec.
+
+        Among the changes, this patch ensures that the drag event isn't fired outside
+        of the drag-and-drop processing loop, WebCore::EventHandler::updateDragAndDrop.
+        Currently, the drag event is fired whenever the mouse button is down and the OS
+        detects the mouse moved. But, as per the spec, the drag event should
+        fire approx. every 350ms so long as the mouse button is down.
+
+        Test: fast/events/drag-and-drop-fire-drag-dragover.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::canHandleDragAndDropForTarget): Formerly named handleDragAndDropForTarget.
+        Modified to determine when we are in the correct instance of EventHandler to service the drag
+        and drop operation.
+        (WebCore::EventHandler::updateDragAndDrop): Moved code from WebCore::EventHandler::dragSourceMovedTo
+        into this method.
+        (WebCore::EventHandler::cancelDragAndDrop):
+        (WebCore::EventHandler::performDragAndDrop):
+        (WebCore::EventHandler::clearDragState):
+        * page/EventHandler.h: Added field m_shouldOnlyFireDragOverEvent to determine whether
+        we should fire both drag and dragover events or only the dragover event.
+
+2009-11-10  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix crash in V8CustomXPathNSResolver (http://crbug.com/26726).
+        https://bugs.webkit.org/show_bug.cgi?id=31301
+
+        Tested by new fast/xpath/xpath-detached-iframe-resolver-crash.html.
+
+        Allowed passing V8Proxy for the calling JS context:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getXPathNSResolver):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::create):
+        (WebCore::V8CustomXPathNSResolver::V8CustomXPathNSResolver):
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8CustomXPathNSResolver.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-10  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement URL decomposition IDL attributes for HTMLAnchorElement.
+        https://bugs.webkit.org/show_bug.cgi?id=29972.
+
+        Add methods for setting different parts of the URL in href attribute.
+
+        Tests: fast/dom/HTMLAnchorElement/set-href-attribute-hash.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-host.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-hostname.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-pathname.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-port.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-protocol.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-search.html
+
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setPort):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::parsePortFromStringPosition):
+        (WebCore::HTMLAnchorElement::setHash):
+        (WebCore::HTMLAnchorElement::setHost):
+        (WebCore::HTMLAnchorElement::setHostname):
+        (WebCore::HTMLAnchorElement::setPathname):
+        (WebCore::HTMLAnchorElement::setPort):
+        (WebCore::HTMLAnchorElement::setProtocol):
+        (WebCore::HTMLAnchorElement::setSearch):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAnchorElement.idl:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::iconURL):
+        * platform/KURL.cpp:
+        (WebCore::KURL::removePort):
+        (WebCore::KURL::setPort):
+        (WebCore::KURL::prettyURL):
+        (WebCore::protocolIsValid):
+        * platform/KURL.h:
+        (WebCore::KURL::canSetHostOrPort):
+        (WebCore::KURL::canSetPathname):
+        (WebCore::KURL::hasPort):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-11-10  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, fix Chromium build after http://trac.webkit.org/changeset/50760.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::paintBorder):
+        (WebCore::PopupListBox::paint):
+        (WebCore::PopupListBox::paintRow):
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::setupLayerForWhiteLayer):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider):
+        (WebCore::paintMediaVolumeSlider):
+        (WebCore::paintMediaTimelineContainer):
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
+
+2009-11-10  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Repro crash saving pcmag.com article as a webarchive.
+        <rdar://problem/7381219> and https://webkit.org/b/31322
+
+        Test: http/tests/webarchive/cross-origin-stylesheet-crash.html
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addSubresourceStyleURLs): Walk the stylesheet itself instead
+          of creating a CSSRuleList (and subjecting ourselves to the security origin check)
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Attempt 2 to fix Tiger build. No review needed.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::deviceRGBColorSpaceRef):
+        (WebCore::sRGBColorSpaceRef):
+
+2009-11-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Changes needed after r50760.
+
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Qt build fix.
+
+        * platform/network/ResourceHandle.h: Only inherit from AuthenticationClient on platforms
+        that use ResourceHandle as a delegate (Mac, CFNetwork, Curl).
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Tiger build fix. No review needed.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef):
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31312
+        Decouple authentication panel callbacks from ResourceHandle
+
+        No change in functionality.
+
+        SocketStreamHandle also needs to request credentials, so it's not appropriate to store
+        ResourceHandle as delegate.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/network/AuthenticationClient.h: Added.
+        Added a new interface for listening to authentication panel notifications.
+
+        * WebCore.xcodeproj/project.pbxproj: Added AuthenticationClient.h. Let Visual Studio do what
+        it wants with the project file.
+
+        (WebCore::AuthenticationClient::ref): Using our usual method of exposing refcounting on an
+        interface class.
+        (WebCore::AuthenticationClient::deref): Ditto.
+
+        * platform/network/ResourceHandle.h:
+        (WebCore::ResourceHandle::refAuthenticationClient): Ditto.
+        (WebCore::ResourceHandle::derefAuthenticationClient): Ditto.
+
+        * platform/network/cf/AuthenticationCF.cpp:
+        (WebCore::AuthenticationChallenge::AuthenticationChallenge):
+        (WebCore::AuthenticationChallenge::platformCompare):
+        * platform/network/cf/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::authenticationClient):
+        * platform/network/chromium/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::authenticationClient):
+        * platform/network/curl/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::authenticationClient):
+        Keeping a reference to AuthenticationClient, not to ResourceHandle.
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+       Second attempted gtk build fix. No review needed.
+
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+
+
+2009-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix back/forwards cache with JSC isolated worlds.
+        https://bugs.webkit.org/show_bug.cgi?id=31310
+        <rdar://problem/7328111> Cached back navigation doesn't restore global object in extension isolated world
+
+        Store the global object for all worlds, not just the normal world.
+        Also maintain bidirectional weak references between the ScriptCachedFrameData and the DOMWrapperWorld,
+        so we can forget global objects if a world goes away.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::rememberScriptCachedFrameData):
+        (WebCore::DOMWrapperWorld::forgetScriptCachedFrameData):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::forgetWorld):
+        (WebCore::ScriptCachedFrameData::domWindow):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptCachedFrameData.h:
+        * bindings/js/ScriptController.h:
+
+2009-11-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix after r50760.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Attempted build fix. (No review needed.)
+
+        * GNUmakefile.am: Adding ColorSpace.h
+
+2009-11-10  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by NOBODY - Build Fix.
+
+        Updated function calls to take a ColorSpace argument, passing
+        in DeviceColorSpace for now - this should be fixed. Also added
+        ColorSpace.h to WebCore project.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
+        * platform/win/WebCoreTextRenderer.cpp:
+        (WebCore::doDrawTextAtPoint):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintMenuListButton):
+
+2009-11-10  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Optimizations to Element::getAttribute
+        https://bugs.webkit.org/show_bug.cgi?id=30926
+
+        * dom/Element.cpp:
+        (WebCore::Element::getAttribute):  User case-insensitive compare instead of lowercasing the name.
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::getAttributeItem):  Avoid redundant compares, and do fast/likely compares first.
+        * platform/text/PlatformString.h:
+        (WebCore::equalPossiblyIgnoringCase):  New inline method, used by both of the above.
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7059710> 
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=31196 Implement -webkit-
+        color-correction for CSS colors
+
+        New exported symbol for GraphicsContext::fillColor() which now 
+        accepts a ColorSpace as an optional parameter.
+        * WebCore.base.exp:
+
+        Added a new file, ColorSpace.h, to define the ColorSpace enum.
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Computed Style for -webkit-color-correction
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Parse -webkit-color-correction
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+       Map CSS identifiers to the appropriate values of the ColorSpace enum
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator ColorSpace):
+
+        New property -webkit-color-correction
+        * css/CSSPropertyNames.in:
+
+        Map -webkit-color-correction into the RenderStyle.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+        Add new value sRGB.
+        * css/CSSValueKeywords.in:
+
+        Comment out the reference to sRGB since it will now be inherited as 
+        a value from CSSValueKeywords.
+        * css/SVGCSSValueKeywords.in:
+
+        Definition of the ColorSpace enum.
+        * platform/graphics/ColorSpace.h: Added.
+        (WebCore::):
+
+        These functions all now take a ColorSpace as a parameter.
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokeColor):
+        (WebCore::GraphicsContext::setFillColor):
+        (WebCore::GraphicsContext::drawHighlightForText):
+
+        Return the appropriate ColorSpace.
+        (WebCore::GraphicsContext::strokeColorSpace):
+        (WebCore::GraphicsContext::fillColorSpace):
+
+        These functions all call other functions which require a ColorSpace 
+        as a parameter.
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+
+        All of the GraphicsContext functions that take a Color should now 
+        also take a ColorSpace.
+        * platform/graphics/GraphicsContext.h:
+
+        Added new member variables stokeColorSpace and fillColorSpace.
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+
+        Attempt to keep the Cairo port building with all of the massive 
+        changes to GraphicsContext.        
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::fillRoundedRect):
+
+        
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef): New static function that returns a 
+        CGColorSpaceRef for the sRGB color space.
+        (WebCore::deviceRGBColorSpaceRef): New static function that returns 
+        a CGColorSpaceRef for the device RGB color space.
+
+        (WebCore::setCGFillColor): Now takes a ColorSpace parameter and 
+        sets the fill color to the specified color in the given ColorSpace.
+        (WebCore::setCGStrokeColor): Same, but for stroke.
+
+        (WebCore::setCGFillColorSpace): New static to set the 
+        CGFillColorSpace to the given ColorSpace
+        (WebCore::setCGStrokeColorSpace): Same, but for stroke.
+
+        Send ColorSpaces when appropriate, set ColorSpaces when 
+        appropriate, and check ColorSpaces when appropriate.
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Attempt to keep Haiku building.
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Attempt to keep QT building.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Attempt to keep Wince building.
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+        Attempt to keep WX building.
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Added functions colorSpace() and setColorSpace()
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::colorSpace):
+        (WebCore::InheritedFlags::setColorSpace):
+
+        The ColorSpace is stored here.
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+
+        All of these call sites call GraphicsContext functions which now 
+        require ColorSpaces.
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::paintCaret):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+        * inspector/InspectorController.cpp:
+        (WebCore::drawOutlinedQuad):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::paintScrollCorner):
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paintScrollCorner):
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::fillWithSolidColor):
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::paint):
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::updateGraphicsContext):
+        (WebCore::paintTextWithShadows):
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::paintSelection):
+        (WebCore::InlineTextBox::paintCompositionBackground):
+        (WebCore::InlineTextBox::paintDecoration):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        (WebCore::InlineTextBox::paintCompositionUnderline):
+        * rendering/InlineTextBox.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::fillHorizontalSelectionGap):
+        (WebCore::RenderBlock::fillVerticalSelectionGap):
+        (WebCore::RenderBlock::fillLeftSelectionGap):
+        (WebCore::RenderBlock::fillRightSelectionGap):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paintColumnBorder):
+        (WebCore::RenderFrameSet::paintRowBorder):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintScrollCorner):
+        (WebCore::RenderLayer::paintResizer):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+        (WebCore::RenderListBox::paintItemBackground):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::drawArcForBoxSide):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::paintScrollCorner):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButton):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::paintBoxDecorations):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintSelection):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerSolid.cpp:
+        (WebCore::SVGPaintServerSolid::setup):
+
+2009-11-10  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Speed up syntax highlighter
+        https://bugs.webkit.org/show_bug.cgi?id=31291
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.moveToNextLine): Replace the line content node.
+        (WebInspector.SourceSyntaxHighlighter.prototype.process):
+        (WebInspector.SourceSyntaxHighlighter.prototype.appendNonToken):
+        (WebInspector.SourceSyntaxHighlighter.prototype.syntaxHighlightNode):
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        (WebInspector.JavaScriptSourceSyntaxHighlighter):
+
+2009-11-09  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove session storage setting
+        https://bugs.webkit.org/show_bug.cgi?id=31279
+
+        Remove session storage from Settings.  It was added temporarily so we could
+        disable it by default at runtime in Chromium.  We now disable these things in a
+        different way, so it's time to remove it.  Qt also depended on this setting for
+        a short period of time, but after talking to them we agreed that it should be
+        removed.
+
+        This bug is the second half of https://bugs.webkit.org/show_bug.cgi?id=30602
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+
+2009-11-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Carlson and Darin Adler.
+
+        WebCore part of making full-screen video pause during scrubbing.
+
+        * WebCore.Video.exp: Sorted and added HTMLMediaElement::beginScrubbing()
+        and HTMLMediaElement::endScrubbing().
+
+2009-11-10  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Reapply 50562 reverted by 50588 due to issues with sandboxing (should be fine now).
+        https://bugs.webkit.org/show_bug.cgi?id=31051
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::V8GCController::gcEpilogue):
+        (WebCore::V8GCController::checkMemoryUsage):
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+
+2009-11-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the part of loader directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31161
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and these are no need to be copyable:
+
+        class Request - WebCore/loader/loader.cpp:100
+        struct ScheduledRedirection - WebCore/loader/RedirectScheduler.cpp:164
+        class ApplicationCacheStorage - WebCore/loader/appcache/ApplicationCacheStorage.cpp:1121
+        class ApplicationCacheHost -  WebCore/loader/DocumentLoader.cpp:151
+        class ImageEventSender - WebCore/loader/ImageLoader.cpp:54
+        struct ProgressItem - WebCore/loader/ProgressTracker.cpp:169
+
+        Inherits ThreadableLoaderClient class from Noncopyable because (its child class) 
+        MainThreadBridge is instantiated by 'new' in 
+        WebCore/loader/WorkerThreadableLoader.cpp:59 it is no need to be copyable.
+
+        ThreadableLoaderClient's inheriting has been changed to public.
+
+        * loader/ImageLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/RedirectScheduler.cpp:
+        * loader/Request.h:
+        * loader/ThreadableLoaderClient.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheStorage.h:
+
+2009-11-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        WebKit coding style fixes.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::mimeTypeCache):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Remove build failure introduced by earlier build fix.
+
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Is this the last build fix? grep tells me yes.
+
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Hopefully the last one.  Why aren't these autogenerated?
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setIndexedPropertiesToExternalArray):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Another chrome build fix.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Yet another chrome buildfix
+
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::constructCanvasArray):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Chrome build fix.
+
+        * bindings/v8/V8Index.h:
+
+2009-11-10  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30901
+        [Gtk] Need to de-lint the Atk a11y code
+
+        Removal of various and sundry style-violating nits.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-11-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        Fix playback rate setter by remembering the rate was changed. Also
+        correctly handle reverse playback by doing a seek from end to
+        beginning of the media.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Rename 3D Canvas related classes to use WebGL prefix
+        https://bugs.webkit.org/show_bug.cgi?id=29095
+
+        Automatic rename of all WebGL related types from Canvas* to
+        WebGL* per more recent version of the WebGL spec.
+
+        Due to the automatic rename I've removed the 600+ line change list.
+
+2009-11-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG feDisplacementMap is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=31255]
+
+        This is the implementation of the SVG filter effect
+        feDisplacementMap. 
+
+        Test: svg/filters/feDisplacementMap.svg
+
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply):
+
+2009-11-09  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add a comment about null strings and hash functions.
+        https://bugs.webkit.org/show_bug.cgi?id=29118
+
+        * platform/text/StringHash.h:
+
+2009-11-09  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Compiler warnings in InspectorResource.h
+        https://bugs.webkit.org/show_bug.cgi?id=29231
+
+        Fix compilation warnings by removing addition operation on an enum type.
+
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::):
+        (WebCore::InspectorResource::Changes::hasChange):
+        (WebCore::InspectorResource::Changes::set):
+        (WebCore::InspectorResource::Changes::setAll):
+
+2009-11-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler and Dan Bernstein.
+
+        <rdar://problem/7328395>
+        https://bugs.webkit.org/show_bug.cgi?id=31277
+
+        When an object tag's style changes (for example when child nodes are added/removed),
+        reuse its Frame (if it has one) instead of creating multiple Frames.
+
+        Test: fast/dom/HTMLObjectElement/children-changed.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestObject):
+
+2009-11-09  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Moved macro MMP_RULES (LINKEROPTION) into symbian instead of symbian-sbsv2,
+        since adjustment of RW-section base address will be needed for all new symbian
+        tool chains, specifically for arm and gcc compilation targets.
+        Also, change target address to 0xE00000 to be sufficient for all targets.
+
+        * WebCore.pro:
+
+2009-11-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Crash when inspecting
+        WebCore\manual-tests\inspector\dom-mutation.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=31259
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Few classes have virtual functions but non-virtual destructor
+        https://bugs.webkit.org/show_bug.cgi?id=31269
+
+        No new tests as there is no functional change.
+
+        * platform/qt/QWebPageClient.h:
+        (QWebPageClient::~QWebPageClient): Add virtual destructor.
+
+2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Allow setting HTTP headers with empty value in XMLHTTPRequest
+        https://bugs.webkit.org/show_bug.cgi?id=31140
+
+        QtNetwork interprets null string as request to remove the header, not add it.
+        Replace null values with empty values before passing them to QtNetwork.
+
+        Test: http/tests/xmlhttprequest/xmlhttprequest-setrequestheader-no-value.html
+
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::ResourceRequest::toNetworkRequest):
+
+2009-11-09  Vadim Zeitlin  <vadim@wxwidgets.org>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Fix handling of alpha channel when using wxWidgets 2.9: it was
+        simply ignored before resulting in transparent areas being black in PNG
+        images for example.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30823
+
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=31040
+
+        No new tests as there is no functional change.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyleSelector):
+        * editing/TextIterator.cpp:
+        (WebCore::pushFullyClippedState):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::appendTrailingWhitespace):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process):
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::computeHash):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * svg/SVGAnimateElement.cpp:
+        (WebCore::parseNumberValueAndUnit):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::startedActiveInterval):
+        * svg/SVGPreserveAspectRatio.cpp:
+        (WebCore::SVGPreserveAspectRatio::getCTM):
+
+2009-11-09  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Win chromium is slow to draw transparent texts
+        https://bugs.webkit.org/show_bug.cgi?id=31258
+
+        Clip graphics context to reduce calculation.
+
+        No new tests because this change only affects performance.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+
+2009-11-09  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        showTree(CounterNode*) generates too little info and has too many spaces.
+        https://bugs.webkit.org/show_bug.cgi?id=31212
+
+        No new tests as the change has no functional effect it is just for
+        improved debugging.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+        Changed to also show addresses of parent, next and previous
+        siblings.
+
+2009-11-09  Stuart Morgan  <stuartmorgan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Moves Mac implementation of setUseSecureKeyboardEntry to Frame.cpp and
+        enables it PLATFORM(CHROMIUM) in addition to PLATFORM(MAC).
+
+        https://bugs.webkit.org/show_bug.cgi?id=31083
+
+        No new tests; implementation is unchanged.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setUseSecureKeyboardEntry):
+        * page/mac/FrameMac.mm:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Make XP_UNIX tests consistent
+        https://bugs.webkit.org/show_bug.cgi?id=31250
+
+        No new tests as there is no functional change.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect): Test if XP_UNIX is defined
+        instead of the value of the macro
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded): Test if the XP_UNIX is
+        defined instead of using the PLATFORM macro to be consistent
+        (WebCore::PluginView::getValue): Ditto.
+
+2009-11-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Thunk to the main thread from ~Database to deref Database's m_document.
+
+        If the Database was the Document's last referrer, then ~Document occurs on the
+        Database thread, and ASSERT(!m_styleRecalcTimer.isActive()) hits a main thread
+        ASSERT in debug builds.
+
+        * storage/Database.cpp:
+        (WebCore::derefDocument):
+        (WebCore::Database::~Database):
+
+2009-11-09  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Track "can have scrollbar" state within FrameView independently of the
+        individual scrollbar states in ScrollView.
+
+        rdar://problem/7215132, https://bugs.webkit.org/show_bug.cgi?id=29167
+        REGRESSION (r48064): mint.com loses scrollbars after coming out of
+        edit mode.
+
+        rdar://problem/7314421, https://bugs.webkit.org/show_bug.cgi?id=30517
+        REGRESSION (r48064): Extra scroll bars in GarageBand Lesson Store.
+
+        Test: fast/overflow/scrollbar-restored.html
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::resetScrollbars):
+        (WebCore::FrameView::setCanHaveScrollbars):
+        (WebCore::FrameView::updateCanHaveScrollbars):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+
+2009-11-09  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: CSS syntax highlighter doesn't recognize negative numbers
+        https://bugs.webkit.org/show_bug.cgi?id=31257
+
+        * inspector/front-end/SourceFrame.js:
+
+2009-11-09  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Debugger shortcuts (F8, F10, F11) have no effect if the Console view is open
+        https://bugs.webkit.org/show_bug.cgi?id=31252
+
+        Route F1-F12 keypresses in the Console view to the current panel if there is one.
+
+        Test: manual-tests/inspector/debugger-shortcuts-with-console-opened.html
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._promptKeyDown):
+        * inspector/front-end/utilities.js:
+        ():
+        * manual-tests/inspector/debugger-shortcuts-with-console-opened.html: Added.
+
+2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Pass credentials provided by XMLHTTPRequest to the network request.
+        https://bugs.webkit.org/show_bug.cgi?id=31208
+
+        After r42483, the credentials are no longer passed to the network request
+        in the URL of the request.
+        Pass the credentials from XMLHTTPRequest to the network request, the same
+        way that other ports do.
+
+        After this patch LayoutTests/http/xmlhttprequest/basic-auth.html passes.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Unreviewed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31161
+
+        Roll back r50657 because it breaks the MAC builds.
+
+        * loader/ImageLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/RedirectScheduler.cpp:
+        * loader/Request.h:
+        * loader/ThreadableLoaderClient.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/icon/IconDatabaseClient.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the part of loader directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31161
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and these are no need to be copyable:
+
+        class Request - WebCore/loader/loader.cpp:100
+        struct ScheduledRedirection - WebCore/loader/RedirectScheduler.cpp:164
+        class IconDatabaseClient - WebCore/loader/icon/IconDatabase.cpp:89
+        class ApplicationCacheStorage - WebCore/loader/appcache/ApplicationCacheStorage.cpp:1121
+        class ApplicationCacheHost -  WebCore/loader/DocumentLoader.cpp:151
+        class ImageEventSender - WebCore/loader/ImageLoader.cpp:54
+        struct ProgressItem - WebCore/loader/ProgressTracker.cpp:169
+
+        Inherits ThreadableLoaderClient class from Noncopyable because (its child class) 
+        MainThreadBridge is instantiated by 'new' in 
+        WebCore/loader/WorkerThreadableLoader.cpp:59 it is no need to be copyable.
+
+        ThreadableLoaderClient's inheriting has been changed to public.
+
+        * loader/ImageLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/RedirectScheduler.cpp:
+        * loader/Request.h:
+        * loader/ThreadableLoaderClient.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/icon/IconDatabaseClient.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's DocLoader
+        https://bugs.webkit.org/show_bug.cgi?id=31163
+
+        Inherits DocLoader class from Noncopyable because it is
+        instantiated by 'new' in WebCore/dom/Document.cpp:370 and 
+        it is no need to be copyable.
+
+        * loader/DocLoader.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's Tokenizer
+        https://bugs.webkit.org/show_bug.cgi?id=31162
+
+        Inherits Tokenizer class from Noncopyable because (its child class)
+        ImageTokenizer instantiated by 'new' in WebCore/loader/ImageDocument.cpp:178 
+        and it is no need to be copyable.
+
+        * dom/Tokenizer.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's DeleteButtonController
+        https://bugs.webkit.org/show_bug.cgi?id=31105
+
+        Inherits DeleteButtonController class from Noncopyable because it is 
+        instantiated by 'new' in WebCore/editing/Editor.cpp:919 and
+        it is no need to be copyable.  
+
+        * editing/DeleteButtonController.h:
+
+2009-11-09  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Expose Page::tabKeyCyclesThroughElements in the API
+        https://bugs.webkit.org/show_bug.cgi?id=30482
+
+        Expose Page::tabKeyCyclesThroughElements as a property of
+        WebKitWebView.
+
+        No new tests; fast/events/keypress-insert-tab.html is no longer skipped.
+
+        * platform/gtk/KeyEventGtk.cpp: Correct m_text for tab key presses.
+        (WebCore::singleCharacterString):
+
+2009-11-09  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Fix a crasher that occurred with text which included newline
+        chars in the markup.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (convertUniCharToUTF8):
+
+2009-11-05  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] The XML tokenizer reports a parse error twice if it occurs before the document element is found.
+        https://bugs.webkit.org/show_bug.cgi?id=31144
+
+        XMLTokenizer::doEnd() uses an additional logic to report a parse failure in
+        documents that end prematurely but are not considered invalid by QXmlStream.
+        This is to stay compatible with the libxml2 implementation.
+        However, that code path would be also hit in situations when it should not,
+        i.e. the error would have already been caught and handled. As a result, the
+        same error would be reported twice.
+
+        No new tests, because the problem is already covered by
+        fast/parser/xml-declaration-missing-ending-mark.html.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::doEnd):
+
+2009-11-08  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Inspector should support copy() in the command line
+        https://bugs.webkit.org/show_bug.cgi?id=31238
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::copyText): Added.
+        * inspector/InspectorBackend.h: Added copyText
+        * inspector/InspectorBackend.idl: Added copyText
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._copy): Added.
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-11-08  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 WorkerContextExecutionProxy does not handle SharedWorkers
+        https://bugs.webkit.org/show_bug.cgi?id=31226
+
+        Now checks to see what type of context is active and creates the
+        appropriate wrapper (DEDICATEDWORKERCONTEXT vs SHAREDWORKERCONTEXT).
+
+        Added support for converting to SharedWorkers and SharedWorkerContexts.
+
+        Test: Existing layout tests cover this case (start passing in Chrome).
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        Now generates the right type of DOMWrapper for SharedWorkerContexts.
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        Added support for SHAREDWORKERCONTEXT.
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+        Added support for SharedWorker and SharedWorkerContext.
+
+2009-11-08  Johnny Ding  <johnnyding.webkit@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31224
+        [V8] Return StyleSheet object instead of HTMLStyleElement w/document.styleSheets named property getter.
+
+        Test: fast/dom/StyleSheet/get-stylesheet-byname.html
+
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+
+2009-11-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: "Search again" on scripts panel switches
+        to the script this search started with.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31243
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.jumpToNextSearchResult):
+
+2009-11-08  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Simplify Icon interface.
+        https://bugs.webkit.org/show_bug.cgi?id=31154
+
+        - Remove Icon::createIconForFile().  createIconForFiles() covers
+          createIconForFile()'s role.
+        - Remove FileChooser::chooseIcon()
+        - Change the parameter types of FileChooser constructor and the
+          factory method, String -> const Vector<String>&, in order to
+          support initialization with multiple files.
+        - Remove the icon loading code in IconChromiumWin.cpp, which
+          doesn't work because of the sandbox.
+
+        No tests because it's just a refactoring.
+
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::FileChooser):
+        (WebCore::FileChooser::create):
+        (WebCore::FileChooser::chooseFile):
+        (WebCore::FileChooser::chooseFiles):
+        * platform/FileChooser.h:
+        * platform/graphics/Icon.h:
+        * platform/graphics/chromium/IconChromiumLinux.cpp:
+        * platform/graphics/chromium/IconChromiumMac.cpp:
+        * platform/graphics/chromium/IconChromiumWin.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/gtk/IconGtk.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/haiku/IconHaiku.cpp:
+        * platform/graphics/mac/IconMac.mm:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/win/IconWin.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/wx/IconWx.cpp:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::RenderFileUploadControl):
+
+2009-11-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31098
+
+        Allows same-origin plugin-based content to load.
+
+        Test: http/tests/security/xssAuditor/object-src-inject.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc): Modified to call XSSAuditor::isSameOriginResource.
+        (WebCore::XSSAuditor::canLoadObject): Ditto.
+        (WebCore::XSSAuditor::canSetBaseElementURL): Ditto. 
+        (WebCore::XSSAuditor::isSameOriginResource): Added.
+        * page/XSSAuditor.h:
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseDate): Changed this to not
+        use a date parser that needs ExecState passed.
+        
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        Build fix for https://bugs.webkit.org/show_bug.cgi?id=31219
+        Clean up GraphicsContext's current concept of ColorSpace
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+
+2009-11-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] committing style edit
+        clears elements panel selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31242
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.update):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2009-11-08  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Holger Freyther.
+
+        ResourceRequest to be class instead of struct
+        https://bugs.webkit.org/show_bug.cgi?id=30670
+
+        Started as a compilation fix for Symbian where the compiler makes a distinction between
+        class and struct in function argument signatures.
+        Changed all forward declarations of ResourceRequest to have class in the forward
+        declaration instead of struct and changed the definition of ResourceRequest to be class
+        and added access qualifiers where missing. Additionally two references of friend
+        struct ResourceRequestBase changed to class instead.
+
+        * history/HistoryItem.h:
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.h:
+        * loader/DocumentThreadableLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/MainResourceLoader.h:
+        * loader/ResourceLoadNotifier.h:
+        * loader/SubresourceLoader.h:
+        * loader/SubresourceLoaderClient.h:
+        * loader/ThreadableLoader.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCache.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * platform/CrossThreadCopier.h:
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleClient.h:
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/cf/ResourceRequest.h:
+        * platform/network/cf/ResourceRequestCFNet.h:
+        * platform/network/chromium/ResourceRequest.h:
+        * platform/network/curl/ResourceRequest.h:
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/soup/ResourceRequest.h:
+        * xml/XMLHttpRequest.h:
+
+2009-11-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7363434> Crash inside RenderObject::localToAbsolute
+        below FrameView::layout
+        https://bugs.webkit.org/show_bug.cgi?id=31093
+
+        Test: fast/block/positioning/relative-positioned-inline-container.html
+
+        In <http://trac.webkit.org/changeset/19148>, setStaticY() was changed
+        to mark the object for layout, doing so without marking its ancestors.
+        However, RenderBlock::skipLeadingWhitespace and
+        RenderBlock::skipTrailingWhitespace() call setStaticY() on a relative-
+        positioned inline container, causing it to be marked for layout without
+        ever going back to give it layout, and thus layout could end with a
+        dirty object still in the tree, leading to all sorts of badness.
+
+        The fix is to revert setStaticY() to not marking the object dirty, and
+        instead do it in the call sites that require it, which are in
+        RenderBlock and RenderFlexibleBox.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderLayer.cpp:
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::setStaticY):
+
+2009-11-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20780
+        
+        Fixes an issue where the onchange event handler is not fired when the 
+        input field is autocompleted.
+        
+        We cannot test this using DRT since DRT cannot emulate autocompletion.
+        So, a manual-test is included.
+
+        Tests: manual-tests/autocompletion-fire-onchange.html
+
+        * manual-tests/autocompletion-fire-onchange.html: Added.
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-11-07  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Mark redrawn areas on image surfaces as dirty.
+
+        This is required to conform to the Cairo API, but is currently only
+        used by debugging tools like cairo-trace.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        (WebCore::putImageData):
+
+2009-11-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30878
+        [Gtk] atk_text_get_text() fails in entries when the end_offset is -1
+
+        If the end_offset is -1, use the String length as the end_offset.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_text):
+
+2009-11-06  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31219 Clean up 
+        GraphicsContext's current concept of ColorSpace
+
+        ColorSpace is now called ColorType. The variables on the state we 
+        appropriately re-named as well. I removed strokeColorSpace() and 
+        fillColorSpace() from GraphicsContext since they were never called. 
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokeColor):
+        (WebCore::GraphicsContext::setFillColor):
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::):
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::calculateDrawingMode):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-11-06  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31177>.
+        Web Inspector: Bind backspace to delete cookies and DOM Storage.
+        
+        Refactor editing code from DOMStorageDataGrid to DataGrid, so other
+        places in the inspector can use editing in DataGrid (added a FIXME for
+        some stuff that needs to be generalized).
+        
+        Also added deleting functionality to DataGrid, and implemented it for
+        Cookies and DOM Storage. The reason this patch is so big is because of
+        the refactoring of editing code, which won't be used yet in a cross-datagrid
+        way, but should be able to.
+        
+        Additionally, moved the callbacks members from DOMStorageDataGrid to
+        DOMStorageItemsView, which allowed us to delete DOMStorageDataGrid, to 
+        make the architecture of DOM Storage look a lot more like the Cookies view.
+        
+        Lastly, added a preventDefault call in ElementsTreeOutline to prevent the 
+        inspector from beeping at you when you delete an element.
+
+        * WebCore.gypi: Removed DOMStorageDataGrid.
+        * WebCore.vcproj/WebCore.vcproj: Removed DOMStorageDataGrid.
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+        (WebInspector.CookieItemsView.prototype._deleteCookieCallback):
+        * inspector/front-end/DOMStorageDataGrid.js: Removed.
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
+        (WebInspector.DOMStorageItemsView.prototype._deleteButtonClicked):
+        (WebInspector.DOMStorageItemsView.prototype._refreshButtonClicked):
+        (WebInspector.DOMStorageItemsView.prototype._editingCallback):
+        (WebInspector.DOMStorageItemsView.prototype.deleteSelectedRow):
+        (WebInspector.DOMStorageItemsView.prototype._deleteCallback):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGrid.prototype._ondblclick): Moved from DOMStorageDataGrid to DataGrid + Refactoring.
+        (WebInspector.DataGrid.prototype._startEditingColumnOfDataGridNode): Ditto.
+        (WebInspector.DataGrid.prototype._startEditing): Ditto.
+        (WebInspector.DataGrid.prototype._editingCommitted.moveToNextIfNeeded): Ditto.
+        (WebInspector.DataGrid.prototype._editingCommitted): Ditto.
+        (WebInspector.DataGrid.prototype._editingCancelled): Ditto.
+        (WebInspector.DataGrid.prototype.handleKeyEvent): Added case for delete/backspace.
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent): Added preventDefault call.
+        * inspector/front-end/WebKit.qrc: Removed DOMStorageDataGrid.
+        * inspector/front-end/inspector.html: Removed DOMStorageDataGrid.
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: added an ExecState parameter.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=31197
+        Implemented a timezone cache not based on Mac OS X's notify_check API.
+
+        Updated for JavaScriptCore internal API change.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue): Updated for namespace change.
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseDate): Pass 0 for ExecState, since we don't have one.
+        (This function probably shouldn't be using a JavaScript date parser
+        to begin with, but oh well.)
+
+2009-11-06  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        The associated webkit bug is https://bugs.webkit.org/show_bug.cgi?id=31067,
+        which affects Chromium only.
+        
+        Changes to V8HTMLDocumentCustom.cpp are as below:-
+        1. The HTMLDocumentOpen function would cause a crash in Chromium if
+           there was no calling javascript context. We now check for this case
+           and pass in NULL to the HTMLDocument::open function which can handle
+           a NULL document parameter.
+        2. The other functions like HTMLDocumentWrite, HTMLDocumentWriteln, etc
+           had ASSERTS for a NULL caller frame, which was bogus as it would crash
+           anyway. We now check for this case and return a failure.
+           
+        Changes to V8DOMWindowCustom.cpp are as below:-
+        1. Instead of failing the window.open call made by NPAPI for lack of a
+           calling javascript context, we now use the entered context as the calling
+           context.
+
+        Tests: plugins/document-open.html
+               plugins/window-open.html
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-06  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Geolocation error code UNKNOWN_ERROR is deprecated.
+        https://bugs.webkit.org/show_bug.cgi?id=31184
+
+        Remove this error code from PositionError, both for use from C++ code and from the JS object.
+
+        Updated fast/dom/Geolocation/error.html to test this.
+
+        * page/PositionError.h: Modified.
+        (WebCore::PositionError::): Remove ErrorCode::UNKNOWN_ERROR.
+        * page/PositionError.idl: Modified. Remove UNKNOWN_ERROR constant.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::startRequest): Replace UNKNOWN_ERROR with POSITION_UNAVAILABLE.
+        * platform/gtk/GeolocationServiceGtk.cpp: Modified.
+        (WebCore::GeolocationServiceGtk::startUpdating): Replace UNKNOWN_ERROR with POSITION_UNAVAILABLE.
+
+2009-11-06  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        feMorphology filter is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=5863]
+
+        The Implementation of feMorphology.
+        
+        Test: We have allready a test for feMorphology
+              svg/W3C-SVG-1.1/filters-morph-01-f.svg
+
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
+
+2009-11-06  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        V8DOMWindowCustom.cpp is missing WEB_SOCKETS guard on include.
+        https://bugs.webkit.org/show_bug.cgi?id=31209
+
+        Build fix only. No new tests possible.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Modified. Added WEB_SOCKETS guard on inclue of WebSockets.h.
+
+2009-11-06  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by David Levin.
+
+        V8 bindings do not support SharedWorkers as event targets
+        https://bugs.webkit.org/show_bug.cgi?id=31199
+
+        No new tests because existing layout tests suffice (they currently
+        crash on Chromium)
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        Added clause to create a DOM wrapper for SharedWorkers.
+
+2009-11-06  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Do not unnecessarly synchronzie in weak reference callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=31191
+
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::handleWeakObject):
+
+2009-11-06  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix resource content search.
+        https://bugs.webkit.org/show_bug.cgi?id=31202
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelineGraph.prototype.refresh):
+
+2009-11-05  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix ASSERT(currentStyle = renderStyle()).
+        https://bugs.webkit.org/show_bug.cgi?id=31152
+
+        * dom/Element.cpp:
+        (WebCore::Element::pseudoStyleCacheIsInvalid): We should have used "==" instead of "=".
+
+2009-11-05  Alpha Lam  <hclam@chromium.org>
+
+        Revert 50562 because it broke Chromium. Not reviewed since this is a build fix and revert.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::V8GCController::gcEpilogue):
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+
+2009-11-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Cross-domain access to stylesheet text should not be allowed
+        https://bugs.webkit.org/show_bug.cgi?id=20527
+
+        Check whether whether the current document can read the cssRules from
+        the style sheet.  Firefox throws a security error here, but we return
+        null instead because that's what we usually do in these cases.
+
+        Test: http/tests/security/cannot-read-cssrules-redirect.html
+              http/tests/security/cannot-read-cssrules.html
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::cssRules):
+
+2009-11-05  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        If the Geolocation service fails to start, invoke the error callback asynchronously.
+        https://bugs.webkit.org/show_bug.cgi?id=28276
+
+        All Geolocation callbacks must be invoked asynchronously.
+        See http://www.w3.org/TR/geolocation-API/#geolocation_interface
+
+        No new tests possible with current LayoutTestController.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::getCurrentPosition): Modified. Asserts that startRequest returned a notifier.
+        (WebCore::Geolocation::watchPosition): Modified. Asserts that startRequest returned a notifier.
+        (WebCore::Geolocation::startRequest): Modified. If the Geolocation service fails to start, set a fatal error on the notifier.
+
+2009-11-05  Chris Jerdonek  <chris.jerdonek@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Removed the "this is part of the KDE project" comments from 
+        all *.h, *.cpp, *.idl, and *.pm files.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31167
+        
+        The maintenance and architecture page in the project wiki lists
+        this as a task.
+        
+        This change includes no changes or additions to test cases 
+        since the change affects only comments.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/scripts/IDLStructure.pm:
+        * css/CSSInheritedValue.cpp:
+        * css/CSSInitialValue.cpp:
+        * css/CSSMediaRule.cpp:
+        * css/CSSNamespace.h:
+        * css/CSSProperty.cpp:
+        * css/CSSProperty.h:
+        * css/CSSRuleList.cpp:
+        * css/CSSRuleList.h:
+        * css/CSSSelector.h:
+        * css/CSSValueList.cpp:
+        * css/FontValue.cpp:
+        * css/MediaFeatureNames.cpp:
+        * css/MediaFeatureNames.h:
+        * css/Pair.h:
+        * css/SVGCSSStyleSelector.cpp:
+        * css/ShadowValue.cpp:
+        * css/StyleSheet.cpp:
+        * css/StyleSheetList.cpp:
+        * css/maketokenizer:
+        * dom/BeforeUnloadEvent.cpp:
+        * dom/BeforeUnloadEvent.h:
+        * dom/CSSMappedAttributeDeclaration.cpp:
+        * dom/EventNames.cpp:
+        * dom/EventTarget.cpp:
+        * dom/MappedAttributeEntry.h:
+        * dom/MouseRelatedEvent.h:
+        * dom/RangeException.h:
+        * dom/StyleElement.h:
+        * dom/Tokenizer.h:
+        * html/HTMLHeadElement.h:
+        * html/HTMLHeadingElement.cpp:
+        * html/HTMLHeadingElement.h:
+        * html/HTMLHtmlElement.h:
+        * html/HTMLImageLoader.h:
+        * html/HTMLMetaElement.h:
+        * html/HTMLModElement.cpp:
+        * html/HTMLModElement.h:
+        * html/HTMLOptionsCollection.cpp:
+        * html/HTMLPlugInElement.cpp:
+        * html/HTMLPreElement.cpp:
+        * html/HTMLPreElement.h:
+        * html/HTMLTableCellElement.cpp:
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.cpp:
+        * html/HTMLTableColElement.h:
+        * html/HTMLTablePartElement.cpp:
+        * html/HTMLTablePartElement.h:
+        * html/HTMLTitleElement.h:
+        * page/MouseEventWithHitTestResults.h:
+        * platform/StaticConstructors.h:
+        * platform/text/AtomicStringImpl.h:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        * rendering/AutoTableLayout.h:
+        * rendering/CounterNode.cpp:
+        * rendering/EllipsisBox.cpp:
+        * rendering/EllipsisBox.h:
+        * rendering/FixedTableLayout.cpp:
+        * rendering/FixedTableLayout.h:
+        * rendering/HitTestRequest.h:
+        * rendering/HitTestResult.h:
+        * rendering/InlineRunBox.h:
+        * rendering/PointerEventsHitRules.cpp:
+        * rendering/PointerEventsHitRules.h:
+        * rendering/RenderBR.cpp:
+        * rendering/RenderBR.h:
+        * rendering/RenderButton.cpp:
+        * rendering/RenderButton.h:
+        * rendering/RenderFieldset.cpp:
+        * rendering/RenderFrameSet.cpp:
+        * rendering/RenderListItem.cpp:
+        * rendering/RenderTableRow.cpp:
+        * rendering/RenderView.h:
+        * rendering/RootInlineBox.h:
+        * rendering/SVGInlineTextBox.cpp:
+        * rendering/SVGInlineTextBox.h:
+        * rendering/TableLayout.h:
+        * rendering/break_lines.h:
+        * rendering/style/SVGRenderStyle.cpp:
+        * rendering/style/SVGRenderStyle.h:
+        * rendering/style/SVGRenderStyleDefs.cpp:
+        * rendering/style/SVGRenderStyleDefs.h:
+        * svg/GradientAttributes.h:
+        * svg/LinearGradientAttributes.h:
+        * svg/PatternAttributes.h:
+        * svg/RadialGradientAttributes.h:
+        * svg/SVGAElement.cpp:
+        * svg/SVGAngle.idl:
+        * svg/SVGAnimateColorElement.cpp:
+        * svg/SVGAnimateColorElement.h:
+        * svg/SVGAnimateElement.cpp:
+        * svg/SVGAnimateElement.h:
+        * svg/SVGAnimateTransformElement.h:
+        * svg/SVGAnimatedPathData.cpp:
+        * svg/SVGAnimatedPathData.h:
+        * svg/SVGAnimatedPoints.cpp:
+        * svg/SVGAnimatedPoints.h:
+        * svg/SVGAnimationElement.cpp:
+        * svg/SVGCircleElement.cpp:
+        * svg/SVGClipPathElement.cpp:
+        * svg/SVGColor.cpp:
+        * svg/SVGColor.idl:
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGCursorElement.cpp:
+        * svg/SVGDefsElement.cpp:
+        * svg/SVGDescElement.cpp:
+        * svg/SVGDescElement.h:
+        * svg/SVGDocument.idl:
+        * svg/SVGElement.idl:
+        * svg/SVGElementInstanceList.cpp:
+        * svg/SVGElementInstanceList.h:
+        * svg/SVGEllipseElement.cpp:
+        * svg/SVGExternalResourcesRequired.cpp:
+        * svg/SVGFEBlendElement.cpp:
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEComponentTransferElement.cpp:
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFECompositeElement.cpp:
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFEFloodElement.cpp:
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFuncAElement.cpp:
+        * svg/SVGFEFuncAElement.h:
+        * svg/SVGFEFuncBElement.cpp:
+        * svg/SVGFEFuncBElement.h:
+        * svg/SVGFEFuncGElement.cpp:
+        * svg/SVGFEFuncGElement.h:
+        * svg/SVGFEFuncRElement.cpp:
+        * svg/SVGFEFuncRElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEImageElement.cpp:
+        * svg/SVGFEMergeElement.cpp:
+        * svg/SVGFEMergeElement.h:
+        * svg/SVGFEMergeNodeElement.cpp:
+        * svg/SVGFEOffsetElement.cpp:
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFETileElement.cpp:
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETurbulenceElement.cpp:
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFilterElement.cpp:
+        * svg/SVGGElement.cpp:
+        * svg/SVGGradientElement.cpp:
+        * svg/SVGHKernElement.idl:
+        * svg/SVGLangSpace.cpp:
+        * svg/SVGLangSpace.h:
+        * svg/SVGLength.cpp:
+        * svg/SVGLength.h:
+        * svg/SVGLength.idl:
+        * svg/SVGLengthList.cpp:
+        * svg/SVGLengthList.h:
+        * svg/SVGLineElement.cpp:
+        * svg/SVGLinearGradientElement.h:
+        * svg/SVGList.h:
+        * svg/SVGListTraits.h:
+        * svg/SVGLocatable.h:
+        * svg/SVGMaskElement.cpp:
+        * svg/SVGMatrix.idl:
+        * svg/SVGMetadataElement.cpp:
+        * svg/SVGMetadataElement.h:
+        * svg/SVGMetadataElement.idl:
+        * svg/SVGNumber.idl:
+        * svg/SVGNumberList.cpp:
+        * svg/SVGNumberList.h:
+        * svg/SVGPaint.cpp:
+        * svg/SVGPathElement.cpp:
+        * svg/SVGPathSeg.h:
+        * svg/SVGPathSegArc.cpp:
+        * svg/SVGPathSegArc.h:
+        * svg/SVGPathSegClosePath.cpp:
+        * svg/SVGPathSegClosePath.h:
+        * svg/SVGPathSegCurvetoCubic.cpp:
+        * svg/SVGPathSegCurvetoCubic.h:
+        * svg/SVGPathSegCurvetoCubicSmooth.cpp:
+        * svg/SVGPathSegCurvetoCubicSmooth.h:
+        * svg/SVGPathSegCurvetoQuadratic.cpp:
+        * svg/SVGPathSegCurvetoQuadratic.h:
+        * svg/SVGPathSegCurvetoQuadraticSmooth.cpp:
+        * svg/SVGPathSegCurvetoQuadraticSmooth.h:
+        * svg/SVGPathSegLineto.cpp:
+        * svg/SVGPathSegLineto.h:
+        * svg/SVGPathSegLinetoHorizontal.cpp:
+        * svg/SVGPathSegLinetoHorizontal.h:
+        * svg/SVGPathSegLinetoVertical.cpp:
+        * svg/SVGPathSegLinetoVertical.h:
+        * svg/SVGPathSegMoveto.cpp:
+        * svg/SVGPathSegMoveto.h:
+        * svg/SVGPatternElement.cpp:
+        * svg/SVGPoint.idl:
+        * svg/SVGPointList.cpp:
+        * svg/SVGPointList.h:
+        * svg/SVGPolyElement.cpp:
+        * svg/SVGPolygonElement.cpp:
+        * svg/SVGPolygonElement.h:
+        * svg/SVGPolylineElement.cpp:
+        * svg/SVGPolylineElement.h:
+        * svg/SVGPreserveAspectRatio.cpp:
+        * svg/SVGPreserveAspectRatio.h:
+        * svg/SVGRadialGradientElement.h:
+        * svg/SVGRect.idl:
+        * svg/SVGRectElement.cpp:
+        * svg/SVGRenderingIntent.h:
+        * svg/SVGSVGElement.idl:
+        * svg/SVGScriptElement.cpp:
+        * svg/SVGSetElement.cpp:
+        * svg/SVGSetElement.h:
+        * svg/SVGStopElement.cpp:
+        * svg/SVGStringList.cpp:
+        * svg/SVGStringList.h:
+        * svg/SVGStylable.cpp:
+        * svg/SVGStylable.h:
+        * svg/SVGStyleElement.cpp:
+        * svg/SVGStyleElement.h:
+        * svg/SVGStyledElement.h:
+        * svg/SVGStyledLocatableElement.cpp:
+        * svg/SVGStyledLocatableElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        * svg/SVGStyledTransformableElement.h:
+        * svg/SVGSwitchElement.cpp:
+        * svg/SVGSymbolElement.cpp:
+        * svg/SVGTRefElement.cpp:
+        * svg/SVGTSpanElement.cpp:
+        * svg/SVGTSpanElement.h:
+        * svg/SVGTests.h:
+        * svg/SVGTextElement.cpp:
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPathElement.cpp:
+        * svg/SVGTextPositioningElement.cpp:
+        * svg/SVGTextPositioningElement.h:
+        * svg/SVGTitleElement.cpp:
+        * svg/SVGTitleElement.h:
+        * svg/SVGTransform.cpp:
+        * svg/SVGTransform.h:
+        * svg/SVGTransform.idl:
+        * svg/SVGTransformList.cpp:
+        * svg/SVGTransformList.h:
+        * svg/SVGTransformable.h:
+        * svg/SVGURIReference.h:
+        * svg/SVGUnitTypes.h:
+        * svg/SVGUseElement.cpp:
+        * svg/SVGViewElement.cpp:
+        * svg/SVGZoomAndPan.cpp:
+        * svg/SVGZoomAndPan.h:
+        * svg/SVGZoomEvent.cpp:
+
+2009-11-05  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        REGRESSION Clean up security origin usage in DOM Storage.
+        https://bugs.webkit.org/show_bug.cgi?id=31188
+
+        Clean up security origin usage in DOM Storage.  This fixes a bug in my
+        refactoring here: https://bugs.webkit.org/show_bug.cgi?id=31149
+
+        Instead of having StorageAreaSync's constructor (which is called in the
+        constructor for StorageAreaImpl) calling a method on StoargeAreaImpl to get the
+        database identifier, simply have StorageAreaImpl pass the identifier into
+        StorageAreaSync.
+
+        No test because there's no change in externally observable behavior.
+
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::create):
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        * storage/StorageAreaSync.h:
+
+2009-11-05  Scott Violet  <sky@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need notification of scrolling frame
+        https://bugs.webkit.org/show_bug.cgi?id=31145
+
+        Adds FrameLoaderClient::didChangeScrollOffset that is called when
+        the frame scrolls. This will be used to know when history state
+        needs to be updated.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didChangeScrollOffset):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::valueChanged):
+
+2009-11-05  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Update bindings to use new API for external arrays
+        https://bugs.webkit.org/show_bug.cgi?id=31181
+
+        No new tests; covered by existing WebGL tests.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setIndexedPropertiesToExternalArray):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/custom/V8CanvasArrayCustom.h:
+        (WebCore::constructCanvasArray):
+
+2009-11-05  Alpha Lam  <hclam@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        50561 introduces a custom method for SVGMatrix, we need to implement
+        this in V8.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Adding definition for V8SVGMatrixMultiply.
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Implement V8SVGMatrixMultiply according to the same method in JSC.
+
+2009-11-05  Jeremy Orlow  <jorlow@chromium.org>
+
+        Revert 50569 since it broke QT.  Build fix and just a revert, so no review.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setSessionStorageEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::sessionStorageEnabled):
+
+2009-11-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        REGRESSION: Web Inspector doesn't show CSS rules properly for iframes
+
+        https://bugs.webkit.org/show_bug.cgi?id=30884
+
+        Test: inspector/styles-iframe.html
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getStyles):
+        (InjectedScript.getComputedStyle):
+        (InjectedScript.addStyleSelector):
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.TestController.prototype.runAfterPendingDispatches):
+        (WebInspector.evaluateForTestInFrontend.invokeMethod):
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-11-05  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Geoffrey Garen and Dimitri Glazkov.
+
+        Rehashing of EventListenerMap leads to loss of EvenListenerList.
+        https://bugs.webkit.org/show_bug.cgi?id=31027
+
+        Tested by new fast/events/event-listener-map-rehash-crash.html.
+
+        EventListenerMap modified to store pointers to listener vectors:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTargetData::~EventTargetData):
+        (WebCore::EventTarget::addEventListener):
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::fireEventListeners):
+        (WebCore::EventTarget::getEventListeners):
+        (WebCore::EventTarget::removeAllEventListeners):
+        * dom/EventTarget.h:
+
+        Usages updated after interface changes:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::transferEventListenersToShadowTree):
+
+2009-11-05  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        Add missing initialization for m_createdByParser.
+        https://bugs.webkit.org/show_bug.cgi?id=31089
+
+        Test: fast/dom/beforeload/pi-before-load.xhtml in Valgrind
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::ProcessingInstruction):
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage runtime flag changes
+        https://bugs.webkit.org/show_bug.cgi?id=30602
+
+        Part 2/2.
+
+        Revert my changes to Settings and instead implement DOM Storage enabling via
+        the methods agreed upon in https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        This stuff was (intentionally) never exposed to web pages or DRT, so there's no
+        LayoutTest visible changes and thus no tests.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        * page/DOMWindow.idl:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * storage/Storage.cpp:
+        (WebCore::Storage::setLocalStorageAvailable):
+        (WebCore::Storage::localStorageAvailable):
+        (WebCore::Storage::setSessionStorageAvailable):
+        (WebCore::Storage::sessionStorageAvailable):
+        * storage/Storage.h:
+
+2009-11-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Bug 31108 - [V8] REGRESSION: Pause on exception is broken
+        https://bugs.webkit.org/show_bug.cgi?id=31108
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-11-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        We should not bubble up events if we drag something to an iframe that
+        has an invalid source.
+        https://bugs.webkit.org/show_bug.cgi?id=30469
+
+        Test: http/tests/misc/bubble-drag-events.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDragAndDropForTarget):
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::cancelDragAndDrop):
+        (WebCore::EventHandler::performDragAndDrop):
+        * page/EventHandler.h:
+        (WebCore::EventHandler::):
+
+2009-11-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: speed up Timelines Clear by a factor of thousands.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31160
+
+        * inspector/front-end/utilities.js:
+        (Element.prototype.removeChildren):
+
+2009-11-05  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        If high memory usage is detected, hint to V8 that it might be due
+        to external objects retained by V8 objects.
+        https://bugs.webkit.org/show_bug.cgi?id=31051
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GetMemoryUsageInMB):
+        (WebCore::V8GCController::gcEpilogue):
+        (WebCore::V8GCController::checkMemoryUsage):
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+
+2009-11-05  Jeff Schiller  <codedread@gmail.com>
+
+        Reviewed by Simon Fraser.
+
+        Correct order of matrix multiplication for SVGMatrix.
+        https://bugs.webkit.org/show_bug.cgi?id=16062
+
+        Test: svg/dom/SVGMatrix-interface.xhtml
+
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::multiply):
+        * svg/SVGMatrix.idl:
+
+2009-11-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make resource-related records in timeline
+        actually take some time.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31139
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Simplify LocalStorageThread
+        https://bugs.webkit.org/show_bug.cgi?id=30935
+
+        This is a re-submit of 50519.  LocalStorageTask should have never been ref
+        counted.  I've removed that and switched a PassRefPtr over to a PassOwnPtr.
+
+        On LocalStoragethread: Remove reference counting. Get rid of locking. Make some
+        of the method names a bit more clear. Assert proper thread usage. Join rather
+        than detaching the thread and doing an ad-hoc form of join. Avoid touching
+        variables on the background thread when simple to do so.  Also create a generic
+        scheduleTask function rather than one for each task.
+
+        No behavior should have changed.
+
+        * storage/LocalStorageTask.h:
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::create):
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::~LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::threadEntryPointCallback):
+        (WebCore::LocalStorageThread::threadEntryPoint):
+        (WebCore::LocalStorageThread::scheduleTask):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Calling databaseIdentifier on LocalStorage's background thread is not safe.
+        https://bugs.webkit.org/show_bug.cgi?id=31149
+
+        Calling SecurityOrigin::databaseIdentifier on LocalStorage's background thread
+        is not safe.  databaseIdentifier does a bunch of string concatenation which
+        ref-counts StringImpls in some cases.  This was caught by valgrind thread
+        sanitizer: http://code.google.com/p/chromium/issues/detail?id=25645
+
+        There's no way to test for such racyness, unfortunately.
+
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::fullDatabaseFilename):
+        * storage/StorageSyncManager.h:
+
+2009-11-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Clean up StorageAreaSync
+        https://bugs.webkit.org/show_bug.cgi?id=31100
+
+        Major fixes: Break the ref count cycle for StorageArea on the main
+        thread, not the background thread since the latter is not safe.
+        Length() needs to block on the import completing.
+
+        Small fixes: setItem needs to handle the copy on write case even if it
+        has an exception.  setItem and removeItem should just bail from the
+        the function if the value hasn't changed rather than wrapping the end
+        in an if block.  Clear should only send an event if it wasn't already
+        cleared.  StorageAreaSync should assert that the final sync was
+        scheduled.
+
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::length):
+          Forgot to block on the import.
+        (WebCore::StorageAreaImpl::key):
+        (WebCore::StorageAreaImpl::setItem):
+          Handle the copy on write case even when there's an exception.
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::performImport):
+        (WebCore::StorageAreaSync::markImported):
+        (WebCore::StorageAreaSync::blockUntilImportComplete):
+        * storage/StorageAreaSync.h:
+
+2009-11-05  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CachedResource
+        https://bugs.webkit.org/show_bug.cgi?id=31114
+
+        Inherits CachedResource class from Noncopyable because its (its child
+        class) CachedCSSStyleSheet instantiated by 'new' in WebCore/loader/Cache.cpp:75 
+        and it is no need to be copyable.
+
+        * loader/CachedResource.h:
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Separate the difference between HAVE(CGINTERPOLATION_MEDIUM), which
+        is true when building on 10.6 or later, and USE(CGINTERPOLATION_MEDIUM)
+        which is true when targeting 10.6 or later.
+
+        HAVE(CGINTERPOLATION_MEDIUM) indicates that kCGInterpolationMedium
+        is present in the CGInterpolationQuality enum, and must be handled
+        by a switch that has cases for each enumerated value.
+
+        USE(CGINTERPOLATION_MEDIUM) indicates that the product will only run
+        on 10.6 or later, and that CoreGraphics will understand when
+        InterpolationMedium is mapped to kCGInterpolationMedium at runtime.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+
+2009-11-04  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix buffer overrun in WebCore::Page::userStyleSheetLocationChanged()
+        https://bugs.webkit.org/show_bug.cgi?id=31138
+
+        Test: LayoutTests/platform/mac/fast/loader/user-stylesheet-fast-path.html in Valgrind
+
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+
+2009-11-04  Timothy Hatcher  <timothy@apple.com>
+
+        Update the Web Inspector Timeline panel to better match the mock-up.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31150
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype._dragWindow):
+        (WebInspector.TimelinePanel.prototype._resizeWindowLeft):
+        (WebInspector.TimelinePanel.prototype._resizeWindowRight):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+        (WebInspector.TimelineCategoryGraph):
+        * inspector/front-end/inspector.css:
+
+2009-11-05  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25439
+        Deleting when in front of a block image removes character from previous paragraph
+
+        Added editing/deleting/25439-{1,2,3}.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): Block images, tables and HRs cannot 
+        be made inline with other content.  Instead of merging, just move the caret to just before 
+        the selection we deleted.
+        * editing/htmlediting.cpp:
+        (WebCore::firstInSpecialElement): Added a FIXME.  This function begins iterating up from pos.node(), which 
+        doesn't necessarily contain pos (suppose pos was [img, 0]).
+        (WebCore::lastInSpecialElement): Ditto.
+        (WebCore::isRenderedAsNonInlineTableImageOrHR): Moved from visible_units.cpp.  Added a check for non-inline images.
+        * editing/htmlediting.h:
+        * editing/visible_units.cpp:
+        (WebCore::startOfParagraph): Use moved/renamed function.  Removed FIXME.  The problem causing 
+        5027702 is now squarely in first/lastInSpecialElement
+        (WebCore::endOfParagraph): Ditto.
+        
+2009-11-04  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Hang in Mail on attempting to change indent level.
+        <rdar://problem/7131805>
+        https://bugs.webkit.org/show_bug.cgi?id=31127
+
+        The hang was caused by an infinite loop inside outdentRegion.
+        The code did not account for the fact that, when a list item
+        contains multiple paragraphs, outdent moves all paragraphs at
+        once, invalidating some of the positions we keep track of in the loop.
+        Some code refactoring has also been done to minimize duplicated code.
+        
+        Test: editing/execCommand/outdent-multiparagraph-list.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Moved code in common with
+        outdentRegion to doApply.
+        (WebCore::IndentOutdentCommand::outdentRegion): Fixed endless loop.
+        (WebCore::IndentOutdentCommand::doApply): Some code refactoring.
+        * editing/IndentOutdentCommand.h: Added VisiblePosition parameters to
+        indentRegion and outdentRegion.
+
+2009-11-04  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Volume slider doesn't have a thumb
+        https://bugs.webkit.org/show_bug.cgi?id=31135
+
+        Fixed an incorrect if statement that prevents volume slider
+        being updated.
+
+        The statement checks if the slider value equals to the current
+        volume value of the media control to avoid updating the volume
+        slider. Updating the volume slider control shouldn't be within
+        this condition because we explicitly set them to be equals
+        during creation of the controls and also when mouse events are
+        received on the volume control.
+
+        No new tests because existing code breaks:
+        LayoutTests/media/video-volume-slider.html
+
+        It should now start passing on Chromium.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::update):
+        Update the volume slider regardless of the current volume value
+        of the media control.
+
+2009-11-04  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by David Levin.
+
+        Need to properly disable applicationCache at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=30417
+
+        Adding applicationCacheEnabled bit to V8 RuntimeEnabledFeatures.
+
+        No new exposed functionality, so no new tests.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setApplicationCacheEnabled):
+        (WebCore::RuntimeEnabledFeatures::applicationCacheEnabled):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+
+2009-11-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31143
+        Assertion failure in CredentialStorage::set() when proxy credentials are being set
+
+        No test, cannot test proxy behavior.
+
+        * platform/network/CredentialStorage.cpp: (WebCore::CredentialStorage::set): Account for the
+        possibility of null url. Release mode changes are likely inconsequential - e.g. we used to
+        add "://" to origin set, which is weird, but safe.
+
+2009-11-04  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Leftover Breakpoints in the Sidebar Pane
+        https://bugs.webkit.org/show_bug.cgi?id=30659
+
+        No new tests.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+
+2009-11-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Use a different method to identify the webkit port in
+        InspectorBackent::platform().
+        This corrects the inspector expected behavior with Qt on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=31116
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::platform):
+        (WebCore::InspectorBackend::port):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/InspectorControllerStub.js:
+        (.WebInspector.InspectorControllerStub.prototype.port):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.toolbarDragStart):
+
+2009-11-04  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Update Cairo requirement to 1.6.
+
+        Also remove all conditional code and workarounds for older versions of
+        Cairo.
+        In particular, gain image quality by removing the use of
+        CAIRO_FILTER_NEAREST when rendering images and use the default
+        bilinear filter instead.
+        https://bugs.webkit.org/show_bug.cgi?id=19266
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::boundingRect):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::paintMozWidget):
+
+2009-11-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Restore removed string conversion after cleanup.
+
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::computeHash):
+
+2009-11-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Need to implement ARIA role="combobox"
+        https://bugs.webkit.org/show_bug.cgi?id=31096
+
+        Test: accessibility/aria-combobox.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isComboBox):
+        (WebCore::AccessibilityObject::isExpanded):
+        (WebCore::AccessibilityObject::expandObject):
+        (WebCore::AccessibilityObject::increment):
+        (WebCore::AccessibilityObject::decrement):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::expandObject):
+        (WebCore::AccessibilityRenderObject::isExpanded):
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityPerformShowMenuAction]):
+        * html/HTMLAttributeNames.in:
+
+2009-11-04  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes naming inconsistencies in TimelineRecordFactory.
+        https://bugs.webkit.org/show_bug.cgi?id=31132
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::willEvaluateScript):
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeRecord):
+        (WebCore::TimelineRecordFactory::createXHRLoadRecord):
+        (WebCore::TimelineRecordFactory::createEvaluateScriptRecord):
+        (WebCore::TimelineRecordFactory::createMarkTimelineRecord):
+        (WebCore::TimelineRecordFactory::createResourceSendRequestRecord):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseRecord):
+        (WebCore::TimelineRecordFactory::createResourceFinishRecord):
+        (WebCore::TimelineRecordFactory::createPaintRecord):
+        * inspector/TimelineRecordFactory.h:
+
+2009-11-04  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Followon to bug 31080, which protects Timeline
+        instrumentation in the case where InspectorTimelineAgent
+        is enabled or disabled during an event dispatch.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31121
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::inspectorTimelineAgent):
+        (WebCore::DOMWindow::dispatchEvent):
+        * page/DOMWindow.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Revert 50519 while I work out what went wrong.
+
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::create):
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::localStorageThreadStart):
+        (WebCore::LocalStorageThread::localStorageThread):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-11-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add basic support for resource events and marks.
+        Couple of drive-by fixes. Enabling the panel!
+
+        https://bugs.webkit.org/show_bug.cgi?id=31130
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelineCategoryTreeElement.prototype._onCheckboxClicked):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-11-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Simplify LocalStorageThread
+        https://bugs.webkit.org/show_bug.cgi?id=30935
+
+        On LocalStoragethread: Remove reference counting. Get rid of locking. Make some
+        of the method names a bit more clear. Assert proper thread usage. Join rather
+        than detaching the thread and doing an ad-hoc form of join. Avoid touching
+        variables on the background thread when simple to do so.  Also create a generic
+        scheduleTask function rather than one for each task.
+
+        No behavior should have changed.
+
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::create):
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::~LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::threadEntryPointCallback):
+        (WebCore::LocalStorageThread::threadEntryPoint):
+        (WebCore::LocalStorageThread::scheduleTask):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-11-04  Vadim Zeitlin  <vadim@wxwidgets.org>
+
+        Reviewed by Eric Seidel.
+
+        [wx] Small cleanup: avoid unnecessary wxString::mb_str() calls.
+
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::computeHash):
+
+2009-11-04  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Adds lightweight network resources to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=31065
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createResourceSendRequestTimelineRecord):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseTimelineRecord):
+        (WebCore::TimelineRecordFactory::createResourceFinishTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+
+2009-11-04  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] ASSERT failure when receiving 401 HTTP Authentication response.
+        https://bugs.webkit.org/show_bug.cgi?id=31077
+
+        Allow sending the response body under the same conditions that we
+        allow it to finish without reporting an error.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-11-04  Adam Roben  <aroben@apple.com>
+
+        Sort WebCore.base.exp
+
+        Rubber-stamped by Dan Bernstein.
+
+        * WebCore.base.exp: Sorted.
+
+2009-11-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed rollout.
+
+        Revert r50496 because it broke all layout tests on QtBuildBot.
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::fontCache):
+        (WebCore::FontCache::FontCache):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        (WebCore::FontPlatformDataCacheKey::isHashTableDeletedValue):
+        (WebCore::FontPlatformDataCacheKey::):
+        (WebCore::FontPlatformDataCacheKey::operator==):
+        (WebCore::FontPlatformDataCacheKey::hash):
+        (WebCore::FontPlatformDataCacheKey::computeHash):
+        (WebCore::FontPlatformDataCacheKey::hashTableDeletedSize):
+        (WebCore::FontPlatformDataCacheKeyHash::hash):
+        (WebCore::FontPlatformDataCacheKeyHash::equal):
+        (WebCore::FontPlatformDataCacheKeyTraits::emptyValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::constructDeletedValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::isDeletedValue):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        (WebCore::FontCache::getCachedFontData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::releaseFontData):
+        (WebCore::FontCache::purgeInactiveFontData):
+        (WebCore::FontCache::addClient):
+        (WebCore::FontCache::removeClient):
+        (WebCore::FontCache::invalidate):
+        * platform/graphics/qt/FontFallbackListQt.cpp: Added.
+        (WebCore::FontFallbackList::FontFallbackList):
+        (WebCore::FontFallbackList::invalidate):
+        (WebCore::FontFallbackList::releaseFontData):
+        (WebCore::FontFallbackList::determinePitch):
+        (WebCore::FontFallbackList::fontDataAt):
+        (WebCore::FontFallbackList::fontDataForCharacters):
+        (WebCore::FontFallbackList::setPlatformFont):
+        * platform/graphics/qt/FontPlatformData.h:
+        (WebCore::FontPlatformData::pixelSize):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-11-04  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31044
+        [Gtk] assertion when webkit_accessible_get_index_in_parent attempts to get parent of the web view
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkParentOfWebView):
+        (webkit_accessible_get_index_in_parent):
+        (webkit_accessible_get_parent):
+
+2009-11-04  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15914
+        [GTK] Implement Unicode functionality using GLib
+
+        Initial version of this patch by Jürg Billeter and Naiem Shaik.
+        Patch 2/4 - Moving TextCodecs to GLib
+        
+        Added probing for a hard-coded lists of text encodings.
+        The basis of this list is taken from the encodings supported by iconv,
+        then extended by e.g. tis-620, windows-1251, euc-kr, windows-1253 and
+        a number of Chinese ones.
+
+        Probing is necessary with the current design of text codecs
+        as iconv/GLib do not support enumerating available encodings.
+
+        * GNUmakefile.am:
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+        * platform/text/gtk/TextCodecGtk.cpp: Added.
+        (WebCore::):
+        (WebCore::newTextCodecGtk):
+        (WebCore::TextCodecGtk::isEncodingAvailable):
+        (WebCore::TextCodecGtk::registerEncodingNames):
+        (WebCore::TextCodecGtk::registerCodecs):
+        (WebCore::TextCodecGtk::registerBaseEncodingNames):
+        (WebCore::TextCodecGtk::registerBaseCodecs):
+        (WebCore::TextCodecGtk::registerExtendedEncodingNames):
+        (WebCore::TextCodecGtk::registerExtendedCodecs):
+        (WebCore::TextCodecGtk::TextCodecGtk):
+        (WebCore::TextCodecGtk::~TextCodecGtk):
+        (WebCore::TextCodecGtk::releaseIConv):
+        (WebCore::TextCodecGtk::createIConvDecoder):
+        (WebCore::TextCodecGtk::createIConvEncoder):
+        (WebCore::TextCodecGtk::decode):
+        (WebCore::TextCodecGtk::encode):
+        * platform/text/gtk/TextCodecGtk.h: Added.
+
+2009-11-04  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Enable DOM clipboard and drag-and-drop access
+        https://bugs.webkit.org/show_bug.cgi?id=30623
+
+        Unify redudant methods which will always return the same value.
+
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-11-04  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31035
+        [GTK] some accessibility tests hitting assertion in debug builds
+
+        Removes the assertions in webkit_accessible_ref_child; adds sanity checks.
+        Any app or AT can attempt to ref a child at a bogus index.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_ref_child):
+
+2009-11-04  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        [gtk] Use gst_element_class_set_details_simple()
+
+        Cosmetic change, just code simplification
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_base_init):
+2009-11-04  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds paint rectangle information to TimelineAgent's didPaint callback.
+        https://bugs.webkit.org/show_bug.cgi?id=31087
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willPaint):
+        * inspector/InspectorTimelineAgent.h:
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createPaintTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+
+2009-11-04  Jaime Yap  <jaimeyap@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        This patch adds API to the console object for annotating the
+        inspector timeline. This allows developers to mark logical
+        checkpoints in their apps and have them overlaid in the event
+        record tree.
+
+        tests updated: LayoutTests/fast/dom/Window/window-properties.html
+        https://bugs.webkit.org/show_bug.cgi?id=31082
+
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::markTimeline):
+        * inspector/InspectorController.h:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didMarkTimeline):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createMarkTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * page/Console.cpp:
+        (WebCore::Console::markTimeline):
+        * page/Console.h:
+        * page/Console.idl:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Unreviewed build fix for WebInspector with Qt build.
+
+        Simply re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-11-02  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Handle fonts like the other ports
+
+        Remove FontFallbackListQt and rely on the common FontFallbackList
+        to handle the fonts. FontCache and FontPlatformData have been
+        updated to work with the common FontFallbackList.
+
+        In the previous implementation, FontPlatformDataCacheKey
+        was a clone of FontPlatformData with the hashing
+        capabilities added in order to use it as a key in the cache's
+        hashmap. FontPlatformData has been modified to handle the hashing
+        function directly so the data are not copied twice in memory.
+
+        FontFallbackList::fontDataAt() from FontFallbackListQt was a copy of
+        code from FontCache::getFontData() and FontFallbackList::fontDataAt().
+        The behavior is similar except currFamily->family().length() was
+        not tested and the fallback fonts selector were not used.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29856
+
+        Test: svg/text/text-font-invalid.html
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        Removed. We now use the implementation from FontFallbackList.cpp
+        * platform/graphics/qt/FontPlatformData.h:
+        Add hashing capabilities to be able to use the data with the FontCache.
+        This was previously done in FontCacheQt.cpp
+        (WebCore::FontPlatformData::FontPlatformData):
+        Added a boolean to identify deleted value in the hash table.
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::operator==):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Leopard build fix
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac):
+        (WebCore::core):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix an assertion failure in core(NSURLProtectionSpace *) by handling NTLM
+        authentication in AuthenticationMac
+
+        * platform/network/mac/AuthenticationMac.mm:
+
+2009-11-03  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes a problem where the timeline instrumentation crashes if
+        timeline profiling is enabled or disabled in the middle of an
+        event dispatch.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31080
+
+        Test: inspector/timeline-trivial.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::processingUserGestureEvent):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::fired):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Allow a frame to go back to copy-on-scroll when it ceases being overlapped
+
+        The code was not testing slow-scrolling frames for overlappedness, thinking the answer
+        would not matter. That is not the case if the only reason for the slow-scrolling is
+        being overlapped.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped): Added. Returns whether there is any
+        reason besides being overlapped that the frame would need to fully repaint on scroll.
+        * page/FrameView.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint): Use useSlowRepaintsIfNotOverlapped().
+
+2009-11-03  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Qt build fix.
+
+        Need to use right capitalization for include file.
+
+        * page/Navigator.cpp:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Migrate from top bar filters to check boxes in Timeline.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31081
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.showCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.hideCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.filter):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineCategoryTreeElement.prototype._onCheckboxClick):
+        (WebInspector.TimelineCategoryGraph.prototype.clearChunks):
+        (WebInspector.TimelineCategoryGraph.prototype.set dimmed):
+        * inspector/front-end/inspector.css:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: clear overview on Clear action and panel reset.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31078
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+
+2009-11-03  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Imported action and rules python files that WebCore.gyp depends on. 
+        These files used to live in chromium.org and deal mostly with auto-generation
+        of code by wrapping existing webkit perl scripts.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31071
+
+        * WebCore.gyp/WebCore.gyp: Fixed paths in actions and rules.
+        * WebCore.gyp/scripts/action_csspropertynames.py: Added.
+        * WebCore.gyp/scripts/action_cssvaluekeywords.py: Added.
+        * WebCore.gyp/scripts/action_makenames.py: Added.
+        * WebCore.gyp/scripts/action_maketokenizer.py: Added.
+        * WebCore.gyp/scripts/action_useragentstylesheets.py: Added.
+        * WebCore.gyp/scripts/rule_binding.py: Added.
+        * WebCore.gyp/scripts/rule_bison.py: Added.
+        * WebCore.gyp/scripts/rule_gperf.py: Added.
+
+2009-11-03  Bradley Green  <brg@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Implement window.navigator.registerProtocolHandler in webkit,
+        https://bugs.webkit.org/b/29651
+
+        Also implemented its sister API window.navigator.registerContentHandler.
+
+        These methods are as described in the HTML5 specification which can be
+        found here,
+        http://dev.w3.org/html5/spec/Overview.html#dom-navigator-registerprotocolhandler
+        http://dev.w3.org/html5/spec/Overview.html#dom-navigator-registercontenthandler
+
+        As specified in the document, the behavior of the browser is determined
+        by the current registered handler.  The state of a registered handler
+        can change at any time, with the user clearing a registered handler,
+        registering a different page as handler, or deferring the hander to the
+        OS.  If webkit was to track the state of the currently registered
+        handlers, it would need more APIs and complexity to keep in sync with
+        user actions reported to webkit from the UA.  For simplicity, the state
+        of protocol handlers should be kept isolated from webkit and webkit only
+        notifies the UA that a page has made the call.  The UA is then
+        responsible for correctly handling the registerProtocolHandler call and
+        the redirects which result from registration.
+
+        We do however follow the specification in insuring that the reserved
+        schemes and mimeTypes are not passed to the UA as custom handler
+        registration tests.  We also insure that the "%s" token is present as
+        required by the specification.
+
+        Updated test expectations for window.clientInformation and navigator
+        objects.
+
+        Tests: fast/dom/registerContentHandler.html
+               fast/dom/registerProtocolHandler.html
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::registerProtocolHandler):
+        (WebCore::Chrome::registerContentHandler):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::registerProtocolHandler):
+        (WebCore::ChromeClient::registerContentHandler):
+        * page/Navigator.cpp:
+        (WebCore::verifyCustomHandlerURL):
+        (WebCore::verifyProtocolHandlerScheme):
+        (WebCore::Navigator::registerProtocolHandler):
+        (WebCore::verifyProtocolHandlerMimeType):
+        (WebCore::Navigator::registerContentHandler):
+        * page/Navigator.h:
+        * page/Navigator.idl:
+
+2009-11-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31079 - Remove #include "Page.h" from Document.h
+
+        No new tests. (No change in functionality)
+
+        * dom/Document.cpp:
+        (WebCore::Document::inspectorTimelineAgent): Moved from Document.h
+        * dom/Document.h:
+
+        Include "Page.h" directly:
+        * html/HTMLVideoElement.cpp:
+        * loader/RedirectScheduler.cpp:
+        * page/History.cpp:
+        * rendering/MediaControlElements.cpp:
+        * storage/StorageAreaImpl.cpp:
+
+2009-11-03  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: hover over JS "things" in source and see their values
+        https://bugs.webkit.org/show_bug.cgi?id=30913
+
+        * inspector/front-end/SourceFrame.js:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: update timeline content boundaries on timer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31072
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelinePanel.prototype._setWindowPosition):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson and Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31070
+        Fix <rdar://problem/7194735> Crashes at RenderText::RenderText()
+        Fix <rdar://problem/6937089> Crashes at RenderWidget::destroy()
+
+        Tests: plugins/attach-during-destroy.html
+               plugins/destroy-reentry.html
+
+        These crashes were caused by plug-in code running during detach(),
+        causing re-entry into RenderWidget::destroy() in one case and a call
+        into attach() in the other. The fix is to prevent plug-in code from
+        being called at certain unsafe times (during attach(), detach(), and
+        recalcStyle()) by deferring changes to the widget hierarchy.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle): Suspend widget hierarchy updates
+            during style recalculation.
+
+        * dom/Element.cpp:
+        (WebCore::Element::attach): Suspend widget hierarchy updates during
+            attach().
+        (WebCore::Element::detach): Suspend widget hierarchy updates during
+            detach().
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::widgetNewParentMap): Returns a static map of pending changes
+            to the widget hierarchy.
+        (WebCore::RenderWidget::suspendWidgetHierarchyUpdates): Increments the
+            suspend count.
+        (WebCore::RenderWidget::resumeWidgetHierarchyUpdates): Decrements the
+            suspend count. If the count is going to be zero, updates the widget
+            hierarchy by executing the pending changes stored in the map.
+        (WebCore::moveWidgetToParentSoon): Updates the widget hierarchy
+            immediately or makes or updates an entry in the map, depending on
+            whether updates are suspended.
+        (WebCore::RenderWidget::destroy): Removed earlier bandaid fix for
+            <rdar://problem/6937089>.
+        (WebCore::RenderWidget::setWidgetGeometry): Assert that widget updates
+            are not suspended, because this function updates the widget’s
+            bounds, which can result in arbitrary native and JavaScript code
+            execution. I think this assertion is true thanks to some deferred-
+            update mechanisms that have already been deployed in other places
+            in the code.
+        (WebCore::RenderWidget::setWidget): Call moveWidgetToParentSoon instead
+            of changing the widget hierarchy directly.
+        * rendering/RenderWidget.h: Declared suspendWidgetHierarchyUpdates()
+            and resumeWidgetHierarchyUpdates().
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: only show timeline records that contribute
+        to the current window.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31069
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelineGraph):
+        (WebInspector.TimelineGraph.prototype.refresh):
+
+2009-11-03  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Watch expression editor should stay open after Add button was clicked
+        https://bugs.webkit.org/show_bug.cgi?id=31049
+
+        No new tests, was a regression, use existing manual test.
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.addExpression):
+
+2009-11-03  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix an off-by-one in the CSS lexer that causes memory corruption in
+        hard-to-trigger circumstances.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30827
+
+        Test: fast/css/end-of-buffer-crash.html
+
+        * css/maketokenizer: Add comments, fix off-by-one.
+
+2009-11-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash due to double-destroy related to CSS run-in property
+        https://bugs.webkit.org/show_bug.cgi?id=31034
+        rdar://problem/7328458
+
+        Test: fast/css/run-in-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::destroy): Reorder destruction so the
+        continuation is destroyed after anonymous children. See comment
+        in the code for more details of why this is right.
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::destroy): Ditto.
+
+2009-11-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix exception in ElementsPanel.js when moving pointer out of crumbs and window
+
+        There might be no new node under mouse if the pointer is moved out of the window
+        in which case we get an exception.
+        https://bugs.webkit.org/show_bug.cgi?id=31061
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._mouseMovedOutOfCrumbs):
+
+2009-11-03  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the dom directory of WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31053
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and these are no need to be copyable:
+
+        class EventNames - 'new' call: WebCore/platform/ThreadGlobalData.cpp:73
+        struct PerformTaskContext - 'new' call: WebCore/dom/Document.cpp:4581
+        class EventData - 'new' call: WebCore/dom/MessagePortChannel.cpp:38
+        struct NodeListsNodeData - 'new' call: WebCore/dom/NodeRareData.h:51 
+        struct EventTargetData - 'new' call: WebCore/dom/NodeRareData.h:100
+        class NodeRareData - 'new' call: WebCore/dom/Node.cpp:552
+
+        Inherits QualifiedName class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/editing/markup.cpp:319
+
+        * dom/Document.cpp:
+        * dom/EventNames.h:
+        * dom/EventTarget.h:
+        * dom/MessagePortChannel.h:
+        * dom/NodeRareData.h:
+        * dom/QualifiedName.h:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement timeline summary panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31064
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._createOverview):
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelineCategoryGraph):
+        (WebInspector.TimelineCategoryGraph.prototype.get graphElement):
+        (WebInspector.TimelineCategoryGraph.prototype.addChunk):
+        (WebInspector.TimelineCategoryGraph.prototype.clearChunks):
+        (WebInspector.TimelineGraph.prototype.refresh):
+        * inspector/front-end/inspector.css:
+
+2009-11-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Toggle off 'Search for node' when the Inspector window is closing
+
+        Searching for node should be toggled off when the Inspector window is closed,
+        in a platform-independent manner.
+        https://bugs.webkit.org/show_bug.cgi?id=31059
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+
+2009-11-03  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Prepare for heap profiles upstreaming:
+        - pass profile type id from InspectorController;
+        - this makes WebInspector.CPUProfile redundant---removed;
+        - support multiple profile types when populating profiles.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31052
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView.profileCallback):
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileView.prototype._sortData):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-11-03  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        UMR in WebCore::AccessibilityRenderObject::children(); m_childrenDirty uninitialized in constructor
+        https://bugs.webkit.org/show_bug.cgi?id=31063
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement Timeline Window, wire it to the bottom timeline.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31056
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.get items):
+        (WebInspector.AbstractTimelinePanel.prototype.createInterface):
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.AbstractTimelinePanel.prototype.invalidateAllItems):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.adjustScrollPosition):
+        (WebInspector.AbstractTimelinePanel.prototype.addExtraDivider):
+        (WebInspector.TimelineGrid):
+        (WebInspector.TimelineGrid.prototype.get itemsGraphsElement):
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        (WebInspector.TimelineGrid.prototype.addExtraDivider):
+        (WebInspector.TimelineGrid.prototype.setScrollAndDividerTop):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.get _resources):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get categories):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._createOverview):
+        (WebInspector.TimelinePanel.prototype.setSidebarWidth):
+        (WebInspector.TimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.TimelinePanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelinePanel.prototype._resizeWindow):
+        (WebInspector.TimelinePanel.prototype._windowResizeDragging):
+        (WebInspector.TimelinePanel.prototype._dragWindow):
+        (WebInspector.TimelinePanel.prototype._windowDragging):
+        (WebInspector.TimelinePanel.prototype._resizeWindowLeft):
+        (WebInspector.TimelinePanel.prototype._resizeWindowRight):
+        (WebInspector.TimelinePanel.prototype._setWindowPosition):
+        (WebInspector.TimelinePanel.prototype._endWindowDragging):
+        (WebInspector.TimelineCategoryTreeElement):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.get minimumBoundary):
+        (WebInspector.TimelineCalculator.prototype.get maximumBoundary):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        * inspector/front-end/inspector.css:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make QWebPluginDatabase private API for now.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30775
+
+        * WebCore.pro:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Extended the conversion of the WebCore ResourceRequest to the
+        QNetworkRequest with a mandatory originating object argument,
+        which is meant to be the QWebFrame the request belongs to.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::ResourceRequest::toNetworkRequest):
+
+2009-11-03  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: monitorEvent should be monitorEvents
+        https://bugs.webkit.org/show_bug.cgi?id=31042
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-11-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Antti Koivisto.
+
+        [Qt] Build fix for Windows CE
+
+        * plugins/PluginDatabase.cpp:
+
+2009-11-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by David Levin.
+
+        fix accessibility webkit-style-check errors
+        https://bugs.webkit.org/show_bug.cgi?id=29672
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::remove):
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        (WebCore::AXObjectCache::removeAXID):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::enableAccessibility):
+        (WebCore::AXObjectCache::enableEnhancedUserInterfaceAccessibility):
+        (WebCore::AXObjectCache::accessibilityEnabled):
+        (WebCore::AXObjectCache::accessibilityEnhancedUserInterfaceEnabled):
+        (WebCore::AXObjectCache::isIDinUse):
+        (WebCore::AXObjectCache::objectFromAXID):
+        (WebCore::AXObjectCache::):
+        (WebCore::AXObjectCache::handleActiveDescendantChanged):
+        (WebCore::AXObjectCache::handleAriaRoleChanged):
+        (WebCore::AXObjectCache::detachWrapper):
+        (WebCore::AXObjectCache::attachWrapper):
+        (WebCore::AXObjectCache::selectedChildrenChanged):
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postPlatformNotification):
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::cellForColumnAndRow):
+        * accessibility/AccessibilityAllInOne.cpp:
+        * accessibility/AccessibilityImageMapLink.cpp:
+        * accessibility/AccessibilityList.h:
+        (WebCore::AccessibilityList::isList):
+        * accessibility/AccessibilityListBox.cpp:
+        * accessibility/AccessibilityListBox.h:
+        (WebCore::AccessibilityListBox::isListBox):
+        * accessibility/AccessibilityListBoxOption.cpp:
+        * accessibility/AccessibilityListBoxOption.h:
+        (WebCore::AccessibilityListBoxOption::isListBoxOption):
+        * accessibility/AccessibilityMediaControls.h:
+        (WebCore::AccessibilityMediaControl::~AccessibilityMediaControl):
+        (WebCore::AccessibilityMediaTimeline::~AccessibilityMediaTimeline):
+        (WebCore::AccessibilityMediaTimeline::isMediaTimeline):
+        (WebCore::AccessibilityMediaControlsContainer::~AccessibilityMediaControlsContainer):
+        (WebCore::AccessibilityMediaControlsContainer::roleValue):
+        (WebCore::AccessibilityMediaControlsContainer::accessibilityIsIgnored):
+        (WebCore::AccessibilityMediaTimeDisplay::~AccessibilityMediaTimeDisplay):
+        (WebCore::AccessibilityMediaTimeDisplay::roleValue):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::parentObjectUnignored):
+        (WebCore::AccessibilityObject::rightLineVisiblePositionRange):
+        (WebCore::replacedNodeNeedsCharacter):
+        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
+        (WebCore::AccessibilityObject::lengthForVisiblePositionRange):
+        (WebCore::AccessibilityObject::actionVerb):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::PlainTextRange::isNull):
+        (WebCore::AccessibilityObject::isAccessibilityRenderObject):
+        (WebCore::AccessibilityObject::isAnchor):
+        (WebCore::AccessibilityObject::isAttachment):
+        (WebCore::AccessibilityObject::isHeading):
+        (WebCore::AccessibilityObject::isLink):
+        (WebCore::AccessibilityObject::isImage):
+        (WebCore::AccessibilityObject::isNativeImage):
+        (WebCore::AccessibilityObject::isImageButton):
+        (WebCore::AccessibilityObject::isPasswordField):
+        (WebCore::AccessibilityObject::isTextControl):
+        (WebCore::AccessibilityObject::isNativeTextControl):
+        (WebCore::AccessibilityObject::isWebArea):
+        (WebCore::AccessibilityObject::isCheckboxOrRadio):
+        (WebCore::AccessibilityObject::isListBox):
+        (WebCore::AccessibilityObject::isFileUploadButton):
+        (WebCore::AccessibilityObject::isProgressIndicator):
+        (WebCore::AccessibilityObject::isSlider):
+        (WebCore::AccessibilityObject::isControl):
+        (WebCore::AccessibilityObject::isList):
+        (WebCore::AccessibilityObject::isDataTable):
+        (WebCore::AccessibilityObject::isTableRow):
+        (WebCore::AccessibilityObject::isTableColumn):
+        (WebCore::AccessibilityObject::isTableCell):
+        (WebCore::AccessibilityObject::isFieldset):
+        (WebCore::AccessibilityObject::isGroup):
+        (WebCore::AccessibilityObject::isChecked):
+        (WebCore::AccessibilityObject::isEnabled):
+        (WebCore::AccessibilityObject::isSelected):
+        (WebCore::AccessibilityObject::isFocused):
+        (WebCore::AccessibilityObject::isHovered):
+        (WebCore::AccessibilityObject::isIndeterminate):
+        (WebCore::AccessibilityObject::isLoaded):
+        (WebCore::AccessibilityObject::isMultiSelect):
+        (WebCore::AccessibilityObject::isOffScreen):
+        (WebCore::AccessibilityObject::isPressed):
+        (WebCore::AccessibilityObject::isReadOnly):
+        (WebCore::AccessibilityObject::isVisited):
+        (WebCore::AccessibilityObject::isRequired):
+        (WebCore::AccessibilityObject::canSetFocusAttribute):
+        (WebCore::AccessibilityObject::canSetTextRangeAttributes):
+        (WebCore::AccessibilityObject::canSetValueAttribute):
+        (WebCore::AccessibilityObject::hasIntValue):
+        (WebCore::AccessibilityObject::accessibilityShouldUseUniqueId):
+        (WebCore::AccessibilityObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::parentObjectIfExists):
+        (WebCore::AccessibilityRenderObject::parentObject):
+        (WebCore::AccessibilityRenderObject::isMenuRelated):
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isFocused):
+        (WebCore::AccessibilityRenderObject::visiblePositionRangeForLine):
+        (WebCore::AccessibilityRenderObject::setSelectedVisiblePositionRange):
+        (WebCore::AccessibilityRenderObject::doAXRangeForLine):
+        (WebCore::AccessibilityRenderObject::doAXStringForRange):
+        (WebCore::AccessibilityRenderObject::accessibilityImageMapHitTest):
+        (WebCore::AccessibilityRenderObject::determineAriaRoleAttribute):
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        (WebCore::AccessibilityRenderObject::isPresentationalChildOfAriaRole):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+        (WebCore::AccessibilityRenderObject::actionVerb):
+        (WebCore::shouldReturnTagNameAsRoleForMSAA):
+        * accessibility/AccessibilityRenderObject.h:
+        (WebCore::AccessibilityRenderObject::isAccessibilityRenderObject):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation):
+        * accessibility/AccessibilitySlider.h:
+        (WebCore::AccessibilitySlider::~AccessibilitySlider):
+        (WebCore::AccessibilitySlider::roleValue):
+        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
+        (WebCore::AccessibilitySlider::isSlider):
+        (WebCore::AccessibilitySlider::canSetValueAttribute):
+        (WebCore::AccessibilitySliderThumb::~AccessibilitySliderThumb):
+        (WebCore::AccessibilitySliderThumb::roleValue):
+        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
+        (WebCore::AccessibilitySliderThumb::setParentObject):
+        (WebCore::AccessibilitySliderThumb::parentObject):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        * accessibility/AccessibilityTableColumn.cpp:
+        * accessibility/AccessibilityTableHeaderContainer.cpp:
+        (WebCore::AccessibilityTableHeaderContainer::addChildren):
+        * accessibility/AccessibilityTableRow.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.h:
+
+2009-11-02  Darin Fisher  <darin@chromium.org>
+
+        Fixing JSC build bustage.
+
+        * bindings/js/ScriptController.cpp: Added missing #include
+
+2009-10-30  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Give the FrameLoaderClient the ability to override Settings::isJavaScriptEnabled.
+        https://bugs.webkit.org/show_bug.cgi?id=30967
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::isEnabled):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isEnabled):
+        * bindings/v8/V8Proxy.cpp: Move implementation of isEnabled to ScriptController
+        * bindings/v8/V8Proxy.h: Ditto
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::allowJavaScript):
+        * platform/chromium/ChromiumBridge.h: Delete uiResourceProtocol function
+
+2009-11-02  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Mark Rowe.
+
+        Fix a typo in Mark's last commit.
+
+        * loader/archive/ArchiveFactory.cpp:
+        (WebCore::archiveMIMETypes):
+
+2009-11-02  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Brady Eidson.
+
+        Re-enable support for web archives on Windows.  It was mistakenly disabled in r50438.
+
+        * loader/archive/ArchiveFactory.cpp:
+        (WebCore::archiveMIMETypes):
+
+2009-11-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        PLATFORM(CF) should be set when building for Qt on Darwin
+        https://bugs.webkit.org/show_bug.cgi?id=23671
+
+        * WebCore.pro: Add SharedBufferCF.cpp and SmartReplaceCF.cpp
+        to the Darwin build.
+        * loader/archive/ArchiveFactory.cpp: Change the support for 
+        legacy WebArchive from all CF platforms to Mac and Chromium 
+        CF platforms.
+        (WebCore::archiveMIMETypes):
+        * platform/text/AtomicString.h: Remove PLATFORM(QT) &&
+        PLATFORM(DARWIN) test as it is redundant now.
+        * platform/text/PlatformString.h: Ditto.
+        * platform/text/StringImpl.h: Ditto.
+        * platform/text/cf/StringCF.cpp: Ditto.
+        * platform/text/cf/StringImplCF.cpp: Ditto.
+
+2009-11-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Actually declare getPluginMimeTypeFromExtension in a header.
+        https://bugs.webkit.org/show_bug.cgi?id=30985
+
+        Our current code does not conform to our style guide.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp:
+        * plugins/chromium/PluginDataChromium.cpp:
+        * plugins/chromium/PluginDataChromium.h: Added.
+
+2009-11-02  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7038305> REGRESSION (Safari 4.0.2 - ToT): After navigating back to a known phishy page, the "Ignore warning" button appears highlighted (along with the "Go Back" button)
+
+        This bug is timing dependent, and not always reproducible.  I could not think of a way to add a 
+        layout test that would demonstrate the problem and fix.
+
+        * platform/mac/ThemeMac.mm:
+        (WebCore::checkbox): Update style.
+        (WebCore::paintCheckbox): ditto.
+        (WebCore::radio): ditto.
+        (WebCore::paintRadio): ditto.
+        (WebCore::setupButtonCell): Added convenience method.
+        (WebCore::button): Use a separate NSButtonCell for defaultButtons and regular buttons.
+        (WebCore::paintButton): Don't check for the key window here.  Consider that when deciding if the button should have the default style in RenderTheme.
+        * rendering/RenderTheme.cpp: (WebCore::RenderTheme::isDefault): Only consider a button to be default if the page is active.  This fixes 
+        a problem I noticed where the button would flicker crazily if the page with the default button was in the background.
+
+2009-11-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Minor RenderWidget clean-up in preparation for deferring widget tree
+        mutation when it is not safe.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::RenderWidget): Initialize m_refCount to 1
+        instead of calling ref().
+        (WebCore::RenderWidget::destroy): Call setWidget(0) instead of
+        repeating what it does.
+        (WebCore::RenderWidget::setWidgetGeometry): Now returns a boolean
+        indicating whether the bounds have changed.
+        (WebCore::RenderWidget::setWidget): Replaced all-encompassing if
+        statement with an early return.
+        (WebCore::RenderWidget::updateWidgetPosition): Call setWidgetGeometry().
+        * rendering/RenderWidget.h:
+
+2009-11-02  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's DatabaseTracker and SQLTransactionClient
+        implementations.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30701
+
+        * storage/chromium: Added.
+        * storage/chromium/DatabaseObserver.h: Added.
+        * storage/chromium/DatabaseTrackerChromium.cpp: Added.
+        * storage/chromium/QuotaTracker.cpp: Added.
+        * storage/chromium/QuotaTracker.h: Added.
+        * storage/chromium/SQLTransactionClientChromium.cpp: Added.
+
+2009-11-02  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson and Dan Bernstein.
+
+        Safari crashes when calling execCommand on formatted html in special case
+        <rdar://problem/7318656>
+        https://bugs.webkit.org/show_bug.cgi?id=31023
+
+        Test: editing/execCommand/align-in-span.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock): Modified comment on containingBlock returning NULL.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setSelectionState): Added check for NULL return from containingBlock,
+        since it is possible when dealing with orphaned trees.
+
+2009-11-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Exception checks were being too aggressive
+        https://bugs.webkit.org/show_bug.cgi?id=31005
+
+        Several calls in CanvasRenderingContext3D are allowed to
+        have a null value passed, which indicated that the 
+        object is being unbound. Handle this case and the corresponding
+        null handling in GraphicsContext3DMac.
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::bindBuffer):
+        (WebCore::CanvasRenderingContext3D::bindFramebuffer):
+        (WebCore::CanvasRenderingContext3D::bindRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::framebufferRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::framebufferTexture2D):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3D::framebufferTexture2D):
+
+2009-11-02  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Each JS execution in console adds extra item into "scripts" combo
+        https://bugs.webkit.org/show_bug.cgi?id=30212
+
+        Added manual test
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * manual-tests/inspector/hidden-evals.html: Added.
+
+2009-11-02  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds a missed case for InspectorTimeline, DOMWindow dispatch of DOM events.
+        https://bugs.webkit.org/show_bug.cgi?id=31030
+
+        * dom/Node.cpp:
+        (WebCore::eventHasListeners): Checks DOMWindow for listeners.
+        (WebCore::Node::dispatchGenericEvent):
+
+2009-11-02  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove threadsafe refcounting from tasks used with WTF::MessageQueue.
+        https://bugs.webkit.org/show_bug.cgi?id=30612
+
+        No new tests since no new functionality. Storage, MessagePorts and Workers tests cover this.
+
+        There are a lot of files but most changes are simply replace RefPtr and PassRefPtr with
+        OwnPtr and PassOwnPtr when dealing with Tasks.
+
+        ScriptExecutionContext::Task, DatabaseTask and WorkerRunLoop::Task are no longer
+        threadsafe refcounted, but simply Noncopyable.
+
+        * dom/Document.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::PerformTaskContext::PerformTaskContext):
+        (WebCore::Document::postTask):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ProcessMessagesSoonTask::create):
+        * dom/ScriptExecutionContext.h:
+        * dom/default/PlatformMessagePortChannel.cpp:
+        (WebCore::PlatformMessagePortChannel::tryGetMessageFromRemote):
+        * dom/default/PlatformMessagePortChannel.h:
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::appendAndCheckEmpty):
+        * loader/FrameLoader.cpp:
+        (WebCore::HashChangeEventTask::create):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::CallCacheListenerTask::create):
+        * storage/Database.cpp:
+        (WebCore::Database::openAndVerifyVersion):
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::Database::scheduleTransaction):
+        (WebCore::Database::scheduleTransactionStep):
+        (WebCore::Database::tableNames):
+        * storage/DatabaseTask.h:
+        (WebCore::DatabaseOpenTask::create):
+        (WebCore::DatabaseCloseTask::create):
+        (WebCore::DatabaseTransactionTask::create):
+        (WebCore::DatabaseTableNamesTask::create):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThread):
+        (WebCore::DatabaseThread::scheduleTask):
+        (WebCore::DatabaseThread::scheduleImmediateTask):
+        (WebCore::SameDatabasePredicate::operator()):
+        * storage/DatabaseThread.h:
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        (WebCore::LocalStorageTask::createTerminate):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::localStorageThread):
+        * storage/LocalStorageThread.h:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::postTaskToLoader):
+        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
+        (WebCore::SharedWorkerConnectTask::create):
+        * workers/GenericWorkerTask.h:
+        (WebCore::GenericWorkerTask1::create):
+        (WebCore::GenericWorkerTask2::create):
+        (WebCore::GenericWorkerTask3::create):
+        (WebCore::GenericWorkerTask4::create):
+        (WebCore::GenericWorkerTask5::create):
+        (WebCore::GenericWorkerTask6::create):
+        (WebCore::GenericWorkerTask7::create):
+        (WebCore::GenericWorkerTask8::create):
+        (WebCore::createCallbackTask):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::postTask):
+        * workers/WorkerContext.h:
+        * workers/WorkerLoaderProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::WorkerExceptionTask::create):
+        (WebCore::WorkerContextDestroyedTask::create):
+        (WebCore::WorkerTerminateTask::create):
+        (WebCore::WorkerThreadActivityReportTask::create):
+        (WebCore::WorkerMessagingProxy::postTaskForModeToWorkerContext):
+        (WebCore::WorkerMessagingProxy::postTaskToLoader):
+        (WebCore::WorkerMessagingProxy::workerThreadCreated):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::ModePredicate::operator()):
+        (WebCore::WorkerRunLoop::runInMode):
+        (WebCore::WorkerRunLoop::postTask):
+        (WebCore::WorkerRunLoop::postTaskForMode):
+        (WebCore::WorkerRunLoop::Task::create):
+        (WebCore::WorkerRunLoop::Task::performTask):
+        (WebCore::WorkerRunLoop::Task::Task):
+        * workers/WorkerRunLoop.h:
+        (WebCore::WorkerRunLoop::Task::~Task):
+        (WebCore::WorkerRunLoop::Task::mode):
+
+2009-11-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Failing media/video-played-reset.html
+        https://bugs.webkit.org/show_bug.cgi?id=30589
+
+        new m_seekTime attribute to keep track of the seek position
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::seek):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Remove Referer when redirecting to non-secure site
+        https://bugs.webkit.org/show_bug.cgi?id=31021
+
+        Remove referer from HTTP headers when redirecting to a non-secure
+        site.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-11-02  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18539
+        multipart/form-data not being parsed correctly on server due to '+' in boundary string
+
+        No test - the characters that the boundary is made of are not deterministic.
+
+        * platform/network/FormDataBuilder.cpp: (WebCore::FormDataBuilder::generateUniqueBoundaryString):
+        Don't ever put a '+' in boundary string, either. Removed a FIXME to bring '/' back once
+        GMail is fixed - I don't think we'll ever want to allow non-alphanumeric characters, as
+        they cause problems on many web sites.
+
+2009-10-30  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30969
+        A no-prefix XPath node test should not match no-namespace elements in HTML document
+
+        Test: fast/xpath/null-namespace-in-html.html
+
+        * xml/XPathStep.cpp: (WebCore::XPath::nodeMatchesBasicTest): Special case non-HTML elements
+        in HTML documents (as these are the ones that can have null namespace).
+
+2009-11-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] No timeline marks on resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31013
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+
+2009-11-02  David Levin  <levin@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Possible crash in RenderSlider::layout.
+        https://bugs.webkit.org/show_bug.cgi?id=31016
+
+        Fix out of place line of code.
+
+        Test: scrollbars/overflow-scrollbar-combinations.html
+        This crash only seems to repro when WebKit draws the play controls,
+        so the crash repros in chromium running this test but not WebKit
+        nightlies which use QuickTime to draw the controls.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::layout):
+
+2009-11-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix Qt build on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30905
+
+        * WebCore.pro:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::create):
+
+2009-11-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        QWebView crash fix.
+
+        The QWebView should not crash if the stop() method is called from
+        a function triggered by the loadProgress signal.
+
+        A null pointer protection was added in the ProgressTracker::incrementProgress.
+
+        New autotest was created.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29425
+
+        * loader/ProgressTracker.cpp:
+        (WebCore::ProgressTracker::incrementProgress):
+
+2009-11-02  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix a leftover from profiles panel generalization.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31010
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.get searchableViews):
+
+2009-11-02  Kai Koehne  <kai.koehne@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Remove implementation of ImageDecocerQt::clearFrameBufferCache.
+        The implementation was buggy, and will visually break repeating
+        animations anyway.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31009
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+
+2009-11-02  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30964
+        [Gtk] Implemment AtkDocument
+
+        Provides access to the reported content language.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_document_get_locale):
+
+2009-11-02  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Rewrite CSSSourceSyntaxHighlighter so it shares more code
+        https://bugs.webkit.org/show_bug.cgi?id=30907
+
+        Test: inspector/css-syntax-highlight.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.syntaxHighlightCSS):
+        (WebInspector.SourceSyntaxHighlighter):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.processChunk):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.moveToNextLine):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process):
+        (WebInspector.SourceSyntaxHighlighter.prototype.lex):
+        (WebInspector.SourceSyntaxHighlighter.prototype.appendNonToken):
+        (WebInspector.SourceSyntaxHighlighter.prototype.syntaxHighlightNode):
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        * inspector/front-end/inspectorSyntaxHighlight.css:
+
+2009-11-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Support ARIA "tab" roles
+        https://bugs.webkit.org/show_bug.cgi?id=30842
+
+        Implement support for ARIA "tab", "tabpanel" and "tablist".
+        As a consequence, we also needed to implement aria-selected
+        and aria-controls.
+
+        Tests: accessibility/aria-controls-with-tabs.html
+               accessibility/aria-tab-roles.html
+
+        * accessibility/AXObjectCache.cpp:
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        * html/HTMLAttributeNames.in:
+
+2009-10-27  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        This is the WebKit-side change needed to fix canvas.getImageData() for
+        Chromium.  The unpremultiply code in Skia assumes that unpremultiplied
+        values should be rounded, while CG does not.  In addition, the fixed
+        point inversion used by Skia introduces slight inaccuracies that make
+        us fail this test.  This change brings Chromium in line with
+        the CG path.
+        https://bugs.webkit.org/show_bug.cgi?id=30825
+
+        Covered by LayoutTests/fast/canvas/canvas-getImageData.html
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+
+2009-11-01  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds window event dispatches to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=31002
+
+        * English.lproj/localizedStrings.js:
+        * dom/Node.cpp: Updated call site to willDispatchEvent and didDispatchEvent.
+        (WebCore::Node::dispatchGenericEvent):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willDispatchEvent): Renamed.
+        (WebCore::InspectorTimelineAgent::didDispatchEvent): Renamed.
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createEventDispatchRecord): Renamed.
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchEvent):
+
+2009-11-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Convert script tag event into a more generic
+        script eval event in timeline.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30999
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willEvaluateScript):
+        (WebCore::InspectorTimelineAgent::didEvaluateScript):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createEvaluateScriptTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+
+2009-11-01  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Fix for loop to use an size_t instead of unsigned and some spacing
+        style fixes.
+
+        * dom/Node.cpp:
+        (WebCore::eventHasListeners):
+
+2009-11-01  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Does not send DOM dispatches to the InspectorTimelineAgent if there
+        are no event listeners.
+        https://bugs.webkit.org/show_bug.cgi?id=30995
+
+        * dom/Node.cpp:
+        (WebCore::eventHasListeners):
+        (WebCore::Node::dispatchGenericEvent):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2009-11-01  Roland Steiner  <rolandsteiner@chromium.org>
+
+        No review (build fix).
+
+        Add missing files for Ruby implementation to WebCore.vcproj
+        (Fix build break after 50397)
+        https://bugs.webkit.org/show_bug.cgi?id=31001
+
+        No new tests. (No functional change)
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-11-02  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        First rudimentary implementation of HTML5 ruby rendering support.
+
+        Following the HTML 5 spec, the box object model for a <ruby> element allows several runs of ruby
+        bases with their respective ruby texts looks as follows:
+
+        1 RenderRuby object, corresponding to the whole <ruby> HTML element
+             1+ RenderRubyRun (anonymous)
+                 0 or 1 RenderRubyText - shuffled to the front in order to re-use existing block layouting
+                     0-n inline object(s)
+                 0 or 1 RenderRubyBase - contains the inline objects that make up the ruby base
+                     1-n inline object(s)
+
+        Note: <rp> elements are defined as having 'display:none' and thus normally are not assigned a renderer.
+        
+        New layout tests will be committed in a follow-up patch under fast/ruby.
+
+        Makefiles, etc.
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        CSS
+        * css/html.css: Added <ruby> and <rt>
+
+        Existing render files:
+        * rendering/RenderBlock.cpp: make moveChild a member function moveChildTo
+        (WebCore::RenderBlock::moveChildTo):
+        (WebCore::RenderBlock::makeChildrenNonInline):
+        (WebCore::RenderBlock::removeChild):
+        * rendering/RenderBlock.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject): instantiate ruby renderers based on element name
+        * rendering/RenderObject.h: add query methods for ruby renderers
+        (WebCore::RenderObject::isRuby):
+        (WebCore::RenderObject::isRubyBase):
+        (WebCore::RenderObject::isRubyRun):
+        (WebCore::RenderObject::isRubyText):
+
+        New ruby renderers:
+        * rendering/RenderRuby.cpp: Added.
+        (WebCore::lastRubyRun):
+        (WebCore::findRubyRunParent):
+        (WebCore::RenderRubyAsInline::RenderRubyAsInline):
+        (WebCore::RenderRubyAsInline::~RenderRubyAsInline):
+        (WebCore::RenderRubyAsInline::isChildAllowed):
+        (WebCore::RenderRubyAsInline::addChild):
+        (WebCore::RenderRubyAsInline::removeChild):
+        (WebCore::RenderRubyAsBlock::RenderRubyAsBlock):
+        (WebCore::RenderRubyAsBlock::~RenderRubyAsBlock):
+        (WebCore::RenderRubyAsBlock::isChildAllowed):
+        (WebCore::RenderRubyAsBlock::addChild):
+        (WebCore::RenderRubyAsBlock::removeChild):
+        * rendering/RenderRuby.h: Added.
+        (WebCore::RenderRubyAsInline::renderName):
+        (WebCore::RenderRubyAsInline::isRuby):
+        (WebCore::RenderRubyAsBlock::renderName):
+        (WebCore::RenderRubyAsBlock::isRuby):
+        * rendering/RenderRubyBase.cpp: Added.
+        (WebCore::RenderRubyBase::RenderRubyBase):
+        (WebCore::RenderRubyBase::~RenderRubyBase):
+        (WebCore::RenderRubyBase::isChildAllowed):
+        (WebCore::RenderRubyBase::splitToLeft):
+        (WebCore::RenderRubyBase::mergeWithRight):
+        * rendering/RenderRubyBase.h: Added.
+        (WebCore::RenderRubyBase::renderName):
+        (WebCore::RenderRubyBase::isRubyBase):
+        * rendering/RenderRubyRun.cpp: Added.
+        (WebCore::RenderRubyRun::RenderRubyRun):
+        (WebCore::RenderRubyRun::~RenderRubyRun):
+        (WebCore::RenderRubyRun::hasRubyText):
+        (WebCore::RenderRubyRun::hasRubyBase):
+        (WebCore::RenderRubyRun::isEmpty):
+        (WebCore::RenderRubyRun::rubyText):
+        (WebCore::RenderRubyRun::rubyBase):
+        (WebCore::RenderRubyRun::rubyBaseSafe):
+        (WebCore::RenderRubyRun::firstLineBlock):
+        (WebCore::RenderRubyRun::updateFirstLetter):
+        (WebCore::RenderRubyRun::isChildAllowed):
+        (WebCore::RenderRubyRun::addChild):
+        (WebCore::RenderRubyRun::removeChild):
+        (WebCore::RenderRubyRun::createRubyBase):
+        (WebCore::RenderRubyRun::staticCreateRubyRun):
+        * rendering/RenderRubyRun.h: Added.
+        (WebCore::RenderRubyRun::renderName):
+        (WebCore::RenderRubyRun::isRubyRun):
+        * rendering/RenderRubyText.cpp: Added.
+        (WebCore::RenderRubyText::RenderRubyText):
+        (WebCore::RenderRubyText::~RenderRubyText):
+        (WebCore::RenderRubyText::isChildAllowed):
+        * rendering/RenderRubyText.h: Added.
+        (WebCore::RenderRubyText::renderName):
+        (WebCore::RenderRubyText::isRubyText):
+
+2009-11-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30992
+        Node.isDefaultNamespace doesn't convert empty strings to null
+
+        Test: fast/dom/Node/default-namespace-empty-argument.html
+
+        * dom/Node.cpp: (WebCore::Node::isDefaultNamespace): Per DOM 3 Core, treat empty input
+        as null.
+
+2009-11-01  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Don't add '/' to the URL path if the it does not include '/' after the protocol component
+        https://bugs.webkit.org/show_bug.cgi?id=30971
+
+        Match IE8 behaviour, that does not add '/' if there is none after the protocol component.
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::parse):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix layering violations in GraphicsContext3D
+        https://bugs.webkit.org/show_bug.cgi?id=30986
+
+        Remove uses of HTMLImageElement and HTMLCanvasElement
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::texImage2D):
+        (WebCore::CanvasRenderingContext3D::texSubImage2D):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+
+2009-11-01  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30964
+        [Gtk] Implemment AtkDocument
+
+        Provides access to expected document attributes.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (documentAttributeValue):
+        (webkit_accessible_document_get_document_attribute_value):
+        (webkit_accessible_document_get_document_attributes):
+
+2009-11-03  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30964
+        [Gtk] Implemment AtkDocument
+
+        Implements what has been implemented in AT-SPI.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (GetAtkInterfaceTypeFromWAIType):
+        (getInterfaceMaskFromObject):
+        (atk_document_interface_init):
+        (webkit_accessible_document_get_document_attribute_value):
+        (webkit_accessible_document_get_document_attributes):
+        (webkit_accessible_document_get_locale):
+
+2009-11-01  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Turn on warnings for QtWebKit for gcc
+        https://bugs.webkit.org/show_bug.cgi?id=30958
+
+        No new tests as there is no functional change.
+
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::RGBA32Buffer): Reorder 
+        initialization list to fix compiler warnings.
+
+
+2009-11-01  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        [Regression] monitorEvent doesn't work
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-11-01  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix Web Inspector: Bug with Message Bubble in Syntax Highlighter
+        https://bugs.webkit.org/show_bug.cgi?id=30990
+
+        * inspector/front-end/SourceFrame.js:
+
+2009-10-31  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30982
+        createHTMLDocument doesn't escape ampersand and less-than in title
+
+        Test: fast/dom/DOMImplementation/createHTMLDocument-title.html
+
+        * dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createHTMLDocument):
+        Set document title after creating the document, avoiding parser intricacies.
+
+2009-11-01  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Double clicking on a breakpoints should not select text
+        https://bugs.webkit.org/show_bug.cgi?id=30950
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+
+2009-11-01  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent().
+
+        [Crash (debug)] Combination of list-item and :after causes assertion failure
+        https://bugs.webkit.org/show_bug.cgi?id=30944
+
+        Test: fast/css/list-item-pseudo-nocrash.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
+2009-11-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30586
+        [GTK] Failing test media/video-src-empty.html
+
+        Correctly set network/ready state depending on GStreamer errors
+        received on the bus.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::attachShader):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove obsolete null checks from CanvasRenderingContext3DMac
+        https://bugs.webkit.org/show_bug.cgi?id=30983
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::attachShader):
+        (WebCore::GraphicsContext3D::bindAttribLocation):
+        (WebCore::GraphicsContext3D::compileShader):
+        (WebCore::GraphicsContext3D::detachShader):
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3D::framebufferTexture2D):
+        (WebCore::GraphicsContext3D::linkProgram):
+        (WebCore::GraphicsContext3D::shaderSource):
+        (WebCore::GraphicsContext3D::useProgram):
+        (WebCore::GraphicsContext3D::validateProgram):
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getShaderi):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
+        (WebCore::GraphicsContext3D::getUniformLocation):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        WebGL allows objects to be used with the wrong context
+        https://bugs.webkit.org/show_bug.cgi?id=30981
+
+        Simply add null checks and a few context guards to ensure we don't
+        deref null or attempt to use an object from a different context.
+
+        Tests: fast/canvas/webgl/incorrect-context-object-behaviour.html
+               fast/canvas/webgl/null-object-behaviour.html
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::attachShader):
+        (WebCore::CanvasRenderingContext3D::bindAttribLocation):
+        (WebCore::CanvasRenderingContext3D::bindBuffer):
+        (WebCore::CanvasRenderingContext3D::bindFramebuffer):
+        (WebCore::CanvasRenderingContext3D::bindRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::compileShader):
+        (WebCore::CanvasRenderingContext3D::detachShader):
+        (WebCore::CanvasRenderingContext3D::framebufferRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::framebufferTexture2D):
+        (WebCore::CanvasRenderingContext3D::getProgrami):
+        (WebCore::CanvasRenderingContext3D::getProgramiv):
+        (WebCore::CanvasRenderingContext3D::getProgramInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderi):
+        (WebCore::CanvasRenderingContext3D::getShaderiv):
+        (WebCore::CanvasRenderingContext3D::getShaderInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderSource):
+        (WebCore::CanvasRenderingContext3D::getUniformf):
+        (WebCore::CanvasRenderingContext3D::getUniformfv):
+        (WebCore::CanvasRenderingContext3D::getUniformi):
+        (WebCore::CanvasRenderingContext3D::getUniformiv):
+        (WebCore::CanvasRenderingContext3D::getUniformLocation):
+        (WebCore::CanvasRenderingContext3D::isBuffer):
+        (WebCore::CanvasRenderingContext3D::linkProgram):
+        (WebCore::CanvasRenderingContext3D::shaderSource):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQueryResult
+        https://bugs.webkit.org/show_bug.cgi?id=30857
+
+        Inherits MediaQueryResult class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:5984 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQueryEvaluator
+        https://bugs.webkit.org/show_bug.cgi?id=30854
+
+        Inherits MediaQueryEvaluator class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:401 and   
+        it is no need to be copyable.
+
+        * css/MediaQueryEvaluator.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSRuleSet
+        https://bugs.webkit.org/show_bug.cgi?id=30852
+
+        Inherits CSSRuleSet class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:455 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.cpp:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSRuleData
+        https://bugs.webkit.org/show_bug.cgi?id=30851
+
+        Inherits CSSRuleData class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.h:320 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSRuleDataList
+        https://bugs.webkit.org/show_bug.cgi?id=30850
+
+        Inherits CSSRuleDataList class from Noncopyable because it has been
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:2715 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSNamespace
+        https://bugs.webkit.org/show_bug.cgi?id=30849
+
+        Inherits CSSNamespace struct from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSheet.cpp:141 and
+        it is no need to be copyable.
+
+        * css/CSSNamespace.h:
+
+2009-10-30  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Refactor DatabaseTask in preparation for removing threadsafe refcounting from it.
+        Move the synchronizer object out of the DatabaseTask so there is no need to keep
+        the pointer to Databasetask around after passing it to MessageQueue.
+        Also pass the references to return parameters to the task so it can update them.
+        https://bugs.webkit.org/show_bug.cgi?id=30941
+
+        No new tests, since this is just moving the code around, no change in functionality.
+
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+        (WebCore::Database::openAndVerifyVersion): Use new DatabaseTaskSynchronizer to wait for task completion.
+        (WebCore::Database::markAsDeletedAndClose): Ditto.
+        (WebCore::Database::tableNames): Ditto.
+        (WebCore::Database::stop): Use the boolean flag rather then 'killed' flag built into MessageQueue.
+        (WebCore::Database::scheduleTransaction): Transaction queue is a Deque now, change the way to fetch the transaction.
+        * storage/Database.h: Change the SQLTransaction queue to be a Deque rather then a MessageQueue.
+        * storage/DatabaseTask.cpp:
+        (WebCore::DatabaseTaskSynchronizer::DatabaseTaskSynchronizer):
+        (WebCore::DatabaseTaskSynchronizer::waitForTaskCompletion):
+        (WebCore::DatabaseTaskSynchronizer::taskCompleted):
+        (WebCore::DatabaseTask::DatabaseTask): Ctor takes DatabaseTaskSynchronizer which can be 0.
+        (WebCore::DatabaseTask::performTask): Signal completion. m_synchronizer should still be around since main thread is waiting on it.
+        (WebCore::DatabaseOpenTask::DatabaseOpenTask): Pass synchronizer and return parameters via constructor.
+        (WebCore::DatabaseCloseTask::DatabaseCloseTask): Ditto.
+        (WebCore::DatabaseTransactionTask::DatabaseTransactionTask): Ditto.
+        (WebCore::DatabaseTableNamesTask::DatabaseTableNamesTask): Ditto.
+        * storage/DatabaseTask.h:
+        (WebCore::DatabaseOpenTask::create):
+        (WebCore::DatabaseCloseTask::create):
+        (WebCore::DatabaseTransactionTask::create):
+        (WebCore::DatabaseTableNamesTask::create):
+
+2009-10-30  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: In Mail, Undo does not restore some characters I have deleted at the end of a line
+        https://bugs.webkit.org/show_bug.cgi?id=30955
+        <rdar://problem/7067033>
+        
+        When the command is deleteWordBackward or deleteWordForward
+        we should not add to the open typing command, but
+        create a new one.
+        
+        Test: editing/undo/undo-deleteWord.html
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed): Always start a new command if the granularity is
+        not CharacterGranularity. 
+        (WebCore::TypingCommand::forwardDeleteKeyPressed): Always start a new command if the granularity is
+        not CharacterGranularity. 
+
+2009-10-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make MediaPlayer constructor private
+        https://bugs.webkit.org/show_bug.cgi?id=30965
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): 
+        (WebCore::HTMLMediaElement::finishParsingChildren): Use MediaPlayer::create.
+
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayer::create): New.
+
+2009-10-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility of headings is not correct
+
+        https://bugs.webkit.org/show_bug.cgi?id=30937
+
+        Reviewed by Alice Liu.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::stringRoleForMSAA):
+        (WebCore::AccessibilityObject::descriptionForMSAA):
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::shouldReturnTagNameAsRoleForMSAA):
+        If the element's tag name is one of h1, h2, h3, h4, h5, h6, return
+        true.
+        (WebCore::AccessibilityRenderObject::stringRoleForMSAA):
+        If the element should return its tag name as the role, return the tag
+        name.
+        (WebCore::AccessibilityRenderObject::positionalDescriptionForMSAA):
+        If the object is a heading, return the string "L" followed by the
+        heading level.
+        (WebCore::AccessibilityRenderObject::descriptionForMSAA):
+        If the object has a positional description, return it. Otherwise, get
+        the accessibility description, and prefix it with "Description" so that
+        MSAA clients know that it's not a positional description.
+
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-10-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility of links is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=30928
+
+        Reviewed by Darin Adler.
+
+        * accessibility/AccessibilityImageMapLink.cpp:
+        (WebCore::AccessibilityImageMapLink::stringValueForMSAA):
+        Return the URL.
+        (WebCore::AccessibilityImageMapLink::nameForMSAA):
+        Return the alt text.
+
+        * accessibility/AccessibilityImageMapLink.h:
+        (WebCore::AccessibilityImageMapLink::isLinked):
+        Return true.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isLinked):
+        (WebCore::AccessibilityObject::stringValueForMSAA):
+        (WebCore::AccessibilityObject::nameForMSAA):
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::isLinkable):
+        Return true if the element is considered "linkable" with respect to
+        accessibility.
+        (WebCore::AccessibilityRenderObject::stringValueForMSAA):
+        If the element is linkable, check whether it has a parent anchor
+        element. If so, return the anchor element's href.
+        (WebCore::AccessibilityRenderObject::isLinked):
+        Return true if the element is linkable and if it's parent anchor tag's
+        href is non-empty.
+        (WebCore::AccessibilityRenderObject::nameForMSAA):
+        For text nodes, return the text.
+
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-10-30  Evan Stade  <estade@chromium.org>
+
+        Reviewed by David Levin.
+
+        Notify the chrome when the focused node has changed.
+        https://bugs.webkit.org/show_bug.cgi?id=30832
+
+        This is similar to AX code that is already in place, except that this also informs the
+        chrome when there stops being a focused node. This is needed for a browser to show the
+        anchor for links that have keyboard focus.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::focusedNodeChanged):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::focusedNodeChanged):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+
+2009-10-30  Ben Murdoch  <benm@google.com>
+
+        Reviewed by David Kilzer.
+
+        openDatabase() with empty version sets db version up incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=28417
+
+        Test: storage/open-database-set-empty-version.html
+
+        * storage/Database.cpp:
+        (WebCore::Database::performOpenAndVerify): Raise an exception if the current database version does not match the expected version when the current version is the empty string.
+
+2009-10-30  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Need to turn off notifications properly at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=30409
+
+        Moving the notificationsEnabled bit from NotificationCenter
+        to the new V8 RuntimeEnabledFeatures object.
+
+        Just moving a bit around, so no new tests.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setNotificationsEnabled):
+        (WebCore::RuntimeEnabledFeatures::notificationsEnabled):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * notifications/NotificationCenter.cpp:
+        * notifications/NotificationCenter.h:
+
+2009-10-30  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] More cleanup after r49949: remove ListenerGuard.
+        ListenerGuard is no longer needed since EventListeners do not depend on frame or v8 context.
+        https://bugs.webkit.org/show_bug.cgi?id=30943
+
+        Covered by fast/events/add-event-without-document.html which will now pass in Chromium.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::clearForNavigation):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener):
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::reportError):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create):
+
+2009-10-30  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        counterValueForElementById should return space-separated string for multiple counters
+        https://bugs.webkit.org/show_bug.cgi?id=30939
+
+        Test: fast/css/counters/counterValueForElementById.html
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeCounterValuesFromChildren):
+        (WebCore::counterValueForElement):
+
+2009-10-30  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+        Add some comments to explain what is happening here.
+
+2009-10-30  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix Web Inspector crash on the errors/warnings counter click
+
+        RenderObject::createVisiblePosition(const Position& position)
+        understands "null Positions", so we can construct such a Position manually.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30499
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForPoint):
+
+2009-10-30  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        Third part of the implementation of AtkTable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (nameFromChildren):
+        (webkit_accessible_get_name):
+        New convenience function to construct an object's name using the name(s) of
+        any children it has.
+
+        (atk_table_interface_init):
+        (webkit_accessible_table_get_column_description):
+        (webkit_accessible_table_get_row_description):
+        Implemented.
+
+        (webkit_accessible_table_get_column_header):
+        Stub function added so that webkit_accessible_table_get_column_description
+        could be implemented in the meantime.
+
+2009-10-30  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        Second part of the implementation of AtkTable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (cellAtIndex):
+        (webkit_accessible_table_get_column_at_index):
+        (webkit_accessible_table_get_row_at_index):
+        (webkit_accessible_table_get_caption):
+        (atk_table_interface_init):
+
+2009-10-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add TimelinePanel into the panels enum.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30915
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+        * inspector/front-end/inspector.js:
+        (WebInspector.showTimelinePanel):
+
+2009-10-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        If the owner widget of the page has a palette set, we
+        should use that one. This was only working when the
+        owner was a QWebView. This patch fixes that.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::applyTheme):
+
+2009-10-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: Wire CookieJarChromium to the cookies
+        backend. This is a final step of a 3-steps raw cookies
+        access implementation in Chromium.
+
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+2009-10-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix Chromium crash in console.log in "deeply recursive" function 
+
+        Check that result of 'frameSourceName' is not null handle
+        before casting it to String. 
+      
+        Allow V8Proxy::sourceName/sourceLineNumber() to report
+        that they have failed due to JavaScript stack overflow.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30904
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::create):
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptCallStack.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::sourceLineNumber):
+        (WebCore::V8Proxy::sourceName):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQuery
+        https://bugs.webkit.org/show_bug.cgi?id=30856
+
+        Inherits MediaQuery class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:4905 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQueryExp
+        https://bugs.webkit.org/show_bug.cgi?id=30855
+
+        Inherits MediaQueryExp class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:4874.
+
+        * css/MediaQueryExp.h:
+
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        No new tests (no functional change).
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-10-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Removed test for an impossible condition (a glyph in a right-to-left run not having
+        the RTL flag 0x800)
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation):
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Out-of-memory crash in isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=30906
+
+        We need to handle the fact that creating a V8:Context might fail.  I
+        don't know how to test this change because creating a context usually
+        only fails when V8 decides it's using too much memory.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+
+2009-10-29  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make links mouse focusable only on GTK and QT.
+
+        Links are now always mouse focusable on GTK and QT. On other platforms
+        the link needs a tabIndex or it needs to be contentEditable.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26856
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isMouseFocusable):
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Complete the fix for hit-testing and selection highlighting in ligatures for the ATSUI
+        code path.
+
+        * platform/graphics/mac/ComplexTextController.h: Added m_ltr member to ComplexTextRun.
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): Skip over deleted
+        glyphs, but update indexes and advances correctly.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Initialize m_ltr.
+
+2009-10-29  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(3.2.3 - 4.0.2): Message composing: when I undo a color change to text in Mail, undo/redo behaves strangely
+        <rdar://problem/7115041>
+        https://bugs.webkit.org/show_bug.cgi?id=30892
+
+        This problem shows in any scenario where it is necessary to split a text
+        node to apply a style. SplitElementCommand and WrapContentsInDummySpanCommand both
+        have member variables initialized in the constructor to keep reference to elements
+        they need to operate upon. These reference are not updated when reapplying the command.
+        For this reason it is necessary to guarantee that unapply doesn not delete the references
+        and that these commands implement doReapply to correctly reuse the existing
+        elements.
+
+        Test: editing/undo/redo-style.html
+
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::executeApply): Added.
+        (WebCore::SplitElementCommand::doApply): Modified to call executeApply. 
+        (WebCore::SplitElementCommand::doUnapply): Doesn't release m_element1.
+        (WebCore::SplitElementCommand::doReapply): Added.
+        * editing/SplitElementCommand.h: Added doReapply and executeApply.
+        * editing/WrapContentsInDummySpanCommand.cpp:
+        (WebCore::WrapContentsInDummySpanCommand::executeApply): Added.
+        (WebCore::WrapContentsInDummySpanCommand::doApply): Modified to call executeApply.
+        (WebCore::WrapContentsInDummySpanCommand::doUnapply): Doesn't release m_dummySpan.
+        (WebCore::WrapContentsInDummySpanCommand::doReapply): Added.
+        * editing/WrapContentsInDummySpanCommand.h: Added doReapply and executeApply.
+
+2009-10-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        DOM Storage's condition variable needs to handle spurious wakeups
+        https://bugs.webkit.org/show_bug.cgi?id=30920
+
+        Add a boolean to keep track of whether it's been terminated.  Clean
+        up the locking code a tiny bit to make it easier to read.  There's
+        no way to reproduce this reliably in a LayoutTest.
+
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+
+2009-10-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Include ComplextTextController into Chromium Mac project.
+
+        * WebCore.gyp/WebCore.gyp: Added include rule for ComplextText* files.
+
+2009-10-29  Timothy Hatcher  <timothy@apple.com>
+
+        Fix tabbing through element attributes in the Web Insector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30429
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted): Don't call _updateTitle,
+        it is called for us when removeAttribute succeeds in the back-end.
+        (WebInspector.ElementsTreeElement.prototype._textNodeEditingCommitted): Ditto except for nodeValue.
+        (WebInspector.ElementsTreeElement.prototype._editingCancelled): Don't call _updateTitle, editing code reverts.
+        (WebInspector.ElementsTreeElement.prototype._updateTitle): Return early if we are editing.
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Problem editing or selecting text containing ligatures
+        https://bugs.webkit.org/show_bug.cgi?id=30025
+
+        Test: platform/mac/fast/text/ligature-subdivision.html
+
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::ComplexTextController): Initialize
+        m_characterInCurrentGlyph.
+        (WebCore::ComplexTextController::offsetForPosition): If the hit glyph spans multiple
+        characters, compute the hit character based on dividing the glyph’s total advance into
+        a number of equal intervals equal to the number of characters and assigning the hit to the
+        character corresponding to the hit interval.
+        (WebCore::ComplexTextController::advance): If the final offset occurs mid-glyph, advance
+        by a fraction of the glyph’s total advance.
+        * platform/graphics/mac/ComplexTextController.h: Added m_characterInCurrentGlyph.
+
+2009-10-29  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30918>.
+        Web Inspector: Datagrid Rows on Windows not properly aligned.
+        
+        Use line-height for the table rows to make sure the height
+        of our text and the height of the table rows are consistent.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r50296.
+        http://trac.webkit.org/changeset/50296
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Out-of-memory crash in isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=30906
+
+        We need to handle the fact that creating a V8:Context might fail.  I
+        don't know how to test this change because creating a context usually
+        only fails when V8 decides it's using too much memory.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+
+2009-10-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Remove build warning introduced by r50284.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-10-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Remove random crashes by removing retrieval of V8 context during garbage collection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30919
+
+        Unfortunately, I haven't been able to trigger this crash explicitly, so no test :(.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::jsWrapperForDOMObject): Added new "assume-it's-there" getter.
+        * bindings/v8/V8DOMWrapper.h: Added getter decl.
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GCPrologueVisitor::visitDOMWrapper): Changed to use explicit getter.
+
+2009-10-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Adjust the project files to sync up with
+        http://trac.webkit.org/changeset/50259
+
+        * WebCore.gypi: Renamed and added files.
+
+2009-10-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Implement DELETE HTTP method for XmlHttpRequest
+        https://bugs.webkit.org/show_bug.cgi?id=30894
+
+        No new tests as this functionality is already tested by the 
+        xmlhttprequest LayoutTests. As this patch depends on an unreleased
+        version of the dependent QtNetwork library and the tests will be
+        enabled later once the dependent library is released (and the
+        buildbot is updated).
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-10-29  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Part of <http://webkit.org/b/30483>.
+        Web Inspector: Always show the Local and Session Storage Views.
+        
+        Even if the length of the DOM Storage entry array is 0, still
+        generate the Datagrid because users can add things storage items
+        through the UI, so we should allow them to even if there isn't
+        anything there currently.
+
+        * English.lproj/localizedStrings.js: Removed "This Storage is Empty".
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add TimelinePanel into the panels enum.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30915
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+
+2009-10-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] Threading problems with some of the tests
+        https://bugs.webkit.org/show_bug.cgi?id=30814
+
+        Create strings shared among threads with crossThreadString
+        constructor method.
+
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+
+2009-10-29  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30308
+        
+        Add support for ARGB videos.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+        Create the Cairo image surface for ARGB32 or RGB24
+        depending on the buffer's caps.
+        
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        Handle ARGB video and convert GStreamer's ARGB to
+        Cairo's for displaying.
+
+2009-10-29  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] expose a method to access memory usage information in ChromiumBridge
+        Declare a static method to be implemented by http://codereview.chromium.org/332010/
+        https://bugs.webkit.org/show_bug.cgi?id=30829
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-10-29  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25679
+        [Gtk] Improve accessibility of focusable lists
+
+        Implements the AtkSelection interface and enables the corresponding
+        (and expected) object:selection-changed event.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (optionFromList):
+        (optionFromSelection):
+        (atk_selection_interface_init):
+        (webkit_accessible_selection_add_selection):
+        (webkit_accessible_selection_clear_selection):
+        (webkit_accessible_selection_ref_selection):
+        (webkit_accessible_selection_get_selection_count):
+        (webkit_accessible_selection_is_child_selected):
+        (webkit_accessible_selection_remove_selection):
+        (webkit_accessible_selection_select_all_selection):
+        (GetAtkInterfaceTypeFromWAIType):
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (AXObjectCache::postPlatformNotification):
+
+2009-10-29  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 30655 - Only plain text should be copied to clipboard for TextArea.
+        https://bugs.webkit.org/show_bug.cgi?id=30655
+
+        * editing/Editor.cpp:
+        (WebCore::nodeIsInTextFormControl):
+        (WebCore::Editor::cut):
+        (WebCore::Editor::copy):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: hide timeline for now - not yet ready.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30912
+
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: deploy Web Inspector's images in WebCore.gypi.
+
+        * WebCore.gypi:
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: get rid of timelineProfilerEnabled method.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30911
+
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        * inspector/InspectorController.h:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Create stub methods for raw cookies access in ChromiumBridge.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=30910
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-10-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's RareData
+        https://bugs.webkit.org/show_bug.cgi?id=30858
+
+        Inherits RareData struct from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSSelector.h:259 and 
+        it is no need to be copyable.
+
+        * css/CSSSelector.h:
+
+2009-10-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's ShorthandScope
+        https://bugs.webkit.org/show_bug.cgi?id=30859
+
+        Inherits ShorthandScope class from FastAllocBase because it is 
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:902 and 
+        it is no need to be copyable.        
+
+        * css/CSSParser.h:
+
+2009-10-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's AXObjectCache
+        https://bugs.webkit.org/show_bug.cgi?id=30848
+
+        Inherits AXObjectCache class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/dom/Document.cpp:1537 and                                
+        it is no need to be copyable.
+
+        * accessibility/AXObjectCache.h:
+
+2009-10-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Don't run JavaScript URLs in view source mode
+        https://bugs.webkit.org/show_bug.cgi?id=30881
+
+        Just say no.
+
+        Test: http/tests/security/view-source-no-javascript-url.html
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+
+2009-10-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Fixes style problems pointed out by Evan Martin.
+
+        * platform/gtk/Language.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        64-bit Leopard build fix after r50259
+        
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        Declared ATSUTextInserted in 64-bit.
+        (WebCore::fontHasMirroringInfo): Use %d format and cast to int.
+        (WebCore::disableLigatures): Ditto.
+        (WebCore::initializeATSUStyle): Ditto.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Ditto.
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Tiger build fix after r50259
+
+        * platform/graphics/mac/ComplexTextController.h:
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Attempted Tiger build fix after r50259
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+
+2009-10-28  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30899
+        WebKit fails to build release on 32-bit Windows systems
+
+        * WebCore.vcproj/WebCore.vcproj: Excluded files from project.
+        * bindings/js/JSBindingsAllInOne.cpp: Added.
+
+2009-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fixed typos in color names.
+
+        * inspector/front-end/Color.js:
+
+2009-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Share code between the ATSUI- and Core Text-based Font implementations by doing the
+        following:
+        - Generalize CoreTextController as ComplexTextController, keeping the Core Text-specific
+          parts in ComplexTextControllerCoreText.cpp.
+        - Generalize FontMacCoreText as FontComplexTextMac using ComplexTextController
+        - Implement ATSUI-specific parts of ComplexTextController in ComplexTextControllerATSUI.
+        - Remove FontMacATSUI.
+
+        * WebCore.xcodeproj/project.pbxproj: Removed CoreTextController.{cpp,h}, FontMacATSUI.mm,
+        and FontMacCoreText.cpp, and added ComplexTextController.{cpp,h},
+        ComplexTextControllerATSUI.cpp, ComplexTextControllerCoreText.cpp, and
+        FontComplexTextMac.cpp.
+
+        * platform/graphics/mac/ComplexTextController.cpp: Copied from CoreTextController.cpp and
+        kept the non-Core Text-specific bits.
+        (WebCore::ComplexTextController::ComplexTextController): Updated for renames, including
+        its own.
+        (WebCore::ComplexTextController::offsetForPosition): Updated for renames and for
+        m_complexTextRuns holding references instead of objects.
+        (WebCore::ComplexTextController::collectComplexTextRuns): Updated for renames, including
+        its own.
+        (WebCore::ComplexTextController::advance): Updated for renames.
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Updated for renames and for
+        m_complexTextRuns holding references instead of objects, and changed to use the glyphs()
+        and advances() accessors.
+
+        * platform/graphics/mac/ComplexTextController.h: Copied from CoreTextController.h and
+        renamed CoreTextController to ComplexTextController and CoreTextRun to ComplexTextRun. Made
+        the latter RefCounted, added ATSUI-specific members to it, and made some other members
+        Core Text-specific. Renamed m_coreTextRuns to m_complexTextRuns and made it hold references
+        rather than objects.
+        (WebCore::ComplexTextController::ComplexTextRun::create):
+        (WebCore::ComplexTextController::ComplexTextRun::glyphs):
+        (WebCore::ComplexTextController::ComplexTextRun::advances):
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp: Added. Includes ATSUI-specific
+        parts of the ComplexTextController implementation. 
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): This ATSUI
+        callback populates the ComplexTextRun’s glyphs, advances and indices vectors. It is invoked
+        when the ComplexTextRun constructor calls ATSUGetGlyphBounds().
+        (WebCore::isArabicLamWithAlefLigature): Helper function, copied from FontMacATSUI.mm.
+        (WebCore::shapeArabic): Helper function, adapted from FontMacATSUI.mm.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Sets up the
+        ATSUTextLayout, substituting the text buffer if necessary for things like shaping Arabic,
+        mirroring glyphs or directionality overrides, then calls ATSUGetGlyphBounds() in order to
+        get the glyphs, advances and indices vectors populated.
+        (WebCore::fontHasMirroringInfo): Helper function, copied from FontMacATSUI.mm.
+        (WebCore::disableLigatures): Ditto.
+        (WebCore::initializeATSUStyle): Ditto, somewhat cleaned up and simplified.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Constructs
+        ComplexTextRuns, either missing-glyphs ones or ATSUTextLayout-based ones.
+
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp: Copied from
+        CoreTextController.cpp and kept the Core Text-specific bits.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Updated for renames,
+        including its own, and moved the code to initialize m_glyphs and m_advances here. Previously
+        this was done in adjustGlyphsAndAdvances().
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Updated for renames,
+        including its own.
+        * platform/graphics/mac/CoreTextController.cpp: Removed.
+        * platform/graphics/mac/CoreTextController.h: Removed.
+        * platform/graphics/mac/FontComplexTextMac.cpp: Renamed FontMacCoreText.cpp to this.
+        (WebCore::Font::selectionRectForComplexText): Changed to use ComplexTextController instead
+        of CoreTextController.
+        (WebCore::Font::drawComplexText): Ditto.
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        (WebCore::Font::offsetForPositionForComplexText): Ditto.
+        * platform/graphics/mac/FontMacATSUI.mm: Removed.
+        * platform/graphics/mac/FontMacCoreText.cpp: Removed.
+
+2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: add support for 'option' role
+        https://bugs.webkit.org/show_bug.cgi?id=30843
+
+        Test: accessibility/aria-option-role.html
+
+        * accessibility/AccessibilityListBoxOption.h:
+        (WebCore::AccessibilityListBoxOption::canHaveChildren):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+
+2009-10-28  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix GCC compiler warnings in WebCore, and enable -Wall and -Werror for Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=30716
+
+        * WebCore.gyp/WebCore.gyp:  Enable "chromium_code" flag, just on Mac build for now.
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::createARIARoleMap):  Fix struct visibiity warning.
+        * bindings/v8/ScriptCallStack.h:  Fix out-of-order member initialization warning.
+        * bindings/v8/V8Collection.h:
+        (WebCore::getV8Object):  Function in header should not be 'static' (fixes unused-static warning.)
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):  Fix signed/unsigned comparison warning.
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::applyGrouping):  Fix unused-variable warning.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):  Enable ListButtonPart case to avoid
+            warning about missing cases in 'switch' statement.
+        * editing/EditorCommand.cpp:
+        (WebCore::createCommandMap):  Fix struct visibiity warning.
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):  Fix out-of-order member initialization warning.
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart):  Add empty 'default' case in
+            'switch' statement to avoid missing-case warning.
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):  Ditto.
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::createFunctionMap):  Fix struct visibiity warning.
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: crashes in WebCore::RedirectScheduler::timerFired(WebCore::Timer<WebCore::RedirectScheduler>*)
+        https://bugs.webkit.org/show_bug.cgi?id=30839
+
+        Added null check for the case when the frame is detached from the page.
+
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30817
+        Use parentObjectUnignored instead of parentObject in webkit_accessible_get_parent
+
+        Also removes the hack I had originally added to solve bug 25411, because
+        the fix here is what I should have done in the first place.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+
+2009-10-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30805
+        Add MessageQueue::removeIf(Predicate&) to remove certain tasks without pulling them from the queue.
+        Existing Database tests cover this, no change in functionality.
+
+        * storage/DatabaseThread.cpp:
+        (WebCore::SameDatabasePredicate::SameDatabasePredicate): Added predicate that flags the tasks belonging to a specified database.
+        (WebCore::SameDatabasePredicate::operator()):
+        (WebCore::DatabaseThread::unscheduleDatabaseTasks): changed to use the new removeIf method.
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Glue subsequent timeline records with same category
+        and title together.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30885
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+
+2009-10-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fails new test fast/js/navigator-language.html
+        https://bugs.webkit.org/show_bug.cgi?id=30440
+
+        Reimplement WebCore::defaultLanguage to account for changes in
+        locale done by setLocale.
+
+        Already existing test: fast/js/navigator-language.html
+
+        * platform/gtk/Language.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7303145> 
+        Can't exit full screen mode or restart movie after pressing command -R.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::removedFromDocument):
+        (WebCore::HTMLMediaElement::documentWillBecomeInactive):
+            Exit from fullscreen if necessary.
+        * html/HTMLMediaElement.h:
+
+2009-10-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Unreviewed - a trivial fix to get Windows bots running.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30841
+        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
+
+        * platform/network/cf/ResourceRequestCFNet.cpp: (WebCore::setHeaderFields): Don't try to
+        access empty vector's data.
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+
+        Remove the extraneous object of ROLE_PANEL.
+
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+
+2009-10-28  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 30547: (Chromium) searchbox not rendered properly due to the css property -webkit-border-radius
+        https://bugs.webkit.org/show_bug.cgi?id=30547
+
+        Test: fast/css/text-input-with-webkit-border-radius.html
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::paintTextFieldInternal):
+          Implemented rounded border rendering in Chromium Windows theme renderer.
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Pull items collections from resources panel and
+        timeline panel into AbstractTimelinePanel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30875
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel):
+        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
+        (WebInspector.AbstractTimelinePanel.prototype.createItemTreeElement):
+        (WebInspector.AbstractTimelinePanel.prototype.createItemGraph):
+        (WebInspector.AbstractTimelinePanel.prototype._showCategory):
+        (WebInspector.AbstractTimelinePanel.prototype._hideCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.filter):
+        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
+        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.reset):
+        (WebInspector.AbstractTimelinePanel.prototype.get calculator):
+        (WebInspector.AbstractTimelinePanel.prototype.set calculator):
+        (WebInspector.AbstractTimelinePanel.prototype.addItem):
+        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
+        (WebInspector.AbstractTimelinePanel.prototype.refreshItem):
+        (WebInspector.AbstractTimelinePanel.prototype.revealAndSelectItem):
+        (WebInspector.AbstractTimelinePanel.prototype.sortItems):
+        (WebInspector.AbstractTimelinePanel.prototype.adjustScrollPosition):
+        (WebInspector.AbstractTimelineCategory):
+        (WebInspector.AbstractTimelineCategory.prototype.toString):
+        * inspector/front-end/ResourceCategory.js:
+        (WebInspector.ResourceCategory):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.createItemTreeElement):
+        (WebInspector.ResourcesPanel.prototype.createItemGraph):
+        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
+        (WebInspector.ResourcesPanel.prototype.populateSidebar):
+        (WebInspector.ResourcesPanel.prototype.get searchableViews):
+        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction.sortFuction):
+        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction):
+        (WebInspector.ResourcesPanel.prototype.searchMatchFound):
+        (WebInspector.ResourcesPanel.prototype.searchCanceled):
+        (WebInspector.ResourcesPanel.prototype.performSearch):
+        (WebInspector.ResourcesPanel.prototype.refresh):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype.removeResource):
+        (WebInspector.ResourcesPanel.prototype.addMessageToResource):
+        (WebInspector.ResourcesPanel.prototype.clearMessages):
+        (WebInspector.ResourcesPanel.prototype.refreshResource):
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.showResource):
+        (WebInspector.ResourcesPanel.prototype._sortResourcesIfNeeded):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        (WebInspector.ResourcesPanel.prototype.get _resources):
+        (WebInspector.ResourceTimeCalculator.prototype._upperBound):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get categories):
+        (WebInspector.TimelinePanel.prototype.populateSidebar):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.createItemTreeElement):
+        (WebInspector.TimelinePanel.prototype.createItemGraph):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelineCategory):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-10-28  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Resets InspectorFrontend in InspectorTimelineAgent instead of removing it so
+        that it remains active on refreshs and page transitions.
+        https://bugs.webkit.org/show_bug.cgi?id=30874
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::resetFrontendProxyObject):
+        * inspector/InspectorTimelineAgent.h:
+
+2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide a way to get counter values with layoutTestContoller
+        https://bugs.webkit.org/show_bug.cgi?id=30555
+
+        Expose WebCore::counterValueForElement as a WebCore API.
+
+        * WebCore.base.exp:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeCounterValuesFromChildren):
+        (WebCore::counterValueForElement):
+        * rendering/RenderTreeAsText.h:
+
+2009-10-28  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, Chromium build fix for r50225.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+
+2009-10-28  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Adds InspectorTimelineAgent  instrumentation for encountering a
+        <SCRIPT> tag when parsing an HTML document. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=30861
+
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        (WebCore::ScriptSourceCode::startLine):
+        (WebCore::ScriptSourceCode::url):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::willScriptTag):
+        (WebCore::InspectorTimelineAgent::didScriptTag):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createScriptTagTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+
+2009-10-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Makes sure that Geolocation watch IDs remain positive on overflow.
+        https://bugs.webkit.org/show_bug.cgi?id=30122
+
+        No new tests possible.
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::watchPosition): Modified. Reset the watch ID to 1 on overflow.
+
+2009-10-28  George Staikos  <george.staikos@torchmobile.com>
+
+        Attempt to fix the Mac debug build after 50225.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+
+2009-10-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30841
+        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
+
+        Tests: http/tests/ssl/referer-301.html
+               http/tests/ssl/referer-303.html
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+        Remove Referer header if redirecting from https to another protocol.
+
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::clearHTTPReferrer): Update request counterparts, as it is
+        always done when changing or adding header fields.
+        (WebCore::ResourceRequestBase::clearHTTPOrigin): Ditto.
+
+        * platform/network/ResourceRequestBase.h: clearHTTPReferrer() and clearHTTPOrigin() are
+        no longer inline, since they have non-trivial implementations.
+
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest): Fixed to synchronize header field removals.
+        (WebCore::ResourceRequest::doUpdateResourceRequest): Ditto.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::setHeaderFields):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        Match Mac changes.
+        
+2009-10-28  Joe Mason  <jmason@rim.com>
+
+        Reviewed by Adam Treat.
+
+        Add FrameLoader::defaultObjectContentType, containing common code for
+        implementing FrameLoaderClient::objectContentType.  (Currently the gtk
+        and win ports have copied this code, and the qt port uses similar code
+        with a few extra clauses.  Moving this to a utility function cuts down
+        on copied code.)   This causes no behavioural change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30868
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+        * loader/FrameLoader.h:
+
+2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] QWebHistory::saveState() is inconsistent with the Qt API
+        https://bugs.webkit.org/show_bug.cgi?id=30710
+
+        Enforce the versioning, by ignoring any version different
+        from 1.
+
+        * history/qt/HistoryItemQt.cpp:
+        (WebCore::HistoryItem::restoreState):
+        (WebCore::HistoryItem::saveState):
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: follow up fix to InspectorControllerStub.
+        Define it after inspector.js due to namespace
+
+        https://bugs.webkit.org/show_bug.cgi?id=30866
+
+        * inspector/front-end/inspector.html:
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add InspectorController stub in order to
+        support opening in standalone mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30866
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/InspectorControllerStub.js: Added.
+        (.WebInspector.InspectorControllerStub):
+        (.WebInspector.InspectorControllerStub.prototype.wrapCallback):
+        (.WebInspector.InspectorControllerStub.prototype.isWindowVisible):
+        (.WebInspector.InspectorControllerStub.prototype.platform):
+        (.WebInspector.InspectorControllerStub.prototype.closeWindow):
+        (.WebInspector.InspectorControllerStub.prototype.attach):
+        (.WebInspector.InspectorControllerStub.prototype.detach):
+        (.WebInspector.InspectorControllerStub.prototype.storeLastActivePanel):
+        (.WebInspector.InspectorControllerStub.prototype.clearMessages):
+        (.WebInspector.InspectorControllerStub.prototype.searchingForNode):
+        (.WebInspector.InspectorControllerStub.prototype.search):
+        (.WebInspector.InspectorControllerStub.prototype.toggleNodeSearch):
+        (.WebInspector.InspectorControllerStub.prototype.setAttachedWindowHeight):
+        (.WebInspector.InspectorControllerStub.prototype.moveByUnrestricted):
+        (.WebInspector.InspectorControllerStub.prototype.addResourceSourceToFrame):
+        (.WebInspector.InspectorControllerStub.prototype.addSourceToFrame):
+        (.WebInspector.InspectorControllerStub.prototype.getResourceDocumentNode):
+        (.WebInspector.InspectorControllerStub.prototype.highlightDOMNode):
+        (.WebInspector.InspectorControllerStub.prototype.hideDOMNodeHighlight):
+        (.WebInspector.InspectorControllerStub.prototype.inspectedWindow):
+        (.WebInspector.InspectorControllerStub.prototype.loaded):
+        (.WebInspector.InspectorControllerStub.prototype.localizedStringsURL):
+        (.WebInspector.InspectorControllerStub.prototype.windowUnloading):
+        (.WebInspector.InspectorControllerStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorControllerStub.prototype.debuggerEnabled):
+        (.WebInspector.InspectorControllerStub.prototype.enableResourceTracking):
+        (.WebInspector.InspectorControllerStub.prototype.disableResourceTracking):
+        (.WebInspector.InspectorControllerStub.prototype.resourceTrackingEnabled):
+        (.WebInspector.InspectorControllerStub.prototype.enableDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.disableDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.addBreakpoint):
+        (.WebInspector.InspectorControllerStub.prototype.removeBreakpoint):
+        (.WebInspector.InspectorControllerStub.prototype.updateBreakpoint):
+        (.WebInspector.InspectorControllerStub.prototype.pauseInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.pauseOnExceptions):
+        (.WebInspector.InspectorControllerStub.prototype.setPauseOnExceptions):
+        (.WebInspector.InspectorControllerStub.prototype.resumeDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.profilerEnabled):
+        (.WebInspector.InspectorControllerStub.prototype.enableProfiler):
+        (.WebInspector.InspectorControllerStub.prototype.disableProfiler):
+        (.WebInspector.InspectorControllerStub.prototype.startProfiling):
+        (.WebInspector.InspectorControllerStub.prototype.stopProfiling):
+        (.WebInspector.InspectorControllerStub.prototype.getProfileHeaders):
+        (.WebInspector.InspectorControllerStub.prototype.getProfile):
+        (.WebInspector.InspectorControllerStub.prototype.takeHeapSnapshot):
+        (.WebInspector.InspectorControllerStub.prototype.databaseTableNames):
+        (.WebInspector.InspectorControllerStub.prototype.stepIntoStatementInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.stepOutOfFunctionInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.stepOverStatementInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.setSetting):
+        (.WebInspector.InspectorControllerStub.prototype.dispatchOnInjectedScript):
+        (.WebInspector.InspectorControllerStub.prototype.releaseWrapperObjectGroup):
+        (.WebInspector.InspectorControllerStub.prototype.setting):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.UIString):
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+
+        Expands upon the new funtionality which allows platforms to indicate
+        that a particular object should not be ignored, so that they can
+        specify that an object should be ignored or that it should be left up
+        to the default handling to decide.
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::accessibilityIsIgnored):
+
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        Expose the table summary as the accessible description because there is no summary object.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_description):
+
+2009-10-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds ScriptController::intializeThreading(), with both JSC and V8 implementations.
+        https://bugs.webkit.org/show_bug.cgi?id=30678
+
+        This new method is used from common code, rather than calling JSC::initializeThreading() (or the V8 equivalent) directly.
+
+        Build fix, no new tests required.
+
+        * bindings/js/ScriptController.cpp: Modified.
+        (WebCore::ScriptController::initializeThreading): Added.
+        * bindings/js/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
+        * bindings/v8/ScriptController.cpp: Modified.
+        (WebCore::ScriptController::initializeThreading): Added.
+        * bindings/v8/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
+        * loader/icon/IconDatabase.cpp: Modified.
+        (WebCore::iconDatabase): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
+        * storage/Database.cpp: Modified.
+        (WebCore::Database::Database): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
+
+2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        Document a feature of the m_liveDecodedResources list.
+        https://bugs.webkit.org/show_bug.cgi?id=30209
+
+        The code made the assumption that the list is sorted by
+        the m_lastDecodedAccessTime property of the CachedResource.
+        The above is not true when CachedResource::setDecodedSize
+        is called and the item is inserted the first time. In this
+        case the m_lastDecodedAccessTime is still zero and the
+        m_liveDecodedResources list becomes unsorted.
+
+        It is impossible that Cache::pruneLiveResources will
+        stop to process the list too early due this feature and
+        the alternatives of updating m_lastDecodedAccessTime in
+        CachedResource::setDecodedSize or changing the insert
+        to search the right position have a negative impact on
+        performance. The best solution for now is to document
+        this feature.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::pruneLiveResources):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::setDecodedSize):
+
+2009-10-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+
+        Make text controls always implement the text interface, and the
+        editable text interface when they are not read only. This is what
+        ATK-users expect.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getInterfaceMaskFromObject):
+
+2009-10-27  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Fraser.
+
+        Change HitTestResult methods to use (3d) transformation aware methods
+        https://bugs.webkit.org/show_bug.cgi?id=27347
+
+        The current HitTestResult methods are not using the (3d)
+        transformation aware routines. This can lead to an assertion
+        SVGRenderBase::mapLocalToContainer method.
+
+        Change HitTestResult::imageRect to use the (3d) transformation
+        aware RenderBox::absoluteContentQuad to avoid running into
+        an assertion with SVG content.
+
+        Remove HitTestResult::boundingBox() as it is only used in
+        two places and conceptually doesn't belong into a HitTest
+        which is operating on points.
+
+        A classic test case is not possible as the methods are not excercised
+        from within HTML/SVG but from the WebKit API Layer. A unittest
+        for Qt/Gtk+/Mac would need to be written but Qt/Gtk+ currently
+        do not support 3d transformations making it impossible to write
+        a reliable test case and the Mac port is currently not doing
+        unit testing.
+
+
+        * rendering/HitTestResult.cpp: Remove boundingBox() method
+        (WebCore::HitTestResult::imageRect): Use transformation aware method
+        * rendering/HitTestResult.h: Remove boundingBox()
+
+2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Custom Cursor doesn't use hotspot.
+        https://bugs.webkit.org/show_bug.cgi?id=30820
+
+        Cursors loaded from a QPixmap didn't specifiy the
+        hotspot. Take the hotspot values from the mac
+        implementation.
+
+        * platform/qt/CursorQt.cpp:
+
+2009-10-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Initial revision of the Timeline grid.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30834
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelineCalculator):
+        * inspector/front-end/Images/timelineBarBlue.png: Added.
+        * inspector/front-end/Images/timelineBarGray.png: Added.
+        * inspector/front-end/Images/timelineBarGreen.png: Added.
+        * inspector/front-end/Images/timelineBarOrange.png: Added.
+        * inspector/front-end/Images/timelineBarPurple.png: Added.
+        * inspector/front-end/Images/timelineBarRed.png: Added.
+        * inspector/front-end/Images/timelineBarYellow.png: Added.
+        * inspector/front-end/Images/timelineCheckmarks.png: Added.
+        * inspector/front-end/Images/timelineDots.png: Added.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceTimeCalculator):
+        (WebInspector.ResourceTransferSizeCalculator):
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype.get categories):
+        (WebInspector.TimelinePanel.prototype.populateSidebar):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClick):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype.showCategory):
+        (WebInspector.TimelinePanel.prototype.hideCategory):
+        (WebInspector.TimelineRecordTreeElement):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.computePercentageFromEventTime):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        (WebInspector.TimelineGraph):
+        (WebInspector.TimelineGraph.prototype.get graphElement):
+        (WebInspector.TimelineGraph.prototype.refreshLabelPositions):
+        (WebInspector.TimelineGraph.prototype.refresh):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Move runAfterPendingDispatches to TestController for Clarity
+        https://bugs.webkit.org/show_bug.cgi?id=30844
+
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.runAfterPendingDispatches):
+        * inspector/front-end/inspector.js: moved runAfterPendingDispatches
+
+2009-10-27  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add missing forward declaration of FramelessScrollView.
+        https://bugs.webkit.org/show_bug.cgi?id=30824
+
+        * platform/chromium/FramelessScrollViewClient.h:
+
+2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        WAI-ARIA: add support for 'presentation' role
+        https://bugs.webkit.org/show_bug.cgi?id=30806
+
+        Test: accessibility/aria-presentational-role.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::RoleEntry::):
+
+2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ARIA menu/menu item need AXRoleDescription
+        https://bugs.webkit.org/show_bug.cgi?id=30804
+
+        Make sure that role descriptions will default to the system's first, before
+        returning an unknown role.
+
+        Test: platform/mac/accessibility/aria-menu-role-descriptions.html
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: migrated away from API that no longer exists.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: migrated away from API that no longer exists.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2009-10-27  Oliver Hunt  <oliver@apple.com>
+
+        Fix wording in comment.
+
+        * bridge/objc/objc_instance.mm:
+        (allocateAutoReleasePool):
+
+2009-10-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash occurs after launching Newsfire 1.6 for the first time
+        https://bugs.webkit.org/show_bug.cgi?id=30807
+
+        We allocate an autorelease pool but then store it off the stack. In a
+        GC environment this led to it being collected, and thus caused badness
+        to ensue.  To work around this we simply avoid using a pool at all in
+        a GC environment as it would be a no-op anyway.
+
+        * bridge/objc/objc_instance.mm:
+        (allocateAutoReleasePool):
+        (ObjcInstance::virtualBegin):
+
+2009-10-27  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        When a Geolocation method is called, immediately calls the error calback asynchronously if permissions
+        have already been denied.
+        https://bugs.webkit.org/show_bug.cgi?id=27944.
+
+        Tests: fast/dom/Geolocation/permission-denied-already-error.html
+               fast/dom/Geolocation/permission-denied-already-success.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. GeoNotifier takes Geolocation object as constructor argument.
+        (WebCore::Geolocation::GeoNotifier::setFatalError): Added. Sets a fatal error for this notifier, causing it to terminate immediately and call the error callback asynchronously.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Added. Used to call the error callback asynchronously on fatal error.
+        (WebCore::Geolocation::getCurrentPosition): Modified. Calls startRequest.
+        (WebCore::Geolocation::watchPosition): Modified. Calls startRequest.
+        (WebCore::Geolocation::startRequest): Added. Common functionality for starting a one-shot or watch request. Sets a fatal error on the notifier if permissions have already been denied.
+        (WebCore::Geolocation::fatalErrorOccurred): Added. Registers that a notifier has encountered a fatal error and should be destroyed.
+        (WebCore::Geolocation::setIsAllowed): Modified. Uses a standard error message for the error callback when permissions are denied.
+        * page/Geolocation.h: Modified.
+        (WebCore::Geolocation::isDenied): Added. Determines whether permissions have been denied.
+
+2009-10-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a bug where I was using the wrong Canvas pointer to do a cross-domain check
+        https://bugs.webkit.org/show_bug.cgi?id=30840
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+
+2009-10-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVGStyledElement::getPresentationAttribute() can return a shared CSSValue (some SVG tests randomly fail on the bot, and in release builds)
+        https://bugs.webkit.org/show_bug.cgi?id=29620
+
+        SVG was modifying CSSValues cached of off CSSMappedAttributeDeclarations.
+        This patch fixes the check to make sure that a new CSSMappedAttributeDeclaration is
+        created before returning a CSSValue that JavaScript can modify.
+
+        Test: svg/dom/getPresentationAttribute-cache-corruption.svg
+
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::getPresentationAttribute):
+
+2009-10-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Incomplete repaint of text field in relative positioned inline at imdb.com
+        https://bugs.webkit.org/show_bug.cgi?id=30047
+
+        Test: fast/repaint/inline-relative-positioned.html
+
+        Implemented offsetFromContainer(), mapLocalToContainer() and
+        mapAbsoluteToLocalPoint() in RenderInline.
+
+        * rendering/RenderBox.h: Fixed argument names in the declaration of
+        mapLocalToContainer().
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::offsetFromContainer):
+        (WebCore::RenderInline::mapLocalToContainer):
+        (WebCore::RenderInline::mapAbsoluteToLocalPoint):
+        * rendering/RenderInline.h:
+
+2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Speculative build fix for Chromium.
+
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-10-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        Make WebGL context failure more robust and make it succeed in more cases
+        https://bugs.webkit.org/show_bug.cgi?id=30349
+
+        Bubble a failure to get a CGLContext up to HTMLContextElement so it can
+        return null from getContext. Also added a more robust pixel format choosing 
+        mechanism and can render correctly when a SW renderer is chosen.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * html/canvas/CanvasRenderingContext.h:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.h:
+        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
+        (WebCore::CanvasRenderingContext3D::cleanupAfterGraphicsCall):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer copyCGLPixelFormatForDisplayMask:]):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::setPixelFormat):
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::ensureContext):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Mac build fix: a forwarding header.
+
+        * ForwardingHeaders/wtf/DateInstanceCache.h: Added.
+
+2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Making fontWeightIsBold static to fix Snow Leopard build.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::fontWeightIsBold):
+
+2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKit cannot remove nested bold tags
+        https://bugs.webkit.org/show_bug.cgi?id=30784
+
+        This patch modifies getPropertiesNotInComputedStyle so that it compares font-weight
+        more flexibly. Instead of comparing cssText, it uses fontWeightIsBold which converts
+        all font weights to either bold or unbold state.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::fontWeightIsBold):
+        (WebCore::getPropertiesNotInComputedStyle): Removes font-weight property
+        if two style have the same value under getFontWeightValue
+
+2009-10-27  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Give an ability to WebKit to free statically allocated pointers
+        before quit.
+        https://bugs.webkit.org/show_bug.cgi?id=27980
+
+        No new tests for this as the change does not affect WebKit
+        functionality, but only memory usage.
+
+        * JavaScriptCore/wtf/StdLibExtras.h:
+        Allowed for the override of DEFINE_STATIC_LOCAL via compiler 
+        commandline options or elsewhere in the code. Useful for 
+        implementing custom builds that free resources allocated via
+        DEFINE_STATIC_LOCAL.
+
+2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Build fix, no review needed.
+
+        Fixing the BUILD. m_estimatedSize in Database.h should be of type
+        'unsigned long' instead of 'unsigned long long'.
+
+        No tests required.
+
+        * storage/Database.h:
+
+2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Refactoring the Database class to not depend on
+        OriginQuotaManager. Also, adding a SecurityOrigin copy to each
+        Database instance, that is safe to use on the file
+        thread. Finally, adding new simple fields and getters to the
+        Database object for storing/getting the display name and estimated
+        size specified by the user in the openDatabase() call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30548
+
+        * page/SecurityOrigin.h:
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase): Storing the display name and
+        the estimated size in the Database object.
+        (WebCore::Database::Database): Storing the display name and the
+        estimated size in the Database object, as well as a SecurityOrigin
+        instance that is safe to use on the DB thread.
+        (WebCore::Database::maximumSize): Delegate the call to
+        DatabaseTracker::getMaxSizeForDatabase().
+        (WebCore::Database::databaseThreadSecurityOrigin): Return the
+        SecurityOrigin instance that's safe to use on the DB thread.
+        (WebCore::Database::threadSafeSecurityOrigin): Return the
+        SecurityOrigin instance that's safe to use on the current thread.
+        (WebCore::Database::displayName): Return the display name
+        specified by the user in the openDatabase() call.
+        (WebCore::Database::estimatedSize): Return the estimated size
+        specified by the user in the openDatabase() call.
+        (WebCore::Database::fileName): Return the name of the file where
+        the current Database is tored.
+        * storage/Database.h:
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase): Returns the
+        maximum size for a DB file based on the current size of that file
+        and the space available for that origin.
+        * storage/DatabaseTracker.h:
+        * storage/SQLTransaction.cpp:
+        * storage/SQLTransactionClient.cpp:
+        (WebCore::SQLTransactionClient::didCommitTransaction): Use the
+        correct SecurityOrigin instance.
+
+2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Pretty Print all HTML Collection Types like we do for NodeList
+        https://bugs.webkit.org/show_bug.cgi?id=30709
+
+        Test: inspector/console-format-collections.html
+
+        * inspector/front-end/InjectedScript.js:
+        (Object.type): check for instances of HTMLCollection like we do for NodeList
+        * inspector/front-end/inspector.js: added WebInspector.pendingDispatches counter
+        (WebInspector.dispatch): increment and decrement dispatch counter
+        (WebInspector.runAfterPendingDispatches): run when there are no more dispatches
+
+2009-10-27  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds XMLHttpRequest support to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=30578
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::didChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::didLoadXHR):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord):
+        (WebCore::TimelineRecordFactory::createXHRLoadTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2009-10-27  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (Safari 4.0.3-ToT): After pressing Shift-PageDown, pressing Shift-Up 
+        extends the top of the selection upwards (but should shrink the selection instead)
+        <rdar://problem/7269075>
+        https://bugs.webkit.org/show_bug.cgi?id=29981
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modify): Added setting m_lastChangeWasHorizontalExtension.
+
+2009-10-27  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Tim Hatcher.
+        
+        Removed an extra console.log from ElementsTreeOutline.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+
+2009-10-27  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Rewrote JavaScriptSourceSyntaxHighlighter to be more accurate
+        https://bugs.webkit.org/show_bug.cgi?id=27147
+
+        Tests: LayoutTests/inspector/javascript-syntax-highlight.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.process): Added. Processes 100 tokens at a time.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.lex): Added. Scans for a token.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.appendNonToken): Added. Appends the non-token characters that lex ignored.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.syntaxHighlightNode): Added. To syntax highlight node in ElementsTreeOutline.
+
+2009-10-27  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Missing null check after string conversion in error reporting
+        https://bugs.webkit.org/show_bug.cgi?id=30774
+
+        Add null check after string conversion in error reporting code.
+        ToString conversion can fail for instance when an exception is
+        thrown during conversion.
+
+        Test: fast/dom/error-to-string-stack-overflow.html
+
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-10-27  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Use a pair of maps to store Geolocation watchers.
+        https://bugs.webkit.org/show_bug.cgi?id=29178
+
+        The pair of maps allows us to look up a watcher either by its ID or by its GeoNotifier object.
+        The ability to look up by a watcher by its GeoNotifier object will be required when implementing
+        Geolocation::fatalErrorOccurred. See https://bugs.webkit.org/show_bug.cgi?id=27944
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::Watchers::set): Added. Adds a watcher with the given ID.
+        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by ID.
+        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by GeoNotifier object.
+        (WebCore::Geolocation::Watchers::clear): Added. Removes all watchers.
+        (WebCore::Geolocation::Watchers::isEmpty): Added. Determines if there are no watchers.
+        (WebCore::Geolocation::Watchers::getNotifiersVector): Added. Gets a vector of the GeoNotifier objects.
+        (WebCore::Geolocation::watchPosition): Modified. Rename watcher identifier static variable.
+        (WebCore::Geolocation::stopTimersForWatchers): Modified. Use Watchers::getNotifiersVector.
+        (WebCore::Geolocation::handleError): Modified. Use Watchers::getNotifiersVector.
+        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Use Watchers::getNotifiersVector.
+        * page/Geolocation.h: Modified. Adds Geolocation::Watchers class.
+
+2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] DOM Storage runtime flag should default to on
+        https://bugs.webkit.org/show_bug.cgi?id=30828
+
+        The DOM Storage runtime flag was supposed to default to on.  I accidentally
+        changed the logic to default to false when I moved the flag.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+
+2009-10-27  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix crash found in chromium test_shell.
+        https://bugs.webkit.org/show_bug.cgi?id=30808
+
+        When WebSocket is deleted without close, webkit would crash
+        when it handles didClose.
+
+        Check scriptExecutionContext before post task for event.
+        Use WebSocketChannel::disconnect() instead of close() in WebSocket
+        destructor, so that WebSocketChannel should not call deleted WebSocket
+        back in didClose().
+        To make sure WebSocketChannel alive while it is processing WebSocket
+        protocol over SocketStreamHandle, ref() in connect() and deref() in
+        didClose().
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::~WebSocket):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::disconnect):
+        (WebCore::WebSocketChannel::didClose):
+        (WebCore::WebSocketChannel::didReceiveData):
+        * websockets/WebSocketChannel.h:
+
+2009-10-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Updated Apple license
+
+        * LICENSE-APPLE:
+
+2009-10-27  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig.
+
+        Re-enable the check that disallows pages with unload handlers in the page cache.
+
+        <rdar://problem/7196485> and http://webkit.org/b/29021 
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-10-27  Timothy Hatcher  <timothy@apple.com>
+
+        Remove more empty files that didn't get removed earlier.
+
+        * inspector/DOMDispatchTimelineItem.cpp: Removed.
+        * inspector/DOMDispatchTimelineItem.h: Removed.
+
+2009-10-27  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix assertion crashes introduced by changes made in r50110.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement): only call popCurrentNode() if there are nodes left in the stack.
+
+2009-10-27  Timothy Hatcher  <timothy@apple.com>
+
+        Remove empty files that didn't get removed earlier.
+
+        * inspector/TimelineItem.cpp: Removed.
+        * inspector/TimelineItem.h: Removed.
+
+2009-10-27  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        First part of the implementation of AtkTable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getCell):
+        (getCellIndex):
+        (webkit_accessible_table_ref_at):
+        (webkit_accessible_table_get_index_at):
+        (webkit_accessible_table_get_n_columns):
+        (webkit_accessible_table_get_n_rows):
+        (webkit_accessible_table_get_column_extent_at):
+        (webkit_accessible_table_get_row_extent_at):
+        (webkit_accessible_table_get_row_header):
+        (atk_table_interface_init):
+        (AtkInterfacesInitFunctions):
+        (GetAtkInterfaceTypeFromWAIType):
+
+2009-10-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Lars Knoll.
+
+        [Qt] Don't lose remainder when computing wheel event deltas
+
+        * platform/qt/WheelEventQt.cpp:
+
+2009-10-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        Fix QtWebKit build for WIN_OS if Netscape plug-in support
+        is turned off and refactor some related code
+        https://bugs.webkit.org/show_bug.cgi?id=30786
+
+        No new tests as there is no new functionality introduced.
+
+        * platform/FileSystem.h: Refactor to make sure that each different
+        type definition is only repeated once.
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::compareFileVersion): Move it out from the
+        ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH guard and combine it with the
+        function body from PluginPackageWin.
+
+        * plugins/win/PluginPackageWin.cpp: Remove compareFileVersion as
+        it is now in PluginPackage.cpp.
+
+2009-10-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27011
+        [Gtk] Implement support for get_index_in_parent
+
+        Implement atk_object_get_index_in_parent.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_index_in_parent):
+
+2009-10-27  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r50131.
+        http://trac.webkit.org/changeset/50131
+
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::ObjcInstance):
+        (ObjcInstance::virtualEnd):
+
+2009-10-26  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30491
+
+        Fixes an issue where pressing return/enter on the keyboard 
+        in <isindex> does not submit it if is not within a <form>.
+
+        According to the HTML 2.0 thru HTML 4.01 spec 
+        (http://www.w3.org/MarkUp/html-spec/html-spec_7.html#SEC7.5), the 
+        <isindex> element does not need to be within a <form> element in 
+        order to submit it. It can submitted on its own. Also, if present,
+        the href property of the <base> element will dictate where to submit
+        the value of the <isindex> element (this is analogous to the action 
+        property of the <form> element).
+
+        Tests: http/tests/misc/isindex-with-no-form-base-href.html
+               http/tests/misc/isindex-with-no-form.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler): Calls createTemporaryFormForIsIndex()
+        to create a <form> if none is present and we are an <isindex> element.
+        (WebCore::HTMLInputElement::createTemporaryFormForIsIndex): Added.
+        * html/HTMLInputElement.h:
+
+2009-10-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Crash occurs after launching Newsfire 1.6 for the first time
+        https://bugs.webkit.org/show_bug.cgi?id=30807
+
+        Use a RetainPtr in ObjcBinding to ensure that we adequately
+        protect the autorelease pool from GC in GC'd applications.
+
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::ObjcInstance):
+        (ObjcInstance::virtualEnd):
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r50125.
+
+        * WebCore.pro: Rename TimelineItem to TimelineRecord.
+
+2009-10-26  Matt Mueller  <mattm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Refactor synchronizable property handling to store one shouldSynchronize flag per set of properties rather than one per property.
+
+        Fixes reading uninitialized memory in SynchronizableProperty hash function as well as simplifying the code.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30658
+
+        Covered by running various svg tests under valgrind, ex:
+        LayoutTests/svg/custom/js-late-mask-and-object-creation.svg
+
+        * svg/SynchronizablePropertyController.cpp:
+        (WebCore::SynchronizableProperties::addProperty):
+        (WebCore::SynchronizableProperties::synchronize):
+        (WebCore::SynchronizableProperties::startAnimation):
+        (WebCore::SynchronizableProperties::stopAnimation):
+        (WebCore::SynchronizablePropertyController::registerProperty):
+        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
+        (WebCore::SynchronizablePropertyController::synchronizeProperty):
+        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
+        (WebCore::SynchronizablePropertyController::startAnimation):
+        (WebCore::SynchronizablePropertyController::stopAnimation):
+        * svg/SynchronizablePropertyController.h:
+        (WebCore::SynchronizableProperties::SynchronizableProperties):
+        (WebCore::SynchronizableProperties::setNeedsSynchronization):
+
+2009-10-26  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Renames TimelineItem to TimelineRecord and updates all call sites.
+        https://bugs.webkit.org/show_bug.cgi?id=30785
+
+        * GNUmakefile.am: 
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addRecordToTimeline):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didInstallTimer):
+        (WebCore::InspectorTimelineAgent::didRemoveTimer):
+        (WebCore::InspectorTimelineAgent::willFireTimer):
+        (WebCore::InspectorTimelineAgent::didFireTimer):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        (WebCore::InspectorTimelineAgent::RecordEntry::RecordEntry):
+        * inspector/TimelineItemFactory.cpp: Removed.
+        * inspector/TimelineItemFactory.h: Removed.
+        * inspector/TimelineRecordFactory.cpp: Added.
+        (WebCore::TimelineRecordFactory::createGenericRecord):
+        (WebCore::TimelineRecordFactory::createDOMDispatchRecord):
+        (WebCore::TimelineRecordFactory::createGenericTimerRecord):
+        (WebCore::TimelineRecordFactory::createTimerInstallRecord):
+        * inspector/TimelineRecordFactory.h: Added.
+        (WebCore::TimelineRecordFactory::TimelineRecordFactory):
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.addRecordToTimeline):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.getRecordTypeName):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+
+2009-10-26  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Windowless Plugins : Print preview shows only part of flash when view is scrolled
+        
+        When printing, QPrinter's preview mode uses a QPicture to capture the output. The
+        QPicture holds a reference to the X Pixmap. As a result, the print preview would
+        update itself when the X Pixmap changes. To prevent the print preview from updating
+        whenever m_drawable is updated (i.e when the view updates), we create a copy.
+        
+        We require that a QPixmap::copy() result in a QPixmap backed by a XPixmap
+        regardless of the graphicssystem. This is taken care of by
+        commit d310f7c710ecb331a9689861f0551eabd38e946e in Qt (4.6)
+        
+        The beauty of this patch is that the newly created X Pixmap is managed by Qt and
+        it will free the Pixmap whenever the user closes the print preview dialog and
+        handles the case of displaying multiple preview dialogs nicely.
+        
+        All credit to Samuel Rødal for suggesting usage of QPixmap::copy().
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30714
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-26  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Don't store properties in the MediaPlayerPrivate class
+
+        Access them via the MediaPlayer class instead.
+        https://bugs.webkit.org/show_bug.cgi?id=30462
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::setVisible):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-10-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30801>.
+        Web Inspector: Control + ]/[ on Windows doesn't change Panels.
+        
+        In my testing, Windows uses "U+00DB" and "U+00DD" to represent
+        [ and ], so we should honor those as well.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Make .rc files compile on Windows without depending on MFC headers
+        https://bugs.webkit.org/show_bug.cgi?id=30750
+
+        * WebCore.vcproj/QTMovieWin.rc: Use winresrc.h because it exists 
+        even when MFC is not installed, and is all that's needed here.
+
+2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Build corrections for ENABLE_FILTERS in Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30797
+
+        Build correction for ENABLE_FILTERS feature.  No new tests needed.
+
+        * platform/graphics/filters/FEColorMatrix.cpp: Use MathExtras.h and
+          its piDouble constant.
+        * platform/graphics/filters/FEGaussianBlur.cpp: Use MathExtras.h and
+          its piDouble constant.  Remove unnecessary call to floor used in
+          the division of an unsigned, converting to int.
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp: Correct include
+          style for MathExtras.h.
+
+2009-10-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7289467> and http://webkit.org/b/30798 - REGRESSION (r48687): www.myuhc.com doesn't load.
+
+        Test: fast/loader/grandparent-completion-starts-redirect.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::completed): Notify all descendants that the load completed, not just direct children.
+
+2009-10-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Re-add CSSPropertyWebkitBackgroundSize in one more place
+
+        Fixes transitions/multiple-background-size-transitions.html, transitions/background-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+
+2009-10-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Tidy up the DOM Storage runtime flag stuff
+        https://bugs.webkit.org/show_bug.cgi?id=30794
+
+        Clean up the DOM Storage runtime flag stuff to match the new way of doing
+        things.  No behavioral changes.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::setLocalStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::localStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::setSessionStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::sessionStorageEnabled):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * storage/Storage.cpp:
+        * storage/Storage.h:
+
+2009-10-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7308952> and http://webkit.org/b/30424 - REGRESSION (r48687): Pages on ucas.com appear blank.
+
+        Test: fast/loader/history-forward-in-head.html
+
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation): Restore the moved canGoBackOrForward() check.
+          This restores the side effect of an invalid history navigation canceling previous scheduled redirects
+          and also fixes the bug of scheduling an invalid history navigation canceling parsing of the current document.
+        (WebCore::RedirectScheduler::timerFired): Removed the canGoBackOrForward() check as it is now made before
+          the redirect is scheduled.
+
+2009-10-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30049
+        <rdar://problem/7286002> Manipulating DOM from a script while parsing XHTML can cause a crash
+
+        Tests: fast/parser/remove-current-node-parent-x-2.xhtml
+               fast/parser/remove-current-node-parent-x.xhtml
+
+        * dom/XMLTokenizer.h: Store the whole stack of parent nodes - element.parentNode() is
+        unreliable after DOM manipulation.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::pushCurrentNode): Push the new node onto stack.
+        (WebCore::XMLTokenizer::popCurrentNode): This is now called instead of setCurrentNode when
+        exiting a node.
+        (WebCore::XMLTokenizer::clearCurrentNodeStack): We're aborting; or just done parsing. This
+        replaces setCurrentNode(0).
+        (WebCore::XMLTokenizer::enterText): Call pushCurrentNode().
+        (WebCore::XMLTokenizer::exitText): Call popCurrentNode(), removing a long-standing FIXME
+        (not sure if it was ever practical though - how can a parent become null while adding text?)
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::~XMLTokenizer): Call clearCurrentNodeStack().
+        (WebCore::XMLTokenizer::startElementNs): Call pushCurrentNode().
+        (WebCore::XMLTokenizer::endElementNs): Call popCurrentNode() to safely get to a parent. Also
+        added a check fo script element still being in document - Firefox parses those that aren't,
+        but doesn't execute them.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::parseStartElement):
+        (WebCore::XMLTokenizer::parseEndElement):
+        Match libxml2 version changes.
+
+2009-10-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        background-size: X treated as background-size: X X, not background-size: X auto
+        https://bugs.webkit.org/show_bug.cgi?id=28440
+
+        Updated fast/backgrounds/size/resources/parsing-background-size-values.js
+        and fast/backgrounds/size/resources/parsing-inherit.js
+
+        Reinstated -webkit-background-size and kept its behavior of filling in
+        the second value with the first one; and changed background-size to have
+        the behavior of filling in the second value with 'auto'.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (computedProperties): Re-added CSSPropertyWebkitBackgroundSize.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Ditto.
+        (WebCore::CSSParser::parseFillSize): Adapted for the new parsing rule.
+        (WebCore::CSSParser::parseFillProperty): Re-added
+        CSSPropertyWebkitBackgroundSize.
+        (WebCore::cssPropertyID): Removed mapping of -webkit-background-size to
+        background-size.
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in: Re-added -webkit-background-size.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Re-added
+        CSSPropertyWebkitBackgroundSize.
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Use "%lli" to format "long long" on WIN_OS to fix HTML5 WebDB crash
+        https://bugs.webkit.org/show_bug.cgi?id=30777
+
+        No new tests as the crash can be reproduced by existing storage
+        LayoutTests (by hitting an assert in debug mode Webkit on WIN_OS).
+
+        * platform/text/String.cpp:
+        (WebCore::String::number): Qt's QString::vsprintf does not
+        understand the "%I64u" format string. Always use the "%lli"
+        format string for Qt port.
+
+2009-10-26  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Roll back r50073 because r50041-50043 were reverted.  r50073 was
+        a chromium side fix for r50041.
+        https://bugs.webkit.org/show_bug.cgi?id=30789
+
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+
+2009-10-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=30765
+        REGRESSION (r48701): Removing an event listener causes the one added just after it not to fire
+        
+        and related bugs.
+
+        If the event listener being removed is prior to the current firing event
+        iterator, we need to decrement the current firing event iterator in
+        addition to the endpoint. (Otherwise, shrinking the event listener vector
+        by one implicity moves the current firing event iterator forward by one.
+        It's like relativity, only without the planets.)
+        
+        Also took the opportunity to change some pointers to references, since
+        they can't be null.
+
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::removeAllEventListeners): Update iterator in addition
+        to end, if need be.
+        (WebCore::EventTarget::fireEventListeners): Updated for interface changes.
+        Added a comment to explain a behavior that was implicit enough to be
+        confusing.
+
+        * dom/EventTarget.h:
+        (WebCore::FiringEventIterator::FiringEventIterator):
+        (WebCore::EventTarget::isFiringEventListeners): Updated for interface changes.
+
+2009-10-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30792>.
+        Web Inspector: When changing resource scope, resource graph can get in weird state.
+        
+        If the user was scrolled down while looking at All resources, and then just
+        selects Fonts, or something that doesn't have many resources, then the graph
+        will stay scrolled down, even when there is no content there.
+        
+        When the filter is updated, scroll to the top of the graph view, so this won't
+        happen.
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+
+2009-10-26  Sam Weinig  <sam@webkit.org>
+
+        Fix mac clean build.
+
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Extract AbstractTimelinePanel that will be a base
+        class for ResourcesPanel and TimelinePanel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30776
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AbstractTimelinePanel.js: Added.
+        (WebInspector.AbstractTimelinePanel):
+        (WebInspector.AbstractTimelinePanel.prototype.get categories):
+        (WebInspector.AbstractTimelinePanel.prototype.showCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.hideCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.createTimelinePanels):
+        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel.createFilterElement):
+        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel):
+        (WebInspector.AbstractTimelinePanel.prototype.filter):
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.AbstractTimelinePanel.prototype._updateSummaryGraph):
+        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.AbstractTimelinePanel.prototype.get needsRefresh):
+        (WebInspector.AbstractTimelinePanel.prototype.set needsRefresh):
+        (WebInspector.AbstractTimelinePanel.prototype.refreshIfNeeded):
+        (WebInspector.AbstractTimelinePanel.prototype.show):
+        (WebInspector.AbstractTimelinePanel.prototype.resize):
+        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.computeSummaryValues):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.TimelineCalculator.prototype.get boundarySpan):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype._value):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        * inspector/front-end/ResourceCategory.js:
+        (WebInspector.ResourceCategory):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
+        (WebInspector.ResourcesPanel.prototype.get categories):
+        (WebInspector.ResourcesPanel.prototype.showCategory):
+        (WebInspector.ResourcesPanel.prototype.hideCategory):
+        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
+        (WebInspector.ResourcesPanel.prototype.populateSidebar):
+        (WebInspector.ResourcesPanel.prototype.createPanelEnabler):
+        (WebInspector.ResourcesPanel.prototype.createStatusbarButtons):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype.resize):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth):
+        (WebInspector.ResourceTimeCalculator):
+        (WebInspector.ResourceTransferSizeCalculator):
+        (WebInspector.ResourceTransferSizeCalculator.prototype.computeBarGraphLabels):
+        * inspector/front-end/SummaryBar.js:
+        (WebInspector.SummaryBar.prototype.update):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-10-26  Avi Drissman  <avi@google.com>
+
+        Reviewed by Darin Adler.
+
+        Use Helvetica in the Inspector as intended.
+        https://bugs.webkit.org/show_bug.cgi?id=30787
+
+        * inspector/front-end/inspector.css:
+
+2009-10-26  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Don't set window.opener to 0 for the current FrameLoader if a noreferrer link was clicked, only suppress opener in a new frame.
+        https://bugs.webkit.org/show_bug.cgi?id=30781
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::urlSelected): Don't suppress opener in the current frame for noreferrer navigations.
+
+2009-10-26  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Data loss occurs when unbolding nested bold tags.
+        https://bugs.webkit.org/show_bug.cgi?id=30083
+
+        Fixes the loop in swapInNodePreservingAttributesAndChildren by saving nextSibling() of child
+        to a temporary valuable.  It was originally calling nextSibling() after appending the child
+        to new parent, in which case, nextSibling is always 0.
+
+        Test: editing/style/unbolding-nested-b.html
+
+        * editing/ReplaceNodeWithSpanCommand.cpp:
+        (WebCore::swapInNodePreservingAttributesAndChildren):
+
+2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Storage events should use Document::url() rather than documentURI()
+        https://bugs.webkit.org/show_bug.cgi?id=30535
+
+        Storage events should use Document::url() rather than Document::documentURI()
+        per http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
+
+        Test: storage/domstorage/documentURI.html
+
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch):
+
+2009-10-26  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Rollout r50041-50043.  The HTML5 spec changed to make HTMLOptionsCollection
+        inherit from HTMLCollection.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        (WebCore::JSHTMLAllCollection::namedItem):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        (WebCore::toJS):
+        * bindings/js/JSHTMLCollectionFunctions.h: Removed.
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::length):
+        (WebCore::JSHTMLOptionsCollection::indexSetter):
+        * bindings/objc/DOMHTML.mm:
+        (kitClass):
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/HTMLCollection.idl:
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Build fix for ENABLE_FILTERS under Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30762
+
+        Build correction for ENABLE_FILTERS feature.  No new tests needed.
+
+        * WebCore.vcproj/WebCore.vcproj:  Make the following changes:
+          (1) Create a new 'filters' sub-folder of the platform/graphics 
+              folder to properly show the sources held in this directory.
+          (2) Move the files that are currently shown in svn/graphics/filters
+              to platform/graphics/filters (where they actually live on disk).
+          (3) Add the missing SVGFilter, SVGFilterBuilder, and SVGFETile to
+              the project so they are built.
+          (4) Remove SVGFEFloodElement.cpp from the build, since it is already
+              being compiled by SVGAllInOne.cpp.  Its presence as a separate
+              entity is causing a linker warning for duplicate symbols.
+          (5) Add ImageBuffer.cpp to the build to support color space
+              calculations for non-CG builds.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Add the platform/graphics/filters
+          path to the search paths in the project.
+
+2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        console.assert should prefix messages with "Assertion failed: "
+        https://bugs.webkit.org/show_bug.cgi?id=19135
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype.toMessageElement): Append "Assertion failed: " for AssertMessageType.
+        (WebInspector.ConsoleMessage.prototype.toString):
+        * page/Console.cpp:
+        (WebCore::Console::assertCondition): Use AssertMessageType.
+        * page/Console.h:
+        (WebCore::MessageType): Added AssertMessageType.
+
+2009-10-26  Rahul Kuchhal  <kuchhal@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Prevent crash when optgroup element is empty by adding a NULL check.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30365
+
+        Test: fast/forms/select-empty-optgroup.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::appendFormData):
+
+2009-10-21  Steven Knight  <sgk@chromium.org>
+
+        Reviewed by David Levin.
+
+        Refactor gyp for separate webcore_bindings{,_sources} targets.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30447
+
+        Handle long link lines by building .idl-generated bindings in a
+        separate webcore_bindings library target.  Avoid Visual Studio
+        dependency issues by building additional generated .cpp and .h files
+        in a separate webcore_bindings_sources target.
+
+        Chrome should still build and test successfully.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-26  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        Make the number of connections for chromium controlled by
+        chromium rather than by ResourceRequestBase.
+        https://bugs.webkit.org/show_bug.cgi?id=30661
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/chromium/ResourceRequest.cpp:
+
+2009-10-26  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. make distcheck build fixes.
+
+        * GNUmakefile.am:
+
+2009-10-26  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Unbreak Chromium build: that requires adding custom implementations
+        for HTMLOptionsCollection's item and namedItem.  Keep v8 binding
+        close to JSC bindings as well.
+        https://bugs.webkit.org/show_bug.cgi?id=30780
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::getNamedItemsFromCollection):
+        (WebCore::getItemFromCollection):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adam Barth and Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30723
+        <rdar://problem/6189415> Input names added to multipart/form-data headers need to be escaped.
+
+        Test: http/tests/security/escape-form-data-field-names.html
+
+        * platform/network/FormDataBuilder.cpp:
+        (WebCore::appendQuotedString):
+        (WebCore::FormDataBuilder::beginMultiPartHeader):
+        (WebCore::FormDataBuilder::addFilenameToMultiPartHeader):
+        Percent-escape line breaks and quotation marks.
+
+2009-10-26  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Adds DOMTimer support to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=30467
+
+        * inspector/InspectorTimelineAgent.cpp: Added timer support and fixed some method names.
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didInstallTimer): Added.
+        (WebCore::InspectorTimelineAgent::didRemoveTimer): Added.
+        (WebCore::InspectorTimelineAgent::willFireTimer): Added.
+        (WebCore::InspectorTimelineAgent::didFireTimer): Added.
+        (WebCore::InspectorTimelineAgent::addItemToTimeline): Added.
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentTimelineItem): Renamed.
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineItemFactory.cpp: Add methods for timer-related ScriptObjects.
+        (WebCore::TimelineItemFactory::createGenericTimerTimelineItem):
+        (WebCore::TimelineItemFactory::createTimerInstallTimelineItem):
+        * inspector/TimelineItemFactory.h:
+        * page/DOMTimer.cpp: Added instrumentation points.
+        (WebCore::DOMTimer::install):
+        (WebCore::DOMTimer::removeById):
+        (WebCore::DOMTimer::fired):
+
+2009-10-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6988966> Hardware layers do not show up in page snapshots
+
+        Add a method that gets called when snapshotting Canvas3DLayers for page snapshots,
+        that allows the layer to return a CGImageRef of its contents.
+        
+        * platform/graphics/mac/Canvas3DLayer.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer copyImageSnapshotWithColorSpace:]):
+
+2009-10-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Pass "console" as object group when evaluating selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30738
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
+
+2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix for Console not showing repeat count when repeatedly logging an Event
+        https://bugs.webkit.org/show_bug.cgi?id=30324
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::updateRepeatCountInConsole): Added.
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addConsoleMessage): Calls updateRepeatCountInConsole if it is a repeating message.
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage): Renamed WebCore::InspectorFrontend::addMessageToConsole
+        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount): Added. Called when repeatCount is incremented.
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.addMessage): Removed calls to msg.isEqual.
+        (WebInspector.ConsoleView.prototype.updateMessageRepeatCount): Added.
+        (WebInspector.ConsoleView.prototype._incrementErrorWarningCount): Added. Updates the error/warning count.
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        (WebInspector.ConsoleMessage):
+        (WebInspector.ConsoleMessage.prototype.toMessageElement): Use ConsoleMessage._updateRepeatCount
+        (WebInspector.ConsoleMessage.prototype._updateRepeatCount):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addConsoleMessage): Renamed WebInspector.addMessageToConsole.
+        (WebInspector.updateConsoleMessageRepeatCount): Added.
+
+2009-10-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        crash with AX on when an image map contains an anchor tag
+        https://bugs.webkit.org/show_bug.cgi?id=30739
+
+        Tests: accessibility/crashing-a-tag-in-map.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::addChildren):
+
+2009-10-26  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds feature ENABLE guards to V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=30697
+
+        This adds guards for the following features to the V8 bindings,
+        to allow builds with V8 to succeed when these features are not enabled.
+        - DATABASE
+        - WORKERS
+        - SHARED_WORKERS
+        - SVG
+        - XPATH
+        - XSLT
+        - INSPECTOR
+
+        This is a build fix only, no new tests required.
+
+        * bindings/v8/DOMObjectsInclude.h: Modified.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Modified.
+        * bindings/v8/V8Index.cpp: Modified.
+        * bindings/v8/V8Index.h: Modified.
+
+2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25679
+        [Gtk] Improve accessibility of focusable lists
+
+        Fixes the issues with the Atk states exposed for ListBoxOption
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkStateSetFromCoreObject):
+
+2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27085
+        [Gtk] Incorrect rendering of list
+
+        Adds a way for platforms to indicate that a particular object
+        should not be ignored.
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::accessibilityIsIgnored):
+
+2009-10-26  Kinuko Yasuda  <kinuko@google.com>
+
+        Reviewed by Jan Alonzo.
+
+        Bug 30619: [Linux] Menu key doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=30619
+
+        Test: manual-tests/keyboard-menukey-event.html
+        No new layout tests: testing this will require changes in the test
+        controller in a platform-specific way.
+
+        * platform/chromium/KeyCodeConversionGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
+        GDK_Menu to return VKEY_APPS instead of VKEY_MENU.
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
+        GDK_Menu to return V_APPS instead of VK_MENU.
+
+2009-10-25  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Reuse already fetched proxy.
+        https://bugs.webkit.org/show_bug.cgi?id=30747
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+
+2009-10-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        Build fix for WIN_OS if Netscape plugin support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=30753
+
+        * plugins/PluginDatabase.cpp:
+
+2009-10-25  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        A quick fix for Bug 29103.
+        Since String::startsWith() cannot fold non-ASCII characters, this change folds the prefix string
+        and the option string before calling String::startsWith().
+        https://bugs.webkit.org/show_bug.cgi?id=29103
+
+        Tests: fast/forms/listbox-typeahead-cyrillic.html
+               fast/forms/listbox-typeahead-greek.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::typeAheadFind):
+
+2009-10-25  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Expanding a node in the Console should not show the element in Elements panel
+        https://bugs.webkit.org/show_bug.cgi?id=30749
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.onmousedown): Check if inside disclosure triangle.
+
+2009-10-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=30751
+        HTMLOptionsCollection should not inherit from HTMLCollection
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Added JSHTMLCollectionFunctions.h
+
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        (WebCore::JSHTMLAllCollection::namedItem):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLOptionsCollection::getCallData):
+        (WebCore::JSHTMLOptionsCollection::canGetItemsForName):
+        (WebCore::JSHTMLOptionsCollection::nameGetter):
+        (WebCore::JSHTMLOptionsCollection::indexSetter):
+        (WebCore::JSHTMLOptionsCollection::item):
+        (WebCore::JSHTMLOptionsCollection::namedItem):
+        Refactor to use generic implementation of HTMLCollection bindings functions
+        from JSHTMLCollectionFunctions.h
+
+        * bindings/js/JSHTMLCollectionFunctions.h: Added.
+        (WebCore::getCollectionNamedItems):
+        (WebCore::getCollectionItems):
+        (WebCore::callHTMLCollectionGeneric):
+        Added generic functions that JSHTMLCollection, JSHTMLAllCollection and
+        JSHTMLOptionsCollection can all use.
+
+        * bindings/js/JSHTMLDocumentCustom.cpp: Add include of JSHTMLAllCollection.h
+        for toJS on document.all.
+
+        * bindings/objc/DOMHTML.mm:
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper):
+        Remove special cases for HTMLOptionsCollection.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/HTMLAllCollection.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-24  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fixed issue with IME inside console
+        https://bugs.webkit.org/show_bug.cgi?id=30660
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._promptKeyDown):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._promptKeyDown):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.searchKeyDown): Moved performSearch here from WebInspector.searchKeyUp.
+        (WebInspector.startEditing.element.handleKeyEvent):
+        (WebInspector.startEditing):
+        * inspector/front-end/utilities.js:
+        (isEnterKey): Added. Check if in IME.
+
+2009-10-24  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30752>.
+        Web Inspector: Multiple Selection on Scope Bars by default Conflicts with other behavior on OSX.
+        
+        Have the scope bars select one scope by default, but if the multiple selection key
+        is pressed, allow for multiple selection.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        (WebInspector.ConsoleView.prototype.filter):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.filter):
+        (WebInspector.ResourcesPanel.prototype._updateFilter):
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Make the scope bars in the Web Inspector match other scope bars in Mac OS X.
+        Also cleans up the CSS to use classes instead of ID selectors.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28186
+
+        Reviewed by Dan Bernstein.
+
+        * inspector/front-end/ResourcesPanel.js: Add the scope-bar class.
+        * inspector/front-end/inspector.css: Lots of changes to make it look right.
+        * inspector/front-end/inspector.html: Add the scope-bar class.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Fix selecting Resources in the Web Inspector's Resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30743
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.isCategoryVisible): Added.
+        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable): Call
+        isCategoryVisible on the ResourcesPanel.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Fix the Scope Bar in the Web Inspector's Resource panel, so that selecting
+        All will deselect the other filters.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30744
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.createFilterElement): Better syntax.
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.filter): Use a normal for loop,
+        and the child variable instead of target in the loop. Other clean up.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Make resizing the Web Inspector's Elements panel sidebar work again.
+        Also makes Resources panel use the sidebar code in Panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30742
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel): Don't create the sidebar with an argument.
+        (WebInspector.Panel.prototype.show): Call updateSidebarWidth.
+        (WebInspector.Panel.prototype.handleKeyEvent): Call handleSidebarKeyEvent.
+        (WebInspector.Panel.prototype.handleSidebarKeyEvent): Added.
+        (WebInspector.Panel.prototype.createSidebar): Renamed from _createSidebar.
+        (WebInspector.Panel.prototype._sidebarDragging): Call updateSidebarWidth.
+        (WebInspector.Panel.prototype.updateSidebarWidth): Renamed from _updateSidebarWidth.
+        (WebInspector.Panel.prototype.setSidebarWidth): Added. Called by updateSidebarWidth.
+        (WebInspector.Panel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel): Call createSidebar.
+        (WebInspector.ProfilesPanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show): Remove call to _updateSidebarWidth.
+        (WebInspector.ResourcesPanel.prototype.showResource): Call updateSidebarWidth
+        (WebInspector.ResourcesPanel.prototype.closeVisibleResource): Ditto.
+        (WebInspector.ResourcesPanel.prototype.setSidebarWidth): Added.
+        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth): Added.
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel): Call createSidebar.
+        (WebInspector.StoragePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel): Call createSidebar.
+        (WebInspector.TimelinePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Call updateSelection() in a few places so hovering in the Web Inspector's
+        Elements panel always has the correct row selection height.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30735
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton): Call updateSelection().
+        (WebInspector.ElementsTreeElement.prototype._insertInLastAttributePosition): Ditto.
+        * inspector/front-end/inspector.css: Prevent text wrapping in the middle of the add attribute text.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Remove the re-root tree feature from the Web Inspector's
+        Elements panel. This feature wasn't super useful and gets
+        in the way of double-click to edit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30736
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+
+2009-10-24  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Implements ReturnsNew hint for V8 bindings generation code.
+        https://bugs.webkit.org/show_bug.cgi?id=30745
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+
+2009-10-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Missing images at 350.org due to wrong URLs
+        https://bugs.webkit.org/show_bug.cgi?id=30748
+
+        Test: fast/dom/HTMLImageElement/parse-src.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::getURLAttribute): Pass the attribute value through deprecateParseURL().
+        This matches what the Objective-C bindings do, as well as what HTMLImageLoader::sourceURI()
+        and SVGImageLoader::sourceURI() do.
+
+2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r50013.
+
+        * WebCore.pro:
+
+2009-10-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Fix up to accommodate for HTMLAllCollection changes in
+        http://trac.webkit.org/changeset/49998.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+
+2009-10-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        <rdar://problem/7294131> Assertion failure in AuthenticationMac at
+        mac(const Credential&) after authenticating to MobileMe Gallery movie
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::Credential): Initialize m_persistence.
+        (WebCore::Credential::isEmpty): Made this method const.
+        * platform/network/Credential.h:
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac): Return nil if the Credential is empty.
+
+2009-10-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30617>.
+        Web Inspector: Resources Scope Bar Should Allow Combinations.
+        
+        Refactor the filtering in ResourcePanel to make it match ConsoleView,
+        and add a divider between All, and the other choices of Resource types.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.filter):
+        (WebInspector.ResourcesPanel.prototype._updateFilter):
+        * inspector/front-end/inspector.css:
+
+2009-10-23  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Ignore the Refresh header if we're in view source mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27239
+
+        Test: http/tests/security/view-source-no-refresh.html
+
+        * loader/FrameLoader.cpp: ignore Refresh in view-source mode.
+
+2009-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30734
+        Remove XMLTokenizer::m_currentNodeIsReferenced
+
+        No change in behavior, no tests.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::setCurrentNode):
+        * dom/XMLTokenizer.h:
+        Don't store a boolean for the current node being the document - we can always check for that.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        A fragment passed to XMLTokenizer is never null - in fact, the first thing we do is dereference
+        it unconditionally, and then begin checking it for null, as if it could help.
+
+2009-10-23  Beth Dakin  <bdakin@apple.com>
+
+        No review since this is a build fix.
+
+        Build fix for the Mac. (Build is only broken when SVG filters are 
+        enabled.)
+
+        Labelled these function static.
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::identity):
+        (WebCore::table):
+        (WebCore::discrete):
+        (WebCore::linear):
+        (WebCore::gamma):
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::boxBlur):
+
+2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement a Timeline panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30725
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/Images/timelineIcon.png: Added.
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.addItemToTimeline):
+        (WebInspector.timelineProfilerWasStarted):
+        (WebInspector.timelineProfilerWasStopped):
+        * inspector/front-end/TimelinePanel.js: Added.
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype.handleKeyEvent):
+        (WebInspector.TimelinePanel.prototype.timelineWasStarted):
+        (WebInspector.TimelinePanel.prototype.timelineWasStopped):
+        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
+        (WebInspector.TimelinePanel.prototype._innerAddItemToTimeline):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButton):
+        (WebInspector.TimelinePanel.prototype.setMainViewWidth):
+        (WebInspector.TimelinePanel.prototype.getItemTypeName):
+        (WebInspector.TimelineRecordTreeElement):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-10-23  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Clash Between Search's onkeyup and incremental search events
+        https://bugs.webkit.org/show_bug.cgi?id=30731
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.performSearch): prevent incremental search event from clobbering a forced search
+
+2009-10-23  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Removes the need for C++ Timeline types in InspectorTimelineAgent in favor
+        of ScriptObjects.
+        https://bugs.webkit.org/show_bug.cgi?id=30707
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/DOMDispatchTimelineItem.cpp: Removed.
+        * inspector/DOMDispatchTimelineItem.h: Removed.
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentTimelineItem):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::TimelineItemEntry::TimelineItemEntry):
+        * inspector/TimelineItem.cpp: Removed.
+        * inspector/TimelineItem.h: Removed.
+        * inspector/TimelineItemFactory.cpp: Added.
+        (WebCore::TimelineItemFactory::createGenericTimelineItem):
+        (WebCore::TimelineItemFactory::createDOMDispatchTimelineItem):
+        * inspector/TimelineItemFactory.h: Added.
+        (WebCore::):
+        (WebCore::TimelineItemFactory::TimelineItemFactory):
+
+2009-10-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30729
+        Provide private API to request the global context for a specific world.
+        Used to initialize parameters on the global object.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::globalObject):
+        * bindings/js/ScriptController.h:
+
+2009-10-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes style problems in Android-specific files.
+        https://bugs.webkit.org/show_bug.cgi?id=30717
+
+        Style changes only, no new tests possible.
+
+        * page/android/EventHandlerAndroid.cpp: Modified.
+        (WebCore::EventHandler::passMouseDownEventToWidget): Fixes whitespace in method signature.
+        (WebCore::EventHandler::passSubframeEventToSubframe): Fixes whitespace in method signature.
+        (WebCore::EventHandler::passWheelEventToWidget): Fixes whitespace in method signature.
+        (WebCore::EventHandler::passMouseMoveEventToSubframe): Fixes whitespace in method signature.
+        * platform/android/ClipboardAndroid.h: Modified. Fixes header include order and indenting.
+        * platform/android/CursorAndroid.cpp: Modified. 
+        (WebCore::grabCursor): Fixes function braces.
+        (WebCore::grabbingCursor): Fixes function braces.
+        * platform/android/FileChooserAndroid.cpp: Modified.
+        (WebCore::FileChooser::basenameForWidth): Fixes braces on while statement, and updates String::copy to String::threadsafeCopy.
+        * platform/android/FileSystemAndroid.cpp: Modified. Fixes header include order.
+        (WebCore::unloadModule): Fixes zero test.
+        (WebCore::writeToFile): Fixes if statement structure.
+        * platform/android/KeyEventAndroid.cpp: Modified.
+        (WebCore::windowsKeyCodeForKeyEvent): Fixes switch statement indenting.
+        (WebCore::keyIdentifierForAndroidKeyCode): Fixes switch statement indenting.
+        * platform/android/ScreenAndroid.cpp: Modified. Fixes header include order and switch statement indenting.
+        * platform/android/TemporaryLinkStubs.cpp: Modified. Fixes header include order.
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Another shot at a fixed build.
+
+        * DerivedSources.cpp:
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Another shot at a fixed build.
+
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-23  Brady Eidson  <beidson@apple.com>
+
+        50,000!
+
+        * ChangeLog: Point out revision 50,000.
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=30695
+        Drop .tags() support from HTMLCollection
+
+        - Make .tags() only work for HTMLAllCollections in JS. .tags() is still
+          available for all HTMLCollection like objects in Objective-C since that
+          is API.
+        - Auto-generate HTMLAllCollection.
+
+        Test: fast/dom/HTMLDocument/document-all.html
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSHTMLAllCollection.cpp: Removed.
+        * bindings/js/JSHTMLAllCollection.h: Removed.
+        * bindings/js/JSHTMLAllCollectionCustom.cpp: Added.
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::getCallData):
+        (WebCore::JSHTMLAllCollection::canGetItemsForName):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        (WebCore::JSHTMLAllCollection::namedItem):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.cpp:
+        (WebCore::Document::all):
+        * dom/Document.h:
+        * dom/HTMLAllCollection.idl: Removed.
+        * html/HTMLAllCollection.cpp: Added.
+        (WebCore::HTMLAllCollection::create):
+        (WebCore::HTMLAllCollection::HTMLAllCollection):
+        (WebCore::HTMLAllCollection::~HTMLAllCollection):
+        * html/HTMLAllCollection.h: Added.
+        * html/HTMLAllCollection.idl: Added.
+        * html/HTMLCollection.h:
+        * html/HTMLCollection.idl:
+        * html/HTMLDocument.idl:
+        * page/DOMWindow.idl:
+
+2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: pull basic sidebar implementation into the Panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30720
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel):
+        (WebInspector.Panel.prototype.jumpToPreviousSearchResult):
+        (WebInspector.Panel.prototype.handleKeyEvent):
+        (WebInspector.Panel.prototype._createSidebar):
+        (WebInspector.Panel.prototype._startSidebarDragging):
+        (WebInspector.Panel.prototype._sidebarDragging):
+        (WebInspector.Panel.prototype._endSidebarDragging):
+        (WebInspector.Panel.prototype._updateSidebarWidth):
+        (WebInspector.Panel.prototype.setCenterViewWidth):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.setCenterViewWidth):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.setCenterViewWidth):
+
+2009-10-23  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Slight optimizations to object returning and exception handling in generated V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=30599
+
+        * bindings/scripts/CodeGeneratorV8.pm: Generate better code
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertToV8Object): Added overload that takes a Ref<>
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Remove unnecessary template param to prevent compile error
+
+2009-10-23  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Volume slider always starts at half volume
+        https://bugs.webkit.org/show_bug.cgi?id=28322
+
+        Sets the value attribute of volume slider to the volume attribute
+        of the media element. Also update the value attribute of the
+        input element for the volume slider when the volume attribute
+        of the media element is updated.
+
+        Test: media/video-volume-slider.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::update):
+        Set the value attribute of the input element for the volume slider
+        using the current volume of the media element.
+        * rendering/MediaControlElements.h:
+        Add method definition of update().
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
+        Creates a volume slider with value attribute equals to the current
+        volume attribute of the media element.
+
+2009-10-23  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Chrome Linux: fix caret positioning in LTR complex languages
+        The caret is positioned off by one in languages like Thai.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28284
+
+        A group of us spent a while trying various approaches to write a test
+        for this; however, since it is only that the blinking cursor is
+        displayed incorrectly, we concluded it can not be tested.
+
+        (Patch by Hironori Bono.)
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::selectionRectForComplexText):
+
+2009-10-23  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium build after IsoldatedWorld change (r49963).
+        https://bugs.webkit.org/show_bug.cgi?id=30719
+
+        * bindings/ScriptControllerBase.cpp:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::executeScriptInIsolatedWorld):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        * dom/Document.cpp:
+        (WebCore::Document::createWrapperCache):
+        * dom/ScriptExecutionContext.cpp:
+        * dom/ScriptExecutionContext.h:
+        * xml/XMLHttpRequest.cpp:
+        * xml/XMLHttpRequest.h:
+
+2009-10-23  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix caretRangeFromPoint()/elementFromPoint() returns wrong result 
+        for a zoomed and scrolled page.
+        https://bugs.webkit.org/show_bug.cgi?id=30689.
+
+        The real cause is the wrong calculation of event.clientX/Y when
+        page is zoomed and scolled.
+        After Sam fixed the event.clientX/Y in r49551, the hit test point
+        should be recalculated (revert r49490).
+
+        Test: fast/dom/Document/CaretRangeFromPoint/caretRangeFromPoint-in-zoom-and-scroll.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint): calculate the correct point
+        relative to document when page is zoomed and scrolled.
+        (WebCore::Document::caretRangeFromPoint): calculate the correct point
+        relative to document when page is zoomed and scrolled.
+
+2009-10-22  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Adding a class that allows us to enable/disable features at
+        runtime. Adding a flag to enable database support.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30653
+
+        * WebCore.gypi:
+        * bindings/v8/RuntimeEnabledFeatures.cpp: Added.
+        * bindings/v8/RuntimeEnabledFeatures.h: Added.
+        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+
+2009-10-23  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector injects _inspectorCommandLineAPI into global object when opened
+        https://bugs.webkit.org/show_bug.cgi?id=30675
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript._ensureCommandLineAPIInstalled): Moved _inspectorCommandLineAPI from window to console.
+
+2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] don't undef NULL in Symbian emulator
+
+        npapi.h way of defining mwerks compiler,__intel__
+        and win32 are all true for Symbian emulator.
+        Changed the definions so that NULL won't be undefined
+        when compiling for Symbian emulator nor target HW.
+
+        * bridge/npapi.h:
+
+2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Correct linking of sqlite3 for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=30569
+
+        ".lib" will try to include library as static library
+        causing the library to be searched from wrong directory and if found
+        will be statically linked instead of the inteded dynamic linking.
+
+        * WebCore.pro:
+
+2009-10-23  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION: Copy is copying incorrect background-color
+        <rdar://problem/7248529>
+        https://bugs.webkit.org/show_bug.cgi?id=29697
+
+        Test: editing/execCommand/indent-paragraphs.html
+
+        This change removes the BackgroundColor from the list 
+        of inheritable CSS properties and changes significantly
+        the way we perform indentation.
+        The new implementation of IndentOutdentCommand uses a new method
+        defined in CompositeEditCommand called moveParagraphWithClones.
+        This is an improved version of the original moveParagraph that
+        is aimed at preserving the original markup of the paragraph being
+        moved.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::): removed CSSPropertyBackgroundColor from editingStyleProperties.
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::CompositeEditCommand): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement): Added.
+        (WebCore::CompositeEditCommand::cleanupAfterDeletion): Added.
+        (WebCore::CompositeEditCommand::moveParagraphWithClones): Added.
+        (WebCore::CompositeEditCommand::moveParagraphs): Modified to use cleanupAfterDeletion.
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary): Removed trailing blanks.
+        * editing/CompositeEditCommand.h: Added three new methods.
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Changed to use moveParagraphWithClones.
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Changed to use moveParagraphWithClones.
+        (WebCore::IndentOutdentCommand::indentRegion): Removed comment.
+        * editing/IndentOutdentCommand.h: Removed prepareBlockquoteLevelForInsertion method.
+
+2009-10-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds missing UnusedParam.h includes, required when INSPECTOR is not enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=30677
+
+        Build fix, no new tests required.
+
+        * page/Console.cpp: Modified. Added UnusedParam.h include.
+        * workers/WorkerContext.cpp: Modified. Added UnusedParam.h include.
+
+2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Plugins : Use window's winId() instead of the widget's.
+
+        As per, https://developer.mozilla.org/en/NPN_GetValue
+        NPNVnetscapeWindow on Unix/X11: "Gets the browser toplevel window in which the
+        plug-in is displayed; returns Window".
+
+        The issue was found because NPNVNetscapeWindow winId() ends up creating
+        a native window resulting in flicker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30706
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::getValue):
+
+2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowless Plugins : Don't use m_clipRect when painting.
+
+        Though it works, it is not correct to use m_clipRect for painting
+        in Windowless mode. Instead, the rect paramater that is passed
+        as a part of PluginView::paint() must be used. This change will
+        also result in some speedup since previously we used to paint all
+        the visible parts of a windowless plugin (even if those parts were
+        not dirty).
+
+        Also, fix invalidateRect() to compute the correct width and height.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30711
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::invalidateRect):
+
+2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        Plugins : Use test.swf in the plugins manual tests.
+
+        They previously referenced youtube videos which among other things are
+        cumbersome to use without internet connection. The old youtube link is
+        just commented out so that testing with youtube can be done with
+        little effort.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30662
+
+        * manual-tests/plugins/test.swf: Copied from LayoutTests/fast/replaced/resources/test.swf.
+        * manual-tests/plugins/windowed.html:
+        * manual-tests/plugins/windowless.html:
+        * manual-tests/qt/plugin-sibling-frame-include.html:
+
+2009-10-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix the Windows Release build by moving Accessibility files
+        into all-in-one file and excluding them from the build.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * accessibility/AccessibilityAllInOne.cpp: Added.
+
+2009-10-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig & Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30696
+        Add support for IsolatedWorlds to JSC bindings.
+
+        An IsolatedWorld is basically a parallel, separate copy of the window shells and DOM wrapper objects for
+        a given document.  To support isolation this patch:
+
+            * Adds support to the ScriptController to track multiple window shells, one per world.
+            * Adds support to Document to support multiple separate wrapper-maps, one per world.
+            * Replaces the single global DOM wrapper map (on the WebCoreJSClientData) with separate maps,
+              stored on the (new) IsolatedWorld objects.
+
+        In addition to supporting separate copies of these objects, two other features are supported:
+
+            * It is necessary to track the current world on entry into JSC, so that within callbacks out to WebCore
+              we can determine which world (and as such, set of DOM bindings) we should be operating on.
+            * EventListeners & Callbacks are run in the world they were registered in.
+              This requires the handler to retain a reference to the world.
+
+        No new tests. (Enabled existing isolated world layout tests.)
+
+        * WebCore.base.exp:
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h:
+        (WebCore::JSCallbackData::JSCallbackData):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::removeWrappers):
+        (WebCore::DOMObjectWrapperMap::get):
+        (WebCore::DOMObjectWrapperMap::set):
+        (WebCore::DOMObjectWrapperMap::remove):
+        (WebCore::DOMObjectWrapperMap::take):
+        (WebCore::IsolatedWorld::IsolatedWorld):
+        (WebCore::IsolatedWorld::~IsolatedWorld):
+        (WebCore::EnterIsolatedWorld::EnterIsolatedWorld):
+        (WebCore::EnterIsolatedWorld::~EnterIsolatedWorld):
+        (WebCore::JSGlobalDataWorldIterator::JSGlobalDataWorldIterator):
+        (WebCore::JSGlobalDataWorldIterator::operator bool):
+        (WebCore::JSGlobalDataWorldIterator::operator*):
+        (WebCore::JSGlobalDataWorldIterator::operator->):
+        (WebCore::JSGlobalDataWorldIterator::operator++):
+        (WebCore::getCurrentWorld):
+        (WebCore::getNormalWorld):
+        (WebCore::commonNormalWorld):
+        (WebCore::commonCurrentWorld):
+        (WebCore::DOMObjectHashTableMap::mapFor):
+        (WebCore::DOMObjectWrapperMap::mapFor):
+        (WebCore::forgetDOMObject):
+        (WebCore::getCachedDOMNodeWrapper):
+        (WebCore::forgetDOMNode):
+        (WebCore::cacheDOMNodeWrapper):
+        (WebCore::forgetAllDOMNodesForDocument):
+        (WebCore::forgetWorldOfDOMNodesForDocument):
+        (WebCore::isObservableThroughDOM):
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markActiveObjectsForContext):
+        (WebCore::takeWrappers):
+        (WebCore::updateDOMNodeDocument):
+        (WebCore::markDOMObjectWrapper):
+        (WebCore::allowsAccessFromFrame):
+        (WebCore::printErrorMessageForFrame):
+        (WebCore::JSC_DebuggerCallFrame_evaluateInWorld):
+        (WebCore::JSC_callInWorld):
+        (WebCore::JSC_constructInWorld):
+        (WebCore::JSC_evaluateInWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::IsolatedWorld::rememberDocument):
+        (WebCore::IsolatedWorld::forgetDocument):
+        (WebCore::IsolatedWorld::rememberScriptController):
+        (WebCore::IsolatedWorld::forgetScriptController):
+        (WebCore::DOMObjectHashTableMap::~DOMObjectHashTableMap):
+        (WebCore::DOMObjectHashTableMap::get):
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        (WebCore::WebCoreJSClientData::currentWorld):
+        (WebCore::WebCoreJSClientData::normalWorld):
+        (WebCore::WebCoreJSClientData::rememberWorld):
+        (WebCore::WebCoreJSClientData::forgetWorld):
+        (WebCore::debuggerWorld):
+        (WebCore::pluginWorld):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        (WebCore::toJSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::printErrorMessage):
+        (WebCore::JSDOMWindowBase::commonJSGlobalData):
+        (WebCore::toJS):
+        (WebCore::toJSDOMWindow):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::toJS):
+        (WebCore::toJSDOMWindowShell):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::open):
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        (WebCore::JSHTMLFrameSetElement::nameGetter):
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::databaseForId):
+        (WebCore::JSInspectorBackend::inspectedWindow):
+        (WebCore::JSInspectorBackend::nodeForId):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/JSMessageChannelCustom.cpp:
+        (WebCore::JSMessageChannel::markChildren):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::markChildren):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSSharedWorkerCustom.cpp:
+        (WebCore::JSSharedWorker::markChildren):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::constructXMLHttpRequest):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren):
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::processingUserGestureEvent):
+        (WebCore::ScriptController::attachDebugger):
+        (WebCore::ScriptController::updateDocument):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::createRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        * bindings/js/ScriptController.h:
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        (WebCore::ScriptController::globalObject):
+        (WebCore::ScriptController::forgetWorld):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        (WebCore::scriptStateFromPage):
+        * bindings/js/ScriptState.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::WorkerScriptController):
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/objc/DOMInternal.mm:
+        (-[WebScriptObject _initializeScriptDOMNodeImp]):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_Construct):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        * dom/Document.cpp:
+        (WebCore::Document::createWrapperCache):
+        * dom/Document.h:
+        (WebCore::Document::wrapperCacheMap):
+        (WebCore::Document::getWrapperCache):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * platform/network/mac/AuthenticationMac.mm:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::dropProtection):
+        * xml/XMLHttpRequest.h:
+        (WebCore::XMLHttpRequest::create):
+
+2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: EventListenersSidebarPane TODO No Longer Needed
+        https://bugs.webkit.org/show_bug.cgi?id=30705
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+
+2009-10-22  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30506
+        <rdar://problem/7319845> Resources that the server sent as 304 not modified are not shown
+        in the inspectors resource pane
+
+        I don't know how to make a test for this.
+
+        The issue here was that preloaded resources weren't added to DocLoader document resource set,
+        but Web Inspector asked DocLoader to fetch data from CachedResource. Even when (if) document
+        parser eventually requested the same resource for real and it got added to resource set, it
+        was too late - the Inspector wasn't updated.
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::cachedResource):
+        (WebCore::InspectorResource::type):
+        (WebCore::InspectorResource::resourceData):
+        * inspector/InspectorResource.h:
+        Fix the issue by trying to fetch corresponding CachedResource harder - also look in global
+        cache. This seems safe, and easier than updating the Inspector on transitions between
+        resource states (revalidate vs. revalidate done and preload vs. non-preload).
+
+2009-10-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6942706> ER: Add a CSS property that allows 
+        shadows to work for SVG content
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=30479
+
+        This patch adds a new SVG-specific CSS property called -webkit-
+        shadow that has the same syntax as -webkit-box-shadow
+
+        Add CSSPropertyWebkitShadow to the list of SVG CSS properties, and 
+        make valueForShadow a member function rather than a static function 
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::valueForShadow):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSComputedStyleDeclaration.h:
+
+        Call valueForShadow for CSSPropertyWebkitShadow
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+
+        Do standard CSS stuff for CSSPropertyWebkitShadow
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/SVGCSSPropertyNames.in:
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+
+        Set the appropriate shadow on the paint context if we have one. 
+        This seems to be all we have to do to have an SVG-shaped shadow.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+        Add shadow to SVGRenderStyle. I added a new macro that I don't like 
+        just because that's the way things are done here right now.
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::SVGRenderStyle):
+        (WebCore::SVGRenderStyle::operator==):
+        * rendering/style/SVGRenderStyle.h:
+        * rendering/style/SVGRenderStyleDefs.cpp:
+        (StyleShadowSVGData::StyleShadowSVGData):
+        (StyleShadowSVGData::operator==):
+        * rendering/style/SVGRenderStyleDefs.h:
+        (WebCore::StyleShadowSVGData::create):
+        (WebCore::StyleShadowSVGData::copy):
+        (WebCore::StyleShadowSVGData::operator!=):
+
+2009-10-22  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+ 
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25530
+        [Gtk] Implement LABEL_FOR/LABELLED_BY relationship pair for labels
+
+        Implements atk_object_ref_relation_set and LABEL_FOR/LABELLED_BY.
+        Also causes the accessible name for labeled controls to be based on
+        the label as expected, rather than based on the contents.
+
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (correspondingLabelForControlElement):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkRelationSetFromCoreObject):
+        (webkit_accessible_ref_relation_set):
+        (webkit_accessible_class_init):
+        (webkit_accessible_get_name):
+
+2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: windowFocused and windowBlured Fail to Clear/Mark Inspector as "inactive"
+        https://bugs.webkit.org/show_bug.cgi?id=30663
+
+          Correctly handle focusing/blurring on inner <iframe>'s such as Source Frames.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.windowFocused): fix for inner iframes
+        (WebInspector.windowBlurred): fix for inner iframes
+        (WebInspector.addMainEventListeners): change useCapture to false
+
+2009-10-22  Jaime Yap  <jaimeyap@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Makes a page reload optional when activating resource monitoring in
+        InspectorController. It leaves the default behavior as performing the reload.
+        Reload is an optional param so callsites do not have to change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30684
+
+        No new tests added.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::enableResourceTracking):
+        * inspector/InspectorController.h:
+
+2009-10-22  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix memory leak in QNetworkReplyHandler::abort().
+        In QNetworkReplyHandler::release(), m_reply should no longer point to its parent
+        after being released.
+        https://bugs.webkit.org/show_bug.cgi?id=30167
+
+        No layout test available as a non-functional fix.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::abort):
+        (WebCore::QNetworkReplyHandler::release):
+
+2009-10-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix DOMAgent leak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30615
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::releaseDOMAgent):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+
+2009-10-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Rework event listeners to not hold references to frame or V8 context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30648
+
+        Covered by existing layout tests: fast/events/attribute-listener*
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added passing ScriptExecutionContext*
+            to event listener handling code.
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep): Changed to use currentContext().
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Reworked to match JSC logic.
+        (WebCore::getEventListenerHandlerBody): Added ScriptExecutionContext* param.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Removed Frame* param
+            and usage.
+        (WebCore::V8AbstractEventListener::handleEvent): Chaged to use ScriptExecutionContext*.
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Ditto.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::getListenerObject): Ditto.
+        (WebCore::V8AbstractEventListener::prepareListenerObject): Ditto.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):  Added ScriptExecutionContext* param.
+        (WebCore::V8DOMWrapper::getEventListener): Ditto.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Ditto.
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper): Removed ContextType* template param,
+            because it's no longer needed.
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::sharedContext): Renamed from shared_context.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener): Removed Frame* param and usage.
+        (WebCore::V8LazyEventListener::callListenerFunction): Added ScriptExecutionContext* param.
+        (WebCore::V8LazyEventListener::prepareListenerObject): Ditto.
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::create): Reordered params to match JSC impl.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy): Adjusted formatting to match WebKit style.
+        (WebCore::V8Proxy::evaluateInNewContext): Changed to use m_context directly.
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId): Ditto.
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase): Ditto.
+        (WebCore::V8Proxy::isContextInitialized): Ditto.
+        (WebCore::V8Proxy::updateDocumentWrapperCache): Ditto.
+        (WebCore::V8Proxy::clearDocumentWrapperCache): Ditto.
+        (WebCore::V8Proxy::disposeContextHandles): Added explicit disposing of m_context. 
+        (WebCore::V8Proxy::clearForClose): Changed to use m_context directly.
+        (WebCore::V8Proxy::clearForNavigation): Ditto.
+        (WebCore::V8Proxy::setSecurityToken): Ditto.
+        (WebCore::V8Proxy::updateDocument): Ditto.
+        (WebCore::V8Proxy::initContextIfNeeded): Ditto.
+        (WebCore::V8Proxy::context): Changed to use v8::Local.
+        (WebCore::V8Proxy::mainWorldContext): Changed to use m_context directly. 
+        (WebCore::V8Proxy::setContextDebugId): Ditto.
+        (WebCore::toV8Context):
+        * bindings/v8/V8Proxy.h: Removed shared_context decl, changed to use straight
+            v8::Persistent for m_context.
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::workerProxy): Added.
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener): Removed
+            WorkerContextExecutionProxy* param.
+        (WebCore::V8WorkerContextEventListener::handleEvent): Started using ScriptExecutionContext*.
+        (WebCore::V8WorkerContextEventListener::reportError): Ditto.
+        (WebCore::V8WorkerContextEventListener::callListenerFunction): Ditto.
+        (WebCore::V8WorkerContextEventListener::getReceiverObject): Ditto.
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create): Removed
+            WorkerContextExecutionProxy* param.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener): Removed ContextType*
+            template param.
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener): Removed Frame* param.
+        (WebCore::V8EventListener::getListenerFunction): Started using ScriptExecutionContext*.
+        (WebCore::V8EventListener::callListenerFunction): Ditto.
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create): Removed Frame* param.
+
+2009-10-14  Gaurav Shah  <gauravsh@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Replaces temporary link stub for <keygen> tag handler for the Chromium
+        browser with a call via the Chromium Bridge.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30360
+
+        * platform/SSLKeyGenerator.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/SSLKeyGeneratorChromium.cpp:
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/chromium/TemporaryLinkStubs.cpp:
+        (WebCore::KURL::fileSystemPath):
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+
+2009-10-22  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes Chromium Mac pasteboard handling to flow through the same code paths as other platforms.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30591
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage):
+
+2009-10-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make accelerated compositing debug indicators work in release builds
+        https://bugs.webkit.org/show_bug.cgi?id=30588
+        
+        Allow some debug indicators, that show which page elements go into compositing layers,
+        to work in release builds, when the runtime prefs are set.
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        (WebCore::GraphicsLayer::setZPosition):
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::clearBorderColor):
+        (WebCore::GraphicsLayer::showRepaintCounter):
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::updateMasksToBounds):
+        (WebCore::GraphicsLayerCA::updateLayerDrawsContent):
+        (WebCore::GraphicsLayerCA::setDebugBorder):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        (WebCore::GraphicsLayerCA::setupContentsLayer):
+        * platform/graphics/mac/WebLayer.mm:
+
+2009-10-22  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Inspector should support monitorEvents/un monitorEvents() in the command line
+        https://bugs.webkit.org/show_bug.cgi?id=19879
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback): Ignores event listeners generated by monitorEvent
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled): Added _inspectorCommandLineAPI._logEvent, _allEventTypes, 
+        _normalizeEventTypes, monitorEvent, unmonitorEvent.
+
+2009-10-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: windowFocused and windowBlurred Fail to Clear/Mark Inspector as "inactive"
+        https://bugs.webkit.org/show_bug.cgi?id=30663
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.windowFocused):
+        (WebInspector.windowBlurred):
+
+2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Error - requestContentType [undefined] is not an object
+        https://bugs.webkit.org/show_bug.cgi?id=30666
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshFormData):
+
+2009-10-22  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        [Haiku] Correction of the accented letter width (they were 2 characters long).
+        https://bugs.webkit.org/show_bug.cgi?id=30629
+
+        * platform/graphics/haiku/SimpleFontDataHaiku.cpp:
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-10-21  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7270320> Screenshots of off-screen plug-ins are blank
+        <rdar://problem/7270314> After halting a transparent PluginView on
+        Windows, the transparency is applied twice
+
+        Replace use of Frame::nodeImage() with a function that takes a snapshot
+        of a PluginView.
+
+        Reviewed by Dan Bernstein.
+
+        * plugins/PluginView.h:
+        Made paintWindowedPluginIntoContext() non-const, as it now calls
+        paintIntoTransformedContext(). Declare paintIntoTransformedContext()
+        and snapshot() for Windows platforms.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintIntoTransformedContext):
+        Paints into the passed HDC without applying any coordinate translations.
+        Code moved from paintWindowedPluginIntoContext() and paint(). Removed
+        the memset() of windowpos in lieu of assignment.
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        Code moved to paintIntoTransformedContext().
+        (WebCore::PluginView::paint):
+        Ditto.
+        (WebCore::PluginView::snapshot):
+        Create a context, and if the plug-in is windowless, translate it so the
+        plug-in will draw at the correct location. Create a bitmap, and select
+        it into the context. Paint the plug-in, and create a BitmapImage from
+        the bitmap.
+        (WebCore::PluginView::halt):
+        Use snapshot().
+
+2009-10-22  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix calculation of length in WebSocketChannel.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=30656
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-10-21  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding the ability to enable/disable functions in V8 at runtime.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30650
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-21  Darin Adler  <darin@apple.com>
+
+        Swedish search (and other languages as well) is broken while fixing Japanese search
+        https://bugs.webkit.org/show_bug.cgi?id=30646
+
+        Rolled Japanese tailoring out that was done to fix
+        https://bugs.webkit.org/show_bug.cgi?id=30437 earlier.
+        It was overriding the locale-specific tailoring.
+        We'll land a fix once we figure out how to add the
+        Japanese tailoring without removing anything.
+
+        * editing/TextIterator.cpp: Rolled out r49924.
+
+2009-10-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: chromium build fix - add missing image to gypi.
+
+        * WebCore.gypi:
+
+2009-10-21  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes part of <http://webkit.org/b/30522>.
+        Web Inspector: DOM Exceptions throughout the Inspector should be more human readable.
+
+        Expose the description attribute that is now a member of
+        ExceptionBase as of r49723, so when a user logs an exception, they
+        can see the description in the Web Inspector.
+
+        Test: fast/dom/dom-exception-description.html
+
+        * dom/DOMCoreException.idl:
+        * dom/EventException.idl:
+        * dom/RangeException.idl:
+        * svg/SVGException.idl:
+        * xml/XMLHttpRequestException.idl:
+        * xml/XPathException.idl:
+
+2009-10-21  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30616>.
+        REGRESSION (r49036): Web Inspector: Summary graph no longer switching to size summary.
+        
+        Add a check to make sure a function we need to calculate percentages is
+        defined before we use it.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
+
+2009-10-21  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        REGRESSION: Clicking on nodes in the console should take you to the element in the DOM
+        https://bugs.webkit.org/show_bug.cgi?id=27231
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatnode): Turns on ElementsTreeOutline.showInElementsPanelEnabled
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline): Added ElementsTreeOutline.showInElementsPanelEnabled
+        (WebInspector.ElementsTreeElement.prototype.onmousedown): Reveals the node in the Elements panel if 
+        treeOutline.showInElementsPanelEnabled is true.
+
+2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30637
+        Fix a compiler warning in windows.
+
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-21  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix the crash when a node not in a document receives dispatchEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=30611
+
+        Test: fast/events/dispatch-event-no-document.html
+
+        * dom/EventTarget.cpp: Check for scriptExecutionContext() at the moment of dispatchEvent; do nothing if no context.
+        (WebCore::EventTarget::dispatchEvent):
+
+2009-10-21  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: disable subpixel text on layers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30635
+        http://code.google.com/p/chromium/issues/detail?id=25365
+
+        With the addition of layers for drawing rounded corners in r49641,
+        subpixel text on rounded rectangles broke. This is because the layer
+        only contains a single alpha channel and this is insufficient to
+        compose subpixel text correctly.
+
+        On Windows, a large body of code in TransparencyWin.cpp exists to try
+        to deal with this. Even then, in some cases, it downgrades to
+        anti-aliased text. We need a fix for the grevious effects quickly thus
+        this patch disables subpixel text when rendering into a layer.
+
+        This would be covered by existing tests except that subpixel text is
+        disabled for pixel tests on Chromium Linux.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::isCanvasMultiLayered):
+        (WebCore::adjustTextRenderMode):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+
+2009-10-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMac 10.4 build fix, make sure we specify the Sqlite3 dependency correctly as otherwise
+        it will use the sqlite3 system library rather than WebCoreSQLite3.
+
+        * wscript:
+
+2009-10-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed background-clip parsing regressions introduced in r46240.
+
+        Test: fast/css/background-clip-text.html
+
+        * css/CSSParser.cpp:
+        (WebCore::parseBackgroundClip): Added this helper method.
+        (WebCore::CSSParser::parseFillShorthand): Use parseBackgroundClip() to
+        reparse the value. The old code called parseFillProperty() again, which
+        didn’t work, because parseFillProperty() advances the value list.
+        (WebCore::CSSParser::parseFillProperty): Changed to use
+        parseBackgroundClip().
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::operator EFillBox): Added a case for
+        CSSValueWebkitText.
+
+2009-10-21  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enable creation of custom SidebarTreeElements for different ProfileTypes
+
+        ProfileTypes can now create sidebar tree elements of custom types.
+        https://bugs.webkit.org/show_bug.cgi?id=30520
+
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
+        (WebInspector.CPUProfileType.prototype.createSidebarTreeElementForProfile):
+        (WebInspector.CPUProfileType.prototype.createView):
+        (WebInspector.CPUProfile.prototype.get head):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType.prototype.buttonClicked):
+        (WebInspector.ProfileType.prototype.viewForProfile):
+        (WebInspector.ProfileType.prototype.createView):
+        (WebInspector.ProfileType.prototype.createSidebarTreeElementForProfile):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+
+2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Selectors in the Styles pane should trigger a search for that selector when clicked
+        https://bugs.webkit.org/show_bug.cgi?id=17126
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult): only change focusedDOMNode on a manual search
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype._clickSelector): trigger a search
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._startEditing): correctly start editing attribute value instead of name
+
+2009-10-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix DOM Agent leak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30615
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+
+2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        Plugins: Create manual tests for testing plugins
+        
+        Create two test files:
+        1. windowed.html - Test plugin in windowed mode.
+        2. windowless.html - Test plugin in windowless mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30503
+
+        * manual-tests/plugins/windowed.html: Added.
+        * manual-tests/plugins/windowless.html: Added.
+
+2009-10-21  Satoshi Nakagawa  <psychs@limechat.net>
+
+        Reviewed by Darin Adler.
+
+        Fixed Japanese text search problems.
+        Treat small kana letters and kana letters as different characters in search.
+        Do not ignore diacritic marks in search for Japanese texts.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30437
+
+        Test: fast/text/international/japanese-kana-letters.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::createCollator):
+        (WebCore::collator):
+        (WebCore::createSearcher):
+
+2009-10-20  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Changes TimelineItems to be created with raw timestamps as opposed
+        to a time relative to a start of session.  Normalized timestamps cause
+        problems when monitoring a browsing session across multiple page
+        transitions.
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+
+2009-10-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix leak of WebSocketChannel by adopting the newly-created reference.
+
+        * websockets/WebSocketChannel.h:
+        (WebCore::WebSocketChannel::create):
+
+2009-10-20  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage runtime flag changes
+        https://bugs.webkit.org/show_bug.cgi?id=30602
+
+        Part 1/2.  Removing sessionStorageEnabled in next patch after the
+        Chromium side of the changes lands.
+
+        Revert my changes to Settings and instead implement DOM Storage enabling via
+        the methods agreed upon in https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        This stuff was (intentionally) never exposed to web pages or DRT, so there's no
+        LayoutTest visible changes and thus no tests.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+        * storage/Storage.cpp:
+        (WebCore::Storage::setLocalStorageAvailable):
+        (WebCore::Storage::localStorageAvailable):
+        (WebCore::Storage::setSessionStorageAvailable):
+        (WebCore::Storage::sessionStorageAvailable):
+        * storage/Storage.h:
+
+2009-10-20  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Need to turn off notifications properly at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=30409
+
+        This code only affects chromium, and is all behind a compile time
+        flag current turned off, so no new tests.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::setIsAvailable):
+        (WebCore::NotificationCenter::isAvailable):
+        * notifications/NotificationCenter.h:
+        * page/DOMWindow.idl:
+        * workers/WorkerContext.idl:
+
+2009-10-20  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fixes RefPtr initialization in the V8 implementation of WebCore::ScriptString to use the ::create() idiom and
+        use adoptRef() properly.  I failed to read the RefPtr docs the first time through :(
+
+        No new tests, error was caught by valgrind on the Chromium builders.
+
+        * bindings/v8/ScriptString.h:
+        (WebCore::ScriptString::ScriptString):
+        (WebCore::ScriptString::operator=):
+        * bindings/v8/ScriptStringImpl.h:
+        (WebCore::ScriptStringImpl::create):
+
+2009-10-20  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: populate child nodes before sorting them.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29673
+
+        * inspector/front-end/BottomUpProfileDataGridTree.js:
+        (WebInspector.BottomUpProfileDataGridNode): Swapped with BottomUpProfileDataGridTree to be consistent with TopDownProfileDataGridNode.
+        (WebInspector.BottomUpProfileDataGridNode.prototype._takePropertiesFromProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._keepOnlyChild):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._exclude):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._merge):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._sharedPopulate):
+        (WebInspector.BottomUpProfileDataGridTree.prototype.exclude):
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.sort): Added missing parentheses.
+        (WebInspector.ProfileDataGridNode.prototype.get _parent):
+        (WebInspector.ProfileDataGridNode.prototype._populate):
+        * inspector/front-end/TopDownProfileDataGridTree.js:
+        (WebInspector.TopDownProfileDataGridNode.prototype._sharedPopulate):
+
+2009-10-20  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove redundant String ref/deref calls in generated V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=30579
+
+        * bindings/v8/V8Binding.h:
+        (WebCore::toString): Fix return type of 'toString' to make it truly a no-op
+            instead of constructing/destructing a String.
+
+2009-10-20  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25411
+        [GTK] ATK accessible ancestry broken
+
+        Work around for the problem of bogus additional objects in the ancestry.
+        We now set the parent when we ref the child, then ask the Atk child if
+        it knows its parent. This solves the bulk of the cases. For those it
+        doesn't, fall back to the existing logic.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+        (webkit_accessible_ref_child):
+
+2009-10-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Alice Liu.
+
+        Fixes <http://webkit.org/b/30421>.
+        Web Inpsector: Local Files can show up on Cookies List with Cookies from other Domain.
+
+        When a page like Google generates an about:blank, it shows up as a local file on
+        the list of Cookie domains, but has all of the cookies of Google. When we are adding
+        cookie domains to the inspector, we should only add the domain is the URL of the resource
+        is in the HTTP protocol family or a file URL.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+
+2009-10-20  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Use a version of libWebKitSystemInterface with global symbols marked
+        private_extern for Chromium Mac.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30590
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/mac: Added.
+        * WebCore.gyp/mac/Empty.cpp: Added.
+        * WebCore.gyp/mac/adjust_visibility.sh: Added.
+
+2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CSSProperty
+        https://bugs.webkit.org/show_bug.cgi?id=30564
+
+        Inherits CSSProperty class from FastAllocBase because it has been
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:367.
+
+        * css/CSSProperty.h:
+
+2009-10-20  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Hide Chromium's media slider thumb if no source has been loaded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30529
+
+        Covered by existing layout tests, notably:
+            LayoutTests/media/controls-rendering.html
+            LayoutTests/media/unsupported-tracks.html
+            LayoutTests/media/video-src-none.html
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::hasSource): Returns true if an HTMLMediaElement has a valid source set.
+        (WebCore::paintMediaMuteButton): Refactored to use hasSource().
+        (WebCore::paintMediaPlayButton): Ditto.
+        (WebCore::paintMediaSliderThumb): Add call to hasSource() to determine if we should paint the thumb.
+
+2009-10-20  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Added getter for FrameLoader:m_suppressOpenerInNewFrame.
+        This will allow Chromium to more intelligently detect
+        noreferrer links and therefore open them in a new process.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30581
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::suppressOpenerInNewFrame): Added.
+
+2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSParserFunction
+        https://bugs.webkit.org/show_bug.cgi?id=30563
+
+        Inherits CSSParserFunction struct from FastAllocBase because it has been
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:4827.
+
+        * css/CSSProperty.h:
+
+2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Watched Expressions Buttons Do Not Match Inspector Styles
+        https://bugs.webkit.org/show_bug.cgi?id=30554
+
+        * inspector/front-end/inspector.css: added style to pane buttons
+
+2009-10-20  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Set debug id for contexts of isolated worlds to distinguish them in debugger.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30559
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        * bindings/v8/V8Proxy.h:
+
+2009-10-20  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Unreviewed buildfix.
+        [Qt] Add FEGaussianBlur.h and FEGaussianBlur.cpp which were refactored in r49778 to WebCore.pro.
+
+        * WebCore.pro:
+
+2009-10-20  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Set EnabledAtRuntime for WebSocket in DOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=29896
+
+        Supported by chromium/v8 only.
+        Add WebSocket::isAvailable()/setIsAvailable(bool) to control v8
+        bindings.
+        Remove Settings::experimentalWebSocketsEnabled() and
+        setExperimentalWebSocketsEnabled(bool).
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::setIsAvailable):
+        (WebCore::WebSocket::isAvailable):
+        * websockets/WebSocket.h:
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION: Dromaeo DOM test is 14% slower
+        https://bugs.webkit.org/show_bug.cgi?id=30273
+
+        Whoops, make prototype bindings actually use the StructureFlags.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-10-19  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Better implementation of WebCore::ScriptString for the V8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29909
+
+        WebCore::ScriptString is used for XMLHttpRequest's responseText attribute which is
+        shared with JavaScript.  Thus, simply using a WebCore::String and copying the value
+        is pretty inefficient, especially since responseText is built up with a sequence of
+        operator+= calls.  JSC builds use a JSC::UString to share the buffer when possible,
+        this patch adopts a similar approach for V8.
+
+        No new tests, behavior is unchanged and covered by LayoutTests/http/tests/xmlhttprequest
+
+        * WebCore.gypi:
+        * bindings/v8/ScriptString.h:
+        (WebCore::ScriptString::ScriptString):
+        (WebCore::ScriptString::operator String):
+        (WebCore::ScriptString::isNull):
+        (WebCore::ScriptString::size):
+        (WebCore::ScriptString::operator=):
+        (WebCore::ScriptString::operator+=):
+        (WebCore::ScriptString::v8StringOrNull):
+        * bindings/v8/ScriptStringImpl.cpp: Added.
+        (WebCore::ScriptStringImpl::ScriptStringImpl):
+        (WebCore::ScriptStringImpl::~ScriptStringImpl):
+        (WebCore::ScriptStringImpl::toString):
+        (WebCore::ScriptStringImpl::isNull):
+        (WebCore::ScriptStringImpl::size):
+        (WebCore::ScriptStringImpl::append):
+        * bindings/v8/ScriptStringImpl.h: Added.
+        (WebCore::ScriptStringImpl::ScriptStringImpl):
+        (WebCore::ScriptStringImpl::v8StringHandle):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r49837.
+        http://trac.webkit.org/changeset/49837
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setStandardFontFamily):
+        (WebCore::Settings::setFixedFontFamily):
+        (WebCore::Settings::setSerifFontFamily):
+        (WebCore::Settings::setSansSerifFontFamily):
+        (WebCore::Settings::setCursiveFontFamily):
+        (WebCore::Settings::setFantasyFontFamily):
+        * page/Settings.h:
+        (WebCore::Settings::standardFontFamily):
+        (WebCore::Settings::fixedFontFamily):
+        (WebCore::Settings::serifFontFamily):
+        (WebCore::Settings::sansSerifFontFamily):
+        (WebCore::Settings::cursiveFontFamily):
+        (WebCore::Settings::fantasyFontFamily):
+        * platform/text/UScriptCode.h: Removed.
+
+2009-10-19  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Check COMPILER(MSVC) instead of PLATFORM(WIN_OS) to avoid the use of vasprintf.
+        https://bugs.webkit.org/show_bug.cgi?id=30473
+
+        vasprintf is missing in MSVC. Use COMPILER(MSVC) guards instead of
+        PLALTFORM(WIN_OS) guards.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::error):
+
+2009-10-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20797
+
+        Make generic font family getters/setters accept an additional
+        argument (script code). It has a default value so that if an embedder
+        does not have/want a per-script font family setting, call-sites
+        don't have to be changed.
+        This is to prepare for fixing bug 10874 (font selection is not
+        language-dependent) and bug 18085.
+
+        There should be no change in layout and no new layout test
+        is added.
+
+        * WebCore.base.exp:
+        * page/Settings.cpp:
+        * page/Settings.h:
+        * platform/text/UScriptCode.h: Added. This is for ports that
+          do not use ICU. the part of ICU's common/unicode/uscript.h
+          that defines script code enum was copied. To keep enums compatible
+          with those in ICU, we don't generate the list out of Scripts.txt
+          of the Unicode Data base or CLDR's data.
+
+2009-10-19  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Clarify usage of SuddenTermination API. No code change.
+
+        * platform/SuddenTermination.h:
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: Dromaeo DOM test is 14% slower
+        https://bugs.webkit.org/show_bug.cgi?id=30273
+
+        Make DOM bindings automatically inherit correct structure
+        flags rather than being needlessly conservative.  This is
+        done by making the bindings generator use the same model
+        for TypeInfo flags that we now use in JSC.
+
+        This gains us about 1% of this regression back.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-19  Robin Qiu  <robin.qiu@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fixed a bug on nested SVG <use> elements.
+        https://bugs.webkit.org/show_bug.cgi?id=26117
+        When a <use> element refer to another <use> element which has
+        child/children, the instance tree built for this <use> element
+        is incorrect (more nodes than expected).
+
+        Test: svg/dom/use-on-use-with-child.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildInstanceTree):
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Small changes to fully invalidate and update the JavaScriptCallFrame.
+
+        <rdar://problem/7020755> JSDebugger crashes after reloading from a breakpoint
+        https://bugs.webkit.org/show_bug.cgi?id=27146
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/JavaScriptCallFrame.h:
+        (WebCore::JavaScriptCallFrame::invalidate):
+        (WebCore::JavaScriptCallFrame::update):
+
+2009-10-19  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        Remove "source" from storage events
+        https://bugs.webkit.org/show_bug.cgi?id=30536
+
+        Remove "source" from storage events per
+        http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
+
+        This was removed because it makes it introduces synchronous access that can
+        cross the event loop boundry (since a storage event can fire from one process
+        and be handled in another).
+
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::StorageEvent):
+        (WebCore::StorageEvent::initStorageEvent):
+        * storage/StorageEvent.h:
+        (WebCore::StorageEvent::uri):
+        * storage/StorageEvent.idl:
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ResourceLoadNotifier::activeDocumentLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30533
+
+        Removing this method from ResourceLoadNotifier better decouples the
+        notifier from FrameLoader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::requestFromDelegate):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        * loader/ResourceLoadNotifier.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move sendRemainingDelegateMessages to ResourceLoadNotifier
+        https://bugs.webkit.org/show_bug.cgi?id=30531
+
+        This method is about notifying folks and doesn't interact with the rest
+        of FrameLoader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
+        * loader/FrameLoader.h:
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::sendRemainingDelegateMessages):
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bypass popup blocker using click event
+        https://bugs.webkit.org/show_bug.cgi?id=21501
+
+        Keep track of which events were generated by JavaScript and use that
+        inforation when figuring out if we're processing a user gesture.
+
+        Test: http/tests/security/popup-blocked-from-fake-event.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGestureEvent):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent):
+        * dom/Event.cpp:
+        (WebCore::Event::Event):
+        * dom/Event.h:
+        (WebCore::Event::createdByDOM):
+        (WebCore::Event::setCreatedByDOM):
+
+2009-10-19  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fixing a typo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30543
+
+        * platform/sql/SQLiteDatabase.h:
+
+2009-10-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Manual Test for crash caused by JS accessing DOMWindow which is disconnected from the Frame.
+        https://bugs.webkit.org/show_bug.cgi?id=30544
+
+        * manual-tests/crash-on-accessing-domwindow-without-frame.html: Added.
+
+2009-10-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Flash at end of opacity/transform transition sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=30501
+        
+        When a transition finishes, there window of time between when the animation is
+        removed, and the final style set on the GraphicsLayer. This caused the layer to revert
+        to its old appearance for one or two frames. To avoid this, we set the final
+        transform or opacity at the start of the transition; we know that the animation
+        will override the final value for as long as its running.
+        
+        No test because this is a very transient effect that can't be captured
+        in a test.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateLayerOpacity):
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::startTransition):
+        * rendering/RenderLayerBacking.h:
+
+2009-10-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add more stop characters into console completions.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30477
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+
+2009-10-19  Marshall Culpepper  <mculpepper@appcelerator.com>
+
+        Reviewed by Adam Roben.
+
+        implemented ClipboardWin::files()
+        https://bugs.webkit.org/show_bug.cgi?id=29666
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::files):
+
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add support for link relations in HTMLAnchorElement and implement rel="noreferrer".
+
+        https://bugs.webkit.org/show_bug.cgi?id=28986
+
+        Tests: http/tests/navigation/no-referrer-reset.html
+               http/tests/navigation/no-referrer-same-window.html
+               http/tests/navigation/no-referrer-subframe.html
+               http/tests/navigation/no-referrer-target-blank.html
+
+        * WebCore.base.exp: Update FrameLoader::loadFrameRequest export symbol
+        * html/HTMLAnchorElement.cpp: Add support for link relations and implement noreferrer
+        (WebCore::HTMLAnchorElement::HTMLAnchorElement):
+        (WebCore::HTMLAnchorElement::defaultEventHandler):
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        (WebCore::HTMLAnchorElement::hasRel):
+        (WebCore::HTMLAnchorElement::setRel):
+        * html/HTMLAnchorElement.h: Add support for link relations and implement noreferrer
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::createWindow):
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected): Add parameter for referrer policy
+        (WebCore::FrameLoader::loadFrameRequest): Add parameter for referrer policy
+        (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy): Suppress opener if requested by ReferrerPolicy
+        * loader/FrameLoader.h: Update urlSelected and loadFrameRequest prototypes
+        * loader/FrameLoaderTypes.h: Add enum for referrer policy
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected): Update call to urlSelected()
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::defaultEventHandler): Update call to urlSelected()
+
+
+2009-10-19  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Dimitri Glazkov (dglazkov@chromium.org).
+
+        [v8] typeof(HTMLMediaElement) should return undefined if media
+        engine is not available
+        https://bugs.webkit.org/show_bug.cgi?id=30343
+
+        Check for availability of the media engine to disable
+        HTMLMediaElement, HTMLAudioElement, HTMLVideoElement, MediaError
+        in runtime.
+
+        Try runs and review in Chromium:
+        http://codereview.chromium.org/276011
+
+        Test: manual-tests/chromium/media-player-not-available.html
+
+        The above test can work work in Chromium. Testing procedures:
+        1. Remove all media support libraries in Chromium (e.g. ffmpeg libraries)
+        2. Open Chromium with above test page
+        3. Verify the test results according to the test page
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Declare enabler methods.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        Report enabled only if media player is available.
+        * manual-tests/chromium/media-player-not-available.html: Added.
+        Manual test, following instruction in this test for procedures.
+        * page/DOMWindow.idl:
+        Mark HTMLMediaElement, HTMLAudioElement, HTMLVideElement, MediaError
+        as enabled at runtime.
+
+2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Refactor out some of the code in paint() into paintPanScrollIcon()
+        and paintScrollbars() in preparation of some Qt API changes.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::paint):
+        * platform/ScrollView.h:
+
+2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Make the local static panScrollIcon into a Image* instead
+        of a RefPtr<Image>.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+
+2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by David Levin.
+
+        Forcefully set antialiasing for Chromium media controls.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30521
+
+        Before it was nondeterministiacally being enabled based on the previous state of GraphicsContext.
+
+        Covered by existing layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Added setShouldAntialias(true).
+
+2009-10-19  Jens Alfke  <jens@mooseyard.com>
+
+        Reviewed by Darin Adler.
+
+        Optimize string upper/lowercasing
+        https://bugs.webkit.org/show_bug.cgi?id=30261
+        
+        - Added AtomicString::upper() and lower()
+        - Further optimized StringImpl::lower()
+        - Removed StringImpl::isLower()
+        - Added QualifiedName::localNameUpper(), which is cached, thereby saving
+          thousands of upper() calls and string allocations.
+ 
+         * dom/Element.cpp:
+         (WebCore::Element::setAttribute): Call AtomicString::lower()
+         * dom/QualifiedName.cpp:
+         (WebCore::QualifiedName::localNameUpper): New method
+         * dom/QualifiedName.h: Added localNameUpper() method
+         * dom/StyledElement.cpp:
+         (WebCore::StyledElement::parseMappedAttribute):  Call AtomicString::lower()
+         * html/HTMLDocument.cpp:
+         (WebCore::HTMLDocument::createElement): Call AtomicString::lower()
+         * html/HTMLElement.cpp:
+         (WebCore::HTMLElement::nodeName): Call localNameUpper()
+         * platform/text/AtomicString.cpp:
+         (WebCore::AtomicString::lower): New method
+         (WebCore::AtomicString::upper): New method
+         * platform/text/AtomicString.h: Added lower() and upper()
+         * platform/text/StringImpl.cpp: Removed isLower()
+         (WebCore::StringImpl::lower): Further optimization of initial loop
+         * platform/text/StringImpl.h: Removed isLower()
+ 
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        If a call to a plugin's invokeMethod, invokeDefault or construct
+        returns false, throw an exception into JS.        
+
+        https://bugs.webkit.org/show_bug.cgi?id=30239
+
+        Test: plugins/netscape-invoke-failure.html
+
+        * bindings/v8/V8NPObject.cpp: Check return values of invokeMethod, invokeDefault and construct.
+        (npObjectInvokeImpl):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod): Check return value
+        (JSC::Bindings::CInstance::invokeDefaultMethod): Check return value
+        (JSC::Bindings::CInstance::invokeConstruct): Check return value
+
+2009-10-16  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix for chromium/skia canvas arc start/end positions, when the arc is
+        >= 360 degrees.
+        https://bugs.webkit.org/show_bug.cgi?id=30449
+
+        Covered by new test:
+        LayoutTests/fast/canvas/arc360.html
+
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::addArc):
+
+2009-10-19  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix uninitialized variable reference in Element::removeAttribute().
+        https://bugs.webkit.org/show_bug.cgi?id=30502
+
+        * dom/Element.cpp:
+        (WebCore::Element::removeAttribute):
+
+2009-10-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30463
+        Remove HTML5 media element 'loadend' event
+
+        * dom/EventNames.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute): Remove 'loadend'.
+        (WebCore::HTMLMediaElement::loadInternal): Ditto.
+        (WebCore::HTMLMediaElement::noneSupported): Ditto.
+        (WebCore::HTMLMediaElement::mediaEngineError): Ditto.
+        (WebCore::HTMLMediaElement::setNetworkState): Ditto.
+        (WebCore::HTMLMediaElement::userCancelledLoad): Ditto.
+
+2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Remove deletion of outgoing FormData object when reply is finished.
+        The buffers will be destroyed a bit later, when the QNetworkReply is deleted.
+        Bug: https://bugs.webkit.org/show_bug.cgi?id=29551
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2009-10-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix hard-to-reproduce crash in HTMLTokenizer by avoiding a rare
+        fastRealloc edge case.
+        https://bugs.webkit.org/show_bug.cgi?id=29313
+
+        No test, the crash shows up occasionally in crash dumps, we weren't able
+        to reproduce it locally.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::enlargeScriptBuffer): Added an early exit to
+            avoid calling fastRealloc with the size of 0.
+
+2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Use fillRect() instead of drawRect() to fix Chromium media controls rendering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30371
+
+        Chromium Mac layout tests will need to be rebaselined.  Existing layout tests for Linux/Win still pass.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Use fillRect() instead of drawRect().
+
+2009-10-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Crash in DOMWindow::clearTimeout etc when DOMWindow is not connected to a frame.
+        https://bugs.webkit.org/show_bug.cgi?id=29832
+
+        Need to make sure the script caches are reset when frame gets disconnected from still-alive DOMWindow.
+        This will prevent JS from calling DOMWindow methods that can not be completed w/o the frame.
+
+        I am not sure it's possible to test this since the only file that repros the problem need ~10 seconds to cause crash.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::~Frame): Right after frame disconnects from DOMWindow, clear WindowShell.
+
+2009-10-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed build warning fix.
+        [Qt] Apply changes to WebCore.pro introduced in r49778
+
+        * WebCore.pro: Removed svg/graphics/filters/SVGFEGaussianBlur.h from HEADERS
+
+2009-10-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move feGaussianBlur from WebCore/svg to WebCore/platform
+        [https://bugs.webkit.org/show_bug.cgi?id=30495]
+
+        This patch moves SVGFRGaussianBlur from svg/graphics/filters
+        to platform/graphics/filters/FEGaussianBlur. This is needed
+        for shadow support on Qt and Cairo.
+        No change in functionality, therfore no new test case needed.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FEGaussianBlur.cpp: Added.
+        * platform/graphics/filters/FEGaussianBlur.h: Added.
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp: Removed.
+        * svg/graphics/filters/SVGFEGaussianBlur.h: Removed.
+
+2009-10-19  Yael Aharon  <yael.aharon@nokia.com>
+
+        Unreviewed.
+
+        Added reviewer name to r49574.
+
+2009-10-19  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30489
+        [Gtk] The document frame/html container claims to be parentless
+
+        Work around for the parentless claim made by the accessible associated
+        with the embedded WebView. When we identify this condition, get the
+        widget's parent, and then get the AtkObject from that. Admittedly an ugly
+        hack, but we'll need it for Yelp and other Gtk+/GNOME applications which
+        plan to switch over to WebKit.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+
+2009-10-19  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        Handle duration queries properly
+        https://bugs.webkit.org/show_bug.cgi?id=29999
+
+        Previously duration queries failed to handle unknown duration
+        and didn't treat the returned duration as an unsigned.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix build on Windows.
+
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Don't crash when client is 0.
+        
+        Client is 0 when we use QWebPage without a QWebView or QGraphicsWebView.
+        In addition, setFrameRect()/updatePluginWidget() is called even if the
+        plugin was not succesfully loaded. updatePluginWidget() updates the
+        window rect which is, in theory, useful to draw something that indicates
+        that we didn't load successfully.
+        
+        So, a status check is added to setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30380
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Fix crash when QWebPage is deleted after QWebView.
+        
+        Fixes various sources of crashes:
+        1. The PluginContainer is a child of QWebView. When the view gets deleted,
+        the PluginView is not notified about the deletion of PluginContainer.
+        2. QWebView destructor does not set client to 0.
+        3. Sometimes pending paint events are sent after the plugin has died, so add
+        a check in PluginView::setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30354
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::~PluginContainerQt):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-19  Jakob Truelsen  <antialize@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+        Allow one to customize the minimal and maximal shrink factors used when printing.
+
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::begin):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setPrintingMinimumShrinkFactor):
+        (WebCore::Settings::setPrintingMaximumShrinkFactor):
+        * page/Settings.h:
+        (WebCore::Settings::printingMinimumShrinkFactor):
+        (WebCore::Settings::printingMaximumShrinkFactor):
+
+2009-10-18  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fixes issue where doubleclicking a word could select following adjacent newlines.
+        https://bugs.webkit.org/show_bug.cgi?id=30234
+
+        Tests: platform/mac/editing/selection/doubleclick-should-not-expand-across-lines.html
+               platform/mac/editing/selection/script-tests/TEMPLATE.html
+               platform/win/editing/selection/doubleclick-should-not-expand-across-lines.html
+               platform/win/editing/selection/script-tests/TEMPLATE.html
+
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::appendTrailingWhitespace):
+
+2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        CURL build fix, use proper header name.
+
+        * platform/network/curl/ResourceHandleManager.h:
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Properties on Arrays and NodeLists are not logged correctly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30485
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray):
+        (WebInspector.ConsoleView.prototype._printArray):
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: touching WebCore so that it
+        initiated inspector frontend deployment on Windows.
+
+        Web Inspector: frontend files are not deployed in Windows
+        incremental build.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::unbind):
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Title of dir(["test", "test2"]) should be Array
+
+        https://bugs.webkit.org/show_bug.cgi?id=30486
+
+        Test: inspector/console-tests.html
+
+        * inspector/front-end/InjectedScript.js:
+
+2009-10-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        REGRESSION: SVG Mask doesn't work for maskContentUnits="objectBoundingBox"
+        [https://bugs.webkit.org/show_bug.cgi?id=30480]
+
+        Patch for SVGMaskElement landed in r49598 should correct the location of
+        the mask image graphics context. It only corrects the location for userSpaceOnUse
+        mode in maskContentUnits but breaks objectBoundingBoxMode.
+        The maskDestRect shouldn't be moved. It is not responsible for the correct context
+        postioin but for the correct position of the mask image.
+        This patch calculates the context postion independently from the maskDestRect.
+        It also uses lineareRGB color space for masking on CG now. This is the default
+        color space for masking operations.
+        We already have tests for both maskContentUnits modes.
+
+            *svg/W3C-SVG-1.1/masking-intro-01-f.svg
+            *svg/custom/mask-with-default-value.svg
+
+        Some tests needed new pixel tests because of the new color space.
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-10-18  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Use v8::Integer::NewFromUnsigned when converting unsigneds into V8's numbers.
+        That is notably faster for small numbers (most common case).
+        https://bugs.webkit.org/show_bug.cgi?id=30493
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [GTK] Add MathML to the build system
+        https://bugs.webkit.org/show_bug.cgi?id=30487
+
+        Add MathML sources if MathML support is enabled.
+
+        * GNUmakefile.am:
+
+2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Non-PCH build fix. Added missing header.
+
+        * bridge/runtime_root.h:
+
+2009-10-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Compositing layers not correctly updated after partial layout
+        https://bugs.webkit.org/show_bug.cgi?id=30425
+        
+        When a partial layout happened, for example as the result of a postion-change-only
+        layout, then some compositing layer positions were not correctly updated. To fix
+        this, updateLayerPositions() now carries along a flag that is set at the rootmost
+        layer being updated, and used to determine when we hit the first compositing layer
+        in this update. RenderLayerBacking::updateAfterLayout() makes use of this information
+        to do a full geometry update on that layer, which is thus the rootmost compositing
+        layer that is being updated.
+
+        Test: compositing/geometry/partial-layout-update.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        * rendering/RenderLayerBacking.h:
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Add support for proxies in CURL.
+ 
+        https://bugs.webkit.org/show_bug.cgi?id=30446
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::setProxyInfo):
+        (WebCore::ResourceHandleManager::initializeHandle):
+        * platform/network/curl/ResourceHandleManager.h:
+        (WebCore::ResourceHandleManager::):
+
+2009-10-18  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez
+
+        https://bugs.webkit.org/show_bug.cgi?id=25901
+        Use ATK_ROLE_SECTION for divTag and ATK_ROLE_LABEL for labelTag
+
+        Replaces the use of ATK_ROLE_PANEL with the expected accessible roles.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_role):
+
+2009-10-17  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Cleanup SVGElement code, preparing for animVal support
+        https://bugs.webkit.org/show_bug.cgi?id=30466
+
+        Add new SynchronizablePropertyController and move the code for SVG property <-> XML attribute synchronization
+        from SVGElement. This is a further preparation for animVal support, where SynchronizablePropertyController will
+        be used to control the start/end state of an animated property.
+
+        We're currently tracking animated properties that need synchronization, generalize this concept and use
+        it to track their creation (bound to certain SVG*Element classes) as well as a flag determing the need
+        of synchronization (no SVG DOM object wrappers, no synchronization needed).
+
+        No change in functionality, thus no tests.
+
+        * GNUmakefile.am: Add 'SynchronizablePropertyController.cpp/h' to build
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * svg/SVGAllInOne.cpp: Ditto.
+        * svg/SVGAnimatedProperty.h: Add registerProperty() function 
+        (WebCore::::SVGAnimatedProperty): Call registerProperty() function  
+        (WebCore::::registerProperty): Add new registerProperty() function, announcing new properties to SynchronizablePropertyController.
+        * svg/SVGAnimatedTemplate.h: Use propertyController() method, to access the new functions moved from SVGElement.
+        (WebCore::lookupOrCreateWrapper):
+        * svg/SVGElement.cpp: Adapt to code moving to SynchronizablePropertyController.
+        (WebCore::SVGElement::updateAnimatedSVGAttribute):
+        * svg/SVGElement.h: Move handling SVG property synchronization to SynchronizablePropertyController.
+        (WebCore::SVGElement::propertyController): Expose reference to SynchronizablePropertyController object.
+        * svg/SVGViewSpec.cpp: Reorder initialization order of contextElement, leading to possible crashes.
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        (WebCore::SVGViewSpec::viewTarget):
+        * svg/SVGViewSpec.h: Ditto.
+        (WebCore::SVGViewSpec::contextElement):
+        * svg/SynchronizablePropertyController.cpp: Added.
+        (WebCore::SynchronizablePropertyController::SynchronizablePropertyController):
+        (WebCore::SynchronizablePropertyController::registerProperty):
+        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
+        (WebCore::SynchronizablePropertyController::synchronizeProperty):
+        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
+        (WebCore::SynchronizablePropertyController::startAnimation):
+        (WebCore::SynchronizablePropertyController::stopAnimation):
+        * svg/SynchronizablePropertyController.h: Added.
+        (WebCore::SynchronizableProperty::SynchronizableProperty):
+        (WebCore::SynchronizableProperty::isHashTableDeletedValue):
+        (WebCore::SynchronizableProperty::operator==):
+        (WebCore::SynchronizablePropertyHash::hash):
+        (WebCore::SynchronizablePropertyHash::equal):
+        (WebCore::SynchronizablePropertyHashTraits::constructDeletedValue):
+        (WebCore::SynchronizablePropertyHashTraits::isDeletedValue):
+
+2009-10-17  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25413
+        [GTK] Please expose the level of headings
+
+        Exposes the heading level as an attribute of the AtkObject.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (addAttributeToSet):
+        (webkit_accessible_get_attributes):
+        (webkit_accessible_class_init):
+
+2009-10-17  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        EventHandler::eventLoopHandleMouseDragged needs ENABLE(DRAG_SUPPORT) guards
+        https://bugs.webkit.org/show_bug.cgi?id=30472
+
+        Put ENABLE(DRAG_SUPPORT) guards around EventHandler::eventLoopHandleMouseDragged
+        in EventHandler.cpp. MSVC fails to compile when DRAG_SUPPORT not enabled.
+
+        * page/EventHandler.cpp:
+
+2009-10-17  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] Video controls not zoomed / transformed correctly
+        https://bugs.webkit.org/show_bug.cgi?id=30461
+
+        Draw the images in the controls scaled.
+
+        No new tests. With this change Chromium will pass the following tests:
+        LayoutTests/media/video-controls-zoomed.html
+        LayoutTests/media/video-controls-transformed.html
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaButton):
+        Pass along the target rect directly.
+        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
+        Adjust the thumb slide applied with the scale factor.
+
+2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Gtk] Build fix for WebKitGtk after r49723.
+
+        Add bindings/js/JSExceptionBase.* to the build.
+
+        * GNUmakefile.am:
+
+2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r49723.
+
+        Add bindings/js/JSExceptionBase.cpp to the build.
+
+        * WebCore.pro:
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30456
+        Fixes for new Debug_All Windows build configuration.
+
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::findCFNetworkModule): Ask for the correct library instead of guessing.
+        * platform/win/ScrollbarThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+        * rendering/RenderMediaControls.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+        * rendering/RenderThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+
+2009-10-16  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to determine whether a plug-in has ever been halted.
+
+        Part of <rdar://problem/7312158>.
+
+        Reviewed by Dan Bernstein.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        Initialize m_hasBeenHalted.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::hasBeenHalted):
+        Return m_hasBeenHalted.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+        Set m_hasBeenHalted.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        @charset rule after the first byte causes the rest of css to be ignored
+        https://bugs.webkit.org/show_bug.cgi?id=18265
+
+        Apparently we're supposed to tolerate whitespace before the charset
+        rule so folks can write code like this:
+
+        <style>
+        @charset "utf-8"
+        ...
+        </style>
+
+        I'm told this is one of the top compatability problems in China.
+        Tests: fast/css/comment-before-charset-external.html
+               fast/css/comment-before-charset.html
+               fast/css/many-spaces-before-charset.html
+               fast/css/space-before-charset-external.html
+               fast/css/space-before-charset.html
+
+        * css/CSSGrammar.y:
+
+2009-10-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes part of <http://webkit.org/b/30412>.
+        Web Inspector should get human readable DOM Exceptions.
+
+        Add a description field to ExceptionBase, and call it through 
+        reportException which allows the user/developer to get a more detailed
+        and coherent error explanation through the Web Inspector.
+
+        This only applies to exceptions that come from a script on the page when
+        it is run. DOM Exceptions that come from the code run in the console, or DOM
+        exceptions that are caught and logged will come in a future patch.
+
+        Tests: inspector/uncaught-dom1-exception.html
+               inspector/uncaught-dom3-exception.html
+               inspector/uncaught-dom8-exception.html
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::reportException):
+        * bindings/js/JSExceptionBase.cpp: Added.
+        (WebCore::toExceptionBase):
+        * bindings/js/JSExceptionBase.h: Added.
+        * dom/ExceptionBase.cpp:
+        (WebCore::ExceptionBase::ExceptionBase):
+        * dom/ExceptionBase.h:
+        (WebCore::ExceptionBase::description):
+        * dom/ExceptionCode.cpp:
+        (WebCore::):
+        (WebCore::getExceptionCodeDescription):
+        * dom/ExceptionCode.h:
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: forgot to check in this #include.
+
+        * bridge/runtime_root.h:
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transform layer gets stuck with the wrong transform after an animation ends
+        <rdar://problem/7311662>
+
+        Work around a CoreAnimation bug which causes an animated transform layer to
+        end up with a stale transform.
+        
+        Test: compositing/animation/state-at-end-event-transform-layer.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::bug7311367Workaround):
+        (WebCore::GraphicsLayerCA::removeAnimationFromLayer):
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        After running a transition with an end event listener, can't change the transform
+        https://bugs.webkit.org/show_bug.cgi?id=30454
+        
+        Fix an issue where, if a document had any listener for webkitTransitionEnd or webkitAnimationEnd,
+        the animations would not get cleaned up correctly, which broke subsequent changes of transform.
+        
+        Now, we always clean up the animations right after queuing up the end events.
+
+        Tests: animations/state-at-end-event.html
+               transitions/move-after-transition.html
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::onAnimationEnd):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::onAnimationEnd):
+
+2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Handle the Enter Key in the Elements Tree Hierarchy
+        https://bugs.webkit.org/show_bug.cgi?id=30428
+
+        TextNode => Edit Text Node
+        Has Attributes => Edit First Attribute
+        No Attributes => Start Editing New Attribute
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent): handle the "Enter" key
+        (WebInspector.ElementsTreeElement.prototype.set hovered): only add new attribute button on nodes with attributes
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute): prevent moving backwards where there are no attributes
+        (WebInspector.ElementsTreeElement.prototype._startEditingFromEvent): renamed to be clearer
+        (WebInspector.ElementsTreeElement.prototype._startEditing): transition to the appropriate edit state for a tree element
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix header indent style for FrameLoader and friends
+        https://bugs.webkit.org/show_bug.cgi?id=30430
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::frame):
+        (WebCore::FrameLoader::policyChecker):
+        (WebCore::FrameLoader::history):
+        (WebCore::FrameLoader::notifier):
+        (WebCore::FrameLoader::isLoadingMainResource):
+        (WebCore::FrameLoader::documentLoader):
+        (WebCore::FrameLoader::policyDocumentLoader):
+        (WebCore::FrameLoader::provisionalDocumentLoader):
+        (WebCore::FrameLoader::state):
+        (WebCore::FrameLoader::client):
+        (WebCore::FrameLoader::url):
+        (WebCore::FrameLoader::isLoadingFromCachedPage):
+        (WebCore::FrameLoader::committingFirstRealLoad):
+        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
+        (WebCore::FrameLoader::creatingInitialEmptyDocument):
+        * loader/HistoryController.h:
+        (WebCore::HistoryController::currentItem):
+        (WebCore::HistoryController::provisionalItem):
+        * loader/PolicyCallback.h:
+        (WebCore::PolicyCallback::request):
+        * loader/PolicyChecker.h:
+        (WebCore::PolicyChecker::loadType):
+        (WebCore::PolicyChecker::setLoadType):
+        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
+        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
+        * loader/RedirectScheduler.h:
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a Debug_All configuration to build entire stack as debug.
+        Change Debug_Internal to:
+        - stop using _debug suffix for all WebKit/Safari binaries
+        - not use _debug as a DLL naming suffix
+        - use non-debug C runtime lib.
+
+        * WebCore.vcproj/QTMovieWin.vcproj: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.make: Debug build in makefile should build Debug_All.
+        * WebCore.vcproj/WebCore.sln: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.submit.sln: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.vcproj: Add Debug_All configuration.
+        * WebCore.vcproj/WebCoreGenerated.vcproj: Renamed single configuration from "Release" to "all".
+
+2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49693, because it broke Chromium build.
+        http://trac.webkit.org/changeset/49693
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Updated media resource selection algorithm to reflect latest HTML 5 specification.
+
+        Noticable changes:
+            -  Elements with no source should have their network state set to NETWORK_EMPTY as opposed to NETWORK_NO_SOURCE
+            -  Empty string ("") is now considered a valid URL resolving to the current page and will be loaded
+
+        Tests: media/video-src-empty.html
+               media/video-src-none.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=30407
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectMediaResource): Updated code and comments to match spec.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Insecure plug-ins don't trigger mixed content
+        https://bugs.webkit.org/show_bug.cgi?id=30431
+
+        Added the missing check.
+
+        Test: http/tests/security/mixedContent/insecure-plugin-in-iframe.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadPlugin):
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Set autobuffer to true and schedule load in V8 audio element constructor.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30448
+
+        Covered by existing tests.
+
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Set autobuffer to true and schedule load.
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove FIXME in RenderMediaControlsChromium as bug was fixed upstream.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30422
+
+        Covered by existing media layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Removed round() and FIXME.
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix Chromium media controls to render a disabled play button when the element is unintialized.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30410
+
+        Covered by existing layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaPlayButton): Include check for NETWORK_EMPTY to render disabled play button.
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Last part -- replace HasDefaultGetPropertyNames with OverridesGetPropertyNames
+        flag.
+
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-16  Steven Knight  <sgk@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30447
+        Handle long link lines by building .idl-generated bindings in a
+        separate webcore_bindings library target.  Avoid Visual Studio
+        dependency issues by building additional generated .cpp and .h files
+        in a separate webcore_bindings_sources target.
+
+        Chrome should still build and test successfully.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Transform transitions that used to be accelerated are no longer so
+        https://bugs.webkit.org/show_bug.cgi?id=30453
+
+        The change in r49633, to not run accelerated animations/transitions on layers that
+        are not attached, broke accelerated transitions/animations in many cases where they start
+        as soon as the page loads. This change reverts the code that tests for the GraphicsLayer being
+        attached.
+        
+        No test, because it's not possible from a test to know whether a transition is accelerated or not.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+
+2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix, build the MSW source to get methods that use the MSW version of
+        PlatformModuleVersion.
+
+        * wscript:
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.  Add back MIMETypeRegistryChromium with the right
+        casing.
+
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Added.
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
+        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageResourceMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMETypeForEncoding):
+        (WebCore::MIMETypeRegistry::isSupportedJavaScriptMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedMediaMIMEType):
+        (WebCore::MIMETypeRegistry::isJavaAppletMIMEType):
+        (WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension):
+        (WebCore::dummyHashSet):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageResourceMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypesForEncoding):
+        (WebCore::MIMETypeRegistry::getSupportedNonImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedMediaMIMETypes):
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        MimeTypeRegistryChromium is mis-casen
+        https://bugs.webkit.org/show_bug.cgi?id=30441
+
+        Change the case of MimeTypeRegistryChromium to match other platforms.
+
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
+        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
+
+2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Change EmptyPluginHalterClient in SVGImage to be non-static, to
+        match changes made http://trac.webkit.org/changeset/49385.
+        https://bugs.webkit.org/show_bug.cgi?id=30403
+
+        Run the following layout test sequence:
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-01-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-03-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-04-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-05-b.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-06-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-08-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-09-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-10-t.svg
+          LayoutTests/svg/carto.net/scrollbar.svg
+          LayoutTests/svg/carto.net/selectionlist.svg
+
+        selectionlist.svg should not crash.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged): Made EmptyPluginHalterClient non-static.
+
+2009-10-16  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add beforeload event support to V8DOMWrapper
+
+        https://bugs.webkit.org/show_bug.cgi?id=30413
+
+        LayoutTests/fast/dom/beforeload/frame-before-load.html
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        MimeTypeRegistryChromium is mis-casen
+        https://bugs.webkit.org/show_bug.cgi?id=30441
+
+        Change the case of MimeTypeRegistryChromium to match other platforms.
+
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
+        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Chrome doesn't set Content-Type for file upload when the file extension
+        is not recognized
+        https://bugs.webkit.org/show_bug.cgi?id=30433
+
+        Apparently, getMIMETypeForPath is supposed to return
+        application/octet-stream when it doesn't have a better MIME type.
+
+        * platform/chromium/MimeTypeRegistryChromium.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Pull out r49676 as it caused build breakges on Symbian
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Crash fix when loading NPAPI plugins on Qt/Mac
+
+        There's no guarantee that the plist will be valid even if we
+        ask the plugin to create it. Crash obverved with iGetter.
+
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-10-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix for Chromium/skia's implementation of canvas's isPointInPath().
+        https://bugs.webkit.org/show_bug.cgi?id=30402
+
+        Covered by LayoutTests/fast/canvas/pointInPath.html.
+
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-10-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor ResourceLoadNotifier out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30379
+
+        These methods have virtually no interaction with the rest of
+        FrameLoader.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::FrameLoader::sendRemainingDelegateMessages):
+        (WebCore::FrameLoader::requestFromDelegate):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::notifier):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::receivedError):
+        * loader/ResourceLoadNotifier.cpp: Added.
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        * loader/ResourceLoadNotifier.h: Added.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        (WebCore::ResourceLoader::didFinishLoadingOnePart):
+        (WebCore::ResourceLoader::didFail):
+        (WebCore::ResourceLoader::didCancel):
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
+
+2009-10-15  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
+        (https://bugs.webkit.org/show_bug.cgi?id=30427)
+        
+        Remove no longer needed methods from ChromiumDataObject.
+
+        No new tests (no functional change)
+
+        * platform/chromium/ChromiumDataObject.h:
+
+2009-10-16  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Need a way to inform the application when a Netscape plugin is created or deleted
+        https://bugs.webkit.org/show_bug.cgi?id=30179
+
+        Inform the application when a plugin is created or destroyed, but only if the 
+        application registered for these notifications.
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-16  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Default language translation should be determined by locale settings,
+        e.g., "en-US".
+        https://bugs.webkit.org/show_bug.cgi?id=29653
+
+        Test: fast/js/navigator-language.html
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Crash fix when loading NPAPI plugins on Qt/Mac
+
+        There's no guarantee that the plist will be valid even if we
+        ask the plugin to create it. Crash obverved with iGetter.
+
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-10-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix for Chromium/skia's implementation of canvas's isPointInPath().
+        https://bugs.webkit.org/show_bug.cgi?id=30402
+
+        Covered by LayoutTests/fast/canvas/pointInPath.html.
+
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-10-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor ResourceLoadNotifier out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30379
+
+        These methods have virtually no interaction with the rest of
+        FrameLoader.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::FrameLoader::sendRemainingDelegateMessages):
+        (WebCore::FrameLoader::requestFromDelegate):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::notifier):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::receivedError):
+        * loader/ResourceLoadNotifier.cpp: Added.
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        * loader/ResourceLoadNotifier.h: Added.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        (WebCore::ResourceLoader::didFinishLoadingOnePart):
+        (WebCore::ResourceLoader::didFail):
+        (WebCore::ResourceLoader::didCancel):
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
+
+2009-10-15  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
+        (https://bugs.webkit.org/show_bug.cgi?id=30427)
+        
+        Remove no longer needed methods from ChromiumDataObject.
+
+        No new tests (no functional change)
+
+        * platform/chromium/ChromiumDataObject.h:
+
+2009-10-15  Daniel Bates  <dbates@webkit.org>
+
+        No review, rolling out r49644.
+        http://trac.webkit.org/changeset/49644
+        
+        We need to think about this change some more. See bug #30418 
+        for more details.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-10-14  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to determine whether a node is a halted plug-in.
+
+        Part of <rdar://problem/7273354> Halted plug-ins should restart on
+        mouseover
+
+        https://bugs.webkit.org/show_bug.cgi?id=30151
+
+        Reviewed by Darin Adler.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        Initialize m_isHalted.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::isHalted):
+        Return m_isHalted.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+        Set m_isHalted to true.
+        (WebCore::PluginView::restart):
+        clear m_isHalted.
+
+2009-10-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Build fix for QtWebKit after r49649.
+
+        Change JSC::HasNonDefaultMark to OverridesMarkChildren in createStructure function.
+
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed - build fix.
+
+        Web Inspector: add file missing in r49648
+
+        * inspector/front-end/TestController.js: Added.
+        (WebInspector.TestController):
+        (WebInspector.TestController.prototype.waitUntilDone):
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Part 2 -- Reverse the TypeInfo HasDefaultMark flag to OverridesMarkChildren, etc
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: introduce test controller with waitUntilDone
+        on frontend side.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30400
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/TestController.js: Added.
+        (WebInspector.TestController):
+        (WebInspector.TestController.prototype.waitUntilDone):
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.evaluateForTestInFrontend):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+
+2009-10-15  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27895
+        
+        Fixes an issue in which injecting an inline event handler whose value ends in a single-line
+        JavaScript comment can bypass the XSSAuditor. Similarly fixes this issue with respect to
+        the HTML Base element, HTML Object element, inline and external script tags, and
+        JavaScript multi-line variants of all of these attacks.
+
+        Tests: http/tests/security/xssAuditor/base-href-comment.html
+               http/tests/security/xssAuditor/iframe-javascript-url-comment.html
+               http/tests/security/xssAuditor/img-onerror-HTML-comment.html
+               http/tests/security/xssAuditor/img-onerror-comment.html
+               http/tests/security/xssAuditor/object-tag-comment.html
+               http/tests/security/xssAuditor/script-tag-comment-HTML-entity.html
+               http/tests/security/xssAuditor/script-tag-comment.html
+               http/tests/security/xssAuditor/script-tag-with-source-comment.html
+
+        * page/XSSAuditor.cpp: Added constant minAttackLength.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::findInRequest): Added parameter context. Only looks at up 
+        to minAttackLength of script code plus context (if any).
+        * page/XSSAuditor.h:
+
+2009-10-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Currently, Skia clip paths are 1-bit. This patch makes our path
+        clipping anti-aliased for non-canvas drawing.
+
+        http://code.google.com/p/chromium/issues/detail?id=5927
+        https://bugs.webkit.org/show_bug.cgi?id=28820
+        http://www.imperialviolet.org/2009/09/02/anti-aliased-clipping.html
+
+        Already covered by layout tests. New baselines will be needed in the
+        Chromium tree.
+
+        (Reland. First landed in r49329, reverted in r49330 due to Windows
+        build break)
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::clip):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::canvasClip):
+        (WebCore::GraphicsContext::clipPath):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::clipPathAntiAliased):
+        (PlatformContextSkia::restore):
+        (PlatformContextSkia::applyAntiAliasedClipPaths):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+
+2009-10-15  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7295738> No way to mute/unmute a movie in full screen video mode
+
+        * WebCore.Video.exp: Export muted and setMute.
+
+2009-10-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transitions fail to run sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=26770
+
+        Fix an issue where we could attempt to start accelerated animations or transitions on
+        GraphicsLayer that were not rooted (because of visibility:hidden), which would leave
+        the AnimationController's m_waitingForResponse flag in a state that killed subsequent
+        software transitions.
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::endAnimationUpdate):
+        (WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
+        (WebCore::AnimationControllerPrivate::addToStartTimeResponseWaitList):
+        (WebCore::AnimationControllerPrivate::startTimeResponse):
+        * page/animation/AnimationControllerPrivate.h:
+        Make some methods non-inline for ease of debugging (these are not hot methods).
+        Rename m_waitingForAResponse to m_waitingForResponse.
+        
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::hasAncestor):
+        New method to report whether the receiver has the given layer as an ancestor. Used for checking
+        whether a layer is rooted.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        Don't try to start accelerated animations or transitions on non-rooted GraphicsLayers.
+
+2009-10-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Refactor ProfilesPanel to support multiple profile types
+
+        Data describing different profile types are now stored in distinct objects.
+        https://bugs.webkit.org/show_bug.cgi?id=30332
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView.profileCallback):
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileView.prototype._sortData):
+        (WebInspector.CPUProfileType):
+        (WebInspector.CPUProfileType.prototype.get buttonTooltip):
+        (WebInspector.CPUProfileType.prototype.get buttonStyle):
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
+        (WebInspector.CPUProfile):
+        (WebInspector.CPUProfile.prototype.get title):
+        (WebInspector.CPUProfile.prototype.get uid):
+        (WebInspector.CPUProfile.prototype.get head):
+        (WebInspector.CPUProfile.prototype.createView):
+        (WebInspector.CPUProfile.prototype.viewForProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType):
+        (WebInspector.ProfileType.prototype.get buttonTooltip):
+        (WebInspector.ProfileType.prototype.get buttonStyle):
+        (WebInspector.ProfileType.prototype.get buttonCaption):
+        (WebInspector.ProfileType.prototype.get id):
+        (WebInspector.ProfileType.prototype.get name):
+        (WebInspector.ProfileType.prototype.buttonClicked):
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems.clickHandler):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.reset):
+        (WebInspector.ProfilesPanel.prototype.registerProfileType):
+        (WebInspector.ProfilesPanel.prototype._makeKey):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype.getProfileType):
+        (WebInspector.ProfilesPanel.prototype.showProfileForURL):
+        (WebInspector.ProfilesPanel.prototype.updateProfileTypeButtons):
+        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
+        (WebInspector.ProfilesPanel.prototype.get searchableViews):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.addProfileHeader):
+        (WebInspector.setRecordingProfile):
+        (WebInspector.linkifyStringAsFragment):
+        (WebInspector.showProfileForURL):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Enable inspector layout tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30014
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GStreamer] READY state doesn't mean "enough data"
+        https://bugs.webkit.org/show_bug.cgi?id=30003
+
+        STATE_READY means MediaPlayer::HaveNothing
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::updateStates):
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30002
+
+        implement cancelLoad
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::cancelLoad):
+
+2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30353
+        
+        Fix race condition, leading to a deadlock
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (webkit_video_sink_unlock_stop):
+        (webkit_video_sink_stop):
+        (webkit_video_sink_start):
+        (webkit_video_sink_class_init):
+        Fix race condition in unlock/render that would lead to deadlocks.
+
+2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30374
+        
+        Check if caps are valid before parsing them
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+        Check if caps are valid before parsing them in ::naturalSize().
+        This prevents assertions if the natural size should be calculated
+        before the video caps are negotiated.
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30006
+        [GStreamer] Unnecessary checks for Messages types in callbacks
+
+        refactored gst message callbacks into a single one
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::duration):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-10-15  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Adele Peterson.
+
+        Anchor elements should be mouse focusable regardless isLink flag.
+        https://bugs.webkit.org/show_bug.cgi?id=26856
+
+        * html/HTMLAnchorElement.cpp:
+        * html/HTMLAnchorElement.h:
+
+2009-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sort XCode project file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Return correct shorthand property name for 
+        background-repeat-x, background-repeat-y, background-position-x,
+        background-position-y, -webkit-mask-position-x, -webkit-mask-position-y,
+        -webkit-mask-repeat-x, -webkit-mask-repeat-y.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28972
+
+        Test: fast/backgrounds/repeat/background-repeat-shorthand.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Migrate profiles to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Create and update frontend script objects only when
+        web inspector is visible.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30376
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::pruneResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
+        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+
+2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Fix Windows build.
+
+        * dom/Document.idl:
+
+2009-10-14  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        [HTML5] Add document.head
+        https://bugs.webkit.org/show_bug.cgi?id=30232
+
+        Test is fast/dom/document-head.html
+
+        * dom/Document.idl: added readonly attribute head
+
+2009-10-14  Matt Mueller  <mattm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Check FNonNeg after the unit switch to avoid valgrind uninitialised conditional reference in WebCore::CSSParser::validUnit.  See http://crbug.com/20939.
+        https://bugs.webkit.org/show_bug.cgi?id=30347
+        https://bugs.webkit.org/show_bug.cgi?id=22772
+
+        Covered by running LayoutTests/fast/css/invalid-percentage-property.html under valgrind.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit):
+
+2009-10-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Move scrolling code from FrameLoader to FrameView
+        https://bugs.webkit.org/show_bug.cgi?id=30370
+
+        This code is about controlling the Frame's view, not about loading
+        stuff into the frame.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::finishedParsing):
+        (WebCore::FrameLoader::scrollToAnchor):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToFragment):
+        (WebCore::FrameView::scrollToAnchor):
+        * page/FrameView.h:
+
+2009-10-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+        
+        Part 1. Reverse the HasStandardGetOwnPropertySlot flag.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        [XSSAuditor] Add an exception for local files
+        https://bugs.webkit.org/show_bug.cgi?id=30352
+
+        Reduce XSS auditor false positives by always letting pages load scripts
+        from their own host. We don't actually know of any false positives
+        that this prevents, but it seems like a good idea.
+
+        One subtly is that we don't add this exception for scripts that have a
+        query string because (1) URLs with query strings are more apt to
+        confuse servers and (2) it is much less common to load scripts with a
+        query string.
+
+        Tests: http/tests/security/xssAuditor/script-tag-with-source-same-host-with-query.html
+               http/tests/security/xssAuditor/script-tag-with-source-same-host.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+
+2009-10-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Kill virtual contextElement() method spread all over SVG code
+        https://bugs.webkit.org/show_bug.cgi?id=30183
+
+        Remove virtual contextElement() function from all SVG*Element classes, as all animated properties live in the
+        SVG*Element classes now instead of the SVGFitToViewBox / SVGURIReference / SVGExternalResourcesRequired
+        subclasses. This is a first step to working animVal support. More patches will follow that depend on this change.
+
+        Remove "This file is part of the KDE project" from several files, change my old mail adress wildfox -> zimmermann,
+        and remove vim modelines on all files I touched. No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGAltGlyphElement.h: Remove virtual contextElement() method.
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::::synchronize):
+        (WebCore::::startAnimation):
+        (WebCore::::stopAnimation):
+        * svg/SVGAnimationElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGCircleElement.h: Ditto.
+        * svg/SVGClipPathElement.h: Ditto.
+        * svg/SVGCursorElement.h: Ditto.
+        * svg/SVGDefsElement.h: Ditto.
+        * svg/SVGEllipseElement.h: Ditto.
+        * svg/SVGExternalResourcesRequired.h: Remove pure-virtual contextElement() method.
+        * svg/SVGFEImageElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGFELightElement.h: Remove virtual contextElement() method.
+        * svg/SVGFEMergeNodeElement.h: Ditto.
+        * svg/SVGFilterElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGFilterPrimitiveStandardAttributes.h: Remove virtual contextElement() method.
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::parseViewBox): Add Document* parameter - we used to fetch the Document pointer from the context element.
+        (WebCore::SVGFitToViewBox::parseMappedAttribute): Ditto.
+        * svg/SVGFitToViewBox.h: Remove pure-virtual contextElement() method.
+        * svg/SVGFontElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGForeignObjectElement.h: Ditto.
+        * svg/SVGGElement.h: Ditto.
+        * svg/SVGGradientElement.h: Ditto.
+        * svg/SVGImageElement.h: Ditto.
+        * svg/SVGLineElement.h: Ditto.
+        * svg/SVGMPathElement.h: Ditto. Fix license indention.
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGMarkerElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGMaskElement.h: Ditto.
+        * svg/SVGPathElement.h: Ditto.
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGPatternElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::updateAnimatedSVGAttribute): synchronizeProperty<...>() has been renamed to PropertySynchronizer<...>::synchronize().
+        * svg/SVGPolyElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGRectElement.h: Ditto.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGSVGElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGScriptElement.h: Ditto.
+        * svg/SVGSwitchElement.h: Ditto.
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGSymbolElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGTRefElement.h: Remove virtual contextElement() method.
+        * svg/SVGTextContentElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGTextPathElement.h: Remove virtual contextElement() method.
+        * svg/SVGUseElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGViewElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::setViewBoxString): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        (WebCore::SVGViewSpec::parseViewSpec): Ditto.
+        * svg/SVGViewSpec.h: Devirtualize contextElement() method, it's the only place where contextElement() remains needed.
+
+2009-10-14  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Masking with wrong offset
+        [https://bugs.webkit.org/show_bug.cgi?id=30325]
+
+        SVGMaskElement moves the mask image graphics context to the wrong location.
+        In objectBoundingBoxMode the maskDestRect gets translated. This transformation
+        is not used in the later calculation. Fix by consistenly calculating the translation
+        offsets from the final mask destination rect.
+
+        Test: svg/custom/mask-with-default-value.svg
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-10-14  Kevin Decker  <kdecker@apple.com>
+
+        Rubberstamped by Jon Honeycutt.
+        
+        Export a few more showSubstituteImage() related methods.
+        
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-14  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Stringify CSS units manually (without printf) to make the formatting
+        locale-insensitive and obey CSS spec with respect to large values.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=18994
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::appendCSSDouble):
+        (WebCore::formatWithUnits):
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-14  Mark Seaborn  <mseaborn@google.com>
+
+        Reviewed by Darin Adler.
+
+        Check error return value in Perl build script
+        https://bugs.webkit.org/show_bug.cgi?id=30316
+
+        * css/makevalues.pl: Die if gperf fails.
+
+2009-10-14  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG wrong filterRegions for userSpaceOnUse and percentage values
+        [https://bugs.webkit.org/show_bug.cgi?id=30330]
+
+        Some clean-up of the SVG filter calculation code. This clean-up
+        also fixes the problem with percentage and userSpaceInUse mode.
+
+        Test: svg/filters/subRegion-in-userSpace.svg
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        * platform/graphics/filters/FilterEffect.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::buildFilter):
+        (WebCore::SVGFilterElement::canvasResource):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        (WebCore::SVGResourceFilter::~SVGResourceFilter):
+        (WebCore::SVGResourceFilter::addFilterEffect):
+        (WebCore::SVGResourceFilter::prepareFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::create):
+        * svg/graphics/filters/SVGFilter.cpp:
+        (WebCore::SVGFilter::SVGFilter):
+        (WebCore::SVGFilter::calculateEffectSubRegion):
+        (WebCore::SVGFilter::create):
+        * svg/graphics/filters/SVGFilter.h:
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        The last change fixed the problem, removing diagnostic printfs.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        CURL build fix for versions < 7.18.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::setDefersLoading):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        One more round of changes to figure out why the webgl 
+        tests are crashing on the build bot. Here I am trying
+        to see if we can create a software renderer. I am also
+        printing the found pixel formats.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Yael Aharon  <yael.aharon@nokia.com>
+ 
+        Reviewed by Simon Hausmann.
+ 
+        Enabling NPAPI plugin support on Qt Webkit for S60 platform
+        https://bugs.webkit.org/show_bug.cgi?id=29302
+
+        Also implemented by Mahesh Kulkarni<mahesh.kulkarni@nokia.com>, 
+        Rohini Ananth <rohini.ananth@nokia.com> and help from Norbert Lesr
+        <norbert.leser@nokia.com>
+         
+        * WebCore.pro:
+        Enabling ENABLE_NETSCAPE_PLUGIN_API for S60 and added S60 specific 
+        new plugin files to be compiled under symbian: macro
+
+        * bridge/npapi.h:
+        Added NPEvent and NPRegion definition for Symbian
+
+        * plugins/PluginPackage.h:
+        Added S60 specific plugin interface and plugin loader variables
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::unload): Added !PLATFORM(SYMBIAN) macro.
+        Default implementation to be used only for non-symbian platform
+        * plugins/PluginDatabase.cpp:
+        Macro !SYMBIAN checking
+        * plugins/PluginView.h:
+        Add Symbian to platforms that support setNPWindowIfNeeded
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect): Add Symbian to platforms that
+        call setNPWindowRect from setFrameRect
+         
+        Added folder 'symbian' which contains implementation files for S60
+        platform-specific NPAPI plugin functionality, under /plugins folder
+        * plugins/symbian
+        * plugins/symbian/npinterface.h:
+        Plugin Interface to be implemented by S60 NPAPI plugins 
+        * plugins/symbian/PluginContainerSymbian.h:
+        * plugins/symbian/PluginContainerSymbian.cpp:
+        * plugins/symbian/PluginDatabaseSymbian.cpp:
+        * plugins/symbian/PluginViewSymbian.cpp:
+        * plugins/symbian/PluginPackageSymbian.cpp:
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        More changes to figure out why the webgl tests are crashing on the build bot.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Round non-integer line height values.
+
+        Change webkit to rounding non-integer line height values
+        instead of truncating them. This fixes a layout test
+        failure on Windows and matches the calculation in IE and Firefox. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=24434
+
+        Test: fast/css/line-height-rounding.html
+              fast/forms/textarea-scrollbar-height.htm
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::lineHeight):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::computedLineHeight):
+
+2009-10-13  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Removes the persistent setting for InspectorTimelineAgent and renames timeline related
+        interfaces to be more consistent with the JavaScript profiler.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::startTimelineProfiler):
+        (WebCore::InspectorBackend::stopTimelineProfiler):
+        (WebCore::InspectorBackend::timelineProfilerEnabled):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::startTimelineProfiler):
+        (WebCore::InspectorController::stopTimelineProfiler):
+        (WebCore::InspectorController::timelineProfilerEnabled):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::timelineProfilerWasStarted):
+        (WebCore::InspectorFrontend::timelineProfilerWasStopped):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.timelineProfilerWasStarted):
+        (WebInspector.timelineProfilerWasStopped):
+
+2009-10-01  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix crash when loading invalid image data
+        https://bugs.webkit.org/show_bug.cgi?id=29980
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::setImageSizeForAltText):
+
+2009-10-09  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for NULL ptr deref in canvas's toDataURL().
+        https://bugs.webkit.org/show_bug.cgi?id=30254
+
+        Test: fast/canvas/canvas-toDataURL-crash.html
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::toDataURL):
+
+2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed, reverting r49558 since it broke profiler tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        ImageDecoderQt: Minor tweaks to the decoder
+
+        - Only cache the data when we start to use it.
+        - Start with a repetition count of none for normal images.
+        - Do not use canRead as this will trigger parsing of the full image
+        - Cope with a GIF failing to decode the first frame, do not
+          set m_failed to true if decoding the first frame failed
+        - Inform the QImageReader about the format that was detected
+        - Always create a ImageDecoderQt when when we have more
+        than four byte.
+
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create): Always create QImageReader for a significant speed up
+        (WebCore::ImageDecoderQt::ImageDecoderQt): Initialize m_repetitionCount to cAnimationNone
+        (WebCore::ImageDecoderQt::setData): Only call ImageDecoder::setData when everything has been received
+        (WebCore::ImageDecoderQt::isSizeAvailable): Do not check m_failed twice.
+        (WebCore::ImageDecoderQt::filenameExtension): Convert from QByteArray to String
+        (WebCore::ImageDecoderQt::frameBufferAtIndex): Check for m_failed before trying to decode
+        (WebCore::ImageDecoderQt::internalDecodeSize): Fail if the size is QSize()
+        (WebCore::ImageDecoderQt::forceLoadEverything): Handle the case were decoding the first frame fails
+        * platform/graphics/qt/ImageDecoderQt.h: Change the m_format type
+
+2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Migrate profiles to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-13  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Don't collect call frame properties until they're needed for completion.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30334
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions): if call frame id is specified and the expression is empty collect frame properties.
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain): don't send call frame properties until they're needed.
+        * inspector/front-end/ScriptsPanel.js:
+
+2009-10-13  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29106
+        [Qt] make CachedResourceHandle.h compile in winscw Symbian compiler.
+
+        Don't inline constructor CachedResourceHandle<T>(R*) to stop winscw
+        compiler aggressively resolve inheritance of class R.  
+        
+        The winscw compiler bug is reported at:
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
+        
+        The change should be reverted when the above bug is fixed in winscw compiler.
+
+        * loader/CachedResourceHandle.h:
+        (WebCore::::CachedResourceHandle):
+
+2009-10-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49554, because it broke Win and Chromium builds.
+        http://trac.webkit.org/changeset/49554
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Stringify CSS units manually (without printf) to make the formatting
+        locale-insensitive and obey CSS spec with respect to large values.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=18994
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::appendCSSDouble):
+        (WebCore::formatWithUnits):
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by David Levin.
+
+        Make grippy lines vertical on horizontal scrollbars in Linux Chrome.
+        While we're rebaselining scrollbars, fix an off by one in the vertical
+        scrollbar rendering too.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30319
+
+        Tests: this is covered by every pixel test involving scrollbars.
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+
+2009-10-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Fix issue where clientX and clientY on MouseEvents were wrong when
+        the page was zoomed and scrolled.
+
+        Test: fast/events/clientXY-in-zoom-and-scroll.html
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::contentsX): Take page zoom into account.
+        (WebCore::contentsY): Ditto.
+
+2009-10-13  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Change the order of arguments on some of the user stylesheet/script functions.  Split the removal functions
+        out into separate ones for scripts and stylesheets.
+
+        * WebCore.base.exp:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScriptToWorld):
+        (WebCore::PageGroup::addUserStyleSheetToWorld):
+        (WebCore::PageGroup::removeUserScriptFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetFromWorld):
+        (WebCore::PageGroup::removeUserScriptsFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userScripts):
+        (WebCore::PageGroup::userStyleSheets):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Chrome's "Skia" theme paints select controls backwards in RTL.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30320
+
+        Test: fast/text/international/bidi-menulist.html
+        (The test is about something else, but it includes RTL selects.)
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMenuList): flip the arrow position in RTL case.
+
+2009-10-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30318
+        ScriptExecutionContext is not anymore needed to create an EventListener - remove old code.
+        It's a followup to r48884. It removed the need to pass the ScritpExecutionContext
+        into EventListener constructor but did not remove the code pulling ScriptExecutionContext.
+
+        Tests:
+        Test adds event listener to a DocumentType Node which is created without a document
+        and then dispatches the event after attaching a node to the tree. Event
+        should fire when node is attached to the tree.
+
+        * fast/events/add-event-without-document-expected.txt: Added.
+        * fast/events/add-event-without-document.html: Added.
+
+        All changes in files below are the same - remove the code that calls
+        EventTarget::scriptExecutionContext and checks it for NULL.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+
+2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=30289
+
+        Cleaned up bitrot in SharedWorker V8 bindings.
+
+        * WebCore.gypi:
+        Removed default implementation of SharedWorkerRepository so Chromium can provide its own.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        Added V8SharedWorkerContext.cpp.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        Added case statements for SHAREDWORKER and SHAREDWORKERCONTEXT.
+        * bindings/v8/V8Index.cpp:
+        Now includes V8SharedWorkerContext.h to allow supporting SharedWorkers.
+        * bindings/v8/V8Index.h:
+        Added definition for SHAREDWORKERCONTEXT wrapper.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        Added includes for SharedWorker.h and SharedWorkerContext.h.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Reorganized Worker field indexes to be clearer, and fixed mismatch in worker field index.
+        Also added field indexes for SharedWorkers.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        Added runtime enabler for the SharedWorker constructor.
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Cleaned up bitrot (various APIs have changed since this file was written).
+        * page/DOMWindow.idl:
+        Added EnabledAtRuntime flag to window.SharedWorker.
+
+2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30345
+        HTTP tests for credential handling fail on Tiger
+
+        We cannot prevent NSURLConnection from doing its credentil handling on Tiger anyway; so
+        let it do its work without intervention. Once again, we pass explicitly passed credentials
+        in URL, fixing regressions from Safari 3.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+
+2009-10-13  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Adam Barth.
+
+        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+
+        Reworked and added to the getter/setter interface in ChromiumDataObject:
+        - added contains...() methods to just query the state
+        - added containsValid...URL() methods for URL data members
+        - removed takeFileNames() as this was too type-dependent
+        - changed return type of fileNames() to Vector<String>
+        - added interface methods to allow appending to and iteration over file names
+
+        No new tests (no functional behavior changed).
+
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::containsMainURL):
+        (WebCore::ChromiumDataObject::containsValidMainURL):
+        (WebCore::ChromiumDataObject::containsMainURLTitle):
+        (WebCore::ChromiumDataObject::containsTextPlain):
+        (WebCore::ChromiumDataObject::containsTextHTML):
+        (WebCore::ChromiumDataObject::containsHTMLBaseURL):
+        (WebCore::ChromiumDataObject::containsValidHTMLBaseURL):
+        (WebCore::ChromiumDataObject::containsContent):
+        (WebCore::ChromiumDataObject::containsContentFileExtension):
+        (WebCore::ChromiumDataObject::containsContentFileName):
+        (WebCore::ChromiumDataObject::setContentFileName):
+        (WebCore::ChromiumDataObject::containsFileNames):
+        (WebCore::ChromiumDataObject::fileNames):
+        (WebCore::ChromiumDataObject::clearFileNames):
+        (WebCore::ChromiumDataObject::countFileNames):
+        (WebCore::ChromiumDataObject::fileNameAt):
+        (WebCore::ChromiumDataObject::setFileNames):
+        (WebCore::ChromiumDataObject::appendToFileNames):
+        (WebCore::ChromiumDataObject::popFileName):
+
+2009-10-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Temporary debugging changes to figure out why the webgl tests are crashing on the build bot.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Visibility:visible inside a compositing layer doesn't make the element visible
+        https://bugs.webkit.org/show_bug.cgi?id=30339
+        
+        When deciding if a layer had any renderable content, RenderLayerBacking::paintIntoLayer()
+        only consulted hasVisibleContent(), which does not take into a account child layers which
+        may be visible. We also have to consult hasVisibleDescendant() as well.
+
+        Test: compositing/compositing-visible-descendant.html
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasVisibleDescendant):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Refactor ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        https://bugs.webkit.org/show_bug.cgi?id=30278
+
+        Move the definition of ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 
+        from the make system into common code.
+
+        Enable ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH if NETSCAPE_PLUGIN_API 
+        support is not enabled.
+
+        Remove notImplemented() from PluginPackageNone.cpp and 
+        PluginDataNone.cpp make them just empty functions.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * plugins/PluginDataNone.cpp:
+        (WebCore::PluginData::initPlugins):
+        (WebCore::PluginData::refresh):
+        * plugins/PluginPackageNone.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        (WebCore::PluginPackage::fetchInfo):
+        (WebCore::PluginPackage::load):
+
+2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30150
+        <rdar://problem/7283540> REGRESSION: Crash when accessing clipboardData.types
+
+        Test: editing/pasteboard/crash-accessing-clipboardData-types.html
+
+        * platform/mac/ClipboardMac.mm: (WebCore::addHTMLClipboardTypesForCocoaType): The String
+        class doesn't have operator bool, it's operator NSString* that is invoked instead, and it
+        converts null strings to non-null @"".
+
+2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+
+        Reviewed by Dimitri Glazkov.
+
+        window attributes (like localStorage) that are disabled at runtime are still visible
+        https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        Adding codegen/bindings to support runtime disabling of attributes.
+
+        No new tests (only supported by chrome currently)
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Refactored the guts of GenerateBatchedAttributeData into a separate GenerateSingleBatchedAttribute with a passed-in indentation level to allow generating a single BatchedAttribute struct.
+        Added support for the EnabledAtRuntime extended attribute, which generates a call to the appropriate XXXXEnabled() API before adding the attribute to the instance.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::batchConfigureAttributes):
+        Refactored attribute setting code into a common inline routine.
+        * bindings/v8/V8Proxy.h:
+        (WebCore::configureAttribute):
+        Inline function which configures a single attribute given a BatchedAttribute struct.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added (DECLARE_)ACCESSOR_RUNTIME_ENABLER to allow enabling attributes at runtime.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        Added code to enable window.Audio only if MediaPlayer.isAvailable() == true
+        * page/DOMWindow.idl:
+        Added [EnabledAtRuntime] extended attribute to the Audio attribute.
+
+2009-10-13  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27457
+        Added support for static validation on type=email input elements as per
+        HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#e-mail-state
+
+        Test: fast/forms/ValidityState-typeMismatch-email.html
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch): ValidityState.typeMismatch
+        performs validation on type=email input elements now.
+        (WebCore::ValidityState::isValidEmailAddress): simple validation method 
+        * html/ValidityState.h:
+
+2009-10-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Event listeners installed on a window object returned from window.open() don't work
+        https://bugs.webkit.org/show_bug.cgi?id=28716
+
+        Tests: http/tests/security/window-events-clear-domain.html
+               http/tests/security/window-events-clear-port.html
+               http/tests/security/window-events-pass.html
+
+        * dom/Document.cpp: Split code of Document::clear() in a way to avoid removing all
+        window event handlers when implicitOpen is called. It is called in 2 cases - on
+        committing loaded content (no need to clean handlers) and on document.open() (needs to remove handlers).
+
+        (WebCore::Document::open): in addition to calling implicitOpen it also removes window
+        event handlers, to preserve the behavior of document.open().
+
+        (WebCore::Document::implicitOpen): includes the part of removed Document::clear() that
+        does not remove window event handlers.
+
+        * dom/Document.h: Removed clear().
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): add check to avoid removing window event handlers
+        if we transition from temporary empty document to a loaded one.
+
+        (WebCore::FrameLoader::didOpenURL): Remove closeURL() which was called twice when loading.
+        (WebCore::FrameLoader::finishedLoadingDocument): add closeURL() to compensate for change above.
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix a leak in the inspector by calling didRemoveNode with
+        an error code when it fails, instead of returning from the
+        Backend.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::removeNode):
+        * inspector/front-end/ElementsTreeOutline.js:
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30337>.
+        Web Inspector: Should be able to delete nodes from the Elements Tree.
+        
+        When the delete key is pressed and a element is selected in the tree,
+        the element should be deleted from the Elements Tree and the DOM.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::removeNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didRemoveNode):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent):
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix REGRESSION(49479): Mouseover on resources graph doesn't show timings.
+        
+        Set pointer-events: none on the new overlay so mouseover events are passed
+        to the resources graph so we can show timings.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-13  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins : Remove all traces of winId. Use ownerWidget() instead.
+        
+        This is a bug for two reasons:
+        1. Everytime we use winId(), we end up creating a native widget. This causes an
+        unnecessary copy of contents from the backing store to the native widget.
+        2. Neither windowed nor windowless plugins require the winId of the QWebView or
+        QGraphicsView.
+        
+        Introduce ownerWidget() which returns a QWidget * without creating a native widget
+        (as opposed to QWidget::find(winId)).
+
+       https://bugs.webkit.org/show_bug.cgi?id=30170
+
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepthPerComponent):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QWebPageClient.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::setSharedXEventFields):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+
+2009-10-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build system fix. Typo in a filename.
+
+        * GNUmakefile.am:
+
+2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+        Alter profile link format to enable multiple profile types
+        https://bugs.webkit.org/show_bug.cgi?id=30253
+
+        The new profile URL includes the profile type along with the
+        profile title and uid.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.linkifyStringAsFragment):
+
+2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix same-named profiles grouping in the Profiles panel.
+
+        The tree node re-parenting while adding a new group node was broken.
+         
+        https://bugs.webkit.org/show_bug.cgi?id=30299
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfile):
+
+2009-10-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Enforce async interaction between inspector controller and frontend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30300
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.dispatch.delayDispatch):
+        (WebInspector.dispatch):
+
+2009-10-12  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix issue caretRangeFromPoint() returns wrong result for a zoomed and 
+        scrolled page.
+        https://bugs.webkit.org/show_bug.cgi?id=30034
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint): calculate the correct point 
+        relative to document when the page is zoomed and scrolled.
+        (WebCore::Document::caretRangeFromPoint): calculate the correct point 
+        relative to document when the page is zoomed and scrolled.
+
+2009-10-12  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        JavaScript bindings of WebSocket addEventListener/removeEventListener
+        https://bugs.webkit.org/show_bug.cgi?id=29841
+
+        Test: fast/websockets/websocket-event-target.html
+
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * websockets/WebSocket.idl:
+
+2009-10-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29078
+        <rdar://problem/7288221>
+
+        Add a mechanism to blacklist certain codecs.  Initially, just blacklist UTF-7 as HTML5 encourages.
+
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::pruneBlacklistedCodecs):
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+
+2009-10-09  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add support for the beforeload event to frames.  Complete support of the beforeload event by making sure
+        its wrapper gets properly constructed (so that the URL field of the event can be accessed).  Add support
+        for the Objective-C wrapper class as well.
+
+        Added fast/dom/beforeload/frame-before-load.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/objc/DOMEvents.mm:
+        (kitClass):
+        * dom/BeforeLoadEvent.h:
+        (WebCore::BeforeLoadEvent::isBeforeLoadEvent):
+        * dom/Event.cpp:
+        (WebCore::Event::isBeforeLoadEvent):
+        * dom/Event.h:
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+
+2009-10-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix <rdar://problem/7094146> Reproducible crash at
+        RenderObject::localToAbsolute()
+
+        Test: fast/dynamic/position-absolute-to-fixed-crash.html
+
+        The crash was caused by stale positioned objects lists following an
+        object transitioning from being absolutely position to being fixed
+        positioned.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange): In case of a transition between
+        absolute and fixed position, mark the parent as having a child needing
+        layout, so that this object will get inserted into its new container's
+        positioned objects list.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange): Changed a condition to cover
+        this transition, so that this object gets removed from its current
+        container's positioned objects list.
+
+2009-10-12  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add a palette() method that is needed by our RenderTheme.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Gradients can't handle percentage values in userSpaceOnUse mode
+        [https://bugs.webkit.org/show_bug.cgi?id=30286]
+
+        Fixed *GradientAttributes to take SVGLength instead of double. This casues
+        the problem, that we can't calculate the correct size of a gradient on
+        userSpaceOnUse mode with percentage values.
+
+        Test: svg/custom/gradient-userSpaceOnUse-with-percentage.svg
+
+        * svg/LinearGradientAttributes.h:
+        (WebCore::LinearGradientAttributes::LinearGradientAttributes):
+        (WebCore::LinearGradientAttributes::x1):
+        (WebCore::LinearGradientAttributes::y1):
+        (WebCore::LinearGradientAttributes::x2):
+        (WebCore::LinearGradientAttributes::y2):
+        (WebCore::LinearGradientAttributes::setX1):
+        (WebCore::LinearGradientAttributes::setY1):
+        (WebCore::LinearGradientAttributes::setX2):
+        (WebCore::LinearGradientAttributes::setY2):
+        * svg/RadialGradientAttributes.h:
+        (WebCore::RadialGradientAttributes::RadialGradientAttributes):
+        (WebCore::RadialGradientAttributes::cx):
+        (WebCore::RadialGradientAttributes::cy):
+        (WebCore::RadialGradientAttributes::r):
+        (WebCore::RadialGradientAttributes::fx):
+        (WebCore::RadialGradientAttributes::fy):
+        (WebCore::RadialGradientAttributes::setCx):
+        (WebCore::RadialGradientAttributes::setCy):
+        (WebCore::RadialGradientAttributes::setR):
+        (WebCore::RadialGradientAttributes::setFx):
+        (WebCore::RadialGradientAttributes::setFy):
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::buildGradient):
+        (WebCore::SVGLinearGradientElement::collectGradientProperties):
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+        (WebCore::SVGRadialGradientElement::collectGradientProperties):
+
+2009-10-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30315>.
+        Web Inspector: DOM Content and Load lines in Resources are unclear what they mean.
+        
+        Add tooltip text to the Load event and DOM Content event lines through
+        a new layer that allows these lines to be on top of the view.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
+        * inspector/front-end/inspector.css:
+
+2009-10-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49429, because it broke layout tests.
+        http://trac.webkit.org/changeset/49429
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG - crash on feMerge when input not available
+        [https://bugs.webkit.org/show_bug.cgi?id=30297]
+
+        Make a early return in SVGFEMergeElement if the needed
+        filter effect doesn't exist.
+
+        Test: svg/filters/feMerge-wrong-input.svg
+
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::build):
+
+2009-10-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added automatic flush before compositing
+        https://bugs.webkit.org/show_bug.cgi?id=30236
+
+        This causes image to always render correctly. In writing a testcase
+        I needed to implement readPixels. This exposed a bug in reading back
+        values from a CanvasArray subclass, so I fixed that as well. Now when
+        you wrap a CanvasArray in a JSValue it actually wraps the specific
+        subclass. To do this I need to add virtual methods to each CanvasArray
+        subclass to determine the type and a custom toJS method for CanvasArray
+        to create the proper wrapper. 
+
+        Test: fast/canvas/webgl/triangle.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasArrayCustom.cpp:
+        (WebCore::toJS):
+        * html/canvas/CanvasArray.h:
+        (WebCore::CanvasArray::isByteArray):
+        (WebCore::CanvasArray::isUnsignedByteArray):
+        (WebCore::CanvasArray::isShortArray):
+        (WebCore::CanvasArray::isUnsignedShortArray):
+        (WebCore::CanvasArray::isIntArray):
+        (WebCore::CanvasArray::isUnsignedIntArray):
+        (WebCore::CanvasArray::isFloatArray):
+        * html/canvas/CanvasArray.idl:
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::isByteArray):
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::isFloatArray):
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::isIntArray):
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::readPixels):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::isShortArray):
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::isUnsignedByteArray):
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::isUnsignedIntArray):
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::isUnsignedShortArray):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer drawInCGLContext:pixelFormat:forLayerTime:displayTime:]):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::readPixels):
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30307
+        
+        Fix 0 sentinel for g_object_set() function call.
+
+        * platform/graphics/gtk/DataSourceGStreamer.cpp:
+        (webkit_data_src_uri_set_uri):
+        0 is passed as 32 bit value on x86-64 in vararg functions, but
+        g_object_set() expects a 64 bit 0. This will cause crashes.
+
+2009-10-12  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Drop in="" from <feFlood>
+        https://bugs.webkit.org/show_bug.cgi?id=29001
+
+        This makes <feFlood in="bogus"> have an effect, too.
+
+        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#feflood-attribute
+
+        Test: svg/dom/feFlood-no-in1.html
+
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::SVGFEFloodElement):
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFloodElement.idl:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::FEFlood):
+        (WebCore::FEFlood::create):
+        * svg/graphics/filters/SVGFEFlood.h:
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29998
+        
+        Scale video to completely fill the target surface while
+        keeping the aspect ratio. This fixes displaying of the
+        YouTube HTML5 sample website.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        Scale video to completely fill the target surface, keep
+        the aspect ratio and center it.
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29997
+        
+        Fixes double memcpy of all rendered video frames.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateRepaintCallback):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::duration):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_dispose):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (marshal_VOID__MINIOBJECT):
+        (webkit_video_sink_class_init):
+        (webkit_video_sink_new):
+        * platform/graphics/gtk/VideoSinkGStreamer.h:
+        Directly pass the buffers up to the MediaPlayerPrivate::paint()
+        method instead of rendering them first to an intermediate cairo
+        surface. This should increase performance and peak memory usage.
+
+2009-10-11  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30242
+        
+        Fixes an issue where JavaScript URLs that are URL-encoded twice can 
+        bypass the XSSAuditor.
+        
+        JavaScript URLs that are completed by method Document::completeURL have added
+        URL-encoded characters such that a direct comparison with the URL-decoded 
+        outgoing HTTP parameters is not sufficient. Instead, the URL-decoded outgoing 
+        HTTP parameters must be URL-decoded before comparison.
+
+        Tests: http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode.html
+               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2.html
+               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3.html
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL): Modified to pass XSSAuditor
+        the URL-decoded source code for the JavaScript URL.
+        * page/XSSAuditor.cpp:
+        (WebCore::isIllegalURICharacter): Minor syntactical change to the comment.
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::canonicalizeURL): Added 
+        parameter decodeURLEscapeSequencesTwice.
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::decodeURL): Ditto.
+        (WebCore::XSSAuditor::findInRequest): Ditto.
+        * page/XSSAuditor.h:
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer): Ditto.
+
+2009-10-11  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Adam Barth.
+
+        Fixes a build break in the V8 bindings caused by revision 49420.
+        https://bugs.webkit.org/show_bug.cgi?id=30294
+
+        Revision 49420 introduces an IDL-defined CanvasActiveInfo
+        type. This causes a build break in the V8 bindings where
+        CanvasGraphicsContext3D naively refers to CanvasActiveInfo as a
+        non-ref type.
+
+        * WebCore.gypi: Include CanvasActiveInfo.idl in build.
+        * bindings/scripts/CodeGeneratorV8.pm: CanvasActiveInfo is a ref
+          ptr type.
+        * bindings/v8/DOMObjectsInclude.h: Include generated
+          CanvasActiveInfo files.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-10-11  Collin Jackson  <collinj@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Log mixed content warnings to console
+
+        https://bugs.webkit.org/show_bug.cgi?id=30290
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
+        (WebCore::FrameLoader::checkIfRunInsecureContent):
+
+2009-10-11  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Add a context scope in JS listener destructor. The destructor code uses the cotext. See http://crbug.com/24200.
+        https://bugs.webkit.org/show_bug.cgi?id=30250
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-11  Lyon Chen  <lyon.chen@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Correct the position of #endif sentence inside WebCore::Document::finishedParsing().
+
+        https://bugs.webkit.org/show_bug.cgi?id=30244
+
+        This change requires no test case as it fix a compiling error.
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+
+2009-10-11  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Adam Barth.
+
+        Sets a 500K stack limit for JavaScript workers in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=29797
+
+        Runaway recursion in JavaScript workers crashes the Chromium
+        worker process on OS X. This is because V8's default stack limit
+        is 512K on ia32 or 1M on x64, but the worker process runs workers
+        on a thread with the OS X default stack size--512K. Because there
+        are already some C+frames on the stack when V8 establishes its
+        512K default stack limit, and V8 doesn't precisely enforce the
+        stack limit, runaway recursion in V8 workers overflows the OS
+        stack and segfaults, killing the worker process. This is described
+        in Chromium bug 21653 <http://crbug.com/21653>.
+
+        This patch sets the V8 stack limit for worker JavaScript in
+        Chromium to a more conservative 500K on all platforms. This allows
+        some "headroom" for the C+stack in use when the limit is set up,
+        and some "legroom" for the V8 helper functions which in practice
+        briefly flout the V8 stack limit.
+
+        Test: LayoutTests/fast/workers/use-machine-stack.html
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+
+2009-10-11  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for wxMac 2.9, use wxGC API for measuring text.
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (GetTextExtent):
+
+2009-10-10  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Sam Weinig.
+
+        Allow [Reflect] on SVG elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28936
+
+        Update the JS binding generators to reference SVGNames instead of
+        HTMLNames, if [Reflect]ing an attribute on an SVG element.  Make
+        SVGElement::id use [Reflect].
+
+        Also make [Reflect] on an attribute with a setter exception work in ObjC
+        bindings.
+
+        Test: svg/dom/id-reflect.html
+
+        * bindings/scripts/CodeGenerator.pm: Add a function to determine the
+        appropriate C+namespace for attribute name constants.
+        * bindings/scripts/CodeGeneratorObjC.pm: Generate ExceptionCode handling
+        code for [Reflect] on an attribute with a setter exception.
+        * bindings/scripts/CodeGeneratorCOM.pm: Generate "SVGNames" instead of
+        "HTMLNames" when appropriate.
+        * bindings/scripts/CodeGeneratorJS.pm: Ditto.
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        * svg/SVGElement.cpp: Remove getter and setter methods for id.
+        * svg/SVGElement.h: Ditto.
+        * svg/SVGElement.idl: Add [Reflect] to id.
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Fix paths in xcode.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Implement getActiveAttrib and getActiveUniform
+        https://bugs.webkit.org/show_bug.cgi?id=30276
+
+        Implements the getActiveAttrib and getActiveUniform APIs.
+        Rather simple patch, adds CanvasActiveInfo definition and implementation
+        and adds forwarding to the GraphicsContext3D.
+
+        Test: fast/canvas/webgl/getActiveTest.html
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/canvas/CanvasActiveInfo.h: Added.
+        (WebCore::CanvasActiveInfo::create):
+        (WebCore::CanvasActiveInfo::name):
+        (WebCore::CanvasActiveInfo::type):
+        (WebCore::CanvasActiveInfo::size):
+        (WebCore::CanvasActiveInfo::CanvasActiveInfo):
+        * html/canvas/CanvasActiveInfo.idl: Added.
+        * html/canvas/CanvasObject.h:
+        (WebCore::CanvasObject::context):
+          Need to make the context public as it is needed to ensure we don't
+          provide a program from one context as an argument to another.
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::getActiveAttrib):
+        (WebCore::CanvasRenderingContext3D::getActiveUniform):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+
+2009-10-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Adding new attributes in Element Panel is
+        counterintuitive.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30057
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmousemove):
+        (WebInspector.ElementsTreeElement.prototype.set hovered):
+        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton):
+
+2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Build fix if Netscape plugin support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=30275
+
+        In addition to fixing the build break with guards
+        remove notImplemented() from PluginViewNone.cpp and
+        make them just just be empty functions.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::handlePostReadFile):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+        (WebCore::PluginView::setParentVisible):
+        (WebCore::PluginView::updatePluginWidget):
+
+2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r49415.
+
+        Add HistoryController.cpp to the build.
+
+        * WebCore.pro:
+
+2009-10-09  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] KURLGoogle's protocolIs barfs on input containing hyphens
+        https://bugs.webkit.org/show_bug.cgi?id=30262
+
+        This is not testable from WebKit since WebKit never uses the member
+        function form of protocolIs with input that can be controlled from a
+        web page.  It always passes string literals lacking hyphens.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::lowerCaseEqualsASCII): Only assert if toASCIILower would
+        transform the input character.
+
+2009-10-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Move HistoryController to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=30272
+
+        Purely mechanical.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/HistoryController.cpp: Added.
+        * loader/HistoryController.h: Added.
+
+2009-10-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        ApplyStyleCommand removes presentational tags even when not necessary
+        https://bugs.webkit.org/show_bug.cgi?id=28091
+
+        This patch updates implicitlyStyledElementShouldBeRemovedWhenApplyingStyle to return true
+        (triggering removal of tag) only if the style implicitly added by the element is not present in
+        the new style to apply. It also changes surroundNodeRangeWithElement so that it merges the
+        surrounding element when possible. applyTextDecorationStyle is modified so that it does not add
+        style span when the style attribute is empty.
+
+        Test: editing/execCommand/toggle-style-3.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::shouldRemoveTextDecorationTag): Returns true if specified text
+        decoration is not present in the style to apply
+        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle): No longer
+        returns true if the tag is used in new style
+        (WebCore::ApplyStyleCommand::applyTextDecorationStyle): Does not add style-span when redundant
+        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement): Merges the newly created element
+        with the surrounding identical elements
+        * editing/ApplyStyleCommand.h:
+
+2009-10-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor HistoryController out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30246
+
+        HistoryController is in charge of managing the current / previous /
+        provisional HistoryItems.  The split isn't perfect, but it's a place to
+        start.  I'll move HistoryController into its own file in another patch.
+
+        * WebCore.base.exp:
+        * loader/FrameLoader.cpp:
+        (WebCore::HistoryController::HistoryController):
+        (WebCore::HistoryController::~HistoryController):
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::closeURL):
+        (WebCore::FrameLoader::begin):
+        (WebCore::HistoryController::restoreDocumentState):
+        (WebCore::HistoryController::setCurrentItem):
+        (WebCore::HistoryController::setProvisionalItem):
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::FrameLoader::scrollToAnchor):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+        (WebCore::FrameLoader::didFirstLayout):
+        (WebCore::HistoryController::updateForFrameLoadCompleted):
+        (WebCore::FrameLoader::frameLoadCompleted):
+        (WebCore::FrameLoader::detachFromParent):
+        (WebCore::FrameLoader::receivedMainResourceError):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        (WebCore::HistoryController::addHistoryItemForFragmentScroll):
+        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
+        (WebCore::FrameLoader::shouldTreatURLAsSameAsCurrent):
+        (WebCore::HistoryController::createHistoryItem):
+        (WebCore::FrameLoader::checkDidPerformFirstNavigation):
+        (WebCore::HistoryController::addBackForwardItemClippedAtTarget):
+        (WebCore::HistoryController::createHistoryItemTree):
+        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem):
+        (WebCore::HistoryController::restoreScrollPositionAndViewState):
+        (WebCore::HistoryController::invalidateCurrentItemCachedPage):
+        (WebCore::HistoryController::saveDocumentState):
+        (WebCore::FrameLoader::loadItem):
+        (WebCore::HistoryController::urlsMatchItem):
+        (WebCore::HistoryController::goToItem):
+        (WebCore::HistoryController::recursiveGoToItem):
+        (WebCore::HistoryController::childFramesMatchItem):
+        (WebCore::HistoryController::updateForStandardLoad):
+        (WebCore::HistoryController::updateForClientRedirect):
+        (WebCore::HistoryController::updateForBackForwardNavigation):
+        (WebCore::HistoryController::updateForReload):
+        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
+        (WebCore::HistoryController::updateForCommit):
+        (WebCore::HistoryController::updateForAnchorScroll):
+        (WebCore::HistoryController::saveDocumentAndScrollState):
+        (WebCore::HistoryController::setCurrentItemTitle):
+        (WebCore::FrameLoader::didChangeTitle):
+        * loader/FrameLoader.h:
+        (WebCore::HistoryController::current):
+        (WebCore::HistoryController::provisional):
+        (WebCore::FrameLoader::policyChecker):
+        (WebCore::FrameLoader::history):
+        (WebCore::FrameLoader::creatingInitialEmptyDocument):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Unreviewed - fixing an obvious typo in my previous check-in.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30260
+        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
+
+        Fixes existing tests (which I thought I had run the previous time).
+
+        * platform/network/CredentialStorage.cpp: (WebCore::originsWithCredentials): Return the
+        set by reference.
+
+2009-10-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [v8] Need change to V8WorkerContextEventListener::reportError signature to match the base class.
+        https://bugs.webkit.org/show_bug.cgi?id=30264
+
+        The base class method changed in r48884.
+
+        Test: fast/worker/worker-script-error.html
+
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        * bindings/v8/V8WorkerContextEventListener.h:
+
+2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30260
+        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
+
+        Tests: http/tests/xmlhttprequest/logout.html
+               http/tests/xmlhttprequest/re-login-async.html
+               http/tests/xmlhttprequest/re-login.html
+
+        Fix several issues with existing credential handling code.
+
+        * platform/network/CredentialStorage.cpp:
+        (WebCore::pathToDefaultProtectionSpaceMap): Changed the data structure to a simpler one.
+        (WebCore::originsWithCredentials): The reason for two-stage lookup above was that we didn't
+        want to iterate paths for origins that never had credentials associated with them. Changed
+        to use a separate HashSet for this.
+        (WebCore::pathToDefaultProtectionSpaceMap): The concept of default per-path credentials didn't
+        match the spec very well. UAs are supposed to deduce protection space from an URL, and then
+        use whichever credentials are known for this protection space. So, OriginToDefaultBasicCredentialMap
+        is now PathToDefaultProtectionSpaceMap.
+        (WebCore::protectionSpaceMapKeyFromURL): Factored out a helper that extracts a directory
+        URL from a given URL. These directory URLs are what we use as keys in PathToDefaultProtectionSpaceMap.
+        (WebCore::CredentialStorage::set): Updated for above changes.
+        (WebCore::findDefaultProtectionSpaceForURL): Factored out code iterating path length to find
+        a prefix in OriginToDefaultBasicCredentialMap.
+        (WebCore::CredentialStorage::set): Another version of set() can update credentials for a
+        URL default protection space. It does nothing if the given URL doesn't correspond to a known
+        protection space.
+        (WebCore::CredentialStorage::get): Renamed from getDefaultAuthenticationCredential.
+
+        * platform/network/CredentialStorage.h: Made the distinction between methods that use a known
+        protection space and those that deduce one from URL more clear.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start): Update credentials before starting the request for real.
+        This makes the following pattern work:
+          var req = new XMLHttpRequest("GET", "logout.html", "logout", "logout"); // wrong credentials
+          req.send("");
+          req.abort();
+        Abort() is used here to avoid having UA present an auth dialog after getting a 401 response.
+        Note that one cannot log in using the same method, because there isn't a known protection
+        space for the URL yet in that case, so the added code has no effect.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Use a correct persistence for
+        calling receivedCredential(). This fixes logging in using an async XHR (withut abort(), of
+        course), and matches sync case.
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+        Renamed getDefaultAuthenticationCredential() to get().
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::WebCoreSynchronousLoader::load):
+        Same changes as in Mac code.
+
+2009-10-09  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Undoing a indent removes text instead of it's formatting.
+        <rdar://problem/7169206>
+        https://bugs.webkit.org/show_bug.cgi?id=28722
+        Restored the behavior prior to http://trac.webkit.org/changeset/46143. This change implemented the
+        indent command making simple DOM operation, without using moveParagraph which cause undo to be broken.
+        
+        Added editing/undo/undo-indent.html test.
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion): Restored. 
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Merged changes.
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Restored.
+        (WebCore::IndentOutdentCommand::indentRegion): Restored and added call to updateLayout to
+        ensure TextIterator could correctly calculate the position starting from the index.
+        * editing/IndentOutdentCommand.h: Restored.
+
+2009-10-09  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+        
+        Optimization: Many StringImpl transformations are no-ops and should just return 'this'
+        https://bugs.webkit.org/show_bug.cgi?id=30186
+
+        Optimized StringImpl methods lower(), stripWhiteSpace() and simplifyWhiteSpace() to
+        detect no-ops and return this instead of creating a new instance.
+        Empirical testing shows that the majority of calls to these methods are no-ops, making
+        this worthwhile even if (in the case of lower()) the non-no-op case is slightly slowed.
+        Upper() is very rarely a no-op, so it wasn't worthwhile to optimize it.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::lower):
+        (WebCore::StringImpl::upper): Just add a comment explaining why this wasn't optimized
+        (WebCore::StringImpl::stripWhiteSpace):
+        (WebCore::StringImpl::simplifyWhiteSpace):
+
+2009-10-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter feGaussianBlur implementation is missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28141]
+
+        This is the implementation of GaussianBlur filter for SVG.
+
+        There is already a test for feGaussianBlur
+        Test: svg/W3C-SVG-1.1/filters-gauss-01-b-w3c.svg 
+
+        Test: svg/filters/feGaussianBlur.svg
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::isAlphaImage):
+        (WebCore::FilterEffect::setIsAlphaImage):
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::apply):
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
+        (WebCore::boxBlur):
+        (WebCore::FEGaussianBlur::apply):
+
+2009-10-09  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] QoS support in the video sink
+        https://bugs.webkit.org/show_bug.cgi?id=29959
+
+        Removed the async buffer queue from the sink. Synchronize the
+        render method of the sink using a g_timeout_add() combined with a
+        gcond triggered when the buffer has been rendered.
+        Also fixed the video sink reference handling in the player, now
+        that the idle is not there anymore to mess up things.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_init):
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        (webkit_video_sink_dispose):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (webkit_video_sink_stop):
+        (webkit_video_sink_class_init):
+
+2009-10-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        feMorphology filter is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=5863]
+
+        Adds SVGFEMorphologyElement, for the SVG filter. It also fixes a bug
+        with the attribute "operator". It was only accessible via "_operator" 
+        on JavaScript.
+
+        Test: svg/dom/operatorAttribute.xhtml
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.SVG.Filters.exp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        * bindings/objc/DOMSVG.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * page/DOMWindow.idl:
+        * svg/SVGAllInOne.cpp:
+        * svg/SVGFECompositeElement.idl:
+        * svg/SVGFEMorphologyElement.cpp: Added.
+        (WebCore::SVGFEMorphologyElement::SVGFEMorphologyElement):
+        (WebCore::SVGFEMorphologyElement::~SVGFEMorphologyElement):
+        (WebCore::SVGFEMorphologyElement::setRadius):
+        (WebCore::SVGFEMorphologyElement::parseMappedAttribute):
+        (WebCore::SVGFEMorphologyElement::build):
+        * svg/SVGFEMorphologyElement.h: Added.
+        * svg/SVGFEMorphologyElement.idl: Added.
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::operator<<):
+        * svg/graphics/filters/SVGFEMorphology.h:
+        (WebCore::):
+        * svg/svgtags.in:
+
+2009-10-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix Chromium breakage.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30104
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.addCookieDomain): check that Storage panel is present before calling its methods.
+
+2009-10-09  Joe Ligman  <joseph.ligman@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Added pure virtual methods setInputMethodEnabled and setInputMethodHint to QWebPageClient
+
+        https://bugs.webkit.org/show_bug.cgi?id=30023
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implement beforeload for images.  ImageLoadEventSender has been refactored into a more generic
+        ImageEventSender that can be used by both load and beforeload events.  If the document has any
+        beforeload listeners, then the installation of images onto the renderer becomes asynchronous
+        and will be held up until the beforeload event can fire at a later date.
+
+        Both beforeload and load events now fire at the end of the tokenizer write() methods, so that
+        in the typical parsing case we don't have to put off the beforeload/load events until after
+        a layout or paint might already have happened.  This lets beforeload/load not cause extra
+        layouts and repaints.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::addListenerTypeIfNeeded):
+        * dom/Document.h:
+        (WebCore::Document::):
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::write):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::attach):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageBeforeLoadEventSender::ImageBeforeLoadEventSender):
+        (WebCore::ImageLoadEventSender::ImageLoadEventSender):
+        (WebCore::beforeLoadEventSender):
+        (WebCore::ImageLoader::ImageLoader):
+        (WebCore::ImageLoader::~ImageLoader):
+        (WebCore::ImageLoader::setImage):
+        (WebCore::ImageLoader::setLoadingImage):
+        (WebCore::ImageLoader::updateFromElement):
+        (WebCore::ImageLoader::notifyFinished):
+        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):
+        (WebCore::ImageLoader::dispatchPendingEvents):
+        (WebCore::ImageEventSender::ImageEventSender):
+        (WebCore::ImageEventSender::dispatchEventSoon):
+        (WebCore::ImageEventSender::cancelEvent):
+        (WebCore::ImageEventSender::dispatchPendingEvents):
+        (WebCore::ImageEventSender::timerFired):
+        * loader/ImageLoader.h:
+        (WebCore::ImageLoader::haveFiredBeforeLoadEvent):
+        * wml/WMLImageElement.cpp:
+        (WebCore::WMLImageElement::attach):
+
+2009-10-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Web Inspector: Wrap Database into ScriptObject in v8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30174
+
+        No tests due to no Script* test infrastructure.
+
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins : Fix crash when using QWebPage without QWebView.
+        
+        'client' is 0 when we have no view.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30251
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins : Add missing setCurrentPlugin(0)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30248
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+
+2009-10-09  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] beforeload event does not fire on script elements in XML
+        https://bugs.webkit.org/show_bug.cgi?id=30235
+
+        r49194 was lacking a change to XMLTokenizerQt.cpp, equivalent to the one
+        made in XMLTokenizerLibxml2.cpp.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement):
+
+2009-10-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSParserValueList
+        https://bugs.webkit.org/show_bug.cgi?id=30249
+
+        Inherits CSSParserValueList class from FastAllocBase because it has 
+        been instantiated by 'new' in WebCore/css/CSSGrammar.y:1271.
+
+        * css/CSSParserValues.h:
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins : Create Pixmap only when size changes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30214
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+
+2009-10-08  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove the WebKitPluginHalterEnabledPreferenceKey in favor of checking
+        for the existence of a PluginHalterDelegate.
+
+        This fixes a leak of WebPluginHalterClients:
+        https://bugs.webkit.org/show_bug.cgi?id=30119.
+
+        Reviewed by Dan Bernstein.
+
+        * WebCore.base.exp:
+        Removed the export of WebCore::Settings::setPluginHalterEnabled().
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyPluginHalterClient::enabled):
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Remove initialization of m_pluginHalterClient, which was removed. If a
+        non-null PluginHalterClient was passed, create the PluginHalter, and
+        set its allowed run time.
+
+        * page/Page.h:
+        Removed pluginHalterEnabledStateChanged() and m_pluginHalterClient.
+
+        * page/PluginHalter.cpp:
+        (WebCore::PluginHalter::didStartPlugin):
+        Check whether the PluginHalterClient is enabled.
+        (WebCore::PluginHalter::didStopPlugin):
+        Ditto.
+
+        * page/PluginHalter.h:
+        Made m_client an OwnPtr.
+
+        * page/PluginHalterClient.h:
+        Added a function to return the enabled state.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        Remove initialization of removed member.
+
+        * page/Settings.h:
+        Removed settings for the enabled state of the PluginHalter; we now use
+        the existence of a WebPluginHalterDelegate to determine whether the
+        PluginHalter is enabled.
+
+2009-10-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move executeScript from FrameLoader to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=30200
+
+        These methods have virtually no interaction with FrameLoader.  They
+        really seem like they ought to belong to ScriptController.
+
+        * WebCore.base.exp:
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::executeScript):
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptController.h:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::executeScript):
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/v8/ScriptController.h:
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::notifyFinished):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected):
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::replaceDocument):
+        * loader/FrameLoader.h:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::performRequest):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: added missing #include.
+
+        * ForwardingHeaders/runtime/StructureChain.h: Copied from WebCore/ForwardingHeaders/runtime/PropertyNameArray.h.
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30237>.
+        DOM Content and Load lines aren't shown if a page is loaded when the inspector is up.
+        
+        Make sure to call update script object if we have an InspectorFrontend to
+        call it on when we get one of the new events.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
+        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: updated for removal of Structure::markAggregate().
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+
+2009-10-08  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make AtomicString create its StringImpl via create(), not the constructor,
+        so it gets allocated in a single heap block, saving memory and CPU cycles.
+        This eliminates two StringImpl constructors, making the remaining ones
+        unambiguous, so the "AdoptBuffer" parameter is no longer needed.
+        Added const attribute to UChar* in StringImpl constructor, eliminating the
+        need for several const_casts in calls to it.
+        StringImpl also unfriends AtomicString (OMG drama!!!)
+        https://bugs.webkit.org/show_bug.cgi?id=30141
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::CStringTranslator::translate): Call StringImpl::create().
+        (WebCore::UCharBufferTranslator::translate): Ditto.
+        (WebCore::HashAndCharactersTranslator::translate): Ditto.
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Remove unnecessary AdoptBuffer param.
+        (WebCore::StringImpl::adopt): Ditto.
+        (WebCore::StringImpl::createUninitialized): Ditto.
+        (WebCore::StringImpl::create): Ditto.
+        (WebCore::StringImpl::crossThreadString): Ditto.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::setHash): Used by AtomicString when creating StringImpls.
+
+2009-10-08  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the shouldLoadMediaElementURL frame loader client function.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+
+2009-10-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        SVGURIReference Build problem for V8.  An additional stale reference to SVGURIReference bindings
+        which wasn't exposed until a clean build.
+        https://bugs.webkit.org/show_bug.cgi?id=30217
+
+        No new tests, just a build fix.
+
+        * bindings/v8/V8Index.cpp:
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sort XCode project file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-08  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        unselectable resources in resource panel
+        https://bugs.webkit.org/show_bug.cgi?id=30079
+
+        manual test added
+        
+        Also changed the way DnD for resources in the Resources panel is 
+        handled.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondragstart):
+        * manual-tests/inspector/duplicate-resource-urls.html: Added.
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30233>
+        Local Storage and Cookies show Blank Titles on Local Files.
+
+        If a local storage or cookies sidebar item has no domain, set the 
+        title to "Local Files", because that is what it represents.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.get mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
+
+2009-10-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix failing media layout tests.  Don't make beforeload block loads of objects that aren't in the
+        document, since video/audio (and images eventually too) can load when not in the document yet.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Move SVGFitToViewBox ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30230
+
+        This patch also devirtualizes viewBoxToViewTransform(), is it's superflous.
+        viewBoxToViewTransform() is now a simple static heper function in SVGFitToViewBox.
+        As a result, the SVGSVGElement::viewBoxToViewTransform() function now resuses the same logic.
+
+        As side-effect this patch fixes svg/custom/linking-a-03-b-transform.svg, the return
+        statement in SVGSVGElement::viewBoxToViewTransform() was clearly wrong.
+
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::SVGFitToViewBox):
+        (WebCore::SVGFitToViewBox::viewBoxToViewTransform):
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        (WebCore::SVGMarkerElement::viewBoxToViewTransform):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/SVGPatternElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        (WebCore::SVGSVGElement::viewBoxToViewTransform):
+        * svg/SVGSVGElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        * svg/SVGViewElement.h:
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        * svg/SVGViewSpec.h:
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Correct a typo that fixes the resizing of columns in Cookie view when you
+        resize the Inspector window.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.resize):
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=29811>
+        Text in Inspector's Styles gear menu is invisible.
+        
+        Adds a style rule for the option text and hr's in the gear menu,
+        to prevent them from being transparent.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Fix build problem with SVGURIReference in V8.
+        https://bugs.webkit.org/show_bug.cgi?id=30217
+
+        No new tests, just a build fix.
+
+        * WebCore.gypi:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+
+2009-10-07  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Make beforeload work on <video>/<audio> elements.
+
+        Added fast/dom/beforeload/video-before-load.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+        (WebCore::HTMLMediaElement::selectMediaResource):
+        (WebCore::HTMLMediaElement::selectNextSourceChild):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Move SVGExternalResourcesRequired ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30218
+
+        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
+        No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        * svg/SVGAElement.h:
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::SVGAnimationElement):
+        * svg/SVGAnimationElement.h:
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::SVGCircleElement):
+        * svg/SVGCircleElement.h:
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::SVGClipPathElement):
+        * svg/SVGClipPathElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        * svg/SVGCursorElement.h:
+        * svg/SVGDefsElement.cpp:
+        (WebCore::SVGDefsElement::SVGDefsElement):
+        * svg/SVGDefsElement.h:
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::SVGEllipseElement):
+        * svg/SVGEllipseElement.h:
+        * svg/SVGExternalResourcesRequired.cpp:
+        (WebCore::SVGExternalResourcesRequired::SVGExternalResourcesRequired):
+        * svg/SVGExternalResourcesRequired.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFontElement.cpp:
+        (WebCore::SVGFontElement::SVGFontElement):
+        * svg/SVGFontElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGElement.cpp:
+        (WebCore::SVGGElement::SVGGElement):
+        * svg/SVGGElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        * svg/SVGImageElement.h:
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::SVGLineElement):
+        * svg/SVGLineElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::SVGPathElement):
+        * svg/SVGPathElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPatternElement.h:
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::SVGPolyElement):
+        * svg/SVGPolyElement.h:
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::SVGRectElement):
+        * svg/SVGRectElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        * svg/SVGSVGElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        * svg/SVGScriptElement.h:
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::SVGSwitchElement):
+        * svg/SVGSwitchElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::SVGTextContentElement):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        * svg/SVGUseElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        * svg/SVGViewElement.h:
+
+2009-10-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        SVG feComposite: operator over mixes up inputs
+        [https://bugs.webkit.org/show_bug.cgi?id=30205]
+
+        SVG feComposite operator over mixed up the inputs.
+        The pixel-test svg/filters/feComposite.svg can already test this.
+        No new test result is needed as long as filters are disabled.
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Move SVGURIReference ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30184
+
+        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
+        No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        * svg/SVGAElement.h:
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::SVGAltGlyphElement):
+        * svg/SVGAltGlyphElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        * svg/SVGCursorElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        * svg/SVGFilterElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        * svg/SVGImageElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        (WebCore::SVGMPathElement::pathElement):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPatternElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        * svg/SVGScriptElement.h:
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::SVGTRefElement):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::SVGTextPathElement):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGURIReference.cpp:
+        (WebCore::SVGURIReference::SVGURIReference):
+        * svg/SVGURIReference.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        * svg/SVGUseElement.h:
+
+2009-10-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Re-add the QApplication::syncX() line for plugin windows removed
+        by r49169. Also changed the location of the sync just after the
+        creation instead of just before sending it to the plugin.
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::platformStart):
+
+2009-10-08  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: NodeLists Don't Display Well in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=28061
+
+        * inspector/front-end/InjectedScript.js:
+        (Object.type):
+
+2009-10-08  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Remove unnecessary XSync for opaque mode.
+        
+        The reason for the XSync was that the plugin would not know about the
+        Drawable. It turns out that the real reason behind this is that even
+        though XCreatePixmap returns a handle, this id is unknown to the server
+        until we flush the connection.
+        
+        So, move the XSync to right after we create the Pixmap.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30207
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+
+2009-10-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30188
+        
+        Fixes an issue where performing a non DHTML drag-and-drop operation 
+        does not work as expected. For instance, dragging some selected text 
+        to an external application, such as TextEdit.
+        
+        This issue was a regression that arose from patching bug #30107.
+        
+        This change is covered by the manual test: 
+        drag-out-of-background-window.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::startDrag): When performing a non-DHTML drag 
+        operation then default to drag operations DragOperationGeneric and 
+        DragOperationCopy according to similar functionality removed when fixing
+        bug #30107, see: 
+        http://trac.webkit.org/browser/trunk/WebKit/mac/WebView/WebHTMLView.mm?rev=48526#L3430 
+
+2009-10-07  Xan Lopez  <xlopez@igalia.com>
+
+        Fix more breakage in the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move PolicyChecker to it's own file
+        https://bugs.webkit.org/show_bug.cgi?id=30193
+
+        This is just moving code around and re-naming things.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/PolicyCallback.cpp: Added.
+        (WebCore::PolicyCallback::PolicyCallback):
+        (WebCore::PolicyCallback::~PolicyCallback):
+        (WebCore::PolicyCallback::clear):
+        (WebCore::PolicyCallback::set):
+        (WebCore::PolicyCallback::call):
+        (WebCore::PolicyCallback::clearRequest):
+        (WebCore::PolicyCallback::cancel):
+        * loader/PolicyCallback.h: Added.
+        (WebCore::PolicyCallback::request):
+        * loader/PolicyCheck.cpp: Removed.
+        * loader/PolicyCheck.h: Removed.
+
+2009-10-07  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by Mark Rowe.
+
+        Include <limits> for std::numeric_limits.  Required by gcc-4.4
+        https://bugs.webkit.org/show_bug.cgi?id=30197
+
+        * html/canvas/CanvasByteArray.h:
+        * html/canvas/CanvasIntArray.h:
+        * html/canvas/CanvasShortArray.h:
+        * html/canvas/CanvasUnsignedByteArray.h:
+        * html/canvas/CanvasUnsignedIntArray.h:
+        * html/canvas/CanvasUnsignedShortArray.h:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor PolicyChecker out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30155
+
+        This patch separates PolicyChecker from FrameLoader.  Loader policy is
+        in change of managing the FrameLoaderClient callbacks.  Ideally, it
+        shouldn't know anything about FrameLoader, but I couldn't quite remove
+        all knowledge (although we might be able to do more later).  In a
+        future patch, I'll move PolicyChecker into a separate file.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::load):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+        (WebCore::PolicyChecker::handleUnimplementablePolicy):
+        (WebCore::PolicyChecker::cannotShowMIMEType):
+        (WebCore::PolicyChecker::PolicyChecker):
+        (WebCore::PolicyChecker::checkNavigationPolicy):
+        (WebCore::PolicyChecker::checkContentPolicy):
+        (WebCore::FrameLoader::shouldReloadToHandleUnreachableURL):
+        (WebCore::FrameLoader::stopAllLoaders):
+        (WebCore::PolicyChecker::cancelCheck):
+        (WebCore::PolicyChecker::stopCheck):
+        (WebCore::PolicyChecker::continueAfterContentPolicy):
+        (WebCore::PolicyChecker::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::loadPostRequest):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::PolicyChecker::checkNewWindowPolicy):
+        (WebCore::PolicyChecker::continueAfterNewWindowPolicy):
+        (WebCore::PolicyChecker::continueAfterNavigationPolicy):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        * loader/FrameLoader.h:
+        (WebCore::PolicyChecker::loadType):
+        (WebCore::PolicyChecker::setLoadType):
+        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
+        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
+        (WebCore::FrameLoader::policy):
+        * loader/FrameLoaderClient.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didCancel):
+        (WebCore::MainResourceLoader::willSendRequest):
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/5751979> Database code takes JSLock on secondary
+        thread, permanently slowing down JavaScript
+
+        Changed callback objects to use a standard helper object. The helper
+        object ASSERTs that it is deleted on the main thread, so no lock is
+        required when unprotecting its members. It also centralizes some previously
+        duplicated code.
+        
+        Callback objects that might be deleted on a secondary thread use
+        callOnMainThread to delete their helper objects on the main thread.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCallbackData.cpp: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
+        (WebCore::JSCallbackData::deleteData):
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
+        (WebCore::JSCallbackData::JSCallbackData):
+        (WebCore::JSCallbackData::~JSCallbackData):
+        (WebCore::JSCallbackData::callback):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionCallback.h:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::~JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::~JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::~JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::~JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.h:
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+
+2009-10-07  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        Fix StringImpl::m_buffer
+        https://bugs.webkit.org/show_bug.cgi?id=30189
+
+        Fix my previous StringImpl patch to avoid using an indefinite-length array member,
+        since MSVC doesn't like it. Instead, go back to offsetting by sizeof(StringImpl).
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::createUninitialized):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::bufferIsInternal):
+
+2009-10-07  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Update isolated worlds under v8 to support world reuse.
+        https://bugs.webkit.org/show_bug.cgi?id=30145
+
+        * bindings/v8/ScriptController.cpp:
+        Replace evaluateInNewIsolatedWorld() withe evaluateInIsolatedWorld(id).
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/v8/ScriptController.h: Ditto.
+        * bindings/v8/V8Proxy.cpp: Ditto.
+        (WebCore::V8Proxy::~V8Proxy): Dittio.
+        (WebCore::V8Proxy::evaluateInIsolatedWorld): Ditto.
+        * bindings/v8/V8Proxy.h: Ditto.
+        * bindings/v8/V8IsolatedWorld.cpp:
+        Add support for controlling lifetime of a world, rather than relying on GC.
+        (WebCore::V8IsolatedWorld::contextWeakReferenceCallback): Ditto.
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld): Ditto.
+        (WebCore::V8IsolatedWorld::destroy): Ditto.
+        * bindings/v8/V8IsolatedWorld.h: Ditto.
+
+2009-10-07  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix for http://trac.webkit.org/changeset/49272 on Windows
+
+        * platform/text/StringImpl.h:
+
+2009-10-07  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Optimization of StringImpl:
+        - Remove unnecessary m_bufferIsInternal member (saves 4 bytes). Instead, check whether
+          m_data points to just past the end of the object's members.
+        - copy() and createWithTerminatingNullCharacter() create the string in a single malloc
+          block instead of 2 (saves ~20 bytes and considerable CPU cycles, increases locality).
+        - Move m_length next to m_hash to save 4 bytes of padding in 64-bit builds.
+          
+        https://bugs.webkit.org/show_bug.cgi?id=29500
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Re-ordered members.
+        (WebCore::StringImpl::~StringImpl): Change to is-buffer-internal check.
+        (WebCore::StringImpl::createUninitialized): Use new m_buffer member instead of sizeof()
+            to ensure chars are copied to correct location.
+        (WebCore::StringImpl::createWithTerminatingNullCharacter): Make sure copy is created
+            in a single malloc block.
+        (WebCore::StringImpl::threadsafeCopy): Make sure copy is created in a single malloc block.
+        (WebCore::StringImpl::crossThreadString): Make sure copy is created in a single malloc block.
+        (WebCore::StringImpl::sharedBuffer): Change to is-buffer-internal check.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::startsWith): Just fixed a confusing param name.
+        (WebCore::StringImpl::bufferIsInternal): Changed member var into accessor method.
+        (WebCore::StringImpl::m_data): Repositioned for optimal member packing in 64-bit.
+        (WebCore::StringImpl::m_buffer): Added to provide an explicit location for where internal buffer goes.
+
+2009-10-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30102
+        And
+        <rdar://problem/5015957>
+        
+        Manual test to confirm that the not-allowed cursor is shown for an
+        invalid drag-and-drop operation.
+        
+        We cannot test this using DRT because of a discrepancy between the Windows
+        API-based drop effect and the WebKit drop effect. See bug #24731 for more
+        details.
+
+        * manual-tests/drag-cursor-notallowed.html: Added.
+
+2009-10-07  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-07  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30104>.
+        Inspector should show cookies of sub-resources on the page.
+        
+        This function implements showing cookies for all sub-resources of a page.
+        When the page is loaded, it populates the Storage Panel with a list of all
+        domains that were loaded as part of the full page load (iframes, ads, etc).
+        When the user selects one of the domains, the inspector calls back into the
+        controller, and the controller combines all of the cookies from that domain
+        into a list, and sends that list is sent back to the controller to render.
+        
+        A domain now needs to be passed into CookieItemsView, and CookieSidebarTreeElement.
+        
+        As a result of a previous patch, we now have detailed cookie information for
+        both Windows on CFNetwork and Mac. Additionally, this patch provides deleteCookie
+        support on Windows.
+
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/js/ScriptObject.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::getCookies):
+        (WebCore::InspectorController::buildArrayForCookies):
+        (WebCore::InspectorController::buildObjectForCookie):
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addCookieDomainForDocument):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.addCookieDomain):
+        (WebInspector.StoragePanel.prototype.showCookies):
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addCookieDomain):
+        * platform/Cookie.h:
+        (WebCore::CookieHash::hash):
+        (WebCore::CookieHash::equal):
+        (WTF::):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::deleteCookie):
+
+2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add ScriptObject::set(const char*, unsigned).
+
+        https://bugs.webkit.org/show_bug.cgi?id=30104
+
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/v8/ScriptObject.h:
+
+2009-10-07  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows (Cairo).
+
+        Provide implementation of new BitmapImage::create that was
+        added in @r49060.
+
+        * platform/graphics/win/ImageCairoWin.cpp:
+
+2009-10-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Refactor RenderThemeChromiumMac and RenderThemeChromiumSkia to render media controls using GraphicsContext.
+
+        Design was based on existing RenderMediaControls.cpp used by RenderThemeSafari/Win.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29987
+
+        Covered by existing layout tests as no new functionality was introduced.
+
+        * WebCore.gypi: Added RenderMediaControlsChromium.cpp/h.
+        * css/mediaControlsChromium.css: Tweaked media slider position and border style.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::toParentMediaElement): Taken from RenderMediaControls.
+        (WebCore::MediaControlElement::rendererIsNeeded): Don't call shouldRenderMediaControlPart() if element has no appearance.
+        (WebCore::MediaControlInputElement::rendererIsNeeded): Ditto.
+        * rendering/RenderMediaControls.cpp: Moved parentMediaElement() to MediaControlElements.
+        * rendering/RenderMediaControlsChromium.cpp: Added.
+        (WebCore::platformResource): Helper to load and cache media control image resources.
+        (WebCore::mediaSliderThumbImage): Implementation refactored from RenderThemeChromiumMac/Skia.
+        (WebCore::mediaVolumeSliderThumbImage): Ditto.
+        (WebCore::paintMediaButton): Ditto.
+        (WebCore::paintMediaMuteButton): Ditto.
+        (WebCore::paintMediaPlayButton): Ditto.
+        (WebCore::paintMediaSlider): Ditto.
+        (WebCore::paintMediaSliderThumb): Ditto.
+        (WebCore::paintMediaVolumeSlider): Ditto.
+        (WebCore::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::paintMediaTimelineContainer): Ditto.
+        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart): Ditto.
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart): Same
+        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
+        * rendering/RenderMediaControlsChromium.h: Added.
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize): Implementation delegated to RenderMediaControlsChromium.
+        (WebCore::RenderThemeChromiumMac::shouldRenderMediaControlPart): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground): Ditto.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaControlsBackground): Implementation delegated to RenderMediaControlsChromium.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Ditto.
+
+2009-10-07  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make plugins work with beforeload.
+
+        Added fast/dom/beforeload/flash-before-load.html
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-10-07  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Protect JS listener object from GC while clearing a property on it.
+        See http://crbug.com/23780.
+        https://bugs.webkit.org/show_bug.cgi?id=30137
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Rubber-stamped by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CachedResourceClient class
+        https://bugs.webkit.org/show_bug.cgi?id=30165
+
+        Inherits CachedResourceClient class from FastAllocBase because (its
+        child class) CSSFontFaceSource has been instantiated by 'new' in WebCore/css/CSSFontFaceSource.h:46.
+
+        * loader/CachedResourceClient.h:
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's IdentifierRep 
+        https://bugs.webkit.org/show_bug.cgi?id=30159                                                        
+
+        Inherits IdentifierRep class from FastAllocBase because it has been                                 
+        instantiated by 'new' in WebCore/bridge/IdentifierRep.cpp:61.  
+
+        * bridge/IdentifierRep.h:
+
+2009-10-07  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fetch pointers to C+DOM window immediately from holder
+        object (do not search prototype chain for proper JS wrapper).
+        https://bugs.webkit.org/show_bug.cgi?id=29031
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::installDOMWindow):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+2009-10-07  Adam Roben  <aroben@apple.com>
+
+        Fix typo in PluginView::load that was causing cross-origin loads to
+        be allowed
+
+        This typo was introduced in the build fix in r49213.
+
+        Fixes <http://webkit.org/b/30168> REGRESSION (r49213):
+        http/tests/plugins/local-geturl-from-remote.html is failing on Windows
+
+        Reviewed by Sam Weinig.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load): Removed a comma operator that was making
+        a condition always evaluate to true.
+
+2009-10-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Do not create valid QColor's for invalid WebCore::Color's.
+
+        * platform/graphics/qt/ColorQt.cpp:
+        (WebCore::Color::operator QColor):
+
+2009-10-07  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Symbian SBSv2 .data segment adress fix
+        https://bugs.webkit.org/show_bug.cgi?id=30157
+
+        RO-section in qtwebkit.dll exceeds allocated space in SBSv2. Move RW-section
+        base address to start from 0x800000 instead of the toolchain default 0x400000
+
+        * WebCore.pro:
+
+2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Migrate database inspection to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29788
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::databaseForId):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::databaseForId):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::getDatabaseTableNames):
+        (WebCore::InspectorBackend::reportDidDispatchOnInjectedScript):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::selectDatabase):
+        (WebCore::InspectorController::databaseForId):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::selectDOMStorage):
+        (WebCore::InspectorController::getDOMStorageResourceForId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorDatabaseResource.h:
+        (WebCore::InspectorDatabaseResource::database):
+        (WebCore::InspectorDatabaseResource::id):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/Database.js:
+        (WebInspector.Database):
+        (WebInspector.Database.prototype.get id):
+        (WebInspector.Database.prototype.set name):
+        (WebInspector.Database.prototype.set version):
+        (WebInspector.Database.prototype.set domain):
+        (WebInspector.Database.prototype.getTableNames):
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.selectDatabase):
+        (WebInspector.StoragePanel.prototype.dataGridForResult):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDatabase):
+
+2009-10-07  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins: Disable content propagation for QGraphicsView items
+        
+        We cannot support content propagation for items in QGraphicsView because
+        the contents of the backing store might be transformed. So turn it off
+        if we are not painting on QWidget.
+        
+        Note that this check will not work for a QWebView in a
+        QGraphicsProxyWidget, but I guess it's fine. Alternative is to do an
+        even uglier cast: static_cast painter's paintDevice() to QWidget and
+        check if it is the viewport() of QGraphicsView.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30149
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build by adding the missing files to the build.
+
+        * WebCore.pro:
+
+2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Fix incorrect convertion of double into int while assigning it to
+        a float.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Fix rounding error issues in height calculation in 64 bits.
+
+        Already covered by existing tests.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-10-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Dual lines in css2.1 layout tests do not match:
+        https://bugs.webkit.org/show_bug.cgi?id=23262
+
+        Now we can put a counter node as the next sibling of a reset node.
+        Re-layout the counter content when the count is updated.
+
+        Tests: fast/css/counters/t1204-increment-00-c-o.html
+               fast/css/counters/t1204-increment-01-c-o.html
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::recount):
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+
+2009-10-06  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Removed unused member variable from FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30146
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        * loader/FrameLoader.h:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        A few small/trivial tweaks to the last build fix.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Need to adjust MessagePort, etc. code for the post clone work done.
+        https://bugs.webkit.org/show_bug.cgi?id=30147
+
+        No change in functionality so no new tests.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/SerializedScriptValue.h: Added.
+         A very simple implementation of SerializedScriptValue
+         that only works for strings.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Fix for <rdar://problem/7271202>
+        Dispatch resource load delegate functions for the media element.
+        Since we don't get the required callbacks from the media engine,
+        just fake the parameters to the delegate functions as best as possible.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource):
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+        * loader/FrameLoader.h:
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        More build fixes.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::DeserializingTreeWalker::getProperty):
+        (WebCore::TeardownTreeWalker::getProperty):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Build and formatting fix.
+
+        * ForwardingHeaders/runtime/ExceptionHelpers.h: Added.
+        * bindings/js/SerializedScriptValue.cpp:
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::operator bool):
+        (WebCore::SerializedScriptValueData::release):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+
+2009-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        It should be possible to post (clone) built-in JS objects to Workers
+        https://bugs.webkit.org/show_bug.cgi?id=22878
+
+        Implement object cloning semantics for postMessage.  Currently only
+        a partial implementation of the spec -- cloning of File, FileList,
+        ImageData, and RegExp were left out as they would have significantly
+        increased patch size.
+
+        Cloning requires multiple tree walks so we use a templated tree
+        walk function, allowing us to share a single implementation for
+        serialization, deserialization, and eventual destruction of the
+        serialized object tree.
+
+        Test: fast/dom/Window/window-postmessage-clone.html
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        * bindings/js/JSMessageEventCustom.cpp:
+        (WebCore::JSMessageEvent::initMessageEvent):
+        * bindings/js/JSMessagePortCustom.h:
+        (WebCore::handlePostMessage):
+        * bindings/js/SerializedScriptValue.cpp: Added.
+        (WebCore::SerializedObject::set):
+        (WebCore::SerializedObject::names):
+        (WebCore::SerializedObject::values):
+        (WebCore::SerializedObject::create):
+        (WebCore::SerializedObject::clear):
+        (WebCore::SerializedObject::SerializedObject):
+        (WebCore::SerializedArray::setIndex):
+        (WebCore::SerializedArray::canDoFastRead):
+        (WebCore::SerializedArray::getIndex):
+        (WebCore::SerializedArray::getSparseIndex):
+        (WebCore::SerializedArray::length):
+        (WebCore::SerializedArray::create):
+        (WebCore::SerializedArray::clear):
+        (WebCore::SerializedArray::SerializedArray):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SharedSerializedData::asArray):
+        (WebCore::SharedSerializedData::asObject):
+        (WebCore::):
+        (WebCore::walk):
+        (WebCore::BaseWalker::BaseWalker):
+        (WebCore::BaseWalker::shouldTerminate):
+        (WebCore::BaseWalker::ticksUntilNextCheck):
+        (WebCore::BaseWalker::didTimeOut):
+        (WebCore::BaseWalker::throwStackOverflow):
+        (WebCore::BaseWalker::throwInterruptedException):
+        (WebCore::SerializingTreeWalker::SerializingTreeWalker):
+        (WebCore::SerializingTreeWalker::null):
+        (WebCore::SerializingTreeWalker::isArray):
+        (WebCore::SerializingTreeWalker::isObject):
+        (WebCore::SerializingTreeWalker::asInputArray):
+        (WebCore::SerializingTreeWalker::asInputObject):
+        (WebCore::SerializingTreeWalker::createOutputArray):
+        (WebCore::SerializingTreeWalker::createOutputObject):
+        (WebCore::SerializingTreeWalker::length):
+        (WebCore::SerializingTreeWalker::canDoFastRead):
+        (WebCore::SerializingTreeWalker::getIndex):
+        (WebCore::SerializingTreeWalker::getSparseIndex):
+        (WebCore::SerializingTreeWalker::getProperty):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::SerializingTreeWalker::getPropertyNames):
+        (WebCore::SerializingTreeWalker::putIndex):
+        (WebCore::SerializingTreeWalker::putProperty):
+        (WebCore::SerializingTreeWalker::startArray):
+        (WebCore::SerializingTreeWalker::endArray):
+        (WebCore::SerializingTreeWalker::startObject):
+        (WebCore::SerializingTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::serialize):
+        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
+        (WebCore::DeserializingTreeWalker::null):
+        (WebCore::DeserializingTreeWalker::isArray):
+        (WebCore::DeserializingTreeWalker::isObject):
+        (WebCore::DeserializingTreeWalker::asInputArray):
+        (WebCore::DeserializingTreeWalker::asInputObject):
+        (WebCore::DeserializingTreeWalker::createOutputArray):
+        (WebCore::DeserializingTreeWalker::createOutputObject):
+        (WebCore::DeserializingTreeWalker::length):
+        (WebCore::DeserializingTreeWalker::canDoFastRead):
+        (WebCore::DeserializingTreeWalker::getIndex):
+        (WebCore::DeserializingTreeWalker::getSparseIndex):
+        (WebCore::DeserializingTreeWalker::getProperty):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::getPropertyNames):
+        (WebCore::DeserializingTreeWalker::putIndex):
+        (WebCore::DeserializingTreeWalker::putProperty):
+        (WebCore::DeserializingTreeWalker::startArray):
+        (WebCore::DeserializingTreeWalker::endArray):
+        (WebCore::DeserializingTreeWalker::startObject):
+        (WebCore::DeserializingTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::deserialize):
+        (WebCore::TeardownTreeWalker::shouldTerminate):
+        (WebCore::TeardownTreeWalker::ticksUntilNextCheck):
+        (WebCore::TeardownTreeWalker::didTimeOut):
+        (WebCore::TeardownTreeWalker::throwStackOverflow):
+        (WebCore::TeardownTreeWalker::throwInterruptedException):
+        (WebCore::TeardownTreeWalker::null):
+        (WebCore::TeardownTreeWalker::isArray):
+        (WebCore::TeardownTreeWalker::isObject):
+        (WebCore::TeardownTreeWalker::asInputArray):
+        (WebCore::TeardownTreeWalker::asInputObject):
+        (WebCore::TeardownTreeWalker::createOutputArray):
+        (WebCore::TeardownTreeWalker::createOutputObject):
+        (WebCore::TeardownTreeWalker::length):
+        (WebCore::TeardownTreeWalker::canDoFastRead):
+        (WebCore::TeardownTreeWalker::getIndex):
+        (WebCore::TeardownTreeWalker::getSparseIndex):
+        (WebCore::TeardownTreeWalker::getProperty):
+        (WebCore::TeardownTreeWalker::convertIfTerminal):
+        (WebCore::TeardownTreeWalker::getPropertyNames):
+        (WebCore::TeardownTreeWalker::putIndex):
+        (WebCore::TeardownTreeWalker::putProperty):
+        (WebCore::TeardownTreeWalker::startArray):
+        (WebCore::TeardownTreeWalker::endArray):
+        (WebCore::TeardownTreeWalker::startObject):
+        (WebCore::TeardownTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::tearDownSerializedData):
+        * bindings/js/SerializedScriptValue.h: Added.
+        (WebCore::SharedSerializedData::~SharedSerializedData):
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::type):
+        (WebCore::SerializedScriptValueData::~SerializedScriptValueData):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SerializedScriptValueData::asImmediate):
+        (WebCore::SerializedScriptValueData::asDouble):
+        (WebCore::SerializedScriptValueData::asString):
+        (WebCore::SerializedScriptValueData::asObject):
+        (WebCore::SerializedScriptValueData::asArray):
+        (WebCore::SerializedScriptValueData::operator bool ):
+        (WebCore::SerializedScriptValueData::release):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::deserialize):
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create):
+        (WebCore::MessageEvent::data):
+        * dom/MessageEvent.idl:
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        * dom/MessagePort.h:
+        * dom/MessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::EventData::message):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+        (WebCore::DOMWindow::postMessage):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/EventSource.cpp:
+        (WebCore::EventSource::createMessageEvent):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didReceiveMessage):
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::postMessage):
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix for Windows.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move FrameLoader::canLoad to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30111
+
+        * WebCore.base.exp:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+        (WebCore::FrameLoader::loadPlugin):
+        (WebCore::FrameLoader::loadFrameRequest):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::createJavaAppletWidget):
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::canLoad):
+        (WebCore::SecurityOrigin::shouldHideReferrer):
+        * page/SecurityOrigin.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move setLocalLoadPolicy and friends to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30110
+
+        These have more to do with security policies than with loading frames.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::setLocalLoadPolicy):
+        (WebCore::SecurityOrigin::restrictAccessToLocal):
+        (WebCore::SecurityOrigin::allowSubstituteDataAccessToLocal):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::):
+
+2009-10-06  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Preparation for <http://webkit.org/b/30104>.
+        Inspector should show cookies of sub-resources on the page.
+        
+        Implement getRawCookies for CFNetwork for Windows, so we can see more
+        than just a key/value pair for Cookies when we are on Windows.
+
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+
+2009-10-06  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30132, make beforeload work with <link> elements and
+        XML processing instructions.
+
+        Fix up ProcessingInstruction's setData call so that it actually updates a stylesheet when the
+        data gets changed.
+
+        Move dispatchBeforeLoadedEvent to ContainerNode so all Elements (and ProcessingInstruction) can
+        access it.
+
+        Added fast/dom/beforeload/link-before-load.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+        * dom/ContainerNode.h:
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+        (WebCore::ProcessingInstruction::setData):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::requestScript):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseMappedAttribute):
+        (WebCore::HTMLLinkElement::process):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::forAttributeValue):
+        * html/HTMLScriptElement.h:
+        * svg/SVGScriptElement.cpp:
+        * svg/SVGScriptElement.h:
+
+2009-10-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        accessibility/media-element.html crashes (and has incorrect result)
+        https://bugs.webkit.org/show_bug.cgi?id=30108
+
+        Fix up the accessibilty label for the newly added fullscreen button,
+        and update the test result accordingly.
+
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaControl::controlTypeName):
+
+2009-10-06  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30028>
+        Multiple calls to SetFrontendProxyObject can leave an InspectorTimelineAgent with an invalid
+        InspectorFrontend.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject): Adds a check for an existing timeline agent.
+
+2009-10-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        Move textRects to the right category in DOM.mm. Include DOMPrivate.h to ensure that the interfaces match.
+
+        * bindings/objc/DOM.mm:
+        (-[DOMNode textRects]):
+
+2009-10-06  Benjamin C Meyer  <bmeyer@rim.com>
+
+        Reviewed by Ariya Hidayat.
+        
+        Match the behavior of other WebKit browser and have the first url of the drag data be the url passed in declareAndWriteDragImage and set the text of the drag data to be the title argument.
+        
+        Manual test: Drag the readability js link from http://lab.arc90.com/experiments/readability/
+        
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::declareAndWriteDragImage):
+
+2009-10-06  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+        
+        HTMLInputElement::max and min are not defined for COM because they
+        conflict with the standard min() and max() macros.
+
+        Tests: fast/forms/ValidityState-rangeOverflow-number.html
+               fast/forms/ValidityState-rangeOverflow-range.html
+               fast/forms/ValidityState-rangeUnderflow-number.html
+               fast/forms/ValidityState-rangeUnderflow-range.html
+               fast/forms/input-minmax.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::rangeMinimum):
+        (WebCore::HTMLInputElement::rangeMaximum):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move m_openedByDOM to Page
+        https://bugs.webkit.org/show_bug.cgi?id=30109
+
+        We only need one instance of m_openedByDOM per page, we should move it
+        to a page-scoped object.  Notice that it's only ever touched for the
+        main frame.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::openedByDOM):
+        (WebCore::Page::setOpenedByDOM):
+        * page/Page.h:
+
+2009-10-06  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Some functions in GraphicsContext do not work
+        as expected if the associated painter has no clipping.
+        https://bugs.webkit.org/show_bug.cgi?id=29691
+
+        No new tests are associated with this because DumpRenderTree
+        always sets clipping on the painter, thus it would never hit 
+        the test case, but fast/box-shadow/basic-shadows.html is a
+        good example of what happens if the clipping is not set by
+        the user of QtWebKit.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        Fixed to handle the case that there is no clipping
+        before the call.
+
+2009-10-06  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30131, make beforeload fire on script elements.
+
+        Added tests in fast/dom/beforeload/.
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::requestScript):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * html/HTMLAttributeNames.in:
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        (WebCore::HTMLScriptElement::dispatchBeforeLoadEvent):
+        * html/HTMLScriptElement.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchBeforeLoadEvent):
+        * svg/SVGScriptElement.h:
+
+2009-10-06  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25526
+        [Gtk] Additional support is needed for caret browsing
+
+        Enable caret movement commands also when caret browsing setting is
+        enabled.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::caretBrowsingEnabled):
+        (WebCore::enabledVisibleSelectionOrCaretBrowsing):
+        (WebCore::enabledInEditableTextOrCaretBrowsing):
+        (WebCore::CommandEntry::):
+        * manual-tests/gtk/caret-browsing.html: Added.
+
+2009-10-06  Anton Muhin  <antonm@chromium>
+
+        Reviewed by Dimitri Glazkov.
+
+        Non standard, but popular exetension allows automagically
+        turn a function into a namespace resolver.  Support that in
+        Chromium as well.
+
+        Adjust CodeGeneratorV8 to treat XPathNSResolver in a special way.
+        https://bugs.webkit.org/show_bug.cgi?id=30128
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getXPathNSResolver):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: close inspector client view on
+        InspectorController::close API call.
+
+        In order to run batch web inspector layout tests (and not affect
+        subsequent tests) we should close inspector client's view upon
+        InspectorController::close API call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30009
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::close):
+
+2009-10-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the Qt/Windows build by stubbing out the still image
+        support for halted plugins for the Qt build.
+
+        Bugzilla entry https://bugs.webkit.org/show_bug.cgi?id=30130
+        tracks removing this by implementing Frame::nodeImage().
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Change QImageReader usage in ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Replace the ReadContext with another appoach to
+        reading the image. Attempt to only read meta information
+        like the image size and number of frames (for animations)
+        first and then when the page is getting drawn decode
+        the image with the QImageReader.
+
+        This is a huge benefit on pages with many images and saves
+        ~2GB of memory on the szeged image test page.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::repetitionCount):
+        (WebCore::ImageDecoderQt::filenameExtension):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        (WebCore::ImageDecoderQt::internalDecodeSize):
+        (WebCore::ImageDecoderQt::internalReadImage):
+        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
+        (WebCore::ImageDecoderQt::forceLoadEverything):
+        (WebCore::ImageDecoderQt::failRead):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make use of RGBA32Buffer in ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Use the RGBA32Buffer instead of the internal ImageData
+        to be able to use support of the base class, optionally
+        support WebCore decoders for Qt and most importantly
+        separate metadata and image data for better cache control.
+
+        Remove ImageSourceQt as everything is now shared with
+        the normal ImageSource.
+
+        Change the ownership of the NativeImagePtr/QPixmap in
+        ImageQt.cpp to delete the m_frame to be subject to cache
+        control.
+
+        * WebCore.pro:
+        * platform/graphics/ImageSource.cpp:
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp: Removed.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::decodedImage):
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp: Added.
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::setDecodedImage):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] ImageDecoderQt avoid QString creation.
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Avoid going from CString to QString to String
+        and go directly from CString to String. Also
+        avoid going to lower case to avoid an extra
+        memory allocation.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Cleanup the ImageDecoder of Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Remove the various enums for partial load. The fact is
+        that this image decoder will decode everything that is
+        in the file at once. Make it look like it behaves to
+        ease fixing this core problem.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageData::ImageData):
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::hasFirstImageHeader):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Reimplement instead of overload frameCount in ImageDecoderQt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Reimplement frameCount instead of overloading it.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameCount):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QImageReader does not support progressive reading
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Change the ImageDecoderQt::setData to store the encoded
+        data in ImageDecoder.
+
+        Only call ReadContext when the whole Resource has been
+        loaded to avoid needless calls to reset and the
+        ReadContext as progressive loading is not supported.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove dead code from ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Remove unused variables and debugging code. The debug
+        code has never been used and does not provide anything
+        useful.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::repetitionCount):
+        (WebCore::ImageDecoderQt::filenameExtension):
+        (WebCore::ImageDecoderQt::imageAtIndex):
+
+2009-10-06  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] segfault when calling gst_video_format_parse_caps in the video sink
+        https://bugs.webkit.org/show_bug.cgi?id=30120
+
+        Fix use of gst_video_format_parse_caps()
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Update mediaControls CSS
+
+        * css/mediaControlsQt.css:
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Get rid of Preferences.ignoreWhitespace.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30092
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent):
+        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.update):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.onpopulate):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.isCaretAtEndOfPrompt):
+        * inspector/front-end/inspector.js:
+        * inspector/front-end/utilities.js:
+        (Node.prototype.rangeOfWord):
+        (traverseNextNode):
+        (traversePreviousNode):
+        (onlyTextChild):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not call nodeTitleInfo twice +
+        followup fixes for r49101.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30087
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Enable painting on printer.
+
+        The print preview dialog crashed because the depth of the drawable
+        changed owing to a bug in Qt - if you draw onto a 32-bit pixmap,
+        and set a 24-bit pixmap as source, it will convert the source to
+        32-bit.
+
+        1210fa5b2d65895ad2be1f9ca7cae586e3b29dc1 is the bug fix in Qt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Make painting and events work when page is zoomed.
+
+        The element gets resized when zoomed. So, we have to make sure that we resize
+        the drawable and do a setwindow call. Multiple calls to setwindow do not
+        crash plugin in windowless mode (unlike in windowed mode).
+
+        For mouse events we have to convert the pos to post-zoom position.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Add PluginQuirkRequiresDefaultScreenDepth quirk for Flash.
+
+        Flash does not use the visual provided by us to draw into the drawable.
+        It instead uses the system default visual (as returned by XDefaultVisual).
+        This means that if the screen default visual is 24-bit, Flash won't be
+        able to draw on 32-bit drawable created by us. This is a bug in Flash
+        and for the moment, the above quirk is only set for Flash.
+
+        Our strategy to create the drawable:
+        1. Create a 32-bit drawable if the default screen depth is 32 or the
+        quirk is not set (i.e not flash)
+        2. If we didn't create a 32-bit drawable (maybe the Display has no such
+        visual), we create a drawable with default screen depth.
+
+        As a result of the above changes, content propagation behavior changes as:
+        1. Content propagation is possible only if the drawable we create and
+        Qt's backing store are of the same depth.
+        2. If we created a 32-bit drawable, there is no need for content
+        propagation (Qt will take care of it).
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        * plugins/PluginQuirkSet.h:
+        (WebCore::):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::getVisualAndColormap):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Qt build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=29362.
+
+        In Qt 4.5, a new function QPainter::fillRect(QRect, QColor) is
+        introduced to avoid the expensive construction of QBrush.
+        By casting WebCore::Color to QColor, we can compile on Qt 4.4
+        and use optimization for solid color fill in Qt 4.5.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::drawBorderlessRectShadow):
+
+2009-10-05  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Eric Carlson.
+
+        Allow the platform media player to know the <video> poster URL.
+        Add MediaPlayerPrivate::prepareToPlay() to support media engines
+        that do not buffer video data automatically. This method allows
+        such media engines to start the buffering just before starting
+        playback.
+        https://bugs.webkit.org/show_bug.cgi?id=29133
+
+        All platforms that currently implement <video> return false
+        in MediaPlayerPrivate::canLoadPoster() and do nothing in
+        MediaPlayerPrivate::prepareToPlay() their behavior is
+        unchanged. The current set of media test should then be
+        sufficient to guarantee that this patch does not break anything.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource):
+        After the MediaPlayer is created, inform it what the poster URL is.
+        (WebCore::HTMLMediaElement::updatePlayState):
+        Add another case where prepareToPlay is called for the platforms
+        that do not buffer video content automatically.
+        (WebCore::HTMLMediaElement::couldPlayIfEnoughData)
+        Same as potentiallyPlaying, except that we don't check for
+        the readyState being at least HAVE_FUTURE_DATA.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::canLoadPoster):
+        Empty implementation for the NullMediaPlayerPrivate.
+        (WebCore::NullMediaPlayerPrivate::setPoster):
+        Empty implementation for the NullMediaPlayerPrivate.
+        (WebCore::MediaPlayer::canLoadPoster):
+        Proxy to the m_private.
+        (WebCore::MediaPlayer::setPoster):
+        Proxy to m_private.
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::canLoadPoster):
+        (WebCore::MediaPlayerPrivateInterface::setPoster):
+        Add new methods that allow the platform player to receive the poster URL.
+        (WebCore::MediaPlayerPrivateInterface::prepareToPlay):
+        Notifies the media engine that playback should start. The media engine
+        should start preparing (e.g. by initializing the player and starting to buffer)
+        and call back when the state is changed to HAVE_FUTURE_DATA.
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        StringImpl needs a method to get an instance for another thread which doesn't copy the underlying buffer.
+        https://bugs.webkit.org/show_bug.cgi?id=30095
+
+        All String::copy methods were changed to call either threadsafeCopy or crossThreadString. The method
+        call was made threadsafeCopy unless I could show that threadsafety wasn't needed.
+
+        No visible change in functionality so no new tests.
+
+        * dom/MessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        (WebCore::IconDatabase::iconForPageURL):
+        (WebCore::IconDatabase::iconURLForPageURL):
+        (WebCore::IconDatabase::retainIconForPageURL):
+        (WebCore::IconDatabase::releaseIconForPageURL):
+        (WebCore::IconDatabase::setIconDataForIconURL):
+        (WebCore::IconDatabase::setIconURLForPageURL):
+        (WebCore::IconDatabase::databasePath):
+        (WebCore::IconDatabase::defaultDatabaseFilename):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin): Since this is used by SecurityOrigin::threadsafeCopy,
+        it makes threadsafe calls.
+        (WebCore::SecurityOrigin::threadsafeCopy): The only place that called this
+        needed a threadsafe method.
+        * page/SecurityOrigin.h:
+        * platform/CrossThreadCopier.cpp:
+        (WebCore::::copy):
+        * platform/KURL.cpp:
+        (WebCore::KURL::copy):
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::copyData):
+        * platform/network/ResourceErrorBase.cpp:
+        (WebCore::ResourceErrorBase::copy):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::copyData):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::copyData):
+        * platform/sql/SQLValue.cpp:
+        (WebCore::SQLValue::SQLValue):
+        (WebCore::SQLValue::string):
+        * platform/sql/SQLValue.h:
+        (WebCore::SQLValue::SQLValue):
+        All constructors now initialize the m_number which is a double. Failure to
+        do so can result in unexpected crashes when it is copied in the copy constructor.
+        See http://blogs.msdn.com/oldnewthing/archive/2008/07/02/8679191.aspx, I was that colleague.
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::threadsafeCopy):
+        (WebCore::String::crossThreadString):
+        * platform/text/StringImpl.cpp:
+        Removed StringImpl::substringCopy which was no longer being used anywhere.
+        (WebCore::StringImpl::threadsafeCopy): Changed the name to indicate that
+        it is threadsafe.
+        (WebCore::StringImpl::crossThreadString): The way to get strings for
+        another thread which is not threadsafe. This shares the underlying buffer
+        with both strings and gives them a way to do threadsafe refcounting for it.
+        * platform/text/StringImpl.h:
+        * storage/ChangeVersionWrapper.cpp:
+        (WebCore::ChangeVersionWrapper::ChangeVersionWrapper):
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap):
+        (WebCore::Database::Database):
+        (WebCore::Database::getVersionFromDatabase):
+        (WebCore::Database::setVersionInDatabase):
+        (WebCore::Database::version):
+        (WebCore::Database::setExpectedVersion):
+        (WebCore::Database::securityOriginCopy):
+        (WebCore::Database::stringIdentifier):
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::scheduleNotifyDatabaseChanged):
+        * storage/OriginQuotaManager.cpp:
+        (WebCore::OriginQuotaManager::addDatabase):
+        * storage/SQLError.h:
+        (WebCore::SQLError::message):
+        (WebCore::SQLError::SQLError):
+        * storage/SQLStatement.cpp:
+        (WebCore::SQLStatement::SQLStatement):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::syncTimerFired):
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::importItem):
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::url): Do the copy of the url in a way that is threadsafe.
+        (WebCore::SharedWorkerProxy::name):
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::DefaultSharedWorkerRepository::getProxy): Do the copy of the url in a way that is threadsafe.
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::Task::Task):
+        (WebCore::WorkerRunLoop::postTaskForMode):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Use X Pixmap instead of QPixmap.
+
+        This has the following advantages:
+        1. Allows more sharing of code between gtk and Qt ports in the future
+        2. QPixmap creates 24-bit by default. We have to later 'upgrade' it to 32-bit.
+        3. QPixmap may sometime change depth behind our back! This will require us to
+        update the plugin about the new visual and colormap.
+        4. We cannot ensure that QPixmap is backed by a X Drawable. For example, with
+        -graphicssystem raster, QPixmap uses the raster (image) backend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add support for windowless NPAPI plugins
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect):
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::setSharedXEventFields):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::setXKeyEventSpecificFields):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::inputEventState):
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::handleFocusInEvent):
+        (WebCore::PluginView::handleFocusOutEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::getPluginDisplay):
+        (WebCore::PluginView::platformStart):
+
+2009-10-05  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Filters do not support source images besides "sourceGraphic"
+        [https://bugs.webkit.org/show_bug.cgi?id=6022]
+
+        Add support for SourceAlpha to SVG filters.
+
+        Test: svg/filters/sourceAlpha.svg
+
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::calculateEffectRect):
+        (WebCore::SourceAlpha::apply):
+        * platform/graphics/filters/SourceAlpha.h:
+
+2009-10-05  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix reliablity bot crash in DateExtension.
+        https://bugs.webkit.org/show_bug.cgi?id=30033
+
+        There were a few problems using the weak persistent pointers because no one else had a
+        handle to them.  The new approach stores them as a hidden value on the Date constructor.
+
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep):
+        (WebCore::DateExtension::GetNativeFunction):
+        (WebCore::DateExtension::Setup):
+        (WebCore::DateExtension::OnSleepDetected):
+        * bindings/v8/DateExtension.h:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore::V8HiddenPropertyName::sleepFunction):
+        * bindings/v8/V8HiddenPropertyName.h:
+
+2009-10-05  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash when trying to load a null stylesheet for a site specific hack. 
+        https://bugs.webkit.org/show_bug.cgi?id=30105
+
+        Created a testcase and tested in browser.  DRT doesn't test
+        site specific hacks.
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+
+2009-10-05  James Robinson  <jamesr@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix forward declaration (struct vs class mismatch)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30094
+
+        * loader/RedirectScheduler.h:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, last Chromium build fix corresponding to revision 49113.
+        Add include for BeforeLoadEvent to DOMObjectsInclude.h.
+
+        * bindings/v8/DOMObjectsInclude.h:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Windows build.
+
+        * html/HTMLMediaElement.cpp:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the build: MediaControllerThemeQT was renamed to MediaControllerThemeQuickTime.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+
+2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
+
+        Reviewed by Simon Fraser
+        
+        Support fullscreen in MediaPlayer (Mac)
+        https://bugs.webkit.org/show_bug.cgi?id=26742
+
+        Add a fullscreen button to the <video> controller if the media engine,
+        and the theme have support for fullscreen, and can show appropriate controls.
+        Clicking the button calls through the ChromeClient to the WebVideoFullscreenController
+        in WebKit to do a nice animation to fullscreen, with a custom controller.
+
+        * DerivedSources.make:
+        * WebCore.Video.exp: Added.
+        New export file for when VIDEO is enabled.
+        
+        * WebCore.base.exp: Export WebCore::HTMLNames::videoTag
+        * WebCore.xcodeproj/project.pbxproj: New files
+        
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement):
+        (WebCore::HTMLMediaElement::willRemove):
+        (WebCore::HTMLMediaElement::screenRect):
+        (WebCore::HTMLMediaElement::enterFullscreen):
+        (WebCore::HTMLMediaElement::exitFullscreen):
+        (WebCore::HTMLMediaElement::platformMedia):
+        Add fullscreen logic. platformMedia returns a pointer to platform-specific playback data
+        used for fullscreen.
+        
+        * html/HTMLVideoElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::supportsFullscreen): Check with both the player and the ChromeClient
+        to see if it's possile to enter fullscreen for this element.
+        
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::supportsFullscreenForNode):
+        (WebCore::ChromeClient::enterFullscreenForNode):
+        (WebCore::ChromeClient::exitFullscreenForNode):
+        New methods
+        
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayer::platformMedia):
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::platformMedia):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        New methods to return platform-specific playback data for fullscreen.
+        
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlFullscreenButtonElement::defaultEventHandler):
+        Hook up the fullscreen button.
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+        Allow the RenderThemeMac to make a decision about the availability of fullscreen based
+        on the QuickTime version, since this affects what controls are availabl.e
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Export a few more methods from Settings.h
+        
+        Rubberstamped by Jon Honeycutt.
+        
+        * WebCore.base.exp:
+
+2009-10-05  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        1-char fix for obviously reverse condition.
+        https://bugs.webkit.org/show_bug.cgi?id=30100
+        No test since the only difference is a timing of GC.
+
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::clear): Revert condition. Almost a typo.
+
+2009-09-30  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Update platform-specific #ifdefs in GraphicsContext3D.h for the
+        Chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=29936
+
+        * platform/graphics/GraphicsContext3D.h:
+        Changed #if PLATFORM(SKIA) to #if PLATFORM(CHROMIUM).
+
+2009-10-05  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r47440): Inserting text in the middle of content in a scrolled textfield results in painting bugs
+        <rdar://problem/7269108>
+        https://bugs.webkit.org/show_bug.cgi?id=29982
+
+        Test: fast/repaint/line-in-scrolled-clipped-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock): Use the unclipped overflow rect
+        (including layout overflow) for the repaint rect calculation.
+
+2009-10-05  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Chromium wants to turn off SharedWorkers at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=29757
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::sharedWorker):
+        Now returns jsUndefined if isAvailable() returns false, to allow SharedWorkers to be disabled at runtime.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerRepository::isAvailable):
+        Made SharedWorkers available by default.
+        * workers/SharedWorkerRepository.h:
+        Added definition for SharedWorkerRepository::isAvailable().
+
+2009-10-05  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        A super quick fix for Bug 28710.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28710
+
+        This change just resets the style sent to addStyleMarkup() to avoid an assertion error
+        and creates an empty style when computedStyleAtPosition is 0 to avoid a crash.
+        (This change is nothing but a better-than-crash change.)
+
+        Tests: editing/selection/select-crash-001.html
+               editing/selection/select-crash-002.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::editingStyleAtPosition): Resets the style sent to addStyleMarkup() if it is not valid.
+        * editing/markup.cpp:
+        (WebCore::createMarkup): Creates an empty style if computedStyleAtPosition is 0.
+
+2009-10-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Silence duplicate errors logged for missing getComputedStyle
+        implementations. Improves the error message as well.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::logUnimplementedPropertyID):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix #3.  Add V8BeforeLoadEvent.[cc|h] to derived sources.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+
+2009-10-05  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the GTK build.
+
+        * GNUmakefile.am:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix #2.  Add new BEFORELOADEVENT to V8ClassIndex.
+
+        * bindings/v8/V8Index.h:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix.  Missing "," after entry for BeforeLoadEvent.idl. 
+
+        * WebCore.gypi:
+
+2009-10-05  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a beforeload event that will be fired before subresources load. (It isn't fired yet.)  The event
+        has one field, the URL that is going to be requested.  Setting preventDefault will stop the load
+        from occurring.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/BeforeLoadEvent.h: Added.
+        (WebCore::BeforeLoadEvent::create):
+        (WebCore::BeforeLoadEvent::initBeforeLoadEvent):
+        (WebCore::BeforeLoadEvent::url):
+        (WebCore::BeforeLoadEvent::BeforeLoadEvent):
+        * dom/BeforeLoadEvent.idl: Added.
+        * dom/EventNames.h:
+        * page/DOMWindow.idl:
+
+2009-10-05  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Add Gentoo-specific paths for searching browser plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=30088
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::defaultPluginDirectories):
+
+2009-10-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Add functionality to pause/throttle CSS transitions/animations in a WebView
+        https://bugs.webkit.org/show_bug.cgi?id=29942
+
+        Exporting call from AnimationController
+
+        * WebCore.base.exp:
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Rubberstamped by Anders Carlsson.
+        
+        * WebCore.base.exp: Update export of HaltablePlugin/PluginHalterClient.
+        * WebCore.xcodeproj/project.pbxproj: Likewise.
+
+2009-10-05  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r49104.
+        http://trac.webkit.org/changeset/49104
+
+        * html/HTMLInputElement.cpp:
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Update style immediately when validation-related values are updated.
+        https://bugs.webkit.org/show_bug.cgi?id=28868
+
+        In order to apply :valid, :invalid, :optional or :required lively,
+          - call setNeedsStyleRecalc() when properties which can change
+            willValidate state are updated, and
+             (Parent form element, name, disabled, readonly)
+          - call updateValidity() when properties which can change validity
+            state are updated. (value, pattern, required)
+
+        Tests: fast/forms/input-live-pseudo-selectors.html
+               fast/forms/textarea-live-pseudo-selectors.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        (WebCore::HTMLFormControlElement::required):
+        (WebCore::HTMLFormControlElement::updateValidity):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setValue):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+
+        Tests: fast/forms/ValidityState-rangeOverflow-number.html
+               fast/forms/ValidityState-rangeOverflow-range.html
+               fast/forms/ValidityState-rangeUnderflow-number.html
+               fast/forms/ValidityState-rangeUnderflow-range.html
+               fast/forms/input-minmax.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::rangeMinimum):
+        (WebCore::HTMLInputElement::rangeMaximum):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduces
+         - new CSS pseudo selector: "-webkit-input-list-button"
+         - new CSS apperance type: "list-button"
+         - new ControlPart value: "ListButtonPart"
+        for the UI of the list attribute of the input element, and adds
+        implementation to draw ListButtonPart on Mac.
+        The code is guarded by ENABLE(DATALIST).
+
+        https://bugs.webkit.org/show_bug.cgi?id=27794
+
+        Test: platform/mac/fast/forms/input-list-button-size.html
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * css/CSSValueKeywords.in:
+        * css/html.css:
+        * html/HTMLInputElement.cpp:
+        * platform/ThemeTypes.h:
+        (WebCore::):
+        * platform/mac/ThemeMac.mm:
+        (WebCore::listButtonSizes):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeMac::controlSize):
+        (WebCore::ThemeMac::minimumControlSize):
+        (WebCore::ThemeMac::controlBorder):
+        (WebCore::ThemeMac::paint):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::paintBorderOnly):
+        (WebCore::RenderTheme::paintDecorations):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustRepaintRect):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-10-05  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30065>
+        nodeTitleInfo should be placed in ElementsTreeOutline.
+        
+        Move nodeTitleInfo into ElementsTreeOutline.js from utilities.js.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
+        * inspector/front-end/utilities.js:
+
+2009-10-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Inform the application when a new request is created
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        Emit a signal each time a request is created, with the request and the frame
+        that created it.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-10-05  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        Add an ASSERT in updateGuidVersionMap.
+        https://bugs.webkit.org/show_bug.cgi?id=30077
+
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap): ASSERT that the guidMutex() is locked.
+
+2009-10-05  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow V8 to throw an exception in _NPN_SetException without worrying about context
+        if we don't have enough information to find the correct context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30026
+
+        Part of the fix for Chromium's failure of LayouTests/plugins/netscape-throw-exception.html.
+
+        * bindings/v8/NPV8Object.cpp: 
+        (_NPN_SetException): Don't suppress the exception if we can't find the relevant context.
+
+2009-10-05  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Place "Close" button in docked mode on the same side as the window "Close" button in detached mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29961
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-10-05  J-P Nurmi  <jpnurmi@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Added pure virtual QWebPageClient::pluginParent()
+
+        https://bugs.webkit.org/show_bug.cgi?id=29710
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-05  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] windowsKeyCodeForKeyEvent() returns a wrong value for the F10 key.
+        https://bugs.webkit.org/show_bug.cgi?id=30042
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-10-05  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix for ENABLE(WEB_SOCKETS) and v8.
+
+        V8ObjectEventListener.h has been removed at r48978
+
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+
+2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector console stops working while JS in IFRAME is paused.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29958
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce inspected object groups for console
+        and watch evaluation results so that they could be released
+        explicitly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29891
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::wrapObject):
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::wrapObject):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        (WebCore::InspectorController::releaseWrapperObjectGroup):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.evaluateInCallFrame):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSection.prototype.update):
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Move mediaControls extras for the Qt port into WebCore/css like other ports
+
+        https://bugs.webkit.org/show_bug.cgi?id=30013
+
+        * WebCore.pro:
+        * WebCore.qrc:
+        * css/mediaControlsQt.css: Renamed from WebCore/css/qt/mediaControls-extras.css.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::extraMediaControlsStyleSheet):
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Rename WebCore/css/mediaControlsQT.css and MediaControllerThemeQT
+
+        https://bugs.webkit.org/show_bug.cgi?id=30013
+
+        The QT suffix has been expanded to QuickTime, to not cause confusion
+        and name-crashes with similar files in the Qt port.
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/mediaControlsQuickTime.css: Renamed from WebCore/css/mediaControlsQT.css.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::):
+        (WebCore::mediaControllerTheme):
+        (WebCore::RenderThemeMac::adjustSliderThumbSize):
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeMac::extraMediaControlsStyleSheet):
+
+2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30064>
+        Syntax Highlighting CSS shouldn't be duplicated.
+
+        Refactor syntax highlighting CSS into a new file, add it to the
+        projects, and have SourceFrame.js and inspector.html include the
+        new CSS file.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspectorSyntaxHighlight.css: Added.
+        * inspector/front-end/WebKit.qrc:
+
+2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30062>
+        Inspector should syntax highlight JS/CSS in elements view.
+
+        Add syntax highlighting of CSS and JavaScript tags to the elements panel.
+        Copied CSS rules from SourceFrame.js to inspector.css, and have the text nodes
+        in utilities.js call the CSS or JS Syntax highlighters if their parent is a script
+        or style tag.
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/utilities.js:
+
+2009-10-04  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Enable Web Sockets in chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=29917
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustova Noronha.
+
+        [GTK] performs a POST when refreshing a view that was obtained with a GET
+        https://bugs.webkit.org/show_bug.cgi?id=29761
+
+        Update the HTTP method in the request stored by willSendRequest
+        after a redirect, since it could have changed.
+
+        Test: http/tests/navigation/postredirect-reload.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Revert previous patch, as the newly added test breaks other tests.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustova Noronha.
+
+        [GTK] performs a POST when refreshing a view that was obtained with a GET
+        https://bugs.webkit.org/show_bug.cgi?id=29761
+
+        Update the HTTP method in the request stored by willSendRequest
+        after a redirect, since it could have changed.
+
+        Test: http/tests/navigation/postredirect-reload.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Fixed Function leak in V8LazyEventListener.
+        (Should fix the remaning leak in
+        https://bugs.webkit.org/show_bug.cgi?id=29093).
+        V8LazyEventListeners used to create FunctionTemplates for each
+        wrapped listener which in turn created Functions that were cached
+        forever in V8 Context. Now there is at most one such Function per
+        Context.
+        https://bugs.webkit.org/show_bug.cgi?id=30060
+
+        Added new hidden property name to store toString result:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        * bindings/v8/V8HiddenPropertyName.h:
+
+        Switched to static FunctionTemplate:
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListenerToString):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        CSS Source View Should be Syntax Highlighted
+        https://bugs.webkit.org/show_bug.cgi?id=14359
+
+          Support for WebKit's CSS Variables @variables and var()
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.CSSSourceSyntaxHighligher):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector should remember preferences for docked/undocked etc
+        https://bugs.webkit.org/show_bug.cgi?id=29089
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources): toggle the preference
+        * inspector/front-end/inspector.js:
+        (WebInspector._loadPreferences): factored out loading preferences
+        (WebInspector.loaded):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        CSS Source View Should be Syntax Highlighted
+        https://bugs.webkit.org/show_bug.cgi?id=14359
+
+          Trigger the Syntax Highlighter for CSS files.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.syntaxHighlightJavascript):
+        (WebInspector.SourceFrame.prototype.syntaxHighlightCSS):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._contentLoaded):
+
+          Factored out the Syntax Highlighting procedure into a "Class"
+          Added CSSSourceSyntaxHighlighter and JavaScriptSourceSyntaxHighlighter
+
+        (WebInspector.SourceSyntaxHighligher):
+        (WebInspector.SourceSyntaxHighligher.prototype.createSpan):
+        (WebInspector.SourceSyntaxHighligher.prototype.process.processChunk):
+        (WebInspector.SourceSyntaxHighligher.prototype.process):
+        (WebInspector.CSSSourceSyntaxHighligher): the CSS Highlighter
+        (WebInspector.JavaScriptSourceSyntaxHighligher): the JS Highlighter
+
+2009-10-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Factor back-forward list methods out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30037
+
+        This change moves these back-forward related methods from FrameLoader
+        to Page.  It's possible we should move these methods into some kind of
+        "page controller" object, but we can figure that out in a future patch.
+
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close):
+        * page/History.cpp:
+        (WebCore::History::length):
+        * page/Page.cpp:
+        (WebCore::Page::canGoBackOrForward):
+        (WebCore::Page::goBackOrForward):
+        (WebCore::Page::getHistoryLength):
+        * page/Page.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: prepare InspectorController for being used from layout tests.
+        This change adds evaluateForTestInFrontend method with the callback that
+        allows evaluating arbitrary code in the frontend context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30008
+
+        * WebCore.Inspector.exp:
+        * WebCore.order:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::didEvaluateForTestInFrontend):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+        (WebCore::InspectorController::didEvaluateForTestInFrontend):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Node search mode is not getting reset on element selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30016
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30036>
+        Should be able to resize Cookie Columns.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.resize):
+
+2009-09-25  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Make WebCore::PluginView participate in plug-in halting.
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/BitmapImage.h:
+        Declare a create() function that takes an HBITMAP.
+
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::create):
+        Use GetObject() to fill out a DIBSECTION structure for the given
+        HBITMAP. Call CGBitmapContextCreate() to create a CG context from the
+        bits of the bitmap. Create a CG image from the context, and pass this
+        when creating a new BitmapImage.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        If we successfully started, tell our parent frame's Page.
+        (WebCore::PluginView::stop):
+        Tell our parent frame's Page that we stopped.
+        (WebCore::PluginView::node):
+
+        * plugins/PluginView.h:
+        Inherit from HaltablePlugin.
+        (WebCore::PluginView::setPlatformPluginWidget):
+        On platforms where the platform plug-in widget is the WebCore::Widget's
+        platform widget, have setPlatformPluginWidget() call
+        setPlatformWidget().
+
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::platformDestroy):
+        After destroying the window, set the platform plug-in widget to 0 to
+        ensure that Widget isn't holding a stale handle.
+        (WebCore::PluginView::halt):
+        Have our element's RenderWidget display a screenshot of the plug-in,
+        then stop the plug-in and destroy it.
+        (WebCore::PluginView::restart):
+        Clear the RenderWidget's substitute image, then start the plug-in.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::showSubstituteImage):
+        Set m_substituteImage to the passed image, and repaint.
+        (WebCore::RenderWidget::paint):
+        If we have a substitute image, paint that instead of allowing the
+        widget to paint itself.
+
+        * rendering/RenderWidget.h:
+        Declare showSubstituteImage(). Added a member to store the substitute
+        image.
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move PolicyCheck out of FrameLoader.{h,cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=30035
+
+        Purely code motion (and adding a destructor).
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/PolicyCheck.cpp:
+        * loader/PolicyCheck.h:
+
+2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Add NPNVToolkit value quirk in plugins for nspluginwrapper.
+        Plugin error message was:
+        ERROR: failed to initialize brower-side RPC events listener
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        (WebCore::staticPluginQuirkRequiresGtkToolKit_NPN_GetValue):
+        (WebCore::PluginPackage::load):
+
+2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] X sync our XEmbed container window creation before sending the
+        xid to plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Setting zero size on a container of a video element doesn't hide the controller
+        https://bugs.webkit.org/show_bug.cgi?id=30031
+        
+        Fix a logic error in enclosingCompositingLayer() when mixing normal flow and 
+        positioned layers. This resulted in enclosingCompositingLayer() giving back a different
+        answer to the logic used to actually parent compositing layers, so layer positions
+        and layer hierarchy would be out of agreement.
+        
+        Test: compositing/geometry/clipped-video-controller.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::compositingContainer):
+        (WebCore::RenderLayer::enclosingCompositingLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::setCompositingParent):
+
+2009-10-02  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Move the following methods of HTMLInputElement and HTMLTextAreaElement
+          to HTMLTextFormControlElement.
+           setSelectionStart()
+           setSelectionEnd()
+           select()
+           setSelectionRange()
+           selectionStart()
+           selectionEnd()
+           selection()
+
+        - Introduce cachedSelectionStart() and cachedSelectionEnd().
+
+        - Unify HTMLInputElement::isTextFieldWithRenderer() and
+         HTMLTextAreaElement::rendererAfterUpdateLayout() into textRendererAfterUpdateLayout().
+        
+        - Unify a part of parseMappedAttribute() of HTMLInputElement and HTMLTextAreaElement.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29782
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::textRendererAfterUpdateLayout):
+        (WebCore::HTMLTextFormControlElement::setSelectionStart):
+        (WebCore::HTMLTextFormControlElement::setSelectionEnd):
+        (WebCore::HTMLTextFormControlElement::select):
+        (WebCore::HTMLTextFormControlElement::setSelectionRange):
+        (WebCore::HTMLTextFormControlElement::selectionStart):
+        (WebCore::HTMLTextFormControlElement::selectionEnd):
+        (WebCore::HTMLTextFormControlElement::selection):
+        (WebCore::HTMLTextFormControlElement::parseMappedAttribute):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::select):
+        (WebCore::HTMLInputElement::cachedSelectionStart):
+        (WebCore::HTMLInputElement::cachedSelectionEnd):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::cachedSelectionStart):
+        (WebCore::HTMLTextAreaElement::cachedSelectionEnd):
+
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Disconnect event listeners on navigation.
+        Fixes http://crbug.com/23597.
+        https://bugs.webkit.org/show_bug.cgi?id=30027
+
+        Added V8ListenerGuard that is shared by listeners and proxy. On
+        navigation proxy sets a flag in the guard turning off listeners.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8ListenerGuard::create):
+        (WebCore::V8ListenerGuard::isDisconnected):
+        (WebCore::V8ListenerGuard::disconnectListeners):
+        (WebCore::V8ListenerGuard::V8ListenerGuard):
+        (WebCore::V8AbstractEventListener::disconnected):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::disconnectEventListeners):
+        (WebCore::V8Proxy::clearForNavigation):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::listenerGuard):
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create):
+
+2009-10-02  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [chromium] Fix WebGL build after CustomGetter constructor changes
+        https://bugs.webkit.org/show_bug.cgi?id=30020
+
+        * page/DOMWindow.idl:
+        Changed CustomGetter to JSCCustomGetter for CanvasArray constructors.
+
+2009-10-02  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: text in a "Request Payload" section disappears on selection
+        https://bugs.webkit.org/show_bug.cgi?id=29967
+
+        No new tests.
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshRequestPayload):
+
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Recursion guard for V8Proxy::callFunction.
+        Fixes http://crbug.com/23278.
+        https://bugs.webkit.org/show_bug.cgi?id=29974
+
+        Test: fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::callFunction):
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix test breakages by adding null checks, and putting inspector code in
+        ENABLE(INSPECTOR).
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent):
+
+2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Clean up the QNetworkReplyHandler to only apply HTTP headers
+        for protocols in the HTTP family.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Move error check into sendResponseIfNeeded() as suggested
+        by Eric Seidel. Also, remove some dead code.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-10-02  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Assertion failure in CompositeEditCommand::moveParagraphs() and crash in Node::nodeIndex() when pasting.
+        <rdar://problem/7148712>
+        https://bugs.webkit.org/show_bug.cgi?id=28992
+
+        Test: editing/selection/replace-selection-crash.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded): Handle properly the case of
+        the destination position matching the end of the paragraph to move.
+
+2009-10-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement per-storage-area quotas for LocalStorage
+        https://bugs.webkit.org/show_bug.cgi?id=29991
+
+        I put 90% of the code in StorageMap since the decision to allow an update is
+        closely tied to quota tracking.  The quota is set via a page's Settings class.
+        Like with the local storage path and whether it's enabled, it's assumed that
+        all pages in the same group will have the same settings.  The setting defaults
+        to 5mb which is what the spec suggests, but it can easily be changed to
+        anything else--including StorageMap::noQuota.  Any values in LocalStorage are
+        grandfathered in regarudless of quota, so importItem only tracks (and will
+        never block) imports.
+
+        I believe this change is a good transition to more complex quota management.
+        For example, if we wanted to track quotas in the SQLite DB, then we'd just add
+        a function to the StorageMap that sets the quota.  This would be fine since all
+        use of LocalStorage is blocked on the import completing, so you'd never hit a
+        quota error in the mean time.  Also, if embedders wanted to ask the user
+        whether to expand the quota whenever it's hit (before deciding whether or not
+        to raise an exception), a callback via the chrome client should be fairly easy.
+        That said, I think it's best to add these features in steps rather than one
+        huge patch.  (Both of these are on my TODO list, btw.)
+
+        Included is a layout test that verifies the behavior.  It assumes the default
+        quota is 5mb (since that's what Settings defaults to).
+
+        Test: storage/domstorage/localstorage/quota.html
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::localStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setLocalStorageQuota):
+        * page/Settings.h:
+        (WebCore::Settings::localStorageQuota):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::create):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::create):
+        (WebCore::StorageMap::StorageMap):
+        (WebCore::StorageMap::copy):
+        (WebCore::StorageMap::setItem):
+        (WebCore::StorageMap::removeItem):
+        (WebCore::StorageMap::importItem):
+        * storage/StorageMap.h:
+        (WebCore::StorageMap::quota):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::localStorageNamespace):
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::localStorageNamespace):
+        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-10-02  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Database Inspector crashes Safari when table has more than 21 columns
+        https://bugs.webkit.org/show_bug.cgi?id=29924
+
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.dataGridForResult): adjust the minimum column width percentage to be flexible for many columns.
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/14370>.
+        Inspector's timeline should record when certain DOM events fired.
+        
+        This patch adds calls into the Web Inspector when the main frame
+        fires an load event, and when the document fires its DOMContent
+        event. Once these values are passed in, they are sent to the Web Inspector
+        as a timing change, and these are denoted by vertical lines in the resources
+        panel (blue for DOM Content, red for load event).
+
+        * English.lproj/localizedStrings.js: Added tooltip text.
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing): Added an Inspector callback for DOM Content.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent): Tell the main resource it got the event.
+        (WebCore::InspectorController::mainResourceFiredLoadEvent): Ditto.
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource): Added new variables.
+        (WebCore::InspectorResource::updateScriptObject): Send new variables to inspector.js.
+        (WebCore::InspectorResource::markDOMContentEventTime): Send a TimingChange event.
+        (WebCore::InspectorResource::markLoadEventTime): Ditto.
+        * inspector/InspectorResource.h:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.get mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded): Draw dividers for event timings.
+        (WebInspector.ResourceTimeCalculator.prototype.computePercentageFromEventTime):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent): Add an Inspector callback for the Load event.
+
+2009-10-02  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add support for blacklist patterns to user stylesheets and scripts in addition to whitelist patterns.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::pageGroupUserSheets):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScript):
+        (WebCore::PageGroup::addUserStyleSheet):
+        (WebCore::PageGroup::removeUserContentWithURLForWorld):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        * page/PageGroup.h:
+        * page/UserContentURLPattern.cpp:
+        (WebCore::UserContentURLPattern::matchesPatterns):
+        * page/UserContentURLPattern.h:
+        * page/UserScript.h:
+        (WebCore::UserScript::UserScript):
+        (WebCore::UserScript::whitelist):
+        (WebCore::UserScript::blacklist):
+        * page/UserStyleSheet.h:
+        (WebCore::UserStyleSheet::UserStyleSheet):
+        (WebCore::UserStyleSheet::whitelist):
+        (WebCore::UserStyleSheet::blacklist):
+
+2009-10-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Build fix when SVG is not enabled
+        https://bugs.webkit.org/show_bug.cgi?id=30011
+
+        Move TextRenderingMode related functions out from
+        the ENABLE(SVG) guard.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
+
+2009-10-02  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        WebGL crashes with recent CanvasArray change
+        https://bugs.webkit.org/show_bug.cgi?id=30018
+
+        Test: fast/canvas/webgl/array-unit-tests.html
+
+        * html/canvas/CanvasArray.cpp:
+        (WebCore::CanvasArray::CanvasArray):
+        Fix bug where PassRefPtr was tested after transferring value to RefPtr.
+
+2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=29989>
+        Safari version number shouldn't be exposed in WebKit code
+        
+        For a WebKit version of 532.3.4:
+        Product version is: 5.32.3.4 (was 4.0.3.0)
+        File version is: 5.32.3.4 (was 4.532.3.4)
+
+        * WebCore.vcproj/QTMovieWin.rc:
+
+2009-10-02  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Enable two point radial gradients in Chromium/Skia.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30017
+
+        Covered by the following tests:
+
+        LayoutTests/svg/W3C-SVG-1.1/pservers-grad-13-b.svg
+        LayoutTests/fast/backgrounds/svg-as-background-3.html
+        LayoutTests/fast/gradients/generated-gradients.html
+        LayoutTests/fast/gradients/simple-gradients.html
+
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::platformGradient):
+
+2009-10-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Conditionally guard cursor code (cursor and updateCursor functions) with !QT_NO_CURSOR.
+        Otherwise, it is inconsistent with class declaration of QCursor.
+
+        No new tests.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] missing support for anamorphic PAR video size
+        https://bugs.webkit.org/show_bug.cgi?id=29717
+
+        cleanup of caps handling in the video sink
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_set_caps):
+
+2009-10-02  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compiler warnings about unused function arguments.
+
+        * bridge/qt/qt_class.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::initializeParserContext):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::setPlatformFont):
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setURLForRect):
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::setEndTime):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
+        * platform/graphics/qt/StillImageQt.h:
+        (WebCore::StillImage::destroyDecodedData):
+        * platform/network/qt/DnsPrefetchHelper.h:
+        (WebCore::DnsPrefetchHelper::lookedUp):
+        * platform/qt/ContextMenuQt.cpp:
+        (WebCore::ContextMenu::setPlatformDescription):
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::populate):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::supportsFocusRing):
+        (WebCore::RenderThemeQt::systemFont):
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeQt::paintMediaSeekBackButton):
+        (WebCore::RenderThemeQt::paintMediaSeekForwardButton):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::platformAddChild):
+        * platform/qt/SearchPopupMenuQt.cpp:
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        * platform/qt/TemporaryLinkStubs.cpp:
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::paint):
+        * xml/XSLStyleSheetQt.cpp:
+        (WebCore::XSLStyleSheet::loadChildSheet):
+        (WebCore::XSLStyleSheet::setParentStyleSheet):
+        * xml/XSLTProcessorQt.cpp:
+        (WebCore::XSLTMessageHandler::handleMessage):
+        (WebCore::XSLTProcessor::transformToString):
+
+2009-10-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] missing support for anamorphic PAR video size
+        https://bugs.webkit.org/show_bug.cgi?id=29717
+
+        Scale the cairo surface of the video sink depending on the
+        pixel-aspect-ratio of the video buffer to paint. Also
+        destruct/re-create the surface when setSize() is called with a new
+        size.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::setSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-02  Ben Murdoch  <benm@google.com>
+
+        Reviewed by David Kilzer.
+
+        Stale database version persists through browser refresh (changeVersion doesn't work)
+        https://bugs.webkit.org/show_bug.cgi?id=27836
+
+        Tests: storage/change-version-handle-reuse.html
+               storage/change-version.html
+
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Implement the V8 binding for database.changeVersion().
+        (WebCore::createTransaction): Fix a bug that was checking the wrong argument index to save the success callback.
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap): Safely update the Guid/version hash map.
+        (WebCore::Database::~Database): Remove code that removes the database from the guid->database and guid->version maps.
+        (WebCore::Database::setVersionInDatabase): Add a comment to explain some behaviour.
+        (WebCore::Database::close): Move the code that updates the maps from the destructor to here.
+        (WebCore::Database::performOpenAndVerify): Call updateGuidVersionMap instead of setting the hash map directly.
+        (WebCore::Database::setExpectedVersion): Update the in memory guid->version map when we want to update the database version.
+
+2009-10-02  Janne Koskinen <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Partial WINSCW build fix.
+
+        Add parentheses around the function pointer declaration, similar to the
+        second hunk in r48825.
+
+        * loader/CachedResourceHandle.h:
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempted build fix by Xcode magic.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.  Actually add the new files.
+
+        * loader/RedirectScheduler.cpp: Added.
+        (WebCore::ScheduledRedirection::):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        * loader/RedirectScheduler.h: Added.
+
+2009-10-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move RedirectScheduler to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=29952
+
+        This change is purely code motion.
+
+        No behavior change.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/RedirectScheduler.cpp: Added.
+        (WebCore::ScheduledRedirection::):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        * loader/RedirectScheduler.h: Added.
+
+2009-10-02  Dave MacLachlan  <dmaclach@gmail.com>
+
+        Reviewed by David Levin.
+
+        Clean up warnings in WebCore/bindings/v8/npruntime.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=29971
+
+        Gets rid of warnings on gcc about using anonymous namespaces 
+          warning: 'StringKeyHashTraits' has a base
+          'WTF::GenericHashTraits<<unnamed>::StringKey>' 
+          whose type uses the anonymous namespace
+        and
+          warning: 'WTF::PairHashTraits<StringKeyHashTraits,
+          WTF::HashTraits<PrivateIdentifier*> >' has a base
+          'WTF::GenericHashTraits<std::pair<<unnamed>::StringKey,
+          PrivateIdentifier*> >' whose type uses the anonymous namespace
+
+        No tests required.
+
+        * bindings/v8/npruntime.cpp:
+
+2009-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Turn on ENABLE_3D_CANVAS in TOT
+        https://bugs.webkit.org/show_bug.cgi?id=29906
+
+        Fixed a bug found when running tests with flag on
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.base.exp:
+        * bindings/js/JSCanvasArrayBufferConstructor.h:
+        (WebCore::construct):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * html/canvas/CanvasArray.cpp:
+        (WebCore::CanvasArray::CanvasArray):
+        * html/canvas/CanvasByteArray.cpp:
+        (WebCore::CanvasByteArray::create):
+        * html/canvas/CanvasFloatArray.cpp:
+        (WebCore::CanvasFloatArray::create):
+        * html/canvas/CanvasIntArray.cpp:
+        (WebCore::CanvasIntArray::create):
+        * html/canvas/CanvasShortArray.cpp:
+        (WebCore::CanvasShortArray::create):
+        * html/canvas/CanvasUnsignedByteArray.cpp:
+        (WebCore::CanvasUnsignedByteArray::create):
+        * html/canvas/CanvasUnsignedIntArray.cpp:
+        (WebCore::CanvasUnsignedIntArray::create):
+        * html/canvas/CanvasUnsignedShortArray.cpp:
+        (WebCore::CanvasUnsignedShortArray::create):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setWebGLEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::webGLEnabled):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/7264725> Re-add a vendor prefix to box-
+        shadow (29927)
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29927
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::ShadowParseContext::ShadowParseContext):
+        (WebCore::ShadowParseContext::commitValue):
+        (WebCore::ShadowParseContext::commitLength):
+        (WebCore::ShadowParseContext::commitColor):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        At bad merge at some point in the development of my patch must have 
+        put TextRenderMode.h in a weird spot in the xcodeproj. Moving it 
+        back where it belongs!
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove FrameLoader::schedule* APIs
+        https://bugs.webkit.org/show_bug.cgi?id=29950
+
+        Change clients of FrameLoader::schedule* to call redirectScheduler
+        directly.
+
+        No behavior change.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::navigateIfAllowed):
+        (WebCore::JSLocation::reload):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::navigateIfAllowed):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::processHttpEquiv):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::receivedFirstData):
+        * loader/FrameLoader.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        * page/History.cpp:
+        (WebCore::History::back):
+        (WebCore::History::forward):
+        (WebCore::History::go):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Just removing a comment I accidentally committed earlier. 
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+
+2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Clean up use of const and mutable in StorageMap
+        https://bugs.webkit.org/show_bug.cgi?id=29933
+
+        What's the point of having every single member variable be mutable and nearly
+        every method be const?  Let's clean it up.
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::setIteratorToIndex):
+        (WebCore::StorageMap::key):
+        (WebCore::StorageMap::importItem):
+        * storage/StorageMap.h:
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6934421> Support CSS for Text Kerning and 
+        ligature
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=6136
+
+        This patch makes the SVG CSS property text-rendering work with any 
+        HTML, much like it does in Firefox. It accepts four possible input 
+        values: auto, optimizeSpeed, optimizeLegibility, and 
+        geometricPrecision. Right now, in this implementation, here is what 
+        those values correspond to:
+
+        auto = optimizeSpeed = what we normally when the value's not set
+        optimizeLegibility = geometricPrecision = ligatures kerning
+
+        Add new file TextRenderingMode.h to the project files.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        CSS support for the new CSSPropertyTextRendering
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+
+        All the old SVG CSS support for this property can go away. When 
+        it's used in SVG, it will just fall into the normal HTML case.
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/SVGCSSPropertyNames.in:
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+        * css/SVGCSSValueKeywords.in:
+
+        FontDescription stores the m_textRendering bit.
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::textRenderingMode):
+        (WebCore::FontDescription::setTextRenderingMode):
+        (WebCore::FontDescription::operator==):
+
+        We want to fall into the complex text rendering code path if 
+        kerning and ligatures have been enabled with this property.
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::canUseGlyphCache):
+
+        Now takes a TextRenderingMode as a parameter.
+        * platform/graphics/SimpleFontData.h:
+
+        New header for the enum.
+        * platform/graphics/TextRenderingMode.h: Added.
+        (WebCore::):
+
+        getCFStringAttributes() now takes a TextRenderingMode as an 
+        attribute.
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::collectCoreTextRunsForCharacters):
+
+        Enable kerning and ligatures whenever the TextRenderingMode is 
+        OptimizeLegibility or GeometricPrecision
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::disableLigatures):
+        (WebCore::initializeATSUStyle):
+        (WebCore::ATSULayoutParameters::initialize):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+
+        More SVG CSS stuff that isn't needed anymore since SVG will use the 
+        new HTML CSS implementation.
+        * rendering/style/SVGRenderStyle.h:
+        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
+        (WebCore::SVGRenderStyle::setBitDefaults):
+        * rendering/style/SVGRenderStyleDefs.h:
+
+2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Use isClosure property of scope proxy to decide whether the
+        scope is a closure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29965
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-10-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Odd color transitions on anchors with transition-property: all
+        https://bugs.webkit.org/show_bug.cgi?id=29911
+
+        When transitioning maybe-invalid colors, if the source and destination
+        color are both invalid, then don't animate.
+        
+        This fixes an issue where a child element of an element running a color
+        transition, with -webkit-transition-property:all, would show a color change.
+        This happened because the "maybe invalid color" logic copied the color style
+        into -webkit-text-fill-color for both endpoints, causing -webkit-text-fill-color
+        to animate while the transition ran, and to then to disappear when the transition
+        finished.
+        
+        Test: transitions/color-transition-all.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperMaybeInvalidColor::equals):
+        (WebCore::PropertyWrapperMaybeInvalidColor::blend):
+
+2009-10-01  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Allow dragging a node who has child nodes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28632
+
+        Test: fast/events/drag-parent-node.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldDragAutoNode):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] media player: better mute support
+        https://bugs.webkit.org/show_bug.cgi?id=29960
+
+        Handle volume and mute state with the two corresponding properties
+        of playbin2.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::setVolume):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] video sink pad template colorspace is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=29953
+
+        Set sink pad template colorspace depending on byte order.
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-01  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Refactored V8 event listeners:
+        (This change should fix http://crbug.com/21079 and
+        https://bugs.webkit.org/show_bug.cgi?id=29093.)
+         o All listeners use weak handles to JS objects to avoid creating
+           cycles and leaking memory.
+         o "Object" variants of listeners removed.
+         o All event accessor callbacks are generated.
+         o Custom event accessors removed.
+         o All wrappers have hidden dependencies on their listeners to
+           prevent listeners from being collected.
+         o All variats of getEventListener function grouped in V8DOMWrapper.
+         o Pointers to C+EventListener wrappers are stored in JS objects
+           instead of event listener lists.
+        https://bugs.webkit.org/show_bug.cgi?id=29825
+
+        * WebCore.gypi: Removed "Object" listeners.
+        * bindings/scripts/CodeGeneratorV8.pm: Now handles event accessors.
+        * bindings/v8/DOMObjectsInclude.h:
+
+        V8AbstractEventListener manages weak JS handle:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::weakEventListenerCallback):
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        (WebCore::V8AbstractEventListener::setListenerObject):
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::cast):
+        (WebCore::V8AbstractEventListener::isLazy):
+        (WebCore::V8AbstractEventListener::getListenerObject):
+        (WebCore::V8AbstractEventListener::getExistingListenerObject):
+        (WebCore::V8AbstractEventListener::hasExistingListenerObject):
+        (WebCore::V8AbstractEventListener::disconnectFrame):
+        (WebCore::V8AbstractEventListener::disconnected):
+        (WebCore::V8AbstractEventListener::prepareListenerObject):
+        (WebCore::V8AbstractEventListener::lineNumber):
+        (WebCore::V8AbstractEventListener::virtualisAttribute):
+
+        Grouped getEventListener functions:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8DOMWrapper.h:
+
+        Removed most event listener objects bookkeeping:
+        * bindings/v8/V8EventListenerList.cpp:
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findWrapper):
+        (WebCore::V8EventListenerList::clearWrapper):
+        (WebCore::V8EventListenerList::doFindWrapper):
+        (WebCore::V8EventListenerList::getHiddenProperty):
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+
+        Added hidden properties for storing EventListener wrappers:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore::V8HiddenPropertyName::listener):
+        (WebCore::V8HiddenPropertyName::attributeListener):
+        * bindings/v8/V8HiddenPropertyName.h:
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::isLazy):
+        * bindings/v8/V8ObjectEventListener.cpp: Removed.
+        * bindings/v8/V8ObjectEventListener.h: Removed.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::disconnectEventListeners):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        * bindings/v8/V8WorkerContextObjectEventListener.cpp: Removed.
+        * bindings/v8/V8WorkerContextObjectEventListener.h: Removed.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        (WebCore::V8EventListener::getListenerFunction):
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+
+2009-10-01  Alexis Menard  <alexis.menard@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Rename QWebGraphicsItem to QGraphicsWebView
+
+        * WebCore.pro:
+
+2009-10-01  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Read-only transactions do not change file sizes and therefore
+        should not trigger quota updates.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29945
+
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::openTransactionAndPreflight):
+        (WebCore::SQLTransaction::runStatements):
+
+2009-09-30  Timothy Hatcher  <timothy@apple.com>
+
+        Fix list box scrolling by correctly overriding the scroll()
+        function on RenderBox.
+
+        <rdar://problem/7255440> REGRESSION (r48683): Mousewheel scrolling
+        of listboxes is broken (29756)
+
+        Reviewed by Dan Bernstein.
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scroll):
+        * rendering/RenderListBox.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::scroll):
+        * rendering/RenderTextControlSingleLine.h:
+
+2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Make a copy of listeners array before dispatching an event in
+        WebInspector.Object.prototype.dispatchEventToListeners. Otherwise if current
+        listener removes itself from the array next listener will be skipped.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29920
+
+        * inspector/front-end/Object.js:
+        (WebInspector.Object.prototype.dispatchEventToListeners): make a copy of listeners array before dispatching an event
+
+2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GtkIMContext filtering interferes with DOM key events
+        https://bugs.webkit.org/show_bug.cgi?id=28733
+
+        Ensure that keyboard events filtered by the GtkIMContext still create
+        the proper DOM events.
+
+        No tests added. Instead previously skipped tests have been enabled.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] data: uri support in media player
+        https://bugs.webkit.org/show_bug.cgi?id=29842
+
+        New GStreamer element to handle data: uris. For now only base64
+        encoded data is supported. Decoded data is handed over to
+        giostreamsrc.
+
+        * GNUmakefile.am:
+        * platform/graphics/gtk/DataSourceGStreamer.cpp: Added.
+        (_do_init):
+        (webkit_data_src_base_init):
+        (webkit_data_src_class_init):
+        (webkit_data_src_reset):
+        (webkit_data_src_init):
+        (webkit_data_src_finalize):
+        (webkit_data_src_uri_get_type):
+        (webkit_data_src_uri_get_protocols):
+        (webkit_data_src_uri_get_uri):
+        (webkit_data_src_uri_set_uri):
+        (webkit_data_src_uri_handler_init):
+        * platform/graphics/gtk/DataSourceGStreamer.h: Added.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::mimeTypeCache):
+
+2009-09-30  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29944
+        
+        Reduces false positives in the XSSAuditor by explicitly allowing requests
+        that do not contain illegal URI characters.
+        
+        As a side effect of this change, the tests property-inject.html, 
+        property-escape-noquotes.html, and property-escape-noquotes-tab-slash-chars.html 
+        fail because these attacks do not contain any illegal URI characters and 
+        thus are now allowed by the XSSAuditor, where previously they weren't. A future
+        change may reinstate this functionality.
+
+        Tests: http/tests/security/xssAuditor/script-tag-safe2.html
+               http/tests/security/xssAuditor/script-tag-safe3.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isIllegalURICharacter): Added method.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::findInRequest): Added parameter 
+        allowRequestIfNoIllegalURICharacters.
+        * page/XSSAuditor.h:
+
+2009-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        reproducible freeze and crash on closing form popup at bosch-home.nl
+        https://bugs.webkit.org/show_bug.cgi?id=28948
+
+        showModalDialog calls getDirect on what is actually a window shell,
+        so ends up not getting a value (since no value can ever be placed
+        directly on the shell), which leads to incorrect behaviour.
+
+        We use a manual test rather than automatic as it was not
+        possible to get a modal run loop to work inside DRT.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::showModalDialog):
+        * manual-tests/showModalDialog-returnValue.html: manual testcase.
+
+2009-09-30  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Adds ValidityState.tooLong support for <input> and <textarea>.
+
+        Introduces tooLong() in HTMLFormControlElement and it always returns false.
+        HTMLInputElement and HTMLTextAreaElement overrides it and checks the text
+        length and maxLength.  tooLong() should work only for `dirty' values.
+        So, introduces m_isDirty flag for HTMLTextAreaElement, and
+        !m_data.value().isNull() works as a dirty flag for HTMLInputElement.
+
+        Renames parameter names of setMaxLength().
+
+        https://bugs.webkit.org/show_bug.cgi?id=27454
+
+        Tests: fast/forms/ValidityState-tooLong-input.html
+               fast/forms/ValidityState-tooLong-textarea.html
+
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::tooLong):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::tooLong):
+        (WebCore::HTMLInputElement::setMaxLength):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::reset):
+        (WebCore::HTMLTextAreaElement::updateValue):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        (WebCore::HTMLTextAreaElement::tooLong):
+        * html/HTMLTextAreaElement.h:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::tooLong):
+
+2009-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Factor RedirectScheduler out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=29948
+
+        This change introduces a new sub-object of Frame, redirectScheduler.
+        The redirectScheduler is responsible for scheduling redirects.
+
+        This change leaves the code for the redirectScheduler in
+        FrameLoader.cpp.  A future change will move the class into its own
+        file.
+
+        No behavior change (hopefully!).
+
+        * loader/FrameLoader.cpp:
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::setDefersLoading):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::didOpenURL):
+        (WebCore::FrameLoader::didExplicitOpen):
+        (WebCore::FrameLoader::cancelAndClear):
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::checkCompleted):
+        (WebCore::FrameLoader::isScheduledLocationChangePending):
+        (WebCore::FrameLoader::scheduleHTTPRedirection):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::FrameLoader::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::FrameLoader::scheduleRefresh):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::FrameLoader::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::FrameLoader::provisionalLoadStarted):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        (WebCore::FrameLoader::completed):
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::redirectScheduler):
+        * page/Frame.h:
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix, not reviewed.
+
+        More Windows build fixes for https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix, not reviewed.
+
+        Fix windows build for fix for https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+2009-09-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] HTMLAudioElement, HTMLImageElement, and HTMLOptionElement are constructable, but they shouldn't be.
+        Only Audio, Image, and Option should be constructable.
+        https://bugs.webkit.org/show_bug.cgi?id=29940
+
+        Test: fast/dom/dom-constructor.html
+
+        * WebCore.gypi: Added new files to project.
+        * bindings/scripts/CodeGeneratorV8.pm: Modified to generate custom constructors.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed handling of HTMLImageElement, HTMLOptionElement
+          and HTMLAudioElement construction.
+        * bindings/v8/V8HTMLAudioElementConstructor.h: Added.
+        * bindings/v8/V8HTMLImageElementConstructor.h: Added.
+        * bindings/v8/V8HTMLOptionElementConstructor.h: Added.
+        * bindings/v8/V8Index.cpp: Added new headers.
+        * bindings/v8/V8Index.h: Added Audio, Image and Option decls.
+        * bindings/v8/custom/V8CustomBinding.h: Ditto.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): Added custom constructors.
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Added custom template creator.
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::V8HTMLOptionElementConstructor::GetTemplate): Ditto.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Ditto.
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        307 redirects should pass along http body and Content-Type header
+        https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        Follow-up fix for:
+        <rdar://problem/3802660> SAP: 307 (Temporary Redirect) responses should use POST, not GET
+        
+        Test: http/tests/loading/resources/redirect-methods-result.php
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest): Pass along http body and Content-Type header.
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): ditto
+
+2009-09-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=29941
+        REGRESSION (r48882-r48888): Many memory leaks on SnowLeopard leaks bot
+
+        Forgot to implement a destructor for JSDOMWindowBaseData, so it was
+        leaking its RefPtr data member.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::destroyJSDOMWindowBaseData):
+        * bindings/js/JSDOMWindowBase.h:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData::JSDOMWindowBaseData):
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Make sure the removal of user stylesheets results in all of the WebViews being updated to
+        reflect the changes.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::removeUserContentWithURLForWorld):
+        (WebCore::PageGroup::removeUserContentForWorld):
+
+2009-09-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION(r47440): drop down menus at americanexpress.com disappear on mouse out
+        https://bugs.webkit.org/show_bug.cgi?id=29209
+
+        Test: fast/inline/relative-positioned-overflow.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow): Add self-painting
+        inlines to overflow to ensure that they are included in hit-testing.
+
+2009-09-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        transforms/3d tests are not run in Release builds
+        https://bugs.webkit.org/show_bug.cgi?id=29827
+
+        Make sure we export the WebCoreHas3DRendering symbol in Release builds,
+        because this symbols is used by run-webkit-tests (via 'nm') to detect whether
+        WebCore was built with ENABLE_3D_RENDERING turned on.
+
+        * DerivedSources.make:
+        * WebCore.3DRendering.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix for QT.  Didn't know WebCore.pro existed.
+
+        * WebCore.pro:
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a method for removal of user scripts and stylesheets by URL from a specific world.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::removeUserContentURLForWorld):
+        * page/PageGroup.h:
+
+2009-09-30  Chris Hawk  <hawk@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for conditionals in the WebCore gyp file, which contained two separate
+        'conditions' values for the webcore target. The first entry was ignored,
+        resulting in some missine defines.
+        https://bugs.webkit.org/show_bug.cgi?id=29907
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-09-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage needs to be more careful about where "ThreadSafe" objects are destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=29265
+
+        DOM Storage needs to be more careful about where "ThreadSafe" objects are
+        destroyed.  With the current code, there actually isn't a race condition, but
+        it sure would be easy for someone to introduce one.  A bunch of
+        ThreadSafeShared objects have RefPtrs to objects that are NOT ThreadSafeShared
+        objects.  If it were possible any of these objects' destructors to be fired off
+        the main thread, then the you'd have a race condition.  The code should be more
+        clear and self-documenting about how things related to each other.
+
+        Since the lifetime of a LocalStorageTask is bounded by the LocalStorageThread
+        which is bounded by the StorageSyncManager, StorageAreaImpl, and
+        StorageAreaSync, there's no reason for LocalStorageTask to store anything other
+        than pointers.  By breaking this dependency, we can eliminate the risk.
+
+        Note that we _could_ have LocalStorageThread's task queue just store
+        LocalStorageTask*'s rather than RefPtr<LocalStorageTask>s but then we'd need to
+        manually take care of deleting.  It'd probably also be possible to change
+        LocalStorageThread around so that it needn't hold onto a reference of itself
+        and have a more deterministic shutdown, but my initial attempts to do so
+        failed, and I decided it wasn't worth changing.  The queue is killed before
+        hand, so the thread is 100% impotent before the main thread continues anyway.
+
+        The constructors and destructors of StorageSyncManager, StorageAreaImpl, and
+        StorageAreaSync now have ASSERTs to verify they're running on the main thread. 
+        I'm fairly positive that it'd be impossible to hit these asserts and the fact
+        that these classes are no longer ThreadSafeShared should make it clear how
+        they're meant to be used, but I think it's worth it to be extra sure.  Of
+        course, ideally, we'd have such an assert every time a ref is incremented or
+        decremented.
+
+        Behavior should be unchanged and this is just an internal code cleanup, so no
+        new tests.
+
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::LocalStorageTask):
+        (WebCore::LocalStorageTask::performTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        (WebCore::LocalStorageTask::createTerminate):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        * storage/LocalStorageThread.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::~StorageAreaImpl):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-09-28  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium needs to be able to override the way storage events are delivered
+        https://bugs.webkit.org/show_bug.cgi?id=29655
+
+        Chromium needs to be able to override the way storage events are delivered.
+        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
+        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
+        injection).  This is necessary because Chromium needs to transport events across
+        a process barrier and then dispatch them without use of a Frame*.
+
+        Behavior should not change with this, so no updates to tests.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageEventDispatcher.cpp: Copied from WebCore/storage/StorageAreaImpl.cpp.
+        (WebCore::StorageEventDispatcher::dispatch):
+        * storage/StorageEventDispatcher.h: Added.  (Well, technically in the other half of this patch.)
+
+2009-09-30  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Need to check NULL frame in EventHandler::updateDragAndDrop.
+        https://bugs.webkit.org/show_bug.cgi?id=29929
+
+        Test: http/tests/misc/drag-over-iframe-invalid-source-crash.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+
+2009-09-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        ASSERTION FAILED: !repaintContainer || repaintContainer == this
+        https://bugs.webkit.org/show_bug.cgi?id=29755
+        
+        Generalize the fix for this bug to account for cases where there may be multiple
+        containing blocks between the repaint container, and the container of the element
+        being repainted.
+
+        Test: compositing/repaint/opacity-between-absolute2.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        Call offsetFromAncestorContainer() to get the correct offset.
+        
+        (WebCore::RenderBox::computeRectForRepaint): Ditto
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::computeRectForRepaint): Ditto.
+        
+        * rendering/RenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::offsetFromAncestorContainer):
+        New method that computes an offset from some object in the ancestor container() chain.
+
+2009-09-30  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix TextCodecQt::decode method after r48752 to return a non-null string if the length of the input is 0.
+        This fixes https://bugs.webkit.org/show_bug.cgi?id=29736.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+
+2009-09-29  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix a couple of bugs with patterns.  Move the setting of the document URL to before the style
+        selector gets constructed so that pattern match testing gets the correct URL.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        * page/UserContentURLPattern.cpp:
+        (WebCore::UserContentURLPattern::parse):
+
+2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Brady Eidson.
+
+        Assertion failure in http/tests/xmlhttprequest/failed-auth.html.
+
+        I couldn't find out why this only started to happen now, but it was incorrect to check
+        persistence of a credential returned by CredentialStorage::get() without checking that it
+        was non-null. When there is no credential for the protection space in storage, get()
+        returns a new object, and Credentil constructor doesn't initialize m_persistence.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Moved the
+        assertion after credential null check.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Added the same persistence
+        assertion, matching sync code (and CF one, as well).
+
+2009-09-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Add an ASSERT for UTF8Encoding().isValid()
+        https://bugs.webkit.org/show_bug.cgi?id=29908
+
+        * platform/text/TextEncoding.cpp:
+        (WebCore::UTF8Encoding):
+
+2009-09-29  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29892
+        Add support for whitelist patterns to control conditional injection of user scripts and
+        user stylesheets.
+
+        No new tests. Not testable until WebKit portion is added in followup patch.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::pageGroupUserSheets):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/UserContentURLPattern.cpp: Added.
+        (WebCore::UserContentURLPattern::matchesPatterns):
+        (WebCore::UserContentURLPattern::parse):
+        (WebCore::UserContentURLPattern::matches):
+        (WebCore::UserContentURLPattern::matchesHost):
+        (WebCore::MatchTester::MatchTester):
+        (WebCore::MatchTester::testStringFinished):
+        (WebCore::MatchTester::patternStringFinished):
+        (WebCore::MatchTester::eatWildcard):
+        (WebCore::MatchTester::eatSameChars):
+        (WebCore::MatchTester::test):
+        (WebCore::UserContentURLPattern::matchesPath):
+        * page/UserContentURLPattern.h: Added.
+        (WebCore::UserContentURLPattern::UserContentURLPattern):
+        (WebCore::UserContentURLPattern::scheme):
+        (WebCore::UserContentURLPattern::host):
+        (WebCore::UserContentURLPattern::path):
+        (WebCore::UserContentURLPattern::matchSubdomains):
+
+2009-09-29  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Reproducible crash pressing return inside quoted content
+        at WebCore::BreakBlockquoteCommand::doApply.
+        <rdar://problem/7085453>
+        In some case, like the one provided in the test case, m_downStreamEnd
+        refers to a node that gets deleted when executing the DeleteSelectionCommand.
+        We shouldn't use m_downStreamEnd to recalculate the new m_endPosition when
+        pruning is needed, because it may be point to a node that has been deleted, but
+        rather rely on removeNode in CompositeEditCommand to update m_endPosition correctly.
+
+        Test: editing/selection/blockquote-crash.html
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply): Added check for invalid position
+        to avoid dereferencing a null node pointer.
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): Don't reset m_endPosition
+        using the value in m_downStreamEnd when it is necessary to prune the start block.
+        
+2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Basic authentication credentials are not sent automatically to top resources
+        https://bugs.webkit.org/show_bug.cgi?id=29901
+
+        No new tests - I don't want to pollute root directory of http tests to check for this rather
+        minor issue.
+
+        * platform/network/CredentialStorage.cpp:
+        (WebCore::CredentialStorage::set): Changed to always preserve leading slash.
+        (WebCore::CredentialStorage::getDefaultAuthenticationCredential): Made breaking out of the
+        loop more explicit.
+
+2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Web Inspector REGRESSION(r47820-r47822): Profiles aren't
+        added to the inspector unless the inspector is already open
+        when the profile completes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29897
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._populateProfiles):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by David Hyatt.
+
+        Fix to logic of earlier commit 48902.
+
+        When merging two if's before committing, I forgot to invert the
+        bool check.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::ignoreHttpError):
+
+2009-09-29  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, build fix.
+
+        Fixing Chromium build, following r48884.
+
+        [https://bugs.webkit.org/show_bug.cgi?id=29894]
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        * bindings/v8/V8WorkerContextEventListener.h:
+
+2009-09-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Follows HTML5's maxLength change in September 2009.
+        - Change HTMLTextAreaElement.maxLength type to signed.
+        - HTMLTextAreaElement.maxLength returns -1 if maxlength= attribute is missing.
+        - HTMLTextAreaElement.maxLength and HTMLInputElement.maxLength
+          throw INDEX_SIZE_ERR for setting negative values.
+        https://bugs.webkit.org/show_bug.cgi?id=29796
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setMaxLength):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
+        (WebCore::HTMLTextAreaElement::maxLength):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+
+2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r48894, because review discussion was not complete.
+        http://trac.webkit.org/changeset/48894
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::begin):
+
+2009-09-29  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Filter feComposite implementation is missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28362]
+
+        feComposite implementation for SVG.
+
+        Test: svg/filters/feComposite.svg
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::arithmetic):
+        (WebCore::FEComposite::apply):
+
+2009-09-29  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Starting all read-only transactions with an explicit BEGIN
+        DEFERRED command instead of BEGIN, since some ports (chromium)
+        might compile their own SQLite library and set BEGIN to BEGIN
+        IMMEDIATE by default; which would result in a deadlock in case of
+        two concurrent read-only transactions on the same DB, and would
+        unnecessarily delay other potential transactions to the same DB.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29729
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::begin):
+
+2009-09-29  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add support for run-time flag for 3D canvas
+        https://bugs.webkit.org/show_bug.cgi?id=29826
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext): Check page settings for
+        experimental WebGL flag before returning 3D graphics context.
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Initialize new flag to false.
+        (WebCore::Settings::setExperimentalWebGLEnabled):
+        * page/Settings.h: Set new flag.
+        (WebCore::Settings::experimentalWebGLEnabled): Return new flag.
+
+2009-09-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium needs to be able to override the way storage events are delivered - part 1
+        https://bugs.webkit.org/show_bug.cgi?id=29889
+
+        Chromium needs to be able to override the way storage events are delivered.
+        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
+        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
+        injection).  This is necessary because Chromium needs to transport events across
+        a process barrier and then dispatch them without use of a Frame*.
+
+        This patch should be a no-op for all ports other than Chromium.
+
+        * WebCore.gypi:
+        * storage/StorageEventDispatcher.h: Added.
+
+2009-09-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (missed file).
+
+        Adding file missed in previous commit.
+
+        * manual-tests/gtk/resources/long_cell.cur: Copied from WebCore/dom/PositionCreationFunctions.h.
+
+2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Correct an issue with XMLHttpRequest attribute event listeners never being cleared.
+        https://bugs.webkit.org/show_bug.cgi?id=29888
+
+        Test: LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-abort-readyState-shouldDispatchEvent.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener): Added isAttribute parameter.
+        (WebCore::ACCESSOR_SETTER): Made all event listener setters create attribute listeners.
+        (WebCore::CALLBACK_FUNC_DECL): Made addEventListener create object listener.
+
+2009-09-22  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix corruption for non-square images.
+
+        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
+        https://bugs.webkit.org/show_bug.cgi?id=29654
+
+        Added an additional manual-test for this issue to the existing Gtk
+        cursor image test.
+
+        * manual-tests/gtk/cursor-image.html:
+        * manual-tests/gtk/resources/long_cell.cur: Added.
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Build fix - pass a proper ScriptExecutipnContext to getEventListenerHandlerBody()
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/js/ScriptEventListener.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/v8/ScriptEventListener.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+
+2009-09-29  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Ensure that we don't scroll lock to an anchor node after a
+        user-initiated scroll, even if that scroll doesn't propagate
+        all the way up to FrameView.
+
+        Test: fast/events/node-event-anchor-lock.html
+
+        * page/EventHandler.cpp: Call setFrameWasScrolledByUser() when a scroll is handled by a node rather than a frame.
+        (WebCore::EventHandler::scrollOverflow):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::sendScrollEvent): Use setFrameWasScrolledByUser();
+        (WebCore::EventHandler::setFrameWasScrolledByUser): Split out of sendScrollEvent();
+        (WebCore::EventHandler::passMousePressEventToScrollbar):
+        * page/EventHandler.h: Declare setFrameWasScrolledByUser().
+
+2009-09-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        Onclick not fired for an element copied with cloneContents() or cloneNode()
+        https://bugs.webkit.org/show_bug.cgi?id=25130
+
+        The change here is that JS event listeners don't keep a reference to a global object from
+        where they were created, and instead take it as a parameter when parsing source code. Also,
+        the listener creation won't fail just because it happens for an element in a frameless
+        document.
+        Thus, moving nodes between documents no longer results in having incorrect registered
+        lazy event listeners on them.
+
+        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
+               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
+               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
+        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
+        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
+        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
+        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
+        (WebCore::JSEventListener::reportError): Ditto.
+
+        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
+        to JSDOMGlobalObject.
+
+        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
+        creation was split between this function and ScriptEventListener; moved it here, as JS
+        global object can be different now.
+
+        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
+        which can not be determined at parsing time.
+
+        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
+        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
+        expect that errors are logged at document parsing time, and because I don't know what other
+        side effects moving it vould have.
+
+        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
+        because JSC needs a global context here.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        Don't pass global object to JSEventListener::create(), which no longer needs it.
+        Note that some of these functions still have an early return for null global object, which
+        can probably be removed in a later patch.
+        Pass ScriptExecutionContext to EventListener methods that now need it.
+
+        * bindings/scripts/CodeGeneratorCOM.pm: Don't force EventTarget implementation on Node -
+        it doesn't work yet (it didn't quite work before this patch, too, because it assumed that
+        any object implementing EventTarget COM interface originated from WebCore).
+
+        * dom/EventListener.idl: Just like in ObjC, EventListener should be a pure interface in
+        COM bindings.
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed virtual destructor from JSGlobalObjectData to eliminate pointer
+        fix-ups when accessing JSGlobalObject::d.
+        
+        Replaced with an explicit destructor function pointer.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::destroyJSDOMGlobalObjectData):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Don't rely on QNetworkReply::NetworkError codes, but
+        on HTTP error codes instead.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::ignoreHttpError):
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Use const references when using Qt's foreach.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix handling of QNetworkReply errors.
+
+        In the QNetworkReplyHandler::finish() a response was sent even when
+        the reply contained an error. This resulted in a sendResponseIfNeeded()
+        calling didReceiveResponse on the client, leading to the destruction
+        of the m_resourceHandle, discontinuing further processing in finish(),
+        and thus not calling didFail on the client.
+
+        Instead it continued as everything went fine, and
+        FrameLoaderClientQt::dispatchDecidePolicyForMIMEType() changed the
+        policy to PolicyDownload due to not being able to show the non existing
+        MIMEType. As the download also obviously fails, it ended up with a
+        policy change error.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        The code for showing error pages when the response was
+        a 401/403/404, was not actually doing so. This patch
+        fixes that.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/7259965> REGRESSION: http/tests/xmlhttprequest/cross-origin-authorization.html
+        is failing/crashing intermittently
+        https://bugs.webkit.org/show_bug.cgi?id=29322
+
+        This was caused by CStringBuffer::encodeBase64() returning a buffer that wasn't zero terminated.
+        The code had other issues as well, so I removed it altogether:
+        - it claimed to avoid some buffer copies, but it didn't;
+        - and I don't think that base64 encoding should be part of CString interface.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::encodeBasicAuthorization): Encode username and password using Base64.h directly.
+        (WebCore::ResourceHandle::start): Use encodeBasicAuthorization().
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Extended logging
+        to synchronous case.
+        (-[WebCoreSynchronousLoader connectionShouldUseCredentialStorage:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveResponse:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveData:]): Ditto.
+        (-[WebCoreSynchronousLoader connectionDidFinishLoading:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didFailWithError:]): Ditto.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp: Matched Mac changes.
+
+        * platform/text/CString.cpp:
+        * platform/text/CString.h:
+        (WebCore::CStringBuffer::create):
+        (WebCore::CStringBuffer::CStringBuffer):
+        Removed code that was added for Base64 in r48363.
+
+2009-09-29  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix typo in Localizations.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=29872
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaControlElementHelpText):
+
+2009-09-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make the XSLT conditional in DOMWindow.idl's xsltProcessor
+        attribute conditional in the generated files, similar to
+        r44116.
+
+        * page/DOMWindow.idl:
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann and Tor Arne Vestbø.
+
+        Use the ResourceError as it is supposed to and handle
+        not HTTP errors from QNetworkReply.
+
+        Thanks to Adam Roben for his input.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Encapsulate JS listeners specifics into ScriptEventListener.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29816
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/js/ScriptEventListener.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/v8/ScriptEventListener.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+
+2009-09-29  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed attempt to fix the build.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2009-09-28  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add experimentalWebSocketsEnabled in Settings.
+        https://bugs.webkit.org/show_bug.cgi?id=28941
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setExperimentalWebSocketsEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::experimentalWebSocketsEnabled):
+        
+2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add platform code to support WebSocket for chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=29171
+
+        To build within chromium tree, it requires a patch in bug 29174.
+        Real implementation will be landed in chromium tree.
+
+        * WebCore.gypi:
+        * platform/network/chromium/SocketStreamError.h: Added.
+        (WebCore::SocketStreamError::SocketStreamError):
+        * platform/network/chromium/SocketStreamHandle.h: Added.
+        (WebCore::SocketStreamHandle::create):
+
+2009-09-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7157288> Crash in RenderStyle::computedLineHeight()
+        when Times New Roman is not installed
+
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont): If Times New Roman is
+        not available, use the Windows default GUI font.
+
+2009-09-28  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Do not add platform-specific methods to cross-platform header
+        FileSystem.h per Darin's feedback for 29109.
+        https://bugs.webkit.org/show_bug.cgi?id=29830
+
+        * platform/FileSystem.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asURL):
+        * platform/chromium/FileSystemChromium.cpp:
+
+2009-09-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Register Chromium's VFSs with a proper sqlite3_io_methods
+        finder. This should only affect the POSIX implementation. The
+        Windows change is included for consistency and in case sqlite
+        starts using something similar in its Windows VFS in the future.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29743
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+
+2009-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Change the V8 bindings' handling of window.toString(),
+        so we return [object DOMWindow] (like JSC), not [object global].
+
+        https://bugs.webkit.org/show_bug.cgi?id=29742
+
+        This will fix a couple of Chromium port test failures and enable us to
+        use the default expectations for a bunch more.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Use the DOMWindow wrapper instead
+        of the global object wrapper when it's available in the DOMWindow toString callback.
+
+2009-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Rubber stamped by David Levin.
+
+        Chromium build fix, add back in #include of V8Proxy.h in V8WebKitPointConstructor.cpp.
+
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Re-include V8Proxy.h.
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        NotNullPassRefPtr: smart pointer optimized for passing references that are not null
+        https://bugs.webkit.org/show_bug.cgi?id=29822
+        
+        Added NotNullPassRefPtr, and deployed it in all places that initialize
+        JavaScript objects.
+
+        * bindings/js/DOMObjectWithSVGContext.h:
+        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::cacheDOMStructure):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObject::DOMObject):
+        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
+        (WebCore::DOMConstructorObject::DOMConstructorObject):
+        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::JSInspectedObjectWrapper):
+        * bindings/js/JSInspectedObjectWrapper.h:
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::JSInspectorCallbackWrapper):
+        * bindings/js/JSInspectorCallbackWrapper.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp):
+        * bridge/runtime_object.h:
+
+2009-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Allow V8 to handle x/y parameters in a WebKitPoint constructor.
+        https://bugs.webkit.org/show_bug.cgi?id=29823
+
+        Fixes V8's handling of LayoutTests/fast/dom/Window/webkitConvertPoint.html
+
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Allow for x/y parameters in constructor.
+
+2009-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build by doing something approximating reasonableness in the Xcode project.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Prospective Tiger build fix.
+
+        * WebCore.xcodeproj/project.pbxproj: Try to use unique IDs for the new files.
+
+2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add explicit frontend event for commit load.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29814
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didCommitLoad):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._setDocument):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.didCommitLoad):
+
+2009-09-28  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium port - recognize we are being built independently
+        of chromium and look for dependencies under webkit/chromium rather
+        than chromium/src.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29722
+
+        * WebCore.gyp/WebCore.gyp: See above. Also removed a few files from
+          the sources list, since they are not supposed to be built here.
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement XSLT support with QtXmlPatterns.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::setTransformSource):
+        * dom/Document.h:
+        (WebCore::Document::transformSource):
+        * dom/TransformSource.h: Added.
+        (WebCore::TransformSource::platformSource):
+        * dom/TransformSourceLibxslt.cpp: Added.
+        (WebCore::TransformSource::TransformSource): Wraps a libxml2 document.
+        (WebCore::TransformSource::~TransformSource):
+        * dom/TransformSourceQt.cpp: Added.
+        (WebCore::TransformSource::TransformSource): Wraps a plain string.
+        (WebCore::TransformSource::~TransformSource):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::doEnd):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::XMLTokenizer::parseProcessingInstruction):
+        * xml/XSLStyleSheet.h:
+        (WebCore::XSLStyleSheet::sheetString):
+        * xml/XSLStyleSheetLibxslt.cpp:
+        (WebCore::XSLStyleSheet::document):
+        * xml/XSLStyleSheetQt.cpp: Added.
+        * xml/XSLTProcessor.h:
+        * xml/XSLTProcessorLibxslt.cpp:
+        (WebCore::xmlDocPtrFromNode):
+        * xml/XSLTProcessorQt.cpp: Added.
+        (WebCore::XSLTMessageHandler::XSLTMessageHandler): A subclass of QAbstractMessageHandler.
+        (WebCore::XSLTMessageHandler::handleMessage): Forwards all processor messages to the Console.
+        (WebCore::XSLTProcessor::transformToString): Uses QXmlQuery.
+
+2009-09-28  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Delegate implementation of rendererIsNeeded() for media control elements to RenderTheme.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28689
+
+        Covered by LayoutTests/media/video-no-audio.html
+
+        * rendering/MediaControlElements.cpp: Removed subclass implementations of rendererIsNeeded().
+        (WebCore::MediaControlElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
+        (WebCore::MediaControlInputElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
+        * rendering/MediaControlElements.h:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::shouldRenderMediaControlPart): New method.  Contains logic moved from subclass implementations of rendererIsNeeded().
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Override to always render mute button.
+        * rendering/RenderThemeChromiumSkia.h:
+
+2009-09-28  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] DragData::asURL should return file URL.
+        https://bugs.webkit.org/show_bug.cgi?id=29109
+
+        Tested by LayoutTests/fast/events/drag-to-navigate.html.
+
+        * platform/FileSystem.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asURL):
+        * platform/chromium/FileSystemChromium.cpp:
+        (WebCore::getAbsolutePath):
+        (WebCore::isDirectory):
+        (WebCore::filePathToURL):
+
+2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Add a special case to handle index arguments, because we need to be
+        able to see if they're < 0.
+        https://bugs.webkit.org/show_bug.cgi?id=29810
+
+        Test: LayoutTests/dom/html/level1/core/hc_characterdataindexsizeerrdeletedatacountnegative.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added special case (matching CodeGeneratorJS.pm)
+          for index arguments.
+
+2009-09-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Extend the MediaWiki/KHTMLFixes.css workaround to cover older MediaWiki versions
+        https://bugs.webkit.org/show_bug.cgi?id=29792
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet): If site specific hacks are
+        enabled, check if the linked style sheet is one of two versions of the
+        MediaWiki KHTMLFixes.css. If so, remove the offending rule.
+
+2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Fix an error in type logic in CodeGeneratorV8.pm, where
+        unsigned ints are accidentally used as signed.
+        https://bugs.webkit.org/show_bug.cgi?id=29810
+
+        Test: LayoutTests/fast/forms/textarea-maxlength.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Made sure "unsigned long" in IDL is
+          properly generates on "unsigned" return value.
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        In preparation for adding XSLT support with QtXmlPatterns to the Qt
+        port, rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp as we will
+        have our own implementation which most likely will not share any code
+        with the current one.
+
+        Additionally, fix some coding style issues.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * xml/XSLStyleSheet.cpp: Renamed to XSLStyleSheetLibxslt.cpp.
+        * xml/XSLStyleSheetLibxslt.cpp: Added.
+
+2009-09-28  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Prospective build fix for r48812.
+
+        Forgot to remove the inline reset() implementation when reverting the indentation
+        changes in the file.
+
+        * xml/XSLTProcessor.h:
+
+2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by nobody (trivial follow up fix), Joseph Pecoraro LGTM-ed.
+
+        Web Inspector: Follow up to r48809.
+        InspectorController.wrapObject should only be called on the inspectable page side.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17429
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+        (WebInspector.EventListenersSection):
+        (WebInspector.EventListenersSection.prototype.update):
+        (WebInspector.EventListenerBar):
+        (WebInspector.EventListenerBar.prototype.update):
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Move the libxslt specific part of XSLTProcessor to a separate file.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        In preparation for adding XSLT support with QtXmlPatterns to the Qt
+        port, move the libxslt part of the XSLTProcessor implementation into
+        another file and leave the part that can be reused and shared.
+
+        Additionally, fix some coding style issues.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * xml/XSLTProcessor.cpp:
+        (WebCore::XSLTProcessor::createDocumentFromSource): Remove trailing whitespaces.
+        (WebCore::createFragmentFromSource): Remove trailing whitespaces.
+        (WebCore::XSLTProcessor::transformToFragment): Remove trailing whitespaces.
+        (WebCore::XSLTProcessor::reset): Moved out of the class definition.
+        * xml/XSLTProcessorLibxslt.cpp: Added.
+        (WebCore::XSLTProcessor::genericErrorFunc): Moved.
+        (WebCore::XSLTProcessor::parseErrorFunc): Moved.
+        (WebCore::docLoaderFunc): Moved.
+        (WebCore::setXSLTLoadCallBack): Moved.
+        (WebCore::writeToVector): Moved.
+        (WebCore::saveResultToString): Moved.
+        (WebCore::xsltParamArrayFromParameterMap): Moved.
+        (WebCore::freeXsltParamArray): Moved.
+        (WebCore::xsltStylesheetPointer): Moved.
+        (WebCore::xmlDocPtrFromNode): Moved.
+        (WebCore::resultMIMEType): Moved.
+        (WebCore::XSLTProcessor::transformToString): Moved.
+
+2009-09-28  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fix the crash of SVG that crashes when use a non-exist symbol
+        https://bugs.webkit.org/show_bug.cgi?id=27693
+
+        Test: svg/custom/use-non-existing-symbol-crash.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::shadowTreeContainsChangedNodes):
+
+2009-09-28  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Should Show Event Listeners/Handlers Registered on each Node
+        https://bugs.webkit.org/show_bug.cgi?id=17429
+        
+          Extracted a method from dispatchEvent to get the event ancestor chain
+        
+        * dom/Node.cpp:
+        (WebCore::Node::eventAncestors): the extracted method
+        (WebCore::Node::dispatchGenericEvent): use eventAncestors
+        * dom/Node.h:
+
+          Asynchronous Flow For the Inspector, Backend -> DOM Agent -> Frontend
+          The DOMAgent's getEventListenersForNode handles the logic of finding
+          all the relevant listeners in the event flow.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getEventListenersForNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+        (WebCore::InspectorDOMAgent::buildObjectForNode): added localName
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::EventListenerInfo::EventListenerInfo):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        * inspector/InspectorFrontend.h:
+        (WebCore::InspectorFrontend::scriptState):
+        * inspector/front-end/DOMAgent.js: added localName to WebInspector.DOMNode from payload
+        (WebInspector.EventListeners.getEventListenersForNodeAsync.mycallback):
+        (WebInspector.EventListeners.getEventListenersForNodeAsync):
+
+          New Sidebar Pane in the Element's Panel
+          Includes Gear Menu for filtering the Event Listeners on the
+          "Selected Node Only" or "All Nodes"
+
+        * inspector/front-end/ElementsPanel.js: Handles refreshing the Pane when necessary
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.updateEventListeners):
+        * inspector/front-end/EventListenersSidebarPane.js: Added. 
+        (WebInspector.EventListenersSidebarPane): The 1st level in the Pane
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+        (WebInspector.EventListenersSection): The 2nd level in the Pane
+        (WebInspector.EventListenersSection.prototype.update): filters on Preference
+        (WebInspector.EventListenersSection.prototype.addListener):
+        (WebInspector.EventListenerBar): The 3rd level in the Pane
+        (WebInspector.EventListenerBar.prototype._getNodeDisplayName):
+        (WebInspector.EventListenerBar.prototype._getFunctionDisplayName):
+        (WebInspector.EventListenersSidebarPane.prototype._changeSetting): For the Gear Menu
+        
+          Consolidated "appropriateSelectorForNode"
+
+        * inspector/front-end/StylesSidebarPane.js:
+        * inspector/front-end/utilities.js:
+
+          Miscellaneous Updates
+
+        * English.lproj/localizedStrings.js: "Event Listeners", "No Event Listeners", "Selected Node Only", "All Nodes"
+        * WebCore.gypi: included the new inspector files
+        * WebCore.vcproj/WebCore.vcproj: included source files that were missing
+        * inspector/front-end/Images/grayConnectorPoint.png: Added. Thanks to Timothy Hatcher.
+        * inspector/front-end/Images/whiteConnectorPoint.png: Added. Thanks to Timothy Hatcher.
+        * inspector/front-end/inspector.js: Preferences for the Gear Menu Event Listeners filter
+        * inspector/front-end/inspector.css: reused as much as possible
+        * inspector/front-end/inspector.html: include the new script
+        * inspector/front-end/WebKit.qrc: included the new inspector files
+
+2009-09-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29760
+        Implement CSSOM Range.getClientRects/getBoundingClientRect 
+
+        Tests: fast/dom/Range/getBoundingClientRect-getClientRects-relative-to-viewport.html
+               fast/dom/Range/getBoundingClientRect.html
+               fast/dom/Range/getClientRects.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::getClientRects):
+        (WebCore::Range::getBoundingClientRect):
+        (WebCore::adjustFloatQuadsForScrollAndAbsoluteZoom):
+        (WebCore::Range::getBorderAndTextQuads):
+        * dom/Range.h:
+        * dom/Range.idl:
+        Implement Range.getClientRects/getBoundingClientRect.
+
+        * dom/Element.cpp:
+        * rendering/RenderObject.h: 
+        (WebCore::adjustForAbsoluteZoom):
+        (WebCore::adjustIntRectForAbsoluteZoom):
+        (WebCore::adjustFloatPointForAbsoluteZoom):
+        (WebCore::adjustFloatQuadForAbsoluteZoom):
+        Move point/quad adjustment methods from Element.cpp to RenderObject.h
+        so that Range.cpp can use them as well.
+
+2009-09-27  Simon Hausmann  <hausmann@webkit.org>
+
+        Unreviewed fix for WebInspector with Qt build.
+
+        Simply re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by nobody (trivial ChangeLog fix).
+
+        Restore WebCore/ChangeLog truncated in r48778.
+
+2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: DOM store is being unbound twice, leading to assertion failure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29770
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::unbind):
+
+2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not track DOM changes while inspector window is closed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29769
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        * inspector/InspectorDOMAgent.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * page/android/InspectorControllerAndroid.cpp:
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+
+2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] Double Clicking Resources Fails to Open in New Window
+
+        https://bugs.webkit.org/show_bug.cgi?id=29762
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.setStyleText):
+        (InjectedScript.openInInspectedWindow):
+        * inspector/front-end/InjectedScriptAccess.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+
+2009-09-26  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+
+        Reviewed by Darin Adler.
+
+        Fix ENABLE_ORIENTATION_EVENTS for non-Mac platforms.
+
+        * DerivedSources.make: Moved Platform.h check for
+        ENABLE_ORIENTATION_EVENTS into Mac-only section and added
+        default of ENABLE_ORIENTATION_EVENTS = 0 to non-Mac section.
+        Added ifndef test to make it possible to override both
+        ENABLE_DASHBOARD_SUPPORT and ENABLE_ORIENTATION_EVENTS external
+        to the makefile.  Moved addition of ENABLE_ORIENTATION_EVENTS to
+        ADDITIONAL_IDL_DEFINES to common section.
+        * GNUmakefile.am: Added support for ENABLE_ORIENTATION_EVENTS if
+        it is ever used.
+        * WebCore.pro: Ditto.
+
+2009-09-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        Move placeholder-related code to HTMLTextFormControlElement from
+        HTMLInputElement, WMLInputElement, InputElement, and
+        HTMLTextAreaElement.
+        https://bugs.webkit.org/show_bug.cgi?id=28703
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/InputElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::HTMLTextFormControlElement):
+        (WebCore::HTMLTextFormControlElement::~HTMLTextFormControlElement):
+        (WebCore::HTMLTextFormControlElement::dispatchFocusEvent):
+        (WebCore::HTMLTextFormControlElement::dispatchBlurEvent):
+        (WebCore::HTMLTextFormControlElement::placeholderShouldBeVisible):
+        (WebCore::HTMLTextFormControlElement::updatePlaceholderVisibility):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLTextFormControlElement::handleFocusEvent):
+        (WebCore::HTMLTextFormControlElement::handleBlurEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        (WebCore::HTMLInputElement::handleFocusEvent):
+        (WebCore::HTMLInputElement::handleBlurEvent):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::supportsPlaceholder):
+        (WebCore::HTMLInputElement::isEmptyValue):
+        * html/HTMLIsIndexElement.cpp:
+        (WebCore::HTMLIsIndexElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::createRenderer):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::supportsPlaceholder):
+        (WebCore::HTMLTextAreaElement::isEmptyValue):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        * rendering/RenderTextControlSingleLine.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::createRenderer):
+        * wml/WMLInputElement.h:
+
+2009-09-26  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Optimize the code so only the text from start to end is scanned.
+        https://bugs.webkit.org/show_bug.cgi?id=29092
+
+        On a platform with webkit+Qt+Symbian, the parsing time for a 600K text
+        file improved from 400ms to 40ms (10x faster).
+
+        * dom/Text.cpp:
+        (WebCore::Text::createWithLengthLimit):
+
+2009-09-26  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        This Patch fixes [chromium] the drop-down is always left-aligned even
+        for RTL element.
+        https://bugs.webkit.org/show_bug.cgi?id=29612
+
+        For auto-complete, the items in drop-down should be right-aligned if
+        the directionality of <input> field is RTL.
+        For <select><option>, the items in drop-down should be right-aligned
+        if the directionality of <select> is RTL.
+
+        No automatic test is possible. Manual tests are added.
+
+        * manual-tests/autofill_alignment.html: Added.
+        * manual-tests/select_alignment.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::paintRow): Adjust the starting x-axis of text to
+        be paint if it should be right-aligned.
+
+2009-09-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION (r48775) FontList.plist written by TOT WebKit causes Safari 4
+        to crash on launch
+        https://bugs.webkit.org/show_bug.cgi?id=29759
+
+        * platform/graphics/win/FontDatabase.cpp:
+        (WebCore::writeFontDatabaseToPlist): Reverted to saving the CG font DB
+        property list at the root of FontList.plist, but with an additional
+        key for the last value of the Fonts registry key.
+        (WebCore::populateFontDatabase): Pass the FontList.plist in its entirety
+        to populatFontDatabaseFromPlist.
+
+2009-09-25  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix. Adding missing header files.
+
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+
+2009-09-25  David Kilzer  <ddkilzer@apple.com>
+
+        Part 1 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+
+        Reviewed by Darin Adler.
+
+        * DerivedSources.make: Move tests for ENABLE_CONTEXT_MENUS,
+        ENABLE_DRAG_SUPPORT and ENABLE_INSPECTOR into Mac-only section.
+
+2009-09-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Load blocks during unload should not affect targeted loads
+        https://bugs.webkit.org/show_bug.cgi?id=29747
+
+        Move the check of the unload state after checking for targeted links.
+
+        Test: fast/loader/unload-hyperlink-targeted.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL):
+
+2009-09-25  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Add initial V8 bindings for WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=29664
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CanvasArrayBufferCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CanvasArrayCustom.h: Added.
+        (WebCore::constructCanvasArray):
+        * bindings/v8/custom/V8CanvasByteArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasFloatArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasIntArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp: Added.
+        (WebCore::jsArrayToFloatArray):
+        (WebCore::jsArrayToIntArray):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * bindings/v8/custom/V8CanvasShortArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-09-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        This is breaking Chromium try bots, so I'm counting this as a build fix.
+
+        Add more svn:ignore exceptions.  On different platforms, these files are
+        generated with different case for WebCore.
+
+        * WebCore.gyp: Changed property svn:ignore.
+
+2009-09-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reverting r48767, as it broke Windows build in a non-trivial way.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::JSEventListener::markJSFunction):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::jsFunction):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventListener.h:
+        (WebCore::EventListener::reportError):
+        (WebCore::EventListener::jsFunction):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+
+2009-09-24  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add a gyp variable to allow building a debug webcore without debug
+        symbols.  This allows for faster compile, link, and gdb times.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29721
+
+        No new tests, build config change.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-09-25  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Declare RegisteredEventListener as a class instead of a struct.
+        This fixes a warning in the Chromium build.
+
+        * dom/RegisteredEventListener.h:
+
+2009-09-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        WebCore part of
+        <rdar://problem/7211635> 2 byte characters are displayed as garbaged
+        <rdar://problem/7212626> garbled/gibberish text (off-by-one)
+
+        When the Windows Fonts directory contains more than one font file for a
+        given font name, which of the fonts gets assigned to the name in the
+        Core Graphics font database was determined arbitrarily and did not
+        always match the font GDI used for the same font name. The mismatch
+        caused character-to-glyph mapping to use one font and glyph rendering to
+        use another.
+
+        The fix is to update the Core Graphics font database from the registry
+        entries (that reflect the name-to-font mapping that GDI uses) after
+        populating it with the result of scanning the Fonts directory. As a
+        consequence, the directory needs to be scanned at startup every time the
+        registry key changes, so the last value of the registry key is kept
+        in the property list on disk so that it could be compared to the current
+        value on startup.
+
+        * platform/graphics/win/FontDatabase.cpp:
+        (WebCore::populateFontDatabaseFromPlist): Now takes a property list as
+        a parameter and avoids round-tripping through XML by calling
+        wkAddFontsFromPlist() instead of wkAddFontsFromPlistRepresentation().
+        (WebCore::fontFilenamesFromRegistryKey):
+        (WebCore::cgFontDBKey):
+        (WebCore::writeFontDatabaseToPlist): Now takes the CG font DB property
+        list and a property list with the font filenames from the registry and
+        writes a dictionary with those property lists as values.
+        (WebCore::fontFilenamesFromRegistry): Added. Returns an array with the
+        values in the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
+        registry key.
+        (WebCore::populateFontDatabase): Changed to read the contents of the
+        Fonts registry key and compare it with the last-saved value from the
+        property list, and to call wkAddFontsFromRegistry() after populating the
+        CG font DB from the file system. Uses wkCreateFontsPlist() instead of
+        wkCreateFontsPlistRepresentation() to avoid round-tripping through XML.
+
+2009-09-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Inlined some object creation code, including lexicalGlobalObject access
+        https://bugs.webkit.org/show_bug.cgi?id=29750
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::currentCallFrame):
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::hasBreakpoint): Updated for JavaScriptCore
+        API changes.
+
+2009-09-25  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24399
+        Make @import work in user stylesheets.  The first bug was that the URL wasn't being set on the
+        user sheets themselves, so relative @import URLs couldn't resolve properly.  The second bug
+        was that the loads would be denied.  This is fixed by using the requestUserCSSStyleSheet method
+        instead of the normal request method.  In order to know when to do this, CSSStyleSheets now have
+        a propagated boolean, m_isUserStyleSheet, that lets them know if they are user stylesheets or not.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::setIsUserStyleSheet):
+        (WebCore::CSSStyleSheet::isUserStyleSheet):
+        * dom/Document.cpp:
+        (WebCore::Document::pageUserSheet):
+        (WebCore::Document::pageGroupUserSheets):
+
+2009-09-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ASSERTION FAILED: !repaintContainer || repaintContainer == this
+        https://bugs.webkit.org/show_bug.cgi?id=29755
+        
+        It's possible for RenderObject::container() to return an object that is higher
+        in the hierarchy than the repaintContainer that is being used to repaint an
+        object. For example, this can happen when running an accelerated opacity
+        transition on an element with a position:absolute parent, and a position:absolute child.
+        
+        In this case we need to detect when RenderObject::container() will skip over
+        repaintContainer, and in that case adjust the coords to shift into repaintContainer's space.
+
+        Test: compositing/repaint/opacity-between-absolute.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::computeRectForRepaint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::container):
+        * rendering/RenderObject.h:
+
+2009-09-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash with hardware accelerated rotation of a PDF image in a data URL
+        <rdar://problem/7250378>
+        
+        PDF images don't return a color space from CGImageGetColorSpace(),
+        so we need to null-check the return value before use.
+
+        Test: compositing/color-matching/pdf-image-match.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+
+2009-09-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Null-deref when first access to an Attr node is after its Element is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=29748
+
+        Test: fast/dom/Attr/access-after-element-destruction.html
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::markChildren): Added. Keeps the ownerElement alive as
+        long as the Attr is alive.
+
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::markChildren): Added. Keeps the Element alive as
+        long as the NamedNodeMap is alive.
+
+        * dom/Attr.idl: Added CustomMarkFunction attribute.
+
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::getAttributeItem): Tweaked formatting.
+        (WebCore::NamedNodeMap::detachFromElement): Call clearAttributes so we don't
+        have attributes hanging around that might need an Attr node created; that way
+        we won't crash with a null-dereference trying to deal with one of them. This
+        can't happen when working with JavaScript since the Element will be kept
+        alive due to the change above.
+        (WebCore::NamedNodeMap::addAttribute): Fix function name in comment.
+        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "1" and added
+        missing braces.
+
+        * dom/NamedAttrMap.h: Made the element function public so it can be used by
+        the JavaScript binding to keep the Element alive.
+
+        * dom/NamedNodeMap.idl: Added CustomMarkFunction attribute.
+
+2009-09-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        Onclick not fired for an element copied with cloneContents() or cloneNode()
+        https://bugs.webkit.org/show_bug.cgi?id=25130
+
+        The change here is that JS event listeners don't keep a reference to a global object from
+        where they were created, and instead take it as a parameter when parsing source code. Also,
+        the listener creation won't fail just because it happens for an element in a frameless
+        document.
+        Thus, moving nodes between documents no longer results in having incorrect registered
+        lazy event listeners on them.
+
+        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
+               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
+               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
+        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
+        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
+        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
+        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
+        (WebCore::JSEventListener::reportError): Ditto.
+
+        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
+        to JSDOMGlobalObject.
+
+        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
+        creation was split between this function and ScriptEventListener; moved it here, as JS
+        global object can be different now.
+
+        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
+        which can not be determined at parsing time.
+
+        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
+        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
+        expect that errors are logged at document parsing time, and because I don't know what other
+        side effects moving it vould have.
+
+        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
+        because JSC needs a global context here.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        Don't pass global object to JSEventListener::create(), which no longer needs it.
+        Note that some of these functions still have an early return for null global object, which
+        can probably be removed in a later patch.
+        Pass ScriptExecutionContext to EventListener methods that now need it.
+
+2009-09-25  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler, Dan Bernstein, Adele Peterson, and others.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29740
+        <rdar://problem/7168738> Gmail: After changing a foreground text color, pressing return doesn't apply background to new line
+
+        Change the way style is preserved when inserting a new paragraph.
+        The original code handled insertion at the beginning and at the end of a paragraph as special
+        cases. The newly created paragraph contained a set of nodes generated starting from the
+        computed style of the insertion node. This approach has two problems:
+        1. if the insertion node has a non opaque background color and one of the parent element did have
+        a solid background color the new paragraph did not have the element with the solid color in the tree.
+        2. in some circumstances it generated more markup than the original paragraph had (a span with bold, italic,
+        background color and some font attribute was being reproduced as span bold italic font as separate tags.
+        The new approach is to recreate in the new paragraph the same hierarchy of nodes found in the
+        paragraph where the insertion point is.
+
+        Test: editing/inserting/insert-bg-font.html
+
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::getAncestorsInsideBlock): retrieves the list of all the ancestors
+        between the insert node and the outer block.
+        (WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock): uses the list of ancestors to recreate
+        in the new paragraph the same element hierarchy present in the starting paragraph.
+        (WebCore::InsertParagraphSeparatorCommand::doApply): changed the code to handle the general case of insertion
+        in the middle of the paragraph to use the new methods. Changed the handling of the insertion at the beginning and
+        at the end of the paragraph to use the new methods instead of applying the calculated style.
+        * editing/InsertParagraphSeparatorCommand.h: added methods getAncestorsInsideBlock and cloneHierarchyUnderNewBlock.
+
+2009-09-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Content-type parameters not taken into account when building form-data
+        https://bugs.webkit.org/show_bug.cgi?id=28970
+
+        existing manual test case extended with new tests
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshFormData):
+        (WebInspector.ResourceView.prototype._refreshParms):
+        * manual-tests/inspector/display-form-data.html:
+
+2009-09-25  Yuan Song  <song.yuan@ericsson.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=14566
+
+        Raise SECURITY_ERR exception if an attempt is made to change document.domain to an invalid value.
+
+        Test: fast/js/invalid-domain-change-throws-exception.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::setDomain):
+        * dom/Document.h:
+        * dom/Document.idl:
+
+2009-09-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        When setTimeout is called with a string argument in an isolated
+        world, we now compile the string in the isolated world.
+
+        Last time we tried this change, we got a lot of crashes.  This
+        time we're using a fresh local handle as our context to avoid
+        trouble if the peristent handle gets disposed before we leave
+        the context.
+
+        Test: fast/dom/timer-clear-interval-in-handler-and-generate-error.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+
+2009-09-25  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix a regression in Mac Chromium popup menus, where the user's
+        selection was ignored and the popup became unresponsive.
+        https://bugs.webkit.org/show_bug.cgi?id=29726
+
+        The fix is to notify the popup's client that the popup was hidden,
+        even if the popup has no parent.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::hidePopup):
+
+2009-09-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Enable Pasteboard::writePlainText for Chromium and fix code style nits.
+        https://bugs.webkit.org/show_bug.cgi?id=29734
+
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writePlainText):
+
+2009-09-25  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28876
+        [Qt] reduce peak memory consumption of text decoding.
+
+        Chop large input buffer into small buffers to reduce peak memory
+        during decoding.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+
+2009-09-24  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add a mechanism for automatically halting plug-ins.
+
+        Reviewed by Oliver Hunt and Alice Liu.
+
+        * GNUmakefile.am:
+
+        * WebCore.base.exp:
+        Update export of Page constructor.
+
+        * WebCore.gypi:
+
+        * WebCore.pro:
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Add PluginHalter.{h,cpp}, PluginHalterClient.h, and
+        HaltablePlugin.h.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Add files to Mac project.
+
+        * loader/EmptyClients.h:
+        Added an empty PluginHalterClient.
+        (WebCore::EmptyPluginHalterClient::shouldHaltPlugin):
+        Return false.
+
+        * page/PluginHalter.cpp: Added.
+        (WebCore::PluginHalter::PluginHalter):
+        (WebCore::PluginHalter::didStartPlugin):
+        Add the object to the plug-in set. If this is the only item in the set,
+        set m_oldestStartTime to this object's time, and start the timer.
+        (WebCore::PluginHalter::didStopPlugin):
+        Remove the plug-in from the set.
+        (WebCore::PluginHalter::timerFired):
+        Find the cut-off time as the current time minus the allowed run time;
+        plug-ins older than this may be halted. Iterate over the plug-ins. Find
+        the object with the oldest start time that is too young to be halted;
+        we'll use its start time to set the timer's next fire time. For all
+        plug-ins that are candidates to be halted, call the
+        PluginHalterClient's shouldHaltPlugin(). If this function returns true,
+        call the plug-in's halt() function. Remove these objects from the set
+        of tracked plug-ins. Call startTimerIfNecessary() to restart the timer.
+        (WebCore::PluginHalter::startTimerIfNecessary):
+        If the timer is set to fire, or the set of tracked plug-ins is empty,
+        return early. Set the timer to fire after the oldest plug-in has run
+        for the allowed run time.
+
+        * page/PluginHalter.h: Added.
+        (WebCore::PluginHalter::setPluginAllowedRunTime):
+
+        * page/PluginHalterClient.h: Added.
+        (WebCore::PluginHalterClient::~PluginHalterClient):
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Initialize m_pluginHalterClient. Call pluginHalterEnabledStateChanged()
+        to create the PluginHalter if necessary.
+        (WebCore::Page::pluginHalterEnabledStateChanged):
+        If plug-in halting is enabled, create the PluginHalter. If it is
+        disabled, clear it.
+        (WebCore::Page::pluginAllowedRunTimeChanged):
+        If there is a plug-in halter, call its setPluginAllowedRunTime().
+        (WebCore::Page::didStartPlugin):
+        If there is a plug-in halter, call its didStartPlugin().
+        (WebCore::Page::didStopPlugin):
+        If there is a plug-in halter, call its didStopPlugin().
+
+        * page/Page.h:
+        Add a parameter to the Page constructor for the PluginHalterClient.
+        Added declarations for didStartPlugin() and didStopPlugin(), which are
+        called when HaltablePlugins are added to or removed from the page. Adds
+        pluginAllowedRunTimeChanged() and pluginHalterEnabledStateChanged() to
+        notify the Page when these settings are changed. Added members to hold
+        the PluginHalter and the PluginHalterClient.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setPluginHalterEnabled):
+        If the enabled state has changed, call the Page's
+        pluginHalterEnabledStateChanged().
+        (WebCore::Settings::setPluginAllowedRunTime):
+        Call the Page's pluginAllowedRunTimeChanged().
+
+        * page/Settings.h:
+        (WebCore::Settings::pluginHalterEnabled):
+        (WebCore::Settings::pluginAllowedRunTime):
+
+        * page/HaltablePlugin.h: Added. Defines an interface for plug-ins that
+        can be automatically halted.
+        (WebCore::HaltablePlugin::~HaltablePlugin):
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+        Pass a dummy PluginHalterClient.
+
+2009-09-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION: webkit-transform scale no longer works properly in nightly build
+        https://bugs.webkit.org/show_bug.cgi?id=29730
+        
+        When the initial or final state of a scale animation does not specify a transform,
+        use a default scale of 1, rather than zero.
+
+        Test: compositing/transitions/scale-transition-no-start.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getTransformFunctionValue):
+
+2009-09-24  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Eric Seidel.
+
+        isEnabled switch for notifications (experimental) in Page Settings
+        https://bugs.webkit.org/show_bug.cgi?id=28930
+
+        Adds a run-time flag in Settings object that controls whether
+        to expose desktop notifications.
+
+        No new test, but test code also modified to set this preference.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitNotifications): check preference before returning notifications object
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setExperimentalNotificationsEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::experimentalNotificationsEnabled):
+
+2009-09-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix <rdar://problem/7162000> Crash while trying to
+        calculate the horizontal position of image
+
+        Test: fast/inline-block/relative-positioned-rtl-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced): Corrected an
+        isInline() test to isRenderInline(). This is similar to r41259.
+
+2009-09-24  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix expanding profile call stacks being broken after sorting.
+        https://bugs.webkit.org/show_bug.cgi?id=26423
+
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.sort):
+        Set shouldRefreshChildren to true on collapsed nodes with children so that expanding it
+        causes the children to be placed in the right positions.
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        Fixed sudden termination console spew due to too many calls to
+        enableSuddenTermination.
+        
+        <rdar://problem/7063125> 10A410: Safari logging enableSuddenTermination errors
+
+        * page/DOMWindow.cpp:
+        (WebCore::removeUnloadEventListener):
+        (WebCore::removeAllUnloadEventListeners):
+        (WebCore::removeBeforeUnloadEventListener):
+        (WebCore::removeAllBeforeUnloadEventListeners): Only
+        enableSuddenTermination if the set of listeners is empty *and* this
+        window was in the set. Otherwise, a no-op will cause us to enableSuddenTermination.
+
+2009-09-24  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebKit returns "" instead of null when getting
+        inexistent, forbidden or invalidly named headers.
+        https://bugs.webkit.org/show_bug.cgi?id=29140
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        Changed to return null as it should according to the spec.
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add GYP generated files to svn:ignore
+        https://bugs.webkit.org/show_bug.cgi?id=29724
+
+        Adding the following files to the svn:ignore list (all in the
+        WebCore/WebCore.gyp directory)
+
+        WebCore.xcodeproj
+        WebCore.sln
+        WebCore.vcproj
+        WebCore_Debug.rules
+        WebCore_Release.rules
+        WebCore_Release - no tcmalloc.rules
+        WebCore_Purify.rules
+        WebCore.mk
+        WebCore_Debug_rules.mk
+        WebCore_Release_rules.mk
+        WebCore_Release - no tcmalloc_rules.mk
+        WebCore_Purify_rules.mk
+        WebCore.scons
+        WebCore_main.scons
+
+        * WebCore.gyp: Changed property svn:ignore.
+
+2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Mac build fix.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+        remove unused parameter from function signature;
+
+2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Oliver Hunt.
+
+        Implement correct horizontal scrollbar behavior for GTKalso on
+        styled scrollbars.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29348
+        [Gtk] Scrollwheel on horizontal scrollbars should slide horizontally
+
+        Test: platform/gtk/scrollbars/overflow-scrollbar-horizontal-wheel-scroll.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleWheelEvent): on GTK+, when using the
+        wheel with the pointer on the horizontal scrollbar, scroll
+        horizontally;
+        * platform/PlatformWheelEvent.h:
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::swapOrientation): allow adding a
+        vertical scroll to the horizontal one;
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        StorageNamespace::storageArea() should take in a PassRefPtr<StorageOrigin>
+        https://bugs.webkit.org/show_bug.cgi?id=29290
+
+        Modified StorageNamespace::storageArea() to take in a PassRefPtr<StorageOrigin>
+        per http://webkit.org/coding/RefPtr.html
+
+        No behavior change, so no tests.
+
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added back enable/disableSuddenTermination() functionality I accidentally
+        removed in my last patch.
+
+        * page/DOMWindow.cpp:
+        (WebCore::addUnloadEventListener):
+        (WebCore::removeUnloadEventListener):
+        (WebCore::removeAllUnloadEventListeners):
+        (WebCore::addBeforeUnloadEventListener):
+        (WebCore::removeBeforeUnloadEventListener):
+        (WebCore::removeAllBeforeUnloadEventListeners):
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Steve Falkenburg and Mark Rowe.
+
+        Don't pass -F to GCC on non-mac platforms since it is an darwin only.
+
+        * DerivedSources.make:
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * dom/Element.idl:
+
+2009-09-23  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Revert the relevant parts of r47925, and implement an alternate
+        fix (localize the coordinate check to GraphicsContext::clipPath()).
+        This fixes http://crbug.com/21174.
+
+        Covered by LayoutTests/svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipPath):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::currentPathInLocalCoordinates):
+
+2009-09-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Merge changes from Mozilla's FTP directory parser.
+        <rdar://problem/7227620> and https://bugs.webkit.org/show_bug.cgi?id=29294
+
+        FTP layout tests not possible at this time.
+        https://bugs.webkit.org/show_bug.cgi?id=29719 tracks making them possible.
+
+        * loader/FTPDirectoryParser.cpp:
+        (WebCore::ParsingFailed):
+        (WebCore::parseOneFTPLine):
+
+2009-09-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] re-enable some media tests
+        https://bugs.webkit.org/show_bug.cgi?id=29716
+
+        make canPlayType() return "probably" if mime-type is known
+        and codecs string is not empty. If codecs is empty return
+        "maybe".
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29703
+        Add a function to element to check whether it matches a CSS selector
+
+        Implement Element.webkitMatchesSelector.
+
+        * css/CSSSelectorList.cpp:
+        (WebCore::forEachTagSelector):
+        (WebCore::forEachSelector):
+        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
+        (WebCore::CSSSelectorList::selectorsNeedNamespaceResolution):
+        * css/CSSSelectorList.h:
+        Moved code to iterate the CSSSelectorList and determine if any
+        selectors need namespace resolution from a static function in
+        Node.cpp to CSSSelectorList so that it can be used by webkitMatchesSelector
+        as well as querySelector/querySelectorAll.
+
+        * dom/Element.cpp:
+        (WebCore::Element::webkitMatchesSelector):
+        * dom/Element.h: 
+        * dom/Element.idl:
+        Implement the new function. Handles exceptional cases identically to
+        querySelector/querySelectorAll.
+
+        * dom/Node.cpp:
+        (WebCore::Node::querySelector):
+        (WebCore::Node::querySelectorAll):
+        Moved selectorsNeedNamespaceResolution to CSSSelectorList from here.
+
+2009-09-24  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fixed bindings build after http://trac.webkit.org/changeset/48701
+        https://bugs.webkit.org/show_bug.cgi?id=29713
+
+        Got rid of isWindowEvent in function signatures:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::getReceiverObject):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        * bindings/v8/V8LazyEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::callListenerFunction):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomEventListener.h:
+
+        Switched to EventTarget methods of adding/removing listeners:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        (WebCore::toEventID):
+        (WebCore::ACCESSOR_SETTER):
+
+        * dom/EventTarget.h: Some functions were incorrectly marked
+        as JSC-specific.
+
+2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Color-code watch expression errors with red.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29707
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionTreeElement.prototype.update):
+        * inspector/front-end/inspector.css:
+
+2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix formatting for messages derived from resource warnings,
+        couple of drive-by formatting fixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29705
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/front-end/ConsoleView.js:
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateAndWrap):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+
+2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Implement InspectorController::copyNode(id).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28357
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::copyNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+
+2009-09-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY(rollout)
+
+        Roll out r48712 as it is incorrect.
+
+        Overriding getPropertyNames is incorrect.
+
+        * bridge/runtime_array.cpp:
+        * bridge/runtime_array.h:
+
+2009-09-24  Xan Lopez  <xlopez@igalia.com>
+
+        Revert r48697, since it broke key handling notification to GTK+.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-09-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GStreamer MediaPlayer is unable to correctly querry duration
+        https://bugs.webkit.org/show_bug.cgi?id=24639
+
+        check duration returned by gst_element_query_duration() only
+        when using GStreamer < 0.10.23.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-09-24  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        The indices of RuntimeArray should be enumerated like for a regular array.
+        https://bugs.webkit.org/show_bug.cgi?id=29005
+
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getPropertyNames):
+        * bridge/runtime_array.h:
+
+2009-09-23  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduce Pasteboard::writePlaintext(const String&) so that copying
+        of the inspected elements HTML will be possible in WebInspector.
+        https://bugs.webkit.org/show_bug.cgi?id=29634
+
+        * platform/Pasteboard.h:
+        * platform/android/TemporaryLinkStubs.cpp:
+        (Pasteboard::writePlainText):
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/haiku/PasteboardHaiku.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        * platform/wince/PasteboardWince.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/wx/PasteboardWx.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+
+2009-09-24  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QApp::translate() calls to provide the correct class name without
+        a trailing comma.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaTimeDescription):
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        More build fix: Removed JSSharedWorkerContextCustom.cpp from project
+        files, since it no longer exists in the repository.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Declare set/unsetPendingActivity public, so
+        SharedWorkerScriptLoader can call them.
+
+        * dom/ActiveDOMObject.h:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed a bit of the Windows build.
+
+        * workers/SharedWorker.idl: Declare a custom mark function. (I accidentally
+        removed this in my last patch.)
+        * WebCore.xcodeproj/project.pbxproj: Added JSSharedWorkerCustom.cpp back
+        to the build. (I accidentally removed this in my last patch.)
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        32-bit build fix: restore previous cast that I thought was unnecessary.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didSendData):
+        (WebCore::XMLHttpRequest::didReceiveData):
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bring a little sanity to this crazy EventTarget world of ours
+        https://bugs.webkit.org/show_bug.cgi?id=29701
+
+        Lots of EventTarget refactoring to achieve a single shared implementation
+        that fixes some of the performance and correctness bugs of the many individual
+        implementations, and makes reasoning about EventTargets and EventListeners
+        much easier.
+        
+        The basic design is this:
+            - EventTarget manages a set of EventListeners.
+            - onXXX EventListener attributes forward to standard EventTarget APIs.
+            - Since the onXXX code is repetitive, it is usually done with macros
+              of the form DEFINE_ATTRIBUTE_EVENT_LISTENER(attributeName).
+            - EventTarget provides a shared implementation of dispatchEvent,
+              which subclasses with special event dispatch rules, like Node, override.
+            - To support Node, which lazily instantiates its EventTarget data,
+              EventTarget has no data members, and instead makes a virtual call
+              to get its data from wherever its subclass chose to store it.
+              
+        Code that used to call dispatchEvent, passing an ExceptionCode paratmeter,
+        even though no exception could be thrown, has been changed not to do so,
+        to improve clarity and performance.
+        
+        Code that used to call a special dispatchXXXEvent function, which just
+        turned around and called dispatchEvent, has been changed to call
+        dispatchEvent, to improve clarity and performance.
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj: Another day in the life of a WebKit
+        engineer.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM): Updated for Node API change. Added
+        "is not in the document but is firing event listeners" as a condition
+        that makes a Node observable in the DOM, so that event listeners firing
+        on removed nodes are not destroyed midstream. (This was a long-standing
+        bug that was somewhat hidden by the old implementation's habit of
+        copying the RegisteredEventListener vector before firing events, which
+        would keep almost all the relevant objects from being destroyed.)
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent): Removed the isWindowEvent flag
+        because it was one of the most elaborately planned no-ops in the history
+        of software crime, and one of the reasons clients thought they needed more
+        than one dispatchEvent function even though they didn't.
+        * bindings/js/JSEventListener.h:
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::markChildren):
+        (WebCore::JSMessagePort::markChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        * bindings/js/JSEventSourceCustom.cpp:
+        * bindings/js/JSMessagePortCustom.cpp:
+        * bindings/js/JSSharedWorkerContextCustom.cpp: Removed.
+        * bindings/js/JSWebSocketCustom.cpp:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::markChildren):
+        * bindings/js/JSWorkerCustom.cpp:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren): EventListener marking is
+        now autogenerated. Classes that still have custom mark functions for other
+        reasons now call a shared EventTarget API to mark their EventListeners.
+
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent): Bye bye isWindowEvent.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Autogeneration support for
+        marking and invalidating event listeners.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::willRemoveChild):
+        (WebCore::ContainerNode::appendChild):
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListeners):
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::setFocusedNode):
+        (WebCore::Document::dispatchWindowEvent):
+        (WebCore::Document::dispatchWindowLoadEvent):
+        (WebCore::Document::finishedParsing):
+        * dom/Document.h: Use dispatchEvent directly.
+
+        * dom/Element.h: Moved a few event listener attributes down from Node,
+        since they don't apply to all Nodes, only Elements.
+
+        * dom/EventListener.h: Removed isWindowEvent parameter.
+
+        * dom/EventNames.h: Added the "display" event name, so it works correctly
+        with attribute macros, and for performance.
+
+        * dom/EventTarget.cpp:
+        (WebCore::forbidEventDispatch):
+        (WebCore::allowEventDispatch):
+        (WebCore::eventDispatchForbidden): Made this code (embarrasingly) thread
+        safe, since it's now called on multiple threads. (Currently, we only forbid
+        event dispatch on the main thread. If we ever want to forbid event dispatch
+        on secondary threads, we can improve it then.)
+
+        (WebCore::EventTarget::addEventListener):
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::setAttributeEventListener):
+        (WebCore::EventTarget::getAttributeEventListener):
+        (WebCore::EventTarget::clearAttributeEventListener):
+        (WebCore::EventTarget::dispatchEvent):
+        (WebCore::EventTarget::fireEventListeners):
+        (WebCore::EventTarget::getEventListeners):
+        (WebCore::EventTarget::removeAllEventListeners):
+        * dom/EventTarget.h:
+        (WebCore::FiringEventEndIterator::FiringEventEndIterator):
+        (WebCore::EventTarget::ref):
+        (WebCore::EventTarget::deref):
+        (WebCore::EventTarget::markEventListeners):
+        (WebCore::EventTarget::invalidateEventListeners):
+        (WebCore::EventTarget::isFiringEventListeners):
+        (WebCore::EventTarget::hasEventListeners): The ONE TRUE IMPLEMENTATION of
+        EventTarget APIs, crafted from an amalgam of all the different versions
+        we used to have. The most significant change here is that we no longer
+        make a copy of an EventListener vector before firing the events in the
+        vector -- instead, we use a reference to the original vector, along with
+        a notification mechanism for the unlikely case when an EventListener is
+        removed from the vector. This substantially reduces malloc, copying, and
+        refcount overhead, and complexity.
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create): Use dispatchEvent directly.
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::eventTargetData):
+        (WebCore::MessagePort::ensureEventTargetData):
+        * dom/MessagePort.h:
+        (WebCore::MessagePort::setOnmessage):
+        (WebCore::MessagePort::onmessage):
+        * dom/MessagePort.idl: Removed custom EventTarget implementation.
+
+        * dom/MutationEvent.h:
+        (WebCore::MutationEvent::create): Added some default values so callers
+        can construct MutationEvents more easily, without calling a custom dispatch
+        function.
+
+        * dom/Node.cpp:
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::eventTargetData):
+        (WebCore::Node::ensureEventTargetData):
+        (WebCore::Node::handleLocalEvents):
+        (WebCore::Node::dispatchEvent):
+        (WebCore::Node::dispatchGenericEvent):
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchUIEvent):
+        (WebCore::Node::dispatchKeyEvent):
+        (WebCore::Node::dispatchMouseEvent):
+        (WebCore::Node::dispatchWheelEvent):
+        (WebCore::Node::dispatchFocusEvent):
+        (WebCore::Node::dispatchBlurEvent):
+        * dom/Node.h:
+        (WebCore::Node::preDispatchEventHandler):
+        (WebCore::Node::postDispatchEventHandler):
+        * dom/Node.idl:
+        * dom/NodeRareData.h:
+        (WebCore::NodeRareData::eventTargetData):
+        (WebCore::NodeRareData::ensureEventTargetData): Use the shared EventTarget
+        interface, and call dispatchEvent directly instead of custom dispatchXXXEvent
+        functions that just forwarded to dispatchEvent.
+
+        * dom/RegisteredEventListener.cpp:
+        * dom/RegisteredEventListener.h:
+        (WebCore::RegisteredEventListener::RegisteredEventListener):
+        (WebCore::operator==): This is just a simple struct now, since we no longer
+        do a complicated copy / refCount / isRemoved dance just to honor the rule
+        that an EventListener can be removed during event dispatch.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Removed another custom dispatchEvent.
+
+        * html/HTMLBodyElement.cpp:
+        * html/HTMLBodyElement.h: Use the shared EventTarget API.
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent):
+        (WebCore::HTMLFormControlElement::checkValidity):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::handleLocalEvents):
+        (WebCore::HTMLFormElement::prepareSubmit):
+        (WebCore::HTMLFormElement::reset):
+        * html/HTMLFormElement.h: Use the standard dispatchEvent API.
+
+        * html/HTMLFrameSetElement.cpp:
+        * html/HTMLFrameSetElement.h: Use the shared EventTarget API.
+
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadInternal):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::dispatchLoadEvent):
+        (WebCore::HTMLScriptElement::dispatchErrorEvent):
+        * html/HTMLSourceElement.cpp:
+        (WebCore::HTMLSourceElement::errorEventTimerFired):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::notifyFinished): Use the standard dispatchEvent API.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::HashChangeEventTask::performTask):
+        (WebCore::FrameLoader::pageHidden): No more isWindowEvent.
+
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::CallCacheListenerTask::performTask):
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::notifyDOMApplicationCache):
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::eventTargetData):
+        (WebCore::DOMApplicationCache::ensureEventTargetData):
+        * loader/appcache/DOMApplicationCache.h:
+        * loader/appcache/DOMApplicationCache.idl: Switched to the standard
+        EventTarget API. As a part of this, I switched this class from using a
+        custom internal event name enumeration to using the standard EventNames.
+
+        * notifications/Notification.cpp:
+        (WebCore::Notification::eventTargetData):
+        (WebCore::Notification::ensureEventTargetData):
+        * notifications/Notification.h:
+        (WebCore::Notification::scriptExecutionContext):
+        * notifications/Notification.idl: Switched to the standard EventTarget API.
+
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::event):
+        (WebCore::windowsWithUnloadEventListeners):
+        (WebCore::windowsWithBeforeUnloadEventListeners):
+        (WebCore::allowsBeforeUnloadListeners):
+        (WebCore::DOMWindow::dispatchAllPendingBeforeUnloadEvents):
+        (WebCore::DOMWindow::pendingUnloadEventListeners):
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Changed the "pending"
+        unload / beforeunload listener tracker just to track which windows had
+        such listeners, instead of actually keeping a copy of the listeners. Now,
+        this code can use the standard EventTarget API.
+
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::postMessageTimerFired):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::dispatchLoadEvent):
+        (WebCore::DOMWindow::dispatchEvent):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        (WebCore::DOMWindow::captureEvents):
+        (WebCore::DOMWindow::releaseEvents):
+        (WebCore::DOMWindow::eventTargetData):
+        (WebCore::DOMWindow::ensureEventTargetData):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl: Use the standard EventTarget APIs.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::canMouseDownStartSelect):
+        (WebCore::EventHandler::canMouseDragExtendSelect):
+        (WebCore::EventHandler::sendResizeEvent):
+        (WebCore::EventHandler::sendScrollEvent): Use dispatchEvent directly.
+
+        * page/EventSource.cpp:
+        (WebCore::EventSource::endRequest):
+        (WebCore::EventSource::didReceiveResponse):
+        (WebCore::EventSource::parseEventStreamLine):
+        (WebCore::EventSource::stop):
+        (WebCore::EventSource::createMessageEvent):
+        (WebCore::EventSource::eventTargetData):
+        (WebCore::EventSource::ensureEventTargetData):
+        * page/EventSource.h:
+        * page/EventSource.idl: Use the standard EventTarget APIs.
+
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
+        (WebCore::FocusController::setFocusedFrame):
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldClose):
+        * page/Frame.h:
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::valueChanged):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::selectionChanged):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged): Use dispatchEvent.
+
+        * svg/SVGElement.cpp:
+        (WebCore::hasLoadListener): Rewritten for new EventTarget API.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::dummyEventTargetData):
+        (WebCore::SVGElementInstance::addEventListener):
+        (WebCore::SVGElementInstance::removeEventListener):
+        (WebCore::SVGElementInstance::removeAllEventListeners):
+        (WebCore::SVGElementInstance::dispatchEvent):
+        (WebCore::SVGElementInstance::eventTargetData):
+        (WebCore::SVGElementInstance::ensureEventTargetData): Use the EventTarget API.
+
+        * svg/SVGElementInstance.h:
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::dispatchLoadEvent):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchErrorEvent): Use dispatchEvent directly.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::transferEventListenersToShadowTree): Updated for
+        new EventTarget API.
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent): No more isWindowEvent.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::eventTargetData):
+        (WebCore::WebSocket::ensureEventTargetData):
+        * websockets/WebSocket.h:
+        * websockets/WebSocket.idl:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::eventTargetData):
+        (WebCore::AbstractWorker::ensureEventTargetData):
+        * workers/AbstractWorker.h:
+        * workers/AbstractWorker.idl:
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerConnectTask::performTask):
+        (WebCore::SharedWorkerScriptLoader::load):
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        * workers/SharedWorker.idl:
+        * workers/SharedWorkerContext.cpp:
+        (WebCore::createConnectEvent):
+        * workers/SharedWorkerContext.h:
+        * workers/SharedWorkerContext.idl:
+        * workers/Worker.cpp:
+        (WebCore::Worker::notifyFinished):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::eventTargetData):
+        (WebCore::WorkerContext::ensureEventTargetData):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerExceptionTask::performTask):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+        (WebCore::XMLHttpRequest::createRequest):
+        (WebCore::XMLHttpRequest::abort):
+        (WebCore::XMLHttpRequest::networkError):
+        (WebCore::XMLHttpRequest::abortError):
+        (WebCore::XMLHttpRequest::didSendData):
+        (WebCore::XMLHttpRequest::didReceiveData):
+        (WebCore::XMLHttpRequest::eventTargetData):
+        (WebCore::XMLHttpRequest::ensureEventTargetData):
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequest.idl:
+        * xml/XMLHttpRequestProgressEvent.h:
+        (WebCore::XMLHttpRequestProgressEvent::create):
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::eventTargetData):
+        (WebCore::XMLHttpRequestUpload::ensureEventTargetData):
+        * xml/XMLHttpRequestUpload.h:
+        * xml/XMLHttpRequestUpload.idl: Use new EventTarget API.
+
+2009-09-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        - Support for maxLength of <textarea>
+        - Move numGraphemeClusters() and numCharactersInGraphemeClusters() from InputElement to String.
+        https://bugs.webkit.org/show_bug.cgi?id=29292
+
+        Test: fast/forms/textarea-maxlength.html
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::sanitizeUserInputValue):
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::defaultEventHandler):
+        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
+        (WebCore::HTMLTextAreaElement::sanitizeUserInputValue):
+        (WebCore::HTMLTextAreaElement::maxLength):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::numGraphemeClusters):
+        (WebCore::String::numCharactersInGraphemeClusters):
+
+2009-09-23  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
+        https://bugs.webkit.org/show_bug.cgi?id=29654
+
+        Give GDK_Backspace key events the proper text properties.
+
+        Instead of adding new tests, this change removes existing tests
+        from Gtk's skipped list.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-09-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26989
+        Should allow navigation of top-level openers
+        <rdar://problem/7034025>
+
+        Allow navigation of cross-origin window.opener if it is top-level frame.
+
+        Test: http/tests/security/frameNavigation/cross-origin-opener.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::shouldAllowNavigation):
+
+2009-09-23  Marshall Culpepper  <mculpepper@appcelerator.com>
+
+        Reviewed by Eric Seidel.
+
+        Added $(WebKitLibrariesDir)/include/cairo so cairo.h is found by
+        default when the necessary dependencies are extracted into the
+        WebKitLibrariesDir.
+        https://bugs.webkit.org/show_bug.cgi?id=29661
+
+        * WebCore.vcproj/WebCoreCairo.vsprops:
+
+2009-09-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Crash when website does a history.back() followed by an alert()
+        https://bugs.webkit.org/show_bug.cgi?id=29686
+        rdar://problem/6984996
+
+        When loading is deferred, we need to defer timer-based loads
+        too, not just networking-driven loads. Otherwise we can get
+        syncronouse navigation while running a script, which leads to
+        crashes and other badness.
+
+        This patch includes a manual test; an automated test may be
+        possible some time in the future.
+
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv): Use scheduleLocationChange
+        instead of scheduleHTTPRedirection to implement the navigation
+        needed for x-frame-options.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader): Updated for data members with
+        new names and new data members.
+        (WebCore::FrameLoader::setDefersLoading): When turning deferral
+        off, call startRedirectionTimer and startCheckCompleteTimer, since
+        either of them might have been fired and ignored while defersLoading
+        was true.
+        (WebCore::FrameLoader::clear): Updated for replacement of the
+        m_checkCompletedTimer and m_checkLoadCompleteTimer timers.
+        (WebCore::FrameLoader::allAncestorsAreComplete): Added.
+        (WebCore::FrameLoader::checkCompleted): Added code to set
+        m_shouldCallCheckCompleted to false. Changed code that calls
+        startRedirectionTimer to call it unconditionally, since that
+        function now knows when to do work and doesn't expect callers
+        to handle that any more.
+        (WebCore::FrameLoader::checkTimerFired): Added. Replaces the old
+        timer fired callbacks. Calls checkCompleted and checkLoadComplete
+        as appropriate, but not when defersLoading is true.
+        (WebCore::FrameLoader::startCheckCompleteTimer): Added. Replaces
+        the two different calls to start timers before. Only starts the
+        timers if they are needed.
+        (WebCore::FrameLoader::scheduleCheckCompleted): Changed to call
+        startCheckCompleteTimer after setting boolean.
+        (WebCore::FrameLoader::scheduleCheckLoadComplete): Ditto.
+        (WebCore::FrameLoader::scheduleHistoryNavigation): Removed
+        canGoBackOrForward check. The logic works more naturally when
+        we don't do anything until the timer fires.
+        (WebCore::FrameLoader::redirectionTimerFired): Do nothing if
+        defersLoading is true. Also moved canGoBackOrForward check here.
+        (WebCore::FrameLoader::scheduleRedirection): Changed code that
+        calls startRedirectionTimer to do so unconditionally. That
+        function now handles the rules about when to start the timer
+        rather than expecting the caller to do so.
+        (WebCore::FrameLoader::startRedirectionTimer): Added code to
+        handle the case where there is no redirection scheduled,
+        where the timer is already active, or where this is a classic
+        redirection and there is an ancestor that has not yet completed
+        loading.
+        (WebCore::FrameLoader::completed): Call startRedirectionTimer
+        here directly instead of calling a cover named parentCompleted.
+        Hooray! One less function in the giant FrameLoader class!
+        (WebCore::FrameLoader::checkLoadComplete): Added code to set
+        m_shouldCallCheckLoadComplete to false.
+
+        * loader/FrameLoader.h: Replaced the two functions
+        checkCompletedTimerFired and checkLoadCompleteTimerFired with
+        one function, checkTimerFired. Removed the parentCompleted
+        function. Added the startCheckCompleteTimer and
+        allAncestorsAreComplete functions. Replaced the
+        m_checkCompletedTimer and m_checkLoadCompleteTimer data
+        members with m_checkTimer, m_shouldCallCheckCompleted, and
+        m_shouldCallCheckLoadComplete.
+
+        * manual-tests/go-back-after-alert.html: Added.
+        * manual-tests/resources/alert-and-go-back.html: Added.
+
+2009-09-23  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/29660> Move "Generate 64-bit Export File" build phase script into DerivedSources.make
+
+        Reviewed by Mark Rowe.
+
+        The "Generate 64-bit Export File" build phase script generated
+        the WebCore.LP64.exp export file used to link 64-bit WebCore.
+        Instead of having a separate build phase script, move its
+        generation into DerivedSources.make where WebCore.exp is
+        generated.
+
+        * DerivedSources.make: Added a rule to make WebCore.LP64.exp.
+        Added code to append WebCore.PluginHostProcess.exp to
+        $(WEBCORE_EXPORT_DEPENDENCIES) when WTF_USE_PLUGIN_HOST_PROCESS
+        is set to 1.
+        * WebCore.PluginHostProcess.exp: Renamed from WebCore/WebCore.LP64.exp.
+        * WebCore.xcodeproj/project.pbxproj: Removed the "Generate
+        64-bit Export File" build phase script. Renamed WebCore.LP64.exp
+        to WebCore.PluginHostProcess.exp.
+
+2009-09-23  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29694
+        [Chromium] Eliminate dependency on gfx::Rect from ImageSkia.
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::drawResampledBitmap):
+
+2009-09-22  Timothy Hatcher  <timothy@apple.com>
+
+        Prevent scrolling multiple elements during latched wheel events.
+
+        Reviewed by Anders Carlsson.
+
+        * page/EventHandler.cpp:
+        (WebCore::scrollAndAcceptEvent):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/EventHandler.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scroll):
+        * rendering/RenderBox.h:
+
+2009-09-23  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29523
+        
+        Fixes an issue where a JavaScript URL that was URL-encoded twice can bypass the
+        XSSAuditor.
+        
+        The method FrameLoader::executeIfJavaScriptURL decodes the URL escape 
+        sequences in a JavaScript URL before it is eventually passed to the XSSAuditor.
+        Because the XSSAuditor also decodes the URL escape sequences as part of its
+        canonicalization, the double decoding of a JavaScript URL would
+        not match the canonicalization of the input parameters.
+
+        Tests: http/tests/security/xssAuditor/iframe-javascript-url-url-encoded.html
+               http/tests/security/xssAuditor/javascript-link-url-encoded.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Moved call to 
+        XSSAuditor::canEvaluateJavaScriptURL into FrameLoader::executeIfJavaScriptURL.
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Ditto.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeIfJavaScriptURL): Modified to call 
+        XSSAuditor::canEvaluateJavaScriptURL on the JavaScript URL before it is
+        decoded.
+
+2009-09-22  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29657
+        Columns don't break properly in positioned elements with a fixed height.  Make sure that
+        a block is still considered to have columns even when the column count is 1 if the column
+        width is non-auto.
+    
+        Added fast/multicol/positioned-with-constrained-height.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::setDesiredColumnCountAndWidth):
+
+2009-09-23  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Add a null check for the Document*. In the mirror benchmarking
+        application a crash from a call from JavaScript was observed.
+
+        I was not able to come up with a test case for this issue.
+
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookieJar):
+
+2009-09-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the Qt/Windows build, after the introduction of
+        the page client.
+
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+
+2009-09-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] media tests failing after their rework
+        https://bugs.webkit.org/show_bug.cgi?id=29532
+
+        Correctly advertise the mime types used by the common formats used
+        in the tests.
+
+        Tests that regressed, and will pass again:
+
+           media/video-canvas-source.html
+           media/video-controls.html
+           media/video-currentTime-set2.html
+           media/video-dom-autoplay.html
+           media/video-dom-src.html
+           media/video-error-abort.html
+           media/video-load-networkState.html
+           media/video-load-readyState.html
+           media/video-muted.html
+           media/video-no-autoplay.html
+           media/video-pause-empty-events.html
+           media/video-play-empty-events.html
+           media/video-seekable.html
+           media/video-seeking.html
+           media/video-size.html
+           media/video-source-type-params.html
+           media/video-source-type.html
+           media/video-source.html
+           media/video-src-change.html
+           media/video-src-invalid-remove.html
+           media/video-src-remove.html
+           media/video-src-set.html
+           media/video-src-source.html
+           media/video-src.html
+           media/video-timeupdate-during-playback.html
+           media/video-volume.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-09-22  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Eric Seidel.
+
+        Fix the crash problem with absolte positioned children in foreignobject
+        htts://bugs.webkit.org/show_bug.cgi?id=26342
+
+        Test: svg/custom/foreignobject-crash-with-absolute-positioned-children.svg
+
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::isSVGForeignObject):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGForeignObject):
+
+2009-09-22  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers "name" attribute is now optional.
+        https://bugs.webkit.org/show_bug.cgi?id=28897
+
+        Test: fast/workers/shared-worker-name.html
+
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        (WebCore::constructSharedWorker):
+        Default 'name' attribute to empty string if it is not provided.
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Default 'name' attribute to empty string if it is not provided.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::matches):
+        Now matches URLs if names are empty strings.
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        Pass URL in to SharedWorkerProxy::matches().
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, another build fix.
+
+        [Chromium] Add another missing include.
+        https://bugs.webkit.org/show_bug.cgi?id=29536
+
+        * inspector/InspectorController.cpp: Added DOMWindow.h include.
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Add missing include.
+        https://bugs.webkit.org/show_bug.cgi?id=29536
+
+        * inspector/InspectorDOMStorageResource.cpp: Added DOMWindow.h include.
+
+2009-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Tighten up the ScheduledRedirection machinery to prepare for a bug fix
+        https://bugs.webkit.org/show_bug.cgi?id=29663
+
+        * loader/FrameLoader.cpp:
+        (WebCore::ScheduledRedirection::ScheduledRedirection): Added a boolean,
+        initialized to false, to keep track if the redirection has been
+        communicated to the client.
+        (WebCore::FrameLoader::stopLoading): Tweaked a comment.
+        (WebCore::FrameLoader::cancelRedirection): Removed code to clear
+        m_scheduledRedirection.clear since stopRedirectionTimer does that now.
+        (WebCore::FrameLoader::allChildrenAreComplete): Added.
+        (WebCore::FrameLoader::checkCompleted): Use allChildrenAreComplete
+        function for clarity.
+        (WebCore::FrameLoader::checkCallImplicitClose): Ditto.
+        (WebCore::FrameLoader::scheduleRedirection): Changed to take a PassOwnPtr.
+        (WebCore::FrameLoader::startRedirectionTimer): Added code to set the
+        toldClient flag and not call clientRedirected a second time if it is set.
+        (WebCore::FrameLoader::stopRedirectionTimer): Changed so this can be safely
+        called multiple times and it will call clientRedirectCancelledOrFinished
+        only once.
+
+        * loader/FrameLoader.h: Changed scheduleRedirection to be a PassOwnPtr.
+        Added allChildrenAreComplete function.
+
+2009-09-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate Databases tab to InjectedScript /
+        serialized interaction.
+
+        DOMStorage interaction is now serialized into JSON messages
+        and doesn't require quarantined objects.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28873
+
+        * dom/EventListener.h:
+        (WebCore::EventListener::):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::selectDOMStorage):
+        (WebCore::InspectorBackend::getDOMStorageEntries):
+        (WebCore::InspectorBackend::setDOMStorageItem):
+        (WebCore::InspectorBackend::removeDOMStorageItem):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::selectDOMStorage):
+        (WebCore::InspectorController::getDOMStorageEntries):
+        (WebCore::InspectorController::setDOMStorageItem):
+        (WebCore::InspectorController::removeDOMStorageItem):
+        (WebCore::InspectorController::getDOMStorageResourceForId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
+        (WebCore::InspectorDOMStorageResource::bind):
+        (WebCore::InspectorDOMStorageResource::unbind):
+        (WebCore::InspectorDOMStorageResource::startReportingChangesToFrontend):
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        (WebCore::InspectorDOMStorageResource::operator==):
+        * inspector/InspectorDOMStorageResource.h:
+        (WebCore::InspectorDOMStorageResource::cast):
+        (WebCore::InspectorDOMStorageResource::id):
+        (WebCore::InspectorDOMStorageResource::domStorage):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
+        (WebCore::InspectorFrontend::didSetDOMStorageItem):
+        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
+        (WebCore::InspectorFrontend::updateDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorage):
+        (WebInspector.DOMStorage.prototype.get id):
+        (WebInspector.DOMStorage.prototype.get domStorage):
+        (WebInspector.DOMStorage.prototype.get isLocalStorage):
+        (WebInspector.DOMStorage.prototype.getEntriesAsync):
+        (WebInspector.DOMStorage.prototype.setItemAsync):
+        (WebInspector.DOMStorage.prototype.removeItemAsync):
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.show):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.selectDOMStorage):
+        (WebInspector.StoragePanel.prototype.updateDOMStorage):
+        (WebInspector.StoragePanel.prototype._domStorageForId):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDOMStorage):
+        (WebInspector.updateDOMStorage):
+
+2009-09-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix for XMLHttpRequest.abort() should destroy the response text.
+        https://bugs.webkit.org/show_bug.cgi?id=29658
+        <rdar://problem/5301430>
+
+        Clearing the response text after calling XMLHttpRequest.abort() is necessary
+        per spec and matches Firefox. It is also a potential memory win.
+
+        Test: http/tests/xmlhttprequest/abort-should-destroy-responseText.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::abort): Clear the response text making sure to
+        keep the actual ResourceReponse around so that the response status and response
+        status text are kept around.
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r48639.
+        http://trac.webkit.org/changeset/48639
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+
+2009-09-22  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Changing the transaction coordinator to (re-)allow multiple read
+        transactions on the same database to run concurrently (without
+        risking a deadlock this time).
+
+        https://bugs.webkit.org/show_bug.cgi?id=29115
+
+        Tests: storage/read-and-write-transactions-dont-run-together.html
+               storage/read-transactions-running-concurrently.html
+
+        * storage/SQLTransaction.h:
+        (WebCore::SQLTransaction::isReadOnly): Returns the type of the
+        transaction.
+        * storage/SQLTransactionCoordinator.cpp:
+        (WebCore::SQLTransactionCoordinator::acquireLock): Changed to
+        allow multiple read transactions on the same DB to run
+        concurrently.
+        (WebCore::SQLTransactionCoordinator::releaseLock): Changed to
+        allow multiple read transactions on the same DB to run
+        concurrently.
+        (WebCore::SQLTransactionCoordinator::shutdown): Renamed the map.
+        * storage/SQLTransactionCoordinator.h:
+
+2009-09-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29652
+        Support true system colors for CSS system colors in Chromium/Win.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::cssValueIdToSysColorIndex):
+        (WebCore::RenderThemeChromiumWin::systemColor):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-09-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6925121> SAP: Wrong width calculation in 
+        table with fixed layout
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29501
+
+        New Tests:
+        * fast/table/fixed-table-with-percent-inside-percent-table.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-auto-table.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-div.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-extra-large-div.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-fixed-width-table.html: Added.
+        * fast/table/fixed-table-with-small-percent-width.html: Added.
+
+        This new quirk is very similar to an existing one that was 
+        implemented in revision 4316.
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcPrefWidths):
+
+2009-09-22  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        List HTTP status code with response headers in resources tab of Web Inspector.
+        http://webkit.org/b/19945
+
+        This patch adds a new top level list in the resources tab, HTTP Information, that 
+        for now, contains the Request Method (GET, POST, etc.) and the Status Code (200, 404, etc.).
+        Additionally, it adds a colored dot next to the requested URL to show the status 
+        (green for success, orange for redirect, red for error).
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ImageView.js:
+        (WebInspector.ImageView):
+        * inspector/front-end/Images/errorRedDot.png: Added.
+        * inspector/front-end/Images/successGreenDot.png: Added.
+        * inspector/front-end/Images/warningOrangeDot.png: Added.
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.StatusTextForCode):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._refreshURL):
+        (WebInspector.ResourceView.prototype._refreshHTTPInformation):
+        * inspector/front-end/inspector.css:
+
+2009-09-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Back list isn't properly updated for fragment changes after a redirect.
+        <rdar://problem/6142803> and https://bugs.webkit.org/show_bug.cgi?id=20355
+
+        Test: fast/loader/fragment-after-redirect-gets-back-entry.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL): Properly reset the policy FrameLoadType before
+          consulting the policy delegate for fragment scrolling.
+
+2009-09-22  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Drop down selects get stuck in the non-visible state and cannot be opened.
+        https://bugs.webkit.org/show_bug.cgi?id=29645
+
+        All paths that lead to hiding the popup menu must call popupDidHide on
+        the PopupMenuClient.  This change makes it so by moving all of the
+        hiding logic to PopupListBox::hidePopup.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupListBox::hidePopup):
+        * platform/chromium/PopupMenuChromium.h:
+
+2009-09-22  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector.log() function not protected if console not yet created
+        https://bugs.webkit.org/show_bug.cgi?id=29336
+        
+        No new tests.  Only affects Web Inspector developers adding logging
+        to their code during development.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.log.isLogAvailable):
+        (WebInspector.log.flushQueue):
+        (WebInspector.log.flushQueueIfAvailable):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2009-09-22  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+
+        Ported chromium.org's webcore.gyp for the webkit chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29617
+
+        * WebCore.gyp/WebCore.gyp: Added.
+
+2009-09-22  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Don't keep clean wrappers artificially alive        
+        We currently keep all DOM node wrappers alive, even when there are
+        no more references to them from JS, in case they have properties
+        that we need to keep around if new JS references are created.
+        This changes the policy to only keep wrappers artificially alive
+        if they have changed since they were created. Empty wrappers are
+        discarded and recreated as needed.
+        https://bugs.webkit.org/show_bug.cgi?id=29330
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+
+2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: console.count and console.timeEnd
+        crash when inspector is opened.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29632
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+
+2009-09-22  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Fix bogus build fix I did last night.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        NPAPI/Mac: Don't paint plugins if we don't have a CGContextRef
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reivewed by Simon Hausmann.
+
+        Fix the Qt/Mac build after r48604 (Implement new QWebPageClient class)
+
+        There's no QWidget::x11Info() on Mac, and setPlatformPluginWidget()
+        takes a QWidget*, not a QWebPageClient*
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+
+2009-09-21  Adam Barth  <abarth@webkit.org>
+
+        Attempted fix for the V8 build.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-09-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Don't re-enter JavaScript after performing access checks
+        https://bugs.webkit.org/show_bug.cgi?id=29531
+
+        Moved the access check slightly later in this functions to avoid
+        re-entering the JavaScript interpreter (typically via toString)
+        after performing the access check.
+
+        I can't really think of a meaningful test for this change.  It's more
+        security hygiene.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::assign):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::if):
+        (CALLBACK_FUNC_DECL):
+        (V8Custom::WindowSetLocation):
+        (V8Custom::ClearTimeoutImpl):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-21  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make all write transaction start with a BEGIN IMMEDIATE command
+        instead of BEGIN.
+
+        We cannot test this change in a layout test, because in order to
+        test it we need to spawn two database threads and execute
+        transaction steps on these two threads in a very specific order,
+        which seems impossible to do when they share the same main thread
+        (as they would in a layout test). The SQLite docs and the case
+        described in the bug though should be enough proof that we do have
+        a problem here and that this patch will fix it.
+
+        Relevant SQLite documentation:
+        http://www.sqlite.org/lang_transaction.html
+        http://www.sqlite.org/lockingv3.html#locking
+
+        https://bugs.webkit.org/show_bug.cgi?id=29218
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::SQLiteTransaction): Added a readOnly
+        parameter.
+        (WebCore::SQLiteTransaction::begin): Changed to BEGIN IMMEDIATE
+        for write transactions.
+        * platform/sql/SQLiteTransaction.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::openTransactionAndPreflight): Passing
+        the read-only flag to the SQLiteTransaction instance.
+
+2009-09-21  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Mark Rowe.
+
+        * DerivedSources.make: Fix the Xcode build on SnowLeopard.
+
+2009-09-15  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Prevent sleeps in unload handlers.
+        https://bugs.webkit.org/show_bug.cgi?id=29193
+
+        Test: fast/dom/Window/slow_unload_handler.html
+
+        * WebCore.gypi:
+        * bindings/v8/DateExtension.cpp: Added.
+        (WebCore::DateExtension::DateExtension):
+        (WebCore::DateExtension::get):
+        (WebCore::DateExtension::setAllowSleep):
+        (WebCore::DateExtension::GetNativeFunction):
+        (WebCore::DateExtension::weakCallback):
+        (WebCore::DateExtension::GiveEnableSleepDetectionFunction):
+        (WebCore::DateExtension::OnSleepDetected):
+        * bindings/v8/DateExtension.h: Added.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::registerExtensionWithV8):
+        (WebCore::V8Proxy::registeredExtensionWithV8):
+        * bindings/v8/V8Proxy.h:
+
+2009-09-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Run-time exception in onmessage handler is not forwarded to the
+        worker object.
+        https://bugs.webkit.org/show_bug.cgi?id=28980
+
+        The previous fix was partially reverted due to a reliability build break
+        in chromium. The break happens when an exception is thrown without
+        setting a message. We need to check for this scenario and handle it.
+
+        Tested by worker-close.html.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-09-21  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser & Sam Weinig.
+
+        Add ENABLE(ORIENTATION_EVENTS)
+        https://bugs.webkit.org/show_bug.cgi?id=29508
+        
+        See documentation here:
+        http://developer.apple.com/safari/library/documentation/AppleApplications/Reference/SafariWebContent/HandlingEvents/HandlingEvents.html#//apple_ref/doc/uid/TP40006511-SW16
+
+        * DerivedSources.make: Use new WebCore.OrientationEvents.exp file if ENABLE_ORIENTATION_EVENTS.
+        Add ENABLE_ORIENTATION_EVENTS to the new ADDITIONAL_IDL_DEFINES variable that is passed to the IDL
+        code generator. This is because ENABLE_ORIENTATION_EVENTS is not in FEATURE_DEFINES.
+        * WebCore.OrientationEvents.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.OrientationEvents.exp.
+        * dom/EventNames.h: Add onorientationchange.
+        * html/HTMLAttributeNames.in: Ditto.
+        * html/HTMLBodyElement.cpp: Handle onorientationchange properly.
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        (WebCore::HTMLBodyElement::onorientationchange):
+        (WebCore::HTMLBodyElement::setOnorientationchange):
+        * html/HTMLBodyElement.h: Ditto.
+        * html/HTMLBodyElement.idl: Ditto.
+        * html/HTMLFrameSetElement.cpp: Ditto.
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        (WebCore::HTMLFrameSetElement::onorientationchange):
+        (WebCore::HTMLFrameSetElement::setOnorientationchange):
+        * html/HTMLFrameSetElement.h: Ditto.
+        * html/HTMLFrameSetElement.idl: Ditto.
+        * page/DOMWindow.cpp: Ditto.
+        (WebCore::DOMWindow::orientation): Calls up the to the Frame for the orientation value.
+        (WebCore::DOMWindow::onorientationchange):
+        (WebCore::DOMWindow::setOnorientationchange):
+        * page/DOMWindow.h: Handle onorientationchange properly.
+        * page/DOMWindow.idl: Ditto.
+        * page/Frame.cpp: Ditto.
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::sendOrientationChangeEvent):
+        * page/Frame.h: Ditto.
+        (WebCore::Frame::orientation):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Try fixing the build again.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: completions are always evaluated against
+        window (discarding call frames).
+
+        https://bugs.webkit.org/show_bug.cgi?id=29616
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.selectedCallFrameId):
+
+2009-09-21  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows (Cairo) target.
+
+        Add stubs for SocketStream classes added in @r47788, which
+        broke the WinCairo build.
+
+        No new tests. (Build failure).
+
+        * WebCore.vcproj/WebCore.vcproj:  Add references to new files
+          to Cairo build, exclude from standard Apple build.
+        * platform/network/curl/SocketStreamError.h: Added.
+        * platform/network/curl/SocketStreamHandle.h: Added.
+        * platform/network/curl/SocketStreamHandleCurl.cpp: Added.
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Expose InspectorResource fields.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29537
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::sourceString):
+        (WebCore::InspectorResource::resourceData):
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::requestHeaderFields):
+        (WebCore::InspectorResource::responseHeaderFields):
+        (WebCore::InspectorResource::responseStatusCode):
+        (WebCore::InspectorResource::requestMethod):
+        (WebCore::InspectorResource::requestFormData):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: JS error drilling down childless node.
+        No need to dispatch double click twice - it is already handled
+        in TreeElement.treeElementDoubleClicked.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22144
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline):
+
+2009-09-21  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Implement new QWebPageClient class and let our classes
+        QWebViewPrivate and QWebGraphicsItemPrivate inherit from it.
+
+        For Qt, platformPageClient() will now return a class derived from
+        the QWebPageClient, so the patch adapts our Qt hooks to go though
+        this class and not depend on the QWebView.
+
+        * WebCore.pro:
+        * platform/Widget.h:
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QWebPageClient.h: Added.
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Evaluating on call frame always returns "undefined".
+
+        https://bugs.webkit.org/show_bug.cgi?id=29613
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.evaluateInCallFrame):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Exception formatting is broken in console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29608
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleCommandResult):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript.createProxyObject):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Console object formatting is broken.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29607
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._format):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy.wrapPrimitiveValue):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Crash When Logging an Element Before Opening Inspector
+
+        https://bugs.webkit.org/show_bug.cgi?id=29514
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+
+2009-09-21  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Incorrect clipping with accelerated compositing content, and position:fixed
+        https://bugs.webkit.org/show_bug.cgi?id=29347
+        
+        Fix the compositing clipping logic to behave correctly when position:fixed
+        elements clip, by using the new backgroundClipRect() method to determine
+        when we need to clip, and to compute the clipping layer position.
+
+        Test: compositing/overflow/fixed-position-ancestor-clip.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::clippedByAncestor):
+
+2009-09-21  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add back in a special case for window.top in the V8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29605
+
+        Fixes LayoutTests/fast/dom/Window/window-property-shadowing.html in the Chromium port.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Ensure window.top is not marked as read only, as this breaks the shadowing disabling.
+
+2009-09-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        HTMLMediaElement: media file should not reload when page comes out of page cache
+        https://bugs.webkit.org/show_bug.cgi?id=29604
+
+        Test: media/restore-from-page-cache.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::userCancelledLoad): Do nothing unless the element
+        is still loading. Only fire an 'emptied' event if the readyState is HAVE_NOTHING,
+        otherwise set the network state to NETWORK_IDLE.
+
+2009-09-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Sean/Shawn/Shaun" Garen.
+
+        Clarify two FIXMEs.
+
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+
+2009-09-21  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Drop down selects fail to close when a value is selected
+        https://bugs.webkit.org/show_bug.cgi?id=29582
+
+        Implement PopupListBox::hidePopup, which was previously
+        declared but unimplemented.  Removes the declaration of
+        showPopup since that method is not implemented.
+
+        PopupListBox::hidePopup takes care of hiding the popup,
+        by invoking hidePopup on its parent PopupContainer, and
+        then informs the PopupMenuClient that popupDidHide.
+        This mimics the old behavior prior to r48370.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::hidePopup):
+
+2009-09-21  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] Windows build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=29535
+
+        * platform/network/qt/DnsPrefetchHelper.cpp: Missing #include "config.h"  added.
+
+2009-09-21  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix. Missing files.
+
+        * GNUmakefile.am:
+
+2009-09-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Crash when clicking link in unload handler
+        https://bugs.webkit.org/show_bug.cgi?id=29525
+
+        Test that the first navigation always wins when the page tries to start
+        a new navigation in an unload handler.
+
+        Tests: fast/loader/unload-form-about-blank.html
+               fast/loader/unload-form-post-about-blank.html
+               fast/loader/unload-form-post.html
+               fast/loader/unload-form.html
+               fast/loader/unload-hyperlink.html
+               fast/loader/unload-javascript-url.html
+               fast/loader/unload-reload.html
+               fast/loader/unload-window-location.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+
+2009-09-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Sometimes crashes when a page is destroyed/loads another URL while playing video
+        https://bugs.webkit.org/show_bug.cgi?id=29496
+
+        Protect the video sink object, and destroy it in an idle callback
+        to hopefully avoid a race condition that leads to a crash.
+
+        This is already tested by media/video-seekable.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::idleUnref):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+
+2009-09-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix for GTKand a blind one for Qt after r48566.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-09-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29519
+        Remove JSNameNodeCollection and just use StaticNodeList
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        * bindings/js/JSNamedNodesCollection.cpp: Removed.
+        * bindings/js/JSNamedNodesCollection.h: Removed.
+
+2009-09-19  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29511
+        
+        Fixes an issue where script code that contains non-ASCII characters may bypass the 
+        XSSAuditor.
+        
+        Before performing a comparison between the script source code and input parameters, we
+        remove all non-ASCII characters, including non-printable ASCII characters from the
+        script source code and input parameters.
+
+        Tests: http/tests/security/xssAuditor/img-onerror-non-ASCII-char.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char-default-encoding.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2-default-encoding.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isNonCanonicalCharacter): Modified to remove all non-ASCII characters,
+        including non-printable ASCII characters.
+
+2009-09-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Incorrect animation with scale(0) transform (singular matrix)
+        https://bugs.webkit.org/show_bug.cgi?id=29465
+        
+        Make accelerated scale() and translate() animations go through the component animation
+        path (rather than just matrix animation) to avoid problems with singular scale matrices,
+        and be slightly more efficient.
+
+        Test: compositing/transitions/singular-scale-transition.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getTransformFunctionValue):
+        (WebCore::getValueFunctionNameForTransformOperation):
+
+2009-09-19  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Adds CSS styling and basic DOM element support for MathML
+
+        * DerivedSources.make:
+          Added user stylesheet and tag factory generation
+
+        * WebCore.xcodeproj/project.pbxproj:
+          Added new DOM element code
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAttr):
+          Added check for document since stylesheet can be added before there is a document
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForElement):
+          Added check to add MathML user agent stylesheet
+
+        * css/mathml.css: Added.
+          MathML user agent stylesheet
+
+        * dom/Document.cpp:
+        (WebCore::Document::createElement):
+          Added support for creation of MathML DOM objects
+
+        * dom/Node.h:
+        (WebCore::Node::isMathMLElement):
+          Added check method for whether the node is a MathML node
+
+        * mathml: Added.
+        * mathml/MathMLElement.cpp: Added.
+        (WebCore::MathMLElement::MathMLElement):
+        (WebCore::MathMLElement::create):
+        (WebCore::MathMLElement::createRenderer):
+        * mathml/MathMLElement.h: Added.
+        (WebCore::MathMLElement::isMathMLElement):
+          MathML DOM base class
+
+
+        * mathml/MathMLInlineContainerElement.cpp: Added.
+        (WebCore::MathMLInlineContainerElement::MathMLInlineContainerElement):
+        (WebCore::MathMLInlineContainerElement::create):
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/MathMLInlineContainerElement.h: Added.
+          Base class for non-text containers
+
+        * mathml/MathMLMathElement.cpp: Added.
+        (WebCore::MathMLMathElement::MathMLMathElement):
+        (WebCore::MathMLMathElement::create):
+        * mathml/MathMLMathElement.h: Added.
+          Root Math element
+
+        * mathml/mathtags.in: Added.
+          Element list mappings
+
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+          Added MathML name initialization
+2009-09-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Canvas drawn with data URL image raises SECURITY_ERR when toDataUrl() called.
+        https://bugs.webkit.org/show_bug.cgi?id=29305
+
+        We need to special-case data URLs when tainting a canvas because we
+        treat data URLs has having no security origin, unlike other
+        browsers.  The reason we do this is to help sites avoid XSS via data
+        URLs, but that consideration doesn't apply to canvas taint.
+
+        Also, we were previously incorrectly taking document.domain state
+        into account when tainting canvas.
+
+        Tests: http/tests/security/canvas-remote-read-data-url-image.html
+               http/tests/security/canvas-remote-read-data-url-svg-image.html
+               http/tests/security/canvas-remote-read-remote-image-document-domain.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::checkOrigin):
+        (WebCore::CanvasRenderingContext2D::createPattern):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::taintsCanvas):
+        * page/SecurityOrigin.h:
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix stylistic issue raised in code review for previous commit.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::hasNonZeroTransformOrigin):
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Element is misplaced during opacity transition with certain configuration of transform-origin and clipping
+        https://bugs.webkit.org/show_bug.cgi?id=29495
+        
+        If an element has zero size, but has a transform origin with absolute values,
+        then the transform origin would not be applied because it is implemented via
+        anchorPoint, which is expressed as a fraction of the layer size.
+        
+        Work around this by artificially inflating the size of the backing store when we need to.
+
+        Test: compositing/geometry/transfrom-origin-on-zero-size-layer.html
+
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        Init m_artificiallyInflatedBounds to false.
+        
+        (WebCore::hasNonZeroTransformOrigin):
+        Utility function that describes whether the transform-origin contains non-percentage
+        x or y offsets.
+        
+        (WebCore::RenderLayerBacking::updateCompositedBounds):
+        New wrapper method around setCompositedBounds() that applies the size inflation
+        when necessary, setting the m_artificiallyInflatedBounds as appropriate.
+        
+        (WebCore::RenderLayerBacking::updateAfterLayout): Call updateCompositedBounds().
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Ditto
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Ditto
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry): Ditto
+
+2009-09-18  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29512
+        Don't recalculate style when restoring from the page cache
+
+        FrameLoaderClient::forceLayout() also forces style recalc. Instead call FrameView::forceLayout() 
+        directly to update the scrollbars while keeping the existing style.
+        
+        Makes back/forward really fast on complex pages (in cases where page cache works).
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad):
+
+2009-09-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Implement ES5 Object.defineProperty function
+        https://bugs.webkit.org/show_bug.cgi?id=29503
+
+        Override defineOwnProperty on JSDOMWindowShell to forward appropriately,
+        and then override defineOwnProperty on JSDOMWindow to disallow cross origin
+        defineOwnProperty usage.  We also override defineOwnProperty on QuarantinedObjectWrapper
+        to ensure correct wrapping semantics of quarantined objects.
+
+        One major caveat in this patch is that it currently disallows the use
+        of Object.defineProperty on DOMObjects other than the window due to
+        the significant work involved in correctly propagating attributes and
+        ensuring correct semantics on dom objects.
+
+        Tests: fast/js/Object-defineProperty.html
+               http/tests/security/xss-DENIED-defineProperty.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMObject::defineOwnProperty):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::defineGetter):
+        (WebCore::JSDOMWindow::defineSetter):
+        (WebCore::JSDOMWindow::defineOwnProperty):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::defineOwnProperty):
+        (WebCore::JSDOMWindowShell::defineGetter):
+        (WebCore::JSDOMWindowShell::defineSetter):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::defineGetter):
+        (WebCore::JSLocationPrototype::defineGetter):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
+        (WebCore::JSQuarantinedObjectWrapper::defineOwnProperty):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-09-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29510
+        Active DOM objects should be suspended while a modal dialog is displayed
+
+        * manual-tests/js-timers-beneath-modal-dialog.html: Added a test for JS timers.
+
+        * page/PageGroupLoadDeferrer.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+        Match other platforms, and make Mac also suspend active DOM objects. Since a page that
+        currently displays a modal dialog cannot go into page cache, there is no danger of suspending
+        an object twice.        
+
+2009-09-18  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Buildfix caused by http://trac.webkit.org/changeset/48513
+        https://bugs.webkit.org/show_bug.cgi?id=29351
+
+        * bridge/qt/qt_instance.h: createRuntimeObject method renamed to newRuntimeObject.
+        * bridge/runtime.h: Visibility of newRuntimeObject method modified to protected.
+
+2009-09-18  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix parameter substitutions in console.log().
+
+        https://bugs.webkit.org/show_bug.cgi?id=29366
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._format):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getPrototypes):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+        * inspector/front-end/utilities.js:
+        ():
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen and Brady Eidson.
+
+        Temporarily remove an assertion that was getting hit when going
+        back to a page in the page cache while a banner in Safari was visible.
+        We should re-enable this once that is fixed. See <rdar://problem/7218118>
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scheduleRelayout):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Try fixing the build again.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Fix windows build.
+        
+        * platform/win/PopupMenuWin.cpp:
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin 'BearClaw' Barraclough.
+
+        Convert another callback type object to store the global object
+        instead of the frame.
+
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::create):
+        (WebCore::JSCustomXPathNSResolver::JSCustomXPathNSResolver):
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSCustomXPathNSResolver.h:
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29332
+        <rdar://problem/7231652> 
+        REGRESSION (r48446): While a <select> popup menu is open, the
+        rest of the WebView doesn't respond to mouse move events.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::translatePoint):
+        New helper function that translates a point between HWND coordinates.
+        
+        (WebCore::PopupMenu::show):
+        Protect the PopupMenu if someone removes the <select> in response to a mouse
+        event. Handle WM_HOST_WINDOW_MOUSEMOVE events.
+        
+        (WebCore::PopupMenu::wndProc):
+        in the WM_MOUSEMOVE handler, if the mouse is not over the popup, post a 
+        WM_HOST_WINDOW_MOUSEMOVE event so that the host window (the WebView) gets the
+        mouse move event.
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Compositing layers are incorrectly positioned after scrolling with position:fixed
+        https://bugs.webkit.org/show_bug.cgi?id=29262
+        
+        When scrolling a page with compositing layers inside a position:fixed element,
+        we need to update the compositing layer positions when the scroll position changes.
+
+        Test: compositing/geometry/fixed-position.html
+
+        * WebCore.base.exp:
+        Export FrameView::scrollPositionChanged()
+        
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollPositionChanged):
+        New method that sends the scroll event, and updates compositing layers positions if necessary.
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Transformed elements inside position:fixed container are clipped incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=29346
+        
+        Fix clipping and hit testing on transformed elements inside a position:fixed element.
+        Previously, the code used the overflowClipRect of the parent clip rects, but
+        this is not correct for fixed postion elements. Instead, share code that is
+        already present in calculateRects() to get the correct rect.
+
+        Test: fast/overflow/position-fixed-transform-clipping.html
+
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        Call the new backgroundClipRect() to get the correct clipRect.
+        
+        (WebCore::RenderLayer::backgroundClipRect):
+        New method, factored out of calculateRects(), that computes the clip rect,
+        doing the right thing for fixed position elements.
+        
+        (WebCore::RenderLayer::calculateRects):
+        Call the new backgroundClipRect() method.
+        
+2009-09-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <rdar://problem/7050773> REGRESSION (r40098) Crash at
+        WebCore::RenderBlock::layoutBlock()
+        https://bugs.webkit.org/show_bug.cgi?id=29498
+
+        Test: accessibility/nested-layout-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::updateBackingStore): Changed to
+            call Document::updateLayoutIgnorePendingStylesheets() instead of
+            calling RenderObject::layoutIfNeeded(). The latter requires that
+            there be no pending style recalc, which allows methods that call
+            Document::updateLayout() to be called during layout without risking
+            re-entry into layout.
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityActionNames]): Null-check
+            m_object after calling updateBackingStore(), since style recalc may
+            destroy the renderer, which destroys the accessibility object and
+            detaches it from the wrapper.
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityFocusedUIElement]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityHitTest:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIsIgnored]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+             Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformAction:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+            Ditto.
+
+2009-09-18  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Simon Hausmann.
+
+        Update Qt build system for Web Socket.
+        https://bugs.webkit.org/show_bug.cgi?id=29270
+
+        * WebCore.pro:
+        * platform/network/qt/SocketStreamError.h: Added.
+        * platform/network/qt/SocketStreamHandle.h: Added.
+        * platform/network/qt/SocketStreamHandleSoup.cpp: Added.
+
+2009-09-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        NULL check HTMLMediaElement::m_playedTimeRanges.
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29494
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::addPlayedRange): New. Create m_playedTimeRanges if
+        necessary, add range specified.
+        (WebCore::HTMLMediaElement::seek): Use addPlayedRange. 
+        (WebCore::HTMLMediaElement::played): Use addPlayedRange. Change time comparison 
+        to be more readable.
+        (WebCore::HTMLMediaElement::updatePlayState): Ditto.
+        * html/HTMLMediaElement.h:
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Follow up fix for https://bugs.webkit.org/show_bug.cgi?id=29276
+        REGRESSION(r48334): WebKit crashes on file select by drag
+
+        Don't use Document.elementFromPoint since it returns null if the point
+        is outside the viewport.  Instead, just hit test ourselves.
+
+        Test: fast/events/drag-file-crash.html
+
+        * page/DragController.cpp:
+        (WebCore::elementUnderMouse):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+
+2009-09-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Each wrapped Objective-C object should use a single RuntimeObjectImp
+        https://bugs.webkit.org/show_bug.cgi?id=29351
+        rdar://problem/7142294
+
+        * WebCore.base.exp: Added a newly-needed exported symbol.
+
+        * bindings/objc/DOMInternal.h: Eliminated unused
+        createWrapperCacheWithIntegerKeys; it has not been needed since the
+        RGBColor wrappers were reworked.
+        * bindings/objc/DOMInternal.mm: Ditto.
+
+        * bridge/objc/objc_instance.h: Made the create function non-inline.
+        * bridge/objc/objc_instance.mm:
+        (createInstanceWrapperCache): Added. Creates an appropriate map table.
+        (ObjcInstance::create): Moved here from header. Uses NSMapGet and
+        NSMapInsert to cache the instance in a map table.
+        (ObjcInstance::~ObjcInstance): Added a call to NSMapRemove to remove
+        the instance from the map table.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance): Remove unneeded code to remove
+        the instance from cachedObjects, which no longer exists.
+        (JSC::Bindings::QtInstance::newRuntimeObject): Renamed to overload new
+        bottleneck. Caching is now handled by the base class.
+
+        * bridge/runtime.cpp:
+        (JSC::Bindings::Instance::Instance): Initialize m_runtimeObject to 0.
+        (JSC::Bindings::Instance::~Instance): Assert m_runtimeObject is 0.
+        (JSC::Bindings::Instance::createRuntimeObject): Use m_runtimeObject
+        if it's already set. Set m_runtimeObject and call addRuntimeObject
+        if it's not.
+        (JSC::Bindings::Instance::newRuntimeObject): Added. Virtual function,
+        used only by createRuntimeObject.
+        (JSC::Bindings::Instance::willDestroyRuntimeObject): Added.
+        Calls removeRuntimeObject and then clears m_runtimeObject.
+        (JSC::Bindings::Instance::willInvalidateRuntimeObject): Added.
+        Clears m_runtimeObject.
+
+        * bridge/runtime.h: Made createRuntimeObject non-virtual. Added
+        willDestroyRuntimeObject, willInvalidateRuntimeObject,
+        newRuntimeObject, and m_runtimeObject.
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp): Removed addRuntimeObject
+        call, now handled by caller.
+        (JSC::RuntimeObjectImp::~RuntimeObjectImp): Replaced removeRuntimeObject
+        call with willDestroyRuntimeObject call; the latter nows calls
+        removeRuntimeObject.
+        (JSC::RuntimeObjectImp::invalidate): Added willInvalidateRuntimeObject
+        call.
+
+        * bridge/runtime_object.h: Made invalidate non-virtual.
+
+2009-09-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make PlatformWindow return something else than PlatformWidget
+        https://bugs.webkit.org/show_bug.cgi?id=29085
+
+        Make platformWindow return a PlatformPageClient
+        (for now typedef'ed to PlatformWidget)
+
+        Also, change the name of platformWindow to platformPageClient()
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::platformPageClient):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::platformPageClient):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::wheelEvent):
+        (WebCore::EventHandler::currentPlatformMouseEvent):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::eventMayStartDrag):
+        * platform/HostWindow.h:
+        * platform/Widget.h:
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+        (WebCore::ScrollView::visibleContentRect):
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setCursor):
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::monitorInfoForWidget):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::calculatePositionAndSize):
+        (WebCore::PopupMenu::wndProc):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::nativeWindowForRenderObject):
+        * platform/wx/ScrollbarThemeWx.cpp:
+        (WebCore::ScrollbarThemeWx::paint):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+
+2009-09-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Web inspector UI adjustments specific to the Qt platform:
+        - Hide the close button
+        - Hide the dock button
+        - Disable the draggable toolbar
+
+        https://bugs.webkit.org/show_bug.cgi?id=29384
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.toolbarDragStart):
+
+2009-09-18  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        QtWebKit Windows CE compile fixes
+
+        Exclude certain pure-WINCE specific code paths from the Qt build.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/FontCache.h:
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop): Guard this code block with NETSCAPE_PLUGIN_API as
+        the corresponding PluginViewWndProc has the same guard in the header file.
+
+2009-09-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Geolocation does not correctly handle Infinity for PositionOptions properties.
+        https://bugs.webkit.org/show_bug.cgi?id=29099
+
+        * bindings/js/JSGeolocationCustom.cpp: Modified.
+        (WebCore::createPositionOptions): Modified. If timeout or maximumAge is positive infinity, applies these values as a special case.
+        * page/PositionOptions.h: Modified.
+        (WebCore::PositionOptions::hasMaximumAge): Added. Determines whether the object has a maximum age.
+        (WebCore::PositionOptions::maximumAge): Modified. Asserts that the object has a maximum age.
+        (WebCore::PositionOptions::clearMaximumAge): Added. Clears the maximum age.
+        (WebCore::PositionOptions::setMaximumAge): Modified. Registers that the maximum age has been set.
+        (WebCore::PositionOptions::PositionOptions): Modified. Registers that the maximum age has been set.
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29276
+        REGRESSION(r48334): WebKit crashes on file select by drag
+
+        Document.elementFromPoint now takes point in client space, not page space.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+
+2009-09-17  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        Reimplement default media UI for Mac Chromium to match the style
+        of the Windows and Linux versions.  Also breaks the dependency
+        on the internal wk* functions that were previously used to
+        render the media controller widgets.
+        https://bugs.webkit.org/show_bug.cgi?id=29161
+
+        No media layout tests are currently enabled in Mac Chromium, so
+        nothing needs rebaselineing, etc.
+
+        This is a recommit of r48438 with a compile fix and merges of
+        recent changes to the file.
+
+        * css/mediaControlsChromium.css:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::mediaElementParent):
+        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
+        (WebCore::mediaSliderThumbImage):
+        (WebCore::mediaVolumeSliderThumbImage):
+        (WebCore::RenderThemeChromiumMac::paintSliderTrack):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
+        (WebCore::RenderThemeChromiumMac::paintMediaButtonInternal):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize):
+
+2009-09-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        The Console scope bar should have a divider between All and the other possible
+        values (Errors, Warnings, Logs). It will look something like:
+        
+        All | Errors Warnings Logs.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createDividerElement):
+        (WebInspector.ConsoleView):
+        * inspector/front-end/inspector.css:
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove additional references to JSVoidCallback which no longer exists.
+
+        * DerivedSources.cpp:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Remove commented out onhashchange attribute now that it is implemented.
+
+        * page/DOMWindow.idl:
+
+2009-09-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7007541> 
+        CrashTracer: 4800crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
+        
+        Make RuntimeObjectImp more robust against m_instance being a null (which can happen if an OOP plug-in
+        crashes while we're calling into it).
+        
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp):
+        (JSC::RuntimeObjectImp::~RuntimeObjectImp):
+        (JSC::RuntimeObjectImp::invalidate):
+        (JSC::RuntimeObjectImp::fallbackObjectGetter):
+        (JSC::RuntimeObjectImp::fieldGetter):
+        (JSC::RuntimeObjectImp::methodGetter):
+        (JSC::RuntimeObjectImp::getOwnPropertySlot):
+        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
+        (JSC::RuntimeObjectImp::put):
+        (JSC::RuntimeObjectImp::defaultValue):
+        (JSC::RuntimeObjectImp::getCallData):
+        (JSC::RuntimeObjectImp::getConstructData):
+        (JSC::RuntimeObjectImp::getPropertyNames):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::getInternalInstance):
+
+2009-09-17  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Wrap primitive values (as objects) in InspectorController::wrap.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28983
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::wrapObject): objects of any type will be wrapped into proxies,
+         only object proxies will have objectId.
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions): there is InjectedScript.getCompletionsi
+         that accepts an expression and returns possible completions. This way we don't need to wrap
+         and unwrap the completions result into a proxy object.
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.createProxyObject):
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-09-17  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Wrap PageTransitionEvents properly for V8's use.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29340
+
+        Fixes Chromium's failures for LayoutTests/fast/events/pageshow-pagehide.html.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object): Wrap PageTransitionEvents properly.
+
+2009-09-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Hardware-accelerated opacity transition on inline asserts
+        https://bugs.webkit.org/show_bug.cgi?id=29342
+        
+        Remove an erroneous toRenderBox() that could be called on a RenderInline; we can just
+        pass an empty size, because the box size is only required for transform animations.
+
+        Test: compositing/transitions/opacity-on-inline.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startTransition):
+
+2009-09-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] OwnHandle might get a weak callback after destruction
+        https://bugs.webkit.org/show_bug.cgi?id=29172
+
+        Be sure to clear out weak reference so we don't get a weak callback
+        after we've destructed ourselves.  Also, removed some tricky methods
+        that had no clients.
+
+        * bindings/v8/OwnHandle.h:
+        (WebCore::OwnHandle::clear):
+
+2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Partial roll out of http://trac.webkit.org/changeset/48455 to
+        fix crashes that started happening in V8Proxy::getEnteredContext().
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+
+2009-09-17  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: labels of checkboxes should, when hit-tested, return the checkbox
+        https://bugs.webkit.org/show_bug.cgi?id=29335
+
+        When an accessibility hit test is done and it hits the label of a control element,
+        the control element should be returned instead of nothing, since the label
+        itself is usually ignored.
+
+        Test: accessibility/label-for-control-hittest.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::correspondingControlForLabelElement):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        (WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-09-17  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Dimitri Glazkov, build fix.
+
+        Change to make RenderThemeChromiumMac compile inside of non PLATFORM(MAC).
+        https://bugs.webkit.org/show_bug.cgi?id=29243
+
+        Covered by existing tests.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+
+2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Accessing properties/methods of an object, created with document.implementation.createDocumentType
+        creates nodes that have no document (ScriptExecutionContext), which in turn produces NULL-ref crashes.
+        https://bugs.webkit.org/show_bug.cgi?id=26402
+
+        Test: fast/dom/DOMImplementation/detached-doctype.html
+              fast/dom/doctype-event-listener-crash.html
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener): Added an extra NULL-check.
+
+2009-09-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        FontDescription.h includes RenderStyleConstants.h, which violates layering
+        https://bugs.webkit.org/show_bug.cgi?id=29327
+
+        * GNUmakefile.am: Added FontSmoothingMode.h.
+        * WebCore.gypi: Added FontSmoothingMode.h.
+        * WebCore.vcproj/WebCore.vcproj: Added FontSmoothingMode.h.
+        * WebCore.xcodeproj/project.pbxproj: Added FontSmoothingMode.h and made
+            it a private header.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Get the
+            font smoothing mode via the font description.
+        * css/CSSPrimitiveValueMappings.h: Include FontSmoothingMode.h
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Updated for the rename
+            of FontSmoothing to FontSmoothingMode.
+        (WebCore::CSSPrimitiveValue::operator FontSmoothingMode): Ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Get the font smoothing mode
+            via the font description.
+        * platform/graphics/FontDescription.h: Do not include
+            RenderStyleConstants.h.
+        (WebCore::FontDescription::fontSmoothing): Updated for the rename of
+            FontSmoothing to FontSmoothingMode.
+        (WebCore::FontDescription::setFontSmoothing): Ditto.
+        * platform/graphics/FontSmoothingMode.h: Added.
+        (WebCore::FontSmoothingMode): Moved the FontSmoothing enum from
+            RenderStyleConstants here and renamed it to this.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::fontSmoothing): Removed this getter, since
+            this can be accessed via the font description.
+        * rendering/style/RenderStyleConstants.h: Moved the FontSmoothing enum
+            from here to FontSmoothingMode.h.
+
+2009-09-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx 2.9 build fix.
+
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxGetGdkWindowForDC):
+
+2009-09-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Elements appear behind <video> when they should be in front sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=29314
+        
+        r45598 added logic that tests for overlap with <video> to determine when to throw
+        a layer into compositing mode. That logic was incorrect in some cases, and this patch
+        fixes it. When testing overlap, the layer needs to be composited iff some previous layer
+        is composited (which adds a rect to the overlay map), and there is overlap.
+
+        Test: compositing/geometry/video-opacity-overlay.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::CompositingState::CompositingState):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-09-17  Avi Drissman  <avi@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Update the Chromium Mac theming files (RenderTheme and Theme) to be
+        up-to-date.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29243
+        http://crbug.com/19604
+
+        Covered by existing tests.
+
+        * WebCore.gypi:
+        * platform/chromium/ThemeChromiumMac.h: Added.
+        (WebCore::ThemeChromiumMac::ThemeChromiumMac):
+        (WebCore::ThemeChromiumMac::~ThemeChromiumMac):
+        (WebCore::ThemeChromiumMac::controlRequiresPreWhiteSpace):
+        * platform/chromium/ThemeChromiumMac.mm: Added.
+        (WebCore::):
+        (WebCore::platformTheme):
+        (WebCore::controlSizeForFont):
+        (WebCore::sizeFromFont):
+        (WebCore::setControlSize):
+        (WebCore::updateStates):
+        (WebCore::inflateRect):
+        (WebCore::checkboxSizes):
+        (WebCore::checkboxMargins):
+        (WebCore::checkboxSize):
+        (WebCore::checkbox):
+        (WebCore::paintCheckbox):
+        (WebCore::radioSizes):
+        (WebCore::radioMargins):
+        (WebCore::radioSize):
+        (WebCore::radio):
+        (WebCore::paintRadio):
+        (WebCore::buttonSizes):
+        (WebCore::buttonMargins):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeChromiumMac::baselinePositionAdjustment):
+        (WebCore::ThemeChromiumMac::controlFont):
+        (WebCore::ThemeChromiumMac::controlSize):
+        (WebCore::ThemeChromiumMac::minimumControlSize):
+        (WebCore::ThemeChromiumMac::controlBorder):
+        (WebCore::ThemeChromiumMac::controlPadding):
+        (WebCore::ThemeChromiumMac::inflateControlPaintRect):
+        (WebCore::ThemeChromiumMac::paint):
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/IntRect.h:
+        * rendering/RenderThemeChromiumMac.h:
+        (WebCore::RenderThemeChromiumMac::supportsControlTints):
+        (WebCore::RenderThemeChromiumMac::scrollbarControlSizeForPart):
+        (WebCore::RenderThemeChromiumMac::supportsSelectionForegroundColors):
+        * rendering/RenderThemeChromiumMac.mm:
+        (-[WebCoreRenderThemeNotificationObserver systemColorsDidChange:]):
+        (-[RTCMFlippedView isFlipped]):
+        (-[RTCMFlippedView currentEditor]):
+        (WebCore::):
+        (WebCore::FlippedView):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeChromiumMac::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumMac::systemFont):
+        (WebCore::convertNSColorToColor):
+        (WebCore::menuBackgroundColor):
+        (WebCore::RenderThemeChromiumMac::systemColor):
+        (WebCore::RenderThemeChromiumMac::isControlStyled):
+        (WebCore::RenderThemeChromiumMac::adjustRepaintRect):
+        (WebCore::RenderThemeChromiumMac::inflateRect):
+        (WebCore::RenderThemeChromiumMac::convertToPaintingRect):
+        (WebCore::RenderThemeChromiumMac::setFontFromControlSize):
+        (WebCore::RenderThemeChromiumMac::paintTextField):
+        (WebCore::RenderThemeChromiumMac::paintCapsLockIndicator):
+        (WebCore::RenderThemeChromiumMac::paintTextArea):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::TopGradientInterpolate):
+        (WebCore::BottomGradientInterpolate):
+        (WebCore::MainGradientInterpolate):
+        (WebCore::TrackGradientInterpolate):
+        (WebCore::RenderThemeChromiumMac::paintMenuListButtonGradients):
+        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingRight):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingTop):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumMac::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSliderTrackStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbStyle):
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintSearchField):
+        (WebCore::RenderThemeChromiumMac::setSearchCellState):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldDecoration):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+        (WebCore::mediaControllerTheme):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
+        (WebCore::getMediaUIPartStateFlags):
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaRewindButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaReturnToRealtimeButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
+        (WebCore::RenderThemeChromiumMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeChromiumMac::paintMediaTimeRemaining):
+        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
+
+2009-09-16  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29306
+        
+        Fixes an issue where an attack that contains accented characters can
+        bypass the XSSAuditor.
+        
+        XSSAuditor::decodeURL used the wrong length for the input string. 
+        When the input string was decoded, the decoded result was truncated.
+        Hence, XSSAuditor was comparing the source code of the script to the 
+        truncated input parameters.
+
+        Test: http/tests/security/xssAuditor/img-onerror-accented-char.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::decodeURL):
+
+2009-09-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Explore allowing pages with unload handlers into the Page Cache
+        https://bugs.webkit.org/show_bug.cgi?id=29021
+
+        No new tests. (All previous tests continue to pass)
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): If the document is in the page cache, don't fire the unload event.
+
+2009-09-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a handle to the original context.  We use that handle to
+        call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-09-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a handle to the original context.  We use that handle to
+        call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-09-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add some groups to the xcode project to make the bindings/js/ group
+        a little nicer.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29320
+        JS callback objects should store the global object
+
+        This just changes the callback objects to store the global object instead
+        of the frame. A follow up patch will change them to store the 'current' 
+        global object instead of the lexical or dynamic.
+
+        * DerivedSources.make: Remove unused VoidCallback.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionCallback.h:
+        (WebCore::JSCustomPositionCallback::create):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        (WebCore::JSCustomPositionErrorCallback::create):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        (WebCore::JSCustomSQLStatementCallback::create):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        (WebCore::JSCustomSQLStatementErrorCallback::create):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::Data::Data):
+        (WebCore::JSCustomSQLTransactionCallback::Data::globalObject):
+        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        (WebCore::JSCustomSQLTransactionCallback::create):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        (WebCore::JSCustomSQLTransactionErrorCallback::create):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.h:
+        (WebCore::JSCustomVoidCallback::create):
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::JSDatabase::changeVersion):
+        (WebCore::createTransaction):
+        (WebCore::JSDatabase::transaction):
+        (WebCore::JSDatabase::readTransaction):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback):
+        (WebCore::createPositionErrorCallback):
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+
+2009-09-15  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <input maxlength=> should restrict only values specified by users.
+        https://bugs.webkit.org/show_bug.cgi?id=21271
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::InputElement::sanitizeValue):
+        (WebCore::InputElement::sanitizeUserInputValue): Rename from constrainValue().
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        (WebCore::InputElement::updateValueIfNeeded):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::value):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::sanitizeValue):
+        * html/HTMLInputElement.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::constrainValue):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::sanitizeValue):
+
+2009-09-16  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Reorganizing helper functions in htmlediting.h to group them by type of object they return/operate upon.
+        https://bugs.webkit.org/show_bug.cgi?id=29319
+
+        * editing/IndentOutdentCommand.cpp:
+        Removed implementation of isAtUnsplittableElement.
+
+        * editing/IndentOutdentCommand.h:
+        Removed member function isAtUnsplittableElement, because it was not class specific and belonged logically among the helper functions.
+
+        * editing/htmlediting.cpp:
+        (WebCore::isAtUnsplittableElement): added. The code was taken from IndentOutdentCommand.
+
+        * editing/htmlediting.h:
+        Reordered functions to group them by type of object returned or operate upon.
+        Added comments.
+        Added isAtUnsplittableElement declaration.
+
+2009-09-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig and Anders Carlsson.
+
+        Removed some vestigial and potentially crashy code that makes consolidating
+        event listeners hard.
+
+        * dom/Node.cpp:
+        (WebCore::Node::addEventListener): No need to limit when event listeners
+        can be added. Other EventTargets don't do this.
+        
+        Also, check for null when accessing document(). Technically, the JS bindings
+        do this check for us, but let's not rely on that.
+
+2009-09-16  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/7155710>
+        HTML selects on windows cause containing window to become inactive when opened
+        
+        Redo the way we handle events when a popup menu is shown, based on
+        http://blogs.msdn.com/oldnewthing/archive/2004/08/20/217684.aspx
+        
+        Since a non-active window can't capture the mouse, we use the owning window 
+        (the WebView) as the capture window. We then run a recursive message pump that 
+        forwards all mouse and keyboard events to the popup menu.
+        
+        * platform/PopupMenu.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Ada Chan.
+
+        Speculative fix for
+        <rdar://problem/6937089> Crashes at RenderWidget::destroy()
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy): Avoid calling renderArena() if node()
+        is null. Add two assertions that can help determine how this crash
+        happens (in particular, whether node() becomes null during destroy() or
+        it is null before destroy() is called).
+
+2009-09-16  Beth Dakin  <bdakin@apple.com>
+
+        Speculative build fix.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2009-09-16  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7083741> Implement a CSS extension to 
+        adjust sub-pixel anti-aliasing for text
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29291
+
+        Added tests:
+        * fast/css/font-smoothing.html: Added.
+        * fast/css/parsing-webkit-font-smoothing.html: Added.
+
+        This patch adds a new CSS property called -webkit-font-smoothing 
+        that accepts the following as valid input: auto | none | 
+        antialiased | subpixel-antialiased
+
+        Return appropriate computed style for -webkit-font-smoothing
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Add a case for CSSPropertyWebkitFontSmoothing, and accept valid 
+        input.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+        Add mappings for FontSmoothing to the right CSS values.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator FontSmoothing):
+
+        Add -webkit-font-smoothing
+        * css/CSSPropertyNames.in:
+
+        Set fontSmoothing on the FontDescription.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+        Add antialiased and subpixel-antialiased as possible new CSS 
+        values.
+        * css/CSSValueKeywords.in:
+        Store the font smoothing CSS value in the FontDescription.
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::fontSmoothing):
+        (WebCore::FontDescription::setFontSmoothing):
+        (WebCore::FontDescription::operator==):
+
+        Call setShouldAntialias() and setShouldUseSmoothing() appropriately 
+        based on the CSS fontSmoothing() value.
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+
+        New function fontSmoothing()
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::fontSmoothing):
+
+        New enum FontSmoothing.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Remove style property if empty string is entered.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29163
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmouseout): fixed null pointer exception
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleText): if styletext to apply is empty it will return an array to confirm the property removal
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Always reset m_implicitShorthand to false after parsing
+        background-repeat style property otherwise properties
+        following after it may be erroneously marked as implicit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28972
+        https://bugs.webkit.org/show_bug.cgi?id=28973
+
+        Test: fast/backgrounds/repeat/margin-shorthand.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+2009-09-16  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Incorrect behavior of XMLHttpRequest::getAllResponseHeaders and
+        XMLHttpRequest::getResponseHeader in the
+        HEADERS_RECEIVED readyState.
+        https://bugs.webkit.org/show_bug.cgi?id=29121
+
+        Tests: http/tests/xmlhttprequest/getAllResponseHeaders.html
+               http/tests/xmlhttprequest/getResponseHeader.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::getAllResponseHeaders):
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        Changed the minimum valid state from LOADING to HEADERS_RECEIVED.
+
+2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix style violation in V8AbstractEventListener.
+        https://bugs.webkit.org/show_bug.cgi?id=29303
+
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::operator==):
+
+2009-09-16  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add Watch Expression support to inspector
+        https://bugs.webkit.org/show_bug.cgi?id=27514
+
+        Manual test added.
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
+        (WebInspector.ObjectPropertiesSection.CompareProperties):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        * inspector/front-end/WatchExpressionsSidebarPane.js: Added.
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSidebarPane.prototype.refreshExpressions):
+        (WebInspector.WatchExpressionsSection):
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.addExpression):
+        (WebInspector.WatchExpressionsSection.prototype.updateExpression):
+        (WebInspector.WatchExpressionsSection.prototype.findAddedTreeElement):
+        (WebInspector.WatchExpressionsSection.prototype.loadSavedExpressions):
+        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
+        (WebInspector.WatchExpressionsSection.CompareProperties):
+        (WebInspector.WatchExpressionTreeElement):
+        (WebInspector.WatchExpressionTreeElement.prototype.update):
+        (WebInspector.WatchExpressionTreeElement.prototype._deleteButtonClicked):
+        (WebInspector.WatchExpressionTreeElement.prototype.startEditing):
+        (WebInspector.WatchExpressionTreeElement.prototype.editingCancelled):
+        (WebInspector.WatchExpressionTreeElement.prototype.applyExpression):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * manual-tests/inspector/debugger-watch-expressions.html: Added.
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(INSPECTOR)
+        https://bugs.webkit.org/show_bug.cgi?id=29260
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.Inspector.exp file if ENABLE_DRAG_SUPPORT.
+        * WebCore.base.exp: Move Inspector only exports to WebCore.Inspector.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.Inspector.exp.
+        * bindings/js/JSDOMWindowBase.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::JSDOMWindowBase::supportsProfiling):
+        * bindings/js/JSInspectedObjectWrapper.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * bindings/js/JSInspectorBackendCustom.cpp: Ditto.
+        * bindings/js/JSInspectorCallbackWrapper.cpp: Ditto.
+        * bindings/js/ScriptObject.cpp: Use ENABLE(INSPECTOR) where applicable.
+        * bindings/js/ScriptObject.h: Ditto.
+        * bindings/js/ScriptObjectQuarantine.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * dom/Document.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::addMessage):
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        (WebCore::Document::scriptImported):
+        * dom/Document.h: Ditto.
+        * dom/Node.cpp: Ditto.
+        (WebCore::Node::dispatchGenericEvent):
+        * dom/ScriptExecutionContext.h: Ditto.
+        (WebCore::):
+        * html/HTMLDocument.cpp: Ditto.
+        (WebCore::HTMLDocument::createTokenizer):
+        * html/HTMLTokenizer.cpp: Ditto.
+        (WebCore::HTMLTokenizer::write):
+        * inspector/ConsoleMessage.cpp: Ditto.
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h: Ditto.
+        * inspector/DOMDispatchTimelineItem.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * inspector/InspectorBackend.cpp: Ditto.
+        * inspector/InspectorController.cpp: Ditto.
+        * inspector/InspectorDOMAgent.cpp: Ditto.
+        * inspector/InspectorDOMStorageResource.cpp: Ditto.
+        * inspector/InspectorDatabaseResource.cpp: Ditto.
+        * inspector/InspectorFrontend.cpp: Ditto.
+        * inspector/InspectorResource.cpp: Ditto.
+        * inspector/InspectorTimelineAgent.cpp: Ditto.
+        * inspector/TimelineItem.cpp: Ditto.
+        * loader/FrameLoader.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::FrameLoader::detachFromParent):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        (WebCore::FrameLoader::dispatchDidCommitLoad):
+        (WebCore::FrameLoader::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::FrameLoader::dispatchWillSendRequest):
+        (WebCore::FrameLoader::dispatchDidReceiveResponse):
+        (WebCore::FrameLoader::dispatchDidReceiveContentLength):
+        (WebCore::FrameLoader::dispatchDidFinishLoading):
+        * page/Chrome.cpp: Ditto.
+        (WebCore::Chrome::mouseDidMoveOverElement):
+        * page/Console.cpp: Ditto.
+        (WebCore::Console::addMessage):
+        (WebCore::Console::count):
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+        (WebCore::Console::time):
+        (WebCore::Console::timeEnd):
+        (WebCore::Console::group):
+        (WebCore::Console::groupEnd):
+        * page/ContextMenuController.cpp: Ditto.
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/DOMWindow.cpp: Ditto.
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::localStorage):
+        * page/EventHandler.cpp: Ditto.
+        (WebCore::EventHandler::handleMousePressEvent):
+        * page/FrameView.cpp: Ditto.
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        (WebCore::Page::~Page):
+        * page/Page.h: Ditto.
+        * platform/ContextMenu.cpp: Ditto.
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * platform/ContextMenuItem.h: Ditto.
+        (WebCore::):
+        * storage/Database.cpp: Ditto.
+        (WebCore::Database::openDatabase):
+        * workers/WorkerContext.cpp: Ditto.
+        (WebCore::WorkerContext::importScripts):
+        * xml/XMLHttpRequest.cpp: Ditto.
+        (WebCore::XMLHttpRequest::didFinishLoading):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(CONTEXT_MENUS)
+        https://bugs.webkit.org/show_bug.cgi?id=29225
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.ContextMenus.exp file if ENABLE_CONTEXT_MENUS.
+        * WebCore.base.exp: Move ContextMenu only exports to WebCore.ContextMenus.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.ContextMenus.exp.
+        * dom/Node.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
+        (WebCore::Node::defaultEventHandler):
+        * loader/EmptyClients.h: Ditto.
+        * page/ContextMenuController.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * page/EventHandler.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * page/EventHandler.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        * page/Page.h: Ditto.
+        * page/mac/EventHandlerMac.mm: Ditto.
+        * page/mac/WebCoreViewFactory.h: Ditto.
+        * platform/ContextMenu.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * platform/LocalizedStrings.h: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * platform/mac/ContextMenuItemMac.mm: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * platform/mac/ContextMenuMac.mm: Ditto.
+        * platform/mac/LocalizedStringsMac.mm: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * svg/graphics/SVGImage.cpp: Ditto.
+        (WebCore::SVGImage::dataChanged):
+
+2009-09-16  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Clean up invalidation for repainting.  Hoist the dirty rect intersection test in ScrollViewMac up
+        into ScrollView so that all platforms do it.
+        
+        Patch deferred repaints in FrameView::repaintContentRectangle to only add the visible portion of
+        the rectangle for repainting.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::repaintContentRectangle):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformRepaintContentRectangle):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(DRAG_SUPPORT)
+        https://bugs.webkit.org/show_bug.cgi?id=29233
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.DragSupport.exp file if ENABLE_DRAG_SUPPORT.
+        * WebCore.base.exp: Move Drag Support only exports to WebCore.DragSupport.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.DragSupport.exp.
+        * dom/Clipboard.h: Use ENABLE(DRAG_SUPPORT) where applicable.
+        * loader/EmptyClients.h: Ditto.
+        * page/DragController.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * page/EventHandler.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/EventHandler.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        * page/Page.h: Ditto.
+        * page/mac/DragControllerMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * page/mac/EventHandlerMac.mm: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        * platform/DragData.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/DragImage.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/mac/ClipboardMac.h: Use ENABLE(DRAG_SUPPORT) where applicable.
+        * platform/mac/ClipboardMac.mm: Ditto.
+        * platform/mac/DragDataMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/mac/DragImageMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * rendering/RenderLayer.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::RenderLayer::autoscroll):
+        * rendering/RenderObject.cpp: Ditto.
+        * rendering/RenderObject.h: Ditto.
+        * svg/graphics/SVGImage.cpp: Ditto.
+        (WebCore::SVGImage::dataChanged):
+
+2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix after adding support for high resolution times in Win.
+
+        * page/Settings.cpp:
+        * page/Settings.h:
+
+2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Added operator==() to event listeners. This fixes V8 bindings
+        build broken in http://trac.webkit.org/changeset/48402.
+        https://bugs.webkit.org/show_bug.cgi?id=29298
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Now
+        uses JSEventListenerType.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::operator==): Only compares
+        pointers since we create at most one wrapper for a JS object.
+
+2009-09-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Crash when visiting http://flipper.googlelabs.com/
+        https://bugs.webkit.org/show_bug.cgi?id=29293
+
+        Check type for being null or empty before looking it up in the
+        hash of supported types.
+
+        Tested by http/tests/loading/redirect-with-no-location-crash.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+
+2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed the notion of "disconnected nodes with event listeners" because
+        it was vestigial. The reference cycle it tried to solve was solved another
+        way in https://bugs.webkit.org/show_bug.cgi?id=21260.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListeners):
+        * dom/Document.h:
+        * dom/Node.cpp:
+        (WebCore::Node::~Node):
+        (WebCore::Node::insertedIntoDocument):
+        (WebCore::Node::removedFromDocument):
+        (WebCore::Node::willMoveToNewOwnerDocument):
+        (WebCore::Node::didMoveToNewOwnerDocument):
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::clearAttributeEventListener):
+
+2009-09-15  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for ranges, including the progressbar, slider, and spinbutton roles
+        https://bugs.webkit.org/show_bug.cgi?id=28841
+
+        Allow certain ARIA roles to change value with AXIncrement and AXDecrement. 
+        Consolidate increment/decrement/changeValue methods. 
+
+        Test: accessibility/aria-slider-value-change.html
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::increment):
+        (WebCore::AccessibilityRenderObject::decrement):
+        (WebCore::AccessibilityRenderObject::changeValueByPercent):
+        (WebCore::AccessibilityRenderObject::setValue):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilitySlider.cpp:
+        * accessibility/AccessibilitySlider.h:
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged):
+
+2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed the jsEventListeners set from JSDOMGlobalObject, to simplify
+        creation and destruction of JSDOMGlobalObject and event listeners.
+        
+        Added an abstract operator==() to EventListener, to replace the
+        jsEventListeners set's role in determining if two event listeners are
+        equal from the DOM's perspective.
+        
+        Added a type field to EventListener, and casting operations, to support
+        operator==() and other abstract operations.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::markJSFunction):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        (WebCore::JSEventListener::operator==):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::cast):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        (WebCore::ObjCEventListener::cast):
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::ObjCEventListener):
+        (WebCore::ObjCEventListener::operator==):
+        * dom/EventListener.h:
+        (WebCore::EventListener::):
+        (WebCore::EventListener::type):
+        (WebCore::EventListener::EventListener):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::addEventListener):
+        (WebCore::MessagePort::removeEventListener):
+        * dom/Node.cpp:
+        (WebCore::Node::removeEventListener):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::mainFrameDocument):
+        (WebCore::InspectorDOMAgent::operator==):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::cast):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::cast):
+        (WebCore::ImageEventListener::ImageEventListener):
+        (WebCore::ImageEventListener::operator==):
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::addEventListener):
+        (WebCore::DOMApplicationCache::removeEventListener):
+        * notifications/Notification.cpp:
+        (WebCore::Notification::removeEventListener):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::removeEventListener):
+        * page/EventSource.cpp:
+        (WebCore::EventSource::addEventListener):
+        (WebCore::EventSource::removeEventListener):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::cast):
+        (WebCore::ConditionEventListener::ConditionEventListener):
+        (WebCore::ConditionEventListener::operator==):
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::addEventListener):
+        (WebCore::AbstractWorker::removeEventListener):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::addEventListener):
+        (WebCore::WorkerContext::removeEventListener):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::addEventListener):
+        (WebCore::XMLHttpRequest::removeEventListener):
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::addEventListener):
+        (WebCore::XMLHttpRequestUpload::removeEventListener):
+
+2009-09-15  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added ENABLE_MATHML to feature defines
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-14  Andrew Richards  <randrew@gmail.com>
+
+        Reviewed by Sam Weinig.
+
+        Document.elementFromPoint() and Document.caretRangeFromPoint() erroneously returning null at points visible only after scrolling.
+        https://bugs.webkit.org/show_bug.cgi?id=29245
+
+        Use visibleContentRect() instead of boundsRect() when checking hit point bounds on viewport.
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-15  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        http://bugs.webkit.org/show_bug.cgi?id=26660
+
+        Chromium Windows: When rotated, the baseline for a span of complex
+        script is completely misaligned with that of the adjacent 
+        simple script text. It's fixed by not applying the baseline offset for
+        the Skia code path.
+
+        Test: transforms/2d/hindi-rotated.html
+
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::draw):
+
+2009-09-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Pass the PopupMenu pointer to CreateWindowEx and then get it from the LPCREATESTRUCT in
+        the WM_CREATE handler. This way we don't have to first create an zero size window and then size it.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::PopupMenuWndProc):
+
+2009-09-15  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Darin Adler.
+
+        MessageEvent should not be cancelable by default
+        https://bugs.webkit.org/show_bug.cgi?id=27846
+
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        Changed constructor to set cancelable=false by default, per the HTML5 spec.
+
+2009-09-15  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        Fix SVG path parsing error if a command starts with dot '.'
+        https://bugs.webkit.org/show_bug.cgi?id=29123
+
+        * svg/SVGParserUtilities.cpp:
+        (WebCore::SVGPathParser::parseSVG):
+
+2009-09-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement conditional breakpoints in the Web Inspector frontend.
+        https://bugs.webkit.org/show_bug.cgi?id=28908
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/Popup.js: Added.
+        (WebInspector.Popup):
+        (WebInspector.Popup.prototype.show):
+        (WebInspector.Popup.prototype.hide):
+        (WebInspector.Popup.prototype.get visible):
+        (WebInspector.Popup.prototype.set element):
+        (WebInspector.Popup.prototype.get element):
+        (WebInspector.Popup.prototype.positionElement):
+        (WebInspector.Popup.prototype.set anchor):
+        (WebInspector.Popup.prototype.get anchor):
+        (WebInspector.Popup.prototype.set autoHide):
+        (WebInspector.Popup.prototype._checkNotVisible):
+        (WebInspector.Popup.prototype._keyEventHandler):
+        (WebInspector.Popup.prototype._mouseDownEventHandler):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceFrame.prototype._documentContextMenu):
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.committed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.dismissed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._showBreakpointConditionPopup):
+        (WebInspector.SourceFrame.prototype._createPopupElement):
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame.prototype._removeBreakpointFromSource):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded.drawBreakpoint):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.set currentFocusElement):
+        (WebInspector.set currentPanel):
+        (WebInspector.loaded):
+        (WebInspector.contextMenu):
+        (WebInspector.elementDragStart):
+        (WebInspector.updateResource):
+        (WebInspector.drawLoadingPieChart):
+        (WebInspector.linkifyURLAsNode):
+        (WebInspector.startEditing.getContent):
+        (WebInspector.startEditing.editingCancelled):
+        (WebInspector.startEditing.editingCommitted):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.positionAt):
+        (Element.prototype.offsetRelativeToWindow):
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Page cache should support pages with unload handlers as an experiment.
+        <rdar://problem/7196485> and https://bugs.webkit.org/show_bug.cgi?id=29021
+
+        For the experiment, only allow pages with unload handlers into the Page Cache on
+        Mac and Windows.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-09-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the change in r48376 to do a null-check to fix a crashing test.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-09-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7047282> Safari crashes at WebCore::RenderMenuList::adjustInnerStyle() 436
+        
+        Avoid a crash when a mouse event handler on a <select> changes the select from a popup
+        to a list (by setting the 'size' property) inside the event handler.
+
+        Test: fast/forms/select-change-popup-to-listbox-in-event-handler.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        More PopupMenu cleanup.
+        
+        * platform/PopupMenu.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        Call registerClass.
+        
+        (WebCore::PopupMenu::registerClass):
+        Make this a private static member function so it can refer to PopupMenuWndProc.
+        
+        (WebCore::PopupMenu::PopupMenuWndProc):
+        Try to get the PopupMenu and call its wndProc member function.
+        
+        (WebCore::PopupMenu::wndProc):
+        Make this a member function.
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Not reviewed, maybe should've been:
+
+        Cleaning up more Windows-specific fallout from the fix for:
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::load): Don't allow empty CFStrings as the stored credentials,
+          as related checks all look at nullity when they really mean to be looking for emptiness. 
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Speculative Qt build fix.
+        
+        * platform/qt/QWebPopup.cpp:
+        (WebCore::QWebPopup::hidePopup):
+
+2009-09-14  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix RenderThemeChromiumWin::determineClassicState so that classic_state
+        matches the state values (and you get a single classic_state value
+        for a given {part,state} value. This change will be tested by a 
+        chromium patch that will land after this.
+
+        This will be tested by code landing downstream on Chromium.org; the
+        code does not execute on webkit.org.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::determineClassicState):
+        (WebCore::RenderThemeChromiumWin::getThemeData):
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29138
+        Simplify popup menu handling.
+
+        * platform/PopupMenuClient.h:
+        Rename hidePopup to popupDidHide.
+        
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleKeyEvent):        
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        Call popupDidHide instead of hidePopup.
+        
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::menuUnmapped):
+        Ditto.
+        
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::show):
+        Ditto.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::hide):
+        Call popupDidHide.
+        
+        (WebCore::PopupWndProc):
+        Call PopupMenu::hide.
+        
+        * platform/wx/PopupMenuWx.cpp:
+        (WebCore::PopupMenu::OnMenuItemSelected):
+        Call popupDidHide.
+        
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::hidePopup):
+        (WebCore::RenderMenuList::popupDidHide):
+        * rendering/RenderMenuList.h:
+        Set the "popup is visible" flag in popupDidHide.
+        
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::hidePopup):
+        (WebCore::RenderTextControlSingleLine::popupDidHide):
+        * rendering/RenderTextControlSingleLine.h:
+        Ditto.
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt.
+
+        - Fix <rdar://problem/7182275>.
+
+        Make sure that the newly created scrollbar's style is up to date.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::~PopupMenu):
+        Call setParent so that the scrollbar's parts are torn down correctly.
+        
+        (WebCore::PopupMenu::show):
+        Call styleChanged.
+
+2009-09-11  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7197644> WebKit should broadcast an MSAA event when
+        jumping to a named anchor
+
+        https://bugs.webkit.org/show_bug.cgi?id=28899
+
+        Reviewed by Adam Roben.
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        Added declaration for handleScrolledToAnchor(). Added a new entry to
+        the enum of accessibility notifications.
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
+        Code moved from AccessibilityRenderObject::internalLinkElement() and
+        refactored slightly; walks the tree until it finds a Node (with a
+        renderer) whose accessibility is not ignored.
+
+        * accessibility/AccessibilityObject.h:
+        Added a declaration for firstAccessibleObjectFromNode().
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::internalLinkElement):
+        Code moved to AccessibilityObject::firstAccessibleObjectFromNode().
+
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        Add a default case that returns early for notifications that Mac
+        doesn't handle.
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Post an AXScrolledToAnchor notification for the first accessible from
+        the anchor Node.
+        (WebCore::AXObjectCache::postPlatformNotification):
+        If the notification is AXFocusedUIElementChanged, fire an
+        EVENT_OBJECT_FOCUS. If the notification is AXScrolledToAnchor, fire
+        EVENT_SYSTEM_SCROLLINGSTART, matching Firefox.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Code moved to postPlatformNotification().
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToAnchor):
+        Call AXObjectCache::handleScrolledToAnchor().
+
+2009-09-14  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Cookies are not inspectable after reloading a page
+        https://bugs.webkit.org/show_bug.cgi?id=29222
+
+        Create the cookieTreeElement on initialization instead of when the view is shown.
+        Reset the selected element of the sidebar on reset.
+
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.show):
+        (WebInspector.StoragePanel.prototype.reset):
+
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+        (WebCore::WebCoreSynchronousLoader::load):
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Safari 4 cannot be used to update firmware on Linksys routers.
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        In http://trac.webkit.org/changeset/42483, we disabled CFNetwork's session credential storage and 
+        implemented our own in WebCore.
+
+        One feature we lost is that CFNetwork would automatically send previously authenticated credentials
+        with new connections when the paths match, as allowed by RFC 2617 for HTTP Basic and Digest Authentication.  
+
+        Even though it's optional for User Agents to do this, (some?) Linksys routers rely on this behavior for
+        HTTP Basic Authentication.  So now WebCore's CredentialStorage will track URL paths for Basic credentials.
+
+        We're not making this enhancement for Digest at this time, since we don't know of anything that broke
+        due to the change in Digest behavior.
+
+        Test: http/tests/loading/basic-credentials-sent-automatically.html
+              http/tests/loading/basic-auth-resend-wrong-credentials.html
+
+        * WebCore.base.exp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::isEmpty):
+        * platform/network/Credential.h:
+
+        Add a slightly more full featured CredentialStore that will track URL paths a credential belongs to:
+        * platform/network/CredentialStorage.cpp: Added.
+        (WebCore::protectionSpaceToCredentialMap):
+        (WebCore::originToDefaultCredentialMap):
+        (WebCore::originStringFromURL):
+        (WebCore::CredentialStorage::set):
+        (WebCore::CredentialStorage::get):
+        (WebCore::CredentialStorage::getDefaultAuthenticationCredential):
+        * platform/network/CredentialStorage.h: Added.
+
+        Allow ProtectionSpace to be a hash key:
+        * platform/network/ProtectionSpace.cpp:
+        (WebCore::ProtectionSpace::ProtectionSpace):
+        * platform/network/ProtectionSpace.h:
+        (WebCore::ProtectionSpace::ProtectionSpace):
+        (WebCore::ProtectionSpace::isHashTableDeletedValue):
+        * platform/network/ProtectionSpaceHash.h: Added.
+        (WebCore::ProtectionSpaceHash::hash):
+        (WebCore::ProtectionSpaceHash::equal):
+
+        Allow ResourceHandles to remember the initial credential they used:
+        * platform/network/ResourceHandleInternal.h:
+
+        Allow mutable ResourceRequests to update their platform object if HTTP header fields change:
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::addHTTPHeaderField):
+
+        Remove WebCoreCredentialStorage:
+        * platform/network/cf/AuthenticationCF.cpp:
+        * platform/network/cf/AuthenticationCF.h:
+        * platform/network/mac/AuthenticationMac.h:
+        * platform/network/mac/AuthenticationMac.mm:
+
+        Change ResourceHandleCFNet to try to use stored credentials on new connections, if appropriate:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::WebCoreSynchronousLoader::load):
+
+        Change ResourceHandleMac to try to use stored credentials on new connections, if appropriate:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::ResourceHandle::receivedCredential):
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Only try the 
+          ProtectionSpace key'ed Credential if it does not match the initially used Credential.
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+
+        Add base64-ability to CString:
+        * platform/text/CString.cpp:
+        (WebCore::CStringBuffer::base64Encode):
+        (WebCore::CString::base64Encode):
+        * platform/text/CString.h:
+        (WebCore::CStringBuffer::create):
+        (WebCore::CStringBuffer::CStringBuffer):
+
+2009-09-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix <rdar://problem/6954546> Crashes in WebCore::RenderPart::setWidget below FrameLoader::loadPlugin.
+
+        The calls to FrameLoader::requestObject within RenderPartObject::updateWidget can result in a plug-in
+        being initialized.  This can run cause arbitrary JavaScript to run and may result in the RenderPartObject
+        being detached from the render tree and destroyed, causing a crash like <rdar://problem/6954546>.
+
+        No test is possible until <rdar://problem/7090444> is fixed.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Ensure that we stay alive for the duration of plug-in initialization.
+
+2009-09-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add RenderWidgetProtector to simplify protecting a RenderWidget from destruction for the
+        duration of a function.  Deploy it within RenderWidget.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidgetGeometry):
+        (WebCore::RenderWidget::updateWidgetPosition): Use a RefPtr rather than explicitly
+        ref'ing and deref'ing the node.
+        * rendering/RenderWidget.h:
+        * rendering/RenderWidgetProtector.h:
+        (WebCore::RenderWidgetProtector::RenderWidgetProtector):
+        (WebCore::RenderWidgetProtector::~RenderWidgetProtector):
+
+2009-09-14  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        CodeGenerator.pm needs some cleaning up
+        https://bugs.webkit.org/show_bug.cgi?id=29238
+
+        * bindings/scripts/CodeGenerator.pm:
+        (FindParentsRecursively): Removed; its functionality is now handled in
+        AddMethodsConstantsAndAttributesFromParentClasses.
+        (ForAllParents): New function that visits an interface's ancestors and
+        invokes a callback for each one.
+        (AddMethodsConstantsAndAttributesFromParentClasses): Simplified by using
+        ForAllParents.
+        (GetMethodsAndAttributesFromParentClasses): Ditto.
+        (IDLFileForInterface): Factored out previous calls to ScanDirectory into
+        this new function, which returns the filename containing a given IDL
+        interface definition.
+        (ParseInterface): Simplified by using IDLFileForInterface.
+        (ScanDirectory): Removed in lieu of IDLFileForInterface.
+        * bindings/scripts/CodeGeneratorV8.pm: Drop call to
+        FindParentsRecursively and get the list of parents from the
+        AddMethodsConstantsAndAttributesFromParentClasses call instead.
+
+2009-09-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Assert hit when dropping a file in QtLauncher
+        https://bugs.webkit.org/show_bug.cgi?id=29242
+
+        Qt's implementation of DropData::asURL does not return a URL encoded string
+        as expected.
+
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+
+2009-09-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, file was missed during TLS.cpp removal.
+
+        * page/wx/FrameWx.cpp: Added.
+        (WebCore::Frame::dragImageForSelection):
+
+2009-09-13  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Web Inspector: Add "New Style Rule" to the localizedStrings
+        https://bugs.webkit.org/show_bug.cgi?id=29237
+
+        * English.lproj/localizedStrings.js:
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Implement filesystem functions.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29196
+
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::fileExists):
+        (WebCore::deleteFile):
+        (WebCore::deleteEmptyDirectory):
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+        (WebCore::makeAllDirectories):
+        (WebCore::pathByAppendingComponent):
+        (WebCore::homeDirectoryPath):
+        (WebCore::directoryName):
+
+2009-09-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for wx 2.9.
+
+        * platform/wx/ScrollbarThemeWx.cpp:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxGetGdkWindowForDC):
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [ES5] Implement Object.keys
+        https://bugs.webkit.org/show_bug.cgi?id=29170
+
+        Switch from getPropertyNames to getOwnPropertyNames, and provide custom
+        getPropertyNames to DOMWindow, DOMWindowShell and QuarantinedObjectWrapper
+        in order to ensure correct semantics are maintained.
+
+        Test: fast/js/Object-keys.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyNames):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getPropertyNames):
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::getOwnPropertyNames):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getPropertyNames):
+        (JSC::RuntimeObjectImp::getOwnPropertyNames):
+        * bridge/runtime_object.h:
+
+2009-09-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29219
+        Document.elementFromPoint() should take page scroll into consideration
+
+        Test: fast/dom/elementFromPoint-relative-to-viewport.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29217
+        Document.caretRangeFromPoint should take the scroll offset into account before hit testing
+
+        In accordance with the CSSOM View Module spec, Document.caretRangeFromPoint should interpret
+        the point passed to it as relative to the viewport, not the document.
+
+        Test: fast/dom/Document/CaretRangeFromPoint/hittest-relative-to-viewport.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added some manual tests to show WebGL in action
+        https://bugs.webkit.org/show_bug.cgi?id=29215
+
+        * manual-tests/webgl: Added.
+        * manual-tests/webgl/Earth.html: Added.
+        * manual-tests/webgl/ManyPlanetsDeep.html: Added.
+        * manual-tests/webgl/SpinningBox.html: Added.
+        * manual-tests/webgl/TeapotPerPixel.html: Added.
+        * manual-tests/webgl/TeapotPerVertex.html: Added.
+        * manual-tests/webgl/resources: Added.
+        * manual-tests/webgl/resources/CanvasMatrix.js: Added.
+        * manual-tests/webgl/resources/earthmap1k.jpg: Added.
+        * manual-tests/webgl/resources/mars500x250.png: Added.
+        * manual-tests/webgl/resources/teapot.obj: Added.
+        * manual-tests/webgl/resources/utils3d.js: Added.
+ 
+2009-09-10  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        aria definition role spelled wrong "defintion"
+        https://bugs.webkit.org/show_bug.cgi?id=28840
+
+        Test: accessibility/aria-slider-value-change.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+
+2009-09-11  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes an assert in Node::isFocusable which was causing crashes in certain cases.
+        https://bugs.webkit.org/show_bug.cgi?id=29210
+
+        * dom/Node.cpp:
+        (WebCore::Node::isFocusable):
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added variants to uniform* and vertexAttrib* calls which take sequence<> in place of CanvasArray
+        https://bugs.webkit.org/show_bug.cgi?id=29139
+        
+        I also added a data() call to each of the CanvasArray subclasses to give back a types pointer
+        to the baseAddress().
+
+        * Configurations/FeatureDefines.xcconfig:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::toArray):
+        (WebCore::):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+        (WebCore::JSCanvasRenderingContext3D::uniform1fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform1iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform2fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform2iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform3fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform3iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform4fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform4iv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib4fv):
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::data):
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::data):
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::data):
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::uniform1fv):
+        (WebCore::CanvasRenderingContext3D::uniform1iv):
+        (WebCore::CanvasRenderingContext3D::uniform2fv):
+        (WebCore::CanvasRenderingContext3D::uniform2iv):
+        (WebCore::CanvasRenderingContext3D::uniform3fv):
+        (WebCore::CanvasRenderingContext3D::uniform3iv):
+        (WebCore::CanvasRenderingContext3D::uniform4fv):
+        (WebCore::CanvasRenderingContext3D::uniform4iv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::data):
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::data):
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::data):
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::data):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+
+2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE(WEB_SOCKETS) guards.
+        https://bugs.webkit.org/show_bug.cgi?id=29174
+
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+
+2009-09-11  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r48229.
+        http://trac.webkit.org/changeset/48229
+
+        * WebCore.base.exp:
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+        (WebCore::Clipboard::sourceOperation):
+        * page/DragController.cpp:
+        (WebCore::DragController::DragController):
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::performDrag):
+        (WebCore::DragController::dragEnteredOrUpdated):
+        (WebCore::DragController::tryDHTMLDrag):
+        (WebCore::DragController::startDrag):
+        * page/DragController.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::dragSourceMovedTo):
+        (WebCore::EventHandler::handleDrag):
+        * page/EventHandler.h:
+
+2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Fix the build.
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27456
+        Added support for static validation of url in
+        ValidityState, for url state inputs.
+        From HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#url-state
+
+        Test: fast/forms/ValidityState-typeMismatch-url.html
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2009-09-11  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Revert r47992: Expose functions to change the focus ring color for
+        Linux Chromium.
+
+        As Darin Fisher has pointed out, there is a better way to do this.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29207
+        Add checks for using WebCore JS context on secondary threads
+
+        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::commonJSGlobalData):
+        Set the new debug-only mainThreadOnly flag.
+
+2009-09-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        The inspector should have scope bars.
+        https://bugs.webkit.org/show_bug.cgi?id=14353
+        
+        Add scope bars to the console, so the user can choose which category
+        of messages they want to see (All, Errors, Warnings, Logs), and they
+        can choose from one or more of {Errors, Warnings, Logs}.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createFilterElement):
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        (WebInspector.ConsoleView.prototype.filter):
+        (WebInspector.ConsoleView.prototype.attach):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-09-11  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Complex text doesn't show up with text stroking
+        https://bugs.webkit.org/show_bug.cgi?id=28707
+
+        Added extra NULL checks for HDC. This is the second fix for issue 28707,
+        and the fix is similar to http://trac.webkit.org/changeset/45482.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::draw):
+
+2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make ElementTimeControl methods return void and not throw.
+        https://bugs.webkit.org/show_bug.cgi?id=28831
+
+        SVG 1.1 erratum:
+        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#elementtimecontrol-interface
+
+        Test: svg/dom/smil-methods.svg
+
+        * svg/ElementTimeControl.h: Change return type from bool to void and remove exception argument.
+        * svg/ElementTimeControl.idl: Change return type from bool to void and remove raises claus.
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::beginElement): Change return type from bool to void and remove exception argument.
+        (WebCore::SVGAnimationElement::beginElementAt): Ditto.
+        (WebCore::SVGAnimationElement::endElement): Ditto.
+        (WebCore::SVGAnimationElement::endElementAt): Ditto.
+        * svg/SVGAnimationElement.h: Ditto.
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added support for texImage2D which takes CanvasArray
+        https://bugs.webkit.org/show_bug.cgi?id=29191
+
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::texImage2D):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::texImage2D):
+
+2009-09-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allow WebKit clients to opt out of high resolution timers on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=29192
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setShouldUseHighResolutionTimers): Added.
+        * page/Settings.h: Added getter/setter for shouldUseHighResolutionTimers.
+        (WebCore::Settings::shouldUseHighResolutionTimers): Added.
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::setSharedTimerFireTime): Don't run high resolution timer code if it is disabled.
+
+2009-09-11  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Share persistent context handles between events        
+        Change events to use a single ref-counted shared persistent handle
+        to the context in which to run, rather than create a new
+        persistent handle for each new event which puts pressure on the
+        gc.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29077
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/SharedPersistent.h: Added.
+        (WebCore::SharedPersistent::set):
+        (WebCore::SharedPersistent::get):
+        (WebCore::SharedPersistent::disposeHandle):
+        (WebCore::SharedPersistent::create):
+        (WebCore::SharedPersistent::SharedPersistent):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::context):
+        (WebCore::V8IsolatedWorld::shared_context):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
+        (WebCore::V8Proxy::isContextInitialized):
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::clearDocumentWrapperCache):
+        (WebCore::V8Proxy::disposeContextHandles):
+        (WebCore::V8Proxy::clearForClose):
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::setSecurityToken):
+        (WebCore::V8Proxy::updateDocument):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::shared_context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::setContextDebugId):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::shared_context):
+
+2009-09-11  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Create a real handle (one which would save an object from GC).
+        https://bugs.webkit.org/show_bug.cgi?id=29150
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ExternalString):
+
+2009-09-11  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Inline WebCore::v8String as it only invokes WebCore::v8ExternalString.
+        https://bugs.webkit.org/show_bug.cgi?id=29152
+
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8String):
+
+2009-09-11  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Changed URLs from qtsoftware.com to qt.nokia.com, as part of a general
+        renaming.
+
+        * ChangeLog-2009-06-16:
+
+2009-09-11  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Use LIBS_PRIVATE on Qt/Mac.
+
+        On the Mac, it means "-framework ApplicationServices -framework Carbon
+        -framework AppKit" are no longer part of the default LIBS in Qt
+        applications. This required a lot of fixes where we used Mac-specific
+        code in Qt.
+
+        * WebCore.pro:
+
+2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Remove duplicated WK_{u,l}cfirst subs from CodeGeneratorV8.pm
+        https://bugs.webkit.org/show_bug.cgi?id=29165
+
+        * bindings/scripts/CodeGeneratorV8.pm: Remove WK_ucfirst and
+        WK_lcfirst, and call the ones in CodeGenerator.pm instead.
+
+2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29132
+        Symbian winscw compiler fails compiling WebCore/text/RegularExpression.cpp.
+
+        Add RegularExpression class qualifier before Private.
+
+        * platform/text/RegularExpression.cpp:
+
+2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29131
+        Use a different variadic macro format for Symbian compiler.
+        
+        Use arg... instead of ellipsis in variadic macro.        
+
+        * platform/StaticConstructors.h:
+
+2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28806
+
+        [Qt] Make the WebInspector available as a QWidget.
+
+        * WebCore.pro:
+
+2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed fix for the Web Inspector with the Qt build.
+
+        Re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, remove stray semicolon from function definition.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Detect mixed content
+        https://bugs.webkit.org/show_bug.cgi?id=29003
+
+        Detect some basic kinds of mixed content (HTTP content loaded into an
+        HTTPS context).  This new detection logic isn't perfect, but it's a
+        place to start.
+
+        Tests: http/tests/security/mixedContent/about-blank-iframe-in-main-frame.html
+               http/tests/security/mixedContent/data-url-iframe-in-main-frame.html
+               http/tests/security/mixedContent/data-url-script-in-iframe.html
+               http/tests/security/mixedContent/insecure-css-in-iframe.html
+               http/tests/security/mixedContent/insecure-css-in-main-frame.html
+               http/tests/security/mixedContent/insecure-iframe-in-iframe.html
+               http/tests/security/mixedContent/insecure-iframe-in-main-frame.html
+               http/tests/security/mixedContent/insecure-image-in-iframe.html
+               http/tests/security/mixedContent/insecure-image-in-main-frame.html
+               http/tests/security/mixedContent/insecure-script-in-iframe.html
+               http/tests/security/mixedContent/redirect-http-to-https-iframe-in-main-frame.html
+               http/tests/security/mixedContent/redirect-http-to-https-script-in-iframe.html
+               http/tests/security/mixedContent/redirect-https-to-http-iframe-in-main-frame.html
+               http/tests/security/mixedContent/redirect-https-to-http-script-in-iframe.html
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::canRequest):
+        (WebCore::DocLoader::requestResource):
+        (WebCore::DocLoader::checkCacheObjectStatus):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isMixedContent):
+        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
+        (WebCore::FrameLoader::checkIfRunInsecureContent):
+        * loader/FrameLoader.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::willSendRequest):
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Windows build.
+
+        Restore platform/mock to the header search path after it was removed in r48270.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-09-08  Timothy Hatcher  <timothy@apple.com>
+
+        Web Inspector: Move the option to create a new style rule under the Styles' gear menu.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29039
+
+        Reviewed by Sam Weinig.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane): Add "New Style Rule" option to the gear menu.
+        (WebInspector.StylesSidebarPane.prototype._update): Check instanceof BlankStylePropertiesSection instead.
+        (WebInspector.StylesSidebarPane.prototype._changeSetting): Added. Keeps the color format setting selected
+        while calling the correct action.
+        (WebInspector.StylesSidebarPane.prototype._createNewRule): Creates a new section and edits the selector.
+        (WebInspector.StylesSidebarPane.prototype.addBlankSection): Insert the section in a cleaner way.
+        (WebInspector.StylesSidebarPane.prototype.removeSection): Added. Removes the passed in section.
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): Return an empty string if there is no node.
+        (WebInspector.StylePropertiesSection.prototype.expand): Removed the check for _blank.
+        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): No need for the context, the original selector
+        is remembered by the editing code.
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled): Do nothing. The original text is already
+        restored by the editing code.
+        (WebInspector.BlankStylePropertiesSection): Call the StylePropertiesSection constructor with appropriate data.
+        Remove event listener code.
+        (WebInspector.BlankStylePropertiesSection.prototype.expand): Added. Does nothing to prevent expanding.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.callback): Correctly construct the
+        WebInspector.CSSStyleDeclaration. Call editingSelectorCancelled instead of editingCancelled.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted): Renamed from editingCommitted to
+        override the base class.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCancelled): Remove the section.
+        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): Removed event listener code. Removed the delete lines
+        since they were doing nothing (deleting nonexistent properties that exist only on the prototype.) Change prototypes at
+        the end to correctly swtich to a real StylePropertiesSection.
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.editingCancelled): Ceck for null/undefined callbacks.
+        (WebInspector.startEditing.editingCommitted): Ditto.
+
+2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix comparison between signed and unsigned integer warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29162
+
+        No functional change.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::findMethodIndex):
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::duration):
+        (WebCore::ImageDecoderQt::imageAtIndex):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+
+2009-09-10  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Build fix for GTKafter r48267.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-08  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove unneeded define for ActiveX.
+        https://bugs.webkit.org/show_bug.cgi?id=29054
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::createClassIdToTypeMap):
+        (WebCore::serviceTypeForClassId):
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Don't copy IDL files in to the built framework.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-10  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implment Range.expand().
+        https://bugs.webkit.org/show_bug.cgi?id=27632
+
+        Test: fast/dom/Range/range-expand.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::expand):
+        * dom/Range.h:
+        * dom/Range.idl:
+
+2009-09-10  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket API implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+        
+        Add build systems for GNUmakefile.am, WebCore.xcodeproj and
+        WebCore.vcproj.
+        Add websockets directory and WebSocket.idl in qt build system.
+        Tests will be landed once the code is completed and functional.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toWebSocket):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::isValidProtocolString):
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::eventListeners):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Added.
+        * websockets/WebSocketChannel.h: Added.
+        * websockets/WebSocketChannelClient.h: Added.
+        * websockets/WebSocketHandshake.cpp: Added.
+        * websockets/WebSocketHandshake.h: Added.
+
+2009-09-10  Albert J. Wong  <ajwong@chromium.org>
+
+        No review, windows build fix only.
+        
+        Spurious semicolon causing parse error in chromium build on windows.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-10  Albert J. Wong  <ajwong@chromium.org>
+
+        No review, build fix only.
+
+        Adding in a missed include from the last patch that is breaking the
+        chromium build.
+
+        * rendering/RenderThemeChromiumMac.mm: include TimeRanges.h
+
+2009-09-10  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        HTMLMediaElement buffered attribute should report a list of time ranges
+        https://bugs.webkit.org/show_bug.cgi?id=29041
+
+        Changed MediaPlayerPrivateInterface and MediaPlayer's definition to
+        report a list of buffered time ranges as WebCore::TimeRanges. This
+        change also got rid of the maxTimeBuffered() method.
+
+        No new tests since this is a API change.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::percentLoaded):
+        Use MediaPlaier::buffered() instead of maxTimeBuffered().
+        (WebCore::HTMLMediaElement::buffered):
+        ditto.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::buffered):
+        Use MediaPlayerPrivateInterface::buffered() instead of maxTimeBuffered().
+        (WebCore::MediaPlayer::buffered):
+        ditto.
+        * platform/graphics/MediaPlayer.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/MediaPlayerPrivate.h:
+        ditto.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        Implements PassRefPtr<TimeRanges> buffered();
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::buffered):
+        Implementation of buffered().
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        Implements PassRefPtr<TimeRanegs> buffered().
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        Implements PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/wince/MediaPlayerPrivateWince.h:
+        ditto.
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        Use buffered() instead of maxTimeBuffered().
+        * rendering/RenderThemeChromiumSkia.cpp:
+        ditto.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        ditto.
+
+2009-09-10  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make bindings generators more aware of IDL dependencies
+        https://bugs.webkit.org/show_bug.cgi?id=29114
+
+        Make the JS and ObjC bindings generators able to output dependency
+        rules for DerivedSources.make to consume.  These rules make a given
+        generated binding class file header, JSWhatever.h, depend on Whatever's
+        ancestor interfaces.
+
+        * DerivedSources.make: Pass --write-dependencies to generate-bindings.pl
+        when generating JS and ObjC bindings.  Include dependency fies that are
+        generated due to that.
+        * bindings/scripts/CodeGenerator.pm: Make
+        AddMethodsConstantsAndAttributesFromParentClasses accumulate a list of
+        the ancestor interfaces that were visited.
+        * bindings/scripts/CodeGeneratorJS.pm: Optionally write out a dependency
+        file.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+        * bindings/scripts/generate-bindings.pl: Add a --write-dependencies
+        option.
+
+2009-09-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez and Dan Winship.
+
+        Give all requests to libsoup, to let it queue, and schedule them
+        itself, instead of throttling the number of requests in WebCore.
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+
+2009-09-10  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Make XMLHttpRequest.send handle File object.
+        https://bugs.webkit.org/show_bug.cgi?id=28924
+
+        Test: http/tests/local/send-dragged-file.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use fastNew and fastDelete instead of operator new and delete for CSSSelector class. 
+        https://bugs.webkit.org/show_bug.cgi?id=25930
+
+        Change using of operator new to fastNew and operator delete to
+        fastDeleteSkippingDestructor for CSSSelector class to avoid mismatched function call.
+
+        This change fixes valgrind's 'mismatched free' notification.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::~CSSParser):
+        (WebCore::CSSParser::createFloatingSelector):
+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::adoptSelectorVector):
+
+2009-09-10  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Geolocation does not correctly handle reentrant calls from callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=29040
+
+        Tests: fast/dom/Geolocation/reentrant-error.html
+               fast/dom/Geolocation/reentrant-success.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::handleError): Modified. Call sendError directly, clearing notifier lists before making callback.
+        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Call sendPosition directly, clearing notifier lists before making callback.
+        * page/Geolocation.h: Modified. Deleted sendErrorToXX and sendPositionToXXX methods.
+
+2009-09-10  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes issue where focused elements did not get blur and focus events when the window was blurred and focused.
+        https://bugs.webkit.org/show_bug.cgi?id=27105
+
+        Test: fast/events/blur-focus-window-should-blur-focus-element.html
+
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
+        (WebCore::FocusController::setFocused):
+        (WebCore::FocusController::setActive):
+
+2009-09-10  Adam Roben  <aroben@apple.com>
+
+        Make the play/pause button in <video> controls indicate the button's
+        action, not the movie state
+
+        This matches the Mac behavior, iTunes, and many other media players.
+
+        No test possible.
+
+        Fixes <http://webkit.org/b/29126> Play/pause button in <video>
+        controls shows the wrong image
+
+        Reviewed by Eric Carlson.
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Reversed when
+        we show the play vs. pause artwork, so that the button reflects what
+        will happen when you click it, rather than the current state of the
+        movie.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Geolocation Coordinates::toString() prints bogus values for unspecified properties.
+        https://bugs.webkit.org/show_bug.cgi?id=29080
+
+        Test: fast/dom/Geolocation/position-string.html
+
+        * GNUmakefile.am: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.gypi: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.pro: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.vcproj/WebCore.vcproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCoreSources.bkl: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * page/Coordinates.cpp: Removed.
+        * page/Coordinates.h: Modified. Removes toString method.
+        * page/Coordinates.idl: Modified. Removes toString method.
+        * page/Geoposition.cpp: Removed.
+        * page/Geoposition.h: Modified. Removes toString method.
+        * page/Geoposition.idl: Modified. Removes toString method.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Correctly applies the Geolocation timeout property.
+        https://bugs.webkit.org/show_bug.cgi?id=27256
+
+        If a timeout is specified, the timer is started as soon as the location acquistion process starts.
+        If a position fix is not obtained within the timeout interval, the position request is cancelled
+        and the error callback (if specified) is invoked. If a position fix is obtained within the timeout
+        interval, the timer is stopped. Permissions are then requested from the user if required. See
+        http://www.w3.org/TR/geolocation-API/#position-options.
+
+        Note that this logic means that the time required to obtain permissions from the user is not
+        included in the timeout interval.
+
+        Tests: fast/dom/Geolocation/timeout.html
+               fast/dom/Geolocation/timeout-zero.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Takes Geolocation object as parameter.
+        (WebCore::Geolocation::GeoNotifier::hasZeroTimeout): Added. Determines whether this request has a zero timeout.
+        (WebCore::Geolocation::GeoNotifier::startTimerIfNeeded): Renamed from startTimer. Starts the timer if a timeout was specified.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Calls the error callback if specified, and reports the timeout to the Geolocation object.
+        (WebCore::Geolocation::getCurrentPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
+        (WebCore::Geolocation::watchPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
+        (WebCore::Geolocation::requestTimedOut): Added. Cancels a request when it times out.
+        (WebCore::Geolocation::setIsAllowed): Modified. No longer starts timers.
+        (WebCore::Geolocation::sendPosition): Modified. No longer stops timers.
+        (WebCore::Geolocation::stopTimer): Added. Stops the timers for a vector of notifiers.
+        (WebCore::Geolocation::stopTimersForOneShots): Added. Stops the timers for all one-shots.
+        (WebCore::Geolocation::stopTimersForWatchers): Added. Stops the timers for all watchers.
+        (WebCore::Geolocation::stopTimers): Added. Stops the timers for all requests.
+        (WebCore::Geolocation::geolocationServicePositionChanged): Modfified. Stops the timers for all requests.
+        * page/Geolocation.h: Modified.
+        (WebCore::Geolocation::GeoNotifier::create): Modified. Takes Geolocation object as parameter.
+
+2009-09-09  Chris Fleizach  <cfleizach@apple.com>
+
+        AX notifications should be an ENUM type instead of strings
+        https://bugs.webkit.org/show_bug.cgi?id=28963
+
+        Build fix for Qt.
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postPlatformNotification):
+
+2009-09-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX notifications should be an ENUM type instead of strings
+        https://bugs.webkit.org/show_bug.cgi?id=28963
+
+        Moves AX notifications over to an ENUM type instead of
+        using the actual string values that are used on OS X.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::selectedChildrenChanged):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged):
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedContents):
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-09-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Missing checkout for getSVGDocument()
+        https://bugs.webkit.org/show_bug.cgi?id=29064
+
+        The V8 code generator didn't understand SVGCheckSecurityDocument.
+
+        Tests: http/tests/security/xss-DENIED-getSVGDocument-iframe.html
+               http/tests/security/xss-DENIED-getSVGDocument-object.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-09-09  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make SVGStyleElement inherit from SVGLangSpace
+        https://bugs.webkit.org/show_bug.cgi?id=29058
+
+        Required by SVG 1.1 Second Edition:
+        http://dev.w3.org/SVG/profiles/1.1F2/publish/styling.html#InterfaceSVGStyleElement
+
+        Test: svg/dom/SVGStyleElement/style-langspace.html
+
+        * svg/SVGStyleElement.cpp: Drop methods xmlspace and setXmlspace.
+        (WebCore::SVGStyleElement::SVGStyleElement): Add SVGLangSpace()
+        initializer.
+        (WebCore::SVGStyleElement::parseMappedAttribute): Call
+        parseMappedAttribute on SVGLangSpace.
+        * svg/SVGStyleElement.h: Drop xmlspace and setXmlspace declarations.
+        * svg/SVGStyleElement.idl: Drop xmlspace attribute and add SVGLangSpace
+        as a superinterface.
+
+2009-09-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove unnecessary includes and forward declarations in V8Proxy.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=29111
+
+        * bindings/v8/V8Proxy.h:
+
+2009-07-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add more position constructors
+        positionBeforeNode, positionAfterNode
+        firstPositionInNode, lastPositionInNode
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        I also added a lastOffsetInNode and deployed it to a couple places.
+
+        There are no callers to these new constructors yet, but those
+        will be coming in future patches.
+
+        * dom/Position.cpp:
+        (WebCore::Position::computeOffsetInContainerNode):
+        * dom/Position.h:
+        (WebCore::positionBeforeNode):
+        (WebCore::positionAfterNode):
+        (WebCore::lastOffsetInNode):
+        (WebCore::firstPositionInNode):
+        (WebCore::lastPositionInNode):
+        * editing/ApplyStyleCommand.cpp:
+        * editing/TextIterator.cpp:
+        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
+        * editing/htmlediting.cpp:
+        (WebCore::lastOffsetForEditing):
+
+2009-04-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename positionBeforeNode to positionInParentBeforeNode
+        and positionAfterNode to positionInParentAfterNode
+        in preparation for adding a positionBeforeNode
+        which returns a neighbor-anchored position.
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        No functional changes, thus no tests.
+
+        * dom/PositionConstructors.h:
+        (WebCore::positionInParentBeforeNode):
+        (WebCore::positionInParentAfterNode):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::operator Position):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyle):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::deleteTarget):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializeStartEnd):
+        (WebCore::updatePositionForNodeRemoval):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::input):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::positionAtStartOfInsertedContent):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
+        * editing/htmlediting.cpp:
+        (WebCore::firstEditablePositionAfterPositionInRoot):
+        (WebCore::lastEditablePositionBeforePositionInRoot):
+        (WebCore::rangeCompliantEquivalent):
+        (WebCore::positionBeforeContainingSpecialElement):
+        (WebCore::positionAfterContainingSpecialElement):
+        (WebCore::positionBeforeTabSpan):
+
+2009-04-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Re-organize position creation functions in preparation for adding more
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        Make position functions inline to avoid ref-churn.
+        Remove startPosition/endPosition as they were only used in one place.
+
+        No functional changes, thus no tests.
+
+        * dom/Position.cpp:
+        * dom/Position.h:
+        (WebCore::positionBeforeNode):
+        (WebCore::positionAfterNode):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::moveTo):
+        * editing/TypingCommand.cpp:
+        * editing/htmlediting.cpp:
+        * editing/htmlediting.h:
+        (WebCore::firstDeepEditingPositionForNode):
+        (WebCore::lastDeepEditingPositionForNode):
+        * rendering/RenderObject.cpp:
+
+2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+        
+        [wx] Add wxSize conversions for IntSize.
+        https://bugs.webkit.org/show_bug.cgi?id=29104
+
+        * platform/graphics/IntSize.h:
+        * platform/graphics/wx/IntSizeWx.cpp: Added.
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator wxSize):
+
+2009-09-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+        
+        Chromium uses its own config.h file that was forked from webkit's config.h.
+        By merging in Chromium's defines, Chromium would again be able to use webkit's
+        config.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28882 
+
+        * config.h: Added chromium-specific defines. 
+
+2009-09-09  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Initialize DataTransfer's effectAllowed and dropEffect properties correctly
+        according to HTML5 spec (sec. 7.9.2-7.9.3).
+        https://bugs.webkit.org/show_bug.cgi?id=26700
+        - At the start of a drag operation, the value of effectAllowed should be
+          the string "uninitialized".
+        - At end of dragstart handler, if effectAllowed hasn't been set yet, it
+          should be set to "copy".
+        - on dragenter and dragover event, dropEffect should be initialized to a
+          default value based on the value of effectAllowed.
+        - at end of dragenter and dragover the dropEffect should be set to "none"
+          if the value set by the handler doesn't match the effectAllowed.
+        - on dragleave event, dropEffect should be "none".
+        - on drop event, dropEffect should be the previously negotiated value.
+
+        Test: fast/events/drag-dropeffect.html
+
+        * WebCore.base.exp:
+            Added a parameter to EventHandler::dragSourceMovedTo.
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+            Initialize m_effectAllowed to "uninitialized".
+        (WebCore::Clipboard::sourceOperation):
+            Treat "uninitialized" as meaning no value has been set.
+        * page/DragController.cpp:
+        (WebCore::DragController::DragController):
+            Initialize new member m_destinationDragOperation.
+        (WebCore::DragController::dragExited):
+            Set m_destinationDragOperation to none on dragExit.
+        (WebCore::DragController::performDrag):
+            Set m_destinationDragOperation to current dropEffect.
+        (WebCore::DragController::dragEnteredOrUpdated):
+            Make sure to clear the operation if drag source doesn't allow it.
+        (WebCore::DragController::tryDHTMLDrag):
+            Set a default value for the dst drag op before sending dragEnter/Over.
+        (WebCore::DragController::startDrag):
+            Clear m_destinationDragOperation at start of drag.
+        * page/DragController.h:
+        (WebCore::DragController::destinationDragOperation):
+            Added new member m_destinationDragOperation, and its public getter.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+            dropEffect should be 'none' during dropleave handler, per spec.
+        (WebCore::EventHandler::dragSourceMovedTo):
+            Added DragOperation parameter, so the handler sees the current dropEffect.
+        (WebCore::EventHandler::handleDrag):
+            Assume DragOperationEvery for non-DHTML drags.
+        * page/EventHandler.h:
+            Added DragOperation parameter to dragSourceMovedTo().
+
+2009-09-09  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        1. Adding support/bindings for read-only transactions.
+        2. Disallowing the SQLITE_*_VIEW and REINDEX operations in the
+        private browsing mode.
+        3. Adding an authorizer test.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28918
+
+        Test: storage/test-authorizer.html
+
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::createTransaction): Parses all arguments and executes a
+        transaction.
+        (WebCore::JSDatabase::transaction): Refactored to use
+        createTransaction().
+        (WebCore::JSDatabase::readTransaction): Added to execute read-only
+        transactions using createTransaction().
+        * bindings/v8/custom/V8CustomBinding.h: Added the binding for
+        Database::readTransaction().
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::createTransaction): Parses all arguments and executes a
+        transaction.
+        (WebCore::transaction): Refactored to use createTransaction().
+        (WebCore::readTransaction): Added to execute read-only
+        transactions using createTransaction().
+        * storage/Database.cpp:
+        (WebCore::Database::transaction): Added support for read-only
+        transactions.
+        * storage/Database.h: Added support for read-only transactions.
+        * storage/Database.idl: Added support for read-only transactions.
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::createTempTable): Make it obvious
+        that the statement will be denied in private browsing mode and
+        read-only transactions.
+        (WebCore::DatabaseAuthorizer::dropTempTable): Same.
+        (WebCore::DatabaseAuthorizer::createTempIndex): Same.
+        (WebCore::DatabaseAuthorizer::dropTempIndex): Same.
+        (WebCore::DatabaseAuthorizer::createTempTrigger): Same.
+        (WebCore::DatabaseAuthorizer::dropTempTrigger): Same.
+        (WebCore::DatabaseAuthorizer::createView): Deny in private
+        browsing mode and read-only transactions.
+        (WebCore::DatabaseAuthorizer::createTempView): Same.
+        (WebCore::DatabaseAuthorizer::dropView): Same.
+        (WebCore::DatabaseAuthorizer::dropTempView): Same.
+        (WebCore::DatabaseAuthorizer::allowReindex): Same.
+        * storage/DatabaseAuthorizer.h:
+        * storage/SQLTransaction.cpp: Added support for read-only
+        transactions.
+        (WebCore::SQLTransaction::create):
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::executeSQL):
+        (WebCore::SQLTransaction::acquireLock):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCoordinator.cpp:
+        (WebCore::SQLTransactionCoordinator::acquireLock): Added a new
+        parameter in preparation for a change that will allow multiple
+        read-only transactions on the same DB to run concurrently.
+        * storage/SQLTransactionCoordinator.h:
+
+2009-09-09  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29102, add support for user stylesheet injection.  This is similar
+        to user script injection but allows for user stylesheets to be added.  The stylesheets are applied immediately
+        to all Frames in the PageGroup.
+
+        Added userscripts/simple-stylesheet.html test case.
+
+        * WebCore.base.exp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        * css/CSSStyleSelector.h:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::attach):
+        (WebCore::Document::pageGroupUserSheets):
+        (WebCore::Document::clearPageGroupUserSheets):
+        (WebCore::Document::recalcStyleSelector):
+        * dom/Document.h:
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserStyleSheet):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        (WebCore::PageGroup::removeAllUserContent):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userStyleSheets):
+        * page/UserStyleSheet.h: Added.
+        (WebCore::UserStyleSheet::UserStyleSheet):
+        (WebCore::UserStyleSheet::source):
+        (WebCore::UserStyleSheet::url):
+        (WebCore::UserStyleSheet::patterns):
+        (WebCore::UserStyleSheet::worldID):
+        * page/UserStyleSheetTypes.h: Added.
+
+2009-09-09  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] CSS Style -webkit-box-shadow is not rendered correctly on
+        Qt platform
+        https://bugs.webkit.org/show_bug.cgi?id=23291
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+         Added the ability to draw shadows for all these curves.
+
+2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add the qwebgraphicsitem.cpp to the build system.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28862
+
+        * WebCore.pro:
+
+2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx port] Move functions in TemporaryLinkStubs.cpp out to files where
+        they belong.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29088
+
+        * editing/wx/EditorWx.cpp:
+        (WebCore::Editor::showColorPanel):
+        (WebCore::Editor::showFontPanel):
+        (WebCore::Editor::showStylesPanel):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        * platform/graphics/wx/IconWx.cpp: Added.
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::Image::drawPattern):
+        * platform/wx/CursorWx.cpp:
+        (WebCore::moveCursor):
+        * platform/wx/FileChooserWx.cpp: Added.
+        (WebCore::FileChooser::basenameForWidth):
+        * platform/wx/KURLWx.cpp: Added.
+        (WebCore::KURL::fileSystemPath):
+        * platform/wx/SSLKeyGeneratorWx.cpp: Added.
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/wx/SearchPopupMenuWx.cpp: Added.
+        (WebCore::SearchPopupMenu::SearchPopupMenu):
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        (WebCore::SearchPopupMenu::enabled):
+        * platform/wx/SharedBufferWx.cpp: Added.
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/wx/SystemTimeWx.cpp: Added.
+        (WebCore::userIdleTime):
+        * platform/wx/TemporaryLinkStubs.cpp: Removed.
+        * platform/wx/TextBreakIteratorInternalICUWx.cpp: Added.
+        (WebCore::currentSearchLocaleID):
+        (WebCore::currentTextBreakLocaleID):
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::setIsSelected):
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Geolocation incorrectly calls error callback in case of exception in success callback.
+        https://bugs.webkit.org/show_bug.cgi?id=27255
+
+        Test: fast/dom/Geolocation/callback-exception.html
+
+        * bindings/js/JSCustomPositionCallback.cpp: Modified.
+        (WebCore::JSCustomPositionCallback::handleEvent): Modified. Removed raisedException out param.
+        * bindings/js/JSCustomPositionCallback.h: Modified. Removed raisedException out param from handleEvent method and made handleEvent private.
+        * bindings/js/JSCustomPositionErrorCallback.h: Modified. Made handleEvent private.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::sendPosition): Modified. No longer call error callback in case of exception in success callback.
+        * page/PositionCallback.h: Modified. Removed raisedException out param from handleEvent method.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        When Geolocation permission is denied, stops watches as well as one-shots.
+        https://bugs.webkit.org/show_bug.cgi?id=28305.
+
+        Tests: fast/dom/Geolocation/watch.html
+               fast/dom/Geolocation/permission-denied-stops-watches.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::setIsAllowed): Modified. Marks the permission error as fatal.
+        (WebCore::Geolocation::handleError): Modified. If the error is fatal, stops watchers as well as one-shots.
+        * page/PositionError.h: Modified.
+        (WebCore::PositionError::setIsFatal): Added. Marks an error as fatal.
+        (WebCore::PositionError::isFatal): Added. Determines whether an error is fatal.
+
+2009-09-09  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+
+        Added getter/setter methods and trivial inline implementations for each.
+        (Note that they are not yet actually used.)
+        Once the Chromium code is changed to use them instead of directly accessing the
+        member variables, the member variables should be made private and cleaned up.
+
+        No new tests (no functional behavior changed).
+
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::mainURL):
+        (WebCore::ChromiumDataObject::setMainURL):
+        (WebCore::ChromiumDataObject::mainURLTitle):
+        (WebCore::ChromiumDataObject::setMainURLTitle):
+        (WebCore::ChromiumDataObject::textPlain):
+        (WebCore::ChromiumDataObject::setTextPlain):
+        (WebCore::ChromiumDataObject::textHTML):
+        (WebCore::ChromiumDataObject::setTextHTML):
+        (WebCore::ChromiumDataObject::htmlBaseURL):
+        (WebCore::ChromiumDataObject::setHTMLBaseURL):
+        (WebCore::ChromiumDataObject::content):
+        (WebCore::ChromiumDataObject::releaseContent):
+        (WebCore::ChromiumDataObject::setContent):
+        (WebCore::ChromiumDataObject::contentFileExtension):
+        (WebCore::ChromiumDataObject::setContentFileExtension):
+        (WebCore::ChromiumDataObject::contentFileName):
+        (WebCore::ChromiumDataObject::setContentFileName):
+        (WebCore::ChromiumDataObject::fileNames):
+        (WebCore::ChromiumDataObject::setFileNames):
+        (WebCore::ChromiumDataObject::takeFileNames):
+
+2009-09-08  Pat Bradley  <vincent.bradley@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] locale date displays incorrect date format in symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=29032
+
+        strftime() in Symbian does not support #
+        Layout tests cannot be run on Symbian yet, so they are not updated.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-09-09  Rohini Ananth <rohini.ananth@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        NPAPI Plugin NPP_AsFile not working on Qt Webkit
+        https://bugs.webkit.org/show_bug.cgi?id=29068
+
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::openTemporaryFile)
+        Autoremove property of QTemporaryFile has been set to false. Hence closeFile() just closes and does not delete the file.
+        This solves the deletion of created temp file in PluginStream::destroyStream() before passing to plugin in NPP_AsFile.
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Remove a few incorrect changes I left in.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Support numeric index getters in bindings
+        https://bugs.webkit.org/show_bug.cgi?id=29067
+
+        Add HasNumericIndexGetter to indicate a non-custom getter that
+        returns a number.  The numeric index getter also uses PropertySlot's
+        setValue rather than setCustomIndex to avoid an additional indirect
+        call.
+
+        * bindings/js/JSCanvasByteArrayCustom.cpp:
+        * bindings/js/JSCanvasFloatArrayCustom.cpp:
+        * bindings/js/JSCanvasIntArrayCustom.cpp:
+        * bindings/js/JSCanvasShortArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::item):
+        * html/canvas/CanvasByteArray.idl:
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::get):
+        (WebCore::CanvasFloatArray::item):
+        * html/canvas/CanvasFloatArray.idl:
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::get):
+        (WebCore::CanvasIntArray::item):
+        * html/canvas/CanvasIntArray.idl:
+        * html/canvas/CanvasPixelArray.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::get):
+        (WebCore::CanvasShortArray::item):
+        * html/canvas/CanvasShortArray.idl:
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::get):
+        (WebCore::CanvasUnsignedByteArray::item):
+        * html/canvas/CanvasUnsignedByteArray.idl:
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::get):
+        (WebCore::CanvasUnsignedIntArray::item):
+        * html/canvas/CanvasUnsignedIntArray.idl:
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::item):
+        * html/canvas/CanvasUnsignedShortArray.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for 2.8.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-08  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        In Mac Chromium, clicking below the last line of an editable area (textarea or
+        contenteditable) should put the caret at the end of the last line, as in Mac Safari.
+
+        Tests: LayoutTests/editing/selection/click-in-margins-inside-editable-div.html
+               LayoutTests/editing/selection/click-in-padding-with-multiple-line-boxes.html
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Change #if PLATFORM_MAC to be Mac-Chrome-inclusive.
+
+2009-09-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Make sure not to do an early return when a data URL stylesheet successfully loads.  We need to still
+        clear the old cached sheet out of all existing Frames.  Fixes the data URL stylesheet layout test failure.
+
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+
+2009-09-08  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * dom/Document.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        More robust wx build fix for 2.9.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27046
+        Implement CSSOM DocumentView.caretRangeFromPoint
+
+        Tests: fast/dom/Document/CaretRangeFromPoint/basic.html
+               fast/dom/Document/CaretRangeFromPoint/replace-element.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::caretRangeFromPoint):
+        * dom/Document.h:
+        * dom/Document.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, generate derived sources earlier in order to make sure
+        they're found by the build system when generating the list of sources to build.
+
+        * wscript:
+
+2009-09-08  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        <iterator> include in V8Proxy.h is spurious and causing ObjC compile issues for Chromium.
+
+        Test: Chromium mac canary build is fixed.
+
+        * bindings/v8/V8Proxy.h: Remove <iterator> include.
+
+2009-09-08  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed attempt to fix the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28987, make the Document cache the page's user stylesheet in
+        parsed form.  Allows the sheet to survive across destruction/re-creation of the CSSStyleSelector.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        * css/CSSStyleSelector.h:
+        * dom/Document.cpp:
+        (WebCore::Document::attach):
+        (WebCore::Document::pageUserSheet):
+        (WebCore::Document::clearPageUserSheet):
+        (WebCore::Document::recalcStyleSelector):
+        * dom/Document.h:
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+        * page/Settings.cpp:
+        (WebCore::Settings::setUserStyleSheetLocation):
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed buildfix.
+
+        Fix Qt build after 48167, by adding the new cpp/h files
+        added to WebCore.gypi to WebCore.pro as well.
+
+        * WebCore.pro:
+
+2009-09-08  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        should not pass URI fragments to libsoup
+        https://bugs.webkit.org/show_bug.cgi?id=28687
+
+        Strip the fragment from the URI before passing it to soup, since
+        it forwards it to servers in some cases (like when using a proxy)
+        which confuses them and makes them return 403/404.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+        (WebCore::):
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add QGraphicsScene events support to the Qt platform events.
+
+        * platform/PlatformMouseEvent.h:
+        * platform/PlatformWheelEvent.h:
+        * platform/qt/PlatformMouseEventQt.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/qt/WheelEventQt.cpp:
+        (WebCore::PlatformWheelEvent::applyDelta):
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-09-08  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Cleanup: remove a few deprecated methods.
+        https://bugs.webkit.org/show_bug.cgi?id=28960
+
+        No new tests, just syntactic sugar.
+
+        * platform/network/chromium/ResourceRequest.h:
+        * platform/network/chromium/ResourceResponse.h:
+
+2009-09-08  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28981
+
+        [Qt] make npapi.h compile in winscw compiler.
+
+        Add XP_SYMBIAN macro to identify Symbian OS; this macro should be used for Symbian
+        specific changes in npapi.h.
+        Undefine XP_WIN when building for Symbian to avoid including Windows specific code.
+
+        * bridge/npapi.h:
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Web Inspector assertion failure related to marking
+        https://bugs.webkit.org/show_bug.cgi?id=28997
+
+        When wrapping the callback the JSInspectorCallbackWrapper creator was using
+        inheritorID for the prototype structure which is unsafe for anything other
+        than a pure JS object.  Instead we now create a new structure, which while
+        inefficient is not problematic as this code is not hit frequently.
+
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+
+2009-09-08  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add missing extension to the file entry in WebCore.vcproj.
+
+        * WebCore.vcproj/WebCore.vcproj: Added "cpp".
+
+2009-09-08  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        dataTransfer.types() should not return Files if file list is empty in the clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28891
+
+        We change the behavior to handle the empty file list in order to match the spec.
+
+        Tested by clipboard-file-access.html.
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::types):
+
+2009-09-08  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Handle middle click in Chromium like QT
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+        Tested by middle-click-onpaste.html.
+
+        * platform/Pasteboard.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::getData):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::isSelectionMode):
+        (WebCore::Pasteboard::setSelectionMode):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PasteboardPrivate.h:
+        (WebCore::PasteboardPrivate::):
+
+2009-09-08  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Eric Seidel.
+
+        WebInspector: Adds a timeline agent to InspectorController that collects
+        high-level timing data about event dispatch, layout, painting and HTML
+        parsing and makes it available to Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=25503
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * dom/Document.h:
+        (WebCore::Document::inspectorTimelineAgent):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * inspector/DOMDispatchTimelineItem.cpp: Added.
+        (WebCore::DOMDispatchTimelineItem::DOMDispatchTimelineItem):
+        (WebCore::DOMDispatchTimelineItem::convertToScriptObject):
+        * inspector/DOMDispatchTimelineItem.h: Added.
+        (WebCore::DOMDispatchTimelineItem::~DOMDispatchTimelineItem):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::enableTimeline):
+        (WebCore::InspectorBackend::disableTimeline):
+        (WebCore::InspectorBackend::timelineEnabled):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::enableTimeline):
+        (WebCore::InspectorController::disableTimeline):
+        (WebCore::InspectorController::timelineEnabled):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::timelineAgent):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::timelineWasEnabled):
+        (WebCore::InspectorFrontend::timelineWasDisabled):
+        (WebCore::InspectorFrontend::addItemToTimeline):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorTimelineAgent.cpp: Added.
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::~InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::currentTimeInMilliseconds):
+        (WebCore::InspectorTimelineAgent::sessionTimeInMilliseconds):
+        * inspector/InspectorTimelineAgent.h: Added.
+        * inspector/TimelineItem.cpp: Added.
+        (WebCore::TimelineItem::TimelineItem):
+        (WebCore::TimelineItem::addToTimeline):
+        (WebCore::TimelineItem::convertToScriptObject):
+        (WebCore::TimelineItem::convertChildrenToScriptArray):
+        (WebCore::TimelineItem::addChildItem):
+        * inspector/TimelineItem.h: Added.
+        (WebCore::):
+        (WebCore::TimelineItem::~TimelineItem):
+        (WebCore::TimelineItem::previous):
+        (WebCore::TimelineItem::releasePrevious):
+        (WebCore::TimelineItem::setEndTime):
+        (WebCore::TimelineItem::type):
+        * inspector/front-end/TimelineAgent.js: Added.
+        (WebInspector.TimelineAgent):
+        (WebInspector.addItemToTimeline):
+        (WebInspector.timelineWasEnabled):
+        (WebInspector.timelineWasDisabled):
+        * inspector/front-end/inspector.html:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h:
+        (WebCore::FrameView::inspectorTimelineAgent):
+        * page/Page.cpp:
+        (WebCore::Page::inspectorTimelineAgent):
+        * page/Page.h:
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix unused variable warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29018
+
+        No functional change, no tests.
+
+        * history/qt/HistoryItemQt.cpp:
+        (WebCore::HistoryItem::restoreState):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::putImageData):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintMenuList):
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Use the declaration order in initializer lists
+        https://bugs.webkit.org/show_bug.cgi?id=29017
+
+        No functional change, no new tests.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+
+2009-09-08  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement ValidityState::typeMismatch() for <input type=number>.
+        https://bugs.webkit.org/show_bug.cgi?id=28934
+
+        Test: fast/forms/ValidityState-typeMismatch-number.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::formStringToDouble):
+        * html/HTMLInputElement.h:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+        * html/ValidityState.h:
+
+2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Another attempt of a buildfix.
+
+        * GNUmakefile.am: Modified. Remove some extra IDL files added in r48153.
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make cursor set cleaner in QtWebKit Api: eliminate SetCursorEvent hack.
+        https://bugs.webkit.org/show_bug.cgi?id=28865
+
+        Save the QCursor as a property in WidgetQt::setCursor
+        and actually change the cursor in QWebView::event() by making use
+        of the QEvent::DynamicPropertyChange event type.
+        When unsetCursor() is called on the QWidget we can fallback to
+        the cursor set by WebCore.
+
+        Patch by Kenneth Rohde Christiansen <kenneth@webkit.org> and
+                 Antonio Gomes <antonio.gomes@openbossa.org> on 2009-09-07
+
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+
+2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Buildfix for build error introduced in r48150.
+
+        * GNUmakefile.am: Modified. Added missing IDL files.
+
+2009-09-08  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Buildfix. Build error caused by r48150.
+
+        * WebCore.pro: missing IDL files added
+
+2009-09-07  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update Canvas 3D implementation to match spec
+        https://bugs.webkit.org/show_bug.cgi?id=29010
+
+        This adds several new CanvasXXXArray classes each of which has a custom constructor
+        and custom getters and setters. Also changed CanvasRenderingContext3D and GraphicsContext3D
+        to match the new and changed API.
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasArrayBufferConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasArrayBufferConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::bufferData):
+        (WebCore::JSCanvasRenderingContext3D::bufferSubData):
+        (WebCore::JSCanvasRenderingContext3D::texImage2D):
+        (WebCore::JSCanvasRenderingContext3D::texSubImage2D):
+        * bindings/js/JSCanvasShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::canvasArrayBuffer):
+        (WebCore::JSDOMWindow::canvasByteArray):
+        (WebCore::JSDOMWindow::canvasUnsignedByteArray):
+        (WebCore::JSDOMWindow::canvasIntArray):
+        (WebCore::JSDOMWindow::canvasUnsignedIntArray):
+        (WebCore::JSDOMWindow::canvasShortArray):
+        (WebCore::JSDOMWindow::canvasUnsignedShortArray):
+        (WebCore::JSDOMWindow::canvasFloatArray):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::paint):
+        * html/canvas/CanvasArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArray.idl: Added.
+        * html/canvas/CanvasArrayBuffer.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArrayBuffer.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArrayBuffer.idl: Added.
+        * html/canvas/CanvasByteArray.cpp:
+        * html/canvas/CanvasByteArray.h:
+        * html/canvas/CanvasByteArray.idl:
+        * html/canvas/CanvasFloatArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasFloatArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasFloatArray.idl: Added.
+        * html/canvas/CanvasIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasIntArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasIntArray.idl: Added.
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::CanvasRenderingContext3D):
+        (WebCore::CanvasRenderingContext3D::markContextChanged):
+        (WebCore::CanvasRenderingContext3D::beginPaint):
+        (WebCore::CanvasRenderingContext3D::endPaint):
+        (WebCore::CanvasRenderingContext3D::reshape):
+        (WebCore::CanvasRenderingContext3D::sizeInBytes):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::bufferData):
+        (WebCore::CanvasRenderingContext3D::bufferSubData):
+        (WebCore::CanvasRenderingContext3D::checkFramebufferStatus):
+        (WebCore::CanvasRenderingContext3D::clear):
+        (WebCore::CanvasRenderingContext3D::createBuffer):
+        (WebCore::CanvasRenderingContext3D::createFramebuffer):
+        (WebCore::CanvasRenderingContext3D::createTexture):
+        (WebCore::CanvasRenderingContext3D::createProgram):
+        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::createShader):
+        (WebCore::CanvasRenderingContext3D::deleteBuffer):
+        (WebCore::CanvasRenderingContext3D::deleteFramebuffer):
+        (WebCore::CanvasRenderingContext3D::deleteProgram):
+        (WebCore::CanvasRenderingContext3D::deleteRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::deleteShader):
+        (WebCore::CanvasRenderingContext3D::deleteTexture):
+        (WebCore::CanvasRenderingContext3D::drawArrays):
+        (WebCore::CanvasRenderingContext3D::drawElements):
+        (WebCore::CanvasRenderingContext3D::getBoolean):
+        (WebCore::CanvasRenderingContext3D::getBooleanv):
+        (WebCore::CanvasRenderingContext3D::getBufferParameteri):
+        (WebCore::CanvasRenderingContext3D::getBufferParameteriv):
+        (WebCore::CanvasRenderingContext3D::getFloat):
+        (WebCore::CanvasRenderingContext3D::getFloatv):
+        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteri):
+        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::CanvasRenderingContext3D::getInteger):
+        (WebCore::CanvasRenderingContext3D::getIntegerv):
+        (WebCore::CanvasRenderingContext3D::getProgrami):
+        (WebCore::CanvasRenderingContext3D::getProgramiv):
+        (WebCore::CanvasRenderingContext3D::getProgramInfoLog):
+        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteri):
+        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteriv):
+        (WebCore::CanvasRenderingContext3D::getShaderi):
+        (WebCore::CanvasRenderingContext3D::getShaderiv):
+        (WebCore::CanvasRenderingContext3D::getShaderInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderSource):
+        (WebCore::CanvasRenderingContext3D::getTexParameterf):
+        (WebCore::CanvasRenderingContext3D::getTexParameterfv):
+        (WebCore::CanvasRenderingContext3D::getTexParameteri):
+        (WebCore::CanvasRenderingContext3D::getTexParameteriv):
+        (WebCore::CanvasRenderingContext3D::getUniformf):
+        (WebCore::CanvasRenderingContext3D::getUniformfv):
+        (WebCore::CanvasRenderingContext3D::getUniformi):
+        (WebCore::CanvasRenderingContext3D::getUniformiv):
+        (WebCore::CanvasRenderingContext3D::getUniformLocation):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribf):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribfv):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribi):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribiv):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribOffset):
+        (WebCore::CanvasRenderingContext3D::texImage2D):
+        (WebCore::CanvasRenderingContext3D::texParameterf):
+        (WebCore::CanvasRenderingContext3D::texParameteri):
+        (WebCore::CanvasRenderingContext3D::texSubImage2D):
+        (WebCore::CanvasRenderingContext3D::uniform1f):
+        (WebCore::CanvasRenderingContext3D::uniform1fv):
+        (WebCore::CanvasRenderingContext3D::uniform1i):
+        (WebCore::CanvasRenderingContext3D::uniform1iv):
+        (WebCore::CanvasRenderingContext3D::uniform2f):
+        (WebCore::CanvasRenderingContext3D::uniform2fv):
+        (WebCore::CanvasRenderingContext3D::uniform2i):
+        (WebCore::CanvasRenderingContext3D::uniform2iv):
+        (WebCore::CanvasRenderingContext3D::uniform3f):
+        (WebCore::CanvasRenderingContext3D::uniform3fv):
+        (WebCore::CanvasRenderingContext3D::uniform3i):
+        (WebCore::CanvasRenderingContext3D::uniform3iv):
+        (WebCore::CanvasRenderingContext3D::uniform4f):
+        (WebCore::CanvasRenderingContext3D::uniform4fv):
+        (WebCore::CanvasRenderingContext3D::uniform4i):
+        (WebCore::CanvasRenderingContext3D::uniform4iv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::CanvasRenderingContext3D::useProgram):
+        (WebCore::CanvasRenderingContext3D::validateProgram):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttribPointer):
+        (WebCore::CanvasRenderingContext3D::viewport):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasShortArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasShortArray.idl: Added.
+        * html/canvas/CanvasTexture.cpp:
+        (WebCore::CanvasTexture::CanvasTexture):
+        * html/canvas/CanvasTexture.h:
+        (WebCore::CanvasTexture::isCubeMapRWrapModeInitialized):
+        (WebCore::CanvasTexture::setCubeMapRWrapModeInitialized):
+        * html/canvas/CanvasUnsignedByteArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedByteArray.h: Added with properties svn:eol-style and svn:mime-type.
+         * html/canvas/CanvasUnsignedByteArray.idl: Added.
+        * html/canvas/CanvasUnsignedIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedIntArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedIntArray.idl: Added.
+        * html/canvas/CanvasUnsignedShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedShortArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedShortArray.idl: Added.
+        * page/DOMWindow.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::beginPaint):
+        (WebCore::GraphicsContext3D::endPaint):
+        (WebCore::GraphicsContext3D::bindTexture):
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+        (WebCore::GraphicsContext3D::checkFramebufferStatus):
+        (WebCore::GraphicsContext3D::drawArrays):
+        (WebCore::GraphicsContext3D::drawElements):
+        (WebCore::GraphicsContext3D::texParameterf):
+        (WebCore::GraphicsContext3D::texParameteri):
+        (WebCore::GraphicsContext3D::uniform1f):
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2f):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3f):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4f):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1i):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2i):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3i):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4i):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::vertexAttrib1f):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2f):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3f):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4f):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+        (WebCore::GraphicsContext3D::vertexAttribPointer):
+        (WebCore::GraphicsContext3D::getBoolean):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getFloat):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getInteger):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getBufferParameteri):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteri):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getProgrami):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteri):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderi):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getTexParameterf):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteri):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformf):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformi):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getVertexAttribf):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribi):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+        (WebCore::GraphicsContext3D::getVertexAttribOffset):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+        (WebCore::GraphicsContext3D::sizeInBytes):
+
+2009-09-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Make m_windowVisible more consistent with the actual visibility of the inspector.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+
+2009-09-07  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed speculative build fix for Snow Leopard.
+
+        * platform/GeolocationService.cpp:
+        (WebCore::createGeolocationServiceNull):
+
+2009-09-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds a mock Geolocation service. This will be used to provide predictable behavior of the
+        Geolocation API for use in LayoutTests. Later changes will integrate the the mock
+        Geolocation service with DumpRenderTree.
+        https://bugs.webkit.org/show_bug.cgi?id=28264
+
+        The mock Geolocation service returns a fixed position or error. This position or error can be
+        set through static methods on the GeolocationService class. The position or error is shared
+        between all instances of the mock Geolocation service.
+
+        Implementation details.
+        The GeolocationService object maintains a pointer to a factory function which it uses to create
+        Geolocation service instances. Each platform implementing Geolocation sets this pointer
+        to the factory function for their platform's implementation. When the mock Geolocation service
+        is activated, the factory function pointer is reset to the factory function for the mock service.
+
+        Test: fast/dom/Geolocation/error.html
+
+        * WebCore.base.exp: Modified. Exports GeolocationServiceMock methods.
+        * GNUMakefile.am: Modified. Added GeolocationServiceMock files.
+        * WebCore.gypi: Modified. Added GeolocationServiceMock files.
+        * WebCore.pro: Modified. Added GeolocationServiceMock files.
+        * WebCore.vcproj/WebCore.vcproj: Modified. Added GeolocationServiceMock files.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Modified. Added mock directory to includes.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Added GeolocationServiceMock files and exports some headers.
+        * WebCoreSources.bkl: Modified. Added GeolocationServiceMock files.
+        * page/ChromeClient.h: Modified. Fixed comment.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::setIsAllowed): Modified. Fixed error string.
+        * platform/GeolocationService.cpp: Modified.
+        (WebCore::createGeolocationServiceNull): Added. Returns null in place of a Geolocation service. Used to avoid link errors on platforms where Geolocation is not implemented.
+        (WebCore::GeolocationService::create): Added. Uses the factory function pointer to create a Geolocation service implementation.
+        (WebCore::GeolocationService::useMock): Added. Configures the GeolocationServie to use the mock implementation.
+        * platform/GeolocationService.h: Modified.
+        * platform/mock: Added.
+        * platform/mock/GeolocationServiceMock.cpp: Added.
+        (WebCore::GeolocationServiceMock::create): Added. Creates a GeolocationServiceMock object.
+        (WebCore::GeolocationServiceMock::GeolocationServiceMock): Added. Constructor.
+        (WebCore::GeolocationServiceMock::~GeolocationServiceMock): Added. Destructor.
+        (WebCore::GeolocationServiceMock::setPosition): Added. Sets the position that will be returned by the object.
+        (WebCore::GeolocationServiceMock::setError): Added. Sets the error that will be returned by the object.
+        (WebCore::GeolocationServiceMock::startUpdating): Added. GeolocationService implementation. Starts the service.
+        (WebCore::GeolocationServiceMock::stopUpdating): Added. GeolocationService implementation. Stops the service.
+        (WebCore::GeolocationServiceMock::timerFired): Added. Used to provide an asynchronous callback when the service is started.
+        (WebCore::GeolocationServiceMock::makeGeolocationCallbackFromAllInstances): Added. Used to call back when the position or error is updated.
+        (WebCore::GeolocationServiceMock::makeGeolocationCallback): Added. Used to call back when the service starts.
+        (WebCore::GeolocationServiceMock::initStatics): Added. Initializes statics members with constructors.
+        (WebCore::GeolocationServiceMock::cleanUpStatics): Added. Cleans up static members with constructors.
+        * platform/mock/GeolocationServiceMock.h: Added.
+        (WebCore::GeolocationServiceMock::lastPosition): Added. Returns the fixed position.
+        (WebCore::GeolocationServiceMock::lastError): Added. Returns the fixed error.
+        * platform/gtk/GeolocationServiceGtk.cpp: Modified.
+        (WebCore::GeolocationServiceGtk::create): Added. Creates an instance of GeolocationServiceGtk.
+        * platform/gtk/GeolocationServiceGtk.h: Modified.
+        * platform/mac/GeolocationServiceMac.h: Modified.
+        * platform/mac/GeolocationServiceMac.mm: Modified.
+        (WebCore::GeolocationServiceMac::create): Added. Creates an instance of GeolocationServiceMac.
+
+2009-09-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28985
+
+        We need to be slightly more careful about how we pick up a script
+        execution context.  In particular, we were getting the wrong document
+        for frames that had been navigated somewhere else.
+
+        In the long term, we should think about a better algorithm for
+        computing the script context.
+
+        Fixes LayoutTests/http/tests/xmlhttprequest/detaching-frame-2.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieveFrame):
+
+2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for 2.8 compilation.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed build fix.
+
+        Reverting r48121 to fix Windows build errors.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Removed.
+        * websockets/WebSocketChannel.h: Removed.
+        * websockets/WebSocketChannelClient.h: Removed.
+        * websockets/WebSocketHandshake.cpp: Removed.
+        * websockets/WebSocketHandshake.h: Removed.
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed speculative build fix.
+
+        Reverted previous build fix as it didn't fix the problem.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+
+2009-09-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, build fix.
+
+        [Qt] Fix build after SHARED_WORKERS are enabled by default (r48131)
+
+        * WebCore.pro:
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed build fix.
+
+        Temporarily removed depenency between JSEventTarget.cpp and WebSocket.h in an attempt to fix a windows build break.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS by default.
+        https://bugs.webkit.org/show_bug.cgi?id=28959
+
+        Tests (enabled in a separate patch):
+               fast/workers/shared-worker-constructor.html
+               fast/workers/shared-worker-context-gc.html
+               fast/workers/shared-worker-event-listener.html
+               fast/workers/shared-worker-exception.html
+               fast/workers/shared-worker-frame-lifecycle.html
+               fast/workers/shared-worker-gc.html
+               fast/workers/shared-worker-lifecycle.html
+               fast/workers/shared-worker-load-error.html
+               fast/workers/shared-worker-location.html
+               fast/workers/shared-worker-navigator.html
+               fast/workers/shared-worker-replace-global-constructor.html
+               fast/workers/shared-worker-replace-self.html
+               fast/workers/shared-worker-shared.html
+               fast/workers/shared-worker-simple.html
+               http/tests/workers/shared-worker-importScripts.html
+               http/tests/workers/shared-worker-redirect.html
+               http/tests/xmlhttprequest/workers/shared-worker-close.html
+               http/tests/xmlhttprequest/workers/shared-worker-methods-async.html
+               http/tests/xmlhttprequest/workers/shared-worker-methods.html
+               http/tests/xmlhttprequest/workers/shared-worker-xhr-file-not-found.html
+
+        * config.h: Removed some whitespace/touched the file to force a full rebuild on the build-bots.
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * dom/DOMWindow.idl: Removed unnecessary whitespace to force a rebuild on the build-bots to pickup the flag change.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerScriptLoader::load):
+        Clean up bitrot in SharedWorker code - DenyCrossOriginRedirect is now DenyCrossOriginRequests.
+        * workers/SharedWorkerContext.cpp:
+        (WebCore::SharedWorkerContext::dispatchConnect):
+        Clean up bitrot - updated SharedWorker code to reflect new MessageEvent API.
+
+2009-09-07  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Add new file to sources list.
+
+        * GNUmakefile.am:
+
+2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for wx SVN trunk. 
+
+        * config.h:
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::paintButton):
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-07  Chris Hills <chaz@chaz6.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Use direct includes for Phonon, not the pretty ones
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+
+2009-09-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket API implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+        
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
+        Other build systems will be updated once the code is functional.
+        Tests will be landed once the code is completed and functional.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toWebSocket):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::isValidProtocolString):
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::eventListeners):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Added.
+        * websockets/WebSocketChannel.h: Added.
+        * websockets/WebSocketChannelClient.h: Added.
+        * websockets/WebSocketHandshake.cpp: Added.
+        * websockets/WebSocketHandshake.h: Added.
+
+2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26854
+        [GTK] Needs API to allow more control over outgoing requests
+
+        Add infrastructure required to provide the new
+        WebKitNetworkResponse object in our API.
+
+        * GNUmakefile.am: Add new files to the build.
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+        * platform/network/soup/ResourceResponse.h:
+        * platform/network/soup/ResourceResponseSoup.cpp: Added.
+        (WebCore::ResourceResponse::toSoupMessage):
+
+2009-09-07  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Cleanup document/frame null-checking in V8DOMWindowCustom.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=29009
+
+        Be consistent in document and frame null checks.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+
+2009-09-07  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [Soup] Limit the number of connections
+        https://bugs.webkit.org/show_bug.cgi?id=18431
+
+        Increase the maximum number of per host and total connections to
+        similar values than those used by the other modern browsers. Seems
+        to significantly improve page loading time in many cases.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ensureSessionIsInitialized):
+
+2009-09-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Various minor chromium appcache modifications.
+        https://bugs.webkit.org/show_bug.cgi?id=28960
+
+        No new tests.
+
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+          Fix a null pointer exception.
+        (WebCore::ACCESSOR_GETTER):
+        * platform/network/chromium/ResourceRequest.h:
+          Switch from appCache 'context' to 'host' terminology.
+          Note: leaving the old deprecated accessors in place until the matching
+          change in chrome is landed to use the new accessors.
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::appCacheHostID):
+        (WebCore::ResourceRequest::setAppCacheHostID):
+        (WebCore::ResourceRequest::appCacheContextID):
+        (WebCore::ResourceRequest::setAppCacheContextID):
+        * platform/network/chromium/ResourceResponse.h:
+          Add an appCacheManifestURL getter/setter.
+          Drop the 'get' prefix from the appCacheID getter.
+          Note: leaving the old deprecated 'get' prefixed accessor in place until the matching
+          change in chrome is landed to use the new accessor.
+        (WebCore::ResourceResponse::appCacheID):
+        (WebCore::ResourceResponse::appCacheManifestURL):
+        (WebCore::ResourceResponse::setAppCacheManifestURL):
+        (WebCore::ResourceResponse::getAppCacheID):
+
+2009-09-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28359
+        Cleanup: Undo some accidental changes around DOMApplicationCache.
+        - Restore support for constructing a DOMApplicationCache object with a null frame ptr.
+        - Return a non-null object for window.applicationCache when the feature is disabled.
+        - Simplify the swapCache method.
+
+        Test: http/tests/appcache/disabled.html
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::DOMApplicationCache):
+        (WebCore::DOMApplicationCache::swapCache):
+        (WebCore::DOMApplicationCache::scriptExecutionContext):
+        * loader/appcache/DOMApplicationCache.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::applicationCache):
+
+2009-09-06  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        hostname and host are mixed up when manipulating anchor elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28954
+
+        handle the case of port 0.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+
+2009-09-06  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make hidden elements not focusable.
+
+        Clean up supportsFocus and isFocusable.
+        supportsFocus now strictly means that the node can be focused by default.
+        This is true for links, form controls and content editable elements for example.
+        isFocusable means that the user can actually focus it.
+        All (2) calls to supportsFocus have been updated to take this into account.
+        
+        Make a elements without href work correctly as well.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27099
+
+        Tests: fast/events/click-focus-anchor.html
+               fast/events/tab-focus-anchor.html
+               fast/events/tab-focus-hidden.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::focus):
+        * dom/Node.cpp:
+        (WebCore::Node::supportsFocus):
+        (WebCore::Node::isFocusable):
+        * dom/Node.h:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::supportsFocus):
+        (WebCore::HTMLAnchorElement::isMouseFocusable):
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::supportsFocus):
+        * html/HTMLAreaElement.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::supportsFocus):
+        * html/HTMLElement.h:
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::supportsFocus):
+        * html/HTMLFieldSetElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::supportsFocus):
+        (WebCore::HTMLFormControlElement::isFocusable):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::supportsFocus):
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::supportsFocus):
+        * html/HTMLLegendElement.h:
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::supportsFocus):
+        (WebCore::HTMLOptGroupElement::isFocusable):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::supportsFocus):
+        (WebCore::HTMLOptionElement::isFocusable):
+        * html/HTMLOptionElement.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchMouseEvent):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocus):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::supportsFocus):
+        (WebCore::SVGAElement::isFocusable):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::supportsFocus):
+        * wml/WMLAElement.h:
+        * wml/WMLFormControlElement.cpp:
+        (WebCore::WMLFormControlElement::supportsFocus):
+        (WebCore::WMLFormControlElement::isFocusable):
+        * wml/WMLFormControlElement.h:
+
+2009-09-06  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by Dimitri Glazkov.
+
+        Expose functions to set the caret blink interval for Linux Chromium.
+        Default value is set to that of RenderTheme::caretBlankInterval().
+        Uses caretBlinkIntervalInternal to avoid overriding
+        RenderThemeChromiumSkia::caretBlankInterval to preserve the disabling
+        of blinking caret required for layout tests.
+        https://bugs.webkit.org/show_bug.cgi?id=28931
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
+        (WebCore::RenderThemeChromiumLinux::caretBlinkIntervalInternal):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-06  Ada Chan  <adachan@apple.com>
+
+        Remove an extra </File> in WebCore.vcproj.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-06  Timothy Hatcher  <timothy@apple.com>
+
+        Adds a persistent setting for color format in the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28889
+
+        Reviewed by Dan Bernstein.
+
+        * English.lproj/localizedStrings.js: New strings.
+        * inspector/front-end/Color.js: Minor style fixes.
+        (WebInspector.Color.prototype.toString): Added. Replaces the individual
+        "toFoo" functions. Takes a optional arguments for the color format to return.
+        * inspector/front-end/Images/paneSettingsButtons.png: Added.
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._changeColorFormat): Update the sections to show
+        the new color format.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay):
+        Use the new toString function on Color.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Use the persistent setting
+        to format colors by default. Add a tooltip for the color swatch.
+        * inspector/front-end/inspector.css: New styles for the settings menu.
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded): Initilize the colorFormat preference.
+
+2009-09-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove Qt v4.6 check from the prefetchDNS implementation
+        https://bugs.webkit.org/show_bug.cgi?id=28993
+
+        * platform/network/qt/DnsPrefetchHelper.cpp:
+        * platform/network/qt/DnsPrefetchHelper.h:
+
+2009-09-06  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Drop <definition-src> support
+        https://bugs.webkit.org/show_bug.cgi?id=28991
+
+        http://dev.w3.org/SVG/profiles/1.1F2/publish/changes.html#FontsChapter
+
+        * DerivedSources.cpp: Remove references to definition-src.
+        * DerivedSources.make: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap): Ditto.
+        * bindings/objc/DOMSVG.h: Ditto.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Ditto.
+        * bindings/v8/V8DOMWrapper.cpp: Ditto.
+        * bindings/v8/V8Index.cpp: Ditto.
+        * bindings/v8/V8Index.h: Ditto.
+        * svg/SVGAllInOne.cpp: Ditto.
+        * svg/SVGDefinitionSrcElement.cpp: Removed.
+        * svg/SVGDefinitionSrcElement.h: Removed.
+        * svg/SVGDefinitionSrcElement.idl: Removed.
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::rebuildFontFace): Don't search for
+        definition-src child.
+        * svg/svgtags.in: Remove definition-src.
+
+2009-09-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Roll out http://trac.webkit.org/changeset/48094, because the
+        logic of retrieving default caret blink interval was incorrect (non-existent)
+        and caused layout test flakiness.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by NOBODY (Chromium reliability build break).
+
+        Back up partial change in r48072 in order to fix chromium reliability build break.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+
+2009-09-05  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28975
+        Fix file upload on chrome/mac. Images that have "Hide Extension" set,
+        such as screenshots by default, can now be uploaded to sites such as
+        imgur.com.
+
+        * platform/FileSystem.h:
+        Add pathGetDisplayFileName().
+        * platform/chromium/FileChooserChromium.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+        Call pathGetDisplayFileName() instead of pathGetFileName().
+        * platform/chromium/FileSystemChromiumLinux.cpp:
+        (WebCore::pathGetDisplayFileName):
+        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
+        * platform/chromium/FileSystemChromiumMac.mm:
+        (WebCore::pathGetFileName):
+        Now returns a real filename instead of a presentational one, which
+        fixes the problem addressed by this change.
+        (WebCore::pathGetDisplayFileName):
+        New function that returns a presentational filename; does what
+        pathGetDisplayFileName() did prior to this patch.
+        * platform/chromium/FileSystemChromiumWin.cpp:
+        (WebCore::pathGetDisplayFileName):
+        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
+
+2009-09-05  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by David Levin.
+
+        Expose functions to set the caret blink interval for Linux Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=28931
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
+        (WebCore::RenderThemeChromiumLinux::caretBlinkInterval):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-04  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Prevent UI freeze in case when too many timers are in the timer queue.
+        https://bugs.webkit.org/show_bug.cgi?id=23865
+
+        The fix measures the elapsed time while executing timers. If we have too many
+        timers and it takes significant time to fire, quit the loop and reschedule.
+        This lets the run loop process user input (close the window for example).
+
+        * platform/ThreadTimers.h:
+        * platform/ThreadTimers.cpp:
+        (WebCore::ThreadTimers::sharedTimerFiredInternal):
+        (WebCore::ThreadTimers::fireTimersInNestedEventLoop):
+        Removed functions and members used before to grab a list of all expired timers.
+        Now we fetch one by one, measuring time and quitting the loop if it takes too long.
+        * platform/Timer.cpp:
+        (WebCore::TimerBase::isActive):
+        (WebCore::TimerBase::setNextFireTime):
+        Since timers are now fired one by one, there is no need to keep track of updated timers.
+        * manual-tests/input-starved-by-timers.html: Manual test that attempts to freeze browser by
+        creating of enough timers. It then keeps UI frozen and after 10 seconds starts to drain the timers
+        so the browser un-freezes. This is instead of a regular layout test because we don't have a way
+        to inject an input events via regular run loop in DRT - instead they are directly dispatched by
+        eventSender, which does not reproduce the UI freeze that happens with real input.
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7201063>
+        
+        Detach any custom scrollbars before detaching the document.
+        
+        * page/Frame.cpp:
+        (WebCore::Frame::setView):
+
+2009-09-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+                Unreviewed, build fix.
+
+                Remove remaining references to UserStyleSheetLoader after r48075.
+
+                * WebCore.gypi:
+                * WebCore.xcodeproj/project.pbxproj:
+                * page/qt/FrameQt.cpp:
+                * page/wince/FrameWince.cpp:
+
+2009-09-04  Michelangelo De Simone  <micdesim@gmail.com>
+
+                Reviewed by David Levin.
+
+                https://bugs.webkit.org/show_bug.cgi?id=28988
+                Minor fix: "novalidate" attribute renamed in "noValidate", according to
+                HTML5 specs:
+                http://www.whatwg.org/specs/web-apps/current-work/#dom-fs-novalidate
+
+                * html/HTMLFormElement.cpp:
+                (WebCore::HTMLFormElement::noValidate):
+                (WebCore::HTMLFormElement::setNoValidate):
+                * html/HTMLFormElement.h:
+                * html/HTMLFormElement.idl:
+
+2009-09-04  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove unused line of code from WorkerContext
+        https://bugs.webkit.org/show_bug.cgi?id=28990
+
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+
+2009-09-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix assertion seen when running buildbot.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure): Create the structure without
+        the HasDefaultMark bit since this has a custom mark function.
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28984, remove the remote stylesheet loader on Mac/Qt.
+        Make sure the other code path (now used by everybody) can handle data URLs.
+
+        As per the post on webkit-dev, the ability to work remotely isn't working properly anyway (it doesn't
+        hold up the pending sheet count, so you'd just FOUC on every Web page), and it's extremely unlikely
+        that anybody is relying on this support.
+        
+        Tor Arne agreed it was ok to disable (he enabled it on the Qt side), and only Mac/Qt were using this
+        code.
+
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::userStyleSheet):
+        * dom/Document.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        * loader/UserStyleSheetLoader.cpp: Removed.
+        * loader/UserStyleSheetLoader.h: Removed.
+        * page/Frame.cpp:
+        (WebCore::Frame::reapplyStyles):
+        * page/Frame.h:
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+        (WebCore::Page::userStyleSheet):
+        * page/mac/FrameMac.mm:
+        * page/qt/FrameQt.cpp:
+
+2009-09-04  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Add "sampling profiler" preference, simplify data display when it's set.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28969
+
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.get data.formatMilliseconds):
+        (WebInspector.ProfileDataGridNode.prototype.get data):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView):
+        * inspector/front-end/inspector.js:
+
+2009-09-04  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Run-time exception in onmessage handler is not forwarded to the worker object.
+        https://bugs.webkit.org/show_bug.cgi?id=28980
+
+        Tested by worker-close.html.
+
+        * bindings/v8/ScriptFunctionCall.cpp:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        (WebCore::reportException):
+        * bindings/v8/V8Utilities.h:
+        (WebCore::getScriptExecutionContext):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove unused m_sheet variable and setCSSStyleSheet methods.
+
+        * dom/Document.cpp:
+        * dom/Document.h:
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt and Adele Peterson.
+
+        (Based on a patch from Adele).
+        
+        Fix <rdar://problem/7185875>.
+        
+        * page/Frame.cpp:
+        (WebCore::Frame::setView):
+        Detach any custom scroll bars from the old view.
+        
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        Simplify the check (and make it work when body is null) by just checking that the scroll bar owner is
+        not a RenderPart object.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        ASSERT that frame() is not null here and also add a null check so that release builds won't crash.
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make m_userStyleSheetLoader in Frame an OwnPtr.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::~Frame):
+        * page/Frame.h:
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::setUserStyleSheetLocation):
+        (WebCore::Frame::setUserStyleSheet):
+
+2009-09-04  Timothy Hatcher  <timothy@apple.com>
+
+        Show color swatches in the Web Inspector before the color text so clicking them will not
+        shift the swatch. Also makes multiple swatches in the single property toggle the color format.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28978
+
+        Reviewed by Darin Adler.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle): Some refactoring to consolidate
+        the processing we do on the property value. This eliminated the old nickname code, since the new
+        WebInspector.Color class handles this. We could also simplify the color regex since more
+        is handled by the Color class. Also no longer uses innerHTML for the linkify code.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processValue): Helper function to
+        process a value given a regex and processor functions. 
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.linkifyURL): Make an anchor for the
+        URL with "url()" syntax surrounding it.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Makes a color, if
+        there was an exception just return a text node.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay.changeTo):
+        Moved from later in the file.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay): Ditto.
+        * inspector/front-end/inspector.css:
+
+2009-09-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Account for scrollbar state changes that occur during layout.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+        Perform a layout prior to checking whether the scrollbar modes are
+        off, on, or automatic.  The modes may change during layout.
+
+        * WebCore.base.exp:
+        * WebCore.order:
+        * page/Frame.cpp:
+        (WebCore::Frame::createView):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::resetScrollbars):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+
+        Eliminate duplicated (and incorrect) scrollbar mode tracking between
+        FrameView and ScrollView.
+
+2009-09-04  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        hostname and host are mixed up when manipulating anchor elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28954
+
+        Swapped the implementation of host and hostname, and made sure not to return
+        the port number if it is default for the given protocol. 
+        FireFox also avoids returning the protocol number if it is default.
+
+        Test: fast/dom/Element/hostname-host.html
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+        (WebCore::HTMLAnchorElement::hostname):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::isDefaultPortForProtocol):
+        * page/SecurityOrigin.h:
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler and Steve Falkenburg.
+
+        Fix <rdar://problem/7192902>.
+
+        Add the necessary plumbing for having QTMovieWin use WebCore timers.
+        
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::TaskTimer::initialize):
+        Create the timer and call QTMovieWin::setTaskTimerFuncs.
+        
+        (WebCore::TaskTimer::setTaskTimerDelay):
+        Start the timer.
+        
+        (WebCore::TaskTimer::stopTaskTimer):
+        Stop the timer.
+        
+        (WebCore::TaskTimer::fired):
+        Call QTMovieWin::taskTimerFired().
+        
+        (WebCore::MediaPlayerPrivate::load):
+        Initialize the Task timer.
+        
+        * platform/graphics/win/QTMovieWin.cpp:
+        (updateTaskTimer):
+        Call the global stopTaskTimer function and setTaskTimerDelay.
+        
+        (QTMovieWin::taskTimerFired):
+        Make this a member function.
+        
+        (QTMovieWin::setTaskTimerFuncs):
+        Set the global function pointers.
+        
+        (QTMovieWin::initializeQuickTime):
+        (DllMain):
+        No need to use the QT shared timer.
+        * platform/graphics/win/QTMovieWin.h:
+
+2009-09-04  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium Win compile.  Missing return statement in
+        WebCore::RenderThemeChromiumSkia::paintSliderThumb.
+        https://bugs.webkit.org/show_bug.cgi?id=28974
+
+        No new tests, build fix.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
+
+2009-09-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Rolling out http://trac.webkit.org/changeset/48035, because it broke
+        the build.
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Fix vcproj file.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-03  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28890, make simple user script injection work.
+        
+        This patch adds new API for adding and removing user scripts from page groups.  User scripts
+        are bundled together in isolated worlds (you can have multiple scripts together in the same
+        world).
+
+        Added userscripts/ directory for holding new tests (along with a simple test of script injection).
+
+        * WebCore.base.exp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/js/ScriptController.h:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/v8/ScriptController.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::finishedParsing):
+        (WebCore::FrameLoader::dispatchDocumentElementAvailable):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScripts):
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/Frame.h:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::~PageGroup):
+        (WebCore::PageGroup::addUserScript):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        (WebCore::PageGroup::removeAllUserContent):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userScripts):
+        * page/UserScript.h: Added.
+        (WebCore::UserScript::UserScript):
+        (WebCore::UserScript::source):
+        (WebCore::UserScript::url):
+        (WebCore::UserScript::patterns):
+        (WebCore::UserScript::worldID):
+        (WebCore::UserScript::injectionTime):
+        * page/UserScriptTypes.h: Added.
+        (WebCore::):
+
+2009-09-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26402
+        Crashes when using a detached DocumentType node
+
+        Test: fast/dom/DOMImplementation/detached-doctype.html
+
+        DocumentType nodes are the only one that can have null document(), and they can never have
+        children, so they are a degenerate case for NodeLists.
+
+        * dom/Node.cpp:
+        (WebCore::Node::childNodes): Don't try register node list with document if there's no
+        document. Since there are no changes possible for a DocumentType's node list, this is not
+        necessary.
+        (WebCore::Node::registerDynamicNodeList): Ditto.
+        (WebCore::Node::unregisterDynamicNodeList): Ditto. I couldn't find a scenario where this
+        was invoked for a DocumentType node, but I also couldn't prove that it can't be (the
+        de-registration code path that I saw taken was via Node destructor, and that already has
+        a null check for document).
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener): Bail out if there is no document (just as we already do
+        if there is no window).
+        (WebCore::JSNode::removeEventListener): Ditto.
+
+2009-09-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] loadFinished never emitted
+        https://bugs.webkit.org/show_bug.cgi?id=28935
+
+        Do not report errors right away from
+        ResourceHandle::start. Instead return true and schedule an error
+        to be reported in the handle later. Otherwise WebCore gets
+        confused and thinks the resource never finished loading, making it
+        not emit the finished status.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+        (WebCore::):
+
+2009-09-04  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [V8] DOM Storage bindings: Event Handler should create StorageEvents
+        https://bugs.webkit.org/show_bug.cgi?id=28942
+        
+        Tests:
+        Causes the following tests that were failing with V8 to pass:
+        * storage/domstorage/localstorage/onstorage-attribute-setwindow.html
+        * storage/domstorage/localstorage/complex-keys.html
+        * storage/domstorage/localstorage/onstorage-attribute-markup.html
+        * storage/domstorage/localstorage/simple-events.html
+        * storage/domstorage/localstorage/onstorage-attribute-set-attribute.html
+        * storage/domstorage/localstorage/index-get-and-set.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-setwindow.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-markup.html
+        * storage/domstorage/sessionstorage/simple-events.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-set-attribute.html
+        * storage/domstorage/sessionstorage/index-get-and-set.html
+
+        Code changes:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):  Create StorageEvents.
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::storageGetter): Check if we are retrieving the length property and return the number of items in the object rather than a property named length when invoking the getItem() member of local/sessionStorage.
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28911
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._formatarray):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        * inspector/front-end/DOMAgent.js:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        * inspector/front-end/InjectedScriptAccess.js: Added.
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.html:
+
+2009-09-04  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement <input type="range"> for Chromium Linux by painting
+        the slider and the thumb using skia.
+        https://bugs.webkit.org/show_bug.cgi?id=28928
+
+        Covered by existing tests (we're currently hitting an assert for them).
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::adjustSliderThumbSize):
+        * rendering/RenderThemeChromiumLinux.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::drawVertLine):
+        (WebCore::drawHorizLine):
+        (WebCore::drawBox):
+        (WebCore::RenderThemeChromiumSkia::paintSliderTrack):
+        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
+        * rendering/RenderThemeChromiumSkia.h:
+
+2009-09-04  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Implement <input type=color> as a text field.
+        - ValidityState::typeMismatch supports for type=color.
+        https://bugs.webkit.org/show_bug.cgi?id=28966
+
+        Tests: fast/forms/ValidityState-patternMismatch-unsupported.html
+               fast/forms/ValidityState-typeMismatch-color.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueMissing):
+        (WebCore::HTMLInputElement::patternMismatch):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::formControlType):
+        (WebCore::HTMLInputElement::saveFormControlState):
+        (WebCore::HTMLInputElement::restoreFormControlState):
+        (WebCore::HTMLInputElement::accessKeyAction):
+        (WebCore::HTMLInputElement::rendererIsNeeded):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::appendFormData):
+        (WebCore::HTMLInputElement::valueWithDefault):
+        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::isRequiredFormControl):
+        (WebCore::HTMLInputElement::dataList):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::):
+        (WebCore::HTMLInputElement::isTextField):
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+        (WebCore::ValidityState::isValidColorString):
+        * html/ValidityState.h:
+
+2009-09-04  Mads Ager  <ager@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Crash when updating document cache
+        https://bugs.webkit.org/show_bug.cgi?id=28965
+
+        Initialization of a V8 JavaScript context can fail.  When that
+        happens, do not attempt to update the document wrapper cache.
+
+        This code path is exercised by http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocument):
+
+2009-09-04  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Two bugs:
+
+        https://bugs.webkit.org/show_bug.cgi?id=25489
+        CSS property background-position is now serialized in shorthand string as
+        background-position-x background-position-y, as the specification requires
+        (See http://www.w3.org/TR/2008/WD-css3-background-20080910/#the-background-position).
+        
+
+        https://bugs.webkit.org/show_bug.cgi?id=26541
+        CSS background-color is now be serialized before other background properties, 
+        as CSS specification requires (See http://dev.w3.org/csswg/cssom/#css-value).  
+
+        An existing layout test that accepted wrong order and skipped position test 
+        had to be modified.
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+
+2009-09-03  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add support for HTMLTextAreaElement.textLength
+        https://bugs.webkit.org/show_bug.cgi?id=28929
+
+        Test: fast/forms/textarea-textlength.html
+
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::textLength):
+        * html/HTMLTextAreaElement.idl:
+
+2009-09-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7180197>, https://bugs.webkit.org/show_bug.cgi?id=28822
+        REGRESSION(r31231): Creating document with current document's DOCTYPE causes crashes
+
+        Test: fast/dom/DOMImplementation/createDocument-with-used-doctype.html
+
+        * dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createDocument): Even though we
+        cannot raise an exception immediately out of fear of breaking Acid3, we shouldn't use a
+        DocumentType node in two documents.
+
+2009-09-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Page Cache should support pages with Frames.
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Tests: fast/events/pageshow-pagehide-on-back-cached-with-frames.html
+               fast/loader/frames-with-unload-handlers-in-page-cache.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-09-03  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Handle middle click in Chromium like QT
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+        Tested by middle-click-onpaste.html.
+
+        * platform/Pasteboard.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::getData):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::isSelectionMode):
+        (WebCore::Pasteboard::setSelectionMode):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PasteboardPrivate.h:
+        (WebCore::PasteboardPrivate::):
+
+2009-09-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Fix a bug where subframes weren't asked if they were cacheable.
+
+        No new tests, especially since page caching for frames isn't turned on yet.
+        A layout test will come in my next patch, which enables frames in the page cache.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+
+2009-09-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by eric@webkit.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Added mixed content methods to FrameLoaderClient.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didDisplayInsecureContent):
+        (WebCore::EmptyFrameLoaderClient::didRunInsecureContent):
+        * loader/FrameLoaderClient.h:
+
+2009-09-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Frames support
+        https://bugs.webkit.org/show_bug.cgi?id=19041
+
+        * page/wx/EventHandlerWx.cpp:
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::nativeWindowForRenderObject):
+        (WebCore::RenderThemeWx::paintButton):
+        (WebCore::RenderThemeWx::paintTextField):
+        (WebCore::RenderThemeWx::paintMenuList):
+        (WebCore::RenderThemeWx::paintMenuListButton):
+        * platform/wx/ScrollbarThemeWx.cpp: Added.
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeWx::~ScrollbarThemeWx):
+        (WebCore::ScrollbarThemeWx::scrollbarThickness):
+        (WebCore::ScrollbarThemeWx::hasThumb):
+        (WebCore::ScrollbarThemeWx::buttonSize):
+        (WebCore::ScrollbarThemeWx::backButtonRect):
+        (WebCore::ScrollbarThemeWx::forwardButtonRect):
+        (WebCore::ScrollbarThemeWx::trackRect):
+        (WebCore::ScrollbarThemeWx::paintScrollCorner):
+        (WebCore::ScrollbarThemeWx::paint):
+        * platform/wx/ScrollbarThemeWx.h: Added.
+        (WebCore::ScrollbarThemeWx::hasButtons):
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp: Added.
+        (wxStyleForPart):
+        (GetButtonWidget):
+        (wxGetGdkWindowForDC):
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp: Added.
+        (wxScrollbarPartToHIPressedState):
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/scrollbar_render.h: Added.
+        (calcThumbStartAndLength):
+        * platform/wx/wxcode/win/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * platform/wx/wxcode/win/scrollbar_render.cpp: Added.
+        (GraphicsHDC::GraphicsHDC):
+        (GraphicsHDC::~GraphicsHDC):
+        (GraphicsHDC::operator HDC):
+        (getTSStateForPart):
+        (wxRenderer_DrawScrollbar):
+        * webcore-wx.bkl:
+
+2009-09-03  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Page content is not displayed in case of HTTP status error
+        https://bugs.webkit.org/show_bug.cgi?id=28949
+
+        If the server sent content, show it to the user instead of an error,
+        even if the HTTP status code is not success.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::resetState):
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2009-09-03  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need to update v8 bindings to support passing multiple ports to postMessage()
+        https://bugs.webkit.org/show_bug.cgi?id=28839
+
+        Added support for passing MessagePortArray to v8 bindings.
+
+        New tests that now pass with V8:
+               fast/events/message-port-multi.html
+               fast/workers/worker-context-multi-port.html
+               fast/workers/worker-multi-port.html
+
+        * WebCore.gypi:
+        Added V8MessageEventCustom.cpp and V8MessagePortCustom.h
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added custom postMessage() handlers for various classes.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::DOMWindowPostMessage):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::DedicatedWorkerContextPostMessage):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8MessageEventCustom.cpp: Added.
+        (WebCore::MessageEventPorts):
+        Added getter for ports attribute.
+        (WebCore::MessageEventInitMessageEvent):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::MessagePortPostMessage):
+        Added custom handler that supports MessagePortArray.
+        (WebCore::getMessagePortArray):
+        Added helper function that supports converting from a sequence-like object to a MessagePortArray.
+        * bindings/v8/custom/V8MessagePortCustom.h: Added.
+        Added declaration for getMessagePortArray().
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::WorkerPostMessage):
+        Added custom handler that supports MessagePortArray.
+
+2009-09-03  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Need to update JS bindings and IDL files to support multiple message ports in postMessage()
+        https://bugs.webkit.org/show_bug.cgi?id=28460
+
+        Added new toJSSequence() API which validates that a JSValue meets the WebIDL criteria for a sequence.
+
+        Tests: fast/events/message-port-multi.html
+               fast/workers/worker-context-multi-port.html
+               fast/workers/worker-multi-port.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Added JSMessagePortCustom.h and JSMessageEventCustom.cpp.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::toJSSequence):
+        Added toJSSequence() API to do validation on sequence-like objects per WebIDL.
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArrays.
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        (WebCore::JSDedicatedWorkerContext::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArrays.
+        * bindings/js/JSMessageEventCustom.cpp: Added.
+        (WebCore::JSMessageEvent::ports):
+        Added custom ports() getter that converts from MessagePortArray to JSArray.
+        (WebCore::JSMessageEvent::initMessageEvent):
+        Added support for passing a MessagePortArray.
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArray.
+        (WebCore::fillMessagePortArray):
+        New helper routine that validates/converts from a JS sequence o a WebCore::MessagePortArray.
+        * bindings/js/JSMessagePortCustom.h: Added.
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArray.
+        * dom/MessageEvent.cpp:
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::ports):
+        Changed ports() to return a MessagePortArray* since this value can be null.
+        * dom/MessageEvent.idl:
+        Updated IDL to match HTML5 spec (now accepts MessagePortArrays instead of a solitary MessagePort).
+        * dom/MessagePort.cpp:
+        * dom/MessagePort.h:
+        * dom/MessagePort.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * workers/Worker.cpp:
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Do not query non-function call frames for function name.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28799
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.CallFrameProxy):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Crash after typing "clear" and pressing return in inspector console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28684
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._clearConsoleMessages):
+        (InjectedScript._inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Squeezed out some performance from string conversion.
+        https://bugs.webkit.org/show_bug.cgi?id=28945
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::data):
+        (WebCore::WebCoreStringResource::length):
+        (WebCore::WebCoreStringResource::atomicString):
+        (WebCore::WebCoreStringResource::string):
+        Avoid calling virtual length method. Be more explicit with
+        external memory computation. Avoid function calls in data and
+        length.
+        (WebCore::):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+        (WebCore::v8NonStringValueToWebCoreString):
+        (WebCore::v8NonStringValueToAtomicWebCoreString):
+        Avoid extra calls of WebCoreStringResource::toString. When
+        AtomicString is computed pass it immediately when constructing
+        WebCoreStringResource. Use inline buffer for small strings.
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8ValueToWebCoreString):
+        (WebCore::v8ValueToAtomicWebCoreString):
+        (WebCore::toString):
+        Inline dispatch of string vs. non-string values.
+
+2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Inlined common case of V8IsolatedWorld::getEntered to speed
+        up V8Proxy lookup.
+        https://bugs.webkit.org/show_bug.cgi?id=28946
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::getEnteredImpl):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::getEntered):
+
+2009-09-03  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix a regression bug that maxLength doesn't work for IME input.
+        https://bugs.webkit.org/show_bug.cgi?id=25253
+
+        Tests: fast/forms/input-maxlength-ime-completed.html
+               fast/forms/input-maxlength-ime-preedit.html
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-09-03  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make SVGStyleElement title/media/type setters do something
+        https://bugs.webkit.org/show_bug.cgi?id=28828
+
+        Test: svg/dom/style-reflect.html
+
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::setXmlspace): Actually change the attribute.
+        (WebCore::SVGStyleElement::setType): Ditto.
+        (WebCore::SVGStyleElement::setMedia): Ditto.
+        (WebCore::SVGStyleElement::setTitle): Ditto.
+
+2009-09-03  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28872
+        
+        Fixes a bug where handleEvent() in the V8 Custom SQL Statement Error binding would not return the correct result to WebCore after invoking the callback.
+
+        Test: storage/statement-error-callback.html
+
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent): Return true from handleEvent() if the callback raised an exception or the callback itself returned true.
+
+2009-09-03  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding three font-specific files to WebCore:
+        FontCustomPlatformData.cpp, FontCustomPlatformData.h,
+        and FontPlatformData.h
+        https://bugs.webkit.org/show_bug.cgi?id=28131
+
+        * platform/graphics/haiku/FontCustomPlatformData.cpp: Added.
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/haiku/FontCustomPlatformData.h: Added.
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+        * platform/graphics/haiku/FontPlatformData.h: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::bold):
+        (WebCore::FontPlatformData::oblique):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        No new tests. (No change in behavior, current tests pass).
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::stopLoading): Adopt the new enum form for FrameLoader::stopLoading().
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): Take an enum to decide whether to dispatch no unload events,
+          only unload, or unload and pagehide.
+        (WebCore::FrameLoader::closeURL):
+        (WebCore::FrameLoader::scheduleRedirection):
+        (WebCore::FrameLoader::cachePageForHistoryItem): Call pageHidden().
+        (WebCore::FrameLoader::pageHidden): Add to dispatch the pagehide event to all frames in the case
+          where a page is added to the PageCache.
+        * loader/FrameLoader.h:
+
+        * loader/FrameLoaderTypes.h: Add an UnloadEventPolicy enum.
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        - More CachedFrame destruction work.
+        - Including related Frame and FrameLoader changes and cleanup.
+
+        No new tests. (No change in behavior, current tests pass).
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Rebuild up the whole FrameTree when restoring.
+        (WebCore::CachedFrame::CachedFrame): Tear down the entire FrameTree when caching.
+        (WebCore::CachedFrame::destroy): For child frames that are being destroyed while in
+          the PageCache, do lightweight cleanup to:
+          A - Prevent referring to a stale Page object.
+          B - Prevent World Leaks of WebKit objects.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopAllLoaders): stopAllLoaders() should never be called on Frames that are
+          in the PageCache. ASSERT that fact.
+        (WebCore::FrameLoader::open): Remove a bogus release-build workaround, as the comment right above it
+          explains it is not effective, and it'd be better to see the crash locally instead of downstream.
+        (WebCore::FrameLoader::closeAndRemoveChild): Make sure the owner element has a page pointer before
+          referencing it.
+        (WebCore::FrameLoader::detachFromParent): Use the new detachViewsAndDocumentLoader() call
+        (WebCore::FrameLoader::detachViewsAndDocumentLoader): Does lightweight cleanup of client (WebKit) objects.
+        * loader/FrameLoader.h:
+
+        * page/Frame.cpp:
+        (WebCore::Frame::detachFromPage): Simply clear the Page pointer without doing any other work.
+        (WebCore::Frame::pageDestroyed): Use the new detachFromPage().
+        * page/Frame.h:
+
+2009-09-02  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Dimitri Glazkov
+
+        [Chromium] Add 'icu::' qualifier in preparation for ICU upgrade to 4.2
+        in Chromium. This is to fix a new file added in r28742 since the
+        last patch for this issue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::getNormalizedTextRun):
+
+2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Correct a typo to fix bustage, caused by r47991.
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+
+        * platform/graphics/skia/ImageBufferSkia.cpp: Changed "Unpremultipled" to "Unmultiplied".
+
+2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Add a missing include to fix bustage, caused by r47991.
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+
+        * platform/graphics/skia/ImageBufferSkia.cpp: Added SkColorPriv include.
+
+2009-09-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Implement file support for DragData.
+        https://bugs.webkit.org/show_bug.cgi?id=28896
+
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsCompatibleContent):
+
+2009-09-02  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Protect libcurl shared data with Mutex objects via curl_set_share_opt.
+        https://bugs.webkit.org/show_bug.cgi?id=28920
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::sharedResourceMutex):
+        (WebCore::curl_lock_callback):
+        (WebCore::curl_unlock_callback):
+        (WebCore::ResourceHandleManager::ResourceHandleManager):
+
+2009-09-02  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Expose functions to change the focus ring color for Linux Chromium
+
+        https://bugs.webkit.org/show_bug.cgi?id=28887
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::setFocusRingColor):
+        (WebCore::RenderThemeChromiumLinux::platformFocusRingColor):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-02  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG Filter premultiplied color support for getImageDate/putImageData
+        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+
+        Patch to get premultiplied color support for Skia on getImageDate/putImageData.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Forget to rename openInFrameloader() to open(), which was requested in Darin's review of my last patch.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore):
+        (WebCore::CachedFrame::open):
+        * history/CachedFrame.h:
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        In http://trac.webkit.org/changeset/47943 I added new header dependencies to FrameLoader.h.
+        Removing them is a little trouble, but worth it going forward.
+        The pattern of creating a "CachedFrameBase" as the interface CachedFrame provides to FrameLoader
+        was suggested by Darin Adler.
+
+        No new tests. (No change in behavior)
+
+        Make CachedFrame inherit privately from CachedFrameBase, which becomes the interface FrameLoader uses:
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::CachedFrameBase):
+        (WebCore::CachedFrameBase::~CachedFrameBase):
+        (WebCore::CachedFrameBase::restore):
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::openInFrameLoader):
+        * history/CachedFrame.h:
+        (WebCore::CachedFrameBase::document):
+        (WebCore::CachedFrameBase::view):
+        (WebCore::CachedFrameBase::domWindow):
+        (WebCore::CachedFrame::create):
+        (WebCore::CachedFrame::documentLoader):
+        (WebCore::CachedFrame::mousePressNode):
+
+        Call the new ::openInFrameLoader() method on the CachedFrame, as CachedFrameBase is now the only
+        thing capable of interacting with FrameLoader::open(CachedFrameBase):
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore):
+        * history/CachedPage.h:
+        (WebCore::CachedPage::documentLoader):
+
+        Make ::open(CachedFrame) public, and change it to ::open(CachedFrameBase):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+
+2009-09-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Cannot pres Enter to escape from bulleted list when <ul> is a child of <li>.
+        https://bugs.webkit.org/show_bug.cgi?id=24866
+
+        This patch modifies breakOutOfEmptyListItem to break out of a properly nested list
+        (a list to break out of is inside another list item).
+
+        When the empty list item appears at the end of another list item, WebKit breaks out of
+        the outer list item, and adds new item below the outer list item.
+        Otherwise, WebKit breaks out of the the inner list item and inserts new paragraph.
+
+        Test: editing/execCommand/break-out-of-empty-list-item.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        This patch is primarily about the "CachedFrame tree" and making slightly different decisions
+        based on whether a CachedFrame is the main frame or a subframe.
+
+        - Store whether a CachedFrame represents the main frame or a subframe.
+        - "Chop off the frame tree" for the main frame when creating its CachedFrame, as main frames 
+          are reused and need to start new page loads with an empty frame tree.
+        - Reattach the frame tree to the main frame when restoring it.
+        - open() the cached subframes in their respective loaders when restoring.
+        - Properly clear() and destroy() cached subframes.
+        - When committing to a new page load, and after caching the previous page, only clear the
+          FrameView for the main frame.
+
+        Note that all of above will eventually be necessary as I continue to land this work in pieces,
+        but doesn't actually change any behavior right now because we still refuse to even *try* to
+        cache pages with frames.
+
+        No new tests. No change in behavior, and current tests continue to pass.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::restore):
+        (WebCore::CachedFrame::clear):
+        (WebCore::CachedFrame::destroy):
+        * history/CachedFrame.h:
+        (WebCore::CachedFrame::isMainFrame):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        No review, build fix.
+
+        http://trac.webkit.org/changeset/47976 broke the build.  
+        Let's try compiling before we land things, shall we?
+
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): Order the initialization list correctly.
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fixes for Windows/MSVC.
+
+        * wscript:
+
+2009-09-02  Ben Murdoch  <benm@google.com>
+
+        Unreviewed build fix for Chromium.
+
+        Missed #including V8Proxy.h in WebCore/bindings/v8/V8Binding.cpp.
+
+        * bindings/v8/V8Binding.cpp: add V8Proxy.h as an include
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fix, don't define symbols we now grab from other sources.
+
+        * platform/wx/TemporaryLinkStubs.cpp:
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fixes for PluginViewNone.cpp and a wx build fix for PluginView.cpp.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop):
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::platformDestroy):
+
+2009-09-02  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Eric Seidel.
+
+        Fix the build failure of WebKit for Linux/Qt when WML is enabled
+
+        No test cases needed since this just fixes the build problem.
+
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::create):
+        * wml/WMLTableElement.cpp:
+        (WebCore::WMLTableElement::joinSuperflousColumns):
+        (WebCore::WMLTableElement::padWithEmptyColumns):
+
+2009-09-02 Yong Li <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: use shared buffer for custom font data
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        Refactored by Joe Mason <joe.mason@torchmobile.com>
+
+        * loader/CachedFont.cpp:
+        add WINCE to platforms using cached custom data
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        (WebCore::renameFont): implement for WinCE
+        * platform/graphics/opentype/OpenTypeUtilities.h:
+        build fixes
+        * platform/graphics/wince/FontCustomPlatformData.cpp:
+        (WebCore::setCustomFontCache): add accessor
+        (WebCore::createFontCustomPlatformData): change param to SharedBuffer
+        * platform/graphics/wince/FontCustomPlatformData.h:
+        update function signatures 
+ 
+2009-09-02 Yong Li <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: font-related build fixes and minor bugfixes
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * platform/graphics/FontCache.h: declare functions added in https://bugs.webkit.org/show_bug.cgi?id=27509
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage): fix ambiguous overload error in min/max on Windows
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): initialize member vars
+        * platform/graphics/SimpleFontData.h: disable unused members on Wince to save space 
+
+2009-09-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Another pass at releasing the storage mutex.
+        https://bugs.webkit.org/show_bug.cgi?id=28904
+
+        Another pass at releasing the storage mutex (when applicable) when we finish
+        executing JavaScript.  http://dev.w3.org/html5/spec/Overview.html#storage-mutex
+        describes the required behavior.
+
+        As it turns out, https://bugs.webkit.org/show_bug.cgi?id=28789 didn't solve
+        the problem correctly.  First of all, I missed that events and timeouts go
+        through a different call path.  Second of all, I didn't consider recursion
+        correctly.  Third of all, my check to see if LocalStorage is alive actually
+        instantiates it if it isn't yet.  Fourth, I forgot DOM_STORAGE guards around
+        it.  So I'm reverting that change completely and doing it more cleanly.
+        Unfortunately, the solution isn't as portable (and thus I've left out the JSC
+        implementation for now).
+
+        NOTE: This change now tracks recursion on function callbacks in V8.  I ran this
+        by Mads Ager and Mike Belshe and they seemed to think adding the checks were
+        fine.  Most callbacks are asynchronous and thus wouldn't be nested.  The few
+        scenareos where you can have nested callbacks probably should have always been
+        protected by a recursion guard.
+
+        Unfortunately, this can't be tested without a hook added to the layout test
+        controllers since the lock is (by design) not supposed to be observable by
+        JavaScript.  https://bugs.webkit.org/show_bug.cgi?id=28906
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): revert
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): revert
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::runScript):
+            Add releaseStorageMutex call.  A small amount of clean up.
+        (WebCore::V8Proxy::callFunction):
+            Add releaseStorageMutex call.  A small amount of clean up.
+        (WebCore::V8Proxy::releaseStorageMutex):
+            Check to see if localStorage has been instantiated.  If so, tell it to
+            unlock all storage areas.
+        * bindings/v8/V8Proxy.h:
+        * page/PageGroup.h:
+        (WebCore::PageGroup::hasLocalStorage):  Make hasLocalStorage public.
+
+2009-09-02  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: Implement ImageBuffer for WINCE
+        Implement Image interface with a light class BufferedImage
+        for rendering ImageBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=28167
+
+        * platform/graphics/wince/ImageBufferData.h: Added.
+        * platform/graphics/wince/ImageBufferWince.cpp: Added.
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Join the various PluginView destructors into one shared implementation
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The Qt port used to delete the platform plugin widget as the last step.
+        Now this is done before cleaning up the script objects and unloading the
+        plugin package, similar to how the Win port does it.
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Share PluginView::init() between ports
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The port-spesific bits are moved to platformStart(), which now returns
+        a bool based on the success of the platformStart.
+
+        m_hasPendingGeometryChange is now initialized in the initializer list
+        instead of in PluginViewQt's init()
+
+        PluginViewMac (currently used only by the Qt port) used to manually call
+        stop() in the case where an unsupported drawing or event model was detected.
+        This was wrong, as the m_status and m_isStarted fields should be used to
+        guard against doing operations on a plugin in this intermediate state.
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-09-02  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28737
+        
+        Update JavaScript bindings in JSC and V8 for SQLTransaction to throw exceptions in the right places.
+
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql): Throw an exception if no parameters are passed to executeSql().
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ValueToWebCoreString): Catch an exception if thrown from toString().
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Allow "arrayish objects" to be passed to executeSql.
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate Databases tab to InjectedScript /
+        serialized interaction.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28873
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.isDB):
+        (WebInspector.Database.prototype.runWithTableNames.sortingCallback):
+        (WebInspector.Database.prototype.runWithTableNames):
+        (WebInspector.Database.prototype.executeSql):
+        (WebInspector.Database.prototype.executeSql.errorCallback):
+        (WebInspector.Database.prototype.executeSql.queryTransaction):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._enterKeyPressed):
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.selectDatabase):
+        (WebInspector.StoragePanel.prototype.updateDatabaseTables.withTableNames):
+        (WebInspector.StoragePanel.prototype.updateDatabaseTables):
+        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate.withTableNames):
+        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate):
+
+2009-09-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed (trivial followup fix). 
+        
+        Web Inspector: Trivial follow up fix to r47944.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::nodeForId):
+
+2009-09-01  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fixed a bug in handling of isReadOnly, where textareas were casted to HTMLInputElements.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+
+2009-09-01  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28047
+        add utility method to enable logging messages for inspector development
+
+        manual test case added (see below)
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype.toMessageElement):
+        (WebInspector.ConsoleMessage.prototype.toString):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.log):
+        * manual-tests/inspector/webinspector-log.html: Added.
+        * page/Console.cpp:
+        (WebCore::printMessageSourceAndLevelPrefix):
+        * page/Console.h:
+        (WebCore::):
+
+2009-09-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21990
+        When a rare EUC-JP character is present, explicitly (and correctly) labelled EUC-JP document
+        is mistreated as Shift_JIS
+
+        <rdar://problem/5828506> Safari should not try auto-detecting if charset information exists
+
+        WebKit used to unconditionally auto-detect document encoding if it was one of Japanese ones.
+        This didn't really match any browser, and did cause problems on some sites.
+
+        Our detector is very quick to label an EUC-JP page as Shift_JIS if it notices a byte that
+        cannot be part of EUC-JP source. However, such bytes do appear in Web pages sometimes,
+        especially in comments. Also, some valid EUC-JP sequences are not known to it.
+
+        Some pages that are fixed by this change:
+
+        <rdar://problem/5934750> Encoding in incorrect at http://cocodeparis.blog45.fc2.com/. This
+        page has incorrect encoding in title, so no browser displays it 100% fine. We now match
+        Firefox and IE.
+
+        <rdar://problem/6007713> The web page http://www.sf.us.emb-japan.go.jp/top.htm is garbled
+        in Safari. There is a stray byte in comments that was makes charset detector think it can't
+        be EUC-JP.
+
+        <rdar://problem/6965711> A Japanese web page www.nippontv.studiolegend.tv is garbled in
+        Safari. Many comments on this page are encoded as Shift_JIS - IE magically displays that
+        fine in View Source mode (it doesn't seem to have an ability to switch between EUC-JP and
+        Shift_JIS in normal HTML view though).
+
+        Test: fast/encoding/japanese-encoding-mix.html
+
+        * loader/TextResourceDecoder.cpp: (WebCore::TextResourceDecoder::decode): Only invoke auto-
+        detection if there is no solid charset information yet.
+
+2009-09-01  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] FileList cannot be accessed via index in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=28883
+
+        Tested by clipboard-file-access.html.
+
+        * WebCore.gypi:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8FileListCustom.cpp: Added.
+
+2009-08-31  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove the workaround added in r47316.
+
+        Reviewed by Sam Weinig.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+
+        * accessibility/AXObjectCache.h:
+        Remove the Document argument to the AXObjectCache constructor and the
+        m_document member variable, and replace the no-parameter
+        handleFocusedUIElementChanged() with the two-parameter GTK function.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (fallbackObject):
+        Don't pass a null Document when constructing the AXObjectCache.
+
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Get the document from the RenderObject; m_document was removed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::axObjectCache):
+        Don't pass the Document when constructing the AXObjectCache.
+        (WebCore::Document::setFocusedNode):
+        Pass the old and new focused RenderObjects when calling
+        handleFocusedUIElementChanged().
+
+2009-09-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Check that InspectorDOMAgent and InspectorFrontend are not null
+        before accessing them in InspectorBackend. They may be null if
+        InspectorController is closed before an asynchronous operation is
+        started.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setAttribute):
+        (WebCore::InspectorBackend::removeAttribute):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        (WebCore::InspectorBackend::highlight):
+        (WebCore::InspectorBackend::nodeForId):
+        (WebCore::InspectorBackend::pushNodePathToFrontend):
+        (WebCore::InspectorBackend::addNodesToSearchResult):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::selectDOMStorage):
+        (WebCore::InspectorBackend::inspectorDOMAgent):
+        (WebCore::InspectorBackend::inspectorFrontend):
+        * inspector/InspectorBackend.h:
+
+2009-09-01  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Page Cache should support pages with frames
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Things learned in the full task that this patch addresses:
+        - The notions of clearing a CachedFrame and destroying a CachedFrame were two concepts that 
+          needed to be managed separately.
+        - Once we start restoring pages with multiple CachedFrames, we'll have to be calling
+          FrameLoader::open(CachedFrame&) multiple times with different CachedFrames, and this process
+          will be guided by the CachedFrames themselves.
+
+        No new tests. (No change in behavior, current layout tests pass)
+        
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::~CachedFrame):
+        (WebCore::CachedFrame::clear): Only clear pointers out.
+        (WebCore::CachedFrame::destroy): Perform the destructive cleanup work here - Things that shouldn't
+          occur simply by navigating back to a page with a CachedFrame.
+        * history/CachedFrame.h:
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::~CachedPage):
+        (WebCore::CachedPage::restore): Call clear() after restoring.
+        (WebCore::CachedPage::clear):
+        (WebCore::CachedPage::destroy):
+        * history/CachedPage.h:
+
+        * history/PageCache.cpp:
+        (WebCore::PageCache::releaseAutoreleasedPagesNow): destroy() CachedPages that are being pruned,
+          instead of clearing them.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad): Let the CachedPage clear() itself after restoring.
+        (WebCore::FrameLoader::open): Don't ::open() the CachedFrame, as the CachedPage does that now.
+        * loader/FrameLoader.h:  Add the friending so CachedPage and CachedFrame can better guide the process.
+          Even though CachedFrame::restore() isn't used for now, it will be soon.
+
+2009-09-01  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        Add a "lowMemoryNotification" method to the V8 ScriptController class.
+        This is needed in order to allow the host application (Android Web browser in this case)
+        to call the v8::V8::LowMemoryNotification() method added to V8 in
+        http://code.google.com/p/v8/source/detail?spec=svn2777&r=2725
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28776
+
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::lowMemoryNotification):
+        * bindings/v8/ScriptController.h:
+
+2009-09-01  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        V8 Bindings for WebSocket API.
+        https://bugs.webkit.org/show_bug.cgi?id=28844
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebSocketCustom.cpp: Added.
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Missed a "." -> "->" conversion.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Try to fix Qt build, take 2.  The Qt code had what looks like a
+        broken virtual function override.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-09-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Uninitialized variable in XSSAuditor
+        https://bugs.webkit.org/show_bug.cgi?id=28874
+
+        One ought to initialize variables before use even when it doesn't
+        matter.  No behavior change.
+
+        * page/XSSAuditor.h:
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer):
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Try to fix Qt build.
+
+        * platform/graphics/ImageSource.cpp:
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Eliminate most of ImageSourceQt.cpp in favor of ImageSource.cpp.
+
+        * WebCore.pro:
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::createFrameAtIndex):
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Make InjectedScript self-contained (move necessary
+        methods from utilities.js into InjectedScript).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28871
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.createProxyObject):
+        (Object.type):
+        (Object.hasProperties):
+        (Object.className):
+        (String.prototype.escapeCharacters):
+        * inspector/front-end/utilities.js:
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: console log message repeat count double.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28856
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+
+2009-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        [Gtk] Fix DATALIST build
+        https://bugs.webkit.org/show_bug.cgi?id=28826
+
+        Add ENABLE_DATALIST to FEATURE_DEFINES.
+
+        * GNUmakefile.am:
+
+2009-09-01  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        SVGSVGElement suspend methods argument/return types incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=28860
+
+        Also fix the style of the argument names.
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::suspendRedraw):
+        (WebCore::SVGSVGElement::unsuspendRedraw):
+        * svg/SVGSVGElement.h:
+
+2009-09-01  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix bug 28808:  [Skia] Fix flaky layout test svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html [DEBUG]
+        (https://bugs.webkit.org/show_bug.cgi?id=28808)
+
+        The bug fix adds an explicit check for the validity of the path when it is 
+        transformed into local coordinates. 
+        This was the most suitable place I could find that didn't cause an inordinate 
+        amount of refactoring. Also, it seems pertinent and may also catch other cases 
+        that are not limited to clipping paths.
+
+        TEST: existing svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp: make isPathSkiaSafe accessible
+        (WebCore::):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::currentPathInLocalCoordinates): check Skia safety of path
+
+2009-09-01  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Combining Diacritical Marks (U+0300..) are not handled correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=28742 
+
+        Normalize (NFC) a TextRun when the run contains combining diacritical marks
+        so that Skia can pick a correct glyph without relying on GSUB table in a font.
+        This change is for Chromium Linux.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::getTextRun): Added.
+        (WebCore::TextRunWalker::getNormalizedTextRun): Added.
+
+        This function is called when the run contains U+0300..U+036F and converts characters in
+        the run to the combined form (NFC) using ICU.
+
+2009-09-01  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Inlined fast paths of V8DOMWrapper::convertNodeToV8Object and
+        V8Proxy::createWrapperFromCache.
+        https://bugs.webkit.org/show_bug.cgi?id=28848
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object): Special
+        function for document wrapping.
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object): Slow case of
+        wrapping a new node.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object): Extracted fast
+        path from V8DOMWrapper.cpp.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::createWrapperFromCache): Extracted fast path
+        from V8Proxy.cpp.
+
+2009-09-01  Eric Seidel  <eric@webkit.org>
+
+        No review, windows build fix only.  Clearly I should have read the patch closer. :(
+
+        Allow excluding certain plugins from loading
+        https://bugs.webkit.org/show_bug.cgi?id=28677
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::refresh):
+
+2009-09-01  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement conditional breakpoints in the Web Inspector backend
+        and add frontend JavaScript stubs.
+        https://bugs.webkit.org/show_bug.cgi?id=28846
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::profiles):
+        (WebCore::InspectorBackend::addBreakpoint):
+        (WebCore::InspectorBackend::updateBreakpoint):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::condition):
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::setCondition):
+        (WebCore::JavaScriptDebugServer::addBreakpoint):
+        (WebCore::JavaScriptDebugServer::breakpointInfo):
+        (WebCore::JavaScriptDebugServer::updateBreakpoint):
+        (WebCore::JavaScriptDebugServer::updateBreakpointInfo):
+        (WebCore::JavaScriptDebugServer::removeBreakpoint):
+        (WebCore::JavaScriptDebugServer::hasBreakpoint):
+        (WebCore::JavaScriptDebugServer::clearBreakpoints):
+        * inspector/JavaScriptDebugServer.h:
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::BreakpointInfo):
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint):
+        (WebInspector.Breakpoint.prototype.get id):
+        (WebInspector.Breakpoint.prototype.get condition):
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+
+2009-09-01  Marius Renn  <damarvy@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added delegate to PluginDatabase to disable loading certain plugins.
+        This is useful when you want to load from the standard plugin
+        directory, but want to exclude certain plugins. Plugins may be
+        excluded early on by name, so that no plugin code is executed (which
+        may have caused a crash).
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::PluginDatabase):
+        (WebCore::PluginDatabase::refresh):
+        * plugins/PluginDatabase.h:
+        (WebCore::PluginDatabase::setClient):
+        * plugins/PluginDatabaseClient.h: Added.
+        (WebCore::PluginDatabaseClient::~PluginDatabaseClient):
+
+2009-08-31  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig
+
+        * WebCore.base.exp: Removed an unneeded symbol export.
+
+2009-08-31  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28466
+        When downloading a file, two GET requests are sent to the HTTP server
+
+        Can't think of a way to test this.
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::releaseResources): only nullify the
+        handle's client when it is the ResourceLoader, to support the case
+        in which a download API uses a different client
+
+2009-08-31  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Text Fields and Text Areas are reported as read-only by inspect32.exe.
+        https://bugs.webkit.org/show_bug.cgi?id=28854
+
+        Added another case in AcccessibiltyRenderObject::isReadOnly to test if text fields
+        and texts areas are read-only.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
+
+2009-08-31  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        fast/workers/worker-lifecycle.html crashes intermittently on snowleopard
+        https://bugs.webkit.org/show_bug.cgi?id=28795
+
+        Changed WorkerContext::close() to no longer stop the worker thread.
+        It is now the parent's responsibility to shut down the worker thread when it is notified that the context is closed.
+
+        * workers/AbstractWorker.cpp:
+        Updated dispatchScriptErrorEvent to pass-through the "handled" value from dispatchEvent(), to allow event handlers added with addEventListener() to mark events as handled.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::workerContextClosed):
+        Now shuts down the worker thread when notified that the context is closed.
+        (WebCore::SharedWorkerProxy::close):
+        Now handles being invoked when the context is already in the process of shutting down.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::close):
+        No longer calls WorkerThread::stop() to avoid race conditions with shutting down the thread while the parent is still interacting with it.
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::isClosing):
+        isClosing() is now public so WorkerRunLoop can call it to determine whether to process tasks.
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerExceptionTask::performTask):
+        Error events should still be delivered even if the worker thread is closing.
+        Also fixed problem where error events were not dispatched if error handlers were added via addEventListener().
+        (WebCore::WorkerTerminateTask::create):
+        New task that invokes terminateWorkerContext() on the parent thread when the context is closed.
+        (WebCore::WorkerTerminateTask::WorkerTerminateTask):
+        (WebCore::WorkerTerminateTask::performTask):
+        (WebCore::WorkerMessagingProxy::workerContextClosed):
+        Now fires off a WorkerTerminateTask to shut down the thread when the context is closed.
+        * workers/WorkerMessagingProxy.h:
+        WorkerMessagingProxy now overrides workerContextClosed().
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::runInMode):
+        Now drops tasks on the floor if the WorkerContext is closing.
+
+2009-08-31  Ojan Vafai  <ojan@chromium.org>
+
+        Not reviewed (build fix)
+
+        Build fix for Chromium to match r49707.
+
+        * bindings/v8/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/v8/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::KURL):
+        (WebCore::blankURL):
+
+2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28858
+        Element.baseURI parses xml:base attribute incorrectly
+
+        Test: fast/dom/base-attribute-parsing.xhtml
+
+        * dom/Element.cpp: (WebCore::Element::baseURI): Avoid assertion failure (no change in
+        release mode).
+
+2009-08-31  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reverting http://trac.webkit.org/changeset/47904, because it caused
+        layout test failure.
+
+        Test: fast/dom/Window/new-window-opener.html
+
+2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28852
+        Rename KURL single argument constructor to avoid confusion
+
+        * platform/KURL.h: The constructor that used to be single argument should now be invoked
+        as KURL(ParsedURLString, myString).
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * bindings/js/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_EvaluateHelper):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::isSVGCursorIdentifier):
+        * css/CSSImageValue.cpp:
+        (WebCore::CSSImageValue::cachedImage):
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/StyleBase.cpp:
+        (WebCore::StyleBase::baseURL):
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * dom/Element.cpp:
+        (WebCore::Element::baseURI):
+        * editing/markup.cpp:
+        (WebCore::completeURLs):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::url):
+        (WebCore::HistoryItem::originalURL):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::createCached):
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource):
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::requestResource):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::getSubresources):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::init):
+        (WebCore::FrameLoader::iconURL):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::FrameLoader::redirectionTimerFired):
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::startRedirectionTimer):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::resourceForURL):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::ApplicationCacheGroup::addEntry):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::loadCache):
+        (WebCore::ApplicationCacheStorage::manifestURLs):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createResource):
+        (WebCore::LegacyWebArchive::create):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        * notifications/NotificationCenter.h:
+        (WebCore::NotificationCenter::createHTMLNotification):
+        * platform/KURL.cpp:
+        (WebCore::KURL::KURL):
+        (WebCore::blankURL):
+        * platform/KURLHash.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::setData):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie):
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::operator CFErrorRef):
+        * platform/network/cf/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::handleLocalReceiveResponse):
+        (WebCore::headerCallback):
+        * platform/network/curl/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/mac/ResourceErrorMac.mm:
+        (WebCore::ResourceError::operator NSError*):
+        * platform/network/mac/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/qt/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::filesystemPathFromUrlOrTitle):
+        (WebCore::ClipboardWin::setData):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+        * xml/XSLImportRule.cpp:
+        (WebCore::XSLImportRule::loadSheet):
+        * xml/XSLTProcessor.cpp:
+        (WebCore::docLoaderFunc):
+        Adapt to the change everywhere the single argument constructor was used. I did a very
+        cursory check of whether these locations were using this constructor properly, and didn't
+        notice any obvious mistakes. The new explicit name will hopefully suggest checking this
+        better when refactoring any such code.
+
+2009-08-31  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=28635 [CSS3 
+        Backgrounds and Borders] Add support for 2-keyword values for 
+        background-repeat
+
+        This patch allows background-repeat to take two values by making 
+        background-repeat just like background-position internally. There 
+        is a little extra legwork for background-repeat because the spec 
+        indicates that its computed value should be equivalent to how it 
+        was specified. I keep track of the specified thing by setting the 
+        implicit flag whenever background-repeat is defined with only one 
+        value (since internally, we now store this as 2 values.)
+        
+        Here we can't access the implicit flag, so for backwards-
+        compatibility's sake, we always return one value when that makes 
+        sense.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::fillRepeatToCSSValue):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Here we check for the implicit flag and return one value when it is 
+        set.
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
+        (WebCore::CSSMutableStyleDeclaration::cssText):
+
+        Add support for CSSPropertyBackgroundRepeatX and 
+        CSSPropertyBackgroundRepeatY
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillShorthand):
+        (WebCore::CSSParser::parseFillRepeat):
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSParser.h:
+
+        Get rid of mappings to RepeatXFill and RepeatYFill since we don't 
+        need those parts of the EFillRepeat enum anymore.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
+
+        Add CSSPropertyBackgroundRepeatX and CSSPropertyBackgroundRepeatY
+        * css/CSSPropertyLonghand.cpp:
+        (WebCore::initShorthandMap):
+
+        Add background-repeat-x and -y.
+        * css/CSSPropertyNames.in:
+
+        Break repeat into x and y.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapFillRepeatX):
+        (WebCore::CSSStyleSelector::mapFillRepeatY):
+        * css/CSSStyleSelector.h:
+
+        There is no more RepeatXFill. Instead, look for 
+        fillLayer->repeatX() == RepeatFill
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+
+        Break m_repeat into m_repeatX and m_repeatY
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer):
+        (WebCore::FillLayer::operator=):
+        (WebCore::FillLayer::operator==):
+        (WebCore::FillLayer::fillUnsetProperties):
+        (WebCore::FillLayer::cullEmptyLayers):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillLayer::repeatX):
+        (WebCore::FillLayer::repeatY):
+        (WebCore::FillLayer::isRepeatXSet):
+        (WebCore::FillLayer::isRepeatYSet):
+        (WebCore::FillLayer::setRepeatX):
+        (WebCore::FillLayer::setRepeatY):
+        (WebCore::FillLayer::clearRepeatX):
+        (WebCore::FillLayer::clearRepeatY):
+        (WebCore::FillLayer::initialFillRepeatX):
+        (WebCore::FillLayer::initialFillRepeatY):
+
+        Again, break backgroundRepeat into backgroundRepeatX and 
+        backgroundRepeatY
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::backgroundRepeatX):
+        (WebCore::InheritedFlags::backgroundRepeatY):
+        (WebCore::InheritedFlags::maskRepeatX):
+        (WebCore::InheritedFlags::maskRepeatY):
+
+        We don't need RepeatXFill or RepeatYFill. Now that we store two 
+        values, they are represented by Repeat-NoRepeat and NoRepeat-
+        Repeat, respectively.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-31  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Compositing layer size needs to take into account software reflections on children.
+        https://bugs.webkit.org/show_bug.cgi?id=28837
+        
+        When computing the bounds of a composited layer, take software-rendered
+        reflections into account.
+
+        Test: compositing/reflections/reflection-in-composited.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+
+2009-08-31  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Perform a layout prior to checking whether the scrollbar modes are
+        off, on, or automatic.  The modes may change during layout.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2009-08-31  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Request Headers Should Show Data Sent With Request
+        https://bugs.webkit.org/show_bug.cgi?id=22920
+
+        Manual test added - see below.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateRequest):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/InspectorResource.h:
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._refreshURL):
+        (WebInspector.ResourceView.prototype._refreshQueryString):
+        (WebInspector.ResourceView.prototype._refreshFormData):
+        (WebInspector.ResourceView.prototype._refreshRequestPayload):
+        (WebInspector.ResourceView.prototype._refreshParms):
+        (WebInspector.ResourceView.prototype._toggleURLdecoding):
+        (WebInspector.ResourceView.prototype._getHeaderValue):
+        (WebInspector.ResourceView.prototype._refreshRequestHeaders):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.updateResource):
+        * manual-tests/inspector/display-form-data.html: Added.
+
+2009-08-31  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: pass call frames into the frontend as a part of
+        pausedScript event.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28847
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didPause):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+        * inspector/front-end/inspector.js:
+        (WebInspector.pausedScript):
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Un-blacklist Silverlight on Mac
+
+        Does not seem to crash anymore, probably due to how we now handle
+        drawing and event model handshake better.
+
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::PluginPackage::isPluginBlacklisted):
+
+2009-08-31  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28827
+        SVGSVGElement.unsuspendRedraw() shouldn't throw
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::unsuspendRedraw):
+        * svg/SVGSVGElement.h:
+        * svg/SVGSVGElement.idl:
+
+2009-08-31  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Change the reutrn type of HTMLInputElement::list so that it
+          conforms to the standard.
+        - Add HTMLInputElement::dataList()
+        https://bugs.webkit.org/show_bug.cgi?id=28769
+
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::list):
+        (WebCore::HTMLInputElement::dataList):
+        (WebCore::HTMLInputElement::selectedOption):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+
+2009-08-31  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Remove ASSERT(frame) in ResourceHandle::start (ResourceHandleCurl.cpp)
+        https://bugs.webkit.org/show_bug.cgi?id=28802
+
+        Remove ASSERT because the frame could be null if the
+        ResourceHandle is not associated with any frame, e.g. if we are
+        downloading a file.
+        If the frame is not null but the page is null this must be an
+        attempted load from an onUnload handler, so let's just block it.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::start):
+
+2009-08-31  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Build fix for platforms which don't enable DOM_STORAGE.
+        https://bugs.webkit.org/show_bug.cgi?id=28834
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-08-29  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=28829
+        Crash in AccessibilityRenderObject::activeDescendant when trying to set aria-activedescendant to something without a renderer
+
+        Test: accessibility/aria-activedescendant-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp: (WebCore::AccessibilityRenderObject::activeDescendant): Nil check.
+
+2009-08-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Gtk Build broken for OSX Quartz
+        https://bugs.webkit.org/show_bug.cgi?id=28727
+
+        Check for XP_UNIX instead of GTK or X11 to ease building of the Gtk
+        port in Mac and Unix/Linux.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::init):
+
+2009-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix positioning error when a compositing, absolutely-positioned element has an ancestor with opacity.
+        https://bugs.webkit.org/show_bug.cgi?id=28754
+        
+        For absolutely-positioned layers, convertToLayerCoords() jumps to the positioned
+        ancestor, since the layer x and y are relative to that ancestor. However, this could
+        skip over the ancestorLayer, thus giving the wrong result.
+        
+        Fix by duplicating the enclosingPositionedAncestor() logic in convertToLayerCoords(),
+        and checking for ancestorLayer along the way. If found, compute offset of both to
+        the enclosingPositionedAncestor() and subtract.
+        
+        This also fixes a positioning bug with abs. positioned elements in reflections,
+        so there is a new reflection test with a pixel result.
+
+        Tests: compositing/geometry/abs-position-inside-opacity.html
+               fast/reflections/abs-position-in-reflection.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::isPositionedContainer):
+        (WebCore::RenderLayer::enclosingPositionedAncestor):
+        (WebCore::RenderLayer::enclosingTransformedAncestor):
+        (WebCore::RenderLayer::convertToLayerCoords):
+
+2009-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe
+
+        Wrap WebkitCSSTransformValues in the correct class of DOM wrapper.
+        https://bugs.webkit.org/show_bug.cgi?id=27727
+
+        When fetching the DOM wrapper for a WebkitCSSTransformValue (which is a kind of 
+        CSSValueList), we need to ask the value list whether it's a WebkitCSSTransformValue,
+        because there is not a unique enum value for WebkitCSSTransformValue.
+
+        * bindings/objc/DOMCSS.mm:
+        (kitClass):
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Jan Michael Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28308
+        Fix some warnings introduced by r47381.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+
+2009-08-28  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21442
+        Make sure filesystemPathFromUrlOrTitle() returns a string with length
+        <= MAX_PATH - 1.
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::filesystemPathFromUrlOrTitle):
+
+2009-08-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's VFS for Linux and Mac.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28750
+
+        * WebCore.gypi:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        (WebCore::SQLiteFileSystem::deleteDatabaseFile):
+        * platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp: Removed.
+        * platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp: Removed.
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+
+2009-08-28  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Made bindings use Node::setOnEvent functions for Node descendants
+        instead of Node::setAttributeEventListener.
+
+        Node::setAttributeEventListener is an internal function and
+        doesn't do the forwarding to DOM window that is required for some
+        HTML elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28709
+
+        Tests added in http://trac.webkit.org/changeset/47326 now pass with V8.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Now generates EventListener accessors for Node descendants instead
+        of using custom callbacks.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener): Moved from V8NodeCustom.cpp.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Fixed a bug in
+        signature.
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::createHiddenDependency):
+        (WebCore::removeHiddenDependency):
+        Changed signature to accept Handle instead of Local.
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Removed custom callbacks for EventListener accessors.
+
+2009-08-28  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28803
+        
+        Implements V8CustomVoidCallback reporting any exceptions that were thrown from the callback function.
+
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::invokeCallback): Checks if the callback raised an exception and reports it to WebCore if so.
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Not reviewed (build fix).
+
+        * platform/graphics/qt/ImageDecoderQt.cpp: Accidentally added some spaces.
+        (WebCore::ImageDecoder::create):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        * platform/graphics/qt/ImageDecoderQt.h: Make constructor public so factory function can access it (this seemed better than making ImageDecoder a friend).
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Move ImageDecoder creation function to a factory function on
+        ImageDecoder.  This is arguably where it makes the most sense anyway,
+        and it will (soon) allow ImageSourceQt.cpp to have one less dedicated
+        function.
+
+        * platform/graphics/ImageSource.cpp:
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp:
+        * platform/image-decoders/ImageDecoder.h:
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28785
+        Combine duplicated code from ImageDecoder*.cpp into the main
+        ImageDecoder.cpp.
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+
+2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Override setScrollbarModes to correctly forward scrollbar modes
+        policy changes to client code, via a new platform-specific method,
+        scrollbarsPolicyDidChange.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::scrollbarsPolicyDidChange):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::createScrollbar):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::setScrollbarModes):
+
+2009-08-28  Cédric Luthi <cedric.luthi@gmail.com>
+
+        Reviewed by Tor Arne Vestbø
+
+        [Qt/Mac] Un-blacklist the QuickTime plugin
+
+        https://bugs.webkit.org/show_bug.cgi?id=28768
+
+        Now that the drawing model is properly negotiated, there is no need the
+        blacklist the QuickTime plugin anymore.
+
+        This revealed a bug in PluginView::performRequest: it should not initiate a
+        request if the plugin has been stopped, which is what happens when a plugin
+        only supports the QuickDraw drawing model.
+
+        * plugins/PluginView.cpp:
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-08-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Set DOM agent document to 0 in InspectorController::close to
+        make DOM agent remove DOM listeners from the inspected document.
+
+        Replace windowVisible checks with m_frontend checks to as inspector
+        window lives in a different process in Chromium while frontend proxy
+        is in the inspected page process.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspect):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::pruneResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::addProfile):
+        * inspector/InspectorController.h:
+
+2009-08-28  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Remove dependency of SummaryBar on WebInspector.resourceCategories.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28801
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get categories):
+        * inspector/front-end/SummaryBar.js:
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.update):
+
+2009-08-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed (patching in l18n change that was missing due to
+        the git binary diff format).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28429
+
+        * English.lproj/localizedStrings.js:
+
+2009-08-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make XSSAuditor go fast
+        https://bugs.webkit.org/show_bug.cgi?id=28667
+
+        Make the XSSAuditor go faster by implementing two optimizations:
+
+        1) We avoid canonicalizing scripts that are larger than the page's URL.
+           This saves a bunch of time for large inline scripts.
+
+        2) We memoize canonicalizing the page's URL because it's silly to
+           canonicalize repeated for each inline event listener.
+
+        These optimizations have a measurable affect on the intl1 page cycler.
+
+        No behavior change.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::MemoizingURLCanonicalizer::canonicalizeURL):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::decodeURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Removed ASSERT_NOT_REACHED, because indeed this ASSERT is reached in
+        fast/canvas/change-context.html. And it's alright to reach it.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Removed assertion.
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Not reviewed.  Build fix for http://trac.webkit.org/changeset/47840
+
+        Peter's change forgot one m_decoder->
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex):
+
+2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Add NULL-check, since the context ain't changeable no more, and
+        thus getContext could return 0.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Added NULL-check.
+
+2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        dataTransfer.types() should include type "Files" when files are present in the clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28780
+
+        Add dataTransfer type "Files" to the chromium port.  Add eseidel's
+        patch for same for the mac port.
+
+        * platform/chromium/ClipboardChromium.cpp:
+
+2009-08-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Removed GL_ from all constants, and gl prefix from all calls
+        https://bugs.webkit.org/show_bug.cgi?id=28773
+
+        This was done for the external API in CanvasRenderingContext3D and
+        the internal API in GraphicsContext3D.
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.h:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+
+2009-08-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Qt and Gtk build fixes. Not reviewed.
+
+        Add CanvasRenderingContext3D.idl to the build scripts.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Release the storage mutex whenever leaving JavaScript execution.
+        https://bugs.webkit.org/show_bug.cgi?id=28789
+
+        http://dev.w3.org/html5/spec/Overview.html#storage-mutex describes the
+        required behavior.  After we leave JavaScript, we must be sure the storage
+        mutex has been released.  At the end of evaluate(), if localStorage has been
+        instantiated, tell it to release any locks that may be applicable.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28753
+        <rdar://problem/7173448> Excessive number of threads (and a crash)
+
+        Coalesce DNS prefetch requests to reduce strain on CFHost. Currently, the algorithm is as follows:
+        - when resolver is idle, the first few requests are sent immediately (they may or may not
+        hit the wire);
+        - if there are a few requests in flight already, coalesce all requests for one second;
+        - to avoid pathological cases with lots of links to different sites on a page, only ask
+        CFHost about a handful of names (dropping the rest).
+
+        Coalescing reduces the number of requests dramatically, as prefetchDNS is called for each
+        link, and these tend to have identical host name.
+
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::DNSResolveQueue::DNSResolveQueue):
+        (WebCore::DNSResolveQueue::shared):
+        (WebCore::DNSResolveQueue::add):
+        (WebCore::DNSResolveQueue::decrementRequestCount):
+        (WebCore::DNSResolveQueue::fired):
+        (WebCore::clientCallback):
+        (WebCore::DNSResolveQueue::resolve):
+        (WebCore::prefetchDNS):
+
+2009-08-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Final patch for Canvas 3D support
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This hooks everything up and provides a working implementation of
+        Canvas 3D. I plumb the creation of the 3D canvas down to GraphicsLayer,
+        passing the opaque context and texture pointers so a Canvas3DLayer can be
+        created (more on that later). It also plumbs changes to the 3D canvas so
+        that Canvas3DLayer can recomposite the results.
+        
+        A 3D Canvas element needs a RenderLayer and compositing layer to render.
+        This is because it renders to an off-screen texture in the GPU and then
+        hands it to a Canvas3DLayer, which is a subclass of CAOpenGLLayer, to
+        render that texture as a 3D quad. This keeps everything in GPU memory to 
+        maximize performance. When a CanvasRenderingContext3D is created it 
+        forces a style recalc which creates the RenderLayer and compositing 
+        layer if needed. 
+        
+        I repurposed an existing flag which was put in place for animation to accomplish 
+        this. This flag is passed to setNeedsStyleRecalc(), and I renamed it from 
+        AnimationStyleChange to SyntheticStyleChange. It essentially says that you need
+        to do a complete style recalc, even though the style itself has not really
+        changed.
+        
+        This patch also fixes a couple of bugs discovered when testing with 3d-canvas
+        turned on. I also added a constructor DOMWindow.idl for CanvasRenderingContext3D.
+        This is needed when making a JS wrapper for the object so the prototype 
+        property can be set.
+
+        Test: fast/canvas/change-context.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::glDrawElements):
+        * bindings/js/JSCanvasRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::setNeedsStyleRecalc):
+        * dom/Node.h:
+        (WebCore::):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::is3D):
+        * html/HTMLCanvasElement.h:
+        * html/canvas/CanvasBuffer.cpp:
+        (WebCore::CanvasBuffer::create):
+        (WebCore::CanvasBuffer::CanvasBuffer):
+        (WebCore::CanvasBuffer::_deleteObject):
+        * html/canvas/CanvasBuffer.h:
+        * html/canvas/CanvasFramebuffer.cpp:
+        (WebCore::CanvasFramebuffer::create):
+        (WebCore::CanvasFramebuffer::CanvasFramebuffer):
+        (WebCore::CanvasFramebuffer::_deleteObject):
+        * html/canvas/CanvasFramebuffer.h:
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::CanvasObject):
+        (WebCore::CanvasObject::~CanvasObject):
+        (WebCore::CanvasObject::deleteObject):
+        * html/canvas/CanvasObject.h:
+        (WebCore::CanvasObject::context):
+        * html/canvas/CanvasProgram.cpp:
+        (WebCore::CanvasProgram::create):
+        (WebCore::CanvasProgram::CanvasProgram):
+        (WebCore::CanvasProgram::_deleteObject):
+        * html/canvas/CanvasProgram.h:
+        * html/canvas/CanvasRenderbuffer.cpp:
+        (WebCore::CanvasRenderbuffer::create):
+        (WebCore::CanvasRenderbuffer::CanvasRenderbuffer):
+        (WebCore::CanvasRenderbuffer::_deleteObject):
+        * html/canvas/CanvasRenderbuffer.h:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::createBuffer):
+        (WebCore::CanvasRenderingContext3D::createFramebuffer):
+        (WebCore::CanvasRenderingContext3D::createTexture):
+        (WebCore::CanvasRenderingContext3D::createProgram):
+        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::createShader):
+        * html/canvas/CanvasRenderingContext3D.h:
+        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
+        * html/canvas/CanvasShader.cpp:
+        (WebCore::CanvasShader::create):
+        (WebCore::CanvasShader::CanvasShader):
+        (WebCore::CanvasShader::_deleteObject):
+        * html/canvas/CanvasShader.h:
+        * html/canvas/CanvasTexture.cpp:
+        (WebCore::CanvasTexture::create):
+        (WebCore::CanvasTexture::CanvasTexture):
+        (WebCore::CanvasTexture::_deleteObject):
+        * html/canvas/CanvasTexture.h:
+        * page/DOMWindow.idl:
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::setNeedsStyleRecalc):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationController::cancelAnimations):
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformTexture):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setContentsToGraphicsContext3D):
+        (WebCore::GraphicsLayer::setGraphicsContext3DNeedsDisplay):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        (WebCore::GraphicsLayerCA::updateContentsGraphicsContext3D):
+        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D):
+        (WebCore::GraphicsLayerCA::setGraphicsContext3DNeedsDisplay):
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::requiresLayer):
+        * rendering/RenderHTMLCanvas.h:
+        (WebCore::RenderHTMLCanvas::isCanvas):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        (WebCore::RenderLayerBacking::canUseDirectCompositing):
+        (WebCore::RenderLayerBacking::rendererContentChanged):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForCanvas):
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isCanvas):
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Clean up ImageDecoder*.cpp a bit.
+
+        * platform/image-decoders/ImageDecoder.cpp: Put functions in the same
+          order as in the header file.  Also, since there's already an anonymous
+          namespace in this file, use it to enclose the local helper functions.
+        (WebCore::):
+        (WebCore::ImageDecoder::upperBoundScaledX):
+        (WebCore::ImageDecoder::lowerBoundScaledX):
+        (WebCore::ImageDecoder::scaledY):
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        (WebCore::RGBA32Buffer::width): Style fix.
+        (WebCore::RGBA32Buffer::height): Style fix.
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
+        (WebCore::RGBA32Buffer::copyBitmapData): Ensure m_size is set correctly.
+        (WebCore::RGBA32Buffer::asNewNativeImage): Remove unneeded temp.
+        (WebCore::RGBA32Buffer::operator=): Simplify.
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+        (WebCore::RGBA32Buffer::asNewNativeImage): Try and collect spaced-out temps under loop comment to show they're all related.  Use size_t for iterating over elements of a Vector.
+        (WebCore::RGBA32Buffer::width): Style fix.
+        (WebCore::RGBA32Buffer::height): Style fix.
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Clean up ImageSource.* in preparation for more fixes on bug 27965.
+
+        * platform/graphics/ImageSource.cpp: Put functions in the same order as in header file.
+        (WebCore::ImageSource::isSizeAvailable): Shorten.
+        (WebCore::ImageSource::size): Shorten.
+        (WebCore::ImageSource::frameSizeAtIndex): Shorten.
+        (WebCore::ImageSource::repetitionCount): Shorten.
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+        * platform/graphics/ImageSource.h: Shorten #ifdef section a bit by sharing common typedefs.
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28785
+        Add ImageDecoder.cpp to various build files so platforms will be able to
+        use it.  Move an ENABLE to not cover the whole file, in preparation for
+        adding a bunch of code.  Simplify #ifdefs in ImageDecoder.h to be "Skia
+        vs. everyone else", which also gives new platforms a reasonable default
+        behavior.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::getAddr):
+
+2009-08-27  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28784
+        
+        Add an exported method to flush pending repaints.
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layoutIfNeededRecursive):
+        (WebCore::FrameView::flushDeferredRepaints):
+        * page/FrameView.h:
+
+2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Expose files from the pasteboard in drop events.
+        https://bugs.webkit.org/show_bug.cgi?id=28782
+
+        Update chromium port to expose dataTransfer.files() as per
+        HTML5 drag drop (Aug 2009 edition).
+
+        * platform/chromium/ClipboardChromium.cpp:
+
+2009-08-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dmitry Glazkov.
+
+        ScriptState now keeps explicit Handle of devtools front-end
+        utility context instead of trying to retrieve it from inspected
+        Frame.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28772
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::ScriptState::~ScriptState):
+        (WebCore::scriptStateFromPage):
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptState::context):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::~ScriptValue):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::frontendScriptState):
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Console won't close.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28778
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        * inspector/front-end/utilities.js:
+        (Node.prototype.isAncestor):
+
+2009-08-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix a typo in files() causing image drags to have junk file arrays.
+        https://bugs.webkit.org/show_bug.cgi?id=28755
+
+        Test: editing/pasteboard/files-during-page-drags.html
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::files):
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Not reviewed.  Build fix for Chromium.
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * DerivedSources.cpp: Added JSPageTransitionEvent.cpp to DerivedSources.cpp.
+
+2009-08-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28758
+        <rdar://problem/6440869> Implement pageshow and pagehide events for b/f cache (28758)
+
+        Tests: fast/events/pageshow-pagehide-on-back-cached.html
+               fast/events/pageshow-pagehide-on-back-uncached.html
+               fast/events/pageshow-pagehide.html
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::stopLoading): Dispatch pagehide event
+        (this function is called both when a document goes away, and when it goes to b/f cache).
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Dispatch pagehide right before unload.
+        (WebCore::DOMWindow::dispatchPageTransitionEvent): Do what it takes to add a new event handler
+        that can be installed on Window object.
+        (WebCore::DOMWindow::onpagehide): Ditto.
+        (WebCore::DOMWindow::setOnpagehide): Ditto.
+        (WebCore::DOMWindow::onpageshow): Ditto.
+        (WebCore::DOMWindow::setOnpageshow): Ditto.
+
+        * history/CachedFrame.cpp: (WebCore::CachedFrame::restore): Dispatch pageshow for a page
+        that isn't being restored from cache.
+
+        * dom/PageTransitionEvent.cpp: Added.
+        (WebCore::PageTransitionEvent::PageTransitionEvent):
+        (WebCore::PageTransitionEvent::~PageTransitionEvent):
+        (WebCore::PageTransitionEvent::initPageTransitionEvent):
+        * dom/PageTransitionEvent.h: Added.
+        (WebCore::PageTransitionEvent::create):
+        (WebCore::PageTransitionEvent::isPageTransitionEvent):
+        (WebCore::PageTransitionEvent::persisted):
+        * dom/PageTransitionEvent.idl: Added.
+        Add event class implementation.
+
+        * html/HTMLBodyElement.cpp: (WebCore::HTMLBodyElement::parseMappedAttribute): Support
+        inline listener definition (note that adding listeners to document.body programmatically
+        is not supported, matching Firefox).
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): Dispatch pageshow event right before load event.
+        (WebCore::Document::dispatchPageTransitionEvent): Do what it takes to add a new event for
+        Docuemnt.
+        (WebCore::Document::createEvent): Ditto.
+
+        * dom/Document.h: Added dispatchPageTransitionEvent.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSEventCustom.cpp: (WebCore::toJS):
+        * dom/Event.cpp: (WebCore::Event::isPageTransitionEvent):
+        * dom/Event.h:
+        * dom/EventNames.h:
+        * html/HTMLAttributeNames.in:
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Do what it takes to add a new event type.
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        Adding missing file from previous commit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28740
+
+        * inspector/front-end/SummaryBar.js: Added.
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.get calculator):
+        (WebInspector.SummaryBar.prototype.set calculator):
+        (WebInspector.SummaryBar.prototype.reset):
+        (WebInspector.SummaryBar.prototype.update):
+        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
+        (WebInspector.SummaryBar.prototype._drawSwatch):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
+        (WebInspector.SummaryBar.prototype._fadeOutRect):
+        (WebInspector.SummaryBar.prototype._makeLegendElement):
+
+2009-08-27  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Factor out Factor out summary bar from Resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28740
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
+        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.ResourcesPanel.prototype._changeSortingFunction):
+        * inspector/front-end/SummaryBar.js: Added.
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.get calculator):
+        (WebInspector.SummaryBar.prototype.set calculator):
+        (WebInspector.SummaryBar.prototype.reset):
+        (WebInspector.SummaryBar.prototype.update):
+        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
+        (WebInspector.SummaryBar.prototype._drawSwatch):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
+        (WebInspector.SummaryBar.prototype._fadeOutRect):
+        (WebInspector.SummaryBar.prototype._makeLegendElement):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-08-26  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Start adding heap profiler to Inspector (hidden behind a flag.)
+
+        https://bugs.webkit.org/show_bug.cgi?id=28429
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.reset):
+        (WebInspector.ProfilesPanel.prototype.addProfile):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._snapshotClicked):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js: added Preferences.heapProfilerPresent flag.
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Metrics sidebar editing is broken.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28434
+
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+
+2009-08-27  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28767
+
+        Make KURLGoogle.cpp's decodeURLEscapeSequences decode %00 to match
+        KURL.cpp.  This makes the XSSAuditor tests pass when using KURLGoogle.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::decodeURLEscapeSequences):
+
+2009-08-27  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix, missing functions after r47763.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+
+2009-08-26  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Removing trailing whitespaces from all storage classes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28075
+
+        * storage/ChangeVersionWrapper.cpp:
+        * storage/Database.cpp:
+        * storage/Database.h:
+        * storage/DatabaseDetails.h:
+        * storage/DatabaseThread.cpp:
+        * storage/DatabaseTracker.cpp:
+        * storage/DatabaseTracker.h:
+        * storage/LocalStorageTask.cpp:
+        * storage/LocalStorageTask.h:
+        * storage/LocalStorageThread.cpp:
+        * storage/LocalStorageThread.h:
+        * storage/OriginQuotaManager.cpp:
+        * storage/OriginUsageRecord.cpp:
+        * storage/OriginUsageRecord.h:
+        * storage/SQLError.h:
+        * storage/SQLResultSetRowList.h:
+        * storage/SQLStatement.cpp:
+        * storage/SQLStatement.h:
+        * storage/SQLStatementCallback.h:
+        * storage/SQLStatementErrorCallback.h:
+        * storage/SQLTransaction.cpp:
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCallback.h:
+        * storage/SQLTransactionErrorCallback.h:
+        * storage/Storage.cpp:
+        * storage/Storage.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        * storage/StorageAreaSync.h:
+        * storage/StorageEvent.cpp:
+        * storage/StorageEvent.h:
+        * storage/StorageMap.cpp:
+        * storage/StorageMap.h:
+        * storage/StorageNamespaceImpl.cpp:
+        * storage/StorageSyncManager.cpp:
+        * storage/StorageSyncManager.h:
+
+2009-08-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28763, flickering when opacity changes.
+
+        Make opacity changes from < 1 to 1 and from 1 to < 1 cause a relayout to happen.  We need
+        to do this in order for overflow information to be properly recomputed.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+
+2009-08-26  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        HTMLMediaElement sometimes loses events
+        https://bugs.webkit.org/show_bug.cgi?id=28762
+        <rdar://problem/7172437>
+
+        A media element triggers the resource selection algorithm if 
+        play() is called when the networkState attribute is NETWORK_EMPTY, but
+        it also immediately queues 'play' and either 'waiting' or 'playing' events.
+        One of the steps in preparing to load is to flush pending events, so those 
+        events were lost if the load timer fired quickly enough. Fixed by deleting
+        pending events before scheduling the load timer.
+
+        Test: media/audio-play-event.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::scheduleLoad):
+            Do nothing if the load timer is already scheduled. Call prepareForLoad so queue of 
+            pending events is flushed immediately.
+        (WebCore::HTMLMediaElement::scheduleNextSourceChild):
+            New, start the load timer without flushing pending events.
+        (WebCore::HTMLMediaElement::load):
+            Call prepareForLoad();
+        (WebCore::HTMLMediaElement::prepareForLoad):
+            New, load setup code moved from loadInternal.
+        (WebCore::HTMLMediaElement::loadInternal):
+            Moved some setup code to prepareForLoad so it can be invoked immediately before
+            arming the load timer.
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Call scheduleNextSourceChild instead of scheduleLoad as the later now clears
+            pending events.
+        * html/HTMLMediaElement.h:
+            Declare scheduleNextSourceChild.
+
+2009-08-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Switch ICO decoder from a Vector of raw pointers to a Vector of
+        OwnPtrs now that that is possible.  Makes code slightly simpler.
+
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::decodeAtIndex):
+        (WebCore::ICOImageDecoder::processDirectory):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+
+2009-08-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28718, image inside relpositioned inline doesn't paint.
+        Make sure vertical overflow is still computed across self-painting layers, even though it isn't
+        propagated to parents.
+
+        Added fast/repaint/rel-positioned-inline-with-overflow.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+
+2009-08-26  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        ResourceRequestBase::*[Aa]llowHTTPCookies shouldn't mention http.
+        https://bugs.webkit.org/show_bug.cgi?id=28735
+
+        Renaming the method to imply its wider implications of affecting cookies
+        over any protocol that supports them.
+
+        No change in functionality so no new tests.
+
+        * WebCore.order:
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::adopt):
+        (WebCore::ResourceRequestBase::copyData):
+        (WebCore::ResourceRequestBase::allowCookies):
+        (WebCore::ResourceRequestBase::setAllowCookies):
+        (WebCore::equalIgnoringHeaderFields):
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::ResourceRequestBase):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+
+2009-08-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Made RenderInline::clippedOverflowRectForRepaint() actually include
+        overflow.
+
+        Test: fast/repaint/inline-overflow.html
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::linesVisibleOverflowBoundingBox): Added. Returns
+            the bounding box of all lines’ visible overflow boxes (under the
+            assumption that the first and last lines determine the top and
+            bottom, respectively).
+        (WebCore::RenderInline::clippedOverflowRectForRepaint): Changed to use
+            linesVisibleOverflowBoundingBox() instead of linesBoundingBox().
+        * rendering/RenderInline.h:
+
+2009-08-26  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        minor style correction and include fix for notifications
+        https://bugs.webkit.org/show_bug.cgi?id=28745
+
+        No change in behavior, so no tests.
+
+        * bindings/js/JSDesktopNotificationsCustom.cpp: add include of Error.h
+        * notifications/Notification.cpp: change enum style to InterCaps
+        (WebCore::Notification::Notification):
+        * notifications/NotificationPresenter.h:
+        (WebCore::NotificationPresenter::):
+
+2009-08-25  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        postMessage() spec now supports sending arrays of ports
+        https://bugs.webkit.org/show_bug.cgi?id=26902
+
+        Added support for sending multiple ports at once via postMessage(). JS bindings will be updated in an upcoming patch.
+
+        No new tests, since the new functionality is not exposed via new JS bindings yet, so the old tests suffice.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Mark MessagePort.h and MessagePortChannel.h as private since they are used by WebKit now.
+        * dom/MessageEvent.cpp:
+        Updated APIs to support passing MessagePortArrays.
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        (WebCore::MessageEvent::messagePort):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::MessageEvent::ports):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::disentanglePorts):
+        Added new static function to extract a MessagePortChannelArray from a MessagePortArray.
+        (WebCore::MessagePort::entanglePorts):
+        Added new static function to generate a MessagePortArray (entangled ports) from a MessagePortChannelArray.
+        * dom/MessagePort.h:
+        * dom/MessagePortChannel.cpp:
+        EventData now contains a MessagePortChannelArray field instead of a single MessagePortChannel.
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::EventData::channels):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+        (WebCore::PostMessageTimer::event):
+        (WebCore::DOMWindow::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        * page/DOMWindow.h:
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::DedicatedWorkerContext::dispatchMessage):
+        * workers/DedicatedWorkerContext.h:
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::Worker::dispatchMessage):
+        * workers/Worker.h:
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        Updated WorkerObjectProxy and WorkerContextProxy API implementations to support sending multiple MessagePorts.
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+        Updated WorkerObjectProxy and WorkerContextProxy APIs to support sending multiple MessagePorts.
+
+2009-08-26  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        SocketStreamHandle interface for WebSocket API
+        https://bugs.webkit.org/show_bug.cgi?id=28037
+
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj.now.
+        Other build systems will be updated once the code is functional.
+        Tests will be landed once this code is complete and functional.
+
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/SocketStreamErrorBase.cpp: Added.
+        * platform/network/SocketStreamErrorBase.h: Added.
+        * platform/network/SocketStreamHandleBase.cpp: Added.
+        * platform/network/SocketStreamHandleBase.h: Added.
+        * platform/network/SocketStreamHandleClient.h: Added.
+        * platform/network/cf/SocketStreamError.h: Added.
+        * platform/network/cf/SocketStreamHandle.h: Added.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Added.
+        * platform/network/soup/SocketStreamError.h: Added.
+        * platform/network/soup/SocketStreamHandle.h: Added.
+        * platform/network/soup/SocketStreamHandleSoup.cpp: Added.
+
+2009-08-26  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] setTimeout does not convert non-string argument to string
+        https://bugs.webkit.org/show_bug.cgi?id=28739
+
+        Convert non-string argument to setTimeout to string in the V8
+        bindings.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-08-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Implement getOwnPropertyDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=28724
+
+        Implement the WebCore side of getOwnPropertyDescriptor.  This
+        requires a custom implementation of getOwnPropertyDescriptor
+        for every class with a custom implementation of getOwnPropertySlot.
+
+        The bindings generator has been updated to generate appropriate
+        versions of getOwnPropertyDescriptor for the general case where
+        a custom getOwnPropertyDescriptor is not needed.  ES5 is vague
+        about how getOwnPropertyDescriptor should work in the context of
+        "host" functions with polymorphic [[GetOwnProperty]], so it seems
+        okay that occasionally we "guess" what attributes -- eg. determining
+        whether a property is writable.
+
+        Test: fast/js/getOwnPropertyDescriptor.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getOwnPropertyDescriptor):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        (WebCore::JSHTMLAppletElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        (WebCore::JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        (WebCore::JSHTMLObjectElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::getOwnPropertyDescriptor):
+        * bindings/js/JSNamedNodesCollection.h:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::getOwnPropertyDescriptorDelegate):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertyDescriptor):
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::getOwnPropertyDescriptor):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertyDescriptor):
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::getOwnPropertyDescriptor):
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
+        * bridge/runtime_object.h:
+
+2009-08-26  Vincent Untz <vuntz@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        GObject checks for NULL (and not 0) in g_object_get, so use that
+        as we were already doing elsewhere to make the compiler happy.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+
+2009-08-26  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        RenderThemeMac.mm has incorrect casting for media control element.
+        https://bugs.webkit.org/show_bug.cgi?id=28730
+
+        MediaControlMuteButtonElement was incorrectly casted to
+        MediaControlPlayButtonElement. This is corrected in this patch.
+
+        No new tests because this is code cleanup and is already covered by existing
+        media layout tests.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+
+2009-08-26  Robert Sesek  <rsesek@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Multi-value select boxes cannot do non-contiguous selection on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=28670
+
+        Change the condition regarding the key modifier check for non-contiguous
+        selection on a multi-value list from just PLATFORM(MAC) to
+        PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN)).
+
+        No new tests. This patch only changes the condition on which a certain mouse
+        event modifier key is used.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        r47744 causes media/video-controls-with-mutation-event-handler.html to crash
+        https://bugs.webkit.org/show_bug.cgi?id=28732
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
+            Don't call setAttribute from the construtor, any registered mutation event 
+            listener will cause a crash.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
+            Set the maxAttr here instead of in the constructor.
+
+2009-08-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Timers from cached pages fire instantly rather than the after the specified timeout delay
+        https://bugs.webkit.org/show_bug.cgi?id=28683
+
+        Test: fast/dom/Window/timer-resume-on-navigation-back.html
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore): Remove duplicated Frame::restore() call, since
+            it should be done only once in FrameLoader::open(cachedFrame)
+        * page/DOMTimer.cpp: Added a debug-only flag and ASSERT to catch out-of-order suspense/restore.
+        (WebCore::DOMTimer::DOMTimer): Ditto.
+        (WebCore::DOMTimer::suspend): Ditto.
+        (WebCore::DOMTimer::resume): Ditto.
+        * page/DOMTimer.h: Ditto.
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Setting the volume of a media element has no effect if called too early
+        https://bugs.webkit.org/show_bug.cgi?id=28731
+
+        * manual-tests/audio-volume.html: 
+            Added.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+            Don't bail if metadata hasn't been loaded, it is fine to set rate and/or
+            volume as soon as the movie has been created.
+
+2009-08-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        DocumentThreadableLoader::getShouldUseCredentialStorage should allow for synchronous callbacks from SubresourceLoader::create.
+        https://bugs.webkit.org/show_bug.cgi?id=28728
+
+        Test: This code path is exercised while running xhr layout tests in chromium.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): When called
+        back synchronously, the loader is 0, so the assert is changed to allow for that.
+        (WebCore::DocumentThreadableLoader::loadRequest): Synchronous callbacks may be
+        done before SubresourceLoader::create finishes, so ensure that any previous loader
+        -- from a preflight request -- is cleared before calling SubresourceLoader::create.
+
+2009-08-25  Mark Rowe  <mrowe@apple.com>
+
+        Stop installing IDL files in to the framework.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-25  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Support for HTMLInputElement::list and HTMLInputElement::selectedOption.
+        https://bugs.webkit.org/show_bug.cgi?id=27756
+
+        Tests: fast/forms/input-list.html
+               fast/forms/input-selectedoption.html
+
+        * html/HTMLAttributeNames.in:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::list):
+        (WebCore::HTMLInputElement::selectedOption):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <video> and <audio> controller should be accessible (edit)
+        https://bugs.webkit.org/show_bug.cgi?id=28081
+
+        Test: accessibility/media-element.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+            Add AccessibilityMediaControls.cpp/.h
+
+        * accessibility/AXObjectCache.cpp:
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::getOrCreate):
+            Create AccessibilityMediaControl. Update Copyright
+
+        * accessibility/AccessibilityMediaControls.cpp:
+        * accessibility/AccessibilityMediaControls.h:
+            Added.
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityObject.h:
+            Add isMediaTimeline. Update Copyright.
+
+        * accessibility/AccessibilitySlider.h:
+            Make constructor protected instead of private so AccessibilityMediaTimeline can
+            call it.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+            Add NSAccessibilityValueDescriptionAttribute to range attributes. 
+        (-[AccessibilityObjectWrapper subrole]):
+            Return NSAccessibilityTimelineSubrole for AccessibilityMediaTimeline.
+
+        * dom/Node.h:
+            add isMediaControlElement.
+
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+        (WebCore::localizedMediaControlElementString): 
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription): 
+            New, return localized media controller strings.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+            Move inside of "#if ENABLE(VIDEO)"
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::MediaControlElement):
+            Initialize m_displayType.
+        (WebCore::MediaControlElement::MediaControlElement):
+        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement):
+            Fix style.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            Set m_displayType based on pseudo style ID.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            rename local "o" to "object".
+        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement):
+        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement):
+        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement):
+        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement):
+        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+            Update for MediaControlInputElement constructor change.
+        (WebCore::MediaControlTimeDisplayElement::formatTime):
+            New, moved here from RenderMedia so AccessibilityMediaTimeDisplay can use it.
+        (WebCore::MediaControlTimeDisplayElement::setCurrentValue):
+            New, set text to current time.
+        * rendering/MediaControlElements.h:
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+            Create controls in tab order.
+        (WebCore::RenderMedia::formatTime):
+            Moved to MediaControlTimeDisplayElement::formatTime.
+        (WebCore::RenderMedia::updateTimeDisplay):
+            Call MediaControlTimeDisplayElement::setCurrentValue.
+        * rendering/RenderMedia.h:
+
+2009-08-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix Canvas layout test failures in Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=28720
+
+        The previous fix r47757 does not handle the V8 object conversion correctly.
+
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix compiling errors in Chromium build caused by Canvas3D changes from r47752.
+        https://bugs.webkit.org/show_bug.cgi?id=28717
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-25  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Implement media volume slider for chromium
+        https://bugs.webkit.org/show_bug.cgi?id=28715
+
+        Provided the implementation of the volume slider and its container for
+        chromium port. With this change there will be a usable volume control
+        slider for chromium theme.
+
+        No new tests since this is covered by existing media layout tests.
+
+        * css/mediaControlsChromium.css: CSS style for the volume slider.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::mediaSliderThumbImage): Returns the image for slider thumb.
+        (WebCore::mediaVolumeSliderThumbImage): Returns the image for volume slider thumb.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Paints the track with one vertical white line.
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Adjusts thumb sizes according to the images.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Paints slider thumb image.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Paints volume slider thumb image.
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Missed checking in 2 Canvas3D files
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * bindings/js/JSCanvasRenderingContextCustom.cpp: Implements toJS to do proper subclass binding
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp: Argument marshaling for 3D calls
+
+2009-08-25  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Exception from JavaScript propagates to main script
+        https://bugs.webkit.org/show_bug.cgi?id=26433
+
+        Make sure that exceptions thrown both at compile time and at
+        runtime in javascript URLs are isolated from the main script.
+
+        Test: fast/dom/javascript-url-exception-isolation.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Added all new Canvas3D files to the build
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This also hooks up CanvasRenderingContext as the common base class for
+        CanvasRenderingContext2D and CanvasRenderingContext3D. And it adds a bit
+        of logic throughout to support the new CanvasRenderingContext3D object.
+        But nothing is hooked up yet.
+
+        * DerivedSources.make:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore/GNUmakefile.am:
+        * WebCore/WebCore.gypi:
+        * WebCore/WebCoreSources.bkl:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::strokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::fillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        (WebCore::JSCanvasRenderingContext2D::createPattern):
+        (WebCore::JSCanvasRenderingContext2D::putImageData):
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM):
+        * bindings/js/JSDocumentCustom.cpp:
+        * bindings/js/JSHTMLCanvasElementCustom.cpp:
+        (WebCore::JSHTMLCanvasElement::markChildren):
+        * dom/Document.cpp:
+        (WebCore::Document::getCSSCanvasContext):
+        * dom/Document.h:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::willDraw):
+        (WebCore::HTMLCanvasElement::reset):
+        (WebCore::HTMLCanvasElement::paint):
+        (WebCore::HTMLCanvasElement::is3D):
+        (WebCore::HTMLCanvasElement::context3D):
+        (WebCore::HTMLCanvasElement::texture3D):
+        * html/HTMLCanvasElement.h:
+        (WebCore::HTMLCanvasElement::renderingContext):
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::~CanvasObject):
+        * html/canvas/CanvasRenderingContext.idl:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
+        (WebCore::CanvasRenderingContext2D::~CanvasRenderingContext2D):
+        * html/canvas/CanvasRenderingContext2D.h:
+        (WebCore::CanvasRenderingContext2D::is2d):
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.idl:
+
+2009-08-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        REGRESSION (r47630): fast/repaint/background-generated.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=28704
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Handle SizeNone.
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer): Initialize the size type to SizeNone.
+        * rendering/style/FillLayer.h:
+        (WebCore::FillSize::FillSize): Changed assignment to initialization and
+            removed redundant assignment to size.
+
+2009-08-25  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Complex text doesn't show up with text stroking
+        https://bugs.webkit.org/show_bug.cgi?id=28707
+
+        Skip the NULL check of m_hdc if Windows GDI is not in use.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawComplexText):
+
+2009-08-25  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Media controls panel does not have a volume control slider
+        https://bugs.webkit.org/show_bug.cgi?id=28241
+
+        Introduced "-webkit-media-controls-volume-slider",
+        "-webkit-media-controls-volume-slider-container" and the supporting
+        implementation. Also added appearances of "media-volume-slider" and
+        "media-volume-slider-container".
+
+        The implementation of the controls are in WebCore::MediaControlElements.
+        Logic to trigger the display of the volume controls are in WebCore::RenderMedia.
+
+        No new tests since this change doesn't have theme implementation and the
+        volume slider is disabled by default.
+
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation): Marks that volume slider is vertical.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added corresponding CSS values.
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): ditto.
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::): ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ditto.
+        * css/CSSValueKeywords.in: ditto.
+        * css/mediaControls.css: Makes the volume slider disabled by default.
+        * platform/ThemeTypes.h: Defines theme parts for volume slider and its container.
+        (WebCore::):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement):
+        (WebCore::MediaControlVolumeSliderContainerElement::styleForElement):
+        Adjust the CSS values for "display", "postion", "left" and "top" according to member variables.
+        (WebCore::MediaControlVolumeSliderContainerElement::setVisible): Affects the "display" CSS value.
+        (WebCore::MediaControlVolumeSliderContainerElement::setPosition): Affects the "left" and "top" CSS values.
+        (WebCore::MediaControlVolumeSliderContainerElement::hitTest): Hit testing this element.
+        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
+        (WebCore::MediaControlVolumeSliderElement::defaultEventHandler): Modifies the volume using the slider value, allows dragging.
+        * rendering/MediaControlElements.h:
+        (WebCore::): Added definition for MediaControlVolumeSliderElement and MediaControlVolumeSliderContainerElement.
+        (WebCore::MediaControlVolumeSliderContainerElement::isVisible): Inline getter.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange): Updates styles for volume container and volume slider.
+        (WebCore::RenderMedia::createVolumeSliderContainer): Creates volume slider container and attach to panel.
+        (WebCore::RenderMedia::createVolumeSlider): Creates volume slider and attach to volume slider container.
+        (WebCore::RenderMedia::updateControls): Updates volume container and volume slider.
+        (WebCore::RenderMedia::updateVolumeSliderContainer): Sets the visibility and position of volume slider container and its child.
+        (WebCore::RenderMedia::forwardEvent):
+        Hit testing the volume slider container and volume slider to toggle the visibility and forward events to slider.
+        * rendering/RenderMedia.h:
+        Added definition for RenderMedia::updateVolumeSliderContainer().
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Not implemented.
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::createThumbStyle): Makes volume slider vertical.
+        (WebCore::RenderSlider::thumbRect): ditto.
+        (WebCore::RenderSlider::mouseEventIsInThumb): ditto.
+        (WebCore::RenderSlider::setValueForPosition): ditto.
+        (WebCore::RenderSlider::positionForOffset): ditto.
+        (WebCore::RenderSlider::currentPosition): ditto.
+        (WebCore::RenderSlider::trackSize): ditto.
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle): Adjust style for volume slider thumb.
+        (WebCore::RenderTheme::paint): Paints volume control parts using theme.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintMediaVolumeSliderContainer): Naive implementation to be overridden.
+        (WebCore::RenderTheme::paintMediaVolumeSliderTrack): ditto.
+        (WebCore::RenderTheme::paintMediaVolumeSliderThumb): ditto.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::): Constants for volume control parts.
+
+2009-08-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt/Mac] Use CONFIG+=build_all only when building libraries
+
+        If no configuration is specified when building WebKit we pass the
+        debug_and_release option to QMake which results in Makefiles for
+        both configurations being generated.
+
+        Previously we built both of these configurations by default, for
+        all targets (both the QtWebKit framework/dyldlib and the various
+        executables such as QtLauncher and tests). This makes sense for
+        the libraries, which get the _debug suffix and can be loaded on
+        demand by setting the DYLD_IMAGE_SUFFIX, but for executables we
+        ended up building the same executable twice.
+
+        We now only build one instance of each executable, and since this
+        is a developer build we build the debug-version. Passing either
+        --debug or --release to build-webkit will override this, and
+        even in the default case the release version can still be built
+        by running 'make release' in the the build directory of each
+        target.
+
+        * WebCore.pro:
+
+2009-08-25  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28690
+        Build failure in webkitgtk+-1.1.3
+
+        Do not use deprecated function to unref a pixbuf.
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::Cursor::Cursor):
+
+2009-08-24  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix Bug 27827 "[Chromium] Functions Keys don't work in google spreadsheet".
+        <https://bugs.webkit.org/show_bug.cgi?id=27827>.
+
+        Because of the lack of mappings from GDK key-codes to WebKit key-codes,
+        Chromium cannot send valid key-codes to JavaScript when a user types
+        function keys. This change just copies the mappings from 'KeyEventGtk.cpp'.
+
+        To write layout tests for this issue, added mappings from function-key
+        names to platform-specific key-codes to EventSendingController objects
+        so that eventSender.keyDown() can send function-key events without using
+        platform-specific key codes. (Unfortunately, this eventSender.keyDown() change
+        is only for Mac. So this change adds this new test to Skipped tests for other
+        platforms to prevent this change from crashing the build trees.)
+
+        Test: fast/events/keydown-function-keys.html
+
+       * platform/chromium/KeyCodeConversionGtk.cpp: Add mappings from GDK key-codes
+        to WebKit key-code for function keys.
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-08-24  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28698
+        Avoid unnecessary transformations for the window resizer rect.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::setFrameRect):
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        <rdar://problem/7161900> REGRESSION: 100 MB membuster leak on windows due to 47391
+        (DNS prefetching support)
+
+        * platform/network/cf/DNSCFNet.cpp: (WebCore::prefetchDNS): Use a run loop from secondary
+        thread on Windows, because there isn't one on main one.
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28374
+        Cross-scheme requests should not be blocked by appcache rules
+
+        Test: http/tests/appcache/different-scheme.html
+
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::shouldLoadResourceFromApplicationCache):
+        Resources with different schemes can never be loaded from appcache.
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28688
+        REGRESSION(r24994): Cannot create a frame with a javascript URL
+
+        Test: http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html
+
+        * bindings/js/JSAttrCustom.cpp: (WebCore::JSAttr::setValue):
+        * bindings/js/JSElementCustom.cpp: (WebCore::allowSettingSrcToJavascriptURL):
+        * bindings/js/JSHTMLFrameElementCustom.cpp: (WebCore::allowSettingJavascriptURL):
+        * bindings/js/JSHTMLIFrameElementCustom.cpp: (WebCore::JSHTMLIFrameElement::setSrc):
+        Omit the checks if there is no document in frame yet.
+
+2009-08-24  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix crash in fast/css/rem-dynamic-scaling.html due to a freed
+        RenderStyle being accessed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28681
+
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle): Make currentStyle a RefPtr.
+
+2009-08-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/5743105> Long freezing during loading and selecting text
+        of a large table
+        https://bugs.webkit.org/show_bug.cgi?id=14918
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Added calls to
+            beginDeferredRepaints() and endDeferredRepaints() around the
+            invalidation of the selection, in order to better coalesce multiple
+            invalid rectangles.
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Simplify findTreeElement code, get rid of potential infinite loop.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28680
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        * inspector/front-end/treeoutline.js:
+        (TreeOutline.prototype.getCachedTreeElement):
+        (TreeOutline.prototype.findTreeElement):
+        * inspector/front-end/utilities.js:
+        (isAncestorNode):
+        ():
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Do expand local scope when hitting the break
+
+        https://bugs.webkit.org/show_bug.cgi?id=28678
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-08-24  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Make sure we use the current FrameView's frame rect when
+        going back to a cached page.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28659
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+
+2009-08-24  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Darin Adler.
+
+        Modifying <text rotate=""> doesn't clear the corresponding SVGAnimatedNumberList
+        https://bugs.webkit.org/show_bug.cgi?id=28673
+
+        Test: svg/dom/text-rotate-live.html
+
+        * svg/SVGNumberList.cpp:
+        (WebCore::SVGNumberList::parse): Clear the list before adding the parsed
+        numbers.
+
+2009-08-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by NOBODY (build fix)
+
+        Turn off ENABLE_3D_CANVAS in the xconfig files.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Only expand local scope when hitting the break
+
+        https://bugs.webkit.org/show_bug.cgi?id=28678
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-08-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        background-size fails to parse if a single length/percentage/auto is followed by a comma
+        https://bugs.webkit.org/show_bug.cgi?id=28674
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillSize): Added an allowComma parameter,
+            which is set to false when this method consumes a comma. Moved
+            handling of 'contain' and 'cover' from parseFillProperty into this
+            method.
+        (WebCore::CSSParser::parseFillProperty): Set allowComma to true before
+            processing the next value, and pass allowComma to parseFillSize.
+        * css/CSSParser.h:
+
+2009-08-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Support for cursors that are images
+        https://bugs.webkit.org/show_bug.cgi?id=28346
+
+        Added support for cursors which are images for CursorGtk. Added
+        a manual test for this.
+
+        * manual-tests/gtk/cursor-image.html: Added.
+        * manual-tests/gtk/resources/redcursor.cur: Added.
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::Cursor::Cursor):
+
+2009-08-24  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Integrate GStreamer video with the graphics backend
+        https://bugs.webkit.org/show_bug.cgi?id=16356
+
+        Improves GStreamer backend implementation of MediaPlayerPrivate class.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateErrorCallback): Send proper MediaPlayer
+        error for different GStreamer errors to MediaPlayerPrivate.
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Move static
+        initialization boolean to a better place.
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        (WebCore::MediaPlayerPrivate::duration): Return if error occured, do not
+        consider the source as stream if duration query failed.
+        (WebCore::MediaPlayerPrivate::currentTime): Return if error occured, use
+        an early return.
+        (WebCore::MediaPlayerPrivate::seek): Return if error occured.
+        (WebCore::MediaPlayerPrivate::setEndTime): Remove implementation since this
+        function doesn't seem to be used anywhere in WebCore.
+        (WebCore::MediaPlayerPrivate::paused):
+        (WebCore::MediaPlayerPrivate::seeking):
+        (WebCore::MediaPlayerPrivate::setRate): Seek to current time when rate is set.
+        (WebCore::MediaPlayerPrivate::maxTimeBuffered): Return if error occured.
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable): Ditto.
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded): Ditto.
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::totalBytesKnown):
+        (WebCore::MediaPlayerPrivate::totalBytes): Ditto.
+        (WebCore::MediaPlayerPrivate::updateStates): Return if error occured, update
+        after seek ended with a successful change
+        (WebCore::MediaPlayerPrivate::didEnd): Do not pause the playbin when end is reached.
+        (WebCore::MediaPlayerPrivate::loadingFailed): Update network state with the given error.
+        (WebCore::mimeTypeCache): Gather supported mime types from GStreamer.
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen): First step towards fullscreen
+        support.
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin): Use playbin2 instead of playbin,
+        do not set playbin's audio sink.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func): Use C+casts, decrease reference count of async
+        queue at the end of the idle function.
+        (webkit_video_sink_render): Increase reference count of async queue.
+        (webkit_video_sink_stop): Remove any idle functions with the sink as data.
+
+2009-08-23  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Remaining new files for Canvas3D
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added Canvas3D method behind an ifdef
+        * html/canvas/CanvasByteArray.cpp: Added. Efficient array of bytes for passing to GL functions
+        * html/canvas/CanvasByteArray.h: Added.
+        * html/canvas/CanvasByteArray.idl: Added.
+        * html/canvas/CanvasNumberArray.cpp: Added. Efficient array of 32 bit floats for passing to GL functions
+        * html/canvas/CanvasNumberArray.h: Added.
+        * html/canvas/CanvasNumberArray.idl: Added.
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate call frames interaction to the InjectedScript-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28408
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleTextMessage):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.get domWindow):
+        (InspectorController.openInInspectedWindow):
+        (InspectorController.getCallFrames):
+        (InspectorController.evaluateInCallFrame):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.openInInspectedWindow):
+        (InjectedScript.getCallFrames):
+        (InjectedScript.evaluateInCallFrame):
+        (InjectedScript._callFrameForId):
+        (InjectedScript._objectForId):
+        (InjectedScript.CallFrameProxy):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype._update):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectPropertyProxy):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane):
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+        (WebInspector.ScopeVariableTreeElement.prototype.onattach):
+        (WebInspector.ScopeVariableTreeElement.prototype.onexpand):
+        (WebInspector.ScopeVariableTreeElement.prototype.oncollapse):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused.callback):
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+
+2009-08-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add support for the placeholder attribute and DOM property of the textarea element.
+        https://bugs.webkit.org/show_bug.cgi?id=21248
+
+        A DOM node for an INPUT element doesn't have a flag for placeholder
+        visibility anymore.  This patch also fixes a bug that a renderer
+        doesn't reflect a corresponding DOM value change.
+
+        Tests: fast/forms/textarea-placeholder-dom-property.html
+               fast/forms/textarea-placeholder-pseudo-style.html
+               fast/forms/textarea-placeholder-set-attribute.html
+               fast/forms/textarea-placeholder-set-value.html
+
+        * css/html.css: Add the default style for placeholder of textarea.
+        * dom/InputElement.cpp: Cleanup for m_placeholderShouldBeVisible removal
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::placeholderShouldBeVisible):
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::InputElementData::InputElementData):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::dispatchFocusEvent):
+        (WebCore::HTMLInputElement::dispatchBlurEvent):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::placeholderShouldBeVisible):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::updatePlaceholderVisibility):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        (WebCore::HTMLTextAreaElement::setValue):
+        (WebCore::HTMLTextAreaElement::placeholderShouldBeVisible):
+        (WebCore::HTMLTextAreaElement::updatePlaceholderVisibility):
+        (WebCore::HTMLTextAreaElement::dispatchFocusEvent):
+        (WebCore::HTMLTextAreaElement::dispatchBlurEvent):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::styleDidChange):
+        (WebCore::RenderTextControl::setInnerTextStyle):
+        (WebCore::RenderTextControl::updatePlaceholderVisibility):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        (WebCore::RenderTextControlMultiLine::updateFromElement):
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        (WebCore::RenderTextControlMultiLine::textBaseStyle):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::textBaseStyle):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
+        * rendering/RenderTextControlSingleLine.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::dispatchFocusEvent):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::placeholderShouldBeVisible):
+
+2009-08-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Code clean-up and build fix for filters enabled builds. Moved SVGNames.h
+        into #if ENABLE(SVG) for Document.cpp and added SVGNames.h to the other
+        files. They are needed there after r47688.
+
+        * dom/Document.cpp:
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEMergeNodeElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+
+2009-08-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed, build fix for make distcheck on GTK+.
+
+        * GNUmakefile.am: Added files needed for the build.
+        * bindings/js/JSDOMWindowCustom.cpp: Protect SharedWorker include
+        with #if clause.
+        * bindings/js/JSEventTarget.cpp: Dito.
+        * dom/Document.cpp: Dito.
+        * loader/FrameLoader.cpp: Dito.
+
+2009-08-23  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Throws an Error on "null"
+        https://bugs.webkit.org/show_bug.cgi?id=28665
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+
+2009-08-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: REGRESSION Formatting Function in Console is Abbreviated Too Often
+
+        https://bugs.webkit.org/show_bug.cgi?id=28666
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getProperties):
+        (InjectedScript.createProxyObject):
+
+2009-08-22  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] BitmapImage::getGdkPixbuf does not handle alpha channels properly
+        https://bugs.webkit.org/show_bug.cgi?id=28345
+
+        When doing the conversion between cairo_surface_t* and GdkPixbuf*
+        account for the differences in the respective formats' in-memory
+        image format.
+
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getCairoSurfacePixel):
+        (WebCore::getGdkPixbufPixel):
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-08-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make DOM classes start with a reference count of 1, like all other RefCounted
+        
+        Next step: Element, HTMLElement, HTMLAnchorElement, HTMLAppletElement,
+        HTMLAreaElement, HTMLEmbedElement, HTMLFrameElement, HTMLIFrameElement,
+        HTMLObjectElement, HTMLPlugInElement, HTMLPlugInImageElement.
+
+        * DerivedSources.make: Fix error seen every time we build by escaping the $
+        in the build rule, since you have to use $$ for that in make.
+
+        * WebCore.base.exp: Updated.
+
+        * bindings/objc/DOM.mm:
+        Added now-needed include of SVGNames.h.
+
+        * dom/Document.cpp: Added now-needed include of SVGNames.h.
+        (WebCore::Document::createElement): Use create instead of new.
+
+        * dom/Element.cpp:
+        (WebCore::Element::Element): Added ConstructionType argument so the caller
+        can determine whether this starts with a reference count of either 0 or 1.
+        Later we will remove this again once they are all 1.
+        (WebCore::Element::create): Added.
+
+        * dom/Element.h: Added create and made constructor protected.
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::StyledElement): Added ConstructionType argument.
+        * dom/StyledElement.h: Made many functions protected or private, including
+        the constructor.
+
+        * dom/make_names.pl: Use create to create the base elements HTMLElement,
+        SVGElement, and WMLElement.
+
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply): Use create instead of new.
+        * editing/UnlinkCommand.cpp:
+        (WebCore::UnlinkCommand::doApply): Ditto.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::create): Added.
+        * html/HTMLAnchorElement.h: Made constructor protected and added create.
+        Also made m_rootEditableElementForSelectionOnMouseDown a RefPtr.
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::create): Added.
+        * html/HTMLAppletElement.h: Made constructor private and added create.
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::create): Added.
+        * html/HTMLAreaElement.h: Made constructor private and added create.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::create): Added.
+        * html/HTMLElement.h: Made constructor protected and added create.
+        Made other functions protected and private. Also added inline
+        definition of constructor.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::create): Added.
+        * html/HTMLEmbedElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::create): Added.
+        (WebCore::HTMLFrameElement::parseMappedAttribute):
+        * html/HTMLFrameElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLFrameElementBase.h: Made functions protected and private.
+
+        * html/HTMLFrameOwnerElement.cpp:
+        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement): Pass
+        CreateElement so reference count starts at 1.
+
+        * html/HTMLFrameOwnerElement.h: Made functions protected and private.
+
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::create): Added.
+        * html/HTMLIFrameElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::create): Added.
+        (WebCore::HTMLObjectElement::containsJavaApplet): Changed while loop
+        into a for loop and tweaked formatting.
+
+        * html/HTMLObjectElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLPlugInElement.h: Made constructor protected.
+        Made other functions protected and private.
+
+        * html/HTMLPlugInImageElement.h: Made constructor and another function
+        protected.
+
+        * html/HTMLTagNames.in: Removed createWithNew from all classes that
+        now have create functions. Moved conditional noscript to a separate
+        paragraph.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Use create.
+        (WebCore::HTMLViewSourceDocument::addLink): Ditto.
+        * page/DragController.cpp:
+        (WebCore::documentFragmentFromDragData): Ditto.
+
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::SVGElement): Pass CreateElementZeroRefCount
+        so reference count still starts at 0. Will change this class later.
+        (WebCore::SVGElement::create): Added.
+        * svg/SVGElement.h: Added create, made constructor protected, and
+        made other functions protected and private. Removed unneeded
+        SVGNames.h include.
+
+        * svg/SVGExternalResourcesRequired.h: Added now-needed SVGNames.h
+        include.
+
+        * svg/SVGStopElement.h: Added now-needed SVGNames.h include.
+        Made functions private.
+
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::WMLElement): Pass CreateElementZeroRefCount
+        so reference count still starts at 0. Will change this class later.
+        (WebCore::WMLElement::create): Added.
+        * wml/WMLElement.h: Added create and made constructor protected.
+
+        * wml/WMLTagNames.in: Removed createWithNew from WMLElement.
+
+2009-08-22  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/7161656> Crash in RenderObject::destroy when using custom scrollbars
+
+        Custom scrollbars normally get detached when a document gets detached.  In this case, a crash was happening when the document had gone into the page cache 
+        and then was getting destroyed without proper scrollbar teardown.  This change makes custom scrollbars get detached when the document enters the cache.
+
+        I couldn't figure out a way to reliably cause this to happen in DRT, since the reproducible case relies on the cache being purged at a particular time.
+
+        * history/CachedFrame.cpp: (WebCore::CachedFrame::CachedFrame): Detach custom scrollbars when the CachedFrame is created.  
+          They'll get reattached when the document comes out of the page cache.
+        * page/FrameView.cpp: (WebCore::FrameView::~FrameView): Added some asserts to catch this problem earlier in debug builds.
+
+2009-08-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Make sure self-collapsing blocks that clear floats are still able to collapse their bottom margins with
+        the bottom of their parent blocks.  The old code prevented all collapsing, but all CSS2.1 states is that:
+        "An element that has had clearance applied to it never collapses its top margin with its parent block's bottom margin."
+        
+        The implication is that the bottom margin can still collapse, and the block-inside-inline form of
+        fast/block/margin-collapse/025.html (added as fast/block/margin-collapse/block-inside-inline/025.html) depends
+        on it to get comparable results.
+
+        Added block-inside-inline tests (a whole slew of them) in fast/block/margin-collapse/block-inside-inline/
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::MarginInfo::MarginInfo):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::handleBottomOfBlock):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::MarginInfo::clearMargin):
+        (WebCore::RenderBlock::MarginInfo::canCollapseBottomWithChildren):
+
+2009-08-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Need to implement ARIA role="listitem" and role="list"
+        https://bugs.webkit.org/show_bug.cgi?id=28606
+
+        Test: platform/mac-snowleopard/accessibility/aria-list-and-listitem.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::isUnorderedList):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+
+2009-08-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Clean up fill image geometry calculation
+        https://bugs.webkit.org/show_bug.cgi?id=28652
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Renamed
+            calculateBackgroundSize() to this. Replaced separate scaledWidth and
+            scaledHeight parameters with a single scaledSize parameter. Renamed
+            parameters and local variables.
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Changed
+            to use CSS3 Backgrounds and Borders terminology in comments and
+            local variable names. Renamed, clarified and consolidated some local
+            variables.
+        * rendering/RenderBoxModelObject.h: Made calculateFillTileSize() private.
+
+2009-08-22  Chris Marrin  <cmarrin@apple.com>
+
+        Unreviewed, build fix.
+
+        Backing out http://trac.webkit.org/changeset/47669
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/CanvasRenderingContext2D.h:
+
+2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Backing out http://trac.webkit.org/changeset/47671 in preparation of
+        rolling out http://trac.webkit.org/changeset/47669.
+
+2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Anders Carlsson.
+
+        Build fix, add CanvasRenderingContext to build systems.
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * DerivedSources.make: Added CanvasRenderinContext.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+2009-08-21  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        New files implementing GL buffer wrappers, and support to make them platform independent
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * html/canvas/CanvasBuffer.cpp: Added. Wrapper around GL Buffer object
+        * html/canvas/CanvasBuffer.h: Added.
+        * html/canvas/CanvasBuffer.idl: Added.
+        * html/canvas/CanvasFramebuffer.cpp: Added. Wrapper around GL Framebuffer object
+        * html/canvas/CanvasFramebuffer.h: Added.
+        * html/canvas/CanvasFramebuffer.idl: Added.
+        * html/canvas/CanvasObject.h: Expose m_context
+        * html/canvas/CanvasProgram.cpp: Added. Wrapper around GL Program object
+        * html/canvas/CanvasProgram.h: Added.
+        * html/canvas/CanvasProgram.idl: Added.
+        * html/canvas/CanvasRenderbuffer.cpp: Added. Wrapper around GL Renderbuffer object
+        * html/canvas/CanvasRenderbuffer.h: Added.
+        * html/canvas/CanvasRenderbuffer.idl: Added.
+        * html/canvas/CanvasRenderingContext3D.cpp: Move m_objects hash table from GraphicsContext3D to here
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasShader.cpp: Added. Wrapper around GL Shader object
+        * html/canvas/CanvasShader.h: Added.
+        * html/canvas/CanvasShader.idl: Added.
+        * html/canvas/CanvasTexture.cpp: Added. Wrapper around GL Texture object
+        * html/canvas/CanvasTexture.h: Added.
+        * html/canvas/CanvasTexture.idl: Added.
+        * platform/graphics/GraphicsContext3D.cpp: Removed.
+        * platform/graphics/GraphicsContext3D.h: Move m_objects hash table from here to CanvasRenderingContext3D
+        * platform/graphics/mac/GraphicsContext3DMac.cpp: Implement platform dependent code for GL object creation/destruction
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        * WebCore.vcproj/build-generated-files.sh:
+        * make-generated-sources.sh:
+        Removed obsolete code to set up CREATE_HASH_TABLE.
+
+2009-08-21  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/7162322> Custom style sheet ignored if UAC is enabled 
+
+        * platform/win/SharedBufferWin.cpp: (WebCore::SharedBuffer::createWithContentsOfFile): 
+        No need to open the file with write access.  Only read access is needed.
+
+2009-08-21  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7161454> Leaks seen during http/tests/xmlhttprequest/cross-origin-no-authorization.html
+
+        Also fixes leaks seen on appcache tests.
+
+        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::cancel): Work around
+        something that's likely a CFNetwork issue. Note that on Windows, there is no matching API
+        to call, and we do not think that the leak occurs there anyway.
+
+2009-08-21  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28650
+        Remove cross-thread code from CrossOriginPreflightResultCache.
+        Removed mutexes, atomic initializer and string copy.
+
+        No new tests, the worker tests cover this.
+
+        * loader/CrossOriginPreflightResultCache.cpp:
+        (WebCore::addToAccessControlAllowList):
+        (WebCore::CrossOriginPreflightResultCache::shared):
+        (WebCore::CrossOriginPreflightResultCache::appendEntry):
+        (WebCore::CrossOriginPreflightResultCache::canSkipPreflight):
+        (WebCore::CrossOriginPreflightResultCache::empty):
+        * loader/CrossOriginPreflightResultCache.h:
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        Buildfix after http://trac.webkit.org/changeset/47655.
+
+        * html/HTMLFormControlElement.h:
+
+2009-08-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Improve Cookie DataGrid to Show Hidden Data
+        https://bugs.webkit.org/show_bug.cgi?id=28269
+
+          Removed Custom Bindings
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.cpp:
+
+          Made Non-Custom Bindings in the Backend
+
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+
+          Build the Cookie ScriptObjects, handles using document.cookie in
+          case the platform hasn't implemented raw cookie access.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getCookies):
+        (WebCore::InspectorDOMAgent::buildObjectForCookie):
+        (WebCore::InspectorDOMAgent::buildArrayForCookies):
+        * inspector/InspectorDOMAgent.h:
+
+          Complete the Asynchronous Calls
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetCookies):
+        * inspector/InspectorFrontend.h:
+
+          Asynchronous Functions to get Cookie Data
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.Cookies.buildCookiesFromString): fallback behavior
+
+          Refactor to use the Asynchronous Functions
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems):
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.simpleDataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+
+          Cleaned/Commented Related Code
+
+        (InspectorController.searchCanceled):
+        * inspector/front-end/InjectedScript.js:
+        * platform/Cookie.h:
+        * English.lproj/localizedStrings.js: the new strings that were supposed to have gone in last time
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28145
+        Add support for novalidate/formnovalidate attribute, from HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#attr-fs-novalidate
+
+        Tests: fast/forms/formnovalidate-attribute.html
+               fast/forms/novalidate-attribute.html
+
+        * html/HTMLAttributeNames.in: added novalidate, formnovalidate
+        * html/HTMLButtonElement.idl: formnovalidate attribute exposed
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::formNoValidate): attribute getter
+        (WebCore::HTMLFormControlElement::setFormNoValidate): attribute setter
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::novalidate): attribute getter
+        (WebCore::HTMLFormElement::setNovalidate): attribute setter
+        * html/HTMLFormElement.h:
+        * html/HTMLFormElement.idl: novalidate attribute exposed
+        * html/HTMLInputElement.idl: formNoValidate attribute exposed
+
+2009-08-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Rendering changes to complete
+        [CSS3 Backgrounds and Borders] Add support for the "contain" value for
+        background-size
+        https://bugs.webkit.org/show_bug.cgi?id=27573
+        and
+        [CSS3 Backgrounds and Borders] Add support for the "cover" value for
+        background-size
+        https://bugs.webkit.org/show_bug.cgi?id=27574
+
+        Test: fast/backgrounds/size/contain-and-cover.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers):
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27452
+        Add support for checkValidity() method and invalid event, from HTML5
+        specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-form-checkvalidity
+
+        Tests: fast/events/invalid-001.html
+               fast/events/invalid-002.html
+               fast/events/invalid-003.html
+               fast/events/invalid-004.html
+               fast/events/invalid-005.html
+               fast/forms/checkValidity-001.html
+               fast/forms/checkValidity-002.html
+               fast/forms/checkValidity-003.html
+               fast/forms/checkValidity-004.html
+
+        * dom/Document.idl: oninvalid event handler
+        * dom/Element.idl: ditto
+        * dom/EventNames.h: added invalid event
+        * dom/Node.cpp:
+        (WebCore::Node::oninvalid): ditto
+        (WebCore::Node::setOninvalid): ditto
+        * dom/Node.h: ditto
+        * html/HTMLAttributeNames.in: oninvalid attribute
+        * html/HTMLButtonElement.idl: added checkValidity() method
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute): parses oninvalid
+        * html/HTMLFieldSetElement.idl: added checkValidity() method
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::checkValidity): checkValidity()
+        implementation
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::checkValidity): checkValidity() implementation
+        for form elements
+        * html/HTMLFormElement.h: checkValidity() definition
+        * html/HTMLFormElement.idl: added checkValidity() method
+        * html/HTMLInputElement.idl: added checkValidity() method
+        * html/HTMLSelectElement.idl: added checkValidity() method
+        * html/HTMLTextAreaElement.idl: added checkValidity() method
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::oninvalid): oninvalid event handler
+        (WebCore::DOMWindow::setOninvalid): ditto
+        * page/DOMWindow.h: ditto
+        * page/DOMWindow.idl: ditto
+
+2009-08-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27571 [CSS3 
+        Backgrounds and Borders] Add support for the "round" value for 
+        background-repeat
+        -and-
+        https://bugs.webkit.org/show_bug.cgi?id=27570 [CSS3 Backgrounds and 
+        Borders] Add support for the "space" value for background-repeat
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
+        * css/CSSValueKeywords.in:
+        * rendering/style/FillLayer.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-21  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        New files for Canvas 3D feature
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This is all the new files for implementing Canvas 3D. None of them are hooked up and
+        are not even included in the build yet. This incorporates the reviews from Simon
+        and Ollie for these files.
+
+        * bindings/js/JSCanvasNumberArrayCustom.cpp: Added. Custom JS binding to do implicit conversion from JS Array
+        * html/CanvasObject.cpp: Added. Base class for all GL object containers
+        * html/CanvasObject.h: Added.
+        * html/CanvasRenderingContext.cpp: Added. Base class for CanvasRenderingContext2D and CanvasRenderingContext3D
+        * html/CanvasRenderingContext.h: Added.
+        * html/CanvasRenderingContext.idl: Added.
+        * html/CanvasRenderingContext3D.cpp: Added. 3D context returned from Canvas.getContext()
+        * html/CanvasRenderingContext3D.h: Added.
+        * html/CanvasRenderingContext3D.idl: Added.
+        * platform/graphics/GraphicsContext3D.cpp: Added. Platform interface between CanvasRenderingContext3D and 3D graphics engine
+        * platform/graphics/GraphicsContext3D.h: Added.
+        * platform/graphics/mac/Canvas3DLayer.h: Added. CALayer subclass to composite 3D canvas
+        * platform/graphics/mac/Canvas3DLayer.mm: Added.
+        * platform/graphics/mac/GraphicsContext3DMac.cpp: Added. Mac specific interface (OpenGL based)
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Another Windows build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::diffTextDecorations):
+
+2009-08-21  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28625, focus rings don't respect the non-strict mode
+        line box shrinking quirk.  Make sure outlines don't extend outside the lineTop and lineBottom
+        of the root line box.
+
+        Covered by existing tests.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addFocusRingRects):
+        (WebCore::RenderInline::paintOutline):
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Windows build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::setTextDecorationProperty): Made it static
+        (WebCore::diffTextDecorations): Made it static
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        execCommand("Underline") uses CSS even when styleWithCSS has been turned off
+        https://bugs.webkit.org/show_bug.cgi?id=23892
+
+        This patch adds support for u and s in StyleChange and addInlineStyleIfNeeded so that
+        WebKit does not use CSS to decorate texts when styleWithCSS is set to false.
+
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::copy): Added.
+        * css/CSSValueList.h: Added copy.
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::applyUnderline):
+        (WebCore::StyleChange::applyLineThrough):
+        (WebCore::StyleChange::StyleChange): Added a boolean trimTextDecorations argument.
+        (WebCore::StyleChange::init): Ditto.
+        (WebCore::StyleChange::extractTextStyles): Handles text decorations.
+        (WebCore::getPropertiesNotInComputedStyle): Handles text decorations properly.
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Adds u and s if needed.
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Rename "Databases" Panel as "Storage"
+        https://bugs.webkit.org/show_bug.cgi?id=28620
+
+          Updated enum from "DatabasesPanel" to "StoragePanel" and wherever it was used.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::specialPanelForJSName): string to display StoragePanel can be either "databases" or "storage"
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+
+          Updated All Direct Access from WebInspector.panels.databases to WebInspector.panels.storage,
+          any DatabasesPanel constructors and appropriate function names.
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView.prototype._queryFinished):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels): updated string that comes from hiddenPanels to be "databases" or "storage"
+        (WebInspector.showStoragePanel):
+        (WebInspector.selectDatabase):
+        (WebInspector.selectDOMStorage):
+        (WebInspector.addDatabase):
+        (WebInspector.addDOMStorage):
+
+          Renamed some files and Updated Accordingly.
+
+        * inspector/front-end/StoragePanel.js: Renamed from WebCore/inspector/front-end/DatabasesPanel.js.
+        * inspector/front-end/Images/storageIcon.png: Renamed from WebCore/inspector/front-end/Images/databasesIcon.png.
+        * inspector/front-end/WebKit.qrc: use new file names
+        * inspector/front-end/inspector.css: use new images name and class names
+        * inspector/front-end/inspector.html: use new file name
+        * WebCore.gypi: use new file names
+
+          Miscellaneous Updates.
+
+        * English.lproj/localizedStrings.js: Updated Tooltip from "Databases" to "Storage"
+
+2009-08-21  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Adding three font-specific files to WebCore:
+        FontCacheHaiku.cpp, FontHaiku.cpp, and SimpleFontDataHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28131
+
+        * platform/graphics/haiku/FontCacheHaiku.cpp: Added.
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::createFontPlatformData):
+        (WebCore::FontCache::getTraitsInFamily):
+        * platform/graphics/haiku/FontHaiku.cpp: Added.
+        (charUnicodeToUTF8HACK):
+        (WebCore::Font::canReturnFallbackFontsForComplexText):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/haiku/SimpleFontDataHaiku.cpp: Added.
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-08-21  Philippe Beauchamp  <philippe.beauchamp@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Middle click panning icon is offset by 3 pixels
+        https://bugs.webkit.org/show_bug.cgi?id=28611
+
+        * platform/ScrollView.cpp:
+        panIconSizeLength initialized to 20 instead of 16 to match icon dimension (2 pixels offset)
+        * platform/win/CursorWin.cpp:
+        (WebCore::middlePanningCursor):
+        Hotspot initialized to (8,8) instead of (7,7) (one pixel offset)
+        
+2009-08-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove inspector resources for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=28610
+
+        Based on an idea from Simon Hausmann.
+
+        * WebCore.pro:
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Inspector: Remove Unused Variable
+        https://bugs.webkit.org/show_bug.cgi?id=28616
+
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype._checkWarning):
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console Array Formatter Shows Extra Properties
+        https://bugs.webkit.org/show_bug.cgi?id=28615
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray): do not ignore hasOwnProperties
+
+2009-08-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27574 [CSS3 
+        Backgrounds and Borders] Add support for the "contain" value for 
+        background-size
+        -and-
+        https://bugs.webkit.org/show_bug.cgi?id=27573 [CSS3 Backgrounds and 
+        Borders] Add support for the "cover" value for background-size
+
+        Return contain or cover when appropriate, and otherwise do what we 
+        used to do.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Accept contain and cover as valid values for background-size.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+
+        Handle setting the size and the sizeLength if appropriate.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapFillSize):
+
+        Added new keywords contain and cover.
+        * css/CSSValueKeywords.in:
+
+        Use just sizeLength instead of size to match old behavior.
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers):
+
+        The variable m_sizeType is an EBackgroundSize, and m_sizeLength is 
+        a LengthSize (the equivalent of what m_size used to be). I got rid 
+        of m_sizeSet and made isSizeSet() dynamic. I also defined a new 
+        struct, FillSize that can be used to set or get m_size and 
+        m_sizeLength both at once. 
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer):
+        (WebCore::FillLayer::operator=):
+        (WebCore::FillLayer::operator==):
+        (WebCore::FillLayer::fillUnsetProperties):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillSize::FillSize):
+        (WebCore::FillSize::operator==):
+        (WebCore::FillSize::operator!=):
+        (WebCore::FillLayer::sizeLength):
+        (WebCore::FillLayer::size):
+        (WebCore::FillLayer::isSizeSet):
+        (WebCore::FillLayer::setSizeType):
+        (WebCore::FillLayer::setSizeLength):
+        (WebCore::FillLayer::setSize):
+        (WebCore::FillLayer::clearSize):
+        (WebCore::FillLayer::initialFillSizeType):
+        (WebCore::FillLayer::initialFillSizeLength):
+        (WebCore::FillLayer::initialFillSize):
+
+        This is all boiler-plate stuff to adjust to the new size() vs. 
+        sizeType() vs. sizeLength() distinction.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::backgroundSizeType):
+        (WebCore::InheritedFlags::backgroundSizeLength):
+        (WebCore::InheritedFlags::maskSize):
+        (WebCore::InheritedFlags::setBackgroundSize):
+        (WebCore::InheritedFlags::setBackgroundSizeLength):
+        (WebCore::InheritedFlags::setMaskSize):
+
+        Definition for EBackgroundSizeType.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-21  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed, build fix after r47580.
+
+        [Qt] Adjust the files.
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-08-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Enable various "grouping" ARIA roles
+        https://bugs.webkit.org/show_bug.cgi?id=28486
+
+        Test: platform/mac/accessibility/aria-grouping-roles.html
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+
+2009-08-20  David Levin  <levin@chromium.org>
+
+        Unreviewed trivial comment fix.
+
+        Update a bug link in a comment due to bugzilla amnesia.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::setResourceToRevalidate):
+
+2009-08-20  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        HTML5 media elements do not fire waiting events correctly
+        https://bugs.webkit.org/show_bug.cgi?id=28335
+
+        Fire the waiting event before seeking, and fix a case where firing of
+        the seeked event is missed when the ready state is changed during
+        a seek.
+
+        Added video-waiting-seeking.html into manual tests because not
+        all platforms allow seeking into non-buffered ranges.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState): add support for
+        waiting event when seeking.
+        (WebCore::HTMLMediaElement::finishSeek): send seeked event
+        whenever seeking finishes.
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): dispatch to
+        new function.
+        * html/HTMLMediaElement.h:
+        * manual-tests/video-waiting-seeking.html: Added.
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fix more cases of
+        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
+        the console with certain content
+
+        If the border box is empty, simply avoid painting instead of trying to
+        clip to the empty path.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2009-08-20  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix.  Forgot a svn add for a patch I landed.  :-(
+
+        * storage/SQLTransactionClient.cpp: Added.
+        (WebCore::SQLTransactionClient::didCommitTransaction):
+        (WebCore::SQLTransactionClient::didExecuteStatement):
+        (WebCore::SQLTransactionClient::didExceedQuota):
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-20  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added a client to SQLTransaction. In addition to being a place to
+        get notifications about certain events in a transaction, it is
+        also an abstraction layer that allows us to plug in different
+        implementations for each port for how transactions interract with
+        the main DB. For example, WebCore's default implementation will
+        make direct calls to DatabaseTracker's methods. At the same time,
+        Chromium's implementation will send IPCs to the browser process
+        whenever a transaction needs something from the main DB.
+
+        All storage tests pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27967
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionClient):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionClient):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Added.
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=24793>
+        Auto scroll speed is faster than in IE, Firefox.
+        
+        Changed pan scrolling speed to match Firefox's algorithm.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::adjustedScrollDelta):
+        (WebCore::RenderLayer::panScrollFromPoint):
+
+2009-08-20  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for assert in Chromium page cycler:  drawRect() was re-using
+        an SkPaint, but not resetting it before calling
+        PlatformGraphicsSkia::setupPaintForFilling() a second time.  This
+        CL fixes drawRect(), and re-enables the assert.
+        http://bugs.webkit.org/show_bug.cgi?id=28172
+        http://crbug.com/19797
+
+        Covered by Chromium page cycler tests.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::drawRect):
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-20  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7159016> Popup menus don't disappear when you click outside the window.
+        
+        Revert r47535 which introduced this.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupWndProc):
+
+2009-08-20  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crashes on sites with lots of images
+        https://bugs.webkit.org/show_bug.cgi?id=28473
+
+        The problem is that m_resourceToRevalidate::m_isBeingRevalidated is false while
+        CachedResource is still referring to it, so it may get deleted before
+        Cache::revalidationSucceeded calls CachedResource::clearResourceToRevalidate.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource): Added assert to verify the resource
+        being revalidated is physically in the cache.
+        (WebCore::Cache::revalidationSucceeded): Changed to do one call to switch from the revalidating
+        resource to the revalidated resource.  This allows for proper lifetime management of the
+        revalidated resource. Added assert to verify that the revalidatingResource is in the cache.
+        (WebCore::Cache::pruneDeadResources): Don't remove items from the cache that are in the
+        process of being validated (or else they can get added twice: Once through the normal mechanism
+        and then again during revalidateResource).
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::CachedResource):
+        (WebCore::CachedResource::isSafeToMakePurgeable):
+        Changed m_isBeingRevalidated to m_proxyResource to allow finding out
+        who the validating resource (or proxy) is.
+
+        (WebCore::CachedResource::~CachedResource): Removed code to handle m_resourceToRevalidate
+        being non-zero because this shouldn't be possible due to checks in canDelete. Added asserts
+        as well.
+        (WebCore::CachedResource::setResourceToRevalidate): Adjusted for the change to m_proxyResource
+        and added a comment about the assert.
+        (WebCore::CachedResource::clearResourceToRevalidate):
+        Only clean up the resourceToRevalidate if it hasn't gotten a new proxy resource.
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::setInCache): Don't clear m_proxyResource because the resource
+        is still being referred to by it and the code it robust to this being switched to a new proxy
+        resource without it being cleared first.
+        (WebCore::CachedResource::canDelete): Changed m_isBeingRevalidated to m_proxyResource.
+
+2009-08-20  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix "Chromium RTL autocomplete popup is not layout correctly".
+        https://bugs.webkit.org/show_bug.cgi?id=27889
+
+        The complete fix of the issue consists 2 parts: the patch in webkit
+        and the patch in Chromium's own code.
+
+        This webkit patch only affects Chromium autofill. It
+        1. introduces a new flag in WebCore::PopupContainerSettings to
+           distinguish whether the width of the drop-down should be restricted
+           or not.
+           For autofill, the width of the drop-down is restricted to
+           be the same as that of the input field (the new flag is set in
+           Chromium's own code). But width is not restricted for <select> (same as before).
+        2. introduce a new flag in WebCore::PopContainerSettings to
+           indicate what heuristics to use when displaying text in drop-down menu.
+           For autofill, use drop-down item's directionality to display drop-down items.
+           Previously, drop-down item is displayed in the its first strong
+           directional character's directionality.
+           (drop-down item's directionality is set in Chromium's own code.
+           It is set the same as the directionality of the element. 
+           For autofill, it is the same directionality as that of the input field.)
+           For <select>, still use the text's first strong directional character's
+           directionality to display the text.
+
+
+        Since the patch only affects the chromium client, not webcore part or
+        other clients. No automatic tests is possible.
+
+        * manual-tests/autofill-popup-width-and-item-direction.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::):
+        (WebCore::PopupListBox::paintRow): If list box width is restricted and 
+        an item is longer to fit in a list box, truncate it and draw part of the text and append ellipses.
+        (WebCore::PopupListBox::layout): Restrict width of list box if applicable.
+        * platform/chromium/PopupMenuChromium.h: 
+        (WebCore::PopupItem::PopupItem): style change.
+        (WebCore::PopupContainerSettings::): Add 2 new flags in PopupContainerSetting to 
+        distinguish whether to restrict width of list box and 
+        in what directionality to display the text in drop-down.
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28504>. 
+        Pan Scrolling can scroll while showing the middlePanScroll icon.
+        
+        Fixed an off by one error between RenderLayer::panScrollFromPoint and EventHandler::updatePanScrollState. 
+        In RenderLayer::panScrollFromPoint, we were setting the icon to be an arrow if the difference between the start
+        of the pan scroll and the current mouseposition is > 15. However, in EventHandler::updatePanScrollState, we would
+        set our amount to scroll to 0 only if the difference in mouse position is < 15. I made this check a <= 15, to fix
+        the off by one error.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::panScrollFromPoint):
+
+2009-08-20  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Pull the code in layoutBlockChildren for handling a normal flow block child into a helper method,
+        layoutBlockChild.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::layoutBlockChild):
+        * rendering/RenderBlock.h:
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Made subframeForHitTargetNode a public static method, so WebView can call it
+        during hit testing.
+
+        * page/EventHandler.cpp:
+        (WebCore::subframeForHitTestResult):
+        (WebCore::EventHandler::subframeForTargetNode):
+        * page/EventHandler.h:
+
+2009-08-20  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubberstamped by Kevin Ollivier.
+
+        Check for null bundle before attempting to use it.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificatePath): Add null check on return of
+          CFBundleGetBundleWithIdentifier.
+
+2009-08-20  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28497, images and inline replaced elements don't propagate overflow properly on a line.
+
+        Added fast/repaint/inline-block-overflow.html and updated another test.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        Make sure to still propagate the border box of the replaced element as layout overflow when overflow clip is set on the
+        replaced element.  Make sure to use the InlineBox x/y positions instead of the RenderBox x/y, since the position of the
+        RenderBox has not been updated to the new values yet.
+        
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        Don't use the root line box's overflow.  Use the actual line box overflow values instead.  In the case of an inline
+        with a layer, our overflow didn't propagate to the root line, so we always need to use our values.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::layout):
+        Make sure to clear shadow overflow when doing layout of replaced elements, so that we don't leave a stale overflow
+        value around if a box-shadow goes away.
+
+2009-08-20  Dmitry Titov  <dimich@chromium.org>
+
+        Another attempt to fix Chromium build.
+
+        * WebCore.gypi: now use the correct name of the image file.
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Make the Windows build even fixeder
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::flush):
+
+2009-08-20  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        * WebCore.gypi: add new Webinspector image files (localStorage.png and sessionStorage.png)
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Windows build fix after the last change
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::releaseWindowsContext):
+        (WebCore::GraphicsContext::drawWindowsBitmap):
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Replace many manually-released CFTypeRefs with RetainPtrs
+        https://bugs.webkit.org/show_bug.cgi?id=28498
+
+        * platform/graphics/cg/ColorCG.cpp:
+        (WebCore::createCGColor):
+        * platform/graphics/cg/GradientCG.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::applyFillPattern):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setURLForRect):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::setData):
+        (WebCore::ImageSource::isSizeAvailable):
+        (WebCore::ImageSource::frameSizeAtIndex):
+        (WebCore::ImageSource::repetitionCount):
+        (WebCore::ImageSource::createFrameAtIndex):
+        (WebCore::ImageSource::frameDurationAtIndex):
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::createScratchContext):
+        (WebCore::Path::contains):
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/mac/ImageMac.mm:
+        (WebCore::BitmapImage::getTIFFRepresentation):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::cocoaTypeFromMIMEType):
+        (WebCore::MIMETypeFromCocoaType):
+        * platform/mac/WebCoreNSStringExtras.mm:
+        (stringEncodingForResource):
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::advanceCurrentStream):
+        (WebCore::setHTTPBody):
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::TextCodecMac::encode):
+
+2009-08-20  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Output actual values of counters in showTree
+        https://bugs.webkit.org/show_bug.cgi?id=28481
+
+        No new tests because this patch just improves debugging outputs.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+
+2009-08-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Add file missed in last check-in.
+
+        * html/HTMLAttributeNames.in:
+
+2009-08-19  Timothy Hatcher  <timothy@apple.com>
+
+        Adds new icons to the Web Inspector for Local Storage,
+        Session Storage and Cookies.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28470
+
+        Reviewed by Eric Seidel.
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.addDOMStorage):
+        (WebInspector.DOMStorageSidebarTreeElement):
+        * inspector/front-end/Images/cookie.png:
+        * inspector/front-end/Images/domStorage.png: Removed.
+        * inspector/front-end/Images/localStorage.png: Added.
+        * inspector/front-end/Images/sessionStorage.png: Added.
+        * inspector/front-end/inspector.css:
+
+2009-08-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        HTML5 media elements must fire 'loadend' progress event
+        https://bugs.webkit.org/show_bug.cgi?id=28419
+
+        * dom/EventNames.h:
+            Define loadend.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+            Deal with onloadend.
+        (WebCore::HTMLMediaElement::loadInternal):
+            Post 'loadend' immediately after 'abort'.
+        (WebCore::HTMLMediaElement::noneSupported):
+            Post 'loadend' immediately after 'error'.
+        (WebCore::HTMLMediaElement::mediaEngineError):
+            Ditto.
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Post 'loadend' immediately after 'load'.
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+            Post 'loadend' immediately after 'abort'.
+
+2009-08-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGESSION(r45316), Crash: WebKit crashes in Google Sites when indenting a table
+        https://bugs.webkit.org/show_bug.cgi?id=28474
+
+        This patch fixes a crash when indenting at right after a table.
+        The bug was caused by Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node());
+        where node() is equal to blockNode. Because blockNode is the enclosing block node, this patch changes it to
+        enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()->parentNode());
+
+        Test: editing/execCommand/indent-right-after-table.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Fixed so that blockNode != endOfCurrentParagraph.deepEquivalent().node()
+
+2009-08-20  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by David Levin.
+
+        Render disabled mute button during an error or if no audio is present.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28475
+
+        Covered by existing layout tests:
+        media/video-controls-visible-audio-only.html
+        media/video-no-audio.html
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7154605> Loading page with 1px wide <select> makes the
+        toolbar go blank
+        and
+        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
+        the console with certain content
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButtonGradients): Return early
+        if the rectangle is empty. Use RenderStyle::getBorderRadiiForRect() to
+        adjust the radii in case the sides of the rectangle are smaller than sum
+        of the radii, so that the gradient background matches the border (which
+        already uses getBorderRadiiForRect()). Check if bottomGradient is empty
+        to avoid clipping to an empty path.
+        (WebCore::RenderThemeMac::paintMenuListButton): Moved a
+        GraphicContext::save() down to avoid a save/restore imbalance in the
+        early return case.
+
+        * rendering/RenderThemeSafari.cpp: Made the same changes.
+        (WebCore::RenderThemeSafari::paintMenuListButtonGradients):
+        (WebCore::RenderThemeSafari::paintMenuListButton):
+
+2009-08-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk][REGRESSION] XHR test failures after r45558
+        https://bugs.webkit.org/show_bug.cgi?id=27143
+
+        Disable sniffing if it's explicitly requested. Updated patch
+        originally by Gustavo Noronha.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::statusWillBeHandledBySoup):
+        (WebCore::gotHeadersCallback):
+        (WebCore::contentSniffedCallback):
+        (WebCore::gotChunkCallback):
+        (WebCore::startHttp):
+
+2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Swap the pixels since QImage expect ARGB while ImageData
+        stores them as RGBA.
+
+        This fixes the fast/canvas/canvas-copyPixels.html test.
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::putImageData):
+
+2009-08-20  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by David Levin.
+
+        [v8] Use atomic string caching for createElement
+        Extend atomic string caching to createElement.  Fix a bug in idl
+        parser that caused incorrect parsing if a function argument
+        attribute list contained a comma.
+        https://bugs.webkit.org/show_bug.cgi?id=28449
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8ValueToAtomicWebCoreStringWithNullCheck):
+        * dom/Document.idl:
+
+2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed, build fix after r47515.
+
+        [Qt] There is no Phonon::MediaObject::hasAudio() function.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio): Assume true.
+
+2009-08-20  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28483
+        The V8 ScriptController's cleanupScriptObjectsForPlugin should take a
+        Widget* instead of void* to avoid the need for manual casting to Widget*
+        at the callsite.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
+        * bindings/v8/ScriptController.h:
+
+2009-08-19  David Levin  <levin@chromium.org>
+
+        Unreviewed speculative build fix for qt.
+
+        * page/OriginAccessEntry.cpp:
+
+2009-08-19  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to
+        specify a more granular policy for cross-origin XHR access.
+
+        Tests: http/tests/xmlhttprequest/origin-whitelisting-all.html
+               http/tests/xmlhttprequest/origin-whitelisting-exact-match.html
+               http/tests/xmlhttprequest/origin-whitelisting-https.html
+               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses-with-subdomains.html
+               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses.html
+               http/tests/xmlhttprequest/origin-whitelisting-subdomains.html
+
+        * WebCore.base.exp: Export methods to manipulate origin access whitelists to enable
+        testing via layout tests.
+
+        * WebCore.xcodeproj/project.pbxproj: Add OriginAccessEntry.*
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCoreSources.blk: Ditto.
+
+        * page/SecurityOrigin.h: Implement origin access whitelists.
+        (WebCore::originAccessMap): Static getter for access whitelists.
+        (WebCore::SecurityOrigin::canRequest): Modify request checking logic to check whitelists.
+        (WebCore::SecurityOrigin::whiteListAccessFromOrigin): Add an entry to a whitelist.
+        (WebCore::SecurityOrigin::resetOriginAccessWhiteLists): Clear all the whitelists.
+
+        * page/OriginAccessEntry.h: Added. An entry in an origin access whitelist.
+        * page/OriginAccessEntry.cpp: Ditto.
+
+2009-08-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Non-precomp headers build fix.
+
+        * platform/image-decoders/ImageDecoder.cpp:
+
+2009-08-19  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Disable a bad SKIA assert
+        https://bugs.webkit.org/show_bug.cgi?id=28482
+
+        In http://trac.webkit.org/changeset/47386/ an assert was "fixed" in SKIA code. 
+        When this was pulled into Chromium, it started breaking the page cycler. 
+        Disable it again until we can figure out what's going on.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        queryCommandState('underline') returns false if the selected text is also bold and italic
+        https://bugs.webkit.org/show_bug.cgi?id=11022
+
+        This patch modifies stateStrikethrough and stateUnderline to use the value -webkit-text-decorations-in-effect
+        instead of text-decoration.  Because text-decoration only retrieves explicit styling at the node on which
+        the query was sent, we need to use -webkit-text-decorations-in-effect to include decorations added by ancestors
+        and also u, s, and strike tags.
+
+        Test: editing/style/text-decoration-state.html
+
+        * editing/EditorCommand.cpp:
+        (WebCore::stateStrikethrough): Use -webkit-test-decorations-in-effect instead of text-decoration.
+        (WebCore::stateUnderline): Ditto.
+
+2009-08-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - Fix <rdar://problem/7155710>
+        HTML selects on windows cause containing window to become inactive when opened.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        Pass SWP_NOACTIVATE to SetWindowPos, remove AW_ACTIVATE from AnimateWindow and pass
+        SW_SHOWNOACTIVATE to ShowWindow.
+        
+        (WebCore::PopupWndProc):
+        Prevent mouse activation from activating the window.
+
+2009-08-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Images flash as you hover them on http://www.atebits.com/scribbles/
+        <rdar://problem/7143958>
+        
+        Tag images with the device colorspace with the colorspace of the main display, rather than
+        GenericRGB, so that composited images color-match those rendered via Core Graphics.
+        
+        Covered by LayoutTests/compositing/color-matching/image-color-matching.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+
+2009-08-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt and Dan Bernstein.
+
+        - Fix <rdar://problem/7152589> Stylable scrollbar corners aren't working.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        Initialize m_scrollCorner.
+
+        (WebCore::FrameView::~FrameView):
+        Assert that m_scrollCorner is null.
+
+        (WebCore::FrameView::detachCustomScrollbars):
+        Destroy m_scrollCorner.
+
+        (WebCore::FrameView::invalidateScrollCorner):
+        Invalidate the scroll corner.
+        
+        (WebCore::FrameView::updateScrollCorner):
+        Create/destroy the scroll corner.
+        
+        (WebCore::FrameView::paintScrollCorner):
+        Paint the scroll corner.
+        
+        * page/FrameView.h:
+        (WebCore::FrameView::isFrameViewScrollCorner):
+        Return whether a RenderScrollbarPart is the frame view scroll corner.
+        
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        Go ahead and update the scroll corner.
+        
+        (WebCore::ScrollView::setScrollbarsSuppressed):
+        Pass the scroll corner rect to invalidateRect.
+        
+        (WebCore::ScrollView::scrollCornerRect):
+        Return the scroll corner rect.
+        
+        * platform/ScrollView.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::imageChanged):
+        If this scrollbar part is the frame view scroll corner, invalidate it.
+
+2009-08-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG feComponentTransfer needs to be implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=27768]
+
+        Implementation of SVG Filter feComponentTransfer.
+
+        There is already a test case
+        Test: svg/W3C-SVG-1.1/filters-comptran-01-b.svg
+
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::identity):
+        (WebCore::table):
+        (WebCore::discrete):
+        (WebCore::linear):
+        (WebCore::gamma):
+        (WebCore::FEComponentTransfer::apply):
+
+2009-08-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/7141522> Incorrect layout of product table at henry.com
+
+        Test: fast/block/basic/quirk-percent-height-table-cell.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcPercentageHeight): Tweak the quirk that allows
+        percentage-height children of auto-height blocks to look for an ancestor
+        with non-auto height and compute their height based on it. The change is
+        that if that ancestor is a table cell, it is ignored and the percent
+        height computes to zero (just like in strict mode). This matches Firefox
+        and IE.
+
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add 'icu::' qualifier when refering to ICU C+names to the other
+        file with this issue missed in the previous check-in.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::):
+
+2009-08-19  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix for Skia).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [CAIRO] Remove setFont indirection
+        https://bugs.webkit.org/show_bug.cgi?id=28453
+
+        Remove the indirection and just set the font in Font::drawGlyphs.
+
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/gtk/FontPlatformData.h:
+        (WebCore::FontPlatformData::scaledFont):
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::~FontPlatformData):
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        * platform/graphics/win/FontPlatformData.h:
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+
+2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: When adding style selector, generate default name based
+        on id / class / type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28468
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode):
+
+2009-08-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Rename combinedOverflow to visibleOverflow, since that's what it actually represents.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::topvisibleOverflow):
+        (WebCore::InlineFlowBox::bottomvisibleOverflow):
+        (WebCore::InlineFlowBox::leftvisibleOverflow):
+        (WebCore::InlineFlowBox::rightvisibleOverflow):
+        (WebCore::InlineFlowBox::visibleOverflowRect):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::floatRect):
+        (WebCore::RenderBlock::nodeAtPoint):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::visibleOverflowRect):
+        (WebCore::RenderBox::topvisibleOverflow):
+        (WebCore::RenderBox::bottomvisibleOverflow):
+        (WebCore::RenderBox::leftvisibleOverflow):
+        (WebCore::RenderBox::rightvisibleOverflow):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderOverflow.h:
+        (WebCore::RenderOverflow::visibleOverflowRect):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::shouldPaint):
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+
+2009-08-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Sound button appears in controller with movies that have no audio
+        https://bugs.webkit.org/show_bug.cgi?id=28464
+
+        Test: media/video-no-audio.html
+
+        * html/HTMLMediaElement.cpp:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::hasAudio):
+            Added hasAudio.
+
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayer::hasVideo):
+            Make const.
+        (WebCore::MediaPlayer::hasAudio):
+            Added hasAudio.
+
+        * platform/graphics/MediaPlayerPrivate.h:
+            Add hasAudio.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/win/QTMovieWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::hasAudio):
+            Ditto.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlMuteButtonElement::disabled):
+            New, return true if media element doesn't have audio.
+        (WebCore::MediaControlMuteButtonElement::rendererIsNeeded):
+            Renderer is not needed if element has no audio.
+        * rendering/MediaControlElements.h:
+        (WebCore::MediaControlInputElement::disabled):
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::getMediaUIPartStateFlags):
+            Return MediaUIPartDisabledFlag if node is disabled.
+            
+
+2009-08-19  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27357
+        Removed the two unnecessary overridden willValidate() methods introduced
+        in r47444.
+
+        * html/HTMLKeygenElement.h:
+        * html/HTMLObjectElement.h:
+
+2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Allow dumping dangling nodes to the console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28458
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::releaseDanglingNodes):
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::bind):
+        (WebCore::InspectorDOMAgent::unbind):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::discardBindings):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::setDetachedRoot):
+        (WebCore::InspectorFrontend::childNodeCountUpdated):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatnode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._setDetachedRoot):
+        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
+        (WebInspector.setDetachedRoot):
+        (WebInspector.childNodeCountUpdated):
+        (InspectorController.pushNodeToFrontend):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.createProxyObject):
+
+2009-08-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27464
+        Implement application cache online whitelist wildcard flag
+
+        Test: http/tests/appcache/whitelist-wildcard.html
+
+        A "*" in NETWORK section means that network loading needn't be blocked.
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::isURLInOnlineWhitelist):
+        * loader/appcache/ApplicationCache.h:
+        (WebCore::ApplicationCache::setAllowsAllNetworkRequests):
+        (WebCore::ApplicationCache::allowsAllNetworkRequests):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::openDatabase):
+        (WebCore::ApplicationCacheStorage::store):
+        (WebCore::ApplicationCacheStorage::loadCache):
+        * loader/appcache/ManifestParser.cpp:
+        (WebCore::parseManifest):
+        * loader/appcache/ManifestParser.h:
+
+2009-08-19  Brady Eidson <beidson@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        <rdar://problem/7042555> Loading certain pages on Tiger will start a spurious download
+        
+        Get rid of method swizzling entirely. This created problems when lower level
+        Foundation code would call into our own swizzled method.
+        
+        * platform/network/mac/ResourceHandleMac.mm: 
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): 
+        * platform/network/mac/WebCoreURLResponse.h:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (-[NSURLResponse adjustMIMETypeIfNecessary]):
+
+2009-08-19  Adam Roben  <aroben@apple.com>
+
+        Fix linker warnings on Windows
+
+        Reviewed by Anders Carlsson.
+
+        Fixes <http://webkit.org/b/28462> WebCore causes linker warnings on
+        Windows about multiply-defined JSHTMLDataListElement symbols
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude JSHTMLDataListElement.cpp
+        from the build (just like we do for the other generated bindings
+        files) so that we don't get warnings about multiply-defined symbols in
+        JSHTMLDataListElement.cpp and DerivedSources.cpp. Also removed
+        duplicate versions of JSSVGElementWrapperFactory.cpp, and let VS
+        reorder a few files.
+
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Add 'icu::' qualifier when refering to ICU C+names.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::fontContainsCharacter):
+
+2009-08-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Cleanup from my patch thet rewrote overflow.  Remove unused member variables from RenderTableSection and
+        move the addition of overflow from children into a separate pass after the height of the section has been
+        set.  This prevents the RenderOverflow struct from being aggressively allocated for all table sections.
+        (Not a a correctness issue, just a memory issue.)
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::RenderTableSection):
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderTableSection.h:
+
+2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Remove bogus dependency rules for built sources that derive
+        from HTMLTagNames.in, HTMLAttributeNames.in and xmlattrs.in. The
+        header files should be generated regardless of whether the source
+        file changed or not. We should only rely on the *.in files being
+        changed.
+
+        * GNUmakefile.am:
+
+2009-08-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        convert FormatBlock candidate tag list from if chain to hash lookup
+        https://bugs.webkit.org/show_bug.cgi?id=28448
+
+        No behavior change, just cleanup.
+
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag):
+        * editing/htmlediting.h:
+
+2009-08-19  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update GraphicsContextSkia's version of drawLine to make use of the shared
+        adjustLineToPixelBoundaries function and elimination overlapping code.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-08-18  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContextSkia.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::setLineDash):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-08-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28446
+        Custom request headers shouldn't be sent with cross-origin preflight request
+
+        Tests: http/tests/xmlhttprequest/access-control-preflight-headers-async.html
+               http/tests/xmlhttprequest/access-control-preflight-headers-sync.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        Don't copy headers to OPTIONS request. The spec is vague about this, but the intention was
+        that they shouldn't be sent, and Firefox doesn't send them.
+
+2009-08-18  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 Bindings for Desktop Notifications feature.
+        https://bugs.webkit.org/show_bug.cgi?id=28271
+
+        * WebCore.gypi: 
+        added notification files to build (all still behind a flag that's not on)
+        * bindings/scripts/CodeGeneratorV8.pm:
+        added special case in DOMWindow/AppCache style for named event handlers
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp: Added.
+        * notifications/Notification.h:
+        made event handler routines public (as they are in DOMWindow, eg) for
+        binding access.
+        * notifications/NotificationCenter.idl:
+        needed to make methods V8Custom to support different behaviors in 
+        worker/page context in chromium. 
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::getNotificationPresenter):
+        (WebCore::WorkerThread::setNotificationPresenter):
+        needed to make these methods public as well so chromium can inject
+        the notification presenter into the worker thread.
+
+2009-08-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - Implement HTML5 nav element
+        https://bugs.webkit.org/show_bug.cgi?id=27937
+
+        <nav> should behave essentially the same as <div> for parsing
+        etc. This is implemented by the changes below.
+        
+        Tests: fast/html/nav-element.html
+
+        * css/html.css:
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority):
+        (WebCore::blockTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode):
+        * html/HTMLTagNames.in:
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson, David Hyatt and Dan Bernstein.
+
+        - Fix <rdar://problem/7152727>
+
+        If a page has custom scroll bars, they will not update correctly when the window is activated/deactivated.
+        
+        * page/FrameView.cpp:
+        (WebCore::FrameView::hasCustomScrollbars):
+        Check if the frame view or any of its subviews have custom scroll bars.
+        
+        (WebCore::FrameView::updateControlTints):
+        Go ahead and update control tints if the frame view has custom scroll bars.
+        
+        * page/FrameView.h:
+
+2009-08-18  Mark Rowe  <mrowe@apple.com>
+
+        Roll out r47477 as it introduced assertion failures and crashes on the build bots.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Removed.
+        * storage/SQLTransactionClient.h: Removed.
+
+2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding the SharedTimer file for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28126
+
+        * platform/haiku/SharedTimerHaiku.cpp: Added.
+        (WebCore::):
+        (WebCore::SharedTimerHaiku::SharedTimerHaiku):
+        (WebCore::SharedTimerHaiku::~SharedTimerHaiku):
+        (WebCore::SharedTimerHaiku::instance):
+        (WebCore::SharedTimerHaiku::start):
+        (WebCore::SharedTimerHaiku::stop):
+        (WebCore::SharedTimerHaiku::Filter):
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
+
+2009-08-18  Mark Rowe  <mrowe@apple.com>
+
+        Release build fix.
+
+        * xml/XMLHttpRequest.cpp: Sprinkle some #ifndef NDEBUG around.
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::~XMLHttpRequest):
+
+2009-08-18  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28412: Leak of WebCore::XMLHttpRequest object during layout tests.
+
+        No new tests: Already covered by existing tests.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Add instrumentation for this kind of leak.
+        (WebCore::XMLHttpRequest::~XMLHttpRequest): Ditto.
+        (WebCore::XMLHttpRequest::createRequest): Only setPendingActivity() if we actually started a request. Also,
+        restore a call to nonCacheRequestInFlight() that got lost in a recent refactor.
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added a client to SQLTransaction. In addition to being a place to
+        get notifications about certain events in a transaction, it is
+        also an abstraction layer that allows us to plug in different
+        implementations for each port for how transactions interract with
+        the main DB. For example, WebCore's default implementation will
+        make direct calls to DatabaseTracker's methods. At the same time,
+        Chromium's implementation will send IPCs to the browser process
+        whenever a transaction needs something from the main DB.
+
+        All storage tests pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27967
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionClient):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionClient):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Added.
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+        Final change for v8 corresponding to http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp: Added missing using statment
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+       More corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+        Make corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+
+2009-08-18  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getIdentifierValue):
+
+2009-08-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More work on making DOM classes start with reference count of 1
+        https://bugs.webkit.org/show_bug.cgi?id=28068
+
+        Some related clean-up and preparation steps so the subsequent
+        patches will be as small as possible.
+
+        * WebCore.base.exp: Sorted this file.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        Use nameAttr instead of the name function.
+
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::JSHTMLFrameElement::setSrc):
+        Use srcAttr instead of the src function.
+
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc):
+        Use srcAttr instead of the src function.
+
+        * bindings/objc/DOM.mm: Sorted includes.
+        * dom/Document.cpp: Ditto.
+
+        * dom/StyledElement.cpp: Made invalidateStyleAttribute inline.
+        * dom/StyledElement.h: Ditto.
+
+        * dom/make_names.pl: Changed default of createWithNew to 0.
+        Eventually all elements will be created with create instead of new.
+
+        * html/HTMLTagNames.in:
+        * svg/svgtags.in:
+        * wml/WMLTagNames.in:
+        Added createWithNew for every tag. We'll remove it as we convert
+        element classes to use create.
+
+        * html/HTMLAppletElement.h: Removed unneeded forward declarations.
+        * html/HTMLFrameElement.h: Ditto.
+
+        * html/HTMLEmbedElement.cpp: Removed many attribute get and
+        set functions.
+        * html/HTMLEmbedElement.h: Ditto.
+        * html/HTMLIFrameElement.cpp: Ditto.
+        * html/HTMLIFrameElement.h: Ditto.
+        * html/HTMLObjectElement.cpp: Ditto.
+        * html/HTMLObjectElement.h: Ditto.
+        * html/HTMLPlugInElement.cpp: Ditto.
+        * html/HTMLPlugInElement.h: Ditto.
+
+        * html/HTMLFrameElementBase.cpp: Removed many attribute get and
+        set functions.
+        (WebCore::HTMLFrameElementBase::location): Changed to use
+        srcAttr instead of src.
+        * html/HTMLFrameElementBase.h: Removed many attribute get and set
+        functions.
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::replaceMediaElementTimerFired):
+        Use srcAttr and typeAttr instead of setSrc and setType.
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::createDocumentStructure): Ditto.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Use nameAttr instead
+        of name -- this avoids an extra AtomicString round trip and a little
+        ref count churn too.
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers need to support loading.
+        https://bugs.webkit.org/show_bug.cgi?id=28342
+
+        Added loader support to shared workers, and refactored worker tests to also test SharedWorkers
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::postTaskToLoader):
+        Forwards load requests to an arbitrary document from the list of worker's documents.
+        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
+        Posts responses back to the shared worker thread.
+
+2009-08-18  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        StyleChange::init needs clean up before fixing the bug 23892
+        https://bugs.webkit.org/show_bug.cgi?id=27749
+
+        This patch simplifies StyleChange::init by removing the iteration on CSS properties,
+        and adding functions reconcileTextDecorationProperties and extractTextStyle to handle the style.
+
+        Because there is a bug in how text decorations are processes in getPropertiesNotInComputedStyle,
+        this patch simplifies the treatment in order to preserve the original behavior of WebKit.
+        However, the current implementation is not best (adds redundant text-decorations) and we should fix it later.
+
+        No test is added since there is no change in behavior.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::init): Uses getPropertiesNotInComputedStyle instead of iterating through the properties
+        (WebCore::StyleChange::reconcileTextDecorationProperties): Removes -webkit-text-decorations-in-effects and redundant "none"
+        (WebCore::getIdentifierValue): Obtains the identifier of a CSSPrimitiveValue
+        (WebCore::StyleChange::extractTextStyles): Converts properties in style to m_apply* and removes the property
+        (WebCore::getPropertiesNotInComputedStyle): Fixed a bug with how text decorations are treated
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixing a DB file naming bug in Chromium. The origin should come
+        before the DB name in the file name.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28331
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+
+2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding four image-specific files to WebCore:
+        IconHaiku.cpp, ImageBufferData.h, ImageBufferHaiku.cpp, ImageHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28130
+
+        * platform/graphics/Icon.h:
+        * platform/graphics/haiku/IconHaiku.cpp: Added.
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/haiku/ImageBufferData.h: Added.
+        * platform/graphics/haiku/ImageBufferHaiku.cpp: Added.
+        (WebCore::ImageBufferData::ImageBufferData):
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::~ImageBuffer):
+        (WebCore::ImageBuffer::context):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        (WebCore::ImageBuffer::toDataURL):
+        (WebCore::ImageBuffer::image):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/haiku/ImageHaiku.cpp: Added.
+        (WebCore::FrameData::clear):
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::BitmapImage::initPlatformData):
+        (WebCore::BitmapImage::invalidatePlatformData):
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::checkForSolidColor):
+        (WebCore::BitmapImage::getBBitmap):
+
+2009-08-18  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27575 [CSS3 
+        Backgrounds and Borders] Drop the prefix from background-size
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillProperty):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        (WebCore::ensurePropertyMap):
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers need to forward exceptions to parent documents
+        https://bugs.webkit.org/show_bug.cgi?id=28320
+
+        Changed SharedWorkerProxy to have individual mutexes (so workers can interact with their parent documents without contention).
+
+        Updated SharedWorkerProxy to forward exceptions/console messages to all parent documents.
+
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        Cleaned up bitrot - added missing include.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::postExceptionTask):
+        Callback used to deliver exceptions to a document.
+        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
+        Forwards exceptions to all parent documents for presentation to the user.
+        (WebCore::postConsoleMessageTask):
+        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
+        Forwards console messages to all parent documents for presentation to the user.
+        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
+        Grabs the mutex before accessing workerDocuments.
+        (WebCore::SharedWorkerProxy::documentDetached):
+        Grabs the mutex before accessing workerDocuments.
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7135588> HTMLMediaElement should ask WebPolicyLoadDelegate before loading resource
+        
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        Call FrameLoaderClient::shouldLoadMediaElementURL.
+        
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::shouldLoadMediaElementURL):
+        Return true by default.
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        openDatabase() should not execute any SQL statement on the
+        database it's trying to open, unless there are no other open
+        handles to the same database. Otherwise, we might run into a
+        deadlock.
+
+        Test: storage/open-database-while-transaction-in-progress.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=28207
+
+        * storage/Database.cpp:
+        (WebCore::Database::performOpenAndVerify):
+
+2009-08-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter feBlend implementation missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28133]
+
+        Implementation of SVG Filter feBlend.
+
+        FilterEffect.cp needed changes to optimize the rendering. With the old code
+        we drew a subEffect on the current FilterEffect by drawImage, got the PixelArray,
+        cleared the drawing area, drew the next FilterEffect with drawImage and picked this
+        PixelArray again. This was unefficient and slow. Now we calculate the requested area
+        of the subEffect and ask the FilterEffect's ImageBuffer for the PixelArray directly,
+        without any drawing operations on GraphicsContext.
+
+        There is already a test case
+        Test: svg/W3C-SVG-1.1/filters-blend-01-b.svg
+
+        * html/canvas/CanvasPixelArray.h:
+        (WebCore::CanvasPixelArray::set):
+        (WebCore::CanvasPixelArray::get):
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::unknown):
+        (WebCore::normal):
+        (WebCore::multiply):
+        (WebCore::screen):
+        (WebCore::darken):
+        (WebCore::lighten):
+        (WebCore::FEBlend::apply):
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::calculateDrawingIntRect):
+        * platform/graphics/filters/FilterEffect.h:
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix array formatter followup: node formatter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28427
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._format):
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Metrics sidebar broken
+
+        https://bugs.webkit.org/show_bug.cgi?id=28434
+
+        * inspector/front-end/MetricsSidebarPane.js:
+
+2009-08-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28432
+        String::createCFString() returns a non-retained empty string
+
+        No known change in functionality, so no test.
+
+        * platform/text/cf/StringCF.cpp: (WebCore::String::createCFString): Retain the CFSTR result.
+    
+2009-08-18  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28326> DRT on Windows doesn't support 
+        LayoutTestController::setQuota or print a callback on UIDelegate::exceededDatabaseQuota.
+        
+        Removed an early return that can cause deleteOrigin or deleteAllDatabases to fail when
+        it doesn't have to.
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::deleteOrigin):
+
+2009-08-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27357
+        Support for :valid and :invalid CSS selectors, from HTML5 specs.
+        http://www.whatwg.org/specs/web-apps/current-work/#selector-valid
+
+        Tests: fast/css/pseudo-invalid-001.html
+               fast/css/pseudo-invalid-002.html
+               fast/css/pseudo-valid-001.html
+               fast/css/pseudo-valid-002.html
+               fast/css/pseudo-valid-003.html
+               fast/css/pseudo-valid-004.html
+               fast/css/pseudo-valid-005.html
+               fast/css/pseudo-valid-006.html
+               fast/css/pseudo-valid-007.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): extracts new pseudo-classes
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement): Make sure we don't share style between
+form controls that have different validity states.
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
+        style associated to new pseudo-classes
+        * dom/Element.h:
+        (WebCore::Element::willValidate): pushed up in hierarchy
+        (WebCore::Element::isValidFormControlElement): checks for valid form
+        control elements (wraps ValidityState::valid())
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::willValidate): minor clean up
+        (WebCore::HTMLFormControlElement::isValidFormControlElement): ditto
+        * html/HTMLFormControlElement.h:
+        * html/HTMLKeygenElement.h:
+        (WebCore::HTMLKeygenElement::willValidate): added
+        * html/HTMLObjectElement.h:
+        (WebCore::HTMLObjectElement::willValidate): added
+        * html/HTMLObjectElement.idl:
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix array formatter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28427
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray):
+
+2009-08-17  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos
+
+        Replace repeated string of PLATFORM(FOO) with a single define
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+
+2009-08-16  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20329, shadows and reflections incorrectly
+        considered part of scrollable overflow.
+
+        This patch takes the engine's concept of overflow and splits it into two types:
+        layout overflow and visual overflow.
+        
+        Layout overflow is about other boxes that spill out of an enclosing box,  For example,
+        in the inline flow case a tall image could spill out of a line box. Examples of 
+        visual overflow are shadows, text stroke (and eventually outline and
+        border-image).
+
+        Three objects tracked overflow before this patch: RenderBlock had 
+        m_overflowLeft/Top/Width/Height variables.  RootInlineBox had an Overflow*
+        that also had four overflow values.  Finally RenderReplaced elements tracked shadow/reflection
+        overflow using a map that cached four values.
+        
+        This patch takes all of these different overflow models and unifies them into a single
+        new class called RenderOverflow.   This class is now a member variable in RenderBox and
+        InlineFlowBoxes.  It is only allocated if overflow actually exists.  Instead of tracking
+        four values, it tracks eight: left/top/right/bottom for layout overflow and 
+        left/top/right/bottom for visual overflow.
+        
+        Overflow computation is now done after layout is finished rather than during layout
+        (when child objects can be churning and moving around).  A number of layout tests progressed
+        by deferring overflow computation to a separate pass.
+        
+        All inline flow boxes now track overflow (and not just the root line box).  This allows
+        repainting of line boxes to actually be tight and bail early if the overflow rect of a box
+        doesn't intersect.  The old code always visited all object on a line if the root line box
+        intersected at all.
+        
+        Line box overflow no longer propagates across self-painting layers.  This fixes a number of
+        issues with incorrect scrollbars appearing when relative positioned inlines were used in a page.
+        
+        Layer bounds have been modified to exclude visual overflow.  The width/height members only really
+        have one reason for continued existence, and that is that they happen to be used in repaint()
+        when an overflow clip object's height isn't accurate.  In this case, the bounds should exclude
+        visual overflow anyway, so this change tightens that repaint up.
+        
+        Root lines have renamed m_selectionTop/Bottom to m_lineTop/Bottom and positionForPoint methods have
+        been changed to use these instead of relying on overflow (which was totally wrong).
+
+        Significant changes have been made to the "almost strict mode" line box quirk where objects with no
+        text children have no effect on the height of a line.  Instead of making the height() of the objects
+        variable and dependent on overflow, the objects now have their full height and get placed on
+        the baseline properly.  They simply don't contribute to overflow above lineTop/Bottom.
+        
+        Reflections are no longer considered overflow of any kind.  Because reflections have their own layers,
+        it is not necessary to treat them as visual or layout overflow in the RenderObject tree.  The end result
+        of not incorporating them into RenderOverflow is that they have no effect on scrolling.  transparencyClipBox
+        has been extended to support fully reflecting the entire clip box when a reflection exists.  This fixes
+        numerous repaint bugs in transparent objects with reflections when the transparent objects had self-painting
+        sublayers.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::adjustViewSize):
+        (WebCore::FrameView::adjustPageHeight):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::height):
+        * rendering/InlineBox.h:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::adjustPosition):
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::InlineFlowBox):
+        (WebCore::InlineFlowBox::topCombinedOverflow):
+        (WebCore::InlineFlowBox::bottomCombinedOverflow):
+        (WebCore::InlineFlowBox::leftCombinedOverflow):
+        (WebCore::InlineFlowBox::rightCombinedOverflow):
+        (WebCore::InlineFlowBox::combinedOverflowRect):
+        (WebCore::InlineFlowBox::topLayoutOverflow):
+        (WebCore::InlineFlowBox::bottomLayoutOverflow):
+        (WebCore::InlineFlowBox::leftLayoutOverflow):
+        (WebCore::InlineFlowBox::rightLayoutOverflow):
+        (WebCore::InlineFlowBox::layoutOverflowRect):
+        (WebCore::InlineFlowBox::topVisualOverflow):
+        (WebCore::InlineFlowBox::bottomVisualOverflow):
+        (WebCore::InlineFlowBox::leftVisualOverflow):
+        (WebCore::InlineFlowBox::rightVisualOverflow):
+        (WebCore::InlineFlowBox::visualOverflowRect):
+        (WebCore::InlineFlowBox::setHorizontalOverflowPositions):
+        (WebCore::InlineFlowBox::setVerticalOverflowPositions):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        (WebCore::RenderBlock::layout):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::addOverflowFromBlockChildren):
+        (WebCore::RenderBlock::handleBottomOfBlock):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::fillInlineSelectionGaps):
+        (WebCore::RenderBlock::floatRect):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+        (WebCore::RenderBlock::layoutColumns):
+        (WebCore::getHeightForLineCount):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::computeVerticalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        (WebCore::RenderBlock::addOverflowFromInlineChildren):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::destroy):
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        (WebCore::RenderBox::localCaretRect):
+        (WebCore::RenderBox::addShadowAndReflectionOverflow):
+        (WebCore::RenderBox::addOverflowFromChild):
+        (WebCore::RenderBox::addLayoutOverflow):
+        (WebCore::RenderBox::addVisualOverflow):
+        (WebCore::RenderBox::clearLayoutOverflow):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::combinedOverflowRect):
+        (WebCore::RenderBox::topCombinedOverflow):
+        (WebCore::RenderBox::bottomCombinedOverflow):
+        (WebCore::RenderBox::leftCombinedOverflow):
+        (WebCore::RenderBox::rightCombinedOverflow):
+        (WebCore::RenderBox::layoutOverflowRect):
+        (WebCore::RenderBox::topLayoutOverflow):
+        (WebCore::RenderBox::bottomLayoutOverflow):
+        (WebCore::RenderBox::leftLayoutOverflow):
+        (WebCore::RenderBox::rightLayoutOverflow):
+        (WebCore::RenderBox::visualOverflowRect):
+        (WebCore::RenderBox::topVisualOverflow):
+        (WebCore::RenderBox::bottomVisualOverflow):
+        (WebCore::RenderBox::leftVisualOverflow):
+        (WebCore::RenderBox::rightVisualOverflow):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateRootLayerPosition):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::positionListMarker):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        * rendering/RenderObject.h:
+        * rendering/RenderOverflow.h: Added.
+        (WebCore::RenderOverflow::RenderOverflow):
+        (WebCore::RenderOverflow::topLayoutOverflow):
+        (WebCore::RenderOverflow::bottomLayoutOverflow):
+        (WebCore::RenderOverflow::leftLayoutOverflow):
+        (WebCore::RenderOverflow::rightLayoutOverflow):
+        (WebCore::RenderOverflow::topVisualOverflow):
+        (WebCore::RenderOverflow::bottomVisualOverflow):
+        (WebCore::RenderOverflow::leftVisualOverflow):
+        (WebCore::RenderOverflow::rightVisualOverflow):
+        (WebCore::RenderOverflow::setTopLayoutOverflow):
+        (WebCore::RenderOverflow::setBottomLayoutOverflow):
+        (WebCore::RenderOverflow::setLeftLayoutOverflow):
+        (WebCore::RenderOverflow::setRightLayoutOverflow):
+        (WebCore::RenderOverflow::setTopVisualOverflow):
+        (WebCore::RenderOverflow::setBottomVisualOverflow):
+        (WebCore::RenderOverflow::setLeftVisualOverflow):
+        (WebCore::RenderOverflow::setRightVisualOverflow):
+        (WebCore::RenderOverflow::layoutOverflowRect):
+        (WebCore::RenderOverflow::visualOverflowRect):
+        (WebCore::RenderOverflow::combinedOverflowRect):
+        (WebCore::RenderOverflow::move):
+        (WebCore::RenderOverflow::addLayoutOverflow):
+        (WebCore::RenderOverflow::addVisualOverflow):
+        (WebCore::RenderOverflow::resetLayoutOverflow):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::~RenderReplaced):
+        (WebCore::RenderReplaced::layout):
+        (WebCore::RenderReplaced::shouldPaint):
+        (WebCore::RenderReplaced::positionForPoint):
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::layout):
+        (WebCore::RenderScrollbarPart::paintIntoRect):
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::layout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderTableSection.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint):
+        (WebCore::RenderText::localCaretRect):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::addHighlightOverflow):
+        (WebCore::RootInlineBox::adjustPosition):
+        (WebCore::RootInlineBox::verticallyAlignBoxes):
+        (WebCore::RootInlineBox::selectionTop):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::RootInlineBox):
+        (WebCore::RootInlineBox::nextRootBox):
+        (WebCore::RootInlineBox::prevRootBox):
+        (WebCore::RootInlineBox::lineTop):
+        (WebCore::RootInlineBox::lineBottom):
+        (WebCore::RootInlineBox::selectionBottom):
+        (WebCore::RootInlineBox::selectionHeight):
+        (WebCore::RootInlineBox::floats):
+        (WebCore::RootInlineBox::floatsPtr):
+        (WebCore::RootInlineBox::setLineTopBottomPositions):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+
+2009-08-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28431
+        <rdar://problem/7137610> Application Cache doesn't work with HTTP authentication
+
+        Test: http/tests/appcache/auth.html
+
+        * loader/appcache/ApplicationCacheGroup.h:
+        (WebCore::ApplicationCacheGroup::shouldUseCredentialStorage): If appcache is enabled,
+        always allow it to use stored credentials (we can't ask WebKit client, and maybe we
+        shouldn't ask it, because it's not a document that's loading these resources).
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by John Sullivan and David Hyatt.
+
+        Fix <rdar://problem/7147996>
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        Update the style of the scroll bars.
+        
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::RenderScrollbar):
+        Calculate the size of the scrollbar and set it as the frame size.
+
+2009-08-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        HTMLMediaElement should fire 'progress' event before 'load'
+        https://bugs.webkit.org/show_bug.cgi?id=28314
+
+        Test: media/progress-event-at-least-one.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Schedule 'progress' event before 'load'.
+
+2009-08-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28415
+        Set svn:eol-style CRLF on all .sln and .vcproj files that don't already
+        have it.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Need to extend DumpRenderTree to expose number of worker threads
+        https://bugs.webkit.org/show_bug.cgi?id=28292
+
+        Expose WorkerThread::workerThreadCount() for DumpRenderTree so we can write worker lifecycle tests.
+
+        Tests: fast/workers/shared-worker-lifecycle.html-disabled
+               fast/workers/worker-lifecycle.html
+
+        * WebCore.base.exp:
+        Exported WorkerThread::workerThreadCount().
+        * WebCore.xcodeproj/project.pbxproj:
+        * workers/WorkerThread.cpp:
+        Added tracking of the number of worker threads.
+        (WebCore::threadCountMutex):
+        (WebCore::WorkerThread::workerThreadCount):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::~WorkerThread):
+        * workers/WorkerThread.h:
+
+2009-08-18  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed, build fix.
+
+        [Qt] Add new files I forgot to add in r47424.
+
+2009-08-18  Markus Goetz <Markus.Goetz@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Implement prefetchDNS() function.
+
+        * WebCore.pro:
+        * platform/qt/TemporaryLinkStubs.cpp:
+
+2009-08-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Support for parsing <datalist> element and generating HTMLDataListElement nodes.
+        https://bugs.webkit.org/show_bug.cgi?id=26915
+
+        Tests: fast/forms/datalist-nonoption-child.html
+               fast/forms/datalist.html
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/html.css:
+        * html/CollectionType.h:
+        (WebCore::):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::itemAfter):
+        * html/HTMLDataListElement.cpp: Added.
+        (WebCore::HTMLDataListElement::HTMLDataListElement):
+        (WebCore::HTMLDataListElement::~HTMLDataListElement):
+        (WebCore::HTMLDataListElement::checkDTD):
+        (WebCore::HTMLDataListElement::options):
+        * html/HTMLDataListElement.h: Added.
+        * html/HTMLDataListElement.idl: Added.
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::isAffectedByResidualStyle):
+        * html/HTMLTagNames.in:
+
+2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        -webkit-box-orient:horizontal doesn't work on <button> tag
+        https://bugs.webkit.org/show_bug.cgi?id=34445
+
+        Make a flexible button's anonymous child flexible and pass the
+        parent's box-orient to the anonymous child.
+
+        Also, added a renderName for anonymous flexible boxes.
+
+        Test: fast/flexbox/box-orient-button.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createAnonymousBlock):
+        * rendering/RenderBlock.h:
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::addChild):
+        (WebCore::RenderButton::setupInnerStyle):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::renderName):
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        Render -webkit-mask via compositing layers when possible
+        https://bugs.webkit.org/show_bug.cgi?id=28414
+        
+        Implement accelerated compositing of -webkit-mask, when combined
+        with already-composited content.
+        
+        RenderLayerBacking now creates an additional GraphicsLayer for the mask contents,
+        and sets this as the mask on another GraphicsLayer via the setMaskLayer() method.
+        GraphicsLayerCA then applies the mask using -[CALayer setMask:].
+        
+        The enum values for GraphicsLayerPaintingPhase were renamed to avoid the
+        confusion with "mask", and a new value, GraphicsLayerPaintMask, was added which
+        indicates that just the mask is painting.
+        
+        When painting the composited mask, we need to paint with the normal compositing
+        mode rather than CompositeDestinationIn, so InlineFlowBox and RenderBox now consult
+        layer()->hasCompositedMask() to pick the mode. If the mask is composited, they no longer
+        need to make transparency layers.
+        
+        We no longer have to throw video rendering into software because of masks.
+        
+        When a masked element has composited descendants, that element needs to
+        become composited so that the mask can be applied via compositing.
+
+        Tests: compositing/masks/masked-ancestor.html
+               compositing/masks/simple-composited-mask.html
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::maskLayer):
+        (WebCore::GraphicsLayer::setMaskLayer):
+        (WebCore::GraphicsLayer::paintingPhase):
+        (WebCore::GraphicsLayer::setPaintingPhase):
+        * platform/graphics/GraphicsLayerClient.h:
+        (WebCore::):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setMaskLayer):
+        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        (WebCore::GraphicsLayerCA::updateMaskLayer):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintMaskImages):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hasCompositedMask):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasCompositedMask):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::~RenderLayerBacking):
+        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        (WebCore::RenderLayerBacking::updateMaskLayer):
+        (WebCore::RenderLayerBacking::paintingPhaseForPrimaryLayer):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        (WebCore::RenderLayerBacking::hasMaskLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing):
+        * rendering/RenderLayerCompositor.h:
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Layer content misplaced with compositing, z-index and overflow
+        https://bugs.webkit.org/show_bug.cgi?id=28361
+        
+        The foreground GraphicsLayer (used to render element foreground when the element has 
+        negative z-order children) was misplaced when there is a clipping layer (which clips
+        children). The foreground layer is parented under the clipping layer so that the foreground
+        depth-sorts with the layer's children, so its geometry needs to be computed relative to
+        that clipping layer.
+        
+        Also clarified some FIXME comments, and corrected a debug-only layer name.
+
+        Test: compositing/geometry/clipping-foreground.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+
+2009-08-17  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix leaks of SVGElementInstance seen during regression tests.
+
+        r47313 made TreeShared types start with a ref-count of 1, but SVGElementInstance was mistakenly
+        not updated to have a create method that adopted the initial reference.  This lead to the instances
+        of SVGElementInstance allocated by SVGUseElement being leaked.
+
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::create):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildPendingResource):
+        (WebCore::SVGUseElement::buildInstanceTree):
+        (WebCore::SVGUseElement::handleDeepUseReferencing):
+
+2009-08-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Some cleanup towards https://bugs.webkit.org/show_bug.cgi?id=13631
+        Page Cache should support pages with frames.
+
+        - Re-factor all remaining page cache code out of DocumentLoader, as CachedPage/CacheFrame loads
+          are solely the responsibility of FrameLoader.
+        - Enhance some page cache related Logging to help development.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::identifierForInitialRequest):
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        * loader/DocumentLoader.h:
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::isLoadingFromCachedPage):
+
+2009-08-17  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Moved implementation of isAfterContent to RenderObject
+        (as inline method to avoid potential performance regressions).
+
+        BUG 28376 -  [Cleanup] isAfterContent() implemented twice, should be member of RenderObject
+        (https://bugs.webkit.org/show_bug.cgi?id=28376)
+
+        * rendering/RenderBox.cpp:
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isAfterContent):
+
+2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Assertion failure in WebCore::RenderHTMLCanvas::layout
+        https://bugs.webkit.org/show_bug.cgi?id=12052
+
+        Don't handle run-in if the element is not a block element.
+
+        Test: fast/runin/nonblock-runin.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+
+2009-08-17  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fix createImageData to raise the NOT_SUPPORTED_ERR exception when
+        either of the arguments are not finite.
+
+        According to
+        http://www.whatwg.org/specs/web-apps/current-work/#pixel-manipulation:
+        "If any of the arguments to createImageData() or getImageData() are
+        infinite or NaN, or if the createImageData()  method is invoked with
+        only one argument but that argument is null, the method must instead
+        raise a NOT_SUPPORTED_ERR  exception."
+
+        Test: http://philip.html5.org/tests/canvas/suite/tests/2d.imageData.create.nonfinite.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::createImageData):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * html/canvas/CanvasRenderingContext2D.idl:
+
+2009-08-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Add a way to release the storage lock
+        https://bugs.webkit.org/show_bug.cgi?id=28411
+
+        Two scripts within the same origin that are accessing LocalStorage must not do
+        it simultaneously, according to the spec.  There are some cases, however, where
+        a script might want to override this behavior.  navigator.getStorageUpdates()
+        was added for this reason:
+        http://dev.w3.org/html5/spec/Overview.html#manually-releasing-the-storage-mutex
+
+        Add this function to navigator and hook it up to DOM Storage.
+
+        * page/Navigator.cpp:
+        (WebCore::Navigator::getStorageUpdates):
+        * page/Navigator.h:
+        * page/Navigator.idl:
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::unlock):
+        * storage/StorageNamespaceImpl.h:
+
+2009-08-17  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        CFNetwork isn't present in the framework search path on Mac OS X so we can't directly include its headers.
+        We include CoreServices.h, the umbrella framework that contains CFNetwork, from the prefix header which
+        results in the CFNetwork headers being included on Mac OS X.  CoreServices.h doesn't include CFNetwork.h on
+        Windows though so we explicitly include this header from the prefix header when on Windows.
+
+        * WebCorePrefix.h:
+        * platform/network/cf/DNSCFNet.cpp: Remove #include that is no longer needed.
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Trying a better build fix (the previous one broke Leopard bots, although it did build for me).
+
+        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFNetwork.h instead.
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Trying to fix Windows build.
+
+        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFHost.h.
+
+2009-08-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28401
+        Add support for DNS prefetching with CFNetwork
+
+        This is just an optimization, no behavior change, so no tests.
+
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::clientCallback):
+        (WebCore::prefetchDNS):
+        Use async CFHostStartInfoResolution() for implementation.
+
+2009-08-17  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28313: Combine ThreadableLoaderOptions::crossOriginRequestPolicy and
+        ThreadableLoaderOptions::crossOriginRedirectPolicy since they are always set the same way.
+
+        Also, tightened up behavior of XMLHttpRequest with cross-origin redirects and access control. We have not implemented
+        redirects access control, so we should never redirect across origins. But in two edge cases, we were:
+
+        * Asynchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
+          authorization headers) to a resource on origin A.
+        * Synchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
+          authorization headers) to another resource on origin B (this time sending access control authorization headers).
+
+        Test: http/tests/xmlhttprequest/access-control-and-redirects.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::willSendRequest): Refactor redirect checking code into shared location.
+        (WebCore::DocumentThreadableLoader::loadRequest): Ditto.
+        (WebCore::DocumentThreadableLoader::isAllowedRedirect): Ditto.
+        * loader/DocumentThreadableLoader.h:
+        * loader/ThreadableLoader.h:
+        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Remove ThreadableLoaderOptions::crossOriginRedirectPolicy.
+        * page/EventSource.cpp:
+        (WebCore::EventSource::connect): Ditto.
+        * workers/Worker.cpp: Ditto.
+        (WebCore::Worker::Worker): Ditto.
+        * workers/WorkerContext.cpp: Ditto.
+        (WebCore::WorkerContext::importScripts): Ditto.
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously): Ditto.
+        (WebCore::WorkerScriptLoader::loadAsynchronously): Ditto.
+        * workers/WorkerScriptLoader.h: 
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::createRequest): Ditto.
+
+2009-08-17  Adam Langley  <agl@google.com>
+
+        Reviewed by Dan Bernstein (relanding of r47157).
+
+        Fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28172
+
+        This was originally fixed in r47157, however it triggered a bug in
+        Skia which caused Chromium Linux to fail layout tests in debug mode.
+        It was reverted in r47189 while we sorted it out.
+
+        The Skia bug was fixed in Skia's r321 [1] and rolled into Chromium in
+        Chromium's r23523. This is a reland of the original patch.
+
+        No new tests because it's a just typo fix.
+
+        [1] http://code.google.com/p/skia/source/detail?r=321
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Protect ResourceHandle for g_file_query_info_async call, using the
+        same technique we already use for HTTP requests that take the soup
+        path.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::finishedCallback):
+        (WebCore::):
+
+2009-08-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r47255): MediaWiki's (including Wikipedia) navigation pane
+        appears below the main content
+        https://bugs.webkit.org/show_bug.cgi?id=28350
+
+        A particular version of the MediaWiki software detects WebKit through
+        user agent sniffing and imports a style sheet called KHTMLFixes.css,
+        which contains a single rule that was meant to work around some KHTML
+        bug, but currently has the sole effect of causing the float containing
+        the main article content to extend all the way to the left and thus push
+        down the left navigation pane.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet): If site specific hacks are
+        enabled, check if the imported style sheet is the MediaWiki
+        KHTMLFixes.css. If so, remove the offending rule.
+
+2009-08-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Kevin Ollivier.
+
+        Correct crash when processing local cancelled requests.
+
+        No new tests. Existing fast/images/favicon-as-image.html
+        displays the problem.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::writeCallback): Add check for m_cancelled after
+          performing local-file processing.
+        (WebCore::ResourceHandleManager::downloadTimerCallback): Add
+          check for m_cancelled after performing local-file processing.
+
+2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Reverts 47371, since it breaks GTK+.
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp: Removed.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2009-08-17  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Allow image decoders to down-sample the image directly
+        to scaled output buffer. This can be enabled/disabled by
+        macro ENABLE(IMAGE_DECODER_DOWN_SAMPLING).
+        Only JPEG and PNG decoders are modified to support it now.
+        https://bugs.webkit.org/show_bug.cgi?id=28308
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp: Added.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::setMaxNumPixels):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::setSize):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix: fix float literals to avoid casting warnings.
+
+        * rendering/MediaControlElements.cpp:
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Use OwnPtrs for GraphicsLayers
+        https://bugs.webkit.org/show_bug.cgi?id=28399
+
+        Convert RenderLayerBacking and RenderLayerCompositor to use OwnPtrs
+        for their references to GraphicsLayers.
+
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayer::create):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        (WebCore::RenderLayerBacking::createGraphicsLayer):
+        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateInternalHierarchy):
+        (WebCore::RenderLayerBacking::updateClippingLayers):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+        * rendering/RenderLayerBacking.h:
+        (WebCore::RenderLayerBacking::graphicsLayer):
+        (WebCore::RenderLayerBacking::clippingLayer):
+        (WebCore::RenderLayerBacking::ancestorClippingLayer):
+        (WebCore::RenderLayerBacking::foregroundLayer):
+        (WebCore::RenderLayerBacking::parentForSublayers):
+        (WebCore::RenderLayerBacking::childForSuperlayers):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::~RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::rootPlatformLayer):
+        (WebCore::RenderLayerCompositor::didMoveOnscreen):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
+        * rendering/RenderLayerCompositor.h:
+
+2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Reset InjectedScript styles cache on document change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28390
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::resetInjectedScript):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._reset):
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * rendering/MediaControlElements.cpp: Removed unneeded include of CString.h,
+        resorted includes, renamed "doc" to "document" and fixed formatting.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed functions now unneeded due to use of Reflect to create
+        language bindings.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+        Get at usemap attribute directly.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+        Get at id attribute directly.
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertHorizontalRule): Ditto.
+
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::dir): Get at dir attribute of body directly.
+        (WebCore::HTMLDocument::setDir): Ditto.
+
+        * html/HTMLElement.cpp: Deleted unused functions.
+        * html/HTMLElement.h: Ditto.
+
+        * html/HTMLImageElement.cpp: Deleted unused functions.
+        (WebCore::HTMLImageElement::alt): Changed to return const AtomicString&.
+        (WebCore::HTMLImageElement::addSubresourceAttributeURLs): Changed to
+        get at usemap attribute directly, but added a FIXME because although
+        it is what the old code did, it looks to not be entirely correct.
+
+        * html/HTMLImageElement.h: Deleted unused functions.
+
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::altDisplayString): Get at alt attribute directly.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageMap): Get at usemap attribute directly.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer): Get at id attribute
+        directly.
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): Removed
+        explicit HTMLNames namespace qualification.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode): Removed unneeded calls
+        to RefPtr::get.
+
+2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Discard DOM Node bindings on any document change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28389
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+
+2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Improve Cookie DataGrid to Show Hidden Data
+        https://bugs.webkit.org/show_bug.cgi?id=28269
+
+        * English.lproj/localizedStrings.js: DataGrid Headers "Name", "Value", "Size", ...
+        * WebCore.gypi: added missing files
+
+          Implemented Bindings for InspectorController.deleteCookie(name)
+
+        * inspector/InspectorBackend.idl:
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        (WebCore::JSInspectorBackend::deleteCookie):
+
+          v8 Bindings Stubs
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+          Removed WebInspector.Cookie
+
+        * inspector/front-end/Cookie.js: Removed.
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/WebKit.qrc:
+
+          Improved DataGrid and Kept Fallback Behavior for Platforms that don't
+          yet provide access to raw cookies.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.buildCookies):
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
+        (WebInspector.CookieItemsView.prototype.fallbackUpdate.callback):
+        (WebInspector.CookieItemsView.prototype.fallbackUpdate):
+        (WebInspector.CookieItemsView.prototype.fallbackBuildCookiesFromString):
+        (WebInspector.CookieItemsView.prototype.fallbackDataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+
+          Interaction with the page through Injected Script (for fallback behavior)
+
+        * inspector/front-end/DOMAgent.js:
+        (InspectorController.getCookies):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.setStyleProperty): style fix
+        (InjectedScript.getCookies):
+
+          Allow alignment of text inside DataGrids.
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGridNode.prototype.createCell):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
+        * inspector/front-end/inspector.css:
+
+          Added deleteCookie(., ., String name)
+          Modified getRawCookies to return a bool to know if its implemented
+
+        * platform/CookieJar.h:
+
+
+          Implemented deleteCookie for Macs
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+          Stub Implementations for Other Platforms
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+2009-08-17  Adam Treat  <adam.treat@torchmobile.com>
+
+        Blind build fix for Leopard.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::adjustLineToPixelBoundaries):
+
+2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContextCG.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+        (WebCore::GraphicsContext::setPlatformTextDrawingMode):
+        (WebCore::GraphicsContext::setCompositeOperation):
+
+2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContext.cpp/h, GraphicsContextCairo.cpp and GraphicsContextQt.cpp.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::save):
+        (WebCore::GraphicsContext::restore):
+        (GraphicsContext::drawText):
+        (GraphicsContext::initFocusRing):
+        (GraphicsContext::focusRingBoundingRect):
+        (GraphicsContext::drawImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::toCairoOperator):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Change HTMLAreaElement to use OwnArrayPtr
+        https://bugs.webkit.org/show_bug.cgi?id=28386
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::HTMLAreaElement): Removed unneeded initializer.
+        (WebCore::HTMLAreaElement::~HTMLAreaElement): Removed unneeded delete call.
+        (WebCore::HTMLAreaElement::parseMappedAttribute): Use the set function
+        instead of deletion followed by assignment.
+        * html/HTMLAreaElement.h: Use OwnArrayPtr.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Fix Windows build.
+
+        * dom/make_names.pl: Add back cast to (void*) needed on Windows.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Move noResize from HTMLFrameElementBase to HTMLFrameElement
+        https://bugs.webkit.org/show_bug.cgi?id=28384
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::HTMLFrameElement): Initialize m_noResize.
+        (WebCore::HTMLFrameElement::parseMappedAttribute): Set m_noResize to true
+        here if noresizeAttr is changed. This code was moved here from
+        HTMLFrameElementBase, but I added some FIXME comments.
+        (WebCore::HTMLFrameElement::setNoResize): Set the attribute based on
+        boolean argument. Moved here from HTMLFrameElementBase.
+
+        * html/HTMLFrameElement.h: Moved noResize, setNoResize, and m_noResize
+        here from HTMLFrameElementBase.
+
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase): Removed m_noResize.
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Removed code to parse
+        noresizeAttr.
+
+        * html/HTMLFrameElementBase.h: Removed noResize, setNoResize, and m_noResize.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Tweak HTMLFrameElementBase so that m_URL can be private
+        https://bugs.webkit.org/show_bug.cgi?id=28385
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::rendererIsNeeded): Removed m_URL argument.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::isURLAllowed): Use m_URL instead of
+        taking an argument.
+        (WebCore::HTMLFrameElementBase::openURL): Removed m_URL argument.
+        * html/HTMLFrameElementBase.h: Removed argument from isURLAllowed function.
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::rendererIsNeeded): Removed m_URL argument.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        HTMLViewSourceDocument should use smart pointers
+        https://bugs.webkit.org/show_bug.cgi?id=28378
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::HTMLViewSourceDocument): Don't initialize
+        pointers any more since RefPtr starts 0 by default.
+        (WebCore::HTMLViewSourceDocument::createContainingTable): Use more specific
+        types for local variables.
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Return a PassRefPtr,
+        and use a RefPtr of a more specific type for a local variable.
+        (WebCore::HTMLViewSourceDocument::addLine): Use more specific types for local
+        variables, and use RefPtr as well.
+        (WebCore::HTMLViewSourceDocument::addLink): Return a PassRefPtr, and use a
+        RefPtr of a more specific type for a local variable.
+
+        * html/HTMLViewSourceDocument.h: Change return types to PassRefPtr and
+        data member types to RefPtr.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        DOM attribute getter/setter functions should use const AtomicString& type
+        https://bugs.webkit.org/show_bug.cgi?id=25425
+
+        Convert 4 more classes. These are classes I am going to make other changes
+        to soon, so it's good to have this use of Reflect in the IDL out of the way.
+
+        * html/HTMLEmbedElement.idl: Use Reflect for many attributes.
+        * html/HTMLFrameElement.idl: Ditto.
+        * html/HTMLIFrameElement.idl: Ditto.
+        * html/HTMLObjectElement.idl: Ditto.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Script to create element factory needs changes to accommodate calling create
+        https://bugs.webkit.org/show_bug.cgi?id=28379
+
+        * dom/make_names.pl: Tweak formatting. Remove lots of unneeded quotes
+        around names used inside {}. Added new createWithNew property for tags
+        that makes the factory use a create function instead of calling new.
+        Renamed functions with initialize in their name to have default in their
+        name, since they return an array full of default values and don't themselves
+        initialize anything.
+
+2009-08-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        StyledElement should use ASCIICType instead of having its own toHex function
+        https://bugs.webkit.org/show_bug.cgi?id=28377
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::addCSSColor): Use isASCIIHexDigit and toASCIIHexValue.
+
+2009-08-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        execCommand("InsertHorizontalRule") inserts a broken <hr> element
+        https://bugs.webkit.org/show_bug.cgi?id=28375
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertHorizontalRule): Create an HTMLHRElement
+        instead of just an HTMLElement.
+
+2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] <option> element & 'onpick' events - history navigation is broken
+        https://bugs.webkit.org/show_bug.cgi?id=28371
+
+        After selecting an option element with an 'onpick' event associated with a 'go' task,
+        the navigation is executed. When going back in history, the same 'onpick' event is fired
+        again. Fix that problem, add wml/option-element-onpick-recursion.html covering the bug.
+
+        Test: wml/option-element-onpick-recursion.html
+
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLSelectElement.cpp:
+        (WebCore::WMLSelectElement::WMLSelectElement):
+        (WebCore::WMLSelectElement::selectInitialOptions):
+        * wml/WMLSelectElement.h:
+        (WebCore::WMLSelectElement::initialized):
+
+2009-08-16  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Resource filtering: keyboard Navigation always uses ALL resources
+        https://bugs.webkit.org/show_bug.cgi?id=28231
+        
+        Determine if a resource is selectable on user action.
+        
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable):
+
+2009-08-16  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28355> Replace MAX()/MIN() macros with type-safe std::max()/min() templates
+
+        Reviewed by Dan Bernstein.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (AXAttributeStringSetSpelling): Changed MIN() to min().
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::Font::selectionRectForComplexText): Changed MAX() to
+        max() and MIN() to min().
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        * platform/graphics/mac/SimpleFontDataMac.mm: Added using
+        std::max statement.
+        (WebCore::SimpleFontData::platformInit): Changed MAX() to max().
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::TextCodecMac::decode): Changed MIN() to min().
+
+2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Cleanup WMLIntrinsicEventHandling code
+        https://bugs.webkit.org/show_bug.cgi?id=28358
+
+        Remove superflous "Event* evt" parameter from executeTask() methods. It's a leftover from the initial WML merge.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::defaultEventHandler):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::defaultEventHandler):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLGoElement.h:
+        * wml/WMLIntrinsicEventHandler.cpp:
+        (WebCore::WMLIntrinsicEventHandler::triggerIntrinsicEvent):
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLPrevElement.h:
+        * wml/WMLRefreshElement.cpp:
+        (WebCore::WMLRefreshElement::executeTask):
+        * wml/WMLRefreshElement.h:
+        * wml/WMLTaskElement.h:
+
+2009-08-16  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: A handful of DOMAgent-related fixes and cleanups.
+
+        - renamed elementId to nodeId in operations on nodes.
+        - added load listeners to frame owners in InspectorDOMAgent.
+        - removed InspectorController::inspectedWindowScriptObjectCleared event.
+        - preserved isViaInspector flag for 'via inspector' marker to survive styles update.
+        - removed contentDocument-related logic from ElementsPanel since it is handled in
+            the InspectorDOMAgent.
+        - removed DOM listeners unregistration and corresponding events from InspectorController.
+        - made this.styles 'private' in ElementsPanel.
+        - added TODO for the handleCopy processing.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28356
+
+        * WebCore.order:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::getChildNodes):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::setTextNodeValue):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        (WebCore::InspectorDOMAgent::innerParentNode):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMDocument.prototype.addEventListener):
+        (WebInspector.DOMDocument.prototype.removeEventListener):
+        (WebInspector.DOMDocument.prototype._fireDomEvent):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync.mycallback):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype._setChildNodes):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        (WebInspector.childNodeInserted):
+        (WebInspector.childNodeRemoved):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.addStyleChange):
+        (WebInspector.ElementsPanel.prototype.removeStyleChange):
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set rootDOMNode):
+        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        (WebInspector.ElementsTreeElement.prototype.onexpand):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.addStyleSelector):
+        (InjectedScript._serializeRule):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        * inspector/front-end/inspector.js:
+        (WebInspector.set hoveredDOMNode):
+        * inspector/front-end/treeoutline.js:
+        (TreeOutline.prototype.findTreeElement):
+        * inspector/front-end/utilities.js:
+        (Node.prototype.enclosingNodeOrSelfWithNodeNameInArray):
+        (Node.prototype.enclosingNodeOrSelfWithClass):
+        (isAncestorNode):
+        (firstCommonNodeAncestor):
+        (traverseNextNode):
+        (traversePreviousNode):
+        ():
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * page/android/InspectorControllerAndroid.cpp:
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Optimize updateFillImages() to not add/remove clients every time
+        https://bugs.webkit.org/show_bug.cgi?id=28334
+
+        Optimize the case where old and new just have a single layer pointing to the same (or no)
+        image.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateFillImages):
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Implement animations of multiple text-shadows and -webkit-box-shadows.
+        https://bugs.webkit.org/show_bug.cgi?id=28266
+        
+        Test: transitions/multiple-shadow-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperShadow::equals):
+        (WebCore::PropertyWrapperShadow::blend):
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Make transitions work for position and size of multiple backgrounds and masks.
+        https://bugs.webkit.org/show_bug.cgi?id=28266
+        
+        Make background-position, background-size, -webkit-mask-position and -webkit-mask-size
+        properties animatable with multiple backgrounds, rather than just animating the first one.
+
+        Tests: transitions/multiple-background-size-transitions.html
+               transitions/multiple-background-transitions.html
+               transitions/multiple-mask-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayerPropertyWrapperBase::FillLayerPropertyWrapperBase):
+        (WebCore::FillLayerPropertyWrapperBase::~FillLayerPropertyWrapperBase):
+        (WebCore::FillLayerPropertyWrapperGetter::FillLayerPropertyWrapperGetter):
+        (WebCore::FillLayerPropertyWrapperGetter::equals):
+        (WebCore::FillLayerPropertyWrapper::FillLayerPropertyWrapper):
+        (WebCore::FillLayerPropertyWrapper::blend):
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        (WebCore::FillLayersPropertyWrapper::equals):
+        (WebCore::FillLayersPropertyWrapper::blend):
+        (WebCore::ensurePropertyMap):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillLayer::setXPosition):
+        (WebCore::FillLayer::setYPosition):
+        (WebCore::FillLayer::setSize):
+
+2009-08-15  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Jan Alonzo.
+
+        Don't crash in fieldset code when WML is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=28012
+
+        Test: fast/wml/html-fieldset-crash.html
+
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::findLegend): ++brackets
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Try and enable EventSource on Windows.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Setting attribute event listeners to the body does not set them on the window
+        https://bugs.webkit.org/show_bug.cgi?id=28343
+
+        Tests: fast/dom/Window/HTMLBodyElement-window-eventListener-attributes.html
+               fast/dom/Window/HTMLFrameSetElement-window-eventListener-attributes.html
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::setOnblur): Use setWindowAttributeEventListener instead of setAttributeEventListener.
+        (WebCore::HTMLBodyElement::setOnerror): Ditto.
+        (WebCore::HTMLBodyElement::setOnfocus): Ditto.
+        (WebCore::HTMLBodyElement::setOnload): Ditto.
+        (WebCore::HTMLBodyElement::setOnbeforeunload): Ditto.
+        (WebCore::HTMLBodyElement::setOnmessage): Ditto.
+        (WebCore::HTMLBodyElement::setOnoffline): Ditto.
+        (WebCore::HTMLBodyElement::setOnonline): Ditto.
+        (WebCore::HTMLBodyElement::setOnresize): Ditto.
+        (WebCore::HTMLBodyElement::setOnstorage): Ditto.
+        (WebCore::HTMLBodyElement::setOnunload): Ditto.
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::setOnblur): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnerror): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnfocus): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnload): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnbeforeunload): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnmessage): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnoffline): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnonline): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnresize): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnstorage): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnunload): Ditto.
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix up some IDL comments.
+
+        * html/HTMLBodyElement.idl:
+        * html/HTMLFrameSetElement.idl:
+
+2009-08-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Sam Weinig.
+
+        Added implementation of the EventSource object that enables
+        server-sent events from HTML5.
+        http://dev.w3.org/html5/eventsource/
+        https://bugs.webkit.org/show_bug.cgi?id=14997
+
+        Tests: fast/eventsource/eventsource-attribute-listeners.html
+               fast/eventsource/eventsource-constructor.html
+               http/tests/eventsource/eventsource-bad-mime-type.html
+               http/tests/eventsource/eventsource-parse-event-stream.html
+               http/tests/eventsource/eventsource-reconnect.html
+               http/tests/eventsource/eventsource-status-code-states.html
+               http/tests/eventsource/workers/eventsource-simple.html
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::eventSource):
+        * bindings/js/JSEventSourceConstructor.cpp: Added.
+        (WebCore::):
+        (WebCore::JSEventSourceConstructor::JSEventSourceConstructor):
+        (WebCore::constructEventSource):
+        (WebCore::JSEventSourceConstructor::getConstructData):
+        * bindings/js/JSEventSourceConstructor.h: Added.
+        (WebCore::JSEventSourceConstructor::classInfo):
+        * bindings/js/JSEventSourceCustom.cpp: Added.
+        (WebCore::JSEventSource::markChildren):
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::eventSource):
+        * dom/EventNames.h:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toEventSource):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * page/EventSource.cpp: Added.
+        (WebCore::EventSource::EventSource):
+        (WebCore::EventSource::~EventSource):
+        (WebCore::EventSource::connect):
+        (WebCore::EventSource::endRequest):
+        (WebCore::EventSource::scheduleReconnect):
+        (WebCore::EventSource::reconnectTimerFired):
+        (WebCore::EventSource::url):
+        (WebCore::EventSource::readyState):
+        (WebCore::EventSource::close):
+        (WebCore::EventSource::scriptExecutionContext):
+        (WebCore::EventSource::addEventListener):
+        (WebCore::EventSource::removeEventListener):
+        (WebCore::EventSource::dispatchEvent):
+        (WebCore::EventSource::didReceiveResponse):
+        (WebCore::EventSource::didReceiveData):
+        (WebCore::EventSource::didFinishLoading):
+        (WebCore::EventSource::didFail):
+        (WebCore::EventSource::didFailRedirectCheck):
+        (WebCore::EventSource::parseEventStream):
+        (WebCore::EventSource::parseEventStreamLine):
+        (WebCore::EventSource::dispatchGenericEvent):
+        (WebCore::EventSource::dispatchMessageEvent):
+        (WebCore::EventSource::stop):
+        * page/EventSource.h: Added.
+        (WebCore::EventSource::create):
+        (WebCore::EventSource::):
+        (WebCore::EventSource::setOnopen):
+        (WebCore::EventSource::onopen):
+        (WebCore::EventSource::setOnmessage):
+        (WebCore::EventSource::onmessage):
+        (WebCore::EventSource::setOnerror):
+        (WebCore::EventSource::onerror):
+        (WebCore::EventSource::toEventSource):
+        (WebCore::EventSource::eventListeners):
+        (WebCore::EventSource::refEventTarget):
+        (WebCore::EventSource::derefEventTarget):
+        * page/EventSource.idl: Added.
+        * workers/WorkerContext.idl:
+
+2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Minor DOMAgent bugfixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28177
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::nodeForId):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+
+2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Evaluating objects while on a breakpoint dumps string
+        representation instead of live object. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=28280
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions.this._evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame.delayedEvaluation):
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
+
+2009-08-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding two new files to WebCore/platform/haiku:
+        LocalizedStringsHaiku.cpp and LoggingHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28129
+
+        * platform/haiku/LocalizedStringsHaiku.cpp: Added.
+        (WebCore::submitButtonDefaultLabel):
+        (WebCore::inputElementAltText):
+        (WebCore::resetButtonDefaultLabel):
+        (WebCore::defaultLanguage):
+        (WebCore::searchableIndexIntroduction):
+        (WebCore::fileButtonChooseFileLabel):
+        (WebCore::fileButtonNoFileSelectedLabel):
+        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
+        (WebCore::contextMenuItemTagDownloadLinkToDisk):
+        (WebCore::contextMenuItemTagCopyLinkToClipboard):
+        (WebCore::contextMenuItemTagOpenImageInNewWindow):
+        (WebCore::contextMenuItemTagDownloadImageToDisk):
+        (WebCore::contextMenuItemTagCopyImageToClipboard):
+        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
+        (WebCore::contextMenuItemTagCopy):
+        (WebCore::contextMenuItemTagGoBack):
+        (WebCore::contextMenuItemTagGoForward):
+        (WebCore::contextMenuItemTagStop):
+        (WebCore::contextMenuItemTagReload):
+        (WebCore::contextMenuItemTagCut):
+        (WebCore::contextMenuItemTagPaste):
+        (WebCore::contextMenuItemTagNoGuessesFound):
+        (WebCore::contextMenuItemTagIgnoreSpelling):
+        (WebCore::contextMenuItemTagLearnSpelling):
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::contextMenuItemTagOpenLink):
+        (WebCore::contextMenuItemTagIgnoreGrammar):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckSpelling):
+        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagFontMenu):
+        (WebCore::contextMenuItemTagBold):
+        (WebCore::contextMenuItemTagItalic):
+        (WebCore::contextMenuItemTagUnderline):
+        (WebCore::contextMenuItemTagOutline):
+        (WebCore::contextMenuItemTagWritingDirectionMenu):
+        (WebCore::contextMenuItemTagDefaultDirection):
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+        (WebCore::contextMenuItemTagInspectElement):
+        (WebCore::searchMenuNoRecentSearchesText):
+        (WebCore::searchMenuRecentSearchesText):
+        (WebCore::searchMenuClearRecentSearchesText):
+        (WebCore::unknownFileSizeText):
+        (WebCore::AXWebAreaText):
+        (WebCore::AXLinkText):
+        (WebCore::AXListMarkerText):
+        (WebCore::AXImageMapText):
+        (WebCore::AXHeadingText):
+        (WebCore::imageTitle):
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+        (WebCore::AXButtonActionVerb):
+        (WebCore::AXTextFieldActionVerb):
+        (WebCore::AXRadioButtonActionVerb):
+        (WebCore::AXCheckedCheckBoxActionVerb):
+        (WebCore::AXUncheckedCheckBoxActionVerb):
+        (WebCore::AXLinkActionVerb):
+        (WebCore::AXDefinitionListTermText):
+        (WebCore::AXDefinitionListDefinitionText):
+        * platform/haiku/LoggingHaiku.cpp: Added.
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+
+2009-08-15  Darin Adler  <darin@apple.com>
+
+        Fix GTK build.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (fallbackObject): Pass 0 for document. Should be OK at least for now.
+
+2009-08-15  Darin Adler  <darin@apple.com>
+
+        Fix Qt build.
+
+        * dom/XMLTokenizerQt.cpp: Use create functions instead of calling new
+        directly to make CDATASection and Comment nodes.
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make DOM classes start with a reference count of 1, like all other RefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=28068
+
+        First half, everything except for element classes.
+
+        * GNUmakefile.am: Removed DocPtr.h.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+        * dom/Attr.cpp:
+        (WebCore::Attr::Attr): Added a call to createTextChild here so callers don't
+        have to call it explicitly.
+        (WebCore::Attr::create): Added.
+        (WebCore::Attr::setValue): Changed to take AtomicString.
+        (WebCore::Attr::cloneNode): Use create.
+
+        * dom/Attr.h: Added a create function. Made the constructor private,
+        and a lot of other functions private as well.
+
+        * dom/Attribute.cpp:
+        (WebCore::Attribute::createAttrIfNeeded): Use Attr::create.
+
+        * dom/CDATASection.cpp:
+        (WebCore::CDATASection::create): Added.
+        (WebCore::CDATASection::cloneNode): Use create.
+        (WebCore::CDATASection::virtualCreate): Ditto.
+
+        * dom/CDATASection.h: Added a create function. Made everything private.
+        Removed unneeded destructor declaration.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::CharacterData): Replaced the multiple constructors
+        with a single one that takes ConstructionType.
+
+        * dom/CharacterData.h: Made more functions be protected and private.
+        Made m_data be private.
+
+        * dom/Comment.cpp:
+        (WebCore::Comment::Comment): Got rid of an extra constructor.
+        (WebCore::Comment::create): Added.
+        (WebCore::Comment::cloneNode): Call create.
+
+        * dom/Comment.h: Added a create function. Made everything private.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::dispatchChildInsertionEvents): Use RefPtr instead of DocPtr.
+        (WebCore::dispatchChildRemovalEvents): Ditto.
+
+        * dom/ContainerNode.h: Made the constructor protected and passed
+        ConstructionType instead of an isElement boolean.
+
+        * dom/DocPtr.h: Removed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Simplified the code that sets m_document
+        since it's no longer a smart pointer.
+        (WebCore::Document::removedLastRef): Use explicit calls to selfOnlyRef
+        and selfOnlyDeref instead of a DocPtr in here.
+        (WebCore::Document::~Document): Simplified the code that sets m_document
+        since it's no longer a smart pointer.
+        (WebCore::Document::createDocumentFragment): Call create.
+        (WebCore::Document::createTextNode): Ditto.
+        (WebCore::Document::createComment): Ditto.
+        (WebCore::Document::createCDATASection): Ditto.
+        (WebCore::Document::createProcessingInstruction): Ditto.
+        (WebCore::Document::createEntityReference): Ditto.
+        (WebCore::Document::createEditingTextNode): Ditto.
+        (WebCore::Document::importNode): Call Attr::create.
+        (WebCore::Document::createAttributeNS): Ditto.
+
+        * dom/Document.h: Call adoptRef. Made a lot of functions private and
+        protected and sorted them so public functions come first.
+
+        * dom/DocumentFragment.cpp:
+        (WebCore::DocumentFragment::create): Added.
+        (WebCore::DocumentFragment::cloneNode): Call create.
+        * dom/DocumentFragment.h: Added create.
+
+        * dom/DocumentType.cpp:
+        (WebCore::DocumentType::DocumentType): Pass type to Node constructor.
+        (WebCore::DocumentType::cloneNode): Use create.
+        * dom/DocumentType.h:
+        (WebCore::DocumentType::create): Call adoptRef.
+
+        * dom/EditingText.cpp:
+        (WebCore::EditingText::create): Added.
+        * dom/EditingText.h: Added a create function. Made everything private.
+
+        * dom/Element.cpp:
+        (WebCore::Element::Element): Pass CreateElementZeroRefCount to preserve
+        the zero reference count behavior for classes derived from Element.
+
+        * dom/EntityReference.cpp:
+        (WebCore::EntityReference::create): Added.
+        (WebCore::EntityReference::cloneNode): Call create.
+        * dom/EntityReference.h: Added create. Made everything private.
+
+        * dom/Node.cpp:
+        (WebCore::Node::initialRefCount): Added. Inline helper function for
+        the constructor.
+        (WebCore::Node::isContainer): Ditto.
+        (WebCore::Node::isElement): Ditto.
+        (WebCore::Node::isText): Ditto.
+        (WebCore::Node::Node): Changed to take a construction type argument.
+        Since m_document is now a normal pointer, added a call to selfOnlyRef.
+        (WebCore::Node::~Node): Ditto, but selfOnlyDeref.
+        (WebCore::Node::setDocument): Added selfOnlyRef/Deref calls.
+        (WebCore::Node::appendTextContent): Use the data function instead of
+        calling nodeValue functions, which do the same thing in a roundabout way.
+
+        * dom/Node.h: Made the constructor protected and replaced the multiple
+        arguments iwth a single ConstructionType argument. Sorted the public
+        things first.
+
+        * dom/Notation.h: Made most things private.
+        * dom/Notation.cpp: Removed extra constructor.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::create): Added.
+        (WebCore::ProcessingInstruction::cloneNode): Call create.
+        * dom/ProcessingInstruction.h: Added create function. Made many other
+        members private.
+
+        * dom/Range.cpp:
+        (WebCore::Range::processContents): Use DocumentFragment::create.
+
+        * dom/Text.cpp:
+        (WebCore::Text::Text): Updated for base class change.
+        (WebCore::Text::create): Added.
+        (WebCore::Text::splitText): Changed to not require access to m_data.
+        (WebCore::Text::cloneNode): Call create.
+        (WebCore::Text::createRenderer): Call dataImpl.
+        (WebCore::Text::attach): Call data.
+        (WebCore::Text::recalcStyle): Call dataImpl.
+        (WebCore::Text::virtualCreate): Call create.
+        (WebCore::Text::createWithLengthLimit): Call create.
+        (WebCore::Text::formatForDebugger): Call data.
+
+        * dom/Text.h: Added a create function. Made many other members private.
+        Renamed createNew to virtualCreate.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::enterText): Call Text::create.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::cdataBlock): Call CDATASection::create.
+        (WebCore::XMLTokenizer::comment): Call Comment::create.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        Call data instead of string.
+
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply): Call Text::create.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertNode): Call DocumentFragment::create.
+
+        * editing/SplitTextNodeCommand.cpp:
+        (WebCore::SplitTextNodeCommand::doApply): Call Text::create.
+
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup): Call data instead of nodeValue.
+
+        * html/HTMLDocument.h:
+        (WebCore::HTMLDocument::create): Call adoptRef.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::createContextualFragment): Call DocumentFragment::create.
+        (WebCore::replaceChildrenWithFragment): Call data instead of string.
+        (WebCore::replaceChildrenWithText): Call Text::create.
+        (WebCore::HTMLElement::setInnerText): Call DocumentFragment::create and
+        Text::create.
+        (WebCore::HTMLElement::setOuterText): Call Text::create.
+
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::HTMLKeygenElement): Call Text::create.
+
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setText): Call Text::create.
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::textCreateErrorCheck): Call Text::create.
+        (WebCore::HTMLParser::commentCreateErrorCheck): Call Comment::create.
+        (WebCore::HTMLParser::handleIsindex): Call Text::create.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addText): Call Text::create.
+
+        * html/HTMLViewSourceDocument.h:
+        (WebCore::HTMLViewSourceDocument::create): Call adoptRef.
+
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryTokenizer::appendEntry): Call Text::create.
+        (WebCore::FTPDirectoryTokenizer::createTDForFilename): Call Text::create.
+
+        * loader/FTPDirectoryDocument.h:
+        (WebCore::FTPDirectoryDocument::create): Call adoptRef.
+        * loader/ImageDocument.h:
+        (WebCore::ImageDocument::create): Ditto.
+        * loader/MediaDocument.h:
+        (WebCore::MediaDocument::create): Ditto.
+        * loader/PlaceholderDocument.h:
+        (WebCore::PlaceholderDocument::create): Ditto.
+        * loader/PluginDocument.h:
+        (WebCore::PluginDocument::create): Ditto.
+        * loader/TextDocument.h:
+        (WebCore::TextDocument::create): Ditto.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didFinishLoading): Use RefPtr instead of DocPtr.
+        (WebCore::Loader::Host::didFail): Ditto.
+
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::TreeShared): Added an initialRefCount argument,
+        defaulting to 1. Node still sometimes initializes it to 0 instead for now.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::originalText): Use dataImpl instead of string.
+
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::originalText): Use dataImpl instead of string.
+        (WebCore::RenderTextFragment::previousCharacter): Ditto.
+
+        * svg/SVGDocument.h:
+        (WebCore::SVGDocument::create): Use adoptRef.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::SVGElementInstance): Updated to take a
+        PassRefPtr.
+
+        * svg/SVGElementInstance.h: Made everything private.
+
+        * wml/WMLDocument.h:
+        (WebCore::WMLDocument::create): Called adoptRef.
+
+        * xml/XPathNamespace.cpp:
+        (WebCore::XPathNamespace::XPathNamespace): Take AtomicString arguments.
+        * xml/XPathNamespace.h: Made everything private.
+
+        * xml/XSLTProcessor.cpp:
+        (WebCore::createFragmentFromSource): Use DocumentFragment::create and
+        Text::create.
+
+2009-08-13  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Part of <rdar://problem/6218721> No MSAA focus events fired for Webkit
+        nightly (20866)
+
+        https://bugs.webkit.org/show_bug.cgi?id=20866
+
+        Reviewed by Oliver Hunt.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+        Changed to take a pointer to its owner document. This is used by
+        AXObjectCache::handleFocusedUIElementChanged().
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        Code moved from AccessibilityRenderObject::focusedUIElement(). Modified
+        to be a static function and to take a pointer to a Page.
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Moved the code to generate the next AXID from getAXID() to here. Added
+        a #if to make this non-WIN only, because Windows has its own
+        implementation.
+        (WebCore::AXObjectCache::getAXID):
+        Ensure that we generate a positive AXID, ranging from 1 to LONG_MAX.
+
+        * accessibility/AXObjectCache.h:
+        Add a declaration for Document and Page. Removed the declaration of
+        AccessibilityObject, because we include the header. Reordered the
+        declaration of Node alphabetically. Moved the typedef for AXID to
+        AccessibilityObject. Removed some trailing whitespace. Added a member
+        variable to hold a pointer to the owner Document.
+        (WebCore::AXObjectCache::AXObjectCache):
+        Changed to take a pointer to its owner Document.
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        Added; code moved from AccessiblityRenderObject::focusedUIElement().
+        Returns the focused element with respect to accessibility.
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Declare a function to generate an AXID.
+        (WebCore::AXObjectCache::objectFromAXID):
+        Return the AccessibilityObject with the given AXID.
+
+        * accessibility/AccessibilityObject.h:
+        Moved the typedef for AXID from AXObjectCache to here. Made the m_id
+        member use the typedef.
+        (WebCore::AccessibilityObject::axObjectID):
+        Changed the return type to use the typedef.
+        (WebCore::AccessibilityObject::setAXObjectID):
+        Changed the argument type to use the typedef.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        Removed some unneeded #includes.
+        (WebCore::AccessibilityRenderObject::focusedUIElement):
+        Moved the code to AXObjectCache::focusedUIElementForPage(), which we now
+        call.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Ensure that we generate an AXID that is in the range 1 to LONG_MAX.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        If the Document has no Page, return. If the Page has not focused
+        element (respecting accessibility), return. Assert that the
+        accessibility of the focused element is not ignored, and that the
+        object's AXID will be negative and fit into a LONG when negated.
+        Broadcast a focus event for the object.
+
+        * dom/Document.cpp:
+        (WebCore::Document::axObjectCache):
+        Pass this when creating the AXObjectCache.
+        (WebCore::Document::setFocusedNode):
+        Call AXObjectCache::handleFocusedUIElementChanged() on Windows.
+
+2009-08-14  Jiahua Huang  <jhuangjiahua@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [gtk] Pasteboard/GtkClipboard can't handle the "text/html" target.
+        https://bugs.webkit.org/show_bug.cgi?id=27028
+
+        Remove the improper set of enum WebKitWebViewTargetInfo
+        by grabbing the target infos via m_helper.
+
+        * manual-tests/gtk/copy-htmltext.html: Added.
+        * platform/Pasteboard.h:
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::clipboard_get_contents_cb):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-08-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix an assertion when bringing up the Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=28318
+        
+        The fix for bug 28295 assumed that image clients count the number of times
+        addClient/removeClient is called. That was true for CachedResource clients,
+        but not StyleGeneratedImage clients, which pass the call onto CSSImageGeneratorValue.
+        
+        Fix by making CSSImageGeneratorValue count the number of times a client is
+        added/removed.
+
+        * css/CSSCanvasValue.cpp:
+        (WebCore::CSSCanvasValue::canvasChanged):
+        (WebCore::CSSCanvasValue::canvasResized):
+        * css/CSSImageGeneratorValue.cpp:
+        (WebCore::CSSImageGeneratorValue::addClient):
+        (WebCore::CSSImageGeneratorValue::removeClient):
+        (WebCore::CSSImageGeneratorValue::getImage):
+        * css/CSSImageGeneratorValue.h:
+
+2009-08-14  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Kevin Ollivier.
+
+        Correct libcurl crash when downloading local files.
+        https://bugs.webkit.org/show_bug.cgi?id=28312
+
+        No new tests. Test is covered by fast/encoding/char-encoding-mac.html.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::handleLocalReceiveResponse): New static function that
+          performs the local setting of valid URL and firing didReceiveResponse.
+          This code was moved from writeCallback.
+        (WebCore::writeCallback): Move local file handling to static function
+          (above) and use the function instead.
+        (WebCore::readCallback): Add check
+          for responseFired, and handle as a local file if it was not.
+
+2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Fix RenderThemeHaiku build.
+        https://bugs.webkit.org/show_bug.cgi?id=28307
+
+        * platform/haiku/RenderThemeHaiku.cpp: Included RenderThemeHaiku.h
+        instead of RenderTheme.h.
+        (WebCore::RenderThemeHaiku::paintCheckbox): Removed the wrong 'virtual'
+        before the function.
+        (WebCore::RenderThemeHaiku::paintRadio): Removed the wrong 'virtual'
+        before the function.
+        * platform/haiku/RenderThemeHaiku.h: Corrected wrong function definitions.
+
+2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Adding SharedBufferHaiku to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28309
+
+        * platform/haiku/SharedBufferHaiku.cpp: Added.
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/haiku/TemporaryLinkStubs.cpp: Removed unnecessary headers
+        and functions.
+        (WebCore::signedPublicKeyAndChallengeString):
+        (WebCore::getSupportedKeySizes):
+
+2009-08-14  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Ensure we're getting the right v8 context in the V8 DOMWindowEvent custom getter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28311
+
+        This should fix Chromium failing LayoutTests/fast/events/set-event-in-another-frame.html.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+
+2009-08-14  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        BUG 28134: Move the remaining parts of Access Control from XMLHttpRequest to ThreadableDocumentLoader.
+        https://bugs.webkit.org/show_bug.cgi?id=28134
+
+        No new tests added since Access Control was already well tested and this is a pure refactor.
+
+        * loader/DocumentThreadableLoader.cpp: Move a lot of the access control code from XHR in, preserving its
+        basic strategy. Also, modify the synchronous path to not be a special case, but reuse more of the async
+        path.
+
+        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Go through the async path and pass additional flags.
+        (WebCore::DocumentThreadableLoader::create): Group enum params into an options struct.
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Ditto.
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest): Brought mostly from XHR.
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight): Ditto.
+        (WebCore::DocumentThreadableLoader::willSendRequest): Handle preflight case.
+        (WebCore::DocumentThreadableLoader::didReceiveResponse): Ditto.
+        (WebCore::DocumentThreadableLoader::didFinishLoading): Ditto.
+        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): Ditto.
+        (WebCore::DocumentThreadableLoader::preflightSuccess): Preflight handling.
+        (WebCore::DocumentThreadableLoader::preflightFailure): Ditto.
+        (WebCore::DocumentThreadableLoader::loadRequest): Common request function that handles async/sync.
+        * loader/DocumentThreadableLoader.h: Group enum params into an options struct.
+        * loader/ThreadableLoader.cpp: Ditto.
+        (WebCore::ThreadableLoader::create): Ditto.
+        (WebCore::ThreadableLoader::loadResourceSynchronously): Ditto.
+        * loader/ThreadableLoader.h: Ditto.
+        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Ditto.
+        * loader/WorkerThreadableLoader.cpp: Ditto.
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):Ditto.
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously): Ditto.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge): Ditto.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader): Ditto.
+        * loader/WorkerThreadableLoader.h: Ditto.
+        (WebCore::WorkerThreadableLoader::create): Ditto.
+        * platform/CrossThreadCopier.h: Allow ThreadableLoaderOptions to be copied across threads.
+        (WebCore::):
+        * workers/WorkerScriptLoader.cpp: More enum->struct grouping.
+        (WebCore::WorkerScriptLoader::loadSynchronously): More enum->struct grouping.
+        (WebCore::WorkerScriptLoader::loadAsynchronously): More enum->struct grouping.
+        * xml/XMLHttpRequest.cpp: Remove all the access control code and some supporting state.
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Ditto.
+        (WebCore::XMLHttpRequest::createRequest): Ditto.
+        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
+        (WebCore::XMLHttpRequest::didReceiveResponse): Ditto.
+        (WebCore::XMLHttpRequest::didReceiveData): Ditto.
+        * xml/XMLHttpRequest.h: Ditto.
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rename the confusing isObject(<class>) to inherits(<class>).
+        It still works on non-objects, returning false.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback):
+        (WebCore::createPositionErrorCallback):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::toNodeFilter):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet):
+        (WebCore::JSXSLTProcessor::transformToFragment):
+        (WebCore::JSXSLTProcessor::transformToDocument):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        Updated to new name, inherits, from old name, isObject.
+
+2009-08-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow Qt API to list and to remove URL schemes that were registered as
+        local URL schemes.
+        [Qt] Allow applications to register their own local URL scheme.
+        https://bugs.webkit.org/show_bug.cgi?id=28240
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::removeURLSchemeRegisteredAsLocal):
+        (WebCore::SecurityOrigin::localURLSchemes):
+        * page/SecurityOrigin.h:
+
+2009-08-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Wrap console objects late (in the frontend) so that injected
+        script was already in place.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28297
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::InspectorFrontend):
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/InspectorFrontend.h:
+
+2009-08-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix logic in RenderObject::updateFillImages() that led to incorrect client
+        counts if an image was used twice in the background-image property.
+        https://bugs.webkit.org/show_bug.cgi?id=28295
+
+        Test: fast/backgrounds/multiple-backgrounds-assert.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateFillImages):
+        Simplify the logic to call addClient()/removeClient() for every background
+        image, but go through the new layers first to avoid removing all the
+        clients of an image.
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Devirtualise marking
+        https://bugs.webkit.org/show_bug.cgi?id=28294
+
+        Make sure we override the JSObject createStructure method on those
+        objects that have custom marking routines.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Follow-up to earlier work to remove dependencies on JavaScriptCore.
+
+        * ForwardingHeaders/parser/Parser.h: Removed.
+        * inspector/JavaScriptDebugServer.cpp: Removed now-unneeded includes
+        of Parser.h.
+
+2009-08-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        'box-orient: block-axis' behaves like 'box-orient: horizontal', causes
+        an assertion failure in debug builds
+        https://bugs.webkit.org/show_bug.cgi?id=28279
+
+        Test: fast/flexbox/block-axis.html
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::operator EBoxOrient): Map block-axis to
+        vertical.
+
+2009-08-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix crash when removing reflection on an absolutely-positioned image.
+        https://bugs.webkit.org/show_bug.cgi?id=28289
+        
+        Make sure we clean up the reflection layer when removing the reflection,
+        so that the RenderLayer tree does not contain pointers to deleted layers.
+
+        Test: fast/reflections/reflected-img-crash.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::~RenderLayer):
+        (WebCore::RenderLayer::styleChanged):
+        (WebCore::RenderLayer::removeReflection):
+        * rendering/RenderLayer.h:
+
+2009-08-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        misalignment because of float:left of <div> tag
+        https://bugs.webkit.org/show_bug.cgi?id=15869
+
+        One section of http://edgar.sec.gov site draws to the right of the rest
+        of the content
+        <rdar://problem/7135951>
+
+        Tests: fast/block/float/avoidance-percent-width-compat.html
+               fast/block/float/avoidance-percent-width-strict.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::getClearDelta): Changed to apply the same float
+            avoidance logic in strict mode and in compatibility mode, which
+            matches Firefox and IE. Changed to compute and use the computed
+            width of the child, instead of ignoring non-fixed widths.
+
+2009-08-13  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Geolocation PositionOptions does not use correct default values.
+        https://bugs.webkit.org/show_bug.cgi?id=27254
+
+        Sets the correct default values for the properties of the PositionOptions object
+        passed to Geolocation methods. See http://www.w3.org/TR/geolocation-API/.
+
+        Also adds checking to throw an exception if arguments of the incorrect type are
+        passed to Geolocation methods. Adds a layout test to test this. This test should
+        pass on all platforms where Geolocation is implemented.
+
+        Test: fast/dom/Geolocation/argument-types.html
+
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback): Added. Creates the callback.
+        (WebCore::createPositionErrorCallback): Added. Creates the calback.
+        (WebCore::createPositionOptions): Added. Creates the PositionOptions object, setting defaults where required.
+        (WebCore::JSGeolocation::getCurrentPosition): Modified. Now uses above helper functions.
+        (WebCore::JSGeolocation::watchPosition): Modified. Now uses above helper functions.
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Asserts that PositionOptions object is present.
+        (WebCore::Geolocation::GeoNotifier::startTimer): Modified. Only starts timer if timeout has been set.
+        * page/PositionOptions.h:
+        (WebCore::PositionOptions::create): Modified. Creates object with default values.
+        (WebCore::PositionOptions::timeout): Modified. Uses correct type.
+        (WebCore::PositionOptions::hasTimeout): Added. Determines whether a timeout has been set.
+        (WebCore::PositionOptions::setTimeout): Modified. Uses correct type.
+        (WebCore::PositionOptions::maximumAge): Modified. Uses correct type.
+        (WebCore::PositionOptions::setMaximumAge): Modified. Uses correct type.
+        (WebCore::PositionOptions::PositionOptions): Modified. Creates object with default values.
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed chromium build fix.
+
+        [Chromium] Let CodeGeneratorV8.pm know that RGBColor is ref-counted.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-08-13  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Merge error in SharedWorker code
+        https://bugs.webkit.org/show_bug.cgi?id=28277
+
+        Fixed merge error that prevents WebKit from compiling with SHARED_WORKERS enabled.
+        No new tests needed.
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        Removed duplicated functions.
+
+2009-08-13  Kyle Prete  <kylep@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        Chromium: Show a "Playback Disabled" button on media error.
+        https://bugs.webkit.org/show_bug.cgi?id=28196
+        Use a disabled play button when the media file cannot be played.
+
+        No new tests needed. Covered by LayoutTests/media/video-empty-source.html
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Qt build.
+
+        * bridge/qt/qt_runtime.cpp:
+
+2009-08-13  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Drag and drop support
+        https://bugs.webkit.org/show_bug.cgi?id=23642
+
+        Utilizes functions that are being called upon drag and drop actions.
+        Uses different GTK clipboards that hold different types
+        of drag data - images, HTML markup, text, URL, URL label.
+        Also clears each clipboard before setting new data to it.
+
+        No new tests - despite some implementations, no new functionality
+        is added until implementations of the GTK drag and drop protocol
+        in WebKit part.
+
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::ClipboardGtk):
+        (WebCore::ClipboardGtk::~ClipboardGtk):
+        (WebCore::getCachedImage):
+        (WebCore::ClipboardGtk::declareAndWriteDragImage):
+        (WebCore::ClipboardGtk::writeURL):
+        (WebCore::ClipboardGtk::writeRange):
+        * platform/gtk/ClipboardGtk.h: ClipboardGdk -> ClipboardGtk
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        JavaScriptCore tweaks to get ready for the parser arena
+        https://bugs.webkit.org/show_bug.cgi?id=28243
+
+        * ForwardingHeaders/runtime/CollectorHeapIterator.h: Removed.
+
+        * WebCore.xcodeproj/project.pbxproj: Exposed a couple header
+        files as Private that are now needed to compile Mac WebKit.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        * bindings/js/JSHistoryCustom.cpp:
+        * bindings/js/JSImageConstructor.cpp:
+        * bindings/js/JSLazyEventListener.cpp:
+        * bindings/js/JSLocationCustom.cpp:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        * bindings/js/JSOptionConstructor.cpp:
+        * bindings/js/JSWebSocketConstructor.cpp:
+        * bindings/js/JSWebSocketCustom.cpp:
+        * bindings/js/JSWorkerConstructor.cpp:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        * bridge/jni/jni_jsobject.mm:
+        Updated includes.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::sourceParsed):
+        Change to not assert if this is called with no listeners.
+        I don't think this was guaranteed before, and we now use
+        this code path when recompiling. Slightly less efficient,
+        but this is a one-time cost when turning on the debugger.
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+        Change to call Debugger::recompileAllJSFunctions.
+
+2009-08-13  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        <rdar://problem/7138591> and https://bugs.webkit.org/show_bug.cgi?id=28260
+        onhashchange property cannot be set from javascript.
+
+        Test: fast/loader/onhashchange-attribute-listeners.html
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::onhashchange):
+        (WebCore::HTMLBodyElement::setOnhashchange):
+        * html/HTMLBodyElement.h:
+        * html/HTMLBodyElement.idl:
+
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::onhashchange):
+        (WebCore::HTMLFrameSetElement::setOnhashchange):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::onhashchange):
+        (WebCore::DOMWindow::setOnhashchange):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix leaks of RGBColor instances from below SVGColor::rgbColor.
+
+        * svg/SVGColor.cpp:
+        (WebCore::SVGColor::rgbColor): Return a PassRefPtr to ensure that the newly-allocated
+        RGBColor is cleaned up by the caller.
+        * svg/SVGColor.h:
+
+2009-08-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate to DOMAgent (serialized access to DOM).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28177
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::highlightDOMNode):
+        (WebCore::JSInspectorBackend::nodeForId):
+        (WebCore::JSInspectorBackend::idForNode):
+        (WebCore::JSInspectorBackend::wrapObject):
+        (WebCore::JSInspectorBackend::unwrapObject):
+        (WebCore::JSInspectorBackend::pushNodePathToFrontend):
+        (WebCore::JSInspectorBackend::selectDatabase):
+        (WebCore::JSInspectorBackend::selectDOMStorage):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptObjectQuarantine.h:
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::isObject):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptObjectQuarantine.h:
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::isObject):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::clearMessages):
+        (WebCore::InspectorBackend::loaded):
+        (WebCore::InspectorBackend::highlight):
+        (WebCore::InspectorBackend::nodeForId):
+        (WebCore::InspectorBackend::idForNode):
+        (WebCore::InspectorBackend::wrapObject):
+        (WebCore::InspectorBackend::unwrapObject):
+        (WebCore::InspectorBackend::pushNodePathToFrontend):
+        (WebCore::InspectorBackend::addNodesToSearchResult):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::selectDOMStorage):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::focusNode):
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::nodeForId):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        (WebCore::InspectorDOMAgent::innerParentElement):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::clearConsoleMessages):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setDocument):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::addNodesToSearchResult):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+        (WebInspector.ConsoleView.prototype._messagesClicked):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow.evalCallback):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._format):
+        (WebInspector.ConsoleView.prototype._formatfunction):
+        (WebInspector.ConsoleView.prototype._formatdate):
+        (WebInspector.ConsoleView.prototype._formatregexp):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._formatobject):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.DOMNode.prototype._renumber):
+        (WebInspector.DOMDocument):
+        (WebInspector.DOMAgent):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype.setAttributeAsync):
+        (WebInspector.DOMAgent.prototype.removeAttributeAsync):
+        (WebInspector.DOMAgent.prototype.setTextNodeValueAsync):
+        (WebInspector.DOMAgent.prototype.nodeForId):
+        (WebInspector.DOMAgent.prototype._setDocument):
+        (WebInspector.DOMAgent.prototype._setChildNodes):
+        (WebInspector.DOMAgent.prototype._bindNodes):
+        (WebInspector.DOMAgent.prototype._childNodeInserted):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        (WebInspector.setDocument):
+        (InspectorController.getStyles):
+        (InspectorController.getComputedStyle):
+        (InspectorController.getInlineStyle):
+        (InspectorController.applyStyleText):
+        (InspectorController.setStyleText):
+        (InspectorController.toggleStyleEnabled):
+        (InspectorController.applyStyleRuleText):
+        (InspectorController.addStyleSelector):
+        (InspectorController.setStyleProperty):
+        (InspectorController.getPrototypes):
+        (InspectorController.getProperties):
+        (InspectorController.setPropertyValue):
+        (InspectorController.evaluate):
+        (InspectorController.addInspectedNode):
+        (InspectorController.performSearch):
+        (InspectorController.searchCanceled):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        (WebInspector.ElementsPanel.prototype._updateMatchesCount):
+        (WebInspector.ElementsPanel.prototype._updateMatchesCountSoon):
+        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode.restoreHighlightToHoveredNode):
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
+        (WebInspector.ElementsTreeElement.prototype.updateChildren):
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleRuleText):
+        (InjectedScript.addStyleSelector):
+        (InjectedScript._doesSelectorAffectNode):
+        (InjectedScript._serializeRule):
+        (InjectedScript._serializeStyle):
+        (InjectedScript.getProperties):
+        (InjectedScript.evaluate):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript.performSearch.addNodesToResults):
+        (InjectedScript.performSearch.matchExactItems):
+        (InjectedScript.performSearch.matchExactId.addNodesToResults.call):
+        (InjectedScript.performSearch.matchExactId):
+        (InjectedScript.performSearch):
+        (InjectedScript.performSearch.matchExactTagNames):
+        (InjectedScript.performSearch.matchExactAttributeNames):
+        (InjectedScript.performSearch.matchPartialTagNames):
+        (InjectedScript.performSearch.matchStartOfTagNames):
+        (InjectedScript.performSearch.matchPartialTagNamesAndAttributeValues):
+        (InjectedScript.performSearch.matchPartialAttributeValues):
+        (InjectedScript.performSearch.matchStyleSelector):
+        (InjectedScript.performSearch.matchPlainText):
+        (InjectedScript.performSearch.matchXPathQuery):
+        (InjectedScript.performSearch.finishedSearching):
+        (InjectedScript.performSearch.processChunk):
+        (InjectedScript.searchCanceled):
+        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._resolveObject):
+        (InjectedScript._nodeForId):
+        (InjectedScript._objectForId):
+        (InjectedScript._createProxyObject):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        (WebInspector.ObjectPropertyProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update.callback):
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted.callback):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.js:
+        (WebInspector._updateHoverHighlight):
+        (WebInspector.loaded):
+        (WebInspector.clearConsoleMessages):
+        (WebInspector.selectDatabase):
+        (WebInspector.selectDOMStorage):
+        (WebInspector.updateFocusedNode):
+        (WebInspector.addNodesToSearchResult):
+        * inspector/front-end/utilities.js:
+        (Object.proxyType):
+        * storage/Storage.h:
+        (WebCore::Storage::frame):
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix leaks of RGBColor instances from below CSSPrimitiveValue::getRGBColorValue.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::getRGBColorValue): Return a PassRefPtr to ensure that the
+        newly-allocated RGBColor is cleaned up by the caller.
+        * css/CSSPrimitiveValue.h:
+
+2009-08-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        wrong font size when css font-family includes monospace
+        https://bugs.webkit.org/show_bug.cgi?id=19161
+
+        Firefox only uses fixed-width default size for exactly "font-family: monospace;".
+        WebKit has historically used fixed-width default size any time a
+        font-family includes monospace in the fallback list.
+
+        This patch corrects WebKit's behavior to match Firefox.
+        I also had to fix a bug in WebKit's font-family fallback behavior where
+        child elements would inherit parts of their parents fallback lists.
+
+        This patch is mostly just replacing all cases where we used to check for:
+        fontDescription.genericFontFamily() == MonospaceFamily
+        with:
+        fontDescription.useFixedDefaultSize()
+
+        Tests: fast/css/getComputedStyle/computed-style-font-family-monospace.html
+               fast/css/getComputedStyle/font-family-fallback-reset.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+           Deploy useFixedDefaultSize().  Also fix the bug where child
+           FontDescriptions would carry part of the parent font-family fallback list.
+        (WebCore::CSSStyleSelector::checkForGenericFamilyChange):
+           It's no longer alright to just check genericFontFamily(),
+           we have to check to make sure the changed style has a matching useFixedDefaultSize().
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::useFixedDefaultSize):
+           Only use the fixed default size if we have one font family and it is "monospace".
+           "-webkit-monospace" is the internal representation of the CSS identifier "monospace".
+
+2009-08-13  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] Fix atomic string externalization crash.
+        Atomic string externalization assumes that all non-empty strings
+        can be externalized which is untrue on 64-bit.  This change fixed
+        that.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This bug causes loads of test crashes, no need to add new tests
+        specifically for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-13  George Staikos  <george.staikos@torchmobile.com>
+
+        Rubberstamped by Darin Adler.
+
+        Use ASSERT_UNUSED instead of UNUSED_PARAM
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::deregisterTask):
+
+2009-08-13  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes a couple of bugs in SecurityOrigin::createFromDatabaseIdentifier.
+        https://bugs.webkit.org/show_bug.cgi?id=28262
+
+        No new tests possible.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
+
+2009-08-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [CAIRO] getImageData fails on a given rect bigger than the image rect
+
+        The destination image and the source image was mixed up on creating the
+        imageData.
+
+        This is just a clean up and doesn't affect the current behavior. It's not
+        possible to test this failure in a LayoutTest. Only canvas uses getImageData
+        at the moment and returns before calling getImageData, if the image rect does
+        not contain the requested rect.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::getImageData):
+
+2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding RenderTheme to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28258
+
+        * platform/haiku/RenderThemeHaiku.cpp: Added.
+        (WebCore::RenderThemeHaiku::create):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeHaiku::RenderThemeHaiku):
+        (WebCore::RenderThemeHaiku::~RenderThemeHaiku):
+        (WebCore::supportsFocus):
+        (WebCore::RenderThemeHaiku::supportsFocusRing):
+        (WebCore::RenderThemeHaiku::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeHaiku::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeHaiku::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeHaiku::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeHaiku::platformTextSearchHighlightColor):
+        (WebCore::RenderThemeHaiku::systemFont):
+        (WebCore::RenderThemeHaiku::paintCheckbox):
+        (WebCore::RenderThemeHaiku::setCheckboxSize):
+        (WebCore::RenderThemeHaiku::paintRadio):
+        (WebCore::RenderThemeHaiku::setRadioSize):
+        (WebCore::RenderThemeHaiku::adjustMenuListStyle):
+        (WebCore::RenderThemeHaiku::paintMenuList):
+        * platform/haiku/RenderThemeHaiku.h: Added.
+        (WebCore::RenderThemeHaiku::supportsHover):
+
+2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Remove the "m_point" code from ContextMenuHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28256
+
+        * platform/haiku/ContextMenuHaiku.cpp:
+        (WebCore::ContextMenuReceiver::ContextMenuReceiver):
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::insertItem):
+
+2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Inspector: Show Hidden Cookie Data
+        https://bugs.webkit.org/show_bug.cgi?id=28185
+
+          Added new file Cookie.h to the WebCore XCode
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+          InspectorController.cookies() binding
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        * inspector/InspectorBackend.idl:
+
+          Struct for static Cookie information
+          (name, value, path, domain, expires, httpOnly, secure, session)
+
+        * platform/Cookie.h: Added.
+        (WebCore::Cookie::Cookie):
+        
+          Getter for the a list of raw Cookies
+          getRawCookies(., ., out Vector<Cookie>)
+        
+        * platform/CookieJar.h:
+
+          Implementation of getRawCookies for the mac platform.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+
+          Stub other CookieJar implementations to satisfy the interface.
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+
+2009-08-13  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add a new gesture in Web Inspector to remove breakpoints
+        https://bugs.webkit.org/show_bug.cgi?id=19131
+        
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+
+2009-08-13  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian target components (library and executable files)
+        require Unique Identifiers (i.e., UID3).
+        These identifiers are defined in the respective project
+        file, conditionally for "symbian" platform.
+
+        * WebCore.pro:
+
+2009-08-13  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        wrong calculation of overflow size for flexbox and table
+        https://bugs.webkit.org/show_bug.cgi?id=28064
+
+        RenderFlexibleBox and RenderTable were using the width of overflow
+        to update height of overflow, so height became wrong value and
+        width was not updated. As the corresponding code of RenderBlock
+        was sane, I factored it out and used from RenderFlexibleBox and
+        RenderTable.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateOverflowWithShadowAndReflection): created from code of layoutBlock
+        (WebCore::RenderBlock::layoutBlock):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlexibleBox.cpp: use updateOverflowWithShadowAndReflection
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout): use updateOverflowWithShadowAndReflection
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Revert r47185, the fix for <https://bugs.webkit.org/show_bug.cgi?id=28185>, as it broke the
+        Windows build in a non-obvious manner.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.idl:
+        * platform/Cookie.h: Removed.
+        * platform/CookieJar.h:
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        * platform/mac/CookieJar.mm:
+        * platform/network/chromium/CookieJarChromium.cpp:
+        * platform/network/curl/CookieJarCurl.cpp:
+        * platform/network/soup/CookieJarSoup.cpp:
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        * platform/network/win/CookieJarWin.cpp:
+        * platform/qt/CookieJarQt.cpp:
+
+2009-08-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed: build fix (for r47192), adding new file from
+        https://bugs.webkit.org/show_bug.cgi?id=28174
+
+        * inspector/front-end/StatusBarButton.js: Added.
+
+2009-08-13  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Introduced StatusBarButton class that encapsulates glyphs support.
+        Views updated accordingly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28174
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems): Updated to retrieve DOM element from StatusBarButton instance (here and in similar getters below.)
+        (WebInspector.CookieItemsView.prototype.hide):
+        (WebInspector.CookieItemsView.prototype.update):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView):
+        (WebInspector.DOMStorageItemsView.prototype.get statusBarItems):
+        (WebInspector.DOMStorageItemsView.prototype.hide):
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.get statusBarItems):
+        (WebInspector.ElementsPanel.prototype.hide):
+        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
+        * inspector/front-end/Panel.js:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype.get statusBarItems):
+        (WebInspector.ProfileView.prototype._updatePercentButton):
+        (WebInspector.ProfileView.prototype._focusClicked):
+        (WebInspector.ProfileView.prototype._excludeClicked):
+        (WebInspector.ProfileView.prototype._resetClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.setRecordingProfile):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get statusBarItems):
+        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        * inspector/front-end/StatusBarButton.js: Added.
+        (WebInspector.StatusBarButton):
+        (WebInspector.StatusBarButton.prototype._clicked):
+        (WebInspector.StatusBarButton.prototype.get disabled):
+        (WebInspector.StatusBarButton.prototype.set disabled):
+        (WebInspector.StatusBarButton.prototype.get title):
+        (WebInspector.StatusBarButton.prototype.set title):
+        (WebInspector.StatusBarButton.prototype.get toggled):
+        (WebInspector.StatusBarButton.prototype.set toggled):
+        (WebInspector.StatusBarButton.prototype.get visible):
+        (WebInspector.StatusBarButton.prototype.set visible):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css: For uniformity, class names are always used to identify status bar buttons. Also, fixed "Reload" button style to use glyphs.
+        * inspector/front-end/inspector.html:
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add shadow support in GraphicsContext::fillRect().
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect): Paint shadow if necessary.
+        (WebCore::GraphicsContext::setPlatformShadow): Inverse y offset.
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for Chromium Linux.
+
+        Rollback r47157 as this broke debug tests of Chromium Linux.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        The chromium build broke due to r47185 which added
+        a cookies array to inspector/InspectorBackend.idl.
+
+        * bindings/v8/custom/V8CustomBinding.h: Added the declaration for the cookies callback.
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL(InspectorBackendCookies)): Stubbed out an implementation
+         for the cookies callback.
+
+2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Show Hidden Cookie Data
+        https://bugs.webkit.org/show_bug.cgi?id=28185
+
+          Added new file Cookie.h to the WebCore XCode
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+          InspectorController.cookies() binding
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        * inspector/InspectorBackend.idl:
+
+          Struct for static Cookie information
+          (name, value, path, domain, expires, httpOnly, secure, session)
+
+        * platform/Cookie.h: Added.
+        (WebCore::Cookie::Cookie):
+        
+          Getter for the a list of raw Cookies
+          getRawCookies(., ., out Vector<Cookie>)
+        
+        * platform/CookieJar.h:
+
+          Implementation of getRawCookies for the mac platform.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+
+          Stub other CookieJar implementations to satisfy the interface.
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+
+2009-08-08  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Cookies in Storage Panel
+        https://bugs.webkit.org/show_bug.cgi?id=27202
+
+          Data Structure for a Cookie. Just Key/Value for Now:
+
+        * inspector/front-end/Cookie.js: Added.
+        (WebInspector.Cookie):
+        (WebInspector.Cookie.prototype.get key):
+        (WebInspector.Cookie.prototype.set key):
+        (WebInspector.Cookie.prototype.get value):
+        (WebInspector.Cookie.prototype.set value):
+
+          A Storage View for Cookies.  Allows for Refresh/Delete:
+
+        * inspector/front-end/CookieItemsView.js: Added.
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems): refresh and delete buttons
+        (WebInspector.CookieItemsView.prototype.show):
+        (WebInspector.CookieItemsView.prototype.hide):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.buildCookies): parses the inspected window's document.cookie string
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies): creates a datagrid for cookies
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked): attempt at deleting the cookie (not flawless)
+        (WebInspector.CookieItemsView.prototype._refreshButtonClicked): rebuild the datagrid
+
+          Include a SidebarSection Section in the Databases Panel:
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel):
+        (WebInspector.DatabasesPanel.prototype.show): calls populateInterface
+        (WebInspector.DatabasesPanel.prototype.populateInterface): adds cookies if they don't exist
+        (WebInspector.DatabasesPanel.prototype.reset): remove cookie specific parts
+        (WebInspector.DatabasesPanel.prototype.addCookies): add cookies sidebar tree element
+        (WebInspector.DatabasesPanel.prototype.showCookies): sets the visible view to a CookiesItemView
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle): just "Cookies" at the moment
+        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.get subtitle): no subtitle yet
+        (WebInspector.CookieSidebarTreeElement.prototype.set subtitle):
+
+          New "Cookies" Image for the Sidebar:
+
+        * inspector/front-end/Images/cookie.png: Added.
+        * inspector/front-end/inspector.css:
+
+          Include the Added Files where appropriate:
+
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-08-12  George Wright  <george.wright@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Add SQLTransactionCoordinator.[h,cpp] to WebCore.pro.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28246
+
+        * WebCore.pro:
+
+2009-08-12  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Mark unused variables to avoid compile failures in -Werror.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::deregisterTask):
+
+2009-08-12  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Niko Zimmermann.
+
+        This is to add WCSS marquee support , which is defined by OMA and is an extension for CSS2, 
+        It extends CSS display with "display:-wap-marquee;-wap-marquee-dir:xxx;-wap-marquee-speed:xxx;-wap-marquee-style:xxx"
+        Minor fixes by Eric Seidel and George Staikos.
+        https://bugs.webkit.org/show_bug.cgi?id=23727
+
+        No new tests, the tests have already been landed at LayoutTests/fast/wcss/
+
+        * WebCore.pro:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * css/WCSSPropertyNames.in: Added.
+        * css/WCSSValueKeywords.in: Added.
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::start):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-12  George Wright  <george.wright@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        Update the canvas renderer's intrinsic size with the zoomed
+        lengths and ensure the intrinsic size is correct when setting
+        an initial style.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26908
+
+        Test: fast/canvas/canvas-zoom.html
+
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::canvasSizeChanged):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::styleDidChange):
+
+2009-08-12  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix regression for dragging the media controller thumb.
+        https://bugs.webkit.org/show_bug.cgi?id=28211
+
+        Modified the conditions for rejecting events on the media controller
+        to only rejecting mouse events not from the left button.
+
+        Test: media/controls-drag-timebar.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+
+2009-08-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixing a deadlock caused by two transactions that run on two
+        different database handles for the same DB. Adding a per-DB thread
+        transaction coordinator that allows the DB thread to run only one
+        transaction per DB file at any given time.
+
+        Adding a regression test for this bug.
+
+        Test: storage/multiple-transactions-on-different-handles.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=27966
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionCoordinator):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionCoordinator):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::debugStepName):
+        (WebCore::SQLTransaction::performNextStep):
+        (WebCore::SQLTransaction::aquireLock):
+        (WebCore::SQLTransaction::lockAquired):
+        (WebCore::SQLTransaction::cleanupAfterSuccessCallback):
+        (WebCore::SQLTransaction::cleanupAfterTransactionErrorCallback):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCoordinator.cpp: Added.
+        * storage/SQLTransactionCoordinator.h: Added.
+
+2009-08-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Custom properties on DOM objects are lost after GC (as demonstrated by the gc-9.html test)
+        https://bugs.webkit.org/show_bug.cgi?id=28194
+
+        * GNUmakefile.am: Added the two new source files.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/js/JSCSSRuleListCustom.cpp: Added.
+        (WebCore::JSCSSRuleList::markChildren): Call markDOMObjectWrapper
+        on rules in the list.
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::markChildren): Added. Call
+        markDOMObjectWrapper on the CSSValue objects that are owned by the
+        declaration as values of the properties.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM): Added code to handle some
+        cases where nodes are observable because they own objects that
+        in turn have custom properties.
+
+        * bindings/js/JSDOMBinding.h: Fix a typo in the header.
+
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::markChildren): Added call to markDOMObjectWrapper
+        for implementation and styleSheets.
+
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::markChildren): Added. Calls markDOMObjectWrapper
+        for attributes and style.
+
+        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added.
+        (WebCore::JSHTMLCanvasElement::markChildren): Call markDOMObjectWrapper
+        on the rendering context.
+
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::markChildren): Call markDOMObjectWrapper on
+        items in the stylesheet.
+
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        (WebCore::JSStyleSheetList::markChildren): Added. Calls
+        markDOMObjectWrapper on stylesheets in the list.
+
+        * css/CSSRuleList.idl: Added CustomMarkFunction.
+        * css/CSSStyleDeclaration.idl: Ditto.
+        * css/StyleSheetList.idl: Ditto.
+        * dom/Element.idl: Ditto.
+        * html/HTMLCanvasElement.idl: Ditto.
+
+        * dom/Element.h: Made everything private that could be.
+        Added access to the attributeMap that does returns
+        the existing map without doing any of the lazy-updating work. This
+        is needed to get at the existing attributes during garbage collection
+        without having side effects.
+
+        * html/HTMLCanvasElement.h: Cleaned up the header a bit, making
+        members private. Added renderingContext2D function for use in
+        JSHTMLCanvasElement::markChildren.
+
+2009-08-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes two bugs about Pan Scrolling - Scrolling with middle mouse button doesn't 
+        work in Expanded view on reader.google.com, and Can enter auto scroll from a non-scrollable area.
+        https://bugs.webkit.org/show_bug.cgi?id=28023
+        https://bugs.webkit.org/show_bug.cgi?id=24794
+        
+        Added a new method to RenderBox seeing if the Box can be scrolled and actually has something to
+        scroll, and use that for pan scrolling.
+
+        Test: platform/win/fast/events/panScroll-nested-divs.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseDraggedEvent):
+        (WebCore::EventHandler::updateAutoscrollRenderer):
+        (WebCore::EventHandler::handleMousePressEvent):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::canBeScrolledAndHasScrollableArea):
+        * rendering/RenderBox.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively):
+
+2009-08-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix of <rdar://6728361> Mouse wheel scrolling on a page with expanded drop down 
+        list detaches drop down.
+
+        Added a function for Windows PopupMenu's to return their class name.
+
+         * platform/PopupMenu.h:
+         * platform/win/PopupMenuWin.cpp:
+         (WebCore::PopupMenu::popupClassName):
+
+2009-08-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        WINCE PORT: Color and Gradient
+        https://bugs.webkit.org/show_bug.cgi?id=27511
+
+        * platform/graphics/wince/ColorWince.cpp: Added.
+        * platform/graphics/wince/GradientWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28172
+
+        No new tests because it's a just typo fix.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-12  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27458
+        Support for the :default CSS pseudoclass, as per HTML5 spec.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/interactive-elements.html#selector-default
+
+        Tests: fast/css/pseudo-default-001.html
+               fast/css/pseudo-default-002.html
+               fast/css/pseudo-default-003.html
+               fast/css/pseudo-default-004.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): pseudoDefault
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement): sharing stuff is
+        aware that only one default button can be present in a form
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
+        the :default CSS pseudoclass
+        * dom/Element.h:
+        (WebCore::Element::isDefaultButtonForForm): new method to determine
+        whether a FormControl is a default button for a given form
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::isDefaultButtonForForm): ditto
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::defaultButton): extracts the default button
+        from the form
+        * html/HTMLFormElement.h:
+
+2009-08-12  David Levin  <levin@chromium.org>
+
+        No review, rolling out r47106.
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This patch relied on a new version of v8 which is not available
+        in chromium yet.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-12  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26993 : Geolocation::requestPermission()
+        https://bugs.webkit.org/show_bug.cgi?id=26993
+
+        Second patch to allow the Geolocation permission request to chrome to be asynchronous
+        or synchronous. Fixes a bug where callbacks were called twice when permissions
+        are granted synchronously.
+
+        No new tests required.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::setIsAllowed): Modified. Calls makeSuccessCallbacks() rather than geolocationServicePositionChanged().
+        (WebCore::Geolocation::geolocationServicePositionChanged): Modified. Updated logic to avoid repeated callbacks when permissions are granted synchronously.
+        (WebCore::Geolocation::makeSuccessCallbacks): Added. Calls success callbacks.
+        * page/Geolocation.h: Modified. Adds makeSuccessCallbacks().
+
+2009-08-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6952336>
+        CrashTracer: [USER] 3 crashes in Safari at com.apple.WebCore • WebCore::SecurityOrigin::canAccess const 27
+
+        Make sure to set the security origin before calling dispatchWindowObjectAvailable.
+        
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+
+2009-08-12  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix [Chromium] drop down menu letter selection, skip selections
+        https://bugs.webkit.org/show_bug.cgi?id=28205
+
+        Not auto-testable since it is chromim platform specific code, and it involves sending a keyboard 
+        event to the popup, which is not possible (eventSender sends the key
+        events through webview, we want to go through the webwidget).
+
+        * manual-tests/keyboard_select_elements_with_same_beginning.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::isCharacterTypeEvent): style change.
+        (WebCore::PopupListBox::handleKeyEvent): typeAheadFind should be called only when the event is
+        a character type event to avoid calling twice for English.
+        (WebCore::PopupListBox::typeAheadFind): remove unnecessary checking of isCharacterTypeEvent() since the whole function is only called under that condition.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding GraphicsContext to WebCore/platform/graphics/haiku.
+        https://bugs.webkit.org/show_bug.cgi?id=28130
+
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp: Added.
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::~GraphicsContext):
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::savePlatformState):
+        (WebCore::GraphicsContext::restorePlatformState):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::beginPath):
+        (WebCore::GraphicsContext::addPath):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::translate):
+        (WebCore::GraphicsContext::origin):
+        (WebCore::GraphicsContext::rotate):
+        (WebCore::GraphicsContext::scale):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setPlatformFont):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::getHaikuStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Modifying WebCore/platform/graphics files to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * platform/graphics/BitmapImage.h: Adding getBBitmap() function.
+        * platform/graphics/Color.h: rgb_color is the Color struct in Haiku.
+        * platform/graphics/FloatPoint.h: BPoint is the Point class in Haiku.
+        * platform/graphics/FloatRect.h: BRect is the Rect class in Haiku.
+        * platform/graphics/GraphicsContext.cpp: 
+        * platform/graphics/GraphicsContext.h: BView is the PlatformGraphicsContext
+        class for Haiku. Adding getHaikuStrokeStyle() function.
+        * platform/graphics/Icon.h: Adding an empty Icon() constructor because
+        this class isn't implemented for the moment.
+        * platform/graphics/ImageSource.h: BBitmap is the native bitmap class 
+        for Haiku.
+        * platform/graphics/IntPoint.h: BPoint is the Point class in Haiku.
+        * platform/graphics/IntRect.h: BRect is the Rect class in Haiku.
+        * platform/graphics/IntSize.h: BSize is the Size class in Haiku.
+        * platform/graphics/Path.h: BRegion is the Path class in Haiku.
+        * platform/graphics/Pattern.h: Adding the GraphicsDef.h header and the 
+        native pattern type.
+        * platform/graphics/SimpleFontData.h: Adding Haiku's Font.h header.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding modification to the WebCore/platform/ files to allow
+        the Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * platform/ContextMenuItem.h: BMenu is the PlatformMenuItemDescription
+        class of Haiku.
+        * platform/Cursor.h: BCursor is the Cursor class of Haiku.
+        * platform/DragData.h: Use a BMessage as DragDataRef.
+        * platform/DragImage.h: Use a BBitmap as DragImageRef.
+        * platform/PlatformKeyboardEvent.h: Use BMessage as event vehicle.
+        * platform/PlatformMenuDescription.h: BMenu is the 
+        PlatformMenuDescription class of Haiku.
+        * platform/PlatformMouseEvent.h: Use BMessage as event vehicle.
+        * platform/PlatformWheelEvent.h: Use BMessage as event vehicle.
+        * platform/PopupMenu.h: Adding a m_menu attribute for Haiku.
+        * platform/Widget.h: BView is the PlatformWidget class of Haiku.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Tiny modifications on WebCore files to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * bindings/js/ScriptControllerHaiku.cpp: Style cleanup.
+        * loader/CachedFont.cpp: Haiku behaves like Qt, Gtk, or Chromium,
+        so many PLATFORM(HAIKU) were added to these functions.
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+        * page/EventHandler.cpp: Like the mac and Qt port, Haiku doesn't need the
+        invertSenseOfTabsToLinks() function.
+        * page/haiku/DragControllerHaiku.cpp: Style cleanup.
+        * platform/image-decoders/ImageDecoder.h: For image decoding Haiku
+        behaves like Cairo or Wx, (not like Skia).
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/text/PlatformString.h: Adding the String(BString&) and BString()
+        methods specific to Haiku.
+        * platform/text/UnicodeRange.h: Haiku needs to include stdint.h.
+        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp:
+        (WebCore::currentSearchLocaleID): Missing function.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding the ScrollbarTheme files.
+        https://bugs.webkit.org/show_bug.cgi?id=28125
+
+        * platform/haiku/ScrollbarThemeHaiku.cpp: Added.
+        (buttonWidth):
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeHaiku::ScrollbarThemeHaiku):
+        (WebCore::ScrollbarThemeHaiku::~ScrollbarThemeHaiku):
+        (WebCore::ScrollbarThemeHaiku::scrollbarThickness):
+        (WebCore::ScrollbarThemeHaiku::hasButtons):
+        (WebCore::ScrollbarThemeHaiku::hasThumb):
+        (WebCore::ScrollbarThemeHaiku::backButtonRect):
+        (WebCore::ScrollbarThemeHaiku::forwardButtonRect):
+        (WebCore::ScrollbarThemeHaiku::trackRect):
+        (WebCore::ScrollbarThemeHaiku::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeHaiku::paintButton):
+        (WebCore::ScrollbarThemeHaiku::paintThumb):
+        * platform/haiku/ScrollbarThemeHaiku.h: Added.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding eight simple files to WebCore/platform/graphics/haiku.
+        https://bugs.webkit.org/show_bug.cgi?id=28122
+
+        * platform/graphics/haiku/ColorHaiku.cpp: Added.
+        (WebCore::Color::Color):
+        (WebCore::Color::operator rgb_color):
+        (WebCore::focusRingColor):
+        * platform/graphics/haiku/FloatPointHaiku.cpp: Added.
+        (WebCore::FloatPoint::FloatPoint):
+        (WebCore::FloatPoint::operator BPoint):
+        * platform/graphics/haiku/FloatRectHaiku.cpp: Added.
+        (WebCore::FloatRect::FloatRect):
+        (WebCore::FloatRect::operator BRect):
+        * platform/graphics/haiku/GradientHaiku.cpp: Added.
+        (WebCore::Gradient::platformDestroy):
+        (WebCore::Gradient::platformGradient):
+        (WebCore::Gradient::fill):
+        * platform/graphics/haiku/IntPointHaiku.cpp: Added.
+        (WebCore::IntPoint::IntPoint):
+        (WebCore::IntPoint::operator BPoint):
+        * platform/graphics/haiku/IntRectHaiku.cpp: Added.
+        (WebCore::IntRect::IntRect):
+        (WebCore::IntRect::operator BRect):
+        * platform/graphics/haiku/IntSizeHaiku.cpp: Added.
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator BSize):
+        * platform/graphics/haiku/PathHaiku.cpp: Added.
+        (WebCore::Path::Path):
+        (WebCore::Path::~Path):
+        (WebCore::Path::operator=):
+        (WebCore::Path::hasCurrentPoint):
+        (WebCore::Path::contains):
+        (WebCore::Path::translate):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::clear):
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::debugString):
+        (WebCore::Path::apply):
+        (WebCore::Path::transform):
+        (WebCore::Path::strokeBoundingRect):
+
+2009-08-12  Lyon Chen  <lyon.chen@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Implement Keygen for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/KeygenWince.cpp: Added.
+
+2009-08-12  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubber-stamped by Kevin Ollivier.
+
+        Handle crash in wx due to null value passed to strlen in
+        the CString constructor.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificatePath):  Check for null return from getenv
+        and use default CString constructor instead.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: simple stubs to make it build for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/DragDataWince.cpp: Added.
+        * platform/wince/DragImageWince.cpp: Added.
+        * platform/wince/EditorWince.cpp: Added.
+        * platform/wince/KURLWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCEPORT: FileSystem and FileChooser
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/FileChooserWince.cpp: Added.
+        * platform/wince/FileSystemWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: implement Cursor for WINCE. There's no real cursor on most
+        WinMob devices. We pass the cursor info to application, which so that 
+        can determine what to do.
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/CursorWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: MIMETypeRegistry
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/MIMETypeRegistryWince.cpp: Added.
+
+2009-08-12  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Pasteboard and SearchPopupMenu
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/PasteboardWince.cpp: Added.
+        * platform/wince/SearchPopupMenuWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Add SharedTimerWince.cpp and SystemTimeWince.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/SharedTimerWince.cpp: Added.
+        * platform/wince/SystemTimeWince.cpp: Added.
+
+2009-08-12  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28204
+        Allow C+exceptions to be disabled in WebCore's V8 Mac build.
+
+        * WebCorePrefix.h:
+        Only undefine |try| and |catch| when building Objective-C[++],
+        leaving the C+library definitions intact for C++.
+
+2009-08-12  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a Custom Setter for DOMWindowEvent in the V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        Tests: fast/events/set-event-in-another-frame.html
+               fast/events/set-event-to-null.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Clean up custom getter/setter code, 
+            as it currently doesn't support a custom getter 
+            and a v8-specific custom setter simultaneously.
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * page/DOMWindow.idl:
+
+2009-08-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Merge wx/ImageSourceWx.cpp into ImageSource.cpp.  No changes to
+        ImageSource.cpp were needed, so this just deletes ImageSourceWx.cpp.
+
+        * WebCore.gypi:
+        * WebCoreSources.bkl:
+        * platform/graphics/wx/ImageSourceWx.cpp: Removed.
+        * webcore-wx.bkl:
+
+2009-08-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dave Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+        Build fix after r47099.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+
+2009-08-08  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        WINCE PORT: Implement Path for WINCE. Most code can be
+        reused for other ports that don't have native path support
+        https://bugs.webkit.org/show_bug.cgi?id=28188
+
+        Written also by George Staikos (including quadCurve() and bezier())
+
+        * platform/graphics/wince/PathWince.cpp: Added.
+        * platform/graphics/wince/PlatformPathWince.cpp: Added.
+        * platform/graphics/wince/PlatformPathWince.h: Added.
+        * platform/graphics/wince/WinceGraphicsExtras.h: Added.
+
+2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        "Double-click to add" new style button does not always show up [quick fix]
+        https://bugs.webkit.org/show_bug.cgi?id=28187
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+
+2009-08-12  Crystal Zhang <crystal.zhang@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: MediaPlayerProxy and MediaPlayerPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=28178
+
+        * platform/graphics/wince/MediaPlayerPrivateWince.h: Added.
+        * platform/graphics/wince/MediaPlayerProxy.cpp: Added.
+        * platform/graphics/wince/MediaPlayerProxy.h: Added.
+
+2009-08-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        HTML 5 database and LocalStorage is not persistent on the Symbian port of QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=28175
+
+        Call QDir::toNativeSeparators() before the path is passed to the OS.
+
+        Based on work by David Leong.
+        
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::pathByAppendingComponent):
+
+2009-08-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Minor build-fix for SVG Filter. Use getUnmultipliedImageData instead
+        of getImageData. This changed since r47099.
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+
+2009-08-12  Viet-Trung Luu  <viettrungluu@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Explicitly set control tints for Chromium/Mac, since the controls'
+        NSCell(s) lack an NSView and hence their tint isn't updated
+        automatically when the application is activated/deactivated.
+        https://bugs.webkit.org/show_bug.cgi?id=28108
+        http://crbug.com/18199
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::updateNSCellControlTint):
+        (WebCore::RenderThemeChromiumMac::paintCheckbox):
+        (WebCore::RenderThemeChromiumMac::paintRadio):
+        (WebCore::RenderThemeChromiumMac::paintButton):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintSearchField):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+
+2009-08-12  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix atomic string externalization crash.
+        Atomic string externalization assumes that all non-empty strings
+        can be externalized which is untrue on 64-bit.  This change fixed
+        that.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This bug causes loads of test crashes, no need to add new tests
+        specifically for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Fix box-shadow painting in r47103. The edge should not be blurry.
+        Also optimize by not having to save and restore painter state.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Adam Treat.
+
+        [Qt] Fix coding style in GraphicsContextQt.cpp
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtCompositionMode):
+        (WebCore::toQtLineCap):
+        (WebCore::toQtLineJoin):
+        (WebCore::GraphicsContextPlatformPrivate::p):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::pen):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+
+2009-08-12  Szabo Carol  <carol.szabo@nokia.com>
+
+        Reviewed by Simon Hausmann and Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23291
+
+        [Qt] Partial support for -webkit-box-shadow. Blur is not support and
+        the shadow still does not go well with border radius.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-08-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Use AM_V_GEN in a few more places, for less noisy builds.
+
+        * GNUmakefile.am:
+
+2009-08-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter premultiplied color support for getImageDate/putImageData
+        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+
+        Some SVG Filters need premultiplied ImageData for the calculation. Therefore getImageData
+        and putImageData of ImageBuffer need support for premultiplied colors.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::getImageData):
+        (WebCore::CanvasRenderingContext2D::putImageData):
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/wx/ImageBufferWx.cpp:
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+
+2009-08-12  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Changed Number.bytesToString to support low-resolution output.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28146
+
+        * inspector/front-end/utilities.js:
+        (Number.bytesToString):
+
+2009-08-12  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for hooking BeginPaint/EndPaint on 64Bit Windows
+
+        Webkit uses the runtime patching trick explained by "Feng Yuan" for
+        hooking these paint functions. It currently supports only 32bit assembly
+        code. This patch adds support for 64Bit version. Since inline-assemblies
+        are not supported for 64Bit, we have use a seperate .asm file.
+
+        * WebCore.pro:
+        * plugins/win/PaintHooks.asm: Added.
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+        (WebCore::hook):
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make it harder to misuse try* allocation routines
+        https://bugs.webkit.org/show_bug.cgi?id=27469
+
+        Add forwarding header for PossiblyNull type, and add missing null check
+        to ImageBuffer creation.
+
+        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Restrict use of FuncDeclNode & FuncExprNode to the parser.
+        https://bugs.webkit.org/show_bug.cgi?id=28209
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+            Function signature change.
+
+2009-08-11  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Merge skia/ImageSourceSkia.cpp into ImageSource.cpp.
+
+        * WebCore.gypi: Remove deleted file, plus a file that was deleted a while back.
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData): Use slightly shorter syntax.
+        (WebCore::ImageSource::filenameExtension): Use shorter syntax.
+        (WebCore::ImageSource::createFrameAtIndex): Remove redundant call, clarify comments, reject all empty images.
+        (WebCore::ImageSource::frameHasAlphaAtIndex): Clarify comments, use shorter syntax.
+        * platform/graphics/skia/ImageSourceSkia.cpp: Removed.
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers do not exit when the last parent document exits
+        https://bugs.webkit.org/show_bug.cgi?id=28170
+
+        Prevents Documents from being suspended/placed in the page cache if they are associated with shared workers.
+
+        Added vector cache instead of nested hash tables for SharedWorker repository.
+
+        Added SharedWorkerRepository::documentDetached API.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        Notifies SharedWorkerRepository when the document is closing.
+        * loader/FrameLoader.cpp:
+        Updated FrameLoader to not cache the Document if it is associated with a SharedWorker (since we can't suspend workers yet, we need to shut them down).
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::create):
+        (WebCore::SharedWorkerProxy::isClosing):
+        Renamed from closing().
+        (WebCore::SharedWorkerProxy::matches):
+        Added manual equality function to replace old hash lookup.
+        (WebCore::SharedWorkerProxy::isDocumentInWorkerDocuments):
+        Checks to see if a document is in the worker's list of documents. Used to determine if page is suspendable.
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
+        Added tracking of the worker's list of documents for lifecycle purposes.
+        (WebCore::SharedWorkerProxy::documentDetached):
+        Shuts down the proxy when the last associated document is detached.
+        (WebCore::SharedWorkerProxy::close):
+        Marks the proxy as closed so it is no longer shared with new instances.
+        (WebCore::SharedWorkerProxy::workerContextDestroyed):
+        Removes the proxy from the repository/frees the proxy when the associated SharedWorkerContext is destroyed.
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        closing()->isClosing()
+        (WebCore::SharedWorkerRepository::documentDetached):
+        (WebCore::SharedWorkerRepository::hasSharedWorkers):
+        Used by FrameLoader to determine if a page has shared workers and so cannot be suspended/cached.
+        (WebCore::DefaultSharedWorkerRepository::hasSharedWorkers):
+        (WebCore::DefaultSharedWorkerRepository::removeProxy):
+        Invoked by workerContextDestroyed() to remove a SharedWorkerProxy from the repository.
+        (WebCore::DefaultSharedWorkerRepository::documentDetached):
+        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        * workers/DefaultSharedWorkerRepository.h:
+        * workers/SharedWorkerRepository.h:
+
+2009-08-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 28200 - ListMarker should be included as part of the text value to parse
+        https://bugs.webkit.org/show_bug.cgi?id=28200
+
+        When returning text through the marker range attributes, the list marker text should
+        also be included. It isn't included by default because a TextIterator is used which
+        only looks at Nodes for text. A list marker does not have a corresponding node,
+        so its text is not returned through accessibility. That is, until now.
+
+        Test: platform/mac/accessibility/string-range-contains-listmarker.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::listMarkerTextForRange):
+        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]):
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+        * rendering/RenderListItem.h:
+
+        Make markerText() public so that accessibility code can access it.
+
+2009-08-11  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Move cairo/ImageSourceCairo.cpp to ImageSource.cpp in preparation for
+        merging most of the other ImageSource*.cpp files with it.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/ImageSource.cpp: Copied from WebCore/platform/graphics/cairo/ImageSourceCairo.cpp.
+        * platform/graphics/cairo/ImageSourceCairo.cpp: Removed.
+
+2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Cairo-based Windows port does not handle the https protocol.
+        https://bugs.webkit.org/show_bug.cgi?id=28171.
+
+        No new tests needed.  Existing https tests show this failure
+        for WinCairo builds.
+
+        * WebCore.vcproj/WebCoreCURL.vsprops: Add a few preprocessor
+          definitions for SSL support in cURL.
+        * platform/network/curl/ResourceHandleManager.h: Add new
+          certificate path member variable.
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificateBundlePath): New method to retrieve the
+          proper certificate resource bundle path.
+        (WebCore::ResourceHandleManager::initializeHandle): Check for
+          the resource bundle and use if available to activate SSL
+          support.
+
+2009-08-11  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Use Clipboard::create() instead of the constructor of Clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28127
+
+        * editing/haiku/EditorHaiku.cpp:
+        (WebCore::Editor::newGeneralClipboard):
+        * page/haiku/EventHandlerHaiku.cpp:
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::createDraggingClipboard):
+        * platform/haiku/ClipboardHaiku.cpp: Style cleanup. There were many whitespace end of lines.
+        (WebCore::ClipboardHaiku::ClipboardHaiku):
+        (WebCore::ClipboardHaiku::clearAllData):
+        (WebCore::ClipboardHaiku::getData):
+        (WebCore::ClipboardHaiku::setData):
+        (WebCore::ClipboardHaiku::types):
+        (WebCore::ClipboardHaiku::dragLocation):
+        (WebCore::ClipboardHaiku::dragImage):
+        (WebCore::ClipboardHaiku::setDragImage):
+        (WebCore::ClipboardHaiku::dragImageElement):
+        (WebCore::ClipboardHaiku::createDragImage):
+        (WebCore::ClipboardHaiku::declareAndWriteDragImage):
+        (WebCore::ClipboardHaiku::writeURL):
+        (WebCore::ClipboardHaiku::writeRange):
+        (WebCore::ClipboardHaiku::hasData):
+        * platform/haiku/DragDataHaiku.cpp:
+        (WebCore::DragData::createClipboard):
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by NOBODY (build break).
+
+        Speculative GTK build fix
+
+        * GNUmakefile.am:
+        Added missing .idl file, and added notifications directory to IDL_PATH.
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by NOBODY (build break).
+
+        Speculative Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Added missing build steps for non-debug targets.
+
+2009-08-11  Drew Wilson <atwilson@google.com>
+
+        Reviewed by NOBODY (build break)
+
+        Speculative build fix for Qt build.
+
+        * WebCore.pro: Added /notifications to include path
+
+2009-08-11  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Desktop Notifications API
+        https://bugs.webkit.org/show_bug.cgi?id=25463
+
+        Adds an implementation of desktop notifications, behind the compile-time
+        flag ENABLE(NOTIFICATIONS).  This code simply relays calls on the JavaScript
+        API through a NotificationProvider interface, which must provide the services
+        to actually notify the user and manage the desktop.  This provider is injected
+        into WebKit through the ChromeClient for normal page contexts and through the
+        WorkerThread for worker contexts.
+
+        A permissions API is defined on a per-origin basis, which allows a web page
+        to check if its origin is allowed to show desktop notifications, and to request
+        permission for its origin.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDesktopNotificationsCustom.cpp: Added.
+        (WebCore::JSNotificationCenter::requestPermission):
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::JSNotification::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toNotification):
+        * dom/EventTarget.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::notificationPresenter):
+        * notifications: Added.
+        * notifications/Notification.cpp: Added.
+        (WebCore::Notification::Notification):
+        (WebCore::Notification::~Notification):
+        (WebCore::Notification::show):
+        (WebCore::Notification::cancel):
+        (WebCore::Notification::ondisplay):
+        (WebCore::Notification::setOndisplay):
+        (WebCore::Notification::onerror):
+        (WebCore::Notification::setOnerror):
+        (WebCore::Notification::onclose):
+        (WebCore::Notification::setOnclose):
+        (WebCore::Notification::getAttributeEventListener):
+        (WebCore::Notification::setAttributeEventListener):
+        (WebCore::Notification::clearAttributeEventListener):
+        (WebCore::Notification::dispatchDisplayEvent):
+        (WebCore::Notification::dispatchErrorEvent):
+        (WebCore::Notification::dispatchCloseEvent):
+        (WebCore::Notification::addEventListener):
+        (WebCore::Notification::removeEventListener):
+        (WebCore::Notification::handleEvent):
+        (WebCore::Notification::dispatchEvent):
+        * notifications/Notification.h: Added.
+        (WebCore::Notification::create):
+        (WebCore::Notification::isHTML):
+        (WebCore::Notification::url):
+        (WebCore::Notification::contents):
+        (WebCore::Notification::scriptExecutionContext):
+        (WebCore::Notification::toNotification):
+        (WebCore::Notification::refEventTarget):
+        (WebCore::Notification::derefEventTarget):
+        * notifications/Notification.idl: Added.
+        * notifications/NotificationCenter.cpp: Added.
+        (WebCore::NotificationCenter::NotificationCenter):
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        * notifications/NotificationCenter.h: Added.
+        (WebCore::NotificationCenter::create):
+        (WebCore::NotificationCenter::createHTMLNotification):
+        (WebCore::NotificationCenter::createNotification):
+        (WebCore::NotificationCenter::context):
+        (WebCore::NotificationCenter::presenter):
+        * notifications/NotificationCenter.idl: Added.
+        * notifications/NotificationContents.h: Added.
+        (WebCore::NotificationContents::NotificationContents):
+        (WebCore::NotificationContents::icon):
+        (WebCore::NotificationContents::title):
+        (WebCore::NotificationContents::body):
+        * notifications/NotificationPresenter.h: Added.
+        (WebCore::NotificationPresenter::):
+        (WebCore::NotificationPresenter::~NotificationPresenter):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::notificationPresenter):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+        (WebCore::DOMWindow::webkitNotifications):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/Page.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        (WebCore::WorkerContext::webkitNotifications):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::getNotificationPresenter):
+        (WebCore::WorkerThread::setNotificationPresenter):
+
+2009-08-11  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console Drawer is Toggling instead of Staying Open
+        https://bugs.webkit.org/show_bug.cgi?id=28115
+
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer.prototype.showView): ensures the drawer will be open and showing the provided view
+        * inspector/front-end/inspector.js:
+        (WebInspector.showConsole): usees the new showView to guarantee the Drawer will be open
+        (WebInspector.showChanges): uses the new showView guarantee the Drawer will be open
+
+2009-08-11  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] WMLPageState is not allowed to store the active card, it needs to be done per document
+        https://bugs.webkit.org/show_bug.cgi?id=28180
+
+        Don't store the active WMLCardElement in WMLPageState, but in WMLDocument.
+        Otherwhise this may lead to crashes related to intrinsic event exeuction.
+
+        Unfortunately select elements aren't testable by the layout tests, so adding
+        a new manual test reproducing the crash.
+
+        * manual-tests/wml/select-onpick-event-crash.wml: Added.
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::determineActiveCard):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::defaultEventHandler):
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::finishedParsing):
+        * wml/WMLDocument.h:
+        (WebCore::WMLDocument::activeCard):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::WMLPageState):
+        * wml/WMLPageState.h:
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLRefreshElement.cpp:
+        (WebCore::WMLRefreshElement::executeTask):
+
+2009-08-07  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28073
+        Treat icons with no bit count and no color count as 256-color for
+        purposes of quality ranking.  Also fix a couple cases of a style
+        violation.
+
+        Test: fast/images/icon-0colors.html
+
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::readDirectoryEntry):
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Need to refactor WorkerObjectProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=28136
+
+        Added WorkerReportingProxy for reporting worker state (exceptions, console messages, thread exited) to the parent.
+
+        Existing tests are sufficient, as this is only a refactoring.
+
+        * GNUmakefile.am:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.gypi:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.vcproj/WebCore.vcproj:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.xcodeproj/project.pbxproj:
+        Added WorkerReportingProxy.h to build.
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
+        * workers/DedicatedWorkerThread.cpp:
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        Changed constructor to pass WorkerReportingProxy to base class.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        Updated SharedWorkerProxy to implement WorkerReportingProxy interface.
+        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
+        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
+        (WebCore::SharedWorkerProxy::workerContextClosed):
+        (WebCore::SharedWorkerProxy::workerContextDestroyed):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        Now passes in WorkerReportingProxy when creating SharedWorkerThread.
+        * workers/SharedWorkerContext.cpp:
+        * workers/SharedWorkerContext.h:
+        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        Passes WorkerReportingProxy to base class constructor.
+        * workers/SharedWorkerThread.h:
+        Constructor now takes a WorkerReportingProxy.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        Moved code that calls workerContextDestroyed() into base class so shared workers share this functionality.
+        (WebCore::WorkerContext::close):
+        Now notifies WorkerReportingProxy when the thread is closing.
+        (WebCore::WorkerContext::reportException):
+        Reports exceptions via WorkerReportingProxy.
+        (WebCore::WorkerContext::addMessage):
+        Reports console messages via WorkerReportingProxy.
+        * workers/WorkerContext.h:
+        * workers/WorkerObjectProxy.h:
+        (WebCore::WorkerObjectProxy::workerContextClosed):
+        Default empty implementation for dedicated workers.
+        * workers/WorkerReportingProxy.h: Added.
+        Base interface that contains APIs moved from WorkerObjectProxy.
+        (WebCore::WorkerReportingProxy::~WorkerReportingProxy):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        Updated constructor to accept a WorkerReportingProxy.
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::workerReportingProxy):
+
+2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Fix the Qt build after r47022.
+
+        Use the new markChildren() pattern for marking aggregate/child objects.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::markChildren):
+        (JSC::Bindings::QtInstance::markAggregate):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
+        * bridge/qt/qt_runtime.h:
+
+2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix the build on the Qt build bot by making the generated JS bindings
+        files depend on the code generator itself.
+
+        * WebCore.pro:
+
+2009-08-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Stack overflow crash in JavaScript garbage collector mark pass
+        https://bugs.webkit.org/show_bug.cgi?id=12216
+
+        Make WebCore use the new iterative marking logic.
+
+        Tests: fast/js/nested-object-gc.html
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::markChildren):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::markChildren):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markActiveObjectsForContext):
+        (WebCore::markDOMObjectWrapper):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::markChildren):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::markChildren):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::markChildren):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        (WebCore::JSDedicatedWorkerContext::markChildren):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::markChildren):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::markJSFunction):
+        * bindings/js/JSEventListener.h:
+        * bindings/js/JSMessageChannelCustom.cpp:
+        (WebCore::JSMessageChannel::markChildren):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::markChildren):
+        * bindings/js/JSNavigatorCustom.cpp:
+        (WebCore::JSNavigator::markChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::markAggregate):
+        * bindings/js/JSNodeFilterCondition.h:
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::markChildren):
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        (WebCore::JSNodeIterator::markChildren):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::markChildren):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::markChildren):
+        * bindings/js/JSSharedWorkerCustom.cpp:
+        (WebCore::JSSharedWorker::markChildren):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::markChildren):
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        (WebCore::JSTreeWalker::markChildren):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::markChildren):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::markChildren):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::markChildren):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventListener.h:
+        (WebCore::EventListener::markJSFunction):
+        (WebCore::markIfNotNull):
+        * dom/NodeFilter.h:
+        (WebCore::NodeFilter::markAggregate):
+        * dom/NodeFilterCondition.h:
+        (WebCore::NodeFilterCondition::markAggregate):
+        * dom/RegisteredEventListener.h:
+        (WebCore::markEventListeners):
+        * page/DOMWindow.h:
+        * workers/WorkerContext.h:
+
+2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Renamed all V8 NPN_ functions to _NPN_ to match JSC and make them "private".
+        https://bugs.webkit.org/show_bug.cgi?id=28089
+
+        Rename all the NPN_foo functions to _NPN_foo so that they can't directly be
+        called by mistake.  This roughly matches the way JSC does it, which is an
+        additional advantage.
+
+        * bindings/v8/NPV8Object.cpp:
+        (npCreateV8ScriptObject):
+        (_NPN_Invoke):
+        (_NPN_InvokeDefault):
+        (_NPN_Evaluate):
+        (_NPN_EvaluateHelper):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_SetException):
+        (_NPN_Enumerate):
+        (_NPN_Construct):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::clearScriptObjects):
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
+        * bindings/v8/V8NPObject.cpp:
+        (npObjectInvokeImpl):
+        (npObjectGetProperty):
+        (npObjectIndexedPropertyGetter):
+        (npObjectGetIndexedProperty):
+        (npObjectSetProperty):
+        (npObjectIndexedPropertySetter):
+        (npObjectSetIndexedProperty):
+        (weakNPObjectCallback):
+        (createV8ObjectForNPObject):
+        (forgetV8ObjectForNPObject):
+        * bindings/v8/V8NPUtils.cpp:
+        (getStringIdentifier):
+        * bindings/v8/npruntime.cpp:
+        * bindings/v8/npruntime_impl.h:
+
+2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Change ___Storage.key() to match current spec behavior.
+        https://bugs.webkit.org/show_bug.cgi?id=28112
+
+        The current WebStorage spec says that ___Storage.key() should return null when
+        the index is out of bounds, rather than an exception.  A bunch of logic can be
+        simplified after this change.
+
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::getPropertyNames):
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
+        * storage/Storage.cpp:
+        (WebCore::Storage::key):
+        * storage/Storage.h:
+        * storage/Storage.idl:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::key):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::key):
+        * storage/StorageMap.h:
+
+2009-08-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28087
+
+        Mods for a chrome specific impl of ApplicationCacheHost.
+
+        * The public section of the interface is the same, but we use
+        PLATFORM(CHROMIUM) to identify which parts of the private
+        section are shared. The chrome specific internals are encapsulated
+        in a seperate ApplicationCacheHostInternal class. WebCore common
+        code only contains a forward reference to this class.
+
+        * Cleanup a couple of stale comments.
+
+        * Have window.applicationCache return null to script when the
+        feature is disabled in the preferences.
+        
+        No new tests.
+
+        * loader/appcache/ApplicationCacheHost.cpp:
+        * loader/appcache/ApplicationCacheHost.h:
+        (WebCore::ApplicationCacheHost::documentLoader):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::applicationCache):
+
+2009-08-10  Crystal Zhang  <crystal.zhang@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Implement GraphicsContext::fillRoundRect() for WINCE port
+        https://bugs.webkit.org/show_bug.cgi?id=27842
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::rectCenterPoint):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::drawRoundCorner):
+
+2009-08-10  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Resources / Graphs should support filtering
+        https://bugs.webkit.org/show_bug.cgi?id=20629
+
+        Introduces a filter bar for resources.
+
+        Thanks to Matt Lilek for the CSS scope bar.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.createFilterElement):
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.categoryOrder.filter):
+        (WebInspector.ResourcesPanel.prototype._updateFilter):
+        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction after http://trac.webkit.org/changeset/46978
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):  Correct
+         deprecated removeRef to new removeFragmentIdentifier.
+
+2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Background color formatting lost on enter
+        https://bugs.webkit.org/show_bug.cgi?id=20348
+
+        This patch makes background color be preserved during editing.
+        In particular, editingStyleAtPosition would include the background color when obtaining styles.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::): Added CSSPropertyBackgroundColor to editingStyleProperties
+
+2009-08-10  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Stop sending QEvent::CursorChange to Qt for mouse move.
+
+        Verify if the cursor didn't change in WidgetQt::setCursor,
+        just like the mac port does.
+
+        Thanks to Adriano Rezendo for spotting and debugging the
+        issue.
+
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+
+2009-08-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28165
+        Application cache maximum size cannot be set before the database is opened
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::vacuumDatabaseFile): Open appcache database if it isn't
+        open yet.
+
+2009-08-10  Vitaly Repeshko  <vitalyr@quad.spb.corp.google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix memory leak in node event listeners. See http://crbug.com/17400.
+        https://bugs.webkit.org/show_bug.cgi?id=28156
+
+        * bindings/scripts/CodeGeneratorV8.pm: Custom event handler accessors now apply to all Node descendants.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::isObjectListener): Added virtual method to detect listeners that have weak references to JS objects.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8ObjectEventListener.cpp:
+        * bindings/v8/V8ObjectEventListener.h:
+        (WebCore::V8ObjectEventListener::isObjectListener):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::removeHiddenDependency):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp: Moved custom accessors from V8ElementCustom.cpp.
+        (WebCore::toEventType):
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener): Made static.
+
+2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Cleanup DOM Storage namespace shutdown code usage of security origin.
+        https://bugs.webkit.org/show_bug.cgi?id=28094
+
+        If a storage namespace is not explicitly closed, be sure to do so on
+        destruction of the object.  In addition, the close call should wait
+        on the background thread finishing its syncing.  (Not doing so is actually
+        a regression from the original LocalStorage code.)
+
+        There's no point to passing in the SecurityOrigin when copying a storage
+        area since what was passed in is exactly what is stored within each
+        storage area.  In addition, the non-copy constructor should take in a
+        PassRefPtr rather than a pointer since that pointer was only passed into
+        the constuctor for RefPtr's anyway.
+
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        (WebCore::StorageAreaImpl::copy):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::~StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::close):
+        * storage/StorageNamespaceImpl.h:
+
+2009-08-10  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed, build fix.
+
+        Rename ref() to fragmentIdentifier() in the wml/ subdirectory.
+
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::determineActiveCard):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::canAccessDeck):
+
+2009-08-10  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        Exclude JSMedia.cpp from build since it is included in DerivedSources.cpp.
+        Fixes linker warnings.        
+        
+        Corrected spelling of JSInspectorBackend.cpp.
+        
+        Other changes related to actually using a Visual Studio to open/save the vcproj file.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove a dead #define.
+
+        * bindings/js/JSDOMBinding.cpp:
+
+2009-08-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Update KURLGoogle for ref* method renames in
+        http://trac.webkit.org/changeset/46978.
+        https://bugs.webkit.org/show_bug.cgi?id=28084
+
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Renamed ref and setRef to fragmentIdentifier and
+            setFragmentIdentifier, respectively.
+        * platform/KURLGoogle.cpp: Ditto, plus all other ref* method names.
+
+2009-08-10  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        [Gtk] Unreviewed. Fix the nit as suggested by Darin in bug #28144
+        for r46989.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::finishedCallback):
+
+2009-08-10  John Kjellberg  <john.kjellberg@power.alstom.com>
+
+        Reviewed by Darin Adler.
+
+        Memory leak in error handling code for SOUP interface
+        https://bugs.webkit.org/show_bug.cgi?id=28144
+
+        Freed memory leaked in error handling code for soup requests.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::finishedCallback):
+        (WebCore::):
+
+2009-08-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide graceful handling of the situation when an embedder invokes
+        visited link update methods before a Page constructor has been called.
+        https://bugs.webkit.org/show_bug.cgi?id=28149
+
+        * page/Page.cpp:
+        (WebCore::Page::allVisitedStateChanged): Added a null-check for allPages.
+        (WebCore::Page::visitedStateChanged): Ditto.
+
+2009-08-10  Xan Lopez  <xlopez@igalia.com>
+
+        Fix GTKbuild.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-08-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove the redundant, Windows CE-only GlyphBuffer::advnaceData()
+
+        * platform/graphics/GlyphBuffer.h: Removed advanceData().
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawText): Changed to use advances(from)
+            instead of advanceData() from.
+
+2009-08-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Remove workaround for older libsoup versions.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+
+2009-08-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Let startHttp validate the URI instead of doing it, with potential
+        crashes, in ::start.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+
+2009-08-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        When empty <input> is focused, getSelection() exposes shadow tree nodes
+        https://bugs.webkit.org/show_bug.cgi?id=15903
+
+        Test: fast/forms/shadow-tree-exposure.html
+
+        * page/DOMSelection.cpp:
+        (WebCore::selectionShadowAncestor): Added.
+        (WebCore::DOMSelection::anchorNode): Return the parent of the shadow
+        ancestor if the selection is in a shadow tree. Matches Firefox.
+        (WebCore::DOMSelection::anchorOffset): Return the index of the shadow
+        ancestor if the selection is in a shadow tree. Matches Firefox.
+        (WebCore::DOMSelection::focusNode): Ditto.
+        (WebCore::DOMSelection::focusOffset): Ditto.
+        (WebCore::DOMSelection::baseNode): More of the same, but since this
+        is a WebKit-invented property, it does not match Firefox.
+        (WebCore::DOMSelection::baseOffset): Ditto.
+        (WebCore::DOMSelection::extentNode): Ditto.
+        (WebCore::DOMSelection::extentOffset): Ditto.
+        (WebCore::DOMSelection::isCollapsed): Return true even when the
+        selection is a range, if the selection is in the shadow tree.
+        Matches Firefox. Also changed behavior when called and the frame
+        is gone to return true instead of false which makes more sense.
+        (WebCore::DOMSelection::empty): Use clear() just like the other
+        selection-clearing function in this file does.
+        (WebCore::DOMSelection::getRangeAt): Return a range that starts
+        and ends before the shadow ancestor. Matches Firefox.
+
+2009-08-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make all status bar button images glyph-based.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28124
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        * inspector/front-end/Images/clearConsoleButtonGlyph.png: Added.
+        * inspector/front-end/Images/clearConsoleButtons.png: Removed.
+        * inspector/front-end/Images/consoleButtonGlyph.png: Added.
+        * inspector/front-end/Images/consoleButtons.png: Removed.
+        * inspector/front-end/Images/dockButtonGlyph.png: Added.
+        * inspector/front-end/Images/dockButtons.png: Removed.
+        * inspector/front-end/Images/enableButtons.png: Removed.
+        * inspector/front-end/Images/enableOutlineButtonGlyph.png: Added.
+        * inspector/front-end/Images/enableSolidButtonGlyph.png: Added.
+        * inspector/front-end/Images/excludeButtonGlyph.png: Added.
+        * inspector/front-end/Images/excludeButtons.png: Removed.
+        * inspector/front-end/Images/focusButtonGlyph.png: Added.
+        * inspector/front-end/Images/focusButtons.png: Removed.
+        * inspector/front-end/Images/largerResourcesButtonGlyph.png: Added.
+        * inspector/front-end/Images/largerResourcesButtons.png: Removed.
+        * inspector/front-end/Images/nodeSearchButtonGlyph.png: Added.
+        * inspector/front-end/Images/nodeSearchButtons.png: Removed.
+        * inspector/front-end/Images/pauseOnExceptionButtonGlyph.png: Added.
+        * inspector/front-end/Images/pauseOnExceptionButtons.png: Removed.
+        * inspector/front-end/Images/percentButtonGlyph.png: Added.
+        * inspector/front-end/Images/percentButtons.png: Removed.
+        * inspector/front-end/Images/recordButtonGlyph.png: Added.
+        * inspector/front-end/Images/recordButtons.png: Removed.
+        * inspector/front-end/Images/recordToggledButtonGlyph.png: Added.
+        * inspector/front-end/Images/reloadButtonGlyph.png: Added.
+        * inspector/front-end/Images/reloadButtons.png: Removed.
+        * inspector/front-end/Images/undockButtonGlyph.png: Added.
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.createStatusBarButton):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-08-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        KURL ref() methods should be fragmentIdentifier() methods 
+        https://bugs.webkit.org/show_bug.cgi?id=28084
+
+        In addition to the renames, also took the chance to replace all use of:
+        setRef(String());
+        with:
+        removeFragmentIdentifier();
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::fragmentIdentifier):
+        (WebCore::KURL::hasFragmentIdentifier):
+        (WebCore::KURL::setFragmentIdentifier):
+        (WebCore::KURL::removeFragmentIdentifier):
+        (WebCore::KURL::prettyURL):
+        (WebCore::equalIgnoringFragmentIdentifier):
+        * platform/KURL.h:
+
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setHash): Rework with new names, and to use the new equalIgnoringNullity() method.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::internalLinkElement):
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::isSVGCursorIdentifier):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::isCurrentDocument):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::hash):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::isURLAllowed):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        (WebCore::FrameLoader::gotoAnchor):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::FrameLoader::scrollToAnchor):
+        (WebCore::FrameLoader::shouldReload):
+        (WebCore::FrameLoader::urlsMatchItem):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::resourceForURL):
+        (WebCore::ApplicationCache::resourceForRequest):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::cacheForMainRequest):
+        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest):
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        (WebCore::ApplicationCacheGroup::didFail):
+        (WebCore::ApplicationCacheGroup::addEntry):
+        * loader/appcache/ApplicationCacheResource.h:
+        (WebCore::ApplicationCacheResource::create):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::findOrCreateCacheGroup):
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
+        * loader/appcache/ManifestParser.cpp:
+        (WebCore::parseManifest):
+        * page/Location.cpp:
+        (WebCore::Location::hash):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::isURLAllowed):
+        * workers/WorkerLocation.cpp:
+        (WebCore::WorkerLocation::hash):
+
+2009-08-10  Andy Shaw <andy.shaw@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix endless loop when the application is quit by a secondary thread during a sync xml http request.
+
+        Replace the m_finished state variable and the call to QCoreApplication::processEvents() with
+        a dedicated QEventLoop, that can be terminated from within WebCoreSynchronousLoader as well
+        as from Qt through its knowledge of globally registered eventloops.
+
+        There is no unit test for this bug as it would require exporting additional symbols and
+        introduce the synchronous loader as global variable just for the test.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::waitForCompletion):
+
+2009-08-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Make properties inspection serialized.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28078
+
+        * inspector/front-end/DOMAgent.js:
+        (InspectorController.getPrototypes):
+        (InspectorController.getProperties):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getPrototypes):
+        (InjectedScript.getProperties):
+        (InjectedScript.setPropertyValue):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectRef):
+        (WebInspector.ObjectPropertyRef):
+        (WebInspector.ObjectPropertiesSection.prototype.onpopulate):
+        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertiesSection.prototype._update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onattach):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] wml.css lacks <pre> support
+        https://bugs.webkit.org/show_bug.cgi?id=28135
+
+        Add <pre> support for WML.
+        Extended fast/wml/text-emphasis.wml to cover <pre> support.
+
+        * css/wml.css: <pre> section copied from html.css
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix non-WML enabled builds. Remove ENABLE(WML) guards around the switch cases 'FrameLoadTypeBackWMLDeckNotAccessible'.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::isBackForwardLoadType):
+        (WebCore::FrameLoader::restoreDocumentState):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::loadItem):
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Deck access control is completly broken
+        https://bugs.webkit.org/show_bug.cgi?id=27721
+
+        Rewrite WML deck access control, actually works now standalone and within LayoutTests.
+        Added several new layout tests covering local & remote access support.
+
+        In order to detect WML task execution failures from within the WML layout tests a new
+        method Console::lastWMLErrorMessage() has been added, returning the last recorded WML
+        error message. Change WML log messages to dump to InspectorClient, just like it's done
+        for HTML - we used to behave like JSMessageSource, which is wrong.
+
+        Tests: http/tests/wml/access-target-domain-deny.html
+               http/tests/wml/access-target-path-deny.html
+               http/tests/wml/access-target.html
+               wml/access-target-deny.html
+               wml/access-target.html
+
+        * inspector/ConsoleMessage.h:
+        (WebCore::ConsoleMessage::source): Added public method to fetch the message source type.
+        (WebCore::ConsoleMessage::message): Added public method to access the error message.
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::consoleMessages): Added for Console::lastWMLErrorMessage(), to be able to crawl through the list of dumped messages.
+        * loader/FrameLoader.cpp: Recognize 'FrameLoadTypeBackWMLDeckNotAccessible', all guarded by ENABLE(WML).
+        (WebCore::isBackForwardLoadType):
+        (WebCore::FrameLoader::restoreDocumentState):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoaderTypes.h:
+        (WebCore::): Add new load type 'FrameLoadTypeBackWMLDeckNotAccessible', behaving like FrameLoadTypeBack plus WML specific information.
+        * page/Console.cpp:
+        (WebCore::Console::addMessage): Don't dump WML messages using ChromeClient (as it's done for JSMessageSource), but go through InspectorController.
+        (WebCore::Console::lastWMLErrorMessage): Crawl InspectorController::consoleMssages() to look up the last WML error message, if present.
+        * page/Console.h:
+        * page/Console.idl: Add "[DontEnum] DOMString lastWMLErrorMessage()".
+        * wml/WMLAccessElement.cpp: Store path/domain as member variables and pass them to WMLPageState once in insertedIntoDocument().
+        (WebCore::WMLAccessElement::parseMappedAttribute):
+        (WebCore::WMLAccessElement::insertedIntoDocument):
+        * wml/WMLAccessElement.h:
+        * wml/WMLCardElement.cpp: Handle 'FrameLoadTypeBackWMLDeckNotAccessible' as deck-entry method. Report WML error in current deck.
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLDocument.cpp: Enable deck-access control in finishedParsing. Take care of method name changes in WMLPageState.
+        (WebCore::WMLDocument::finishedParsing):
+        (WebCore::WMLDocument::initialize):
+        * wml/WMLErrorHandling.cpp: Never report 'WMLErrorDeckNotAccessible' messages through the tokenizer, that would alter the page into error state.
+        (WebCore::reportWMLError):
+        * wml/WMLPageState.cpp: Completly rewrote access path/domain parsing & deck-access control, strictly following the WML spec. All covered by tests.
+        (WebCore::WMLPageState::WMLPageState):
+        (WebCore::normalizedHostName):
+        (WebCore::hostFromURL):
+        (WebCore::urlForHistoryItem):
+        (WebCore::tryAccessHistoryURLs):
+        (WebCore::WMLPageState::processAccessControlData):
+        (WebCore::WMLPageState::resetAccessControlData):
+        (WebCore::WMLPageState::canAccessDeck):
+        (WebCore::WMLPageState::hostIsAllowedToAccess):
+        (WebCore::WMLPageState::pathIsAllowedToAccess):
+        * wml/WMLPageState.h:
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        FrameLoadType / WebFrameLoadType enums are out of sync
+        https://bugs.webkit.org/show_bug.cgi?id=28132
+
+        Modify FrameLoadType enum to match the order of WebFrameLoadType in WebFramePrivate.h / IWebFramePrivate.idl.
+        The mac/win public API exposes the old 'FrameLoadTypeReloadAllowingStaleData' value, which resides between
+        'FrameLoadTypeReload' and 'FrameLoadTypeSame'. Work around this problem, by assigning 'FrameLoadTypeSame = FrameLoadTypeReload 2'.
+
+        Add a note to the FrameLoadType enum to keep it in sync with WebFramePrivate.h & IWebFramePrivate.idl.
+
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] manual-tests/wml/onevent-prev.wml crashes
+        https://bugs.webkit.org/show_bug.cgi?id=27722
+
+        Fix intrinsic event execution, leading to crashes.
+        First finish parsing the document, then execute the events. Not the other way round.
+        -> exposes bugs all over the WML layout tests, which relied on that quirk.
+
+        Fixes manual-tests/wml/onevent-prev.wml.
+
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::WMLDocument):
+        (WebCore::WMLDocument::finishedParsing):
+        (WebCore::WMLDocument::initialize):
+        * wml/WMLDocument.h:
+
+2009-08-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Update WebCore.gyp to add ImageBuffer.cpp,
+        introduced by http://trac.webkit.org/changeset/46956.
+        https://bugs.webkit.org/show_bug.cgi?id=27844
+
+        * WebCore.gypi: Added ImageBuffer.cpp.
+
+2009-08-08  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by Jan Michael Alonzo.
+
+        Add [DontEnum] to WML specific initializeWMLPageState/resetWMLPageState methods, to assure
+        fast/dom/Window/window-properties.html doesn't show any differences when WML is enabled.
+
+        * dom/Document.idl:
+
+2009-08-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG Filter need feColorMatrix implementation
+        [https://bugs.webkit.org/show_bug.cgi?id=27711]
+
+        Adds the filter effect feColorMatrix to SVG filters. 
+
+        There is already a test in the w3c directory.
+        Test: svg/W3C-SVG-1.1/filters-color-01-b.svg
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::matrix):
+        (WebCore::saturate):
+        (WebCore::huerotate):
+        (WebCore::luminance):
+        (WebCore::FEColorMatrix::apply):
+
+2009-08-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Build fix for Tiger.
+        https://bugs.webkit.org/show_bug.cgi?id=27844
+
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+
+2009-08-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        This is an initial implementation for linearRGB and sRGB support for all
+        platforms. Some platforms like Cg support different color spaces
+        natively, others like Qt, Cairo and Skia do not. This patch uses the
+        native implementation of platforms if possible and offers a common version
+        if not.
+
+        Different color spaces are used in SVG Filters. Nearly every Filter test 
+        case is a test for this patch and will be enabled, once Filters are enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=27844
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/ImageBuffer.cpp: Added.
+        (WebCore::ImageBuffer::transformColorSpace):
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::):
+        (WebCore::ImageBuffer::create):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::OwnedBuffers::OwnedBuffers):
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::getEffectContext):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::strokeContains):
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::scratchContext):
+        * platform/graphics/wx/ImageBufferWx.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::nativeImageForCurrentFrame):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::prepareFilter):
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-08-08  Xan Lopez  <xlopez@igalia.com>
+
+        Roll out r46928, since it wasn't done in accordance with the
+        agreed naming.
+
+        * bindings/gdom/GdomDOMObject.cpp: Removed.
+
+2009-08-08  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Enable accessibility in Gtk DRT
+        https://bugs.webkit.org/show_bug.cgi?id=25989
+
+        Add SPI to get the focused accessible element to be used by DRT.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_focused_element):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.h:
+
+2009-08-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix - add html/canvas to the binding generator's include path
+
+        * GNUmakefile.am:
+
+2009-08-07  Oliver Hunt  <oliver@apple.com>
+
+        Another attempt to fix windows.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-08-07  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix - add html/canvas to the include path.
+
+        * GNUmakefile.am:
+
+2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Prospective build fix for Qt following r46937.
+
+        * WebCore.pro:
+
+2009-08-07  Yong Li  <yong.li@torchmobile.com>
+
+        WINCE PORT: store only width for GlyphBufferAdvance, to save space on low-memory devices
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore::GlyphBuffer::advanceAt):
+        (WebCore::GlyphBuffer::advanceData):
+        (WebCore::GlyphBuffer::add):
+
+2009-08-07  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: pass unrecognized glyphs to GDI to handle
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+
+2009-08-07  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move Canvas related file to a subdirectories
+        https://bugs.webkit.org/show_bug.cgi?id=28026
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/CanvasGradient.cpp: Removed.
+        * html/CanvasGradient.h: Removed.
+        * html/CanvasGradient.idl: Removed.
+        * html/CanvasPattern.cpp: Removed.
+        * html/CanvasPattern.h: Removed.
+        * html/CanvasPattern.idl: Removed.
+        * html/CanvasPixelArray.cpp: Removed.
+        * html/CanvasPixelArray.h: Removed.
+        * html/CanvasPixelArray.idl: Removed.
+        * html/CanvasRenderingContext2D.cpp: Removed.
+        * html/CanvasRenderingContext2D.h: Removed.
+        * html/CanvasRenderingContext2D.idl: Removed.
+        * html/CanvasStyle.cpp: Removed.
+        * html/CanvasStyle.h: Removed.
+        * html/canvas: Added.
+        * html/canvas/CanvasGradient.cpp: Copied from WebCore/html/CanvasGradient.cpp.
+        * html/canvas/CanvasGradient.h: Copied from WebCore/html/CanvasGradient.h.
+        * html/canvas/CanvasGradient.idl: Copied from WebCore/html/CanvasGradient.idl.
+        * html/canvas/CanvasPattern.cpp: Copied from WebCore/html/CanvasPattern.cpp.
+        * html/canvas/CanvasPattern.h: Copied from WebCore/html/CanvasPattern.h.
+        * html/canvas/CanvasPattern.idl: Copied from WebCore/html/CanvasPattern.idl.
+        * html/canvas/CanvasPixelArray.cpp: Copied from WebCore/html/CanvasPixelArray.cpp.
+        * html/canvas/CanvasPixelArray.h: Copied from WebCore/html/CanvasPixelArray.h.
+        * html/canvas/CanvasPixelArray.idl: Copied from WebCore/html/CanvasPixelArray.idl.
+        * html/canvas/CanvasRenderingContext2D.cpp: Copied from WebCore/html/CanvasRenderingContext2D.cpp.
+        * html/canvas/CanvasRenderingContext2D.h: Copied from WebCore/html/CanvasRenderingContext2D.h.
+        * html/canvas/CanvasRenderingContext2D.idl: Copied from WebCore/html/CanvasRenderingContext2D.idl.
+        * html/canvas/CanvasStyle.cpp: Copied from WebCore/html/CanvasStyle.cpp.
+        * html/canvas/CanvasStyle.h: Copied from WebCore/html/CanvasStyle.h.
+
+2009-08-07  Szabo Carol  <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        QtWebkit ignores letter-spacing and word-spacing styles.
+        QtWebkit handles custom letter-spacing and word-spacing in the native QFont
+        class, but the values for these options are not not passed on from
+        the platform independent part of the Font class.
+        Fixed QtWebkit behavior by applying the options to QFont when it is
+        returned via Font::font()
+
+        http://bugs.webkit.org/show_bug.cgi?id=27988
+
+        LayoutTests:
+        fast/css/word-space-extra.html
+        css2.1/t1604-c542-letter-sp-00-b-a.html
+        css2.1/t1604-c541-word-sp-01-b-a.html
+        css1/text_properties/word_spacing.html
+        
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::font):
+
+2009-08-07  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Use correct highlight color for listboxes and completion popups.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28090
+
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        Rename activeListBoxSelectionBackgroundColor to
+        platformActiveListBoxSelectionBackgroundColor, so that it actually
+        overrides a virtual method.
+
+2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added a fourth bunch of Haiku-specific files for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=26988
+
+        * platform/haiku/PasteboardHaiku.cpp: Added.
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::generalPasteboard):
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        (WebCore::Pasteboard::writeURL):
+        (WebCore::Pasteboard::writeImage):
+        (WebCore::Pasteboard::clear):
+        * platform/haiku/PlatformKeyboardEventHaiku.cpp: Added.
+        (WebCore::keyIdentifierForHaikuKeyCode):
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
+        * platform/haiku/PlatformMouseEventHaiku.cpp: Added.
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/haiku/PlatformWheelEventHaiku.cpp: Added.
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-08-07  Nicolas Weber  <thakis@chromium.org>
+
+        Teach WebKit how to decode jpegs in cmyk and ycck color spaces.
+        Heavily inspired by Firefox's take on this issue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27909
+
+        Reviewed by Eric Seidel.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+        Tell jpeglib to convert ycck to cmyk and keep cmyk.
+        (WebCore::convertCMYKToRGBA):
+        Added function to convert cmyk to rgb.
+        (WebCore::convertRGBToRGBA):
+        Extracted existing conversion logic into its own function.
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        Call convertCMYKToRGBA for cmyk images, convertRGBToRGBA for rgb
+        images.
+
+2009-08-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers should be shared
+        https://bugs.webkit.org/show_bug.cgi?id=28058
+
+        Added tracking of shared workers to the SharedWorkerRepository.
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::create):
+        Changed SharedWorkerProxy to derive from ThreadSafeShared, as it needs to outlive the repository (if closed while some documents are still loading).
+        (WebCore::SharedWorkerProxy::thread):
+        (WebCore::SharedWorkerProxy::closing):
+        Added flag used to determine whether the worker has closed itself while loading.
+        (WebCore::SharedWorkerProxy::url):
+        (WebCore::SharedWorkerProxy::name):
+        Proxy now tracks worker URL and name to allow validity checks per section 4.8.3 of the WebWorkers spec.
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::SharedWorkerProxy::addToDocumentSet):
+        Added API to track the document set for a worker to allow worker shutdown. Currently does nothing.
+        (WebCore::SharedWorkerScriptLoader::SharedWorkerScriptLoader):
+        Renamed SharedWorkerLoader to be SharedWorkerScriptLoader for clarity.
+        (WebCore::SharedWorkerScriptLoader::load):
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        (WebCore::DefaultSharedWorkerRepository::instance):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        Now handles "worker already loaded" case.
+        (WebCore::SharedWorkerRepository::connect):
+        Delegates to DefaultSharedWorkerRepository::connectToWorker
+        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
+        Added code to track the SharedWorkerProxy in a map, and to handle the "worker already loaded" case.
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        Atomic get-or-create operation on the internal tracking HashMap.
+        * workers/DefaultSharedWorkerRepository.h:
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        * workers/SharedWorkerRepository.h:
+        Removed instance() API and made constructor private to prevent instantiation.
+        (WebCore::SharedWorkerRepository::SharedWorkerRepository):
+
+2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added four Haiku-specific files for WebCore:
+        PopupMenuHaiku.cpp, ScreenHaiku.cpp,
+        SearchPopupMenuHaiku.cpp and SoundHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28080
+
+        * platform/haiku/PopupMenuHaiku.cpp: Added.
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        (WebCore::PopupMenu::updateFromElement):
+        (WebCore::PopupMenu::itemWritingDirectionIsNatural):
+        * platform/haiku/ScreenHaiku.cpp: Added.
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        * platform/haiku/SearchPopupMenuHaiku.cpp: Added.
+        (WebCore::SearchPopupMenu::SearchPopupMenu):
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        (WebCore::SearchPopupMenu::enabled):
+        * platform/haiku/SoundHaiku.cpp: Added.
+        (WebCore::systemBeep):
+
+2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added two Haiku-specific files to WebCore:
+        TemporaryLinkStubs.cpp and WidgetHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28080
+
+        * platform/haiku/TemporaryLinkStubs.cpp: Added.
+        (loadResourceIntoArray):
+        (WebCore::historyContains):
+        (WebCore::supportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        (WebCore::userIdleTime):
+        (WebCore::callOnMainThread):
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        (WebCore::KURL::fileSystemPath):
+        (WebCore::getSupportedKeySizes):
+        * platform/haiku/WidgetHaiku.cpp: Added.
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setCursor):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::paint):
+        (WebCore::Widget::setIsSelected):
+
+2009-08-07  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix the problem that isAttribute is set to false for onerror and
+        onmessage in worker custom code.
+        https://bugs.webkit.org/show_bug.cgi?id=28083
+
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-08-07  Vitaly Repeshko  <vitalyr@quad.spb.corp.google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 bindings: speed up lookupDOMWrapper by using new V8 API function.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28071
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+
+2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        selectionHasStyle doesn't handle text-specific properties properly
+        https://bugs.webkit.org/show_bug.cgi?id=27858
+
+        This patch modifies selectionHasStyle so that it returns TrueTriState when text styles
+        (text-decoration, font-style, font-weight, & color) are present in all text nodes,
+        regardless of whether the style is also present in their ancestor nodes or not.
+        e.g. New behavior concludes that <b><i>hello</i><i>world</i></b> has italic style.
+
+        WebKit now applies the text styles (bold, italic, etc) if the specified style was not present on
+        at least one text node, rather than at the beginning of selection except on Mac.
+        On Mac, WebKit applies the text style if the style was not present at the beginning of style.
+
+        Test: editing/execCommand/toggle-compound-styles.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getPropertiesNotInComputedStyle): bug fix, must use copy instead of makeMutable for a mutable style.
+        * editing/Editor.cpp:
+        (WebCore::):
+        (WebCore::triStateOfStyleInComputedStyle): Added a boolean type to ignore text-specific styles
+        (WebCore::Editor::selectionHasStyle): Ignores text-specific styles for all but text nodes
+        * editing/EditorCommand.cpp:
+        (WebCore::executeToggleStyle): Uses selectionHasStyle instead of selectionStartHasStyle
+
+2009-08-07  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Do not register V8 error message listener in WorkerContextExecutionProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=28082
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+
+2009-08-07  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Cairo-based Windows port does not handle cookies properly
+        https://bugs.webkit.org/show_bug.cgi?id=27414
+
+        curl handles cookies by itself, so using WinINet functions
+        to get and set cookies is wrong.
+
+        Replace CookieJarWin.cpp with CookieJarCurl.cpp so that
+        cookies can be implemented later once curl provides an API to
+        get and set cookies.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28074
+
+        V8 bindings for the window.applicationCache attribute.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp: Added.
+
+2009-08-07  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Right click on timeline of media controls panel cause seek
+        https://bugs.webkit.org/show_bug.cgi?id=27920
+
+        Add a test simulate the behavior of seeking by right clicking
+        on the time bar of media controls while playing.
+
+        * media/controls-right-click-on-timebar-expected.txt: Added.
+        * media/controls-right-click-on-timebar.html: Added.
+
+2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        deprecatedCopyInheritableProperties must be replaced by two different functions
+        https://bugs.webkit.org/show_bug.cgi?id=28057
+
+        This patch deletes deprecatedInheritableProperties and modifies call callees to call either editingStyleAtPosition
+        or prepareEditingStyleToApplyAt. The concept of editing style is introduced in this patch,
+        which consists of all CSS properties need to be preserved under editing operations.
+
+        No test is added since this patch does not change any behavior.
+
+        * css/CSSComputedStyleDeclaration.cpp: Removed deprecatedCopyInheritableProperties
+        * css/CSSComputedStyleDeclaration.h: Removed deprecatedCopyInheritableProperties
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::):
+        (WebCore::editingStyleAtPosition): Obtains the editing-specific computed style at the position
+        (WebCore::prepareEditingStyleToApplyAt): Removes redundant editing styles at the specified position
+        (WebCore::removeStylesAddedByNode): Removes the style derived from the specified node
+        * editing/ApplyStyleCommand.h:
+        (WebCore::):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphs): Uses editingStyleAtPosition
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Uses editingStyleAtPosition
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::removeEnclosingAnchorStyle): Uses removeStyleOfNode
+        (WebCore::DeleteSelectionCommand::saveTypingStyleState): Uses editingStyleAtPosition
+        (WebCore::DeleteSelectionCommand::calculateTypingStyleAfterDelete): Uses prepareEditingStyleToApplyAt
+        * editing/EditCommand.cpp:
+        * editing/EditCommand.h:
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::calculateStyleBeforeInsertion): Uses editingStyleAtPosition
+        (WebCore::InsertParagraphSeparatorCommand::applyStyleAfterInsertion): Uses prepareEditingStyleToApplyAt
+        * editing/RemoveFormatCommand.cpp:
+        (WebCore::RemoveFormatCommand::doApply): Uses editingStyleAtPosition
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::handleStyleSpansBeforeInsertion): Uses editingStyleAtPosition
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans): Uses editingStyleAtPosition and prepareEditingStyleToApplyAt
+        (WebCore::ReplaceSelectionCommand::doApply): Uses prepareEditingStyleToApplyAt
+        * editing/markup.cpp:
+        (WebCore::removeEnclosingMailBlockquoteStyle): Uses removeStyleOfNode
+        (WebCore::removeDefaultStyles): Uses prepareEditingStyleToApplyAt
+        (WebCore::createMarkup): Uses editingStyleAtPosition
+
+2009-08-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27250: Geolocation callback function IDL files are superfluous
+        https://bugs.webkit.org/show_bug.cgi?id=27250
+
+        The objects for the Geolocation success and error callbacks are created 'manually' in
+        WebCore/bindings/js/JSGeolocationCustom.cpp. Furthermore, the callback interfaces are 
+        marked 'NoInterfaceObject' in the W3C spec, so the prototype should not
+        appear on the window object. Hence IDL files for these callbacks are not required.
+
+        See http://www.w3.org/TR/geolocation-API/#geolocation_interface and
+        http://www.w3.org/TR/WebIDL/#NoInterfaceObject.
+
+        No new tests required.
+
+        * DerivedSources.make: Modified. Removed reference to IDL files.
+        * WebCore.gypi: Modified. Removed reference to IDL files.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removed reference to IDL files.
+        * page/PositionCallback.idl: Removed.
+        * page/PositionErrorCallback.idl: Removed.
+
+2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Build fix for Qt when ENABLE_VIDEO = 0.  This was necessitated by r46890 which
+        put the idl files back into play regardless of compile time defines.
+
+        * html/TimeRanges.idl:
+
+2009-08-07  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Coding style patches for RenderThemeQt.cpp based on results from cpp_style.py.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28050
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::baselinePosition):
+        (WebCore::inflateButtonRect):
+        (WebCore::RenderThemeQt::supportsFocus):
+        (WebCore::RenderThemeQt::applyTheme):
+
+2009-08-07  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Prevent RenderThemeQt AdjustStyle based calls for TextField, MenuList and MenuListButton
+        from discarding style colour.
+
+        Add tests and remove tests from platform/qt/Skipped that now pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28050
+
+        Tests: fast/forms/menulist-style-color.html
+               fast/forms/text-style-color.html
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustTextFieldStyle):
+        (WebCore::RenderThemeQt::adjustMenuListStyle):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+
+2009-08-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22495
+        [V8] Re-land http://trac.webkit.org/changeset/46821, now that
+        http://trac.webkit.org/changeset/46874 re-landed
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Darin Adler and George Staikos.
+
+        Add rectToRect convenience function which returns the TransformationMatrix
+        which maps the 'from' rectangle to the 'to' rectangle.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28067
+
+        No tests as this would require binding the method to js and since it is static
+        that doesn't seem possible.  Please check the math.
+
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::rectToRect):
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2009-08-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implement the HTML5 hashchange event.
+        https://bugs.webkit.org/show_bug.cgi?id=21605
+
+        Test: fast/loader/hashchange-event.html
+
+        * dom/EventNames.h: Add "hashchange"
+        * html/HTMLAttributeNames.in: Add "onhashchange"
+
+        * loader/FrameLoader.cpp:
+        (WebCore::HashChangeEventTask::create):
+        (WebCore::HashChangeEventTask::performTask):
+        (WebCore::HashChangeEventTask::HashChangeEventTask):
+        (WebCore::FrameLoader::scrollToAnchor): When an anchor navigation is completed and the
+          new fragment identifier is different from the old one, queue a hash change event
+          on the Document.
+
+        Add a window event listener for the hashchange event if onhashchange is encountered:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute): 
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+
+        Add a new string utility method that gives "null and empty are equivalent" behavior:
+        * platform/text/PlatformString.h:
+        (WebCore::equalIgnoringNullity):
+        * platform/text/StringImpl.cpp:
+        (WebCore::equalIgnoringNullity):
+        * platform/text/StringImpl.h:
+
+2009-08-07  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add the initial implementation of the ability to resize the columns in
+        a DataGrid in the Web Inspector. Enables that functionality in both the
+        Profile View and in the Local Storage View.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26182
+        
+        In this version, resizing a column can change the width of at most two
+        columns (the columns to the left and right of the resizer being dragged).
+        
+        Possible changes in future patches:
+        
+        1) Be able to specify the minimum size of a column and the maximum size
+           of a column. If the minimum size is equal to the maximum size, the
+           column can't be resized.
+        2) Make the behavior more in line with the following description:
+        
+        Everything before the column that is resized stays fixed size. The
+        resized column changes sizes. The other columns except the last stay
+        the same size. And the last column adjusts to fit with a minimum size.
+        If the last column is already the minimum, the next to last column
+        shrinks, etc.
+        
+        3) Make it possible to scale the column sizes appropriately when the
+           Web Inspector window gets resized.
+        
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        Once the DataGrid is added to the DOM, update the widths of the
+        DataGrid in order to put the resizers in place.
+        (WebInspector.DOMStorageItemsView.prototype.resize):
+        Update the widths of the DataGrid in order to correctly adjust the
+        positions of the resizers.
+        
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        Store column groups whose widths can later be changed when the columns
+        are resized by the user.
+        Also, keep track of whether the widths of the columns have been
+        initialized.
+        (WebInspector.DataGrid.prototype.updateWidths):
+        Create the resizers for the columns.
+        (WebInspector.DataGrid.prototype._clickInDataTable):
+        Didn't actually change anything in this method, just added a comma to
+        the end of the function.
+        (WebInspector.DataGrid.prototype._startResizerDragging):
+        Store the resizer that is currently dragging.
+        (WebInspector.DataGrid.prototype._resizerDragging):
+        Constrain the area that the resizer can be dragged to the column to
+        it's left and right, with some padding added to make sure that the
+        neighboring columns don't disappear.
+        (WebInspector.DataGrid.prototype._endResizerDragging):
+        
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.resize):
+        Resize the view.
+        (WebInspector.DatabasesPanel.prototype._updateSidebarWidth):
+        ditto.
+        
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.prototype.show):
+        Now that the DataGrid is actually attached to the DOM, update the
+        widths of the DataGrid in order to put the resizers in place.
+        (WebInspector.ProfileView.prototype.resize):
+        Update the widths of the DataGrid in order to correctly adjust the
+        positions of the resizers.
+        
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.resize):
+        Resize the view.
+        (WebInspector.ProfilesPanel.prototype._updateSidebarWidth):
+        ditto.
+        
+        * inspector/front-end/inspector.css:
+        Add in a style rule for a resizer in the Data Grid.
+
+2009-08-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Back out r46847 and fix the Qt build system to always generate
+        all the JS binding files from IDL files. The generated files
+        have #if feature guards, so the #ifs are not needed in the
+        files using them.
+
+        * WebCore.pro:
+        * bindings/js/JSEventTarget.cpp:
+        * bindings/js/JSWorkerContextBase.cpp:
+        * bindings/js/WorkerScriptController.cpp:
+
+2009-08-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Adele Peterson.
+
+        Cannot scroll for box-reflect:right
+        https://bugs.webkit.org/show_bug.cgi?id=27979
+
+        Update m_overflowLeft an m_overflowWidth for reflection just like
+        m_overflowTop and m_overflowHeight.
+
+        Test: fast/reflections/reflection-overflow-scroll.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+
+2009-08-06  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        box-shadow's spread is ignored with <table>
+        https://bugs.webkit.org/show_bug.cgi?id=28017
+
+        Use RenderStyle::getBoxShadowExtent just like RenderBlock.
+
+        Test: fast/box-shadow/box-shadow-overflow-scroll.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+
+2009-08-06  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: NodeLists Don't Display Well in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=28061
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._format): Specific check if the object is a NodeList, display as an "array"
+
+2009-08-06  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by David Levin.
+
+        Chromium Linux: add support for @font-face
+        https://bugs.webkit.org/show_bug.cgi?id=28015
+        
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+
+        Modified #ifdefs so that chromium linux can load remote fonts.
+        
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::createFontCustomPlatformData):
+
+        Create SkTypeface for a web font by calling SkTypeface::CreateFromStream function.
+        
+        (WebCore::RemoteFontStream::RemoteFontStream):
+        (WebCore::RemoteFontStream::~RemoteFontStream):
+        (WebCore::RemoteFontStream::rewind):
+        (WebCore::RemoteFontStream::read):
+
+        New class that implements SkStream interface and wraps wtf's SharedBuffer.
+        
+        * platform/graphics/chromium/FontCustomPlatformData.h:
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+
+        Added member variables for Linux.
+        
+2009-08-06  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix JPEGImageDecoder.cpp compile error on WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=28051
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+
+2009-08-06  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        Adding WebCore support for the waf build system for wx.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27619
+
+        * wscript: Added.
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed revert.
+
+        http://bugs.webkit.org/show_bug.cgi?id=27879
+
+        Revert 46877 because it broke GTK.
+
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+
+2009-08-06  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 27956 - AX: roleValue should be cached for performance
+        https://bugs.webkit.org/show_bug.cgi?id=27956
+
+        Caches the role value of an accessibility object instead of calculating it everytime.
+        The changes gained a 5% speedup using VoiceOver to navigate a webpage.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::handleAriaRoleChanged):
+
+        Use generic role setter instead of specific ARIA role setter.
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::AccessibilityObject):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::headingLevel):
+
+        Make headingLevel into instance method so that it can *safely* be called in the constructor.
+
+        (WebCore::AccessibilityObject::setRoleValue):
+        (WebCore::AccessibilityObject::roleValue):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
+        (WebCore::AccessibilityRenderObject::headingLevel):
+        (WebCore::AccessibilityRenderObject::intValue):
+        (WebCore::AccessibilityRenderObject::updateAccessibilityRole):
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (AXAttributeStringSetHeadingLevel):
+
+2009-08-06  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Adam Barth.
+
+        Change Noncopyable inheriting to public
+        http://bugs.webkit.org/show_bug.cgi?id=27879
+
+        Since Noncopyable is inherited from FastAllocBase, Noncopyable's
+        inheriting has been changed to public.
+
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Add explicit dependencies for our build verification scripts to ensure that they always run after linking has completed.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implement the matchMedium method on the Media interface described in the CSSOM View Module.
+        https://bugs.webkit.org/show_bug.cgi?id=22495
+        
+        Add a new Media interface, obtainable via the AbstractView, that can
+        evaluate queries via its matchesMedium() method.
+
+        Test: fast/media/matchmedium-query-api.html
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Add Media.* files to the build.
+
+        * css/Media.cpp: Added.
+        (WebCore::Media::Media):
+        (WebCore::Media::type):
+        (WebCore::Media::matchMedium):
+        * css/Media.h: Added.
+        (WebCore::Media::create):
+        (WebCore::Media::document):
+        * css/Media.idl: Added.
+        Media::matchMedium() uses a MediaQueryEvaluator() to test the query.
+
+        * page/AbstractView.idl:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::media):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Add a readonly attribute for Media.
+
+2009-08-06  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27455
+        Support for a custom validation message in ValidityState and related
+        form controls.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#dom-cva-setcustomvalidity
+
+        Tests: fast/forms/ValidityState-customError-001.html
+               fast/forms/ValidityState-customError-002.html
+               fast/forms/ValidityState-customError-003.html
+               fast/forms/ValidityState-customError-004.html
+
+        * html/HTMLButtonElement.idl: setCustomValidity DOM method
+        * html/HTMLFieldSetElement.idl: ditto
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::setCustomValidity): ditto
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::valueMissing): moved down
+        * html/HTMLInputElement.idl: ditto
+        * html/HTMLSelectElement.idl: ditto
+        * html/HTMLTextAreaElement.idl:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::setCustomErrorMessage): method to set custom
+        validation message
+        (WebCore::ValidityState::customError): validation flag
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Bring a little order to our otherwise out of control lives.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Stop copying .idl files in to the framework resources directory.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build some more.
+
+        Add JSWebSocket.cpp and JSWebSocket.h to the Xcode project, and move the WebSocket-related
+        files and groups in to the appropriate locations.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add WebSocket.idl
+        https://bugs.webkit.org/show_bug.cgi?id=27209
+
+        Add WebSocket.idl in WebCore/websockets/.
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
+        Other build systems will be updated once the code is functional.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebSocketConstructor.cpp: Added.
+        * bindings/js/JSWebSocketConstructor.h: Added.
+        * bindings/js/JSWebSocketCustom.cpp: Added.
+        * websockets/WebSocket.cpp: Added.
+        * websockets/WebSocket.h: Added.
+        * websockets/WebSocket.idl: Added.
+
+2009-08-06  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Style cleaning for WorkerContextExecutionProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=27997
+
+        Cleanup WorkerContextExecutioonProxy related files to follow
+        WebKit coding styles after all V8 binding codes are upstreamed.
+        1) Lower-case the first letter of remaining functins in class
+           WorkerContextExecutionProxy. Update the V8 code generator
+           and all other references accordingly.
+        2) Integrate getConstructor from WorkerContextExecutionProxy
+           to V8DOMWrapper.
+        3) Other misc changes, like removing trailing whitespaces and
+           sorting the include files.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructorForContext):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::~V8WorkerContextEventListener):
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::reportError):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextObjectEventListener.cpp:
+        (WebCore::weakObjectEventListenerCallback):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertEventToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertWorkerContextToV8Object):
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
+        (WebCore::WorkerContextExecutionProxy::removeEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        (WebCore::WorkerContextExecutionProxy::context):
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-06  Darin Adler  <darin@apple.com>
+
+        Fix Mac Leopard debug build.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::equalIgnoringCase): Removed meaningless assertion; an unsigned
+        is always >= 0 and checking causes a warning in the newer versions of gcc.
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreview rollout.
+
+        Revert 46840 because it broke the reliability tests.
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed rollout.
+
+        Revert 46840 in preparation to revert 46838, which broke the reliability tests.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::mainWorldContext):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::context):
+
+2009-08-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: move style-related utilities into InjectedScript.
+
+        http://bugs.webkit.org/show_bug.cgi?id=27939
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.prototype.isPropertyImplicit):
+        (WebInspector.CSSStyleDeclaration.prototype.styleTextWithShorthands):
+        (WebInspector.CSSStyleDeclaration.prototype.getLonghandProperties):
+        (WebInspector.CSSStyleDeclaration.prototype.getShorthandPriority):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleText):
+        (InjectedScript.toggleStyleEnabled):
+        (InjectedScript._serializeStyle):
+        (InjectedScript._getUniqueStyleProperties):
+        (InjectedScript._getLonghandProperties):
+        (InjectedScript._getShorthandPriority):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._update):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
+        (WebInspector.StylePropertiesSection.prototype.onpopulate):
+        (WebInspector.StylePropertyTreeElement.prototype.get priority):
+        (WebInspector.StylePropertyTreeElement.prototype.get value):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/utilities.js:
+
+2009-08-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed build fix, add #ifdef guards around
+        inclusions of shared worker specific files.
+
+        * bindings/js/JSEventTarget.cpp:
+        * bindings/js/JSWorkerContextBase.cpp:
+        * bindings/js/WorkerScriptController.cpp:
+
+2009-08-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        cssgrammar.cpp fails to compile with RVCT compiler
+        https://bugs.webkit.org/show_bug.cgi?id=27952
+
+        * css/CSSGrammar.y: Do not convert to String to get rid of the stray
+        memory allocation 
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::equalIgnoringCase):
+        * platform/text/StringImpl.h: 
+        (WebCore::equalIgnoringCase): Add charactersEqualIgnoringCase
+          function that works with a character pointer and length
+
+2009-08-06  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Created first working implementation of SharedWorkers (execution only, no sharing).
+        https://bugs.webkit.org/show_bug.cgi?id=27927
+
+        Added initial implementations of SharedWorkerThread and SharedWorkerContext.
+        No v8 bindings yet.
+
+        * DerivedSources.cpp:
+        Added shared worker files.
+        * DerivedSources.make:
+        Added shared worker files.
+        * GNUmakefile.am:
+        Added shared worker files.
+        * WebCore.gypi:
+        Added shared worker files.
+        * WebCore.pro:
+        Added shared worker files.
+        * WebCore.vcproj/WebCore.vcproj:
+        Added shared worker files.
+        * WebCore.xcodeproj/project.pbxproj:
+        Added shared worker files.
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        Added code to convert from EventTarget to correct JS class.
+        (WebCore::toEventTarget):
+        Added code to cast from JS object to appropriate EventTarget impl class.
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
+        (WebCore::constructSharedWorker):
+        Tweaked the constructor code to pass in the lexical global object like normal workers.
+        * bindings/js/JSSharedWorkerContextCustom.cpp: Added.
+        (WebCore::JSSharedWorkerContext::mark):
+        Custom marking of the onconnect handler.
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::toJSSharedWorkerContext):
+        (WebCore::toJSWorkerContext):
+        Added proper conversion to the correct WorkerContext derived class.
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        Updated WorkerScriptController to create the correct type of binding object (JSSharedWorkerContext vs JSDedicatedWorkerContext)
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Added support for SharedWorkerContext.
+        * bindings/v8/DOMObjectsInclude.h:
+        Added shared worker bindings files.
+        * dom/EventNames.h:
+        Added connect event.
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toSharedWorkerContext):
+        Added API for casting to new derived class (SharedWorkerContext).
+        * dom/EventTarget.h:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::resolveURL):
+        Moved code that resolves/validates URLs to base class so it can be shared between dedicated/shared workers.
+        * workers/AbstractWorker.h:
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::logException):
+        Refactored exception handling code - moved onerror handling to base class.
+        * workers/DedicatedWorkerContext.h:
+        (WebCore::DedicatedWorkerContext::isDedicatedWorkerContext):
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        Changed constructor to fire up worker thread.
+        * workers/SharedWorker.h:
+        * workers/SharedWorkerContext.cpp: Added.
+        (WebCore::SharedWorkerContext::SharedWorkerContext):
+        (WebCore::SharedWorkerContext::~SharedWorkerContext):
+        (WebCore::SharedWorkerContext::logException):
+        (WebCore::SharedWorkerContext::addMessage):
+        Placeholder methods until we add support for sending exceptions/messages to console.
+        (WebCore::SharedWorkerContext::dispatchConnect):
+        (WebCore::SharedWorkerContext::thread):
+        * workers/SharedWorkerContext.h: Added.
+        (WebCore::SharedWorkerContext::create):
+        (WebCore::SharedWorkerContext::isSharedWorkerContext):
+        (WebCore::SharedWorkerContext::toSharedWorkerContext):
+        (WebCore::SharedWorkerContext::setOnconnect):
+        (WebCore::SharedWorkerContext::onconnect):
+        (WebCore::SharedWorkerContext::name):
+        * workers/SharedWorkerContext.idl: Added.
+        * workers/SharedWorkerRepository.h: Added.
+        (WebCore::SharedWorkerRepository::~SharedWorkerRepository):
+        * workers/DefaultSharedWorkerRepository.cpp: Added.
+        Implementation of core singleton class that will be used to implement sharing.
+        (WebCore::SharedWorkerProxy::setThread):
+        Proxy object used to handle resource loading for a given shared worker.
+        (WebCore::SharedWorkerProxy::postTaskToLoader):
+        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
+        Placeholder routines until we implement loading.
+        (WebCore::SharedWorkerConnectTask::create):
+        Creates a task to fire off a connect event on the worker thread.
+        (WebCore::SharedWorkerConnectTask::SharedWorkerConnectTask):
+        (WebCore::SharedWorkerConnectTask::performTask):
+        (WebCore::SharedWorkerLoader::SharedWorkerLoader):
+        Added helper object to load the initial script for the worker.
+        (WebCore::SharedWorkerLoader::load):
+        (WebCore::SharedWorkerLoader::notifyFinished):
+        (WebCore::SharedWorkerRepository::instance):
+        (WebCore::DefaultSharedWorkerRepository::instance):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        Fires off the worker thread once the script is loaded.
+        (WebCore::SharedWorkerRepository::connect):
+        (WebCore::DefaultSharedWorkerRepository::DefaultSharedWorkerRepository):
+        (WebCore::DefaultSharedWorkerRepository::~DefaultSharedWorkerRepository):
+        * workers/DefaultSharedWorkerRepository.h: Added.
+        * workers/SharedWorkerThread.cpp: Added.
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        (WebCore::SharedWorkerThread::~SharedWorkerThread):
+        (WebCore::SharedWorkerThread::createWorkerContext):
+        * workers/SharedWorkerThread.h: Added.
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::isSharedWorkerContext):
+        (WebCore::WorkerContext::isDedicatedWorkerContext):
+        Added APIs to determine the type of a given context.
+
+2009-08-06  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Added ENABLE_3D_CANVAS flag to build, default to off
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-06  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] windowsKeyCodeForKeyEvent fix
+
+        Fix windowsKeyCodeForKeyEvent to determine wheter the event comes from the keypad.
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+
+2009-08-06  George Staikos  <george.staikos@torchmobile.com>
+
+        Rubber-stamped by Ariya Hidayat.
+
+        Remove the dead wince/ directory that should never have gone in.
+
+        * svg/graphics/wince: Removed.
+        * svg/graphics/wince/SVGResourceFilterWince.cpp: Removed.
+
+2009-08-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Extract style editing into a separate file that is
+        going to be loaded in page context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27939
+
+        * inspector/front-end/InjectedScript.js: Added.
+        (InjectedScript.applyStyleText):
+        (InjectedScript.setStyleText):
+        (InjectedScript.toggleStyleEnabled):
+        (InjectedScript.setStyleRule):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted.callback):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Remove bug-bait V8Proxy::context()
+        https://bugs.webkit.org/show_bug.cgi?id=27826
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::mainWorldContext):
+        * bindings/v8/V8Proxy.h:
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempt to fix the Chromium Linux build.  This function is
+        not used.
+
+        * bindings/v8/OwnHandle.h:
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a weak handle to the original context.  We use that handle
+        to call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Revert http://trac.webkit.org/changeset/46821, which was
+        landed to supplement http://trac.webkit.org/changeset/46816, but
+        now that the latter is reverted, the former needs the same.
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-08-05  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Color is only reported in rgb() format; should toggle between rgb() and hex
+        https://bugs.webkit.org/show_bug.cgi?id=13516
+
+          New Class to Parse and Change Between Color Representations:
+
+        * inspector/front-end/Color.js: Added.
+        (WebInspector.Color):
+
+          Representations of Colors in Raw Form. (May be Lazy Loaded):
+
+        (WebInspector.Color.prototype.get shorthex):
+        (WebInspector.Color.prototype.get hex):
+        (WebInspector.Color.prototype.set hex):
+        (WebInspector.Color.prototype.get rgb):
+        (WebInspector.Color.prototype.set rgb):
+        (WebInspector.Color.prototype.get hsl):
+        (WebInspector.Color.prototype.set hsl):
+        (WebInspector.Color.prototype.get nickname):
+        (WebInspector.Color.prototype.set nickname):
+        (WebInspector.Color.prototype.get rgba):
+        (WebInspector.Color.prototype.set rgba):
+        (WebInspector.Color.prototype.get hsla):
+        (WebInspector.Color.prototype.set hsla):
+
+          Helpers and Standard String Representations:
+
+        (WebInspector.Color.prototype.hasShortHex):
+        (WebInspector.Color.prototype.toRgb):
+        (WebInspector.Color.prototype.toHsl):
+        (WebInspector.Color.prototype.toShortHex):
+        (WebInspector.Color.prototype.toHex):
+        (WebInspector.Color.prototype.toRgba):
+        (WebInspector.Color.prototype.toHsla):
+        (WebInspector.Color.prototype.toNickname):
+
+          Conversion Functions to Determine Other Representations:
+          My Sources for all algorithms and sample data:
+          Wikipedia: http://en.wikipedia.org/wiki/HSV_color_space
+          CSS Specification: http://www.w3.org/TR/css3-color/#hsla-color
+
+        (WebInspector.Color.prototype.rgbToHex):
+        (WebInspector.Color.prototype.hexToRgb):
+        (WebInspector.Color.prototype.rgbToHsl):
+        (WebInspector.Color.prototype.hslToRgb.hueToRgb):
+        (WebInspector.Color.prototype.hslToRgb):
+        (WebInspector.Color.prototype.rgbaToHsla):
+        (WebInspector.Color.prototype.hslaToRgba):
+
+          Called from the constructor, attempts to parse and will throw an error
+          if it cannot parse.  If simple then the "hex" value is guarenteed.
+          If advanced then both the "rgba" and "hsla" are guarenteed.  If it is
+          a nickname in any way (e.g. "transparent", "black") then this is
+          guarenteed to be set as well.
+
+        (WebInspector.Color.prototype.parse):
+
+          Clicking on the swatch will rotate through Color Representations.
+            Simple:   rgb -> hsl -> nickname? -> shorthex? -> hex -> (loop around)
+            Advanced: rgba -> hsla -> nickname? -> (loop around)
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.value.):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+
+          Load Color.js:
+
+        * inspector/front-end/inspector.html:
+
+2009-08-05  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Support setting event listeners for message ports in the worker process.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28004
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-05  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        http://bugs.webkit.org/show_bug.cgi?id=28022
+
+        Minor fix for media code on chromium/skia.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack):
+
+2009-08-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Client side image maps did not handle zoom correctly.
+        Client side image maps did not handle border and padding correctly.
+
+        Test: fast/images/image-map-zoom.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::nodeAtPoint): Compute the values to pass in to the map
+        element using the content box and the effective zoom.
+
+2009-08-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28027
+        <rdar://7064428> Files with accents in names are submitted incorrectly due to use of
+        precomposed Unicode
+
+        * platform/network/mac/FormDataStreamMac.mm: (WebCore::setHTTPBody): Use getFileSize() from
+        FileSystem.h instead of custom code for getting file size. This adds path normalization
+        necessary with some file systems on Mac. This also loses a S_IFMT check, which didn't seem
+        important anyway.
+
+2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Include Media into V8 bindings.
+
+        * bindings/v8/DOMObjectsInclude.h: Added Media include.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Added V8Media include.
+        * bindings/v8/V8Index.cpp: Added decl for V8Media.
+        * bindings/v8/V8Index.h: Added V8Media include.
+
+2009-08-04  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Fix Windows layout test crashes.
+
+        PluginView::removeFromUnstartedListIfNecessary() would try to remove
+        any unstarted PluginView from the Page's set of unstarted plug-ins,
+        regardless of why the PluginView wasn't started. If we tried to start a
+        plug-in, but it failed to start, we would hit an assertion in
+        Page::removeUnstartedPlugin() that asserts that we would only modify the
+        unstarted plug-ins set if we were not currently starting plug-ins.
+
+        Fix this by having PluginView track whether it's waiting to be started,
+        and to check this before trying to remove itself from the Page's
+        unstarted plug-ins set.
+
+        Reviewed by Darin Adler.
+
+        * page/Page.cpp:
+        (WebCore::Page::removeUnstartedPlugin):
+        Assert that the passed PluginView is in the unstarted set.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        Set that we are not waiting to be started.
+        (WebCore::PluginView::startOrAddtoUnstartedList):
+        Set that we are waiting to be started.
+        (WebCore::PluginView::removeFromUnstartedListIfNecessary):
+        Check not whether we are started, but whether we are waiting to be
+        started.
+        (WebCore::PluginView::PluginView):
+
+        * plugins/PluginView.h:
+
+2009-08-05  Jeremy Orlow  <jorlow@chromium.org>
+
+       Fix DOM Storage memory leak
+       https://bugs.webkit.org/show_bug.cgi?id=28029
+
+       Forgot to use adoptRef in one place.  This caused the = operator to
+       increment the ref count when it shouldn't have, so StorageAreaImpl's were
+       never freed.
+
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::storageArea):
+
+2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Let CodeGeneratorV8.pm know that Media is ref-counted.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added Media check to IsRefPtrType.
+
+2009-08-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Use checked casts for render tree
+        https://bugs.webkit.org/show_bug.cgi?id=23522
+
+        Last patch. Makes all the casts of RenderObject use checked
+        casts instead of using static_cast directly.
+
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::visibleChildren):
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::elementRect):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::textUnderElement):
+        (WebCore::AccessibilityRenderObject::stringValue):
+        (WebCore::AccessibilityRenderObject::titleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySliderThumb::elementRect):
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::scrollToSelection):
+        (WebCore::SelectElement::recalcStyle):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::reset):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::updateWidget):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::attach):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::defaultEventHandler):
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::attach):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::addSearchResult):
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::parseMappedAttribute):
+        (WebCore::HTMLLIElement::attach):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState):
+        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged):
+        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
+        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
+        (WebCore::HTMLMediaElement::mediaPlayerGraphicsLayer):
+        (WebCore::HTMLMediaElement::defaultEventHandler):
+        (WebCore::HTMLMediaElement::finishParsingChildren):
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::parseMappedAttribute):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::updateWidget):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::defaultEventHandler):
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::selectCursor):
+        (WebCore::EventHandler::capsLockStateMayHaveChanged):
+        * page/Frame.cpp:
+        (WebCore::Frame::ownerRenderer):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        * page/wince/FrameWince.cpp:
+        (WebCore::computePageRectsForFrame):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+        * rendering/RenderCounter.cpp:
+        (WebCore::planCounter):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::computeEdgeInfo):
+        (WebCore::RenderFrameSet::setIsResizing):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::contentsBox):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
+        * rendering/RenderListItem.cpp:
+        (WebCore::previousListItem):
+        (WebCore::RenderListItem::explicitValueChanged):
+        * rendering/RenderObject.cpp:
+        (WebCore::updateListMarkerNumbers):
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::updateListMarkerNumbers):
+        (WebCore::invalidateCountersInContainer):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::minimumThumbLength):
+        (WebCore::RenderScrollbarTheme::backButtonRect):
+        (WebCore::RenderScrollbarTheme::forwardButtonRect):
+        (WebCore::RenderScrollbarTheme::trackRect):
+        (WebCore::RenderScrollbarTheme::constrainTrackRectToTrackPieces):
+        (WebCore::RenderScrollbarTheme::paintScrollbarBackground):
+        (WebCore::RenderScrollbarTheme::paintTrackBackground):
+        (WebCore::RenderScrollbarTheme::paintTrackPiece):
+        (WebCore::RenderScrollbarTheme::paintButton):
+        (WebCore::RenderScrollbarTheme::paintThumb):
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderThumbElement::defaultEventHandler):
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::determineSliderThumbState):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintSliderThumb):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintSliderThumb):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::determineSliderThumbState):
+        * rendering/SVGCharacterLayoutInfo.cpp:
+        (WebCore::SVGCharacterLayoutInfo::addLayoutInformation):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::findSVGRootObject):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::RenderTextControlInnerBlock::nodeAtPoint):
+        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::attach):
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::rootInlineBoxForTextContentElement):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+        Use checked casts.
+
+        * rendering/RenderApplet.h:
+        * rendering/RenderCounter.h:
+        * rendering/RenderFieldset.h:
+        * rendering/RenderFileUploadControl.h:
+        * rendering/RenderFrame.h:
+        * rendering/RenderFrameSet.h:
+        * rendering/RenderHTMLCanvas.h:
+        * rendering/RenderListBox.h:
+        * rendering/RenderListItem.h:
+        * rendering/RenderListMarker.h:
+        * rendering/RenderMedia.h:
+        * rendering/RenderMenuList.h:
+        * rendering/RenderPart.h:
+        * rendering/RenderPartObject.h:
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGTextPath.h:
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/RenderScrollbar.h:
+        * rendering/RenderSlider.h:
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.h:
+        * rendering/RenderVideo.h:
+        Added a checked cast. Also made most members protected or private.
+
+        * rendering/RenderBlock.h:
+        * rendering/RenderInline.h:
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGBlock.h:
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSVGText.h:
+        * rendering/RenderTextControl.h:
+        Made most members protected or private.
+
+        * rendering/RenderInline.cpp:
+        * rendering/RenderSVGContainer.cpp:
+        * rendering/RenderSVGHiddenContainer.cpp:
+        * rendering/RenderSVGImage.cpp:
+        * rendering/RenderSVGRoot.cpp:
+        Removed unneeded destructor.
+
+        * rendering/RenderSVGHiddenContainer.h:
+        Removed unneeded virtual function overrides that did the same as
+        the default and base class.
+
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::paint): Updated to use m_viewport
+        directly instead of using a function call.
+        (WebCore::RenderSVGViewportContainer::applyViewportClip): Ditto.
+        (WebCore::RenderSVGViewportContainer::viewportTransform): Ditto.
+        (WebCore::RenderSVGViewportContainer::localToParentTransform): Ditto.
+        (WebCore::RenderSVGViewportContainer::pointIsInsideViewportClip): Ditto.
+
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::pseudoForScrollbarPart): Changed switch statement to use cases for
+        all values instead of using a default case.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<): Removed dependency on casting to types that don't
+        have any public members we need to get at. Instead, use function names to
+        identify the type rather than doing so much overloading. Changed to use
+        checked casts.
+        (WebCore::write): Ditto.
+
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::renderSubtreeToImage): Changed to use a checked cast and also
+        added a comment about the fact that the code does not do sufficient type
+        checking before doing the cast.
+
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeRenderSVGTextBox): Renamed this from operator<<.
+        (WebCore::writeSVGInlineTextBoxes): Renamed this from writeSVGInlineText.
+        (WebCore::writeSVGText): Renamed this from write.
+        (WebCore::writeSVGInlineText): Ditto.
+        (WebCore::writeSVGImage): Ditto.
+        * rendering/SVGRenderTreeAsText.h: Updated for name changes. Removed
+        unneeded default arguments.
+
+2009-08-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27851
+        Fix a pair of compiler warnings on the GTK Linux buildbot.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::processFileHeader): Don't use multi-character constants, they're not portable.
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::setSize): Simpler code that also doesn't compare signed with unsigned.
+
+2009-08-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460
+        Return multiple icon entries from the ICO decoder as separate frames,
+        sorted by decreasing quality (much like the CG ICO decoder does).
+
+        As a result of this change, we can eliminate the Skia-specific setData()
+        hack that the Chromium port used to select the desired icon size -- now
+        callers can just enumerate the frames and ask for the data from the one
+        they like.
+        
+        Under the hood, the ICO decoder now keeps vectors for a number of things
+        (including directory entries and image decoders) where it used to have
+        single members.  However, callers (that I have seen) will only request
+        one frame from the icon, so practically there aren't going to be lots of
+        instantiated image decoders.
+
+        * platform/graphics/ImageSource.h: Move |m_decoder| back to private now that Skia no longer needs to access it.
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
+        * platform/graphics/skia/ImageSourceSkia.cpp:
+        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
+        (WebCore::ImageSource::setData): Remove function to ask for a particular icon size.
+        * platform/graphics/skia/ImageSourceSkia.h: Removed.
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::ICOImageDecoder):
+        (WebCore::ICOImageDecoder::~ICOImageDecoder): Delete all instantiated per-frame decoders.
+        (WebCore::ICOImageDecoder::setData): Send data to all instantiated per-frame decoders.
+        (WebCore::ICOImageDecoder::isSizeAvailable): Use size from icon directory instead of PNG decoder (if applicable) so we can report it without decoding the PNG frames.
+        (WebCore::ICOImageDecoder::size): Report frame-specific size if BMP decoder is calling.  Otherwise, use size from icon directory instead of PNG decoder (if applicable).
+        (WebCore::ICOImageDecoder::frameSizeAtIndex): Implement.
+        (WebCore::ICOImageDecoder::setSize): Sanity check value if BMP decoder is calling.
+        (WebCore::ICOImageDecoder::frameCount): Implement.
+        (WebCore::ICOImageDecoder::frameBufferAtIndex): Sanity check size for PNG frames.
+        (WebCore::ICOImageDecoder::compareEntries): Add utility function for sorting entries.
+        (WebCore::ICOImageDecoder::setDataForPNGDecoderAtIndex): Factor out utility function for passing correct data blob to a PNG decoder.
+        (WebCore::ICOImageDecoder::decodeWithCheckForDataEnded): Split decode() into two pieces.
+        (WebCore::ICOImageDecoder::decodeDirectory): The first part of the old decode().
+        (WebCore::ICOImageDecoder::decodeAtIndex): The second part of the old decode(), split off so we avoid decoding an entry until it's requested.
+        (WebCore::ICOImageDecoder::processDirectory): Add resizing of internal data structures based on directory contents.
+        (WebCore::ICOImageDecoder::processDirectoryEntries): Sort entries by quality.
+        (WebCore::ICOImageDecoder::imageTypeAtIndex): Return type to caller instead of setting a member.
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+
+2009-08-05  Szabo Carol  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27942
+
+        Test: fast/forms/select-reset-multiple-selections-4-single-selection.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::reset):
+           Added HTML 4.01 compliant handling of broken webpages that
+           specify more than one selected option for single selection SELECT
+           element, in a manner that emulates Firefox and is similar to IE 7
+
+
+2009-08-05  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        WebCore.pro bugfix
+
+        Fix the gperf lines to properly include the string.h header at compilation with gperf version 3.0.3 and newer.
+
+        * WebCore.pro:
+
+2009-08-05  Chris Fleizach  <cfleizach@apple.com>
+
+        Fix Tiger build breakage.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2009-08-04  Simon Hausmann  <hausmann@webkit.org>
+
+        Prospective build fix for Qt build bot: Fix dependency of HTMLNames.cpp
+        to both source files, HTMLTagNames.in and HTMLAttributeNames.in
+
+        * WebCore.pro:
+
+2009-08-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Keypress should exit from pan scrolling mode.
+        https://bugs.webkit.org/show_bug.cgi?id=28005
+
+        Change the logic from only exiting pan scrolling on escape to exiting on any key press,
+        making it easier for users to back out of an accidental pan scroll.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::keyEvent):
+        
+2009-08-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION (r45064): Drop caret remains in text control after the mouse exits
+        https://bugs.webkit.org/show_bug.cgi?id=26787
+
+        Add back missing dragController()->clear() call.
+
+        * manual-tests/drag-caret.html: Added.
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Bug 27994 - WAI-ARIA: aria-valuetext needs to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=27994
+
+        Forgot to commit attribute names.
+
+        * html/HTMLAttributeNames.in:
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27994 - WAI-ARIA: aria-valuetext needs to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=27994
+
+        Test: platform/mac/accessibility/aria-valuetext.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::valueDescription):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::valueDescription):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-08-04  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27821
+
+        No new features, no new tests. Existing layout tests pass.
+
+        * WebCore.base.exp:
+
+        Export AppliationCacheGroup::storeCopyOfCache
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Restore DOMApplicationCache.h and ApplicationCacheHost.h to 'project' headers
+        instead of 'private' headers since they're no longer in the DocumentLoader.h
+        include graph.
+
+        * html/HTMLHtmlElement.cpp:
+        (WebCore::HTMLHtmlElement::insertedIntoDocument):
+
+        Reinstate the test for manifest.isNull instead of .isEmtpty().
+        Added a FIXME to revisit once the spec gets clarified.
+        
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        (WebCore::DocumentLoader::mainReceivedError):
+        (WebCore::DocumentLoader::detachFromFrame):
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::applicationCacheHost):
+
+        ApplicationCacheHost is held in an OwnPtr<> by DocumentLoader. This was done
+        for compile time friendliness, it results in a smaller include graph for files
+        dependent on DocumentLoader.h.
+
+        * loader/FrameLoader.cpp:
+        * loader/MainResourceLoader.cpp:
+        * loader/ResourceLoader.cpp:
+
+        Cleanup ussage of ENABLE(xxx) around includes, generally remove those guards.
+        This was done for readability at the include site. The included files contain appropriate guards,
+        so they're not needed at the include site.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::update):
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        (WebCore::ApplicationCacheGroup::manifestNotFound):
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::CallCacheListenerTask::create):
+        (WebCore::CallCacheListenerTask::performTask):
+        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
+        (WebCore::ApplicationCacheGroup::postListenerTask):
+        * loader/appcache/ApplicationCacheGroup.h:
+
+        Use ApplicationCachHost defined constants, no longer depends on DOMApplicationCache.
+
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::ApplicationCacheHost):
+        (WebCore::ApplicationCacheHost::setDOMApplicationCache):
+        (WebCore::ApplicationCacheHost::notifyEventListener):
+        (WebCore::ApplicationCacheHost::status):
+        * loader/appcache/ApplicationCacheHost.h:
+        (WebCore::ApplicationCacheHost::):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::storeCopyOfCache):
+        * loader/appcache/ApplicationCacheStorage.h:
+
+        Merge recently added transferApplicationCache and pre-existing storeCopyOfCache methods.
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::status):
+        (WebCore::DOMApplicationCache::addEventListener):
+        (WebCore::DOMApplicationCache::removeEventListener):
+        (WebCore::DOMApplicationCache::callListener):
+        (WebCore::DOMApplicationCache::toEventType):
+        (WebCore::DOMApplicationCache::toEventID):
+        * loader/appcache/DOMApplicationCache.h:
+        (WebCore::DOMApplicationCache::setAttributeEventListener):
+        (WebCore::DOMApplicationCache::getAttributeEventListener):
+        (WebCore::DOMApplicationCache::clearAttributeEventListener):
+        (WebCore::DOMApplicationCache::callEventListener):
+        (WebCore::DOMApplicationCache::setOnchecking):
+        (WebCore::DOMApplicationCache::onchecking):
+        (WebCore::DOMApplicationCache::setOnerror):
+        (WebCore::DOMApplicationCache::onerror):
+        (WebCore::DOMApplicationCache::setOnnoupdate):
+        (WebCore::DOMApplicationCache::onnoupdate):
+        (WebCore::DOMApplicationCache::setOndownloading):
+        (WebCore::DOMApplicationCache::ondownloading):
+        (WebCore::DOMApplicationCache::setOnprogress):
+        (WebCore::DOMApplicationCache::onprogress):
+        (WebCore::DOMApplicationCache::setOnupdateready):
+        (WebCore::DOMApplicationCache::onupdateready):
+        (WebCore::DOMApplicationCache::setOncached):
+        (WebCore::DOMApplicationCache::oncached):
+        (WebCore::DOMApplicationCache::setOnobsolete):
+        (WebCore::DOMApplicationCache::onobsolete):
+
+        Use ApplicationCachHost defined constants for Status and EventIDs.
+
+2009-08-04  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Revert r46421 and r46769, which appear to have totally hosed the v8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        * bindings/v8/V8AbstractEventListener.cpp: Revert r46421.
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Revert r46769.
+        (WebCore::ACCESSOR_GETTER):
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27993 - AXSliders are missing required attributes and actions
+        https://bugs.webkit.org/show_bug.cgi?id=27993
+
+        Expose appropriate actions and attributes for sliders.
+
+        Test: platform/mac/accessibility/slider-supports-actions.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::orientation):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation):
+        * accessibility/AccessibilitySlider.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityActionNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-08-04  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix an assert in WebCoreStringResource that causes worker script
+        evaluation failed.
+        https://bugs.webkit.org/show_bug.cgi?id=27996
+
+        The fix is to check for the same thread, instead of the main thread.
+        This is because Chromium's workers use v8 in a single thread that is
+        not the main thread.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::atomicString):
+
+2009-08-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Add support for transitions/animations of text-indent.
+
+        Test: transitions/text-indent-transition.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-08-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Add support for transitions of min- and max-width, and min- and max-height.
+        https://bugs.webkit.org/show_bug.cgi?id=27990
+
+        Test: transitions/min-max-width-height-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27964 - WAI-ARIA: radio button does not determine its label from text content
+        https://bugs.webkit.org/show_bug.cgi?id=27964
+
+        ARIA radio buttons also need to use the text inside of them, like buttons and other roles.
+        Also fixed an issue where an extra space was being appended to some ARIA labels.
+
+        Test: platform/mac/accessibility/aria-radiobutton-text.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::ariaAccessibilityName):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaAccessibilityName):
+        (WebCore::AccessibilityRenderObject::ariaLabeledByAttribute):
+        (WebCore::AccessibilityRenderObject::title):
+        (WebCore::AccessibilityRenderObject::ariaDescribedByAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-08-04  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Missed a place that expects window.event to be hidden when it shouldn't be.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): window.event is no longer hidden.
+
+2009-08-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Bug 27958 - WAI-ARIA: Implement 'aria-required' attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=27958
+
+        Test: platform/mac/accessibility/aria-required.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isRequired):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isRequired):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-08-04  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add QWebPluginDatabase API to the Qt API.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        * WebCore.pro:
+
+2009-08-04  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Adam Treat.
+
+        [Qt] PlusDarker is not supported. Fall back to CompositionMode_Darken
+        (as it is the closest match) instead of CompositionMode_SourceOver.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtCompositionMode):
+
+2009-08-04  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Fix crash when converting empty v8 string to atomic webkit string.
+        https://bugs.webkit.org/show_bug.cgi?id=27975
+
+        collection-null-like-arguments.html tests for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-04  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        selectionHasStyle needs clean up to fix Bug 27858
+        https://bugs.webkit.org/show_bug.cgi?id=27865
+
+        This patch cleans up selectionStartHasStyle and selectionHasStyle.
+        No test is added because the patch does not change any behavior.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getPropertiesNotInComputedStyle): Used in triStateOfStyleInComputedStyle but will be used here as well
+        * editing/ApplyStyleCommand.h: Added the prototype of getPropertiesNotInComputedStyle
+        * editing/Editor.cpp:
+        (WebCore::triStateOfStyleInComputedStyle): Determines if the specified style is present in the specified computed style.
+        (WebCore::Editor::selectionStartHasStyle): Uses triStateOfStyleInComputedStyle
+        (WebCore::Editor::selectionHasStyle): Uses triStateOfStyleInComputedStyle instead of updateState
+
+2009-08-03  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix MessagePort construction in worker process.  Also make the other object constructions match this.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27906
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+
+2009-08-03  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by David Levin.
+
+        [V8] Cache atomic strings in externalized v8 strings
+        https://bugs.webkit.org/show_bug.cgi?id=27762
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::data):
+        (WebCore::WebCoreStringResource::length):
+        (WebCore::WebCoreStringResource::webcoreString):
+        (WebCore::WebCoreStringResource::atomicString):
+        (WebCore::WebCoreStringResource::toStringResource):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+        (WebCore::v8ValueToWebCoreString):
+        (WebCore::v8ValueToAtomicWebCoreString):
+        * bindings/v8/V8Binding.h:
+        (WebCore::):
+        * dom/Document.idl:
+
+2009-08-03  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: DOM Storage Live Updating Should Not Affect Tabbing
+        https://bugs.webkit.org/show_bug.cgi?id=27957
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode): disable storage event listener
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing): disable storage event listener
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled): enable storage event listener
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype._unregisterStorageEventListener): quick return if no listener
+
+2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Consolidate common gcc flags to WebKit.pri
+        https://bugs.webkit.org/show_bug.cgi?id=27934
+
+        * WebCore.pro:
+
+2009-08-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium code sometimes isn't sandboxed and needs to access the FS.
+        https://bugs.webkit.org/show_bug.cgi?id=27954
+
+        These changes are the WebKit side of http://codereview.chromium.org/159778 which
+        aims to make LocalStorage persistent.
+
+        This change runs all FileSystem routines through the ChromiumBridge so that
+        WebKitClients can handle them if they choose to.  For now, the only such client
+        will be the one running in the browser process.
+
+        It also adds a method called sandboxEnabled to the Chromium bridge so that the
+        SQLite file system code can shift its behavior depending on whether we're
+        inside a sandbox or not.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/FileSystemChromium.cpp:
+        (WebCore::deleteFile):
+        (WebCore::deleteEmptyDirectory):
+        (WebCore::getFileModificationTime):
+        (WebCore::directoryName):
+        (WebCore::pathByAppendingComponent):
+        (WebCore::makeAllDirectories):
+        (WebCore::fileExists):
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+
+2009-08-03  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Implement media slider for chromium
+        https://bugs.webkit.org/show_bug.cgi?id=27859
+
+        Implemented the media slider for chromium port. The implementation
+        is using Skia for drawing the thumb and buffered region instead of
+        using any native system controls so different platforms would have
+        the same look and feel.
+
+        No new tests because this is covered by existing tests.
+
+        * css/mediaControlsChromium.css:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+
+2009-07-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460
+        Plumbing and cleanup in advance of returning multiple frames from the
+        ICOImageDecoder:
+        * Make ImageDecoder::frameCount() return a size_t like
+          ImageSource::frameCount() and BitmapImage::frameCount() already do.
+        * Add ImageDecoder::frameSizeAtIndex() alongside size(), to report the
+          size of a particular frame.  Hook all the
+          ImageSource::frameSizeAtIndex() implementations to this.  No
+          ImageDecoder implements this yet; that will come in my next change.
+
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameCount): returns size_t.
+        * platform/graphics/qt/ImageDecoderQt.h: frameCount() returns size_t.
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/graphics/skia/ImageSourceSkia.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize): frameCount() returns size_t.
+        * platform/graphics/win/ImageCairoWin.cpp:
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize): frameCount() returns size_t.
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::size): Clarify comment.
+        (WebCore::ImageDecoder::frameSizeAtIndex): Add.
+        (WebCore::ImageDecoder::frameCount): returns size_t.
+        (WebCore::ImageDecoder::frameBufferAtIndex): Remove unneeded param name.
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::frameCount): returns size_t.
+        (WebCore::GIFImageDecoder::frameBufferAtIndex): frameCount() returns size_t.
+        * platform/image-decoders/gif/GIFImageDecoder.h: frameCount() returns size_t.
+
+2009-08-03  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that could cause an ASSERT to fail incorrectly, leading
+        to a renderer crash in Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27947
+
+        All tests in storage/ pass.
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::~SQLiteTransaction):
+        (WebCore::SQLiteTransaction::begin):
+
+2009-08-03  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Based on work by Yael Aharon.
+
+        Implement keyboard event forwarding for windowless plugins
+        for the Qt port.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::setSharedXEventFields):
+        (WebCore::setXKeyEventSpecificFields):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-08-03  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Make Bottom "Drawer" More Extensible To Support Other Views
+        https://bugs.webkit.org/show_bug.cgi?id=27928
+
+        * English.lproj/localizedStrings.js:
+
+          "Show changes view", "Hide changes view", "Clear changes log", "%d style change", "%d style changes"
+
+        * inspector/front-end/ChangesView.js: Added.
+        (WebInspector.ChangesView):
+        (WebInspector.ChangesView.prototype._clearButtonClicked):
+        (WebInspector.ChangesView.prototype._toggleChangesButtonClicked):
+        (WebInspector.ChangesView.prototype.attach):
+        (WebInspector.ChangesView.prototype.show):
+        (WebInspector.ChangesView.prototype.hide):
+
+          To be a new view to show Changes made via the inspector.  DOM, CSS, or otherwise.
+
+        * inspector/front-end/Console.js: Removed.
+
+          Sliding View aspect moved to Drawer.js.  The "console" itself has moved to ConsoleView.js
+
+        * inspector/front-end/ConsoleView.js: Added.
+
+          Little has changed from its move from Console.js other then support for working with the Drawer.
+
+        * inspector/front-end/Drawer.js: Added.
+        (WebInspector.Drawer):
+        (WebInspector.Drawer.prototype.get visibleView):
+        (WebInspector.Drawer.prototype.set visibleView):
+        (WebInspector.Drawer.prototype.show.animationFinished):
+        (WebInspector.Drawer.prototype.show):
+        (WebInspector.Drawer.prototype.hide.animationFinished):
+        (WebInspector.Drawer.prototype.hide):
+        (WebInspector.Drawer.prototype._safelyRemoveChildren):
+        (WebInspector.Drawer.prototype._startStatusBarDragging):
+        (WebInspector.Drawer.prototype._statusBarDragging):
+        (WebInspector.Drawer.prototype._endStatusBarDragging):
+
+          Allow for multiple views inside the Sliding Drawer.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.renameSelector):
+        (WebInspector.ElementsPanel.prototype.addStyleChange):
+        (WebInspector.ElementsPanel.prototype.removeStyleChange):
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+
+          Starting work on the "Changes" Panel. The ability to generate a Stylesheet from Styles added via the Inspector.
+
+        * inspector/front-end/Images/styleIcon.png: Added.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.isInspectorStylesheet):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+          Interface with ElementsPanel for generating a Stylesheet of Changes.
+
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css: Refactored to allow for multiple views in the drawer.
+        * inspector/front-end/inspector.html: Refactored to allow for multiple views in the drawer.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.get styleChanges):
+        (WebInspector.set styleChanges):
+        (WebInspector._updateChangesCount):
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.showConsole):
+        (WebInspector.showChanges):
+
+          Support for the drawer and "styles changed icon" similar to the "errors and warnings" icons.
+
+2009-08-03  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Correct an assert on a PassRefPtr in the v8 svg bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=27951
+
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        (WebCore::V8SVGDynamicPODTypeWrapper::V8SVGDynamicPODTypeWrapper):
+
+2009-08-03  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27748
+        crash w/ stack overflow when same CSS file loaded repeatedly
+
+        Fix crash caused by a stack overflow when repeatedly loading very large
+        CSS files. CSSRuleData in CSSStyleSelector.h destroyed itself 
+        recursively rather than iteratively.
+
+        Test: fast/css/large-list-of-rules-crash.html
+
+        * css/CSSStyleSelector.h:
+        (WebCore::CSSRuleData::~CSSRuleData):
+        (WebCore::CSSRuleDataList::~CSSRuleDataList):
+
+2009-08-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Make the DRT APIs to pause transitions and animations work for accelerated animations
+        <https://bugs.webkit.org/show_bug.cgi?id=27627>
+        <rdar://problem/6442932>
+
+        Fix the 'pauseAnimationAtTimeOnElementWithId' and 'pauseTransitionAtTimeOnElementWithId' APIs
+        available to LayoutTests to work with accelerated animations and transitions. Done by sending
+        the pause time down to the GraphicsLayer, and using it to stop time on the layer.
+        
+        I also added an assertion to check that the animation has actually started when we
+        try to pause it, to check that the pause time we compute is valid. This revealed a number
+        of tests that tried to pause before animations started, required some amount of test fixing.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::freezeAtTime):
+        * page/animation/AnimationBase.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::pauseTransitionAtTime):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::suspendAnimations):
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::suspendAnimations):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::suspendAnimations):
+        * rendering/RenderLayerBacking.h:
+
+2009-08-03  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix Chromium build by removing PluginView.h from Page.cpp.
+        Chromium doesn't use PluginView and the pointer is never
+        dereferenced so the header doesn't need to be included.
+        https://bugs.webkit.org/show_bug.cgi?id=27946
+
+        No new tests because this is a build fix.
+
+        * page/Page.cpp:
+
+2009-08-03  Eric Carlson  <eric.carlson@apple.com>
+
+        One more build fix after https://bugs.webkit.org/show_bug.cgi?id=46720.
+
+        Unreviewed.
+
+        * WebCoreSources.bkl:
+
+2009-08-03  Eric Carlson  <eric.carlson@apple.com>
+
+        Build fix after https://bugs.webkit.org/show_bug.cgi?id=46720.
+
+        Unreviewed.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27943: Need to implement ARIA role="radiogroup"
+        https://bugs.webkit.org/show_bug.cgi?id=27943
+
+        Test: platform/mac/accessibility/aria-radiogroup.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isRadioGroup):
+        (WebCore::AccessibilityObject::selectedRadioButton):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::selectedRadioButton):
+        (WebCore::RoleEntry::):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper roleDescription]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-08-03  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        HTMLInputElement is not controllable by assistive technologies
+        https://bugs.webkit.org/show_bug.cgi?id=27941
+
+        Test: accessibility/input-slider.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+            Add AccessibilitySlider.cpp/.h
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+            Create AccessibilitySlider and AccessibilitySliderThumb.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::increment):
+        (WebCore::AccessibilityObject::decrement):
+            Add default, do nothing, base class methods.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+            Correct typo.
+
+        * accessibility/AccessibilitySlider.cpp: Added.
+        (WebCore::AccessibilitySlider::AccessibilitySlider):
+        (WebCore::AccessibilitySlider::create):
+        (WebCore::AccessibilitySlider::children):
+        (WebCore::AccessibilitySlider::addChildren):
+        (WebCore::AccessibilitySlider::getAttribute):
+        (WebCore::AccessibilitySlider::valueForRange):
+        (WebCore::AccessibilitySlider::maxValueForRange):
+        (WebCore::AccessibilitySlider::minValueForRange):
+        (WebCore::AccessibilitySlider::changeValue):
+        (WebCore::AccessibilitySlider::setValue):
+        (WebCore::AccessibilitySlider::increment):
+        (WebCore::AccessibilitySlider::decrement):
+        (WebCore::AccessibilitySlider::element):
+        (WebCore::AccessibilitySliderThumb::AccessibilitySliderThumb):
+        (WebCore::AccessibilitySliderThumb::create):
+        (WebCore::AccessibilitySliderThumb::elementRect):
+        (WebCore::AccessibilitySliderThumb::size):
+        * accessibility/AccessibilitySlider.h: Added.
+        (WebCore::AccessibilitySlider::~AccessibilitySlider):
+        (WebCore::AccessibilitySlider::roleValue):
+        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
+        (WebCore::AccessibilitySlider::isSlider):
+        (WebCore::AccessibilitySlider::canSetValueAttribute):
+        (WebCore::AccessibilitySliderThumb::~AccessibilitySliderThumb):
+        (WebCore::AccessibilitySliderThumb::roleValue):
+        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
+        (WebCore::AccessibilitySliderThumb::setParentObject):
+        (WebCore::AccessibilitySliderThumb::parentObject):
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (RoleEntry::):
+            SliderThumbRole -> NSAccessibilityValueIndicatorRole
+        (-[AccessibilityObjectWrapper roleDescription]):
+            Return role description for NSAccessibilitySliderRole and NSAccessibilityValueIndicatorRole.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+            Minor coding style correction.
+        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]):
+            If attachement view handles press action, don't also call object wrapper.
+        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
+            New, call object's increment() method.
+        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
+            New, call object's decrement() method.
+        (-[AccessibilityObjectWrapper accessibilityPerformAction:]):
+            Respond to NSAccessibilityIncrementAction and NSAccessibilityDecrementAction.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::thumbRect):
+            Factor logic out of layout so AccessibilitySliderThumb can get thumb location/size.
+        (WebCore::RenderSlider::layout):
+            Move code to thumbRect().
+        * rendering/RenderSlider.h:
+
+2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Build fix if Netscape plugin support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=27940
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop): Do not call NPN_MemFree if NPAPI is
+        disabled
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::platformStart): Empty stub.
+
+2009-07-31  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE port: LOAD_WITH_ALTERED_SEARCH_PATH param of LoadLibraryEx not supported on WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27917
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load): use LoadLibrary instead of LoadLibraryEx
+
+2009-08-02  Adam Barth  <abarth@webkit.org>
+        Reviewed by Darin Adler.
+
+        SVGElementInstance::scriptExecutionContext should call document() instead of scriptExecutionContext()
+
+        https://bugs.webkit.org/show_bug.cgi?id=27932
+
+        There's no reason to pay for a virtual function call in this case.  We
+        can just call document() directly because we know that element is a
+        Node*.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::scriptExecutionContext):
+
+2009-08-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        JSNodeCustom should call document() instead of scriptExecutionContext()
+        https://bugs.webkit.org/show_bug.cgi?id=27931
+
+        We want to call document() because it's in inline function, instead of
+        scriptExecutionContext() because it's a virtual function.  If we have a
+        Node*, then we know that the virtual function will always return the
+        document anyway.
+
+        There are more instance of this bug, but I'd like to start with a small
+        patch and work up.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::toJSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+
+2009-08-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Anders Carlsson.
+
+        Share implementation of PluginView::userAgent() and userAgentStatic()
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        Differences to the original implementation are as follows:
+        
+            - The Win port used to return 0 for userAgentStatic, but now
+              returns the quirk mode MozillaUserAgent as the other ports.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::userAgent):
+        (WebCore::PluginView::userAgentStatic):
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Anders Carlsson.
+
+        Unregister plugin from PluginMainThreadScheduler if NPP_New fails
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+        
+        Since the plugin has not been started yet (m_isStarted is not set),
+        calling stop() will not have any affect, so we manually unregister
+        in start() before returning.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+
+2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Anders Carlsson.
+
+        Join the various versions of PluginView::stop() into one shared implementation
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The platform-dependent bits are now ifdef'ed in the shared implementation,
+        using the XP_ defines (XP_WIN, XP_MACOSX, XP_UNIX) from npapi.h
+        
+        Differences to the original implementation are as follows:
+
+            - The Qt port unregistered the plugin before calling NP_SetWindow
+              with a 0 window handle. Now it's done after (similar to Win)
+
+            - The GTK and Qt ports unregistered the plugin before clearing
+              the m_npWindow.ws_info struct. Now it's done after.
+              
+            - The Win port constructed the DropAllLocks after unsubclassing
+              the window. Now it's done before.
+              
+            - The Mac, Qt, and GTK ports did not pass a NPSavedData struct
+              to NP_Destroy (like the Win port). Now all ports do.
+
+            - The Win port did not call PluginView::setCurrentPluginView()
+              before calling to NP-functions. Now it does.     
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-07-30  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: let me *edit* css styles in the web inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=27124
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel): added property stylesheet pointing to 1 stylesheet added to the page if needed
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update): handle blank sections
+        (WebInspector.StylesSidebarPane.prototype.addBlankSection): blank section in the correct position
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): helper to get a nice selector for the selectd node
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype.expand):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyInherited):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
+        (WebInspector.StylePropertiesSection.prototype.addNewBlankProperty):
+        (WebInspector.StylePropertiesSection.prototype._dblclickEmptySpace): easily create new properties
+        (WebInspector.StylePropertiesSection.prototype._dblclickSelector):
+        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): allow for editing selectors
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
+        (WebInspector.StylePropertiesSection.prototype._doesSelectorAffectSelectedNode): helper to check if a selector applies to the selected node
+        (WebInspector.BlankStylePropertiesSection.prototype._dblclick):
+        (WebInspector.BlankStylePropertiesSection.prototype.startEditing):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCancelled):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): morph into a StylePropertiesSection
+        (WebInspector.StylePropertyTreeElement.prototype):
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        * inspector/front-end/inspector.css:
+
+2009-07-31  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] check if proxy is present before invoking a handler
+        https://bugs.webkit.org/show_bug.cgi?id=27883 
+
+        Do not invoke handler function if proxy is null pointer (that would lead to access violation
+        anyway)
+
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::callListenerFunction):
+
+2009-08-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Reimplement Elements Panel so that its
+        interaction with DOM is serialized.
+
+        This is a first cut wuth read support for DOM elements
+        tree as well as some limited editing. No properties, no
+        styles, no search capabilities are implemented yet.
+        Set Preferences.useDOMAgent to true in order to try it
+        out, otherwise disabled by default.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27771
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setAttribute):
+        (WebCore::InspectorBackend::removeAttribute):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::domAgent):
+        * inspector/InspectorDOMAgent.cpp: Added.
+        * inspector/InspectorDOMAgent.h: Added.
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/Callback.js: Added.
+        * inspector/front-end/DOMAgent.js: Added.
+        * inspector/front-end/ElementsPanel.js:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-08-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        isContentEditable function in htmlediting.* must be removed
+        https://bugs.webkit.org/show_bug.cgi?id=27870
+
+        This patch removes isContentEditable function in htmlediting.cpp and
+        replaces all usage by calling Node::isContentEditable or its derivatives.
+
+        * editing/AppendNodeCommand.cpp: ditto
+        (WebCore::AppendNodeCommand::AppendNodeCommand): ditto
+        * editing/IndentOutdentCommand.cpp: ditto
+        (WebCore::IndentOutdentCommand::outdentParagraph): ditto
+        * editing/InsertNodeBeforeCommand.cpp: ditto
+        (WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand): ditto
+        * editing/htmlediting.cpp: ditto
+        (WebCore::enclosingNodeWithTag): ditto
+        (WebCore::enclosingNodeOfType): ditto
+        (WebCore::canMergeLists): ditto
+        * editing/htmlediting.h: Updated prototype
+
+2009-08-01  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix a message port handle always getting marked as reachable once it gets entangled.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27824
+
+        No tests since this only arises with the Chromium multi-process message port implementation
+        which isn't in this repostiory.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
+
+2009-07-31  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        Fix Geolocation permission problem
+        https://bugs.webkit.org/show_bug.cgi?id=26993
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::requestPermission):
+
+2009-07-31  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Added project properties as needed by symbian platform
+
+        * WebCore.pro:
+
+2009-07-31  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix compiler warning.
+
+        Initialize member variables in the correct order.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+
+2009-07-31  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Windows build fix!
+
+        Unreviewed.
+
+        * page/win/PageWin.cpp:
+
+2009-07-31  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Mac build fix.
+
+        Unreviewed.
+
+        * page/Page.cpp:
+        Move setCanStartPlugins() from here...
+        * page/win/PageWin.cpp:
+        (WebCore::Page::setCanStartPlugins):
+        ... to here.
+
+2009-07-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/5698113> Safari shouldn't auto-activate plug-ins in
+        background tabs (make Win consistent with Mac)
+
+        https://bugs.webkit.org/show_bug.cgi?id=27855
+
+        Reviewed by Anders Carlsson.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::dispatchDidFailToStartPlugin):
+        Declare a new function to dispatch failures to start plug-ins.
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Initialize new member variable.
+        (WebCore::Page::addUnstartedPlugin):
+        Add the PluginView to the set of unstarted plug-ins.
+        (WebCore::Page::removeUnstartedPlugin):
+        Remove the PluginView from the set of unstarted plug-ins.
+        (WebCore::Page::setCanStartPlugins):
+        If we can now start plug-ins, iterate the set of unstarted plug-ins,
+        starting them. If a plug-in fails to start, dispatch a failed-to-start-
+        plug-in error. Clear the list of unstarted plug-ins.
+
+        * page/Page.h:
+        Added m_canStartPlugins to track whether we can currently start
+        plug-ins. Added m_unstartedPlugins to keep track of plug-ins in the
+        page that are waiting to be started.
+        (WebCore::Page::canStartPlugins):
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        m_mimeType is now a WebCore::String, so we call .utf8(). If NPP_New()
+        fails, set m_status to reflect this; this used to be set by init(), but
+        start() will not be called by init() if we are delaying start().
+        If NPP_New() succeeds, set m_status to reflect this, and call
+        platformStart().
+        (WebCore::PluginView::startOrAddToUnstartedList):
+        If we cannot start plug-ins, add this view to the Page's list of
+        unstarted plug-ins and return true. Otherwise, call start() and return
+        the result.
+        (WebCore::PluginView::removeFromUnstartedListIfNecessary):
+        If we've been started or we don't have a Page, return early. Remove
+        ourselves from the Page's list of unstarted plug-ins.
+        (WebCore::PluginView::bindingInstance):
+        If we haven't been started yet, return 0. This matches the Mac
+        behavior.
+        (WebCore::PluginView::setParameters):
+        If we find the "plug-ins page" parameter, record it; it may be used if
+        we fail to start the plug-in.
+        (WebCore::PluginView::PluginView):
+        Initialize new members m_haveUpdatedPluginWidget. Initialize m_mimeType
+        with mimeType directly; m_mimeType is now a WebCore::String.
+
+        * plugins/PluginView.h:
+        Made start() public, so Page can call it when we start unstarted
+        plug-ins. Changed m_mimeType from CString to String and added
+        m_pluginsPage; these are needed by dispatchDidFailToStartPlugin().
+        (WebCore::PluginView::pluginsPage):
+        Added for dispatchDidFailToStartPlugin().
+        (WebCore::PluginView::mimeType):
+        Ditto.
+        (WebCore::PluginView::url):
+        Ditto.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::platformStart):
+        Stubbed.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        Stubbed.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::platformStart):
+        Stubbed.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        Use m_haveUpdatedPluginWidget to ensure that we will call MoveWindow()
+        and SetWindowRgn() to position the plug-in and set its clip rect if an
+        earlier call to updatePluginWidget() was made before
+        setPlatformPluginWidget() was called to set the plug-in's HWND.
+        (WebCore::PluginView::~PluginView):
+        Call removeFromUnstartedListIfNecessary() to remove the plug-in from
+        the unstarted list if the plug-in is destroyed before it is started.
+        (WebCore::PluginView::init):
+        Call startOrAddtoUnstartedList to start the plug-in or, if plug-ins
+        cannot be started, to add it to the list of plug-ins waiting to be
+        started. Set m_status to indicate success; this is also set by start(),
+        but that may be delayed, and we don't want the loader to dispatch a
+        failed-to-start-plug-in error when we return from init().
+        (WebCore::PluginView::platformStart):
+        Added; code moved from init(). This is now called by start() to perform
+        any platform-specific tasks that need to take place after the plug-in
+        has started. Added a call to updatePluginWidget() to ensure we position
+        the plug-in and set its clip rect after the plug-in has started.
+        Removed the setting of m_status; start() does this before calling this
+        function (and we assert this at the head of the function).
+
+2009-07-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Use checked casts for render tree
+        https://bugs.webkit.org/show_bug.cgi?id=23522
+
+        Next step: Add casts for all the RenderTable classes and use them everywhere.
+
+        Also added a few uses in places that were still using static_cast.
+        Also made some virtual member functions private.
+        Also changed RenderTable::m_tableLayout to use OwnPtr.
+
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        (WebCore::AccessibilityTable::addChildren):
+        (WebCore::AccessibilityTable::cellForColumnAndRow):
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::parentTable):
+        (WebCore::AccessibilityTableCell::rowIndexRange):
+        (WebCore::AccessibilityTableCell::columnIndexRange):
+        (WebCore::AccessibilityTableCell::titleUIElement):
+        * accessibility/AccessibilityTableColumn.cpp:
+        (WebCore::AccessibilityTableColumn::headerObject):
+        * accessibility/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::parentTable):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * editing/TextIterator.cpp:
+        (WebCore::shouldEmitTabBeforeNode):
+        (WebCore::shouldEmitNewlinesBeforeAndAfterNode):
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::parseMappedAttribute):
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::parseMappedAttribute):
+        * page/Frame.cpp:
+        (WebCore::Frame::searchForLabelsAboveCell):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::searchForNSLabelsAboveCell):
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        (WebCore::AutoTableLayout::fullRecalc):
+        (WebCore::shouldScaleColumns):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcPrefWidths):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcPercentageHeight):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::addChild):
+        (WebCore::RenderObject::containingBlock):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::collapsedBottomBorder):
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::table):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::addChild):
+        (WebCore::RenderTableRow::layout):
+        (WebCore::RenderTableRow::paint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild):
+        (WebCore::RenderTableSection::layoutRows):
+        (WebCore::RenderTableSection::lowestPosition):
+        (WebCore::RenderTableSection::rightmostPosition):
+        (WebCore::RenderTableSection::leftmostPosition):
+        (WebCore::RenderTableSection::paintObject):
+        (WebCore::RenderTableSection::recalcCells):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::writeTextRun):
+        Use checked casts.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::styleDidChange): Updated to use OwnPtr.
+        (WebCore::RenderTable::addChild): Use checked cast.
+        (WebCore::RenderTable::layout): Ditto.
+        (WebCore::RenderTable::setCellWidths): Ditto.
+        (WebCore::RenderTable::paintObject): Ditto.
+        (WebCore::RenderTable::splitColumn): Ditto.
+        (WebCore::RenderTable::appendColumn): Ditto.
+        (WebCore::RenderTable::colElement): Ditto.
+        (WebCore::RenderTable::recalcSections): Ditto.
+        (WebCore::RenderTable::outerBorderBottom): Ditto.
+        (WebCore::RenderTable::outerBorderLeft): Ditto.
+        (WebCore::RenderTable::outerBorderRight): Ditto.
+        (WebCore::RenderTable::sectionAbove): Ditto.
+        (WebCore::RenderTable::sectionBelow): Ditto.
+
+        * rendering/RenderTable.h: Added checked cast. Made virtual
+        functions private. Changed m_tableLayout to be a OwnPtr.
+
+        * rendering/RenderTableCell.h: Added checked cast.
+        * rendering/RenderTableCol.h: Ditto. Made virtual functions private.
+        * rendering/RenderTableRow.h: Ditto.
+        * rendering/RenderTableSection.h: Ditto.
+
+2009-07-31  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by John Sullivan.
+
+        <rdar://problem/6973106> and https://bugs.webkit.org/show_bug.cgi?id=27896
+        Favicons are still loaded when automatic image loading is disabled.
+
+        People who want to avoid loading images generally want to avoid loading all images.
+
+        Test: http/tests/misc/favicon-loads-with-images-disabled.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::startIconLoader): After committing the URL mapping, don't actually 
+          perform the load if images shouldn't be loading.
+
+2009-07-31  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+        
+        Accelerated animations stutter on pages with lots of animations and 3d transforms
+        https://bugs.webkit.org/show_bug.cgi?id=27884
+        
+        This patch changes the strategy for synchronizing painting view the view,
+        and compositing layer updates. Previously the strategy was to disable screen
+        updates between the time we updated the layer tree, and painted the view. That
+        left screen updates disabled for too long (hundreds of milliseconds) in some
+        cases, causing animation stutter.
+        
+        The new strategy is to batch up changes to the CA layer tree, and commit them
+        all at once just before painting happens (referred to as a "sync" in the code).
+        GraphicsLayerCA now keeps a bitmask of changed properties, and then migrates
+        the values stored in GraphicsLayer into the CA layer tree at commit time.
+        
+        Compositing layers are then synced in FrameView::paintContents(). However, not
+        all style/layout changes will result in painting; to deal with style changes that
+        touch only compositing properties, we set up a runloop observer that takes care
+        of comitting layer changes when no painting happens.
+
+        * WebCore.base.exp: Export FrameView::syncCompositingStateRecursive()
+
+        * loader/EmptyClients.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive()
+        * page/ChromeClient.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive()
+
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::syncCompositingStateRecursive): syncCompositingState() on the
+        view and all subviews. Like layoutIfNeededRecursive(). If layout is pending, does not
+        sync and returns false, since we only want to sync when layout is done.
+        
+        (WebCore::FrameView::paintContents): syncCompositingState() before painting.
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::endAnimation):
+        Call animationPaused() to notify the graphics layers about animation pausing.
+        
+        * platform/graphics/FloatPoint3D.h:
+        (WebCore::operator==):
+        (WebCore::operator!=): 
+        Add missing comparison operators.
+        
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::setOpacity):
+        (WebCore::GraphicsLayer::setBackgroundColor): Simple setters no longer care about animation info.
+        
+        (WebCore::GraphicsLayer::paintGraphicsLayerContents): Null-check client.
+        
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::AnimationValue:):
+        (WebCore::TransformAnimationValue:):
+        (WebCore::KeyframeValueList:):
+        (WebCore::KeyframeValueList::insert):
+        Cleaned up versions of FloatValue and TransformValue, used to store information
+        about keyframes values.
+
+        (WebCore::GraphicsLayer::contentsRect):
+        (WebCore::GraphicsLayer::setContentsRect):
+        ContentsRect is now a simple setter.
+        
+        (WebCore::GraphicsLayer::addAnimation):
+        (WebCore::GraphicsLayer::removeAnimationsForProperty):
+        (WebCore::GraphicsLayer::removeAnimationsForKeyframes):
+        (WebCore::GraphicsLayer::pauseAnimation):
+        Simplified animation api.
+        
+        (WebCore::GraphicsLayer::setGeometryOrientation):
+        (WebCore::GraphicsLayer::geometryOrientation):
+        setGeometryOrientation is now just a normal member variable.
+        
+        (WebCore::GraphicsLayer::contentsOrientation): add a getter.
+        (WebCore::GraphicsLayer::syncCompositingState): Entry into the layer sync code.
+        
+        * platform/graphics/GraphicsLayerClient.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive)
+
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        Lots of cleanup and refactoring. Main points:
+        - Layer changes are all batched, and only committed to the CA layer on syncCompositingState().
+        - Bitmask is used to store which properties have changed. More efficient than before.
+        - Simpler animation interface; simple setters are no longer confounded with animations.
+        - Refactored code that creates CA animations, and stores which animations are running.
+
+        * platform/graphics/transforms/TransformOperations.h:
+        (WebCore::TransformOperations::size):
+        (WebCore::TransformOperations::at): Useful accessors for size and indexed access.
+        
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        Renamed 'contentsLayer' to 'foregroundLayer' to avoid confusion with GraphicsLayer's
+        contentsLayer.
+        Adapt to GraphicsLayer's simpler animation API.
+        Pass animation pausing through to the graphics layers.
+        contentsBox() is no longer a callback via GraphicsLayerClient.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::setCompositingLayersNeedRebuild):
+        (WebCore::RenderLayerCompositor::scheduleSync):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        scheduleViewUpdate() is no longer required. Instead, we plumb through "compositingLayerSync"
+        notifications, which travel up to WebKit and set up a runloop observer.
+        
+2009-07-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by David Levin.
+
+        Guard needs //'s between #endif and ENABLE(DATAGRID)
+        https://bugs.webkit.org/show_bug.cgi?id=27862
+
+        Compiling this file causes a build break without this change.
+
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
+
+2009-07-31  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Geolocation clean up when no longer updating
+        https://bugs.webkit.org/show_bug.cgi?id=27888
+
+        When Geolocation::disconnectFrame() is called, need to call 
+        Document::setUsingGeolocation(false) to mirror the true call 
+        when it is set up.
+
+        When handling an error, and there are no more listeners, call
+        GeolocationService::stopUpdating().
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::disconnectFrame):
+        (WebCore::Geolocation::handleError):
+
+2009-07-31  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by George Staikos.
+
+        Consolidate GeoLocation code to send positions and errors
+        https://bugs.webkit.org/show_bug.cgi?id=27863
+        
+        Create helper methods that will send positions and errors to either
+        one shots or watchers.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::sendError):
+        (WebCore::Geolocation::sendErrorToOneShots):
+        (WebCore::Geolocation::sendErrorToWatchers):
+        (WebCore::Geolocation::sendPosition):
+        (WebCore::Geolocation::sendPositionToOneShots):
+        (WebCore::Geolocation::sendPositionToWatchers):
+        * page/Geolocation.h:
+
+2009-07-31  Xan Lopez  <xlopez@igalia.com>
+
+        Roll out previous change as it might be causing some weirdness in
+        the bots.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::processFileHeader):
+
+2009-07-31  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix compiler warning.
+        https://bugs.webkit.org/show_bug.cgi?id=27851
+
+        GCC does not like multi-character character constants, so use the
+        explicit numerical value of 'BM' in the enum.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::processFileHeader):
+
+2009-07-30  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Mark Rowe, but Dan Bernstein also reviewed and asked thoughtful questions.
+
+        <rdar://problem/7106968> and https://bugs.webkit.org/show_bug.cgi?id=27868
+        http://www.ruthhuntcandy.com/ goes into infinite refresh in WebKit, works in others.
+        
+        Test: http/tests/misc/meta-refresh-stray-single-quote.html
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseHTTPRefresh): Allow for a stray quote character at the start of the URL string.
+
+2009-07-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Adele Peterson and Jon Honeycutt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=27828> for Mac.
+        Bug 27828: Title attribute is not respected on option elements
+
+        No tests added as it is not clear how to test a tool tip from DumpRenderTree.
+
+        * platform/PopupMenuClient.h: Add a method for retrieving the tool tip of an item.
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::populate): Set the tool tip of the menu item to that of the represented item.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemToolTip): Expose the title attribute of the element as the tool tip.
+        * rendering/RenderMenuList.h:
+        * rendering/RenderTextControlSingleLine.h:
+        (WebCore::RenderTextControlSingleLine::itemToolTip): Return an empty string, indicating no tool tip, for
+        the popup menu in RenderTextControlSingleLine.
+
+2009-07-30  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Remove ChromeClientChromium::setToolTip().
+        https://bugs.webkit.org/show_bug.cgi?id=27861
+
+        This patch is just to remove a temporarily introduced overloaded empty
+        virtual function. No test is needed.
+
+        * page/chromium/ChromeClientChromium.h:
+
+2009-07-30  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27821
+
+        ApplicationCacheHost refactoring.
+        
+        1) Better encapsulate the interfaces between webcore common code
+        and the appcache system within a new class ApplicationCacheHost.
+
+        2) Use that interface throughout the loader system, replacing inline appcache logic.
+
+        3) Implement the interface in terms of webcore's appcache system.
+
+        4) Add the new files to various makefiles.
+
+        5) Implement protocolHostAndPortAreEqual() in KURLGoogle.cpp
+
+        No new features, no new tests. The existing layout tests all pass.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLHtmlElement.cpp:
+        (WebCore::HTMLHtmlElement::insertedIntoDocument):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        (WebCore::DocumentLoader::~DocumentLoader):
+        (WebCore::DocumentLoader::mainReceivedError):
+        (WebCore::DocumentLoader::detachFromFrame):
+        (WebCore::DocumentLoader::setPrimaryLoadComplete):
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::applicationCacheHost):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        (WebCore::MainResourceLoader::didReceiveData):
+        (WebCore::MainResourceLoader::didFinishLoading):
+        (WebCore::MainResourceLoader::didFail):
+        (WebCore::MainResourceLoader::load):
+        * loader/MainResourceLoader.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::load):
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didFail):
+        * loader/ResourceLoader.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::selectCacheWithoutManifestURL):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::disassociateDocumentLoader):
+        (WebCore::ApplicationCacheGroup::update):
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        (WebCore::ApplicationCacheGroup::manifestNotFound):
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::ApplicationCacheGroup::associateDocumentLoaderWithCache):
+        (WebCore::CallCacheListenerTask::create):
+        (WebCore::CallCacheListenerTask::performTask):
+        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
+        (WebCore::ApplicationCacheGroup::postListenerTask):
+        * loader/appcache/ApplicationCacheGroup.h:
+        * loader/appcache/ApplicationCacheHost.cpp: Added.
+        * loader/appcache/ApplicationCacheHost.h: Added.
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::transferApplicationCache):
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::DOMApplicationCache):
+        (WebCore::DOMApplicationCache::disconnectFrame):
+        (WebCore::DOMApplicationCache::applicationCacheHost):
+        (WebCore::DOMApplicationCache::status):
+        (WebCore::DOMApplicationCache::update):
+        (WebCore::DOMApplicationCache::swapCache):
+        (WebCore::DOMApplicationCache::addEventListener):
+        (WebCore::DOMApplicationCache::removeEventListener):
+        (WebCore::DOMApplicationCache::dispatchEvent):
+        (WebCore::DOMApplicationCache::callListener):
+        (WebCore::DOMApplicationCache::toEventName):
+        (WebCore::DOMApplicationCache::toEventType):
+        * loader/appcache/DOMApplicationCache.h:
+        (WebCore::DOMApplicationCache::):
+        (WebCore::DOMApplicationCache::setAttributeEventListener):
+        (WebCore::DOMApplicationCache::getAttributeEventListener):
+        (WebCore::DOMApplicationCache::clearAttributeEventListener):
+        (WebCore::DOMApplicationCache::callEventListener):
+        (WebCore::DOMApplicationCache::setOnchecking):
+        (WebCore::DOMApplicationCache::onchecking):
+        (WebCore::DOMApplicationCache::setOnerror):
+        (WebCore::DOMApplicationCache::onerror):
+        (WebCore::DOMApplicationCache::setOnnoupdate):
+        (WebCore::DOMApplicationCache::onnoupdate):
+        (WebCore::DOMApplicationCache::setOndownloading):
+        (WebCore::DOMApplicationCache::ondownloading):
+        (WebCore::DOMApplicationCache::setOnprogress):
+        (WebCore::DOMApplicationCache::onprogress):
+        (WebCore::DOMApplicationCache::setOnupdateready):
+        (WebCore::DOMApplicationCache::onupdateready):
+        (WebCore::DOMApplicationCache::setOncached):
+        (WebCore::DOMApplicationCache::oncached):
+        (WebCore::DOMApplicationCache::setOnobsolete):
+        (WebCore::DOMApplicationCache::onobsolete):
+        (WebCore::DOMApplicationCache::~DOMApplicationCache):
+        * platform/KURLGoogle.cpp:
+        (WebCore::protocolHostAndPortAreEqual):
+
+2009-07-30  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27854 - crash at WebCore::AXObjectCache::notificationPostTimerFired
+        https://bugs.webkit.org/show_bug.cgi?id=27854
+
+        AccessibilityObjects need to be retained while waiting to fire their notifications, otherwise
+        they can disappear and then lead to crashes.
+       
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::notificationPostTimerFired):
+        (WebCore::AXObjectCache::postNotification):
+        * accessibility/AXObjectCache.h:
+
+2009-07-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Minor change to earlier commit suggested by Darin Adler.
+        Use the variable rather than dereferencing 'it' again.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+
+2009-07-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Animation with a timing function property in a keyframe eats CPU
+        https://bugs.webkit.org/show_bug.cgi?id=27856
+        <rdar://problem/7104476> Animation demo uses lots of CPU
+        
+        Don't include animation-timing-function in the list of properties to
+        animate in a keyframe animation, because this property is not animated;
+        instead, it describes the timing function to apply to this keyframe.
+        
+        This prevents the animation code from thinking that there's a property
+        that it has to software-animate, and thus firing the animation timer frequently.
+        
+        Not testable because there is no visible impact.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation): Don't add
+        CSSPropertyWebkitAnimationTimingFunction to the list of properties to animate.
+
+        * page/animation/KeyframeAnimation.cpp
+        (WebCore::KeyframeAnimation::getKeyframeAnimationInterval): Add a comment
+
+2009-07-30  Mike Fenton  <mike.fenton@torchmobile.com>
+
+         Reviewed by Adam Treat.
+
+         Apply colour style to buttons that use Theme settings in Qt.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27814
+
+         * platform/qt/RenderThemeQt.cpp:
+         (WebCore::RenderThemeQt::adjustButtonStyle):
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make WebCore compile with the new JS number representation.
+
+        * ForwardingHeaders/runtime/JSAPIValueWrapper.h: Added.
+        * ForwardingHeaders/runtime/JSNumberCell.h: Removed.
+        * bindings/js/ScriptEventListener.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/c/c_instance.cpp:
+
+2009-07-30  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Don't try to hash member function pointers, instead use a precomputed value based on the field.
+        https://bugs.webkit.org/show_bug.cgi?id=27843
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        (WebCore::PODTypeWrapperCacheInfo::PODTypeWrapperCacheInfo):
+        (WebCore::PODTypeWrapperCacheInfo::operator==):
+        (WebCore::PODTypeWrapperCacheInfoHash::hash):
+        (WebCore::V8SVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix compiler warning.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-07-29  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a way to register V8 extensions for Isolated Worlds only.
+        https://bugs.webkit.org/show_bug.cgi?id=27785
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInNewWorld):
+        (WebCore::ScriptController::evaluateInNewContext):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::evaluate):
+        * bindings/v8/V8IsolatedWorld.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::registerExtensionWithV8):
+        (WebCore::V8Proxy::registerExtension):
+        * bindings/v8/V8Proxy.h:
+
+2009-07-30  Mike Fenton  <mike.fenton@torchmobile.com>
+
+         Reviewed by Adam Treat.
+
+         Add previously defined out support to PopupMenuQt for marking entries as
+         disabled and for selecting the desired item.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27772
+
+         * platform/qt/PopupMenuQt.cpp:
+         (WebCore::PopupMenu::populate):
+
+2009-07-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Use checked casts for render tree
+        https://bugs.webkit.org/show_bug.cgi?id=23522
+
+        Next step: Add new toRenderWidget cast and use it everywhere.
+
+        Use checked casts in all the places that were using static_cast
+        but there is a checked cast available.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::stringValue):
+        (WebCore::AccessibilityRenderObject::widget):
+        (WebCore::AccessibilityRenderObject::widgetForAttachmentView):
+        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+        * dom/Document.cpp:
+        (WebCore::widgetForNode):
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::findWidgetRenderer):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::defaultEventHandler):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::defaultEventHandler):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::writeRawData):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::subframeForTargetNode):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/Frame.cpp:
+        (WebCore::isFrameElement):
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::computePageRects):
+        * page/android/EventHandlerAndroid.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/chromium/FrameChromium.cpp:
+        (WebCore::computePageRectsForFrame):
+        * page/gtk/EventHandlerGtk.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/haiku/EventHandlerHaiku.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        * page/win/FrameWin.cpp:
+        (WebCore::computePageRectsForFrame):
+        * page/wx/EventHandlerWx.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::getCachedImage):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeImage):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::getCachedImage):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::getCachedImage):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::boxModelObject):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::addChildToContinuation):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateImageContents):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::RenderTextControlInnerBlock::positionForPoint):
+        Use checked cast instead of static_cast.
+        
+        * rendering/RenderWidget.h: Added toRenderWidget.
+
+2009-07-30  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: some files modified to build for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27816
+
+        * accessibility/AccessibilityObject.h:
+        * page/win/EventHandlerWin.cpp:
+        (WebCore::EventHandler::createDraggingClipboard):
+        * platform/win/PlatformMouseEventWin.cpp:
+        (WebCore::messageToEventType):
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::deviceInfoForWidget):
+        (WebCore::screenIsMonochrome):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::paint):
+        (WebCore::registerPopup):
+        (WebCore::PopupWndProc):
+
+2009-07-30  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: modified graphics files
+        https://bugs.webkit.org/show_bug.cgi?id=27779
+
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::mayFillWithSolidColor):
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/graphics/Path.h:
+        * platform/graphics/Pattern.h:
+        * platform/graphics/transforms/Matrix3DTransformOperation.cpp:
+        (WebCore::Matrix3DTransformOperation::blend):
+        * platform/graphics/transforms/MatrixTransformOperation.cpp:
+        (WebCore::MatrixTransformOperation::blend):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::operator*):
+        * platform/graphics/win/IconWin.cpp:
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+
+2009-07-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Improve efficiency by rewriting code doing three hash table
+        lookups, which can be replaced by just one as pointed out
+        by Darin Adler.
+
+        Though being slightly less clear, this should be considerable
+        faster.
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::remove):
+
+2009-07-30  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Code cleanup in MediaPlayerPrivateGStreamer.cpp|h and VideoSinkGStreamer.cpp|h (Part 2)
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Removed unneeded includes (gdk.h and gtk.h) and added glib.h and cairo.h instead.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-07-30  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Code cleanup in MediaPlayerPrivateGStreamer.cpp|h and VideoSinkGStreamer.cpp|h (Part 1)
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Fixed many code style issues pointed by WebKitTools/Scripts/modules/cpplint.py
+        No functionality change at all.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        * platform/graphics/gtk/VideoSinkGStreamer.h:
+
+2009-07-30  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow to explicitly choose a preferred plugin for a mimetype.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        When the preferred plugin is set for a specific MIME type, it will be
+        always picked up, regardless of its version, quirks etc.
+
+        Client applications may want to use that API to resolve mimetype
+        ambiguity in a custom way, rather than in the default way that is
+        currently used in WebKit.
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::pluginForMIMEType):
+        (WebCore::PluginDatabase::MIMETypeForExtension):
+        (WebCore::PluginDatabase::setPreferredPluginForMIMEType): Added.
+        (WebCore::PluginDatabase::remove):
+        (WebCore::PluginDatabase::clear):
+        * plugins/PluginDatabase.h:
+
+2009-07-30  Jakub Wieczorek  <faw217@gmail.com>
+
+        [Qt] Fix build with Qt 4.4 after r46535.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+
+2009-07-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Video elements fires another "load" event when attached to DOM
+        https://bugs.webkit.org/show_bug.cgi?id=27623
+
+        Test: media/media-load-event.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::insertedIntoDocument):
+            Only schedule load when element's network state is NETWORK_EMPTY.
+
+2009-07-30  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Cache v8 strings when converting from WebCore::String to v8 string.
+        https://bugs.webkit.org/show_bug.cgi?id=27655
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8String): now just immediately calls v8ExternalString
+        (WebCore::enableStringImplCache): enables caching of conversions from WebCore::StringImpl to
+        v8::String
+        (WebCore::makeExternalString): utilty function to create external v8::String out of
+        WebCore::String
+        (WebCore::getStringCache): static function to access string cache
+        (WebCore::cachedStringCallback): callback for weak handles of v8::Strings stored in the
+        cache
+        (WebCore::v8ExternalString): if caching enabled, checks if there is already v8::String for
+        the given WebCore::StringImpl.  If present, returns it, otherwise creates a new v8 external
+        string.
+        * bindings/v8/V8Binding.h:
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25535
+        [GTK] object:state-changed:checked events missing for radio buttons and checkboxes
+
+        Implement state-changed:checked for radio buttons and checkboxes.
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Forgot the 'break'.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix Mac build.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-07-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Adam Barth.
+
+        Add missing enumeration value to switch.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-07-29  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Workers need to throw an exception when presented with invalid URLs.
+        https://bugs.webkit.org/show_bug.cgi?id=27770
+
+        Tests covered by worker-constructor.html and worker-redirect.html.
+
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::constructWorker):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        * workers/Worker.h:
+        (WebCore::Worker::create):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
+        (WebCore::WorkerScriptLoader::createResourceRequest):
+        * workers/WorkerScriptLoader.h:
+
+2009-07-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        (REGRESSION: r46039) Should restore previous connections-per-host limit for non-http(s) hosts
+        https://bugs.webkit.org/show_bug.cgi?id=27822 and <rdar://problem/7091659>
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests): For non-http(s) hosts, restore the previous behavior of 
+          only limiting connections while parsing and still trying to figure out stylesheet urls.
+
+2009-07-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Add WebCore/page/wince/FrameWince.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27729
+
+        * page/wince/FrameWince.cpp: Added.
+
+2009-07-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        REGRESSION(r46370-46426): /editing/style/remove-underline-from-stylesheet.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=27809
+
+        The patch primarily rebaselines the tests but also fixes the bug in currentlyHasStyle.
+        To determine that a particular text decoration is present, currentlyHasStyle should refer to
+        -webkit-text-decorations-in-effect to take care of styles set by u, s, strike tags and ancestors' CSS.
+        We also need to update layout to accommodate the changes made within ApplyStyleCommand.
+
+        * editing/ApplyStyleCommand.cpp: ditto
+        (WebCore::StyleChange::currentlyHasStyle): ditto
+
+2009-07-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: changes to platform/text files
+        https://bugs.webkit.org/show_bug.cgi?id=27715
+
+        * platform/text/String.cpp:
+        (WebCore::String::format):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+
+2009-07-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        FIX: HDC leaks in PopupMenuWin.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27817
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::paint):
+
+2009-07-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Illegal values for <ol start> cause list numbering start at 0 (should start at 1)
+        https://bugs.webkit.org/show_bug.cgi?id=27810
+
+        Test: fast/lists/ol-start-parsing.html
+
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::parseMappedAttribute): Check the result of toInt
+        and use the value 1 if it failed to parse. Before we were getting toInt's default
+        behavior, which is to return 0.
+
+2009-07-29  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Added foundation work to allow a testing infrastructure for the Web
+        Inspector.
+
+        * inspector/InspectorClient.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::scriptObjectReady): Tell the testing
+        harness that the window object is ready.
+        * loader/EmptyClients.h: Empty class support for SVG.
+        (WebCore::EmptyInspectorClient::inspectorWindowObjectCleared):
+
+2009-07-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Build fix for windows after landing
+        Bug 27807 - AX: move re-usable code into more common areas for other platforms
+   
+        Apparently bzero doesn't exist on windows.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
+
+2009-07-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        Bug 27807 - AX: move re-usable code into more common areas for other platforms
+        https://bugs.webkit.org/show_bug.cgi?id=27807
+
+        Moves some accessibility code that was in the Mac file to a more common place so 
+        it can be used by other platforms. 
+        This includes:
+           Making TextMarkerData from a VisiblePosition.
+           Making a VisiblePosition from TextMarkerData.
+           Finding the anchor accessibility object for an arbitrary Node.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::visiblePositionForTextMarkerData):
+        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
+        * accessibility/AXObjectCache.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::anchorElementForNode):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::visiblePositionForIndex):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (textMarkerForVisiblePosition):
+        (visiblePositionForTextMarker):
+        (AXAttributedStringAppendText):
+
+2009-07-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Inset box shadows are incorrectly accounted for in visual overflow
+        computations
+        https://bugs.webkit.org/show_bug.cgi?id=27811
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally): Use
+            getBoxShadowHorizontalExtent().
+        (WebCore::InlineFlowBox::placeBoxesVertically): Use
+            getBoxShadowVerticalExtent(). Removed duplicate code to get the
+            text-shadow overflow.
+        (WebCore::InlineFlowBox::paint): Use getBoxShadowHorizontalExtent().
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::overflowHeight): Use
+            getBoxShadowVerticalExtent().
+        (WebCore::RenderBlock::overflowWidth): Use
+            getBoxShadowHorizontalExtent().
+        (WebCore::RenderBlock::overflowLeft): Ditto.
+        (WebCore::RenderBlock::overflowTop): Use getBoxShadowVerticalExtent().
+        (WebCore::RenderBlock::overflowRect): Use getBoxShadowExtent().
+        (WebCore::RenderBlock::layoutBlock): Ditto.
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock): Ditto.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateRects): Exclude inset shadows.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Use
+            getBoxShadowHorizontalExtent() and getBoxShadowVerticalExtent().
+        (WebCore::RenderObject::adjustRectForOutlineAndShadow): Exclude inset
+            shadows.
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Ditto.
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setTextShadow): Also assert that text-shadows are
+            not inset.
+        (WebCore::RenderStyle::getBoxShadowExtent): Added. Excludes inset
+            shadows.
+        (WebCore::RenderStyle::getBoxShadowHorizontalExtent): Ditto.
+        (WebCore::RenderStyle::getBoxShadowVerticalExtent): Ditto.
+        * rendering/style/RenderStyle.h:
+
+2009-07-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix crash when an element with display: table-row is composited (e.g. via a 3d-transform)
+        https://bugs.webkit.org/show_bug.cgi?id=27796
+        
+        Avoid repainting when a layer becomes composited if the renderer is not parented
+        yet, because it makes no sense to do so.
+        
+        If the table row is a repaint container, default to the RenderBox implementation
+        of clippedOverflowRectForRepaint(), because we cannot hand off the repaint rect
+        computation to something that is above the repaint container.
+
+        Test: fast/table/table-row-compositing-repaint-crash.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::repaintOnCompositingChange):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::clippedOverflowRectForRepaint):
+
+2009-07-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27791
+        307 redirects of POSTs should use POST, not GET
+
+        Test: http/tests/loading/redirect-methods.html
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+
+2009-07-29  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Adding -webkit-animation-play-state back in
+        https://bugs.webkit.org/show_bug.cgi?id=26867
+
+        We've decided to keep -webkit-animation-play-state. So this
+        just adds back in the code from https://bugs.webkit.org/show_bug.cgi?id=22907.
+
+        Test: animations/play-state.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseAnimationPlayState):
+        (WebCore::CSSParser::parseAnimationProperty):
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapAnimationPlayState):
+        * css/CSSStyleSelector.h:
+        * platform/animation/Animation.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Expose the default plugin directories and the current directory set of
+        the plugin database as public API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        * plugins/PluginDatabase.h:
+        (WebCore::PluginDatabase::pluginDirectories):
+
+2009-07-29  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Font size for current time display in media controls panel
+        is affected by body font size.
+        https://bugs.webkit.org/show_bug.cgi?id=27799
+
+        Fixing the problem of rendering by explicitly setting the font size
+        for the time displays.
+
+        No new tests since this is covered by existing media tests.
+
+        * css/mediaControlsChromium.css:
+
+2009-07-29  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Update WebCore/page/ContextMenuController.cpp to conform to WebKit
+        Style Guidelines as identified by cpp_style.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27613
+
+        * page/ContextMenuController.cpp:
+        (WebCore::openNewWindow):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+
+2009-07-29  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Removed unused wrapCPointer/extractCPointer from the v8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=27805
+
+        * bindings/v8/V8DOMWrapper.h:
+
+2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Expose the PluginDatabase::pluginForMIMEType() function as public API.
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        It can be used to determine the appropriate plugin for a mime type,
+        without guessing the mimetype from the extension.
+
+        * plugins/PluginDatabase.h:
+
+2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Treat.
+
+        Allow to enable/disable particular plugin packages.
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Disabled plugins will not be picked up when looking for a plugin
+        supporting the requested mimetypes.
+
+        Client applications may want to use that API to disable specific
+        plugins.
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::pluginForMIMEType):
+        (WebCore::PluginDatabase::MIMETypeForExtension):
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::PluginPackage):
+        (WebCore::PluginPackage::setEnabled):
+        * plugins/PluginPackage.h:
+        (WebCore::PluginPackage::isEnabled):
+
+2009-07-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        [WML] Running WML tests in random order multiple times exposes subtle bugs
+        https://bugs.webkit.org/show_bug.cgi?id=27801
+
+        Remove superflous assertions regarding the parent node. Under certain circumstances
+        these can even fire (related to garbage collection while destructing). Fixes random order
+        WML tests (run-webkit-tests fast/wml wml http/tests/wml fast/wml ... --random)
+
+        The wml/enter-first-card-with-events.html test relied on a bug in our implementation of
+        WMLPageState::reset() - the history stack should still contain the current card afterwards.
+        Fix that bug by preserving the first item in BackForwardList::clearWMLPageHistory().
+
+        * history/BackForwardList.cpp: Preserve first item in history stack, as demanded by the spec.
+        (WebCore::BackForwardList::clearWMLPageHistory):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::insertedIntoDocument):
+        (WebCore::WMLDoElement::removedFromDocument):
+        * wml/WMLNoopElement.cpp:
+        (WebCore::WMLNoopElement::insertedIntoDocument):
+        * wml/WMLOnEventElement.cpp:
+        (WebCore::eventHandlingParent):
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::insertedIntoDocument):
+        (WebCore::WMLPostfieldElement::removedFromDocument):
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::insertedIntoDocument):
+        (WebCore::WMLSetvarElement::removedFromDocument):
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::insertedIntoDocument):
+        (WebCore::WMLTaskElement::removedFromDocument):
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::insertedIntoDocument):
+        (WebCore::WMLTimerElement::removedFromDocument):
+
+2009-07-29  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26848
+        [Qt] ResourceHandle::willLoadFromCache needs to be implemented QtWebKit.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem):
+        * platform/network/ResourceHandle.h:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-07-29  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Media control panel for <video> in MediaDocument is mis-placed
+        https://bugs.webkit.org/show_bug.cgi?id=27798
+
+        Fixing a rendering problem: When <video> is displayed in MediaDocument,
+        the media control panel overlaps with the video by 16 pixels.
+
+        No new tests as this is covered by existing media tests.
+
+        * css/mediaControlsChromium.css:
+
+2009-07-29  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix for Chromium.  Those last two patches weren't
+        independent despite the clean merge.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+
+2009-07-29  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        ImageSourceCG makes bad data refs (race condition causes blank images)
+        https://bugs.webkit.org/show_bug.cgi?id=27777
+
+        Make ImageSourceCG guarantee that the lifetime of the SharedBuffer that
+        backs the CFDataRef will be long enough.
+
+        No new tests, as this fixes a bug with a race condition that is
+        difficult to trigger.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::setData):
+
+2009-07-29  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console should show completions for the command line APIs
+        https://bugs.webkit.org/show_bug.cgi?id=27696
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._reportCompletions): Adds properties from _inspectorCommandLineAPI to 
+        completions when available.
+        * inspector/front-end/utilities.js:
+        (Object.properties): Added.
+        (Object.sortedProperties):
+
+2009-07-29  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Refactor the first step of layout in RenderFlexibleBox.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27704
+
+        No new tests as this change is just a refactoring.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::gatherFlexChildrenInfo):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+
+2009-07-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fix a bug that HTMLOptionElement::value() returns an incorrect
+        value in a case that the element has a label attribute and no
+        value attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=27760
+
+        Test: fast/forms/option-value-and-label.html
+
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::collectOptionLabelOrText):
+        (WebCore::OptionElement::collectOptionInnerText):
+        (WebCore::OptionElement::normalizeText):
+        (WebCore::OptionElement::collectOptionTextRespectingGroupLabel):
+        (WebCore::OptionElement::collectOptionValue):
+        * dom/OptionElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::text):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::text):
+
+2009-07-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world wrappers for event handlers
+        https://bugs.webkit.org/show_bug.cgi?id=27533
+
+        Instead of getting the context from the frame, we cache the context
+        when the listener is created so that we get the context for the right
+        world.
+
+        Test: http/tests/security/isolatedWorld/click-event.html
+
+        * WebCore.gypi:
+        * bindings/v8/OwnHandle.h: Added.
+        (WebCore::OwnHandle::OwnHandle):
+        (WebCore::OwnHandle::~OwnHandle):
+        (WebCore::OwnHandle::get):
+        (WebCore::OwnHandle::set):
+        (WebCore::OwnHandle::release):
+        (WebCore::OwnHandle::adopt):
+        (WebCore::OwnHandle::swap):
+        (WebCore::OwnHandle::clear):
+        (WebCore::OwnHandle::makeWeak):
+        (WebCore::OwnHandle::weakCallback):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8DOMWrapper.h:
+
+2009-07-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach V8Proxy::context about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27701
+
+        Change V8Proxy::context(Frame*) to understand isolated worlds.  Audit
+        all callers of this method to make sure they want isolated worlds.  In
+        cases where we really want the main world, I've changed the call to
+        V8Proxy::mainWorldContext(Frame*).
+        
+        The main visible change is to the document.open method when called with
+        more than two arguments.  This design seems more likely to lead to
+        future correct code.
+
+        Test: http/tests/security/isolatedWorld/document-open.html
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::bindToWindowObject):
+        (WebCore::ScriptController::collectGarbage):
+        (WebCore::createScriptObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        * bindings/v8/V8Helpers.cpp:
+        (WebCore::toV8Context):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::bindJsObjectToWindow):
+        * bindings/v8/V8Proxy.h:
+
+2009-07-29  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build, add missing file.
+
+        * WebCore.pro:
+
+2009-07-28  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Speculative fix for <rdar://problem/7005077> WER: Crash in
+        WebCore::PluginStream::destroyStream+279 (1310510882)
+
+        Reviewed by Oliver Hunt.
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::destroyStream):
+        Move the "protector" RefPtr out of the block that dispatches
+        notifications and into the function level; if NPN_DestroyStream were
+        called from NPP_NewStream as the comment warns, we would be deleted at
+        the end of the block.
+
+2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Inspector: Tab Through the DOM Storage DataGrid when Editing
+
+        https://bugs.webkit.org/show_bug.cgi?id=27746
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode): refactored to directly edit and select a column
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted.moveToNextIfNeeded): handles moveDirection on a commit
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted): uses moveToNext to traverse appropriately
+
+2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Inspector: Create New DOM Storage Items via DataGrid
+
+        https://bugs.webkit.org/show_bug.cgi?id=27322
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing): click anyway means creationNode
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted): fix unintended globals
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow): creationNode is special case
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.addCreationNode): maintain a quick ref to the single creationNode
+        (WebInspector.CreationDataGridNode): new type of node
+        (WebInspector.CreationDataGridNode.prototype.makeNormal): convert to a normal node
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage): add a creationNode to the GridData
+
+2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Inspector: Automatically Refresh DOM Storage Grids on "storage" event
+
+        https://bugs.webkit.org/show_bug.cgi?id=27400
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.show): trigger adding the listener
+        (WebInspector.DatabasesPanel.prototype.reset): trigger removing the listener
+        (WebInspector.DatabasesPanel.prototype._registerStorageEventListener): register the listener on the inspected window
+        (WebInspector.DatabasesPanel.prototype._unregisterStorageEventListener): unregister the listener on the inspected window
+        (WebInspector.DatabasesPanel.prototype._storageEvent): handle the storage event
+
+2009-07-28  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Inspector should support inspect() in the command line.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19874
+        rdar://problem/6070225
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled.inspectObject):
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.revealAndSelectDomStorage): Added.
+        (WebInspector.DatabasesPanel.prototype.revealAndSelectDatabase): Added.
+        (WebInspector.DatabasesPanel.prototype.showDatabase): 
+
+2009-07-28  Keishi Hattori  <casey.hattori@gmail.com>
+
+        The rest of: Web Inspector: Add inspected node using public console API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27758
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled): Removed _inspectorCommandLineAPI._addInspectedNode.
+        (WebInspector.Console.prototype.addInspectedNode): Added.
+
+2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Accept autocomplete on 'End' key pressed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27447.
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.handleKeyEvent):
+
+2009-07-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by David Levin.
+
+        [Qt] Build fix after r46502
+        https://bugs.webkit.org/show_bug.cgi?id=27789
+
+        * WebCore.pro: Remove StorageArea.cpp
+
+2009-07-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Follow-on fix to r35582.  Replace main thread assertions with WebCoreObjCScheduleDeallocateOnMainThread
+        in -dealloc overrides in DOMObject subclasses.
+
+        * bindings/scripts/CodeGeneratorObjC.pm:
+
+2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        [WML] WML*Element classes mostly implement insertedIntoDocument(), not removedFromDocument()
+        https://bugs.webkit.org/show_bug.cgi?id=27786
+
+        WML*Element classes mostly implement insertedIntoDocument(), not removedFromDocument().
+        The only case where this is relevant in WML is error handling. The parsed WML
+        tree fragment is inserted in an XHTML compound error document. This requires
+        removedFromDocument() to be correctly implemented otherwhise we run into
+        trouble (visible when using run-webkit-tests fast/wml --random).
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::registerTask):
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLAnchorElement.h:
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::removedFromDocument):
+        (WebCore::WMLDoElement::registerTask):
+        (WebCore::WMLDoElement::deregisterTask):
+        * wml/WMLDoElement.h:
+        * wml/WMLEventHandlingElement.cpp:
+        (WebCore::WMLEventHandlingElement::registerDoElement):
+        (WebCore::WMLEventHandlingElement::deregisterDoElement):
+        * wml/WMLEventHandlingElement.h:
+        * wml/WMLFieldSetElement.cpp:
+        (WebCore::WMLFieldSetElement::removedFromDocument):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::registerPostfieldElement):
+        (WebCore::WMLGoElement::deregisterPostfieldElement):
+        * wml/WMLGoElement.h:
+        * wml/WMLIntrinsicEventHandler.cpp:
+        (WebCore::WMLIntrinsicEventHandler::deregisterIntrinsicEvent):
+        * wml/WMLIntrinsicEventHandler.h:
+        * wml/WMLOnEventElement.cpp:
+        (WebCore::eventHandlingParent):
+        (WebCore::WMLOnEventElement::registerTask):
+        (WebCore::WMLOnEventElement::deregisterTask):
+        * wml/WMLOnEventElement.h:
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::removedFromDocument):
+        * wml/WMLPostfieldElement.h:
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::removedFromDocument):
+        * wml/WMLSetvarElement.h:
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::removedFromDocument):
+        (WebCore::WMLTaskElement::registerVariableSetter):
+        (WebCore::WMLTaskElement::deregisterVariableSetter):
+        (WebCore::WMLTaskElement::storeVariableState):
+        * wml/WMLTaskElement.h:
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::removedFromDocument):
+        * wml/WMLTimerElement.h:
+
+2009-07-28  David Levin  <levin@chromium.org>
+
+        Suggested by Drew Wilson.
+
+        Speculative gtk build fix, follow up to:
+        https://bugs.webkit.org/show_bug.cgi?id=27697
+
+        * GNUmakefile.am:
+
+2009-07-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        [CSS3 Backgrounds and Borders] Drop the prefix from the border-radius
+        properties
+        https://bugs.webkit.org/show_bug.cgi?id=27578
+
+        [CSS3 Backgrounds and Borders] Handle the / and 4 values in
+        border-radius
+        https://bugs.webkit.org/show_bug.cgi?id=27584
+
+        Test: fast/borders/border-radius-parsing.html
+
+        Dropped the -webkit- prefix from the individual corner border-radius
+        properties. Added border-radius with the / and 4-value syntax, and
+        maintained -webkit-border-radius with legacy 2-value syntax.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (computedProperties): Removed Webkit prefix.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Removed Webkit prefix from the
+            single-corner properties. Call out to parseBorderRadius() to parse
+            border-radius and -webkit-border-radius. 
+        (WebCore::completeBorderRadii): Added this helper function that
+            completes the values for all four corners when fewer than four are
+            specified.
+        (WebCore::CSSParser::parseBorderRadius): Added.
+        (WebCore::cssPropertyID): Map -webkit-border-*-*-radius to the
+            unprefixed property.
+        * css/CSSParser.h:
+        * css/CSSPropertyLonghand.cpp:
+        (WebCore::initShorthandMap): Removed the Webkit prefix. Added an entry
+            for border-radius. Kept the entry for -webkit-border-radius.
+        * css/CSSPropertyNames.in: Removed the -webkit- prefix from the
+            single-corenr properties. Added border-radius. Kept
+            -webkit-border-radius because of its conflicting syntax.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Removed the Webkit prefix.
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap): Ditto.
+
+2009-07-28  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Refactored dedicated-worker-specific code from WorkerThread into DedicatedWorkerThread class.
+
+        WorkerThread needs to be refactored to separate out dedicated-worker functionality.
+        https://bugs.webkit.org/show_bug.cgi?id=27697
+
+        This is just a refactoring, so existing tests suffice.
+
+        * GNUmakefile.am:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.gypi:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.pro:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.vcproj/WebCore.vcproj:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.xcodeproj/project.pbxproj:
+        Added DedicatedWorkerThread.h/.cpp
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        Removed code to track pending activity - this is handled by DedicatedWorkerContext::importScripts() now.
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        Removed code to track pending activity - this is handled by DedicatedWorkerContext::importScripts() now.
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
+        (WebCore::DedicatedWorkerContext::addMessage):
+        Forwards console messages to parent document.
+        (WebCore::DedicatedWorkerContext::importScripts):
+        Now sends the updated pending activity status after importing scripts.
+        (WebCore::DedicatedWorkerContext::thread):
+        Helper routine that casts WorkerThread to DedicatedWorkerThread.
+        * workers/DedicatedWorkerContext.h:
+        (WebCore::DedicatedWorkerContext::create):
+        * workers/DedicatedWorkerThread.cpp: Added.
+        (WebCore::DedicatedWorkerThread::create):
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        (WebCore::DedicatedWorkerThread::~DedicatedWorkerThread):
+        (WebCore::DedicatedWorkerThread::createWorkerContext):
+        Implementation of the base class factory method to create the appropriate worker context.
+        (WebCore::DedicatedWorkerThread::runEventLoop):
+        Reports pending activity before running the event loop.
+        * workers/DedicatedWorkerThread.h: Added.
+        (WebCore::DedicatedWorkerThread::workerObjectProxy):
+        Moved from base class.
+        * workers/WorkerContext.cpp:
+        * workers/WorkerContext.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        Now creates DedicatedWorkerThread.
+        (WebCore::WorkerMessagingProxy::workerThreadCreated):
+        Now is passed a DedicatedWorkerThread.
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        Moved workerObjectProxy param into derived class constructor.
+        (WebCore::WorkerThread::workerThread):
+        (WebCore::WorkerThread::runEventLoop):
+        Moved the event loop execution into a virtual function so DedicatedWorkerThread could report pending activity first.
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::workerContext):
+
+2009-07-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix V8NPUtils' handling of UTF8 identifiers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27782
+
+        * bindings/v8/V8NPUtils.cpp:
+        (getStringIdentifier): Treat the input string as UTF8 instead of ASCII,
+            since NPN_GetStringIdentifier() is expecting UTF8.
+
+2009-07-28  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Misc cleanup in DOM Storage.
+        https://bugs.webkit.org/show_bug.cgi?id=27517
+
+        The StorageAreaImpl changes are all for Chromium.  Because the DOM Storage implementation
+        runs in a different process from where the Frame object lives, Chromium passes in NULL
+        for the sourceFrame.  This affects events and handling privateBrowsing.  Chromium's
+        incognito mode does not use the private browsing setting, so that's not a concern.  As for
+        events, I've decided to simply disable them for now.
+
+        The StorageNamespaceImpl changes get rid of a stale comment (path is .copy'ed for thread-
+        safety) and to add an assert that .copy is only ever called on a SessionStorage namespace.
+
+        Also cleaned up tailing whitespace in several parts of StorageAreaImpl.cpp
+
+        * storage/StorageArea.cpp: Removed.  (It was empty anyway.)
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::privateBrowsingEnabled): Factored out the check.
+        (WebCore::StorageAreaImpl::setItem): Make frame optional.
+        (WebCore::StorageAreaImpl::removeItem): ditto
+        (WebCore::StorageAreaImpl::clear): ditto
+        (WebCore::StorageAreaImpl::dispatchStorageEvent): Disable in Chromium for now.
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl): Remove stale comment.
+        (WebCore::StorageNamespaceImpl::copy): Add assert that it's SessionStorage.
+
+2009-07-28  Alpha Lam  <hclam@google.com>
+
+        Reviewed by David Levin.
+
+        [chromium] Default UI controls for <video> has rendering problems
+        https://bugs.webkit.org/show_bug.cgi?id=27669
+
+        Fixes the bug that <video> in MediaDocument is 1 pixel tall if
+        it is playing an audio file by changing the style to be 32px
+        tall.
+
+        Also fixes a problem of default styled audio tag that hides the
+        all the time digits by expanding the width to 300px.
+
+        Changed the size and position of the current time and remaining
+        display to give enough space for the hour digit to be shown.
+
+        There are no new tests provided because this is already covered
+        by existing tests.
+
+        * css/mediaControlsChromium.css:
+
+2009-07-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix style in PluginPackage and PluginDatabase.
+        Part of https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::refresh):
+        (WebCore::PluginDatabase::findPlugin):
+        * plugins/PluginDatabase.h:
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::~PluginPackage):
+        (WebCore::PluginPackage::freeLibrarySoon):
+        (WebCore::PluginPackage::freeLibraryTimerFired):
+        (WebCore::PluginPackage::unloadWithoutShutdown):
+        (WebCore::PluginPackage::initializeBrowserFuncs):
+        * plugins/PluginPackage.h:
+
+2009-07-28  Anantanarayanan Iyengar  <ananta@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27769
+        The V8 bindings function V8Proxy::createNewContext can be 
+        called during frame shutdown where the activeDocumentLoader
+        function in FrameLoader can return NULL. Added a check for the
+        same.
+
+        No new tests added as this is an edge case where the V8 
+        bindings code is reentered via NPAPI during shutdown. It is 
+        difficult to write a consistently reproducible test for this.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+
+2009-07-28  Ivan Posva  <iposva@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Associate the CanvasPixelData backing store with the
+        indexed properties of the wrapper object.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27773
+
+        No new tests: Relying on existing Canvas tests.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+
+2009-07-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Nuke all references to JSWorkerContextBase.lut.h, it was removed
+        back in April.
+
+        * GNUmakefile.am:
+
+2009-07-28  Robert Agoston  <Agoston.Robert@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Fixed references to script generate-webkitversion.pl, and
+        removed duplicated generate-webkitversion.pl
+
+        https://bugs.webkit.org/show_bug.cgi?id=27158
+
+        * WebCore.pro:
+        * platform/generate-webkitversion.pl: Removed.
+
+2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dmitry Glazkov.
+
+        Web Inspector: encapsulate ScriptState into the ScriptObject, get rid of
+        InspectorJSONObject.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27766
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/ScriptArray.cpp:
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::set):
+        (WebCore::ScriptArray::length):
+        (WebCore::ScriptArray::createNew):
+        * bindings/js/ScriptArray.h:
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::ScriptObject):
+        (WebCore::ScriptObject::set):
+        (WebCore::ScriptObject::createNew):
+        (WebCore::ScriptGlobalObject::get):
+        * bindings/js/ScriptObject.h:
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptArray.cpp:
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::set):
+        (WebCore::ScriptArray::length):
+        (WebCore::ScriptArray::createNew):
+        * bindings/v8/ScriptArray.h:
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::ScriptObject):
+        (WebCore::ScriptObject::set):
+        (WebCore::ScriptObject::createNew):
+        (WebCore::ScriptGlobalObject::get):
+        * bindings/v8/ScriptObject.h:
+        (WebCore::ScriptObject::ScriptObject):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::newScriptArray):
+        (WebCore::InspectorFrontend::newScriptObject):
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorJSONObject.cpp: Removed.
+        * inspector/InspectorJSONObject.h: Removed.
+        * inspector/InspectorResource.cpp:
+        (WebCore::populateHeadersObject):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+
+2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Variable substitution recursion seems to have bugs
+        https://bugs.webkit.org/show_bug.cgi?id=27726
+
+        Allow <setvar> elements to depend on the value specified by preceeding <setvar> elements.
+        Required by the specification - assure it only works in linear order. A setvar element may
+        not depend on the variable state of a following setvar element, only the previous ones.
+
+        Extend wml/variable-reference-valid.html layout test to cover these cases.
+
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::storeVariableState):
+
+2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Page title doesn't update after variable substitution, if it contained variables
+        https://bugs.webkit.org/show_bug.cgi?id=27725
+
+        Fix bug in containsVariableReference() function, we we're decreasing the nameEndPosition
+        too much, leading to a bug with 1-char variable names, which were not detected properly.
+
+        Extend wml/variable-reference-valid.html layout test to cover 1-char variable names.
+        Also fixes manual-tests/wml/task-refresh-in-anchor.wml, which happened to use 1-char variable names.
+
+        * wml/WMLVariables.cpp:
+        (WebCore::containsVariableReference):
+
+2009-07-28  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Simon Hausmann.
+
+        Add WebKit version API to Qt.
+
+        Get the current version of WebKit from WebKit/mac/Configurations/Version.xcconfig
+        at compile time and make it available to webkit ports through WebKitVersion.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27158
+
+        * WebCore.pro: Call generate-webkitversion.pl
+
+2009-07-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix.
+
+        * GNUmakefile.am:
+
+2009-07-28  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Replace hardcoded separator text with proper separator.
+        Also adjusts include order as per style guidelines.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27763
+
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::populate):
+
+2009-07-28  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Add output directory for VS pre-build steps to enable out-of-tree builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=27700
+
+        The tmp.obj file is now placed in the intermediate build directory.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add inspected node using public console API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27758
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype.addInspectedNode):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel):
+
+2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] <do> elements with a <noop> task shouldn't be exposed to the user
+        https://bugs.webkit.org/show_bug.cgi?id=27724
+
+        Fix WMLNoopElement to disable it's parent WMLDoElement, as required by the spec.
+        Moved manual-tests/wml/task-noop-in-do.wml to LayoutTests/fast/wml/task-noop-in-do.wml.
+
+        * manual-tests/wml/task-noop-in-do.wml: Removed.
+        * wml/WMLNoopElement.cpp:
+        (WebCore::WMLNoopElement::insertedIntoDocument):
+
+2009-07-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Disable some compiler warnings for the win build
+        https://bugs.webkit.org/show_bug.cgi?id=27709
+
+        * WebCore.pro: Move the msvc options to WebKit.pri
+
+2009-07-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Tor Arne Vestbø
+
+        Make equality checks for logging channel names ignore casing.
+
+        * platform/Logging.cpp:
+        (WebCore::getChannelFromName):
+
+2009-07-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Refactor ResourceHandleSoup - make start* functions static
+        https://bugs.webkit.org/show_bug.cgi?id=27687
+
+        * platform/network/ResourceHandle.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startData):
+        (WebCore::startHttp):
+        (WebCore::):
+
+2009-07-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Do not cache the pango layout in the object, since the layout of
+        the page can change between calls.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-07-23  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Simplify management of Nodes in weak handles callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=27628
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::weakNodeCallback):
+
+2009-07-28  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by David Levin.
+
+        Fix error handling of GetIconInfo (returns a bool).
+
+        * platform/win/DragImageWin.cpp:
+        (WebCore::createDragImageIconForCachedImage):
+
+2009-07-27  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix of <rdar://5015949> Drag Icon is not produced for over sized images.
+        
+        Implemented the createDragImageIconForCachedImage function by using the Windows 
+        SHFILEINFO structure.
+
+        * platform/win/DragImageWin.cpp:
+        (WebCore::createDragImageIconForCachedImage):
+
+2009-07-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Split up V8DOMMap.cpp by class
+        https://bugs.webkit.org/show_bug.cgi?id=27685
+
+        No behavior change.  Just copy-and-paste.
+
+        * WebCore.gypi:
+        * bindings/v8/ChildThreadDOMData.cpp: Added.
+        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
+        (WebCore::ChildThreadDOMData::getStore):
+        * bindings/v8/ChildThreadDOMData.h: Added.
+        * bindings/v8/DOMData.cpp: Added.
+        (WebCore::DOMData::DOMData):
+        (WebCore::DOMData::getCurrent):
+        (WebCore::DOMData::getCurrentMainThread):
+        (WebCore::DOMData::handleWeakObject):
+        (WebCore::DOMData::ensureDeref):
+        (WebCore::DOMData::derefObject):
+        (WebCore::DOMData::derefDelayedObjects):
+        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/DOMData.h: Added.
+        (WebCore::):
+        * bindings/v8/DOMDataStore.cpp: Added.
+        (WebCore::DOMDataStore::DOMDataStore):
+        (WebCore::DOMDataStore::~DOMDataStore):
+        (WebCore::DOMDataStore::allStores):
+        (WebCore::DOMDataStore::allStoresMutex):
+        (WebCore::DOMDataStore::getDOMWrapperMap):
+        (WebCore::forget):
+        (WebCore::DOMDataStore::weakDOMObjectCallback):
+        (WebCore::DOMDataStore::weakActiveDOMObjectCallback):
+        (WebCore::DOMDataStore::weakNodeCallback):
+        (WebCore::DOMDataStore::weakSVGElementInstanceCallback):
+        (WebCore::DOMDataStore::weakSVGObjectWithContextCallback):
+        * bindings/v8/DOMDataStore.h: Added.
+        (WebCore::DOMDataStore::):
+        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
+        (WebCore::DOMDataStore::InternalDOMWrapperMap::forgetOnly):
+        (WebCore::DOMDataStore::domData):
+        (WebCore::DOMDataStore::domNodeMap):
+        (WebCore::DOMDataStore::domObjectMap):
+        (WebCore::DOMDataStore::activeDomObjectMap):
+        (WebCore::DOMDataStore::domSvgElementInstanceMap):
+        (WebCore::DOMDataStore::domSvgObjectWithContextMap):
+        * bindings/v8/MainThreadDOMData.cpp: Added.
+        (WebCore::MainThreadDOMData::MainThreadDOMData):
+        (WebCore::MainThreadDOMData::getStore):
+        * bindings/v8/MainThreadDOMData.h: Added.
+        * bindings/v8/ScopedDOMDataStore.cpp: Added.
+        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
+        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
+        * bindings/v8/ScopedDOMDataStore.h: Added.
+        * bindings/v8/StaticDOMDataStore.cpp: Added.
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        * bindings/v8/StaticDOMDataStore.h: Added.
+        * bindings/v8/V8DOMMap.cpp:
+
+2009-07-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7091036> REGRESSION: Microsoft Messenger crashes during file send/receive due to use of WebKit on non-main thread
+
+        Add a method for detecting if we're being used within Microsoft Messenger.
+
+        * WebCore.base.exp: Export applicationIsMicrosoftMessenger and sort existing entries.
+        * platform/mac/RuntimeApplicationChecks.h:
+        * platform/mac/RuntimeApplicationChecks.mm:
+        (WebCore::applicationIsMicrosoftMessenger):
+
+2009-07-27  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Implement EventListener::reportError for V8 event listeners in worker context. 
+        https://bugs.webkit.org/show_bug.cgi?id=27731
+
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        * bindings/v8/V8WorkerContextEventListener.h:
+
+2009-07-27  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel and David Levin.
+
+        Re-apply chromium/skia border fix (originally landed in r46157,
+        reverted in r46363), since it was not the cause of the reliability
+        failures in Chromium.
+
+        http://bugs.webkit.org/show_bug.cgi?id=27388
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-07-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        createMarkup does not handle CSS properly
+        https://bugs.webkit.org/show_bug.cgi?id=27660
+
+        This patch isolates code that creates markup for styles in addStyleMarkup
+        It also makes all presentational elements (u, s, strike, i, em, b, strong) special ancestor in createMarkup
+        so that we can assume no text decoration style is passed to addStyleMarkup.
+
+        * editing/markup.cpp:
+        (WebCore::propertyMissingOrEqualToNone): Changed the first argument from CSSMutableStyleDecleration to CSSStyleDeclaration
+        (WebCore::isElementPresentational): Used to be elementHasTextDecorationProperty, now supports presentational tags
+        (WebCore::addStyleMarkup): Adds markup for style span and div
+        (WebCore::createMarkup): Uses isElementPresentational and addStyleMarkup
+
+2009-07-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        fix more obvious global object lookups
+        https://bugs.webkit.org/show_bug.cgi?id=27745
+
+        No new tests for these changes.  I believe in many cases
+        testing to be impossible.  Lack of testing justification next to
+        each change below.  The remaining pieces of bug 27634 will all
+        need tests.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::updateDocument): not testable.
+        * bindings/js/JSDataGridColumnListCustom.cpp:
+        (WebCore::JSDataGridColumnList::nameGetter): no testing for this incomplete feature.
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent): would require outer frame to trigger an event in the inner frame
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS): covered by other tests, always correct to pass the globalObject through.
+        * bindings/js/JSHTMLElementCustom.cpp:
+        (WebCore::JSHTMLElement::pushEventHandlerScope): unclear when this could be triggered.
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::remove): toJS seems superfluous here to begin with.
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode): would require outer frame to trigger inner frame event.
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::jsObjectForPluginElement): only used for NPAPI binding, unclear how to test.
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): unclear how to test.
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set): unclear how to test/inspector only.
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject): unclear how to test.
+        * bindings/objc/DOMInternal.mm:
+        (-[WebScriptObject _initializeScriptDOMNodeImp]): unclear how to test.
+
+2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] 'title' attribute handling not correct for <a> / <anchor> elements
+        https://bugs.webkit.org/show_bug.cgi?id=27720
+
+        Unify title() implementation in WMLElement instead of several copies of the same logic.
+        We forgot WMLAnchorElement/WMLAElement, that lead to bugs. Fixes hovering links in the
+        WML manual-test suite.
+
+        * wml/WMLCardElement.cpp:
+        * wml/WMLCardElement.h:
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::title):
+        * wml/WMLElement.h:
+        * wml/WMLOptGroupElement.cpp:
+        * wml/WMLOptGroupElement.h:
+        * wml/WMLSelectElement.cpp:
+        * wml/WMLSelectElement.h:
+
+2009-07-27  Adam Treat  <adam.treat@torchmobile.com>
+
+        Speculative build fix for Windows and WinCE.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load):
+
+2009-07-27  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27474
+        Fixes crashes due to renderer getting destroyed in updateLayout.
+        We need to call updateLayout before we call into the renderer.
+        Removed the updateLayout call from RenderTextControl and moved it
+        into the calling sites.
+        
+        Also changes updateLayout to updateLayoutIgnorePendingStylesheets so
+        this works with pending stylesheets. Unfortunately, this seems to be
+        untestable. Loading an external stylesheet and then having an inline
+        script hit this code did not result in an pending stylesheets.
+        
+        The are other cases of this bug in the rendering code. I'll file a 
+        followup bug to audit the calls to updateLayout.
+
+        Test: fast/dom/text-control-crash-on-select.html
+
+        * dom/Document.h:
+        (WebCore::Document::inStyleRecalc): Added so the ASSERTs in updateFocusAppearance
+            and setSelectionRange could deal with cases of reentrancy into updateLayout
+            calls. This happens in a couple layout tests.
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::updateSelectionRange):
+        * html/HTMLInputElement.cpp:
+        (WebCore::isTextFieldWithRendererAfterUpdateLayout):
+        (WebCore::HTMLInputElement::setSelectionStart):
+        (WebCore::HTMLInputElement::setSelectionEnd):
+        (WebCore::HTMLInputElement::select):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::rendererAfterUpdateLayout):
+        (WebCore::HTMLTextAreaElement::setSelectionStart):
+        (WebCore::HTMLTextAreaElement::setSelectionEnd):
+        (WebCore::HTMLTextAreaElement::select):
+        (WebCore::HTMLTextAreaElement::setSelectionRange):
+        (WebCore::HTMLTextAreaElement::updateFocusAppearance):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setSelectionRange):
+
+2009-07-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        [V8] Remove parameterless frame/window retrieval methods from V8Proxy.
+        https://bugs.webkit.org/show_bug.cgi?id=27737
+
+        Refactoring, no new behavior, covered by existing tests.
+
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/V8NPUtils.cpp:
+        (convertV8ObjectToNPVariant): Ditto.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieve): Ditto.
+        (WebCore::V8Proxy::canAccessPrivate): Ditto.
+        * bindings/v8/V8Proxy.h: Removed parameterless retrieveWindow/retrieveProxy decls.
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Changed to use V8Proxy::retrieveFrameForCurrentContext().
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+
+2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] 'onpick' intrinsic event handling missing
+        https://bugs.webkit.org/show_bug.cgi?id=27723
+
+        Trigger 'onpick' intrinsic events from WMLOptionElement::setSelectedState().
+        All was in place, just forgot to enable the relevant code.
+
+        Fixes manual-tests/wml/select-onpick-event.wml
+        Test: wml/option-element-onpick.html
+
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::setSelectedState):
+
+2009-07-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27735
+        Give a helpful name to JSLock constructor argument
+
+        * bindings/js/GCController.cpp:
+        (WebCore::collect):
+        (WebCore::GCController::gcTimerFired):
+        (WebCore::GCController::garbageCollectNow):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::currentCallFrame):
+        (WebCore::JSInspectorBackend::profiles):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptArray.cpp:
+        (WebCore::ScriptArray::set):
+        (WebCore::ScriptArray::createNew):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        (WebCore::ScriptController::clearScriptObjects):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        (WebCore::ScriptObject::createNew):
+        (WebCore::ScriptGlobalObject::set):
+        (WebCore::ScriptGlobalObject::get):
+        (WebCore::ScriptGlobalObject::remove):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::quarantineValue):
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject removeWebScriptKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_Enumerate):
+        (_NPN_Construct):
+        * bridge/c/c_class.cpp:
+        (JSC::Bindings::CClass::~CClass):
+        (JSC::Bindings::CClass::methodsNamed):
+        (JSC::Bindings::CClass::fieldNamed):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::getPropertyNames):
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance):
+        (JSC::Bindings::CField::setValueToInstance):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        (JSC::Bindings::convertNPVariantToValue):
+        * bridge/jni/jni_class.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::stringValue):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::setMember):
+        (JavaJSObject::removeMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::setSlot):
+        (JavaJSObject::toString):
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaMethod::signature):
+        * bridge/jni/jni_runtime.h:
+        (JSC::Bindings::JavaString::JavaString):
+        (JSC::Bindings::JavaString::_commonInit):
+        (JSC::Bindings::JavaString::~JavaString):
+        (JSC::Bindings::JavaString::UTF8String):
+        * bridge/jni/jni_utility.cpp:
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::moveGlobalExceptionToExecState):
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        (JSC::Bindings::convertNSStringToString):
+        (JSC::Bindings::convertObjcValueToValue):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::removeFromCache):
+        (JSC::Bindings::QtInstance::~QtInstance):
+        (JSC::Bindings::QtInstance::getQtInstance):
+        (JSC::Bindings::QtInstance::createRuntimeObject):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        (JSC::Bindings::QtConnectionObject::execute):
+        * bridge/runtime.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addScriptProfile):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::getTotalTime):
+        (WebCore::getSelfTime):
+        (WebCore::getTotalPercent):
+        (WebCore::getSelfPercent):
+        (WebCore::getNumberOfCalls):
+        (WebCore::getChildren):
+        (WebCore::getParent):
+        (WebCore::getHead):
+        (WebCore::getVisible):
+        (WebCore::getCallUID):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        (WebCore::getString):
+        (WebCore::PluginView::performRequest):
+        (WebCore::PluginView::bindingInstance):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::init):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::dispatchNPEvent):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::init):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::stop):
+
+2009-07-27  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Make plugin work for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27713
+
+        * plugins/win/PluginDatabaseWin.cpp:
+        (SHGetValue):
+        (PathRemoveFileSpec):
+        (WebCore::addWindowsMediaPlayerPluginDirectory):
+        (WebCore::addMacromediaPluginDirectories):
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::registerPluginView):
+        (WebCore::PluginView::wndProc):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::init):
+
+2009-07-27  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Inspector: Tab Through Element Attributes and CSS Properties When Editing
+
+        https://bugs.webkit.org/show_bug.cgi?id=27673
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._startEditing): refactored parameter
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute): refactored to remove excess
+        (WebInspector.ElementsTreeElement.prototype._triggerEditAttribute): provide an attribute name and this will start editing it
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted.moveToNextAttributeIfNeeded): move between attributes
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.onpopulate):
+        (WebInspector.StylePropertiesSection.prototype.findTreeElementWithName): search through treeElements for a style property name
+        (WebInspector.StylePropertiesSection.prototype.addNewBlankProperty): initialize a blank property for adding new properties
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle): add references to the name and value elements
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.editingCommitted): include the move direction as a parameter to the commit callback
+        (WebInspector.startEditing.element.handleKeyEvent): handle the tab key to specify the move direction
+        (WebInspector.startEditing):
+
+2009-07-27  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Add mapping FontWeight to QFont::Weight values as requested via FIXME.
+        https://bugs.webkit.org/show_bug.cgi?id=27663
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        * platform/graphics/qt/FontPlatformData.h:
+        (WebCore::FontPlatformData::toQFontWeight):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-07-27  Jakub Wieczorek  <faw217@gmail.com>
+
+         Reviewed by Adam Treat.
+
+         When clearing the plugin database, clear also the timestamp map.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27651
+
+         Currently, if we clear the database, it will still think that it is up
+         to date with the plugin directories so refreshing the database again
+         after changing the search paths may not work.
+
+         * plugins/PluginDatabase.cpp:
+         (WebCore::PluginDatabase::clear):
+
+2009-07-27  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add in trivial implementation of FontPlatformData::description() for
+        linux to fix build bustage in chromium.
+
+        Fix chromium linux build by adding missing function implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=27732
+
+        Tested with a build of chromium on linux.
+
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::description):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+
+2009-07-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build correct, no review.
+
+        Final correction for WinCairo builds.
+        CoreServices only exists in Apple builds, but
+        some of its internal includes (e.g., <windows.h>) are needed
+        for other Windows targets.
+
+        * WebCorePrefix.h: When building for WinCairo, make sure
+          to include <windows.h>, <stdio.h>, and <ConditionalMacros.h>
+
+2009-07-27  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25552
+        Added new "pattern" attribute to HTMLInputElement and validation code
+        (validity.patternMismatch) as per HTML5 specs.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#attr-input-pattern
+
+        Tests: fast/forms/ValidityState-002.html
+               fast/forms/ValidityState-patternMismatch-001.html
+               fast/forms/ValidityState-patternMismatch-002.html
+               fast/forms/ValidityState-patternMismatch-003.html
+               fast/forms/ValidityState-patternMismatch-004.html
+               fast/forms/ValidityState-patternMismatch-005.html
+               fast/forms/ValidityState-patternMismatch-006.html
+               fast/forms/ValidityState-patternMismatch-007.html
+               fast/forms/pattern-attribute-001.html
+               fast/forms/pattern-attribute-002.html
+               fast/forms/pattern-attribute-003.html
+
+        * html/HTMLAttributeNames.in: pattern attribute
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::patternMismatch): method definition
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::patternMismatch): validation method
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::patternMismatch): validation flag
+
+2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Manual WML tests aren't properly working
+        https://bugs.webkit.org/show_bug.cgi?id=27718
+
+        Fix file paths in the manual WML layout tests, remove unneeded tests (already covered by DRT tests).
+        Add missing resources directory and test image. Reformat all testcases to a common style.
+        Add new StartTests.wml file, which should be used as starting point to crawl through the manual tests.
+
+        Filing bugs soon for all tests exposing bugs (7 in total).
+
+        * manual-tests/wml/StartTests.wml: Added.
+        * manual-tests/wml/a-br-element.wml:
+        * manual-tests/wml/a-element.wml:
+        * manual-tests/wml/a-img-element.wml:
+        * manual-tests/wml/access-target.wml:
+        * manual-tests/wml/anchor-br-element.wml:
+        * manual-tests/wml/anchor-element.wml:
+        * manual-tests/wml/anchor-img-element.wml:
+        * manual-tests/wml/card-newcontext-attr.wml:
+        * manual-tests/wml/card-onenterbackward.wml:
+        * manual-tests/wml/card-onenterforward.wml:
+        * manual-tests/wml/card-ontimer.wml:
+        * manual-tests/wml/card-title-attr.wml: Removed.
+        * manual-tests/wml/deck-access-control.wml:
+        * manual-tests/wml/go-element.wml: Removed.
+        * manual-tests/wml/input-emptyok.wml: Removed.
+        * manual-tests/wml/input-format.wml:
+        * manual-tests/wml/onevent-go.wml:
+        * manual-tests/wml/onevent-noop.wml:
+        * manual-tests/wml/onevent-prev.wml:
+        * manual-tests/wml/onevent-refresh.wml:
+        * manual-tests/wml/onevent-shadow.wml:
+        * manual-tests/wml/postfield-get.wml: Removed.
+        * manual-tests/wml/postfield-post.wml: Removed.
+        * manual-tests/wml/resources: Added.
+        * manual-tests/wml/resources/smiley.png: Added.
+        * manual-tests/wml/select-element.wml:
+        * manual-tests/wml/select-onpick-event.wml:
+        * manual-tests/wml/setvar-element.wml:
+        * manual-tests/wml/targetdeck.wml:
+        * manual-tests/wml/task-go-in-anchor.wml:
+        * manual-tests/wml/task-noop-in-do.wml:
+        * manual-tests/wml/task-noop-in-onevent.wml: Removed.
+        * manual-tests/wml/task-prev-in-anchor.wml:
+        * manual-tests/wml/task-refresh-in-anchor.wml:
+        * manual-tests/wml/template-go.wml:
+        * manual-tests/wml/template-onevent.wml: Removed.
+        * manual-tests/wml/template-ontimer.wml:
+        * manual-tests/wml/timer.wml:
+        * manual-tests/wml/variable-substitution.wml:
+
+2009-07-27  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a regression introduced in r42671, which caused the js event 
+        object to be hidden (some websites depend on being able to access it).
+
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Make the event object visible to javascript, instead of hidden.
+
+2009-07-27  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Removing a no-op block of code in DatabaseTracker.cpp that
+        should've been removed in the patch for bug 26054.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27666
+
+        All tests in WebCore/storage pass.
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::fullPathForDatabase): Removed a no-op
+        block of code that was moved to SQLiteFileSystem.cpp and should
+        have been removed from DatabaseTracker.cpp
+
+2009-07-27  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix error handling in dedicated worker and worker context.
+        https://bugs.webkit.org/show_bug.cgi?id=27525
+
+        The following problems have been fixed:
+        1) The uncaught runtime script error is not reported using the
+        WorkerGlobalScope object's onerror attribute.
+        2) If the error is still not handled afterwards (onerror attribute
+        is not defined as a function or it returns true), the error should
+        be reported back to the associated Worker object by firing an
+        ErrorEvent.
+        3) If the error is still not handled by the associated Worker
+        object, the error should be reported to the user.
+
+        Test: fast/workers/worker-script-error.html
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSEventListener.h:
+        * dom/EventListener.h:
+        (WebCore::EventListener::reportError): adds a function to call
+        EventListener as a function with 3 arguments to report an error.
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
+        * workers/AbstractWorker.h:
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::reportException):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        * workers/WorkerContext.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerExceptionTask::performTask):
+        * workers/WorkerMessagingProxy.h:
+
+2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] History handling / page cache / loading is buggy and depends on several hacks
+        https://bugs.webkit.org/show_bug.cgi?id=27707
+
+        Redesign WML history/loading handling. In detail:
+
+        - Remove FrameLoader::setForceReloadWmlDeck(). WML used to force a special loading behaviour
+          by calling this method from WMLGoElement & friends - instead teach FrameLoader to detect
+          WML content itself.
+
+          WML content is usually a standalone WML document (isWMLDocument()=true) or as special case
+          an XHTML document which embeds a WML document (that's the way the WML layout tests work).
+          Force WML loading behaviour even for XHTML document which embed WML documents. This only
+          applies to our layout tests, not for any real world site. Though it gives us a perfect
+          way to test the WML loading code even when we're not operating on a standalone WML document.
+
+          Whenever a WMLCardElement is inserted into the document it will check wheter it's inserted
+          in a standalone WML document or wheter the main frame document is different. If it differs
+          the main frame documents' "containsWMLContent" property is set to true.
+
+          -> Make FrameLoader::shouldReload() use the new frameContainsWMLContent() method, which
+             checks if the associated frame document is a WML document or wheter it contains WML content.
+
+        - Change FrameLoader::loadItem() to use the new frameContainsWMLContent() method for 'shouldScroll'
+          detection. WML documents (or those containing WML content) always want new loads even for in-page
+          navigation. No "scroll to anchor" mechanism should apply.
+
+        - Modify FrameLoader::canCachePageContainingThisFrame() to check for !frameContainsWMLContent().
+          WML pages should never be cached, potential security problem due the use of variables (per spec).
+
+        Add two new WML tests which were broken before, testing onenterforward/onenterbackward event handling
+        and history navigation (<prev/> task).
+
+        Tests: wml/enter-card-with-events.html
+               wml/enter-first-card-with-events.html
+
+        * dom/Document.cpp: Initialize new 'm_containsWMLContent' property.
+        (WebCore::Document::Document):
+        * dom/Document.h: Add new helper methods and 'm_containsWMLContent" variable (explained above).
+        (WebCore::Document::setContainsWMLContent):
+        (WebCore::Document::containsWMLContent):
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::clearWMLPageHistory): Renamed from clearWmlPageHistory() & slight cleanup.
+        * history/BackForwardList.h:
+        * loader/FrameLoader.cpp: Rework WML loading behaviour (explained above).
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::frameContainsWMLContent):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::shouldReload):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * wml/WMLCardElement.cpp: 
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded): No need anymore to manually track history length.
+        (WebCore::WMLCardElement::insertedIntoDocument): Handle setting containsWMLContent on the main frame document.
+        * wml/WMLGoElement.cpp: 
+        (WebCore::WMLGoElement::executeTask): Remove call to FrameLoader::setForceReloadWmlDeck()
+        * wml/WMLPageState.cpp: Remove 'm_historyLength' - no need anymore to track history length on our own.
+        (WebCore::WMLPageState::WMLPageState):
+        (WebCore::WMLPageState::dump):
+        (WebCore::WMLPageState::reset):
+        * wml/WMLPageState.h:
+
+2009-07-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        Fix Chromium build breakage introduced in 46388.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27705
+
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
+        (WebCore::FontPlatformData::description):
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.h:
+
+2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add some more debug logging to PluginViewMac.
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Jan Michael Alonzo.
+
+        Remove dead code from the GTK NPAPI implementation.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+
+2009-07-27  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Buildfix on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=27702
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedEndPaint):
+            Constraint of (*endPaint) operand modified from "g" to "m" (memory) in inline 
+            assembly, because with "g" constraint, wrong assembly code generated.
+
+2009-07-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebCore bindings: Implement ScriptArray bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27691
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptArray.cpp: Added.
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::handleException):
+        (WebCore::ScriptArray::set):
+        (WebCore::length):
+        (WebCore::ScriptArray::createNew):
+        * bindings/js/ScriptArray.h: Added.
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::jsArray):
+        * bindings/v8/ScriptArray.cpp: Added.
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::set):
+        (WebCore::ScriptArray::length):
+        (WebCore::ScriptArray::createNew):
+        * bindings/v8/ScriptArray.h: Added.
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::~ScriptArray):
+
+2009-07-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build correct, no review.
+
+        Change in r46407 broke Apple Windows build.
+        Switch to WinCairo-only test, to avoid any
+        other platform break.
+
+        * WebCorePrefix.h: 
+
+2009-07-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build correct, no review.
+
+        Change in r46407 broke Apple Windows build.
+
+        * WebCorePrefix.h: Use WTF_PLATFORM_CG to decide if
+          CoreServices.h should be included.
+
+2009-07-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build correction, no review.
+
+        Change in r46195 broke WinCairo build.
+
+        * WebCorePrefix.h: CoreServices should be ignored
+          for non-Apple build.
+
+2009-07-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement the breakpoints sidebar pane.
+        This change adds simple UI support into the existing
+        BreakpointSidebarPane.
+
+        https://bugs.webkit.org/show_bug.cgi?id=11175
+
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set enabled):
+        (WebInspector.Breakpoint.prototype.get label):
+        (WebInspector.Breakpoint.prototype.get id):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane):
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement.labelClicked):
+        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.scriptOrResourceForID):
+        * inspector/front-end/inspector.css:
+
+2009-07-16  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Canvas: rotation of 'no-repeat' pattern still has small error
+        https://bugs.webkit.org/show_bug.cgi?id=26749
+
+        Use 1<<22 as steps of no-repeat pattern to make the error less
+        than 0.5.  The previous value may cause 1 pixel errors.
+
+        Add another test to show this bug clearly.
+        Also add png expected image which was missing in the previous patch.
+
+        Test: fast/canvas/image-pattern-rotate.html
+
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2009-07-25  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Windows build break due to warning C4819
+        https://bugs.webkit.org/show_bug.cgi?id=27416
+
+        Disable C4819 warning to fix build.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-07-25  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Kevin McCullough.
+
+        Inspector: Keyboard Shortcuts to Switch Panels
+        https://bugs.webkit.org/show_bug.cgi?id=27286
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded): save a list of the order of the panels
+        (WebInspector.documentKeyDown): handle the keyboard shortcuts to traverse the panels
+
+2009-07-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        [Qt] Fix build break after r46369
+        https://bugs.webkit.org/show_bug.cgi?id=27680
+
+        * WebCore.pro:
+
+2009-07-25  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Variable substitution is buggy
+        https://bugs.webkit.org/show_bug.cgi?id=27677
+
+        Substitute variables upon attach() time instead of insertedIntoDocument(). Otherwhise variable substitution
+        won't work during inter-deck jumps (same URL, different fragment). Covered by new test fast/wml/newcontext-same-deck.html.
+
+        * dom/Text.cpp:
+        (WebCore::Text::attach):
+        * dom/Text.h:
+
+2009-07-25  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] WMLDoElement doesn't update its RenderButton object upon attach()
+        https://bugs.webkit.org/show_bug.cgi?id=27676
+
+        WMLDoElement needs to implement attach() and call updateFromElement() on its associated RenderButton.
+        Mimics HTMLButtonElement/HTMLFormControlElement behaviour and fixes several painting/styling issues covered by existing tests in fast/wml.
+
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::attach):
+        * wml/WMLDoElement.h:
+
+2009-07-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Fix Windows build breakage introduced in 46390.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Inspector: Properties Should be Sorted more Naturally
+        https://bugs.webkit.org/show_bug.cgi?id=27329
+
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update): use the displaySort when showing properties
+        (WebInspector.ObjectPropertiesSection.prototype._displaySort): alphaNumerical sort
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate): use the displaySort when showing properties
+        * inspector/front-end/utilities.js:
+        (Object.sortedProperties): allow for an optional sorting function in Object.sortedProperties
+
+2009-07-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Split InspectorController into InspectorController
+        and InspectorBackend. Everything frontend needs from InspectorController
+        will slowly migrate into the InspectorBackend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27541
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSInspectorBackendCustom.cpp: Added.
+        (WebCore::JSInspectorBackend::highlightDOMNode):
+        (WebCore::JSInspectorBackend::search):
+        (WebCore::JSInspectorBackend::databaseTableNames):
+        (WebCore::JSInspectorBackend::inspectedWindow):
+        (WebCore::JSInspectorBackend::setting):
+        (WebCore::JSInspectorBackend::setSetting):
+        (WebCore::JSInspectorBackend::wrapCallback):
+        (WebCore::JSInspectorBackend::currentCallFrame):
+        (WebCore::JSInspectorBackend::profiles):
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/js/JSInspectorControllerCustom.cpp: Removed.
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/js/ScriptObject.h:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObject.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp: Removed.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::inspectorBackend):
+        * inspector/InspectorBackend.cpp: Added.
+        * inspector/InspectorBackend.h: Added.
+        (WebCore::InspectorBackend::create):
+        (WebCore::InspectorBackend::inspectorController):
+        * inspector/InspectorBackend.idl: Added.
+        * inspector/InspectorController.idl: Removed.
+        * inspector/front-end/Resource.js:
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        * page/Page.h:
+
+2009-07-25  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Update WebCore/page/Frame.cpp/h to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27654
+
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::~Frame):
+        (WebCore::Frame::setDocument):
+        (WebCore::Frame::firstRectForRange):
+        (WebCore::createRegExpForLabels):
+        (WebCore::Frame::searchForLabelsBeforeElement):
+        (WebCore::Frame::matchLabelsAgainstElement):
+        (WebCore::Frame::selectionLayoutChanged):
+        (WebCore::Frame::setZoomFactor):
+        (WebCore::Frame::reapplyStyles):
+        (WebCore::Frame::isContentEditable):
+        (WebCore::Frame::computeAndSetTypingStyle):
+        (WebCore::Frame::selectionStartStylePropertyValue):
+        (WebCore::Frame::selectionComputedStyle):
+        (WebCore::Frame::applyEditingStyleToBodyElement):
+        (WebCore::Frame::removeEditingStyleFromBodyElement):
+        (WebCore::Frame::applyEditingStyleToElement):
+        (WebCore::Frame::selectionBounds):
+        (WebCore::Frame::currentForm):
+        (WebCore::Frame::revealSelection):
+        (WebCore::Frame::styleForSelectionStart):
+        (WebCore::Frame::setSelectionFromNone):
+        (WebCore::Frame::findString):
+        (WebCore::Frame::markAllMatchesForText):
+        (WebCore::Frame::setMarkedTextMatchesAreHighlighted):
+        (WebCore::Frame::clearFormerDOMWindow):
+        (WebCore::Frame::unfocusWindow):
+        (WebCore::Frame::respondToChangedSelection):
+        (WebCore::Frame::documentAtPoint):
+        * page/Frame.h:
+        (WebCore::Frame::create):
+        (WebCore::Frame::displayStringModifiedByEncoding):
+        (WebCore::Frame::pageZoomFactor):
+        (WebCore::Frame::textZoomFactor):
+
+2009-07-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add functions to print the glyph page trees for debugging
+        https://bugs.webkit.org/show_bug.cgi?id=27671
+
+        * platform/graphics/FontData.h: Defined a description() method.
+
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::showSubtree): Added. Prints the node and
+            its descendants.
+        (showGlyphPageTrees): Added. Prints all glyph page trees.
+        (showGlyphPageTree): Added. Prints the glyph page tree for a given page.
+        * platform/graphics/GlyphPageTreeNode.h:
+
+        * platform/graphics/SegmentedFontData.cpp:
+        (WebCore::SegmentedFontData::description): Added.
+
+        * platform/graphics/SegmentedFontData.h:
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::description): Added. Uses the platform data
+            as the description for non-svg, non-custom fonts.
+        * platform/graphics/SimpleFontData.h:
+
+        * platform/graphics/gtk/FontPlatformData.h:
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+
+        * platform/graphics/mac/FontPlatformData.h:
+        * platform/graphics/mac/FontPlatformDataMac.mm:
+        (WebCore::FontPlatformData::description): Added. Returns the
+            description of the CGFont, the size and the synthetic style flags,
+            if set.
+
+        * platform/graphics/qt/FontPlatformData.h:
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+
+        * platform/graphics/win/FontPlatformData.h:
+        * platform/graphics/win/FontPlatformDataWin.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+
+        * platform/graphics/wince/FontPlatformData.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+        * platform/graphics/wince/FontPlatformData.h:
+
+        * platform/graphics/wx/FontPlatformData.h:
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+
+2009-07-24  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        SVG and XPath memory leaks in V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=27488
+
+        Add proper 'create' methods to SVGPodTypeWrappers and
+        XPathNSResolvers in the V8 bindings to avoid memory leaks.
+
+        Introduce convertToV8Object methods that accept PassRefPtrs and
+        clean up the use of get() and release() on RefPtrs.
+        
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        (WebCore::V8SVGPODTypeWrapperCreatorForList::create):
+        (WebCore::V8SVGPODTypeWrapperCreatorForList::V8SVGPODTypeWrapperCreatorForList):
+        (WebCore::V8SVGStaticPODTypeWrapper::create):
+        (WebCore::V8SVGStaticPODTypeWrapper::V8SVGStaticPODTypeWrapper):
+        (WebCore::V8SVGStaticPODTypeWrapperWithPODTypeParent::create):
+        (WebCore::V8SVGStaticPODTypeWrapperWithPODTypeParent::V8SVGStaticPODTypeWrapperWithPODTypeParent):
+        (WebCore::V8SVGStaticPODTypeWrapperWithParent::create):
+        (WebCore::V8SVGStaticPODTypeWrapperWithParent::V8SVGStaticPODTypeWrapperWithParent):
+        (WebCore::V8SVGDynamicPODTypeWrapper::create):
+        (WebCore::V8SVGDynamicPODTypeWrapper::V8SVGDynamicPODTypeWrapper):
+        (WebCore::V8SVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ClientRectListCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::create):
+        * bindings/v8/custom/V8CustomXPathNSResolver.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-24  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix of <rdar://6310538> Middle-click panning should be springloaded while dragging
+        https://bugs.webkit.org/show_bug.cgi?id=21794
+        
+        Create two new booleans to determine whether we have done a springloaded pan scroll, and update
+        the name of setPanScrollCursor to updatePanScrollState to more accurately describe what the function
+        does. 
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler): Initialized two new booleans.
+        (WebCore::EventHandler::autoscrollTimerFired):
+        (WebCore::EventHandler::updatePanScrollState): Renamed from setPanScrollCursor.
+        (WebCore::EventHandler::stopAutoscrollTimer): Clear the pan scrolling in progress flag.
+        (WebCore::EventHandler::handleMouseReleaseEvent): Clear the pan scrolling button pressed flag.
+        * page/EventHandler.h:
+
+2009-07-24  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27657
+        Add more wince port files to WebCore
+
+        Written by Yong Li  <yong.li@torchmobile.com> and Lyon Chen <lyon.chen@torchmobile.com>
+
+        * loader/icon/wince/IconDatabaseWince.cpp: Added.
+        * rendering/RenderThemeWince.cpp: Added.
+        * rendering/RenderThemeWince.h: Added.
+        * storage/wince/DatabaseThreadWince.cpp: Added.
+        * storage/wince/DatabaseThreadWince.h: Added.
+        * storage/wince/LocalStorageThreadWince.cpp: Added.
+        * storage/wince/LocalStorageThreadWince.h: Added.
+        * svg/graphics/wince/SVGResourceFilterWince.cpp: Added.
+
+2009-07-24  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        execCommand('underline') can modify DOM outside of the contentEditable area
+        https://bugs.webkit.org/show_bug.cgi?id=24333
+
+        highestAncestorWithTextDecoration stops at the closest unsplittable element so that if text-decoration is applied
+        outside of it, we don't accidently modify the style attribute.
+
+        Tests: editing/style/textdecoration-outside-of-rooteditable.html
+               editing/style/textdecoration-outside-of-unsplittable-element.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::init):
+        (WebCore::highestAncestorWithTextDecoration):
+
+2009-07-24  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27639
+
+        Fixes false positives when evaluating certain strings that only contain 
+        non-canonical characters.
+
+        Test: http/tests/security/xssAuditor/script-tag-safe.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isNonCanonicalCharacter):
+        (WebCore::XSSAuditor::findInRequest):
+
+2009-07-24  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Changed WorkerContext destructor to not access possibly-freed WorkerThread.
+
+        Failed assertion in WorkerContext::~WorkerContext().
+        https://bugs.webkit.org/show_bug.cgi?id=27665
+
+       * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::~DedicatedWorkerContext):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        Removed assertion that relies on WorkerThread still being alive (moved to DedicatedWorkerContext destructor).
+
+2009-07-24  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Adam Barth.
+
+        Updated code generator to properly generate bindings for WorkerContext exposed functions.
+
+        Storing a reference to WorkerContext.postMessage() and calling it later yields a TypeError
+        https://bugs.webkit.org/show_bug.cgi?id=27419
+
+        Test: fast/workers/worker-call.html
+
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::toJSDedicatedWorkerContext):
+        (WebCore::toJSWorkerContext):
+        Functions that convert from JSValue to the appropriate WorkerContext/DedicatedWorkerContext object.
+        * bindings/js/JSWorkerContextBase.h:
+        Added toJS*WorkerContext APIs.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        Added code to appropriately check the passed-in this object when invoking functions at global scope.
+
+2009-07-24  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Adam Barth.
+
+        Refactor WorkerContext to move DedicatedWorker-specific APIs into DedicatedWorkerContext
+        https://bugs.webkit.org/show_bug.cgi?id=27420
+
+        No new tests as the existing tests already provide sufficient coverage (this is just a refactoring with no new functionality).
+
+        * DerivedSources.cpp:
+        Added JSDerivedWorkerContext.cpp
+        * DerivedSources.make:
+        Added DerivedWorkerContext files
+        * GNUmakefile.am:
+        Added DerivedWorkerContext files
+        * WebCore.gypi:
+        Added DerivedWorkerContext files
+        * WebCore.pro:
+        Added DerivedWorkerContext files
+        * WebCore.vcproj/WebCore.vcproj:
+        Added DerivedWorkerContext files
+        * WebCore.xcodeproj/project.pbxproj:
+        Added DerivedWorkerContext files
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp: Added.
+        (WebCore::JSDedicatedWorkerContext::mark):
+        Custom mark function for onmessage event handler.
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        Supports conversion to JSDedicatedWorkerContext.
+        (WebCore::toEventTarget):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark):
+        Moved onmessage mark handling into DedicatedWorkerContext.
+        * bindings/js/WorkerScriptController.cpp:
+        Added appropriate casts to DedicatedWorkerContext for postMessage().
+        (WebCore::WorkerScriptController::initScript):
+        Manually sets up the prototype chain for the worker context.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        Changed special case code for WorkerContext to be triggered by new IsWorkerContext attribute.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Changed hard-coded tests for WorkerContext to support DedicatedWorkerContext.
+        * bindings/v8/DOMObjectsInclude.h:
+        Added DedicatedWorkerContext.h
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        Added V8DedicatedWorkerContext.cpp
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        Added code to reserve extra fields for V8DedicatedWorkerContext.
+        * bindings/v8/V8Index.cpp:
+        Now includes V8DedicatedWorkerContext.h in addition to V8WorkerContext.h
+        * bindings/v8/V8Index.h:
+        Added DedicatedWorkerContext as a non-node wrapper type.
+        Removed WORKERCONTEXT as a valid template type.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        Creates DedicatedWorkerContext instead of WorkerContext.
+        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
+        Returns DedicatedWorkerContext instead of WorkerContext.
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        Refactored to deal with DedicatedWorkerContext.
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp: Added.
+        Moved onmessage code from V8WorkerContextCustom.cpp
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        Moved onmessage code to V8DedicatedWorkerContextCustom.cpp
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toDedicatedWorkerContext):
+        * dom/EventTarget.h:
+        * workers/DedicatedWorkerContext.cpp: Added.
+        Moved DedicatedWorker-only APIs from WorkerContext.
+        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
+        (WebCore::DedicatedWorkerContext::~DedicatedWorkerContext):
+        (WebCore::DedicatedWorkerContext::reportException):
+        (WebCore::DedicatedWorkerContext::postMessage):
+        (WebCore::DedicatedWorkerContext::dispatchMessage):
+        * workers/DedicatedWorkerContext.h: Added.
+        Moved DedicatedWorker-only APIs from WorkerContext.
+        (WebCore::DedicatedWorkerContext::create):
+        (WebCore::DedicatedWorkerContext::toDedicatedWorkerContext):
+        (WebCore::DedicatedWorkerContext::setOnmessage):
+        (WebCore::DedicatedWorkerContext::onmessage):
+        * workers/DedicatedWorkerContext.idl: Added.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        Moved code that notifies parent that worker is closing down into DedicatedWorkerContext.
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::isClosing):
+        Exposed closing flag as an API so derived classes can access it.
+        * workers/WorkerContext.idl:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        Calls into DedicatedWorkerContext to handle message.
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::workerThread):
+        Creates a DedicatedWorkerContext when the thread starts up.
+
+2009-07-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Move more callers to using 3 argument toJS
+        https://bugs.webkit.org/show_bug.cgi?id=27661
+
+        No functional changes, thus no tests.
+        These are all the places where we can't yet pass the
+        correct globalObject because we don't have or don't know the right one.
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+
+2009-07-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix the last of the x-frame constructor calls to have the right prototype chains
+        https://bugs.webkit.org/show_bug.cgi?id=27645
+
+        Fix the last few constructors to use their stored globalObject pointer when
+        constructing objects instead of the lexicalGlobalObject().
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::constructAudio):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::constructImage):
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::construct):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::constructHTMLOptionElement):
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::constructWebKitPoint):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::constructWorker):
+
+2009-07-24  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Cleanup exception handling in worker evaluation code.
+        https://bugs.webkit.org/show_bug.cgi?id=27282
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        (WebCore::WorkerContextExecutionState::WorkerContextExecutionState):
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::setException):
+
+2009-07-24  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Reverting r46157, since it may be causing problems with Chromium
+        reliability (see http://crbug.com/17569).
+
+        https://bugs.webkit.org/show_bug.cgi?id=27388
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        REGRESSION: inspector seems broken in ToT WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=27646
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
+
+2009-07-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Add the shadow style member to the ShadowData constructor and ==
+        operator
+
+        * rendering/style/ShadowData.cpp:
+        (WebCore::ShadowData::ShadowData):
+        (WebCore::ShadowData::operator==):
+
+2009-07-24  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] More V8 bindings changes to use ErrorEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=27630
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-07-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Clean up dependencies on Apple support libraries for non-Apple build.
+        http://bugs.webkit.org/show_bug.cgi?id=27532.
+
+        * platform/graphics/win/SimpleFontDataWin.cpp: Conditionalize references
+          to ApplicationServices.h and WebKitSystemInterface.h
+
+2009-07-24  Dan Bernstein  <mitz@apple.com>
+
+        Another attempted build fix 
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+
+2009-07-24  Dan Bernstein  <mitz@apple.com>
+
+        Attempted build fix
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::toJS):
+
+2009-07-24  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Build fix for 64 bit Linux.
+
+        int64_t is long on Linux 64 bit and not long long, thus
+        getFileSize with a int64_t out value fails to build.
+
+        Use a temporary to work around the problem.
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::spaceNeeded):
+
+2009-07-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Update all CREATE_DOM_*_WRAPPER callers to pass globalObject
+        https://bugs.webkit.org/show_bug.cgi?id=27644
+
+        This is another attempt at making the change for bug 27634 smaller.
+        I included the changes to make_names.pl as well as any file which
+        used CREATE_DOM_*_WRAPPER macros.
+
+        The changes to the construct* functions are what fix the cases in
+        fast/dom/constructed-objects-prototypes.html
+
+        The changes to passing globalObject through CREATE_* are what fix
+        fast/dom/prototype-inheritance-2.html
+
+        * bindings/js/JSCDATASectionCustom.cpp:
+        (WebCore::toJSNewlyCreated): pass globalObject.
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSDOMBinding.h: updated macros to pass globalObject.
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::setAttributeNode): use globalObject() for wrapping return value.
+        (WebCore::JSElement::setAttributeNodeNS): use globalObject() for wrapping return value.
+        (WebCore::toJSNewlyCreated): pass globalObject.
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::JSEvent::clipboardData): pass globalObject.
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems): use globalObject() for wrapping returned collection items.
+        (WebCore::callHTMLCollection): use globalObject() for wrapping returned collection items.
+        (WebCore::JSHTMLCollection::item): use globalObject() for wrapping returned collection items.
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapper): pass globalObject.
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSTextCustom.cpp:
+        (WebCore::toJSNewlyCreated): pass globalObject.
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::constructWebKitCSSMatrix): use constructors globalObject when constructing
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::constructXMLHttpRequest): use constructors globalObject when constructing
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::constructXSLTProcessor): use constructors globalObject when constructing
+        * dom/make_names.pl:
+            Pass globalObject through CREATE_* macros and various support functions.
+
+2009-07-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Update CodeGeneratorJS.pm to support passing JSDOMGlobalObject* to toJS calls
+        https://bugs.webkit.org/show_bug.cgi?id=27643
+
+        This is an attempt to make this change as small as possible.
+        I started by including all changes to CodeGeneratorJS.pm from bug 27634,
+        and then made the minimal amount of other changes needed to support that change.
+
+        Most toJS implementations ignore their passed JSDOMGlobalObject.
+        There are stub 2-argument toJS, toJSNewlyCreated implementations to help compiling.
+        All places where it is not clear what we should pass as the global object
+        (or where the global object is simply not available, like for some SVG bindings)
+        we pass deprecatedGlobalObjectForPrototype instead.
+
+        * bindings/js/JSCDATASectionCustom.cpp:
+        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::setDOMException): pass the wrong globalObject for now
+        * bindings/js/JSDOMBinding.h:
+            Pass the wrong global object to the CREATE_ macros for now.
+            In the next change we'll come back and pass the correct one.
+            That will require changes to make_names.pl.
+        (WebCore::DOMObjectWithGlobalPointer::scriptExecutionContext):
+        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
+        (WebCore::DOMObjectWithGlobalPointer::~DOMObjectWithGlobalPointer):
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::getDOMObjectWrapper):
+        (WebCore::createDOMNodeWrapper):
+        (WebCore::getDOMNodeWrapper):
+        (WebCore::toJS): added to convert 2 arg calls to 3 arg calls to limit the scope of this change.
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::toJS): DOMWindow always uses its own prototype chain.
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSEventTarget.h:
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapper): pass globalObject to toJS(Document*) to avoid recursion
+        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::toJS): pass globalObject along
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::inverse): pass wrong globalObject for now.
+        (WebCore::JSSVGMatrix::rotateFromVector): pass wrong globalObject for now.
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegListCustom.cpp:
+            All of these methods need a globalObject, but most SVG binding don't have
+            space for one, so we just pass the lexicalGlobalObject for now.
+        (WebCore::JSSVGPathSegList::initialize):
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        (WebCore::JSSVGPathSegList::appendItem):
+        * bindings/js/JSSVGPointListCustom.cpp:
+        (WebCore::finishGetter): pass wrong globalObject for now.
+        (WebCore::finishSetter):
+        (WebCore::finishSetterReadOnlyResult):
+        * bindings/js/JSSVGTransformListCustom.cpp:
+        (WebCore::finishGetter): pass wrong globalObject for now.
+        (WebCore::finishSetter):
+        (WebCore::finishSetterReadOnlyResult):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSTextCustom.cpp:
+        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::toJS): WorkerContext always uses its own prototype chain since it's a GlobalObject subclass.
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+            All generated toJS calls now pass a globalObject.
+            All generated toJS implementations now expect a globalObject.
+            Simplified all the slot casts by using a "castedThis" local.
+            SVG bindings which don't have a globalObject() accessor pass the deprecated lexicalGlobalObject instead.
+            Simplified printing of constructor objects using a $constructorClassName variable.
+            All generated constructor functions follow the construct$className form to match the custom constructors.
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        typing "document.__proto__" in inspector throws exception
+        https://bugs.webkit.org/show_bug.cgi?id=27169
+
+        * inspector/front-end/utilities.js:
+        (Object.type):
+
+2009-07-24  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Anders Carlsson.
+
+        ApplicationCache should have size limit
+        https://bugs.webkit.org/show_bug.cgi?id=22700
+
+        https://lists.webkit.org/pipermail/webkit-dev/2009-May/007560.html
+
+        This change implements a mechanism for limiting the maximum size of
+        the application cache file. When this size is reached, a ChromeClient
+        callback is invoked asynchronously and the saving of the last (failed)
+        cache is retried automatically.
+        
+        This change also extends the ApplicationCacheStorage API by allowing
+        a client to query or modify the application cache without having to
+        load any resources into memory.
+
+        Test: http/tests/appcache/max-size.html
+
+        * WebCore.base.exp:
+        Exports the symbols required by the DumpRenderTree test application.
+        * loader/EmptyClients.h:
+        Adds empty implementation of the new ChromeClient methods.
+        * loader/appcache/ApplicationCache.cpp:
+        * loader/appcache/ApplicationCache.h:
+        Adds the ability to calculate the approximate size of an ApplicationCache object.
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        * loader/appcache/ApplicationCacheGroup.h:
+        Invokes the ChromeClient callback when the storage layer runs out of space.
+        After the callback is invoked, we re-attempt to store the newest cache,
+        in case the ChromeClient has freed some space.
+        * loader/appcache/ApplicationCacheResource.cpp:
+        * loader/appcache/ApplicationCacheResource.h:
+        Adds the ability to calculate the approximate size of an ApplicationCacheResource object.
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        * loader/appcache/ApplicationCacheStorage.h:
+        Enforces a maximum size for the application cache file.
+        * page/ChromeClient.h:
+        Adds a new callback, invoked when the ApplicationCacheStorage reports that it has
+        reached the maximum size for its database file.
+        * platform/sql/SQLiteDatabase.cpp:
+        * platform/sql/SQLiteDatabase.h:
+        Adds a new method that allows querying for the amount of unused space inside the
+        application cache database file.
+
+2009-07-24  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Use TextEncoding facilities to convert between UTF16 and UTF8
+        instead of rolling our own solution.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (convertUniCharToUTF8):
+
+2009-07-24  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Fix confusion in g_substr between length in bytes and length in
+        characters. Was causing crashes in some situations when dealing
+        with non-ASCII text encoded as UTF8.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (g_substr):
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Impossible to add an attribute to a node without attributes
+        https://bugs.webkit.org/show_bug.cgi?id=21108
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.set hovered):
+        (WebInspector.ElementsTreeElement.prototype.toggleNewButton):
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+        (WebInspector.ElementsTreeElement.prototype._startEditing):
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute):
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        * inspector/front-end/inspector.css:
+
+2009-07-24  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Adds support for Firebug's magic $0 variable to access inspected node
+        https://bugs.webkit.org/show_bug.cgi?id=17907
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled): Added _inspectorCommandLineAPI.{
+            _inspectedNodes, _addInspectedNode, $0, $1, $n}
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged): Stores the inspected node history
+            in _inspectorCommandLineAPI._inspectedNodes
+        (WebInspector.ElementsPanel):
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Dragging a resource in the sidebar should drag it's URL
+        https://bugs.webkit.org/show_bug.cgi?id=14410
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Double click on a resource in the sidebar should open that resource in Safari
+        https://bugs.webkit.org/show_bug.cgi?id=14409
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick): open a resource url
+
+2009-07-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        Bump pango version requirement to 1.12 and remove unnecessary #ifdefs.
+
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::getDefaultPangoLayout):
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/gtk/Language.cpp:
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Missing UIString and other localizedString.js fixes
+        https://bugs.webkit.org/show_bug.cgi?id=27288
+
+        * English.lproj/localizedStrings.js:
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Should Syntax Highlight JSON
+        https://bugs.webkit.org/show_bug.cgi?id=27503
+
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._contentLoaded):
+
+2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update WebCore/page/DOMTimer.cpp/h to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27624
+
+        * page/DragController.cpp:
+        (WebCore::DragController::~DragController):
+        (WebCore::documentFragmentFromDragData):
+        (WebCore::DragController::dragEnded):
+        (WebCore::DragController::dragEntered):
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::dragUpdated):
+        (WebCore::DragController::performDrag):
+        (WebCore::asFileInput):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::delegateDragSourceAction):
+        (WebCore::DragController::concludeEditDrag):
+        (WebCore::DragController::canProcessDrag):
+        (WebCore::DragController::tryDHTMLDrag):
+        (WebCore::DragController::mayStartDragAtEventLocation):
+        (WebCore::getCachedImage):
+        (WebCore::getImage):
+        (WebCore::prepareClipboardForImageDrag):
+        (WebCore::dragLocForDHTMLDrag):
+        (WebCore::DragController::startDrag):
+        (WebCore::DragController::doImageDrag):
+        (WebCore::DragController::doSystemDrag):
+        (WebCore::DragController::placeDragCaret):
+
+2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update WebCore/page/Chrome.cpp to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27608
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::runBeforeUnloadConfirmPanel):
+        (WebCore::Chrome::runJavaScriptAlert):
+        (WebCore::Chrome::runJavaScriptConfirm):
+        (WebCore::Chrome::runJavaScriptPrompt):
+        (WebCore::Chrome::shouldInterruptJavaScript):
+        (WebCore::Chrome::setToolTip):
+        (WebCore::Chrome::requestGeolocationPermissionForFrame):
+        (WebCore::ChromeClient::generateReplacementFile):
+        (WebCore::ChromeClient::paintCustomScrollbar):
+
+2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update WebCore/page/Coordinates.cpp to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27614
+
+        * page/Coordinates.cpp:
+        (WebCore::Coordinates::toString):
+
+2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update WebCore/page/DOMSelection.cpp/h to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27614
+
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::setBaseAndExtent):
+        (WebCore::DOMSelection::modify):
+        (WebCore::DOMSelection::addRange):
+        (WebCore::DOMSelection::deleteFromDocument):
+        * page/DOMSelection.h:
+
+2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update WebCore/page/DOMTimer.cpp/h to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27618
+
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::DOMTimer):
+        (WebCore::DOMTimer::~DOMTimer):
+        (WebCore::DOMTimer::fired):
+        (WebCore::DOMTimer::suspend):
+        (WebCore::DOMTimer::resume):
+        (WebCore::DOMTimer::canSuspend):
+        * page/DOMTimer.h:
+        (WebCore::DOMTimer::minTimerInterval):
+        (WebCore::DOMTimer::setMinTimerInterval):
+
+2009-07-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Classes call DOMObject::mark() explicitly, should call DOMObjectWithGlobal::mark() instead
+        https://bugs.webkit.org/show_bug.cgi?id=27641
+
+        Nothing uses globalObject() yet, but this was causing crashes
+        in the patch for bug 27634.  This is covered by fast/dom/gc-6.html.
+
+        I decided to change these to Base:: instead of DOMObjectWithGlobal::
+        for future-proofing.  All autogenerated classes use a typedef Base
+        to avoid bugs like these.  Sadly C+does not have a built-in super:: we could use.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::mark):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::mark):
+        * bindings/js/JSMessageChannelCustom.cpp:
+        (WebCore::JSMessageChannel::mark):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::getOwnPropertySlot):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::mark):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::mark):
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        (WebCore::JSNodeIterator::mark):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::mark):
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        (WebCore::JSTreeWalker::mark):
+
+2009-07-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Make most DOMObjects hold onto a JSDOMGlobalObject*
+        https://bugs.webkit.org/show_bug.cgi?id=27588
+
+        This change is almost entirely plumbing.  Only one functional
+        change as part of this all (window.document.constructor has the correct prototype)
+        Changes are detailed below.
+
+        inner.document.constructor is fixed because all properties on the window
+        object are created with the correct globalObject (instead of the lexical one).
+        Since all objects now carry a globalObject pointer, when document creates
+        HTMLDocumentConstructor it now has the right globalObject to use.
+
+        Tests:
+          fast/dom/prototype-inheritance.html
+          fast/dom/prototype-inheritance-2.html
+
+        * bindings/js/DOMObjectWithSVGContext.h:
+        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
+            Update the comment and add an ignored globalObject argument.
+        * bindings/js/JSDOMBinding.h:
+            Pass a globalObject to all DOMObjects during creation.  Currently it's the wrong global object.
+            Once toJS is passed a globalObject it will be the right one.
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::createDOMNodeWrapper):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::globalObject): Makes binding generation easier.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::history): JSHistory is now passed a globalObject, but since it has no custom constructor it doesn't use it.
+        (WebCore::JSDOMWindow::location): JSLocation is now passed a globalObject, but since it has no custom constructor it doesn't use it.
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location): JSLocation is now passed a globalObject, but since it has no custom constructor it doesn't use it.
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
+        * bindings/js/JSHTMLCollectionCustom.cpp: Re-factoring needed to pass globalObject to JSNamedNodesCollection constructor.
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::canGetItemsForName):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        * bindings/js/JSNamedNodesCollection.cpp:
+             Now passed globalObject.  This is tested by inner.document.forms.testForm.
+             The passed globalObject is still wrong until toJS is fixed.
+        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection):
+        * bindings/js/JSNamedNodesCollection.h:
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+             Add DOMConstructorObject missed by http://trac.webkit.org/changeset/45938
+             This class is not compiled by default, so not testable.
+        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
+        * bindings/js/JSSharedWorkerConstructor.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+             Make all bindings objects carry a globalObject pointer using DOMObjectWithGlobalPointer.
+             SVG bindings which need a context() pointer do not have enough space for globalObject() too.
+             WorkerContext does not need a globalObject (it is one), so special case it.
+             Make all .constructor calls use the stored globalObject().  This is what fixes window.document.constructor.
+             Make all constructors inherit from DOMConstructorObject for consistency.  Since the auto-bound constructors
+             override createStructure anyway, there is no functional change here.  Just completing work started in r45938.
+
+2009-07-23  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        WebCore has a few places that don't gracefully handle a null request returned from willSendRequest.
+        https://bugs.webkit.org/show_bug.cgi?id=27595
+
+        Test: http/tests/misc/will-send-request-returns-null-on-redirect.html
+        
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::removeResource): Null-check the request URL.
+        
+        * platform/network/cf/ResourceHandleCFNet.cpp: Ditto, and return null instead of creating an empty one.
+        (WebCore::willSendRequest):
+
+2009-07-23  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27633 - AXLoadComplete can be fired off to frequently
+        https://bugs.webkit.org/show_bug.cgi?id=27633
+
+        An integration issue left out some curly braces.
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+
+2009-07-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        URL appears in back/forward button menu instead of title for items with custom representation
+        https://bugs.webkit.org/show_bug.cgi?id=27586
+        rdar://problem/5060337
+
+        * WebCore.base.exp: Exported DocumentLoader::setTitle for use by Mac WebKit.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::didChangeTitle): Tightened code to check if the document
+        loader is the correct one; previously this would never happen because we'd
+        commit the load before any title changes could be registered, but now we can
+        encounter a case where we get a title during a provisional load.
+
+2009-07-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        [CSS3 Backgrounds and Borders] Add support for inset box shadows
+        https://bugs.webkit.org/show_bug.cgi?id=27582
+
+        Test: fast/box-shadow/inset.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForShadow): Set the ShadowValue’s shadow style to 'inset'
+            as needed.
+
+        * css/CSSParser.cpp:
+        (WebCore::ShadowParseContext::ShadowParseContext): Added style and allowStyle
+            members. Initialize the allowStyle member.
+        (WebCore::ShadowParseContext::commitValue): Pass the style value to the
+            ShadowValue constructor. Reset allowStyle.
+        (WebCore::ShadowParseContext::commitLength): Update allowStyle.
+        (WebCore::ShadowParseContext::commitColor): Ditto.
+        (WebCore::ShadowParseContext::commitStyle): Added. Sets the style member and
+            updates the state.
+        (WebCore::CSSParser::parseShadow): Parse the 'inset' keyword.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Get the style value from the
+            shadow value and pass it to the ShadowData constructor.
+
+        * css/ShadowValue.cpp:
+        (WebCore::ShadowValue::ShadowValue): Added style.
+        (WebCore::ShadowValue::cssText): Added style.
+
+        * css/ShadowValue.h:
+        (WebCore::ShadowValue::create): Added style.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc): Added a blend function for shadow styles. When blending
+            between normal and inset shadows, all intermediate values map to normal.
+        (WebCore::PropertyWrapperShadow::blend): Added normal style to the default
+            shadow.
+            
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintBoxShadow): Added a shadow style parameter,
+            which is passed through to RenderBoxModelObject::paintBoxShadow().
+
+        (WebCore::InlineFlowBox::paintBoxDecorations): Paint inset shadows on top of
+            the background.
+
+        * rendering/InlineFlowBox.h:
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintBoxDecorations): Paint inset shadows on top of the
+            background.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow): Added a shadow style
+            parameter, and code to paint inset shadows.
+
+        * rendering/RenderBoxModelObject.h:
+
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations): Paint inset shadows on top of
+            the background.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintBoxDecorations): Ditto.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paintBoxDecorations): Ditto.
+
+        * rendering/style/ShadowData.h:
+        Added a ShadowStyle enum.
+        (WebCore::ShadowData::ShadowData): Add and initialize a style member.
+
+2009-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the build with UNUSED_PARAM(frame) for when ENABLE(3D_RENDERING) is not defined.
+
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::transform_3dMediaFeatureEval):
+
+2009-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        3d-transforms media query needs to look check that accelerated compositing is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=27621
+        
+        When evaluating a media query with '-webkit-transform-3d', we need to check the
+        runtime switch that toggles accererated compositing, and therefore 3D.
+        
+        No test because we can't disable the pref dynamically in DRT.
+
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::transform_3dMediaFeatureEval):
+
+2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        execCommand('underline') can't remove <U> underlines
+        https://bugs.webkit.org/show_bug.cgi?id=20215
+
+        This patch adds support for u, s, and strike to implicitlyStyledElementShouldBeRemovedWhenApplyingStyle so that
+        WebKit can remove those presentational tags when necessary.
+        It also modifies StyleChange::init not to add "text-decoration: none".  Not only is this style meaningless
+        (does not override inherited styles) but it was also causing WebKit to generate extra spans with this style.
+
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::hasValue): True if the property contains the specified value
+        * css/CSSValueList.h: Updated prototype
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::init): No longer adds "text-decoration: none"
+        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle): Supports text-decoration-related elements
+
+2009-07-23  Jessie Berlin  <jberlin@apple.com>
+        
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27554
+        Expose the value of text-overflow in getComputedStyle.
+
+        Test: fast/css/getComputedStyle/getComputedStyle-text-overflow.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        Add text-overflow to the list of computedProperties.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        Return the value of the text-overflow property.
+
+2009-07-23  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27510
+
+        [S60 QtWebKit] Don't put some intermediate generated files into the final mmp project
+        file for linking. This is a temporary workaround for qmake bug in Symbian port, should 
+        be reverted after qmake is fixed.
+
+        * WebCore.pro:
+
+2009-07-23  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix an assert in running workers in Chrome.
+        https://bugs.webkit.org/show_bug.cgi?id=27620
+
+        The fix is to change V8DOMMap::removeAllDOMObjectsInCurrentThreadHelper
+        to do not call removeObjectsFromWrapperMap for certain types of DOM
+        objects that exist only in main thread.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
+
+2009-07-23  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27572
+        Implement support for background-attachment:local.
+
+        Added new test fast/overflow/overflow-with-local-attachment.html.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillAttachment):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapFillAttachment):
+        * css/CSSValueKeywords.in:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillLayer::attachment):
+        (WebCore::FillLayer::setAttachment):
+        (WebCore::FillLayer::hasFixedImage):
+        (WebCore::FillLayer::initialFillAttachment):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::backgroundAttachment):
+        (WebCore::InheritedFlags::maskAttachment):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-07-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        copyInheritableProperties and removeComputedInheritablePropertiesFrom should be deprecated
+        https://bugs.webkit.org/show_bug.cgi?id=27325
+
+        This patch deprecates copyInheritableProperties because it has been used for two different purposes:
+        1.  Calculating the typing style.
+        2.  Moving HTML subtrees and seeking to remove redundant styles.
+        These tasks should be broken out into two separate functions.  New code should not use this function.
+
+        It deletes removeComputedInheritablePropertiesFrom because it hasn't been used anywhere.
+
+        There is no test since the patch does not change any behavior.
+
+        * css/CSSComputedStyleDeclaration.cpp: removeComputedInheritablePropertiesFrom has been removed
+        (WebCore::CSSComputedStyleDeclaration::deprecatedCopyInheritableProperties): has been renamed from copyInheritableProperties
+        * css/CSSComputedStyleDeclaration.h: ditto
+        * editing/DeleteSelectionCommand.cpp: ditto
+        (WebCore::removeEnclosingAnchorStyle): ditto
+        (WebCore::DeleteSelectionCommand::saveTypingStyleState): ditto
+        * editing/EditCommand.cpp: ditto
+        (WebCore::EditCommand::styleAtPosition): ditto
+        * editing/RemoveFormatCommand.cpp: ditto
+        (WebCore::RemoveFormatCommand::doApply): ditto
+        * editing/ReplaceSelectionCommand.cpp: ditto
+        (WebCore::handleStyleSpansBeforeInsertion): ditto
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans): ditto
+        * editing/markup.cpp: ditto
+        (WebCore::removeEnclosingMailBlockquoteStyle): ditto
+        (WebCore::removeDefaultStyles): ditto
+        (WebCore::createMarkup): ditto
+
+2009-07-22  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Audio element at default width shouldn't have time field.
+        https://bugs.webkit.org/show_bug.cgi?id=27589
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimeDisplayElement::setVisible): Make sure we don't
+        forget to remember the visibility if there is no renderer.
+
+2009-07-23  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27598 Clean up the 
+        AccessibilityObject class
+
+        Mostly this is just moving empty stubs into the header rather than 
+        muddying the cpp file with them. A few functions were made pure 
+        virtual.
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::isARIAControl):
+        (WebCore::AccessibilityObject::clickPoint):
+        (WebCore::AccessibilityObject::documentFrameView):
+        (WebCore::AccessibilityObject::actionVerb):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::intValue):
+        (WebCore::AccessibilityObject::layoutCount):
+        (WebCore::AccessibilityObject::doAccessibilityHitTest):
+        (WebCore::AccessibilityObject::focusedUIElement):
+        (WebCore::AccessibilityObject::firstChild):
+        (WebCore::AccessibilityObject::lastChild):
+        (WebCore::AccessibilityObject::previousSibling):
+        (WebCore::AccessibilityObject::nextSibling):
+        (WebCore::AccessibilityObject::parentObjectIfExists):
+        (WebCore::AccessibilityObject::observableObject):
+        (WebCore::AccessibilityObject::linkedUIElements):
+        (WebCore::AccessibilityObject::titleUIElement):
+        (WebCore::AccessibilityObject::ariaRoleAttribute):
+        (WebCore::AccessibilityObject::isPresentationalChildOfAriaRole):
+        (WebCore::AccessibilityObject::ariaRoleHasPresentationalChildren):
+        (WebCore::AccessibilityObject::roleValue):
+        (WebCore::AccessibilityObject::ariaAccessiblityName):
+        (WebCore::AccessibilityObject::ariaLabeledByAttribute):
+        (WebCore::AccessibilityObject::ariaDescribedByAttribute):
+        (WebCore::AccessibilityObject::accessibilityDescription):
+        (WebCore::AccessibilityObject::ariaSelectedTextDOMRange):
+        (WebCore::AccessibilityObject::axObjectCache):
+        (WebCore::AccessibilityObject::axObjectID):
+        (WebCore::AccessibilityObject::setAXObjectID):
+        (WebCore::AccessibilityObject::anchorElement):
+        (WebCore::AccessibilityObject::actionElement):
+        (WebCore::AccessibilityObject::boundingBoxRect):
+        (WebCore::AccessibilityObject::selectedTextRange):
+        (WebCore::AccessibilityObject::selectionStart):
+        (WebCore::AccessibilityObject::selectionEnd):
+        (WebCore::AccessibilityObject::url):
+        (WebCore::AccessibilityObject::selection):
+        (WebCore::AccessibilityObject::stringValue):
+        (WebCore::AccessibilityObject::title):
+        (WebCore::AccessibilityObject::helpText):
+        (WebCore::AccessibilityObject::textUnderElement):
+        (WebCore::AccessibilityObject::text):
+        (WebCore::AccessibilityObject::textLength):
+        (WebCore::AccessibilityObject::selectedText):
+        (WebCore::AccessibilityObject::accessKey):
+        (WebCore::AccessibilityObject::widget):
+        (WebCore::AccessibilityObject::widgetForAttachmentView):
+        (WebCore::AccessibilityObject::setFocused):
+        (WebCore::AccessibilityObject::setSelectedText):
+        (WebCore::AccessibilityObject::setSelectedTextRange):
+        (WebCore::AccessibilityObject::setValue):
+        (WebCore::AccessibilityObject::setSelected):
+        (WebCore::AccessibilityObject::makeRangeVisible):
+        (WebCore::AccessibilityObject::childrenChanged):
+        (WebCore::AccessibilityObject::addChildren):
+        (WebCore::AccessibilityObject::hasChildren):
+        (WebCore::AccessibilityObject::selectedChildren):
+        (WebCore::AccessibilityObject::visibleChildren):
+        (WebCore::AccessibilityObject::visiblePositionRange):
+        (WebCore::AccessibilityObject::visiblePositionRangeForLine):
+        (WebCore::AccessibilityObject::boundsForVisiblePositionRange):
+        (WebCore::AccessibilityObject::setSelectedVisiblePositionRange):
+        (WebCore::AccessibilityObject::visiblePositionForPoint):
+        (WebCore::AccessibilityObject::nextVisiblePosition):
+        (WebCore::AccessibilityObject::previousVisiblePosition):
+        (WebCore::AccessibilityObject::visiblePositionForIndex):
+        (WebCore::AccessibilityObject::indexForVisiblePosition):
+        (WebCore::AccessibilityObject::index):
+        (WebCore::AccessibilityObject::doAXRangeForLine):
+        (WebCore::AccessibilityObject::doAXRangeForIndex):
+        (WebCore::AccessibilityObject::doAXStringForRange):
+        (WebCore::AccessibilityObject::doAXBoundsForRange):
+        (WebCore::AccessibilityObject::updateBackingStore):
+
+2009-07-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Fix of <rdar://4877658> Dragging from the area between the horizontal/vertical scrollbars when status bar is showing starts a selection and autoscroll.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+
+2009-07-23  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27581
+        Drop the prefix from the box-shadow property.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::ShadowParseContext::commitLength):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-07-22  Viet-Trung Luu  <viettrungluu@gmail.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27289
+        When a mouse click occurs on a scrollbar without a preceding mouse move
+        onto it, the release isn't handled correctly (since
+        EventHandler::m_lastScrollbarUnderMouse isn't set on mouse down, but
+        only on mouse move). (Side comment: That scrollbar-handling code
+        in EventHandler is ugly. It should be fixed properly.)
+
+        Tests: scrollbars/scrollbar-miss-mousemove.html
+               scrollbars/scrollbar-miss-mousemove-disabled.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        (WebCore::EventHandler::updateLastScrollbarUnderMouse):
+        * page/EventHandler.h:
+
+2009-07-23  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Update WebCore/page/BarInfo.cpp to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27606
+
+        * page/BarInfo.cpp:
+        (WebCore::BarInfo::visible):
+
+2009-07-23  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Update WebCore/page/Console.cpp to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27606
+
+        * page/Console.cpp:
+        (WebCore::printMessageSourceAndLevelPrefix):
+        (WebCore::Console::profile):
+        (WebCore::Console::time):
+
+2009-07-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix crashes with the QObject bindings after garbage collection.
+
+        There is one QtInstance per wrapped QObject, and that QtInstance keeps
+        references to cached JSObjects for slots. When those objects get
+        deleted due to GC, then they becoming dangling pointers.
+
+        When a cached member dies, it is now removed from the QtInstance's
+        cache.
+
+        As we cannot track the lifetime of the children, we have to remove
+        them from QtInstance alltogether. They are not cached and were
+        only used for mark(), but we _want_ them to be subject to gc.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance): Minor coding style cleanup,
+        use qDeleteAll().
+        (JSC::Bindings::QtInstance::removeCachedMethod): New function, to
+        clean m_methods and m_defaultMethod.
+        (JSC::Bindings::QtInstance::mark): Avoid marking already marked objects.
+        (JSC::Bindings::QtField::valueFromInstance): Don't save children for
+        marking.
+        * bridge/qt/qt_instance.h: Declare removeCachedMethod.
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMethod::~QtRuntimeMethod): Call removeCachedMethod
+        with this on the instance.
+
+2009-07-23  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27599
+        'const unsigned' in return value
+
+        Remove const modifier from unsigned return value, as it does not
+        make sense.
+
+        * dom/ErrorEvent.h:
+
+2009-07-22  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by David Levin.
+
+        Bug 22784: Improve keyboard navigation of Select elements.
+        Home/End and PageUp/PageDn buttons do not do anything in drop down lists,
+        on non-Mac platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=22784
+        http://code.google.com/p/chromium/issues/detail?id=4576
+
+        New test: LayoutTests/fast/forms/select-popup-pagekeys.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::nextValidIndex): 
+        New utility fn for traversing items of a select's list.
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+        Added code to handle Home/End and PageUp/PageDn when ARROW_KEYS_POP_MENU is false.
+
+2009-07-23  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix a couple of compiler warnings.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (copySurface):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
+
+2009-07-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by David Levin.
+
+        Enable HTML5 Datagrid defines for the Qt build.
+
+        * WebCore.pro:
+
+2009-07-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Make Node wrappers go fast
+        https://bugs.webkit.org/show_bug.cgi?id=27597
+
+        Profiles indicate we're spending a lot of time asking whether we're on
+        the main thread when looking up DOM wrappers for Nodes, but there isn't
+        much point in doing that work because Nodes only exist on the main
+        thread.  I've also added an assert to keep us honest in this regard.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::):
+        (WebCore::getDOMNodeMap):
+        (WebCore::DOMData::getCurrent):
+        (WebCore::DOMData::getCurrentMainThread):
+
+2009-07-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove unneeded virtual destructor from ScriptSourceProvider
+        https://bugs.webkit.org/show_bug.cgi?id=27563
+
+        * bindings/js/ScriptSourceProvider.h:
+
+2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        execCommand('underline' / 'strikeThrough') doesn't work properly with multiple styles in text-decoration
+        https://bugs.webkit.org/show_bug.cgi?id=27476
+
+        executeStrikethrough and executeUnderline were toggling between "line-through" / "underline" and "none".
+        This patch adds executeToggleStyleInList that toggles a style in CSSValueList instead of toggling the entire value.
+        It modifies CSSComputedStyleDeclaration to return CSSValueList instead of CSSPrimitiveValue for text decorations,
+        and adds removeAll member function to CSSValueList.
+
+        Tests: editing/execCommand/toggle-text-decorations.html
+               fast/css/getComputedStyle/getComputedStyle-text-decoration.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::renderTextDecorationFlagsToCSSValue): Creates a CSSValueList
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Returns a CSSValueList instead of CSSValue
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Text decorations are space separated instead of comma separated
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::removeAll): Removes all values that match the specified value
+        * css/CSSValueList.h:
+        * editing/EditorCommand.cpp:
+        (WebCore::applyCommandToFrame): Apply style to a frame using specified command
+        (WebCore::executeApplyStyle): Uses applyCommandToFrame
+        (WebCore::executeToggleStyleInList): Uses applyCommandToFrame
+        (WebCore::executeToggleStyle): Toggles a style in CSSValueList
+        (WebCore::executeStrikethrough): Uses executeToggleStyleInList
+        (WebCore::executeUnderline): Uses executeToggleStyleInList
+
+2009-07-22  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27174
+        And
+        https://bugs.webkit.org/show_bug.cgi?id=26938
+        
+        Code cleanup. Implements support for detecting attacks transformed by 
+        PHP Magic Quotes/PHP addslashes().
+
+        Tests: http/tests/security/xssAuditor/script-tag-addslashes-backslash.html
+               http/tests/security/xssAuditor/script-tag-addslashes-double-quote.html
+               http/tests/security/xssAuditor/script-tag-addslashes-null-char.html
+               http/tests/security/xssAuditor/script-tag-addslashes-single-quote.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isInvalidCharacter):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::normalize): Decodes HTML entities, removes backslashes,
+        and removes control characters that could otherwise cause a discrepancy between
+        the source code of a script and the outgoing HTTP parameters.
+        (WebCore::XSSAuditor::decodeURL):
+        (WebCore::XSSAuditor::decodeHTMLEntities):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-07-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Null deref in JSObject::mark due to null xhr wrapper
+        https://bugs.webkit.org/show_bug.cgi?id=27565
+
+        Make event target binding for appcache and xhr behave in the same way as
+        it does for all other events.
+
+        No test as I couldn't make a testcase which was remotely reliable.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+
+2009-07-22  Mads Ager  <ager@chromium.org>
+
+        Reviewed by David Levin.
+
+        Inform V8 of the amount of WebCore string memory it is keeping alive.
+        https://bugs.webkit.org/show_bug.cgi?id=27537
+
+        V8 uses external strings that are backed by WebCore strings. Since
+        the external strings themselves are small, V8 has no way of
+        knowing how much memory it is actually holding on to. With this
+        change, we inform V8 of the amount of WebCore string data it is
+        holding on to with external strings.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+
+2009-07-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27562
+        Add the finalized versions of background-clip and background-origin.  Remove background-clip from
+        the background shorthand and have it be auto-set based off background-origin's value.
+
+        Three new tests added in fast/backgrounds/size
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillShorthand):
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSPropertyLonghand.cpp:
+        (WebCore::initShorthandMap):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+
+2009-07-22  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Hook up V8 bindings for DataGrid elements.
+        https://bugs.webkit.org/show_bug.cgi?id=27383
+        http://code.google.com/p/chromium/issues/detail?id=16730
+
+        Tests: Enhanced LayoutTests/fast/dom/HTMLDataGridElement/*
+        to handle exceptions, check appropriate JS prototypes, and
+        test column-list's item() method as well as array-indexing.
+
+        * WebCore.gypi: Added new source files.
+        * bindings/scripts/CodeGeneratorV8.pm: Made GenerateBatchedAttributeData put #if's around conditional attributes.
+        * bindings/v8/DOMObjectsInclude.h: #include DataGrid headers.
+        * bindings/v8/V8DOMWrapper.cpp: Add bindings from HTML tags to datagrid templates.
+        (WebCore::V8DOMWrapper::getTemplate): Customize datagrid template.
+        * bindings/v8/V8DataGridDataSource.cpp: Added. (Based on JSDataGridDataSource)
+        (WebCore::V8DataGridDataSource::V8DataGridDataSource):
+        (WebCore::V8DataGridDataSource::~V8DataGridDataSource):
+        * bindings/v8/V8DataGridDataSource.h: Added. (Based on JSDataGridDataSource)
+        (WebCore::V8DataGridDataSource::create):
+        (WebCore::V8DataGridDataSource::isJSDataGridDataSource):
+        (WebCore::V8DataGridDataSource::jsDataSource):
+        (WebCore::asV8DataGridDataSource):
+        * bindings/v8/V8GCController.h: Added new handle type "DATASOURCE".
+        * bindings/v8/V8Index.h: Conditionalize datagrid stuff.
+        * bindings/v8/custom/V8CustomBinding.h: Declare more accessors. Conditionalize.
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp: Added.
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Fill in dataSource accessors.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        pushDownTextDecorationStyleAroundNode needs clean up
+        https://bugs.webkit.org/show_bug.cgi?id=27556
+
+        Cleaned up. pushDownTextDecorationStyleAroundNode traverses tree vertically from highestAncestor to targetNode
+        While traversing, it will apply the specified style to all nodes but targetNode.
+        i.e. the style is applies to all ancestor nodes and their siblings of targetNode.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::pushDownTextDecorationStyleAroundNode): Cleaned up and added comments
+        * editing/ApplyStyleCommand.h: Updated prototype
+
+2009-07-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Handle any type of line endings in WebCore/css/*CSSPropertyNames.in.
+
+        * DerivedSources.make:
+        * css/makeprop.pl:
+        * css/makevalues.pl:
+
+2009-07-22  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium has a build break after removal of JSRGBColor bindings
+        https://bugs.webkit.org/show_bug.cgi?id=27548
+
+        Fix a build break in Chromium V8 after the JSRGBColor bindings change:
+        https://bugs.webkit.org/show_bug.cgi?id=27242
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-07-22  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Chromium Linux: add static functions to FontPlatformData which allow
+        for setting the global font rendering preferences.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27513
+        http://code.google.com/p/chromium/issues/detail?id=12179
+
+        This should not affect any layout tests.
+
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::setHinting):
+        (WebCore::FontPlatformData::setAntiAlias):
+        (WebCore::FontPlatformData::setSubpixelGlyphs):
+        (WebCore::FontPlatformData::setupPaint):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+
+2009-07-22  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Move Inspector panels creation into a function to make possible introducing
+        custom panels.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.loaded):
+
+2009-07-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Print console command message upon evaluate
+        selection request; Handle errors in evaluation request
+        properly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27535
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
+
+2009-07-22  Xan Lopez  <xlopez@igalia.com>
+
+        Attempt to fix the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-07-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
+
+        * WebCore.pro: Add RGBColor.cpp to the build, remove JSRGBColor.
+
+2009-07-21  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27494
+
+        Fixes an issue that can cause a crash or unexpected behavior when calling
+        WebCore::ScriptSourceCode::source on a cached script.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/CachedScriptSourceProvider.h: Modified to inherit from 
+        WebCore::ScriptSourceCode.
+        (WebCore::CachedScriptSourceProvider::source):
+        (WebCore::CachedScriptSourceProvider::CachedScriptSourceProvider):
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode): Separated out source provider and
+        rewrote to use WebCore::ScriptSourceProvider.
+        (WebCore::ScriptSourceCode::source):
+        * bindings/js/ScriptSourceProvider.h: Added.
+        (WebCore::ScriptSourceProvider::ScriptSourceProvider):
+        (WebCore::ScriptSourceProvider::~ScriptSourceProvider):
+        * bindings/js/StringSourceProvider.h: Modified to inherit from 
+        WebCore::ScriptSourceCode.
+        (WebCore::StringSourceProvider::StringSourceProvider):
+
+2009-07-21  Sam Weinig  <sam@webkit.org>
+
+        Another attempt to fix the Windows build.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-07-21  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the Windows build.
+
+        * DerivedSources.cpp:
+
+2009-07-21  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the GTK build.
+
+        * GNUmakefile.am:
+
+2009-07-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Autogenerate Objective-C binding implementation for RGBColor.
+
+        No functionality change.
+
+        * WebCore.xcodeproj/project.pbxproj: 
+        * bindings/objc/DOMRGBColor.mm: Removed.
+        * bindings/scripts/CodeGeneratorObjC.pm: Add logic to convert from
+        WebCore::Color to NSColor*.
+        * css/RGBColor.idl:
+
+2009-07-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27242
+        JSC bindings should use an auto-bound RGBColor class instead of hand-rolled JSRGBColor
+
+        Move the JSC and Objective-C bindings onto using the RGBColor object instead
+        of just an unsigned int. The JSC bindings are now completely autogenerated for
+        this class. (Also removes the last lut from WebCore).
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSRGBColor.cpp: Removed.
+        * bindings/js/JSRGBColor.h: Removed.
+        * bindings/objc/DOM.mm:
+        (-[DOMRGBColor _color]):
+        * bindings/objc/DOMRGBColor.mm:
+        (-[DOMRGBColor dealloc]):
+        (-[DOMRGBColor finalize]):
+        (-[DOMRGBColor red]):
+        (-[DOMRGBColor green]):
+        (-[DOMRGBColor blue]):
+        (-[DOMRGBColor alpha]):
+        (-[DOMRGBColor color]):
+        * bindings/scripts/CodeGenerator.pm:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseColor):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::getRGBColorValue):
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::getRGBA32Value):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
+        * css/RGBColor.cpp:
+        (WebCore::RGBColor::alpha):
+        * css/RGBColor.h:
+        (WebCore::RGBColor::color):
+        (WebCore::RGBColor::RGBColor):
+        * css/RGBColor.idl:
+        * page/DOMWindow.idl:
+        * svg/SVGColor.cpp:
+        (WebCore::SVGColor::rgbColor):
+        * svg/SVGColor.h:
+
+2009-07-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Implement AbstractWorker::dispatchScriptErrorEvent by generating an ErrorEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=27515
+
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
+
+2009-07-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Move m_context out of generator into a superclass
+        https://bugs.webkit.org/show_bug.cgi?id=27521
+
+        Mostly this is removing code from CodeGeneratorJS
+        and instead using a DOMObjectWithSVGContext superclass in JSDOMBinding.h.
+
+        DOMObjectWithSVGContext.h is its own file so that WebKit doesn't need to
+        know about SVGElement.h (WebKit includes JSDOMBinding.h for some reason).
+
+        I also removed context pointer from SVGZoomEvent since it was never used.
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/DOMObjectWithSVGContext.h: Added.
+        (WebCore::DOMObjectWithSVGContext::context):
+        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-07-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION (r46142):  editing/execCommand/19087.html & editing/execCommand/19653-1.html fail in Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=27480
+
+        Because m_anchorType : 2 is treated as a signed integer by cl.exe, anchorType() wasn't returning the correct value.
+        We made m_anchorType unsigned so that anchorType() returns the correct value.
+
+        * dom/Position.h:
+        (WebCore::Position::anchorType): statically cast to AnchorType
+
+2009-07-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Add V8 bindings for onerror in WorkerContext.
+        https://bugs.webkit.org/show_bug.cgi?id=27518
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-07-21  Jian Li  <jianli@chromium.org>
+
+        Fix the incorrect patch being landed for bug 27516 that has already been reviewed.
+        https://bugs.webkit.org/show_bug.cgi?id=27516
+
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::setOnerror):
+        (WebCore::WorkerContext::onerror):
+        * workers/WorkerContext.idl:
+
+2009-07-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add onerror to WorkerContext.
+        https://bugs.webkit.org/show_bug.cgi?id=27516
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::setOnerror):
+        (WebCore::WorkerContext::onerror):
+        * workers/WorkerContext.idl:
+
+2009-07-21  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27509
+        Add font-related files for the WinCE port.
+
+        Written by Yong Li <yong.li@torchmobile.com>
+
+        * platform/graphics/wince/FontCacheWince.cpp: Added.
+        * platform/graphics/wince/FontCustomPlatformData.cpp: Added.
+        * platform/graphics/wince/FontCustomPlatformData.h: Added.
+        * platform/graphics/wince/FontPlatformData.cpp: Added.
+        * platform/graphics/wince/FontPlatformData.h: Added.
+        * platform/graphics/wince/FontWince.cpp: Added.
+        * platform/graphics/wince/GlyphPageTreeNodeWince.cpp: Added.
+        * platform/graphics/wince/SimpleFontDataWince.cpp: Added.
+
+2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Fix the Windows build, and update the comment on top now that wx uses WebCorePrefix.h too.
+
+        * WebCorePrefix.h:
+
+2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        WebCorePrefix.h build fixes for non-Mac and wx / CURL builds.
+
+        * WebCorePrefix.h:
+
+2009-07-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        All DOMConstructorObjects should hold a pointer to the JSDOMGlobalObject
+        https://bugs.webkit.org/show_bug.cgi?id=27478
+
+        This is just moving code.
+        I've added two new classes: DOMObjectWithGlobalPointer and DOMConstructorWithDocument.
+
+        DOMObjectWithGlobalPointer is a new baseclass for DOMConstructorObject.
+        (It's a baseclass because eventually all DOMObjects will have a global pointer, but
+        I'll be moving them onto DOMObjectWithGlobalPointer in stages.)
+
+        DOMConstructorWithDocument is a new baseclass for the 3 constructor objects
+        which require a backpointer to the Document to function.  I made this a subclass of
+        DOMConstructorObject to make clear that most constructors can hold no-such assumptions
+        about having a back-pointer to the Document (since many constructors can be used from Workers).
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSAudioConstructor.h:
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::globalObject):
+        (WebCore::DOMObjectWithGlobalPointer::scriptExecutionContext):
+        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
+        (WebCore::DOMObjectWithGlobalPointer::mark):
+        (WebCore::DOMConstructorObject::DOMConstructorObject):
+        (WebCore::DOMConstructorWithDocument::document):
+        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageConstructor.h:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        * bindings/js/JSMessageChannelConstructor.h:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSOptionConstructor.h:
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+
+2009-07-21  James Hawkins  <jhawkins@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27453
+        Initialize isInt when creating a CSSParserValue for a function.
+
+        No change in behavior, so no tests.
+
+        * css/CSSFunctionValue.cpp:
+        (WebCore::CSSFunctionValue::parserValue):
+
+2009-07-20  Jens Alfke  <snej@google.com>
+ 
+         Reviewed by David Levin.
+ 
+         Bug 27448: [Chromium] On Mac, arrow keys should cause Select to pop up its menu.
+         Mac build of Chromium doesn't follow Mac HI guidelines to pop up the menu when
+         an arrow key is pressed.
+         https://bugs.webkit.org/show_bug.cgi?id=27448
+ 
+         No new tests; affects only control response to user input.
+ 
+         * dom/SelectElement.cpp:
+         Changed definition of ARROW_KEYS_POP_MENU to make it true in Mac Chromium,
+         so it will behave compatibly with Mac HI guidelines on pop-up menus.
+         It's not possible to have PLATFORM(MAC) be true in the Mac build of Chromium.
+ 
+2009-07-21  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] popup menus can crash when the selected index is -1
+        https://bugs.webkit.org/show_bug.cgi?id=27275
+
+        Crash reports from users indicate a crash can occur when PopupListBox::isSelectableItem
+        is passed an index of less than 0 (which is possible under certain circumstances). This
+        change prevents such a value from causing a crash by enforcing valid index values passed
+        by all callers of isSelectableItem. isSelectableItem is now a private method of
+        PopupListBox, as there are no external callers.
+
+        Also cleaned up a small amount of code for style and grammar errors.
+
+        No automatic test is provided since we cannot send events to the child window used by
+        the popup menu.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::selectIndex):
+        (WebCore::PopupListBox::isSelectableItem):
+        (WebCore::PopupListBox::selectPreviousRow):
+
+2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Don't include winsock2.h on wx, it conflicts with wx's inclusion of winsock.
+
+        * platform/network/curl/ResourceHandleManager.h:
+
+2009-07-21  Adam Roben  <aroben@apple.com>
+
+        Roll out r46153, r46154, and r46155
+
+        These changes were causing build failures and assertion failures on
+        Windows.
+
+        * ForwardingHeaders/wtf/PossiblyNull.h: Removed.
+        * platform/graphics/cg/ImageBufferCG.cpp:
+
+2009-07-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement ErrorEvent API.
+        https://bugs.webkit.org/show_bug.cgi?id=27387
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * dom/ErrorEvent.cpp: Added.
+        * dom/ErrorEvent.h: Added.
+        * dom/ErrorEvent.idl: Added.
+        * dom/Event.cpp:
+        (WebCore::Event::isErrorEvent):
+        * dom/Event.h:
+
+2009-07-21  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Searching in thepiratebay.org doesn't work with more than 1 word
+        https://bugs.webkit.org/show_bug.cgi?id=24602
+
+        Remove workaround required for <=libsoup-2.26.1
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-07-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        V8IsolatedWorld keeps a handle to a disposed context
+        https://bugs.webkit.org/show_bug.cgi?id=27397
+
+        Make a copy of the context handle before making it weak.  We don't want
+        to make the original handle weak because we want it to survive for the
+        length of the V8IsolatedWorld::evaluate method.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+
+2009-07-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add ability to evaluate selection while on break point.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27502
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceFrame.prototype._documentKeyDown):
+
+2009-07-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Special case ConsolePanel opening since
+        it is a 'fast view'.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27493
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+
+2009-07-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix Qt code to follow the WebKit Coding Style.
+
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::qstring):
+        (WebCore::fixSpacing):
+        * platform/graphics/qt/FontQt43.cpp:
+        (WebCore::generateComponents):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::cursorToX):
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtFillRule):
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::~GraphicsContext):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getWindowsContext):
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::paint):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::frameDurationAtIndex):
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::create):
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::isEmpty):
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        (WebCore::TransformationMatrix::operator QTransform):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::ClipboardQt):
+        (WebCore::ClipboardQt::clearData):
+        (WebCore::ClipboardQt::clearAllData):
+        (WebCore::ClipboardQt::getData):
+        (WebCore::ClipboardQt::setData):
+        (WebCore::ClipboardQt::setDragImage):
+        (WebCore::getCachedImage):
+        (WebCore::ClipboardQt::declareAndWriteDragImage):
+        (WebCore::ClipboardQt::writeURL):
+        (WebCore::ClipboardQt::writeRange):
+        (WebCore::ClipboardQt::hasData):
+        * platform/qt/ClipboardQt.h:
+        * platform/qt/ContextMenuItemQt.cpp:
+        (WebCore::ContextMenuItem::action):
+        (WebCore::ContextMenuItem::title):
+        * platform/qt/CursorQt.cpp:
+        (WebCore::westPanningCursor):
+        (WebCore::notAllowedCursor):
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::containsFiles):
+        (WebCore::DragData::asFilenames):
+        (WebCore::DragData::asPlainText):
+        (WebCore::DragData::asFragment):
+        * platform/qt/DragImageQt.cpp:
+        (WebCore::createDragImageIconForCachedImage):
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::getFileSize):
+        (WebCore::unloadModule):
+        * platform/qt/Localizations.cpp:
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        * platform/qt/MIMETypeRegistryQt.cpp:
+        (WebCore::):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::plainText):
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/qt/PlatformMouseEventQt.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::populate):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::fallbackStyle):
+        (WebCore::inflateButtonRect):
+        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::paintMenuList):
+        (WebCore::RenderThemeQt::applyTheme):
+        (WebCore::WorldMatrixTransformer::WorldMatrixTransformer):
+        (WebCore::RenderThemeQt::paintMediaBackground):
+        (WebCore::RenderThemeQt::paintMediaFullscreenButton):
+        * platform/qt/RenderThemeQt.h:
+        * platform/qt/ScreenQt.cpp:
+        (WebCore::screenRect):
+        (WebCore::usableScreenRect):
+        * platform/qt/ScrollbarQt.cpp:
+        (WebCore::Scrollbar::contextMenu):
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::scPart):
+        (WebCore::scrollbarPart):
+        * platform/qt/ScrollbarThemeQt.h:
+        * platform/qt/SharedBufferQt.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/qt/TemporaryLinkStubs.cpp:
+        (PluginDatabase::defaultPluginDirectories):
+        (PluginDatabase::getPluginPathsInDirectories):
+        (PluginDatabase::isPreferredPluginDirectory):
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        (WebCore::userIdleTime):
+        (WebCore::prefetchDNS):
+        * platform/text/qt/StringQt.cpp:
+        (WebCore::String::String):
+        * platform/text/qt/TextBoundaries.cpp:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        (WebCore::TextBreakIterator::following):
+        (WebCore::TextBreakIterator::preceding):
+        (WebCore::WordBreakIteratorQt::first):
+        (WebCore::WordBreakIteratorQt::next):
+        (WebCore::WordBreakIteratorQt::previous):
+        (WebCore::CharBreakIteratorQt::first):
+        (WebCore::CharBreakIteratorQt::next):
+        (WebCore::CharBreakIteratorQt::previous):
+        (WebCore::characterBreakIterator):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::userAgentStatic):
+        (WebCore::PluginView::handlePostReadFile):
+        (WebCore::PluginView::init):
+
+2009-07-21  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by David Levin.
+
+        Added a first bunch of Haiku-specific files for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=26988
+
+        * platform/haiku/ClipboardHaiku.cpp: Added.
+        (WebCore::ClipboardHaiku::ClipboardHaiku):
+        (WebCore::ClipboardHaiku::clearData):
+        (WebCore::ClipboardHaiku::clearAllData):
+        (WebCore::ClipboardHaiku::getData):
+        (WebCore::ClipboardHaiku::setData):
+        (WebCore::ClipboardHaiku::types):
+        (WebCore::ClipboardHaiku::files):
+        (WebCore::ClipboardHaiku::dragLocation):
+        (WebCore::ClipboardHaiku::dragImage):
+        (WebCore::ClipboardHaiku::setDragImage):
+        (WebCore::ClipboardHaiku::dragImageElement):
+        (WebCore::ClipboardHaiku::setDragImageElement):
+        (WebCore::ClipboardHaiku::createDragImage):
+        (WebCore::ClipboardHaiku::declareAndWriteDragImage):
+        (WebCore::ClipboardHaiku::writeURL):
+        (WebCore::ClipboardHaiku::writeRange):
+        (WebCore::ClipboardHaiku::hasData):
+        * platform/haiku/ClipboardHaiku.h: Added.
+        (WebCore::ClipboardHaiku::create):
+        (WebCore::ClipboardHaiku::~ClipboardHaiku):
+        * platform/haiku/CookieJarHaiku.cpp: Added.
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
+        * platform/haiku/CursorHaiku.cpp: Added.
+        (WebCore::Cursor::Cursor):
+        (WebCore::Cursor::~Cursor):
+        (WebCore::Cursor::operator=):
+        (WebCore::pointerCursor):
+        (WebCore::moveCursor):
+        (WebCore::crossCursor):
+        (WebCore::handCursor):
+        (WebCore::iBeamCursor):
+        (WebCore::waitCursor):
+        (WebCore::helpCursor):
+        (WebCore::eastResizeCursor):
+        (WebCore::northResizeCursor):
+        (WebCore::northEastResizeCursor):
+        (WebCore::northWestResizeCursor):
+        (WebCore::southResizeCursor):
+        (WebCore::southEastResizeCursor):
+        (WebCore::southWestResizeCursor):
+        (WebCore::westResizeCursor):
+        (WebCore::northSouthResizeCursor):
+        (WebCore::eastWestResizeCursor):
+        (WebCore::northEastSouthWestResizeCursor):
+        (WebCore::northWestSouthEastResizeCursor):
+        (WebCore::columnResizeCursor):
+        (WebCore::rowResizeCursor):
+        (WebCore::verticalTextCursor):
+        (WebCore::cellCursor):
+        (WebCore::contextMenuCursor):
+        (WebCore::noDropCursor):
+        (WebCore::copyCursor):
+        (WebCore::progressCursor):
+        (WebCore::aliasCursor):
+        (WebCore::noneCursor):
+        (WebCore::notAllowedCursor):
+        (WebCore::zoomInCursor):
+        (WebCore::zoomOutCursor):
+        (WebCore::grabCursor):
+        (WebCore::grabbingCursor):
+
+2009-07-21  Albert Astals Cid <aacid@kde.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Change #error line not to have a ' (single quote)
+
+        * DerivedSources.cpp:
+
+2009-07-21  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by David Levin.
+
+        Add ENABLE_RUBY to list of build options
+        https://bugs.webkit.org/show_bug.cgi?id=27324
+
+        Added flag ENABLE_RUBY:
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-07-21  James Hawkins  <jhawkins@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27467
+        Return an empty path in PlatformContextSkia::currentPathInLocalCoordinates
+        if matrix.invert() fails.  This prevents the use of an uninitialized
+        value in inverseMatrix.
+
+        No new tests added.  Run
+        LayoutTests/svg/dynamic-updates/SVGMarkerElement-dom-markerHeight-attr.html
+        under valgrind and notice there are no errors.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::currentPathInLocalCoordinates):
+
+2009-07-21  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27388
+
+        Fix dotted and dashed borders on Chromium/skia.  This follows
+        the logic in the Cg path, so results are much closer to Safari now 
+        (some tests won't be exactly the same due to font layout differences).
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-07-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make it harder to misuse try* allocation routines
+        https://bugs.webkit.org/show_bug.cgi?id=27469
+
+        Add forwarding header for PossiblyNull type, and add missing null check
+        to ImageBuffer creation.
+
+        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+
+2009-07-20  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Guard access to installedMediaEngines()[0].
+
+        https://bugs.webkit.org/show_bug.cgi?id=27479
+        http://code.google.com/p/chromium/issues/detail?id=16541
+
+        Else where in the file, installedMediaEngines is always checked for
+        being empty because access. This patch adds a case which missed that
+        check.
+
+        This triggered a crash in Chromium:
+            http://www.yakeze.com/chat/example-chromium-crash/
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load):
+
+2009-07-20  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Allow search entries to render with a CSS border if the RenderTheme
+        doesn't paint them.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27466
+        http://code.google.com/p/chromium/issues/detail?id=16958
+
+        <input type="search"> is very much like a text entry except that,
+        currently, if the RenderTheme doesn't deal with it, nothing is
+        rendered. With this patch, the default CSS border is rendered if the
+        RenderTheme requests it.
+
+        This will affect many layout tests, but only for Chromium Linux and
+        those results are not currently in the WebKit tree.
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paintBorderOnly):
+
+2009-07-17  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Switch to faster methods to access internal fields.
+        https://bugs.webkit.org/show_bug.cgi?id=27372
+
+        Minor refactoring.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
+        (WebCore::V8DOMWrapper::convertToNativeObject):
+        (WebCore::V8DOMWrapper::convertToNativeEvent):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-20  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: cache Harfbuzz faces.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27473
+
+        Previously, we recreated the Harfbuzz face for each script-run. With
+        this patch, we keep the Harfbuzz face in the FontPlatformData (created
+        as needed) and so they will persist for the duration of the
+        FontPlatformData.
+
+        Shouldn't affect any layout tests. Results in a significant win on the
+        intl2 page cycler time.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::~TextRunWalker):
+        (WebCore::TextRunWalker::setupFontForScriptRun):
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::~RefCountedHarfbuzzFace):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::harfbuzzFace):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::create):
+        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::face):
+        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::RefCountedHarfbuzzFace):
+        * platform/graphics/chromium/HarfbuzzSkia.h: Added.
+
+2009-07-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION (r46142): Need to remove showTreeThisForThis
+        https://bugs.webkit.org/show_bug.cgi?id=27475
+
+        Removes showTreeThisForThis
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::appendParagraphIntoNode):
+
+2009-07-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Refactoring of indentRegion to fix bugs 26816 and 25317
+        https://bugs.webkit.org/show_bug.cgi?id=26816
+        https://bugs.webkit.org/show_bug.cgi?id=25317
+        https://bugs.webkit.org/show_bug.cgi?id=23995 (partially)
+
+        This patch implements appendParagraphIntoNode, a simpler specialized version of moveParagraph
+        and replaces all calls inside indentRegion. The following is the new behavior of indentRegion.
+
+        1. We try to indent as many wrapping nodes as possible.
+           e.g. when indenting "hello" in <div>hello</div>, we try to indent div as well.
+        2. We do not delete any wrapping elements
+           With moveParagraph, we used to remove all wrapping nodes, and replaced with a blockquote.
+           This was causing https://bugs.webkit.org/show_bug.cgi?id=23995 for indentation.
+           With appendParagraphIntoNode, we can preserve all wrapping nodes.
+        3. We only split the tree until the closest block node instead of until the root editable node.
+           This behavioral change fixes the bug 25317.
+        4. When multiple paragraphs are indented, we indent the highest common ancestor within the selection.
+           e.g. when a list is a child node of a div, and the entire div is intended,
+                we enclose the div by a single blockquote.
+
+        Note that new behavior is more consistent with that of Internet Explorer and Firefox.
+        To demonstrate this, the following tests are added.
+
+        Tests: editing/execCommand/indent-div-inside-list.html
+               editing/execCommand/indent-nested-blockquotes.html
+               editing/execCommand/indent-nested-div.html
+               editing/execCommand/indent-second-paragraph-in-blockquote.html
+
+        * editing/IndentOutdentCommand.cpp: prepareBlockquoteLevelForInsertion is removed
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): uses appendParagraphIntoNode now
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): uses appendParagraphIntoNode now
+        (WebCore::IndentOutdentCommand::appendParagraphIntoNode): removes a paragraph and appends it to a new node
+        (WebCore::IndentOutdentCommand::removeUnnecessaryLineBreakAt): removes a break element at the specified position
+        (WebCore::IndentOutdentCommand::indentRegion): exhibits the described behavior
+        * editing/IndentOutdentCommand.h: updated prototype
+
+2009-07-20  Dan Bernstein  <mitz@apple.com>
+
+        Try to fix release builds after r46136
+
+        * dom/Element.cpp:
+
+2009-07-17  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Media Controls: We are specifying the text height, where it is unneeded and the slider is 2px off.
+        https://bugs.webkit.org/show_bug.cgi?id=27380
+
+        Adjust the margin of the slider and remove useless height specification to fix alignement of the media controls.
+
+        * css/mediaControlsQT.css:
+
+2009-07-20  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27468
+        Back out r46060, which caused problems for some Apple developers.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-07-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        When loading a custom view into a frame, the old document is still
+        around
+        <rdar://problem/5145841>
+
+        Safari fires onload before PDF is loaded into the browser
+        <rdar://problem/6618869>
+
+        Test: fast/loader/non-html-load-event.html
+
+        * GNUmakefile.am: Added PlaceholderDocument.{cpp,h}
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+        * dom/Document.h:
+        (WebCore::Document::setStyleSelector): Added this protected accessor for
+            PlaceholderDocument to use.
+        * dom/Element.cpp:
+        (WebCore::Element::clientWidth): Check whether the document has a
+            renderer.
+        (WebCore::Element::clientHeight): Ditto.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin): Create a PlaceholderDocument for frames
+            that do not use an HTML view. Do not nullify the content size in
+            that case.
+        (WebCore::FrameLoader::transitionToCommitted): For frames that do not
+            use an HTML view, call receivedFirstData(), which sets up the
+            frame with a new PlaceHolderDocument.
+        * loader/PlaceholderDocument.cpp: Added.
+        (WebCore::PlaceholderDocument::attach): Sets up the style selector but
+            does not create a RenderView.
+        * loader/PlaceholderDocument.h: Added.
+        (WebCore::PlaceholderDocument::create):
+        (WebCore::PlaceholderDocument::PlaceholderDocument):
+
+2009-07-20  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Handle opacity and opacity animations on transform layers in Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=27398
+
+        This makes two changes, and only for Leopard. 
+
+        First, whenever opacity is changed on a layer I propagate the 
+        change into the content layer and all the children if the layer 
+        on which opacity is set is a transform layer (preserve3D is true). 
+        The opacity set is the accumulated opacity from this layer
+        and all its direct ancestor transform layers. Second, I turn off all 
+        hardware opacity animation.
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::accumulatedOpacity):
+        (WebCore::GraphicsLayer::distributeOpacity):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setOpacityInternal):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setPreserves3D):
+        (WebCore::GraphicsLayerCA::setOpacity):
+        (WebCore::GraphicsLayerCA::animateFloat):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        (WebCore::GraphicsLayerCA::setOpacityInternal):
+        (WebCore::GraphicsLayerCA::updateOpacityOnLayer):
+
+2009-07-20  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27349
+        Add GraphicsContext implementation for the WinCE port.
+
+        Written by Yong Li <yong.li@torchmobile.com>, George Staikos <george.staikos@torchmobile.com> and Lyon Chen <lyon.chen@torchmobile.com>
+        with trivial style fixes by Adam Treat <adam.treat@torchmobile.com>
+
+        * platform/graphics/wince/GraphicsContextWince.cpp: Added.
+
+2009-07-20  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding the Win SQLite VFS implementation for Chromium, and stubs
+        for the Mac and Linux VFSs.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26940
+
+        * WebCore.gypi:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Added.
+
+2009-07-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27097
+        [Gtk] Segfault when examining an object of ROLE_TABLE via at-spi
+
+        Check that an object is a RenderObject before trying to access its
+        renderer and related node.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_role):
+
+2009-07-20  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] font cache reworking
+        https://bugs.webkit.org/show_bug.cgi?id=27265
+
+        Reimplemented Qt's FontCache in a way that follows the shared one.
+        Now we can release its elements when those became inactive.
+        FontFallbackList had been changed to be able to hold WebCore fonts in its list and to be able to release a FontData what is in the cache.
+
+        No change in behavior, so no tests.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        (WebCore::FontPlatformDataCacheKey::isHashTableDeletedValue):
+        (WebCore::FontPlatformDataCacheKey::): Key type for the cache of FontPlatformData objects.
+        It can be constructed from a FontPlatformData or from a FontDescription. The keys have to be consistent
+        with FontPlatformData::FontPlatformData(const FontDescription&) - if we create the same
+        FontPlatformData from two FontDescription then we have to create the same key from them, and vica versa.
+        (WebCore::FontPlatformDataCacheKey::operator==):
+        (WebCore::FontPlatformDataCacheKey::hash):
+        (WebCore::FontPlatformDataCacheKey::computeHash):
+        (WebCore::FontPlatformDataCacheKey::hashTableDeletedSize):
+        (WebCore::FontPlatformDataCacheKeyHash::hash):
+        (WebCore::FontPlatformDataCacheKeyHash::equal):
+        (WebCore::FontPlatformDataCacheKeyTraits::emptyValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::constructDeletedValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::isDeletedValue):
+        (WebCore::FontCache::getCachedFontPlatformData): Get a FontDescription and returns a FontPlatformData.
+        (WebCore::FontCache::getCachedFontData): Get a FontPlatformData and returns a SimpleFontData.
+        (WebCore::FontCache::releaseFontData): Get a SimpleFontData and releases it from the cache. Also releases the appropriate FontPlatformData.
+        (WebCore::FontCache::purgeInactiveFontData): Frees inactive elements.
+        (WebCore::FontCache::invalidate): Frees all inactive elements (call purgeInactiveFontData with default argument)
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::releaseFontData):
+        (WebCore::FontFallbackList::fontDataAt):
+        * platform/graphics/qt/FontPlatformData.h:
+        (WebCore::FontPlatformData::family): Getter. It is needed for FontPlatformDataCacheKey.
+        (WebCore::FontPlatformData::bold): Ditto.
+        (WebCore::FontPlatformData::italic): Ditto.
+        (WebCore::FontPlatformData::smallCaps): Ditto.
+        (WebCore::FontPlatformData::pixelSize): Ditto.
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData): Set m_bold.
+
+2009-07-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26716
+        [Gtk] Each XMLHttpRequest leaks memory.
+
+        Free the SoupURI we create to check the URI. Fix suggested by John
+        Kjellberg.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-07-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] On Symbian link against system sqlite3
+        https://bugs.webkit.org/show_bug.cgi?id=27368
+
+        Add an option to force linking against system sqlite3
+        by adding system-sqlite to the CONFIG variable.
+
+        The Symbian specific part of this patch is contributed by 
+        Norbert Leser.
+
+        * WebCore.pro:
+
+2009-07-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Change the glib version check to check for the first unstable
+        release with g_mapped_file_unref. Otherwise this would be useless
+        until 2.22 is released, a few months from now.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-07-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by and done with Tor Arne Vestbø.
+
+        Fix fast/css/pseudo-required-optional-*.html in the Qt build
+        after r46062.
+
+        These tests triggered a bug in RenderThemeQt where we did not fall back
+        to the unstyled painting of text areas and input fields when they have
+        a styled background.
+
+        Our re-implementation of isControlStyled incorrectly only checked the
+        border for determining whether to style or not. The base-implementation
+        performs the same check, but also includes the background. Removing
+        our implementation fixes the appearance.
+
+        * platform/qt/RenderThemeQt.cpp: Removed isControlStyled reimplementation.
+        * platform/qt/RenderThemeQt.h: Ditto.
+
+2009-07-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Add missing (sorted) header files to the HEADERS variable in the qmake
+        .pro file for improved completion in IDEs.
+
+        * WebCore.pro:
+
+2009-07-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Factor V8ConsoleMessage out of V8Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=27421
+
+        No behavior change.
+
+        * WebCore.gypi:
+        * bindings/v8/V8ConsoleMessage.cpp: Added.
+        (WebCore::V8ConsoleMessage::V8ConsoleMessage):
+        (WebCore::V8ConsoleMessage::dispatchNow):
+        (WebCore::V8ConsoleMessage::dispatchLater):
+        (WebCore::V8ConsoleMessage::processDelayed):
+        (WebCore::V8ConsoleMessage::handler):
+        * bindings/v8/V8ConsoleMessage.h: Added.
+        (WebCore::V8ConsoleMessage::Scope::Scope):
+        (WebCore::V8ConsoleMessage::Scope::~Scope):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::logInfo):
+        (WebCore::reportUnsafeAccessTo):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+        (WebCore::V8Proxy::newInstance):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::processConsoleMessages):
+
+2009-07-19  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        Remove unused member variable.
+
+        * svg/SVGPolyElement.h:
+
+2009-07-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        HTMLAudioElement: constructor should set "autobuffer" attribute
+        https://bugs.webkit.org/show_bug.cgi?id=27422
+
+        Test: media/audio-constructor-autobuffer.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::constructAudio):
+            Set 'autobuffer' attribute.
+
+2009-07-19  Thierry Bastian <thierry.bastian@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build with mingw.
+
+        * WebCore.pro: Don't use MSVC commandline options to disable warnings
+        with mingw.
+
+2009-07-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Phase 2: Remove event listener methods from V8Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=27415
+
+        No behavior change.
+
+        * bindings/v8/V8ObjectEventListener.cpp:
+        (WebCore::weakObjectEventListenerCallback):
+        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::disconnectEventListeners):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::eventListeners):
+        (WebCore::V8Proxy::objectListeners):
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        (WebCore::getEventListener):
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::~V8EventListener):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::getEventListener):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] soup/ResourceHandleSoup.cpp:533: error: 'g_mapped_file_free' was not declared in this scope
+        https://bugs.webkit.org/show_bug.cgi?id=27230
+
+        Use g_mapped_file_unref for GLIB version 2.22 onwards.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-07-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Add spread radius support to -webkit-box-shadow
+        https://bugs.webkit.org/show_bug.cgi?id=27417
+        rdar://problem/7072267
+
+        Test: fast/box-shadow/spread.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForShadow): Added a property ID parameter and used it to
+            include the spread length for box-shadow but not for text-shadow.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+            Pass the property ID to valueForShadow().
+
+        * css/CSSParser.cpp:
+        (WebCore::ShadowParseContext::ShadowParseContext): Added property,
+            spread, and allowSpread members. Added a property ID parameter to
+            the constructor. Initialize the property and allowSpread members.
+        (WebCore::ShadowParseContext::allowLength): Added allowSpread.
+        (WebCore::ShadowParseContext::commitValue): Pass the spread value to
+            the ShadowValue constructor. Reset allowSpread.
+        (WebCore::ShadowParseContext::commitLength): Allow spread after blur
+            for the box-shadow property.
+        (WebCore::ShadowParseContext::commitColor): Reset allowSpread.
+        (WebCore::CSSParser::parseShadow): Pass the property ID to
+            ShadowParseContext().
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Get the spread value from
+            the shadow value and pass it to the ShadowData constructor.
+
+        * css/ShadowValue.cpp:
+        (WebCore::ShadowValue::ShadowValue): Added spread.
+        (WebCore::ShadowValue::cssText): Added spread.
+
+        * css/ShadowValue.h:
+        (WebCore::ShadowValue::create): Added spread.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc): Blend the spread value.
+        (WebCore::PropertyWrapperShadow::blend): Added 0 spread to the default
+            shadow.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally): Account for spread in
+            the visual overflow calculations.
+        (WebCore::InlineFlowBox::placeBoxesVertically): Ditto.
+        (WebCore::InlineFlowBox::paint): Ditto.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::overflowHeight): Ditto.
+        (WebCore::RenderBlock::overflowWidth): Ditto.
+        (WebCore::RenderBlock::overflowLeft): Ditto.
+        (WebCore::RenderBlock::overflowTop): Ditto.
+        (WebCore::RenderBlock::overflowRect): Ditto.
+        (WebCore::RenderBlock::layoutBlock): Ditto.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow): Inflate the shadow-
+            casting rect by the shadow spread value. Adjust border radii if
+            necessary.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock): Account for spread in the
+            visual overflow calculations.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateRects): Ditto.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Account for spread.
+        (WebCore::RenderObject::adjustRectForOutlineAndShadow): Ditto.
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Ditto.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setTextShadow): Assert that text shadows do not
+            have spread.
+
+        * rendering/style/ShadowData.cpp:
+        (WebCore::ShadowData::ShadowData): Added spread.
+        (WebCore::ShadowData::operator==): Compare spread.
+        * rendering/style/ShadowData.h:
+        (WebCore::ShadowData::ShadowData): Added spread.
+
+2009-07-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Jan Alonzo.
+
+        Minor FrameLoader.cpp cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=27406
+
+        No behavior change.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeIfJavaScriptURL):
+
+2009-07-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Move event listener methods from V8Proxy to V8EventListenerList
+        https://bugs.webkit.org/show_bug.cgi?id=27408
+
+        Move some event listener code out of V8Proxy and into the event
+        listener list.
+
+        I'd like to remove these methods from V8Proxy entirely and just expose
+        getters for the lists themselves, but I'll do that in a follow up
+        patch.
+
+        * bindings/v8/V8EventListenerList.cpp:
+        (WebCore::V8EventListenerList::findWrapper):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/V8ObjectEventListener.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::findV8EventListener):
+        (WebCore::V8Proxy::findOrCreateV8EventListener):
+        (WebCore::V8Proxy::removeV8EventListener):
+        (WebCore::V8Proxy::findObjectEventListener):
+        (WebCore::V8Proxy::findOrCreateObjectEventListener):
+        (WebCore::V8Proxy::removeObjectEventListener):
+        * bindings/v8/V8Proxy.h:
+
+2009-07-18  Jeremy Orlow  <jorlow@chromium.org>
+
+        Rubber stamped by Adam Barth.
+
+        Revert https://bugs.webkit.org/show_bug.cgi?id=27383
+        https://bugs.webkit.org/show_bug.cgi?id=27407
+
+        Revert Jens' patch.  I believe he forgot to include a file.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8DataGridDataSource.cpp: Removed.
+        * bindings/v8/V8DataGridDataSource.h: Removed.
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-07-17  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27405
+
+        Fixes an issue when decoding HTML entities with an unknown named entity that 
+        caused null-characters to be inserted into the decoded result.
+
+        Test: http/tests/security/xssAuditor/link-onclick-ampersand.html
+              http/tests/security/xssAuditor/javascript-link-ampersand.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::decodeHTMLEntities): Added check to conditional so that
+        non-zero entity values are not inserted during decoding process.
+
+2009-07-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        <http://webkit.org/b/18363> [GTK] Combo boxes cannot be opened pressing space
+
+        Reviewed by Holger Freyther.
+
+        Add Gtk to platforms that want to open the menulist using the
+        spacebar.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-07-17  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25523
+        [GTK] The text displayed by push buttons is not exposed to assistive technologies
+
+        Add new public method text() to RenderButton and use it from
+        AccessibilityRenderObject::stringValue().
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::stringValue):
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::text):
+        * rendering/RenderButton.h:
+
+2009-07-17  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Restore proxy retrieval
+        https://bugs.webkit.org/show_bug.cgi?id=27369
+
+        No new tests are needed.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+
+2009-07-17  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27351
+        Added platform "Symbian" to WEBCORE_NAVIGATOR_PLATFORM
+        Use uname to find the correct platform for Linux.
+
+        * page/NavigatorBase.cpp:
+        (WebCore::NavigatorBase::platform):
+
+2009-07-17  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Hook up V8 bindings for DataGrid elements.
+        https://bugs.webkit.org/show_bug.cgi?id=27383
+        http://code.google.com/p/chromium/issues/detail?id=16730
+
+        Tests: Enhanced LayoutTests/fast/dom/HTMLDataGridElement/*
+        to handle exceptions, check appropriate JS prototypes, and
+        test column-list's item() method as well as array-indexing.
+
+        * WebCore.gypi: Added new source files.
+        * bindings/scripts/CodeGeneratorV8.pm: Made GenerateBatchedAttributeData put #if's around conditional attributes.
+        * bindings/v8/DOMObjectsInclude.h: #include DataGrid headers.
+        * bindings/v8/V8DOMWrapper.cpp: Add bindings from HTML tags to datagrid templates.
+        (WebCore::V8DOMWrapper::getTemplate): Customize datagrid template.
+        * bindings/v8/V8DataGridDataSource.cpp: Added. (Based on JSDataGridDataSource)
+        (WebCore::V8DataGridDataSource::V8DataGridDataSource):
+        (WebCore::V8DataGridDataSource::~V8DataGridDataSource):
+        * bindings/v8/V8DataGridDataSource.h: Added. (Based on JSDataGridDataSource)
+        (WebCore::V8DataGridDataSource::create):
+        (WebCore::V8DataGridDataSource::isJSDataGridDataSource):
+        (WebCore::V8DataGridDataSource::jsDataSource):
+        (WebCore::asV8DataGridDataSource):
+        * bindings/v8/V8GCController.h: Added new handle type "DATASOURCE".
+        * bindings/v8/V8Index.h: Conditionalize datagrid stuff.
+        * bindings/v8/custom/V8CustomBinding.h: Declare more accessors. Conditionalize.
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Fill in dataSource accessors.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        StorageArea should only contain methods we intend to proxy.
+        https://bugs.webkit.org/show_bug.cgi?id=27181
+
+        Right now, StorageAreaSync takes in a StorageArea* and calls methods
+        like importItem.  Really, StorageAreaSync should be operating directly
+        on StorageAreaImpl* and those methods should be removed from StorageArea
+        since StorageAreaSync should never be attached to anything other than a
+        StorageAreaImpl.
+
+        This was pointed out in the review for
+        https://bugs.webkit.org/show_bug.cgi?id=27072
+
+        Also clean up StorageNamespaceImpl to operate directly on
+        StorageAreaImpl.  Also, get rid of the factory for StorageArea
+        since nothing should ever create a StorageArea directly.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/StorageArea.cpp: Removed.
+        * storage/StorageArea.h:
+        (WebCore::StorageArea::~StorageArea):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::copy):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::create):
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        * storage/StorageAreaSync.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add v8 implementation for DOM Storage ScriptObjectQuarantine.
+        https://bugs.webkit.org/show_bug.cgi?id=27327
+
+        Wrap the storage object with a generic object as is done elsewhere in
+        the file (but continue to hit a NOTIMPLEMENTED if DOM_STORAGE is not
+        enabled.
+
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+
+2009-07-17  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27394
+        Fix access to global object wrappers after navigation of their
+        frame in the V8 bindings.  This fixes selenium test failures.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocument):
+
+2009-07-17  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 32-bit build by removing implicit float <-> double conversions.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::constrainedAttachedWindowHeight):
+
+2009-07-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix of <rdar://problem/5712795> Win: Cannot change the height of the docked Web Inspector (14272)
+        https://bugs.webkit.org/show_bug.cgi?id=14272
+        
+        Moved preference setting for attached inspector height and inspector height calculation from
+        WebInspectorClient.mm into InspectorController.cpp, to make this code cross-platform and enable
+        Windows resizing of attached inspector.
+
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+
+2009-07-17  Dan Bernstein  <mitz@apple.com>
+
+        Another attempt at fixing the build after r46063
+
+        * WebCore.xcodeproj/project.pbxproj: Made ExceptionCode.h a private
+            header, because it is now included from htmlediting.h, which is
+            a private header.
+
+2009-07-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27396
+        Moving cursor in Thai text sometimes jumps over two characters
+
+        Test: editing/text-iterator/thai-cursor-movement.html
+
+        * platform/text/TextBreakIteratorICU.cpp: (WebCore::cursorMovementIterator): Added a special
+        case for five Thai characters, matching ICU/CLDR changes.
+
+2009-07-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Some constructor objects exposed on Window have the wrong prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=27276
+
+        Several Constructor classes were already being passed a global object
+        during construction, but they were ignoring it for prototype lookup.
+        I've fixed those to use the passed global object instead.
+
+        Most of these Constructor classes should just be auto-generated, but I
+        refrained from changing them over to auto-gen in this patch.
+
+        Fixed CodeGeneratorJS to pass a global object to getDOMConstructor when
+        available, otherwise default to deprecatedGlobalObjectForPrototype(exec)
+        to match existing behavior.
+
+        Test: fast/dom/prototype-inheritance.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::deprecatedGlobalObjectForPrototype): Make it easy to detect where the wrong global object is being used.
+        (WebCore::deprecatedGetDOMStructure):
+        * bindings/js/JSDOMGlobalObject.h: remove error-prone getDOMConstructor, require passing JSDOMGlobalObject*
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webKitPoint): pass "this" for the global object.
+        (WebCore::JSDOMWindow::webKitCSSMatrix): pass "this" for the global object.
+        (WebCore::JSDOMWindow::xsltProcessor): pass "this" for the global object.
+        (WebCore::JSDOMWindow::worker): pass "this" for the global object.
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor): add new globalObject parameter and use it
+        * bindings/js/JSWebKitCSSMatrixConstructor.h:
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor): add new globalObject parameter and use it
+        * bindings/js/JSWebKitPointConstructor.h:
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor): add new globalObject parameter and use it
+        * bindings/js/JSWorkerConstructor.h:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor): use the existing globalObject pointer for prototype lookup
+         -- XMLHttpRequest constructor was also missing a length.  Added one.
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+        * bindings/js/JSXSLTProcessorConstructor.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-07-17  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * editing/htmlediting.cpp:
+        (WebCore::visiblePositionBeforeNode):
+        (WebCore::visiblePositionAfterNode):
+
+2009-07-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix for symbol lookup error.
+
+        Move AbstractWorker from SHARED_WORKERS to WORKERS as Worker derives from it now
+        Changed in http://trac.webkit.org/changeset/46048
+
+        * GNUmakefile.am:
+
+2009-07-17  Ryosuke Niwa  <ryosuke.niwa@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        htmlediting.cpp needs more utility functions to fix the bug 26816
+        https://bugs.webkit.org/show_bug.cgi?id=27038
+
+        In order to fix the bug 26816, we need several utility functions be added to htmlediting.cpp
+
+        No tests because functions haven't been used anywhere yet.
+
+        * dom/Range.cpp:
+        (WebCore::Range::create):
+        (WebCore::Range::comparePoint): added const qualifier
+        (WebCore::Range::compareNode): added const qualifier
+        * dom/Range.h:
+        * editing/htmlediting.cpp:
+        (WebCore::unsplittableElementForPosition): find the enclosing unsplittable element (editing root & table cell)
+        (WebCore::positionBeforeNode): added ASSERT(node)
+        (WebCore::positionAfterNode): added ASSERT(node)
+        (WebCore::visiblePositionBeforeNode):
+        (WebCore::visiblePositionAfterNode):
+        (WebCore::createRange): create a range object from two visible positions
+        (WebCore::extendRangeToWrappingNodes): extend range to include nodes that starts and ends at the boundaries
+        (WebCore::canMergeLists): typo
+        (WebCore::indexForVisiblePosition): added const qualifier
+        (WebCore::isVisiblyAdjacent): typo
+        (WebCore::isNodeVisiblyContainedWithin): determine if a node is inside a range or within the visible boundaries of the range
+        * editing/htmlediting.h:
+
+2009-07-17  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25551
+        Added support for the "required" attribute, the valueMissing flag
+        to the ValidityState object and :required/:optional CSS pseudoclasses.
+        Part of HTML5 sec. Forms specs.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#attr-input-required
+
+        Tests: fast/css/pseudo-required-optional-001.html
+               fast/css/pseudo-required-optional-002.html
+               fast/css/pseudo-required-optional-003.html
+               fast/css/pseudo-required-optional-004.html
+               fast/css/pseudo-required-optional-005.html
+               fast/css/pseudo-required-optional-006.html
+               fast/forms/ValidityState-valueMissing-001.html
+               fast/forms/ValidityState-valueMissing-002.html
+               fast/forms/ValidityState-valueMissing-003.html
+               fast/forms/ValidityState-valueMissing-004.html
+               fast/forms/ValidityState-valueMissing-005.html
+               fast/forms/ValidityState-valueMissing-006.html
+               fast/forms/ValidityState-valueMissing-007.html
+               fast/forms/ValidityState-valueMissing-008.html
+               fast/forms/ValidityState-valueMissing-009.html
+               fast/forms/required-attribute-001.html
+               fast/forms/required-attribute-002.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): pseudoRequired/pseudoOptional
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::): ditto
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ditto
+        * dom/Element.h:
+        (WebCore::Element::isOptionalFormControl): check for optional controls
+        (WebCore::Element::isRequiredFormControl): check for required controls
+        * html/HTMLAttributeNames.in: required attribute
+        * html/HTMLButtonElement.h:
+        (WebCore::HTMLButtonElement::isOptionalFormControl): ditto
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::required): requiredAttr getter
+        (WebCore::HTMLFormControlElement::setRequired): requiredAttr setter
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::valueMissing): method definition
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueMissing): validation code
+        (WebCore::HTMLInputElement::isRequiredFormControl): ditto
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::isOptionalFormControl): ditto
+        * html/HTMLInputElement.idl: required DOM attribute
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::isOptionalFormControl): ditto
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::valueMissing): validation code
+        (WebCore::HTMLTextAreaElement::isOptionalFormControl): ditto
+        (WebCore::HTMLTextAreaElement::isRequiredFormControl): ditto
+        * html/HTMLTextAreaElement.idl: required DOM attribute
+        * html/ValidityState.cpp:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::valueMissing): validation flag
+
+2009-07-17  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27390 CSS custom 
+        cursor hotspots should work in quirks mode
+        - and corresponding <rdar://problem/6554340>
+
+        Enable hotspots in quirks mode.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+        Update this manual test to reflect the fact that hotspots are now 
+        expected to work in quirks mode.
+        * manual-tests/css3-cursor-fallback-quirks.html:
+
+2009-07-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-07-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27384
+        Random crashes in appcache/update-cache.html test
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): Reorder code to avoid using a handle
+        after canceling it.
+
+2009-07-17  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Need to refactor Worker to derive from AbstractWorker
+        https://bugs.webkit.org/show_bug.cgi?id=26948
+
+        Changed Worker to derive from AbstractWorker, which involved moving
+        AbstractWorker files from being wrapped by ENABLE_SHARED_WORKERS to
+        ENABLE_WORKERS.
+
+        Removed obsolete functionality from the JS/V8 bindings that is now
+        inherited from AbstractWorker.
+
+        * WebCore.pro:
+        Moved AbstractWorker files out of SHARED_WORKERS section and into WORKERS.
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
+        * bindings/js/JSWorkerCustom.cpp:
+        Removed obsolete event listener code (now in base class)
+        (WebCore::JSWorker::mark):
+        No longer need to explicitly mark event listeners (handled by base class).
+        * bindings/v8/V8Index.h:
+        Moved AbstractWorker lines out of SHARED_WORKERS section and into WORKERS.
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
+        * bindings/v8/custom/V8CustomBinding.h:
+        Moved AbstractWorker lines out of SHARED_WORKERS section and into WORKERS.
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        Removed obsolete event listener code that now lives in the base class.
+        (WebCore::V8WorkerConstructor): Cleaned up legacy style nits.
+        * workers/AbstractWorker.cpp:
+        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
+        * workers/AbstractWorker.h:
+        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
+        * workers/Worker.cpp:
+        Removed event listener code (now in base class).
+        (WebCore::Worker::Worker): Now derives from AbstractWorker.
+        (WebCore::Worker::notifyFinished): Calls dispatchLoadErrorEvent on base class.
+        * workers/Worker.h:
+        Removed APIs that now live in the base class.
+        * workers/Worker.idl:
+        Now derives from AbstractWorker.
+        Removed APIs that live in the base class, and added a GenerateToJS flag.
+
+2009-07-17  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27379
+        Absolutely-positioned elements with a scrollbar wrap prematurely.  Make sure to include
+        the vertical scrollbar width for overflow:scroll elements.
+
+        Added fast/css/positioned-overflow-scroll.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcPrefWidths):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::calcPrefWidths):
+
+2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need a DOM_STORAGE guard in DerivedSroucesAllInOne.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27375
+
+        In https://bugs.webkit.org/show_bug.cgi?id=27360 I added Storage.cpp
+        and StorageEvent.cpp.  Unfortunately, until later this afternoon,
+        DOM_STORAGE is not turned on by default in Chromium, and so these two
+        files are never generated.  This breaks the compile.
+
+        There are no other instances of guards in the file, which puzzles me...
+        but I think adding guards is the right way to go about this.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp:  Added the guard.
+
+2009-07-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26496
+
+        Let WebCore always enforce the connection-per-host limit itself.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests):
+
+2009-07-17  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Some transitions don't work correctly on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=27356
+
+        We only have code to do component animation using valueFunction.
+        So on Leopard we always need to do matrix animation in hardware.
+        This fix ensures that. 
+
+        This is currently not testable because it appears only in the
+        hardware animation and we can't yet do pixel tests while 
+        hardware animating.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
+
+2009-07-17  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK+] Crash in screenAvailable due a null Widget*
+
+        JSDOMWindow::open called screenAvailableRect(0). The other
+        Screen methods can be called with a null widget as well, fix the
+        crashing test by checking for null.
+
+        In screenRect and screenAvailableRect it is not tried to use
+        a default screen as the existing implementation didn't try either
+        in case of not having a toplevel widget.
+
+        LayoutTests/fast/frames/crash-removed-iframe.html caused a crash.
+
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual): New method to get a visual or return zero.
+        (WebCore::screenDepth): Use getVisual.
+        (WebCore::screenDepthPerComponent): Use getVisual.
+        (WebCore::screenIsMonochrome): Use screenDepth which will do the null checking
+        (WebCore::screenRect): Check for !widget.
+        (WebCore::screenAvailableRect): Check for !widget.
+
+2009-07-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix the include path for the Symbian port
+        https://bugs.webkit.org/show_bug.cgi?id=27358
+
+        * WebCore.pro:
+
+2009-07-17  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make it possible to set the plugin directories from the DRT.
+        Part of https://bugs.webkit.org/show_bug.cgi?id=27215
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::installedPlugins): Now optionally takes
+        a populate argument, so we can avoid loading system plugins from the
+        DRT and thus avoid their strerr errors that can make tests fail.
+        (WebCore::PluginDatabase::clear): Make it possible to clear the
+        database. Called from setPluginDirectories.
+        * plugins/PluginDatabase.h:
+        (WebCore::PluginDatabase::setPluginDirectories): Make public
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        PluginViewMac: Stop the plugin when loading fails
+
+        Also, prevent event propagation when in the stopped state
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        PluginViewMac: Allow query and set of drawing and event models
+
+        We now support querying and setting of the drawing and event model,
+        but we still only support the CoreGraphics drawing model, and the
+        Carbon event model.
+
+        If unsupported drawing or event models are detected we show the
+        missing-plugin icon.
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Initialize two PluginView members using memset
+
+        m_npWindow is used on all platforms, not just for XP_UNIX,
+        so always initialize it. m_npCgContext on the other hand
+        is only used for XP_MACOSX.
+
+        * plugins/PluginView.cpp:
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add more debug logging in PluginView
+
+        * plugins/PluginView.cpp: Add debug for setValue
+        * plugins/gtk/PluginViewGtk.cpp: Add debug for getValue
+        * plugins/mac/PluginViewMac.cpp: Add debug for getValue and more
+        * plugins/qt/PluginViewQt.cpp: Add debug for getValue
+        * plugins/win/PluginViewWin.cpp: Add debug for getValue
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Use same license in PluginDebug.cpp as in the original PluginDebug.h
+
+        * plugins/PluginDebug.cpp: Use license from PluginDebug.h
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add more debugging functionality for the WebCore NPAPI layer
+
+        * GNUmakefile.am: Add PluginDebug.cpp
+        * WebCore.gypi: Add PluginDebug.cpp
+        * WebCore.pro: Add PluginDebug.cpp
+        * WebCore.vcproj/WebCore.vcproj: Add PluginDebug.cpp
+        * WebCoreSources.bkl: Add PluginDebug.cpp
+        * plugins/PluginDebug.h: Move errorStrings to PluginDebug.cpp
+        * plugins/PluginDebug.cpp: New file
+
+2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium build with DOM_STORAGE enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=27360
+
+        2 minor changes as noted below:
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Add the generated .cpp files.
+        * storage/StorageAreaImpl.cpp:  #include "DOMWindow.h"
+
+2009-07-16  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add --web-sockets flag and ENABLE_WEB_SOCKETS define.
+        https://bugs.webkit.org/show_bug.cgi?id=27206
+        
+        Add ENABLE_WEB_SOCKETS
+
+        * Configurations/FeatureDefines.xcconfig: add ENABLE_WEB_SOCKETS
+        * GNUmakefile.am: add ENABLE_WEB_SOCKETS
+        * WebCore.vcproj/WebCoreCommon.vsprops: add ENABLE_WEB_SOCKETS
+        * WebCore.vcproj/build-generated-files.sh: add ENABLE_WEB_SOCKETS
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added a third bunch of Haiku-specific files for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=26952
+
+        Adding five files, EventLoopHaiku.cpp, FileChooserHaiku.cpp,
+        FileSystemHaiku.cpp, KeyboardCodes.h and MIMETypeRegistryHaiku.cpp
+
+        * platform/haiku/EventLoopHaiku.cpp: Added.
+        (WebCore::EventLoop::cycle):
+        * platform/haiku/FileChooserHaiku.cpp: Added.
+        (WebCore::FileChooser::FileChooser):
+        (WebCore::FileChooser::basenameForWidth):
+        * platform/haiku/FileSystemHaiku.cpp: Added.
+        (WebCore::fileSystemRepresentation):
+        (WebCore::homeDirectoryPath):
+        (WebCore::openTemporaryFile):
+        (WebCore::closeFile):
+        (WebCore::writeToFile):
+        (WebCore::unloadModule):
+        (WebCore::listDirectory):
+        * platform/haiku/KeyboardCodes.h: Added.
+        * platform/haiku/MIMETypeRegistryHaiku.cpp: Added.
+        (WebCore::):
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added a second bunch of Haiku-specific files for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=26952
+
+        Adding four files, ContextMenuHaiku.cpp, ContextMenuItemHaiku.cpp,
+        DragDataHaiku.cpp and DragImageHaiku.cpp
+
+        * platform/haiku/ContextMenuHaiku.cpp: Added.
+        (WebCore::ContextMenuReceiver::ContextMenuReceiver):
+        (WebCore::ContextMenuReceiver::HandleMessage):
+        (WebCore::ContextMenuReceiver::Result):
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::~ContextMenu):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::itemCount):
+        (WebCore::ContextMenu::insertItem):
+        (WebCore::ContextMenu::platformDescription):
+        (WebCore::ContextMenu::setPlatformDescription):
+        * platform/haiku/ContextMenuItemHaiku.cpp: Added.
+        (ContextMenuItem::ContextMenuItem):
+        (ContextMenuItem::~ContextMenuItem):
+        (ContextMenuItem::releasePlatformDescription):
+        (ContextMenuItem::type):
+        (ContextMenuItem::setType):
+        (ContextMenuItem::action):
+        (ContextMenuItem::setAction):
+        (ContextMenuItem::title):
+        (ContextMenuItem::setTitle):
+        (ContextMenuItem::platformSubMenu):
+        (ContextMenuItem::setSubMenu):
+        (ContextMenuItem::setChecked):
+        (ContextMenuItem::setEnabled):
+        (ContextMenuItem::enabled):
+        * platform/haiku/DragDataHaiku.cpp: Added.
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::DragData::containsColor):
+        (WebCore::DragData::containsFiles):
+        (WebCore::DragData::asFilenames):
+        (WebCore::DragData::containsPlainText):
+        (WebCore::DragData::asPlainText):
+        (WebCore::DragData::asColor):
+        (WebCore::DragData::createClipboard):
+        (WebCore::DragData::containsCompatibleContent):
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::asFragment):
+        * platform/haiku/DragImageHaiku.cpp: Added.
+        (WebCore::dragImageSize):
+        (WebCore::deleteDragImage):
+        (WebCore::scaleDragImage):
+        (WebCore::dissolveDragImageToFraction):
+        (WebCore::createDragImageFromImage):
+        (WebCore::createDragImageIconForCachedImage):
+
+2009-07-16  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Darin Fisher and Brett Wilson.
+
+        Refactor Skia implementation of gradients and patterns.
+
+        http://bugs.webkit.org/show_bug.cgi?id=26618
+
+        The following layout tests were breaking on Chromium/Linux:
+
+        LayoutTests/svg/custom/js-late-gradient-creation.svg (bad baseline PNG)
+        LayoutTests/svg/custom/js-late-gradient-and-object.creation.svg
+        LayoutTests/svg/custom/js-late-pattern-creation.svg (bad baseline PNG)
+        LayoutTests/svg/custom/js-late-pattern-and-object-creation.svg
+
+        I could've fixed these the easy way, by copying the same 5
+        lines of code we use everywhere we need patterns or gradients, but
+        I decided to fix it the hard way:  by refactoring the code so that
+        PlatformContextSkia::setupPaintForFilling() and
+        PlatformContextSkia::setupPaintForStroking() do the right thing,
+        and also handle gradients and patterns.
+        
+        This required pushing the gradients and patterns set in 
+        (generic) GraphicsContext::setFillPattern() and friends down into
+        PlatformContextSkia.  For this, I followed the setPlatformXXX()
+        pattern used elsewhere in GraphicsContext, and stubbed them out on
+        the other platforms with #if !PLATFORM(SKIA).  This also required
+        pushing changes to the gradientSpaceTransform from the Gradient into 
+        GradientSkia.
+
+        Since it's a Skia context, I decided to cache the values as
+        SkShaders.  There were existing m_pattern and m_gradient SkShaders,
+        but they were unused, and whose use was ambiguous, so I
+        replaced them with one SkShader each for filling and stroking.
+
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::setGradientSpaceTransform):
+        (WebCore::Gradient::setPlatformGradientSpaceTransform):
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+        (WebCore::GraphicsContext::setPlatformFillGradient):
+        (WebCore::GraphicsContext::setPlatformFillPattern):
+        (WebCore::GraphicsContext::setPlatformStrokeGradient):
+        (WebCore::GraphicsContext::setPlatformStrokePattern):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::setPlatformGradientSpaceTransform):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::setPlatformFillGradient):
+        (WebCore::GraphicsContext::setPlatformFillPattern):
+        (WebCore::GraphicsContext::setPlatformStrokeGradient):
+        (WebCore::GraphicsContext::setPlatformStrokePattern):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::State::~State):
+        (PlatformContextSkia::drawRect):
+        (PlatformContextSkia::setupPaintCommon):
+        (PlatformContextSkia::setupPaintForFilling):
+        (PlatformContextSkia::setupPaintForStroking):
+        (PlatformContextSkia::setFillColor):
+        (PlatformContextSkia::setStrokeColor):
+        (PlatformContextSkia::setStrokeShader):
+        (PlatformContextSkia::setFillShader):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::skiaDrawText):
+        (WebCore::paintSkiaText):
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::SVGPaintServer::teardown):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added Haiku-specific files for WebCore/platform/image-decoders/.
+        https://bugs.webkit.org/show_bug.cgi?id=26949
+
+        Adding a new file, ImageDecoderHaiku.cpp.
+
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp: Added.
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added Haiku-specific files for WebCore/page/.
+        https://bugs.webkit.org/show_bug.cgi?id=26949
+
+        Adding three new files, DragControllerHaiku.cpp, EventHandlerHaiku.cpp
+        and FrameHaiku.cpp
+
+        * page/haiku/DragControllerHaiku.cpp: Added.
+        (WebCore::DragController::isCopyKeyDown):
+        (WebCore::DragController::dragOperation):
+        (WebCore::DragController::maxDragImageSize):
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        * page/haiku/EventHandlerHaiku.cpp: Added.
+        (WebCore::isKeyboardOptionTab):
+        (WebCore::EventHandler::invertSenseOfTabsToLinks):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::focusDocumentView):
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        (WebCore::EventHandler::eventActivatedView):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::createDraggingClipboard):
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::accessKeyModifiers):
+        * page/haiku/FrameHaiku.cpp: Added.
+        (WebCore::Frame::dragImageForSelection):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added Haiku-specific files for WebCore/editing/.
+        https://bugs.webkit.org/show_bug.cgi?id=26949
+
+        Adding one new file, EditorHaiku.cpp
+
+        * editing/haiku/EditorHaiku.cpp: Added.
+        (WebCore::Editor::newGeneralClipboard):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added Haiku-specific files for WebCore/bindings/js/.
+        https://bugs.webkit.org/show_bug.cgi?id=26949
+
+        Adding a new file, ScriptControllerHaiku.cpp
+
+        * bindings/js/ScriptControllerHaiku.cpp: Added.
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added Haiku-specific files for WebCore/platform/text/.
+        https://bugs.webkit.org/show_bug.cgi?id=26949
+
+        Adding two new files, StringHaiku.cpp
+        and TextBreakIteratorInternalICUHaiku.cpp
+
+        * platform/text/haiku/StringHaiku.cpp: Added.
+        (WebCore::String::String):
+        (WebCore::String::operator BString):
+        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp: Added.
+        (WebCore::currentTextBreakLocaleID):
+
+2009-07-16  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Sends the basename of a selected file for non-multipart form submission.
+        <https://bugs.webkit.org/show_bug.cgi?id=26505>
+
+        Test: fast/forms/get-file-upload.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::appendFormData):
+
+2009-07-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Centralize hidden property names
+        https://bugs.webkit.org/show_bug.cgi?id=27359
+
+        No behavior change.  Just moving these names to a central location.
+        I'll move the rest of our hidden property names as I sweep though the
+        bindings.
+
+        * WebCore.gypi:
+        * bindings/v8/V8HiddenPropertyName.cpp: Added.
+        (WebCore::V8HiddenPropertyName::objectPrototype):
+        (WebCore::V8HiddenPropertyName::isolatedWorld):
+        * bindings/v8/V8HiddenPropertyName.h: Added.
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::getEntered):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::getHiddenObjectPrototype):
+        (WebCore::V8Proxy::installHiddenObjectPrototype):
+
+2009-07-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION (r41238) Repainted portion of a scaled image does not line up with full image
+        https://bugs.webkit.org/show_bug.cgi?id=26747
+        rdar://problem/7009243
+
+        Test: fast/repaint/background-misaligned.html
+
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::drawTiled): Moved a variable definition closer to where
+        it is used.
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw): In the subimage code path, compute a
+        pixel-aligned source rect, because the subiamge is always pixel-aligned
+        in source space, and adjust the destination rect to preserve the
+        source -> destination mapping. Clip to the (original) destination rect
+        to prevent bleeding out.
+
+2009-07-16  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a sessionStorageEnabled setting to the settings class.
+        https://bugs.webkit.org/show_bug.cgi?id=27318
+
+        Allow LocalStorage to be enabled without enabling SessionStorage at
+        runtime.  There is a settings class setting for localStorage, but not
+        for sessionStorage.  We want to be able to test one of these features
+        without necessarily enabling the other.
+
+        SessionStorage defaults to true so as to not change behavior and
+        because there really aren't any security concerns around SessionStorage
+        (unlike LocalsStorage).  The flag is needed in Chromium only because
+        we want to enable the compile time flag in the default build, but don't
+        want it on by default until it's been thoroughly tested.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):  Check the new flag
+        (WebCore::DOMWindow::localStorage):  A bit of cleanup
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):  Default the flag to true
+        (WebCore::Settings::setSessionStorageEnabled):  Add the new flag
+        * page/Settings.h:
+        (WebCore::Settings::sessionStorageEnabled):  Get the new flag
+
+2009-07-16  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Revert 45987.  Tests did not pass on Windows.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::appendFormData):
+
+2009-07-16  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Added SHARED_WORKER flag to Windows build files, as well as associated .ccp/.h files.
+        Added missing V8 bindings to the AllInOne file
+
+        https://bugs.webkit.org/show_bug.cgi?id=27321
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Added missing files to build.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        Added missing V8 bindings (V8AbstractWorker.cpp and V8SharedWorker.cpp)
+        * DerivedSources.cpp
+        Added missing JS bindings (JSAbstractWorker.cpp and JSSharedWorker.cpp)
+
+2009-07-16  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add a getter in MessagePortChannel for the PlatformMessagePortChannel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27337
+
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::channel):
+
+2009-07-16  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix tooltip does not get its directionality from its element's directionality.
+        https://bugs.webkit.org/show_bug.cgi?id=24187
+
+        Per mitz's suggestion in comment #6, while getting the plain-text 
+        title, we also get the directionality of the title. How to handle 
+        the directionality is up to clients. Clients could ignore it, 
+        or use attribute or unicode control characters to display the title
+        as what they want.
+
+        WARNING: NO TEST CASES ADDED OR CHANGED
+
+        * WebCore.base.exp: Replace 2 names due to signature change.
+        * loader/EmptyClients.h: 
+        (WebCore::EmptyChromeClient::setToolTip): Add direction as 2nd parameter.
+        * page/Chrome.cpp:
+        (WebCore::Chrome::setToolTip): Calculate tooltip direction as well and pass it to client to take care when display tooltip.
+        * page/ChromeClient.h: Add direction as 2nd parameter to pure virtual function setToolTip().
+        * page/chromium/ChromeClientChromium.h:
+        (WebCore::ChromeClientChromium::setToolTip): Add setToolTip() 
+        temprarily to make chromium compile after pick up this webkit patch.
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::spellingToolTip): Besides getting the 
+        spelling tooltip, get its directionality as well.
+        (WebCore::HitTestResult::title): Besides getting the title, 
+        get its directionality as well.
+        * rendering/HitTestResult.h: Add 2 more methods.
+
+2009-07-16  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        [CAIRO] pattern of a canvas-element changes after modifications on canvas-element
+        https://bugs.webkit.org/show_bug.cgi?id=20578
+
+        Copy pixel image in ImageBuffer::image() just like CG and Skia glue.
+
+        Test: fast/canvas/canvas-pattern-modify.html
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (copySurface):
+        (WebCore::ImageBuffer::image):
+
+2009-07-16  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27353
+        Images mispositioned because of bug in percentage-based relative positioning.
+
+        Added fast/css/nested-floating-relative-position-percentages.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetX):
+
+2009-07-16  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Sends the basename of a selected file for non-multipart form submission.
+        <https://bugs.webkit.org/show_bug.cgi?id=26505>
+
+        Test: fast/forms/get-file-upload.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::appendFormData):
+
+2009-07-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Video size sometimes jumps just after the video starts loading
+        https://bugs.webkit.org/show_bug.cgi?id=27352
+
+        Ensure that the media player is at or after the 'HaveMetadata' state so that
+        the instrinsic size is known before we create the layer for video. This avoids
+        a flash caused by computing the video rect using the default intrinsic size, and then
+        re-computing it when that size changes.
+        
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::isReadyForRendering):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
+
+2009-07-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Antti Koivisto.
+        Patch by Brady Eidson and Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26496
+        <rdar://problem/7065391> Microsoft Outlook Web Access fails because XHR stream connection blocks script loading/revalidation
+
+        After refreshing a page and when all CachedResources on that page are in validation mode, they got an exemption
+        from the connection-per-host limit.  Removing that exemption makes the test case load smoothly after reloads.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests): Remove the resourceIsCacheValidator exemption to the connection-per-host limit.
+
+2009-07-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] V8IsolatedWorld::evaluate needs to call didCreateIsolatedScriptContext
+        https://bugs.webkit.org/show_bug.cgi?id=27335
+
+        evaluateInNewContext makes this delegate call.  evaluateInNewWorld
+        needs to make the same call.  This does not appear to be testable with
+        our current technology.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::evaluate):
+
+2009-07-15  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix a typo: application/atom=xml -> application/atom+xml.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+
+2009-07-16  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27292
+        Improve handling of <canvas> path operations on an empty path.
+        Implement Skia's Path::hasCurrentPoint().
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::lineTo):
+        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
+        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::hasCurrentPoint):
+
+2009-07-15  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Setting white-space and word-wrap via CSS in textarea doesn't override the wrap attribute
+        https://bugs.webkit.org/show_bug.cgi?id=26254
+
+        Make it so that setting white-space and word-wrap via CSS
+        overrides the wrap attribute.
+
+        This involves having the shadow div in the textarea inherit
+        the CSS from its parent instead of hard-coding it in
+        RenderTextControlMultiline.
+        
+        Committer note: Earlier I reverted this change because I did it incorrectly
+        by leaving out css/html.css. In the patch, the filename was the old name
+        css/html4.css and that led to my error.
+
+        * css/html.css:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+
+2009-07-15  James Hawkins  <jhawkins@google.com>
+
+        Reviewed by Adam Barth.
+
+        [V8] Remove a local variable that is shadowing a function parameter.
+        https://bugs.webkit.org/show_bug.cgi?id=27309
+
+        No test required as this modification does not change the current behavior.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+
+2009-07-15  Adam Langley  <agl@google.com>
+
+        No review: reverting previous change.
+
+        Revert r45959:
+
+        2009-07-15  Dumitru Daniliuc  <dumi@chromium.org>
+        Reviewed by Dimitri Glazkov.
+
+        Adding the Win SQLite VFS implementation for Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26940
+
+
+        The Chromium side of this patch was landed in 20839, but broke the build. It
+        was reverted in r20840. Thus, I'm reverting this side of the patch too.
+
+        * WebCore.gypi:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Removed.
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Removed.
+
+2009-07-15  David Levin  <levin@chromium.org>
+
+        Layout test fix, reverting previous change.
+
+        Reverting r45962 as it caused several layout test failures.
+
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+
+2009-06-08  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Setting white-space and word-wrap via CSS in textarea doesn't override the wrap attribute
+        https://bugs.webkit.org/show_bug.cgi?id=26254
+
+        Make it so that setting white-space and word-wrap via CSS
+        overrides the wrap attribute.
+
+        This involves having the shadow div in the textarea inherit
+        the CSS from its parent instead of hard-coding it in
+        RenderTextControlMultiline.
+
+        * css/html4.css:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+
+2009-07-15  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding the Win SQLite VFS implementation for Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26940
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/sql/chromium: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Added.
+
+2009-07-15  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Bug 25151 - workers that fail to load scripts not firing error event.
+        https://bugs.webkit.org/show_bug.cgi?id=25151
+
+        This fixes the problem that an error event is not fired when the worker
+        script fails to load. Some reasons this may occur are an invalid URL for
+        the worker script or a cross-origin redirect.
+
+        We also moves the code to complete the URL and check its origin from
+        Worker constructor to WorkerScriptLoader loading functions in order to
+        move the exception throwing logic out of the scope of Worker constructor.
+        Due to this change, we also remove the output ExceptionCode parameter
+        in the worker constructor. Corresponding JS/V8 binding codes have been
+        updated to reflect this change.
+
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::constructWorker):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        (WebCore::Worker::notifyFinished):
+        * workers/Worker.h:
+        (WebCore::Worker::create):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::toCrossOriginRedirectPolicy):
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
+        (WebCore::notifyLoadErrorTask):
+        (WebCore::WorkerScriptLoader::createResourceRequest):
+        (WebCore::WorkerScriptLoader::didFail):
+        (WebCore::WorkerScriptLoader::didFailRedirectCheck):
+        (WebCore::WorkerScriptLoader::didReceiveAuthenticationCancellation):
+        (WebCore::WorkerScriptLoader::notifyError):
+        * workers/WorkerScriptLoader.h:
+        (WebCore::):
+        (WebCore::WorkerScriptLoader::url):
+
+2009-07-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        text-shadow is not drawn for text with transparent colour
+        https://bugs.webkit.org/show_bug.cgi?id=21374
+
+        Test: fast/text/shadow-translucent-fill.html
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::paintTextWithShadows): If the text fill color is not opaque,
+        paint all shadows separately from the text, by casting them from
+        clipped-out opaque text.
+
+2009-07-15  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build.
+
+        * html/HTMLAreaElement.cpp:
+
+2009-07-15  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Cleanup DOM Storage dependencies.
+        https://bugs.webkit.org/show_bug.cgi?id=27180
+
+        DOM Storage had several unnecessary (and probably unintended)
+        dependencies.  This patch replaces many includes of header files with
+        forward declaration of classes, making some destructors explicit, and
+        taking some factories out of the header files.
+
+        This will allow things like StorageAreaSync to take a StorageAreaImpl*
+        (as it should) rather than a StorageArea* which previously weren't
+        possible because the dependencies were such a tangled mess.
+
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::~LocalStorageTask):
+        * storage/LocalStorageTask.h:
+        * storage/Storage.cpp:
+        (WebCore::Storage::~Storage):
+        * storage/Storage.h:
+        * storage/StorageArea.cpp:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        * storage/StorageAreaSync.h:
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::StorageEvent):
+        * storage/StorageEvent.h:
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        * storage/StorageNamespaceImpl.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        * storage/StorageSyncManager.h:
+
+2009-07-15  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Incorrect animation when trying to duplicate effect of transform-origin
+        https://bugs.webkit.org/show_bug.cgi?id=27310
+
+        The bug is that matrix animation is being used when animating
+        a list of transform functions that match in the from and to states.
+        This sometimes works. But because of the way CA does matrix animation
+        function lists like the one shown in the testcase animate incorrectly.
+
+        This fixes the bug by always doing component animation
+        as long as the function lists match. This allows CA
+        to animate the components and then recompose the result
+        into the correct matrix.
+
+        Test: animations/transform-origin-vs-functions.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
+
+2009-07-15  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        Upstream the V8NPObject and NPV8Object build changes for WebCore.gypi.
+
+        Add upstreamed V8 bindings files into WebCore.gypi so they can be seen
+        downstream
+        https://bugs.webkit.org/show_bug.cgi?id=27274
+
+        Changes the build file for chromium.  Test built the chromium tree
+        to verify.
+
+        * WebCore.gypi:
+
+2009-07-15  Mark Rowe  <mrowe@apple.com>
+
+        I like it when the code compiles.
+
+        * WebCore.base.exp:
+
+2009-07-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Renamed parseURL to deprecatedParseURL.
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::setValue): Renamed.
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::allowSettingSrcToJavascriptURL): Renamed.
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::allowSettingJavascriptURL): Renamed.
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc): Renamed.
+        * bindings/objc/DOM.mm:
+        (-[DOMElement _getURLAttribute:]): Renamed.
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLDocument _createDocumentFragmentWithMarkupString:baseURLString:]): Renamed.
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::allowSettingFrameSrcToJavascriptUrl): Renamed.
+        * css/CSSHelper.cpp:
+        (WebCore::deprecatedParseURL): Renamed.
+        * css/CSSHelper.h: Renamed and updated comment.
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::defaultEventHandler): Renamed.
+        (WebCore::HTMLAnchorElement::parseMappedAttribute): Renamed.
+        * html/HTMLBaseElement.cpp:
+        (WebCore::HTMLBaseElement::parseMappedAttribute): Renamed.
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute): Renamed.
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::parseMappedAttribute): Renamed.
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::parseMappedAttribute): Renamed.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Renamed.
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute): Renamed.
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::sourceURI): Renamed.
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseMappedAttribute): Renamed.
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute): Renamed.
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::parseMappedAttribute): Renamed.
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::parseMappedAttribute): Renamed.
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseTag): Renamed.
+        * html/PreloadScanner.cpp:
+        (WebCore::PreloadScanner::processAttribute): Renamed.
+        (WebCore::PreloadScanner::emitCSSRule): Renamed.
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::declareAndWriteDragImage): Renamed.
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage): Renamed.
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::declareAndWriteDragImage): Renamed.
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::declareAndWriteDragImage): Renamed.
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::absoluteImageURL): Renamed.
+        (WebCore::HitTestResult::absoluteMediaURL): Renamed.
+        (WebCore::HitTestResult::absoluteLinkURL): Renamed.
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::defaultEventHandler): Renamed.
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::sourceURI): Renamed.
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::defaultEventHandler): Renamed.
+        * wml/WMLImageLoader.cpp:
+        (WebCore::WMLImageLoader::sourceURI): Renamed.
+
+2009-07-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        CSSHelper.h's parseURL is a function that no one should ever call
+        Part 1: Eliminate callers in the CSS parser.
+        https://bugs.webkit.org/show_bug.cgi?id=26599
+
+        Test: fast/css/uri-token-parsing.html
+
+        * css/CSSHelper.h: Added a comment explaining why nobody should ever call this
+        function. A FIXME suggests a next step, which would be to rename it deprecatedParseURL.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Removed unneeded call to parseURL;
+        CSSParser::text already takes care of parsing the URI token syntax, and the
+        parseURL function does no good.
+        (WebCore::CSSParser::parseContent): Ditto.
+        (WebCore::CSSParser::parseFillImage): Ditto.
+        (WebCore::CSSParser::parseFontFaceSrc): Ditto.
+        (WebCore::CSSParser::parseBorderImage): Ditto.
+        (WebCore::isCSSWhitespace): Added. Helper function that makes the text function
+        easier to read.
+        (WebCore::CSSParser::text): Tweak logic so that leading and trailing whitespace
+        are both trimmed before removing the quote marks. Changed to use the
+        isCSSWhitespace, isASCIIHexDigit, and toASCIIHexValue functions for clarity.
+
+        * css/CSSParser.h: Removed stray "public:" in this header.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::substring): Optimized the case where the substring covers
+        the entire string, so we just share the StringImpl instead of making a new one.
+        This case came up in earlier versions of the CSS parser changes above.
+        (WebCore::StringImpl::substringCopy): Streamlined the logic here and made it
+        not call substring any more. Before, this was relying on the substring function
+        always making a copy of any non-empty substring.
+
+2009-07-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        After double-clicking a word, using Shift-arrow to select behaves unpredictably
+        https://bugs.webkit.org/show_bug.cgi?id=27177
+        rdar://problem/7034324
+
+        Test: editing/selection/extend-selection-after-double-click.html
+
+        The bug was due to the m_lastChangeWasHorizontalExtension flag, which was not
+        being cleared in many cases where it should have been.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection): Set m_lastChangeWasHorizontalExtension
+        to false. This catches all sorts of cases that don't flow through the modify function.
+        Before, the flag would reflect the last call to the modify function, which was not
+        necessarily the last selection change.
+        (WebCore::SelectionController::willBeModified): Rearrange function for clarity.
+        Remove code that sets m_lastChangeWasHorizontalExtension; that is now handled elsewhere. 
+        (WebCore::SelectionController::modify): Call setLastChangeWasHorizontalExtension after
+        setSelection when setting up a trial selection controller, since setSelection now
+        clears that flag. Also changed both trial selection controller cases to set the flag,
+        although it's not strictly necessary in both cases. Added code to set
+        m_lastChangeWasHorizontalExtension when extending the selection, which used to be
+        handled in willBeModified. Now we need to do it after the selection change.
+
+2009-07-15  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need to update DOM Storage files in GYPI file.
+        https://bugs.webkit.org/show_bug.cgi?id=27317
+
+        Need to update DOM Storage files in the GYPI file.  They're pretty out
+        of date and we're on the path towards enabling them for everyone!
+
+        * WebCore.gypi:
+
+2009-07-15  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26794
+        Make Yacc-generated parsers to use fastMalloc/fastFree.
+        
+        Define YYMALLOC and YYFREE to fastMalloc and fastFree
+        respectively.
+
+        * css/CSSGrammar.y:
+        * xml/XPathGrammar.y:
+
+2009-07-15  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27193
+        Don't run in to anonymous blocks.  No other browsers do this, and our implementation of run-in
+        is effectively broken as a result.
+
+        No new tests. Changed fast/runin/001.html and fast/runin/generated.html to match new behavior.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+
+2009-07-15  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Darin Adler.
+
+        Test: fast/js/instanceof-operator.html
+
+        Fix for: Bug 25205 -  XMLHttpRequest instance is not an instanceof XMLHttpRequest
+        https://bugs.webkit.org/show_bug.cgi?id=25205
+
+        In addition to for XMLHttpRequest, this also fixes for:
+        - Audio
+        - Image
+        - MessageChannel
+        - Option
+        - WebKitCSSMatrix
+        - WebKitPoint
+        - Worker
+        - XSLTProcessor
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSAudioConstructor.h:
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMConstructorObject::createStructure):
+        (WebCore::DOMConstructorObject::DOMConstructorObject):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageConstructor.h:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        * bindings/js/JSMessageChannelConstructor.h:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSOptionConstructor.h:
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        * bindings/js/JSWebKitCSSMatrixConstructor.h:
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
+        * bindings/js/JSWebKitPointConstructor.h:
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
+        * bindings/js/JSWorkerConstructor.h:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+        * bindings/js/JSXSLTProcessorConstructor.h:
+
+2009-07-15  Kai Br�ning  <kai@granus.net>
+
+        Reviewed by Dave Hyatt.
+
+        CSS21 attribute selectors not dynamic for xml.
+        https://bugs.webkit.org/show_bug.cgi?id=25072
+
+        Moved the relevant test in StyledElement::attributeChanged()
+        to a new function Element::recalcStyleIfNeededAfterAttributeChanged()
+        so it can be called from both StyledElement::attributeChanged()
+        and Element::attributeChanged().
+        Refactored Element::attributeChanged() into
+        Element::updateAfterAttributeChanged() and
+        Element::recalcStyleIfNeededAfterAttributeChanged(), which are called
+        separately from StyledElement::attributeChanged().
+
+        Test: fast/css/attribute-selector-dynamic.xml
+
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+        (WebCore::Element::updateAfterAttributeChanged):
+        (WebCore::Element::recalcStyleIfNeededAfterAttributeChanged):
+        * dom/Element.h:
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged):
+
+2009-07-15  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Layout test failures for drawImage in Canvas
+        https://bugs.webkit.org/show_bug.cgi?id=27311
+
+        Fixing several canvas layout tests failures due to a
+        missing return statement in CanvasRenderingContext2DDrawImage() which
+        was accidentally removed in r45929.
+
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+
+2009-07-15  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26969
+
+        If the httpMethod() of the request passed to SubresourceLoader::create is not
+        supported by the client we must expect to call didFail() while m_loader is still null.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (DocumentThreadableLoader::didFail):Changed.
+
+2009-07-15  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build.
+
+        * WebCore.base.exp:
+        * css/MediaQueryEvaluator.cpp:
+        * rendering/SVGRenderTreeAsText.cpp:
+        * rendering/style/SVGRenderStyle.cpp:
+        * svg/graphics/SVGPaintServer.cpp:
+
+2009-07-07  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] drawImage method of HTMLCanvasElement to accept HTMLVideoElement as argument
+        https://bugs.webkit.org/show_bug.cgi?id=27170
+
+        Changed CanvasRenderingContext2DDrawImage() to accept HTMLVideoElement
+        as a parameter of drawImage() for HTMLCanvasElement.
+
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+
+2009-07-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world constructors
+        https://bugs.webkit.org/show_bug.cgi?id=27287
+
+        Don't enter V8Proxy::m_context before creating DOM constructors.
+        Instead, use getWrapperContext to get the right context.
+
+        After this patch, all my tests pass.  I'll enable the feature
+        downstream and land the tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::evaluate):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createWrapperFromCache):
+        (WebCore::V8Proxy::isContextInitialized):
+        (WebCore::V8Proxy::disposeContextHandles):
+        (WebCore::V8Proxy::installDOMWindow):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::getHiddenObjectPrototype):
+        (WebCore::V8Proxy::installHiddenObjectPrototype):
+        * bindings/v8/V8Proxy.h:
+
+2009-07-15  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Darin Adler.
+
+        useless null-check statement in visible_units.cpp@logicalStartOfLine
+        https://bugs.webkit.org/show_bug.cgi?id=27154
+
+        Simple fix.
+
+        * editing/visible_units.cpp:
+        (WebCore::logicalStartOfLine): Doubled honorEditableBoundaryAtOrAfter() call removed.
+
+2009-07-15  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27304
+        WebKit should provide usage and eligibility information about the page cache.
+
+        * WebCore.base.exp:
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::childFrameCount):
+        * history/CachedFrame.h:
+
+        * history/PageCache.cpp:
+        (WebCore::PageCache::frameCount):
+        (WebCore::PageCache::autoreleasedPageCount):
+        * history/PageCache.h:
+        (WebCore::PageCache::pageCount):
+
+2009-07-15  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by David Levin.
+
+        Chromium's canvas forgets its context after fillText again
+        https://bugs.webkit.org/show_bug.cgi?id=27293
+
+        No new tests because the test for this was already added in
+        https://bugs.webkit.org/show_bug.cgi?id=26436
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::compositeTextComposite):
+
+2009-07-14  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27283
+
+        Implement the new 'rem' unit from CSS3.
+
+        Added some rem-* tests in fast/css.
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit):
+        (WebCore::unitFromString):
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::lex):
+        * css/CSSParserValues.cpp:
+        (WebCore::CSSParserValue::createCSSValue):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::computeLengthInt):
+        (WebCore::CSSPrimitiveValue::computeLengthIntForLength):
+        (WebCore::CSSPrimitiveValue::computeLengthShort):
+        (WebCore::CSSPrimitiveValue::computeLengthFloat):
+        (WebCore::CSSPrimitiveValue::computeLengthDouble):
+        (WebCore::CSSPrimitiveValue::cssText):
+        (WebCore::CSSPrimitiveValue::parserValue):
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::):
+        (WebCore::CSSPrimitiveValue::isUnitTypeLength):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::initForStyleResolve):
+        (WebCore::convertToLength):
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapFillSize):
+        (WebCore::CSSStyleSelector::mapFillXPosition):
+        (WebCore::CSSStyleSelector::mapFillYPosition):
+        (WebCore::CSSStyleSelector::createTransformOperations):
+        * css/CSSStyleSelector.h:
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::device_heightMediaFeatureEval):
+        (WebCore::device_widthMediaFeatureEval):
+        (WebCore::heightMediaFeatureEval):
+        (WebCore::widthMediaFeatureEval):
+        * css/WebKitCSSMatrix.cpp:
+        (WebCore::WebKitCSSMatrix::setMatrixValue):
+        * css/tokenizer.flex:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Document::usesRemUnits):
+        (WebCore::Document::setUsesRemUnits):
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeStyle):
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::cssPrimitiveToLength):
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::applyStrokeStyleToContext):
+        (WebCore::dashArrayFromRenderingStyle):
+        * svg/graphics/SVGPaintServer.h:
+
+2009-07-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Remove extraneous qualifier, accidentally added in http://trac.webkit.org/changeset/45884.
+
+        * bindings/v8/V8DOMWrapper.h: Removed extraneous qualifier.
+
+2009-07-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Update bindings for ValiditeState patch.
+        https://bugs.webkit.org/show_bug.cgi?id=19562
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-07-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Cleanup - Remove obsolete code from the make system
+        https://bugs.webkit.org/show_bug.cgi?id=27299
+
+        * WebCore.pro:
+
+2009-07-15  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix the build without media elements.
+
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::absoluteMediaURL): Add #if ENABLE(VIDEO)
+        markers around the body of the method.
+
+2009-07-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Move storeLastActivePanel out of the
+        ifdef ENABLE_JAVASCRIPT_DEBUGGER section in IDL;
+        Add default panel for the first opening of the
+        WebInspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27263
+
+        * inspector/InspectorController.cpp:
+        (InspectorController::setWindowVisible):
+        * inspector/InspectorController.idl:
+
+2009-07-14  Darin Adler  <darin@apple.com>
+
+        Try to fix Windows build.
+
+        * bindings/scripts/CodeGeneratorCOM.pm: Add Reflect and ReflectURL support.
+
+2009-07-14  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        HTMLMediaElement::supportsFullscreen() should return false
+        https://bugs.webkit.org/show_bug.cgi?id=27284
+
+        (Reverting a part of 45875)
+
+        HTMLVideoElement::supportsFullscreen() will properly do the
+        job, and check if the backend supports fullscreen.
+
+        HTMLVideoElement is the only subclass to support fullscreen
+        (conditionnaly). HTMLAudioElement fullscreen is not supported
+        and is a different kind of fullscreen, if it comes to be wanted.
+
+        No test can be done currently given that none of the media
+        backends support fullscreen.
+
+        * html/HTMLMediaElement.cpp:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::supportsFullscreen):
+
+2009-07-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Next step in making DOM attribute getter/setters consistently use AtomicString
+        https://bugs.webkit.org/show_bug.cgi?id=25425
+
+        This covers eight DOM classes, and for each one of the classes:
+
+        - Changes the IDL to use the Reflect syntax for all simple cases.
+        - Removes unused functions in the classes, mainly newly unused ones that were
+          used for reflection before.
+        - Removes unneeded explicitly defined destructors.
+        - Explicitly declares destructors as virtual.
+        - Removes unneeded includes.
+        - Makes members protected or private rather than public where possible.
+        - Renames "doc" to "document".
+        - Tweaks formatting to match our latest style in a few places.
+        - Improves some FIXME comments.
+
+        Over time we'll want to do this for all HTML DOM classes.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::HTMLAnchorElement):
+        * html/HTMLAnchorElement.h:
+        (WebCore::HTMLAnchorElement::endTagRequirement):
+        (WebCore::HTMLAnchorElement::tagPriority):
+        * html/HTMLAnchorElement.idl:
+        * html/HTMLAppletElement.cpp:
+        * html/HTMLAppletElement.h:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::parseMappedAttribute):
+        * html/HTMLAreaElement.h:
+        (WebCore::HTMLAreaElement::endTagRequirement):
+        (WebCore::HTMLAreaElement::tagPriority):
+        * html/HTMLAreaElement.idl:
+        * html/HTMLBRElement.cpp:
+        (WebCore::HTMLBRElement::parseMappedAttribute):
+        * html/HTMLBRElement.h:
+        * html/HTMLBRElement.idl:
+        * html/HTMLBaseElement.cpp:
+        (WebCore::HTMLBaseElement::HTMLBaseElement):
+        (WebCore::HTMLBaseElement::removedFromDocument):
+        (WebCore::HTMLBaseElement::process):
+        * html/HTMLBaseElement.h:
+        * html/HTMLBaseElement.idl:
+        * html/HTMLBaseFontElement.cpp:
+        (WebCore::HTMLBaseFontElement::HTMLBaseFontElement):
+        * html/HTMLBaseFontElement.h:
+        (WebCore::HTMLBaseFontElement::endTagRequirement):
+        (WebCore::HTMLBaseFontElement::tagPriority):
+        * html/HTMLBaseFontElement.idl:
+        * html/HTMLBlockquoteElement.cpp:
+        (WebCore::HTMLBlockquoteElement::HTMLBlockquoteElement):
+        * html/HTMLBlockquoteElement.h:
+        (WebCore::HTMLBlockquoteElement::tagPriority):
+        * html/HTMLBlockquoteElement.idl:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::HTMLBodyElement):
+        (WebCore::HTMLBodyElement::addSubresourceAttributeURLs):
+        * html/HTMLBodyElement.h:
+        (WebCore::HTMLBodyElement::endTagRequirement):
+        (WebCore::HTMLBodyElement::tagPriority):
+        * html/HTMLBodyElement.idl:
+        Made changes as described above.
+
+        * loader/FrameLoader.cpp: Removed unneeded include of HTMLAnchorElement.h.
+
+2009-07-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Reorganize JavaScriptCore headers into:
+        API: include/JavaScriptCore/
+        Private: include/private/JavaScriptCore/
+
+        Reviewed by Darin Adler.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Change all Noncopyable inheriting visibility to public.
+        https://bugs.webkit.org/show_bug.cgi?id=27225
+
+        Change all Noncopyable inheriting visibility to public because
+        it is needed to the custom allocation framework (bug #20422).
+
+        * bindings/js/GCController.h:
+        * bindings/js/WorkerScriptController.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::):
+        * bridge/runtime.h:
+        * css/CSSSelector.h:
+        * css/CSSSelectorList.h:
+        * css/CSSStyleSelector.h:
+        * dom/ClassNames.h:
+        * dom/MessagePortChannel.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        * dom/XMLTokenizerScope.h:
+        * editing/ReplaceSelectionCommand.cpp:
+        * editing/SelectionController.h:
+        * editing/TextIterator.cpp:
+        * history/PageCache.h:
+        * html/CanvasRenderingContext2D.h:
+        * html/HTMLParser.h:
+        * html/HTMLParserQuirks.h:
+        * html/PreloadScanner.h:
+        * loader/Cache.h:
+        * loader/CrossOriginPreflightResultCache.h:
+        * loader/FrameLoader.h:
+        * loader/ProgressTracker.h:
+        * loader/ThreadableLoader.h:
+        * loader/appcache/ApplicationCacheGroup.h:
+        * loader/archive/ArchiveResourceCollection.h:
+        * loader/icon/IconDatabase.h:
+        * loader/icon/IconLoader.h:
+        * loader/icon/PageURLRecord.h:
+        * loader/loader.h:
+        * page/ContextMenuController.h:
+        * page/EventHandler.h:
+        * page/FrameTree.h:
+        * page/Page.h:
+        * page/PageGroup.h:
+        * page/PageGroupLoadDeferrer.h:
+        * page/mac/EventHandlerMac.mm:
+        * platform/AutodrainedPool.h:
+        * platform/ContextMenu.h:
+        * platform/EventLoop.h:
+        * platform/HostWindow.h:
+        * platform/Pasteboard.h:
+        * platform/PurgeableBuffer.h:
+        * platform/RunLoopTimer.h:
+        * platform/ThreadGlobalData.h:
+        * platform/ThreadTimers.h:
+        * platform/Timer.h:
+        * platform/TreeShared.h:
+        * platform/graphics/FontData.h:
+        * platform/graphics/GlyphWidthMap.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/ImageBuffer.h:
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/skia/GraphicsContextPlatformPrivate.h:
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        * platform/mac/LocalCurrentGraphicsContext.h:
+        * platform/network/FormDataBuilder.h:
+        * platform/network/ResourceHandleInternal.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        * platform/text/StringBuffer.h:
+        * platform/text/TextCodec.h:
+        * platform/win/WindowMessageBroadcaster.h:
+        * rendering/CounterNode.h:
+        * rendering/LayoutState.h:
+        * rendering/RenderFrameSet.h:
+        * rendering/RenderView.h:
+        * rendering/TransformState.h:
+        * svg/SVGAnimatedProperty.h:
+        * svg/SynchronizableTypeWrapper.h:
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerRunLoop.cpp:
+        * xml/XPathExpressionNode.h:
+        * xml/XPathParser.h:
+        * xml/XPathPredicate.h:
+        * xml/XPathStep.h:
+
+2009-07-14  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fails to save document state when navigating away from a page with a
+        reference fragment.
+        https://bugs.webkit.org/show_bug.cgi?id=27281
+
+        Test: fast/history/saves-state-after-fragment-nav.html
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::isCurrentDocument): Use equalIgnoringRef
+        to compare URLs.
+
+2009-07-14  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Sam Weinig.
+
+        Inspector: Remove Unintended Global Variables
+        https://bugs.webkit.org/show_bug.cgi?id=27203
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.animateStyle):
+
+2009-07-14  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19562
+        Added build stuff and stub for the ValidityState class, part of HTML5
+        section Forms:
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#validitystate
+
+        Test: fast/forms/ValidityState-001.html
+
+        * DerivedSources.cpp: Inclusion of ValidityState files
+        * DerivedSources.make: ditto
+        * GNUmakefile.am: ditto
+        * WebCore.gypi: ditto
+        * WebCore.pro: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto
+        * WebCore.xcodeproj/project.pbxproj: ditto
+        * WebCoreSources.bkl: ditto
+        * html/HTMLButtonElement.idl: validity attribute
+        * html/HTMLFieldSetElement.idl: ditto
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::validity): ValidityState getter
+        * html/HTMLFormControlElement.h: ditto
+        * html/HTMLInputElement.idl: validity attribute
+        * html/HTMLSelectElement.idl: ditto
+        * html/HTMLTextAreaElement.idl: ditto
+        * html/ValidityState.cpp: Added.
+        (WebCore::ValidityState::ValidityState):
+        (WebCore::ValidityState::valid): validation flag
+        * html/ValidityState.h: Added.
+        (WebCore::ValidityState::create): validation flag
+        (WebCore::ValidityState::control): ditto
+        (WebCore::ValidityState::valueMissing): ditto
+        (WebCore::ValidityState::typeMismatch): ditto
+        (WebCore::ValidityState::patternMismatch): ditto
+        (WebCore::ValidityState::tooLong): ditto
+        (WebCore::ValidityState::rangeUnderflow): ditto
+        (WebCore::ValidityState::rangeOverflow): ditto
+        (WebCore::ValidityState::stepMismatch): ditto
+        (WebCore::ValidityState::customError): ditto
+        * html/ValidityState.idl: Added.
+
+2009-07-14  Ryosuke Niwa  <rniwa@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Outdenting a line inside a blockquote tag does nothing
+        https://bugs.webkit.org/show_bug.cgi?id=25316
+
+        The bug was caused by the code checking whether the blockquote is created by WebKit or not.
+        We simply remove this code to be consistent with Firefox and Internet Explorer.
+        Also, enclosingBlockFlow == enclosingNode in outdentParagraph isn't a sufficient condition to insert
+        the placeholder before the enclosingNode because there could be contents before the current paragraph.
+        Instead, we should split the enclosingNode (which is a blockquote) at the starting position of outdentation.
+        It turned out that this solves the bug 25315 also: https://bugs.webkit.org/show_bug.cgi?id=25315
+
+        Test: editing/execCommand/outdent-regular-blockquote.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::isIndentBlockquote): no longer checks whether a blockquote is created by WebKit or not.
+        (WebCore::IndentOutdentCommand::outdentParagraph): takes care of the case enclosingBlockFlow == enclosingNode
+
+2009-07-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world wrappers for Node prototypes
+        https://bugs.webkit.org/show_bug.cgi?id=27277
+
+        This change does two things:
+
+        1) We bypass the wrapper cache in the isolated world.  This is because
+           the wrapper template cache has prototypes that lead to the main
+           world.  We can add a template cache for the isolated world if
+           performance warrants.
+
+        2) We introduce a smarter way to grab the wrapper context for a frame
+           that is aware that proxy <-> context do not stand in one-to-one
+           correspondence.  This generalizes our solution for the node wrapper
+           case to prototypes.
+
+        The net result is that Node wrappers get the right prototypes.  As
+        before, tests to follow.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        (WebCore::V8DOMWrapper::getWrapperContext):
+        * bindings/v8/V8DOMWrapper.h:
+
+2009-07-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world wrappers for Nodes
+        https://bugs.webkit.org/show_bug.cgi?id=27271
+
+        Previously, we keepy a pointer to the DOMMap on V8Proxy, but this
+        caused us to miss the branch in V8DOMMap.cpp for isolated worlds.
+
+        I have tests, but I can't land them until I get this feature under
+        control.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::V8Proxy):
+
+2009-07-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world crash on getting window.location
+        https://bugs.webkit.org/show_bug.cgi?id=27268
+
+        I have a test for this locally, but it requires a compile-time hack to
+        run.  Once I get the feature's stability under control, we can turn the
+        feature on and add the tests.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::context):
+
+2009-07-14  Brent Fulgham  <bfulgham@webkit.org>
+
+        Correct failing tests after r45875.  The original patch did not
+        test the m_player member for null, causing crashes.  This will
+        happen fairly frequently in real use.  Was this original patch
+        ever tested?
+        https://bugs.webkit.org/show_bug.cgi?id=27246
+
+        Test via existing media tests.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::supportsFullscreen): Check for null pointer.
+        (WebCore::HTMLMediaElement::supportsSave): Check for null pointer.
+
+2009-07-14  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Explicitly mark the HTML generated for the Mac as being UTF-8 encoded.
+        The Windows clipboard format is explicitly documented as being UTF-8,
+        and all Linux apps assume UTF-8. On the Mac, though, unless otherwise
+        indicated, Windows-1252 is assumed, which is wrong.
+
+        Bug: https://bugs.webkit.org/show_bug.cgi?id=27262
+
+        No new tests.
+
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::writeRange):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeSelection):
+
+2009-07-14  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8NPObject.h and V8NPObject.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=27103
+
+        This just upstreams the files from the chromium code base. Only
+        minor changes to formatting and similar were done, so no testing
+        is required because nothing really changed.  Code verified to compile.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::bindToWindowObject):
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * bindings/v8/V8NPObject.cpp: Added.
+        (npObjectInvokeImpl):
+        (npObjectMethodHandler):
+        (npObjectInvokeDefaultHandler):
+        (weakTemplateCallback):
+        (npObjectGetProperty):
+        (npObjectNamedPropertyGetter):
+        (npObjectIndexedPropertyGetter):
+        (npObjectGetNamedProperty):
+        (npObjectGetIndexedProperty):
+        (npObjectSetProperty):
+        (npObjectNamedPropertySetter):
+        (npObjectIndexedPropertySetter):
+        (npObjectSetNamedProperty):
+        (npObjectSetIndexedProperty):
+        (weakNPObjectCallback):
+        (createV8ObjectForNPObject):
+        (forgetV8ObjectForNPObject):
+        * bindings/v8/V8NPObject.h: Added.
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+
+
+2009-07-14  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add HTMLMediaElement::supportSave() and a
+        HitTestResult::absoluteMediaURL() functions
+        https://bugs.webkit.org/show_bug.cgi?id=27246
+
+        Added an implementation of supportsSave() into HTMLMediaElement
+        that delegates to MediaPlayerPrivateImpl so that the media engine
+        is able to signal whether or not a media source supports saving.
+
+        Also added a function to HitTestResult that allows for retrieval
+        of the currentSrc associated with the "hit" media element. 
+        
+        These functions are just pipeing with no visible UI change so there
+        are no related layout test changes.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::supportsFullscreen): 
+        (WebCore::HTMLMediaElement::supportsSave):
+        * html/HTMLMediaElement.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::supportsSave):
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen):
+        (WebCore::MediaPlayerPrivateInterface::supportsSave):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::altDisplayString):
+        (WebCore::HitTestResult::absoluteMediaURL):
+        * rendering/HitTestResult.h:
+
+2009-07-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Implement Reflect and ReflectURL attribute support.
+        https://bugs.webkit.org/show_bug.cgi?id=27273
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added support for Reflect and ReflectURL attributes.
+
+2009-07-14  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27266
+        Add hasCurrentPoint() to WebCore::Path.
+        This fixes Skia-based Chromium regression caused by the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=27187.
+        For Skia, the new method always returns 'true', pending actual implementation.
+        This means Chromium still will differ from Gecko behavior, but at least its Canvas
+        will not be completely broken.
+
+        Existing Canvas Layout Tests should pass in Chromium after this change.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::lineTo): insteand of Path::isEmpty() test for hasCurrentPoint().
+        (WebCore::CanvasRenderingContext2D::quadraticCurveTo): ditto.
+        (WebCore::CanvasRenderingContext2D::bezierCurveTo): ditto.
+
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::hasCurrentPoint):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::hasCurrentPoint):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::hasCurrentPoint):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::hasCurrentPoint):
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::hasCurrentPoint):
+        All these files add a Path::hasCurrentPoint() for various platforms.
+
+2009-07-14  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Upstream RGBColor from src.chromium.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27133
+
+        * WebCore.gypi: Add RGBColor
+        * css/RGBColor.cpp: Added.
+        (WebCore::RGBColor::create):
+        (WebCore::RGBColor::red):
+        (WebCore::RGBColor::green):
+        (WebCore::RGBColor::blue):
+        * css/RGBColor.h: Added.
+        (WebCore::RGBColor::RGBColor):
+
+2009-07-10  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Rename the didCreate/DestroyScriptContext calls to make it
+        clear that that those refer to the frame's contxt.  Add another
+        similar call for when creating contexts via evaluateInNewContext.
+        https://bugs.webkit.org/show_bug.cgi?id=27104
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::disposeContextHandles):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didCreateScriptContextForFrame):
+        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContextForFrame):
+        (WebCore::EmptyFrameLoaderClient::didCreateIsolatedScriptContext):
+        * loader/FrameLoaderClient.h:
+
+2009-07-14  Brent Fulgham  <bfulgham@webkit.org>
+
+        Revert http://trac.webkit.org/changeset/45864 after
+        breaking of Windows build.
+
+        * storage/LocalStorageTask.cpp:
+        * storage/LocalStorageTask.h:
+        * storage/Storage.cpp:
+        * storage/Storage.h:
+        * storage/StorageArea.cpp:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        * storage/StorageAreaSync.h:
+        * storage/StorageEvent.cpp:
+        * storage/StorageEvent.h:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::StorageEvent):
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        * storage/StorageNamespaceImpl.h:
+        * storage/StorageSyncManager.cpp:
+        * storage/StorageSyncManager.h:
+
+2009-07-11  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Cleanup DOM Storage dependencies.
+        https://bugs.webkit.org/show_bug.cgi?id=27180
+
+        DOM Storage had several unnecessary (and probably unintended)
+        dependencies.  This patch replaces many includes of header files with
+        forward declaration of classes, making some destructors explicit, and
+        taking some factories out of the header files.
+
+        This will allow things like StorageAreaSync to take a StorageAreaImpl*
+        (as it should) rather than a StorageArea* which previously weren't
+        possible because the dependencies were such a tangled mess.
+
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::~LocalStorageTask):
+        * storage/LocalStorageTask.h:
+        * storage/Storage.cpp:
+        (WebCore::Storage::~Storage):
+        * storage/Storage.h:
+        * storage/StorageArea.cpp:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        * storage/StorageAreaSync.h:
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::StorageEvent):
+        * storage/StorageEvent.h:
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        * storage/StorageNamespaceImpl.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        * storage/StorageSyncManager.h:
+
+
+2009-07-14  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26983
+
+        Check to make sure the view is attached to a frame() in the visibleContentsResized()
+        method as it can be triggered before the view is attached by Frame::createView(...)
+        setting various values such as setScrollBarModes(...) for example.  An ASSERT is
+        triggered when a view is layout before being attached to a frame().
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::visibleContentsResized):
+        * page/FrameView.h:
+
+2009-07-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: show last opened panel when invoking inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27263
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::storeLastActivePanel):
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::Setting::Setting):
+        * inspector/InspectorController.idl:
+        * inspector/front-end/inspector.js:
+        (WebInspector.set currentPanel):
+        (WebInspector.loaded):
+
+2009-07-14  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Speed up access to NodeList length.
+        https://bugs.webkit.org/show_bug.cgi?id=27264
+
+        That's a minimal alternation of the code.
+
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER): 1) use AtomicString for comparison, 2) use
+        v8::Integer::New instead of v8::Number::New.
+
+2009-07-14  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Do not do unnecessary conversions from v8::Handle<v8::Value> to
+        v8::Handle<v8::Object> and accompanying changes.
+        https://bugs.webkit.org/show_bug.cgi?id=26953
+
+        Three things:
+
+        1) do not cast from v8::Value to v8::Object if unnecessary---casts are cheap,
+        but are not free (they check for emptiness of handle);
+        2) inline conversion from wrapper to node;
+        3) simplify case to an ASSERT.
+
+        This is just a refactoring, so no new tests are needed.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::convertToSVGPODTypeImpl):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::convertDOMWrapperToNative):
+        (WebCore::V8Proxy::convertToNativeObject):
+        (WebCore::V8Proxy::convertToNativeEvent):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::toCanvasStyle):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::V8Custom::GetTargetFrame):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Straight quotes should match fancy quotes in in-page search
+        https://bugs.webkit.org/show_bug.cgi?id=27217
+
+        Tests: fast/text/find-quotes.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::foldQuoteMark): Added.
+        (WebCore::foldQuoteMarks): Added.
+        (WebCore::SearchBuffer::SearchBuffer): Call foldQuoteMarks on the target string.
+        (WebCore::SearchBuffer::append): Call foldQuoteMarks on characters as they are
+        added to the search buffer.
+
+        * platform/text/CharacterNames.h: Added more quotation mark character names.
+        Sorted character names with the sort tool.
+
+2009-07-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: handle debugger shortcuts while on source frame or on
+        script file selector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27224
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+
+2009-07-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use standard HashCountedSet instead of a hand rolled one
+        in HTMLDocument.
+
+        * html/HTMLDocument.cpp:
+        (WebCore::addItemToMap):
+        (WebCore::removeItemFromMap):
+        * html/HTMLDocument.h:
+
+2009-07-13  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Darin Adler and Maciej Stachowiak.
+
+        Implement HTML5 draggable
+        https://bugs.webkit.org/show_bug.cgi?id=26262
+
+        This adds support for the HTML5 draggable attribute and its DOM binding. It maps the draggable property
+        to the CSS properties -webkit-user-drag and -webkit-user-select respectively.
+
+        Spec: http://www.whatwg.org/specs/web-apps/current-work/multipage/editing.html#the-draggable-attribute
+
+        Test: fast/html/draggable.html
+
+        * css/html.css:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::draggable):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::draggable):
+        (WebCore::HTMLElement::setDraggable):
+        * html/HTMLElement.h:
+        * html/HTMLElement.idl:
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::draggable):
+        * html/HTMLImageElement.h:
+
+2009-07-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Image rendered as layer contents looks different from image rendered via CG.
+        <rdar://problem/7048830> 
+        
+        Fix a visible color profile difference between between images rendered via Core Graphics
+        and those rendered via a compositing layer, by assigning the GenericRGB profile to
+        untagged images (which come through as having the DeviceRGB profile) when they are set
+        as layer contents.
+
+        Test: compositing/color-matching/image-color-matching.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+
+2009-07-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27220
+        Assertion failure in createSearcher() (usearch_open() status is U_USING_DEFAULT_WARNING)
+
+        * editing/TextIterator.cpp:
+        (WebCore::createSearcher): Add U_USING_DEFAULT_WARNING as a possible status code
+        in the assertion. Affects only the assertion.
+
+2009-07-13  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26925
+        <rdar://problem/7027850> URL Fragment Breaks Application Cache Loads
+
+        Test: http/tests/appcache/main-resource-hash.html
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::resourceForURL):
+        (WebCore::ApplicationCache::resourceForRequest):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::cacheForMainRequest):
+        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest):
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        (WebCore::ApplicationCacheGroup::didFail):
+        (WebCore::ApplicationCacheGroup::addEntry):
+        Remove URL fragment at appcache code borders.
+
+        * loader/appcache/ApplicationCacheResource.h:
+        (WebCore::ApplicationCacheResource::create):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::findOrCreateCacheGroup):
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
+        Assert that there is no URL fragment in URL at key points in appcache code.
+
+2009-07-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27166
+        rdar://problem/7015857
+        Find for strings composed entirely of spaces doesn't work
+
+        Test: fast/text/find-spaces.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::findPlainText): Removed unneeded special case.
+        The empty string case already works correctly.
+
+2009-07-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        Remove NPPVpluginPrivateModeBool, it was removed from the spec.
+        
+        * bridge/npapi.h:
+
+2009-07-13  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27237
+
+        Make V8DOMMap.h compiling with gcc option -Werror=non=virtual-dtor.  
+
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::WeakReferenceMap::WeakReferenceMap):
+        (WebCore::WeakReferenceMap::~WeakReferenceMap):
+
+2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Remove an accidental add of bidi.(cpp|h) to WebCore.gypi.
+
+        * WebCore.gypi: Removed bidi.cpp and bidi.h
+
+2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Update WebCore.gyp in preparation to hooking it up.
+
+        * WebCore.gypi: Added files that were mid-stream while switching over.
+
+2009-07-13  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, another small fix for Chromium build.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-07-13  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, fix Chromium build bustage.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::JavaScriptConsoleMessage::addToPage):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+
+2009-07-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27234
+        <rdar://problem/7054356>
+
+        Add null page check in HTMLDocument::hasFocus.
+
+        Test: fast/dom/HTMLDocument/hasFocus-frameless-crash.html
+
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::hasFocus): Add page null check.
+        (WebCore::HTMLDocument::createTokenizer): Cleanup page null check.
+
+2009-07-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Disable continuous spell checking in the inspector
+        https://bugs.webkit.org/show_bug.cgi?id=27131
+
+        * inspector/front-end/inspector.html: Added spellcheck="false" to the
+            main-panels and console-prompt containers.
+
+2009-07-13  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: fix assertion when rendering google.com.kh
+
+        https://bugs.webkit.org/show_bug.cgi?id=26924
+
+        Some shapers (i.e. Khmer) will produce cluster logs which report that
+        /no/ code points contributed to certain glyphs. Because of this, we
+        take any code point which contributed to the glyph in question, or any
+        subsequent glyph.  If we run off the end, then we take the last code
+        point.
+
+        Added LayoutTests/fast/text/international/khmar-selection.html
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::offsetForPositionForComplexText):
+
+2009-07-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        spellcheck="false" is ignored
+        <rdar://problem/7054177>
+
+        * editing/Editor.cpp:
+        (WebCore::markMisspellingsOrBadGrammar): Moved code to check the
+            spellcheck attribute from here...
+        (WebCore::Editor::spellCheckingEnabledInFocusedNode): ...to here.
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges): Bail out
+            if spell chcking is disabled by the spellcheck attribute.
+        * editing/Editor.h:
+
+2009-07-13  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add new configuration flag for redistributable Windows build.
+        https://bugs.webkit.org/show_bug.cgi=27087
+        
+        * WebCore.vcproj/WebCore.vcproj: Add new WinCairo.vsprops to
+          Debug_Cairo and Release_Cairo builds.
+        * config.h: Check for presence of WIN_CAIRO and select appropriate
+          configuration.  Defaults to standard Apple build.
+
+2009-07-13  Peter Kasting  <pkasting@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=19562
+        Back out previous patch for this bug (too many problems).
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLButtonElement.idl:
+        * html/HTMLFieldSetElement.idl:
+        * html/HTMLFormControlElement.cpp:
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::form):
+        * html/HTMLInputElement.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        * html/ValidityState.cpp: Removed.
+        * html/ValidityState.h: Removed.
+        * html/ValidityState.idl: Removed.
+
+2009-07-13  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add HTMLAllCollection to WebCore.gypi.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27223
+
+        * WebCore.gypi: Add HTMLAllCollection.
+
+2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Add a missing check for constructor call in WebKitCSSMatrixConstructor.
+        https://bugs.webkit.org/show_bug.cgi?id=27218
+
+        Test: fast/css/matrix-as-function-crash.html
+
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Added a check for constructor call.
+
+2009-07-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix.
+
+        * GNUmakefile.am:
+
+2009-07-13  Cédric Luthi  <cedric.luthi@gmail.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix NPWindow clip rect in PluginViewMac
+
+        The rect should be in window-coordinates. This bug can be observed
+        with Flash 10 here: http://www.permadi.com/tutorial/cursorTracker/
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-07-13  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix Qt implementation of WebCore::directoryName to return the absolute
+        directory name instead of the base file name.
+
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::directoryName):
+
+2009-07-13  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix WebCore::Path::isEmpty() for the Qt port to return true
+        if there is no element in the path.
+
+        QPainterPath::isEmpty() returns also true if there is one single
+        MoveTo element inside, which makes sense but doesn't patch Webcore's
+        is-empty definition.
+
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::isEmpty): Use elementCount() == 0.
+
+2009-07-13  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream fixes to NPV8Object.cpp that make ~30 layout tests pass.
+        https://bugs.webkit.org/show_bug.cgi?id=27127
+
+        There were a number of bugs introduced during the last upstreaming
+        effort that broke around 30 layout tests.  This fixes those bugs.
+        It also has compile fixes to match the recent cutting apart of
+        V8Proxy.
+
+        * bindings/v8/NPV8Object.cpp:
+        (freeV8NPObject):
+        (npCreateV8ScriptObject):
+        (NPN_Invoke):
+        (NPN_InvokeDefault):
+        (NPN_EvaluateHelper):
+        (NPN_SetException):
+        (NPN_Construct):
+
+2009-07-13  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix memory leak in the V8 binding layer. 
+        https://bugs.webkit.org/show_bug.cgi?id=27163
+
+        Reinitializing the context is not necessary when clearing the proxy for navigation
+        and it will lead us to hold on to an empty context for each frame.
+
+        Test for empty context instead of empty global object handle when
+        updating the document for a context.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::updateDocument):
+
+2009-07-13  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Correct the logic to determine if a V8 callback returns a value.
+        https://bugs.webkit.org/show_bug.cgi?id=27155
+
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::invokeCallback):
+        - Don't crash if result.IsEmpty().
+
+2009-07-13  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Add ENABLE(SHARED_WORKERS) flag and define SharedWorker APIs
+        https://bugs.webkit.org/show_bug.cgi?id=26932
+
+        Initial IDL definition and bindings for SharedWorkers.
+
+        * Configurations/FeatureDefines.xcconfig:
+        Added new files for SharedWorker support.
+        * DerivedSources.make:
+        Added new files for SharedWorker support.
+        * GNUmakefile.am:
+        Added new files for SharedWorker support.
+        * WebCore.gypi:
+        Added new files for SharedWorker support.
+        * WebCore.pro:
+        Added new files for SharedWorker support.
+        * WebCore.xcodeproj/project.pbxproj:
+        Added new files for SharedWorker support.
+        * bindings/js/JSAbstractWorkerCustom.cpp: Added.
+        (WebCore::JSAbstractWorker::mark):
+        Custom mark handler that marks the event listeners.
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        (WebCore::JSAbstractWorker::toJS):
+        Custom toJS handler which differentiates between various subclasses.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::sharedWorker):
+        SharedWorker constructor (only enabled when SHARED_WORKERS is
+        enabled).
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        Added support for converting to/from SharedWorkers.
+        * bindings/js/JSSharedWorkerConstructor.cpp: Added.
+        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
+        (WebCore::constructSharedWorker):
+        (WebCore::JSSharedWorkerConstructor::getConstructData):
+        * bindings/js/JSSharedWorkerConstructor.h: Added.
+        (WebCore::JSSharedWorkerConstructor::classInfo):
+        * bindings/js/JSSharedWorkerCustom.cpp: Added.
+        (WebCore::JSSharedWorker::mark):
+        Custom mark function that marks the internal MessagePort.
+        * bindings/v8/DOMObjectsInclude.h:
+        Updated to include new header files.
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp: Added.
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        V8 handlers for add/removeEventListener().
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        Custom constructor for SharedWorker.
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toSharedWorker):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * workers/AbstractWorker.cpp: Added.
+        (WebCore::AbstractWorker::AbstractWorker):
+        Common base class for SharedWorker and (soon) Worker. The functions below were copied from Worker.cpp.
+        This is the first step in refactoring Worker to derive from AbstractWorker to enable code sharing.
+        (WebCore::AbstractWorker::~AbstractWorker):
+        (WebCore::AbstractWorker::addEventListener):
+        (WebCore::AbstractWorker::removeEventListener):
+        (WebCore::AbstractWorker::dispatchEvent):
+        (WebCore::AbstractWorker::dispatchLoadErrorEvent):
+        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
+        * workers/AbstractWorker.h: Added.
+        Definitions of functionality shared by Worker.h and SharedWorker.h. In a future patch, Worker will derive from AbstractWorker.
+        (WebCore::AbstractWorker::scriptExecutionContext):
+        (WebCore::AbstractWorker::setOnerror):
+        (WebCore::AbstractWorker::onerror):
+        (WebCore::AbstractWorker::eventListeners):
+        (WebCore::AbstractWorker::refEventTarget):
+        (WebCore::AbstractWorker::derefEventTarget):
+        * workers/AbstractWorker.idl: Added.
+        * workers/SharedWorker.cpp: Added.
+        (WebCore::SharedWorker::SharedWorker):
+        (WebCore::SharedWorker::~SharedWorker):
+        * workers/SharedWorker.h: Added.
+        (WebCore::SharedWorker::create):
+        (WebCore::SharedWorker::port):
+        (WebCore::SharedWorker::toSharedWorker):
+        * workers/SharedWorker.idl: Added.
+
+2009-07-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Cleanup - Remove prf install target
+        https://bugs.webkit.org/show_bug.cgi?id=27191
+
+        qtwebkit.prf has been removed; this cleans up the related
+        install target as well.
+
+        * WebCore.pro: Remove prf install target
+
+2009-07-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Facebook Chat is broken due to XSS auditor
+        https://bugs.webkit.org/show_bug.cgi?id=27179
+
+        Instead of just using the script's URL as to detect an XSS attack, we
+        now use a bit of context before the URL.  In particular, we use the
+        bytes from the beginning of the attribute name to the end of the
+        attribute value.  In virtually all injection attacks, the attacker
+        would need to supply the attribute name as well as the attribute value.
+        However, in the Facebook false positive, the attribute name is not
+        present in the URL.
+
+        Tests: http/tests/security/xssAuditor/script-tag-src-redirect-safe.html
+               http/tests/security/xssAuditor/script-tag-with-source-double-quote.html
+               http/tests/security/xssAuditor/script-tag-with-source-no-quote.html
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseTag):
+        * html/HTMLTokenizer.h:
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        * page/XSSAuditor.h:
+
+2009-07-12  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Refactor ConsoleMessage to add MessageType attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=20625
+
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::printErrorMessage):
+        * dom/Document.cpp:
+        (WebCore::Document::reportException):
+        (WebCore::Document::addMessage):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::reportErrorToConsole):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::endGroup):
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        (WebCore::InspectorController::count):
+        * inspector/InspectorController.h:
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype.addMessage):
+        (WebInspector.ConsoleMessage): Added type property.
+        (WebInspector.ConsoleMessage.prototype.toMessageElement):
+        (WebInspector.ConsoleMessage.prototype.toString):
+        (WebInspector.ConsoleMessage.prototype.isEqual):
+        (WebInspector.ConsoleCommandResult):
+        (WebInspector.ConsoleGroup.prototype.addMessage):
+        (WebInspector.ConsoleGroup.prototype._titleClicked):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype._addTip):
+        (WebInspector.Resource.prototype._checkWarning):
+        * inspector/front-end/inspector.css: Changed ".console-group-title-level" to ".console-group-title"
+        * inspector/front-end/inspector.js:
+        (WebInspector.addMessageToConsole):
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::printAccessDeniedMessage):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::addMessageToConsole):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::reportLocalLoadFailed):
+        (WebCore::FrameLoader::shouldAllowNavigation):
+        * page/ChromeClient.h:
+        * page/Console.cpp:
+        (WebCore::printMessageSourceAndLevelPrefix):
+        (WebCore::Console::addMessage):
+        (WebCore::Console::error):
+        (WebCore::Console::log):
+        (WebCore::Console::dir):
+        (WebCore::Console::trace):
+        (WebCore::Console::assertCondition):
+        (WebCore::Console::timeEnd):
+        (WebCore::Console::warn):
+        * page/Console.h: Added MessageType enum.
+        (WebCore::):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::postMessageTimerFired):
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::reportWarning):
+        (WebCore::SVGDocumentExtensions::reportError):
+        * wml/WMLErrorHandling.cpp:
+        (WebCore::reportWMLError):
+        * workers/GenericWorkerTask.h: Added GenericWorkerTask8 for the extra argument.
+        (WebCore::GenericWorkerTask8::create):
+        (WebCore::GenericWorkerTask8::GenericWorkerTask8):
+        (WebCore::GenericWorkerTask8::performTask):
+        (WebCore::createCallbackTask):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::addMessage):
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerContext.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::postConsoleMessageTask):
+        (WebCore::WorkerMessagingProxy::postConsoleMessageToWorkerObject):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::reportUnsafeUsage):
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        * xml/XSLTProcessor.cpp:
+        (WebCore::XSLTProcessor::parseErrorFunc):
+
+2009-07-12  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream UndetectableHTMLCollection.idl as HTMLAllCollection.idl.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27132
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * dom/HTMLAllCollection.idl: Added.
+
+2009-07-12  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Inspector: Duplicate Computation in Autocompletion
+        https://bugs.webkit.org/show_bug.cgi?id=26778
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype._completionsReady):
+
+2009-07-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27196
+        Rename bidi.cpp to RenderBlockLineLayout.cpp and remove bidi.h
+
+        * GNUmakefile.am: Updated.
+        * WebCore.gypi: Updated.
+        * WebCore.pro: Updated.
+        * WebCore.vcproj/WebCore.vcproj: Updated.
+        * WebCore.xcodeproj/project.pbxproj: Updated.
+        * WebCoreSources.bkl: Updated.
+        * rendering/RenderBlock.h: Removed unnecessary forward declaration and
+            updated comments.
+        * rendering/RenderBlockLineLayout.cpp: Copied from WebCore/rendering/bidi.cpp.
+            Removed unnecessary #include statements.
+        (WebCore::BidiRun::BidiRun): Moved here from bidi.h.
+        (WebCore::RenderBlock::layoutInlineChildren): Removed outdated comment.
+        * rendering/bidi.cpp: Removed.
+        * rendering/bidi.h: Removed.
+
+2009-07-12  Dan Bernstein  <mitz@apple.com>
+
+        - Windows build fix
+
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged):
+
+2009-07-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - Image cleanup
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::destroyDecodedData): Use the data() accessor
+        instead of the m_data member.
+        (WebCore::BitmapImage::dataChanged): Ditto.
+        * platform/graphics/Image.h: Re-ordered #includes and class
+        declarations. Removed the drawPatternCallback() declaration. Made member
+        variables private.
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::drawPatternCallback): Changed this from a member function to a
+        static function.
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged): Use the data() accessor
+        instead of the m_data member.
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged): Ditto.
+
+2009-07-12  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27189
+        
+        Fixes insufficient check in XSSAuditor::canSetBaseElementURL that caused 
+        XSSAuditor to incorrectly block HTML Base elements whose base path coincided 
+        with the URL of the page.
+
+        Test: http/tests/security/xssAuditor/base-href-safe3.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canSetBaseElementURL): Changed conditional to only call 
+        XSSAuditor::findInRequest() if the host in the page URL disagrees with the host 
+        in the base element URL.
+
+2009-07-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Text searching with ICU should take the user's default locale into account
+        https://bugs.webkit.org/show_bug.cgi?id=27184
+        rdar://problem/6812121
+
+        No simple way to test this since it's dependent on user locale.
+        After this, the user's default locale is used only on Mac.
+
+        * editing/TextIterator.cpp:
+        (WebCore::createSearcher): Pass result of the currentSearchLocaleID
+        function as the locale.
+
+        * platform/text/TextBreakIteratorInternalICU.h: Added declaration of
+        currentSearchLocaleID function.
+
+        * platform/text/android/TextBreakIteratorInternalICU.cpp:
+        (WebCore::currentSearchLocaleID): Added. Returns the empty string.
+        * platform/text/chromium/TextBreakIteratorInternalICUChromium.cpp:
+        (WebCore::currentSearchLocaleID): Ditto.
+        * platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp:
+        (WebCore::currentSearchLocaleID): Ditto.
+
+        * platform/text/mac/TextBreakIteratorInternalICUMac.mm:
+        (WebCore::textBreakLocalePreference): Added. Returns the value of
+        the AppleTextBreakLocale preference.
+        (WebCore::topLanguagePreference): Added. Returns the value of the
+        first item in the AppleLanguages preference.
+        (WebCore::canonicalLanguageIdentifier): Added. Cover for the
+        CFLocaleCreateCanonicalLanguageIdentifierFromString function.
+        (WebCore::getLocale): Added. Transfers the locale from a CFStringRef
+        into a buffer.
+        (WebCore::getSearchLocale): Added. Calls topLanguagePreference,
+        canonicalLanguageIdentifier, and getLocale.
+        (WebCore::currentSearchLocaleID): Added. Calls getSearchLocale once.
+        (WebCore::getTextBreakLocale): Changed to call
+        textBreakLocalePreference, topLanguagePreference,
+        canonicalLanguageIdentifier, and getLocale.
+
+        * platform/text/win/TextBreakIteratorInternalICUWin.cpp:
+        (WebCore::currentSearchLocaleID): Added. Returns the empty string.
+        * platform/wx/TemporaryLinkStubs.cpp:
+        (WebCore::currentSearchLocaleID): Ditto.
+
+2009-07-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Create a PangoLayout that properly represents the visual
+        appearance of the text in the web page so that the line boundary
+        modes of getText{At,Before,After}Offset work correctly.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (UTF16ToUTF8):
+        (g_substr):
+        (convertUniCharToUTF8):
+        (getPangoLayoutForAtk):
+
+2009-07-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Bug 27187 - Match Gecko behaviour for canvas path mutation APIs on an empty path
+        <https://bugs.webkit.org/show_bug.cgi?id=27187>
+
+        Simple API change, check for the empty path and add appropriate point if necessary.
+
+        Test: fast/canvas/canvas-modify-emptyPath.html
+
+        * Info.plist:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::lineTo):
+        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
+        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
+
+2009-07-11  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        HTMLMediaElement.canPlayType "maybe" and "probably" reversed
+        https://bugs.webkit.org/show_bug.cgi?id=27186
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+            Return "probably" if type has codecs parameter.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::supportsType):
+            Ditto.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+            Ditto.
+
+2009-07-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        A worker-thread inspired follow-up for:
+        https://bugs.webkit.org/show_bug.cgi?id=26496 and <rdar://problem/7046520>
+        REGRESSION: XHR stream connection blocks iFrame loading and resource downloading
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Don't perform the XHR compensation when the XHR
+          is running on a worker thread. Accessing the global Cache data structures from a non-main thread is
+          not currently supported.
+
+2009-07-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Enable support for accelerated compositing and 3d transforms on Leopard.
+        <https://bugs.webkit.org/show_bug.cgi?id=20166>
+        <rdar://problem/6120614>
+
+        Reviewed by Oliver Hunt.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-07-11  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build after r45724.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::QtRuntimeObjectImp):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMethod::QtRuntimeMethod):
+
+2009-07-10  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26921
+
+        Implements support for HTML entities, so XSSAuditor can protect against attacks
+        encoded with HTML entities.
+
+        Tests: http/tests/security/xssAuditor/inline-event-HTML-entities.html
+               http/tests/security/xssAuditor/javascript-link-HTML-entities-control-char.html
+               http/tests/security/xssAuditor/javascript-link-HTML-entities-named.html
+               http/tests/security/xssAuditor/javascript-link-HTML-entities-null-char.html
+               http/tests/security/xssAuditor/javascript-link-HTML-entities.html
+               http/tests/security/xssAuditor/link-onclick-entities.html
+               http/tests/security/xssAuditor/script-tag-entities.html
+               http/tests/security/xssAuditor/script-tag-with-source-entities.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::decodeURL): Modified to call WebCore::XSSAuditor::decodeHTMLEntities
+        to decode HTML entities.
+        (WebCore::XSSAuditor::decodeHTMLEntities): Added method to decode HTML entities.
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-07-10  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 27007: Build fixes when ICONDATABASE is disabled
+
+        <https://bugs.webkit.org/show_bug.cgi?id=27007>
+
+        Reviewed by Sam Weinig.
+
+        * WebCore.xcodeproj/project.pbxproj: Added IconDatabaseNone.cpp
+        to the project.
+        * loader/icon/IconDatabase.cpp: Added
+        #if ENABLE(ICONDATABASE)/#endif macro guard.
+        * loader/icon/IconDatabase.h: Removed three public methods from
+        #if ENABLE(ICONDATABASE)/#endif macro so that they may be
+        stubbed out in IconDatabaseNone.cpp.
+        * loader/icon/IconDatabaseNone.cpp: Added
+        #if !ENABLE(ICONDATABASE)/#endif macro guard.
+        (WebCore::IconDatabase::importIconURLForPageURL): Added.
+        (WebCore::IconDatabase::importIconDataForIconURL): Added.
+        (WebCore::IconDatabase::shouldStopThreadActivity): Added.
+
+2009-07-10  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27151
+
+        Fixes issue where JavaScript URLs that contain null- and non-null control characters can
+        bypass XSSAuditor.
+
+        Tests: http/tests/security/xssAuditor/javascript-link-control-char.html
+               http/tests/security/xssAuditor/javascript-link-null-char.html
+               http/tests/security/xssAuditor/javascript-link.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Separated out logic for JavaScript URLs from 
+        inline scripts. For JavaScript URLs, calls XSSAuditor::canEvaluateJavaScriptURL.
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Made similar changes to evaluate() as in
+        bindings/js/ScriptController.cpp.
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL): Separated out logic for JavaScript URLs
+        into its own method.
+        * page/XSSAuditor.h:
+
+2009-07-10  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        WebKit needs a style linting tool
+        https://bugs.webkit.org/show_bug.cgi?id=25884
+
+        Fix bunch of style issues by autofix of cpplint.
+        This patch is created to demonstrate the autofix of cpplint.py.
+
+        No new testcases because it's a style fix
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseMediaQuery):
+        (WebCore::CSSParser::validUnit):
+        (WebCore::CSSParser::parseValue):
+        (WebCore::skipCommaInDashboardRegion):
+        (WebCore::CSSParser::parseDashboardRegions):
+        (WebCore::ShadowParseContext::commitValue):
+        (WebCore::ShadowParseContext::commitLength):
+        (WebCore::ShadowParseContext::commitColor):
+        (WebCore::BorderImageParseContext::commitNumber):
+        (WebCore::BorderImageParseContext::commitWidth):
+        (WebCore::BorderImageParseContext::commitRule):
+        (WebCore::BorderImageParseContext::commitBorderImage):
+        (WebCore::CSSParser::lex):
+        (WebCore::CSSParser::text):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/MediaList.cpp:
+        (WebCore::MediaList::deleteMedium):
+        * css/MediaQuery.h:
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::parseAspectRatio):
+        * css/MediaQueryEvaluator.h:
+        * css/MediaQueryExp.h:
+        (WebCore::MediaQueryExp::operator==):
+        * css/WebKitCSSMatrix.h:
+        * dom/Comment.h:
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Document.h:
+        (WebCore::Document::setHasDashboardRegions):
+        * dom/DocumentFragment.cpp:
+        (WebCore::DocumentFragment::nodeName):
+        * dom/DocumentFragment.h:
+        * dom/DynamicNodeList.h:
+        * dom/EditingText.h:
+        * dom/Element.cpp:
+        (WebCore::Element::dispatchAttrAdditionEvent):
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::item):
+        * dom/Node.cpp:
+        (WebCore::Node::nodeValue):
+        (WebCore::Node::nodeIndex):
+        * dom/NodeRareData.h:
+        (WebCore::NodeListsNodeData::create):
+        * dom/Notation.h:
+        * dom/ProcessingInstruction.h:
+        * dom/Range.cpp:
+        (WebCore::Range::processContents):
+        * dom/StyledElement.cpp:
+        (WebCore::toHex):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::PendingCallbacks::PendingStartElementNSCallback::~PendingStartElementNSCallback):
+        (WebCore::PendingCallbacks::PendingStartElementNSCallback::call):
+        (WebCore::PendingCallbacks::):
+        (WebCore::OffsetBuffer::readOutBytes):
+        (WebCore::handleElementNamespaces):
+        (WebCore::handleElementAttributes):
+        (WebCore::attributesStartElementNsHandler):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::attributesStartElementNsHandler):
+        (WebCore::XMLTokenizer::parseStartElement):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyle):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * editing/Editor.cpp:
+        (WebCore::Editor::pasteAsPlainText):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::directionOfEnclosingBlock):
+        * editing/SmartReplaceICU.cpp:
+        (WebCore::addAllCodePoints):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::icon):
+        (WebCore::HistoryItem::adoptVisitCounts):
+        * html/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyFillColor):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::setActive):
+        (WebCore::HTMLAnchorElement::isLiveLink):
+        * html/HTMLAppletElement.h:
+        * html/HTMLAudioElement.h:
+        * html/HTMLBRElement.h:
+        * html/HTMLBaseElement.h:
+        * html/HTMLBaseFontElement.h:
+        * html/HTMLDListElement.h:
+        * html/HTMLDirectoryElement.h:
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::HTMLFieldSetElement):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::reset):
+        * html/HTMLHRElement.cpp:
+        (WebCore::HTMLHRElement::parseMappedAttribute):
+        * html/HTMLHeadElement.h:
+        * html/HTMLHtmlElement.h:
+        * html/HTMLImageElement.h:
+        (WebCore::HTMLImageElement::setLoadManually):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::selection):
+        * html/HTMLIsIndexElement.h:
+        * html/HTMLMarqueeElement.cpp:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::):
+        * html/HTMLMenuElement.h:
+        * html/HTMLMetaElement.h:
+        * html/HTMLModElement.h:
+        * html/HTMLOListElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::childrenChanged):
+        * html/HTMLParamElement.h:
+        * html/HTMLQuoteElement.h:
+        * html/HTMLStyleElement.h:
+        * html/HTMLTableCaptionElement.h:
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.h:
+        * html/HTMLTableSectionElement.cpp:
+        (WebCore::HTMLTableSectionElement::deleteRow):
+        * html/HTMLTitleElement.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseNonHTMLText):
+        (WebCore::HTMLTokenizer::parseEntity):
+        (WebCore::HTMLTokenizer::parseTag):
+        (WebCore::HTMLTokenizer::write):
+        * html/HTMLUListElement.h:
+        * html/HTMLVideoElement.h:
+        * html/TimeRanges.h:
+        (WebCore::TimeRanges::Range::Range):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::enableResourceTracking):
+        (WebCore::InspectorController::disableResourceTracking):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::newInspectorJSONObject):
+        * page/Console.cpp:
+        (WebCore::Console::addMessage):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::selectCursor):
+        (WebCore::EventHandler::defaultKeyboardEventHandler):
+        * page/Frame.cpp:
+        (WebCore::Frame::jsDefaultStatusBarText):
+        * page/android/DragControllerAndroid.cpp:
+        (WebCore::DragController::dragOperation):
+        * page/android/EventHandlerAndroid.cpp:
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::eventActivatedView):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * page/gtk/DragControllerGtk.cpp:
+        (WebCore::DragController::dragOperation):
+        * page/qt/DragControllerQt.cpp:
+        * page/win/DragControllerWin.cpp:
+        (WebCore::DragController::isCopyKeyDown):
+        * page/win/FrameWin.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::mouseEventOffsetToThumb):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::setVerticalAlignLength):
+        (WebCore::InheritedFlags::setUnicodeBidi):
+        (WebCore::InheritedFlags::setCursor):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+        * rendering/style/SVGRenderStyleDefs.h:
+        * rendering/style/StyleInheritedData.h:
+        (WebCore::StyleInheritedData::operator!=):
+        * storage/DatabaseTask.h:
+        * svg/GradientAttributes.h:
+        * svg/LinearGradientAttributes.h:
+        * svg/PatternAttributes.h:
+        * svg/RadialGradientAttributes.h:
+        * svg/SVGAnimatedPathData.h:
+        * svg/SVGAnimatedPoints.h:
+        * svg/SVGAnimationElement.h:
+        * svg/SVGClipPathElement.h:
+        * svg/SVGElementInstance.h:
+        * svg/SVGFEBlendElement.cpp:
+        (WebCore::SVGFEBlendElement::build):
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::build):
+        * svg/SVGFEComponentTransferElement.cpp:
+        (WebCore::SVGFEComponentTransferElement::build):
+        * svg/SVGFECompositeElement.cpp:
+        (WebCore::SVGFECompositeElement::build):
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::build):
+        * svg/SVGFEDisplacementMapElement.cpp:
+        (WebCore::SVGFEDisplacementMapElement::build):
+        * svg/SVGFEDistantLightElement.h:
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFuncAElement.h:
+        * svg/SVGFEFuncBElement.h:
+        * svg/SVGFEFuncGElement.h:
+        * svg/SVGFEFuncRElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::build):
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::build):
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::build):
+        * svg/SVGFEOffsetElement.cpp:
+        (WebCore::SVGFEOffsetElement::build):
+        * svg/SVGFEPointLightElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::build):
+        * svg/SVGFESpotLightElement.h:
+        * svg/SVGFETileElement.cpp:
+        (WebCore::SVGFETileElement::build):
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::parseMappedAttribute):
+        * svg/SVGList.h:
+        * svg/SVGListTraits.h:
+        (WebCore::):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMetadataElement.h:
+        * svg/SVGParserUtilities.cpp:
+        (WebCore::SVGPathParser::parseSVG):
+        (WebCore::SVGPathParser::calculateArc):
+        * svg/SVGPathElement.h:
+        * svg/SVGPathSegClosePath.h:
+        * svg/SVGSVGElement.h:
+        * svg/SVGSetElement.h:
+        * svg/SVGSwitchElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::parseMappedAttribute):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGTitleElement.h:
+        * svg/SVGTransformable.cpp:
+        (WebCore::):
+        * svg/SVGViewSpec.cpp:
+        (WebCore::):
+        * svg/animation/SMILTime.cpp:
+        (WebCore::operator+):
+        (WebCore::operator-):
+        (WebCore::operator*):
+        * svg/animation/SVGSMILElement.h:
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::clientMap):
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::value):
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::value):
+        * workers/WorkerRunLoop.cpp:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection):
+        * xml/XPathPath.h:
+
+2009-07-10  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7049066>.
+        Update SnowLeopard media controller layout.
+
+        * css/mediaControlsQT.css:
+            Update for new layout.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::movieLoadType):
+            Added to replace isStreaming.
+        * html/HTMLMediaElement.h:
+            Declare movieLoadType, remove isStreaming.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlStatusDisplayElement::update):
+            Use movieLoadType instead of isStreaming.
+        (WebCore::MediaControlTimelineContainerElement::rendererIsNeeded):
+            MediaControlElement is the base class, not HTMLInputElement.
+        (WebCore::MediaControlStatusDisplayElement::rendererIsNeeded):
+            Ditto.
+        (WebCore::MediaControlRewindButtonElement::rendererIsNeeded):
+            Don't display rewind button for live streams.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::rendererIsNeeded):
+            MediaControlInputElement is the base class, not HTMLInputElement.
+        * rendering/MediaControlElements.h:
+
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::getMediaUIPartStateFlags):
+            New, return wkDrawMediaUIPart flags.
+        (WebCore::RenderThemeMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+        (WebCore::RenderThemeMac::paintMediaPlayButton):
+        (WebCore::RenderThemeMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeMac::paintMediaRewindButton):
+        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton):
+        (WebCore::RenderThemeMac::paintMediaControlsBackground):
+        (WebCore::RenderThemeMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
+            Use getMediaUIPartStateFlags.
+
+2009-07-10  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19562
+        Added build stuff and stub for the ValidityState class, part of HTML5
+        section Forms:
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#validitystate
+
+        Test: fast/forms/ValidityState-001.html
+
+        * DerivedSources.cpp: Fix aimed to include ValidityState files
+        * DerivedSources.make: ditto
+        * GNUmakefile.am: ditto
+        * WebCore.gypi: ditto
+        * WebCore.pro: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto
+        * WebCore.xcodeproj/project.pbxproj: ditto
+        * WebCoreSources.bkl: ditto
+        * html/HTMLButtonElement.idl: "validity" attribute
+        * html/HTMLFieldSetElement.idl: ditto
+        * html/HTMLFormControlElement.cpp: object getter
+        (WebCore::HTMLFormControlElement::validity):
+        * html/HTMLFormControlElement.h: ditto
+        * html/HTMLInputElement.idl: "validity" attribute
+        * html/HTMLSelectElement.idl: ditto
+        * html/HTMLTextAreaElement.idl: ditto
+        * html/ValidityState.cpp: Added.
+        (WebCore::ValidityState::ValidityState):
+        (WebCore::ValidityState::valid): validation flag
+        * html/ValidityState.h: Added.
+        (WebCore::ValidityState::create): creation routine
+        (WebCore::ValidityState::control): ValidityState's parent getter
+        (WebCore::ValidityState::valueMissing): validation flag
+        (WebCore::ValidityState::typeMismatch): ditto
+        (WebCore::ValidityState::patternMismatch): ditto
+        (WebCore::ValidityState::tooLong): ditto
+        (WebCore::ValidityState::rangeUnderflow): ditto
+        (WebCore::ValidityState::rangeOverflow): ditto
+        (WebCore::ValidityState::stepMismatch): ditto
+        (WebCore::ValidityState::customError): ditto
+        * html/ValidityState.idl: Added.
+
+2009-07-10  Brady Eidson  <beidson@apple.com>
+
+        Style cleanup over my last patch.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::~XMLHttpRequest):
+
+2009-07-10  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::dynamicGlobalObject):
+        * inspector/JavaScriptCallFrame.h: New helper method, used below.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::detach): In the special case
+        where we detach from a window currently executing JavaScript,
+        manually tear down our representation of the JavaScript
+        call stack, since we won't get any more callbacks from JavaScriptCore
+        to automatically tear it down. It's too bad that WebCore is
+        responsible for this kind of tracking -- in the future, it would
+        be nice if more of the breakpoint handling was inside of JavaScriptCore.
+
+2009-07-10  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26496 and <rdar://problem/7046520>
+        REGRESSION: XHR stream connection blocks iFrame loading and resource downloading
+
+        With this test we ended up going over the maximum-connections-per-host limit that CFNetwork expected.
+        When that happened, the first request that was over the limit ended up in a bizarre state where it 
+        wasn't fully serviced until after the long running XHR was complete.
+
+        Loader and Loader::Host work together to try to not exceed the max-connection limit but non-cache
+        resources - such as XHR - could still end up causing this limit to be exceeded.
+
+        This fix adds a workaround specifically for XHR while we hash out a more thorough solution that will
+        handle this at the resource handle level.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::nonCacheRequestInFlight):
+        (WebCore::Loader::nonCacheRequestComplete):
+        (WebCore::Loader::Host::Host):
+        (WebCore::Loader::Host::nonCacheRequestInFlight):
+        (WebCore::Loader::Host::nonCacheRequestComplete):
+        (WebCore::Loader::Host::servePendingRequests): Take nonCacheRequestsInFlight into account.
+        * loader/loader.h:
+        (WebCore::Loader::Host::processingResource): Take nonCacheRequestsInFlight into account.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::~XMLHttpRequest): 
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Bump the nonCacheRequestInFlight count.
+        (WebCore::XMLHttpRequest::didFail): Decrement that count if the Loader was notified.
+        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
+
+2009-07-10  Antti Koivisto  <antti@apple.com>
+
+        Try to unbreak non-Mac build.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::formDidFocus):
+        (WebCore::ChromeClient::formDidBlur):
+
+2009-07-10  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        The rest of the fix for <rdar://problem/7038831> REGRESSION (TOT): 
+        In Mail, a crash occurs at WebCore::Widget::afterMouseDown() after 
+        clicking To Do's close box
+
+        Make the Widget* in passMouseDownEventToWidget() a RefPtr.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+
+2009-07-10  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        rename getDOMStructure calls w/o JSGlobalObject* to deprecatedGetDOMStructure
+        https://bugs.webkit.org/show_bug.cgi?id=27157
+
+        This is the first step to fixing
+        https://bugs.webkit.org/show_bug.cgi?id=27088
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::deprecatedGetDOMStructure):
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::createDOMNodeWrapper):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection):
+        * bindings/js/JSRGBColor.cpp:
+        (WebCore::JSRGBColor::JSRGBColor):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::RuntimeArray):
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::RuntimeMethod):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp):
+
+2009-07-10  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Add delegate methods about focus and blur and state change
+        https://bugs.webkit.org/show_bug.cgi?id=27153
+
+        Call the appropriate new ChromeClient methods for focus and blur.
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::dispatchFocusEvent):
+        (WebCore::HTMLFormControlElement::dispatchBlurEvent):
+        * html/HTMLFormControlElement.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::formDidFocus):
+        (WebCore::EmptyChromeClient::formDidBlur):
+        * page/ChromeClient.h:
+
+2009-07-10  Steve Falkenburg  <sfalken@apple.com>
+
+        <rdar://problem/7048741> REGRESSION: Error about missing SwMenuX.dll opening pages with Shockwave
+        
+        Use altered search path while loading plug-ins. This modifies the DLL search order
+        to look in the directory containing the plug-in even if a call to SetDllDirectory
+        was previously made. Use of SetDllDirectory removes the current directory from the search path,
+        breaking the previous strategy for locating any dependent DLLs of the plug-in.
+        
+        Reviewed by Jon Honeycutt.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load): Use LoadLibraryEx with LOAD_WITH_ALTERED_SEARCH_PATH
+
+2009-07-10  Adam Roben  <aroben@apple.com>
+
+        Sort all our Xcode projects
+
+        Accomplished using sort-Xcode-project-file.
+
+        Requested by Dave Kilzer.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-07-10  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Chromium Linux: use disabled images for disabled widgets.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27106
+
+        Previously, checkboxes and radio controls rendered the same even if disabled.
+        The Chromium side of this change is r20224.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+
+2009-07-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fix crash when changing the zoom level in http://iphone.akamai.com/
+        <rdar://problem/7029077>
+
+        RenderLayerBacking's paintIntoLayer() method called updateLayerListsIfNeeded(),
+        which could potentially destroy that compositing layer, causing a crash.
+        Prevent this from happening by not doing a compositing update from paintIntoLayer().
+
+        The existing updateLayerListsIfNeeded() was renamed to updateCompositingAndLayerListsIfNeeded(),
+        and still does the compositing update. The new updateLayerListsIfNeeded() does not touch
+        compositing layers, and is still called from paintIntoLayer().
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::updateLayerListsIfNeeded):
+        (WebCore::RenderLayer::updateCompositingAndLayerListsIfNeeded):
+        * rendering/RenderLayer.h:
+
+2009-07-10  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Darin Adler.
+
+        Need to remove UsesManualToJSImplementation() in favor of CustomToJS.
+        https://bugs.webkit.org/show_bug.cgi?id=27010
+
+        Added support for CustomToJS IDL attribute to replace the hard-coded class list in UsesManualToJSImplementation().
+
+        This is just a cleanup of existing functionality, so existing LayoutTests adequately cover this patch.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        Removed UsesManualToJSImplementation(), added support for CustomToJS attribute.
+        * css/CSSRule.idl:
+        * css/CSSValue.idl:
+        * css/StyleSheet.idl:
+        * dom/Document.idl:
+        * dom/Event.idl:
+        * dom/Node.idl:
+        * html/ImageData.idl:
+        * svg/SVGElementInstance.idl:
+        * svg/SVGPathSeg.idl:
+        Added CustomToJS attribute to all the above IDL files.
+
+2009-07-10  Dan Bernstein  <mitz@apple.com>
+
+        - fix the build by reverting the ill-advised r45711
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToAnchor):
+
+2009-07-09  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Updated WebCore.base.exp to add some needed functions.
+
+        * WebCore.base.exp:
+
+2009-07-10  Dan Bernstein  <mitz@apple.com>
+
+        - address a review comment from Simon Fraser which I forgot to include
+          in the last check-in
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToAnchor): Pass true to getRect() for
+        maximum transform friendliness!
+
+2009-07-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=27137
+          <rdar://problem/7043124> REGRESSION (r44311): Reproducible crash due
+          to infinite recursion into FrameLoader::gotoAnchor() ->
+          FrameView::layout()
+
+        Test: fast/loader/goto-anchor-infinite-layout.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::gotoAnchor): Moved the code to update layout,
+        find the renderer to scroll to, and scroll from here to methods on
+        FrameView, and replaced it with a call to
+        FrameView::maintainScrollPositionAtAnchor().
+        (WebCore::FrameLoader::completed): Call maintainScrollPositionAtAnchor()
+        instead of setLockedToAnchor().
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView): Removed initialization of
+        m_lockedToAnchor.
+        (WebCore::FrameView::reset): Reset m_maintainScrollPositionAnchor instead
+        of m_lockedToAnchor.
+        (WebCore::FrameView::layout): Removed the code related to scrolling to
+        the anchor from here, because scrolling can trigger events which
+        invalidate the layout, and as such, belongs with the post-layout tasks.
+        (WebCore::FrameView::maintainScrollPositionAtAnchor): Added. When called
+        with a node scrolls the view to the top of that node and maintains it
+        scrolled to the top of the node during subsequent layouts, until
+        this function is called with 0 or other things trigger scrolling.
+        (WebCore::FrameView::scrollRectIntoViewRecursively): Reset
+        m_maintainScrollPositionAnchor.
+        (WebCore::FrameView::setScrollPosition): Ditto.
+        (WebCore::FrameView::scrollToAnchor): Added. Scrolls to the top of
+        m_maintainScrollPositionAnchor, if it is set.
+        (WebCore::FrameView::performPostLayoutTasks): Call scrollToAnchor().
+        (WebCore::FrameView::setWasScrolledByUser): Reset
+        m_maintainScrollPositionAnchor.
+
+        * page/FrameView.h: Removed lockedToAnchor(), setLockedToAnchor(),
+        and m_lockedToAnchor. Added maintainScrollPositionAtAnchor() and
+        m_maintainScrollPositionAnchor.
+
+2009-07-04  Sriram Yadavalli  <sriram.yadavalli@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26439
+
+        QtWebKit fails in loading www.nytimes.com in Windows/Linux
+
+        QNetworkReplyHandler is ignoring content associated with 401 error.
+        This causes the XHR response handling to fail.
+
+        Simon: Added also ProxyAuthenticationRequiredError, to handle the same
+        case when going through proxies, as suggested by Prasanth.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-07-10  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Enable HTML 5 Messaging to fix message channel Qt DRT failures in
+        fast/events.
+
+        * WebCore.pro:
+
+2009-07-09  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        added InlineBox::isLeaf()
+        firstLeafChild()/lastLeafChild() not virtual and not callable on InlineBox anymore.
+        firstLeafChild()/lastLeafChild() will no longer return a node outside of the given subtree.   
+        Removed firstLeafChildAfterBox()/lastLeafChildBeforeBox()
+        Removed potentially quadratic behavior if all nodes before/after a given box are empty InlineFlowBoxes
+
+        Currently, these methods are called on RootInlineBox objects only, so above changes should not have
+        any observable effect (only the removal of the square performance behavior could apply, 
+        but the conditions for that are probably of a rather theoretical nature).
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::nextLeafChild):
+        (WebCore::InlineBox::prevLeafChild):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::isLeaf):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::firstLeafChild):
+        (WebCore::InlineFlowBox::lastLeafChild):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::firstChild):
+        (WebCore::InlineFlowBox::lastChild):
+        (WebCore::InlineFlowBox::isLeaf):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::closestLeafChildForXPos):
+
+2009-07-09  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Added InlineBox::baselinePosition() and lineHeight() methods
+        (adapted remaining code accordingly to use those methods)
+
+        No change in functionality.
+
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::baselinePosition):
+        (WebCore::InlineBox::lineHeight):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+
+2009-07-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 27142 - canPlayType() should return empty string for unsupported content
+        <https://bugs.webkit.org/show_bug.cgi?id=27142>
+
+        Return "" instead of "no" for unsupport media types. 
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::canPlayType):
+
+2009-07-09  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement the part of HTML5 spec that deals with parsing of <rp> and <rt> tags
+        in that their end tags are optional if followed by <rp>/<rt>.
+
+        Also specify a new accessibility role "annotation" for <rp> and <rt>.
+
+        Affected code parts are not enclosed in #IF ENABLE(RUBY), since the parsing
+        is not affected by whether ruby is rendered properly or not (in fact, it may 
+        be more profound without ruby layouting, since the contents of <rp> are not hidden).
+
+        Test: fast/ruby/parse-rp.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::roleValue):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::endTagRequirement):
+        (WebCore::HTMLElement::tagPriority):
+        (WebCore::inlineTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::rpCreateErrorCheck):
+        (WebCore::HTMLParser::rtCreateErrorCheck):
+        (WebCore::HTMLParser::getNode):
+        * html/HTMLParser.h:
+        * html/HTMLTagNames.in:
+
+2009-07-09  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, fix for previous commit.
+
+        The change http://trac.webkit.org/changeset/45695 did not correctly
+        enabled GTL and QT build flags. This caused layout tests failure.
+        This is speculative fix for those failures.
+
+        * GNUmakefile.am: added ENABLE_CHANNEL_MESSAGING flag.
+        * WebCore.pro: ditto.
+        * page/DOMWindow.idl: touched to cause recompile.
+        * workers/WorkerContext.idl: ditto.
+
+2009-07-09  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26903
+
+        Turned on CHANNEL_MESSAGING by default because the MessageChannel API
+        is now implemented for Web Workers and is reasonably stable.
+
+        Tests: fast/events/message-channel-gc-2.html
+               fast/events/message-channel-gc-3.html
+               fast/events/message-channel-gc-4.html
+               fast/events/message-channel-gc.html
+               fast/events/message-channel-listener-circular-ownership.html
+               fast/events/message-port-clone.html
+               fast/events/message-port-constructor-for-deleted-document.html
+               fast/events/message-port-deleted-document.html
+               fast/events/message-port-deleted-frame.html
+               fast/events/message-port-inactive-document.html
+               fast/events/message-port-no-wrapper.html
+               fast/events/message-port.html
+               fast/workers/worker-cloneport.html
+               fast/workers/worker-messageport-gc.html
+               fast/workers/worker-messageport.html
+
+        * Configurations/FeatureDefines.xcconfig: Turned on ENABLE_CHANNEL_MESSAGING.
+        * WebCore/WebCore.vcproj/WebCoreCommon.vsprops: ditto.
+        * WebCore/WebCore.vcproj/build-generated-files.sh: ditto.
+        * WebCore/page/DOMWindow.idl: touch the file to cause re-generation of headers.
+        * WebCore/workers/WorkerContext.idl: ditto.
+
+
+2009-07-09  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Full page zoom breaks remaining and elapsed time display in the <video> controller.
+        https://bugs.webkit.org/show_bug.cgi?id=27123
+
+        We are changing the size of the time remaining and time elapsed field, to
+        automatically hide them, when the controller is too short.
+
+        Because we toggle the size between 0 and the previous value of the
+        controller, we miss any width change that may occur during full page zoom,
+        and we fail to restore a correct width.
+
+        This change fixes that problem by using a cloned style on which we
+        set the width to 0, and restoring the previous style when going back to
+        the normal width.
+
+        We take care about properly using the cloned style or the pseudo style,
+        by overriding styleForElement().
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::styleForElement):
+        (WebCore::MediaControlElement::attach):
+        (WebCore::MediaControlElement::updateStyle):
+        (WebCore::MediaControlInputElement::styleForElement):
+        (WebCore::MediaControlInputElement::attach):
+        (WebCore::MediaControlInputElement::updateStyle):
+        (WebCore::MediaControlTimeDisplayElement::MediaControlTimeDisplayElement):
+        (WebCore::MediaControlTimeDisplayElement::styleForElement):
+        (WebCore::MediaControlTimeDisplayElement::setVisible):
+        * rendering/MediaControlElements.h:
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::shouldShowTimeDisplayControls): Make sure
+        we take in account the zoom level when deciding if we should hide the 
+        ellapsed and remaining time.
+
+2009-07-09  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix chromium build bustage due to Widget being a RefCounted class.
+        https://bugs.webkit.org/show_bug.cgi?id=27139
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        * platform/chromium/PopupMenuChromium.h:
+
+2009-07-09  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27130 - Need to implement ARIA role="toolbar"
+        https://bugs.webkit.org/show_bug.cgi?id=27130
+
+        Test: platform/mac/accessibility/aria-toolbar.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-07-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Upstream WebCore.gypi, the project file for Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=27135
+
+        * WebCore.gypi: Added.
+
+2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        A more robust fix for <rdar://problem/6930280> Reproducible crash at
+        USA Today photo gallery
+
+        Reviewed by Steve Falkenburg.
+
+        * plugins/win/PluginMessageThrottlerWin.cpp:
+        (WebCore::PluginMessageThrottlerWin::messageThrottleTimerFired):
+        Protect the PluginView from destruction before calling its window proc.
+
+2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/6978804> WER #16: Repro Access Violation in
+        WebCore::PluginView::bindingInstance (1310178023)
+
+        Reviewed by Darin Adler.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::bindingInstance):
+        Protect the PluginView from destruction before calling NPN_GetValue. If
+        the renderer for the PluginView was destroyed during the call, and the
+        PluginView's ref count is now 1, return null.
+
+2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Speculative fix for <rdar://problem/6991251> WER #13: Crash in
+        WebKit!WebCore::PluginView::performRequest+203 (1311461169)
+
+        Reviewed by Darin Adler.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::performRequest):
+        Protect the PluginView from destruction before performing a load.
+        Removed some trailing whitespace.
+
+2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Build fix.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
+
+2009-07-09  Beth Dakin and Jon Honeycutt <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Make Widget RefCounted to fix or make fixable:
+
+        <rdar://problem/7038831> REGRESSION (TOT): In Mail, a crash occurs 
+        at WebCore::Widget::afterMouseDown() after clicking To Do's close 
+        box
+        <rdar://problem/6978804> WER #16: Repro Access Violation in 
+        WebCore::PluginView::bindingInstance (1310178023)
+        -and-
+        <rdar://problem/6991251> WER #13: Crash in WebKit!
+        WebCore::PluginView::performRequest+203 (1311461169) 
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::createPlugin):
+        Changed to return PassRefPtr
+        (WebCore::EmptyFrameLoaderClient::createJavaAppletWidget):
+        Ditto.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+        (WebCore::FrameLoader::loadPlugin):
+        Make the widget variable a RefPtr. Use .get() when passing it to
+        RenderPart::setWidget().
+        (WebCore::FrameLoader::createJavaAppletWidget):
+        Make the widget variable a RefPtr.
+
+        * loader/FrameLoader.h:
+        Changed the return type of createJavaAppletWidget().
+
+        * loader/FrameLoaderClient.h:
+        Change the return types of createPlugin() and 
+        createJavaAppletWidget().
+
+        * page/Frame.cpp:
+        (WebCore::Frame::createView):
+        No need to call .get() since setWidget() takes a RefPtr.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layoutIfNeededRecursive):
+        children() now returns a HashSet of RefPtrs.
+
+        * page/FrameView.h:
+        Remove inheritance from RefCounted; we pick this up from ScrollView
+        through Widget.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::addChild):
+        addChild() now takes a PassRefPtr and m_children now keeps a 
+        HashSet of RefPtrs.
+
+        * platform/ScrollView.h:
+        ScrollView constructor is now protected.
+        (WebCore::ScrollView::children):
+        m_children is now a HashSet of RefPtrs.
+
+        * platform/Scrollbar.h:
+        Remove inheritance from RefCounted; we pick this up from ScrollView
+        through Widget.
+
+        * platform/Widget.h:
+        Inherit from RefCounted. Cleaned up some whitespace. Make m_widget 
+        a RefPtr.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::create):
+        Adopt the PluginView when returning it.
+
+        * plugins/PluginView.h:
+        Changed create() to return a PassRefPtr.
+
+        * rendering/RenderApplet.cpp:
+        Receive result in a RefPtr when calling createJavaAppletWidget().
+
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::setWidget): 
+        setWidget() now takes a PassRefPtr. Also removed the manual ref of 
+        FrameViews. This is handled by having m_widget be a RefPtr. Removed 
+        deleteWidget().
+
+        * rendering/RenderPart.h:
+        Removed override of deleteWidget().
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+        (WebCore::RenderWidget::setWidget):
+        (WebCore::RenderWidget::paint):
+        (WebCore::RenderWidget::setOverlapTestResult):
+        (WebCore::RenderWidget::updateWidgetPosition):
+        Use .get().
+        (WebCore::RenderWidget::clearWidget):
+        Don't call deleteWidget(). It was removed. 
+
+        * rendering/RenderWidget.h:
+        Removed deleteWidget(). Made m_widget a RefPtr.
+        (WebCore::RenderWidget::widget):
+        Use .get().
+
+2009-07-09  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27129 - AX: possible assertion for a non-native image in accessibility
+        https://bugs.webkit.org/show_bug.cgi?id=27129 
+
+        It's possible for an image that is not really an image to assert, because its renderer
+        is turned into a RenderImage.
+
+        Test: accessibility/non-native-image-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::RoleEntry::):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-07-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix for SnowLeopard.
+        
+        Avoid using the contentsTransform methods if not on Leopard, because
+        we don't need to call them.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::updateContentsTransform):
+        * platform/graphics/mac/WebLayer.mm:
+        (-[WebLayer setNeedsDisplayInRect:]):
+        * platform/graphics/mac/WebTiledLayer.mm:
+        (-[WebTiledLayer setNeedsDisplayInRect:]):
+
+2009-07-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Improve the appearance of text in compositing layers when -[CALayer geometryFlipped]
+        is not available.
+        <rdar://problem/6120614>
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setContentsOrientation):
+        (WebCore::GraphicsLayer::contentsOrientation):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        Add a m_contentsOrientation member and getter/setter to control whether
+        the contents of this layer have a transform applied to them before display.
+
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        New method to return the default contents orientation.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::flipTransform):
+        Convenience method to return a transform with a Y flip.
+
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::setSize):
+        After the size changes we have to update the contentsTransform.
+
+        (WebCore::GraphicsLayerCA::setGeometryOrientation):
+        (WebCore::GraphicsLayerCA::geometryOrientation):
+        If -setGeometryFlipped: is not available, use a children transform.
+        
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        Tiled layers have issues with flipped contentsTransform, so just use
+        top-down drawing for them. Call updateContentsTransform() to set the
+        new contents transform after swapping layers.
+        
+        (WebCore::GraphicsLayerCA::defaultContentsOrientation):
+        Use bottom-up when -geometryFlipped is not available, otherwise top-down.
+        
+        (WebCore::GraphicsLayerCA::updateContentsTransform):
+        Set the layer contents transform based on contentsOrientation().
+
+        (WebCore::GraphicsLayerCA::setContentsLayer):
+        We have to manually flip contents layers if we're not using -geometryFlipped.
+        
+        * platform/graphics/mac/WebLayer.h:
+        * platform/graphics/mac/WebLayer.mm:
+        Do early return if layerContents is nil. Flip the CTM if the layer has
+        bottom-up coordinates, so that CG sees a CTM with no flip.
+        Do the CGContextRestoreGState() after drawing the debug indicator.
+        
+        (-[WebLayer setNeedsDisplayInRect:]):
+        * platform/graphics/mac/WebTiledLayer.mm:
+        (-[WebTiledLayer setNeedsDisplayInRect:]):
+        Need to map the dirty rect through the contentsTransform.
+
+2009-07-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6921671> Visit counter shouldn't be incremented by redirects.
+
+        Can't test this functionality with layout tests.
+
+        * WebCore.base.exp:
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::recordVisitAtTime):
+        (WebCore::HistoryItem::visited):
+        * history/HistoryItem.h:
+        Only increase visit count if explicitly told to. Now, some visits change last access time,
+        but do not increase visit count.
+
+2009-07-09  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7046098> MediaControllerThemeQT requires QuickTime 7.6.3
+
+        Require QuickTime 7.6.3 or higher to enable the new media controller UI.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme):
+
+2009-07-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Remove incorrect comment.
+
+        * page/MouseEventWithHitTestResults.h:
+
+2009-07-09  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Update the V8 bindings codegenerator to use the RGBColor::create
+        method to handle refcounts for RGBColor objects correctly.
+        
+       * bindings/scripts/CodeGeneratorV8.pm: Use RGBColor::create to create RGBColor objects.
+
+2009-07-09  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Crash in RenderMedia::styleDidChange.
+        <rdar://problem/7044313> CrashTracer: quicklook crashed generating thumbnail for page with 
+        media element (RenderMedia::styleDidChange 115)
+
+        Speculative fix for crash in styleDidChange. Null check controller elements before tell
+        them to update style.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange):
+
+2009-07-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Move V8DOMWrapper to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=27121
+
+        * bindings/v8/V8DOMWrapper.cpp: Added.
+        (WebCore::GetToStringName):
+        (WebCore::ConstructorToString):
+        (WebCore::V8DOMWrapper::convertSVGElementInstanceToV8Object):
+        (WebCore::V8DOMWrapper::convertSVGObjectWithContextToV8Object):
+        (WebCore::V8DOMWrapper::domObjectHasJSWrapper):
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
+        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMObject):
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        (WebCore::V8DOMWrapper::domWrapperType):
+        (WebCore::V8DOMWrapper::convertToNativeObjectImpl):
+        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNodeHelper):
+        (WebCore::V8DOMWrapper::wrapNativeNodeFilter):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+        (WebCore::V8DOMWrapper::maybeDOMWrapper):
+        (WebCore::V8DOMWrapper::isDOMEventWrapper):
+        (WebCore::V8DOMWrapper::isWrapperOfType):
+        (WebCore::V8DOMWrapper::htmlElementType):
+        (WebCore::V8DOMWrapper::svgElementType):
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        (WebCore::):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
+        (WebCore::V8DOMWrapper::convertDOMImplementationToV8Object):
+        (WebCore::V8DOMWrapper::convertStyleSheetToV8Object):
+        (WebCore::V8DOMWrapper::convertCSSValueToV8Object):
+        (WebCore::V8DOMWrapper::convertCSSRuleToV8Object):
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        * bindings/v8/V8DOMWrapper.h: Added.
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
+        (WebCore::V8DOMWrapper::wrapCPointer):
+        (WebCore::V8DOMWrapper::extractCPointer):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertToNativeObject):
+        (WebCore::V8DOMWrapper::convertToNativeEvent):
+        (WebCore::V8DOMWrapper::extractCPointerImpl):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+
+2009-07-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Crash in setFocusedFrame.
+        <rdar://7032869> Crashing in setFocusedFrame on blogger.com.
+
+        Speculative fix for crasher in setFocusedFrame.  Make sure to ref both frames and fire
+        the events only after the local member has been updated.
+
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setFocusedFrame):
+
+2009-07-09  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Possible crashes when mouse clicks not dispatched because range input destroyed while 
+        thumb is being dragged (e.g. scrub to end of movie)
+        <rdar://problem/7037494> 
+        https://bugs.webkit.org/show_bug.cgi?id=27101
+
+        Some shadow nodes "capture" all mouse events from mouseDown to mouseUp so they continue to 
+        get mouse events even when the mouse is moved outside of the node. This is done by putting
+        EventHandler into a mode where it sends all mouse events to the node regardless of the
+        actual mouse position. The mode is set on mouseDown and cleared on mouseUp but if the
+        node is deleted while in this mode, the mouseUp is never sent and EventHandler continues
+        to try to send events to the deleted node. This sometimes results in a crash, and sometimes
+        in a page that doesn't respond to click events.
+
+        Tests: fast/forms/search-delete-while-cancel-button-clicked.html
+               fast/forms/slider-delete-while-dragging-thumb.html
+               media/audio-delete-while-slider-thumb-clicked.html
+               media/audio-delete-while-step-button-clicked.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlSeekButtonElement::detach):
+            New, call setCapturingMouseEventsNode if capturing mouse events.
+        * rendering/MediaControlElements.h:
+            Declare detach().
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderThumbElement::detach):
+            New, call setCapturingMouseEventsNode if capturing mouse events.
+
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::SearchFieldCancelButtonElement::detach):
+            New, call setCapturingMouseEventsNode if capturing mouse events.
+        * rendering/TextControlInnerElements.h:
+            Declare detach().
+
+2009-07-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Enter the Frame's context before creating new objects in setContextDebugId.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27112
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setContextDebugId):
+
+2009-07-09  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build.
+
+        * WebCore.pro: Add new storage impl files to the build.
+
+2009-07-08  Adam Barth  <abarth@webkit.org>
+
+        Rubber stamped by Eric Seidel.
+
+        [V8] Move DOM wrapper functions in V8Proxy to V8DOMWrapper
+        https://bugs.webkit.org/show_bug.cgi?id=27107
+
+        This patch is just renaming.  Code motion will occur next.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::createScriptObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::getReceiverObject):
+        * bindings/v8/V8Collection.cpp:
+        (WebCore::toOptionsCollectionSetter):
+        * bindings/v8/V8Collection.h:
+        (WebCore::getV8Object):
+        (WebCore::getNamedPropertyOfCollection):
+        (WebCore::nodeCollectionNamedPropertyGetter):
+        (WebCore::getIndexedPropertyOfCollection):
+        (WebCore::nodeCollectionIndexedPropertyGetter):
+        (WebCore::nodeCollectionIndexedPropertyEnumerator):
+        (WebCore::collectionIndexedPropertyEnumerator):
+        (WebCore::collectionStringOrNullIndexedPropertyGetter):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::DOMData::handleWeakObject):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::enumerateDOMObjectMap):
+        (WebCore::DOMObjectVisitor::visitDOMWrapper):
+        (WebCore::GCPrologueVisitor::visitDOMWrapper):
+        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
+        * bindings/v8/V8Helpers.cpp:
+        (WebCore::wrapNPObject):
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::acceptNode):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8DOMWrapper::convertSVGElementInstanceToV8Object):
+        (WebCore::V8DOMWrapper::convertSVGObjectWithContextToV8Object):
+        (WebCore::V8DOMWrapper::domObjectHasJSWrapper):
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
+        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMObject):
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::getConstructor):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8Proxy::retrieveWindow):
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::installDOMWindow):
+        (WebCore::setDOMExceptionHelper):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        (WebCore::V8DOMWrapper::domWrapperType):
+        (WebCore::V8DOMWrapper::convertToNativeObjectImpl):
+        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNodeHelper):
+        (WebCore::V8DOMWrapper::wrapNativeNodeFilter):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+        (WebCore::V8DOMWrapper::maybeDOMWrapper):
+        (WebCore::V8DOMWrapper::isDOMEventWrapper):
+        (WebCore::V8DOMWrapper::isWrapperOfType):
+        (WebCore::V8DOMWrapper::htmlElementType):
+        (WebCore::V8DOMWrapper::svgElementType):
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
+        (WebCore::V8DOMWrapper::convertDOMImplementationToV8Object):
+        (WebCore::V8DOMWrapper::convertStyleSheetToV8Object):
+        (WebCore::V8DOMWrapper::convertCSSValueToV8Object):
+        (WebCore::V8DOMWrapper::convertCSSRuleToV8Object):
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        (WebCore::V8Proxy::bindJsObjectToWindow):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
+        (WebCore::V8DOMWrapper::wrapCPointer):
+        (WebCore::V8DOMWrapper::extractCPointer):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertToNativeObject):
+        (WebCore::V8DOMWrapper::convertToNativeEvent):
+        (WebCore::V8DOMWrapper::extractCPointerImpl):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8Proxy::constructDOMObject):
+        (WebCore::toV8):
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        (WebCore::V8SVGPODTypeUtil::toSVGPODType):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::GetConstructor):
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::toCanvasStyle):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ClientRectListCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::V8Custom::GetTargetFrame):
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
+        (WebCore::V8CustomSQLStatementCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
+        (WebCore::V8CustomSQLTransactionCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8EventCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
+        (WebCore::storageGetter):
+        (WebCore::storageSetter):
+        (WebCore::storageDeleter):
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::SetTimeoutOrInterval):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Make sure we can click outside the slider thumb and start dragging.
+        https://bugs.webkit.org/show_bug.cgi?id=26229
+
+        Previously we were assuming that if the thumb hasn't been clicked, we
+        wouldn't issue any value change upon dragging.
+
+        We need to handle the two different cases:
+        - Clicked in the thumb, we need to make sure the cursor is always pointing
+        the same slider thumb point.
+        - Clicked outside, the cursor should always be pointing to the center of
+        the thumb.
+
+        For simplicity, we don't remember the original point of the mouse down,
+        but a vector between that point and the thumb.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderThumbElement::SliderThumbElement):
+        (WebCore::SliderThumbElement::defaultEventHandler):
+        (WebCore::RenderSlider::mouseEventVectorToThumb): Utility function.
+        * rendering/RenderSlider.h:
+
+2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27100
+        <rdar://problem/7042621>
+
+        Don't display "loading" in the <video> controller when
+        there is no src specified.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlStatusDisplayElement::update): The only
+        way to find out if we have an element is currentSrc(). networkState()
+        will always report LOADING according to the spec.
+
+2009-07-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Move V8GCController functions to their own file
+        https://bugs.webkit.org/show_bug.cgi?id=27102
+
+        * bindings/v8/V8GCController.cpp: Added.
+        * bindings/v8/V8GCController.h: Added.
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+
+2009-07-08  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Split StorageArea and StorageNamespace into an interface and implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=27072
+
+        I need to split StorageNamespace and StorageArea into an interface and
+        implementation.  In a later patch, I'll implement a proxy interface
+        that'll run inside the Chromium renderer process.
+
+        Additionally, fix the alphabetical ordering of files I recently added
+        in the project files.
+
+        This is a continuation of other refactoring work:
+        https://bugs.webkit.org/show_bug.cgi?id=25376
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::create):
+        * storage/StorageArea.h:
+        (WebCore::StorageArea::~StorageArea):
+        * storage/StorageAreaImpl.cpp: Copied from WebCore/storage/StorageArea.cpp.
+        (WebCore::StorageAreaImpl::create):
+        (WebCore::StorageAreaImpl::~StorageAreaImpl):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        (WebCore::StorageAreaImpl::copy):
+        (WebCore::StorageAreaImpl::length):
+        (WebCore::StorageAreaImpl::key):
+        (WebCore::StorageAreaImpl::getItem):
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        (WebCore::StorageAreaImpl::contains):
+        (WebCore::StorageAreaImpl::importItem):
+        (WebCore::StorageAreaImpl::securityOrigin):
+        (WebCore::StorageAreaImpl::close):
+        (WebCore::StorageAreaImpl::blockUntilImportComplete):
+        (WebCore::StorageAreaImpl::dispatchStorageEvent):
+        * storage/StorageAreaImpl.h: Copied from WebCore/storage/StorageArea.h.
+        * storage/StorageAreaSync.h:
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::localStorageNamespace):
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        * storage/StorageNamespace.h:
+        (WebCore::StorageNamespace::~StorageNamespace):
+        * storage/StorageNamespaceImpl.cpp: Copied from WebCore/storage/StorageNamespace.cpp.
+        (WebCore::StorageNamespaceImpl::localStorageNamespace):
+        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::~StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::storageArea):
+        (WebCore::StorageNamespaceImpl::close):
+        * storage/StorageNamespaceImpl.h: Copied from WebCore/storage/StorageNamespace.h.
+
+2009-07-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Move garbage collector related functions from V8Proxy to V8GCController
+        https://bugs.webkit.org/show_bug.cgi?id=26967
+
+        This patch just moves the functions around in V8Proxy.  We'll actually
+        move them to a separate file in another patch.
+
+        * bindings/v8/NPV8Object.cpp:
+        (freeV8NPObject):
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::~ScheduledAction):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::gcProtectJSWrapper):
+        (WebCore::ScriptController::gcUnprotectJSWrapper):
+        * bindings/v8/ScriptInstance.cpp:
+        (WebCore::V8ScriptInstance::clear):
+        (WebCore::V8ScriptInstance::set):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::operator=):
+        (WebCore::ScriptValue::clear):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::~V8LazyEventListener):
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
+        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8GCController::registerGlobalHandle):
+        (WebCore::V8GCController::unregisterGlobalHandle):
+        (WebCore::V8GCController::gcProtect):
+        (WebCore::V8GCController::gcUnprotect):
+        (WebCore::V8Proxy::destroyGlobal):
+        (WebCore::V8Proxy::updateDocumentWrapper):
+        (WebCore::V8Proxy::clearDocumentWrapper):
+        (WebCore::V8Proxy::disposeContextHandles):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::):
+        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+
+2009-07-08  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26918
+        
+        Prevents injection of HTML Base tag.
+
+        Tests: http/tests/security/xssAuditor/base-href-control-char.html
+               http/tests/security/xssAuditor/base-href-null-char.html
+               http/tests/security/xssAuditor/base-href-safe.html
+               http/tests/security/xssAuditor/base-href-safe2.html
+               http/tests/security/xssAuditor/base-href-scheme-relative.html
+               http/tests/security/xssAuditor/base-href.html
+
+        * html/HTMLBaseElement.cpp:
+        (WebCore::HTMLBaseElement::parseMappedAttribute):
+        (WebCore::HTMLBaseElement::process): Modified to call XSSAuditor::canSetBaseElementURL
+        to determine if it is safe to use base element URL.
+        * html/HTMLBaseElement.h: Added field m_hrefAttrValue to store unparsed base element URL.
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        * page/XSSAuditor.h:
+
+2009-07-08  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8 npruntime bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27094
+
+        * bindings/v8/npruntime.cpp: Upstreamed from src.chromium.org.
+        (StringKey::operator==):
+        (StringKey::StringKeyHash::hash):
+        (StringKey::StringKeyHash::equal):
+        (StringKeyHashTraits::constructDeletedValue):
+        (StringKeyHashTraits::isDeletedValue):
+        (getStringIdentifierMap):
+        (getIntIdentifierMap):
+        * bindings/v8/npruntime_impl.h: Upstreamed from src.chromium.org.
+        * bindings/v8/npruntime_internal.h: Upstreamed from src.chromium.org.
+        * bindings/v8/npruntime_priv.h: Upstreamed from src.chromium.org.
+
+2009-07-08  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Extending the PlatformFileHandle definition from PLATFORM(WIN) to
+        PLATFORM(WIN_OS)
+
+        https://bugs.webkit.org/show_bug.cgi?id=27013
+
+        * platform/FileSystem.h:
+
+2009-07-08  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27071
+        
+        Resolves issue when HTTP parameters contain null- and  non-null-control- characters.
+
+        Tests: http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event-null-char.html
+               http/tests/security/xssAuditor/embed-tag-control-char.html
+               http/tests/security/xssAuditor/embed-tag-null-char.html
+               http/tests/security/xssAuditor/embed-tag.html
+               http/tests/security/xssAuditor/link-onclick-control-char.html
+               http/tests/security/xssAuditor/link-onclick-null-char.html
+               http/tests/security/xssAuditor/object-embed-tag-control-char.html
+               http/tests/security/xssAuditor/object-embed-tag-null-char.html
+               http/tests/security/xssAuditor/object-embed-tag.html
+               http/tests/security/xssAuditor/object-tag.html
+               http/tests/security/xssAuditor/script-tag-post-control-char.html
+               http/tests/security/xssAuditor/script-tag-post-null-char.html
+               http/tests/security/xssAuditor/script-tag-with-source-control-char.html
+               http/tests/security/xssAuditor/script-tag-with-source-null-char.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isNonNullControlCharacter): Called by XSSAuditor::decodeURL.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::decodeURL): Added parameters matchNullCharacters,
+        and matchNonNullControlCharacters.
+        (WebCore::XSSAuditor::findInRequest): Added parameters matchNullCharacters,
+        and matchNonNullControlCharacters.
+        * page/XSSAuditor.h:
+
+2009-07-08  Marc-Antoine Ruel  <maruel@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add DerivesSourcesAllInOne.cpp to help with release windows compilation.
+        https://bugs.webkit.org/show_bug.cgi?id=27093
+
+        This is specific for v8, no change in behavior.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Added.
+
+2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27086
+
+        Make sure the Media controller doesn't fade in for no reason.
+        This is happening because a update() call to the controller
+        panel may reset the opacity to 1.0, given that it reloads the
+        style.
+
+        We also add a different fade in and fade out time to soften
+        the fade out effect.
+
+        No test case because this depends on how the movie is loaded.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::RenderMedia):
+        (WebCore::RenderMedia::updateControls):
+        (WebCore::RenderMedia::updateControlVisibility): Simplify
+        , and make sure we stop the timer if there is no animation
+        to do.
+        (WebCore::RenderMedia::opacityAnimationTimerFired): 
+        * rendering/RenderMedia.h:
+
+2009-07-08  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 27081: Wrap RunLoopTimerCF.cpp in PLATFORM(MAC) && HAVE(RUNLOOP_TIMER)
+
+        <https://bugs.webkit.org/show_bug.cgi?id=27081>
+
+        Reviewed by Timothy Hatcher.
+
+        * platform/cf/RunLoopTimerCF.cpp: This code is only used on
+        Mac OS X when HAVE(RUNLOOP_TIMER) is enabled, so wrap the code
+        in that macro as well.
+
+2009-07-08  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add -[WebView _isProcessingUserGesture]
+        https://bugs.webkit.org/show_bug.cgi?id=27084
+
+        Rename FrameLoader::userGestureHint() to FrameLoader::isProcessingUserGesture()
+        for clarity.
+
+        * WebCore.base.exp: Add WebCore::FrameLoader::isProcessingUserGesture()
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::processingUserGesture):
+        * loader/FrameLoader.cpp: 
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::isProcessingUserGesture):
+        * loader/FrameLoader.h:
+
+2009-07-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed (an earlier version) by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27090
+        Remove lockBackForwardList argument from HTMLFormElement::submit()
+
+        No change in behavior, so no tests.
+
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::submit):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::submit):
+        * html/HTMLFormElement.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::scheduleFormSubmission):
+        * loader/FrameLoader.h:
+        Don't pass lockBackForwardList around when it's known to be false.
+
+2009-07-08  Marc-Antoine Ruel  <maruel@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix V8 idl codegen to use unique constant names
+        <https://bugs.webkit.org/show_bug.cgi?id=27089>
+
+        Embed the interface name in the global constant names so coagulating all
+        the .cc files into one compile unit works with V8 bindings.
+
+        Nothing added; Still compiles and pass tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-07-08  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix: Add missing #includes for Windows (cURL) build.
+        The <winsock2.h> and <windows.h> headers were not being
+        included in Windows cURL builds.
+
+        * platform/network/ResourceHandleInternal.h:
+        * platform/network/curl/ResourceHandleManager.h:
+
+2009-07-08  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        WebKit needs a style linting tool
+        https://bugs.webkit.org/show_bug.cgi?id=25884
+
+        Fix bunch of style issues in WebCore/rendering.
+        This patch is created to demonstrate cpplint.py.
+
+        No testcase because it's just a style fixes.
+
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        (WebCore::AutoTableLayout::layout):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeEllipsisBox):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+        * rendering/MediaControlElements.h:
+        * rendering/RenderArena.cpp:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::startDelayUpdateScrollInfo):
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
+        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
+        (WebCore::RenderBlock::positionNewFloats):
+        (WebCore::RenderBlock::newLine):
+        (WebCore::RenderBlock::floatBottom):
+        (WebCore::RenderBlock::leftBottom):
+        (WebCore::RenderBlock::rightBottom):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcReplacedWidthUsing):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::layoutLegend):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::FlexBoxIterator::FlexBoxIterator):
+        (WebCore::FlexBoxIterator::reset):
+        (WebCore::FlexBoxIterator::first):
+        (WebCore::FlexBoxIterator::next):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::borderStartEdgeColor):
+        * rendering/RenderFrameSet.h:
+        * rendering/RenderImage.cpp:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateVisibilityStatus):
+        (WebCore::RenderLayer::calculateClipRects):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::panScroll):
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::updateMarqueeStyle):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::localCaretRect):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::adjustRectsForAspectRatio):
+        * rendering/RenderSlider.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::outerBorderBottom):
+        * rendering/RenderTableCol.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::itemIsSeparator):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::supportsHover):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::supportsFocusRing):
+        * rendering/SVGCharacterLayoutInfo.cpp:
+        (WebCore::SVGCharacterLayoutInfo::addStackContent):
+        * rendering/SVGCharacterLayoutInfo.h:
+        * rendering/TextControlInnerElements.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+
+2009-07-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Reduce complexity of lifetime management in DynamicNodeList caches
+        <https://bugs.webkit.org/show_bug.cgi?id=27068>
+
+        Switch the Cache object used by DynamicNodeList into a normal
+        refcounted object rather than having a weird flag controlled
+        refcounting system, where positive refcount did not automatically
+        imply the cache object would actually still be live.
+
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicNodeList::DynamicNodeList):
+        (WebCore::DynamicNodeList::~DynamicNodeList):
+        (WebCore::DynamicNodeList::Caches::Caches):
+        (WebCore::DynamicNodeList::Caches::create):
+        * dom/DynamicNodeList.h:
+        * dom/Node.cpp:
+        (WebCore::Node::childNodes):
+        (WebCore::Node::getElementsByTagNameNS):
+        (WebCore::Node::getElementsByName):
+        (WebCore::Node::getElementsByClassName):
+        (WebCore::NodeListsNodeData::invalidateCaches):
+        (WebCore::NodeListsNodeData::isEmpty):
+        * dom/NodeRareData.h:
+        (WebCore::NodeListsNodeData::NodeListsNodeData):
+
+2009-07-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+        
+        -webkit-perspective should be a Length
+        https://bugs.webkit.org/show_bug.cgi?id=27066
+        
+        -webkit-perspective should not take a magic valueless number, but should
+        be a normal Length value which responds to zooming. Treat valueless numbers
+        as pixels for backward compatibility.
+        
+        Test: transforms/3d/general/perspective-units.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2009-07-07  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27047
+
+        We need to make sure that when we reattach, we also reattach
+        the children in every MediaControlElement. Else we may end up
+        having no remaining or elapsed time.
+
+        We have to handle that, because we are using a special shadow
+        tree in the DOM, and that we are ourselves handling
+        attaching/detaching the renderer.
+
+        The strategy here is to try to implement ::attach(), and try
+        to reuse as much code as we can from the super class, including
+        children attachement.
+
+        Test: media/controls-after-reload.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::styleForElement): Code factoring.
+        (WebCore::MediaControlElement::rendererIsNeeded): Code factoring.
+        (WebCore::MediaControlElement::attach): Implement attach
+        and call super class so that children are also attached.
+        (WebCore::MediaControlElement::updateStyle): Use attach()
+        (WebCore::MediaControlInputElement::styleForElement): Code factoring.
+        (WebCore::MediaControlInputElement::rendererIsNeeded): Code factoring.
+        (WebCore::MediaControlInputElement::attach): See above.
+        (WebCore::MediaControlInputElement::updateStyle): Use attach()
+        * rendering/MediaControlElements.h:
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls): Directly run attach() on
+        the m_panel, which is a root node for our shadow tree.
+
+2009-07-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Repaint issue after layer drops out of composited mode.
+        <https://bugs.webkit.org/show_bug.cgi?id=27022>
+
+        RenderLayers cache repaint rects in the form of m_repaintRect and m_outlineBox,
+        and expect these to stay valid from one style change to the next. These rects
+        are relative to the repaint container, so if a layer stops being composited,
+        we need to recompute them.
+        
+        Test: compositing/repaint/layer-repaint-rects.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::computeRepaintRects):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+
+2009-07-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt and Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26963
+          <rdar://problem/7030998> Reproducible crash at
+          FontCache::getFontData() when a custom font is used in a pseudo-style
+
+        Test: fast/css/pseudo-cache-stale.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::pseudoStyleCacheIsInvalid): Added. Given the old
+        style and the new style, goes over cached pseudo-styles in the old
+        style and re-resolves the same style types off the new style. If any of
+        the new pseudo-styles is different from the currently cached
+        corresponding style, returns true. Otherwise, returns false.
+        (WebCore::Element::recalcStyle): Validate the pseudo-style cache before
+        deciding to keep the existing style.
+        * dom/Element.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::uncachedFirstLineStyle): Added this version that
+        returns an uncached first-line style based off the given style.
+        (WebCore::RenderObject::getUncachedPseudoStyle): Added the 'ownStyle'
+        parameter.
+        * rendering/RenderObject.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::getPseudoStyleCache): Added. Returns the cached
+        pseudo-styles in the passed-in vector.
+        * rendering/style/RenderStyle.h:
+
+2009-07-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=27042
+          <rdar://problem/7010981> Incomplete painting of newly created floats
+
+        Tests: fast/repaint/float-in-new-block-with-layout-delta.html
+               fast/repaint/float-new-in-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChildren): If the child has never been
+        laid out before, paint its overhanging floats in addition to itself.
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::FloatWithRect::FloatWithRect): Added and
+        initialized a boolean everHadLayout member.
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Paint floats that have
+        never been laid out before and did not move from (0, 0).
+
+2009-07-07  Brady Eidson  <beidson@apple.com>
+
+        Contributions from both Darin Adler and Brady Eidson.
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7024039> REGRESSION (r42158): Back-forward navigation does not work correctly on nytimes.com
+
+        In r42158 we lost some exclusions to making back/forward items for subframe navigations when a main frame
+        navigation was still in progress.
+
+        This patch makes things even better than it used to be by:
+        - Locking back/forward history at the time the navigation is scheduled, not after the load has committed.
+        - Locking back/forward history if *any* ancestor frame is still loading instead of just the main frame.
+
+        Test: fast/loader/subframe-navigate-during-main-frame-load.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm): Move out the history locking logic into a standalone function so it can be
+          used from multiple sites.
+        (WebCore::mustLockBackForwardList): Returns true if any ancestor frame is still loading.
+        (WebCore::FrameLoader::scheduleLocationChange): Respect mustLockBackForwardList() in addition to the passed in
+          lockBackForwardList flag.
+        (WebCore::FrameLoader::scheduleFormSubmission): Ditto.
+
+2009-07-07  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream DOMObjectsInclude.h from src.chromium.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27035
+
+        * bindings/v8/DOMObjectsInclude.h: Added.
+
+2009-07-07  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Relanding r45559, which was rolled back at r45574.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26857
+
+        * bindings/scripts/CodeGeneratorV8.pm: Updated a function name in auto-generated bindings.
+        * bindings/v8/V8Binding.cpp: Moved from src.chromium.org.
+        * bindings/v8/V8Binding.h: Contents moved from src.chromium.org.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::handleConsoleMessage):
+        (WebCore::V8Proxy::compileScript):
+        (WebCore::V8Proxy::sourceName):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-07  Gregory Hughes  <gfhughesVO+webkit@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        AX: Some webpages do not send AXLoadComplete
+        https://bugs.webkit.org/show_bug.cgi?id=26995
+
+        When sending the AXLayoutComplete notification it is possible
+        that the AXObjectCache was cleared, resulting in no valid
+        object to send the notification to. This fix ensures that an
+        AX object is created and cached if one does not already exist.
+
+        Not able to add a test because notifications get sent after the layout test is completed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+
+2009-07-06  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27015
+
+        Make sure that the CSS properties letter-spacing, word-spacing,
+        line-height, text-transform, text-indent, text-shadow,
+        text-decoration and color do not affect the media element controls,
+        that display text.
+
+        Controls that display text are only present in when the theme
+        MediaControllerThemeQT is being used.
+
+        Test: media/controls-styling.html
+
+        * css/mediaControlsQT.css:
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::updateStyle): Special case for
+        text-decoration. text-decoration can't be overriden from CSS, because
+        text-decoration is additive for historical reasons.
+
+2009-07-07  Albert Wong  <ajwong@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        Add in missing header fix syntax issue that crept into last patch.
+        https://bugs.webkit.org/show_bug.cgi?id=27027
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
+
+2009-07-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Make use of geometry information to decide which layers become composited.
+
+        <rdar://problem/7011947>
+        <https://bugs.webkit.org/show_bug.cgi?id=27021>
+        
+        In addition to looking at painting order, also, optionally, take layer
+        overlap into account when deciding which RenderLayers need to be composited.
+
+        No testcase because DRT doesn't dump which layers are composited.
+        
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        Removed the unused CompositingUpdate parameter, and just do an early return
+        when there is no view.
+        
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::rendererContentChanged):
+        (WebCore::RenderLayer::dirtyZOrderLists):
+        (WebCore::RenderLayer::dirtyNormalFlowList):
+        (WebCore::RenderLayer::styleChanged):
+        (WebCore::RenderLayer::mustOverlapCompositedLayers):
+        (WebCore::RenderLayer::setMustOverlapCompositedLayers):
+        Change "overlay" to "overlap" for consistency with the use of "overlap"
+        elsewhere.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        compositingLayersNeedUpdate() renamed to compositingLayersNeedRebuild().
+        
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        Tell the compositor that we started an accelerated animation or transition.
+        
+        * rendering/RenderLayerCompositor.h:
+        (WebCore::RenderLayerCompositor::compositingLayersNeedRebuild):
+        Renamed, since it's explicitly about changes in hierarchy now.
+        
+        (WebCore::RenderLayerCompositor::setCompositingConsultsOverlap):
+        (WebCore::RenderLayerCompositor::compositingConsultsOverlap):
+        New getter and setter for whether compositing should take overlap into account.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        Add m_compositingConsultsOverlap, re-order some member variables.
+        
+        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
+        Whitespace cleanup and method rename.
+        
+        (WebCore::RenderLayerCompositor::setCompositingLayersNeedRebuild):
+        Method and variable renaming.
+        
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        Now we have to run through the layer hierarchy every time if looking
+        at overlap, because changes in layout can now alter compositing behavior.
+        We minimize work by tracking whether we actually need to change the layer
+        hierarchy via needLayerRebuild.
+        
+        (WebCore::RenderLayerCompositor::updateBacking):
+        3D transforms turn off overlap mode.
+        
+        (WebCore::RenderLayerCompositor::layerWasAdded):
+        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
+        Method rename.
+        
+        (WebCore::RenderLayerCompositor::addToOverlapMap):
+        (WebCore::RenderLayerCompositor::overlapsCompositedLayers):
+        Utility methods to add a layer to the overlapMap (computing the absolute
+        bounding box only if we haven't already done so), and testing the map
+        entries.
+        
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        If a layer would composite only because it comes after other compositing
+        layers in the painting order, then consult the overlap map to determine whether
+        it overlaps, and thus actually needs to composite.
+        
+        Add layers to the map when they must be composited.
+        
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        Only do re-parenting work if the updateHierarchy flag is set.
+        
+        (WebCore::RenderLayerCompositor::didStartAcceleratedAnimation):
+        When we start an accelerated transition or animation, we stop looking at
+        overlap because we can no longer guarantee correct front-to-back ordering while the
+        accelerated animation is running.
+
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+        Method renames.
+        
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setMaximalOutlineSize):
+        Add comment indicating that this could be optimized.
+
+2009-07-14  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Speed up creation of V8 wrappers for DOM nodes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26882
+
+        This patch doesn't require new tests as it a set of refactorings
+        to speed up wrapper creation.  
+
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+
+2009-07-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] textarea height property works only if other property are defined
+        https://bugs.webkit.org/show_bug.cgi?id=18984
+
+        Let WebCore handle textarea's metrics instead of readjusting it RenderthemeGtk.
+
+        Test: fast/forms/textarea-metrics.html
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        * platform/gtk/RenderThemeGtk.h:
+
+2009-07-07  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Antti Koivisto.
+
+        HTML5 Database becomes locked if a transaction is in progress when the page is refreshed.
+        https://bugs.webkit.org/show_bug.cgi?id=25711
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25711 where web
+        storage databases could become locked until the browser is shut
+        down if the page is refreshed whilst a transaction is in progress.
+
+        Test: storage/database-lock-after-reload.html
+
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+        (WebCore::Database::close): add code to inform the database thread we've closed the database.
+        (WebCore::Database::performOpenAndVerify): add code to inform the database thread we've opened a database.
+        * storage/Database.h:
+        (WebCore::Database::opened): return true iff the underlying sqlite database has been opened but not closed.
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThread): Before the database thread terminates, close any databases that ran transactions in this thread.
+        (WebCore::DatabaseThread::recordDatabaseOpen): Records a database that executed a transaction in this thread.
+        (WebCore::DatabaseThread::recordDatabaseClosed): Removes a database from the set of open databases.
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::getThreadID): return the thread id for the database thread.
+
+2009-07-07  Jiahua Huang  <jhuangjiahua@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [Gtk] Paste of rich text from firefox results garbled markup
+        https://bugs.webkit.org/show_bug.cgi?id=26791
+
+        Fix problem with UTF-16 clipboard pasted.
+
+        * manual-tests/gtk/paste-richtext-from-firefox.html: Added.
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::documentFragment):
+
+2009-07-07  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Change 'Continue debug' shortcut from F5 to F8 for consistency with Firebug.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23849
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+
+2009-07-06  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Update RenderThemeChromiumMac for wkDrawMediaUIPart and wkDrawMediaSlider API
+        change.
+
+        Fix compile RenderThemeChromiumMac.mm due to API changes from r45572
+        https://bugs.webkit.org/show_bug.cgi?id=27018
+
+        This is mainly an API change update to fix the chromium compile.  It
+        also has a small fix of a typo in RenderThemeMac.mm.
+
+        Compilation against the head of chromium trunk passed.  Since this is
+        a compile fix, that should be sufficient.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::):
+        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::):
+
+2009-07-06  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 27002: Build fix when DASHBOARD_SUPPORT is disabled with -Wunused-parameter
+
+        <https://bugs.webkit.org/show_bug.cgi?id=27002>
+
+        Reviewed by Geoff Garen.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::prepareGradientForDashboard):
+        Mark gradient as an unused parameter when DASHBOARD_SUPPORT is
+        disabled.
+
+2009-07-06  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 27001: Fix improper use of PassRefPtr<Node> to RefPtr<Node>
+
+        <https://bugs.webkit.org/show_bug.cgi?id=27001>
+
+        Reviewed by Geoff Garen.
+
+        PassRefPtr<> should only be used for arguments to functions that
+        take ownership of the object, or as return values from functions
+        that relinquish ownership of the object.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::increaseSelectionListLevelOrdered): Changed
+        stack-allocated PassRefPtr<Node> to RefPtr<Node> and call
+        release() on returned object.
+        (WebCore::Editor::increaseSelectionListLevelUnordered): Ditto.
+
+2009-07-06  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7035474> Make new media controller UI default on SnowLeopard
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme):
+            New media controller UI is enabled by default on SnowLeopard.
+
+2009-07-06  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, build fix.
+
+        Roll out r45559 to fix Chromium canary.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26857
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp: Removed.
+        * bindings/v8/V8Binding.h:
+        (WebCore::toInt32):
+        (WebCore::toWebCoreString):
+        (WebCore::fromWebCoreString):
+        (WebCore::toWebCoreStringWithNullCheck):
+        (WebCore::isUndefinedOrNull):
+        (WebCore::v8Boolean):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::handleConsoleMessage):
+        (WebCore::V8Proxy::compileScript):
+        (WebCore::V8Proxy::sourceName):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-06  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7008093> Media controller can’t be used to scrub when movie is 
+        narrow — track is too narrow
+
+        Do not show media controller time display elements when the a movie is too narrow.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+            The 'state' parameter to wkDrawMediaUIPart is now an unsigned bitfield.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimeDisplayElement::MediaControlTimeDisplayElement):
+            Give current time and time remaining controls a common base class.
+        (WebCore::MediaControlTimeDisplayElement::setVisible):
+            New method, hide and show the element.
+        * rendering/MediaControlElements.h:
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::RenderMedia):
+            Initialize m_previousVisible.
+        (WebCore::RenderMedia::layout):
+            Show/hide the time display elements as the movie width changes.
+        (WebCore::RenderMedia::createCurrentTimeDisplay):
+        (WebCore::RenderMedia::createTimeRemainingDisplay):
+            Base class is now MediaControlTimeDisplayElement, not MediaControlElement.
+        (WebCore::RenderMedia::shouldShowTimeDisplayControls):
+            New, decide if time display elements should be visible or not.
+        * rendering/RenderMedia.h:
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::):
+        (WebCore::RenderThemeMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+        (WebCore::RenderThemeMac::paintMediaPlayButton):
+        (WebCore::RenderThemeMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeMac::paintMediaRewindButton):
+        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton):
+        (WebCore::RenderThemeMac::paintMediaControlsBackground):
+        (WebCore::RenderThemeMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
+            The 'state' parameter to wkDrawMediaUIPart is now an unsigned bitfield.
+
+2009-07-06  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 27000: Minor clean up to runtime_root.{cpp|h}
+
+        <https://bugs.webkit.org/show_bug.cgi?id=27000>
+
+        Reviewed by Geoff Garen.
+
+        * bridge/runtime_root.cpp: Added blank line between license and
+        the first #include statement.
+        * bridge/runtime_root.h: Added comment to #endif.
+
+2009-07-06  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        generalize the special height treatment for SVG (to be re-used for ruby):
+            renamed InlineBox::m_isSVG to m_hasVirtualHeight
+            renamed InlineBox::isSVG() to hasVirtualHeight()
+            renamed InlineBox::setIsSVG() to setHasVirtualHeight()
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::height):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        (WebCore::InlineBox::isText):
+        (WebCore::InlineBox::setIsText):
+        (WebCore::InlineBox::isSVGRootInlineBox):
+        (WebCore::InlineBox::hasVirtualHeight):
+        (WebCore::InlineBox::setHasVirtualHeight):
+        (WebCore::InlineBox::virtualHeight):
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::createFlowBox):
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::createTextBox):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::createRootBox):
+        * rendering/SVGInlineFlowBox.h:
+        (WebCore::SVGInlineFlowBox::virtualHeight):
+        * rendering/SVGInlineTextBox.h:
+        (WebCore::SVGInlineTextBox::virtualHeight):
+        * rendering/SVGRootInlineBox.h:
+        (WebCore::SVGRootInlineBox::virtualHeight):
+
+2009-07-06  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r45285): focus rings are black on windows safari
+        https://bugs.webkit.org/show_bug.cgi?id=26821
+        <rdar://problem/7018252>
+
+        Add a mechanism for setting a custom focus ring color, and relocate the 
+        determination of focus ring color to base class RenderTheme.
+
+        No new tests.  Already-existing tests run in pixel mode would have caught this regression
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue): Move the responsibility
+        of determining focus color to base class RenderTheme.
+        * rendering/RenderTheme.cpp:
+        (WebCore::customFocusRingColor): Added static local.
+        (WebCore::RenderTheme::setCustomFocusRingColor): Added
+        (WebCore::RenderTheme::focusRingColor): Use custom color over platform color.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::platformFocusRingColor): default implementation, black color
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderTheme::themeForPage): Circumstances that lead to returning the RenderThemeWin
+        are the same under which we want to use the focus ring color from SafariTheme.
+        (WebCore::RenderThemeSafari::platformFocusRingColor): Renamed from focusRingColor
+        * rendering/RenderThemeSafari.h:
+
+        Renaming focusRingColor to platformFocusRingColor in these files:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::platformFocusRingColor):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::platformFocusRingColor):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::platformFocusRingColor):
+
+        Cleanup leftover from removal of WebCore::Color in r45285 in these files:
+        * WebCore.order:
+        * platform/graphics/Color.h:
+
+2009-07-06  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Bug 15135: REGRESSION (r19843-r19850): Changing a flexbox's
+        contents makes its container scroll to the top
+        https://bugs.webkit.org/show_bug.cgi?id=15135
+
+        Delay updateing scroll bar of descendants of flexbox until their
+        positions are determined.  In this way we can prevent descendants
+        of flexible boxes from changing positions of their scrollbars
+        using tentative positions.
+
+        Test: fast/flexbox/repaint-scrollbar.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::startDelayUpdateScrollInfo):
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
+        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+
+2009-07-06  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Make unconfirmed IME text affect textarea's value.
+        This matches input and contentEditable elements as well
+        IE and Firefox.
+
+        This fixes https://bugs.webkit.org/show_bug.cgi?id=25061.
+
+        Input elements would go down this code path because it
+        would always get a null compositionNode from frame->editor().
+        Special casing compositionNodes is wrong because we explicitly
+        want unconfirmed IME input in the textarea's value (assuming we
+        want to match IE and Firefox here).
+
+        This change is originally created by Ojan Vafai <ojan@chromium.org> and
+        I just changed its manual tests with an automated test on his behalf.
+
+        Test: platform/mac/editing/input/text-control-ime-input.html
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::text):
+        (WebCore::RenderTextControl::textWithHardLineBreaks):
+
+2009-07-06  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Add the ability for wheel events to latch to a node.
+        
+        * WebCore.base.exp:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/EventHandler.h:
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::wheelEvent):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2009-07-06  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a bunch of layout test crahses in Chromium caused by a bad usage of DEFINE_STATIC_LOCAL.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26997
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ValueToWebCoreString): Use a regular static declaration instead of DEFINE_STATIC_LOCAL.
+
+2009-07-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: suggest global properties based on async evaluation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26976
+
+        Before this change, empty string was evaluated to the global object
+        (or scope chain object) synchronously. This is now fixed and global
+        object is evaluated using the same control flow.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype.completions):
+        (WebInspector.Console.prototype._evalInInspectedWindow):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._variablesInScope):
+
+2009-07-06  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix crash when indenting in an empty table cell.
+        https://bugs.webkit.org/show_bug.cgi?id=26872
+
+        The crash is that we would call splitTreeToNode where the node
+        and the nodeToSplitTo were the same node.
+
+        Test: editing/execCommand/indent-empty-table-cell.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::splitTreeToNode):
+        Added an assert in that node and nodeToSplitTo
+        are different nodes to make this assumption explicit.
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::isAtUnsplittableElement):
+        (WebCore::IndentOutdentCommand::indentRegion):
+        * editing/IndentOutdentCommand.h:
+
+2009-07-06  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Upstream V8Binding and update some function names.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26857
+
+        * bindings/scripts/CodeGeneratorV8.pm: Update function names in auto-generated files.
+        * bindings/v8/V8Binding.cpp: Upstreamed from src.chromium.org.
+        * bindings/v8/V8Binding.h: Upstreamed from src.chromium.org.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::handleConsoleMessage):
+        (WebCore::V8Proxy::compileScript):
+        (WebCore::V8Proxy::sourceName):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-06  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Jan Alonzo.
+
+        Use soup's content sniffing
+        https://bugs.webkit.org/show_bug.cgi?id=26982
+
+        Drop our hackish content sniffing code, and use the new libsoup
+        feature to do that job for us.
+
+        Testing this is in a cross-platform way is not obvious or possible
+        while we are using platform-specific code for sniffing.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotHeadersCallback):
+        (WebCore::contentSniffedCallback):
+        (WebCore::gotChunkCallback):
+        (WebCore::ResourceHandle::startHttp):
+
+2009-07-05  Antonio Gomes  <antonio.gomes@openbossa.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r40499): fast/dom/cssTarget-crash.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=20342
+
+        Re-added code removed by commit r40499.
+        Without this, both Qt and Mac were crashing while running the test.
+
+        Note that this does not entirely fix the bug. It fixes the WebCore
+        crash, but the test no longer seems to work due to loader changes.
+        So this patch does not reenable the test. The test probably has to
+        be rewritten.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removedFromDocument): Re-added code to
+        set the CSS target of the document to 0.
+
+2009-07-05  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26943
+
+        When one transition finishes slightly before another the longer
+        one will fire a second time. This is because the second
+        ImplicitAnmation object is culled too early, before its final
+        RenderStyle is in place. This is done by cleanupFinishedAnimations()
+        so I got rid of that method completely and now cleanup each
+        transition or animation at the point where I am setting the final
+        style, or when I detect that the transition or animation has been
+        terminated early (which happens when you remove it from the style).
+
+        Test: transitions/extra-transition.html
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        * page/animation/CompositeAnimation.h:
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::getTimeToNextEvent):
+        Avoid a divide by zero if m_animation->duration() is zero, which can happen
+        if the duration is changed to zero while the animation is running.
+
+2009-07-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Revert the previous commit because it broke the
+        animations/transition-and-animation-1.html
+        testcase.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::getTimeToNextEvent):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
+        * page/animation/CompositeAnimation.h:
+
+2009-07-05  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26943
+
+        When one transition finishes slightly before another the longer
+        one will fire a second time. This is because the second 
+        ImplicitAnmation object is culled too early, before its final
+        RenderStyle is in place. This is done by cleanupFinishedAnimations()
+        so I got rid of that method completely and now cleanup each 
+        transition or animation at the point where I am setting the final
+        style, or when I detect that the transition or animation has been
+        terminated early (which happens when you remove it from the style).
+
+        Test: transitions/extra-transition.html
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        * page/animation/CompositeAnimation.h:
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::getTimeToNextEvent):
+        Avoid a divide by zero if m_animation->duration() is zero, which can happen
+        if the duration is changed to zero while the animation is running.
+
+2009-07-05  Lars Knoll  <lars.knoll@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26843
+
+        Fix run-time crashes in JavaScriptCore with the Metrowerks compiler on Symbian.
+
+        The Metrowerks compiler on the Symbian platform moves the globally
+        defined Hashtables into read-only memory, despite one of the members
+        being mutable. This causes crashes at run-time due to write access to
+        read-only memory.
+
+        Avoid the use of const with this compiler by introducing the
+        JSC_CONST_HASHTABLE macro.
+
+        Based on idea by Norbert Leser.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Use JSC_CONST_HASHTABLE for hash tables
+        define in the bindings.
+
+2009-07-05  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 26897 - Dynamic SVG images do not display correctly
+        https://bugs.webkit.org/show_bug.cgi?id=26897
+
+        Use repaint() to fix a rendering problem with a SVG image embedded in xhtml.
+
+        Test: svg/custom/createImageElement2.xhtml
+
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::imageChanged):
+
+2009-07-05  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26960
+        [Gtk] caret offset not updated when selecting text
+
+        Report the caret offset from the end of the selection so it works
+        correctly for multi-char selections too (ie, anything that is not
+        the zero width caret).
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_caret_offset):
+
+2009-07-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed link fix for Qt.
+
+        Fix Qt link error by adding two new localized strings
+
+        In r45474 two new strings got added to LocalizedStrings.h add
+        the definition of them to Qt.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+
+2009-07-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r44670-r44680): Typing is suprisingly slow in password field on reddit.com
+        https://bugs.webkit.org/show_bug.cgi?id=26959
+        rdar://problem/7029882
+
+        The code to handle iteration boundaries was malfunctioning when the boundary was
+        at the edge of a shadow tree. This happens all the time with <input> elements.
+
+        It's not immediately obvious how to make a regression test for this since the
+        symptom was a performance problem, not incorrect behavior. I'll add a test if I
+        figure out a way to make one.
+
+        * editing/TextIterator.cpp:
+        (WebCore::parentCrossingShadowBoundaries): Renamed from parentOrShadowParent.
+        (WebCore::depthCrossingShadowBoundaries): Updated for name change.
+        (WebCore::nextInPreOrderCrossingShadowBoundaries): Added.
+        (WebCore::previousInPostOrderCrossingShadowBoundaries): Added.
+        (WebCore::setUpFullyClippedStack): Updated for name change.
+        (WebCore::TextIterator::TextIterator): Updated for name change. Use
+        nextInPreOrderCrossingShadowBoundaries instead of Range::pastLastNode to fix the bug.
+        (WebCore::TextIterator::advance): Updated for name change.
+        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
+        Tweaked formatting.
+        (WebCore::SimplifiedBackwardsTextIterator::advance): Ditto. Changed code that
+        initializes m_pastStartNode to use previousInPostOrderCrossingShadowBoundaries.
+        (WebCore::SimplifiedBackwardsTextIterator::handleNonTextNode): Tweaked formatting.
+        (WebCore::SimplifiedBackwardsTextIterator::exitNode): Ditto.
+
+2009-07-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Background audio stops playing when JS GC runs
+        https://bugs.webkit.org/show_bug.cgi?id=26956
+        
+        Ensure we keep the Audio object around while it is playing, so that it
+        doesn't get collected.
+        
+        Not testable because there's no way to know whether the audio keeps
+        playing without holding a reference to it.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM):
+
+2009-07-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26814
+        [Gtk] Caret-moved events are not issued for the correct offset
+        when text is selected forward
+
+        Report the caret offset from the end of the selection, otherwise
+        we'll report the same offset when moving the caret while
+        modififying the selection (eg, with Shift Right).
+
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2009-07-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26815
+        [Gtk] text-selection-changed events are not issued for the correct
+        object when the selection spans multiple objects
+
+        Get the focused node from the end of the selection, not the start,
+        so we can detect when we cross object boundaries.
+
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26947
+
+        Fix the media controls hit tests. They may lose click events.
+
+        Test cases already covered in the video-controls-zoomed tests.
+
+        Don't trust wkHitTestMediaUIPart for the tests. We are accurate enough.
+
+        * rendering/RenderThemeMac.h: Remove hitTestMediaControlPart.
+        * rendering/RenderThemeMac.mm: Remove hitTestMediaControlPart.
+
+2009-07-02  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        RenderBlock and RenderInline have confusingly named object creation methods:
+        RenderBlock::createRootBox/createRootInlineBox
+        RenderInline::createFlowBox/createInlineFlowBox
+        where the 2nd method in both cases just calls the first and then appends the created object.
+        I therefore renamed those methods to something IMHO more informative:
+        
+        createRootBox()         -> createRootInlineBox()
+        createRootInlineBox()   -> createAndAppendRootInlineBox();
+        createFlowBox()         -> createInlineFlowBox();
+        createInlineFlowBox()   -> createAndAppendInlineFlowBox();
+
+        https://bugs.webkit.org/show_bug.cgi?id=26828
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createRootInlineBox):
+        (WebCore::RenderBlock::createAndAppendRootInlineBox):
+        * rendering/RenderBlock.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::createInlineFlowBox):
+        (WebCore::RenderInline::createAndAppendInlineFlowBox):
+        * rendering/RenderInline.h:
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::createInlineFlowBox):
+        * rendering/RenderSVGInline.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::createRootInlineBox):
+        * rendering/RenderSVGText.h:
+        * rendering/bidi.cpp:
+        (WebCore::createInlineBoxForRenderer):
+
+2009-07-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix typo in the resource panel enabler caption.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26753
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+
+2009-07-02  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        [Win] HTML5 Drag and drop, dragend is not fired when pressing Esc
+        https://bugs.webkit.org/show_bug.cgi?id=26699
+
+        * manual-tests/drag-escape.html: Added.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dragSourceEndedAt):
+
+2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser. 
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26944
+
+        Make sure we support full page zoom in video controls.
+
+        This is tracked by a the video-controls-zoom test case.
+
+        * css/mediaControlsQT.css: Make sure we don't have any inherited margin.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::updateStyle): Propagate the style to the innertext.
+        * rendering/RenderThemeMac.mm: Adjust the painting rect.
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
+
+2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Fix the Gtk build after r45474. The localized strings should
+        have been added there.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+
+2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26939
+
+        Media controller is rendered badly at http://www.mozilla.com/en-US/firefox/video/firefox-3.5.html
+
+        We fix two things:
+        - We use px instead of em, because px is used everywhere else
+        and because 0.09em hit the font size limit.
+        - We use -webkit-box instead of inline-block because in strict mode
+        inline-block has a different behavior.
+
+        Test: media/controls-strict.html
+
+        * css/mediaControlsQT.css:
+
+2009-07-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        TextIterator should use hasOverflowClip when checking for overflow instead of looking at the style.
+        https://bugs.webkit.org/show_bug.cgi?id=26942
+
+        * editing/TextIterator.cpp:
+        (WebCore::fullyClipsContents):
+
+2009-07-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/5230700>
+        Remove local .xhtml file workaround
+
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit): Work around is no longer necessary.
+
+2009-07-02  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Sort, add functions used by WebKit.
+        
+        * WebCore.base.exp:
+
+2009-07-02  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig.
+
+        More of <rdar://problem/6969425> Safari 4.0 doesn't recognize text/plain files if their extension is unknown.
+
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (webNSURLResponseMIMEType): Give Tiger a chance to query the UTI machinery.
+
+2009-07-02  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: fix complex text rendering with line break characters.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26935
+
+        If the CSS white-space property is inhibiting line breaking, we might
+        find end-of-line characters rendered via the complex text path. Fonts
+        don't provide glyphs for these code points so, if we find one, we
+        simulate the space glyph being interposed in this case.  Because the
+        input is variable-length per code point, we walk the input in step
+        with the output.
+
+        Covered by:
+            LayoutTests/fast/text/international/bidi-linebreak-002.html
+            LayoutTests/fast/text/international/bidi-linebreak-003.html
+            LayoutTests/fast/text/international/hindi-whitespace.html
+
+        * platform/graphics/chromium/HarfbuzzSkia.cpp:
+        (WebCore::stringToGlyphs):
+
+2009-07-02  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26521
+        Expose file size to chromium.
+
+        Implement getFileSize() for Chromium.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/FileSystemChromium.cpp:
+        (WebCore::getFileSize):
+
+2009-07-02  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, build fix.
+
+        * bindings/v8/V8SVGPODTypeWrapper.h: Lost a space in nested template argument list.
+
+2009-07-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix: add missing #include.
+
+        * platform/mac/ThemeMac.mm:
+
+2009-07-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/7028682> ThemeMac::paintRadio() throws Obj-C exceptions when zoomed
+
+        Add BEGIN_BLOCK_OBJC_EXCEPTIONS/END_BLOCK_OBJC_EXCEPTIONS guards around code
+        that can possibly throw Objective-C exceptions when drawing Mac form controls.
+
+        * platform/mac/ThemeMac.mm:
+        (WebCore::paintCheckbox):
+        (WebCore::paintRadio):
+        (WebCore::paintButton):
+        (WebCore::ThemeMac::inflateControlPaintRect):
+
+2009-07-02  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Upstream V8SVGPODTypeWrapper.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26907
+
+        * bindings/scripts/CodeGeneratorV8.pm: Update function being renamed in V8SVGPODTypeWrapper.h.
+        * bindings/v8/V8SVGPODTypeWrapper.h: Upstreamed from src.chromium.org.
+
+2009-07-02  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adds an abstraction layer between the DB classes and the file
+        system, which allows us to add our own logic for storing, opening,
+        deleting, etc. databases.
+
+        The patch was tested using the tests in WebCore/storage.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26054
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::open): Delegating the job of opening DB files to SQLiteFileSystem to allow use of custom VFSs.
+        * platform/sql/SQLiteFileSystem.cpp: Added.
+        * platform/sql/SQLiteFileSystem.h: Added.
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::directoryName): Implemented.
+        * storage/Database.cpp:
+        (WebCore::Database::databaseSize): The code that returns the size of a DB file moved to SQLiteFileSystem.
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::DatabaseTracker): Added the ability to register a custom SQLite VFS.
+        (WebCore::DatabaseTracker::trackerDatabasePath): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::openTrackerDatabase): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::originPath): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::fullPathForDatabase): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::usageForDatabase): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::deleteOrigin): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::deleteDatabaseFile): DB file-related operations moved to SQLiteFileSystem.
+        * storage/OriginUsageRecord.cpp:
+        (WebCore::OriginUsageRecord::diskUsage): DB file-related operations moved to SQLiteFileSystem.
+
+2009-07-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Always clip replaced elements to border radii.
+        https://bugs.webkit.org/show_bug.cgi?id=26933
+
+        Make sure to always clip replaced elements to border radii, even when overflow is visible.
+        Stop defaulting those elements to overflow:hidden in the UA sheet, since it is now no longer
+        necessary.
+
+        Covered by existing tests (since the UA default changing keeps the behavior exactly the same).
+
+        * css/html.css:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2009-07-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        convertFromScrollbarToContainingView and friends should be in ScrollView
+        https://bugs.webkit.org/show_bug.cgi?id=26929
+
+        This is breaking Chromium's build because PopupMenuChromium inherits
+        from ScrollView, but these functions are pure virtual in it.  I could
+        put it directly in PopupMenuChromium, but that seems a bit silly since
+        the functions are fairly generic.
+
+        Passes existing layout tests.
+
+        * page/FrameView.cpp:  Remove the 4 functions Hyatt just added
+        (IntRect WebCore::FrameView::convertFromScrollbarToContainingView):
+        (IntRect WebCore::FrameView::convertFromContainingViewToScrollBar):
+        (IntPoint WebCore::FrameView::convertFromScrollbarToContainingView):
+        (IntPoint WebCore::FrameView::convertFromContainingViewToScrollBar):
+        * page/FrameView.h: ditto
+        * platform/ScrollView.cpp:  Move the 4 functions from FrameView here
+        (IntRect WebCore::ScrollView::convertFromScrollbarToContainingView):
+        (IntRect WebCore::ScrollView::convertFromContainingViewToScrollBar):
+        (IntPoint WebCore::ScrollView::convertFromScrollbarToContainingView):
+        (IntPoint WebCore::ScrollView::convertFromContainingViewToScrollBar):
+        * platform/ScrollView.h: ditto
+
+2009-07-02  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=26088 - TransparencyWin 
+        doesn't handle errors well at all; revise it to fail silently 
+        (drawing nothing), and bulletproof FontChromiumWin to handle the
+        failure accordingly.
+
+        Tests: fast/text/text-large-negative-letter-spacing-with-opacity.html
+               fast/text/text-letter-spacing.html
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::TransparencyAwareGlyphPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::~TransparencyAwareGlyphPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::drawGlyphs):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::TransparencyWin):
+        (WebCore::TransparencyWin::setupLayerForNoLayer):
+        (WebCore::TransparencyWin::setupLayerForOpaqueCompositeLayer):
+        (WebCore::TransparencyWin::setupLayerForWhiteLayer):
+        (WebCore::TransparencyWin::setupTransformForKeepTransform):
+        (WebCore::TransparencyWin::setupTransformForScaleTransform):
+        (WebCore::TransparencyWin::initializeNewContext):
+        (WebCore::TransparencyWin::compositeOpaqueComposite):
+        (WebCore::TransparencyWin::compositeTextComposite):
+        (WebCore::TransparencyWin::makeLayerOpaque):
+        * platform/graphics/chromium/TransparencyWin.h:
+        (WebCore::TransparencyWin::platformContext):
+
+2009-07-02  Eric Carlson  <eric.carlson@apple.com>
+
+        Change #import to #include to fix non-ObjC builds.
+
+        * rendering/MediaControlElements.cpp:
+
+2009-07-02  Anders Carlsson  <andersca@apple.com>
+
+        Build fix.
+        
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (mimeTypeFromUTITree):
+
+2009-07-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for bug 22119, clicks in the scrollbars of transformed content don't work.  Add new
+        conversion methods for going across parent/child widget boundaries that can be implemented
+        by the FrameView and ScrollbarClient to be transform-aware.
+
+        Test cases added in platform/mac/fast/forms and platform/mac/fast/overflow.
+
+        * WebCore.base.exp:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::convertFromScrollbarToContainingView):
+        (WebCore::FrameView::convertFromContainingViewToScrollbar):
+        (WebCore::FrameView::convertFromRenderer):
+        (WebCore::FrameView::convertToRenderer):
+        (WebCore::FrameView::convertToContainingView):
+        (WebCore::FrameView::convertFromContainingView):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::convertToContainingView):
+        (WebCore::Scrollbar::convertFromContainingView):
+        * platform/Scrollbar.h:
+        * platform/ScrollbarClient.h:
+        (WebCore::ScrollbarClient::convertFromScrollbarToContainingView):
+        (WebCore::ScrollbarClient::convertFromContainingViewToScrollbar):
+        * platform/Widget.cpp:
+        (WebCore::Widget::convertFromContainingWindow):
+        (WebCore::Widget::convertToContainingWindow):
+        (WebCore::Widget::convertFromRootToContainingWindow):
+        (WebCore::Widget::convertFromContainingWindowToRoot):
+        (WebCore::Widget::convertToContainingView):
+        (WebCore::Widget::convertFromContainingView):
+        * platform/Widget.h:
+        * platform/graphics/IntPoint.h:
+        (WebCore::IntPoint::move):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::convertFromRootToContainingWindow):
+        (WebCore::Widget::convertFromContainingWindowToRoot):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::isPointInOverflowControl):
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::convertFromScrollbarToContainingView):
+        (WebCore::RenderDataGrid::convertFromContainingViewToScrollbar):
+        * rendering/RenderDataGrid.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::convertFromScrollbarToContainingView):
+        (WebCore::RenderLayer::convertFromContainingViewToScrollbar):
+        (WebCore::RenderLayer::scrollbarOffset):
+        (WebCore::RenderLayer::hitTestOverflowControls):
+        * rendering/RenderLayer.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::isPointInOverflowControl):
+        (WebCore::RenderListBox::convertFromScrollbarToContainingView):
+        (WebCore::RenderListBox::convertFromContainingViewToScrollbar):
+        * rendering/RenderListBox.h:
+
+2009-07-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt and Simon Fraser.
+
+        - fix <rdar://problem/6933052> SPOD playing video in a div with a box
+          shadow
+
+        Test: fast/box-shadow/transform-fringing.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow): Clip out the
+        box even if it has an opaque background, but in that case, inset the
+        clip path by 1 pixel, to avoid antialiasing artifacts.
+        Do not inset the clip rect by 1 pixel if the CTM is purely a
+        translation.
+        Move the shadow-casting path away in the non-rounded-rect case (it
+        was already being done in the rounded-rect case), to avoid a black
+        fringe when the CTM is not purely a translation.
+
+2009-07-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6969425> Safari 4.0 doesn't recognize text/plain files if their extension is unknown.
+
+        Walk the CoreTypes UTI tree for extensions with unknown MIME types, using the first MIME type found.
+
+        For many types of text files (such as source code files) this ends up being text/plain.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Tweak the logging output.
+
+        * platform/network/mac/WebCoreURLResponse.h:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (mimeTypeFromUTITree): 
+        (webNSURLResponseMIMEType): Use mimeTypeFromUTITree() to find a UTI-based MIME type for this file's extension.
+        (-[NSURLResponse _webcore_reportedMIMEType]): Return the actual MIME type that CFNetwork gave us.
+
+2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6518119>
+
+        Add a rewind button and hide the timeline for live broadcasts when
+        in MediaUI mode.
+
+        * css/CSSPrimitiveValueMappings.h: 
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Add the new pseudo element.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): Ditto.
+        * css/CSSSelector.h: 
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): Ditto.
+
+        * css/CSSValueKeywords.in: Ditto.
+        * css/mediaControls.css: Ditto.
+        * css/mediaControlsQT.css: Ditto.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::rewind): New.
+        (WebCore::HTMLMediaElement::returnToRealTime): New.
+        (WebCore::HTMLMediaElement::isStreaming): New.
+        * html/HTMLMediaElement.h:
+
+        * page/mac/WebCoreViewFactory.h: Declare mediaElementLoadingStateText and mediaElementLiveBroadcastStateText.
+
+        * platform/LocalizedStrings.h: Add localized media state messages.
+
+        * platform/ThemeTypes.h: Add the new pseudo element.
+
+        * platform/mac/LocalizedStringsMac.mm: 
+        (WebCore::mediaElementLoadingStateText): Add localized media state.
+        (WebCore::mediaElementLiveBroadcastStateText): Ditto.
+
+        * platform/mac/WebCoreSystemInterface.h: Change BOOL param wkDrawMediaUIPart to an int to support
+           multiple states.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+        * rendering/MediaControlElements.cpp: 
+        (WebCore::MediaControlElement::MediaControlElement): Deal with new elements.
+        (WebCore::MediaControlElement::attachToParent): Ditto.
+        (WebCore::MediaControlElement::update): Ditto.
+        (WebCore::MediaControlElement::updateStyle): Ditto.
+        (WebCore::MediaControlTimelineContainerElement::MediaControlTimelineContainerElement): Ditto.
+        (WebCore::MediaControlTimelineContainerElement::rendererIsNeeded): Ditto.
+        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement): Ditto.
+        (WebCore::MediaControlStatusDisplayElement::update): Ditto.
+        (WebCore::MediaControlStatusDisplayElement::rendererIsNeeded): Ditto.
+        (WebCore::MediaControlInputElement::MediaControlInputElement): Ditto.
+        (WebCore::MediaControlInputElement::attachToParent): Ditto.
+        (WebCore::MediaControlInputElement::updateStyle): Ditto.
+        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement): Ditto.
+        (WebCore::MediaControlRewindButtonElement::defaultEventHandler): Ditto.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement): Ditto.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::defaultEventHandler): Ditto.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::rendererIsNeeded): Ditto.
+        (WebCore::MediaControlTimelineElement::defaultEventHandler): Ditto.
+        (WebCore::MediaControlTimelineElement::update): Ditto.
+        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): Ditto.
+        * rendering/MediaControlElements.h: Ditto.
+
+        * rendering/RenderMedia.cpp: 
+        (WebCore::RenderMedia::styleDidChange): Deal with the new elements.
+        (WebCore::RenderMedia::createPanel): Ditto.
+        (WebCore::RenderMedia::createRewindButton): Ditto.
+        (WebCore::RenderMedia::createReturnToRealtimeButton): Ditto.
+        (WebCore::RenderMedia::createStatusDisplay): Ditto.
+        (WebCore::RenderMedia::createTimelineContainer): Ditto.
+        (WebCore::RenderMedia::createCurrentTimeDisplay): Ditto.
+        (WebCore::RenderMedia::createTimeRemainingDisplay): Ditto.
+        (WebCore::RenderMedia::updateControls): Ditto.
+        (WebCore::RenderMedia::forwardEvent): Ditto.
+        * rendering/RenderMedia.h:
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paint): Deal with the new elements.
+
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintMediaRewindButton): Deal with the new elements.
+        (WebCore::RenderTheme::paintMediaReturnToRealtimeButton): Ditto.
+        (WebCore::RenderTheme::paintMediaControlsBackground): Ditto.
+
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaRewindButton): Deal with the new elements.
+        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton): Ditto.
+        (WebCore::RenderThemeMac::paintMediaControlsBackground): Ditto.
+
+        * rendering/style/RenderStyleConstants.h: Add constants for the new elements.
+
+2009-07-01  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Small refactoring of MessagePortChannel so that PlatformMessagePortChannel
+        may be defined at the WebKit layer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26905
+
+        * dom/MessageChannel.cpp:
+        (WebCore::MessageChannel::MessageChannel):
+        * dom/MessagePortChannel.cpp:
+        * dom/MessagePortChannel.h:
+        * dom/default/PlatformMessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::createChannel):
+        (WebCore::MessagePortChannel::create):
+        (WebCore::MessagePortChannel::MessagePortChannel):
+        (WebCore::MessagePortChannel::~MessagePortChannel):
+
+2009-07-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <video> fails to show on http://camendesign.com/code/video_for_everybody
+        <rdar://problem/7026010>
+        https://bugs.webkit.org/show_bug.cgi?id=26919
+
+        Fix an issue introduced in r44961. In that revision we changed to only update
+        compositing layer geometry when all siblings had been laid out (i.e. we pushed
+        the updates one level down). However, that left out the root layer, so this
+        fix ensures that the root layer geometry gets updated at the end.
+
+        Test: compositing/geometry/root-layer-update.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+
+2009-07-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        <rdar://problem/7026010> <video> fails to show on http://camendesign.com/code/video_for_everybody
+
+        First part of fix: when outline width changes, don't to a synchronous
+        layer update right away, but just set the flag to say that compositing
+        layers need updating. The synchronous layer update left the layer geometries
+        out of whack when it happened in the middle of layout (e.g. when inside ::first-letter).
+        
+        Test: compositing/geometry/outline-change.html
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setMaximalOutlineSize):
+
+2009-07-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26842
+        Build fix when ENABLE_DATABASE is off
+
+        Move Database.h into ENABLE(DATABASE) guard so toggling ENABLE_DATABASE
+        off does not break builds.
+
+        * bindings/js/ScriptObjectQuarantine.cpp:
+
+2009-07-01  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26899
+        
+        Modified XSSAuditor::decodeURL to only remove null characters so that 
+        it is consistent with the behavior of HTMLTokenizer and prevents 
+        injected scripts that contain control characters. 
+
+        Tests: http/tests/security/xssAuditor/script-tag-control-char.html
+               http/tests/security/xssAuditor/script-tag-null-char.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::decodeURL): Modified to only remove null characters. 
+        * page/XSSAuditor.h: Reverted naming of third argument of method XSSAuditor::decodeURL
+        from allowControlCharacters back to allowNullCharacters.
+        * platform/network/ResourceResponseBase.cpp: Reverted back to rev #45003.
+        (WebCore::isControlCharacter):
+        * platform/network/ResourceResponseBase.h: Reverted back to rev #45003.  
+
+2009-07-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        - supported keyboard shortcuts compatible with Firebug in Scripts Debugger:
+        F5, Ctrl+/ (win,lin), Command+/ (mac) - continue
+        F10, Ctrl+' (win, lin), Command+' (mac) - step over
+        F11, Ctrl+; (win, lin), Command+; (mac) - step into
+        Shift+F11, Ctrl+Shift+; (win, lin), Command+Shift+; (mac) - step out
+
+        - added call stack navigation shortcuts:
+        Ctrl+. - next call frame
+        Ctrl+, - previouse call frame
+
+        https://bugs.webkit.org/show_bug.cgi?id=23849
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane):
+        (WebInspector.CallStackSidebarPane.prototype.handleKeyEvent):
+        (WebInspector.CallStackSidebarPane.prototype._selectNextCallFrameOnStack):
+        (WebInspector.CallStackSidebarPane.prototype._selectPreviousCallFrameOnStack):
+        (WebInspector.CallStackSidebarPane.prototype._selectedPlacardByIndex):
+        (WebInspector.CallStackSidebarPane.prototype._selectedCallFrameIndex):
+        * inspector/front-end/KeyboardShortcut.js: Added.
+        (WebInspector.KeyboardShortcut):
+        (WebInspector.KeyboardShortcut.makeKey):
+        (WebInspector.KeyboardShortcut.makeKeyFromEvent):
+        (WebInspector.KeyboardShortcut.makeKeyFromCodeAndModifiers_):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.handleKeyEvent):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-07-01  Daniel Erat  <derat@google.com>
+
+        Reviewed by David Levin.
+
+        Chromium Linux: Move the scrollbar thumb on middle-click.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26910
+        http://code.google.com/p/chromium/issues/detail?id=11976
+
+        Tested by building Chrome and checking that the scrollbar moves as expected.
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        * platform/chromium/ScrollbarThemeChromium.h:
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        * platform/chromium/ScrollbarThemeChromiumLinux.h:
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        * platform/chromium/ScrollbarThemeChromiumWin.h:
+
+2009-07-01  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a preference/setting to toggle whether content sniffing is enabled for file URLs.
+
+        * WebCore.base.exp:
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setLocalFileContentSniffingEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::localFileContentSniffingEnabled):
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+
+2009-07-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26909: aria-label needs to be supported
+        https://bugs.webkit.org/show_bug.cgi?id=26909
+
+        Test: accessibility/aria-label.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        * html/HTMLAttributeNames.in:
+
+2009-07-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        More datagrid columns work.  Make sure columns cache both a style for the column header as well
+        as a style for the column background (behind the cells).
+
+        Hook up to CSSStyleSelector methods for obtaining the pseudo styles for columns (stubbed out and
+        unimplemented).
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::pseudoStyleForDataGridColumn):
+        (WebCore::CSSStyleSelector::pseudoStyleForDataGridColumnHeader):
+        * css/CSSStyleSelector.h:
+        * html/DataGridColumn.h:
+        (WebCore::DataGridColumn::setColumnList):
+        (WebCore::DataGridColumn::columnStyle):
+        (WebCore::DataGridColumn::setColumnStyle):
+        (WebCore::DataGridColumn::headerStyle):
+        (WebCore::DataGridColumn::setHeaderStyle):
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::recalcStyleForColumn):
+        (WebCore::RenderDataGrid::columnStyle):
+        (WebCore::RenderDataGrid::headerStyle):
+        (WebCore::RenderDataGrid::paintColumnHeaders):
+        * rendering/RenderDataGrid.h:
+
+2009-07-01  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        <rdar://problem/7009870> After <audio> movie finishes playing, Pause button fails to change 
+        back to Play button
+
+        Grab onto the current time when QTKit "ended" notification fires and use it as 
+        duration from that point on as QuickTime sometimes refuses to play all the way to
+        the time it reports for duration and buffered. HTMLMediaElement assumes that there
+        more to play in this situation and tries to restart playback, endlessly.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+            Rename m_duration to m_reportedDuration. Declare m_cachedDuration.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+            Rename m_duration to m_reportedDuration. Initialize m_cachedDuration.
+        (WebCore::MediaPlayerPrivate::duration):
+            Return m_cachedDuration once it has been set.
+        (WebCore::MediaPlayerPrivate::updateStates):
+            Rename m_duration to m_reportedDuration.
+        (WebCore::MediaPlayerPrivate::didEnd):
+            Set m_cachedDuration to currentTime().
+
+2009-07-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 26900: AX: Manual spell check with Command-; does not bring up suggestions
+        https://bugs.webkit.org/show_bug.cgi?id=26900
+
+        Editable web areas should have a clickpoint that uses where the selection is.
+
+        Test: accessibility/editable-webarea-context-menu-point.html
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::clickPoint):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-07-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove unused code in SVGTransformList and SVGTransformDistance
+        <https://bugs.webkit.org/show_bug.cgi?id=26891>
+
+        * svg/SVGTransformDistance.cpp:
+        (WebCore::SVGTransformDistance::SVGTransformDistance):
+        * svg/SVGTransformList.cpp:
+        * svg/SVGTransformList.h:
+
+2009-07-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Begin stubbing out functions for layout, painting and style/geometry caching on columns.  Not enough
+        is implemented for this to do much of anything yet, but it should help keep patch sizes down. :)
+
+        * html/DataGridColumn.cpp:
+        (WebCore::DataGridColumn::columnChanged):
+        * html/DataGridColumn.h:
+        (WebCore::DataGridColumn::setId):
+        (WebCore::DataGridColumn::setLabel):
+        (WebCore::DataGridColumn::setType):
+        (WebCore::DataGridColumn::setSortable):
+        (WebCore::DataGridColumn::setSortDirection):
+        (WebCore::DataGridColumn::setColumnList):
+        (WebCore::DataGridColumn::style):
+        (WebCore::DataGridColumn::setStyle):
+        (WebCore::DataGridColumn::rect):
+        (WebCore::DataGridColumn::setRect):
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::DataGridColumnList):
+        (WebCore::DataGridColumnList::setDataGridNeedsLayout):
+        (WebCore::DataGridColumnList::add):
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::move):
+        (WebCore::DataGridColumnList::clear):
+        (WebCore::DataGridColumnList::primaryColumnChanged):
+        * html/DataGridColumnList.h:
+        (WebCore::DataGridColumnList::create):
+        (WebCore::DataGridColumnList::dataGrid):
+        (WebCore::DataGridColumnList::clearDataGrid):
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
+        (WebCore::HTMLDataGridColElement::findDataGridAncestor):
+        (WebCore::HTMLDataGridColElement::insertedIntoTree):
+        (WebCore::HTMLDataGridColElement::removedFromTree):
+        * html/HTMLDataGridColElement.h:
+        (WebCore::HTMLDataGridColElement::dataGrid):
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        (WebCore::HTMLDataGridElement::~HTMLDataGridElement):
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::styleDidChange):
+        (WebCore::RenderDataGrid::recalcStyleForColumns):
+        (WebCore::RenderDataGrid::recalcStyleForColumn):
+        (WebCore::RenderDataGrid::styleForColumn):
+        (WebCore::RenderDataGrid::layout):
+        (WebCore::RenderDataGrid::layoutColumns):
+        (WebCore::RenderDataGrid::paintColumnHeaders):
+        (WebCore::RenderDataGrid::paintColumnHeader):
+        * rendering/RenderDataGrid.h:
+        (WebCore::RenderDataGrid::renderName):
+        (WebCore::RenderDataGrid::canHaveChildren):
+
+2009-07-01  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26807
+        
+        Fixes this address by checking whether frame->document()->decoder() is null. 
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::findInRequest):
+
+2009-07-01  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26885
+
+        Correctly reset history length to '0', not '1'. Old relict from early WML days.
+        Add some new WML testcases covering the use of history length (by onenterforward event handling)
+
+        Tests: wml/onenterforward-event.html
+               wml/onenterforward-inline-event.html
+               wml/ontimer-event.html
+ 
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::reset):
+
+2009-07-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Make sure setting attributes on dcol elements properly updates the corresponding DataGridColumn object.
+
+        Added new test in fast/dom/HTMLDataGridElement.
+
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::parseMappedAttribute):
+        * html/HTMLDataGridColElement.h:
+
+2009-07-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/6998524> REGRESSION (r44474): Form text field has focus ring, looks focused,
+        even though the field is not actually focused for keyboard input
+        
+        Add the concept of whether or not the Page is focused by adding a boolean to the focusController.  This allows the
+        focused frame and focused node to both be cached and changed programmatically even when the Page itself doesn't
+        actually happen to have focus at that time.
+
+        * WebCore.base.exp:
+        * page/FocusController.cpp:
+        (WebCore::FocusController::FocusController):
+        (WebCore::FocusController::setFocusedFrame):
+        (WebCore::FocusController::setFocused):
+        (WebCore::FocusController::setActive):
+        * page/FocusController.h:
+        (WebCore::FocusController::isFocused):
+
+2009-07-01  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Move some API headers from WebCore.pro to headers.pri so that they
+        get installed when running make install from the build directory.
+
+        * WebCore.pro:
+
+2009-07-01  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Ariya Hidayat.
+
+        Ran WebKitTools/Scripts/generate-qt-inspector-resource to update the
+        qrc file with new png files from the web inspector.
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-06-30  Mark Rowe  <mrowe@apple.com>
+
+        Land some code that has a hope of compiling.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::imageSourceOptions):
+
+2009-06-30  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Flip back on block caching. Throwing away block data, while 
+        a perceived memory win, is a performance hit in cases where we 
+        are repainting large images (i.e. backgrounds) frequently 
+        (i.e. a flash video playing on top).  
+        <rdar://problem/6933515> REGRESSION(L-SL): Large JPEG images are 
+        decoded on drawing, slowing down painting of sites that frequently 
+        repaint e.g. because of Flash (pandora.com, Starcraft 2)
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::imageSourceOptions):
+
+2009-06-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - Rename html4.css to html.css, since we target HTML5 now
+        https://bugs.webkit.org/show_bug.cgi?id=26873
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::loadFullDefaultStyle):
+        * css/html.css: Copied from css/html4.css.
+        * css/html4.css: Removed.
+        * css/themeWin.css:
+        * platform/Theme.h:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        * rendering/RenderTheme.h:
+
+2009-06-30  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Drag and drop support
+        https://bugs.webkit.org/show_bug.cgi?id=23642
+
+        Define DragImageRef as GdkPixbuf and implement essential
+        functions which manipulate drag images.
+
+        * platform/DragImage.h:
+        * platform/gtk/DragImageGtk.cpp:
+        (WebCore::dragImageSize):
+        (WebCore::deleteDragImage):
+        (WebCore::scaleDragImage):
+        (WebCore::createDragImageFromImage):
+
+2009-06-30  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        StorageNamespace.cpp build issue
+        https://bugs.webkit.org/show_bug.cgi?id=26859
+
+        Moved #endif //ENABLE(DOM_STORAGE) position
+        so that the build doesn't fail.
+        The namespace WebCore was started after the #if ENABLE(DOM_STORAGE)
+        but closed after the #endif.
+
+        * storage/StorageNamespace.cpp:
+
+2009-06-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7020825> HTMLMediaElement should not assume seeking is only possible in 
+        buffered time ranges
+
+        * html/HTMLMediaElement.cpp:
+            Don't ASSERT if the network state goes to Idle when when the ready state is 
+            HaveEnoughData or higher, it is perfectly legal.
+        (WebCore::HTMLMediaElement::setReadyState): 
+            Don't clear m_seeking after posting a 'seeking' event.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::seek):
+            Do nothing when asked to seek to the same time we are already seeking to. Check requested
+            seek time against maxTimeSeekable, not maxTimeLoaded.
+        (WebCore::MediaPlayerPrivate::doSeek):
+            Don't bother stopping a movie that isn't playing. Minor cleanup to make the code more readable.
+        (WebCore::MediaPlayerPrivate::seekTimerFired):
+            Check requested seek time against maxTimeSeekable, not maxTimeLoaded.
+        (WebCore::MediaPlayerPrivate::updateStates):
+            A streaming movie has as much data as it needs once it reaches "playable", so 
+            set the ready state to HaveFutureData. A movie with metadata doesn't drop back 
+            to "have nothing" when seeking. A streaming movie doesn't use the network when paused.
+        (WebCore::MediaPlayerPrivate::timeChanged):
+            It may not be possible to seek to a specific time in a streamed movie but when seeking 
+            in a streaming movie QuickTime sets the time to closest time possible and posts a  
+            timechanged notification, so update m_seekTo so we can detect when the seek completes.
+
+2009-06-30  Steve Falkenburg  <sfalken@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=26860
+
+        Reviewed by Sam Weinig.
+
+        Blacklist Yahoo Application State plug-in for versions prior to 1.0.0.6.
+        Earlier versions cause corruption crashes.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::isPluginBlacklisted):
+
+2009-06-30  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7005207> <video> in canvas broken with ACCEL_COMPOSITING
+        
+        Fix drawImage of video in CanvasRenderingContext2D when
+        accelerated compositing is enabled. This is done by
+        adding a new paint method to HTMLVideoElement that
+        is only called from canvas, which will create the software
+        renderer if necessary, but otherwise calls the regular
+        paint method. Meanwhile, add logic to the software video
+        renderer so that it can be created without calling repaint
+        every time it sees a new frame.
+        
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::paintCurrentFrameInContext):
+        * html/HTMLVideoElement.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::paintCurrentFrameInContext):
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::paintCurrentFrameInContext):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie):
+        (WebCore::MediaPlayerPrivate::createQTVideoRenderer):
+        (WebCore::MediaPlayerPrivate::currentRenderingMode):
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
+        (WebCore::MediaPlayerPrivate::paintCurrentFrameInContext):
+
+2009-06-30  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26858
+
+        Get <dcol> elements reflected into the datagrid's column list.  Make sure columns get added/removed
+        properly.  (Attribute changes are still not caught.  That is coming in a separate patch.)
+
+        Added fast/dom/HTMLDataGridElement/DataGridColumns-dom.html
+
+        * html/DataGridColumn.h:
+        (WebCore::DataGridColumn::create):
+        (WebCore::DataGridColumn::setColumnList):
+        (WebCore::DataGridColumn::DataGridColumn):
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::add):
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::clear):
+        * html/DataGridColumnList.h:
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
+        (WebCore::HTMLDataGridColElement::findDatagridAncestor):
+        (WebCore::HTMLDataGridColElement::ensureColumn):
+        (WebCore::HTMLDataGridColElement::insertedIntoTree):
+        (WebCore::HTMLDataGridColElement::removedFromTree):
+        (WebCore::HTMLDataGridColElement::sortable):
+        (WebCore::HTMLDataGridColElement::setSortable):
+        * html/HTMLDataGridColElement.h:
+        (WebCore::HTMLDataGridColElement::column):
+        (WebCore::HTMLDataGridColElement::setColumn):
+        (WebCore::HTMLDataGridColElement::datagrid):
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::setDataSource):
+        (WebCore::HTMLDataGridElement::dataSource):
+
+2009-06-30  Jeremy Orlow (jorlow@chromium.org)
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26852
+
+        Fix some minor build issues in the v8 bindings.
+
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
+        (WebCore::storageGetter):
+        (WebCore::storageSetter):
+        (WebCore::storageDeleter):
+        * storage/StorageArea.cpp:
+
+2009-06-30  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: use different fonts for each script run.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26853
+
+        Previously, when rendering complex text, we picked a single font which
+        could render all the glyphs needed for the run. However, this meant
+        that sometimes lines were rendered with, for example, [LATIN, THAI,
+        LATIN] and we could end up with a different font for the Latin parts
+        than for lines without Thai in them.
+
+        With this patch, we pick a font for each script run.
+
+        This change is covered by existing layout tests.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::drawGlyphs):
+        (WebCore::TextRunWalker::TextRunWalker):
+        (WebCore::TextRunWalker::~TextRunWalker):
+        (WebCore::TextRunWalker::nextScriptRun):
+        (WebCore::TextRunWalker::fontPlatformDataForScriptRun):
+        (WebCore::TextRunWalker::setupFontForScriptRun):
+        (WebCore::TextRunWalker::allocHarfbuzzFont):
+        (WebCore::setupForTextPainting):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::setupPaint):
+
+2009-06-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt, Dan Bernstein.
+        
+        <rdar://problem/6191676> Redraw issues scrolling overflow:scroll div with compositing
+
+        There are two parts to this fix. First, if a compositing layer has overflow clipping
+        or a mask, then the compositing layer does not need to be sized to encompass all
+        non-composited children.
+        
+        Second, when scrolling, we have to back up to the compositing ancestor and have
+        it reposition descendant compositing layers, because overflow doesn't follow
+        the z-order tree.
+        
+        Test: compositing/overflow/overflow-scroll.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        Pass the UpdateCompositingLayers flag when updating layers after layout, so that
+        we can reposition compositing layers if we're not about to do a layer rebuild.
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        Only update compositing layers if the flag is set.
+        
+        (WebCore::RenderLayer::scrollToOffset):
+        Do compositing layer updates from the compositing ancestor in one fell swoop.
+
+        * rendering/RenderLayer.h:
+        Replace the unused FullUpdate flag with one that allows us to specify whether
+        compositing layers should be updated.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        * rendering/RenderLayerBacking.h:
+        New param that we can pass to updateCompositingDescendantGeometry to control
+        whether the update goes deep.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        We can return earlier if this is not a self-painting layer.
+        If the layer has overflow clip or a mask, then the composited bounds are just the
+        local bounds, excluding descendants.
+        
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry):
+        * rendering/RenderLayerCompositor.h:
+        Renamed from updateCompositingChildrenGeometry, and added a flag that allows
+        us to do a deep update.
+
+2009-06-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26764
+        Uncaught NOT_FOUND_ERR: DOMException 8 loading empty text file
+
+        Test: fast/parser/empty-text-resource.html
+
+        * loader/TextDocument.cpp: (WebCore::TextTokenizer::finish): Create document tree if it
+        hasn't been created yet.
+
+2009-06-30  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Renamed scrollbarUnderPoint to scrollbarAtPoint.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollbarAtPoint):
+        * platform/ScrollView.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleMouseDownEvent):
+        (WebCore::PopupListBox::handleMouseMoveEvent):
+
+2009-06-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6960286> CrashTracer: [REGRESSION] 1120 crashes in Safari at com.apple.WebCore WebCore::JSLazyEventListener::parseCode const 62
+
+        <select> elements and other elements the produce popups can keep their popups
+        live across a page load.  If this occurs and the <select> element has an
+        onchange handler it is possible to get into a state where we try to execute
+        JS on a page that no longer has an execution context. 
+
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode):
+          Be paranoid and add a null check, but assert as well because we shouldn't
+          actually get to this point.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::valueChanged):
+
+2009-06-30  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25435>
+
+        Added support for sending MessagePorts to/from Workers via postMessage().
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::messageChannel):
+        Exposes MessageChannel constructor WorkerContext.
+        * bindings/js/JSWorkerCustom.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Now correctly handles being instantiated from within a Worker.
+       * platform/CrossThreadCopier.h:
+        (WebCore::GenericWorkerTaskTraits<PassOwnPtr>):
+        Added support for passing PassOwnPtr as argument to GenericWorkerTask
+       * workers/GenericWorkerTask.h:
+        (WebCore::):
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        Now handles disentangling/entangling MessagePorts sent to/from via postMessage.
+        (WebCore::Worker::dispatchMessage):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        Added an optional MessagePort argument to postMessage()
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::hasPendingActivity):
+        Workers now report pending activity whenever there are remotely entangled ports.
+        (WebCore::WorkerContext::postMessage):
+        Now handles disentangling/entangling MessagePorts sent to/from via postMessage.
+        (WebCore::WorkerContext::dispatchMessage):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        Added an optional MessagePort argument to postMessage()
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        Updated messaging infrastructure to transport an optional MessagePort/MessagePortChannel.
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        Added additional postMessage() API that accepts a MessagePort
+        * workers/WorkerObjectProxy.h:
+        Added additional postMessage() API that accepts a MessagePort
+
+2009-06-30  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: Add complex text support on Linux.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25068
+
+        This patch adds complex text support on Linux using Harfbuzz. It's not
+        the fastest code possible: some caching of font tables will certainly
+        be required. However, it's probably the simplest code that works.
+
+        This will require checking in new baselines in the Chromium tree for
+        those layout tests which now pass.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::drawGlyphs):
+        (WebCore::truncateFixedPointToInteger):
+        (WebCore::TextRunWalker::TextRunWalker):
+        (WebCore::TextRunWalker::~TextRunWalker):
+        (WebCore::TextRunWalker::reset):
+        (WebCore::TextRunWalker::setXOffsetToZero):
+        (WebCore::TextRunWalker::rtl):
+        (WebCore::TextRunWalker::setBackwardsIteration):
+        (WebCore::TextRunWalker::nextScriptRun):
+        (WebCore::TextRunWalker::glyphs):
+        (WebCore::TextRunWalker::length):
+        (WebCore::TextRunWalker::xPositions):
+        (WebCore::TextRunWalker::advances):
+        (WebCore::TextRunWalker::width):
+        (WebCore::TextRunWalker::logClusters):
+        (WebCore::TextRunWalker::numCodePoints):
+        (WebCore::TextRunWalker::widthOfFullRun):
+        (WebCore::TextRunWalker::allocHarfbuzzFont):
+        (WebCore::TextRunWalker::deleteGlyphArrays):
+        (WebCore::TextRunWalker::createGlyphArrays):
+        (WebCore::TextRunWalker::expandGlyphArrays):
+        (WebCore::TextRunWalker::shapeGlyphs):
+        (WebCore::TextRunWalker::setGlyphXPositions):
+        (WebCore::setupForTextPainting):
+        (WebCore::fontPlatformDataForTextRun):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::glyphIndexForXPositionInScriptRun):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        * platform/graphics/chromium/HarfbuzzSkia.cpp: Added.
+        (WebCore::SkiaScalarToHarfbuzzFixed):
+        (WebCore::stringToGlyphs):
+        (WebCore::glyphsToAdvances):
+        (WebCore::canRender):
+        (WebCore::getOutlinePoint):
+        (WebCore::getGlyphMetrics):
+        (WebCore::getFontMetric):
+        (WebCore::harfbuzzSkiaGetTable):
+
+2009-06-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7019799> Slow loading MediaDocument can fall back to plug-in unnecessarily
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::updateStates):
+            Always fall back to a plug-in if m_hasUnsupportedTracks is set.
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
+            Set m_hasUnsupportedTracks if we disable a track.
+
+2009-06-30  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix inverted if/else that's causing a layout test in src.chromium.org to fail.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26820
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::GCPrologueVisitor::visitDOMWrapper): if (port2), not if (!port2).
+
+2009-06-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6946611> REGRESSION (r30673): Shade10:" D_Snap
+          to Grid" window is clipping
+
+        Added an app-specific quirk to revert the behavior of <link> elements
+        to the way it was before r30673, namely that if the rel attribute
+        is not "stylesheet" but the type attribute contains "text/css", the
+        link behaves as a stylesheet link.
+
+        * WebCore.base.exp: Exported setTreatsAnyTextCSSLinkAsStylesheet().
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process): Check
+            Settings::treatsAnyTextCSSLinkAsStylesheet() and if true, allow a
+            style sheet link if the type contains "text/css".
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+            Initialize m_treatsAnyTextCSSLinkAsStylesheet.
+        (WebCore::Settings::setTreatsAnyTextCSSLinkAsStylesheet): Added.
+        * page/Settings.h:
+        (WebCore::Settings::treatsAnyTextCSSLinkAsStylesheet): Added.
+
+2009-06-30  Adrien Nader  <camaradetux@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        Fix typo in GNUMakefile.am: it reads WebCOre instead of WebCore.
+
+        * GNUmakefile.am:
+
+2009-06-30  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Turn on ENABLE_DATAGRID so we can run the layout tests.
+
+        * GNUmakefile.am:
+
+2009-06-30  Raju Kunnath  <raju.kunnath@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26752>
+
+        [Qt] Windows release build issue with Qt4.5 due to -GL flag on msvc2005 and msvc2008. 
+
+        * WebCore.pro: Removed -GL compiler option for win32-msvc2005|win32-msvc2008.
+
+2009-06-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Initialize member variables in the right order. Fixes compiler
+        warning.
+
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::BMPImageReader):
+
+2009-06-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26831
+        Fix compiler warning in WorkerLoaderProxy.h
+
+        Forward declaration of a class within a class is not allowed,
+        since the compiler can't know if the declaration is legal at that
+        point. This gives the following compiler warning:
+
+        ../../WebCore/workers/WorkerLoaderProxy.h:40: warning: declaration
+        "class WebCore::ScriptExecutionContext::Task" does not declare
+        anything
+
+        Include the full ScriptExecutionHeader header instead.
+
+        * workers/WorkerLoaderProxy.h:
+
+2009-06-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Remove unused function.
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+
+2009-06-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Change RenderLayer::updateLayerPositions() to use a bitmask instead of two
+        boolean arguments. FullUpdate is unused at present, but will be used soon.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::):
+
+2009-06-29  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix one more bad merge in V8Proxy.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26819
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException): setDOMExceptionHelper() instead of convertToV8Object().
+
+2009-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove more unused scons support.
+
+        * SConstruct: Removed.
+
+2009-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix some incorrect create functions.
+
+        * html/DataGridColumn.h:
+        (WebCore::DataGridColumn::create):
+        * html/DataGridColumnList.h:
+        (WebCore::DataGridColumnList::create):
+
+2009-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Remove initialize method from DataGridDataSource and add
+        DOMDataGridDataSource.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSDataGridDataSource.cpp:
+        * bindings/js/JSDataGridDataSource.h:
+        * bindings/js/JSHTMLDataGridElementCustom.cpp:
+        (WebCore::JSHTMLDataGridElement::setDataSource):
+        * html/DOMDataGridDataSource.cpp: Added.
+        (WebCore::DOMDataGridDataSource::DOMDataGridDataSource):
+        (WebCore::DOMDataGridDataSource::~DOMDataGridDataSource):
+        * html/DOMDataGridDataSource.h: Added.
+        (WebCore::DOMDataGridDataSource::create):
+        (WebCore::DOMDataGridDataSource::isDOMDataGridDataSource):
+        (WebCore::asDOMDataGridDataSource):
+        * html/DataGridDataSource.h:
+        (WebCore::DataGridDataSource::isDOMDataGridDataSource):
+        (WebCore::DataGridDataSource::isJSDataGridDataSource):
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        (WebCore::HTMLDataGridElement::setDataSource):
+        (WebCore::HTMLDataGridElement::dataSource):
+        * html/HTMLDataGridElement.h:
+
+2009-06-29  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a couple of bad merge items from my previous V8Proxy patch.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26813
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::nodeCollectionNamedPropertyGetter):  Fix a bad function name that slipped through.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException):  Fix a bad merge that caused a couple of lines of extraneous, breaking code to get in.
+
+2009-06-29  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26706
+
+        Fixed crash due to dereference of m_toStyle
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::isTargetPropertyEqual):
+
+2009-06-29  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7014813> Ask media engine if a movie is streamed or downloaded.
+
+        * WebCore.base.exp: 
+            Export _wkQTMovieGetType
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::hasSingleSecurityOrigin):
+            Move to keep with other non-callback functions.
+        (WebCore::MediaPlayer::movieLoadType):
+            New, returns the movie type.
+        * platform/graphics/MediaPlayer.h:
+            Declare MovieLoadType enum and movieLoadType method.
+
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::movieLoadType):
+            Default implementation of movieLoadType
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie):
+            Don't base m_isStreaming on protocol, there are other types of streaming movies.
+        (WebCore::MediaPlayerPrivate::maxTimeBuffered):
+            Don't assume all streams are unbuffered.
+        (WebCore::MediaPlayerPrivate::updateStates):
+            Update m_isStreaming once we have metadata.
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
+            Tracks that are disabled to begin with shouldn't be included in m_enabledTrackCount.
+        (WebCore::MediaPlayerPrivate::movieLoadType):
+            New, return movie type.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+            Add wkQTMovieGetType.
+
+2009-06-29  Alice Liu  <alice.liu@apple.com>
+
+        Fixed <rdar://problem/6930280> Reproducible crash at USA Today photo gallery
+
+        Reviewed by Anders Carlsson.
+
+        No test added because the crash requires a flash plugin
+
+        * plugins/win/PluginMessageThrottlerWin.cpp:
+        Rely on the hWnd of the plugin to tell us whether the PluginView has 
+        been deleted during execution of its wndProc.
+        (WebCore::PluginMessageThrottlerWin::messageThrottleTimerFired):
+
+2009-06-29  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26811
+         [Chromium] Remove a flag and functions used to enable workers in runtime.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/WorkerContextExecutionProxy.h:
+
+2009-06-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        <rdar://problem/6976712> Text antialiasing problems when rendering into compositing layers.
+        
+        Improve the appearance of text in compositing layers by making use of
+        CA's layer geometry flipping, rather that doing it ourselves with a flip
+        transform. This allows CG to use font autohinting in the layer text.
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setGeometryOrientation):
+        (WebCore::GraphicsLayer::geometryOrientation):
+        New methods to set whether this layer uses flipped geometry.
+        
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setGeometryOrientation):
+        (WebCore::GraphicsLayerCA::geometryOrientation):
+        Subclass in order to call into CA
+        
+        (WebCore::GraphicsLayerCA::setContentsLayer):
+        Now that CA is doing the geometry flipping, we no longer need to flip the content
+        layers for image and video manually
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        Turn on flipping on the root layer.
+
+2009-06-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26246
+
+        Implement most WML specific <select> element features.
+        Add 'iname' / 'ivalue' support and support variable references.
+
+        Add two tests covering most select/variable related functionality.
+        Needs more tests when adding full 'iname' / 'ivalue' support (used in conjuction with onpick).
+
+        Tests: http/tests/wml/post-data-to-server.html
+               wml/select-element-variables.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::optionCount): Refactored from HTMLSelectElement::length() for use within HTML & WML.
+        * dom/SelectElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::length): Use new SelectElement::optionCount() function. (no functional changes for HTML).
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded): Activated commented code taking care of WMLSelectElement initialization.
+        * wml/WMLSelectElement.cpp: Add a bunch of new code handling WML specific feature processing.
+        (WebCore::WMLSelectElement::title):
+        (WebCore::WMLSelectElement::formControlName):
+        (WebCore::WMLSelectElement::defaultEventHandler):
+        (WebCore::WMLSelectElement::selectInitialOptions):
+        (WebCore::WMLSelectElement::calculateDefaultOptionIndices):
+        (WebCore::WMLSelectElement::selectDefaultOptions):
+        (WebCore::WMLSelectElement::initializeVariables):
+        (WebCore::WMLSelectElement::updateVariables):
+        (WebCore::WMLSelectElement::parseIndexValueString):
+        (WebCore::WMLSelectElement::valueStringToOptionIndices):
+        (WebCore::WMLSelectElement::optionIndicesToValueString):
+        (WebCore::WMLSelectElement::optionIndicesToString):
+        (WebCore::WMLSelectElement::name):
+        (WebCore::WMLSelectElement::value):
+        (WebCore::WMLSelectElement::iname):
+        (WebCore::WMLSelectElement::ivalue):
+        * wml/WMLSelectElement.h:
+
+2009-06-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Put <datagrid> behind an ifdef.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * bindings/js/JSDataGridColumnListCustom.cpp:
+        * bindings/js/JSDataGridDataSource.cpp:
+        * bindings/js/JSDataGridDataSource.h:
+        * bindings/js/JSHTMLDataGridElementCustom.cpp:
+        * html/DataGridColumn.cpp:
+        * html/DataGridColumn.h:
+        * html/DataGridColumn.idl:
+        * html/DataGridColumnList.cpp:
+        * html/DataGridColumnList.h:
+        * html/DataGridColumnList.idl:
+        * html/DataGridDataSource.h:
+        * html/HTMLDataGridCellElement.cpp:
+        * html/HTMLDataGridCellElement.h:
+        * html/HTMLDataGridCellElement.idl:
+        * html/HTMLDataGridColElement.cpp:
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.cpp:
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp:
+        * html/HTMLDataGridRowElement.h:
+        * html/HTMLDataGridRowElement.idl:
+        * html/HTMLTagNames.in:
+        * page/DOMWindow.idl:
+        * rendering/RenderDataGrid.cpp:
+        * rendering/RenderDataGrid.h:
+
+2009-06-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat and Adam Roben.
+
+        Fix compilation with MINGW. Ported MSVC inline assembly to
+        GNU inline assembly. Also fixed casting errors where gcc
+        refused to cast a pointer-to-function to a pointer-to-object,
+        without an intermediate cast to a non-pointer type.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+        (WebCore::hook):
+        (WebCore::setUpOffscreenPaintingHooks):
+
+2009-06-26  John Sullivan  <sullivan@apple.com>
+
+        Added Speech submenu to context menu on Mac when there's a non-editable selection
+        (it was already present when there's an editable selection). 
+        Also added support for disabling "Stop Speaking" when there is no speaking to stop.
+
+        Reviewed by Tim Hatcher.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyContextMenuClient::isSpeaking):
+        implemented this new virtual function to return false
+        
+        * page/ContextMenuClient.h:
+        declared this new pure virtual function
+        
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        insert Speech item (after a separator) on Mac when there's selected non-editable text
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        enable Stop Speaking item only if the context menu client returns true for isSpeaking()
+
+2009-06-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26783
+          <rdar://problem/7014543> REGRESSION (r45296): Subfolders not displayed
+          in MobileMe iDisk Web App
+
+        Test: added a case to fast/dom/Element/scrollWidth.html
+
+        Ensure that scroll{Width, Height} is greater or equal to
+        client{Width, Height}.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26780
+        
+        Do not make compositing layers for non-self-painting RenderLayers,
+        since these exist only to push a clip onto the clipping stack. If such
+        a layer gets compositied for some other reason, it should not paint.
+        
+        Also ensure that we update composited layer positions correctly
+        inside overflow:scroll layers. We can't assume that the contents
+        are child layers, so we have to go up to the compositing ancestor,
+        and tell it to update all its child layer positions as we do 
+        after layout.
+
+        Tests: compositing/layers-inside-overflow-scroll.html
+               compositing/self-painting-layers.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+
+2009-06-28  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
+
+        Reviewed by Eric Seidel.
+
+        PurgeableBuffer #defines leave out functions on gtk MacOSX 10.4 build
+        https://bugs.webkit.org/show_bug.cgi?id=23057
+
+        Define these functions for Gtk as well.
+
+        * platform/PurgeableBuffer.h:
+
+2009-06-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Update CodeGeneratorV8.pm to match the new api for V8Proxy.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26765
+
+        * bindings/scripts/CodeGeneratorV8.pm: Match the current version of V8Proxy.
+
+2009-06-28  Nicolas Sylvain  <nsylvain@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        If loading a font fails because of the sandbox, we ask the browser process to 
+        try to load it by calling ensureFontLoaded. If it still fails after 
+        ensureFontLoaded, we hit a ASSERT_NOT_REACHED. 
+
+        This case happens once in a while during browser shutdown. The browser will 
+        queue a message to the renderer to shutdown, and will then stop answering sync 
+        messages from the renderer. If the renderer is still loading a page during this 
+        time, it might try to call the browser process to ask to load a font. The 
+        browser process will ignore the request, and the font will fail to load, even 
+        after the second try. 
+
+        This is unfortunate, but there is no real risk here, since the renderer will be 
+        going away as soon as it processes another message. 
+
+        This can't be layout tested as it depends on the sandbox. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=26743 
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+
+2009-06-28  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15457
+
+        Test: plugins/netscape-plugin-map-data-to-src.html
+
+        Fix problems with Real or WMP plugins not displaying because "data" was set
+        on the OBJECT tag instead of "src".  This is based on what Firefox does, see
+        http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsObjectFrame.cpp#3045
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::mapDataParamToSrc):
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-06-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [Qt] Build fix after r45290
+        https://bugs.webkit.org/show_bug.cgi?id=26769
+
+        * WebCore.pro:
+
+2009-06-27  Emilio Pozuelo Monfort  <pochu27@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Don't use deprecated GTKsymbols.
+        https://bugs.webkit.org/show_bug.cgi?id=26583
+
+        * plugins/gtk/gtk2xtbin.c:
+        (gtk_xtbin_class_init):
+        (gtk_xtbin_new):
+        (gtk_xtbin_destroy):
+
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26780
+        
+        Fix up previous change. When computeCompositingRequirements() determines
+        that the current layer is composited, it needs to inform its parent
+        by setting compositingState.m_subtreeIsCompositing() to true. That didn't
+        always happen after the previous patch. Clarified the logic here.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::CompositingState::CompositingState):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26780
+        
+        First part: fix the RenderLayer::hasCompositingDescendant() flag to be set
+        correctly.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        Do not unconditionally set compositingState.m_subtreeIsCompositing, because
+        that can clobber the value from an earlier sibling. Add some more comments.
+        
+        Remove a final use of Vector iterators.
+        
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
+        Move the normalFlowList() processing outside the test for isStackingContext().
+
+2009-06-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser and Antti Koivisto.
+
+        - make paintFillLayerExtended() non-virtual and remove its clipY and
+          clipH parameters
+
+        These parameters were computed and passed along to
+        paintFillLayerExtended in order to vertically constrain the rect fill to
+        the damage rect, because Qt cannot paint tall rectangles (see
+        <http://websvn.kde.org/?view=rev&revision=42721>). Since the damage rect
+        is passed along in the PaintInfo, the extra parameters are redundant,
+        and the intersection can just take place in paintFillLayerExtended().
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintFillLayers):
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintRootBoxDecorations):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::paintMask):
+        (WebCore::RenderBox::paintMaskImages):
+        (WebCore::RenderBox::paintFillLayers):
+        (WebCore::RenderBox::paintFillLayer):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations):
+        (WebCore::RenderFieldset::paintMask):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintBoxDecorations):
+        (WebCore::RenderTable::paintMask):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+        (WebCore::RenderTableCell::paintMask):
+
+2009-06-27  Ryosuke Niwa  <rniwa@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26762
+
+        Clean up for IndentOutdentCommand::indentRegion, and solved most of problems related to the bug 21712.
+        https://bugs.webkit.org/show_bug.cgi?id=21712
+
+        Added few utility functions to htmlediting.h/cpp
+
+        isVisibilyAdjacent checks whether the first position is visibly next to the second position.
+        i.e. there is no visible node between the first and second positions
+
+        canMergeLists checks whether two lists can be merged.
+        It checks the type of list, the editing boundary, and adjacency of the lists.
+
+        Tests: editing/execCommand/indent-nested-lists-1.html
+               editing/execCommand/indent-nested-lists-2.html
+               editing/execCommand/indent-nested-lists-3.html
+               editing/execCommand/indent-nested-lists-4.html
+               editing/execCommand/indent-nested-lists-5.html
+               editing/execCommand/indent-nested-lists-6.html
+               editing/execCommand/indent-nested-lists-7.html
+               editing/execCommand/outdent-nested-lists-1.html
+               editing/execCommand/outdent-nested-lists-2.html
+               editing/execCommand/outdent-nested-lists-3.html
+               editing/execCommand/outdent-nested-lists-4.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion):
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem):
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote):
+        (WebCore::IndentOutdentCommand::indentRegion):
+        * editing/IndentOutdentCommand.h:
+        * editing/htmlediting.cpp:
+        (WebCore::enclosingListChild):
+        (WebCore::canMergeLists):
+        (WebCore::isVisibilyAdjacent):
+        * editing/htmlediting.h:
+
+2009-06-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix completion when iterating options using Tab.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26722
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype._completionsReady):
+
+2009-06-27  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Override visibleContentRect to handle GTK+'s case, in which
+        scrollbars or equivalent decoration are painted by the parent
+        widget.
+
+        * platform/ScrollView.cpp:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::visibleContentRect):
+
+2009-06-27  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26708
+        
+        Fix addresses false negatives with respect to scheme relative paths, iFrame JavaScript URLs,
+        and UTF-7 encoded payloads.   
+
+        Tests: http/tests/security/xssAuditor/http-equiv-utf-7-encoded.html
+               http/tests/security/xssAuditor/iframe-javascript-url.html
+               http/tests/security/xssAuditor/script-tag-utf-7-encoded.html
+               http/tests/security/xssAuditor/script-tag-with-source-relative-scheme.html
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler): Moved XSSAuditor check to HTMLTokenizer::parseTag.
+        (WebCore::HTMLTokenizer::parseTag):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe): Modified to inform XSSAuditor of parent frame so
+        as to compare against iFrame javascript URL.
+        * page/XSSAuditor.cpp: Removed method XSSAuditor::isControlCharacter. Instead, exposed method
+        isControlCharacter in ResourceResponseBase.cpp.
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::decodeURL): Modified to decode string using specified encoder.
+        (WebCore::XSSAuditor::findInRequest): Generalized to arbitrary frame so as to prevent execution
+        of iFrame javascript URL.
+        * page/XSSAuditor.h: Added field m_parentFrame.
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::isControlCharacter):
+        * platform/network/ResourceResponseBase.h:
+
+2009-06-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 26771: Canvas is incorrectly tainted when drawing from a video element that uses <source> elements
+
+        The drawImage(<video>) logic naively assumes that it just needs
+        to check the src attribute of the video element when in fact it
+        needs to look at the url that is being played instead.  Failure
+        to do this means that video provided through source elements 
+        taints the canvas.
+
+        Test: media/video-canvas-source.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::checkOrigin):
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        * html/CanvasRenderingContext2D.h:
+
+2009-06-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26695
+        
+        Added the ability to do scrollbar hit testing in EventHandler, changed the
+        signature of a PlatformWheelEvent constructor, and changed scrollbarUnderMouse
+        to scrollbarUnderPoint, and updated all calls to that function.        
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/EventHandler.h:
+        (WebCore::):
+        * platform/PlatformWheelEvent.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollbarUnderPoint):
+        * platform/ScrollView.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleMouseDownEvent):
+        (WebCore::PopupListBox::handleMouseMoveEvent):
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7011924> Opacity transitions should not trigger hardware compositing mode
+        
+        Don't go into compositing mode just for opacity transitions, but they will be
+        hardware acclerated if we're already compositing.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForTransform):
+        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
+        * rendering/RenderLayerCompositor.h:
+
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber-stamped by Dave Levin
+
+        Rename ioCompState to compositingState to better match WebCore coding style.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+
+2009-06-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - revert unintentional project changes from r45277
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-06-26  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Windows build.
+
+        * WebCore.vcproj/WebCore.vcproj: Remove ColorSafari.cpp as
+        the file was deleted from SVN.
+
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26766
+
+        Change to use array indexing rather than Vector enumerators; the former
+        are preferred style.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::hasNonCompositingContent):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
+        (WebCore::RenderLayerCompositor::layerHas3DContent):
+
+2009-06-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix <rdar://problem/6961476> REGRESSION (r42043): scrollWidth reported
+          as 1 px
+
+        Test: fast/dom/Element/scrollWidth.html
+
+        Changed scrollWidth and scrollHeight to use the same logic for
+        visible overflow boxes that is used for clipped overflow boxes. In
+        particular, borders are not included and
+        {leftmost,rightmost,lowest}Position() are used. This logic matches IE8.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-06-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26725: aria-hidden, aria-disabled, aria-readonly need to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=26725
+
+        Tests: accessibility/aria-disabled.html
+               accessibility/aria-hidden.html
+               accessibility/aria-readonly.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaIsHidden):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isEnabled):
+        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+        * html/HTMLAttributeNames.in:
+
+2009-06-26  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26759
+
+        GIFImageDecoder is broken.
+
+        Make the GIFImageDecoder.repetitionCount function const to match the
+        base class. The mismatched definitions were causing the function to not
+        get called.
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::repetitionCount):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+
+2009-06-26  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        Additional fix for https://bugs.webkit.org/show_bug.cgi?id=26651
+
+        The flag should always default to true to avoid it getting set
+        to false in a build with accelerated compositing turned off
+        and then disabling accelerated compositing when subsequently
+        running a build with it turned on.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2009-06-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Followup for the fix for <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
+
+        Now that other MIME type correction stuff is in our swizzled method, Tiger needs it too!
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+        * platform/network/mac/WebCoreURLResponse.h:
+
+2009-06-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26732
+
+        For the final step of https://bugs.webkit.org/show_bug.cgi?id=25376,
+        combine LocalStorage and SessionStorage into StorageNamespace. The
+        synching code (for LocalStorage) has already been removed, so these
+        classes are now very similar.  All they do is essentially contain a
+        logical grouping of origins that are attached to specific contexts
+        (be it PageGroups for LocalStorage and Page for SessionStorage).
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * page/Chrome.cpp:
+        (WebCore::Chrome::createWindow):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::localStorage):
+        * page/DOMWindow.h:
+        * page/Page.cpp:
+        (WebCore::Page::sessionStorage):
+        (WebCore::Page::setSessionStorage):
+        * page/Page.h:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::localStorage):
+        * page/PageGroup.h:
+        * storage/LocalStorage.cpp: Removed.
+        * storage/LocalStorage.h: Removed.
+        * storage/LocalStorageTask.cpp:
+        * storage/LocalStorageThread.cpp:
+        * storage/SessionStorage.cpp: Removed.
+        * storage/SessionStorage.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::create):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::length):
+        (WebCore::StorageArea::key):
+        (WebCore::StorageArea::getItem):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::contains):
+        (WebCore::StorageArea::importItem):
+        (WebCore::StorageArea::close):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        (WebCore::):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        * storage/StorageNamespace.cpp: Copied from WebCore/storage/LocalStorage.cpp.
+        (WebCore::localStorageNamespaceMap):
+        (WebCore::StorageNamespace::localStorageNamespace):
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        (WebCore::StorageNamespace::StorageNamespace):
+        (WebCore::StorageNamespace::~StorageNamespace):
+        (WebCore::StorageNamespace::copy):
+        (WebCore::StorageNamespace::storageArea):
+        (WebCore::StorageNamespace::close):
+        * storage/StorageNamespace.h: Copied from WebCore/storage/LocalStorage.h.
+
+2009-06-26  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Upstream V8Proxy.  This involved updating a lot of function and variable names to match WebKit style, hence the large size.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26623
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::~ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isSafeScript):
+        (WebCore::ScriptController::gcProtectJSWrapper):
+        (WebCore::ScriptController::gcUnprotectJSWrapper):
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::setEventHandlerLineNumber):
+        (WebCore::ScriptController::bindToWindowObject):
+        (WebCore::ScriptController::collectGarbage):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::createScriptObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptInstance.cpp:
+        (WebCore::V8ScriptInstance::clear):
+        (WebCore::V8ScriptInstance::set):
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::operator=):
+        (WebCore::ScriptValue::clear):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        (WebCore::V8AbstractEventListener::getReceiverObject):
+        * bindings/v8/V8Collection.cpp:
+        (WebCore::toOptionsCollectionSetter):
+        * bindings/v8/V8Collection.h:
+        (WebCore::getV8Object):
+        (WebCore::getNamedPropertyOfCollection):
+        (WebCore::nodeCollectionNamedPropertyGetter):
+        (WebCore::getIndexedPropertyOfCollection):
+        (WebCore::nodeCollectionIndexedPropertyGetter):
+        (WebCore::nodeCollectionIndexedPropertyEnumerator):
+        (WebCore::collectionIndexedPropertyEnumerator):
+        (WebCore::collectionStringOrNullIndexedPropertyGetter):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::weakDOMObjectCallback):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/V8Helpers.cpp:
+        (WebCore::wrapNPObject):
+        (WebCore::toV8Context):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::~V8LazyEventListener):
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
+        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
+        (WebCore::V8NodeFilterCondition::acceptNode):
+        * bindings/v8/V8ObjectEventListener.cpp:
+        (WebCore::weakObjectEventListenerCallback):
+        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
+        * bindings/v8/V8Proxy.cpp: Added.
+        * bindings/v8/V8Proxy.h:
+        (WebCore::):
+        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
+        (WebCore::V8Proxy::):
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::frame):
+        (WebCore::V8Proxy::inlineCode):
+        (WebCore::V8Proxy::setInlineCode):
+        (WebCore::V8Proxy::timerCallback):
+        (WebCore::V8Proxy::setTimerCallback):
+        (WebCore::V8Proxy::setEventHandlerLineNumber):
+        (WebCore::V8Proxy::finishedWithEvent):
+        (WebCore::V8Proxy::wrapCPointer):
+        (WebCore::V8Proxy::extractCPointer):
+        (WebCore::V8Proxy::convertDOMWrapperToNative):
+        (WebCore::V8Proxy::convertDOMWrapperToNode):
+        (WebCore::V8Proxy::convertToV8Object):
+        (WebCore::V8Proxy::convertToNativeObject):
+        (WebCore::V8Proxy::convertToNativeEvent):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::extractCPointerImpl):
+        (WebCore::V8Proxy::utilityContext):
+        (WebCore::V8Proxy::constructDOMObject):
+        (WebCore::throwError):
+        (WebCore::toV8):
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::GetConstructor):
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        (WebCore::WorkerContextExecutionProxy::runScript):
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::toCanvasStyle):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ClientRectListCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::allowSettingFrameSrcToJavascriptUrl):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::V8Custom::GetTargetFrame):
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        (WebCore::V8EventListener::~V8EventListener):
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
+        (WebCore::V8CustomSQLStatementCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
+        (WebCore::V8CustomSQLTransactionCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::V8CustomVoidCallback::handleEvent):
+        (WebCore::invokeCallback):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8DOMParserConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::convertBase64):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::createWindow):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8EventCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::SetTimeoutOrInterval):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/7011047> Profiler shows the record button 'on' even
+        though it's finished
+
+        I consolidated the creation of the user initiated profile name into
+        its own function and then called it from console::profile instead of
+        calling startUserInitiatedProfiling().  This way we don't call
+        toggleRecordButton() which turns on the record button.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        * inspector/InspectorController.h:
+        * page/Console.cpp:
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+
+2009-06-26  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26691
+
+        Cleanup: Move focusRingColor to RenderTheme.
+
+        Most of this CL involves deleting files and removing dead code.
+
+        focusRingColor() is now defined in RenderTheme rather than in
+        misc. places on each port.  The default color is specified as
+        black in renderTheme and ports can override it in their own
+        custom renderThemes.
+
+        Behavior should be identical except for the following cases,
+        this lists platform and what the focus ring color used to be
+        before this cl and the file where it used to be defined:
+
+        Android - red
+        WebCore/platform/android/TemporaryLinkStubs.cpp
+
+        Cairo - aqua focus ring color - 0xFF7DADD9
+        WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+
+        wx - red
+        WebCore/platform/wx/TemporaryLinkStubs.cpp
+
+        QT - black
+        WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+
+        Manual test: manual-tests/focusringcolor-change-on-theme-change.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
+        * manual-tests/focusringcolor-change-on-theme-change.html: Added.
+        * platform/android/TemporaryLinkStubs.cpp:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/chromium/ColorChromium.cpp: Removed.
+        * platform/graphics/chromium/ColorChromiumMac.mm: Removed.
+        * platform/graphics/mac/ColorMac.h:
+        * platform/graphics/mac/ColorMac.mm:
+        (WebCore::oldAquaFocusRingColor):
+        (WebCore::setUsesTestModeFocusRingColor):
+        (WebCore::usesTestModeFocusRingColor):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/win/ColorSafari.cpp: Removed.
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::focusRingColor):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::focusRingColor):
+        (WebCore::RenderThemeChromiumMac::systemColor):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::focusRingColor):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::focusRingColor):
+        (WebCore::RenderThemeMac::systemColor):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::makeRGBAFromCGColor):
+        (WebCore::RenderThemeSafari::focusRingColor):
+        * rendering/RenderThemeSafari.h:
+
+2009-06-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26761
+        [Chromium] Enable Dedicated Workers in Chromium.
+
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Remove the check that prevented workers from being created w/o a command-line switch.
+        The flag itself and methods will be removed in a subsequent patch, after
+        corresponding change in Chromium.
+
+2009-06-26  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        Fix: https://bugs.webkit.org/show_bug.cgi?id=26723
+        Where the m_mouseDown event was never being set on windows, so the
+        client X and Y coordinates were always being reported as zero in a
+        dragstart handler.
+
+        Test: editing/selection/drag-start-event-client-x-y.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        Set the m_mouseDown event when the mouse press is handled.
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::mouseDown):
+        Removed now redundant setting of m_mouseDown.
+
+2009-06-26  Brady Eidson  <beidson@apple.com>
+
+        Tiger build fix
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (swizzleMIMETypeMethodIfNecessary):
+
+2009-06-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26681
+        Problem updating applicationCache when server returns 304
+        
+        Improve the fix, make the test pass on Tiger.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): Fix another code path to remove the
+        current item from list.
+
+        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::start): On Tiger,
+        conditional requests that cannot be cached by network layer cause errors with default cache
+        policy.
+
+2009-06-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig
+
+        <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
+
+        When we disabled content sniffing for file urls we lost knowledge of many file extensions that we
+        didn't intend to lose.  Turns out the CoreTypes UTI database doesn't know about every extension Gatekeeper
+        knew about.
+
+        By comparing CoreTypes' database to Gatekeepers, this patch adds a hardcoded list of file extension to MIME
+        type mappings that are missing in CoreType's database.
+
+        Test: platform/mac/fast/loader/file-url-mimetypes.html
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Move the MIME Type swizzling code to
+          WebCoreURLResponse.
+
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit): _webcore_MIMEType -> MIMEType, as we now have only one place
+          where we do all MIMEType correction.
+
+        * platform/network/mac/WebCoreURLResponse.h: Remove _webcore_MIMEType, as it is now folded into the swizzled
+          implementation of MIMEType.
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (createBinaryExtensionsSet):
+        (createExtensionToMIMETypeMap):
+        (swizzleMIMETypeMethodIfNecessary):
+        (webNSURLResponseMIMEType): If it's a file URL and there's no MIME type, see if the extension exists in the 
+          extension -> MIME type map before turning to the default MIME type.  Also roll in what was previously
+          implemented in _webcore_MIMEType.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::~SVGImage): Tweak this ASSERT - SVGImages might get destroyed without ever having a client.
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Show the fullscreen button only if the backend has support for it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26661
+
+        No test since this is not reachable via the DOM.
+
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::supportsFullscreen): new
+        * html/HTMLVideoElement.h:
+        (WebCore::HTMLVideoElement::supportsFullscreen): new
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::supportsFullscreen): new
+        (WebCore::MediaPlayer::supportsFullscreen): new
+        * platform/graphics/MediaPlayer.h: new
+        * platform/graphics/MediaPlayerPrivate.h: new
+        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen): new
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): new
+        * rendering/MediaControlElements.h:
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7007776> Controller doesn't automatically update counters when file
+        is playing ( http://www.jazzguitar.be/mp3/Michael%20Lewis%20-%20SSSJ.mp3 )
+
+        Update the time display when the movie time changes.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26659
+
+        Support hidding a control bar element from the Media element controller.
+
+        Update layout tests since the fullscreen button no longer has a renderer.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaTextDisplayElement::update): call updateStyle() so everything
+        is updated properly.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+        (WebCore::MediaControlInputElement::update): call updateStyle()
+        (WebCore::MediaControlInputElement::updateStyle): create the renderer properly
+        or not depending on what rendererIsNeeded() return.
+        * rendering/MediaControlElements.h:
+
+2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6968137> Profiler title numbers increment even after a
+        reload.
+
+        - Now the numbers are reset when the profiles are.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+
+2009-06-26  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7000796>
+        REGRESSION(34681): Breaking up quoted text makes new, unquoted text blue after certain steps; repros with some messages
+
+        Test: editing/inserting/break-blockquote-after-delete.html
+
+        Keep track of whether the typing style should be preserved after the TypingCommand is applied.  When adding onto an open
+        typing command, keep that flag up to date.
+
+        In this case, an InsertParagraphSeparatorInQuotedContent command, which should not preserve typing style, 
+        was following an open Delete command, which does preserve the typing style.  So we were applying the original
+        typing style (from before the delete, so blue text) to the cursor in the unquoted area after breaking up the blockquote.
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::TypingCommand):
+        (WebCore::TypingCommand::typingAddedToOpenCommand):
+        (WebCore::TypingCommand::insertTextRunWithoutNewlines):
+        (WebCore::TypingCommand::insertLineBreak):
+        (WebCore::TypingCommand::insertParagraphSeparator):
+        (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        (WebCore::TypingCommand::deleteSelection):
+        (WebCore::TypingCommand::updatePreservesTypingStyle):
+        * editing/TypingCommand.h: (WebCore::TypingCommand::preservesTypingStyle):
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for saving and loading of QWebHistory to and from a QByteArray.
+
+        This includes streaming operators for QWebHistory. for convenience.
+
+        New autotests that test QWebHistory and QWebHistoryItem serialization.
+
+        * WebCore.pro:
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::dailyVisitCounts):
+        (WebCore::HistoryItem::weeklyVisitCounts):
+        * history/qt/HistoryItemQt.cpp: Added.
+        (WebCore::HistoryItem::restoreState):
+        (WebCore::HistoryItem::saveState):
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for QDataStream operators to String and IntPoint.
+
+        * platform/graphics/IntPoint.h:
+        (WebCore::operator<<):
+        (WebCore::operator>>):
+        * platform/text/PlatformString.h:
+        * platform/text/qt/StringQt.cpp:
+        (WebCore::operator<<):
+        (WebCore::operator>>):
+
+2009-06-26  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Add #if ENABLE(DOM_STORAGE) to the V8 custom bindings for local/session storage.
+        https://bugs.webkit.org/show_bug.cgi?id=26757
+
+        * bindings/v8/custom/V8StorageCustom.cpp
+
+2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Test: platform/qt/fast/events/event-sender-keydown-frame.html
+
+        Bug 20303: [Qt] Key events are not working in frames.
+
+        Merge scrolling handling code in qt and win port, move it to
+        EventHandler.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::scrollRecursively):
+        * page/EventHandler.h:
+
+2009-06-26  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26682
+        Bug 26682: It should be possible to add image to SVG DOM programmatically (using JavaScript)
+
+        Make sure the xlink:href animated property setting syncs the corresponding attribute with the right namespace.
+
+        Test: svg/custom/createImageElement.svg
+
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::synchronizeProperty):
+
+2009-06-26  Takeshi Yoshino  <tyoshino@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Bug 26156: In view-source mode, always render the contents using HTMLViewSourceDocument
+        https://bugs.webkit.org/show_bug.cgi?id=26156
+
+        When in view-source mode, render the contents using HTMLViewSourceDocument
+        regardless it's applicable for any plugin or not.
+
+        Chromium tells WebCore to render the contents of specified URL when
+        view-source: prefix is added to the URL. But currently, DOMImplementation
+        ignores inViewSourceMode() when the MIME type is indicating that the contents
+        are neither texts nor HTML family documents.
+
+        For example, we can check the contents of asf file without launching media
+        player. Rendering contents for view-source:-specified input is not what user
+        expects.
+
+        http://code.google.com/p/chromium/issues/detail?id=10545
+
+        I want to fix this issue by this patch. IMHO, regardless of this Chromium
+        specific issue, I think we should force use of HTMLViewSourceDocument when
+        inViewSourceMode() is specified.
+
+        Test: fast/frames/viewsource-on-image-file.html
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::createTokenizer):
+        * html/HTMLViewSourceDocument.h:
+
+2009-06-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25529
+        [Gtk] Expected states not exposed to assistive technologies
+
+        Add support for VISIBLE, EDITABLE and SENSITIVE states.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkStateSetFromCoreObject):
+
+2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        "Pointer to incomplete class type is not allowed" error with RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=26721
+
+        Based on Norbert Leser's work.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchMouseEvent):
+        * dom/Node.h: Remove the default value for PassRefPtr<Event> args,
+        to eliminate dependency on the Event class definition
+
+2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [Qt] Build fix after r45183
+        https://bugs.webkit.org/show_bug.cgi?id=26748
+
+        * WebCore.pro:
+
+2009-06-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26681
+        <rdar://problem/7003461> Problem updating applicationCache when server returns 304
+
+        Test: http/tests/appcache/update-cache.html
+
+        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        We're already done with the resource, don't try to load it again.
+
+2009-06-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        <rdar://problem/6990481>
+        
+        Handle perspective computation on non-layer objects.
+
+        Test: transforms/3d/general/perspective-non-layer.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getTransformFromContainer):
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26653
+
+        Use flex box in the mediaControls.css style, to nicely scale if a button gets
+        dynamically added or removed.
+
+        Media tests results are affected by this changes.
+
+        * css/mediaControls.css:
+        * css/mediaControlsQT.css:
+
+2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26724
+
+        Move relavent part of setDefaultFontSize from RenderThemeChromiumWin
+        up into RenderThemeChromiumSkia.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::setDefaultFontSize):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::setDefaultFontSize):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-06-25  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26733
+
+        Add V8-only methods to FrameLoaderClient that V8 can use to send
+        out notifications when it creates/destroys a script context.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didCreateScriptContext):
+        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContext):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didCreateScriptContext):
+        (WebCore::FrameLoaderClient::didDestroyScriptContext):
+
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        Correct a few typos that snuck in when I was reformatting CodeGeneratorV8.pm
+        to match WebKit style.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Corrected lots of typos.
+
+2009-06-25  Adam Langley  <agl@google.com>
+
+        TBRed: fix for Chromium tree.
+
+        Add missing include for r45199.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26736
+
+        r45199 added a reference to throwError without including V8Proxy.h
+
+        * bindings/v8/WorkerScriptController.cpp:
+
+2009-06-25  Adam Langley  <agl@google.com>
+
+        TBRed: fix for Chromium tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26735
+
+        Fix V8IsolatedWorld to point to the correct include file.
+
+        The deprecated v8_index.h was removed from the Chromium tree in r19291
+        and upstreamed into WebKit with r45193. However V8IsolatedWorld
+        slipped in between the cracks and broke the build.
+
+        * bindings/v8/V8IsolatedWorld.h: update with new header location.
+
+2009-06-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26651
+        
+        Preference is named "WebKitAcceleratedCompositingEnabled"
+        and is a boolean value. When false, prevents compositing layers from
+        being created, which prevents hardware animation from running.
+        Also forces video to do software rendering. Added a cache for
+        the flag in RenderLayerCompositing and made it all work
+        on-the-fly when the flag is changed while a page is loaded.
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        * page/Settings.cpp:
+        (WebCore::setNeedsReapplyStylesInAllFrames):
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setAcceleratedCompositingEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::acceleratedCompositingEnabled):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hasAcceleratedCompositing):
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::currentTransform):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::enableCompositingMode):
+        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
+        * rendering/RenderLayerCompositor.h:
+        (WebCore::RenderLayerCompositor::hasAcceleratedCompositing):
+        * rendering/RenderObject.h:
+        (WebCore::makeMatrixRenderable):
+
+2009-06-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 26701: Implement the missing code for "FIXME: Need to return an
+        exception" in WorkerScriptController::evaluate for v8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=26701
+
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+
+2009-06-25  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8Index.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26495
+
+        * bindings/v8/V8Index.cpp: Added.
+        (WebCore::V8ClassIndex::GetFactory): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::GetCache): Moved from src.chromium.org.
+        * bindings/v8/V8Index.h:
+        (WebCore::V8ClassIndex::): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::ToInt): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::FromInt): Moved from src.chromium.org.
+
+2009-06-25  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26529
+
+        This is hopefully the last step before our renderers can run
+        cleanly in a chroot.
+
+        WebKit needs to be able to ask for the correct font to use in
+        the case that the current font doesn't include glyphs for
+        certain code points. Currently we make a fontconfig call in our
+        WebKit port to handle this.
+
+        This patch changes this so that the call is sent our via
+        ChromiumBridge.
+
+        http://codereview.chromium.org/132007
+
+        This should not affect any layout tests.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+
+2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26566
+        Upstream these files from the chromium v8 code.  No tests were
+        affected because this is essentially a code move.
+
+        * bindings/v8/NPV8Object.cpp: Added.
+        (allocV8NPObject):
+        (freeV8NPObject):
+        (listFromVariantArgs):
+        (npIdentifierToV8Identifier):
+        (npCreateV8ScriptObject):
+        (NPN_Invoke):
+        (NPN_InvokeDefault):
+        (NPN_Evaluate):
+        (NPN_EvaluateHelper):
+        (NPN_GetProperty):
+        (NPN_SetProperty):
+        (NPN_RemoveProperty):
+        (NPN_HasProperty):
+        (NPN_HasMethod):
+        (NPN_SetException):
+        (NPN_Enumerate):
+        (NPN_Construct):
+        * bindings/v8/NPV8Object.h: Added.
+        (PrivateIdentifier::):
+        * bindings/v8/V8NPUtils.cpp: Added.
+        (convertV8ObjectToNPVariant):
+        (convertNPVariantToV8Object):
+        (getStringIdentifier):
+        * bindings/v8/V8NPUtils.h: Added.
+
+2009-06-25  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26436
+
+        Windows Chromium bug fix: save context of destination canvas in
+        TransparencyWin::compositeTextComposite() before the function
+        modifies the context.
+
+        Test: fast/canvas/translate-text.html
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::compositeTextComposite):
+
+2009-06-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Show the filename and first line for "(program)" in the Profiler/Debugger
+        https://bugs.webkit.org/show_bug.cgi?id=25475
+
+        Add support to associate a sourceURL with an eval()'d string
+        via a @sourceURL comment.  Currently the sourceURL is only available
+        in the script debugger, not in the console or profiler, but it's
+        most needed in the script debugger.
+
+        * English.lproj/localizedStrings.js: added new "(program): %s" string
+        * inspector/front-end/Script.js:
+        (WebInspector.Script): if no sourceURL is available for the Script,
+        search for a comment of the form //@ sourceURL=(url) to use
+        as the sourceURL instead.
+        * manual-tests/inspector/named-evals.html: Added.
+
+2009-06-25  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23721: Changing dropdown's selectedIndex within onchange handler fires another onchange
+        https://bugs.webkit.org/show_bug.cgi?id=23721
+
+        onchange events fire when a SELECT element has
+        focus and the selectedIndex is updated by script in some way--either
+        during another onchange, onkeypress, onfocus, or timer--and then
+        focus is lost. 
+
+        Fixed by making a separate method for user-driven selectedIndex 
+        changes, leaving scripts to use one which doesn't cause onchange to
+        be queued.
+        
+        Test: fast/forms/select-script-onchange.html
+
+        * dom/SelectElement.cpp: check if the pending change is user driven
+        before calling onchange
+        (WebCore::SelectElement::menuListOnChange):
+        (WebCore::SelectElement::setSelectedIndex):
+        * dom/SelectElement.h: store whether the pending change is user driven
+        (WebCore::SelectElementData::userDrivenChange):
+        (WebCore::SelectElementData::setUserDrivenChange):
+        * html/HTMLSelectElement.cpp: split into two methods -- script version
+        [non-user-driven] corresponds to IDL defined property name
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        (WebCore::HTMLSelectElement::setSelectedIndexByUser):
+        * html/HTMLSelectElement.h: 
+        * rendering/RenderMenuList.cpp: use ByUser method when coming through
+        the renderer
+        (WebCore::RenderMenuList::valueChanged):
+
+2009-06-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        Combined LocalStorageArea and SessionStorageArea into StorageArea since
+        (after my other refactorings) there are no longer substantial
+        differences between the two.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp: Removed.
+        * storage/LocalStorageArea.h: Removed.
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/SessionStorageArea.cpp: Removed.
+        * storage/SessionStorageArea.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::createLocalStorage):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::createSessionStorage):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::scheduleFinalSync):
+        (WebCore::StorageArea::blockUntilImportComplete):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26671
+          <rdar://problem/7001880> Safari 4.0 crashes in
+          WebCore::DOMTimer::fired()
+
+        Test: fast/dom/style-sheet-candidate-remove-unrendered-document.html
+
+        When a "style sheet candidate" element is removed from a document,
+        call Document::removeStyleSheetCandidateNode() regardless of whether
+        the document is rendered. Otherwise, the document's style sheet
+        candidate set can end up containing stale references.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::removedFromDocument):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::removedFromDocument):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::removedFromDocument):
+
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Update CodeGeneratorV8.pm to sync up with the changes downstream.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added HTMLFrameSetElement check,
+          FileList as a ref-counted type, and DataGridColumn as typeCanFailConversion.
+
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Add FileList.h include to fix Chromium build.
+
+        * platform/chromium/ClipboardChromium.cpp: Added FileList.h include.
+
+2009-06-25  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        Bug 26489: Web Inspector: Typo in DatabaseQuery Error Message
+        https://bugs.webkit.org/show_bug.cgi?id=26489
+
+        Fixed a Typo in a Web Inspector error message.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryError):
+
+2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, add missing StorageAreaSync files to the build.
+
+        * WebCore.pro:
+
+2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by and done with Tor Arne Vestbø.
+
+        Fix shortcut keyboard handling with plugins on the Qt/Mac build.
+
+        When we receive shortcut events like Ctrl+V then the text in the QKeyEvent is
+        empty. If we're asked to disambiguate the event into a Char keyboard event,
+        we try to detect this situation and still set the text, to ensure that the
+        general event handling sends a key press event after this disambiguation.
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        Build fix only, no review.
+
+        Add FileList.h and NotImplemented.h includes in an attempt to fix bots.
+
+        * platform/gtk/ClipboardGtk.cpp:
+        * platform/qt/ClipboardQt.cpp:
+        * platform/win/ClipboardWin.cpp:
+        * platform/wx/ClipboardWx.cpp:
+
+2009-05-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Expose files in the clipboard in ondrop events
+        https://bugs.webkit.org/show_bug.cgi?id=25916
+
+        Make it possible for applications like gmail to implement
+        drag and drop of attachments onto email messages.
+
+        This patch exposes an event.dataTransfer.files accessor
+        on the drop event.  No information is exposed during dragover.
+        This follows the HTML 5 drag and drop security model:
+        http://www.w3.org/TR/html5/editing.html#security-risks-in-the-drag-and-drop-model
+        The test http/tests/security/clipboard/clipboard-file-access.html
+        verifies this behavior.
+
+        Internet Explorer shows historical documentation of supporting
+        getData('File') as a way of exposing files on the pasteboard.  The current version of their docs:
+        http://msdn.microsoft.com/en-us/library/ms537658(VS.85).aspx
+        has removed this reference (as far as I can tell IE never implemented it)
+        I have a printed copy of that URL from 2008 on my desk describing getData('File') in IE.
+        IE does not follow the HTML5 clipboard security model and always allows access to the full clipboard, even on dragover.
+
+        I choose not to use IE's getData('File') and instead added .files
+        so that the accessor could have a type, matching WebKit's existing
+        .files accessor on HTMLInputElement.
+
+        Mozilla has equivalent file access:
+        event.dataTransfer.mozGetDataAt("application/x-moz-file", 0);
+        which also does not return a typed value.
+        https://developer.mozilla.org/En/DragDrop/Recommended_Drag_Types#Dragging_Files
+
+        This is only implemented for Mac WebKit.  All other platforms (including Apple's Win WebKit)
+        have incomplete Clipboard implementations and will require experts from those platforms
+        to add this functionality.  Right now they all have Clipboard*::files() methods which call notImplemented();
+
+        Test: http/tests/security/clipboard/clipboard-file-access.html
+
+        * dom/Clipboard.h:
+        * dom/Clipboard.idl:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::files):
+        * platform/chromium/ClipboardChromium.h:
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::files):
+        * platform/gtk/ClipboardGtk.h:
+        * platform/mac/ClipboardMac.h:
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::absoluteURLsFromPasteboardFilenames):
+        (WebCore::absoluteURLsFromPasteboard):
+        (WebCore::ClipboardMac::files):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::files):
+        * platform/qt/ClipboardQt.h:
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::files):
+        * platform/win/ClipboardWin.h:
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::files):
+        * platform/wx/ClipboardWx.h:
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        No review, only completing revert of r45144.
+
+        Add back files deleted by r45144.
+
+        * storage/LocalStorageArea.cpp: Added.
+        (WebCore::LocalStorageArea::create):
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::itemChanged):
+        (WebCore::LocalStorageArea::itemRemoved):
+        (WebCore::LocalStorageArea::areaCleared):
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        (WebCore::LocalStorageArea::dispatchStorageEvent):
+        * storage/LocalStorageArea.h: Added.
+        * storage/SessionStorageArea.cpp: Added.
+        (WebCore::SessionStorageArea::copy):
+        (WebCore::SessionStorageArea::SessionStorageArea):
+        (WebCore::SessionStorageArea::itemChanged):
+        (WebCore::SessionStorageArea::itemRemoved):
+        (WebCore::SessionStorageArea::areaCleared):
+        (WebCore::SessionStorageArea::blockUntilImportComplete):
+        (WebCore::SessionStorageArea::dispatchStorageEvent):
+        * storage/SessionStorageArea.h: Added.
+        (WebCore::SessionStorageArea::create):
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        No review, reverting r45144 only.
+
+        Roll out r45144 after 18 test failures appeared on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::~StorageArea):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        Combined LocalStorageArea and SessionStorageArea into StorageArea since
+        (after my other refactorings) there are no longer substantial
+        differences between the two.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp: Removed.
+        * storage/LocalStorageArea.h: Removed.
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/SessionStorageArea.cpp: Removed.
+        * storage/SessionStorageArea.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::createLocalStorage):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::createSessionStorage):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::scheduleFinalSync):
+        (WebCore::StorageArea::blockUntilImportComplete):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix <rdar://problem/7001817> REGRESSION (r41902): Base position track
+          at UCSC Genome Browser doesn't work because image map prevents img
+          from hit-testing
+
+        Test: fast/replaced/image-map-2.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::nodeAtPoint): Do not reset 'inside' to false if
+        the image map failed the hit test.
+
+2009-06-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26366
+
+        Refactor V8DOMMap to support isolated worlds.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInNewWorld):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
+        (WebCore::DOMDataStore::allStores):
+        (WebCore::DOMDataStore::allStoresMutex):
+        (WebCore::DOMDataStore::domData):
+        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
+        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        (WebCore::):
+        (WebCore::MainThreadDOMData::MainThreadDOMData):
+        (WebCore::MainThreadDOMData::getStore):
+        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
+        (WebCore::ChildThreadDOMData::getStore):
+        (WebCore::DOMDataStore::DOMDataStore):
+        (WebCore::DOMDataStore::~DOMDataStore):
+        (WebCore::DOMDataStoreHandle::DOMDataStoreHandle):
+        (WebCore::DOMDataStoreHandle::~DOMDataStoreHandle):
+        (WebCore::forget):
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+        (WebCore::DOMData::getCurrent):
+        (WebCore::DOMData::handleWeakObject):
+        (WebCore::DOMData::ensureDeref):
+        (WebCore::weakDOMObjectCallback):
+        (WebCore::weakActiveDOMObjectCallback):
+        (WebCore::weakNodeCallback):
+        (WebCore::weakSVGElementInstanceCallback):
+        (WebCore::weakSVGObjectWithContextCallback):
+        (WebCore::DOMData::derefObject):
+        (WebCore::DOMData::derefDelayedObjects):
+        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
+        (WebCore::visitDOMNodesInCurrentThread):
+        (WebCore::visitDOMObjectsInCurrentThread):
+        (WebCore::visitActiveDOMObjectsInCurrentThread):
+        (WebCore::visitDOMSVGElementInstancesInCurrentThread):
+        (WebCore::visitSVGObjectsInCurrentThread):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::DOMDataStoreHandle::getStore):
+        * bindings/v8/V8IsolatedWorld.cpp: Added.
+        (WebCore::getIsolatedWorldKey):
+        (WebCore::contextWeakReferenceCallback):
+        (WebCore::V8IsolatedWorld::evaluate):
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::getEntered):
+        * bindings/v8/V8IsolatedWorld.h: Added.
+        (WebCore::V8IsolatedWorld::getDOMDataStore):
+
+2009-06-24  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Bug 26604: Search doesn't work in Web Inspector Profiler
+        https://bugs.webkit.org/show_bug.cgi?id=26604
+
+        Seems like search was damaged in revision 42808.
+
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.prototype.refresh):
+        Here and in other functions: nodes we're searching in are profile data grid
+        nodes, so there is no more need for '_dataGridNode' references.
+        (WebInspector.ProfileView.prototype.searchCanceled):
+        (WebInspector.ProfileView.prototype.performSearch.matchesQuery):
+        Fixed accidental semicolon that caused 'matchesQuery' always return true.
+        (WebInspector.ProfileView.prototype.performSearch):
+        To perform search correctly in the case of bottom up tree, we need to populate
+        the tree, because there's no 1-to-1 correspondence between profile nodes and
+        data grid nodes in this case.
+        (WebInspector.ProfileView.prototype._jumpToSearchResult):
+
+2009-06-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        <rdar://problem/6450239&6574516>
+    
+        Fix flashing issues caused by compositing layers rendering content before
+        a deferred layout has happened. Because the -viewWillDraw machinery doesn't
+        work for composited layers, we need to use scheduleViewUpdate() to queue
+        up a layout via the run loop observer in WebKit, whenever we know we
+        are going to be painting soon.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+
+2009-06-24  David Levin  <levin@chromium.org>
+
+        Fix all builds.
+
+        * ForwardingHeaders/wtf/FastAllocBase.h: Added.
+
+2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26658
+
+        Split the syncing portions of LocalStorageArea into StorageAreaSync.
+        This name will make more sense in the next patch (in this set) when
+        LocalStorageArea and SessionStorageArea are merged to become simply
+        StorageArea.  (Thus the synching portion of StorageArea is in
+        StorageAreaSync.)
+
+        This looks like a big patch, but really all it's doing is splitting
+        code and patching split-related things up.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::create):
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::itemChanged):
+        (WebCore::LocalStorageArea::itemRemoved):
+        (WebCore::LocalStorageArea::areaCleared):
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        * storage/LocalStorageArea.h:
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::LocalStorageTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        * storage/LocalStorageThread.h:
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::blockUntilImportComplete):
+        * storage/SessionStorageArea.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp: Copied from WebCore/storage/LocalStorageArea.cpp.
+        * storage/StorageAreaSync.h: Copied from WebCore/storage/LocalStorageArea.h.
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix Qt build.
+
+        * WebCore.pro:
+
+2009-06-24  David Levin  <levin@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Bug 26696: Member functions in DataGridColumnList should return pointers instead of PassRefPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=26696
+
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::itemWithName):
+        (WebCore::DataGridColumnList::add):
+        * html/DataGridColumnList.h:
+        (WebCore::DataGridColumnList::item):
+        (WebCore::DataGridColumnList::primaryColumn):
+        (WebCore::DataGridColumnList::sortColumn):
+
+2009-06-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave "Messy" Hyatt.
+
+        Little bit of style cleanup.
+
+        * html/DataGridColumn.cpp:
+        * html/DataGridColumn.h:
+        * html/DataGridColumn.idl:
+        * html/DataGridColumnList.cpp:
+        * html/DataGridColumnList.h:
+        * html/DataGridColumnList.idl:
+        * html/HTMLDataGridCellElement.cpp:
+        * html/HTMLDataGridCellElement.h:
+        * html/HTMLDataGridCellElement.idl:
+        * html/HTMLDataGridColElement.cpp:
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp:
+        * html/HTMLDataGridRowElement.h:
+        * html/HTMLDataGridRowElement.idl:
+
+2009-06-24  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26668: AX: need a way to retrieve the language for an element
+        
+        Provides a way to retrieve the language associated with a specific accessibility element.
+
+        Test: accessibility/language-attribute.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::language):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::language):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-06-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+        
+        <rdar://problem/6893811> Instead of downloading files linked from Google Earth, file contents displayed in browser window as text.
+
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (createBinaryExtensionsSet): Add '.kmz' to the list of known-to-be-binary extensions.
+
+2009-06-24  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26685
+        Accomodate for backwards-incompatible skia api changes.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::setupPaintCommon):
+        (PlatformContextSkia::setXfermodeMode):
+        (PlatformContextSkia::applyClipFromImage):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::):
+        (WebCore::WebCoreCompositeToSkiaComposite):
+        * platform/graphics/skia/SkiaUtils.h:
+
+2009-06-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix. Add files that were added in r45093 and r45096
+
+        * GNUmakefile.am:
+
+2009-06-24  Brady Eidson  <beidson@apple.com>
+
+        Fix 64-bit SnowLeopard build.
+
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::move):
+
+2009-06-24  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26392
+        Bug 26392: In html, modification of xlink:href of an newly inserted svg image does not work.
+        https://bugs.webkit.org/show_bug.cgi?id=26328
+        Bug 26328: changing href attribute of svg images does not work when changing display attribute as well
+
+        React to href updates even when there is no renderer, i.e. display=none.
+
+        Tests: svg/custom/js-update-image-and-display.svg
+               svg/custom/js-update-image-and-display2.svg
+               svg/custom/js-update-image-and-display3.svg
+
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::svgAttributeChanged):
+
+2009-06-24  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26687
+
+        Add basic back-end column support to datagrid.
+
+        Added fast/dom/HTMLDataGridElement/ column tests.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/DataGridColumn.cpp: Added.
+        (WebCore::DataGridColumn::setPrimary):
+        * html/DataGridColumn.h: Added.
+        (WebCore::DataGridColumn::create):
+        (WebCore::DataGridColumn::id):
+        (WebCore::DataGridColumn::setId):
+        (WebCore::DataGridColumn::label):
+        (WebCore::DataGridColumn::setLabel):
+        (WebCore::DataGridColumn::type):
+        (WebCore::DataGridColumn::setType):
+        (WebCore::DataGridColumn::sortable):
+        (WebCore::DataGridColumn::setSortable):
+        (WebCore::DataGridColumn::sortDirection):
+        (WebCore::DataGridColumn::setSortDirection):
+        (WebCore::DataGridColumn::primary):
+        (WebCore::DataGridColumn::detachFromColumnList):
+        (WebCore::DataGridColumn::DataGridColumn):
+        * html/DataGridColumn.idl: Added.
+        * html/DataGridColumnList.cpp: Added.
+        (WebCore::DataGridColumnList::~DataGridColumnList):
+        (WebCore::DataGridColumnList::itemWithName):
+        (WebCore::DataGridColumnList::add):
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::move):
+        (WebCore::DataGridColumnList::clear):
+        (WebCore::DataGridColumnList::primaryColumnChanged):
+        * html/DataGridColumnList.h: Added.
+        (WebCore::DataGridColumnList::create):
+        (WebCore::DataGridColumnList::length):
+        (WebCore::DataGridColumnList::item):
+        (WebCore::DataGridColumnList::primaryColumn):
+        (WebCore::DataGridColumnList::sortColumn):
+        * html/DataGridColumnList.idl: Added.
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::sortable):
+        (WebCore::HTMLDataGridColElement::setSortable):
+        (WebCore::HTMLDataGridColElement::sortDirection):
+        (WebCore::HTMLDataGridColElement::setSortDirection):
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        * html/HTMLDataGridElement.h:
+        (WebCore::HTMLDataGridElement::columns):
+        * html/HTMLDataGridElement.idl:
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::paintObject):
+        (WebCore::RenderDataGrid::paintColumnHeaders):
+        (WebCore::RenderDataGrid::rebuildColumns):
+        * rendering/RenderDataGrid.h:
+        (WebCore::RenderDataGrid::gridElement):
+
+2009-06-24  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Partially fixes: https://bugs.webkit.org/show_bug.cgi?id=24735
+        (<rdar://problem/5015942>)
+        Where on windows it was not possible to set an element as the drag
+        image using setDragImage on the dataTransfer object.
+        
+        Does not "fix" the case of dragging a link where the default link image
+        is still used, even when the -webkit-user-drag is set to "element". This
+        is the same behavior as is found on OS X.
+        
+        Added a manual test because it is not possible to check that what is
+        contained in the image snapshot is indeed the requested element.
+
+        * dom/Clipboard.h:
+        (WebCore::Clipboard::dragImageElement):
+        Made getting the raw pointer from the RefPtr a const operation.
+        * manual-tests/drag-with-div-or-image-as-data-image.html: Added.
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::createDragImage):
+        Get an image of the rendered element and its subtree.
+
+2009-06-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26683
+        Fix Chromium build bustage: Add custom binding for HTMLDataGridElement.dataSource
+
+        This change just adds a stub implementation for now to help fix the build.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Added.
+
+2009-06-24  David Kilzer  <ddkilzer@apple.com>
+
+        Build fixes for ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+
+        Reviewed by Adam Roben.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::deliverNotification): Removed
+        ExceptionCode parameter from togglePlayState().
+        (WebCore::HTMLMediaElement::initialURL): Don't convert a KURL
+        object to a String when assigning to a KURL variable.
+
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Save memory by not storing attribute values in member variables, if not absolutely needed.
+        Also fixes bugs where we're substituting variables too early (noticeable with the upcoming <select> element).
+
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::parseMappedAttribute):
+        (WebCore::WMLDoElement::label):
+        * wml/WMLDoElement.h:
+        * wml/WMLFieldSetElement.cpp:
+        (WebCore::WMLFieldSetElement::insertedIntoDocument):
+        * wml/WMLFieldSetElement.h:
+        * wml/WMLOptGroupElement.cpp:
+        (WebCore::WMLOptGroupElement::title):
+        (WebCore::WMLOptGroupElement::parseMappedAttribute):
+        (WebCore::WMLOptGroupElement::groupLabelText):
+        * wml/WMLOptGroupElement.h:
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::name):
+        (WebCore::WMLPostfieldElement::value):
+        (WebCore::WMLPostfieldElement::encodeData):
+        * wml/WMLPostfieldElement.h:
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::parseMappedAttribute):
+        (WebCore::WMLSetvarElement::name):
+        (WebCore::WMLSetvarElement::value):
+        * wml/WMLSetvarElement.h:
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::parseMappedAttribute):
+        (WebCore::WMLTimerElement::insertedIntoDocument):
+        (WebCore::WMLTimerElement::timerFired):
+        (WebCore::WMLTimerElement::start):
+        (WebCore::WMLTimerElement::value):
+        * wml/WMLTimerElement.h:
+
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        Forgot to initialize m_task member variable. Results in crashes sometimes.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::WMLAnchorElement):
+
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Forgot to include within last patch.
+
+        * manual-tests/wml/card-title-attr.wml: Added.
+
+2009-06-24  Wajahat Siddiqui <wajahatmeister@gmail.com>
+ 
+        Reviewed by Nikolas Zimmermann.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26474
+        Adding WML <card> title attribute handling.
+
+        * wml/WMLElement.h: marking parseValueSubstitutingVariableReferences and parseValueForbiddingVariableReferences as const
+        * wml/WMLElement.cpp:
+        * wml/WMLCardElement.h: 
+        (WebCore::WMLCardElement::title):
+        * wml/WMLCardElement.cpp:
+        * wml/manual-test/card-title-attr.wml: Manual test  
+ 
+2009-06-24  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the build without ENABLE_VIDEO.
+
+        * html/CanvasRenderingContext2D.cpp: Add #if ENABLE guards.
+        * html/CanvasRenderingContext2D.h: Ditto.
+
+2009-06-24  Siddhartha Chattopadhyay  <sidchat@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26200 which I introduced earlier. I had
+        the smartReplace set TRUE initially, which was wrong since the purpose of this call is
+        to just replace the selection, and place the caret at the end of the selection it replaced.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
+        * manual-tests/textarea-caret-position-after-auto-spell-correct.html: Added.
+
+2009-06-24  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Don't use an unsigned int for intervalInMS because we sometimes initialize
+        it with a negative value.
+
+        * platform/wx/SharedTimerWx.cpp:
+        (WebCore::setSharedTimerFireTime):
+
+2009-06-24  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        The previous checkin had an improper merge.  This fixes the build.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+
+2009-06-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25922
+        JS setting dropEffect = "none" causes tryDHTMLDrag
+        to return DragOperationNone.  Which is also the value
+        tryDHTMLDrag previously used to indicate JS did not
+        want to handle the drag.
+
+        Make it possible for the DragController::try* methods
+        to return a bool to indicate if javascript accepted
+        or rejected the drag event, separate from the DragOperation.
+
+        Tests:
+        - fast/events/drag-to-navigate.html
+        - fast/events/prevent-drag-to-navigate.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::dragEnteredOrUpdated):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::defaultOperationForDrag):
+        (WebCore::DragController::tryDHTMLDrag):
+        * page/DragController.h:
+
+2009-06-23  Oliver Hunt  <oliver@apple.com> and Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Sam Weinig and Dave Hyatt.
+
+        <rdar://problem/6164797> Add Canvas API to allow drawing of <video> frames
+        <https://bugs.webkit.org/show_bug.cgi?id=25920>
+
+        Add support for drawing the contents of the video element to the canvas
+        in accordance with the current HTML5 draft.
+
+        Test: media/video-canvas.html
+
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+          Standard custom bindings stuff we need to do for all canvas methods.
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::size): Helper function for finding the size of a video element
+        (WebCore::CanvasRenderingContext2D::checkOrigin): moved up in the file.
+        (WebCore::CanvasRenderingContext2D::drawImage): The various overloads of HTML5's drawImage(<video>)
+        * html/CanvasRenderingContext2D.h:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::hasSingleSecurityOrigin):
+          hasSingleSecurityOrigin is needed for security, currently all implementations are trivial
+          as we force QT to maintain a single origin.
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::paint): 
+            Paint routine on video so we don't have to look at MediaPlayer directly
+        * html/HTMLVideoElement.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::hasSingleSecurityOrigin):
+        (WebCore::MediaPlayer::hasSingleSecurityOrigin):
+            Default implementations of hasSingleSecurityOrigin
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+            A video may need a player now even if it is not visible.
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+            Always return true due to restrictions we've placed on QT.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+            Jump through some hoops to allow windows QT to draw to an intermediate buffer.
+            In the long term we'd like to cache the HDC, but this will do for now.
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+            As for Mac we force QT to only allow same origin loads.
+
+2009-06-23  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: Fix crash with inherited font-size in <option>
+
+        https://bugs.webkit.org/show_bug.cgi?id=26656
+        http://code.google.com/p/chromium/issues/detail?id=14853
+
+        In r42597 (https://bugs.webkit.org/show_bug.cgi?id=25244), I changed
+        the <select> handing for Chromium to fix a rendering bug. However,
+        although the font-size is correctly ignored, getRowHeight wasn't
+        updated and so was calculating the height of the rows in an
+        inconsistent manner. This can lead to a crash.
+
+        * manual-tests/optgroup-empty-and-nested.html: adding test case for crash
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::getRowHeight):
+
+2009-06-23  Brady Eidson  <beidson@apple.com>
+
+        Patch by Antti Koivisto.
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/6988010> Failed resources not reloaded when built against Tiger SDK
+
+        A latent bug that cache revalidation uncovered.  When a CachedResource failed to load,
+        it should always be revalidated upon reload.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::canUseCacheValidator):
+        (WebCore::CachedResource::mustRevalidate):
+
+2009-06-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6634228> Crash in [NSScroller mouseDown:] beneath
+          EventHandler::passMouseDownEventToWidget()
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passMouseDownEventToWidget): Surround the
+        -mouseDown: call with calls to Widget::beforeMouseDown() and
+        Widget::afterMouseDown(), which prevent the widget's view hierarchy from
+        being removed from its parent view while the scroller is tracking the
+        mouse.
+
+2009-06-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26516
+        Add initial implementation of DataGridDataSource
+
+        - Initial implementation only supports the initialize callback function.
+
+        Test: fast/dom/HTMLDataGridElement/DataGridDataSource-basic.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSDataGridDataSource.cpp: Added.
+        (WebCore::JSDataGridDataSource::JSDataGridDataSource):
+        (WebCore::JSDataGridDataSource::~JSDataGridDataSource):
+        (WebCore::JSDataGridDataSource::initialize):
+        * bindings/js/JSDataGridDataSource.h: Added.
+        (WebCore::JSDataGridDataSource::create):
+        (WebCore::JSDataGridDataSource::isJSDataGridDataSource):
+        (WebCore::JSDataGridDataSource::jsDataSource):
+        (WebCore::asJSDataGridDataSource):
+        * bindings/js/JSHTMLDataGridElementCustom.cpp: Added.
+        (WebCore::JSHTMLDataGridElement::listener):
+        (WebCore::JSHTMLDataGridElement::setListener):
+        * html/DataGridDataSource.h: Added.
+        (WebCore::DataGridDataSource::~DataGridDataSource):
+        (WebCore::DataGridDataSource::isJSDataGridDataSource):
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        (WebCore::HTMLDataGridElement::setDataSource):
+        (WebCore::HTMLDataGridElement::initializationTimerFired):
+        * html/HTMLDataGridElement.h:
+        (WebCore::HTMLDataGridElement::dataSource):
+        * html/HTMLDataGridElement.idl:
+
+2009-06-23  Ryosuke Niwa  <rniwa@google.com>
+
+        Reviewed by Justin Garcia.
+
+        Undo the changeset 21212 to fix the regression bug 14062.
+        The changeset 21212 attempted to fix rdar://problem/5002441.
+        The changeset 21212 modified InsertTextCommand::input so as to convert
+        all spaces in text to non-breaking spaces for rdar://problem/5002441.
+        However, the bug was originally caused by rebalanceWhitespaceAt
+        and this workaround introduced a regression bug 14062.
+        Because rebalanceWhitespaceAt appears to behave correctly now,
+        the workaround introduced in 21212 is no longer needed.
+
+        Test: editing/inserting/space-after-removeformat.html
+
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::input):
+
+2009-06-23  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26523 <col> 
+        elements width can't be changed with javascript
+
+        This patch both fixes setting the width attribute directly in 
+        JavaScript, and setting the width on the style attribute. 
+
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::parseMappedAttribute): If we have a 
+        new width, call setNeedsLayoutAndPrefWidthsRecalc()
+
+        Call calcPrefWidths() on the table cols.
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+        
+        Call layoutIfNeeded on the table cols.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::clippedOverflowRectForRepaint): Use new 
+        table() convenience function.
+        (WebCore::RenderTableCol::calcPrefWidths): Just call 
+        setPrefWidthsDirty(false) on ourself and our children.
+        (WebCore::RenderTableCol::table):
+        * rendering/RenderTableCol.h:
+
+2009-06-23  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Add logic to CSSStyleDeclaration::diff to deal with font-sizes that are 
+        keyword values. When diff is called on a CSSStyleDeclaration, we check
+        the keywordSize to see if font-size matches a keyword value.
+        
+        This ensures that when we diff a CSSMutableStyleDeclaration returned from
+        copyInheritableProperties on a CSSComputedStyleDeclaration that we 
+        correctly identify matching font-sizes.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26279
+
+        Test: editing/inserting/font-size-clears-from-typing-style.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::cssPropertyMatches):
+        * css/CSSComputedStyleDeclaration.h:
+        * css/CSSStyleDeclaration.cpp:
+        (WebCore::CSSStyleDeclaration::cssPropertyMatches):
+        (WebCore::CSSStyleDeclaration::diff):
+        * css/CSSStyleDeclaration.h:
+
+2009-06-23  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6994790> CrashTracer: [USER] 8 crashes in Mail trying to
+        add a blank line to pasted Facebook content (under
+        CompositeEditCommand::positionAvoidingSpecialElementBoundary)
+
+        - Just added null checks and I will create a new bug to prevent the
+        bad behavior.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix.
+
+        Wrap shouldDoSoftwarePaint() in #if USE(ACCELERATED_COMPOSITING) to avoid warning when 
+        ACCELERATED_COMPOSITING is not defined.
+
+        * rendering/RenderLayer.cpp:
+
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24863
+        
+        Fix reflection painting on elements with compositing layers.
+
+        Test: compositing/reflections/reflection-on-composited.html
+
+        * rendering/RenderLayer.h:
+        Add a new PaintLayerPaintingReflection flag which is set while painting inside
+        reflections.
+        (WebCore::RenderLayer::setPaintingInsideReflection):
+        Add a setter so that RenderLayerBacking can call it.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::shouldDoSoftwarePaint):
+        Utility to clarify the logic of when a composited layer should do a software paint.
+        
+        (WebCore::RenderLayer::paintLayer):
+        Use shouldDoSoftwarePaint() to determine when to software-paint a reflected layer.
+        Remove transform-related tests from the reflection-painting if test because they appear
+        to be unnecessary.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        Add the code to paint reflections to the composited layer painting method.
+        
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+        Set the PaintLayerPaintingReflection flag.
+
+2009-06-23  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26643
+        Memory cache should respect Cache-Control: no-store
+        
+        Make resources with Cache-Control: no-store uncacheable in the memory cache.
+        They get evicted immediately when all clients are gone and are always
+        reloaded from the server.
+
+        Conforms to RFC2616 14.9.2 and seems also match Firefox behavior.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::removeClient):
+        (WebCore::CachedResource::canUseCacheValidator):
+        (WebCore::CachedResource::mustRevalidate):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::ResourceResponseBase):
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives):
+        (WebCore::ResourceResponseBase::cacheControlContainsNoStore):
+        * platform/network/ResourceResponseBase.h:
+
+2009-06-23  Brady Eidson  <beidson@apple.com>
+
+        Windows build fix.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::play):
+        (QTMovieWin::pause):
+        (QTMovieWin::setRate):
+        (QTMovieWin::setCurrentTime):
+
+2009-06-23  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6902203> REGRESSION: 'Return' insertion point incorrect
+        after manually quoting blank line then hitting return
+
+        If the insertion point is both the begining and ending visible position
+        then we need to insert at the end instead of the begining, which is what
+        would normally happen if the insertion point was as the begining.
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+
+2009-06-23  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig, and looked over by Eric Carlson.
+
+        <rdar://problem/6980466> Media elements should provide option for changing pitch correction
+
+        Introduce a new boolean property to HTMLMediaElement called webkitPreservesPitch for script to control this.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Currently the platforms that have a flexible pitch preservation 
+          property (Quicktime on Mac and Win) have had it on by default, so continue that default for now.
+        (WebCore::HTMLMediaElement::loadResource):
+        (WebCore::HTMLMediaElement::webkitPreservesPitch):
+        (WebCore::HTMLMediaElement::setWebkitPreservesPitch):
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::setPreservesPitch):
+        (WebCore::MediaPlayer::MediaPlayer):
+        (WebCore::MediaPlayer::preservesPitch):
+        (WebCore::MediaPlayer::setPreservesPitch):
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::setPreservesPitch):
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createQTMovie): Rework to allow recreation of the movie with almost the
+          exact same attributes as before, with pitch preservation being the difference.
+        (WebCore::MediaPlayerPrivate::setPreservesPitch): Recreate the QTMovie if the flag actually changes.
+        (WebCore::MediaPlayerPrivate::updateStates): Restore current time and rate if this is a recreated movie.
+        (WebCore::MediaPlayerPrivate::timeChanged): Clear the time-to-be-restored, as this callback means it
+          has been effectively overwritten.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::setPreservesPitch):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::QTMovieWinPrivate):
+        (QTMovieWinPrivate::~QTMovieWinPrivate):
+        (QTMovieWinPrivate::task): Restore current time and rate if this is a re-created movie.
+        (QTMovieWin::play): Clear the time-to-be-restored, as this effectively overwrites it.
+        (QTMovieWin::pause): Ditto.
+        (QTMovieWin::setRate): Ditto.
+        (QTMovieWin::setCurrentTime): Ditto.
+        (QTMovieWin::setPreservesPitch): Recreate the Movie if the flag actually changes.
+        (QTMovieWin::load): Rework to allow recreation of the Movie with similar state as the movie before it, 
+          but changing the pitch preservation flag.
+        * platform/graphics/win/QTMovieWin.h:
+
+2009-06-23  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6998286> Crash after leaving page with <video>
+        
+        Don't try to post events after going into the page cache.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::documentWillBecomeInactive): Cancel pending events and stop
+        event timers so we won't try to post events after going into the cache.
+
+2009-06-23  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Simplify the interaction between LocalStorageArea/SessionStorageArea
+        and StorageArea by creating a "blockUntilImportComplete()" function
+        rather than bouncing back and forth between the child and parent
+        classes in a somewhat unintuitive manner.
+
+        This patch also paves the way for LocalStorageArea and
+        SessionStorageArea being merged into one.  It's part of several in a
+        set which are separating syncing (to disk) code from the rest of the
+        implementation so that local storage and session storage's code can be
+        unified.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25376
+
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        * storage/LocalStorageArea.h:
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::length):
+        (WebCore::StorageArea::key):
+        (WebCore::StorageArea::getItem):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::contains):
+        * storage/StorageArea.h:
+        (WebCore::StorageArea::blockUntilImportComplete):
+
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        First part of https://bugs.webkit.org/show_bug.cgi?id=26652
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint):
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::):
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+        Replace the 3 boolean params to RenderLayer::paintLayer() with a bit mask for readability.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        Remove the unused 'haveTransparency' param to paintIntoLayer().
+
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6997929> Assertion at WebCore::RenderLayer::updateClipRects with hardware acceleration
+
+        The updatingControlTints() painting pass goes through compositing layer boundaries,
+        so we need to ensure we don't cache clip rects computed with the wrong root by
+        setting temporaryClipRects to true.
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
+        Remove a printf that I left in by mistake.
+
+2009-06-23  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebCore side of <rdar://problem/6946094>.
+        
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::setExternalDataObject):
+        * platform/win/ClipboardWin.h:
+
+2009-06-23  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26650
+
+        Add setFormContentType and setFormData since it is awkward for Chromium
+        to use setFormInfoFromRequest to set the underlying members.  Also, add
+        a clearChildren method that Chromium needs.  These methods are used as
+        part of the Chromium code that serializes a HistoryItem for storing in
+        the browser's session history.
+
+        * history/HistoryItem.cpp:
+        * history/HistoryItem.h:
+
+2009-06-23  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6978938> Need HTML 5 event attributes for media elements
+
+        Test: media/event-attributes.html
+
+        * html/HTMLAttributeNames.in: Add media event attribute names.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute): Handle media event attributes.
+
+2009-06-23  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix Qt build with Phonon.
+
+        The #include <phonon> header no longer exists. And the <Phonon> or
+        <Phonon/Phonon> headers have never existed (neither for us nor for the
+        Phonon sources). You have to select each and every header that you do
+        want now.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Remove duplicated code in Qt & GTK logging initialization
+
+        We now share the getChannelFromName() function in Logging.cpp
+
+        * platform/gtk/LoggingGtk.cpp:
+        * platform/qt/LoggingQt.cpp:
+
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Rename the plugin logging channel to plural form 'Plugins'
+
+        This matches both the other logging channel names, as well as the
+        WebKit logging channel used by Safari/Mac for plugins.
+
+        * platform/Logging.cpp:
+        * platform/Logging.h:
+        * platform/gtk/LoggingGtk.cpp:
+        * platform/mac/LoggingMac.mm:
+        * platform/qt/LoggingQt.cpp:
+        * platform/win/LoggingWin.cpp:
+        * plugins/PluginDebug.h:
+        * plugins/gtk/PluginPackageGtk.cpp:
+        * plugins/mac/PluginPackageMac.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginPackageQt.cpp:
+
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix NPAPI mouse translation issues on Mac
+
+        The WindowRef we pass to the plugin refers to the the top level window,
+        so the x and y positions have to be relative to this position, but we
+        have to manually compensate for title bar decorations and other parents
+        of the QWebView since contentsToWindow() only traverses to the QWebView.
+
+        Previously we did this compensation when passing on mouse coordinates to
+        the plugin, which caused various issues with translations such as not
+        being able to close the Flash settings dialog, or the hand cursor not
+        appearing over links.
+
+        We now do the compensation as part of the call to NPP_SetWindow, and
+        then pass mouse coordinates in global context without any compensation,
+        similar to how both Safari and Mozilla does it.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::globalMousePosForPlugin):
+
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] Resolve absolute path to library install_name manually
+
+        Since our target.path is set to the Qt directory (to be able
+        to do 'make install') the 'absolute_library_soname' option
+        to QMake did not do the right thing.
+
+        We now compute the absolute path manually using DESTDIR.
+
+        * WebCore.pro:
+
+2009-06-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6991146> Scrollbars in hardware layers don't change to the
+        inactive look in background windows
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        Don't short-circuit the "painting" pass that is used to udpate control tints.
+
+2009-06-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26567
+        Upstream V8 bindings code generator. With this change, also added interface ancestor
+        traversal to IDL parser, which is necessary for V8 bindings. The traversal is used
+        to determine whether an interface is a Node to facilitate proper casting and storage
+        in V8DOMMap.
+
+        * bindings/scripts/CodeGenerator.pm: Added parent traversal sub, needed
+            by V8 bindings.
+        * bindings/scripts/CodeGeneratorV8.pm: Added.
+        * bindings/scripts/IDLParser.pm: Modified to allow limited parsing for
+            parent traversal cases.
+
+2009-06-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Add event handler attribute getter/setters to HTMLFrameSetElement
+        as specified in HTML 5.  These match the ones on HTMLBodyElement.
+
+        * dom/Node.h:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        (WebCore::HTMLFrameSetElement::onblur):
+        (WebCore::HTMLFrameSetElement::setOnblur):
+        (WebCore::HTMLFrameSetElement::onerror):
+        (WebCore::HTMLFrameSetElement::setOnerror):
+        (WebCore::HTMLFrameSetElement::onfocus):
+        (WebCore::HTMLFrameSetElement::setOnfocus):
+        (WebCore::HTMLFrameSetElement::onload):
+        (WebCore::HTMLFrameSetElement::setOnload):
+        (WebCore::HTMLFrameSetElement::onbeforeunload):
+        (WebCore::HTMLFrameSetElement::setOnbeforeunload):
+        (WebCore::HTMLFrameSetElement::onmessage):
+        (WebCore::HTMLFrameSetElement::setOnmessage):
+        (WebCore::HTMLFrameSetElement::onoffline):
+        (WebCore::HTMLFrameSetElement::setOnoffline):
+        (WebCore::HTMLFrameSetElement::ononline):
+        (WebCore::HTMLFrameSetElement::setOnonline):
+        (WebCore::HTMLFrameSetElement::onresize):
+        (WebCore::HTMLFrameSetElement::setOnresize):
+        (WebCore::HTMLFrameSetElement::onstorage):
+        (WebCore::HTMLFrameSetElement::setOnstorage):
+        (WebCore::HTMLFrameSetElement::onunload):
+        (WebCore::HTMLFrameSetElement::setOnunload):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
+
+2009-06-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
+        https://bugs.webkit.org/show_bug.cgi?id=25425
+
+        * bindings/scripts/CodeGeneratorJS.pm: Added handling for ReflectURL.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+
+        * dom/Element.cpp:
+        (WebCore::Element::getURLAttribute): Added. For use implementing getters
+        for ReflectURL.
+        * dom/Element.h: Added getURLAttribute.
+
+        * html/HTMLImageElement.idl: Use Reflect and ReflectURL.
+
+2009-06-22  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 26626: Make WorkerContextExecutionProxy::toV8Object handle exception
+        objects.
+        https://bugs.webkit.org/show_bug.cgi?id=26626
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+
+2009-06-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add RenderDataGrid to the build.  Give it some basic default styling (that more or less matches a listbox).  It has a default size
+        of 300x150.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/html4.css:
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::createRenderer):
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * rendering/RenderDataGrid.cpp: Added.
+        (WebCore::RenderDataGrid::RenderDataGrid):
+        (WebCore::RenderDataGrid::~RenderDataGrid):
+        (WebCore::RenderDataGrid::calcPrefWidths):
+        (WebCore::RenderDataGrid::paintObject):
+        (WebCore::RenderDataGrid::valueChanged):
+        (WebCore::RenderDataGrid::invalidateScrollbarRect):
+        (WebCore::RenderDataGrid::isActive):
+        * rendering/RenderDataGrid.h: Added.
+        (WebCore::RenderDataGrid::renderName):
+        (WebCore::RenderDataGrid::canHaveChildren):
+        (WebCore::RenderDataGrid::scrollbarCornerPresent):
+
+2009-06-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26430
+        <rdar://problem/6944442> Elements jump around when they become composited (WWDC checkers demo)
+        <rdar://problem/6989006> Lots of time spent in RenderLayerCompositor::calculateCompositedBounds()
+            during window resize when using hardware layers
+        
+        Fix an ordering dependency which caused the compositing position of a layer
+        to be affected by some later sibling, which affected the compositing ancestor's
+        composited bounds.
+        
+        The fix is to only update the compositing positions of layers in some subtree
+        when updateAfterLayout() has been called on all the layers in that subtree,
+        from the ancestor down.
+        
+        Also cache the composited bounds of a RenderLayerBacking, now that we can
+        guarantee that those bounds are accurate.
+        
+        Test: compositing/sibling-positioning.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::hitTestLayer):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        (WebCore::RenderLayerBacking::compositedBounds):
+        (WebCore::RenderLayerBacking::setCompositedBounds):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
+        * rendering/RenderLayerCompositor.h:
+
+2009-06-22  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        First step in https://bugs.webkit.org/show_bug.cgi?id=25376
+
+        Add StorageSyncManager.cpp/h
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+
+        In preparation for combining SessionStorage and LocalStorage into a
+        single StorageManager, move the syncing bits out of LocalStorage and
+        into its own class.
+
+        The next step is to combine LocalStorageArea and SessionStorageArea
+        into one.  Then SessionStorage and LocalStorage can be combined.
+
+        Note that combining them will cut down on code paths that must be
+        proxied, eliminate virtual dispatch, and allow Chromium to (eventually)
+        write historical sessionStorage to disk when memory is getting tight.
+
+        Also remove a couple bits of cruft including code for quotas which is
+        unnecessary (since a meta-data db is unnecessary since you can just
+        count bytes as you read the local storage databases into memory).
+
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::LocalStorage):
+        (WebCore::LocalStorage::storageArea):
+        (WebCore::LocalStorage::close):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::syncTimerFired):
+        (WebCore::LocalStorageArea::performImport):
+        * storage/LocalStorageArea.h:
+        (WebCore::LocalStorageArea::create):
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::performTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::):
+        (WebCore::LocalStorageTask::createImport):
+        * storage/LocalStorageThread.cpp:
+        * storage/LocalStorageThread.h:
+        * storage/SessionStorage.h:
+        * storage/StorageSyncManager.cpp: Copied from WebCore/storage/LocalStorage.cpp.
+        (WebCore::StorageSyncManager::create):
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::fullDatabaseFilename):
+        (WebCore::StorageSyncManager::close):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h: Copied from WebCore/storage/LocalStorage.h.
+        (WebCore::):
+
+2009-06-22  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26622
+        Add ChromiumDataObject::copy()
+
+        * platform/chromium/ChromiumDataObject.cpp:
+        * platform/chromium/ChromiumDataObject.h:
+
+2009-06-22  Timothy Hatcher  <timothy@apple.com>
+
+        Add a silhouette image for the enable view of the Resource panel.
+
+        Reviewed by Kevin McCullough.
+
+        * inspector/front-end/Images/resourcesSilhouette.png: Added.
+        * inspector/front-end/inspector.css:
+
+2009-06-22  Kyle Prete  <kylep@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26552
+        Add V8 JS bindings for Audio Constructor.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added a callback declaration for audio ctor to macro.
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        Added the whole file.
+
+2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26600
+        StringImpl::copy() no longer copies empty string correctly
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::ustring): Changed method calling syntax to look less like calling a
+        static method.
+        (WebCore::StringImpl::copy): Reverted part of r41917 that caused the problem.
+
+2009-06-22  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Not auto-testable since it involves sending a keyboard event to
+        the popup, which is not possible (eventSender sends the key
+        events through webview, we want to go through the webwidget).
+
+        This patch is one part of the fix for issue "keyboard selection in
+        Hebrew select element does not work in Windows". The other part of the
+        fix is in chromium's webkit/glue layer.
+        https://bugs.webkit.org/show_bug.cgi?id=25899
+
+        * manual-tests/keyboard_select_non_english.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::isCharacterTypeEvent): Added. Check whether the event is a 
+        character type event. "Char" in Windows or "KeyDown" in Mac is character
+        type event.
+        (WebCore::PopupListBox::typeAheadFind): Since m_lastCharTime is used to
+        indicate whether user types multiple characters continuely as a search
+        prefix or not, it should be only assigned when the event is character 
+        type event. 
+
+2009-06-22  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6115819> Notify of profile start in console
+
+        Put a message in the console that announces that a profile has started,
+        similar to how a console message announces that a profile has finished.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile): Use renamed function.
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        Renamed.
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        New function that logs the message about the profile starting.
+        (WebCore::InspectorController::startUserInitiatedProfiling): Ditto
+        * inspector/InspectorController.h:
+        * inspector/front-end/ProfilesPanel.js: Print the "run" of the profile's
+        title if there are multiple profiles, and take into account the fact
+        that titles are displayed twice as much now.
+        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
+        * page/Console.cpp:
+        (WebCore::Console::profile): Call new function.
+
+2009-06-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26615
+
+        Add IDL interface for datagrid cell elements.  Add a few more properties to the datagrid itself that
+        correspond to ones you find on <select> elements.
+
+        Add an expanded property to row elements.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLDataGridCellElement.cpp: Added.
+        (WebCore::HTMLDataGridCellElement::HTMLDataGridCellElement):
+        (WebCore::HTMLDataGridCellElement::label):
+        (WebCore::HTMLDataGridCellElement::setLabel):
+        (WebCore::HTMLDataGridCellElement::focused):
+        (WebCore::HTMLDataGridCellElement::setFocused):
+        (WebCore::HTMLDataGridCellElement::checked):
+        (WebCore::HTMLDataGridCellElement::setChecked):
+        (WebCore::HTMLDataGridCellElement::indeterminate):
+        (WebCore::HTMLDataGridCellElement::setIndeterminate):
+        (WebCore::HTMLDataGridCellElement::progress):
+        (WebCore::HTMLDataGridCellElement::setProgress):
+        * html/HTMLDataGridCellElement.h: Added.
+        (WebCore::HTMLDataGridCellElement::endTagRequirement):
+        (WebCore::HTMLDataGridCellElement::tagPriority):
+        * html/HTMLDataGridCellElement.idl: Added.
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::autofocus):
+        (WebCore::HTMLDataGridElement::setAutofocus):
+        (WebCore::HTMLDataGridElement::disabled):
+        (WebCore::HTMLDataGridElement::setDisabled):
+        (WebCore::HTMLDataGridElement::size):
+        (WebCore::HTMLDataGridElement::setSize):
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp:
+        (WebCore::HTMLDataGridRowElement::checkDTD):
+        (WebCore::HTMLDataGridRowElement::expanded):
+        (WebCore::HTMLDataGridRowElement::setExpanded):
+        * html/HTMLDataGridRowElement.h:
+        * html/HTMLDataGridRowElement.idl:
+        * html/HTMLElementsAllInOne.cpp:
+        * html/HTMLTagNames.in:
+
+2009-06-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add event handler attribute getter/setters to HTMLBodyElement
+        as specified in HTML 5.
+
+        - Removes erroneous inclusion of the onresize and onunload event
+        handler attributes in Element and Document.
+
+        * dom/Document.cpp:
+        (WebCore::Document::getWindowAttributeEventListener):
+        * dom/Document.h:
+        * dom/Document.idl:
+        * dom/Element.idl:
+        * dom/Node.cpp:
+        * dom/Node.h: onblur, onerror, onfocus, and onload all need to be declared
+        virtual, since their behavior for HTMLBodyElement differs from the base
+        implementation.
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::onblur):
+        (WebCore::HTMLBodyElement::setOnblur):
+        (WebCore::HTMLBodyElement::onerror):
+        (WebCore::HTMLBodyElement::setOnerror):
+        (WebCore::HTMLBodyElement::onfocus):
+        (WebCore::HTMLBodyElement::setOnfocus):
+        (WebCore::HTMLBodyElement::onload):
+        (WebCore::HTMLBodyElement::setOnload):
+        (WebCore::HTMLBodyElement::onbeforeunload):
+        (WebCore::HTMLBodyElement::setOnbeforeunload):
+        (WebCore::HTMLBodyElement::onmessage):
+        (WebCore::HTMLBodyElement::setOnmessage):
+        (WebCore::HTMLBodyElement::onoffline):
+        (WebCore::HTMLBodyElement::setOnoffline):
+        (WebCore::HTMLBodyElement::ononline):
+        (WebCore::HTMLBodyElement::setOnonline):
+        (WebCore::HTMLBodyElement::onresize):
+        (WebCore::HTMLBodyElement::setOnresize):
+        (WebCore::HTMLBodyElement::onstorage):
+        (WebCore::HTMLBodyElement::setOnstorage):
+        (WebCore::HTMLBodyElement::onunload):
+        (WebCore::HTMLBodyElement::setOnunload):
+        * html/HTMLBodyElement.h:
+        * html/HTMLBodyElement.idl:
+
+2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26601
+        Remove disabled code for appcache dynamic entries
+
+        This also removes code for DOM 3 Core DOMStringList, which we don't use for anything else yet.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSDOMStringListCustom.cpp: Removed.
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMStringListCustom.cpp: Removed.
+        * dom/DOMStringList.cpp: Removed.
+        * dom/DOMStringList.h: Removed.
+        * dom/DOMStringList.idl: Removed.
+        * dom/StaticStringList.cpp: Removed.
+        * dom/StaticStringList.h: Removed.
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::addResource):
+        * loader/appcache/ApplicationCache.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+        * loader/appcache/ApplicationCacheResource.cpp:
+        (WebCore::ApplicationCacheResource::dumpType):
+        * loader/appcache/ApplicationCacheResource.h:
+        (WebCore::ApplicationCacheResource::):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::storeUpdatedType):
+        * loader/appcache/DOMApplicationCache.cpp:
+        * loader/appcache/DOMApplicationCache.h:
+        * loader/appcache/DOMApplicationCache.idl:
+        * page/DOMWindow.idl:
+
+2009-06-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * DerivedSources.cpp:
+        * html/HTMLElementsAllInOne.cpp:
+
+2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by John Sullivan.
+
+        <rdar://problem/6956606> REGRESSION (S4Beta -> Final): After the password is input,
+        Japanese can't be input.
+
+        WebKit uses a per-frame input context for most editable fields, and application's global
+        context for password fields, manually controlling secure input state and the list of available
+        input sources.
+
+        We were setting TSMDocument property to disable non-Roman input methods after focus changed
+        to a password field, but before selection was updated. This resulted in the property being
+        applied to a wrong TSMDocument in some cases, because TSMGetActiveDocument() uses input
+        context cached by +[NSApplication updateWindows], we change context based on selection,
+        not on focus.
+
+        * page/mac/FrameMac.mm: (WebCore::Frame::setUseSecureKeyboardEntry): Since there is only one
+        context that we use for password fields - the global one - there is no need to get the active
+        one.
+
+2009-06-22  David Levin  <levin@chromium.org>
+
+        Reviewed by David Hyatt and Eric Seidel.
+
+        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
+        https://bugs.webkit.org/show_bug.cgi?id=26326
+
+        Test: scrollbars/scrollbar-crash-on-refresh.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        Gives the FrameView a change to do any necessary cleanup on
+        Document::detach() which is where the renderArena gets detroyed.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        Gets rid of any custom scrollbars (if the docment supplied them).
+        * page/FrameView.h:
+        * platform/Scrollbar.h:
+        (WebCore::Scrollbar::isCustomScrollbar):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        Removed the check for document()->frame().  If frame() is 0 in this code,
+        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
+        * rendering/RenderScrollbar.h:
+        (WebCore::RenderScrollbar::isCustomScrollbar):
+
+2009-06-22  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=23606
+          <rdar://problem/6537777> CSS gradient not repainted when image load
+          completes
+
+        Test: fast/repaint/background-generated.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers): Return true if the layer does not
+        specify a size and the image uses the container size.
+
+2009-06-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26607
+
+        Add IDL for HTMLDataGridRowElement.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::primary):
+        (WebCore::HTMLDataGridColElement::setPrimary):
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::checkDTD):
+        (WebCore::HTMLDataGridElement::multiple):
+        (WebCore::HTMLDataGridElement::setMultiple):
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp: Added.
+        (WebCore::HTMLDataGridRowElement::HTMLDataGridRowElement):
+        (WebCore::HTMLDataGridRowElement::selected):
+        (WebCore::HTMLDataGridRowElement::setSelected):
+        (WebCore::HTMLDataGridRowElement::focused):
+        (WebCore::HTMLDataGridRowElement::setFocused):
+        * html/HTMLDataGridRowElement.h: Added.
+        (WebCore::HTMLDataGridRowElement::tagPriority):
+        * html/HTMLDataGridRowElement.idl: Added.
+        * html/HTMLTagNames.in:
+
+2009-06-19  Yael Aharon <yael.aharon@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26556
+
+        Fix a crash in case that the QNetworkReply::readReady signal is
+        "stuck" in deferred mode due to JavaScript alert, and in the meantime,
+        QNetworkreply::finished signal is received and processed before
+        QNetworkReply::readReady is processed.
+
+        * manual-tests/qt/unload-alert.html: Added.
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::setLoadMode):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::start):
+        (WebCore::QNetworkReplyHandler::sendQueuedItems):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        (WebCore::QNetworkReplyHandler::):
+
+2009-06-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Fix the Qt build.
+
+        * WebCore.pro:
+
+2009-06-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
+        https://bugs.webkit.org/show_bug.cgi?id=25425
+
+        * bindings/scripts/CodeGeneratorJS.pm: Tweaked mechanism for includes to be a bit
+        more consistent and to make SVGElement.h be included in the header rather than in
+        every implementation file that includes the header. Added code to use getAttribute
+        and setAttribute directly when the [Reflect] extended attribute is used.
+
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+
+        * html/HTMLElement.idl: Used [Reflect] for all the attributes in this class that
+        reflect content attributes. Restricting this to one class for now to keep the
+        patch small and start out slowly.
+
+2009-06-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26596
+        Only expose event handler attributes to elements and documents.
+
+        Test: fast/dom/event-attribute-availability.html
+
+        * dom/Document.idl:
+        * dom/Element.idl:
+        * dom/Node.cpp:
+        * dom/Node.h:
+        * dom/Node.idl:
+
+2009-06-21  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26580
+        
+        Fix to enable XSSAuditor on child windows.
+        
+        Test: http/tests/security/xssAuditor/link-opens-new-window.html
+        
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::isEnabled):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        * page/XSSAuditor.h: Removed method setXSSAuditorEnabled, and field m_isEnabled.
+        Moved implementation of isEnabled to XSSAuditor.cpp and changed implementation
+        to query Settings.
+
+2009-06-21  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY.
+
+        Speculative windows build fix (idea by Mark Rowe).
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-06-21  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (Speculative gtk build fix).
+
+        * GNUmakefile.am:
+
+2009-06-21  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY.
+
+        Speculative tiger build fix and a windows build fix.
+        More fixes may still be in order.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * dom/default/PlatformMessagePortChannel.h:
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
+
+2009-06-21  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (Speculative tiger build fix).
+
+        * dom/default/PlatformMessagePortChannel.h:
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::~MessagePortQueue):
+
+2009-06-21  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26448>
+        
+        Added optimized GC for MessagePorts when the entangled port is run by the same thread.
+        Fixed bug in isProxyFor() that was not properly throwing an exception when trying to clone the entangled port.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markActiveObjectsForContext):
+        Now marks remotely entangled ports as in-use, in addition to those with pending activity.
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        Now checks if the entangled port is local (run by same thread) and if so mark()s it.
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::disentangle):
+        Removes cloned ports from the ScriptExecutionContext - this allows cloned ports to be GC'd as otherwise they look like remotely entangled ports.
+        (WebCore::MessagePort::start):
+        (WebCore::MessagePort::locallyEntangledPort):
+        Added API for fetching the entangled port if it is run by the same thread
+        * dom/MessagePort.h:
+        * dom/MessagePortProxyWrapper.h:
+        * dom/default/MessagePortProxy.cpp:
+        (WebCore::MessagePortProxyWrapper::locallyEntangledPort):
+        Added API for fetching the entangled port if it is run by the same thread        
+        (WebCore::MessagePortProxy::hasPendingActivity):
+        Changed definition of hasPendingActivity() to be stricter - only returns true if there are pending messages.
+        (WebCore::MessagePortProxy::locallyEntangledPort):
+        * dom/default/MessagePortProxy.h:
+
+2009-06-21  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25043>
+        Removed obsolete MessagePort.startConversation(), active and onclose APIs.
+
+        Refactored MessagePortProxy into MessagePortChannel and a platform-dependent PlatformMessagePortChannel
+        implementation. Modified APIs to simplify cross-process implementations by moving the messaging code
+        entirely into the platform-dependent proxy.
+
+        Created a thread-safe default PlatformMessagePortChannel implementation.
+
+        Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how
+        cross-thread MessagePorts work.
+        
+        * GNUMakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+            Added MessagePortChannel/PlatformMessagePortChannel files.
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+            Changed ports to not mark their entangled pair as reachable, per the spec.
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * dom/MessageChannel.cpp:
+        (WebCore::MessageChannel::MessageChannel):
+            Updated to use PlatformMessagePortChannel::createChannel() to entangle the ports.
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::MessagePort):
+        (WebCore::MessagePort::~MessagePort):
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::disentangle):
+        (WebCore::MessagePort::messageAvailable):
+        (WebCore::MessagePort::start):
+        (WebCore::MessagePort::close):
+        (WebCore::MessagePort::entangle):
+        (WebCore::MessagePort::contextDestroyed):
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::setOnmessage):
+        (WebCore::MessagePort::hasPendingActivity):
+            Changed these APIs to delegate to new PlatformMessagePortChannel APIs.
+        * dom/MessagePort.h:
+            Renamed isQueueOpen() to started().
+        * dom/MessagePort.idl:
+            Removed startConversation and onclose.
+        * dom/MessagePortProxy.h: Removed.
+        * dom/MessagePortChannel.cpp: Added.
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        (WebCore::MessagePortChannel::~MessagePortChannel):
+        * dom/MessagePortChannel.h: Added.
+        (WebCore::MessagePortChannel::EventData::message):
+        (WebCore::MessagePortChannel::EventData::channel):
+            Changed EventData to hold a reference to a MessagePortChannel object instead of a MessagePort to enable cross-thread messaging.
+        (WebCore::MessagePortChannel::MessagePortChannel):
+        (WebCore::MessagePortChannel::create):        
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore:ScriptExecutionContext::dispatchMessagePortEvents):
+            Renamed isQueueOpen() to started().
+        * dom/default/PlatformMessagePortChannel.cpp: Added.
+        (WebCore::MessagePortChannel::entangleIfOpen):
+        (WebCore::MessagePortChannel::disentangle):
+        (WebCore::MessagePortChannel::postMessageToRemote):
+        (WebCore::MessagePortChannel::tryGetMessageFromRemote):
+        (WebCore::MessagePortChannel::close):
+        (WebCore::MessagePortChannel::isConnectedTo):
+        (WebCore::MessagePortChannel::hasPendingActivity):
+        (WebCore::PlatformMessagePortChannel::PlatformMessagePortChannel):
+        (WebCore::PlatformMessagePortChannel::~PlatformMessagePortChannel):
+        (WebCore::PlatformMessagePortChannel::createChannel):
+        (WebCore::PlatformMessagePortChannel::entangleIfOpen):
+        (WebCore::PlatformMessagePortChannel::disentangle):
+        (WebCore::PlatformMessagePortChannel::setRemotePort):
+        (WebCore::PlatformMessagePortChannel::remotePort):
+        (WebCore::PlatformMessagePortChannel::entangledChannel):
+        (WebCore::PlatformMessagePortChannel::setEntangledChannel):
+        (WebCore::PlatformMessagePortChannel::postMessageToRemote):
+        (WebCore::PlatformMessagePortChannel::tryGetMessageFromRemote):
+        (WebCore::PlatformMessagePortChannel::isConnectedTo):
+        (WebCore::PlatformMessagePortChannel::close):
+        (WebCore::PlatformMessagePortChannel::closeInternal):
+        (WebCore::PlatformMessagePortChannel::hasPendingActivity):
+        * dom/default/PlatformMessagePortChannel.h: Added.
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::create):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::appendAndCheckEmpty):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::isEmpty):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::MessagePortQueue):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+            Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how cross-thread MessagePorts work.
+        (WebCore::PostMessageTimer::event):
+        (WebCore::DOMWindow::postMessage):
+        (WebCore::DOMWindow::postMessageTimerFired):
+
+2009-06-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=15383
+          <rdar://problem/5682745> resize: vertical does not restrict to vertical
+          resize
+
+        Test: fast/css/resize-single-axis.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::resize): Ignore movement along the non-resizing
+        axis.
+
+2009-06-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Eric Seidel
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26578
+        event.currentTarget for listener registered on window should point to the window object like in Firefox
+
+        Test: fast/events/event-trace.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent): Make the DOMWindow the currentTarget when events are dispatched
+        to it. We previously used the document because DOMWindow was not yet an EventTarget.
+
+2009-06-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=9694
+          resize value not compared
+
+        Test: fast/css/resize-value-compared.html
+
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::operator==): Compare the resize
+        member.
+
+2009-06-19  Alice Liu  <alice.liu@apple.com>
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=26568 
+        Repro crash animating GIF if previously used in a closed window's back/forward list
+        Also filed as <rdar://problem/6978362>
+
+        Reviewed by Maciej Stachowiak.
+
+        Can't test this bug with an automated layout test since it requires b/f caching 
+        * manual-tests/animated-gif-bfcache-crash.html: Added.
+        * manual-tests/resources/containsAnimatedGif.html: Added.
+
+        Adding checks for hostWindow() since there is no guarantee that the Page is alive
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollRectIntoViewRecursively):
+        (WebCore::ScrollView::contentsToScreen):
+        (WebCore::ScrollView::screenToContents):
+        (WebCore::ScrollView::wheelEvent):
+
+2009-06-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26554
+        Shadowing of top and parent
+
+        * page/DOMWindow.idl:
+
+2009-06-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=15106>.
+        Bug 15106: REGRESSION: Can't drag text as element when user-select is set to none
+
+        We allow selections to begin within an element that has -webkit-user-select: none set,
+        unless the element is draggable as dragging should take priority over starting a selection.
+
+        Test: editing/selection/user-drag-element-and-user-select-none.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::canStartSelection):
+
+2009-06-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 26528: REGRESSION (r44674): Assertion in TextIterator::pushFullyClippedState while counting matches for "a" on apple.com
+        https://bugs.webkit.org/show_bug.cgi?id=26528
+        rdar://problem/6985329
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::handleReplacedElement): When entering a text control,
+        start at the top of the shadow tree (by calling shadowTreeRootNode). Also
+        remove assumption that innerTextElement will never be 0 since RenderTextControl
+        doesn't really guarantee this.
+
+2009-06-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by NOBODY.
+
+        Speculative Qt build fix - add HTMLDataGridColElement to the build script.
+
+        * WebCore.pro:
+
+2009-06-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26561
+
+        Remove a memcpy by retrieving the already existing copy of a string
+        instead of making a new one.
+
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        (WebCore::ScriptSourceCode::source):
+        * bindings/js/StringSourceProvider.h:
+        (WebCore::StringSourceProvider::source):
+
+2009-06-19  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Steve Falkenburg.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26488
+        No Support for Single Finger or Two Finger Panning in Windows 7
+        
+        The code in WebCore allows us to interpret a Pan gesture as
+        a mousewheel event, and we are able to reuse the scrolling code.
+        Another constructor was created in WheelEventWin which takes data
+        better suited to the pan guesture than what was currently there. 
+        
+        Unable to add tests to simulate touch behavior/gestures.
+
+        * platform/PlatformWheelEvent.h:
+        * platform/win/WheelEventWin.cpp:
+
+2009-06-19  Chris Marrin  <cmarrin@apple.com>
+
+        Fixed a build error, which only shows up in the i386 compile
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
+
+2009-06-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6988385> REGRESSION: In full page video player, movie's
+        video track becomes detached from its controller.
+        
+        When in the media document, the MediaPlayer should not report that it
+        is capable of hardware acceleration, because it renders via a QTMovieView
+        which is already accelerated.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
+
+2009-06-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Adding XSSAuditor.cpp to the wx build.
+
+        * WebCoreSources.bkl:
+
+2009-06-19  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26544
+
+        If I am doing a Matrix hardware animation and any matrix is singular, I revert to software.
+        This is not really testable, since we can't see what the hardware animation is doing.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
+
+2009-06-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        An additional fix for Bug 26532: Native functions do not correctly unlink
+        from optimised callsites when they're collected
+        <https://bugs.webkit.org/show_bug.cgi?id=26532> | <rdar://problem/6625385>
+
+        Use "NativeFunctionWrapper" instead of "PrototypeFunction" in cross-frame
+        accessors, so the type of object you get to wrap a function is the same,
+        regardless of whether the access to the function is cross-frame.
+        
+        This is faster and more idiomatic than what we had before. It also would
+        have avoided Bug 26532 because it would have prevented a conflicting
+        PrototypeFunction from being allocated to wrap postMessage, where a
+        NativeFunctionWrapper had been allocated previously.
+        
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::objectToStringFunctionGetter):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::nonCachingStaticFunctionGetter):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::nonCachingStaticBackFunctionGetter):
+        (WebCore::nonCachingStaticForwardFunctionGetter):
+        (WebCore::nonCachingStaticGoFunctionGetter):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::nonCachingStaticReplaceFunctionGetter):
+        (WebCore::nonCachingStaticReloadFunctionGetter):
+        (WebCore::nonCachingStaticAssignFunctionGetter):
+
+2009-06-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by John Sullivan
+
+        <rdar://problem/6953673> Crash in RenderLayerCompositor::setCompositingParent
+        
+        Fix a crash that could occur in complex content due to timing issues
+        when doing a partial layer tree rebuild which is required when painting;
+        setCompositingParent() could be called with a parent which has not been made
+        compositing yet.
+
+2009-06-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Build fix. Adding missing HTMLDataGrid* files to the build.
+
+        * GNUmakefile.am:
+
+2009-06-19  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460 part three
+        Make BMPImageReader a standalone class that is used by ICOImageDecoder
+        and BMPImageDecoder to decode individual BMPs within a file.  These
+        decoders now inherit directly from ImageDecoder.
+        
+        This also makes these decoders decode on-demand in isSizeAvailable() and
+        frameBufferAtIndex(), like the other decoders, instead of when setData()
+        is called, like before.  This should provide a speedup on pages
+        containing BMPs that aren't immediately onscreen.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::BMPImageDecoder):
+        (WebCore::BMPImageDecoder::setData):
+        (WebCore::BMPImageDecoder::isSizeAvailable):
+        (WebCore::BMPImageDecoder::frameBufferAtIndex):
+        (WebCore::BMPImageDecoder::decodeWithCheckForDataEnded):
+        (WebCore::BMPImageDecoder::decode):
+        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/image-decoders/bmp/BMPImageDecoder.h:
+        (WebCore::BMPImageDecoder::readUint32):
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::BMPImageReader):
+        (WebCore::BMPImageReader::decodeBMP):
+        (WebCore::BMPImageReader::readInfoHeaderSize):
+        (WebCore::BMPImageReader::processInfoHeader):
+        (WebCore::BMPImageReader::readInfoHeader):
+        (WebCore::BMPImageReader::processBitmasks):
+        (WebCore::BMPImageReader::processColorTable):
+        (WebCore::BMPImageReader::processRLEData):
+        (WebCore::BMPImageReader::processNonRLEData):
+        (WebCore::BMPImageReader::setFailed):
+        * platform/image-decoders/bmp/BMPImageReader.h:
+        (WebCore::BMPImageReader::readUint16):
+        (WebCore::BMPImageReader::readUint32):
+        (WebCore::BMPImageReader::setBuffer):
+        (WebCore::BMPImageReader::setData):
+        (WebCore::BMPImageReader::):
+        (WebCore::BMPImageReader::pastEndOfImage):
+        (WebCore::BMPImageReader::readCurrentPixel):
+        (WebCore::BMPImageReader::setRGBA):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::ICOImageDecoder):
+        (WebCore::ICOImageDecoder::setData):
+        (WebCore::ICOImageDecoder::isSizeAvailable):
+        (WebCore::ICOImageDecoder::size):
+        (WebCore::ICOImageDecoder::frameBufferAtIndex):
+        (WebCore::ICOImageDecoder::decodeWithCheckForDataEnded):
+        (WebCore::ICOImageDecoder::decode):
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::processDirectoryEntries):
+        (WebCore::ICOImageDecoder::readDirectoryEntry):
+        (WebCore::ICOImageDecoder::processImageType):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        (WebCore::ICOImageDecoder::readUint16):
+        (WebCore::ICOImageDecoder::readUint32):
+
+2009-06-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26555
+
+        Fix the Chromium canary bot.  Turns out ScriptSourceCode doesn't have
+        the same API in V8 and JSC.
+
+        * WebCore/bindings/js/ScriptController.cpp:
+        * WebCore/bindings/js/ScriptSourceCode.h:
+        * WebCore/bindings/v8/ScriptController.cpp:
+        * WebCore/page/XSSAuditor.cpp:
+        * WebCore/page/XSSAuditor.h:
+
+2009-06-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26547
+        
+        Implement the IDL interface for HTMLDataGridColElement.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLDataGridColElement.cpp: Added.
+        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
+        (WebCore::HTMLDataGridColElement::label):
+        (WebCore::HTMLDataGridColElement::setLabel):
+        (WebCore::HTMLDataGridColElement::type):
+        (WebCore::HTMLDataGridColElement::setType):
+        (WebCore::HTMLDataGridColElement::sortable):
+        (WebCore::HTMLDataGridColElement::setSortable):
+        (WebCore::HTMLDataGridColElement::sortDirection):
+        (WebCore::HTMLDataGridColElement::setSortDirection):
+        (WebCore::HTMLDataGridColElement::selected):
+        (WebCore::HTMLDataGridColElement::setSelected):
+        * html/HTMLDataGridColElement.h: Added.
+        (WebCore::HTMLDataGridColElement::endTagRequirement):
+        (WebCore::HTMLDataGridColElement::tagPriority):
+        * html/HTMLDataGridColElement.idl: Added.
+        * html/HTMLDataGridElement.h:
+        * html/HTMLElementsAllInOne.cpp:
+        * html/HTMLTagNames.in:
+        * page/DOMWindow.idl:
+
+2009-06-19  Chris Evans  <scarybeasts@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        There is no new test because this cannot be tested deterministically.
+        I've not been able to cause a crash at all in the test framework, but
+        I have verified that this is happening in the wild and that the patch
+        fixes the likely cause in the debugger.
+
+        * loader/TextResourceDecoder.cpp: careful not to iterate off the end
+          of our input buffer looking for the end of the comment.
+
+2009-06-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26536
+
+        Fix external-script-URL-location.html and
+        write-external-script-open.html LayoutTests.
+
+        implicitOpen is called from several places.  We need to setXSSAuditor
+        each time, so I moved the call inside implicitOpen.
+
+        * dom/Document.cpp:
+        (WebCore::Document::open):
+        (WebCore::Document::implicitOpen):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+
+2009-06-19  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Levin.
+
+        Use WebCore::multipleFileUploadText() in Chromium to fix a problem
+        that Chromium shows only the first filename even if a user selects
+        multiple files for <input type=file multiple>.
+        <https://bugs.webkit.org/show_bug.cgi?id=26502>
+
+        * platform/chromium/FileChooserChromium.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+
+2009-06-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6967596> Safari hung using 100% CPU when I tried
+          to look up a word in Dictionary using command-control-d
+
+        Test: editing/selection/move-by-line-005.html
+
+        The root cause of this bug was searchAheadForBetterMatch() continuing
+        past the first rendered text object after the given object. While we
+        want to skip non-rendered text and empty containers, when we encounter
+        rendered text object, we must return a text box for that object.
+
+        * dom/Position.cpp:
+        (WebCore::searchAheadForBetterMatch):
+
+2009-06-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by David Levin
+
+        https://bugs.webkit.org/show_bug.cgi?id=25657
+
+        Chromium Linux port does not handle non-BMP characters properly.
+        It's fixed with a 'UTF-16 iterator macro' to extract Unicode
+        codepoints out of a UTF-16 input string.
+
+        A manual test is added for non-BMP character rendering,
+        which we can use until a small freely-distributable font
+        covering non-BMP is added to the Webkit source tree.
+
+
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+        * manual-tests/non-bmp.html: Added.
+
+2009-06-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 Bindings: return proper state from the script stack.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26512
+
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::state):
+
+2009-06-19  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Windows build fix.
+        
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2009-06-19  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+        Build fix after 44825.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-06-18  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26426: Canvas: rotation of 'no-repeat' pattern is weird
+        <https://bugs.webkit.org/show_bug.cgi?id=26426>
+
+        Use 1<<23-1 as steps of no-repeat patterns instead of 100000000.0f.
+        The original number cannot be represented by mantissa of float
+        (23bit) so that it caused some error.
+
+        Test: fast/canvas/image-object-in-canvas.html:
+
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2009-06-19  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempt to fix the Chromium build.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::xssAuditor):
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+
+2009-06-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26199
+
+        Added an experimental reflective XSS filter.  The filter is disabled by
+        default.
+
+        Test: http/tests/security/xssAuditor/script-tag.html
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptController.h:
+        (WebCore::ScriptController::xssAuditor):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * dom/Tokenizer.h:
+        (WebCore::Tokenizer::xssAuditor):
+        (WebCore::Tokenizer::setXSSAuditor):
+        (WebCore::Tokenizer::Tokenizer):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        (WebCore::FrameLoader::requestObject):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setXSSAuditorEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::xssAuditorEnabled):
+        * page/XSSAuditor.cpp: Added.
+        (WebCore::isControlCharacter):
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::~XSSAuditor):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::decodeURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h: Added.
+        (WebCore::XSSAuditor::isEnabled):
+        (WebCore::XSSAuditor::setXSSAuditorEnabled):
+
+2009-06-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        feOffset and objectBoundingBox
+        [https://bugs.webkit.org/show_bug.cgi?id=26441]
+
+        If we use objectBoundingBox for primitiveUnits, the fractions given
+        to dx or dy of feOffset must be multiplied with the referenced objects
+        objectBoundingBox size.
+
+        Test: svg/filters/feOffset.svg
+
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+
+2009-06-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        feTile implementation missing
+        [https://bugs.webkit.org/show_bug.cgi?id=26419]
+
+        Implementation of feTile, a pattern effect for SVG filters. It was
+        necessary to modify FilterEffect since source inputs need a secial
+        logic and we have to identify if an effect is a source input.
+
+        Tests: svg/batik/filters/feTile.svg
+               svg/filters/feTile.svg
+
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::isSourceInput):
+        * platform/graphics/filters/SourceAlpha.h:
+        (WebCore::SourceAlpha::isSourceInput):
+        * platform/graphics/filters/SourceGraphic.h:
+        (WebCore::SourceGraphic::isSourceInput):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-06-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        feMerge implementation
+        [https://bugs.webkit.org/show_bug.cgi?id=26480]
+
+        Added feMerge to the SVG Filter system.
+
+        Test: svg/filters/feMerge.svg
+
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::uniteChildEffectSubregions):
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEMerge.h:
+
+2009-06-18  Mark Rowe  <mrowe@apple.com>
+
+        Speculative Windows build fix.
+
+        * page/win/FrameCGWin.cpp: Add missing #include.
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Dave Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26425
+        Final refactorings, picking up a few places where BitmapInfo
+        could be used.
+
+        * page/win/FrameCGWin.cpp:
+        (WebCore::imageFromRect):
+        * platform/win/CursorWin.cpp:
+        (WebCore::Cursor::Cursor):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
+
+2009-06-18  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 26522: In DOM mode, VoiceOver reads some mouseover text on web sites strangely
+        https://bugs.webkit.org/show_bug.cgi?id=26522
+
+        Test: accessibility/non-data-table-cell-title-ui-element.html
+
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::titleUIElement):
+
+2009-06-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix after recent RenderTheme changes.
+
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::~RenderThemeWx):
+        (WebCore::RenderTheme::themeForPage):
+
+2009-06-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460 part two
+        Attempt to minimize diff of following functional change by first landing
+        non-functional change to:
+        * Make readUintX() public and static (since they will need to be once
+          BMPImageReader is included in *ImageDecoder via composition rather
+          than inheritance).  Add wrappers in each class so callers can be
+          simpler.  In the next patch, these wrappers will be beefed up slightly
+          and the callers will get even simpler.
+        * Change direct setting of m_failed to use setFailed(), since in the
+          next patch much of this code won't even have direct access to m_failed
+        * Add a helper function in ICOImageDecoder to determine the image type
+          instead of simply doing it inline
+        * Rewrap lines that used to be <=80 cols and slipped over it during the
+          original landing of these decoders
+        * Other misc. changes, e.g. adding constructor definitions, reordering
+          functions, changing RGBA32Buffer& to RGBA32Buffer*, etc. that have no
+          functional effect but minimize the subsequent diff for readability
+
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::BMPImageDecoder):
+        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/image-decoders/bmp/BMPImageDecoder.h:
+        (WebCore::BMPImageDecoder::readUint32):
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::decodeBMP):
+        (WebCore::BMPImageReader::getInfoHeaderSize):
+        (WebCore::BMPImageReader::processInfoHeader):
+        (WebCore::BMPImageReader::readInfoHeader):
+        (WebCore::BMPImageReader::processBitmasks):
+        (WebCore::BMPImageReader::processColorTable):
+        (WebCore::BMPImageReader::processRLEData):
+        (WebCore::BMPImageReader::processNonRLEData):
+        * platform/image-decoders/bmp/BMPImageReader.h:
+        (WebCore::BMPImageReader::readUint16Helper):
+        (WebCore::BMPImageReader::readUint32Helper):
+        (WebCore::BMPImageReader::):
+        (WebCore::BMPImageReader::readUint16):
+        (WebCore::BMPImageReader::readUint32):
+        (WebCore::BMPImageReader::readCurrentPixel):
+        (WebCore::BMPImageReader::getComponent):
+        (WebCore::BMPImageReader::setI):
+        (WebCore::BMPImageReader::setRGBA):
+        (WebCore::BMPImageReader::fillRGBA):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::ICOImageDecoder):
+        (WebCore::ICOImageDecoder::isSizeAvailable):
+        (WebCore::ICOImageDecoder::size):
+        (WebCore::ICOImageDecoder::decodeImage):
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::processDirectoryEntries):
+        (WebCore::ICOImageDecoder::isBetterEntry):
+        (WebCore::ICOImageDecoder::processImageType):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        (WebCore::ICOImageDecoder::readUint16):
+        (WebCore::ICOImageDecoder::readUint32):
+
+2009-06-18  Peter Kasting  <pkasting@google.com>
+
+        Fix build bustage.
+
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+
+2009-06-18  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6940880> REGRESSION: Breakpoints don't break in 64-bit
+
+        Convert intptr_t to Strings so that we don't loose bits in the
+        conversion to JS.  Previously they were being put into 32bit ints.
+
+        * inspector/InspectorController.cpp: Convert the String back to an
+        intptr_t.
+        (WebCore::InspectorController::addBreakpoint):
+        (WebCore::InspectorController::removeBreakpoint):
+        * inspector/InspectorController.h:
+        * inspector/InspectorController.idl: Use strings in JS to avoid 32bit
+        truncation.
+        * inspector/InspectorFrontend.cpp: Make the intptr_t into a String.
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        * platform/text/PlatformString.h: Implemented the necessary conversion
+        functions to be able to convert to and from an intptr_t.
+        * platform/text/String.cpp: Ditto.
+        (WebCore::String::toIntPtrStrict):
+        (WebCore::String::toIntPtr):
+        (WebCore::charactersToIntPtrStrict):
+        (WebCore::charactersToIntPtr):
+        * platform/text/StringImpl.cpp: Ditto.
+        (WebCore::StringImpl::toIntPtrStrict):
+        (WebCore::StringImpl::toIntPtr):
+        * platform/text/StringImpl.h: Ditto.
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Final cleanups in this refactoring:
+        (1) Move WindowsBitmap implementation from CG-specific file to
+            the platform-common GraphicsContextWin.cpp, since it is
+            equally useful on both platforms.
+        (2) Revise the TransformationMatrix logic as suggested by
+            Adam Roben in his review comments to Part #2 of this
+            refactoring.
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContext::WindowsBitmap::WindowsBitmap):
+        (WebCore::GraphicsContext::WindowsBitmap::~WindowsBitmap):
+        (WebCore::GraphicsContext::createWindowsBitmap):
+        (WebCore::GraphicsContext::getWindowsContext):
+        (WebCore::GraphicsContextPlatformPrivate::scale):
+        (WebCore::GraphicsContextPlatformPrivate::rotate):
+        (WebCore::GraphicsContextPlatformPrivate::translate):
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+
+2009-06-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460 part one
+        Make isSizeAvailable non-const, since it's not logically const (it
+        triggers lazy decoding), and simplify all the implementations (without
+        changing behavior; just make less verbose).  Remove some other
+        inappropriate consts, which enables the removal of all the mutable
+        declarations in the decoders.
+
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::isSizeAvailable):
+        (WebCore::ImageDecoder::setSize): Make public to avoid needing a friend declaration in the JPEG decoder, and because the ICO/BMP decoders will soon need this.
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::isSizeAvailable):
+        (WebCore::GIFImageDecoder::repetitionCount):
+        (WebCore::GIFImageDecoder::decode):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::isSizeAvailable):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::isSizeAvailable):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::isSizeAvailable):
+        (WebCore::PNGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.h:
+        * platform/image-decoders/xbm/XBMImageDecoder.cpp:
+        (WebCore::XBMImageDecoder::isSizeAvailable):
+        (WebCore::XBMImageDecoder::frameBufferAtIndex):
+        (WebCore::XBMImageDecoder::decode):
+        * platform/image-decoders/xbm/XBMImageDecoder.h: Rename decodeXBM() to decode() for consistency with the JPEG/PNG decoders, and in the future the ICO/BMP decoders.
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move some common functions out of platform files and into
+        the common implementation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26425.
+        Add a new platform context method (flush) so that the
+        getWindowsContext method can be consolidated into the common
+        GraphicsContextWin.cpp file.
+         
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        (WebCore::GraphicsContextPlatformPrivate::flush):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::flush):
+        * platform/graphics/win/GraphicsContextCGWin.cpp: Remove
+          getWindowContext method.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp: Remove
+          getWindowContext method and fillWithClearColor methods.
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::fillWithClearColor): Moved from *CairoWin.cpp
+        (WebCore::GraphicsContext::getWindowsContext): Moved
+          from *CairoWin.cpp
+
+2009-06-18  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Remove code that I accidentally committed in r44811.
+
+        * editing/markup.cpp:
+        (WebCore::createMarkup):
+
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6983207> Non-layer content is not re-rendered when transition
+        starts sometimes (with hardware acceleration).
+        
+        When deciding which RenderLayers should be composited, when a layer goes into
+        compositing mode we repaint the old location. However, we did that before
+        we'd looked at all the factors that may force a layer to composite, so missed
+        some cases. Fix by doing the repaint once we really know whether it's going
+        to composite.
+
+        Test: compositing/repaint/become-overlay-composited-layer.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined, and
+        the Tiger build where QTMovieLayer does not exist.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
+        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
+        (WebCore::MediaPlayerPrivate::currentRenderingMode):
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
+        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
+
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::currentRenderingMode):
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
+
+2009-06-17  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15189
+        Adds the HTML5 input event support for textarea.
+        
+        Also, moves the oninput attribute parse handling to HTMLElement so that
+        it can be set on any HTML element so that bubbling events can be handled
+        using HTML attribute handlers.
+
+        Test: fast/forms/textarea-input-event.html
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+
+2009-06-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Share code between filterEffects
+        [https://bugs.webkit.org/show_bug.cgi?id=26479]
+
+        Share more code of filter effects. The imageBuffer creation can move to
+        FilterEffect ant every effect asks for the GraphicsContext. Move the
+        drawingRect calculation to FilterEffect.
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::calculateDrawingRect):
+        (WebCore::FilterEffect::getEffectContext):
+        * platform/graphics/filters/FilterEffect.h:
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26499
+        
+        Support hardware-accelerationed rendering of video elements.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerSawUnsupportedTracks):
+        (WebCore::HTMLMediaElement::mediaPlayerRepaint):
+        Just move these methods to group the render-related methods together.
+        
+        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
+        Call out method to ask the RenderLayerCompositor if presentation of this video
+        can be acclerated. It might say no, if, for example, the video has a reflection.
+        
+        (WebCore::HTMLMediaElement::mediaPlayerGraphicsLayer):
+        Fetch the GraphicsLayer from the RenderVideo that will host the movie layer.
+        
+        * html/HTMLMediaElement.h:
+        Reordered the rendering-related methods, and added two methods related to video
+        acceleration.
+        
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::acceleratedRenderingStateChanged):
+        Called by the rendering system when it determines that the video must go into, or
+        fall off of the hardware-accelerated path.
+        
+        (WebCore::MediaPlayer::supportsAcceleratedRendering):
+        Method to say whether the media engine supports accelerated rendering.
+        
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerRepaint):
+        (WebCore::MediaPlayerClient::mediaPlayerSizeChanged):
+        Moved.
+        
+        (WebCore::MediaPlayerClient::mediaPlayerRenderingCanBeAccelerated):
+        (WebCore::MediaPlayerClient::mediaPlayerGraphicsLayer):
+        New methods to ask the client if the rendering system can support accelerated
+        rendering, and to get a GraphicsLayer to plug the movie layer into.
+        
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::supportsAcceleratedRendering):
+        (WebCore::MediaPlayerPrivateInterface::acceleratedRenderingStateChanged):
+        Forwarding methods from MediaPlayer.
+        
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        Some new methods related to using a QTMovieLayer, and to simplify the rendering mode logic.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
+        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
+        Methods to create and destroy the QTMovieLayer.
+        
+        (WebCore::MediaPlayerPrivate::currentRenderingMode):
+        (WebCore::MediaPlayerPrivate::preferredRenderingMode):
+        Methods to clarify the code that decides which of the 3 rendering modes to use.
+        
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+        Changed to use the new rendering mode methods.
+        
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
+        Destroy the layer if we have one.
+        
+        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
+        Small utility method.
+        
+        (WebCore::MediaPlayerPrivate::updateStates):
+        Move the call to setUpVideoRendering() to before we send out the state notifications,
+        so that we will have created the rendering objects already.
+        
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
+        Return true if we have QTMovieLayer.
+        
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
+        We've been told that we went into or out of accelerated mode; maybe reset
+        the renderer, and set the layer if we have to.
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::rendererContentChanged):
+        We may need to udpate compositing layers if the video went into accelerated mode.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::canUseDirectCompositing):
+        Add smarts to deal with video, which allows us to avoid extra backing store.
+        
+        (WebCore::RenderLayerBacking::contentsBox):
+        Use the videoBox to use the content layer for video layers.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        Poke the RenderVideo if the state changed.
+        
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        Handle an edge case when the video element itself is a stacking context
+        because of opacity or transform.
+        
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
+        Allow video to throw us into compositing mode if the media engine supports it.
+        
+        * rendering/RenderLayerCompositor.h:
+        New methods related to video.
+        
+        * rendering/RenderVideo.h:
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::updatePlayer):
+        Call rendererContentChanged() to give the compositor a change to throw the video into
+        compositing mode.
+        
+        (WebCore::RenderVideo::supportsAcceleratedRendering):
+        (WebCore::RenderVideo::acceleratedRenderingStateChanged):
+        (WebCore::RenderVideo::videoGraphicsLayer):
+        Methods to allow the MediaPlayer to do rendering-related stuff via the media element.
+
+2009-06-18  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Niko.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26385
+        Root SVG element is not checked on requiredFeatures, requiredExtension like other elements
+
+        Also do the isValid check for outer <svg>.
+
+        Test: svg/custom/outer-svg-unknown-feature.svg
+
+        * svg/SVGDocument.cpp:
+        (WebCore::SVGDocument::childShouldCreateRenderer):
+        * svg/SVGDocument.h:
+
+2009-06-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6913221> REGRESSION (Safari 3-4): Search field on
+          apple.com cuts entered text
+
+        Test: fast/forms/search-vertical-alignment.html
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::layout): Vertically center the
+            the search field's inner block.
+
+2009-06-18  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compilation with Symbian WINSCW compiler, which produced
+        multiple definitions of the CSSPrimitiveValue conversion operators.
+
+        It turns out that they are defined inline but not declared inline.
+
+        Adding the inline keyword to the declaration fixes the build.
+
+        * css/CSSPrimitiveValue.h:
+
+2009-06-18  Markus Goetz <Markus.Goetz@nokia.com>
+
+        Reviewed by Simon Hausman.
+
+        Clarify in docs how to compile with debug information.
+
+        * WebCore.pro:
+
+2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] When writing an URL to the clipboard, save the corresponding title
+        in the mime data as well.
+
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::writeURL):
+
+2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
+
+        [Qt] Fix build. Add HTMLDataGridElement.
+
+        * WebCore.pro:
+
+2009-06-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix.
+
+        Add HTMLDataGridElement header and IDL to the build script.
+
+        * GNUmakefile.am:
+
+2009-06-18  Chris Evans  <scarybeasts@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        Fix 8-digit long hex entities. Fixes bug 26454
+        https://bugs.webkit.org/show_bug.cgi?id=26454
+
+        Test: fast/parser/eightdigithexentity.html
+
+        * html/HTMLTokenizer.cpp: fix off-by-ones.
+
+2009-06-18  David Levin  <levin@chromium.org>
+
+        Fix chromium linux build.
+
+        Fixes a mistake that happened during the complicated merge for
+        landing r44775, r44776, r44777.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::create):
+
+2009-06-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26499
+        
+        First step to making video rendering be hardware-accelerated:
+        make <video> elements get self-painting RenderLayers, and add
+        an isVideo() virtual method to RenderObject.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState):
+        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged):
+        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
+        (WebCore::RenderLayer::isSelfPaintingLayer):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isVideo):
+        * rendering/RenderVideo.h:
+        (WebCore::RenderVideo::requiresLayer):
+        (WebCore::RenderVideo::isVideo):
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Refactor a few common routines in the various Windows ports
+        and reduce some duplicated code.
+
+        (1) Create TransformationMatrix XFORM casting operator, and
+            switch various XFORM structure uses to utilize it.
+        (2) Push concatCTM call to GraphicsContextWin now that the
+            TransformationMatrix can directly create XFORM (rather
+            than converting to CGAffineTransform/cairo_matrix_t first.)
+
+        * WebCore.vcproj/WebCore.vcproj: Add new BitmapInfo structure.
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::scale):
+        (WebCore::GraphicsContextPlatformPrivate::rotate):
+        (WebCore::GraphicsContextPlatformPrivate::translate):
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
+        (WebCore::TransformationMatrix::operator XFORM): New operator
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Non-CG Windows build fix after @r44758.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderTheme::themeForPage):
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Refactor a few common routines in the various Windows ports
+        and reduce some duplicated code.
+        https://bugs.webkit.org/show_bug.cgi?id=26425.
+
+        Refactor use of BITMAPINFO for the new BitmapInfo structure.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/win/BitmapInfo.cpp: Added.
+        (WebCore::bitmapInfoForSize):
+        (WebCore::BitmapInfo::create):
+        (WebCore::BitmapInfo::createBottomUp):
+        * platform/win/BitmapInfo.h: Added.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
+        (WebCore::TransformationMatrix::operator XFORM): New operator
+        * platform/win/DragImageCGWin.cpp:
+        (WebCore::allocImage):
+        * platform/win/DragImageCairoWin.cpp:
+        (WebCore::allocImage):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Remove unnecessary 6th parameter from SOFT_LINK_OPTIONAL
+
+        Reviewed by Mark Rowe.
+
+        * platform/graphics/win/ColorSafari.cpp: Removed the 6th parameter and
+        an unnecessary parameter name.
+        * platform/win/SoftLinking.h: Removed the unused 6th parameter.
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Make Settings::shouldPaintNativeControls default to true
+
+        This matches the default up in WebKit (that was changed in r43318).
+
+        Fixes Bug 26493: REGRESSION (r44758): First tab always uses Mac-style
+        form controls
+        <https://bugs.webkit.org/show_bug.cgi?id=26493>
+
+        Reviewed by Darin Adler and Dave Hyatt.
+
+        No test possible since DRT always uses Mac-style form controls.
+
+        * page/Settings.cpp: Changed the initial value of
+        gShouldPaintNativeControls to true.
+
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderTheme::themeForPage): Added a FIXME about the design
+        flaw here involving querying Settings before it's been initialized.
+
+2009-06-17  David Levin  <levin@chromium.org>
+
+        Fix chromium windows build.
+
+        A mistake that happened during the complicated merge for
+        landing r44775, r44776, r44777.
+
+        * rendering/RenderThemeChromiumWin.h:
+        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
+
+2009-06-17  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6981193> Crash in MediaControlInputElement::attachToParent
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaTextDisplayElement::attachToParent): NULL check element renderer or parent renderer.
+        (WebCore::MediaControlInputElement::attachToParent): Ditto.
+
+2009-06-17  David Hyatt  <hyatt@apple.com>
+
+        Fix Windows build.  There's no HTMLDataGridElement.cpp file yet.
+
+        * html/HTMLElementsAllInOne.cpp:
+
+2009-06-17  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben and Anders Carlsson.
+
+        Stub out the HTMLDataGridElement.
+
+        * DerivedSources.make:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * editing/htmlediting.cpp:
+        (WebCore::canHaveChildrenForEditing):
+        * html/HTMLDataGridElement.h: Added.
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        (WebCore::HTMLDataGridElement::tagPriority):
+        * html/HTMLDataGridElement.idl: Added.
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::isAffectedByResidualStyle):
+        * html/HTMLTagNames.in:
+
+2009-06-17  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        Fix typo in previous changes.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
+
+2009-06-17  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26148
+        Remove common code from RenderThemeChromiumWin that is shared with
+        RenderThemeChromiumSkia.
+
+        Also move supportsControlTints to RenderThemeChromiumLinux since it
+        is linux specific.
+
+        There are no tests changed because this just removes functions with
+        duplicate implementations between the base and derived classes.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::supportsControlTints):
+        * rendering/RenderThemeChromiumLinux.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::):
+        (WebCore::getNonClientMetrics):
+        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::systemFont):
+        (WebCore::RenderThemeChromiumWin::paintCheckbox):
+        (WebCore::RenderThemeChromiumWin::paintRadio):
+        (WebCore::RenderThemeChromiumWin::paintSliderThumb):
+        (WebCore::RenderThemeChromiumWin::caretBlinkIntervalInternal):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-06-17  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26148
+        Move RenderThemeChromiumSkia into its own file.  This is purely a code move.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * rendering/RenderThemeChromiumLinux.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::):
+        (WebCore::setSizeIfAuto):
+        (WebCore::mediaElementParent):
+        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
+        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::supportsHover):
+        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
+        (WebCore::RenderThemeChromiumSkia::systemFont):
+        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+        (WebCore::RenderThemeChromiumSkia::setRadioSize):
+        (WebCore::brightenColor):
+        (WebCore::paintButtonLike):
+        (WebCore::RenderThemeChromiumSkia::paintButton):
+        (WebCore::RenderThemeChromiumSkia::paintTextField):
+        (WebCore::RenderThemeChromiumSkia::paintTextArea):
+        (WebCore::RenderThemeChromiumSkia::paintSearchField):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuList):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
+        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
+        * rendering/RenderThemeChromiumSkia.h:
+        (WebCore::RenderThemeChromiumSkia::supportsControlTints):
+
+2009-06-17  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26148
+        Extract RenderThemeChromiumSkia out of RenderThemeChromiumLinux.  This
+        is mostly a code shuffle.  The non-suffle changes are:
+           1) Creation of a caretBlinkIntervalInternal.
+           2) Moving of some inline functions into the implementation files.
+           3) Changing of defaultGUIFont into a static class constant from a
+              static function.  Also the type is changed to String.
+           4) Changing of defaultFontSize into a static class constant from a
+              static variable in the file scope.
+           5) The static supportsFocus function was collapsed into
+              supportsFocusRing.
+           6) Split the extraDefaultStyleSheet into Skia and Linux versions.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
+        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::supportsHover):
+        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
+        (WebCore::RenderThemeChromiumSkia::systemFont):
+        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+        (WebCore::RenderThemeChromiumSkia::setRadioSize):
+        (WebCore::RenderThemeChromiumSkia::paintButton):
+        (WebCore::RenderThemeChromiumSkia::paintTextField):
+        (WebCore::RenderThemeChromiumSkia::paintTextArea):
+        (WebCore::RenderThemeChromiumSkia::paintSearchField):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuList):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::systemColor):
+        (WebCore::RenderThemeChromiumLinux::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Add a SOFT_LINK_OPTIONAL macro
+
+        This macro is useful when soft-linking functions that are present in
+        only some versions of a particular library (e.g., APIs added in
+        Windows Vista that aren't available on Windows XP).
+
+        Reviewed by Ada Chan.
+
+        * platform/graphics/win/ColorSafari.cpp:
+        (WebCore::focusRingColor):
+        Use the SoftLinking.h macros instead of doing the soft-link ourselves.
+        Also removed an unused call to focusRingColor.isValid().
+
+        * platform/win/SoftLinking.h: Added SOFT_LINK_OPTIONAL.
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26470.
+        The use of zero-width or zero-height rectangles in generating
+        gradients caused Windows Cairo to crash, and webkitgtk to
+        produce invalid images.
+
+        We now test for NaN in the phase argument, which is calculated
+        using fmodf and can blow up when the width/height values passed
+        are zero.
+
+        Test: fast/gradients/border-image-gradient-sides-and-corners.html
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-06-17  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        If loading a font fails because of the sandbox, we ask the browser process to
+        try to load it by calling ensureFontLoaded. If it still fails after
+        ensureFontLoaded, we hit a ASSERT_NOT_REACHED.
+
+        This case happens once in a while during browser shutdown. The browser will
+        queue a message to the renderer to shutdown, and will then stop answering sync
+        messages from the renderer. If the renderer is still loading a page during this
+        time, it might try to call the browser process to ask to load a font. The
+        browser process will ignore the request, and the font will fail to load, even
+        after the second try.
+
+        This is unfortunate, but there is no real risk here, since the renderer will be
+        going away as soon as it processes another message.
+        
+        This can't be layout tested as it depends on the sandbox.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26484
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::fontContainsCharacter):
+
+2009-06-17  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26482
+        <rdar://problem/6978590> When setting playback rate to 0, the audio element stops 
+        playing (doesn't resume later)
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setRate): Always set the rate, even when "paused".
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::setRate): Ditto.
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Add all the generated JS*.cpp files back to WebCore.vcproj
+
+        They are not compiled by the vcproj directly. Instead they are
+        compiled as part of DerivedSources.cpp. Having them listed in the
+        vcproj makes them be included in Project Find, etc.
+
+        Rubber-stamped in advance by Steve Falkenburg.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-06-17  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Don't fire redundant 'change' events for a file upload form.
+        https://bugs.webkit.org/show_bug.cgi?id=26471
+
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::chooseFiles): Suppress change event if the
+        existing selected files and the incoming selected files are equal.
+        (WebCore::FileChooser::chooseIcon): Returns 0 if there is no selected
+        files.
+
+2009-06-17  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23155
+        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
+
+        * platform/KeyboardCodes.h:
+
+2009-06-17  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23155
+        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getWindowsContext):
+        * platform/win/SystemTimeWin.cpp:
+        (WebCore::userIdleTime):
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Speculative Mac build fix
+
+        * page/Page.h: Forward-declare RenderTheme instead of including
+        RenderTheme.h so that we don't need to make RenderTheme.h a private
+        header for WebKit's benefit.
+
+        * editing/SelectionController.cpp:
+        * rendering/InlineTextBox.cpp:
+        * rendering/RenderObject.cpp:
+        Added #includes of RenderTheme.h.
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Speculative Mac build fix
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderTheme::create): Added.
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Speculative Mac build fix
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderTheme::themeForPage): Remove the name of an unused
+        parameter.
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Speculative Mac build fix
+
+        * page/Page.cpp:
+        (WebCore::Page::Page): Change the initializer order to match the
+        declaration order.
+
+2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Follow up to bug https://bugs.webkit.org/show_bug.cgi?id=26278
+        Patch that make WebCore have a RenderTheme per page
+
+        Make the Qt implementation of RenderTheme create a theme per page,
+        and use the QStyle associated with the view of each page, in order
+        to make the QWidget setStyle() method work as advertised.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::qStyle):
+        (WebCore::findFrameLineWidth):
+        (WebCore::inflateButtonRect):
+        (WebCore::RenderThemeQt::adjustRepaintRect):
+        (WebCore::RenderThemeQt::isControlStyled):
+        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
+        (WebCore::RenderThemeQt::setButtonPadding):
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::paintTextField):
+        (WebCore::RenderThemeQt::setPopupPadding):
+        * platform/qt/RenderThemeQt.h:
+
+2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Dave Hyatt and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26278
+        Patch that make WebCore have a RenderTheme per page
+
+
+        Create a different RenderTheme per page, so that RenderTheme has
+        access to page specific theming. This is needed for the Qt port, as Qt
+        supports setting the theme (style) per widget.
+
+        This change was suggested and discussed with Dave Hyatt.
+
+        More detailed:
+
+        1) Create a theme per page or one global one, depending on the needs
+           of the platform.
+        2) Add an accesser to the theme from RenderObject.
+        3) Change all uses of the theming to access the theme through
+           RenderObject, using the global default theme as fallback, when the
+           document of RenderObject has no page.
+           When we don't have access to a RenderObject, use the default theme.
+        4) Modify all RenderTheme platform implementations to work with the
+           above changes, still creating only one global theme.
+
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::boundingBoxRect):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::loadFullDefaultStyle):
+        (WebCore::CSSStyleSelector::styleForElement):
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::setActive):
+        (WebCore::ContainerNode::setHovered):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+        (WebCore::HTMLInputElement::setIndeterminate):
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionLayoutChanged):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateControlTints):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        * page/Page.h:
+        (WebCore::Page::theme):
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::paintRow):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::create):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeGtk::RenderThemeGtk):
+        (WebCore::RenderThemeGtk::~RenderThemeGtk):
+        (WebCore::RenderThemeGtk::gtkEntry):
+        (WebCore::RenderThemeGtk::gtkTreeView):
+        * platform/gtk/RenderThemeGtk.h:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::create):
+        (WebCore::RenderTheme::themeForPage):
+        * platform/qt/RenderThemeQt.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::determineState):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::hitTest):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::theme):
+        * rendering/RenderObject.h:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::defaultTheme):
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeChromiumLinux.h:
+        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeChromiumWin.h:
+        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeSafari.h:
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeWin.h:
+
+2009-06-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6974175> ASSERT in JITStubs.cpp at appsaccess.apple.com
+
+        JSDOMWindowCustom was using PropertySlot::putValue, however this interface
+        appears to be fundaementally incorrect - PropertySlots are only used to get
+        values, all puts use PutPropertySlot.  However PutPropertySlot cannot be
+        used in the fashion desired here - it only reports the caching type of a
+        write that has been performed.
+
+        (This caused a bug where the put should have triggered a transition, and
+        failed to do so.)
+
+        Removing the faulty case from the optimization leads to a ~0.5% progression
+        on in-browser SunSpider (presumably the very first case was not being hit
+        often, and the simplification here is beneficial).
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::put):
+
+2009-06-17  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY, layout tests fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26326
+        This reverts commit r44751.
+
+        Once that change was checked scrollbars/scrollbar-orientation.html started
+        crashing on Windows.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * page/FrameView.cpp:
+        * page/FrameView.h:
+        * platform/Scrollbar.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderScrollbar.h:
+
+2009-06-16  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        In ImageSource::setData, delete the old m_encoder before replacing it with a new one.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26458
+
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::setData):
+
+2009-06-16  David Levin  <levin@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
+        https://bugs.webkit.org/show_bug.cgi?id=26326
+
+        Test: scrollbars/scrollbar-crash-on-refresh.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        Gives the FrameView a change to do any necessary cleanup on
+        Document::detach() which is where the renderArena gets detroyed.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        Gets rid of any custom scrollbars (if the docment supplied them).
+        * page/FrameView.h:
+        * platform/Scrollbar.h:
+        (WebCore::Scrollbar::isCustomScrollbar):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        Removed the check for document()->frame().  If frame() is 0 in this code,
+        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
+        * rendering/RenderScrollbar.h:
+        (WebCore::RenderScrollbar::isCustomScrollbar):
+
+2009-06-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix of <rdar://6967547> Ctrl-C copies null value erasing text in clipboard in Safari.
+        This patch kept the way events were firing as they were before, and Windows events are
+        consistent with Mac.       
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::tryDHTMLCopy): Added check for canCopy() before clearing PasteBoard
+        (WebCore::Editor::tryDHTMLCut): Added check for canCut() before clearing PasteBoard
+
+2009-06-16  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/6660037> CrashTracer: [USER] 46 crashes in Safari at com.apple.WebCore • WebCore::CachedCSSStyleSheet::addClient 53
+        
+        When revalidating a resource, calling addClient() on one client might cause another to get removed.
+        
+        - made CachedResource::addClient() non-virtual and added virtual didAddClient()
+        - in CachedResource::switchClientsToRevalidatedResource() add all clients to the client set of the revalidated resource first
+        - check if the client is still in the set before invoking didAddClient() for it
+        
+        No test case, I didn't manage to construct one. You need some combination of 304 revalidation, stylesheets that
+        reference each other via @imports and reloading.
+
+        * WebCore.base.exp:
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::didAddClient):
+        * loader/CachedCSSStyleSheet.h:
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::didAddClient):
+        * loader/CachedFont.h:
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::didAddClient):
+        * loader/CachedImage.h:
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::addClient):
+        (WebCore::CachedResource::addClientToSet):
+        (WebCore::CachedResource::switchClientsToRevalidatedResource):
+        * loader/CachedResource.h:
+        * loader/CachedScript.cpp:
+        (WebCore::CachedScript::didAddClient):
+        * loader/CachedScript.h:
+        * loader/CachedXSLStyleSheet.cpp:
+        (WebCore::CachedXSLStyleSheet::didAddClient):
+        * loader/CachedXSLStyleSheet.h:
+
+2009-06-16  Simon Fraser  <simon.fraser@apple.com>
+
+        No Review
+
+        Fix code inside an #ifdef that draws the video framerate.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-06-16  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 26456: Hook up V8 bindings for Worker's importScripts functionality.
+        https://bugs.webkit.org/show_bug.cgi?id=26456
+
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp: Fixed missing exception code
+          handling in Worker constructor for V8 bindings.
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Update of https://bugs.webkit.org/show_bug.cgi?id=26353.
+        Provide an assignment operator to avoid improper reference
+        counts on the Cairo font objects.  This brings the Windows
+        Cairo port in line with the GTKport.
+
+        * platform/graphics/win/FontPlatformData.h:
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+
+2009-06-16  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for <rdar://problem/6890126> Theme code should fetch the MediaControlElementType from 
+        the MediaControlInputElement, rather than computing it again
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::percentLoaded): New, utility function for controller implementation.
+        * html/HTMLMediaElement.h:
+
+        * rendering/MediaControlElements.h:
+        (WebCore::MediaControlInputElement::displayType): New, return m_displayType.
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Stop using MediaPlayer object, get button
+        state from the button itself and get movie state from HTMLMediaElement.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaMuteButton): Get state from button instead of MediaPlayer.
+        (WebCore::RenderThemeMac::paintMediaPlayButton): Ditto.
+
+2009-06-16  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Bug 26450: Rename values of enum RedirectOriginCheck to make them
+        clearer.
+        https://bugs.webkit.org/show_bug.cgi?id=26450
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::create):
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::willSendRequest):
+        * loader/DocumentThreadableLoader.h:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::create):
+        (WebCore::ThreadableLoader::loadResourceSynchronously):
+        * loader/ThreadableLoader.h:
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        * loader/WorkerThreadableLoader.h:
+        (WebCore::WorkerThreadableLoader::create):
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
+        * workers/WorkerScriptLoader.h:
+        (WebCore::WorkerContext::importScripts):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
+
+2009-06-16  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix a UMR in WebCore::BitStack by initializing new memory to 0.
+        https://bugs.webkit.org/show_bug.cgi?id=26449
+        No new tests, covered by purify.
+
+        * editing/TextIterator.cpp:
+        (WebCore::BitStack::push):
+
+2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        Test: fast/multicol/columns-shorthand-parsing.html 
+
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=26453.
+        Null Cairo contextwill crash Windows Cairo build.
+
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::syncContext):
+          Add a check for null context before attempting to
+          retrieve the Cairo surface.
+
+2009-06-16  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26447
+        Fix animated GIF breakage in Cairo/wx ports.
+
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::operator=):
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::operator=):
+
+2009-06-16  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by John Sullivan
+        
+        <rdar://problem/6937882>
+        
+        Tweak "time remaining" and "time elapsed" fields in the overlay video controller.
+
+        * css/mediaControlsQT.css:
+
+2009-06-16  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth and David Levin.
+
+        Bug 26146: Change to use ThreadableLoader to load the worker script
+        in order to check URL origin for redirection.
+        https://bugs.webkit.org/show_bug.cgi?id=26146
+
+        Test: http/tests/workers/worker-redirect.html
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        (WebCore::Worker::notifyFinished):
+        * workers/Worker.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerImportScriptsClient.cpp: Removed.
+        * workers/WorkerImportScriptsClient.h: Removed.
+        * workers/WorkerScriptLoader.cpp: Renamed from workers/WorkerImportScriptsClient.cpp.
+          This to make it more generic so worker script loading could use it.
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
+        (WebCore::WorkerScriptLoader::didFinishLoading):
+        (WebCore::WorkerScriptLoader::didFail):
+        (WebCore::WorkerScriptLoader::didFailRedirectCheck):
+        (WebCore::WorkerScriptLoader::didReceiveAuthenticationCancellation):
+        (WebCore::WorkerScriptLoader::notifyFinished):
+        * workers/WorkerScriptLoader.h: Renamed from workers/WorkerImportScriptsClient.h.
+          This to make it more generic so worker script loading could use it.
+        * workers/WorkerScriptLoaderClient.h: Added.
+
+2009-06-16  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Use consistent GUID comparison functions.
+        https://bugs.webkit.org/show_bug.cgi?id=26427
+
+        * platform/win/WCDataObject.cpp:
+        (WebCore::WCDataObject::QueryInterface):
+
+2009-06-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Fix compiler warning.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_class_init):
+
+2009-08-07  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27424
+
+        * WebKit/gtk/gdom/ConvertToGCharPrivate.h: Added.
+        (copyAsGChar): added to help GObject bindings convert various types to glib's gchar* 
+
+2009-06-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Remove dummy AtkStreamableContent implementation.
+
+        It's completely empty, we'll add it back (and conditionally
+        instead of unconditionally) when it does something.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (GetAtkInterfaceTypeFromWAIType):
+        (getInterfaceMaskFromObject):
+
+== Rolled over to ChangeLog-2009-06-16 ==
diff --git a/src/3rdparty/webkit/WebCore/DerivedSources.cpp b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
deleted file mode 100644
index 1edbf7dbd1..0000000000
--- a/src/3rdparty/webkit/WebCore/DerivedSources.cpp
+++ /dev/null
@@ -1,372 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
-
-#include "JSAbstractWorker.cpp"
-#include "JSAttr.cpp"
-#include "JSBarInfo.cpp"
-#include "JSBeforeLoadEvent.cpp"
-#include "JSCanvasGradient.cpp"
-#include "JSCanvasPattern.cpp"
-#include "JSCanvasRenderingContext.cpp"
-#include "JSCanvasRenderingContext2D.cpp"
-#if ENABLE(3D_CANVAS)    
-#include "JSCanvasRenderingContext3D.cpp"
-#endif
-#include "JSCDATASection.cpp"
-#include "JSCharacterData.cpp"
-#include "JSClientRect.cpp"
-#include "JSClientRectList.cpp"
-#include "JSClipboard.cpp"
-#include "JSComment.cpp"
-#include "JSConsole.cpp"
-#include "JSCounter.cpp"
-#include "JSCSSCharsetRule.cpp"
-#include "JSCSSFontFaceRule.cpp"
-#include "JSCSSImportRule.cpp"
-#include "JSCSSMediaRule.cpp"
-#include "JSCSSPageRule.cpp"
-#include "JSCSSPrimitiveValue.cpp"
-#include "JSCSSRule.cpp"
-#include "JSCSSRuleList.cpp"
-#include "JSCSSStyleDeclaration.cpp"
-#include "JSCSSStyleRule.cpp"
-#include "JSCSSStyleSheet.cpp"
-#include "JSCSSValue.cpp"
-#include "JSCSSValueList.cpp"
-#include "JSCSSVariablesDeclaration.cpp"
-#include "JSCSSVariablesRule.cpp"
-#include "JSDatabase.cpp"
-#include "JSDataGridColumn.cpp"
-#include "JSDataGridColumnList.cpp"
-#include "JSDedicatedWorkerContext.cpp"
-#include "JSDocument.cpp"
-#include "JSDocumentFragment.cpp"
-#include "JSDocumentType.cpp"
-#include "JSDOMApplicationCache.cpp"
-#include "JSDOMCoreException.cpp"
-#include "JSDOMImplementation.cpp"
-#include "JSDOMParser.cpp"
-#include "JSDOMSelection.cpp"
-#include "JSDOMWindow.cpp"
-#include "JSElement.cpp"
-#include "JSEntity.cpp"
-#include "JSEntityReference.cpp"
-#include "JSErrorEvent.cpp"
-#include "JSEvent.cpp"
-#include "JSEventException.cpp"
-#include "JSEventSource.cpp"
-#include "JSFile.cpp"
-#include "JSFileList.cpp"
-#include "JSHistory.cpp"
-#include "JSHTMLAllCollection.cpp"
-#include "JSHTMLAnchorElement.cpp"
-#include "JSHTMLAppletElement.cpp"
-#include "JSHTMLAreaElement.cpp"
-#include "JSHTMLAudioElement.cpp"
-#include "JSHTMLBaseElement.cpp"
-#include "JSHTMLBaseFontElement.cpp"
-#include "JSHTMLBlockquoteElement.cpp"
-#include "JSHTMLBodyElement.cpp"
-#include "JSHTMLBRElement.cpp"
-#include "JSHTMLButtonElement.cpp"
-#include "JSHTMLCanvasElement.cpp"
-#include "JSHTMLCollection.cpp"
-#include "JSHTMLDataGridElement.cpp"
-#include "JSHTMLDataGridCellElement.cpp"
-#include "JSHTMLDataGridColElement.cpp"
-#include "JSHTMLDataGridRowElement.cpp"
-#include "JSHTMLDataListElement.cpp"
-#include "JSHTMLDirectoryElement.cpp"
-#include "JSHTMLDivElement.cpp"
-#include "JSHTMLDListElement.cpp"
-#include "JSHTMLDocument.cpp"
-#include "JSHTMLElement.cpp"
-#include "JSHTMLElementWrapperFactory.cpp"
-#include "JSHTMLEmbedElement.cpp"
-#include "JSHTMLFieldSetElement.cpp"
-#include "JSHTMLFontElement.cpp"
-#include "JSHTMLFormElement.cpp"
-#include "JSHTMLFrameElement.cpp"
-#include "JSHTMLFrameSetElement.cpp"
-#include "JSHTMLHeadElement.cpp"
-#include "JSHTMLHeadingElement.cpp"
-#include "JSHTMLHRElement.cpp"
-#include "JSHTMLHtmlElement.cpp"
-#include "JSHTMLIFrameElement.cpp"
-#include "JSHTMLImageElement.cpp"
-#include "JSHTMLInputElement.cpp"
-#include "JSHTMLIsIndexElement.cpp"
-#include "JSHTMLLabelElement.cpp"
-#include "JSHTMLLegendElement.cpp"
-#include "JSHTMLLIElement.cpp"
-#include "JSHTMLLinkElement.cpp"
-#include "JSHTMLMapElement.cpp"
-#include "JSHTMLMarqueeElement.cpp"
-#include "JSHTMLMediaElement.cpp"
-#include "JSHTMLMenuElement.cpp"
-#include "JSHTMLMetaElement.cpp"
-#include "JSHTMLModElement.cpp"
-#include "JSHTMLObjectElement.cpp"
-#include "JSHTMLOListElement.cpp"
-#include "JSHTMLOptGroupElement.cpp"
-#include "JSHTMLOptionElement.cpp"
-#include "JSHTMLOptionsCollection.cpp"
-#include "JSHTMLParagraphElement.cpp"
-#include "JSHTMLParamElement.cpp"
-#include "JSHTMLPreElement.cpp"
-#include "JSHTMLQuoteElement.cpp"
-#include "JSHTMLScriptElement.cpp"
-#include "JSHTMLSelectElement.cpp"
-#include "JSHTMLSourceElement.cpp"
-#include "JSHTMLStyleElement.cpp"
-#include "JSHTMLTableCaptionElement.cpp"
-#include "JSHTMLTableCellElement.cpp"
-#include "JSHTMLTableColElement.cpp"
-#include "JSHTMLTableElement.cpp"
-#include "JSHTMLTableRowElement.cpp"
-#include "JSHTMLTableSectionElement.cpp"
-#include "JSHTMLTextAreaElement.cpp"
-#include "JSHTMLTitleElement.cpp"
-#include "JSHTMLUListElement.cpp"
-#include "JSHTMLVideoElement.cpp"
-#include "JSImageData.cpp"
-#include "JSJavaScriptCallFrame.cpp"
-#include "JSKeyboardEvent.cpp"
-#include "JSLocation.cpp"
-#include "JSMedia.cpp"
-#include "JSMediaError.cpp"
-#include "JSMediaList.cpp"
-#include "JSMessageChannel.cpp"
-#include "JSMessageEvent.cpp"
-#include "JSMessagePort.cpp"
-#include "JSMimeType.cpp"
-#include "JSMimeTypeArray.cpp"
-#include "JSMouseEvent.cpp"
-#include "JSMutationEvent.cpp"
-#include "JSNamedNodeMap.cpp"
-#include "JSNavigator.cpp"
-#include "JSNode.cpp"
-#include "JSNodeFilter.cpp"
-#include "JSNodeIterator.cpp"
-#include "JSNodeList.cpp"
-#include "JSNotation.cpp"
-#include "JSNotificationCenter.cpp"
-#include "JSNotification.cpp"
-#include "JSOverflowEvent.cpp"
-#include "JSPageTransitionEvent.cpp"
-#include "JSPlugin.cpp"
-#include "JSPluginArray.cpp"
-#include "JSProcessingInstruction.cpp"
-#include "JSProgressEvent.cpp"
-#include "JSRange.cpp"
-#include "JSRangeException.cpp"
-#include "JSRect.cpp"
-#include "JSRGBColor.cpp"
-#include "JSScreen.cpp"
-#include "JSSharedWorker.cpp"
-#include "JSSharedWorkerContext.cpp"
-#include "JSSQLError.cpp"
-#include "JSSQLResultSet.cpp"
-#include "JSSQLResultSetRowList.cpp"
-#include "JSSQLTransaction.cpp"
-#include "JSStorage.cpp"
-#include "JSStorageEvent.cpp"
-#include "JSStyleSheet.cpp"
-#include "JSStyleSheetList.cpp"
-#include "JSSVGAElement.cpp"
-#include "JSSVGAltGlyphElement.cpp"
-#include "JSSVGAngle.cpp"
-#include "JSSVGAnimateColorElement.cpp"
-#include "JSSVGAnimatedAngle.cpp"
-#include "JSSVGAnimatedBoolean.cpp"
-#include "JSSVGAnimatedEnumeration.cpp"
-#include "JSSVGAnimatedInteger.cpp"
-#include "JSSVGAnimatedLength.cpp"
-#include "JSSVGAnimatedLengthList.cpp"
-#include "JSSVGAnimatedNumber.cpp"
-#include "JSSVGAnimatedNumberList.cpp"
-#include "JSSVGAnimatedPreserveAspectRatio.cpp"
-#include "JSSVGAnimatedRect.cpp"
-#include "JSSVGAnimatedString.cpp"
-#include "JSSVGAnimatedTransformList.cpp"
-#include "JSSVGAnimateElement.cpp"
-#include "JSSVGAnimateTransformElement.cpp"
-#include "JSSVGAnimationElement.cpp"
-#include "JSSVGCircleElement.cpp"
-#include "JSSVGClipPathElement.cpp"
-#include "JSSVGColor.cpp"
-#include "JSSVGComponentTransferFunctionElement.cpp"
-#include "JSSVGCursorElement.cpp"
-#include "JSSVGDefsElement.cpp"
-#include "JSSVGDescElement.cpp"
-#include "JSSVGDocument.cpp"
-#include "JSSVGElement.cpp"
-#include "JSSVGElementInstance.cpp"
-#include "JSSVGElementInstanceList.cpp"
-#include "JSSVGEllipseElement.cpp"
-#include "JSSVGException.cpp"
-#include "JSSVGFEBlendElement.cpp"
-#include "JSSVGFEColorMatrixElement.cpp"
-#include "JSSVGFEComponentTransferElement.cpp"
-#include "JSSVGFECompositeElement.cpp"
-#include "JSSVGFEDiffuseLightingElement.cpp"
-#include "JSSVGFEDisplacementMapElement.cpp"
-#include "JSSVGFEDistantLightElement.cpp"
-#include "JSSVGFEFloodElement.cpp"
-#include "JSSVGFEFuncAElement.cpp"
-#include "JSSVGFEFuncBElement.cpp"
-#include "JSSVGFEFuncGElement.cpp"
-#include "JSSVGFEFuncRElement.cpp"
-#include "JSSVGFEGaussianBlurElement.cpp"
-#include "JSSVGFEImageElement.cpp"
-#include "JSSVGFEMergeElement.cpp"
-#include "JSSVGFEMergeNodeElement.cpp"
-#include "JSSVGFEMorphologyElement.cpp"
-#include "JSSVGFEOffsetElement.cpp"
-#include "JSSVGFEPointLightElement.cpp"
-#include "JSSVGFESpecularLightingElement.cpp"
-#include "JSSVGFESpotLightElement.cpp"
-#include "JSSVGFETileElement.cpp"
-#include "JSSVGFETurbulenceElement.cpp"
-#include "JSSVGFilterElement.cpp"
-#include "JSSVGFontElement.cpp"
-#include "JSSVGFontFaceElement.cpp"
-#include "JSSVGFontFaceFormatElement.cpp"
-#include "JSSVGFontFaceNameElement.cpp"
-#include "JSSVGFontFaceSrcElement.cpp"
-#include "JSSVGFontFaceUriElement.cpp"
-#include "JSSVGForeignObjectElement.cpp"
-#include "JSSVGGElement.cpp"
-#include "JSSVGGlyphElement.cpp"
-#include "JSSVGGradientElement.cpp"
-#include "JSSVGImageElement.cpp"
-#include "JSSVGLength.cpp"
-#include "JSSVGLengthList.cpp"
-#include "JSSVGLinearGradientElement.cpp"
-#include "JSSVGLineElement.cpp"
-#include "JSSVGMarkerElement.cpp"
-#include "JSSVGMaskElement.cpp"
-#include "JSSVGMatrix.cpp"
-#include "JSSVGMetadataElement.cpp"
-#include "JSSVGMissingGlyphElement.cpp"
-#include "JSSVGNumber.cpp"
-#include "JSSVGNumberList.cpp"
-#include "JSSVGPaint.cpp"
-#include "JSSVGPathElement.cpp"
-#include "JSSVGPathSeg.cpp"
-#include "JSSVGPathSegArcAbs.cpp"
-#include "JSSVGPathSegArcRel.cpp"
-#include "JSSVGPathSegClosePath.cpp"
-#include "JSSVGPathSegCurvetoCubicAbs.cpp"
-#include "JSSVGPathSegCurvetoCubicRel.cpp"
-#include "JSSVGPathSegCurvetoCubicSmoothAbs.cpp"
-#include "JSSVGPathSegCurvetoCubicSmoothRel.cpp"
-#include "JSSVGPathSegCurvetoQuadraticAbs.cpp"
-#include "JSSVGPathSegCurvetoQuadraticRel.cpp"
-#include "JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp"
-#include "JSSVGPathSegCurvetoQuadraticSmoothRel.cpp"
-#include "JSSVGPathSegLinetoAbs.cpp"
-#include "JSSVGPathSegLinetoHorizontalAbs.cpp"
-#include "JSSVGPathSegLinetoHorizontalRel.cpp"
-#include "JSSVGPathSegLinetoRel.cpp"
-#include "JSSVGPathSegLinetoVerticalAbs.cpp"
-#include "JSSVGPathSegLinetoVerticalRel.cpp"
-#include "JSSVGPathSegList.cpp"
-#include "JSSVGPathSegMovetoAbs.cpp"
-#include "JSSVGPathSegMovetoRel.cpp"
-#include "JSSVGPatternElement.cpp"
-#include "JSSVGPoint.cpp"
-#include "JSSVGPointList.cpp"
-#include "JSSVGPolygonElement.cpp"
-#include "JSSVGPolylineElement.cpp"
-#include "JSSVGPreserveAspectRatio.cpp"
-#include "JSSVGRadialGradientElement.cpp"
-#include "JSSVGRect.cpp"
-#include "JSSVGRectElement.cpp"
-#include "JSSVGRenderingIntent.cpp"
-#include "JSSVGScriptElement.cpp"
-#include "JSSVGSetElement.cpp"
-#include "JSSVGStopElement.cpp"
-#include "JSSVGStringList.cpp"
-#include "JSSVGStyleElement.cpp"
-#include "JSSVGSVGElement.cpp"
-#include "JSSVGSwitchElement.cpp"
-#include "JSSVGSymbolElement.cpp"
-#include "JSSVGTextContentElement.cpp"
-#include "JSSVGTextElement.cpp"
-#include "JSSVGTextPathElement.cpp"
-#include "JSSVGTextPositioningElement.cpp"
-#include "JSSVGTitleElement.cpp"
-#include "JSSVGTransform.cpp"
-#include "JSSVGTransformList.cpp"
-#include "JSSVGTRefElement.cpp"
-#include "JSSVGTSpanElement.cpp"
-#include "JSSVGUnitTypes.cpp"
-#include "JSSVGUseElement.cpp"
-#include "JSSVGViewElement.cpp"
-#include "JSSVGZoomEvent.cpp"
-#include "JSText.cpp"
-#include "JSTextEvent.cpp"
-#include "JSTextMetrics.cpp"
-#include "JSTimeRanges.cpp"
-#include "JSTreeWalker.cpp"
-#include "JSUIEvent.cpp"
-#include "JSValidityState.cpp"
-#include "JSWebKitAnimationEvent.cpp"
-#include "JSWebKitCSSKeyframeRule.cpp"
-#include "JSWebKitCSSKeyframesRule.cpp"
-#include "JSWebKitCSSTransformValue.cpp"
-#include "JSWebKitCSSMatrix.cpp"
-#include "JSWebKitPoint.cpp"
-#include "JSWebKitTransitionEvent.cpp"
-#include "JSWebSocket.cpp"
-#include "JSWheelEvent.cpp"
-#include "JSWorker.cpp"
-#include "JSWorkerContext.cpp"
-#include "JSWorkerLocation.cpp"
-#include "JSWorkerNavigator.cpp"
-#include "JSXMLHttpRequest.cpp"
-#include "JSXMLHttpRequestException.cpp"
-#include "JSXMLHttpRequestProgressEvent.cpp"
-#include "JSXMLHttpRequestUpload.cpp"
-#include "JSXMLSerializer.cpp"
-#include "JSXPathEvaluator.cpp"
-#include "JSXPathException.cpp"
-#include "JSXPathExpression.cpp"
-#include "JSXPathNSResolver.cpp"
-#include "JSXPathResult.cpp"
-#include "JSXSLTProcessor.cpp"
-#include "UserAgentStyleSheetsData.cpp"
-
-// On MSVC, including StaticConstructors.h causes all global objects not to be
-// automatically initialized by the C runtime. This is useful in some specific
-// cases (e.g., the *Names.cpp files), but can be dangerous in others. We don't
-// want StaticConstructors.h to "pollute" all the source files we #include here
-// accidentally, so we'll throw an error whenever any file includes it.
-#ifdef StaticConstructors_h
-#error Do not include any file in DerivedSources.cpp that includes StaticConstructors.h
-#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringBuilder.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringBuilder.h
new file mode 100644
index 0000000000..115db065ac
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringBuilder.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_StringBuilder_h
+#define WebCore_FWD_StringBuilder_h
+#include <JavaScriptCore/StringBuilder.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UStringImpl.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UStringImpl.h
new file mode 100644
index 0000000000..94167a4d6e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UStringImpl.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_UStringImpl_h
+#define WebCore_FWD_UStringImpl_h
+#include <JavaScriptCore/UStringImpl.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCMap.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCMap.h
new file mode 100644
index 0000000000..89432a84f8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCMap.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_WeakGCMap_h
+#define WebCore_FWD_WeakGCMap_h
+#include <JavaScriptCore/WeakGCMap.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCPtr.h
new file mode 100644
index 0000000000..e87f8f2b1d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCPtr.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_WeakGCPtr_h
+#define WebCore_FWD_WeakGCPtr_h
+#include <JavaScriptCore/WeakGCPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h
deleted file mode 100644
index bb6ed9a5ef..0000000000
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h
+++ /dev/null
@@ -1,5 +0,0 @@
-#ifndef WebCore_FWD_PtrAndFlags_h
-#define WebCore_FWD_PtrAndFlags_h
-#include <JavaScriptCore/PtrAndFlags.h>
-#endif
-
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringHashFunctions.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringHashFunctions.h
new file mode 100644
index 0000000000..72c1194a35
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringHashFunctions.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_StringHashFunctions_h
+#define WebCore_FWD_StringHashFunctions_h
+#include <JavaScriptCore/StringHashFunctions.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ValueCheck.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ValueCheck.h
new file mode 100644
index 0000000000..4667674eb2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ValueCheck.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_ValueCheck_h
+#define WebCore_FWD_ValueCheck_h
+#include <JavaScriptCore/ValueCheck.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/Info.plist b/src/3rdparty/webkit/WebCore/Info.plist
index 525a372d3b..9c24f98da6 100644
--- a/src/3rdparty/webkit/WebCore/Info.plist
+++ b/src/3rdparty/webkit/WebCore/Info.plist
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
 	<key>CFBundleDevelopmentRegion</key>
@@ -7,7 +7,7 @@
 	<key>CFBundleExecutable</key>
 	<string>${PRODUCT_NAME}</string>
 	<key>CFBundleGetInfoString</key>
-	<string>${BUNDLE_VERSION}, Copyright 2003-2009 Apple Inc.; Copyright 1997 Martin Jones &lt;mjones@kde.org&gt;; Copyright 1998, 1999 Torben Weis &lt;weis@kde.org&gt;; Copyright 1998, 1999, 2002 Waldo Bastian &lt;bastian@kde.org&gt;; Copyright 1998-2000 Lars Knoll &lt;knoll@kde.org&gt;; Copyright 1999, 2001 Antti Koivisto &lt;koivisto@kde.org&gt;; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2000 Simon Hausmann &lt;hausmann@kde.org&gt;; Copyright 2000, 2001 Dirk Mueller &lt;mueller@kde.org&gt;; Copyright 2000, 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 2000 Daniel Molkentin &lt;molkentin@kde.org&gt;; Copyright 2000 Stefan Schimanski &lt;schimmi@kde.org&gt;; Copyright 1998-2000 Netscape Communications Corporation; Copyright 1998, 1999, 2000 Thai Open Source Software Center Ltd and Clark Cooper; Copyright 2001, 2002 Expat maintainers.</string>
+	<string>${BUNDLE_VERSION}, Copyright 2003-2010 Apple Inc.; Copyright 1997 Martin Jones &lt;mjones@kde.org&gt;; Copyright 1998, 1999 Torben Weis &lt;weis@kde.org&gt;; Copyright 1998, 1999, 2002 Waldo Bastian &lt;bastian@kde.org&gt;; Copyright 1998-2000 Lars Knoll &lt;knoll@kde.org&gt;; Copyright 1999, 2001 Antti Koivisto &lt;koivisto@kde.org&gt;; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2000 Simon Hausmann &lt;hausmann@kde.org&gt;; Copyright 2000, 2001 Dirk Mueller &lt;mueller@kde.org&gt;; Copyright 2000, 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 2000 Daniel Molkentin &lt;molkentin@kde.org&gt;; Copyright 2000 Stefan Schimanski &lt;schimmi@kde.org&gt;; Copyright 1998-2000 Netscape Communications Corporation; Copyright 1998, 1999, 2000 Thai Open Source Software Center Ltd and Clark Cooper; Copyright 2001, 2002 Expat maintainers.</string>
 	<key>CFBundleIdentifier</key>
 	<string>com.apple.${PRODUCT_NAME}</string>
 	<key>CFBundleInfoDictionaryVersion</key>
diff --git a/src/3rdparty/webkit/WebCore/WebCore.ClientBasedGeolocation.exp b/src/3rdparty/webkit/WebCore/WebCore.ClientBasedGeolocation.exp
new file mode 100644
index 0000000000..c624acb336
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/WebCore.ClientBasedGeolocation.exp
@@ -0,0 +1,2 @@
+__ZN7WebCore21GeolocationController13errorOccurredEPNS_16GeolocationErrorE
+__ZN7WebCore21GeolocationController15positionChangedEPNS_19GeolocationPositionE
diff --git a/src/3rdparty/webkit/WebCore/WebCore.Geolocation.exp b/src/3rdparty/webkit/WebCore/WebCore.Geolocation.exp
new file mode 100644
index 0000000000..296c8aa3b5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/WebCore.Geolocation.exp
@@ -0,0 +1,2 @@
+__ZN7WebCore22GeolocationServiceMock11setPositionEN3WTF10PassRefPtrINS_11GeopositionEEE
+__ZN7WebCore22GeolocationServiceMock8setErrorEN3WTF10PassRefPtrINS_13PositionErrorEEE
diff --git a/src/3rdparty/webkit/WebCore/WebCore.Video.exp b/src/3rdparty/webkit/WebCore/WebCore.Video.exp
index 5d356983d4..da79150528 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.Video.exp
+++ b/src/3rdparty/webkit/WebCore/WebCore.Video.exp
@@ -1,14 +1,17 @@
-__ZN7WebCore16HTMLMediaElement4playEv
-__ZN7WebCore16HTMLMediaElement5pauseEv
-__ZNK7WebCore16HTMLMediaElement6volumeEv
-__ZNK7WebCore16HTMLMediaElement7canPlayEv
-__ZNK7WebCore16HTMLMediaElement8durationEv
-__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZN7WebCore16HTMLMediaElement10screenRectEv
+__ZN7WebCore16HTMLMediaElement12endScrubbingEv
+__ZN7WebCore16HTMLMediaElement14beginScrubbingEv
+__ZN7WebCore16HTMLMediaElement14exitFullscreenEv
+__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
+__ZN7WebCore16HTMLMediaElement4playEb
+__ZN7WebCore16HTMLMediaElement5pauseEb
+__ZN7WebCore16HTMLMediaElement6rewindEf
 __ZN7WebCore16HTMLMediaElement8setMutedEb
 __ZN7WebCore16HTMLMediaElement9setVolumeEfRi
-__ZN7WebCore16HTMLMediaElement6rewindEf
-__ZN7WebCore16HTMLMediaElement10screenRectEv
 __ZNK7WebCore16HTMLMediaElement11currentTimeEv
 __ZNK7WebCore16HTMLMediaElement13platformMediaEv
-__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
-__ZN7WebCore16HTMLMediaElement14exitFullscreenEv
+__ZNK7WebCore16HTMLMediaElement21processingUserGestureEv
+__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZNK7WebCore16HTMLMediaElement6volumeEv
+__ZNK7WebCore16HTMLMediaElement7canPlayEv
+__ZNK7WebCore16HTMLMediaElement8durationEv
diff --git a/src/3rdparty/webkit/WebCore/WebCore.gypi b/src/3rdparty/webkit/WebCore/WebCore.gypi
index c0baaf40b5..9746b4637a 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.gypi
+++ b/src/3rdparty/webkit/WebCore/WebCore.gypi
@@ -1,8 +1,6 @@
 {
     'variables': {
         'webcore_bindings_idl_files': [
-
-            #IDL files
             'css/CSSCharsetRule.idl',
             'css/CSSFontFaceRule.idl',
             'css/CSSImportRule.idl',
@@ -38,6 +36,8 @@
             'dom/ClientRectList.idl',
             'dom/Clipboard.idl',
             'dom/Comment.idl',
+            'dom/CompositionEvent.idl',
+            'dom/CustomEvent.idl',
             'dom/DOMCoreException.idl',
             'dom/DOMImplementation.idl',
             'dom/Document.idl',
@@ -65,41 +65,49 @@
             'dom/Notation.idl',
             'dom/OverflowEvent.idl',
             'dom/PageTransitionEvent.idl',
+            'dom/PopStateEvent.idl',
             'dom/ProcessingInstruction.idl',
             'dom/ProgressEvent.idl',
             'dom/Range.idl',
             'dom/RangeException.idl',
             'dom/Text.idl',
             'dom/TextEvent.idl',
+            'dom/Touch.idl',
+            'dom/TouchEvent.idl',
+            'dom/TouchList.idl',
             'dom/TreeWalker.idl',
             'dom/UIEvent.idl',
             'dom/WebKitAnimationEvent.idl',
             'dom/WebKitTransitionEvent.idl',
             'dom/WheelEvent.idl',
-            'html/canvas/CanvasActiveInfo.idl',
-            'html/canvas/CanvasArray.idl',
-            'html/canvas/CanvasArrayBuffer.idl',
-            'html/canvas/CanvasBuffer.idl',
-            'html/canvas/CanvasByteArray.idl',
-            'html/canvas/CanvasFloatArray.idl',
-            'html/canvas/CanvasFramebuffer.idl',
+            'html/Blob.idl',
+            'html/canvas/WebGLActiveInfo.idl',
+            'html/canvas/WebGLArray.idl',
+            'html/canvas/WebGLArrayBuffer.idl',
+            'html/canvas/WebGLBuffer.idl',
+            'html/canvas/WebGLByteArray.idl',
+            'html/canvas/WebGLContextAttributes.idl',
+            'html/canvas/WebGLFloatArray.idl',
+            'html/canvas/WebGLFramebuffer.idl',
             'html/canvas/CanvasGradient.idl',
-            'html/canvas/CanvasIntArray.idl',
+            'html/canvas/WebGLIntArray.idl',
             'html/canvas/CanvasPattern.idl',
             'html/canvas/CanvasPixelArray.idl',
-            'html/canvas/CanvasProgram.idl',
-            'html/canvas/CanvasRenderbuffer.idl',
+            'html/canvas/WebGLProgram.idl',
+            'html/canvas/WebGLRenderbuffer.idl',
             'html/canvas/CanvasRenderingContext.idl',
             'html/canvas/CanvasRenderingContext2D.idl',
-            'html/canvas/CanvasRenderingContext3D.idl',
-            'html/canvas/CanvasShader.idl',
-            'html/canvas/CanvasShortArray.idl',
-            'html/canvas/CanvasUnsignedByteArray.idl',
-            'html/canvas/CanvasUnsignedIntArray.idl',
-            'html/canvas/CanvasUnsignedShortArray.idl',
-            'html/canvas/CanvasTexture.idl',
+            'html/canvas/WebGLRenderingContext.idl',
+            'html/canvas/WebGLShader.idl',
+            'html/canvas/WebGLShortArray.idl',
+            'html/canvas/WebGLUniformLocation.idl',
+            'html/canvas/WebGLUnsignedByteArray.idl',
+            'html/canvas/WebGLUnsignedIntArray.idl',
+            'html/canvas/WebGLUnsignedShortArray.idl',
+            'html/canvas/WebGLTexture.idl',
             'html/DataGridColumn.idl',
             'html/DataGridColumnList.idl',
+            'html/DOMFormData.idl',
             'html/File.idl',
             'html/FileList.idl',
             'html/HTMLAllCollection.idl',
@@ -157,6 +165,7 @@
             'html/HTMLParagraphElement.idl',
             'html/HTMLParamElement.idl',
             'html/HTMLPreElement.idl',
+            'html/HTMLProgressElement.idl',
             'html/HTMLQuoteElement.idl',
             'html/HTMLScriptElement.idl',
             'html/HTMLSelectElement.idl',
@@ -178,7 +187,9 @@
             'html/TimeRanges.idl',
             'html/ValidityState.idl',
             'html/VoidCallback.idl',
+            'inspector/InjectedScriptHost.idl',
             'inspector/InspectorBackend.idl',
+            'inspector/InspectorFrontendHost.idl',
             'inspector/JavaScriptCallFrame.idl',
             'loader/appcache/DOMApplicationCache.idl',
             'notifications/Notification.idl',
@@ -186,8 +197,10 @@
             'page/AbstractView.idl',
             'page/BarInfo.idl',
             'page/Console.idl',
+            'page/Coordinates.idl',
             'page/DOMSelection.idl',
             'page/DOMWindow.idl',
+            'page/EventSource.idl',
             'page/Geolocation.idl',
             'page/Geoposition.idl',
             'page/History.idl',
@@ -202,12 +215,39 @@
             'plugins/Plugin.idl',
             'plugins/PluginArray.idl',
             'storage/Database.idl',
+            'storage/IDBDatabaseError.idl',
+            'storage/IDBDatabaseException.idl',
+            'storage/IDBDatabaseRequest.idl',
+            'storage/IDBRequest.idl',
+            'storage/IndexedDatabaseRequest.idl',
             'storage/SQLError.idl',
             'storage/SQLResultSet.idl',
             'storage/SQLResultSetRowList.idl',
             'storage/SQLTransaction.idl',
             'storage/Storage.idl',
             'storage/StorageEvent.idl',
+            'websockets/WebSocket.idl',
+            'workers/AbstractWorker.idl',
+            'workers/DedicatedWorkerContext.idl',
+            'workers/SharedWorker.idl',
+            'workers/SharedWorkerContext.idl',
+            'workers/Worker.idl',
+            'workers/WorkerContext.idl',
+            'workers/WorkerLocation.idl',
+            'xml/DOMParser.idl',
+            'xml/XMLHttpRequest.idl',
+            'xml/XMLHttpRequestException.idl',
+            'xml/XMLHttpRequestProgressEvent.idl',
+            'xml/XMLHttpRequestUpload.idl',
+            'xml/XMLSerializer.idl',
+            'xml/XPathEvaluator.idl',
+            'xml/XPathException.idl',
+            'xml/XPathExpression.idl',
+            'xml/XPathNSResolver.idl',
+            'xml/XPathResult.idl',
+            'xml/XSLTProcessor.idl',
+        ],
+        'webcore_svg_bindings_idl_files': [
             'svg/ElementTimeControl.idl',
             'svg/SVGAElement.idl',
             'svg/SVGAltGlyphElement.idl',
@@ -354,26 +394,6 @@
             'svg/SVGViewSpec.idl',
             'svg/SVGZoomAndPan.idl',
             'svg/SVGZoomEvent.idl',
-            'websockets/WebSocket.idl',
-            'workers/AbstractWorker.idl',
-            'workers/DedicatedWorkerContext.idl',
-            'workers/SharedWorker.idl',
-            'workers/SharedWorkerContext.idl',
-            'workers/Worker.idl',
-            'workers/WorkerContext.idl',
-            'workers/WorkerLocation.idl',
-            'xml/DOMParser.idl',
-            'xml/XMLHttpRequest.idl',
-            'xml/XMLHttpRequestException.idl',
-            'xml/XMLHttpRequestProgressEvent.idl',
-            'xml/XMLHttpRequestUpload.idl',
-            'xml/XMLSerializer.idl',
-            'xml/XPathEvaluator.idl',
-            'xml/XPathException.idl',
-            'xml/XPathExpression.idl',
-            'xml/XPathNSResolver.idl',
-            'xml/XPathResult.idl',
-            'xml/XSLTProcessor.idl',
         ],
         'webcore_files': [
 
@@ -396,10 +416,18 @@
             'accessibility/AccessibilityListBoxOption.h',
             'accessibility/AccessibilityMediaControls.cpp',
             'accessibility/AccessibilityMediaControls.h',
+            'accessibility/AccessibilityMenuList.cpp',
+            'accessibility/AccessibilityMenuList.h',
+            'accessibility/AccessibilityMenuListPopup.cpp',
+            'accessibility/AccessibilityMenuListPopup.h',
+            'accessibility/AccessibilityMenuListOption.cpp',
+            'accessibility/AccessibilityMenuListOption.h',
             'accessibility/AccessibilityObject.cpp',
             'accessibility/AccessibilityObject.h',
             'accessibility/AccessibilityRenderObject.cpp',
             'accessibility/AccessibilityRenderObject.h',
+            'accessibility/AccessibilityScrollbar.cpp',
+            'accessibility/AccessibilityScrollbar.h',
             'accessibility/AccessibilitySlider.cpp',
             'accessibility/AccessibilitySlider.h',
             'accessibility/AccessibilityTable.cpp',
@@ -428,8 +456,20 @@
             'accessibility/win/AccessibilityObjectWin.cpp',
             'accessibility/win/AccessibilityObjectWrapperWin.h',
             'accessibility/wx/AccessibilityObjectWx.cpp',
+            'bindings/generic/BindingDOMWindow.h',
+            'bindings/generic/BindingElement.h',
+            'bindings/generic/BindingSecurity.h',
+            'bindings/generic/BindingSecurityBase.cpp',
+            'bindings/generic/BindingSecurityBase.h',
+            'bindings/generic/GenericBinding.h',
+            'bindings/generic/RuntimeEnabledFeatures.cpp',
+            'bindings/generic/RuntimeEnabledFeatures.h',
             'bindings/js/CachedScriptSourceProvider.h',
             'bindings/js/DOMObjectWithSVGContext.h',
+            'bindings/js/DOMObjectHashTableMap.cpp',
+            'bindings/js/DOMObjectHashTableMap.h',
+            'bindings/js/DOMWrapperWorld.cpp',
+            'bindings/js/DOMWrapperWorld.h',
             'bindings/js/GCController.cpp',
             'bindings/js/GCController.h',
             'bindings/js/JSCallbackData.cpp',
@@ -469,6 +509,8 @@
             'bindings/js/JSDataGridDataSource.cpp',
             'bindings/js/JSDataGridDataSource.h',
             'bindings/js/JSDedicatedWorkerContextCustom.cpp',
+            'bindings/js/JSDebugWrapperSet.cpp',
+            'bindings/js/JSDebugWrapperSet.h',
             'bindings/js/JSDocumentCustom.cpp',
             'bindings/js/JSDocumentFragmentCustom.cpp',
             'bindings/js/JSDOMApplicationCacheCustom.cpp',
@@ -482,6 +524,8 @@
             'bindings/js/JSDOMWindowCustom.h',
             'bindings/js/JSDOMWindowShell.cpp',
             'bindings/js/JSDOMWindowShell.h',
+            'bindings/js/JSDOMWrapper.cpp',
+            'bindings/js/JSDOMWrapper.h',
             'bindings/js/JSElementCustom.cpp',
             'bindings/js/JSEventCustom.cpp',
             'bindings/js/JSEventListener.cpp',
@@ -517,11 +561,8 @@
             'bindings/js/JSImageConstructor.cpp',
             'bindings/js/JSImageConstructor.h',
             'bindings/js/JSImageDataCustom.cpp',
-            'bindings/js/JSInspectedObjectWrapper.cpp',
-            'bindings/js/JSInspectedObjectWrapper.h',
-            'bindings/js/JSInspectorCallbackWrapper.cpp',
-            'bindings/js/JSInspectorCallbackWrapper.h',
-            'bindings/js/JSInspectorBackendCustom.cpp',
+            'bindings/js/JSInjectedScriptHostCustom.cpp',
+            'bindings/js/JSInspectorFrontendHostCustom.cpp',
             'bindings/js/JSJavaScriptCallFrameCustom.cpp',
             'bindings/js/JSLazyEventListener.cpp',
             'bindings/js/JSLazyEventListener.h',
@@ -539,6 +580,7 @@
             'bindings/js/JSNamedNodesCollection.h',
             'bindings/js/JSNavigatorCustom.cpp',
             'bindings/js/JSNodeCustom.cpp',
+            'bindings/js/JSNodeCustom.h',
             'bindings/js/JSNodeFilterCondition.cpp',
             'bindings/js/JSNodeFilterCondition.h',
             'bindings/js/JSNodeFilterCustom.cpp',
@@ -550,8 +592,6 @@
             'bindings/js/JSPluginCustom.cpp',
             'bindings/js/JSPluginElementFunctions.cpp',
             'bindings/js/JSPluginElementFunctions.h',
-            'bindings/js/JSQuarantinedObjectWrapper.cpp',
-            'bindings/js/JSQuarantinedObjectWrapper.h',
             'bindings/js/JSRGBColor.cpp',
             'bindings/js/JSRGBColor.h',
             'bindings/js/JSSharedWorkerConstructor.cpp',
@@ -563,14 +603,14 @@
             'bindings/js/JSStorageCustom.h',
             'bindings/js/JSStyleSheetCustom.cpp',
             'bindings/js/JSStyleSheetListCustom.cpp',
+            'bindings/js/JSSVGContextCache.h',
             'bindings/js/JSSVGElementInstanceCustom.cpp',
             'bindings/js/JSSVGLengthCustom.cpp',
             'bindings/js/JSSVGMatrixCustom.cpp',
             'bindings/js/JSSVGPathSegCustom.cpp',
             'bindings/js/JSSVGPathSegListCustom.cpp',
+            'bindings/js/JSSVGPODListCustom.h',
             'bindings/js/JSSVGPODTypeWrapper.h',
-            'bindings/js/JSSVGPointListCustom.cpp',
-            'bindings/js/JSSVGTransformListCustom.cpp',
             'bindings/js/JSTextCustom.cpp',
             'bindings/js/JSTreeWalkerCustom.cpp',
             'bindings/js/JSWebKitCSSMatrixConstructor.cpp',
@@ -593,6 +633,10 @@
             'bindings/js/JSXSLTProcessorConstructor.cpp',
             'bindings/js/JSXSLTProcessorConstructor.h',
             'bindings/js/JSXSLTProcessorCustom.cpp',
+            'bindings/js/JavaScriptProfile.cpp',
+            'bindings/js/JavaScriptProfile.h',
+            'bindings/js/JavaScriptProfileNode.cpp',
+            'bindings/js/JavaScriptProfileNode.h',
             'bindings/js/ScheduledAction.cpp',
             'bindings/js/ScheduledAction.h',
             'bindings/js/ScriptArray.cpp',
@@ -617,8 +661,6 @@
             'bindings/js/ScriptInstance.h',
             'bindings/js/ScriptObject.cpp',
             'bindings/js/ScriptObject.h',
-            'bindings/js/ScriptObjectQuarantine.cpp',
-            'bindings/js/ScriptObjectQuarantine.h',
             'bindings/js/ScriptSourceCode.h',
             'bindings/js/ScriptSourceProvider.h',
             'bindings/js/ScriptState.cpp',
@@ -626,33 +668,42 @@
             'bindings/js/ScriptString.h',
             'bindings/js/ScriptValue.cpp',
             'bindings/js/ScriptValue.h',
+            'bindings/js/ScriptWrappable.h',
             'bindings/js/StringSourceProvider.h',
+            'bindings/js/WebCoreJSClientData.h',
             'bindings/js/WorkerScriptController.cpp',
             'bindings/js/WorkerScriptController.h',
             'bindings/ScriptControllerBase.cpp',
             'bindings/v8/ChildThreadDOMData.cpp',
             'bindings/v8/ChildThreadDOMData.h',
-            'bindings/v8/custom/V8AbstractWorkerCustom.cpp',
             'bindings/v8/custom/V8AttrCustom.cpp',
+            'bindings/v8/custom/V8BarInfoCustom.cpp',
             'bindings/v8/custom/V8CanvasPixelArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasArrayCustom.h',
-            'bindings/v8/custom/V8CanvasArrayBufferCustom.cpp',
-            'bindings/v8/custom/V8CanvasByteArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasIntArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasFloatArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasShortArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLArrayCustom.h',
+            'bindings/v8/custom/V8WebGLArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLArrayBufferCustom.cpp',
+            'bindings/v8/custom/V8WebGLByteArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLIntArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLFloatArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLShortArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp',
             'bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp',
-            'bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp',
-            'bindings/v8/custom/V8ClientRectListCustom.cpp',
+            'bindings/v8/custom/V8WebGLRenderingContextCustom.cpp',
             'bindings/v8/custom/V8ClipboardCustom.cpp',
+            'bindings/v8/custom/V8CoordinatesCustom.cpp',
+            'bindings/v8/custom/V8CSSRuleCustom.cpp',
             'bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp',
-            'bindings/v8/custom/V8CustomBinding.cpp',
-            'bindings/v8/custom/V8CustomBinding.h',
+            'bindings/v8/custom/V8CSSStyleSheetCustom.cpp',
+            'bindings/v8/custom/V8CSSValueCustom.cpp',
+            'bindings/v8/custom/V8CustomCallback.h',
             'bindings/v8/custom/V8CustomEventListener.cpp',
             'bindings/v8/custom/V8CustomEventListener.h',
+            'bindings/v8/custom/V8CustomPositionCallback.cpp',
+            'bindings/v8/custom/V8CustomPositionCallback.h',
+            'bindings/v8/custom/V8CustomPositionErrorCallback.cpp',
+            'bindings/v8/custom/V8CustomPositionErrorCallback.h',
             'bindings/v8/custom/V8CustomSQLStatementCallback.cpp',
             'bindings/v8/custom/V8CustomSQLStatementCallback.h',
             'bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp',
@@ -665,17 +716,21 @@
             'bindings/v8/custom/V8CustomVoidCallback.h',
             'bindings/v8/custom/V8CustomXPathNSResolver.cpp',
             'bindings/v8/custom/V8CustomXPathNSResolver.h',
+            'bindings/v8/custom/V8DatabaseCallback.cpp',
+            'bindings/v8/custom/V8DatabaseCallback.h',
             'bindings/v8/custom/V8DatabaseCustom.cpp',
             'bindings/v8/custom/V8DataGridColumnListCustom.cpp',
             'bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp',
             'bindings/v8/custom/V8DocumentLocationCustom.cpp',
-            'bindings/v8/custom/V8DOMApplicationCacheCustom.cpp',
-            'bindings/v8/custom/V8DOMParserConstructor.cpp',
+            'bindings/v8/custom/V8DOMFormDataCustom.cpp',
+            'bindings/v8/custom/V8DOMSelectionCustom.cpp',
             'bindings/v8/custom/V8DOMWindowCustom.cpp',
             'bindings/v8/custom/V8DocumentCustom.cpp',
             'bindings/v8/custom/V8ElementCustom.cpp',
             'bindings/v8/custom/V8EventCustom.cpp',
-            'bindings/v8/custom/V8FileListCustom.cpp',
+            'bindings/v8/custom/V8EventSourceConstructor.cpp',
+            'bindings/v8/custom/V8GeolocationCustom.cpp',
+            'bindings/v8/custom/V8HistoryCustom.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.h',
             'bindings/v8/custom/V8HTMLAllCollectionCustom.cpp',
@@ -683,6 +738,7 @@
             'bindings/v8/custom/V8HTMLCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLDataGridElementCustom.cpp',
             'bindings/v8/custom/V8HTMLDocumentCustom.cpp',
+            'bindings/v8/custom/V8HTMLElementCustom.cpp',
             'bindings/v8/custom/V8HTMLFormElementCustom.cpp',
             'bindings/v8/custom/V8HTMLFrameElementCustom.cpp',
             'bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp',
@@ -694,10 +750,12 @@
             'bindings/v8/custom/V8HTMLOptionElementConstructor.h',
             'bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLPlugInElementCustom.cpp',
-            'bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLSelectElementCustom.cpp',
             'bindings/v8/custom/V8HTMLSelectElementCustom.h',
-            'bindings/v8/custom/V8InspectorBackendCustom.cpp',
+            'bindings/v8/custom/V8IDBRequestCustom.cpp',
+            'bindings/v8/custom/V8IndexedDatabaseRequestCustom.cpp',
+            'bindings/v8/custom/V8InjectedScriptHostCustom.cpp',
+            'bindings/v8/custom/V8InspectorFrontendHostCustom.cpp',
             'bindings/v8/custom/V8LocationCustom.cpp',
             'bindings/v8/custom/V8MessageChannelConstructor.cpp',
             'bindings/v8/custom/V8MessageEventCustom.cpp',
@@ -712,13 +770,18 @@
             'bindings/v8/custom/V8NodeIteratorCustom.cpp',
             'bindings/v8/custom/V8NodeListCustom.cpp',
             'bindings/v8/custom/V8NotificationCenterCustom.cpp',
+            'bindings/v8/custom/V8PopStateEventCustom.cpp',
             'bindings/v8/custom/V8StorageCustom.cpp',
             'bindings/v8/custom/V8SQLResultSetRowListCustom.cpp',
             'bindings/v8/custom/V8SQLTransactionCustom.cpp',
-            'bindings/v8/custom/V8SVGElementInstanceCustom.cpp',
+            'bindings/v8/custom/V8SVGDocumentCustom.cpp',
+            'bindings/v8/custom/V8SVGElementCustom.cpp',
             'bindings/v8/custom/V8SVGLengthCustom.cpp',
             'bindings/v8/custom/V8SVGMatrixCustom.cpp',
+            'bindings/v8/custom/V8SVGPathSegCustom.cpp',
+            'bindings/v8/custom/V8ScreenCustom.cpp',
             'bindings/v8/custom/V8SharedWorkerCustom.cpp',
+            'bindings/v8/custom/V8StyleSheetCustom.cpp',
             'bindings/v8/custom/V8StyleSheetListCustom.cpp',
             'bindings/v8/custom/V8TreeWalkerCustom.cpp',
             'bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp',
@@ -728,9 +791,6 @@
             'bindings/v8/custom/V8WorkerCustom.cpp',
             'bindings/v8/custom/V8XMLHttpRequestConstructor.cpp',
             'bindings/v8/custom/V8XMLHttpRequestCustom.cpp',
-            'bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp',
-            'bindings/v8/custom/V8XMLSerializerConstructor.cpp',
-            'bindings/v8/custom/V8XPathEvaluatorConstructor.cpp',
             'bindings/v8/custom/V8XSLTProcessorCustom.cpp',
             'bindings/v8/DateExtension.cpp',
             'bindings/v8/DateExtension.h',
@@ -738,14 +798,15 @@
             'bindings/v8/DOMData.h',
             'bindings/v8/DOMDataStore.cpp',
             'bindings/v8/DOMDataStore.h',
-            'bindings/v8/DOMObjectsInclude.h',
+            'bindings/v8/DOMWrapperWorld.cpp',
+            'bindings/v8/DOMWrapperWorld.h',
+            'bindings/v8/IsolatedWorld.cpp',
+            'bindings/v8/IsolatedWorld.h',
             'bindings/v8/MainThreadDOMData.cpp',
             'bindings/v8/MainThreadDOMData.h',
             'bindings/v8/NPV8Object.cpp',
             'bindings/v8/NPV8Object.h',
             'bindings/v8/OwnHandle.h',
-            'bindings/v8/RuntimeEnabledFeatures.cpp',
-            'bindings/v8/RuntimeEnabledFeatures.h',
             'bindings/v8/ScheduledAction.cpp',
             'bindings/v8/ScheduledAction.h',
             'bindings/v8/ScopedDOMDataStore.cpp',
@@ -759,6 +820,8 @@
             'bindings/v8/ScriptCallStack.h',
             'bindings/v8/ScriptController.cpp',
             'bindings/v8/ScriptController.h',
+            'bindings/v8/ScriptDebugServer.cpp',
+            'bindings/v8/ScriptDebugServer.h',
             'bindings/v8/ScriptEventListener.cpp',
             'bindings/v8/ScriptEventListener.h',
             'bindings/v8/ScriptFunctionCall.cpp',
@@ -767,8 +830,9 @@
             'bindings/v8/ScriptInstance.h',
             'bindings/v8/ScriptObject.cpp',
             'bindings/v8/ScriptObject.h',
-            'bindings/v8/ScriptObjectQuarantine.cpp',
-            'bindings/v8/ScriptObjectQuarantine.h',
+            'bindings/v8/ScriptProfile.h',
+            'bindings/v8/ScriptProfiler.cpp',
+            'bindings/v8/ScriptProfiler.h',
             'bindings/v8/ScriptScope.cpp',
             'bindings/v8/ScriptScope.h',
             'bindings/v8/ScriptSourceCode.h',
@@ -779,7 +843,12 @@
             'bindings/v8/ScriptStringImpl.h',
             'bindings/v8/ScriptValue.cpp',
             'bindings/v8/ScriptValue.h',
+            'bindings/v8/ScriptWrappable.h',
+            'bindings/v8/SerializedScriptValue.cpp',
             'bindings/v8/SerializedScriptValue.h',
+            'bindings/v8/specialization/V8BindingDOMWindow.h',
+            'bindings/v8/specialization/V8BindingState.cpp',
+            'bindings/v8/specialization/V8BindingState.h',
             'bindings/v8/StaticDOMDataStore.cpp',
             'bindings/v8/StaticDOMDataStore.h',
             'bindings/v8/V8AbstractEventListener.cpp',
@@ -794,20 +863,22 @@
             'bindings/v8/V8DataGridDataSource.h',
             'bindings/v8/V8DOMMap.cpp',
             'bindings/v8/V8DOMMap.h',
+            'bindings/v8/V8DOMWindowShell.cpp',
+            'bindings/v8/V8DOMWindowShell.h',
             'bindings/v8/V8DOMWrapper.cpp',
             'bindings/v8/V8DOMWrapper.h',
             'bindings/v8/V8EventListenerList.cpp',
             'bindings/v8/V8EventListenerList.h',
             'bindings/v8/V8GCController.cpp',
             'bindings/v8/V8GCController.h',
+            'bindings/v8/V8GCForContextDispose.cpp',
+            'bindings/v8/V8GCForContextDispose.h',
             'bindings/v8/V8Helpers.cpp',
             'bindings/v8/V8Helpers.h',
             'bindings/v8/V8HiddenPropertyName.cpp',
             'bindings/v8/V8HiddenPropertyName.h',
-            'bindings/v8/V8Index.cpp',
-            'bindings/v8/V8Index.h',
-            'bindings/v8/V8IsolatedWorld.cpp',
-            'bindings/v8/V8IsolatedWorld.h',
+            'bindings/v8/V8IsolatedContext.cpp',
+            'bindings/v8/V8IsolatedContext.h',
             'bindings/v8/V8LazyEventListener.cpp',
             'bindings/v8/V8LazyEventListener.h',
             'bindings/v8/V8NPObject.cpp',
@@ -827,6 +898,9 @@
             'bindings/v8/WorkerContextExecutionProxy.cpp',
             'bindings/v8/WorkerScriptController.h',
             'bindings/v8/WorkerScriptController.cpp',
+            'bindings/v8/WorldContextHandle.cpp',
+            'bindings/v8/WorldContextHandle.h',
+            'bindings/v8/WrapperTypeInfo.h',
             'bindings/v8/npruntime.cpp',
             'bindings/v8/npruntime_impl.h',
             'bindings/v8/npruntime_internal.h',
@@ -981,14 +1055,14 @@
             'dom/CDATASection.h',
             'dom/CSSMappedAttributeDeclaration.cpp',
             'dom/CSSMappedAttributeDeclaration.h',
+            'dom/CanvasSurface.cpp',
+            'dom/CanvasSurface.h',
             'dom/CharacterData.cpp',
             'dom/CharacterData.h',
             'dom/CheckedRadioButtons.cpp',
             'dom/CheckedRadioButtons.h',
             'dom/ChildNodeList.cpp',
             'dom/ChildNodeList.h',
-            'dom/ClassNames.cpp',
-            'dom/ClassNames.h',
             'dom/ClassNodeList.cpp',
             'dom/ClassNodeList.h',
             'dom/ClientRect.cpp',
@@ -1002,9 +1076,13 @@
             'dom/ClipboardEvent.h',
             'dom/Comment.cpp',
             'dom/Comment.h',
+            'dom/CompositionEvent.cpp',
+            'dom/CompositionEvent.h',
             'dom/ContainerNode.cpp',
             'dom/ContainerNode.h',
             'dom/ContainerNodeAlgorithms.h',
+            'dom/CustomEvent.cpp',
+            'dom/CustomEvent.h',
             'dom/DOMCoreException.h',
             'dom/DOMImplementation.cpp',
             'dom/DOMImplementation.h',
@@ -1088,6 +1166,8 @@
             'dom/OptionGroupElement.h',
             'dom/OverflowEvent.cpp',
             'dom/OverflowEvent.h',
+            'dom/PopStateEvent.cpp',
+            'dom/PopStateEvent.h',
             'dom/PageTransitionEvent.cpp',
             'dom/PageTransitionEvent.h',
             'dom/Position.cpp',
@@ -1114,6 +1194,8 @@
             'dom/SelectElement.h',
             'dom/SelectorNodeList.cpp',
             'dom/SelectorNodeList.h',
+            'dom/SpaceSplitString.cpp',
+            'dom/SpaceSplitString.h',
             'dom/StaticNodeList.cpp',
             'dom/StaticNodeList.h',
             'dom/StaticStringList.cpp',
@@ -1128,6 +1210,11 @@
             'dom/Text.h',
             'dom/TextEvent.cpp',
             'dom/TextEvent.h',
+            'dom/Touch.cpp',
+            'dom/Touch.h',
+            'dom/TouchEvent.cpp',
+            'dom/TouchList.cpp',
+            'dom/TouchList.h',
             'dom/Tokenizer.h',
             'dom/TransformSourceLibxslt.cpp',
             'dom/TransformSource.h',
@@ -1268,52 +1355,62 @@
             'history/HistoryItem.h',
             'history/PageCache.cpp',
             'history/PageCache.h',
-            'html/canvas/CanvasArray.cpp',
-            'html/canvas/CanvasArray.h',
-            'html/canvas/CanvasArrayBuffer.cpp',
-            'html/canvas/CanvasArrayBuffer.h',
-            'html/canvas/CanvasBuffer.cpp',
-            'html/canvas/CanvasBuffer.h',
-            'html/canvas/CanvasByteArray.cpp',
-            'html/canvas/CanvasByteArray.h',
-            'html/canvas/CanvasFloatArray.cpp',
-            'html/canvas/CanvasFloatArray.h',
-            'html/canvas/CanvasFramebuffer.cpp',
-            'html/canvas/CanvasFramebuffer.h',
+            'html/Blob.cpp',
+            'html/Blob.h',
+            'html/canvas/WebGLArray.cpp',
+            'html/canvas/WebGLArray.h',
+            'html/canvas/WebGLArrayBuffer.cpp',
+            'html/canvas/WebGLArrayBuffer.h',
+            'html/canvas/WebGLBuffer.cpp',
+            'html/canvas/WebGLBuffer.h',
+            'html/canvas/WebGLByteArray.cpp',
+            'html/canvas/WebGLByteArray.h',
+            'html/canvas/WebGLContextAttributes.cpp',
+            'html/canvas/WebGLContextAttributes.h',
+            'html/canvas/WebGLFloatArray.cpp',
+            'html/canvas/WebGLFloatArray.h',
+            'html/canvas/WebGLFramebuffer.cpp',
+            'html/canvas/WebGLFramebuffer.h',
+            'html/canvas/WebGLGetInfo.cpp',
+            'html/canvas/WebGLGetInfo.h',
+            'html/canvas/CanvasContextAttributes.cpp',
+            'html/canvas/CanvasContextAttributes.h',
             'html/canvas/CanvasGradient.cpp',
             'html/canvas/CanvasGradient.h',
-            'html/canvas/CanvasIntArray.cpp',
-            'html/canvas/CanvasIntArray.h',
+            'html/canvas/WebGLIntArray.cpp',
+            'html/canvas/WebGLIntArray.h',
             'html/canvas/CanvasObject.cpp',
             'html/canvas/CanvasObject.h',
             'html/canvas/CanvasPattern.cpp',
             'html/canvas/CanvasPattern.h',
             'html/canvas/CanvasPixelArray.cpp',
             'html/canvas/CanvasPixelArray.h',
-            'html/canvas/CanvasProgram.cpp',
-            'html/canvas/CanvasProgram.h',
-            'html/canvas/CanvasRenderbuffer.cpp',
-            'html/canvas/CanvasRenderbuffer.h',
+            'html/canvas/WebGLProgram.cpp',
+            'html/canvas/WebGLProgram.h',
+            'html/canvas/WebGLRenderbuffer.cpp',
+            'html/canvas/WebGLRenderbuffer.h',
             'html/canvas/CanvasRenderingContext.cpp',
             'html/canvas/CanvasRenderingContext.h',
             'html/canvas/CanvasRenderingContext2D.cpp',
             'html/canvas/CanvasRenderingContext2D.h',
-            'html/canvas/CanvasRenderingContext3D.cpp',
-            'html/canvas/CanvasRenderingContext3D.h',
-            'html/canvas/CanvasShader.cpp',
-            'html/canvas/CanvasShader.h',
-            'html/canvas/CanvasShortArray.cpp',
-            'html/canvas/CanvasShortArray.h',
+            'html/canvas/WebGLRenderingContext.cpp',
+            'html/canvas/WebGLRenderingContext.h',
+            'html/canvas/WebGLShader.cpp',
+            'html/canvas/WebGLShader.h',
+            'html/canvas/WebGLShortArray.cpp',
+            'html/canvas/WebGLShortArray.h',
             'html/canvas/CanvasStyle.cpp',
             'html/canvas/CanvasStyle.h',
-            'html/canvas/CanvasTexture.cpp',
-            'html/canvas/CanvasTexture.h',
-            'html/canvas/CanvasUnsignedByteArray.cpp',
-            'html/canvas/CanvasUnsignedByteArray.h',
-            'html/canvas/CanvasUnsignedIntArray.cpp',
-            'html/canvas/CanvasUnsignedIntArray.h',
-            'html/canvas/CanvasUnsignedShortArray.cpp',
-            'html/canvas/CanvasUnsignedShortArray.h',
+            'html/canvas/WebGLTexture.cpp',
+            'html/canvas/WebGLTexture.h',
+            'html/canvas/WebGLUniformLocation.cpp',
+            'html/canvas/WebGLUniformLocation.h',
+            'html/canvas/WebGLUnsignedByteArray.cpp',
+            'html/canvas/WebGLUnsignedByteArray.h',
+            'html/canvas/WebGLUnsignedIntArray.cpp',
+            'html/canvas/WebGLUnsignedIntArray.h',
+            'html/canvas/WebGLUnsignedShortArray.cpp',
+            'html/canvas/WebGLUnsignedShortArray.h',
             'html/CollectionCache.cpp',
             'html/CollectionCache.h',
             'html/CollectionType.h',
@@ -1321,8 +1418,12 @@
             'html/DataGridColumn.h',
             'html/DOMDataGridDataSource.cpp',
             'html/DOMDataGridDataSource.h',
+            'html/DOMFormData.cpp',
+            'html/DOMFormData.h',
             'html/DataGridColumnList.cpp',
             'html/DataGridColumnList.h',
+            'html/DateComponents.cpp',
+            'html/DateComponents.h',
             'html/File.cpp',
             'html/File.h',
             'html/FileList.cpp',
@@ -1461,6 +1562,8 @@
             'html/HTMLPlugInImageElement.h',
             'html/HTMLPreElement.cpp',
             'html/HTMLPreElement.h',
+            'html/HTMLProgressElement.cpp',
+            'html/HTMLProgressElement.h',
             'html/HTMLQuoteElement.cpp',
             'html/HTMLQuoteElement.h',
             'html/HTMLScriptElement.cpp',
@@ -1504,6 +1607,8 @@
             'html/MediaError.h',
             'html/PreloadScanner.cpp',
             'html/PreloadScanner.h',
+            'html/StepRange.cpp',
+            'html/StepRange.h',
             'html/TextMetrics.h',
             'html/TimeRanges.cpp',
             'html/TimeRanges.h',
@@ -1513,6 +1618,10 @@
             'inspector/InspectorClient.h',
             'inspector/ConsoleMessage.cpp',
             'inspector/ConsoleMessage.h',
+            'inspector/InjectedScript.cpp',
+            'inspector/InjectedScript.h',
+            'inspector/InjectedScriptHost.cpp',
+            'inspector/InjectedScriptHost.h',
             'inspector/InspectorBackend.cpp',
             'inspector/InspectorBackend.h',
             'inspector/InspectorController.cpp',
@@ -1525,19 +1634,20 @@
             'inspector/InspectorDOMStorageResource.h',
             'inspector/InspectorFrontend.cpp',
             'inspector/InspectorFrontend.h',
+            'inspector/InspectorFrontendClient.h',
+            'inspector/InspectorFrontendClientLocal.cpp',
+            'inspector/InspectorFrontendClientLocal.h',
+            'inspector/InspectorFrontendHost.cpp',
+            'inspector/InspectorFrontendHost.h',
             'inspector/InspectorResource.cpp',
             'inspector/InspectorResource.h',
             'inspector/InspectorTimelineAgent.cpp',
             'inspector/InspectorTimelineAgent.h',
+            'inspector/InspectorWorkerResource.h',
             'inspector/JavaScriptCallFrame.cpp',
             'inspector/JavaScriptCallFrame.h',
-            'inspector/JavaScriptDebugListener.h',
-            'inspector/JavaScriptDebugServer.cpp',
-            'inspector/JavaScriptDebugServer.h',
-            'inspector/JavaScriptProfile.cpp',
-            'inspector/JavaScriptProfile.h',
-            'inspector/JavaScriptProfileNode.cpp',
-            'inspector/JavaScriptProfileNode.h',
+            'inspector/ScriptBreakpoint.h',
+            'inspector/ScriptDebugListener.h',
             'inspector/TimelineRecordFactory.cpp',
             'inspector/TimelineRecordFactory.h',
             'loader/appcache/ApplicationCache.cpp',
@@ -1695,7 +1805,6 @@
             'page/chromium/DragControllerChromium.cpp',
             'page/chromium/EventHandlerChromium.cpp',
             'page/chromium/FrameChromium.cpp',
-            'page/chromium/FrameChromium.h',
             'page/gtk/DragControllerGtk.cpp',
             'page/gtk/EventHandlerGtk.cpp',
             'page/gtk/FrameGtk.cpp',
@@ -1732,6 +1841,7 @@
             'page/ContextMenuClient.h',
             'page/ContextMenuController.cpp',
             'page/ContextMenuController.h',
+            'page/ContextMenuProvider.h',
             'page/DOMSelection.cpp',
             'page/DOMSelection.h',
             'page/DOMTimer.cpp',
@@ -1745,6 +1855,8 @@
             'page/EditorClient.h',
             'page/EventHandler.cpp',
             'page/EventHandler.h',
+            'page/EventSource.cpp',
+            'page/EventSource.h',
             'page/FocusController.cpp',
             'page/FocusController.h',
             'page/FocusDirection.h',
@@ -1757,6 +1869,13 @@
             'page/FrameView.h',
             'page/Geolocation.cpp',
             'page/Geolocation.h',
+            'page/GeolocationController.cpp',
+            'page/GeolocationController.h',
+            'page/GeolocationControllerClient.h',
+            'page/GeolocationError.h',
+            'page/GeolocationPosition.h',
+            'page/GeolocationPositionCache.cpp',
+            'page/GeolocationPositionCache.h',
             'page/Geoposition.h',
             'page/HaltablePlugin.h',
             'page/History.cpp',
@@ -1793,6 +1912,8 @@
             'page/SecurityOriginHash.h',
             'page/Settings.cpp',
             'page/Settings.h',
+            'page/SpatialNavigation.h',
+            'page/SpatialNavigation.cpp',
             'page/UserContentURLPattern.cpp',
             'page/UserContentURLPattern.h',
             'page/UserScript.h',
@@ -1806,6 +1927,7 @@
             'page/WorkerNavigator.h',
             'page/XSSAuditor.cpp',
             'page/XSSAuditor.h',
+            'page/ZoomMode.h',
             'platform/animation/Animation.cpp',
             'platform/animation/Animation.h',
             'platform/animation/AnimationList.cpp',
@@ -1841,6 +1963,8 @@
             'platform/chromium/FramelessScrollView.cpp',
             'platform/chromium/FramelessScrollView.h',
             'platform/chromium/FramelessScrollViewClient.h',
+            'platform/chromium/GeolocationServiceChromium.cpp',
+            'platform/chromium/GeolocationServiceChromium.h',
             'platform/chromium/KeyCodeConversion.h',
             'platform/chromium/KeyCodeConversionGtk.cpp',
             'platform/chromium/KeyboardCodesPosix.h',
@@ -1861,6 +1985,8 @@
             'platform/chromium/ScrollbarThemeChromium.cpp',
             'platform/chromium/ScrollbarThemeChromium.h',
             'platform/chromium/ScrollbarThemeChromiumLinux.cpp',
+            'platform/chromium/ScrollbarThemeChromiumMac.h',
+            'platform/chromium/ScrollbarThemeChromiumMac.mm',
             'platform/chromium/ScrollbarThemeChromiumWin.cpp',
             'platform/chromium/SearchPopupMenuChromium.cpp',
             'platform/chromium/SharedTimerChromium.cpp',
@@ -1890,6 +2016,7 @@
             'platform/graphics/cg/FloatRectCG.cpp',
             'platform/graphics/cg/FloatSizeCG.cpp',
             'platform/graphics/cg/GradientCG.cpp',
+            'platform/graphics/cg/GraphicsContext3DCG.cpp',
             'platform/graphics/cg/GraphicsContextCG.cpp',
             'platform/graphics/cg/GraphicsContextPlatformPrivateCG.h',
             'platform/graphics/cg/ImageBufferCG.cpp',
@@ -1947,6 +2074,11 @@
             'platform/graphics/filters/FEComposite.h',
             'platform/graphics/filters/FEGaussianBlur.cpp',
             'platform/graphics/filters/FEGaussianBlur.h',
+            'platform/graphics/filters/Filter.h',
+            'platform/graphics/filters/FilterEffect.cpp',
+            'platform/graphics/filters/FilterEffect.h',
+            'platform/graphics/filters/ImageBufferFilter.cpp',
+            'platform/graphics/filters/ImageBufferFilter.h',
             'platform/graphics/filters/SourceAlpha.cpp',
             'platform/graphics/filters/SourceAlpha.h',
             'platform/graphics/filters/SourceGraphic.cpp',
@@ -1974,17 +2106,18 @@
             'platform/graphics/gtk/VideoSinkGStreamer.h',
             'platform/graphics/mac/ColorMac.h',
             'platform/graphics/mac/ColorMac.mm',
-            'platform/graphics/mac/CoreTextController.cpp',
-            'platform/graphics/mac/CoreTextController.h',
+            'platform/graphics/mac/ComplexTextController.cpp',
+            'platform/graphics/mac/ComplexTextController.h',
+            'platform/graphics/mac/ComplexTextControllerATSUI.cpp',
+            'platform/graphics/mac/ComplexTextControllerCoreText.cpp',
             'platform/graphics/mac/FloatPointMac.mm',
             'platform/graphics/mac/FloatRectMac.mm',
             'platform/graphics/mac/FloatSizeMac.mm',
             'platform/graphics/mac/FontCacheMac.mm',
+            'platform/graphics/mac/FontComplexTextMac.cpp',
             'platform/graphics/mac/FontCustomPlatformData.cpp',
             'platform/graphics/mac/FontCustomPlatformData.h',
             'platform/graphics/mac/FontMac.mm',
-            'platform/graphics/mac/FontMacATSUI.mm',
-            'platform/graphics/mac/FontMacCoreText.cpp',
             'platform/graphics/mac/FontPlatformData.h',
             'platform/graphics/mac/FontPlatformDataMac.mm',
             'platform/graphics/mac/GlyphPageTreeNodeMac.cpp',
@@ -2005,6 +2138,8 @@
             'platform/graphics/mac/WebTiledLayer.h',
             'platform/graphics/mac/WebTiledLayer.mm',
             'platform/graphics/MediaPlayer.cpp',
+            'platform/graphics/opentype/OpenTypeSanitizer.cpp',
+            'platform/graphics/opentype/OpenTypeSanitizer.h',
             'platform/graphics/opentype/OpenTypeUtilities.cpp',
             'platform/graphics/opentype/OpenTypeUtilities.h',
             'platform/graphics/qt/ColorQt.cpp',
@@ -2045,10 +2180,17 @@
             'platform/graphics/skia/GradientSkia.cpp',
             'platform/graphics/skia/GraphicsContextPlatformPrivate.h',
             'platform/graphics/skia/GraphicsContextSkia.cpp',
+            'platform/graphics/skia/GraphicsContext3DSkia.cpp',
+            'platform/graphics/skia/GraphicsLayerSkia.cpp',
+            'platform/graphics/skia/GraphicsLayerSkia.h',
             'platform/graphics/skia/ImageBufferSkia.cpp',
             'platform/graphics/skia/ImageSkia.cpp',
             'platform/graphics/skia/IntPointSkia.cpp',
             'platform/graphics/skia/IntRectSkia.cpp',
+            'platform/graphics/skia/LayerRendererSkia.cpp',
+            'platform/graphics/skia/LayerRendererSkia.h',
+            'platform/graphics/skia/LayerSkia.cpp',
+            'platform/graphics/skia/LayerSkia.h',
             'platform/graphics/skia/NativeImageSkia.cpp',
             'platform/graphics/skia/NativeImageSkia.h',
             'platform/graphics/skia/PathSkia.cpp',
@@ -2061,6 +2203,8 @@
             'platform/graphics/skia/SkiaUtils.cpp',
             'platform/graphics/skia/SkiaUtils.h',
             'platform/graphics/skia/TransformationMatrixSkia.cpp',
+            'platform/graphics/transforms/AffineTransform.cpp',
+            'platform/graphics/transforms/AffineTransform.h',
             'platform/graphics/transforms/IdentityTransformOperation.h',
             'platform/graphics/transforms/Matrix3DTransformOperation.cpp',
             'platform/graphics/transforms/Matrix3DTransformOperation.h',
@@ -2180,6 +2324,7 @@
             'platform/graphics/Gradient.h',
             'platform/graphics/GraphicsContext.cpp',
             'platform/graphics/GraphicsContext.h',
+            'platform/graphics/GraphicsContext3D.cpp',
             'platform/graphics/GraphicsContext3D.h',
             'platform/graphics/GraphicsContextPrivate.h',
             'platform/graphics/GraphicsLayer.cpp',
@@ -2283,8 +2428,6 @@
             'platform/image-decoders/png/PNGImageDecoder.h',
             'platform/image-decoders/skia/ImageDecoderSkia.cpp',
             'platform/image-decoders/wx/ImageDecoderWx.cpp',
-            'platform/image-decoders/xbm/XBMImageDecoder.cpp',
-            'platform/image-decoders/xbm/XBMImageDecoder.h',
             'platform/image-decoders/zlib/crc32.h',
             'platform/image-decoders/zlib/deflate.h',
             'platform/image-decoders/zlib/inffast.h',
@@ -2359,17 +2502,6 @@
             'platform/network/cf/AuthenticationCF.h',
             'platform/network/cf/AuthenticationChallenge.h',
             'platform/network/cf/DNSCFNet.cpp',
-            'platform/network/cf/FormDataStreamCFNet.cpp',
-            'platform/network/cf/FormDataStreamCFNet.h',
-            'platform/network/cf/ResourceError.h',
-            'platform/network/cf/ResourceErrorCF.cpp',
-            'platform/network/cf/ResourceHandleCFNet.cpp',
-            'platform/network/cf/ResourceRequest.h',
-            'platform/network/cf/ResourceRequestCFNet.cpp',
-            'platform/network/cf/ResourceRequestCFNet.h',
-            'platform/network/cf/ResourceResponse.h',
-            'platform/network/cf/ResourceResponseCFNet.cpp',
-            'platform/network/cf/ResourceResponseCFNet.h',
             'platform/network/cf/SocketStreamError.h',
             'platform/network/cf/SocketStreamHandle.h',
             'platform/network/cf/SocketStreamHandleCFNet.cpp',
@@ -2441,6 +2573,7 @@
             'platform/network/win/ResourceHandleWin.h',
             'platform/network/AuthenticationChallengeBase.cpp',
             'platform/network/AuthenticationChallengeBase.h',
+            'platform/network/AuthenticationClient.h',
             'platform/network/Credential.cpp',
             'platform/network/Credential.h',
             'platform/network/DNS.h',
@@ -2575,7 +2708,7 @@
             'platform/text/StringImpl.cpp',
             'platform/text/StringImpl.h',
             'platform/text/TextBoundaries.h',
-            'platform/text/TextBoundariesICU.cpp',
+            'platform/text/TextBoundaries.cpp',
             'platform/text/TextBreakIterator.h',
             'platform/text/TextBreakIteratorICU.cpp',
             'platform/text/TextBreakIteratorInternalICU.h',
@@ -2755,6 +2888,8 @@
             'platform/ScrollbarThemeComposite.cpp',
             'platform/ScrollbarThemeComposite.h',
             'platform/SearchPopupMenu.h',
+            'platform/SecureTextInput.cpp',
+            'platform/SecureTextInput.h',
             'platform/SharedBuffer.cpp',
             'platform/SharedBuffer.h',
             'platform/SharedTimer.h',
@@ -2775,6 +2910,7 @@
             'platform/Widget.cpp',
             'platform/Widget.h',
             'plugins/chromium/PluginDataChromium.cpp',
+            'plugins/chromium/PluginDataChromium.h',
             'plugins/gtk/PluginDataGtk.cpp',
             'plugins/gtk/PluginPackageGtk.cpp',
             'plugins/gtk/PluginViewGtk.cpp',
@@ -2820,6 +2956,7 @@
             'plugins/PluginStream.h',
             'plugins/PluginView.cpp',
             'plugins/PluginView.h',
+            'plugins/PluginViewNone.cpp',
             'plugins/npapi.cpp',
             'plugins/npfunctions.h',
             'rendering/style/BindingURI.cpp',
@@ -2882,6 +3019,8 @@
             'rendering/style/StyleVisualData.h',
             'rendering/AutoTableLayout.cpp',
             'rendering/AutoTableLayout.h',
+            'rendering/BidiRun.cpp',
+            'rendering/BidiRun.h',
             'rendering/CounterNode.cpp',
             'rendering/CounterNode.h',
             'rendering/EllipsisBox.cpp',
@@ -2896,7 +3035,7 @@
             'rendering/InlineBox.h',
             'rendering/InlineFlowBox.cpp',
             'rendering/InlineFlowBox.h',
-            'rendering/InlineRunBox.h',
+            'rendering/InlineIterator.h',
             'rendering/InlineTextBox.cpp',
             'rendering/InlineTextBox.h',
             'rendering/LayoutState.cpp',
@@ -2924,6 +3063,8 @@
             'rendering/RenderCounter.h',
             'rendering/RenderDataGrid.cpp',
             'rendering/RenderDataGrid.h',
+            'rendering/RenderEmbeddedObject.cpp',
+            'rendering/RenderEmbeddedObject.h',
             'rendering/RenderFieldset.cpp',
             'rendering/RenderFieldset.h',
             'rendering/RenderFileUploadControl.cpp',
@@ -2976,10 +3117,20 @@
             'rendering/RenderPartObject.h',
             'rendering/RenderPath.cpp',
             'rendering/RenderPath.h',
+            'rendering/RenderProgress.cpp',
+            'rendering/RenderProgress.h',
             'rendering/RenderReplaced.cpp',
             'rendering/RenderReplaced.h',
             'rendering/RenderReplica.cpp',
             'rendering/RenderReplica.h',
+            'rendering/RenderRuby.cpp',
+            'rendering/RenderRuby.h',
+            'rendering/RenderRubyBase.cpp',
+            'rendering/RenderRubyBase.h',
+            'rendering/RenderRubyRun.cpp',
+            'rendering/RenderRubyRun.h',
+            'rendering/RenderRubyText.cpp',
+            'rendering/RenderRubyText.h',
             'rendering/RenderSVGBlock.cpp',
             'rendering/RenderSVGBlock.h',
             'rendering/RenderSVGContainer.cpp',
@@ -2996,8 +3147,15 @@
             'rendering/RenderSVGInlineText.h',
             'rendering/RenderSVGModelObject.cpp',
             'rendering/RenderSVGModelObject.h',
+            'rendering/RenderSVGResource.h',
+            'rendering/RenderSVGResourceClipper.cpp',
+            'rendering/RenderSVGResourceClipper.h',
+            'rendering/RenderSVGResourceMasker.cpp',
+            'rendering/RenderSVGResourceMasker.h',
             'rendering/RenderSVGRoot.cpp',
             'rendering/RenderSVGRoot.h',
+            'rendering/RenderSVGShadowTreeRootContainer.cpp',
+            'rendering/RenderSVGShadowTreeRootContainer.h',
             'rendering/RenderSVGTSpan.cpp',
             'rendering/RenderSVGTSpan.h',
             'rendering/RenderSVGText.cpp',
@@ -3073,12 +3231,17 @@
             'rendering/SVGInlineFlowBox.h',
             'rendering/SVGInlineTextBox.cpp',
             'rendering/SVGInlineTextBox.h',
+            'rendering/SVGMarkerData.h',
+            'rendering/SVGMarkerLayoutInfo.cpp',
+            'rendering/SVGMarkerLayoutInfo.h',
             'rendering/SVGRenderSupport.cpp',
             'rendering/SVGRenderSupport.h',
             'rendering/SVGRenderTreeAsText.cpp',
             'rendering/SVGRenderTreeAsText.h',
             'rendering/SVGRootInlineBox.cpp',
             'rendering/SVGRootInlineBox.h',
+            'rendering/SVGShadowTreeElements.cpp',
+            'rendering/SVGShadowTreeElements.h',
             'rendering/TableLayout.h',
             'rendering/TextControlInnerElements.cpp',
             'rendering/TextControlInnerElements.h',
@@ -3088,10 +3251,17 @@
             'rendering/break_lines.h',
             'storage/ChangeVersionWrapper.cpp',
             'storage/ChangeVersionWrapper.h',
+            'storage/chromium/DatabaseObserver.h',
+            'storage/chromium/IndexedDatabase.cpp',
+            'storage/chromium/DatabaseTrackerChromium.cpp',
+            'storage/chromium/QuotaTracker.cpp',
+            'storage/chromium/QuotaTracker.h',
+            'storage/chromium/SQLTransactionClientChromium.cpp',
             'storage/Database.cpp',
             'storage/Database.h',
             'storage/DatabaseAuthorizer.cpp',
             'storage/DatabaseAuthorizer.h',
+            'storage/DatabaseCallback.h',
             'storage/DatabaseDetails.h',
             'storage/DatabaseTask.cpp',
             'storage/DatabaseTask.h',
@@ -3100,6 +3270,17 @@
             'storage/DatabaseTracker.cpp',
             'storage/DatabaseTracker.h',
             'storage/DatabaseTrackerClient.h',
+            'storage/IDBDatabaseError.h',
+            'storage/IDBDatabaseException.h',
+            'storage/IDBDatabaseRequest.h',
+            'storage/IDBRequest.cpp',
+            'storage/IDBRequest.h',
+            'storage/IndexedDatabase.cpp',
+            'storage/IndexedDatabase.h',
+            'storage/IndexedDatabaseImpl.cpp',
+            'storage/IndexedDatabaseImpl.h',
+            'storage/IndexedDatabaseRequest.cpp',
+            'storage/IndexedDatabaseRequest.h',
             'storage/LocalStorageTask.cpp',
             'storage/LocalStorageTask.h',
             'storage/LocalStorageThread.cpp',
@@ -3173,8 +3354,10 @@
             'svg/graphics/filters/SVGFETile.h',
             'svg/graphics/filters/SVGFETurbulence.cpp',
             'svg/graphics/filters/SVGFETurbulence.h',
-            'svg/graphics/filters/SVGFilterEffect.cpp',
-            'svg/graphics/filters/SVGFilterEffect.h',
+            'svg/graphics/filters/SVGFilter.cpp',
+            'svg/graphics/filters/SVGFilter.h',
+            'svg/graphics/filters/SVGFilterBuilder.cpp',
+            'svg/graphics/filters/SVGFilterBuilder.h',
             'svg/graphics/filters/SVGLightSource.cpp',
             'svg/graphics/filters/SVGLightSource.h',
             'svg/graphics/filters/SVGPointLightSource.h',
@@ -3195,24 +3378,14 @@
             'svg/graphics/SVGPaintServerSolid.h',
             'svg/graphics/SVGResource.cpp',
             'svg/graphics/SVGResource.h',
-            'svg/graphics/SVGResourceClipper.cpp',
-            'svg/graphics/SVGResourceClipper.h',
             'svg/graphics/SVGResourceFilter.cpp',
             'svg/graphics/SVGResourceFilter.h',
             'svg/graphics/SVGResourceListener.h',
             'svg/graphics/SVGResourceMarker.cpp',
             'svg/graphics/SVGResourceMarker.h',
-            'svg/graphics/SVGResourceMasker.cpp',
-            'svg/graphics/SVGResourceMasker.h',
             'svg/ColorDistance.cpp',
             'svg/ColorDistance.h',
             'svg/ElementTimeControl.h',
-            'svg/Filter.cpp',
-            'svg/Filter.h',
-            'svg/FilterBuilder.h',
-            'svg/FilterBuilder.cpp',
-            'svg/FilterEffect.cpp',
-            'svg/FilterEffect.h',
             'svg/GradientAttributes.h',
             'svg/LinearGradientAttributes.h',
             'svg/PatternAttributes.h',
@@ -3237,6 +3410,8 @@
             'svg/SVGAnimatedPoints.cpp',
             'svg/SVGAnimatedPoints.h',
             'svg/SVGAnimatedProperty.h',
+            'svg/SVGAnimatedPropertySynchronizer.h',
+            'svg/SVGAnimatedPropertyTraits.h',
             'svg/SVGAnimatedTemplate.h',
             'svg/SVGAnimationElement.cpp',
             'svg/SVGAnimationElement.h',
@@ -3264,6 +3439,7 @@
             'svg/SVGElementInstance.h',
             'svg/SVGElementInstanceList.cpp',
             'svg/SVGElementInstanceList.h',
+            'svg/SVGElementRareData.h',
             'svg/SVGEllipseElement.cpp',
             'svg/SVGEllipseElement.h',
             'svg/SVGException.h',
@@ -3486,9 +3662,9 @@
             'svg/SVGZoomAndPan.h',
             'svg/SVGZoomEvent.cpp',
             'svg/SVGZoomEvent.h',
-            'svg/SynchronizablePropertyController.cpp',
-            'svg/SynchronizablePropertyController.h',
-            'svg/SynchronizableTypeWrapper.h',
+            'websockets/ThreadableWebSocketChannel.cpp',
+            'websockets/ThreadableWebSocketChannel.h',
+            'websockets/ThreadableWebSocketChannelClientWrapper.h',
             'websockets/WebSocket.cpp',
             'websockets/WebSocket.h',
             'websockets/WebSocketChannel.cpp',
@@ -3496,6 +3672,10 @@
             'websockets/WebSocketChannelClient.h',
             'websockets/WebSocketHandshake.cpp',
             'websockets/WebSocketHandshake.h',
+            'websockets/WebSocketHandshakeRequest.cpp',
+            'websockets/WebSocketHandshakeRequest.h',
+            'websockets/WorkerThreadableWebSocketChannel.cpp',
+            'websockets/WorkerThreadableWebSocketChannel.h',
             'workers/AbstractWorker.cpp',
             'workers/AbstractWorker.h',
             'workers/DedicatedWorkerContext.cpp',
@@ -3537,6 +3717,8 @@
             'xml/XMLHttpRequest.h',
             'xml/XMLHttpRequestException.h',
             'xml/XMLHttpRequestProgressEvent.h',
+            'xml/XMLHttpRequestProgressEventThrottle.cpp',
+            'xml/XMLHttpRequestProgressEventThrottle.h',
             'xml/XMLHttpRequestUpload.cpp',
             'xml/XMLHttpRequestUpload.h',
             'xml/XMLSerializer.cpp',
@@ -3588,14 +3770,22 @@
 
             'inspector/front-end/inspector.html',
             'inspector/front-end/AbstractTimelinePanel.js',
+            'inspector/front-end/AuditCategories.js',
+            'inspector/front-end/AuditLauncherView.js',
+            'inspector/front-end/AuditResultView.js',
+            'inspector/front-end/AuditRules.js',
+            'inspector/front-end/AuditsPanel.js',
             'inspector/front-end/BottomUpProfileDataGridTree.js',
             'inspector/front-end/Breakpoint.js',
             'inspector/front-end/BreakpointsSidebarPane.js',
             'inspector/front-end/Callback.js',
             'inspector/front-end/CallStackSidebarPane.js',
             'inspector/front-end/ChangesView.js',
+            'inspector/front-end/Checkbox.js',
             'inspector/front-end/Color.js',
+            'inspector/front-end/ConsolePanel.js',
             'inspector/front-end/ConsoleView.js',
+            'inspector/front-end/ContextMenu.js',
             'inspector/front-end/CookieItemsView.js',
             'inspector/front-end/Database.js',
             'inspector/front-end/DatabaseQueryView.js',
@@ -3603,15 +3793,17 @@
             'inspector/front-end/DataGrid.js',
             'inspector/front-end/DOMAgent.js',
             'inspector/front-end/DOMStorage.js',
-            'inspector/front-end/DOMStorageDataGrid.js',
             'inspector/front-end/DOMStorageItemsView.js',
+            'inspector/front-end/DOMSyntaxHighlighter.js',
             'inspector/front-end/Drawer.js',
             'inspector/front-end/ElementsPanel.js',
             'inspector/front-end/ElementsTreeOutline.js',
             'inspector/front-end/EventListenersSidebarPane.js',
             'inspector/front-end/FontView.js',
             'inspector/front-end/ImageView.js',
-            'inspector/front-end/InspectorControllerStub.js',
+            'inspector/front-end/InspectorBackendStub.js',
+            'inspector/front-end/InspectorFrontendHostStub.js',
+            'inspector/front-end/InjectedFakeWorker.js',
             'inspector/front-end/InjectedScript.js',
             'inspector/front-end/InjectedScriptAccess.js',
             'inspector/front-end/inspector.js',
@@ -3623,7 +3815,7 @@
             'inspector/front-end/Panel.js',
             'inspector/front-end/PanelEnablerView.js',
             'inspector/front-end/Placard.js',
-            'inspector/front-end/Popup.js',
+            'inspector/front-end/Popover.js',
             'inspector/front-end/ProfileDataGridTree.js',
             'inspector/front-end/ProfilesPanel.js',
             'inspector/front-end/ProfileView.js',
@@ -3637,33 +3829,56 @@
             'inspector/front-end/Script.js',
             'inspector/front-end/ScriptsPanel.js',
             'inspector/front-end/ScriptView.js',
+            'inspector/front-end/Section.js',
+            'inspector/front-end/Settings.js',
             'inspector/front-end/SidebarPane.js',
             'inspector/front-end/SidebarTreeElement.js',
+            'inspector/front-end/SourceCSSTokenizer.js',
             'inspector/front-end/SourceFrame.js',
+            'inspector/front-end/SourceHTMLTokenizer.js',
+            'inspector/front-end/SourceJavaScriptTokenizer.js',
+            'inspector/front-end/SourceTokenizer.js',
             'inspector/front-end/SourceView.js',
             'inspector/front-end/StatusBarButton.js',
             'inspector/front-end/StoragePanel.js',
             'inspector/front-end/StylesSidebarPane.js',
             'inspector/front-end/SummaryBar.js',
             'inspector/front-end/TestController.js',
+            'inspector/front-end/TextEditorHighlighter.js',
+            'inspector/front-end/TextEditorModel.js',
             'inspector/front-end/TextPrompt.js',
+            'inspector/front-end/TextViewer.js',
             'inspector/front-end/TimelineAgent.js',
+            'inspector/front-end/TimelineOverviewPane.js',
+            'inspector/front-end/TimelineGrid.js',
             'inspector/front-end/TimelinePanel.js',
             'inspector/front-end/TopDownProfileDataGridTree.js',
             'inspector/front-end/treeoutline.js',
             'inspector/front-end/utilities.js',
             'inspector/front-end/View.js',
             'inspector/front-end/WatchExpressionsSidebarPane.js',
+            'inspector/front-end/WelcomeView.js',
+            'inspector/front-end/WorkersSidebarPane.js',
+            'inspector/front-end/audits.css',
             'inspector/front-end/inspector.css',
             'inspector/front-end/inspectorSyntaxHighlight.css',
+            'inspector/front-end/popover.css',
+            'inspector/front-end/textViewer.css',
         ],
         'webinspector_image_files': [
-
+            'inspector/front-end/Images/auditsIcon.png',
             'inspector/front-end/Images/back.png',
+            'inspector/front-end/Images/breakpointBorder.png',
+            'inspector/front-end/Images/breakpointConditionalBorder.png',
+            'inspector/front-end/Images/breakpointConditionalCounterBorder.png',
+            'inspector/front-end/Images/breakpointCounterBorder.png',
+            'inspector/front-end/Images/breakpointsActivateButtonGlyph.png',
+            'inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png',
             'inspector/front-end/Images/checker.png',
             'inspector/front-end/Images/clearConsoleButtonGlyph.png',
             'inspector/front-end/Images/closeButtons.png',
             'inspector/front-end/Images/consoleButtonGlyph.png',
+            'inspector/front-end/Images/consoleIcon.png',
             'inspector/front-end/Images/cookie.png',
             'inspector/front-end/Images/database.png',
             'inspector/front-end/Images/databaseTable.png',
@@ -3687,9 +3902,11 @@
             'inspector/front-end/Images/enableSolidButtonGlyph.png',
             'inspector/front-end/Images/errorIcon.png',
             'inspector/front-end/Images/errorMediumIcon.png',
+            'inspector/front-end/Images/errorRedDot.png',
             'inspector/front-end/Images/excludeButtonGlyph.png',
             'inspector/front-end/Images/focusButtonGlyph.png',
             'inspector/front-end/Images/forward.png',
+            'inspector/front-end/Images/gearButtonGlyph.png',
             'inspector/front-end/Images/glossyHeader.png',
             'inspector/front-end/Images/glossyHeaderPressed.png',
             'inspector/front-end/Images/glossyHeaderSelected.png',
@@ -3707,11 +3924,14 @@
             'inspector/front-end/Images/paneSettingsButtons.png',
             'inspector/front-end/Images/pauseOnExceptionButtonGlyph.png',
             'inspector/front-end/Images/percentButtonGlyph.png',
+            'inspector/front-end/Images/popoverArrows.png',
+            'inspector/front-end/Images/popoverBackground.png',
             'inspector/front-end/Images/profileGroupIcon.png',
             'inspector/front-end/Images/profileIcon.png',
             'inspector/front-end/Images/profilesIcon.png',
             'inspector/front-end/Images/profileSmallIcon.png',
             'inspector/front-end/Images/profilesSilhouette.png',
+            'inspector/front-end/Images/programCounterBorder.png',
             'inspector/front-end/Images/radioDot.png',
             'inspector/front-end/Images/recordButtonGlyph.png',
             'inspector/front-end/Images/recordToggledButtonGlyph.png',
@@ -3739,6 +3959,7 @@
             'inspector/front-end/Images/segmentSelected.png',
             'inspector/front-end/Images/segmentSelectedEnd.png',
             'inspector/front-end/Images/sessionStorage.png',
+            'inspector/front-end/Images/spinner.gif',
             'inspector/front-end/Images/splitviewDimple.png',
             'inspector/front-end/Images/splitviewDividerBackground.png',
             'inspector/front-end/Images/statusbarBackground.png',
@@ -3749,6 +3970,13 @@
             'inspector/front-end/Images/statusbarResizerHorizontal.png',
             'inspector/front-end/Images/statusbarResizerVertical.png',
             'inspector/front-end/Images/storageIcon.png',
+            'inspector/front-end/Images/successGreenDot.png',
+            'inspector/front-end/Images/thumbActiveHoriz.png',
+            'inspector/front-end/Images/thumbActiveVert.png',
+            'inspector/front-end/Images/thumbHoriz.png',
+            'inspector/front-end/Images/thumbVert.png',
+            'inspector/front-end/Images/thumbHoverHoriz.png',
+            'inspector/front-end/Images/thumbHoverVert.png',
             'inspector/front-end/Images/timelineHollowPillBlue.png',
             'inspector/front-end/Images/timelineHollowPillGray.png',
             'inspector/front-end/Images/timelineHollowPillGreen.png',
@@ -3773,11 +4001,9 @@
             'inspector/front-end/Images/timelinePillPurple.png',
             'inspector/front-end/Images/timelinePillRed.png',
             'inspector/front-end/Images/timelinePillYellow.png',
-            'inspector/front-end/Images/tipBalloon.png',
-            'inspector/front-end/Images/tipBalloonBottom.png',
-            'inspector/front-end/Images/tipIcon.png',
-            'inspector/front-end/Images/tipIconPressed.png',
             'inspector/front-end/Images/toolbarItemSelected.png',
+            'inspector/front-end/Images/trackHoriz.png',
+            'inspector/front-end/Images/trackVert.png',
             'inspector/front-end/Images/treeDownTriangleBlack.png',
             'inspector/front-end/Images/treeDownTriangleWhite.png',
             'inspector/front-end/Images/treeRightTriangleBlack.png',
@@ -3789,6 +4015,7 @@
             'inspector/front-end/Images/userInputPreviousIcon.png',
             'inspector/front-end/Images/userInputResultIcon.png',
             'inspector/front-end/Images/warningIcon.png',
+            'inspector/front-end/Images/warningOrangeDot.png',
             'inspector/front-end/Images/warningMediumIcon.png',
             'inspector/front-end/Images/warningsErrors.png',
             'inspector/front-end/Images/whiteConnectorPoint.png'
diff --git a/src/3rdparty/webkit/WebCore/WebCore.order b/src/3rdparty/webkit/WebCore/WebCore.order
index c1040e23c6..48f321bb7a 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.order
+++ b/src/3rdparty/webkit/WebCore/WebCore.order
@@ -215,11 +215,6 @@ __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableEP
-__ZN7WebCore21JavaScriptDebugServer6sharedEv
-__ZN7WebCore21JavaScriptDebugServerC1Ev
-__ZN7WebCore21JavaScriptDebugServerC2Ev
-__ZN7WebCore21JavaScriptDebugServer11pageCreatedEPNS_4PageE
-__ZN7WebCore21JavaScriptDebugServer28hasListenersInterestedInPageEPNS_4PageE
 __ZNK3WTF9HashTableIPN7WebCore4PageESt4pairIS3_PNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS7_EENS_10HashTraitsIS7_
 __ZN7WebCore8Settings27setLocalStorageDatabasePathERKNS_6StringE
 __ZN7WebCore5FrameC1EPNS_4PageEPNS_21HTMLFrameOwnerElementEPNS_17FrameLoaderClientE
@@ -19747,8 +19742,6 @@ __ZN7WebCore15JSMimeTypeArray11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierER
 __ZN7WebCore13MimeTypeArray4itemEj
 __ZN7WebCore14jsMimeTypeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore8MimeType4typeEv
-__ZNK7WebCore16JSDOMWindowShell21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
-__ZNK7WebCore11JSDOMWindow21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
 __ZNK7WebCore9RenderBox20firstLineBoxBaselineEv
 __ZN7WebCore10ClientRectC1Ev
 __ZN7WebCore10ClientRectC2Ev
@@ -19815,7 +19808,6 @@ __ZN3WTF6VectorIN3JSC16ProtectedJSValueELm0EE15reserveCapacityEm
 __ZN3WTF6VectorIN3JSC16ProtectedJSValueELm0EE6shrinkEm
 __ZN7WebCore13HTMLTokenizer9parseTextERNS_15SegmentedStringENS0_5StateE
 __ZN7WebCore19InspectorController14enableProfilerEb
-__ZN7WebCore21JavaScriptDebugServer27recompileAllJSFunctionsSoonEv
 __ZN7WebCore33jsConsolePrototypeFunctionProfileEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore7Console7profileERKN3JSC7UStringEPNS_15ScriptCallStackE
 __ZN7WebCore36jsConsolePrototypeFunctionProfileEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
@@ -19851,8 +19843,6 @@ __ZN7WebCoreL6getURLEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
 __ZN7WebCoreL13getLineNumberEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
 __ZN7WebCoreL11getChildrenEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
 __ZNK3WTF7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS7_IS4_EEE3getERKx
-__ZN7WebCore5TimerINS_21JavaScriptDebugServerEE5firedEv
-__ZN7WebCore21JavaScriptDebugServer23recompileAllJSFunctionsEPNS_5TimerIS0_EE
 __ZNK3JSC21CollectorHeapIteratorILNS_8HeapTypeE0EEdeEv
 __ZN3JSC21CollectorHeapIteratorILNS_8HeapTypeE0EEppEv
 __ZN3WTF6VectorIN3JSC12ProtectedPtrINS1_10JSFunctionEEELm0EE14expandCapacityEm
@@ -23799,7 +23789,6 @@ __ZN7WebCore18ScriptFunctionCall14appendArgumentEb
 __ZN7WebCore18ScriptFunctionCall4callEv
 __ZN7WebCore18ScriptFunctionCall4callERbb
 __ZN7WebCore44jsInspectorControllerPrototypeFunctionAttachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
-__ZN7WebCore19InspectorController12attachWindowEv
 __ZN7WebCore19InspectorController21populateScriptObjectsEv
 __ZN7WebCoreL18callSimpleFunctionEPN3JSC9ExecStateERKNS_12ScriptObjectEPKc
 __ZN7WebCore19InspectorController9showPanelENS0_13SpecialPanelsE
@@ -23860,7 +23849,6 @@ __ZN7WebCoreL19drawHighlightForBoxERNS_15GraphicsContextERKNS_9FloatQuadES4_S4_S
 __ZN7WebCoreL16drawOutlinedQuadERNS_15GraphicsContextERKNS_9FloatQuadERKNS_5ColorE
 __ZN7WebCoreL10quadToPathERKNS_9FloatQuadE
 __ZN7WebCore44jsInspectorControllerPrototypeFunctionDetachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
-__ZN7WebCore19InspectorController12detachWindowEv
 __ZN7WebCore56jsInspectorControllerPrototypeFunctionMoveByUnrestrictedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
 __ZNK7WebCore19InspectorController12moveWindowByEff
 __ZN7WebCoreL24drawOutlinedQuadWithClipERNS_15GraphicsContextERKNS_9FloatQuadES4_RKNS_5ColorE
@@ -23876,19 +23864,15 @@ __ZN7WebCore13TextTokenizerC2EPNS_22HTMLViewSourceDocumentE
 __ZN7WebCore22HTMLViewSourceDocument17addViewSourceTextERKNS_6StringE
 __ZN7WebCore52jsInspectorControllerPrototypeFunctionEnableDebuggerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore19InspectorController14enableDebuggerEv
-__ZN7WebCore21JavaScriptDebugServer11addListenerEPNS_23JavaScriptDebugListenerEPNS_4PageE
 __ZN3WTF7HashMapIPN7WebCore4PageEPNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_EE
 __ZN3WTF7HashSetIPN7WebCore23JavaScriptDebugListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
 __ZN3WTF9HashTableIPN7WebCore23JavaScriptDebugListenerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_
-__ZN7WebCore21JavaScriptDebugServer14didAddListenerEPNS_4PageE
 __ZN7WebCore4Page11setDebuggerEPN3JSC8DebuggerE
-__ZN7WebCore21JavaScriptDebugServer16clearBreakpointsEv
 __ZN3WTF20deleteAllPairSecondsIPNS_7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEEEKNS_7HashMapIlS7_NS2_ImEENS4_IlEENS4_IS7_EEEEE
 __ZNK7WebCore25JSCanvasGradientPrototype9classInfoEv
 __ZNK7WebCore30JSInspectorControllerPrototype9classInfoEv
 __ZN3WTF7HashMapIPN3JSC14SourceProviderEPNS1_9ExecStateENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3_RKS5_
 __ZN3WTF9HashTableIPN3JSC14SourceProviderESt4pairIS3_PNS1_9ExecStateEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHa
-__ZN7WebCore21JavaScriptDebugServer12sourceParsedEPN3JSC9ExecStateERKNS1_10SourceCodeEiRKNS1_7UStringE
 __ZN7WebCoreL6toPageEPN3JSC14JSGlobalObjectE
 __ZNK3WTF7HashMapIPN7WebCore4PageEPNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_E
 __ZN7WebCoreL22dispatchDidParseSourceERKN3WTF7HashSetIPNS_23JavaScriptDebugListenerENS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEEP
@@ -23902,32 +23886,20 @@ __ZN7WebCore21JSInspectorController16addSourceToFrameEPN3JSC9ExecStateERKNS1_7Ar
 __ZN7WebCore32jsConsolePrototypeFunctionAssertEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore7Console15assertConditionEbPNS_15ScriptCallStackE
 __ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE6shrinkEm
-__ZN7WebCore21JavaScriptDebugServer9callEventERKN3JSC17DebuggerCallFrameEli
 __ZN7WebCore19JavaScriptCallFrameC1ERKN3JSC17DebuggerCallFrameEN3WTF10PassRefPtrIS0_EEli
 __ZN7WebCore19JavaScriptCallFrameC2ERKN3JSC17DebuggerCallFrameEN3WTF10PassRefPtrIS0_EEli
-__ZN7WebCore21JavaScriptDebugServer13pauseIfNeededEPNS_4PageE
-__ZNK7WebCore21JavaScriptDebugServer13hasBreakpointElj
 __ZNK3WTF7HashMapIlPNS_7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEEENS2_ImEENS4_IlEENS4_IS7_EEE3getERKl
-__ZN7WebCore21JavaScriptDebugServer11atStatementERKN3JSC17DebuggerCallFrameEli
-__ZN7WebCore21JavaScriptDebugServer11returnEventERKN3JSC17DebuggerCallFrameEli
 __ZN7WebCore19JavaScriptCallFrame6callerEv
 __ZN3WTF10RefCountedIN7WebCore19JavaScriptCallFrameEE5derefEv
-__ZN7WebCore21JavaScriptDebugServer18willExecuteProgramERKN3JSC17DebuggerCallFrameEli
-__ZN7WebCore21JavaScriptDebugServer17didExecuteProgramERKN3JSC17DebuggerCallFrameEli
 __ZN7WebCore46jsInspectorControllerPrototypeFunctionProfilesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore21JSInspectorController8profilesEPN3JSC9ExecStateERKNS1_7ArgListE
 __ZN7WebCore52jsInspectorControllerPrototypeFunctionEnableProfilerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore32JSHTMLOptionsCollectionPrototype9classInfoEv
-__ZN7WebCore21JavaScriptDebugServer15continueProgramEv
-__ZN7WebCore21JavaScriptDebugServer9exceptionERKN3JSC17DebuggerCallFrameEli
 __ZN7WebCore52jsInspectorControllerPrototypeFunctionStartProfilingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore51jsInspectorControllerPrototypeFunctionStopProfilingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore19InspectorController26stopUserInitiatedProfilingEv
 __ZN7WebCore19InspectorController15disableDebuggerEv
-__ZN7WebCore21JavaScriptDebugServer14removeListenerEPNS_23JavaScriptDebugListenerEPNS_4PageE
 __ZN3WTF9HashTableIPN7WebCore4PageESt4pairIS3_PNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS7_EENS_10HashTraitsIS7_E
-__ZN7WebCore21JavaScriptDebugServer17didRemoveListenerEPNS_4PageE
-__ZN7WebCore21JavaScriptDebugServer21didRemoveLastListenerEv
 __ZN7WebCore5Frame17setIsDisconnectedEb
 __ZN7WebCore19InspectorController11closeWindowEv
 __ZN7WebCoreL19getUniqueIdCallbackEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pri b/src/3rdparty/webkit/WebCore/WebCore.pri
new file mode 100644
index 0000000000..be1d56bf18
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/WebCore.pri
@@ -0,0 +1,722 @@
+CONFIG(standalone_package) {
+    isEmpty(WC_GENERATED_SOURCES_DIR):WC_GENERATED_SOURCES_DIR = $$PWD/generated
+} else {
+    isEmpty(WC_GENERATED_SOURCES_DIR):WC_GENERATED_SOURCES_DIR = generated
+}
+
+## Define default features macros for optional components
+## (look for defs in config.h and included files!)
+# Try to locate sqlite3 source
+CONFIG(QTDIR_build) {
+    SQLITE3SRCDIR = $$QT_SOURCE_TREE/src/3rdparty/sqlite/
+} else {
+    SQLITE3SRCDIR = $$(SQLITE3SRCDIR)
+    isEmpty(SQLITE3SRCDIR) {
+        SQLITE3SRCDIR = $$[QT_INSTALL_PREFIX]/src/3rdparty/sqlite/
+    }
+}
+
+contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
+    DEFINES+=ENABLE_DATABASE=0 ENABLE_DOM_STORAGE=0 ENABLE_ICONDATABASE=0 ENABLE_WORKERS=0 ENABLE_SHARED_WORKERS=0
+}
+
+# turn off SQLITE support if we do not have sqlite3 available
+!CONFIG(QTDIR_build):win32-*:!exists( $${SQLITE3SRCDIR}/sqlite3.c ): DEFINES += ENABLE_SQLITE=0 ENABLE_DATABASE=0 ENABLE_WORKERS=0 ENABLE_SHARED_WORKERS=0 ENABLE_ICONDATABASE=0 ENABLE_OFFLINE_WEB_APPLICATIONS=0 ENABLE_DOM_STORAGE=0
+
+!contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=.): DEFINES += ENABLE_JAVASCRIPT_DEBUGGER=1
+!contains(DEFINES, ENABLE_DATABASE=.): DEFINES += ENABLE_DATABASE=1
+!contains(DEFINES, ENABLE_EVENTSOURCE=.): DEFINES += ENABLE_EVENTSOURCE=1
+!contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=.): DEFINES += ENABLE_OFFLINE_WEB_APPLICATIONS=1
+!contains(DEFINES, ENABLE_DOM_STORAGE=.): DEFINES += ENABLE_DOM_STORAGE=1
+!contains(DEFINES, ENABLE_ICONDATABASE=.): DEFINES += ENABLE_ICONDATABASE=1
+!contains(DEFINES, ENABLE_CHANNEL_MESSAGING=.): DEFINES += ENABLE_CHANNEL_MESSAGING=1
+!contains(DEFINES, ENABLE_ORIENTATION_EVENTS=.): DEFINES += ENABLE_ORIENTATION_EVENTS=0
+
+# turn on SQLITE support if any of the dependent features are turned on
+!contains(DEFINES, ENABLE_SQLITE=.) {
+  contains(DEFINES, ENABLE_DATABASE=1)|contains(DEFINES, ENABLE_ICONDATABASE=1)|contains(DEFINES, ENABLE_DOM_STORAGE=1)|contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
+    DEFINES += ENABLE_SQLITE=1
+  } else {
+    DEFINES += ENABLE_SQLITE=0
+  }
+}
+
+!contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=.): DEFINES += ENABLE_DASHBOARD_SUPPORT=0
+!contains(DEFINES, ENABLE_FILTERS=.): DEFINES += ENABLE_FILTERS=1
+!contains(DEFINES, ENABLE_XPATH=.): DEFINES += ENABLE_XPATH=1
+#!contains(DEFINES, ENABLE_XBL=.): DEFINES += ENABLE_XBL=1
+!contains(DEFINES, ENABLE_WCSS=.): DEFINES += ENABLE_WCSS=0
+!contains(DEFINES, ENABLE_WML=.): DEFINES += ENABLE_WML=0
+!contains(DEFINES, ENABLE_SHARED_WORKERS=.): DEFINES += ENABLE_SHARED_WORKERS=1
+!contains(DEFINES, ENABLE_WORKERS=.): DEFINES += ENABLE_WORKERS=1
+!contains(DEFINES, ENABLE_XHTMLMP=.): DEFINES += ENABLE_XHTMLMP=0
+!contains(DEFINES, ENABLE_DATAGRID=.): DEFINES += ENABLE_DATAGRID=0
+!contains(DEFINES, ENABLE_VIDEO=.): DEFINES += ENABLE_VIDEO=1
+!contains(DEFINES, ENABLE_RUBY=.): DEFINES += ENABLE_RUBY=1
+!contains(DEFINES, ENABLE_SANDBOX=.): DEFINES += ENABLE_SANDBOX=1
+!contains(DEFINES, ENABLE_PROGRESS_TAG=.): DEFINES += ENABLE_PROGRESS_TAG=1
+!contains(DEFINES, ENABLE_BLOB_SLICE=.): DEFINES += ENABLE_BLOB_SLICE=0
+
+greaterThan(QT_MINOR_VERSION, 5) {
+    !contains(DEFINES, ENABLE_3D_RENDERING=.): DEFINES += ENABLE_3D_RENDERING=1
+}
+
+# SVG support
+!contains(DEFINES, ENABLE_SVG=0) {
+    !contains(DEFINES, ENABLE_SVG=.): DEFINES += ENABLE_SVG=1
+    !contains(DEFINES, ENABLE_SVG_FONTS=.): DEFINES += ENABLE_SVG_FONTS=1
+    !contains(DEFINES, ENABLE_SVG_FOREIGN_OBJECT=.): DEFINES += ENABLE_SVG_FOREIGN_OBJECT=1
+    !contains(DEFINES, ENABLE_SVG_ANIMATION=.): DEFINES += ENABLE_SVG_ANIMATION=1
+    !contains(DEFINES, ENABLE_SVG_AS_IMAGE=.): DEFINES += ENABLE_SVG_AS_IMAGE=1
+    !contains(DEFINES, ENABLE_SVG_USE=.): DEFINES += ENABLE_SVG_USE=1
+} else {
+    DEFINES += ENABLE_SVG_FONTS=0 ENABLE_SVG_FOREIGN_OBJECT=0 ENABLE_SVG_ANIMATION=0 ENABLE_SVG_AS_IMAGE=0 ENABLE_SVG_USE=0
+}
+
+# HTML5 media support
+!contains(DEFINES, ENABLE_VIDEO=.): DEFINES += ENABLE_VIDEO=1
+
+# HTML5 datalist support
+!contains(DEFINES, ENABLE_DATALIST=.): DEFINES += ENABLE_DATALIST=1
+
+# Tiled Backing Store support
+greaterThan(QT_MINOR_VERSION, 5) {
+    !contains(DEFINES, ENABLE_TILED_BACKING_STORE=.): DEFINES += ENABLE_TILED_BACKING_STORE=1
+}
+
+# Nescape plugins support (NPAPI)
+!contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=.) {
+    unix|win32-*:!embedded:!wince*: {
+        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=1
+    } else {
+        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=0
+    }
+}
+
+# Web Socket support.
+!contains(DEFINES, ENABLE_WEB_SOCKETS=.): DEFINES += ENABLE_WEB_SOCKETS=1
+
+# XSLT support with QtXmlPatterns
+!contains(DEFINES, ENABLE_XSLT=.) {
+    contains(QT_CONFIG, xmlpatterns):DEFINES += ENABLE_XSLT=1
+    else:DEFINES += ENABLE_XSLT=0
+}
+
+!CONFIG(QTDIR_build):!contains(DEFINES, ENABLE_QT_BEARER=.) {
+    symbian: {
+        exists($${EPOCROOT}epoc32/release/winscw/udeb/QtBearer.lib)| \
+        exists($${EPOCROOT}epoc32/release/armv5/lib/QtBearer.lib) {
+            DEFINES += ENABLE_QT_BEARER=1
+        }
+    }
+}
+
+# Bearer management is part of Qt 4.7
+!lessThan(QT_MINOR_VERSION, 7):!contains(DEFINES, ENABLE_QT_BEARER=.):DEFINES += ENABLE_QT_BEARER=1
+
+# Enable touch event support with Qt 4.6
+!lessThan(QT_MINOR_VERSION, 6): DEFINES += ENABLE_TOUCH_EVENTS=1
+
+# Used to compute defaults for the build-webkit script
+CONFIG(compute_defaults) {
+    message($$DEFINES)
+    error("Done computing defaults")
+}
+
+contains(DEFINES, ENABLE_WCSS=1) {
+    contains(DEFINES, ENABLE_XHTMLMP=0) {
+        DEFINES -= ENABLE_XHTMLMP=0
+        DEFINES += ENABLE_XHTMLMP=1
+    }
+}
+
+## Forward enabled feature macros to JavaScript enabled features macros
+FEATURE_DEFINES_JAVASCRIPT = LANGUAGE_JAVASCRIPT=1
+contains(DEFINES, ENABLE_CHANNEL_MESSAGING=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_CHANNEL_MESSAGING=1
+contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_ORIENTATION_EVENTS=1
+contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=0): DASHBOARDSUPPORTCSSPROPERTIES -= $$PWD/css/DashboardSupportCSSPropertyNames.in
+contains(DEFINES, ENABLE_DATAGRID=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATAGRID=1
+contains(DEFINES, ENABLE_EVENTSOURCE=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_EVENTSOURCE=1
+contains(DEFINES, ENABLE_DATABASE=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATABASE=1
+contains(DEFINES, ENABLE_DATALIST=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATALIST=1
+contains(DEFINES, ENABLE_DOM_STORAGE=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_DOM_STORAGE=1
+contains(DEFINES, ENABLE_SHARED_SCRIPT=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SHARED_SCRIPT=1
+contains(DEFINES, ENABLE_WORKERS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WORKERS=1
+contains(DEFINES, ENABLE_SHARED_WORKERS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SHARED_WORKERS=1
+contains(DEFINES, ENABLE_VIDEO=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_VIDEO=1
+contains(DEFINES, ENABLE_XPATH=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_XPATH=1
+contains(DEFINES, ENABLE_XSLT=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_XSLT=1
+contains(DEFINES, ENABLE_XBL=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_XBL=1
+contains(DEFINES, ENABLE_FILTERS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_FILTERS=1
+contains(DEFINES, ENABLE_WCSS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WCSS=1
+contains(DEFINES, ENABLE_WML=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WML=1
+contains(DEFINES, ENABLE_XHTMLMP=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_XHTMLMP=1
+contains(DEFINES, ENABLE_SVG=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG=1
+contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
+contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_OFFLINE_WEB_APPLICATIONS=1
+contains(DEFINES, ENABLE_WEB_SOCKETS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WEB_SOCKETS=1
+contains(DEFINES, ENABLE_TOUCH_EVENTS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_TOUCH_EVENTS=1
+contains(DEFINES, ENABLE_TILED_BACKING_STORE=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_TILED_BACKING_STORE=1
+
+
+## Derived source generators
+WML_NAMES = $$PWD/wml/WMLTagNames.in
+
+SVG_NAMES = $$PWD/svg/svgtags.in
+
+XLINK_NAMES = $$PWD/svg/xlinkattrs.in
+
+TOKENIZER = $$PWD/css/tokenizer.flex
+
+DOCTYPESTRINGS = $$PWD/html/DocTypeStrings.gperf
+
+CSSBISON = $$PWD/css/CSSGrammar.y
+
+HTML_NAMES = $$PWD/html/HTMLTagNames.in
+
+XML_NAMES = $$PWD/xml/xmlattrs.in
+
+XMLNS_NAMES = $$PWD/xml/xmlnsattrs.in
+
+ENTITIES_GPERF = $$PWD/html/HTMLEntityNames.gperf
+
+COLORDAT_GPERF = $$PWD/platform/ColorData.gperf
+
+WALDOCSSPROPS = $$PWD/css/CSSPropertyNames.in
+
+WALDOCSSVALUES = $$PWD/css/CSSValueKeywords.in
+
+DASHBOARDSUPPORTCSSPROPERTIES = $$PWD/css/DashboardSupportCSSPropertyNames.in
+
+XPATHBISON = $$PWD/xml/XPathGrammar.y
+
+contains(DEFINES, ENABLE_SVG=1) {
+    EXTRACSSPROPERTIES += $$PWD/css/SVGCSSPropertyNames.in
+    EXTRACSSVALUES += $$PWD/css/SVGCSSValueKeywords.in
+}
+
+contains(DEFINES, ENABLE_WCSS=1) {
+    EXTRACSSPROPERTIES += $$PWD/css/WCSSPropertyNames.in
+    EXTRACSSVALUES += $$PWD/css/WCSSValueKeywords.in
+}
+
+STYLESHEETS_EMBED = \
+    $$PWD/css/html.css \
+    $$PWD/css/quirks.css \
+    $$PWD/css/svg.css \
+    $$PWD/css/view-source.css \
+    $$PWD/css/wml.css \
+    $$PWD/css/mediaControls.css \
+    $$PWD/css/mediaControlsQt.css \
+    $$PWD/css/themeQtNoListboxes.css \
+    $$PWD/css/themeQtMaemo5.css
+
+IDL_BINDINGS += \
+    css/Counter.idl \
+    css/CSSCharsetRule.idl \
+    css/CSSFontFaceRule.idl \
+    css/CSSImportRule.idl \
+    css/CSSMediaRule.idl \
+    css/CSSPageRule.idl \
+    css/CSSPrimitiveValue.idl \
+    css/CSSRule.idl \
+    css/CSSRuleList.idl \
+    css/CSSStyleDeclaration.idl \
+    css/CSSStyleRule.idl \
+    css/CSSStyleSheet.idl \
+    css/CSSValue.idl \
+    css/CSSValueList.idl \
+    css/CSSVariablesDeclaration.idl \
+    css/CSSVariablesRule.idl \
+    css/Media.idl \
+    css/MediaList.idl \
+    css/RGBColor.idl \
+    css/Rect.idl \
+    css/StyleSheet.idl \
+    css/StyleSheetList.idl \
+    css/WebKitCSSKeyframeRule.idl \
+    css/WebKitCSSKeyframesRule.idl \
+    css/WebKitCSSMatrix.idl \
+    css/WebKitCSSTransformValue.idl \
+    dom/Attr.idl \
+    dom/BeforeLoadEvent.idl \
+    dom/CharacterData.idl \
+    dom/ClientRect.idl \
+    dom/ClientRectList.idl \
+    dom/Clipboard.idl \
+    dom/CDATASection.idl \
+    dom/Comment.idl \
+    dom/CompositionEvent.idl \
+    dom/CustomEvent.idl \
+    dom/DocumentFragment.idl \
+    dom/Document.idl \
+    dom/DocumentType.idl \
+    dom/DOMCoreException.idl \
+    dom/DOMImplementation.idl \
+    dom/Element.idl \
+    dom/Entity.idl \
+    dom/EntityReference.idl \
+    dom/ErrorEvent.idl \
+    dom/Event.idl \
+    dom/EventException.idl \
+#    dom/EventListener.idl \
+#    dom/EventTarget.idl \
+    dom/KeyboardEvent.idl \
+    dom/MouseEvent.idl \
+    dom/MessageChannel.idl \
+    dom/MessageEvent.idl \
+    dom/MessagePort.idl \
+    dom/MutationEvent.idl \
+    dom/NamedNodeMap.idl \
+    dom/Node.idl \
+    dom/NodeFilter.idl \
+    dom/NodeIterator.idl \
+    dom/NodeList.idl \
+    dom/Notation.idl \
+    dom/OverflowEvent.idl \
+    dom/PageTransitionEvent.idl \
+    dom/PopStateEvent.idl \
+    dom/ProcessingInstruction.idl \
+    dom/ProgressEvent.idl \
+    dom/RangeException.idl \
+    dom/Range.idl \
+    dom/Text.idl \
+    dom/TextEvent.idl \
+    dom/Touch.idl \
+    dom/TouchEvent.idl \
+    dom/TouchList.idl \
+    dom/TreeWalker.idl \
+    dom/UIEvent.idl \
+    dom/WebKitAnimationEvent.idl \
+    dom/WebKitTransitionEvent.idl \
+    dom/WheelEvent.idl \
+    html/Blob.idl \
+    html/canvas/WebGLArray.idl \
+    html/canvas/WebGLArrayBuffer.idl \
+    html/canvas/WebGLByteArray.idl \
+    html/canvas/WebGLFloatArray.idl \
+    html/canvas/CanvasGradient.idl \
+    html/canvas/WebGLIntArray.idl \
+    html/canvas/CanvasPattern.idl \
+    html/canvas/CanvasRenderingContext.idl \
+    html/canvas/CanvasRenderingContext2D.idl \
+    html/canvas/WebGLActiveInfo.idl \
+    html/canvas/WebGLBuffer.idl \
+    html/canvas/WebGLContextAttributes.idl \
+    html/canvas/WebGLFramebuffer.idl \
+    html/canvas/WebGLProgram.idl \
+    html/canvas/WebGLRenderbuffer.idl \
+    html/canvas/WebGLRenderingContext.idl \
+    html/canvas/WebGLShader.idl \
+    html/canvas/WebGLShortArray.idl \
+    html/canvas/WebGLTexture.idl \
+    html/canvas/WebGLUniformLocation.idl \
+    html/canvas/WebGLUnsignedByteArray.idl \
+    html/canvas/WebGLUnsignedIntArray.idl \
+    html/canvas/WebGLUnsignedShortArray.idl \
+    html/DataGridColumn.idl \
+    html/DataGridColumnList.idl \
+    html/DOMFormData.idl \
+    html/File.idl \
+    html/FileList.idl \
+    html/HTMLAllCollection.idl \
+    html/HTMLAudioElement.idl \
+    html/HTMLAnchorElement.idl \
+    html/HTMLAppletElement.idl \
+    html/HTMLAreaElement.idl \
+    html/HTMLBaseElement.idl \
+    html/HTMLBaseFontElement.idl \
+    html/HTMLBlockquoteElement.idl \
+    html/HTMLBodyElement.idl \
+    html/HTMLBRElement.idl \
+    html/HTMLButtonElement.idl \
+    html/HTMLCanvasElement.idl \
+    html/HTMLCollection.idl \
+    html/HTMLDataGridElement.idl \
+    html/HTMLDataGridCellElement.idl \
+    html/HTMLDataGridColElement.idl \
+    html/HTMLDataGridRowElement.idl \
+    html/HTMLDataListElement.idl \
+    html/HTMLDirectoryElement.idl \
+    html/HTMLDivElement.idl \
+    html/HTMLDListElement.idl \
+    html/HTMLDocument.idl \
+    html/HTMLElement.idl \
+    html/HTMLEmbedElement.idl \
+    html/HTMLFieldSetElement.idl \
+    html/HTMLFontElement.idl \
+    html/HTMLFormElement.idl \
+    html/HTMLFrameElement.idl \
+    html/HTMLFrameSetElement.idl \
+    html/HTMLHeadElement.idl \
+    html/HTMLHeadingElement.idl \
+    html/HTMLHRElement.idl \
+    html/HTMLHtmlElement.idl \
+    html/HTMLIFrameElement.idl \
+    html/HTMLImageElement.idl \
+    html/HTMLInputElement.idl \
+    html/HTMLIsIndexElement.idl \
+    html/HTMLLabelElement.idl \
+    html/HTMLLegendElement.idl \
+    html/HTMLLIElement.idl \
+    html/HTMLLinkElement.idl \
+    html/HTMLMapElement.idl \
+    html/HTMLMarqueeElement.idl \
+    html/HTMLMediaElement.idl \
+    html/HTMLMenuElement.idl \
+    html/HTMLMetaElement.idl \
+    html/HTMLModElement.idl \
+    html/HTMLObjectElement.idl \
+    html/HTMLOListElement.idl \
+    html/HTMLOptGroupElement.idl \
+    html/HTMLOptionElement.idl \
+    html/HTMLOptionsCollection.idl \
+    html/HTMLParagraphElement.idl \
+    html/HTMLParamElement.idl \
+    html/HTMLPreElement.idl \
+    html/HTMLProgressElement.idl \
+    html/HTMLQuoteElement.idl \
+    html/HTMLScriptElement.idl \
+    html/HTMLSelectElement.idl \
+    html/HTMLSourceElement.idl \
+    html/HTMLStyleElement.idl \
+    html/HTMLTableCaptionElement.idl \
+    html/HTMLTableCellElement.idl \
+    html/HTMLTableColElement.idl \
+    html/HTMLTableElement.idl \
+    html/HTMLTableRowElement.idl \
+    html/HTMLTableSectionElement.idl \
+    html/HTMLTextAreaElement.idl \
+    html/HTMLTitleElement.idl \
+    html/HTMLUListElement.idl \
+    html/HTMLVideoElement.idl \
+    html/ImageData.idl \
+    html/MediaError.idl \
+    html/TextMetrics.idl \
+    html/TimeRanges.idl \
+    html/ValidityState.idl \
+    html/VoidCallback.idl \
+    inspector/InjectedScriptHost.idl \
+    inspector/InspectorBackend.idl \
+    inspector/InspectorFrontendHost.idl \
+    inspector/JavaScriptCallFrame.idl \
+    loader/appcache/DOMApplicationCache.idl \
+    page/BarInfo.idl \
+    page/Console.idl \
+    page/Coordinates.idl \
+    page/DOMSelection.idl \
+    page/DOMWindow.idl \
+    page/EventSource.idl \
+    page/Geolocation.idl \
+    page/Geoposition.idl \
+    page/History.idl \
+    page/Location.idl \
+    page/Navigator.idl \
+    page/PositionError.idl \
+    page/Screen.idl \
+    page/WebKitPoint.idl \
+    page/WorkerNavigator.idl \
+    plugins/Plugin.idl \
+    plugins/MimeType.idl \
+    plugins/PluginArray.idl \
+    plugins/MimeTypeArray.idl \
+    storage/Database.idl \
+    storage/Storage.idl \
+    storage/StorageEvent.idl \
+    storage/SQLError.idl \
+    storage/SQLResultSet.idl \
+    storage/SQLResultSetRowList.idl \
+    storage/SQLTransaction.idl \
+    svg/SVGZoomEvent.idl \
+    svg/SVGAElement.idl \
+    svg/SVGAltGlyphElement.idl \
+    svg/SVGAngle.idl \
+    svg/SVGAnimateColorElement.idl \
+    svg/SVGAnimatedAngle.idl \
+    svg/SVGAnimatedBoolean.idl \
+    svg/SVGAnimatedEnumeration.idl \
+    svg/SVGAnimatedInteger.idl \
+    svg/SVGAnimatedLength.idl \
+    svg/SVGAnimatedLengthList.idl \
+    svg/SVGAnimatedNumber.idl \
+    svg/SVGAnimatedNumberList.idl \
+    svg/SVGAnimatedPreserveAspectRatio.idl \
+    svg/SVGAnimatedRect.idl \
+    svg/SVGAnimatedString.idl \
+    svg/SVGAnimatedTransformList.idl \
+    svg/SVGAnimateElement.idl \
+    svg/SVGAnimateTransformElement.idl \
+    svg/SVGAnimationElement.idl \
+    svg/SVGCircleElement.idl \
+    svg/SVGClipPathElement.idl \
+    svg/SVGColor.idl \
+    svg/SVGComponentTransferFunctionElement.idl \
+    svg/SVGCursorElement.idl \
+    svg/SVGDefsElement.idl \
+    svg/SVGDescElement.idl \
+    svg/SVGDocument.idl \
+    svg/SVGElement.idl \
+    svg/SVGElementInstance.idl \
+    svg/SVGElementInstanceList.idl \
+    svg/SVGEllipseElement.idl \
+    svg/SVGException.idl \
+    svg/SVGFEBlendElement.idl \
+    svg/SVGFEColorMatrixElement.idl \
+    svg/SVGFEComponentTransferElement.idl \
+    svg/SVGFECompositeElement.idl \
+    svg/SVGFEDiffuseLightingElement.idl \
+    svg/SVGFEDisplacementMapElement.idl \
+    svg/SVGFEDistantLightElement.idl \
+    svg/SVGFEFloodElement.idl \
+    svg/SVGFEFuncAElement.idl \
+    svg/SVGFEFuncBElement.idl \
+    svg/SVGFEFuncGElement.idl \
+    svg/SVGFEFuncRElement.idl \
+    svg/SVGFEGaussianBlurElement.idl \
+    svg/SVGFEImageElement.idl \
+    svg/SVGFEMergeElement.idl \
+    svg/SVGFEMergeNodeElement.idl \
+    svg/SVGFEMorphologyElement.idl \
+    svg/SVGFEOffsetElement.idl \
+    svg/SVGFEPointLightElement.idl \
+    svg/SVGFESpecularLightingElement.idl \
+    svg/SVGFESpotLightElement.idl \
+    svg/SVGFETileElement.idl \
+    svg/SVGFETurbulenceElement.idl \
+    svg/SVGFilterElement.idl \
+    svg/SVGFontElement.idl \
+    svg/SVGFontFaceElement.idl \
+    svg/SVGFontFaceFormatElement.idl \
+    svg/SVGFontFaceNameElement.idl \
+    svg/SVGFontFaceSrcElement.idl \
+    svg/SVGFontFaceUriElement.idl \
+    svg/SVGForeignObjectElement.idl \
+    svg/SVGGElement.idl \
+    svg/SVGGlyphElement.idl \
+    svg/SVGGradientElement.idl \
+    svg/SVGHKernElement.idl \
+    svg/SVGImageElement.idl \
+    svg/SVGLength.idl \
+    svg/SVGLengthList.idl \
+    svg/SVGLinearGradientElement.idl \
+    svg/SVGLineElement.idl \
+    svg/SVGMarkerElement.idl \
+    svg/SVGMaskElement.idl \
+    svg/SVGMatrix.idl \
+    svg/SVGMetadataElement.idl \
+    svg/SVGMissingGlyphElement.idl \
+    svg/SVGNumber.idl \
+    svg/SVGNumberList.idl \
+    svg/SVGPaint.idl \
+    svg/SVGPathElement.idl \
+    svg/SVGPathSegArcAbs.idl \
+    svg/SVGPathSegArcRel.idl \
+    svg/SVGPathSegClosePath.idl \
+    svg/SVGPathSegCurvetoCubicAbs.idl \
+    svg/SVGPathSegCurvetoCubicRel.idl \
+    svg/SVGPathSegCurvetoCubicSmoothAbs.idl \
+    svg/SVGPathSegCurvetoCubicSmoothRel.idl \
+    svg/SVGPathSegCurvetoQuadraticAbs.idl \
+    svg/SVGPathSegCurvetoQuadraticRel.idl \
+    svg/SVGPathSegCurvetoQuadraticSmoothAbs.idl \
+    svg/SVGPathSegCurvetoQuadraticSmoothRel.idl \
+    svg/SVGPathSeg.idl \
+    svg/SVGPathSegLinetoAbs.idl \
+    svg/SVGPathSegLinetoHorizontalAbs.idl \
+    svg/SVGPathSegLinetoHorizontalRel.idl \
+    svg/SVGPathSegLinetoRel.idl \
+    svg/SVGPathSegLinetoVerticalAbs.idl \
+    svg/SVGPathSegLinetoVerticalRel.idl \
+    svg/SVGPathSegList.idl \
+    svg/SVGPathSegMovetoAbs.idl \
+    svg/SVGPathSegMovetoRel.idl \
+    svg/SVGPatternElement.idl \
+    svg/SVGPoint.idl \
+    svg/SVGPointList.idl \
+    svg/SVGPolygonElement.idl \
+    svg/SVGPolylineElement.idl \
+    svg/SVGPreserveAspectRatio.idl \
+    svg/SVGRadialGradientElement.idl \
+    svg/SVGRectElement.idl \
+    svg/SVGRect.idl \
+    svg/SVGRenderingIntent.idl \
+    svg/SVGScriptElement.idl \
+    svg/SVGSetElement.idl \
+    svg/SVGStopElement.idl \
+    svg/SVGStringList.idl \
+    svg/SVGStyleElement.idl \
+    svg/SVGSVGElement.idl \
+    svg/SVGSwitchElement.idl \
+    svg/SVGSymbolElement.idl \
+    svg/SVGTextContentElement.idl \
+    svg/SVGTextElement.idl \
+    svg/SVGTextPathElement.idl \
+    svg/SVGTextPositioningElement.idl \
+    svg/SVGTitleElement.idl \
+    svg/SVGTransform.idl \
+    svg/SVGTransformList.idl \
+    svg/SVGTRefElement.idl \
+    svg/SVGTSpanElement.idl \
+    svg/SVGUnitTypes.idl \
+    svg/SVGUseElement.idl \
+    svg/SVGViewElement.idl \
+    websockets/WebSocket.idl \
+    workers/AbstractWorker.idl \
+    workers/DedicatedWorkerContext.idl \
+    workers/SharedWorker.idl \
+    workers/SharedWorkerContext.idl \
+    workers/Worker.idl \
+    workers/WorkerContext.idl \
+    workers/WorkerLocation.idl \
+    xml/DOMParser.idl \
+    xml/XMLHttpRequest.idl \
+    xml/XMLHttpRequestException.idl \
+    xml/XMLHttpRequestProgressEvent.idl \
+    xml/XMLHttpRequestUpload.idl \
+    xml/XMLSerializer.idl \
+    xml/XPathNSResolver.idl \
+    xml/XPathException.idl \
+    xml/XPathExpression.idl \
+    xml/XPathResult.idl \
+    xml/XPathEvaluator.idl \
+    xml/XSLTProcessor.idl
+
+contains(DEFINES, ENABLE_WML=1) {
+    wmlnames.output = $${WC_GENERATED_SOURCES_DIR}/WMLNames.cpp
+    wmlnames.input = WML_NAMES
+    wmlnames.wkScript = $$PWD/dom/make_names.pl
+    wmlnames.commands = perl -I$$PWD/bindings/scripts $$wmlnames.wkScript --tags $$PWD/wml/WMLTagNames.in --attrs $$PWD/wml/WMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$WC_GENERATED_SOURCES_DIR
+    wmlnames.wkExtraSources = $${WC_GENERATED_SOURCES_DIR}/WMLElementFactory.cpp
+    addExtraCompiler(wmlnames)
+}
+
+contains(DEFINES, ENABLE_SVG=1) {
+    # GENERATOR 5-C:
+    svgnames.output = $${WC_GENERATED_SOURCES_DIR}/SVGNames.cpp
+    svgnames.input = SVG_NAMES
+    svgnames.wkScript = $$PWD/dom/make_names.pl
+    svgnames.commands = perl -I$$PWD/bindings/scripts $$svgnames.wkScript --tags $$PWD/svg/svgtags.in --attrs $$PWD/svg/svgattrs.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$WC_GENERATED_SOURCES_DIR
+    svgnames.wkExtraSources = $${WC_GENERATED_SOURCES_DIR}/SVGElementFactory.cpp $${WC_GENERATED_SOURCES_DIR}/JSSVGElementWrapperFactory.cpp
+    addExtraCompiler(svgnames)
+}
+
+# GENERATOR 5-D:
+xlinknames.output = $${WC_GENERATED_SOURCES_DIR}/XLinkNames.cpp
+xlinknames.wkScript = $$PWD/dom/make_names.pl
+xlinknames.commands = perl -I$$PWD/bindings/scripts $$xlinknames.wkScript --attrs $$PWD/svg/xlinkattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$WC_GENERATED_SOURCES_DIR
+xlinknames.input = XLINK_NAMES
+addExtraCompiler(xlinknames)
+
+# GENERATOR 6-A:
+cssprops.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.cpp
+cssprops.input = WALDOCSSPROPS
+cssprops.wkScript = $$PWD/css/makeprop.pl
+cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $${DASHBOARDSUPPORTCSSPROPERTIES} $${EXTRACSSPROPERTIES} > $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.in && cd $$WC_GENERATED_SOURCES_DIR && perl $$cssprops.wkScript && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
+cssprops.depends = ${QMAKE_FILE_NAME} $${DASHBOARDSUPPORTCSSPROPERTIES} $${EXTRACSSPROPERTIES}
+addExtraCompiler(cssprops)
+
+# GENERATOR 6-B:
+cssvalues.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.c
+cssvalues.input = WALDOCSSVALUES
+cssvalues.wkScript = $$PWD/css/makevalues.pl
+cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$EXTRACSSVALUES > $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.in && cd $$WC_GENERATED_SOURCES_DIR && perl $$cssvalues.wkScript && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
+cssvalues.depends = ${QMAKE_FILE_NAME} $${EXTRACSSVALUES}
+cssvalues.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.h
+addExtraCompiler(cssvalues)
+
+# GENERATOR 1: IDL compiler
+idl.output = $${WC_GENERATED_SOURCES_DIR}/JS${QMAKE_FILE_BASE}.cpp
+idl.input = IDL_BINDINGS
+idl.wkScript = $$PWD/bindings/scripts/generate-bindings.pl
+idl.commands = perl -I$$PWD/bindings/scripts $$idl.wkScript --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" --generator JS --include $$PWD/dom --include $$PWD/html --include $$PWD/xml --include $$PWD/svg --outputDir $$WC_GENERATED_SOURCES_DIR --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_FILE_NAME}
+idl.depends = $$PWD/bindings/scripts/CodeGenerator.pm \
+              $$PWD/bindings/scripts/CodeGeneratorJS.pm \
+              $$PWD/bindings/scripts/IDLParser.pm \
+              $$PWD/bindings/scripts/IDLStructure.pm \
+              $$PWD/bindings/scripts/InFilesParser.pm
+addExtraCompiler(idl)
+
+# GENERATOR 3: tokenizer (flex)
+tokenizer.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.cpp
+tokenizer.input = TOKENIZER
+tokenizer.wkScript = $$PWD/css/maketokenizer
+tokenizer.commands = flex -t < ${QMAKE_FILE_NAME} | perl $$tokenizer.wkScript > ${QMAKE_FILE_OUT}
+addExtraCompiler(tokenizer)
+
+# GENERATOR 4: CSS grammar
+cssbison.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.cpp
+cssbison.input = CSSBISON
+cssbison.wkScript = $$PWD/css/makegrammar.pl
+cssbison.commands = perl $$cssbison.wkScript ${QMAKE_FILE_NAME} $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}
+cssbison.depends = ${QMAKE_FILE_NAME}
+addExtraCompiler(cssbison)
+
+# GENERATOR 5-A:
+htmlnames.output = $${WC_GENERATED_SOURCES_DIR}/HTMLNames.cpp
+htmlnames.input = HTML_NAMES
+htmlnames.wkScript = $$PWD/dom/make_names.pl
+htmlnames.commands = perl -I$$PWD/bindings/scripts $$htmlnames.wkScript --tags $$PWD/html/HTMLTagNames.in --attrs $$PWD/html/HTMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\"  --factory --wrapperFactory --outputDir $$WC_GENERATED_SOURCES_DIR
+htmlnames.depends = $$PWD/html/HTMLAttributeNames.in
+htmlnames.wkExtraSources = $${WC_GENERATED_SOURCES_DIR}/HTMLElementFactory.cpp $${WC_GENERATED_SOURCES_DIR}/JSHTMLElementWrapperFactory.cpp
+addExtraCompiler(htmlnames)
+
+# GENERATOR 5-B:
+xmlnsnames.output = $${WC_GENERATED_SOURCES_DIR}/XMLNSNames.cpp
+xmlnsnames.input = XMLNS_NAMES
+xmlnsnames.wkScript = $$PWD/dom/make_names.pl
+xmlnsnames.commands = perl -I$$PWD/bindings/scripts $$xmlnsnames.wkScript --attrs $$PWD/xml/xmlnsattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$WC_GENERATED_SOURCES_DIR
+addExtraCompiler(xmlnsnames)
+
+# GENERATOR 5-C:
+xmlnames.output = $${WC_GENERATED_SOURCES_DIR}/XMLNames.cpp
+xmlnames.input = XML_NAMES
+xmlnames.wkScript = $$PWD/dom/make_names.pl
+xmlnames.commands = perl -I$$PWD/bindings/scripts $$xmlnames.wkScript --attrs $$PWD/xml/xmlattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$WC_GENERATED_SOURCES_DIR
+addExtraCompiler(xmlnames)
+
+# GENERATOR 8-A:
+entities.output = $${WC_GENERATED_SOURCES_DIR}/HTMLEntityNames.c
+entities.input = ENTITIES_GPERF
+entities.commands = gperf -a -L ANSI-C -C -G -c -o -t --includes --key-positions="*" -N findEntity -D -s 2 < $$PWD/html/HTMLEntityNames.gperf > $${WC_GENERATED_SOURCES_DIR}/HTMLEntityNames.c
+entities.clean = ${QMAKE_FILE_OUT}
+addExtraCompiler(entities)
+
+# GENERATOR 8-B:
+doctypestrings.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.cpp
+doctypestrings.input = DOCTYPESTRINGS
+doctypestrings.commands = gperf -CEot -L ANSI-C --includes --key-positions="*" -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
+doctypestrings.clean = ${QMAKE_FILE_OUT}
+addExtraCompiler(doctypestrings)
+
+# GENERATOR 8-C:
+colordata.output = $${WC_GENERATED_SOURCES_DIR}/ColorData.c
+colordata.input = COLORDAT_GPERF
+colordata.commands = gperf -CDEot -L ANSI-C --includes --key-positions="*" -N findColor -D -s 2 < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
+addExtraCompiler(colordata)
+
+# GENERATOR 9:
+stylesheets.wkScript = $$PWD/css/make-css-file-arrays.pl
+stylesheets.output = $${WC_GENERATED_SOURCES_DIR}/UserAgentStyleSheetsData.cpp
+stylesheets.input = stylesheets.wkScript
+stylesheets.commands = perl $$stylesheets.wkScript --preprocessor \"$${QMAKE_MOC} -E\" $${WC_GENERATED_SOURCES_DIR}/UserAgentStyleSheets.h ${QMAKE_FILE_OUT} $$STYLESHEETS_EMBED
+stylesheets.depends = $$STYLESHEETS_EMBED
+stylesheets.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_WC_GENERATED_SOURCES_DIR}/UserAgentStyleSheets.h
+addExtraCompiler(stylesheets, $${WC_GENERATED_SOURCES_DIR}/UserAgentStyleSheets.h)
+
+# GENERATOR 10: XPATH grammar
+xpathbison.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.cpp
+xpathbison.input = XPATHBISON
+xpathbison.commands = bison -d -p xpathyy ${QMAKE_FILE_NAME} -o $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${WC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c $${WC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp && $(MOVE) $${WC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${WC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
+xpathbison.depends = ${QMAKE_FILE_NAME}
+addExtraCompiler(xpathbison)
+
+# GENERATOR 11: WebKit Version
+# The appropriate Apple-maintained Version.xcconfig file for WebKit version information is in WebKit/mac/Configurations/.
+webkitversion.wkScript = $$PWD/../WebKit/scripts/generate-webkitversion.pl
+webkitversion.output = $${WC_GENERATED_SOURCES_DIR}/WebKitVersion.h
+webkitversion.input = webkitversion.wkScript
+webkitversion.commands = perl $$webkitversion.wkScript --config $$PWD/../WebKit/mac/Configurations/Version.xcconfig --outputDir $${WC_GENERATED_SOURCES_DIR}/
+webkitversion.clean = ${QMAKE_VAR_WC_GENERATED_SOURCES_DIR}/WebKitVersion.h
+webkitversion.wkAddOutputToSources = false
+addExtraCompiler(webkitversion)
+
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index 5fe9703617..b20a8821eb 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -4,14 +4,14 @@ CONFIG += depend_includepath
 
 symbian: {
     TARGET.EPOCALLOWDLLDATA=1
-    TARGET.EPOCHEAPSIZE = 0x20000 0x2000000 // Min 128kB, Max 32MB
     TARGET.CAPABILITY = All -Tcb
     isEmpty(QT_LIBINFIX) {
         TARGET.UID3 = 0x200267C2
     } else {
         TARGET.UID3 = 0xE00267C2
     }
-    webkitlibs.sources = $$QMAKE_LIBDIR_QT/QtWebKit$${QT_LIBINFIX}.dll
+    webkitlibs.sources = QtWebKit$${QT_LIBINFIX}.dll
+    CONFIG(QTDIR_build): webkitlibs.sources = $$QMAKE_LIBDIR_QT/$$webkitlibs.sources
     webkitlibs.path = /sys/bin
     vendorinfo = \
         "; Localised Vendor name" \
@@ -27,14 +27,19 @@ symbian: {
 
     DEPLOYMENT += webkitlibs webkitbackup
 
+    # Need to guarantee that these come before system includes of /epoc32/include
+    MMP_RULES += "USERINCLUDE rendering"
+    MMP_RULES += "USERINCLUDE platform/text"
     symbian-abld|symbian-sbsv2 {
         # RO text (code) section in qtwebkit.dll exceeds allocated space for gcce udeb target.
         # Move RW-section base address to start from 0xE00000 instead of the toolchain default 0x400000.
         QMAKE_LFLAGS.ARMCC += --rw-base 0xE00000
-        CONFIG += do_not_build_as_thumb
+        MMP_RULES += ALWAYS_BUILD_AS_ARM
     }
+    CONFIG(release, debug|release): QMAKE_CXXFLAGS.ARMCC += -OTime -O3
 }
 
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ..
 include($$PWD/../WebKit.pri)
 
 TEMPLATE = lib
@@ -42,36 +47,44 @@ TARGET = QtWebKit
 
 contains(QT_CONFIG, embedded):CONFIG += embedded
 
-CONFIG(QTDIR_build) {
-    GENERATED_SOURCES_DIR = $$PWD/generated
-    include($$QT_SOURCE_TREE/src/qbase.pri)
+CONFIG(standalone_package) {
+    isEmpty(WC_GENERATED_SOURCES_DIR):WC_GENERATED_SOURCES_DIR = $$PWD/generated
+    isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = $$PWD/../JavaScriptCore/generated
+
     PRECOMPILED_HEADER = $$PWD/../WebKit/qt/WebKit_pch.h
     DEFINES *= NDEBUG
+
+    symbian: TARGET += $${QT_LIBINFIX}
 } else {
-    !static: DEFINES += QT_MAKEDLL
+    isEmpty(WC_GENERATED_SOURCES_DIR):WC_GENERATED_SOURCES_DIR = generated
+    isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = ../JavaScriptCore/generated
 
     CONFIG(debug, debug|release) {
-        isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}debug
         OBJECTS_DIR = obj/debug
     } else { # Release
-        isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}release
         OBJECTS_DIR = obj/release
     }
 
-    DESTDIR = $$OUTPUT_DIR/lib
 }
 
-GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR${QMAKE_DIR_SEP}
+CONFIG(QTDIR_build) {
+    include($$QT_SOURCE_TREE/src/qbase.pri)
+    # Qt will set the version for us when building in Qt's tree
+} else {
+    VERSION = $${QT_MAJOR_VERSION}.$${QT_MINOR_VERSION}.$${QT_PATCH_VERSION}
+    DESTDIR = $$OUTPUT_DIR/lib
+    !static: DEFINES += QT_MAKEDLL
+}
 
 unix {
     QMAKE_PKGCONFIG_REQUIRES = QtCore QtGui QtNetwork
-    lessThan(QT_MINOR_VERSION, 4): QMAKE_PKGCONFIG_REQUIRES += QtXml
 }
 
 unix:!mac:*-g++*:QMAKE_CXXFLAGS += -ffunction-sections -fdata-sections 
 unix:!mac:*-g++*:QMAKE_LFLAGS += -Wl,--gc-sections
+linux*-g++*:QMAKE_LFLAGS += $$QMAKE_LFLAGS_NOUNDEF
 
-CONFIG(release):!CONFIG(QTDIR_build) {
+CONFIG(release):!CONFIG(standalone_package) {
     contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
     unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
 }
@@ -87,7 +100,6 @@ win32-msvc2005|win32-msvc2008:{
     QMAKE_CXXFLAGS_RELEASE -= -GL
 }
 
-win32-*: DEFINES += _HAS_TR1=0
 wince* {
 #    DEFINES += ENABLE_SVG=0 ENABLE_XPATH=0 ENABLE_XBL=0 \
 #               ENABLE_SVG_ANIMATION=0 ENABLE_SVG_USE=0  \
@@ -108,125 +120,64 @@ win32-g++ {
 # Assume that symbian OS always comes with sqlite
 symbian:!CONFIG(QTDIR_build): CONFIG += system-sqlite
 
-# Try to locate sqlite3 source
-CONFIG(QTDIR_build) {
-    SQLITE3SRCDIR = $$QT_SOURCE_TREE/src/3rdparty/sqlite/
-} else {
-    SQLITE3SRCDIR = $$(SQLITE3SRCDIR)
-    isEmpty(SQLITE3SRCDIR) {
-        SQLITE3SRCDIR = $$[QT_INSTALL_PREFIX]/src/3rdparty/sqlite/
-    } 
-}
-
-# Optional components (look for defs in config.h and included files!)
 
-contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
-    DEFINES+=ENABLE_DATABASE=0 ENABLE_DOM_STORAGE=0 ENABLE_ICONDATABASE=0 ENABLE_WORKERS=0 ENABLE_SHARED_WORKERS=0
-}
 
-# turn off SQLITE support if we do not have sqlite3 available
-!CONFIG(QTDIR_build):win32-*:!exists( $${SQLITE3SRCDIR}/sqlite3.c ): DEFINES += ENABLE_SQLITE=0 ENABLE_DATABASE=0 ENABLE_ICONDATABASE=0 ENABLE_OFFLINE_WEB_APPLICATIONS=0 ENABLE_DOM_STORAGE=0
-
-!contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=.): DEFINES += ENABLE_JAVASCRIPT_DEBUGGER=1
-!contains(DEFINES, ENABLE_DATABASE=.): DEFINES += ENABLE_DATABASE=1
-!contains(DEFINES, ENABLE_EVENTSOURCE=.): DEFINES += ENABLE_EVENTSOURCE=1
-!contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=.): DEFINES += ENABLE_OFFLINE_WEB_APPLICATIONS=1
-!contains(DEFINES, ENABLE_DOM_STORAGE=.): DEFINES += ENABLE_DOM_STORAGE=1
-!contains(DEFINES, ENABLE_ICONDATABASE=.): DEFINES += ENABLE_ICONDATABASE=1
-!contains(DEFINES, ENABLE_CHANNEL_MESSAGING=.): DEFINES += ENABLE_CHANNEL_MESSAGING=1
-!contains(DEFINES, ENABLE_ORIENTATION_EVENTS=.): DEFINES += ENABLE_ORIENTATION_EVENTS=0
-
-# turn on SQLITE support if any of the dependent features are turned on
-!contains(DEFINES, ENABLE_SQLITE=.) {
-  contains(DEFINES, ENABLE_DATABASE=1)|contains(DEFINES, ENABLE_ICONDATABASE=1)|contains(DEFINES, ENABLE_DOM_STORAGE=1)|contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
-    DEFINES += ENABLE_SQLITE=1
-  } else {
-    DEFINES += ENABLE_SQLITE=0
-  }
-}
+RESOURCES += \
+    $$PWD/../WebCore/WebCore.qrc
 
-!contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=.): DEFINES += ENABLE_DASHBOARD_SUPPORT=0
-!contains(DEFINES, ENABLE_FILTERS=.): DEFINES += ENABLE_FILTERS=0
-!contains(DEFINES, ENABLE_XPATH=.): DEFINES += ENABLE_XPATH=1
-#!contains(DEFINES, ENABLE_XBL=.): DEFINES += ENABLE_XBL=1
-!contains(DEFINES, ENABLE_WCSS=.): DEFINES += ENABLE_WCSS=0
-!contains(DEFINES, ENABLE_WML=.): DEFINES += ENABLE_WML=0
-!contains(DEFINES, ENABLE_SHARED_WORKERS=.): DEFINES += ENABLE_SHARED_WORKERS=1
-!contains(DEFINES, ENABLE_WORKERS=.): DEFINES += ENABLE_WORKERS=1
-!contains(DEFINES, ENABLE_XHTMLMP=.): DEFINES += ENABLE_XHTMLMP=0
-!contains(DEFINES, ENABLE_DATAGRID=.): DEFINES += ENABLE_DATAGRID=0
-
-# SVG support
-!contains(DEFINES, ENABLE_SVG=0) {
-    !contains(DEFINES, ENABLE_SVG=.): DEFINES += ENABLE_SVG=1
-    !contains(DEFINES, ENABLE_SVG_FONTS=.): DEFINES += ENABLE_SVG_FONTS=1
-    !contains(DEFINES, ENABLE_SVG_FOREIGN_OBJECT=.): DEFINES += ENABLE_SVG_FOREIGN_OBJECT=1
-    !contains(DEFINES, ENABLE_SVG_ANIMATION=.): DEFINES += ENABLE_SVG_ANIMATION=1
-    !contains(DEFINES, ENABLE_SVG_AS_IMAGE=.): DEFINES += ENABLE_SVG_AS_IMAGE=1
-    !contains(DEFINES, ENABLE_SVG_USE=.): DEFINES += ENABLE_SVG_USE=1
-} else {
-    DEFINES += ENABLE_SVG_FONTS=0 ENABLE_SVG_FOREIGN_OBJECT=0 ENABLE_SVG_ANIMATION=0 ENABLE_SVG_AS_IMAGE=0 ENABLE_SVG_USE=0
+!symbian:!maemo5 {
+    RESOURCES += $$PWD/../WebCore/inspector/front-end/WebKit.qrc
 }
 
-mameo5|symbian|embedded {
+maemo5|symbian|embedded {
     DEFINES += ENABLE_FAST_MOBILE_SCROLLING=1
 }
 
-# HTML5 ruby support
-!contains(DEFINES, ENABLE_RUBY=.): DEFINES += ENABLE_RUBY=1
-
-# HTML5 media support
-!contains(DEFINES, ENABLE_VIDEO=.) {
-    contains(QT_CONFIG, phonon):DEFINES += ENABLE_VIDEO=1
-    else:DEFINES += ENABLE_VIDEO=0
+maemo5 {
+    DEFINES += ENABLE_NO_LISTBOX_RENDERING=1
 }
 
-# HTML5 datalist support
-!contains(DEFINES, ENABLE_DATALIST=.): DEFINES += ENABLE_DATALIST=1
-
-# Nescape plugins support (NPAPI)
-!contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=.) {
-    unix|win32-*:!embedded:!wince*: {
-        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=1
-    } else {
-        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=0
-    }
-}
+include($$PWD/../JavaScriptCore/JavaScriptCore.pri)
+addJavaScriptCoreLib(../JavaScriptCore)
 
-# Web Socket support.
-!contains(DEFINES, ENABLE_WEB_SOCKETS=.): DEFINES += ENABLE_WEB_SOCKETS=0
 
-# XSLT support with QtXmlPatterns
-!contains(DEFINES, ENABLE_XSLT=.) {
-    contains(QT_CONFIG, xmlpatterns):!lessThan(QT_MINOR_VERSION, 5):DEFINES += ENABLE_XSLT=1
-    else:DEFINES += ENABLE_XSLT=0
-}
+# HTML5 Media Support
+# We require phonon for versions of Qt < 4.7
+# We require QtMultimedia for versions of Qt >= 4.7
+!contains(DEFINES, ENABLE_VIDEO=.) {
+    DEFINES -= ENABLE_VIDEO=1
+    DEFINES += ENABLE_VIDEO=0
 
-!CONFIG(QTDIR_build):!contains(DEFINES, ENABLE_QT_BEARER=.) {
-    symbian: {
-        exists($${EPOCROOT}epoc32/release/winscw/udeb/QtBearer.lib)| \
-        exists($${EPOCROOT}epoc32/release/armv5/lib/QtBearer.lib) {
-            DEFINES += ENABLE_QT_BEARER=1
-        }
+    lessThan(QT_MINOR_VERSION, 7):contains(QT_CONFIG, phonon) {
+        DEFINES -= ENABLE_VIDEO=0
+        DEFINES += ENABLE_VIDEO=1
+    }
+    !lessThan(QT_MINOR_VERSION, 7):contains(QT_CONFIG, multimedia) {
+        DEFINES -= ENABLE_VIDEO=0
+        DEFINES += ENABLE_VIDEO=1
     }
 }
 
-DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1 WTF_CHANGES=1
+# Extract sources to build from the generator definitions
+defineTest(addExtraCompiler) {
+    isEqual($${1}.wkAddOutputToSources, false): return(true)
 
-# Used to compute defaults for the build-webkit script
-CONFIG(compute_defaults) {
-    message($$DEFINES)
-    error("Done computing defaults")
-}
+    outputRule = $$eval($${1}.output)
+    input = $$eval($${1}.input)
+    input = $$eval($$input)
 
-RESOURCES += \
-    $$PWD/../WebCore/WebCore.qrc
+    for(file,input) {
+        base = $$basename(file)
+        base ~= s/\..+//
+        newfile=$$replace(outputRule,\\$\\{QMAKE_FILE_BASE\\},$$base)
+        SOURCES += $$newfile
+    }
+    SOURCES += $$eval($${1}.wkExtraSources)
+    export(SOURCES)
 
-!symbian {
-    RESOURCES += $$PWD/../WebCore/inspector/front-end/WebKit.qrc
+    return(true)
 }
-
-include($$PWD/../JavaScriptCore/JavaScriptCore.pri)
+include(WebCore.pri)
 
 INCLUDEPATH = \
     $$PWD \
@@ -234,6 +185,7 @@ INCLUDEPATH = \
     $$PWD/bindings/js \
     $$PWD/bridge \
     $$PWD/bridge/c \
+    $$PWD/bridge/jsc \
     $$PWD/css \
     $$PWD/dom \
     $$PWD/dom/default \
@@ -271,7 +223,7 @@ INCLUDEPATH = \
     $$PWD/wml \
     $$PWD/workers \
     $$PWD/xml \
-    $$GENERATED_SOURCES_DIR \
+    $$WC_GENERATED_SOURCES_DIR \
     $$INCLUDEPATH
 
 INCLUDEPATH = \
@@ -280,33 +232,12 @@ INCLUDEPATH = \
     $$PWD/platform/graphics/qt \
     $$PWD/platform/network/qt \
     $$PWD/platform/qt \
+    $$PWD/../WebKit/qt/Api \
     $$PWD/../WebKit/qt/WebCoreSupport \
     $$INCLUDEPATH
 
 QT += network
-lessThan(QT_MINOR_VERSION, 4): QT += xml
-
-QMAKE_EXTRA_TARGETS += generated_files
-
-FEATURE_DEFINES_JAVASCRIPT = LANGUAGE_JAVASCRIPT=1
-
-TOKENIZER = $$PWD/css/tokenizer.flex
-
-DOCTYPESTRINGS = $$PWD/html/DocTypeStrings.gperf
-
-CSSBISON = $$PWD/css/CSSGrammar.y
-
-HTML_NAMES = $$PWD/html/HTMLTagNames.in
-
-XML_NAMES = $$PWD/xml/xmlattrs.in
-
-ENTITIES_GPERF = $$PWD/html/HTMLEntityNames.gperf
 
-COLORDAT_GPERF = $$PWD/platform/ColorData.gperf
-
-WALDOCSSPROPS = $$PWD/css/CSSPropertyNames.in
-
-WALDOCSSVALUES = $$PWD/css/CSSValueKeywords.in
 
 DASHBOARDSUPPORTCSSPROPERTIES = $$PWD/css/DashboardSupportCSSPropertyNames.in
 
@@ -321,378 +252,18 @@ contains(DEFINES, ENABLE_WCSS=1) {
     EXTRACSSVALUES += $$PWD/css/WCSSValueKeywords.in
 }
 
-STYLESHEETS_EMBED = \
-    $$PWD/css/html.css \
-    $$PWD/css/quirks.css \
-    $$PWD/css/svg.css \
-    $$PWD/css/view-source.css \
-    $$PWD/css/wml.css \
-    $$PWD/css/mediaControls.css \
-    $$PWD/css/mediaControlsQt.css
-
-DOMLUT_FILES += \
-    bindings/js/JSDOMWindowBase.cpp \
-    bindings/js/JSWorkerContextBase.cpp
-
-IDL_BINDINGS += \
-    css/Counter.idl \
-    css/CSSCharsetRule.idl \
-    css/CSSFontFaceRule.idl \
-    css/CSSImportRule.idl \
-    css/CSSMediaRule.idl \
-    css/CSSPageRule.idl \
-    css/CSSPrimitiveValue.idl \
-    css/CSSRule.idl \
-    css/CSSRuleList.idl \
-    css/CSSStyleDeclaration.idl \
-    css/CSSStyleRule.idl \
-    css/CSSStyleSheet.idl \
-    css/CSSValue.idl \
-    css/CSSValueList.idl \
-    css/CSSVariablesDeclaration.idl \
-    css/CSSVariablesRule.idl \
-    css/Media.idl \
-    css/MediaList.idl \
-    css/RGBColor.idl \
-    css/Rect.idl \
-    css/StyleSheet.idl \
-    css/StyleSheetList.idl \
-    css/WebKitCSSKeyframeRule.idl \
-    css/WebKitCSSKeyframesRule.idl \
-    css/WebKitCSSMatrix.idl \
-    css/WebKitCSSTransformValue.idl \
-    dom/Attr.idl \
-    dom/BeforeLoadEvent.idl \
-    dom/CharacterData.idl \
-    dom/ClientRect.idl \
-    dom/ClientRectList.idl \
-    dom/Clipboard.idl \
-    dom/CDATASection.idl \
-    dom/Comment.idl \
-    dom/DocumentFragment.idl \
-    dom/Document.idl \
-    dom/DocumentType.idl \
-    dom/DOMCoreException.idl \
-    dom/DOMImplementation.idl \
-    dom/Element.idl \
-    dom/Entity.idl \
-    dom/EntityReference.idl \
-    dom/ErrorEvent.idl \
-    dom/Event.idl \
-    dom/EventException.idl \
-#    dom/EventListener.idl \
-#    dom/EventTarget.idl \
-    dom/KeyboardEvent.idl \
-    dom/MouseEvent.idl \
-    dom/MessageChannel.idl \
-    dom/MessageEvent.idl \
-    dom/MessagePort.idl \
-    dom/MutationEvent.idl \
-    dom/NamedNodeMap.idl \
-    dom/Node.idl \
-    dom/NodeFilter.idl \
-    dom/NodeIterator.idl \
-    dom/NodeList.idl \
-    dom/Notation.idl \
-    dom/OverflowEvent.idl \
-    dom/PageTransitionEvent.idl \
-    dom/ProcessingInstruction.idl \
-    dom/ProgressEvent.idl \
-    dom/RangeException.idl \
-    dom/Range.idl \
-    dom/Text.idl \
-    dom/TextEvent.idl \
-    dom/TreeWalker.idl \
-    dom/UIEvent.idl \
-    dom/WebKitAnimationEvent.idl \
-    dom/WebKitTransitionEvent.idl \
-    dom/WheelEvent.idl \
-    html/canvas/CanvasArray.idl \
-    html/canvas/CanvasArrayBuffer.idl \
-    html/canvas/CanvasByteArray.idl \
-    html/canvas/CanvasFloatArray.idl \
-    html/canvas/CanvasGradient.idl \
-    html/canvas/CanvasIntArray.idl \
-    html/canvas/CanvasPattern.idl \
-    html/canvas/CanvasRenderingContext.idl \
-    html/canvas/CanvasRenderingContext2D.idl \
-    html/canvas/CanvasRenderingContext3D.idl \
-    html/canvas/CanvasShortArray.idl \
-    html/canvas/CanvasUnsignedByteArray.idl \
-    html/canvas/CanvasUnsignedIntArray.idl \
-    html/canvas/CanvasUnsignedShortArray.idl \
-    html/DataGridColumn.idl \
-    html/DataGridColumnList.idl \
-    html/File.idl \
-    html/FileList.idl \
-    html/HTMLAllCollection.idl \
-    html/HTMLAudioElement.idl \
-    html/HTMLAnchorElement.idl \
-    html/HTMLAppletElement.idl \
-    html/HTMLAreaElement.idl \
-    html/HTMLBaseElement.idl \
-    html/HTMLBaseFontElement.idl \
-    html/HTMLBlockquoteElement.idl \
-    html/HTMLBodyElement.idl \
-    html/HTMLBRElement.idl \
-    html/HTMLButtonElement.idl \
-    html/HTMLCanvasElement.idl \
-    html/HTMLCollection.idl \
-    html/HTMLDataGridElement.idl \
-    html/HTMLDataGridCellElement.idl \
-    html/HTMLDataGridColElement.idl \
-    html/HTMLDataGridRowElement.idl \
-    html/HTMLDataListElement.idl \
-    html/HTMLDirectoryElement.idl \
-    html/HTMLDivElement.idl \
-    html/HTMLDListElement.idl \
-    html/HTMLDocument.idl \
-    html/HTMLElement.idl \
-    html/HTMLEmbedElement.idl \
-    html/HTMLFieldSetElement.idl \
-    html/HTMLFontElement.idl \
-    html/HTMLFormElement.idl \
-    html/HTMLFrameElement.idl \
-    html/HTMLFrameSetElement.idl \
-    html/HTMLHeadElement.idl \
-    html/HTMLHeadingElement.idl \
-    html/HTMLHRElement.idl \
-    html/HTMLHtmlElement.idl \
-    html/HTMLIFrameElement.idl \
-    html/HTMLImageElement.idl \
-    html/HTMLInputElement.idl \
-    html/HTMLIsIndexElement.idl \
-    html/HTMLLabelElement.idl \
-    html/HTMLLegendElement.idl \
-    html/HTMLLIElement.idl \
-    html/HTMLLinkElement.idl \
-    html/HTMLMapElement.idl \
-    html/HTMLMarqueeElement.idl \
-    html/HTMLMediaElement.idl \
-    html/HTMLMenuElement.idl \
-    html/HTMLMetaElement.idl \
-    html/HTMLModElement.idl \
-    html/HTMLObjectElement.idl \
-    html/HTMLOListElement.idl \
-    html/HTMLOptGroupElement.idl \
-    html/HTMLOptionElement.idl \
-    html/HTMLOptionsCollection.idl \
-    html/HTMLParagraphElement.idl \
-    html/HTMLParamElement.idl \
-    html/HTMLPreElement.idl \
-    html/HTMLQuoteElement.idl \
-    html/HTMLScriptElement.idl \
-    html/HTMLSelectElement.idl \
-    html/HTMLSourceElement.idl \
-    html/HTMLStyleElement.idl \
-    html/HTMLTableCaptionElement.idl \
-    html/HTMLTableCellElement.idl \
-    html/HTMLTableColElement.idl \
-    html/HTMLTableElement.idl \
-    html/HTMLTableRowElement.idl \
-    html/HTMLTableSectionElement.idl \
-    html/HTMLTextAreaElement.idl \
-    html/HTMLTitleElement.idl \
-    html/HTMLUListElement.idl \
-    html/HTMLVideoElement.idl \
-    html/ImageData.idl \
-    html/MediaError.idl \
-    html/TextMetrics.idl \
-    html/TimeRanges.idl \
-    html/ValidityState.idl \
-    html/VoidCallback.idl \
-    inspector/InspectorBackend.idl \
-    inspector/JavaScriptCallFrame.idl \
-    loader/appcache/DOMApplicationCache.idl \
-    page/BarInfo.idl \
-    page/Console.idl \
-    page/Coordinates.idl \
-    page/DOMSelection.idl \
-    page/DOMWindow.idl \
-    page/EventSource.idl \
-    page/Geolocation.idl \
-    page/Geoposition.idl \
-    page/History.idl \
-    page/Location.idl \
-    page/Navigator.idl \
-    page/PositionError.idl \
-    page/Screen.idl \
-    page/WebKitPoint.idl \
-    page/WorkerNavigator.idl \
-    plugins/Plugin.idl \
-    plugins/MimeType.idl \
-    plugins/PluginArray.idl \
-    plugins/MimeTypeArray.idl \
-    storage/Database.idl \
-    storage/Storage.idl \
-    storage/StorageEvent.idl \
-    storage/SQLError.idl \
-    storage/SQLResultSet.idl \
-    storage/SQLResultSetRowList.idl \
-    storage/SQLTransaction.idl \
-    svg/SVGZoomEvent.idl \
-    svg/SVGAElement.idl \
-    svg/SVGAltGlyphElement.idl \
-    svg/SVGAngle.idl \
-    svg/SVGAnimateColorElement.idl \
-    svg/SVGAnimatedAngle.idl \
-    svg/SVGAnimatedBoolean.idl \
-    svg/SVGAnimatedEnumeration.idl \
-    svg/SVGAnimatedInteger.idl \
-    svg/SVGAnimatedLength.idl \
-    svg/SVGAnimatedLengthList.idl \
-    svg/SVGAnimatedNumber.idl \
-    svg/SVGAnimatedNumberList.idl \
-    svg/SVGAnimatedPreserveAspectRatio.idl \
-    svg/SVGAnimatedRect.idl \
-    svg/SVGAnimatedString.idl \
-    svg/SVGAnimatedTransformList.idl \
-    svg/SVGAnimateElement.idl \
-    svg/SVGAnimateTransformElement.idl \
-    svg/SVGAnimationElement.idl \
-    svg/SVGCircleElement.idl \
-    svg/SVGClipPathElement.idl \
-    svg/SVGColor.idl \
-    svg/SVGComponentTransferFunctionElement.idl \
-    svg/SVGCursorElement.idl \
-    svg/SVGDefsElement.idl \
-    svg/SVGDescElement.idl \
-    svg/SVGDocument.idl \
-    svg/SVGElement.idl \
-    svg/SVGElementInstance.idl \
-    svg/SVGElementInstanceList.idl \
-    svg/SVGEllipseElement.idl \
-    svg/SVGException.idl \
-    svg/SVGFEBlendElement.idl \
-    svg/SVGFEColorMatrixElement.idl \
-    svg/SVGFEComponentTransferElement.idl \
-    svg/SVGFECompositeElement.idl \
-    svg/SVGFEDiffuseLightingElement.idl \
-    svg/SVGFEDisplacementMapElement.idl \
-    svg/SVGFEDistantLightElement.idl \
-    svg/SVGFEFloodElement.idl \
-    svg/SVGFEFuncAElement.idl \
-    svg/SVGFEFuncBElement.idl \
-    svg/SVGFEFuncGElement.idl \
-    svg/SVGFEFuncRElement.idl \
-    svg/SVGFEGaussianBlurElement.idl \
-    svg/SVGFEImageElement.idl \
-    svg/SVGFEMergeElement.idl \
-    svg/SVGFEMergeNodeElement.idl \
-    svg/SVGFEMorphologyElement.idl \
-    svg/SVGFEOffsetElement.idl \
-    svg/SVGFEPointLightElement.idl \
-    svg/SVGFESpecularLightingElement.idl \
-    svg/SVGFESpotLightElement.idl \
-    svg/SVGFETileElement.idl \
-    svg/SVGFETurbulenceElement.idl \
-    svg/SVGFilterElement.idl \
-    svg/SVGFontElement.idl \
-    svg/SVGFontFaceElement.idl \
-    svg/SVGFontFaceFormatElement.idl \
-    svg/SVGFontFaceNameElement.idl \
-    svg/SVGFontFaceSrcElement.idl \
-    svg/SVGFontFaceUriElement.idl \
-    svg/SVGForeignObjectElement.idl \
-    svg/SVGGElement.idl \
-    svg/SVGGlyphElement.idl \
-    svg/SVGGradientElement.idl \
-    svg/SVGHKernElement.idl \
-    svg/SVGImageElement.idl \
-    svg/SVGLength.idl \
-    svg/SVGLengthList.idl \
-    svg/SVGLinearGradientElement.idl \
-    svg/SVGLineElement.idl \
-    svg/SVGMarkerElement.idl \
-    svg/SVGMaskElement.idl \
-    svg/SVGMatrix.idl \
-    svg/SVGMetadataElement.idl \
-    svg/SVGMissingGlyphElement.idl \
-    svg/SVGNumber.idl \
-    svg/SVGNumberList.idl \
-    svg/SVGPaint.idl \
-    svg/SVGPathElement.idl \
-    svg/SVGPathSegArcAbs.idl \
-    svg/SVGPathSegArcRel.idl \
-    svg/SVGPathSegClosePath.idl \
-    svg/SVGPathSegCurvetoCubicAbs.idl \
-    svg/SVGPathSegCurvetoCubicRel.idl \
-    svg/SVGPathSegCurvetoCubicSmoothAbs.idl \
-    svg/SVGPathSegCurvetoCubicSmoothRel.idl \
-    svg/SVGPathSegCurvetoQuadraticAbs.idl \
-    svg/SVGPathSegCurvetoQuadraticRel.idl \
-    svg/SVGPathSegCurvetoQuadraticSmoothAbs.idl \
-    svg/SVGPathSegCurvetoQuadraticSmoothRel.idl \
-    svg/SVGPathSeg.idl \
-    svg/SVGPathSegLinetoAbs.idl \
-    svg/SVGPathSegLinetoHorizontalAbs.idl \
-    svg/SVGPathSegLinetoHorizontalRel.idl \
-    svg/SVGPathSegLinetoRel.idl \
-    svg/SVGPathSegLinetoVerticalAbs.idl \
-    svg/SVGPathSegLinetoVerticalRel.idl \
-    svg/SVGPathSegList.idl \
-    svg/SVGPathSegMovetoAbs.idl \
-    svg/SVGPathSegMovetoRel.idl \
-    svg/SVGPatternElement.idl \
-    svg/SVGPoint.idl \
-    svg/SVGPointList.idl \
-    svg/SVGPolygonElement.idl \
-    svg/SVGPolylineElement.idl \
-    svg/SVGPreserveAspectRatio.idl \
-    svg/SVGRadialGradientElement.idl \
-    svg/SVGRectElement.idl \
-    svg/SVGRect.idl \
-    svg/SVGRenderingIntent.idl \
-    svg/SVGScriptElement.idl \
-    svg/SVGSetElement.idl \
-    svg/SVGStopElement.idl \
-    svg/SVGStringList.idl \
-    svg/SVGStyleElement.idl \
-    svg/SVGSVGElement.idl \
-    svg/SVGSwitchElement.idl \
-    svg/SVGSymbolElement.idl \
-    svg/SVGTextContentElement.idl \
-    svg/SVGTextElement.idl \
-    svg/SVGTextPathElement.idl \
-    svg/SVGTextPositioningElement.idl \
-    svg/SVGTitleElement.idl \
-    svg/SVGTransform.idl \
-    svg/SVGTransformList.idl \
-    svg/SVGTRefElement.idl \
-    svg/SVGTSpanElement.idl \
-    svg/SVGUnitTypes.idl \
-    svg/SVGUseElement.idl \
-    svg/SVGViewElement.idl \
-    websockets/WebSocket.idl \
-    workers/AbstractWorker.idl \
-    workers/DedicatedWorkerContext.idl \
-    workers/SharedWorker.idl \
-    workers/SharedWorkerContext.idl \
-    workers/Worker.idl \
-    workers/WorkerContext.idl \
-    workers/WorkerLocation.idl \
-    xml/DOMParser.idl \
-    xml/XMLHttpRequest.idl \
-    xml/XMLHttpRequestException.idl \
-    xml/XMLHttpRequestProgressEvent.idl \
-    xml/XMLHttpRequestUpload.idl \
-    xml/XMLSerializer.idl \
-    xml/XPathNSResolver.idl \
-    xml/XPathException.idl \
-    xml/XPathExpression.idl \
-    xml/XPathResult.idl \
-    xml/XPathEvaluator.idl \
-    xml/XSLTProcessor.idl
-
-
 SOURCES += \
     accessibility/AccessibilityImageMapLink.cpp \
     accessibility/AccessibilityMediaControls.cpp \    
+    accessibility/AccessibilityMenuList.cpp \
+    accessibility/AccessibilityMenuListOption.cpp \
+    accessibility/AccessibilityMenuListPopup.cpp \
     accessibility/AccessibilityObject.cpp \    
     accessibility/AccessibilityList.cpp \    
     accessibility/AccessibilityListBox.cpp \    
     accessibility/AccessibilityListBoxOption.cpp \    
     accessibility/AccessibilityRenderObject.cpp \    
+    accessibility/AccessibilityScrollbar.cpp \
     accessibility/AccessibilitySlider.cpp \    
     accessibility/AccessibilityARIAGrid.cpp \    
     accessibility/AccessibilityARIAGridCell.cpp \    
@@ -704,6 +275,8 @@ SOURCES += \
     accessibility/AccessibilityTableRow.cpp \    
     accessibility/AXObjectCache.cpp \
     bindings/js/GCController.cpp \
+    bindings/js/DOMObjectHashTableMap.cpp \
+    bindings/js/DOMWrapperWorld.cpp \
     bindings/js/JSCallbackData.cpp \
     bindings/js/JSAttrCustom.cpp \
     bindings/js/JSCDATASectionCustom.cpp \
@@ -722,12 +295,15 @@ SOURCES += \
     bindings/js/JSCustomXPathNSResolver.cpp \
     bindings/js/JSDataGridColumnListCustom.cpp \
     bindings/js/JSDataGridDataSource.cpp \
+    bindings/js/JSDebugWrapperSet.cpp \
     bindings/js/JSDocumentCustom.cpp \
     bindings/js/JSDocumentFragmentCustom.cpp \
+    bindings/js/JSDOMFormDataCustom.cpp \
     bindings/js/JSDOMGlobalObject.cpp \
     bindings/js/JSDOMWindowBase.cpp \
     bindings/js/JSDOMWindowCustom.cpp \
     bindings/js/JSDOMWindowShell.cpp \
+    bindings/js/JSDOMWrapper.cpp \
     bindings/js/JSElementCustom.cpp \
     bindings/js/JSEventCustom.cpp \
     bindings/js/JSEventSourceConstructor.cpp \
@@ -754,9 +330,8 @@ SOURCES += \
     bindings/js/JSHTMLSelectElementCustom.cpp \
     bindings/js/JSImageConstructor.cpp \
     bindings/js/JSImageDataCustom.cpp \
-    bindings/js/JSInspectedObjectWrapper.cpp \
-    bindings/js/JSInspectorBackendCustom.cpp \
-    bindings/js/JSInspectorCallbackWrapper.cpp \
+    bindings/js/JSInjectedScriptHostCustom.cpp \
+    bindings/js/JSInspectorFrontendHostCustom.cpp \
     bindings/js/JSLocationCustom.cpp \
     bindings/js/JSNamedNodeMapCustom.cpp \
     bindings/js/JSNavigatorCustom.cpp  \
@@ -766,7 +341,6 @@ SOURCES += \
     bindings/js/JSNodeIteratorCustom.cpp \
     bindings/js/JSNodeListCustom.cpp \
     bindings/js/JSOptionConstructor.cpp \
-    bindings/js/JSQuarantinedObjectWrapper.cpp \
     bindings/js/JSStyleSheetCustom.cpp \
     bindings/js/JSStyleSheetListCustom.cpp \
     bindings/js/JSTextCustom.cpp \
@@ -788,15 +362,21 @@ SOURCES += \
     bindings/js/JSEventListener.cpp \
     bindings/js/JSLazyEventListener.cpp \
     bindings/js/JSPluginElementFunctions.cpp \
+    bindings/js/JSPopStateEventCustom.cpp \
+    bindings/js/JavaScriptProfile.h \
+    bindings/js/JavaScriptProfileNode.h \
+    bindings/js/JavaScriptProfile.cpp \
+    bindings/js/JavaScriptProfileNode.cpp \
     bindings/js/ScriptArray.cpp \
     bindings/js/ScriptCachedFrameData.cpp \
     bindings/js/ScriptCallFrame.cpp \
     bindings/js/ScriptCallStack.cpp \
     bindings/js/ScriptController.cpp \
+    bindings/js/ScriptDebugServer.cpp \
     bindings/js/ScriptEventListener.cpp \
     bindings/js/ScriptFunctionCall.cpp \
     bindings/js/ScriptObject.cpp \
-    bindings/js/ScriptObjectQuarantine.cpp \
+    bindings/js/ScriptProfiler.cpp \
     bindings/js/ScriptState.cpp \
     bindings/js/ScriptValue.cpp \
     bindings/js/ScheduledAction.cpp \
@@ -806,14 +386,15 @@ SOURCES += \
     bridge/NP_jsobject.cpp \
     bridge/npruntime.cpp \
     bridge/runtime_array.cpp \
-    bridge/runtime.cpp \
     bridge/runtime_method.cpp \
     bridge/runtime_object.cpp \
     bridge/runtime_root.cpp \
+    bridge/c/CRuntimeObject.cpp \
     bridge/c/c_class.cpp \
     bridge/c/c_instance.cpp \
     bridge/c/c_runtime.cpp \
     bridge/c/c_utility.cpp \
+    bridge/jsc/BridgeJSC.cpp \
     css/CSSBorderImageValue.cpp \
     css/CSSCanvasValue.cpp \
     css/CSSCharsetRule.cpp \
@@ -880,18 +461,20 @@ SOURCES += \
     dom/BeforeTextInsertedEvent.cpp \
     dom/BeforeUnloadEvent.cpp \
     dom/CDATASection.cpp \
+    dom/CanvasSurface.cpp \
     dom/CharacterData.cpp \
     dom/CheckedRadioButtons.cpp \
     dom/ChildNodeList.cpp \
-    dom/ClassNames.cpp \
     dom/ClassNodeList.cpp \
     dom/ClientRect.cpp \
     dom/ClientRectList.cpp \
     dom/Clipboard.cpp \
     dom/ClipboardEvent.cpp \
     dom/Comment.cpp \
+    dom/CompositionEvent.cpp \
     dom/ContainerNode.cpp \
     dom/CSSMappedAttributeDeclaration.cpp \
+    dom/CustomEvent.cpp \
     dom/Document.cpp \
     dom/DocumentFragment.cpp \
     dom/DocumentType.cpp \
@@ -929,6 +512,7 @@ SOURCES += \
     dom/OptionElement.cpp \
     dom/OverflowEvent.cpp \
     dom/PageTransitionEvent.cpp \
+    dom/PopStateEvent.cpp \
     dom/Position.cpp \
     dom/PositionIterator.cpp \
     dom/ProcessingInstruction.cpp \
@@ -940,12 +524,16 @@ SOURCES += \
     dom/ScriptExecutionContext.cpp \
     dom/SelectElement.cpp \
     dom/SelectorNodeList.cpp \
+    dom/SpaceSplitString.cpp \
     dom/StaticNodeList.cpp \
     dom/StyledElement.cpp \
     dom/StyleElement.cpp \
     dom/TagNodeList.cpp \
     dom/Text.cpp \
     dom/TextEvent.cpp \
+    dom/Touch.cpp \
+    dom/TouchEvent.cpp \
+    dom/TouchList.cpp \
     dom/Traversal.cpp \
     dom/TreeWalker.cpp \
     dom/UIEvent.cpp \
@@ -1009,6 +597,7 @@ SOURCES += \
     history/HistoryItem.cpp \
     history/qt/HistoryItemQt.cpp \
     history/PageCache.cpp \
+    html/Blob.cpp \
     html/canvas/CanvasGradient.cpp \
     html/canvas/CanvasPattern.cpp \
     html/canvas/CanvasPixelArray.cpp \
@@ -1018,7 +607,9 @@ SOURCES += \
     html/CollectionCache.cpp \
     html/DataGridColumn.cpp \
     html/DataGridColumnList.cpp \
+    html/DateComponents.cpp \
     html/DOMDataGridDataSource.cpp \
+    html/DOMFormData.cpp \
     html/File.cpp \
     html/FileList.cpp \
     html/FormDataList.cpp \
@@ -1086,9 +677,9 @@ SOURCES += \
     html/HTMLPlugInElement.cpp \
     html/HTMLPlugInImageElement.cpp \
     html/HTMLPreElement.cpp \
+    html/HTMLProgressElement.cpp \
     html/HTMLQuoteElement.cpp \
     html/HTMLScriptElement.cpp \
-    html/HTMLNoScriptElement.cpp \
     html/HTMLSelectElement.cpp \
     html/HTMLStyleElement.cpp \
     html/HTMLTableCaptionElement.cpp \
@@ -1106,14 +697,19 @@ SOURCES += \
     html/HTMLViewSourceDocument.cpp \
     html/ImageData.cpp \
     html/PreloadScanner.cpp \
+    html/StepRange.cpp \
     html/ValidityState.cpp \
     inspector/ConsoleMessage.cpp \
+    inspector/InjectedScript.cpp \
+    inspector/InjectedScriptHost.cpp \
     inspector/InspectorBackend.cpp \
     inspector/InspectorController.cpp \
     inspector/InspectorDatabaseResource.cpp \
     inspector/InspectorDOMAgent.cpp \
     inspector/InspectorDOMStorageResource.cpp \
     inspector/InspectorFrontend.cpp \
+    inspector/InspectorFrontendClientLocal.cpp \
+    inspector/InspectorFrontendHost.cpp \
     inspector/InspectorResource.cpp \
     inspector/InspectorTimelineAgent.cpp \
     inspector/TimelineRecordFactory.cpp \
@@ -1182,6 +778,8 @@ SOURCES += \
     page/FrameTree.cpp \
     page/FrameView.cpp \
     page/Geolocation.cpp \
+    page/GeolocationController.cpp \
+    page/GeolocationPositionCache.cpp \
     page/History.cpp \
     page/Location.cpp \
     page/MouseEventWithHitTestResults.cpp \
@@ -1194,6 +792,7 @@ SOURCES += \
     page/SecurityOrigin.cpp \
     page/Screen.cpp \
     page/Settings.cpp \
+    page/SpatialNavigation.cpp \
     page/UserContentURLPattern.cpp \
     page/WindowFeatures.cpp \
     page/XSSAuditor.cpp \
@@ -1219,8 +818,8 @@ SOURCES += \
     platform/FileChooser.cpp \
     platform/GeolocationService.cpp \
     platform/image-decoders/qt/RGBA32BufferQt.cpp \
-    platform/graphics/filters/FEGaussianBlur.cpp \
     platform/graphics/FontDescription.cpp \
+    platform/graphics/FontFallbackList.cpp \
     platform/graphics/FontFamily.cpp \
     platform/graphics/BitmapImage.cpp \
     platform/graphics/Color.cpp \
@@ -1231,6 +830,7 @@ SOURCES += \
     platform/graphics/FloatSize.cpp \
     platform/graphics/FontData.cpp \
     platform/graphics/Font.cpp \
+    platform/graphics/FontCache.cpp \
     platform/graphics/GeneratedImage.cpp \
     platform/graphics/Gradient.cpp \
     platform/graphics/GraphicsContext.cpp \
@@ -1245,6 +845,8 @@ SOURCES += \
     platform/graphics/Pen.cpp \
     platform/graphics/SegmentedFontData.cpp \
     platform/graphics/SimpleFontData.cpp \
+    platform/graphics/TiledBackingStore.cpp \
+    platform/graphics/transforms/AffineTransform.cpp \
     platform/graphics/transforms/TransformationMatrix.cpp \
     platform/graphics/transforms/MatrixTransformOperation.cpp \
     platform/graphics/transforms/Matrix3DTransformOperation.cpp \
@@ -1302,6 +904,7 @@ SOURCES += \
     plugins/PluginView.cpp \
     rendering/AutoTableLayout.cpp \
     rendering/break_lines.cpp \
+    rendering/BidiRun.cpp \
     rendering/CounterNode.cpp \
     rendering/EllipsisBox.cpp \
     rendering/FixedTableLayout.cpp \
@@ -1320,6 +923,7 @@ SOURCES += \
     rendering/RenderButton.cpp \
     rendering/RenderCounter.cpp \
     rendering/RenderDataGrid.cpp \
+    rendering/RenderEmbeddedObject.cpp \
     rendering/RenderFieldset.cpp \
     rendering/RenderFileUploadControl.cpp \
     rendering/RenderFlexibleBox.cpp \
@@ -1340,8 +944,13 @@ SOURCES += \
     rendering/RenderObjectChildList.cpp \
     rendering/RenderPart.cpp \
     rendering/RenderPartObject.cpp \
+    rendering/RenderProgress.cpp \
     rendering/RenderReplaced.cpp \
     rendering/RenderReplica.cpp \
+    rendering/RenderRuby.cpp \
+    rendering/RenderRubyBase.cpp \
+    rendering/RenderRubyRun.cpp \
+    rendering/RenderRubyText.cpp \
     rendering/RenderScrollbar.cpp \
     rendering/RenderScrollbarPart.cpp \
     rendering/RenderScrollbarTheme.cpp \
@@ -1389,6 +998,7 @@ SOURCES += \
     rendering/style/StyleVisualData.cpp \
     xml/DOMParser.cpp \
     xml/XMLHttpRequest.cpp \
+    xml/XMLHttpRequestProgressEventThrottle.cpp \
     xml/XMLHttpRequestUpload.cpp \
     xml/XMLSerializer.cpp 
 
@@ -1403,6 +1013,7 @@ HEADERS += \
     accessibility/AccessibilityMediaControls.h \
     accessibility/AccessibilityObject.h \
     accessibility/AccessibilityRenderObject.h \
+    accessibility/AccessibilityScrollbar.h \
     accessibility/AccessibilitySlider.h \
     accessibility/AccessibilityTableCell.h \
     accessibility/AccessibilityTableColumn.h \
@@ -1411,8 +1022,9 @@ HEADERS += \
     accessibility/AccessibilityTableRow.h \
     accessibility/AXObjectCache.h \
     bindings/js/CachedScriptSourceProvider.h \
-    bindings/js/DOMObjectWithSVGContext.h \
     bindings/js/GCController.h \
+    bindings/js/DOMObjectHashTableMap.h \
+    bindings/js/DOMWrapperWorld.h \
     bindings/js/JSCallbackData.h \
     bindings/js/JSAudioConstructor.h \
     bindings/js/JSCSSStyleDeclarationCustom.h \
@@ -1424,13 +1036,16 @@ HEADERS += \
     bindings/js/JSCustomSQLTransactionErrorCallback.h \
     bindings/js/JSCustomVoidCallback.h \
     bindings/js/JSCustomXPathNSResolver.h \
+    bindings/js/JSDatabaseCallback.h \
     bindings/js/JSDataGridDataSource.h \
+    bindings/js/JSDebugWrapperSet.h \
     bindings/js/JSDOMBinding.h \
     bindings/js/JSDOMGlobalObject.h \
     bindings/js/JSDOMWindowBase.h \
     bindings/js/JSDOMWindowBase.h \
     bindings/js/JSDOMWindowCustom.h \
     bindings/js/JSDOMWindowShell.h \
+    bindings/js/JSDOMWrapper.h \
     bindings/js/JSEventListener.h \
     bindings/js/JSEventSourceConstructor.h \
     bindings/js/JSEventTarget.h \
@@ -1441,15 +1056,13 @@ HEADERS += \
     bindings/js/JSHTMLObjectElementCustom.h \
     bindings/js/JSHTMLSelectElementCustom.h \
     bindings/js/JSImageConstructor.h \
-    bindings/js/JSInspectedObjectWrapper.h \
-    bindings/js/JSInspectorCallbackWrapper.h \
     bindings/js/JSLazyEventListener.h \
     bindings/js/JSLocationCustom.h \
     bindings/js/JSMessageChannelConstructor.h \
+    bindings/js/JSNodeCustom.h \
     bindings/js/JSNodeFilterCondition.h \
     bindings/js/JSOptionConstructor.h \
     bindings/js/JSPluginElementFunctions.h \
-    bindings/js/JSQuarantinedObjectWrapper.h \
     bindings/js/JSSharedWorkerConstructor.h \
     bindings/js/JSStorageCustom.h \
     bindings/js/JSWebKitCSSMatrixConstructor.h \
@@ -1468,26 +1081,30 @@ HEADERS += \
     bindings/js/ScriptEventListener.h \
     bindings/js/ScriptFunctionCall.h \
     bindings/js/ScriptObject.h \
-    bindings/js/ScriptObjectQuarantine.h \
     bindings/js/ScriptSourceCode.h \
     bindings/js/ScriptSourceProvider.h \
     bindings/js/ScriptState.h \
     bindings/js/ScriptValue.h \
+    bindings/js/ScriptWrappable.h \
     bindings/js/SerializedScriptValue.h \
     bindings/js/StringSourceProvider.h \
+    bindings/js/WebCoreJSClientData.h \
     bindings/js/WorkerScriptController.h \
+    bridge/Bridge.h \
+    bridge/c/CRuntimeObject.h \
     bridge/c/c_class.h \
     bridge/c/c_instance.h \
     bridge/c/c_runtime.h \
     bridge/c/c_utility.h \
+    bridge/jsc/BridgeJSC.h \
     bridge/IdentifierRep.h \
     bridge/NP_jsobject.h \
     bridge/npruntime.h \
     bridge/qt/qt_class.h \
     bridge/qt/qt_instance.h \
     bridge/qt/qt_runtime.h \
+    bridge/qt/qt_pixmapruntime.h \
     bridge/runtime_array.h \
-    bridge/runtime.h \
     bridge/runtime_method.h \
     bridge/runtime_object.h \
     bridge/runtime_root.h \
@@ -1560,7 +1177,6 @@ HEADERS += \
     dom/CharacterData.h \
     dom/CheckedRadioButtons.h \
     dom/ChildNodeList.h \
-    dom/ClassNames.h \
     dom/ClassNodeList.h \
     dom/ClientRect.h \
     dom/ClientRectList.h \
@@ -1569,6 +1185,7 @@ HEADERS += \
     dom/Comment.h \
     dom/ContainerNode.h \
     dom/CSSMappedAttributeDeclaration.h \
+    dom/CustomEvent.h \
     dom/default/PlatformMessagePortChannel.h \
     dom/DocumentFragment.h \
     dom/Document.h \
@@ -1617,12 +1234,16 @@ HEADERS += \
     dom/ScriptExecutionContext.h \
     dom/SelectElement.h \
     dom/SelectorNodeList.h \
+    dom/SpaceSplitString.h \
     dom/StaticNodeList.h \
     dom/StyledElement.h \
     dom/StyleElement.h \
     dom/TagNodeList.h \
     dom/TextEvent.h \
     dom/Text.h \
+    dom/Touch.h \
+    dom/TouchEvent.h \
+    dom/TouchList.h \
     dom/TransformSource.h \
     dom/Traversal.h \
     dom/TreeWalker.h \
@@ -1682,6 +1303,7 @@ HEADERS += \
     history/CachedPage.h \
     history/HistoryItem.h \
     history/PageCache.h \
+    html/Blob.h \
     html/canvas/CanvasGradient.h \
     html/canvas/CanvasPattern.h \
     html/canvas/CanvasPixelArray.h \
@@ -1691,7 +1313,9 @@ HEADERS += \
     html/CollectionCache.h \
     html/DataGridColumn.h \
     html/DataGridColumnList.h \
+    html/DateComponents.h \
     html/DOMDataGridDataSource.h \
+    html/DOMFormData.h \
     html/File.h \
     html/FileList.h \
     html/FormDataList.h \
@@ -1761,6 +1385,7 @@ HEADERS += \
     html/HTMLPlugInElement.h \
     html/HTMLPlugInImageElement.h \
     html/HTMLPreElement.h \
+    html/HTMLProgressElement.h \
     html/HTMLQuoteElement.h \
     html/HTMLScriptElement.h \
     html/HTMLSelectElement.h \
@@ -1782,20 +1407,23 @@ HEADERS += \
     html/HTMLViewSourceDocument.h \
     html/ImageData.h \
     html/PreloadScanner.h \
+    html/StepRange.h \
     html/TimeRanges.h \
     html/ValidityState.h \
     inspector/ConsoleMessage.h \
+    inspector/InjectedScript.h \
+    inspector/InjectedScriptHost.h \
     inspector/InspectorBackend.h \
     inspector/InspectorController.h \
     inspector/InspectorDatabaseResource.h \
     inspector/InspectorDOMStorageResource.h \
     inspector/InspectorFrontend.h \
+    inspector/InspectorFrontendClient.h \
+    inspector/InspectorFrontendClientLocal.h \
+    inspector/InspectorFrontendHost.h \
     inspector/InspectorResource.h \
     inspector/InspectorTimelineAgent.h \
     inspector/JavaScriptCallFrame.h \
-    inspector/JavaScriptDebugServer.h \
-    inspector/JavaScriptProfile.h \
-    inspector/JavaScriptProfileNode.h \
     inspector/TimelineRecordFactory.h \
     loader/appcache/ApplicationCacheGroup.h \
     loader/appcache/ApplicationCacheHost.h \
@@ -1855,6 +1483,7 @@ HEADERS += \
     page/Chrome.h \
     page/Console.h \
     page/ContextMenuController.h \
+    page/ContextMenuProvider.h \
     page/Coordinates.h \
     page/DOMSelection.h \
     page/DOMTimer.h \
@@ -1867,6 +1496,7 @@ HEADERS += \
     page/FrameTree.h \
     page/FrameView.h \
     page/Geolocation.h \
+    page/GeolocationPositionCache.h \
     page/Geoposition.h \
     page/HaltablePlugin.h \
     page/History.h \
@@ -1883,9 +1513,11 @@ HEADERS += \
     page/Screen.h \
     page/SecurityOrigin.h \
     page/Settings.h \
+    page/SpatialNavigation.h \
     page/WindowFeatures.h \
     page/WorkerNavigator.h \
     page/XSSAuditor.h \
+    page/ZoomMode.h \
     platform/animation/Animation.h \
     platform/animation/AnimationList.h \
     platform/Arena.h \
@@ -1924,6 +1556,8 @@ HEADERS += \
     platform/graphics/GraphicsTypes.h \
     platform/graphics/Image.h \
     platform/graphics/ImageSource.h \
+    platform/graphics/IntPoint.h \
+    platform/graphics/IntPointHash.h \
     platform/graphics/IntRect.h \
     platform/graphics/MediaPlayer.h \
     platform/graphics/Path.h \
@@ -1935,6 +1569,9 @@ HEADERS += \
     platform/graphics/qt/StillImageQt.h \
     platform/graphics/SegmentedFontData.h \
     platform/graphics/SimpleFontData.h \
+    platform/graphics/Tile.h \
+    platform/graphics/TiledBackingStore.h \    
+    platform/graphics/TiledBackingStoreClient.h \
     platform/graphics/transforms/Matrix3DTransformOperation.h \
     platform/graphics/transforms/MatrixTransformOperation.h \
     platform/graphics/transforms/PerspectiveTransformOperation.h \
@@ -1950,6 +1587,7 @@ HEADERS += \
     platform/Logging.h \
     platform/MIMETypeRegistry.h \
     platform/network/AuthenticationChallengeBase.h \
+    platform/network/AuthenticationClient.h \
     platform/network/Credential.h \
     platform/network/FormDataBuilder.h \
     platform/network/FormData.h \
@@ -1962,9 +1600,12 @@ HEADERS += \
     platform/network/ResourceHandle.h \
     platform/network/ResourceRequestBase.h \
     platform/network/ResourceResponseBase.h \
+    platform/PlatformTouchEvent.h \
+    platform/PlatformTouchPoint.h \
     platform/qt/ClipboardQt.h \
     platform/qt/QWebPageClient.h \
-    platform/qt/QWebPopup.h \
+    platform/qt/QtAbstractWebPopup.h \
+    platform/qt/QtStyleOptionWebComboBox.h \
     platform/qt/RenderThemeQt.h \
     platform/qt/ScrollbarThemeQt.h \
     platform/Scrollbar.h \
@@ -2031,6 +1672,7 @@ HEADERS += \
     rendering/RenderButton.h \
     rendering/RenderCounter.h \
     rendering/RenderDataGrid.h \
+    rendering/RenderEmbeddedObject.h \
     rendering/RenderFieldset.h \
     rendering/RenderFileUploadControl.h \
     rendering/RenderFlexibleBox.h \
@@ -2054,8 +1696,13 @@ HEADERS += \
     rendering/RenderPart.h \
     rendering/RenderPartObject.h \
     rendering/RenderPath.h \
+    rendering/RenderProgress.h \
     rendering/RenderReplaced.h \
     rendering/RenderReplica.h \
+    rendering/RenderRuby.h \
+    rendering/RenderRubyBase.h \
+    rendering/RenderRubyRun.h \
+    rendering/RenderRubyText.h \
     rendering/RenderScrollbar.h \
     rendering/RenderScrollbarPart.h \
     rendering/RenderScrollbarTheme.h \
@@ -2068,7 +1715,11 @@ HEADERS += \
     rendering/RenderSVGInline.h \
     rendering/RenderSVGInlineText.h \
     rendering/RenderSVGModelObject.h \
+    rendering/RenderSVGResource.h \
+    rendering/RenderSVGResourceClipper.h \
+    rendering/RenderSVGResourceMasker.h \
     rendering/RenderSVGRoot.h \
+    rendering/RenderSVGShadowTreeRootContainer.h \
     rendering/RenderSVGText.h \
     rendering/RenderSVGTextPath.h \
     rendering/RenderSVGTransformableContainer.h \
@@ -2121,9 +1772,12 @@ HEADERS += \
     rendering/SVGCharacterLayoutInfo.h \
     rendering/SVGInlineFlowBox.h \
     rendering/SVGInlineTextBox.h \
+    rendering/SVGMarkerData.h \
+    rendering/SVGMarkerLayoutInfo.h \
     rendering/SVGRenderSupport.h \
     rendering/SVGRenderTreeAsText.h \
     rendering/SVGRootInlineBox.h \
+    rendering/SVGShadowTreeElements.h \
     rendering/TextControlInnerElements.h \
     rendering/TransformState.h \
     svg/animation/SMILTimeContainer.h \
@@ -2151,17 +1805,19 @@ HEADERS += \
     svg/graphics/SVGPaintServerPattern.h \
     svg/graphics/SVGPaintServerRadialGradient.h \
     svg/graphics/SVGPaintServerSolid.h \
-    svg/graphics/SVGResourceClipper.h \
     svg/graphics/SVGResourceFilter.h \
     svg/graphics/SVGResource.h \
     svg/graphics/SVGResourceMarker.h \
-    svg/graphics/SVGResourceMasker.h \
     svg/SVGAElement.h \
     svg/SVGAltGlyphElement.h \
     svg/SVGAngle.h \
     svg/SVGAnimateColorElement.h \
     svg/SVGAnimatedPathData.h \
     svg/SVGAnimatedPoints.h \
+    svg/SVGAnimatedProperty.h \
+    svg/SVGAnimatedPropertySynchronizer.h \
+    svg/SVGAnimatedPropertyTraits.h \
+    svg/SVGAnimatedTemplate.h \
     svg/SVGAnimateElement.h \
     svg/SVGAnimateMotionElement.h \
     svg/SVGAnimateTransformElement.h \
@@ -2178,6 +1834,7 @@ HEADERS += \
     svg/SVGElement.h \
     svg/SVGElementInstance.h \
     svg/SVGElementInstanceList.h \
+    svg/SVGElementRareData.h \
     svg/SVGEllipseElement.h \
     svg/SVGExternalResourcesRequired.h \
     svg/SVGFEBlendElement.h \
@@ -2285,7 +1942,6 @@ HEADERS += \
     svg/SVGViewSpec.h \
     svg/SVGZoomAndPan.h \
     svg/SVGZoomEvent.h \
-    svg/SynchronizablePropertyController.h \
     wml/WMLAccessElement.h \
     wml/WMLAElement.h \
     wml/WMLAnchorElement.h \
@@ -2359,6 +2015,7 @@ HEADERS += \
     xml/XSLTProcessor.h \
     xml/XSLTUnicodeSort.h \
     $$PWD/../WebKit/qt/Api/qwebplugindatabase_p.h \
+    $$PWD/../WebKit/qt/WebCoreSupport/QtFallbackWebPopup.h \
     $$PWD/../WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h \
     $$PWD/platform/network/qt/DnsPrefetchHelper.h
 
@@ -2367,6 +2024,7 @@ SOURCES += \
     bindings/js/ScriptControllerQt.cpp \
     bridge/qt/qt_class.cpp \
     bridge/qt/qt_instance.cpp \
+    bridge/qt/qt_pixmapruntime.cpp \
     bridge/qt/qt_runtime.cpp \
     page/qt/DragControllerQt.cpp \
     page/qt/EventHandlerQt.cpp \
@@ -2374,7 +2032,6 @@ SOURCES += \
     platform/graphics/qt/TransformationMatrixQt.cpp \
     platform/graphics/qt/ColorQt.cpp \
     platform/graphics/qt/FontQt.cpp \
-    platform/graphics/qt/FontQt43.cpp \
     platform/graphics/qt/FontPlatformDataQt.cpp \
     platform/graphics/qt/FloatPointQt.cpp \
     platform/graphics/qt/FloatRectQt.cpp \
@@ -2407,10 +2064,10 @@ SOURCES += \
     platform/qt/FileSystemQt.cpp \
     platform/qt/SharedBufferQt.cpp \
     platform/graphics/qt/FontCacheQt.cpp \
-    platform/graphics/qt/FontCustomPlatformData.cpp \
-    platform/graphics/qt/FontFallbackListQt.cpp \
+    platform/graphics/qt/FontCustomPlatformDataQt.cpp \
     platform/graphics/qt/GlyphPageTreeNodeQt.cpp \
     platform/graphics/qt/SimpleFontDataQt.cpp \
+    platform/graphics/qt/TileQt.cpp \
     platform/qt/KURLQt.cpp \
     platform/qt/Localizations.cpp \
     platform/qt/MIMETypeRegistryQt.cpp \
@@ -2418,8 +2075,10 @@ SOURCES += \
     platform/qt/PlatformKeyboardEventQt.cpp \
     platform/qt/PlatformMouseEventQt.cpp \
     platform/qt/PlatformScreenQt.cpp \
+    platform/qt/PlatformTouchEventQt.cpp \
+    platform/qt/PlatformTouchPointQt.cpp \
     platform/qt/PopupMenuQt.cpp \
-    platform/qt/QWebPopup.cpp \
+    platform/qt/QtAbstractWebPopup.cpp \
     platform/qt/RenderThemeQt.cpp \
     platform/qt/ScrollbarQt.cpp \
     platform/qt/ScrollbarThemeQt.cpp \
@@ -2430,12 +2089,13 @@ SOURCES += \
     platform/qt/LoggingQt.cpp \
     platform/text/qt/StringQt.cpp \
     platform/qt/TemporaryLinkStubs.cpp \
-    platform/text/qt/TextBoundaries.cpp \
+    platform/text/qt/TextBoundariesQt.cpp \
     platform/text/qt/TextBreakIteratorQt.cpp \
     platform/text/qt/TextCodecQt.cpp \
     platform/qt/WheelEventQt.cpp \
     platform/qt/WidgetQt.cpp \
     plugins/qt/PluginDataQt.cpp \
+    ../WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp \
     ../WebKit/qt/WebCoreSupport/ChromeClientQt.cpp \
     ../WebKit/qt/WebCoreSupport/ContextMenuClientQt.cpp \
     ../WebKit/qt/WebCoreSupport/DragClientQt.cpp \
@@ -2458,37 +2118,34 @@ SOURCES += \
     ../WebKit/qt/Api/qwebinspector.cpp \
     ../WebKit/qt/Api/qwebkitversion.cpp
 
+maemo5 {
+    HEADERS += \
+        ../WebKit/qt/WebCoreSupport/QtMaemoWebPopup.h \
+        platform/qt/Maemo5Webstyle.h
+    SOURCES += \
+        ../WebKit/qt/WebCoreSupport/QtMaemoWebPopup.cpp \
+        platform/qt/Maemo5Webstyle.cpp
+}
+
 
-    win32-*|wince*: SOURCES += platform/win/SystemTimeWin.cpp
+    win32-*|wince*: SOURCES += platform/win/SystemTimeWin.cpp \
+                               platform/graphics/win/TransformationMatrixWin.cpp
 
     mac {
         SOURCES += \
             platform/text/cf/StringCF.cpp \
-            platform/text/cf/StringImplCF.cpp
+            platform/text/cf/StringImplCF.cpp \
+            platform/cf/SharedBufferCF.cpp \
+            editing/SmartReplaceCF.cpp
         LIBS_PRIVATE += -framework Carbon -framework AppKit
     }
 
     win32-* {
         LIBS += -lgdi32
         LIBS += -luser32
-        LIBS += -lwinmm
     }
     wince*: LIBS += -lmmtimer
 
-    # Files belonging to the Qt 4.3 build
-    lessThan(QT_MINOR_VERSION, 4) {
-        HEADERS += \
-            $$PWD/../WebKit/qt/Api/qwebnetworkinterface.h \
-            $$PWD/../WebKit/qt/Api/qwebnetworkinterface_p.h \
-            $$PWD/../WebKit/qt/Api/qcookiejar.h
-
-        SOURCES += \
-            ../WebKit/qt/Api/qwebnetworkinterface.cpp \
-            ../WebKit/qt/Api/qcookiejar.cpp
-
-        DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
-     }
-
 contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
 
     SOURCES += plugins/npapi.cpp
@@ -2520,7 +2177,10 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
                 INCLUDEPATH += platform/mac
                 # Note: XP_MACOSX is defined in npapi.h
             } else {
-                !embedded: CONFIG += x11
+                !embedded {
+                    CONFIG += x11
+                    LIBS += -lXrender
+                }
                 SOURCES += \
                     plugins/qt/PluginContainerQt.cpp \
                     plugins/qt/PluginPackageQt.cpp \
@@ -2535,12 +2195,12 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
             INCLUDEPATH += $$PWD/plugins/win \
                            $$PWD/platform/win
     
-            SOURCES += page/win/PageWin.cpp \
-                       plugins/win/PluginDatabaseWin.cpp \
+            SOURCES += plugins/win/PluginDatabaseWin.cpp \
                        plugins/win/PluginPackageWin.cpp \
                        plugins/win/PluginMessageThrottlerWin.cpp \
                        plugins/win/PluginViewWin.cpp \
-                       platform/win/BitmapInfo.cpp
+                       platform/win/BitmapInfo.cpp \
+                       platform/win/WebCoreInstanceHandle.cpp
     
             LIBS += \
                 -ladvapi32 \
@@ -2558,26 +2218,6 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
         plugins/PluginViewNone.cpp
 }
 
-contains(DEFINES, ENABLE_CHANNEL_MESSAGING=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_CHANNEL_MESSAGING=1
-}
-
-contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_ORIENTATION_EVENTS=1
-}
-
-contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=0) {
-    DASHBOARDSUPPORTCSSPROPERTIES -= $$PWD/css/DashboardSupportCSSPropertyNames.in
-}
-
-contains(DEFINES, ENABLE_DATAGRID=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATAGRID=1
-}
-
-contains(DEFINES, ENABLE_EVENTSOURCE=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_EVENTSOURCE=1
-}
-
 contains(DEFINES, ENABLE_SQLITE=1) {
     !system-sqlite:exists( $${SQLITE3SRCDIR}/sqlite3.c ) {
             # Build sqlite3 into WebCore from source
@@ -2611,8 +2251,6 @@ contains(DEFINES, ENABLE_SQLITE=1) {
 
 
 contains(DEFINES, ENABLE_DATABASE=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATABASE=1
-
     SOURCES += \
         storage/ChangeVersionWrapper.cpp \
         storage/DatabaseTask.cpp \
@@ -2630,18 +2268,18 @@ contains(DEFINES, ENABLE_DATABASE=1) {
         bindings/js/JSCustomSQLStatementErrorCallback.cpp \
         bindings/js/JSCustomSQLTransactionCallback.cpp \
         bindings/js/JSCustomSQLTransactionErrorCallback.cpp \
+        bindings/js/JSDatabaseCallback.cpp \
         bindings/js/JSDatabaseCustom.cpp \
         bindings/js/JSSQLResultSetRowListCustom.cpp \
         bindings/js/JSSQLTransactionCustom.cpp
 }
 
 contains(DEFINES, ENABLE_DOM_STORAGE=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_DOM_STORAGE=1
-
     HEADERS += \
         storage/ChangeVersionWrapper.h \
         storage/DatabaseAuthorizer.h \
         storage/Database.h \
+        storage/DatabaseCallback.h \
         storage/DatabaseTask.h \
         storage/DatabaseThread.h \
         storage/DatabaseTracker.h \
@@ -2692,8 +2330,6 @@ contains(DEFINES, ENABLE_ICONDATABASE=1) {
 }
 
 contains(DEFINES, ENABLE_WORKERS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WORKERS=1
-
     SOURCES += \
         bindings/js/JSAbstractWorkerCustom.cpp \
         bindings/js/JSDedicatedWorkerContextCustom.cpp \
@@ -2717,8 +2353,6 @@ contains(DEFINES, ENABLE_WORKERS=1) {
 }
 
 contains(DEFINES, ENABLE_SHARED_WORKERS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_SHARED_WORKERS=1
-
     SOURCES += \
         bindings/js/JSSharedWorkerConstructor.cpp \
         bindings/js/JSSharedWorkerCustom.cpp \
@@ -2729,8 +2363,6 @@ contains(DEFINES, ENABLE_SHARED_WORKERS=1) {
 }
 
 contains(DEFINES, ENABLE_VIDEO=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_VIDEO=1
-
     SOURCES += \
         html/HTMLAudioElement.cpp \
         html/HTMLMediaElement.cpp \
@@ -2743,30 +2375,34 @@ contains(DEFINES, ENABLE_VIDEO=1) {
         rendering/RenderMedia.cpp \
         bindings/js/JSAudioConstructor.cpp
 
-        HEADERS += \
-            platform/graphics/qt/MediaPlayerPrivatePhonon.h
+        # QtMultimedia since 4.7
+        greaterThan(QT_MINOR_VERSION, 6) {
+            HEADERS += platform/graphics/qt/MediaPlayerPrivateQt.h
+            SOURCES += platform/graphics/qt/MediaPlayerPrivateQt.cpp
 
-        SOURCES += \
-            platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
-
-        # Add phonon manually to prevent it from coming first in
-        # the include paths, as Phonon's path.h conflicts with
-        # WebCore's Path.h on case-insensitive filesystems.
-        qtAddLibrary(phonon)
-        INCLUDEPATH -= $$QMAKE_INCDIR_QT/phonon
-        INCLUDEPATH += $$QMAKE_INCDIR_QT/phonon
-        mac {
-            INCLUDEPATH -= $$QMAKE_LIBDIR_QT/phonon.framework/Headers
-            INCLUDEPATH += $$QMAKE_LIBDIR_QT/phonon.framework/Headers
+            QT += multimedia
+        } else {
+            HEADERS += \
+                platform/graphics/qt/MediaPlayerPrivatePhonon.h
+
+            SOURCES += \
+                platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
+
+            # Add phonon manually to prevent it from coming first in
+            # the include paths, as Phonon's path.h conflicts with
+            # WebCore's Path.h on case-insensitive filesystems.
+            qtAddLibrary(phonon)
+            INCLUDEPATH -= $$QMAKE_INCDIR_QT/phonon
+            INCLUDEPATH += $$QMAKE_INCDIR_QT/phonon
+            mac {
+                INCLUDEPATH -= $$QMAKE_LIBDIR_QT/phonon.framework/Headers
+                INCLUDEPATH += $$QMAKE_LIBDIR_QT/phonon.framework/Headers
+            }
         }
 
 }
 
 contains(DEFINES, ENABLE_XPATH=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_XPATH=1
-
-    XPATHBISON = $$PWD/xml/XPathGrammar.y
-
     SOURCES += \
         xml/NativeXPathNSResolver.cpp \
         xml/XPathEvaluator.cpp \
@@ -2789,8 +2425,6 @@ contains(DEFINES, ENABLE_XPATH=1) {
 unix:!mac:CONFIG += link_pkgconfig
 
 contains(DEFINES, ENABLE_XSLT=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_XSLT=1
-
     tobe|!tobe: QT += xmlpatterns
 
     SOURCES += \
@@ -2802,10 +2436,6 @@ contains(DEFINES, ENABLE_XSLT=1) {
         xml/XSLTProcessorQt.cpp
 }
 
-contains(DEFINES, ENABLE_XBL=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_XBL=1
-}
-
 contains(DEFINES, ENABLE_FILTERS=1) {
     SOURCES += \
         platform/graphics/filters/FEBlend.cpp \
@@ -2816,16 +2446,6 @@ contains(DEFINES, ENABLE_FILTERS=1) {
         platform/graphics/filters/FilterEffect.cpp \
         platform/graphics/filters/SourceAlpha.cpp \
         platform/graphics/filters/SourceGraphic.cpp
-
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_FILTERS=1
-}
-
-contains(DEFINES, ENABLE_WCSS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WCSS=1
-    contains(DEFINES, ENABLE_XHTMLMP=0) {
-        DEFINES -= ENABLE_XHTMLMP=0
-        DEFINES += ENABLE_XHTMLMP=1
-    }
 }
 
 contains(DEFINES, ENABLE_WML=1) {
@@ -2866,29 +2486,11 @@ contains(DEFINES, ENABLE_WML=1) {
         wml/WMLTemplateElement.cpp \
         wml/WMLTimerElement.cpp \
         wml/WMLVariables.cpp
-
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WML=1
-
-    WML_NAMES = $$PWD/wml/WMLTagNames.in
-
-    wmlnames_a.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLNames.cpp
-    wmlnames_a.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/wml/WMLTagNames.in --attrs $$PWD/wml/WMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
-    wmlnames_a.input = WML_NAMES
-    wmlnames_a.dependency_type = TYPE_C
-    wmlnames_a.CONFIG = target_predeps
-    wmlnames_a.variable_out = GENERATED_SOURCES
-    addExtraCompilerWithHeader(wmlnames_a)
-    wmlnames_b.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLElementFactory.cpp
-    wmlnames_b.commands = @echo -n ''
-    wmlnames_b.input = SVG_NAMES
-    wmlnames_b.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLNames.cpp
-    wmlnames_b.CONFIG = target_predeps
-    wmlnames_b.variable_out = GENERATED_SOURCES
-    addExtraCompilerWithHeader(wmlnames_b)
 }
 
 contains(DEFINES, ENABLE_XHTMLMP=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_XHTMLMP=1
+    SOURCES += \
+        html/HTMLNoScriptElement.cpp
 }
 
 contains(DEFINES, ENABLE_QT_BEARER=1) {
@@ -2903,12 +2505,6 @@ contains(DEFINES, ENABLE_QT_BEARER=1) {
 }
 
 contains(DEFINES, ENABLE_SVG=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG=1
-
-    SVG_NAMES = $$PWD/svg/svgtags.in
-
-    XLINK_NAMES = $$PWD/svg/xlinkattrs.in
-
     SOURCES += \
 # TODO: this-one-is-not-auto-added! FIXME! tmp/SVGElementFactory.cpp \
         bindings/js/JSSVGElementInstanceCustom.cpp \
@@ -2916,8 +2512,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         bindings/js/JSSVGMatrixCustom.cpp \
         bindings/js/JSSVGPathSegCustom.cpp \
         bindings/js/JSSVGPathSegListCustom.cpp \
-        bindings/js/JSSVGPointListCustom.cpp \
-        bindings/js/JSSVGTransformListCustom.cpp \
         css/SVGCSSComputedStyleDeclaration.cpp \
         css/SVGCSSParser.cpp \
         css/SVGCSSStyleSelector.cpp \
@@ -3055,7 +2649,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/SVGViewElement.cpp \
         svg/SVGViewSpec.cpp \
         svg/SVGZoomAndPan.cpp \
-        svg/SynchronizablePropertyController.cpp \
         svg/animation/SMILTime.cpp \
         svg/animation/SMILTimeContainer.cpp \
         svg/animation/SVGSMILElement.cpp \
@@ -3080,11 +2673,9 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/graphics/SVGPaintServerPattern.cpp \
         svg/graphics/SVGPaintServerRadialGradient.cpp \
         svg/graphics/SVGPaintServerSolid.cpp \
-        svg/graphics/SVGResourceClipper.cpp \
         svg/graphics/SVGResource.cpp \
         svg/graphics/SVGResourceFilter.cpp \
         svg/graphics/SVGResourceMarker.cpp \
-        svg/graphics/SVGResourceMasker.cpp \
         rendering/RenderForeignObject.cpp \
         rendering/RenderPath.cpp \
         rendering/RenderSVGBlock.cpp \
@@ -3095,7 +2686,10 @@ contains(DEFINES, ENABLE_SVG=1) {
         rendering/RenderSVGInline.cpp \
         rendering/RenderSVGInlineText.cpp \
         rendering/RenderSVGModelObject.cpp \
+        rendering/RenderSVGResourceClipper.cpp \
+        rendering/RenderSVGResourceMasker.cpp \
         rendering/RenderSVGRoot.cpp \
+        rendering/RenderSVGShadowTreeRootContainer.cpp \
         rendering/RenderSVGText.cpp \
         rendering/RenderSVGTextPath.cpp \
         rendering/RenderSVGTransformableContainer.cpp \
@@ -3104,83 +2698,19 @@ contains(DEFINES, ENABLE_SVG=1) {
         rendering/SVGCharacterLayoutInfo.cpp \
         rendering/SVGInlineFlowBox.cpp \
         rendering/SVGInlineTextBox.cpp \
+        rendering/SVGMarkerLayoutInfo.cpp \
         rendering/SVGRenderSupport.cpp \
-        rendering/SVGRootInlineBox.cpp
-
-
-        # GENERATOR 5-C:
-        svgnames_a.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
-        svgnames_a.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/svg/svgtags.in --attrs $$PWD/svg/svgattrs.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
-        svgnames_a.input = SVG_NAMES
-        svgnames_a.dependency_type = TYPE_C
-        svgnames_a.CONFIG = target_predeps
-        svgnames_a.variable_out = GENERATED_SOURCES
-        addExtraCompilerWithHeader(svgnames_a)
-        svgnames_b.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGElementFactory.cpp
-        svgnames_b.commands = @echo -n ''
-        svgnames_b.input = SVG_NAMES
-        svgnames_b.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
-        svgnames_b.CONFIG = target_predeps
-        svgnames_b.variable_out = GENERATED_SOURCES
-        addExtraCompilerWithHeader(svgnames_b)
-        svgelementwrapper.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSSVGElementWrapperFactory.cpp
-        svgelementwrapper.commands = @echo -n ''
-        svgelementwrapper.input = SVG_NAMES
-        svgelementwrapper.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
-        svgelementwrapper.CONFIG = target_predeps
-        svgelementwrapper.variable_out = GENERATED_SOURCES
-        addExtraCompiler(svgelementwrapper)
-        svgelementwrapper_header.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSSVGElementWrapperFactory.h
-        svgelementwrapper_header.commands = @echo -n ''
-        svgelementwrapper_header.input = SVG_NAMES
-        svgelementwrapper_header.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
-        svgelementwrapper_header.CONFIG = target_predeps
-        svgelementwrapper_header.variable_out = GENERATED_FILES
-        addExtraCompiler(svgelementwrapper_header)
-
-        # GENERATOR 5-D:
-        xlinknames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}XLinkNames.cpp
-        xlinknames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --attrs $$PWD/svg/xlinkattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$GENERATED_SOURCES_DIR
-        xlinknames.input = XLINK_NAMES
-        xlinknames.dependency_type = TYPE_C
-        xlinknames.CONFIG = target_predeps
-        xlinknames.variable_out = GENERATED_SOURCES
-        addExtraCompilerWithHeader(xlinknames)
-
-} 
-# GENERATOR 6-A:
-cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-cssprops.input = WALDOCSSPROPS
-cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES $$EXTRACSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
-cssprops.CONFIG = target_predeps no_link
-cssprops.variable_out =
-cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES EXTRACSSPROPERTIES
-addExtraCompilerWithHeader(cssprops)
-
-# GENERATOR 6-B:
-cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
-cssvalues.input = WALDOCSSVALUES
-cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$EXTRACSSVALUES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
-cssvalues.CONFIG = target_predeps no_link
-cssvalues.variable_out =
-cssvalues.depend = ${QMAKE_FILE_NAME} EXTRACSSVALUES
-cssvalues.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}${QMAKE_FILE_BASE}.h
-addExtraCompiler(cssvalues)
+        rendering/SVGRootInlineBox.cpp \
+        rendering/SVGShadowTreeElements.cpp
+}
 
 contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
-
     SOURCES += \
         bindings/js/JSJavaScriptCallFrameCustom.cpp \
         inspector/JavaScriptCallFrame.cpp \
-        inspector/JavaScriptDebugServer.cpp \
-        inspector/JavaScriptProfile.cpp \
-        inspector/JavaScriptProfileNode.cpp
 }
 
 contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_OFFLINE_WEB_APPLICATIONS=1
-
 SOURCES += \
     loader/appcache/ApplicationCache.cpp \
     loader/appcache/ApplicationCacheGroup.cpp \
@@ -3193,179 +2723,158 @@ SOURCES += \
 }
 
 contains(DEFINES, ENABLE_WEB_SOCKETS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WEB_SOCKETS=1
+    HEADERS += \
+        websockets/ThreadableWebSocketChannel.h \
+        websockets/ThreadableWebSocketChannelClientWrapper.h \
+        websockets/WebSocket.h \
+        websockets/WebSocketChannel.h \
+        websockets/WebSocketChannelClient.h \
+        websockets/WebSocketHandshake.h \
+        websockets/WebSocketHandshakeRequest.h \
+        platform/network/qt/SocketStreamHandlePrivate.h
 
-SOURCES += \
-    websockets/WebSocket.cpp \
-    websockets/WebSocketChannel.cpp \
-    websockets/WebSocketHandshake.cpp \
-    platform/network/SocketStreamErrorBase.cpp \
-    platform/network/SocketStreamHandleBase.cpp \
-    platform/network/qt/SocketStreamHandleSoup.cpp \
-    bindings/js/JSWebSocketCustom.cpp \
-    bindings/js/JSWebSocketConstructor.cpp
+    SOURCES += \
+        websockets/WebSocket.cpp \
+        websockets/WebSocketChannel.cpp \
+        websockets/WebSocketHandshake.cpp \
+        websockets/WebSocketHandshakeRequest.cpp \
+        websockets/ThreadableWebSocketChannel.cpp \
+        platform/network/SocketStreamErrorBase.cpp \
+        platform/network/SocketStreamHandleBase.cpp \
+        platform/network/qt/SocketStreamHandleQt.cpp \
+        bindings/js/JSWebSocketCustom.cpp \
+        bindings/js/JSWebSocketConstructor.cpp
+
+    contains(DEFINES, ENABLE_WORKERS=1) {
+        HEADERS += \
+            websockets/WorkerThreadableWebSocketChannel.h
+
+        SOURCES += \
+            websockets/WorkerThreadableWebSocketChannel.cpp
+    }
 }
 
-# GENERATOR 1: IDL compiler
-idl.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JS${QMAKE_FILE_BASE}.cpp
-idl.variable_out = GENERATED_SOURCES
-idl.input = IDL_BINDINGS
-idl.commands = perl -I$$PWD/bindings/scripts $$PWD/bindings/scripts/generate-bindings.pl --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" --generator JS --include $$PWD/dom --include $$PWD/html --include $$PWD/xml --include $$PWD/svg --outputDir $$GENERATED_SOURCES_DIR --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_FILE_NAME}
-idl.depends = $$PWD/bindings/scripts/generate-bindings.pl \
-              $$PWD/bindings/scripts/CodeGenerator.pm \
-              $$PWD/bindings/scripts/CodeGeneratorJS.pm \
-              $$PWD/bindings/scripts/IDLParser.pm \
-              $$PWD/bindings/scripts/IDLStructure.pm \
-              $$PWD/bindings/scripts/InFilesParser.pm
-idl.CONFIG += target_predeps
-addExtraCompilerWithHeader(idl)
-
-# GENERATOR 2-A: LUT creator
-domlut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.lut.h
-domlut.commands = perl $$PWD/../JavaScriptCore/create_hash_table ${QMAKE_FILE_NAME} -n WebCore > ${QMAKE_FILE_OUT}
-domlut.depend = ${QMAKE_FILE_NAME}
-domlut.input = DOMLUT_FILES
-domlut.CONFIG += no_link
-addExtraCompiler(domlut)
-
-# GENERATOR 3: tokenizer (flex)
-tokenizer.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-tokenizer.commands = flex -t < ${QMAKE_FILE_NAME} | perl $$PWD/css/maketokenizer > ${QMAKE_FILE_OUT}
-tokenizer.dependency_type = TYPE_C
-tokenizer.input = TOKENIZER
-tokenizer.CONFIG += target_predeps no_link
-tokenizer.variable_out =
-addExtraCompiler(tokenizer)
-
-# GENERATOR 4: CSS grammar
-cssbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-cssbison.commands = perl $$PWD/css/makegrammar.pl ${QMAKE_FILE_NAME} $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}
-cssbison.depend = ${QMAKE_FILE_NAME}
-cssbison.input = CSSBISON
-cssbison.CONFIG = target_predeps
-cssbison.dependency_type = TYPE_C
-cssbison.variable_out = GENERATED_SOURCES
-addExtraCompilerWithHeader(cssbison)
-
-# GENERATOR 5-A:
-htmlnames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
-htmlnames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/html/HTMLTagNames.in --attrs $$PWD/html/HTMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\"  --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
-htmlnames.input = HTML_NAMES
-htmlnames.dependency_type = TYPE_C
-htmlnames.CONFIG = target_predeps
-htmlnames.variable_out = GENERATED_SOURCES
-htmlnames.depends = $$PWD/html/HTMLAttributeNames.in
-addExtraCompilerWithHeader(htmlnames)
-
-htmlelementfactory.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLElementFactory.cpp
-htmlelementfactory.commands = @echo -n ''
-htmlelementfactory.input = HTML_NAMES
-htmlelementfactory.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
-htmlelementfactory.CONFIG = target_predeps
-htmlelementfactory.variable_out = GENERATED_SOURCES
-htmlelementfactory.clean += ${QMAKE_FILE_OUT}
-addExtraCompilerWithHeader(htmlelementfactory)
-
-elementwrapperfactory.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSHTMLElementWrapperFactory.cpp
-elementwrapperfactory.commands = @echo -n ''
-elementwrapperfactory.input = HTML_NAMES
-elementwrapperfactory.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
-elementwrapperfactory.CONFIG = target_predeps
-elementwrapperfactory.variable_out = GENERATED_SOURCES
-elementwrapperfactory.clean += ${QMAKE_FILE_OUT}
-addExtraCompilerWithHeader(elementwrapperfactory)
-
-# GENERATOR 5-B:
-xmlnames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}XMLNames.cpp
-xmlnames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --attrs $$PWD/xml/xmlattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$GENERATED_SOURCES_DIR
-xmlnames.input = XML_NAMES
-xmlnames.dependency_type = TYPE_C
-xmlnames.CONFIG = target_predeps
-xmlnames.variable_out = GENERATED_SOURCES
-addExtraCompilerWithHeader(xmlnames)
-
-# GENERATOR 8-A:
-entities.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLEntityNames.c
-entities.commands = gperf -a -L ANSI-C -C -G -c -o -t --includes --key-positions="*" -N findEntity -D -s 2 < $$PWD/html/HTMLEntityNames.gperf > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLEntityNames.c
-entities.input = ENTITIES_GPERF
-entities.dependency_type = TYPE_C
-entities.CONFIG = target_predeps no_link
-entities.variable_out =
-entities.clean = ${QMAKE_FILE_OUT}
-addExtraCompiler(entities)
-
-# GENERATOR 8-B:
-doctypestrings.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-doctypestrings.input = DOCTYPESTRINGS
-doctypestrings.commands = gperf -CEot -L ANSI-C --includes --key-positions="*" -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
-doctypestrings.dependency_type = TYPE_C
-doctypestrings.CONFIG += target_predeps no_link
-doctypestrings.variable_out =
-doctypestrings.clean = ${QMAKE_FILE_OUT}
-addExtraCompiler(doctypestrings)
-
-# GENERATOR 8-C:
-colordata.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}ColorData.c
-colordata.commands = gperf -CDEot -L ANSI-C --includes --key-positions="*" -N findColor -D -s 2 < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
-colordata.input = COLORDAT_GPERF
-colordata.CONFIG = target_predeps no_link
-colordata.variable_out =
-addExtraCompiler(colordata)
-
-# GENERATOR 9:
-stylesheets.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}UserAgentStyleSheetsData.cpp
-stylesheets.commands = perl $$PWD/css/make-css-file-arrays.pl --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}UserAgentStyleSheets.h ${QMAKE_FILE_OUT} $$STYLESHEETS_EMBED
-STYLESHEETS_EMBED_GENERATOR_SCRIPT = $$PWD/css/make-css-file-arrays.pl
-stylesheets.input = STYLESHEETS_EMBED_GENERATOR_SCRIPT
-stylesheets.depends = $$STYLESHEETS_EMBED
-stylesheets.CONFIG = target_predeps
-stylesheets.variable_out = GENERATED_SOURCES
-stylesheets.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}UserAgentStyleSheets.h
-addExtraCompilerWithHeader(stylesheets, $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}UserAgentStyleSheets.h)
-
-# GENERATOR 10: XPATH grammar
-xpathbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-xpathbison.commands = bison -d -p xpathyy ${QMAKE_FILE_NAME} -o $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
-xpathbison.depend = ${QMAKE_FILE_NAME}
-xpathbison.input = XPATHBISON
-xpathbison.CONFIG = target_predeps
-xpathbison.dependency_type = TYPE_C
-xpathbison.variable_out = GENERATED_SOURCES
-addExtraCompilerWithHeader(xpathbison)
-
-# GENERATOR 11: WebKit Version
-# The appropriate Apple-maintained Version.xcconfig file for WebKit version information is in WebKit/mac/Configurations/.
-webkitversion.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WebKitVersion.h
-webkitversion.commands = perl $$PWD/../WebKit/scripts/generate-webkitversion.pl --config $$PWD/../WebKit/mac/Configurations/Version.xcconfig --outputDir $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
-WEBKITVERSION_SCRIPT = $$PWD/../WebKit/scripts/generate-webkitversion.pl
-webkitversion.input = WEBKITVERSION_SCRIPT
-webkitversion.CONFIG = target_predeps
-webkitversion.depend = $$PWD/../WebKit/scripts/generate-webkitversion.pl
-webkitversion.variable_out = GENERATED_SOURCES
-webkitversion.clean = ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}WebKitVersion.h
-addExtraCompiler(webkitversion)
+contains(DEFINES, ENABLE_3D_CANVAS=1) {
+QT += opengl
+HEADERS += \
+	bindings/js/JSWebGLArrayBufferConstructor.h \
+	bindings/js/JSWebGLArrayHelper.h \
+	bindings/js/JSWebGLByteArrayConstructor.h \
+	bindings/js/JSWebGLFloatArrayConstructor.h \
+	bindings/js/JSWebGLIntArrayConstructor.h \
+	bindings/js/JSWebGLShortArrayConstructor.h \
+	bindings/js/JSWebGLUnsignedByteArrayConstructor.h \
+	bindings/js/JSWebGLUnsignedIntArrayConstructor.h \
+	bindings/js/JSWebGLUnsignedShortArrayConstructor.h \
+	html/canvas/CanvasContextAttributes.h \
+	html/canvas/CanvasObject.h \
+	html/canvas/WebGLActiveInfo.h \
+	html/canvas/WebGLArrayBuffer.h \
+	html/canvas/WebGLArray.h \
+	html/canvas/WebGLBuffer.h \
+	html/canvas/WebGLByteArray.h \
+	html/canvas/WebGLContextAttributes.h \
+	html/canvas/WebGLFloatArray.h \
+	html/canvas/WebGLFramebuffer.h \
+	html/canvas/WebGLGetInfo.h \
+	html/canvas/WebGLIntArray.h \
+	html/canvas/WebGLProgram.h \
+	html/canvas/WebGLRenderbuffer.h \
+	html/canvas/WebGLRenderingContext.h \
+	html/canvas/WebGLShader.h \
+	html/canvas/WebGLShortArray.h \
+	html/canvas/WebGLTexture.h \
+	html/canvas/WebGLUniformLocation.h \
+	html/canvas/WebGLUnsignedByteArray.h \
+	html/canvas/WebGLUnsignedIntArray.h \
+	html/canvas/WebGLUnsignedShortArray.h \
+    platform/graphics/GraphicsContext3D.h 
+
+SOURCES += \
+	bindings/js/JSWebGLArrayBufferConstructor.cpp \
+	bindings/js/JSWebGLArrayCustom.cpp \
+	bindings/js/JSWebGLByteArrayConstructor.cpp \
+	bindings/js/JSWebGLByteArrayCustom.cpp \
+	bindings/js/JSWebGLFloatArrayConstructor.cpp \
+	bindings/js/JSWebGLFloatArrayCustom.cpp \
+	bindings/js/JSWebGLIntArrayConstructor.cpp \
+	bindings/js/JSWebGLIntArrayCustom.cpp \
+	bindings/js/JSWebGLRenderingContextCustom.cpp \
+	bindings/js/JSWebGLShortArrayConstructor.cpp \
+	bindings/js/JSWebGLShortArrayCustom.cpp \
+	bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp \
+	bindings/js/JSWebGLUnsignedByteArrayCustom.cpp \
+	bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp \
+	bindings/js/JSWebGLUnsignedIntArrayCustom.cpp \
+	bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp \
+	bindings/js/JSWebGLUnsignedShortArrayCustom.cpp \
+	html/canvas/CanvasContextAttributes.cpp \
+    html/canvas/CanvasObject.cpp \
+	html/canvas/WebGLArrayBuffer.cpp \
+	html/canvas/WebGLArray.cpp \
+	html/canvas/WebGLBuffer.cpp \
+	html/canvas/WebGLByteArray.cpp \
+	html/canvas/WebGLContextAttributes.cpp \
+	html/canvas/WebGLFloatArray.cpp \
+	html/canvas/WebGLFramebuffer.cpp \
+	html/canvas/WebGLGetInfo.cpp \
+	html/canvas/WebGLIntArray.cpp \
+	html/canvas/WebGLProgram.cpp \
+	html/canvas/WebGLRenderbuffer.cpp \
+	html/canvas/WebGLRenderingContext.cpp \
+	html/canvas/WebGLShader.cpp \
+	html/canvas/WebGLShortArray.cpp \
+	html/canvas/WebGLTexture.cpp \
+	html/canvas/WebGLUniformLocation.cpp \
+	html/canvas/WebGLUnsignedByteArray.cpp \
+	html/canvas/WebGLUnsignedIntArray.cpp \
+	html/canvas/WebGLUnsignedShortArray.cpp \
+    platform/graphics/GraphicsContext3D.cpp \
+    platform/graphics/qt/GraphicsContext3DQt.cpp \
+
+}
 
+contains(DEFINES, ENABLE_SYMBIAN_DIALOG_PROVIDERS) {
+    # this feature requires the S60 platform private BrowserDialogsProvider.h header file
+    # and is therefore not enabled by default but only meant for platform builds.
+    symbian {
+        LIBS += -lbrowserdialogsprovider
+    }
+}
 
 include($$PWD/../WebKit/qt/Api/headers.pri)
 HEADERS += $$WEBKIT_API_HEADERS
+
 !CONFIG(QTDIR_build) {
-    target.path = $$[QT_INSTALL_LIBS]
-    headers.files = $$WEBKIT_API_HEADERS
-    headers.path = $$[QT_INSTALL_HEADERS]/QtWebKit
+    exists(../include/QtWebKit/classheaders.pri):include(../include/QtWebKit/classheaders.pri)
+    WEBKIT_INSTALL_HEADERS = $$WEBKIT_API_HEADERS $$WEBKIT_CLASS_HEADERS
+
+    !symbian {
+        headers.files = $$WEBKIT_INSTALL_HEADERS
+        headers.path = $$[QT_INSTALL_HEADERS]/QtWebKit
+        target.path = $$[QT_INSTALL_LIBS]
 
-    VERSION=$${QT_MAJOR_VERSION}.$${QT_MINOR_VERSION}.$${QT_PATCH_VERSION}
+        INSTALLS += target headers
+    } else {
+        # INSTALLS is not implemented in qmake's s60 generators, copy headers manually
+        inst_headers.commands = $$QMAKE_COPY ${QMAKE_FILE_NAME} ${QMAKE_FILE_OUT}
+        inst_headers.input = WEBKIT_INSTALL_HEADERS
+        inst_headers.output = $$[QT_INSTALL_HEADERS]/QtWebKit/${QMAKE_FILE_BASE}${QMAKE_FILE_EXT}
+        QMAKE_EXTRA_COMPILERS += inst_headers
+
+        install.depends += compiler_inst_headers_make_all
+        QMAKE_EXTRA_TARGETS += install
+    }
 
     win32-*|wince* {
         DLLDESTDIR = $$OUTPUT_DIR/bin
+        TARGET = $$qtLibraryTarget($$TARGET)
 
-        dlltarget.commands = $(COPY_FILE) $(DESTDIR)$(TARGET) $$[QT_INSTALL_BINS]
+        dlltarget.commands = $(COPY_FILE) $(DESTDIR_TARGET) $$[QT_INSTALL_BINS]
         dlltarget.CONFIG = no_path
         INSTALLS += dlltarget
     }
 
-
-    INSTALLS += target headers
-
     unix {
         CONFIG += create_pc create_prl
         QMAKE_PKGCONFIG_LIBDIR = $$target.path
@@ -3389,7 +2898,7 @@ HEADERS += $$WEBKIT_API_HEADERS
 
             CONFIG += lib_bundle qt_no_framework_direct_includes qt_framework
             FRAMEWORK_HEADERS.version = Versions
-            FRAMEWORK_HEADERS.files = $$WEBKIT_API_HEADERS
+            FRAMEWORK_HEADERS.files = $${headers.files}
             FRAMEWORK_HEADERS.path = Headers
             QMAKE_BUNDLE_DATA += FRAMEWORK_HEADERS
         }
@@ -3399,8 +2908,7 @@ HEADERS += $$WEBKIT_API_HEADERS
     }
 }
 
-CONFIG(QTDIR_build):isEqual(QT_MAJOR_VERSION, 4):greaterThan(QT_MINOR_VERSION, 4) {
-    # start with 4.5
+CONFIG(QTDIR_build) {
     # Remove the following 2 lines if you want debug information in WebCore
     CONFIG -= separate_debug_info
     CONFIG += no_debug_info
@@ -3423,14 +2931,28 @@ CONFIG(QTDIR_build):isEqual(QT_MAJOR_VERSION, 4):greaterThan(QT_MINOR_VERSION, 4
             plugins/win/PaintHooks.asm
     }
 }
+contains(DEFINES, WTF_USE_ACCELERATED_COMPOSITING) {
+HEADERS += \
+    rendering/RenderLayerBacking.h \
+    rendering/RenderLayerCompositor.h \
+    platform/graphics/GraphicsLayer.h \
+    platform/graphics/GraphicsLayerClient.h \
+    platform/graphics/qt/GraphicsLayerQt.h
+SOURCES += \
+    platform/graphics/GraphicsLayer.cpp \
+    platform/graphics/qt/GraphicsLayerQt.cpp \
+    rendering/RenderLayerBacking.cpp \
+    rendering/RenderLayerCompositor.cpp
+}
 
 symbian {
     shared {
         contains(CONFIG, def_files) {
             DEF_FILE=../WebKit/qt/symbian
+            # defFilePath is for Qt4.6 compatibility
+            defFilePath=../WebKit/qt/symbian
+        } else {
+            MMP_RULES += EXPORTUNFROZEN
         }
     }
 }
-
-# WebKit doesn't compile in C++0x mode
-*-g++*:QMAKE_CXXFLAGS -= -std=c++0x -std=gnu++0x
diff --git a/src/3rdparty/webkit/WebCore/WebCore.qrc b/src/3rdparty/webkit/WebCore/WebCore.qrc
index 69f860a0c9..6da93c67fb 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.qrc
+++ b/src/3rdparty/webkit/WebCore/WebCore.qrc
@@ -12,5 +12,6 @@
     <file alias="copyCursor.png">Resources/copyCursor.png</file>
     <file alias="progressCursor.png">Resources/progressCursor.png</file>
     <file alias="aliasCursor.png">Resources/aliasCursor.png</file>
+    <file alias="deleteButton.png">Resources/deleteButton.png</file>
 </qresource>
 </RCC>
diff --git a/src/3rdparty/webkit/WebCore/WebCorePrefix.cpp b/src/3rdparty/webkit/WebCore/WebCorePrefix.cpp
index b522e1dfe2..02a5643c79 100644
--- a/src/3rdparty/webkit/WebCore/WebCorePrefix.cpp
+++ b/src/3rdparty/webkit/WebCore/WebCorePrefix.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,4 +24,3 @@
  */
 
 #include "WebCorePrefix.h"
-
diff --git a/src/3rdparty/webkit/WebCore/WebCorePrefix.h b/src/3rdparty/webkit/WebCore/WebCorePrefix.h
index 6c8e200c18..ac2014ee00 100644
--- a/src/3rdparty/webkit/WebCore/WebCorePrefix.h
+++ b/src/3rdparty/webkit/WebCore/WebCorePrefix.h
@@ -18,7 +18,7 @@
  *
  */
 
-/* This prefix file should contain only:
+/* This prefix file should contain only: 
  *    1) files to precompile for faster builds
  *    2) in one case at least: OS-X-specific performance bug workarounds
  *    3) the special trick to catch us using new or delete without including "config.h"
@@ -62,6 +62,19 @@
 #include <pthread.h>
 #endif // defined(WIN32) || defined(_WIN32)
 
+#if defined(ANDROID)
+#ifdef __cplusplus
+// Must come before include of algorithm.
+#define PREFIX_FOR_WEBCORE 1
+#define EXPORT __attribute__((visibility("default")))
+#endif
+// Android uses a single set of include directories when building WebKit and
+// JavaScriptCore. Since WebCore/ is included before JavaScriptCore/, Android
+// includes JavaScriptCore/config.h explicitly here to make sure it gets picked
+// up.
+#include <JavaScriptCore/config.h>
+#endif
+
 #include <sys/types.h>
 #include <fcntl.h>
 #if defined(__APPLE__)
@@ -105,7 +118,7 @@
 
 #include <time.h>
 
-#ifndef BUILDING_WX__
+#if !defined(BUILDING_WX__) && !defined(ANDROID)
 #include <CoreFoundation/CoreFoundation.h>
 #ifdef WIN_CAIRO
 #include <ConditionalMacros.h>
@@ -121,7 +134,7 @@
 #endif
 
 #endif
-#endif
+#endif  // !defined(BUILDING_WX__) && !defined(ANDROID)
 
 #ifdef __OBJC__
 #import <Cocoa/Cocoa.h>
@@ -140,3 +153,4 @@
 #undef try
 #undef catch
 #endif
+
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
index 55199a3257..c347a81759 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,14 +30,18 @@
 #include "AXObjectCache.h"
 
 #include "AccessibilityARIAGrid.h"
-#include "AccessibilityARIAGridRow.h"
 #include "AccessibilityARIAGridCell.h"
+#include "AccessibilityARIAGridRow.h"
+#include "AccessibilityImageMapLink.h"
 #include "AccessibilityList.h"
 #include "AccessibilityListBox.h"
 #include "AccessibilityListBoxOption.h"
-#include "AccessibilityImageMapLink.h"
 #include "AccessibilityMediaControls.h"
+#include "AccessibilityMenuList.h"
+#include "AccessibilityMenuListPopup.h"
+#include "AccessibilityMenuListOption.h"
 #include "AccessibilityRenderObject.h"
+#include "AccessibilityScrollbar.h"
 #include "AccessibilitySlider.h"
 #include "AccessibilityTable.h"
 #include "AccessibilityTableCell.h"
@@ -46,6 +50,8 @@
 #include "AccessibilityTableRow.h"
 #include "FocusController.h"
 #include "Frame.h"
+#include "HTMLAreaElement.h"
+#include "HTMLImageElement.h"
 #include "HTMLNames.h"
 #if ENABLE(VIDEO)
 #include "MediaControlElements.h"
@@ -80,6 +86,35 @@ AXObjectCache::~AXObjectCache()
     }
 }
 
+AccessibilityObject* AXObjectCache::focusedImageMapUIElement(HTMLAreaElement* areaElement)
+{
+    // Find the corresponding accessibility object for the HTMLAreaElement. This should be
+    // in the list of children for its corresponding image.
+    if (!areaElement)
+        return 0;
+    
+    HTMLImageElement* imageElement = areaElement->imageElement();
+    if (!imageElement)
+        return 0;
+    
+    AccessibilityObject* axRenderImage = areaElement->document()->axObjectCache()->getOrCreate(imageElement->renderer());
+    if (!axRenderImage)
+        return 0;
+    
+    AccessibilityObject::AccessibilityChildrenVector imageChildren = axRenderImage->children();
+    unsigned count = imageChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* child = imageChildren[k].get();
+        if (!child->isImageMapLink())
+            continue;
+        
+        if (static_cast<AccessibilityImageMapLink*>(child)->areaElement() == areaElement)
+            return child;
+    }    
+    
+    return 0;
+}
+    
 AccessibilityObject* AXObjectCache::focusedUIElementForPage(const Page* page)
 {
     // get the focused node in the page
@@ -88,6 +123,9 @@ AccessibilityObject* AXObjectCache::focusedUIElementForPage(const Page* page)
     if (!focusedNode)
         focusedNode = focusedDocument;
 
+    if (focusedNode->hasTagName(areaTag))
+        return focusedImageMapUIElement(static_cast<HTMLAreaElement*>(focusedNode));
+    
     RenderObject* focusedNodeRenderer = focusedNode->renderer();
     if (!focusedNodeRenderer)
         return 0;
@@ -141,11 +179,16 @@ AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
         RefPtr<AccessibilityObject> newObj = 0;
         if (renderer->isListBox())
             newObj = AccessibilityListBox::create(renderer);
-        else if (node && (nodeIsAriaType(node, "list") || node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))
+        else if (renderer->isMenuList())
+            newObj = AccessibilityMenuList::create(renderer);
+
+        // If the node is aria role="list" or the aria role is empty and its a ul/ol/dl type (it shouldn't be a list if aria says otherwise). 
+        else if (node && ((nodeIsAriaType(node, "list") || nodeIsAriaType(node, "directory"))
+                          || (nodeIsAriaType(node, nullAtom) && (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))))
             newObj = AccessibilityList::create(renderer);
         
         // aria tables
-        else if (nodeIsAriaType(node, "grid"))
+        else if (nodeIsAriaType(node, "grid") || nodeIsAriaType(node, "treegrid"))
             newObj = AccessibilityARIAGrid::create(renderer);
         else if (nodeIsAriaType(node, "row"))
             newObj = AccessibilityARIAGridRow::create(renderer);
@@ -191,23 +234,32 @@ AccessibilityObject* AXObjectCache::getOrCreate(AccessibilityRole role)
     
     // will be filled in...
     switch (role) {
-        case ListBoxOptionRole:
-            obj = AccessibilityListBoxOption::create();
-            break;
-        case ImageMapLinkRole:
-            obj = AccessibilityImageMapLink::create();
-            break;
-        case ColumnRole:
-            obj = AccessibilityTableColumn::create();
-            break;            
-        case TableHeaderContainerRole:
-            obj = AccessibilityTableHeaderContainer::create();
-            break;   
-        case SliderThumbRole:
-            obj = AccessibilitySliderThumb::create();
-            break;
-        default:
-            obj = 0;
+    case ListBoxOptionRole:
+        obj = AccessibilityListBoxOption::create();
+        break;
+    case ImageMapLinkRole:
+        obj = AccessibilityImageMapLink::create();
+        break;
+    case ColumnRole:
+        obj = AccessibilityTableColumn::create();
+        break;            
+    case TableHeaderContainerRole:
+        obj = AccessibilityTableHeaderContainer::create();
+        break;   
+    case SliderThumbRole:
+        obj = AccessibilitySliderThumb::create();
+        break;
+    case MenuListPopupRole:
+        obj = AccessibilityMenuListPopup::create();
+        break;
+    case MenuListOptionRole:
+        obj = AccessibilityMenuListOption::create();
+        break;
+    case ScrollBarRole:
+        obj = AccessibilityScrollbar::create();
+        break;
+    default:
+        obj = 0;
     }
     
     if (obj)
@@ -235,9 +287,8 @@ void AXObjectCache::remove(AXID axID)
     removeAXID(obj);
     
     // finally remove the object
-    if (!m_objects.take(axID)) {
+    if (!m_objects.take(axID))
         return;
-    }
     
     ASSERT(m_objects.size() >= m_idsInUse.size());    
 }
@@ -261,7 +312,7 @@ AXID AXObjectCache::platformGenerateAXID() const
     AXID objID = lastUsedID;
     do {
         ++objID;
-    } while (objID == 0 || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
+    } while (!objID || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
 
     lastUsedID = objID;
 
@@ -286,20 +337,29 @@ AXID AXObjectCache::getAXID(AccessibilityObject* obj)
     return objID;
 }
 
-void AXObjectCache::removeAXID(AccessibilityObject* obj)
+void AXObjectCache::removeAXID(AccessibilityObject* object)
 {
-    if (!obj)
+    if (!object)
         return;
     
-    AXID objID = obj->axObjectID();
-    if (objID == 0)
+    AXID objID = object->axObjectID();
+    if (!objID)
         return;
     ASSERT(!HashTraits<AXID>::isDeletedValue(objID));
     ASSERT(m_idsInUse.contains(objID));
-    obj->setAXObjectID(0);
+    object->setAXObjectID(0);
     m_idsInUse.remove(objID);
 }
 
+#if HAVE(ACCESSIBILITY)
+void AXObjectCache::contentChanged(RenderObject* renderer)
+{
+    AccessibilityObject* object = getOrCreate(renderer);
+    if (object)
+        object->contentChanged(); 
+}
+#endif
+
 void AXObjectCache::childrenChanged(RenderObject* renderer)
 {
     if (!renderer)
@@ -339,7 +399,7 @@ void AXObjectCache::notificationPostTimerFired(Timer<AXObjectCache>*)
 }
     
 #if HAVE(ACCESSIBILITY)
-void AXObjectCache::postNotification(RenderObject* renderer, AXNotification notification, bool postToElement)
+void AXObjectCache::postNotification(RenderObject* renderer, AXNotification notification, bool postToElement, PostType postType)
 {
     // Notifications for text input objects are sent to that object.
     // All others are sent to the top WebArea.
@@ -348,28 +408,35 @@ void AXObjectCache::postNotification(RenderObject* renderer, AXNotification noti
     
     // Get an accessibility object that already exists. One should not be created here
     // because a render update may be in progress and creating an AX object can re-trigger a layout
-    RefPtr<AccessibilityObject> obj = get(renderer);
-    while (!obj && renderer) {
+    RefPtr<AccessibilityObject> object = get(renderer);
+    while (!object && renderer) {
         renderer = renderer->parent();
-        obj = get(renderer); 
+        object = get(renderer); 
     }
     
     if (!renderer)
         return;
-
-    if (obj && !postToElement)
-        obj = obj->observableObject();
-    
-    Document* document = renderer->document();
-    if (!obj && document)
-        obj = get(document->renderer());
     
-    if (!obj)
+    postNotification(object.get(), renderer->document(), notification, postToElement, postType);
+}
+
+void AXObjectCache::postNotification(AccessibilityObject* object, Document* document, AXNotification notification, bool postToElement, PostType postType)
+{
+    if (object && !postToElement)
+        object = object->observableObject();
+
+    if (!object && document)
+        object = get(document->renderer());
+
+    if (!object)
         return;
 
-    m_notificationsToPost.append(make_pair(obj, notification));
-    if (!m_notificationPostTimer.isActive())
-        m_notificationPostTimer.startOneShot(0);
+    if (postType == PostAsynchronously) {
+        m_notificationsToPost.append(make_pair(object, notification));
+        if (!m_notificationPostTimer.isActive())
+            m_notificationPostTimer.startOneShot(0);
+    } else
+        postPlatformNotification(object, notification);
 }
 
 void AXObjectCache::selectedChildrenChanged(RenderObject* renderer)
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
index 5a75f84fe9..dad73f2b60 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,104 +42,117 @@ class WebCoreTextMarker;
 
 namespace WebCore {
 
-    class Node;
-    class Page;
-    class RenderObject;
-    class String;
-    class VisiblePosition;
-
-    struct TextMarkerData  {
-        AXID axID;
-        Node* node;
-        int offset;
-        EAffinity affinity;
+class HTMLAreaElement;
+class Node;
+class Page;
+class RenderObject;
+class String;
+class VisiblePosition;
+
+struct TextMarkerData {
+    AXID axID;
+    Node* node;
+    int offset;
+    EAffinity affinity;
+};
+
+enum PostType { PostSynchronously, PostAsynchronously };
+
+class AXObjectCache : public Noncopyable {
+public:
+    AXObjectCache();
+    ~AXObjectCache();
+
+    static AccessibilityObject* focusedUIElementForPage(const Page*);
+
+    // to be used with render objects
+    AccessibilityObject* getOrCreate(RenderObject*);
+    
+    // used for objects without backing elements
+    AccessibilityObject* getOrCreate(AccessibilityRole);
+    
+    // will only return the AccessibilityObject if it already exists
+    AccessibilityObject* get(RenderObject*);
+    
+    void remove(RenderObject*);
+    void remove(AXID);
+
+    void detachWrapper(AccessibilityObject*);
+    void attachWrapper(AccessibilityObject*);
+    void childrenChanged(RenderObject*);
+    void selectedChildrenChanged(RenderObject*);
+    // Called by a node when text or a text equivalent (e.g. alt) attribute is changed.
+    void contentChanged(RenderObject*);
+    
+    void handleActiveDescendantChanged(RenderObject*);
+    void handleAriaRoleChanged(RenderObject*);
+    void handleFocusedUIElementChanged(RenderObject* oldFocusedRenderer, RenderObject* newFocusedRenderer);
+    void handleScrolledToAnchor(const Node* anchorNode);
+
+    static void enableAccessibility() { gAccessibilityEnabled = true; }
+    static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
+    
+    static bool accessibilityEnabled() { return gAccessibilityEnabled; }
+    static bool accessibilityEnhancedUserInterfaceEnabled() { return gAccessibilityEnhancedUserInterfaceEnabled; }
+
+    void removeAXID(AccessibilityObject*);
+    bool isIDinUse(AXID id) const { return m_idsInUse.contains(id); }
+    AXID platformGenerateAXID() const;
+    AccessibilityObject* objectFromAXID(AXID id) const { return m_objects.get(id).get(); }
+
+    // Text marker utilities.
+    static void textMarkerDataForVisiblePosition(TextMarkerData&, const VisiblePosition&);
+    static VisiblePosition visiblePositionForTextMarkerData(TextMarkerData&);
+
+    enum AXNotification {
+        AXActiveDescendantChanged,
+        AXCheckedStateChanged,
+        AXFocusedUIElementChanged,
+        AXLayoutComplete,
+        AXLoadComplete,
+        AXSelectedChildrenChanged,
+        AXSelectedTextChanged,
+        AXValueChanged,
+        AXScrolledToAnchor,
+        AXLiveRegionChanged,
+        AXMenuListValueChanged,
     };
 
-    class AXObjectCache {
-    public:
-        AXObjectCache();
-        ~AXObjectCache();
-
-        static AccessibilityObject* focusedUIElementForPage(const Page*);
-
-        // to be used with render objects
-        AccessibilityObject* getOrCreate(RenderObject*);
-        
-        // used for objects without backing elements
-        AccessibilityObject* getOrCreate(AccessibilityRole);
-        
-        // will only return the AccessibilityObject if it already exists
-        AccessibilityObject* get(RenderObject*);
-        
-        void remove(RenderObject*);
-        void remove(AXID);
-
-        void detachWrapper(AccessibilityObject*);
-        void attachWrapper(AccessibilityObject*);
-        void childrenChanged(RenderObject*);
-        void selectedChildrenChanged(RenderObject*);
-        void handleActiveDescendantChanged(RenderObject*);
-        void handleAriaRoleChanged(RenderObject*);
-        void handleFocusedUIElementChanged(RenderObject* oldFocusedRenderer, RenderObject* newFocusedRenderer);
-        void handleScrolledToAnchor(const Node* anchorNode);
-
-        static void enableAccessibility() { gAccessibilityEnabled = true; }
-        static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
-        
-        static bool accessibilityEnabled() { return gAccessibilityEnabled; }
-        static bool accessibilityEnhancedUserInterfaceEnabled() { return gAccessibilityEnhancedUserInterfaceEnabled; }
-
-        void removeAXID(AccessibilityObject*);
-        bool isIDinUse(AXID id) const { return m_idsInUse.contains(id); }
-        AXID platformGenerateAXID() const;
-        AccessibilityObject* objectFromAXID(AXID id) const { return m_objects.get(id).get(); }
-
-        // Text marker utilities.
-        static void textMarkerDataForVisiblePosition(TextMarkerData&, const VisiblePosition&);
-        static VisiblePosition visiblePositionForTextMarkerData(TextMarkerData&);
-
-        enum AXNotification {
-            AXCheckedStateChanged,
-            AXFocusedUIElementChanged,
-            AXLayoutComplete,
-            AXLoadComplete,
-            AXSelectedChildrenChanged,
-            AXSelectedTextChanged,
-            AXValueChanged,
-            AXScrolledToAnchor,
-        };
-        
-        void postNotification(RenderObject*, AXNotification, bool postToElement);
-
-    protected:
-        void postPlatformNotification(AccessibilityObject*, AXNotification);
-
-    private:
-        HashMap<AXID, RefPtr<AccessibilityObject> > m_objects;
-        HashMap<RenderObject*, AXID> m_renderObjectMapping;
-        static bool gAccessibilityEnabled;
-        static bool gAccessibilityEnhancedUserInterfaceEnabled;
-        
-        HashSet<AXID> m_idsInUse;
-        
-        Timer<AXObjectCache> m_notificationPostTimer;
-        Vector<pair<RefPtr<AccessibilityObject>, AXNotification> > m_notificationsToPost;
-        void notificationPostTimerFired(Timer<AXObjectCache>*);
-        
-        AXID getAXID(AccessibilityObject*);
-        bool nodeIsAriaType(Node* node, String role);
-    };
+    void postNotification(RenderObject*, AXNotification, bool postToElement, PostType = PostAsynchronously);
+    void postNotification(AccessibilityObject*, Document*, AXNotification, bool postToElement, PostType = PostAsynchronously);
+
+protected:
+    void postPlatformNotification(AccessibilityObject*, AXNotification);
+
+private:
+    HashMap<AXID, RefPtr<AccessibilityObject> > m_objects;
+    HashMap<RenderObject*, AXID> m_renderObjectMapping;
+    static bool gAccessibilityEnabled;
+    static bool gAccessibilityEnhancedUserInterfaceEnabled;
+    
+    HashSet<AXID> m_idsInUse;
+    
+    Timer<AXObjectCache> m_notificationPostTimer;
+    Vector<pair<RefPtr<AccessibilityObject>, AXNotification> > m_notificationsToPost;
+    void notificationPostTimerFired(Timer<AXObjectCache>*);
+    
+    static AccessibilityObject* focusedImageMapUIElement(HTMLAreaElement*);
+    
+    AXID getAXID(AccessibilityObject*);
+    bool nodeIsAriaType(Node*, String role);
+};
 
 #if !HAVE(ACCESSIBILITY)
-    inline void AXObjectCache::handleActiveDescendantChanged(RenderObject*) { }
-    inline void AXObjectCache::handleAriaRoleChanged(RenderObject*) { }
-    inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
-    inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
-    inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
-    inline void AXObjectCache::postNotification(RenderObject*, AXNotification, bool postToElement) { }
-    inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification) { }
-    inline void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*) { }
-    inline void AXObjectCache::handleScrolledToAnchor(const Node*) { }
+inline void AXObjectCache::handleActiveDescendantChanged(RenderObject*) { }
+inline void AXObjectCache::handleAriaRoleChanged(RenderObject*) { }
+inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
+inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
+inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
+inline void AXObjectCache::postNotification(RenderObject*, AXNotification, bool postToElement, PostType) { }
+inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification) { }
+inline void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*) { }
+inline void AXObjectCache::handleScrolledToAnchor(const Node*) { }
+inline void AXObjectCache::contentChanged(RenderObject*) { }
 #endif
 
 }
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp
index 69c4512695..58b3fa1ab3 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp
@@ -29,11 +29,11 @@
 #include "config.h"
 #include "AccessibilityARIAGrid.h"
 
+#include "AXObjectCache.h"
 #include "AccessibilityTableCell.h"
 #include "AccessibilityTableColumn.h"
 #include "AccessibilityTableHeaderContainer.h"
 #include "AccessibilityTableRow.h"
-#include "AXObjectCache.h"
 #include "RenderObject.h"
 
 using namespace std;
@@ -131,13 +131,12 @@ AccessibilityTableCell* AccessibilityARIAGrid::cellForColumnAndRow(unsigned colu
     if (!m_renderer)
         return 0;
     
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     if (column >= columnCount() || row >= rowCount())
         return 0;
     
-    AccessibilityObject *tableRow = m_rows[row].get();
+    AccessibilityObject* tableRow = m_rows[row].get();
     if (!tableRow)
         return 0;
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h
index 32c8ce9e9b..3511f0fa26 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h
@@ -52,6 +52,9 @@ public:
     virtual AccessibilityTableCell* cellForColumnAndRow(unsigned column, unsigned row);
 
 private:
+    // ARIA treegrids and grids support selected rows.
+    virtual bool supportsSelectedRows() { return true; }    
+
     void addChild(AccessibilityObject* object, HashSet<AccessibilityObject*>& appendedRows, unsigned& columnCount);
 };
 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp
index 6e1f1c8122..7d562d95e7 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp
@@ -30,6 +30,7 @@
 #include "AccessibilityARIAGridRow.h"
 
 #include "AccessibilityObject.h"
+#include "AccessibilityTable.h"
 #include "RenderObject.h"
 
 using namespace std;
@@ -50,6 +51,71 @@ PassRefPtr<AccessibilityARIAGridRow> AccessibilityARIAGridRow::create(RenderObje
     return adoptRef(new AccessibilityARIAGridRow(renderer));
 }
 
+bool AccessibilityARIAGridRow::isARIATreeGridRow() const
+{
+    AccessibilityObject* parent = parentTable();
+    if (!parent)
+        return false;
+    
+    return parent->ariaRoleAttribute() == TreeGridRole;
+}
+    
+void AccessibilityARIAGridRow::disclosedRows(AccessibilityChildrenVector& disclosedRows)
+{
+    // The contiguous disclosed rows will be the rows in the table that 
+    // have an aria-level of plus 1 from this row.
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isDataTable())
+        return;
+    
+    // Search for rows that match the correct level. 
+    // Only take the subsequent rows from this one that are +1 from this row's level.
+    int index = rowIndex();
+    if (index < 0)
+        return;
+    
+    unsigned level = hierarchicalLevel();
+    AccessibilityChildrenVector& allRows = static_cast<AccessibilityTable*>(parent)->rows();
+    int rowCount = allRows.size();
+    for (int k = index + 1; k < rowCount; ++k) {
+        AccessibilityObject* row = allRows[k].get();
+        // Stop at the first row that doesn't match the correct level.
+        if (row->hierarchicalLevel() != level + 1)
+            break;
+
+        disclosedRows.append(row);
+    }
+}
+    
+AccessibilityObject* AccessibilityARIAGridRow::disclosedByRow() const
+{
+    // The row that discloses this one is the row in the table
+    // that is aria-level subtract 1 from this row.
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isDataTable())
+        return 0;
+    
+    // If the level is 1 or less, than nothing discloses this row.
+    unsigned level = hierarchicalLevel();
+    if (level <= 1)
+        return 0;
+    
+    // Search for the previous row that matches the correct level.
+    int index = rowIndex();
+    AccessibilityChildrenVector& allRows = static_cast<AccessibilityTable*>(parent)->rows();
+    int rowCount = allRows.size();
+    if (index >= rowCount)
+        return 0;
+    
+    for (int k = index - 1; k >= 0; --k) {
+        AccessibilityObject* row = allRows[k].get();
+        if (row->hierarchicalLevel() == level - 1)
+            return row;
+    }
+    
+    return 0;
+}
+    
 AccessibilityObject* AccessibilityARIAGridRow::parentTable() const
 {
     AccessibilityObject* parent = parentObjectUnignored();
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h
index c2ca8b8e32..f89ea92adc 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h
@@ -41,8 +41,14 @@ public:
     static PassRefPtr<AccessibilityARIAGridRow> create(RenderObject*);
     virtual ~AccessibilityARIAGridRow();
     
+    void disclosedRows(AccessibilityChildrenVector&);
+    AccessibilityObject* disclosedByRow() const;
+    
     virtual AccessibilityObject* headerObject();
     virtual AccessibilityObject* parentTable() const;    
+    
+private:
+    virtual bool isARIATreeGridRow() const;
 }; 
     
 } // namespace WebCore 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityAllInOne.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityAllInOne.cpp
index 83cf5d0892..9cf2068e4a 100755
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityAllInOne.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityAllInOne.cpp
@@ -25,6 +25,7 @@
 
 // This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
 
+#include <AXObjectCache.cpp>
 #include <AccessibilityARIAGrid.cpp>
 #include <AccessibilityARIAGridCell.cpp>
 #include <AccessibilityARIAGridRow.cpp>
@@ -35,10 +36,10 @@
 #include <AccessibilityMediaControls.cpp>
 #include <AccessibilityObject.cpp>
 #include <AccessibilityRenderObject.cpp>
+#include <AccessibilityScrollbar.cpp>
 #include <AccessibilitySlider.cpp>
 #include <AccessibilityTable.cpp>
 #include <AccessibilityTableCell.cpp>
 #include <AccessibilityTableColumn.cpp>
 #include <AccessibilityTableHeaderContainer.cpp>
 #include <AccessibilityTableRow.cpp>
-#include <AXObjectCache.cpp>
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp
index 943122e4b9..06150b9fcb 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityImageMapLink.h"
 
-#include "AccessibilityRenderObject.h"
 #include "AXObjectCache.h"
+#include "AccessibilityRenderObject.h"
 #include "Document.h"
 #include "HTMLNames.h"
 #include "IntRect.h"
@@ -68,6 +68,18 @@ AccessibilityObject* AccessibilityImageMapLink::parentObject() const
     return m_mapElement->document()->axObjectCache()->getOrCreate(m_mapElement->renderer());
 }
     
+AccessibilityRole AccessibilityImageMapLink::roleValue() const
+{
+    if (!m_areaElement)
+        return WebCoreLinkRole;
+    
+    const AtomicString& ariaRole = m_areaElement->getAttribute(roleAttr);
+    if (!ariaRole.isEmpty())
+        return AccessibilityObject::ariaRoleToWebCoreRole(ariaRole);
+
+    return WebCoreLinkRole;
+}
+    
 Element* AccessibilityImageMapLink::actionElement() const
 {
     return anchorElement();
@@ -134,5 +146,15 @@ IntSize AccessibilityImageMapLink::size() const
 {
     return elementRect().size();
 }
-    
+
+String AccessibilityImageMapLink::stringValueForMSAA() const
+{
+    return url();
+}
+
+String AccessibilityImageMapLink::nameForMSAA() const
+{
+    return accessibilityDescription();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h
index 2c27e4609a..ca4c62c71b 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h
@@ -44,21 +44,29 @@ public:
     virtual ~AccessibilityImageMapLink();
     
     void setHTMLAreaElement(HTMLAreaElement* element) { m_areaElement = element; }
+    HTMLAreaElement* areaElement() const { return m_areaElement; }
+    
     void setHTMLMapElement(HTMLMapElement* element) { m_mapElement = element; }    
+    HTMLMapElement* mapElement() const { return m_mapElement; }
+    
     void setParent(AccessibilityObject* parent) { m_parent = parent; }
         
-    virtual AccessibilityRole roleValue() const { return WebCoreLinkRole; }
+    virtual AccessibilityRole roleValue() const;
     virtual bool accessibilityIsIgnored() const { return false; }
     virtual bool isEnabled() const { return true; }
-
+    
     virtual AccessibilityObject* parentObject() const;
     virtual Element* anchorElement() const;
     virtual Element* actionElement() const;
     virtual KURL url() const;
     virtual bool isLink() const { return true; } 
+    virtual bool isLinked() const { return true; }
     virtual String title() const;
     virtual String accessibilityDescription() const;
-    
+
+    virtual String stringValueForMSAA() const;
+    virtual String nameForMSAA() const;
+
     virtual IntSize size() const;
     virtual IntRect elementRect() const;
 
@@ -66,6 +74,8 @@ private:
     HTMLAreaElement* m_areaElement;
     HTMLMapElement* m_mapElement;
     AccessibilityObject* m_parent;
+    
+    virtual bool isImageMapLink() const { return true; }
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
index 95239b01a5..073b0fc36f 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
@@ -55,6 +55,12 @@ PassRefPtr<AccessibilityList> AccessibilityList::create(RenderObject* renderer)
 
 bool AccessibilityList::accessibilityIsIgnored() const
 {
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
     // lists don't appear on tiger/leopard on the mac
 #if ACCESSIBILITY_LISTS
     return false;
@@ -83,7 +89,11 @@ bool AccessibilityList::isOrderedList() const
 {
     if (!m_renderer)
         return false;
-    
+
+    // ARIA says a directory is like a static table of contents, which sounds like an ordered list.
+    if (ariaRoleAttribute() == DirectoryRole)
+        return true;
+
     Node* node = m_renderer->node();
     return node && node->hasTagName(olTag);    
 }
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h
index 89befb24fd..b7265b2334 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h
@@ -47,7 +47,7 @@ public:
     static PassRefPtr<AccessibilityList> create(RenderObject*);
     virtual ~AccessibilityList();
     
-    virtual bool isList() const { return true; };
+    virtual bool isList() const { return true; }
     bool isUnorderedList() const;
     bool isOrderedList() const;
     bool isDefinitionList() const;
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
index 1f37481be2..8a9e062e85 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
@@ -31,9 +31,9 @@
 
 #include "AXObjectCache.h"
 #include "AccessibilityListBoxOption.h"
-#include "HitTestResult.h"
 #include "HTMLNames.h"
 #include "HTMLSelectElement.h"
+#include "HitTestResult.h"
 #include "RenderListBox.h"
 #include "RenderObject.h"
 
@@ -78,9 +78,9 @@ void AccessibilityListBox::addChildren()
     unsigned length = listItems.size();
     for (unsigned i = 0; i < length; i++) {
         // The cast to HTMLElement below is safe because the only other possible listItem type
-        // would be a WMLElement, but WML builds don't use accessbility features at all.
+        // would be a WMLElement, but WML builds don't use accessibility features at all.
         AccessibilityObject* listOption = listBoxOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
-        if (listOption)
+        if (listOption && !listOption->accessibilityIsIgnored())
             m_children.append(listOption);
     }
 }
@@ -151,6 +151,17 @@ AccessibilityObject* AccessibilityListBox::listBoxOptionAccessibilityObject(HTML
     
     return listBoxObject;
 }
+    
+bool AccessibilityListBox::accessibilityIsIgnored() const
+{
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
+    return false;
+}
 
 AccessibilityObject* AccessibilityListBox::doAccessibilityHitTest(const IntPoint& point) const
 {
@@ -165,16 +176,21 @@ AccessibilityObject* AccessibilityListBox::doAccessibilityHitTest(const IntPoint
     
     IntRect parentRect = boundingBoxRect();
     
-    const Vector<Element*>& listItems = static_cast<HTMLSelectElement*>(node)->listItems();
-    unsigned length = listItems.size();
+    AccessibilityObject* listBoxOption = 0;
+    unsigned length = m_children.size();
     for (unsigned i = 0; i < length; i++) {
         IntRect rect = toRenderListBox(m_renderer)->itemBoundingBoxRect(parentRect.x(), parentRect.y(), i);
         // The cast to HTMLElement below is safe because the only other possible listItem type
-        // would be a WMLElement, but WML builds don't use accessbility features at all.
-        if (rect.contains(point))
-            return listBoxOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
+        // would be a WMLElement, but WML builds don't use accessibility features at all.
+        if (rect.contains(point)) {
+            listBoxOption = m_children[i].get();
+            break;
+        }
     }
     
+    if (listBoxOption && !listBoxOption->accessibilityIsIgnored())
+        return listBoxOption;
+    
     return axObjectCache()->getOrCreate(m_renderer);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h
index 3f3352d9ad..72ce82f935 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h
@@ -43,15 +43,13 @@ public:
     virtual ~AccessibilityListBox();
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const;
-    virtual bool isListBox() const { return true; };
+    virtual bool isListBox() const { return true; }
     
     virtual bool canSetFocusAttribute() const { return true; }
     virtual bool canSetSelectedChildrenAttribute() const;
     void setSelectedChildren(AccessibilityChildrenVector&);
     virtual AccessibilityRole roleValue() const { return ListBoxRole; }
-    
-    virtual bool accessibilityIsIgnored() const { return false; }
-    
+        
     virtual void selectedChildren(AccessibilityChildrenVector&);
     virtual void visibleChildren(AccessibilityChildrenVector&);
     
@@ -59,6 +57,7 @@ public:
 
 private:    
     AccessibilityObject* listBoxOptionAccessibilityObject(HTMLElement*) const;
+    virtual bool accessibilityIsIgnored() const;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
index 6e3bf98c7c..57519e38da 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
@@ -34,12 +34,12 @@
 #include "Element.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
-#include "HTMLOptionElement.h"
 #include "HTMLOptGroupElement.h"
+#include "HTMLOptionElement.h"
 #include "HTMLSelectElement.h"
 #include "IntRect.h"
-#include "RenderObject.h"
 #include "RenderListBox.h"
+#include "RenderObject.h"
 
 using namespace std;
 
@@ -105,6 +105,22 @@ IntRect AccessibilityListBoxOption::elementRect() const
     return rect;
 }
 
+bool AccessibilityListBoxOption::accessibilityIsIgnored() const
+{
+    if (!m_optionElement)
+        return true;
+    
+    if (equalIgnoringCase(getAttribute(m_optionElement, aria_hiddenAttr), "true"))
+        return true;
+    
+    return parentObject()->accessibilityIsIgnored();
+}
+    
+String AccessibilityListBoxOption::language() const
+{
+    return AccessibilityObject::language(m_optionElement);
+}
+
 bool AccessibilityListBoxOption::canSetSelectedAttribute() const
 {
     if (!m_optionElement)
@@ -128,6 +144,10 @@ String AccessibilityListBoxOption::stringValue() const
     if (!m_optionElement)
         return String();
     
+    const AtomicString& ariaLabel = getAttribute(m_optionElement, aria_labelAttr);
+    if (!ariaLabel.isNull())
+        return ariaLabel;
+    
     if (m_optionElement->hasTagName(optionTag))
         return static_cast<HTMLOptionElement*>(m_optionElement)->text();
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
index 933cdeb351..1da77e7809 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
@@ -51,7 +51,7 @@ public:
     void setHTMLElement(HTMLElement* element) { m_optionElement = element; }
     
     virtual AccessibilityRole roleValue() const { return ListBoxOptionRole; }
-    virtual bool accessibilityIsIgnored() const { return false; }
+    virtual bool accessibilityIsIgnored() const;
     virtual bool isSelected() const;
     virtual bool isEnabled() const;
     virtual String stringValue() const;
@@ -63,11 +63,12 @@ public:
     virtual IntRect elementRect() const;
     virtual IntSize size() const;
     virtual AccessibilityObject* parentObject() const;
-    bool isListBoxOption() const { return true; };
+    bool isListBoxOption() const { return true; }
     
 private:
     HTMLElement* m_optionElement;
     
+    virtual String language() const;
     virtual bool canHaveChildren() const { return false; }
     HTMLSelectElement* listBoxOptionParentNode() const;
     int listBoxOptionIndex() const;
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
index 7200de9ba4..6151840f59 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
@@ -113,6 +113,8 @@ String AccessibilityMediaControl::controlTypeName() const
     DEFINE_STATIC_LOCAL(const String, mediaStatusDisplayName, ("StatusDisplay"));
     DEFINE_STATIC_LOCAL(const String, mediaCurrentTimeDisplay, ("CurrentTimeDisplay"));
     DEFINE_STATIC_LOCAL(const String, mediaTimeRemainingDisplay, ("TimeRemainingDisplay"));
+    DEFINE_STATIC_LOCAL(const String, mediaShowClosedCaptionsButtonName, ("ShowClosedCaptionsButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaHideClosedCaptionsButtonName, ("HideClosedCaptionsButton"));
 
     switch (controlType()) {
     case MediaFullscreenButton:
@@ -139,6 +141,10 @@ String AccessibilityMediaControl::controlTypeName() const
         return mediaCurrentTimeDisplay;
     case MediaTimeRemainingDisplay:
         return mediaTimeRemainingDisplay;
+    case MediaShowClosedCaptionsButton:
+        return mediaShowClosedCaptionsButtonName;
+    case MediaHideClosedCaptionsButton:
+        return mediaHideClosedCaptionsButtonName;
 
     default:
         break;
@@ -187,6 +193,8 @@ AccessibilityRole AccessibilityMediaControl::roleValue() const
     case MediaReturnToRealtimeButton:
     case MediaUnMuteButton:
     case MediaPauseButton:
+    case MediaShowClosedCaptionsButton:
+    case MediaHideClosedCaptionsButton:
         return ButtonRole;
 
     case MediaStatusDisplay:
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.h
index 9b306fd7c0..6f51b2c87a 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.h
@@ -37,77 +37,77 @@
 
 namespace WebCore {
 
-    class AccessibilityMediaControl : public AccessibilityRenderObject {
+class AccessibilityMediaControl : public AccessibilityRenderObject {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaControl() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaControl() { }
 
-        virtual AccessibilityRole roleValue() const;
-        virtual bool accessibilityIsIgnored() const;
+    virtual AccessibilityRole roleValue() const;
+    virtual bool accessibilityIsIgnored() const;
 
-        virtual String title() const;
-        virtual String accessibilityDescription() const;
-        virtual String helpText() const;
+    virtual String title() const;
+    virtual String accessibilityDescription() const;
+    virtual String helpText() const;
 
-    protected:
-        AccessibilityMediaControl(RenderObject*);
-        MediaControlElementType controlType() const;
-        String controlTypeName() const;
-    };
+protected:
+    AccessibilityMediaControl(RenderObject*);
+    MediaControlElementType controlType() const;
+    String controlTypeName() const;
+};
 
 
-    class AccessibilityMediaTimeline : public AccessibilitySlider {
+class AccessibilityMediaTimeline : public AccessibilitySlider {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaTimeline() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaTimeline() { }
 
-        virtual bool isMediaTimeline() const { return true; }
+    virtual bool isMediaTimeline() const { return true; }
 
-        virtual String helpText() const;
-        virtual String valueDescription() const;
-        const AtomicString& getAttribute(const QualifiedName& attribute) const;
+    virtual String helpText() const;
+    virtual String valueDescription() const;
+    const AtomicString& getAttribute(const QualifiedName& attribute) const;
 
-    private:
-        AccessibilityMediaTimeline(RenderObject*);
-    };
+private:
+    AccessibilityMediaTimeline(RenderObject*);
+};
 
 
-    class AccessibilityMediaControlsContainer : public AccessibilityMediaControl {
+class AccessibilityMediaControlsContainer : public AccessibilityMediaControl {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaControlsContainer() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaControlsContainer() { }
 
-        virtual AccessibilityRole roleValue() const { return ToolbarRole; }
-        virtual bool accessibilityIsIgnored() const { return false; }
+    virtual AccessibilityRole roleValue() const { return ToolbarRole; }
+    virtual bool accessibilityIsIgnored() const { return false; }
 
-        virtual String helpText() const;
-        virtual String accessibilityDescription() const;
+    virtual String helpText() const;
+    virtual String accessibilityDescription() const;
 
-    private:
-        AccessibilityMediaControlsContainer(RenderObject*);
-        bool controllingVideoElement() const;
-        const String elementTypeName() const;
-    };
+private:
+    AccessibilityMediaControlsContainer(RenderObject*);
+    bool controllingVideoElement() const;
+    const String elementTypeName() const;
+};
 
 
-    class AccessibilityMediaTimeDisplay : public AccessibilityMediaControl {
+class AccessibilityMediaTimeDisplay : public AccessibilityMediaControl {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaTimeDisplay() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaTimeDisplay() { }
 
-        virtual AccessibilityRole roleValue() const { return StaticTextRole; }
-        virtual bool accessibilityIsIgnored() const;
+    virtual AccessibilityRole roleValue() const { return StaticTextRole; }
+    virtual bool accessibilityIsIgnored() const;
 
-        virtual String stringValue() const;
-        virtual String accessibilityDescription() const;
+    virtual String stringValue() const;
+    virtual String accessibilityDescription() const;
 
-    private:
-        AccessibilityMediaTimeDisplay(RenderObject*);
-    };
+private:
+    AccessibilityMediaTimeDisplay(RenderObject*);
+};
 
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.cpp
new file mode 100644
index 0000000000..05cdf977fb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AccessibilityMenuList.h"
+
+#include "AXObjectCache.h"
+#include "AccessibilityMenuListPopup.h"
+#include "RenderMenuList.h"
+
+namespace WebCore {
+
+AccessibilityMenuList::AccessibilityMenuList(RenderObject* renderer)
+    : AccessibilityRenderObject(renderer)
+{
+    ASSERT_ARG(renderer, renderer->isMenuList());
+}
+
+bool AccessibilityMenuList::press() const
+{
+    RenderMenuList* menuList = static_cast<RenderMenuList*>(m_renderer);
+    if (menuList->popupIsVisible())
+        menuList->hidePopup();
+    else
+        menuList->showPopup();
+    return true;
+}
+
+void AccessibilityMenuList::addChildren()
+{
+    m_haveChildren = true;
+
+    AXObjectCache* cache = m_renderer->document()->axObjectCache();
+
+    AccessibilityObject* list = cache->getOrCreate(MenuListPopupRole);
+    if (!list)
+        return;
+
+    if (list->accessibilityPlatformIncludesObject() == IgnoreObject) {
+        cache->remove(list->axObjectID());
+        return;
+    }
+
+    static_cast<AccessibilityMenuListPopup*>(list)->setMenuList(this);
+    m_children.append(list);
+
+    list->addChildren();
+}
+
+void AccessibilityMenuList::childrenChanged()
+{
+    if (m_children.isEmpty())
+        return;
+
+    ASSERT(m_children.size() == 1);
+    m_children[0]->childrenChanged();
+}
+
+bool AccessibilityMenuList::isCollapsed() const
+{
+    return !static_cast<RenderMenuList*>(m_renderer)->popupIsVisible();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.h
new file mode 100644
index 0000000000..d00c8b4f55
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef AccessibilityMenuList_h
+#define AccessibilityMenuList_h
+
+#include "AccessibilityObject.h"
+#include "AccessibilityRenderObject.h"
+
+namespace WebCore {
+
+class AccessibilityMenuList;
+class AccessibilityMenuListPopup;
+class HTMLOptionElement;
+
+class AccessibilityMenuList : public AccessibilityRenderObject {
+public:
+    static PassRefPtr<AccessibilityMenuList> create(RenderObject* renderer) { return adoptRef(new AccessibilityMenuList(renderer)); }
+
+    virtual bool isCollapsed() const;
+    virtual bool press() const;
+
+private:
+    AccessibilityMenuList(RenderObject*);
+
+    virtual bool isMenuList() const { return true; }
+    virtual AccessibilityRole roleValue() const { return PopUpButtonRole; }
+    virtual bool accessibilityIsIgnored() const { return false; }
+    virtual bool canSetFocusAttribute() const { return true; }
+
+    virtual void addChildren();
+    virtual void childrenChanged();
+};
+
+} // namespace WebCore
+
+#endif // AccessibilityMenuList_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.cpp
new file mode 100644
index 0000000000..d7473deaaf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.cpp
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AccessibilityMenuListOption.h"
+
+#include "AXObjectCache.h"
+#include "AccessibilityMenuListPopup.h"
+#include "HTMLNames.h"
+#include "HTMLOptionElement.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+AccessibilityMenuListOption::AccessibilityMenuListOption()
+    : m_popup(0)
+{
+}
+
+void AccessibilityMenuListOption::setElement(HTMLElement* element)
+{
+    ASSERT_ARG(element, element->hasTagName(optionTag));
+    m_element = element;
+}
+
+Element* AccessibilityMenuListOption::actionElement() const
+{
+    return m_element.get();
+}
+
+AccessibilityObject* AccessibilityMenuListOption::parentObject() const
+{
+    return m_popup;
+}
+
+bool AccessibilityMenuListOption::isEnabled() const
+{
+    // disabled() returns true if the parent <select> element is disabled,
+    // which we don't want.
+    return !static_cast<HTMLOptionElement*>(m_element.get())->ownElementDisabled();
+}
+
+bool AccessibilityMenuListOption::isVisible() const
+{
+    // In a single-option select with the popup collapsed, only the selected
+    // item is considered visible.
+    return !m_popup->isOffScreen() || isSelected();
+}
+
+bool AccessibilityMenuListOption::isOffScreen() const
+{
+    // Invisible list options are considered to be offscreen.
+    return !isVisible();
+}
+
+bool AccessibilityMenuListOption::isSelected() const
+{
+    return static_cast<HTMLOptionElement*>(m_element.get())->selected();
+}
+
+void AccessibilityMenuListOption::setSelected(bool b)
+{
+    if (!canSetSelectedAttribute())
+        return;
+
+    static_cast<HTMLOptionElement*>(m_element.get())->setSelected(b);
+}
+
+String AccessibilityMenuListOption::nameForMSAA() const
+{
+    return static_cast<HTMLOptionElement*>(m_element.get())->text();
+}
+
+bool AccessibilityMenuListOption::canSetSelectedAttribute() const
+{
+    return isEnabled();
+}
+
+IntRect AccessibilityMenuListOption::elementRect() const
+{
+    AccessibilityObject* parent = parentObject();
+    ASSERT(parent->isMenuListPopup());
+
+    AccessibilityObject* grandparent = parent->parentObject();
+    ASSERT(grandparent->isMenuList());
+
+    return grandparent->elementRect();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.h
new file mode 100644
index 0000000000..7e27888a58
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef AccessibilityMenuListOption_h
+#define AccessibilityMenuListOption_h
+
+#include "AccessibilityObject.h"
+
+namespace WebCore {
+
+class AccessibilityMenuListPopup;
+class HTMLElement;
+
+class AccessibilityMenuListOption : public AccessibilityObject {
+public:
+    static PassRefPtr<AccessibilityMenuListOption> create() { return adoptRef(new AccessibilityMenuListOption); }
+
+    void setElement(HTMLElement*);
+    void setParent(AccessibilityMenuListPopup* popup) { m_popup = popup; }
+
+private:
+    AccessibilityMenuListOption();
+
+    virtual bool isMenuListOption() const { return true; }
+
+    virtual AccessibilityRole roleValue() const { return MenuListOptionRole; }
+    virtual bool canHaveChildren() const { return false; }
+    virtual IntSize size() const { return elementRect().size(); }
+
+    virtual Element* actionElement() const;
+    virtual AccessibilityObject* parentObject() const;
+    virtual bool isEnabled() const;
+    virtual bool isVisible() const;
+    virtual bool isOffScreen() const;
+    virtual bool isSelected() const;
+    virtual String nameForMSAA() const;
+    virtual void setSelected(bool);
+    virtual bool canSetSelectedAttribute() const;
+    virtual IntRect elementRect() const;
+
+    RefPtr<HTMLElement> m_element;
+    AccessibilityMenuListPopup* m_popup;
+};
+
+} // namespace WebCore
+
+#endif // AccessibilityMenuListOption_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.cpp
new file mode 100644
index 0000000000..48c2fabb2f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.cpp
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AccessibilityMenuListPopup.h"
+
+#include "AXObjectCache.h"
+#include "AccessibilityMenuList.h"
+#include "AccessibilityMenuListOption.h"
+#include "HTMLNames.h"
+#include "HTMLSelectElement.h"
+#include "RenderObject.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+AccessibilityMenuListPopup::AccessibilityMenuListPopup()
+    : m_menuList(0)
+{
+}
+
+bool AccessibilityMenuListPopup::isVisible() const
+{
+    return false;
+}
+
+bool AccessibilityMenuListPopup::isOffScreen() const
+{
+    return m_menuList->isCollapsed();
+}
+
+AccessibilityObject* AccessibilityMenuListPopup::parentObject() const
+{
+    return m_menuList;
+}
+
+bool AccessibilityMenuListPopup::isEnabled() const
+{
+    return m_menuList->isEnabled();
+}
+
+AccessibilityMenuListOption* AccessibilityMenuListPopup::menuListOptionAccessibilityObject(HTMLElement* element) const
+{
+    if (!element || !element->hasTagName(optionTag))
+        return 0;
+
+    AccessibilityObject* object = m_menuList->renderer()->document()->axObjectCache()->getOrCreate(MenuListOptionRole);
+    ASSERT(object->isMenuListOption());
+
+    AccessibilityMenuListOption* option = static_cast<AccessibilityMenuListOption*>(object);
+    option->setElement(element);
+
+    return option;
+}
+
+bool AccessibilityMenuListPopup::press() const
+{
+    m_menuList->press();
+    return true;
+}
+
+void AccessibilityMenuListPopup::addChildren()
+{
+    Node* selectNode = m_menuList->renderer()->node();
+    if (!selectNode)
+        return;
+
+    m_haveChildren = true;
+
+    ASSERT(selectNode->hasTagName(selectTag));
+
+    const Vector<Element*>& listItems = static_cast<HTMLSelectElement*>(selectNode)->listItems();
+    unsigned length = listItems.size();
+    for (unsigned i = 0; i < length; i++) {
+        // The cast to HTMLElement below is safe because the only other possible listItem type
+        // would be a WMLElement, but WML builds don't use accessbility features at all.
+        AccessibilityMenuListOption* option = menuListOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
+        if (option) {
+            option->setParent(this);
+            m_children.append(option);
+        }
+    }
+}
+
+void AccessibilityMenuListPopup::childrenChanged()
+{
+    for (size_t i = m_children.size(); i > 0 ; --i) {
+        AccessibilityObject* child = m_children[i - 1].get();
+        if (child->actionElement() && !child->actionElement()->attached()) {
+            m_menuList->renderer()->document()->axObjectCache()->remove(child->axObjectID());
+            m_children.remove(i - 1);
+        }
+    }
+}
+
+void AccessibilityMenuListPopup::setMenuList(AccessibilityMenuList* menuList)
+{
+    ASSERT_ARG(menuList, menuList);
+    ASSERT(!m_menuList);
+    m_menuList = menuList;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.h
index be280632f4..88fbf7c2aa 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,34 +20,49 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSInspectorCallbackWrapper_h
-#define JSInspectorCallbackWrapper_h
+#ifndef AccessibilityMenuListPopup_h
+#define AccessibilityMenuListPopup_h
 
-#include "JSQuarantinedObjectWrapper.h"
+#include "AccessibilityObject.h"
 
 namespace WebCore {
 
-    class JSInspectorCallbackWrapper : public JSQuarantinedObjectWrapper {
-    public:
-        static JSC::JSValue wrap(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue);
+class AccessibilityMenuList;
+class AccessibilityMenuListOption;
+class HTMLElement;
 
-        virtual ~JSInspectorCallbackWrapper();
+class AccessibilityMenuListPopup : public AccessibilityObject {
+public:
+    static PassRefPtr<AccessibilityMenuListPopup> create() { return adoptRef(new AccessibilityMenuListPopup); }
 
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-        static const JSC::ClassInfo s_info;
+    void setMenuList(AccessibilityMenuList*);
 
-    protected:
-        JSInspectorCallbackWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
+    virtual bool isEnabled() const;
+    virtual bool isOffScreen() const;
 
-        virtual bool allowsCallAsFunction() const { return true; }
+private:
+    AccessibilityMenuListPopup();
 
-        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const;
-        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
-    };
+    virtual bool isMenuListPopup() const { return true; }
+
+    virtual IntRect elementRect() const { return IntRect(); }
+    virtual IntSize size() const { return IntSize(); }
+    virtual AccessibilityRole roleValue() const { return MenuListPopupRole; }
+
+    virtual bool isVisible() const;
+    virtual AccessibilityObject* parentObject() const;
+    virtual bool press() const;
+    virtual void addChildren();
+    virtual void childrenChanged();
+
+    AccessibilityMenuListOption* menuListOptionAccessibilityObject(HTMLElement*) const;
+
+    AccessibilityMenuList* m_menuList;
+};
 
 } // namespace WebCore
 
-#endif // JSInspectorCallbackWrapper_h
+#endif // AccessibilityMenuListPopup_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
index d7093e46e1..8dedc36d2f 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityObject.h"
 
-#include "AccessibilityRenderObject.h"
 #include "AXObjectCache.h"
+#include "AccessibilityRenderObject.h"
 #include "CharacterNames.h"
 #include "FloatRect.h"
 #include "FocusController.h"
@@ -85,8 +85,9 @@ void AccessibilityObject::detach()
 AccessibilityObject* AccessibilityObject::parentObjectUnignored() const
 {
     AccessibilityObject* parent;
-    for (parent = parentObject(); parent && parent->accessibilityIsIgnored(); parent = parent->parentObject())
-        ;
+    for (parent = parentObject(); parent && parent->accessibilityIsIgnored(); parent = parent->parentObject()) {
+    }
+    
     return parent;
 }
 
@@ -147,6 +148,15 @@ bool AccessibilityObject::press() const
     return true;
 }
     
+String AccessibilityObject::language(Node* node) const
+{
+    const AtomicString& lang = getAttribute(node, langAttr);
+    if (lang.isEmpty())
+        return AccessibilityObject::language();
+    
+    return lang;
+}
+    
 String AccessibilityObject::language() const
 {
     AccessibilityObject* parent = parentObject();
@@ -275,7 +285,7 @@ VisiblePositionRange AccessibilityObject::rightLineVisiblePositionRange(const Vi
     VisiblePosition startPosition = startOfLine(nextVisiblePos);
 
     // fetch for a valid line start position
-    if (startPosition.isNull() ) {
+    if (startPosition.isNull()) {
         startPosition = visiblePos;
         nextVisiblePos = nextVisiblePos.next();
     } else
@@ -381,9 +391,8 @@ static bool replacedNodeNeedsCharacter(Node* replacedNode)
 {
     // we should always be given a rendered node and a replaced node, but be safe
     // replaced nodes are either attachments (widgets) or images
-    if (!replacedNode || !replacedNode->renderer() || !replacedNode->renderer()->isReplaced() || replacedNode->isTextNode()) {
+    if (!replacedNode || !replacedNode->renderer() || !replacedNode->renderer()->isReplaced() || replacedNode->isTextNode())
         return false;
-    }
 
     // create an AX object, but skip it if it is not supposed to be seen
     AccessibilityObject* object = replacedNode->renderer()->document()->axObjectCache()->getOrCreate(replacedNode->renderer());
@@ -445,7 +454,7 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
     RefPtr<Range> range = makeRange(visiblePositionRange.start, visiblePositionRange.end);
     for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
-        if (it.length() != 0) {
+        if (it.length()) {
             // Add a textual representation for list marker text
             String listMarkerText = listMarkerTextForNodeAndPosition(it.node(), visiblePositionRange.start);
             if (!listMarkerText.isEmpty())
@@ -459,9 +468,8 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
             ASSERT(node == it.range()->endContainer(exception));
             int offset = it.range()->startOffset(exception);
 
-            if (replacedNodeNeedsCharacter(node->childNode(offset))) {
+            if (replacedNodeNeedsCharacter(node->childNode(offset)))
                 resultVector.append(objectReplacementCharacter);
-            }
         }
     }
 
@@ -478,9 +486,9 @@ int AccessibilityObject::lengthForVisiblePositionRange(const VisiblePositionRang
     RefPtr<Range> range = makeRange(visiblePositionRange.start, visiblePositionRange.end);
     for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
-        if (it.length() != 0) {
+        if (it.length())
             length += it.length();
-        } else {
+        else {
             // locate the node and starting offset for this replaced range
             int exception = 0;
             Node* node = it.range()->startContainer(exception);
@@ -732,8 +740,8 @@ FrameView* AccessibilityObject::documentFrameView() const
 
 void AccessibilityObject::clearChildren()
 {
-    m_haveChildren = false;
     m_children.clear();
+    m_haveChildren = false;
 }
 
 AccessibilityObject* AccessibilityObject::anchorElementForNode(Node* node)
@@ -754,6 +762,53 @@ AccessibilityObject* AccessibilityObject::anchorElementForNode(Node* node)
     return anchorRenderer->document()->axObjectCache()->getOrCreate(anchorRenderer);
 }
     
+void AccessibilityObject::ariaTreeRows(AccessibilityChildrenVector& result)
+{
+    AccessibilityChildrenVector axChildren = children();
+    unsigned count = axChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* obj = axChildren[k].get();
+        
+        // Add tree items as the rows.
+        if (obj->roleValue() == TreeItemRole) 
+            result.append(obj);
+
+        // Now see if this item also has rows hiding inside of it.
+        obj->ariaTreeRows(result);
+    }
+}
+    
+void AccessibilityObject::ariaTreeItemContent(AccessibilityChildrenVector& result)
+{
+    // The ARIA tree item content are the item that are not other tree items or their containing groups.
+    AccessibilityChildrenVector axChildren = children();
+    unsigned count = axChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* obj = axChildren[k].get();
+        AccessibilityRole role = obj->roleValue();
+        if (role == TreeItemRole || role == GroupRole)
+            continue;
+        
+        result.append(obj);
+    }
+}
+
+void AccessibilityObject::ariaTreeItemDisclosedRows(AccessibilityChildrenVector& result)
+{
+    AccessibilityChildrenVector axChildren = children();
+    unsigned count = axChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* obj = axChildren[k].get();
+        
+        // Add tree items as the rows.
+        if (obj->roleValue() == TreeItemRole)
+            result.append(obj);
+        // If it's not a tree item, then descend into the group to find more tree items.
+        else 
+            obj->ariaTreeRows(result);
+    }    
+}
+    
 const String& AccessibilityObject::actionVerb() const
 {
     // FIXME: Need to add verbs for select elements.
@@ -763,26 +818,44 @@ const String& AccessibilityObject::actionVerb() const
     DEFINE_STATIC_LOCAL(const String, checkedCheckBoxAction, (AXCheckedCheckBoxActionVerb()));
     DEFINE_STATIC_LOCAL(const String, uncheckedCheckBoxAction, (AXUncheckedCheckBoxActionVerb()));
     DEFINE_STATIC_LOCAL(const String, linkAction, (AXLinkActionVerb()));
+    DEFINE_STATIC_LOCAL(const String, menuListAction, (AXMenuListActionVerb()));
+    DEFINE_STATIC_LOCAL(const String, menuListPopupAction, (AXMenuListPopupActionVerb()));
     DEFINE_STATIC_LOCAL(const String, noAction, ());
 
     switch (roleValue()) {
-        case ButtonRole:
-            return buttonAction;
-        case TextFieldRole:
-        case TextAreaRole:
-            return textFieldAction;
-        case RadioButtonRole:
-            return radioButtonAction;
-        case CheckBoxRole:
-            return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
-        case LinkRole:
-        case WebCoreLinkRole:
-            return linkAction;
-        default:
-            return noAction;
+    case ButtonRole:
+        return buttonAction;
+    case TextFieldRole:
+    case TextAreaRole:
+        return textFieldAction;
+    case RadioButtonRole:
+        return radioButtonAction;
+    case CheckBoxRole:
+        return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
+    case LinkRole:
+    case WebCoreLinkRole:
+        return linkAction;
+    case PopUpButtonRole:
+        return menuListAction;
+    case MenuListPopupRole:
+        return menuListPopupAction;
+    default:
+        return noAction;
     }
 }
  
+const AtomicString& AccessibilityObject::getAttribute(Node* node, const QualifiedName& attribute)
+{
+    if (!node)
+        return nullAtom;
+    
+    if (!node->isElementNode())
+        return nullAtom;
+    
+    Element* element = static_cast<Element*>(node);
+    return element->getAttribute(attribute);
+}
+    
 // Lacking concrete evidence of orientation, horizontal means width > height. vertical is height > width;
 AccessibilityOrientation AccessibilityObject::orientation() const
 {
@@ -794,6 +867,119 @@ AccessibilityOrientation AccessibilityObject::orientation() const
 
     // A tie goes to horizontal.
     return AccessibilityOrientationHorizontal;
+}    
+
+typedef HashMap<String, AccessibilityRole, CaseFoldingHash> ARIARoleMap;
+
+struct RoleEntry {
+    String ariaRole;
+    AccessibilityRole webcoreRole;
+};
+
+static ARIARoleMap* createARIARoleMap()
+{
+    const RoleEntry roles[] = {
+        { "alert", ApplicationAlertRole },
+        { "alertdialog", ApplicationAlertDialogRole },
+        { "application", LandmarkApplicationRole },
+        { "article", DocumentArticleRole },
+        { "banner", LandmarkBannerRole },
+        { "button", ButtonRole },
+        { "checkbox", CheckBoxRole },
+        { "complementary", LandmarkComplementaryRole },
+        { "contentinfo", LandmarkContentInfoRole },
+        { "dialog", ApplicationDialogRole },
+        { "directory", DirectoryRole },
+        { "grid", TableRole },
+        { "gridcell", CellRole },
+        { "columnheader", ColumnHeaderRole },
+        { "combobox", ComboBoxRole },
+        { "definition", DefinitionListDefinitionRole },
+        { "document", DocumentRole },
+        { "rowheader", RowHeaderRole },
+        { "group", GroupRole },
+        { "heading", HeadingRole },
+        { "img", ImageRole },
+        { "link", WebCoreLinkRole },
+        { "list", ListRole },        
+        { "listitem", GroupRole },        
+        { "listbox", ListBoxRole },
+        { "log", ApplicationLogRole },
+        // "option" isn't here because it may map to different roles depending on the parent element's role
+        { "main", LandmarkMainRole },
+        { "marquee", ApplicationMarqueeRole },
+        { "math", DocumentMathRole },
+        { "menu", MenuRole },
+        { "menubar", GroupRole },
+        // "menuitem" isn't here because it may map to different roles depending on the parent element's role
+        { "menuitemcheckbox", MenuItemRole },
+        { "menuitemradio", MenuItemRole },
+        { "note", DocumentNoteRole },
+        { "navigation", LandmarkNavigationRole },
+        { "option", ListBoxOptionRole },
+        { "presentation", IgnoredRole },
+        { "progressbar", ProgressIndicatorRole },
+        { "radio", RadioButtonRole },
+        { "radiogroup", RadioGroupRole },
+        { "region", DocumentRegionRole },
+        { "row", RowRole },
+        { "range", SliderRole },
+        { "scrollbar", ScrollBarRole },
+        { "search", LandmarkSearchRole },
+        { "separator", SplitterRole },
+        { "slider", SliderRole },
+        { "spinbutton", ProgressIndicatorRole },
+        { "status", ApplicationStatusRole },
+        { "tab", TabRole },
+        { "tablist", TabListRole },
+        { "tabpanel", TabPanelRole },
+        { "text", StaticTextRole },
+        { "textbox", TextAreaRole },
+        { "timer", ApplicationTimerRole },
+        { "toolbar", ToolbarRole },
+        { "tooltip", UserInterfaceTooltipRole },
+        { "tree", TreeRole },
+        { "treegrid", TreeGridRole },
+        { "treeitem", TreeItemRole }
+    };
+    ARIARoleMap* roleMap = new ARIARoleMap;
+    
+    const unsigned numRoles = sizeof(roles) / sizeof(roles[0]);
+    for (unsigned i = 0; i < numRoles; ++i)
+        roleMap->set(roles[i].ariaRole, roles[i].webcoreRole);
+    return roleMap;
+}
+
+AccessibilityRole AccessibilityObject::ariaRoleToWebCoreRole(const String& value)
+{
+    ASSERT(!value.isEmpty());
+    static const ARIARoleMap* roleMap = createARIARoleMap();
+    return roleMap->get(value);
 }
+
+bool AccessibilityObject::isInsideARIALiveRegion() const
+{
+    if (supportsARIALiveRegion())
+        return true;
+    
+    for (AccessibilityObject* axParent = parentObject(); axParent; axParent = axParent->parentObject()) {
+        if (axParent->supportsARIALiveRegion())
+            return true;
+    }
+    
+    return false;
+}
+
+bool AccessibilityObject::supportsARIAAttributes() const
+{
+    return supportsARIALiveRegion() || supportsARIADragging() || supportsARIADropping() || supportsARIAFlowTo() || supportsARIAOwns();
+}
+    
+bool AccessibilityObject::supportsARIALiveRegion() const
+{
+    const AtomicString& liveRegion = ariaLiveRegionStatus();
+    return equalIgnoringCase(liveRegion, "polite") || equalIgnoringCase(liveRegion, "assertive");
+}
+
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
index 8fc40e860a..7c52cd5931 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
@@ -34,13 +34,12 @@
 #include "Range.h"
 #include "VisiblePosition.h"
 #include "VisibleSelection.h"
-#include <wtf/Platform.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
 #if PLATFORM(MAC)
 #include <wtf/RetainPtr.h>
-#elif PLATFORM(WIN) && !PLATFORM(WINCE)
+#elif PLATFORM(WIN) && !OS(WINCE)
 #include "AccessibilityObjectWrapperWin.h"
 #include "COMPtr.h"
 #elif PLATFORM(CHROMIUM)
@@ -161,7 +160,18 @@ enum AccessibilityRole {
     AnnotationRole,
     SliderThumbRole,
     IgnoredRole,
-    
+    TabRole,
+    TabListRole,
+    TabPanelRole,
+    TreeRole,
+    TreeGridRole,
+    TreeItemRole,
+    DirectoryRole,
+    EditableTextRole,
+    ListItemRole,
+    MenuListPopupRole,
+    MenuListOptionRole,
+
     // ARIA Grouping roles
     LandmarkApplicationRole,
     LandmarkBannerRole,
@@ -171,6 +181,9 @@ enum AccessibilityRole {
     LandmarkNavigationRole,
     LandmarkSearchRole,
     
+    ApplicationAlertRole,
+    ApplicationAlertDialogRole,
+    ApplicationDialogRole,
     ApplicationLogRole,
     ApplicationMarqueeRole,
     ApplicationStatusRole,
@@ -178,6 +191,7 @@ enum AccessibilityRole {
     
     DocumentRole,
     DocumentArticleRole,
+    DocumentMathRole,
     DocumentNoteRole,
     DocumentRegionRole,
     
@@ -189,7 +203,7 @@ enum AccessibilityOrientation {
     AccessibilityOrientationHorizontal,
 };
     
-enum AccessibilityObjectPlatformInclusion {
+enum AccessibilityObjectInclusion {
     IncludeObject,
     IgnoreObject,
     DefaultBehavior,
@@ -225,7 +239,7 @@ struct PlainTextRange {
         , length(l)
     { }
     
-    bool isNull() const { return start == 0 && length == 0; }
+    bool isNull() const { return !start && !length; }
 };
 
 class AccessibilityObject : public RefCounted<AccessibilityObject> {
@@ -237,64 +251,82 @@ public:
         
     typedef Vector<RefPtr<AccessibilityObject> > AccessibilityChildrenVector;
     
-    virtual bool isAccessibilityRenderObject() const { return false; };
-    virtual bool isAnchor() const { return false; };
-    virtual bool isAttachment() const { return false; };
-    virtual bool isHeading() const { return false; };
-    virtual bool isLink() const { return false; };
-    virtual bool isImage() const { return false; };
-    virtual bool isNativeImage() const { return false; };
-    virtual bool isImageButton() const { return false; };
-    virtual bool isPasswordField() const { return false; };
-    virtual bool isTextControl() const { return false; };
-    virtual bool isNativeTextControl() const { return false; };
-    virtual bool isWebArea() const { return false; };
-    virtual bool isCheckboxOrRadio() const { return false; };
-    virtual bool isListBox() const { return roleValue() == ListBoxRole; };
+    virtual bool isAccessibilityRenderObject() const { return false; }
+    virtual bool isAnchor() const { return false; }
+    virtual bool isAttachment() const { return false; }
+    virtual bool isHeading() const { return false; }
+    virtual bool isLink() const { return false; }
+    virtual bool isImage() const { return false; }
+    virtual bool isNativeImage() const { return false; }
+    virtual bool isImageButton() const { return false; }
+    virtual bool isPasswordField() const { return false; }
+    virtual bool isTextControl() const { return false; }
+    virtual bool isNativeTextControl() const { return false; }
+    virtual bool isWebArea() const { return false; }
+    virtual bool isCheckboxOrRadio() const { return false; }
+    virtual bool isListBox() const { return roleValue() == ListBoxRole; }
     virtual bool isMediaTimeline() const { return false; }
     virtual bool isMenuRelated() const { return false; }
     virtual bool isMenu() const { return false; }
     virtual bool isMenuBar() const { return false; }
     virtual bool isMenuButton() const { return false; }
     virtual bool isMenuItem() const { return false; }
-    virtual bool isFileUploadButton() const { return false; };
+    virtual bool isFileUploadButton() const { return false; }
     virtual bool isInputImage() const { return false; }
-    virtual bool isProgressIndicator() const { return false; };
-    virtual bool isSlider() const { return false; };
-    virtual bool isControl() const { return false; };
-    virtual bool isList() const { return false; };
-    virtual bool isDataTable() const { return false; };
-    virtual bool isTableRow() const { return false; };
-    virtual bool isTableColumn() const { return false; };
-    virtual bool isTableCell() const { return false; };
-    virtual bool isFieldset() const { return false; };
-    virtual bool isGroup() const { return false; };
+    virtual bool isProgressIndicator() const { return false; }
+    virtual bool isSlider() const { return false; }
+    virtual bool isControl() const { return false; }
+    virtual bool isList() const { return false; }
+    virtual bool isDataTable() const { return false; }
+    virtual bool isTableRow() const { return false; }
+    virtual bool isTableColumn() const { return false; }
+    virtual bool isTableCell() const { return false; }
+    virtual bool isFieldset() const { return false; }
+    virtual bool isGroup() const { return false; }
+    virtual bool isARIATreeGridRow() const { return false; }
+    virtual bool isImageMapLink() const { return false; }
+    virtual bool isMenuList() const { return false; }
+    virtual bool isMenuListPopup() const { return false; }
+    virtual bool isMenuListOption() const { return false; }
+    bool isTabList() const { return roleValue() == TabListRole; }
+    bool isTabItem() const { return roleValue() == TabRole; }
     bool isRadioGroup() const { return roleValue() == RadioGroupRole; }
+    bool isComboBox() const { return roleValue() == ComboBoxRole; }
+    bool isTree() const { return roleValue() == TreeRole; }
+    bool isTreeItem() const { return roleValue() == TreeItemRole; }
+    bool isScrollbar() const { return roleValue() == ScrollBarRole; }
+    bool isButton() const { return roleValue() == ButtonRole; }
     
-    virtual bool isChecked() const { return false; };
-    virtual bool isEnabled() const { return false; };
-    virtual bool isSelected() const { return false; };
-    virtual bool isFocused() const { return false; };
-    virtual bool isHovered() const { return false; };
-    virtual bool isIndeterminate() const { return false; };
-    virtual bool isLoaded() const { return false; };
-    virtual bool isMultiSelect() const { return false; };
-    virtual bool isOffScreen() const { return false; };
-    virtual bool isPressed() const { return false; };
-    virtual bool isReadOnly() const { return false; };
-    virtual bool isVisited() const { return false; };
-    virtual bool isRequired() const { return false; };
-
-    virtual bool canSetFocusAttribute() const { return false; };
-    virtual bool canSetTextRangeAttributes() const { return false; };
-    virtual bool canSetValueAttribute() const { return false; };
+    virtual bool isChecked() const { return false; }
+    virtual bool isEnabled() const { return false; }
+    virtual bool isSelected() const { return false; }
+    virtual bool isFocused() const { return false; }
+    virtual bool isHovered() const { return false; }
+    virtual bool isIndeterminate() const { return false; }
+    virtual bool isLoaded() const { return false; }
+    virtual bool isMultiSelectable() const { return false; }
+    virtual bool isOffScreen() const { return false; }
+    virtual bool isPressed() const { return false; }
+    virtual bool isReadOnly() const { return false; }
+    virtual bool isVisited() const { return false; }
+    virtual bool isRequired() const { return false; }
+    virtual bool isLinked() const { return false; }
+    virtual bool isExpanded() const { return false; }
+    virtual bool isVisible() const { return true; }
+    virtual bool isCollapsed() const { return false; }
+    virtual void setIsExpanded(bool) { }
+
+    virtual bool canSetFocusAttribute() const { return false; }
+    virtual bool canSetTextRangeAttributes() const { return false; }
+    virtual bool canSetValueAttribute() const { return false; }
     virtual bool canSetSelectedAttribute() const { return false; }
     virtual bool canSetSelectedChildrenAttribute() const { return false; }
+    virtual bool canSetExpandedAttribute() const { return false; }
     
-    virtual bool hasIntValue() const { return false; };
+    virtual bool hasIntValue() const { return false; }
 
-    bool accessibilityShouldUseUniqueId() const { return true; };
-    virtual bool accessibilityIsIgnored() const  { return true; };
+    bool accessibilityShouldUseUniqueId() const { return true; }
+    virtual bool accessibilityIsIgnored() const  { return true; }
 
     virtual int headingLevel() const { return 0; }
     virtual int intValue() const { return 0; }
@@ -303,9 +335,22 @@ public:
     virtual float maxValueForRange() const { return 0.0f; }
     virtual float minValueForRange() const { return 0.0f; }
     virtual AccessibilityObject* selectedRadioButton() { return 0; }
+    virtual AccessibilityObject* selectedTabItem() { return 0; }    
     virtual int layoutCount() const { return 0; }
+    virtual double estimatedLoadingProgress() const { return 0; }
     static bool isARIAControl(AccessibilityRole);
     static bool isARIAInput(AccessibilityRole);
+    virtual bool supportsARIAOwns() const { return false; }
+    virtual void ariaOwnsElements(AccessibilityChildrenVector&) const { }
+    virtual bool supportsARIAFlowTo() const { return false; }
+    virtual void ariaFlowToElements(AccessibilityChildrenVector&) const { }
+    
+    // ARIA drag and drop
+    virtual bool supportsARIADropping() const { return false; }
+    virtual bool supportsARIADragging() const { return false; }
+    virtual bool isARIAGrabbed() { return false; }
+    virtual void setARIAGrabbed(bool) { }
+    virtual void determineARIADropEffects(Vector<String>&) { }
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const { return 0; }
     virtual AccessibilityObject* focusedUIElement() const { return 0; }
@@ -331,7 +376,6 @@ public:
 
     void setRoleValue(AccessibilityRole role) { m_role = role; }
     virtual AccessibilityRole roleValue() const { return m_role; }
-    virtual String ariaAccessibilityName(const String&) const { return String(); }
     virtual String ariaLabeledByAttribute() const { return String(); }
     virtual String ariaDescribedByAttribute() const { return String(); }
     virtual String accessibilityDescription() const { return String(); }
@@ -370,32 +414,40 @@ public:
     virtual FrameView* topDocumentFrameView() const { return 0; }
     virtual FrameView* documentFrameView() const;
     virtual String language() const;
-
+    String language(Node*) const;
+    virtual unsigned hierarchicalLevel() const { return 0; }
+    
     virtual void setFocused(bool) { }
     virtual void setSelectedText(const String&) { }
     virtual void setSelectedTextRange(const PlainTextRange&) { }
     virtual void setValue(const String&) { }
     virtual void setSelected(bool) { }
-
+    virtual void setSelectedRows(AccessibilityChildrenVector&) { }
+    
     virtual void makeRangeVisible(const PlainTextRange&) { }
     virtual bool press() const;
     bool performDefaultAction() const { return press(); }
-
+    
     virtual AccessibilityOrientation orientation() const;
-    virtual void increment() { };
-    virtual void decrement() { };
+    virtual void increment() { }
+    virtual void decrement() { }
 
     virtual void childrenChanged() { }
+    virtual void contentChanged() { }
     virtual const AccessibilityChildrenVector& children() { return m_children; }
     virtual void addChildren() { }
     virtual bool canHaveChildren() const { return true; }
     virtual bool hasChildren() const { return m_haveChildren; }
     virtual void selectedChildren(AccessibilityChildrenVector&) { }
     virtual void visibleChildren(AccessibilityChildrenVector&) { }
+    virtual void tabChildren(AccessibilityChildrenVector&) { }
     virtual bool shouldFocusActiveDescendant() const { return false; }
     virtual AccessibilityObject* activeDescendant() const { return 0; }    
     virtual void handleActiveDescendantChanged() { }
 
+    static AccessibilityRole ariaRoleToWebCoreRole(const String&);
+    static const AtomicString& getAttribute(Node*, const QualifiedName&);
+
     virtual VisiblePositionRange visiblePositionRange() const { return VisiblePositionRange(); }
     virtual VisiblePositionRange visiblePositionRangeForLine(unsigned) const { return VisiblePositionRange(); }
     
@@ -446,6 +498,29 @@ public:
 
     unsigned doAXLineForIndex(unsigned);
 
+    virtual String stringValueForMSAA() const { return String(); }
+    virtual String stringRoleForMSAA() const { return String(); }
+    virtual String nameForMSAA() const { return String(); }
+    virtual String descriptionForMSAA() const { return String(); }
+    virtual AccessibilityRole roleValueForMSAA() const { return roleValue(); }
+
+    // Used by an ARIA tree to get all its rows.
+    void ariaTreeRows(AccessibilityChildrenVector&);
+    // Used by an ARIA tree item to get all of its direct rows that it can disclose.
+    void ariaTreeItemDisclosedRows(AccessibilityChildrenVector&);
+    // Used by an ARIA tree item to get only its content, and not its child tree items and groups. 
+    void ariaTreeItemContent(AccessibilityChildrenVector&);
+    
+    // ARIA live-region features.
+    bool supportsARIALiveRegion() const;
+    bool isInsideARIALiveRegion() const;
+    virtual const AtomicString& ariaLiveRegionStatus() const { return nullAtom; }
+    virtual const AtomicString& ariaLiveRegionRelevant() const { return nullAtom; }
+    virtual bool ariaLiveRegionAtomic() const { return false; }
+    virtual bool ariaLiveRegionBusy() const { return false; }
+    
+    bool supportsARIAAttributes() const;
+    
 #if HAVE(ACCESSIBILITY)
 #if PLATFORM(GTK)
     AccessibilityObjectWrapper* wrapper() const;
@@ -459,18 +534,14 @@ public:
 #endif
 #endif
 
-    // a platform-specific method for determining if an attachment is ignored
 #if HAVE(ACCESSIBILITY)
+    // a platform-specific method for determining if an attachment is ignored
     bool accessibilityIgnoreAttachment() const;
-#else
-    bool accessibilityIgnoreAttachment() const { return true; }
-#endif
-
     // gives platforms the opportunity to indicate if and how an object should be included
-#if HAVE(ACCESSIBILITY)
-    AccessibilityObjectPlatformInclusion accessibilityPlatformIncludesObject() const;
+    AccessibilityObjectInclusion accessibilityPlatformIncludesObject() const;
 #else
-    AccessibilityObjectPlatformInclusion accessibilityPlatformIncludesObject() const { return DefaultBehavior; }
+    bool accessibilityIgnoreAttachment() const { return true; }
+    AccessibilityObjectInclusion accessibilityPlatformIncludesObject() const { return DefaultBehavior; }
 #endif
 
     // allows for an AccessibilityObject to update its render tree or perform
@@ -489,7 +560,7 @@ protected:
     
 #if PLATFORM(MAC)
     RetainPtr<AccessibilityObjectWrapper> m_wrapper;
-#elif PLATFORM(WIN) && !PLATFORM(WINCE)
+#elif PLATFORM(WIN) && !OS(WINCE)
     COMPtr<AccessibilityObjectWrapper> m_wrapper;
 #elif PLATFORM(GTK)
     AtkObject* m_wrapper;
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
index 4c50b9a3ba..8de8e5bfdb 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -30,8 +30,8 @@
 #include "AccessibilityRenderObject.h"
 
 #include "AXObjectCache.h"
-#include "AccessibilityListBox.h"
 #include "AccessibilityImageMapLink.h"
+#include "AccessibilityListBox.h"
 #include "CharacterNames.h"
 #include "EventNames.h"
 #include "FloatRect.h"
@@ -53,6 +53,7 @@
 #include "HitTestResult.h"
 #include "LocalizedStrings.h"
 #include "NodeList.h"
+#include "ProgressTracker.h"
 #include "RenderButton.h"
 #include "RenderFieldset.h"
 #include "RenderFileUploadControl.h"
@@ -64,9 +65,11 @@
 #include "RenderMenuList.h"
 #include "RenderText.h"
 #include "RenderTextControl.h"
+#include "RenderTextFragment.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
+#include "SelectElement.h"
 #include "SelectionController.h"
 #include "Text.h"
 #include "TextIterator.h"
@@ -84,6 +87,8 @@ AccessibilityRenderObject::AccessibilityRenderObject(RenderObject* renderer)
     : AccessibilityObject()
     , m_renderer(renderer)
     , m_ariaRole(UnknownRole)
+    , m_childrenDirty(false)
+    , m_roleForMSAA(UnknownRole)
 {
     updateAccessibilityRole();
 #ifndef NDEBUG
@@ -166,7 +171,7 @@ AccessibilityObject* AccessibilityRenderObject::parentObjectIfExists() const
     if (!m_renderer)
         return 0;
     
-    RenderObject *parent = m_renderer->parent();
+    RenderObject* parent = m_renderer->parent();
     if (!parent)
         return 0;
 
@@ -178,7 +183,7 @@ AccessibilityObject* AccessibilityRenderObject::parentObject() const
     if (!m_renderer)
         return 0;
     
-    RenderObject *parent = m_renderer->parent();
+    RenderObject* parent = m_renderer->parent();
     if (!parent)
         return 0;
     
@@ -296,10 +301,10 @@ bool AccessibilityRenderObject::isSlider() const
 bool AccessibilityRenderObject::isMenuRelated() const
 {
     AccessibilityRole role = roleValue();
-    return  role == MenuRole ||
-            role == MenuBarRole ||
-            role == MenuButtonRole ||
-            role == MenuItemRole;
+    return role == MenuRole 
+        || role == MenuBarRole
+        || role == MenuButtonRole
+        || role == MenuItemRole;
 }    
 
 bool AccessibilityRenderObject::isMenu() const
@@ -361,11 +366,21 @@ bool AccessibilityRenderObject::isChecked() const
     if (!m_renderer->node() || !m_renderer->node()->isElementNode())
         return false;
 
+    // First test for native checkedness semantics
     InputElement* inputElement = toInputElement(static_cast<Element*>(m_renderer->node()));
-    if (!inputElement)
+    if (inputElement)
+        return inputElement->isChecked();
+
+    // Else, if this is an ARIA checkbox or radio, respect the aria-checked attribute
+    AccessibilityRole ariaRole = ariaRoleAttribute();
+    if (ariaRole == RadioButtonRole || ariaRole == CheckBoxRole) {
+        if (equalIgnoringCase(getAttribute(aria_checkedAttr), "true"))
+            return true;
         return false;
+    }
 
-    return inputElement->isChecked();
+    // Otherwise it's not checked
+    return false;
 }
 
 bool AccessibilityRenderObject::isHovered() const
@@ -374,9 +389,16 @@ bool AccessibilityRenderObject::isHovered() const
     return m_renderer->node() && m_renderer->node()->hovered();
 }
 
-bool AccessibilityRenderObject::isMultiSelect() const
+bool AccessibilityRenderObject::isMultiSelectable() const
 {
     ASSERT(m_renderer);
+    
+    const AtomicString& ariaMultiSelectable = getAttribute(aria_multiselectableAttr);
+    if (equalIgnoringCase(ariaMultiSelectable, "true"))
+        return true;
+    if (equalIgnoringCase(ariaMultiSelectable, "false"))
+        return false;
+    
     if (!m_renderer->isListBox())
         return false;
     return m_renderer->node() && static_cast<HTMLSelectElement*>(m_renderer->node())->multiple();
@@ -505,18 +527,28 @@ AccessibilityObject* AccessibilityRenderObject::selectedRadioButton()
     }
     return 0;
 }
+
+AccessibilityObject* AccessibilityRenderObject::selectedTabItem()
+{
+    if (!isTabList())
+        return 0;
+    
+    // Find the child tab item that is selected (ie. the intValue == 1).
+    AccessibilityObject::AccessibilityChildrenVector tabs;
+    tabChildren(tabs);
+    
+    int count = tabs.size();
+    for (int i = 0; i < count; ++i) {
+        AccessibilityObject* object = m_children[i].get();
+        if (object->isTabItem() && object->intValue() == 1)
+            return object;
+    }
+    return 0;
+}
     
 const AtomicString& AccessibilityRenderObject::getAttribute(const QualifiedName& attribute) const
 {
-    Node* node = m_renderer->node();
-    if (!node)
-        return nullAtom;
-
-    if (!node->isElementNode())
-        return nullAtom;
-
-    Element* element = static_cast<Element*>(node);
-    return element->getAttribute(attribute);
+    return AccessibilityObject::getAttribute(m_renderer->node(), attribute);
 }
 
 Element* AccessibilityRenderObject::anchorElement() const
@@ -578,6 +610,10 @@ Element* AccessibilityRenderObject::actionElement() const
     if (m_renderer->isMenuList())
         return static_cast<Element*>(m_renderer->node());
 
+    AccessibilityRole role = roleValue();
+    if (role == ButtonRole || role == PopUpButtonRole)
+        return static_cast<Element*>(m_renderer->node()); 
+    
     Element* elt = anchorElement();
     if (!elt)
         elt = mouseButtonListener();
@@ -693,23 +729,46 @@ String AccessibilityRenderObject::helpText() const
     return String();
 }
     
-String AccessibilityRenderObject::language() const
+unsigned AccessibilityRenderObject::hierarchicalLevel() const
 {
     if (!m_renderer)
-        return String();
-    
-    // Defer to parent if this element doesn't have a language set
+        return 0;
+
     Node* node = m_renderer->node();
-    if (!node)
-        return AccessibilityObject::language();
+    if (!node || !node->isElementNode())
+        return 0;
+    Element* element = static_cast<Element*>(node);
+    String ariaLevel = element->getAttribute(aria_levelAttr);
+    if (!ariaLevel.isEmpty())
+        return ariaLevel.toInt();
     
-    if (!node->isElementNode())
-        return AccessibilityObject::language();
+    // Only tree item will calculate its level through the DOM currently.
+    if (roleValue() != TreeItemRole)
+        return 0;
+    
+    // Hierarchy leveling starts at 0.
+    // We measure tree hierarchy by the number of groups that the item is within.
+    unsigned level = 0;
+    AccessibilityObject* parent = parentObject();
+    while (parent) {
+        AccessibilityRole parentRole = parent->roleValue();
+        if (parentRole == GroupRole)
+            level++;
+        else if (parentRole == TreeRole)
+            break;
+        
+        parent = parent->parentObject();
+    }
     
-    String language = static_cast<Element*>(node)->getAttribute(langAttr);
-    if (language.isEmpty())
-        return AccessibilityObject::language();
-    return language;
+    return level;
+}
+    
+String AccessibilityRenderObject::language() const
+{
+    if (!m_renderer)
+        return String();
+    
+    return AccessibilityObject::language(m_renderer->node());
 }
 
 String AccessibilityRenderObject::textUnderElement() const
@@ -730,6 +789,14 @@ String AccessibilityRenderObject::textUnderElement() const
         }
     }
     
+    // Sometimes text fragments don't have Node's associated with them (like when
+    // CSS content is used to insert text).
+    if (m_renderer->isText()) {
+        RenderText* renderTextObject = toRenderText(m_renderer);
+        if (renderTextObject->isTextFragment())
+            return String(static_cast<RenderTextFragment*>(m_renderer)->contentString());
+    }
+    
     // return the null string for anonymous text because it is non-trivial to get
     // the actual text and, so far, that is not needed
     return String();
@@ -780,7 +847,7 @@ String AccessibilityRenderObject::valueDescription() const
     
 float AccessibilityRenderObject::valueForRange() const
 {
-    if (!isProgressIndicator() && !isSlider())
+    if (!isProgressIndicator() && !isSlider() && !isScrollbar())
         return 0.0f;
 
     return getAttribute(aria_valuenowAttr).toFloat();
@@ -807,11 +874,23 @@ String AccessibilityRenderObject::stringValue() const
     if (!m_renderer || isPasswordField())
         return String();
     
+    if (ariaRoleAttribute() == StaticTextRole)
+        return text();
+        
     if (m_renderer->isText())
         return textUnderElement();
     
-    if (m_renderer->isMenuList())
+    if (m_renderer->isMenuList()) {
+        // RenderMenuList will go straight to the text() of its selected item.
+        // This has to be overriden in the case where the selected item has an aria label
+        SelectElement* selectNode = toSelectElement(static_cast<Element*>(m_renderer->node()));
+        Element* selectedOption = selectNode->listItems()[selectNode->selectedIndex()];
+        String overridenDescription = AccessibilityObject::getAttribute(selectedOption, aria_labelAttr);
+        if (!overridenDescription.isNull())
+            return overridenDescription;
+        
         return toRenderMenuList(m_renderer)->text();
+    }
     
     if (m_renderer->isListMarker())
         return toRenderListMarker(m_renderer)->text();
@@ -864,56 +943,67 @@ static String accessibleNameForNode(Node* node)
     return String();
 }
 
-String AccessibilityRenderObject::ariaAccessibilityName(const String& s) const
+String AccessibilityRenderObject::accessibilityDescriptionForElements(Vector<Element*> &elements) const
+{
+    Vector<UChar> ariaLabel;
+    unsigned size = elements.size();
+    for (unsigned i = 0; i < size; ++i) {
+        Element* idElement = elements[i];
+        
+        String nameFragment = accessibleNameForNode(idElement);
+        ariaLabel.append(nameFragment.characters(), nameFragment.length());
+        for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement)) {
+            nameFragment = accessibleNameForNode(n);
+            ariaLabel.append(nameFragment.characters(), nameFragment.length());
+        }
+            
+        if (i != size - 1)
+            ariaLabel.append(' ');
+    }
+    return String::adopt(ariaLabel);
+}
+
+    
+void AccessibilityRenderObject::elementsFromAttribute(Vector<Element*>& elements, const QualifiedName& attribute) const
 {
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return;
+
     Document* document = m_renderer->document();
     if (!document)
-        return String();
-
-    String idList = s;
+        return;
+    
+    String idList = getAttribute(attribute).string();
+    if (idList.isEmpty())
+        return;
+    
     idList.replace('\n', ' ');
     Vector<String> idVector;
     idList.split(' ', idVector);
-
-    Vector<UChar> ariaLabel;
+    
     unsigned size = idVector.size();
     for (unsigned i = 0; i < size; ++i) {
         String idName = idVector[i];
         Element* idElement = document->getElementById(idName);
-        if (idElement) {
-            String nameFragment = accessibleNameForNode(idElement);
-            ariaLabel.append(nameFragment.characters(), nameFragment.length());
-            for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement)) {
-                nameFragment = accessibleNameForNode(n);
-                ariaLabel.append(nameFragment.characters(), nameFragment.length());
-            }
-            
-            if (i != size - 1)
-                ariaLabel.append(' ');
-        }
+        if (idElement)
+            elements.append(idElement);
     }
-    return String::adopt(ariaLabel);
 }
-
+    
+void AccessibilityRenderObject::ariaLabeledByElements(Vector<Element*>& elements) const
+{
+    elementsFromAttribute(elements, aria_labeledbyAttr);
+    if (!elements.size())
+        elementsFromAttribute(elements, aria_labelledbyAttr);
+}
+   
 String AccessibilityRenderObject::ariaLabeledByAttribute() const
 {
-    Node* node = m_renderer->node();
-    if (!node)
-        return String();
-
-    if (!node->isElementNode())
-        return String();
-
-    // The ARIA spec uses the British spelling: "labelled." It seems prudent to support the American
-    // spelling ("labeled") as well.
-    String idList = getAttribute(aria_labeledbyAttr).string();
-    if (idList.isEmpty()) {
-        idList = getAttribute(aria_labelledbyAttr).string();
-        if (idList.isEmpty())
-            return String();
-    }
-
-    return ariaAccessibilityName(idList);
+    Vector<Element*> elements;
+    ariaLabeledByElements(elements);
+    
+    return accessibilityDescriptionForElements(elements);
 }
 
 static HTMLLabelElement* labelForElement(Element* element)
@@ -990,6 +1080,8 @@ String AccessibilityRenderObject::title() const
         || ariaRole == MenuItemRole
         || ariaRole == MenuButtonRole
         || ariaRole == RadioButtonRole
+        || ariaRole == CheckBoxRole
+        || ariaRole == TabRole
         || isHeading())
         return textUnderElement();
     
@@ -1001,11 +1093,10 @@ String AccessibilityRenderObject::title() const
 
 String AccessibilityRenderObject::ariaDescribedByAttribute() const
 {
-    String idList = getAttribute(aria_describedbyAttr).string();
-    if (idList.isEmpty())
-        return String();
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_describedbyAttr);
     
-    return ariaAccessibilityName(idList);
+    return accessibilityDescriptionForElements(elements);
 }
 
 String AccessibilityRenderObject::accessibilityDescription() const
@@ -1032,7 +1123,7 @@ String AccessibilityRenderObject::accessibilityDescription() const
     }
     
     if (isWebArea()) {
-        Document *document = m_renderer->document();
+        Document* document = m_renderer->document();
         Node* owner = document->ownerElement();
         if (owner) {
             if (owner->hasTagName(frameTag) || owner->hasTagName(iframeTag)) {
@@ -1048,12 +1139,7 @@ String AccessibilityRenderObject::accessibilityDescription() const
         if (owner && owner->isHTMLElement())
             return static_cast<HTMLElement*>(owner)->getAttribute(nameAttr);
     }
-    
-    if (roleValue() == DefinitionListTermRole)
-        return AXDefinitionListTermText();
-    if (roleValue() == DefinitionListDefinitionRole)
-        return AXDefinitionListDefinitionText();
-    
+
     return String();
 }
 
@@ -1068,7 +1154,10 @@ IntRect AccessibilityRenderObject::boundingBoxRect() const
         obj = obj->node()->renderer();
     
     Vector<FloatQuad> quads;
-    obj->absoluteQuads(quads);
+    if (obj->isText())
+        obj->absoluteQuads(quads);
+    else
+        obj->absoluteFocusRingQuads(quads);
     const size_t n = quads.size();
     if (!n)
         return IntRect();
@@ -1198,6 +1287,8 @@ void AccessibilityRenderObject::addRadioButtonGroupMembers(AccessibilityChildren
 // or an internal anchor connection
 void AccessibilityRenderObject::linkedUIElements(AccessibilityChildrenVector& linkedUIElements) const
 {
+    ariaFlowToElements(linkedUIElements);
+
     if (isAnchor()) {
         AccessibilityObject* linkedAXElement = internalLinkElement();
         if (linkedAXElement)
@@ -1208,6 +1299,71 @@ void AccessibilityRenderObject::linkedUIElements(AccessibilityChildrenVector& li
         addRadioButtonGroupMembers(linkedUIElements);
 }
 
+bool AccessibilityRenderObject::hasTextAlternative() const
+{
+    // ARIA: section 2A, bullet #3 says if aria-labeledby or aria-label appears, it should
+    // override the "label" element association.
+    if (!ariaLabeledByAttribute().isEmpty() || !getAttribute(aria_labelAttr).string().isEmpty())
+        return true;
+        
+    return false;   
+}
+    
+bool AccessibilityRenderObject::supportsARIAFlowTo() const
+{
+    return !getAttribute(aria_flowtoAttr).string().isEmpty();
+}
+    
+void AccessibilityRenderObject::ariaFlowToElements(AccessibilityChildrenVector& flowTo) const
+{
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_flowtoAttr);
+    
+    AXObjectCache* cache = axObjectCache();
+    unsigned count = elements.size();
+    for (unsigned k = 0; k < count; ++k) {
+        Element* element = elements[k];
+        AccessibilityObject* flowToElement = cache->getOrCreate(element->renderer());
+        if (flowToElement)
+            flowTo.append(flowToElement);
+    }
+        
+}
+    
+bool AccessibilityRenderObject::supportsARIADropping() const 
+{
+    const AtomicString& dropEffect = getAttribute(aria_dropeffectAttr).string();
+    return !dropEffect.isEmpty();
+}
+
+bool AccessibilityRenderObject::supportsARIADragging() const
+{
+    const AtomicString& grabbed = getAttribute(aria_grabbedAttr).string();
+    return equalIgnoringCase(grabbed, "true") || equalIgnoringCase(grabbed, "false");   
+}
+
+bool AccessibilityRenderObject::isARIAGrabbed()
+{
+    return elementAttributeValue(aria_grabbedAttr);
+}
+
+void AccessibilityRenderObject::setARIAGrabbed(bool grabbed)
+{
+    setElementAttributeValue(aria_grabbedAttr, grabbed);
+}
+
+void AccessibilityRenderObject::determineARIADropEffects(Vector<String>& effects)
+{
+    String dropEffects = getAttribute(aria_dropeffectAttr).string();
+    if (dropEffects.isEmpty()) {
+        effects.clear();
+        return;
+    }
+    
+    dropEffects.replace('\n', ' ');
+    dropEffects.split(' ', effects);
+}
+    
 bool AccessibilityRenderObject::exposesTitleUIElement() const
 {
     if (!isControl())
@@ -1217,6 +1373,9 @@ bool AccessibilityRenderObject::exposesTitleUIElement() const
     if (isCheckboxOrRadio() && getAttribute(titleAttr).isEmpty())
         return false;
     
+    if (hasTextAlternative())
+        return false;
+    
     return true;
 }
     
@@ -1242,13 +1401,13 @@ AccessibilityObject* AccessibilityRenderObject::titleUIElement() const
     
 bool AccessibilityRenderObject::ariaIsHidden() const
 {
-    if (equalIgnoringCase(getAttribute(aria_hiddenAttr).string(), "true"))
+    if (equalIgnoringCase(getAttribute(aria_hiddenAttr), "true"))
         return true;
     
     // aria-hidden hides this object and any children
     AccessibilityObject* object = parentObject();
     while (object) {
-        if (object->isAccessibilityRenderObject() && equalIgnoringCase(static_cast<AccessibilityRenderObject*>(object)->getAttribute(aria_hiddenAttr).string(), "true"))
+        if (object->isAccessibilityRenderObject() && equalIgnoringCase(static_cast<AccessibilityRenderObject*>(object)->getAttribute(aria_hiddenAttr), "true"))
             return true;
         object = object->parentObject();
     }
@@ -1256,29 +1415,86 @@ bool AccessibilityRenderObject::ariaIsHidden() const
     return false;
 }
 
-bool AccessibilityRenderObject::accessibilityIsIgnored() const
+bool AccessibilityRenderObject::isDescendantOfBarrenParent() const
 {
-    // is the platform is interested in this object?
-    AccessibilityObjectPlatformInclusion decision = accessibilityPlatformIncludesObject();
-    if (decision == IncludeObject)
-        return false;
-    if (decision == IgnoreObject)
-        return true;
-    // the decision must, therefore, be DefaultBehavior.
-
-    // ignore invisible element
+    for (AccessibilityObject* object = parentObject(); object; object = object->parentObject()) {
+        if (!object->canHaveChildren())
+            return true;
+    }
+    
+    return false;
+}
+    
+bool AccessibilityRenderObject::isAllowedChildOfTree() const
+{
+    // Determine if this is in a tree. If so, we apply special behavior to make it work like an AXOutline.
+    AccessibilityObject* axObj = parentObject();
+    bool isInTree = false;
+    while (axObj) {
+        if (axObj->isTree()) {
+            isInTree = true;
+            break;
+        }
+        axObj = axObj->parentObject();
+    }
+    
+    // If the object is in a tree, only tree items should be exposed (and the children of tree items).
+    if (isInTree) {
+        AccessibilityRole role = roleValue();
+        if (role != TreeItemRole && role != StaticTextRole)
+            return false;
+    }
+    return true;
+}
+    
+AccessibilityObjectInclusion AccessibilityRenderObject::accessibilityIsIgnoredBase() const
+{
+    // The following cases can apply to any element that's a subclass of AccessibilityRenderObject.
+    
+    // Ignore invisible elements.
     if (!m_renderer || m_renderer->style()->visibility() != VISIBLE)
-        return true;
+        return IgnoreObject;
 
+    // Anything marked as aria-hidden or a child of something aria-hidden must be hidden.
     if (ariaIsHidden())
-        return true;
+        return IgnoreObject;
     
+    // Anything that is a presentational role must be hidden.
     if (isPresentationalChildOfAriaRole())
-        return true;
+        return IgnoreObject;
+
+    // Allow the platform to make a decision.
+    AccessibilityObjectInclusion decision = accessibilityPlatformIncludesObject();
+    if (decision == IncludeObject)
+        return IncludeObject;
+    if (decision == IgnoreObject)
+        return IgnoreObject;
         
+    return DefaultBehavior;
+}  
+ 
+bool AccessibilityRenderObject::accessibilityIsIgnored() const
+{
+    // Check first if any of the common reasons cause this element to be ignored.
+    // Then process other use cases that need to be applied to all the various roles
+    // that AccessibilityRenderObjects take on.
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
+    // If this element is within a parent that cannot have children, it should not be exposed.
+    if (isDescendantOfBarrenParent())
+        return true;    
+    
     if (roleValue() == IgnoredRole)
         return true;
     
+    // An ARIA tree can only have tree items and static text as children.
+    if (!isAllowedChildOfTree())
+        return true;
+    
     // ignore popup menu items because AppKit does
     for (RenderObject* parent = m_renderer->parent(); parent; parent = parent->parent()) {
         if (parent->isMenuList())
@@ -1288,7 +1504,7 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     // find out if this element is inside of a label element.
     // if so, it may be ignored because it's the label for a checkbox or radio button
     AccessibilityObject* controlObject = correspondingControlForLabelElement();
-    if (controlObject && !controlObject->exposesTitleUIElement())
+    if (controlObject && !controlObject->exposesTitleUIElement() && controlObject->isCheckboxOrRadio())
         return true;
         
     AccessibilityRole ariaRole = ariaRoleAttribute();
@@ -1300,8 +1516,8 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     // NOTE: BRs always have text boxes now, so the text box check here can be removed
     if (m_renderer->isText()) {
         // static text beneath MenuItems and MenuButtons are just reported along with the menu item, so it's ignored on an individual level
-        if (parentObjectUnignored()->ariaRoleAttribute() == MenuItemRole ||
-            parentObjectUnignored()->ariaRoleAttribute() == MenuButtonRole)
+        if (parentObjectUnignored()->ariaRoleAttribute() == MenuItemRole
+            || parentObjectUnignored()->ariaRoleAttribute() == MenuButtonRole)
             return true;
         RenderText* renderText = toRenderText(m_renderer);
         if (m_renderer->isBR() || !renderText->firstTextBox())
@@ -1321,11 +1537,28 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     if (isControl())
         return false;
     
+    if (ariaRole != UnknownRole)
+        return false;
+    
     // don't ignore labels, because they serve as TitleUIElements
     Node* node = m_renderer->node();
     if (node && node->hasTagName(labelTag))
         return false;
     
+    // Anything that is content editable should not be ignored.
+    // However, one cannot just call node->isContentEditable() since that will ask if its parents
+    // are also editable. Only the top level content editable region should be exposed.
+    if (node && node->isElementNode()) {
+        Element* element = static_cast<Element*>(node);
+        const AtomicString& contentEditable = element->getAttribute(contenteditableAttr);
+        if (equalIgnoringCase(contentEditable, "true"))
+            return false;
+    }
+    
+    // if this element has aria attributes on it, it should not be ignored.
+    if (supportsARIAAttributes())
+        return false;
+    
     if (m_renderer->isBlockFlow() && m_renderer->childrenInline())
         return !toRenderBlock(m_renderer)->firstLineBox() && !mouseButtonListener();
     
@@ -1364,9 +1597,6 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
         return false;
     }
     
-    if (ariaRole != UnknownRole)
-        return false;
-    
     // make a platform-specific decision
     if (isAttachment())
         return accessibilityIgnoreAttachment();
@@ -1379,6 +1609,21 @@ bool AccessibilityRenderObject::isLoaded() const
     return !m_renderer->document()->tokenizer();
 }
 
+double AccessibilityRenderObject::estimatedLoadingProgress() const
+{
+    if (!m_renderer)
+        return 0;
+    
+    if (isLoaded())
+        return 1.0;
+    
+    Page* page = m_renderer->document()->page();
+    if (!page)
+        return 0;
+    
+    return page->progress()->estimatedProgress();
+}
+    
 int AccessibilityRenderObject::layoutCount() const
 {
     if (!m_renderer->isRenderView())
@@ -1388,6 +1633,10 @@ int AccessibilityRenderObject::layoutCount() const
 
 String AccessibilityRenderObject::text() const
 {
+    // If this is a user defined static text, use the accessible name computation.
+    if (ariaRoleAttribute() == StaticTextRole)
+        return accessibilityDescription();
+    
     if (!isTextControl() || isPasswordField())
         return String();
     
@@ -1545,6 +1794,51 @@ bool AccessibilityRenderObject::isVisited() const
     return m_renderer->style()->pseudoState() == PseudoVisited;
 }
     
+bool AccessibilityRenderObject::isExpanded() const
+{
+    if (equalIgnoringCase(getAttribute(aria_expandedAttr).string(), "true"))
+        return true;
+    
+    return false;  
+}
+
+void AccessibilityRenderObject::setElementAttributeValue(const QualifiedName& attributeName, bool value)
+{
+    if (!m_renderer)
+        return;
+    
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return;
+    
+    Element* element = static_cast<Element*>(node);
+    element->setAttribute(attributeName, (value) ? "true" : "false");        
+}
+    
+bool AccessibilityRenderObject::elementAttributeValue(const QualifiedName& attributeName) const
+{
+    if (!m_renderer)
+        return false;
+    
+    return equalIgnoringCase(getAttribute(attributeName), "true");
+}
+    
+void AccessibilityRenderObject::setIsExpanded(bool isExpanded)
+{
+    // Combo boxes, tree items and rows can be expanded (in different ways on different platforms).
+    // That action translates into setting the aria-expanded attribute to true.
+    AccessibilityRole role = roleValue();
+    switch (role) {
+    case ComboBoxRole:
+    case TreeItemRole:
+    case RowRole:
+        setElementAttributeValue(aria_expandedAttr, isExpanded);
+        break;
+    default:
+        break;
+    }
+}
+    
 bool AccessibilityRenderObject::isRequired() const
 {
     if (equalIgnoringCase(getAttribute(aria_requiredAttr).string(), "true"))
@@ -1562,9 +1856,56 @@ bool AccessibilityRenderObject::isSelected() const
     if (!node)
         return false;
     
+    String ariaSelected = getAttribute(aria_selectedAttr).string();
+    if (equalIgnoringCase(ariaSelected, "true"))
+        return true;    
+    
+    if (isTabItem() && isTabItemSelected())
+        return true;
+
     return false;
 }
 
+bool AccessibilityRenderObject::isTabItemSelected() const
+{
+    if (!isTabItem() || !m_renderer)
+        return false;
+    
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return false;
+    
+    // The ARIA spec says a tab item can also be selected if it is aria-labeled by a tabpanel
+    // that has keyboard focus inside of it, or if a tabpanel in its aria-controls list has KB
+    // focus inside of it.
+    AccessibilityObject* focusedElement = focusedUIElement();
+    if (!focusedElement)
+        return false;
+    
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_controlsAttr);
+    
+    unsigned count = elements.size();
+    for (unsigned k = 0; k < count; ++k) {
+        Element* element = elements[k];
+        AccessibilityObject* tabPanel = axObjectCache()->getOrCreate(element->renderer());
+
+        // A tab item should only control tab panels.
+        if (!tabPanel || tabPanel->roleValue() != TabPanelRole)
+            continue;
+        
+        AccessibilityObject* checkFocusElement = focusedElement;
+        // Check if the focused element is a descendant of the element controlled by the tab item.
+        while (checkFocusElement) {
+            if (tabPanel == checkFocusElement)
+                return true;
+            checkFocusElement = checkFocusElement->parentObject();
+        }
+    }
+    
+    return false;
+}
+    
 bool AccessibilityRenderObject::isFocused() const
 {
     if (!m_renderer)
@@ -1580,8 +1921,8 @@ bool AccessibilityRenderObject::isFocused() const
     
     // A web area is represented by the Document node in the DOM tree, which isn't focusable.
     // Check instead if the frame's selection controller is focused
-    if (focusedNode == m_renderer->node() || 
-        (roleValue() == WebAreaRole && document->frame()->selection()->isFocusedAndActive()))
+    if (focusedNode == m_renderer->node()
+        || (roleValue() == WebAreaRole && document->frame()->selection()->isFocusedAndActive()))
         return true;
     
     return false;
@@ -1613,6 +1954,27 @@ void AccessibilityRenderObject::changeValueByPercent(float percentChange)
     axObjectCache()->postNotification(m_renderer, AXObjectCache::AXValueChanged, true);
 }
     
+void AccessibilityRenderObject::setSelected(bool enabled)
+{
+    setElementAttributeValue(aria_selectedAttr, enabled);
+}
+
+void AccessibilityRenderObject::setSelectedRows(AccessibilityChildrenVector& selectedRows)
+{
+    // Setting selected only makes sense in trees and tables (and tree-tables).
+    AccessibilityRole role = roleValue();
+    if (role != TreeRole && role != TreeGridRole && role != TableRole)
+        return;
+    
+    bool isMulti = isMultiSelectable();
+    unsigned count = selectedRows.size();
+    if (count > 1 && !isMulti)
+        count = 1;
+    
+    for (unsigned k = 0; k < count; ++k)
+        selectedRows[k]->setSelected(true);
+}
+    
 void AccessibilityRenderObject::setValue(const String& string)
 {
     if (!m_renderer)
@@ -1632,6 +1994,29 @@ void AccessibilityRenderObject::setValue(const String& string)
     }
 }
 
+void AccessibilityRenderObject::ariaOwnsElements(AccessibilityChildrenVector& axObjects) const
+{
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_ownsAttr);
+    
+    unsigned count = elements.size();
+    for (unsigned k = 0; k < count; ++k) {
+        RenderObject* render = elements[k]->renderer();
+        AccessibilityObject* obj = axObjectCache()->getOrCreate(render);
+        if (obj)
+            axObjects.append(obj);
+    }
+}
+
+bool AccessibilityRenderObject::supportsARIAOwns() const
+{
+    if (!m_renderer)
+        return false;
+    const AtomicString& ariaOwns = getAttribute(aria_ownsAttr).string();
+
+    return !ariaOwns.isEmpty();
+}
+    
 bool AccessibilityRenderObject::isEnabled() const
 {
     ASSERT(m_renderer);
@@ -1653,6 +2038,8 @@ RenderView* AccessibilityRenderObject::topRenderer() const
 
 Document* AccessibilityRenderObject::document() const
 {
+    if (!m_renderer)
+        return 0;
     return m_renderer->document();
 }
 
@@ -1676,24 +2063,14 @@ AXObjectCache* AccessibilityRenderObject::axObjectCache() const
 AccessibilityObject* AccessibilityRenderObject::accessibilityParentForImageMap(HTMLMapElement* map) const
 {
     // find an image that is using this map
-    if (!m_renderer || !map)
+    if (!map)
         return 0;
 
-    String mapName = map->getName().string().lower();
-    RefPtr<HTMLCollection> coll = m_renderer->document()->images();
-    for (Node* curr = coll->firstItem(); curr; curr = coll->nextItem()) {
-        RenderObject* obj = curr->renderer();
-        if (!obj || !curr->hasTagName(imgTag))
-            continue;
-        
-        // The HTMLImageElement's useMap() value includes the '#' symbol at the beginning,
-        // which has to be stripped off
-        String useMapName = static_cast<HTMLImageElement*>(curr)->getAttribute(usemapAttr).string().substring(1).lower();
-        if (useMapName == mapName)
-            return axObjectCache()->getOrCreate(obj);
-    }
+    HTMLImageElement* imageElement = map->imageElement();
+    if (!imageElement)
+        return 0;
     
-    return 0;
+    return axObjectCache()->getOrCreate(imageElement->renderer());
 }
     
 void AccessibilityRenderObject::getDocumentLinks(AccessibilityChildrenVector& result)
@@ -1777,7 +2154,7 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRange() const
 
 VisiblePositionRange AccessibilityRenderObject::visiblePositionRangeForLine(unsigned lineCount) const
 {
-    if (lineCount == 0 || !m_renderer)
+    if (!lineCount || !m_renderer)
         return VisiblePositionRange();
     
     // iterate over the lines
@@ -1785,7 +2162,7 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRangeForLine(unsi
     // last offset of the last line
     VisiblePosition visiblePos = m_renderer->document()->renderer()->positionForCoordinates(0, 0);
     VisiblePosition savedVisiblePos;
-    while (--lineCount != 0) {
+    while (--lineCount) {
         savedVisiblePos = visiblePos;
         visiblePos = nextLinePosition(visiblePos, 0);
         if (visiblePos.isNull() || visiblePos == savedVisiblePos)
@@ -1900,9 +2277,8 @@ void AccessibilityRenderObject::setSelectedVisiblePositionRange(const VisiblePos
         return;
     
     // make selection and tell the document to use it. if it's zero length, then move to that position
-    if (range.start == range.end) {
+    if (range.start == range.end)
         m_renderer->document()->frame()->selection()->moveTo(range.start, true);
-    }
     else {
         VisibleSelection newSelection = VisibleSelection(range.start, range.end);
         m_renderer->document()->frame()->selection()->setSelection(newSelection);
@@ -1998,7 +2374,7 @@ PlainTextRange AccessibilityRenderObject::doAXRangeForLine(unsigned lineNumber)
     // iterate to the specified line
     VisiblePosition visiblePos = visiblePositionForIndex(0);
     VisiblePosition savedVisiblePos;
-    for (unsigned lineCount = lineNumber; lineCount != 0; lineCount -= 1) {
+    for (unsigned lineCount = lineNumber; lineCount; lineCount -= 1) {
         savedVisiblePos = visiblePos;
         visiblePos = nextLinePosition(visiblePos, 0);
         if (visiblePos.isNull() || visiblePos == savedVisiblePos)
@@ -2053,8 +2429,8 @@ String AccessibilityRenderObject::doAXStringForRange(const PlainTextRange& range
     if (isPasswordField())
         return String();
     
-    if (range.length == 0)
-        return "";
+    if (!range.length)
+        return String();
     
     if (!isTextControl())
         return String();
@@ -2081,7 +2457,7 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityImageMapHitTest(HTM
     if (!area)
         return 0;
     
-    HTMLMapElement *map = static_cast<HTMLMapElement*>(area->parent());
+    HTMLMapElement* map = static_cast<HTMLMapElement*>(area->parent());
     AccessibilityObject* parent = accessibilityParentForImageMap(map);
     if (!parent)
         return 0;
@@ -2115,14 +2491,21 @@ AccessibilityObject* AccessibilityRenderObject::doAccessibilityHitTest(const Int
     if (node->hasTagName(areaTag)) 
         return accessibilityImageMapHitTest(static_cast<HTMLAreaElement*>(node), point);
     
+    if (node->hasTagName(optionTag))
+        node = static_cast<HTMLOptionElement*>(node)->ownerSelectElement();
+    
     RenderObject* obj = node->renderer();
     if (!obj)
         return 0;
     
     AccessibilityObject* result = obj->document()->axObjectCache()->getOrCreate(obj);
 
-    if (obj->isListBox())
-        return static_cast<AccessibilityListBox*>(result)->doAccessibilityHitTest(point);
+    if (obj->isListBox()) {
+        // Make sure the children are initialized so that hit testing finds the right element.
+        AccessibilityListBox* listBox = static_cast<AccessibilityListBox*>(result);
+        listBox->updateChildrenIfNecessary();
+        return listBox->doAccessibilityHitTest(point);
+    }
         
     if (result->accessibilityIsIgnored()) {
         // If this element is the label of a control, a hit test should return the control.
@@ -2159,14 +2542,14 @@ bool AccessibilityRenderObject::shouldFocusActiveDescendant() const
     case ProgressIndicatorRole:
     case ToolbarRole:
     case OutlineRole:
+    case TreeRole:
+    case GridRole:
     /* FIXME: replace these with actual roles when they are added to AccessibilityRole
     composite
     alert
     alertdialog
-    grid
     status
     timer
-    tree
     */
         return true;
     default:
@@ -2176,19 +2559,22 @@ bool AccessibilityRenderObject::shouldFocusActiveDescendant() const
 
 AccessibilityObject* AccessibilityRenderObject::activeDescendant() const
 {
-    if (renderer()->node() && !renderer()->node()->isElementNode())
+    if (!m_renderer)
         return 0;
-    Element* element = static_cast<Element*>(renderer()->node());
+    
+    if (m_renderer->node() && !m_renderer->node()->isElementNode())
+        return 0;
+    Element* element = static_cast<Element*>(m_renderer->node());
         
     String activeDescendantAttrStr = element->getAttribute(aria_activedescendantAttr).string();
     if (activeDescendantAttrStr.isNull() || activeDescendantAttrStr.isEmpty())
         return 0;
     
-    Element* target = renderer()->document()->getElementById(activeDescendantAttrStr);
+    Element* target = document()->getElementById(activeDescendantAttrStr);
     if (!target)
         return 0;
     
-    AccessibilityObject* obj = renderer()->document()->axObjectCache()->getOrCreate(target->renderer());
+    AccessibilityObject* obj = axObjectCache()->getOrCreate(target->renderer());
     if (obj && obj->isAccessibilityRenderObject())
     // an activedescendant is only useful if it has a renderer, because that's what's needed to post the notification
         return obj;
@@ -2207,7 +2593,7 @@ void AccessibilityRenderObject::handleActiveDescendantChanged()
     AccessibilityRenderObject* activedescendant = static_cast<AccessibilityRenderObject*>(activeDescendant());
     
     if (activedescendant && shouldFocusActiveDescendant())
-        doc->axObjectCache()->postNotification(activedescendant->renderer(), AXObjectCache::AXFocusedUIElementChanged, true);
+        doc->axObjectCache()->postNotification(m_renderer, AXObjectCache::AXActiveDescendantChanged, true);
 }
 
 AccessibilityObject* AccessibilityRenderObject::correspondingControlForLabelElement() const
@@ -2247,80 +2633,6 @@ AccessibilityObject* AccessibilityRenderObject::observableObject() const
     
     return 0;
 }
-    
-typedef HashMap<String, AccessibilityRole, CaseFoldingHash> ARIARoleMap;
-
-struct RoleEntry {
-    String ariaRole;
-    AccessibilityRole webcoreRole;
-};
-
-static const ARIARoleMap& createARIARoleMap()
-{
-    const RoleEntry roles[] = {
-        { "application", LandmarkApplicationRole },
-        { "article", DocumentArticleRole },
-        { "banner", LandmarkBannerRole },
-        { "button", ButtonRole },
-        { "checkbox", CheckBoxRole },
-        { "complementary", LandmarkComplementaryRole },
-        { "contentinfo", LandmarkContentInfoRole },
-        { "grid", TableRole },
-        { "gridcell", CellRole },
-        { "columnheader", ColumnHeaderRole },
-        { "definition", DefinitionListDefinitionRole },
-        { "document", DocumentRole },
-        { "rowheader", RowHeaderRole },
-        { "group", GroupRole },
-        { "heading", HeadingRole },
-        { "img", ImageRole },
-        { "link", WebCoreLinkRole },
-        { "list", ListRole },        
-        { "listitem", GroupRole },        
-        { "listbox", ListBoxRole },
-        { "log", ApplicationLogRole },
-        // "option" isn't here because it may map to different roles depending on the parent element's role
-        { "main", LandmarkMainRole },
-        { "marquee", ApplicationMarqueeRole },
-        { "menu", MenuRole },
-        { "menubar", GroupRole },
-        // "menuitem" isn't here because it may map to different roles depending on the parent element's role
-        { "menuitemcheckbox", MenuItemRole },
-        { "menuitemradio", MenuItemRole },
-        { "note", DocumentNoteRole },
-        { "navigation", LandmarkNavigationRole },
-        { "option", ListBoxOptionRole },
-        { "presentation", IgnoredRole },
-        { "progressbar", ProgressIndicatorRole },
-        { "radio", RadioButtonRole },
-        { "radiogroup", RadioGroupRole },
-        { "region", DocumentRegionRole },
-        { "row", RowRole },
-        { "range", SliderRole },
-        { "search", LandmarkSearchRole },
-        { "separator", SplitterRole },
-        { "slider", SliderRole },
-        { "spinbutton", ProgressIndicatorRole },
-        { "status", ApplicationStatusRole },
-        { "textbox", TextAreaRole },
-        { "timer", ApplicationTimerRole },
-        { "toolbar", ToolbarRole },
-        { "tooltip", UserInterfaceTooltipRole }
-    };
-    ARIARoleMap& roleMap = *new ARIARoleMap;
-        
-    const unsigned numRoles = sizeof(roles) / sizeof(roles[0]);
-    for (unsigned i = 0; i < numRoles; ++i)
-        roleMap.set(roles[i].ariaRole, roles[i].webcoreRole);
-    return roleMap;
-}
-
-static AccessibilityRole ariaRoleToWebCoreRole(String value)
-{
-    ASSERT(!value.isEmpty() && !value.isNull());
-    static const ARIARoleMap& roleMap = createARIARoleMap();
-    return roleMap.get(value);
-}
 
 AccessibilityRole AccessibilityRenderObject::determineAriaRoleAttribute() const
 {
@@ -2329,17 +2641,21 @@ AccessibilityRole AccessibilityRenderObject::determineAriaRoleAttribute() const
         return UnknownRole;
     
     AccessibilityRole role = ariaRoleToWebCoreRole(ariaRole);
+
+    if (role == ButtonRole && elementAttributeValue(aria_haspopupAttr))
+        role = PopUpButtonRole;
+    
     if (role)
         return role;
     // selects and listboxes both have options as child roles, but they map to different roles within WebCore
-    if (equalIgnoringCase(ariaRole,"option")) {
+    if (equalIgnoringCase(ariaRole, "option")) {
         if (parentObjectUnignored()->ariaRoleAttribute() == MenuRole)
             return MenuItemRole;
         if (parentObjectUnignored()->ariaRoleAttribute() == ListBoxRole)
             return ListBoxOptionRole;
     }
     // an aria "menuitem" may map to MenuButton or MenuItem depending on its parent
-    if (equalIgnoringCase(ariaRole,"menuitem")) {
+    if (equalIgnoringCase(ariaRole, "menuitem")) {
         if (parentObjectUnignored()->ariaRoleAttribute() == GroupRole)
             return MenuButtonRole;
         if (parentObjectUnignored()->ariaRoleAttribute() == MenuRole)
@@ -2418,7 +2734,7 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
     if (m_renderer->isMenuList())
         return PopUpButtonRole;
     
-    if (headingLevel() != 0)
+    if (headingLevel())
         return HeadingRole;
     
     if (node && node->hasTagName(ddTag))
@@ -2429,19 +2745,43 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
 
     if (node && (node->hasTagName(rpTag) || node->hasTagName(rtTag)))
         return AnnotationRole;
-    
+
+#if PLATFORM(GTK)
+    // Gtk ATs expect all tables, data and layout, to be exposed as tables.
+    if (node && (node->hasTagName(tdTag) || node->hasTagName(thTag)))
+        return CellRole;
+
+    if (node && node->hasTagName(trTag))
+        return RowRole;
+
+    if (node && node->hasTagName(tableTag))
+        return TableRole;
+#endif   
+
     if (m_renderer->isBlockFlow() || (node && node->hasTagName(labelTag)))
         return GroupRole;
     
     return UnknownRole;
 }
 
+AccessibilityOrientation AccessibilityRenderObject::orientation() const
+{
+    const AtomicString& ariaOrientation = getAttribute(aria_orientationAttr).string();
+    if (equalIgnoringCase(ariaOrientation, "horizontal"))
+        return AccessibilityOrientationHorizontal;
+    if (equalIgnoringCase(ariaOrientation, "vertical"))
+        return AccessibilityOrientationVertical;
+    
+    return AccessibilityObject::orientation();
+}
+    
 bool AccessibilityRenderObject::isPresentationalChildOfAriaRole() const
 {
     // Walk the parent chain looking for a parent that has presentational children
     AccessibilityObject* parent;
     for (parent = parentObject(); parent && !parent->ariaRoleHasPresentationalChildren(); parent = parent->parentObject())
-        ;
+    { }
+    
     return parent;
 }
     
@@ -2474,30 +2814,36 @@ bool AccessibilityRenderObject::canSetFocusAttribute() const
         return false;
 
     switch (roleValue()) {
-        case WebCoreLinkRole:
-        case ImageMapLinkRole:
-        case TextFieldRole:
-        case TextAreaRole:
-        case ButtonRole:
-        case PopUpButtonRole:
-        case CheckBoxRole:
-        case RadioButtonRole:
-        case SliderRole:
-            return true;
-        default:
-            return false;
+    case WebCoreLinkRole:
+    case ImageMapLinkRole:
+    case TextFieldRole:
+    case TextAreaRole:
+    case ButtonRole:
+    case PopUpButtonRole:
+    case CheckBoxRole:
+    case RadioButtonRole:
+    case SliderRole:
+        return true;
+    default:
+        return node->supportsFocus();
     }
 }
+    
+bool AccessibilityRenderObject::canSetExpandedAttribute() const
+{
+    // An object can be expanded if it aria-expanded is true or false.
+    String ariaExpanded = getAttribute(aria_expandedAttr).string();
+    return equalIgnoringCase(ariaExpanded, "true") || equalIgnoringCase(ariaExpanded, "false");
+}
 
 bool AccessibilityRenderObject::canSetValueAttribute() const
 {
     if (equalIgnoringCase(getAttribute(aria_readonlyAttr).string(), "true"))
         return false;
 
-    if (isWebArea() || isTextControl()) 
-        return !isReadOnly();
-
-    return isProgressIndicator() || isSlider();
+    // Any node could be contenteditable, so isReadOnly should be relied upon
+    // for this information for all elements.
+    return isProgressIndicator() || isSlider() || !isReadOnly();
 }
 
 bool AccessibilityRenderObject::canSetTextRangeAttributes() const
@@ -2505,22 +2851,50 @@ bool AccessibilityRenderObject::canSetTextRangeAttributes() const
     return isTextControl();
 }
 
+void AccessibilityRenderObject::contentChanged()
+{
+    // If this element supports ARIA live regions, then notify the AT of changes.
+    for (RenderObject* renderParent = m_renderer->parent(); renderParent; renderParent = renderParent->parent()) {
+        AccessibilityObject* parent = m_renderer->document()->axObjectCache()->get(renderParent);
+        if (!parent)
+            continue;
+        
+        // If we find a parent that has ARIA live region on, send the notification and stop processing.
+        // The spec does not talk about nested live regions.
+        if (parent->supportsARIALiveRegion()) {
+            axObjectCache()->postNotification(renderParent, AXObjectCache::AXLiveRegionChanged, true);
+            break;
+        }
+    }
+}
+    
 void AccessibilityRenderObject::childrenChanged()
 {
     // this method is meant as a quick way of marking dirty
     // a portion of the accessibility tree
     
-    markChildrenDirty();
-    
     if (!m_renderer)
         return;
     
     // Go up the render parent chain, marking children as dirty.
     // We can't rely on the accessibilityParent() because it may not exist and we must not create an AX object here either
-    for (RenderObject* renderParent = m_renderer->parent(); renderParent; renderParent = renderParent->parent()) {
+    // At the same time, process ARIA live region changes.
+    for (RenderObject* renderParent = m_renderer; renderParent; renderParent = renderParent->parent()) {
         AccessibilityObject* parent = m_renderer->document()->axObjectCache()->get(renderParent);
-        if (parent && parent->isAccessibilityRenderObject())
-            static_cast<AccessibilityRenderObject *>(parent)->markChildrenDirty();
+        if (!parent || !parent->isAccessibilityRenderObject())
+            continue;
+        
+        AccessibilityRenderObject* axParent = static_cast<AccessibilityRenderObject*>(parent);
+        // Only do work if the children haven't been marked dirty. This has the effect of blocking
+        // future live region change notifications until the AX tree has been accessed again. This
+        // is a good performance win for all parties.
+        if (!axParent->needsToUpdateChildren()) {
+            axParent->setNeedsToUpdateChildren();
+            
+            // If this element supports ARIA live regions, then notify the AT of changes.
+            if (axParent->supportsARIALiveRegion())
+                axObjectCache()->postNotification(renderParent, AXObjectCache::AXLiveRegionChanged, true);
+        }
     }
 }
     
@@ -2531,28 +2905,40 @@ bool AccessibilityRenderObject::canHaveChildren() const
     
     // Elements that should not have children
     switch (roleValue()) {
-        case ImageRole:
-        case ButtonRole:
-        case PopUpButtonRole:
-        case CheckBoxRole:
-        case RadioButtonRole:
-        case StaticTextRole:
-        case ListBoxOptionRole:
-            return false;
-        default:
-            return true;
+    case ImageRole:
+    case ButtonRole:
+    case PopUpButtonRole:
+    case CheckBoxRole:
+    case RadioButtonRole:
+    case TabRole:
+    case StaticTextRole:
+    case ListBoxOptionRole:
+    case ScrollBarRole:
+        return false;
+    default:
+        return true;
     }
 }
 
-const AccessibilityObject::AccessibilityChildrenVector& AccessibilityRenderObject::children()
+void AccessibilityRenderObject::clearChildren()
+{
+    AccessibilityObject::clearChildren();
+    m_childrenDirty = false;
+}
+    
+void AccessibilityRenderObject::updateChildrenIfNecessary()
 {
-    if (m_childrenDirty) {
+    if (needsToUpdateChildren())
         clearChildren();        
-        m_childrenDirty = false;
-    }
     
-    if (!m_haveChildren)
-        addChildren();
+    if (!hasChildren())
+        addChildren();    
+}
+    
+const AccessibilityObject::AccessibilityChildrenVector& AccessibilityRenderObject::children()
+{
+    updateChildrenIfNecessary();
+    
     return m_children;
 }
 
@@ -2603,18 +2989,91 @@ void AccessibilityRenderObject::addChildren()
         }
     }
 }
+        
+const AtomicString& AccessibilityRenderObject::ariaLiveRegionStatus() const
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, liveRegionStatusAssertive, ("assertive"));
+    DEFINE_STATIC_LOCAL(const AtomicString, liveRegionStatusPolite, ("polite"));
+    DEFINE_STATIC_LOCAL(const AtomicString, liveRegionStatusOff, ("off"));
+    
+    const AtomicString& liveRegionStatus = getAttribute(aria_liveAttr);
+    // These roles have implicit live region status.
+    if (liveRegionStatus.isEmpty()) {
+        switch (roleValue()) {
+        case ApplicationAlertDialogRole:
+        case ApplicationAlertRole:
+            return liveRegionStatusAssertive;
+        case ApplicationLogRole:
+        case ApplicationStatusRole:
+            return liveRegionStatusPolite;
+        case ApplicationTimerRole:
+            return liveRegionStatusOff;
+        default:
+            break;
+        }
+    }
+
+    return liveRegionStatus;
+}
+
+const AtomicString& AccessibilityRenderObject::ariaLiveRegionRelevant() const
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, defaultLiveRegionRelevant, ("additions text"));
+    const AtomicString& relevant = getAttribute(aria_relevantAttr);
 
+    // Default aria-relevant = "additions text".
+    if (relevant.isEmpty())
+        return defaultLiveRegionRelevant;
+    
+    return relevant;
+}
+
+bool AccessibilityRenderObject::ariaLiveRegionAtomic() const
+{
+    return elementAttributeValue(aria_atomicAttr);    
+}
+
+bool AccessibilityRenderObject::ariaLiveRegionBusy() const
+{
+    return elementAttributeValue(aria_busyAttr);    
+}
+    
+void AccessibilityRenderObject::ariaSelectedRows(AccessibilityChildrenVector& result)
+{
+    // Get all the rows. 
+    AccessibilityChildrenVector allRows;
+    ariaTreeRows(allRows);
+
+    // Determine which rows are selected.
+    bool isMulti = isMultiSelectable();
+
+    // Prefer active descendant over aria-selected.
+    AccessibilityObject* activeDesc = activeDescendant();
+    if (activeDesc && (activeDesc->isTreeItem() || activeDesc->isTableRow())) {
+        result.append(activeDesc);    
+        if (!isMulti)
+            return;
+    }
+
+    unsigned count = allRows.size();
+    for (unsigned k = 0; k < count; ++k) {
+        if (allRows[k]->isSelected()) {
+            result.append(allRows[k]);
+            if (!isMulti)
+                break;
+        }
+    }
+}
+    
 void AccessibilityRenderObject::ariaListboxSelectedChildren(AccessibilityChildrenVector& result)
 {
     AccessibilityObject* child = firstChild();
-    bool isMultiselectable = false;
     
     Element* element = static_cast<Element*>(renderer()->node());        
     if (!element || !element->isElementNode()) // do this check to ensure safety of static_cast above
         return;
 
-    String multiselectablePropertyStr = element->getAttribute("aria-multiselectable").string();
-    isMultiselectable = equalIgnoringCase(multiselectablePropertyStr, "true");
+    bool isMulti = isMultiSelectable();
     
     while (child) {
         // every child should have aria-role option, and if so, check for selected attribute/state
@@ -2625,10 +3084,10 @@ void AccessibilityRenderObject::ariaListboxSelectedChildren(AccessibilityChildre
         if (childRenderer && ariaRole == ListBoxOptionRole) {
             Element* childElement = static_cast<Element*>(childRenderer->node());
             if (childElement && childElement->isElementNode()) { // do this check to ensure safety of static_cast above
-                String selectedAttrString = childElement->getAttribute("aria-selected").string();
+                String selectedAttrString = childElement->getAttribute(aria_selectedAttr).string();
                 if (equalIgnoringCase(selectedAttrString, "true")) {
                     result.append(child);
-                    if (isMultiselectable)
+                    if (isMulti)
                         return;
                 }
             }
@@ -2642,11 +3101,11 @@ void AccessibilityRenderObject::selectedChildren(AccessibilityChildrenVector& re
     ASSERT(result.isEmpty());
 
     // only listboxes should be asked for their selected children. 
-    if (ariaRoleAttribute() != ListBoxRole) { // native list boxes would be AccessibilityListBoxes, so only check for aria list boxes
-        ASSERT_NOT_REACHED(); 
-        return;
-    }
-    return ariaListboxSelectedChildren(result);
+    AccessibilityRole role = roleValue();
+    if (role == ListBoxRole) // native list boxes would be AccessibilityListBoxes, so only check for aria list boxes
+        ariaListboxSelectedChildren(result);
+    else if (role == TreeRole || role == TreeGridRole || role == TableRole)
+        ariaSelectedRows(result);
 }
 
 void AccessibilityRenderObject::ariaListboxVisibleChildren(AccessibilityChildrenVector& result)      
@@ -2673,6 +3132,17 @@ void AccessibilityRenderObject::visibleChildren(AccessibilityChildrenVector& res
     return ariaListboxVisibleChildren(result);
 }
  
+void AccessibilityRenderObject::tabChildren(AccessibilityChildrenVector& result)
+{
+    ASSERT(roleValue() == TabListRole);
+    
+    unsigned length = m_children.size();
+    for (unsigned i = 0; i < length; ++i) {
+        if (m_children[i]->isTabItem())
+            result.append(m_children[i]);
+    }
+}
+    
 const String& AccessibilityRenderObject::actionVerb() const
 {
     // FIXME: Need to add verbs for select elements.
@@ -2685,20 +3155,20 @@ const String& AccessibilityRenderObject::actionVerb() const
     DEFINE_STATIC_LOCAL(const String, noAction, ());
     
     switch (roleValue()) {
-        case ButtonRole:
-            return buttonAction;
-        case TextFieldRole:
-        case TextAreaRole:
-            return textFieldAction;
-        case RadioButtonRole:
-            return radioButtonAction;
-        case CheckBoxRole:
-            return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
-        case LinkRole:
-        case WebCoreLinkRole:
-            return linkAction;
-        default:
-            return noAction;
+    case ButtonRole:
+        return buttonAction;
+    case TextFieldRole:
+    case TextAreaRole:
+        return textFieldAction;
+    case RadioButtonRole:
+        return radioButtonAction;
+    case CheckBoxRole:
+        return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
+    case LinkRole:
+    case WebCoreLinkRole:
+        return linkAction;
+    default:
+        return noAction;
     }
 }
      
@@ -2711,4 +3181,128 @@ void AccessibilityRenderObject::updateBackingStore()
     m_renderer->document()->updateLayoutIgnorePendingStylesheets();
 }
 
+static bool isLinkable(const AccessibilityRenderObject& object)
+{
+    if (!object.renderer())
+        return false;
+
+    // See https://wiki.mozilla.org/Accessibility/AT-Windows-API for the elements
+    // Mozilla considers linkable.
+    return object.isLink() || object.isImage() || object.renderer()->isText();
+}
+
+String AccessibilityRenderObject::stringValueForMSAA() const
+{
+    if (isLinkable(*this)) {
+        Element* anchor = anchorElement();
+        if (anchor && anchor->hasTagName(aTag))
+            return static_cast<HTMLAnchorElement*>(anchor)->href();
+    }
+
+    return stringValue();
+}
+
+bool AccessibilityRenderObject::isLinked() const
+{
+    if (!isLinkable(*this))
+        return false;
+
+    Element* anchor = anchorElement();
+    if (!anchor || !anchor->hasTagName(aTag))
+        return false;
+
+    return !static_cast<HTMLAnchorElement*>(anchor)->href().isEmpty();
+}
+
+String AccessibilityRenderObject::nameForMSAA() const
+{
+    if (m_renderer && m_renderer->isText())
+        return textUnderElement();
+
+    return title();
+}
+
+static bool shouldReturnTagNameAsRoleForMSAA(const Element& element)
+{
+    // See "document structure",
+    // https://wiki.mozilla.org/Accessibility/AT-Windows-API
+    // FIXME: Add the other tag names that should be returned as the role.
+    return element.hasTagName(h1Tag) || element.hasTagName(h2Tag) 
+        || element.hasTagName(h3Tag) || element.hasTagName(h4Tag)
+        || element.hasTagName(h5Tag) || element.hasTagName(h6Tag);
+}
+
+String AccessibilityRenderObject::stringRoleForMSAA() const
+{
+    if (!m_renderer)
+        return String();
+
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return String();
+
+    Element* element = static_cast<Element*>(node);
+    if (!shouldReturnTagNameAsRoleForMSAA(*element))
+        return String();
+
+    return element->tagName();
+}
+
+String AccessibilityRenderObject::positionalDescriptionForMSAA() const
+{
+    // See "positional descriptions",
+    // https://wiki.mozilla.org/Accessibility/AT-Windows-API
+    if (isHeading())
+        return "L" + String::number(headingLevel());
+
+    // FIXME: Add positional descriptions for other elements.
+    return String();
+}
+
+String AccessibilityRenderObject::descriptionForMSAA() const
+{
+    String description = positionalDescriptionForMSAA();
+    if (!description.isEmpty())
+        return description;
+
+    description = accessibilityDescription();
+    if (!description.isEmpty()) {
+        // From the Mozilla MSAA implementation:
+        // "Signal to screen readers that this description is speakable and is not
+        // a formatted positional information description. Don't localize the
+        // 'Description: ' part of this string, it will be parsed out by assistive
+        // technologies."
+        return "Description: " + description;
+    }
+
+    return String();
+}
+
+static AccessibilityRole msaaRoleForRenderer(const RenderObject* renderer)
+{
+    if (!renderer)
+        return UnknownRole;
+
+    if (renderer->isText())
+        return EditableTextRole;
+
+    if (renderer->isListItem())
+        return ListItemRole;
+
+    return UnknownRole;
+}
+
+AccessibilityRole AccessibilityRenderObject::roleValueForMSAA() const
+{
+    if (m_roleForMSAA != UnknownRole)
+        return m_roleForMSAA;
+
+    m_roleForMSAA = msaaRoleForRenderer(m_renderer);
+
+    if (m_roleForMSAA == UnknownRole)
+        m_roleForMSAA = roleValue();
+
+    return m_roleForMSAA;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
index c6fd74876f..244eb6075f 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
@@ -62,7 +62,7 @@ public:
     static PassRefPtr<AccessibilityRenderObject> create(RenderObject*);
     virtual ~AccessibilityRenderObject();
     
-    bool isAccessibilityRenderObject() const { return true; };
+    bool isAccessibilityRenderObject() const { return true; }
     
     virtual bool isAnchor() const;
     virtual bool isAttachment() const;
@@ -96,20 +96,26 @@ public:
     virtual bool isHovered() const;
     virtual bool isIndeterminate() const;
     virtual bool isLoaded() const;
-    virtual bool isMultiSelect() const;
+    virtual bool isMultiSelectable() const;
     virtual bool isOffScreen() const;
     virtual bool isPressed() const;
     virtual bool isReadOnly() const;
     virtual bool isVisited() const;        
     virtual bool isRequired() const;
+    virtual bool isLinked() const;
+    virtual bool isExpanded() const;
+    virtual void setIsExpanded(bool);
 
     const AtomicString& getAttribute(const QualifiedName&) const;
     virtual bool canSetFocusAttribute() const;
     virtual bool canSetTextRangeAttributes() const;
     virtual bool canSetValueAttribute() const;
-    
+    virtual bool canSetExpandedAttribute() const;
+
     virtual bool hasIntValue() const;
     
+    // Provides common logic used by all elements when determining isIgnored.
+    AccessibilityObjectInclusion accessibilityIsIgnoredBase() const;
     virtual bool accessibilityIsIgnored() const;
     
     virtual int headingLevel() const;
@@ -119,7 +125,9 @@ public:
     virtual float maxValueForRange() const;
     virtual float minValueForRange() const;
     virtual AccessibilityObject* selectedRadioButton();
+    virtual AccessibilityObject* selectedTabItem();
     virtual int layoutCount() const;
+    virtual double estimatedLoadingProgress() const;
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const;
     virtual AccessibilityObject* focusedUIElement() const;
@@ -136,6 +144,8 @@ public:
     virtual AccessibilityObject* correspondingControlForLabelElement() const;
     virtual AccessibilityObject* correspondingLabelForControlElement() const;
 
+    virtual void ariaOwnsElements(AccessibilityChildrenVector&) const;
+    virtual bool supportsARIAOwns() const;
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
     virtual bool ariaRoleHasPresentationalChildren() const;
@@ -167,7 +177,6 @@ public:
     virtual PlainTextRange selectedTextRange() const;
     virtual VisibleSelection selection() const;
     virtual String stringValue() const;
-    virtual String ariaAccessibilityName(const String&) const;
     virtual String ariaLabeledByAttribute() const;
     virtual String title() const;
     virtual String ariaDescribedByAttribute() const;
@@ -184,23 +193,30 @@ public:
     virtual Widget* widgetForAttachmentView() const;
     virtual void getDocumentLinks(AccessibilityChildrenVector&);
     virtual FrameView* documentFrameView() const;
-    virtual String language() const;
-    
+    virtual unsigned hierarchicalLevel() const;
+
     virtual const AccessibilityChildrenVector& children();
+    virtual void clearChildren();
+    void updateChildrenIfNecessary();
     
     virtual void setFocused(bool);
     virtual void setSelectedTextRange(const PlainTextRange&);
     virtual void setValue(const String&);
+    virtual void setSelected(bool);
+    virtual void setSelectedRows(AccessibilityChildrenVector&);
     virtual void changeValueByPercent(float percentChange);
+    virtual AccessibilityOrientation orientation() const;
     virtual void increment();
     virtual void decrement();
     
     virtual void detach();
     virtual void childrenChanged();
+    virtual void contentChanged();
     virtual void addChildren();
     virtual bool canHaveChildren() const;
     virtual void selectedChildren(AccessibilityChildrenVector&);
     virtual void visibleChildren(AccessibilityChildrenVector&);
+    virtual void tabChildren(AccessibilityChildrenVector&);
     virtual bool shouldFocusActiveDescendant() const;
     virtual AccessibilityObject* activeDescendant() const;
     virtual void handleActiveDescendantChanged();
@@ -209,6 +225,14 @@ public:
     virtual VisiblePositionRange visiblePositionRangeForLine(unsigned) const;
     virtual IntRect boundsForVisiblePositionRange(const VisiblePositionRange&) const;
     virtual void setSelectedVisiblePositionRange(const VisiblePositionRange&) const;
+    virtual bool supportsARIAFlowTo() const;
+    virtual void ariaFlowToElements(AccessibilityChildrenVector&) const;
+
+    virtual bool supportsARIADropping() const;
+    virtual bool supportsARIADragging() const;
+    virtual bool isARIAGrabbed();
+    virtual void setARIAGrabbed(bool);
+    virtual void determineARIADropEffects(Vector<String>&);
     
     virtual VisiblePosition visiblePositionForPoint(const IntPoint&) const;
     virtual VisiblePosition visiblePositionForIndex(unsigned indexValue, bool lastIndexOK) const;    
@@ -224,13 +248,21 @@ public:
     virtual IntRect doAXBoundsForRange(const PlainTextRange&) const;
     
     virtual void updateBackingStore();
-    
+
+    virtual String stringValueForMSAA() const;
+    virtual String stringRoleForMSAA() const;
+    virtual String nameForMSAA() const;
+    virtual String descriptionForMSAA() const;
+    virtual AccessibilityRole roleValueForMSAA() const;
+
 protected:
     RenderObject* m_renderer;
     AccessibilityRole m_ariaRole;
     mutable bool m_childrenDirty;
     
     void setRenderObject(RenderObject* renderer) { m_renderer = renderer; }
+    void ariaLabeledByElements(Vector<Element*>& elements) const;
+    bool needsToUpdateChildren() const { return m_childrenDirty; }
     
     virtual bool isDetached() const { return !m_renderer; }
 
@@ -238,19 +270,40 @@ private:
     void ariaListboxSelectedChildren(AccessibilityChildrenVector&);
     void ariaListboxVisibleChildren(AccessibilityChildrenVector&);
     bool ariaIsHidden() const;
+    bool isDescendantOfBarrenParent() const;
+    bool isAllowedChildOfTree() const;
+    bool hasTextAlternative() const;
+    String positionalDescriptionForMSAA() const;
+    virtual String language() const;
 
     Element* menuElementForMenuButton() const;
     Element* menuItemElementForMenu() const;
     AccessibilityRole determineAccessibilityRole();
     AccessibilityRole determineAriaRoleAttribute() const;
 
+    bool isTabItemSelected() const;
     IntRect checkboxOrRadioRect() const;
     void addRadioButtonGroupMembers(AccessibilityChildrenVector& linkedUIElements) const;
     AccessibilityObject* internalLinkElement() const;
     AccessibilityObject* accessibilityImageMapHitTest(HTMLAreaElement*, const IntPoint&) const;
     AccessibilityObject* accessibilityParentForImageMap(HTMLMapElement* map) const;
 
-    void markChildrenDirty() const { m_childrenDirty = true; }
+    void ariaSelectedRows(AccessibilityChildrenVector&);
+    
+    bool elementAttributeValue(const QualifiedName&) const;
+    void setElementAttributeValue(const QualifiedName&, bool);
+    
+    String accessibilityDescriptionForElements(Vector<Element*> &elements) const;
+    void elementsFromAttribute(Vector<Element*>& elements, const QualifiedName& name) const;
+    
+    virtual const AtomicString& ariaLiveRegionStatus() const;
+    virtual const AtomicString& ariaLiveRegionRelevant() const;
+    virtual bool ariaLiveRegionAtomic() const;
+    virtual bool ariaLiveRegionBusy() const;    
+    
+    void setNeedsToUpdateChildren() const { m_childrenDirty = true; }
+    
+    mutable AccessibilityRole m_roleForMSAA;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.cpp
new file mode 100644
index 0000000000..717d0dabf9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AccessibilityScrollbar.h"
+
+#include "Scrollbar.h"
+
+namespace WebCore {
+
+AccessibilityScrollbar::AccessibilityScrollbar()
+    : m_scrollbar(0)
+{
+}
+
+PassRefPtr<AccessibilityScrollbar> AccessibilityScrollbar::create()
+{
+    return adoptRef(new AccessibilityScrollbar);
+}
+
+float AccessibilityScrollbar::valueForRange() const
+{
+    if (!m_scrollbar)
+        return 0;
+    return m_scrollbar->currentPos();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.h
new file mode 100644
index 0000000000..d75e60cda2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#ifndef AccessibilityScrollbar_h
+#define AccessibilityScrollbar_h
+
+#include "AccessibilityObject.h"
+
+namespace WebCore {
+
+class Scrollbar;
+
+class AccessibilityScrollbar : public AccessibilityObject {
+public:
+    static PassRefPtr<AccessibilityScrollbar> create();
+
+    void setScrollbar(Scrollbar* scrollbar) { m_scrollbar = scrollbar; }
+
+    virtual AccessibilityRole roleValue() const { return ScrollBarRole; }
+
+    virtual float valueForRange() const;
+
+private:
+    AccessibilityScrollbar();
+
+    virtual bool accessibilityIsIgnored() const { return false; }
+
+    // These should never be reached since the AccessibilityScrollbar is not part of
+    // the accessibility tree.
+    virtual IntSize size() const { ASSERT_NOT_REACHED(); return IntSize(); }
+    virtual IntRect elementRect() const { ASSERT_NOT_REACHED(); return IntRect(); }
+    virtual AccessibilityObject* parentObject() const { ASSERT_NOT_REACHED(); return 0; }
+
+    Scrollbar* m_scrollbar;
+};
+
+} // namespace WebCore
+
+#endif // AccessibilityScrollbar_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.cpp
index 5aca672580..e8d1f41720 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.cpp
@@ -68,18 +68,18 @@ AccessibilityOrientation AccessibilitySlider::orientation() const
     
     ControlPart styleAppearance = style->appearance();
     switch (styleAppearance) {
-        case SliderThumbHorizontalPart:
-        case SliderHorizontalPart:
-        case MediaSliderPart:
-            return AccessibilityOrientationHorizontal;
+    case SliderThumbHorizontalPart:
+    case SliderHorizontalPart:
+    case MediaSliderPart:
+        return AccessibilityOrientationHorizontal;
+    
+    case SliderThumbVerticalPart: 
+    case SliderVerticalPart:
+    case MediaVolumeSliderPart:
+        return AccessibilityOrientationVertical;
         
-        case SliderThumbVerticalPart: 
-        case SliderVerticalPart:
-        case MediaVolumeSliderPart:
-            return AccessibilityOrientationVertical;
-            
-        default:
-            return AccessibilityOrientationHorizontal;
+    default:
+        return AccessibilityOrientationHorizontal;
     }
 }
     
@@ -99,6 +99,17 @@ const AtomicString& AccessibilitySlider::getAttribute(const QualifiedName& attri
     return element()->getAttribute(attribute);
 }
 
+bool AccessibilitySlider::accessibilityIsIgnored() const
+{
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
+    return false;
+}
+    
 float AccessibilitySlider::valueForRange() const
 {
     return element()->value().toFloat();
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.h
index 254ebdd512..461f62b659 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.h
@@ -33,58 +33,58 @@
 
 namespace WebCore {
 
-    class HTMLInputElement;
+class HTMLInputElement;
 
-    class AccessibilitySlider : public AccessibilityRenderObject {
-        
-    public:
-        static PassRefPtr<AccessibilitySlider> create(RenderObject*);
-        virtual ~AccessibilitySlider() { }
+class AccessibilitySlider : public AccessibilityRenderObject {
+    
+public:
+    static PassRefPtr<AccessibilitySlider> create(RenderObject*);
+    virtual ~AccessibilitySlider() { }
 
-        virtual AccessibilityRole roleValue() const { return SliderRole; }
-        virtual bool accessibilityIsIgnored() const { return false; }
+    virtual AccessibilityRole roleValue() const { return SliderRole; }
 
-        virtual bool isSlider() const { return true; }
+    virtual bool isSlider() const { return true; }
 
-        virtual const AccessibilityChildrenVector& children();
-        virtual void addChildren();
+    virtual const AccessibilityChildrenVector& children();
+    virtual void addChildren();
 
-        virtual bool canSetValueAttribute() const { return true; };
-        const AtomicString& getAttribute(const QualifiedName& attribute) const;
+    virtual bool canSetValueAttribute() const { return true; }
+    const AtomicString& getAttribute(const QualifiedName& attribute) const;
 
-        virtual void setValue(const String&);
-        virtual float valueForRange() const;
-        virtual float maxValueForRange() const;
-        virtual float minValueForRange() const;
-        virtual AccessibilityOrientation orientation() const;
+    virtual void setValue(const String&);
+    virtual float valueForRange() const;
+    virtual float maxValueForRange() const;
+    virtual float minValueForRange() const;
+    virtual AccessibilityOrientation orientation() const;
 
-    protected:
-        AccessibilitySlider(RenderObject*);
+protected:
+    AccessibilitySlider(RenderObject*);
 
-    private:
-        HTMLInputElement* element() const;
-    };
+private:
+    HTMLInputElement* element() const;
+    virtual bool accessibilityIsIgnored() const;
+};
 
-    class AccessibilitySliderThumb : public AccessibilityObject {
-        
-    public:
-        static PassRefPtr<AccessibilitySliderThumb> create();
-        virtual ~AccessibilitySliderThumb() { }
+class AccessibilitySliderThumb : public AccessibilityObject {
+    
+public:
+    static PassRefPtr<AccessibilitySliderThumb> create();
+    virtual ~AccessibilitySliderThumb() { }
 
-        virtual AccessibilityRole roleValue() const { return SliderThumbRole; }
-        virtual bool accessibilityIsIgnored() const { return false; }
+    virtual AccessibilityRole roleValue() const { return SliderThumbRole; }
 
-        void setParentObject(AccessibilitySlider* slider) { m_parentSlider = slider; }
-        virtual AccessibilityObject* parentObject() const { return m_parentSlider; }
+    void setParentObject(AccessibilitySlider* slider) { m_parentSlider = slider; }
+    virtual AccessibilityObject* parentObject() const { return m_parentSlider; }
 
-        virtual IntSize size() const;
-        virtual IntRect elementRect() const;
+    virtual IntSize size() const;
+    virtual IntRect elementRect() const;
 
-    private:
-        AccessibilitySliderThumb();
+private:
+    AccessibilitySliderThumb();
+    virtual bool accessibilityIsIgnored() const { return false; }
 
-        AccessibilitySlider* m_parentSlider;
-    };
+    AccessibilitySlider* m_parentSlider;
+};
 
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
index 928ef2cfdb..aed8867ec6 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
@@ -29,15 +29,15 @@
 #include "config.h"
 #include "AccessibilityTable.h"
 
+#include "AXObjectCache.h"
 #include "AccessibilityTableCell.h"
 #include "AccessibilityTableColumn.h"
 #include "AccessibilityTableHeaderContainer.h"
 #include "AccessibilityTableRow.h"
-#include "AXObjectCache.h"
 #include "HTMLNames.h"
-#include "HTMLTableElement.h"
 #include "HTMLTableCaptionElement.h"
 #include "HTMLTableCellElement.h"
+#include "HTMLTableElement.h"
 #include "RenderObject.h"
 #include "RenderTable.h"
 #include "RenderTableCell.h"
@@ -94,6 +94,11 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
     Node* tableNode = table->node();
     if (!tableNode || !tableNode->hasTagName(tableTag))
         return false;
+
+    // Gtk+ ATs expect all tables to be exposed as tables.
+#if PLATFORM(GTK)
+    return true;
+#endif
     
     // if there is a caption element, summary, THEAD, or TFOOT section, it's most certainly a data table
     HTMLTableElement* tableElement = static_cast<HTMLTableElement*>(tableNode);
@@ -149,8 +154,8 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
             HTMLTableCellElement* cellElement = static_cast<HTMLTableCellElement*>(cellNode);
             
             // in this case, the developer explicitly assigned a "data" table attribute
-            if (!cellElement->headers().isEmpty() || !cellElement->abbr().isEmpty() || 
-                !cellElement->axis().isEmpty() || !cellElement->scope().isEmpty())
+            if (!cellElement->headers().isEmpty() || !cellElement->abbr().isEmpty()
+                || !cellElement->axis().isEmpty() || !cellElement->scope().isEmpty())
                 return true;
             
             RenderStyle* renderStyle = cell->style();
@@ -158,15 +163,15 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
                 continue;
 
             // a cell needs to have matching bordered sides, before it can be considered a bordered cell.
-            if ((cell->borderTop() > 0 && cell->borderBottom() > 0) ||
-                (cell->borderLeft() > 0 && cell->borderRight() > 0))
+            if ((cell->borderTop() > 0 && cell->borderBottom() > 0)
+                || (cell->borderLeft() > 0 && cell->borderRight() > 0))
                 borderedCellCount++;
             
             // if the cell has a different color from the table and there is cell spacing,
             // then it is probably a data table cell (spacing and colors take the place of borders)
             Color cellColor = renderStyle->backgroundColor();
-            if (table->hBorderSpacing() > 0 && table->vBorderSpacing() > 0 && 
-                tableBGColor != cellColor && cellColor.alpha() != 1)
+            if (table->hBorderSpacing() > 0 && table->vBorderSpacing() > 0
+                && tableBGColor != cellColor && cellColor.alpha() != 1)
                 backgroundDifferenceCellCount++;
             
             // if we've found 10 "good" cells, we don't need to keep searching
@@ -193,10 +198,9 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
     
 void AccessibilityTable::clearChildren()
 {
-    m_children.clear();
+    AccessibilityRenderObject::clearChildren();
     m_rows.clear();
     m_columns.clear();
-    m_haveChildren = false;
 }
 
 void AccessibilityTable::addChildren()
@@ -251,7 +255,12 @@ void AccessibilityTable::addChildren()
                 
                 row->setRowIndex((int)m_rows.size());        
                 m_rows.append(row);
-                m_children.append(row);
+                if (!row->accessibilityIsIgnored())
+                    m_children.append(row);
+#if PLATFORM(GTK)
+                else
+                    m_children.append(row->children());
+#endif
                 appendedRows.add(row);
             }
         }
@@ -266,11 +275,12 @@ void AccessibilityTable::addChildren()
         column->setColumnIndex((int)i);
         column->setParentTable(this);
         m_columns.append(column);
-        m_children.append(column);
+        if (!column->accessibilityIsIgnored())
+            m_children.append(column);
     }
     
     AccessibilityObject* headerContainerObject = headerContainer();
-    if (headerContainerObject)
+    if (headerContainerObject && !headerContainerObject->accessibilityIsIgnored())
         m_children.append(headerContainerObject);
 }
     
@@ -287,17 +297,15 @@ AccessibilityObject* AccessibilityTable::headerContainer()
 
 AccessibilityObject::AccessibilityChildrenVector& AccessibilityTable::columns()
 {
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
         
     return m_columns;
 }
 
 AccessibilityObject::AccessibilityChildrenVector& AccessibilityTable::rows()
 {
-    if (!hasChildren())
-        addChildren();
-
+    updateChildrenIfNecessary();
+    
     return m_rows;
 }
     
@@ -306,8 +314,7 @@ void AccessibilityTable::rowHeaders(AccessibilityChildrenVector& headers)
     if (!m_renderer)
         return;
     
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     unsigned rowCount = m_rows.size();
     for (unsigned k = 0; k < rowCount; ++k) {
@@ -323,8 +330,7 @@ void AccessibilityTable::columnHeaders(AccessibilityChildrenVector& headers)
     if (!m_renderer)
         return;
     
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     unsigned colCount = m_columns.size();
     for (unsigned k = 0; k < colCount; ++k) {
@@ -340,8 +346,7 @@ void AccessibilityTable::cells(AccessibilityObject::AccessibilityChildrenVector&
     if (!m_renderer)
         return;
     
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     int numRows = m_rows.size();
     for (int row = 0; row < numRows; ++row) {
@@ -352,16 +357,14 @@ void AccessibilityTable::cells(AccessibilityObject::AccessibilityChildrenVector&
     
 unsigned AccessibilityTable::columnCount()
 {
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     return m_columns.size();    
 }
     
 unsigned AccessibilityTable::rowCount()
 {
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     return m_rows.size();
 }
@@ -371,8 +374,7 @@ AccessibilityTableCell* AccessibilityTable::cellForColumnAndRow(unsigned column,
     if (!m_renderer || !m_renderer->isTable())
         return 0;
     
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     RenderTable* table = toRenderTable(m_renderer);
     RenderTableSection* tableSection = table->header();
@@ -448,9 +450,15 @@ AccessibilityRole AccessibilityTable::roleValue() const
     
 bool AccessibilityTable::accessibilityIsIgnored() const
 {
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
     if (!isDataTable())
         return AccessibilityRenderObject::accessibilityIsIgnored();
-    
+        
     return false;
 }
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h
index b6aa3cac9e..42edf2a18b 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h
@@ -63,6 +63,7 @@ public:
     AccessibilityChildrenVector& columns();
     AccessibilityChildrenVector& rows();
     
+    virtual bool supportsSelectedRows() { return false; }
     unsigned columnCount();
     unsigned rowCount();
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
index 7674cb8f6a..318c619e6f 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
@@ -56,6 +56,12 @@ PassRefPtr<AccessibilityTableCell> AccessibilityTableCell::create(RenderObject*
 
 bool AccessibilityTableCell::accessibilityIsIgnored() const
 {
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
     if (!isTableCell())
         return AccessibilityRenderObject::accessibilityIsIgnored();
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
index e09d65ea47..5872706427 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
@@ -29,12 +29,12 @@
 #include "config.h"
 #include "AccessibilityTableColumn.h"
 
-#include "AccessibilityTableCell.h"
 #include "AXObjectCache.h"
+#include "AccessibilityTableCell.h"
 #include "HTMLNames.h"
 #include "RenderTable.h"
-#include "RenderTableSection.h"
 #include "RenderTableCell.h"
+#include "RenderTableSection.h"
 
 using namespace std;
 
@@ -158,6 +158,18 @@ AccessibilityObject* AccessibilityTableColumn::headerObjectForSection(RenderTabl
     return m_parentTable->axObjectCache()->getOrCreate(cell);
 }
     
+bool AccessibilityTableColumn::accessibilityIsIgnored() const
+{
+    if (!m_parentTable)
+        return true;
+    
+#if PLATFORM(GTK)
+    return true;
+#endif
+    
+    return m_parentTable->accessibilityIsIgnored();
+}
+    
 void AccessibilityTableColumn::addChildren()
 {
     ASSERT(!m_haveChildren); 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h
index 62703980ab..15d300c972 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h
@@ -49,8 +49,8 @@ public:
     virtual AccessibilityObject* parentObject() const { return m_parentTable; }
     AccessibilityObject* headerObject();
         
+    virtual bool accessibilityIsIgnored() const;
     virtual AccessibilityRole roleValue() const { return ColumnRole; }
-    virtual bool accessibilityIsIgnored() const { return false; }
     virtual bool isTableColumn() const { return true; }
     
     void setColumnIndex(int columnIndex) { m_columnIndex = columnIndex; }
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
index af9de39805..e2da83c895 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityTableHeaderContainer.h"
 
-#include "AccessibilityTable.h"
 #include "AXObjectCache.h"
+#include "AccessibilityTable.h"
 
 using namespace std;
 
@@ -68,6 +68,18 @@ IntSize AccessibilityTableHeaderContainer::size() const
     return elementRect().size();
 }
     
+bool AccessibilityTableHeaderContainer::accessibilityIsIgnored() const
+{
+    if (!m_parentTable)
+        return true;
+    
+#if PLATFORM(GTK)
+    return true;
+#endif
+
+    return m_parentTable->accessibilityIsIgnored();
+}
+
 void AccessibilityTableHeaderContainer::addChildren()
 {
     ASSERT(!m_haveChildren); 
@@ -79,9 +91,8 @@ void AccessibilityTableHeaderContainer::addChildren()
     static_cast<AccessibilityTable*>(m_parentTable)->columnHeaders(m_children);
     
     unsigned length = m_children.size();
-    for (unsigned k = 0; k < length; ++k) {
+    for (unsigned k = 0; k < length; ++k)
         m_headerRect.unite(m_children[k]->elementRect());
-    }
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h
index 8a9448a5db..79521c0f06 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h
@@ -48,8 +48,6 @@ public:
     void setParentTable(AccessibilityTable* table) { m_parentTable = table; }
     virtual AccessibilityObject* parentObject() const { return m_parentTable; }
     
-    virtual bool accessibilityIsIgnored() const { return false; }
-    
     virtual const AccessibilityChildrenVector& children();
     virtual void addChildren();
     
@@ -60,6 +58,7 @@ private:
     AccessibilityTable* m_parentTable;
     IntRect m_headerRect;
     
+    virtual bool accessibilityIsIgnored() const;
 }; 
     
 } // namespace WebCore 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
index 53b479e4ab..e2a1157d6b 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityTableRow.h"
 
-#include "AccessibilityTableCell.h"
 #include "AXObjectCache.h"
+#include "AccessibilityTableCell.h"
 #include "HTMLNames.h"
 #include "HTMLTableRowElement.h"
 #include "RenderObject.h"
@@ -76,6 +76,12 @@ bool AccessibilityTableRow::isTableRow() const
     
 bool AccessibilityTableRow::accessibilityIsIgnored() const
 {    
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
     if (!isTableRow())
         return AccessibilityRenderObject::accessibilityIsIgnored();
 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp b/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
index 756ece31c6..7232642378 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
@@ -20,8 +20,6 @@
 #include "config.h"
 #include "AccessibilityObject.h"
 
-QT_BEGIN_NAMESPACE
-
 #if HAVE(ACCESSIBILITY)
 
 namespace WebCore {
@@ -31,13 +29,14 @@ bool AccessibilityObject::accessibilityIgnoreAttachment() const
     return false;
 }
 
-AccessibilityObjectPlatformInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
+AccessibilityObjectInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
 {
+    if (isMenuListPopup() || isMenuListOption())
+        return IgnoreObject;
+
     return DefaultBehavior;
 }
 
 } // namespace WebCore
 
 #endif // HAVE(ACCESSIBILITY)
-
-QT_END_NAMESPACE
diff --git a/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp b/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
index 7dc68ef196..0467f2d8c9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
@@ -22,6 +22,7 @@
 #include "ScriptController.h"
 
 #include "Frame.h"
+#include "FrameLoaderClient.h"
 #include "Page.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
@@ -30,6 +31,19 @@
 
 namespace WebCore {
 
+bool ScriptController::canExecuteScripts(ReasonForCallingCanExecuteScripts reason)
+{
+    // FIXME: We should get this information from the document instead of the frame.
+    if (m_frame->loader()->isSandboxed(SandboxScripts))
+        return false;
+
+    Settings* settings = m_frame->settings();
+    const bool allowed = m_frame->loader()->client()->allowJavaScript(settings && settings->isJavaScriptEnabled());
+    if (!allowed && reason == AboutToExecuteScript)
+        m_frame->loader()->client()->didNotAllowScript();
+    return allowed;
+}
+
 ScriptValue ScriptController::executeScript(const String& script, bool forceUserGesture)
 {
     return executeScript(ScriptSourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url()));
@@ -37,7 +51,7 @@ ScriptValue ScriptController::executeScript(const String& script, bool forceUser
 
 ScriptValue ScriptController::executeScript(const ScriptSourceCode& sourceCode)
 {
-    if (!isEnabled() || isPaused())
+    if (!canExecuteScripts(AboutToExecuteScript) || isPaused())
         return ScriptValue();
 
     bool wasInExecuteScript = m_inExecuteScript;
@@ -73,8 +87,15 @@ bool ScriptController::executeIfJavaScriptURL(const KURL& url, bool userGesture,
         result = executeScript(script, userGesture);
 
     String scriptResult;
+#if USE(JSC)
+    JSDOMWindowShell* shell = windowShell(mainThreadNormalWorld());
+    JSC::ExecState* exec = shell->window()->globalExec();
+    if (!result.getString(exec, scriptResult))
+        return true;
+#else
     if (!result.getString(scriptResult))
         return true;
+#endif
 
     // FIXME: We should always replace the document, but doing so
     //        synchronously can cause crashes:
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/BindingDOMWindow.h b/src/3rdparty/webkit/WebCore/bindings/generic/BindingDOMWindow.h
new file mode 100644
index 0000000000..d6d308702c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/BindingDOMWindow.h
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BindingDOMWindow_h
+#define BindingDOMWindow_h
+
+#include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "GenericBinding.h"
+#include "Page.h"
+#include "SecurityOrigin.h"
+
+namespace WebCore {
+
+template <class Binding>
+class BindingDOMWindow {
+public:
+    typedef typename Binding::Value BindingValue;
+
+    static Frame* createWindow(State<Binding>*,
+                               Frame* callingFrame,
+                               Frame* enteredFrame,
+                               Frame* openerFrame,
+                               const String& url,
+                               const String& frameName,
+                               const WindowFeatures& windowFeatures,
+                               BindingValue dialogArgs);
+};
+
+// Implementations of templated methods must be in this file.
+
+template <class Binding>
+Frame* BindingDOMWindow<Binding>::createWindow(State<Binding>* state,
+                                               Frame* callingFrame,
+                                               Frame* enteredFrame,
+                                               Frame* openerFrame,
+                                               const String& url,
+                                               const String& frameName,
+                                               const WindowFeatures& windowFeatures,
+                                               BindingValue dialogArgs)
+{
+    ASSERT(callingFrame);
+    ASSERT(enteredFrame);
+
+    if (Document* callingDocument = callingFrame->document()) {
+        // Sandboxed iframes cannot open new auxiliary browsing contexts.
+        if (callingDocument->securityOrigin()->isSandboxed(SandboxNavigation))
+            return 0;
+    }
+
+    ResourceRequest request;
+
+    // For whatever reason, Firefox uses the entered frame to determine
+    // the outgoingReferrer.  We replicate that behavior here.
+    String referrer = enteredFrame->loader()->outgoingReferrer();
+    request.setHTTPReferrer(referrer);
+    FrameLoader::addHTTPOriginIfNeeded(request, enteredFrame->loader()->outgoingOrigin());
+    FrameLoadRequest frameRequest(request, frameName);
+
+    // FIXME: It's much better for client API if a new window starts with a URL,
+    // here where we know what URL we are going to open. Unfortunately, this
+    // code passes the empty string for the URL, but there's a reason for that.
+    // Before loading we have to set up the opener, openedByDOM,
+    // and dialogArguments values. Also, to decide whether to use the URL
+    // we currently do an allowsAccessFrom call using the window we create,
+    // which can't be done before creating it. We'd have to resolve all those
+    // issues to pass the URL instead of "".
+
+    bool created;
+    // We pass in the opener frame here so it can be used for looking up the
+    // frame name, in case the active frame is different from the opener frame,
+    // and the name references a frame relative to the opener frame, for example
+    // "_self" or "_parent".
+    Frame* newFrame = callingFrame->loader()->createWindow(openerFrame->loader(), frameRequest, windowFeatures, created);
+    if (!newFrame)
+        return 0;
+
+    newFrame->loader()->setOpener(openerFrame);
+    newFrame->page()->setOpenedByDOM();
+
+    Binding::DOMWindow::storeDialogArgs(state, newFrame, dialogArgs);
+
+    if (!protocolIsJavaScript(url) || BindingSecurity<Binding>::canAccessFrame(state, newFrame, true)) {
+        KURL completedUrl =
+            url.isEmpty() ? KURL(ParsedURLString, "") : completeURL(url);
+        bool userGesture = processingUserGesture();
+
+        if (created)
+            newFrame->loader()->changeLocation(completedUrl, referrer, false, false, userGesture);
+        else if (!url.isEmpty())
+            newFrame->redirectScheduler()->scheduleLocationChange(completedUrl.string(), referrer, false, userGesture);
+    }
+
+    return newFrame;
+}
+
+} // namespace WebCore
+
+#endif // BindingDOMWindow_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/BindingElement.h b/src/3rdparty/webkit/WebCore/bindings/generic/BindingElement.h
new file mode 100644
index 0000000000..ba7856af1b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/BindingElement.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BindingElement_h
+#define BindingElement_h
+
+#include "Attr.h"
+#include "BindingSecurity.h"
+#include "Element.h"
+#include "ExceptionCode.h"
+
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+template <class Binding>
+class BindingElement {
+public:
+    static void setAttribute(State<Binding>*, Element*, const AtomicString&, const AtomicString&, ExceptionCode&);
+    static RefPtr<Attr> setAttributeNode(State<Binding>*, Element*, Attr*, ExceptionCode&);
+    static void setAttributeNS(State<Binding>*, Element*, const AtomicString&, const AtomicString&, const AtomicString&, ExceptionCode&);
+    static RefPtr<Attr> setAttributeNodeNS(State<Binding>*, Element*, Attr*, ExceptionCode&);
+};
+
+// Implementations of templated methods must be in this file.
+
+template <class Binding>
+void BindingElement<Binding>::setAttribute(State<Binding>* state, Element* element, const AtomicString& name, const AtomicString& value, ExceptionCode& ec)
+{
+    ASSERT(element);
+
+    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, name, value))
+        return;
+
+    element->setAttribute(name, value, ec);
+}
+
+template <class Binding>
+RefPtr<Attr> BindingElement<Binding>::setAttributeNode(State<Binding>* state, Element* element, Attr* newAttr, ExceptionCode& ec)
+{
+    ASSERT(element);
+    ASSERT(newAttr);
+
+    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, newAttr->name(), newAttr->value()))
+        return 0;
+
+    return element->setAttributeNode(newAttr, ec);
+}
+
+template <class Binding>
+void BindingElement<Binding>::setAttributeNS(State<Binding>* state, Element* element, const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& value, ExceptionCode& ec)
+{
+    ASSERT(element);
+
+    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, qualifiedName, value))
+        return;
+
+    element->setAttributeNS(namespaceURI, qualifiedName, value, ec);
+}
+
+template <class Binding>
+RefPtr<Attr> BindingElement<Binding>::setAttributeNodeNS(State<Binding>* state, Element* element, Attr* newAttr, ExceptionCode& ec)
+{
+    ASSERT(element);
+    ASSERT(newAttr);
+
+    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, newAttr->name(), newAttr->value()))
+        return 0;
+
+    return element->setAttributeNodeNS(newAttr, ec);
+}
+
+} // namespace WebCore
+
+#endif // BindingElement_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurity.h b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurity.h
new file mode 100644
index 0000000000..929b8f4c41
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurity.h
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BindingSecurity_h
+#define BindingSecurity_h
+
+#include "BindingSecurityBase.h"
+#include "CSSHelper.h"
+#include "Element.h"
+#include "GenericBinding.h"
+#include "HTMLFrameElementBase.h"
+
+namespace WebCore {
+
+class DOMWindow;
+class Frame;
+class Node;
+
+// Security functions shared by various language bindings.
+template <class Binding>
+class BindingSecurity : public BindingSecurityBase {
+public:
+    // Check if the active execution context can access the target frame.
+    static bool canAccessFrame(State<Binding>*, Frame*, bool reportError);
+
+    // Check if it is safe to access the given node from the
+    // current security context.
+    static bool checkNodeSecurity(State<Binding>*, Node* target);
+
+    static bool allowSettingFrameSrcToJavascriptUrl(State<Binding>*, HTMLFrameElementBase*, String value);
+    static bool allowSettingSrcToJavascriptURL(State<Binding>*, Element*, String name, String value);
+
+private:
+    explicit BindingSecurity() {}
+    ~BindingSecurity();
+
+    // Check if the current DOMWindow's security context can access the target
+    // DOMWindow.  This function does not report errors, so most callers should
+    // use canAccessFrame instead.
+    static bool canAccessWindow(State<Binding>*, DOMWindow* target);
+};
+
+// Implementations of templated methods must be in this file.
+
+template <class Binding>
+bool BindingSecurity<Binding>::canAccessWindow(State<Binding>* state,
+                                               DOMWindow* targetWindow)
+{
+    DOMWindow* activeWindow = state->getActiveWindow();
+    return canAccess(activeWindow, targetWindow);
+}
+
+template <class Binding>
+bool BindingSecurity<Binding>::canAccessFrame(State<Binding>* state,
+                                              Frame* target,
+                                              bool reportError)
+{
+    // The subject is detached from a frame, deny accesses.
+    if (!target)
+        return false;
+
+    if (!canAccessWindow(state, getDOMWindow(target))) {
+        if (reportError)
+            state->immediatelyReportUnsafeAccessTo(target);
+        return false;
+    }
+    return true;
+}
+
+template <class Binding>
+bool BindingSecurity<Binding>::checkNodeSecurity(State<Binding>* state, Node* node)
+{
+    if (!node)
+        return false;
+
+    Frame* target = getFrame(node);
+
+    if (!target)
+        return false;
+
+    return canAccessFrame(state, target, true);
+}
+
+template <class Binding>
+bool BindingSecurity<Binding>::allowSettingFrameSrcToJavascriptUrl(State<Binding>* state, HTMLFrameElementBase* frame, String value)
+{
+    if (protocolIsJavaScript(deprecatedParseURL(value))) {
+        Node* contentDoc = frame->contentDocument();
+        if (contentDoc && !checkNodeSecurity(state, contentDoc))
+            return false;
+    }
+    return true;
+}
+
+template <class Binding>
+bool BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(State<Binding>* state, Element* element, String name, String value)
+{
+    if ((element->hasTagName(HTMLNames::iframeTag) || element->hasTagName(HTMLNames::frameTag)) && equalIgnoringCase(name, "src"))
+        return allowSettingFrameSrcToJavascriptUrl(state, static_cast<HTMLFrameElementBase*>(element), value);
+    return true;
+}
+
+}
+
+#endif // BindingSecurity_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.cpp b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.cpp
new file mode 100644
index 0000000000..1598781cd9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BindingSecurityBase.h"
+
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "SecurityOrigin.h"
+
+namespace WebCore {
+
+DOMWindow* BindingSecurityBase::getDOMWindow(Frame* frame)
+{
+    return frame->domWindow();
+}
+
+Frame* BindingSecurityBase::getFrame(Node* node)
+{
+    return node->document()->frame();
+}
+
+// Same origin policy implementation:
+//
+// Same origin policy prevents JS code from domain A from accessing JS & DOM
+// objects in a different domain B. There are exceptions and several objects
+// are accessible by cross-domain code. For example, the window.frames object
+// is accessible by code from a different domain, but window.document is not.
+//
+// The JS binding code sets security check callbacks on a function template,
+// and accessing instances of the template calls the callback function.
+// The callback function enforces the same origin policy.
+//
+// Callback functions are expensive. Binding code should use a security token
+// string to do fast access checks for the common case where source and target
+// are in the same domain. A security token is a string object that represents
+// the protocol/url/port of a domain.
+//
+// There are special cases where security token matching is not enough.
+// For example, JS can set its domain to a super domain by calling
+// document.setDomain(...). In these cases, the binding code can reset
+// a context's security token to its global object so that the fast access
+// check will always fail.
+
+// Helper to check if the current execution context can access a target frame.
+// First it checks same domain policy using the lexical context.
+//
+// This is equivalent to KJS::Window::allowsAccessFrom(ExecState*).
+bool BindingSecurityBase::canAccess(DOMWindow* activeWindow,
+                                    DOMWindow* targetWindow)
+{
+    ASSERT(targetWindow);
+
+    String message;
+
+    if (activeWindow == targetWindow)
+        return true;
+
+    if (!activeWindow)
+        return false;
+
+    const SecurityOrigin* activeSecurityOrigin = activeWindow->securityOrigin();
+    const SecurityOrigin* targetSecurityOrigin = targetWindow->securityOrigin();
+
+    // We have seen crashes were the security origin of the target has not been
+    // initialized. Defend against that.
+    if (!targetSecurityOrigin)
+        return false;
+
+    if (activeSecurityOrigin->canAccess(targetSecurityOrigin))
+        return true;
+
+    // Allow access to a "about:blank" page if the dynamic context is a
+    // detached context of the same frame as the blank page.
+    if (targetSecurityOrigin->isEmpty() && activeWindow->frame() == targetWindow->frame())
+        return true;
+
+    return false;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.h b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.h
new file mode 100644
index 0000000000..cfa2e99970
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BindingSecurityBase_h
+#define BindingSecurityBase_h
+
+namespace WebCore {
+
+class DOMWindow;
+class Frame;
+class Node;
+
+// Helper functions for BindingSecurity that depend on WebCore classes, and
+// thus should not be implemented in BindingSecurity.h, which contains template
+// method definitions.
+class BindingSecurityBase {
+protected:
+    static DOMWindow* getDOMWindow(Frame*);
+    static Frame* getFrame(Node*);
+    static bool canAccess(DOMWindow* active, DOMWindow* target);
+};
+
+}
+
+#endif // BindingSecurityBase_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/GenericBinding.h b/src/3rdparty/webkit/WebCore/bindings/generic/GenericBinding.h
new file mode 100644
index 0000000000..d030b45841
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/GenericBinding.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GenericBinding_h
+#define GenericBinding_h
+
+namespace WebCore {
+
+// Used to instantiate binding templates for any methods shared among all
+// language bindings.
+class GenericBinding {};
+
+// Class to represent execution state for each language binding.
+template <class T>
+class State {};
+
+// Common notion of execution state for language bindings.
+template <>
+class State<GenericBinding> {
+    // Any methods shared across bindings can go here.
+};
+
+}
+
+#endif // GenericBinding_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h b/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
index 5d0bd2aec0..6ba85dad90 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -28,52 +28,73 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef PtrAndFlags_h
-#define PtrAndFlags_h
+#include "config.h"
+#include "RuntimeEnabledFeatures.h"
 
-#include <wtf/Assertions.h>
+#include "Database.h"
+#include "MediaPlayer.h"
+#include "SharedWorkerRepository.h"
+#include "WebSocket.h"
 
-namespace WTF {
-    template<class T, typename FlagEnum> class PtrAndFlagsBase {
-    public:
-        bool isFlagSet(FlagEnum flagNumber) const { ASSERT(flagNumber < 2); return m_ptrAndFlags & (1 << flagNumber); }
-        void setFlag(FlagEnum flagNumber) { ASSERT(flagNumber < 2); m_ptrAndFlags |= (1 << flagNumber);}
-        void clearFlag(FlagEnum flagNumber) { ASSERT(flagNumber < 2); m_ptrAndFlags &= ~(1 << flagNumber);}
-        T* get() const { return reinterpret_cast<T*>(m_ptrAndFlags & ~3); }
-        void set(T* ptr)
-        {
-            ASSERT(!(reinterpret_cast<intptr_t>(ptr) & 3));
-            m_ptrAndFlags = reinterpret_cast<intptr_t>(ptr) | (m_ptrAndFlags & 3);
-#ifndef NDEBUG
-            m_leaksPtr = ptr;
-#endif
-        }
+namespace WebCore {
+
+bool RuntimeEnabledFeatures::isLocalStorageEnabled = true;
+bool RuntimeEnabledFeatures::isSessionStorageEnabled = true;
+bool RuntimeEnabledFeatures::isWebkitNotificationsEnabled = false;
+bool RuntimeEnabledFeatures::isApplicationCacheEnabled = true;
+bool RuntimeEnabledFeatures::isGeolocationEnabled = true;
+bool RuntimeEnabledFeatures::isIndexedDBEnabled = false;
+bool RuntimeEnabledFeatures::isWebGLEnabled = false;
+bool RuntimeEnabledFeatures::isPushStateEnabled = false;
+
+#if ENABLE(VIDEO)
+
+bool RuntimeEnabledFeatures::audioEnabled()
+{
+    return MediaPlayer::isAvailable();
+}
+
+bool RuntimeEnabledFeatures::htmlMediaElementEnabled()
+{
+    return MediaPlayer::isAvailable();
+}
+
+bool RuntimeEnabledFeatures::htmlAudioElementEnabled()
+{
+    return MediaPlayer::isAvailable();
+}
 
-        bool operator!() const { return !get(); }
-        T* operator->() const { return reinterpret_cast<T*>(m_ptrAndFlags & ~3); }
+bool RuntimeEnabledFeatures::htmlVideoElementEnabled()
+{
+    return MediaPlayer::isAvailable();
+}
+
+bool RuntimeEnabledFeatures::mediaErrorEnabled()
+{
+    return MediaPlayer::isAvailable();
+}
 
-    protected:
-        intptr_t m_ptrAndFlags;
-#ifndef NDEBUG
-        void* m_leaksPtr; // Only used to allow tools like leaks on OSX to detect that the memory is referenced.
 #endif
-    };
 
-    template<class T, typename FlagEnum> class PtrAndFlags : public PtrAndFlagsBase<T, FlagEnum> {
-    public:
-        PtrAndFlags()
-        {
-            PtrAndFlagsBase<T, FlagEnum>::m_ptrAndFlags = 0;
-        }
-        PtrAndFlags(T* ptr)
-        {
-            PtrAndFlagsBase<T, FlagEnum>::m_ptrAndFlags = 0;
-            set(ptr);
-        }
-    };
-} // namespace WTF
+#if ENABLE(SHARED_WORKERS)
+bool RuntimeEnabledFeatures::sharedWorkerEnabled()
+{
+    return SharedWorkerRepository::isAvailable();
+}
+#endif
 
-using WTF::PtrAndFlagsBase;
-using WTF::PtrAndFlags;
+#if ENABLE(WEB_SOCKETS)
+bool RuntimeEnabledFeatures::webSocketEnabled()
+{
+    return WebSocket::isAvailable();
+}
+#endif
+
+#if ENABLE(DATABASE)
+bool RuntimeEnabledFeatures::openDatabaseEnabled()
+{
+    return Database::isAvailable();
+}
+#endif
 
-#endif // PtrAndFlags_h
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.h
new file mode 100644
index 0000000000..37dceff910
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RuntimeEnabledFeatures_h
+#define RuntimeEnabledFeatures_h
+
+namespace WebCore {
+
+// A class that stores static enablers for all experimental features. Note that
+// the method names must line up with the JavaScript method they enable for code
+// generation to work properly.
+
+class RuntimeEnabledFeatures {
+public:
+    static void setLocalStorageEnabled(bool isEnabled) { isLocalStorageEnabled = isEnabled; }
+    static bool localStorageEnabled() { return isLocalStorageEnabled; }
+
+    static void setSessionStorageEnabled(bool isEnabled) { isSessionStorageEnabled = isEnabled; }
+    static bool sessionStorageEnabled() { return isSessionStorageEnabled; }
+
+    static void setWebkitNotificationsEnabled(bool isEnabled) { isWebkitNotificationsEnabled = isEnabled; }
+    static bool webkitNotificationsEnabled() { return isWebkitNotificationsEnabled; }
+
+    static void setApplicationCacheEnabled(bool isEnabled) { isApplicationCacheEnabled = isEnabled; }
+    static bool applicationCacheEnabled() { return isApplicationCacheEnabled; }
+
+    static void setGeolocationEnabled(bool isEnabled) { isGeolocationEnabled = isEnabled; }
+    static bool geolocationEnabled() { return isGeolocationEnabled; }
+
+    static void setIndexedDBEnabled(bool isEnabled) { isIndexedDBEnabled = isEnabled; }
+    static bool indexedDBEnabled() { return isIndexedDBEnabled; }
+
+#if ENABLE(VIDEO)
+    static bool audioEnabled();
+    static bool htmlMediaElementEnabled();
+    static bool htmlAudioElementEnabled();
+    static bool htmlVideoElementEnabled();
+    static bool mediaErrorEnabled();
+#endif
+
+#if ENABLE(SHARED_WORKERS)
+    static bool sharedWorkerEnabled();
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    static bool webSocketEnabled();
+#endif
+
+#if ENABLE(DATABASE)
+    static bool openDatabaseEnabled();
+#endif
+
+#if ENABLE(3D_CANVAS)
+    static void setWebGLEnabled(bool isEnabled) { isWebGLEnabled = isEnabled; }
+    static bool webGLRenderingContextEnabled() { return isWebGLEnabled; }
+    static bool webGLArrayBufferEnabled() { return isWebGLEnabled; }
+    static bool webGLByteArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLUnsignedByteArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLShortArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLUnsignedShortArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLIntArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLUnsignedIntArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLFloatArrayEnabled() { return isWebGLEnabled; }
+#endif
+
+    static void setPushStateEnabled(bool isEnabled) { isPushStateEnabled = isEnabled; }
+    static bool pushStateEnabled() { return isPushStateEnabled; }
+    static bool replaceStateEnabled() { return isPushStateEnabled; }
+
+private:
+    // Never instantiate.
+    RuntimeEnabledFeatures() { }
+
+    static bool isLocalStorageEnabled;
+    static bool isSessionStorageEnabled;
+    static bool isWebkitNotificationsEnabled;
+    static bool isApplicationCacheEnabled;
+    static bool isGeolocationEnabled;
+    static bool isIndexedDBEnabled;
+    static bool isWebGLEnabled;
+    static bool isPushStateEnabled;
+};
+
+} // namespace WebCore
+
+#endif // RuntimeEnabledFeatures_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.cpp b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.cpp
new file mode 100644
index 0000000000..bfcab0b331
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.cpp
@@ -0,0 +1,37 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "DOMObjectHashTableMap.h"
+
+#include "WebCoreJSClientData.h"
+
+using namespace JSC;
+
+namespace WebCore{
+
+DOMObjectHashTableMap& DOMObjectHashTableMap::mapFor(JSGlobalData& globalData)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    ASSERT(clientData);
+    return static_cast<WebCoreJSClientData*>(clientData)->hashTableMap;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.h b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.h
new file mode 100644
index 0000000000..4ddacb86e6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.h
@@ -0,0 +1,60 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *  Copyright (C) 2009 Google, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef DOMObjectHashTableMap_h
+#define DOMObjectHashTableMap_h
+
+#include <runtime/Lookup.h>
+#include <wtf/HashMap.h>
+
+namespace JSC {
+    class JSGlobalData;
+}
+
+namespace WebCore {
+
+// Map from static HashTable instances to per-GlobalData ones.
+class DOMObjectHashTableMap {
+public:
+    static DOMObjectHashTableMap& mapFor(JSC::JSGlobalData&);
+
+    ~DOMObjectHashTableMap()
+    {
+        HashMap<const JSC::HashTable*, JSC::HashTable>::iterator mapEnd = m_map.end();
+        for (HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.begin(); iter != m_map.end(); ++iter)
+            iter->second.deleteTable();
+    }
+
+    const JSC::HashTable* get(const JSC::HashTable* staticTable)
+    {
+        HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.find(staticTable);
+        if (iter != m_map.end())
+            return &iter->second;
+        return &m_map.set(staticTable, JSC::HashTable(*staticTable)).first->second;
+    }
+
+private:
+    HashMap<const JSC::HashTable*, JSC::HashTable> m_map;
+};
+
+} // namespace WebCore
+
+#endif // DOMObjectHashTableMap_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectWithSVGContext.h b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectWithSVGContext.h
deleted file mode 100644
index 3d435cb2f6..0000000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectWithSVGContext.h
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright (C) 2009 Google, Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DOMObjectWithSVGContext_h
-#define DOMObjectWithSVGContext_h
-
-#if ENABLE(SVG)
-
-#include "JSDOMBinding.h"
-#include "SVGElement.h"
-
-namespace WebCore {
-
-    // FIXME: This class (and file) should be removed once all SVG bindings
-    // have moved context() onto the various impl() pointers.
-    class DOMObjectWithSVGContext : public DOMObject {
-    public:
-        SVGElement* context() const { return m_context.get(); }
-
-    protected:
-        DOMObjectWithSVGContext(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject*, SVGElement* context)
-            : DOMObject(structure)
-            , m_context(context)
-        {
-            // No space to store the JSDOMGlobalObject w/o hitting the CELL_SIZE limit.
-        }
-
-    protected: // FIXME: Many custom bindings use m_context directly.  Making this protected to temporariliy reduce code churn.
-        RefPtr<SVGElement> m_context;
-    };
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG)
-#endif // DOMObjectWithSVGContext_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.cpp b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.cpp
new file mode 100644
index 0000000000..c696315762
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.cpp
@@ -0,0 +1,68 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "DOMWrapperWorld.h"
+
+#include "JSDOMWindow.h"
+#include "WebCoreJSClientData.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+DOMWrapperWorld::DOMWrapperWorld(JSC::JSGlobalData* globalData, bool isNormal)
+    : m_globalData(globalData)
+    , m_isNormal(isNormal)
+{
+}
+
+static void forgetWorldOfDOMNodesForDocument(Document* document, DOMWrapperWorld* world)
+{
+    Document::JSWrapperCache* wrappers = document->wrapperCacheMap().take(world);
+    ASSERT(wrappers); // 'world' should only know about 'document' if 'document' knows about 'world'!
+    delete wrappers;
+}
+
+DOMWrapperWorld::~DOMWrapperWorld()
+{
+    JSGlobalData::ClientData* clientData = m_globalData->clientData;
+    ASSERT(clientData);
+    static_cast<WebCoreJSClientData*>(clientData)->forgetWorld(this);
+
+    for (HashSet<Document*>::iterator iter = documentsWithWrappers.begin(); iter != documentsWithWrappers.end(); ++iter)
+        forgetWorldOfDOMNodesForDocument(*iter, this);
+}
+
+DOMWrapperWorld* normalWorld(JSC::JSGlobalData& globalData)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    ASSERT(clientData);
+    return static_cast<WebCoreJSClientData*>(clientData)->normalWorld();
+}
+
+DOMWrapperWorld* mainThreadNormalWorld()
+{
+    ASSERT(isMainThread());
+    static DOMWrapperWorld* cachedNormalWorld = normalWorld(*JSDOMWindow::commonJSGlobalData());
+    return cachedNormalWorld;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.h b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.h
new file mode 100644
index 0000000000..65cf6a6914
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.h
@@ -0,0 +1,88 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *  Copyright (C) 2009 Google, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef DOMWrapperWorld_h
+#define DOMWrapperWorld_h
+
+#include "Document.h"
+#include "JSDOMGlobalObject.h"
+#include "JSDOMWrapper.h"
+#include <runtime/WeakGCMap.h>
+
+namespace WebCore {
+
+class StringImpl;
+
+typedef JSC::WeakGCMap<void*, DOMObject*> DOMObjectWrapperMap;
+typedef JSC::WeakGCMap<StringImpl*, JSC::JSString*> JSStringCache; 
+
+class DOMWrapperWorld : public RefCounted<DOMWrapperWorld> {
+public:
+    static PassRefPtr<DOMWrapperWorld> create(JSC::JSGlobalData* globalData, bool isNormal)
+    {
+        return adoptRef(new DOMWrapperWorld(globalData, isNormal));
+    }
+    ~DOMWrapperWorld();
+
+    void rememberDocument(Document* document) { documentsWithWrappers.add(document); }
+    void forgetDocument(Document* document) { documentsWithWrappers.remove(document); }
+
+    // FIXME: can we make this private?
+    DOMObjectWrapperMap m_wrappers;
+    JSStringCache m_stringCache;
+
+    bool isNormal() const { return m_isNormal; }
+
+protected:
+    DOMWrapperWorld(JSC::JSGlobalData*, bool isNormal);
+
+private:
+    JSC::JSGlobalData* m_globalData;
+    HashSet<Document*> documentsWithWrappers;
+    bool m_isNormal;
+};
+
+DOMWrapperWorld* normalWorld(JSC::JSGlobalData&);
+DOMWrapperWorld* mainThreadNormalWorld();
+inline DOMWrapperWorld* debuggerWorld() { return mainThreadNormalWorld(); }
+inline DOMWrapperWorld* pluginWorld() { return mainThreadNormalWorld(); }
+
+inline DOMWrapperWorld* currentWorld(JSC::ExecState* exec)
+{
+    return static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->world();
+}
+
+// From Document.h
+
+inline Document::JSWrapperCache* Document::getWrapperCache(DOMWrapperWorld* world)
+{
+    if (world->isNormal()) {
+        if (Document::JSWrapperCache* wrapperCache = m_normalWorldWrapperCache)
+            return wrapperCache;
+        ASSERT(!m_wrapperCacheMap.contains(world));
+    } else if (Document::JSWrapperCache* wrapperCache = m_wrapperCacheMap.get(world))
+        return wrapperCache;
+    return createWrapperCache(world);
+}
+
+} // namespace WebCore
+
+#endif // DOMWrapperWorld_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
index 59bcfa372d..d5a17891ba 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
@@ -40,17 +40,13 @@ using namespace JSC;
 
 namespace WebCore {
 
-#if USE(PTHREADS)
-
 static void* collect(void*)
 {
     JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow::commonJSGlobalData()->heap.collect();
+    JSDOMWindow::commonJSGlobalData()->heap.collectAllGarbage();
     return 0;
 }
 
-#endif
-
 GCController& gcController()
 {
     DEFINE_STATIC_LOCAL(GCController, staticGCController, ());
@@ -70,14 +66,14 @@ void GCController::garbageCollectSoon()
 
 void GCController::gcTimerFired(Timer<GCController>*)
 {
-    JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow::commonJSGlobalData()->heap.collect();
+    collect(0);
 }
 
 void GCController::garbageCollectNow()
 {
     JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow::commonJSGlobalData()->heap.collect();
+    if (!JSDOMWindow::commonJSGlobalData()->heap.isBusy())
+        collect(0);
 }
 
 void GCController::garbageCollectOnAlternateThreadForDebugging(bool waitUntilDone)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
index 6eca7bdbed..61fcf987a6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
@@ -50,7 +50,7 @@ JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -60,7 +60,7 @@ JSValue JSAbstractWorker::removeEventListener(ExecState* exec, const ArgList& ar
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
index 14457c4db3..3c01535fa0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
@@ -65,10 +65,8 @@ void JSAttr::markChildren(MarkStack& markStack)
 
     // Mark the element so that this will work to access the attribute even if the last
     // other reference goes away.
-    if (Element* element = impl()->ownerElement()) {
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
-            markStack.append(wrapper);
-    }
+    if (Element* element = impl()->ownerElement())
+        markDOMNodeWrapper(markStack, element->document(), element);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
index 174cc11f5d..77bb120988 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -30,10 +30,7 @@
 #include "JSAudioConstructor.h"
 
 #include "HTMLAudioElement.h"
-#include "HTMLNames.h"
 #include "JSHTMLAudioElement.h"
-#include "ScriptExecutionContext.h"
-#include "Text.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
@@ -46,24 +43,30 @@ JSAudioConstructor::JSAudioConstructor(ExecState* exec, JSDOMGlobalObject* globa
     : DOMConstructorWithDocument(JSAudioConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
     putDirect(exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontDelete | DontEnum);
 }
 
 static JSObject* constructAudio(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSAudioConstructor* jsAudio = static_cast<JSAudioConstructor*>(constructor);
-    // FIXME: Why doesn't this need the call toJS on the document like JSImageConstructor?
-    Document* document = jsAudio->document();
+    JSAudioConstructor* jsConstructor = static_cast<JSAudioConstructor*>(constructor);
+
+    Document* document = jsConstructor->document();
     if (!document)
         return throwError(exec, ReferenceError, "Audio constructor associated document is unavailable");
 
-    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(HTMLNames::audioTag, document);
-    audio->setAutobuffer(true);
-    if (args.size() > 0) {
-        audio->setSrc(args.at(0).toString(exec));
-        audio->scheduleLoad();
-    }
-    return asObject(toJS(exec, jsAudio->globalObject(), audio.release()));
+    // Calling toJS on the document causes the JS document wrapper to be
+    // added to the window object. This is done to ensure that JSDocument::markChildren
+    // will be called, which will cause the audio element to be marked if necessary.
+    toJS(exec, jsConstructor->globalObject(), document);
+
+    // FIXME: This converts an undefined argument to the string "undefined", but possibly we
+    // should treat it as if no argument was passed instead, by checking the value of args.at
+    // rather than looking at args.size.
+    String src;
+    if (args.size() > 0)
+        src = args.at(0).toString(exec);
+    return asObject(toJS(exec, jsConstructor->globalObject(),
+        HTMLAudioElement::createForJSConstructor(document, src)));
 }
 
 ConstructType JSAudioConstructor::getConstructData(ConstructData& constructData)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp
index f08303a0c6..5a0820b629 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -85,8 +85,8 @@
 #include "JSHistoryCustom.cpp"
 #include "JSImageConstructor.cpp"
 #include "JSImageDataCustom.cpp"
-#include "JSInspectedObjectWrapper.cpp"
-#include "JSInspectorBackendCustom.cpp"
+#include "JSInjectedScriptHostCustom.cpp"
+#include "JSInspectorFrontendHostCustom.cpp"
 #include "JSJavaScriptCallFrameCustom.cpp"
 #include "JSLazyEventListener.cpp"
 #include "JSLocationCustom.cpp"
@@ -106,7 +106,6 @@
 #include "JSPluginArrayCustom.cpp"
 #include "JSPluginCustom.cpp"
 #include "JSPluginElementFunctions.cpp"
-#include "JSQuarantinedObjectWrapper.cpp"
 #include "JSSQLResultSetRowListCustom.cpp"
 #include "JSSQLTransactionCustom.cpp"
 #include "JSSVGElementInstanceCustom.cpp"
@@ -114,7 +113,6 @@
 #include "JSSVGMatrixCustom.cpp"
 #include "JSSVGPathSegCustom.cpp"
 #include "JSSVGPathSegListCustom.cpp"
-#include "JSSVGPointListCustom.cpp"
 #include "JSSharedWorkerConstructor.cpp"
 #include "JSSharedWorkerCustom.cpp"
 #include "JSStorageCustom.cpp"
@@ -142,9 +140,10 @@
 #include "ScriptCallStack.cpp"
 #include "ScriptController.cpp"
 #include "ScriptControllerWin.cpp"
+#include "ScriptDebugServer.cpp"
 #include "ScriptEventListener.cpp"
 #include "ScriptFunctionCall.cpp"
-#include "ScriptObjectQuarantine.cpp"
+#include "ScriptProfiler.cpp"
 #include "ScriptState.cpp"
 #include "SerializedScriptValue.cpp"
 #include "WorkerScriptController.cpp"
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
index 1b96c06279..b0adf15395 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
@@ -54,7 +54,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, CSSRule* rule)
     if (!rule)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), rule);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, rule);
     if (wrapper)
         return wrapper;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 4a137d36f4..fad7aba9c4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -142,9 +142,9 @@ bool JSCSSStyleDeclaration::canGetItemsForName(ExecState*, CSSStyleDeclaration*,
 
 // FIXME: You can get these properties, and set them (see putDelegate below),
 // but you should also be able to enumerate them.
-JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
+    JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
 
     // Set up pixelOrPos boolean to handle the fact that
     // pixelTop returns "CSS Top" as number value in unit pixels
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
index 87a5760254..83c1d3a914 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
@@ -49,7 +49,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, CSSValue* value)
     if (!value)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), value);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, value);
 
     if (wrapper)
         return wrapper;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
index 38292c7b68..e128f277a0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
@@ -47,13 +47,8 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
     ASSERT(globalObject());
 
     ExecState* exec = globalObject()->globalExec();
-    
-    JSValue function;
-    {
-        // Switch worlds, just in case handleEvent is a getter and causes JS execution!
-        EnterDOMWrapperWorld worldEntry(exec, m_isolatedWorld.get());
-        function = callback()->get(exec, Identifier(exec, "handleEvent"));
-    }
+    JSValue function = callback()->get(exec, Identifier(exec, "handleEvent"));
+
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -64,7 +59,7 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
     }
     
     globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = callInWorld(exec, function, callType, callData, callback(), args, m_isolatedWorld.get());
+    JSValue result = JSC::call(exec, function, callType, callData, callback(), args);
     globalObject()->globalData()->timeoutChecker.stop();
 
     Document::updateStyleForAllDocuments();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
index 5c867019c1..b939c01be3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
@@ -48,7 +48,6 @@ public:
     JSCallbackData(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
         : m_callback(callback)
         , m_globalObject(globalObject)
-        , m_isolatedWorld(currentWorld(globalObject->globalExec()))
     {
     }
     
@@ -65,7 +64,6 @@ public:
 private:
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
     JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
-    RefPtr<DOMWrapperWorld> m_isolatedWorld;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
deleted file mode 100644
index 14548d7e39..0000000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "config.h"
-#include "JSCanvasArray.h"
-#include "JSCanvasByteArray.h"
-#include "JSCanvasUnsignedByteArray.h"
-#include "JSCanvasShortArray.h"
-#include "JSCanvasUnsignedShortArray.h"
-#include "JSCanvasIntArray.h"
-#include "JSCanvasUnsignedIntArray.h"
-#include "JSCanvasFloatArray.h"
-
-#include "CanvasArray.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArray* object)
-{
-    if (object->isFloatArray())
-        return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, static_cast<CanvasFloatArray*>(object));
-    if (object->isUnsignedByteArray())
-        return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, static_cast<CanvasUnsignedByteArray*>(object));
-    if (object->isByteArray())
-        return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, static_cast<CanvasByteArray*>(object));
-    if (object->isIntArray())
-        return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, static_cast<CanvasIntArray*>(object));
-    if (object->isUnsignedIntArray())
-        return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, static_cast<CanvasUnsignedIntArray*>(object));
-    if (object->isShortArray())
-        return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, static_cast<CanvasShortArray*>(object));
-    if (object->isUnsignedShortArray())
-        return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, static_cast<CanvasUnsignedShortArray*>(object));
-    return jsUndefined();
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index bb3500b9ef..a27192305e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -51,10 +51,10 @@ static JSValue toJS(ExecState* exec, CanvasStyle* style)
     return jsString(exec, style->color());
 }
 
-static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValue value)
+static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState* exec, JSValue value)
 {
     if (value.isString())
-        return CanvasStyle::create(asString(value)->value());
+        return CanvasStyle::create(asString(value)->value(exec));
     if (!value.isObject())
         return 0;
     JSObject* object = asObject(value);
@@ -102,13 +102,13 @@ JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList&
     switch (args.size()) {
         case 1:
             if (args.at(0).isString())
-                context->setFillColor(asString(args.at(0))->value());
+                context->setFillColor(asString(args.at(0))->value(exec));
             else
                 context->setFillColor(args.at(0).toFloat(exec));
             break;
         case 2:
             if (args.at(0).isString())
-                context->setFillColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
+                context->setFillColor(asString(args.at(0))->value(exec), args.at(1).toFloat(exec));
             else
                 context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
@@ -139,13 +139,13 @@ JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgLis
     switch (args.size()) {
         case 1:
             if (args.at(0).isString())
-                context->setStrokeColor(asString(args.at(0))->value());
+                context->setStrokeColor(asString(args.at(0))->value(exec));
             else
                 context->setStrokeColor(args.at(0).toFloat(exec));
             break;
         case 2:
             if (args.at(0).isString())
-                context->setStrokeColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
+                context->setStrokeColor(asString(args.at(0))->value(exec), args.at(1).toFloat(exec));
             else
                 context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
@@ -298,7 +298,7 @@ JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& ar
         case 4:
             if (args.at(3).isString())
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
-                                   args.at(2).toFloat(exec), asString(args.at(3))->value());
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value(exec));
             else
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
                                    args.at(2).toFloat(exec), args.at(3).toFloat(exec));
@@ -306,7 +306,7 @@ JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& ar
         case 5:
             if (args.at(3).isString())
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
-                                   args.at(2).toFloat(exec), asString(args.at(3))->value(),
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value(exec),
                                    args.at(4).toFloat(exec));
             else
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
deleted file mode 100644
index 3938ba1c29..0000000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
+++ /dev/null
@@ -1,443 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasRenderingContext3D.h"
-
-#include "CanvasRenderingContext3D.h"
-#include "ExceptionCode.h"
-#include "HTMLCanvasElement.h"
-#include "HTMLImageElement.h"
-#include "JSCanvasFloatArray.h"
-#include "JSCanvasIntArray.h"
-#include "JSHTMLCanvasElement.h"
-#include "JSHTMLImageElement.h"
-#include "JSWebKitCSSMatrix.h"
-#include <runtime/Error.h>
-#include <wtf/FastMalloc.h>
-#include <wtf/OwnFastMallocPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-JSValue JSCanvasRenderingContext3D::bufferData(JSC::ExecState* exec, JSC::ArgList const& args)
-{
-    if (args.size() != 3)
-        return throwError(exec, SyntaxError);
-
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned usage = args.at(2).toInt32(exec);
-
-    // If argument 1 is a number, we are initializing this buffer to that size
-    if (!args.at(1).isObject()) {
-        unsigned int count = args.at(1).toInt32(exec);
-        static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, count, usage);
-        return jsUndefined();
-    }
-
-    CanvasArray* array = toCanvasArray(args.at(1));
-    
-    static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, array, usage);
-    return jsUndefined();
-}
-
-JSValue JSCanvasRenderingContext3D::bufferSubData(JSC::ExecState* exec, JSC::ArgList const& args)
-{
-    if (args.size() != 3)
-        return throwError(exec, SyntaxError);
-
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned offset = args.at(1).toInt32(exec);
-    
-    CanvasArray* array = toCanvasArray(args.at(2));
-    
-    static_cast<CanvasRenderingContext3D*>(impl())->bufferSubData(target, offset, array);
-    return jsUndefined();
-}
-
-// void texImage2DHTML(in unsigned long target, in unsigned long level, in HTMLImageElement image);
-JSValue JSCanvasRenderingContext3D::texImage2D(ExecState* exec, const ArgList& args)
-{ 
-    if (args.size() < 3)
-        return throwError(exec, SyntaxError);
-
-    ExceptionCode ec = 0;
-    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
-    unsigned target = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    unsigned level = args.at(1).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-    
-    if (args.size() > 5) {
-        // This must be the bare array case.
-        if (args.size() != 9)
-            return throwError(exec, SyntaxError);
-            
-        unsigned internalformat = args.at(2).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned width = args.at(3).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned height = args.at(4).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned border = args.at(5).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned format = args.at(6).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned type = args.at(7).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        CanvasArray* array = toCanvasArray(args.at(8));
-        if (exec->hadException())    
-            return jsUndefined();
-            
-        if (!array)
-            return throwError(exec, TypeError);
-        
-        // FIXME: Need to check to make sure CanvasArray is a CanvasByteArray or CanvasShortArray,
-        // depending on the passed type parameter.
-        
-        context->texImage2D(target, level, internalformat, width, height, border, format, type, array, ec);
-        return jsUndefined();
-    }
-    
-    // The image parameter can be a <img> or <canvas> element.
-    JSValue value = args.at(2);
-    if (!value.isObject())
-        return throwError(exec, TypeError);
-    JSObject* o = asObject(value);
-    
-    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
-    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
-    
-    if (o->inherits(&JSHTMLImageElement::s_info)) {
-        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texImage2D(target, level, imgElt, flipY, premultiplyAlpha, ec);
-    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
-        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texImage2D(target, level, canvas, flipY, premultiplyAlpha, ec);
-    } else {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-    }
-    
-    return jsUndefined();    
-}
-
-// void texSubImage2DHTML(in unsigned long target, in unsigned long level, in unsigned long xoff, in unsigned long yoff, in unsigned long width, in unsigned long height, in HTMLImageElement image);
-JSValue JSCanvasRenderingContext3D::texSubImage2D(ExecState* exec, const ArgList& args)
-{ 
-    if (args.size() < 7 || args.size() > 9)
-        return throwError(exec, SyntaxError);
-
-    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned level = args.at(1).toInt32(exec);
-    unsigned xoff = args.at(2).toInt32(exec);
-    unsigned yoff = args.at(3).toInt32(exec);
-    unsigned width = args.at(4).toInt32(exec);
-    unsigned height = args.at(5).toInt32(exec);
-    
-    // The image parameter can be a <img> or <canvas> element.
-    JSValue value = args.at(6);
-    if (!value.isObject())
-        return throwError(exec, TypeError);
-    JSObject* o = asObject(value);
-    
-    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
-    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
-    
-    ExceptionCode ec = 0;
-    if (o->inherits(&JSHTMLImageElement::s_info)) {
-        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texSubImage2D(target, level, xoff, yoff, width, height, imgElt, flipY, premultiplyAlpha, ec);
-    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
-        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texSubImage2D(target, level, xoff, yoff, width, height, canvas, flipY, premultiplyAlpha, ec);
-    } else {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-    }
-    
-    return jsUndefined();    
-}
-
-template<typename T>
-void toArray(JSC::ExecState* exec, JSC::JSValue value, T*& array, int& size)
-{
-    array = 0;
-    
-    if (!value.isObject())
-        return;
-        
-    JSC::JSObject* object = asObject(value);
-    int length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
-    void* tempValues;
-    if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues))
-        return;
-    
-    T* values = static_cast<T*>(tempValues);
-    for (int i = 0; i < length; ++i) {
-        JSC::JSValue v = object->get(exec, i);
-        if (exec->hadException())
-            return;
-        values[i] = static_cast<T>(v.toNumber(exec));
-    }
-
-    array = values;
-    size = length;
-}
-
-enum DataFunctionToCall {
-    f_uniform1v, f_uniform2v, f_uniform3v, f_uniform4v,
-    f_vertexAttrib1v, f_vertexAttrib2v, f_vertexAttrib3v, f_vertexAttrib4v
-};
-
-enum DataFunctionMatrixToCall {
-    f_uniformMatrix2fv, f_uniformMatrix3fv, f_uniformMatrix4fv
-};
-
-static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
-{
-    if (args.size() != 2)
-        return throwError(exec, SyntaxError);
-
-    long location = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(1));
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    if (canvasArray) {
-        switch(f) {
-            case f_uniform1v: context->uniform1fv(location, canvasArray.get()); break;
-            case f_uniform2v: context->uniform2fv(location, canvasArray.get()); break;
-            case f_uniform3v: context->uniform3fv(location, canvasArray.get()); break;
-            case f_uniform4v: context->uniform4fv(location, canvasArray.get()); break;
-            case f_vertexAttrib1v: context->vertexAttrib1fv(location, canvasArray.get()); break;
-            case f_vertexAttrib2v: context->vertexAttrib2fv(location, canvasArray.get()); break;
-            case f_vertexAttrib3v: context->vertexAttrib3fv(location, canvasArray.get()); break;
-            case f_vertexAttrib4v: context->vertexAttrib4fv(location, canvasArray.get()); break;
-        }
-        return jsUndefined();
-    }
-    
-    float* array;
-    int size;
-    toArray<float>(exec, args.at(1), array, size);
-    
-    if (!array)
-        return throwError(exec, TypeError);
-
-    switch(f) {
-        case f_uniform1v: context->uniform1fv(location, array, size); break;
-        case f_uniform2v: context->uniform2fv(location, array, size); break;
-        case f_uniform3v: context->uniform3fv(location, array, size); break;
-        case f_uniform4v: context->uniform4fv(location, array, size); break;
-        case f_vertexAttrib1v: context->vertexAttrib1fv(location, array, size); break;
-        case f_vertexAttrib2v: context->vertexAttrib2fv(location, array, size); break;
-        case f_vertexAttrib3v: context->vertexAttrib3fv(location, array, size); break;
-        case f_vertexAttrib4v: context->vertexAttrib4fv(location, array, size); break;
-    }
-    return jsUndefined();
-}
-
-static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
-{
-    if (args.size() != 2)
-        return throwError(exec, SyntaxError);
-
-    long location = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    RefPtr<CanvasIntArray> canvasArray = toCanvasIntArray(args.at(1));
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    if (canvasArray) {
-        switch(f) {
-            case f_uniform1v: context->uniform1iv(location, canvasArray.get()); break;
-            case f_uniform2v: context->uniform2iv(location, canvasArray.get()); break;
-            case f_uniform3v: context->uniform3iv(location, canvasArray.get()); break;
-            case f_uniform4v: context->uniform4iv(location, canvasArray.get()); break;
-            default: break;
-        }
-        return jsUndefined();
-    }
-    
-    int* array;
-    int size;
-    toArray<int>(exec, args.at(1), array, size);
-    
-    if (!array)
-        return throwError(exec, TypeError);
-
-    switch(f) {
-        case f_uniform1v: context->uniform1iv(location, array, size); break;
-        case f_uniform2v: context->uniform2iv(location, array, size); break;
-        case f_uniform3v: context->uniform3iv(location, array, size); break;
-        case f_uniform4v: context->uniform4iv(location, array, size); break;
-        default: break;
-    }
-    return jsUndefined();
-}
-
-static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
-{
-    if (args.size() != 3)
-        return throwError(exec, SyntaxError);
-
-    long location = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    bool transpose = args.at(1).toBoolean(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(2));
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    if (canvasArray) {
-        switch(f) {
-            case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, canvasArray.get()); break;
-            case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, canvasArray.get()); break;
-            case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, canvasArray.get()); break;
-        }
-        return jsUndefined();
-    }
-    
-    float* array;
-    int size;
-    toArray<float>(exec, args.at(2), array, size);
-    
-    if (!array)
-        return throwError(exec, TypeError);
-
-    switch(f) {
-        case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, array, size); break;
-        case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, array, size); break;
-        case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, array, size); break;
-    }
-    return jsUndefined();
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform1fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform1iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform2fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform2iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform3fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform3iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform4fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform4iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix2fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionMatrix(f_uniformMatrix2fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix3fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionMatrix(f_uniformMatrix3fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix4fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionMatrix(f_uniformMatrix4fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib1fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib2fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib3fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib4fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
index 0cd2aa388e..df24eb7fed 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
@@ -29,8 +29,8 @@
 #include "CanvasRenderingContext2D.h"
 #include "JSCanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)
-#include "CanvasRenderingContext3D.h"
-#include "JSCanvasRenderingContext3D.h"
+#include "WebGLRenderingContext.h"
+#include "JSWebGLRenderingContext.h"
 #endif
 
 using namespace JSC;
@@ -44,7 +44,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasR
 
 #if ENABLE(3D_CANVAS)
     if (object->is3d())
-        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
+        return getDOMObjectWrapper<JSWebGLRenderingContext>(exec, globalObject, static_cast<WebGLRenderingContext*>(object));
 #endif
     ASSERT(object->is2d());
     return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
deleted file mode 100644
index 23c197fde5..0000000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSCanvasUnsignedShortArrayConstructor_h
-#define JSCanvasUnsignedShortArrayConstructor_h
-
-#include "JSDOMBinding.h"
-#include "JSDocument.h"
-
-namespace WebCore {
-
-    class JSCanvasUnsignedShortArrayConstructor : public DOMConstructorObject {
-    public:
-        JSCanvasUnsignedShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-}
-
-#endif // JSCanvasUnsignedShortArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
index 9c484673d8..b631cdd107 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
@@ -24,11 +24,13 @@
  */
 
 #include "config.h"
+
 #include "JSConsole.h"
-#include "JavaScriptProfile.h"
-#include <runtime/JSArray.h>
 
 #include "Console.h"
+#include "JavaScriptProfile.h"
+#include "ScriptCallStack.h"
+#include <runtime/JSArray.h>
 
 using namespace JSC;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
index e5f83aa10d..cc6d45cd26 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSCustomPositionCallback.h"
 
+#if ENABLE(GEOLOCATION)
+
 #include "Frame.h"
 #include "JSGeoposition.h"
 #include "ScriptController.h"
@@ -52,3 +54,5 @@ void JSCustomPositionCallback::handleEvent(Geoposition* geoposition)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
index bd64deb48d..c94ae9aaa6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSCustomPositionErrorCallback.h"
 
+#if ENABLE(GEOLOCATION)
+
 #include "Frame.h"
 #include "JSPositionError.h"
 #include "ScriptController.h"
@@ -53,3 +55,5 @@ void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
 }
     
 } // namespace WebCore
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index 61785092bf..4d5de79650 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -77,7 +77,7 @@ bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction,
         // Therefore an exception and returning true are the same thing - so, return true on an exception
         return true;
     }
-    return result.toBoolean(exec);
+    return !result.isFalse();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index c2884d7a3a..07cfc746a2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -90,7 +90,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     args.append(jsString(exec, prefix));
 
     m_globalObject->globalData()->timeoutChecker.start();
-    JSValue retval = callInWorld(exec, function, callType, callData, m_customResolver, args, currentWorld(m_globalObject->globalExec()));
+    JSValue retval = JSC::call(exec, function, callType, callData, m_customResolver, args);
     m_globalObject->globalData()->timeoutChecker.stop();
 
     String result;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index 91ee51ada4..5637087bcb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -91,7 +91,7 @@ JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList&
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -101,7 +101,7 @@ JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgLis
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index ef69c7b1e9..f294dadb2d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -25,6 +25,7 @@
 
 #include "ActiveDOMObject.h"
 #include "DOMCoreException.h"
+#include "DOMObjectHashTableMap.h"
 #include "Document.h"
 #include "EventException.h"
 #include "ExceptionBase.h"
@@ -33,10 +34,11 @@
 #include "HTMLAudioElement.h"
 #include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
-#include "HTMLScriptElement.h"
 #include "HTMLNames.h"
+#include "HTMLScriptElement.h"
 #include "JSDOMCoreException.h"
 #include "JSDOMWindowCustom.h"
+#include "JSDebugWrapperSet.h"
 #include "JSEventException.h"
 #include "JSExceptionBase.h"
 #include "JSNode.h"
@@ -45,12 +47,16 @@
 #include "KURL.h"
 #include "MessagePort.h"
 #include "RangeException.h"
+#include "ScriptCachedFrameData.h"
 #include "ScriptController.h"
 #include "Settings.h"
+#include "WebCoreJSClientData.h"
 #include "XMLHttpRequestException.h"
+#include <runtime/DateInstance.h>
 #include <runtime/Error.h>
 #include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
+#include <wtf/MathExtras.h>
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(SVG)
@@ -63,11 +69,6 @@
 #include "XPathException.h"
 #endif
 
-#if ENABLE(WORKERS)
-#include <wtf/ThreadSpecific.h>
-using namespace WTF;
-#endif
-
 using namespace JSC;
 
 namespace WebCore {
@@ -77,121 +78,6 @@ using namespace HTMLNames;
 typedef Document::JSWrapperCache JSWrapperCache;
 typedef Document::JSWrapperCacheMap JSWrapperCacheMap;
 
-// For debugging, keep a set of wrappers currently registered, and check that
-// all are unregistered before they are destroyed. This has helped us fix at
-// least one bug.
-
-static void addWrapper(DOMObject* wrapper);
-static void removeWrapper(DOMObject* wrapper);
-static void removeWrappers(const JSWrapperCache& wrappers);
-static void removeWrappers(const DOMObjectWrapperMap& wrappers);
-
-#ifdef NDEBUG
-
-static inline void addWrapper(DOMObject*)
-{
-}
-
-static inline void removeWrapper(DOMObject*)
-{
-}
-
-static inline void removeWrappers(const JSWrapperCache&)
-{
-}
-
-static inline void removeWrappers(const DOMObjectWrapperMap&)
-{
-}
-
-#else
-
-static HashSet<DOMObject*>& wrapperSet()
-{
-#if ENABLE(WORKERS)
-    DEFINE_STATIC_LOCAL(ThreadSpecific<HashSet<DOMObject*> >, staticWrapperSet, ());
-    return *staticWrapperSet;
-#else
-    DEFINE_STATIC_LOCAL(HashSet<DOMObject*>, staticWrapperSet, ());
-    return staticWrapperSet;
-#endif
-}
-
-static void addWrapper(DOMObject* wrapper)
-{
-    ASSERT(!wrapperSet().contains(wrapper));
-    wrapperSet().add(wrapper);
-}
-
-static void removeWrapper(DOMObject* wrapper)
-{
-    if (!wrapper)
-        return;
-    ASSERT(wrapperSet().contains(wrapper));
-    wrapperSet().remove(wrapper);
-}
-
-static void removeWrappers(const JSWrapperCache& wrappers)
-{
-    JSWrapperCache::const_iterator wrappersEnd = wrappers.end();
-    for (JSWrapperCache::const_iterator it = wrappers.begin(); it != wrappersEnd; ++it)
-        removeWrapper(it->second);
-}
-
-static inline void removeWrappers(const DOMObjectWrapperMap& wrappers)
-{
-    DOMObjectWrapperMap::const_iterator wrappersEnd = wrappers.end();
-    for (DOMObjectWrapperMap::const_iterator it = wrappers.begin(); it != wrappersEnd; ++it)
-        removeWrapper(it->second);
-}
-
-DOMObject::~DOMObject()
-{
-    ASSERT(!wrapperSet().contains(this));
-}
-
-#endif
-
-DOMWrapperWorld::DOMWrapperWorld(JSC::JSGlobalData* globalData)
-    : m_globalData(globalData)
-{
-}
-
-DOMWrapperWorld::~DOMWrapperWorld()
-{
-    JSGlobalData::ClientData* clientData = m_globalData->clientData;
-    ASSERT(clientData);
-    static_cast<WebCoreJSClientData*>(clientData)->forgetWorld(this);
-
-    removeWrappers(m_wrappers);
-
-    for (HashSet<Document*>::iterator iter = documentsWithWrappers.begin(); iter != documentsWithWrappers.end(); ++iter)
-        forgetWorldOfDOMNodesForDocument(*iter, this);
-    for (HashSet<ScriptController*>::iterator iter = scriptControllersWithShells.begin(); iter != scriptControllersWithShells.end(); ++iter)
-        (*iter)->forgetWorld(this);
-}
-
-EnterDOMWrapperWorld::EnterDOMWrapperWorld(JSC::JSGlobalData& globalData, DOMWrapperWorld* isolatedWorld)
-{
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    m_clientData = static_cast<WebCoreJSClientData*>(clientData);
-    m_clientData->m_worldStack.append(isolatedWorld);
-}
-
-EnterDOMWrapperWorld::EnterDOMWrapperWorld(JSC::ExecState* exec, DOMWrapperWorld* isolatedWorld)
-{
-    JSGlobalData::ClientData* clientData = exec->globalData().clientData;
-    ASSERT(clientData);
-    m_clientData = static_cast<WebCoreJSClientData*>(clientData);
-    m_clientData->m_worldStack.append(isolatedWorld);
-}
-
-EnterDOMWrapperWorld::~EnterDOMWrapperWorld()
-{
-    m_clientData->m_worldStack.removeLast();
-}
-
 class JSGlobalDataWorldIterator {
 public:
     JSGlobalDataWorldIterator(JSGlobalData* globalData)
@@ -228,124 +114,105 @@ private:
     HashSet<DOMWrapperWorld*>::iterator m_end;
 };
 
-static inline DOMWrapperWorld* currentWorld(JSC::JSGlobalData& globalData)
-{
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->currentWorld();
-}
-
-DOMWrapperWorld* currentWorld(JSC::ExecState* exec)
-{
-    return currentWorld(exec->globalData());
-}
-
-DOMWrapperWorld* normalWorld(JSC::JSGlobalData& globalData)
-{
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->normalWorld();
-}
-
-DOMWrapperWorld* mainThreadNormalWorld()
-{
-    ASSERT(isMainThread());
-    return normalWorld(*JSDOMWindow::commonJSGlobalData());
-}
-
-DOMWrapperWorld* mainThreadCurrentWorld()
+const JSC::HashTable* getHashTableForGlobalData(JSGlobalData& globalData, const JSC::HashTable* staticTable)
 {
-    ASSERT(isMainThread());
-
-    JSGlobalData::ClientData* clientData = JSDOMWindowBase::commonJSGlobalData()->clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->currentWorld();
+    return DOMObjectHashTableMap::mapFor(globalData).get(staticTable);
 }
 
-DOMObjectHashTableMap& DOMObjectHashTableMap::mapFor(JSGlobalData& globalData)
+bool hasCachedDOMObjectWrapperUnchecked(JSGlobalData* globalData, void* objectHandle)
 {
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->hashTableMap;
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        if (worldIter->m_wrappers.uncheckedGet(objectHandle))
+            return true;
+    }
+    return false;
 }
 
-const JSC::HashTable* getHashTableForGlobalData(JSGlobalData& globalData, const JSC::HashTable* staticTable)
+bool hasCachedDOMObjectWrapper(JSGlobalData* globalData, void* objectHandle)
 {
-    return DOMObjectHashTableMap::mapFor(globalData).get(staticTable);
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        if (worldIter->m_wrappers.get(objectHandle))
+            return true;
+    }
+    return false;
 }
 
-//inline DOMObjectWrapperMap& DOMObjectWrapperMap::mapFor(JSGlobalData& globalData)
-inline DOMObjectWrapperMap& DOMObjectWrapperMapFor(JSGlobalData& globalData)
+DOMObject* getCachedDOMObjectWrapper(JSC::ExecState* exec, void* objectHandle) 
 {
-    return currentWorld(globalData)->m_wrappers;
+    return domObjectWrapperMapFor(exec).get(objectHandle);
 }
 
-DOMObject* getCachedDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle) 
+void cacheDOMObjectWrapper(JSC::ExecState* exec, void* objectHandle, DOMObject* wrapper) 
 {
-    return DOMObjectWrapperMapFor(globalData).get(objectHandle);
+    JSDebugWrapperSet::willCacheWrapper(wrapper);
+    domObjectWrapperMapFor(exec).set(objectHandle, wrapper);
 }
 
-void cacheDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle, DOMObject* wrapper) 
+bool hasCachedDOMNodeWrapperUnchecked(Document* document, Node* node)
 {
-    addWrapper(wrapper);
-    DOMObjectWrapperMapFor(globalData).set(objectHandle, wrapper);
-}
+    if (!document)
+        return hasCachedDOMObjectWrapperUnchecked(JSDOMWindow::commonJSGlobalData(), node);
 
-JSNode* getCachedDOMNodeWrapper(Document* document, Node* node)
-{
-    if (document)
-        return document->getWrapperCache(mainThreadCurrentWorld())->get(node);
-    return static_cast<JSNode*>(DOMObjectWrapperMapFor(*JSDOMWindow::commonJSGlobalData()).get(node));
+    JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+    for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
+        if (iter->second->uncheckedGet(node))
+            return true;
+    }
+    return false;
 }
 
 void forgetDOMObject(DOMObject* wrapper, void* objectHandle)
 {
     JSC::JSGlobalData* globalData = Heap::heap(wrapper)->globalData();
-    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
-        DOMObjectWrapperMap& wrappers = worldIter->m_wrappers;
-        DOMObjectWrapperMap::iterator iter = wrappers.find(objectHandle);
-        if ((iter != wrappers.end()) && (iter->second == wrapper)) {
-            removeWrapper(wrapper);
-            wrappers.remove(iter);
-            return;
-        }
+
+    // Check the normal world first!
+    JSGlobalData::ClientData* clientData = globalData->clientData;
+    ASSERT(clientData);
+    DOMObjectWrapperMap& wrappers = static_cast<WebCoreJSClientData*>(clientData)->normalWorld()->m_wrappers;
+    if (wrappers.uncheckedRemove(objectHandle, wrapper)) {
+        JSDebugWrapperSet::didUncacheWrapper(wrapper);
+        return;
     }
 
-    // If the world went away, it should have removed this wrapper from the set.
-    ASSERT(!wrapperSet().contains(wrapper));
+    // We can't guarantee that a wrapper is in the cache when it uncaches itself,
+    // since a new wrapper may be cached before the old wrapper's destructor runs.
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        if (worldIter->m_wrappers.uncheckedRemove(objectHandle, wrapper))
+            break;
+    }
+    JSDebugWrapperSet::didUncacheWrapper(wrapper);
 }
 
-void forgetDOMNode(DOMObject* wrapper, Node* node, Document* document)
+void forgetDOMNode(JSNode* wrapper, Node* node, Document* document)
 {
+    node->clearWrapper(wrapper);
+
     if (!document) {
         forgetDOMObject(wrapper, node);
         return;
     }
 
+    // We can't guarantee that a wrapper is in the cache when it uncaches itself,
+    // since a new wrapper may be cached before the old wrapper's destructor runs.
     JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
     for (JSWrapperCacheMap::iterator wrappersIter = wrapperCacheMap.begin(); wrappersIter != wrapperCacheMap.end(); ++wrappersIter) {
-        JSWrapperCache* wrappers = wrappersIter->second;
-        JSWrapperCache::iterator iter = wrappers->find(node);
-        if ((iter != wrappers->end()) && (iter->second == wrapper)) {
-            wrappers->remove(iter);
-            removeWrapper(wrapper);
-            return;
-        }
+        if (wrappersIter->second->uncheckedRemove(node, wrapper))
+            break;
     }
-
-    // If the world went away, it should have removed this wrapper from the set.
-    ASSERT(!wrapperSet().contains(wrapper));
+    JSDebugWrapperSet::didUncacheWrapper(wrapper);
 }
 
-void cacheDOMNodeWrapper(Document* document, Node* node, JSNode* wrapper)
+void cacheDOMNodeWrapper(JSC::ExecState* exec, Document* document, Node* node, JSNode* wrapper)
 {
-    if (!document) {
-        addWrapper(wrapper);
-        DOMObjectWrapperMapFor(*JSDOMWindow::commonJSGlobalData()).set(node, wrapper);
-        return;
-    }
-    addWrapper(wrapper);
-    document->getWrapperCache(mainThreadCurrentWorld())->set(node, wrapper);
+    JSDebugWrapperSet::willCacheWrapper(wrapper);
+
+    if (!document)
+        domObjectWrapperMapFor(exec).set(node, wrapper);
+    else
+        document->getWrapperCache(currentWorld(exec))->set(node, wrapper);
+
+    if (currentWorld(exec)->isNormal())
+        node->setWrapper(wrapper);
 }
 
 void forgetAllDOMNodesForDocument(Document* document)
@@ -354,21 +221,11 @@ void forgetAllDOMNodesForDocument(Document* document)
     JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
     JSWrapperCacheMap::const_iterator wrappersMapEnd = wrapperCacheMap.end();
     for (JSWrapperCacheMap::const_iterator wrappersMapIter = wrapperCacheMap.begin(); wrappersMapIter != wrappersMapEnd; ++wrappersMapIter) {
-        JSWrapperCache* wrappers = wrappersMapIter->second;
-        removeWrappers(*wrappers);
-        delete wrappers;
+        delete wrappersMapIter->second;
         wrappersMapIter->first->forgetDocument(document);
     }
 }
 
-void forgetWorldOfDOMNodesForDocument(Document* document, DOMWrapperWorld* world)
-{
-    JSWrapperCache* wrappers = document->wrapperCacheMap().take(world);
-    ASSERT(wrappers); // 'world' should only know about 'document' if 'document' knows about 'world'!
-    removeWrappers(*wrappers);
-    delete wrappers;
-}
-
 static inline bool isObservableThroughDOM(JSNode* jsNode, DOMWrapperWorld* world)
 {
     // Certain conditions implicitly make a JS DOM node wrapper observable
@@ -395,14 +252,14 @@ static inline bool isObservableThroughDOM(JSNode* jsNode, DOMWrapperWorld* world
         // the custom markChildren functions rather than here.
         if (node->isElementNode()) {
             if (NamedNodeMap* attributes = static_cast<Element*>(node)->attributeMap()) {
-                if (DOMObject* wrapper = world->m_wrappers.get(attributes)) {
+                if (DOMObject* wrapper = world->m_wrappers.uncheckedGet(attributes)) {
                     if (wrapper->hasCustomProperties())
                         return true;
                 }
             }
             if (node->isStyledElement()) {
                 if (CSSMutableStyleDeclaration* style = static_cast<StyledElement*>(node)->inlineStyleDecl()) {
-                    if (DOMObject* wrapper = world->m_wrappers.get(style)) {
+                    if (DOMObject* wrapper = world->m_wrappers.uncheckedGet(style)) {
                         if (wrapper->hasCustomProperties())
                             return true;
                     }
@@ -410,7 +267,7 @@ static inline bool isObservableThroughDOM(JSNode* jsNode, DOMWrapperWorld* world
             }
             if (static_cast<Element*>(node)->hasTagName(canvasTag)) {
                 if (CanvasRenderingContext* context = static_cast<HTMLCanvasElement*>(node)->renderingContext()) {
-                    if (DOMObject* wrapper = world->m_wrappers.get(context)) {
+                    if (DOMObject* wrapper = world->m_wrappers.uncheckedGet(context)) {
                         if (wrapper->hasCustomProperties())
                             return true;
                     }
@@ -448,8 +305,8 @@ void markDOMNodesForDocument(MarkStack& markStack, Document* document)
         DOMWrapperWorld* world = wrappersIter->first;
         JSWrapperCache* nodeDict = wrappersIter->second;
 
-        JSWrapperCache::iterator nodeEnd = nodeDict->end();
-        for (JSWrapperCache::iterator nodeIt = nodeDict->begin(); nodeIt != nodeEnd; ++nodeIt) {
+        JSWrapperCache::iterator nodeEnd = nodeDict->uncheckedEnd();
+        for (JSWrapperCache::iterator nodeIt = nodeDict->uncheckedBegin(); nodeIt != nodeEnd; ++nodeIt) {
             JSNode* jsNode = nodeIt->second;
             if (isObservableThroughDOM(jsNode, world))
                 markStack.append(jsNode);
@@ -467,8 +324,7 @@ void markActiveObjectsForContext(MarkStack& markStack, JSGlobalData& globalData,
     for (HashMap<ActiveDOMObject*, void*>::const_iterator iter = activeObjects.begin(); iter != activeObjectsEnd; ++iter) {
         if (iter->first->hasPendingActivity()) {
             // Generally, an active object with pending activity must have a wrapper to mark its listeners.
-            // However, some ActiveDOMObjects don't have JS wrappers (timers created by setTimeout is one example).
-            // FIXME: perhaps need to make sure even timers have a markable 'wrapper'.
+            // However, some ActiveDOMObjects don't have JS wrappers.
             markDOMObjectWrapper(markStack, globalData, iter->second);
         }
     }
@@ -491,7 +347,7 @@ static inline void takeWrappers(Node* node, Document* document, WrapperSet& wrap
         JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
         for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
             if (JSNode* wrapper = iter->second->take(node)) {
-                removeWrapper(wrapper);
+                JSDebugWrapperSet::didUncacheWrapper(wrapper);
                 wrapperSet.append(WrapperAndWorld(wrapper, iter->first));
             }
         }
@@ -499,7 +355,7 @@ static inline void takeWrappers(Node* node, Document* document, WrapperSet& wrap
         for (JSGlobalDataWorldIterator worldIter(JSDOMWindow::commonJSGlobalData()); worldIter; ++worldIter) {
             DOMWrapperWorld* world = *worldIter;
             if (JSNode* wrapper = static_cast<JSNode*>(world->m_wrappers.take(node))) {
-                removeWrapper(wrapper);
+                JSDebugWrapperSet::didUncacheWrapper(wrapper);
                 wrapperSet.append(WrapperAndWorld(wrapper, world));
             }
         }
@@ -515,11 +371,11 @@ void updateDOMNodeDocument(Node* node, Document* oldDocument, Document* newDocum
 
     for (unsigned i = 0; i < wrapperSet.size(); ++i) {
         JSNode* wrapper = wrapperSet[i].first;
+        JSDebugWrapperSet::willCacheWrapper(wrapper);
         if (newDocument)
             newDocument->getWrapperCache(wrapperSet[i].second)->set(node, wrapper);
         else
             wrapperSet[i].second->m_wrappers.set(node, wrapper);
-        addWrapper(wrapper);
     }
 }
 
@@ -532,11 +388,65 @@ void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void*
         return;
 
     for (JSGlobalDataWorldIterator worldIter(&globalData); worldIter; ++worldIter) {
-        if (DOMObject* wrapper = worldIter->m_wrappers.get(object))
+        if (DOMObject* wrapper = worldIter->m_wrappers.uncheckedGet(object))
+            markStack.append(wrapper);
+    }
+}
+
+void markDOMNodeWrapper(MarkStack& markStack, Document* document, Node* node)
+{
+    if (document) {
+        JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+        for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
+            if (JSNode* wrapper = iter->second->uncheckedGet(node))
+                markStack.append(wrapper);
+        }
+        return;
+    }
+
+    for (JSGlobalDataWorldIterator worldIter(JSDOMWindow::commonJSGlobalData()); worldIter; ++worldIter) {
+        if (DOMObject* wrapper = worldIter->m_wrappers.uncheckedGet(node))
             markStack.append(wrapper);
     }
 }
 
+static void stringWrapperDestroyed(JSString* str, void* context)
+{
+    StringImpl* cacheKey = static_cast<StringImpl*>(context);
+    JSC::JSGlobalData* globalData = Heap::heap(str)->globalData();
+
+    // Check the normal world first!
+    JSGlobalData::ClientData* clientData = globalData->clientData;
+    ASSERT(clientData);
+    JSStringCache& cache = static_cast<WebCoreJSClientData*>(clientData)->normalWorld()->m_stringCache;
+    if (cache.uncheckedRemove(cacheKey, str)) {
+        cacheKey->deref();
+        return;
+    }
+
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        if (worldIter->m_stringCache.uncheckedRemove(cacheKey, str))
+            break;
+    }
+
+    cacheKey->deref();
+}
+
+JSValue jsStringSlowCase(ExecState* exec, JSStringCache& stringCache, StringImpl* stringImpl)
+{
+    // If there is a stale entry, we have to explicitly remove it to avoid
+    // problems down the line.
+    if (JSString* wrapper = stringCache.uncheckedGet(stringImpl))
+        stringCache.uncheckedRemove(stringImpl, wrapper);
+
+    JSString* wrapper = jsStringWithFinalizer(exec, stringImpl->ustring(), stringWrapperDestroyed, stringImpl);
+    stringCache.set(stringImpl, wrapper);
+    // ref explicitly instead of using a RefPtr-keyed hashtable because the wrapper can
+    // outlive the cache, so the stringImpl has to match the wrapper's lifetime.
+    stringImpl->ref();
+    return wrapper;
+}
+
 JSValue jsStringOrNull(ExecState* exec, const String& s)
 {
     if (s.isNull())
@@ -565,6 +475,11 @@ JSValue jsStringOrFalse(ExecState* exec, const String& s)
     return jsString(exec, s);
 }
 
+JSValue jsString(ExecState* exec, const KURL& url)
+{
+    return jsString(exec, url.string());
+}
+
 JSValue jsStringOrNull(ExecState* exec, const KURL& url)
 {
     if (url.isNull())
@@ -600,6 +515,22 @@ UString valueToStringWithUndefinedOrNullCheck(ExecState* exec, JSValue value)
     return value.toString(exec);
 }
 
+JSValue jsDateOrNull(ExecState* exec, double value)
+{
+    if (!isfinite(value))
+        return jsNull();
+    return new (exec) DateInstance(exec, value);
+}
+
+double valueToDate(ExecState* exec, JSValue value)
+{
+    if (value.isNumber())
+        return value.uncheckedGetNumber();
+    if (!value.inherits(&DateInstance::info))
+        return std::numeric_limits<double>::quiet_NaN();
+    return static_cast<DateInstance*>(value.toObject(exec))->internalNumber();
+}
+
 void reportException(ExecState* exec, JSValue exception)
 {
     UString errorMessage = exception.toString(exec);
@@ -658,7 +589,7 @@ void setDOMException(ExecState* exec, ExceptionCode ec)
             break;
 #if ENABLE(SVG)
         case SVGExceptionType:
-            errorObject = toJS(exec, globalObject, SVGException::create(description).get(), 0);
+            errorObject = toJS(exec, globalObject, SVGException::create(description).get(), 0 /* no context on purpose */);
             break;
 #endif
 #if ENABLE(XPATH)
@@ -728,19 +659,19 @@ Frame* toDynamicFrame(ExecState* exec)
 bool processingUserGesture(ExecState* exec)
 {
     Frame* frame = toDynamicFrame(exec);
-    return frame && frame->script()->processingUserGesture();
+    return frame && frame->script()->processingUserGesture(currentWorld(exec));
 }
 
 KURL completeURL(ExecState* exec, const String& relativeURL)
 {
-    // For histoical reasons, we need to complete the URL using the dynamic frame.
+    // For historical reasons, we need to complete the URL using the dynamic frame.
     Frame* frame = toDynamicFrame(exec);
     if (!frame)
         return KURL();
     return frame->loader()->completeURL(relativeURL);
 }
 
-JSValue objectToStringFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+JSValue objectToStringFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, objectProtoFuncToString);
 }
@@ -804,34 +735,4 @@ JSC::JSObject* toJSSequence(ExecState* exec, JSValue value, unsigned& length)
     return object;
 }
 
-bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDescriptor&, bool)
-{
-    throwError(exec, TypeError, "defineProperty is not supported on DOM Objects");
-    return false;
-}
-
-JSValue DebuggerCallFrame_evaluateInWorld(const JSC::DebuggerCallFrame& debuggerCallFrame, const UString& script, JSValue& exception)
-{
-    EnterDOMWrapperWorld worldEntry(debuggerCallFrame.dynamicGlobalObject()->globalExec(), debuggerWorld());
-    return debuggerCallFrame.evaluate(script, exception);
-}
-
-JSValue callInWorld(ExecState* exec, JSValue function, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args, DOMWrapperWorld* isolatedWorld)
-{
-    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
-    return JSC::call(exec, function, callType, callData, thisValue, args);
-}
-
-JSObject* constructInWorld(ExecState* exec, JSValue object, ConstructType constructType, const ConstructData& constructData, const ArgList& args, DOMWrapperWorld* isolatedWorld)
-{
-    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
-    return JSC::construct(exec, object, constructType, constructData, args);
-}
-
-Completion evaluateInWorld(ExecState* exec, ScopeChain& scopeChain, const SourceCode& sourceCode, JSValue thisValue, DOMWrapperWorld* isolatedWorld)
-{
-    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
-    return JSC::evaluate(exec, scopeChain, sourceCode, thisValue);
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
index ba41d85992..219472b88d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
@@ -23,9 +23,13 @@
 #define JSDOMBinding_h
 
 #include "JSDOMGlobalObject.h"
-#include "Document.h" // For DOMConstructorWithDocument
+#include "JSDOMWrapper.h"
+#include "DOMWrapperWorld.h"
+#include "JSSVGContextCache.h"
+#include "Document.h"
 #include <runtime/Completion.h>
 #include <runtime/Lookup.h>
+#include <runtime/WeakGCMap.h>
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
@@ -42,6 +46,7 @@ namespace WebCore {
     class Node;
     class String;
     class ScriptController;
+    class ScriptCachedFrameData;
 
     typedef int ExceptionCode;
 
@@ -49,60 +54,37 @@ namespace WebCore {
     class SVGElement;
 #endif
 
-    // Base class for all objects in this binding except Window.
-    class DOMObject : public JSC::JSObject {
-    protected:
-        explicit DOMObject(NonNullPassRefPtr<JSC::Structure> structure) 
-            : JSObject(structure)
-        {
-        }
-
-        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, bool);
-
-#ifndef NDEBUG
-        virtual ~DOMObject();
-#endif
-    };
-
     // FIXME: This class should collapse into DOMObject once all DOMObjects are
     // updated to store a globalObject pointer.
     class DOMObjectWithGlobalPointer : public DOMObject {
     public:
-        JSDOMGlobalObject* globalObject() const { return m_globalObject; }
+        JSDOMGlobalObject* globalObject() const { return static_cast<JSDOMGlobalObject*>(getAnonymousValue(GlobalObjectSlot).asCell()); }
 
         ScriptExecutionContext* scriptExecutionContext() const
         {
             // FIXME: Should never be 0, but can be due to bug 27640.
-            return m_globalObject->scriptExecutionContext();
+            return globalObject()->scriptExecutionContext();
         }
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
-        static const unsigned StructureFlags = JSC::OverridesMarkChildren | DOMObject::StructureFlags;
+        static const unsigned AnonymousSlotCount = 1 + DOMObject::AnonymousSlotCount;
+        static const unsigned GlobalObjectSlot = AnonymousSlotCount - 1;
 
         DOMObjectWithGlobalPointer(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObject(structure)
-            , m_globalObject(globalObject)
         {
             // FIXME: This ASSERT is valid, but fires in fast/dom/gc-6.html when trying to create
             // new JavaScript objects on detached windows due to DOMWindow::document()
             // needing to reach through the frame to get to the Document*.  See bug 27640.
             // ASSERT(globalObject->scriptExecutionContext());
+            putAnonymousValue(GlobalObjectSlot, globalObject);
         }
         virtual ~DOMObjectWithGlobalPointer() { }
-
-        void markChildren(JSC::MarkStack& markStack)
-        {
-            DOMObject::markChildren(markStack);
-            markStack.append(m_globalObject);
-        }
-
-    private:
-        JSDOMGlobalObject* m_globalObject;
     };
 
     // Base class for all constructor objects in the JSC bindings.
@@ -110,7 +92,7 @@ namespace WebCore {
     public:
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
@@ -138,121 +120,29 @@ namespace WebCore {
         }
     };
 
-    typedef HashMap<void*, DOMObject*> DOMObjectWrapperMap;
-
-    class DOMWrapperWorld : public RefCounted<DOMWrapperWorld> {
-    public:
-        DOMWrapperWorld(JSC::JSGlobalData*);
-        ~DOMWrapperWorld();
-
-        void rememberDocument(Document* document) { documentsWithWrappers.add(document); }
-        void forgetDocument(Document* document) { documentsWithWrappers.remove(document); }
-        void rememberScriptController(ScriptController* scriptController) { scriptControllersWithShells.add(scriptController); }
-        void forgetScriptController(ScriptController* scriptController) { scriptControllersWithShells.remove(scriptController); }
-
-        // FIXME: can we make this private?
-        DOMObjectWrapperMap m_wrappers;
-
-    private:
-        JSC::JSGlobalData* m_globalData;
-        HashSet<Document*> documentsWithWrappers;
-        HashSet<ScriptController*> scriptControllersWithShells;
-    };
-
-    // Map from static HashTable instances to per-GlobalData ones.
-    class DOMObjectHashTableMap {
-    public:
-        static DOMObjectHashTableMap& mapFor(JSC::JSGlobalData&);
-
-        ~DOMObjectHashTableMap()
-        {
-            HashMap<const JSC::HashTable*, JSC::HashTable>::iterator mapEnd = m_map.end();
-            for (HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.begin(); iter != m_map.end(); ++iter)
-                iter->second.deleteTable();
-        }
-
-        const JSC::HashTable* get(const JSC::HashTable* staticTable)
-        {
-            HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.find(staticTable);
-            if (iter != m_map.end())
-                return &iter->second;
-            return &m_map.set(staticTable, JSC::HashTable(*staticTable)).first->second;
-        }
-
-    private:
-        HashMap<const JSC::HashTable*, JSC::HashTable> m_map;
-    };
-
-    class WebCoreJSClientData : public JSC::JSGlobalData::ClientData {
-        friend class EnterDOMWrapperWorld;
-        friend class JSGlobalDataWorldIterator;
-
-    public:
-        WebCoreJSClientData(JSC::JSGlobalData* globalData)
-            : m_normalWorld(globalData)
-        {
-            m_worldStack.append(&m_normalWorld);
-            m_worldSet.add(&m_normalWorld);
-        }
-        // FIXME: add a destructor to assert m_worldSet only contains m_normalWorld?
-
-        DOMWrapperWorld* currentWorld() { return m_worldStack.last(); }
-        DOMWrapperWorld* normalWorld() { return &m_normalWorld; }
-
-        void rememberWorld(DOMWrapperWorld* world)
-        {
-            ASSERT(!m_worldSet.contains(world));
-            m_worldSet.add(world);
-        }
-        void forgetWorld(DOMWrapperWorld* world)
-        {
-            ASSERT(m_worldSet.contains(world));
-            m_worldSet.remove(world);
-        }
-
-        DOMObjectHashTableMap hashTableMap;
-    private:
-        Vector<DOMWrapperWorld*> m_worldStack;
-        HashSet<DOMWrapperWorld*> m_worldSet;
-        DOMWrapperWorld m_normalWorld;
-    };
-
-    class EnterDOMWrapperWorld {
-    public:
-        EnterDOMWrapperWorld(JSC::JSGlobalData&, DOMWrapperWorld*);
-        EnterDOMWrapperWorld(JSC::ExecState*, DOMWrapperWorld*);
-        ~EnterDOMWrapperWorld();
-
-    private:
-        WebCoreJSClientData* m_clientData;
-    };
-
-    DOMObject* getCachedDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle);
-    void cacheDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle, DOMObject* wrapper);
-    void forgetDOMNode(DOMObject* wrapper, Node* node, Document* document);
+    DOMObject* getCachedDOMObjectWrapper(JSC::ExecState*, void* objectHandle);
+    bool hasCachedDOMObjectWrapper(JSC::JSGlobalData*, void* objectHandle);
+    void cacheDOMObjectWrapper(JSC::ExecState*, void* objectHandle, DOMObject* wrapper);
+    void forgetDOMNode(JSNode* wrapper, Node* node, Document* document);
     void forgetDOMObject(DOMObject* wrapper, void* objectHandle);
 
-    JSNode* getCachedDOMNodeWrapper(Document*, Node*);
-    void cacheDOMNodeWrapper(Document*, Node*, JSNode* wrapper);
+    JSNode* getCachedDOMNodeWrapper(JSC::ExecState*, Document*, Node*);
+    void cacheDOMNodeWrapper(JSC::ExecState*, Document*, Node*, JSNode* wrapper);
     void forgetAllDOMNodesForDocument(Document*);
-    void forgetWorldOfDOMNodesForDocument(Document*, DOMWrapperWorld*);
     void updateDOMNodeDocument(Node*, Document* oldDocument, Document* newDocument);
+
     void markDOMNodesForDocument(JSC::MarkStack&, Document*);
     void markActiveObjectsForContext(JSC::MarkStack&, JSC::JSGlobalData&, ScriptExecutionContext*);
     void markDOMObjectWrapper(JSC::MarkStack&, JSC::JSGlobalData& globalData, void* object);
+    void markDOMNodeWrapper(JSC::MarkStack& markStack, Document* document, Node* node);
+    bool hasCachedDOMObjectWrapperUnchecked(JSC::JSGlobalData*, void* objectHandle);
+    bool hasCachedDOMNodeWrapperUnchecked(Document*, Node*);
 
     JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
     JSC::Structure* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSC::ExecState*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
 
-    DOMWrapperWorld* currentWorld(JSC::ExecState*);
-    DOMWrapperWorld* normalWorld(JSC::JSGlobalData&);
-    DOMWrapperWorld* mainThreadCurrentWorld();
-    DOMWrapperWorld* mainThreadNormalWorld();
-    inline DOMWrapperWorld* debuggerWorld() { return mainThreadNormalWorld(); }
-    inline DOMWrapperWorld* pluginWorld() { return mainThreadNormalWorld(); }
-
     JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
     void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
 
@@ -283,17 +173,17 @@ namespace WebCore {
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object)
     {
         ASSERT(object);
-        ASSERT(!getCachedDOMObjectWrapper(exec->globalData(), object));
+        ASSERT(!getCachedDOMObjectWrapper(exec, object));
         // FIXME: new (exec) could use a different globalData than the globalData this wrapper is cached on.
         WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, object);
-        cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
+        cacheDOMObjectWrapper(exec, object, wrapper);
         return wrapper;
     }
     template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object)
     {
         if (!object)
             return JSC::jsNull();
-        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object))
             return wrapper;
         return createDOMObjectWrapper<WrapperClass>(exec, globalObject, object);
     }
@@ -302,19 +192,21 @@ namespace WebCore {
     #define CREATE_SVG_OBJECT_WRAPPER(exec, globalObject, className, object, context) createDOMObjectWrapper<JS##className>(exec, globalObject, static_cast<className*>(object), context)
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object, SVGElement* context)
     {
-        ASSERT(object);
-        ASSERT(!getCachedDOMObjectWrapper(exec->globalData(), object));
-        WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, object, context);
-        cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
+        DOMObject* wrapper = createDOMObjectWrapper<WrapperClass, DOMClass>(exec, globalObject, object);
+        ASSERT(wrapper);
+        if (context)
+            JSSVGContextCache::addWrapper(wrapper, context);
         return wrapper;
     }
     template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object, SVGElement* context)
     {
         if (!object)
             return JSC::jsNull();
-        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object)) {
+            ASSERT(JSSVGContextCache::svgContextForDOMObject(wrapper) == context);
             return wrapper;
-        return createDOMObjectWrapper<WrapperClass>(exec, globalObject, object, context);
+        }
+        return createDOMObjectWrapper<WrapperClass, DOMClass>(exec, globalObject, object, context);
     }
 #endif
 
@@ -322,18 +214,18 @@ namespace WebCore {
     template<class WrapperClass, class DOMClass> inline JSNode* createDOMNodeWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* node)
     {
         ASSERT(node);
-        ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
+        ASSERT(!getCachedDOMNodeWrapper(exec, node->document(), node));
         WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, node);
         // FIXME: The entire function can be removed, once we fix caching.
         // This function is a one-off hack to make Nodes cache in the right global object.
-        cacheDOMNodeWrapper(node->document(), node, wrapper);
+        cacheDOMNodeWrapper(exec, node->document(), node, wrapper);
         return wrapper;
     }
     template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMNodeWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* node)
     {
         if (!node)
             return JSC::jsNull();
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(node->document(), node))
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(exec, node->document(), node))
             return wrapper;
         return createDOMNodeWrapper<WrapperClass>(exec, globalObject, node);
     }
@@ -346,6 +238,14 @@ namespace WebCore {
     // Convert a DOM implementation exception code into a JavaScript exception in the execution state.
     void setDOMException(JSC::ExecState*, ExceptionCode);
 
+    JSC::JSValue jsString(JSC::ExecState*, const String&); // empty if the string is null
+    JSC::JSValue jsStringSlowCase(JSC::ExecState*, JSStringCache&, StringImpl*);
+    JSC::JSValue jsString(JSC::ExecState*, const KURL&); // empty if the URL is null
+    inline JSC::JSValue jsString(JSC::ExecState* exec, const AtomicString& s)
+    { 
+        return jsString(exec, s.string());
+    }
+        
     JSC::JSValue jsStringOrNull(JSC::ExecState*, const String&); // null if the string is null
     JSC::JSValue jsStringOrNull(JSC::ExecState*, const KURL&); // null if the URL is null
 
@@ -362,6 +262,11 @@ namespace WebCore {
     JSC::UString valueToStringWithNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null
     JSC::UString valueToStringWithUndefinedOrNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null or undefined
 
+    // Returns a Date instance for the specified value, or null if the value is NaN or infinity.
+    JSC::JSValue jsDateOrNull(JSC::ExecState*, double);
+    // NaN if the value can't be converted to a date.
+    double valueToDate(JSC::ExecState*, JSC::JSValue);
+
     // FIXME: These are a stop-gap until all toJS calls can be converted to pass a globalObject
     template <typename T>
     inline JSC::JSValue toJS(JSC::ExecState* exec, T* ptr)
@@ -397,17 +302,33 @@ namespace WebCore {
     bool allowsAccessFromFrame(JSC::ExecState*, Frame*, String& message);
     bool shouldAllowNavigation(JSC::ExecState*, Frame*);
     void printErrorMessageForFrame(Frame*, const String& message);
-    JSC::JSValue objectToStringFunctionGetter(JSC::ExecState*, const JSC::Identifier& propertyName, const JSC::PropertySlot&);
+    JSC::JSValue objectToStringFunctionGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier& propertyName);
 
     Frame* toLexicalFrame(JSC::ExecState*);
     Frame* toDynamicFrame(JSC::ExecState*);
     bool processingUserGesture(JSC::ExecState*);
     KURL completeURL(JSC::ExecState*, const String& relativeURL);
+    
+    inline JSC::JSValue jsString(JSC::ExecState* exec, const String& s)
+    {
+        StringImpl* stringImpl = s.impl();
+        if (!stringImpl || !stringImpl->length())
+            return jsEmptyString(exec);
 
-    JSC::JSValue DebuggerCallFrame_evaluateInWorld(const JSC::DebuggerCallFrame& debuggerCallFrame, const JSC::UString& script, JSC::JSValue& exception);
-    JSC::JSValue callInWorld(JSC::ExecState*, JSC::JSValue function, JSC::CallType, const JSC::CallData&, JSC::JSValue thisValue, const JSC::ArgList&, DOMWrapperWorld*);
-    JSC::JSObject* constructInWorld(JSC::ExecState* exec, JSC::JSValue object, JSC::ConstructType constructType, const JSC::ConstructData& constructData, const JSC::ArgList& args, DOMWrapperWorld*);
-    JSC::Completion evaluateInWorld(JSC::ExecState*, JSC::ScopeChain&, const JSC::SourceCode&, JSC::JSValue thisValue, DOMWrapperWorld*);
+        if (stringImpl->length() == 1 && stringImpl->characters()[0] <= 0xFF)
+            return jsString(exec, stringImpl->ustring());
+
+        JSStringCache& stringCache = currentWorld(exec)->m_stringCache;
+        if (JSC::JSString* wrapper = stringCache.get(stringImpl))
+            return wrapper;
+
+        return jsStringSlowCase(exec, stringCache, stringImpl);
+    }
+
+    inline DOMObjectWrapperMap& domObjectWrapperMapFor(JSC::ExecState* exec)
+    {
+        return currentWorld(exec)->m_wrappers;
+    }
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMFormDataCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMFormDataCustom.cpp
new file mode 100644
index 0000000000..222cbcc6d0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMFormDataCustom.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDOMFormData.h"
+
+#include "DOMFormData.h"
+#include "JSBlob.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSDOMFormData::append(ExecState* exec, const ArgList& args)
+{
+    if (args.size() >= 2) {
+        String name = args.at(0).toString(exec);
+        JSValue value = args.at(1);
+        if (value.inherits(&JSBlob::s_info))
+            impl()->append(name, toBlob(value));
+        else
+            impl()->append(name, value.toString(exec));
+    }
+
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
index 011a4e4c91..e0b5b891d4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -40,6 +40,8 @@ using namespace JSC;
 
 namespace WebCore {
 
+const ClassInfo JSDOMGlobalObject::s_info = { "DOMGlobalObject", 0, 0, 0 };
+
 JSDOMGlobalObject::JSDOMGlobalObject(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject::JSDOMGlobalObjectData* data, JSObject* thisValue)
     : JSGlobalObject(structure, data, thisValue)
 {
@@ -56,14 +58,9 @@ void JSDOMGlobalObject::markChildren(MarkStack& markStack)
     JSDOMConstructorMap::iterator end2 = constructors().end();
     for (JSDOMConstructorMap::iterator it2 = constructors().begin(); it2 != end2; ++it2)
         markStack.append(it2->second);
-}
 
-PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JSValue val)
-{
-    if (!val.isObject())
-        return 0;
-
-    return JSEventListener::create(asObject(val), true, currentWorld(globalExec())).get();
+    if (d()->m_injectedScript)
+        markStack.append(d()->m_injectedScript);
 }
 
 void JSDOMGlobalObject::setCurrentEvent(Event* evt)
@@ -76,6 +73,16 @@ Event* JSDOMGlobalObject::currentEvent() const
     return d()->evt;
 }
 
+void JSDOMGlobalObject::setInjectedScript(JSObject* injectedScript)
+{
+    d()->m_injectedScript = injectedScript;
+}
+
+JSObject* JSDOMGlobalObject::injectedScript() const
+{
+    return d()->m_injectedScript;
+}
+
 void JSDOMGlobalObject::destroyJSDOMGlobalObjectData(void* jsDOMGlobalObjectData)
 {
     delete static_cast<JSDOMGlobalObjectData*>(jsDOMGlobalObjectData);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
index 6b75a6f6d0..8eb55c1484 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -54,29 +54,29 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
-        // Creates a JS EventListener for an "onXXX" event attribute. These
-        // listeners cannot be removed through the removeEventListener API.
-        PassRefPtr<JSEventListener> createJSAttributeEventListener(JSC::JSValue);
-
         // Make binding code generation easier.
         JSDOMGlobalObject* globalObject() { return this; }
 
         void setCurrentEvent(Event*);
         Event* currentEvent() const;
 
+        void setInjectedScript(JSObject*);
+        JSObject* injectedScript() const;
+
         virtual void markChildren(JSC::MarkStack&);
 
+        DOMWrapperWorld* world() { return d()->m_world.get(); }
+
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+        static const JSC::ClassInfo s_info;
+
     protected:
         struct JSDOMGlobalObjectData : public JSC::JSGlobalObject::JSGlobalObjectData {
-            JSDOMGlobalObjectData()
-                : JSGlobalObjectData(destroyJSDOMGlobalObjectData)
-                , evt(0)
-            {
-            }
-
-            JSDOMGlobalObjectData(Destructor destructor)
+            JSDOMGlobalObjectData(DOMWrapperWorld* world, Destructor destructor = destroyJSDOMGlobalObjectData)
                 : JSGlobalObjectData(destructor)
                 , evt(0)
+                , m_world(world)
+                , m_injectedScript(0)
             {
             }
 
@@ -84,6 +84,8 @@ namespace WebCore {
             JSDOMConstructorMap constructors;
 
             Event* evt;
+            RefPtr<DOMWrapperWorld> m_world;
+            JSObject* m_injectedScript;
         };
 
     private:
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
index 86ff149bb4..c25a70adbb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -24,6 +24,7 @@
 #include "JSDOMWindowBase.h"
 
 #include "CString.h"
+#include "Chrome.h"
 #include "Console.h"
 #include "DOMWindow.h"
 #include "Frame.h"
@@ -35,12 +36,20 @@
 #include "ScriptController.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
+#include "WebCoreJSClientData.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, 0, 0 };
+const ClassInfo JSDOMWindowBase::s_info = { "Window", &JSDOMGlobalObject::s_info, 0, 0 };
+
+JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+    : JSDOMGlobalObjectData(shell->world(), destroyJSDOMWindowBaseData)
+    , impl(window)
+    , shell(shell)
+{
+}
 
 JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
@@ -53,11 +62,10 @@ JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRef
     addStaticGlobals(staticGlobals, sizeof(staticGlobals) / sizeof(GlobalPropertyInfo));
 }
 
-void JSDOMWindowBase::updateDocument(DOMWrapperWorld* world)
+void JSDOMWindowBase::updateDocument()
 {
     ASSERT(d()->impl->document());
     ExecState* exec = globalExec();
-    EnterDOMWrapperWorld worldEntry(exec, world);
     symbolTablePutWithAttributes(Identifier(exec, "document"), toJS(exec, this, d()->impl->document()), DontDelete | ReadOnly);
 }
 
@@ -69,7 +77,7 @@ ScriptExecutionContext* JSDOMWindowBase::scriptExecutionContext() const
 String JSDOMWindowBase::crossDomainAccessErrorMessage(const JSGlobalObject* other) const
 {
     KURL originURL = asJSDOMWindow(other)->impl()->url();
-    KURL targetURL = impl()->frame()->document()->url();
+    KURL targetURL = d()->shell->window()->impl()->url();
     if (originURL.isNull() || targetURL.isNull())
         return String();
 
@@ -164,7 +172,7 @@ void JSDOMWindowBase::destroyJSDOMWindowBaseData(void* jsDOMWindowBaseData)
     delete static_cast<JSDOMWindowBaseData*>(jsDOMWindowBaseData);
 }
 
-// JSDOMGlobalObject* is ignored, accesing a window in any context will
+// JSDOMGlobalObject* is ignored, accessing a window in any context will
 // use that DOMWindow's prototype chain.
 JSValue toJS(ExecState* exec, JSDOMGlobalObject*, DOMWindow* domWindow)
 {
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
index 31e24868fe..272699633e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
@@ -47,7 +47,7 @@ namespace WebCore {
         JSDOMWindowBase(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
     public:
-        void updateDocument(DOMWrapperWorld*);
+        void updateDocument();
 
         DOMWindow* impl() const { return d()->impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
@@ -77,12 +77,7 @@ namespace WebCore {
 
     private:
         struct JSDOMWindowBaseData : public JSDOMGlobalObjectData {
-            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
-                : JSDOMGlobalObjectData(destroyJSDOMWindowBaseData)
-                , impl(window)
-                , shell(shell)
-            {
-            }
+            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell);
 
             RefPtr<DOMWindow> impl;
             JSDOMWindowShell* shell;
@@ -97,7 +92,7 @@ namespace WebCore {
     };
 
     // Returns a JSDOMWindow or jsNull()
-    // JSDOMGlobalObject* is ignored, accesing a window in any context will
+    // JSDOMGlobalObject* is ignored, accessing a window in any context will
     // use that DOMWindow's prototype chain.
     JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DOMWindow*);
     JSC::JSValue toJS(JSC::ExecState*, DOMWindow*);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 2804b3ce65..e8c2781e32 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -21,7 +21,8 @@
 #include "JSDOMWindowCustom.h"
 
 #include "AtomicString.h"
-#include "Base64.h"
+#include "Chrome.h"
+#include "Database.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "ExceptionCode.h"
@@ -35,6 +36,8 @@
 #include "HTMLDocument.h"
 #include "History.h"
 #include "JSAudioConstructor.h"
+#include "JSDatabase.h"
+#include "JSDatabaseCallback.h"
 #include "JSDOMWindowShell.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
@@ -53,14 +56,14 @@
 #endif
 
 #if ENABLE(3D_CANVAS)
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasByteArrayConstructor.h"
-#include "JSCanvasUnsignedByteArrayConstructor.h"
-#include "JSCanvasIntArrayConstructor.h"
-#include "JSCanvasUnsignedIntArrayConstructor.h"
-#include "JSCanvasShortArrayConstructor.h"
-#include "JSCanvasUnsignedShortArrayConstructor.h"
-#include "JSCanvasFloatArrayConstructor.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLByteArrayConstructor.h"
+#include "JSWebGLUnsignedByteArrayConstructor.h"
+#include "JSWebGLIntArrayConstructor.h"
+#include "JSWebGLUnsignedIntArrayConstructor.h"
+#include "JSWebGLShortArrayConstructor.h"
+#include "JSWebGLUnsignedShortArrayConstructor.h"
+#include "JSWebGLFloatArrayConstructor.h"
 #endif
 #include "JSWebKitCSSMatrixConstructor.h"
 #include "JSWebKitPointConstructor.h"
@@ -96,7 +99,7 @@ void JSDOMWindow::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    impl()->markEventListeners(markStack);
+    impl()->markJSEventListeners(markStack);
 
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
@@ -112,6 +115,7 @@ void JSDOMWindow::markChildren(MarkStack& markStack)
     markDOMObjectWrapper(markStack, globalData, impl()->optionalStatusbar());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalToolbar());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalLocation());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalMedia());
 #if ENABLE(DOM_STORAGE)
     markDOMObjectWrapper(markStack, globalData, impl()->optionalSessionStorage());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalLocalStorage());
@@ -122,24 +126,24 @@ void JSDOMWindow::markChildren(MarkStack& markStack)
 }
 
 template<NativeFunction nativeFunction, int length>
-JSValue nonCachingStaticFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+JSValue nonCachingStaticFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), length, propertyName, nativeFunction);
 }
 
-static JSValue childFrameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+static JSValue childFrameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(AtomicString(propertyName))->domWindow());
+    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->child(AtomicString(propertyName))->domWindow());
 }
 
-static JSValue indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+static JSValue indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(slot.index())->domWindow());
+    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->child(index)->domWindow());
 }
 
-static JSValue namedItemGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+static JSValue namedItemGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSDOMWindowBase* thisObj = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindowBase* thisObj = static_cast<JSDOMWindow*>(asObject(slotBase));
     Document* document = thisObj->impl()->frame()->document();
 
     ASSERT(thisObj->allowsAccessFrom(exec));
@@ -265,7 +269,7 @@ bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& property
         }
     }
 
-    // FIXME: Search the whole frame hierachy somewhere around here.
+    // FIXME: Search the whole frame hierarchy somewhere around here.
     // We need to test the correct priority order.
 
     // allow window[1] or parent[1] etc. (#56983)
@@ -297,10 +301,10 @@ bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& property
 
 bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    // When accessing a Window cross-domain, functions are always the native built-in ones, and they
-    // are not affected by properties changed on the Window or anything in its prototype chain.
-    // This is consistent with the behavior of Firefox.
-    
+    // Never allow cross-domain getOwnPropertyDescriptor
+    if (!allowsAccessFrom(exec))
+        return false;
+
     const HashEntry* entry;
     
     // We don't want any properties other than "close" and "closed" on a closed window.
@@ -323,65 +327,6 @@ bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
         return true;
     }
 
-    String errorMessage;
-    bool allowsAccess = allowsAccessFrom(exec, errorMessage);
-    if (allowsAccess && JSGlobalObject::getOwnPropertyDescriptor(exec, propertyName, descriptor))
-        return true;
-
-    // We need this code here because otherwise JSDOMWindowBase will stop the search before we even get to the
-    // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
-    // Also, it's important to get the implementation straight out of the DOMWindow prototype regardless of
-    // what prototype is actually set on this object.
-    entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & Function) {
-            if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
-                if (!DOMWindow::canShowModalDialog(impl()->frame())) {
-                    descriptor.setUndefined();
-                    return true;
-                }
-            }
-        }
-    } else {
-        // Allow access to toString() cross-domain, but always Object.prototype.toString.
-        if (propertyName == exec->propertyNames().toString) {
-            if (!allowsAccess) {
-                PropertySlot slot;
-                slot.setCustom(this, objectToStringFunctionGetter);
-                descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                return true;
-            }
-        }
-    }
-    
     entry = JSDOMWindow::s_info.propHashTable(exec)->entry(exec, propertyName);
     if (entry) {
         PropertySlot slot;
@@ -402,19 +347,6 @@ bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
         return true;
     }
     
-    // Do prototype lookup early so that functions and attributes in the prototype can have
-    // precedence over the index and name getters.  
-    JSValue proto = prototype();
-    if (proto.isObject()) {
-        if (asObject(proto)->getPropertyDescriptor(exec, propertyName, descriptor)) {
-            if (!allowsAccess) {
-                printErrorMessage(errorMessage);
-                descriptor.setUndefined();
-            }
-            return true;
-        }
-    }
-
     bool ok;
     unsigned i = propertyName.toArrayIndex(&ok);
     if (ok && i < impl()->frame()->tree()->childCount()) {
@@ -466,28 +398,20 @@ bool JSDOMWindow::deleteProperty(ExecState* exec, const Identifier& propertyName
     return Base::deleteProperty(exec, propertyName);
 }
 
-void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Only allow the window to enumerated by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
-    Base::getPropertyNames(exec, propertyNames);
+    Base::getPropertyNames(exec, propertyNames, mode);
 }
 
-void JSDOMWindow::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSDOMWindow::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Only allow the window to enumerated by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
-    Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    // Only allow getting property attributes properties by frames in the same origin.
-    if (!allowsAccessFrom(exec))
-        return false;
-    return Base::getPropertyAttributes(exec, propertyName, attributes);
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
@@ -540,24 +464,24 @@ JSValue JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& propertyNam
 JSValue JSDOMWindow::history(ExecState* exec) const
 {
     History* history = impl()->history();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), history))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, history))
         return wrapper;
 
     JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
     JSHistory* jsHistory = new (exec) JSHistory(getDOMStructure<JSHistory>(exec, window), window, history);
-    cacheDOMObjectWrapper(exec->globalData(), history, jsHistory);
+    cacheDOMObjectWrapper(exec, history, jsHistory);
     return jsHistory;
 }
 
 JSValue JSDOMWindow::location(ExecState* exec) const
 {
     Location* location = impl()->location();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, location))
         return wrapper;
 
     JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
     JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, window), window, location);
-    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    cacheDOMObjectWrapper(exec, location, jsLocation);
     return jsLocation;
 }
 
@@ -645,44 +569,44 @@ JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
 }
  
 #if ENABLE(3D_CANVAS)
-JSValue JSDOMWindow::canvasArrayBuffer(ExecState* exec) const
+JSValue JSDOMWindow::webGLArrayBuffer(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasArrayBufferConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLArrayBufferConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasByteArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLByteArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasByteArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLByteArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasUnsignedByteArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLUnsignedByteArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasUnsignedByteArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLUnsignedByteArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasIntArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLIntArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasIntArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLIntArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasUnsignedIntArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLUnsignedIntArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasUnsignedIntArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLUnsignedIntArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasShortArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLShortArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasShortArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLShortArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasUnsignedShortArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLUnsignedShortArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasUnsignedShortArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLUnsignedShortArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasFloatArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLFloatArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasFloatArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLFloatArrayConstructor>(exec, this);
 }
 #endif
  
@@ -744,6 +668,12 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
     ASSERT(lexicalFrame);
     ASSERT(dynamicFrame);
 
+    if (Document* lexicalDocument = lexicalFrame->document()) {
+        // Sandboxed iframes cannot open new auxiliary browsing contexts.
+        if (lexicalDocument->securityOrigin()->isSandboxed(SandboxNavigation))
+            return 0;
+    }
+
     ResourceRequest request;
 
     // For whatever reason, Firefox uses the dynamicGlobalObject to determine
@@ -790,6 +720,14 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
     return newFrame;
 }
 
+static bool domWindowAllowPopUp(Frame* activeFrame, ExecState* exec)
+{
+    ASSERT(activeFrame);
+    if (activeFrame->script()->processingUserGesture(currentWorld(exec)))
+        return true;
+    return DOMWindow::allowPopUp(activeFrame);
+}
+
 JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 {
     String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
@@ -810,7 +748,7 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 
     // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
     // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
-    if (!DOMWindow::allowPopUp(dynamicFrame) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
+    if (!domWindowAllowPopUp(dynamicFrame, exec) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
         return jsUndefined();
 
     // Get the target frame for the special cases of _top and _parent.  In those
@@ -880,7 +818,7 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
     if (!dynamicFrame)
         return jsUndefined();
 
-    if (!DOMWindow::canShowModalDialogNow(frame) || !DOMWindow::allowPopUp(dynamicFrame))
+    if (!DOMWindow::canShowModalDialogNow(frame) || !domWindowAllowPopUp(dynamicFrame, exec))
         return jsUndefined();
 
     HashMap<String, String> features;
@@ -976,71 +914,30 @@ JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
 
 JSValue JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
-    return jsNumber(exec, impl()->setTimeout(action, delay));
+
+    ExceptionCode ec = 0;
+    int result = impl()->setTimeout(action.release(), delay, ec);
+    setDOMException(exec, ec);
+
+    return jsNumber(exec, result);
 }
 
 JSValue JSDOMWindow::setInterval(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
-    return jsNumber(exec, impl()->setInterval(action, delay));
-}
 
-JSValue JSDOMWindow::atob(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return throwError(exec, SyntaxError, "Not enough arguments");
-
-    JSValue v = args.at(0);
-    if (v.isNull())
-        return jsEmptyString(exec);
-
-    UString s = v.toString(exec);
-    if (!s.is8Bit()) {
-        setDOMException(exec, INVALID_CHARACTER_ERR);
-        return jsUndefined();
-    }
-
-    Vector<char> in(s.size());
-    for (int i = 0; i < s.size(); ++i)
-        in[i] = static_cast<char>(s.data()[i]);
-    Vector<char> out;
-
-    if (!base64Decode(in, out))
-        return throwError(exec, GeneralError, "Cannot decode base64");
-
-    return jsString(exec, String(out.data(), out.size()));
-}
-
-JSValue JSDOMWindow::btoa(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return throwError(exec, SyntaxError, "Not enough arguments");
-
-    JSValue v = args.at(0);
-    if (v.isNull())
-        return jsEmptyString(exec);
-
-    UString s = v.toString(exec);
-    if (!s.is8Bit()) {
-        setDOMException(exec, INVALID_CHARACTER_ERR);
-        return jsUndefined();
-    }
-
-    Vector<char> in(s.size());
-    for (int i = 0; i < s.size(); ++i)
-        in[i] = static_cast<char>(s.data()[i]);
-    Vector<char> out;
-
-    base64Encode(in, out);
+    ExceptionCode ec = 0;
+    int result = impl()->setInterval(action.release(), delay, ec);
+    setDOMException(exec, ec);
 
-    return jsString(exec, String(out.data(), out.size()));
+    return jsNumber(exec, result);
 }
 
 JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
@@ -1053,7 +950,7 @@ JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -1067,10 +964,30 @@ JSValue JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
+#if ENABLE(DATABASE)
+JSValue JSDOMWindow::openDatabase(ExecState* exec, const ArgList& args)
+{
+    if (!allowsAccessFrom(exec) || (args.size() < 4))
+        return jsUndefined();
+    ExceptionCode ec = 0;
+    const UString& name = args.at(0).toString(exec);
+    const UString& version = args.at(1).toString(exec);
+    const UString& displayName = args.at(2).toString(exec);
+    unsigned long estimatedSize = args.at(3).toInt32(exec);
+    RefPtr<DatabaseCallback> creationCallback;
+    if ((args.size() >= 5) && args.at(4).isObject())
+        creationCallback = JSDatabaseCallback::create(asObject(args.at(4)), globalObject());
+
+    JSValue result = toJS(exec, globalObject(), WTF::getPtr(impl()->openDatabase(name, version, displayName, estimatedSize, creationCallback.release(), ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+#endif
+
 DOMWindow* toDOMWindow(JSValue value)
 {
     if (!value.isObject())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
index 9072f91bc3..1e82a493d2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -43,9 +43,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindowShell);
 
 const ClassInfo JSDOMWindowShell::s_info = { "JSDOMWindowShell", 0, 0, 0 };
 
-JSDOMWindowShell::JSDOMWindowShell(PassRefPtr<DOMWindow> window)
+JSDOMWindowShell::JSDOMWindowShell(PassRefPtr<DOMWindow> window, DOMWrapperWorld* world)
     : Base(JSDOMWindowShell::createStructure(jsNull()))
     , m_window(0)
+    , m_world(world)
 {
     setWindow(window);
 }
@@ -113,19 +114,14 @@ bool JSDOMWindowShell::deleteProperty(ExecState* exec, const Identifier& propert
     return m_window->deleteProperty(exec, propertyName);
 }
 
-void JSDOMWindowShell::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSDOMWindowShell::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    m_window->getPropertyNames(exec, propertyNames);
+    m_window->getPropertyNames(exec, propertyNames, mode);
 }
 
-void JSDOMWindowShell::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSDOMWindowShell::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    m_window->getOwnPropertyNames(exec, propertyNames);
-}
-
-bool JSDOMWindowShell::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    return m_window->getPropertyAttributes(exec, propertyName, attributes);
+    m_window->getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 void JSDOMWindowShell::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
index 36cb8d6ad6..1b986b8dd7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
@@ -40,7 +40,7 @@ namespace WebCore {
     class JSDOMWindowShell : public DOMObject {
         typedef DOMObject Base;
     public:
-        JSDOMWindowShell(PassRefPtr<DOMWindow>);
+        JSDOMWindowShell(PassRefPtr<DOMWindow>, DOMWrapperWorld* world);
         virtual ~JSDOMWindowShell();
 
         JSDOMWindow* window() const { return m_window; }
@@ -60,9 +60,11 @@ namespace WebCore {
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype) 
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
+        DOMWrapperWorld* world() { return m_world.get(); }
+
     private:
         static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | DOMObject::StructureFlags;
 
@@ -73,9 +75,8 @@ namespace WebCore {
         virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, unsigned attributes);
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName);
-        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-        virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
+        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
         virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
         virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction, unsigned attributes);
         virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
@@ -85,6 +86,7 @@ namespace WebCore {
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
         JSDOMWindow* m_window;
+        RefPtr<DOMWrapperWorld> m_world;
     };
 
     JSC::JSValue toJS(JSC::ExecState*, Frame*);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.cpp
new file mode 100644
index 0000000000..3fcdcc18dc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDOMWrapper.h"
+
+#include "JSDebugWrapperSet.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+#ifndef NDEBUG
+
+DOMObject::~DOMObject()
+{
+    ASSERT(!JSDebugWrapperSet::shared().contains(this));
+}
+
+#endif
+
+bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDescriptor&, bool)
+{
+    throwError(exec, TypeError, "defineProperty is not supported on DOM Objects");
+    return false;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.h
new file mode 100644
index 0000000000..00594cf0b6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.h
@@ -0,0 +1,46 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *  Copyright (C) 2009 Google, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JSDOMWrapper_h
+#define JSDOMWrapper_h
+
+#include <runtime/JSObject.h>
+
+namespace WebCore {
+
+// Base class for all objects in this binding except Window.
+class DOMObject : public JSC::JSObject {
+protected:
+    explicit DOMObject(NonNullPassRefPtr<JSC::Structure> structure) 
+        : JSObject(structure)
+    {
+    }
+
+    virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, bool);
+
+#ifndef NDEBUG
+    virtual ~DOMObject();
+#endif
+};
+
+} // namespace WebCore
+
+#endif // JSDOMWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
index 91b3d1546c..9a6982a452 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
@@ -43,9 +43,9 @@ bool JSDataGridColumnList::canGetItemsForName(ExecState*, DataGridColumnList* im
     return impl->itemWithName(propertyName);
 }
 
-JSValue JSDataGridColumnList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSDataGridColumnList::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slotBase));
     return toJS(exec, thisObj->globalObject(), thisObj->impl()->itemWithName(propertyName));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.cpp
new file mode 100644
index 0000000000..c75a6e53b7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDatabaseCallback.h"
+
+#if ENABLE(DATABASE)
+
+#include "Frame.h"
+#include "JSDatabase.h"
+#include "ScriptController.h"
+#include "ScriptExecutionContext.h"
+#include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+JSDatabaseCallback::JSDatabaseCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
+    , m_isolatedWorld(DOMWrapperWorld::create(globalObject->globalData(), true))
+{
+}
+
+JSDatabaseCallback::~JSDatabaseCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
+
+void JSDatabaseCallback::handleEvent(ScriptExecutionContext* context, Database* database)
+{
+    ASSERT(m_data);
+    ASSERT(context);
+
+    RefPtr<JSDatabaseCallback> protect(this);
+
+    JSC::JSLock lock(SilenceAssertionsOnly);
+
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(context, m_isolatedWorld.get());
+    if (!globalObject)
+        return;
+
+    ExecState* exec = globalObject->globalExec();
+    MarkedArgumentBuffer args;
+    args.append(toJS(exec, database));
+
+    bool ignored;
+    m_data->invokeCallback(args, &ignored);
+}
+
+}
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.h
new file mode 100644
index 0000000000..2f9234e20a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSDatabaseCallback_h
+#define JSDatabaseCallback_h
+
+#if ENABLE(DATABASE)
+
+#include "DatabaseCallback.h"
+#include "JSCallbackData.h"
+
+namespace WebCore {
+
+class ScriptExecutionContext;
+
+class JSDatabaseCallback : public DatabaseCallback {
+public:
+    static PassRefPtr<JSDatabaseCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSDatabaseCallback(callback, globalObject));
+    }
+
+    virtual ~JSDatabaseCallback();
+
+    virtual void handleEvent(ScriptExecutionContext*, Database*);
+
+private:
+    JSDatabaseCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
+
+    JSCallbackData* m_data;
+    RefPtr<DOMWrapperWorld> m_isolatedWorld;
+};
+
+}
+
+#endif // ENABLE(DATABASE)
+
+#endif // JSDatabaseCallback_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.cpp
new file mode 100644
index 0000000000..b0d6ca9a1f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDebugWrapperSet.h"
+
+#include <wtf/StdLibExtras.h>
+
+#if ENABLE(WORKERS)
+#include <wtf/ThreadSpecific.h>
+#endif
+
+namespace WebCore {
+
+JSDebugWrapperSet& JSDebugWrapperSet::shared()
+{
+#if ENABLE(WORKERS)
+    DEFINE_STATIC_LOCAL(WTF::ThreadSpecific<JSDebugWrapperSet>, staticWrapperSet, ());
+    return *staticWrapperSet;
+#else
+    DEFINE_STATIC_LOCAL(JSDebugWrapperSet, staticWrapperSet, ());
+    return staticWrapperSet;
+#endif
+}
+
+JSDebugWrapperSet::JSDebugWrapperSet()
+{
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.h
new file mode 100644
index 0000000000..94b6f78fcf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSDebugWrapperSet_h
+#define JSDebugWrapperSet_h
+
+#include "JSDOMWrapper.h"
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+// For debugging, keep a set of wrappers currently cached, and check that
+// all are uncached before they are destroyed. This helps us catch bugs like:
+//     - wrappers being deleted without being removed from the cache
+//     - wrappers being cached twice
+
+class JSDebugWrapperSet : public Noncopyable {
+    friend class WTF::ThreadSpecific<JSDebugWrapperSet>;
+public:
+    static JSDebugWrapperSet& shared();
+
+    void add(DOMObject* object) { m_wrapperSet.add(object); }
+    void remove(DOMObject* object) { m_wrapperSet.remove(object); }
+    bool contains(DOMObject* object) const { return m_wrapperSet.contains(object); }
+
+    static void willCacheWrapper(DOMObject*);
+    static void didUncacheWrapper(DOMObject*);
+
+private:
+    JSDebugWrapperSet();
+
+    HashSet<DOMObject*> m_wrapperSet;
+};
+
+#ifdef NDEBUG
+
+inline void JSDebugWrapperSet::willCacheWrapper(DOMObject*)
+{
+}
+
+inline void JSDebugWrapperSet::didUncacheWrapper(DOMObject*)
+{
+}
+
+#else
+
+inline void JSDebugWrapperSet::willCacheWrapper(DOMObject* wrapper)
+{
+    ASSERT(!JSDebugWrapperSet::shared().contains(wrapper));
+    JSDebugWrapperSet::shared().add(wrapper);
+}
+
+inline void JSDebugWrapperSet::didUncacheWrapper(DOMObject* wrapper)
+{
+    if (!wrapper)
+        return;
+    ASSERT(JSDebugWrapperSet::shared().contains(wrapper));
+    JSDebugWrapperSet::shared().remove(wrapper);
+}
+
+#endif
+
+} // namespace WebCore
+
+#endif // JSDebugWrapperSet_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
index d7f8725426..eda153e2f4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -26,7 +26,7 @@
 #include "HTMLDocument.h"
 #include "JSCanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)
-#include "JSCanvasRenderingContext3D.h"
+#include "JSWebGLRenderingContext.h"
 #endif
 #include "JSDOMWindowCustom.h"
 #include "JSHTMLDocument.h"
@@ -65,11 +65,11 @@ JSValue JSDocument::location(ExecState* exec) const
         return jsNull();
 
     Location* location = frame->domWindow()->location();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, location))
         return wrapper;
 
     JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, globalObject()), globalObject(), location);
-    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    cacheDOMObjectWrapper(exec, location, jsLocation);
     return jsLocation;
 }
 
@@ -87,7 +87,7 @@ void JSDocument::setLocation(ExecState* exec, JSValue value)
     if (activeFrame)
         str = activeFrame->document()->completeURL(str).string();
 
-    bool userGesture = activeFrame->script()->processingUserGesture();
+    bool userGesture = activeFrame->script()->processingUserGesture(currentWorld(exec));
     frame->redirectScheduler()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
 }
 
@@ -96,18 +96,18 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Document* documen
     if (!document)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), document);
+    DOMObject* wrapper = getCachedDOMNodeWrapper(exec, document, document);
     if (wrapper)
         return wrapper;
 
     if (document->isHTMLDocument())
-        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, HTMLDocument, document);
+        wrapper = CREATE_DOM_NODE_WRAPPER(exec, globalObject, HTMLDocument, document);
 #if ENABLE(SVG)
     else if (document->isSVGDocument())
-        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, SVGDocument, document);
+        wrapper = CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGDocument, document);
 #endif
     else
-        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, Document, document);
+        wrapper = CREATE_DOM_NODE_WRAPPER(exec, globalObject, Document, document);
 
     // Make sure the document is kept around by the window object, and works right with the
     // back/forward cache.
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
index fb64ff26c2..c7252904ee 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
@@ -145,7 +145,7 @@ JSValue toJSNewlyCreated(ExecState* exec, JSDOMGlobalObject* globalObject, Eleme
     if (!element)
         return jsNull();
 
-    ASSERT(!getCachedDOMNodeWrapper(element->document(), element));
+    ASSERT(!getCachedDOMNodeWrapper(exec, element->document(), element));
 
     JSNode* wrapper;        
     if (element->isHTMLElement())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
index edf9151a75..6686d7a69c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
@@ -30,9 +30,13 @@
 #include "JSEvent.h"
 
 #include "Clipboard.h"
+#include "CompositionEvent.h"
+#include "CustomEvent.h"
 #include "Event.h"
 #include "JSBeforeLoadEvent.h"
 #include "JSClipboard.h"
+#include "JSCustomEvent.h"
+#include "JSCompositionEvent.h"
 #include "JSErrorEvent.h"
 #include "JSKeyboardEvent.h"
 #include "JSMessageEvent.h"
@@ -40,6 +44,7 @@
 #include "JSMutationEvent.h"
 #include "JSOverflowEvent.h"
 #include "JSPageTransitionEvent.h"
+#include "JSPopStateEvent.h"
 #include "JSProgressEvent.h"
 #include "JSTextEvent.h"
 #include "JSUIEvent.h"
@@ -55,6 +60,7 @@
 #include "MutationEvent.h"
 #include "OverflowEvent.h"
 #include "PageTransitionEvent.h"
+#include "PopStateEvent.h"
 #include "ProgressEvent.h"
 #include "TextEvent.h"
 #include "UIEvent.h"
@@ -74,6 +80,11 @@
 #include "SVGZoomEvent.h"
 #endif
 
+#if ENABLE(TOUCH_EVENTS)
+#include "JSTouchEvent.h"
+#include "TouchEvent.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
@@ -90,7 +101,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
     if (!event)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), event);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, event);
     if (wrapper)
         return wrapper;
 
@@ -107,6 +118,12 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
         else if (event->isSVGZoomEvent())
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, SVGZoomEvent, event);
 #endif
+        else if (event->isCompositionEvent())
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, CompositionEvent, event);
+#if ENABLE(TOUCH_EVENTS)
+        else if (event->isTouchEvent())
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, TouchEvent, event);
+#endif
         else
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, UIEvent, event);
     } else if (event->isMutationEvent())
@@ -136,6 +153,10 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
     else if (event->isErrorEvent())
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, ErrorEvent, event);
 #endif
+    else if (event->isPopStateEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, PopStateEvent, event);
+    else if (event->isCustomEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, CustomEvent, event);
     else
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, Event, event);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
index 1a999a859e..be049db3dd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
@@ -31,9 +31,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSEventListener::JSEventListener(JSObject* function, bool isAttribute, DOMWrapperWorld* isolatedWorld)
+JSEventListener::JSEventListener(JSObject* function, JSObject* wrapper, bool isAttribute, DOMWrapperWorld* isolatedWorld)
     : EventListener(JSEventListenerType)
     , m_jsFunction(function)
+    , m_wrapper(wrapper)
     , m_isAttribute(isAttribute)
     , m_isolatedWorld(isolatedWorld)
 {
@@ -43,9 +44,10 @@ JSEventListener::~JSEventListener()
 {
 }
 
-JSObject* JSEventListener::jsFunction(ScriptExecutionContext*) const
+JSObject* JSEventListener::initializeJSFunction(ScriptExecutionContext*) const
 {
-    return m_jsFunction;
+    ASSERT_NOT_REACHED();
+    return 0;
 }
 
 void JSEventListener::markJSFunction(MarkStack& markStack)
@@ -81,18 +83,13 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
             return;
         // FIXME: Is this check needed for other contexts?
         ScriptController* script = frame->script();
-        if (!script->isEnabled() || script->isPaused())
+        if (!script->canExecuteScripts(AboutToExecuteScript) || script->isPaused())
             return;
     }
 
     ExecState* exec = globalObject->globalExec();
+    JSValue handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
 
-    JSValue handleEventFunction;
-    {
-        // Switch worlds, just in case handleEvent is a getter and causes JS execution!
-        EnterDOMWrapperWorld worldEntry(exec, m_isolatedWorld.get());
-        handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
-    }
     CallData callData;
     CallType callType = handleEventFunction.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -114,8 +111,8 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
 
         globalData->timeoutChecker.start();
         JSValue retval = handleEventFunction
-            ? callInWorld(exec, handleEventFunction, callType, callData, jsFunction, args, m_isolatedWorld.get())
-            : callInWorld(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args, m_isolatedWorld.get());
+            ? JSC::call(exec, handleEventFunction, callType, callData, jsFunction, args)
+            : JSC::call(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args);
         globalData->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
@@ -132,8 +129,6 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
             }
         }
 
-        if (scriptExecutionContext->isDocument())
-            Document::updateStyleForAllDocuments();
         deref();
     }
 }
@@ -166,7 +161,7 @@ bool JSEventListener::reportError(ScriptExecutionContext* context, const String&
     JSValue thisValue = globalObject->toThisObject(exec);
 
     globalData->timeoutChecker.start();
-    JSValue returnValue = callInWorld(exec, jsFunction, callType, callData, thisValue, args, m_isolatedWorld.get());
+    JSValue returnValue = JSC::call(exec, jsFunction, callType, callData, thisValue, args);
     globalData->timeoutChecker.stop();
 
     // If an error occurs while handling the script error, it should be bubbled up.
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
index bf3af4811f..569c192a4e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
@@ -22,7 +22,7 @@
 
 #include "EventListener.h"
 #include "JSDOMWindow.h"
-#include <runtime/Protect.h>
+#include <runtime/WeakGCPtr.h>
 
 namespace WebCore {
 
@@ -30,9 +30,9 @@ namespace WebCore {
 
     class JSEventListener : public EventListener {
     public:
-        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, bool isAttribute, DOMWrapperWorld* isolatedWorld)
+        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, JSC::JSObject* wrapper, bool isAttribute, DOMWrapperWorld* isolatedWorld)
         {
-            return adoptRef(new JSEventListener(listener, isAttribute, isolatedWorld));
+            return adoptRef(new JSEventListener(listener, wrapper, isAttribute, isolatedWorld));
         }
 
         static const JSEventListener* cast(const EventListener* listener)
@@ -49,23 +49,64 @@ namespace WebCore {
         // Returns true if this event listener was created for an event handler attribute, like "onload" or "onclick".
         bool isAttribute() const { return m_isAttribute; }
 
-        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
+        JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
+        DOMWrapperWorld* isolatedWorld() const { return m_isolatedWorld.get(); }
+
+        JSC::JSObject* wrapper() const { return m_wrapper.get(); }
+        void setWrapper(JSC::JSObject* wrapper) const { m_wrapper = wrapper; }
 
     private:
+        virtual JSC::JSObject* initializeJSFunction(ScriptExecutionContext*) const;
         virtual void markJSFunction(JSC::MarkStack&);
+        virtual void invalidateJSFunction(JSC::JSObject*);
         virtual void handleEvent(ScriptExecutionContext*, Event*);
         virtual bool reportError(ScriptExecutionContext*, const String& message, const String& url, int lineNumber);
         virtual bool virtualisAttribute() const;
-        void clearJSFunctionInline();
 
     protected:
-        JSEventListener(JSC::JSObject* function, bool isAttribute, DOMWrapperWorld* isolatedWorld);
+        JSEventListener(JSC::JSObject* function, JSC::JSObject* wrapper, bool isAttribute, DOMWrapperWorld* isolatedWorld);
 
+    private:
         mutable JSC::JSObject* m_jsFunction;
+        mutable JSC::WeakGCPtr<JSC::JSObject> m_wrapper;
+
         bool m_isAttribute;
         RefPtr<DOMWrapperWorld> m_isolatedWorld;
     };
 
+    inline JSC::JSObject* JSEventListener::jsFunction(ScriptExecutionContext* scriptExecutionContext) const
+    {
+        if (!m_jsFunction)
+            m_jsFunction = initializeJSFunction(scriptExecutionContext);
+
+        // Verify that we have a valid wrapper protecting our function from
+        // garbage collection.
+        ASSERT(m_wrapper || !m_jsFunction);
+        if (!m_wrapper)
+            return 0;
+
+        // Try to verify that m_jsFunction wasn't recycled. (Not exact, since an
+        // event listener can be almost anything, but this makes test-writing easier).
+        ASSERT(!m_jsFunction || static_cast<JSC::JSCell*>(m_jsFunction)->isObject());
+
+        return m_jsFunction;
+    }
+
+    inline void JSEventListener::invalidateJSFunction(JSC::JSObject* wrapper)
+    {
+        m_wrapper.clear(wrapper);
+    }
+
+    // Creates a JS EventListener for an "onXXX" event attribute.
+    inline PassRefPtr<JSEventListener> createJSAttributeEventListener(JSC::ExecState* exec, JSC::JSValue listener, JSC::JSObject* wrapper)
+    {
+        if (!listener.isObject())
+            return 0;
+
+        return JSEventListener::create(asObject(listener), wrapper, true, currentWorld(exec));
+    }
+
+
 } // namespace WebCore
 
 #endif // JSEventListener_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
index 8f0dfb10a4..dab3285490 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
@@ -49,7 +49,7 @@ JSValue JSEventSource::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -59,7 +59,7 @@ JSValue JSEventSource::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
index 530b89bc68..8bc348ce00 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSGeolocation.h"
 
+#if ENABLE(GEOLOCATION)
+
 #include "DOMWindow.h"
 #include "ExceptionCode.h"
 #include "Geolocation.h"
@@ -178,3 +180,5 @@ JSValue JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
index fd1dd11ee1..06b3ce442c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
@@ -112,9 +112,9 @@ bool JSHTMLAllCollection::canGetItemsForName(ExecState*, HTMLAllCollection* coll
     return !namedItems.isEmpty();
 }
 
-JSValue JSHTMLAllCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLAllCollection::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLAllCollection* thisObj = static_cast<JSHTMLAllCollection*>(asObject(slot.slotBase()));
+    JSHTMLAllCollection* thisObj = static_cast<JSHTMLAllCollection*>(asObject(slotBase));
     return getNamedItems(exec, thisObj, propertyName);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
index 30892e0c64..40d20cf9bd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
@@ -53,14 +53,4 @@ CallType JSHTMLAppletElement::getCallData(CallData& callData)
     return runtimeObjectGetCallData(impl(), callData);
 }
 
-bool JSHTMLAppletElement::canGetItemsForName(ExecState*, HTMLAppletElement*, const Identifier& propertyName)
-{
-    return propertyName == "__apple_runtime_object";
-}
-
-JSValue JSHTMLAppletElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    return runtimeObjectGetter(exec, propertyName, slot);
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
index 8ecd287418..80634f7c57 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
@@ -26,10 +26,12 @@
 #include "config.h"
 #include "JSHTMLCanvasElement.h"
 
+#include "CanvasContextAttributes.h"
 #include "HTMLCanvasElement.h"
 #include "JSCanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)
-#include "JSCanvasRenderingContext3D.h"
+#include "JSWebGLRenderingContext.h"
+#include "WebGLContextAttributes.h"
 #endif
 #include <wtf/GetPtr.h>
 
@@ -47,4 +49,36 @@ void JSHTMLCanvasElement::markChildren(MarkStack& markStack)
     markDOMObjectWrapper(markStack, globalData, canvas->renderingContext());
 }
 
+JSValue JSHTMLCanvasElement::getContext(ExecState* exec, const ArgList& args)
+{
+    HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(impl());
+    const UString& contextId = args.at(0).toString(exec);
+    RefPtr<CanvasContextAttributes> attrs;
+#if ENABLE(3D_CANVAS)
+    if (contextId == "experimental-webgl" || contextId == "webkit-3d") {
+        attrs = WebGLContextAttributes::create();
+        WebGLContextAttributes* webGLAttrs = static_cast<WebGLContextAttributes*>(attrs.get());
+        if (args.size() > 1 && args.at(1).isObject()) {
+            JSObject* jsAttrs = args.at(1).getObject();
+            Identifier alpha(exec, "alpha");
+            if (jsAttrs->hasProperty(exec, alpha))
+                webGLAttrs->setAlpha(jsAttrs->get(exec, alpha).toBoolean(exec));
+            Identifier depth(exec, "depth");
+            if (jsAttrs->hasProperty(exec, depth))
+                webGLAttrs->setDepth(jsAttrs->get(exec, depth).toBoolean(exec));
+            Identifier stencil(exec, "stencil");
+            if (jsAttrs->hasProperty(exec, stencil))
+                webGLAttrs->setStencil(jsAttrs->get(exec, stencil).toBoolean(exec));
+            Identifier antialias(exec, "antialias");
+            if (jsAttrs->hasProperty(exec, antialias))
+                webGLAttrs->setAntialias(jsAttrs->get(exec, antialias).toBoolean(exec));
+            Identifier premultipliedAlpha(exec, "premultipliedAlpha");
+            if (jsAttrs->hasProperty(exec, premultipliedAlpha))
+                webGLAttrs->setPremultipliedAlpha(jsAttrs->get(exec, premultipliedAlpha).toBoolean(exec));
+        }
+    }
+#endif
+    return toJS(exec, globalObject(), WTF::getPtr(canvas->getContext(contextId, attrs.get())));
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index dd4ceaa695..73728ed1f1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -109,9 +109,9 @@ bool JSHTMLCollection::canGetItemsForName(ExecState*, HTMLCollection* collection
     return !namedItems.isEmpty();
 }
 
-JSValue JSHTMLCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLCollection::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLCollection* thisObj = static_cast<JSHTMLCollection*>(asObject(slot.slotBase()));
+    JSHTMLCollection* thisObj = static_cast<JSHTMLCollection*>(asObject(slotBase));
     return getNamedItems(exec, thisObj, propertyName);
 }
 
@@ -134,7 +134,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, HTMLCollection* c
     if (!collection)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), collection);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, collection);
 
     if (wrapper)
         return wrapper;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index a65ca7cfbd..410c553778 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -55,9 +55,9 @@ bool JSHTMLDocument::canGetItemsForName(ExecState*, HTMLDocument* document, cons
     return atomicPropertyName && (document->hasNamedItem(atomicPropertyName) || document->hasExtraNamedItem(atomicPropertyName));
 }
 
-JSValue JSHTMLDocument::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLDocument::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLDocument* thisObj = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* thisObj = static_cast<JSHTMLDocument*>(asObject(slotBase));
     HTMLDocument* document = static_cast<HTMLDocument*>(thisObj->impl());
 
     String name = propertyName;
@@ -113,7 +113,7 @@ JSValue JSHTMLDocument::open(ExecState* exec, const ArgList& args)
                 CallType callType = function.getCallData(callData);
                 if (callType == CallTypeNone)
                     return throwError(exec, TypeError);
-                return callInWorld(exec, function, callType, callData, wrapper, args, currentWorld(exec));
+                return JSC::call(exec, function, callType, callData, wrapper, args);
             }
         }
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
index bce3ffb6a6..b9f8c12eb6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
@@ -53,14 +53,4 @@ CallType JSHTMLEmbedElement::getCallData(CallData& callData)
     return runtimeObjectGetCallData(impl(), callData);
 }
 
-bool JSHTMLEmbedElement::canGetItemsForName(ExecState*, HTMLEmbedElement*, const Identifier& propertyName)
-{
-    return propertyName == "__apple_runtime_object";
-}
-
-JSValue JSHTMLEmbedElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    return runtimeObjectGetter(exec, propertyName, slot);
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
index de9ec4ac9b..36ddfb1e4b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
@@ -44,9 +44,9 @@ bool JSHTMLFormElement::canGetItemsForName(ExecState*, HTMLFormElement* form, co
     return namedItems.size();
 }
 
-JSValue JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFormElement::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLElement* jsForm = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* jsForm = static_cast<JSHTMLFormElement*>(asObject(slotBase));
     HTMLFormElement* form = static_cast<HTMLFormElement*>(jsForm->impl());
 
     Vector<RefPtr<Node> > namedItems;
@@ -66,7 +66,7 @@ JSValue JSHTMLFormElement::submit(ExecState* exec, const ArgList&)
     Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!activeFrame)
         return jsUndefined();
-    static_cast<HTMLFormElement*>(impl())->submit(0, false, !activeFrame->script()->anyPageIsProcessingUserGesture());
+    static_cast<HTMLFormElement*>(impl())->submit(activeFrame);
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
index 68769d6acc..484c3576a9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
@@ -47,9 +47,9 @@ bool JSHTMLFrameSetElement::canGetItemsForName(ExecState*, HTMLFrameSetElement*
     return frame && frame->hasTagName(frameTag);
 }
 
-JSValue JSHTMLFrameSetElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFrameSetElement::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slotBase));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
 
     Node* frame = element->children()->namedItem(propertyName);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
index 1bfb51f0af..68c9e59f66 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
@@ -53,14 +53,4 @@ CallType JSHTMLObjectElement::getCallData(CallData& callData)
     return runtimeObjectGetCallData(impl(), callData);
 }
 
-bool JSHTMLObjectElement::canGetItemsForName(ExecState*, HTMLObjectElement*, const Identifier& propertyName)
-{
-    return propertyName == "__apple_runtime_object";
-}
-
-JSValue JSHTMLObjectElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    return runtimeObjectGetter(exec, propertyName, slot);
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
index b24b1ffedb..c031b30ac9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -38,17 +38,17 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValue nonCachingStaticBackFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticBackFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, jsHistoryPrototypeFunctionBack);
 }
 
-static JSValue nonCachingStaticForwardFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticForwardFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, jsHistoryPrototypeFunctionForward);
 }
 
-static JSValue nonCachingStaticGoFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticGoFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 1, propertyName, jsHistoryPrototypeFunctionGo);
 }
@@ -95,15 +95,15 @@ bool JSHistory::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& pr
 
 bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    // When accessing History cross-domain, functions are always the native built-in ones.
-    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
-    
-    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
-    // allowed, return false so the normal lookup will take place.
-    String message;
-    if (allowsAccessFromFrame(exec, impl()->frame(), message))
-        return false;
-    
+    if (!impl()->frame()) {
+        descriptor.setUndefined();
+        return true;
+    }
+
+    // Throw out all cross domain access
+    if (!allowsAccessFromFrame(exec, impl()->frame()))
+        return true;
+
     // Check for the few functions that we allow, even when called cross-domain.
     const HashEntry* entry = JSHistoryPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
     if (entry) {
@@ -133,8 +133,7 @@ bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifi
             return true;
         }
     }
-    
-    printErrorMessageForFrame(impl()->frame(), message);
+
     descriptor.setUndefined();
     return true;
 }
@@ -155,12 +154,60 @@ bool JSHistory::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-void JSHistory::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSHistory::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Only allow the history object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getOwnPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+JSValue JSHistory::pushState(ExecState* exec, const ArgList& args)
+{
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, args.at(0));
+    if (exec->hadException())
+        return jsUndefined();
+
+    String title = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
+    if (exec->hadException())
+        return jsUndefined();
+        
+    String url;
+    if (args.size() > 2) {
+        url = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+        if (exec->hadException())
+            return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    impl()->stateObjectAdded(historyState.release(), title, url, History::StateObjectPush, ec);
+    setDOMException(exec, ec);
+
+    return jsUndefined();
+}
+
+JSValue JSHistory::replaceState(ExecState* exec, const ArgList& args)
+{
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, args.at(0));
+    if (exec->hadException())
+        return jsUndefined();
+
+    String title = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
+    if (exec->hadException())
+        return jsUndefined();
+        
+    String url;
+    if (args.size() > 2) {
+        url = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+        if (exec->hadException())
+            return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    impl()->stateObjectAdded(historyState.release(), title, url, History::StateObjectReplace, ec);
+    setDOMException(exec, ec);
+
+    return jsUndefined();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
index 0f4a99196d..a574326038 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -24,7 +24,6 @@
 #include "HTMLNames.h"
 #include "JSHTMLImageElement.h"
 #include "JSNode.h"
-#include "ScriptExecutionContext.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
@@ -43,35 +42,30 @@ JSImageConstructor::JSImageConstructor(ExecState* exec, JSDOMGlobalObject* globa
 
 static JSObject* constructImage(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    bool widthSet = false;
-    bool heightSet = false;
-    int width = 0;
-    int height = 0;
-    if (args.size() > 0) {
-        widthSet = true;
-        width = args.at(0).toInt32(exec);
-    }
-    if (args.size() > 1) {
-        heightSet = true;
-        height = args.at(1).toInt32(exec);
-    }
-
     JSImageConstructor* jsConstructor = static_cast<JSImageConstructor*>(constructor);
     Document* document = jsConstructor->document();
     if (!document)
         return throwError(exec, ReferenceError, "Image constructor associated document is unavailable");
 
     // Calling toJS on the document causes the JS document wrapper to be
-    // added to the window object. This is done to ensure that JSDocument::mark
-    // will be called (which will cause the image element to be marked if necessary).
+    // added to the window object. This is done to ensure that JSDocument::markChildren
+    // will be called, which will cause the image element to be marked if necessary.
     toJS(exec, jsConstructor->globalObject(), document);
+    int width;
+    int height;
+    int* optionalWidth = 0;
+    int* optionalHeight = 0;
+    if (args.size() > 0) {
+        width = args.at(0).toInt32(exec);
+        optionalWidth = &width;
+    }
+    if (args.size() > 1) {
+        height = args.at(1).toInt32(exec);
+        optionalHeight = &height;
+    }
 
-    RefPtr<HTMLImageElement> image = new HTMLImageElement(HTMLNames::imgTag, document);
-    if (widthSet)
-        image->setWidth(width);
-    if (heightSet)
-        image->setHeight(height);
-    return asObject(toJS(exec, jsConstructor->globalObject(), image.release()));
+    return asObject(toJS(exec, jsConstructor->globalObject(),
+        HTMLImageElement::createForJSConstructor(document, optionalWidth, optionalHeight)));
 }
 
 ConstructType JSImageConstructor::getConstructData(ConstructData& constructData)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
index fa3b1d5c03..61c51128e4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
@@ -41,7 +41,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, ImageData* imageD
     if (!imageData)
         return jsNull();
     
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), imageData);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, imageData);
     if (wrapper)
         return wrapper;
     
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
new file mode 100644
index 0000000000..75597fbf30
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
@@ -0,0 +1,234 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInjectedScriptHost.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "Console.h"
+#if ENABLE(DATABASE)
+#include "Database.h"
+#include "JSDatabase.h"
+#endif
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "InjectedScript.h"
+#include "InjectedScriptHost.h"
+#include "InspectorController.h"
+#include "InspectorResource.h"
+#include "JSDOMWindow.h"
+#include "JSNode.h"
+#include "JSRange.h"
+#include "Node.h"
+#include "Page.h"
+#if ENABLE(DOM_STORAGE)
+#include "SerializedScriptValue.h"
+#include "Storage.h"
+#include "JSStorage.h"
+#endif
+#include "TextIterator.h"
+#include "VisiblePosition.h"
+#include <parser/SourceCode.h>
+#include <runtime/JSArray.h>
+#include <runtime/JSLock.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include "JavaScriptCallFrame.h"
+#include "JSJavaScriptCallFrame.h"
+#include "ScriptDebugServer.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptObject InjectedScriptHost::createInjectedScript(const String& source, ScriptState* scriptState, long id)
+{
+    SourceCode sourceCode = makeSource(source);
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    JSValue globalThisValue = scriptState->globalThisValue();
+    Completion comp = JSC::evaluate(scriptState, globalObject->globalScopeChain(), sourceCode, globalThisValue);
+    if (comp.complType() != JSC::Normal && comp.complType() != JSC::ReturnValue)
+        return ScriptObject();
+    JSValue functionValue = comp.value();
+    CallData callData;
+    CallType callType = functionValue.getCallData(callData);
+    if (callType == CallTypeNone)
+        return ScriptObject();
+
+    MarkedArgumentBuffer args;
+    args.append(toJS(scriptState, globalObject, this));
+    args.append(globalThisValue);
+    args.append(jsNumber(scriptState, id));
+    JSValue result = JSC::call(scriptState, functionValue, callType, callData, globalThisValue, args);
+    if (result.isObject())
+        return ScriptObject(scriptState, result.getObject());
+    return ScriptObject();
+}
+
+#if ENABLE(DATABASE)
+JSValue JSInjectedScriptHost::databaseForId(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    Database* database = impl()->databaseForId(args.at(0).toInt32(exec));
+    if (!database)
+        return jsUndefined();
+    return toJS(exec, database);
+}
+#endif
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+JSValue JSInjectedScriptHost::currentCallFrame(ExecState* exec, const ArgList&)
+{
+    JavaScriptCallFrame* callFrame = ScriptDebugServer::shared().currentCallFrame();
+    if (!callFrame || !callFrame->isValid())
+        return jsUndefined();
+
+    JSLock lock(SilenceAssertionsOnly);
+    return toJS(exec, callFrame);
+}
+
+JSValue JSInjectedScriptHost::isActivation(ExecState*, const ArgList& args)
+{
+    JSObject* object = args.at(0).getObject();
+    return jsBoolean(object && object->isActivationObject());
+}
+#endif
+
+JSValue JSInjectedScriptHost::nodeForId(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    Node* node = impl()->nodeForId(args.at(0).toInt32(exec));
+    if (!node)
+        return jsUndefined();
+
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    JSLock lock(SilenceAssertionsOnly);
+    return toJS(exec, node);
+}
+
+JSValue JSInjectedScriptHost::pushNodePathToFrontend(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 3)
+        return jsUndefined();
+
+    Node* node = toNode(args.at(0));
+    if (!node)
+        return jsUndefined();
+
+    bool withChildren = args.at(1).toBoolean(exec);
+    bool selectInUI = args.at(2).toBoolean(exec);
+    return jsNumber(exec, impl()->pushNodePathToFrontend(node, withChildren, selectInUI));
+}
+
+#if ENABLE(DATABASE)
+JSValue JSInjectedScriptHost::selectDatabase(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    Database* database = toDatabase(args.at(0));
+    if (database)
+        impl()->selectDatabase(database);
+    return jsUndefined();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+JSValue JSInjectedScriptHost::selectDOMStorage(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    Storage* storage = toStorage(args.at(0));
+    if (storage)
+        impl()->selectDOMStorage(storage);
+    return jsUndefined();
+}
+#endif
+
+JSValue JSInjectedScriptHost::reportDidDispatchOnInjectedScript(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 3)
+        return jsUndefined();
+    
+    if (!args.at(0).isInt32())
+        return jsUndefined();
+    int callId = args.at(0).asInt32();
+    
+    RefPtr<SerializedScriptValue> result(SerializedScriptValue::create(exec, args.at(1)));
+    
+    bool isException;
+    if (!args.at(2).getBoolean(isException))
+        return jsUndefined();
+    impl()->reportDidDispatchOnInjectedScript(callId, result.get(), isException);
+    return jsUndefined();
+}
+
+InjectedScript InjectedScriptHost::injectedScriptFor(ScriptState* scriptState)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    JSObject* injectedScript = globalObject->injectedScript();
+    if (injectedScript)
+        return InjectedScript(ScriptObject(scriptState, injectedScript));
+
+    ASSERT(!m_injectedScriptSource.isEmpty()); 
+    pair<long, ScriptObject> injectedScriptObject = injectScript(m_injectedScriptSource, scriptState);
+    globalObject->setInjectedScript(injectedScriptObject.second.jsObject());
+    InjectedScript result(injectedScriptObject.second);
+    m_idToInjectedScript.set(injectedScriptObject.first, result);
+    return result;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
deleted file mode 100644
index ed79427b63..0000000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSInspectedObjectWrapper.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "JSInspectorCallbackWrapper.h"
-#include <runtime/JSGlobalObject.h>
-#include <wtf/StdLibExtras.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSInspectedObjectWrapper);
-
-typedef HashMap<JSObject*, JSInspectedObjectWrapper*> WrapperMap;
-typedef HashMap<JSGlobalObject*, WrapperMap*> GlobalObjectWrapperMap;
-
-static GlobalObjectWrapperMap& wrappers()
-{
-    DEFINE_STATIC_LOCAL(GlobalObjectWrapperMap, map, ());
-    return map;
-}
-
-const ClassInfo JSInspectedObjectWrapper::s_info = { "JSInspectedObjectWrapper", &JSQuarantinedObjectWrapper::s_info, 0, 0 };
-
-JSValue JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValue unwrappedValue)
-{
-    if (!unwrappedValue.isObject())
-        return unwrappedValue;
-
-    JSObject* unwrappedObject = asObject(unwrappedValue);
-
-    if (unwrappedObject->inherits(&JSInspectedObjectWrapper::s_info))
-        return unwrappedObject;
-
-    if (WrapperMap* wrapperMap = wrappers().get(unwrappedExec->lexicalGlobalObject()))
-        if (JSInspectedObjectWrapper* wrapper = wrapperMap->get(unwrappedObject))
-            return wrapper;
-
-    JSValue prototype = unwrappedObject->prototype();
-    ASSERT(prototype.isNull() || prototype.isObject());
-
-    if (prototype.isNull())
-        return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(jsNull()));
-    return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(asObject(wrap(unwrappedExec, prototype))));
-}
-
-JSInspectedObjectWrapper::JSInspectedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
-    : JSQuarantinedObjectWrapper(unwrappedExec, unwrappedObject, structure)
-{
-    WrapperMap* wrapperMap = wrappers().get(unwrappedGlobalObject());
-    if (!wrapperMap) {
-        wrapperMap = new WrapperMap;
-        wrappers().set(unwrappedGlobalObject(), wrapperMap);
-    }
-
-    ASSERT(!wrapperMap->contains(unwrappedObject));
-    wrapperMap->set(unwrappedObject, this);
-}
-
-JSInspectedObjectWrapper::~JSInspectedObjectWrapper()
-{
-    ASSERT(wrappers().contains(unwrappedGlobalObject()));
-    WrapperMap* wrapperMap = wrappers().get(unwrappedGlobalObject());
-
-    ASSERT(wrapperMap->contains(unwrappedObject()));
-    wrapperMap->remove(unwrappedObject());
-
-    if (wrapperMap->isEmpty()) {
-        wrappers().remove(unwrappedGlobalObject());
-        delete wrapperMap;
-    }
-}
-
-JSValue JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValue value) const
-{
-    // The Inspector is only allowed to pass primitive values and wrapped objects to objects from the inspected page.
-
-    if (!value.isObject())
-        return value;
-
-    JSQuarantinedObjectWrapper* wrapper = asWrapper(value);
-    ASSERT_WITH_MESSAGE(wrapper, "Objects passed to JSInspectedObjectWrapper must be wrapped");
-    if (!wrapper)
-        return jsUndefined();
-
-    if (wrapper->allowsUnwrappedAccessFrom(unwrappedExecState())) {
-        ASSERT_WITH_MESSAGE(wrapper->inherits(&s_info), "A wrapper contains an object from the inspected page but is not a JSInspectedObjectWrapper");
-        if (!wrapper->inherits(&s_info))
-            return jsUndefined();
-
-        // Return the unwrapped object so the inspected page never sees one of its own objects in wrapped form.
-        return wrapper->unwrappedObject();
-    }
-
-    ASSERT_WITH_MESSAGE(wrapper->inherits(&JSInspectorCallbackWrapper::s_info), "A wrapper that was not from the inspected page and is not an Inspector callback was passed to a JSInspectedObjectWrapper");
-    if (!wrapper->inherits(&JSInspectorCallbackWrapper::s_info))
-        return jsUndefined();
-
-    return wrapper;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h
deleted file mode 100644
index ad97035e56..0000000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef JSInspectedObjectWrapper_h
-#define JSInspectedObjectWrapper_h
-
-#include "JSQuarantinedObjectWrapper.h"
-
-namespace WebCore {
-
-    class JSInspectedObjectWrapper : public JSQuarantinedObjectWrapper {
-    public:
-        static JSC::JSValue wrap(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue);
-        virtual ~JSInspectedObjectWrapper();
-
-        static const JSC::ClassInfo s_info;
-
-    private:
-        JSInspectedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
-
-        virtual bool allowsGetProperty() const { return true; }
-        virtual bool allowsSetProperty() const { return true; }
-        virtual bool allowsDeleteProperty() const { return true; }
-        virtual bool allowsConstruct() const { return true; }
-        virtual bool allowsHasInstance() const { return true; }
-        virtual bool allowsCallAsFunction() const { return true; }
-        virtual bool allowsGetPropertyNames() const { return true; }
-
-        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const;
-        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
-
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-} // namespace WebCore
-
-#endif // JSInspectedObjectWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
deleted file mode 100644
index 439f532825..0000000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
+++ /dev/null
@@ -1,346 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSInspectorBackend.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "Console.h"
-#if ENABLE(DATABASE)
-#include "Database.h"
-#include "JSDatabase.h"
-#endif
-#include "ExceptionCode.h"
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "InspectorBackend.h"
-#include "InspectorController.h"
-#include "InspectorResource.h"
-#include "JSDOMWindow.h"
-#include "JSInspectedObjectWrapper.h"
-#include "JSInspectorCallbackWrapper.h"
-#include "JSNode.h"
-#include "JSRange.h"
-#include "Node.h"
-#include "Page.h"
-#if ENABLE(DOM_STORAGE)
-#include "Storage.h"
-#include "JSStorage.h"
-#endif
-#include "TextIterator.h"
-#include "VisiblePosition.h"
-#include <runtime/JSArray.h>
-#include <runtime/JSLock.h>
-#include <wtf/Vector.h>
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-#include "JavaScriptCallFrame.h"
-#include "JavaScriptDebugServer.h"
-#include "JSJavaScriptCallFrame.h"
-#endif
-
-using namespace JSC;
-
-namespace WebCore {
-
-JSValue JSInspectorBackend::highlightDOMNode(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    impl()->highlight(args.at(0).toInt32(exec));
-    return jsUndefined();
-}
-
-JSValue JSInspectorBackend::search(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    Node* node = toNode(args.at(0));
-    if (!node)
-        return jsUndefined();
-
-    String target = args.at(1).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    MarkedArgumentBuffer result;
-    RefPtr<Range> searchRange(rangeOfContents(node));
-
-    ExceptionCode ec = 0;
-    do {
-        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
-        if (resultRange->collapsed(ec))
-            break;
-
-        // A non-collapsed result range can in some funky whitespace cases still not
-        // advance the range's start position (4509328). Break to avoid infinite loop.
-        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
-        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
-            break;
-
-        result.append(toJS(exec, resultRange.get()));
-
-        setStart(searchRange.get(), newStart);
-    } while (true);
-
-    return constructArray(exec, result);
-}
-
-#if ENABLE(DATABASE)
-JSValue JSInspectorBackend::databaseForId(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-
-    Database* database = impl()->databaseForId(args.at(0).toInt32(exec));
-    if (!database)
-        return jsUndefined();
-    // Could use currentWorld(exec) ... but which exec!  The following mixed use of exec & inspectedWindow->globalExec() scares me!
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame(), debuggerWorld());
-    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, database));
-}
-#endif
-
-JSValue JSInspectorBackend::inspectedWindow(ExecState*, const ArgList&)
-{
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame(), debuggerWorld());
-    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), inspectedWindow);
-}
-
-JSValue JSInspectorBackend::setting(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    String key = args.at(0).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-    const InspectorController::Setting& setting = ic->setting(key);
-
-    switch (setting.type()) {
-        default:
-        case InspectorController::Setting::NoType:
-            return jsUndefined();
-        case InspectorController::Setting::StringType:
-            return jsString(exec, setting.string());
-        case InspectorController::Setting::DoubleType:
-            return jsNumber(exec, setting.doubleValue());
-        case InspectorController::Setting::IntegerType:
-            return jsNumber(exec, setting.integerValue());
-        case InspectorController::Setting::BooleanType:
-            return jsBoolean(setting.booleanValue());
-        case InspectorController::Setting::StringVectorType: {
-            MarkedArgumentBuffer stringsArray;
-            const Vector<String>& strings = setting.stringVector();
-            const unsigned length = strings.size();
-            for (unsigned i = 0; i < length; ++i)
-                stringsArray.append(jsString(exec, strings[i]));
-            return constructArray(exec, stringsArray);
-        }
-    }
-}
-
-JSValue JSInspectorBackend::setSetting(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    String key = args.at(0).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    InspectorController::Setting setting;
-
-    JSValue value = args.at(1);
-    if (value.isUndefined() || value.isNull()) {
-        // Do nothing. The setting is already NoType.
-        ASSERT(setting.type() == InspectorController::Setting::NoType);
-    } else if (value.isString())
-        setting.set(value.toString(exec));
-    else if (value.isNumber())
-        setting.set(value.toNumber(exec));
-    else if (value.isBoolean())
-        setting.set(value.toBoolean(exec));
-    else {
-        JSArray* jsArray = asArray(value);
-        if (!jsArray)
-            return jsUndefined();
-        Vector<String> strings;
-        for (unsigned i = 0; i < jsArray->length(); ++i) {
-            String item = jsArray->get(exec, i).toString(exec);
-            if (exec->hadException())
-                return jsUndefined();
-            strings.append(item);
-        }
-        setting.set(strings);
-    }
-
-    if (exec->hadException())
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (ic)
-        ic->setSetting(key, setting);
-
-    return jsUndefined();
-}
-
-JSValue JSInspectorBackend::wrapCallback(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    return JSInspectorCallbackWrapper::wrap(exec, args.at(0));
-}
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-
-JSValue JSInspectorBackend::currentCallFrame(ExecState* exec, const ArgList&)
-{
-    JavaScriptCallFrame* callFrame = impl()->currentCallFrame();
-    if (!callFrame || !callFrame->isValid())
-        return jsUndefined();
-
-    // FIXME: I am not sure if this is actually needed. Can we just use exec?
-    ExecState* globalExec = callFrame->scopeChain()->globalObject->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    return JSInspectedObjectWrapper::wrap(globalExec, toJS(exec, callFrame));
-}
-
-#endif
-
-JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    Node* node = impl()->nodeForId(args.at(0).toInt32(exec));
-    if (!node)
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-
-    JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame(), debuggerWorld());
-    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, deprecatedGlobalObjectForPrototype(inspectedWindow->globalExec()), node));
-}
-
-JSValue JSInspectorBackend::wrapObject(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    return impl()->wrapObject(ScriptValue(args.at(0)), args.at(1).toString(exec)).jsValue();
-}
-
-JSValue JSInspectorBackend::unwrapObject(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    return impl()->unwrapObject(args.at(0).toString(exec)).jsValue();
-}
-
-JSValue JSInspectorBackend::pushNodePathToFrontend(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
-        return jsUndefined();
-
-    Node* node = toNode(wrapper->unwrappedObject());
-    if (!node)
-        return jsUndefined();
-
-    bool selectInUI = args.at(1).toBoolean(exec);
-    return jsNumber(exec, impl()->pushNodePathToFrontend(node, selectInUI));
-}
-
-#if ENABLE(DATABASE)
-JSValue JSInspectorBackend::selectDatabase(ExecState*, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
-        return jsUndefined();
-
-    Database* database = toDatabase(wrapper->unwrappedObject());
-    if (database)
-        impl()->selectDatabase(database);
-    return jsUndefined();
-}
-#endif
-
-#if ENABLE(DOM_STORAGE)
-JSValue JSInspectorBackend::selectDOMStorage(ExecState*, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
-        return jsUndefined();
-
-    Storage* storage = toStorage(wrapper->unwrappedObject());
-    if (storage)
-        impl()->selectDOMStorage(storage);
-    return jsUndefined();
-}
-#endif
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
deleted file mode 100644
index 9c4330d051..0000000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
+++ /dev/null
@@ -1,111 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSInspectorCallbackWrapper.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "JSInspectedObjectWrapper.h"
-#include <wtf/StdLibExtras.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSInspectorCallbackWrapper);
-
-typedef HashMap<JSObject*, JSInspectorCallbackWrapper*> WrapperMap;
-
-static WrapperMap& wrappers()
-{
-    DEFINE_STATIC_LOCAL(WrapperMap, map, ());
-    return map;
-}
-
-const ClassInfo JSInspectorCallbackWrapper::s_info = { "JSInspectorCallbackWrapper", &JSQuarantinedObjectWrapper::s_info, 0, 0 };
-
-static Structure* leakInspectorCallbackWrapperStructure()
-{
-    Structure::startIgnoringLeaks();
-    Structure* structure = JSInspectorCallbackWrapper::createStructure(jsNull()).releaseRef();
-    Structure::stopIgnoringLeaks();
-    return structure;
-}
-
-JSValue JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValue unwrappedValue)
-{
-    if (!unwrappedValue.isObject())
-        return unwrappedValue;
-
-    JSObject* unwrappedObject = asObject(unwrappedValue);
-
-    if (unwrappedObject->inherits(&JSInspectorCallbackWrapper::s_info))
-        return unwrappedObject;
-
-    if (JSInspectorCallbackWrapper* wrapper = wrappers().get(unwrappedObject))
-        return wrapper;
-
-    JSValue prototype = unwrappedObject->prototype();
-    ASSERT(prototype.isNull() || prototype.isObject());
-
-    if (prototype.isNull()) {
-        static Structure* structure = leakInspectorCallbackWrapperStructure();
-        return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, structure);
-    }
-    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, createStructure(wrap(unwrappedExec, prototype)));
-}
-
-JSInspectorCallbackWrapper::JSInspectorCallbackWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
-    : JSQuarantinedObjectWrapper(unwrappedExec, unwrappedObject, structure)
-{
-    ASSERT(!wrappers().contains(unwrappedObject));
-    wrappers().set(unwrappedObject, this);
-}
-
-JSInspectorCallbackWrapper::~JSInspectorCallbackWrapper()
-{
-    wrappers().remove(unwrappedObject());
-}
-
-JSValue JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExec, JSValue unwrappedValue) const
-{
-    if (JSQuarantinedObjectWrapper* wrapper = asWrapper(unwrappedValue)) {
-        // The only time a wrapper should be passed into a JSInspectorCallbackWrapper is when a client-side storage callback
-        // is called. (The client-side storage API calls the callback with the `this` object set to the callback itself.)
-        ASSERT_WITH_MESSAGE(wrapper == this, "A different wrapper was passed into a JSInspectorCallbackWrapper");
-        if (wrapper != this)
-            return jsUndefined();
-
-        return wrapper->unwrappedObject();
-    }
-
-    // Any value being passed to the Inspector from the inspected page should be wrapped in a JSInspectedObjectWrapper.
-    return JSInspectedObjectWrapper::wrap(unwrappedExec, unwrappedValue);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp
new file mode 100644
index 0000000000..7b06bacd01
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInspectorFrontendHost.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "ContextMenuItem.h"
+#include "InspectorController.h"
+#include "InspectorFrontendHost.h"
+#include "JSEvent.h"
+#include "MouseEvent.h"
+#include <runtime/JSArray.h>
+#include <runtime/JSLock.h>
+#include <runtime/JSObject.h>
+#include <wtf/Vector.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSInspectorFrontendHost::showContextMenu(ExecState* execState, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    Event* event = toEvent(args.at(0));
+
+    JSArray* array = asArray(args.at(1));
+    Vector<ContextMenuItem*> items;
+
+    for (size_t i = 0; i < array->length(); ++i) {
+        JSObject* item = asObject(array->getIndex(i));
+        JSValue label = item->get(execState, Identifier(execState, "label"));
+        JSValue id = item->get(execState, Identifier(execState, "id"));
+        if (label.isUndefined() || id.isUndefined())
+            items.append(new ContextMenuItem(SeparatorType, ContextMenuItemTagNoAction, String()));
+        else {
+            ContextMenuAction typedId = static_cast<ContextMenuAction>(ContextMenuItemBaseCustomTag + id.toInt32(execState));
+            items.append(new ContextMenuItem(ActionType, typedId, label.toString(execState)));
+        }
+    }
+
+    impl()->showContextMenu(event, items);
+    return jsUndefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
index 08ecf2b126..afbdf5d1d3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
@@ -55,9 +55,9 @@ JSValue JSJavaScriptCallFrame::type(ExecState* exec) const
 {
     switch (impl()->type()) {
         case DebuggerCallFrame::FunctionType:
-            return jsString(exec, "function");
+            return jsString(exec, UString("function"));
         case DebuggerCallFrame::ProgramType:
-            return jsString(exec, "program");
+            return jsString(exec, UString("program"));
     }
 
     ASSERT_NOT_REACHED();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
index 6d75f4fbb7..cd1d267455 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -35,12 +35,11 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter eventListenerCounter("JSLazyEventListener");
 #endif
 
-JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, DOMWrapperWorld* isolatedWorld)
-    : JSEventListener(0, true, isolatedWorld)
+JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, JSObject* wrapper, DOMWrapperWorld* isolatedWorld)
+    : JSEventListener(0, wrapper, true, isolatedWorld)
     , m_functionName(functionName)
     , m_eventParameterName(eventParameterName)
     , m_code(code)
-    , m_parsed(false)
     , m_sourceURL(sourceURL)
     , m_lineNumber(lineNumber)
     , m_originalNode(node)
@@ -48,8 +47,8 @@ JSLazyEventListener::JSLazyEventListener(const String& functionName, const Strin
     // We don't retain the original node because we assume it
     // will stay alive as long as this handler object is around
     // and we need to avoid a reference cycle. If JS transfers
-    // this handler to another node, parseCode will be called and
-    // then originalNode is no longer needed.
+    // this handler to another node, initializeJSFunction will
+    // be called and then originalNode is no longer needed.
 
     // A JSLazyEventListener can be created with a line number of zero when it is created with
     // a setAttribute call from JavaScript, so make the line number 1 in that case.
@@ -68,79 +67,62 @@ JSLazyEventListener::~JSLazyEventListener()
 #endif
 }
 
-JSObject* JSLazyEventListener::jsFunction(ScriptExecutionContext* executionContext) const
-{
-    parseCode(executionContext);
-    return m_jsFunction;
-}
-
-void JSLazyEventListener::parseCode(ScriptExecutionContext* executionContext) const
+JSObject* JSLazyEventListener::initializeJSFunction(ScriptExecutionContext* executionContext) const
 {
     ASSERT(executionContext);
     ASSERT(executionContext->isDocument());
     if (!executionContext)
-        return;
-
-    if (m_parsed)
-        return;
+        return 0;
 
     Frame* frame = static_cast<Document*>(executionContext)->frame();
     if (!frame)
-        return;
+        return 0;
 
     ScriptController* scriptController = frame->script();
-    if (!scriptController->isEnabled())
-        return;
+    if (!scriptController->canExecuteScripts(AboutToExecuteScript))
+        return 0;
 
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(executionContext, m_isolatedWorld.get());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(executionContext, isolatedWorld());
     if (!globalObject)
-        return;
-
-    // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
-    if (m_originalNode) {
-        JSLock lock(SilenceAssertionsOnly);
-        // FIXME: Should pass the global object associated with the node
-        toJS(globalObject->globalExec(), globalObject, m_originalNode);
-    }
+        return 0;
 
     if (executionContext->isDocument()) {
         JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject);
         Frame* frame = window->impl()->frame();
         if (!frame)
-            return;
+            return 0;
         // FIXME: Is this check needed for non-Document contexts?
         ScriptController* script = frame->script();
-        if (!script->isEnabled() || script->isPaused())
-            return;
+        if (!script->canExecuteScripts(AboutToExecuteScript) || script->isPaused())
+            return 0;
     }
 
-    m_parsed = true;
-
     ExecState* exec = globalObject->globalExec();
 
     MarkedArgumentBuffer args;
     args.append(jsNontrivialString(exec, m_eventParameterName));
     args.append(jsString(exec, m_code));
 
-    m_jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), m_sourceURL, m_lineNumber); // FIXME: is globalExec ok?
-
-    JSFunction* listenerAsFunction = static_cast<JSFunction*>(m_jsFunction);
-
+    JSObject* jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), m_sourceURL, m_lineNumber); // FIXME: is globalExec ok?
     if (exec->hadException()) {
         exec->clearException();
+        return 0;
+    }
+
+    JSFunction* listenerAsFunction = static_cast<JSFunction*>(jsFunction);
+    if (m_originalNode) {
+        if (!wrapper()) {
+            // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
+            JSLock lock(SilenceAssertionsOnly);
+            // FIXME: Should pass the global object associated with the node
+            setWrapper(asObject(toJS(globalObject->globalExec(), globalObject, m_originalNode)));
+        }
 
-        // failed to parse, so let's just make this listener a no-op
-        m_jsFunction = 0;
-    } else if (m_originalNode) {
         // Add the event's home element to the scope
         // (and the document, and the form - see JSHTMLElement::eventHandlerScope)
         ScopeChain scope = listenerAsFunction->scope();
-
-        JSValue thisObj = toJS(exec, globalObject, m_originalNode);
-        if (thisObj.isObject()) {
-            static_cast<JSNode*>(asObject(thisObj))->pushEventHandlerScope(exec, scope);
-            listenerAsFunction->setScope(scope);
-        }
+        static_cast<JSNode*>(wrapper())->pushEventHandlerScope(exec, scope);
+        listenerAsFunction->setScope(scope);
     }
 
     // Since we only parse once, there's no need to keep data used for parsing around anymore.
@@ -148,6 +130,7 @@ void JSLazyEventListener::parseCode(ScriptExecutionContext* executionContext) co
     m_code = String();
     m_eventParameterName = String();
     m_sourceURL = String();
+    return jsFunction;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
index ba26ef6970..1b00b75b25 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
@@ -29,24 +29,21 @@ namespace WebCore {
 
     class JSLazyEventListener : public JSEventListener {
     public:
-        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, DOMWrapperWorld* isolatedWorld)
+        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, JSC::JSObject* wrapper, DOMWrapperWorld* isolatedWorld)
         {
-            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, node, sourceURL, lineNumber, isolatedWorld));
+            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, node, sourceURL, lineNumber, wrapper, isolatedWorld));
         }
         virtual ~JSLazyEventListener();
 
     private:
-        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node*, const String& sourceURL, int lineNumber, DOMWrapperWorld* isolatedWorld);
+        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node*, const String& sourceURL, int lineNumber, JSC::JSObject* wrapper, DOMWrapperWorld* isolatedWorld);
 
-        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
+        virtual JSC::JSObject* initializeJSFunction(ScriptExecutionContext*) const;
         virtual bool wasCreatedFromMarkup() const { return true; }
 
-        void parseCode(ScriptExecutionContext*) const;
-
         mutable String m_functionName;
         mutable String m_eventParameterName;
         mutable String m_code;
-        mutable bool m_parsed;
         mutable String m_sourceURL;
         int m_lineNumber;
         Node* m_originalNode;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
index c76a2b18c9..a3e2baec71 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
@@ -24,6 +24,7 @@
 #include "JSLocationCustom.h"
 
 #include "DOMWindow.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "JSDOMBinding.h"
@@ -38,17 +39,17 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValue nonCachingStaticReplaceFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticReplaceFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 1, propertyName, jsLocationPrototypeFunctionReplace);
 }
 
-static JSValue nonCachingStaticReloadFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticReloadFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, jsLocationPrototypeFunctionReload);
 }
 
-static JSValue nonCachingStaticAssignFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticAssignFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 1, propertyName, jsLocationPrototypeFunctionAssign);
 }
@@ -102,14 +103,9 @@ bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identif
         return true;
     }
     
-    // When accessing Location cross-domain, functions are always the native built-in ones.
-    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
-    
-    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
-    // allowed, return false so the normal lookup will take place.
-    String message;
-    if (allowsAccessFromFrame(exec, frame, message))
-        return false;
+    // throw out all cross domain access
+    if (!allowsAccessFromFrame(exec, frame))
+        return true;
     
     // Check for the few functions that we allow, even when called cross-domain.
     const HashEntry* entry = JSLocationPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
@@ -133,8 +129,7 @@ bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identif
     // FIXME: Other implementers of the Window cross-domain scheme (Window, History) allow toString,
     // but for now we have decided not to, partly because it seems silly to return "[Object Location]" in
     // such cases when normally the string form of Location would be the URL.
-    
-    printErrorMessageForFrame(frame, message);
+
     descriptor.setUndefined();
     return true;
 }
@@ -174,12 +169,12 @@ bool JSLocation::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-void JSLocation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSLocation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Only allow the location object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getOwnPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
@@ -220,7 +215,10 @@ void JSLocation::setProtocol(ExecState* exec, JSValue value)
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setProtocol(value.toString(exec));
+    if (!url.setProtocol(value.toString(exec))) {
+        setDOMException(exec, SYNTAX_ERR);
+        return;
+    }
 
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
@@ -257,8 +255,9 @@ void JSLocation::setPort(ExecState* exec, JSValue value)
     const UString& portString = value.toString(exec);
     int port = charactersToInt(portString.data(), portString.size());
     if (port < 0 || port > 0xFFFF)
-        port = 0;
-    url.setPort(port);
+        url.removePort();
+    else
+        url.setPort(port);
 
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
index 2c09620cd3..2ee812518c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -49,7 +49,7 @@ void JSMessagePort::markChildren(MarkStack& markStack)
     if (MessagePort* entangledPort = m_impl->locallyEntangledPort())
         markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), entangledPort);
 
-    m_impl->markEventListeners(markStack);
+    m_impl->markJSEventListeners(markStack);
 }
 
 JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
@@ -58,7 +58,7 @@ JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -68,7 +68,7 @@ JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
index c90dadd077..c4b31894cf 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
@@ -33,9 +33,9 @@ bool JSMimeTypeArray::canGetItemsForName(ExecState*, MimeTypeArray* mimeTypeArra
     return mimeTypeArray->canGetItemsForName(propertyName);
 }
 
-JSValue JSMimeTypeArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSMimeTypeArray::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSMimeTypeArray* thisObj = static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()));
+    JSMimeTypeArray* thisObj = static_cast<JSMimeTypeArray*>(asObject(slotBase));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index 1974ab0cc9..13f3628cbe 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -40,9 +40,9 @@ bool JSNamedNodeMap::canGetItemsForName(ExecState*, NamedNodeMap* impl, const Id
     return impl->getNamedItem(propertyName);
 }
 
-JSValue JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNamedNodeMap::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSNamedNodeMap* thisObj = static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()));
+    JSNamedNodeMap* thisObj = static_cast<JSNamedNodeMap*>(asObject(slotBase));
     return toJS(exec, thisObj->impl()->getNamedItem(propertyName));
 }
 
@@ -52,10 +52,8 @@ void JSNamedNodeMap::markChildren(MarkStack& markStack)
 
     // Mark the element so that this will work to access the attribute even if the last
     // other reference goes away.
-    if (Element* element = impl()->element()) {
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
-            markStack.append(wrapper);
-    }
+    if (Element* element = impl()->element())
+        markDOMNodeWrapper(markStack, element->document(), element);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
index 2a4aa80bff..134c5813a2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -114,7 +114,7 @@ JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -124,7 +124,7 @@ JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -137,42 +137,45 @@ void JSNode::markChildren(MarkStack& markStack)
     Base::markChildren(markStack);
 
     Node* node = m_impl.get();
-    node->markEventListeners(markStack);
+    node->markJSEventListeners(markStack);
 
     // Nodes in the document are kept alive by JSDocument::mark, so, if we're in
     // the document, we need to mark the document, but we don't need to explicitly
     // mark any other nodes.
     if (node->inDocument()) {
         if (Document* doc = node->ownerDocument())
-            markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), doc);
+            markDOMNodeWrapper(markStack, doc, doc);
         return;
     }
 
-    // This is a node outside the document, so find the root of the tree it is in,
-    // and start marking from there.
+    // This is a node outside the document.
+    // Find the the root, and the highest ancestor with a wrapper.
     Node* root = node;
-    for (Node* current = m_impl.get(); current; current = current->parentNode())
+    Node* outermostNodeWithWrapper = node;
+    for (Node* current = m_impl.get(); current; current = current->parentNode()) {
         root = current;
+        if (hasCachedDOMNodeWrapperUnchecked(current->document(), current))
+            outermostNodeWithWrapper = current;
+    }
 
-    // Nodes in a subtree are marked by the tree's root, so, if the root is already
-    // marking the tree, we don't need to explicitly mark any other nodes.
-    if (root->inSubtreeMark())
+    // Only nodes that have no ancestors with wrappers mark the subtree. In the common
+    // case, the root of the detached subtree has a wrapper, so the tree will only
+    // get marked once. Nodes that aren't outermost need to mark the outermost
+    // in case it is otherwise unreachable.
+    if (node != outermostNodeWithWrapper) {
+        markDOMNodeWrapper(markStack, m_impl->document(), outermostNodeWithWrapper);
         return;
+    }
 
     // Mark the whole tree subtree.
-    root->setInSubtreeMark(true);
-    for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode()) {
-        JSNode* wrapper = getCachedDOMNodeWrapper(m_impl->document(), nodeToMark);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
-    root->setInSubtreeMark(false);
+    for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode())
+        markDOMNodeWrapper(markStack, m_impl->document(), nodeToMark);
 }
 
-static ALWAYS_INLINE JSValue createWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
+static ALWAYS_INLINE JSValue createWrapperInline(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
 {
     ASSERT(node);
-    ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
+    ASSERT(!getCachedDOMNodeWrapper(exec, node->document(), node));
     
     JSNode* wrapper;    
     switch (node->nodeType()) {
@@ -225,25 +228,18 @@ static ALWAYS_INLINE JSValue createWrapper(ExecState* exec, JSDOMGlobalObject* g
 
     return wrapper;    
 }
-    
-JSValue toJSNewlyCreated(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
+
+JSValue createWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
 {
-    if (!node)
-        return jsNull();
-    
-    return createWrapper(exec, globalObject, node);
+    return createWrapperInline(exec, globalObject, node);
 }
     
-JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
+JSValue toJSNewlyCreated(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
 {
     if (!node)
         return jsNull();
-
-    JSNode* wrapper = getCachedDOMNodeWrapper(node->document(), node);
-    if (wrapper)
-        return wrapper;
-
-    return createWrapper(exec, globalObject, node);
+    
+    return createWrapperInline(exec, globalObject, node);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.h
new file mode 100644
index 0000000000..9d06ae636d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2007, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSNodeCustom_h
+#define JSNodeCustom_h
+
+#include "JSDOMBinding.h"
+#include <wtf/AlwaysInline.h>
+
+namespace WebCore {
+
+inline JSNode* getCachedDOMNodeWrapper(JSC::ExecState* exec, Document* document, Node* node)
+{
+    if (currentWorld(exec)->isNormal()) {
+        ASSERT(node->wrapper() == (document ? document->getWrapperCache(currentWorld(exec))->get(node) : domObjectWrapperMapFor(exec).get(node)));
+        return static_cast<JSNode*>(node->wrapper());
+    }
+
+    if (document)
+        return document->getWrapperCache(currentWorld(exec))->get(node);
+    return static_cast<JSNode*>(domObjectWrapperMapFor(exec).get(node));
+}
+
+JSC::JSValue createWrapper(JSC::ExecState*, JSDOMGlobalObject*, Node*);
+
+inline JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
+{
+    if (!node)
+        return JSC::jsNull();
+
+    JSNode* wrapper = getCachedDOMNodeWrapper(exec, node->document(), node);
+    if (wrapper)
+        return wrapper;
+
+    return createWrapper(exec, globalObject, node);
+}
+
+}
+
+#endif // JSDOMNodeCustom_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
index 54dc020037..d34f5c1acd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -66,7 +66,7 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
-    JSValue result = callInWorld(exec, m_filter, callType, callData, m_filter, args, currentWorld(exec));
+    JSValue result = JSC::call(exec, m_filter, callType, callData, m_filter, args);
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
index 2821d018c5..3f7d08bbd3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
@@ -56,9 +56,9 @@ bool JSNodeList::canGetItemsForName(ExecState*, NodeList* impl, const Identifier
     return impl->itemWithName(propertyName);
 }
 
-JSValue JSNodeList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNodeList::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSNodeList* thisObj = static_cast<JSNodeList*>(asObject(slot.slotBase()));
+    JSNodeList* thisObj = static_cast<JSNodeList*>(asObject(slotBase));
     return toJS(exec, thisObj->impl()->itemWithName(propertyName));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
index 7da066635e..995903eada 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -49,21 +49,18 @@ static JSObject* constructHTMLOptionElement(ExecState* exec, JSObject* construct
     if (!document)
         return throwError(exec, ReferenceError, "Option constructor associated document is unavailable");
 
-    RefPtr<HTMLOptionElement> element = static_pointer_cast<HTMLOptionElement>(document->createElement(HTMLNames::optionTag, false));
-
-    ExceptionCode ec = 0;
-    RefPtr<Text> text = document->createTextNode("");
+    String data;
     if (!args.at(0).isUndefined())
-        text->setData(args.at(0).toString(exec), ec);
-    if (ec == 0)
-        element->appendChild(text.release(), ec);
-    if (ec == 0 && !args.at(1).isUndefined())
-        element->setValue(args.at(1).toString(exec));
-    if (ec == 0)
-        element->setDefaultSelected(args.at(2).toBoolean(exec));
-    if (ec == 0)
-        element->setSelected(args.at(3).toBoolean(exec));
+        data = args.at(0).toString(exec);
 
+    String value;
+    if (!args.at(1).isUndefined())
+        value = args.at(1).toString(exec);
+    bool defaultSelected = args.at(2).toBoolean(exec);
+    bool selected = args.at(3).toBoolean(exec);
+
+    ExceptionCode ec = 0;
+    RefPtr<HTMLOptionElement> element = HTMLOptionElement::createForJSConstructor(document, data, value, defaultSelected, selected, ec);
     if (ec) {
         setDOMException(exec, ec);
         return 0;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
index 81d42958dc..9e0c3f5c63 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
@@ -33,9 +33,9 @@ bool JSPluginArray::canGetItemsForName(ExecState*, PluginArray* pluginArray, con
     return pluginArray->canGetItemsForName(propertyName);
 }
 
-JSValue JSPluginArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPluginArray::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSPluginArray* thisObj = static_cast<JSPluginArray*>(asObject(slot.slotBase()));
+    JSPluginArray* thisObj = static_cast<JSPluginArray*>(asObject(slotBase));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
index 555dd9ed64..b29e5836f4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
@@ -32,9 +32,9 @@ bool JSPlugin::canGetItemsForName(ExecState*, Plugin* plugin, const Identifier&
     return plugin->canGetItemsForName(propertyName);
 }
 
-JSValue JSPlugin::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPlugin::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSPlugin* thisObj = static_cast<JSPlugin*>(asObject(slot.slotBase()));
+    JSPlugin* thisObj = static_cast<JSPlugin*>(asObject(slotBase));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
index ada2a77a84..b20b9a712e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
@@ -20,10 +20,10 @@
 #include "config.h"
 #include "JSPluginElementFunctions.h"
 
+#include "Bridge.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
 #include "JSHTMLElement.h"
-#include "runtime.h"
 #include "runtime_object.h"
 
 using namespace JSC;
@@ -35,7 +35,7 @@ using namespace HTMLNames;
 
 // Runtime object support code for JSHTMLAppletElement, JSHTMLEmbedElement and JSHTMLObjectElement.
 
-static Instance* pluginInstance(Node* node)
+Instance* pluginInstance(Node* node)
 {
     if (!node)
         return 0;
@@ -49,7 +49,7 @@ static Instance* pluginInstance(Node* node)
     return instance;
 }
 
-static RuntimeObjectImp* getRuntimeObject(ExecState* exec, Node* node)
+static RuntimeObject* getRuntimeObject(ExecState* exec, Node* node)
 {
     Instance* instance = pluginInstance(node);
     if (!instance)
@@ -57,19 +57,11 @@ static RuntimeObjectImp* getRuntimeObject(ExecState* exec, Node* node)
     return instance->createRuntimeObject(exec);
 }
 
-JSValue runtimeObjectGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue runtimeObjectPropertyGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slotBase));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
-    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
-    return runtimeObject ? runtimeObject : jsUndefined();
-}
-
-JSValue runtimeObjectPropertyGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
-    HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
-    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
+    RuntimeObject* runtimeObject = getRuntimeObject(exec, element);
     if (!runtimeObject)
         return jsUndefined();
     return runtimeObject->get(exec, propertyName);
@@ -77,7 +69,7 @@ JSValue runtimeObjectPropertyGetter(ExecState* exec, const Identifier& propertyN
 
 bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot, JSHTMLElement* element)
 {
-    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element->impl());
+    RuntimeObject* runtimeObject = getRuntimeObject(exec, element->impl());
     if (!runtimeObject)
         return false;
     if (!runtimeObject->hasProperty(exec, propertyName))
@@ -88,7 +80,7 @@ bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& pr
 
 bool runtimeObjectCustomGetOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, JSHTMLElement* element)
 {
-    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element->impl());
+    RuntimeObject* runtimeObject = getRuntimeObject(exec, element->impl());
     if (!runtimeObject)
         return false;
     if (!runtimeObject->hasProperty(exec, propertyName))
@@ -104,7 +96,7 @@ bool runtimeObjectCustomGetOwnPropertyDescriptor(ExecState* exec, const Identifi
 
 bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValue value, HTMLElement* element, PutPropertySlot& slot)
 {
-    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
+    RuntimeObject* runtimeObject = getRuntimeObject(exec, element);
     if (!runtimeObject)
         return 0;
     if (!runtimeObject->hasProperty(exec, propertyName))
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
index a5a323a27e..736ace9c6a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
@@ -22,6 +22,12 @@
 
 #include "JSDOMBinding.h"
 
+namespace JSC {
+namespace Bindings {
+class Instance;
+}
+}
+
 namespace WebCore {
 
     class HTMLElement;
@@ -29,9 +35,9 @@ namespace WebCore {
     class Node;
 
     // Runtime object support code for JSHTMLAppletElement, JSHTMLEmbedElement and JSHTMLObjectElement.
+    JSC::Bindings::Instance* pluginInstance(Node*);
 
-    JSC::JSValue runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-    JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
     bool runtimeObjectCustomGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&, JSHTMLElement*);
     bool runtimeObjectCustomGetOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, JSHTMLElement*);
     bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, HTMLElement*, JSC::PutPropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPopStateEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPopStateEventCustom.cpp
new file mode 100644
index 0000000000..3f5fd7ebad
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPopStateEventCustom.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "JSPopStateEvent.h"
+
+#include "PopStateEvent.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSPopStateEvent::initPopStateEvent(ExecState* exec, const ArgList& args)
+{
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    RefPtr<SerializedScriptValue> stateObjectArg = SerializedScriptValue::create(exec, args.at(3));
+    
+    PopStateEvent* event = static_cast<PopStateEvent*>(impl());
+    event->initPopStateEvent(typeArg, canBubbleArg, cancelableArg, stateObjectArg.release());
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
deleted file mode 100644
index 2ab2c003cd..0000000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ /dev/null
@@ -1,336 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSQuarantinedObjectWrapper.h"
-
-#include "JSDOMBinding.h"
-
-#include <runtime/JSGlobalObject.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSQuarantinedObjectWrapper);
-
-const ClassInfo JSQuarantinedObjectWrapper::s_info = { "JSQuarantinedObjectWrapper", 0, 0, 0 };
-
-JSQuarantinedObjectWrapper* JSQuarantinedObjectWrapper::asWrapper(JSValue value)
-{
-    if (!value.isObject())
-        return 0;
-
-    JSObject* object = asObject(value);
-
-    if (!object->inherits(&JSQuarantinedObjectWrapper::s_info))
-        return 0;
-
-    return static_cast<JSQuarantinedObjectWrapper*>(object);
-}
-
-JSValue JSQuarantinedObjectWrapper::cachedValueGetter(ExecState*, const Identifier&, const PropertySlot& slot)
-{
-    JSValue v = slot.slotBase();
-    ASSERT(v);
-    return v;
-}
-
-JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
-    : JSObject(structure)
-    , m_unwrappedGlobalObject(unwrappedExec->lexicalGlobalObject())
-    , m_unwrappedObject(unwrappedObject)
-{
-    ASSERT_ARG(unwrappedExec, unwrappedExec);
-    ASSERT_ARG(unwrappedObject, unwrappedObject);
-    ASSERT(this->structure());
-}
-
-JSQuarantinedObjectWrapper::~JSQuarantinedObjectWrapper()
-{
-}
-
-bool JSQuarantinedObjectWrapper::allowsUnwrappedAccessFrom(ExecState* exec) const
-{
-    return m_unwrappedGlobalObject->profileGroup() == exec->lexicalGlobalObject()->profileGroup();
-}
-
-ExecState* JSQuarantinedObjectWrapper::unwrappedExecState() const
-{
-    return m_unwrappedGlobalObject->globalExec();
-}
-
-void JSQuarantinedObjectWrapper::transferExceptionToExecState(ExecState* exec) const
-{
-    ASSERT(exec != unwrappedExecState());
-
-    if (!unwrappedExecState()->hadException())
-        return;
-
-    JSValue exception = unwrappedExecState()->exception();
-    unwrappedExecState()->clearException();
-    exec->setException(wrapOutgoingValue(unwrappedExecState(), exception));
-}
-
-void JSQuarantinedObjectWrapper::markChildren(MarkStack& markStack)
-{
-    JSObject::markChildren(markStack);
-
-    markStack.append(m_unwrappedObject);
-    markStack.append(m_unwrappedGlobalObject);
-}
-
-bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, const Identifier& identifier, PropertySlot& slot)
-{
-    if (!allowsGetProperty()) {
-        slot.setUndefined();
-        return true;
-    }
-
-    PropertySlot unwrappedSlot(m_unwrappedObject);
-    bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
-    if (result) {
-        JSValue unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
-        slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
-    }
-
-    transferExceptionToExecState(exec);
-
-    return result;
-}
-
-bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, unsigned identifier, PropertySlot& slot)
-{
-    if (!allowsGetProperty()) {
-        slot.setUndefined();
-        return true;
-    }
-
-    PropertySlot unwrappedSlot(m_unwrappedObject);
-    bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
-    if (result) {
-        JSValue unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
-        slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
-    }
-
-    transferExceptionToExecState(exec);
-
-    return result;
-}
-
-bool JSQuarantinedObjectWrapper::getOwnPropertyDescriptor(ExecState* exec, const Identifier& identifier, PropertyDescriptor& descriptor)
-{
-    if (!allowsGetProperty()) {
-        descriptor.setUndefined();
-        return true;
-    }
-
-    PropertyDescriptor unwrappedDescriptor;
-    bool result = m_unwrappedObject->getOwnPropertyDescriptor(unwrappedExecState(), identifier, unwrappedDescriptor);
-
-    if (unwrappedDescriptor.isAccessorDescriptor()) {
-        descriptor.setAccessorDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.getter()),
-                                         wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.setter()),
-                                         unwrappedDescriptor.attributes());
-    } else
-        descriptor.setDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.value()), unwrappedDescriptor.attributes());
-    transferExceptionToExecState(exec);
-    return result;
-}
-
-void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
-{
-    if (!allowsSetProperty())
-        return;
-
-    m_unwrappedObject->put(unwrappedExecState(), identifier, prepareIncomingValue(exec, value), slot);
-
-    transferExceptionToExecState(exec);
-}
-
-void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSValue value)
-{
-    if (!allowsSetProperty())
-        return;
-
-    m_unwrappedObject->put(unwrappedExecState(), identifier, prepareIncomingValue(exec, value));
-
-    transferExceptionToExecState(exec);
-}
-
-bool JSQuarantinedObjectWrapper::defineOwnProperty(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool shouldThrow)
-{
-    if (!allowsSetProperty())
-        return false;
-
-    PropertyDescriptor wrappedDescriptor;
-    if (descriptor.isDataDescriptor()) {
-        wrappedDescriptor.setValue(prepareIncomingValue(exec, descriptor.value()));
-        if (wrappedDescriptor.writablePresent())
-            wrappedDescriptor.setWritable(descriptor.writable());
-    } else if (descriptor.isAccessorDescriptor()) {
-        if (descriptor.getter())
-            wrappedDescriptor.setGetter(prepareIncomingValue(exec, descriptor.getter()));
-        if (descriptor.setter())
-            wrappedDescriptor.setSetter(prepareIncomingValue(exec, descriptor.setter()));
-    }
-    if (wrappedDescriptor.enumerablePresent())
-        wrappedDescriptor.setEnumerable(descriptor.enumerable());
-    if (wrappedDescriptor.configurablePresent())
-        wrappedDescriptor.setConfigurable(descriptor.configurable());
-    
-    bool result = m_unwrappedObject->defineOwnProperty(unwrappedExecState(), propertyName, wrappedDescriptor, shouldThrow);
-    
-    transferExceptionToExecState(exec);
-    return result;
-}
-
-bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, const Identifier& identifier)
-{
-    if (!allowsDeleteProperty())
-        return false;
-
-    bool result = m_unwrappedObject->deleteProperty(unwrappedExecState(), identifier);
-
-    transferExceptionToExecState(exec);
-
-    return result;
-}
-
-bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, unsigned identifier)
-{
-    if (!allowsDeleteProperty())
-        return false;
-
-    bool result = m_unwrappedObject->deleteProperty(unwrappedExecState(), identifier);
-
-    transferExceptionToExecState(exec);
-
-    return result;
-}
-
-JSObject* JSQuarantinedObjectWrapper::construct(ExecState* exec, JSObject* constructor, const ArgList& args)
-{
-    JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(constructor);
-
-    MarkedArgumentBuffer preparedArgs;
-    for (size_t i = 0; i < args.size(); ++i)
-        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(i)));
-
-    // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getConstructData
-    // from when we called it in JSQuarantinedObjectWrapper::getConstructData.
-    ConstructData unwrappedConstructData;
-    ConstructType unwrappedConstructType = wrapper->m_unwrappedObject->getConstructData(unwrappedConstructData);
-    ASSERT(unwrappedConstructType != ConstructTypeNone);
-
-    // FIXME: Quarantined objects are all in the debuggerWorld(), for now. Instead, we should remove the quarantined objects, & replace them with an isolated world?
-    JSValue unwrappedResult = constructInWorld(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs, debuggerWorld());
-
-    JSValue resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
-    ASSERT(resultValue.isObject());
-    JSObject* result = asObject(resultValue);
-
-    wrapper->transferExceptionToExecState(exec);
-
-    return result;
-}
-
-ConstructType JSQuarantinedObjectWrapper::getConstructData(ConstructData& constructData)
-{
-    if (!allowsConstruct())
-        return ConstructTypeNone;
-    ConstructData unwrappedConstructData;
-    if (m_unwrappedObject->getConstructData(unwrappedConstructData) == ConstructTypeNone)
-        return ConstructTypeNone;
-    constructData.native.function = construct;
-    return ConstructTypeHost;
-}
-
-bool JSQuarantinedObjectWrapper::hasInstance(ExecState* exec, JSValue value, JSValue proto)
-{
-    if (!allowsHasInstance())
-        return false;
-
-    bool result = m_unwrappedObject->hasInstance(unwrappedExecState(), prepareIncomingValue(exec, value), prepareIncomingValue(exec, proto));
-
-    transferExceptionToExecState(exec);
-
-    return result;
-}
-
-JSValue JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
-{
-    JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(function);
-
-    JSValue preparedThisValue = wrapper->prepareIncomingValue(exec, thisValue);
-
-    MarkedArgumentBuffer preparedArgs;
-    for (size_t i = 0; i < args.size(); ++i)
-        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(i)));
-
-    // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getCallData
-    // from when we called it in JSQuarantinedObjectWrapper::getCallData.
-    CallData unwrappedCallData;
-    CallType unwrappedCallType = wrapper->m_unwrappedObject->getCallData(unwrappedCallData);
-    ASSERT(unwrappedCallType != CallTypeNone);
-
-    // FIXME: Quarantined objects are all in the debuggerWorld(), for now. Instead, we should remove the quarantined objects, & replace them with an isolated world?
-    JSValue unwrappedResult = callInWorld(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs, debuggerWorld());
-
-    JSValue result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
-
-    wrapper->transferExceptionToExecState(exec);
-
-    return result;
-}
-
-CallType JSQuarantinedObjectWrapper::getCallData(CallData& callData)
-{
-    if (!allowsCallAsFunction())
-        return CallTypeNone;
-    CallData unwrappedCallData;
-    if (m_unwrappedObject->getCallData(unwrappedCallData) == CallTypeNone)
-        return CallTypeNone;
-    callData.native.function = call;
-    return CallTypeHost;
-}
-
-void JSQuarantinedObjectWrapper::getPropertyNames(ExecState*, PropertyNameArray& array)
-{
-    if (!allowsGetPropertyNames())
-        return;
-    
-    m_unwrappedObject->getPropertyNames(unwrappedExecState(), array);
-}
-
-void JSQuarantinedObjectWrapper::getOwnPropertyNames(ExecState*, PropertyNameArray& array)
-{
-    if (!allowsGetPropertyNames())
-        return;
-
-    m_unwrappedObject->getOwnPropertyNames(unwrappedExecState(), array);
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
deleted file mode 100644
index 9f624951c0..0000000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef JSQuarantinedObjectWrapper_h
-#define JSQuarantinedObjectWrapper_h
-
-#include <runtime/JSObject.h>
-
-namespace WebCore {
-
-    class JSQuarantinedObjectWrapper : public JSC::JSObject {
-    public:
-        static JSQuarantinedObjectWrapper* asWrapper(JSC::JSValue);
-
-        virtual ~JSQuarantinedObjectWrapper();
-
-        virtual JSC::JSObject* unwrappedObject() { return m_unwrappedObject; }
-
-        JSC::JSGlobalObject* unwrappedGlobalObject() const { return m_unwrappedGlobalObject; };
-        JSC::ExecState* unwrappedExecState() const;
-
-        bool allowsUnwrappedAccessFrom(JSC::ExecState*) const;
-
-        static const JSC::ClassInfo s_info;
-
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
-        { 
-            return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
-        }
-
-    protected:
-        static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::ImplementsHasInstance | JSC::OverridesHasInstance | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::JSObject::StructureFlags;
-
-        JSQuarantinedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
-
-        virtual void markChildren(JSC::MarkStack&);
-
-    private:
-        virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-        virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned, JSC::PropertySlot&);
-        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
-
-        virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
-        virtual void put(JSC::ExecState*, unsigned, JSC::JSValue);
-        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
-
-        virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
-        virtual bool deleteProperty(JSC::ExecState*, unsigned);
-
-        virtual JSC::CallType getCallData(JSC::CallData&);
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-
-        virtual bool hasInstance(JSC::ExecState*, JSC::JSValue, JSC::JSValue proto);
-        
-        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-
-        virtual JSC::UString className() const { return m_unwrappedObject->className(); }
-
-        virtual bool allowsGetProperty() const { return false; }
-        virtual bool allowsSetProperty() const { return false; }
-        virtual bool allowsDeleteProperty() const { return false; }
-        virtual bool allowsConstruct() const { return false; }
-        virtual bool allowsHasInstance() const { return false; }
-        virtual bool allowsCallAsFunction() const { return false; }
-        virtual bool allowsGetPropertyNames() const { return false; }
-
-        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const = 0;
-        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const = 0;
-
-        static JSC::JSValue cachedValueGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-        void transferExceptionToExecState(JSC::ExecState*) const;
-
-        static JSC::JSValue JSC_HOST_CALL call(JSC::ExecState*, JSC::JSObject* function, JSC::JSValue thisValue, const JSC::ArgList&);
-        static JSC::JSObject* construct(JSC::ExecState*, JSC::JSObject*, const JSC::ArgList&);
-
-        JSC::JSGlobalObject* m_unwrappedGlobalObject;
-        JSC::JSObject* m_unwrappedObject;
-    };
-
-} // namespace WebCore
-
-#endif // JSQuarantinedObjectWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGContextCache.h b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGContextCache.h
new file mode 100644
index 0000000000..75ed32449e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGContextCache.h
@@ -0,0 +1,97 @@
+/*
+    Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSSVGContextCache_h
+#define JSSVGContextCache_h
+
+#if ENABLE(SVG)
+#include "SVGElement.h"
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+class DOMObject;
+
+class JSSVGContextCache : public Noncopyable {
+public:
+    typedef HashMap<DOMObject*, SVGElement*> WrapperMap;
+
+    static WrapperMap& wrapperMap()
+    {
+        DEFINE_STATIC_LOCAL(WrapperMap, s_wrapperMap, ());
+        return s_wrapperMap;
+    }
+
+    static void addWrapper(DOMObject* wrapper, SVGElement* context)
+    {
+        ASSERT(wrapper);
+        ASSERT(context);
+
+        pair<WrapperMap::iterator, bool> result = wrapperMap().add(wrapper, context);
+        if (result.second) {
+            WrapperMap::iterator& it = result.first;
+            ASSERT_UNUSED(it, it->second == context);
+        }
+    }
+
+    static void forgetWrapper(DOMObject* wrapper)
+    {
+        ASSERT(wrapper);
+
+        WrapperMap& map = wrapperMap();
+        WrapperMap::iterator it = map.find(wrapper);
+        if (it == map.end())
+            return;
+
+        map.remove(it);
+    }
+
+    static void propagateSVGDOMChange(DOMObject* wrapper, const QualifiedName& attributeName)
+    {
+        WrapperMap& map = wrapperMap();
+        WrapperMap::iterator it = map.find(wrapper);
+        if (it == map.end())
+            return;
+
+        SVGElement* context = it->second;
+        ASSERT(context);
+
+        context->svgAttributeChanged(attributeName);
+    }
+
+    static SVGElement* svgContextForDOMObject(DOMObject* wrapper)
+    {
+        ASSERT(wrapper);
+
+        WrapperMap& map = wrapperMap();
+        WrapperMap::iterator it = map.find(wrapper);
+        if (it == map.end())
+            return 0;
+
+        SVGElement* context = it->second;
+        ASSERT(context);
+        return context;
+    }
+
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index ba1cf22703..b3bded5eb4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -43,9 +43,7 @@ void JSSVGElementInstance::markChildren(MarkStack& markStack)
     Base::markChildren(markStack);
 
     // Mark the wrapper for our corresponding element, so it can mark its event handlers.
-    JSNode* correspondingWrapper = getCachedDOMNodeWrapper(impl()->correspondingElement()->document(), impl()->correspondingElement());
-    if (correspondingWrapper)
-        markStack.append(correspondingWrapper);
+    markDOMNodeWrapper(markStack, impl()->correspondingElement()->document(), impl()->correspondingElement());
 }
 
 JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
@@ -54,7 +52,7 @@ JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& a
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -64,7 +62,7 @@ JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
index bad52ae698..33bbf30293 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
@@ -28,18 +28,22 @@ namespace WebCore {
 
 JSValue JSSVGLength::value(ExecState* exec) const
 {
-    SVGLength imp(*impl());
-    return jsNumber(exec, imp.value(context()));
+    JSSVGPODTypeWrapper<SVGLength>* imp = impl();
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(const_cast<JSSVGLength*>(this));
+
+    SVGLength podImp(*imp);
+    return jsNumber(exec, podImp.value(context));
 }
 
 JSValue JSSVGLength::convertToSpecifiedUnits(ExecState* exec, const ArgList& args)
 {
-    JSSVGPODTypeWrapper<SVGLength>* wrapper = impl();
+    JSSVGPODTypeWrapper<SVGLength>* imp = impl();
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    SVGLength imp(*wrapper);
-    imp.convertToSpecifiedUnits(args.at(0).toInt32(exec), context());
+    SVGLength podImp(*imp);
+    podImp.convertToSpecifiedUnits(args.at(0).toInt32(exec), context);
 
-    wrapper->commitChange(imp, context());
+    imp->commitChange(podImp, this);
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
index 35390b229f..59e3f03f2a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2009 Jeff Schiller <codedread@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,17 +23,37 @@
 #if ENABLE(SVG)
 #include "JSSVGMatrix.h"
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "SVGException.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
+JSValue JSSVGMatrix::multiply(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    if (!args.at(0).inherits(&JSSVGMatrix::s_info))
+        return throwError(exec, TypeError, "secondMatrix argument was not a SVGMatrix");
+
+    JSSVGMatrix* matrixObj = static_cast<JSSVGMatrix*>(asObject(args.at(0)));
+
+    AffineTransform m1(*impl());
+    AffineTransform m2(*(matrixObj->impl()));
+
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
+    return toJS(exec, globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(m1.multLeft(m2)).get(), context);
+}
+
 JSValue JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
 {
-    TransformationMatrix imp(*impl());
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.inverse()).get(), m_context.get());
+    AffineTransform imp(*impl());
+
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
+    JSValue result = toJS(exec, globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.inverse()).get(), context);
 
     if (!imp.isInvertible())
         setDOMException(exec, SVGException::SVG_MATRIX_NOT_INVERTABLE);
@@ -42,12 +63,13 @@ JSValue JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
 
 JSValue JSSVGMatrix::rotateFromVector(ExecState* exec, const ArgList& args)
 {
-    TransformationMatrix imp(*impl());
+    AffineTransform imp(*impl());
  
     float x = args.at(0).toFloat(exec);
     float y = args.at(1).toFloat(exec);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotateFromVector(x, y)).get(), m_context.get());
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
+    JSValue result = toJS(exec, globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.rotateFromVector(x, y)).get(), context);
 
     if (x == 0.0 || y == 0.0)
         setDOMException(exec, SVGException::SVG_INVALID_VALUE_ERR);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODListCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODListCustom.h
new file mode 100644
index 0000000000..8a0654c44b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODListCustom.h
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef JSSVGPODListCustom_h
+#define JSSVGPODListCustom_h
+
+#include "JSSVGContextCache.h"
+#include "JSSVGPODTypeWrapper.h"
+#include "SVGList.h"
+
+namespace WebCore {
+
+namespace JSSVGPODListCustom {
+
+// Helper structure only containing public typedefs, as C++ does not allow templatized typedefs
+template<typename PODType>
+struct JSSVGPODListTraits { 
+    typedef SVGPODListItem<PODType> PODListItem;
+    typedef SVGList<RefPtr<PODListItem> > PODList;
+    typedef PODType (*ConversionCallback)(JSC::JSValue);
+};
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue finishGetter(JSC::ExecState* exec, ExceptionCode& ec, JSPODListType* wrapper,
+                                 PassRefPtr<typename JSSVGPODListTraits<PODType>::PODListItem> item)
+{
+    if (ec) {
+        setDOMException(exec, ec);
+        return JSC::jsUndefined();
+    }
+    
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(wrapper);
+    return toJS(exec, wrapper->globalObject(),
+                JSSVGPODTypeWrapperCreatorForList<PODType>::create(item.get(), listImp->associatedAttributeName()).get(), context);
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue finishSetter(JSC::ExecState* exec, ExceptionCode& ec, JSPODListType* wrapper,                                
+                                 PassRefPtr<typename JSSVGPODListTraits<PODType>::PODListItem> item)
+{
+    if (ec) {
+        setDOMException(exec, ec);
+        return JSC::jsUndefined();
+    }
+
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+
+    const QualifiedName& attributeName = listImp->associatedAttributeName();
+    JSSVGContextCache::propagateSVGDOMChange(wrapper, attributeName);
+
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(wrapper);
+    return toJS(exec, wrapper->globalObject(),
+                JSSVGPODTypeWrapperCreatorForList<PODType>::create(item.get(), attributeName).get(), context);
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue finishSetterReadOnlyResult(JSC::ExecState* exec, ExceptionCode& ec, JSPODListType* wrapper,                                
+                                               PassRefPtr<typename JSSVGPODListTraits<PODType>::PODListItem> item)
+{
+    if (ec) {
+        setDOMException(exec, ec);
+        return JSC::jsUndefined();
+    }
+
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    JSSVGContextCache::propagateSVGDOMChange(wrapper, listImp->associatedAttributeName());
+    return toJS(exec, wrapper->globalObject(),
+                JSSVGStaticPODTypeWrapper<PODType>::create(*item).get(), 0  /* no context on purpose */);
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue clear(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList&,
+                          typename JSSVGPODListTraits<PODType>::ConversionCallback)
+{
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    listImp->clear(ec);
+
+    if (ec)
+        setDOMException(exec, ec);
+    else
+        JSSVGContextCache::propagateSVGDOMChange(wrapper, listImp->associatedAttributeName());
+
+    return JSC::jsUndefined();
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue initialize(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                               typename JSSVGPODListTraits<PODType>::ConversionCallback conversion)
+{
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishSetter<JSPODListType, PODType>(exec, ec, wrapper,
+                                                listImp->initialize(JSSVGPODListTraits<PODType>::PODListItem::copy(conversion(args.at(0))), ec));
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue getItem(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                            typename JSSVGPODListTraits<PODType>::ConversionCallback)
+{
+    bool indexOk = false;
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return JSC::jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishGetter<JSPODListType, PODType>(exec, ec, wrapper,
+                                                listImp->getItem(index, ec));
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue insertItemBefore(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                                     typename JSSVGPODListTraits<PODType>::ConversionCallback conversion)
+{
+    bool indexOk = false;
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return JSC::jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishSetter<JSPODListType, PODType>(exec, ec, wrapper,
+                                                listImp->insertItemBefore(JSSVGPODListTraits<PODType>::PODListItem::copy(conversion(args.at(0))), index, ec));
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue replaceItem(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                                typename JSSVGPODListTraits<PODType>::ConversionCallback conversion)
+{
+    bool indexOk = false;
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return JSC::jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishSetter<JSPODListType, PODType>(exec, ec, wrapper,
+                                                listImp->replaceItem(JSSVGPODListTraits<PODType>::PODListItem::copy(conversion(args.at(0))), index, ec));
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue removeItem(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                               typename JSSVGPODListTraits<PODType>::ConversionCallback)
+{
+    bool indexOk = false;
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return JSC::jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishSetterReadOnlyResult<JSPODListType, PODType>(exec, ec, wrapper,
+                                                              listImp->removeItem(index, ec));
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue appendItem(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                               typename JSSVGPODListTraits<PODType>::ConversionCallback conversion)
+{
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishSetter<JSPODListType, PODType>(exec, ec, wrapper,
+                                                listImp->appendItem(JSSVGPODListTraits<PODType>::PODListItem::copy(conversion(args.at(0))), ec));
+}
+
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
index 51e4e9e64b..2efc60ea7c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
@@ -28,28 +28,31 @@
 #define JSSVGPODTypeWrapper_h
 
 #if ENABLE(SVG)
+#include "JSSVGContextCache.h"
 #include "SVGElement.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
+class DOMObject;
+
 template<typename PODType>
 class JSSVGPODTypeWrapper : public RefCounted<JSSVGPODTypeWrapper<PODType> > {
 public:
     virtual ~JSSVGPODTypeWrapper() { }
 
     virtual operator PODType() = 0;
-    virtual void commitChange(PODType, SVGElement*) = 0;
+    virtual void commitChange(PODType, DOMObject*) = 0;
 };
 
 // This file contains JS wrapper objects for SVG datatypes, that are passed around by value
-// in WebCore/svg (aka. 'POD types'). For instance SVGMatrix is mapped to TransformationMatrix, and
+// in WebCore/svg (aka. 'POD types'). For instance SVGMatrix is mapped to AffineTransform, and
 // passed around as const reference. SVG DOM demands these objects to be "live", changes to any
 // of the writable attributes of SVGMatrix need to be reflected in the object which exposed the
-// SVGMatrix object (ie. 'someElement.transform.matrix.a = 50.0', in that case 'SVGTransform').
-// The SVGTransform class stores its "TransformationMatrix m_matrix" object on the stack. If it would
+// SVGMatrix object (i.e. 'someElement.transform.matrix.a = 50.0', in that case 'SVGTransform').
+// The SVGTransform class stores its "AffineTransform m_matrix" object on the stack. If it would
 // be stored as pointer we could just build an auto-generated JSSVG* wrapper object around it
-// and all changes to that object would automatically affect the TransformationMatrix* object stored
+// and all changes to that object would automatically affect the AffineTransform* object stored
 // in the SVGTransform object. For the sake of efficiency and memory we don't pass around any
 // primitive values as pointers, so a custom JS wrapper object is needed for all SVG types, that
 // are internally represented by POD types (SVGRect <-> FloatRect, SVGPoint <-> FloatPoint, ...).
@@ -68,13 +71,13 @@ public:
 // GetterMethod and SetterMethod are each 12 bytes. We have to pack to a size
 // greater than or equal to that to avoid an alignment warning (C4121). 16 is
 // the next-largest size allowed for packing, so we use that.
-#pragma pack(16)
+#pragma pack(push, 16)
 #endif
 template<typename PODType, typename PODTypeCreator>
 class JSSVGDynamicPODTypeWrapper : public JSSVGPODTypeWrapper<PODType> {
 public:
     typedef PODType (PODTypeCreator::*GetterMethod)() const; 
-    typedef void (PODTypeCreator::*SetterMethod)(PODType);
+    typedef void (PODTypeCreator::*SetterMethod)(const PODType&);
 
     static PassRefPtr<JSSVGDynamicPODTypeWrapper> create(PassRefPtr<PODTypeCreator> creator, GetterMethod getter, SetterMethod setter)
     {
@@ -86,12 +89,10 @@ public:
         return (m_creator.get()->*m_getter)();
     }
 
-    virtual void commitChange(PODType type, SVGElement* context)
+    virtual void commitChange(PODType type, DOMObject* wrapper)
     {
         (m_creator.get()->*m_setter)(type);
-
-        if (context)
-            context->svgAttributeChanged(m_creator->associatedAttributeName());
+        JSSVGContextCache::propagateSVGDOMChange(wrapper, m_creator->associatedAttributeName());
     }
 
 private:
@@ -105,15 +106,20 @@ private:
         ASSERT(m_setter);
     }
 
+    virtual ~JSSVGDynamicPODTypeWrapper();
+
     // Update callbacks
     RefPtr<PODTypeCreator> m_creator;
     GetterMethod m_getter;
     SetterMethod m_setter;
 };
+#if COMPILER(MSVC)
+#pragma pack(pop)
+#endif
 
-// Represents a JS wrapper object for SVG POD types (not for SVGAnimated* clases). Any modification to the SVG POD
+// Represents a JS wrapper object for SVG POD types (not for SVGAnimated* classes). Any modification to the SVG POD
 // types don't cause any updates unlike JSSVGDynamicPODTypeWrapper. This class is used for return values (ie. getBBox())
-// and for properties where SVG specification explicitely states, that the contents of the POD type are immutable.
+// and for properties where SVG specification explicitly states, that the contents of the POD type are immutable.
 
 template<typename PODType>
 class JSSVGStaticPODTypeWrapper : public JSSVGPODTypeWrapper<PODType> {
@@ -128,7 +134,7 @@ public:
         return m_podType;
     }
 
-    virtual void commitChange(PODType type, SVGElement*)
+    virtual void commitChange(PODType type, DOMObject*)
     {
         m_podType = type;
     }
@@ -152,10 +158,10 @@ public:
         return adoptRef(new JSSVGStaticPODTypeWrapperWithPODTypeParent(type, parent));
     }
 
-    virtual void commitChange(PODType type, SVGElement* context)
+    virtual void commitChange(PODType type, DOMObject* wrapper)
     {
-        JSSVGStaticPODTypeWrapper<PODType>::commitChange(type, context);
-        m_parentType->commitChange(ParentTypeArg(type), context);    
+        JSSVGStaticPODTypeWrapper<PODType>::commitChange(type, wrapper);
+        m_parentType->commitChange(ParentTypeArg(type), wrapper);
     }
 
 private:
@@ -172,7 +178,7 @@ private:
 // GetterMethod and SetterMethod are each 12 bytes. We have to pack to a size
 // greater than or equal to that to avoid an alignment warning (C4121). 16 is
 // the next-largest size allowed for packing, so we use that.
-#pragma pack(16)
+#pragma pack(push, 16)
 #endif
 template<typename PODType, typename ParentType>
 class JSSVGStaticPODTypeWrapperWithParent : public JSSVGPODTypeWrapper<PODType> {
@@ -190,7 +196,7 @@ public:
         return (m_parent.get()->*m_getter)();
     }
 
-    virtual void commitChange(PODType type, SVGElement*)
+    virtual void commitChange(PODType type, DOMObject*)
     {
         (m_parent.get()->*m_setter)(type);
     }
@@ -223,7 +229,7 @@ public:
     typedef SVGPODListItem<PODType> PODListItemPtrType;
 
     typedef PODType (SVGPODListItem<PODType>::*GetterMethod)() const; 
-    typedef void (SVGPODListItem<PODType>::*SetterMethod)(PODType);
+    typedef void (SVGPODListItem<PODType>::*SetterMethod)(const PODType&);
 
     static PassRefPtr<JSSVGPODTypeWrapperCreatorForList> create(PassRefPtr<PODListItemPtrType> creator, const QualifiedName& attributeName)
     {
@@ -235,15 +241,13 @@ public:
         return (m_creator.get()->*m_getter)();
     }
 
-    virtual void commitChange(PODType type, SVGElement* context)
+    virtual void commitChange(PODType type, DOMObject* wrapper)
     {
         if (!m_setter)
             return;
 
         (m_creator.get()->*m_setter)(type);
-
-        if (context)
-            context->svgAttributeChanged(m_associatedAttributeName);
+        JSSVGContextCache::propagateSVGDOMChange(wrapper, m_associatedAttributeName);
     }
 
 private:
@@ -269,7 +273,7 @@ private:
 template<typename PODType, typename PODTypeCreator>
 struct PODTypeWrapperCacheInfo {
     typedef PODType (PODTypeCreator::*GetterMethod)() const; 
-    typedef void (PODTypeCreator::*SetterMethod)(PODType);
+    typedef void (PODTypeCreator::*SetterMethod)(const PODType&);
 
     // Empty value
     PODTypeWrapperCacheInfo()
@@ -309,6 +313,9 @@ struct PODTypeWrapperCacheInfo {
     GetterMethod getter;
     SetterMethod setter;
 };
+#if COMPILER(MSVC)
+#pragma pack(pop)
+#endif
 
 template<typename PODType, typename PODTypeCreator>
 struct PODTypeWrapperCacheInfoHash {
@@ -351,60 +358,53 @@ struct PODTypeWrapperCacheInfoTraits : WTF::GenericHashTraits<PODTypeWrapperCach
     }
 };
 
+// Used for dynamic read-write attributes
 template<typename PODType, typename PODTypeCreator>
 class JSSVGDynamicPODTypeWrapperCache {
 public:
     typedef PODType (PODTypeCreator::*GetterMethod)() const; 
-    typedef void (PODTypeCreator::*SetterMethod)(PODType);
+    typedef void (PODTypeCreator::*SetterMethod)(const PODType&);
 
     typedef PODTypeWrapperCacheInfo<PODType, PODTypeCreator> CacheInfo;
     typedef PODTypeWrapperCacheInfoHash<PODType, PODTypeCreator> CacheInfoHash;
     typedef PODTypeWrapperCacheInfoTraits<PODType, PODTypeCreator> CacheInfoTraits;
 
     typedef JSSVGPODTypeWrapper<PODType> WrapperBase;
-    typedef JSSVGDynamicPODTypeWrapper<PODType, PODTypeCreator> DynamicWrapper;
-    typedef HashMap<CacheInfo, DynamicWrapper*, CacheInfoHash, CacheInfoTraits> DynamicWrapperHashMap;
-    typedef typename DynamicWrapperHashMap::const_iterator DynamicWrapperHashMapIterator;
+    typedef JSSVGDynamicPODTypeWrapper<PODType, PODTypeCreator> Wrapper;
+    typedef HashMap<CacheInfo, Wrapper*, CacheInfoHash, CacheInfoTraits> WrapperMap;
 
-    static DynamicWrapperHashMap& dynamicWrapperHashMap()
+    static WrapperMap& wrapperMap()
     {
-        DEFINE_STATIC_LOCAL(DynamicWrapperHashMap, s_dynamicWrapperHashMap, ());
-        return s_dynamicWrapperHashMap;
+        DEFINE_STATIC_LOCAL(WrapperMap, s_wrapperMap, ());
+        return s_wrapperMap;
     }
 
-    // Used for readwrite attributes only
     static PassRefPtr<WrapperBase> lookupOrCreateWrapper(PODTypeCreator* creator, GetterMethod getter, SetterMethod setter)
     {
-        DynamicWrapperHashMap& map(dynamicWrapperHashMap());
         CacheInfo info(creator, getter, setter);
+        pair<typename WrapperMap::iterator, bool> result = wrapperMap().add(info, 0);
+        if (!result.second) // pre-existing entry
+            return result.first->second;
 
-        if (map.contains(info))
-            return map.get(info);
-
-        RefPtr<DynamicWrapper> wrapper = DynamicWrapper::create(creator, getter, setter);
-        map.set(info, wrapper.get());
+        RefPtr<Wrapper> wrapper = Wrapper::create(creator, getter, setter);
+        result.first->second = wrapper.get();
         return wrapper.release();
     }
 
-    static void forgetWrapper(WrapperBase* wrapper)
+    static void forgetWrapper(PODTypeCreator* creator, GetterMethod getter, SetterMethod setter)
     {
-        DynamicWrapperHashMap& map(dynamicWrapperHashMap());
-
-        DynamicWrapperHashMapIterator it = map.begin();
-        DynamicWrapperHashMapIterator end = map.end();
-
-        for (; it != end; ++it) {
-            if (it->second != wrapper)
-                continue;
-
-            // It's guaranteed that there's just one object we need to take care of.
-            map.remove(it->first);
-            break;
-        }
+        CacheInfo info(creator, getter, setter);
+        wrapperMap().remove(info);
     }
 };
 
-};
+template<typename PODType, typename PODTypeCreator>
+JSSVGDynamicPODTypeWrapper<PODType, PODTypeCreator>::~JSSVGDynamicPODTypeWrapper()
+{
+    JSSVGDynamicPODTypeWrapperCache<PODType, PODTypeCreator>::forgetWrapper(m_creator.get(), m_getter, m_setter);
+}
+
+} // namespace WebCore
 
 #endif // ENABLE(SVG)
 #endif // JSSVGPODTypeWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
index 42fa878fe2..eac2c4bd46 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
@@ -21,6 +21,8 @@
 
 #if ENABLE(SVG)
 #include "JSSVGPathSeg.h"
+
+#include "JSDOMBinding.h"
 #include "JSSVGPathSegArcAbs.h"
 #include "JSSVGPathSegArcRel.h"
 #include "JSSVGPathSegClosePath.h"
@@ -40,9 +42,6 @@
 #include "JSSVGPathSegLinetoVerticalRel.h"
 #include "JSSVGPathSegMovetoAbs.h"
 #include "JSSVGPathSegMovetoRel.h"
-
-#include "JSDOMBinding.h"
-
 #include "SVGPathSeg.h"
 #include "SVGPathSegArc.h"
 #include "SVGPathSegClosePath.h"
@@ -64,8 +63,10 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, SVGPathSeg* objec
     if (!object)
         return jsNull();
 
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object)) {
+        ASSERT(JSSVGContextCache::svgContextForDOMObject(wrapper) == context);
         return wrapper;
+    }
 
     switch (object->pathSegType()) {
     case SVGPathSeg::PATHSEG_CLOSEPATH:
@@ -115,5 +116,3 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, SVGPathSeg* objec
 }
 
 #endif // ENABLE(SVG)
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
index b71f3a6416..48317277b9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
@@ -24,6 +24,7 @@
 
 #include "Document.h"
 #include "Frame.h"
+#include "JSSVGContextCache.h"
 #include "JSSVGPathSeg.h"
 #include "SVGDocumentExtensions.h"
 #include "SVGElement.h"
@@ -39,12 +40,12 @@ JSValue JSSVGPathSegList::clear(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
-    imp->clear(ec);
+    SVGPathSegList* list = impl();
+    list->clear(ec);
 
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return jsUndefined();
 }
 
@@ -53,14 +54,15 @@ JSValue JSSVGPathSegList::initialize(ExecState* exec, const ArgList& args)
     ExceptionCode ec = 0;
     SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSegList* list = impl();
 
-    SVGPathSeg* obj = WTF::getPtr(imp->initialize(newItem, ec));
+    SVGPathSeg* obj = WTF::getPtr(list->initialize(newItem, ec));
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), obj, m_context.get());
+    JSValue result = toJS(exec, globalObject(), obj, context);
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return result;
 }
 
@@ -75,10 +77,11 @@ JSValue JSSVGPathSegList::getItem(ExecState* exec, const ArgList& args)
         return jsUndefined();
     }
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
-    SVGPathSeg* obj = WTF::getPtr(imp->getItem(index, ec));
+    SVGPathSegList* list = impl();
+    SVGPathSeg* obj = WTF::getPtr(list->getItem(index, ec));
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), obj, m_context.get());
+    JSValue result = toJS(exec, globalObject(), obj, context);
     setDOMException(exec, ec);
     return result;
 }
@@ -95,12 +98,13 @@ JSValue JSSVGPathSegList::insertItemBefore(ExecState* exec, const ArgList& args)
         return jsUndefined();
     }
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSegList* list = impl();
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->insertItemBefore(newItem, index, ec)), m_context.get());
+    JSValue result = toJS(exec, globalObject(), WTF::getPtr(list->insertItemBefore(newItem, index, ec)), context);
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return result;
 }
 
@@ -116,12 +120,13 @@ JSValue JSSVGPathSegList::replaceItem(ExecState* exec, const ArgList& args)
         return jsUndefined();
     }
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSegList* list = impl();
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->replaceItem(newItem, index, ec)), m_context.get());
+    JSValue result = toJS(exec, globalObject(), WTF::getPtr(list->replaceItem(newItem, index, ec)), context);
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return result;
 }
 
@@ -136,14 +141,15 @@ JSValue JSSVGPathSegList::removeItem(ExecState* exec, const ArgList& args)
         return jsUndefined();
     }
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSegList* list = impl();
 
-    RefPtr<SVGPathSeg> obj(imp->removeItem(index, ec));
+    RefPtr<SVGPathSeg> obj(list->removeItem(index, ec));
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), obj.get(), m_context.get());
+    JSValue result = toJS(exec, globalObject(), obj.get(), context);
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return result;
 }
 
@@ -152,12 +158,13 @@ JSValue JSSVGPathSegList::appendItem(ExecState* exec, const ArgList& args)
     ExceptionCode ec = 0;
     SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSegList* list = impl();
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->appendItem(newItem, ec)), m_context.get());
+    JSValue result = toJS(exec, globalObject(), WTF::getPtr(list->appendItem(newItem, ec)), context);
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp
deleted file mode 100644
index 1969fe2849..0000000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
- * Copyright (C) 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "JSSVGPointList.h"
-
-#include "JSSVGPoint.h"
-#include "SVGPointList.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-typedef SVGPODListItem<FloatPoint> PODListItem;
-typedef SVGList<RefPtr<PODListItem> > SVGPointListBase;
-
-static JSValue finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), list->associatedAttributeName()).get(), context);
-}
-
-static JSValue finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    const QualifiedName& attributeName = list->associatedAttributeName();
-    context->svgAttributeChanged(attributeName);
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), attributeName).get(), context);
-}
-
-static JSValue finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem> item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    context->svgAttributeChanged(list->associatedAttributeName());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<FloatPoint>::create(*item).get(), context);
-}
-
-JSValue JSSVGPointList::clear(ExecState* exec, const ArgList&)
-{
-    ExceptionCode ec = 0;
-    impl()->clear(ec);
-    setDOMException(exec, ec);
-    m_context->svgAttributeChanged(impl()->associatedAttributeName());
-    return jsUndefined();
-}
-
-JSValue JSSVGPointList::initialize(ExecState* exec, const ArgList& args)
-{
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->initialize(PODListItem::copy(toSVGPoint(args.at(0))), ec));
-}
-
-JSValue JSSVGPointList::getItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(0).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishGetter(exec, ec, context(), impl(),
-        listImp->getItem(index, ec));
-}
-
-JSValue JSSVGPointList::insertItemBefore(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(1).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->insertItemBefore(PODListItem::copy(toSVGPoint(args.at(0))), index, ec));
-}
-
-JSValue JSSVGPointList::replaceItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(1).toInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->replaceItem(PODListItem::copy(toSVGPoint(args.at(0))), index, ec));
-}
-
-JSValue JSSVGPointList::removeItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(0).toInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishSetterReadOnlyResult(exec, ec, context(), impl(),
-        listImp->removeItem(index, ec));
-}
-
-JSValue JSSVGPointList::appendItem(ExecState* exec, const ArgList& args)
-{
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->appendItem(PODListItem::copy(toSVGPoint(args.at(0))), ec));
-}
-
-}
-
-#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp
deleted file mode 100644
index 1a9110a9a6..0000000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "JSSVGTransformList.h"
-
-#include "JSSVGTransform.h"
-#include "SVGTransformList.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-typedef SVGPODListItem<SVGTransform> PODListItem;
-typedef SVGList<RefPtr<PODListItem> > SVGTransformListBase;
-
-static JSValue finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), list->associatedAttributeName()).get(), context);
-}
-
-static JSValue finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    const QualifiedName& attributeName = list->associatedAttributeName();
-    context->svgAttributeChanged(attributeName);
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), attributeName).get(), context);
-}
-
-static JSValue finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    context->svgAttributeChanged(list->associatedAttributeName());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<SVGTransform>::create(*item).get(), context);
-}
-
-JSValue JSSVGTransformList::clear(ExecState* exec, const ArgList&)
-{
-    ExceptionCode ec = 0;
-    impl()->clear(ec);
-    setDOMException(exec, ec);
-    m_context->svgAttributeChanged(impl()->associatedAttributeName());
-    return jsUndefined();
-}
-
-JSValue JSSVGTransformList::initialize(ExecState* exec, const ArgList& args)
-{
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->initialize(PODListItem::copy(toSVGTransform(args.at(0))), ec));
-}
-
-JSValue JSSVGTransformList::getItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(0).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishGetter(exec, ec, context(), impl(),
-        listImp->getItem(index, ec));
-}
-
-JSValue JSSVGTransformList::insertItemBefore(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(1).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->insertItemBefore(PODListItem::copy(toSVGTransform(args.at(0))), index, ec));
-}
-
-JSValue JSSVGTransformList::replaceItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(1).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->replaceItem(PODListItem::copy(toSVGTransform(args.at(0))), index, ec));
-}
-
-JSValue JSSVGTransformList::removeItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(0).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishSetterReadOnlyResult(exec, ec, context(), impl(),
-        listImp->removeItem(index, ec));
-}
-
-JSValue JSSVGTransformList::appendItem(ExecState* exec, const ArgList& args)
-{
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->appendItem(PODListItem::copy(toSVGTransform(args.at(0))), ec));
-}
-
-}
-
-#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
index e416d358c8..63a38d692f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
@@ -41,9 +41,9 @@ bool JSStorage::canGetItemsForName(ExecState*, Storage* impl, const Identifier&
     return impl->contains(propertyName);
 }
 
-JSValue JSStorage::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStorage::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSStorage* thisObj = static_cast<JSStorage*>(asObject(slot.slotBase()));
+    JSStorage* thisObj = static_cast<JSStorage*>(asObject(slotBase));
     return jsStringOrNull(exec, thisObj->impl()->getItem(propertyName));
 }
 
@@ -64,13 +64,13 @@ bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return true;
 }
 
-void JSStorage::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSStorage::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     unsigned length = m_impl->length();
     for (unsigned i = 0; i < length; ++i)
         propertyNames.add(Identifier(exec, m_impl->key(i)));
         
-    Base::getOwnPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 bool JSStorage::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
index d711b6fe3b..ecfc6a63c5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -40,7 +40,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, StyleSheet* style
     if (!styleSheet)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), styleSheet);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, styleSheet);
     if (wrapper)
         return wrapper;
 
@@ -68,10 +68,8 @@ void JSStyleSheet::markChildren(MarkStack& markStack)
     // is kept around, then we want the node to stay around too. One possibility would
     // be to make ref/deref on the style sheet ref/deref the node instead, but there's
     // a lot of disentangling of the CSS DOM objects that would need to happen first.
-    if (Node* ownerNode = sheet->ownerNode()) {
-        if (JSNode* ownerNodeWrapper = getCachedDOMNodeWrapper(ownerNode->document(), ownerNode))
-            markStack.append(ownerNodeWrapper);
-    }
+    if (Node* ownerNode = sheet->ownerNode())
+        markDOMNodeWrapper(markStack, ownerNode->document(), ownerNode);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
index 7bf93890df..873f2114c6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
@@ -52,9 +52,9 @@ bool JSStyleSheetList::canGetItemsForName(ExecState*, StyleSheetList* styleSheet
     return styleSheetList->getNamedItem(propertyName);
 }
 
-JSValue JSStyleSheetList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStyleSheetList::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSStyleSheetList* thisObj = static_cast<JSStyleSheetList*>(asObject(slot.slotBase()));
+    JSStyleSheetList* thisObj = static_cast<JSStyleSheetList*>(asObject(slotBase));
     HTMLStyleElement* element = thisObj->impl()->getNamedItem(propertyName);
     ASSERT(element);
     return toJS(exec, element->sheet());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayBufferConstructor.cpp
index 93d53cae89..8671908fbe 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayBufferConstructor.cpp
@@ -27,28 +27,27 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasArrayBufferConstructor.h"
+#include "JSWebGLArrayBufferConstructor.h"
 
 #include "Document.h"
-#include "CanvasArrayBuffer.h"
-#include "JSCanvasArrayBuffer.h"
+#include "JSWebGLArrayBuffer.h"
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasArrayBufferConstructor::s_info = { "CanvasArrayBufferConstructor", 0, 0, 0 };
+const ClassInfo JSWebGLArrayBufferConstructor::s_info = { "WebGLArrayBufferConstructor", 0, 0, 0 };
 
-JSCanvasArrayBufferConstructor::JSCanvasArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLArrayBufferConstructor::JSWebGLArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasArrayBufferPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLArrayBufferPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasArrayBufferConstructor* jsConstructor = static_cast<JSCanvasArrayBufferConstructor*>(constructor);
+    JSWebGLArrayBufferConstructor* jsConstructor = static_cast<JSWebGLArrayBufferConstructor*>(constructor);
 
     unsigned int size = 0;
     if (args.size() == 1) {
@@ -56,10 +55,15 @@ static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* construct
         if (isnan(size))
             size = 0;
     }
-    return asObject(toJS(exec, jsConstructor->globalObject(), CanvasArrayBuffer::create(size)));
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(size, 1);
+    if (!buffer.get()){
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
+    return asObject(toJS(exec, jsConstructor->globalObject(), buffer.get()));
 }
 
-JSC::ConstructType JSCanvasArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasArrayBuffer;
     return ConstructTypeHost;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayBufferConstructor.h
index 5f1254ed96..c7a927ee75 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayBufferConstructor.h
@@ -23,26 +23,27 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasArrayBufferConstructor_h
-#define JSCanvasArrayBufferConstructor_h
+#ifndef JSWebGLArrayBufferConstructor_h
+#define JSWebGLArrayBufferConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
-#include "JSCanvasArrayBuffer.h"
+#include "JSWebGLArrayBuffer.h"
 #include <runtime/Error.h>
+#include "WebGLArrayBuffer.h"
 
 namespace WebCore {
 
-    class CanvasArray;
+    class WebGLArray;
 
     // Template function used by CanvasXXXArrayConstructors
     template<class C, typename T>
-    PassRefPtr<CanvasArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
+    PassRefPtr<WebGLArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
     {
         // There are 3 constructors:
         //
         //  1) (in int size)
-        //  2) (in CanvasArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
+        //  2) (in WebGLArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
         //  3) (in sequence<T>) - This ends up being a JS "array-like" object
         //
         RefPtr<C> arrayObject;
@@ -51,24 +52,30 @@ namespace WebCore {
         if (args.size() < 1)
             return C::create(0, 0, 0);
         
+        if (args.size() > 1 && !args.at(0).isObject())
+            // Invalid first argument
+            return 0;
+
         if (args.at(0).isObject()) {
-            RefPtr<CanvasArrayBuffer> buffer = toCanvasArrayBuffer(args.at(0));
+            RefPtr<WebGLArrayBuffer> buffer = toWebGLArrayBuffer(args.at(0));
             if (buffer) {
-                int offset = (args.size() > 1) ? args.at(1).toInt32(exec) : 0;
-                unsigned int length = (args.size() > 2) ? static_cast<unsigned int>(args.at(2).toInt32(exec)) : 0;
+                unsigned offset = (args.size() > 1) ? args.at(1).toUInt32(exec) : 0;
+                unsigned int length = (buffer->byteLength() - offset) / sizeof(T);
+                if (args.size() > 2)
+                    length = args.at(2).toUInt32(exec);
                 return C::create(buffer, offset, length);
             }
             
             JSC::JSObject* array = asObject(args.at(0));
-            int length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+            unsigned length = array->get(exec, JSC::Identifier(exec, "length")).toUInt32(exec);
             void* tempValues;
-            if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues)) {
+            if (!tryFastCalloc(length, sizeof(T)).getValue(tempValues)) {
                 throwError(exec, JSC::GeneralError);
                 return 0;
             }
             
             OwnFastMallocPtr<T> values(static_cast<T*>(tempValues));
-            for (int i = 0; i < length; ++i) {
+            for (unsigned i = 0; i < length; ++i) {
                 JSC::JSValue v = array->get(exec, i);
                 if (exec->hadException())
                     return 0;
@@ -78,13 +85,13 @@ namespace WebCore {
             return C::create(values.get(), length);
         }
         
-        unsigned size = static_cast<unsigned>(args.at(0).toInt32(exec));
+        unsigned size = args.at(0).toUInt32(exec);
         return C::create(size);
     }
 
-    class JSCanvasArrayBufferConstructor : public DOMConstructorObject {
+    class JSWebGLArrayBufferConstructor : public DOMConstructorObject {
     public:
-        JSCanvasArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -94,4 +101,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasArrayBufferConstructor_h
+#endif // JSWebGLArrayBufferConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayCustom.cpp
new file mode 100644
index 0000000000..d111d4e2b5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayCustom.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "config.h"
+#include "JSWebGLArray.h"
+#include "JSWebGLByteArray.h"
+#include "JSWebGLUnsignedByteArray.h"
+#include "JSWebGLShortArray.h"
+#include "JSWebGLUnsignedShortArray.h"
+#include "JSWebGLIntArray.h"
+#include "JSWebGLUnsignedIntArray.h"
+#include "JSWebGLFloatArray.h"
+
+#include "WebGLArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLArray* object)
+{
+    if (!object)
+        return jsUndefined();
+        
+    if (object) {
+        if (object->isFloatArray())
+            return getDOMObjectWrapper<JSWebGLFloatArray>(exec, globalObject, static_cast<WebGLFloatArray*>(object));
+        if (object->isUnsignedByteArray())
+            return getDOMObjectWrapper<JSWebGLUnsignedByteArray>(exec, globalObject, static_cast<WebGLUnsignedByteArray*>(object));
+        if (object->isByteArray())
+            return getDOMObjectWrapper<JSWebGLByteArray>(exec, globalObject, static_cast<WebGLByteArray*>(object));
+        if (object->isIntArray())
+            return getDOMObjectWrapper<JSWebGLIntArray>(exec, globalObject, static_cast<WebGLIntArray*>(object));
+        if (object->isUnsignedIntArray())
+            return getDOMObjectWrapper<JSWebGLUnsignedIntArray>(exec, globalObject, static_cast<WebGLUnsignedIntArray*>(object));
+        if (object->isShortArray())
+            return getDOMObjectWrapper<JSWebGLShortArray>(exec, globalObject, static_cast<WebGLShortArray*>(object));
+        if (object->isUnsignedShortArray())
+            return getDOMObjectWrapper<JSWebGLUnsignedShortArray>(exec, globalObject, static_cast<WebGLUnsignedShortArray*>(object));
+    }
+    return jsUndefined();
+}
+
+JSValue JSWebGLArray::slice(ExecState* exec, const ArgList& args)
+{
+    WebGLArray* array = reinterpret_cast<WebGLArray*>(impl());
+
+    int start, end;
+    switch (args.size()) {
+    case 0:
+        start = 0;
+        end = array->length();
+        break;
+    case 1:
+        start = args.at(0).toInt32(exec);
+        end = array->length();
+        break;
+    default:
+        start = args.at(0).toInt32(exec);
+        end = args.at(1).toInt32(exec);
+    }
+    return toJS(exec, globalObject(), array->slice(start, end));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayHelper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayHelper.h
new file mode 100644
index 0000000000..481c68fba1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayHelper.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLArrayHelper_h
+#define JSWebGLArrayHelper_h
+
+#include "ExceptionCode.h"
+#include "JSDOMBinding.h"
+#include <interpreter/CallFrame.h>
+#include <runtime/ArgList.h>
+#include <runtime/Error.h>
+#include <runtime/JSObject.h>
+#include <runtime/JSValue.h>
+
+namespace WebCore {
+
+template <class T>
+JSC::JSValue setWebGLArrayFromArray(JSC::ExecState* exec, T* webGLArray, JSC::ArgList const& args)
+{
+    if (args.at(0).isObject()) {
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        JSC::JSObject* array = JSC::asObject(args.at(0));
+        uint32_t offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        uint32_t length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+        if (offset > webGLArray->length() ||
+            offset + length > webGLArray->length() ||
+            offset + length < offset)
+            setDOMException(exec, INDEX_SIZE_ERR);
+        else {
+            for (uint32_t i = 0; i < length; i++) {
+                JSC::JSValue v = array->get(exec, i);
+                if (exec->hadException())
+                    return JSC::jsUndefined();
+                webGLArray->set(i + offset, v.toNumber(exec));
+            }
+        }
+
+        return JSC::jsUndefined();
+    }
+
+    return JSC::throwError(exec, JSC::SyntaxError);
+}
+
+}
+
+#endif // JSWebGLArrayHelper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayConstructor.cpp
index 15e39c27ba..f76fb1dfe1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayConstructor.cpp
@@ -27,38 +27,42 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasFloatArrayConstructor.h"
+#include "JSWebGLByteArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasFloatArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasFloatArray.h"
+#include "WebGLByteArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLByteArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasFloatArrayConstructor::s_info = { "CanvasFloatArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLByteArrayConstructor::s_info = { "WebGLByteArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasFloatArrayConstructor::JSCanvasFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLByteArrayConstructor::JSWebGLByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasFloatArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLByteArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
-static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasFloatArrayConstructor* jsConstructor = static_cast<JSCanvasFloatArrayConstructor*>(constructor);
-    RefPtr<CanvasFloatArray> array = static_cast<CanvasFloatArray*>(construct<CanvasFloatArray, float>(exec, args).get());
+    JSWebGLByteArrayConstructor* jsConstructor = static_cast<JSWebGLByteArrayConstructor*>(constructor);
+    RefPtr<WebGLByteArray> array = static_cast<WebGLByteArray*>(construct<WebGLByteArray, signed char>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
-    constructData.native.function = constructCanvasFloatArray;
+    constructData.native.function = constructCanvasByteArray;
     return ConstructTypeHost;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayConstructor.h
index 5e196529cf..a201567955 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasIntArrayConstructor_h
-#define JSCanvasIntArrayConstructor_h
+#ifndef JSWebGLByteArrayConstructor_h
+#define JSWebGLByteArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasIntArrayConstructor : public DOMConstructorObject {
+    class JSWebGLByteArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasIntArrayConstructor_h
+#endif // JSWebGLByteArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayCustom.cpp
new file mode 100644
index 0000000000..f7872a813f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayCustom.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLByteArray.h"
+
+#include "WebGLByteArray.h"
+
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLByteArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLByteArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLByteArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() < 1 || args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLByteArray* array = toWebGLByteArray(args.at(0));
+    if (array) {
+        // void set(in WebGLByteArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayConstructor.cpp
index ec1d66d25b..e6375acdfe 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayConstructor.cpp
@@ -27,38 +27,42 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasByteArrayConstructor.h"
+#include "JSWebGLFloatArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasByteArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasByteArray.h"
+#include "WebGLFloatArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLFloatArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasByteArrayConstructor::s_info = { "CanvasByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLFloatArrayConstructor::s_info = { "WebGLFloatArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasByteArrayConstructor::JSCanvasByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLFloatArrayConstructor::JSWebGLFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLFloatArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
-static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasByteArrayConstructor* jsConstructor = static_cast<JSCanvasByteArrayConstructor*>(constructor);
-    RefPtr<CanvasByteArray> array = static_cast<CanvasByteArray*>(construct<CanvasByteArray, signed char>(exec, args).get());
+    JSWebGLFloatArrayConstructor* jsConstructor = static_cast<JSWebGLFloatArrayConstructor*>(constructor);
+    RefPtr<WebGLFloatArray> array = static_cast<WebGLFloatArray*>(construct<WebGLFloatArray, float>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
-    constructData.native.function = constructCanvasByteArray;
+    constructData.native.function = constructCanvasFloatArray;
     return ConstructTypeHost;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayConstructor.h
index 4d5dc11b8e..faf90ff652 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasByteArrayConstructor_h
-#define JSCanvasByteArrayConstructor_h
+#ifndef JSWebGLFloatArrayConstructor_h
+#define JSWebGLFloatArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasByteArrayConstructor : public DOMConstructorObject {
+    class JSWebGLFloatArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasByteArrayConstructor_h
+#endif // JSWebGLFloatArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayCustom.cpp
new file mode 100644
index 0000000000..f4acbcfb2e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLFloatArray.h"
+
+#include "WebGLFloatArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<float>(value.toNumber(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLFloatArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLFloatArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLFloatArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in float value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<float>(args.at(1).toNumber(exec)));
+        return jsUndefined();
+    }
+
+    WebGLFloatArray* array = toWebGLFloatArray(args.at(0));
+    if (array) {
+        // void set(in WebGLFloatArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayConstructor.cpp
index 6d57912eba..5b14803499 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayConstructor.cpp
@@ -27,36 +27,40 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasIntArrayConstructor.h"
+#include "JSWebGLIntArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasIntArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasIntArray.h"
+#include "WebGLIntArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLIntArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasIntArrayConstructor::s_info = { "CanvasIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLIntArrayConstructor::s_info = { "WebGLIntArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasIntArrayConstructor::JSCanvasIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLIntArrayConstructor::JSWebGLIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLIntArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasIntArrayConstructor* jsConstructor = static_cast<JSCanvasIntArrayConstructor*>(constructor);
-    RefPtr<CanvasIntArray> array = static_cast<CanvasIntArray*>(construct<CanvasIntArray, int>(exec, args).get());
+    JSWebGLIntArrayConstructor* jsConstructor = static_cast<JSWebGLIntArrayConstructor*>(constructor);
+    RefPtr<WebGLIntArray> array = static_cast<WebGLIntArray*>(construct<WebGLIntArray, int>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasIntArray;
     return ConstructTypeHost;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayConstructor.h
index df218252d9..d42c0468b0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasShortArrayConstructor_h
-#define JSCanvasShortArrayConstructor_h
+#ifndef JSWebGLIntArrayConstructor_h
+#define JSWebGLIntArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasShortArrayConstructor : public DOMConstructorObject {
+    class JSWebGLIntArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasShortArrayConstructor_h
+#endif // JSWebGLIntArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayCustom.cpp
new file mode 100644
index 0000000000..de0825634b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLIntArray.h"
+
+#include "WebGLIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLIntArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLIntArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLIntArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed int>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLIntArray* array = toWebGLIntArray(args.at(0));
+    if (array) {
+        // void set(in WebGLIntArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
new file mode 100644
index 0000000000..e3360273e3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
@@ -0,0 +1,835 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLRenderingContext.h"
+
+#include "ExceptionCode.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "HTMLVideoElement.h"
+#include "JSHTMLCanvasElement.h"
+#include "JSHTMLImageElement.h"
+#include "JSHTMLVideoElement.h"
+#include "JSImageData.h"
+#include "JSWebGLBuffer.h"
+#include "JSWebGLFloatArray.h"
+#include "JSWebGLFramebuffer.h"
+#include "JSWebGLIntArray.h"
+#include "JSWebGLProgram.h"
+#include "JSWebGLRenderbuffer.h"
+#include "JSWebGLShader.h"
+#include "JSWebGLTexture.h"
+#include "JSWebGLUniformLocation.h"
+#include "JSWebGLUnsignedByteArray.h"
+#include "JSWebKitCSSMatrix.h"
+#include "NotImplemented.h"
+#include "WebGLBuffer.h"
+#include "WebGLFloatArray.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLGetInfo.h"
+#include "WebGLIntArray.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderingContext.h"
+#include <runtime/Error.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/OwnFastMallocPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSWebGLRenderingContext::bufferData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned usage = args.at(2).toInt32(exec);
+    ExceptionCode ec = 0;
+
+    // If argument 1 is a number, we are initializing this buffer to that size
+    if (!args.at(1).isObject()) {
+        unsigned int count = args.at(1).toInt32(exec);
+        static_cast<WebGLRenderingContext*>(impl())->bufferData(target, count, usage, ec);
+    } else {
+        WebGLArray* array = toWebGLArray(args.at(1));
+        static_cast<WebGLRenderingContext*>(impl())->bufferData(target, array, usage, ec);
+    }
+
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSWebGLRenderingContext::bufferSubData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned offset = args.at(1).toInt32(exec);
+    ExceptionCode ec = 0;
+    
+    WebGLArray* array = toWebGLArray(args.at(2));
+    
+    static_cast<WebGLRenderingContext*>(impl())->bufferSubData(target, offset, array, ec);
+
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+static JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, const WebGLGetInfo& info)
+{
+    switch (info.getType()) {
+    case WebGLGetInfo::kTypeBool:
+        return jsBoolean(info.getBool());
+    case WebGLGetInfo::kTypeFloat:
+        return jsNumber(exec, info.getFloat());
+    case WebGLGetInfo::kTypeLong:
+        return jsNumber(exec, info.getLong());
+    case WebGLGetInfo::kTypeNull:
+        return jsNull();
+    case WebGLGetInfo::kTypeString:
+        return jsString(exec, info.getString());
+    case WebGLGetInfo::kTypeUnsignedLong:
+        return jsNumber(exec, info.getUnsignedLong());
+    case WebGLGetInfo::kTypeWebGLBuffer:
+        return toJS(exec, globalObject, info.getWebGLBuffer());
+    case WebGLGetInfo::kTypeWebGLFloatArray:
+        return toJS(exec, globalObject, info.getWebGLFloatArray());
+    case WebGLGetInfo::kTypeWebGLFramebuffer:
+        return toJS(exec, globalObject, info.getWebGLFramebuffer());
+    case WebGLGetInfo::kTypeWebGLIntArray:
+        return toJS(exec, globalObject, info.getWebGLIntArray());
+    // FIXME: implement WebGLObjectArray
+    // case WebGLGetInfo::kTypeWebGLObjectArray:
+    case WebGLGetInfo::kTypeWebGLProgram:
+        return toJS(exec, globalObject, info.getWebGLProgram());
+    case WebGLGetInfo::kTypeWebGLRenderbuffer:
+        return toJS(exec, globalObject, info.getWebGLRenderbuffer());
+    case WebGLGetInfo::kTypeWebGLTexture:
+        return toJS(exec, globalObject, info.getWebGLTexture());
+    case WebGLGetInfo::kTypeWebGLUnsignedByteArray:
+        return toJS(exec, globalObject, info.getWebGLUnsignedByteArray());
+    default:
+        notImplemented();
+        return jsUndefined();
+    }
+}
+
+enum ObjectType {
+    kBuffer, kRenderbuffer, kTexture, kVertexAttrib
+};
+
+static JSValue getObjectParameter(JSWebGLRenderingContext* obj, ExecState* exec, const ArgList& args, ObjectType objectType)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(obj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    unsigned pname = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info;
+    switch (objectType) {
+    case kBuffer:
+        info = context->getBufferParameter(target, pname, ec);
+        break;
+    case kRenderbuffer:
+        info = context->getRenderbufferParameter(target, pname, ec);
+        break;
+    case kTexture:
+        info = context->getTexParameter(target, pname, ec);
+        break;
+    case kVertexAttrib:
+        // target => index
+        info = context->getVertexAttrib(target, pname, ec);
+        break;
+    default:
+        notImplemented();
+        break;
+    }
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, obj->globalObject(), info);
+}
+
+enum WhichProgramCall {
+    kProgramParameter, kUniform
+};
+
+JSValue JSWebGLRenderingContext::getBufferParameter(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kBuffer);
+}
+
+JSValue JSWebGLRenderingContext::getFramebufferAttachmentParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    unsigned attachment = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    unsigned pname = args.at(2).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getFramebufferAttachmentParameter(target, attachment, pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 1)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    unsigned pname = args.at(0).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getParameter(pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getProgramParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    unsigned pname = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getProgramParameter(program, pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getRenderbufferParameter(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kRenderbuffer);
+}
+
+JSValue JSWebGLRenderingContext::getShaderParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLShader* shader = toWebGLShader(args.at(0));
+    unsigned pname = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getShaderParameter(shader, pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getTexParameter(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kTexture);
+}
+
+JSValue JSWebGLRenderingContext::getUniform(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    WebGLUniformLocation* loc = toWebGLUniformLocation(args.at(1));
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getUniform(program, loc, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getVertexAttrib(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kVertexAttrib);
+}
+
+//   void texImage2D(in GLenum target, in GLint level, in GLenum internalformat, in GLsizei width, in GLsizei height, in GLint border, in GLenum format, in GLenum type, in WebGLArray pixels);
+//   void texImage2D(in GLenum target, in GLint level, in ImageData pixels, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texImage2D(in GLenum target, in GLint level, in HTMLImageElement image, [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texImage2D(in GLenum target, in GLint level, in HTMLCanvasElement canvas, [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texImage2D(in GLenum target, in GLint level, in HTMLVideoElement video, [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+JSValue JSWebGLRenderingContext::texImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 3 || args.size() > 9)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    unsigned level = args.at(1).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+
+    JSObject* o = 0;
+    
+    if (args.size() <= 5) {
+        // This is one of the last 4 forms. Param 2 can be ImageData or <img>, <canvas> or <video> element.
+        JSValue value = args.at(2);
+    
+        if (!value.isObject())
+            return throwError(exec, TypeError);
+        
+        o = asObject(value);
+        
+        bool flipY = args.at(3).toBoolean(exec);
+        bool premultiplyAlpha = args.at(4).toBoolean(exec);
+        
+        if (o->inherits(&JSImageData::s_info)) {
+            ImageData* data = static_cast<ImageData*>(static_cast<JSImageData*>(o)->impl());
+            context->texImage2D(target, level, data, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLImageElement::s_info)) {
+            HTMLImageElement* element = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(o)->impl());
+            context->texImage2D(target, level, element, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+            HTMLCanvasElement* element = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(o)->impl());
+            context->texImage2D(target, level, element, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLVideoElement::s_info)) {
+            HTMLVideoElement* element = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(o)->impl());
+            context->texImage2D(target, level, element, flipY, premultiplyAlpha, ec);
+        } else
+            ec = TYPE_MISMATCH_ERR;
+    } else {
+        if (args.size() != 9)
+            return throwError(exec, SyntaxError);
+
+        // This must be the WebGLArray case
+        unsigned internalformat = args.at(2).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned width = args.at(3).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned height = args.at(4).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned border = args.at(5).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned format = args.at(6).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned type = args.at(7).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        JSValue value = args.at(8);
+            
+        // For this case passing 0 (for a null array) is allowed
+        if (value.isNull())
+            context->texImage2D(target, level, internalformat, width, height, border, format, type, 0, ec);
+        else if (value.isObject()) {
+            o = asObject(value);
+            
+            if (o->inherits(&JSWebGLArray::s_info)) {
+                // FIXME: Need to check to make sure WebGLArray is a WebGLByteArray or WebGLShortArray,
+                // depending on the passed type parameter.
+                WebGLArray* obj = static_cast<WebGLArray*>(static_cast<JSWebGLArray*>(o)->impl());
+                context->texImage2D(target, level, internalformat, width, height, border, format, type, obj, ec);
+            } else
+                return throwError(exec, TypeError);
+        } else 
+            return throwError(exec, TypeError);
+    }
+    
+    setDOMException(exec, ec);
+    return jsUndefined();    
+}
+
+//   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, in GLsizei width, in GLsizei height, in GLenum format, in GLenum type, in WebGLArray pixels);
+//   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, in ImageData pixels, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, in HTMLImageElement image, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, in HTMLCanvasElement canvas, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, in HTMLVideoElement video, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+JSValue JSWebGLRenderingContext::texSubImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 5 || args.size() > 9)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+
+    unsigned level = args.at(1).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    unsigned xoff = args.at(2).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    unsigned yoff = args.at(3).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    JSObject* o = 0;
+        
+    if (args.size() <= 7) {
+        // This is one of the last 4 forms. Param 4 can be <img>, <canvas> or <video> element, of the format param.
+        JSValue value = args.at(4);
+
+        if (!value.isObject())
+            return throwError(exec, SyntaxError);
+
+        o = asObject(value);
+
+        bool flipY = args.at(5).toBoolean(exec);
+        bool premultiplyAlpha = args.at(6).toBoolean(exec);
+        
+        if (o->inherits(&JSImageData::s_info)) {
+            ImageData* data = static_cast<ImageData*>(static_cast<JSImageData*>(o)->impl());
+            context->texSubImage2D(target, level, xoff, yoff, data, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLImageElement::s_info)) {
+            HTMLImageElement* element = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(o)->impl());
+            context->texSubImage2D(target, level, xoff, yoff, element, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+            HTMLCanvasElement* element = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(o)->impl());
+            context->texSubImage2D(target, level, xoff, yoff, element, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLVideoElement::s_info)) {
+            HTMLVideoElement* element = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(o)->impl());
+            context->texSubImage2D(target, level, xoff, yoff, element, flipY, premultiplyAlpha, ec);
+        } else
+            ec = TYPE_MISMATCH_ERR;
+    } else {
+        // This must be the WebGLArray form
+        if (args.size() != 9)
+            return throwError(exec, SyntaxError);
+
+        unsigned width = args.at(4).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+        
+        unsigned height = args.at(5).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+        
+        unsigned format = args.at(6).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+        
+        unsigned type = args.at(7).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+        
+        JSValue value = args.at(8);
+        if (!value.isObject())
+            context->texSubImage2D(target, level, xoff, yoff, width, height, format, type, 0, ec);
+        else {
+            o = asObject(value);
+        
+            if (o->inherits(&JSWebGLArray::s_info)) {
+                WebGLArray* obj = static_cast<WebGLArray*>(static_cast<JSWebGLArray*>(o)->impl());
+                context->texSubImage2D(target, level, xoff, yoff, width, height, format, type, obj, ec);
+            } else
+                return throwError(exec, TypeError);
+        }
+    }
+    
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+template<typename T, size_t inlineCapacity>
+bool toVector(JSC::ExecState* exec, JSC::JSValue value, Vector<T, inlineCapacity>& vector)
+{
+    if (!value.isObject())
+        return false;
+
+    JSC::JSObject* object = asObject(value);
+    int32_t length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+    vector.resize(length);
+
+    for (int32_t i = 0; i < length; ++i) {
+        JSC::JSValue v = object->get(exec, i);
+        if (exec->hadException())
+            return false;
+        vector[i] = static_cast<T>(v.toNumber(exec));
+    }
+
+    return true;
+}
+
+enum DataFunctionToCall {
+    f_uniform1v, f_uniform2v, f_uniform3v, f_uniform4v,
+    f_vertexAttrib1v, f_vertexAttrib2v, f_vertexAttrib3v, f_vertexAttrib4v
+};
+
+enum DataFunctionMatrixToCall {
+    f_uniformMatrix2fv, f_uniformMatrix3fv, f_uniformMatrix4fv
+};
+
+static bool functionForUniform(DataFunctionToCall f)
+{
+    switch (f) {
+    case f_uniform1v:
+    case f_uniform2v:
+    case f_uniform3v:
+    case f_uniform4v:
+        return true;
+        break;
+    default: break;
+    }
+    return false;
+}
+
+static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, WebGLRenderingContext* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+    
+    WebGLUniformLocation* location = 0;
+    long index = -1;
+    
+    if (functionForUniform(f))
+        location = toWebGLUniformLocation(args.at(0));
+    else
+        index = args.at(0).toInt32(exec);
+
+    if (exec->hadException())
+        return jsUndefined();
+        
+    RefPtr<WebGLFloatArray> webGLArray = toWebGLFloatArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    ExceptionCode ec = 0;
+    if (webGLArray) {
+        switch (f) {
+        case f_uniform1v:
+            context->uniform1fv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform2v:
+            context->uniform2fv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform3v:
+            context->uniform3fv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform4v:
+            context->uniform4fv(location, webGLArray.get(), ec);
+            break;
+        case f_vertexAttrib1v:
+            context->vertexAttrib1fv(index, webGLArray.get());
+            break;
+        case f_vertexAttrib2v:
+            context->vertexAttrib2fv(index, webGLArray.get());
+            break;
+        case f_vertexAttrib3v:
+            context->vertexAttrib3fv(index, webGLArray.get());
+            break;
+        case f_vertexAttrib4v:
+            context->vertexAttrib4fv(index, webGLArray.get());
+            break;
+        }
+        
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    Vector<float, 64> array;
+    if (!toVector(exec, args.at(1), array))
+        return throwError(exec, TypeError);
+
+    switch (f) {
+    case f_uniform1v:
+        context->uniform1fv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform2v:
+        context->uniform2fv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform3v:
+        context->uniform3fv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform4v:
+        context->uniform4fv(location, array.data(), array.size(), ec);
+        break;
+    case f_vertexAttrib1v:
+        context->vertexAttrib1fv(index, array.data(), array.size());
+        break;
+    case f_vertexAttrib2v:
+        context->vertexAttrib2fv(index, array.data(), array.size());
+        break;
+    case f_vertexAttrib3v:
+        context->vertexAttrib3fv(index, array.data(), array.size());
+        break;
+    case f_vertexAttrib4v:
+        context->vertexAttrib4fv(index, array.data(), array.size());
+        break;
+    }
+    
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, WebGLRenderingContext* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+  
+    if (exec->hadException())
+        return jsUndefined();
+        
+    RefPtr<WebGLIntArray> webGLArray = toWebGLIntArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    ExceptionCode ec = 0;
+    if (webGLArray) {
+        switch (f) {
+        case f_uniform1v:
+            context->uniform1iv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform2v:
+            context->uniform2iv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform3v:
+            context->uniform3iv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform4v:
+            context->uniform4iv(location, webGLArray.get(), ec);
+            break;
+        default:
+            break;
+        }
+        
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+
+    Vector<int, 64> array;
+    if (!toVector(exec, args.at(1), array))
+        return throwError(exec, TypeError);
+
+    switch (f) {
+    case f_uniform1v:
+        context->uniform1iv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform2v:
+        context->uniform2iv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform3v:
+        context->uniform3iv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform4v:
+        context->uniform4iv(location, array.data(), array.size(), ec);
+        break;
+    default:
+        break;
+    }
+    
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState* exec, const JSC::ArgList& args, WebGLRenderingContext* context)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    bool transpose = args.at(1).toBoolean(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<WebGLFloatArray> webGLArray = toWebGLFloatArray(args.at(2));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    ExceptionCode ec = 0;
+    if (webGLArray) {
+        switch (f) {
+        case f_uniformMatrix2fv:
+            context->uniformMatrix2fv(location, transpose, webGLArray.get(), ec);
+            break;
+        case f_uniformMatrix3fv:
+            context->uniformMatrix3fv(location, transpose, webGLArray.get(), ec);
+            break;
+        case f_uniformMatrix4fv:
+            context->uniformMatrix4fv(location, transpose, webGLArray.get(), ec);
+            break;
+        }
+        
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    Vector<float, 64> array;
+    if (!toVector(exec, args.at(2), array))
+        return throwError(exec, TypeError);
+
+    switch (f) {
+    case f_uniformMatrix2fv:
+        context->uniformMatrix2fv(location, transpose, array.data(), array.size(), ec);
+        break;
+    case f_uniformMatrix3fv:
+        context->uniformMatrix3fv(location, transpose, array.data(), array.size(), ec);
+        break;
+    case f_uniformMatrix4fv:
+        context->uniformMatrix4fv(location, transpose, array.data(), array.size(), ec);
+        break;
+    }
+
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform1v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform1iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform1v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform2v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform2iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform2v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform3v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform3iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform3v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform4v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform4iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform4v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniformMatrix2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix2fv, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniformMatrix3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix3fv, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniformMatrix4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix4fv, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib1v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib2v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib3v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib4v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayConstructor.cpp
index a885b7bca8..a33779b4e5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayConstructor.cpp
@@ -27,37 +27,41 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasShortArrayConstructor.h"
+#include "JSWebGLShortArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasShortArray.h"
-#include "JSCanvasArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasShortArray.h"
+#include "WebGLShortArray.h"
+#include "JSWebGLArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLShortArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasShortArrayConstructor::s_info = { "CanvasShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLShortArrayConstructor::s_info = { "WebGLShortArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasShortArrayConstructor::JSCanvasShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLShortArrayConstructor::JSWebGLShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLShortArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasShortArrayConstructor* jsConstructor = static_cast<JSCanvasShortArrayConstructor*>(constructor);
-    RefPtr<CanvasShortArray> array = static_cast<CanvasShortArray*>(construct<CanvasShortArray, short>(exec, args).get());
+    JSWebGLShortArrayConstructor* jsConstructor = static_cast<JSWebGLShortArrayConstructor*>(constructor);
+    RefPtr<WebGLShortArray> array = static_cast<WebGLShortArray*>(construct<WebGLShortArray, short>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasShortArray;
     return ConstructTypeHost;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayConstructor.h
index efea2506da..7807a13716 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasFloatArrayConstructor_h
-#define JSCanvasFloatArrayConstructor_h
+#ifndef JSWebGLShortArrayConstructor_h
+#define JSWebGLShortArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasFloatArrayConstructor : public DOMConstructorObject {
+    class JSWebGLShortArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasFloatArrayConstructor_h
+#endif // JSWebGLShortArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayCustom.cpp
index 95a80a722f..899b0c9137 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayCustom.cpp
@@ -27,22 +27,50 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedIntArray.h"
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLShortArray.h"
 
-#include "CanvasUnsignedIntArray.h"
+#include "WebGLShortArray.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSCanvasUnsignedIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void JSWebGLShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
-    impl()->set(index, static_cast<unsigned int>(value.toInt32(exec)));
+    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedIntArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLShortArray* object)
 {
-    return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, object);
+    return getDOMObjectWrapper<JSWebGLShortArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLShortArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed short>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLShortArray* shortArray = toWebGLShortArray(args.at(0));
+    if (shortArray) {
+        // void set(in WebGLShortArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(shortArray, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp
index 5d0800e660..dcb940ee92 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp
@@ -27,36 +27,41 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedByteArrayConstructor.h"
+#include "JSWebGLUnsignedByteArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasUnsignedByteArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasUnsignedByteArray.h"
+#include "ExceptionCode.h"
+#include "WebGLUnsignedByteArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLUnsignedByteArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasUnsignedByteArrayConstructor::s_info = { "CanvasUnsignedByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLUnsignedByteArrayConstructor::s_info = { "WebGLUnsignedByteArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasUnsignedByteArrayConstructor::JSCanvasUnsignedByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasUnsignedByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLUnsignedByteArrayConstructor::JSWebGLUnsignedByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLUnsignedByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLUnsignedByteArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasUnsignedByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasUnsignedByteArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedByteArrayConstructor*>(constructor);
-    RefPtr<CanvasUnsignedByteArray> array = static_cast<CanvasUnsignedByteArray*>(construct<CanvasUnsignedByteArray, unsigned char>(exec, args).get());
+    JSWebGLUnsignedByteArrayConstructor* jsConstructor = static_cast<JSWebGLUnsignedByteArrayConstructor*>(constructor);
+    RefPtr<WebGLUnsignedByteArray> array = static_cast<WebGLUnsignedByteArray*>(construct<WebGLUnsignedByteArray, unsigned char>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasUnsignedByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLUnsignedByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasUnsignedByteArray;
     return ConstructTypeHost;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.h
index 6016159e3c..d90ce96af9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasUnsignedIntArrayConstructor_h
-#define JSCanvasUnsignedIntArrayConstructor_h
+#ifndef JSWebGLUnsignedByteArrayConstructor_h
+#define JSWebGLUnsignedByteArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasUnsignedIntArrayConstructor : public DOMConstructorObject {
+    class JSWebGLUnsignedByteArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasUnsignedIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLUnsignedByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasUnsignedIntArrayConstructor_h
+#endif // JSWebGLUnsignedByteArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayCustom.cpp
index f2b0c74538..b576374a31 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayCustom.cpp
@@ -27,22 +27,50 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedByteArray.h"
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLUnsignedByteArray.h"
 
-#include "CanvasUnsignedByteArray.h"
+#include "WebGLUnsignedByteArray.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSCanvasUnsignedByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void JSWebGLUnsignedByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
     impl()->set(index, static_cast<unsigned char>(value.toInt32(exec)));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedByteArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUnsignedByteArray* object)
 {
-    return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, object);
+    return getDOMObjectWrapper<JSWebGLUnsignedByteArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLUnsignedByteArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<unsigned char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLUnsignedByteArray* array = toWebGLUnsignedByteArray(args.at(0));
+    if (array) {
+        // void set(in WebGLUnsignedByteArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp
index 5f145a7313..23fcccee50 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp
@@ -27,36 +27,40 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedIntArrayConstructor.h"
+#include "JSWebGLUnsignedIntArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasUnsignedIntArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasUnsignedIntArray.h"
+#include "WebGLUnsignedIntArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLUnsignedIntArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasUnsignedIntArrayConstructor::s_info = { "CanvasUnsignedIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLUnsignedIntArrayConstructor::s_info = { "WebGLUnsignedIntArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasUnsignedIntArrayConstructor::JSCanvasUnsignedIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasUnsignedIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLUnsignedIntArrayConstructor::JSWebGLUnsignedIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLUnsignedIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLUnsignedIntArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasUnsignedIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasUnsignedIntArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedIntArrayConstructor*>(constructor);
-    RefPtr<CanvasUnsignedIntArray> array = static_cast<CanvasUnsignedIntArray*>(construct<CanvasUnsignedIntArray, unsigned int>(exec, args).get());
+    JSWebGLUnsignedIntArrayConstructor* jsConstructor = static_cast<JSWebGLUnsignedIntArrayConstructor*>(constructor);
+    RefPtr<WebGLUnsignedIntArray> array = static_cast<WebGLUnsignedIntArray*>(construct<WebGLUnsignedIntArray, unsigned int>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasUnsignedIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLUnsignedIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasUnsignedIntArray;
     return ConstructTypeHost;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.h
new file mode 100644
index 0000000000..7eabbc178a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLUnsignedIntArrayConstructor_h
+#define JSWebGLUnsignedIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSWebGLUnsignedIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSWebGLUnsignedIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSWebGLUnsignedIntArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayCustom.cpp
new file mode 100644
index 0000000000..c8b74545d8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLUnsignedIntArray.h"
+
+#include "WebGLUnsignedIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLUnsignedIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned int>(value.toUInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUnsignedIntArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLUnsignedIntArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLUnsignedIntArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<unsigned int>(args.at(1).toUInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLUnsignedIntArray* array = toWebGLUnsignedIntArray(args.at(0));
+    if (array) {
+        // void set(in WebGLUnsignedIntArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp
index 97356937b1..d8c2cfb865 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp
@@ -27,36 +27,40 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedShortArrayConstructor.h"
+#include "JSWebGLUnsignedShortArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasUnsignedShortArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasUnsignedShortArray.h"
+#include "WebGLUnsignedShortArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLUnsignedShortArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasUnsignedShortArrayConstructor::s_info = { "CanvasUnsignedShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLUnsignedShortArrayConstructor::s_info = { "WebGLUnsignedShortArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasUnsignedShortArrayConstructor::JSCanvasUnsignedShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasUnsignedShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLUnsignedShortArrayConstructor::JSWebGLUnsignedShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLUnsignedShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLUnsignedShortArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasUnsignedShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasUnsignedShortArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedShortArrayConstructor*>(constructor);
-    RefPtr<CanvasUnsignedShortArray> array = static_cast<CanvasUnsignedShortArray*>(construct<CanvasUnsignedShortArray, unsigned short>(exec, args).get());
+    JSWebGLUnsignedShortArrayConstructor* jsConstructor = static_cast<JSWebGLUnsignedShortArrayConstructor*>(constructor);
+    RefPtr<WebGLUnsignedShortArray> array = static_cast<WebGLUnsignedShortArray*>(construct<WebGLUnsignedShortArray, unsigned short>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasUnsignedShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLUnsignedShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasUnsignedShortArray;
     return ConstructTypeHost;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.h
index 9cfb721423..5eba20d4a3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasUnsignedByteArrayConstructor_h
-#define JSCanvasUnsignedByteArrayConstructor_h
+#ifndef JSWebGLUnsignedShortArrayConstructor_h
+#define JSWebGLUnsignedShortArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasUnsignedByteArrayConstructor : public DOMConstructorObject {
+    class JSWebGLUnsignedShortArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasUnsignedByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLUnsignedShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasUnsignedByteArrayConstructor_h
+#endif // JSWebGLUnsignedShortArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayCustom.cpp
index 290cd4bbfb..0c82c3e66c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayCustom.cpp
@@ -27,22 +27,50 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedShortArray.h"
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLUnsignedShortArray.h"
 
-#include "CanvasUnsignedShortArray.h"
+#include "WebGLUnsignedShortArray.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSCanvasUnsignedShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void JSWebGLUnsignedShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
     impl()->set(index, static_cast<unsigned short>(value.toInt32(exec)));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedShortArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUnsignedShortArray* object)
 {
-    return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, object);
+    return getDOMObjectWrapper<JSWebGLUnsignedShortArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLUnsignedShortArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<unsigned short>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLUnsignedShortArray* array = toWebGLUnsignedShortArray(args.at(0));
+    if (array) {
+        // void set(in WebGLUnsignedShortArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h
index 069647a7a7..633e612117 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h
@@ -31,6 +31,8 @@
 #ifndef JSWebSocketConstructor_h
 #define JSWebSocketConstructor_h
 
+#if ENABLE(WEB_SOCKETS)
+
 #include "JSDOMBinding.h"
 
 namespace WebCore {
@@ -45,6 +47,8 @@ class JSWebSocketConstructor : public DOMConstructorObject {
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 };
 
-}  // namespace WebCore
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
 
-#endif  // JSWebSocketConstructor_h
+#endif // JSWebSocketConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
index 33c3fcd586..d610f01c4a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -38,7 +38,6 @@
 #include "KURL.h"
 #include "JSEventListener.h"
 #include "WebSocket.h"
-#include "NotImplemented.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
@@ -66,7 +65,7 @@ JSValue JSWebSocket::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -76,7 +75,7 @@ JSValue JSWebSocket::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
index 741a2692f1..2491f4df70 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -42,10 +42,10 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase);
 
-const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, 0 };
+const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", &JSDOMGlobalObject::s_info, 0, 0 };
 
 JSWorkerContextBase::JSWorkerContextBase(NonNullPassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
-    : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData, this)
+    : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData(normalWorld(*impl->script()->globalData())), this)
     , m_impl(impl)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
index 490d9b138a..bf9409c83e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -32,8 +32,10 @@
 #include "JSDOMBinding.h"
 #include "JSDOMGlobalObject.h"
 #include "JSEventListener.h"
+#include "JSEventSourceConstructor.h"
 #include "JSMessageChannelConstructor.h"
 #include "JSMessagePort.h"
+#include "JSWebSocketConstructor.h"
 #include "JSWorkerLocation.h"
 #include "JSWorkerNavigator.h"
 #include "JSXMLHttpRequestConstructor.h"
@@ -43,10 +45,6 @@
 #include "WorkerNavigator.h"
 #include <interpreter/Interpreter.h>
 
-#if ENABLE(EVENTSOURCE)
-#include "JSEventSourceConstructor.h"
-#endif
-
 using namespace JSC;
 
 namespace WebCore {
@@ -62,7 +60,7 @@ void JSWorkerContext::markChildren(MarkStack& markStack)
     markDOMObjectWrapper(markStack, globalData, impl()->optionalLocation());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalNavigator());
 
-    impl()->markEventListeners(markStack);
+    impl()->markJSEventListeners(markStack);
 }
 
 bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -93,6 +91,13 @@ JSValue JSWorkerContext::xmlHttpRequest(ExecState* exec) const
     return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
 }
 
+#if ENABLE(WEB_SOCKETS)
+JSValue JSWorkerContext::webSocket(ExecState* exec) const
+{
+    return getDOMConstructor<JSWebSocketConstructor>(exec, this);
+}
+#endif
+
 JSValue JSWorkerContext::importScripts(ExecState* exec, const ArgList& args)
 {
     if (!args.size())
@@ -122,7 +127,7 @@ JSValue JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -132,26 +137,26 @@ JSValue JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& arg
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSWorkerContext::setTimeout(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
-    return jsNumber(exec, impl()->setTimeout(action, delay));
+    return jsNumber(exec, impl()->setTimeout(action.release(), delay));
 }
 
 JSValue JSWorkerContext::setInterval(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
-    return jsNumber(exec, impl()->setInterval(action, delay));
+    return jsNumber(exec, impl()->setInterval(action.release(), delay));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 7ee2720180..ede5a25522 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -29,18 +29,20 @@
 #include "config.h"
 #include "JSXMLHttpRequest.h"
 
+#include "Blob.h"
+#include "DOMFormData.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "Event.h"
-#include "File.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLDocument.h"
+#include "JSBlob.h"
+#include "JSDOMFormData.h"
 #include "JSDOMWindowCustom.h"
 #include "JSDocument.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
-#include "JSFile.h"
 #include "XMLHttpRequest.h"
 #include <runtime/Error.h>
 #include <interpreter/Interpreter.h>
@@ -56,7 +58,7 @@ void JSXMLHttpRequest::markChildren(MarkStack& markStack)
     if (XMLHttpRequestUpload* upload = m_impl->optionalUpload())
         markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), upload);
 
-    m_impl->markEventListeners(markStack);
+    m_impl->markJSEventListeners(markStack);
 }
 
 // Custom functions
@@ -67,21 +69,23 @@ JSValue JSXMLHttpRequest::open(ExecState* exec, const ArgList& args)
 
     const KURL& url = impl()->scriptExecutionContext()->completeURL(args.at(1).toString(exec));
     String method = args.at(0).toString(exec);
-    bool async = true;
-    if (args.size() >= 3)
-        async = args.at(2).toBoolean(exec);
 
     ExceptionCode ec = 0;
-    if (args.size() >= 4 && !args.at(3).isUndefined()) {
-        String user = valueToStringWithNullCheck(exec, args.at(3));
-
-        if (args.size() >= 5 && !args.at(4).isUndefined()) {
-            String password = valueToStringWithNullCheck(exec, args.at(4));
-            impl()->open(method, url, async, user, password, ec);
+    if (args.size() >= 3) {
+        bool async = args.at(2).toBoolean(exec);
+
+        if (args.size() >= 4 && !args.at(3).isUndefined()) {
+            String user = valueToStringWithNullCheck(exec, args.at(3));
+            
+            if (args.size() >= 5 && !args.at(4).isUndefined()) {
+                String password = valueToStringWithNullCheck(exec, args.at(4));
+                impl()->open(method, url, async, user, password, ec);
+            } else
+                impl()->open(method, url, async, user, ec);
         } else
-            impl()->open(method, url, async, user, ec);
+            impl()->open(method, url, async, ec);
     } else
-        impl()->open(method, url, async, ec);
+        impl()->open(method, url, ec);
 
     setDOMException(exec, ec);
     return jsUndefined();
@@ -109,8 +113,10 @@ JSValue JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
             impl()->send(ec);
         else if (val.inherits(&JSDocument::s_info))
             impl()->send(toDocument(val), ec);
-        else if (val.inherits(&JSFile::s_info))
-            impl()->send(toFile(val), ec);
+        else if (val.inherits(&JSBlob::s_info))
+            impl()->send(toBlob(val), ec);
+        else if (val.inherits(&JSDOMFormData::s_info))
+            impl()->send(toDOMFormData(val), ec);
         else
             impl()->send(val.toString(exec), ec);
     }
@@ -153,7 +159,7 @@ JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -163,7 +169,7 @@ JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& ar
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index fa7cfec41c..857c12d251 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -48,7 +48,7 @@ void JSXMLHttpRequestUpload::markChildren(MarkStack& markStack)
     if (XMLHttpRequest* xmlHttpRequest = m_impl->associatedXMLHttpRequest())
         markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), xmlHttpRequest);
 
-    m_impl->markEventListeners(markStack);
+    m_impl->markJSEventListeners(markStack);
 }
 
 JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
@@ -57,7 +57,7 @@ JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList&
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -67,7 +67,7 @@ JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgLi
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.cpp
index 3a65fb8b27..8e56ed8e5b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.cpp
@@ -29,11 +29,11 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
 #include "JavaScriptProfileNode.h"
-#include <profiler/Profile.h>
 #include <JavaScriptCore/APICast.h>
 #include <JavaScriptCore/JSObjectRef.h>
 #include <JavaScriptCore/JSStringRef.h>
 #include <JavaScriptCore/OpaqueJSString.h>
+#include <profiler/Profile.h>
 #include <runtime/JSObject.h>
 #include <runtime/JSValue.h>
 #include <wtf/StdLibExtras.h>
@@ -47,7 +47,7 @@ namespace WebCore {
 typedef HashMap<Profile*, JSObject*> ProfileMap;
 
 static ProfileMap& profileCache()
-{ 
+{
     DEFINE_STATIC_LOCAL(ProfileMap, staticProfiles, ());
     return staticProfiles;
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.h b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.h
index 28fd3e4f5c..7b75b978c3 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.h
@@ -31,13 +31,13 @@
 #include <runtime/JSValue.h>
 
 namespace JSC {
-    class ExecState;
-    class Profile;
+class ExecState;
+class Profile;
 }
 
 namespace WebCore {
 
-    JSC::JSValue toJS(JSC::ExecState*, JSC::Profile*);
+JSC::JSValue toJS(JSC::ExecState*, JSC::Profile*);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.cpp
index 2d462f626c..7d60b241fd 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.cpp
@@ -29,12 +29,12 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
 #include "JSDOMBinding.h"
-#include <profiler/ProfileNode.h>
 #include <JavaScriptCore/APICast.h>
-#include <JavaScriptCore/JSObjectRef.h>
 #include <JavaScriptCore/JSContextRef.h>
+#include <JavaScriptCore/JSObjectRef.h>
 #include <JavaScriptCore/JSRetainPtr.h>
 #include <JavaScriptCore/JSStringRef.h>
+#include <profiler/ProfileNode.h>
 #include <runtime/JSLock.h>
 #include <runtime/JSValue.h>
 #include <wtf/StdLibExtras.h>
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.h b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.h
index ad72b71139..f01be19817 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.h
@@ -28,18 +28,18 @@
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
-#include <runtime/JSValue.h>
 #include <JavaScriptCore/JSBase.h>
+#include <runtime/JSValue.h>
 
 namespace JSC {
-    class ExecState;
-    class ProfileNode;
+class ExecState;
+class ProfileNode;
 }
 
 namespace WebCore {
 
-    JSClassRef ProfileNodeClass();
-    JSC::JSValue toJS(JSC::ExecState*, JSC::ProfileNode*);
+JSClassRef ProfileNodeClass();
+JSC::JSValue toJS(JSC::ExecState*, JSC::ProfileNode*);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
index 9a21b6b99d..6dea50eac9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
@@ -47,7 +47,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScheduledAction* ScheduledAction::create(ExecState* exec, const ArgList& args, DOMWrapperWorld* isolatedWorld)
+PassOwnPtr<ScheduledAction> ScheduledAction::create(ExecState* exec, const ArgList& args, DOMWrapperWorld* isolatedWorld)
 {
     JSValue v = args.at(0);
     CallData callData;
@@ -103,7 +103,7 @@ void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSV
         args.append(m_args[i]);
 
     globalObject->globalData()->timeoutChecker.start();
-    callInWorld(exec, m_function, callType, callData, thisValue, args, m_isolatedWorld.get());
+    JSC::call(exec, m_function, callType, callData, thisValue, args);
     globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException())
@@ -117,7 +117,7 @@ void ScheduledAction::execute(Document* document)
         return;
 
     RefPtr<Frame> frame = window->impl()->frame();
-    if (!frame || !frame->script()->isEnabled())
+    if (!frame || !frame->script()->canExecuteScripts(AboutToExecuteScript))
         return;
 
     frame->script()->setProcessingTimerCallback(true);
@@ -126,7 +126,7 @@ void ScheduledAction::execute(Document* document)
         executeFunctionInContext(window, window->shell());
         Document::updateStyleForAllDocuments();
     } else
-        frame->script()->executeScriptInIsolatedWorld(m_isolatedWorld.get(), m_code);
+        frame->script()->executeScriptInWorld(m_isolatedWorld.get(), m_code);
 
     frame->script()->setProcessingTimerCallback(false);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
index 4ea727d5f7..3b7e001cd7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
@@ -24,6 +24,7 @@
 #include <JSDOMBinding.h>
 #include <runtime/JSCell.h>
 #include <runtime/Protect.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 namespace JSC {
@@ -40,9 +41,9 @@ namespace WebCore {
     * time interval, either once or repeatedly. Used for window.setTimeout()
     * and window.setInterval()
     */
-    class ScheduledAction {
+    class ScheduledAction : public Noncopyable {
     public:
-        static ScheduledAction* create(JSC::ExecState*, const JSC::ArgList&, DOMWrapperWorld* isolatedWorld);
+        static PassOwnPtr<ScheduledAction> create(JSC::ExecState*, const JSC::ArgList&, DOMWrapperWorld* isolatedWorld);
 
         void execute(ScriptExecutionContext*);
 
@@ -56,7 +57,7 @@ namespace WebCore {
 
         void executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue thisValue);
         void execute(Document*);
-#if ENABLE(WORKERS)        
+#if ENABLE(WORKERS)
         void execute(WorkerContext*);
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp
index 2c4075a919..caecc4051d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp
@@ -53,6 +53,10 @@ static bool handleException(ScriptState* scriptState)
 
 bool ScriptArray::set(unsigned index, const ScriptObject& value)
 {
+    if (value.scriptState() != m_scriptState) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
     JSLock lock(SilenceAssertionsOnly);
     jsArray()->put(m_scriptState, index, value.jsObject());
     return handleException(m_scriptState);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
index e01324e178..16f18d35a0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -44,19 +44,26 @@ using namespace JSC;
 namespace WebCore {
 
 ScriptCachedFrameData::ScriptCachedFrameData(Frame* frame)
+    : m_domWindow(0)
 {
     JSLock lock(SilenceAssertionsOnly);
 
     ScriptController* scriptController = frame->script();
-    // FIXME: explicitly save and restore isolated worlds' global objects when using the back/forward cache. <rdar://problem/7328111>
-    if (JSDOMWindowShell* windowShell = scriptController->existingWindowShell(mainThreadNormalWorld())) {
-        m_window = windowShell->window();
-        scriptController->attachDebugger(0);
+    ScriptController::ShellMap& windowShells = scriptController->m_windowShells;
+
+    ScriptController::ShellMap::iterator windowShellsEnd = windowShells.end();
+    for (ScriptController::ShellMap::iterator iter = windowShells.begin(); iter != windowShellsEnd; ++iter) {
+        JSDOMWindow* window = iter->second->window();
+        m_windows.add(iter->first.get(), window);
+        m_domWindow = window->impl();
     }
+
+    scriptController->attachDebugger(0);
 }
 
-DOMWindow* ScriptCachedFrameData::domWindow() const {
-    return m_window ? m_window->impl() : 0;
+DOMWindow* ScriptCachedFrameData::domWindow() const
+{
+    return m_domWindow;
 }
 
 ScriptCachedFrameData::~ScriptCachedFrameData()
@@ -66,31 +73,37 @@ ScriptCachedFrameData::~ScriptCachedFrameData()
 
 void ScriptCachedFrameData::restore(Frame* frame)
 {
-    Page* page = frame->page();
-
     JSLock lock(SilenceAssertionsOnly);
 
     ScriptController* scriptController = frame->script();
-    // FIXME: explicitly save and restore isolated worlds' global objects when using the back/forward cache. <rdar://problem/7328111>
-    if (JSDOMWindowShell* windowShell = scriptController->existingWindowShell(mainThreadNormalWorld())) {
-        if (m_window)
-            windowShell->setWindow(m_window.get());
+    ScriptController::ShellMap& windowShells = scriptController->m_windowShells;
+
+    ScriptController::ShellMap::iterator windowShellsEnd = windowShells.end();
+    for (ScriptController::ShellMap::iterator iter = windowShells.begin(); iter != windowShellsEnd; ++iter) {
+        DOMWrapperWorld* world = iter->first.get();
+        JSDOMWindowShell* windowShell = iter->second.get();
+
+        if (JSDOMWindow* window = m_windows.get(world))
+            windowShell->setWindow(window);
         else {
             windowShell->setWindow(frame->domWindow());
-            scriptController->attachDebugger(page->debugger());
-            windowShell->window()->setProfileGroup(page->group().identifier());
+
+            if (Page* page = frame->page()) {
+                scriptController->attachDebugger(windowShell, page->debugger());
+                windowShell->window()->setProfileGroup(page->group().identifier());
+            }
         }
     }
 }
 
 void ScriptCachedFrameData::clear()
 {
-    JSLock lock(SilenceAssertionsOnly);
+    if (m_windows.isEmpty())
+        return;
 
-    if (m_window) {
-        m_window = 0;
-        gcController().garbageCollectSoon();
-    }
+    JSLock lock(SilenceAssertionsOnly);
+    m_windows.clear();
+    gcController().garbageCollectSoon();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h
index c661f28155..15c23c5179 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h
@@ -38,8 +38,11 @@ namespace WebCore {
     class Frame;
     class JSDOMWindow;
     class DOMWindow;
+    class DOMWrapperWorld;
+
+    class ScriptCachedFrameData  : public Noncopyable {
+        typedef HashMap< RefPtr<DOMWrapperWorld>, JSC::ProtectedPtr<JSDOMWindow> > JSDOMWindowSet;
 
-    class ScriptCachedFrameData  {
     public:
         ScriptCachedFrameData(Frame*);
         ~ScriptCachedFrameData();
@@ -49,7 +52,8 @@ namespace WebCore {
         DOMWindow* domWindow() const;
 
     private:
-        JSC::ProtectedPtr<JSDOMWindow> m_window;
+        JSDOMWindowSet m_windows;
+        DOMWindow* m_domWindow;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
index 021ede5c84..c8eadd1c1f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
@@ -54,14 +54,15 @@ ScriptCallStack::ScriptCallStack(ExecState* exec, const ArgList& args, unsigned
 
     exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, urlString, function);
 
+    unsigned lineNumber = signedLineNumber >= 0 ? signedLineNumber : 0;
+
     if (function) {
         m_caller = asInternalFunction(function);
-        unsigned lineNumber = signedLineNumber >= 0 ? signedLineNumber : 0;
-        m_frames.append(ScriptCallFrame(m_caller->name(&m_exec->globalData()), urlString, lineNumber, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(m_caller->name(m_exec), urlString, lineNumber, args, skipArgumentCount));
     } else {
         // Caller is unknown, but we should still add the frame, because
         // something called us, and gave us arguments.
-        m_frames.append(ScriptCallFrame(UString(), UString(), 0, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(UString(), urlString, lineNumber, args, skipArgumentCount));
     }
 }
 
@@ -94,10 +95,15 @@ void ScriptCallStack::initialize()
     while (!func.isNull()) {
         InternalFunction* internalFunction = asInternalFunction(func);
         ArgList emptyArgList;
-        m_frames.append(ScriptCallFrame(internalFunction->name(&m_exec->globalData()), UString(), 0, emptyArgList, 0));
+        m_frames.append(ScriptCallFrame(internalFunction->name(m_exec), UString(), 0, emptyArgList, 0));
         func = m_exec->interpreter()->retrieveCaller(m_exec, internalFunction);
     }
     m_initialized = true;
 }
 
+bool ScriptCallStack::callLocation(String*, int*)
+{
+    return false;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.h
index 190756492d..f5f8ae06a2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.h
@@ -49,9 +49,11 @@ namespace WebCore {
         ~ScriptCallStack();
 
         ScriptState* state() const { return m_exec; }
+        ScriptState* globalState() const { return m_exec->lexicalGlobalObject()->globalExec(); }
         // frame retrieval methods
         const ScriptCallFrame &at(unsigned);
         unsigned size();
+        static bool callLocation(String*, int*);
 
     private:
         void initialize();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
index 4a1d413bc5..f6b779af0e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
@@ -25,8 +25,10 @@
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
+#include "FrameLoaderClient.h"
 #include "GCController.h"
 #include "HTMLPlugInElement.h"
+#include "InspectorTimelineAgent.h"
 #include "JSDocument.h"
 #include "NP_jsobject.h"
 #include "Page.h"
@@ -35,6 +37,7 @@
 #include "ScriptValue.h"
 #include "Settings.h"
 #include "StorageNamespace.h"
+#include "WebCoreJSClientData.h"
 #include "XSSAuditor.h"
 #include "npruntime_impl.h"
 #include "runtime_root.h"
@@ -43,6 +46,7 @@
 #include <runtime/JSLock.h>
 
 using namespace JSC;
+using namespace std;
 
 namespace WebCore {
 
@@ -79,9 +83,6 @@ ScriptController::ScriptController(Frame* frame)
 ScriptController::~ScriptController()
 {
     if (!m_windowShells.isEmpty()) {
-        for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
-            iter->first->forgetScriptController(this);
-
         m_windowShells.clear();
     
         // It's likely that releasing the global object has created a lot of garbage.
@@ -102,7 +103,7 @@ ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode
     }
 
     // evaluate code. Returns the JS return value or 0
-    // if there was none, an error occured or the type couldn't be converted.
+    // if there was none, an error occurred or the type couldn't be converted.
 
     // inlineCode is true for <a href="javascript:doSomething()">
     // and false for <script>doSomething()</script>. Check if it has the
@@ -117,10 +118,20 @@ ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode
 
     RefPtr<Frame> protect = m_frame;
 
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
+        timelineAgent->willEvaluateScript(sourceURL, sourceCode.startLine());
+#endif
+
     exec->globalData().timeoutChecker.start();
-    Completion comp = WebCore::evaluateInWorld(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, shell, world);
+    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, shell);
     exec->globalData().timeoutChecker.stop();
 
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
+        timelineAgent->didEvaluateScript();
+#endif
+
     // Evaluating the JavaScript could cause the frame to be deallocated
     // so we start the keep alive timer here.
     m_frame->keepAlive();
@@ -145,53 +156,26 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
 // An DOMWrapperWorld other than the thread's normal world.
 class IsolatedWorld : public DOMWrapperWorld {
 public:
+    static PassRefPtr<IsolatedWorld> create(JSGlobalData* globalData) { return adoptRef(new IsolatedWorld(globalData)); }
+
+protected:
     IsolatedWorld(JSGlobalData* globalData)
-        : DOMWrapperWorld(globalData)
+        : DOMWrapperWorld(globalData, false)
     {
         JSGlobalData::ClientData* clientData = globalData->clientData;
         ASSERT(clientData);
         static_cast<WebCoreJSClientData*>(clientData)->rememberWorld(this);
     }
-
-    static PassRefPtr<IsolatedWorld> create(JSGlobalData* globalData) { return adoptRef(new IsolatedWorld(globalData)); }
 };
 
-static PassRefPtr<IsolatedWorld> findWorld(unsigned worldID)
+PassRefPtr<DOMWrapperWorld> ScriptController::createWorld()
 {
-    if (!worldID)
-        return IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
-
-    typedef HashMap<unsigned, RefPtr<IsolatedWorld> > WorldMap;
-    DEFINE_STATIC_LOCAL(WorldMap, isolatedWorlds, ());
-
-    WorldMap::iterator iter = isolatedWorlds.find(worldID);
-    if (iter != isolatedWorlds.end())
-        return iter->second;
-
-    RefPtr<IsolatedWorld> newWorld = IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
-    isolatedWorlds.add(worldID, newWorld);
-    return newWorld;
+    return IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
 }
 
-JSDOMWindow* ScriptController::globalObject(unsigned worldID)
+void ScriptController::getAllWorlds(Vector<DOMWrapperWorld*>& worlds)
 {
-    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
-    return windowShell(world.get())->window();
-}
-
-ScriptValue ScriptController::evaluateInIsolatedWorld(unsigned worldID, const ScriptSourceCode& sourceCode) 
-{
-    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
-    return evaluateInWorld(sourceCode, world.get());
-}
-
-void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>& sourceCode) 
-{
-    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
-
-    unsigned size = sourceCode.size();
-    for (unsigned i = 0; i < size; ++i)
-        evaluateInWorld(sourceCode[i], world.get());
+    static_cast<WebCoreJSClientData*>(JSDOMWindow::commonJSGlobalData()->clientData)->getAllWorlds(worlds);
 }
 
 void ScriptController::clearWindowShell()
@@ -201,19 +185,17 @@ void ScriptController::clearWindowShell()
 
     JSLock lock(SilenceAssertionsOnly);
 
-    // Clear the debugger from the current window before setting the new window.
-    DOMWrapperWorld* debugWorld = debuggerWorld();
-    attachDebugger(0);
-
     for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter) {
-        DOMWrapperWorld* world = iter->first;
         JSDOMWindowShell* windowShell = iter->second;
+
+        // Clear the debugger from the current window before setting the new window.
+        attachDebugger(windowShell, 0);
+
         windowShell->window()->willRemoveFromWindowShell();
         windowShell->setWindow(m_frame->domWindow());
 
         if (Page* page = m_frame->page()) {
-            if (world == debugWorld)
-                attachDebugger(page->debugger());
+            attachDebugger(windowShell, page->debugger());
             windowShell->window()->setProfileGroup(page->group().identifier());
         }
     }
@@ -228,53 +210,33 @@ JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld* world)
 
     JSLock lock(SilenceAssertionsOnly);
 
-    JSDOMWindowShell* windowShell = new JSDOMWindowShell(m_frame->domWindow());
+    JSDOMWindowShell* windowShell = new JSDOMWindowShell(m_frame->domWindow(), world);
     m_windowShells.add(world, windowShell);
-    world->rememberScriptController(this);
-    windowShell->window()->updateDocument(world);
+    windowShell->window()->updateDocument();
 
     if (Page* page = m_frame->page()) {
-        if (world == debuggerWorld())
-            attachDebugger(page->debugger());
+        attachDebugger(windowShell, page->debugger());
         windowShell->window()->setProfileGroup(page->group().identifier());
     }
 
-    {
-        EnterDOMWrapperWorld worldEntry(*JSDOMWindow::commonJSGlobalData(), world);
-        m_frame->loader()->dispatchWindowObjectAvailable();
-    }
+    m_frame->loader()->dispatchDidClearWindowObjectInWorld(world);
 
     return windowShell;
 }
 
-bool ScriptController::processingUserGesture() const
+bool ScriptController::processingUserGesture(DOMWrapperWorld* world) const
 {
-    return m_allowPopupsFromPlugin || processingUserGestureEvent() || isJavaScriptAnchorNavigation();
+    return m_allowPopupsFromPlugin || processingUserGestureEvent(world) || isJavaScriptAnchorNavigation();
 }
 
-bool ScriptController::processingUserGestureEvent() const
+bool ScriptController::processingUserGestureEvent(DOMWrapperWorld* world) const
 {
-    JSDOMWindowShell* shell = existingWindowShell(mainThreadNormalWorld());
+    JSDOMWindowShell* shell = existingWindowShell(world);
     if (!shell)
         return false;
 
-    if (Event* event = shell->window()->currentEvent()) {
-        if (event->createdByDOM())
-            return false;
-
-        const AtomicString& type = event->type();
-        if ( // mouse events
-            type == eventNames().clickEvent || type == eventNames().mousedownEvent ||
-            type == eventNames().mouseupEvent || type == eventNames().dblclickEvent ||
-            // keyboard events
-            type == eventNames().keydownEvent || type == eventNames().keypressEvent ||
-            type == eventNames().keyupEvent ||
-            // other accepted events
-            type == eventNames().selectEvent || type == eventNames().changeEvent ||
-            type == eventNames().focusEvent || type == eventNames().blurEvent ||
-            type == eventNames().submitEvent)
-            return true;
-    }
+    if (Event* event = shell->window()->currentEvent())
+        return event->fromUserGesture();
     
     return false;
 }
@@ -300,7 +262,20 @@ bool ScriptController::anyPageIsProcessingUserGesture() const
     HashSet<Page*>::const_iterator end = pages.end();
     for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
         for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-            if (frame->script()->processingUserGesture())
+            ScriptController* script = frame->script();
+
+            if (script->m_allowPopupsFromPlugin)
+                return true;
+
+            const ShellMap::const_iterator iterEnd = m_windowShells.end();
+            for (ShellMap::const_iterator iter = m_windowShells.begin(); iter != iterEnd; ++iter) {
+                JSDOMWindowShell* shell = iter->second.get();
+                Event* event = shell->window()->currentEvent();
+                if (event && event->fromUserGesture())
+                    return true;
+            }
+
+            if (isJavaScriptAnchorNavigation())
                 return true;
         }
     }
@@ -308,16 +283,14 @@ bool ScriptController::anyPageIsProcessingUserGesture() const
     return false;
 }
 
-bool ScriptController::isEnabled()
+void ScriptController::attachDebugger(JSC::Debugger* debugger)
 {
-    Settings* settings = m_frame->settings();
-    return (settings && settings->isJavaScriptEnabled());
+    for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
+        attachDebugger(iter->second, debugger);
 }
 
-void ScriptController::attachDebugger(JSC::Debugger* debugger)
+void ScriptController::attachDebugger(JSDOMWindowShell* shell, JSC::Debugger* debugger)
 {
-    // FIXME: Should be able to debug isolated worlds.
-    JSDOMWindowShell* shell = existingWindowShell(debuggerWorld());
     if (!shell)
         return;
 
@@ -335,7 +308,7 @@ void ScriptController::updateDocument()
 
     JSLock lock(SilenceAssertionsOnly);
     for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
-        iter->second->window()->updateDocument(iter->first);
+        iter->second->window()->updateDocument();
 }
 
 void ScriptController::updateSecurityOrigin()
@@ -345,7 +318,7 @@ void ScriptController::updateSecurityOrigin()
 
 Bindings::RootObject* ScriptController::bindingRootObject()
 {
-    if (!isEnabled())
+    if (!canExecuteScripts(NotAboutToExecuteScript))
         return 0;
 
     if (!m_bindingRootObject) {
@@ -372,7 +345,7 @@ PassRefPtr<Bindings::RootObject> ScriptController::createRootObject(void* native
 NPObject* ScriptController::windowScriptNPObject()
 {
     if (!m_windowScriptNPObject) {
-        if (isEnabled()) {
+        if (canExecuteScripts(NotAboutToExecuteScript)) {
             // JavaScript is enabled, so there is a JavaScript window object.
             // Return an NPObject bound to the window object.
             JSC::JSLock lock(SilenceAssertionsOnly);
@@ -405,7 +378,7 @@ NPObject* ScriptController::createScriptObjectForPluginElement(HTMLPlugInElement
 JSObject* ScriptController::jsObjectForPluginElement(HTMLPlugInElement* plugin)
 {
     // Can't create JSObjects when JavaScript is disabled
-    if (!isEnabled())
+    if (!canExecuteScripts(NotAboutToExecuteScript))
         return 0;
 
     // Create a JSObject bound to this element
@@ -468,31 +441,11 @@ void ScriptController::clearScriptObjects()
 #endif
 }
 
-ScriptValue ScriptController::executeScriptInIsolatedWorld(unsigned worldID, const String& script, bool forceUserGesture)
-{
-    ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());
-
-    if (!isEnabled() || isPaused())
-        return ScriptValue();
-
-    bool wasInExecuteScript = m_inExecuteScript;
-    m_inExecuteScript = true;
-
-    ScriptValue result = evaluateInIsolatedWorld(worldID, sourceCode);
-
-    if (!wasInExecuteScript) {
-        m_inExecuteScript = false;
-        Document::updateStyleForAllDocuments();
-    }
-
-    return result;
-}
-
-ScriptValue ScriptController::executeScriptInIsolatedWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture)
+ScriptValue ScriptController::executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture)
 {
     ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());
 
-    if (!isEnabled() || isPaused())
+    if (!canExecuteScripts(AboutToExecuteScript) || isPaused())
         return ScriptValue();
 
     bool wasInExecuteScript = m_inExecuteScript;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
index f2a497d191..6af17366cb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
@@ -62,13 +62,21 @@ class XSSAuditor;
 
 typedef HashMap<void*, RefPtr<JSC::Bindings::RootObject> > RootObjectMap;
 
+enum ReasonForCallingCanExecuteScripts {
+    AboutToExecuteScript,
+    NotAboutToExecuteScript
+};
+
 class ScriptController {
-    typedef WTF::HashMap<DOMWrapperWorld*, JSC::ProtectedPtr<JSDOMWindowShell> > ShellMap;
+    friend class ScriptCachedFrameData;
+    typedef WTF::HashMap< RefPtr<DOMWrapperWorld>, JSC::ProtectedPtr<JSDOMWindowShell> > ShellMap;
 
 public:
     ScriptController(Frame*);
     ~ScriptController();
 
+    static PassRefPtr<DOMWrapperWorld> createWorld();
+
     JSDOMWindowShell* windowShell(DOMWrapperWorld* world)
     {
         ShellMap::iterator iter = m_windowShells.find(world);
@@ -83,17 +91,12 @@ public:
     {
         return windowShell(world)->window();
     }
-    JSDOMWindow* globalObject(unsigned worldID);
 
-    void forgetWorld(DOMWrapperWorld* world)
-    {
-        m_windowShells.remove(world);
-    }
+    static void getAllWorlds(Vector<DOMWrapperWorld*>&);
 
     ScriptValue executeScript(const ScriptSourceCode&);
     ScriptValue executeScript(const String& script, bool forceUserGesture = false);
-    ScriptValue executeScriptInIsolatedWorld(unsigned worldID, const String& script, bool forceUserGesture = false);
-    ScriptValue executeScriptInIsolatedWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture = false);
+    ScriptValue executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture = false);
 
     // Returns true if argument is a JavaScript URL.
     bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
@@ -104,19 +107,19 @@ public:
 
     ScriptValue evaluate(const ScriptSourceCode&);
     ScriptValue evaluateInWorld(const ScriptSourceCode&, DOMWrapperWorld*);
-    ScriptValue evaluateInIsolatedWorld(unsigned /*worldID*/, const ScriptSourceCode&);
-    void evaluateInIsolatedWorld(unsigned /*worldID*/, const Vector<ScriptSourceCode>&);
 
     void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
     int eventHandlerLineNumber() { return m_handlerLineNumber; }
 
     void setProcessingTimerCallback(bool b) { m_processingTimerCallback = b; }
-    bool processingUserGesture() const;
+    bool processingUserGesture(DOMWrapperWorld*) const;
     bool anyPageIsProcessingUserGesture() const;
 
-    bool isEnabled();
+    bool canExecuteScripts(ReasonForCallingCanExecuteScripts);
 
-    void attachDebugger(JSC::Debugger*);
+    // Debugger can be 0 to detach any existing Debugger.
+    void attachDebugger(JSC::Debugger*); // Attaches/detaches in all worlds/window shells.
+    void attachDebugger(JSDOMWindowShell*, JSC::Debugger*);
 
     void setPaused(bool b) { m_paused = b; }
     bool isPaused() const { return m_paused; }
@@ -166,7 +169,7 @@ private:
 
     void disconnectPlatformScriptObjects();
 
-    bool processingUserGestureEvent() const;
+    bool processingUserGestureEvent(DOMWrapperWorld*) const;
     bool isJavaScriptAnchorNavigation() const;
 
     ShellMap m_windowShells;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerBrew.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerBrew.cpp
new file mode 100644
index 0000000000..d8d345aefa
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerBrew.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2008 Apple Computer, Inc.
+ * Copyright (C) 2009 Company 100, Inc.
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptController.h"
+
+#include "Bridge.h"
+#include "PluginView.h"
+#include "runtime_root.h"
+
+namespace WebCore {
+
+PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(WebCore::Widget* widget)
+{
+    if (!widget->isPluginView())
+        return 0;
+
+    return static_cast<PluginView*>(widget)->bindingInstance();
+
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerGtk.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerGtk.cpp
index c906034a77..6ffae69860 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerGtk.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerGtk.cpp
@@ -31,9 +31,9 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "Bridge.h"
 #include "PluginView.h"
 #include "runtime_root.h"
-#include "runtime.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp
index 3fe471d6f7..a1f1590c46 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp
@@ -27,8 +27,8 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "Bridge.h"
 #include "PluginView.h"
-#include "runtime.h"
 #include "runtime_root.h"
 
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
index 21ec0f2873..a89548929a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
@@ -29,6 +29,7 @@
 #import "config.h"
 #import "ScriptController.h"
 
+#import "Bridge.h"
 #import "DOMAbstractViewFrame.h"
 #import "DOMWindow.h"
 #import "Frame.h"
@@ -37,6 +38,8 @@
 #import "JSDOMWindow.h"
 #import "WebScriptObjectPrivate.h"
 #import "Widget.h"
+#import "objc_instance.h"
+#import "runtime_root.h"
 #import <JavaScriptCore/APICast.h>
 #import <runtime/JSLock.h>
 
@@ -46,12 +49,8 @@
 #import "npruntime_impl.h"
 #endif
 
-#import "objc_instance.h"
-#import "runtime_root.h"
-#import "runtime.h"
-
 #if ENABLE(MAC_JAVA_BRIDGE)
-#import "jni_instance.h"
+#import "JavaInstanceJSC.h"
 #endif
 
 @interface NSObject (WebPlugin)
@@ -108,7 +107,7 @@ PassScriptInstance ScriptController::createScriptInstanceForWidget(Widget* widge
 
 WebScriptObject* ScriptController::windowScriptObject()
 {
-    if (!isEnabled())
+    if (!canExecuteScripts(NotAboutToExecuteScript))
         return 0;
 
     if (!m_windowScriptObject) {
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerQt.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerQt.cpp
index 6b141902d6..55d4ba41d2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerQt.cpp
@@ -36,11 +36,11 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "Bridge.h"
 #include "DOMWindow.h"
 #include "PluginView.h"
 #include "qt_instance.h"
 #include "runtime_root.h"
-#include "runtime.h"
 
 #include <QWidget>
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWin.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWin.cpp
index 703cf7c7ff..e0a959ebc6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWin.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWin.cpp
@@ -27,8 +27,8 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "Bridge.h"
 #include "PluginView.h"
-#include "runtime.h"
 
 using namespace JSC::Bindings;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWx.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWx.cpp
index 1c14928882..1d7b4cab48 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWx.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWx.cpp
@@ -27,9 +27,9 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "Bridge.h"
 #include "PluginView.h"
 #include "runtime_root.h"
-#include "runtime.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.cpp
index e460ae849b..5305da35c7 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,7 +28,7 @@
  */
 
 #include "config.h"
-#include "JavaScriptDebugServer.h"
+#include "ScriptDebugServer.h"
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
@@ -38,14 +39,16 @@
 #include "FrameView.h"
 #include "JSDOMWindowCustom.h"
 #include "JavaScriptCallFrame.h"
-#include "JavaScriptDebugListener.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "PluginView.h"
+#include "ScriptBreakpoint.h"
+#include "ScriptController.h"
+#include "ScriptDebugListener.h"
 #include "ScrollView.h"
 #include "Widget.h"
-#include "ScriptController.h"
 #include <debugger/DebuggerCallFrame.h>
+#include <parser/SourceCode.h>
 #include <runtime/JSLock.h>
 #include <wtf/MainThread.h>
 #include <wtf/StdLibExtras.h>
@@ -55,62 +58,30 @@ using namespace JSC;
 
 namespace WebCore {
 
-typedef JavaScriptDebugServer::ListenerSet ListenerSet;
-
-inline const UString& JavaScriptDebugServer::BreakpointInfo::condition() const
-{
-    return m_condition;
-}
-
-void JavaScriptDebugServer::BreakpointInfo::setCondition(const UString& condition)
+ScriptDebugServer& ScriptDebugServer::shared()
 {
-    m_condition = condition;
-}
-
-JavaScriptDebugServer& JavaScriptDebugServer::shared()
-{
-    DEFINE_STATIC_LOCAL(JavaScriptDebugServer, server, ());
+    DEFINE_STATIC_LOCAL(ScriptDebugServer, server, ());
     return server;
 }
 
-JavaScriptDebugServer::JavaScriptDebugServer()
+ScriptDebugServer::ScriptDebugServer()
     : m_callingListeners(false)
-    , m_pauseOnExceptions(false)
+    , m_pauseOnExceptionsState(DontPauseOnExceptions)
     , m_pauseOnNextStatement(false)
     , m_paused(false)
     , m_doneProcessingDebuggerEvents(true)
+    , m_breakpointsActivated(true)
     , m_pauseOnCallFrame(0)
-    , m_recompileTimer(this, &JavaScriptDebugServer::recompileAllJSFunctions)
+    , m_recompileTimer(this, &ScriptDebugServer::recompileAllJSFunctions)
 {
 }
 
-JavaScriptDebugServer::~JavaScriptDebugServer()
+ScriptDebugServer::~ScriptDebugServer()
 {
     deleteAllValues(m_pageListenersMap);
-    deleteAllValues(m_breakpoints);
-}
-
-void JavaScriptDebugServer::addListener(JavaScriptDebugListener* listener)
-{
-    ASSERT_ARG(listener, listener);
-
-    m_listeners.add(listener);
-
-    didAddListener(0);
 }
 
-void JavaScriptDebugServer::removeListener(JavaScriptDebugListener* listener)
-{
-    ASSERT_ARG(listener, listener);
-
-    m_listeners.remove(listener);
-
-    didRemoveListener(0);
-    if (!hasListeners())
-        didRemoveLastListener();
-}
-
-void JavaScriptDebugServer::addListener(JavaScriptDebugListener* listener, Page* page)
+void ScriptDebugServer::addListener(ScriptDebugListener* listener, Page* page)
 {
     ASSERT_ARG(listener, listener);
     ASSERT_ARG(page, page);
@@ -125,7 +96,7 @@ void JavaScriptDebugServer::addListener(JavaScriptDebugListener* listener, Page*
     didAddListener(page);
 }
 
-void JavaScriptDebugServer::removeListener(JavaScriptDebugListener* listener, Page* page)
+void ScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page)
 {
     ASSERT_ARG(listener, listener);
     ASSERT_ARG(page, page);
@@ -146,7 +117,7 @@ void JavaScriptDebugServer::removeListener(JavaScriptDebugListener* listener, Pa
         didRemoveLastListener();
 }
 
-void JavaScriptDebugServer::pageCreated(Page* page)
+void ScriptDebugServer::pageCreated(Page* page)
 {
     ASSERT_ARG(page, page);
 
@@ -155,7 +126,7 @@ void JavaScriptDebugServer::pageCreated(Page* page)
     page->setDebugger(this);
 }
 
-bool JavaScriptDebugServer::hasListenersInterestedInPage(Page* page)
+bool ScriptDebugServer::hasListenersInterestedInPage(Page* page)
 {
     ASSERT_ARG(page, page);
 
@@ -165,72 +136,41 @@ bool JavaScriptDebugServer::hasListenersInterestedInPage(Page* page)
     return m_pageListenersMap.contains(page);
 }
 
-void JavaScriptDebugServer::addBreakpoint(intptr_t sourceID, unsigned lineNumber, const UString& condition)
-{
-    LineToBreakpointInfoMap* sourceBreakpoints = m_breakpoints.get(sourceID);
-    if (!sourceBreakpoints) {
-        sourceBreakpoints = new LineToBreakpointInfoMap;
-        m_breakpoints.set(sourceID, sourceBreakpoints);
-    }
-    BreakpointInfo* info = sourceBreakpoints->get(lineNumber);
-    if (!info)
-        sourceBreakpoints->set(lineNumber, new BreakpointInfo(condition));
-    else
-        updateBreakpointInfo(info, condition);
-}
-
-JavaScriptDebugServer::BreakpointInfo* JavaScriptDebugServer::breakpointInfo(intptr_t sourceID, unsigned lineNumber) const
-{
-    LineToBreakpointInfoMap* sourceBreakpoints = m_breakpoints.get(sourceID);
-    if (!sourceBreakpoints)
-        return 0;
-    return sourceBreakpoints->get(lineNumber);
-}
-
-void JavaScriptDebugServer::updateBreakpoint(intptr_t sourceID, unsigned lineNumber, const UString& condition)
+void ScriptDebugServer::setBreakpoint(const String& sourceID, unsigned lineNumber, ScriptBreakpoint breakpoint)
 {
-    BreakpointInfo* info = breakpointInfo(sourceID, lineNumber);
-    if (!info)
-        return;
-    updateBreakpointInfo(info, condition);
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    BreakpointsMap::iterator it = m_breakpoints.find(sourceIDValue);
+    if (it == m_breakpoints.end())
+        it = m_breakpoints.set(sourceIDValue, SourceBreakpoints()).first;
+    it->second.set(lineNumber, breakpoint);
 }
 
-void JavaScriptDebugServer::updateBreakpointInfo(BreakpointInfo* info, const UString& condition)
+void ScriptDebugServer::removeBreakpoint(const String& sourceID, unsigned lineNumber)
 {
-    info->setCondition(condition);
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    BreakpointsMap::iterator it = m_breakpoints.find(sourceIDValue);
+    if (it != m_breakpoints.end())
+        it->second.remove(lineNumber);
 }
 
-void JavaScriptDebugServer::removeBreakpoint(intptr_t sourceID, unsigned lineNumber)
+bool ScriptDebugServer::hasBreakpoint(intptr_t sourceID, unsigned lineNumber) const
 {
-    LineToBreakpointInfoMap* sourceBreakpoints = m_breakpoints.get(sourceID);
-    if (!sourceBreakpoints)
-        return;
-
-    BreakpointInfo* info = sourceBreakpoints->get(lineNumber);
-    if (!info)
-        return;
-
-    sourceBreakpoints->remove(lineNumber);
-    delete info;
-
-    if (sourceBreakpoints->isEmpty()) {
-        m_breakpoints.remove(sourceID);
-        delete sourceBreakpoints;
-    }
-}
+    if (!m_breakpointsActivated)
+        return false;
 
-bool JavaScriptDebugServer::hasBreakpoint(intptr_t sourceID, unsigned lineNumber) const
-{
-    BreakpointInfo* info = breakpointInfo(sourceID, lineNumber);
-    if (!info)
+    BreakpointsMap::const_iterator it = m_breakpoints.find(sourceID);
+    if (it == m_breakpoints.end())
+        return false;
+    SourceBreakpoints::const_iterator breakIt = it->second.find(lineNumber);
+    if (breakIt == it->second.end() || !breakIt->second.enabled)
         return false;
 
     // An empty condition counts as no condition which is equivalent to "true".
-    if (info->condition().isEmpty())
+    if (breakIt->second.condition.isEmpty())
         return true;
 
     JSValue exception;
-    JSValue result = m_currentCallFrame->evaluate(info->condition(), exception);
+    JSValue result = m_currentCallFrame->evaluate(breakIt->second.condition, exception);
     if (exception) {
         // An erroneous condition counts as "false".
         return false;
@@ -238,28 +178,27 @@ bool JavaScriptDebugServer::hasBreakpoint(intptr_t sourceID, unsigned lineNumber
     return result.toBoolean(m_currentCallFrame->scopeChain()->globalObject->globalExec());
 }
 
-void JavaScriptDebugServer::clearBreakpoints()
+void ScriptDebugServer::clearBreakpoints()
 {
-    BreakpointsMap::iterator end = m_breakpoints.end();
-    for (BreakpointsMap::iterator it = m_breakpoints.begin(); it != end; ++it) {
-        deleteAllValues(*(it->second));
-        it->second->clear();
-    }
-    deleteAllValues(m_breakpoints);
     m_breakpoints.clear();
 }
 
-void JavaScriptDebugServer::setPauseOnExceptions(bool pause)
+void ScriptDebugServer::setBreakpointsActivated(bool activated)
+{
+    m_breakpointsActivated = activated;
+}
+
+void ScriptDebugServer::setPauseOnExceptionsState(PauseOnExceptionsState pause)
 {
-    m_pauseOnExceptions = pause;
+    m_pauseOnExceptionsState = pause;
 }
 
-void JavaScriptDebugServer::pauseProgram()
+void ScriptDebugServer::pauseProgram()
 {
     m_pauseOnNextStatement = true;
 }
 
-void JavaScriptDebugServer::continueProgram()
+void ScriptDebugServer::continueProgram()
 {
     if (!m_paused)
         return;
@@ -268,7 +207,7 @@ void JavaScriptDebugServer::continueProgram()
     m_doneProcessingDebuggerEvents = true;
 }
 
-void JavaScriptDebugServer::stepIntoStatement()
+void ScriptDebugServer::stepIntoStatement()
 {
     if (!m_paused)
         return;
@@ -277,7 +216,7 @@ void JavaScriptDebugServer::stepIntoStatement()
     m_doneProcessingDebuggerEvents = true;
 }
 
-void JavaScriptDebugServer::stepOverStatement()
+void ScriptDebugServer::stepOverStatement()
 {
     if (!m_paused)
         return;
@@ -286,7 +225,7 @@ void JavaScriptDebugServer::stepOverStatement()
     m_doneProcessingDebuggerEvents = true;
 }
 
-void JavaScriptDebugServer::stepOutOfFunction()
+void ScriptDebugServer::stepOutOfFunction()
 {
     if (!m_paused)
         return;
@@ -295,27 +234,43 @@ void JavaScriptDebugServer::stepOutOfFunction()
     m_doneProcessingDebuggerEvents = true;
 }
 
-JavaScriptCallFrame* JavaScriptDebugServer::currentCallFrame()
+JavaScriptCallFrame* ScriptDebugServer::currentCallFrame()
 {
     if (!m_paused)
         return 0;
     return m_currentCallFrame.get();
 }
 
-static void dispatchDidParseSource(const ListenerSet& listeners, ExecState* exec, const JSC::SourceCode& source)
+ScriptState* ScriptDebugServer::currentCallFrameState()
+{
+    if (!m_paused)
+        return 0;
+    return m_currentCallFrame->scopeChain()->globalObject->globalExec();        
+}
+
+void ScriptDebugServer::dispatchDidParseSource(const ListenerSet& listeners, const JSC::SourceCode& source)
 {
-    Vector<JavaScriptDebugListener*> copy;
+    String sourceID = JSC::UString(JSC::UString::from(source.provider()->asID()));
+    String url = source.provider()->url();
+    String data = JSC::UString(source.data(), source.length());
+    int firstLine = source.firstLine();
+
+    Vector<ScriptDebugListener*> copy;
     copyToVector(listeners, copy);
     for (size_t i = 0; i < copy.size(); ++i)
-        copy[i]->didParseSource(exec, source);
+        copy[i]->didParseSource(sourceID, url, data, firstLine);
 }
 
-static void dispatchFailedToParseSource(const ListenerSet& listeners, ExecState* exec, const SourceCode& source, int errorLine, const String& errorMessage)
+void ScriptDebugServer::dispatchFailedToParseSource(const ListenerSet& listeners, const SourceCode& source, int errorLine, const String& errorMessage)
 {
-    Vector<JavaScriptDebugListener*> copy;
+    String url = source.provider()->url();
+    String data = JSC::UString(source.data(), source.length());
+    int firstLine = source.firstLine();
+
+    Vector<ScriptDebugListener*> copy;
     copyToVector(listeners, copy);
     for (size_t i = 0; i < copy.size(); ++i)
-        copy[i]->failedToParseSource(exec, source, errorLine, errorMessage);
+        copy[i]->failedToParseSource(url, data, firstLine, errorLine, errorMessage);
 }
 
 static Page* toPage(JSGlobalObject* globalObject)
@@ -327,7 +282,7 @@ static Page* toPage(JSGlobalObject* globalObject)
     return frame ? frame->page() : 0;
 }
 
-void JavaScriptDebugServer::detach(JSGlobalObject* globalObject)
+void ScriptDebugServer::detach(JSGlobalObject* globalObject)
 {
     // If we're detaching from the currently executing global object, manually tear down our
     // stack, since we won't get further debugger callbacks to do so. Also, resume execution,
@@ -340,7 +295,7 @@ void JavaScriptDebugServer::detach(JSGlobalObject* globalObject)
     Debugger::detach(globalObject);
 }
 
-void JavaScriptDebugServer::sourceParsed(ExecState* exec, const SourceCode& source, int errorLine, const UString& errorMessage)
+void ScriptDebugServer::sourceParsed(ExecState* exec, const SourceCode& source, int errorLine, const UString& errorMessage)
 {
     if (m_callingListeners)
         return;
@@ -355,31 +310,31 @@ void JavaScriptDebugServer::sourceParsed(ExecState* exec, const SourceCode& sour
 
     if (hasGlobalListeners()) {
         if (isError)
-            dispatchFailedToParseSource(m_listeners, exec, source, errorLine, errorMessage);
+            dispatchFailedToParseSource(m_listeners, source, errorLine, errorMessage);
         else
-            dispatchDidParseSource(m_listeners, exec, source);
+            dispatchDidParseSource(m_listeners, source);
     }
 
     if (ListenerSet* pageListeners = m_pageListenersMap.get(page)) {
         ASSERT(!pageListeners->isEmpty());
         if (isError)
-            dispatchFailedToParseSource(*pageListeners, exec, source, errorLine, errorMessage);
+            dispatchFailedToParseSource(*pageListeners, source, errorLine, errorMessage);
         else
-            dispatchDidParseSource(*pageListeners, exec, source);
+            dispatchDidParseSource(*pageListeners, source);
     }
 
     m_callingListeners = false;
 }
 
-static void dispatchFunctionToListeners(const ListenerSet& listeners, JavaScriptDebugServer::JavaScriptExecutionCallback callback)
+void ScriptDebugServer::dispatchFunctionToListeners(const ListenerSet& listeners, JavaScriptExecutionCallback callback)
 {
-    Vector<JavaScriptDebugListener*> copy;
+    Vector<ScriptDebugListener*> copy;
     copyToVector(listeners, copy);
     for (size_t i = 0; i < copy.size(); ++i)
         (copy[i]->*callback)();
 }
 
-void JavaScriptDebugServer::dispatchFunctionToListeners(JavaScriptExecutionCallback callback, Page* page)
+void ScriptDebugServer::dispatchFunctionToListeners(JavaScriptExecutionCallback callback, Page* page)
 {
     if (m_callingListeners)
         return;
@@ -388,17 +343,17 @@ void JavaScriptDebugServer::dispatchFunctionToListeners(JavaScriptExecutionCallb
 
     ASSERT(hasListeners());
 
-    WebCore::dispatchFunctionToListeners(m_listeners, callback);
+    dispatchFunctionToListeners(m_listeners, callback);
 
     if (ListenerSet* pageListeners = m_pageListenersMap.get(page)) {
         ASSERT(!pageListeners->isEmpty());
-        WebCore::dispatchFunctionToListeners(*pageListeners, callback);
+        dispatchFunctionToListeners(*pageListeners, callback);
     }
 
     m_callingListeners = false;
 }
 
-void JavaScriptDebugServer::setJavaScriptPaused(const PageGroup& pageGroup, bool paused)
+void ScriptDebugServer::setJavaScriptPaused(const PageGroup& pageGroup, bool paused)
 {
     setMainThreadCallbacksPaused(paused);
 
@@ -409,7 +364,7 @@ void JavaScriptDebugServer::setJavaScriptPaused(const PageGroup& pageGroup, bool
         setJavaScriptPaused(*it, paused);
 }
 
-void JavaScriptDebugServer::setJavaScriptPaused(Page* page, bool paused)
+void ScriptDebugServer::setJavaScriptPaused(Page* page, bool paused)
 {
     ASSERT_ARG(page, page);
 
@@ -419,11 +374,11 @@ void JavaScriptDebugServer::setJavaScriptPaused(Page* page, bool paused)
         setJavaScriptPaused(frame, paused);
 }
 
-void JavaScriptDebugServer::setJavaScriptPaused(Frame* frame, bool paused)
+void ScriptDebugServer::setJavaScriptPaused(Frame* frame, bool paused)
 {
     ASSERT_ARG(frame, frame);
 
-    if (!frame->script()->isEnabled())
+    if (!frame->script()->canExecuteScripts(NotAboutToExecuteScript))
         return;
 
     frame->script()->setPaused(paused);
@@ -437,15 +392,7 @@ void JavaScriptDebugServer::setJavaScriptPaused(Frame* frame, bool paused)
     setJavaScriptPaused(frame->view(), paused);
 }
 
-#if PLATFORM(MAC)
-
-void JavaScriptDebugServer::setJavaScriptPaused(FrameView*, bool)
-{
-}
-
-#else
-
-void JavaScriptDebugServer::setJavaScriptPaused(FrameView* view, bool paused)
+void ScriptDebugServer::setJavaScriptPaused(FrameView* view, bool paused)
 {
     if (!view)
         return;
@@ -462,9 +409,7 @@ void JavaScriptDebugServer::setJavaScriptPaused(FrameView* view, bool paused)
     }
 }
 
-#endif
-
-void JavaScriptDebugServer::pauseIfNeeded(Page* page)
+void ScriptDebugServer::pauseIfNeeded(Page* page)
 {
     if (m_paused)
         return;
@@ -482,7 +427,7 @@ void JavaScriptDebugServer::pauseIfNeeded(Page* page)
     m_pauseOnNextStatement = false;
     m_paused = true;
 
-    dispatchFunctionToListeners(&JavaScriptDebugListener::didPause, page);
+    dispatchFunctionToListeners(&ScriptDebugListener::didPause, page);
 
     setJavaScriptPaused(page->group(), true);
 
@@ -497,10 +442,10 @@ void JavaScriptDebugServer::pauseIfNeeded(Page* page)
 
     m_paused = false;
 
-    dispatchFunctionToListeners(&JavaScriptDebugListener::didContinue, page);
+    dispatchFunctionToListeners(&ScriptDebugListener::didContinue, page);
 }
 
-void JavaScriptDebugServer::callEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void ScriptDebugServer::callEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
 {
     if (m_paused)
         return;
@@ -509,7 +454,7 @@ void JavaScriptDebugServer::callEvent(const DebuggerCallFrame& debuggerCallFrame
     pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
 }
 
-void JavaScriptDebugServer::atStatement(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void ScriptDebugServer::atStatement(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
 {
     if (m_paused)
         return;
@@ -522,7 +467,7 @@ void JavaScriptDebugServer::atStatement(const DebuggerCallFrame& debuggerCallFra
     pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
 }
 
-void JavaScriptDebugServer::returnEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void ScriptDebugServer::returnEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
 {
     if (m_paused)
         return;
@@ -540,7 +485,7 @@ void JavaScriptDebugServer::returnEvent(const DebuggerCallFrame& debuggerCallFra
     m_currentCallFrame = m_currentCallFrame->caller();
 }
 
-void JavaScriptDebugServer::exception(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void ScriptDebugServer::exception(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, bool hasHandler)
 {
     if (m_paused)
         return;
@@ -549,14 +494,14 @@ void JavaScriptDebugServer::exception(const DebuggerCallFrame& debuggerCallFrame
     if (!m_currentCallFrame)
         return;
 
-    if (m_pauseOnExceptions)
+    if (m_pauseOnExceptionsState == PauseOnAllExceptions || (m_pauseOnExceptionsState == PauseOnUncaughtExceptions && !hasHandler))
         m_pauseOnNextStatement = true;
 
     m_currentCallFrame->update(debuggerCallFrame, sourceID, lineNumber);
     pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
 }
 
-void JavaScriptDebugServer::willExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void ScriptDebugServer::willExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
 {
     if (m_paused)
         return;
@@ -565,7 +510,7 @@ void JavaScriptDebugServer::willExecuteProgram(const DebuggerCallFrame& debugger
     pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
 }
 
-void JavaScriptDebugServer::didExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void ScriptDebugServer::didExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
 {
     if (m_paused)
         return;
@@ -583,7 +528,7 @@ void JavaScriptDebugServer::didExecuteProgram(const DebuggerCallFrame& debuggerC
     m_currentCallFrame = m_currentCallFrame->caller();
 }
 
-void JavaScriptDebugServer::didReachBreakpoint(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void ScriptDebugServer::didReachBreakpoint(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
 {
     if (m_paused)
         return;
@@ -597,18 +542,18 @@ void JavaScriptDebugServer::didReachBreakpoint(const DebuggerCallFrame& debugger
     pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
 }
 
-void JavaScriptDebugServer::recompileAllJSFunctionsSoon()
+void ScriptDebugServer::recompileAllJSFunctionsSoon()
 {
     m_recompileTimer.startOneShot(0);
 }
 
-void JavaScriptDebugServer::recompileAllJSFunctions(Timer<JavaScriptDebugServer>*)
+void ScriptDebugServer::recompileAllJSFunctions(Timer<ScriptDebugServer>*)
 {
     JSLock lock(SilenceAssertionsOnly);
     Debugger::recompileAllJSFunctions(JSDOMWindow::commonJSGlobalData());
 }
 
-void JavaScriptDebugServer::didAddListener(Page* page)
+void ScriptDebugServer::didAddListener(Page* page)
 {
     recompileAllJSFunctionsSoon();
 
@@ -618,7 +563,7 @@ void JavaScriptDebugServer::didAddListener(Page* page)
         Page::setDebuggerForAllPages(this);
 }
 
-void JavaScriptDebugServer::didRemoveListener(Page* page)
+void ScriptDebugServer::didRemoveListener(Page* page)
 {
     if (hasGlobalListeners() || (page && hasListenersInterestedInPage(page)))
         return;
@@ -631,7 +576,7 @@ void JavaScriptDebugServer::didRemoveListener(Page* page)
         Page::setDebuggerForAllPages(0);
 }
 
-void JavaScriptDebugServer::didRemoveLastListener()
+void ScriptDebugServer::didRemoveLastListener()
 {
     m_doneProcessingDebuggerEvents = true;
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.h
new file mode 100644
index 0000000000..47405851c7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.h
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptDebugServer_h
+#define ScriptDebugServer_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "PlatformString.h"
+#include "ScriptBreakpoint.h"
+#include "ScriptState.h"
+#include "Timer.h"
+
+#include <debugger/Debugger.h>
+#include <runtime/UString.h>
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/RefPtr.h>
+
+namespace JSC {
+class DebuggerCallFrame;
+class JSGlobalObject;
+}
+namespace WebCore {
+
+class Frame;
+class FrameView;
+class Page;
+class PageGroup;
+class ScriptDebugListener;
+class JavaScriptCallFrame;
+
+class ScriptDebugServer : JSC::Debugger, public Noncopyable {
+public:
+    static ScriptDebugServer& shared();
+
+    void addListener(ScriptDebugListener*, Page*);
+    void removeListener(ScriptDebugListener*, Page*);
+
+    void setBreakpoint(const String& sourceID, unsigned lineNumber, ScriptBreakpoint breakpoint);
+    void removeBreakpoint(const String& sourceID, unsigned lineNumber);
+    void clearBreakpoints();
+    void setBreakpointsActivated(bool activated);
+
+    enum PauseOnExceptionsState {
+        DontPauseOnExceptions,
+        PauseOnAllExceptions,
+        PauseOnUncaughtExceptions
+    };
+    PauseOnExceptionsState pauseOnExceptionsState() const { return m_pauseOnExceptionsState; }
+    void setPauseOnExceptionsState(PauseOnExceptionsState);
+
+    void pauseProgram();
+    void continueProgram();
+    void stepIntoStatement();
+    void stepOverStatement();
+    void stepOutOfFunction();
+
+    void recompileAllJSFunctionsSoon();
+    void recompileAllJSFunctions(Timer<ScriptDebugServer>* = 0);
+
+    JavaScriptCallFrame* currentCallFrame();
+    ScriptState* currentCallFrameState();
+
+    void pageCreated(Page*);
+
+private:
+    typedef HashSet<ScriptDebugListener*> ListenerSet;
+    typedef void (ScriptDebugListener::*JavaScriptExecutionCallback)();
+
+    ScriptDebugServer();
+    ~ScriptDebugServer();
+
+    bool hasBreakpoint(intptr_t sourceID, unsigned lineNumber) const;
+    bool hasListeners() const { return !m_listeners.isEmpty() || !m_pageListenersMap.isEmpty(); }
+    bool hasGlobalListeners() const { return !m_listeners.isEmpty(); }
+    bool hasListenersInterestedInPage(Page*);
+
+    void setJavaScriptPaused(const PageGroup&, bool paused);
+    void setJavaScriptPaused(Page*, bool paused);
+    void setJavaScriptPaused(Frame*, bool paused);
+    void setJavaScriptPaused(FrameView*, bool paused);
+
+    void dispatchFunctionToListeners(JavaScriptExecutionCallback, Page*);
+    void dispatchFunctionToListeners(const ListenerSet& listeners, JavaScriptExecutionCallback callback);
+    void dispatchDidParseSource(const ListenerSet& listeners, const JSC::SourceCode& source);
+    void dispatchFailedToParseSource(const ListenerSet& listeners, const JSC::SourceCode& source, int errorLine, const String& errorMessage);
+
+    void pauseIfNeeded(Page*);
+
+    virtual void detach(JSC::JSGlobalObject*);
+
+    virtual void sourceParsed(JSC::ExecState*, const JSC::SourceCode&, int errorLine, const JSC::UString& errorMsg);
+    virtual void callEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
+    virtual void atStatement(const JSC::DebuggerCallFrame&, intptr_t sourceID, int firstLine);
+    virtual void returnEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
+    virtual void exception(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, bool hasHandler);
+    virtual void willExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
+    virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
+    virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
+
+    void didAddListener(Page*);
+    void didRemoveListener(Page*);
+    void didRemoveLastListener();
+
+    typedef HashMap<Page*, ListenerSet*> PageListenersMap;
+    typedef HashMap<intptr_t, SourceBreakpoints> BreakpointsMap;
+
+    PageListenersMap m_pageListenersMap;
+    ListenerSet m_listeners;
+    bool m_callingListeners;
+    PauseOnExceptionsState m_pauseOnExceptionsState;
+    bool m_pauseOnNextStatement;
+    bool m_paused;
+    bool m_doneProcessingDebuggerEvents;
+    bool m_breakpointsActivated;
+    JavaScriptCallFrame* m_pauseOnCallFrame;
+    RefPtr<JavaScriptCallFrame> m_currentCallFrame;
+    BreakpointsMap m_breakpoints;
+    Timer<ScriptDebugServer> m_recompileTimer;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif // ScriptDebugServer_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
index 8399c7acb4..afa87849d1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
@@ -37,6 +37,7 @@
 #include "JSNode.h"
 #include "Frame.h"
 #include "XSSAuditor.h"
+#include <runtime/JSLock.h>
 
 using namespace JSC;
 
@@ -52,14 +53,18 @@ static const String& eventParameterName(bool isSVGEvent)
 PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribute* attr)
 {
     ASSERT(node);
+    ASSERT(attr);
+    if (attr->isNull())
+        return 0;
 
     int lineNumber = 1;
     String sourceURL;
+    JSObject* wrapper = 0;
     
     // FIXME: We should be able to provide accurate source information for frameless documents, too (e.g. for importing nodes from XMLHttpRequest.responseXML).
     if (Frame* frame = node->document()->frame()) {
         ScriptController* scriptController = frame->script();
-        if (!scriptController->isEnabled())
+        if (!scriptController->canExecuteScripts(AboutToExecuteScript))
             return 0;
 
         if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
@@ -69,9 +74,13 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribu
 
         lineNumber = scriptController->eventHandlerLineNumber();
         sourceURL = node->document()->url().string();
+
+        JSC::JSLock lock(SilenceAssertionsOnly);
+        JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(node->document(), mainThreadNormalWorld());
+        wrapper = asObject(toJS(globalObject->globalExec(), globalObject, node));
     }
 
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, lineNumber, mainThreadNormalWorld());
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, lineNumber, wrapper, mainThreadNormalWorld());
 }
 
 PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
@@ -79,11 +88,15 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
     if (!frame)
         return 0;
 
+    ASSERT(attr);
+    if (attr->isNull())
+        return 0;
+
     int lineNumber = 1;
     String sourceURL;
     
     ScriptController* scriptController = frame->script();
-    if (!scriptController->isEnabled())
+    if (!scriptController->canExecuteScripts(AboutToExecuteScript))
         return 0;
 
     if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
@@ -93,15 +106,19 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
 
     lineNumber = scriptController->eventHandlerLineNumber();
     sourceURL = frame->document()->url().string();
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, lineNumber, mainThreadNormalWorld());
+    JSObject* wrapper = toJSDOMWindow(frame, mainThreadNormalWorld());
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, lineNumber, wrapper, mainThreadNormalWorld());
 }
 
 String getEventListenerHandlerBody(ScriptExecutionContext* context, ScriptState* scriptState, EventListener* eventListener)
 {
-    JSC::JSObject* functionObject = eventListener->jsFunction(context);
-    if (!functionObject)
+    const JSEventListener* jsListener = JSEventListener::cast(eventListener);
+    if (!jsListener)
+        return "";
+    JSC::JSObject* jsFunction = jsListener->jsFunction(context);
+    if (!jsFunction)
         return "";
-    return functionObject->toString(scriptState);
+    return jsFunction->toString(scriptState);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
index 91b2a57614..5001d3c501 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -42,8 +42,8 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScriptFunctionCall::ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const String& name)
-    : m_exec(exec)
+ScriptFunctionCall::ScriptFunctionCall(const ScriptObject& thisObject, const String& name)
+    : m_exec(thisObject.scriptState())
     , m_thisObject(thisObject)
     , m_name(name)
 {
@@ -51,6 +51,10 @@ ScriptFunctionCall::ScriptFunctionCall(ScriptState* exec, const ScriptObject& th
 
 void ScriptFunctionCall::appendArgument(const ScriptObject& argument)
 {
+    if (argument.scriptState() != m_exec) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
     m_arguments.append(argument.jsObject());
 }
 
@@ -72,14 +76,27 @@ void ScriptFunctionCall::appendArgument(const String& argument)
 
 void ScriptFunctionCall::appendArgument(const JSC::UString& argument)
 {
+    JSLock lock(SilenceAssertionsOnly);
     m_arguments.append(jsString(m_exec, argument));
 }
 
+void ScriptFunctionCall::appendArgument(const char* argument)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    m_arguments.append(jsString(m_exec, UString(argument)));
+}
+
 void ScriptFunctionCall::appendArgument(JSC::JSValue argument)
 {
     m_arguments.append(argument);
 }
 
+void ScriptFunctionCall::appendArgument(long argument)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
 void ScriptFunctionCall::appendArgument(long long argument)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -92,6 +109,12 @@ void ScriptFunctionCall::appendArgument(unsigned int argument)
     m_arguments.append(jsNumber(m_exec, argument));
 }
 
+void ScriptFunctionCall::appendArgument(unsigned long argument)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
 void ScriptFunctionCall::appendArgument(int argument)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -123,8 +146,7 @@ ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
     if (callType == CallTypeNone)
         return ScriptValue();
 
-    // FIXME: Should this function take a worldID? - only used by inspector?
-    JSValue result = callInWorld(m_exec, function, callType, callData, thisObject, m_arguments, debuggerWorld());
+    JSValue result = JSC::call(m_exec, function, callType, callData, thisObject, m_arguments);
     if (m_exec->hadException()) {
         if (reportExceptions)
             reportException(m_exec, m_exec->exception());
@@ -162,8 +184,7 @@ ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExcept
     if (constructType == ConstructTypeNone)
         return ScriptObject();
 
-    // FIXME: Currently this method constructs objects in debuggerWorld().  We could use the current world, or pass a worldID to this function?
-    JSValue result = constructInWorld(m_exec, constructor, constructType, constructData, m_arguments, debuggerWorld());
+    JSValue result = JSC::construct(m_exec, constructor, constructType, constructData, m_arguments);
     if (m_exec->hadException()) {
         if (reportExceptions)
             reportException(m_exec, m_exec->exception());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h
index 079ac212ab..9742e8fcfa 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h
@@ -48,17 +48,20 @@ namespace WebCore {
 
     class ScriptFunctionCall {
     public:
-        ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const String& name);
+        ScriptFunctionCall(const ScriptObject& thisObject, const String& name);
         virtual ~ScriptFunctionCall() {};
 
         void appendArgument(const ScriptObject&);
         void appendArgument(const ScriptString&);
         void appendArgument(const ScriptValue&);
         void appendArgument(const String&);
+        void appendArgument(const char*);
         void appendArgument(const JSC::UString&);
         void appendArgument(JSC::JSValue);
+        void appendArgument(long);
         void appendArgument(long long);
         void appendArgument(unsigned int);
+        void appendArgument(unsigned long);
         void appendArgument(int);
         void appendArgument(bool);
         ScriptValue call(bool& hadException, bool reportExceptions = true);
@@ -70,6 +73,12 @@ namespace WebCore {
         ScriptObject m_thisObject;
         String m_name;
         JSC::MarkedArgumentBuffer m_arguments;
+
+    private:
+        // MarkedArgumentBuffer must be stack allocated, so prevent heap
+        // alloc of ScriptFunctionCall as well.
+        void* operator new(size_t) { ASSERT_NOT_REACHED(); return reinterpret_cast<void*>(0xbadbeef); }
+        void* operator new[](size_t) { ASSERT_NOT_REACHED(); return reinterpret_cast<void*>(0xbadbeef); }
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptInstance.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptInstance.h
index 3095df933d..0b3b59f13a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptInstance.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptInstance.h
@@ -31,8 +31,8 @@
 #ifndef ScriptInstance_h
 #define ScriptInstance_h
 
+#include "Bridge.h"
 #include <wtf/RefPtr.h>
-#include "runtime.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
index 1172e8e81f..7948219e14 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
@@ -32,10 +32,15 @@
 #include "ScriptObject.h"
 
 #include "JSDOMBinding.h"
-#include "JSInspectorBackend.h"
 
 #include <runtime/JSLock.h>
 
+#if ENABLE(INSPECTOR)
+#include "JSInjectedScriptHost.h"
+#include "JSInspectorBackend.h"
+#include "JSInspectorFrontendHost.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
@@ -65,6 +70,10 @@ bool ScriptObject::set(const String& name, const String& value)
 
 bool ScriptObject::set(const char* name, const ScriptObject& value)
 {
+    if (value.scriptState() != m_scriptState) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
     jsObject()->put(m_scriptState, Identifier(m_scriptState, name), value.jsObject(), slot);
@@ -87,6 +96,14 @@ bool ScriptObject::set(const char* name, double value)
     return handleException(m_scriptState);
 }
 
+bool ScriptObject::set(const char* name, long value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    PutPropertySlot slot;
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
+}
+
 bool ScriptObject::set(const char* name, long long value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -111,6 +128,14 @@ bool ScriptObject::set(const char* name, unsigned value)
     return handleException(m_scriptState);
 }
 
+bool ScriptObject::set(const char* name, unsigned long value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    PutPropertySlot slot;
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
+}
+
 bool ScriptObject::set(const char* name, bool value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -140,6 +165,22 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Inspect
     globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
 }
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorFrontendHost* value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
+    return handleException(scriptState);
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InjectedScriptHost* value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
+    return handleException(scriptState);
+}
 #endif // ENABLE(INSPECTOR)
 
 bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
index 31381f39df..0c993e1b27 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
@@ -38,21 +38,26 @@
 #include <runtime/Protect.h>
 
 namespace WebCore {
+    class InjectedScriptHost;
     class InspectorBackend;
+    class InspectorFrontendHost;
 
     class ScriptObject : public ScriptValue {
     public:
         ScriptObject(ScriptState*, JSC::JSObject*);
         ScriptObject() {}
         JSC::JSObject* jsObject() const { return asObject(jsValue()); }
+        ScriptState* scriptState() const { return m_scriptState; }
 
         bool set(const String& name, const String&);
         bool set(const char* name, const ScriptObject&);
         bool set(const char* name, const String&);
         bool set(const char* name, double);
+        bool set(const char* name, long);
         bool set(const char* name, long long);
         bool set(const char* name, int);
         bool set(const char* name, unsigned);
+        bool set(const char* name, unsigned long);
         bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
@@ -66,6 +71,8 @@ namespace WebCore {
         static bool set(ScriptState*, const char* name, const ScriptObject&);
 #if ENABLE(INSPECTOR)
         static bool set(ScriptState*, const char* name, InspectorBackend*);
+        static bool set(ScriptState*, const char* name, InspectorFrontendHost*);
+        static bool set(ScriptState*, const char* name, InjectedScriptHost*);
 #endif
         static bool get(ScriptState*, const char* name, ScriptObject&);
         static bool remove(ScriptState*, const char* name);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
deleted file mode 100644
index 313530feca..0000000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ScriptObjectQuarantine.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "Document.h"
-#include "Frame.h"
-#include "JSDOMBinding.h"
-#include "JSInspectedObjectWrapper.h"
-#include "JSNode.h"
-#include "ScriptObject.h"
-#include "ScriptValue.h"
-#include "Storage.h"
-
-#include <runtime/JSLock.h>
-
-#if ENABLE(DATABASE)
-#include "Database.h"
-#include "JSDatabase.h"
-#endif
-
-#if ENABLE(DOM_STORAGE)
-#include "JSStorage.h"
-#endif
-
-using namespace JSC;
-
-namespace WebCore {
-
-ScriptValue quarantineValue(ScriptState* scriptState, const ScriptValue& value)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    return ScriptValue(JSInspectedObjectWrapper::wrap(scriptState, value.jsValue()));
-}
-
-#if ENABLE(DATABASE)
-bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject)
-{
-    ASSERT(database);
-
-    Frame* frame = database->document()->frame();
-    if (!frame)
-        return false;
-
-    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame, debuggerWorld());
-    ExecState* exec = globalObject->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, database))));
-
-    return true;
-}
-#endif
-
-#if ENABLE(DOM_STORAGE)
-bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject)
-{
-    ASSERT(storage);
-    Frame* frame = storage->frame();
-    ASSERT(frame);
-
-    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame, debuggerWorld());
-    ExecState* exec = globalObject->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, storage))));
-
-    return true;
-}
-#endif
-
-bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
-{
-    ExecState* exec = scriptStateFromNode(node);
-    if (!exec)
-        return false;
-
-    JSLock lock(SilenceAssertionsOnly);
-    // FIXME: Should use some sort of globalObjectFromNode()
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, deprecatedGlobalObjectForPrototype(exec), node))));
-
-    return true;
-}
-
-bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject)
-{
-    ASSERT(domWindow);
-
-    JSDOMWindow* window = toJSDOMWindow(domWindow->frame(), debuggerWorld());
-    ExecState* exec = window->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, window)));
-
-    return true;
-}
-
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfile.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfile.h
new file mode 100644
index 0000000000..32095e3cac
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfile.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptProfile_h
+#define ScriptProfile_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include <profiler/Profile.h>
+
+namespace WebCore {
+
+typedef JSC::Profile ScriptProfile;
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif // ScriptProfile_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfiler.cpp
index 20cd805c04..789e3d340c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfiler.cpp
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,31 +21,29 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
 
-#include "JSCanvasFloatArray.h"
+#include "ScriptProfiler.h"
 
-#include "CanvasFloatArray.h"
-
-using namespace JSC;
+#include <profiler/Profiler.h>
 
 namespace WebCore {
 
-void JSCanvasFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void ScriptProfiler::start(ScriptState* state, const String& title)
 {
-    impl()->set(index, static_cast<float>(value.toInt32(exec)));
+    JSC::Profiler::profiler()->startProfiling(state, title);
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasFloatArray* object)
+PassRefPtr<ScriptProfile> ScriptProfiler::stop(ScriptState* state, const String& title)
 {
-    return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, object);
+    return JSC::Profiler::profiler()->stopProfiling(state, title);
 }
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfiler.h
index 04697cebff..a86bcfbf6c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfiler.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,31 +21,28 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
+#ifndef ScriptProfiler_h
+#define ScriptProfiler_h
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include "ScriptProfile.h"
+#include "ScriptState.h"
 
-#include "JSCanvasByteArray.h"
-
-#include "CanvasByteArray.h"
-
-using namespace JSC;
+#include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
-void JSCanvasByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasByteArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, object);
-}
+class ScriptProfiler : public Noncopyable {
+public:
+    static void start(ScriptState* state, const String& title);
+    static PassRefPtr<ScriptProfile> stop(ScriptState* state, const String& title);
+};
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif // ScriptProfiler_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
index 60ba2a05d7..3edd1bdd07 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
@@ -38,7 +38,13 @@
 
 namespace WebCore {
 
-ScriptState* scriptStateFromNode(Node* node)
+ScriptState* mainWorldScriptState(Frame* frame)
+{
+    JSDOMWindowShell* shell = frame->script()->windowShell(mainThreadNormalWorld());
+    return shell->window()->globalExec();
+}
+
+ScriptState* scriptStateFromNode(DOMWrapperWorld* world, Node* node)
 {
     if (!node)
         return 0;
@@ -48,14 +54,14 @@ ScriptState* scriptStateFromNode(Node* node)
     Frame* frame = document->frame();
     if (!frame)
         return 0;
-    if (!frame->script()->isEnabled())
+    if (!frame->script()->canExecuteScripts(NotAboutToExecuteScript))
         return 0;
-    return frame->script()->globalObject(mainThreadCurrentWorld())->globalExec();
+    return frame->script()->globalObject(world)->globalExec();
 }
 
-ScriptState* scriptStateFromPage(Page* page)
+ScriptState* scriptStateFromPage(DOMWrapperWorld* world, Page* page)
 {
-    return page->mainFrame()->script()->globalObject(mainThreadCurrentWorld())->globalExec();
+    return page->mainFrame()->script()->globalObject(world)->globalExec();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
index 279234e4a8..0c7c5757a6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
@@ -36,6 +36,7 @@
 
 namespace WebCore {
     class DOMWrapperWorld;
+    class Frame;
     class Node;
     class Page;
 
@@ -45,8 +46,10 @@ namespace WebCore {
     // For now, the separation is purely by convention.
     typedef JSC::ExecState ScriptState;
 
-    ScriptState* scriptStateFromNode(Node*);
-    ScriptState* scriptStateFromPage(Page*);
+    ScriptState* mainWorldScriptState(Frame*);
+
+    ScriptState* scriptStateFromNode(DOMWrapperWorld*, Node*);
+    ScriptState* scriptStateFromPage(DOMWrapperWorld*, Page*);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
index 6dab9a00a2..18964b8d66 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
@@ -33,6 +33,7 @@
 
 #include "PlatformString.h"
 #include <runtime/UString.h>
+#include <runtime/StringBuilder.h>
 
 namespace WebCore {
 
@@ -57,7 +58,10 @@ public:
 
     ScriptString& operator+=(const String& s)
     {
-        m_str += s;
+        JSC::StringBuilder buffer;
+        buffer.append(m_str);
+        buffer.append(s);
+        m_str = buffer.build();
         return *this;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
index 6eac102d79..005c329ead 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "ScriptValue.h"
 
+#include "SerializedScriptValue.h"
+
 #include <JavaScriptCore/APICast.h>
 #include <JavaScriptCore/JSValueRef.h>
 
@@ -40,13 +42,13 @@ using namespace JSC;
 
 namespace WebCore {
 
-bool ScriptValue::getString(String& result) const
+bool ScriptValue::getString(ScriptState* scriptState, String& result) const
 {
     if (!m_value)
         return false;
     JSLock lock(SilenceAssertionsOnly);
     UString ustring;
-    if (!m_value.get().getString(ustring))
+    if (!m_value.get().getString(scriptState, ustring))
         return false;
     result = ustring;
     return true;
@@ -81,4 +83,14 @@ bool ScriptValue::isObject() const
     return m_value.get().isObject();
 }
 
+PassRefPtr<SerializedScriptValue> ScriptValue::serialize(ScriptState* scriptState)
+{
+    return SerializedScriptValue::create(scriptState, jsValue());
+}
+
+ScriptValue ScriptValue::deserialize(ScriptState* scriptState, SerializedScriptValue* value)
+{
+    return ScriptValue(value->deserialize(scriptState, scriptState->lexicalGlobalObject()));
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
index 19bb693135..3d0d944aa2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
@@ -33,11 +33,14 @@
 
 #include "PlatformString.h"
 #include "ScriptState.h"
+#include <runtime/JSValue.h>
 #include <runtime/Protect.h>
+#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
 class String;
+class SerializedScriptValue;
 
 class ScriptValue {
 public:
@@ -45,7 +48,7 @@ public:
     virtual ~ScriptValue() {}
 
     JSC::JSValue jsValue() const { return m_value.get(); }
-    bool getString(String& result) const;
+    bool getString(ScriptState*, String& result) const;
     String toString(ScriptState* scriptState) const { return m_value.get().toString(scriptState); }
     bool isEqual(ScriptState*, const ScriptValue&) const;
     bool isNull() const;
@@ -53,6 +56,11 @@ public:
     bool isObject() const;
     bool hasNoValue() const { return m_value == JSC::JSValue(); }
 
+    PassRefPtr<SerializedScriptValue> serialize(ScriptState*);
+    static ScriptValue deserialize(ScriptState*, SerializedScriptValue*);
+
+    static ScriptValue undefined() { return ScriptValue(JSC::jsUndefined()); }
+
 private:
     JSC::ProtectedJSValue m_value;
 };
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptWrappable.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptWrappable.h
new file mode 100644
index 0000000000..5e99c1c571
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptWrappable.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptWrappable_h
+#define ScriptWrappable_h
+
+#include "JSDOMWrapper.h"
+#include <runtime/WeakGCPtr.h>
+
+namespace WebCore {
+
+class ScriptWrappable {
+public:
+    ScriptWrappable() : m_wrapper(0) { }
+    
+    DOMObject* wrapper() const
+    {
+        return m_wrapper.get();
+    }
+    
+    void setWrapper(DOMObject* wrapper)
+    {
+        ASSERT(wrapper);
+        m_wrapper = wrapper;
+    }
+    
+    void clearWrapper(DOMObject* wrapper) 
+    { 
+        m_wrapper.clear(wrapper); 
+    }
+    
+private:
+    JSC::WeakGCPtr<DOMObject> m_wrapper;
+};
+
+} // namespace WebCore
+
+#endif // ScriptWrappable_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp
index 48cd92d7c4..fbf889946e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -27,9 +27,19 @@
 #include "config.h"
 #include "SerializedScriptValue.h"
 
+#include "File.h"
+#include "FileList.h"
+#include "ImageData.h"
+#include "JSDOMGlobalObject.h"
+#include "JSFile.h"
+#include "JSFileList.h"
+#include "JSImageData.h"
+#include <JavaScriptCore/APICast.h>
 #include <runtime/DateInstance.h>
 #include <runtime/ExceptionHelpers.h>
+#include <runtime/JSLock.h>
 #include <runtime/PropertyNameArray.h>
+#include <wtf/ByteArray.h>
 #include <wtf/HashTraits.h>
 #include <wtf/Vector.h>
 
@@ -136,6 +146,52 @@ private:
     unsigned m_length;
 };
 
+class SerializedFileList : public SharedSerializedData {
+public:
+    static PassRefPtr<SerializedFileList> create(const FileList* list)
+    {
+        return adoptRef(new SerializedFileList(list));
+    }
+
+    unsigned length() const { return m_files.size(); }
+    const String& item(unsigned idx) { return m_files[idx]; }
+
+private:
+    SerializedFileList(const FileList* list)
+    {
+        unsigned length = list->length();
+        m_files.reserveCapacity(length);
+        for (unsigned i = 0; i < length; i++)
+            m_files.append(list->item(i)->path().crossThreadString());
+    }
+
+    Vector<String> m_files;
+};
+
+class SerializedImageData : public SharedSerializedData {
+public:
+    static PassRefPtr<SerializedImageData> create(const ImageData* imageData)
+    {
+        return adoptRef(new SerializedImageData(imageData));
+    }
+    
+    unsigned width() const { return m_width; }
+    unsigned height() const { return m_height; }
+    WTF::ByteArray* data() const { return m_storage.get(); }
+private:
+    SerializedImageData(const ImageData* imageData)
+        : m_width(imageData->width())
+        , m_height(imageData->height())
+    {
+        WTF::ByteArray* array = imageData->data()->data();
+        m_storage = WTF::ByteArray::create(array->length());
+        memcpy(m_storage->data(), array->data(), array->length());
+    }
+    unsigned m_width;
+    unsigned m_height;
+    RefPtr<WTF::ByteArray> m_storage;
+};
+
 SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedObject> data)
     : m_type(ObjectType)
     , m_sharedData(data)
@@ -148,6 +204,24 @@ SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedArray> dat
 {
 }
 
+SerializedScriptValueData::SerializedScriptValueData(const FileList* fileList)
+    : m_type(FileListType)
+    , m_sharedData(SerializedFileList::create(fileList))
+{
+}
+
+SerializedScriptValueData::SerializedScriptValueData(const ImageData* imageData)
+    : m_type(ImageDataType)
+    , m_sharedData(SerializedImageData::create(imageData))
+{
+}
+
+SerializedScriptValueData::SerializedScriptValueData(const File* file)
+    : m_type(FileType)
+    , m_string(file->path().crossThreadString())
+{
+}
+
 SerializedArray* SharedSerializedData::asArray()
 {
     return static_cast<SerializedArray*>(this);
@@ -158,6 +232,16 @@ SerializedObject* SharedSerializedData::asObject()
     return static_cast<SerializedObject*>(this);
 }
 
+SerializedFileList* SharedSerializedData::asFileList()
+{
+    return static_cast<SerializedFileList*>(this);
+}
+
+SerializedImageData* SharedSerializedData::asImageData()
+{
+    return static_cast<SerializedImageData*>(this);
+}
+
 static const unsigned maximumFilterRecursion = 40000;
 enum WalkerState { StateUnknown, ArrayStartState, ArrayStartVisitMember, ArrayEndVisitMember,
     ObjectStartState, ObjectStartVisitMember, ObjectEndVisitMember };
@@ -470,7 +554,7 @@ struct SerializingTreeWalker : public BaseWalker {
             return SerializedScriptValueData(value);
 
         if (value.isString())
-            return SerializedScriptValueData(asString(value)->value());
+            return SerializedScriptValueData(asString(value)->value(m_exec));
 
         if (value.isNumber())
             return SerializedScriptValueData(SerializedScriptValueData::NumberType, value.uncheckedGetNumber());
@@ -481,10 +565,19 @@ struct SerializingTreeWalker : public BaseWalker {
         if (isArray(value))
             return SerializedScriptValueData();
 
-        CallData unusedData;
-        if (value.isObject() && value.getCallData(unusedData) == CallTypeNone)
-            return SerializedScriptValueData();
-
+        if (value.isObject()) {
+            JSObject* obj = asObject(value);
+            if (obj->inherits(&JSFile::s_info))
+                return SerializedScriptValueData(toFile(obj));
+            if (obj->inherits(&JSFileList::s_info))
+                return SerializedScriptValueData(toFileList(obj));
+            if (obj->inherits(&JSImageData::s_info))
+                return SerializedScriptValueData(toImageData(obj));
+                
+            CallData unusedData;
+            if (value.getCallData(unusedData) == CallTypeNone)
+                return SerializedScriptValueData();
+        }
         // Any other types are expected to serialize as null.
         return SerializedScriptValueData(jsNull());
     }
@@ -559,8 +652,10 @@ struct DeserializingTreeWalker : public BaseWalker {
     typedef JSObject* OutputObject;
     typedef SerializedObject::PropertyNameList PropertyList;
 
-    DeserializingTreeWalker(ExecState* exec, bool mustCopy)
+    DeserializingTreeWalker(ExecState* exec, JSGlobalObject* globalObject, bool mustCopy)
         : BaseWalker(exec)
+        , m_globalObject(globalObject)
+        , m_isDOMGlobalObject(globalObject->inherits(&JSDOMGlobalObject::s_info))
         , m_mustCopy(mustCopy)
     {
     }
@@ -589,14 +684,14 @@ struct DeserializingTreeWalker : public BaseWalker {
 
     JSArray* createOutputArray(unsigned length)
     {
-        JSArray* array = constructEmptyArray(m_exec);
+        JSArray* array = constructEmptyArray(m_exec, m_globalObject);
         array->setLength(length);
         return array;
     }
 
     JSObject* createOutputObject()
     {
-        return constructEmptyObject(m_exec);
+        return constructEmptyObject(m_exec, m_globalObject);
     }
 
     uint32_t length(RefPtr<SerializedArray> array)
@@ -639,11 +734,35 @@ struct DeserializingTreeWalker : public BaseWalker {
             case SerializedScriptValueData::NumberType:
                 return jsNumber(m_exec, value.asDouble());
             case SerializedScriptValueData::DateType:
-                return new (m_exec) DateInstance(m_exec, value.asDouble());
-            default:
+                return new (m_exec) DateInstance(m_exec, m_globalObject->dateStructure(), value.asDouble());
+            case SerializedScriptValueData::FileType:
+                if (!m_isDOMGlobalObject)
+                    return jsNull();
+                return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), File::create(value.asString().crossThreadString()));
+            case SerializedScriptValueData::FileListType: {
+                if (!m_isDOMGlobalObject)
+                    return jsNull();
+                RefPtr<FileList> result = FileList::create();
+                SerializedFileList* serializedFileList = value.asFileList();
+                unsigned length = serializedFileList->length();
+                for (unsigned i = 0; i < length; i++)
+                    result->append(File::create(serializedFileList->item(i)));
+                return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), result.get());
+            }
+            case SerializedScriptValueData::ImageDataType: {
+                if (!m_isDOMGlobalObject)
+                    return jsNull();
+                SerializedImageData* serializedImageData = value.asImageData();
+                RefPtr<ImageData> result = ImageData::create(serializedImageData->width(), serializedImageData->height());
+                memcpy(result->data()->data()->data(), serializedImageData->data()->data(), serializedImageData->data()->length());
+                return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), result.get());
+            }
+            case SerializedScriptValueData::EmptyType:
                 ASSERT_NOT_REACHED();
-                return JSValue();
+                return jsNull();
         }
+        ASSERT_NOT_REACHED();
+        return jsNull();
     }
 
     void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
@@ -681,12 +800,15 @@ struct DeserializingTreeWalker : public BaseWalker {
     }
 
 private:
+    void* operator new(size_t);
+    JSGlobalObject* m_globalObject;
+    bool m_isDOMGlobalObject;
     bool m_mustCopy;
 };
 
-JSValue SerializedScriptValueData::deserialize(ExecState* exec, bool mustCopy) const
+JSValue SerializedScriptValueData::deserialize(ExecState* exec, JSGlobalObject* global, bool mustCopy) const
 {
-    DeserializingTreeWalker context(exec, mustCopy);
+    DeserializingTreeWalker context(exec, global, mustCopy);
     return walk<DeserializingTreeWalker>(context, *this);
 }
 
@@ -790,11 +912,15 @@ struct TeardownTreeWalker {
             case SerializedScriptValueData::StringType:
             case SerializedScriptValueData::ImmediateType:
             case SerializedScriptValueData::NumberType:
+            case SerializedScriptValueData::DateType:
+            case SerializedScriptValueData::EmptyType:
+            case SerializedScriptValueData::FileType:
+            case SerializedScriptValueData::FileListType:
+            case SerializedScriptValueData::ImageDataType:
                 return true;
-            default:
-                ASSERT_NOT_REACHED();
-                return JSValue();
         }
+        ASSERT_NOT_REACHED();
+        return true;
     }
 
     void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
@@ -836,4 +962,38 @@ void SerializedScriptValueData::tearDownSerializedData()
     walk<TeardownTreeWalker>(context, *this);
 }
 
+SerializedScriptValue::~SerializedScriptValue()
+{
+}
+
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(JSContextRef originContext, JSValueRef apiValue, JSValueRef* exception)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = toJS(originContext);
+    JSValue value = toJS(exec, apiValue);
+    PassRefPtr<SerializedScriptValue> serializedValue = SerializedScriptValue::create(exec, value);
+    if (exec->hadException()) {
+        if (exception)
+            *exception = toRef(exec, exec->exception());
+        exec->clearException();
+        return 0;
+    }
+    
+    return serializedValue;
+}
+
+JSValueRef SerializedScriptValue::deserialize(JSContextRef destinationContext, JSValueRef* exception)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = toJS(destinationContext);
+    JSValue value = deserialize(exec, exec->lexicalGlobalObject());
+    if (exec->hadException()) {
+        if (exception)
+            *exception = toRef(exec, exec->exception());
+        exec->clearException();
+        return 0;
+    }
+    return toRef(exec, value);
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h
index f8a126ff7b..93bd0de908 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h
@@ -29,15 +29,25 @@
 
 #include "ScriptValue.h"
 
+typedef const struct OpaqueJSContext* JSContextRef;
+typedef const struct OpaqueJSValue* JSValueRef;
+
 namespace WebCore {
-    class SerializedObject;
+    class File;
+    class FileList;
+    class ImageData;
     class SerializedArray;
+    class SerializedFileList;
+    class SerializedImageData;
+    class SerializedObject;
 
     class SharedSerializedData : public RefCounted<SharedSerializedData> {
     public:
         virtual ~SharedSerializedData() { }
         SerializedArray* asArray();
         SerializedObject* asObject();
+        SerializedFileList* asFileList();
+        SerializedImageData* asImageData();
     };
 
     class SerializedScriptValue;
@@ -51,12 +61,15 @@ namespace WebCore {
             ImmediateType,
             ObjectType,
             ArrayType,
-            StringType
+            StringType,
+            FileType,
+            FileListType,
+            ImageDataType
         };
 
         SerializedType type() const { return m_type; }
         static SerializedScriptValueData serialize(JSC::ExecState*, JSC::JSValue);
-        JSC::JSValue deserialize(JSC::ExecState*, bool mustCopy) const;
+        JSC::JSValue deserialize(JSC::ExecState*, JSC::JSGlobalObject*, bool mustCopy) const;
 
         ~SerializedScriptValueData()
         {
@@ -74,6 +87,10 @@ namespace WebCore {
             , m_string(string.crossThreadString()) // FIXME: Should be able to just share the Rep
         {
         }
+        
+        explicit SerializedScriptValueData(const File*);
+        explicit SerializedScriptValueData(const FileList*);
+        explicit SerializedScriptValueData(const ImageData*);
 
         explicit SerializedScriptValueData(JSC::JSValue value)
             : m_type(ImmediateType)
@@ -105,7 +122,7 @@ namespace WebCore {
 
         String asString() const
         {
-            ASSERT(m_type == StringType);
+            ASSERT(m_type == StringType || m_type == FileType);
             return m_string;
         }
 
@@ -123,6 +140,20 @@ namespace WebCore {
             return m_sharedData->asArray();
         }
 
+        SerializedFileList* asFileList() const
+        {
+            ASSERT(m_type == FileListType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asFileList();
+        }
+        
+        SerializedImageData* asImageData() const
+        {
+            ASSERT(m_type == ImageDataType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asImageData();
+        }
+
         operator bool() const { return m_type != EmptyType; }
 
         SerializedScriptValueData release()
@@ -150,6 +181,8 @@ namespace WebCore {
             return adoptRef(new SerializedScriptValue(SerializedScriptValueData::serialize(exec, value)));
         }
 
+        static PassRefPtr<SerializedScriptValue> create(JSContextRef, JSValueRef value, JSValueRef* exception);
+
         static PassRefPtr<SerializedScriptValue> create(String string)
         {
             return adoptRef(new SerializedScriptValue(SerializedScriptValueData(string)));
@@ -175,14 +208,15 @@ namespace WebCore {
             return m_value.asString();
         }
 
-        JSC::JSValue deserialize(JSC::ExecState* exec)
+        JSC::JSValue deserialize(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject)
         {
             if (!m_value)
                 return JSC::jsNull();
-            return m_value.deserialize(exec, m_mustCopy);
+            return m_value.deserialize(exec, globalObject, m_mustCopy);
         }
 
-        ~SerializedScriptValue() {}
+        JSValueRef deserialize(JSContextRef, JSValueRef* exception);
+        ~SerializedScriptValue();
 
     private:
         SerializedScriptValue(SerializedScriptValueData value)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WebCoreJSClientData.h b/src/3rdparty/webkit/WebCore/bindings/js/WebCoreJSClientData.h
new file mode 100644
index 0000000000..e0d2e4e977
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WebCoreJSClientData.h
@@ -0,0 +1,78 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *  Copyright (C) 2009 Google, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef WebCoreJSClientData_h
+#define WebCoreJSClientData_h
+
+#include "DOMWrapperWorld.h"
+#include "DOMObjectHashTableMap.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/HashSet.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class WebCoreJSClientData : public JSC::JSGlobalData::ClientData, public Noncopyable {
+    friend class JSGlobalDataWorldIterator;
+public:
+    WebCoreJSClientData(JSC::JSGlobalData* globalData)
+        : m_normalWorld(DOMWrapperWorld::create(globalData, true))
+    {
+        m_worldSet.add(m_normalWorld.get());
+    }
+
+    virtual ~WebCoreJSClientData()
+    {
+        ASSERT(m_worldSet.contains(m_normalWorld.get()));
+        ASSERT(m_worldSet.size() == 1);
+        ASSERT(m_normalWorld->hasOneRef());
+        m_normalWorld.clear();
+        ASSERT(m_worldSet.isEmpty());
+    }
+
+    DOMWrapperWorld* normalWorld() { return m_normalWorld.get(); }
+
+    void getAllWorlds(Vector<DOMWrapperWorld*>& worlds)
+    {
+        copyToVector(m_worldSet, worlds);
+    }
+
+    void rememberWorld(DOMWrapperWorld* world)
+    {
+        ASSERT(!m_worldSet.contains(world));
+        m_worldSet.add(world);
+    }
+    void forgetWorld(DOMWrapperWorld* world)
+    {
+        ASSERT(m_worldSet.contains(world));
+        m_worldSet.remove(world);
+    }
+
+    DOMObjectHashTableMap hashTableMap;
+
+private:
+    HashSet<DOMWrapperWorld*> m_worldSet;
+    RefPtr<DOMWrapperWorld> m_normalWorld;
+};
+
+} // namespace WebCore
+
+#endif // WebCoreJSClientData_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
index b66b0e8151..e371423ad8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
@@ -30,11 +30,11 @@
 
 #include "WorkerScriptController.h"
 
-#include "JSDOMBinding.h"
 #include "JSDedicatedWorkerContext.h"
 #include "JSSharedWorkerContext.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
+#include "WebCoreJSClientData.h"
 #include "WorkerContext.h"
 #include "WorkerObjectProxy.h"
 #include "WorkerThread.h"
@@ -58,9 +58,6 @@ WorkerScriptController::WorkerScriptController(WorkerContext* workerContext)
 WorkerScriptController::~WorkerScriptController()
 {
     m_workerContextWrapper = 0; // Unprotect the global object.
-
-    ASSERT(!m_globalData->heap.protectedObjectCount());
-    ASSERT(!m_globalData->heap.isBusy());
     m_globalData->heap.destroy();
 }
 
@@ -123,7 +120,7 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode,
 
     ExecState* exec = m_workerContextWrapper->globalExec();
     m_workerContextWrapper->globalData()->timeoutChecker.start();
-    Completion comp = evaluateInWorld(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper, currentWorld(exec));
+    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper);
     m_workerContextWrapper->globalData()->timeoutChecker.stop();
 
     if (comp.complType() == Normal || comp.complType() == ReturnValue)
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
index c1cb0a0347..487a4b3912 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
@@ -1,26 +1,26 @@
 #
 # WebKit IDL parser
-# 
+#
 # Copyright (C) 2005 Nikolas Zimmermann <wildfox@kde.org>
 # Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
 # Copyright (C) 2007 Apple Inc. All rights reserved.
 # Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
-# 
+#
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
 # License as published by the Free Software Foundation; either
 # version 2 of the License, or (at your option) any later version.
-# 
+#
 # This library is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 # Library General Public License for more details.
-# 
+#
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 # Boston, MA 02110-1301, USA.
-# 
+#
 
 package CodeGenerator;
 
@@ -39,14 +39,15 @@ my $codeGenerator = 0;
 
 my $verbose = 0;
 
-my %primitiveTypeHash = ("int" => 1, "short" => 1, "long" => 1, "long long" => 1, 
+my %primitiveTypeHash = ("int" => 1, "short" => 1, "long" => 1, "long long" => 1,
                          "unsigned int" => 1, "unsigned short" => 1,
-                         "unsigned long" => 1, "unsigned long long" => 1, 
-                         "float" => 1, "double" => 1, 
-                         "boolean" => 1, "void" => 1);
+                         "unsigned long" => 1, "unsigned long long" => 1,
+                         "float" => 1, "double" => 1,
+                         "boolean" => 1, "void" => 1,
+                         "Date" => 1);
 
 my %podTypeHash = ("SVGNumber" => 1, "SVGTransform" => 1);
-my %podTypesWithWritablePropertiesHash = ("SVGLength" => 1, "SVGMatrix" => 1, "SVGPoint" => 1, "SVGRect" => 1);
+my %podTypesWithWritablePropertiesHash = ("SVGAngle" => 1, "SVGLength" => 1, "SVGMatrix" => 1, "SVGPoint" => 1, "SVGPreserveAspectRatio" => 1, "SVGRect" => 1);
 my %stringTypeHash = ("DOMString" => 1, "AtomicString" => 1);
 
 my %nonPointerTypeHash = ("DOMTimeStamp" => 1, "CompareHow" => 1, "SVGPaintType" => 1);
@@ -327,10 +328,10 @@ sub IsSVGAnimatedType
     my $type = shift;
 
     return 1 if $svgAnimatedTypeHash{$type};
-    return 0; 
+    return 0;
 }
 
-# Uppercase the first letter while respecting WebKit style guidelines. 
+# Uppercase the first letter while respecting WebKit style guidelines.
 # E.g., xmlEncoding becomes XMLEncoding, but xmlllang becomes Xmllang.
 sub WK_ucfirst
 {
@@ -340,12 +341,13 @@ sub WK_ucfirst
     return $ret;
 }
 
-# Lowercase the first letter while respecting WebKit style guidelines. 
+# Lowercase the first letter while respecting WebKit style guidelines.
 # URL becomes url, but SetURL becomes setURL.
 sub WK_lcfirst
 {
     my ($object, $param) = @_;
     my $ret = lcfirst($param);
+    $ret =~ s/hTML/html/ if $ret =~ /^hTML/;
     $ret =~ s/uRL/url/ if $ret =~ /^uRL/;
     $ret =~ s/jS/js/ if $ret =~ /^jS/;
     $ret =~ s/xML/xml/ if $ret =~ /^xML/;
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
deleted file mode 100644
index 4ca441b525..0000000000
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
+++ /dev/null
@@ -1,1319 +0,0 @@
-#
-# Copyright (C) 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
-# Copyright (C) 2006 Anders Carlsson <andersca@mac.com>
-# Copyright (C) 2006, 2007 Samuel Weinig <sam@webkit.org>
-# Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
-# Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
-#
-# This library is free software; you can redistribute it and/or
-# modify it under the terms of the GNU Library General Public
-# License as published by the Free Software Foundation; either
-# version 2 of the License, or (at your option) any later version.
-#
-# This library is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# Library General Public License for more details.
-#
-# You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
-# the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-# Boston, MA 02111-1307, USA.
-
-package CodeGeneratorCOM;
-
-use File::stat;
-
-# Global Variables
-my $module = "";
-my $outputDir = "";
-
-my @IDLHeader = ();
-my @IDLContent = ();
-my %IDLIncludes = ();
-my %IDLForwardDeclarations = ();
-my %IDLDontForwardDeclare = ();
-my %IDLImports = ();
-my %IDLDontImport = ();
-
-my @CPPInterfaceHeader = ();
-
-my @CPPHeaderHeader = ();
-my @CPPHeaderContent = ();
-my %CPPHeaderIncludes = ();
-my %CPPHeaderIncludesAngle = ();
-my %CPPHeaderForwardDeclarations = ();
-my %CPPHeaderDontForwardDeclarations = ();
-
-my @CPPImplementationHeader = ();
-my @CPPImplementationContent = ();
-my %CPPImplementationIncludes = ();
-my %CPPImplementationWebCoreIncludes = ();
-my %CPPImplementationIncludesAngle = ();
-my %CPPImplementationDontIncludes = ();
-
-my @additionalInterfaceDefinitions = ();
-
-my $DASHES = "----------------------------------------";
-my $TEMP_PREFIX = "GEN_";
-
-# Hashes
-
-my %includeCorrector = map {($_, 1)} qw{UIEvent KeyboardEvent MouseEvent
-                                        MutationEvent OverflowEvent WheelEvent};
-
-my %conflictMethod = (
-    # FIXME: Add C language keywords?
-);
-
-# Default License Templates
-my @licenseTemplate = split(/\r/, << "EOF");
-/*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-EOF
-
-# Default constructor
-sub new
-{
-    my $object = shift;
-    my $reference = { };
-
-    $codeGenerator = shift;
-    $outputDir = shift;
-
-    bless($reference, $object);
-    return $reference;
-}
-
-sub finish
-{
-    my $object = shift;
-}
-
-# Params: 'domClass' struct
-sub GenerateInterface
-{
-    my $object = shift;
-    my $dataNode = shift;
-    my $defines = shift;
-
-    my $name = $dataNode->name;
-
-    my $pureInterface = $dataNode->extendedAttributes->{"PureInterface"};
-
-    # Start actual generation..
-    $object->GenerateIDL($dataNode, $pureInterface);
-    if ($pureInterface) {
-        $object->GenerateInterfaceHeader($dataNode);
-    } else {
-        $object->GenerateCPPHeader($dataNode);
-        $object->GenerateCPPImplementation($dataNode);
-    }
-
-    # Write changes.
-    $object->WriteData($name, $pureInterface);
-}
-
-# Params: 'idlDocument' struct
-sub GenerateModule
-{
-    my $object = shift;
-    my $dataNode = shift;
-
-    $module = $dataNode->module;
-}
-
-sub GetInterfaceName
-{
-    my $name = $codeGenerator->StripModule(shift);
-
-    die "GetInterfaceName should only be used on interfaces." if ($codeGenerator->IsStringType($name) or $codeGenerator->IsPrimitiveType($name));
-
-    # special cases
-    return "I" . $TEMP_PREFIX . "DOMAbstractView" if $name eq "DOMWindow";
-    return "I" . $TEMP_PREFIX . $name if $name eq "DOMImplementation" or $name eq "DOMTimeStamp";
-
-    # Default, assume COM type has the same type name as
-    # idl type prefixed with "IDOM".
-    return "I" . $TEMP_PREFIX . "DOM" . $name;
-}
-
-sub GetClassName
-{
-    my $name = $codeGenerator->StripModule(shift);
-
-    # special cases
-    return "BSTR" if $codeGenerator->IsStringType($name);
-    return "BOOL" if $name eq "boolean";
-    return "unsigned" if $name eq "unsigned long";
-    return "int" if $name eq "long";
-    return $name if $codeGenerator->IsPrimitiveType($name);
-    return $TEMP_PREFIX . "DOMAbstractView" if $name eq "DOMWindow";
-    return $TEMP_PREFIX . $name if $name eq "DOMImplementation" or $name eq "DOMTimeStamp";
-
-    # Default, assume COM type has the same type name as
-    # idl type prefixed with "DOM".
-    return $TEMP_PREFIX . "DOM" . $name;
-}
-
-sub GetCOMType
-{
-    my ($type) = @_;
-
-    die "Don't use GetCOMType for string types, use one of In/Out variants instead." if $codeGenerator->IsStringType($type);
-
-    return "BOOL" if $type eq "boolean";
-    return "UINT" if $type eq "unsigned long";
-    return "INT" if $type eq "long";
-    return $type if $codeGenerator->IsPrimitiveType($type) or $type eq "DOMTimeStamp";
-    # return "unsigned short" if $type eq "CompareHow" or $type eq "SVGPaintType";
-
-    return GetInterfaceName($type) . "*";
-}
-
-sub GetCOMTypeIn
-{
-    my ($type) = @_;
-    return "LPCTSTR" if $codeGenerator->IsStringType($type);
-    return GetCOMType($type);
-}
-
-sub GetCOMTypeOut
-{
-    my ($type) = @_;
-    return "BSTR" if $codeGenerator->IsStringType($type);
-    return GetCOMType($type);
-}
-
-sub IDLTypeToImplementationType
-{
-    my $type = $codeGenerator->StripModule(shift);
-
-    return "bool" if $type eq "boolean";
-    return "unsigned" if $type eq "unsigned long";
-    return "int" if $type eq "long";
-    return $type if $codeGenerator->IsPrimitiveType($type);
-
-    return "WebCore::String" if $codeGenerator->IsStringType($type);
-    return "WebCore::${type}";
-}
-
-sub StripNamespace
-{
-    my ($type) = @_;
-
-    $type =~ s/^WebCore:://;
-
-    return $type;
-}
-
-sub GetParentInterface
-{
-    my ($dataNode) = @_;
-    return "I" . $TEMP_PREFIX . "DOMObject" if (@{$dataNode->parents} == 0);
-    return GetInterfaceName($codeGenerator->StripModule($dataNode->parents(0)));
-}
-
-sub GetParentClass
-{
-    my ($dataNode) = @_;
-    return $TEMP_PREFIX . "DOMObject" if (@{$dataNode->parents} == 0);
-    return GetClassName($codeGenerator->StripModule($dataNode->parents(0)));
-}
-
-sub AddForwardDeclarationsForTypeInIDL
-{
-    my $type = $codeGenerator->StripModule(shift);
-
-    return if $codeGenerator->IsNonPointerType($type) or $codeGenerator->IsStringType($type);
-
-    my $interface = GetInterfaceName($type);
-    $IDLForwardDeclarations{$interface} = 1;
-    $IDLImports{$interface} = 1;
-}
-
-sub AddIncludesForTypeInCPPHeader
-{
-    my $type = $codeGenerator->StripModule(shift);
-    my $useAngleBrackets = shift;
-
-    return if $codeGenerator->IsNonPointerType($type);
-
-    # Add special Cases HERE
-
-    if ($type =~ m/^I/) {
-        $type = "WebKit";
-    }
-
-    if ($useAngleBrackets) {
-        $CPPHeaderIncludesAngle{"$type.h"} = 1;
-        return;
-    }
-
-    if ($type eq "GEN_DOMImplementation") {
-        $CPPHeaderIncludes{"GEN_DOMDOMImplementation.h"} = 1;
-        return;
-    }
-
-    if ($type eq "IGEN_DOMImplementation") {
-        $CPPHeaderIncludes{"IGEN_DOMDOMImplementation.h"} = 1;
-        return;
-    }
-
-    $CPPHeaderIncludes{"$type.h"} = 1;
-}
-
-sub AddForwardDeclarationsForTypeInCPPHeader
-{
-    my $type = $codeGenerator->StripModule(shift);
-
-    return if $codeGenerator->IsNonPointerType($type) or $codeGenerator->IsStringType($type);
-
-    my $interface = GetInterfaceName($type);
-    $CPPHeaderForwardDeclarations{$interface} = 1;
-}
-
-sub AddIncludesForTypeInCPPImplementation
-{
-    my $type = $codeGenerator->StripModule(shift);
-
-    die "Include type not supported!" if $includeCorrector{$type};
-
-    return if $codeGenerator->IsNonPointerType($type);
-
-    if ($codeGenerator->IsStringType($type)) {
-        $CPPImplementationWebCoreIncludes{"AtomicString.h"} = 1;
-        $CPPImplementationWebCoreIncludes{"BString.h"} = 1;
-        $CPPImplementationWebCoreIncludes{"KURL.h"} = 1;
-        return;
-    }
-
-    # Special casing
-    $CPPImplementationWebCoreIncludes{"NameNodeList.h"} = 1 if $type eq "NodeList";
-    $CPPImplementationWebCoreIncludes{"CSSMutableStyleDeclaration.h"} = 1 if $type eq "CSSStyleDeclaration";
-
-    # Add implementation type
-    $CPPImplementationWebCoreIncludes{StripNamespace(IDLTypeToImplementationType($type)) . ".h"} = 1;
-
-    my $COMClassName = GetClassName($type);
-    $CPPImplementationIncludes{"${COMClassName}.h"} = 1;
-}
-
-sub GetAdditionalInterfaces
-{
-    # This function does nothing, but it stays here for future multiple inheritance support.
-    my $type = $codeGenerator->StripModule(shift);
-    return ();
-}
-
-sub GenerateIDL
-{
-    my ($object, $dataNode, $pureInterface) = @_;
-
-    my $inInterfaceName = $dataNode->name;
-    my $outInterfaceName = GetInterfaceName($inInterfaceName);
-    my $uuid = $dataNode->extendedAttributes->{"InterfaceUUID"} || die "All classes require an InterfaceUUID extended attribute.";
-
-    my $parentInterfaceName = ($pureInterface) ? "IUnknown" : GetParentInterface($dataNode);
-
-    my $numConstants = @{$dataNode->constants};
-    my $numAttributes = @{$dataNode->attributes};
-    my $numFunctions = @{$dataNode->functions};
-
-    # - Add default header template
-    @IDLHeader = @licenseTemplate;
-    push(@IDLHeader, "\n");
-
-    # - INCLUDES -
-    push(@IDLHeader, "#ifndef DO_NO_IMPORTS\n");
-    push(@IDLHeader, "import \"oaidl.idl\";\n");
-    push(@IDLHeader, "import \"ocidl.idl\";\n");
-    push(@IDLHeader, "#endif\n\n");
-
-    unless ($pureInterface) {
-        push(@IDLHeader, "#ifndef DO_NO_IMPORTS\n");
-        push(@IDLHeader, "import \"${parentInterfaceName}.idl\";\n");
-        push(@IDLHeader, "#endif\n\n");
-
-        $IDLDontForwardDeclare{$outInterfaceName} = 1;
-        $IDLDontImport{$outInterfaceName} = 1;
-        $IDLDontForwardDeclare{$parentInterfaceName} = 1;
-        $IDLDontImport{$parentInterfaceName} = 1;
-    }
-
-    # - Begin
-    # -- Attributes
-    push(@IDLContent, "[\n");
-    push(@IDLContent, "    object,\n");
-    push(@IDLContent, "    oleautomation,\n");
-    push(@IDLContent, "    uuid(" . $uuid . "),\n");
-    push(@IDLContent, "    pointer_default(unique)\n");
-    push(@IDLContent, "]\n");
-
-    # -- Interface
-    push(@IDLContent, "interface " . $outInterfaceName . " : " . $parentInterfaceName . "\n");
-    push(@IDLContent, "{\n");
-
-
-    # - FIXME: Add constants.
-
-
-    # - Add attribute getters/setters.
-    if ($numAttributes > 0) {
-        foreach my $attribute (@{$dataNode->attributes}) {
-            my $attributeName = $attribute->signature->name;
-            my $attributeIDLType = $attribute->signature->type;
-            my $attributeTypeIn = GetCOMTypeIn($attributeIDLType);
-            my $attributeTypeOut = GetCOMTypeOut($attributeIDLType);
-            my $attributeIsReadonly = ($attribute->type =~ /^readonly/);
-
-            AddForwardDeclarationsForTypeInIDL($attributeIDLType);
-
-            unless ($attributeIsReadonly) {
-                # Setter
-                my $setterName = "set" . $codeGenerator->WK_ucfirst($attributeName);
-                my $setter = "    HRESULT " . $setterName . "([in] " . $attributeTypeIn . ");\n";
-                push(@IDLContent, $setter);
-            }
-
-            # Getter
-            my $getter = "    HRESULT " . $attributeName . "([out, retval] " . $attributeTypeOut . "*);\n\n";
-            push(@IDLContent, $getter);
-        }
-    }
-
-    # - Add functions.
-    if ($numFunctions > 0) {
-        foreach my $function (@{$dataNode->functions}) {
-            my $functionName = $function->signature->name;
-            my $returnIDLType = $function->signature->type;
-            my $returnType = GetCOMTypeOut($returnIDLType);
-            my $noReturn = ($returnType eq "void");
-
-            AddForwardDeclarationsForTypeInIDL($returnIDLType);
-
-            my @paramArgList = ();
-            foreach my $param (@{$function->parameters}) {
-                my $paramName = $param->name;
-                my $paramIDLType = $param->type;
-                my $paramType = GetCOMTypeIn($param->type);
-
-                AddForwardDeclarationsForTypeInIDL($paramIDLType);
-
-                # Form parameter
-                my $parameter = "[in] ${paramType} ${paramName}";
-
-                # Add parameter to function signature
-                push(@paramArgList, $parameter);
-            }
-
-            unless ($noReturn) {
-                my $resultParameter = "[out, retval] " . $returnType . "* result";
-                push(@paramArgList, $resultParameter);
-            }
-
-            my $functionSig = "    HRESULT " . $functionName . "(";
-            $functionSig .= join(", ", @paramArgList);
-            $functionSig .= ");\n\n";
-            push(@IDLContent, $functionSig);
-        }
-    }
-
-    # - End
-    push(@IDLContent, "}\n\n");
-}
-
-sub GenerateInterfaceHeader
-{
-    my ($object, $dataNode) = @_;
-
-    my $IDLType = $dataNode->name;
-    my $implementationClass = IDLTypeToImplementationType($IDLType);
-    my $implementationClassWithoutNamespace = StripNamespace($implementationClass);
-    my $className = GetClassName($IDLType);
-    my $interfaceName = GetInterfaceName($IDLType);
-
-    # - Add default header template
-    @CPPInterfaceHeader = @licenseTemplate;
-    push(@CPPInterfaceHeader, "\n");
-
-    # - Header guards -
-    push(@CPPInterfaceHeader, "#ifndef " . $className . "_h\n");
-    push(@CPPInterfaceHeader, "#define " . $className . "_h\n\n");
-
-    # - Forward Declarations -
-    push(@CPPInterfaceHeader, "interface ${interfaceName};\n\n");
-    push(@CPPInterfaceHeader, "namespace WebCore {\n");
-    push(@CPPInterfaceHeader, "    class ${implementationClassWithoutNamespace};\n");
-    push(@CPPInterfaceHeader, "}\n\n");
-
-    # - Default Interface Creator -
-    push(@CPPInterfaceHeader, "${interfaceName}* to${interfaceName}(${implementationClass}*) { return 0; }\n\n");
-
-    push(@CPPInterfaceHeader, "#endif // " . $className . "_h\n");
-}
-
-# -----------------------------------------------------------------------------
-#    CPP Helper Functions
-# -----------------------------------------------------------------------------
-
-sub GenerateCPPAttributeSignature
-{
-    my ($attribute, $className, $options) = @_;
-
-    my $attributeName = $attribute->signature->name;
-    my $isReadonly = ($attribute->type =~ /^readonly/);
-
-    my $newline = $$options{"NewLines"} ? "\n" : "";
-    my $indent = $$options{"Indent"} ? " " x $$options{"Indent"} : "";
-    my $semicolon = $$options{"IncludeSemiColon"} ? ";" : "";
-    my $virtual = $$options{"AddVirtualKeyword"} ? "virtual " : "";
-    my $class = $$options{"UseClassName"} ? "${className}::" : "";
-    my $forwarder = $$options{"Forwarder"} ? 1 : 0;
-    my $joiner =  ($$options{"NewLines"} ? "\n" . $indent . "    " : "");
-
-    my %attributeSignatures = ();
-
-    unless ($isReadonly) {
-        my $attributeTypeIn = GetCOMTypeIn($attribute->signature->type);
-        my $setterName = "set" . $codeGenerator->WK_ucfirst($attributeName);
-        my $setter = $indent . $virtual . "HRESULT STDMETHODCALLTYPE ". $class . $setterName . "(";
-        $setter .= $joiner . "/* [in] */ ${attributeTypeIn} ${attributeName})" . $semicolon . $newline;
-        if ($forwarder) {
-            $setter .= " { return " . $$options{"Forwarder"} . "::" . $setterName . "(${attributeName}); }\n";
-        }
-        $attributeSignatures{"Setter"} = $setter;
-    }
-
-    my $attributeTypeOut = GetCOMTypeOut($attribute->signature->type);
-    my $getter = $indent . $virtual . "HRESULT STDMETHODCALLTYPE " . $class . $attributeName . "(";
-    $getter .= $joiner . "/* [retval][out] */ ${attributeTypeOut}* result)" . $semicolon . $newline;
-    if ($forwarder) {
-        $getter .= " { return " . $$options{"Forwarder"} . "::" . $attributeName . "(result); }\n";
-    }
-    $attributeSignatures{"Getter"} = $getter;
-
-    return %attributeSignatures;
-}
-
-
-sub GenerateCPPAttribute
-{
-    my ($attribute, $className, $implementationClass, $IDLType) = @_;
-
-    my $implementationClassWithoutNamespace = StripNamespace($implementationClass);
-
-    my $attributeName = $attribute->signature->name;
-    my $attributeIDLType = $attribute->signature->type;
-    my $hasSetterException = @{$attribute->setterExceptions};
-    my $hasGetterException = @{$attribute->getterExceptions};
-    my $isReadonly = ($attribute->type =~ /^readonly/);
-    my $attributeTypeIsPrimitive = $codeGenerator->IsPrimitiveType($attributeIDLType);
-    my $attributeTypeIsString = $codeGenerator->IsStringType($attributeIDLType);
-    my $attributeImplementationType = IDLTypeToImplementationType($attributeIDLType);
-    my $attributeImplementationTypeWithoutNamespace = StripNamespace($attributeImplementationType);
-    my $attributeTypeCOMClassName = GetClassName($attributeIDLType);
-
-    $CPPImplementationWebCoreIncludes{"ExceptionCode.h"} = 1 if $hasSetterException or $hasGetterException;
-
-    my %signatures = GenerateCPPAttributeSignature($attribute, $className, { "NewLines" => 1,
-                                                                             "Indent" => 0,
-                                                                             "IncludeSemiColon" => 0,
-                                                                             "UseClassName" => 1,
-                                                                             "AddVirtualKeyword" => 0 });
-
-    my %attrbutesToReturn = ();
-
-    unless ($isReadonly) {
-        my @setterImplementation = ();
-        push(@setterImplementation, $signatures{"Setter"});
-        push(@setterImplementation, "{\n");
-
-        my $setterName = "set" . $codeGenerator->WK_ucfirst($attributeName);
-
-        my @setterParams = ();
-        if ($attributeTypeIsString) {
-            push(@setterParams, $attributeName);
-            if ($hasSetterException) {
-                push(@setterImplementation, "    WebCore::ExceptionCode ec = 0;\n");
-                push(@setterParams, "ec");
-            }
-        } elsif ($attributeTypeIsPrimitive) {
-            if ($attribute->signature->extendedAttributes->{"ConvertFromString"}) {
-                push(@setterParams, "WebCore::String::number(${attributeName})");
-            } elsif ($attributeIDLType eq "boolean") {
-                push(@setterParams, "!!${attributeName}");
-            } else {
-                my $primitiveImplementationType = IDLTypeToImplementationType($attributeIDLType);
-                push(@setterParams, "static_cast<${primitiveImplementationType}>(${attributeName})");
-            }
-
-            if ($hasSetterException) {
-                push(@setterImplementation, "    WebCore::ExceptionCode ec = 0;\n");
-                push(@setterParams, "ec");
-            }
-        } else {
-            $CPPImplementationWebCoreIncludes{"COMPtr.h"} = 1;
-
-            push(@setterImplementation, "    if (!${attributeName})\n");
-            push(@setterImplementation, "        return E_POINTER;\n\n");
-            push(@setterImplementation, "    COMPtr<${attributeTypeCOMClassName}> ptr(Query, ${attributeName});\n");
-            push(@setterImplementation, "    if (!ptr)\n");
-            push(@setterImplementation, "        return E_NOINTERFACE;\n");
-
-            push(@setterParams, "ptr->impl${attributeImplementationTypeWithoutNamespace}()");
-            if ($hasSetterException) {
-                push(@setterImplementation, "    WebCore::ExceptionCode ec = 0;\n");
-                push(@setterParams, "ec");
-            }
-        }
-
-        # FIXME: CHECK EXCEPTION AND DO SOMETHING WITH IT
-
-        my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
-        my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
-        if ($reflect || $reflectURL) {
-            my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
-            my $namespace = $codeGenerator->NamespaceForAttributeName($IDLType, $contentAttributeName);
-            $CPPImplementationWebCoreIncludes{"${namespace}.h"} = 1;
-            push(@setterImplementation, "    impl${implementationClassWithoutNamespace}()->setAttribute(WebCore::${namespace}::${contentAttributeName}Attr, " . join(", ", @setterParams) . ");\n");
-        } else {
-            push(@setterImplementation, "    impl${implementationClassWithoutNamespace}()->${setterName}(" . join(", ", @setterParams) . ");\n");
-        }
-        push(@setterImplementation, "    return S_OK;\n");
-        push(@setterImplementation, "}\n\n");
-
-        $attrbutesToReturn{"Setter"} = join("", @setterImplementation);
-    }
-
-    my @getterImplementation = ();
-    push(@getterImplementation, $signatures{"Getter"});
-    push(@getterImplementation, "{\n");
-    push(@getterImplementation, "    if (!result)\n");
-    push(@getterImplementation, "        return E_POINTER;\n\n");
-
-    my $implementationGetter;
-    my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
-    my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
-    if ($reflect || $reflectURL) {
-        my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
-        my $namespace = $codeGenerator->NamespaceForAttributeName($IDLType, $contentAttributeName);
-        $implIncludes{"${namespace}.h"} = 1;
-        my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
-        $implementationGetter = "impl${implementationClassWithoutNamespace}()->${getAttributeFunctionName}(WebCore::${namespace}::${contentAttributeName}Attr)";
-    } else {
-        $implementationGetter = "impl${implementationClassWithoutNamespace}()->" . $codeGenerator->WK_lcfirst($attributeName) . "(" . ($hasGetterException ? "ec" : ""). ")";
-    }
-
-    push(@getterImplementation, "    WebCore::ExceptionCode ec = 0;\n") if $hasGetterException;
-
-    if ($attributeTypeIsString) {
-        push(@getterImplementation, "    *result = WebCore::BString(${implementationGetter}).release();\n");
-    } elsif ($attributeTypeIsPrimitive) {
-        if ($attribute->signature->extendedAttributes->{"ConvertFromString"}) {
-            push(@getterImplementation, "    *result = static_cast<${attributeTypeCOMClassName}>(${implementationGetter}.toInt());\n");
-        } else {
-            push(@getterImplementation, "    *result = static_cast<${attributeTypeCOMClassName}>(${implementationGetter});\n");
-        }
-    } else {
-        $CPPImplementationIncludesAngle{"wtf/GetPtr.h"} = 1;
-        my $attributeTypeCOMInterfaceName = GetInterfaceName($attributeIDLType);
-        push(@getterImplementation, "    *result = 0;\n");
-        push(@getterImplementation, "    ${attributeImplementationType}* resultImpl = WTF::getPtr(${implementationGetter});\n");
-        push(@getterImplementation, "    if (!resultImpl)\n");
-        push(@getterImplementation, "        return E_POINTER;\n\n");
-        push(@getterImplementation, "    *result = to${attributeTypeCOMInterfaceName}(resultImpl);\n");
-    }
-
-    # FIXME: CHECK EXCEPTION AND DO SOMETHING WITH IT
-
-    push(@getterImplementation, "    return S_OK;\n");
-    push(@getterImplementation, "}\n\n");
-
-    $attrbutesToReturn{"Getter"} = join("", @getterImplementation);
-
-    return %attrbutesToReturn;
-}
-
-sub GenerateCPPFunctionSignature
-{
-    my ($function, $className, $options) = @_;
-
-    my $functionName = $function->signature->name;
-    my $returnIDLType = $function->signature->type;
-    my $returnType = GetCOMTypeOut($returnIDLType);
-    my $noReturn = ($returnType eq "void");
-
-    my $newline = $$options{"NewLines"} ? "\n" : "";
-    my $indent = $$options{"Indent"} ? " " x $$options{"Indent"} : "";
-    my $semicolon = $$options{"IncludeSemiColon"} ? ";" : "";
-    my $virtual = $$options{"AddVirtualKeyword"} ? "virtual " : "";
-    my $class = $$options{"UseClassName"} ? "${className}::" : "";
-    my $forwarder = $$options{"Forwarder"} ? 1 : 0;
-    my $joiner = ($$options{"NewLines"} ? "\n" . $indent . "    " : " ");
-
-    my @paramArgList = ();
-    foreach my $param (@{$function->parameters}) {
-        my $paramName = $param->name;
-        my $paramType = GetCOMTypeIn($param->type);
-        my $parameter = "/* [in] */ ${paramType} ${paramName}";
-        push(@paramArgList, $parameter);
-    }
-
-    unless ($noReturn) {
-        my $resultParameter .= "/* [out, retval] */ ${returnType}* result";
-        push(@paramArgList, $resultParameter);
-    }
-
-    my $functionSig = $indent . $virtual . "HRESULT STDMETHODCALLTYPE " . $class . $functionName . "(";
-    $functionSig .= $joiner . join("," . $joiner, @paramArgList) if @paramArgList > 0;
-    $functionSig .= ")" . $semicolon . $newline;
-    if ($forwarder) {
-        my @paramNameList = ();
-        push(@paramNameList, $_->name) foreach (@{$function->parameters});
-        push(@paramNameList, "result") unless $noReturn;
-        $functionSig .= " { return " . $$options{"Forwarder"} . "::" . $functionName . "(" . join(", ", @paramNameList) . "); }\n";
-    }
-
-    return $functionSig
-}
-
-sub GenerateCPPFunction
-{
-    my ($function, $className, $implementationClass) = @_;
-
-    my @functionImplementation = ();
-
-    my $signature = GenerateCPPFunctionSignature($function, $className, { "NewLines" => 1,
-                                                                          "Indent" => 0,
-                                                                          "IncludeSemiColon" => 0,
-                                                                          "UseClassName" => 1,
-                                                                          "AddVirtualKeyword" => 0 });
-
-    my $implementationClassWithoutNamespace = StripNamespace($implementationClass);
-
-    my $functionName = $function->signature->name;
-    my $returnIDLType = $function->signature->type;
-    my $noReturn = ($returnIDLType eq "void");
-    my $raisesExceptions = @{$function->raisesExceptions};
-
-    AddIncludesForTypeInCPPImplementation($returnIDLType);
-    $CPPImplementationWebCoreIncludes{"ExceptionCode.h"} = 1 if $raisesExceptions;
-
-    my %needsCustom = ();
-    my @parameterInitialization = ();
-    my @parameterList = ();
-    foreach my $param (@{$function->parameters}) {
-        my $paramName = $param->name;
-        my $paramIDLType = $param->type;
-
-        my $paramTypeIsPrimitive = $codeGenerator->IsPrimitiveType($paramIDLType);
-        my $paramTypeIsString = $codeGenerator->IsStringType($paramIDLType);
-
-        $needsCustom{"NodeToReturn"} = $paramName if $param->extendedAttributes->{"Return"};
-
-        AddIncludesForTypeInCPPImplementation($paramIDLType);
-
-        # FIXME: We may need to null check the arguments as well
-
-        if ($paramTypeIsString) {
-            push(@parameterList, $paramName);
-        } elsif ($paramTypeIsPrimitive) {
-            if ($paramIDLType eq "boolean") {
-                push(@parameterList, "!!${paramName}");
-            } else {
-                my $primitiveImplementationType = IDLTypeToImplementationType($paramIDLType);
-                push(@parameterList, "static_cast<${primitiveImplementationType}>(${paramName})");
-            }
-        } else {
-            $CPPImplementationWebCoreIncludes{"COMPtr.h"} = 1;
-
-            $needsCustom{"CanReturnEarly"} = 1;
-
-            my $paramTypeCOMClassName = GetClassName($paramIDLType);
-            my $paramTypeImplementationWithoutNamespace = StripNamespace(IDLTypeToImplementationType($paramIDLType));
-            my $ptrName = "ptrFor" . $codeGenerator->WK_ucfirst($paramName);
-            my $paramInit = "    COMPtr<${paramTypeCOMClassName}> ${ptrName}(Query, ${paramName});\n";
-            $paramInit .= "    if (!${ptrName})\n";
-            $paramInit .= "        return E_NOINTERFACE;";
-            push(@parameterInitialization, $paramInit);
-            push(@parameterList, "${ptrName}->impl${paramTypeImplementationWithoutNamespace}()");
-        }
-    }
-
-    push(@parameterList, "ec") if $raisesExceptions;
-
-    my $implementationGetter = "impl${implementationClassWithoutNamespace}()";
-
-    my $callSigBegin = "    ";
-    my $callSigMiddle = "${implementationGetter}->" . $codeGenerator->WK_lcfirst($functionName) . "(" . join(", ", @parameterList) . ")";
-    my $callSigEnd = ";\n";
-
-    if (defined $needsCustom{"NodeToReturn"}) {
-        my $nodeToReturn = $needsCustom{"NodeToReturn"};
-        $callSigBegin .= "if (";
-        $callSigEnd = ")\n";
-        $callSigEnd .= "        *result = ${nodeToReturn};";
-    } elsif (!$noReturn) {
-        my $returnTypeIsString =  $codeGenerator->IsStringType($returnIDLType);
-        my $returnTypeIsPrimitive = $codeGenerator->IsPrimitiveType($returnIDLType);
-
-        if ($returnTypeIsString) {
-            $callSigBegin .= "*result = WebCore::BString(";
-            $callSigEnd = ").release();\n";
-        } elsif ($returnTypeIsPrimitive) {
-            my $primitiveCOMType = GetClassName($returnIDLType);
-            $callSigBegin .= "*result = static_cast<${primitiveCOMType}>(";
-            $callSigEnd = ");";
-        } else {
-            $CPPImplementationIncludesAngle{"wtf/GetPtr.h"} = 1;
-            my $returnImplementationType = IDLTypeToImplementationType($returnIDLType);
-            my $returnTypeCOMInterfaceName = GetInterfaceName($returnIDLType);
-            $callSigBegin .= "${returnImplementationType}* resultImpl = WTF::getPtr(";
-            $callSigEnd = ");\n";
-            $callSigEnd .= "    if (!resultImpl)\n";
-            $callSigEnd .= "        return E_POINTER;\n\n";
-            $callSigEnd .= "    *result = to${returnTypeCOMInterfaceName}(resultImpl);";
-        }
-    }
-
-    push(@functionImplementation, $signature);
-    push(@functionImplementation, "{\n");
-    unless ($noReturn) {
-        push(@functionImplementation, "    if (!result)\n");
-        push(@functionImplementation, "        return E_POINTER;\n\n");
-        push(@functionImplementation, "    *result = 0;\n\n") if $needsCustom{"CanReturnEarly"};
-    }
-    push(@functionImplementation, "    WebCore::ExceptionCode ec = 0;\n") if $raisesExceptions; # FIXME: CHECK EXCEPTION AND DO SOMETHING WITH IT
-    push(@functionImplementation, join("\n", @parameterInitialization) . (@parameterInitialization > 0 ? "\n" : ""));
-    push(@functionImplementation, $callSigBegin . $callSigMiddle . $callSigEnd . "\n");
-    push(@functionImplementation, "    return S_OK;\n");
-    push(@functionImplementation, "}\n\n");
-
-    return join("", @functionImplementation);
-}
-
-
-# -----------------------------------------------------------------------------
-#    CPP Header
-# -----------------------------------------------------------------------------
-
-sub GenerateCPPHeader
-{
-    my ($object, $dataNode) = @_;
-
-    my $IDLType = $dataNode->name;
-    my $implementationClass = IDLTypeToImplementationType($IDLType);
-    my $implementationClassWithoutNamespace = StripNamespace($implementationClass);
-    my $className = GetClassName($IDLType);
-    my $interfaceName = GetInterfaceName($IDLType);
-
-    my $parentClassName = GetParentClass($dataNode);
-    my @otherInterfacesImplemented = GetAdditionalInterfaces($IDLType);
-    foreach my $otherInterface (@otherInterfacesImplemented) {
-        push(@additionalInterfaceDefinitions, $codeGenerator->ParseInterface($otherInterface));
-    }
-
-    # FIXME: strip whitespace from UUID
-    my $uuid = $dataNode->extendedAttributes->{"ImplementationUUID"} || die "All classes require an ImplementationUUID extended attribute.";
-
-    my $numAttributes = @{$dataNode->attributes};
-    my $numFunctions = @{$dataNode->functions};
-
-    # - Add default header template
-    @CPPHeaderHeader = @licenseTemplate;
-    push(@CPPHeaderHeader, "\n");
-
-    # - Header guards -
-    push(@CPPHeaderHeader, "#ifndef " . $className . "_h\n");
-    push(@CPPHeaderHeader, "#define " . $className . "_h\n\n");
-
-    AddIncludesForTypeInCPPHeader($interfaceName);
-    AddIncludesForTypeInCPPHeader($parentClassName);
-    $CPPHeaderDontForwardDeclarations{$className} = 1;
-    $CPPHeaderDontForwardDeclarations{$interfaceName} = 1;
-    $CPPHeaderDontForwardDeclarations{$parentClassName} = 1;
-
-    # -- Forward declare implementation type
-    push(@CPPHeaderContent, "namespace WebCore {\n");
-    push(@CPPHeaderContent, "    class ". StripNamespace($implementationClass) . ";\n");
-    push(@CPPHeaderContent, "}\n\n");
-
-    # -- Start Class --
-    my @parentsClasses = ($parentClassName, $interfaceName);
-    push(@parentsClasses, map { GetInterfaceName($_) } @otherInterfacesImplemented);
-    push(@CPPHeaderContent, "class __declspec(uuid(\"$uuid\")) ${className} : " . join(", ", map { "public $_" } @parentsClasses) . " {\n");
-
-    # Add includes for all additional interfaces to implement
-    map { AddIncludesForTypeInCPPHeader(GetInterfaceName($_)) } @otherInterfacesImplemented;
-
-    # -- BASICS --
-    # FIXME: The constructor and destructor should be protected, but the current design of
-    # createInstance requires them to be public.  One solution is to friend the constructor
-    # of the top-level-class with every one of its child classes, but that requires information
-    # this script currently does not have, though possibly could determine.
-    push(@CPPHeaderContent, "public:\n");
-    push(@CPPHeaderContent, "   ${className}(${implementationClass}*);\n");
-    push(@CPPHeaderContent, "   virtual ~${className}();\n\n");
-
-    push(@CPPHeaderContent, "public:\n");
-    push(@CPPHeaderContent, "    static ${className}* createInstance(${implementationClass}*);\n\n");
-
-    push(@CPPHeaderContent, "    // IUnknown\n");
-    push(@CPPHeaderContent, "    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID, void** ppvObject);\n");
-    push(@CPPHeaderContent, "    virtual ULONG STDMETHODCALLTYPE AddRef() { return ${parentClassName}::AddRef(); }\n");
-    push(@CPPHeaderContent, "    virtual ULONG STDMETHODCALLTYPE Release() { return ${parentClassName}::Release(); }\n\n");
-
-
-    # -- Parent Class Forwards --
-    if (@{$dataNode->parents}) {
-        my %attributeNameSet = map {($_->signature->name, 1)} @{$dataNode->attributes};
-        my %functionNameSet = map {($_->signature->name, 1)} @{$dataNode->functions};
-
-        my @parentLists = $codeGenerator->GetMethodsAndAttributesFromParentClasses($dataNode);
-        push(@CPPHeaderContent, "\n");
-        foreach my $parentHash (@parentLists) {
-
-            push(@CPPHeaderContent, "    // " . GetInterfaceName($parentHash->{'name'}) . $DASHES . "\n");
-
-            my @attributeList = @{$parentHash->{'attributes'}};
-            push(@CPPHeaderContent, "    // Attributes\n");
-            foreach my $attribute (@attributeList) {
-                # Don't forward an attribute that this class redefines.
-                next if $attributeNameSet{$attribute->signature->name};
-
-                AddForwardDeclarationsForTypeInCPPHeader($attribute->signature->type);
-
-                my %attributes = GenerateCPPAttributeSignature($attribute, $className, { "NewLines" => 0,
-                                                                                         "Indent" => 4,
-                                                                                         "IncludeSemiColon" => 0,
-                                                                                         "AddVirtualKeyword" => 1,
-                                                                                         "UseClassName" => 0,
-                                                                                         "Forwarder" => $parentClassName });
-                push(@CPPHeaderContent, values(%attributes));
-            }
-
-            # Add attribute names to attribute names set in case other ancestors 
-            # also define them.
-            $attributeNameSet{$_->signature->name} = 1 foreach @attributeList;
-
-            push(@CPPHeaderContent, "\n");
-
-            my @functionList = @{$parentHash->{'functions'}};
-            push(@CPPHeaderContent, "    // Functions\n");
-            foreach my $function (@functionList) {
-                # Don't forward a function that this class redefines.
-                next if $functionNameSet{$function->signature->name};
-
-                AddForwardDeclarationsForTypeInCPPHeader($function->signature->type);
-                AddForwardDeclarationsForTypeInCPPHeader($_->type) foreach (@{$function->parameters});
-
-                my $functionSig = GenerateCPPFunctionSignature($function, $className, { "NewLines" => 0,
-                                                                                        "Indent" => 4,
-                                                                                        "IncludeSemiColon" => 0,
-                                                                                        "AddVirtualKeyword" => 1,
-                                                                                        "UseClassName" => 0,
-                                                                                        "Forwarder" => $parentClassName });
-
-                push(@CPPHeaderContent, $functionSig);
-            }
-            # Add functions names to functions names set in case other ancestors 
-            # also define them.
-            $functionNameSet{$_->signature->name} = 1 foreach @functionList;
-
-            push(@CPPHeaderContent, "\n");
-        }
-    }
-
-    # - Additional interfaces to implement -
-    foreach my $interfaceToImplement (@additionalInterfaceDefinitions) {
-        my $IDLTypeOfInterfaceToImplement = $interfaceToImplement->name;
-        my $nameOfInterfaceToImplement = GetInterfaceName($IDLTypeOfInterfaceToImplement);
-        my $numAttributesInInterface = @{$interfaceToImplement->attributes};
-        my $numFunctionsInInterface = @{$interfaceToImplement->functions};
-
-        push(@CPPHeaderContent, "    // ${nameOfInterfaceToImplement} ${DASHES}\n\n");
-
-        # - Add attribute getters/setters.
-        if ($numAttributesInInterface > 0) {
-            push(@CPPHeaderContent, "    // Attributes\n\n");
-            foreach my $attribute (@{$interfaceToImplement->attributes}) {
-                AddForwardDeclarationsForTypeInCPPHeader($attribute->signature->type);
-
-                my %attributeSigs = GenerateCPPAttributeSignature($attribute, $className, { "NewLines" => 1,
-                                                                                            "Indent" => 4,
-                                                                                            "IncludeSemiColon" => 1,
-                                                                                            "AddVirtualKeyword" => 1,
-                                                                                            "UseClassName" => 0 });
-
-                push(@CPPHeaderContent, values(%attributeSigs));
-                push(@CPPHeaderContent, "\n");
-            }
-        }
-
-        # - Add functions.
-        if ($numFunctionsInInterface > 0) {
-            push(@CPPHeaderContent, "    // Functions\n\n");
-            foreach my $function (@{$interfaceToImplement->functions}) {
-                AddForwardDeclarationsForTypeInCPPHeader($function->signature->type);
-                AddForwardDeclarationsForTypeInCPPHeader($_->type) foreach (@{$function->parameters});
-
-                my $functionSig = GenerateCPPFunctionSignature($function, $className, { "NewLines" => 1,
-                                                                                        "Indent" => 4,
-                                                                                        "IncludeSemiColon" => 1,
-                                                                                        "AddVirtualKeyword" => 1,
-                                                                                        "UseClassName" => 0 });
-
-                push(@CPPHeaderContent, $functionSig);
-                push(@CPPHeaderContent, "\n");
-            }
-        }
-    }
-
-    if ($numAttributes > 0 || $numFunctions > 0) {
-        push(@CPPHeaderContent, "    // ${interfaceName} ${DASHES}\n\n");
-    }
-
-    # - Add constants COMING SOON
-
-    # - Add attribute getters/setters.
-    if ($numAttributes > 0) {
-        push(@CPPHeaderContent, "    // Attributes\n\n");
-        foreach my $attribute (@{$dataNode->attributes}) {
-            AddForwardDeclarationsForTypeInCPPHeader($attribute->signature->type);
-
-            my %attributeSigs = GenerateCPPAttributeSignature($attribute, $className, { "NewLines" => 1,
-                                                                                        "Indent" => 4,
-                                                                                        "IncludeSemiColon" => 1,
-                                                                                        "AddVirtualKeyword" => 1,
-                                                                                        "UseClassName" => 0 });
-
-            push(@CPPHeaderContent, values(%attributeSigs));
-            push(@CPPHeaderContent, "\n");
-        }
-    }
-
-    # - Add functions.
-    if ($numFunctions > 0) {
-        push(@CPPHeaderContent, "    // Functions\n\n");
-        foreach my $function (@{$dataNode->functions}) {
-            AddForwardDeclarationsForTypeInCPPHeader($function->signature->type);
-            AddForwardDeclarationsForTypeInCPPHeader($_->type) foreach (@{$function->parameters});
-
-            my $functionSig = GenerateCPPFunctionSignature($function, $className, { "NewLines" => 1,
-                                                                                    "Indent" => 4,
-                                                                                    "IncludeSemiColon" => 1,
-                                                                                    "AddVirtualKeyword" => 1,
-                                                                                    "UseClassName" => 0 });
-
-            push(@CPPHeaderContent, $functionSig);
-            push(@CPPHeaderContent, "\n");
-        }
-    }
-
-    push(@CPPHeaderContent, "    ${implementationClass}* impl${implementationClassWithoutNamespace}() const;\n");
-
-    if (@{$dataNode->parents} == 0) {
-        AddIncludesForTypeInCPPHeader("wtf/RefPtr", 1);
-        push(@CPPHeaderContent, "\n");
-        push(@CPPHeaderContent, "    ${implementationClass}* impl() const { return m_impl.get(); }\n\n");
-        push(@CPPHeaderContent, "private:\n");
-        push(@CPPHeaderContent, "    RefPtr<${implementationClass}> m_impl;\n");
-    }
-
-    # -- End Class --
-    push(@CPPHeaderContent, "};\n\n");
-
-    # -- Default Interface Creator --
-    push(@CPPHeaderContent, "${interfaceName}* to${interfaceName}(${implementationClass}*);\n\n");
-
-    push(@CPPHeaderContent, "#endif // " . $className . "_h\n");
-}
-
-
-# -----------------------------------------------------------------------------
-#    CPP Implementation
-# -----------------------------------------------------------------------------
-
-sub GenerateCPPImplementation
-{
-    my ($object, $dataNode) = @_;
-
-    my $IDLType = $dataNode->name;
-    my $implementationClass = IDLTypeToImplementationType($IDLType);
-    my $implementationClassWithoutNamespace = StripNamespace($implementationClass);
-    my $className = GetClassName($IDLType);
-    my $interfaceName = GetInterfaceName($IDLType);
-
-    my $parentClassName = GetParentClass($dataNode);
-    my $isBaseClass = (@{$dataNode->parents} == 0);
-
-    my $uuid = $dataNode->extendedAttributes->{"ImplementationUUID"} || die "All classes require an ImplementationUUID extended attribute.";
-
-    my $numAttributes = @{$dataNode->attributes};
-    my $numFunctions = @{$dataNode->functions};
-
-    # - Add default header template
-    @CPPImplementationHeader = @licenseTemplate;
-    push(@CPPImplementationHeader, "\n");
-
-    push(@CPPImplementationHeader, "#include \"config.h\"\n");
-    push(@CPPImplementationHeader, "#include \"WebKitDLL.h\"\n");
-    push(@CPPImplementationHeader, "#include " . ($className eq "GEN_DOMImplementation" ? "\"GEN_DOMDOMImplementation.h\"" : "\"${className}.h\"") . "\n");
-    $CPPImplementationDontIncludes{"${className}.h"} = 1;
-    $CPPImplementationWebCoreIncludes{"${implementationClassWithoutNamespace}.h"} = 1;
-
-    # -- Constructor --
-    push(@CPPImplementationContent, "${className}::${className}(${implementationClass}* impl)\n");
-    if ($isBaseClass) {
-        push(@CPPImplementationContent, "    : m_impl(impl)\n");
-        push(@CPPImplementationContent, "{\n");
-        push(@CPPImplementationContent, "    ASSERT_ARG(impl, impl);\n");
-        push(@CPPImplementationContent, "}\n\n");
-    } else {
-        push(@CPPImplementationContent, "    : ${parentClassName}(impl)\n");
-        push(@CPPImplementationContent, "{\n");
-        push(@CPPImplementationContent, "}\n\n");
-    }
-
-    # -- Destructor --
-    push(@CPPImplementationContent, "${className}::~${className}()\n");
-    push(@CPPImplementationContent, "{\n");
-    if ($isBaseClass) {
-        $CPPImplementationIncludes{"DOMCreateInstance.h"} = 1;
-        push(@CPPImplementationContent, "    removeDOMWrapper(impl());\n");
-    }
-    push(@CPPImplementationContent, "}\n\n");
-
-    push(@CPPImplementationContent, "${implementationClass}* ${className}::impl${implementationClassWithoutNamespace}() const\n");
-    push(@CPPImplementationContent, "{\n");
-    push(@CPPImplementationContent, "    return static_cast<${implementationClass}*>(impl());\n");
-    push(@CPPImplementationContent, "}\n\n");
-
-    # Base classes must implement the createInstance method externally.
-    if (@{$dataNode->parents} != 0) {
-        push(@CPPImplementationContent, "${className}* ${className}::createInstance(${implementationClass}* impl)\n");
-        push(@CPPImplementationContent, "{\n");
-        push(@CPPImplementationContent, "    return static_cast<${className}*>(${parentClassName}::createInstance(impl));\n");
-        push(@CPPImplementationContent, "}\n");
-    }
-
-    push(@CPPImplementationContent, "// IUnknown $DASHES\n\n");
-
-    # -- QueryInterface --
-    push(@CPPImplementationContent, "HRESULT STDMETHODCALLTYPE ${className}::QueryInterface(REFIID riid, void** ppvObject)\n");
-    push(@CPPImplementationContent, "{\n");
-    push(@CPPImplementationContent, "    *ppvObject = 0;\n");
-    push(@CPPImplementationContent, "    if (IsEqualGUID(riid, IID_${interfaceName}))\n");
-    push(@CPPImplementationContent, "        *ppvObject = reinterpret_cast<${interfaceName}*>(this);\n");
-    push(@CPPImplementationContent, "    else if (IsEqualGUID(riid, __uuidof(${className})))\n");
-    push(@CPPImplementationContent, "        *ppvObject = reinterpret_cast<${className}*>(this);\n");
-    push(@CPPImplementationContent, "    else\n");
-    push(@CPPImplementationContent, "        return ${parentClassName}::QueryInterface(riid, ppvObject);\n\n");
-    push(@CPPImplementationContent, "    AddRef();\n");
-    push(@CPPImplementationContent, "    return S_OK;\n");
-    push(@CPPImplementationContent, "}\n\n");
-
-    # - Additional interfaces to implement -
-    foreach my $interfaceToImplement (@additionalInterfaceDefinitions) {
-        my $IDLTypeOfInterfaceToImplement = $interfaceToImplement->name;
-        my $nameOfInterfaceToImplement = GetInterfaceName($IDLTypeOfInterfaceToImplement);
-        my $numAttributesInInterface = @{$interfaceToImplement->attributes};
-        my $numFunctionsInInterface = @{$interfaceToImplement->functions};
-
-        push(@CPPImplementationContent, "    // ${nameOfInterfaceToImplement} ${DASHES}\n\n");
-
-        if ($numAttributesInInterface > 0) {
-            push(@CPPImplementationContent, "// Attributes\n\n");
-            foreach my $attribute (@{$interfaceToImplement->attributes}) {
-                # FIXME: Do this in one step.
-                # FIXME: Implement exception handling.
-
-                AddIncludesForTypeInCPPImplementation($attribute->signature->type);
-
-                my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass, $IDLType);
-                push(@CPPImplementationContent, values(%attributes));
-            }
-        }
-
-        # - Add functions.
-        if ($numFunctionsInInterface > 0) {
-            push(@CPPImplementationContent, "// Functions\n\n");
-
-            foreach my $function (@{$interfaceToImplement->functions}) {
-                my $functionImplementation = GenerateCPPFunction($function, $className, $implementationClass);
-                push(@CPPImplementationContent, $functionImplementation);
-            }
-        }
-    }
-
-    push(@CPPImplementationContent, "// ${interfaceName} $DASHES\n\n");
-
-    # - Add attribute getters/setters.
-    if ($numAttributes > 0) {
-        push(@CPPImplementationContent, "// Attributes\n\n");
-        foreach my $attribute (@{$dataNode->attributes}) {
-            # FIXME: do this in one step
-            my $hasSetterException = @{$attribute->setterExceptions};
-            my $hasGetterException = @{$attribute->getterExceptions};
-
-            AddIncludesForTypeInCPPImplementation($attribute->signature->type);
-
-            my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass, $IDLType);
-            push(@CPPImplementationContent, values(%attributes));
-        }
-    }
-
-    # - Add functions.
-    if ($numFunctions > 0) {
-        push(@CPPImplementationContent, "// Functions\n\n");
-
-        foreach my $function (@{$dataNode->functions}) {
-            my $functionImplementation = GenerateCPPFunction($function, $className, $implementationClass);
-            push(@CPPImplementationContent, $functionImplementation);
-        }
-    }
-
-    # - Default implementation for interface creator.
-    # FIXME: add extended attribute to add custom implementation if necessary.
-    push(@CPPImplementationContent, "${interfaceName}* to${interfaceName}(${implementationClass}* impl)\n");
-    push(@CPPImplementationContent, "{\n");
-    push(@CPPImplementationContent, "    return ${className}::createInstance(impl);\n");
-    push(@CPPImplementationContent, "}\n");
-}
-
-sub WriteData
-{
-    my ($object, $name, $pureInterface) = @_;
-
-    # -- IDL --
-    my $IDLFileName = "$outputDir/I" . $TEMP_PREFIX . "DOM" . $name . ".idl";
-    unlink($IDLFileName);
-
-    # Write to output IDL.
-    open(OUTPUTIDL, ">$IDLFileName") or die "Couldn't open file $IDLFileName";
-
-    # Add header
-    print OUTPUTIDL @IDLHeader;
-
-    # Add forward declarations and imorts
-    delete $IDLForwardDeclarations{keys(%IDLDontForwardDeclare)};
-    delete $IDLImports{keys(%IDLDontImport)};
-
-    print OUTPUTIDL map { "cpp_quote(\"interface $_;\")\n" } sort keys(%IDLForwardDeclarations);
-    print OUTPUTIDL "\n";
-
-    print OUTPUTIDL map { "interface $_;\n" } sort keys(%IDLForwardDeclarations);
-    print OUTPUTIDL "\n";
-    print OUTPUTIDL "#ifndef DO_NO_IMPORTS\n";
-    print OUTPUTIDL map { ($_ eq "IGEN_DOMImplementation") ? "import \"IGEN_DOMDOMImplementation.idl\";\n" : "import \"$_.idl\";\n" } sort keys(%IDLImports);
-    print OUTPUTIDL "#endif\n";
-    print OUTPUTIDL "\n";
-
-    # Add content
-    print OUTPUTIDL @IDLContent;
-
-    close(OUTPUTIDL);
-
-    @IDLHeader = ();
-    @IDLContent = ();
-
-    if ($pureInterface) {
-        my $CPPInterfaceHeaderFileName = "$outputDir/" . $TEMP_PREFIX . "DOM" . $name . ".h";
-        unlink($CPPInterfaceHeaderFileName);
-
-        open(OUTPUTCPPInterfaceHeader, ">$CPPInterfaceHeaderFileName") or die "Couldn't open file $CPPInterfaceHeaderFileName";
-
-        print OUTPUTCPPInterfaceHeader @CPPInterfaceHeader;
-
-        close(OUTPUTCPPInterfaceHeader);
-
-        @CPPInterfaceHeader = ();
-    } else {
-        my $CPPHeaderFileName = "$outputDir/" . $TEMP_PREFIX . "DOM" . $name . ".h";
-        unlink($CPPHeaderFileName);
-
-        # -- CPP Header --
-        open(OUTPUTCPPHeader, ">$CPPHeaderFileName") or die "Couldn't open file $CPPHeaderFileName";
-
-        # Add header
-        print OUTPUTCPPHeader @CPPHeaderHeader;
-
-        # Add includes
-        print OUTPUTCPPHeader map { ($_ eq "GEN_DOMImplementation.h") ? "#include \"GEN_DOMDOMImplementation.h\"\n" : "#include \"$_\"\n" } sort keys(%CPPHeaderIncludes);
-        print OUTPUTCPPHeader map { "#include <$_>\n" } sort keys(%CPPHeaderIncludesAngle);
-
-        foreach my $dontDeclare (keys(%CPPHeaderDontForwardDeclarations)) {
-            delete $CPPHeaderForwardDeclarations{$dontDeclare} if ($CPPHeaderForwardDeclarations{$dontDeclare});
-        }
-        print OUTPUTCPPHeader "\n";
-        print OUTPUTCPPHeader map { "interface $_;\n" } sort keys(%CPPHeaderForwardDeclarations);
-        print OUTPUTCPPHeader "\n";
-
-        # Add content
-        print OUTPUTCPPHeader @CPPHeaderContent;
-
-        close(OUTPUTCPPHeader);
-
-        @CPPHeaderHeader = ();
-        @CPPHeaderContent = ();
-
-
-        # -- CPP Implementation --
-        my $CPPImplementationFileName = "$outputDir/" . $TEMP_PREFIX . "DOM" . $name . ".cpp";
-        unlink($CPPImplementationFileName);
-
-        open(OUTPUTCPPImplementation, ">$CPPImplementationFileName") or die "Couldn't open file $CPPImplementationFileName";
-
-        # Add header
-        print OUTPUTCPPImplementation @CPPImplementationHeader;
-        print OUTPUTCPPImplementation "\n";
-
-        # Add includes
-        foreach my $dontInclude (keys(%CPPImplementationDontIncludes)) {
-            delete $CPPImplementationIncludes{$dontInclude} if ($CPPImplementationIncludes{$dontInclude});
-        }
-        print OUTPUTCPPImplementation map { ($_ eq "GEN_DOMImplementation.h") ? "#include \"GEN_DOMDOMImplementation.h\"\n" : "#include \"$_\"\n" } sort keys(%CPPImplementationIncludes);
-        print OUTPUTCPPImplementation map { "#include <$_>\n" } sort keys(%CPPImplementationIncludesAngle);
-        print OUTPUTCPPImplementation "\n";
-
-        print OUTPUTCPPImplementation "#pragma warning(push, 0)\n";
-        print OUTPUTCPPImplementation map { "#include <WebCore/$_>\n" } sort keys(%CPPImplementationWebCoreIncludes);
-        print OUTPUTCPPImplementation "#pragma warning(pop)\n";
-
-        # Add content
-        print OUTPUTCPPImplementation @CPPImplementationContent;
-
-        close(OUTPUTCPPImplementation);
-
-        @CPPImplementationHeader = ();
-        @CPPImplementationContent = ();
-    }
-}
-
-1;
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
index d8367acb30..1aed11d4b7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -17,7 +17,7 @@
 # Library General Public License for more details.
 #
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 # Boston, MA 02110-1301, USA.
 
@@ -32,11 +32,14 @@ my $writeDependencies = 0;
 my @headerContentHeader = ();
 my @headerContent = ();
 my %headerIncludes = ();
+my %headerTrailingIncludes = ();
 
 my @implContentHeader = ();
 my @implContent = ();
 my %implIncludes = ();
 my @depsContent = ();
+my $numCachedAttributes = 0;
+my $currentCachedAttribute = 0;
 
 # Default .h template
 my $headerTemplate = << "EOF";
@@ -132,15 +135,7 @@ sub GetParentClassName
     my $dataNode = shift;
 
     return $dataNode->extendedAttributes->{"LegacyParent"} if $dataNode->extendedAttributes->{"LegacyParent"};
-    if (@{$dataNode->parents} eq 0) {
-        # FIXME: SVG types requiring a context() pointer do not have enough
-        # space to hold a globalObject pointer as well w/o hitting the CELL_SIZE limit.
-        # This could be fixed by moving context() into the various impl() classes.
-        # Until then, we special case these SVG bindings and allow them to return
-        # the wrong prototypes and constructors during x-frame access.  See bug 27088.
-        return "DOMObjectWithSVGContext" if IsSVGTypeNeedingContextParameter($dataNode->name);
-        return "DOMObjectWithGlobalPointer";
-    }
+    return "DOMObjectWithGlobalPointer" if (@{$dataNode->parents} eq 0);
     return "JS" . $codeGenerator->StripModule($dataNode->parents(0));
 }
 
@@ -149,6 +144,7 @@ sub GetVisibleClassName
     my $className = shift;
 
     return "DOMException" if $className eq "DOMCoreException";
+    return "FormData" if $className eq "DOMFormData";
     return $className;
 }
 
@@ -169,16 +165,6 @@ sub IndexGetterReturnsStrings
     return 0;
 }
 
-sub CreateSVGContextInterfaceName
-{
-    my $type = shift;
-
-    return $type if $codeGenerator->IsSVGAnimatedType($type);
-    return "SVGPathSeg" if $type =~ /^SVGPathSeg/ and $type ne "SVGPathSegList";
-
-    return "";
-}
-
 sub AddIncludesForType
 {
     my $type = $codeGenerator->StripModule(shift);
@@ -316,7 +302,14 @@ sub GenerateGetOwnPropertySlotBody
     if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
         push(@getOwnPropertySlotImpl, "    bool ok;\n");
         push(@getOwnPropertySlotImpl, "    unsigned index = propertyName.toUInt32(&ok, false);\n");
-        push(@getOwnPropertySlotImpl, "    if (ok && index < static_cast<$implClassName*>(impl())->length()) {\n");
+
+        # If the item function returns a string then we let the ConvertNullStringTo handle the cases
+        # where the index is out of range.
+        if (IndexGetterReturnsStrings($implClassName)) {
+            push(@getOwnPropertySlotImpl, "    if (ok) {\n");
+        } else {
+            push(@getOwnPropertySlotImpl, "    if (ok && index < static_cast<$implClassName*>(impl())->length()) {\n");
+        }
         if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
             push(@getOwnPropertySlotImpl, "        slot.setValue(getByIndex(exec, index));\n");
         } else {
@@ -368,6 +361,14 @@ sub GenerateGetOwnPropertyDescriptorBody
     my $namespaceMaybe = ($inlined ? "JSC::" : "");
     
     my @getOwnPropertyDescriptorImpl = ();
+    if ($dataNode->extendedAttributes->{"CheckDomainSecurity"}) {
+        if ($interfaceName eq "DOMWindow") {
+            push(@implContent, "    if (!static_cast<$className*>(thisObject)->allowsAccessFrom(exec))\n");
+        } else {
+            push(@implContent, "    if (!allowsAccessFromFrame(exec, static_cast<$className*>(thisObject)->impl()->frame()))\n");
+        }
+        push(@implContent, "        return false;\n");
+    }
     
     if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
         push(@getOwnPropertyDescriptorImpl, "    ${namespaceMaybe}JSValue proto = prototype();\n");
@@ -476,7 +477,6 @@ sub GenerateHeader
     my $hasParent = $hasLegacyParent || $hasRealParent;
     my $parentClassName = GetParentClassName($dataNode);
     my $conditional = $dataNode->extendedAttributes->{"Conditional"};
-    my $needsSVGContext = IsSVGTypeNeedingContextParameter($interfaceName);
     my $eventTarget = $dataNode->extendedAttributes->{"EventTarget"};
     my $needsMarkChildren = $dataNode->extendedAttributes->{"CustomMarkFunction"} || $dataNode->extendedAttributes->{"EventTarget"};
     
@@ -496,8 +496,7 @@ sub GenerateHeader
     if ($hasParent) {
         $headerIncludes{"$parentClassName.h"} = 1;
     } else {
-        $headerIncludes{"DOMObjectWithSVGContext.h"} = $needsSVGContext;
-        $headerIncludes{"JSDOMBinding.h"} = !$needsSVGContext;
+        $headerIncludes{"JSDOMBinding.h"} = 1;
         $headerIncludes{"<runtime/JSGlobalObject.h>"} = 1;
         $headerIncludes{"<runtime/ObjectPrototype.h>"} = 1;
     }
@@ -520,6 +519,7 @@ sub GenerateHeader
     # Get correct pass/store types respecting PODType flag
     my $podType = $dataNode->extendedAttributes->{"PODType"};
     my $implType = $podType ? "JSSVGPODTypeWrapper<$podType> " : $implClassName;
+
     $headerIncludes{"$podType.h"} = 1 if $podType and $podType ne "float";
 
     $headerIncludes{"JSSVGPODTypeWrapper.h"} = 1 if $podType;
@@ -544,22 +544,23 @@ sub GenerateHeader
         push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<$implType>, JSDOMWindowShell*);\n");
     } elsif ($dataNode->extendedAttributes->{"IsWorkerContext"}) {
         push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<$implType>);\n");
-    } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
-        push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<$implType>, SVGElement* context);\n");
     } else {
         push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<$implType>);\n");
     }
 
     # Destructor
-    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $eventTarget or $interfaceName eq "Document" or $interfaceName eq "DOMWindow");
+    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $eventTarget or $interfaceName eq "DOMWindow");
 
     # Prototype
     push(@headerContent, "    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);\n") unless ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"});
 
-    $implIncludes{"${className}Custom.h"} = 1 if $dataNode->extendedAttributes->{"CustomHeader"} || $dataNode->extendedAttributes->{"CustomPutFunction"} || $dataNode->extendedAttributes->{"DelegatingPutFunction"};
+    $headerTrailingIncludes{"${className}Custom.h"} = 1 if $dataNode->extendedAttributes->{"CustomHeader"};
+
+    $implIncludes{"${className}Custom.h"} = 1 if !$dataNode->extendedAttributes->{"CustomHeader"} && ($dataNode->extendedAttributes->{"CustomPutFunction"} || $dataNode->extendedAttributes->{"DelegatingPutFunction"});
 
     my $hasGetter = $numAttributes > 0 
-                 || $dataNode->extendedAttributes->{"GenerateConstructor"} 
+                 || !($dataNode->extendedAttributes->{"OmitConstructor"}
+                 || $dataNode->extendedAttributes->{"CustomConstructor"})
                  || $dataNode->extendedAttributes->{"HasIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}
@@ -610,7 +611,7 @@ sub GenerateHeader
     push(@headerContent,
         "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
         "    {\n" .
-        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));\n" .
+        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);\n" .
         "    }\n\n");
 
     # markChildren function
@@ -630,7 +631,7 @@ sub GenerateHeader
 
     # Custom getPropertyNames function exists on DOMWindow
     if ($interfaceName eq "DOMWindow") {
-        push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n");
+        push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);\n");
         $structureFlags{"JSC::OverridesGetPropertyNames"} = 1;
     }
 
@@ -639,13 +640,10 @@ sub GenerateHeader
 
     # Custom getOwnPropertyNames function
     if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
-        push(@headerContent, "    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n");
+        push(@headerContent, "    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);\n");
         $structureFlags{"JSC::OverridesGetPropertyNames"} = 1;       
     }
 
-    # Custom getPropertyAttributes function
-    push(@headerContent, "    virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;\n") if $dataNode->extendedAttributes->{"CustomGetPropertyAttributes"};
-
     # Custom defineGetter function
     push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);\n") if $dataNode->extendedAttributes->{"CustomDefineGetter"};
 
@@ -665,7 +663,7 @@ sub GenerateHeader
     }
 
     # Constructor object getter
-    push(@headerContent, "    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);\n") if $dataNode->extendedAttributes->{"GenerateConstructor"};
+    push(@headerContent, "    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);\n") if (!($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"}));
 
     my $numCustomFunctions = 0;
     my $numCustomAttributes = 0;
@@ -677,9 +675,17 @@ sub GenerateHeader
             $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"};
             $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCCustomGetter"};
             $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCCustomSetter"};
+            if ($attribute->signature->extendedAttributes->{"CachedAttribute"}) {
+                push(@headerContent, "    static const unsigned " . $attribute->signature->name . "Slot = $numCachedAttributes + Base::AnonymousSlotCount;\n");
+                $numCachedAttributes++;
+            }
         }
     }
 
+    if ($numCachedAttributes > 0) {
+        push(@headerContent, "    using $parentClassName" . "::putAnonymousValue;\n");
+        push(@headerContent, "    using $parentClassName" . "::getAnonymousValue;\n");
+    }
     if ($numCustomAttributes > 0) {
         push(@headerContent, "\n    // Custom attributes\n");
 
@@ -726,6 +732,12 @@ sub GenerateHeader
         push(@headerContent, "    }\n");
     }
     
+    # anonymous slots
+    if ($numCachedAttributes) {
+        push(@headerContent, "public:\n");
+        push(@headerContent, "    static const unsigned AnonymousSlotCount = $numCachedAttributes + Base::AnonymousSlotCount;\n");
+    }
+
     # structure flags
     push(@headerContent, "protected:\n");
     push(@headerContent, "    static const unsigned StructureFlags = ");
@@ -736,7 +748,7 @@ sub GenerateHeader
 
     # Index getter
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
-        push(@headerContent, "    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+        push(@headerContent, "    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);\n");
     }
     if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
         push(@headerContent, "    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);\n");
@@ -751,7 +763,7 @@ sub GenerateHeader
     if ($dataNode->extendedAttributes->{"HasNameGetter"} || $dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
         push(@headerContent, "private:\n");
         push(@headerContent, "    static bool canGetItemsForName(JSC::ExecState*, $implClassName*, const JSC::Identifier&);\n");
-        push(@headerContent, "    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+        push(@headerContent, "    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
     }
 
     push(@headerContent, "};\n\n");
@@ -769,7 +781,7 @@ sub GenerateHeader
 
     if (!$hasParent || $dataNode->extendedAttributes->{"GenerateToJS"} || $dataNode->extendedAttributes->{"CustomToJS"}) {
         if ($podType) {
-            push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<$podType>*, SVGElement* context);\n");
+            push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<$podType>*, SVGElement*);\n");
         } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
             push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, $implType*, SVGElement* context);\n");
         } else {
@@ -818,7 +830,7 @@ sub GenerateHeader
     push(@headerContent,
         "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
         "    {\n" .
-        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));\n" .
+        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);\n" .
         "    }\n");
     if ($dataNode->extendedAttributes->{"DelegatingPrototypePutFunction"}) {
         push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
@@ -848,20 +860,20 @@ sub GenerateHeader
         }
     }
 
-    if ($numAttributes > 0 || $dataNode->extendedAttributes->{"GenerateConstructor"}) {
+    if ($numAttributes > 0 || !($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"})) {
         push(@headerContent,"// Attributes\n\n");
         foreach my $attribute (@{$dataNode->attributes}) {
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
-            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
             unless ($attribute->type =~ /readonly/) {
                 my $setter = "setJS" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
                 push(@headerContent, "void ${setter}(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);\n");
             }
         }
         
-        if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
+        if (!($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"})) {
             my $getter = "js" . $interfaceName . "Constructor";
-            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
         }
     }
 
@@ -869,7 +881,7 @@ sub GenerateHeader
         push(@headerContent,"// Constants\n\n");
         foreach my $constant (@{$dataNode->constants}) {
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($constant->name);
-            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
         }
     }
 
@@ -928,7 +940,7 @@ sub GenerateImplementation
 
     # - Add all attributes in a hashtable definition
     my $numAttributes = @{$dataNode->attributes};
-    $numAttributes++ if $dataNode->extendedAttributes->{"GenerateConstructor"};
+    $numAttributes++ if (!($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"}));
 
     if ($numAttributes > 0) {
         my $hashSize = $numAttributes;
@@ -969,7 +981,7 @@ sub GenerateImplementation
             }
         }
 
-        if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
+        if (!($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"})) {
             push(@hashKeys, "constructor");
             my $getter = "js" . $interfaceName . "Constructor";
             push(@hashValue1, $getter);
@@ -987,7 +999,7 @@ sub GenerateImplementation
     my $numFunctions = @{$dataNode->functions};
 
     # - Add all constants
-    if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
+    if (!($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"})) {
         $hashSize = $numConstants;
         $hashName = $className . "ConstructorTable";
 
@@ -1159,9 +1171,6 @@ sub GenerateImplementation
     my $podType = $dataNode->extendedAttributes->{"PODType"};
     my $implType = $podType ? "JSSVGPODTypeWrapper<$podType> " : $implClassName;
 
-    my $needsSVGContext = IsSVGTypeNeedingContextParameter($implClassName);
-    my $parentNeedsSVGContext = ($needsSVGContext and $parentClassName =~ /SVG/);
-
     # Constructor
     if ($interfaceName eq "DOMWindow") {
         AddIncludesForType("JSDOMWindowShell");
@@ -1172,16 +1181,19 @@ sub GenerateImplementation
         push(@implContent, "${className}::$className(NonNullPassRefPtr<Structure> structure, PassRefPtr<$implType> impl)\n");
         push(@implContent, "    : $parentClassName(structure, impl)\n");
     } else {
-        my $contextArg = $needsSVGContext ? ", SVGElement* context" : "";
-        push(@implContent, "${className}::$className(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<$implType> impl$contextArg)\n");
+        push(@implContent, "${className}::$className(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<$implType> impl)\n");
         if ($hasParent) {
-            push(@implContent, "    : $parentClassName(structure, globalObject, impl" . ($parentNeedsSVGContext ? ", context" : "") . ")\n");
+            push(@implContent, "    : $parentClassName(structure, globalObject, impl)\n");
         } else {
-            push(@implContent, "    : $parentClassName(structure, globalObject" . ($needsSVGContext ? ", context" : "") . ")\n");
+            push(@implContent, "    : $parentClassName(structure, globalObject)\n");
             push(@implContent, "    , m_impl(impl)\n");
         }
     }
     push(@implContent, "{\n");
+    if ($numCachedAttributes > 0) {
+        push(@implContent, "    for (unsigned i = Base::AnonymousSlotCount; i < AnonymousSlotCount; i++)\n");
+        push(@implContent, "        putAnonymousValue(i, JSValue());\n");
+    }
     push(@implContent, "}\n\n");
 
     # Destructor
@@ -1191,41 +1203,27 @@ sub GenerateImplementation
 
         if ($eventTarget) {
             $implIncludes{"RegisteredEventListener.h"} = 1;
-            push(@implContent, "    impl()->invalidateEventListeners();\n");
+            push(@implContent, "    impl()->invalidateJSEventListeners(this);\n");
         }
 
         if (!$dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
             if ($interfaceName eq "Node") {
                  push(@implContent, "    forgetDOMNode(this, impl(), impl()->document());\n");
             } else {
-                if ($podType) {
-                    my $animatedType = $implClassName;
-                    $animatedType =~ s/SVG/SVGAnimated/;
-
-                    # Special case for JSSVGNumber
-                    if ($codeGenerator->IsSVGAnimatedType($animatedType) and $podType ne "float") {
-                        push(@implContent, "    JSSVGDynamicPODTypeWrapperCache<$podType, $animatedType>::forgetWrapper(m_impl.get());\n");
-                    }
-                }
                 push(@implContent, "    forgetDOMObject(this, impl());\n");
             }
+
+            push(@implContent, "    JSSVGContextCache::forgetWrapper(this);\n") if IsSVGTypeNeedingContextParameter($implClassName);
         }
 
         push(@implContent, "}\n\n");
     }
 
-    # Document needs a special destructor because it's a special case for caching. It needs
-    # its own special handling rather than relying on the caching that Node normally does.
-    if ($interfaceName eq "Document") {
-        push(@implContent, "${className}::~$className()\n");
-        push(@implContent, "{\n    forgetDOMObject(this, static_cast<${implClassName}*>(impl()));\n}\n\n");
-    }
-
     if ($needsMarkChildren && !$dataNode->extendedAttributes->{"CustomMarkFunction"}) {
         push(@implContent, "void ${className}::markChildren(MarkStack& markStack)\n");
         push(@implContent, "{\n");
         push(@implContent, "    Base::markChildren(markStack);\n");
-        push(@implContent, "    impl()->markEventListeners(markStack);\n");
+        push(@implContent, "    impl()->markJSEventListeners(markStack);\n");
         push(@implContent, "}\n\n");
     }
 
@@ -1241,7 +1239,8 @@ sub GenerateImplementation
     }
 
     my $hasGetter = $numAttributes > 0 
-                 || $dataNode->extendedAttributes->{"GenerateConstructor"} 
+                 || !($dataNode->extendedAttributes->{"OmitConstructor"} 
+                 || $dataNode->extendedAttributes->{"CustomConstructor"})
                  || $dataNode->extendedAttributes->{"HasIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}
@@ -1292,9 +1291,9 @@ sub GenerateImplementation
                     push(@implContent, "#if ${conditionalString}\n");
                 }
 
-                push(@implContent, "JSValue ${getFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
+                push(@implContent, "JSValue ${getFunctionName}(ExecState* exec, JSValue slotBase, const Identifier&)\n");
                 push(@implContent, "{\n");
-                push(@implContent, "    ${className}* castedThis = static_cast<$className*>(asObject(slot.slotBase()));\n");
+                push(@implContent, "    ${className}* castedThis = static_cast<$className*>(asObject(slotBase));\n");
 
                 my $implClassNameForValueConversion = "";
                 if (!$podType and ($codeGenerator->IsSVGAnimatedType($implClassName) or $attribute->type !~ /^readonly/)) {
@@ -1324,12 +1323,14 @@ sub GenerateImplementation
                     push(@implContent, "    UNUSED_PARAM(exec);\n");
                     push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(castedThis->impl());\n");
                     push(@implContent, "    if (EventListener* listener = imp->$implGetterFunctionName()) {\n");
+                    push(@implContent, "        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {\n");
                     if ($implClassName eq "Document" || $implClassName eq "WorkerContext" || $implClassName eq "SharedWorkerContext" || $implClassName eq "DedicatedWorkerContext") {
-                        push(@implContent, "        if (JSObject* jsFunction = listener->jsFunction(imp))\n");
+                        push(@implContent, "            if (JSObject* jsFunction = jsListener->jsFunction(imp))\n");
                     } else {
-                        push(@implContent, "        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))\n");
+                        push(@implContent, "            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))\n");
                     }
-                    push(@implContent, "            return jsFunction;\n");
+                    push(@implContent, "                return jsFunction;\n");
+                    push(@implContent, "        }\n");
                     push(@implContent, "    }\n");
                     push(@implContent, "    return jsNull();\n");
                 } elsif ($attribute->signature->type =~ /Constructor$/) {
@@ -1340,12 +1341,19 @@ sub GenerateImplementation
                     push(@implContent, "    return JS" . $constructorType . "::getConstructor(exec, castedThis);\n");
                 } elsif (!@{$attribute->getterExceptions}) {
                     push(@implContent, "    UNUSED_PARAM(exec);\n");
+                    my $cacheIndex = 0;
+                    if ($attribute->signature->extendedAttributes->{"CachedAttribute"}) {
+                        $cacheIndex = $currentCachedAttribute;
+                        $currentCachedAttribute++;
+                        push(@implContent, "    if (JSValue cachedValue = castedThis->getAnonymousValue(" . $className . "::" . $attribute->signature->name . "Slot))\n");
+                        push(@implContent, "        return cachedValue;\n");
+                    }
                     if ($podType) {
                         push(@implContent, "    $podType imp(*castedThis->impl());\n");
                         if ($podType eq "float") { # Special case for JSSVGNumber
-                            push(@implContent, "    return " . NativeToJSValue($attribute->signature, 0, $implClassName, "", "imp", "castedThis") . ";\n");
+                            push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "", "imp", "castedThis") . ";\n");
                         } else {
-                            push(@implContent, "    return " . NativeToJSValue($attribute->signature, 0, $implClassName, "", "imp.$implGetterFunctionName()", "castedThis") . ";\n");
+                            push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "", "imp.$implGetterFunctionName()", "castedThis") . ";\n");
                         }
                     } else {
                         push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(castedThis->impl());\n");
@@ -1364,11 +1372,15 @@ sub GenerateImplementation
                         my $jsType = NativeToJSValue($attribute->signature, 0, $implClassName, $implClassNameForValueConversion, $value, "castedThis");
                         if ($codeGenerator->IsSVGAnimatedType($type)) {
                             push(@implContent, "    RefPtr<$type> obj = $jsType;\n");
-                            push(@implContent, "    return toJS(exec, castedThis->globalObject(), obj.get(), imp);\n");
+                            push(@implContent, "    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);\n");
                         } else {
-                            push(@implContent, "    return $jsType;\n");
+                            push(@implContent, "    JSValue result = $jsType;\n");
                         }
                     }
+                    
+                    push(@implContent, "    castedThis->putAnonymousValue(" . $className . "::" . $attribute->signature->name . "Slot, result);\n") if ($attribute->signature->extendedAttributes->{"CachedAttribute"});
+                    push(@implContent, "    return result;\n");
+
                 } else {
                     push(@implContent, "    ExceptionCode ec = 0;\n");                    
                     if ($podType) {
@@ -1392,20 +1404,13 @@ sub GenerateImplementation
                 push(@implContent, "\n");
             }
 
-            if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
+            if (!($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"})) {
                 my $constructorFunctionName = "js" . $interfaceName . "Constructor";
 
-                push(@implContent, "JSValue ${constructorFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
+                push(@implContent, "JSValue ${constructorFunctionName}(ExecState* exec, JSValue slotBase, const Identifier&)\n");
                 push(@implContent, "{\n");
-                if (IsSVGTypeNeedingContextParameter($interfaceName)) {
-                    # FIXME: SVG bindings with a context pointer have no space to store a globalObject
-                    # so we use deprecatedGlobalObjectForPrototype instead.
-                    push(@implContent, "    UNUSED_PARAM(slot);\n");
-                    push(@implContent, "    return ${className}::getConstructor(exec, deprecatedGlobalObjectForPrototype(exec));\n");
-                } else {
-                    push(@implContent, "    ${className}* domObject = static_cast<$className*>(asObject(slot.slotBase()));\n");
-                    push(@implContent, "    return ${className}::getConstructor(exec, domObject->globalObject());\n");
-                }
+                push(@implContent, "    ${className}* domObject = static_cast<$className*>(asObject(slotBase));\n");
+                push(@implContent, "    return ${className}::getConstructor(exec, domObject->globalObject());\n");
                 push(@implContent, "}\n");
             }
         }
@@ -1479,36 +1484,30 @@ sub GenerateImplementation
                             $implIncludes{"JSEventListener.h"} = 1;
                             push(@implContent, "    UNUSED_PARAM(exec);\n");
                             push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(thisObject)->impl());\n");
-                            if ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
-                                push(@implContent, "    JSDOMGlobalObject* globalObject = static_cast<$className*>(thisObject);\n");
-                            } else {
-                                $implIncludes{"Frame.h"} = 1;
-                                $implIncludes{"JSDOMGlobalObject.h"} = 1;
-                                push(@implContent, "    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);\n");
-                                push(@implContent, "    if (!globalObject)\n");
-                                push(@implContent, "        return;\n");
-                            }
-                            push(@implContent, "    imp->set$implSetterFunctionName(globalObject->createJSAttributeEventListener(value));\n");
+                            push(@implContent, "    imp->set$implSetterFunctionName(createJSAttributeEventListener(exec, value, thisObject));\n");
                         } elsif ($attribute->signature->type =~ /Constructor$/) {
                             my $constructorType = $attribute->signature->type;
                             $constructorType =~ s/Constructor$//;
-                            $implIncludes{"JS" . $constructorType . ".h"} = 1;
+                            if ($constructorType ne "DOMObject") {
+                                $implIncludes{"JS" . $constructorType . ".h"} = 1;
+                            }
                             push(@implContent, "    // Shadowing a built-in constructor\n");
                             push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(Identifier(exec, \"$name\"), value);\n");
                         } elsif ($attribute->signature->extendedAttributes->{"Replaceable"}) {
                             push(@implContent, "    // Shadowing a built-in object\n");
                             push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(Identifier(exec, \"$name\"), value);\n");
                         } else {
+                            push(@implContent, "    $className* castedThisObj = static_cast<$className*>(thisObject);\n");
+                            push(@implContent, "    $implType* imp = static_cast<$implType*>(castedThisObj->impl());\n");
                             if ($podType) {
-                                push(@implContent, "    $podType imp(*static_cast<$className*>(thisObject)->impl());\n");
+                                push(@implContent, "    $podType podImp(*imp);\n");
                                 if ($podType eq "float") { # Special case for JSSVGNumber
-                                    push(@implContent, "    imp = " . JSValueToNative($attribute->signature, "value") . ";\n");
+                                    push(@implContent, "    podImp = " . JSValueToNative($attribute->signature, "value") . ";\n");
                                 } else {
-                                    push(@implContent, "    imp.set$implSetterFunctionName(" . JSValueToNative($attribute->signature, "value") . ");\n");
+                                    push(@implContent, "    podImp.set$implSetterFunctionName(" . JSValueToNative($attribute->signature, "value") . ");\n");
                                 }
-                                push(@implContent, "        static_cast<$className*>(thisObject)->impl()->commitChange(imp, static_cast<$className*>(thisObject)->context());\n");
+                                push(@implContent, "    imp->commitChange(podImp, castedThisObj);\n");
                             } else {
-                                push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(thisObject)->impl());\n");
                                 my $nativeValue = JSValueToNative($attribute->signature, "value");
                                 push(@implContent, "    ExceptionCode ec = 0;\n") if @{$attribute->setterExceptions};
                                 my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
@@ -1524,10 +1523,8 @@ sub GenerateImplementation
                                 push(@implContent, ", ec") if @{$attribute->setterExceptions};
                                 push(@implContent, ");\n");
                                 push(@implContent, "    setDOMException(exec, ec);\n") if @{$attribute->setterExceptions};
-
                                 if (IsSVGTypeNeedingContextParameter($implClassName)) {
-                                    push(@implContent, "    if (static_cast<$className*>(thisObject)->context())\n");
-                                    push(@implContent, "        static_cast<$className*>(thisObject)->context()->svgAttributeChanged(static_cast<$className*>(thisObject)->impl()->associatedAttributeName());\n");
+                                    push(@implContent, "    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());\n");
                                 }
                             }
                         }
@@ -1540,17 +1537,17 @@ sub GenerateImplementation
     }
 
     if (($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) && !$dataNode->extendedAttributes->{"CustomGetPropertyNames"}) {
-        push(@implContent, "void ${className}::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)\n");
+        push(@implContent, "void ${className}::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)\n");
         push(@implContent, "{\n");
         if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
             push(@implContent, "    for (unsigned i = 0; i < static_cast<${implClassName}*>(impl())->length(); ++i)\n");
             push(@implContent, "        propertyNames.add(Identifier::from(exec, i));\n");
         }
-        push(@implContent, "     Base::getOwnPropertyNames(exec, propertyNames);\n");
+        push(@implContent, "     Base::getOwnPropertyNames(exec, propertyNames, mode);\n");
         push(@implContent, "}\n\n");
     }
 
-    if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
+    if (!($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"})) {
         push(@implContent, "JSValue ${className}::getConstructor(ExecState* exec, JSGlobalObject* globalObject)\n{\n");
         push(@implContent, "    return getDOMConstructor<${className}Constructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));\n");
         push(@implContent, "}\n\n");
@@ -1590,15 +1587,31 @@ sub GenerateImplementation
                 push(@implContent, "        return jsUndefined();\n");
             }
 
+            # Special case for JSSVGLengthList / JSSVGTransformList / JSSVGPointList / JSSVGNumberList
+            # Instead of having JSSVG*Custom.cpp implementations for the SVGList interface for all of these
+            # classes, we directly forward the calls to JSSVGPODListCustom, which centralizes the otherwise
+            # duplicated code for the JSSVG*List classes mentioned above.
+            my $svgPODListType;
+            if ($implClassName =~ /SVG.*List/) {
+                $svgPODListType = $implClassName;
+                $svgPODListType =~ s/List$//;
+                $svgPODListType = "" unless $codeGenerator->IsPodType($svgPODListType);
+                
+                # Ignore additional (non-SVGList) SVGTransformList methods, that are not handled through JSSVGPODListCustom
+                $svgPODListType = "" if $functionImplementationName =~ /createSVGTransformFromMatrix/;
+                $svgPODListType = "" if $functionImplementationName =~ /consolidate/;
+            }
+
             if ($function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"JSCCustom"}) {
                 push(@implContent, "    return castedThisObj->" . $functionImplementationName . "(exec, args);\n");
+            } elsif ($svgPODListType) {
+                $implIncludes{"JS${svgPODListType}.h"} = 1;
+                $implIncludes{"JSSVGPODListCustom.h"} = 1;
+                push(@implContent, "    return JSSVGPODListCustom::$functionImplementationName<$className, " . GetNativeType($svgPODListType)
+                                 . ">(castedThisObj, exec, args, to" . $svgPODListType . ");\n");
             } else {
-                if ($podType) {
-                    push(@implContent, "    JSSVGPODTypeWrapper<$podType>* wrapper = castedThisObj->impl();\n");
-                    push(@implContent, "    $podType imp(*wrapper);\n");
-                } else {
-                    push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(castedThisObj->impl());\n");
-                }
+                push(@implContent, "    $implType* imp = static_cast<$implType*>(castedThisObj->impl());\n");
+                push(@implContent, "    $podType podImp(*imp);\n") if $podType;
 
                 my $numParameters = @{$function->parameters};
 
@@ -1618,7 +1631,7 @@ sub GenerateImplementation
                 }
 
                 my $paramIndex = 0;
-                my $functionString = "imp" . ($podType ? "." : "->") . $functionImplementationName . "(";
+                my $functionString = ($podType ? "podImp." : "imp->") . $functionImplementationName . "(";
 
                 my $hasOptionalArguments = 0;
 
@@ -1672,7 +1685,12 @@ sub GenerateImplementation
                     } else {
                         $functionString .= $name;
                     }
+                    $paramIndex++;
+                }
 
+                if ($function->signature->extendedAttributes->{"NeedsUserGestureCheck"}) {
+                    $functionString .= ", " if $paramIndex;
+                    $functionString .= "processingUserGesture(exec)";
                     $paramIndex++;
                 }
 
@@ -1690,7 +1708,7 @@ sub GenerateImplementation
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($constant->name);
 
             # FIXME: this casts into int to match our previous behavior which turned 0xFFFFFFFF in -1 for NodeFilter.SHOW_ALL
-            push(@implContent, "JSValue ${getter}(ExecState* exec, const Identifier&, const PropertySlot&)\n");
+            push(@implContent, "JSValue ${getter}(ExecState* exec, JSValue, const Identifier&)\n");
             push(@implContent, "{\n");
             push(@implContent, "    return jsNumber(exec, static_cast<int>(" . $constant->value . "));\n");
             push(@implContent, "}\n\n");
@@ -1698,14 +1716,14 @@ sub GenerateImplementation
     }
 
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
-        push(@implContent, "\nJSValue ${className}::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
+        push(@implContent, "\nJSValue ${className}::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)\n");
         push(@implContent, "{\n");
-        push(@implContent, "    ${className}* thisObj = static_cast<$className*>(asObject(slot.slotBase()));\n");
+        push(@implContent, "    ${className}* thisObj = static_cast<$className*>(asObject(slotBase));\n");
         if (IndexGetterReturnsStrings($implClassName)) {
             $implIncludes{"KURL.h"} = 1;
-            push(@implContent, "    return jsStringOrNull(exec, thisObj->impl()->item(slot.index()));\n");
+            push(@implContent, "    return jsStringOrNull(exec, thisObj->impl()->item(index));\n");
         } else {
-            push(@implContent, "    return toJS(exec, thisObj->globalObject(), static_cast<$implClassName*>(thisObj->impl())->item(slot.index()));\n");
+            push(@implContent, "    return toJS(exec, thisObj->globalObject(), static_cast<$implClassName*>(thisObj->impl())->item(index));\n");
         }
         push(@implContent, "}\n");
         if ($interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
@@ -1729,11 +1747,10 @@ sub GenerateImplementation
         if ($podType) {
             push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JSSVGPODTypeWrapper<$podType>* object, SVGElement* context)\n");
         } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
-             push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, $implType* object, SVGElement* context)\n");
+            push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, $implType* object, SVGElement* context)\n");
         } else {
             push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, $implType* object)\n");
         }
-
         push(@implContent, "{\n");
         if ($podType) {
             push(@implContent, "    return getDOMObjectWrapper<$className, JSSVGPODTypeWrapper<$podType> >(exec, globalObject, object, context);\n");
@@ -1791,11 +1808,7 @@ sub GenerateImplementationFunctionCall()
     if ($function->signature->type eq "void") {
         push(@implContent, $indent . "$functionString;\n");
         push(@implContent, $indent . "setDOMException(exec, ec);\n") if @{$function->raisesExceptions};
-
-        if ($podType) {
-            push(@implContent, $indent . "wrapper->commitChange(imp, castedThisObj->context());\n");
-        }
-
+        push(@implContent, $indent . "imp->commitChange(podImp, castedThisObj);\n") if $podType;
         push(@implContent, $indent . "return jsUndefined();\n");
     } else {
         push(@implContent, "\n" . $indent . "JSC::JSValue result = " . NativeToJSValue($function->signature, 1, $implClassName, "", $functionString, "castedThisObj") . ";\n");
@@ -1804,7 +1817,7 @@ sub GenerateImplementationFunctionCall()
         if ($podType and not $function->signature->extendedAttributes->{"Immutable"}) {
             # Immutable methods do not commit changes back to the instance, thus producing
             # a new instance rather than mutating existing one.
-            push(@implContent, $indent . "wrapper->commitChange(imp, castedThisObj->context());\n");
+            push(@implContent, $indent . "imp->commitChange(podImp, castedThisObj);\n");
         }
 
         push(@implContent, $indent . "return result;\n");
@@ -1827,11 +1840,14 @@ sub GetNativeTypeFromSignature
 my %nativeType = (
     "CompareHow" => "Range::CompareHow",
     "DOMString" => "const UString&",
+    "DOMObject" => "ScriptValue",
     "NodeFilter" => "RefPtr<NodeFilter>",
+    "SVGAngle" => "SVGAngle",
     "SVGLength" => "SVGLength",
-    "SVGMatrix" => "TransformationMatrix",
+    "SVGMatrix" => "AffineTransform",
     "SVGNumber" => "float",
     "SVGPaintType" => "SVGPaint::SVGPaintType",
+    "SVGPreserveAspectRatio" => "SVGPreserveAspectRatio",
     "SVGPoint" => "FloatPoint",
     "SVGRect" => "FloatRect",
     "SVGTransform" => "SVGTransform",
@@ -1841,6 +1857,8 @@ my %nativeType = (
     "long" => "int",
     "unsigned long" => "unsigned",
     "unsigned short" => "unsigned short",
+    "long long" => "long long",
+    "unsigned long long" => "unsigned long long",
 );
 
 sub GetNativeType
@@ -1864,7 +1882,9 @@ sub JSValueToNative
     return "$value.toNumber(exec)" if $type eq "double";
     return "$value.toFloat(exec)" if $type eq "float" or $type eq "SVGNumber";
     return "$value.toInt32(exec)" if $type eq "unsigned long" or $type eq "long" or $type eq "unsigned short";
+    return "static_cast<$type>($value.toInteger(exec))" if $type eq "long long" or $type eq "unsigned long long";
 
+    return "valueToDate(exec, $value)" if $type eq "Date";
     return "static_cast<Range::CompareHow>($value.toInt32(exec))" if $type eq "CompareHow";
     return "static_cast<SVGPaint::SVGPaintType>($value.toInt32(exec))" if $type eq "SVGPaintType";
 
@@ -1874,7 +1894,11 @@ sub JSValueToNative
         return "$value.toString(exec)";
     }
 
-    if ($type eq "SerializedScriptValue") {
+    if ($type eq "DOMObject") {
+        return "$value";
+    }
+
+    if ($type eq "SerializedScriptValue" or $type eq "any") {
         $implIncludes{"SerializedScriptValue.h"} = 1;
         return "SerializedScriptValue::create(exec, $value)";
     }
@@ -1902,7 +1926,11 @@ sub NativeToJSValue
     my $type = $codeGenerator->StripModule($signature->type);
 
     return "jsBoolean($value)" if $type eq "boolean";
-    
+
+    # Need to check Date type before IsPrimitiveType().
+    if ($type eq "Date") {
+        return "jsDateOrNull(exec, $value)";
+    }
     if ($codeGenerator->IsPrimitiveType($type) or $type eq "SVGPaintType" or $type eq "DOMTimeStamp") {
         $implIncludes{"<runtime/JSNumberCell.h>"} = 1;
         return "jsNumber(exec, $value)";
@@ -1922,9 +1950,7 @@ sub NativeToJSValue
         return "jsString(exec, $value)";
     }
     
-    # Some SVG bindings don't have space to store a globalObject pointer, for those, we use the deprecatedGlobalObjectForPrototype hack for now.
-    my $globalObject = IsSVGTypeNeedingContextParameter($implClassName) ? "deprecatedGlobalObjectForPrototype(exec)" : "$thisValue->globalObject()";
-
+    my $globalObject = "$thisValue->globalObject()";
     if ($codeGenerator->IsPodType($type)) {
         $implIncludes{"JS$type.h"} = 1;
 
@@ -1942,25 +1968,16 @@ sub NativeToJSValue
             and $codeGenerator->IsPodTypeWithWriteableProperties($type)
             and not defined $signature->extendedAttributes->{"Immutable"}) {
             if ($codeGenerator->IsPodType($implClassName)) {
-                return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapperWithPODTypeParent<$nativeType, $implClassName>::create($value, $thisValue->impl()).get(), $thisValue->context())";
+                return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapperWithPODTypeParent<$nativeType, $implClassName>::create($value, $thisValue->impl()).get(), JSSVGContextCache::svgContextForDOMObject(castedThis))";
             } else {
                 return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapperWithParent<$nativeType, $implClassName>::create(imp, &${implClassName}::$getter, &${implClassName}::$setter).get(), imp)";
             }
         }
 
         if ($implClassNameForValueConversion eq "") {
-            # SVGZoomEvent has no context() pointer, and is also not an SVGElement.
-            # This is not a problem, because SVGZoomEvent has no read/write properties.
-            return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapper<$nativeType>::create($value).get(), 0)" if $implClassName eq "SVGZoomEvent";
-
-            if (IsSVGTypeNeedingContextParameter($implClassName)) {
-                return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapper<$nativeType>::create($value).get(), castedThisObj->context())" if $inFunctionCall;
-                return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapper<$nativeType>::create($value).get(), $thisValue->context())";
-            } else {
-                return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapper<$nativeType>::create($value).get(), imp)";
-            }
-        } else { # These classes, always have a m_context pointer!
-            return "toJS(exec, $globalObject, JSSVGDynamicPODTypeWrapperCache<$nativeType, $implClassNameForValueConversion>::lookupOrCreateWrapper(imp, &${implClassNameForValueConversion}::$getter, &${implClassNameForValueConversion}::$setter).get(), $thisValue->context())";
+            return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapper<$nativeType>::create($value).get(), 0 /* no context on purpose */)";
+        } else {
+            return "toJS(exec, $globalObject, JSSVGDynamicPODTypeWrapperCache<$nativeType, $implClassNameForValueConversion>::lookupOrCreateWrapper(imp, &${implClassNameForValueConversion}::$getter, &${implClassNameForValueConversion}::$setter).get(), JSSVGContextCache::svgContextForDOMObject(castedThis));"
         }
     }
 
@@ -1980,15 +1997,19 @@ sub NativeToJSValue
     }
 
     if ($type eq "DOMObject") {
-        $implIncludes{"JSCanvasRenderingContext2D.h"} = 1;
+        if ($implClassName eq "Document") {
+            $implIncludes{"JSCanvasRenderingContext2D.h"} = 1;
+        } else {
+            return "$value.jsValue();";
+        }
     } elsif ($type =~ /SVGPathSeg/) {
         $implIncludes{"JS$type.h"} = 1;
         $joinedName = $type;
         $joinedName =~ s/Abs|Rel//;
         $implIncludes{"$joinedName.h"} = 1;
-    } elsif ($type eq "SerializedScriptValue") {
-        $implIncludes{"$type.h"} = 1;
-        return "$value->deserialize(exec)";
+    } elsif ($type eq "SerializedScriptValue" or $type eq "any") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return "$value ? $value->deserialize(exec, castedThis->globalObject()) : jsNull()";
     } else {
         # Default, include header with same name.
         $implIncludes{"JS$type.h"} = 1;
@@ -1998,7 +2019,7 @@ sub NativeToJSValue
     return $value if $codeGenerator->IsSVGAnimatedType($type);
 
     if (IsSVGTypeNeedingContextParameter($type)) {
-        my $contextPtr = IsSVGTypeNeedingContextParameter($implClassName) ? "$thisValue->context()" : "imp";
+        my $contextPtr = IsSVGTypeNeedingContextParameter($implClassName) ? "JSSVGContextCache::svgContextForDOMObject(castedThis)" : "imp";
         return "toJS(exec, $globalObject, WTF::getPtr($value), $contextPtr)";
     }
 
@@ -2118,6 +2139,7 @@ tableSizeLoop:
     $i = 0;
     foreach my $key (@{$keys}) {
         my $conditional;
+        my $targetType;
 
         if ($conditionals) {
             $conditional = $conditionals->{$key};
@@ -2126,7 +2148,13 @@ tableSizeLoop:
             my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
             push(@implContent, "#if ${conditionalString}\n");
         }
-        push(@implContent, "    { \"$key\", @$specials[$i], (intptr_t)@$value1[$i], (intptr_t)@$value2[$i] },\n");
+        
+        if ("@$specials[$i]" =~ m/Function/) {
+            $targetType = "static_cast<NativeFunction>";
+        } else {
+            $targetType = "static_cast<PropertySlot::GetValueFunc>";
+        }
+        push(@implContent, "    { \"$key\", @$specials[$i], (intptr_t)" . $targetType . "(@$value1[$i]), (intptr_t)@$value2[$i] },\n");
         if ($conditional) {
             push(@implContent, "#endif\n");
         }
@@ -2241,12 +2269,23 @@ sub WriteData
         }
 
         print $HEADER @headerContent;
+
+        @includes = ();
+        foreach my $include (keys %headerTrailingIncludes) {
+            $include = "\"$include\"" unless $include =~ /^["<]/; # "
+            push @includes, $include;
+        }
+        foreach my $include (sort @includes) {
+            print $HEADER "#include $include\n";
+        }
+
         close($HEADER);
         undef($HEADER);
 
         @headerContentHeader = ();
         @headerContent = ();
         %headerIncludes = ();
+        %headerTrailingIncludes = ();
     }
 
     if (defined($DEPS)) {
@@ -2283,7 +2322,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index 91248c5500..3c5fe45fd9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -17,7 +17,7 @@
 # Library General Public License for more details.
 # 
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 # Boston, MA 02110-1301, USA.
 #
@@ -66,7 +66,7 @@ my %nativeObjCTypeHash = ("URL" => 1, "Color" => 1);
 my %baseTypeHash = ("Object" => 1, "Node" => 1, "NodeList" => 1, "NamedNodeMap" => 1, "DOMImplementation" => 1,
                     "Event" => 1, "CSSRule" => 1, "CSSValue" => 1, "StyleSheet" => 1, "MediaList" => 1,
                     "Counter" => 1, "Rect" => 1, "RGBColor" => 1, "XPathExpression" => 1, "XPathResult" => 1,
-                    "NodeIterator" => 1, "TreeWalker" => 1, "AbstractView" => 1,
+                    "NodeIterator" => 1, "TreeWalker" => 1, "AbstractView" => 1, "Blob" => 1,
                     "SVGAngle" => 1, "SVGAnimatedAngle" => 1, "SVGAnimatedBoolean" => 1, "SVGAnimatedEnumeration" => 1,
                     "SVGAnimatedInteger" => 1, "SVGAnimatedLength" => 1, "SVGAnimatedLengthList" => 1,
                     "SVGAnimatedNumber" => 1, "SVGAnimatedNumberList" => 1, "SVGAnimatedPoints" => 1,
@@ -222,7 +222,13 @@ sub ReadPublicInterfaces
     %publicInterfaces = ();
 
     my $fileName = "WebCore/bindings/objc/PublicDOMInterfaces.h";
-    open FILE, "-|", "/usr/bin/gcc", "-E", "-P", "-x", "objective-c", 
+    my $gccLocation = "";
+    if (($Config::Config{'osname'}) =~ /solaris/i) {
+        $gccLocation = "/usr/sfw/bin/gcc";
+    } else {
+        $gccLocation = "/usr/bin/gcc";
+    }
+    open FILE, "-|", $gccLocation, "-E", "-P", "-x", "objective-c",
         (map { "-D$_" } split(/ +/, $defines)), "-DOBJC_CODE_GENERATION", $fileName or die "Could not open $fileName";
     my @documentContent = <FILE>;
     close FILE;
@@ -316,6 +322,7 @@ sub GetClassName
     return "BOOL" if $name eq "boolean";
     return "unsigned" if $name eq "unsigned long";
     return "int" if $name eq "long";
+    return "NSTimeInterval" if $name eq "Date";
     return "DOMAbstractView" if $name eq "DOMWindow";
     return $name if $codeGenerator->IsPrimitiveType($name) or $name eq "DOMImplementation" or $name eq "DOMTimeStamp";
 
@@ -577,7 +584,7 @@ sub AddIncludesForType
     }
 
     if ($type eq "SVGMatrix") {
-        $implIncludes{"TransformationMatrix.h"} = 1;
+        $implIncludes{"AffineTransform.h"} = 1;
         $implIncludes{"DOMSVGMatrixInternal.h"} = 1;
         $implIncludes{"SVGException.h"} = 1;
         return;
@@ -1040,6 +1047,7 @@ sub GenerateImplementation
     $implIncludes{$classHeaderName . "Internal.h"} = 1;
 
     # FIXME: These includes are only needed when the class is a subclass of one of these polymorphic classes.
+    $implIncludes{"DOMBlobInternal.h"} = 1;
     $implIncludes{"DOMCSSRuleInternal.h"} = 1;
     $implIncludes{"DOMCSSValueInternal.h"} = 1;
     $implIncludes{"DOMEventInternal.h"} = 1;
@@ -1221,7 +1229,7 @@ sub GenerateImplementation
                 $getterContentTail .= ")";
             } elsif ($attribute->signature->extendedAttributes->{"ConvertFromString"}) {
                 $getterContentTail .= ".toInt()";
-            } elsif ($codeGenerator->IsPodType($idlType)) {
+            } elsif ($codeGenerator->IsPodType($idlType) or $idlType eq "Date") {
                 $getterContentHead = "kit($getterContentHead";
                 $getterContentTail .= ")";
             } elsif (IsProtocolType($idlType) and $idlType ne "EventTarget") {
@@ -1292,6 +1300,10 @@ sub GenerateImplementation
                     push(@implContent, "    ASSERT($argName);\n\n");
                 }
 
+                if ($idlType eq "Date") {
+                    $arg = "core(" . $arg . ")";
+                }
+
                 if ($podType) {
                     # Special case for DOMSVGNumber
                     if ($podType eq "float") {
@@ -1420,8 +1432,8 @@ sub GenerateImplementation
             }
 
             # FIXME! We need [Custom] support for ObjC, to move these hacks into DOMSVGLength/MatrixCustom.mm
-            my $svgMatrixRotateFromVector = ($podType and $podType eq "TransformationMatrix" and $functionName eq "rotateFromVector");
-            my $svgMatrixInverse = ($podType and $podType eq "TransformationMatrix" and $functionName eq "inverse");
+            my $svgMatrixRotateFromVector = ($podType and $podType eq "AffineTransform" and $functionName eq "rotateFromVector");
+            my $svgMatrixInverse = ($podType and $podType eq "AffineTransform" and $functionName eq "inverse");
             my $svgLengthConvertToSpecifiedUnits = ($podType and $podType eq "SVGLength" and $functionName eq "convertToSpecifiedUnits");
 
             push(@parameterNames, "ec") if $raisesExceptions and !($svgMatrixRotateFromVector || $svgMatrixInverse);
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 95b2aa2fb9..68007e20d3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -7,8 +7,6 @@
 # Copyright (C) 2007, 2008, 2009 Google Inc.
 # Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 #
-# This file is part of the KDE project
-#
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
 # License as published by the Free Software Foundation; either
@@ -20,7 +18,7 @@
 # Library General Public License for more details.
 #
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
 # Boston, MA 02111-1307, USA.
 #
@@ -86,11 +84,6 @@ sub finish
     $object->WriteData();
 }
 
-sub leftShift($$) {
-    my ($value, $distance) = @_;
-    return (($value << $distance) & 0xFFFFFFFF);
-}
-
 # Workaround for V8 bindings difference where RGBColor is not a POD type.
 sub IsPodType
 {
@@ -128,13 +121,6 @@ sub GenerateModule
     $module = $dataNode->module;
 }
 
-sub GetLegacyHeaderIncludes
-{
-    my $legacyParent = shift;
-
-    die "Don't know what headers to include for module $module";
-}
-
 sub AvoidInclusionOfType
 {
     my $type = shift;
@@ -144,28 +130,21 @@ sub AvoidInclusionOfType
     return 0;
 }
 
-sub UsesManualToJSImplementation
-{
-    my $type = shift;
-
-    return 1 if $type eq "SVGPathSeg";
-    return 0;
-}
-
 sub AddIncludesForType
 {
     my $type = $codeGenerator->StripModule(shift);
 
     # When we're finished with the one-file-per-class
     # reorganization, we won't need these special cases.
-    if ($codeGenerator->IsPrimitiveType($type) or AvoidInclusionOfType($type)) {
-    } elsif ($type =~ /SVGPathSeg/) {
-        $joinedName = $type;
-        $joinedName =~ s/Abs|Rel//;
-        $implIncludes{"${joinedName}.h"} = 1;
-    } else {
+    if (!$codeGenerator->IsPrimitiveType($type) and !AvoidInclusionOfType($type) and $type ne "Date") {
         # default, include the same named file
-        $implIncludes{GetImplementationFileName(${type})} = 1;
+        $implIncludes{GetV8HeaderName(${type})} = 1;
+
+        if ($type =~ /SVGPathSeg/) {
+            $joinedName = $type;
+            $joinedName =~ s/Abs|Rel//;
+            $implIncludes{"${joinedName}.h"} = 1;
+        }
     }
 
     # additional includes (things needed to compile the bindings but not the header)
@@ -204,25 +183,6 @@ sub AddIncludesForSVGAnimatedType
     $implIncludes{"SVGAnimatedTemplate.h"} = 1;
 }
 
-sub AddClassForwardIfNeeded
-{
-    my $implClassName = shift;
-
-    # SVGAnimatedLength/Number/etc.. are typedefs to SVGAnimtatedTemplate, so don't use class forwards for them!
-    push(@headerContent, "class $implClassName;\n\n") unless $codeGenerator->IsSVGAnimatedType($implClassName);
-}
-
-sub GetImplementationFileName
-{
-    my $iface = shift;
-    return "Event.h" if $iface eq "DOMTimeStamp";
-    return "NamedAttrMap.h" if $iface eq "NamedNodeMap";
-    return "NameNodeList.h" if $iface eq "NodeList";
-    return "XMLHttpRequest.h" if $iface eq "XMLHttpRequest";
-
-    return "${iface}.h";
-}
-
 # If the node has a [Conditional=XXX] attribute, returns an "ENABLE(XXX)" string for use in an #if.
 sub GenerateConditionalString
 {
@@ -260,39 +220,109 @@ sub GenerateHeader
 
     # Get correct pass/store types respecting PODType flag
     my $podType = $dataNode->extendedAttributes->{"PODType"};
-    my $passType = $podType ? "JSSVGPODTypeWrapper<$podType>*" : "$implClassName*";
 
     push(@headerContent, "#include \"$podType.h\"\n") if $podType and ($podType ne "double" and $podType ne "float" and $podType ne "RGBA32");
 
     push(@headerContent, "#include <v8.h>\n");
     push(@headerContent, "#include <wtf/HashMap.h>\n");
     push(@headerContent, "#include \"StringHash.h\"\n");
-
-    push(@headerContent, "\nnamespace WebCore {\n\n");
-    push(@headerContent, "class V8ClassIndex;\n");
+    push(@headerContent, "#include \"WrapperTypeInfo.h\"\n");
+    push(@headerContent, GetHeaderClassInclude($implClassName));
+    push(@headerContent, "\nnamespace WebCore {\n");
+    if ($podType) {
+        push(@headerContent, "\ntemplate<typename PODType> class V8SVGPODTypeWrapper;\n");
+    }
     push(@headerContent, "\nclass $className {\n");
+
+    my $nativeType = GetNativeTypeForConversions($interfaceName);
+    if ($podType) {
+        $nativeType = "V8SVGPODTypeWrapper<${nativeType} >";
+    }
+    my $forceNewObjectParameter = IsDOMNodeType($interfaceName) ? ", bool forceNewObject = false" : "";
     push(@headerContent, <<END);
 
- public:
-  static bool HasInstance(v8::Handle<v8::Value> value);
-  static v8::Persistent<v8::FunctionTemplate> GetRawTemplate();
+public:
+    static bool HasInstance(v8::Handle<v8::Value> value);
+    static v8::Persistent<v8::FunctionTemplate> GetRawTemplate();
+    static v8::Persistent<v8::FunctionTemplate> GetTemplate();
+    static ${nativeType}* toNative(v8::Handle<v8::Object>);
+    static v8::Handle<v8::Object> wrap(${nativeType}*${forceNewObjectParameter});
+    static void derefObject(void*);
+    static WrapperTypeInfo info;
 END
+    if (IsActiveDomType($implClassName)) {
+        push(@headerContent, "    static ActiveDOMObject* toActiveDOMObject(v8::Handle<v8::Object>);\n");
+    }
 
     if ($implClassName eq "DOMWindow") {
-      push(@headerContent, <<END);
-  static v8::Persistent<v8::ObjectTemplate> GetShadowObjectTemplate();
+        push(@headerContent, <<END);
+    static v8::Persistent<v8::ObjectTemplate> GetShadowObjectTemplate();
 END
     }
 
-    push(@headerContent, <<END);
+    my @enabledAtRuntime;
+    foreach my $function (@{$dataNode->functions}) {
+        my $name = $function->signature->name;
+        my $attrExt = $function->signature->extendedAttributes;
 
- private:
-  static v8::Persistent<v8::FunctionTemplate> GetTemplate();
+        if ($attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+            push(@headerContent, <<END);
+    static v8::Handle<v8::Value> ${name}Callback(const v8::Arguments&);
+END
+        }
+
+        if ($attrExt->{"EnabledAtRuntime"}) {
+            push(@enabledAtRuntime, $function);
+        }
+    }
+
+    if ($dataNode->extendedAttributes->{"CustomConstructor"} || $dataNode->extendedAttributes->{"CanBeConstructed"}) {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Value> constructorCallback(const v8::Arguments& args);
+END
+    }
+
+    foreach my $attribute (@{$dataNode->attributes}) {
+        my $name = $attribute->signature->name;
+        my $attrExt = $attribute->signature->extendedAttributes;
+        if ($attrExt->{"V8CustomGetter"} || $attrExt->{"CustomGetter"}
+            || $attrExt->{"V8Custom"} || $attrExt->{"Custom"}) {
+            push(@headerContent, <<END);
+    static v8::Handle<v8::Value> ${name}AccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info);
+END
+        }
+        if ($attrExt->{"V8CustomSetter"} || $attrExt->{"CustomSetter"}
+            || $attrExt->{"V8Custom"} || $attrExt->{"Custom"}) {
+            push(@headerContent, <<END);
+    static void ${name}AccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info);
+END
+        }
+        if ($attrExt->{"EnabledAtRuntime"}) {
+            push(@enabledAtRuntime, $attribute);
+        }
+    }
+
+    GenerateHeaderNamedAndIndexedPropertyAccessors($dataNode);
+    GenerateHeaderCustomCall($dataNode);
+    GenerateHeaderCustomInternalFieldIndices($dataNode);
+
+    if ($dataNode->extendedAttributes->{"CheckDomainSecurity"}) {
+        push(@headerContent, <<END);
+    static bool namedSecurityCheck(v8::Local<v8::Object> host, v8::Local<v8::Value> key, v8::AccessType, v8::Local<v8::Value> data);
+    static bool indexedSecurityCheck(v8::Local<v8::Object> host, uint32_t index, v8::AccessType, v8::Local<v8::Value> data);
+END
+    }
 
-  friend class V8ClassIndex;
+    push(@headerContent, <<END);
 };
 
+    v8::Handle<v8::Value> toV8(${nativeType}*${forceNewObjectParameter});
+END
+    if (IsRefPtrType($implClassName)) {
+        push(@headerContent, <<END);
+    v8::Handle<v8::Value> toV8(PassRefPtr<${nativeType} >${forceNewObjectParameter});
 END
+    }
 
     push(@headerContent, "}\n\n");
     push(@headerContent, "#endif // $className" . "_H\n");
@@ -300,6 +330,151 @@ END
     push(@headerContent, "#endif // ${conditionalString}\n\n") if $conditionalString;
 }
 
+sub GetInternalFields
+{
+    my $dataNode = shift;
+    my $name = $dataNode->name;
+    
+    my @customInternalFields = ();
+ 
+    # We can't ask whether a parent type has a given extendedAttribute, so special-case Node, AbstractWorker and WorkerContext to include all sub-types.
+    # FIXME: SVGElementInstance should probably have the EventTarget extended attribute, but doesn't.
+    if ($dataNode->extendedAttributes->{"EventTarget"} || IsNodeSubType($dataNode) || IsSubType($dataNode, "AbstractWorker") || IsSubType($dataNode, "WorkerContext")
+        || $name eq "SVGElementInstance") {
+        push(@customInternalFields, "eventListenerCacheIndex");
+    }
+
+    if (IsSubType($dataNode, "Document")) {
+        push(@customInternalFields, "implementationIndex");
+        if ($name eq "HTMLDocument") {
+            push(@customInternalFields, ("markerIndex", "shadowIndex"));
+        }
+    } elsif (IsSubType($dataNode, "StyleSheet") || $name eq "NamedNodeMap") {
+        push(@customInternalFields, "ownerNodeIndex");
+    } elsif ($name eq "MessageChannel") {
+        push(@customInternalFields, ("port1Index", "port2Index"));
+    } elsif ($name eq "DOMWindow") {
+        push(@customInternalFields, ("consoleIndex", "historyIndex", "locationbarIndex", "menubarIndex", "navigatorIndex", 
+            "personalbarIndex", "screenIndex", "scrollbarsIndex", "selectionIndex", "statusbarIndex", "toolbarIndex", "locationIndex",
+            "domSelectionIndex", "enteredIsolatedWorldIndex"));
+    }
+    return @customInternalFields;
+}
+
+sub GetHeaderClassInclude
+{
+    my $className = shift;
+    if ($className =~ /SVGPathSeg/) {
+        $className =~ s/Abs|Rel//;
+    }
+    return "" if (AvoidInclusionOfType($className));
+    return "#include \"SVGAnimatedTemplate.h\"\n" if ($codeGenerator->IsSVGAnimatedType($className));
+    return "#include \"${className}.h\"\n";
+}
+
+sub GenerateHeaderCustomInternalFieldIndices
+{
+    my $dataNode = shift;
+    my @customInternalFields = GetInternalFields($dataNode);
+    my $customFieldCounter = 0;
+    foreach my $customInternalField (@customInternalFields) {
+        push(@headerContent, <<END);
+    static const int ${customInternalField} = v8DefaultWrapperInternalFieldCount + ${customFieldCounter};
+END
+        $customFieldCounter++;
+    }
+    push(@headerContent, <<END);
+    static const int internalFieldCount = v8DefaultWrapperInternalFieldCount + ${customFieldCounter};
+END
+}
+
+my %indexerSpecialCases = (
+    "Storage" => 1,
+    "HTMLAppletElement" => 1,
+    "HTMLDocument" => 1,
+    "HTMLEmbedElement" => 1,
+    "HTMLObjectElement" => 1
+);
+
+sub GenerateHeaderNamedAndIndexedPropertyAccessors
+{
+    my $dataNode = shift;
+    my $interfaceName = $dataNode->name;
+    my $hasCustomIndexedGetter = $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"};
+    my $hasCustomIndexedSetter = $dataNode->extendedAttributes->{"HasCustomIndexSetter"} && !$dataNode->extendedAttributes->{"HasNumericIndexGetter"};
+    my $hasCustomNamedGetter = $dataNode->extendedAttributes->{"HasNameGetter"} || $dataNode->extendedAttributes->{"HasOverridingNameGetter"} || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"};
+    my $hasCustomNamedSetter = $dataNode->extendedAttributes->{"DelegatingPutFunction"};
+    my $hasCustomDeleters = $dataNode->extendedAttributes->{"CustomDeleteProperty"};
+    my $hasCustomEnumerator = $dataNode->extendedAttributes->{"CustomGetPropertyNames"};
+    if ($interfaceName eq "HTMLOptionsCollection") {
+        $interfaceName = "HTMLCollection";
+        $hasCustomIndexedGetter = 1;
+        $hasCustomNamedGetter = 1;
+    }
+    if ($interfaceName eq "DOMWindow") {
+        $hasCustomDeleterr = 0;
+        $hasEnumerator = 0;
+    }
+    if ($interfaceName eq "HTMLSelectElement" || $interfaceName eq "HTMLAppletElement" || $interfaceName eq "HTMLEmbedElement" || $interfaceName eq "HTMLObjectElement") {
+        $hasCustomNamedGetter = 1;
+    }
+    my $isIndexerSpecialCase = exists $indexerSpecialCases{$interfaceName};
+
+    if ($hasCustomIndexedGetter || $isIndexerSpecialCase) {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Value> indexedPropertyGetter(uint32_t index, const v8::AccessorInfo& info);
+END
+    }
+
+    if ($isIndexerSpecialCase || $hasCustomIndexedSetter) {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Value> indexedPropertySetter(uint32_t index, v8::Local<v8::Value> value, const v8::AccessorInfo& info);
+END
+    }
+    if ($hasCustomDeleters) {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Boolean> indexedPropertyDeleter(uint32_t index, const v8::AccessorInfo& info);
+END
+    }
+    if ($hasCustomNamedGetter) {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Value> namedPropertyGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info);
+END
+    }
+    if ($hasCustomNamedSetter) {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Value> namedPropertySetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info);
+END
+    }
+    if ($hasCustomDeleters || $interfaceName eq "HTMLDocument") {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Boolean> namedPropertyDeleter(v8::Local<v8::String> name, const v8::AccessorInfo& info);
+END
+    }
+    if ($hasCustomEnumerator) {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Array> namedPropertyEnumerator(const v8::AccessorInfo& info);
+END
+    }
+}
+
+sub GenerateHeaderCustomCall
+{
+    my $dataNode = shift;
+
+    if ($dataNode->extendedAttributes->{"CustomCall"}) {
+        push(@headerContent, "    static v8::Handle<v8::Value> callAsFunctionCallback(const v8::Arguments&);\n");
+    }
+    if ($dataNode->name eq "Event") {
+        push(@headerContent, "    static v8::Handle<v8::Value> dataTransferAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info);\n");
+        push(@headerContent, "    static void valueAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info);\n");
+    }
+    if ($dataNode->name eq "Location") {
+        push(@headerContent, "    static v8::Handle<v8::Value> assignAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info);\n");
+        push(@headerContent, "    static v8::Handle<v8::Value> reloadAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info);\n");
+        push(@headerContent, "    static v8::Handle<v8::Value> replaceAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info);\n");
+    }
+}
 
 sub GenerateSetDOMException
 {
@@ -314,66 +489,30 @@ sub GenerateSetDOMException
     return $result;
 }
 
-sub IsNodeSubType
+sub IsSubType
 {
     my $dataNode = shift;
-    return 1 if ($dataNode->name eq "Node");
+    my $parentType = shift;
+    return 1 if ($dataNode->name eq $parentType);
     foreach (@allParents) {
         my $parent = $codeGenerator->StripModule($_);
-        return 1 if $parent eq "Node";
+        return 1 if $parent eq $parentType;
     }
     return 0;
 }
 
-sub GetHiddenDependencyIndex
-{
-    my $dataNode = shift;
-    my $attribute = shift;
-    my $name = $dataNode->name;
-    return "V8Custom::kNodeEventListenerCacheIndex" if IsNodeSubType($dataNode);
-    return "V8Custom::kSVGElementInstanceEventListenerCacheIndex" if $name eq "SVGElementInstance";
-    return "V8Custom::kAbstractWorkerRequestCacheIndex" if $name eq "AbstractWorker";
-    return "V8Custom::kWorkerRequestCacheIndex" if $name eq "Worker";
-    return "V8Custom::kDedicatedWorkerContextRequestCacheIndex" if $name eq "DedicatedWorkerContext";
-    return "V8Custom::kWorkerContextRequestCacheIndex" if $name eq "WorkerContext";
-    return "V8Custom::kWorkerContextRequestCacheIndex" if $name eq "SharedWorkerContext";
-    return "V8Custom::kMessagePortRequestCacheIndex" if $name eq "MessagePort";
-    return "V8Custom::kWebSocketCacheIndex" if $name eq "WebSocket";
-    return "V8Custom::kXMLHttpRequestCacheIndex" if $name eq "XMLHttpRequest";
-    return "V8Custom::kXMLHttpRequestCacheIndex" if $name eq "XMLHttpRequestUpload";
-    return "V8Custom::kDOMApplicationCacheCacheIndex" if $name eq "DOMApplicationCache";
-    return "V8Custom::kNotificationRequestCacheIndex" if $name eq "Notification";
-    return "V8Custom::kDOMWindowEventListenerCacheIndex" if $name eq "DOMWindow";
-    die "Unexpected name " . $name . " when generating " . $attribute;
-}
-
-sub HolderToNative
+sub IsNodeSubType
 {
     my $dataNode = shift;
-    my $implClassName = shift;
-    my $classIndex = shift;
-
-    if (IsNodeSubType($dataNode)) {
-        push(@implContentDecls, <<END);
-    $implClassName* imp = V8DOMWrapper::convertDOMWrapperToNode<$implClassName>(holder);
-END
-
-    } else {
-        push(@implContentDecls, <<END);
-    $implClassName* imp = V8DOMWrapper::convertToNativeObject<$implClassName>(V8ClassIndex::$classIndex, holder);
-END
-
-  }
+    return IsSubType($dataNode, "Node");
 }
 
 sub GenerateDomainSafeFunctionGetter
 {
     my $function = shift;
-    my $dataNode = shift;
-    my $classIndex = shift;
     my $implClassName = shift;
 
-    my $className = "V8" . $dataNode->name;
+    my $className = "V8" . $implClassName;
     my $funcName = $function->signature->name;
 
     my $signature = "v8::Signature::New(" . $className . "::GetRawTemplate())";
@@ -381,36 +520,26 @@ sub GenerateDomainSafeFunctionGetter
         $signature = "v8::Local<v8::Signature>()";
     }
 
-    my $newTemplateString = GenerateNewFunctionTemplate($function, $dataNode, $signature);
-
-    $implIncludes{"V8Proxy.h"} = 1;
+    my $newTemplateString = GenerateNewFunctionTemplate($function, $implClassName, $signature);
 
     push(@implContentDecls, <<END);
-  static v8::Handle<v8::Value> ${funcName}AttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info) {
+static v8::Handle<v8::Value> ${funcName}AttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
     INC_STATS(\"DOM.$implClassName.$funcName._get\");
-    static v8::Persistent<v8::FunctionTemplate> private_template =
-        v8::Persistent<v8::FunctionTemplate>::New($newTemplateString);
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
+    static v8::Persistent<v8::FunctionTemplate> private_template = v8::Persistent<v8::FunctionTemplate>::New($newTemplateString);
+    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(${className}::GetTemplate(), info.This());
     if (holder.IsEmpty()) {
-      // can only reach here by 'object.__proto__.func', and it should passed
-      // domain security check already
-
-      return private_template->GetFunction();
+        // can only reach here by 'object.__proto__.func', and it should passed
+        // domain security check already
+        return private_template->GetFunction();
     }
-END
-
-  HolderToNative($dataNode, $implClassName, $classIndex);
-
-    push(@implContentDecls, <<END);
-    if (!V8Proxy::canAccessFrame(imp->frame(), false)) {
-      static v8::Persistent<v8::FunctionTemplate> shared_template =
-        v8::Persistent<v8::FunctionTemplate>::New($newTemplateString);
-      return shared_template->GetFunction();
-
-    } else {
-      return private_template->GetFunction();
+    ${implClassName}* imp = ${className}::toNative(holder);
+    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), false)) {
+        static v8::Persistent<v8::FunctionTemplate> shared_template = v8::Persistent<v8::FunctionTemplate>::New($newTemplateString);
+        return shared_template->GetFunction();
     }
-  }
+    return private_template->GetFunction();
+}
 
 END
 }
@@ -418,37 +547,32 @@ END
 sub GenerateConstructorGetter
 {
     my $implClassName = shift;
-    my $classIndex = shift;
 
     push(@implContentDecls, <<END);
-  static v8::Handle<v8::Value> ${implClassName}ConstructorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info) {
+static v8::Handle<v8::Value> ${implClassName}ConstructorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info) {
     INC_STATS(\"DOM.$implClassName.constructors._get\");
     v8::Handle<v8::Value> data = info.Data();
-    ASSERT(data->IsNumber());
-    V8ClassIndex::V8WrapperType type = V8ClassIndex::FromInt(data->Int32Value());
+    ASSERT(data->IsExternal() || data->IsNumber());
+    WrapperTypeInfo* type = WrapperTypeInfo::unwrap(data);
 END
 
-    if ($classIndex eq "DOMWINDOW") {
+    if ($implClassName eq "DOMWindow") {
         push(@implContentDecls, <<END);
-    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
     // Get the proxy corresponding to the DOMWindow if possible to
     // make sure that the constructor function is constructed in the
     // context of the DOMWindow and not in the context of the caller.
-    return V8DOMWrapper::getConstructor(type, window);
+    return V8DOMWrapper::getConstructor(type, V8DOMWindow::toNative(info.Holder()));
 END
-    } elsif ($classIndex eq "DEDICATEDWORKERCONTEXT" or $classIndex eq "WORKERCONTEXT" or $classIndex eq "SHAREDWORKERCONTEXT") {
-        $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
+    } elsif ($implClassName eq "DedicatedWorkerContext" or $implClassName eq "WorkerContext" or $implClassName eq "SharedWorkerContext") {
         push(@implContentDecls, <<END);
-    WorkerContext* workerContext = V8DOMWrapper::convertToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, info.Holder());
-    return V8DOMWrapper::getConstructor(type, workerContext);
+    return V8DOMWrapper::getConstructor(type, V8WorkerContext::toNative(info.Holder()));
 END
     } else {
-        push(@implContentDecls, "    return v8::Undefined();");
+        push(@implContentDecls, "    return v8::Handle<v8::Value>();");
     }
 
     push(@implContentDecls, <<END);
-
-    }
+}
 
 END
 }
@@ -457,23 +581,20 @@ sub GenerateNormalAttrGetter
 {
     my $attribute = shift;
     my $dataNode = shift;
-    my $classIndex = shift;
     my $implClassName = shift;
     my $interfaceName = shift;
 
     my $attrExt = $attribute->signature->extendedAttributes;
 
     my $attrName = $attribute->signature->name;
-    $implIncludes{"V8Proxy.h"} = 1;
 
     my $attrType = GetTypeFromSignature($attribute->signature);
     my $attrIsPodType = IsPodType($attrType);
 
-    my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
+    my $nativeType = GetNativeTypeFromSignature($attribute->signature, -1);
     my $isPodType = IsPodType($implClassName);
     my $skipContext = 0;
 
-
     if ($isPodType) {
         $implClassName = GetNativeType($implClassName);
         $implIncludes{"V8SVGPODTypeWrapper.h"} = 1;
@@ -496,17 +617,18 @@ sub GenerateNormalAttrGetter
         $attrIsPodType = 0;
     }
 
-    my $getterStringUsesImp = $implClassName ne "double";
+    my $getterStringUsesImp = $implClassName ne "float";
 
   # Getter
     push(@implContentDecls, <<END);
-  static v8::Handle<v8::Value> ${attrName}AttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info) {
+static v8::Handle<v8::Value> ${attrName}AttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
     INC_STATS(\"DOM.$implClassName.$attrName._get\");
 END
 
     if ($isPodType) {
         push(@implContentDecls, <<END);
-    V8SVGPODTypeWrapper<$implClassName>* imp_wrapper = V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());
+    V8SVGPODTypeWrapper<$implClassName>* imp_wrapper = V8SVGPODTypeWrapper<$implClassName>::toNative(info.Holder());
     $implClassName imp_instance = *imp_wrapper;
 END
         if ($getterStringUsesImp) {
@@ -516,30 +638,42 @@ END
         }
 
     } elsif ($attrExt->{"v8OnProto"} || $attrExt->{"V8DisallowShadowing"}) {
-      if ($classIndex eq "DOMWINDOW") {
-        push(@implContentDecls, <<END);
+        if ($interfaceName eq "DOMWindow") {
+            push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = info.Holder();
 END
-      } else {
-        # perform lookup first
+        } else {
+            # perform lookup first
+            push(@implContentDecls, <<END);
+    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8${interfaceName}::GetTemplate(), info.This());
+    if (holder.IsEmpty()) return v8::Handle<v8::Value>();
+END
+        }
         push(@implContentDecls, <<END);
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
-    if (holder.IsEmpty()) return v8::Undefined();
+    ${implClassName}* imp = V8${implClassName}::toNative(holder);
 END
-      }
-        HolderToNative($dataNode, $implClassName, $classIndex);
     } else {
+        my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
+        if ($getterStringUsesImp && $reflect && IsNodeSubType($dataNode) && $codeGenerator->IsStringType($attrType)) {
+            # Generate super-compact call for regular attribute getter:
+            my $contentAttributeName = $reflect eq "1" ? $attrName : $reflect;
+            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+            $implIncludes{"${namespace}.h"} = 1;
+            push(@implContentDecls, "    return getElementStringAttr(info, ${namespace}::${contentAttributeName}Attr);\n");
+            push(@implContentDecls, "}\n\n");
+            return;
+            # Skip the rest of the function!
+        }
         push(@implContentDecls, <<END);
-    v8::Handle<v8::Object> holder = info.Holder();
+    ${implClassName}* imp = V8${implClassName}::toNative(info.Holder());
 END
-        HolderToNative($dataNode, $implClassName, $classIndex);
     }
 
     # Generate security checks if necessary
     if ($attribute->signature->extendedAttributes->{"CheckNodeSecurity"}) {
-        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->$attrName())) return v8::Undefined();\n\n");
+        push(@implContentDecls, "    if (!V8BindingSecurity::checkNodeSecurity(V8BindingState::Only(), imp->$attrName())) return v8::Handle<v8::Value>();\n\n");
     } elsif ($attribute->signature->extendedAttributes->{"CheckFrameSecurity"}) {
-        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->contentDocument())) return v8::Undefined();\n\n");
+        push(@implContentDecls, "    if (!V8BindingSecurity::checkNodeSecurity(V8BindingState::Only(), imp->contentDocument())) return v8::Handle<v8::Value>();\n\n");
     }
 
     my $useExceptions = 1 if @{$attribute->getterExceptions} and !($isPodType);
@@ -553,7 +687,12 @@ END
     }
 
     my $getterFunc = $codeGenerator->WK_lcfirst($attrName);
-    $getterFunc .= "Animated" if $codeGenerator->IsSVGAnimatedType($attribute->signature->type);
+
+    if ($codeGenerator->IsSVGAnimatedType($attribute->signature->type)) {
+        # Some SVGFE*Element.idl use 'operator' as attribute name; rewrite as '_operator' to avoid clashes with C/C++
+        $getterFunc = "_" . $getterFunc if ($attrName =~ /operator/);
+        $getterFunc .= "Animated";
+    }
 
     my $returnType = GetTypeFromSignature($attribute->signature);
 
@@ -579,10 +718,6 @@ END
         $getterString = "imp_instance";
     }
 
-    if ($nativeType eq "String") {
-        $getterString = "toString($getterString)";
-    }
-
     my $result;
     my $wrapper;
 
@@ -619,7 +754,7 @@ END
     } else {
         if ($attribute->signature->type eq "EventListener" && $dataNode->name eq "DOMWindow") {
             push(@implContentDecls, "    if (!imp->document())\n");
-            push(@implContentDecls, "      return v8::Undefined();\n");
+            push(@implContentDecls, "        return v8::Handle<v8::Value>();\n");
         }
 
         if ($useExceptions) {
@@ -635,60 +770,37 @@ END
     }
 
     if (IsSVGTypeNeedingContextParameter($attrType) && !$skipContext) {
-        my $resultObject = $result;
         if ($attrIsPodType) {
-            $resultObject = "wrapper";
+            push(@implContentDecls, GenerateSVGContextAssignment($implClassName, "wrapper.get()", "    "));
+        } else {
+            push(@implContentDecls, GenerateSVGContextRetrieval($implClassName, "    "));
+            # The templating associated with passing withSVGContext()'s return value directly into toV8 can get compilers confused,
+            # so just manually set the return value to a PassRefPtr of the expected type.
+            push(@implContentDecls, "    PassRefPtr<$attrType> resultAsPassRefPtr = V8Proxy::withSVGContext($result, context);\n");
+            $result = "resultAsPassRefPtr";
         }
-        $resultObject = "WTF::getPtr(" . $resultObject . ")";
-        push(@implContentDecls, GenerateSVGContextAssignment($implClassName, $resultObject, "    "));
     }
 
     if ($attrIsPodType) {
-        my $classIndex = uc($attrType);
-        push(@implContentDecls, "    return V8DOMWrapper::convertToV8Object(V8ClassIndex::$classIndex, wrapper.release());\n");
+        $implIncludes{"V8${attrType}.h"} = 1;
+        push(@implContentDecls, "    return toV8(wrapper.release().get());\n");
     } else {
         push(@implContentDecls, "    " . ReturnNativeToJSValue($attribute->signature, $result, "    ").";\n");
     }
 
-    push(@implContentDecls, "  }\n\n");  # end of getter
-}
-
-
-sub GenerateReplaceableAttrSetter
-{
-    my $implClassName = shift;
-
-    $implIncludes{"V8Proxy.h"} = 1;
-
-    push(@implContentDecls,
-       "  static void ${attrName}AttrSetter(v8::Local<v8::String> name," .
-       " v8::Local<v8::Value> value, const v8::AccessorInfo& info) {\n");
-
-    push(@implContentDecls, "    INC_STATS(\"DOM.$implClassName.$attrName._set\");\n");
-
-    push(@implContentDecls, "    v8::Local<v8::String> ${attrName}_string = v8::String::New(\"${attrName}\");\n");
-    push(@implContentDecls, "    info.Holder()->Delete(${attrName}_string);\n");
-    push(@implContentDecls, "    info.This()->Set(${attrName}_string, value);\n");
-    push(@implContentDecls, "  }\n\n");
+    push(@implContentDecls, "}\n\n");  # end of getter
 }
 
-
 sub GenerateNormalAttrSetter
 {
     my $attribute = shift;
     my $dataNode = shift;
-    my $classIndex = shift;
     my $implClassName = shift;
     my $interfaceName = shift;
 
     my $attrExt = $attribute->signature->extendedAttributes;
 
-    $implIncludes{"V8Proxy.h"} = 1;
-
-    push(@implContentDecls,
-       "  static void ${attrName}AttrSetter(v8::Local<v8::String> name," .
-       " v8::Local<v8::Value> value, const v8::AccessorInfo& info) {\n");
-
+    push(@implContentDecls, "static void ${attrName}AttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)\n{\n");
     push(@implContentDecls, "    INC_STATS(\"DOM.$implClassName.$attrName._set\");\n");
 
     my $isPodType = IsPodType($implClassName);
@@ -696,37 +808,51 @@ sub GenerateNormalAttrSetter
     if ($isPodType) {
         $implClassName = GetNativeType($implClassName);
         $implIncludes{"V8SVGPODTypeWrapper.h"} = 1;
-        push(@implContentDecls, "    V8SVGPODTypeWrapper<$implClassName>* wrapper = V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());\n");
+        push(@implContentDecls, "    V8SVGPODTypeWrapper<$implClassName>* wrapper = V8SVGPODTypeWrapper<$implClassName>::toNative(info.Holder());\n");
         push(@implContentDecls, "    $implClassName imp_instance = *wrapper;\n");
         push(@implContentDecls, "    $implClassName* imp = &imp_instance;\n");
 
     } elsif ($attrExt->{"v8OnProto"}) {
-      if ($classIndex eq "DOMWINDOW") {
+      if ($interfaceName eq "DOMWindow") {
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = info.Holder();
 END
       } else {
         # perform lookup first
         push(@implContentDecls, <<END);
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
+    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8${interfaceName}::GetTemplate(), info.This());
     if (holder.IsEmpty()) return;
 END
       }
-        HolderToNative($dataNode, $implClassName, $classIndex);
+    push(@implContentDecls, <<END);
+    ${implClassName}* imp = V8${implClassName}::toNative(holder);
+END
     } else {
+        my $attrType = GetTypeFromSignature($attribute->signature);
+        my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
+        my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
+        if (($reflect || $reflectURL) && IsNodeSubType($dataNode) && $codeGenerator->IsStringType($attrType)) {
+            # Generate super-compact call for regular attribute setter:
+            my $contentAttributeName = ($reflect || $reflectURL) eq "1" ? $attrName : ($reflect || $reflectURL);
+            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+            $implIncludes{"${namespace}.h"} = 1;
+            push(@implContentDecls, "    setElementStringAttr(info, ${namespace}::${contentAttributeName}Attr, value);\n");
+            push(@implContentDecls, "}\n\n");
+            return;
+            # Skip the rest of the function!
+        }
+
         push(@implContentDecls, <<END);
-    v8::Handle<v8::Object> holder = info.Holder();
+    ${implClassName}* imp = V8${implClassName}::toNative(info.Holder());
 END
-        HolderToNative($dataNode, $implClassName, $classIndex);
     }
 
     my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
     if ($attribute->signature->type eq "EventListener") {
         if ($dataNode->name eq "DOMWindow") {
             push(@implContentDecls, "    if (!imp->document())\n");
-            push(@implContentDecls, "      return;\n");
+            push(@implContentDecls, "        return;\n");
         }
-        push(@implContentDecls, "    $nativeType v = V8DOMWrapper::getEventListener(imp, value, true, ListenerFindOrCreate);\n");
     } else {
         push(@implContentDecls, "    $nativeType v = " . JSValueToNative($attribute->signature, "value") . ";\n");
     }
@@ -751,7 +877,7 @@ END
         push(@implContentDecls, "    ExceptionCode ec = 0;\n");
     }
 
-    if ($implClassName eq "double") {
+    if ($implClassName eq "float") {
         push(@implContentDecls, "    *imp = $result;\n");
     } else {
         my $implSetterFunctionName = $codeGenerator->WK_ucfirst($attrName);
@@ -764,20 +890,10 @@ END
             push(@implContentDecls, "    imp->setAttribute(${namespace}::${contentAttributeName}Attr, $result");
         } elsif ($attribute->signature->type eq "EventListener") {
             $implIncludes{"V8AbstractEventListener.h"} = 1;
-            $implIncludes{"V8CustomBinding.h"} = 1;
-            $cacheIndex = GetHiddenDependencyIndex($dataNode, $attrName);
-            push(@implContentDecls, "    $nativeType old = imp->$attrName();\n");
-            push(@implContentDecls, "    V8AbstractEventListener* oldListener = old ? V8AbstractEventListener::cast(old.get()) : 0;\n");
-            push(@implContentDecls, "    if (oldListener) {\n");
-            push(@implContentDecls, "      v8::Local<v8::Object> oldListenerObject = oldListener->getExistingListenerObject();\n");
-            push(@implContentDecls, "      if (!oldListenerObject.IsEmpty())\n");
-            push(@implContentDecls, "        removeHiddenDependency(holder, oldListenerObject, $cacheIndex);\n");
-            push(@implContentDecls, "    }\n");
-            push(@implContentDecls, "    imp->set$implSetterFunctionName($result);\n");
-            push(@implContentDecls, "    if ($result)\n");
-            push(@implContentDecls, "      createHiddenDependency(holder, value, $cacheIndex");
+            push(@implContentDecls, "    transferHiddenDependency(info.Holder(), imp->$attrName(), value, V8${interfaceName}::eventListenerCacheIndex);\n");
+            push(@implContentDecls, "    imp->set$implSetterFunctionName(V8DOMWrapper::getEventListener(value, true, ListenerFindOrCreate)");
         } else {
-            push(@implContentDecls, "    imp->set$implSetterFunctionName(" . $result);
+            push(@implContentDecls, "    imp->set$implSetterFunctionName($result");
         }
         push(@implContentDecls, ", ec") if $useExceptions;
         push(@implContentDecls, ");\n");
@@ -804,16 +920,14 @@ END
     }
 
     push(@implContentDecls, "    return;\n");
-    push(@implContentDecls, "  }\n\n");  # end of setter
+    push(@implContentDecls, "}\n\n");  # end of setter
 }
 
-sub GenerateNewFunctionTemplate
+sub GetFunctionTemplateCallbackName
 {
     $function = shift;
-    $dataNode = shift;
-    $signature = shift;
+    $interfaceName = shift;
 
-    my $interfaceName = $dataNode->name;
     my $name = $function->signature->name;
 
     if ($function->signature->extendedAttributes->{"Custom"} ||
@@ -822,48 +936,85 @@ sub GenerateNewFunctionTemplate
             $function->signature->extendedAttributes->{"V8Custom"}) {
             die "Custom and V8Custom should be mutually exclusive!"
         }
-        my $customFunc = $function->signature->extendedAttributes->{"Custom"} ||
-                         $function->signature->extendedAttributes->{"V8Custom"};
-        if ($customFunc eq 1) {
-            $customFunc = $interfaceName . $codeGenerator->WK_ucfirst($name);
-        }
-        return "v8::FunctionTemplate::New(V8Custom::v8${customFunc}Callback, v8::Handle<v8::Value>(), $signature)";
+        return "V8${interfaceName}::${name}Callback";
     } else {
-        return "v8::FunctionTemplate::New(${interfaceName}Internal::${name}Callback, v8::Handle<v8::Value>(), $signature)";
+        return "${interfaceName}Internal::${name}Callback";
+    }
+}
+
+sub GenerateNewFunctionTemplate
+{
+    $function = shift;
+    $interfaceName = shift;
+    $signature = shift;
+
+    my $callback = GetFunctionTemplateCallbackName($function, $interfaceName);
+    return "v8::FunctionTemplate::New($callback, v8::Handle<v8::Value>(), $signature)";
+}
+
+sub GenerateEventListenerCallback
+{
+    my $implClassName = shift;
+    my $functionName = shift;
+    my $lookupType = ($functionName eq "add") ? "OrCreate" : "Only";
+    my $passRefPtrHandling = ($functionName eq "add") ? "" : ".get()";
+    my $hiddenDependencyAction = ($functionName eq "add") ? "create" : "remove";
+ 
+    push(@implContentDecls, <<END);
+static v8::Handle<v8::Value> ${functionName}EventListenerCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.${implClassName}.${functionName}EventListener()");
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(args[1], false, ListenerFind${lookupType});
+    if (listener) {
+        V8${implClassName}::toNative(args.Holder())->${functionName}EventListener(v8ValueToAtomicWebCoreString(args[0]), listener${passRefPtrHandling}, args[2]->BooleanValue());
+        ${hiddenDependencyAction}HiddenDependency(args.Holder(), args[1], V8${implClassName}::eventListenerCacheIndex);
     }
+    return v8::Undefined();
+}
+
+END
 }
 
 sub GenerateFunctionCallback
 {
     my $function = shift;
     my $dataNode = shift;
-    my $classIndex = shift;
     my $implClassName = shift;
 
     my $interfaceName = $dataNode->name;
     my $name = $function->signature->name;
 
-    push(@implContentDecls,
-"  static v8::Handle<v8::Value> ${name}Callback(const v8::Arguments& args) {\n" .
-"    INC_STATS(\"DOM.$implClassName.$name\");\n");
+    # Adding and removing event listeners are not standard callback behavior,
+    # but they are extremely consistent across the various classes that take event listeners,
+    # so we can generate them as a "special case".
+    if ($name eq "addEventListener") {
+        GenerateEventListenerCallback($implClassName, "add");
+        return;
+    } elsif ($name eq "removeEventListener") {
+        GenerateEventListenerCallback($implClassName, "remove");
+        return;
+    }
+
+    push(@implContentDecls, <<END);
+static v8::Handle<v8::Value> ${name}Callback(const v8::Arguments& args) {
+    INC_STATS(\"DOM.$implClassName.$name\");
+END
 
     my $numParameters = @{$function->parameters};
 
     if ($function->signature->extendedAttributes->{"RequiresAllArguments"}) {
-        push(@implContentDecls,
-            "    if (args.Length() < $numParameters) return v8::Undefined();\n");
+        push(@implContentDecls, "    if (args.Length() < $numParameters) return v8::Handle<v8::Value>();\n");
     }
 
     if (IsPodType($implClassName)) {
         my $nativeClassName = GetNativeType($implClassName);
-        push(@implContentDecls, "    V8SVGPODTypeWrapper<$nativeClassName>* imp_wrapper = V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<$nativeClassName> >(V8ClassIndex::$classIndex, args.Holder());\n");
+        push(@implContentDecls, "    V8SVGPODTypeWrapper<$nativeClassName>* imp_wrapper = V8SVGPODTypeWrapper<$nativeClassName>::toNative(args.Holder());\n");
         push(@implContentDecls, "    $nativeClassName imp_instance = *imp_wrapper;\n");
         push(@implContentDecls, "    $nativeClassName* imp = &imp_instance;\n");
     } else {
         push(@implContentDecls, <<END);
-    v8::Handle<v8::Object> holder = args.Holder();
+    ${implClassName}* imp = V8${implClassName}::toNative(args.Holder());
 END
-        HolderToNative($dataNode, $implClassName, $classIndex);
     }
 
   # Check domain security if needed
@@ -871,26 +1022,43 @@ END
        || $interfaceName eq "DOMWindow")
        && !$function->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
     # We have not find real use cases yet.
-    push(@implContentDecls,
-"    if (!V8Proxy::canAccessFrame(imp->frame(), true)) {\n".
-"      return v8::Undefined();\n" .
-"    }\n");
+    push(@implContentDecls, <<END);
+    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), true))
+        return v8::Handle<v8::Value>();
+END
     }
 
+    my $raisesExceptions = @{$function->raisesExceptions};
+    if (!$raisesExceptions) {
+        foreach my $parameter (@{$function->parameters}) {
+            if (TypeCanFailConversion($parameter) or $parameter->extendedAttributes->{"IsIndex"}) {
+                $raisesExceptions = 1;
+            }
+        }
+    }
 
-    if (@{$function->raisesExceptions}) {
+    if ($raisesExceptions) {
         $implIncludes{"ExceptionCode.h"} = 1;
         push(@implContentDecls, "    ExceptionCode ec = 0;\n");
+        push(@implContentDecls, "    {\n");
+        # The brace here is needed to prevent the ensuing 'goto fail's from jumping past constructors
+        # of objects (like Strings) declared later, causing compile errors. The block scope ends
+        # right before the label 'fail:'.
     }
 
     if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
-        push(@implContentDecls, "    ScriptCallStack callStack(args, $numParameters);\n");
+        push(@implContentDecls, <<END);
+    OwnPtr<ScriptCallStack> callStack(ScriptCallStack::create(args, $numParameters));
+    if (!callStack)
+        return v8::Undefined();
+END
         $implIncludes{"ScriptCallStack.h"} = 1;
     }
     if ($function->signature->extendedAttributes->{"SVGCheckSecurityDocument"}) {
-        push(@implContentDecls,
-"    if (!V8Proxy::checkNodeSecurity(imp->getSVGDocument(ec)))\n" .
-"      return v8::Undefined();\n");
+        push(@implContentDecls, <<END);
+    if (!V8BindingSecurity::checkNodeSecurity(V8BindingState::Only(), imp->getSVGDocument(ec)))
+        return v8::Handle<v8::Value>();
+END
     }
 
     my $paramIndex = 0;
@@ -911,7 +1079,7 @@ END
             push(@implContentDecls, "    bool ${parameterName}Ok;\n");
         }
 
-        push(@implContentDecls, "    " . GetNativeTypeFromSignature($parameter, 1) . " $parameterName = ");
+        push(@implContentDecls, "    " . GetNativeTypeFromSignature($parameter, $paramIndex) . " $parameterName = ");
         push(@implContentDecls, JSValueToNative($parameter, "args[$paramIndex]",
            BasicTypeCanFailConversion($parameter) ?  "${parameterName}Ok" : undef) . ";\n");
 
@@ -919,8 +1087,8 @@ END
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
 "    if (UNLIKELY(!$parameterName" . (BasicTypeCanFailConversion($parameter) ? "Ok" : "") . ")) {\n" .
-"      V8Proxy::setDOMException(TYPE_MISMATCH_ERR);\n" .
-"      return v8::Handle<v8::Value>();\n" .
+"        ec = TYPE_MISMATCH_ERR;\n" .
+"        goto fail;\n" .
 "    }\n");
         }
 
@@ -928,8 +1096,8 @@ END
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
 "    if (UNLIKELY($parameterName < 0)) {\n" .
-"      V8Proxy::setDOMException(INDEX_SIZE_ERR);\n" .
-"      return v8::Handle<v8::Value>();\n" .
+"        ec = INDEX_SIZE_ERR;\n" .
+"        goto fail;\n" .
 "    }\n");
         }
 
@@ -939,7 +1107,15 @@ END
     # Build the function call string.
     my $callString = GenerateFunctionCallString($function, $paramIndex, "    ", $implClassName);
     push(@implContentDecls, "$callString");
-    push(@implContentDecls, "  }\n\n");
+
+    if ($raisesExceptions) {
+        push(@implContentDecls, "    }\n");
+        push(@implContentDecls, "    fail:\n");
+        push(@implContentDecls, "    V8Proxy::setDOMException(ec);\n");
+        push(@implContentDecls, "    return v8::Handle<v8::Value>();\n");
+    }
+
+    push(@implContentDecls, "}\n\n");
 }
 
 sub GenerateBatchedAttributeData
@@ -991,7 +1167,7 @@ sub GenerateSingleBatchedAttribute
         "";
     if ($customAccessor eq 1) {
         # use the naming convension, interface + (capitalize) attr name
-        $customAccessor = $interfaceName . $codeGenerator->WK_ucfirst($attrName);
+        $customAccessor = $interfaceName . "::" . $attrName;
     }
 
     my $getter;
@@ -1008,17 +1184,17 @@ sub GenerateSingleBatchedAttribute
     }
 
     my $on_proto = "0 /* on instance */";
-    my $data = "V8ClassIndex::INVALID_CLASS_INDEX /* no data */";
+    my $data = "0 /* no data */";
 
     # Constructor
     if ($attribute->signature->type =~ /Constructor$/) {
         my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
         $constructorType =~ s/Constructor$//;
-        my $constructorIndex = uc($constructorType);
+        $implIncludes{"V8${constructorType}.h"} = 1;
         if ($customAccessor) {
-            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
+            $getter = "V8${customAccessor}AccessorGetter";
         } else {
-            $data = "V8ClassIndex::${constructorIndex}";
+            $data = "&V8${constructorType}::info";
             $getter = "${interfaceName}Internal::${interfaceName}ConstructorGetter";
         }
         $setter = "0";
@@ -1032,12 +1208,12 @@ sub GenerateSingleBatchedAttribute
         # Custom Setter
         if ($attrExt->{"CustomSetter"} || $attrExt->{"V8CustomSetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
             $hasCustomSetter = 1;
-            $setter = "V8Custom::v8${customAccessor}AccessorSetter";
+            $setter = "V8${customAccessor}AccessorSetter";
         }
 
         # Custom Getter
-        if ($attrExt->{"CustomGetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
-            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
+        if ($attrExt->{"CustomGetter"} || $attrExt->{"V8CustomGetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+            $getter = "V8${customAccessor}AccessorGetter";
         }
     }
 
@@ -1078,14 +1254,184 @@ sub GenerateSingleBatchedAttribute
 END
 }
 
+sub GenerateImplementationIndexer
+{
+    my $dataNode = shift;
+    my $indexer = shift;
+    my $interfaceName = $dataNode->name;
+
+    # FIXME: Figure out what HasNumericIndexGetter is really supposed to do. Right now, it's only set on WebGL-related files.
+    my $hasCustomSetter = $dataNode->extendedAttributes->{"HasCustomIndexSetter"} && !$dataNode->extendedAttributes->{"HasNumericIndexGetter"};
+    my $hasGetter = $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"};
+
+    # FIXME: Find a way to not have to special-case HTMLOptionsCollection.
+    if ($interfaceName eq "HTMLOptionsCollection") {
+        $hasGetter = 1;
+    }
+    # FIXME: If the parent interface of $dataNode already has
+    # HasIndexGetter, we don't need to handle the getter here.
+    if ($interfaceName eq "WebKitCSSTransformValue") {
+        $hasGetter = 0;
+    }
+
+    # FIXME: Investigate and remove this nastinesss. In V8, named property handling and indexer handling are apparently decoupled,
+    # which means that object[X] where X is a number doesn't reach named property indexer. So we need to provide
+    # simplistic, mirrored indexer handling in addition to named property handling.
+    my $isSpecialCase = exists $indexerSpecialCases{$interfaceName};
+    if ($isSpecialCase) {
+        $hasGetter = 1;
+        if ($dataNode->extendedAttributes->{"DelegatingPutFunction"}) {
+            $hasCustomSetter = 1;
+        }
+    }
+
+    if (!$hasGetter) {
+        return;
+    }
+
+    $implIncludes{"V8Collection.h"} = 1;
+
+    my $indexerType = $indexer ? $indexer->type : 0;
+
+    # FIXME: Remove this once toV8 helper methods are implemented (see https://bugs.webkit.org/show_bug.cgi?id=32563).
+    if ($interfaceName eq "WebKitCSSKeyframesRule") {
+        $indexerType = "WebKitCSSKeyframeRule";
+    }
+
+    if ($indexerType && !$hasCustomSetter) {
+        if ($indexerType eq "DOMString") {
+            my $conversion = $indexer->extendedAttributes->{"ConvertNullStringTo"};
+            if ($conversion && $conversion eq "Null") {
+                push(@implContent, <<END);
+    setCollectionStringOrNullIndexedGetter<${interfaceName}>(desc);
+END
+            } else {
+                push(@implContent, <<END);
+    setCollectionStringIndexedGetter<${interfaceName}>(desc);
+END
+            }
+        } else {
+            push(@implContent, <<END);
+    setCollectionIndexedGetter<${interfaceName}, ${indexerType}>(desc);
+END
+            # Include the header for this indexer type, because setCollectionIndexedGetter() requires toV8() for this type.
+            $implIncludes{"V8${indexerType}.h"} = 1;
+        }
+
+        return;
+    }
+
+    my $hasDeleter = $dataNode->extendedAttributes->{"CustomDeleteProperty"};
+    my $hasEnumerator = !$isSpecialCase && IsNodeSubType($dataNode);
+    my $setOn = "Instance";
+
+    # V8 has access-check callback API (see ObjectTemplate::SetAccessCheckCallbacks) and it's used on DOMWindow
+    # instead of deleters or enumerators. In addition, the getter should be set on prototype template, to
+    # get implementation straight out of the DOMWindow prototype regardless of what prototype is actually set
+    # on the object.
+    if ($interfaceName eq "DOMWindow") {
+        $setOn = "Prototype";
+        $hasDeleter = 0;
+    }
+
+    push(@implContent, "    desc->${setOn}Template()->SetIndexedPropertyHandler(V8${interfaceName}::indexedPropertyGetter");
+    push(@implContent, $hasCustomSetter ? ", V8${interfaceName}::indexedPropertySetter" : ", 0");
+    push(@implContent, ", 0"); # IndexedPropertyQuery -- not being used at the moment.
+    push(@implContent, $hasDeleter ? ", V8${interfaceName}::indexedPropertyDeleter" : ", 0");
+    push(@implContent, ", nodeCollectionIndexedPropertyEnumerator<${interfaceName}>") if $hasEnumerator;
+    push(@implContent, ");\n");
+}
+
+sub GenerateImplementationNamedPropertyGetter
+{
+    my $dataNode = shift;
+    my $namedPropertyGetter = shift;
+    my $interfaceName = $dataNode->name;
+    my $hasCustomGetter = $dataNode->extendedAttributes->{"HasOverridingNameGetter"} || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"};
+
+    # FIXME: Remove hard-coded HTMLOptionsCollection reference by changing HTMLOptionsCollection to not inherit
+    # from HTMLCollection per W3C spec (http://www.w3.org/TR/2003/REC-DOM-Level-2-HTML-20030109/html.html#HTMLOptionsCollection).
+    if ($interfaceName eq "HTMLOptionsCollection") {
+        $interfaceName = "HTMLCollection";
+        $hasCustomGetter = 1;
+    }
+
+    if ($interfaceName eq "HTMLAppletElement" || $interfaceName eq "HTMLEmbedElement" || $interfaceName eq "HTMLObjectElement") {
+        $hasCustomGetter = 1;
+    }
+
+    my $hasGetter = $dataNode->extendedAttributes->{"HasNameGetter"} || $hasCustomGetter || $namedPropertyGetter;
+    if (!$hasGetter) {
+        return;
+    }
+
+    if ($namedPropertyGetter && $namedPropertyGetter->type ne "Node" && !$namedPropertyGetter->extendedAttributes->{"Custom"} && !$hasCustomGetter) {
+        $implIncludes{"V8Collection.h"} = 1;
+        my $type = $namedPropertyGetter->type;
+        push(@implContent, <<END);
+    setCollectionNamedGetter<${interfaceName}, ${type}>(desc);
+END
+        return;
+    }
+
+    my $hasSetter = $dataNode->extendedAttributes->{"DelegatingPutFunction"};
+    # FIXME: Try to remove hard-coded HTMLDocument reference by aligning handling of document.all with JSC bindings.
+    my $hasDeleter = $dataNode->extendedAttributes->{"CustomDeleteProperty"} || $interfaceName eq "HTMLDocument";
+    my $hasEnumerator = $dataNode->extendedAttributes->{"CustomGetPropertyNames"};
+    my $setOn = "Instance";
+
+    # V8 has access-check callback API (see ObjectTemplate::SetAccessCheckCallbacks) and it's used on DOMWindow
+    # instead of deleters or enumerators. In addition, the getter should be set on prototype template, to
+    # get implementation straight out of the DOMWindow prototype regardless of what prototype is actually set
+    # on the object.
+    if ($interfaceName eq "DOMWindow") {
+        $setOn = "Prototype";
+        $hasDeleter = 0;
+        $hasEnumerator = 0;
+    }
+
+    push(@implContent, "    desc->${setOn}Template()->SetNamedPropertyHandler(V8${interfaceName}::namedPropertyGetter, ");
+    push(@implContent, $hasSetter ? "V8${interfaceName}::namedPropertySetter, " : "0, ");
+    push(@implContent, "0, "); # NamedPropertyQuery -- not being used at the moment.
+    push(@implContent, $hasDeleter ? "V8${interfaceName}::namedPropertyDeleter, " : "0, ");
+    push(@implContent, $hasEnumerator ? "V8${interfaceName}::namedPropertyEnumerator" : "0");
+    push(@implContent, ");\n");
+}
+
+sub GenerateImplementationCustomCall
+{
+    my $dataNode = shift;
+    my $interfaceName = $dataNode->name;
+    my $hasCustomCall = $dataNode->extendedAttributes->{"CustomCall"};
+
+    # FIXME: Remove hard-coded HTMLOptionsCollection reference.
+    if ($interfaceName eq "HTMLOptionsCollection") {
+        $interfaceName = "HTMLCollection";
+        $hasCustomCall = 1;
+    }
+
+    if ($hasCustomCall) {
+        push(@implContent, "    desc->InstanceTemplate()->SetCallAsFunctionHandler(V8${interfaceName}::callAsFunctionCallback);\n");
+    }
+}
+
+sub GenerateImplementationMasqueradesAsUndefined
+{
+    my $dataNode = shift;
+    if ($dataNode->extendedAttributes->{"MasqueradesAsUndefined"})
+    {
+        push(@implContent, "    desc->InstanceTemplate()->MarkAsUndetectable();\n");
+    }
+}
+
 sub GenerateImplementation
 {
     my $object = shift;
     my $dataNode = shift;
     my $interfaceName = $dataNode->name;
+    my $visibleInterfaceName = GetVisibleInterfaceName($interfaceName);
     my $className = "V8$interfaceName";
     my $implClassName = $interfaceName;
-    my $classIndex = uc($codeGenerator->StripModule($interfaceName));
 
     my $hasLegacyParent = $dataNode->extendedAttributes->{"LegacyParent"};
     my $conditionalString = GenerateConditionalString($dataNode);
@@ -1095,8 +1441,12 @@ sub GenerateImplementation
 
     push(@implFixedHeader,
          "#include \"config.h\"\n" .
+         "#include \"RuntimeEnabledFeatures.h\"\n" .
          "#include \"V8Proxy.h\"\n" .
-         "#include \"V8Binding.h\"\n\n" .
+         "#include \"V8Binding.h\"\n" .
+         "#include \"V8BindingState.h\"\n" .
+         "#include \"V8DOMWrapper.h\"\n" .
+         "#include \"V8IsolatedContext.h\"\n\n" .
          "#undef LOG\n\n");
 
     push(@implFixedHeader, "\n#if ${conditionalString}\n\n") if $conditionalString;
@@ -1108,14 +1458,15 @@ sub GenerateImplementation
     $implIncludes{"${className}.h"} = 1;
 
     AddIncludesForType($interfaceName);
-    $implIncludes{"V8Proxy.h"} = 1;
 
-    push(@implContentDecls, "namespace WebCore {\n");
+    my $toActive = IsActiveDomType($interfaceName) ? "${className}::toActiveDOMObject" : "0";
+
+    push(@implContentDecls, "namespace WebCore {\n\n");
+    push(@implContentDecls, "WrapperTypeInfo ${className}::info = { ${className}::GetTemplate, ${className}::derefObject, ${toActive} };\n\n");   
     push(@implContentDecls, "namespace ${interfaceName}Internal {\n\n");
     push(@implContentDecls, "template <typename T> void V8_USE(T) { }\n\n");
 
     my $hasConstructors = 0;
-
     # Generate property accessors for attributes.
     for ($index = 0; $index < @{$dataNode->attributes}; $index++) {
         $attribute = @{$dataNode->attributes}[$index];
@@ -1124,9 +1475,8 @@ sub GenerateImplementation
 
         # Generate special code for the constructor attributes.
         if ($attrType =~ /Constructor$/) {
-            if ($attribute->signature->extendedAttributes->{"CustomGetter"}) {
-                $implIncludes{"V8CustomBinding.h"} = 1;
-            } else {
+            if (!($attribute->signature->extendedAttributes->{"CustomGetter"} ||
+                $attribute->signature->extendedAttributes->{"V8CustomGetter"})) {
                 $hasConstructors = 1;
             }
             next;
@@ -1141,46 +1491,48 @@ sub GenerateImplementation
         # implementation.
         if ($attribute->signature->extendedAttributes->{"Custom"} ||
             $attribute->signature->extendedAttributes->{"V8Custom"}) {
-            $implIncludes{"V8CustomBinding.h"} = 1;
             next;
         }
 
         # Generate the accessor.
-        if ($attribute->signature->extendedAttributes->{"CustomGetter"}) {
-            $implIncludes{"V8CustomBinding.h"} = 1;
-        } else {
-            GenerateNormalAttrGetter($attribute, $dataNode, $classIndex, $implClassName, $interfaceName);
+        if (!($attribute->signature->extendedAttributes->{"CustomGetter"} ||
+            $attribute->signature->extendedAttributes->{"V8CustomGetter"})) {
+            GenerateNormalAttrGetter($attribute, $dataNode, $implClassName, $interfaceName);
         }
-        if ($attribute->signature->extendedAttributes->{"CustomSetter"} ||
-            $attribute->signature->extendedAttributes->{"V8CustomSetter"}) {
-            $implIncludes{"V8CustomBinding.h"} = 1;
-        } elsif ($attribute->signature->extendedAttributes->{"Replaceable"}) {
-            $dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"} || die "Replaceable attribute can only be used in interface that defines ExtendsDOMGlobalObject attribute!";
-            # GenerateReplaceableAttrSetter($implClassName);
-        } elsif ($attribute->type !~ /^readonly/ && !$attribute->signature->extendedAttributes->{"V8ReadOnly"}) {
-            GenerateNormalAttrSetter($attribute, $dataNode, $classIndex, $implClassName, $interfaceName);
+        if (!$attribute->signature->extendedAttributes->{"CustomSetter"} &&
+            !$attribute->signature->extendedAttributes->{"V8CustomSetter"} &&
+            !$attribute->signature->extendedAttributes->{"Replaceable"} &&
+            $attribute->type !~ /^readonly/ &&
+            !$attribute->signature->extendedAttributes->{"V8ReadOnly"}) {
+            GenerateNormalAttrSetter($attribute, $dataNode, $implClassName, $interfaceName);
         }
     }
 
     if ($hasConstructors) {
-        GenerateConstructorGetter($implClassName, $classIndex);
+        GenerateConstructorGetter($implClassName);
     }
 
+    my $indexer;
+    my $namedPropertyGetter;
     # Generate methods for functions.
     foreach my $function (@{$dataNode->functions}) {
-        # hack for addEventListener/RemoveEventListener
-        # FIXME: avoid naming conflict
-        if ($function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"V8Custom"}) {
-                $implIncludes{"V8CustomBinding.h"} = 1;
-        } else {
-            GenerateFunctionCallback($function, $dataNode, $classIndex, $implClassName);
+        if (!($function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"V8Custom"})) {
+            GenerateFunctionCallback($function, $dataNode, $implClassName);
+        }
+
+        if ($function->signature->name eq "item") {
+            $indexer = $function->signature;
+        }
+
+        if ($function->signature->name eq "namedItem") {
+            $namedPropertyGetter = $function->signature;
         }
 
         # If the function does not need domain security check, we need to
         # generate an access getter that returns different function objects
         # for different calling context.
         if (($dataNode->extendedAttributes->{"CheckDomainSecurity"} || ($interfaceName eq "DOMWindow")) && $function->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
-            GenerateDomainSafeFunctionGetter($function, $dataNode, $classIndex, $implClassName);
+            GenerateDomainSafeFunctionGetter($function, $implClassName);
         }
     }
 
@@ -1194,6 +1546,7 @@ sub GenerateImplementation
     my @enabledAtRuntime;
     my @normal;
     foreach my $attribute (@$attributes) {
+
         if ($interfaceName eq "DOMWindow" && $attribute->signature->extendedAttributes->{"V8DisallowShadowing"}) {
             push(@disallowsShadowing, $attribute);
         } elsif ($attribute->signature->extendedAttributes->{"EnabledAtRuntime"}) {
@@ -1218,6 +1571,38 @@ sub GenerateImplementation
         push(@implContent, "};\n");
     }
 
+    # Setup table of standard callback functions
+    $num_callbacks = 0;
+    $has_callbacks = 0;
+    foreach my $function (@{$dataNode->functions}) {
+        my $attrExt = $function->signature->extendedAttributes;
+        # Don't put any nonstandard functions into this table:
+        if ($attrExt->{"V8OnInstance"}) {
+            next;
+        }
+        if ($attrExt->{"EnabledAtRuntime"} || RequiresCustomSignature($function) || $attrExt->{"V8DoNotCheckSignature"}) {
+            next;
+        }
+        if ($attrExt->{"DoNotCheckDomainSecurity"} &&
+            ($dataNode->extendedAttributes->{"CheckDomainSecurity"} || $interfaceName eq "DOMWindow")) {
+            next;
+        }
+        if ($attrExt->{"DontEnum"} || $attrExt->{"V8ReadOnly"}) {
+            next;
+        }
+        if (!$has_callbacks) {
+            $has_callbacks = 1;
+            push(@implContent, "static const BatchedCallback ${interfaceName}_callbacks[] = {\n");
+        }
+        my $name = $function->signature->name;
+        my $callback = GetFunctionTemplateCallbackName($function, $interfaceName);
+        push(@implContent, <<END);
+  {"$name", $callback},
+END
+        $num_callbacks++;
+    }
+    push(@implContent, "};\n")  if $has_callbacks;
+
     # Setup constants
     my $has_constants = 0;
     if (@{$dataNode->constants}) {
@@ -1240,60 +1625,100 @@ END
 
     push(@implContentDecls, "} // namespace ${interfaceName}Internal\n\n");
 
-    my $access_check = "/* no access check */";
+    # In namespace WebCore, add generated implementation for 'CanBeConstructed'.
+    if ($dataNode->extendedAttributes->{"CanBeConstructed"} && !$dataNode->extendedAttributes->{"CustomConstructor"}) {
+        push(@implContent, <<END);
+v8::Handle<v8::Value> ${className}::constructorCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.${interfaceName}.Contructor");
+    return V8Proxy::constructDOMObject<$interfaceName>(args, &info);
+}
+END
+   }
+
+    my $access_check = "";
     if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} && !($interfaceName eq "DOMWindow")) {
-        $access_check = "instance->SetAccessCheckCallbacks(V8Custom::v8${interfaceName}NamedSecurityCheck, V8Custom::v8${interfaceName}IndexedSecurityCheck, v8::Integer::New(V8ClassIndex::ToInt(V8ClassIndex::${classIndex})));";
+        $access_check = "instance->SetAccessCheckCallbacks(V8${interfaceName}::namedSecurityCheck, V8${interfaceName}::indexedSecurityCheck, v8::External::Wrap(&V8${interfaceName}::info));";
     }
 
     # For the DOMWindow interface, generate the shadow object template
     # configuration method.
     if ($implClassName eq "DOMWindow") {
         push(@implContent, <<END);
-static v8::Persistent<v8::ObjectTemplate> ConfigureShadowObjectTemplate(v8::Persistent<v8::ObjectTemplate> templ) {
-  batchConfigureAttributes(templ,
-                           v8::Handle<v8::ObjectTemplate>(),
-                           shadow_attrs,
-                           sizeof(shadow_attrs)/sizeof(*shadow_attrs));
-  return templ;
+static v8::Persistent<v8::ObjectTemplate> ConfigureShadowObjectTemplate(v8::Persistent<v8::ObjectTemplate> templ)
+{
+    batchConfigureAttributes(templ, v8::Handle<v8::ObjectTemplate>(), shadow_attrs, sizeof(shadow_attrs)/sizeof(*shadow_attrs));
+
+    // Install a security handler with V8.
+    templ->SetAccessCheckCallbacks(V8DOMWindow::namedSecurityCheck, V8DOMWindow::indexedSecurityCheck, v8::External::Wrap(&V8DOMWindow::info));
+    templ->SetInternalFieldCount(V8DOMWindow::internalFieldCount);
+    return templ;
 }
 END
     }
 
+    # find the super descriptor
+    my $parentClassTemplate = "";
+    foreach (@{$dataNode->parents}) {
+        my $parent = $codeGenerator->StripModule($_);
+        if ($parent eq "EventTarget") { next; }
+        $implIncludes{"V8${parent}.h"} = 1;
+        $parentClassTemplate = "V8" . $parent . "::GetTemplate()";
+        last;
+    }
+    if (!$parentClassTemplate) {
+        $parentClassTemplate = "v8::Persistent<v8::FunctionTemplate>()";
+    }
+
     # Generate the template configuration method
     push(@implContent,  <<END);
-static v8::Persistent<v8::FunctionTemplate> Configure${className}Template(v8::Persistent<v8::FunctionTemplate> desc) {
-  v8::Local<v8::ObjectTemplate> instance = desc->InstanceTemplate();
+static v8::Persistent<v8::FunctionTemplate> Configure${className}Template(v8::Persistent<v8::FunctionTemplate> desc)
+{
+    v8::Local<v8::Signature> default_signature = configureTemplate(desc, \"${visibleInterfaceName}\", $parentClassTemplate, V8${interfaceName}::internalFieldCount,
 END
-    if (IsNodeSubType($dataNode)) {
+    # Set up our attributes if we have them
+    if ($has_attributes) {
         push(@implContent, <<END);
-  instance->SetInternalFieldCount(V8Custom::kNodeMinimumInternalFieldCount);
+        ${interfaceName}_attrs, sizeof(${interfaceName}_attrs)/sizeof(*${interfaceName}_attrs),
 END
     } else {
         push(@implContent, <<END);
-  instance->SetInternalFieldCount(V8Custom::kDefaultWrapperInternalFieldCount);
+        NULL, 0,
 END
     }
 
-    push(@implContent,  <<END);
-  v8::Local<v8::Signature> default_signature = v8::Signature::New(desc);
-  v8::Local<v8::ObjectTemplate> proto = desc->PrototypeTemplate();
-  $access_check
+    if ($has_callbacks) {
+        push(@implContent, <<END);
+        ${interfaceName}_callbacks, sizeof(${interfaceName}_callbacks)/sizeof(*${interfaceName}_callbacks));
 END
+    } else {
+        push(@implContent, <<END);
+        NULL, 0);
+END
+    }
 
-
-    # Set up our attributes if we have them
-    if ($has_attributes) {
+    if ($dataNode->extendedAttributes->{"CustomConstructor"} || $dataNode->extendedAttributes->{"CanBeConstructed"}) {
         push(@implContent, <<END);
-  batchConfigureAttributes(instance, proto, ${interfaceName}_attrs, sizeof(${interfaceName}_attrs)/sizeof(*${interfaceName}_attrs));
+        desc->SetCallHandler(V8${interfaceName}::constructorCallback);
 END
     }
 
+    if ($access_check or @enabledAtRuntime or @{$dataNode->functions} or $has_constants) {
+        push(@implContent,  <<END);
+    v8::Local<v8::ObjectTemplate> instance = desc->InstanceTemplate();
+    v8::Local<v8::ObjectTemplate> proto = desc->PrototypeTemplate();
+END
+    }
+
+    push(@implContent,  "    $access_check\n");
+
     # Setup the enable-at-runtime attrs if we have them
     foreach my $runtime_attr (@enabledAtRuntime) {
-        $enable_function = $interfaceName . $codeGenerator->WK_ucfirst($runtime_attr->signature->name);
+        # A function named RuntimeEnabledFeatures::{methodName}Enabled() need to be written by hand.
+        $enable_function = "RuntimeEnabledFeatures::" . $codeGenerator->WK_lcfirst($runtime_attr->signature->name) . "Enabled";
         my $conditionalString = GenerateConditionalString($runtime_attr->signature);
         push(@implContent, "\n#if ${conditionalString}\n") if $conditionalString;
-        push(@implContent, "    if (V8Custom::v8${enable_function}Enabled()) {\n");
+        push(@implContent, "    if (${enable_function}()) {\n");
         push(@implContent, "        static const BatchedAttribute attrData =\\\n");
         GenerateSingleBatchedAttribute($interfaceName, $runtime_attr, ";", "    ");
         push(@implContent, <<END);
@@ -1303,8 +1728,15 @@ END
         push(@implContent, "\n#endif // ${conditionalString}\n") if $conditionalString;
     }
 
+    GenerateImplementationIndexer($dataNode, $indexer);
+    GenerateImplementationNamedPropertyGetter($dataNode, $namedPropertyGetter);
+    GenerateImplementationCustomCall($dataNode);
+    GenerateImplementationMasqueradesAsUndefined($dataNode);
+
     # Define our functions with Set() or SetAccessor()
+    $total_functions = 0;
     foreach my $function (@{$dataNode->functions}) {
+        $total_functions++;
         my $attrExt = $function->signature->extendedAttributes;
         my $name = $function->signature->name;
 
@@ -1326,8 +1758,8 @@ END
         my $conditional = "";
         if ($attrExt->{"EnabledAtRuntime"}) {
             # Only call Set()/SetAccessor() if this method should be enabled
-            $enable_function = $interfaceName . $codeGenerator->WK_ucfirst($function->signature->name);
-            $conditional = "if (V8Custom::v8${enable_function}Enabled())\n";
+            $enable_function = "RuntimeEnabledFeatures::" . $codeGenerator->WK_lcfirst($function->signature->name) . "Enabled";
+            $conditional = "if (${enable_function}())\n        ";
         }
 
         if ($attrExt->{"DoNotCheckDomainSecurity"} &&
@@ -1349,108 +1781,333 @@ END
             $property_attributes .= "|v8::ReadOnly";
             push(@implContent, <<END);
 
-  // $commentInfo
-  $conditional $template->SetAccessor(
-      v8::String::New("$name"),
-      ${interfaceName}Internal::${name}AttrGetter,
-      0,
-      v8::Handle<v8::Value>(),
-      v8::ALL_CAN_READ,
-      static_cast<v8::PropertyAttribute>($property_attributes));
+    // $commentInfo
+    ${conditional}$template->SetAccessor(v8::String::New("$name"), ${interfaceName}Internal::${name}AttrGetter, 0, v8::Handle<v8::Value>(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>($property_attributes));
 END
+          $num_callbacks++;
           next;
       }
 
       my $signature = "default_signature";
-      if ($attrExt->{"V8DoNotCheckSignature"}){
+      if ($attrExt->{"V8DoNotCheckSignature"}) {
           $signature = "v8::Local<v8::Signature>()";
       }
 
       if (RequiresCustomSignature($function)) {
           $signature = "${name}_signature";
-          push(@implContent, "\n  // Custom Signature '$name'\n", CreateCustomSignature($function));
+          push(@implContent, "\n    // Custom Signature '$name'\n", CreateCustomSignature($function));
       }
 
       # Normal function call is a template
-      my $templateFunction = GenerateNewFunctionTemplate($function, $dataNode, $signature);
+      my $callback = GetFunctionTemplateCallbackName($function, $interfaceName);
 
+      if ($property_attributes eq "v8::DontDelete") {
+          $property_attributes = "";
+      } else {
+          $property_attributes = ", static_cast<v8::PropertyAttribute>($property_attributes)";
+      }
 
-      push(@implContent, <<END);
+      if ($template eq "proto" && $conditional eq "" && $signature eq "default_signature" && $property_attributes eq "") {
+          # Standard type of callback, already created in the batch, so skip it here.
+          next;
+      }
 
-  // $commentInfo
-  $conditional ${template}->Set(
-      v8::String::New("$name"),
-      $templateFunction,
-      static_cast<v8::PropertyAttribute>($property_attributes));
+      push(@implContent, <<END);
+    ${conditional}$template->Set(v8::String::New("$name"), v8::FunctionTemplate::New($callback, v8::Handle<v8::Value>(), ${signature})$property_attributes);
 END
+      $num_callbacks++;
     }
 
-    # set the super descriptor
-    foreach (@{$dataNode->parents}) {
-        my $parent = $codeGenerator->StripModule($_);
-        if ($parent eq "EventTarget") { next; }
-        $implIncludes{"V8${parent}.h"} = 1;
-        my $parentClassIndex = uc($codeGenerator->StripModule($parent));
-        push(@implContent, "  desc->Inherit(V8DOMWrapper::getTemplate(V8ClassIndex::${parentClassIndex}));\n");
-        last;
+    die "Wrong number of callbacks generated for $interfaceName ($num_callbacks, should be $total_functions)" if $num_callbacks != $total_functions;
+
+    if ($has_constants) {
+        push(@implContent, <<END);
+    batchConfigureConstants(desc, proto, ${interfaceName}_consts, sizeof(${interfaceName}_consts)/sizeof(*${interfaceName}_consts));
+END
     }
 
-    # Set the class name.  This is used when printing objects.
-    push(@implContent, "  desc->SetClassName(v8::String::New(\"${interfaceName}\"));\n");
+    # Special cases
+    if ($interfaceName eq "DOMWindow") {
+        push(@implContent, <<END);
 
-    if ($has_constants) {
+    proto->SetInternalFieldCount(V8DOMWindow::internalFieldCount);
+    desc->SetHiddenPrototype(true);
+    instance->SetInternalFieldCount(V8DOMWindow::internalFieldCount);
+    // Set access check callbacks, but turned off initially.
+    // When a context is detached from a frame, turn on the access check.
+    // Turning on checks also invalidates inline caches of the object.
+    instance->SetAccessCheckCallbacks(V8DOMWindow::namedSecurityCheck, V8DOMWindow::indexedSecurityCheck, v8::External::Wrap(&V8DOMWindow::info), false);
+END
+    }
+    if ($interfaceName eq "Location") {
         push(@implContent, <<END);
-  batchConfigureConstants(desc, proto, ${interfaceName}_consts, sizeof(${interfaceName}_consts)/sizeof(*${interfaceName}_consts));
+
+    // For security reasons, these functions are on the instance instead
+    // of on the prototype object to ensure that they cannot be overwritten.
+    instance->SetAccessor(v8::String::New("reload"), V8Location::reloadAccessorGetter, 0, v8::Handle<v8::Value>(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly));
+    instance->SetAccessor(v8::String::New("replace"), V8Location::replaceAccessorGetter, 0, v8::Handle<v8::Value>(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly));
+    instance->SetAccessor(v8::String::New("assign"), V8Location::assignAccessorGetter, 0, v8::Handle<v8::Value>(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly));
 END
     }
 
+    my $nativeType = GetNativeTypeForConversions($interfaceName);
+    if ($dataNode->extendedAttributes->{"PODType"}) {
+        $nativeType = "V8SVGPODTypeWrapper<${nativeType}>";
+    }
     push(@implContent, <<END);
-  return desc;
+
+    // Custom toString template
+    desc->Set(getToStringName(), getToStringTemplate());
+    return desc;
+}
+
+v8::Persistent<v8::FunctionTemplate> ${className}::GetRawTemplate()
+{
+    static v8::Persistent<v8::FunctionTemplate> ${className}_raw_cache_ = createRawTemplate();
+    return ${className}_raw_cache_;
 }
 
-v8::Persistent<v8::FunctionTemplate> ${className}::GetRawTemplate() {
-  static v8::Persistent<v8::FunctionTemplate> ${className}_raw_cache_;
-  if (${className}_raw_cache_.IsEmpty()) {
-    v8::HandleScope scope;
-    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(V8Proxy::checkNewLegal);
-    ${className}_raw_cache_ = v8::Persistent<v8::FunctionTemplate>::New(result);
-  }
-  return ${className}_raw_cache_;
+v8::Persistent<v8::FunctionTemplate> ${className}::GetTemplate()\
+{
+    static v8::Persistent<v8::FunctionTemplate> ${className}_cache_ = Configure${className}Template(GetRawTemplate());
+    return ${className}_cache_;
 }
 
-v8::Persistent<v8::FunctionTemplate> ${className}::GetTemplate() {
-  static v8::Persistent<v8::FunctionTemplate> ${className}_cache_;
-  if (${className}_cache_.IsEmpty())
-    ${className}_cache_ = Configure${className}Template(GetRawTemplate());
-  return ${className}_cache_;
+${nativeType}* ${className}::toNative(v8::Handle<v8::Object> object)
+{
+    return reinterpret_cast<${nativeType}*>(object->GetPointerFromInternalField(v8DOMWrapperObjectIndex));
 }
 
-bool ${className}::HasInstance(v8::Handle<v8::Value> value) {
-  return GetRawTemplate()->HasInstance(value);
+bool ${className}::HasInstance(v8::Handle<v8::Value> value)
+{
+    return GetRawTemplate()->HasInstance(value);
 }
 
 END
 
+    if (IsActiveDomType($interfaceName)) {
+        # MessagePort is handled like an active dom object even though it doesn't inherit
+        # from ActiveDOMObject, so don't try to cast it to ActiveDOMObject.
+        my $returnValue = $interfaceName eq "MessagePort" ? "0" : "toNative(object)";
+        push(@implContent, <<END);
+ActiveDOMObject* ${className}::toActiveDOMObject(v8::Handle<v8::Object> object)
+{
+    return ${returnValue};
+}      
+END
+    }
+
     if ($implClassName eq "DOMWindow") {
         push(@implContent, <<END);
-v8::Persistent<v8::ObjectTemplate> V8DOMWindow::GetShadowObjectTemplate() {
-  static v8::Persistent<v8::ObjectTemplate> V8DOMWindowShadowObject_cache_;
-  if (V8DOMWindowShadowObject_cache_.IsEmpty()) {
-    V8DOMWindowShadowObject_cache_ = v8::Persistent<v8::ObjectTemplate>::New(v8::ObjectTemplate::New());
-    ConfigureShadowObjectTemplate(V8DOMWindowShadowObject_cache_);
-  }
-  return V8DOMWindowShadowObject_cache_;
+v8::Persistent<v8::ObjectTemplate> V8DOMWindow::GetShadowObjectTemplate()
+{
+    static v8::Persistent<v8::ObjectTemplate> V8DOMWindowShadowObject_cache_;
+    if (V8DOMWindowShadowObject_cache_.IsEmpty()) {
+        V8DOMWindowShadowObject_cache_ = v8::Persistent<v8::ObjectTemplate>::New(v8::ObjectTemplate::New());
+        ConfigureShadowObjectTemplate(V8DOMWindowShadowObject_cache_);
+    }
+    return V8DOMWindowShadowObject_cache_;
 }
 END
     }
 
+    GenerateToV8Converters($dataNode, $interfaceName, $className, $nativeType);
+
+    push(@implContent, <<END);
+
+void ${className}::derefObject(void* object)
+{
+END
+
+    if (IsRefPtrType($interfaceName)) {
+        push(@implContent, <<END);
+    static_cast<${nativeType}*>(object)->deref();
+END
+    }
+
     push(@implContent, <<END);
+}
+
 } // namespace WebCore
 END
 
     push(@implContent, "\n#endif // ${conditionalString}\n") if $conditionalString;
 }
 
+sub GenerateToV8Converters
+{
+    my $dataNode = shift;
+    my $interfaceName = shift;
+    my $className = shift;
+    my $nativeType = shift;
+
+    my $domMapFunction = GetDomMapFunction($dataNode, $interfaceName);
+    my $forceNewObjectInput = IsDOMNodeType($interfaceName) ? ", bool forceNewObject" : "";
+    my $forceNewObjectCall = IsDOMNodeType($interfaceName) ? ", forceNewObject" : "";
+
+    push(@implContent, <<END);
+
+v8::Handle<v8::Object> ${className}::wrap(${nativeType}* impl${forceNewObjectInput})
+{
+    v8::Handle<v8::Object> wrapper;
+    V8Proxy* proxy = 0;
+END
+
+    if (IsNodeSubType($dataNode)) {
+        push(@implContent, <<END);
+    if (impl->document()) {
+        proxy = V8Proxy::retrieve(impl->document()->frame());
+        if (proxy && static_cast<Node*>(impl->document()) == static_cast<Node*>(impl))
+            proxy->windowShell()->initContextIfNeeded();
+    }
+
+END
+    }
+
+    if ($domMapFunction) {
+        push(@implContent, "  if (!forceNewObject) {\n") if IsDOMNodeType($interfaceName);
+        if (IsNodeSubType($dataNode)) {
+            push(@implContent, "    wrapper = V8DOMWrapper::getWrapper(impl);\n");
+        } else {
+            push(@implContent, "    wrapper = ${domMapFunction}.get(impl);\n");
+        }
+        push(@implContent, <<END);
+    if (!wrapper.IsEmpty())
+        return wrapper;
+END
+        push(@implContent, "    }\n") if IsDOMNodeType($interfaceName);
+    }
+    if (IsNodeSubType($dataNode)) {
+        push(@implContent, <<END);
+
+    v8::Handle<v8::Context> context;
+    if (proxy)
+        context = proxy->context();
+
+    // Enter the node's context and create the wrapper in that context.
+    if (!context.IsEmpty())
+        context->Enter();
+END
+    }
+
+    push(@implContent, <<END);
+    wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
+END
+
+    if (IsNodeSubType($dataNode)) {
+        push(@implContent, <<END);
+    // Exit the node's context if it was entered.
+    if (!context.IsEmpty())
+        context->Exit();
+END
+    }
+
+    push(@implContent, <<END);
+    if (wrapper.IsEmpty())
+        return wrapper;
+END
+    push(@implContent, "\n    impl->ref();\n") if IsRefPtrType($interfaceName);
+
+    if ($domMapFunction) {
+        push(@implContent, <<END);
+    ${domMapFunction}.set(impl, v8::Persistent<v8::Object>::New(wrapper));
+END
+    }
+
+    push(@implContent, <<END);
+    return wrapper;
+}
+END
+
+    if (IsRefPtrType($interfaceName)) {
+        push(@implContent, <<END);
+
+v8::Handle<v8::Value> toV8(PassRefPtr<${nativeType} > impl${forceNewObjectInput})
+{
+    return toV8(impl.get()${forceNewObjectCall});
+}
+END
+    }
+
+    if (!HasCustomToV8Implementation($dataNode, $interfaceName)) {
+        push(@implContent, <<END);
+
+v8::Handle<v8::Value> toV8(${nativeType}* impl${forceNewObjectInput})
+{
+    if (!impl)
+        return v8::Null();
+    return ${className}::wrap(impl${forceNewObjectCall});
+}
+END
+    }
+}
+
+sub HasCustomToV8Implementation {
+    # FIXME: This subroutine is lame. Probably should be an .idl attribute (CustomToV8)?
+    $dataNode = shift;
+    $interfaceName = shift;
+
+    # We generate a custom converter (but JSC doesn't) for the following:
+    return 1 if $interfaceName eq "BarInfo";
+    return 1 if $interfaceName eq "CSSStyleSheet";
+    return 1 if $interfaceName eq "CanvasPixelArray";
+    return 1 if $interfaceName eq "DOMSelection";
+    return 1 if $interfaceName eq "DOMWindow";
+    return 1 if $interfaceName eq "Element";
+    return 1 if $interfaceName eq "Location";
+    return 1 if $interfaceName eq "HTMLDocument";
+    return 1 if $interfaceName eq "HTMLElement";
+    return 1 if $interfaceName eq "History";
+    return 1 if $interfaceName eq "NamedNodeMap";
+    return 1 if $interfaceName eq "Navigator";
+    return 1 if $interfaceName eq "SVGDocument";
+    return 1 if $interfaceName eq "SVGElement";
+    return 1 if $interfaceName eq "Screen";
+    return 1 if $interfaceName eq "WorkerContext";
+    # We don't generate a custom converter (but JSC does) for the following:
+    return 0 if $interfaceName eq "AbstractWorker";
+    return 0 if $interfaceName eq "CanvasRenderingContext";
+    return 0 if $interfaceName eq "ImageData";
+    return 0 if $interfaceName eq "SVGElementInstance";
+
+    # For everything else, do what JSC does.
+    return $dataNode->extendedAttributes->{"CustomToJS"};
+}
+
+sub GetDomMapFunction
+{
+    my $dataNode = shift;
+    my $type = shift;
+    return "getDOMSVGElementInstanceMap()" if $type eq "SVGElementInstance";
+    return "getDOMNodeMap()" if IsNodeSubType($dataNode);
+    # Only use getDOMSVGObjectWithContextMap() for non-node svg objects
+    return "getDOMSVGObjectWithContextMap()" if $type =~ /SVG/;
+    return "" if $type eq "DOMImplementation";
+    return "getActiveDOMObjectMap()" if IsActiveDomType($type);
+    return "getDOMObjectMap()";
+}
+
+sub IsActiveDomType
+{
+    # FIXME: Consider making this an .idl attribute.
+    my $type = shift;
+    return 1 if $type eq "MessagePort";
+    return 1 if $type eq "XMLHttpRequest";
+    return 1 if $type eq "WebSocket";
+    return 1 if $type eq "Worker";
+    return 1 if $type eq "SharedWorker";
+    return 0;
+}
+
+sub GetNativeTypeForConversions
+{
+    my $type = shift;
+    return "FloatRect" if $type eq "SVGRect";
+    return "FloatPoint" if $type eq "SVGPoint";
+    return "AffineTransform" if $type eq "SVGMatrix";
+    return "float" if $type eq "SVGNumber";
+    return $type;
+}
 
 sub GenerateFunctionCallString()
 {
@@ -1497,7 +2154,6 @@ sub GenerateFunctionCallString()
 
     my $first = 1;
     my $index = 0;
-    my $nodeToReturn = 0;
 
     foreach my $parameter (@{$function->parameters}) {
         if ($index eq $numberOfParameters) {
@@ -1519,16 +2175,20 @@ sub GenerateFunctionCallString()
         } else {
             $functionString .= $paramName;
         }
-
-        if ($parameter->extendedAttributes->{"Return"}) {
-            $nodeToReturn = $parameter->name;
-        }
         $index++;
     }
 
     if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
         $functionString .= ", " if not $first;
-        $functionString .= "&callStack";
+        $functionString .= "callStack.get()";
+        if ($first) { $first = 0; }
+    }
+
+    if ($function->signature->extendedAttributes->{"NeedsUserGestureCheck"}) {
+        $functionString .= ", " if not $first;
+        # FIXME: We need to pass DOMWrapperWorld as a parameter.
+        # See http://trac.webkit.org/changeset/54182
+        $functionString .= "processingUserGesture()";
         if ($first) { $first = 0; }
     }
 
@@ -1541,24 +2201,10 @@ sub GenerateFunctionCallString()
     my $return = "result";
     my $returnIsRef = IsRefPtrType($returnType);
 
-    if ($nodeToReturn) {
-        # Special case for insertBefore, replaceChild, removeChild and
-        # appendChild functions from Node.
-        $result .= $indent . "bool success = $functionString;\n";
-        if (@{$function->raisesExceptions}) {
-            $result .= GenerateSetDOMException($indent);
-        }
-        $result .= $indent . "if (success)\n";
-        $result .= $indent . "    " .
-            "return V8DOMWrapper::convertNodeToV8Object($nodeToReturn);\n";
-        $result .= $indent . "return v8::Null();\n";
-        return $result;
-    } elsif ($returnType eq "void") {
+    if ($returnType eq "void") {
         $result .= $indent . "$functionString;\n";
     } elsif ($copyFirst) {
-        $result .=
-            $indent . GetNativeType($returnType, 0) . " result = *imp;\n" .
-            $indent . "$functionString;\n";
+        $result .= $indent . GetNativeType($returnType, 0) . " result = *imp;\n" . $indent . "$functionString;\n";
     } elsif ($returnsListItemPodType) {
         $result .= $indent . "RefPtr<SVGPODListItem<$nativeReturnType> > result = $functionString;\n";
     } elsif (@{$function->raisesExceptions} or $returnsPodType or $isPodType or IsSVGTypeNeedingContextParameter($returnType)) {
@@ -1570,7 +2216,7 @@ sub GenerateFunctionCallString()
     }
 
     if (@{$function->raisesExceptions}) {
-        $result .= GenerateSetDOMException($indent);
+        $result .= $indent . "if (UNLIKELY(ec)) goto fail;\n";
     }
 
     # If the return type is a POD type, separate out the wrapper generation
@@ -1612,8 +2258,8 @@ sub GenerateFunctionCallString()
     }
 
     if ($returnsPodType) {
-        my $classIndex = uc($returnType);
-        $result .= $indent . "return V8DOMWrapper::convertToV8Object(V8ClassIndex::$classIndex, wrapper.release());\n";
+        $implIncludes{"V8${returnType}.h"} = 1;
+        $result .= $indent . "return toV8(wrapper.release());\n";
     } else {
         $return .= ".release()" if ($returnIsRef);
         $result .= $indent . ReturnNativeToJSValue($function->signature, $return, $indent) . ";\n";
@@ -1627,19 +2273,14 @@ sub GetTypeFromSignature
 {
     my $signature = shift;
 
-    my $type = $codeGenerator->StripModule($signature->type);
-    if (($type eq "DOMString") && $signature->extendedAttributes->{"HintAtomic"}) {
-        $type = "AtomicString";
-    }
-
-    return $type;
+    return $codeGenerator->StripModule($signature->type);
 }
 
 
 sub GetNativeTypeFromSignature
 {
     my $signature = shift;
-    my $isParameter = shift;
+    my $parameterIndex = shift;
 
     my $type = GetTypeFromSignature($signature);
 
@@ -1648,117 +2289,39 @@ sub GetNativeTypeFromSignature
         return "int";
     }
 
-    return GetNativeType($type, $isParameter);
-}
-
-sub IsRefPtrType
-{
-    my $type = shift;
-    return 1 if $type eq "Attr";
-    return 1 if $type eq "CanvasActiveInfo";
-    return 1 if $type eq "CanvasArray";
-    return 1 if $type eq "CanvasArrayBuffer";
-    return 1 if $type eq "CanvasBooleanArray";
-    return 1 if $type eq "CanvasByteArray";
-    return 1 if $type eq "CanvasBuffer";
-    return 1 if $type eq "CanvasFloatArray";
-    return 1 if $type eq "CanvasFramebuffer";
-    return 1 if $type eq "CanvasGradient";
-    return 1 if $type eq "CanvasIntArray";
-    return 1 if $type eq "CanvasObject";
-    return 1 if $type eq "CanvasProgram";
-    return 1 if $type eq "CanvasRenderbuffer";
-    return 1 if $type eq "CanvasShader";
-    return 1 if $type eq "CanvasShortArray";
-    return 1 if $type eq "CanvasTexture";
-    return 1 if $type eq "CanvasUnsignedByteArray";
-    return 1 if $type eq "CanvasUnsignedIntArray";
-    return 1 if $type eq "CanvasUnsignedShortArray";
-    return 1 if $type eq "ClientRect";
-    return 1 if $type eq "ClientRectList";
-    return 1 if $type eq "CDATASection";
-    return 1 if $type eq "Comment";
-    return 1 if $type eq "CSSRule";
-    return 1 if $type eq "CSSStyleRule";
-    return 1 if $type eq "CSSCharsetRule";
-    return 1 if $type eq "CSSImportRule";
-    return 1 if $type eq "CSSMediaRule";
-    return 1 if $type eq "CSSFontFaceRule";
-    return 1 if $type eq "CSSPageRule";
-    return 1 if $type eq "CSSPrimitiveValue";
-    return 1 if $type eq "CSSStyleSheet";
-    return 1 if $type eq "CSSStyleDeclaration";
-    return 1 if $type eq "CSSValue";
-    return 1 if $type eq "CSSRuleList";
-    return 1 if $type eq "Database";
-    return 1 if $type eq "Document";
-    return 1 if $type eq "DocumentFragment";
-    return 1 if $type eq "DocumentType";
-    return 1 if $type eq "Element";
-    return 1 if $type eq "EntityReference";
-    return 1 if $type eq "Event";
-    return 1 if $type eq "EventListener";
-    return 1 if $type eq "FileList";
-    return 1 if $type eq "HTMLCollection";
-    return 1 if $type eq "HTMLAllCollection";
-    return 1 if $type eq "HTMLDocument";
-    return 1 if $type eq "HTMLElement";
-    return 1 if $type eq "HTMLOptionsCollection";
-    return 1 if $type eq "ImageData";
-    return 1 if $type eq "Media";
-    return 1 if $type eq "MediaError";
-    return 1 if $type eq "MimeType";
-    return 1 if $type eq "Node";
-    return 1 if $type eq "NodeList";
-    return 1 if $type eq "NodeFilter";
-    return 1 if $type eq "NodeIterator";
-    return 1 if $type eq "NSResolver";
-    return 1 if $type eq "Plugin";
-    return 1 if $type eq "ProcessingInstruction";
-    return 1 if $type eq "Range";
-    return 1 if $type eq "RGBColor";
-    return 1 if $type eq "Text";
-    return 1 if $type eq "TextMetrics";
-    return 1 if $type eq "TimeRanges";
-    return 1 if $type eq "TreeWalker";
-    return 1 if $type eq "WebKitCSSMatrix";
-    return 1 if $type eq "WebKitPoint";
-    return 1 if $type eq "XPathExpression";
-    return 1 if $type eq "XPathNSResolver";
-    return 1 if $type eq "XPathResult";
-
-    return 1 if $type eq "SVGAngle";
-    return 1 if $type eq "SVGElementInstance";
-    return 1 if $type eq "SVGElementInstanceList";
-    return 1 if $type =~ /^SVGPathSeg/;
-
-    return 1 if $type =~ /^SVGAnimated/;
+    $type = GetNativeType($type, $parameterIndex >= 0 ? 1 : 0);
 
-    return 0;
-}
-
-sub IsVideoClassName
-{
-    my $class = shift;
-    return 1 if $class eq "V8HTMLAudioElement";
-    return 1 if $class eq "V8HTMLMediaElement";
-    return 1 if $class eq "V8HTMLSourceElement";
-    return 1 if $class eq "V8HTMLVideoElement";
-    return 1 if $class eq "V8MediaError";
-    return 1 if $class eq "V8TimeRanges";
+    if ($parameterIndex >= 0 && $type eq "V8Parameter") {
+        my $mode = "";
+        if ($signature->extendedAttributes->{"ConvertUndefinedOrNullToNullString"}) {
+            $mode = "WithUndefinedOrNullCheck";
+        } elsif ($signature->extendedAttributes->{"ConvertNullToNullString"}) {
+            $mode = "WithNullCheck";
+        }
+        $type .= "<$mode>";
+    }
 
-    return 0;
+    return $type;
 }
 
-sub IsWorkerClassName
+sub IsRefPtrType
 {
-    my $class = shift;
-    return 1 if $class eq "V8Worker";
-    return 1 if $class eq "V8WorkerContext";
-    return 1 if $class eq "V8WorkerLocation";
-    return 1 if $class eq "V8WorkerNavigator";
+    my $type = shift;
 
-    return 0;
+    return 0 if $type eq "boolean";
+    return 0 if $type eq "float";
+    return 0 if $type eq "int";
+    return 0 if $type eq "Date";
+    return 0 if $type eq "DOMString";
+    return 0 if $type eq "double";
+    return 0 if $type eq "short";
+    return 0 if $type eq "long";
+    return 0 if $type eq "unsigned";
+    return 0 if $type eq "unsigned long";
+    return 0 if $type eq "unsigned short";
+    return 0 if $type eq "SVGAnimatedPoints";
+
+    return 1;
 }
 
 sub GetNativeType
@@ -1766,28 +2329,34 @@ sub GetNativeType
     my $type = shift;
     my $isParameter = shift;
 
-    if ($type eq "float" or $type eq "AtomicString" or $type eq "double") {
+    if ($type eq "float" or $type eq "double") {
         return $type;
     }
 
+    return "V8Parameter" if ($type eq "DOMString" or $type eq "DOMUserData") and $isParameter;
     return "int" if $type eq "int";
     return "int" if $type eq "short" or $type eq "unsigned short";
     return "unsigned" if $type eq "unsigned long";
     return "int" if $type eq "long";
+    return "long long" if $type eq "long long";
     return "unsigned long long" if $type eq "unsigned long long";
     return "bool" if $type eq "boolean";
     return "String" if $type eq "DOMString";
     return "Range::CompareHow" if $type eq "CompareHow";
     return "FloatRect" if $type eq "SVGRect";
     return "FloatPoint" if $type eq "SVGPoint";
-    return "TransformationMatrix" if $type eq "SVGMatrix";
+    return "AffineTransform" if $type eq "SVGMatrix";
     return "SVGTransform" if $type eq "SVGTransform";
     return "SVGLength" if $type eq "SVGLength";
-    return "double" if $type eq "SVGNumber";
+    return "SVGAngle" if $type eq "SVGAngle";
+    return "float" if $type eq "SVGNumber";
+    return "SVGPreserveAspectRatio" if $type eq "SVGPreserveAspectRatio";
     return "SVGPaint::SVGPaintType" if $type eq "SVGPaintType";
     return "DOMTimeStamp" if $type eq "DOMTimeStamp";
     return "unsigned" if $type eq "unsigned int";
     return "Node*" if $type eq "EventTarget" and $isParameter;
+    return "double" if $type eq "Date";
+    return "ScriptValue" if $type eq "DOMObject";
 
     return "String" if $type eq "DOMUserData";  # FIXME: Temporary hack?
 
@@ -1803,69 +2372,6 @@ sub GetNativeType
     return "${type}*";
 }
 
-
-my %typeCanFailConversion = (
-    "AtomicString" => 0,
-    "Attr" => 1,
-    "CanvasArray" => 0,
-    "CanvasBuffer" => 0,
-    "CanvasByteArray" => 0,
-    "CanvasFloatArray" => 0,
-    "CanvasFramebuffer" => 0,
-    "CanvasGradient" => 0,
-    "CanvasIntArray" => 0,
-    "CanvasPixelArray" => 0,
-    "CanvasProgram" => 0,
-    "CanvasRenderbuffer" => 0,
-    "CanvasShader" => 0,
-    "CanvasShortArray" => 0,
-    "CanvasTexture" => 0,
-    "CompareHow" => 0,
-    "DataGridColumn" => 0,
-    "DOMString" => 0,
-    "DOMWindow" => 0,
-    "DocumentType" => 0,
-    "Element" => 0,
-    "Event" => 0,
-    "EventListener" => 0,
-    "EventTarget" => 0,
-    "HTMLCanvasElement" => 0,
-    "HTMLElement" => 0,
-    "HTMLImageElement" => 0,
-    "HTMLOptionElement" => 0,
-    "HTMLVideoElement" => 0,
-    "Node" => 0,
-    "NodeFilter" => 0,
-    "MessagePort" => 0,
-    "NSResolver" => 0,
-    "Range" => 0,
-    "SQLResultSet" => 0,
-    "Storage" => 0,
-    "SVGAngle" => 0,
-    "SVGElement" => 0,
-    "SVGLength" => 1,
-    "SVGMatrix" => 1,
-    "SVGNumber" => 0,
-    "SVGPaintType" => 0,
-    "SVGPathSeg" => 0,
-    "SVGPoint" => 1,
-    "SVGRect" => 1,
-    "SVGTransform" => 1,
-    "VoidCallback" => 1,
-    "WebKitCSSMatrix" => 0,
-    "WebKitPoint" => 0,
-    "XPathEvaluator" => 0,
-    "XPathNSResolver" => 0,
-    "XPathResult" => 0,
-    "boolean" => 0,
-    "double" => 0,
-    "float" => 0,
-    "long" => 0,
-    "unsigned long" => 0,
-    "unsigned short" => 0,
-);
-
-
 sub TranslateParameter
 {
     my $signature = shift;
@@ -1881,9 +2387,11 @@ sub BasicTypeCanFailConversion
     my $signature = shift;
     my $type = GetTypeFromSignature($signature);
 
+    return 1 if $type eq "SVGAngle";
     return 1 if $type eq "SVGLength";
     return 1 if $type eq "SVGMatrix";
     return 1 if $type eq "SVGPoint";
+    return 1 if $type eq "SVGPreserveAspectRatio";
     return 1 if $type eq "SVGRect";
     return 1 if $type eq "SVGTransform";
     return 0;
@@ -1896,10 +2404,9 @@ sub TypeCanFailConversion
     my $type = GetTypeFromSignature($signature);
 
     $implIncludes{"ExceptionCode.h"} = 1 if $type eq "Attr";
-
-    return $typeCanFailConversion{$type} if exists $typeCanFailConversion{$type};
-
-    die "Don't know whether a JS value can fail conversion to type $type.";
+    return 1 if $type eq "Attr";
+    return 1 if $type eq "VoidCallback";
+    return BasicTypeCanFailConversion($signature);
 }
 
 sub JSValueToNative
@@ -1917,19 +2424,13 @@ sub JSValueToNative
     return "$value->NumberValue()" if $type eq "SVGNumber";
 
     return "toInt32($value${maybeOkParam})" if $type eq "unsigned long" or $type eq "unsigned short" or $type eq "long";
+    return "toInt64($value)" if $type eq "unsigned long long" or $type eq "long long";
     return "static_cast<Range::CompareHow>($value->Int32Value())" if $type eq "CompareHow";
     return "static_cast<SVGPaint::SVGPaintType>($value->ToInt32()->Int32Value())" if $type eq "SVGPaintType";
+    return "toWebCoreDate($value)" if $type eq "Date";
 
-    if ($type eq "AtomicString") {
-        return "v8ValueToAtomicWebCoreStringWithNullCheck($value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
-        return "v8ValueToAtomicWebCoreString($value)";
-    }
-
-    return "toWebCoreString($value)" if $type eq "DOMUserData";
-    if ($type eq "DOMString") {
-        return "toWebCoreStringWithNullCheck($value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
-        return "toWebCoreStringWithNullOrUndefinedCheck($value)" if $signature->extendedAttributes->{"ConvertUndefinedOrNullToNullString"};
-        return "toWebCoreString($value)";
+    if ($type eq "DOMString" or $type eq "DOMUserData") {
+        return $value;
     }
 
     if ($type eq "SerializedScriptValue") {
@@ -1937,6 +2438,11 @@ sub JSValueToNative
         return "SerializedScriptValue::create($value)";
     }
 
+    if ($type eq "DOMObject") {
+        $implIncludes{"ScriptValue.h"} = 1;
+        return "ScriptValue($value)";
+    }
+
     if ($type eq "NodeFilter") {
         return "V8DOMWrapper::wrapNativeNodeFilter($value)";
     }
@@ -1950,12 +2456,11 @@ sub JSValueToNative
     }
 
     # Default, assume autogenerated type conversion routines
-    $implIncludes{"V8Proxy.h"} = 1;
     if ($type eq "EventTarget") {
         $implIncludes{"V8Node.h"} = 1;
 
         # EventTarget is not in DOM hierarchy, but all Nodes are EventTarget.
-        return "V8Node::HasInstance($value) ? V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast($value)) : 0";
+        return "V8Node::HasInstance($value) ? V8Node::toNative(v8::Handle<v8::Object>::Cast($value)) : 0";
     }
 
     if ($type eq "XPathNSResolver") {
@@ -1963,51 +2468,49 @@ sub JSValueToNative
     }
 
     AddIncludesForType($type);
-    # $implIncludes{"$type.h"} = 1 unless AvoidInclusionOfType($type);
 
     if (IsDOMNodeType($type)) {
         $implIncludes{"V8${type}.h"} = 1;
 
         # Perform type checks on the parameter, if it is expected Node type,
         # return NULL.
-        return "V8${type}::HasInstance($value) ? V8DOMWrapper::convertDOMWrapperToNode<${type}>(v8::Handle<v8::Object>::Cast($value)) : 0";
+        return "V8${type}::HasInstance($value) ? V8${type}::toNative(v8::Handle<v8::Object>::Cast($value)) : 0";
     } else {
-        # TODO: Temporary to avoid Window name conflict.
-        my $classIndex = uc($type);
-        my $implClassName = ${type};
-
         $implIncludes{"V8$type.h"} = 1;
 
         if (IsPodType($type)) {
             my $nativeType = GetNativeType($type);
             $implIncludes{"V8SVGPODTypeWrapper.h"} = 1;
 
-            return "V8SVGPODTypeUtil::toSVGPODType<${nativeType}>(V8ClassIndex::${classIndex}, $value${maybeOkParam})"
+            return "V8SVGPODTypeUtil::toSVGPODType<${nativeType}>(&V8${type}::info, $value${maybeOkParam})"
         }
 
         $implIncludes{"V8${type}.h"} = 1;
 
         # Perform type checks on the parameter, if it is expected Node type,
         # return NULL.
-        return "V8${type}::HasInstance($value) ? V8DOMWrapper::convertToNativeObject<${implClassName}>(V8ClassIndex::${classIndex}, v8::Handle<v8::Object>::Cast($value)) : 0";
+        return "V8${type}::HasInstance($value) ? V8${type}::toNative(v8::Handle<v8::Object>::Cast($value)) : 0";
     }
 }
 
-
 sub GetV8HeaderName
 {
     my $type = shift;
-    return "V8" . GetImplementationFileName($type);
+    return "V8Event.h" if $type eq "DOMTimeStamp";
+    return "EventListener.h" if $type eq "EventListener";
+    return "EventTarget.h" if $type eq "EventTarget";
+    return "SerializedScriptValue.h" if $type eq "SerializedScriptValue";
+    return "ScriptValue.h" if $type eq "DOMObject";
+    return "V8${type}.h";
 }
 
-
 sub CreateCustomSignature
 {
     my $function = shift;
     my $count = @{$function->parameters};
     my $name = $function->signature->name;
-    my $result = "  const int ${name}_argc = ${count};\n" .
-      "  v8::Handle<v8::FunctionTemplate> ${name}_argv[${name}_argc] = { ";
+    my $result = "    const int ${name}_argc = ${count};\n" .
+      "    v8::Handle<v8::FunctionTemplate> ${name}_argv[${name}_argc] = { ";
     my $first = 1;
     foreach my $parameter (@{$function->parameters}) {
         if ($first) { $first = 0; }
@@ -2028,7 +2531,7 @@ sub CreateCustomSignature
         }
     }
     $result .= " };\n";
-    $result .= "  v8::Handle<v8::Signature> ${name}_signature = v8::Signature::New(desc, ${name}_argc, ${name}_argv);\n";
+    $result .= "    v8::Handle<v8::Signature> ${name}_signature = v8::Signature::New(desc, ${name}_argc, ${name}_argv);\n";
     return $result;
 }
 
@@ -2043,9 +2546,9 @@ sub RequiresCustomSignature
     }
 
     foreach my $parameter (@{$function->parameters}) {
-      if (IsWrapperType($parameter->type)) {
-          return 1;
-      }
+        if (IsWrapperType($parameter->type)) {
+            return 1;
+        }
     }
     return 0;
 }
@@ -2053,17 +2556,20 @@ sub RequiresCustomSignature
 
 my %non_wrapper_types = (
     'float' => 1,
-    'AtomicString' => 1,
     'double' => 1,
     'short' => 1,
     'unsigned short' => 1,
     'long' => 1,
     'unsigned long' => 1,
     'boolean' => 1,
+    'long long' => 1,
+    'unsigned long long' => 1,
     'DOMString' => 1,
     'CompareHow' => 1,
+    'SVGAngle' => 1,
     'SVGRect' => 1,
     'SVGPoint' => 1,
+    'SVGPreserveAspectRatio' => 1,
     'SVGMatrix' => 1,
     'SVGTransform' => 1,
     'SVGLength' => 1,
@@ -2071,6 +2577,7 @@ my %non_wrapper_types = (
     'SVGPaintType' => 1,
     'DOMTimeStamp' => 1,
     'JSObject' => 1,
+    'DOMObject' => 1,
     'EventTarget' => 1,
     'NodeFilter' => 1,
     'EventListener' => 1
@@ -2119,11 +2626,10 @@ sub ReturnNativeToJSValue
     my $value = shift;
     my $indent = shift;
     my $type = GetTypeFromSignature($signature);
-    my $className= "V8$type";
 
     return "return v8::Date::New(static_cast<double>($value))" if $type eq "DOMTimeStamp";
-    return "return $value ? v8::True() : v8::False()" if $type eq "boolean";
-    return "return v8::Undefined()" if $type eq "void";
+    return "return v8Boolean($value)" if $type eq "boolean";
+    return "return v8::Handle<v8::Value>()" if $type eq "void";     # equivalent to v8::Undefined()
 
     # For all the types where we use 'int' as the representation type,
     # we use Integer::New which has a fast Smi conversion check.
@@ -2131,7 +2637,9 @@ sub ReturnNativeToJSValue
     return "return v8::Integer::New($value)" if $nativeType eq "int";
     return "return v8::Integer::NewFromUnsigned($value)" if $nativeType eq "unsigned";
 
+    return "return v8DateOrNull($value);" if $type eq "Date";
     return "return v8::Number::New($value)" if $codeGenerator->IsPrimitiveType($type) or $type eq "SVGPaintType";
+    return "return $value.v8Value()" if $nativeType eq "ScriptValue";
 
     if ($codeGenerator->IsStringType($type)) {
         my $conv = $signature->extendedAttributes->{"ConvertNullStringTo"};
@@ -2145,61 +2653,36 @@ sub ReturnNativeToJSValue
         return "return v8String($value)";
     }
 
-    # V8 specific.
-    my $implClassName = $type;
     AddIncludesForType($type);
-    # $implIncludes{GetImplementationFileName($type)} = 1 unless AvoidInclusionOfType($type);
 
     # special case for non-DOM node interfaces
     if (IsDOMNodeType($type)) {
-        if ($signature->extendedAttributes->{"ReturnsNew"}) {
-            return "return V8DOMWrapper::convertNewNodeToV8Object($value)";
-        } else {
-            return "return V8DOMWrapper::convertNodeToV8Object($value)";
-        }
+        return "return toV8(${value}" . ($signature->extendedAttributes->{"ReturnsNew"} ? ", true)" : ")");
     }
 
-    if ($type eq "EventTarget" or $type eq "SVGElementInstance") {
+    if ($type eq "EventTarget") {
         return "return V8DOMWrapper::convertEventTargetToV8Object($value)";
     }
 
-    if ($type eq "Event") {
-        return "return V8DOMWrapper::convertEventToV8Object($value)";
-    }
-
     if ($type eq "EventListener") {
-        return "return V8DOMWrapper::convertEventListenerToV8Object(imp->scriptExecutionContext(), $value)";
+        $implIncludes{"V8AbstractEventListener.h"} = 1;
+        return "return ${value} ? v8::Handle<v8::Value>(static_cast<V8AbstractEventListener*>(${value})->getListenerObject(imp->scriptExecutionContext())) : v8::Handle<v8::Value>(v8::Null())";
     }
 
     if ($type eq "SerializedScriptValue") {
         $implIncludes{"$type.h"} = 1;
-        return "return v8String($value->toString())";
+        return "return $value->deserialize()";
     }
 
-    if ($type eq "DedicatedWorkerContext" or $type eq "WorkerContext" or $type eq "SharedWorkerContext") {
-        $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
-        return "return WorkerContextExecutionProxy::convertWorkerContextToV8Object($value)";
-    }
-
-    if ($type eq "WorkerLocation" or $type eq "WorkerNavigator" or $type eq "NotificationCenter") {
-        $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
-        my $classIndex = uc($type);
+    $implIncludes{"wtf/RefCounted.h"} = 1;
+    $implIncludes{"wtf/RefPtr.h"} = 1;
+    $implIncludes{"wtf/GetPtr.h"} = 1;
 
-        return "return WorkerContextExecutionProxy::convertToV8Object(V8ClassIndex::$classIndex, $value)";
+    if (IsPodType($type)) {
+        $value = GenerateSVGStaticPodTypeWrapper($type, $value) . ".get()";
     }
 
-    else {
-        $implIncludes{"wtf/RefCounted.h"} = 1;
-        $implIncludes{"wtf/RefPtr.h"} = 1;
-        $implIncludes{"wtf/GetPtr.h"} = 1;
-        my $classIndex = uc($type);
-
-        if (IsPodType($type)) {
-            $value = GenerateSVGStaticPodTypeWrapper($type, $value);
-        }
-
-        return "return V8DOMWrapper::convertToV8Object(V8ClassIndex::$classIndex, $value)";
-    }
+    return "return toV8($value)";
 }
 
 sub GenerateSVGStaticPodTypeWrapper {
@@ -2333,6 +2816,15 @@ sub IsSVGListTypeNeedingSpecialHandling
     return 0;
 }
 
+sub GetVisibleInterfaceName
+{
+    my $interfaceName = shift;
+
+    return "DOMException" if $interfaceName eq "DOMCoreException";
+    return "FormData" if $interfaceName eq "DOMFormData";
+    return $interfaceName;
+}
+
 sub DebugPrint
 {
     my $output = shift;
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm
index 4abdb455fd..7db7747cfa 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm
@@ -3,8 +3,6 @@
 #
 # Copyright (C) 2005 Nikolas Zimmermann <wildfox@kde.org>
 # 
-# This file is part of the KDE project
-# 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
 # License as published by the Free Software Foundation; either
@@ -16,7 +14,7 @@
 # Library General Public License for more details.
 # 
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 # Boston, MA 02110-1301, USA.
 # 
@@ -66,7 +64,14 @@ sub Parse
     $parentsOnly = shift;
 
     if (!$preprocessor) {
-        $preprocessor = "/usr/bin/gcc -E -P -x c++";
+        require Config;
+        my $gccLocation = "";
+        if (($Config::Config{'osname'}) =~ /solaris/i) {
+            $gccLocation = "/usr/sfw/bin/gcc";
+        } else {
+            $gccLocation = "/usr/bin/gcc";
+        }
+        $preprocessor = $gccLocation . " -E -P -x c++";
     }
 
     if (!$defines) {
@@ -160,6 +165,7 @@ sub parseExtendedAttributes
         # Attributes with no value are set to be true
         $value = 1 unless defined $value;
         $attrs{$name} = $value;
+        die("Invalid extended attribute name: '$name'\n") if $name =~ /\s/;
     }
 
     return \%attrs;
@@ -372,7 +378,9 @@ sub DetermineParseMode
         $mode = MODE_INTERFACE;
     } elsif ($_ =~ /exception/) {
         $mode = MODE_EXCEPTION;
-    } elsif ($_ =~ /alias/) {
+    } elsif ($_ =~ /(\A|\b)alias/) {
+        # The (\A|\b) above is needed so we don't match attributes
+        # whose names contain the substring "alias".
         $mode = MODE_ALIAS;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/IDLStructure.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/IDLStructure.pm
index 5a59ff1042..6224e549f6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/IDLStructure.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/IDLStructure.pm
@@ -3,8 +3,6 @@
 #
 # Copyright (C) 2005 Nikolas Zimmermann <wildfox@kde.org>
 # 
-# This file is part of the KDE project
-# 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
 # License as published by the Free Software Foundation; either
@@ -16,7 +14,7 @@
 # Library General Public License for more details.
 # 
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 # Boston, MA 02110-1301, USA.
 # 
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/generate-bindings.pl b/src/3rdparty/webkit/WebCore/bindings/scripts/generate-bindings.pl
index c7adeb3a12..44ed4d3956 100755
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/generate-bindings.pl
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/generate-bindings.pl
@@ -16,7 +16,7 @@
 # Library General Public License for more details.
 # 
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 # Boston, MA 02110-1301, USA.
 # 
@@ -56,7 +56,6 @@ my $idlFile = $ARGV[0];
 die('Must specify input file.') unless defined($idlFile);
 die('Must specify IDL search path.') unless @idlDirectories;
 die('Must specify generator') unless defined($generator);
-die('Must specify input file.') unless defined($idlFile);
 die('Must specify output directory.') unless defined($outputDirectory);
 die('Must specify defines') unless defined($defines);
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/Bridge.h b/src/3rdparty/webkit/WebCore/bridge/Bridge.h
new file mode 100644
index 0000000000..50efc6464b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/Bridge.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Bridge_h
+#define Bridge_h
+
+#include "BridgeJSC.h"
+#include <wtf/Noncopyable.h>
+
+namespace JSC  {
+
+namespace Bindings {
+
+class Method : public Noncopyable {
+public:
+    virtual int numParameters() const = 0;
+
+    virtual ~Method() { }
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
index 8128bf8cb9..99bae0b1b9 100644
--- a/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
+++ b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
@@ -28,6 +28,7 @@
 
 #include <wtf/Assertions.h>
 #include <wtf/FastAllocBase.h>
+#include <wtf/StringExtras.h>
 #include <string.h>
 
 namespace WebCore {
@@ -54,7 +55,7 @@ private:
     IdentifierRep(const char* name)
         : m_isString(true)
     {
-        m_value.m_string = strdup(name);
+        m_value.m_string = fastStrDup(name);
     }
     
     ~IdentifierRep()
diff --git a/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp b/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
index 6a89652cdb..2b1d17ff07 100644
--- a/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
@@ -30,6 +30,7 @@
 #include "NP_jsobject.h"
 
 #include "PlatformString.h"
+#include "PluginView.h"
 #include "StringSourceProvider.h"
 #include "c_utility.h"
 #include "c_instance.h"
@@ -50,6 +51,64 @@ using namespace JSC;
 using namespace JSC::Bindings;
 using namespace WebCore;
 
+class ObjectMap {
+public:
+    NPObject* get(RootObject* rootObject, JSObject* jsObject)
+    {
+        return m_map.get(rootObject).get(jsObject);
+    }
+
+    void add(RootObject* rootObject, JSObject* jsObject, NPObject* npObject)
+    {
+        HashMap<RootObject*, JSToNPObjectMap>::iterator iter = m_map.find(rootObject);
+        if (iter == m_map.end()) {
+            rootObject->addInvalidationCallback(&m_invalidationCallback);
+            iter = m_map.add(rootObject, JSToNPObjectMap()).first;
+        }
+
+        ASSERT(iter->second.find(jsObject) == iter->second.end());
+        iter->second.add(jsObject, npObject);
+    }
+
+    void remove(RootObject* rootObject)
+    {
+        HashMap<RootObject*, JSToNPObjectMap>::iterator iter = m_map.find(rootObject);
+        ASSERT(iter != m_map.end());
+        m_map.remove(iter);
+    }
+
+    void remove(RootObject* rootObject, JSObject* jsObject)
+    {
+        HashMap<RootObject*, JSToNPObjectMap>::iterator iter = m_map.find(rootObject);
+        ASSERT(iter != m_map.end());
+        ASSERT(iter->second.find(jsObject) != iter->second.end());
+
+        iter->second.remove(jsObject);
+    }
+
+private:
+    struct RootObjectInvalidationCallback : public RootObject::InvalidationCallback {
+        virtual void operator()(RootObject*);
+    };
+    RootObjectInvalidationCallback m_invalidationCallback;
+
+    // JSObjects are protected by RootObject.
+    typedef HashMap<JSObject*, NPObject*> JSToNPObjectMap;
+    HashMap<RootObject*, JSToNPObjectMap> m_map;
+};
+
+
+static ObjectMap& objectMap()
+{
+    DEFINE_STATIC_LOCAL(ObjectMap, map, ());
+    return map;
+}
+
+void ObjectMap::RootObjectInvalidationCallback::operator()(RootObject* rootObject)
+{
+    objectMap().remove(rootObject);
+}
+
 static void getListFromVariantArgs(ExecState* exec, const NPVariant* args, unsigned argCount, RootObject* rootObject, MarkedArgumentBuffer& aList)
 {
     for (unsigned i = 0; i < argCount; ++i)
@@ -65,8 +124,10 @@ static void jsDeallocate(NPObject* npObj)
 {
     JavaScriptObject* obj = reinterpret_cast<JavaScriptObject*>(npObj);
 
-    if (obj->rootObject && obj->rootObject->isValid())
+    if (obj->rootObject && obj->rootObject->isValid()) {
+        objectMap().remove(obj->rootObject, obj->imp);
         obj->rootObject->gcUnprotect(obj->imp);
+    }
 
     if (obj->rootObject)
         obj->rootObject->deref();
@@ -82,12 +143,18 @@ static NPClass* NPNoScriptObjectClass = &noScriptClass;
 
 NPObject* _NPN_CreateScriptObject(NPP npp, JSObject* imp, PassRefPtr<RootObject> rootObject)
 {
+    if (NPObject* object = objectMap().get(rootObject.get(), imp))
+        return _NPN_RetainObject(object);
+
     JavaScriptObject* obj = reinterpret_cast<JavaScriptObject*>(_NPN_CreateObject(npp, NPScriptObjectClass));
 
     obj->rootObject = rootObject.releaseRef();
 
-    if (obj->rootObject)
+    if (obj->rootObject) {
         obj->rootObject->gcProtect(imp);
+        objectMap().add(obj->rootObject, imp, reinterpret_cast<NPObject*>(obj));
+    }
+
     obj->imp = imp;
 
     return reinterpret_cast<NPObject*>(obj);
@@ -124,7 +191,7 @@ bool _NPN_InvokeDefault(NPP, NPObject* o, const NPVariant* args, uint32_t argCou
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = callInWorld(exec, function, callType, callData, function, argList, pluginWorld());
+        JSValue resultV = JSC::call(exec, function, callType, callData, function, argList);
         globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
@@ -174,7 +241,7 @@ bool _NPN_Invoke(NPP npp, NPObject* o, NPIdentifier methodName, const NPVariant*
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = callInWorld(exec, function, callType, callData, obj->imp, argList, pluginWorld());
+        JSValue resultV = JSC::call(exec, function, callType, callData, obj->imp, argList);
         globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
@@ -190,7 +257,7 @@ bool _NPN_Invoke(NPP npp, NPObject* o, NPIdentifier methodName, const NPVariant*
     return true;
 }
 
-bool _NPN_Evaluate(NPP, NPObject* o, NPString* s, NPVariant* variant)
+bool _NPN_Evaluate(NPP instance, NPObject* o, NPString* s, NPVariant* variant)
 {
     if (o->_class == NPScriptObjectClass) {
         JavaScriptObject* obj = reinterpret_cast<JavaScriptObject*>(o); 
@@ -199,12 +266,16 @@ bool _NPN_Evaluate(NPP, NPObject* o, NPString* s, NPVariant* variant)
         if (!rootObject || !rootObject->isValid())
             return false;
 
+        // There is a crash in Flash when evaluating a script that destroys the
+        // PluginView, so we destroy it asynchronously.
+        PluginView::keepAlive(instance);
+
         ExecState* exec = rootObject->globalObject()->globalExec();
         JSLock lock(SilenceAssertionsOnly);
         String scriptString = convertNPStringToUTF16(s);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        Completion completion = evaluateInWorld(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(scriptString), JSC::JSValue(), pluginWorld());
+        Completion completion = JSC::evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(scriptString), JSC::JSValue());
         globalObject->globalData()->timeoutChecker.stop();
         ComplType type = completion.complType();
         
@@ -379,7 +450,7 @@ bool _NPN_HasMethod(NPP, NPObject* o, NPIdentifier methodName)
 
 void _NPN_SetException(NPObject*, const NPUTF8* message)
 {
-    // Ignorning the NPObject param is consistent with the Mozilla implementation.
+    // Ignoring the NPObject param is consistent with the Mozilla implementation.
     UString exception(message);
     CInstance::setGlobalException(exception);
 }
@@ -444,7 +515,7 @@ bool _NPN_Construct(NPP, NPObject* o, const NPVariant* args, uint32_t argCount,
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = constructInWorld(exec, constructor, constructType, constructData, argList, pluginWorld());
+        JSValue resultV = JSC::construct(exec, constructor, constructType, constructData, argList);
         globalObject->globalData()->timeoutChecker.stop();
         
         // Convert and return the result.
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/CRuntimeObject.cpp b/src/3rdparty/webkit/WebCore/bridge/c/CRuntimeObject.cpp
new file mode 100644
index 0000000000..47425a20ba
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/c/CRuntimeObject.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+
+#include "CRuntimeObject.h"
+#include "c_instance.h"
+
+namespace JSC {
+namespace Bindings {
+
+const ClassInfo CRuntimeObject::s_info = { "CRuntimeObject", &RuntimeObject::s_info, 0, 0 };
+
+CRuntimeObject::CRuntimeObject(ExecState* exec, PassRefPtr<CInstance> instance)
+    : RuntimeObject(exec, instance)
+{
+}
+
+CRuntimeObject::~CRuntimeObject()
+{
+}
+
+CInstance* CRuntimeObject::getInternalCInstance() const
+{
+    return static_cast<CInstance*>(getInternalInstance());
+}
+
+
+}
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/CRuntimeObject.h b/src/3rdparty/webkit/WebCore/bridge/c/CRuntimeObject.h
new file mode 100644
index 0000000000..b53387a81b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/c/CRuntimeObject.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CRuntimeObject_h
+#define CRuntimeObject_h
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+
+#include "runtime_object.h"
+
+namespace JSC {
+namespace Bindings {
+
+class CInstance;
+
+class CRuntimeObject : public RuntimeObject {
+public:
+    CRuntimeObject(ExecState*, PassRefPtr<CInstance>);
+    virtual ~CRuntimeObject();
+
+    CInstance* getInternalCInstance() const;
+
+    static const ClassInfo s_info;
+
+private:
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+};
+
+}
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_class.h b/src/3rdparty/webkit/WebCore/bridge/c/c_class.h
index 7f20af4244..52db2b9755 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_class.h
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_class.h
@@ -28,8 +28,8 @@
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
 
+#include "Bridge.h"
 #include "npruntime_internal.h"
-#include "runtime.h"
 #include <wtf/HashMap.h>
 
 namespace JSC {
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
index 77b5966271..2adb322dd3 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
@@ -29,15 +29,17 @@
 
 #include "c_instance.h"
 
+#include "CRuntimeObject.h"
+#include "IdentifierRep.h"
 #include "c_class.h"
 #include "c_runtime.h"
 #include "c_utility.h"
-#include "IdentifierRep.h"
 #include "npruntime_impl.h"
+#include "runtime_method.h"
 #include "runtime_root.h"
+#include <interpreter/CallFrame.h>
 #include <runtime/ArgList.h>
 #include <runtime/Error.h>
-#include <interpreter/CallFrame.h>
 #include <runtime/JSLock.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/PropertyNameArray.h>
@@ -89,6 +91,11 @@ CInstance::~CInstance()
     _NPN_ReleaseObject(_object);
 }
 
+RuntimeObject* CInstance::newRuntimeObject(ExecState* exec)
+{
+    return new (exec) CRuntimeObject(exec, this);
+}
+
 Class *CInstance::getClass() const
 {
     if (!_class)
@@ -101,8 +108,33 @@ bool CInstance::supportsInvokeDefaultMethod() const
     return _object->_class->invokeDefault;
 }
 
-JSValue CInstance::invokeMethod(ExecState* exec, const MethodList& methodList, const ArgList& args)
+class CRuntimeMethod : public RuntimeMethod {
+public:
+    CRuntimeMethod(ExecState* exec, const Identifier& name, Bindings::MethodList& list)
+        : RuntimeMethod(exec, name, list)
+    {
+    }
+
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+
+    static const ClassInfo s_info;
+};
+
+const ClassInfo CRuntimeMethod::s_info = { "CRuntimeMethod", &RuntimeMethod::s_info, 0, 0 };
+
+JSValue CInstance::getMethod(ExecState* exec, const Identifier& propertyName)
+{
+    MethodList methodList = getClass()->methodsNamed(propertyName, this);
+    return new (exec) CRuntimeMethod(exec, propertyName, methodList);
+}
+
+JSValue CInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod, const ArgList& args)
 {
+    if (!asObject(runtimeMethod)->inherits(&CRuntimeMethod::s_info))
+        return throwError(exec, TypeError, "Attempt to invoke non-plug-in method on plug-in object.");
+
+    const MethodList& methodList = *runtimeMethod->methods();
+
     // Overloading methods are not allowed by NPObjects.  Should only be one
     // name match for a particular method.
     ASSERT(methodList.size() == 1);
@@ -138,7 +170,7 @@ JSValue CInstance::invokeMethod(ExecState* exec, const MethodList& methodList, c
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
 
-    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
+    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, m_rootObject.get());
     _NPN_ReleaseVariantValue(&resultVariant);
     return resultValue;
 }
@@ -173,7 +205,7 @@ JSValue CInstance::invokeDefaultMethod(ExecState* exec, const ArgList& args)
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
 
-    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
+    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, m_rootObject.get());
     _NPN_ReleaseVariantValue(&resultVariant);
     return resultValue;
 }
@@ -212,7 +244,7 @@ JSValue CInstance::invokeConstruct(ExecState* exec, const ArgList& args)
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
 
-    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
+    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, m_rootObject.get());
     _NPN_ReleaseVariantValue(&resultVariant);
     return resultValue;
 }
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h
index f9e9de3273..be4a4cbf27 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h
@@ -28,9 +28,9 @@
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
 
-#include "runtime.h"
-#include <wtf/PassRefPtr.h>
+#include "Bridge.h"
 #include "runtime_root.h"
+#include <wtf/PassRefPtr.h>
 
 typedef struct NPObject NPObject;
 
@@ -50,6 +50,7 @@ public:
     }
 
     static void setGlobalException(JSC::UString exception);
+    static void moveGlobalExceptionToExecState(ExecState*);
 
     ~CInstance ();
 
@@ -58,7 +59,8 @@ public:
     virtual JSValue valueOf(ExecState*) const;
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList&);
+    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName);
+    virtual JSValue invokeMethod(ExecState*, RuntimeMethod* method, const ArgList&);
     virtual bool supportsInvokeDefaultMethod() const;
     virtual JSValue invokeDefaultMethod(ExecState*, const ArgList&);
 
@@ -74,9 +76,10 @@ public:
     NPObject *getObject() const { return _object; }
 
 private:
-    static void moveGlobalExceptionToExecState(ExecState* exec);
     CInstance(NPObject*, PassRefPtr<RootObject>);
 
+    virtual RuntimeObject* newRuntimeObject(ExecState*);
+
     mutable CClass *_class;
     NPObject *_object;
 };
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp
index e9a7bb644f..e038cd4d81 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp
@@ -49,6 +49,7 @@ JSValue CField::valueFromInstance(ExecState* exec, const Instance* inst) const
         {
             JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
             result = obj->_class->getProperty(obj, _fieldIdentifier, &property);
+            CInstance::moveGlobalExceptionToExecState(exec);
         }
         if (result) {
             JSValue result = convertNPVariantToValue(exec, &property, instance->rootObject());
@@ -70,6 +71,7 @@ void CField::setValueToInstance(ExecState *exec, const Instance *inst, JSValue a
         {
             JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
             obj->_class->setProperty(obj, _fieldIdentifier, &variant);
+            CInstance::moveGlobalExceptionToExecState(exec);
         }
 
         _NPN_ReleaseVariantValue(&variant);
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h
index e797342b03..5355934a34 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h
@@ -28,8 +28,8 @@
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
 
+#include "Bridge.h"
 #include "npruntime_internal.h"
-#include "runtime.h"
 
 namespace JSC {
 namespace Bindings {
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp
index 7ff77e73de..04d47c39ae 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp
@@ -30,6 +30,7 @@
 
 #include "c_utility.h"
 
+#include "CRuntimeObject.h"
 #include "JSDOMWindow.h"
 #include "NP_jsobject.h"
 #include "c_instance.h"
@@ -85,9 +86,9 @@ void convertValueToNPVariant(ExecState* exec, JSValue value, NPVariant* result)
         NULL_TO_NPVARIANT(*result);
     } else if (value.isObject()) {
         JSObject* object = asObject(value);
-        if (object->classInfo() == &RuntimeObjectImp::s_info) {
-            RuntimeObjectImp* imp = static_cast<RuntimeObjectImp*>(object);
-            CInstance* instance = static_cast<CInstance*>(imp->getInternalInstance());
+        if (object->classInfo() == &CRuntimeObject::s_info) {
+            CRuntimeObject* runtimeObject = static_cast<CRuntimeObject*>(object);
+            CInstance* instance = runtimeObject->getInternalCInstance();
             if (instance) {
                 NPObject* obj = instance->getObject();
                 _NPN_RetainObject(obj);
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/JNIBridge.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/JNIBridge.cpp
new file mode 100644
index 0000000000..778d4c3aa7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/JNIBridge.cpp
@@ -0,0 +1,181 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JNIBridge.h"
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "CString.h"
+#include "StringBuilder.h"
+
+
+using namespace JSC;
+using namespace JSC::Bindings;
+using namespace WebCore;
+
+
+JavaParameter::JavaParameter(JNIEnv* env, jstring type)
+{
+    m_type = JavaString(env, type);
+    m_JNIType = JNITypeFromClassName(m_type.UTF8String());
+}
+
+JavaMethod::JavaMethod(JNIEnv* env, jobject aMethod)
+{
+    // Get return type name
+    jstring returnTypeName = 0;
+    if (jobject returnType = callJNIMethod<jobject>(aMethod, "getReturnType", "()Ljava/lang/Class;")) {
+            returnTypeName = static_cast<jstring>(callJNIMethod<jobject>(returnType, "getName", "()Ljava/lang/String;"));
+        if (!returnTypeName)
+            returnTypeName = env->NewStringUTF("<Unknown>");
+        env->DeleteLocalRef(returnType);
+    }
+    m_returnType = JavaString(env, returnTypeName);
+    m_JNIReturnType = JNITypeFromClassName(m_returnType.UTF8String());
+    env->DeleteLocalRef(returnTypeName);
+
+    // Get method name
+    jstring methodName = static_cast<jstring>(callJNIMethod<jobject>(aMethod, "getName", "()Ljava/lang/String;"));
+    if (!returnTypeName)
+        returnTypeName = env->NewStringUTF("<Unknown>");
+    m_name = JavaString(env, methodName);
+    env->DeleteLocalRef(methodName);
+
+    // Get parameters
+    if (jarray jparameters = static_cast<jarray>(callJNIMethod<jobject>(aMethod, "getParameterTypes", "()[Ljava/lang/Class;"))) {
+        m_numParameters = env->GetArrayLength(jparameters);
+        m_parameters = new JavaParameter[m_numParameters];
+
+        for (int i = 0; i < m_numParameters; i++) {
+            jobject aParameter = env->GetObjectArrayElement(static_cast<jobjectArray>(jparameters), i);
+            jstring parameterName = static_cast<jstring>(callJNIMethod<jobject>(aParameter, "getName", "()Ljava/lang/String;"));
+            if (!parameterName)
+                parameterName = env->NewStringUTF("<Unknown>");
+            m_parameters[i] = JavaParameter(env, parameterName);
+            env->DeleteLocalRef(aParameter);
+            env->DeleteLocalRef(parameterName);
+        }
+        env->DeleteLocalRef(jparameters);
+    } else {
+        m_numParameters = 0;
+        m_parameters = 0;
+    }
+
+    // Created lazily.
+    m_signature = 0;
+    m_methodID = 0;
+
+    jclass modifierClass = env->FindClass("java/lang/reflect/Modifier");
+    int modifiers = callJNIMethod<jint>(aMethod, "getModifiers", "()I");
+    m_isStatic = static_cast<bool>(callJNIStaticMethod<jboolean>(modifierClass, "isStatic", "(I)Z", modifiers));
+    env->DeleteLocalRef(modifierClass);
+}
+
+JavaMethod::~JavaMethod()
+{
+    if (m_signature)
+        fastFree(m_signature);
+    delete[] m_parameters;
+};
+
+// JNI method signatures use '/' between components of a class name, but
+// we get '.' between components from the reflection API.
+static void appendClassName(StringBuilder& builder, const char* className)
+{
+#if USE(JSC)
+    ASSERT(JSLock::lockCount() > 0);
+#endif
+
+    char* c = fastStrDup(className);
+
+    char* result = c;
+    while (*c) {
+        if (*c == '.')
+            *c = '/';
+        c++;
+    }
+
+    builder.append(result);
+
+    fastFree(result);
+}
+
+const char* JavaMethod::signature() const
+{
+    if (!m_signature) {
+#if USE(JSC)
+        JSLock lock(SilenceAssertionsOnly);
+#endif
+
+        StringBuilder signatureBuilder;
+        signatureBuilder.append("(");
+        for (int i = 0; i < m_numParameters; i++) {
+            JavaParameter* aParameter = parameterAt(i);
+            JNIType type = aParameter->getJNIType();
+            if (type == array_type)
+                appendClassName(signatureBuilder, aParameter->type());
+            else {
+                signatureBuilder.append(signatureFromPrimitiveType(type));
+                if (type == object_type) {
+                    appendClassName(signatureBuilder, aParameter->type());
+                    signatureBuilder.append(";");
+                }
+            }
+        }
+        signatureBuilder.append(")");
+
+        const char* returnType = m_returnType.UTF8String();
+        if (m_JNIReturnType == array_type)
+            appendClassName(signatureBuilder, returnType);
+        else {
+            signatureBuilder.append(signatureFromPrimitiveType(m_JNIReturnType));
+            if (m_JNIReturnType == object_type) {
+                appendClassName(signatureBuilder, returnType);
+                signatureBuilder.append(";");
+            }
+        }
+
+        String signatureString = signatureBuilder.toString();
+        m_signature = fastStrDup(signatureString.utf8().data());
+    }
+
+    return m_signature;
+}
+
+JNIType JavaMethod::JNIReturnType() const
+{
+    return m_JNIReturnType;
+}
+
+jmethodID JavaMethod::methodID(jobject obj) const
+{
+    if (!m_methodID)
+        m_methodID = getMethodID(obj, m_name.UTF8String(), signature());
+    return m_methodID;
+}
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/JNIBridge.h b/src/3rdparty/webkit/WebCore/bridge/jni/JNIBridge.h
new file mode 100644
index 0000000000..5d482a7001
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/JNIBridge.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JNIBridge_h
+#define JNIBridge_h
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "Bridge.h"
+#include "JNIUtility.h"
+
+#if USE(JSC)
+#include "JavaStringJSC.h"
+#elif USE(V8)
+#include "JavaStringV8.h"
+#endif
+
+namespace JSC {
+
+namespace Bindings {
+
+typedef const char* RuntimeType;
+
+class JavaString {
+public:
+    JavaString()
+    {
+        m_impl.init();
+    }
+
+    JavaString(JNIEnv* e, jstring s)
+    {
+        m_impl.init(e, s);
+    }
+
+    JavaString(jstring s)
+    {
+        m_impl.init(getJNIEnv(), s);
+    }
+
+    const char* UTF8String() const { return m_impl.UTF8String(); }
+    const jchar* uchars() const { return m_impl.uchars(); }
+    int length() const { return m_impl.length(); }
+#if USE(JSC)
+    operator UString() const { return m_impl.uString(); }
+#endif
+
+private:
+    JavaStringImpl m_impl;
+};
+
+class JavaParameter {
+public:
+    JavaParameter() : m_JNIType(invalid_type) { }
+    JavaParameter(JNIEnv*, jstring type);
+    virtual ~JavaParameter() { }
+
+    RuntimeType type() const { return m_type.UTF8String(); }
+    JNIType getJNIType() const { return m_JNIType; }
+
+private:
+    JavaString m_type;
+    JNIType m_JNIType;
+};
+
+class JavaMethod : public Method {
+public:
+    JavaMethod(JNIEnv*, jobject aMethod);
+    ~JavaMethod();
+
+    const JavaString& name() const { return m_name; }
+    RuntimeType returnType() const { return m_returnType.UTF8String(); }
+    JavaParameter* parameterAt(int i) const { return &m_parameters[i]; }
+    int numParameters() const { return m_numParameters; }
+
+    const char* signature() const;
+    JNIType JNIReturnType() const;
+
+    jmethodID methodID(jobject obj) const;
+
+    bool isStatic() const { return m_isStatic; }
+
+private:
+    JavaParameter* m_parameters;
+    int m_numParameters;
+    JavaString m_name;
+    mutable char* m_signature;
+    JavaString m_returnType;
+    JNIType m_JNIReturnType;
+    mutable jmethodID m_methodID;
+    bool m_isStatic;
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
+
+#endif // JNIBridge_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/JNIUtility.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/JNIUtility.cpp
new file mode 100644
index 0000000000..ece39ed744
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/JNIUtility.cpp
@@ -0,0 +1,343 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JNIUtility.h"
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include <dlfcn.h>
+
+namespace JSC {
+
+namespace Bindings {
+
+static jint KJSGetCreatedJavaVMs(JavaVM** vmBuf, jsize bufLen, jsize* nVMs)
+{
+    static void* javaVMFramework = 0;
+    if (!javaVMFramework)
+        javaVMFramework = dlopen("/System/Library/Frameworks/JavaVM.framework/JavaVM", RTLD_LAZY);
+    if (!javaVMFramework)
+        return JNI_ERR;
+
+    typedef jint(*FunctionPointerType)(JavaVM**, jsize, jsize*);
+    static FunctionPointerType functionPointer = 0;
+    if (!functionPointer)
+        functionPointer = reinterpret_cast<FunctionPointerType>(dlsym(javaVMFramework, "JNI_GetCreatedJavaVMs"));
+    if (!functionPointer)
+        return JNI_ERR;
+    return functionPointer(vmBuf, bufLen, nVMs);
+}
+
+static JavaVM* jvm = 0;
+
+// Provide the ability for an outside component to specify the JavaVM to use
+// If the jvm value is set, the getJavaVM function below will just return.
+// In getJNIEnv(), if AttachCurrentThread is called to a VM that is already
+// attached, the result is a no-op.
+void setJavaVM(JavaVM* javaVM)
+{
+    jvm = javaVM;
+}
+
+JavaVM* getJavaVM()
+{
+    if (jvm)
+        return jvm;
+
+    JavaVM* jvmArray[1];
+    jsize bufLen = 1;
+    jsize nJVMs = 0;
+    jint jniError = 0;
+
+    // Assumes JVM is already running ..., one per process
+    jniError = KJSGetCreatedJavaVMs(jvmArray, bufLen, &nJVMs);
+    if (jniError == JNI_OK && nJVMs > 0)
+        jvm = jvmArray[0];
+    else
+        LOG_ERROR("JNI_GetCreatedJavaVMs failed, returned %ld", static_cast<long>(jniError));
+
+    return jvm;
+}
+
+JNIEnv* getJNIEnv()
+{
+    union {
+        JNIEnv* env;
+        void* dummy;
+    } u;
+    jint jniError = 0;
+
+    jniError = getJavaVM()->AttachCurrentThread(&u.dummy, 0);
+    if (jniError == JNI_OK)
+        return u.env;
+    LOG_ERROR("AttachCurrentThread failed, returned %ld", static_cast<long>(jniError));
+    return 0;
+}
+
+jmethodID getMethodID(jobject obj, const char* name, const char* sig)
+{
+    JNIEnv* env = getJNIEnv();
+    jmethodID mid = 0;
+
+    if (env) {
+        jclass cls = env->GetObjectClass(obj);
+        if (cls) {
+            mid = env->GetMethodID(cls, name, sig);
+            if (!mid) {
+                env->ExceptionClear();
+                mid = env->GetStaticMethodID(cls, name, sig);
+                if (!mid)
+                    env->ExceptionClear();
+            }
+        }
+        env->DeleteLocalRef(cls);
+    }
+    return mid;
+}
+
+const char* getCharactersFromJString(jstring aJString)
+{
+    return getCharactersFromJStringInEnv(getJNIEnv(), aJString);
+}
+
+void releaseCharactersForJString(jstring aJString, const char* s)
+{
+    releaseCharactersForJStringInEnv(getJNIEnv(), aJString, s);
+}
+
+const char* getCharactersFromJStringInEnv(JNIEnv* env, jstring aJString)
+{
+    jboolean isCopy;
+    const char* s = env->GetStringUTFChars(aJString, &isCopy);
+    if (!s) {
+        env->ExceptionDescribe();
+        env->ExceptionClear();
+        fprintf(stderr, "\n");
+    }
+    return s;
+}
+
+void releaseCharactersForJStringInEnv(JNIEnv* env, jstring aJString, const char* s)
+{
+    env->ReleaseStringUTFChars(aJString, s);
+}
+
+const jchar* getUCharactersFromJStringInEnv(JNIEnv* env, jstring aJString)
+{
+    jboolean isCopy;
+    const jchar* s = env->GetStringChars(aJString, &isCopy);
+    if (!s) {
+        env->ExceptionDescribe();
+        env->ExceptionClear();
+        fprintf(stderr, "\n");
+    }
+    return s;
+}
+
+void releaseUCharactersForJStringInEnv(JNIEnv* env, jstring aJString, const jchar* s)
+{
+    env->ReleaseStringChars(aJString, s);
+}
+
+JNIType JNITypeFromClassName(const char* name)
+{
+    JNIType type;
+
+    if (!strcmp("byte", name))
+        type = byte_type;
+    else if (!strcmp("short", name))
+        type = short_type;
+    else if (!strcmp("int", name))
+        type = int_type;
+    else if (!strcmp("long", name))
+        type = long_type;
+    else if (!strcmp("float", name))
+        type = float_type;
+    else if (!strcmp("double", name))
+        type = double_type;
+    else if (!strcmp("char", name))
+        type = char_type;
+    else if (!strcmp("boolean", name))
+        type = boolean_type;
+    else if (!strcmp("void", name))
+        type = void_type;
+    else if ('[' == name[0])
+        type = array_type;
+    else
+        type = object_type;
+
+    return type;
+}
+
+const char* signatureFromPrimitiveType(JNIType type)
+{
+    switch (type) {
+    case void_type:
+        return "V";
+
+    case array_type:
+        return "[";
+
+    case object_type:
+        return "L";
+
+    case boolean_type:
+        return "Z";
+
+    case byte_type:
+        return "B";
+
+    case char_type:
+        return "C";
+
+    case short_type:
+        return "S";
+
+    case int_type:
+        return "I";
+
+    case long_type:
+        return "J";
+
+    case float_type:
+        return "F";
+
+    case double_type:
+        return "D";
+
+    case invalid_type:
+    default:
+        break;
+    }
+    return "";
+}
+
+JNIType JNITypeFromPrimitiveType(char type)
+{
+    switch (type) {
+    case 'V':
+        return void_type;
+
+    case 'L':
+        return object_type;
+
+    case '[':
+        return array_type;
+
+    case 'Z':
+        return boolean_type;
+
+    case 'B':
+        return byte_type;
+
+    case 'C':
+        return char_type;
+
+    case 'S':
+        return short_type;
+
+    case 'I':
+        return int_type;
+
+    case 'J':
+        return long_type;
+
+    case 'F':
+        return float_type;
+
+    case 'D':
+        return double_type;
+
+    default:
+        break;
+    }
+    return invalid_type;
+}
+
+jvalue getJNIField(jobject obj, JNIType type, const char* name, const char* signature)
+{
+    JavaVM* jvm = getJavaVM();
+    JNIEnv* env = getJNIEnv();
+    jvalue result;
+
+    memset(&result, 0, sizeof(jvalue));
+    if (obj && jvm && env) {
+        jclass cls = env->GetObjectClass(obj);
+        if (cls) {
+            jfieldID field = env->GetFieldID(cls, name, signature);
+            if (field) {
+                switch (type) {
+                case array_type:
+                case object_type:
+                    result.l = env->functions->GetObjectField(env, obj, field);
+                    break;
+                case boolean_type:
+                    result.z = env->functions->GetBooleanField(env, obj, field);
+                    break;
+                case byte_type:
+                    result.b = env->functions->GetByteField(env, obj, field);
+                    break;
+                case char_type:
+                    result.c = env->functions->GetCharField(env, obj, field);
+                    break;
+                case short_type:
+                    result.s = env->functions->GetShortField(env, obj, field);
+                    break;
+                case int_type:
+                    result.i = env->functions->GetIntField(env, obj, field);
+                    break;
+                case long_type:
+                    result.j = env->functions->GetLongField(env, obj, field);
+                    break;
+                case float_type:
+                    result.f = env->functions->GetFloatField(env, obj, field);
+                    break;
+                case double_type:
+                    result.d = env->functions->GetDoubleField(env, obj, field);
+                    break;
+                default:
+                    LOG_ERROR("Invalid field type (%d)", static_cast<int>(type));
+                }
+            } else {
+                LOG_ERROR("Could not find field: %s", name);
+                env->ExceptionDescribe();
+                env->ExceptionClear();
+                fprintf(stderr, "\n");
+            }
+
+            env->DeleteLocalRef(cls);
+        } else
+            LOG_ERROR("Could not find class for object");
+    }
+
+    return result;
+}
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.h b/src/3rdparty/webkit/WebCore/bridge/jni/JNIUtility.h
index c315b1f80e..0eb889c8f5 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.h
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/JNIUtility.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,15 +20,14 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef _JNI_UTILITY_H_
-#define _JNI_UTILITY_H_
+#ifndef JNIUtility_h
+#define JNIUtility_h
 
 #if ENABLE(MAC_JAVA_BRIDGE)
 
-#include <runtime/JSValue.h>
 #include <JavaVM/jni.h>
 
 // The order of these items can not be modified as they are tightly
@@ -53,45 +52,40 @@ typedef enum {
 
 namespace JSC {
 
-class ExecState;
-class JSObject;    
-
 namespace Bindings {
 
 class JavaParameter;
 
-const char *getCharactersFromJString(jstring aJString);
-void releaseCharactersForJString(jstring aJString, const char *s);
+const char* getCharactersFromJString(jstring);
+void releaseCharactersForJString(jstring, const char*);
 
-const char *getCharactersFromJStringInEnv(JNIEnv *env, jstring aJString);
-void releaseCharactersForJStringInEnv(JNIEnv *env, jstring aJString, const char *s);
-const jchar *getUCharactersFromJStringInEnv(JNIEnv *env, jstring aJString);
-void releaseUCharactersForJStringInEnv(JNIEnv *env, jstring aJString, const jchar *s);
+const char* getCharactersFromJStringInEnv(JNIEnv*, jstring);
+void releaseCharactersForJStringInEnv(JNIEnv*, jstring, const char*);
+const jchar* getUCharactersFromJStringInEnv(JNIEnv*, jstring);
+void releaseUCharactersForJStringInEnv(JNIEnv*, jstring, const jchar*);
 
-JNIType JNITypeFromClassName(const char *name);
+JNIType JNITypeFromClassName(const char* name);
 JNIType JNITypeFromPrimitiveType(char type);
-const char *signatureFromPrimitiveType(JNIType type);
-
-jvalue convertValueToJValue(ExecState*, JSValue, JNIType, const char* javaClassName);
+const char* signatureFromPrimitiveType(JNIType);
 
-jvalue getJNIField(jobject obj, JNIType type, const char *name, const char *signature);
+jvalue getJNIField(jobject, JNIType, const char* name, const char* signature);
 
-jmethodID getMethodID(jobject obj, const char *name, const char *sig);
+jmethodID getMethodID(jobject, const char* name, const char* sig);
 JNIEnv* getJNIEnv();
 JavaVM* getJavaVM();
 void setJavaVM(JavaVM*);
-    
-    
+
+
 template <typename T> struct JNICaller;
 
 template<> struct JNICaller<void> {
     static void callA(jobject obj, jmethodID mid, jvalue* args)
     {
-        return getJNIEnv()->CallVoidMethodA(obj, mid, args);
+        getJNIEnv()->CallVoidMethodA(obj, mid, args);
     }
     static void callV(jobject obj, jmethodID mid, va_list args)
     {
-        return getJNIEnv()->CallVoidMethodV(obj, mid, args);
+        getJNIEnv()->CallVoidMethodV(obj, mid, args);
     }
 };
 
@@ -103,7 +97,7 @@ template<> struct JNICaller<jobject> {
     static jobject callV(jobject obj, jmethodID mid, va_list args)
     {
         return getJNIEnv()->CallObjectMethodV(obj, mid, args);
-    }    
+    }
 };
 
 template<> struct JNICaller<jboolean> {
@@ -119,7 +113,6 @@ template<> struct JNICaller<jboolean> {
     {
         return getJNIEnv()->CallStaticBooleanMethod(cls, mid, args);
     }
-    
 };
 
 template<> struct JNICaller<jbyte> {
@@ -141,7 +134,7 @@ template<> struct JNICaller<jchar> {
     static jchar callV(jobject obj, jmethodID mid, va_list args)
     {
         return getJNIEnv()->CallCharMethodV(obj, mid, args);
-    }    
+    }
 };
 
 template<> struct JNICaller<jshort> {
@@ -203,34 +196,30 @@ template<typename T> T callJNIMethodIDA(jobject obj, jmethodID mid, jvalue *args
 {
     return JNICaller<T>::callA(obj, mid, args);
 }
-    
+
 template<typename T>
-static T callJNIMethodV(jobject obj, const char *name, const char *sig, va_list args)
+static T callJNIMethodV(jobject obj, const char* name, const char* sig, va_list args)
 {
-    JavaVM *jvm = getJavaVM();
-    JNIEnv *env = getJNIEnv();
-    
-    if ( obj != NULL && jvm != NULL && env != NULL) {
+    JavaVM* jvm = getJavaVM();
+    JNIEnv* env = getJNIEnv();
+
+    if (obj && jvm && env) {
         jclass cls = env->GetObjectClass(obj);
-        if ( cls != NULL ) {
+        if (cls) {
             jmethodID mid = env->GetMethodID(cls, name, sig);
-            if ( mid != NULL )
-            {
+            if (mid) {
+                // Avoids references to cls without popping the local frame.
+                env->DeleteLocalRef(cls);
                 return JNICaller<T>::callV(obj, mid, args);
             }
-            else
-            {
-                fprintf(stderr, "%s: Could not find method: %s for %p\n", __PRETTY_FUNCTION__, name, obj);
-                env->ExceptionDescribe();
-                env->ExceptionClear();
-                fprintf (stderr, "\n");
-            }
+            LOG_ERROR("Could not find method: %s for %p", name, obj);
+            env->ExceptionDescribe();
+            env->ExceptionClear();
+            fprintf(stderr, "\n");
 
             env->DeleteLocalRef(cls);
-        }
-        else {
-            fprintf(stderr, "%s: Could not find class for %p\n", __PRETTY_FUNCTION__, obj);
-        }
+        } else
+            LOG_ERROR("Could not find class for %p", obj);
     }
 
     return 0;
@@ -241,43 +230,41 @@ T callJNIMethod(jobject obj, const char* methodName, const char* methodSignature
 {
     va_list args;
     va_start(args, methodSignature);
-    
-    T result= callJNIMethodV<T>(obj, methodName, methodSignature, args);
-    
+
+    T result = callJNIMethodV<T>(obj, methodName, methodSignature, args);
+
     va_end(args);
-    
+
     return result;
 }
-    
+
 template<typename T>
 T callJNIStaticMethod(jclass cls, const char* methodName, const char* methodSignature, ...)
 {
-    JavaVM *jvm = getJavaVM();
-    JNIEnv *env = getJNIEnv();
+    JavaVM* jvm = getJavaVM();
+    JNIEnv* env = getJNIEnv();
     va_list args;
-    
+
     va_start(args, methodSignature);
-    
+
     T result = 0;
-    
-    if (cls != NULL && jvm != NULL && env != NULL) {
+
+    if (cls && jvm && env) {
         jmethodID mid = env->GetStaticMethodID(cls, methodName, methodSignature);
-        if (mid != NULL) 
+        if (mid)
             result = JNICaller<T>::callStaticV(cls, mid, args);
         else {
-            fprintf(stderr, "%s: Could not find method: %s for %p\n", __PRETTY_FUNCTION__, methodName, cls);
+            LOG_ERROR("Could not find method: %s for %p", methodName, cls);
             env->ExceptionDescribe();
             env->ExceptionClear();
-            fprintf (stderr, "\n");
+            fprintf(stderr, "\n");
         }
     }
-    
+
     va_end(args);
-    
+
     return result;
 }
-    
-bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValue& exceptionDescription);
 
 } // namespace Bindings
 
@@ -285,4 +272,4 @@ bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool
 
 #endif // ENABLE(MAC_JAVA_BRIDGE)
 
-#endif // _JNI_UTILITY_H_
+#endif // JNIUtility_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.cpp
deleted file mode 100644
index 012b0476dc..0000000000
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.cpp
+++ /dev/null
@@ -1,141 +0,0 @@
-/*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "jni_class.h"
-
-#if ENABLE(MAC_JAVA_BRIDGE)
-
-#include "JSDOMWindow.h"
-#include <runtime/Identifier.h>
-#include <runtime/JSLock.h>
-#include "jni_utility.h"
-#include "jni_runtime.h"
-
-using namespace JSC::Bindings;
-
-JavaClass::JavaClass(jobject anInstance)
-{
-    jobject aClass = callJNIMethod<jobject>(anInstance, "getClass", "()Ljava/lang/Class;");
-    
-    if (!aClass) {
-        fprintf(stderr, "%s:  unable to call getClass on instance %p\n", __PRETTY_FUNCTION__, anInstance);
-        return;
-    }
-    
-    jstring className = (jstring)callJNIMethod<jobject>(aClass, "getName", "()Ljava/lang/String;");
-    const char *classNameC = getCharactersFromJString(className);
-    _name = strdup(classNameC);
-    releaseCharactersForJString(className, classNameC);
-
-    int i;
-    JNIEnv *env = getJNIEnv();
-
-    // Get the fields
-    jarray fields = (jarray)callJNIMethod<jobject>(aClass, "getFields", "()[Ljava/lang/reflect/Field;");
-    int numFields = env->GetArrayLength(fields);    
-    for (i = 0; i < numFields; i++) {
-        jobject aJField = env->GetObjectArrayElement((jobjectArray)fields, i);
-        JavaField *aField = new JavaField(env, aJField); // deleted in the JavaClass destructor
-        {
-            JSLock lock(SilenceAssertionsOnly);
-            _fields.set(aField->name(), aField);
-        }
-        env->DeleteLocalRef(aJField);
-    }
-
-    // Get the methods
-    jarray methods = (jarray)callJNIMethod<jobject>(aClass, "getMethods", "()[Ljava/lang/reflect/Method;");
-    int numMethods = env->GetArrayLength(methods);
-    for (i = 0; i < numMethods; i++) {
-        jobject aJMethod = env->GetObjectArrayElement((jobjectArray)methods, i);
-        JavaMethod *aMethod = new JavaMethod(env, aJMethod); // deleted in the JavaClass destructor
-        MethodList* methodList;
-        {
-            JSLock lock(SilenceAssertionsOnly);
-
-            methodList = _methods.get(aMethod->name());
-            if (!methodList) {
-                methodList = new MethodList();
-                _methods.set(aMethod->name(), methodList);
-            }
-        }
-        methodList->append(aMethod);
-        env->DeleteLocalRef(aJMethod);
-    }    
-}
-
-JavaClass::~JavaClass() {
-    free((void *)_name);
-
-    JSLock lock(SilenceAssertionsOnly);
-
-    deleteAllValues(_fields);
-    _fields.clear();
-
-    MethodListMap::const_iterator end = _methods.end();
-    for (MethodListMap::const_iterator it = _methods.begin(); it != end; ++it) {
-        const MethodList* methodList = it->second;
-        deleteAllValues(*methodList);
-        delete methodList;
-    }
-    _methods.clear();
-}
-
-MethodList JavaClass::methodsNamed(const Identifier& identifier, Instance*) const
-{
-    MethodList *methodList = _methods.get(identifier.ustring().rep());
-    
-    if (methodList)
-        return *methodList;
-    return MethodList();
-}
-
-Field *JavaClass::fieldNamed(const Identifier& identifier, Instance*) const
-{
-    return _fields.get(identifier.ustring().rep());
-}
-
-bool JavaClass::isNumberClass() const
-{
-    return ((strcmp(_name, "java.lang.Byte") == 0 ||
-             strcmp(_name, "java.lang.Short") == 0 ||
-             strcmp(_name, "java.lang.Integer") == 0 ||
-             strcmp(_name, "java.lang.Long") == 0 ||
-             strcmp(_name, "java.lang.Float") == 0 ||
-             strcmp(_name, "java.lang.Double") == 0) );
-}
-
-bool JavaClass::isBooleanClass() const
-{
-    return strcmp(_name, "java.lang.Boolean") == 0;
-}
-
-bool JavaClass::isStringClass() const
-{
-    return strcmp(_name, "java.lang.String") == 0;
-}
-
-#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.cpp
deleted file mode 100644
index 2ef0c1da9e..0000000000
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.cpp
+++ /dev/null
@@ -1,330 +0,0 @@
-/*
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "jni_instance.h"
-
-#if ENABLE(MAC_JAVA_BRIDGE)
-
-#include "jni_class.h"
-#include "jni_runtime.h"
-#include "jni_utility.h"
-#include "runtime_object.h"
-#include "runtime_root.h"
-#include <runtime/ArgList.h>
-#include <runtime/Error.h>
-#include <runtime/JSLock.h>
-
-#ifdef NDEBUG
-#define JS_LOG(formatAndArgs...) ((void)0)
-#else
-#define JS_LOG(formatAndArgs...) { \
-    fprintf (stderr, "%s:%d -- %s:  ", __FILE__, __LINE__, __FUNCTION__); \
-    fprintf(stderr, formatAndArgs); \
-}
-#endif
- 
-using namespace JSC::Bindings;
-using namespace JSC;
-
-JavaInstance::JavaInstance (jobject instance, PassRefPtr<RootObject> rootObject)
-    : Instance(rootObject)
-{
-    _instance = new JObjectWrapper (instance);
-    _class = 0;
-}
-
-JavaInstance::~JavaInstance () 
-{
-    delete _class; 
-}
-
-#define NUM_LOCAL_REFS 64
-
-void JavaInstance::virtualBegin()
-{
-    getJNIEnv()->PushLocalFrame (NUM_LOCAL_REFS);
-}
-
-void JavaInstance::virtualEnd()
-{
-    getJNIEnv()->PopLocalFrame (NULL);
-}
-
-Class *JavaInstance::getClass() const 
-{
-    if (_class == 0)
-        _class = new JavaClass (_instance->_instance);
-    return _class;
-}
-
-JSValue JavaInstance::stringValue(ExecState* exec) const
-{
-    JSLock lock(SilenceAssertionsOnly);
-    
-    jstring stringValue = (jstring)callJNIMethod<jobject>(_instance->_instance, "toString", "()Ljava/lang/String;");
-    JNIEnv *env = getJNIEnv();
-    const jchar *c = getUCharactersFromJStringInEnv(env, stringValue);
-    UString u((const UChar *)c, (int)env->GetStringLength(stringValue));
-    releaseUCharactersForJStringInEnv(env, stringValue, c);
-    return jsString(exec, u);
-}
-
-JSValue JavaInstance::numberValue(ExecState* exec) const
-{
-    jdouble doubleValue = callJNIMethod<jdouble>(_instance->_instance, "doubleValue", "()D");
-    return jsNumber(exec, doubleValue);
-}
-
-JSValue JavaInstance::booleanValue() const
-{
-    jboolean booleanValue = callJNIMethod<jboolean>(_instance->_instance, "booleanValue", "()Z");
-    return jsBoolean(booleanValue);
-}
-
-JSValue JavaInstance::invokeMethod (ExecState *exec, const MethodList &methodList, const ArgList &args)
-{
-    int i, count = args.size();
-    jvalue *jArgs;
-    JSValue resultValue;
-    Method *method = 0;
-    size_t numMethods = methodList.size();
-    
-    // Try to find a good match for the overloaded method.  The 
-    // fundamental problem is that JavaScript doesn have the
-    // notion of method overloading and Java does.  We could 
-    // get a bit more sophisticated and attempt to does some
-    // type checking as we as checking the number of parameters.
-    Method *aMethod;
-    for (size_t methodIndex = 0; methodIndex < numMethods; methodIndex++) {
-        aMethod = methodList[methodIndex];
-        if (aMethod->numParameters() == count) {
-            method = aMethod;
-            break;
-        }
-    }
-    if (method == 0) {
-        JS_LOG ("unable to find an appropiate method\n");
-        return jsUndefined();
-    }
-    
-    const JavaMethod *jMethod = static_cast<const JavaMethod*>(method);
-    JS_LOG ("call %s %s on %p\n", UString(jMethod->name()).UTF8String().c_str(), jMethod->signature(), _instance->_instance);
-    
-    if (count > 0) {
-        jArgs = (jvalue *)malloc (count * sizeof(jvalue));
-    }
-    else
-        jArgs = 0;
-        
-    for (i = 0; i < count; i++) {
-        JavaParameter* aParameter = jMethod->parameterAt(i);
-        jArgs[i] = convertValueToJValue(exec, args.at(i), aParameter->getJNIType(), aParameter->type());
-        JS_LOG("arg[%d] = %s\n", i, args.at(i).toString(exec).ascii());
-    }
-        
-    jvalue result;
-
-    // Try to use the JNI abstraction first, otherwise fall back to
-    // nornmal JNI.  The JNI dispatch abstraction allows the Java plugin
-    // to dispatch the call on the appropriate internal VM thread.
-    RootObject* rootObject = this->rootObject();
-    if (!rootObject)
-        return jsUndefined();
-
-    bool handled = false;
-    if (rootObject->nativeHandle()) {
-        jobject obj = _instance->_instance;
-        JSValue exceptionDescription;
-        const char *callingURL = 0;  // FIXME, need to propagate calling URL to Java
-        handled = dispatchJNICall(exec, rootObject->nativeHandle(), obj, jMethod->isStatic(), jMethod->JNIReturnType(), jMethod->methodID(obj), jArgs, result, callingURL, exceptionDescription);
-        if (exceptionDescription) {
-            throwError(exec, GeneralError, exceptionDescription.toString(exec));
-            free (jArgs);
-            return jsUndefined();
-        }
-    }
-    
-    // The following code can be conditionally removed once we have a Tiger update that
-    // contains the new Java plugin.  It is needed for builds prior to Tiger.
-    if (!handled) {    
-        jobject obj = _instance->_instance;
-        switch (jMethod->JNIReturnType()){
-            case void_type:
-                callJNIMethodIDA<void>(obj, jMethod->methodID(obj), jArgs);
-                break;            
-            case object_type:
-                result.l = callJNIMethodIDA<jobject>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            case boolean_type:
-                result.z = callJNIMethodIDA<jboolean>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            case byte_type:
-                result.b = callJNIMethodIDA<jbyte>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            case char_type:
-                result.c = callJNIMethodIDA<jchar>(obj, jMethod->methodID(obj), jArgs);
-                break;            
-            case short_type:
-                result.s = callJNIMethodIDA<jshort>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            case int_type:
-                result.i = callJNIMethodIDA<jint>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            
-            case long_type:
-                result.j = callJNIMethodIDA<jlong>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            case float_type:
-                result.f = callJNIMethodIDA<jfloat>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            case double_type:
-                result.d = callJNIMethodIDA<jdouble>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            case invalid_type:
-            default:
-                break;
-        }
-    }
-        
-    switch (jMethod->JNIReturnType()){
-        case void_type: {
-            resultValue = jsUndefined();
-        }
-        break;
-        
-        case object_type: {
-            if (result.l != 0) {
-                const char *arrayType = jMethod->returnType();
-                if (arrayType[0] == '[') {
-                    resultValue = JavaArray::convertJObjectToArray(exec, result.l, arrayType, rootObject);
-                }
-                else {
-                    resultValue = JavaInstance::create(result.l, rootObject)->createRuntimeObject(exec);
-                }
-            }
-            else {
-                resultValue = jsUndefined();
-            }
-        }
-        break;
-        
-        case boolean_type: {
-            resultValue = jsBoolean(result.z);
-        }
-        break;
-        
-        case byte_type: {
-            resultValue = jsNumber(exec, result.b);
-        }
-        break;
-        
-        case char_type: {
-            resultValue = jsNumber(exec, result.c);
-        }
-        break;
-        
-        case short_type: {
-            resultValue = jsNumber(exec, result.s);
-        }
-        break;
-        
-        case int_type: {
-            resultValue = jsNumber(exec, result.i);
-        }
-        break;
-        
-        case long_type: {
-            resultValue = jsNumber(exec, result.j);
-        }
-        break;
-        
-        case float_type: {
-            resultValue = jsNumber(exec, result.f);
-        }
-        break;
-        
-        case double_type: {
-            resultValue = jsNumber(exec, result.d);
-        }
-        break;
-
-        case invalid_type:
-        default: {
-            resultValue = jsUndefined();
-        }
-        break;
-    }
-
-    free (jArgs);
-
-    return resultValue;
-}
-
-JSValue JavaInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
-{
-    if (hint == PreferString)
-        return stringValue(exec);
-    if (hint == PreferNumber)
-        return numberValue(exec);
-    JavaClass *aClass = static_cast<JavaClass*>(getClass());
-    if (aClass->isStringClass())
-        return stringValue(exec);
-    if (aClass->isNumberClass())
-        return numberValue(exec);
-    if (aClass->isBooleanClass())
-        return booleanValue();
-    return valueOf(exec);
-}
-
-JSValue JavaInstance::valueOf(ExecState* exec) const 
-{
-    return stringValue(exec);
-}
-
-JObjectWrapper::JObjectWrapper(jobject instance)
-: _refCount(0)
-{
-    assert (instance != 0);
-
-    // Cache the JNIEnv used to get the global ref for this java instanace.
-    // It'll be used to delete the reference.
-    _env = getJNIEnv();
-        
-    _instance = _env->NewGlobalRef (instance);
-    
-    JS_LOG ("new global ref %p for %p\n", _instance, instance);
-
-    if  (_instance == NULL) {
-        fprintf (stderr, "%s:  could not get GlobalRef for %p\n", __PRETTY_FUNCTION__, instance);
-    }
-}
-
-JObjectWrapper::~JObjectWrapper() {
-    JS_LOG ("deleting global ref %p\n", _instance);
-    _env->DeleteGlobalRef (_instance);
-}
-
-#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
index cc28a75774..5e036ab33b 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
@@ -29,33 +29,27 @@
 #if ENABLE(MAC_JAVA_BRIDGE)
 
 #include "Frame.h"
+#include "JavaRuntimeObject.h"
+#include "JNIBridge.h"
+#include "JNIUtility.h"
+#include "JNIUtilityPrivate.h"
 #include "JSDOMBinding.h"
+#include "Logging.h"
 #include "ScriptController.h"
 #include "StringSourceProvider.h"
 #include "WebCoreFrameView.h"
-#include "jni_runtime.h"
-#include "jni_utility.h"
 #include "runtime_object.h"
 #include "runtime_root.h"
 #include <interpreter/CallFrame.h>
 #include <runtime/Completion.h>
 #include <runtime/JSGlobalObject.h>
 #include <runtime/JSLock.h>
-#include <wtf/Assertions.h>
 
 using WebCore::Frame;
 
 using namespace JSC::Bindings;
 using namespace JSC;
-
-#ifdef NDEBUG
-#define JS_LOG(formatAndArgs...) ((void)0)
-#else
-#define JS_LOG(formatAndArgs...) { \
-    fprintf (stderr, "%s(%p,%p):  ", __PRETTY_FUNCTION__, _performJavaScriptRunLoop, CFRunLoopGetCurrent()); \
-    fprintf(stderr, formatAndArgs); \
-}
-#endif
+using namespace WebCore;
 
 #define UndefinedHandle 1
 
@@ -67,12 +61,12 @@ static CFRunLoopSourceRef completionSource;
 
 static void completedJavaScriptAccess (void *i)
 {
-    assert (CFRunLoopGetCurrent() != _performJavaScriptRunLoop);
+    ASSERT(CFRunLoopGetCurrent() != _performJavaScriptRunLoop);
     
     JSObjectCallContext *callContext = (JSObjectCallContext *)i;
     CFRunLoopRef runLoop = (CFRunLoopRef)callContext->originatingLoop;
     
-    assert (CFRunLoopGetCurrent() == runLoop);
+    ASSERT(CFRunLoopGetCurrent() == runLoop);
     
     CFRunLoopStop(runLoop);
 }
@@ -114,7 +108,7 @@ static void dispatchToJavaScriptThread(JSObjectCallContext *context)
     
     CFRunLoopRef currentRunLoop = CFRunLoopGetCurrent();
     
-    assert (currentRunLoop != _performJavaScriptRunLoop);
+    ASSERT(currentRunLoop != _performJavaScriptRunLoop);
     
     // Setup a source to signal once the invocation of the JavaScript
     // call completes.
@@ -127,7 +121,7 @@ static void dispatchToJavaScriptThread(JSObjectCallContext *context)
     completionSource = CFRunLoopSourceCreate(NULL, 0, &sourceContext);
     CFRunLoopAddSource(currentRunLoop, completionSource, kCFRunLoopDefaultMode);
     
-    // Wakeup JavaScript access thread and make it do it's work.
+    // Wakeup JavaScript access thread and make it do its work.
     CFRunLoopSourceSignal(_performJavaScriptSource);
     if (CFRunLoopIsWaiting(_performJavaScriptRunLoop))
         CFRunLoopWakeUp(_performJavaScriptRunLoop);
@@ -143,7 +137,7 @@ static void dispatchToJavaScriptThread(JSObjectCallContext *context)
 
 static void performJavaScriptAccess(void*)
 {
-    assert (CFRunLoopGetCurrent() == _performJavaScriptRunLoop);
+    ASSERT(CFRunLoopGetCurrent() == _performJavaScriptRunLoop);
     
     // Dispatch JavaScript calls here.
     CFRunLoopSourceContext sourceContext;
@@ -204,7 +198,7 @@ jvalue JavaJSObject::invoke(JSObjectCallContext *context)
         else {
             JSObject *imp = jlong_to_impptr(nativeHandle);
             if (!findProtectingRootObject(imp)) {
-                fprintf (stderr, "%s:%d:  Attempt to access JavaScript from destroyed applet, type %d.\n", __FILE__, __LINE__, context->type);
+                LOG_ERROR("Attempt to access JavaScript from destroyed applet, type %d.", context->type);
                 return result;
             }
 
@@ -255,7 +249,7 @@ jvalue JavaJSObject::invoke(JSObjectCallContext *context)
                 }
                 
                 default: {
-                    fprintf (stderr, "%s:  invalid JavaScript call\n", __PRETTY_FUNCTION__);
+                    LOG_ERROR("invalid JavaScript call");
                 }
             }
         }
@@ -282,7 +276,7 @@ RootObject* JavaJSObject::rootObject() const
 
 jobject JavaJSObject::call(jstring methodName, jobjectArray args) const
 {
-    JS_LOG ("methodName = %s\n", JavaString(methodName).UTF8String());
+    LOG(LiveConnect, "JavaJSObject::call methodName = %s", JavaString(methodName).UTF8String());
 
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
@@ -303,7 +297,7 @@ jobject JavaJSObject::call(jstring methodName, jobjectArray args) const
     MarkedArgumentBuffer argList;
     getListFromJArray(exec, args, argList);
     rootObject->globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = WebCore::callInWorld(exec, function, callType, callData, _imp, argList, WebCore::pluginWorld());
+    JSValue result = JSC::call(exec, function, callType, callData, _imp, argList);
     rootObject->globalObject()->globalData()->timeoutChecker.stop();
 
     return convertValueToJObject(result);
@@ -311,7 +305,7 @@ jobject JavaJSObject::call(jstring methodName, jobjectArray args) const
 
 jobject JavaJSObject::eval(jstring script) const
 {
-    JS_LOG ("script = %s\n", JavaString(script).UTF8String());
+    LOG(LiveConnect, "JavaJSObject::eval script = %s", JavaString(script).UTF8String());
     
     JSValue result;
 
@@ -322,7 +316,7 @@ jobject JavaJSObject::eval(jstring script) const
         return 0;
 
     rootObject->globalObject()->globalData()->timeoutChecker.start();
-    Completion completion = WebCore::evaluateInWorld(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script)), JSC::JSValue(), WebCore::pluginWorld());
+    Completion completion = JSC::evaluate(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script)), JSC::JSValue());
     rootObject->globalObject()->globalData()->timeoutChecker.stop();
     ComplType type = completion.complType();
     
@@ -338,7 +332,7 @@ jobject JavaJSObject::eval(jstring script) const
 
 jobject JavaJSObject::getMember(jstring memberName) const
 {
-    JS_LOG ("(%p) memberName = %s\n", _imp, JavaString(memberName).UTF8String());
+    LOG(LiveConnect, "JavaJSObject::getMember (%p) memberName = %s", _imp, JavaString(memberName).UTF8String());
 
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
@@ -354,7 +348,7 @@ jobject JavaJSObject::getMember(jstring memberName) const
 
 void JavaJSObject::setMember(jstring memberName, jobject value) const
 {
-    JS_LOG ("memberName = %s, value = %p\n", JavaString(memberName).UTF8String(), value);
+    LOG(LiveConnect, "JavaJSObject::setMember memberName = %s, value = %p", JavaString(memberName).UTF8String(), value);
 
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
@@ -370,7 +364,7 @@ void JavaJSObject::setMember(jstring memberName, jobject value) const
 
 void JavaJSObject::removeMember(jstring memberName) const
 {
-    JS_LOG ("memberName = %s\n", JavaString(memberName).UTF8String());
+    LOG(LiveConnect, "JavaJSObject::removeMember memberName = %s", JavaString(memberName).UTF8String());
 
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
@@ -384,11 +378,7 @@ void JavaJSObject::removeMember(jstring memberName) const
 
 jobject JavaJSObject::getSlot(jint index) const
 {
-#ifdef __LP64__
-    JS_LOG ("index = %d\n", index);
-#else
-    JS_LOG ("index = %ld\n", index);
-#endif
+    LOG(LiveConnect, "JavaJSObject::getSlot index = %ld", static_cast<long>(index));
 
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
@@ -405,11 +395,7 @@ jobject JavaJSObject::getSlot(jint index) const
 
 void JavaJSObject::setSlot(jint index, jobject value) const
 {
-#ifdef __LP64__
-    JS_LOG ("index = %d, value = %p\n", index, value);
-#else
-    JS_LOG ("index = %ld, value = %p\n", index, value);
-#endif
+    LOG(LiveConnect, "JavaJSObject::setSlot index = %ld, value = %p", static_cast<long>(index), value);
 
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
@@ -423,7 +409,7 @@ void JavaJSObject::setSlot(jint index, jobject value) const
 
 jstring JavaJSObject::toString() const
 {
-    JS_LOG ("\n");
+    LOG(LiveConnect, "JavaJSObject::toString");
     
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
@@ -433,7 +419,7 @@ jstring JavaJSObject::toString() const
     JSObject *thisObj = const_cast<JSObject*>(_imp);
     ExecState* exec = rootObject->globalObject()->globalExec();
     
-    return (jstring)convertValueToJValue (exec, thisObj, object_type, "java.lang.String").l;
+    return static_cast<jstring>(convertValueToJValue(exec, rootObject, thisObj, object_type, "java.lang.String").l);
 }
 
 void JavaJSObject::finalize() const
@@ -461,7 +447,7 @@ static PassRefPtr<RootObject> createRootObject(void* nativeHandle)
 // another JavaJSObject.
 jlong JavaJSObject::createNative(jlong nativeHandle)
 {
-    JS_LOG ("nativeHandle = %d\n", (int)nativeHandle);
+    LOG(LiveConnect, "JavaJSObject::createNative nativeHandle = %d", static_cast<int>(nativeHandle));
 
     if (nativeHandle == UndefinedHandle)
         return nativeHandle;
@@ -527,31 +513,29 @@ jobject JavaJSObject::convertValueToJObject(JSValue value) const
         jlong nativeHandle;
         
         if (value.isObject()) {
-            JSObject* imp = asObject(value);
+            JSObject* object = asObject(value);
             
             // We either have a wrapper around a Java instance or a JavaScript
             // object.  If we have a wrapper around a Java instance, return that
             // instance, otherwise create a new Java JavaJSObject with the JSObject*
-            // as it's nativeHandle.
-            if (imp->classInfo() && strcmp(imp->classInfo()->className, "RuntimeObject") == 0) {
-                RuntimeObjectImp* runtimeImp = static_cast<RuntimeObjectImp*>(imp);
-                JavaInstance *runtimeInstance = static_cast<JavaInstance *>(runtimeImp->getInternalInstance());
+            // as its nativeHandle.
+            if (object->inherits(&JavaRuntimeObject::s_info)) {
+                JavaRuntimeObject* runtimeObject = static_cast<JavaRuntimeObject*>(object);
+                JavaInstance* runtimeInstance = runtimeObject->getInternalJavaInstance();
                 if (!runtimeInstance)
                     return 0;
                 
                 return runtimeInstance->javaInstance();
+            } else {
+                nativeHandle = ptr_to_jlong(object);
+                rootObject->gcProtect(object);
             }
-            else {
-                nativeHandle = ptr_to_jlong(imp);
-                rootObject->gcProtect(imp);
-            }
-        }
+        } else {
         // All other types will result in an undefined object.
-        else {
             nativeHandle = UndefinedHandle;
         }
         
-        // Now create the Java JavaJSObject.  Look for the JavaJSObject in it's new (Tiger)
+        // Now create the Java JavaJSObject.  Look for the JavaJSObject in its new (Tiger)
         // location and in the original Java 1.4.2 location.
         jclass JSObjectClass;
         
@@ -579,30 +563,31 @@ JSValue JavaJSObject::convertJObjectToValue(ExecState* exec, jobject theObject)
     // See section 22.7 of 'JavaScript:  The Definitive Guide, 4th Edition',
     // figure 22-4.
     jobject classOfInstance = callJNIMethod<jobject>(theObject, "getClass", "()Ljava/lang/Class;");
-    jstring className = (jstring)callJNIMethod<jobject>(classOfInstance, "getName", "()Ljava/lang/String;");
-    
+    if (!classOfInstance) {
+        JSLock lock(SilenceAssertionsOnly);
+        return JavaInstance::create(theObject, _rootObject)->createRuntimeObject(exec);
+    }
+
     // Only the sun.plugin.javascript.webkit.JSObject has a member called nativeJSObject. This class is
     // created above to wrap internal browser objects. The constructor of this class takes the native
     // pointer and stores it in this object, so that it can be retrieved below.
-    if (strcmp(JavaString(className).UTF8String(), "sun.plugin.javascript.webkit.JSObject") == 0) {
-        // Pull the nativeJSObject value from the Java instance.  This is a
-        // pointer to the JSObject.
-        JNIEnv *env = getJNIEnv();
-        jfieldID fieldID = env->GetFieldID((jclass)classOfInstance, "nativeJSObject", "J");
-        if (fieldID == NULL) {
-            return jsUndefined();
-        }
-        jlong nativeHandle = env->GetLongField(theObject, fieldID);
-        if (nativeHandle == UndefinedHandle) {
-            return jsUndefined();
-        }
-        JSObject *imp = static_cast<JSObject*>(jlong_to_impptr(nativeHandle));
-        return imp;
+    jstring className = (jstring)callJNIMethod<jobject>(classOfInstance, "getName", "()Ljava/lang/String;");
+    if (!className || (strcmp(JavaString(className).UTF8String(), "sun.plugin.javascript.webkit.JSObject") != 0)) {
+        JSLock lock(SilenceAssertionsOnly);
+        return JavaInstance::create(theObject, _rootObject)->createRuntimeObject(exec);
     }
 
-    JSLock lock(SilenceAssertionsOnly);
-
-    return JavaInstance::create(theObject, _rootObject)->createRuntimeObject(exec);
+    // Pull the nativeJSObject value from the Java instance.  This is a
+    // pointer to the JSObject.
+    JNIEnv *env = getJNIEnv();
+    jfieldID fieldID = env->GetFieldID((jclass)classOfInstance, "nativeJSObject", "J");
+    if (fieldID == NULL)
+        return jsUndefined();
+    jlong nativeHandle = env->GetLongField(theObject, fieldID);
+    if (nativeHandle == UndefinedHandle)
+        return jsUndefined();
+    JSObject *imp = static_cast<JSObject*>(jlong_to_impptr(nativeHandle));
+    return imp;
 }
 
 void JavaJSObject::getListFromJArray(ExecState* exec, jobjectArray jArray, MarkedArgumentBuffer& list) const
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm b/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm
index 0306bfd117..e2e71c5900 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm
@@ -28,7 +28,8 @@
 #if ENABLE(MAC_JAVA_BRIDGE)
 
 #import <Foundation/Foundation.h>
-#import "jni_utility.h"
+#import "JNIUtility.h"
+#import "JNIUtilityPrivate.h"
 #import "objc_utility.h"
 #include <runtime/JSLock.h>
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.cpp
deleted file mode 100644
index cc48037419..0000000000
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.cpp
+++ /dev/null
@@ -1,547 +0,0 @@
-/*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include <jni_runtime.h>
-
-#if ENABLE(MAC_JAVA_BRIDGE)
-
-#include <jni_utility.h>
-
-#include "runtime_array.h"
-#include "runtime_object.h"
-#include "runtime_root.h"
-#include <runtime/Error.h>
-#include <runtime/JSLock.h>
-
-#ifdef NDEBUG
-#define JS_LOG(formatAndArgs...) ((void)0)
-#else
-#define JS_LOG(formatAndArgs...) { \
-    fprintf (stderr, "%s:%d -- %s:  ", __FILE__, __LINE__, __FUNCTION__); \
-    fprintf(stderr, formatAndArgs); \
-}
-#endif
-
-using namespace JSC;
-using namespace JSC::Bindings;
-
-
-JavaParameter::JavaParameter (JNIEnv *env, jstring type)
-{
-    _type = JavaString (env, type);
-    _JNIType = JNITypeFromClassName (_type.UTF8String());
-}
-
-JavaField::JavaField (JNIEnv *env, jobject aField)
-{
-    // Get field type
-    jobject fieldType = callJNIMethod<jobject>(aField, "getType", "()Ljava/lang/Class;");
-    jstring fieldTypeName = (jstring)callJNIMethod<jobject>(fieldType, "getName", "()Ljava/lang/String;");
-    _type = JavaString(env, fieldTypeName);
-    _JNIType = JNITypeFromClassName (_type.UTF8String());
-
-    // Get field name
-    jstring fieldName = (jstring)callJNIMethod<jobject>(aField, "getName", "()Ljava/lang/String;");
-    _name = JavaString(env, fieldName);
-
-    _field = new JObjectWrapper(aField);
-}
-
-JSValue JavaArray::convertJObjectToArray(ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject> rootObject)
-{
-    if (type[0] != '[')
-        return jsUndefined();
-
-    return new (exec) RuntimeArray(exec, new JavaArray((jobject)anObject, type, rootObject));
-}
-
-jvalue JavaField::dispatchValueFromInstance(ExecState *exec, const JavaInstance *instance, const char *name, const char *sig, JNIType returnType) const
-{
-    jobject jinstance = instance->javaInstance();
-    jobject fieldJInstance = _field->_instance;
-    JNIEnv *env = getJNIEnv();
-    jvalue result;
-
-    bzero (&result, sizeof(jvalue));
-    jclass cls = env->GetObjectClass(fieldJInstance);
-    if ( cls != NULL ) {
-        jmethodID mid = env->GetMethodID(cls, name, sig);
-        if ( mid != NULL )
-        {
-            RootObject* rootObject = instance->rootObject();
-            if (rootObject && rootObject->nativeHandle()) {
-                JSValue exceptionDescription;
-                jvalue args[1];
-                
-                args[0].l = jinstance;
-                dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, returnType, mid, args, result, 0, exceptionDescription);
-                if (exceptionDescription)
-                    throwError(exec, GeneralError, exceptionDescription.toString(exec));
-            }
-        }
-    }
-    return result;
-}
-
-JSValue JavaField::valueFromInstance(ExecState* exec, const Instance* i) const 
-{
-    const JavaInstance *instance = static_cast<const JavaInstance *>(i);
-
-    JSValue jsresult = jsUndefined();
-    
-    switch (_JNIType) {
-        case array_type:
-        case object_type: {
-            jvalue result = dispatchValueFromInstance (exec, instance, "get", "(Ljava/lang/Object;)Ljava/lang/Object;", object_type);
-            jobject anObject = result.l;
-
-            const char *arrayType = type();
-            if (arrayType[0] == '[') {
-                jsresult = JavaArray::convertJObjectToArray(exec, anObject, arrayType, instance->rootObject());
-            }
-            else if (anObject != 0){
-                jsresult = JavaInstance::create(anObject, instance->rootObject())->createRuntimeObject(exec);
-            }
-        }
-        break;
-            
-        case boolean_type:
-            jsresult = jsBoolean(dispatchValueFromInstance(exec, instance, "getBoolean", "(Ljava/lang/Object;)Z", boolean_type).z);
-            break;
-            
-        case byte_type:
-        case char_type:
-        case short_type:
-        
-        case int_type: {
-            jint value;
-            jvalue result = dispatchValueFromInstance (exec, instance, "getInt", "(Ljava/lang/Object;)I", int_type);
-            value = result.i;
-            jsresult = jsNumber(exec, (int)value);
-        }
-        break;
-
-        case long_type:
-        case float_type:
-        case double_type: {
-            jdouble value;
-            jvalue result = dispatchValueFromInstance (exec, instance, "getDouble", "(Ljava/lang/Object;)D", double_type);
-            value = result.i;
-            jsresult = jsNumber(exec, (double)value);
-        }
-        break;
-        default:
-        break;
-    }
-
-    JS_LOG ("getting %s = %s\n", UString(name()).UTF8String().c_str(), jsresult.toString(exec).ascii());
-    
-    return jsresult;
-}
-
-void JavaField::dispatchSetValueToInstance(ExecState *exec, const JavaInstance *instance, jvalue javaValue, const char *name, const char *sig) const
-{
-    jobject jinstance = instance->javaInstance();
-    jobject fieldJInstance = _field->_instance;
-    JNIEnv *env = getJNIEnv();
-
-    jclass cls = env->GetObjectClass(fieldJInstance);
-    if ( cls != NULL ) {
-        jmethodID mid = env->GetMethodID(cls, name, sig);
-        if ( mid != NULL )
-        {
-            RootObject* rootObject = instance->rootObject();
-            if (rootObject && rootObject->nativeHandle()) {
-                JSValue exceptionDescription;
-                jvalue args[2];
-                jvalue result;
-                
-                args[0].l = jinstance;
-                args[1] = javaValue;
-                dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, void_type, mid, args, result, 0, exceptionDescription);
-                if (exceptionDescription)
-                    throwError(exec, GeneralError, exceptionDescription.toString(exec));
-            }
-        }
-    }
-}
-
-void JavaField::setValueToInstance(ExecState* exec, const Instance* i, JSValue aValue) const
-{
-    const JavaInstance *instance = static_cast<const JavaInstance *>(i);
-    jvalue javaValue = convertValueToJValue (exec, aValue, _JNIType, type());
-
-    JS_LOG ("setting value %s to %s\n", UString(name()).UTF8String().c_str(), aValue.toString(exec).ascii());
-
-    switch (_JNIType) {
-        case array_type:
-        case object_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "set", "(Ljava/lang/Object;Ljava/lang/Object;)V");
-        }
-        break;
-            
-        case boolean_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setBoolean", "(Ljava/lang/Object;Z)V");
-        }
-        break;
-            
-        case byte_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setByte", "(Ljava/lang/Object;B)V");
-        }
-        break;
-
-        case char_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setChar", "(Ljava/lang/Object;C)V");
-        }
-        break;
-
-        case short_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setShort", "(Ljava/lang/Object;S)V");
-        }
-        break;
-
-        case int_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setInt", "(Ljava/lang/Object;I)V");
-        }
-        break;
-
-        case long_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setLong", "(Ljava/lang/Object;J)V");
-        }
-        break;
-
-        case float_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setFloat", "(Ljava/lang/Object;F)V");
-        }
-        break;
-
-        case double_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setDouble", "(Ljava/lang/Object;D)V");
-        }
-        break;
-        default:
-        break;
-    }
-}
-
-JavaMethod::JavaMethod (JNIEnv *env, jobject aMethod)
-{
-    // Get return type
-    jobject returnType = callJNIMethod<jobject>(aMethod, "getReturnType", "()Ljava/lang/Class;");
-    jstring returnTypeName = (jstring)callJNIMethod<jobject>(returnType, "getName", "()Ljava/lang/String;");
-    _returnType =JavaString (env, returnTypeName);
-    _JNIReturnType = JNITypeFromClassName (_returnType.UTF8String());
-    env->DeleteLocalRef (returnType);
-    env->DeleteLocalRef (returnTypeName);
-
-    // Get method name
-    jstring methodName = (jstring)callJNIMethod<jobject>(aMethod, "getName", "()Ljava/lang/String;");
-    _name = JavaString (env, methodName);
-    env->DeleteLocalRef (methodName);
-
-    // Get parameters
-    jarray jparameters = (jarray)callJNIMethod<jobject>(aMethod, "getParameterTypes", "()[Ljava/lang/Class;");
-    _numParameters = env->GetArrayLength (jparameters);
-    _parameters = new JavaParameter[_numParameters];
-    
-    int i;
-    for (i = 0; i < _numParameters; i++) {
-        jobject aParameter = env->GetObjectArrayElement ((jobjectArray)jparameters, i);
-        jstring parameterName = (jstring)callJNIMethod<jobject>(aParameter, "getName", "()Ljava/lang/String;");
-        _parameters[i] = JavaParameter(env, parameterName);
-        env->DeleteLocalRef (aParameter);
-        env->DeleteLocalRef (parameterName);
-    }
-    env->DeleteLocalRef (jparameters);
-
-    // Created lazily.
-    _signature = 0;
-    _methodID = 0;
-    
-    jclass modifierClass = env->FindClass("java/lang/reflect/Modifier");
-    int modifiers = callJNIMethod<jint>(aMethod, "getModifiers", "()I");
-    _isStatic = (bool)callJNIStaticMethod<jboolean>(modifierClass, "isStatic", "(I)Z", modifiers);
-}
-
-JavaMethod::~JavaMethod() 
-{
-    if (_signature)
-        free(_signature);
-    delete [] _parameters;
-};
-
-// JNI method signatures use '/' between components of a class name, but
-// we get '.' between components from the reflection API.
-static void appendClassName(UString& aString, const char* className)
-{
-    ASSERT(JSLock::lockCount() > 0);
-    
-    char *result, *cp = strdup(className);
-    
-    result = cp;
-    while (*cp) {
-        if (*cp == '.')
-            *cp = '/';
-        cp++;
-    }
-        
-    aString.append(result);
-
-    free (result);
-}
-
-const char *JavaMethod::signature() const 
-{
-    if (!_signature) {
-        JSLock lock(SilenceAssertionsOnly);
-
-        UString signatureBuilder("(");
-        for (int i = 0; i < _numParameters; i++) {
-            JavaParameter* aParameter = parameterAt(i);
-            JNIType _JNIType = aParameter->getJNIType();
-            if (_JNIType == array_type)
-                appendClassName(signatureBuilder, aParameter->type());
-            else {
-                signatureBuilder.append(signatureFromPrimitiveType(_JNIType));
-                if (_JNIType == object_type) {
-                    appendClassName(signatureBuilder, aParameter->type());
-                    signatureBuilder.append(";");
-                }
-            }
-        }
-        signatureBuilder.append(")");
-        
-        const char *returnType = _returnType.UTF8String();
-        if (_JNIReturnType == array_type) {
-            appendClassName(signatureBuilder, returnType);
-        } else {
-            signatureBuilder.append(signatureFromPrimitiveType(_JNIReturnType));
-            if (_JNIReturnType == object_type) {
-                appendClassName(signatureBuilder, returnType);
-                signatureBuilder.append(";");
-            }
-        }
-        
-        _signature = strdup(signatureBuilder.ascii());
-    }
-    
-    return _signature;
-}
-
-JNIType JavaMethod::JNIReturnType() const
-{
-    return _JNIReturnType;
-}
-
-jmethodID JavaMethod::methodID (jobject obj) const
-{
-    if (_methodID == 0) {
-        _methodID = getMethodID (obj, _name.UTF8String(), signature());
-    }
-    return _methodID;
-}
-
-
-JavaArray::JavaArray(jobject array, const char* type, PassRefPtr<RootObject> rootObject)
-    : Array(rootObject)
-{
-    _array = new JObjectWrapper(array);
-    // Java array are fixed length, so we can cache length.
-    JNIEnv *env = getJNIEnv();
-    _length = env->GetArrayLength((jarray)_array->_instance);
-    _type = strdup(type);
-    _rootObject = rootObject;
-}
-
-JavaArray::~JavaArray () 
-{
-    free ((void *)_type);
-}
-
-RootObject* JavaArray::rootObject() const 
-{ 
-    return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
-}
-
-void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValue aValue) const
-{
-    JNIEnv *env = getJNIEnv();
-    char *javaClassName = 0;
-    
-    JNIType arrayType = JNITypeFromPrimitiveType(_type[1]);
-    if (_type[1] == 'L'){
-        // The type of the array will be something like:
-        // "[Ljava.lang.string;".  This is guaranteed, so no need
-        // for extra sanity checks.
-        javaClassName = strdup(&_type[2]);
-        javaClassName[strchr(javaClassName, ';')-javaClassName] = 0;
-    }
-    jvalue aJValue = convertValueToJValue (exec, aValue, arrayType, javaClassName);
-    
-    switch (arrayType) {
-        case object_type: {
-            env->SetObjectArrayElement((jobjectArray)javaArray(), index, aJValue.l);
-            break;
-        }
-            
-        case boolean_type: {
-            env->SetBooleanArrayRegion((jbooleanArray)javaArray(), index, 1, &aJValue.z);
-            break;
-        }
-            
-        case byte_type: {
-            env->SetByteArrayRegion((jbyteArray)javaArray(), index, 1, &aJValue.b);
-            break;
-        }
-            
-        case char_type: {
-            env->SetCharArrayRegion((jcharArray)javaArray(), index, 1, &aJValue.c);
-            break;
-        }
-            
-        case short_type: {
-            env->SetShortArrayRegion((jshortArray)javaArray(), index, 1, &aJValue.s);
-            break;
-        }
-            
-        case int_type: {
-            env->SetIntArrayRegion((jintArray)javaArray(), index, 1, &aJValue.i);
-            break;
-        }
-            
-        case long_type: {
-            env->SetLongArrayRegion((jlongArray)javaArray(), index, 1, &aJValue.j);
-        }
-            
-        case float_type: {
-            env->SetFloatArrayRegion((jfloatArray)javaArray(), index, 1, &aJValue.f);
-            break;
-        }
-            
-        case double_type: {
-            env->SetDoubleArrayRegion((jdoubleArray)javaArray(), index, 1, &aJValue.d);
-            break;
-        }
-        default:
-        break;
-    }
-    
-    if (javaClassName)
-        free ((void *)javaClassName);
-}
-
-
-JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
-{
-    JNIEnv *env = getJNIEnv();
-    JNIType arrayType = JNITypeFromPrimitiveType(_type[1]);
-    switch (arrayType) {
-        case object_type: {
-            jobjectArray objectArray = (jobjectArray)javaArray();
-            jobject anObject;
-            anObject = env->GetObjectArrayElement(objectArray, index);
-
-            // No object?
-            if (!anObject) {
-                return jsNull();
-            }
-            
-            // Nested array?
-            if (_type[1] == '[') {
-                return JavaArray::convertJObjectToArray(exec, anObject, _type+1, rootObject());
-            }
-            // or array of other object type?
-            return JavaInstance::create(anObject, rootObject())->createRuntimeObject(exec);
-        }
-            
-        case boolean_type: {
-            jbooleanArray booleanArray = (jbooleanArray)javaArray();
-            jboolean aBoolean;
-            env->GetBooleanArrayRegion(booleanArray, index, 1, &aBoolean);
-            return jsBoolean(aBoolean);
-        }
-            
-        case byte_type: {
-            jbyteArray byteArray = (jbyteArray)javaArray();
-            jbyte aByte;
-            env->GetByteArrayRegion(byteArray, index, 1, &aByte);
-            return jsNumber(exec, aByte);
-        }
-            
-        case char_type: {
-            jcharArray charArray = (jcharArray)javaArray();
-            jchar aChar;
-            env->GetCharArrayRegion(charArray, index, 1, &aChar);
-            return jsNumber(exec, aChar);
-            break;
-        }
-            
-        case short_type: {
-            jshortArray shortArray = (jshortArray)javaArray();
-            jshort aShort;
-            env->GetShortArrayRegion(shortArray, index, 1, &aShort);
-            return jsNumber(exec, aShort);
-        }
-            
-        case int_type: {
-            jintArray intArray = (jintArray)javaArray();
-            jint anInt;
-            env->GetIntArrayRegion(intArray, index, 1, &anInt);
-            return jsNumber(exec, anInt);
-        }
-            
-        case long_type: {
-            jlongArray longArray = (jlongArray)javaArray();
-            jlong aLong;
-            env->GetLongArrayRegion(longArray, index, 1, &aLong);
-            return jsNumber(exec, aLong);
-        }
-            
-        case float_type: {
-            jfloatArray floatArray = (jfloatArray)javaArray();
-            jfloat aFloat;
-            env->GetFloatArrayRegion(floatArray, index, 1, &aFloat);
-            return jsNumber(exec, aFloat);
-        }
-            
-        case double_type: {
-            jdoubleArray doubleArray = (jdoubleArray)javaArray();
-            jdouble aDouble;
-            env->GetDoubleArrayRegion(doubleArray, index, 1, &aDouble);
-            return jsNumber(exec, aDouble);
-        }
-        default:
-        break;
-    }
-    return jsUndefined();
-}
-
-unsigned int JavaArray::getLength() const
-{
-    return _length;
-}
-
-#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.h b/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.h
deleted file mode 100644
index 81484ff372..0000000000
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.h
+++ /dev/null
@@ -1,191 +0,0 @@
-/*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef _JNI_RUNTIME_H_
-#define _JNI_RUNTIME_H_
-
-#if ENABLE(MAC_JAVA_BRIDGE)
-
-#include <jni_utility.h>
-#include <jni_instance.h>
-#include <runtime/JSLock.h>
-
-
-namespace JSC
-{
-
-namespace Bindings
-{
-
-typedef const char* RuntimeType;
-
-class JavaString
-{
-public:
-    JavaString()
-    {
-        JSLock lock(SilenceAssertionsOnly);
-        _rep = UString().rep();
-    }
-
-    void _commonInit (JNIEnv *e, jstring s)
-    {
-        int _size = e->GetStringLength (s);
-        const jchar *uc = getUCharactersFromJStringInEnv (e, s);
-        {
-            JSLock lock(SilenceAssertionsOnly);
-            _rep = UString(reinterpret_cast<const UChar*>(uc), _size).rep();
-        }
-        releaseUCharactersForJStringInEnv (e, s, uc);
-    }
-    
-    JavaString (JNIEnv *e, jstring s) {
-        _commonInit (e, s);
-    }
-    
-    JavaString (jstring s) {
-        _commonInit (getJNIEnv(), s);
-    }
-    
-    ~JavaString()
-    {
-        JSLock lock(SilenceAssertionsOnly);
-        _rep = 0;
-    }
-    
-    const char *UTF8String() const { 
-        if (_utf8String.c_str() == 0) {
-            JSLock lock(SilenceAssertionsOnly);
-            _utf8String = UString(_rep).UTF8String();
-        }
-        return _utf8String.c_str();
-    }
-    const jchar *uchars() const { return (const jchar *)_rep->data(); }
-    int length() const { return _rep->size(); }
-    operator UString() const { return UString(_rep); }
-
-private:
-    RefPtr<UString::Rep> _rep;
-    mutable CString _utf8String;
-};
-
-class JavaParameter
-{
-public:
-    JavaParameter () : _JNIType(invalid_type) {};
-    JavaParameter (JNIEnv *env, jstring type);
-    virtual ~JavaParameter() { }
-
-    RuntimeType type() const { return _type.UTF8String(); }
-    JNIType getJNIType() const { return _JNIType; }
-    
-private:
-    JavaString _type;
-    JNIType _JNIType;
-};
-
-
-class JavaField : public Field
-{
-public:
-    JavaField (JNIEnv *env, jobject aField);
-
-    virtual JSValue valueFromInstance(ExecState *exec, const Instance *instance) const;
-    virtual void setValueToInstance(ExecState *exec, const Instance *instance, JSValue aValue) const;
-    
-    UString::Rep* name() const { return ((UString)_name).rep(); }
-    virtual RuntimeType type() const { return _type.UTF8String(); }
-
-    JNIType getJNIType() const { return _JNIType; }
-    
-private:
-    void dispatchSetValueToInstance(ExecState *exec, const JavaInstance *instance, jvalue javaValue, const char *name, const char *sig) const;
-    jvalue dispatchValueFromInstance(ExecState *exec, const JavaInstance *instance, const char *name, const char *sig, JNIType returnType) const;
-
-    JavaString _name;
-    JavaString _type;
-    JNIType _JNIType;
-    RefPtr<JObjectWrapper> _field;
-};
-
-
-class JavaMethod : public Method
-{
-public:
-    JavaMethod(JNIEnv* env, jobject aMethod);
-    ~JavaMethod();
-
-    UString::Rep* name() const { return ((UString)_name).rep(); }
-    RuntimeType returnType() const { return _returnType.UTF8String(); };
-    JavaParameter* parameterAt(int i) const { return &_parameters[i]; };
-    int numParameters() const { return _numParameters; };
-    
-    const char *signature() const;
-    JNIType JNIReturnType() const;
-
-    jmethodID methodID (jobject obj) const;
-    
-    bool isStatic() const { return _isStatic; }
-
-private:
-    JavaParameter* _parameters;
-    int _numParameters;
-    JavaString _name;
-    mutable char* _signature;
-    JavaString _returnType;
-    JNIType _JNIReturnType;
-    mutable jmethodID _methodID;
-    bool _isStatic;
-};
-
-class JavaArray : public Array
-{
-public:
-    JavaArray(jobject array, const char* type, PassRefPtr<RootObject>);
-    virtual ~JavaArray();
-
-    RootObject* rootObject() const;
-
-    virtual void setValueAt(ExecState *exec, unsigned int index, JSValue aValue) const;
-    virtual JSValue valueAt(ExecState *exec, unsigned int index) const;
-    virtual unsigned int getLength() const;
-    
-    jobject javaArray() const { return _array->_instance; }
-
-    static JSValue convertJObjectToArray (ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject>);
-
-private:
-    RefPtr<JObjectWrapper> _array;
-    unsigned int _length;
-    const char *_type;
-};
-
-} // namespace Bindings
-
-} // namespace JSC
-
-#endif // ENABLE(MAC_JAVA_BRIDGE)
-
-#endif // _JNI_RUNTIME_H_
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.cpp
deleted file mode 100644
index 86075c933b..0000000000
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.cpp
+++ /dev/null
@@ -1,584 +0,0 @@
-/*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "jni_utility.h"
-
-#if ENABLE(MAC_JAVA_BRIDGE)
-
-#include "jni_runtime.h"
-#include "runtime_array.h"
-#include "runtime_object.h"
-#include <runtime/JSArray.h>
-#include <runtime/JSLock.h>
-#include <dlfcn.h>
-
-namespace JSC {
-
-namespace Bindings {
-
-static jint KJS_GetCreatedJavaVMs(JavaVM** vmBuf, jsize bufLen, jsize* nVMs)
-{
-    static void* javaVMFramework = 0;
-    if (!javaVMFramework)
-        javaVMFramework = dlopen("/System/Library/Frameworks/JavaVM.framework/JavaVM", RTLD_LAZY);
-    if (!javaVMFramework)
-        return JNI_ERR;
-
-    static jint(*functionPointer)(JavaVM**, jsize, jsize *) = 0;
-    if (!functionPointer)
-        functionPointer = (jint(*)(JavaVM**, jsize, jsize *))dlsym(javaVMFramework, "JNI_GetCreatedJavaVMs");
-    if (!functionPointer)
-        return JNI_ERR;
-    return functionPointer(vmBuf, bufLen, nVMs);
-}
-
-static JavaVM *jvm = 0;
-
-// Provide the ability for an outside component to specify the JavaVM to use
-// If the jvm value is set, the getJavaVM function below will just return. 
-// In getJNIEnv(), if AttachCurrentThread is called to a VM that is already
-// attached, the result is a no-op.
-void setJavaVM(JavaVM *javaVM)
-{
-    jvm = javaVM;
-}
-
-JavaVM *getJavaVM()
-{
-    if (jvm)
-        return jvm;
-
-    JavaVM *jvmArray[1];
-    jsize bufLen = 1;
-    jsize nJVMs = 0;
-    jint jniError = 0;
-
-    // Assumes JVM is already running ..., one per process
-    jniError = KJS_GetCreatedJavaVMs(jvmArray, bufLen, &nJVMs);
-    if ( jniError == JNI_OK && nJVMs > 0 ) {
-        jvm = jvmArray[0];
-    }
-    else 
-        fprintf(stderr, "%s: JNI_GetCreatedJavaVMs failed, returned %ld\n", __PRETTY_FUNCTION__, (long)jniError);
-        
-    return jvm;
-}
-
-JNIEnv* getJNIEnv()
-{
-    union {
-        JNIEnv* env;
-        void* dummy;
-    } u;
-    jint jniError = 0;
-
-    jniError = (getJavaVM())->AttachCurrentThread(&u.dummy, NULL);
-    if (jniError == JNI_OK)
-        return u.env;
-    else
-        fprintf(stderr, "%s: AttachCurrentThread failed, returned %ld\n", __PRETTY_FUNCTION__, (long)jniError);
-    return NULL;
-}
-
-jmethodID getMethodID (jobject obj, const char *name, const char *sig)
-{
-    JNIEnv *env = getJNIEnv();
-    jmethodID mid = 0;
-        
-    if ( env != NULL) {
-    jclass cls = env->GetObjectClass(obj);
-    if ( cls != NULL ) {
-            mid = env->GetMethodID(cls, name, sig);
-            if (!mid) {
-                env->ExceptionClear();
-                mid = env->GetStaticMethodID(cls, name, sig);
-                if (!mid) {
-                    env->ExceptionClear();
-                }
-            }
-        }
-        env->DeleteLocalRef(cls);
-    }
-    return mid;
-}
-
-const char *getCharactersFromJString (jstring aJString)
-{
-    return getCharactersFromJStringInEnv (getJNIEnv(), aJString);
-}
-
-void releaseCharactersForJString (jstring aJString, const char *s)
-{
-    releaseCharactersForJStringInEnv (getJNIEnv(), aJString, s);
-}
-
-const char *getCharactersFromJStringInEnv (JNIEnv *env, jstring aJString)
-{
-    jboolean isCopy;
-    const char *s = env->GetStringUTFChars((jstring)aJString, &isCopy);
-    if (!s) {
-        env->ExceptionDescribe();
-        env->ExceptionClear();
-                fprintf (stderr, "\n");
-    }
-    return s;
-}
-
-void releaseCharactersForJStringInEnv (JNIEnv *env, jstring aJString, const char *s)
-{
-    env->ReleaseStringUTFChars (aJString, s);
-}
-
-const jchar *getUCharactersFromJStringInEnv (JNIEnv *env, jstring aJString)
-{
-    jboolean isCopy;
-    const jchar *s = env->GetStringChars((jstring)aJString, &isCopy);
-    if (!s) {
-        env->ExceptionDescribe();
-        env->ExceptionClear();
-                fprintf (stderr, "\n");
-    }
-    return s;
-}
-
-void releaseUCharactersForJStringInEnv (JNIEnv *env, jstring aJString, const jchar *s)
-{
-    env->ReleaseStringChars (aJString, s);
-}
-
-JNIType JNITypeFromClassName(const char *name)
-{
-    JNIType type;
-    
-    if (strcmp("byte",name) == 0)
-        type = byte_type;
-    else if (strcmp("short",name) == 0)
-        type = short_type;
-    else if (strcmp("int",name) == 0)
-        type = int_type;
-    else if (strcmp("long",name) == 0)
-        type = long_type;
-    else if (strcmp("float",name) == 0)
-        type = float_type;
-    else if (strcmp("double",name) == 0)
-        type = double_type;
-    else if (strcmp("char",name) == 0)
-        type = char_type;
-    else if (strcmp("boolean",name) == 0)
-        type = boolean_type;
-    else if (strcmp("void",name) == 0)
-        type = void_type;
-    else if ('[' == name[0]) 
-        type = array_type;
-    else
-        type = object_type;
-        
-    return type;
-}
-
-const char *signatureFromPrimitiveType(JNIType type)
-{
-    switch (type){
-        case void_type: 
-            return "V";
-        
-        case array_type:
-            return "[";
-        
-        case object_type:
-            return "L";
-        
-        case boolean_type:
-            return "Z";
-        
-        case byte_type:
-            return "B";
-            
-        case char_type:
-            return "C";
-        
-        case short_type:
-            return "S";
-        
-        case int_type:
-            return "I";
-        
-        case long_type:
-            return "J";
-        
-        case float_type:
-            return "F";
-        
-        case double_type:
-            return "D";
-
-        case invalid_type:
-        default:
-        break;
-    }
-    return "";
-}
-
-JNIType JNITypeFromPrimitiveType(char type)
-{
-    switch (type){
-        case 'V': 
-            return void_type;
-        
-        case 'L':
-            return object_type;
-            
-        case '[':
-            return array_type;
-        
-        case 'Z':
-            return boolean_type;
-        
-        case 'B':
-            return byte_type;
-            
-        case 'C':
-            return char_type;
-        
-        case 'S':
-            return short_type;
-        
-        case 'I':
-            return int_type;
-        
-        case 'J':
-            return long_type;
-        
-        case 'F':
-            return float_type;
-        
-        case 'D':
-            return double_type;
-
-        default:
-        break;
-    }
-    return invalid_type;
-}
-
-jvalue getJNIField( jobject obj, JNIType type, const char *name, const char *signature)
-{
-    JavaVM *jvm = getJavaVM();
-    JNIEnv *env = getJNIEnv();
-    jvalue result;
-
-    bzero (&result, sizeof(jvalue));
-    if ( obj != NULL && jvm != NULL && env != NULL) {
-        jclass cls = env->GetObjectClass(obj);
-        if ( cls != NULL ) {
-            jfieldID field = env->GetFieldID(cls, name, signature);
-            if ( field != NULL ) {
-                switch (type) {
-                case array_type:
-                case object_type:
-                    result.l = env->functions->GetObjectField(env, obj, field);
-                    break;
-                case boolean_type:
-                    result.z = env->functions->GetBooleanField(env, obj, field);
-                    break;
-                case byte_type:
-                    result.b = env->functions->GetByteField(env, obj, field);
-                    break;
-                case char_type:
-                    result.c = env->functions->GetCharField(env, obj, field);
-                    break;
-                case short_type:
-                    result.s = env->functions->GetShortField(env, obj, field);
-                    break;
-                case int_type:
-                    result.i = env->functions->GetIntField(env, obj, field);
-                    break;
-                case long_type:
-                    result.j = env->functions->GetLongField(env, obj, field);
-                    break;
-                case float_type:
-                    result.f = env->functions->GetFloatField(env, obj, field);
-                    break;
-                case double_type:
-                    result.d = env->functions->GetDoubleField(env, obj, field);
-                    break;
-                default:
-                    fprintf(stderr, "%s: invalid field type (%d)\n", __PRETTY_FUNCTION__, (int)type);
-                }
-            }
-            else
-            {
-                fprintf(stderr, "%s: Could not find field: %s\n", __PRETTY_FUNCTION__, name);
-                env->ExceptionDescribe();
-                env->ExceptionClear();
-                fprintf (stderr, "\n");
-            }
-
-            env->DeleteLocalRef(cls);
-        }
-        else {
-            fprintf(stderr, "%s: Could not find class for object\n", __PRETTY_FUNCTION__);
-        }
-    }
-
-    return result;
-}
-
-static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray, const char* javaClassName)
-{
-    JNIEnv *env = getJNIEnv();
-    // As JS Arrays can contain a mixture of objects, assume we can convert to
-    // the requested Java Array type requested, unless the array type is some object array
-    // other than a string.
-    unsigned length = jsArray->length();
-    jobjectArray jarray = 0;
-    
-    // Build the correct array type
-    switch (JNITypeFromPrimitiveType(javaClassName[1])) { 
-        case object_type: {
-        // Only support string object types
-        if (0 == strcmp("[Ljava.lang.String;", javaClassName)) {
-            jarray = (jobjectArray)env->NewObjectArray(length,
-                env->FindClass("java/lang/String"),
-                env->NewStringUTF(""));
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                UString stringValue = item.toString(exec);
-                env->SetObjectArrayElement(jarray,i,
-                    env->functions->NewString(env, (const jchar *)stringValue.data(), stringValue.size()));
-                }
-            }
-            break;
-        }
-        
-        case boolean_type: {
-            jarray = (jobjectArray)env->NewBooleanArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                jboolean value = (jboolean)item.toNumber(exec);
-                env->SetBooleanArrayRegion((jbooleanArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-        
-        case byte_type: {
-            jarray = (jobjectArray)env->NewByteArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                jbyte value = (jbyte)item.toNumber(exec);
-                env->SetByteArrayRegion((jbyteArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-
-        case char_type: {
-            jarray = (jobjectArray)env->NewCharArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                UString stringValue = item.toString(exec);
-                jchar value = 0;
-                if (stringValue.size() > 0)
-                    value = ((const jchar*)stringValue.data())[0];
-                env->SetCharArrayRegion((jcharArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-
-        case short_type: {
-            jarray = (jobjectArray)env->NewShortArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                jshort value = (jshort)item.toNumber(exec);
-                env->SetShortArrayRegion((jshortArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-
-        case int_type: {
-            jarray = (jobjectArray)env->NewIntArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                jint value = (jint)item.toNumber(exec);
-                env->SetIntArrayRegion((jintArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-
-        case long_type: {
-            jarray = (jobjectArray)env->NewLongArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                jlong value = (jlong)item.toNumber(exec);
-                env->SetLongArrayRegion((jlongArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-
-        case float_type: {
-            jarray = (jobjectArray)env->NewFloatArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                jfloat value = (jfloat)item.toNumber(exec);
-                env->SetFloatArrayRegion((jfloatArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-    
-        case double_type: {
-            jarray = (jobjectArray)env->NewDoubleArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                jdouble value = (jdouble)item.toNumber(exec);
-                env->SetDoubleArrayRegion((jdoubleArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-        
-        case array_type: // don't handle embedded arrays
-        case void_type: // Don't expect arrays of void objects
-        case invalid_type: // Array of unknown objects
-            break;
-    }
-    
-    // if it was not one of the cases handled, then null is returned
-    return jarray;
-}
-
-
-jvalue convertValueToJValue(ExecState* exec, JSValue value, JNIType _JNIType, const char* javaClassName)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    
-    jvalue result;
-   
-    switch (_JNIType){
-        case array_type:
-        case object_type: {
-            result.l = (jobject)0;
-            
-            // First see if we have a Java instance.
-            if (value.isObject()){
-                JSObject* objectImp = asObject(value);
-                if (objectImp->classInfo() == &RuntimeObjectImp::s_info) {
-                    RuntimeObjectImp* imp = static_cast<RuntimeObjectImp*>(objectImp);
-                    JavaInstance *instance = static_cast<JavaInstance*>(imp->getInternalInstance());
-                    if (instance)
-                        result.l = instance->javaInstance();
-                }
-                else if (objectImp->classInfo() == &RuntimeArray::s_info) {
-                // Input is a JavaScript Array that was originally created from a Java Array
-                    RuntimeArray* imp = static_cast<RuntimeArray*>(objectImp);
-                    JavaArray *array = static_cast<JavaArray*>(imp->getConcreteArray());
-                    result.l = array->javaArray();
-                } 
-                else if (objectImp->classInfo() == &JSArray::info) {
-                    // Input is a Javascript Array. We need to create it to a Java Array.
-                    result.l = convertArrayInstanceToJavaArray(exec, asArray(value), javaClassName);
-                }
-            }
-            
-            // Now convert value to a string if the target type is a java.lang.string, and we're not
-            // converting from a Null.
-            if (result.l == 0 && strcmp(javaClassName, "java.lang.String") == 0) {
-#ifdef CONVERT_NULL_TO_EMPTY_STRING
-                if (value->isNull()) {
-                    JNIEnv *env = getJNIEnv();
-                    jchar buf[2];
-                    jobject javaString = env->functions->NewString (env, buf, 0);
-                    result.l = javaString;
-                }
-                else 
-#else
-                if (!value.isNull())
-#endif
-                {
-                    UString stringValue = value.toString(exec);
-                    JNIEnv *env = getJNIEnv();
-                    jobject javaString = env->functions->NewString (env, (const jchar *)stringValue.data(), stringValue.size());
-                    result.l = javaString;
-                }
-            } else if (result.l == 0) 
-                bzero (&result, sizeof(jvalue)); // Handle it the same as a void case
-        }
-        break;
-        
-        case boolean_type: {
-            result.z = (jboolean)value.toNumber(exec);
-        }
-        break;
-            
-        case byte_type: {
-            result.b = (jbyte)value.toNumber(exec);
-        }
-        break;
-        
-        case char_type: {
-            result.c = (jchar)value.toNumber(exec);
-        }
-        break;
-
-        case short_type: {
-            result.s = (jshort)value.toNumber(exec);
-        }
-        break;
-
-        case int_type: {
-            result.i = (jint)value.toNumber(exec);
-        }
-        break;
-
-        case long_type: {
-            result.j = (jlong)value.toNumber(exec);
-        }
-        break;
-
-        case float_type: {
-            result.f = (jfloat)value.toNumber(exec);
-        }
-        break;
-
-        case double_type: {
-            result.d = (jdouble)value.toNumber(exec);
-        }
-        break;
-            
-        break;
-
-        case invalid_type:
-        default:
-        case void_type: {
-            bzero (&result, sizeof(jvalue));
-        }
-        break;
-    }
-    return result;
-}
-
-}  // end of namespace Bindings
-
-} // end of namespace JSC
-
-#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIBridgeJSC.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIBridgeJSC.cpp
new file mode 100644
index 0000000000..5fce148405
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIBridgeJSC.cpp
@@ -0,0 +1,445 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JNIBridgeJSC.h"
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "JNIUtilityPrivate.h"
+#include "Logging.h"
+#include "runtime_array.h"
+#include "runtime_object.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+using namespace JSC::Bindings;
+using namespace WebCore;
+
+JavaField::JavaField(JNIEnv* env, jobject aField)
+{
+    // Get field type name
+    jstring fieldTypeName = 0;
+    if (jobject fieldType = callJNIMethod<jobject>(aField, "getType", "()Ljava/lang/Class;"))
+        fieldTypeName = static_cast<jstring>(callJNIMethod<jobject>(fieldType, "getName", "()Ljava/lang/String;"));
+    if (!fieldTypeName)
+        fieldTypeName = env->NewStringUTF("<Unknown>");
+    m_type = JavaString(env, fieldTypeName);
+
+    m_JNIType = JNITypeFromClassName(m_type.UTF8String());
+
+    // Get field name
+    jstring fieldName = static_cast<jstring>(callJNIMethod<jobject>(aField, "getName", "()Ljava/lang/String;"));
+    if (!fieldName)
+        fieldName = env->NewStringUTF("<Unknown>");
+    m_name = JavaString(env, fieldName);
+
+    m_field = new JObjectWrapper(aField);
+}
+
+JSValue JavaArray::convertJObjectToArray(ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject> rootObject)
+{
+    if (type[0] != '[')
+        return jsUndefined();
+
+    return new (exec) RuntimeArray(exec, new JavaArray(anObject, type, rootObject));
+}
+
+jvalue JavaField::dispatchValueFromInstance(ExecState* exec, const JavaInstance* instance, const char* name, const char* sig, JNIType returnType) const
+{
+    jobject jinstance = instance->javaInstance();
+    jobject fieldJInstance = m_field->m_instance;
+    JNIEnv* env = getJNIEnv();
+    jvalue result;
+
+    memset(&result, 0, sizeof(jvalue));
+    jclass cls = env->GetObjectClass(fieldJInstance);
+    if (cls) {
+        jmethodID mid = env->GetMethodID(cls, name, sig);
+        if (mid) {
+            RootObject* rootObject = instance->rootObject();
+            if (rootObject && rootObject->nativeHandle()) {
+                JSValue exceptionDescription;
+                jvalue args[1];
+
+                args[0].l = jinstance;
+                dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, returnType, mid, args, result, 0, exceptionDescription);
+                if (exceptionDescription)
+                    throwError(exec, GeneralError, exceptionDescription.toString(exec));
+            }
+        }
+    }
+    return result;
+}
+
+JSValue JavaField::valueFromInstance(ExecState* exec, const Instance* i) const
+{
+    const JavaInstance* instance = static_cast<const JavaInstance*>(i);
+
+    JSValue jsresult = jsUndefined();
+
+    switch (m_JNIType) {
+    case array_type:
+    case object_type:
+        {
+            jvalue result = dispatchValueFromInstance(exec, instance, "get", "(Ljava/lang/Object;)Ljava/lang/Object;", object_type);
+            jobject anObject = result.l;
+
+            if (!anObject)
+                return jsNull();
+
+            const char* arrayType = type();
+            if (arrayType[0] == '[')
+                jsresult = JavaArray::convertJObjectToArray(exec, anObject, arrayType, instance->rootObject());
+            else if (anObject)
+                jsresult = JavaInstance::create(anObject, instance->rootObject())->createRuntimeObject(exec);
+        }
+        break;
+
+    case boolean_type:
+        jsresult = jsBoolean(dispatchValueFromInstance(exec, instance, "getBoolean", "(Ljava/lang/Object;)Z", boolean_type).z);
+        break;
+
+    case byte_type:
+    case char_type:
+    case short_type:
+
+    case int_type:
+        {
+            jint value;
+            jvalue result = dispatchValueFromInstance(exec, instance, "getInt", "(Ljava/lang/Object;)I", int_type);
+            value = result.i;
+            jsresult = jsNumber(exec, static_cast<int>(value));
+        }
+        break;
+
+    case long_type:
+    case float_type:
+    case double_type:
+        {
+            jdouble value;
+            jvalue result = dispatchValueFromInstance(exec, instance, "getDouble", "(Ljava/lang/Object;)D", double_type);
+            value = result.i;
+            jsresult = jsNumber(exec, static_cast<double>(value));
+        }
+        break;
+    default:
+        break;
+    }
+
+    LOG(LiveConnect, "JavaField::valueFromInstance getting %s = %s", UString(name()).UTF8String().c_str(), jsresult.toString(exec).ascii());
+
+    return jsresult;
+}
+
+void JavaField::dispatchSetValueToInstance(ExecState* exec, const JavaInstance* instance, jvalue javaValue, const char* name, const char* sig) const
+{
+    jobject jinstance = instance->javaInstance();
+    jobject fieldJInstance = m_field->m_instance;
+    JNIEnv* env = getJNIEnv();
+
+    jclass cls = env->GetObjectClass(fieldJInstance);
+    if (cls) {
+        jmethodID mid = env->GetMethodID(cls, name, sig);
+        if (mid) {
+            RootObject* rootObject = instance->rootObject();
+            if (rootObject && rootObject->nativeHandle()) {
+                JSValue exceptionDescription;
+                jvalue args[2];
+                jvalue result;
+
+                args[0].l = jinstance;
+                args[1] = javaValue;
+                dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, void_type, mid, args, result, 0, exceptionDescription);
+                if (exceptionDescription)
+                    throwError(exec, GeneralError, exceptionDescription.toString(exec));
+            }
+        }
+    }
+}
+
+void JavaField::setValueToInstance(ExecState* exec, const Instance* i, JSValue aValue) const
+{
+    const JavaInstance* instance = static_cast<const JavaInstance*>(i);
+    jvalue javaValue = convertValueToJValue(exec, i->rootObject(), aValue, m_JNIType, type());
+
+    LOG(LiveConnect, "JavaField::setValueToInstance setting value %s to %s", UString(name()).UTF8String().c_str(), aValue.toString(exec).ascii());
+
+    switch (m_JNIType) {
+    case array_type:
+    case object_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "set", "(Ljava/lang/Object;Ljava/lang/Object;)V");
+        }
+        break;
+
+    case boolean_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setBoolean", "(Ljava/lang/Object;Z)V");
+        }
+        break;
+
+    case byte_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setByte", "(Ljava/lang/Object;B)V");
+        }
+        break;
+
+    case char_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setChar", "(Ljava/lang/Object;C)V");
+        }
+        break;
+
+    case short_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setShort", "(Ljava/lang/Object;S)V");
+        }
+        break;
+
+    case int_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setInt", "(Ljava/lang/Object;I)V");
+        }
+        break;
+
+    case long_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setLong", "(Ljava/lang/Object;J)V");
+        }
+        break;
+
+    case float_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setFloat", "(Ljava/lang/Object;F)V");
+        }
+        break;
+
+    case double_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setDouble", "(Ljava/lang/Object;D)V");
+        }
+        break;
+    default:
+        break;
+    }
+}
+
+JavaArray::JavaArray(jobject array, const char* type, PassRefPtr<RootObject> rootObject)
+    : Array(rootObject)
+{
+    m_array = new JObjectWrapper(array);
+    // Java array are fixed length, so we can cache length.
+    JNIEnv* env = getJNIEnv();
+    m_length = env->GetArrayLength(static_cast<jarray>(m_array->m_instance));
+    m_type = strdup(type);
+}
+
+JavaArray::~JavaArray()
+{
+    free(const_cast<char*>(m_type));
+}
+
+RootObject* JavaArray::rootObject() const
+{
+    return m_rootObject && m_rootObject->isValid() ? m_rootObject.get() : 0;
+}
+
+void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValue aValue) const
+{
+    JNIEnv* env = getJNIEnv();
+    char* javaClassName = 0;
+
+    JNIType arrayType = JNITypeFromPrimitiveType(m_type[1]);
+    if (m_type[1] == 'L') {
+        // The type of the array will be something like:
+        // "[Ljava.lang.string;".  This is guaranteed, so no need
+        // for extra sanity checks.
+        javaClassName = strdup(&m_type[2]);
+        javaClassName[strchr(javaClassName, ';')-javaClassName] = 0;
+    }
+    jvalue aJValue = convertValueToJValue(exec, m_rootObject.get(), aValue, arrayType, javaClassName);
+
+    switch (arrayType) {
+    case object_type:
+        {
+            env->SetObjectArrayElement(static_cast<jobjectArray>(javaArray()), index, aJValue.l);
+            break;
+        }
+
+    case boolean_type:
+        {
+            env->SetBooleanArrayRegion(static_cast<jbooleanArray>(javaArray()), index, 1, &aJValue.z);
+            break;
+        }
+
+    case byte_type:
+        {
+            env->SetByteArrayRegion(static_cast<jbyteArray>(javaArray()), index, 1, &aJValue.b);
+            break;
+        }
+
+    case char_type:
+        {
+            env->SetCharArrayRegion(static_cast<jcharArray>(javaArray()), index, 1, &aJValue.c);
+            break;
+        }
+
+    case short_type:
+        {
+            env->SetShortArrayRegion(static_cast<jshortArray>(javaArray()), index, 1, &aJValue.s);
+            break;
+        }
+
+    case int_type:
+        {
+            env->SetIntArrayRegion(static_cast<jintArray>(javaArray()), index, 1, &aJValue.i);
+            break;
+        }
+
+    case long_type:
+        {
+            env->SetLongArrayRegion(static_cast<jlongArray>(javaArray()), index, 1, &aJValue.j);
+        }
+
+    case float_type:
+        {
+            env->SetFloatArrayRegion(static_cast<jfloatArray>(javaArray()), index, 1, &aJValue.f);
+            break;
+        }
+
+    case double_type:
+        {
+            env->SetDoubleArrayRegion(static_cast<jdoubleArray>(javaArray()), index, 1, &aJValue.d);
+            break;
+        }
+    default:
+        break;
+    }
+
+    if (javaClassName)
+        free(const_cast<char*>(javaClassName));
+}
+
+
+JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
+{
+    JNIEnv* env = getJNIEnv();
+    JNIType arrayType = JNITypeFromPrimitiveType(m_type[1]);
+    switch (arrayType) {
+    case object_type:
+        {
+            jobjectArray objectArray = static_cast<jobjectArray>(javaArray());
+            jobject anObject;
+            anObject = env->GetObjectArrayElement(objectArray, index);
+
+            // No object?
+            if (!anObject)
+                return jsNull();
+
+            // Nested array?
+            if (m_type[1] == '[')
+                return JavaArray::convertJObjectToArray(exec, anObject, m_type + 1, rootObject());
+            // or array of other object type?
+            return JavaInstance::create(anObject, rootObject())->createRuntimeObject(exec);
+        }
+
+    case boolean_type:
+        {
+            jbooleanArray booleanArray = static_cast<jbooleanArray>(javaArray());
+            jboolean aBoolean;
+            env->GetBooleanArrayRegion(booleanArray, index, 1, &aBoolean);
+            return jsBoolean(aBoolean);
+        }
+
+    case byte_type:
+        {
+            jbyteArray byteArray = static_cast<jbyteArray>(javaArray());
+            jbyte aByte;
+            env->GetByteArrayRegion(byteArray, index, 1, &aByte);
+            return jsNumber(exec, aByte);
+        }
+
+    case char_type:
+        {
+            jcharArray charArray = static_cast<jcharArray>(javaArray());
+            jchar aChar;
+            env->GetCharArrayRegion(charArray, index, 1, &aChar);
+            return jsNumber(exec, aChar);
+            break;
+        }
+
+    case short_type:
+        {
+            jshortArray shortArray = static_cast<jshortArray>(javaArray());
+            jshort aShort;
+            env->GetShortArrayRegion(shortArray, index, 1, &aShort);
+            return jsNumber(exec, aShort);
+        }
+
+    case int_type:
+        {
+            jintArray intArray = static_cast<jintArray>(javaArray());
+            jint anInt;
+            env->GetIntArrayRegion(intArray, index, 1, &anInt);
+            return jsNumber(exec, anInt);
+        }
+
+    case long_type:
+        {
+            jlongArray longArray = static_cast<jlongArray>(javaArray());
+            jlong aLong;
+            env->GetLongArrayRegion(longArray, index, 1, &aLong);
+            return jsNumber(exec, aLong);
+        }
+
+    case float_type:
+        {
+            jfloatArray floatArray = static_cast<jfloatArray>(javaArray());
+            jfloat aFloat;
+            env->GetFloatArrayRegion(floatArray, index, 1, &aFloat);
+            return jsNumber(exec, aFloat);
+        }
+
+    case double_type:
+        {
+            jdoubleArray doubleArray = static_cast<jdoubleArray>(javaArray());
+            jdouble aDouble;
+            env->GetDoubleArrayRegion(doubleArray, index, 1, &aDouble);
+            return jsNumber(exec, aDouble);
+        }
+    default:
+        break;
+    }
+    return jsUndefined();
+}
+
+unsigned int JavaArray::getLength() const
+{
+    return m_length;
+}
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIBridgeJSC.h b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIBridgeJSC.h
new file mode 100644
index 0000000000..902bd4e2fc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIBridgeJSC.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JNIBridgeJSC_h
+#define JNIBridgeJSC_h
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "Bridge.h"
+#include "JNIBridge.h"
+#include <JavaVM/jni.h>
+
+namespace JSC {
+
+namespace Bindings {
+
+class JavaField : public Field {
+public:
+    JavaField(JNIEnv*, jobject aField);
+
+    virtual JSValue valueFromInstance(ExecState*, const Instance*) const;
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const;
+
+    const JavaString& name() const { return m_name; }
+    virtual RuntimeType type() const { return m_type.UTF8String(); }
+
+    JNIType getJNIType() const { return m_JNIType; }
+
+private:
+    void dispatchSetValueToInstance(ExecState*, const JavaInstance*, jvalue, const char* name, const char* sig) const;
+    jvalue dispatchValueFromInstance(ExecState*, const JavaInstance*, const char* name, const char* sig, JNIType returnType) const;
+
+    JavaString m_name;
+    JavaString m_type;
+    JNIType m_JNIType;
+    RefPtr<JObjectWrapper> m_field;
+};
+
+class JavaArray : public Array {
+public:
+    JavaArray(jobject array, const char* type, PassRefPtr<RootObject>);
+    virtual ~JavaArray();
+
+    RootObject* rootObject() const;
+
+    virtual void setValueAt(ExecState*, unsigned int index, JSValue) const;
+    virtual JSValue valueAt(ExecState*, unsigned int index) const;
+    virtual unsigned int getLength() const;
+
+    jobject javaArray() const { return m_array->m_instance; }
+
+    static JSValue convertJObjectToArray(ExecState*, jobject, const char* type, PassRefPtr<RootObject>);
+
+private:
+    RefPtr<JObjectWrapper> m_array;
+    unsigned int m_length;
+    const char* m_type;
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
+
+#endif // JNIBridge_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp
new file mode 100644
index 0000000000..4702d12775
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp
@@ -0,0 +1,316 @@
+/*
+ * Copyright (C) 2003, 2010 Apple, Inc.  All rights reserved.
+ * Copyright 2009, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JNIUtilityPrivate.h"
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "JavaRuntimeObject.h"
+#include "JNIBridgeJSC.h"
+#include "runtime_array.h"
+#include "runtime_object.h"
+#include <runtime/JSArray.h>
+#include <runtime/JSLock.h>
+
+namespace JSC {
+
+namespace Bindings {
+
+static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray, const char* javaClassName)
+{
+    JNIEnv* env = getJNIEnv();
+    // As JS Arrays can contain a mixture of objects, assume we can convert to
+    // the requested Java Array type requested, unless the array type is some object array
+    // other than a string.
+    unsigned length = jsArray->length();
+    jobjectArray jarray = 0;
+
+    // Build the correct array type
+    switch (JNITypeFromPrimitiveType(javaClassName[1])) {
+    case object_type:
+            {
+            // Only support string object types
+            if (!strcmp("[Ljava.lang.String;", javaClassName)) {
+                jarray = (jobjectArray)env->NewObjectArray(length,
+                    env->FindClass("java/lang/String"),
+                    env->NewStringUTF(""));
+                for (unsigned i = 0; i < length; i++) {
+                    JSValue item = jsArray->get(exec, i);
+                    UString stringValue = item.toString(exec);
+                    env->SetObjectArrayElement(jarray, i,
+                        env->functions->NewString(env, (const jchar *)stringValue.data(), stringValue.size()));
+                }
+            }
+            break;
+        }
+
+    case boolean_type:
+        {
+            jarray = (jobjectArray)env->NewBooleanArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                jboolean value = (jboolean)item.toNumber(exec);
+                env->SetBooleanArrayRegion((jbooleanArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case byte_type:
+        {
+            jarray = (jobjectArray)env->NewByteArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                jbyte value = (jbyte)item.toNumber(exec);
+                env->SetByteArrayRegion((jbyteArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case char_type:
+        {
+            jarray = (jobjectArray)env->NewCharArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                UString stringValue = item.toString(exec);
+                jchar value = 0;
+                if (stringValue.size() > 0)
+                    value = ((const jchar*)stringValue.data())[0];
+                env->SetCharArrayRegion((jcharArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case short_type:
+        {
+            jarray = (jobjectArray)env->NewShortArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                jshort value = (jshort)item.toNumber(exec);
+                env->SetShortArrayRegion((jshortArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case int_type:
+        {
+            jarray = (jobjectArray)env->NewIntArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                jint value = (jint)item.toNumber(exec);
+                env->SetIntArrayRegion((jintArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case long_type:
+        {
+            jarray = (jobjectArray)env->NewLongArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                jlong value = (jlong)item.toNumber(exec);
+                env->SetLongArrayRegion((jlongArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case float_type:
+        {
+            jarray = (jobjectArray)env->NewFloatArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                jfloat value = (jfloat)item.toNumber(exec);
+                env->SetFloatArrayRegion((jfloatArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case double_type:
+        {
+            jarray = (jobjectArray)env->NewDoubleArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                jdouble value = (jdouble)item.toNumber(exec);
+                env->SetDoubleArrayRegion((jdoubleArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case array_type: // don't handle embedded arrays
+    case void_type: // Don't expect arrays of void objects
+    case invalid_type: // Array of unknown objects
+        break;
+    }
+
+    // if it was not one of the cases handled, then null is returned
+    return jarray;
+}
+
+jvalue convertValueToJValue(ExecState* exec, RootObject* rootObject, JSValue value, JNIType jniType, const char* javaClassName)
+{
+    JSLock lock(SilenceAssertionsOnly);
+
+    jvalue result;
+    memset(&result, 0, sizeof(jvalue));
+
+    switch (jniType) {
+    case array_type:
+    case object_type:
+        {
+            // FIXME: JavaJSObject::convertValueToJObject functionality is almost exactly the same,
+            // these functions should use common code.
+
+            if (value.isObject()) {
+                JSObject* object = asObject(value);
+                if (object->inherits(&JavaRuntimeObject::s_info)) {
+                    // Unwrap a Java instance.
+                    JavaRuntimeObject* runtimeObject = static_cast<JavaRuntimeObject*>(object);
+                    JavaInstance* instance = runtimeObject->getInternalJavaInstance();
+                    if (instance)
+                        result.l = instance->javaInstance();
+                } else if (object->classInfo() == &RuntimeArray::s_info) {
+                    // Input is a JavaScript Array that was originally created from a Java Array
+                    RuntimeArray* imp = static_cast<RuntimeArray*>(object);
+                    JavaArray* array = static_cast<JavaArray*>(imp->getConcreteArray());
+                    result.l = array->javaArray();
+                } else if (object->classInfo() == &JSArray::info) {
+                    // Input is a Javascript Array. We need to create it to a Java Array.
+                    result.l = convertArrayInstanceToJavaArray(exec, asArray(value), javaClassName);
+                } else if (!result.l && (!strcmp(javaClassName, "java.lang.Object")) || (!strcmp(javaClassName, "netscape.javascript.JSObject"))) {
+                    // Wrap objects in JSObject instances.
+                    JNIEnv* env = getJNIEnv();
+                    jclass jsObjectClass = env->FindClass("sun/plugin/javascript/webkit/JSObject");
+                    jmethodID constructorID = env->GetMethodID(jsObjectClass, "<init>", "(J)V");
+                    if (constructorID) {
+                        jlong nativeHandle = ptr_to_jlong(object);
+                        rootObject->gcProtect(object);
+                        result.l = env->NewObject(jsObjectClass, constructorID, nativeHandle);
+                    }
+                }
+            }
+
+            // Create an appropriate Java object if target type is java.lang.Object.
+            if (!result.l && !strcmp(javaClassName, "java.lang.Object")) {
+                if (value.isString()) {
+                    UString stringValue = asString(value)->value(exec);
+                    JNIEnv* env = getJNIEnv();
+                    jobject javaString = env->functions->NewString(env, (const jchar*)stringValue.data(), stringValue.size());
+                    result.l = javaString;
+                } else if (value.isNumber()) {
+                    double doubleValue = value.uncheckedGetNumber();
+                    JNIEnv* env = getJNIEnv();
+                    jclass clazz = env->FindClass("java/lang/Double");
+                    jmethodID constructor = env->GetMethodID(clazz, "<init>", "(D)V");
+                    jobject javaDouble = env->functions->NewObject(env, clazz, constructor, doubleValue);
+                    result.l = javaDouble;
+                } else if (value.isBoolean()) {
+                    bool boolValue = value.getBoolean();
+                    JNIEnv* env = getJNIEnv();
+                    jclass clazz = env->FindClass("java/lang/Boolean");
+                    jmethodID constructor = env->GetMethodID(clazz, "<init>", "(Z)V");
+                    jobject javaBoolean = env->functions->NewObject(env, clazz, constructor, boolValue);
+                    result.l = javaBoolean;
+                } else if (value.isUndefined()) {
+                    UString stringValue = "undefined";
+                    JNIEnv* env = getJNIEnv();
+                    jobject javaString = env->functions->NewString(env, (const jchar*)stringValue.data(), stringValue.size());
+                    result.l = javaString;
+                }
+            }
+
+            // Convert value to a string if the target type is a java.lang.String, and we're not
+            // converting from a null.
+            if (!result.l && !strcmp(javaClassName, "java.lang.String")) {
+                if (!value.isNull()) {
+                    UString stringValue = value.toString(exec);
+                    JNIEnv* env = getJNIEnv();
+                    jobject javaString = env->functions->NewString(env, (const jchar*)stringValue.data(), stringValue.size());
+                    result.l = javaString;
+                }
+            }
+        }
+        break;
+
+    case boolean_type:
+        {
+            result.z = (jboolean)value.toNumber(exec);
+        }
+        break;
+
+    case byte_type:
+        {
+            result.b = (jbyte)value.toNumber(exec);
+        }
+        break;
+
+    case char_type:
+        {
+            result.c = (jchar)value.toNumber(exec);
+        }
+        break;
+
+    case short_type:
+        {
+            result.s = (jshort)value.toNumber(exec);
+        }
+        break;
+
+    case int_type:
+        {
+            result.i = (jint)value.toNumber(exec);
+        }
+        break;
+
+    case long_type:
+        {
+            result.j = (jlong)value.toNumber(exec);
+        }
+        break;
+
+    case float_type:
+        {
+            result.f = (jfloat)value.toNumber(exec);
+        }
+        break;
+
+    case double_type:
+        {
+            result.d = (jdouble)value.toNumber(exec);
+        }
+        break;
+
+    case invalid_type:
+    case void_type:
+        break;
+    }
+    return result;
+}
+
+} // end of namespace Bindings
+
+} // end of namespace JSC
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIUtilityPrivate.h b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIUtilityPrivate.h
new file mode 100644
index 0000000000..8d4652d8f0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIUtilityPrivate.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
+ * Copyright 2009, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JNIUtilityPrivate_h
+#define JNIUtilityPrivate_h
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "JNIUtility.h"
+#include <runtime/JSValue.h>
+
+namespace JSC {
+
+class ExecState;
+class JSObject;
+
+namespace Bindings {
+
+class RootObject;
+
+jvalue convertValueToJValue(ExecState*, RootObject*, JSValue, JNIType, const char* javaClassName);
+bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValue& exceptionDescription);
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
+
+#endif // JNIUtilityPrivate_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaClassJSC.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
new file mode 100644
index 0000000000..e1b8b4cf8d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JavaClassJSC.h"
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "JNIUtility.h"
+#include "JSDOMWindow.h"
+#include <runtime/Identifier.h>
+#include <runtime/JSLock.h>
+
+using namespace JSC::Bindings;
+
+JavaClass::JavaClass(jobject anInstance)
+{
+    jobject aClass = callJNIMethod<jobject>(anInstance, "getClass", "()Ljava/lang/Class;");
+
+    if (!aClass) {
+        LOG_ERROR("Unable to call getClass on instance %p", anInstance);
+        m_name = fastStrDup("<Unknown>");
+        return;
+    }
+
+    if (jstring className = (jstring)callJNIMethod<jobject>(aClass, "getName", "()Ljava/lang/String;")) {
+        const char* classNameC = getCharactersFromJString(className);
+        m_name = fastStrDup(classNameC);
+        releaseCharactersForJString(className, classNameC);
+    } else
+        m_name = fastStrDup("<Unknown>");
+
+    int i;
+    JNIEnv* env = getJNIEnv();
+
+    // Get the fields
+    if (jarray fields = (jarray)callJNIMethod<jobject>(aClass, "getFields", "()[Ljava/lang/reflect/Field;")) {
+        int numFields = env->GetArrayLength(fields);
+        for (i = 0; i < numFields; i++) {
+            jobject aJField = env->GetObjectArrayElement((jobjectArray)fields, i);
+            JavaField* aField = new JavaField(env, aJField); // deleted in the JavaClass destructor
+            {
+                JSLock lock(SilenceAssertionsOnly);
+                m_fields.set(((UString)aField->name()).rep(), aField);
+            }
+            env->DeleteLocalRef(aJField);
+        }
+        env->DeleteLocalRef(fields);
+    }
+
+    // Get the methods
+    if (jarray methods = (jarray)callJNIMethod<jobject>(aClass, "getMethods", "()[Ljava/lang/reflect/Method;")) {
+        int numMethods = env->GetArrayLength(methods);
+        for (i = 0; i < numMethods; i++) {
+            jobject aJMethod = env->GetObjectArrayElement((jobjectArray)methods, i);
+            JavaMethod* aMethod = new JavaMethod(env, aJMethod); // deleted in the JavaClass destructor
+            MethodList* methodList;
+            {
+                JSLock lock(SilenceAssertionsOnly);
+
+                methodList = m_methods.get(((UString)aMethod->name()).rep());
+                if (!methodList) {
+                    methodList = new MethodList();
+                    m_methods.set(((UString)aMethod->name()).rep(), methodList);
+                }
+            }
+            methodList->append(aMethod);
+            env->DeleteLocalRef(aJMethod);
+        }
+        env->DeleteLocalRef(methods);
+    }
+
+    env->DeleteLocalRef(aClass);
+}
+
+JavaClass::~JavaClass()
+{
+    fastFree(const_cast<char*>(m_name));
+
+    JSLock lock(SilenceAssertionsOnly);
+
+    deleteAllValues(m_fields);
+    m_fields.clear();
+
+    MethodListMap::const_iterator end = m_methods.end();
+    for (MethodListMap::const_iterator it = m_methods.begin(); it != end; ++it) {
+        const MethodList* methodList = it->second;
+        deleteAllValues(*methodList);
+        delete methodList;
+    }
+    m_methods.clear();
+}
+
+MethodList JavaClass::methodsNamed(const Identifier& identifier, Instance*) const
+{
+    MethodList* methodList = m_methods.get(identifier.ustring().rep());
+
+    if (methodList)
+        return *methodList;
+    return MethodList();
+}
+
+Field* JavaClass::fieldNamed(const Identifier& identifier, Instance*) const
+{
+    return m_fields.get(identifier.ustring().rep());
+}
+
+bool JavaClass::isNumberClass() const
+{
+    return (!strcmp(m_name, "java.lang.Byte")
+        || !strcmp(m_name, "java.lang.Short")
+        || !strcmp(m_name, "java.lang.Integer")
+        || !strcmp(m_name, "java.lang.Long")
+        || !strcmp(m_name, "java.lang.Float")
+        || !strcmp(m_name, "java.lang.Double"));
+}
+
+bool JavaClass::isBooleanClass() const
+{
+    return !strcmp(m_name, "java.lang.Boolean");
+}
+
+bool JavaClass::isStringClass() const
+{
+    return !strcmp(m_name, "java.lang.String");
+}
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.h b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaClassJSC.h
index 890b4d3cec..09b93e9026 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.h
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaClassJSC.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,15 +20,15 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef JNI_CLASS_H_
-#define JNI_CLASS_H_
+#ifndef JavaClassJSC_h
+#define JavaClassJSC_h
 
 #if ENABLE(MAC_JAVA_BRIDGE)
 
-#include <jni_runtime.h>
+#include "JNIBridgeJSC.h"
 #include <wtf/HashMap.h>
 
 namespace JSC {
@@ -37,20 +37,20 @@ namespace Bindings {
 
 class JavaClass : public Class {
 public:
-    JavaClass (jobject anInstance);
-    ~JavaClass ();
+    JavaClass(jobject);
+    ~JavaClass();
+
+    virtual MethodList methodsNamed(const Identifier&, Instance*) const;
+    virtual Field* fieldNamed(const Identifier&, Instance*) const;
 
-    virtual MethodList methodsNamed(const Identifier&, Instance* instance) const;    
-    virtual Field *fieldNamed(const Identifier&, Instance* instance) const;
-    
     bool isNumberClass() const;
     bool isBooleanClass() const;
     bool isStringClass() const;
-    
+
 private:
-    const char *_name;
-    FieldMap _fields;
-    MethodListMap _methods;
+    const char* m_name;
+    FieldMap m_fields;
+    MethodListMap m_methods;
 };
 
 } // namespace Bindings
@@ -59,4 +59,4 @@ private:
 
 #endif // ENABLE(MAC_JAVA_BRIDGE)
 
-#endif // JNI_CLASS_H_
+#endif // JavaClassJSC_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
new file mode 100644
index 0000000000..585b315629
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
@@ -0,0 +1,381 @@
+/*
+ * Copyright (C) 2003, 2008, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JavaInstanceJSC.h"
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "JavaRuntimeObject.h"
+#include "JNIBridgeJSC.h"
+#include "JNIUtility.h"
+#include "JNIUtilityPrivate.h"
+#include "JavaClassJSC.h"
+#include "Logging.h"
+#include "runtime_method.h"
+#include "runtime_object.h"
+#include "runtime_root.h"
+#include <runtime/ArgList.h>
+#include <runtime/Error.h>
+#include <runtime/JSLock.h>
+
+using namespace JSC::Bindings;
+using namespace JSC;
+using namespace WebCore;
+
+JavaInstance::JavaInstance(jobject instance, PassRefPtr<RootObject> rootObject)
+    : Instance(rootObject)
+{
+    m_instance = new JObjectWrapper(instance);
+    m_class = 0;
+}
+
+JavaInstance::~JavaInstance()
+{
+    delete m_class;
+}
+
+RuntimeObject* JavaInstance::newRuntimeObject(ExecState* exec)
+{
+    return new (exec) JavaRuntimeObject(exec, this);
+}
+
+#define NUM_LOCAL_REFS 64
+
+void JavaInstance::virtualBegin()
+{
+    getJNIEnv()->PushLocalFrame(NUM_LOCAL_REFS);
+}
+
+void JavaInstance::virtualEnd()
+{
+    getJNIEnv()->PopLocalFrame(0);
+}
+
+Class* JavaInstance::getClass() const
+{
+    if (!m_class)
+        m_class = new JavaClass (m_instance->m_instance);
+    return m_class;
+}
+
+JSValue JavaInstance::stringValue(ExecState* exec) const
+{
+    JSLock lock(SilenceAssertionsOnly);
+
+    jstring stringValue = (jstring)callJNIMethod<jobject>(m_instance->m_instance, "toString", "()Ljava/lang/String;");
+
+    // Should throw a JS exception, rather than returning ""? - but better than a null dereference.
+    if (!stringValue)
+        return jsString(exec, UString());
+
+    JNIEnv* env = getJNIEnv();
+    const jchar* c = getUCharactersFromJStringInEnv(env, stringValue);
+    UString u((const UChar*)c, (int)env->GetStringLength(stringValue));
+    releaseUCharactersForJStringInEnv(env, stringValue, c);
+    return jsString(exec, u);
+}
+
+JSValue JavaInstance::numberValue(ExecState* exec) const
+{
+    jdouble doubleValue = callJNIMethod<jdouble>(m_instance->m_instance, "doubleValue", "()D");
+    return jsNumber(exec, doubleValue);
+}
+
+JSValue JavaInstance::booleanValue() const
+{
+    jboolean booleanValue = callJNIMethod<jboolean>(m_instance->m_instance, "booleanValue", "()Z");
+    return jsBoolean(booleanValue);
+}
+
+class JavaRuntimeMethod : public RuntimeMethod {
+public:
+    JavaRuntimeMethod(ExecState* exec, const Identifier& name, Bindings::MethodList& list)
+        : RuntimeMethod(exec, name, list)
+    {
+    }
+
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+
+    static const ClassInfo s_info;
+};
+
+const ClassInfo JavaRuntimeMethod::s_info = { "JavaRuntimeMethod", &RuntimeMethod::s_info, 0, 0 };
+
+JSValue JavaInstance::getMethod(ExecState* exec, const Identifier& propertyName)
+{
+    MethodList methodList = getClass()->methodsNamed(propertyName, this);
+    return new (exec) JavaRuntimeMethod(exec, propertyName, methodList);
+}
+
+JSValue JavaInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod, const ArgList &args)
+{
+    if (!asObject(runtimeMethod)->inherits(&JavaRuntimeMethod::s_info))
+        return throwError(exec, TypeError, "Attempt to invoke non-Java method on Java object.");
+
+    const MethodList& methodList = *runtimeMethod->methods();
+
+    int i;
+    int count = args.size();
+    JSValue resultValue;
+    Method* method = 0;
+    size_t numMethods = methodList.size();
+
+    // Try to find a good match for the overloaded method.  The
+    // fundamental problem is that JavaScript doesn't have the
+    // notion of method overloading and Java does.  We could
+    // get a bit more sophisticated and attempt to does some
+    // type checking as we as checking the number of parameters.
+    for (size_t methodIndex = 0; methodIndex < numMethods; methodIndex++) {
+        Method* aMethod = methodList[methodIndex];
+        if (aMethod->numParameters() == count) {
+            method = aMethod;
+            break;
+        }
+    }
+    if (!method) {
+        LOG(LiveConnect, "JavaInstance::invokeMethod unable to find an appropiate method");
+        return jsUndefined();
+    }
+
+    const JavaMethod* jMethod = static_cast<const JavaMethod*>(method);
+    LOG(LiveConnect, "JavaInstance::invokeMethod call %s %s on %p", UString(jMethod->name()).UTF8String().c_str(), jMethod->signature(), m_instance->m_instance);
+
+    Vector<jvalue> jArgs(count);
+
+    for (i = 0; i < count; i++) {
+        JavaParameter* aParameter = jMethod->parameterAt(i);
+        jArgs[i] = convertValueToJValue(exec, m_rootObject.get(), args.at(i), aParameter->getJNIType(), aParameter->type());
+        LOG(LiveConnect, "JavaInstance::invokeMethod arg[%d] = %s", i, args.at(i).toString(exec).ascii());
+    }
+
+    jvalue result;
+
+    // Try to use the JNI abstraction first, otherwise fall back to
+    // normal JNI.  The JNI dispatch abstraction allows the Java plugin
+    // to dispatch the call on the appropriate internal VM thread.
+    RootObject* rootObject = this->rootObject();
+    if (!rootObject)
+        return jsUndefined();
+
+    bool handled = false;
+    if (rootObject->nativeHandle()) {
+        jobject obj = m_instance->m_instance;
+        JSValue exceptionDescription;
+        const char *callingURL = 0; // FIXME, need to propagate calling URL to Java
+        handled = dispatchJNICall(exec, rootObject->nativeHandle(), obj, jMethod->isStatic(), jMethod->JNIReturnType(), jMethod->methodID(obj), jArgs.data(), result, callingURL, exceptionDescription);
+        if (exceptionDescription) {
+            throwError(exec, GeneralError, exceptionDescription.toString(exec));
+            return jsUndefined();
+        }
+    }
+
+#ifdef BUILDING_ON_TIGER
+    if (!handled) {
+        jobject obj = m_instance->m_instance;
+        switch (jMethod->JNIReturnType()) {
+        case void_type:
+            callJNIMethodIDA<void>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case object_type:
+            result.l = callJNIMethodIDA<jobject>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case boolean_type:
+            result.z = callJNIMethodIDA<jboolean>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case byte_type:
+            result.b = callJNIMethodIDA<jbyte>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case char_type:
+            result.c = callJNIMethodIDA<jchar>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case short_type:
+            result.s = callJNIMethodIDA<jshort>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case int_type:
+            result.i = callJNIMethodIDA<jint>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case long_type:
+            result.j = callJNIMethodIDA<jlong>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case float_type:
+            result.f = callJNIMethodIDA<jfloat>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case double_type:
+            result.d = callJNIMethodIDA<jdouble>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case array_type:
+        case invalid_type:
+            break;
+        }
+    }
+#endif
+
+    switch (jMethod->JNIReturnType()) {
+    case void_type:
+        {
+            resultValue = jsUndefined();
+        }
+        break;
+
+    case object_type:
+        {
+            if (result.l) {
+                // FIXME: array_type return type is handled below, can we actually get an array here?
+                const char* arrayType = jMethod->returnType();
+                if (arrayType[0] == '[')
+                    resultValue = JavaArray::convertJObjectToArray(exec, result.l, arrayType, rootObject);
+                else {
+                    jobject classOfInstance = callJNIMethod<jobject>(result.l, "getClass", "()Ljava/lang/Class;");
+                    jstring className = static_cast<jstring>(callJNIMethod<jobject>(classOfInstance, "getName", "()Ljava/lang/String;"));
+                    if (!strcmp(JavaString(className).UTF8String(), "sun.plugin.javascript.webkit.JSObject")) {
+                        // Pull the nativeJSObject value from the Java instance.  This is a pointer to the JSObject.
+                        JNIEnv* env = getJNIEnv();
+                        jfieldID fieldID = env->GetFieldID(static_cast<jclass>(classOfInstance), "nativeJSObject", "J");
+                        jlong nativeHandle = env->GetLongField(result.l, fieldID);
+                        // FIXME: Handling of undefined values differs between functions in JNIUtilityPrivate.cpp and those in those in jni_jsobject.mm,
+                        // and so it does between different versions of LiveConnect spec. There should not be multiple code paths to do the same work.
+                        if (nativeHandle == 1 /* UndefinedHandle */)
+                            return jsUndefined();
+                        return static_cast<JSObject*>(jlong_to_ptr(nativeHandle));
+                    } else
+                        return JavaInstance::create(result.l, rootObject)->createRuntimeObject(exec);
+                }
+            } else
+                return jsUndefined();
+        }
+        break;
+
+    case boolean_type:
+        {
+            resultValue = jsBoolean(result.z);
+        }
+        break;
+
+    case byte_type:
+        {
+            resultValue = jsNumber(exec, result.b);
+        }
+        break;
+
+    case char_type:
+        {
+            resultValue = jsNumber(exec, result.c);
+        }
+        break;
+
+    case short_type:
+        {
+            resultValue = jsNumber(exec, result.s);
+        }
+        break;
+
+    case int_type:
+        {
+            resultValue = jsNumber(exec, result.i);
+        }
+        break;
+
+    case long_type:
+        {
+            resultValue = jsNumber(exec, result.j);
+        }
+        break;
+
+    case float_type:
+        {
+            resultValue = jsNumber(exec, result.f);
+        }
+        break;
+
+    case double_type:
+        {
+            resultValue = jsNumber(exec, result.d);
+        }
+        break;
+
+    case array_type:
+        {
+            const char* arrayType = jMethod->returnType();
+            ASSERT(arrayType[0] == '[');
+            resultValue = JavaArray::convertJObjectToArray(exec, result.l, arrayType, rootObject);
+        }
+        break;
+
+    case invalid_type:
+        {
+            resultValue = jsUndefined();
+        }
+        break;
+    }
+
+    return resultValue;
+}
+
+JSValue JavaInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+{
+    if (hint == PreferString)
+        return stringValue(exec);
+    if (hint == PreferNumber)
+        return numberValue(exec);
+    JavaClass* aClass = static_cast<JavaClass*>(getClass());
+    if (aClass->isStringClass())
+        return stringValue(exec);
+    if (aClass->isNumberClass())
+        return numberValue(exec);
+    if (aClass->isBooleanClass())
+        return booleanValue();
+    return valueOf(exec);
+}
+
+JSValue JavaInstance::valueOf(ExecState* exec) const
+{
+    return stringValue(exec);
+}
+
+JObjectWrapper::JObjectWrapper(jobject instance)
+    : m_refCount(0)
+{
+    ASSERT(instance);
+
+    // Cache the JNIEnv used to get the global ref for this java instance.
+    // It'll be used to delete the reference.
+    m_env = getJNIEnv();
+
+    m_instance = m_env->NewGlobalRef(instance);
+
+    LOG(LiveConnect, "JObjectWrapper ctor new global ref %p for %p", m_instance, instance);
+
+    if (!m_instance)
+        LOG_ERROR("Could not get GlobalRef for %p", instance);
+}
+
+JObjectWrapper::~JObjectWrapper()
+{
+    LOG(LiveConnect, "JObjectWrapper dtor deleting global ref %p", m_instance);
+    m_env->DeleteGlobalRef(m_instance);
+}
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.h b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaInstanceJSC.h
index 0dcab3e4b3..d395cc871f 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.h
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaInstanceJSC.h
@@ -20,15 +20,15 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef _JNI_INSTANCE_H_
-#define _JNI_INSTANCE_H_
+#ifndef JavaInstanceJSC_h
+#define JavaInstanceJSC_h
 
 #if ENABLE(MAC_JAVA_BRIDGE)
 
-#include "runtime.h"
+#include "Bridge.h"
 #include "runtime_root.h"
 
 #include <JavaVM/jni.h>
@@ -39,64 +39,68 @@ namespace Bindings {
 
 class JavaClass;
 
-class JObjectWrapper
-{
+class JObjectWrapper {
 friend class RefPtr<JObjectWrapper>;
 friend class JavaArray;
 friend class JavaField;
 friend class JavaInstance;
 friend class JavaMethod;
 
+public:
+    jobject instance() const { return m_instance; }
+    void setInstance(jobject instance) { m_instance = instance; }
+
+    void ref() { m_refCount++; }
+    void deref()
+    {
+        if (!(--m_refCount))
+            delete this;
+    }
+
 protected:
-    JObjectWrapper(jobject instance);    
+    JObjectWrapper(jobject instance);
     ~JObjectWrapper();
-    
-    void ref() { _refCount++; }
-    void deref() 
-    { 
-        if (--_refCount == 0) 
-            delete this; 
-    }
 
-    jobject _instance;
+    jobject m_instance;
 
 private:
-    JNIEnv *_env;
-    unsigned int _refCount;
+    JNIEnv* m_env;
+    unsigned int m_refCount;
 };
 
-class JavaInstance : public Instance
-{
+class JavaInstance : public Instance {
 public:
-    static PassRefPtr<JavaInstance> create(jobject instance, PassRefPtr<RootObject> rootObject) 
+    static PassRefPtr<JavaInstance> create(jobject instance, PassRefPtr<RootObject> rootObject)
     {
         return adoptRef(new JavaInstance(instance, rootObject));
     }
-    
+
     ~JavaInstance();
-    
-    virtual Class *getClass() const;
-    
+
+    virtual Class* getClass() const;
+
     virtual JSValue valueOf(ExecState*) const;
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-    virtual JSValue invokeMethod(ExecState* exec, const MethodList& method, const ArgList& args);
+    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName);
+    virtual JSValue invokeMethod(ExecState* exec, RuntimeMethod* method, const ArgList& args);
+
+    jobject javaInstance() const { return m_instance->m_instance; }
 
-    jobject javaInstance() const { return _instance->_instance; }
-    
     JSValue stringValue(ExecState*) const;
     JSValue numberValue(ExecState*) const;
     JSValue booleanValue() const;
 
 protected:
+    JavaInstance(jobject instance, PassRefPtr<RootObject>);
+
+    virtual RuntimeObject* newRuntimeObject(ExecState*);
+
     virtual void virtualBegin();
     virtual void virtualEnd();
 
-private:
-    JavaInstance(jobject instance, PassRefPtr<RootObject>);
-
-    RefPtr<JObjectWrapper> _instance;
-    mutable JavaClass *_class;
+    RefPtr<JObjectWrapper> m_instance;
+    mutable JavaClass* m_class;
 };
 
 } // namespace Bindings
@@ -105,4 +109,4 @@ private:
 
 #endif // ENABLE(MAC_JAVA_BRIDGE)
 
-#endif // _JNI_INSTANCE_H_
+#endif // JavaInstanceJSC_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaRuntimeObject.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaRuntimeObject.cpp
new file mode 100644
index 0000000000..dc58b71d13
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaRuntimeObject.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "JavaInstanceJSC.h"
+#include "JavaRuntimeObject.h"
+
+namespace JSC {
+namespace Bindings {
+
+const ClassInfo JavaRuntimeObject::s_info = { "JavaRuntimeObject", &RuntimeObject::s_info, 0, 0 };
+
+JavaRuntimeObject::JavaRuntimeObject(ExecState* exec, PassRefPtr<JavaInstance> instance)
+    : RuntimeObject(exec, instance)
+{
+}
+
+JavaRuntimeObject::~JavaRuntimeObject()
+{
+}
+
+JavaInstance* JavaRuntimeObject::getInternalJavaInstance() const
+{
+    return static_cast<JavaInstance*>(getInternalInstance());
+}
+
+
+
+}
+}
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaRuntimeObject.h b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaRuntimeObject.h
new file mode 100644
index 0000000000..d9bf693dc3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaRuntimeObject.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JavaRuntimeObject_h
+#define JavaRuntimeObject_h
+
+#include "runtime_object.h"
+
+namespace JSC {
+namespace Bindings {
+
+class JavaInstance;
+
+class JavaRuntimeObject : public RuntimeObject {
+public:
+    JavaRuntimeObject(ExecState*, PassRefPtr<JavaInstance>);
+    virtual ~JavaRuntimeObject();
+
+    JavaInstance* getInternalJavaInstance() const;
+
+    static const ClassInfo s_info;
+
+private:
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+};
+
+}
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaStringJSC.h b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaStringJSC.h
new file mode 100644
index 0000000000..cc2263ab3f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaStringJSC.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2010 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaStringJSC_h
+#define JavaStringJSC_h
+
+#include "JNIUtility.h"
+#include "JavaInstanceJSC.h"
+#include <runtime/JSLock.h>
+
+
+namespace JSC {
+
+namespace Bindings {
+
+class JavaStringImpl {
+public:
+    ~JavaStringImpl()
+    {
+        JSLock lock(SilenceAssertionsOnly);
+        m_rep = 0;
+    }
+
+    void init()
+    {
+        JSLock lock(SilenceAssertionsOnly);
+        m_rep = UString().rep();
+    }
+
+    void init(JNIEnv* e, jstring s)
+    {
+        int size = e->GetStringLength(s);
+        const jchar* uc = getUCharactersFromJStringInEnv(e, s);
+        {
+            JSLock lock(SilenceAssertionsOnly);
+            m_rep = UString(reinterpret_cast<const UChar*>(uc), size).rep();
+        }
+        releaseUCharactersForJStringInEnv(e, s, uc);
+    }
+
+    const char* UTF8String() const
+    {
+        if (!m_utf8String.c_str()) {
+            JSLock lock(SilenceAssertionsOnly);
+            m_utf8String = UString(m_rep).UTF8String();
+        }
+        return m_utf8String.c_str();
+    }
+    const jchar* uchars() const { return (const jchar*)m_rep->characters(); }
+    int length() const { return m_rep->length(); }
+    UString uString() const { return UString(m_rep); }
+
+private:
+    RefPtr<UString::Rep> m_rep;
+    mutable CString m_utf8String;
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // JavaStringJSC_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/jsc/BridgeJSC.cpp
index eac8586a36..3d8f62da8d 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/jsc/BridgeJSC.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,11 +21,11 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
-#include "runtime.h"
+#include "BridgeJSC.h"
 
 #include "runtime_object.h"
 #include "runtime_root.h"
@@ -34,12 +35,14 @@
 #include "qt_instance.h"
 #endif
 
-namespace JSC { namespace Bindings {
+namespace JSC {
+
+namespace Bindings {
 
 Array::Array(PassRefPtr<RootObject> rootObject)
-    : _rootObject(rootObject)
+    : m_rootObject(rootObject)
 {
-    ASSERT(_rootObject);
+    ASSERT(m_rootObject);
 }
 
 Array::~Array()
@@ -47,10 +50,10 @@ Array::~Array()
 }
 
 Instance::Instance(PassRefPtr<RootObject> rootObject)
-    : _rootObject(rootObject)
+    : m_rootObject(rootObject)
     , m_runtimeObject(0)
 {
-    ASSERT(_rootObject);
+    ASSERT(m_rootObject);
 }
 
 Instance::~Instance()
@@ -80,30 +83,30 @@ void Instance::end()
     virtualEnd();
 }
 
-RuntimeObjectImp* Instance::createRuntimeObject(ExecState* exec)
+RuntimeObject* Instance::createRuntimeObject(ExecState* exec)
 {
-    ASSERT(_rootObject);
-    ASSERT(_rootObject->isValid());
+    ASSERT(m_rootObject);
+    ASSERT(m_rootObject->isValid());
     if (m_runtimeObject)
         return m_runtimeObject;
     JSLock lock(SilenceAssertionsOnly);
     m_runtimeObject = newRuntimeObject(exec);
-    _rootObject->addRuntimeObject(m_runtimeObject);
+    m_rootObject->addRuntimeObject(m_runtimeObject);
     return m_runtimeObject;
 }
 
-RuntimeObjectImp* Instance::newRuntimeObject(ExecState* exec)
+RuntimeObject* Instance::newRuntimeObject(ExecState* exec)
 {
     JSLock lock(SilenceAssertionsOnly);
-    return new (exec) RuntimeObjectImp(exec, this);
+    return new (exec)RuntimeObject(exec, this);
 }
 
 void Instance::willDestroyRuntimeObject()
 {
-    ASSERT(_rootObject);
-    ASSERT(_rootObject->isValid());
+    ASSERT(m_rootObject);
+    ASSERT(m_rootObject->isValid());
     ASSERT(m_runtimeObject);
-    _rootObject->removeRuntimeObject(m_runtimeObject);
+    m_rootObject->removeRuntimeObject(m_runtimeObject);
     m_runtimeObject = 0;
 }
 
@@ -113,9 +116,11 @@ void Instance::willInvalidateRuntimeObject()
     m_runtimeObject = 0;
 }
 
-RootObject* Instance::rootObject() const 
-{ 
-    return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
+RootObject* Instance::rootObject() const
+{
+    return m_rootObject && m_rootObject->isValid() ? m_rootObject.get() : 0;
 }
 
-} } // namespace JSC::Bindings
+} // namespace Bindings
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime.h b/src/3rdparty/webkit/WebCore/bridge/jsc/BridgeJSC.h
index 6682a97685..8379170222 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/jsc/BridgeJSC.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,11 +21,13 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef JAVASCRIPTCORE_BINDINGS_RUNTIME_H
-#define JAVASCRIPTCORE_BINDINGS_RUNTIME_H
+#ifndef BridgeJSC_h
+#define BridgeJSC_h
+
+#if USE(JSC)
 
 #include <runtime/JSString.h>
 #include <wtf/HashMap.h>
@@ -37,13 +40,14 @@ class ArgList;
 class Identifier;
 class JSGlobalObject;
 class PropertyNameArray;
-class RuntimeObjectImp;
+class RuntimeMethod;
 
 namespace Bindings {
 
 class Instance;
 class Method;
 class RootObject;
+class RuntimeObject;
 
 typedef Vector<Method*> MethodList;
 
@@ -55,13 +59,6 @@ public:
     virtual ~Field() { }
 };
 
-class Method : public Noncopyable {
-public:
-    virtual int numParameters() const = 0;
-        
-    virtual ~Method() { }
-};
-
 class Class : public Noncopyable {
 public:
     virtual MethodList methodsNamed(const Identifier&, Instance*) const = 0;
@@ -85,31 +82,32 @@ public:
     // any needed state.
     void begin();
     void end();
-    
+
     virtual Class* getClass() const = 0;
-    RuntimeObjectImp* createRuntimeObject(ExecState*);
+    RuntimeObject* createRuntimeObject(ExecState*);
     void willInvalidateRuntimeObject();
     void willDestroyRuntimeObject();
-    
+
     // Returns false if the value was not set successfully.
     virtual bool setValueOfUndefinedField(ExecState*, const Identifier&, JSValue) { return false; }
 
-    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList& args) = 0;
+    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName) = 0;
+    virtual JSValue invokeMethod(ExecState*, RuntimeMethod* method, const ArgList& args) = 0;
 
     virtual bool supportsInvokeDefaultMethod() const { return false; }
     virtual JSValue invokeDefaultMethod(ExecState*, const ArgList&) { return jsUndefined(); }
-    
+
     virtual bool supportsConstruct() const { return false; }
     virtual JSValue invokeConstruct(ExecState*, const ArgList&) { return JSValue(); }
-    
+
     virtual void getPropertyNames(ExecState*, PropertyNameArray&) { }
 
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const = 0;
-    
+
     virtual JSValue valueOf(ExecState* exec) const = 0;
-    
+
     RootObject* rootObject() const;
-    
+
     virtual ~Instance();
 
     virtual bool getOwnPropertySlot(JSObject*, ExecState*, const Identifier&, PropertySlot&) { return false; }
@@ -119,35 +117,37 @@ public:
 protected:
     virtual void virtualBegin() { }
     virtual void virtualEnd() { }
-    virtual RuntimeObjectImp* newRuntimeObject(ExecState*);
+    virtual RuntimeObject* newRuntimeObject(ExecState*);
 
-    RefPtr<RootObject> _rootObject;
+    RefPtr<RootObject> m_rootObject;
 
 private:
-    RuntimeObjectImp* m_runtimeObject;
+    RuntimeObject* m_runtimeObject;
 };
 
 class Array : public Noncopyable {
 public:
     Array(PassRefPtr<RootObject>);
     virtual ~Array();
-    
-    virtual void setValueAt(ExecState *, unsigned index, JSValue) const = 0;
-    virtual JSValue valueAt(ExecState *, unsigned index) const = 0;
+
+    virtual void setValueAt(ExecState*, unsigned index, JSValue) const = 0;
+    virtual JSValue valueAt(ExecState*, unsigned index) const = 0;
     virtual unsigned int getLength() const = 0;
 
 protected:
-    RefPtr<RootObject> _rootObject;
+    RefPtr<RootObject> m_rootObject;
 };
 
-const char *signatureForParameters(const ArgList&);
+const char* signatureForParameters(const ArgList&);
 
 typedef HashMap<RefPtr<UString::Rep>, MethodList*> MethodListMap;
-typedef HashMap<RefPtr<UString::Rep>, Method*> MethodMap; 
-typedef HashMap<RefPtr<UString::Rep>, Field*> FieldMap; 
-    
+typedef HashMap<RefPtr<UString::Rep>, Method*> MethodMap;
+typedef HashMap<RefPtr<UString::Rep>, Field*> FieldMap;
+
 } // namespace Bindings
 
 } // namespace JSC
 
+#endif // USE(JSC)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp
index 09a1544458..9ecf19fe2c 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp
@@ -127,7 +127,7 @@ Field* QtClass::fieldNamed(const Identifier& identifier, Instance* instance) con
 
     QObject* obj = qtinst->getObject();
     UString ustring = identifier.ustring();
-    QString objName((const QChar*)ustring.rep()->data(), ustring.size());
+    QString objName((const QChar*)ustring.rep()->characters(), ustring.size());
     QByteArray ba = objName.toAscii();
 
     // First check for a cached field
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h
index dc6b13052f..b7a04cfdd1 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h
@@ -20,8 +20,7 @@
 #ifndef BINDINGS_QT_CLASS_H_
 #define BINDINGS_QT_CLASS_H_
 
-#include "runtime.h"
-
+#include "Bridge.h"
 #include "qglobal.h"
 
 QT_BEGIN_NAMESPACE
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
index ec362ec6b2..3df6a89c68 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
@@ -44,28 +44,36 @@ typedef QMultiHash<void*, QtInstance*> QObjectInstanceMap;
 static QObjectInstanceMap cachedInstances;
 
 // Derived RuntimeObject
-class QtRuntimeObjectImp : public RuntimeObjectImp {
+class QtRuntimeObject : public RuntimeObject {
 public:
-    QtRuntimeObjectImp(ExecState*, PassRefPtr<Instance>);
+    QtRuntimeObject(ExecState*, PassRefPtr<Instance>);
 
     static const ClassInfo s_info;
 
     virtual void markChildren(MarkStack& markStack)
     {
-        RuntimeObjectImp::markChildren(markStack);
+        RuntimeObject::markChildren(markStack);
         QtInstance* instance = static_cast<QtInstance*>(getInternalInstance());
         if (instance)
             instance->markAggregate(markStack);
     }
 
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    {
+        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount);
+    }
+
+protected:
+    static const unsigned StructureFlags = RuntimeObject::StructureFlags | OverridesMarkChildren;
+
 private:
     virtual const ClassInfo* classInfo() const { return &s_info; }
 };
 
-const ClassInfo QtRuntimeObjectImp::s_info = { "QtRuntimeObject", &RuntimeObjectImp::s_info, 0, 0 };
+const ClassInfo QtRuntimeObject::s_info = { "QtRuntimeObject", &RuntimeObject::s_info, 0, 0 };
 
-QtRuntimeObjectImp::QtRuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> instance)
-    : RuntimeObjectImp(exec, WebCore::deprecatedGetDOMStructure<QtRuntimeObjectImp>(exec), instance)
+QtRuntimeObject::QtRuntimeObject(ExecState* exec, PassRefPtr<Instance> instance)
+    : RuntimeObject(exec, WebCore::deprecatedGetDOMStructure<QtRuntimeObject>(exec), instance)
 {
 }
 
@@ -156,9 +164,9 @@ QtInstance* QtInstance::getInstance(JSObject* object)
 {
     if (!object)
         return 0;
-    if (!object->inherits(&QtRuntimeObjectImp::s_info))
+    if (!object->inherits(&QtRuntimeObject::s_info))
         return 0;
-    return static_cast<QtInstance*>(static_cast<RuntimeObjectImp*>(object)->getInternalInstance());
+    return static_cast<QtInstance*>(static_cast<RuntimeObject*>(object)->getInternalInstance());
 }
 
 Class* QtInstance::getClass() const
@@ -168,10 +176,10 @@ Class* QtInstance::getClass() const
     return m_class;
 }
 
-RuntimeObjectImp* QtInstance::newRuntimeObject(ExecState* exec)
+RuntimeObject* QtInstance::newRuntimeObject(ExecState* exec)
 {
     JSLock lock(SilenceAssertionsOnly);
-    return new (exec) QtRuntimeObjectImp(exec, this);
+    return new (exec) QtRuntimeObject(exec, this);
 }
 
 void QtInstance::markAggregate(MarkStack& markStack)
@@ -226,13 +234,18 @@ void QtInstance::getPropertyNames(ExecState* exec, PropertyNameArray& array)
     }
 }
 
-JSValue QtInstance::invokeMethod(ExecState*, const MethodList&, const ArgList&)
+JSValue QtInstance::getMethod(ExecState* exec, const Identifier& propertyName)
+{
+    MethodList methodList = getClass()->methodsNamed(propertyName, this);
+    return new (exec) RuntimeMethod(exec, propertyName, methodList);
+}
+
+JSValue QtInstance::invokeMethod(ExecState*, RuntimeMethod*, const ArgList&)
 {
     // Implemented via fallbackMethod & QtRuntimeMetaMethod::callAsFunction
     return jsUndefined();
 }
 
-
 JSValue QtInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (hint == PreferString)
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
index 0afc6c754f..607f1339a8 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
@@ -20,11 +20,11 @@
 #ifndef BINDINGS_QT_INSTANCE_H_
 #define BINDINGS_QT_INSTANCE_H_
 
-#include <QtScript/qscriptengine.h>
-#include "runtime.h"
+#include "Bridge.h"
 #include "runtime_root.h"
-#include <qpointer.h>
+#include <QtScript/qscriptengine.h>
 #include <qhash.h>
+#include <qpointer.h>
 #include <qset.h>
 
 namespace JSC {
@@ -40,7 +40,7 @@ public:
     ~QtInstance();
 
     virtual Class* getClass() const;
-    virtual RuntimeObjectImp* newRuntimeObject(ExecState*);
+    virtual RuntimeObject* newRuntimeObject(ExecState*);
 
     virtual void begin();
     virtual void end();
@@ -50,7 +50,8 @@ public:
 
     void markAggregate(MarkStack&);
 
-    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList&);
+    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName);
+    virtual JSValue invokeMethod(ExecState*, RuntimeMethod*, const ArgList&);
 
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_pixmapruntime.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_pixmapruntime.cpp
new file mode 100644
index 0000000000..803316d78f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_pixmapruntime.cpp
@@ -0,0 +1,362 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+#include "config.h"
+#include "qt_pixmapruntime.h"
+
+#include "CachedImage.h"
+#include "HTMLImageElement.h"
+#include "JSGlobalObject.h"
+#include "JSHTMLImageElement.h"
+#include "JSLock.h"
+#include "ObjectPrototype.h"
+#include "StillImageQt.h"
+#include <QBuffer>
+#include <QByteArray>
+#include <QImage>
+#include <QPixmap>
+#include <QVariant>
+#include <runtime_object.h>
+#include <runtime_root.h>
+#include <runtime_method.h>
+
+using namespace WebCore;
+namespace JSC {
+
+namespace Bindings {
+
+class QtPixmapClass : public Class {
+public:
+    QtPixmapClass();
+    virtual MethodList methodsNamed(const Identifier&, Instance*) const;
+    virtual Field* fieldNamed(const Identifier&, Instance*) const;
+};
+
+
+class QtPixmapWidthField : public Field {
+public:
+    static const char* name() { return "width"; }
+    virtual JSValue valueFromInstance(ExecState* exec, const Instance* instance) const
+    {
+        return jsNumber(exec, static_cast<const QtPixmapInstance*>(instance)->width());
+    }
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const {}
+};
+
+class QtPixmapHeightField : public Field {
+public:
+    static const char* name() { return "height"; }
+    virtual JSValue valueFromInstance(ExecState* exec, const Instance* instance) const
+    {
+        return jsNumber(exec, static_cast<const QtPixmapInstance*>(instance)->height());
+    }
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const {}
+};
+
+class QtPixmapRuntimeMethod : public Method {
+public:
+    virtual int numParameters() const
+    {
+        return 0;
+    }
+    virtual JSValue invoke(ExecState* exec, QtPixmapInstance*, const ArgList&) = 0;
+
+};
+
+// this function receives an HTML image element as a parameter, makes it display the pixmap/image from Qt
+class QtPixmapAssignToElementMethod : public QtPixmapRuntimeMethod {
+public:
+    static const char* name() { return "assignToHTMLImageElement"; }
+    JSValue invoke(ExecState* exec, QtPixmapInstance* instance, const ArgList& args)
+    {
+        if (!args.size())
+            return jsUndefined();
+
+        JSObject* objectArg = args.at(0).toObject(exec);
+        if (!objectArg)
+            return jsUndefined();
+
+        if (!objectArg->inherits(&JSHTMLImageElement::s_info))
+            return jsUndefined();
+
+        // we now know that we have a valid <img> element as the argument, we can attach the pixmap to it.
+        PassRefPtr<StillImage> stillImage = WebCore::StillImage::create(instance->toPixmap());
+        HTMLImageElement* imageElement = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(objectArg)->impl());
+        imageElement->setCachedImage(new CachedImage(stillImage.get()));
+        JSDOMGlobalObject* global = static_cast<JSDOMGlobalObject*>(instance->rootObject()->globalObject());
+        toJS(exec, global, imageElement->document());
+        return jsUndefined();
+    }
+
+    virtual int numParameters() const
+    {
+        return 1;
+    }
+};
+
+// this function encodes the image to a dataUrl, to be used in background etc. Note: very slow.
+class QtPixmapToDataUrlMethod : public QtPixmapRuntimeMethod {
+public:
+    static const char* name() { return "toDataUrl"; }
+    JSValue invoke(ExecState* exec, QtPixmapInstance* instance, const ArgList&)
+    {
+        QByteArray byteArray;
+        QBuffer buffer(&byteArray);
+        instance->toImage().save(&buffer, "PNG");
+        const QString encodedString = QString("data:image/png;base64,") + byteArray.toBase64();
+        const UString ustring((UChar*)encodedString.utf16(), encodedString.length());
+        return jsString(exec, ustring);
+    }
+};
+
+class QtPixmapToStringMethod : public QtPixmapRuntimeMethod {
+    public:
+    static const char* name() { return "toString"; }
+    JSValue invoke(ExecState* exec, QtPixmapInstance* instance, const ArgList&)
+    {
+        return instance->valueOf(exec);
+    }
+};
+
+struct QtPixmapMetaData {
+    QtPixmapToDataUrlMethod toDataUrlMethod;
+    QtPixmapAssignToElementMethod assignToElementMethod;
+    QtPixmapToStringMethod toStringMethod;
+    QtPixmapHeightField heightField;
+    QtPixmapWidthField widthField;
+    QtPixmapClass cls;
+} qt_pixmap_metaData;
+
+// Derived RuntimeObject
+class QtPixmapRuntimeObject : public RuntimeObject {
+public:
+    QtPixmapRuntimeObject(ExecState*, PassRefPtr<Instance>);
+
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    {
+        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount);
+    }
+
+protected:
+    static const unsigned StructureFlags = RuntimeObject::StructureFlags | OverridesMarkChildren;
+
+private:
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+};
+
+QtPixmapRuntimeObject::QtPixmapRuntimeObject(ExecState* exec, PassRefPtr<Instance> instance)
+    : RuntimeObject(exec, WebCore::deprecatedGetDOMStructure<QtPixmapRuntimeObject>(exec), instance)
+{
+}
+
+const ClassInfo QtPixmapRuntimeObject::s_info = { "QtPixmapRuntimeObject", &RuntimeObject::s_info, 0, 0 };
+
+QtPixmapClass::QtPixmapClass()
+{
+}
+
+
+Class* QtPixmapInstance::getClass() const
+{
+    return &qt_pixmap_metaData.cls;
+}
+
+JSValue QtPixmapInstance::getMethod(ExecState* exec, const Identifier& propertyName)
+{
+    MethodList methodList = getClass()->methodsNamed(propertyName, this);
+    return new (exec) RuntimeMethod(exec, propertyName, methodList);
+}
+
+JSValue QtPixmapInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod, const ArgList& args)
+{
+    const MethodList& methods = *runtimeMethod->methods();
+
+    if (methods.size() == 1) {
+        QtPixmapRuntimeMethod* method = static_cast<QtPixmapRuntimeMethod*>(methods[0]);
+        return method->invoke(exec, this, args);
+    }
+    return jsUndefined();
+}
+
+MethodList QtPixmapClass::methodsNamed(const Identifier& identifier, Instance*) const
+{
+    MethodList methods;
+    if (identifier == QtPixmapToDataUrlMethod::name())
+        methods.append(&qt_pixmap_metaData.toDataUrlMethod);
+    else if (identifier == QtPixmapAssignToElementMethod::name())
+        methods.append(&qt_pixmap_metaData.assignToElementMethod);
+    else if (identifier == QtPixmapToStringMethod::name())
+        methods.append(&qt_pixmap_metaData.toStringMethod);
+    return methods;
+}
+
+Field* QtPixmapClass::fieldNamed(const Identifier& identifier, Instance*) const
+{
+    if (identifier == QtPixmapWidthField::name())
+        return &qt_pixmap_metaData.widthField;
+    if (identifier == QtPixmapHeightField::name())
+        return &qt_pixmap_metaData.heightField;
+    return 0;
+}
+
+void QtPixmapInstance::getPropertyNames(ExecState*exec, PropertyNameArray& arr)
+{
+    arr.add(Identifier(exec, UString(QtPixmapToDataUrlMethod::name())));
+    arr.add(Identifier(exec, UString(QtPixmapAssignToElementMethod::name())));
+    arr.add(Identifier(exec, UString(QtPixmapToStringMethod::name())));
+    arr.add(Identifier(exec, UString(QtPixmapWidthField::name())));
+    arr.add(Identifier(exec, UString(QtPixmapHeightField::name())));
+}
+
+JSValue QtPixmapInstance::defaultValue(ExecState* exec, PreferredPrimitiveType ptype) const
+{
+    if (ptype == PreferNumber) {
+        return jsBoolean(
+                (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QImage>()) && !(data.value<QImage>()).isNull())
+                || (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QPixmap>()) && !data.value<QPixmap>().isNull()));
+    }
+
+    if (ptype == PreferString)
+        return valueOf(exec);
+
+    return jsUndefined();
+}
+
+JSValue QtPixmapInstance::valueOf(ExecState* exec) const
+{
+    const QString stringValue = QString("[Qt Native Pixmap %1,%2]").arg(width()).arg(height());
+    UString ustring((UChar*)stringValue.utf16(), stringValue.length());
+    return jsString(exec, ustring);
+}
+
+QtPixmapInstance::QtPixmapInstance(PassRefPtr<RootObject> rootObj, const QVariant& d)
+        :Instance(rootObj), data(d)
+{
+}
+
+int QtPixmapInstance::width() const
+{
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QPixmap>()))
+        return data.value<QPixmap>().width();
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QImage>()))
+        return data.value<QImage>().width();
+    return 0;
+}
+
+int QtPixmapInstance::height() const
+{
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QPixmap>()))
+        return data.value<QPixmap>().height();
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QImage>()))
+        return data.value<QImage>().height();
+    return 0;
+}
+
+QPixmap QtPixmapInstance::toPixmap()
+{
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QPixmap>()))
+        return data.value<QPixmap>();
+
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QImage>())) {
+        const QPixmap pixmap = QPixmap::fromImage(data.value<QImage>());
+        data = QVariant::fromValue<QPixmap>(pixmap);
+        return pixmap;
+    }
+
+    return QPixmap();
+}
+
+QImage QtPixmapInstance::toImage()
+{
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QImage>()))
+        return data.value<QImage>();
+
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QPixmap>())) {
+        const QImage image = data.value<QPixmap>().toImage();
+        data = QVariant::fromValue<QImage>(image);
+        return image;
+    }
+
+    return QImage();
+}
+
+QVariant QtPixmapInstance::variantFromObject(JSObject* object, QMetaType::Type hint)
+{
+    if (!object)
+        goto returnEmptyVariant;
+
+    if (object->inherits(&JSHTMLImageElement::s_info)) {
+        JSHTMLImageElement* elementJSWrapper = static_cast<JSHTMLImageElement*>(object);
+        HTMLImageElement* imageElement = static_cast<HTMLImageElement*>(elementJSWrapper->impl());
+
+        if (!imageElement)
+            goto returnEmptyVariant;
+
+        CachedImage* cachedImage = imageElement->cachedImage();
+        if (!cachedImage)
+            goto returnEmptyVariant;
+
+        Image* image = cachedImage->image();
+        if (!image)
+            goto returnEmptyVariant;
+
+        QPixmap* pixmap = image->nativeImageForCurrentFrame();
+        if (!pixmap)
+            goto returnEmptyVariant;
+
+        return (hint == static_cast<QMetaType::Type>(qMetaTypeId<QPixmap>()))
+                  ? QVariant::fromValue<QPixmap>(*pixmap)
+                  : QVariant::fromValue<QImage>(pixmap->toImage());
+    }
+
+    if (object->inherits(&QtPixmapRuntimeObject::s_info)) {
+        QtPixmapRuntimeObject* runtimeObject = static_cast<QtPixmapRuntimeObject*>(object);
+        QtPixmapInstance* instance = static_cast<QtPixmapInstance*>(runtimeObject->getInternalInstance());
+        if (!instance)
+            goto returnEmptyVariant;
+
+        if (hint == qMetaTypeId<QPixmap>())
+            return QVariant::fromValue<QPixmap>(instance->toPixmap());
+
+        if (hint == qMetaTypeId<QImage>())
+            return QVariant::fromValue<QImage>(instance->toImage());
+    }
+
+returnEmptyVariant:
+    if (hint == qMetaTypeId<QPixmap>())
+        return QVariant::fromValue<QPixmap>(QPixmap());
+    if (hint == qMetaTypeId<QImage>())
+        return QVariant::fromValue<QImage>(QImage());
+    return QVariant();
+}
+JSObject* QtPixmapInstance::createRuntimeObject(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& data)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    return new(exec) QtPixmapRuntimeObject(exec, new QtPixmapInstance(root, data));
+}
+
+bool QtPixmapInstance::canHandle(QMetaType::Type hint)
+{
+    return hint == qMetaTypeId<QImage>() || hint == qMetaTypeId<QPixmap>();
+}
+
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_pixmapruntime.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_pixmapruntime.h
new file mode 100644
index 0000000000..a0e0e26849
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_pixmapruntime.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifndef qt_pixmapruntime_h
+#define qt_pixmapruntime_h
+
+#include "Bridge.h"
+#include <QVariant>
+
+namespace JSC {
+
+namespace Bindings {
+
+class QtPixmapInstance : public Instance {
+    QVariant data;
+public:
+    QtPixmapInstance(PassRefPtr<RootObject> rootObj, const QVariant& newData);
+    virtual Class* getClass() const;
+    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName);
+    virtual JSValue invokeMethod(ExecState*, RuntimeMethod*, const ArgList& args);
+    virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
+    virtual JSValue valueOf(ExecState* exec) const;
+    int width() const;
+    int height() const;
+    QPixmap toPixmap();
+    QImage toImage();
+    static JSObject* createRuntimeObject(ExecState*, PassRefPtr<RootObject>, const QVariant&);
+    static QVariant variantFromObject(JSObject*, QMetaType::Type hint);
+    static bool canHandle(QMetaType::Type hint);
+};
+
+}
+
+}
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
index ee7aa1a9f8..3bd5190aa3 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
@@ -29,7 +29,10 @@
 #include "JSArray.h"
 #include "JSByteArray.h"
 #include "JSDOMBinding.h"
+#include "JSDOMWindow.h"
+#include <JSFunction.h>
 #include "JSGlobalObject.h"
+#include "JSHTMLElement.h"
 #include "JSLock.h"
 #include "JSObject.h"
 #include "ObjectPrototype.h"
@@ -43,10 +46,10 @@
 #include "qobject.h"
 #include "qstringlist.h"
 #include "qt_instance.h"
+#include "qt_pixmapruntime.h"
 #include "qvarlengtharray.h"
-#include <JSFunction.h>
+#include "qwebelement.h"
 #include <limits.h>
-#include <runtime.h>
 #include <runtime/Error.h>
 #include <runtime_array.h>
 #include <runtime_object.h>
@@ -114,6 +117,21 @@ QDebug operator<<(QDebug dbg, const JSRealType &c)
 }
 #endif
 
+// this is here as a proxy, so we'd have a class to friend in QWebElement,
+// as getting/setting a WebCore in QWebElement is private
+class QtWebElementRuntime {
+public:
+    static QWebElement create(Element* element)
+    {
+        return QWebElement(element);
+    }
+
+    static Element* get(const QWebElement& element)
+    {
+        return element.m_element;
+    }
+};
+
 static JSRealType valueRealType(ExecState* exec, JSValue val)
 {
     if (val.isNumber())
@@ -136,7 +154,7 @@ static JSRealType valueRealType(ExecState* exec, JSValue val)
             return Date;
         else if (object->inherits(&RegExpObject::info))
             return RegExp;
-        else if (object->inherits(&RuntimeObjectImp::s_info))
+        else if (object->inherits(&RuntimeObject::s_info))
             return QObj;
         return Object;
     }
@@ -290,7 +308,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                     dist = 6;
             } else {
                 UString str = value.toString(exec);
-                ret = QVariant(QChar(str.size() ? *(const ushort*)str.rep()->data() : 0));
+                ret = QVariant(QChar(str.size() ? *(const ushort*)str.rep()->characters() : 0));
                 if (type == String)
                     dist = 3;
                 else
@@ -305,7 +323,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 return QString();
             } else {
                 UString ustring = value.toString(exec);
-                ret = QVariant(QString((const QChar*)ustring.rep()->data(), ustring.size()));
+                ret = QVariant(QString((const QChar*)ustring.rep()->characters(), ustring.size()));
                 if (type == String)
                     dist = 0;
                 else
@@ -329,7 +347,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                         QVariant v = convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects);
                         if (objdist >= 0) {
                             UString ustring = (*it).ustring();
-                            QString id = QString((const QChar*)ustring.rep()->data(), ustring.size());
+                            QString id = QString((const QChar*)ustring.rep()->characters(), ustring.size());
                             result.insert(id, v);
                         }
                     }
@@ -404,7 +422,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 for (int i = 0; i < len; ++i) {
                     JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
                     UString ustring = val.toString(exec);
-                    QString qstring = QString((const QChar*)ustring.rep()->data(), ustring.size());
+                    QString qstring = QString((const QChar*)ustring.rep()->characters(), ustring.size());
 
                     result.append(qstring);
                 }
@@ -418,7 +436,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 for (int i = 0; i < len; ++i) {
                     JSValue val = array->get(exec, i);
                     UString ustring = val.toString(exec);
-                    QString qstring = QString((const QChar*)ustring.rep()->data(), ustring.size());
+                    QString qstring = QString((const QChar*)ustring.rep()->characters(), ustring.size());
 
                     result.append(qstring);
                 }
@@ -427,7 +445,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
             } else {
                 // Make a single length array
                 UString ustring = value.toString(exec);
-                QString qstring = QString((const QChar*)ustring.rep()->data(), ustring.size());
+                QString qstring = QString((const QChar*)ustring.rep()->characters(), ustring.size());
                 QStringList result;
                 result.append(qstring);
                 ret = QVariant(result);
@@ -443,7 +461,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 dist = 0;
             } else {
                 UString ustring = value.toString(exec);
-                ret = QVariant(QString((const QChar*)ustring.rep()->data(), ustring.size()).toLatin1());
+                ret = QVariant(QString((const QChar*)ustring.rep()->characters(), ustring.size()).toLatin1());
                 if (type == String)
                     dist = 5;
                 else
@@ -457,8 +475,8 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
         case QMetaType::QTime:
             if (type == Date) {
                 DateInstance* date = static_cast<DateInstance*>(object);
-                WTF::GregorianDateTime gdt;
-                WTF::msToGregorianDateTime(date->internalNumber(), true, gdt);
+                GregorianDateTime gdt;
+                msToGregorianDateTime(exec, date->internalNumber(), true, gdt);
                 if (hint == QMetaType::QDateTime) {
                     ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
                     dist = 0;
@@ -471,8 +489,8 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 }
             } else if (type == Number) {
                 double b = value.toNumber(exec);
-                WTF::GregorianDateTime gdt;
-                msToGregorianDateTime(b, true, gdt);
+                GregorianDateTime gdt;
+                msToGregorianDateTime(exec, b, true, gdt);
                 if (hint == QMetaType::QDateTime) {
                     ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
                     dist = 6;
@@ -485,7 +503,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 }
             } else if (type == String) {
                 UString ustring = value.toString(exec);
-                QString qstring = QString((const QChar*)ustring.rep()->data(), ustring.size());
+                QString qstring = QString((const QChar*)ustring.rep()->characters(), ustring.size());
 
                 if (hint == QMetaType::QDateTime) {
                     QDateTime dt = QDateTime::fromString(qstring, Qt::ISODate);
@@ -534,7 +552,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
 */
                 // Attempt to convert.. a bit risky
                 UString ustring = value.toString(exec);
-                QString qstring = QString((const QChar*)ustring.rep()->data(), ustring.size());
+                QString qstring = QString((const QChar*)ustring.rep()->characters(), ustring.size());
 
                 // this is of the form '/xxxxxx/i'
                 int firstSlash = qstring.indexOf(QLatin1Char('/'));
@@ -554,7 +572,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 }
             } else if (type == String) {
                 UString ustring = value.toString(exec);
-                QString qstring = QString((const QChar*)ustring.rep()->data(), ustring.size());
+                QString qstring = QString((const QChar*)ustring.rep()->characters(), ustring.size());
 
                 QRegExp re(qstring);
                 if (re.isValid()) {
@@ -720,6 +738,13 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                     }
                 }
                 break;
+            } else if (QtPixmapInstance::canHandle(static_cast<QMetaType::Type>(hint))) {
+                ret = QtPixmapInstance::variantFromObject(object, static_cast<QMetaType::Type>(hint));
+            } else if (hint == (QMetaType::Type) qMetaTypeId<QWebElement>()) {
+                if (object && object->inherits(&JSHTMLElement::s_info))
+                    ret = QVariant::fromValue<QWebElement>(QtWebElementRuntime::create((static_cast<JSHTMLElement*>(object))->impl()));
+                else
+                    ret = QVariant::fromValue<QWebElement>(QWebElement());
             } else if (hint == (QMetaType::Type) qMetaTypeId<QVariant>()) {
                 if (value.isUndefinedOrNull()) {
                     if (distance)
@@ -824,7 +849,7 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         }
 
         // Dates specified this way are in local time (we convert DateTimes above)
-        WTF::GregorianDateTime dt;
+        GregorianDateTime dt;
         dt.year = date.year() - 1900;
         dt.month = date.month() - 1;
         dt.monthDay = date.day();
@@ -832,7 +857,7 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         dt.minute = time.minute();
         dt.second = time.second();
         dt.isDST = -1;
-        double ms = WTF::gregorianDateTimeToMS(dt, time.msec(), /*inputIsUTC*/ false);
+        double ms = gregorianDateTimeToMS(exec, dt, time.msec(), /*inputIsUTC*/ false);
 
         return new (exec) DateInstance(exec, trunc(ms));
     }
@@ -849,6 +874,20 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         return QtInstance::getQtInstance(obj, root, QScriptEngine::QtOwnership)->createRuntimeObject(exec);
     }
 
+    if (QtPixmapInstance::canHandle(static_cast<QMetaType::Type>(variant.type())))
+        return QtPixmapInstance::createRuntimeObject(exec, root, variant);
+
+    if (type == qMetaTypeId<QWebElement>()) {
+        if (!root->globalObject()->inherits(&JSDOMWindow::s_info))
+            return jsUndefined();
+
+        Document* document = (static_cast<JSDOMWindow*>(root->globalObject()))->impl()->document();
+        if (!document)
+            return jsUndefined();
+
+        return toJS(exec, toJSDOMGlobalObject(document, exec), QtWebElementRuntime::get(variant.value<QWebElement>()));
+    }
+
     if (type == QMetaType::QVariantMap) {
         // create a new object, and stuff properties into it
         JSObject* ret = constructEmptyObject(exec);
@@ -1395,15 +1434,52 @@ bool QtRuntimeMetaMethod::getOwnPropertySlot(ExecState* exec, const Identifier&
     return QtRuntimeMethod::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-JSValue QtRuntimeMetaMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
+bool QtRuntimeMetaMethod::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (propertyName == "connect") {
+        PropertySlot slot;
+        slot.setCustom(this, connectGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
+        return true;
+    }
+
+    if (propertyName == "disconnect") {
+        PropertySlot slot;
+        slot.setCustom(this, disconnectGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
+        return true;
+    }
+
+    if (propertyName == exec->propertyNames().length) {
+        PropertySlot slot;
+        slot.setCustom(this, lengthGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
+        return true;
+    }
+
+    return QtRuntimeMethod::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+void QtRuntimeMetaMethod::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (mode == IncludeDontEnumProperties) {
+        propertyNames.add(Identifier(exec, "connect"));
+        propertyNames.add(Identifier(exec, "disconnect"));
+        propertyNames.add(exec->propertyNames().length);
+    }
+
+    QtRuntimeMethod::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+JSValue QtRuntimeMetaMethod::lengthGetter(ExecState* exec, JSValue, const Identifier&)
 {
     // QtScript always returns 0
     return jsNumber(exec, 0);
 }
 
-JSValue QtRuntimeMetaMethod::connectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
+JSValue QtRuntimeMetaMethod::connectGetter(ExecState* exec, JSValue slotBase, const Identifier& ident)
 {
-    QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slot.slotBase()));
+    QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slotBase));
     QW_DS(QtRuntimeMetaMethod, thisObj);
 
     if (!d->m_connect)
@@ -1411,9 +1487,9 @@ JSValue QtRuntimeMetaMethod::connectGetter(ExecState* exec, const Identifier& id
     return d->m_connect;
 }
 
-JSValue QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
+JSValue QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, JSValue slotBase, const Identifier& ident)
 {
-    QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slot.slotBase()));
+    QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slotBase));
     QW_DS(QtRuntimeMetaMethod, thisObj);
 
     if (!d->m_disconnect)
@@ -1581,7 +1657,27 @@ bool QtRuntimeConnectionMethod::getOwnPropertySlot(ExecState* exec, const Identi
     return QtRuntimeMethod::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-JSValue QtRuntimeConnectionMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
+bool QtRuntimeConnectionMethod::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (propertyName == exec->propertyNames().length) {
+        PropertySlot slot;
+        slot.setCustom(this, lengthGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
+        return true;
+    }
+
+    return QtRuntimeMethod::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+void QtRuntimeConnectionMethod::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (mode == IncludeDontEnumProperties)
+        propertyNames.add(exec->propertyNames().length);
+
+    QtRuntimeMethod::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+JSValue QtRuntimeConnectionMethod::lengthGetter(ExecState* exec, JSValue, const Identifier&)
 {
     // we have one formal argument, and one optional
     return jsNumber(exec, 1);
@@ -1744,7 +1840,7 @@ template <typename T> QtArray<T>::~QtArray ()
 
 template <typename T> RootObject* QtArray<T>::rootObject() const
 {
-    return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
+    return m_rootObject && m_rootObject->isValid() ? m_rootObject.get() : 0;
 }
 
 template <typename T> void QtArray<T>::setValueAt(ExecState* exec, unsigned index, JSValue aValue) const
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
index f2ce95424a..0e0ee685f4 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
@@ -20,9 +20,9 @@
 #ifndef BINDINGS_QT_RUNTIME_H_
 #define BINDINGS_QT_RUNTIME_H_
 
+#include "Bridge.h"
 #include "Completion.h"
 #include "Protect.h"
-#include "runtime.h"
 #include "runtime_method.h"
 
 #include <qbytearray.h>
@@ -151,10 +151,12 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType,  OverridesGetOwnPropertySlot | OverridesMarkChildren));
+        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount);
     }
 
 protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | InternalFunction::StructureFlags | OverridesMarkChildren;
+
     QtRuntimeMethodData *d_func() const {return d_ptr;}
     QtRuntimeMethod(QtRuntimeMethodData *dd, ExecState *exec, const Identifier &n, PassRefPtr<QtInstance> inst);
     QtRuntimeMethodData *d_ptr;
@@ -166,6 +168,8 @@ public:
     QtRuntimeMetaMethod(ExecState *exec, const Identifier &n, PassRefPtr<QtInstance> inst, int index, const QByteArray& signature, bool allowPrivate);
 
     virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
     virtual void markChildren(MarkStack& markStack);
 
@@ -175,9 +179,9 @@ protected:
 private:
     virtual CallType getCallData(CallData&);
     static JSValue JSC_HOST_CALL call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args);
-    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue connectGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue disconnectGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue connectGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue disconnectGetter(ExecState*, JSValue, const Identifier&);
 };
 
 class QtConnectionObject;
@@ -187,6 +191,8 @@ public:
     QtRuntimeConnectionMethod(ExecState *exec, const Identifier &n, bool isConnect, PassRefPtr<QtInstance> inst, int index, const QByteArray& signature );
 
     virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
 protected:
     QtRuntimeConnectionMethodData* d_func() const {return reinterpret_cast<QtRuntimeConnectionMethodData*>(d_ptr);}
@@ -194,7 +200,7 @@ protected:
 private:
     virtual CallType getCallData(CallData&);
     static JSValue JSC_HOST_CALL call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args);
-    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
     static QMultiMap<QObject *, QtConnectionObject *> connections;
     friend class QtConnectionObject;
 };
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp
index feadb074c7..1f2bfe7659 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp
@@ -28,6 +28,7 @@
 
 #include <runtime/ArrayPrototype.h>
 #include <runtime/Error.h>
+#include <runtime/PropertyNameArray.h>
 #include "JSDOMBinding.h"
 
 using namespace WebCore;
@@ -39,27 +40,44 @@ const ClassInfo RuntimeArray::s_info = { "RuntimeArray", &JSArray::info, 0, 0 };
 RuntimeArray::RuntimeArray(ExecState* exec, Bindings::Array* array)
     // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
     // We need to pass in the right global object for "array".
-    : JSObject(deprecatedGetDOMStructure<RuntimeArray>(exec))
-    , _array(array)
+    : JSArray(deprecatedGetDOMStructure<RuntimeArray>(exec))
 {
+    setSubclassData(array);
 }
 
-JSValue RuntimeArray::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+RuntimeArray::~RuntimeArray()
 {
-    RuntimeArray* thisObj = static_cast<RuntimeArray*>(asObject(slot.slotBase()));
+    delete getConcreteArray();
+}
+
+JSValue RuntimeArray::lengthGetter(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    RuntimeArray* thisObj = static_cast<RuntimeArray*>(asObject(slotBase));
     return jsNumber(exec, thisObj->getLength());
 }
 
-JSValue RuntimeArray::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue RuntimeArray::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    RuntimeArray* thisObj = static_cast<RuntimeArray*>(asObject(slot.slotBase()));
-    return thisObj->getConcreteArray()->valueAt(exec, slot.index());
+    RuntimeArray* thisObj = static_cast<RuntimeArray*>(asObject(slotBase));
+    return thisObj->getConcreteArray()->valueAt(exec, index);
+}
+
+void RuntimeArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    unsigned length = getLength();
+    for (unsigned i = 0; i < length; ++i)
+        propertyNames.add(Identifier::from(exec, i));
+
+    if (mode == IncludeDontEnumProperties)
+        propertyNames.add(exec->propertyNames().length);
+
+    JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 bool RuntimeArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     if (propertyName == exec->propertyNames().length) {
-        slot.setCustom(this, lengthGetter);
+        slot.setCacheableCustom(this, lengthGetter);
         return true;
     }
     
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
index 1218b8cbe9..e301268abc 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
@@ -26,29 +26,31 @@
 #ifndef RUNTIME_ARRAY_H_
 #define RUNTIME_ARRAY_H_
 
-#include "runtime.h"
-#include <runtime/JSGlobalObject.h>
+#include "Bridge.h"
+#include <runtime/ArrayPrototype.h>
 
 namespace JSC {
     
-class RuntimeArray : public JSObject {
+class RuntimeArray : public JSArray {
 public:
     RuntimeArray(ExecState*, Bindings::Array*);
-    
-    virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
-    virtual bool getOwnPropertySlot(ExecState *, unsigned, PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(ExecState *, const Identifier&, PropertyDescriptor&);
+    virtual ~RuntimeArray();
+
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
     virtual void put(ExecState*, unsigned propertyName, JSValue);
     
-    virtual bool deleteProperty(ExecState *exec, const Identifier &propertyName);
-    virtual bool deleteProperty(ExecState *exec, unsigned propertyName);
+    virtual bool deleteProperty(ExecState* exec, const Identifier &propertyName);
+    virtual bool deleteProperty(ExecState* exec, unsigned propertyName);
     
-    virtual const ClassInfo *classInfo() const { return &s_info; }
+    virtual const ClassInfo* classInfo() const { return &s_info; }
     
     unsigned getLength() const { return getConcreteArray()->getLength(); }
     
-    Bindings::Array *getConcreteArray() const { return _array.get(); }
+    Bindings::Array* getConcreteArray() const { return static_cast<Bindings::Array*>(subclassData()); }
 
     static const ClassInfo s_info;
 
@@ -57,17 +59,10 @@ public:
         return globalObject->arrayPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
-    {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
-    }
-
 private:
     static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
-    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue indexGetter(ExecState*, const Identifier&, const PropertySlot&);
-
-    OwnPtr<Bindings::Array> _array;
+    static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue indexGetter(ExecState*, JSValue, unsigned);
 };
     
 } // namespace JSC
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp
index ffe4c0a5a6..29145b6536 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp
@@ -27,6 +27,8 @@
 #include "runtime_method.h"
 
 #include "JSDOMBinding.h"
+#include "JSHTMLElement.h"
+#include "JSPluginElementFunctions.h"
 #include "runtime_object.h"
 #include <runtime/Error.h>
 #include <runtime/FunctionPrototype.h>
@@ -39,7 +41,7 @@ using namespace Bindings;
 
 ASSERT_CLASS_FITS_IN_CELL(RuntimeMethod);
 
-const ClassInfo RuntimeMethod::s_info = { "RuntimeMethod", 0, 0, 0 };
+const ClassInfo RuntimeMethod::s_info = { "RuntimeMethod", &InternalFunction::info, 0, 0 };
 
 RuntimeMethod::RuntimeMethod(ExecState* exec, const Identifier& ident, Bindings::MethodList& m)
     // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
@@ -50,9 +52,9 @@ RuntimeMethod::RuntimeMethod(ExecState* exec, const Identifier& ident, Bindings:
 {
 }
 
-JSValue RuntimeMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue RuntimeMethod::lengthGetter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    RuntimeMethod* thisObj = static_cast<RuntimeMethod*>(asObject(slot.slotBase()));
+    RuntimeMethod* thisObj = static_cast<RuntimeMethod*>(asObject(slotBase));
 
     // Ick!  There may be more than one method with this name.  Arbitrarily
     // just pick the first method.  The fundamental problem here is that 
@@ -66,7 +68,7 @@ JSValue RuntimeMethod::lengthGetter(ExecState* exec, const Identifier&, const Pr
 bool RuntimeMethod::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot &slot)
 {
     if (propertyName == exec->propertyNames().length) {
-        slot.setCustom(this, lengthGetter);
+        slot.setCacheableCustom(this, lengthGetter);
         return true;
     }
     
@@ -91,27 +93,27 @@ static JSValue JSC_HOST_CALL callRuntimeMethod(ExecState* exec, JSObject* functi
 
     if (method->methods()->isEmpty())
         return jsUndefined();
-    
-    RuntimeObjectImp* imp;
 
-    if (thisValue.inherits(&RuntimeObjectImp::s_info)) {
-        imp = static_cast<RuntimeObjectImp*>(asObject(thisValue));
+    RefPtr<Instance> instance;
+
+    if (thisValue.inherits(&RuntimeObject::s_info)) {
+        RuntimeObject* runtimeObject = static_cast<RuntimeObject*>(asObject(thisValue));
+        instance = runtimeObject->getInternalInstance();
+        if (!instance) 
+            return RuntimeObject::throwInvalidAccessError(exec);
     } else {
-        // If thisObj is the DOM object for a plugin, get the corresponding
-        // runtime object from the DOM object.
-        JSValue value = thisValue.get(exec, Identifier(exec, "__apple_runtime_object"));
-        if (value.inherits(&RuntimeObjectImp::s_info))    
-            imp = static_cast<RuntimeObjectImp*>(asObject(value));
-        else
+        // Calling a runtime object of a plugin element?
+        if (thisValue.inherits(&JSHTMLElement::s_info)) {
+            HTMLElement* element = static_cast<JSHTMLElement*>(asObject(thisValue))->impl();
+            instance = pluginInstance(element);
+        }
+        if (!instance)
             return throwError(exec, TypeError);
     }
+    ASSERT(instance);
 
-    RefPtr<Instance> instance = imp->getInternalInstance();
-    if (!instance) 
-        return RuntimeObjectImp::throwInvalidAccessError(exec);
-        
     instance->begin();
-    JSValue result = instance->invokeMethod(exec, *method->methods(), args);
+    JSValue result = instance->invokeMethod(exec, method, args);
     instance->end();
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
index 967604846c..9c80ba19c4 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
@@ -26,7 +26,7 @@
 #ifndef RUNTIME_FUNCTION_H_
 #define RUNTIME_FUNCTION_H_
 
-#include "runtime.h"
+#include "Bridge.h"
 #include <runtime/InternalFunction.h>
 #include <runtime/JSGlobalObject.h>
 #include <wtf/OwnPtr.h>
@@ -47,12 +47,14 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+
 private:
     static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesMarkChildren | InternalFunction::StructureFlags;
-    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual CallType getCallData(CallData&);
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
index 9583fb23f0..83aae748fa 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
@@ -34,32 +34,31 @@
 using namespace WebCore;
 
 namespace JSC {
+namespace Bindings {
 
-using namespace Bindings;
+const ClassInfo RuntimeObject::s_info = { "RuntimeObject", 0, 0, 0 };
 
-const ClassInfo RuntimeObjectImp::s_info = { "RuntimeObject", 0, 0, 0 };
-
-RuntimeObjectImp::RuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> instance)
+RuntimeObject::RuntimeObject(ExecState* exec, PassRefPtr<Instance> instance)
     // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
     // We need to pass in the right global object for "i".
-    : JSObject(deprecatedGetDOMStructure<RuntimeObjectImp>(exec))
+    : JSObject(deprecatedGetDOMStructure<RuntimeObject>(exec))
     , m_instance(instance)
 {
 }
 
-RuntimeObjectImp::RuntimeObjectImp(ExecState*, NonNullPassRefPtr<Structure> structure, PassRefPtr<Instance> instance)
+RuntimeObject::RuntimeObject(ExecState*, NonNullPassRefPtr<Structure> structure, PassRefPtr<Instance> instance)
     : JSObject(structure)
     , m_instance(instance)
 {
 }
 
-RuntimeObjectImp::~RuntimeObjectImp()
+RuntimeObject::~RuntimeObject()
 {
     if (m_instance)
         m_instance->willDestroyRuntimeObject();
 }
 
-void RuntimeObjectImp::invalidate()
+void RuntimeObject::invalidate()
 {
     ASSERT(m_instance);
     if (m_instance)
@@ -67,9 +66,9 @@ void RuntimeObjectImp::invalidate()
     m_instance = 0;
 }
 
-JSValue RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue RuntimeObject::fallbackObjectGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
+    RuntimeObject* thisObj = static_cast<RuntimeObject*>(asObject(slotBase));
     RefPtr<Instance> instance = thisObj->m_instance;
 
     if (!instance)
@@ -85,9 +84,9 @@ JSValue RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier
     return result;
 }
 
-JSValue RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue RuntimeObject::fieldGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {    
-    RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
+    RuntimeObject* thisObj = static_cast<RuntimeObject*>(asObject(slotBase));
     RefPtr<Instance> instance = thisObj->m_instance;
 
     if (!instance)
@@ -104,9 +103,9 @@ JSValue RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propert
     return result;
 }
 
-JSValue RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue RuntimeObject::methodGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
+    RuntimeObject* thisObj = static_cast<RuntimeObject*>(asObject(slotBase));
     RefPtr<Instance> instance = thisObj->m_instance;
 
     if (!instance)
@@ -114,16 +113,14 @@ JSValue RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& proper
     
     instance->begin();
 
-    Class *aClass = instance->getClass();
-    MethodList methodList = aClass->methodsNamed(propertyName, instance.get());
-    JSValue result = new (exec) RuntimeMethod(exec, propertyName, methodList);
+    JSValue method = instance->getMethod(exec, propertyName);
 
     instance->end();
             
-    return result;
+    return method;
 }
 
-bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& propertyName, PropertySlot& slot)
+bool RuntimeObject::getOwnPropertySlot(ExecState *exec, const Identifier& propertyName, PropertySlot& slot)
 {
     if (!m_instance) {
         throwInvalidAccessError(exec);
@@ -168,7 +165,7 @@ bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& pro
     return instance->getOwnPropertySlot(this, exec, propertyName, slot);
 }
 
-bool RuntimeObjectImp::getOwnPropertyDescriptor(ExecState *exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool RuntimeObject::getOwnPropertyDescriptor(ExecState *exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
     if (!m_instance) {
         throwInvalidAccessError(exec);
@@ -217,7 +214,7 @@ bool RuntimeObjectImp::getOwnPropertyDescriptor(ExecState *exec, const Identifie
     return instance->getOwnPropertyDescriptor(this, exec, propertyName, descriptor);
 }
 
-void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+void RuntimeObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (!m_instance) {
         throwInvalidAccessError(exec);
@@ -237,13 +234,13 @@ void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSVa
     instance->end();
 }
 
-bool RuntimeObjectImp::deleteProperty(ExecState*, const Identifier&)
+bool RuntimeObject::deleteProperty(ExecState*, const Identifier&)
 {
     // Can never remove a property of a RuntimeObject.
     return false;
 }
 
-JSValue RuntimeObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue RuntimeObject::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (!m_instance)
         return throwInvalidAccessError(exec);
@@ -258,14 +255,15 @@ JSValue RuntimeObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType h
 
 static JSValue JSC_HOST_CALL callRuntimeObject(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
-    RefPtr<Instance> instance(static_cast<RuntimeObjectImp*>(function)->getInternalInstance());
+    ASSERT(function->inherits(&RuntimeObject::s_info));
+    RefPtr<Instance> instance(static_cast<RuntimeObject*>(function)->getInternalInstance());
     instance->begin();
     JSValue result = instance->invokeDefaultMethod(exec, args);
     instance->end();
     return result;
 }
 
-CallType RuntimeObjectImp::getCallData(CallData& callData)
+CallType RuntimeObject::getCallData(CallData& callData)
 {
     if (!m_instance)
         return CallTypeNone;
@@ -280,7 +278,8 @@ CallType RuntimeObjectImp::getCallData(CallData& callData)
 
 static JSObject* callRuntimeConstructor(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    RefPtr<Instance> instance(static_cast<RuntimeObjectImp*>(constructor)->getInternalInstance());
+    ASSERT(constructor->inherits(&RuntimeObject::s_info));
+    RefPtr<Instance> instance(static_cast<RuntimeObject*>(constructor)->getInternalInstance());
     instance->begin();
     JSValue result = instance->invokeConstruct(exec, args);
     instance->end();
@@ -289,7 +288,7 @@ static JSObject* callRuntimeConstructor(ExecState* exec, JSObject* constructor,
     return result.isObject() ? static_cast<JSObject*>(result.asCell()) : constructor;
 }
 
-ConstructType RuntimeObjectImp::getConstructData(ConstructData& constructData)
+ConstructType RuntimeObject::getConstructData(ConstructData& constructData)
 {
     if (!m_instance)
         return ConstructTypeNone;
@@ -302,7 +301,7 @@ ConstructType RuntimeObjectImp::getConstructData(ConstructData& constructData)
     return ConstructTypeHost;
 }
 
-void RuntimeObjectImp::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void RuntimeObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode)
 {
     if (!m_instance) {
         throwInvalidAccessError(exec);
@@ -316,14 +315,10 @@ void RuntimeObjectImp::getPropertyNames(ExecState* exec, PropertyNameArray& prop
     instance->end();
 }
 
-void RuntimeObjectImp::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    getOwnPropertyNames(exec, propertyNames);
-}
-
-JSObject* RuntimeObjectImp::throwInvalidAccessError(ExecState* exec)
+JSObject* RuntimeObject::throwInvalidAccessError(ExecState* exec)
 {
     return throwError(exec, ReferenceError, "Trying to access object from destroyed plug-in.");
 }
 
 }
+}
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
index 391e078d6a..b735e36d07 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
@@ -26,15 +26,16 @@
 #ifndef KJS_RUNTIME_OBJECT_H
 #define KJS_RUNTIME_OBJECT_H
 
-#include "runtime.h"
+#include "Bridge.h"
 #include <runtime/JSGlobalObject.h>
 
 namespace JSC {
+namespace Bindings {
 
-class RuntimeObjectImp : public JSObject {
+class RuntimeObject : public JSObject {
 public:
-    RuntimeObjectImp(ExecState*, PassRefPtr<Bindings::Instance>);
-    virtual ~RuntimeObjectImp();
+    RuntimeObject(ExecState*, PassRefPtr<Instance>);
+    virtual ~RuntimeObject();
 
     virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
     virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor&);
@@ -44,12 +45,11 @@ public:
     virtual CallType getCallData(CallData&);
     virtual ConstructType getConstructData(ConstructData&);
 
-    virtual void getPropertyNames(ExecState*, PropertyNameArray&);
-    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
     void invalidate();
 
-    Bindings::Instance* getInternalInstance() const { return m_instance.get(); }
+    Instance* getInternalInstance() const { return m_instance.get(); }
 
     static JSObject* throwInvalidAccessError(ExecState*);
 
@@ -62,23 +62,24 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 protected:
     static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
-    RuntimeObjectImp(ExecState*, NonNullPassRefPtr<Structure>, PassRefPtr<Bindings::Instance>);
+    RuntimeObject(ExecState*, NonNullPassRefPtr<Structure>, PassRefPtr<Instance>);
 
 private:
     virtual const ClassInfo* classInfo() const { return &s_info; }
     
-    static JSValue fallbackObjectGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue fieldGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue methodGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue fallbackObjectGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue fieldGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue methodGetter(ExecState*, JSValue, const Identifier&);
 
-    RefPtr<Bindings::Instance> m_instance;
+    RefPtr<Instance> m_instance;
 };
     
-} // namespace
+}
+}
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_root.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_root.cpp
index 0e9bf742df..09fd43bc9f 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_root.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_root.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "runtime_root.h"
 
-#include "runtime.h"
+#include "Bridge.h"
 #include "runtime_object.h"
 #include <runtime/JSGlobalObject.h>
 #include <wtf/HashCountedSet.h>
@@ -71,6 +71,10 @@ RootObject* findRootObject(JSGlobalObject* globalObject)
     return 0;
 }
 
+RootObject::InvalidationCallback::~InvalidationCallback()
+{
+}
+
 PassRefPtr<RootObject> RootObject::create(const void* nativeHandle, JSGlobalObject* globalObject)
 {
     return adoptRef(new RootObject(nativeHandle, globalObject));
@@ -97,8 +101,8 @@ void RootObject::invalidate()
         return;
 
     {
-        HashSet<RuntimeObjectImp*>::iterator end = m_runtimeObjects.end();
-        for (HashSet<RuntimeObjectImp*>::iterator it = m_runtimeObjects.begin(); it != end; ++it)
+        HashSet<RuntimeObject*>::iterator end = m_runtimeObjects.end();
+        for (HashSet<RuntimeObject*>::iterator it = m_runtimeObjects.begin(); it != end; ++it)
             (*it)->invalidate();
         
         m_runtimeObjects.clear();
@@ -109,6 +113,14 @@ void RootObject::invalidate()
     m_nativeHandle = 0;
     m_globalObject = 0;
 
+    {
+        HashSet<InvalidationCallback*>::iterator end = m_invalidationCallbacks.end();
+        for (HashSet<InvalidationCallback*>::iterator iter = m_invalidationCallbacks.begin(); iter != end; ++iter)
+            (**iter)(this);
+
+        m_invalidationCallbacks.clear();
+    }
+
     ProtectCountSet::iterator end = m_protectCountSet.end();
     for (ProtectCountSet::iterator it = m_protectCountSet.begin(); it != end; ++it)
         JSC::gcUnprotect(it->first);
@@ -156,7 +168,7 @@ JSGlobalObject* RootObject::globalObject() const
     return m_globalObject;
 }
 
-void RootObject::addRuntimeObject(RuntimeObjectImp* object)
+void RootObject::addRuntimeObject(RuntimeObject* object)
 {
     ASSERT(m_isValid);
     ASSERT(!m_runtimeObjects.contains(object));
@@ -164,7 +176,7 @@ void RootObject::addRuntimeObject(RuntimeObjectImp* object)
     m_runtimeObjects.add(object);
 }        
     
-void RootObject::removeRuntimeObject(RuntimeObjectImp* object)
+void RootObject::removeRuntimeObject(RuntimeObject* object)
 {
     ASSERT(m_isValid);
     ASSERT(m_runtimeObjects.contains(object));
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_root.h b/src/3rdparty/webkit/WebCore/bridge/runtime_root.h
index fdd73c4883..04f382aa33 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_root.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_root.h
@@ -41,11 +41,11 @@ namespace JSC {
 
 class Interpreter;
 class JSGlobalObject;
-class RuntimeObjectImp;
 
 namespace Bindings {
 
 class RootObject;
+class RuntimeObject;
 
 typedef HashCountedSet<JSObject*> ProtectCountSet;
 
@@ -70,8 +70,15 @@ public:
     const void* nativeHandle() const;
     JSGlobalObject* globalObject() const;
 
-    void addRuntimeObject(RuntimeObjectImp*);
-    void removeRuntimeObject(RuntimeObjectImp*);
+    void addRuntimeObject(RuntimeObject*);
+    void removeRuntimeObject(RuntimeObject*);
+
+    struct InvalidationCallback {
+        virtual void operator()(RootObject*) = 0;
+        virtual ~InvalidationCallback();
+    };
+    void addInvalidationCallback(InvalidationCallback* callback) { m_invalidationCallbacks.add(callback); }
+
 private:
     RootObject(const void* nativeHandle, JSGlobalObject*);
     
@@ -79,9 +86,11 @@ private:
     
     const void* m_nativeHandle;
     ProtectedPtr<JSGlobalObject> m_globalObject;
+
     ProtectCountSet m_protectCountSet;
+    HashSet<RuntimeObject*> m_runtimeObjects;    
 
-    HashSet<RuntimeObjectImp*> m_runtimeObjects;    
+    HashSet<InvalidationCallback*> m_invalidationCallbacks;
 };
 
 } // namespace Bindings
diff --git a/src/3rdparty/webkit/WebCore/bridge/testbindings.cpp b/src/3rdparty/webkit/WebCore/bridge/testbindings.cpp
index e4bbc7e6e8..bcba115b35 100644
--- a/src/3rdparty/webkit/WebCore/bridge/testbindings.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/testbindings.cpp
@@ -19,19 +19,17 @@
  *
  */
 #include "config.h"
-#include <assert.h>
-#include <stdio.h>
-#include <string.h>
 
-#include "JSValue.h"
+#include "Bridge.h"
 #include "JSObject.h"
-#include "types.h"
+#include "JSValue.h"
 #include "interpreter.h"
-
 #include "npruntime_internal.h"
-
-#include "runtime.h"
 #include "runtime_object.h"
+#include "types.h"
+#include <assert.h>
+#include <stdio.h>
+#include <string.h>
 
 
 #define LOG(formatAndArgs...) { \
diff --git a/src/3rdparty/webkit/WebCore/bridge/testbindings.mm b/src/3rdparty/webkit/WebCore/bridge/testbindings.mm
index ca70e172f4..31564a8385 100644
--- a/src/3rdparty/webkit/WebCore/bridge/testbindings.mm
+++ b/src/3rdparty/webkit/WebCore/bridge/testbindings.mm
@@ -24,20 +24,18 @@
  */
 
 #include "config.h"
-#include <Foundation/Foundation.h>
 
+#include "Bridge.h"
+#include <Foundation/Foundation.h>
+#include "JSObject.h"
+#include "JSValue.h"
 #import <WebKit/WebScriptObject.h>
-
+#include "interpreter.h"
+#include "runtime_object.h"
 #include <stdio.h>
 #include <string.h>
-
-#include "JSValue.h"
-#include "JSObject.h"
 #include "types.h"
-#include "interpreter.h"
 
-#include "runtime.h"
-#include "runtime_object.h"
 
 #define LOG(formatAndArgs...) { \
     fprintf (stderr, "%s:  ", __PRETTY_FUNCTION__); \
diff --git a/src/3rdparty/webkit/WebCore/bridge/testqtbindings.cpp b/src/3rdparty/webkit/WebCore/bridge/testqtbindings.cpp
index 41a9a3a4f9..73df1550cb 100644
--- a/src/3rdparty/webkit/WebCore/bridge/testqtbindings.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/testqtbindings.cpp
@@ -23,21 +23,18 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 #include "config.h"
-#include <assert.h>
-#include <stdio.h>
-#include <string.h>
 
-#include "JSValue.h"
+#include "Bridge.h"
 #include "JSObject.h"
-#include "types.h"
+#include "JSValue.h"
 #include "interpreter.h"
-
-#include "qobject.h"
 #include "qdebug.h"
-
-#include "runtime.h"
+#include "qobject.h"
 #include "runtime_object.h"
-
+#include "types.h"
+#include <assert.h>
+#include <stdio.h>
+#include <string.h>
 
 
 class MyObject : public QObject
diff --git a/src/3rdparty/webkit/WebCore/config.h b/src/3rdparty/webkit/WebCore/config.h
index 003acbee17..b612e3980a 100644
--- a/src/3rdparty/webkit/WebCore/config.h
+++ b/src/3rdparty/webkit/WebCore/config.h
@@ -25,7 +25,7 @@
 
 #include <wtf/Platform.h>
 
-#if PLATFORM(WIN_OS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
+#if OS(WINDOWS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
 #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
 #define JS_EXPORTDATA __declspec(dllexport)
 #else
@@ -36,8 +36,10 @@
 #else
 #define WEBKIT_EXPORTDATA __declspec(dllimport)
 #endif
+#define JS_EXPORTCLASS JS_EXPORTDATA
 #else
 #define JS_EXPORTDATA
+#define JS_EXPORTCLASS
 #define WEBKIT_EXPORTDATA
 #endif
 
@@ -47,7 +49,7 @@
 #define HAVE_FUNC_USLEEP 1
 #endif /* __APPLE__ */
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 
 #ifndef _WIN32_WINNT
 #define _WIN32_WINNT 0x0500
@@ -73,7 +75,36 @@
 #endif
 #endif
 
-#endif /* PLATFORM(WIN_OS) */
+#endif /* OS(WINDOWS) */
+
+#if PLATFORM(ANDROID)
+#define WEBCORE_NAVIGATOR_VENDOR "Google Inc."
+// This must be defined before we include FastMalloc.h, below.
+#define USE_SYSTEM_MALLOC 1
+#define LOG_DISABLED 1
+#include <wtf/Assertions.h>
+// Central place to set which optional features Android uses.
+#define ENABLE_CHANNEL_MESSAGING 1
+#define ENABLE_DOM_STORAGE 1
+#undef ENABLE_FTPDIR  // Enabled by default in Platform.h
+#define ENABLE_FTPDIR 0
+#ifndef ENABLE_SVG
+#define ENABLE_SVG 0
+#endif
+#define ENABLE_VIDEO 1
+#define ENABLE_WORKERS 1
+#define ENABLE_XBL 0
+#define ENABLE_XHTMLMP 0
+#define ENABLE_XPATH 0
+#define ENABLE_XSLT 0
+#define ENABLE_ARCHIVE 0
+#define ENABLE_OFFLINE_WEB_APPLICATIONS 1
+#undef ENABLE_GEOLOCATION  // Disabled by default in Platform.h
+#define ENABLE_GEOLOCATION 1
+#undef ENABLE_INSPECTOR  // Enabled by default in Platform.h
+#define ENABLE_INSPECTOR 0
+#define ENABLE_EVENT_SOURCE 0
+#endif /* PLATFORM(ANDROID) */
 
 #ifdef __cplusplus
 
@@ -103,7 +134,7 @@
 
 #if COMPILER(MSVC)
 #define SKIP_STATIC_CONSTRUCTORS_ON_MSVC 1
-#else
+#elif !COMPILER(WINSCW)
 #define SKIP_STATIC_CONSTRUCTORS_ON_GCC 1
 #endif
 
@@ -141,12 +172,7 @@
 #define WTF_USE_NEW_THEME 1
 #endif // PLATFORM(MAC)
 
-#if PLATFORM(SYMBIAN)
-#undef WIN32
-#undef _WIN32
-#if COMPILER(WINSCW)
-#undef SKIP_STATIC_CONSTRUCTORS_ON_GCC
-#endif
+#if OS(SYMBIAN)
 #define USE_SYSTEM_MALLOC 1
 #define U_HAVE_INT8_T 0
 #define U_HAVE_INT16_T 0
@@ -161,10 +187,10 @@
 
 #if PLATFORM(CHROMIUM)
 
-#if !PLATFORM(DARWIN)
+#if !OS(DARWIN)
 // Define SKIA on non-Mac.
 #define WTF_PLATFORM_SKIA 1
-#endif /* !PLATFORM(DARWIN) */
+#endif /* !OS(DARWIN) */
 
 // Chromium uses this file instead of JavaScriptCore/config.h to compile
 // JavaScriptCore/wtf (chromium doesn't compile the rest of JSC). Therefore,
diff --git a/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl b/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl
index db0333ac4c..2b158ff8b6 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=94180bad-a74e-4df9-adbc-6ce4e5b96155,
-        ImplementationUUID=354aa39e-ad53-4e9a-a927-80c3966c47f2
-    ] CSSCharsetRule : CSSRule {
+    interface CSSCharsetRule : CSSRule {
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute [ConvertNullStringTo=Null] DOMString encoding;
 #else
diff --git a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
index b8769f9a9a..90c0150125 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -33,10 +33,8 @@
 #include "CSSReflectValue.h"
 #include "CSSTimingFunctionValue.h"
 #include "CSSValueList.h"
-#include "CachedImage.h"
 #include "Document.h"
 #include "ExceptionCode.h"
-#include "Pair.h"
 #include "Rect.h"
 #include "RenderBox.h"
 #include "RenderLayer.h"
@@ -148,6 +146,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitAnimationDelay,
     CSSPropertyWebkitAnimationDirection,
     CSSPropertyWebkitAnimationDuration,
+    CSSPropertyWebkitAnimationFillMode,
     CSSPropertyWebkitAnimationIterationCount,
     CSSPropertyWebkitAnimationName,
     CSSPropertyWebkitAnimationPlayState,
@@ -173,6 +172,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitBoxReflect,
     CSSPropertyWebkitBoxShadow,
     CSSPropertyWebkitBoxSizing,
+    CSSPropertyWebkitColorCorrection,
     CSSPropertyWebkitColumnBreakAfter,
     CSSPropertyWebkitColumnBreakBefore,
     CSSPropertyWebkitColumnBreakInside,
@@ -262,7 +262,7 @@ static const int computedProperties[] = {
     CSSPropertyWritingMode,
     CSSPropertyGlyphOrientationHorizontal,
     CSSPropertyGlyphOrientationVertical,
-    CSSPropertyWebkitShadow
+    CSSPropertyWebkitSvgShadow
 #endif
 };
 
@@ -630,9 +630,9 @@ static PassRefPtr<CSSValue> fillRepeatToCSSValue(EFillRepeat xRepeat, EFillRepea
     // if the two values are equivalent to repeat-x or repeat-y, just return the shorthand.
     if (xRepeat == yRepeat)
         return CSSPrimitiveValue::create(xRepeat);
-    if (xRepeat == CSSValueRepeat && yRepeat == CSSValueNoRepeat)
+    if (xRepeat == RepeatFill && yRepeat == NoRepeatFill)
         return CSSPrimitiveValue::createIdentifier(CSSValueRepeatX);
-    if (xRepeat == CSSValueNoRepeat && yRepeat == CSSValueRepeat)
+    if (xRepeat == NoRepeatFill && yRepeat == RepeatFill)
         return CSSPrimitiveValue::createIdentifier(CSSValueRepeatY);
 
     RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
@@ -899,9 +899,9 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 return CSSPrimitiveValue::createIdentifier(CSSValueNormal);
             return CSSPrimitiveValue::create(style->letterSpacing(), CSSPrimitiveValue::CSS_PX);
         case CSSPropertyWebkitLineClamp:
-            if (style->lineClamp() == -1)
+            if (style->lineClamp().isNone())
                 return CSSPrimitiveValue::createIdentifier(CSSValueNone);
-            return CSSPrimitiveValue::create(style->lineClamp(), CSSPrimitiveValue::CSS_PERCENTAGE);
+            return CSSPrimitiveValue::create(style->lineClamp().value(), style->lineClamp().isPercentage() ? CSSPrimitiveValue::CSS_PERCENTAGE : CSSPrimitiveValue::CSS_NUMBER);
         case CSSPropertyLineHeight: {
             Length length = style->lineHeight();
             if (length.isNegative())
@@ -911,8 +911,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 // for how high to be in pixels does include things like minimum font size and the zoom factor.
                 // On the other hand, since font-size doesn't include the zoom factor, we really can't do
                 // that here either.
-                // The line height returned is rounded to the nearest integer.
-                return CSSPrimitiveValue::create(length.calcMinValue(style->fontDescription().specifiedSize(), true), CSSPrimitiveValue::CSS_PX);
+                return CSSPrimitiveValue::create(static_cast<int>(length.percent() * style->fontDescription().specifiedSize()) / 100, CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(length.value(), CSSPrimitiveValue::CSS_PX);
         }
         case CSSPropertyListStyleImage:
@@ -1200,6 +1199,30 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         }
         case CSSPropertyWebkitAnimationDuration:
             return getDurationValue(style->animations());
+        case CSSPropertyWebkitAnimationFillMode: {
+            RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
+            const AnimationList* t = style->animations();
+            if (t) {
+                for (size_t i = 0; i < t->size(); ++i) {
+                    switch (t->animation(i)->fillMode()) {
+                    case AnimationFillModeNone:
+                        list->append(CSSPrimitiveValue::createIdentifier(CSSValueNone));
+                        break;
+                    case AnimationFillModeForwards:
+                        list->append(CSSPrimitiveValue::createIdentifier(CSSValueForwards));
+                        break;
+                    case AnimationFillModeBackwards:
+                        list->append(CSSPrimitiveValue::createIdentifier(CSSValueBackwards));
+                        break;
+                    case AnimationFillModeBoth:
+                        list->append(CSSPrimitiveValue::createIdentifier(CSSValueBoth));
+                        break;
+                    }
+                }
+            } else
+                list->append(CSSPrimitiveValue::createIdentifier(CSSValueNone));
+            return list.release();
+        }
         case CSSPropertyWebkitAnimationIterationCount: {
             RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
             const AnimationList* t = style->animations();
@@ -1348,6 +1371,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return getTimingFunctionValue(style->transitions());
         case CSSPropertyPointerEvents:
             return CSSPrimitiveValue::create(style->pointerEvents());
+        case CSSPropertyWebkitColorCorrection:
+            return CSSPrimitiveValue::create(style->colorSpace());
 
         /* Shorthand properties, currently not supported see bug 13658*/
         case CSSPropertyBackground:
@@ -1475,7 +1500,7 @@ unsigned CSSComputedStyleDeclaration::length() const
 String CSSComputedStyleDeclaration::item(unsigned i) const
 {
     if (i >= length())
-        return String();
+        return "";
 
     return getPropertyName(static_cast<CSSPropertyID>(computedProperties[i]));
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp
index c1a517c2a2..fe10cf3cfb 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp
@@ -25,7 +25,6 @@
 #include "DocLoader.h"
 #include "Document.h"
 #include "PlatformString.h"
-#include "RenderStyle.h"
 #include <wtf/MathExtras.h>
 #include <wtf/UnusedParam.h>
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSFontFace.cpp b/src/3rdparty/webkit/WebCore/css/CSSFontFace.cpp
index 4d8da59a8f..70cd9bbb20 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSFontFace.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSFontFace.cpp
@@ -77,8 +77,11 @@ void CSSFontFace::addSource(CSSFontFaceSource* source)
     source->setFontFace(this);
 }
 
-void CSSFontFace::fontLoaded(CSSFontFaceSource*)
+void CSSFontFace::fontLoaded(CSSFontFaceSource* source)
 {
+    if (source != m_activeSource)
+        return;
+
     // FIXME: Can we assert that m_segmentedFontFaces is not empty? That may
     // require stopping in-progress font loading when the last
     // CSSSegmentedFontFace is removed.
@@ -97,17 +100,22 @@ void CSSFontFace::fontLoaded(CSSFontFaceSource*)
 
 SimpleFontData* CSSFontFace::getFontData(const FontDescription& fontDescription, bool syntheticBold, bool syntheticItalic)
 {
+    m_activeSource = 0;
     if (!isValid())
         return 0;
-        
+
     ASSERT(!m_segmentedFontFaces.isEmpty());
     CSSFontSelector* fontSelector = (*m_segmentedFontFaces.begin())->fontSelector();
 
-    SimpleFontData* result = 0;
-    unsigned size = m_sources.size();
-    for (unsigned i = 0; i < size && !result; i++)
-        result = m_sources[i]->getFontData(fontDescription, syntheticBold, syntheticItalic, fontSelector);
-    return result;
+    size_t size = m_sources.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (SimpleFontData* result = m_sources[i]->getFontData(fontDescription, syntheticBold, syntheticItalic, fontSelector)) {
+            m_activeSource = m_sources[i];
+            return result;
+        }
+    }
+
+    return 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSFontFace.h b/src/3rdparty/webkit/WebCore/css/CSSFontFace.h
index 41c9c55822..4e2fee5a8d 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSFontFace.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSFontFace.h
@@ -82,6 +82,7 @@ public:
 private:
     CSSFontFace(FontTraitsMask traitsMask)
         : m_traitsMask(traitsMask)
+        , m_activeSource(0)
     {
     }
 
@@ -89,6 +90,7 @@ private:
     Vector<UnicodeRange> m_ranges;
     HashSet<CSSSegmentedFontFace*> m_segmentedFontFaces;
     Vector<CSSFontFaceSource*> m_sources;
+    CSSFontFaceSource* m_activeSource;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSFontFaceRule.idl b/src/3rdparty/webkit/WebCore/css/CSSFontFaceRule.idl
index 514c7ddc1e..bd38a6137c 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSFontFaceRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSFontFaceRule.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=8afa4b1a-39fe-49fb-be6d-4d56e81d9b4a,
-        ImplementationUUID=5a7971d9-5aad-4ed7-be67-3a1644560256
-    ] CSSFontFaceRule : CSSRule {
+    interface CSSFontFaceRule : CSSRule {
         readonly attribute CSSStyleDeclaration style;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp b/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp
index 111cea29ec..1354e68ae5 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp
@@ -107,8 +107,7 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
 #else
     if (!m_font) {
 #endif
-        FontPlatformData* data = fontCache()->getCachedFontPlatformData(fontDescription, m_string);
-        SimpleFontData* fontData = fontCache()->getCachedFontData(data);
+        SimpleFontData* fontData = fontCache()->getCachedFontData(fontDescription, m_string);
 
         // We're local. Just return a SimpleFontData from the normal cache.
         return fontData;
@@ -179,10 +178,11 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
         if (DocLoader* docLoader = fontSelector->docLoader())
             m_font->beginLoadIfNeeded(docLoader);
         // FIXME: m_string is a URL so it makes no sense to pass it as a family name.
-        FontPlatformData* tempData = fontCache()->getCachedFontPlatformData(fontDescription, m_string);
+        SimpleFontData* tempData = fontCache()->getCachedFontData(fontDescription, m_string);
         if (!tempData)
             tempData = fontCache()->getLastResortFallbackFont(fontDescription);
-        fontData.set(new SimpleFontData(*tempData, true, true));
+
+        fontData.set(new SimpleFontData(tempData->platformData(), true, true));
     }
 
     m_fontDataTable.set(hashKey, fontData.get());
diff --git a/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp
index 35bc876dda..56ee261715 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp
@@ -45,7 +45,6 @@
 #include "FontCache.h"
 #include "FontFamilyValue.h"
 #include "Frame.h"
-#include "NodeList.h"
 #include "RenderObject.h"
 #include "Settings.h"
 #include "SimpleFontData.h"
@@ -395,7 +394,7 @@ static FontData* fontDataForGenericFamily(Document* document, const FontDescript
         genericFamily = settings->standardFontFamily();
 
     if (!genericFamily.isEmpty())
-        return fontCache()->getCachedFontData(fontCache()->getCachedFontPlatformData(fontDescription, genericFamily));
+        return fontCache()->getCachedFontData(fontDescription, genericFamily);
 
     return 0;
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSGradientValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSGradientValue.cpp
index 3f45e477b5..5946d7a828 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSGradientValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSGradientValue.cpp
@@ -29,9 +29,7 @@
 #include "CSSStyleSelector.h"
 #include "GeneratedImage.h"
 #include "Gradient.h"
-#include "GraphicsContext.h"
 #include "Image.h"
-#include "ImageBuffer.h"
 #include "IntSize.h"
 #include "IntSizeHash.h"
 #include "PlatformString.h"
diff --git a/src/3rdparty/webkit/WebCore/css/CSSGrammar.y b/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
index 0530e913ed..7183efa9f9 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
+++ b/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
@@ -97,7 +97,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %}
 
-%expect 51
+%expect 54
 
 %nonassoc LOWEST_PREC
 
@@ -184,18 +184,15 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %type <rule> charset
 %type <rule> ruleset
-%type <rule> valid_rule_or_import
 %type <rule> media
 %type <rule> import
+%type <rule> namespace
 %type <rule> page
 %type <rule> font_face
 %type <rule> keyframes
 %type <rule> invalid_rule
 %type <rule> save_block
 %type <rule> invalid_at
-%type <rule> invalid_at_list
-%type <rule> invalid_import
-%type <rule> invalid_media
 %type <rule> rule
 %type <rule> valid_rule
 %type <ruleList> block_rule_list 
@@ -249,6 +246,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %type <integer> match
 %type <integer> unary_operator
+%type <integer> maybe_unary_operator
 %type <character> operator
 
 %type <valueList> expr
@@ -268,7 +266,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 %%
 
 stylesheet:
-    maybe_space maybe_charset maybe_sgml import_list variables_list namespace_list rule_list
+    maybe_space maybe_charset maybe_sgml rule_list
   | webkit_rule maybe_space
   | webkit_decls maybe_space
   | webkit_value maybe_space
@@ -278,13 +276,8 @@ stylesheet:
   | webkit_keyframe_rule maybe_space
   ;
 
-valid_rule_or_import:
-    valid_rule
-  | import
-  ;
-
 webkit_rule:
-    WEBKIT_RULE_SYM '{' maybe_space valid_rule_or_import maybe_space '}' {
+    WEBKIT_RULE_SYM '{' maybe_space valid_rule maybe_space '}' {
         static_cast<CSSParser*>(parser)->m_rule = $4;
     }
 ;
@@ -373,31 +366,6 @@ charset:
   }
 ;
 
-import_list:
- /* empty */
- | import_list import maybe_sgml {
-     CSSParser* p = static_cast<CSSParser*>(parser);
-     if ($2 && p->m_styleSheet)
-         p->m_styleSheet->append($2);
- }
- | invalid_at_list {
- }
- ;
-
-variables_list:
-/* empty */
-| variables_list variables_rule maybe_sgml {
-    CSSParser* p = static_cast<CSSParser*>(parser);
-     if ($2 && p->m_styleSheet)
-         p->m_styleSheet->append($2);
-}
-;
-
-namespace_list:
-/* empty */
-| namespace_list namespace maybe_sgml
-;
-
 rule_list:
    /* empty */
  | rule_list rule maybe_sgml {
@@ -413,13 +381,17 @@ valid_rule:
   | page
   | font_face
   | keyframes
+  | namespace
+  | import
+  | variables_rule
   ;
 
 rule:
-    valid_rule
+    valid_rule {
+        static_cast<CSSParser*>(parser)->m_hadSyntacticallyValidCSSRule = true;
+    }
   | invalid_rule
   | invalid_at
-  | invalid_import
   ;
 
 block_rule_list: 
@@ -445,8 +417,10 @@ block_rule:
     block_valid_rule
   | invalid_rule
   | invalid_at
-  | invalid_import
-  | invalid_media
+  | namespace
+  | import
+  | variables_rule
+  | media
   ;
 
 
@@ -570,17 +544,23 @@ variable_name:
 
 namespace:
 NAMESPACE_SYM maybe_space maybe_ns_prefix string_or_uri maybe_space ';' {
-    CSSParser* p = static_cast<CSSParser*>(parser);
-    if (p->m_styleSheet)
-        p->m_styleSheet->addNamespace(p, $3, $4);
+    static_cast<CSSParser*>(parser)->addNamespace($3, $4);
+    $$ = 0;
+}
+| NAMESPACE_SYM maybe_space maybe_ns_prefix string_or_uri maybe_space invalid_block {
+    $$ = 0;
+}
+| NAMESPACE_SYM error invalid_block {
+    $$ = 0;
+}
+| NAMESPACE_SYM error ';' {
+    $$ = 0;
 }
-| NAMESPACE_SYM error invalid_block
-| NAMESPACE_SYM error ';'
 ;
 
 maybe_ns_prefix:
 /* empty */ { $$.characters = 0; }
-| IDENT WHITESPACE { $$ = $1; }
+| IDENT maybe_space { $$ = $1; }
 ;
 
 string_or_uri:
@@ -788,6 +768,11 @@ combinator:
   | '>' maybe_space { $$ = CSSSelector::Child; }
   ;
 
+maybe_unary_operator:
+    unary_operator { $$ = $1; }
+    | { $$ = 1; }
+    ;
+
 unary_operator:
     '-' { $$ = -1; }
   | '+' { $$ = 1; }
@@ -807,6 +792,7 @@ selector_list:
             deleteAllValues(*$$);
             $$->shrink(0);
             $$->append(p->sinkFloatingSelector($1));
+            p->updateLastSelectorLine();
         }
     }
     | selector_list ',' maybe_space selector %prec UNIMPORTANT_TOK {
@@ -814,6 +800,7 @@ selector_list:
             CSSParser* p = static_cast<CSSParser*>(parser);
             $$ = $1;
             $$->append(p->sinkFloatingSelector($4));
+            p->updateLastSelectorLine();
         } else
             $$ = 0;
     }
@@ -1130,11 +1117,11 @@ pseudo:
         }
     }
     // used by :nth-*(ax+b)
-    | ':' FUNCTION NTH ')' {
+    | ':' FUNCTION maybe_space NTH maybe_space ')' {
         CSSParser *p = static_cast<CSSParser*>(parser);
         $$ = p->createFloatingSelector();
         $$->m_match = CSSSelector::PseudoClass;
-        $$->setArgument($3);
+        $$->setArgument($4);
         $$->m_value = $2;
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
@@ -1148,11 +1135,11 @@ pseudo:
         }
     }
     // used by :nth-*
-    | ':' FUNCTION INTEGER ')' {
+    | ':' FUNCTION maybe_space maybe_unary_operator INTEGER maybe_space ')' {
         CSSParser *p = static_cast<CSSParser*>(parser);
         $$ = p->createFloatingSelector();
         $$->m_match = CSSSelector::PseudoClass;
-        $$->setArgument(String::number($3));
+        $$->setArgument(String::number($4 * $5));
         $$->m_value = $2;
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
@@ -1166,11 +1153,11 @@ pseudo:
         }
     }
     // used by :nth-*(odd/even) and :lang
-    | ':' FUNCTION IDENT ')' {
+    | ':' FUNCTION maybe_space IDENT maybe_space ')' {
         CSSParser *p = static_cast<CSSParser*>(parser);
         $$ = p->createFloatingSelector();
         $$->m_match = CSSSelector::PseudoClass;
-        $$->setArgument($3);
+        $$->setArgument($4);
         $2.lower();
         $$->m_value = $2;
         CSSSelector::PseudoType type = $$->pseudoType();
@@ -1186,7 +1173,7 @@ pseudo:
     }
     // used by :not
     | ':' NOTFUNCTION maybe_space simple_selector maybe_space ')' {
-        if (!$4 || $4->simpleSelector() || $4->tagHistory())
+        if (!$4 || $4->simpleSelector() || $4->tagHistory() || $4->matchesPseudoElement())
             $$ = 0;
         else {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -1229,6 +1216,9 @@ decl_list:
     declaration ';' maybe_space {
         $$ = $1;
     }
+    | declaration invalid_block_list maybe_space {
+        $$ = false;
+    }
     | declaration invalid_block_list ';' maybe_space {
         $$ = false;
     }
@@ -1346,6 +1336,12 @@ expr:
             $$->addValue(p->sinkFloatingValue($3));
         }
     }
+    | expr invalid_block_list {
+        $$ = 0;
+    }
+    | expr invalid_block_list error {
+        $$ = 0;
+    }
     | expr error {
         $$ = 0;
     }
@@ -1481,23 +1477,6 @@ invalid_at:
     }
     ;
 
-invalid_at_list:
-    invalid_at maybe_sgml
-  | invalid_at_list invalid_at maybe_sgml
-  ;
-
-invalid_import:
-    import {
-        $$ = 0;
-    }
-    ;
-
-invalid_media:
-    media {
-        $$ = 0;
-    }
-    ;
-
 invalid_rule:
     error invalid_block {
         $$ = 0;
@@ -1517,8 +1496,12 @@ invalid_rule:
     ;
 
 invalid_block:
-    '{' error invalid_block_list error closing_brace
-  | '{' error closing_brace
+    '{' error invalid_block_list error closing_brace {
+        static_cast<CSSParser*>(parser)->invalidBlockHit();
+    }
+  | '{' error closing_brace {
+        static_cast<CSSParser*>(parser)->invalidBlockHit();
+    }
     ;
 
 invalid_block_list:
diff --git a/src/3rdparty/webkit/WebCore/css/CSSImageValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSImageValue.cpp
index 3432a4e94f..96a8dec2a6 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSImageValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSImageValue.cpp
@@ -25,7 +25,6 @@
 #include "Cache.h"
 #include "CachedImage.h"
 #include "DocLoader.h"
-#include "RenderStyle.h"
 #include "StyleCachedImage.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp b/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp
index 6e62f6de0d..1e79a390a0 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp
@@ -25,7 +25,7 @@
 #include "CachedCSSStyleSheet.h"
 #include "DocLoader.h"
 #include "Document.h"
-#include "MediaList.h"
+#include "SecurityOrigin.h"
 #include "Settings.h"
 #include <wtf/StdLibExtras.h>
 
@@ -54,22 +54,44 @@ CSSImportRule::~CSSImportRule()
         m_cachedSheet->removeClient(this);
 }
 
-void CSSImportRule::setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet* sheet)
+void CSSImportRule::setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CachedCSSStyleSheet* sheet)
 {
     if (m_styleSheet)
         m_styleSheet->setParent(0);
-    m_styleSheet = CSSStyleSheet::create(this, url, charset);
+    m_styleSheet = CSSStyleSheet::create(this, href, baseURL, charset);
 
+    bool crossOriginCSS = false;
+    bool validMIMEType = false;
     CSSStyleSheet* parent = parentStyleSheet();
     bool strict = !parent || parent->useStrictParsing();
-    String sheetText = sheet->sheetText(strict);
+    bool enforceMIMEType = strict;
+    bool needsSiteSpecificQuirks = parent && parent->doc() && parent->doc()->settings() && parent->doc()->settings()->needsSiteSpecificQuirks();
+
+#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD)
+    if (enforceMIMEType && needsSiteSpecificQuirks) {
+        // Covers both http and https, with or without "www."
+        if (baseURL.string().contains("mcafee.com/japan/", false))
+            enforceMIMEType = false;
+    }
+#endif
+
+    String sheetText = sheet->sheetText(enforceMIMEType, &validMIMEType);
     m_styleSheet->parseString(sheetText, strict);
 
-    if (strict && parent && parent->doc() && parent->doc()->settings() && parent->doc()->settings()->needsSiteSpecificQuirks()) {
+    if (!parent || !parent->doc() || !parent->doc()->securityOrigin()->canRequest(baseURL))
+        crossOriginCSS = true;
+
+    if (crossOriginCSS && !validMIMEType && !m_styleSheet->hasSyntacticallyValidCSSHeader())
+        m_styleSheet = CSSStyleSheet::create(this, href, baseURL, charset);
+
+    if (strict && needsSiteSpecificQuirks) {
         // Work around <https://bugs.webkit.org/show_bug.cgi?id=28350>.
         DEFINE_STATIC_LOCAL(const String, slashKHTMLFixesDotCss, ("/KHTMLFixes.css"));
         DEFINE_STATIC_LOCAL(const String, mediaWikiKHTMLFixesStyleSheet, ("/* KHTML fix stylesheet */\n/* work around the horizontal scrollbars */\n#column-content { margin-left: 0; }\n\n"));
-        if (url.endsWith(slashKHTMLFixesDotCss) && sheetText == mediaWikiKHTMLFixesStyleSheet) {
+        // There are two variants of KHTMLFixes.css. One is equal to mediaWikiKHTMLFixesStyleSheet,
+        // while the other lacks the second trailing newline.
+        if (baseURL.string().endsWith(slashKHTMLFixesDotCss) && !sheetText.isNull() && mediaWikiKHTMLFixesStyleSheet.startsWith(sheetText)
+                && sheetText.length() >= mediaWikiKHTMLFixesStyleSheet.length() - 1) {
             ASSERT(m_styleSheet->length() == 1);
             ExceptionCode ec;
             m_styleSheet->deleteRule(0, ec);
@@ -98,15 +120,16 @@ void CSSImportRule::insertedIntoParent()
         return;
 
     String absHref = m_strHref;
-    if (!parentSheet->href().isNull())
+    if (!parentSheet->finalURL().isNull())
         // use parent styleheet's URL as the base URL
-        absHref = KURL(KURL(ParsedURLString, parentSheet->href()), m_strHref).string();
+        absHref = KURL(parentSheet->finalURL(), m_strHref).string();
 
     // Check for a cycle in our import chain.  If we encounter a stylesheet
     // in our parent chain with the same URL, then just bail.
     StyleBase* root = this;
     for (StyleBase* curr = parent(); curr; curr = curr->parent()) {
-        if (curr->isCSSStyleSheet() && absHref == static_cast<CSSStyleSheet*>(curr)->href())
+        // FIXME: This is wrong if the finalURL was updated via document::updateBaseURL. 
+        if (curr->isCSSStyleSheet() && absHref == static_cast<CSSStyleSheet*>(curr)->finalURL().string())
             return;
         root = curr;
     }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSImportRule.h b/src/3rdparty/webkit/WebCore/css/CSSImportRule.h
index f5460067ea..10d30268e1 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSImportRule.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSImportRule.h
@@ -63,7 +63,7 @@ private:
     virtual unsigned short type() const { return IMPORT_RULE; }
 
     // from CachedResourceClient
-    virtual void setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet*);
+    virtual void setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CachedCSSStyleSheet*);
 
     String m_strHref;
     RefPtr<MediaList> m_lstMedia;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSImportRule.idl b/src/3rdparty/webkit/WebCore/css/CSSImportRule.idl
index 454553e685..8e60905d02 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSImportRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSImportRule.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=8f60b3a2-ebf0-484d-a714-47a9974a6a9e,
-        ImplementationUUID=437ea93c-68e5-4897-85fe-e161653801eb
-    ] CSSImportRule : CSSRule {
+    interface CSSImportRule : CSSRule {
         readonly attribute [ConvertNullStringTo=Null] DOMString href;
         readonly attribute stylesheets::MediaList media;
         readonly attribute CSSStyleSheet styleSheet;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSInheritedValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSInheritedValue.cpp
index 08d3db30ff..20b73e228c 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSInheritedValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSInheritedValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/CSSInitialValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSInitialValue.cpp
index 9c2bb234bd..cbe776b0dc 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSInitialValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSInitialValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/CSSMediaRule.cpp b/src/3rdparty/webkit/WebCore/css/CSSMediaRule.cpp
index 610e988096..d1c220bedb 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSMediaRule.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSMediaRule.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2002, 2005, 2006 Apple Computer, Inc.
diff --git a/src/3rdparty/webkit/WebCore/css/CSSMediaRule.idl b/src/3rdparty/webkit/WebCore/css/CSSMediaRule.idl
index 1347171329..813bd70672 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSMediaRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSMediaRule.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=9c623c09-2677-4d28-ba90-826da0ae316a,
-        ImplementationUUID=30493ec9-e139-4e9e-ae24-cc8f532006d9
-    ] CSSMediaRule : CSSRule {
+    interface CSSMediaRule : CSSRule {
         readonly attribute stylesheets::MediaList media;
         readonly attribute CSSRuleList cssRules;
         
diff --git a/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp
index 2dd2f5d830..31c75072ae 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -23,7 +23,6 @@
 
 #include "CSSImageValue.h"
 #include "CSSParser.h"
-#include "CSSProperty.h"
 #include "CSSPropertyLonghand.h"
 #include "CSSPropertyNames.h"
 #include "CSSRule.h"
@@ -259,20 +258,28 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
 
 String CSSMutableStyleDeclaration::get4Values(const int* properties) const
 {
-    String res;
-    for (int i = 0; i < 4; ++i) {
-        if (!isPropertyImplicit(properties[i])) {
-            RefPtr<CSSValue> value = getPropertyCSSValue(properties[i]);
+    // Assume the properties are in the usual order top, right, bottom, left.
+    RefPtr<CSSValue> topValue = getPropertyCSSValue(properties[0]);
+    RefPtr<CSSValue> rightValue = getPropertyCSSValue(properties[1]);
+    RefPtr<CSSValue> bottomValue = getPropertyCSSValue(properties[2]);
+    RefPtr<CSSValue> leftValue = getPropertyCSSValue(properties[3]);
 
-            // apparently all 4 properties must be specified.
-            if (!value)
-                return String();
+    // All 4 properties must be specified.
+    if (!topValue || !rightValue || !bottomValue || !leftValue)
+        return String();
+
+    bool showLeft = rightValue->cssText() != leftValue->cssText();
+    bool showBottom = (topValue->cssText() != bottomValue->cssText()) || showLeft;
+    bool showRight = (topValue->cssText() != rightValue->cssText()) || showBottom;
+
+    String res = topValue->cssText();
+    if (showRight)
+        res += " " + rightValue->cssText();
+    if (showBottom)
+        res += " " + bottomValue->cssText();
+    if (showLeft)
+        res += " " + leftValue->cssText();
 
-            if (!res.isNull())
-                res += " ";
-            res += value->cssText();
-        }
-    }
     return res;
 }
 
@@ -306,7 +313,7 @@ String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* propertie
             RefPtr<CSSValue> value;
             if (values[j]) {
                 if (values[j]->isValueList())
-                    value = static_cast<CSSValueList*>(values[j].get())->itemWithoutBoundsCheck(i);
+                    value = static_cast<CSSValueList*>(values[j].get())->item(i);
                 else {
                     value = values[j];
                     
@@ -628,7 +635,7 @@ unsigned CSSMutableStyleDeclaration::length() const
 String CSSMutableStyleDeclaration::item(unsigned i) const
 {
     if (i >= m_properties.size())
-       return String();
+       return "";
     return getPropertyName(static_cast<CSSPropertyID>(m_properties[i].id()));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSNamespace.h b/src/3rdparty/webkit/WebCore/css/CSSNamespace.h
index 9194be855e..0a1119d1f3 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSNamespace.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSNamespace.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the CSS implementation for KDE.
- *
  * Copyright (C) 1999-2003 Lars Knoll (knoll@kde.org)
  *               1999 Waldo Bastian (bastian@kde.org)
  * Copyright (C) 2004, 2006 Apple Computer, Inc.
@@ -28,7 +26,7 @@
 
 namespace WebCore {
 
-    struct CSSNamespace {
+    struct CSSNamespace : Noncopyable {
         AtomicString m_prefix;
         AtomicString m_uri;
         CSSNamespace* m_parent;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPageRule.idl b/src/3rdparty/webkit/WebCore/css/CSSPageRule.idl
index 3ad570eef5..6b50b6ddd4 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPageRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSPageRule.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=4e8d9d26-65ca-483f-a6d4-be1a25905056,
-        ImplementationUUID=d8e40379-8b0e-4dce-b1f8-636dcf055a5f
-    ] CSSPageRule : CSSRule {
+    interface CSSPageRule : CSSRule {
 
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString selectorText
                      setter raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
index 7750a800bb..214fc5149f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
@@ -139,9 +139,15 @@ CSSParser::CSSParser(bool strictParsing)
     , m_currentShorthand(0)
     , m_implicitShorthand(false)
     , m_hasFontFaceOnlyValues(false)
+    , m_hadSyntacticallyValidCSSRule(false)
     , m_defaultNamespace(starAtom)
     , m_data(0)
     , yy_start(1)
+    , m_line(0)
+    , m_lastSelectorLine(0)
+    , m_allowImportRules(true)
+    , m_allowVariablesRules(true)
+    , m_allowNamespaceDeclarations(true)
     , m_floatingMediaQuery(0)
     , m_floatingMediaQueryExp(0)
     , m_floatingMediaQueryExpList(0)
@@ -229,6 +235,7 @@ void CSSParser::parseSheet(CSSStyleSheet* sheet, const String& string)
 PassRefPtr<CSSRule> CSSParser::parseRule(CSSStyleSheet* sheet, const String& string)
 {
     m_styleSheet = sheet;
+    m_allowNamespaceDeclarations = false;
     setupParser("@-webkit-rule{", string, "} ");
     cssyyparse(this);
     return m_rule.release();
@@ -364,7 +371,7 @@ bool CSSParser::parseMediaQuery(MediaList* queries, const String& string)
 
 void CSSParser::addProperty(int propId, PassRefPtr<CSSValue> value, bool important)
 {
-    auto_ptr<CSSProperty> prop(new CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand));
+    OwnPtr<CSSProperty> prop(new CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand));
     if (m_numParsedProperties >= m_maxParsedProperties) {
         m_maxParsedProperties += 32;
         if (m_maxParsedProperties > UINT_MAX / sizeof(CSSProperty*))
@@ -566,7 +573,7 @@ bool CSSParser::parseValue(int propId, bool important)
         return true;
     }
 
-    bool valid_primitive = false;
+    bool validPrimitive = false;
     RefPtr<CSSValue> parsedValue;
 
     switch (static_cast<CSSPropertyID>(propId)) {
@@ -582,13 +589,13 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertySize:                 // <length>{1,2} | auto | portrait | landscape | inherit
     case CSSPropertyQuotes:               // [<string> <string>]+ | none | inherit
         if (id)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyUnicodeBidi:         // normal | embed | bidi-override | inherit
         if (id == CSSValueNormal ||
              id == CSSValueEmbed ||
              id == CSSValueBidiOverride)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyPosition:             // static | relative | absolute | fixed | inherit
@@ -596,7 +603,7 @@ bool CSSParser::parseValue(int propId, bool important)
              id == CSSValueRelative ||
              id == CSSValueAbsolute ||
              id == CSSValueFixed)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyPageBreakAfter:     // auto | always | avoid | left | right | inherit
@@ -608,19 +615,19 @@ bool CSSParser::parseValue(int propId, bool important)
              id == CSSValueAvoid ||
              id == CSSValueLeft ||
              id == CSSValueRight)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyPageBreakInside:    // avoid | auto | inherit
     case CSSPropertyWebkitColumnBreakInside:
         if (id == CSSValueAuto || id == CSSValueAvoid)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyEmptyCells:          // show | hide | inherit
         if (id == CSSValueShow ||
              id == CSSValueHide)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyContent:              // [ <string> | <uri> | <counter> | attr(X) | open-quote |
@@ -633,12 +640,12 @@ bool CSSParser::parseValue(int propId, bool important)
             id == CSSValuePreWrap ||
             id == CSSValuePreLine ||
             id == CSSValueNowrap)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyClip:                 // <shape> | auto | inherit
         if (id == CSSValueAuto)
-            valid_primitive = true;
+            validPrimitive = true;
         else if (value->unit == CSSParserValue::Function)
             return parseShape(propId, important);
         break;
@@ -649,17 +656,17 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyCaptionSide:         // top | bottom | left | right | inherit
         if (id == CSSValueLeft || id == CSSValueRight ||
             id == CSSValueTop || id == CSSValueBottom)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyBorderCollapse:      // collapse | separate | inherit
         if (id == CSSValueCollapse || id == CSSValueSeparate)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyVisibility:           // visible | hidden | collapse | inherit
         if (id == CSSValueVisible || id == CSSValueHidden || id == CSSValueCollapse)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyOverflow: {
@@ -674,21 +681,19 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyOverflowY:           // visible | hidden | scroll | auto | marquee | overlay | inherit
         if (id == CSSValueVisible || id == CSSValueHidden || id == CSSValueScroll || id == CSSValueAuto ||
             id == CSSValueOverlay || id == CSSValueWebkitMarquee)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyListStylePosition:  // inside | outside | inherit
         if (id == CSSValueInside || id == CSSValueOutside)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyListStyleType:
-        // disc | circle | square | decimal | decimal-leading-zero | lower-roman |
-        // upper-roman | lower-greek | lower-alpha | lower-latin | upper-alpha |
-        // upper-latin | hebrew | armenian | georgian | cjk-ideographic | hiragana |
-        // katakana | hiragana-iroha | katakana-iroha | none | inherit
+        // See section CSS_PROP_LIST_STYLE_TYPE of file CSSValueKeywords.in
+        // for the list of supported list-style-types.
         if ((id >= CSSValueDisc && id <= CSSValueKatakanaIroha) || id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyDisplay:
@@ -700,41 +705,41 @@ bool CSSParser::parseValue(int propId, bool important)
 #else
         if ((id >= CSSValueInline && id <= CSSValueWebkitInlineBox) || id == CSSValueNone)
 #endif
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyDirection:            // ltr | rtl | inherit
         if (id == CSSValueLtr || id == CSSValueRtl)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyTextTransform:       // capitalize | uppercase | lowercase | none | inherit
         if ((id >= CSSValueCapitalize && id <= CSSValueLowercase) || id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyFloat:                // left | right | none | inherit + center for buggy CSS
         if (id == CSSValueLeft || id == CSSValueRight ||
              id == CSSValueNone || id == CSSValueCenter)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyClear:                // none | left | right | both | inherit
         if (id == CSSValueNone || id == CSSValueLeft ||
              id == CSSValueRight|| id == CSSValueBoth)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyTextAlign:
         // left | right | center | justify | webkit_left | webkit_right | webkit_center | start | end | <string> | inherit
         if ((id >= CSSValueWebkitAuto && id <= CSSValueWebkitCenter) || id == CSSValueStart || id == CSSValueEnd ||
              value->unit == CSSPrimitiveValue::CSS_STRING)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyOutlineStyle:        // (<border-style> except hidden) | auto | inherit
         if (id == CSSValueAuto || id == CSSValueNone || (id >= CSSValueInset && id <= CSSValueDouble))
-            valid_primitive = true;
+            validPrimitive = true;
         break; 
         
     case CSSPropertyBorderTopStyle:     //// <border-style> | inherit
@@ -743,7 +748,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyBorderLeftStyle:
     case CSSPropertyWebkitColumnRuleStyle:
         if (id >= CSSValueNone && id <= CSSValueDouble)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyFontWeight:  // normal | bold | bolder | lighter | 100 | 200 | 300 | 400 | 500 | 600 | 700 | 800 | 900 | inherit
@@ -770,13 +775,13 @@ bool CSSParser::parseValue(int propId, bool important)
     }
     case CSSPropertyWebkitBorderHorizontalSpacing:
     case CSSPropertyWebkitBorderVerticalSpacing:
-        valid_primitive = validUnit(value, FLength|FNonNeg, m_strict);
+        validPrimitive = validUnit(value, FLength | FNonNeg, m_strict);
         break;
     case CSSPropertyOutlineColor:        // <color> | invert | inherit
         // Outline color has "invert" as additional keyword.
         // Also, we want to allow the special focus color even in strict parsing mode.
         if (propId == CSSPropertyOutlineColor && (id == CSSValueInvert || id == CSSValueWebkitFocusRingColor)) {
-            valid_primitive = true;
+            validPrimitive = true;
             break;
         }
         /* nobreak */
@@ -793,13 +798,13 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitTextFillColor:
     case CSSPropertyWebkitTextStrokeColor:
         if (id == CSSValueWebkitText)
-            valid_primitive = true; // Always allow this, even when strict parsing is on,
+            validPrimitive = true; // Always allow this, even when strict parsing is on,
                                     // since we use this in our UA sheets.
         else if (id == CSSValueCurrentcolor)
-            valid_primitive = true;
+            validPrimitive = true;
         else if ((id >= CSSValueAqua && id <= CSSValueWindowtext) || id == CSSValueMenu ||
              (id >= CSSValueWebkitFocusRingColor && id < CSSValueWebkitText && !m_strict)) {
-            valid_primitive = true;
+            validPrimitive = true;
         } else {
             parsedValue = parseColor();
             if (parsedValue)
@@ -856,9 +861,9 @@ bool CSSParser::parseValue(int propId, bool important)
         id = value->id;
         if (!m_strict && value->id == CSSValueHand) { // MSIE 5 compatibility :/
             id = CSSValuePointer;
-            valid_primitive = true;
+            validPrimitive = true;
         } else if ((value->id >= CSSValueAuto && value->id <= CSSValueWebkitGrabbing) || value->id == CSSValueCopy || value->id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     }
 
@@ -936,27 +941,27 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyBorderLeftWidth:
     case CSSPropertyWebkitColumnRuleWidth:
         if (id == CSSValueThin || id == CSSValueMedium || id == CSSValueThick)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FLength, m_strict);
+            validPrimitive = validUnit(value, FLength | FNonNeg, m_strict);
         break;
 
     case CSSPropertyLetterSpacing:       // normal | <length> | inherit
     case CSSPropertyWordSpacing:         // normal | <length> | inherit
         if (id == CSSValueNormal)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FLength, m_strict);
+            validPrimitive = validUnit(value, FLength, m_strict);
         break;
 
     case CSSPropertyWordBreak:          // normal | break-all | break-word (this is a custom extension)
         if (id == CSSValueNormal || id == CSSValueBreakAll || id == CSSValueBreakWord)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyWordWrap:           // normal | break-word
         if (id == CSSValueNormal || id == CSSValueBreakWord)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyTextIndent:          // <length> | <percentage> | inherit
@@ -965,30 +970,30 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyPaddingBottom:       //   <length> | <percentage>
     case CSSPropertyPaddingLeft:         ////
     case CSSPropertyWebkitPaddingStart:
-        valid_primitive = (!id && validUnit(value, FLength|FPercent, m_strict));
+        validPrimitive = (!id && validUnit(value, FLength | FPercent, m_strict));
         break;
 
     case CSSPropertyMaxHeight:           // <length> | <percentage> | none | inherit
     case CSSPropertyMaxWidth:            // <length> | <percentage> | none | inherit
         if (id == CSSValueNone || id == CSSValueIntrinsic || id == CSSValueMinIntrinsic) {
-            valid_primitive = true;
+            validPrimitive = true;
             break;
         }
         /* nobreak */
     case CSSPropertyMinHeight:           // <length> | <percentage> | inherit
     case CSSPropertyMinWidth:            // <length> | <percentage> | inherit
         if (id == CSSValueIntrinsic || id == CSSValueMinIntrinsic)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = (!id && validUnit(value, FLength|FPercent|FNonNeg, m_strict));
+            validPrimitive = (!id && validUnit(value, FLength | FPercent | FNonNeg, m_strict));
         break;
 
     case CSSPropertyFontSize:
         // <absolute-size> | <relative-size> | <length> | <percentage> | inherit
         if (id >= CSSValueXxSmall && id <= CSSValueLarger)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = (validUnit(value, FLength|FPercent|FNonNeg, m_strict));
+            validPrimitive = (validUnit(value, FLength | FPercent | FNonNeg, m_strict));
         break;
 
     case CSSPropertyFontStyle:           // normal | italic | oblique | inherit
@@ -1002,18 +1007,18 @@ bool CSSParser::parseValue(int propId, bool important)
         // <percentage> | <length> | inherit
 
         if (id >= CSSValueBaseline && id <= CSSValueWebkitBaselineMiddle)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = (!id && validUnit(value, FLength|FPercent, m_strict));
+            validPrimitive = (!id && validUnit(value, FLength | FPercent, m_strict));
         break;
 
     case CSSPropertyHeight:               // <length> | <percentage> | auto | inherit
     case CSSPropertyWidth:                // <length> | <percentage> | auto | inherit
         if (id == CSSValueAuto || id == CSSValueIntrinsic || id == CSSValueMinIntrinsic)
-            valid_primitive = true;
+            validPrimitive = true;
         else
             // ### handle multilength case where we allow relative units
-            valid_primitive = (!id && validUnit(value, FLength|FPercent|FNonNeg, m_strict));
+            validPrimitive = (!id && validUnit(value, FLength | FPercent | FNonNeg, m_strict));
         break;
 
     case CSSPropertyBottom:               // <length> | <percentage> | auto | inherit
@@ -1026,38 +1031,38 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyMarginLeft:          ////
     case CSSPropertyWebkitMarginStart:
         if (id == CSSValueAuto)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = (!id && validUnit(value, FLength|FPercent, m_strict));
+            validPrimitive = (!id && validUnit(value, FLength | FPercent, m_strict));
         break;
 
     case CSSPropertyZIndex:              // auto | <integer> | inherit
         if (id == CSSValueAuto) {
-            valid_primitive = true;
+            validPrimitive = true;
             break;
         }
         /* nobreak */
     case CSSPropertyOrphans:              // <integer> | inherit
     case CSSPropertyWidows:               // <integer> | inherit
         // ### not supported later on
-        valid_primitive = (!id && validUnit(value, FInteger, false));
+        validPrimitive = (!id && validUnit(value, FInteger, false));
         break;
 
     case CSSPropertyLineHeight:          // normal | <number> | <length> | <percentage> | inherit
         if (id == CSSValueNormal)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = (!id && validUnit(value, FNumber|FLength|FPercent|FNonNeg, m_strict));
+            validPrimitive = (!id && validUnit(value, FNumber | FLength | FPercent | FNonNeg, m_strict));
         break;
     case CSSPropertyCounterIncrement:    // [ <identifier> <integer>? ]+ | none | inherit
         if (id != CSSValueNone)
             return parseCounter(propId, 1, important);
-        valid_primitive = true;
+        validPrimitive = true;
         break;
      case CSSPropertyCounterReset:        // [ <identifier> <integer>? ]+ | none | inherit
         if (id != CSSValueNone)
             return parseCounter(propId, 0, important);
-        valid_primitive = true;
+        validPrimitive = true;
         break;
     case CSSPropertyFontFamily:
         // [[ <family-name> | <generic-family> ],]* [<family-name> | <generic-family>] | inherit
@@ -1070,11 +1075,11 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitTextDecorationsInEffect:
         // none | [ underline || overline || line-through || blink ] | inherit
         if (id == CSSValueNone) {
-            valid_primitive = true;
+            validPrimitive = true;
         } else {
             RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
-            bool is_valid = true;
-            while (is_valid && value) {
+            bool isValid = true;
+            while (isValid && value) {
                 switch (value->id) {
                 case CSSValueBlink:
                     break;
@@ -1084,11 +1089,11 @@ bool CSSParser::parseValue(int propId, bool important)
                     list->append(CSSPrimitiveValue::createIdentifier(value->id));
                     break;
                 default:
-                    is_valid = false;
+                    isValid = false;
                 }
                 value = m_valueList->next();
             }
-            if (list->length() && is_valid) {
+            if (list->length() && isValid) {
                 parsedValue = list.release();
                 m_valueList->next();
             }
@@ -1097,14 +1102,14 @@ bool CSSParser::parseValue(int propId, bool important)
 
     case CSSPropertyZoom:          // normal | reset | document | <number> | <percentage> | inherit
         if (id == CSSValueNormal || id == CSSValueReset || id == CSSValueDocument)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = (!id && validUnit(value, FNumber | FPercent | FNonNeg, true));
+            validPrimitive = (!id && validUnit(value, FNumber | FPercent | FNonNeg, true));
         break;
         
     case CSSPropertyTableLayout:         // auto | fixed | inherit
         if (id == CSSValueAuto || id == CSSValueFixed)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertySrc:  // Only used within @font-face, so cannot use inherit | initial or be !important.  This is a list of urls or local references.
@@ -1116,13 +1121,13 @@ bool CSSParser::parseValue(int propId, bool important)
     /* CSS3 properties */
     case CSSPropertyWebkitAppearance:
         if ((id >= CSSValueCheckbox && id <= CSSValueTextarea) || id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyWebkitBinding:
 #if ENABLE(XBL)
         if (id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         else {
             RefPtr<CSSValueList> values = CSSValueList::createCommaSeparated();
             CSSParserValue* val;
@@ -1156,7 +1161,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitBorderImage:
     case CSSPropertyWebkitMaskBoxImage:
         if (id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         else {
             RefPtr<CSSValue> result;
             if (parseBorderImage(propId, important, result)) {
@@ -1171,15 +1176,15 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyBorderBottomRightRadius: {
         if (num != 1 && num != 2)
             return false;
-        valid_primitive = validUnit(value, FLength, m_strict);
-        if (!valid_primitive)
+        validPrimitive = validUnit(value, FLength, m_strict);
+        if (!validPrimitive)
             return false;
         RefPtr<CSSPrimitiveValue> parsedValue1 = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
         RefPtr<CSSPrimitiveValue> parsedValue2;
         if (num == 2) {
             value = m_valueList->next();
-            valid_primitive = validUnit(value, FLength, m_strict);
-            if (!valid_primitive)
+            validPrimitive = validUnit(value, FLength, m_strict);
+            if (!validPrimitive)
                 return false;
             parsedValue2 = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
         } else
@@ -1194,56 +1199,59 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitBorderRadius:
         return parseBorderRadius(propId, important);
     case CSSPropertyOutlineOffset:
-        valid_primitive = validUnit(value, FLength, m_strict);
+        validPrimitive = validUnit(value, FLength, m_strict);
         break;
     case CSSPropertyTextShadow: // CSS2 property, dropped in CSS2.1, back in CSS3, so treat as CSS3
     case CSSPropertyWebkitBoxShadow:
         if (id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         else
             return parseShadow(propId, important);
         break;
     case CSSPropertyWebkitBoxReflect:
         if (id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         else
             return parseReflect(propId, important);
         break;
     case CSSPropertyOpacity:
-        valid_primitive = validUnit(value, FNumber, m_strict);
+        validPrimitive = validUnit(value, FNumber, m_strict);
         break;
     case CSSPropertyWebkitBoxAlign:
         if (id == CSSValueStretch || id == CSSValueStart || id == CSSValueEnd ||
             id == CSSValueCenter || id == CSSValueBaseline)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitBoxDirection:
         if (id == CSSValueNormal || id == CSSValueReverse)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitBoxLines:
         if (id == CSSValueSingle || id == CSSValueMultiple)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitBoxOrient:
         if (id == CSSValueHorizontal || id == CSSValueVertical ||
             id == CSSValueInlineAxis || id == CSSValueBlockAxis)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitBoxPack:
         if (id == CSSValueStart || id == CSSValueEnd ||
             id == CSSValueCenter || id == CSSValueJustify)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitBoxFlex:
-        valid_primitive = validUnit(value, FNumber, m_strict);
+        validPrimitive = validUnit(value, FNumber, m_strict);
         break;
     case CSSPropertyWebkitBoxFlexGroup:
     case CSSPropertyWebkitBoxOrdinalGroup:
-        valid_primitive = validUnit(value, FInteger|FNonNeg, true);
+        validPrimitive = validUnit(value, FInteger | FNonNeg, true);
         break;
     case CSSPropertyWebkitBoxSizing:
-        valid_primitive = id == CSSValueBorderBox || id == CSSValueContentBox;
+        validPrimitive = id == CSSValueBorderBox || id == CSSValueContentBox;
+        break;
+    case CSSPropertyWebkitColorCorrection:
+        validPrimitive = id == CSSValueSrgb || id == CSSValueDefault;
         break;
     case CSSPropertyWebkitMarquee: {
         const int properties[5] = { CSSPropertyWebkitMarqueeDirection, CSSPropertyWebkitMarqueeIncrement,
@@ -1255,71 +1263,71 @@ bool CSSParser::parseValue(int propId, bool important)
         if (id == CSSValueForwards || id == CSSValueBackwards || id == CSSValueAhead ||
             id == CSSValueReverse || id == CSSValueLeft || id == CSSValueRight || id == CSSValueDown ||
             id == CSSValueUp || id == CSSValueAuto)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitMarqueeIncrement:
         if (id == CSSValueSmall || id == CSSValueLarge || id == CSSValueMedium)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FLength|FPercent, m_strict);
+            validPrimitive = validUnit(value, FLength | FPercent, m_strict);
         break;
     case CSSPropertyWebkitMarqueeStyle:
         if (id == CSSValueNone || id == CSSValueSlide || id == CSSValueScroll || id == CSSValueAlternate)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitMarqueeRepetition:
         if (id == CSSValueInfinite)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FInteger|FNonNeg, m_strict);
+            validPrimitive = validUnit(value, FInteger | FNonNeg, m_strict);
         break;
     case CSSPropertyWebkitMarqueeSpeed:
         if (id == CSSValueNormal || id == CSSValueSlow || id == CSSValueFast)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FTime|FInteger|FNonNeg, m_strict);
+            validPrimitive = validUnit(value, FTime | FInteger | FNonNeg, m_strict);
         break;
 #if ENABLE(WCSS)
     case CSSPropertyWapMarqueeDir:
         if (id == CSSValueLtr || id == CSSValueRtl)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWapMarqueeStyle:
         if (id == CSSValueNone || id == CSSValueSlide || id == CSSValueScroll || id == CSSValueAlternate)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWapMarqueeLoop:
         if (id == CSSValueInfinite)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FInteger | FNonNeg, m_strict);
+            validPrimitive = validUnit(value, FInteger | FNonNeg, m_strict);
         break;
     case CSSPropertyWapMarqueeSpeed:
         if (id == CSSValueNormal || id == CSSValueSlow || id == CSSValueFast)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FTime | FInteger | FNonNeg, m_strict);
+            validPrimitive = validUnit(value, FTime | FInteger | FNonNeg, m_strict);
         break;
 #endif
     case CSSPropertyWebkitUserDrag: // auto | none | element
         if (id == CSSValueAuto || id == CSSValueNone || id == CSSValueElement)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitUserModify: // read-only | read-write
         if (id == CSSValueReadOnly || id == CSSValueReadWrite || id == CSSValueReadWritePlaintextOnly)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitUserSelect: // auto | none | text
         if (id == CSSValueAuto || id == CSSValueNone || id == CSSValueText)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyTextOverflow: // clip | ellipsis
         if (id == CSSValueClip || id == CSSValueEllipsis)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitTransform:
         if (id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         else {
             PassRefPtr<CSSValue> val = parseTransform();
             if (val) {
@@ -1349,18 +1357,18 @@ bool CSSParser::parseValue(int propId, bool important)
     }
     case CSSPropertyWebkitTransformStyle:
         if (value->id == CSSValueFlat || value->id == CSSValuePreserve3d)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitBackfaceVisibility:
         if (value->id == CSSValueVisible || value->id == CSSValueHidden)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitPerspective:
         if (id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         else {
             // Accepting valueless numbers is a quirk of the -webkit prefixed version of the property.
-            if (validUnit(value, FNumber|FLength|FNonNeg, m_strict)) {
+            if (validUnit(value, FNumber | FLength | FNonNeg, m_strict)) {
                 RefPtr<CSSValue> val = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
                 if (val) {
                     addProperty(propId, val.release(), important);
@@ -1387,6 +1395,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitAnimationDelay:
     case CSSPropertyWebkitAnimationDirection:
     case CSSPropertyWebkitAnimationDuration:
+    case CSSPropertyWebkitAnimationFillMode:
     case CSSPropertyWebkitAnimationName:
     case CSSPropertyWebkitAnimationPlayState:
     case CSSPropertyWebkitAnimationIterationCount:
@@ -1424,13 +1433,13 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitMarginTopCollapse:
     case CSSPropertyWebkitMarginBottomCollapse:
         if (id == CSSValueCollapse || id == CSSValueSeparate || id == CSSValueDiscard)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyTextLineThroughMode:
     case CSSPropertyTextOverlineMode:
     case CSSPropertyTextUnderlineMode:
         if (id == CSSValueContinuous || id == CSSValueSkipWhiteSpace)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyTextLineThroughStyle:
     case CSSPropertyTextOverlineStyle:
@@ -1438,50 +1447,50 @@ bool CSSParser::parseValue(int propId, bool important)
         if (id == CSSValueNone || id == CSSValueSolid || id == CSSValueDouble ||
             id == CSSValueDashed || id == CSSValueDotDash || id == CSSValueDotDotDash ||
             id == CSSValueWave)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyTextRendering: // auto | optimizeSpeed | optimizeLegibility | geometricPrecision
         if (id == CSSValueAuto || id == CSSValueOptimizespeed || id == CSSValueOptimizelegibility
             || id == CSSValueGeometricprecision)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyTextLineThroughWidth:
     case CSSPropertyTextOverlineWidth:
     case CSSPropertyTextUnderlineWidth:
         if (id == CSSValueAuto || id == CSSValueNormal || id == CSSValueThin ||
             id == CSSValueMedium || id == CSSValueThick)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = !id && validUnit(value, FNumber|FLength|FPercent, m_strict);
+            validPrimitive = !id && validUnit(value, FNumber | FLength | FPercent, m_strict);
         break;
     case CSSPropertyResize: // none | both | horizontal | vertical | auto
         if (id == CSSValueNone || id == CSSValueBoth || id == CSSValueHorizontal || id == CSSValueVertical || id == CSSValueAuto)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitColumnCount:
         if (id == CSSValueAuto)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = !id && validUnit(value, FInteger | FNonNeg, false);
+            validPrimitive = !id && validUnit(value, FInteger | FNonNeg, false);
         break;
     case CSSPropertyWebkitColumnGap:         // normal | <length>
         if (id == CSSValueNormal)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FLength | FNonNeg, m_strict);
+            validPrimitive = validUnit(value, FLength | FNonNeg, m_strict);
         break;
     case CSSPropertyWebkitColumnWidth:         // auto | <length>
         if (id == CSSValueAuto)
-            valid_primitive = true;
+            validPrimitive = true;
         else // Always parse this property in strict mode, since it would be ambiguous otherwise when used in the 'columns' shorthand property.
-            valid_primitive = validUnit(value, FLength, true);
+            validPrimitive = validUnit(value, FLength, true);
         break;
     case CSSPropertyPointerEvents:
         // none | visiblePainted | visibleFill | visibleStroke | visible |
         // painted | fill | stroke | auto | all | inherit
         if (id == CSSValueVisible || id == CSSValueNone || id == CSSValueAll || id == CSSValueAuto ||
             (id >= CSSValueVisiblepainted && id <= CSSValueStroke))
-            valid_primitive = true;
+            validPrimitive = true;
         break;
             
     // End of CSS3 properties
@@ -1489,56 +1498,58 @@ bool CSSParser::parseValue(int propId, bool important)
     // Apple specific properties.  These will never be standardized and are purely to
     // support custom WebKit-based Apple applications.
     case CSSPropertyWebkitLineClamp:
-        valid_primitive = (!id && validUnit(value, FPercent, false));
+        // When specifying number of lines, don't allow 0 as a valid value
+        // When specifying either type of unit, require non-negative integers
+        validPrimitive = (!id && (value->unit == CSSPrimitiveValue::CSS_PERCENTAGE || value->fValue) && validUnit(value, FInteger | FPercent | FNonNeg, false));
         break;
     case CSSPropertyWebkitTextSizeAdjust:
         if (id == CSSValueAuto || id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitRtlOrdering:
         if (id == CSSValueLogical || id == CSSValueVisual)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     
     case CSSPropertyWebkitFontSizeDelta:           // <length>
-        valid_primitive = validUnit(value, FLength, m_strict);
+        validPrimitive = validUnit(value, FLength, m_strict);
         break;
 
     case CSSPropertyWebkitNbspMode:     // normal | space
         if (id == CSSValueNormal || id == CSSValueSpace)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyWebkitLineBreak:   // normal | after-white-space
         if (id == CSSValueNormal || id == CSSValueAfterWhiteSpace)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyWebkitMatchNearestMailBlockquoteColor:   // normal | match
         if (id == CSSValueNormal || id == CSSValueMatch)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyWebkitHighlight:
         if (id == CSSValueNone || value->unit == CSSPrimitiveValue::CSS_STRING)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     
     case CSSPropertyWebkitBorderFit:
         if (id == CSSValueBorder || id == CSSValueLines)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
         
     case CSSPropertyWebkitTextSecurity:
         // disc | circle | square | none | inherit
         if (id == CSSValueDisc || id == CSSValueCircle || id == CSSValueSquare|| id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyWebkitFontSmoothing:
         if (id == CSSValueAuto || id == CSSValueNone 
             || id == CSSValueAntialiased || id == CSSValueSubpixelAntialiased)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -1646,7 +1657,7 @@ bool CSSParser::parseValue(int propId, bool important)
         // [ [ 'font-style' || 'font-variant' || 'font-weight' ]? 'font-size' [ / 'line-height' ]?
         // 'font-family' ] | caption | icon | menu | message-box | small-caption | status-bar | inherit
         if (id >= CSSValueCaption && id <= CSSValueStatusBar)
-            valid_primitive = true;
+            validPrimitive = true;
         else
             return parseFont(important);
         break;
@@ -1688,7 +1699,7 @@ bool CSSParser::parseValue(int propId, bool important)
 #endif
     }
 
-    if (valid_primitive) {
+    if (validPrimitive) {
         if (id != 0)
             parsedValue = CSSPrimitiveValue::createIdentifier(id);
         else if (value->unit == CSSPrimitiveValue::CSS_STRING)
@@ -1882,7 +1893,8 @@ bool CSSParser::parseAnimationShorthand(bool important)
                                 CSSPropertyWebkitAnimationTimingFunction,
                                 CSSPropertyWebkitAnimationDelay,
                                 CSSPropertyWebkitAnimationIterationCount,
-                                CSSPropertyWebkitAnimationDirection };
+                                CSSPropertyWebkitAnimationDirection,
+                                CSSPropertyWebkitAnimationFillMode };
     const int numProperties = sizeof(properties) / sizeof(properties[0]);
     
     ShorthandScope scope(this, CSSPropertyWebkitAnimation);
@@ -2235,7 +2247,7 @@ PassRefPtr<CSSValue> CSSParser::parseFillPositionXY(bool& xFound, bool& yFound)
             percent = 50;
         return CSSPrimitiveValue::create(percent, CSSPrimitiveValue::CSS_PERCENTAGE);
     }
-    if (validUnit(m_valueList->current(), FPercent|FLength, m_strict))
+    if (validUnit(m_valueList->current(), FPercent | FLength, m_strict))
         return CSSPrimitiveValue::create(m_valueList->current()->fValue,
                                          (CSSPrimitiveValue::UnitTypes)m_valueList->current()->unit);
                 
@@ -2343,7 +2355,7 @@ PassRefPtr<CSSValue> CSSParser::parseFillSize(int propId, bool& allowComma)
     if (value->id == CSSValueAuto)
         parsedValue1 = CSSPrimitiveValue::create(0, CSSPrimitiveValue::CSS_UNKNOWN);
     else {
-        if (!validUnit(value, FLength|FPercent, m_strict))
+        if (!validUnit(value, FLength | FPercent, m_strict))
             return 0;
         parsedValue1 = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
     }
@@ -2356,7 +2368,7 @@ PassRefPtr<CSSValue> CSSParser::parseFillSize(int propId, bool& allowComma)
         else if (value->unit == CSSParserValue::Operator && value->iValue == ',')
             allowComma = false;
         else {
-            if (!validUnit(value, FLength|FPercent, m_strict))
+            if (!validUnit(value, FLength | FPercent, m_strict))
                 return 0;
             parsedValue2 = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
         }
@@ -2558,17 +2570,25 @@ PassRefPtr<CSSValue> CSSParser::parseAnimationDirection()
 PassRefPtr<CSSValue> CSSParser::parseAnimationDuration()
 {
     CSSParserValue* value = m_valueList->current();
-    if (validUnit(value, FTime|FNonNeg, m_strict))
+    if (validUnit(value, FTime | FNonNeg, m_strict))
         return CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
     return 0;
 }
 
+PassRefPtr<CSSValue> CSSParser::parseAnimationFillMode()
+{
+    CSSParserValue* value = m_valueList->current();
+    if (value->id == CSSValueNone || value->id == CSSValueForwards || value->id == CSSValueBackwards || value->id == CSSValueBoth)
+        return CSSPrimitiveValue::createIdentifier(value->id);
+    return 0;
+}
+
 PassRefPtr<CSSValue> CSSParser::parseAnimationIterationCount()
 {
     CSSParserValue* value = m_valueList->current();
     if (value->id == CSSValueInfinite)
         return CSSPrimitiveValue::createIdentifier(value->id);
-    if (validUnit(value, FInteger|FNonNeg, m_strict))
+    if (validUnit(value, FInteger | FNonNeg, m_strict))
         return CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
     return 0;
 }
@@ -2705,6 +2725,11 @@ bool CSSParser::parseAnimationProperty(int propId, RefPtr<CSSValue>& result)
                     if (currValue)
                         m_valueList->next();
                     break;
+                case CSSPropertyWebkitAnimationFillMode:
+                    currValue = parseAnimationFillMode();
+                    if (currValue)
+                        m_valueList->next();
+                    break;
                 case CSSPropertyWebkitAnimationIterationCount:
                     currValue = parseAnimationIterationCount();
                     if (currValue)
@@ -3039,7 +3064,7 @@ bool CSSParser::parseFont(bool important)
             } else {
                 valid = false;
             }
-        } else if (!font->weight && validUnit(value, FInteger|FNonNeg, true)) {
+        } else if (!font->weight && validUnit(value, FInteger | FNonNeg, true)) {
             int weight = (int)value->fValue;
             int val = 0;
             if (weight == 100)
@@ -3087,7 +3112,7 @@ bool CSSParser::parseFont(bool important)
     // <absolute-size> | <relative-size> | <length> | <percentage> | inherit
     if (value->id >= CSSValueXxSmall && value->id <= CSSValueLarger)
         font->size = CSSPrimitiveValue::createIdentifier(value->id);
-    else if (validUnit(value, FLength|FPercent|FNonNeg, m_strict))
+    else if (validUnit(value, FLength | FPercent | FNonNeg, m_strict))
         font->size = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes) value->unit);
     value = m_valueList->next();
     if (!font->size || !value)
@@ -3100,7 +3125,7 @@ bool CSSParser::parseFont(bool important)
             return false;
         if (value->id == CSSValueNormal) {
             // default value, nothing to do
-        } else if (validUnit(value, FNumber|FLength|FPercent|FNonNeg, m_strict))
+        } else if (validUnit(value, FNumber | FLength | FPercent | FNonNeg, m_strict))
             font->lineHeight = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes) value->unit);
         else
             return false;
@@ -3483,19 +3508,66 @@ bool CSSParser::parseFontFaceUnicodeRange()
     return true;
 }
 
+static inline bool isCSSWhitespace(UChar c)
+{
+    return c == ' ' || c == '\t' || c == '\r' || c == '\n' || c == '\f';
+}
+
+static inline bool parseInt(const UChar*& string, const UChar* end, UChar terminator, int& value)
+{
+    const UChar* current = string;
+    int localValue = 0;
+    bool negative = false;
+    while (current != end && isCSSWhitespace(*current)) 
+        current++;
+    if (current != end && *current == '-') {
+        negative = true;
+        current++;
+    }
+    if (current == end || !isASCIIDigit(*current))
+        return false;
+    while (current != end && isASCIIDigit(*current))
+        localValue = localValue * 10 + *current++ - '0';
+    while (current != end && isCSSWhitespace(*current))
+        current++;
+    if (current == end || *current++ != terminator)
+        return false;
+    // Clamp negative values at zero.
+    value = negative ? 0 : localValue;
+    string = current;
+    return true;
+}
+
 bool CSSParser::parseColor(const String &name, RGBA32& rgb, bool strict)
 {
     if (!strict && Color::parseHexColor(name, rgb))
         return true;
 
-    // try a little harder
+    // Try rgb() syntax.
+    if (name.startsWith("rgb(")) {
+        const UChar* current = name.characters() + 4;
+        const UChar* end = name.characters() + name.length();
+        int red;
+        int green;
+        int blue;
+        if (!parseInt(current, end, ',', red))
+            return false;
+        if (!parseInt(current, end, ',', green))
+            return false;
+        if (!parseInt(current, end, ')', blue))
+            return false;
+        if (current != end)
+            return false;
+        rgb = makeRGB(red, green, blue);
+        return true;
+    }        
+    // Try named colors.
     Color tc;
     tc.setNamedColor(name);
     if (tc.isValid()) {
         rgb = tc.rgb();
         return true;
     }
-
     return false;
 }
 
@@ -3528,7 +3600,9 @@ bool CSSParser::parseColorParameters(CSSParserValue* value, int* colorArray, boo
         v = args->next();
         if (!validUnit(v, FNumber, true))
             return false;
-        colorArray[3] = static_cast<int>(max(0.0, min(1.0, v->fValue)) * 255);
+        // Convert the floating pointer number of alpha to an integer in the range [0, 256),
+        // with an equal distribution across all 256 values.
+        colorArray[3] = static_cast<int>(max(0.0, min(1.0, v->fValue)) * nextafter(256.0, 0.0));
     }
     return true;
 }
@@ -3760,8 +3834,8 @@ bool CSSParser::parseShadow(int propId, bool important)
                 // value.  Treat as invalid.
                 return false;
 #if ENABLE(SVG)
-            // -webkit-shadow does not support multiple values.
-            if (static_cast<CSSPropertyID>(propId) == CSSPropertyWebkitShadow)
+            // -webkit-svg-shadow does not support multiple values.
+            if (static_cast<CSSPropertyID>(propId) == CSSPropertyWebkitSvgShadow)
                 return false;
 #endif            
             // The value is good.  Commit it.
@@ -4021,7 +4095,7 @@ bool CSSParser::parseBorderImage(int propId, bool important, RefPtr<CSSValue>& r
         return false;
 
     while ((val = m_valueList->next())) {
-        if (context.allowNumber() && validUnit(val, FInteger|FNonNeg|FPercent, true)) {
+        if (context.allowNumber() && validUnit(val, FInteger | FNonNeg | FPercent, true)) {
             context.commitNumber(val);
         } else if (propId == CSSPropertyWebkitBorderImage && context.allowSlash() && val->unit == CSSParserValue::Operator && val->iValue == '/') {
             context.commitSlash();
@@ -4619,11 +4693,13 @@ static inline int yyerror(const char*) { return 1; }
 int CSSParser::lex(void* yylvalWithoutType)
 {
     YYSTYPE* yylval = static_cast<YYSTYPE*>(yylvalWithoutType);
-    int token = lex();
     int length;
+
+    lex();
+
     UChar* t = text(&length);
 
-    switch (token) {
+    switch (token()) {
     case WHITESPACE:
     case SGML_CD:
     case INCLUDES:
@@ -4689,12 +4765,29 @@ int CSSParser::lex(void* yylvalWithoutType)
         break;
     }
 
-    return token;
+    return token();
 }
 
-static inline bool isCSSWhitespace(UChar c)
+void CSSParser::recheckAtKeyword(const UChar* str, int len)
 {
-    return c == ' ' || c == '\t' || c == '\r' || c == '\n' || c == '\f';
+    String ruleName(str, len);
+    if (equalIgnoringCase(ruleName, "@import"))
+        yyTok = IMPORT_SYM;
+    else if (equalIgnoringCase(ruleName, "@page"))
+        yyTok = PAGE_SYM;
+    else if (equalIgnoringCase(ruleName, "@media"))
+        yyTok = MEDIA_SYM;
+    else if (equalIgnoringCase(ruleName, "@font-face"))
+        yyTok = FONT_FACE_SYM;
+    else if (equalIgnoringCase(ruleName, "@charset"))
+        yyTok = CHARSET_SYM;
+    else if (equalIgnoringCase(ruleName, "@namespace"))
+        yyTok = NAMESPACE_SYM;
+    else if (equalIgnoringCase(ruleName, "@-webkit-keyframes"))
+        yyTok = WEBKIT_KEYFRAMES_SYM;
+    else if (equalIgnoringCase(ruleName, "@-webkit-mediaquery"))
+        yyTok = WEBKIT_MEDIAQUERY_SYM;
+    // FIXME: Add CSS Variables if we ever decide to turn it back on.
 }
 
 UChar* CSSParser::text(int *length)
@@ -4750,6 +4843,8 @@ UChar* CSSParser::text(int *length)
     UChar* out = start;
     UChar* escape = 0;
 
+    bool sawEscape = false;
+
     for (int i = 0; i < l; i++) {
         UChar* current = start + i;
         if (escape == current - 1) {
@@ -4794,6 +4889,7 @@ UChar* CSSParser::text(int *length)
         }
         if (!escape && *current == '\\') {
             escape = current;
+            sawEscape = true;
             continue;
         }
         *out++ = *current;
@@ -4814,9 +4910,23 @@ UChar* CSSParser::text(int *length)
     }
     
     *length = out - start;
+    
+    // If we have an unrecognized @-keyword, and if we handled any escapes at all, then
+    // we should attempt to adjust yyTok to the correct type.
+    if (yyTok == ATKEYWORD && sawEscape)
+        recheckAtKeyword(start, *length);
+
     return start;
 }
 
+void CSSParser::countLines()
+{
+    for (UChar* current = yytext; current < yytext + yyleng; ++current) {
+        if (*current == '\n')
+            ++m_line;
+    }
+}
+
 CSSSelector* CSSParser::createFloatingSelector()
 {
     CSSSelector* selector = fastNew<CSSSelector>();
@@ -4944,7 +5054,7 @@ CSSRule* CSSParser::createCharsetRule(const CSSParserString& charset)
 
 CSSRule* CSSParser::createImportRule(const CSSParserString& url, MediaList* media)
 {
-    if (!media || !m_styleSheet)
+    if (!media || !m_styleSheet || !m_allowImportRules)
         return 0;
     RefPtr<CSSImportRule> rule = CSSImportRule::create(m_styleSheet, url, media);
     CSSImportRule* result = rule.get();
@@ -4956,6 +5066,7 @@ CSSRule* CSSParser::createMediaRule(MediaList* media, CSSRuleList* rules)
 {
     if (!media || !rules || !m_styleSheet)
         return 0;
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     RefPtr<CSSMediaRule> rule = CSSMediaRule::create(m_styleSheet, media, rules);
     CSSMediaRule* result = rule.get();
     m_parsedStyleObjects.append(rule.release());
@@ -4973,6 +5084,7 @@ CSSRuleList* CSSParser::createRuleList()
 
 WebKitCSSKeyframesRule* CSSParser::createKeyframesRule()
 {
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     RefPtr<WebKitCSSKeyframesRule> rule = WebKitCSSKeyframesRule::create(m_styleSheet);
     WebKitCSSKeyframesRule* rulePtr = rule.get();
     m_parsedStyleObjects.append(rule.release());
@@ -4981,9 +5093,10 @@ WebKitCSSKeyframesRule* CSSParser::createKeyframesRule()
 
 CSSRule* CSSParser::createStyleRule(Vector<CSSSelector*>* selectors)
 {
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     CSSStyleRule* result = 0;
     if (selectors) {
-        RefPtr<CSSStyleRule> rule = CSSStyleRule::create(m_styleSheet);
+        RefPtr<CSSStyleRule> rule = CSSStyleRule::create(m_styleSheet, m_lastSelectorLine);
         rule->adoptSelectorVector(*selectors);
         if (m_hasFontFaceOnlyValues)
             deleteFontFaceOnlyValues();
@@ -4997,6 +5110,7 @@ CSSRule* CSSParser::createStyleRule(Vector<CSSSelector*>* selectors)
 
 CSSRule* CSSParser::createFontFaceRule()
 {
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     RefPtr<CSSFontFaceRule> rule = CSSFontFaceRule::create(m_styleSheet);
     for (unsigned i = 0; i < m_numParsedProperties; ++i) {
         CSSProperty* property = m_parsedProperties[i];
@@ -5014,6 +5128,15 @@ CSSRule* CSSParser::createFontFaceRule()
     return result;
 }
 
+void CSSParser::addNamespace(const AtomicString& prefix, const AtomicString& uri)
+{
+    if (!m_styleSheet || !m_allowNamespaceDeclarations)
+        return;
+    m_allowImportRules = false;
+    m_allowVariablesRules = false;
+    m_styleSheet->addNamespace(this, prefix, uri);
+}
+
 #if !ENABLE(CSS_VARIABLES)
 
 CSSRule* CSSParser::createVariablesRule(MediaList*, bool)
@@ -5035,6 +5158,9 @@ bool CSSParser::addVariableDeclarationBlock(const CSSParserString&)
 
 CSSRule* CSSParser::createVariablesRule(MediaList* mediaList, bool variablesKeyword)
 {
+    if (!m_allowVariablesRules)
+        return 0;
+    m_allowImportRules = false;
     RefPtr<CSSVariablesRule> rule = CSSVariablesRule::create(m_styleSheet, mediaList, variablesKeyword);
     rule->setDeclaration(CSSVariablesDeclaration::create(rule.get(), m_variableNames, m_variableValues));
     clearVariables();    
@@ -5175,6 +5301,12 @@ WebKitCSSKeyframeRule* CSSParser::createKeyframeRule(CSSParserValueList* keys)
     return keyframePtr;
 }
 
+void CSSParser::invalidBlockHit()
+{
+    if (m_styleSheet && !m_hadSyntacticallyValidCSSRule)
+        m_styleSheet->setHasSyntacticallyValidCSSHeader(false);
+}
+
 static int cssPropertyID(const UChar* propertyName, unsigned length)
 {
     if (!length)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.h b/src/3rdparty/webkit/WebCore/css/CSSParser.h
index 6d1bb32cc8..9c6aa3731e 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.h
@@ -95,6 +95,7 @@ namespace WebCore {
         PassRefPtr<CSSValue> parseAnimationDelay();
         PassRefPtr<CSSValue> parseAnimationDirection();
         PassRefPtr<CSSValue> parseAnimationDuration();
+        PassRefPtr<CSSValue> parseAnimationFillMode();
         PassRefPtr<CSSValue> parseAnimationIterationCount();
         PassRefPtr<CSSValue> parseAnimationName();
         PassRefPtr<CSSValue> parseAnimationPlayState();
@@ -187,13 +188,18 @@ namespace WebCore {
         MediaQuery* createFloatingMediaQuery(Vector<MediaQueryExp*>*);
         MediaQuery* sinkFloatingMediaQuery(MediaQuery*);
 
+        void addNamespace(const AtomicString& prefix, const AtomicString& uri);
+
         bool addVariable(const CSSParserString&, CSSParserValueList*);
         bool addVariableDeclarationBlock(const CSSParserString&);
         bool checkForVariables(CSSParserValueList*);
         void addUnresolvedProperty(int propId, bool important);
-        
+        void invalidBlockHit();
+
         Vector<CSSSelector*>* reusableSelectorVector() { return &m_reusableSelectorVector; }
-        
+
+        void updateLastSelectorLine() { m_lastSelectorLine = m_line; }
+
         bool m_strict;
         bool m_important;
         int m_id;
@@ -212,6 +218,7 @@ namespace WebCore {
         bool m_implicitShorthand;
 
         bool m_hasFontFaceOnlyValues;
+        bool m_hadSyntacticallyValidCSSRule;
 
         Vector<String> m_variableNames;
         Vector<RefPtr<CSSValue> > m_variableValues;
@@ -222,9 +229,12 @@ namespace WebCore {
         int lex(void* yylval);
         int token() { return yyTok; }
         UChar* text(int* length);
+        void countLines();
         int lex();
         
     private:
+        void recheckAtKeyword(const UChar* str, int len);
+    
         void clearProperties();
 
         void setupParser(const char* prefix, const String&, const char* suffix);
@@ -246,6 +256,12 @@ namespace WebCore {
         int yyleng;
         int yyTok;
         int yy_start;
+        int m_line;
+        int m_lastSelectorLine;
+
+        bool m_allowImportRules;
+        bool m_allowVariablesRules;
+        bool m_allowNamespaceDeclarations;
 
         Vector<RefPtr<StyleBase> > m_parsedStyleObjects;
         Vector<RefPtr<CSSRuleList> > m_parsedRuleLists;
@@ -287,7 +303,7 @@ namespace WebCore {
     int cssPropertyID(const String&);
     int cssValueKeywordID(const CSSParserString&);
 
-    class ShorthandScope {
+    class ShorthandScope : public FastAllocBase {
     public:
         ShorthandScope(CSSParser* parser, int propId) : m_parser(parser)
         {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
index d2286bb4c7..e6caa2b41f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
@@ -34,8 +34,6 @@
 #include "Rect.h"
 #include "RenderStyle.h"
 #include <wtf/ASCIICType.h>
-#include <wtf/MathExtras.h>
-#include <wtf/StringExtras.h>
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -70,7 +68,7 @@ PassRefPtr<CSSPrimitiveValue> CSSPrimitiveValue::createColor(unsigned rgbValue)
     static ColorValueCache* colorValueCache = new ColorValueCache;
     // These are the empty and deleted values of the hash table.
     if (rgbValue == Color::transparent) {
-        static CSSPrimitiveValue* colorTransparent = new CSSPrimitiveValue(Color::transparent);
+        static CSSPrimitiveValue* colorTransparent = new CSSPrimitiveValue(CSSValueTransparent);
         return colorTransparent;
     }
     if (rgbValue == Color::white) {
@@ -118,11 +116,30 @@ PassRefPtr<CSSPrimitiveValue> CSSPrimitiveValue::create(const String& value, Uni
     return adoptRef(new CSSPrimitiveValue(value, type));
 }
 
-static const char* valueOrPropertyName(int valueOrPropertyID)
+static const AtomicString& valueOrPropertyName(int valueOrPropertyID)
 {
-    if (const char* valueName = getValueName(valueOrPropertyID))
-        return valueName;
-    return getPropertyName(static_cast<CSSPropertyID>(valueOrPropertyID));
+    ASSERT_ARG(valueOrPropertyID, valueOrPropertyID >= 0);
+    ASSERT_ARG(valueOrPropertyID, valueOrPropertyID < numCSSValueKeywords || (valueOrPropertyID >= firstCSSProperty && valueOrPropertyID < firstCSSProperty + numCSSProperties));
+
+    if (valueOrPropertyID < 0)
+        return nullAtom;
+
+    if (valueOrPropertyID < numCSSValueKeywords) {
+        static AtomicString* cssValueKeywordStrings[numCSSValueKeywords];
+        if (!cssValueKeywordStrings[valueOrPropertyID])
+            cssValueKeywordStrings[valueOrPropertyID] = new AtomicString(getValueName(valueOrPropertyID));
+        return *cssValueKeywordStrings[valueOrPropertyID];
+    }
+
+    if (valueOrPropertyID >= firstCSSProperty && valueOrPropertyID < firstCSSProperty + numCSSProperties) {
+        static AtomicString* cssPropertyStrings[numCSSProperties];
+        int propertyIndex = valueOrPropertyID - firstCSSProperty;
+        if (!cssPropertyStrings[propertyIndex])
+            cssPropertyStrings[propertyIndex] = new AtomicString(getPropertyName(static_cast<CSSPropertyID>(valueOrPropertyID)));
+        return *cssPropertyStrings[propertyIndex];
+    }
+
+    return nullAtom;
 }
 
 // "ident" from the CSS tokenizer, minus backslash-escape sequences
@@ -686,71 +703,6 @@ int CSSPrimitiveValue::getIdent()
     return m_value.ident;
 }
 
-static void appendCSSDouble(Vector<UChar>& vector, double value)
-{
-    // From the CSS specification section titled "Integers and real numbers",
-    // real numbers are only formatted as [sign] [digits] "." [digits].
-    // This differs from printf-style formatting in that exponents (e.g. 1.3e06)
-    // are not allowed.  Since NaN/inf are also not valid CSS values this
-    // function doesn't handle them.
-
-    // For compatibility with what was returned by older versions of
-    // WebKit, we target 6 digits of precision.
-    const int digitsAfterDecimalPoint = 6;
-    long long rounded = llround(fabs(value) * 1000000.0);
-    if (rounded == 0) {
-        vector.append('0');
-        return;
-    }
-
-    char buf[24];
-    int length = snprintf(buf, sizeof(buf), "%lld", rounded);
-    int decimalPoint = length - digitsAfterDecimalPoint;
-
-    // We are matching printf("%g")'s behavior and must trim trailing zeros,
-    // regardless of whether they're significant.
-    while (length > 0 && length > decimalPoint && buf[length - 1] == '0')
-        length--;
-
-    // Reserve an estimate of space for the number of digits we anticipate
-    // along with a minus sign/initial zero/decimal point.
-    vector.reserveCapacity(vector.size() + 3 + length);
-
-    if (value < 0)
-        vector.append('-');
-
-    if (decimalPoint <= 0) {
-        // Only digits after the decimal point.
-        vector.append('0');
-        vector.append('.');
-        for (int i = decimalPoint; i < 0; i++)
-            vector.append('0');
-        for (int i = 0; i < length; i++)
-            vector.append(buf[i]);
-    } else if (length <= decimalPoint) {
-        // Only digits before the decimal point.
-        for (int i = 0; i < length; i++)
-            vector.append(buf[i]);
-    } else {
-        // Digits before and after the decimal point.
-        for (int i = 0; i < decimalPoint; i++)
-            vector.append(buf[i]);
-        vector.append('.');
-        for (int i = decimalPoint; i < length; i++)
-            vector.append(buf[i]);
-    }
-}
-
-static String formatWithUnits(double value, const char* units)
-{
-    Vector<UChar> result;
-    appendCSSDouble(result, value);
-    result.reserveCapacity(result.size() + strlen(units));
-    for (int i = 0; units[i]; i++)
-        result.append(units[i]);
-    return String::adopt(result);
-}
-
 String CSSPrimitiveValue::cssText() const
 {
     // FIXME: return the original value instead of a generated one (e.g. color
@@ -762,61 +714,61 @@ String CSSPrimitiveValue::cssText() const
             break;
         case CSS_NUMBER:
         case CSS_PARSER_INTEGER:
-            text = formatWithUnits(m_value.num, "");
+            text = String::number(m_value.num);
             break;
         case CSS_PERCENTAGE:
-            text = formatWithUnits(m_value.num, "%");
+            text = String::format("%.6lg%%", m_value.num);
             break;
         case CSS_EMS:
-            text = formatWithUnits(m_value.num, "em");
+            text = String::format("%.6lgem", m_value.num);
             break;
         case CSS_EXS:
-            text = formatWithUnits(m_value.num, "ex");
+            text = String::format("%.6lgex", m_value.num);
             break;
         case CSS_REMS:
-            text = formatWithUnits(m_value.num, "rem");
+            text = String::format("%.6lgrem", m_value.num);
             break;
         case CSS_PX:
-            text = formatWithUnits(m_value.num, "px");
+            text = String::format("%.6lgpx", m_value.num);
             break;
         case CSS_CM:
-            text = formatWithUnits(m_value.num, "cm");
+            text = String::format("%.6lgcm", m_value.num);
             break;
         case CSS_MM:
-            text = formatWithUnits(m_value.num, "mm");
+            text = String::format("%.6lgmm", m_value.num);
             break;
         case CSS_IN:
-            text = formatWithUnits(m_value.num, "in");
+            text = String::format("%.6lgin", m_value.num);
             break;
         case CSS_PT:
-            text = formatWithUnits(m_value.num, "pt");
+            text = String::format("%.6lgpt", m_value.num);
             break;
         case CSS_PC:
-            text = formatWithUnits(m_value.num, "pc");
+            text = String::format("%.6lgpc", m_value.num);
             break;
         case CSS_DEG:
-            text = formatWithUnits(m_value.num, "deg");
+            text = String::format("%.6lgdeg", m_value.num);
             break;
         case CSS_RAD:
-            text = formatWithUnits(m_value.num, "rad");
+            text = String::format("%.6lgrad", m_value.num);
             break;
         case CSS_GRAD:
-            text = formatWithUnits(m_value.num, "grad");
+            text = String::format("%.6lggrad", m_value.num);
             break;
         case CSS_MS:
-            text = formatWithUnits(m_value.num, "ms");
+            text = String::format("%.6lgms", m_value.num);
             break;
         case CSS_S:
-            text = formatWithUnits(m_value.num, "s");
+            text = String::format("%.6lgs", m_value.num);
             break;
         case CSS_HZ:
-            text = formatWithUnits(m_value.num, "hz");
+            text = String::format("%.6lghz", m_value.num);
             break;
         case CSS_KHZ:
-            text = formatWithUnits(m_value.num, "khz");
+            text = String::format("%.6lgkhz", m_value.num);
             break;
         case CSS_TURN:
-            text = formatWithUnits(m_value.num, "turn");
+            text = String::format("%.6lgturn", m_value.num);
             break;
         case CSS_DIMENSION:
             // FIXME
@@ -997,7 +949,7 @@ CSSParserValue CSSPrimitiveValue::parserValue() const
             break;
         case CSS_IDENT: {
             value.id = m_value.ident;
-            String name = valueOrPropertyName(m_value.ident);
+            const AtomicString& name = valueOrPropertyName(m_value.ident);
             value.string.characters = const_cast<UChar*>(name.characters());
             value.string.length = name.length();
             break;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl
index befe5accf4..85806641b0 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl
@@ -19,11 +19,7 @@
 
 module css {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=a286b0cb-4ff0-4482-aa6e-7c5fb39afaba,
-        ImplementationUUID=c310c84d-480f-4bbb-9187-28e00956ac47
-    ] CSSPrimitiveValue : CSSValue {
+    interface CSSPrimitiveValue : CSSValue {
 
         // UnitTypes
         const unsigned short CSS_UNKNOWN    = 0;
@@ -69,11 +65,8 @@ module css {
             raises(DOMException);
         Rect getRectValue()
             raises(DOMException);
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         RGBColor getRGBColorValue()
             raises(DOMException);
-#endif
-
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
index 6f89df9df6..223b51531c 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2007 Alexey Proskuryakov <ap@nypop.com>.
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -28,6 +28,7 @@
 #ifndef CSSPrimitiveValueMappings_h
 #define CSSPrimitiveValueMappings_h
 
+#include "ColorSpace.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSValueKeywords.h"
 #include "FontSmoothingMode.h"
@@ -197,6 +198,9 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case DefaultButtonPart:
             m_value.ident = CSSValueDefaultButton;
             break;
+        case InnerSpinButtonPart:
+            m_value.ident = CSSValueInnerSpinButton;
+            break;
         case ListboxPart:
             m_value.ident = CSSValueListbox;
             break;
@@ -229,6 +233,9 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case MediaReturnToRealtimeButtonPart:
             m_value.ident = CSSValueMediaReturnToRealtimeButton;
             break;
+        case MediaToggleClosedCaptionsButtonPart:
+            m_value.ident = CSSValueMediaToggleClosedCaptionsButton;
+            break;
         case MediaSliderPart:
             m_value.ident = CSSValueMediaSlider;
             break;
@@ -265,6 +272,14 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case MenulistTextFieldPart:
             m_value.ident = CSSValueMenulistTextfield;
             break;
+        case OuterSpinButtonPart:
+            m_value.ident = CSSValueOuterSpinButton;
+            break;
+        case ProgressBarPart:
+#if ENABLE(PROGRESS_BAR)
+            m_value.ident = CSSValueProgressBar;
+#endif
+            break;
         case SliderHorizontalPart:
             m_value.ident = CSSValueSliderHorizontal;
             break;
@@ -926,69 +941,237 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EListStyleType e)
     : m_type(CSS_IDENT)
 {
     switch (e) {
-        case LNONE:
-            m_value.ident = CSSValueNone;
-            break;
-        case DISC:
-            m_value.ident = CSSValueDisc;
-            break;
-        case CIRCLE:
-            m_value.ident = CSSValueCircle;
-            break;
-        case SQUARE:
-            m_value.ident = CSSValueSquare;
-            break;
-        case LDECIMAL:
-            m_value.ident = CSSValueDecimal;
-            break;
-        case DECIMAL_LEADING_ZERO:
-            m_value.ident = CSSValueDecimalLeadingZero;
-            break;
-        case LOWER_ROMAN:
-            m_value.ident = CSSValueLowerRoman;
-            break;
-        case UPPER_ROMAN:
-            m_value.ident = CSSValueUpperRoman;
-            break;
-        case LOWER_GREEK:
-            m_value.ident = CSSValueLowerGreek;
-            break;
-        case LOWER_ALPHA:
-            m_value.ident = CSSValueLowerAlpha;
-            break;
-        case LOWER_LATIN:
-            m_value.ident = CSSValueLowerLatin;
-            break;
-        case UPPER_ALPHA:
-            m_value.ident = CSSValueUpperAlpha;
-            break;
-        case UPPER_LATIN:
-            m_value.ident = CSSValueUpperLatin;
-            break;
-        case HEBREW:
-            m_value.ident = CSSValueHebrew;
-            break;
-        case ARMENIAN:
-            m_value.ident = CSSValueArmenian;
-            break;
-        case GEORGIAN:
-            m_value.ident = CSSValueGeorgian;
-            break;
-        case CJK_IDEOGRAPHIC:
-            m_value.ident = CSSValueCjkIdeographic;
-            break;
-        case HIRAGANA:
-            m_value.ident = CSSValueHiragana;
-            break;
-        case KATAKANA:
-            m_value.ident = CSSValueKatakana;
-            break;
-        case HIRAGANA_IROHA:
-            m_value.ident = CSSValueHiraganaIroha;
-            break;
-        case KATAKANA_IROHA:
-            m_value.ident = CSSValueKatakanaIroha;
-            break;
+    case Afar:
+        m_value.ident = CSSValueAfar;
+        break;
+    case Amharic:
+        m_value.ident = CSSValueAmharic;
+        break;
+    case AmharicAbegede:
+        m_value.ident = CSSValueAmharicAbegede;
+        break;
+    case ArabicIndic:
+        m_value.ident = CSSValueArabicIndic;
+        break;
+    case Armenian:
+        m_value.ident = CSSValueArmenian;
+        break;
+    case BinaryListStyle:
+        m_value.ident = CSSValueBinary;
+        break;
+    case Bengali:
+        m_value.ident = CSSValueBengali;
+        break;
+    case Cambodian:
+        m_value.ident = CSSValueCambodian;
+        break;
+    case Circle:
+        m_value.ident = CSSValueCircle;
+        break;
+    case CjkEarthlyBranch:
+        m_value.ident = CSSValueCjkEarthlyBranch;
+        break;
+    case CjkHeavenlyStem:
+        m_value.ident = CSSValueCjkHeavenlyStem;
+        break;
+    case CJKIdeographic:
+        m_value.ident = CSSValueCjkIdeographic;
+        break;
+    case DecimalLeadingZero:
+        m_value.ident = CSSValueDecimalLeadingZero;
+        break;
+    case DecimalListStyle:
+        m_value.ident = CSSValueDecimal;
+        break;
+    case Devanagari:
+        m_value.ident = CSSValueDevanagari;
+        break;
+    case Disc:
+        m_value.ident = CSSValueDisc;
+        break;
+    case Ethiopic:
+        m_value.ident = CSSValueEthiopic;
+        break;
+    case EthiopicAbegede:
+        m_value.ident = CSSValueEthiopicAbegede;
+        break;
+    case EthiopicAbegedeAmEt:
+        m_value.ident = CSSValueEthiopicAbegedeAmEt;
+        break;
+    case EthiopicAbegedeGez:
+        m_value.ident = CSSValueEthiopicAbegedeGez;
+        break;
+    case EthiopicAbegedeTiEr:
+        m_value.ident = CSSValueEthiopicAbegedeTiEr;
+        break;
+    case EthiopicAbegedeTiEt:
+        m_value.ident = CSSValueEthiopicAbegedeTiEt;
+        break;
+    case EthiopicHalehameAaEr:
+        m_value.ident = CSSValueEthiopicHalehameAaEr;
+        break;
+    case EthiopicHalehameAaEt:
+        m_value.ident = CSSValueEthiopicHalehameAaEt;
+        break;
+    case EthiopicHalehameAmEt:
+        m_value.ident = CSSValueEthiopicHalehameAmEt;
+        break;
+    case EthiopicHalehameGez:
+        m_value.ident = CSSValueEthiopicHalehameGez;
+        break;
+    case EthiopicHalehameOmEt:
+        m_value.ident = CSSValueEthiopicHalehameOmEt;
+        break;
+    case EthiopicHalehameSidEt:
+        m_value.ident = CSSValueEthiopicHalehameSidEt;
+        break;
+    case EthiopicHalehameSoEt:
+        m_value.ident = CSSValueEthiopicHalehameSoEt;
+        break;
+    case EthiopicHalehameTiEr:
+        m_value.ident = CSSValueEthiopicHalehameTiEr;
+        break;
+    case EthiopicHalehameTiEt:
+        m_value.ident = CSSValueEthiopicHalehameTiEt;
+        break;
+    case EthiopicHalehameTig:
+        m_value.ident = CSSValueEthiopicHalehameTig;
+        break;
+    case Georgian:
+        m_value.ident = CSSValueGeorgian;
+        break;
+    case Gujarati:
+        m_value.ident = CSSValueGujarati;
+        break;
+    case Gurmukhi:
+        m_value.ident = CSSValueGurmukhi;
+        break;
+    case Hangul:
+        m_value.ident = CSSValueHangul;
+        break;
+    case HangulConsonant:
+        m_value.ident = CSSValueHangulConsonant;
+        break;
+    case Hebrew:
+        m_value.ident = CSSValueHebrew;
+        break;
+    case Hiragana:
+        m_value.ident = CSSValueHiragana;
+        break;
+    case HiraganaIroha:
+        m_value.ident = CSSValueHiraganaIroha;
+        break;
+    case Kannada:
+        m_value.ident = CSSValueKannada;
+        break;
+    case Katakana:
+        m_value.ident = CSSValueKatakana;
+        break;
+    case KatakanaIroha:
+        m_value.ident = CSSValueKatakanaIroha;
+        break;
+    case Khmer:
+        m_value.ident = CSSValueKhmer;
+        break;
+    case Lao:
+        m_value.ident = CSSValueLao;
+        break;
+    case LowerAlpha:
+        m_value.ident = CSSValueLowerAlpha;
+        break;
+    case LowerGreek:
+        m_value.ident = CSSValueLowerGreek;
+        break;
+    case LowerHexadecimal:
+        m_value.ident = CSSValueLowerHexadecimal;
+        break;
+    case LowerLatin:
+        m_value.ident = CSSValueLowerLatin;
+        break;
+    case LowerNorwegian:
+        m_value.ident = CSSValueLowerNorwegian;
+        break;
+    case LowerRoman:
+        m_value.ident = CSSValueLowerRoman;
+        break;
+    case Malayalam:
+        m_value.ident = CSSValueMalayalam;
+        break;
+    case Mongolian:
+        m_value.ident = CSSValueMongolian;
+        break;
+    case Myanmar:
+        m_value.ident = CSSValueMyanmar;
+        break;
+    case NoneListStyle:
+        m_value.ident = CSSValueNone;
+        break;
+    case Octal:
+        m_value.ident = CSSValueOctal;
+        break;
+    case Oriya:
+        m_value.ident = CSSValueOriya;
+        break;
+    case Oromo:
+        m_value.ident = CSSValueOromo;
+        break;
+    case Persian:
+        m_value.ident = CSSValuePersian;
+        break;
+    case Sidama:
+        m_value.ident = CSSValueSidama;
+        break;
+    case Somali:
+        m_value.ident = CSSValueSomali;
+        break;
+    case Square:
+        m_value.ident = CSSValueSquare;
+        break;
+    case Telugu:
+        m_value.ident = CSSValueTelugu;
+        break;
+    case Thai:
+        m_value.ident = CSSValueThai;
+        break;
+    case Tibetan:
+        m_value.ident = CSSValueTibetan;
+        break;
+    case Tigre:
+        m_value.ident = CSSValueTigre;
+        break;
+    case TigrinyaEr:
+        m_value.ident = CSSValueTigrinyaEr;
+        break;
+    case TigrinyaErAbegede:
+        m_value.ident = CSSValueTigrinyaErAbegede;
+        break;
+    case TigrinyaEt:
+        m_value.ident = CSSValueTigrinyaEt;
+        break;
+    case TigrinyaEtAbegede:
+        m_value.ident = CSSValueTigrinyaEtAbegede;
+        break;
+    case UpperAlpha:
+        m_value.ident = CSSValueUpperAlpha;
+        break;
+    case UpperGreek:
+        m_value.ident = CSSValueUpperGreek;
+        break;
+    case UpperHexadecimal:
+        m_value.ident = CSSValueUpperHexadecimal;
+        break;
+    case UpperLatin:
+        m_value.ident = CSSValueUpperLatin;
+        break;
+    case UpperNorwegian:
+        m_value.ident = CSSValueUpperNorwegian;
+        break;
+    case UpperRoman:
+        m_value.ident = CSSValueUpperRoman;
+        break;
+    case Urdu:
+        m_value.ident = CSSValueUrdu;
+        break;
     }
 }
 
@@ -996,7 +1179,7 @@ template<> inline CSSPrimitiveValue::operator EListStyleType() const
 {
     switch (m_value.ident) {
         case CSSValueNone:
-            return LNONE;
+            return NoneListStyle;
         default:
             return static_cast<EListStyleType>(m_value.ident - CSSValueDisc);
     }
@@ -1881,6 +2064,32 @@ template<> inline CSSPrimitiveValue::operator TextRenderingMode() const
     }
 }
 
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ColorSpace space)
+    : m_type(CSS_IDENT)
+{
+    switch (space) {
+        case DeviceColorSpace:
+            m_value.ident = CSSValueDefault;
+            break;
+        case sRGBColorSpace:
+            m_value.ident = CSSValueSrgb;
+            break;
+    }
+}
+
+template<> inline CSSPrimitiveValue::operator ColorSpace() const
+{
+    switch (m_value.ident) {
+        case CSSValueDefault:
+            return DeviceColorSpace;
+        case CSSValueSrgb:
+            return sRGBColorSpace;
+        default:
+            ASSERT_NOT_REACHED();
+            return DeviceColorSpace;
+    }
+}
+
 #if ENABLE(SVG)
 
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineCap e)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSProperty.cpp b/src/3rdparty/webkit/WebCore/css/CSSProperty.cpp
index 9b21a3f262..d7f21754bf 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSProperty.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSProperty.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/CSSProperty.h b/src/3rdparty/webkit/WebCore/css/CSSProperty.h
index b5635d05ea..4505f33284 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSProperty.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSProperty.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
index 48a18e7479..5f7b188f6b 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
+++ b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
@@ -151,6 +151,7 @@ zoom
 -webkit-animation-delay
 -webkit-animation-direction
 -webkit-animation-duration
+-webkit-animation-fill-mode
 -webkit-animation-iteration-count
 -webkit-animation-name
 -webkit-animation-play-state
@@ -185,6 +186,7 @@ zoom
 -webkit-box-reflect
 -webkit-box-shadow
 -webkit-box-sizing
+-webkit-color-correction
 -webkit-column-break-after
 -webkit-column-break-before
 -webkit-column-break-inside
diff --git a/src/3rdparty/webkit/WebCore/css/CSSRule.cpp b/src/3rdparty/webkit/WebCore/css/CSSRule.cpp
index 8fe4caf744..43d8eacda0 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSRule.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSRule.cpp
@@ -22,7 +22,6 @@
 #include "config.h"
 #include "CSSRule.h"
 
-#include "CSSStyleSheet.h"
 #include "NotImplemented.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSRule.idl b/src/3rdparty/webkit/WebCore/css/CSSRule.idl
index bc57e551d2..eaf1335f7d 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSRule.idl
@@ -23,10 +23,7 @@ module css {
     // Introduced in DOM Level 2:
     interface [
         CustomToJS,
-        GenerateConstructor,
-        Polymorphic,
-        InterfaceUUID=548139b4-31ab-4978-b1d5-cfcfdfbaea0e,
-        ImplementationUUID=0268e673-2489-4743-9a3a-197dae4b4d9c
+        Polymorphic
     ] CSSRule {
 
         // RuleType
diff --git a/src/3rdparty/webkit/WebCore/css/CSSRuleList.cpp b/src/3rdparty/webkit/WebCore/css/CSSRuleList.cpp
index 4528d404ed..7367ab2833 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSRuleList.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSRuleList.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2002, 2005, 2006 Apple Computer, Inc.
diff --git a/src/3rdparty/webkit/WebCore/css/CSSRuleList.h b/src/3rdparty/webkit/WebCore/css/CSSRuleList.h
index 26186b3b05..a355c4a443 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSRuleList.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSRuleList.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2002, 2006 Apple Computer, Inc.
diff --git a/src/3rdparty/webkit/WebCore/css/CSSRuleList.idl b/src/3rdparty/webkit/WebCore/css/CSSRuleList.idl
index 9add078721..e253287fa9 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSRuleList.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSRuleList.idl
@@ -28,10 +28,7 @@ module css {
     // Introduced in DOM Level 2:
     interface [
         CustomMarkFunction,
-        GenerateConstructor,
-        HasIndexGetter,
-        InterfaceUUID=64c346a0-1e34-49d3-9472-57ec8e0fdccb,
-        ImplementationUUID=971a28e0-d0da-4570-9b71-e39fc2cf9a1b
+        HasIndexGetter
     ] CSSRuleList {
         readonly attribute unsigned long    length;
         CSSRule           item(in unsigned long index);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
index 313528f821..453642a6cf 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
@@ -99,6 +99,7 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, focus, ("focus"));
     DEFINE_STATIC_LOCAL(AtomicString, hover, ("hover"));
     DEFINE_STATIC_LOCAL(AtomicString, indeterminate, ("indeterminate"));
+    DEFINE_STATIC_LOCAL(AtomicString, innerSpinButton, ("-webkit-inner-spin-button"));
 #if ENABLE(DATALIST)
     DEFINE_STATIC_LOCAL(AtomicString, inputListButton, ("-webkit-input-list-button"));
 #endif
@@ -116,6 +117,7 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekForwardButton, ("-webkit-media-controls-seek-forward-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsRewindButton, ("-webkit-media-controls-rewind-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsReturnToRealtimeButton, ("-webkit-media-controls-return-to-realtime-button"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsToggleClosedCaptionsButton, ("-webkit-media-controls-toggle-closed-captions-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsStatusDisplay, ("-webkit-media-controls-status-display"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsFullscreenButton, ("-webkit-media-controls-fullscreen-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimelineContainer, ("-webkit-media-controls-timeline-container"));
@@ -126,6 +128,10 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, onlyChild, ("only-child"));
     DEFINE_STATIC_LOCAL(AtomicString, onlyOfType, ("only-of-type"));
     DEFINE_STATIC_LOCAL(AtomicString, optional, ("optional"));
+    DEFINE_STATIC_LOCAL(AtomicString, outerSpinButton, ("-webkit-outer-spin-button"));
+#if ENABLE(PROGRESS_BAR)
+    DEFINE_STATIC_LOCAL(AtomicString, progressBar, ("-webkit-progress-bar"));
+#endif
     DEFINE_STATIC_LOCAL(AtomicString, required, ("required"));
     DEFINE_STATIC_LOCAL(AtomicString, resizer, ("-webkit-resizer"));
     DEFINE_STATIC_LOCAL(AtomicString, root, ("root"));
@@ -234,7 +240,10 @@ void CSSSelector::extractPseudoType() const
         m_pseudoType = PseudoHover;
     else if (m_value == indeterminate)
         m_pseudoType = PseudoIndeterminate;
-    else if (m_value == link)
+    else if (m_value == innerSpinButton) {
+        m_pseudoType = PseudoInnerSpinButton;
+        element = true;
+    } else if (m_value == link)
         m_pseudoType = PseudoLink;
     else if (m_value == lang)
         m_pseudoType = PseudoLang;
@@ -271,6 +280,9 @@ void CSSSelector::extractPseudoType() const
     } else if (m_value == mediaControlsReturnToRealtimeButton) {
         m_pseudoType = PseudoMediaControlsReturnToRealtimeButton;
         element = true;
+    } else if (m_value == mediaControlsToggleClosedCaptionsButton) {
+        m_pseudoType = PseudoMediaControlsToggleClosedCaptions;
+        element = true;
     } else if (m_value == mediaControlsStatusDisplay) {
         m_pseudoType = PseudoMediaControlsStatusDisplay;
         element = true;
@@ -293,7 +305,10 @@ void CSSSelector::extractPseudoType() const
         m_pseudoType = PseudoNthLastChild;
     else if (m_value == nthLastOfType)
         m_pseudoType = PseudoNthLastOfType;
-    else if (m_value == root)
+    else if (m_value == outerSpinButton) {
+        m_pseudoType = PseudoOuterSpinButton;
+        element = true;
+    } else if (m_value == root)
         m_pseudoType = PseudoRoot;
     else if (m_value == windowInactive)
         m_pseudoType = PseudoWindowInactive;
@@ -553,8 +568,8 @@ bool CSSSelector::matchNth(int count)
 
 // a helper function for parsing nth-arguments
 bool CSSSelector::RareData::parseNth()
-{    
-    const String& argument = m_argument;
+{
+    String argument = m_argument.lower();
     
     if (argument.isEmpty())
         return false;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelector.h b/src/3rdparty/webkit/WebCore/css/CSSSelector.h
index 0c3b677d6f..e54b5d578f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelector.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelector.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the CSS implementation for KDE.
- *
  * Copyright (C) 1999-2003 Lars Knoll (knoll@kde.org)
  *               1999 Waldo Bastian (bastian@kde.org)
  * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
@@ -176,6 +174,7 @@ namespace WebCore {
             PseudoMediaControlsVolumeSliderContainer,
             PseudoMediaControlsCurrentTimeDisplay,
             PseudoMediaControlsTimeRemainingDisplay,
+            PseudoMediaControlsToggleClosedCaptions,
             PseudoMediaControlsTimeline,
             PseudoMediaControlsVolumeSlider,
             PseudoMediaControlsSeekBackButton,
@@ -184,7 +183,9 @@ namespace WebCore {
             PseudoMediaControlsReturnToRealtimeButton,
             PseudoMediaControlsStatusDisplay,
             PseudoMediaControlsFullscreenButton,
-            PseudoInputListButton
+            PseudoInputListButton,
+            PseudoInnerSpinButton,
+            PseudoOuterSpinButton,
         };
 
         PseudoType pseudoType() const
@@ -211,6 +212,13 @@ namespace WebCore {
         bool parseNth();
         bool matchNth(int count);
 
+        bool matchesPseudoElement() const 
+        { 
+            if (m_pseudoType == PseudoUnknown)
+                extractPseudoType();
+            return m_match == PseudoElement;
+        }
+
         Relation relation() const { return static_cast<Relation>(m_relation); }
 
         bool isLastInSelectorList() const { return m_isLastInSelectorList; }
@@ -230,7 +238,7 @@ namespace WebCore {
 
         void extractPseudoType() const;
 
-        struct RareData {
+        struct RareData : Noncopyable {
             RareData(CSSSelector* tagHistory)
                 : m_tagHistory(tagHistory)
                 , m_simpleSelector(0)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl
index 3e37418160..297b732158 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl
@@ -23,12 +23,9 @@ module css {
     // Introduced in DOM Level 2:
     interface [
         CustomMarkFunction,
-        GenerateConstructor,
         DelegatingPutFunction,
         HasNameGetter,
-        HasIndexGetter,
-        InterfaceUUID=9989b2c3-a2b6-449b-abf9-c60d2260b1d7,
-        ImplementationUUID=985c50c7-9f19-436a-9e45-c0aa02996d0e
+        HasIndexGetter
     ] CSSStyleDeclaration {
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString        cssText
                      setter raises(DOMException);
@@ -44,7 +41,7 @@ module css {
             raises(DOMException);
 
         readonly attribute unsigned long    length;
-        [ConvertNullStringTo=Null] DOMString          item(in unsigned long index);
+        DOMString          item(in unsigned long index);
         readonly attribute CSSRule          parentRule;
 
         // Extensions
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleRule.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleRule.cpp
index aaac2542b8..1036e8fb8e 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleRule.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleRule.cpp
@@ -27,8 +27,9 @@
 
 namespace WebCore {
 
-CSSStyleRule::CSSStyleRule(CSSStyleSheet* parent)
+CSSStyleRule::CSSStyleRule(CSSStyleSheet* parent, int sourceLine)
     : CSSRule(parent)
+    , m_sourceLine(sourceLine)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleRule.h b/src/3rdparty/webkit/WebCore/css/CSSStyleRule.h
index 23d8648274..835f2a207c 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleRule.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleRule.h
@@ -34,9 +34,9 @@ class CSSSelector;
 
 class CSSStyleRule : public CSSRule {
 public:
-    static PassRefPtr<CSSStyleRule> create(CSSStyleSheet* parent)
+    static PassRefPtr<CSSStyleRule> create(CSSStyleSheet* parent, int sourceLine)
     {
-        return adoptRef(new CSSStyleRule(parent));
+        return adoptRef(new CSSStyleRule(parent, sourceLine));
     }
     virtual ~CSSStyleRule();
 
@@ -58,8 +58,10 @@ public:
 
     virtual void addSubresourceStyleURLs(ListHashSet<KURL>& urls);
 
+    int sourceLine() { return m_sourceLine; }
+
 private:
-    CSSStyleRule(CSSStyleSheet* parent);
+    CSSStyleRule(CSSStyleSheet* parent, int sourceLine);
 
     virtual bool isStyleRule() { return true; }
 
@@ -68,6 +70,7 @@ private:
 
     RefPtr<CSSMutableStyleDeclaration> m_style;
     CSSSelectorList m_selectorList;
+    int m_sourceLine;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleRule.idl b/src/3rdparty/webkit/WebCore/css/CSSStyleRule.idl
index 0240dd0c93..862acd8fce 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleRule.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=ce4e3330-c40b-4430-8ed4-030ab4ddbc93,
-        ImplementationUUID=c3d2f1b8-3970-4b36-882e-ce7f5668d8e2
-    ] CSSStyleRule : CSSRule {
+    interface CSSStyleRule : CSSRule {
 
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString selectorText
                      setter raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
index 40627cfa76..fe64cc9fdd 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
@@ -28,14 +28,11 @@
 
 #include "CSSBorderImageValue.h"
 #include "CSSCursorImageValue.h"
-#include "CSSFontFace.h"
 #include "CSSFontFaceRule.h"
-#include "CSSFontFaceSource.h"
 #include "CSSImportRule.h"
 #include "CSSMediaRule.h"
 #include "CSSParser.h"
 #include "CSSPrimitiveValueMappings.h"
-#include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSReflectValue.h"
 #include "CSSRuleList.h"
@@ -61,6 +58,7 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "HTMLTextAreaElement.h"
+#include "KeyframeList.h"
 #include "LinkHash.h"
 #include "MappedAttribute.h"
 #include "MatrixTransformOperation.h"
@@ -350,7 +348,7 @@ if (id == propID) { \
     return; \
 }
 
-class CSSRuleSet {
+class CSSRuleSet : public Noncopyable {
 public:
     CSSRuleSet();
     ~CSSRuleSet();
@@ -416,7 +414,7 @@ CSSStyleSelector::CSSStyleSelector(Document* doc, StyleSheetList* styleSheets, C
     , m_fontSelector(CSSFontSelector::create(doc))
 {
     init();
-
+        
     m_matchAuthorAndUserStyles = matchAuthorAndUserStyles;
     
     Element* root = doc->documentElement();
@@ -443,7 +441,7 @@ CSSStyleSelector::CSSStyleSelector(Document* doc, StyleSheetList* styleSheets, C
         m_medium = new MediaQueryEvaluator("all");
 
     if (root)
-        m_rootDefaultStyle = styleForElement(root, 0, false, true); // dont ref, because the RenderStyle is allocated from global heap
+        m_rootDefaultStyle = styleForElement(root, 0, false, true); // don't ref, because the RenderStyle is allocated from global heap
 
     if (m_rootDefaultStyle && view) {
         delete m_medium;
@@ -465,7 +463,7 @@ CSSStyleSelector::CSSStyleSelector(Document* doc, StyleSheetList* styleSheets, C
     // add stylesheets from document
     m_authorStyle = new CSSRuleSet();
     
-    // Add rules from elments like SVG's <font-face>
+    // Add rules from elements like SVG's <font-face>
     if (mappedElementSheet)
         m_authorStyle->addRulesFromSheet(mappedElementSheet, *m_medium, this);
 
@@ -475,6 +473,9 @@ CSSStyleSelector::CSSStyleSelector(Document* doc, StyleSheetList* styleSheets, C
         if (sheet->isCSSStyleSheet() && !sheet->disabled())
             m_authorStyle->addRulesFromSheet(static_cast<CSSStyleSheet*>(sheet), *m_medium, this);
     }
+    
+    if (doc->renderer() && doc->renderer()->style())
+        doc->renderer()->style()->font().update(fontSelector());
 }
 
 // This is a simplified style setting function for keyframe styles
@@ -662,7 +663,7 @@ void CSSStyleSelector::matchRules(CSSRuleSet* rules, int& firstRuleIndex, int& l
         matchRulesForList(rules->getIDRules(m_element->getIDAttribute().impl()), firstRuleIndex, lastRuleIndex);
     if (m_element->hasClass()) {
         ASSERT(m_styledElement);
-        const ClassNames& classNames = m_styledElement->classNames();
+        const SpaceSplitString& classNames = m_styledElement->classNames();
         size_t size = classNames.size();
         for (size_t i = 0; i < size; ++i)
             matchRulesForList(rules->getClassRules(classNames[i].impl()), firstRuleIndex, lastRuleIndex);
@@ -761,7 +762,7 @@ void CSSStyleSelector::sortMatchedRules(unsigned start, unsigned end)
         return;
     }
 
-    // Peform a merge sort for larger lists.
+    // Perform a merge sort for larger lists.
     unsigned mid = (start + end) / 2;
     sortMatchedRules(start, mid);
     sortMatchedRules(mid, end);
@@ -1003,9 +1004,15 @@ bool CSSStyleSelector::canShareStyleWithElement(Node* n)
 
                 if (s->isDefaultButtonForForm() != m_element->isDefaultButtonForForm())
                     return false;
-
-                if ((s->willValidate() && s->isValidFormControlElement()) !=
-                    (m_element->willValidate() && m_element->isValidFormControlElement()))
+                
+                if (!m_element->document()->containsValidityStyleRules())
+                    return false;
+                
+                bool willValidate = s->willValidate();
+                if (willValidate != m_element->willValidate())
+                    return false;
+                
+                if (willValidate && (s->isValidFormControlElement() != m_element->isValidFormControlElement()))
                     return false;
             }
 
@@ -1091,6 +1098,39 @@ void CSSStyleSelector::matchUARules(int& firstUARule, int& lastUARule)
     }
 }
 
+PassRefPtr<RenderStyle> CSSStyleSelector::styleForDocument(Document* document)
+{
+    RefPtr<RenderStyle> documentStyle = RenderStyle::create();
+    documentStyle->setDisplay(BLOCK);
+    documentStyle->setVisuallyOrdered(document->visuallyOrdered());
+    documentStyle->setZoom(document->frame()->pageZoomFactor());
+    
+    FontDescription fontDescription;
+    fontDescription.setUsePrinterFont(document->printing());
+    if (Settings* settings = document->settings()) {
+        fontDescription.setRenderingMode(settings->fontRenderingMode());
+        if (document->printing() && !settings->shouldPrintBackgrounds())
+            documentStyle->setForceBackgroundsToWhite(true);
+        const AtomicString& stdfont = settings->standardFontFamily();
+        if (!stdfont.isEmpty()) {
+            fontDescription.firstFamily().setFamily(stdfont);
+            fontDescription.firstFamily().appendFamily(0);
+        }
+        fontDescription.setKeywordSize(CSSValueMedium - CSSValueXxSmall + 1);
+        int size = CSSStyleSelector::fontSizeForKeyword(document, CSSValueMedium, false);
+        fontDescription.setSpecifiedSize(size);
+        bool useSVGZoomRules = document->isSVGDocument();
+        fontDescription.setComputedSize(CSSStyleSelector::getComputedSizeFromSpecifiedSize(document, documentStyle.get(), fontDescription.isAbsoluteSize(), size, useSVGZoomRules));
+    }
+
+    documentStyle->setFontDescription(fontDescription);
+    documentStyle->font().update(0);
+    if (document->inCompatMode())
+        documentStyle->setHtmlHacks(true); // enable html specific rendering tricks
+        
+    return documentStyle.release();
+}
+
 // If resolveForRootDefault is true, style based on user agent style sheet only. This is used in media queries, where
 // relative units are interpreted according to document root element style, styled only with UA stylesheet
 
@@ -1297,7 +1337,9 @@ void CSSStyleSelector::keyframeStylesForAnimation(Element* e, const RenderStyle*
     // Get the keyframesRule for this name
     if (!e || list.animationName().isEmpty())
         return;
-            
+
+    m_keyframesRuleMap.checkConsistency();
+   
     if (!m_keyframesRuleMap.contains(list.animationName().impl()))
         return;
         
@@ -2368,15 +2410,8 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 }
                 break;
             case CSSSelector::PseudoEnabled:
-                if (e && e->isFormControlElement()) {
-                    InputElement* inputElement = toInputElement(e);
-                    if (inputElement && inputElement->isInputTypeHidden())
-                        break;
-                    // The UI spec states that you can't match :enabled unless you are an object that can
-                    // "receive focus and be activated."  We will limit matching of this pseudo-class to elements
-                    // that are non-"hidden" controls.
+                if (e && e->isFormControlElement())
                     return e->isEnabledFormControl();
-                }
                 break;
             case CSSSelector::PseudoFullPageMedia:
                 return e && e->document() && e->document()->isMediaDocument();
@@ -2384,16 +2419,8 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoDefault:
                 return e && e->isDefaultButtonForForm();
             case CSSSelector::PseudoDisabled:
-                if (e && e->isFormControlElement()) {
-                    InputElement* inputElement = toInputElement(e);
-                    if (inputElement && inputElement->isInputTypeHidden())
-                        break;
-
-                    // The UI spec states that you can't match :enabled unless you are an object that can
-                    // "receive focus and be activated."  We will limit matching of this pseudo-class to elements
-                    // that are non-"hidden" controls.
+                if (e && e->isFormControlElement())
                     return !e->isEnabledFormControl();
-                }
                 break;
             case CSSSelector::PseudoReadOnly: {
                 if (!e || !e->isFormControlElement())
@@ -2409,11 +2436,17 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 return e && e->isOptionalFormControl();
             case CSSSelector::PseudoRequired:
                 return e && e->isRequiredFormControl();
-            case CSSSelector::PseudoValid:
-                return e && e->willValidate() && e->isValidFormControlElement();
-            case CSSSelector::PseudoInvalid:
-                return e && e->willValidate() && !e->isValidFormControlElement();
-            case CSSSelector::PseudoChecked: {
+            case CSSSelector::PseudoValid: {
+                if (!e)
+                    return false;
+                e->document()->setContainsValidityStyleRules();
+                return e->willValidate() && e->isValidFormControlElement();
+            } case CSSSelector::PseudoInvalid: {
+                if (!e)
+                    return false;
+                e->document()->setContainsValidityStyleRules();
+                return e->willValidate() && !e->isValidFormControlElement();
+            } case CSSSelector::PseudoChecked: {
                 if (!e || !e->isFormControlElement())
                     break;
                 // Even though WinIE allows checked and indeterminate to co-exist, the CSS selector spec says that
@@ -2556,6 +2589,9 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoMediaControlsReturnToRealtimeButton:
                 dynamicPseudo = MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON;
                 return true;
+            case CSSSelector::PseudoMediaControlsToggleClosedCaptions:
+                dynamicPseudo = MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON;
+                return true;
             case CSSSelector::PseudoMediaControlsStatusDisplay:
                 dynamicPseudo = MEDIA_CONTROLS_STATUS_DISPLAY;
                 return true;
@@ -2583,6 +2619,12 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoResizer:
                 dynamicPseudo = RESIZER;
                 return true;
+            case CSSSelector::PseudoInnerSpinButton:
+                dynamicPseudo = INNER_SPIN_BUTTON;
+                return true;
+            case CSSSelector::PseudoOuterSpinButton:
+                dynamicPseudo = OUTER_SPIN_BUTTON;
+                return true;
             case CSSSelector::PseudoUnknown:
             case CSSSelector::PseudoNotParsed:
             default:
@@ -2864,7 +2906,7 @@ void CSSStyleSelector::applyDeclarations(bool applyFirst, bool isImportant,
                     case CSSPropertyFontVariant:
                     case CSSPropertyZoom:
                         // these have to be applied first, because other properties use the computed
-                        // values of these porperties.
+                        // values of these properties.
                         first = true;
                         break;
                     default:
@@ -2927,6 +2969,16 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
     float zoomFactor = m_style->effectiveZoom();
 
+    // SVG handles zooming in a different way compared to CSS. The whole document is scaled instead
+    // of each individual length value in the render style / tree. CSSPrimitiveValue::computeLength*()
+    // multiplies each resolved length with the zoom multiplier - so for SVG we need to disable that.
+    // Though all CSS values that can be applied to outermost <svg> elements (width/height/border/padding...)
+    // need to respect the scaling. RenderBox (the parent class of RenderSVGRoot) grabs values like
+    // width/height/border/padding/... from the RenderStyle -> for SVG these values would never scale,
+    // if we'd pass a 1.0 zoom factor everyhwere. So we only pass a zoom factor of 1.0 for specific
+    // properties that are NOT allowed to scale within a zoomed SVG document (letter/word-spacing/font-size).
+    bool useSVGZoomRules = m_element && m_element->isSVGElement();
+
     Length l;
     bool apply = false;
 
@@ -3029,7 +3081,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 #if ENABLE(WCSS)
         if (primitiveValue) {
             if (primitiveValue->getIdent() == CSSValueWapMarquee) {
-                // Initialize Wap Marquee style
+                // Initialize WAP Marquee style
                 m_style->setOverflowX(OMARQUEE);
                 m_style->setOverflowY(OMARQUEE);
                 m_style->setWhiteSpace(NOWRAP);
@@ -3568,7 +3620,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         } else {
             if (!primitiveValue)
                 return;
-            width = primitiveValue->computeLengthInt(style(), m_rootElementStyle, zoomFactor);
+            width = primitiveValue->computeLengthInt(style(), m_rootElementStyle, useSVGZoomRules ? 1.0f : zoomFactor);
         }
         switch (id) {
         case CSSPropertyLetterSpacing:
@@ -3878,7 +3930,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             if (m_parentNode)
                 fontDescription.setKeywordSize(m_parentStyle->fontDescription().keywordSize());
         } else if (isInitial) {
-            size = fontSizeForKeyword(CSSValueMedium, m_style->htmlHacks(), fontDescription.useFixedDefaultSize());
+            size = fontSizeForKeyword(m_checker.m_document, CSSValueMedium, fontDescription.useFixedDefaultSize());
             fontDescription.setKeywordSize(CSSValueMedium - CSSValueXxSmall + 1);
         } else if (primitiveValue->getIdent()) {
             // Keywords are being used.
@@ -3891,7 +3943,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 case CSSValueXLarge:
                 case CSSValueXxLarge:
                 case CSSValueWebkitXxxLarge:
-                    size = fontSizeForKeyword(primitiveValue->getIdent(), m_style->htmlHacks(), fontDescription.useFixedDefaultSize());
+                    size = fontSizeForKeyword(m_checker.m_document, primitiveValue->getIdent(), fontDescription.useFixedDefaultSize());
                     fontDescription.setKeywordSize(primitiveValue->getIdent() - CSSValueXxSmall + 1);
                     break;
                 case CSSValueLarger:
@@ -3978,7 +4030,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         if (primitiveValue->getIdent() == CSSValueNormal)
             lineHeight = Length(-100.0, Percent);
         else if (CSSPrimitiveValue::isUnitTypeLength(type)) {
-            double multiplier = m_style->effectiveZoom();
+            double multiplier = zoomFactor;
             if (m_style->textSizeAdjust() && m_checker.m_document->frame() && m_checker.m_document->frame()->shouldApplyTextZoom())
                 multiplier *= m_checker.m_document->frame()->textZoomFactor();
             lineHeight = Length(primitiveValue->computeLengthIntForLength(style(), m_rootElementStyle,  multiplier), Fixed);
@@ -4140,7 +4192,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             // We need to adjust the size to account for the generic family change from monospace
             // to non-monospace.
             if (fontDescription.keywordSize() && fontDescription.useFixedDefaultSize())
-                setFontSize(fontDescription, fontSizeForKeyword(CSSValueXxSmall + fontDescription.keywordSize() - 1, m_style->htmlHacks(), false));
+                setFontSize(fontDescription, fontSizeForKeyword(m_checker.m_document, CSSValueXxSmall + fontDescription.keywordSize() - 1, false));
             fontDescription.setGenericFamily(initialDesc.genericFamily());
             if (!initialDesc.firstFamily().familyIsEmpty())
                 fontDescription.setFamily(initialDesc.firstFamily());
@@ -4217,7 +4269,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         // If currFamily is non-zero then we set at least one family on this description.
         if (currFamily) {
             if (fontDescription.keywordSize() && fontDescription.useFixedDefaultSize() != oldFamilyUsedFixedDefaultSize)
-                setFontSize(fontDescription, fontSizeForKeyword(CSSValueXxSmall + fontDescription.keywordSize() - 1, m_style->htmlHacks(), !oldFamilyUsedFixedDefaultSize));
+                setFontSize(fontDescription, fontSizeForKeyword(m_checker.m_document, CSSValueXxSmall + fontDescription.keywordSize() - 1, !oldFamilyUsedFixedDefaultSize));
 
             if (m_style->setFontDescription(fontDescription))
                 m_fontDirty = true;
@@ -4437,7 +4489,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 fontDescription.firstFamily().appendFamily(0);
             }
             fontDescription.setKeywordSize(CSSValueMedium - CSSValueXxSmall + 1);
-            setFontSize(fontDescription, fontSizeForKeyword(CSSValueMedium, m_style->htmlHacks(), false));
+            setFontSize(fontDescription, fontSizeForKeyword(m_checker.m_document, CSSValueMedium, false));
             m_style->setLineHeight(RenderStyle::initialLineHeight());
             m_lineHeightValue = 0;
             if (m_style->setFontDescription(fontDescription))
@@ -4460,7 +4512,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 fontDescription.setUsePrinterFont(m_checker.m_document->printing());
            
                 // Handle the zoom factor.
-                fontDescription.setComputedSize(getComputedSizeFromSpecifiedSize(fontDescription.isAbsoluteSize(), fontDescription.specifiedSize()));
+                fontDescription.setComputedSize(getComputedSizeFromSpecifiedSize(m_checker.m_document, m_style.get(), fontDescription.isAbsoluteSize(), fontDescription.specifiedSize(), useSVGZoomRules));
                 if (m_style->setFontDescription(fontDescription))
                     m_fontDirty = true;
             }
@@ -5000,13 +5052,15 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitMarginBottomCollapse:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marginBottomCollapse, MarginBottomCollapse)
         return;
-
-    // Apple-specific changes.  Do not merge these properties into KHTML.
     case CSSPropertyWebkitLineClamp: {
         HANDLE_INHERIT_AND_INITIAL(lineClamp, LineClamp)
         if (!primitiveValue)
             return;
-        m_style->setLineClamp(primitiveValue->getIntValue(CSSPrimitiveValue::CSS_PERCENTAGE));
+        int type = primitiveValue->primitiveType();
+        if (type == CSSPrimitiveValue::CSS_NUMBER)
+            m_style->setLineClamp(LineClampValue(primitiveValue->getIntValue(CSSPrimitiveValue::CSS_NUMBER), LineClampLineCount));
+        else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
+            m_style->setLineClamp(LineClampValue(primitiveValue->getIntValue(CSSPrimitiveValue::CSS_PERCENTAGE), LineClampPercentage));
         return;
     }
     case CSSPropertyWebkitHighlight: {
@@ -5222,6 +5276,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitAnimationDuration:
         HANDLE_ANIMATION_VALUE(duration, Duration, value)
         return;
+    case CSSPropertyWebkitAnimationFillMode:
+        HANDLE_ANIMATION_VALUE(fillMode, FillMode, value)
+        return;
     case CSSPropertyWebkitAnimationIterationCount:
         HANDLE_ANIMATION_VALUE(iterationCount, IterationCount, value)
         return;
@@ -5267,6 +5324,17 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         m_style->setPointerEvents(*primitiveValue);
         return;
     }
+    case CSSPropertyWebkitColorCorrection:
+        if (isInherit) 
+            m_style->setColorSpace(m_parentStyle->colorSpace());
+        else if (isInitial)
+            m_style->setColorSpace(DeviceColorSpace);
+        else {
+            if (!primitiveValue)
+                return;
+            m_style->setColorSpace(*primitiveValue);
+        }
+        return;
     case CSSPropertyInvalid:
         return;
     case CSSPropertyFontStretch:
@@ -5570,6 +5638,30 @@ void CSSStyleSelector::mapAnimationDuration(Animation* animation, CSSValue* valu
         animation->setDuration(primitiveValue->getFloatValue()/1000.0f);
 }
 
+void CSSStyleSelector::mapAnimationFillMode(Animation* layer, CSSValue* value)
+{
+    if (value->cssValueType() == CSSValue::CSS_INITIAL) {
+        layer->setFillMode(Animation::initialAnimationFillMode());
+        return;
+    }
+
+    CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+    switch (primitiveValue->getIdent()) {
+    case CSSValueNone:
+        layer->setFillMode(AnimationFillModeNone);
+        break;
+    case CSSValueForwards:
+        layer->setFillMode(AnimationFillModeForwards);
+        break;
+    case CSSValueBackwards:
+        layer->setFillMode(AnimationFillModeBackwards);
+        break;
+    case CSSValueBoth:
+        layer->setFillMode(AnimationFillModeBoth);
+        break;
+    }
+}
+
 void CSSStyleSelector::mapAnimationIterationCount(Animation* animation, CSSValue* value)
 {
     if (value->cssValueType() == CSSValue::CSS_INITIAL) {
@@ -5769,7 +5861,7 @@ void CSSStyleSelector::checkForGenericFamilyChange(RenderStyle* style, RenderSty
     // multiplying by our scale factor.
     float size;
     if (childFont.keywordSize())
-        size = fontSizeForKeyword(CSSValueXxSmall + childFont.keywordSize() - 1, style->htmlHacks(), childFont.useFixedDefaultSize());
+        size = fontSizeForKeyword(m_checker.m_document, CSSValueXxSmall + childFont.keywordSize() - 1, childFont.useFixedDefaultSize());
     else {
         Settings* settings = m_checker.m_document->settings();
         float fixedScaleFactor = settings
@@ -5788,11 +5880,20 @@ void CSSStyleSelector::checkForGenericFamilyChange(RenderStyle* style, RenderSty
 void CSSStyleSelector::setFontSize(FontDescription& fontDescription, float size)
 {
     fontDescription.setSpecifiedSize(size);
-    fontDescription.setComputedSize(getComputedSizeFromSpecifiedSize(fontDescription.isAbsoluteSize(), size));
+
+    bool useSVGZoomRules = m_element && m_element->isSVGElement();
+    fontDescription.setComputedSize(getComputedSizeFromSpecifiedSize(m_checker.m_document, m_style.get(), fontDescription.isAbsoluteSize(), size, useSVGZoomRules)); 
 }
 
-float CSSStyleSelector::getComputedSizeFromSpecifiedSize(bool isAbsoluteSize, float specifiedSize)
+float CSSStyleSelector::getComputedSizeFromSpecifiedSize(Document* document, RenderStyle* style, bool isAbsoluteSize, float specifiedSize, bool useSVGZoomRules)
 {
+    float zoomFactor = 1.0f;
+    if (!useSVGZoomRules) {
+        zoomFactor = style->effectiveZoom();
+        if (document->frame() && document->frame()->shouldApplyTextZoom())
+            zoomFactor *= document->frame()->textZoomFactor();
+    }
+
     // We support two types of minimum font size.  The first is a hard override that applies to
     // all fonts.  This is "minSize."  The second type of minimum font size is a "smart minimum"
     // that is applied only when the Web page can't know what size it really asked for, e.g.,
@@ -5803,17 +5904,12 @@ float CSSStyleSelector::getComputedSizeFromSpecifiedSize(bool isAbsoluteSize, fl
     // However we always allow the page to set an explicit pixel size that is smaller,
     // since sites will mis-render otherwise (e.g., http://www.gamespot.com with a 9px minimum).
     
-    Settings* settings = m_checker.m_document->settings();
+    Settings* settings = document->settings();
     if (!settings)
         return 1.0f;
 
     int minSize = settings->minimumFontSize();
     int minLogicalSize = settings->minimumLogicalFontSize();
-
-    float zoomFactor = m_style->effectiveZoom();
-    if (m_checker.m_document->frame() && m_checker.m_document->frame()->shouldApplyTextZoom())
-        zoomFactor *= m_checker.m_document->frame()->textZoomFactor();
-
     float zoomedSize = specifiedSize * zoomFactor;
 
     // Apply the hard minimum first.  We only apply the hard minimum if after zooming we're still too small.
@@ -5874,12 +5970,13 @@ static const int strictFontSizeTable[fontSizeTableMax - fontSizeTableMin + 1][to
 // factors for each keyword value.
 static const float fontSizeFactors[totalKeywords] = { 0.60f, 0.75f, 0.89f, 1.0f, 1.2f, 1.5f, 2.0f, 3.0f };
 
-float CSSStyleSelector::fontSizeForKeyword(int keyword, bool quirksMode, bool fixed) const
+float CSSStyleSelector::fontSizeForKeyword(Document* document, int keyword, bool fixed)
 {
-    Settings* settings = m_checker.m_document->settings();
+    Settings* settings = document->settings();
     if (!settings)
         return 1.0f;
 
+    bool quirksMode = document->inCompatMode();
     int mediumSize = fixed ? settings->defaultFixedFontSize() : settings->defaultFontSize();
     if (mediumSize >= fontSizeTableMin && mediumSize <= fontSizeTableMax) {
         // Look up the entry in the table.
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h
index 6e0663fd17..284d561736 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h
@@ -23,7 +23,6 @@
 #define CSSStyleSelector_h
 
 #include "CSSFontSelector.h"
-#include "KeyframeList.h"
 #include "LinkHash.h"
 #include "MediaQueryExp.h"
 #include "RenderStyle.h"
@@ -56,6 +55,7 @@ class Element;
 class Frame;
 class FrameView;
 class KURL;
+class KeyframeList;
 class MediaQueryEvaluator;
 class Node;
 class Settings;
@@ -65,7 +65,7 @@ class StyleSheetList;
 class StyledElement;
 class WebKitCSSKeyframesRule;
 
-class MediaQueryResult {
+class MediaQueryResult : public Noncopyable {
 public:
     MediaQueryResult(const MediaQueryExp& expr, bool result)
         : m_expression(expr)
@@ -92,6 +92,8 @@ public:
 
         PassRefPtr<RenderStyle> pseudoStyleForElement(PseudoId, Element*, RenderStyle* parentStyle = 0);
 
+        static PassRefPtr<RenderStyle> styleForDocument(Document*);
+
 #if ENABLE(DATAGRID)
         // Datagrid style computation (uses unique pseudo elements and structures)
         PassRefPtr<RenderStyle> pseudoStyleForDataGridColumn(DataGridColumn*, RenderStyle* parentStyle);
@@ -112,8 +114,8 @@ public:
 
         // Given a CSS keyword in the range (xx-small to -webkit-xxx-large), this function will return
         // the correct font size scaled relative to the user's default (medium).
-        float fontSizeForKeyword(int keyword, bool quirksMode, bool monospace) const;
-
+        static float fontSizeForKeyword(Document*, int keyword, bool monospace);
+        
     private:
         // When the CSS keyword "larger" is used, this function will attempt to match within the keyword
         // table, and failing that, will simply multiply by 1.2.
@@ -129,7 +131,7 @@ public:
         void applyPropertyToStyle(int id, CSSValue*, RenderStyle*);
 
     private:
-        float getComputedSizeFromSpecifiedSize(bool isAbsoluteSize, float specifiedSize);
+        static float getComputedSizeFromSpecifiedSize(Document*, RenderStyle*, bool isAbsoluteSize, float specifiedSize, bool useSVGZoomRules);
 
     public:
         Color getColorFromPrimitiveValue(CSSPrimitiveValue*);
@@ -233,6 +235,7 @@ public:
         void mapAnimationDelay(Animation*, CSSValue*);
         void mapAnimationDirection(Animation*, CSSValue*);
         void mapAnimationDuration(Animation*, CSSValue*);
+        void mapAnimationFillMode(Animation*, CSSValue*);
         void mapAnimationIterationCount(Animation*, CSSValue*);
         void mapAnimationName(Animation*, CSSValue*);
         void mapAnimationPlayState(Animation*, CSSValue*);
@@ -286,7 +289,7 @@ public:
         HashMap<CSSMutableStyleDeclaration*, RefPtr<CSSMutableStyleDeclaration> > m_resolvedVariablesDeclarations;
     };
 
-    class CSSRuleData {
+    class CSSRuleData : public Noncopyable {
     public:
         CSSRuleData(unsigned pos, CSSStyleRule* r, CSSSelector* sel, CSSRuleData* prev = 0)
             : m_position(pos)
@@ -314,7 +317,7 @@ public:
         CSSRuleData* m_next;
     };
 
-    class CSSRuleDataList {
+    class CSSRuleDataList : public Noncopyable {
     public:
         CSSRuleDataList(unsigned pos, CSSStyleRule* rule, CSSSelector* sel)
             : m_first(new CSSRuleData(pos, rule, sel))
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
index 1579999e55..fb253747a6 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
@@ -28,39 +28,43 @@
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "Node.h"
+#include "SecurityOrigin.h"
 #include "TextEncoding.h"
 #include <wtf/Deque.h>
 
 namespace WebCore {
 
-CSSStyleSheet::CSSStyleSheet(CSSStyleSheet* parentSheet, const String& href, const String& charset)
-    : StyleSheet(parentSheet, href)
+CSSStyleSheet::CSSStyleSheet(CSSStyleSheet* parentSheet, const String& href, const KURL& baseURL, const String& charset)
+    : StyleSheet(parentSheet, href, baseURL)
     , m_doc(parentSheet ? parentSheet->doc() : 0)
     , m_namespaces(0)
     , m_charset(charset)
     , m_loadCompleted(false)
     , m_strictParsing(!parentSheet || parentSheet->useStrictParsing())
     , m_isUserStyleSheet(parentSheet ? parentSheet->isUserStyleSheet() : false)
+    , m_hasSyntacticallyValidCSSHeader(true)
 {
 }
 
-CSSStyleSheet::CSSStyleSheet(Node* parentNode, const String& href, const String& charset)
-    : StyleSheet(parentNode, href)
+CSSStyleSheet::CSSStyleSheet(Node* parentNode, const String& href, const KURL& baseURL, const String& charset)
+    : StyleSheet(parentNode, href, baseURL)
     , m_doc(parentNode->document())
     , m_namespaces(0)
     , m_charset(charset)
     , m_loadCompleted(false)
     , m_strictParsing(false)
     , m_isUserStyleSheet(false)
+    , m_hasSyntacticallyValidCSSHeader(true)
 {
 }
 
-CSSStyleSheet::CSSStyleSheet(CSSRule* ownerRule, const String& href, const String& charset)
-    : StyleSheet(ownerRule, href)
+CSSStyleSheet::CSSStyleSheet(CSSRule* ownerRule, const String& href, const KURL& baseURL, const String& charset)
+    : StyleSheet(ownerRule, href, baseURL)
     , m_namespaces(0)
     , m_charset(charset)
     , m_loadCompleted(false)
     , m_strictParsing(!ownerRule || ownerRule->useStrictParsing())
+    , m_hasSyntacticallyValidCSSHeader(true)
 {
     CSSStyleSheet* parentSheet = ownerRule ? ownerRule->parentStyleSheet() : 0;
     m_doc = parentSheet ? parentSheet->doc() : 0;
@@ -92,9 +96,24 @@ unsigned CSSStyleSheet::insertRule(const String& rule, unsigned index, Exception
         return 0;
     }
 
-    // ###
-    // HIERARCHY_REQUEST_ERR: Raised if the rule cannot be inserted at the specified index e.g. if an
-    //@import rule is inserted after a standard rule set or other at-rule.
+    // Throw a HIERARCHY_REQUEST_ERR exception if the rule cannot be inserted at the specified index.  The best
+    // example of this is an @import rule inserted after regular rules.
+    if (index > 0) {
+        if (r->isImportRule()) {
+            // Check all the rules that come before this one to make sure they are only @charset and @import rules.
+            for (unsigned i = 0; i < index; ++i) {
+                if (!item(i)->isCharsetRule() && !item(i)->isImportRule()) {
+                    ec = HIERARCHY_REQUEST_ERR;
+                    return 0;
+                }
+            }
+        } else if (r->isCharsetRule()) {
+            // The @charset rule has to come first and there can be only one.
+            ec = HIERARCHY_REQUEST_ERR;
+            return 0;
+        }
+    }
+
     insert(index, r.release());
     
     styleSheetChanged();
@@ -118,6 +137,8 @@ int CSSStyleSheet::addRule(const String& selector, const String& style, Exceptio
 
 PassRefPtr<CSSRuleList> CSSStyleSheet::cssRules(bool omitCharsetRules)
 {
+    if (doc() && !doc()->securityOrigin()->canRequest(baseURL()))
+        return 0;
     return CSSRuleList::create(this, omitCharsetRules);
 }
 
@@ -135,7 +156,7 @@ void CSSStyleSheet::deleteRule(unsigned index, ExceptionCode& ec)
 
 void CSSStyleSheet::addNamespace(CSSParser* p, const AtomicString& prefix, const AtomicString& uri)
 {
-    if (uri.isEmpty())
+    if (uri.isNull())
         return;
 
     m_namespaces = new CSSNamespace(prefix, uri, m_namespaces);
@@ -148,11 +169,11 @@ void CSSStyleSheet::addNamespace(CSSParser* p, const AtomicString& prefix, const
 
 const AtomicString& CSSStyleSheet::determineNamespace(const AtomicString& prefix)
 {
-    if (prefix.isEmpty())
+    if (prefix.isNull())
         return nullAtom; // No namespace. If an element/attribute has a namespace, we won't match it.
-    else if (prefix == starAtom)
+    if (prefix == starAtom)
         return starAtom; // We'll match any namespace.
-    else if (m_namespaces) {
+    if (m_namespaces) {
         CSSNamespace* ns = m_namespaces->namespaceForPrefix(prefix);
         if (ns)
             return ns->uri();
@@ -227,10 +248,12 @@ void CSSStyleSheet::addSubresourceStyleURLs(ListHashSet<KURL>& urls)
         CSSStyleSheet* styleSheet = styleSheetQueue.first();
         styleSheetQueue.removeFirst();
 
-        RefPtr<CSSRuleList> ruleList = styleSheet->cssRules();
-
-        for (unsigned i = 0; i < ruleList->length(); ++i) {
-            CSSRule* rule = ruleList->item(i);
+        for (unsigned i = 0; i < styleSheet->length(); ++i) {
+            StyleBase* styleBase = styleSheet->item(i);
+            if (!styleBase->isRule())
+                continue;
+            
+            CSSRule* rule = static_cast<CSSRule*>(styleBase);
             if (rule->isImportRule()) {
                 if (CSSStyleSheet* ruleStyleSheet = static_cast<CSSImportRule*>(rule)->styleSheet())
                     styleSheetQueue.append(ruleStyleSheet);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h
index f534104f30..bb14e28108 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h
@@ -38,27 +38,31 @@ class CSSStyleSheet : public StyleSheet {
 public:
     static PassRefPtr<CSSStyleSheet> create()
     {
-        return adoptRef(new CSSStyleSheet(static_cast<CSSStyleSheet*>(0), String(), String()));
+        return adoptRef(new CSSStyleSheet(static_cast<CSSStyleSheet*>(0), String(), KURL(), String()));
     }
     static PassRefPtr<CSSStyleSheet> create(Node* ownerNode)
     {
-        return adoptRef(new CSSStyleSheet(ownerNode, String(), String()));
+        return adoptRef(new CSSStyleSheet(ownerNode, String(), KURL(), String()));
     }
-    static PassRefPtr<CSSStyleSheet> create(Node* ownerNode, const String& href)
+    static PassRefPtr<CSSStyleSheet> create(Node* ownerNode, const String& originalURL, const KURL& finalURL)
     {
-        return adoptRef(new CSSStyleSheet(ownerNode, href, String()));
+        return adoptRef(new CSSStyleSheet(ownerNode, originalURL, finalURL, String()));
     }
-    static PassRefPtr<CSSStyleSheet> create(Node* ownerNode, const String& href, const String& charset)
+    static PassRefPtr<CSSStyleSheet> create(Node* ownerNode, const String& originalURL, const KURL& finalURL, const String& charset)
     {
-        return adoptRef(new CSSStyleSheet(ownerNode, href, charset));
+        return adoptRef(new CSSStyleSheet(ownerNode, originalURL, finalURL, charset));
     }
-    static PassRefPtr<CSSStyleSheet> create(CSSRule* ownerRule, const String& href, const String& charset)
+    static PassRefPtr<CSSStyleSheet> create(CSSRule* ownerRule, const String& originalURL, const KURL& finalURL, const String& charset)
     {
-        return adoptRef(new CSSStyleSheet(ownerRule, href, charset));
+        return adoptRef(new CSSStyleSheet(ownerRule, originalURL, finalURL, charset));
+    }
+    static PassRefPtr<CSSStyleSheet> createInline(Node* ownerNode, const KURL& finalURL)
+    {
+        return adoptRef(new CSSStyleSheet(ownerNode, finalURL.string(), finalURL, String()));
     }
 
     virtual ~CSSStyleSheet();
-    
+
     CSSRule* ownerRule() const;
     PassRefPtr<CSSRuleList> cssRules(bool omitCharsetRules = false);
     unsigned insertRule(const String& rule, unsigned index, ExceptionCode&);
@@ -72,7 +76,7 @@ public:
 
     void addNamespace(CSSParser*, const AtomicString& prefix, const AtomicString& uri);
     const AtomicString& determineNamespace(const AtomicString& prefix);
-    
+
     virtual void styleSheetChanged();
 
     virtual bool parseString(const String&, bool strict = true);
@@ -95,12 +99,14 @@ public:
 
     void setIsUserStyleSheet(bool b) { m_isUserStyleSheet = b; }
     bool isUserStyleSheet() const { return m_isUserStyleSheet; }
+    void setHasSyntacticallyValidCSSHeader(bool b) { m_hasSyntacticallyValidCSSHeader = b; }
+    bool hasSyntacticallyValidCSSHeader() const { return m_hasSyntacticallyValidCSSHeader; }
 
 private:
-    CSSStyleSheet(Node* ownerNode, const String& href, const String& charset);
-    CSSStyleSheet(CSSStyleSheet* parentSheet, const String& href, const String& charset);
-    CSSStyleSheet(CSSRule* ownerRule, const String& href, const String& charset);
-    
+    CSSStyleSheet(Node* ownerNode, const String& originalURL, const KURL& finalURL, const String& charset);
+    CSSStyleSheet(CSSStyleSheet* parentSheet, const String& originalURL, const KURL& finalURL, const String& charset);
+    CSSStyleSheet(CSSRule* ownerRule, const String& originalURL, const KURL& finalURL, const String& charset);
+
     virtual bool isCSSStyleSheet() const { return true; }
     virtual String type() const { return "text/css"; }
 
@@ -110,6 +116,7 @@ private:
     bool m_loadCompleted : 1;
     bool m_strictParsing : 1;
     bool m_isUserStyleSheet : 1;
+    bool m_hasSyntacticallyValidCSSHeader : 1;
 };
 
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.idl b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.idl
index d10844c954..e18021790c 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=2f547f65-f8c4-4f13-8724-ed10ed79dcc4,
-        ImplementationUUID=1b5c24b3-8b6f-43a9-8891-654ba858f42f
-    ] CSSStyleSheet : stylesheets::StyleSheet {
+    interface CSSStyleSheet : stylesheets::StyleSheet {
         readonly attribute CSSRule          ownerRule;
         readonly attribute CSSRuleList      cssRules;
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSUnknownRule.idl b/src/3rdparty/webkit/WebCore/css/CSSUnknownRule.idl
index 2365cd2790..b62ceb873f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSUnknownRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSUnknownRule.idl
@@ -22,8 +22,7 @@ module css {
 
     // Introduced in DOM Level 2:
     interface [
-        InterfaceUUID=35670098-b732-419c-b7cd-dc0d5e26d5e3,
-        ImplementationUUID=4b755f87-2509-4b98-a953-8ecb88fe4b21
+        OmitConstructor
     ] CSSUnknownRule : CSSRule {
     };
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValue.idl b/src/3rdparty/webkit/WebCore/css/CSSValue.idl
index ee82b0ccb9..fe6b8f2c38 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValue.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSValue.idl
@@ -22,10 +22,7 @@ module css {
 
     interface [
         CustomToJS,
-        GenerateConstructor,
-        Polymorphic,
-        InterfaceUUID=9fd62a7b-539d-4500-bd6c-ec075abbc404,
-        ImplementationUUID=e10a2860-f98e-4bd3-96b4-1493ad941dfe
+        Polymorphic
     ] CSSValue {
 
         // UnitTypes
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in b/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
index 1b7b1d82be..9d7ed6c18f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
+++ b/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
@@ -225,6 +225,28 @@ circle
 square
 decimal
 decimal-leading-zero
+arabic-indic
+binary
+bengali
+cambodian
+khmer
+devanagari
+gujarati
+gurmukhi
+kannada
+lower-hexadecimal
+lao
+malayalam
+mongolian
+myanmar
+octal
+oriya
+persian
+urdu
+telugu
+tibetan
+thai
+upper-hexadecimal
 lower-roman
 upper-roman
 lower-greek
@@ -232,6 +254,40 @@ lower-alpha
 lower-latin
 upper-alpha
 upper-latin
+afar
+ethiopic-halehame-aa-et
+ethiopic-halehame-aa-er
+amharic
+ethiopic-halehame-am-et
+amharic-abegede
+ethiopic-abegede-am-et
+cjk-earthly-branch
+cjk-heavenly-stem
+ethiopic
+ethiopic-halehame-gez
+ethiopic-abegede
+ethiopic-abegede-gez
+hangul-consonant
+hangul
+lower-norwegian
+oromo
+ethiopic-halehame-om-et
+sidama
+ethiopic-halehame-sid-et
+somali
+ethiopic-halehame-so-et
+tigre
+ethiopic-halehame-tig
+tigrinya-er
+ethiopic-halehame-ti-er
+tigrinya-er-abegede
+ethiopic-abegede-ti-er
+tigrinya-et
+ethiopic-halehame-ti-et
+tigrinya-et-abegede
+ethiopic-abegede-ti-et
+upper-greek
+upper-norwegian
 hebrew
 armenian
 georgian
@@ -501,6 +557,7 @@ square-button
 button
 button-bevel
 default-button
+inner-spin-button
 list-button
 listbox
 listitem
@@ -511,6 +568,7 @@ media-seek-back-button
 media-seek-forward-button
 media-rewind-button
 media-return-to-realtime-button
+media-toggle-closed-captions-button
 media-slider
 media-sliderthumb
 media-volume-slider-container
@@ -523,6 +581,8 @@ menulist
 menulist-button
 menulist-text
 menulist-textfield
+outer-spin-button
+progress-bar
 slider-horizontal
 slider-vertical
 sliderthumb-horizontal
@@ -580,6 +640,13 @@ lines
 # alternate
 
 #
+# CSS_PROP__WEBKIT_ANIMATION_FILL_MODE
+#
+# forwards
+# backwards
+# both
+
+#
 # CSS_PROP__WEBKIT_ANIMATION_ITERATION_COUNT
 #
 # infinite
@@ -638,3 +705,14 @@ subpixel-antialiased
 optimizeSpeed
 optimizeLegibility
 geometricPrecision
+
+# -webkit-color-correction
+#default
+sRGB
+
+# (-webkit-view-mode:) media feature:
+mini
+floating
+application
+fullscreen
+#all
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValueList.cpp b/src/3rdparty/webkit/WebCore/css/CSSValueList.cpp
index 9633f7cbec..8f1f88dc8e 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValueList.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSValueList.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValueList.idl b/src/3rdparty/webkit/WebCore/css/CSSValueList.idl
index 8ddfaaef67..06df5d7c5e 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValueList.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSValueList.idl
@@ -27,10 +27,7 @@ module css {
 
     // Introduced in DOM Level 2:
     interface [
-        GenerateConstructor,
-        HasIndexGetter,
-        InterfaceUUID=2fb74620-9029-400c-bc4b-4ce8e25b081f,
-        ImplementationUUID=1d8fc822-f89a-48d5-a2ac-827e5a24357e
+        HasIndexGetter
     ] CSSValueList : CSSValue {
         readonly attribute unsigned long    length;
         CSSValue           item(in unsigned long index);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.idl b/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.idl
index 82d2e9ccb0..672bfe2ed1 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.idl
@@ -26,7 +26,6 @@
 module css {
 
     interface [
-        GenerateConstructor,
         HasIndexGetter
     ] CSSVariablesDeclaration {
         attribute DOMString         cssText;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSVariablesRule.idl b/src/3rdparty/webkit/WebCore/css/CSSVariablesRule.idl
index ec49282036..780e84d094 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSVariablesRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSVariablesRule.idl
@@ -25,9 +25,7 @@
 
 module css {
 
-    interface [
-        GenerateConstructor
-    ] CSSVariablesRule : CSSRule {
+    interface CSSVariablesRule : CSSRule {
         readonly attribute stylesheets::MediaList  media;
         readonly attribute CSSVariablesDeclaration variables;
     };
diff --git a/src/3rdparty/webkit/WebCore/css/Counter.idl b/src/3rdparty/webkit/WebCore/css/Counter.idl
index 5be8f0d247..6236c454e9 100644
--- a/src/3rdparty/webkit/WebCore/css/Counter.idl
+++ b/src/3rdparty/webkit/WebCore/css/Counter.idl
@@ -20,11 +20,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=365d0f26-3a6e-457c-a34c-174d98f79798,
-        ImplementationUUID=8bfdc968-9a1b-4e4f-8d36-732d49b48eaa
-    ] Counter {
+    interface Counter {
         readonly attribute DOMString identifier;
         readonly attribute DOMString listStyle;
         readonly attribute DOMString separator;
diff --git a/src/3rdparty/webkit/WebCore/css/FontValue.cpp b/src/3rdparty/webkit/WebCore/css/FontValue.cpp
index 231ac64f9f..991fc6e5b3 100644
--- a/src/3rdparty/webkit/WebCore/css/FontValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/FontValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/Media.cpp b/src/3rdparty/webkit/WebCore/css/Media.cpp
index 57c4aaca06..e238602c90 100644
--- a/src/3rdparty/webkit/WebCore/css/Media.cpp
+++ b/src/3rdparty/webkit/WebCore/css/Media.cpp
@@ -34,15 +34,14 @@
 
 namespace WebCore {
 
-Media::Media(DOMWindow* window)
-    : m_window(window)
+Media::Media(Frame* frame)
+    : m_frame(frame)
 {
 }
 
 String Media::type() const
 {
-    Frame* frame = m_window->frame();
-    FrameView* view = frame ? frame->view() : 0;
+    FrameView* view = m_frame ? m_frame->view() : 0;
     if (view)
         return view->mediaType();
 
@@ -51,15 +50,19 @@ String Media::type() const
 
 bool Media::matchMedium(const String& query) const
 {
-    Document* document = m_window->document();
-    Frame* frame = m_window->frame();
+    if (!m_frame)
+        return false;
+
+    Document* document = m_frame->document();
+    ASSERT(document);
+    Element* documentElement = document->documentElement();
+    ASSERT(documentElement);
 
     CSSStyleSelector* styleSelector = document->styleSelector();
-    Element* docElement = document->documentElement();
-    if (!styleSelector || !docElement || !frame)
+    if (!styleSelector)
         return false;
 
-    RefPtr<RenderStyle> rootStyle = styleSelector->styleForElement(docElement, 0 /*defaultParent*/, false /*allowSharing*/, true /*resolveForRootDefault*/);
+    RefPtr<RenderStyle> rootStyle = styleSelector->styleForElement(documentElement, 0 /*defaultParent*/, false /*allowSharing*/, true /*resolveForRootDefault*/);
     RefPtr<MediaList> media = MediaList::create();
 
     ExceptionCode ec = 0;
@@ -67,7 +70,7 @@ bool Media::matchMedium(const String& query) const
     if (ec)
         return false;
 
-    MediaQueryEvaluator screenEval(type(), frame, rootStyle.get());
+    MediaQueryEvaluator screenEval(type(), m_frame, rootStyle.get());
     return screenEval.eval(media.get());
 }
 
diff --git a/src/3rdparty/webkit/WebCore/css/Media.h b/src/3rdparty/webkit/WebCore/css/Media.h
index 0d7b504dc6..ee6961b368 100644
--- a/src/3rdparty/webkit/WebCore/css/Media.h
+++ b/src/3rdparty/webkit/WebCore/css/Media.h
@@ -32,21 +32,21 @@ namespace WebCore {
 
 class Media : public RefCounted<Media> {
 public:
-    static PassRefPtr<Media> create(DOMWindow* window)
+    static PassRefPtr<Media> create(Frame* frame)
     {
-        return adoptRef(new Media(window));
+        return adoptRef(new Media(frame));
     }
-    
-    Document* document() const { return m_window->document(); }
+
+    void disconnectFrame() { m_frame = 0; }
 
     String type() const;
 
     bool matchMedium(const String&) const;
     
 private:
-    Media(DOMWindow*);
+    Media(Frame*);
 
-    RefPtr<DOMWindow> m_window;
+    Frame* m_frame;
 };
 
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/css/Media.idl b/src/3rdparty/webkit/WebCore/css/Media.idl
index b01d712aee..1bf59007b8 100644
--- a/src/3rdparty/webkit/WebCore/css/Media.idl
+++ b/src/3rdparty/webkit/WebCore/css/Media.idl
@@ -24,9 +24,7 @@
  */
 
 module view {
-    interface [
-        GenerateConstructor,
-    ] Media {
+    interface Media {
         readonly attribute DOMString type;
         boolean matchMedium(in DOMString mediaquery);
     };
diff --git a/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.cpp b/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.cpp
index fcee5de5a7..a7799c18f5 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.cpp
+++ b/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h b/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h
index 51965860e9..8aaedb2d83 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h
+++ b/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the CSS implementation for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
@@ -27,6 +25,13 @@
 namespace WebCore {
     namespace MediaFeatureNames {
 
+#if ENABLE(WIDGETS_10_SUPPORT)
+#define CSS_MEDIAQUERY_NAMES_FOR_WIDGETS_10_MEDIAFEATURE(macro) \
+    macro(view_mode, "-webkit-view-mode")
+#else
+#define CSS_MEDIAQUERY_NAMES_FOR_WIDGETS_10_MEDIAFEATURE(macro)
+#endif
+
 #define CSS_MEDIAQUERY_NAMES_FOR_EACH_MEDIAFEATURE(macro) \
     macro(color, "color") \
     macro(grid, "grid") \
@@ -61,6 +66,8 @@ namespace WebCore {
     macro(transform_3d, "-webkit-transform-3d") \
     macro(transition, "-webkit-transition") \
     macro(animation, "-webkit-animation") \
+    CSS_MEDIAQUERY_NAMES_FOR_WIDGETS_10_MEDIAFEATURE(macro)
+
 // end of macro
 
 #ifndef CSS_MEDIAQUERY_NAMES_HIDE_GLOBALS
diff --git a/src/3rdparty/webkit/WebCore/css/MediaList.idl b/src/3rdparty/webkit/WebCore/css/MediaList.idl
index dc10e6319d..54ad4f8199 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaList.idl
+++ b/src/3rdparty/webkit/WebCore/css/MediaList.idl
@@ -27,10 +27,7 @@ module stylesheets {
 
     // Introduced in DOM Level 2:
     interface [
-        GenerateConstructor,
-        HasIndexGetter,
-        InterfaceUUID=4ed02a0b-15b3-4a20-8f16-d91295aaf2cb,
-        ImplementationUUID=6c5095d8-fdcc-4f9a-b04a-23c2a6d2cf49
+        HasIndexGetter
     ] MediaList {
 
                  attribute [ConvertNullToNullString, ConvertNullStringTo=Null] DOMString mediaText
diff --git a/src/3rdparty/webkit/WebCore/css/MediaQuery.h b/src/3rdparty/webkit/WebCore/css/MediaQuery.h
index ff22d9ad6a..7cbd3bfa39 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaQuery.h
+++ b/src/3rdparty/webkit/WebCore/css/MediaQuery.h
@@ -34,7 +34,7 @@
 namespace WebCore {
 class MediaQueryExp;
 
-class MediaQuery {
+class MediaQuery : public Noncopyable {
 public:
     enum Restrictor {
         Only, Not, None
diff --git a/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp b/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp
index 4963ed4ede..8eaa1e3741 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp
+++ b/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp
@@ -29,6 +29,7 @@
 #include "MediaQueryEvaluator.h"
 
 #include "Chrome.h"
+#include "ChromeClient.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSStyleSelector.h"
 #include "CSSValueList.h"
@@ -47,7 +48,7 @@
 #include "PlatformScreen.h"
 #include <wtf/HashMap.h>
 
-#if ENABLE(3D_RENDERING)
+#if ENABLE(3D_RENDERING) && USE(ACCELERATED_COMPOSITING)
 #include "RenderLayerCompositor.h"
 #endif
 
@@ -474,8 +475,10 @@ static bool transform_3dMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* f
 
 #if ENABLE(3D_RENDERING)
     bool threeDEnabled = false;
+#if USE(ACCELERATED_COMPOSITING)
     if (RenderView* view = frame->contentRenderer())
         threeDEnabled = view->compositor()->hasAcceleratedCompositing();
+#endif
 
     returnValueIfNoParameter = threeDEnabled;
     have3dRendering = threeDEnabled ? 1 : 0;
@@ -492,6 +495,29 @@ static bool transform_3dMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* f
     return returnValueIfNoParameter;
 }
 
+#if ENABLE(WIDGETS_10_SUPPORT)
+static bool view_modeMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* frame, MediaFeaturePrefix op)
+{
+    if (value) {
+        String mode = static_cast<CSSPrimitiveValue*>(value)->getStringValue();
+        if (ChromeClient* client = frame->page()->chrome()->client()) {
+            if (mode == "all")
+                return true;
+            if (mode == "mini" && client->isDocked())
+                return true;
+            if (mode == "floating" && client->isFloating())
+                return true;
+            if (mode == "application" && client->isApplication())
+                return true;
+            if (mode == "fullscreen" && client->isFullscreen())
+                return true;
+            return false;
+        }
+    }
+    return false;
+}
+#endif
+
 static void createFunctionMap()
 {
     // Create the table.
diff --git a/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.h b/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.h
index 404504b237..00ac394c80 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.h
+++ b/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.h
@@ -49,7 +49,7 @@ class MediaQueryExp;
  * the device characteristics are not known. This can be used to prune the loading
  * of stylesheets to only those which are probable to match.
  */
-class MediaQueryEvaluator {
+class MediaQueryEvaluator : public Noncopyable {
 public:
     /** Creates evaluator which evaluates only simple media queries
      *  Evaluator returns true for "all", and returns value of \mediaFeatureResult
diff --git a/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h b/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h
index 5ff4af33f3..fd55cf6985 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h
+++ b/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h
@@ -36,7 +36,7 @@
 namespace WebCore {
 class CSSParserValueList;
 
-class MediaQueryExp {
+class MediaQueryExp : public FastAllocBase {
 public:
     MediaQueryExp(const AtomicString& mediaFeature, CSSParserValueList* values);
     ~MediaQueryExp();
diff --git a/src/3rdparty/webkit/WebCore/css/Pair.h b/src/3rdparty/webkit/WebCore/css/Pair.h
index a2b127e43a..c76bd821ae 100644
--- a/src/3rdparty/webkit/WebCore/css/Pair.h
+++ b/src/3rdparty/webkit/WebCore/css/Pair.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/RGBColor.idl b/src/3rdparty/webkit/WebCore/css/RGBColor.idl
index d29f8114b0..1dc87bcfd8 100644
--- a/src/3rdparty/webkit/WebCore/css/RGBColor.idl
+++ b/src/3rdparty/webkit/WebCore/css/RGBColor.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=2e3b1501-2cf7-4a4a-bbf7-d8843d1c3be7,
-        ImplementationUUID=cf779953-4898-4800-aa31-6c9e3f4711be
-    ] RGBColor {
+    interface RGBColor {
         readonly attribute CSSPrimitiveValue  red;
         readonly attribute CSSPrimitiveValue  green;
         readonly attribute CSSPrimitiveValue  blue;
diff --git a/src/3rdparty/webkit/WebCore/css/Rect.idl b/src/3rdparty/webkit/WebCore/css/Rect.idl
index 3c31dc6e02..60eb70e31f 100644
--- a/src/3rdparty/webkit/WebCore/css/Rect.idl
+++ b/src/3rdparty/webkit/WebCore/css/Rect.idl
@@ -19,11 +19,7 @@
 
 module css {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=696bc4d9-c1d3-4225-a5b3-2cef28967705,
-        ImplementationUUID=ae83743f-4dc4-4785-869b-8c3010c7d006
-    ] Rect {
+    interface Rect {
         readonly attribute CSSPrimitiveValue  top;
         readonly attribute CSSPrimitiveValue  right;
         readonly attribute CSSPrimitiveValue  bottom;
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
index 1f19983441..f184b1b50e 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
@@ -166,7 +166,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getSVGPropertyCSSValue(int pro
 
             return 0;
         }
-        case CSSPropertyWebkitShadow:
+        case CSSPropertyWebkitSvgShadow:
             return valueForShadow(svgStyle->shadow(), propertyID);
         case CSSPropertyMarker:
         case CSSPropertyEnableBackground:
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
index 8730e49a09..0986f1ceb3 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
@@ -257,7 +257,7 @@ bool CSSParser::parseSVGValue(int propId, bool important)
                 m_valueList->next();
         }
         break;
-    case CSSPropertyWebkitShadow:
+    case CSSPropertyWebkitSvgShadow:
         if (id == CSSValueNone)
             valid_primitive = true;
         else
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in b/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in
index 809eabec84..9f97146ffa 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in
@@ -47,4 +47,4 @@ kerning
 text-anchor
 writing-mode
 
--webkit-shadow
+-webkit-svg-shadow
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
index 7e4483f409..5651a0a9fa 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
@@ -10,8 +10,6 @@
              (C) 2004 Allan Sandfeld Jensen(kde@carewolf.com)
              (C) 2004 Germain Garand(germain@ebooksfrance.org)
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -527,7 +525,7 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
             // Silently ignoring this property for now
             // http://bugs.webkit.org/show_bug.cgi?id=6022
             break;
-        case CSSPropertyWebkitShadow: {
+        case CSSPropertyWebkitSvgShadow: {
             if (isInherit)
                 return svgstyle->setShadow(m_parentStyle->svgStyle()->shadow() ? new ShadowData(*m_parentStyle->svgStyle()->shadow()) : 0);
             if (isInitial || primitiveValue) // initial | none
@@ -536,19 +534,17 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
             if (!value->isValueList())
                 return;
 
-            float zoomFactor = m_style->effectiveZoom();
-
             CSSValueList *list = static_cast<CSSValueList*>(value);
             ASSERT(list->length() == 1);
             ShadowValue* item = static_cast<ShadowValue*>(list->itemWithoutBoundsCheck(0));
-            int x = item->x->computeLengthInt(style(), m_rootElementStyle, zoomFactor);
-            int y = item->y->computeLengthInt(style(), m_rootElementStyle, zoomFactor);
-            int blur = item->blur ? item->blur->computeLengthInt(style(), m_rootElementStyle, zoomFactor) : 0;
+            int x = item->x->computeLengthInt(style(), m_rootElementStyle);
+            int y = item->y->computeLengthInt(style(), m_rootElementStyle);
+            int blur = item->blur ? item->blur->computeLengthInt(style(), m_rootElementStyle) : 0;
             Color color;
             if (item->color)
                 color = getColorFromPrimitiveValue(item->color.get());
 
-            // -webkit-shadow does should not have a spread or style
+            // -webkit-svg-shadow does should not have a spread or style
             ASSERT(!item->spread);
             ASSERT(!item->style);
                 
@@ -566,5 +562,4 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
 
 }
 
-// vim:ts=4:noet
-#endif // ENABLE(SVG)
+#endif
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in b/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in
index 152a68f246..91fb57e0af 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in
@@ -183,7 +183,7 @@ new
 # CSS_PROP_STOP_OPACITY
 # CSS_PROP_COLOR_INTERPOLATION
 #auto
-sRGB
+#sRGB
 linearRGB
 
 # CSS_PROP_COLOR_INTERPOLATION_FILTERS
diff --git a/src/3rdparty/webkit/WebCore/css/ShadowValue.cpp b/src/3rdparty/webkit/WebCore/css/ShadowValue.cpp
index 27be86c117..060a322342 100644
--- a/src/3rdparty/webkit/WebCore/css/ShadowValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/ShadowValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2009 Apple Computer, Inc.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/StyleBase.cpp b/src/3rdparty/webkit/WebCore/css/StyleBase.cpp
index 8bfec5e5a4..93dbda0488 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleBase.cpp
+++ b/src/3rdparty/webkit/WebCore/css/StyleBase.cpp
@@ -56,9 +56,9 @@ KURL StyleBase::baseURL() const
     StyleSheet* sheet = const_cast<StyleBase*>(this)->stylesheet();
     if (!sheet)
         return KURL();
-    if (!sheet->href().isNull())
-        return KURL(ParsedURLString, sheet->href());
-    if (sheet->parent()) 
+    if (!sheet->finalURL().isNull())
+        return sheet->finalURL();
+    if (sheet->parent())
         return sheet->parent()->baseURL();
     if (!sheet->ownerNode()) 
         return KURL();
diff --git a/src/3rdparty/webkit/WebCore/css/StyleSheet.cpp b/src/3rdparty/webkit/WebCore/css/StyleSheet.cpp
index 16e6278297..4f20a20c7a 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/css/StyleSheet.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2006 Apple Computer, Inc.
  *
@@ -26,27 +24,29 @@
 
 namespace WebCore {
 
-StyleSheet::StyleSheet(StyleSheet* parentSheet, const String& href)
+StyleSheet::StyleSheet(StyleSheet* parentSheet, const String& originalURL, const KURL& finalURL)
     : StyleList(parentSheet)
     , m_parentNode(0)
-    , m_strHref(href)
+    , m_originalURL(originalURL)
+    , m_finalURL(finalURL)
     , m_disabled(false)
 {
 }
 
-
-StyleSheet::StyleSheet(Node* parentNode, const String& href)
+StyleSheet::StyleSheet(Node* parentNode, const String& originalURL, const KURL& finalURL)
     : StyleList(0)
     , m_parentNode(parentNode)
-    , m_strHref(href)
+    , m_originalURL(originalURL)
+    , m_finalURL(finalURL)
     , m_disabled(false)
 {
 }
 
-StyleSheet::StyleSheet(StyleBase* owner, const String& href)
+StyleSheet::StyleSheet(StyleBase* owner, const String& originalURL, const KURL& finalURL)
     : StyleList(owner)
     , m_parentNode(0)
-    , m_strHref(href)
+    , m_originalURL(originalURL)
+    , m_finalURL(finalURL)
     , m_disabled(false)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/css/StyleSheet.h b/src/3rdparty/webkit/WebCore/css/StyleSheet.h
index 016d50ad6d..621733def7 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/css/StyleSheet.h
@@ -41,8 +41,15 @@ public:
 
     Node* ownerNode() const { return m_parentNode; }
     StyleSheet *parentStyleSheet() const;
-    const String& href() const { return m_strHref; }
-    void setHref(const String& href) { m_strHref = href; }
+
+    // Note that href is the URL that started the redirect chain that led to
+    // this style sheet. This property probably isn't useful for much except
+    // the JavaScript binding (which needs to use this value for security).
+    const String& href() const { return m_originalURL; }
+
+    void setFinalURL(const KURL& finalURL) { m_finalURL = finalURL; }
+    const KURL& finalURL() const { return m_finalURL; }
+
     const String& title() const { return m_strTitle; }
     void setTitle(const String& s) { m_strTitle = s; }
     MediaList* media() const { return m_media.get(); }
@@ -58,15 +65,16 @@ public:
     virtual bool parseString(const String&, bool strict = true) = 0;
 
 protected:
-    StyleSheet(Node* ownerNode, const String& href);
-    StyleSheet(StyleSheet* parentSheet, const String& href);
-    StyleSheet(StyleBase* owner, const String& href);
+    StyleSheet(Node* ownerNode, const String& href, const KURL& finalURL);
+    StyleSheet(StyleSheet* parentSheet, const String& href, const KURL& finalURL);
+    StyleSheet(StyleBase* owner, const String& href, const KURL& finalURL);
 
 private:
     virtual bool isStyleSheet() const { return true; }
 
     Node* m_parentNode;
-    String m_strHref;
+    String m_originalURL;
+    KURL m_finalURL;
     String m_strTitle;
     RefPtr<MediaList> m_media;
     bool m_disabled;
diff --git a/src/3rdparty/webkit/WebCore/css/StyleSheet.idl b/src/3rdparty/webkit/WebCore/css/StyleSheet.idl
index e4f4090da6..4f5368900a 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleSheet.idl
+++ b/src/3rdparty/webkit/WebCore/css/StyleSheet.idl
@@ -24,10 +24,7 @@ module stylesheets {
     interface [
         CustomMarkFunction,
         CustomToJS,
-        GenerateConstructor,
-        Polymorphic,
-        InterfaceUUID=2bd2db5f-aaab-4422-96a0-e05455313f35,
-        ImplementationUUID=a8ca694d-71f2-4479-8c76-ee9c1c729b49
+        Polymorphic
     ] StyleSheet {
         readonly attribute [ConvertNullStringTo=Null] DOMString        type;
                  attribute boolean          disabled;
diff --git a/src/3rdparty/webkit/WebCore/css/StyleSheetList.cpp b/src/3rdparty/webkit/WebCore/css/StyleSheetList.cpp
index b9df810b37..2c90258731 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleSheetList.cpp
+++ b/src/3rdparty/webkit/WebCore/css/StyleSheetList.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/StyleSheetList.idl b/src/3rdparty/webkit/WebCore/css/StyleSheetList.idl
index 574d749b24..6cef99d2d6 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleSheetList.idl
+++ b/src/3rdparty/webkit/WebCore/css/StyleSheetList.idl
@@ -23,11 +23,8 @@ module stylesheets {
     // Introduced in DOM Level 2:
     interface [
         CustomMarkFunction,
-        GenerateConstructor,
         HasIndexGetter,
-        HasNameGetter,
-        InterfaceUUID=707da1d7-7c8f-42b1-bbbf-c009e429663f,
-        ImplementationUUID=5991ebaf-ce6c-42db-b1c8-fb34af8d5c76
+        HasNameGetter
     ] StyleSheetList {
         readonly attribute unsigned long    length;
         StyleSheet         item(in unsigned long index);
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframeRule.idl b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframeRule.idl
index a8dd9c3f11..f6eac7741d 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframeRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframeRule.idl
@@ -29,11 +29,7 @@
 module css {
 
     // Introduced in DOM Level ?:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=87b7cde8-5818-4f68-b554-5382e6d9428c,
-        ImplementationUUID=b000d468-bb7a-4866-8946-5dea8b6a3c13
-    ] WebKitCSSKeyframeRule : CSSRule {
+    interface WebKitCSSKeyframeRule : CSSRule {
 
         attribute DOMString keyText;
         readonly attribute CSSStyleDeclaration style;
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.cpp b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.cpp
index 440d7a2c2c..23f9f34af9 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.cpp
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.cpp
@@ -108,8 +108,16 @@ WebKitCSSKeyframeRule* WebKitCSSKeyframesRule::findRule(const String& s)
 
 int WebKitCSSKeyframesRule::findRuleIndex(const String& key) const
 {
+    String percentageString;
+    if (equalIgnoringCase(key, "from"))
+        percentageString = "0%";
+    else if (equalIgnoringCase(key, "to"))
+        percentageString = "100%";
+    else
+        percentageString = key;
+
     for (unsigned i = 0; i < length(); ++i) {
-        if (item(i)->keyText() == key)
+        if (item(i)->keyText() == percentageString)
             return i;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.h b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.h
index 8c76b61328..f58406f10e 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.h
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.h
@@ -64,7 +64,7 @@ public:
     // themselves, or know that it will get called later.
     void setNameInternal(const String& name)
     {   
-        m_name = name;
+        m_name = AtomicString(name);
     }
 
     CSSRuleList* cssRules() { return m_lstCSSRules.get(); }
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.idl b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.idl
index 2b64be1e64..c40aff9517 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.idl
@@ -30,10 +30,7 @@ module css {
 
     // Introduced in DOM Level ?:
     interface [
-        GenerateConstructor,
-        HasIndexGetter,
-        InterfaceUUID=49f5644a-5dbb-4e31-ac6b-9446ae3895c9,
-        ImplementationUUID=a7c78aaa-5883-4ef2-a8bd-f2f1a1fd025a
+        HasIndexGetter
     ] WebKitCSSKeyframesRule : CSSRule {
 
         attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString name;
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.idl b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.idl
index 6b22da1329..9d6c897834 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.idl
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.idl
@@ -26,7 +26,7 @@
 module css {
 
     // Introduced in DOM Level ?:
-    interface WebKitCSSMatrix {
+    interface [CustomConstructor] WebKitCSSMatrix {
 
         // These attributes are simple aliases for certain elements of the 4x4 matrix
         attribute double a; // alias for m11
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl
index 14a373fbd0..087aa82e65 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl
@@ -29,10 +29,7 @@
 module css {
 
     interface [
-            GenerateConstructor,
             HasIndexGetter
-            InterfaceUUID=303fe632-5dcf-4472-b977-33a5481e1d12,
-            ImplementationUUID=eb49e5c6-6075-45b8-b5c4-7e775c01e7c4
     ] WebKitCSSTransformValue : CSSValueList {
 
         // OperationTypes
diff --git a/src/3rdparty/webkit/WebCore/css/html.css b/src/3rdparty/webkit/WebCore/css/html.css
index 095fab3adf..d036be085a 100644
--- a/src/3rdparty/webkit/WebCore/css/html.css
+++ b/src/3rdparty/webkit/WebCore/css/html.css
@@ -72,7 +72,7 @@ layer {
     display: block
 }
 
-nav {
+article, aside, footer, header, hgroup, nav, section {
     display: block
 }
 
@@ -359,6 +359,17 @@ input::-webkit-input-list-button {
     display: inline-block;
 }
 
+input::-webkit-inner-spin-button {
+    -webkit-appearance: inner-spin-button;
+    display: inline-block;
+}
+
+input::-webkit-outer-spin-button {
+    -webkit-appearance: outer-spin-button;
+    display: inline-block;
+    margin-left: 2px;
+}
+
 textarea {
     -webkit-appearance: textarea;
     background-color: white;
@@ -504,6 +515,19 @@ option {
     font-weight: normal;
 }
 
+/* progress */
+
+progress {
+    -webkit-appearance: progress-bar;
+    padding: initial;
+    border: initial;
+    margin: 2px;
+}
+
+progress::-webkit-progress-bar {
+    -webkit-appearance: progress-bar;
+}
+
 /* datagrid */
 
 datagrid {
@@ -607,6 +631,23 @@ a:-webkit-any-link:active {
     color: -webkit-activelink
 }
 
+/* HTML5 ruby elements */
+
+ruby, rt {
+    text-indent: 0; /* blocks used for ruby rendering should not trigger this */
+    line-height: normal;
+}
+
+ruby > rt {
+    display: block;
+    font-size: 60%; /* make slightly larger than 50% for better readability */
+    text-align: center;
+}
+
+ruby > rp {
+    display: none;
+}
+
 /* other elements */
 
 noframes {
diff --git a/src/3rdparty/webkit/WebCore/css/make-css-file-arrays.pl b/src/3rdparty/webkit/WebCore/css/make-css-file-arrays.pl
index 05c8fd17c7..9ffeaa7ca8 100755
--- a/src/3rdparty/webkit/WebCore/css/make-css-file-arrays.pl
+++ b/src/3rdparty/webkit/WebCore/css/make-css-file-arrays.pl
@@ -28,7 +28,14 @@ my $preprocessor;
 GetOptions('preprocessor=s' => \$preprocessor);
 
 if (!$preprocessor) {
-    $preprocessor = "/usr/bin/gcc -E -P -x c++";
+    require Config;
+    my $gccLocation = "";
+    if (($Config::Config{'osname'}) =~ /solaris/i) {
+        $gccLocation = "/usr/sfw/bin/gcc";
+    } else {
+        $gccLocation = "/usr/bin/gcc";
+    }
+    $preprocessor = $gccLocation . " -E -P -x c++";
 }
 
 my $header = $ARGV[0];
diff --git a/src/3rdparty/webkit/WebCore/css/maketokenizer b/src/3rdparty/webkit/WebCore/css/maketokenizer
index efac3c6a5a..90d5fcbf21 100644
--- a/src/3rdparty/webkit/WebCore/css/maketokenizer
+++ b/src/3rdparty/webkit/WebCore/css/maketokenizer
@@ -1,7 +1,5 @@
 print <<END;
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2003 Lars Knoll (knoll\@kde.org)
  *
  *
diff --git a/src/3rdparty/webkit/WebCore/css/mathml.css b/src/3rdparty/webkit/WebCore/css/mathml.css
index e725d8c295..8b4da3e0d5 100644
--- a/src/3rdparty/webkit/WebCore/css/mathml.css
+++ b/src/3rdparty/webkit/WebCore/css/mathml.css
@@ -1,91 +1,116 @@
 @namespace "http://www.w3.org/1998/Math/MathML";
 
-/* approved */
 math {
-    font-family: Symbol, STIXGeneral, "Times New Roman";
+    font-family: Symbol, "Times New Roman";
     display: inline-block;
     padding: 0px;
     margin: 0px;
-    text-indent: 0;
-    font-size: 1.1em;
     vertical-align: baseline;
+    line-height: 1.0;
 }
+
 math[display="block"] {
-    font-family: "New Times Roman"
     display: block;
     text-align: center;
     page-break-inside: avoid;
+    margin-bottom: 1em;
+}
+
+math > * {
+    vertical-align: baseline;
+}
+
+mrow, mfenced {
+    display: inline-block;
+    white-space: nowrap;
+    vertical-align: middle;
+}
+
+mrow > mo, mfenced > mo, math > mo
+{
+    vertical-align: middle;
+}
+
+mi, mtext {
+    font-style: italic;
+    padding-right: 0.1em;
+}
+
+mi + mrow {
+    margin-left: 0.1em;
 }
 
 mfrac {
+    display: inline-block;
     vertical-align: middle;
 }
 
 msub, msup {
-   display: inline-block;
+    display: inline-block;
+    vertical-align: baseline;
 }
 
 msub > * + * {
-   vertical-align: sub;
-   font-size: 0.75em;
-   line-height: 0.75em;
+    vertical-align: sub;
+    font-size: 0.75em;
 }
 
 msup > * + * {
-   vertical-align: super;
-   font-size: 0.75em;
-   line-height: 0.75em;
+    vertical-align: super;
+    font-size: 0.75em;
+}
+
+msubsup {
+    display: inline-block;
+    vertical-align: baseline;
 }
 
 msubsup > * {
     margin: 0px;
     padding: 0px;
-    vertical-align: middle;
 }
 
 msubsup > * + * {
-   font-size: 0.75em;
-   line-height: 0.75em;
+    font-size: 0.75em;
 }
 
-munderover {
-    vertical-align: middle;
+munder, mover, munderover {
+    display: inline-block;
+    vertical-align: baseline;
 }
 
 munderover > * + *, mover > * + *, munder > * + * {
-   font-size: 0.75em;
-   line-height: 0.5625em;
+    font-size: 0.75em;
 }
 
-mrow {
-    line-height: 1em;
-    white-space: nowrap;
-    vertical-align: middle;
+mover > mi {
+    text-align: center;
 }
 
-mfenced > * {
-    vertical-align: middle;
+mo, mn, mi, mtext {
+    padding: 0px;
+    margin: 0px;
+}
+
+mo {
+    display: inline-block;
 }
 
-mo, mn, mi {
-   line-height: 0.75em;
-   padding: 0px;
-   margin: 0px;
+mo {
+    padding-left: 0.05em;
+    padding-right: 0.05em;
 }
 
 mo[mathsize="small"], mn[mathsize="small"], mi[mathsize="small"] {
-   font-size: 0.75em;
-   line-height: 0.5625em;
+    font-size: 0.75em;
 }
 
 mo[mathsize="normal"],mn[mathsize="normal"],mi[mathsize="normal"] {
-   font-size: 1em;
-   line-height: 0.75em;
+    font-size: 1em;
 }
 
 mo[mathsize="big"], mn[mathsize="big"], mi[mathsize="big"] {
-   line-height: 1.2em;
-   font-size: 1.5em;
+    font-size: 1.5em;
 }
  
 annotation, annotation-xml {
@@ -100,25 +125,25 @@ merror {
 }
 
 msqrt {
+    display: inline-block;
     padding-top: 0.2em;
     padding-left: 0.75em;
 }
 
 mroot {
+    display: inline-block;
     padding-top: 0.2em;
     padding-left: 0.2em;
 }
 
 mroot > * + * {
     font-size: 0.75em;
-    line-height: 0.75em;
     vertical-align: top;
     padding-right: 0.3em;
 }
 
 mtable {
     display: inline-table;
-    line-height: 1.5em;
     text-align: center;
     vertical-align: middle;
 }
@@ -168,3 +193,6 @@ mtable[columnlines="dashed"] > mtr > mtd + mtd {
     border-left: dashed thin;
 }
 
+mspace[linebreak="newline"] {
+    display: block;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControls.css b/src/3rdparty/webkit/WebCore/css/mediaControls.css
index d0ec90d6d2..de2c2fe001 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControls.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControls.css
@@ -124,3 +124,10 @@ audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewin
 audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button {
     display: none;
 }
+
+audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button {
+    -webkit-appearance: media-toggle-closed-captions-button;
+    display: -webkit-box;
+    width: 16px;
+    height: 16px;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsGtk.css b/src/3rdparty/webkit/WebCore/css/mediaControlsGtk.css
new file mode 100644
index 0000000000..cc6da14296
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsGtk.css
@@ -0,0 +1,65 @@
+/*
+ * WebKitGTK+ specific overrides for HTML5 media elements.
+ *
+ * Copyright (C) 2009 Zan Dobersek <zandobersek@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+audio {
+    height: 20px;
+    width: 300px;
+}
+
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    height: 20px;
+}
+
+audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
+    width: 20px;
+    height: 20px;
+}
+
+audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
+    width: 20px;
+    height: 20px;
+}
+
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    height: 20px;
+    border-left: 1px solid rgba(255, 255, 255, 0.2);
+    border-right: 1px solid rgba(255, 255, 255, 0.2);
+}
+
+audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
+    height: 20px;
+}
+
+audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
+    width: 20px;
+    height: 20px;
+}
+
+audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
+    width: 20px;
+    height: 20px;
+}
+
+audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
+    width: 20px;
+    height: 20px;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsQt.css b/src/3rdparty/webkit/WebCore/css/mediaControlsQt.css
index a9c3609f07..d49fe9620b 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControlsQt.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsQt.css
@@ -51,8 +51,6 @@ video:-webkit-full-page-media::-webkit-media-controls-panel {
 }
 
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
-    left: auto;
-    right: 5px;
     width: 12px;
     height: 12px;
     padding: 6px;
@@ -60,7 +58,6 @@ audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-bu
 }
 
 audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
-    left: 5px;
     width: 9px;
     height: 12px;
     padding: 6px 12px 6px 11px;
@@ -72,7 +69,21 @@ audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-
 }
 
 audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
-    display: none;
+    -webkit-appearance: media-current-time-display;
+    -webkit-user-select: none;
+    display: inline-block;
+    height: 12px;
+    padding: 6px;
+    margin: 5px 3px;
+
+    overflow: hidden;
+    cursor: default;
+
+    text-align: center;
+    font-size: 10px;
+    font-family: Verdana;
+    font-weight: bold;
+    color: white;
 }
 
 audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
@@ -80,51 +91,38 @@ audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-contr
 }
 
 audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
-    left: 42px;
-    right: 34px;
     height: 12px;
     padding: 6px 8px;
-    margin: 5px 0px;
+    margin: 5px 3px;
 }
 
 audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
-    display: none;
+    -webkit-appearance: media-volume-slider-container;
+    position: absolute;
+    height: 103px;
+    width: 24px;
 }
 
 audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
-    display: none;
+    -webkit-appearance: media-volume-slider;
+    display: inline;
+    position: absolute;
+
+    width: 12px;
+    padding: 6px;
+    height: 88px;
+    margin: 0 0 3px 0;
 }
 
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
-    /* Since MediaControlElements are always created with a renderer we have to hide
-       the controls we don't use, so they don't mess up activation and event handling */
-    left: 0px;
-    top: 0px;
-    width: 0px;
-    height: 0px;
-
     display: none;
 }
 
 audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
-    /* Since MediaControlElements are always created with a renderer we have to hide
-       the controls we don't use, so they don't mess up activation and event handling */
-    left: 0px;
-    top: 0px;
-    width: 0px;
-    height: 0px;
-
     display: none;
 }
 
 audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
-    /* Since MediaControlElements are always created with a renderer we have to hide
-       the controls we don't use, so they don't mess up activation and event handling */
-    left: 0px;
-    top: 0px;
-    width: 0px;
-    height: 0px;
-
     display: none;
 }
 
@@ -136,3 +134,7 @@ audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-co
     display: none;
 }
 
+audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button {
+    display: none;
+}
+
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsQuickTime.css b/src/3rdparty/webkit/WebCore/css/mediaControlsQuickTime.css
index 5cf48ae636..965685de2c 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControlsQuickTime.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsQuickTime.css
@@ -132,7 +132,7 @@ audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-f
     height: 16px;
     margin-left: 7px;
     margin-right: 7px;
-    -webkit-box-ordinal-group: 3; /* At the very end */
+    -webkit-box-ordinal-group: 4; /* At the very end */
 }
 
 audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button {
@@ -175,3 +175,13 @@ audio::-webkit-media-controls-status-display, video::-webkit-media-controls-stat
     text-indent: 0;
     text-decoration: none;
 }
+
+audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button {
+    -webkit-appearance: media-toggle-closed-captions-button;
+    display: -webkit-box;
+    width: 16px;
+    height: 16px;
+    margin-left: 7px;
+    margin-right: 7px;
+    -webkit-box-ordinal-group: 3; /* between mute and fullscreen */
+}
diff --git a/src/3rdparty/webkit/WebCore/css/svg.css b/src/3rdparty/webkit/WebCore/css/svg.css
index 322eda8341..171c1c41fb 100644
--- a/src/3rdparty/webkit/WebCore/css/svg.css
+++ b/src/3rdparty/webkit/WebCore/css/svg.css
@@ -32,9 +32,18 @@
     which does not use CSS layout [CSS2-LAYOUT] or XSL formatting [XSL], the 'overflow' property on the 
     outermost 'svg' element is ignored for the purposes of visual rendering and the initial clipping path is set 
     to the bounds of the initial viewport.
+
+    When an outermost 'svg' element is embedded inline within a parent XML grammar which uses CSS layout
+    [CSS2-LAYOUT] or XSL formatting [XSL], if the 'overflow' property has the value hidden or scroll, then
+    the user agent will establish an initial clipping path equal to the bounds of the initial viewport; otherwise,
+    the initial clipping path is set according to the clipping rules as defined in [CSS2-overflow].
+
+    Opera/Firefox & WebKit agreed on NOT setting "overflow: hidden" for the outermost svg element - SVG 1.1 Errata
+    contains these changes as well as all future SVG specifications: see http://lists.w3.org/Archives/Public/public-svg-wg/2008JulSep/0347.html
 */
-svg:root {
-    overflow: hidden !important
+
+svg:not(:root), symbol, image, marker, pattern, foreignObject {
+    overflow: hidden
 }
 
 svg {
@@ -42,10 +51,6 @@ svg {
     height: 100%;
 }
 
-svg, symbol, marker, pattern {
-    overflow: hidden
-}
-
 text, foreignObject {
     display: block
 }
diff --git a/src/3rdparty/webkit/WebCore/css/themeQtMaemo5.css b/src/3rdparty/webkit/WebCore/css/themeQtMaemo5.css
new file mode 100644
index 0000000000..c568d5dcee
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/themeQtMaemo5.css
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+input[type="button"],
+input[type="submit"],
+input[type="reset"],
+input[type="file"]::-webkit-file-upload-button, button,
+select {
+    padding: 2px 18px 3px 18px;
+    border: 1px solid black;
+    -webkit-border-radius:5px;
+    background-color: ButtonFace;
+}
+
+input[type="button"]:disabled,
+input[type="submit"]:disabled,
+input[type="reset"]:disabled,
+input[type="file"]:disabled::-webkit-file-upload-button,
+button:disabled,
+select:disabled {
+    border: 1px solid gray;
+}
+
+input[type="button"]:active,
+input[type="submit"]:active,
+input[type="reset"]:active,
+input[type="file"]:active::-webkit-file-upload-button,
+button:active,
+select:active{
+    background-color: ButtonShadow;
+}
+
+input[type="button"]:active:disabled,
+input[type="submit"]:active:disabled,
+input[type="reset"]:active:disabled,
+input[type="file"]:active:disabled::-webkit-file-upload-button,
+button:active:disabled,
+select:active:disabled {
+    border: 1px solid gray;
+}
+
+input:not([type]),
+input[type="text"],
+input[type="password"],
+textarea {
+    border: 1px solid black;
+}
+
+input:not([type]):disabled,
+input[type="text"]:disabled,
+input[type="password"]:disabled,
+textarea:disabled {
+    border: 1px solid grey;
+    background-color:ButtonHighlight;
+}
+
+input:not([type]):active,
+input[type="text"]:active,
+input[type="password"]:active,
+textarea:active {
+    background-color:ButtonShadow;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/themeQtNoListboxes.css b/src/3rdparty/webkit/WebCore/css/themeQtNoListboxes.css
new file mode 100644
index 0000000000..4c5e44ad71
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/themeQtNoListboxes.css
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+select[size],
+select[multiple],
+select[size][multiple] {
+    -webkit-appearance: menulist;
+    -webkit-box-align: center;
+    border: 1px solid;
+    -webkit-border-radius: 5px;
+    white-space: pre;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/tokenizer.flex b/src/3rdparty/webkit/WebCore/css/tokenizer.flex
index 1569ee205e..3af725ccf5 100644
--- a/src/3rdparty/webkit/WebCore/css/tokenizer.flex
+++ b/src/3rdparty/webkit/WebCore/css/tokenizer.flex
@@ -24,13 +24,13 @@ url             ([!#$%&*-~]|{nonascii}|{escape})*
 w               [ \t\r\n\f]*
 nl              \n|\r\n|\r|\f
 range           \?{1,6}|{h}(\?{0,5}|{h}(\?{0,4}|{h}(\?{0,3}|{h}(\?{0,2}|{h}(\??|{h})))))
-nth             (-?[0-9]*n[\+-][0-9]+)|(-?[0-9]*n)
+nth             [\+-]?{intnum}*n([\+-]{intnum})?
 
 %%
 
-\/\*[^*]*\*+([^/*][^*]*\*+)*\/  /* ignore comments */
+\/\*[^*]*\*+([^/*][^*]*\*+)*\/ {countLines(); /* ignore comments */ }
 
-[ \t\r\n\f]+            {yyTok = WHITESPACE; return yyTok;}
+[ \t\r\n\f]+            {countLines(); yyTok = WHITESPACE; return yyTok;}
 
 "<!--"                  {yyTok = SGML_CD; return yyTok;}
 "-->"                   {yyTok = SGML_CD; return yyTok;}
diff --git a/src/3rdparty/webkit/WebCore/css/view-source.css b/src/3rdparty/webkit/WebCore/css/view-source.css
index f898565495..60467b9dd1 100644
--- a/src/3rdparty/webkit/WebCore/css/view-source.css
+++ b/src/3rdparty/webkit/WebCore/css/view-source.css
@@ -130,7 +130,7 @@ td {
     -webkit-border-fit: lines;
     min-height: 13px;
     font-size: 9px;
-    font-family: Lucida Grande;
+    font-family: Lucida Grande, sans-serif;
     font-weight: bold;
     margin: 6px 25px;
     padding: 0 7px 1px;
diff --git a/src/3rdparty/webkit/WebCore/dom/Attr.cpp b/src/3rdparty/webkit/WebCore/dom/Attr.cpp
index aa5916bb66..2ef5f9bed0 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attr.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Attr.cpp
@@ -27,9 +27,12 @@
 #include "Element.h"
 #include "ExceptionCode.h"
 #include "Text.h"
+#include "XMLNSNames.h"
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 inline Attr::Attr(Element* element, Document* document, PassRefPtr<Attribute> attribute)
     : ContainerNode(document)
     , m_element(element)
@@ -100,7 +103,13 @@ void Attr::setPrefix(const AtomicString& prefix, ExceptionCode& ec)
     if (ec)
         return;
 
-    m_attribute->setPrefix(prefix);
+    if ((prefix == xmlnsAtom && namespaceURI() != XMLNSNames::xmlnsNamespaceURI)
+        || static_cast<Attr*>(this)->qualifiedName() == xmlnsAtom) {
+        ec = NAMESPACE_ERR;
+        return;
+    }
+
+    m_attribute->setPrefix(prefix.isEmpty() ? AtomicString() : prefix);
 }
 
 String Attr::nodeValue() const
@@ -164,4 +173,9 @@ void Attr::childrenChanged(bool changedByParser, Node* beforeChange, Node* after
         m_element->attributeChanged(m_attribute.get());
 }
 
+bool Attr::isId() const
+{
+    return qualifiedName().matches(m_element ? m_element->idAttributeName() : idAttr);
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Attr.h b/src/3rdparty/webkit/WebCore/dom/Attr.h
index e927a6e182..2e02a02742 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attr.h
+++ b/src/3rdparty/webkit/WebCore/dom/Attr.h
@@ -52,6 +52,8 @@ public:
     Attribute* attr() const { return m_attribute.get(); }
     const QualifiedName& qualifiedName() const { return m_attribute->name(); }
 
+    bool isId() const;
+
     // An extension to get presentational information for attributes.
     CSSStyleDeclaration* style() { return m_attribute->style(); }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Attr.idl b/src/3rdparty/webkit/WebCore/dom/Attr.idl
index c01f34a4d2..af8447845f 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attr.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Attr.idl
@@ -22,10 +22,7 @@ module core {
 
     interface [
         CustomMarkFunction,
-        GenerateConstructor,
-        GenerateNativeConverter,
-        InterfaceUUID=EEE8E22B-22C3-4e50-95F4-5E0B8AAD8231,
-        ImplementationUUID=41B16348-D8E7-4d21-BFDB-125705B7E91F
+        GenerateNativeConverter
     ] Attr : Node {
 
         // DOM Level 1
@@ -38,11 +35,13 @@ module core {
         // DOM Level 2
 
         readonly attribute Element ownerElement;
-        
+
+        // DOM Level 3
+
+        readonly attribute boolean isId;
+
         // extensions
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute CSSStyleDeclaration style;
-#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.idl b/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.idl
index d06a39d291..9c8b7e5036 100644
--- a/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.idl
@@ -26,9 +26,7 @@
 
 module events {
 
-    interface [
-        GenerateConstructor
-    ] BeforeLoadEvent : Event {
+    interface BeforeLoadEvent : Event {
         void initBeforeLoadEvent(in DOMString type,
                                  in boolean canBubble, 
                                  in boolean cancelable,
diff --git a/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.cpp b/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.cpp
index 2521aa1885..97d7f97490 100644
--- a/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
diff --git a/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.h b/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.h
index 39c96fdf92..2644693db4 100644
--- a/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
diff --git a/src/3rdparty/webkit/WebCore/dom/CDATASection.idl b/src/3rdparty/webkit/WebCore/dom/CDATASection.idl
index 7c6c1e6bcb..70a4f55803 100644
--- a/src/3rdparty/webkit/WebCore/dom/CDATASection.idl
+++ b/src/3rdparty/webkit/WebCore/dom/CDATASection.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=DC8E30FD-42DD-4a12-9B74-78D634321B41,
-        ImplementationUUID=10A5D70C-D93E-409c-A6BA-9D7CB4E3D06A
-    ] CDATASection : Text {
+    interface CDATASection : Text {
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/CSSMappedAttributeDeclaration.cpp b/src/3rdparty/webkit/WebCore/dom/CSSMappedAttributeDeclaration.cpp
index 7fe0915193..9ee6474555 100644
--- a/src/3rdparty/webkit/WebCore/dom/CSSMappedAttributeDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/CSSMappedAttributeDeclaration.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
diff --git a/src/3rdparty/webkit/WebCore/dom/CanvasSurface.cpp b/src/3rdparty/webkit/WebCore/dom/CanvasSurface.cpp
new file mode 100644
index 0000000000..69c795139e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/CanvasSurface.cpp
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CanvasSurface.h"
+
+namespace WebCore {
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.idl b/src/3rdparty/webkit/WebCore/dom/CanvasSurface.h
index 63b2dcd6bc..118db8f306 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.idl
+++ b/src/3rdparty/webkit/WebCore/dom/CanvasSurface.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,13 +20,22 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-module html {
-    interface [Conditional=3D_CANVAS, CustomToJS] CanvasArray {
-        readonly attribute long length;
-        int sizeInBytes();
-        int alignedSizeInBytes();
-    };
-}
+#ifndef CanvasSurface_h
+#define CanvasSurface_h
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class CanvasSurface : public Noncopyable {
+public:
+
+private:
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/dom/CharacterData.idl b/src/3rdparty/webkit/WebCore/dom/CharacterData.idl
index 7c8c7acca3..4ddd782974 100644
--- a/src/3rdparty/webkit/WebCore/dom/CharacterData.idl
+++ b/src/3rdparty/webkit/WebCore/dom/CharacterData.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=149159F4-D2BA-4040-8137-6BF6424C972A,
-        ImplementationUUID=E2095280-B9BD-446a-8C03-79F78417CDFF
-    ] CharacterData : Node {
+    interface CharacterData : Node {
 
         attribute [ConvertNullToNullString] DOMString data
             setter raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.cpp b/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.cpp
index 9883f5843e..3cf88489f5 100644
--- a/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.cpp
@@ -60,6 +60,8 @@ HTMLInputElement* CheckedRadioButtons::checkedButtonForGroup(const AtomicString&
 {
     if (!m_nameToCheckedRadioButtonMap)
         return 0;
+
+    m_nameToCheckedRadioButtonMap->checkConsistency();
     
     return m_nameToCheckedRadioButtonMap->get(name.impl());
 }
@@ -69,6 +71,8 @@ void CheckedRadioButtons::removeButton(HTMLFormControlElement* element)
     if (element->name().isEmpty() || !m_nameToCheckedRadioButtonMap)
         return;
     
+    m_nameToCheckedRadioButtonMap->checkConsistency();
+
     NameToInputMap::iterator it = m_nameToCheckedRadioButtonMap->find(element->name().impl());
     if (it == m_nameToCheckedRadioButtonMap->end() || it->second != element)
         return;
diff --git a/src/3rdparty/webkit/WebCore/dom/ClassNodeList.h b/src/3rdparty/webkit/WebCore/dom/ClassNodeList.h
index d40ee1994c..c519b3e53b 100644
--- a/src/3rdparty/webkit/WebCore/dom/ClassNodeList.h
+++ b/src/3rdparty/webkit/WebCore/dom/ClassNodeList.h
@@ -30,8 +30,8 @@
 #ifndef ClassNodeList_h
 #define ClassNodeList_h
 
-#include "ClassNames.h"
 #include "DynamicNodeList.h"
+#include "SpaceSplitString.h"
 
 namespace WebCore {
 
@@ -47,7 +47,7 @@ namespace WebCore {
 
         virtual bool nodeMatches(Element*) const;
 
-        ClassNames m_classNames;
+        SpaceSplitString m_classNames;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/ClientRect.idl b/src/3rdparty/webkit/WebCore/dom/ClientRect.idl
index 6f0598f135..7dbdd6898a 100644
--- a/src/3rdparty/webkit/WebCore/dom/ClientRect.idl
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRect.idl
@@ -26,9 +26,7 @@
 
 module view {
 
-    interface [
-        GenerateConstructor
-    ] ClientRect {
+    interface ClientRect {
         readonly attribute float top;
         readonly attribute float right;
         readonly attribute float bottom;
diff --git a/src/3rdparty/webkit/WebCore/dom/ClientRectList.idl b/src/3rdparty/webkit/WebCore/dom/ClientRectList.idl
index 8230f6c699..63724181d4 100644
--- a/src/3rdparty/webkit/WebCore/dom/ClientRectList.idl
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRectList.idl
@@ -27,7 +27,6 @@
 module view {
 
     interface [
-        GenerateConstructor,
         HasIndexGetter
     ] ClientRectList {
         readonly attribute unsigned long length;
diff --git a/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp b/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp
index 6d1bc152d5..bb9a0cb88f 100644
--- a/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp
@@ -27,7 +27,6 @@
 #include "Clipboard.h"
 
 #include "CachedImage.h"
-#include "DOMImplementation.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "Image.h"
@@ -35,7 +34,9 @@
 namespace WebCore {
 
 Clipboard::Clipboard(ClipboardAccessPolicy policy, bool isForDragging) 
-    : m_policy(policy) 
+    : m_policy(policy)
+    , m_dropEffect("uninitialized")
+    , m_effectAllowed("uninitialized")
     , m_dragStarted(false)
     , m_forDragging(isForDragging)
     , m_dragImage(0)
@@ -55,6 +56,8 @@ void Clipboard::setAccessPolicy(ClipboardAccessPolicy policy)
 static DragOperation dragOpFromIEOp(const String& op)
 {
     // yep, it's really just this fixed set
+    if (op == "uninitialized")
+        return DragOperationEvery;
     if (op == "none")
         return DragOperationNone;
     if (op == "copy")
@@ -62,7 +65,7 @@ static DragOperation dragOpFromIEOp(const String& op)
     if (op == "link")
         return DragOperationLink;
     if (op == "move")
-        return DragOperationGeneric;
+        return DragOperationGeneric;    // FIXME: Why is this DragOperationGeneric? <http://webkit.org/b/33697>
     if (op == "copyLink")
         return (DragOperation)(DragOperationCopy | DragOperationLink);
     if (op == "copyMove")
@@ -96,29 +99,29 @@ static String IEOpFromDragOp(DragOperation op)
     return "none";
 }
 
-bool Clipboard::sourceOperation(DragOperation& op) const
+DragOperation Clipboard::sourceOperation() const
 {
-    if (m_effectAllowed.isNull())
-        return false;
-    op = dragOpFromIEOp(m_effectAllowed);
-    return true;
+    DragOperation op = dragOpFromIEOp(m_effectAllowed);
+    ASSERT(op != DragOperationPrivate);
+    return op;
 }
 
-bool Clipboard::destinationOperation(DragOperation& op) const
+DragOperation Clipboard::destinationOperation() const
 {
-    if (m_dropEffect.isNull())
-        return false;
-    op = dragOpFromIEOp(m_dropEffect);
-    return true;
+    DragOperation op = dragOpFromIEOp(m_dropEffect);
+    ASSERT(op == DragOperationCopy || op == DragOperationNone || op == DragOperationLink || op == DragOperationGeneric || op == DragOperationMove || op == DragOperationEvery);
+    return op;
 }
 
 void Clipboard::setSourceOperation(DragOperation op)
 {
+    ASSERT_ARG(op, op != DragOperationPrivate);
     m_effectAllowed = IEOpFromDragOp(op);
 }
 
 void Clipboard::setDestinationOperation(DragOperation op)
 {
+    ASSERT_ARG(op, op == DragOperationCopy || op == DragOperationNone || op == DragOperationLink || op == DragOperationGeneric || op == DragOperationMove);
     m_dropEffect = IEOpFromDragOp(op);
 }
 
@@ -127,6 +130,10 @@ void Clipboard::setDropEffect(const String &effect)
     if (!m_forDragging)
         return;
 
+    // The attribute must ignore any attempts to set it to a value other than none, copy, link, and move. 
+    if (effect != "none" && effect != "copy"  && effect != "link" && effect != "move")
+        return;
+
     if (m_policy == ClipboardReadable || m_policy == ClipboardTypesReadable)
         m_dropEffect = effect;
 }
@@ -136,6 +143,17 @@ void Clipboard::setEffectAllowed(const String &effect)
     if (!m_forDragging)
         return;
 
+    if (dragOpFromIEOp(effect) == DragOperationPrivate) {
+        // This means that there was no conversion, and the effectAllowed that
+        // we are passed isn't a valid effectAllowed, so we should ignore it,
+        // and not set m_effectAllowed.
+
+        // The attribute must ignore any attempts to set it to a value other than 
+        // none, copy, copyLink, copyMove, link, linkMove, move, all, and uninitialized.
+        return;
+    }
+
+
     if (m_policy == ClipboardWritable)
         m_effectAllowed = effect;
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Clipboard.h b/src/3rdparty/webkit/WebCore/dom/Clipboard.h
index f6c09b2036..4018e4f935 100644
--- a/src/3rdparty/webkit/WebCore/dom/Clipboard.h
+++ b/src/3rdparty/webkit/WebCore/dom/Clipboard.h
@@ -43,8 +43,9 @@ namespace WebCore {
         // Is this operation a drag-drop or a copy-paste?
         bool isForDragging() const { return m_forDragging; }
 
-        String dropEffect() const { return m_dropEffect; }
+        String dropEffect() const { return dropEffectIsUninitialized() ? "none" : m_dropEffect; }
         void setDropEffect(const String&);
+        bool dropEffectIsUninitialized() const { return m_dropEffect == "uninitialized"; }
         String effectAllowed() const { return m_effectAllowed; }
         void setEffectAllowed(const String&);
     
@@ -69,13 +70,14 @@ namespace WebCore {
 #endif
         virtual void writeURL(const KURL&, const String&, Frame*) = 0;
         virtual void writeRange(Range*, Frame*) = 0;
+        virtual void writePlainText(const String&) = 0;
 
         virtual bool hasData() = 0;
         
         void setAccessPolicy(ClipboardAccessPolicy);
 
-        bool sourceOperation(DragOperation&) const;
-        bool destinationOperation(DragOperation&) const;
+        DragOperation sourceOperation() const;
+        DragOperation destinationOperation() const;
         void setSourceOperation(DragOperation);
         void setDestinationOperation(DragOperation);
         
diff --git a/src/3rdparty/webkit/WebCore/dom/Clipboard.idl b/src/3rdparty/webkit/WebCore/dom/Clipboard.idl
index dc8677e87d..6509677308 100644
--- a/src/3rdparty/webkit/WebCore/dom/Clipboard.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Clipboard.idl
@@ -28,9 +28,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor
-    ] Clipboard {
+    interface Clipboard {
                  attribute [ConvertNullStringTo=Undefined] DOMString dropEffect;
                  attribute [ConvertNullStringTo=Undefined] DOMString effectAllowed;
         readonly attribute [CustomGetter] Array types;
diff --git a/src/3rdparty/webkit/WebCore/dom/Comment.idl b/src/3rdparty/webkit/WebCore/dom/Comment.idl
index a89f0e7fda..b9f4e319ea 100644
--- a/src/3rdparty/webkit/WebCore/dom/Comment.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Comment.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=5D16069F-7E6B-4b28-8647-C36B2ED81ED1,
-        ImplementationUUID=CB55DB55-411F-451f-97C6-284B99E77F8E
-    ] Comment : CharacterData {
+    interface Comment : CharacterData {
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp b/src/3rdparty/webkit/WebCore/dom/CompositionEvent.cpp
index 21af0a616c..508d5e6bec 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/CompositionEvent.cpp
@@ -9,7 +9,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- *
+ * 
  * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
@@ -21,30 +21,43 @@
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
  */
 
 #include "config.h"
+#include "CompositionEvent.h"
 
-#if ENABLE(3D_CANVAS)
+#include "EventNames.h"
 
-#include "JSCanvasShortArray.h"
+namespace WebCore {
 
-#include "CanvasShortArray.h"
+CompositionEvent::CompositionEvent()
+{
+}
 
-using namespace JSC;
+CompositionEvent::CompositionEvent(const AtomicString& type, PassRefPtr<AbstractView> view, const String& data)
+    : UIEvent(type, true, true, view, 0)
+    , m_data(data)
+{
+}
 
-namespace WebCore {
+CompositionEvent::~CompositionEvent()
+{
+}
 
-void JSCanvasShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void CompositionEvent::initCompositionEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView> view, const String& data)
 {
-    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
+    if (dispatched())
+        return;
+
+    initUIEvent(type, canBubble, cancelable, view, 0);
+
+    m_data = data;
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasShortArray* object)
+bool CompositionEvent::isCompositionEvent() const
 {
-    return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, object);
+    return true;
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/dom/CompositionEvent.h b/src/3rdparty/webkit/WebCore/dom/CompositionEvent.h
new file mode 100644
index 0000000000..4ff01ae2a4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/CompositionEvent.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef CompositionEvent_h
+#define CompositionEvent_h
+
+#include "UIEvent.h"
+
+namespace WebCore {
+
+    class CompositionEvent : public UIEvent {
+    public:
+        static PassRefPtr<CompositionEvent> create()
+        {
+            return adoptRef(new CompositionEvent);
+        }
+        static PassRefPtr<CompositionEvent> create(const AtomicString& type, PassRefPtr<AbstractView> view, const String& data)
+        {
+          return adoptRef(new CompositionEvent(type, view, data));
+        }
+        virtual ~CompositionEvent();
+    
+        void initCompositionEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView>, const String& data);
+    
+        String data() const { return m_data; }
+
+        virtual bool isCompositionEvent() const;
+
+    private:
+        CompositionEvent();
+        CompositionEvent(const AtomicString& type, PassRefPtr<AbstractView> view, const String& data);
+
+        String m_data;
+    };
+
+} // namespace WebCore
+
+#endif // CompositionEvent_h
diff --git a/src/3rdparty/webkit/WebCore/dom/CompositionEvent.idl b/src/3rdparty/webkit/WebCore/dom/CompositionEvent.idl
new file mode 100644
index 0000000000..28d6625886
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/CompositionEvent.idl
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module events {
+
+    // Introduced in DOM Level 3:
+    interface CompositionEvent : UIEvent {
+
+        readonly attribute DOMString data;
+
+        void initCompositionEvent(in DOMString typeArg, 
+                                  in boolean canBubbleArg, 
+                                  in boolean cancelableArg, 
+                                  in DOMWindow viewArg, 
+                                  in DOMString dataArg);
+
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
index 5cd07819d9..fb2852f1d4 100644
--- a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
@@ -33,6 +33,7 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "InlineTextBox.h"
+#include "InspectorController.h"
 #include "MutationEvent.h"
 #include "Page.h"
 #include "RenderTheme.h"
@@ -42,6 +43,7 @@
 
 namespace WebCore {
 
+static void notifyChildInserted(Node*);
 static void dispatchChildInsertionEvents(Node*);
 static void dispatchChildRemovalEvents(Node*);
 
@@ -143,9 +145,9 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         child->setNextSibling(next.get());
         allowEventDispatch();
 
-        // Dispatch the mutation events.
+        // Send notification about the children change.
         childrenChanged(false, refChildPreviousSibling.get(), next.get(), 1);
-        dispatchChildInsertionEvents(child.get());
+        notifyChildInserted(child.get());
                 
         // Add child to the rendering tree.
         if (attached() && !child->attached() && child->parent() == this) {
@@ -155,6 +157,10 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
                 child->attach();
         }
 
+        // Now that the child is attached to the render tree, dispatch
+        // the relevant mutation events.
+        dispatchChildInsertionEvents(child.get());
+
         child = nextChild.release();
     }
 
@@ -255,8 +261,7 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
         child->setNextSibling(next);
         allowEventDispatch();
 
-        // Dispatch the mutation events
-        dispatchChildInsertionEvents(child.get());
+        notifyChildInserted(child.get());
                 
         // Add child to the rendering tree
         if (attached() && !child->attached() && child->parent() == this) {
@@ -266,6 +271,10 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
                 child->attach();
         }
 
+        // Now that the child is attached to the render tree, dispatch
+        // the relevant mutation events.
+        dispatchChildInsertionEvents(child.get());
+
         prev = child;
         child = nextChild.release();
     }
@@ -332,6 +341,13 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
 
     document()->removeFocusedNodeOfSubtree(child.get());
     
+    // Events fired when blurring currently focused node might have moved this
+    // child into a different parent.
+    if (child->parentNode() != this) {
+        ec = NOT_FOUND_ERR;
+        return false;
+    }
+
     // FIXME: After sending the mutation events, "this" could be destroyed.
     // We can prevent that by doing a "ref", but first we have to make sure
     // that no callers call with ref count == 0 and parent = 0 (as of this
@@ -395,33 +411,43 @@ bool ContainerNode::removeChildren()
     document()->removeFocusedNodeOfSubtree(this, true);
 
     forbidEventDispatch();
-    int childCountDelta = 0;
+    Vector<RefPtr<Node> > removedChildren;
     while (RefPtr<Node> n = m_firstChild) {
-        childCountDelta--;
-
         Node* next = n->nextSibling();
         
-        // Remove the node from the tree before calling detach or removedFromDocument (4427024, 4129744)
+        // Remove the node from the tree before calling detach or removedFromDocument (4427024, 4129744).
+        // removeChild() does this after calling detach(). There is no explanation for
+        // this discrepancy between removeChild() and its optimized version removeChildren().
         n->setPreviousSibling(0);
         n->setNextSibling(0);
         n->setParent(0);
-        
+
         m_firstChild = next;
         if (n == m_lastChild)
             m_lastChild = 0;
 
         if (n->attached())
             n->detach();
-        
-        if (n->inDocument())
-            n->removedFromDocument();
+
+        removedChildren.append(n.release());
     }
     allowEventDispatch();
 
+    size_t removedChildrenCount = removedChildren.size();
+
     // Dispatch a single post-removal mutation event denoting a modified subtree.
-    childrenChanged(false, 0, 0, childCountDelta);
+    childrenChanged(false, 0, 0, -static_cast<int>(removedChildrenCount));
     dispatchSubtreeModifiedEvent();
 
+    for (size_t i = 0; i < removedChildrenCount; ++i) {
+        Node* removedChild = removedChildren[i].get();
+        if (removedChild->inDocument())
+            removedChild->removedFromDocument();
+        // removeChild() calls removedFromTree(true) if the child was not in the
+        // document. There is no explanation for this discrepancy between removeChild()
+        // and its optimized version removeChildren().
+    }
+
     return true;
 }
 
@@ -479,9 +505,9 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
         m_lastChild = child.get();
         allowEventDispatch();
 
-        // Dispatch the mutation events
+        // Send notification about the children change.
         childrenChanged(false, prev.get(), 0, 1);
-        dispatchChildInsertionEvents(child.get());
+        notifyChildInserted(child.get());
 
         // Add child to the rendering tree
         if (attached() && !child->attached() && child->parent() == this) {
@@ -490,6 +516,10 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
             else
                 child->attach();
         }
+
+        // Now that the child is attached to the render tree, dispatch
+        // the relevant mutation events.
+        dispatchChildInsertionEvents(child.get());
         
         child = nextChild.release();
     }
@@ -865,10 +895,17 @@ Node *ContainerNode::childNode(unsigned index) const
     return n;
 }
 
-static void dispatchChildInsertionEvents(Node* child)
+static void notifyChildInserted(Node* child)
 {
     ASSERT(!eventDispatchForbidden());
 
+#if ENABLE(INSPECTOR)
+    if (Page* page = child->document()->page()) {
+        if (InspectorController* inspectorController = page->inspectorController())
+            inspectorController->didInsertDOMNode(child);
+    }
+#endif
+
     RefPtr<Node> c = child;
     RefPtr<Document> document = child->document();
 
@@ -878,6 +915,14 @@ static void dispatchChildInsertionEvents(Node* child)
         c->insertedIntoTree(true);
 
     document->incDOMTreeVersion();
+}
+
+static void dispatchChildInsertionEvents(Node* child)
+{
+    ASSERT(!eventDispatchForbidden());
+
+    RefPtr<Node> c = child;
+    RefPtr<Document> document = child->document();
 
     if (c->parentNode() && document->hasListenerType(Document::DOMNODEINSERTED_LISTENER))
         c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeInsertedEvent, true, c->parentNode()));
@@ -891,6 +936,13 @@ static void dispatchChildInsertionEvents(Node* child)
 
 static void dispatchChildRemovalEvents(Node* child)
 {
+#if ENABLE(INSPECTOR)    
+    if (Page* page = child->document()->page()) {
+        if (InspectorController* inspectorController = page->inspectorController())
+            inspectorController->didRemoveDOMNode(child);
+    }
+#endif
+
     RefPtr<Node> c = child;
     RefPtr<Document> document = child->document();
 
diff --git a/src/3rdparty/webkit/WebCore/dom/CustomEvent.cpp b/src/3rdparty/webkit/WebCore/dom/CustomEvent.cpp
new file mode 100644
index 0000000000..c377063b7a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/CustomEvent.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CustomEvent.h"
+
+#include "EventNames.h"
+
+namespace WebCore {
+
+CustomEvent::CustomEvent()
+{
+}
+
+void CustomEvent::initCustomEvent(const AtomicString& type, bool canBubble, bool cancelable, ScriptValue detail)
+{
+    if (dispatched())
+        return;
+
+    initEvent(type, canBubble, cancelable);
+
+    m_detail = detail;
+}
+
+bool CustomEvent::isCustomEvent() const
+{
+    return true;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArrayBuffer.h b/src/3rdparty/webkit/WebCore/dom/CustomEvent.h
index e3ff2b00e2..d910767c07 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArrayBuffer.h
+++ b/src/3rdparty/webkit/WebCore/dom/CustomEvent.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,32 +20,38 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef CanvasArrayBuffer_h
-#define CanvasArrayBuffer_h
+#ifndef CustomEvent_h
+#define CustomEvent_h
 
-#include <wtf/PassRefPtr.h>
+#include "AtomicString.h"
+#include "Event.h"
+#include "ScriptValue.h"
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
-    
-    class CanvasArrayBuffer : public RefCounted<CanvasArrayBuffer> {
-    public:
-        static PassRefPtr<CanvasArrayBuffer> create(unsigned sizeInBytes);
-
-        void* data();
-        unsigned byteLength() const;
-
-        ~CanvasArrayBuffer();
-
-    private:
-        CanvasArrayBuffer(unsigned sizeInBytes);
-        unsigned m_sizeInBytes;
-        void* m_data;
-    };
-    
+
+class CustomEvent : public Event {
+public:
+    static PassRefPtr<CustomEvent> create()
+    {
+        return adoptRef(new CustomEvent);
+    }
+
+    void initCustomEvent(const AtomicString& type, bool canBubble, bool cancelable, ScriptValue detail);
+
+    virtual bool isCustomEvent() const;
+
+    ScriptValue detail() const { return m_detail; }
+
+private:
+    CustomEvent();
+
+    ScriptValue m_detail;
+};
+
 } // namespace WebCore
 
-#endif // CanvasArrayBuffer_h
+#endif // CustomEvent_h
diff --git a/src/3rdparty/webkit/WebCore/dom/CustomEvent.idl b/src/3rdparty/webkit/WebCore/dom/CustomEvent.idl
new file mode 100644
index 0000000000..1ab468c52c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/CustomEvent.idl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module events {
+
+    // Introduced in DOM Level 3:
+    interface CustomEvent : Event {
+
+       readonly attribute DOMObject detail;
+
+       void initCustomEvent(in DOMString typeArg, 
+                            in boolean canBubbleArg, 
+                            in boolean cancelableArg, 
+                            in DOMObject detailArg);
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl b/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl
index 3001995283..9baea1bd89 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl
+++ b/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl
@@ -28,9 +28,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor
-    ] DOMCoreException {
+    interface DOMCoreException {
 
         readonly attribute unsigned short   code;
         readonly attribute DOMString        name;
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
index 59b97033e0..ec89a1b3c1 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
@@ -31,6 +31,7 @@
 #include "Element.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
+#include "FrameLoaderClient.h"
 #include "FTPDirectoryDocument.h"
 #include "HTMLDocument.h"
 #include "HTMLNames.h"
@@ -272,16 +273,6 @@ PassRefPtr<CSSStyleSheet> DOMImplementation::createCSSStyleSheet(const String&,
     return sheet.release();
 }
 
-PassRefPtr<Document> DOMImplementation::createDocument(Frame* frame)
-{
-    return Document::create(frame);
-}
-
-PassRefPtr<HTMLDocument> DOMImplementation::createHTMLDocument(Frame* frame)
-{
-    return HTMLDocument::create(frame);
-}
-
 bool DOMImplementation::isXMLMIMEType(const String& mimeType)
 {
     if (mimeType == "text/xml" || mimeType == "application/xml" || mimeType == "text/xsl")
@@ -305,7 +296,8 @@ PassRefPtr<HTMLDocument> DOMImplementation::createHTMLDocument(const String& tit
 {
     RefPtr<HTMLDocument> d = HTMLDocument::create(0);
     d->open();
-    d->write("<!doctype html><html><head><title>" + title + "</title></head><body></body></html>");
+    d->write("<!doctype html><html><body></body></html>");
+    d->setTitle(title);
     return d.release();
 }
 
@@ -336,7 +328,7 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& type, Frame
 #endif
 
     PluginData* pluginData = 0;
-    if (frame && frame->page() && frame->page()->settings()->arePluginsEnabled())
+    if (frame && frame->page() && frame->loader()->allowPlugins(NotAboutToInstantiatePlugin))
         pluginData = frame->page()->pluginData();
 
     // PDF is one image type for which a plugin can override built-in support.
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.h b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.h
index 9e6f9a943d..b776d2285f 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.h
+++ b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.h
@@ -57,8 +57,6 @@ public:
 
     // Other methods (not part of DOM)
     static PassRefPtr<Document> createDocument(const String& MIMEType, Frame*, bool inViewSourceMode);
-    static PassRefPtr<Document> createDocument(Frame*);
-    static PassRefPtr<HTMLDocument> createHTMLDocument(Frame*);
 
     static bool isXMLMIMEType(const String& MIMEType);
     static bool isTextMIMEType(const String& MIMEType);
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl
index 6f4df80f72..81df6c8808 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl
+++ b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl
@@ -20,11 +20,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=B0CC344F-963C-4acc-9FC6-EB22649345E5,
-        ImplementationUUID=9E835092-2CA3-426b-826B-8272A8105E49
-    ] DOMImplementation {
+    interface DOMImplementation {
 
         // DOM Level 1
 
@@ -44,7 +40,6 @@ module core {
 
         // DOMImplementationCSS interface from DOM Level 2 CSS
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         [OldStyleObjC] CSSStyleSheet createCSSStyleSheet(in DOMString title,
                                                          in DOMString media)
             raises(DOMException);
@@ -52,7 +47,6 @@ module core {
         // HTMLDOMImplementation interface from DOM Level 2 HTML
 
         HTMLDocument createHTMLDocument(in DOMString title);
-#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index 4eb44f71ed..aedba0dd0b 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -36,9 +36,12 @@
 #include "CSSValueKeywords.h"
 #include "CString.h"
 #include "CachedCSSStyleSheet.h"
+#include "Chrome.h"
+#include "ChromeClient.h"
 #include "Comment.h"
 #include "Console.h"
 #include "CookieJar.h"
+#include "CustomEvent.h"
 #include "DOMImplementation.h"
 #include "DOMWindow.h"
 #include "DocLoader.h"
@@ -67,6 +70,7 @@
 #include "HTMLElementFactory.h"
 #include "HTMLFrameOwnerElement.h"
 #include "HTMLHeadElement.h"
+#include "HTMLIFrameElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLLinkElement.h"
 #include "HTMLMapElement.h"
@@ -98,6 +102,7 @@
 #include "PageGroup.h"
 #include "PageTransitionEvent.h"
 #include "PlatformKeyboardEvent.h"
+#include "PopStateEvent.h"
 #include "ProcessingInstruction.h"
 #include "ProgressEvent.h"
 #include "RegisteredEventListener.h"
@@ -112,6 +117,7 @@
 #include "SegmentedString.h"
 #include "SelectionController.h"
 #include "Settings.h"
+#include "StringBuffer.h"
 #include "StyleSheetList.h"
 #include "TextEvent.h"
 #include "TextIterator.h"
@@ -125,6 +131,7 @@
 #include "WebKitTransitionEvent.h"
 #include "WheelEvent.h"
 #include "XMLHttpRequest.h"
+#include "XMLNSNames.h"
 #include "XMLNames.h"
 #include "XMLTokenizer.h"
 #include "htmlediting.h"
@@ -134,11 +141,6 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/StdLibExtras.h>
 
-#if ENABLE(DATABASE)
-#include "Database.h"
-#include "DatabaseThread.h"
-#endif
-
 #if ENABLE(SHARED_WORKERS)
 #include "SharedWorkerRepository.h"
 #endif
@@ -170,6 +172,10 @@
 #include "SVGStyleElement.h"
 #endif
 
+#if ENABLE(TOUCH_EVENTS)
+#include "TouchEvent.h"
+#endif
+
 #if ENABLE(WML)
 #include "WMLDocument.h"
 #include "WMLElement.h"
@@ -314,15 +320,50 @@ static bool disableRangeMutation(Page* page)
 
 static HashSet<Document*>* documentsThatNeedStyleRecalc = 0;
 
-Document::Document(Frame* frame, bool isXHTML)
+class DocumentWeakReference : public ThreadSafeShared<DocumentWeakReference> {
+public:
+    static PassRefPtr<DocumentWeakReference> create(Document* document)
+    {
+        return adoptRef(new DocumentWeakReference(document));
+    }
+
+    Document* document()
+    {
+        ASSERT(isMainThread());
+        return m_document;
+    }
+
+    void clear()
+    {
+        ASSERT(isMainThread());
+        m_document = 0;
+    }
+
+private:
+    DocumentWeakReference(Document* document)
+        : m_document(document)
+    {
+        ASSERT(isMainThread());
+    }
+
+    Document* m_document;
+};
+
+Document::Document(Frame* frame, bool isXHTML, bool isHTML)
     : ContainerNode(0)
     , m_domtree_version(0)
     , m_styleSheets(StyleSheetList::create(this))
     , m_styleRecalcTimer(this, &Document::styleRecalcTimerFired)
     , m_frameElementsShouldIgnoreScrolling(false)
+    , m_containsValidityStyleRules(false)
+    , m_updateFocusAppearanceRestoresSelection(false)
     , m_title("")
+    , m_rawTitle("")
     , m_titleSetExplicitly(false)
     , m_updateFocusAppearanceTimer(this, &Document::updateFocusAppearanceTimerFired)
+    , m_startTime(currentTime())
+    , m_overMinimumLayoutThreshold(false)
+    , m_extraLayoutDelay(0)
     , m_executeScriptSoonTimer(this, &Document::executeScriptSoonTimerFired)
     , m_xmlVersion("1.0")
     , m_xmlStandalone(false)
@@ -330,7 +371,6 @@ Document::Document(Frame* frame, bool isXHTML)
     , m_bindingManager(new XBLBindingManager(this))
 #endif
     , m_savedRenderer(0)
-    , m_secureForms(0)
     , m_designMode(inherit)
     , m_selfOnlyRefCount(0)
 #if ENABLE(SVG)
@@ -345,14 +385,17 @@ Document::Document(Frame* frame, bool isXHTML)
     , m_inPageCache(false)
     , m_useSecureKeyboardEntryWhenActive(false)
     , m_isXHTML(isXHTML)
+    , m_isHTML(isHTML)
     , m_numNodeListCaches(0)
-#if ENABLE(DATABASE)
-    , m_hasOpenDatabases(false)
+#if USE(JSC)
+    , m_normalWorldWrapperCache(0)
 #endif
     , m_usingGeolocation(false)
+    , m_pendingEventTimer(this, &Document::pendingEventTimerFired)
 #if ENABLE(WML)
     , m_containsWMLContent(false)
 #endif
+    , m_weakReference(DocumentWeakReference::create(this))
 {
     m_document = this;
 
@@ -363,15 +406,13 @@ Document::Document(Frame* frame, bool isXHTML)
     m_ignoreAutofocus = false;
 
     m_frame = frame;
-    m_renderArena = 0;
 
     m_axObjectCache = 0;
     
     m_docLoader = new DocLoader(this);
 
-    visuallyOrdered = false;
+    m_visuallyOrdered = false;
     m_bParsing = false;
-    m_tokenizer = 0;
     m_wellFormed = false;
 
     setParseMode(Strict);
@@ -391,7 +432,6 @@ Document::Document(Frame* frame, bool isXHTML)
 
     m_gotoAnchorNeededAfterStylesheetsLoad = false;
  
-    m_styleSelector = 0;
     m_didCalculateStyleSelector = false;
     m_pendingStylesheets = 0;
     m_ignorePendingStylesheets = false;
@@ -405,8 +445,6 @@ Document::Document(Frame* frame, bool isXHTML)
     resetActiveLinkColor();
 
     m_processingLoadEvent = false;
-    m_startTime = currentTime();
-    m_overMinimumLayoutThreshold = false;
     
     initSecurityContext();
     initDNSPrefetch();
@@ -414,7 +452,7 @@ Document::Document(Frame* frame, bool isXHTML)
     static int docID = 0;
     m_docID = docID++;
 #if ENABLE(XHTMLMP)
-    m_shouldProcessNoScriptElement = settings() && !settings()->isJavaScriptEnabled();
+    m_shouldProcessNoScriptElement = m_frame->script()->canExecuteScripts(NotAboutToExecuteScript);
 #endif
 }
 
@@ -437,13 +475,15 @@ void Document::removedLastRef()
         m_titleElement = 0;
         m_documentElement = 0;
 
+        // removeAllChildren() doesn't always unregister IDs, do it upfront to avoid having stale references in the map.
+        m_elementsById.clear();
+
         removeAllChildren();
 
         deleteAllValues(m_markers);
         m_markers.clear();
 
-        delete m_tokenizer;
-        m_tokenizer = 0;
+        m_tokenizer.clear();
 
         m_cssCanvasElements.clear();
 
@@ -477,18 +517,14 @@ Document::~Document()
     forgetAllDOMNodesForDocument(this);
 #endif
 
-    delete m_tokenizer;
+    m_tokenizer.clear();
     m_document = 0;
-    delete m_styleSelector;
-    delete m_docLoader;
-    
-    if (m_renderArena) {
-        delete m_renderArena;
-        m_renderArena = 0;
-    }
+    m_docLoader.clear();
+
+    m_renderArena.clear();
 
 #if ENABLE(XBL)
-    delete m_bindingManager;
+    m_bindingManager.clear();
 #endif
 
     deleteAllValues(m_markers);
@@ -501,26 +537,25 @@ Document::~Document()
     for (unsigned i = 0; i < count; i++)
         deleteAllValues(m_nameCollectionInfo[i]);
 
-#if ENABLE(DATABASE)
-    if (m_databaseThread) {
-        ASSERT(m_databaseThread->terminationRequested());
-        m_databaseThread = 0;
-    }
-#endif
-
     if (m_styleSheets)
         m_styleSheets->documentDestroyed();
+
+    m_weakReference->clear();
 }
 
+#if USE(JSC)
 Document::JSWrapperCache* Document::createWrapperCache(DOMWrapperWorld* world)
 {
     JSWrapperCache* wrapperCache = new JSWrapperCache();
     m_wrapperCacheMap.set(world, wrapperCache);
-#if USE(JSC)
+    if (world->isNormal()) {
+        ASSERT(!m_normalWorldWrapperCache);
+        m_normalWorldWrapperCache = wrapperCache;
+    }
     world->rememberDocument(this);
-#endif
     return wrapperCache;
 }
+#endif
 
 void Document::resetLinkColor()
 {
@@ -765,6 +800,9 @@ PassRefPtr<Node> Document::adoptNode(PassRefPtr<Node> source, ExceptionCode& ec)
             break;
         }       
         default:
+            if (source->hasTagName(iframeTag))
+                static_cast<HTMLIFrameElement*>(source.get())->setRemainsAliveOnRemovalFromTree(attached());
+
             if (source->parentNode())
                 source->parentNode()->removeChild(source.get(), ec);
     }
@@ -777,21 +815,17 @@ PassRefPtr<Node> Document::adoptNode(PassRefPtr<Node> source, ExceptionCode& ec)
 
 bool Document::hasPrefixNamespaceMismatch(const QualifiedName& qName)
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, xmlnsNamespaceURI, ("http://www.w3.org/2000/xmlns/"));
-    DEFINE_STATIC_LOCAL(const AtomicString, xmlns, ("xmlns"));
-    DEFINE_STATIC_LOCAL(const AtomicString, xml, ("xml"));
-
     // These checks are from DOM Core Level 2, createElementNS
     // http://www.w3.org/TR/DOM-Level-2-Core/core.html#ID-DocCrElNS
     if (!qName.prefix().isEmpty() && qName.namespaceURI().isNull()) // createElementNS(null, "html:div")
         return true;
-    if (qName.prefix() == xml && qName.namespaceURI() != XMLNames::xmlNamespaceURI) // createElementNS("http://www.example.com", "xml:lang")
+    if (qName.prefix() == xmlAtom && qName.namespaceURI() != XMLNames::xmlNamespaceURI) // createElementNS("http://www.example.com", "xml:lang")
         return true;
 
     // Required by DOM Level 3 Core and unspecified by DOM Level 2 Core:
     // http://www.w3.org/TR/2004/REC-DOM-Level-3-Core-20040407/core.html#ID-DocCrElNS
     // createElementNS("http://www.w3.org/2000/xmlns/", "foo:bar"), createElementNS(null, "xmlns:bar")
-    if ((qName.prefix() == xmlns && qName.namespaceURI() != xmlnsNamespaceURI) || (qName.prefix() != xmlns && qName.namespaceURI() == xmlnsNamespaceURI))
+    if ((qName.prefix() == xmlnsAtom && qName.namespaceURI() != XMLNSNames::xmlnsNamespaceURI) || (qName.prefix() != xmlnsAtom && qName.namespaceURI() == XMLNSNames::xmlnsNamespaceURI))
         return true;
 
     return false;
@@ -852,6 +886,8 @@ Element* Document::getElementById(const AtomicString& elementId) const
     if (elementId.isEmpty())
         return 0;
 
+    m_elementsById.checkConsistency();
+
     Element* element = m_elementsById.get(elementId.impl());
     if (element)
         return element;
@@ -861,7 +897,7 @@ Element* Document::getElementById(const AtomicString& elementId) const
         for (Node *n = traverseNextNode(); n != 0; n = n->traverseNextNode()) {
             if (n->isElementNode()) {
                 element = static_cast<Element*>(n);
-                if (element->hasID() && element->getAttribute(idAttr) == elementId) {
+                if (element->hasID() && element->getAttribute(element->idAttributeName()) == elementId) {
                     m_duplicateIds.remove(elementId.impl());
                     m_elementsById.set(elementId.impl(), element);
                     return element;
@@ -1043,6 +1079,8 @@ void Document::addElementById(const AtomicString& elementId, Element* element)
 
 void Document::removeElementById(const AtomicString& elementId, Element* element)
 {
+    m_elementsById.checkConsistency();
+
     if (m_elementsById.get(elementId.impl()) == element)
         m_elementsById.remove(elementId.impl());
     else
@@ -1067,8 +1105,67 @@ Element* Document::getElementByAccessKey(const String& key) const
     return m_elementsByAccessKey.get(key.impl());
 }
 
+/*
+ * Performs three operations:
+ *  1. Convert control characters to spaces
+ *  2. Trim leading and trailing spaces
+ *  3. Collapse internal whitespace.
+ */
+static inline String canonicalizedTitle(Document* document, const String& title)
+{
+    const UChar* characters = title.characters();
+    unsigned length = title.length();
+    unsigned i;
+
+    StringBuffer buffer(length);
+    unsigned builderIndex = 0;
+
+    // Skip leading spaces and leading characters that would convert to spaces
+    for (i = 0; i < length; ++i) {
+        UChar c = characters[i];
+        if (!(c <= 0x20 || c == 0x7F))
+            break;
+    }
+
+    if (i == length)
+        return "";
+
+    // Replace control characters with spaces, and backslashes with currency symbols, and collapse whitespace.
+    bool previousCharWasWS = false;
+    for (; i < length; ++i) {
+        UChar c = characters[i];
+        if (c <= 0x20 || c == 0x7F || (WTF::Unicode::category(c) & (WTF::Unicode::Separator_Line | WTF::Unicode::Separator_Paragraph))) {
+            if (previousCharWasWS)
+                continue;
+            buffer[builderIndex++] = ' ';
+            previousCharWasWS = true;
+        } else {
+            buffer[builderIndex++] = c;
+            previousCharWasWS = false;
+        }
+    }
+
+    // Strip trailing spaces
+    while (builderIndex > 0) {
+        --builderIndex;
+        if (buffer[builderIndex] != ' ')
+            break;
+    }
+
+    if (!builderIndex && buffer[builderIndex] == ' ')
+        return "";
+
+    buffer.shrink(builderIndex + 1);
+
+    // Replace the backslashes with currency symbols if the encoding requires it.
+    document->displayBufferModifiedByEncoding(buffer.characters(), buffer.length());
+    
+    return String::adopt(buffer);
+}
+
 void Document::updateTitle()
 {
+    m_title = canonicalizedTitle(this, m_rawTitle);
     if (Frame* f = frame())
         f->loader()->setTitle(m_title);
 }
@@ -1095,10 +1192,10 @@ void Document::setTitle(const String& title, Element* titleElement)
         m_titleElement = titleElement;
     }
 
-    if (m_title == title)
+    if (m_rawTitle == title)
         return;
 
-    m_title = title;
+    m_rawTitle = title;
     updateTitle();
 
     if (m_titleSetExplicitly && m_titleElement && m_titleElement->hasTagName(titleTag))
@@ -1123,8 +1220,8 @@ void Document::removeTitle(Element* titleElement)
             }
     }
 
-    if (!m_titleElement && !m_title.isEmpty()) {
-        m_title = "";
+    if (!m_titleElement && !m_rawTitle.isEmpty()) {
+        m_rawTitle = "";
         updateTitle();
     }
 }
@@ -1231,13 +1328,13 @@ void Document::recalcStyle(StyleChange change)
         return; // Guard against re-entrancy. -dwh
 
 #if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->willRecalculateStyle();
 #endif
 
     m_inStyleRecalc = true;
     suspendPostAttachCallbacks();
+    RenderWidget::suspendWidgetHierarchyUpdates();
     if (view())
         view()->pauseScheduledEvents();
     
@@ -1249,32 +1346,7 @@ void Document::recalcStyle(StyleChange change)
         // style selector may set this again during recalc
         m_hasNodesWithPlaceholderStyle = false;
         
-        RefPtr<RenderStyle> documentStyle = RenderStyle::create();
-        documentStyle->setDisplay(BLOCK);
-        documentStyle->setVisuallyOrdered(visuallyOrdered);
-        documentStyle->setZoom(frame()->pageZoomFactor());
-        m_styleSelector->setStyle(documentStyle);
-    
-        FontDescription fontDescription;
-        fontDescription.setUsePrinterFont(printing());
-        if (Settings* settings = this->settings()) {
-            fontDescription.setRenderingMode(settings->fontRenderingMode());
-            if (printing() && !settings->shouldPrintBackgrounds())
-                documentStyle->setForceBackgroundsToWhite(true);
-            const AtomicString& stdfont = settings->standardFontFamily();
-            if (!stdfont.isEmpty()) {
-                fontDescription.firstFamily().setFamily(stdfont);
-                fontDescription.firstFamily().appendFamily(0);
-            }
-            fontDescription.setKeywordSize(CSSValueMedium - CSSValueXxSmall + 1);
-            m_styleSelector->setFontSize(fontDescription, m_styleSelector->fontSizeForKeyword(CSSValueMedium, inCompatMode(), false));
-        }
-
-        documentStyle->setFontDescription(fontDescription);
-        documentStyle->font().update(m_styleSelector->fontSelector());
-        if (inCompatMode())
-            documentStyle->setHtmlHacks(true); // enable html specific rendering tricks
-
+        RefPtr<RenderStyle> documentStyle = CSSStyleSelector::styleForDocument(this);
         StyleChange ch = diff(documentStyle.get(), renderer()->style());
         if (renderer() && ch != NoChange)
             renderer()->setStyle(documentStyle.release());
@@ -1300,6 +1372,7 @@ bail_out:
 
     if (view())
         view()->resumeScheduledEvents();
+    RenderWidget::resumeWidgetHierarchyUpdates();
     resumePostAttachCallbacks();
     m_inStyleRecalc = false;
 
@@ -1310,7 +1383,7 @@ bail_out:
     }
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->didRecalculateStyle();
 #endif
 }
@@ -1381,7 +1454,7 @@ void Document::updateLayoutIgnorePendingStylesheets()
         } else if (m_hasNodesWithPlaceholderStyle)
             // If new nodes have been added or style recalc has been done with style sheets still pending, some nodes 
             // may not have had their real style calculated yet. Normally this gets cleaned when style sheets arrive 
-            // but here we need up-to-date style immediatly.
+            // but here we need up-to-date style immediately.
             recalcStyle(Force);
     }
 
@@ -1390,6 +1463,26 @@ void Document::updateLayoutIgnorePendingStylesheets()
     m_ignorePendingStylesheets = oldIgnore;
 }
 
+PassRefPtr<RenderStyle> Document::styleForElementIgnoringPendingStylesheets(Element* element)
+{
+    ASSERT_ARG(element, element->document() == this);
+
+    bool oldIgnore = m_ignorePendingStylesheets;
+    m_ignorePendingStylesheets = true;
+    RefPtr<RenderStyle> style = styleSelector()->styleForElement(element, element->parent() ? element->parent()->computedStyle() : 0);
+    m_ignorePendingStylesheets = oldIgnore;
+    return style.release();
+}
+
+void Document::createStyleSelector()
+{
+    bool matchAuthorAndUserStyles = true;
+    if (Settings* docSettings = settings())
+        matchAuthorAndUserStyles = docSettings->authorAndUserStylesEnabled();
+    m_styleSelector.set(new CSSStyleSelector(this, m_styleSheets.get(), m_mappedElementSheet.get(), pageUserSheet(), pageGroupUserSheets(), 
+                                             !inCompatMode(), matchAuthorAndUserStyles));
+}
+
 void Document::attach()
 {
     ASSERT(!attached());
@@ -1400,19 +1493,11 @@ void Document::attach()
         m_renderArena = new RenderArena();
     
     // Create the rendering tree
-    setRenderer(new (m_renderArena) RenderView(this, view()));
+    setRenderer(new (m_renderArena.get()) RenderView(this, view()));
 #if USE(ACCELERATED_COMPOSITING)
     renderView()->didMoveOnscreen();
 #endif
 
-    if (!m_styleSelector) {
-        bool matchAuthorAndUserStyles = true;
-        if (Settings* docSettings = settings())
-            matchAuthorAndUserStyles = docSettings->authorAndUserStylesEnabled();
-        m_styleSelector = new CSSStyleSelector(this, m_styleSheets.get(), m_mappedElementSheet.get(), pageUserSheet(), pageGroupUserSheets(), 
-                                               !inCompatMode(), matchAuthorAndUserStyles);
-    }
-
     recalcStyle(Force);
 
     RenderObject* render = renderer();
@@ -1445,6 +1530,17 @@ void Document::detach()
         FrameView* view = m_frame->view();
         if (view)
             view->detachCustomScrollbars();
+
+#if ENABLE(TOUCH_EVENTS)
+        Page* ownerPage = page();
+        if (ownerPage && (m_frame == ownerPage->mainFrame())) {
+            // Inform the Chrome Client that it no longer needs to
+            // foward touch events to WebCore as the document is being
+            // destroyed. It may start again if a subsequent page
+            // registers a touch event listener.
+            ownerPage->chrome()->client()->needTouchEvents(false);
+        }
+#endif
     }
 
     // indicate destruction mode,  i.e. attached() but renderer == 0
@@ -1462,16 +1558,12 @@ void Document::detach()
         render->destroy();
     
     // This is required, as our Frame might delete itself as soon as it detaches
-    // us. However, this violates Node::detach() symantics, as it's never
+    // us. However, this violates Node::detach() semantics, as it's never
     // possible to re-attach. Eventually Document::detach() should be renamed,
     // or this setting of the frame to 0 could be made explicit in each of the
     // callers of Document::detach().
     m_frame = 0;
-    
-    if (m_renderArena) {
-        delete m_renderArena;
-        m_renderArena = 0;
-    }
+    m_renderArena.clear();
 }
 
 void Document::removeAllEventListeners()
@@ -1543,7 +1635,7 @@ AXObjectCache* Document::axObjectCache() const
 
 void Document::setVisuallyOrdered()
 {
-    visuallyOrdered = true;
+    m_visuallyOrdered = true;
     if (renderer())
         renderer()->style()->setVisuallyOrdered(true);
 }
@@ -1586,8 +1678,7 @@ void Document::cancelParsing()
         // the onload handler when closing as a side effect of a cancel-style
         // change, such as opening a new document or closing the window while
         // still parsing
-        delete m_tokenizer;
-        m_tokenizer = 0;
+        m_tokenizer.clear();
         close();
     }
 }
@@ -1596,8 +1687,7 @@ void Document::implicitOpen()
 {
     cancelParsing();
 
-    delete m_tokenizer;
-    m_tokenizer = 0;
+    m_tokenizer.clear();
 
     removeChildren();
 
@@ -1694,8 +1784,7 @@ void Document::implicitClose()
 
     // We have to clear the tokenizer, in case someone document.write()s from the
     // onLoad event handler, as in Radar 3206524.
-    delete m_tokenizer;
-    m_tokenizer = 0;
+    m_tokenizer.clear();
 
     // Parser should have picked up all preloads by now
     m_docLoader->clearPreloads();
@@ -1729,9 +1818,13 @@ void Document::implicitClose()
     if (f)
         f->animation()->resumeAnimations(this);
 
-    ImageLoader::dispatchPendingEvents();
+    ImageLoader::dispatchPendingBeforeLoadEvents();
+    ImageLoader::dispatchPendingLoadEvents();
     dispatchWindowLoadEvent();
-    dispatchWindowEvent(PageTransitionEvent::create(eventNames().pageshowEvent, false), this);
+    enqueuePageshowEvent(PageshowEventNotPersisted);
+    if (m_pendingStateObject)
+        enqueuePopstateEvent(m_pendingStateObject.release());
+    
     if (f)
         f->loader()->handledOnloadEvents();
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
@@ -1818,13 +1911,13 @@ bool Document::shouldScheduleLayout()
 int Document::minimumLayoutDelay()
 {
     if (m_overMinimumLayoutThreshold)
-        return 0;
+        return m_extraLayoutDelay;
     
     int elapsed = elapsedTime();
     m_overMinimumLayoutThreshold = elapsed > cLayoutScheduleThreshold;
     
     // We'll want to schedule the timer to fire at the minimum layout threshold.
-    return max(0, cLayoutScheduleThreshold - elapsed);
+    return max(0, cLayoutScheduleThreshold - elapsed) + m_extraLayoutDelay;
 }
 
 int Document::elapsedTime() const
@@ -1920,9 +2013,9 @@ void Document::updateBaseURL()
         m_baseURL = KURL();
 
     if (m_elemSheet)
-        m_elemSheet->setHref(m_baseURL.string());
+        m_elemSheet->setFinalURL(m_baseURL);
     if (m_mappedElementSheet)
-        m_mappedElementSheet->setHref(m_baseURL.string());
+        m_mappedElementSheet->setFinalURL(m_baseURL);
 }
 
 String Document::userAgent(const KURL& url) const
@@ -1944,7 +2037,7 @@ CSSStyleSheet* Document::pageUserSheet()
         return 0;
     
     // Parse the sheet and cache it.
-    m_pageUserSheet = CSSStyleSheet::create(this, settings()->userStyleSheetLocation());
+    m_pageUserSheet = CSSStyleSheet::createInline(this, settings()->userStyleSheetLocation());
     m_pageUserSheet->setIsUserStyleSheet(true);
     m_pageUserSheet->parseString(userSheetText, !inCompatMode());
     return m_pageUserSheet.get();
@@ -1979,7 +2072,7 @@ const Vector<RefPtr<CSSStyleSheet> >* Document::pageGroupUserSheets() const
             const UserStyleSheet* sheet = sheets->at(i).get();
             if (!UserContentURLPattern::matchesPatterns(url(), sheet->whitelist(), sheet->blacklist()))
                 continue;
-            RefPtr<CSSStyleSheet> parsedSheet = CSSStyleSheet::create(const_cast<Document*>(this), sheet->url());
+            RefPtr<CSSStyleSheet> parsedSheet = CSSStyleSheet::createInline(const_cast<Document*>(this), sheet->url());
             parsedSheet->setIsUserStyleSheet(true);
             parsedSheet->parseString(sheet->source(), !inCompatMode());
             if (!m_pageGroupUserSheets)
@@ -2001,14 +2094,14 @@ void Document::clearPageGroupUserSheets()
 CSSStyleSheet* Document::elementSheet()
 {
     if (!m_elemSheet)
-        m_elemSheet = CSSStyleSheet::create(this, m_baseURL.string());
+        m_elemSheet = CSSStyleSheet::createInline(this, m_baseURL);
     return m_elemSheet.get();
 }
 
 CSSStyleSheet* Document::mappedElementSheet()
 {
     if (!m_mappedElementSheet)
-        m_mappedElementSheet = CSSStyleSheet::create(this, m_baseURL.string());
+        m_mappedElementSheet = CSSStyleSheet::createInline(this, m_baseURL);
     return m_mappedElementSheet.get();
 }
 
@@ -2172,8 +2265,10 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
         }
     } else if (equalIgnoringCase(equiv, "set-cookie")) {
         // FIXME: make setCookie work on XML documents too; e.g. in case of <html:meta .....>
-        if (isHTMLDocument())
-            static_cast<HTMLDocument*>(this)->setCookie(content);
+        if (isHTMLDocument()) {
+            ExceptionCode ec; // Exception (for sandboxed documents) ignored.
+            static_cast<HTMLDocument*>(this)->setCookie(content, ec);
+        }
     } else if (equalIgnoringCase(equiv, "content-language"))
         setContentLanguage(content);
     else if (equalIgnoringCase(equiv, "x-dns-prefetch-control"))
@@ -2489,7 +2584,7 @@ void Document::recalcStyleSelector()
                     sheet = cssSheet.get();
                 }
             }
-        } else if (n->isHTMLElement() && (n->hasTagName(linkTag) || n->hasTagName(styleTag))
+        } else if ((n->isHTMLElement() && (n->hasTagName(linkTag) || n->hasTagName(styleTag)))
 #if ENABLE(SVG)
             ||  (n->isSVGElement() && n->hasTagName(SVGNames::styleTag))
 #endif
@@ -2557,10 +2652,7 @@ void Document::recalcStyleSelector()
 
     m_styleSheets->swap(sheets);
 
-    // Create a new style selector
-    delete m_styleSelector;
-    m_styleSelector = new CSSStyleSelector(this, m_styleSheets.get(), m_mappedElementSheet.get(), 
-                                           pageUserSheet(), pageGroupUserSheets(), !inCompatMode(), matchAuthorAndUserStyles);
+    m_styleSelector.clear();
     m_didCalculateStyleSelector = true;
 }
 
@@ -2651,14 +2743,14 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
             oldFocusedNode->setActive(false);
 
         oldFocusedNode->setFocus(false);
-                
+
         // Dispatch a change event for text fields or textareas that have been edited
         RenderObject* r = oldFocusedNode->renderer();
-        if (r && r->isTextControl() && toRenderTextControl(r)->isEdited()) {
-            oldFocusedNode->dispatchEvent(Event::create(eventNames().changeEvent, true, false));
+        if (r && r->isTextControl() && toRenderTextControl(r)->wasChangedSinceLastChangeEvent()) {
+            static_cast<Element*>(oldFocusedNode.get())->dispatchFormControlChangeEvent();
             r = oldFocusedNode->renderer();
             if (r && r->isTextControl())
-                toRenderTextControl(r)->setEdited(false);
+                toRenderTextControl(r)->setChangedSinceLastChangeEvent(false);
         }
 
         // Dispatch the blur event and let the node do any other blur related activities (important for text fields)
@@ -2669,7 +2761,9 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
             focusChangeBlocked = true;
             newFocusedNode = 0;
         }
-        oldFocusedNode->dispatchUIEvent(eventNames().DOMFocusOutEvent, 0, 0);
+        
+        oldFocusedNode->dispatchUIEvent(eventNames().focusoutEvent, 0, 0); // DOM level 3 name for the bubbling blur event.
+
         if (m_focusedNode) {
             // handler shifted focus
             focusChangeBlocked = true;
@@ -2699,7 +2793,9 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
             focusChangeBlocked = true;
             goto SetFocusedNodeDone;
         }
-        m_focusedNode->dispatchUIEvent(eventNames().DOMFocusInEvent, 0, 0);
+
+        m_focusedNode->dispatchUIEvent(eventNames().focusinEvent, 0, 0); // DOM level 3 bubbling focus event.
+
         if (m_focusedNode != newFocusedNode) { 
             // handler shifted focus
             focusChangeBlocked = true;
@@ -2742,6 +2838,8 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         axObjectCache()->handleFocusedUIElementChanged(oldFocusedRenderer, newFocusedRenderer);
     }
 #endif
+    if (!focusChangeBlocked)
+        page()->chrome()->focusedNodeChanged(m_focusedNode.get());
 
 SetFocusedNodeDone:
     updateStyleIfNeeded();
@@ -2900,11 +2998,32 @@ void Document::dispatchWindowLoadEvent()
     domWindow->dispatchLoadEvent();
 }
 
+void Document::enqueueEvent(PassRefPtr<Event> event)
+{
+    m_pendingEventQueue.append(event);
+    if (!m_pendingEventTimer.isActive())
+        m_pendingEventTimer.startOneShot(0);
+}
+
+void Document::pendingEventTimerFired(Timer<Document>*)
+{
+    ASSERT(!m_pendingEventTimer.isActive());
+    Vector<RefPtr<Event> > eventQueue;
+    eventQueue.swap(m_pendingEventQueue);
+
+    typedef Vector<RefPtr<Event> >::const_iterator Iterator;
+    Iterator end = eventQueue.end();
+    for (Iterator it = eventQueue.begin(); it != end; ++it)
+        dispatchWindowEvent(*it);
+}
+
 PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode& ec)
 {
     RefPtr<Event> event;
     if (eventType == "Event" || eventType == "Events" || eventType == "HTMLEvents")
         event = Event::create();
+    else if (eventType == "CustomEvent")
+        event = CustomEvent::create();
     else if (eventType == "KeyboardEvent" || eventType == "KeyboardEvents")
         event = KeyboardEvent::create();
     else if (eventType == "MessageEvent")
@@ -2939,6 +3058,10 @@ PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode&
     else if (eventType == "SVGZoomEvents")
         event = SVGZoomEvent::create();
 #endif
+#if ENABLE(TOUCH_EVENTS)
+    else if (eventType == "TouchEvent")
+        event = TouchEvent::create();
+#endif
     if (event) {
         event->setCreatedByDOM(true);
         return event.release();
@@ -2975,6 +3098,16 @@ void Document::addListenerTypeIfNeeded(const AtomicString& eventType)
         addListenerType(TRANSITIONEND_LISTENER);
     else if (eventType == eventNames().beforeloadEvent)
         addListenerType(BEFORELOAD_LISTENER);
+#if ENABLE(TOUCH_EVENTS)
+    else if (eventType == eventNames().touchstartEvent
+             || eventType == eventNames().touchmoveEvent
+             || eventType == eventNames().touchendEvent
+             || eventType == eventNames().touchcancelEvent) {
+        addListenerType(TOUCH_LISTENER);
+        if (Page* page = this->page())
+            page->chrome()->client()->needTouchEvents(true);
+    }
+#endif
 }
 
 CSSStyleDeclaration* Document::getOverrideStyle(Element*, const String&)
@@ -2989,11 +3122,20 @@ Element* Document::ownerElement() const
     return frame()->ownerElement();
 }
 
-String Document::cookie() const
+String Document::cookie(ExceptionCode& ec) const
 {
     if (page() && !page()->cookieEnabled())
         return String();
 
+    // FIXME: The HTML5 DOM spec states that this attribute can raise an
+    // INVALID_STATE_ERR exception on getting if the Document has no
+    // browsing context.
+
+    if (!securityOrigin()->canAccessCookies()) {
+        ec = SECURITY_ERR;
+        return String();
+    }
+
     KURL cookieURL = this->cookieURL();
     if (cookieURL.isEmpty())
         return String();
@@ -3001,11 +3143,20 @@ String Document::cookie() const
     return cookies(this, cookieURL);
 }
 
-void Document::setCookie(const String& value)
+void Document::setCookie(const String& value, ExceptionCode& ec)
 {
     if (page() && !page()->cookieEnabled())
         return;
 
+    // FIXME: The HTML5 DOM spec states that this attribute can raise an
+    // INVALID_STATE_ERR exception on setting if the Document has no
+    // browsing context.
+
+    if (!securityOrigin()->canAccessCookies()) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
     KURL cookieURL = this->cookieURL();
     if (cookieURL.isEmpty())
         return;
@@ -3027,6 +3178,11 @@ String Document::domain() const
 
 void Document::setDomain(const String& newDomain, ExceptionCode& ec)
 {
+    if (SecurityOrigin::isDomainRelaxationForbiddenForURLScheme(securityOrigin()->protocol())) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
     // Both NS and IE specify that changing the domain is only allowed when
     // the new domain is a suffix of the old domain.
 
@@ -3207,6 +3363,8 @@ void Document::removeImageMap(HTMLMapElement* imageMap)
     if (!name.impl())
         return;
 
+    m_imageMapsByName.checkConsistency();
+
     ImageMapsByName::iterator it = m_imageMapsByName.find(name.impl());
     if (it != m_imageMapsByName.end() && it->second == imageMap)
         m_imageMapsByName.remove(it);
@@ -3219,6 +3377,7 @@ HTMLMapElement *Document::getImageMap(const String& url) const
     int hashPos = url.find('#');
     String name = (hashPos < 0 ? url : url.substring(hashPos + 1)).impl();
     AtomicString mapName = isHTMLDocument() ? name.lower() : name;
+    m_imageMapsByName.checkConsistency();
     return m_imageMapsByName.get(mapName.impl());
 }
 
@@ -3732,7 +3891,7 @@ void Document::repaintMarkers(DocumentMarker::MarkerType markerType)
     }
 }
 
-void Document::setRenderedRectForMarker(Node* node, DocumentMarker marker, const IntRect& r)
+void Document::setRenderedRectForMarker(Node* node, const DocumentMarker& marker, const IntRect& r)
 {
     MarkerMapVectorPair* vectorPair = m_markers.get(node);
     if (!vectorPair) {
@@ -3929,7 +4088,7 @@ PassRefPtr<Attr> Document::createAttributeNS(const String& namespaceURI, const S
     }
 
     // Spec: DOM Level 2 Core: http://www.w3.org/TR/DOM-Level-2-Core/core.html#ID-DocCrAttrNS
-    if (!shouldIgnoreNamespaceChecks && qName.localName() == "xmlns" && qName.namespaceURI() != "http://www.w3.org/2000/xmlns/") {
+    if (!shouldIgnoreNamespaceChecks && qName.localName() == xmlnsAtom && qName.namespaceURI() != XMLNSNames::xmlnsNamespaceURI) {
         ec = NAMESPACE_ERR;
         return 0;
     }
@@ -4024,6 +4183,7 @@ CollectionCache* Document::nameCollectionInfo(CollectionType type, const AtomicS
     NamedCollectionMap::iterator iter = map.find(name.impl());
     if (iter == map.end())
         iter = map.add(name.impl(), new CollectionCache).first;
+    iter->second->checkConsistency();
     return iter->second;
 }
 
@@ -4227,7 +4387,7 @@ void Document::setUseSecureKeyboardEntryWhenActive(bool usesSecureKeyboard)
         return;
         
     m_useSecureKeyboardEntryWhenActive = usesSecureKeyboard;
-    m_frame->updateSecureKeyboardEntryIfActive();
+    m_frame->selection()->updateSecureKeyboardEntryIfActive();
 }
 
 bool Document::useSecureKeyboardEntryWhenActive() const
@@ -4252,7 +4412,7 @@ void Document::initSecurityContext()
     // loading URL.
     const KURL& url = m_frame->loader()->url();
     m_cookieURL = url;
-    ScriptExecutionContext::setSecurityOrigin(SecurityOrigin::create(url));
+    ScriptExecutionContext::setSecurityOrigin(SecurityOrigin::create(url, m_frame->loader()->sandboxFlags()));
 
     if (SecurityOrigin::allowSubstituteDataAccessToLocal()) {
         // If this document was loaded with substituteData, then the document can
@@ -4275,6 +4435,10 @@ void Document::initSecurityContext()
           // Some clients want file:// URLs to have universal access, but that
           // setting is dangerous for other clients.
           securityOrigin()->grantUniversalAccess();
+        } else if (!settings->allowFileAccessFromFileURLs() && securityOrigin()->isLocal()) {
+          // Some clients want file:// URLs to have even tighter restrictions by
+          // default, and not be able to access other local files.
+          securityOrigin()->makeUnique();
         }
     }
 
@@ -4304,8 +4468,54 @@ void Document::setSecurityOrigin(SecurityOrigin* securityOrigin)
     initDNSPrefetch();
 }
 
-void Document::updateFocusAppearanceSoon()
+#if ENABLE(DATABASE)
+
+bool Document::isDatabaseReadOnly() const
+{
+    if (!page() || page()->settings()->privateBrowsingEnabled())
+        return true;
+    return false;
+}
+
+void Document::databaseExceededQuota(const String& name)
+{
+    Page* currentPage = page();
+    if (currentPage)
+        currentPage->chrome()->client()->exceededDatabaseQuota(document()->frame(), name);
+}
+
+#endif
+
+bool Document::isContextThread() const
+{
+    return isMainThread();
+}
+
+void Document::updateURLForPushOrReplaceState(const KURL& url)
+{
+    Frame* f = frame();
+    if (!f)
+        return;
+
+    setURL(url);
+    f->loader()->documentLoader()->replaceRequestURLForSameDocumentNavigation(url);
+}
+
+void Document::statePopped(SerializedScriptValue* stateObject)
+{
+    Frame* f = frame();
+    if (!f)
+        return;
+    
+    if (f->loader()->isComplete())
+        enqueuePopstateEvent(stateObject);
+    else
+        m_pendingStateObject = stateObject;
+}
+
+void Document::updateFocusAppearanceSoon(bool restorePreviousSelection)
 {
+    m_updateFocusAppearanceRestoresSelection = restorePreviousSelection;
     if (!m_updateFocusAppearanceTimer.isActive())
         m_updateFocusAppearanceTimer.startOneShot(0);
 }
@@ -4327,7 +4537,7 @@ void Document::updateFocusAppearanceTimerFired(Timer<Document>*)
 
     Element* element = static_cast<Element*>(node);
     if (element->isFocusable())
-        element->updateFocusAppearance(false);
+        element->updateFocusAppearance(m_updateFocusAppearanceRestoresSelection);
 }
 
 void Document::executeScriptSoonTimerFired(Timer<Document>* timer)
@@ -4358,63 +4568,12 @@ void Document::executeScriptSoon(ScriptElementData* data, CachedResourceHandle<C
         m_executeScriptSoonTimer.startOneShot(0);
 }
 
-// FF method for accessing the selection added for compatability.
+// FF method for accessing the selection added for compatibility.
 DOMSelection* Document::getSelection() const
 {
     return frame() ? frame()->domWindow()->getSelection() : 0;
 }
 
-#if ENABLE(DATABASE)
-
-void Document::addOpenDatabase(Database* database)
-{
-    if (!m_openDatabaseSet)
-        m_openDatabaseSet.set(new DatabaseSet);
-
-    ASSERT(!m_openDatabaseSet->contains(database));
-    m_openDatabaseSet->add(database);
-}
-
-void Document::removeOpenDatabase(Database* database)
-{
-    ASSERT(m_openDatabaseSet && m_openDatabaseSet->contains(database));
-    if (!m_openDatabaseSet)
-        return;
-        
-    m_openDatabaseSet->remove(database);
-}
-
-DatabaseThread* Document::databaseThread()
-{
-    if (!m_databaseThread && !m_hasOpenDatabases) {
-        // Create the database thread on first request - but not if at least one database was already opened,
-        // because in that case we already had a database thread and terminated it and should not create another.
-        m_databaseThread = DatabaseThread::create();
-        if (!m_databaseThread->start())
-            m_databaseThread = 0;
-    }
-
-    return m_databaseThread.get();
-}
-
-void Document::stopDatabases()
-{
-    if (m_openDatabaseSet) {
-        DatabaseSet::iterator i = m_openDatabaseSet->begin();
-        DatabaseSet::iterator end = m_openDatabaseSet->end();
-        for (; i != end; ++i) {
-            (*i)->stop();
-            if (m_databaseThread)
-                m_databaseThread->unscheduleDatabaseTasks(*i);
-        }
-    }
-    
-    if (m_databaseThread)
-        m_databaseThread->requestTermination();
-}
-
-#endif
-
 #if ENABLE(WML)
 void Document::resetWMLPageState()
 {
@@ -4533,51 +4692,33 @@ void Document::scriptImported(unsigned long identifier, const String& sourceStri
 #endif
 }
 
-class ScriptExecutionContextTaskTimer : public TimerBase {
-public:
-    ScriptExecutionContextTaskTimer(PassRefPtr<Document> context, PassRefPtr<ScriptExecutionContext::Task> task)
-        : m_context(context)
-        , m_task(task)
-    {
-    }
-
-private:
-    virtual void fired()
-    {
-        m_task->performTask(m_context.get());
-        delete this;
-    }
-
-    RefPtr<Document> m_context;
-    RefPtr<ScriptExecutionContext::Task> m_task;
-};
-
-struct PerformTaskContext {
-    PerformTaskContext(ScriptExecutionContext* scriptExecutionContext, PassRefPtr<ScriptExecutionContext::Task> task)
-        : scriptExecutionContext(scriptExecutionContext)
+struct PerformTaskContext : Noncopyable {
+    PerformTaskContext(PassRefPtr<DocumentWeakReference> documentReference, PassOwnPtr<ScriptExecutionContext::Task> task)
+        : documentReference(documentReference)
         , task(task)
     {
     }
 
-    ScriptExecutionContext* scriptExecutionContext; // The context should exist until task execution.
-    RefPtr<ScriptExecutionContext::Task> task;
+    RefPtr<DocumentWeakReference> documentReference;
+    OwnPtr<ScriptExecutionContext::Task> task;
 };
 
 static void performTask(void* ctx)
 {
-    PerformTaskContext* ptctx = reinterpret_cast<PerformTaskContext*>(ctx);
-    ptctx->task->performTask(ptctx->scriptExecutionContext);
-    delete ptctx;
+    ASSERT(isMainThread());
+
+    PerformTaskContext* context = reinterpret_cast<PerformTaskContext*>(ctx);
+    ASSERT(context);
+
+    if (Document* document = context->documentReference->document())
+        context->task->performTask(document);
+
+    delete context;
 }
 
-void Document::postTask(PassRefPtr<Task> task)
+void Document::postTask(PassOwnPtr<Task> task)
 {
-    if (isMainThread()) {
-        ScriptExecutionContextTaskTimer* timer = new ScriptExecutionContextTaskTimer(static_cast<Document*>(this), task);
-        timer->startOneShot(0);
-    } else {
-        callOnMainThread(performTask, new PerformTaskContext(this, task));
-    }
+    callOnMainThread(performTask, new PerformTaskContext(m_weakReference, task));
 }
 
 Element* Document::findAnchor(const String& name)
@@ -4623,6 +4764,26 @@ void Document::displayBufferModifiedByEncoding(UChar* buffer, unsigned len) cons
         m_decoder->encoding().displayBuffer(buffer, len);
 }
 
+void Document::enqueuePageshowEvent(PageshowEventPersistence persisted)
+{
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=36334 Pageshow event needs to fire asynchronously.
+    dispatchWindowEvent(PageTransitionEvent::create(eventNames().pageshowEvent, persisted), this);
+}
+
+void Document::enqueueHashchangeEvent(const String& /*oldURL*/, const String& /*newURL*/)
+{
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=36201 Hashchange event needs to fire asynchronously.
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=36335 Hashchange event is now its own interface and takes two
+    //   URL arguments which we need to pass in here.
+    dispatchWindowEvent(Event::create(eventNames().hashchangeEvent, false, false));
+}
+
+void Document::enqueuePopstateEvent(PassRefPtr<SerializedScriptValue> stateObject)
+{
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=36202 Popstate event needs to fire asynchronously
+    dispatchWindowEvent(PopStateEvent::create(stateObject));
+}
+
 #if ENABLE(XHTMLMP)
 bool Document::isXHTMLMPDocument() const
 {
@@ -4630,8 +4791,21 @@ bool Document::isXHTMLMPDocument() const
         return false;
     // As per section 7.2 of OMA-WAP-XHTMLMP-V1_1-20061020-A.pdf, a conforming user agent
     // MUST accept XHTMLMP document identified as "application/vnd.wap.xhtml+xml"
-    // and SHOULD accept it identified as "application/xhtml+xml"
-    return frame()->loader()->responseMIMEType() == "application/vnd.wap.xhtml+xml" || frame()->loader()->responseMIMEType() == "application/xhtml+xml";
+    // and SHOULD accept it identified as "application/xhtml+xml" , "application/xhtml+xml" is a 
+    // general MIME type for all XHTML documents, not only for XHTMLMP
+    return frame()->loader()->responseMIMEType() == "application/vnd.wap.xhtml+xml";
+}
+#endif
+
+#if ENABLE(INSPECTOR)
+InspectorTimelineAgent* Document::inspectorTimelineAgent() const 
+{
+    return page() ? page()->inspectorTimelineAgent() : 0;
+}
+
+InspectorController* Document::inspectorController() const 
+{
+    return page() ? page()->inspectorController() : 0;
 }
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.h b/src/3rdparty/webkit/WebCore/dom/Document.h
index 0632be1033..cc3e559e1e 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.h
+++ b/src/3rdparty/webkit/WebCore/dom/Document.h
@@ -32,10 +32,13 @@
 #include "CollectionCache.h"
 #include "CollectionType.h"
 #include "Color.h"
+#include "Document.h"
 #include "DocumentMarker.h"
-#include "Page.h"
 #include "ScriptExecutionContext.h"
 #include "Timer.h"
+#if USE(JSC)
+#include <runtime/WeakGCMap.h>
+#endif
 #include <wtf/HashCountedSet.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
@@ -61,6 +64,7 @@ namespace WebCore {
     class DocLoader;
     class DocumentFragment;
     class DocumentType;
+    class DocumentWeakReference;
     class EditingText;
     class Element;
     class EntityReference;
@@ -68,7 +72,6 @@ namespace WebCore {
     class EventListener;
     class Frame;
     class FrameView;
-    class HitTestRequest;
     class HTMLCanvasElement;
     class HTMLCollection;
     class HTMLAllCollection;
@@ -78,6 +81,8 @@ namespace WebCore {
     class HTMLHeadElement;
     class HTMLInputElement;
     class HTMLMapElement;
+    class HistoryItem;
+    class HitTestRequest;
     class InspectorTimelineAgent;
     class IntPoint;
     class DOMWrapperWorld;
@@ -85,6 +90,7 @@ namespace WebCore {
     class MouseEventWithHitTestResults;
     class NodeFilter;
     class NodeIterator;
+    class Page;
     class PlatformMouseEvent;
     class ProcessingInstruction;
     class Range;
@@ -93,6 +99,7 @@ namespace WebCore {
     class RenderView;
     class ScriptElementData;
     class SecurityOrigin;
+    class SerializedScriptValue;
     class SegmentedString;
     class Settings;
     class StyleSheet;
@@ -168,15 +175,20 @@ struct FormElementKeyHashTraits : WTF::GenericHashTraits<FormElementKey> {
     static bool isDeletedValue(const FormElementKey& value) { return value.isHashTableDeletedValue(); }
 };
 
+enum PageshowEventPersistence {
+    PageshowEventNotPersisted = 0,
+    PageshowEventPersisted = 1
+};
+    
 class Document : public ContainerNode, public ScriptExecutionContext {
 public:
     static PassRefPtr<Document> create(Frame* frame)
     {
-        return adoptRef(new Document(frame, false));
+        return adoptRef(new Document(frame, false, false));
     }
     static PassRefPtr<Document> createXHTML(Frame* frame)
     {
-        return adoptRef(new Document(frame, true));
+        return adoptRef(new Document(frame, true, false));
     }
     virtual ~Document();
 
@@ -250,6 +262,12 @@ public:
     DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(selectstart);
+#if ENABLE(TOUCH_EVENTS)
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchstart);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchmove);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchend);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchcancel);
+#endif
 
     DocumentType* doctype() const { return m_docType.get(); }
 
@@ -336,13 +354,14 @@ public:
         ASSERT(type >= FirstUnnamedDocumentCachedType);
         unsigned index = type - FirstUnnamedDocumentCachedType;
         ASSERT(index < NumUnnamedDocumentCachedTypes);
+        m_collectionInfo[index].checkConsistency();
         return &m_collectionInfo[index]; 
     }
 
     CollectionCache* nameCollectionInfo(CollectionType, const AtomicString& name);
 
     // Other methods (not part of DOM)
-    virtual bool isHTMLDocument() const { return false; }
+    bool isHTMLDocument() const { return m_isHTML; }
     virtual bool isImageDocument() const { return false; }
 #if ENABLE(SVG)
     virtual bool isSVGDocument() const { return false; }
@@ -361,7 +380,12 @@ public:
 #endif
     virtual bool isFrameSet() const { return false; }
     
-    CSSStyleSelector* styleSelector() const { return m_styleSelector; }
+    CSSStyleSelector* styleSelector()
+    { 
+        if (!m_styleSelector)
+            createStyleSelector();
+        return m_styleSelector.get();
+    }
 
     Element* getElementByAccessKey(const String& key) const;
     
@@ -431,6 +455,7 @@ public:
     Settings* settings() const; // can be NULL
 #if ENABLE(INSPECTOR)
     InspectorTimelineAgent* inspectorTimelineAgent() const; // can be NULL
+    virtual InspectorController* inspectorController() const; // can be NULL
 #endif
 
     PassRefPtr<Range> createRange();
@@ -450,13 +475,14 @@ public:
     virtual void updateStyleIfNeeded();
     void updateLayout();
     void updateLayoutIgnorePendingStylesheets();
+    PassRefPtr<RenderStyle> styleForElementIgnoringPendingStylesheets(Element*);
     static void updateStyleForAllDocuments(); // FIXME: Try to reduce the # of calls to this function.
-    DocLoader* docLoader() { return m_docLoader; }
+    DocLoader* docLoader() { return m_docLoader.get(); }
 
     virtual void attach();
     virtual void detach();
 
-    RenderArena* renderArena() { return m_renderArena; }
+    RenderArena* renderArena() { return m_renderArena.get(); }
 
     RenderView* renderView() const;
 
@@ -465,6 +491,7 @@ public:
     
     // to get visually ordered hebrew and arabic pages right
     void setVisuallyOrdered();
+    bool visuallyOrdered() const { return m_visuallyOrdered; }
 
     void open(Document* ownerDocument = 0);
     void implicitOpen();
@@ -504,7 +531,7 @@ public:
     CSSStyleSheet* mappedElementSheet();
     
     virtual Tokenizer* createTokenizer();
-    Tokenizer* tokenizer() { return m_tokenizer; }
+    Tokenizer* tokenizer() { return m_tokenizer.get(); }
     
     bool printing() const { return m_printing; }
     void setPrinting(bool p) { m_printing = p; }
@@ -521,6 +548,10 @@ public:
     void setParsing(bool);
     bool parsing() const { return m_bParsing; }
     int minimumLayoutDelay();
+
+    // This method is used by Android.
+    void setExtraLayoutDelay(int delay) { m_extraLayoutDelay = delay; }
+
     bool shouldScheduleLayout();
     int elapsedTime() const;
     
@@ -618,7 +649,8 @@ public:
         ANIMATIONSTART_LISTENER              = 0x200,
         ANIMATIONITERATION_LISTENER          = 0x400,
         TRANSITIONEND_LISTENER               = 0x800,
-        BEFORELOAD_LISTENER                  = 0x1000
+        BEFORELOAD_LISTENER                  = 0x1000,
+        TOUCH_LISTENER                       = 0x2000
     };
 
     bool hasListenerType(ListenerType listenerType) const { return (m_listenerTypes & listenerType); }
@@ -675,8 +707,8 @@ public:
     void setTitle(const String&, Element* titleElement = 0);
     void removeTitle(Element* titleElement);
 
-    String cookie() const;
-    void setCookie(const String&);
+    String cookie(ExceptionCode&) const;
+    void setCookie(const String&, ExceptionCode&);
 
     String referrer() const;
 
@@ -685,8 +717,28 @@ public:
 
     String lastModified() const;
 
+    // The cookieURL is used to query the cookie database for this document's
+    // cookies. For example, if the cookie URL is http://example.com, we'll
+    // use the non-Secure cookies for example.com when computing
+    // document.cookie.
+    //
+    // Q: How is the cookieURL different from the document's URL?
+    // A: The two URLs are the same almost all the time.  However, if one
+    //    document inherits the security context of another document, it
+    //    inherits its cookieURL but not its URL.
+    //
     const KURL& cookieURL() const { return m_cookieURL; }
 
+    // The firstPartyForCookies is used to compute whether this document
+    // appears in a "third-party" context for the purpose of third-party
+    // cookie blocking.  The document is in a third-party context if the
+    // cookieURL and the firstPartyForCookies are from different hosts.
+    //
+    // Note: Some ports (including possibly Apple's) only consider the
+    //       document in a third-party context if the cookieURL and the
+    //       firstPartyForCookies have a different registry-controlled
+    //       domain.
+    //
     const KURL& firstPartyForCookies() const { return m_firstPartyForCookies; }
     void setFirstPartyForCookies(const KURL& url) { m_firstPartyForCookies = url; }
     
@@ -730,7 +782,7 @@ public:
     void removeMarkers(DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     void removeMarkers(Node*);
     void repaintMarkers(DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
-    void setRenderedRectForMarker(Node*, DocumentMarker, const IntRect&);
+    void setRenderedRectForMarker(Node*, const DocumentMarker&, const IntRect&);
     void invalidateRenderedRectsForMarkersInRect(const IntRect&);
     void shiftMarkers(Node*, unsigned startOffset, int delta, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     void setMarkersActive(Range*, bool);
@@ -764,7 +816,7 @@ public:
 
 #if ENABLE(XBL)
     // XBL methods
-    XBLBindingManager* bindingManager() const { return m_bindingManager; }
+    XBLBindingManager* bindingManager() const { return m_bindingManager.get(); }
 #endif
 
     void incDOMTreeVersion() { ++m_domtree_version; }
@@ -802,10 +854,10 @@ public:
     void removeNodeListCache() { ASSERT(m_numNodeListCaches > 0); --m_numNodeListCaches; }
     bool hasNodeListCaches() const { return m_numNodeListCaches; }
 
-    void updateFocusAppearanceSoon();
+    void updateFocusAppearanceSoon(bool restorePreviousSelection);
     void cancelFocusAppearanceUpdate();
         
-    // FF method for accessing the selection added for compatability.
+    // FF method for accessing the selection added for compatibility.
     DOMSelection* getSelection() const;
     
     // Extension for manipulating canvas drawing contexts for use in CSS
@@ -819,18 +871,15 @@ public:
     virtual void addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
     virtual void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
     virtual void scriptImported(unsigned long, const String&);
-    virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
+    virtual void postTask(PassOwnPtr<Task>); // Executes the task on context's thread asynchronously.
 
-    typedef HashMap<WebCore::Node*, JSNode*> JSWrapperCache;
+#if USE(JSC)
+    typedef JSC::WeakGCMap<WebCore::Node*, JSNode*> JSWrapperCache;
     typedef HashMap<DOMWrapperWorld*, JSWrapperCache*> JSWrapperCacheMap;
     JSWrapperCacheMap& wrapperCacheMap() { return m_wrapperCacheMap; }
-    JSWrapperCache* getWrapperCache(DOMWrapperWorld* world)
-    {
-        if (JSWrapperCache* wrapperCache = m_wrapperCacheMap.get(world))
-            return wrapperCache;
-        return createWrapperCache(world);
-    }
+    JSWrapperCache* getWrapperCache(DOMWrapperWorld* world);
     JSWrapperCache* createWrapperCache(DOMWrapperWorld*);
+#endif
 
     virtual void finishedParsing();
 
@@ -887,17 +936,18 @@ public:
     //       that already contains content.
     void setSecurityOrigin(SecurityOrigin*);
 
+    void updateURLForPushOrReplaceState(const KURL&);
+    void statePopped(SerializedScriptValue*);
+
     bool processingLoadEvent() const { return m_processingLoadEvent; }
 
 #if ENABLE(DATABASE)
-    void addOpenDatabase(Database*);
-    void removeOpenDatabase(Database*);
-    DatabaseThread* databaseThread();   // Creates the thread as needed, but not if it has been already terminated.
-    void setHasOpenDatabases() { m_hasOpenDatabases = true; }
-    bool hasOpenDatabases() { return m_hasOpenDatabases; }
-    void stopDatabases();
+    virtual bool isDatabaseReadOnly() const;
+    virtual void databaseExceededQuota(const String& name);
 #endif
 
+    virtual bool isContextThread() const;
+
     void setUsingGeolocation(bool f) { m_usingGeolocation = f; }
     bool usingGeolocation() const { return m_usingGeolocation; };
 
@@ -908,11 +958,16 @@ public:
     void resetWMLPageState();
     void initializeWMLPageState();
 #endif
+    
+    bool containsValidityStyleRules() const { return m_containsValidityStyleRules; }
+    void setContainsValidityStyleRules() { m_containsValidityStyleRules = true; }
 
-protected:
-    Document(Frame*, bool isXHTML);
+    void enqueueEvent(PassRefPtr<Event>);
+    void enqueuePageshowEvent(PageshowEventPersistence);
+    void enqueueHashchangeEvent(const String& oldURL, const String& newURL);
 
-    void setStyleSelector(CSSStyleSelector* styleSelector) { m_styleSelector = styleSelector; }
+protected:
+    Document(Frame*, bool isXHTML, bool isHTML);
 
     void clearXMLVersion() { m_xmlVersion = String(); }
 
@@ -947,12 +1002,17 @@ private:
 
     void cacheDocumentElement() const;
 
-    CSSStyleSelector* m_styleSelector;
+    void createStyleSelector();
+
+    void enqueuePopstateEvent(PassRefPtr<SerializedScriptValue> stateObject);
+    void pendingEventTimerFired(Timer<Document>*);
+
+    OwnPtr<CSSStyleSelector> m_styleSelector;
     bool m_didCalculateStyleSelector;
 
     Frame* m_frame;
-    DocLoader* m_docLoader;
-    Tokenizer* m_tokenizer;
+    OwnPtr<DocLoader> m_docLoader;
+    OwnPtr<Tokenizer> m_tokenizer;
     bool m_wellFormed;
 
     // Document URLs.
@@ -1032,7 +1092,7 @@ private:
     String m_selectedStylesheetSet;
 
     bool m_loadingSheet;
-    bool visuallyOrdered;
+    bool m_visuallyOrdered;
     bool m_bParsing;
     Timer<Document> m_styleRecalcTimer;
     bool m_inStyleRecalc;
@@ -1047,12 +1107,15 @@ private:
     bool m_isDNSPrefetchEnabled;
     bool m_haveExplicitlyDisabledDNSPrefetch;
     bool m_frameElementsShouldIgnoreScrolling;
+    bool m_containsValidityStyleRules;
+    bool m_updateFocusAppearanceRestoresSelection;
 
     String m_title;
+    String m_rawTitle;
     bool m_titleSetExplicitly;
     RefPtr<Element> m_titleElement;
-    
-    RenderArena* m_renderArena;
+
+    OwnPtr<RenderArena> m_renderArena;
 
     typedef std::pair<Vector<DocumentMarker>, Vector<IntRect> > MarkerMapVectorPair;
     typedef HashMap<RefPtr<Node>, MarkerMapVectorPair*> MarkerMap;
@@ -1065,8 +1128,14 @@ private:
     Element* m_cssTarget;
     
     bool m_processingLoadEvent;
+    RefPtr<SerializedScriptValue> m_pendingStateObject;
+    HashSet<RefPtr<HistoryItem> > m_associatedHistoryItems;
     double m_startTime;
     bool m_overMinimumLayoutThreshold;
+    // This is used to increase the minimum delay between re-layouts. It is set
+    // using setExtraLayoutDelay to modify the minimum delay used at different
+    // points during the lifetime of the Document.
+    int m_extraLayoutDelay;
 
     Vector<std::pair<ScriptElementData*, CachedResourceHandle<CachedScript> > > m_scriptsToExecuteSoon;
     Timer<Document> m_executeScriptSoonTimer;
@@ -1077,7 +1146,7 @@ private:
 #endif
 
 #if ENABLE(XBL)
-    XBLBindingManager* m_bindingManager; // The access point through which documents and elements communicate with XBL.
+    OwnPtr<XBLBindingManager> m_bindingManager; // The access point through which documents and elements communicate with XBL.
 #endif
     
     typedef HashMap<AtomicStringImpl*, HTMLMapElement*> ImageMapsByName;
@@ -1096,7 +1165,6 @@ private:
 #endif
 
     RenderObject* m_savedRenderer;
-    int m_secureForms;
     
     RefPtr<TextResourceDecoder> m_decoder;
 
@@ -1145,23 +1213,25 @@ private:
     bool m_useSecureKeyboardEntryWhenActive;
 
     bool m_isXHTML;
+    bool m_isHTML;
 
     unsigned m_numNodeListCaches;
 
+#if USE(JSC)
     JSWrapperCacheMap m_wrapperCacheMap;
-
-#if ENABLE(DATABASE)
-    RefPtr<DatabaseThread> m_databaseThread;
-    bool m_hasOpenDatabases;    // This never changes back to false, even as the database thread is closed.
-    typedef HashSet<Database*> DatabaseSet;
-    OwnPtr<DatabaseSet> m_openDatabaseSet;
+    JSWrapperCache* m_normalWorldWrapperCache;
 #endif
-    
+
     bool m_usingGeolocation;
 
+    Timer<Document> m_pendingEventTimer;
+    Vector<RefPtr<Event> > m_pendingEventQueue;
+
 #if ENABLE(WML)
     bool m_containsWMLContent;
 #endif
+
+    RefPtr<DocumentWeakReference> m_weakReference;
 };
 
 inline bool Document::hasElementWithId(AtomicStringImpl* id) const
@@ -1175,12 +1245,6 @@ inline bool Node::isDocumentNode() const
     return this == m_document;
 }
 
-#if ENABLE(INSPECTOR)
-inline InspectorTimelineAgent* Document::inspectorTimelineAgent() const {
-    return page() ? page()->inspectorTimelineAgent() : 0;
-}
-#endif
-
 } // namespace WebCore
 
 #endif // Document_h
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.idl b/src/3rdparty/webkit/WebCore/dom/Document.idl
index e9b5480571..26ed7fd3ee 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Document.idl
@@ -22,12 +22,9 @@ module core {
 
     interface [
         CustomToJS,
-        GenerateConstructor,
         GenerateNativeConverter,
         CustomMarkFunction,
-        InlineGetOwnPropertySlot,
-        InterfaceUUID=48BB95FC-2D08-4c54-BE65-7558736A4CAE,
-        ImplementationUUID=FF5CBE81-F817-429c-A6C2-0CCCD2328062
+        InlineGetOwnPropertySlot
     ] Document : Node {
 
         // DOM Level 1 Core
@@ -35,7 +32,7 @@ module core {
         readonly attribute [V8Custom] DOMImplementation implementation;
         readonly attribute Element documentElement;
 
-        [ReturnsNew] Element createElement(in [ConvertNullToNullString, HintAtomic] DOMString tagName)
+        [ReturnsNew] Element createElement(in [ConvertNullToNullString] DOMString tagName)
             raises (DOMException);
         DocumentFragment   createDocumentFragment();
         [ReturnsNew] Text createTextNode(in DOMString data);
@@ -64,7 +61,7 @@ module core {
             raises (DOMException);
         [OldStyleObjC] NodeList getElementsByTagNameNS(in [ConvertNullToNullString] DOMString namespaceURI,
                                                        in DOMString localName);
-        Element            getElementById(in [HintAtomic] DOMString elementId);
+        Element            getElementById(in DOMString elementId);
 
         // DOM Level 3 Core
 
@@ -81,7 +78,6 @@ module core {
 
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString documentURI;
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // DOM Level 2 Events (DocumentEvents interface)
 
         Event              createEvent(in DOMString eventType)
@@ -129,7 +125,6 @@ module core {
                                                       in XPathResult inResult)
             raises(DOMException);
 #endif // ENABLE_XPATH
-#endif // !defined(LANGUAGE_COM)
 
         // Common extensions
 
@@ -162,19 +157,16 @@ module core {
 #endif
         readonly attribute DOMString URL;
 
-        // FIXME: the DOM spec states that this attribute can 
-        // raise an exception on setting.
                  attribute [ConvertNullToNullString] DOMString cookie
-                     /*setter raises (DOMException)*/;
+                     setter raises (DOMException),
+                     getter raises (DOMException);
 
         // FIXME: the DOM spec does NOT have this attribute
         // raising an exception.
                  attribute HTMLElement body
                      setter raises (DOMException);
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute HTMLHeadElement head;
-#endif
         readonly attribute HTMLCollection images;
         readonly attribute HTMLCollection applets;
         readonly attribute HTMLCollection links;
@@ -195,9 +187,7 @@ module core {
         readonly attribute [ConvertNullStringTo=Undefined] DOMString readyState;
 
         Element            elementFromPoint(in long x, in long y);
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         Range              caretRangeFromPoint(in long x, in long y);
-#endif
 
         // Mozilla extensions
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
@@ -210,11 +200,9 @@ module core {
         readonly attribute [ConvertNullStringTo=Null] DOMString preferredStylesheetSet;
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString selectedStylesheetSet;
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         CSSStyleDeclaration createCSSStyleDeclaration();
 #endif
-#endif
 
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // DOM Level 2 Style Interface
@@ -231,11 +219,9 @@ module core {
                                                   
 #endif
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
         [V8Custom] DOMObject getCSSCanvasContext(in DOMString contextId, in DOMString name, in long width, in long height);
 #endif
-#endif
 
         // HTML 5
         NodeList getElementsByClassName(in DOMString tagname);
@@ -253,7 +239,6 @@ module core {
 #endif
 
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Event handler DOM attributes
         attribute [DontEnum] EventListener onabort;
         attribute [DontEnum] EventListener onblur;
@@ -321,6 +306,11 @@ module core {
         attribute [DontEnum] EventListener onreset;
         attribute [DontEnum] EventListener onsearch;
         attribute [DontEnum] EventListener onselectstart;
+#if defined(ENABLE_TOUCH_EVENTS) && ENABLE_TOUCH_EVENTS
+        attribute [DontEnum] EventListener ontouchstart;
+        attribute [DontEnum] EventListener ontouchmove;
+        attribute [DontEnum] EventListener ontouchend;
+        attribute [DontEnum] EventListener ontouchcancel;
 #endif
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl b/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl
index ff6232f415..882b62db39 100644
--- a/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl
+++ b/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=F5C8DAF0-D728-4b2b-9D9C-630621B07D35,
-        ImplementationUUID=E57BF71F-3FAA-495c-A307-E288F8E5B2EC
-    ] DocumentFragment : Node {
+    interface DocumentFragment : Node {
         // NodeSelector - Selector API
         Element querySelector(in DOMString selectors)
             raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/dom/DocumentType.cpp b/src/3rdparty/webkit/WebCore/dom/DocumentType.cpp
index b8185e7671..9012b6889b 100644
--- a/src/3rdparty/webkit/WebCore/dom/DocumentType.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/DocumentType.cpp
@@ -23,7 +23,6 @@
 #include "config.h"
 #include "DocumentType.h"
 
-#include "DOMImplementation.h"
 #include "Document.h"
 #include "NamedNodeMap.h"
 
diff --git a/src/3rdparty/webkit/WebCore/dom/DocumentType.idl b/src/3rdparty/webkit/WebCore/dom/DocumentType.idl
index ef7b5b69a7..7992dc5000 100644
--- a/src/3rdparty/webkit/WebCore/dom/DocumentType.idl
+++ b/src/3rdparty/webkit/WebCore/dom/DocumentType.idl
@@ -20,10 +20,7 @@
 module core {
 
     interface [
-        GenerateConstructor,
-        GenerateNativeConverter,
-        InterfaceUUID=20F04535-A423-4273-8CFE-3AD996100D29,
-        ImplementationUUID=736D952F-DBAF-458b-834B-F1638700BD88
+        GenerateNativeConverter
     ] DocumentType : Node {
 
         // DOM Level 1
diff --git a/src/3rdparty/webkit/WebCore/dom/DynamicNodeList.cpp b/src/3rdparty/webkit/WebCore/dom/DynamicNodeList.cpp
index 892a5e7712..3f0744b88f 100644
--- a/src/3rdparty/webkit/WebCore/dom/DynamicNodeList.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/DynamicNodeList.cpp
@@ -129,7 +129,9 @@ Node* DynamicNodeList::itemWithName(const AtomicString& elementId) const
                     return node;
             }
         }
-        return 0;
+        if (!node)
+            return 0;
+        // In the case of multiple nodes with the same name, just fall through.
     }
 
     unsigned length = this->length();
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.cpp b/src/3rdparty/webkit/WebCore/dom/Element.cpp
index 0692999623..8711110a46 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Element.cpp
@@ -35,6 +35,7 @@
 #include "ClientRect.h"
 #include "ClientRectList.h"
 #include "Document.h"
+#include "DocumentFragment.h"
 #include "ElementRareData.h"
 #include "ExceptionCode.h"
 #include "FocusController.h"
@@ -42,13 +43,17 @@
 #include "FrameView.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
+#include "HTMLTokenizer.h"
+#include "InspectorController.h"
 #include "NamedNodeMap.h"
 #include "NodeList.h"
 #include "NodeRenderStyle.h"
 #include "Page.h"
 #include "RenderView.h"
+#include "RenderWidget.h"
 #include "TextIterator.h"
 #include "XMLNames.h"
+#include "XMLTokenizer.h"
 
 #if ENABLE(SVG)
 #include "SVGNames.h"
@@ -91,6 +96,51 @@ NodeRareData* Element::createRareData()
 {
     return new ElementRareData;
 }
+
+PassRefPtr<DocumentFragment> Element::createContextualFragment(const String& markup, FragmentScriptingPermission scriptingPermission)
+{
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(document());
+    
+    if (document()->isHTMLDocument())
+        parseHTMLDocumentFragment(markup, fragment.get(), scriptingPermission);
+    else {
+        if (!parseXMLDocumentFragment(markup, fragment.get(), this, scriptingPermission))
+            // FIXME: We should propagate a syntax error exception out here.
+            return 0;
+    }
+    
+    // Exceptions are ignored because none ought to happen here.
+    ExceptionCode ignoredExceptionCode;
+    
+    // We need to pop <html> and <body> elements and remove <head> to
+    // accommodate folks passing complete HTML documents to make the
+    // child of an element.
+    
+    RefPtr<Node> nextNode;
+    for (RefPtr<Node> node = fragment->firstChild(); node; node = nextNode) {
+        nextNode = node->nextSibling();
+        if (node->hasTagName(htmlTag) || node->hasTagName(bodyTag)) {
+            Node* firstChild = node->firstChild();
+            if (firstChild)
+                nextNode = firstChild;
+            RefPtr<Node> nextChild;
+            for (RefPtr<Node> child = firstChild; child; child = nextChild) {
+                nextChild = child->nextSibling();
+                node->removeChild(child.get(), ignoredExceptionCode);
+                ASSERT(!ignoredExceptionCode);
+                fragment->insertBefore(child, node.get(), ignoredExceptionCode);
+                ASSERT(!ignoredExceptionCode);
+            }
+            fragment->removeChild(node.get(), ignoredExceptionCode);
+            ASSERT(!ignoredExceptionCode);
+        } else if (node->hasTagName(headTag)) {
+            fragment->removeChild(node.get(), ignoredExceptionCode);
+            ASSERT(!ignoredExceptionCode);
+        }
+    }
+    
+    return fragment.release();
+}
     
 PassRefPtr<Node> Element::cloneNode(bool deep)
 {
@@ -111,11 +161,11 @@ PassRefPtr<Element> Element::cloneElementWithoutChildren()
     // This is a sanity check as HTML overloads some of the DOM methods.
     ASSERT(isHTMLElement() == clone->isHTMLElement());
 
+    clone->copyNonAttributeProperties(this);
+
     // Clone attributes.
     if (namedAttrMap)
         clone->attributes()->setAttributes(*attributes(true)); // Call attributes(true) to force attribute synchronization to occur (for svg and style) before cloning happens.
-
-    clone->copyNonAttributeProperties(this);
     
     return clone.release();
 }
@@ -135,6 +185,12 @@ void Element::setAttribute(const QualifiedName& name, const AtomicString& value)
     ExceptionCode ec;
     setAttribute(name, value, ec);
 }
+    
+void Element::setCStringAttribute(const QualifiedName& name, const char* cStringValue)
+{
+    ExceptionCode ec;
+    setAttribute(name, AtomicString(cStringValue), ec);
+}
 
 void Element::setBooleanAttribute(const QualifiedName& name, bool b)
 {
@@ -152,21 +208,6 @@ NamedNodeMap* Element::attributes() const
     return attributes(false);
 }
 
-NamedNodeMap* Element::attributes(bool readonly) const
-{
-    if (!m_isStyleAttributeValid)
-        updateStyleAttribute();
-
-#if ENABLE(SVG)
-    if (!m_areSVGAttributesValid)
-        updateAnimatedSVGAttribute(String());
-#endif
-
-    if (!readonly && !namedAttrMap)
-        createAttributeMap();
-    return namedAttrMap.get();
-}
-
 Node::NodeType Element::nodeType() const
 {
     return ELEMENT_NODE;
@@ -189,7 +230,7 @@ const AtomicString& Element::getAttribute(const QualifiedName& name) const
 
 #if ENABLE(SVG)
     if (!m_areSVGAttributesValid)
-        updateAnimatedSVGAttribute(name.localName());
+        updateAnimatedSVGAttribute(name);
 #endif
 
     if (namedAttrMap)
@@ -488,18 +529,22 @@ static inline bool shouldIgnoreAttributeCase(const Element* e)
 
 const AtomicString& Element::getAttribute(const String& name) const
 {
-    String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-    if (localName == styleAttr.localName() && !m_isStyleAttributeValid)
+    bool ignoreCase = shouldIgnoreAttributeCase(this);
+    
+    // Update the 'style' attribute if it's invalid and being requested:
+    if (!m_isStyleAttributeValid && equalPossiblyIgnoringCase(name, styleAttr.localName(), ignoreCase))
         updateStyleAttribute();
 
 #if ENABLE(SVG)
-    if (!m_areSVGAttributesValid)
-        updateAnimatedSVGAttribute(name);
+    if (!m_areSVGAttributesValid) {
+        // We're not passing a namespace argument on purpose. SVGNames::*Attr are defined w/o namespaces as well.
+        updateAnimatedSVGAttribute(QualifiedName(nullAtom, name, nullAtom));
+    }
 #endif
 
     if (namedAttrMap)
-        if (Attribute* a = namedAttrMap->getAttributeItem(name, shouldIgnoreAttributeCase(this)))
-            return a->value();
+        if (Attribute* attribute = namedAttrMap->getAttributeItem(name, ignoreCase))
+            return attribute->value();
     
     return nullAtom;
 }
@@ -516,20 +561,16 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
         return;
     }
 
-#if COMPILER(RVCT)
-    const AtomicString localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-#else
     const AtomicString& localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-#endif
 
     // allocate attributemap if necessary
     Attribute* old = attributes(false)->getAttributeItem(localName, false);
 
     document()->incDOMTreeVersion();
 
-    if (localName == idAttr.localName())
+    if (localName == idAttributeName().localName())
         updateId(old ? old->value() : nullAtom, value);
-    
+
     if (old && value.isNull())
         namedAttrMap->removeAttribute(old->name());
     else if (!old && !value.isNull())
@@ -538,6 +579,15 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
         old->setValue(value);
         attributeChanged(old);
     }
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = document()->page()) {
+        if (InspectorController* inspectorController = page->inspectorController()) {
+            if (!m_synchronizingStyleAttribute)
+                inspectorController->didModifyDOMAttr(this);
+        }
+    }
+#endif
 }
 
 void Element::setAttribute(const QualifiedName& name, const AtomicString& value, ExceptionCode&)
@@ -547,9 +597,9 @@ void Element::setAttribute(const QualifiedName& name, const AtomicString& value,
     // allocate attributemap if necessary
     Attribute* old = attributes(false)->getAttributeItem(name);
 
-    if (name == idAttr)
+    if (name == idAttributeName())
         updateId(old ? old->value() : nullAtom, value);
-    
+
     if (old && value.isNull())
         namedAttrMap->removeAttribute(name);
     else if (!old && !value.isNull())
@@ -558,6 +608,15 @@ void Element::setAttribute(const QualifiedName& name, const AtomicString& value,
         old->setValue(value);
         attributeChanged(old);
     }
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = document()->page()) {
+        if (InspectorController* inspectorController = page->inspectorController()) {
+            if (!m_synchronizingStyleAttribute)
+                inspectorController->didModifyDOMAttr(this);
+        }
+    }
+#endif
 }
 
 PassRefPtr<Attribute> Element::createAttribute(const QualifiedName& name, const AtomicString& value)
@@ -573,20 +632,22 @@ void Element::attributeChanged(Attribute* attr, bool)
 
 void Element::updateAfterAttributeChanged(Attribute* attr)
 {
-    AXObjectCache* axObjectCache = document()->axObjectCache();
-    if (!axObjectCache->accessibilityEnabled())
+    if (!AXObjectCache::accessibilityEnabled())
         return;
 
     const QualifiedName& attrName = attr->name();
     if (attrName == aria_activedescendantAttr) {
         // any change to aria-activedescendant attribute triggers accessibility focus change, but document focus remains intact
-        axObjectCache->handleActiveDescendantChanged(renderer());
+        document()->axObjectCache()->handleActiveDescendantChanged(renderer());
     } else if (attrName == roleAttr) {
         // the role attribute can change at any time, and the AccessibilityObject must pick up these changes
-        axObjectCache->handleAriaRoleChanged(renderer());
+        document()->axObjectCache()->handleAriaRoleChanged(renderer());
     } else if (attrName == aria_valuenowAttr) {
         // If the valuenow attribute changes, AX clients need to be notified.
-        axObjectCache->postNotification(renderer(), AXObjectCache::AXValueChanged, true);
+        document()->axObjectCache()->postNotification(renderer(), AXObjectCache::AXValueChanged, true);
+    } else if (attrName == aria_labelAttr || attrName == aria_labeledbyAttr || attrName == altAttr || attrName == titleAttr) {
+        // If the content of an element changes due to an attribute change, notify accessibility.
+        document()->axObjectCache()->contentChanged(renderer());
     }
 }
     
@@ -595,15 +656,31 @@ void Element::recalcStyleIfNeededAfterAttributeChanged(Attribute* attr)
     if (document()->attached() && document()->styleSelector()->hasSelectorForAttribute(attr->name().localName()))
         setNeedsStyleRecalc();
 }
-        
-void Element::setAttributeMap(PassRefPtr<NamedNodeMap> list)
+
+// Returns true is the given attribute is an event handler.
+// We consider an event handler any attribute that begins with "on".
+// It is a simple solution that has the advantage of not requiring any
+// code or configuration change if a new event handler is defined.
+
+static bool isEventHandlerAttribute(const QualifiedName& name)
+{
+    return name.namespaceURI().isNull() && name.localName().startsWith("on");
+}
+
+static bool isAttributeToRemove(const QualifiedName& name, const AtomicString& value)
+{    
+    return (name.localName().endsWith(hrefAttr.localName()) || name == srcAttr || name == actionAttr) && protocolIsJavaScript(deprecatedParseURL(value));       
+}
+
+void Element::setAttributeMap(PassRefPtr<NamedNodeMap> list, FragmentScriptingPermission scriptingPermission)
 {
     document()->incDOMTreeVersion();
 
     // If setting the whole map changes the id attribute, we need to call updateId.
 
-    Attribute* oldId = namedAttrMap ? namedAttrMap->getAttributeItem(idAttr) : 0;
-    Attribute* newId = list ? list->getAttributeItem(idAttr) : 0;
+    const QualifiedName& idName = idAttributeName();
+    Attribute* oldId = namedAttrMap ? namedAttrMap->getAttributeItem(idName) : 0;
+    Attribute* newId = list ? list->getAttributeItem(idName) : 0;
 
     if (oldId || newId)
         updateId(oldId ? oldId->value() : nullAtom, newId ? newId->value() : nullAtom);
@@ -615,6 +692,22 @@ void Element::setAttributeMap(PassRefPtr<NamedNodeMap> list)
 
     if (namedAttrMap) {
         namedAttrMap->m_element = this;
+        // If the element is created as result of a paste or drag-n-drop operation
+        // we want to remove all the script and event handlers.
+        if (scriptingPermission == FragmentScriptingNotAllowed) {
+            unsigned i = 0;
+            while (i < namedAttrMap->length()) {
+                const QualifiedName& attributeName = namedAttrMap->m_attributes[i]->name();
+                if (isEventHandlerAttribute(attributeName)) {
+                    namedAttrMap->m_attributes.remove(i);
+                    continue;
+                }
+
+                if (isAttributeToRemove(attributeName, namedAttrMap->m_attributes[i]->value()))
+                    namedAttrMap->m_attributes[i]->setValue(nullAtom);
+                i++;
+            }
+        }
         unsigned len = namedAttrMap->length();
         for (unsigned i = 0; i < len; i++)
             attributeChanged(namedAttrMap->m_attributes[i].get());
@@ -629,7 +722,7 @@ bool Element::hasAttributes() const
 
 #if ENABLE(SVG)
     if (!m_areSVGAttributesValid)
-        updateAnimatedSVGAttribute(String());
+        updateAnimatedSVGAttribute(anyQName());
 #endif
 
     return namedAttrMap && namedAttrMap->length() > 0;
@@ -645,19 +738,20 @@ String Element::nodeNamePreservingCase() const
     return m_tagName.toString();
 }
 
-void Element::setPrefix(const AtomicString &_prefix, ExceptionCode& ec)
+void Element::setPrefix(const AtomicString& prefix, ExceptionCode& ec)
 {
     ec = 0;
-    checkSetPrefix(_prefix, ec);
+    checkSetPrefix(prefix, ec);
     if (ec)
         return;
 
-    m_tagName.setPrefix(_prefix);
+    m_tagName.setPrefix(prefix.isEmpty() ? AtomicString() : prefix);
 }
 
 KURL Element::baseURI() const
 {
-    KURL base(KURL(), getAttribute(baseAttr));
+    const AtomicString& baseAttribute = getAttribute(baseAttr);
+    KURL base(KURL(), baseAttribute);
     if (!base.protocol().isEmpty())
         return base;
 
@@ -669,7 +763,7 @@ KURL Element::baseURI() const
     if (parentBase.isNull())
         return base;
 
-    return KURL(parentBase, base.string());
+    return KURL(parentBase, baseAttribute);
 }
 
 void Element::createAttributeMap() const
@@ -708,7 +802,7 @@ void Element::insertedIntoDocument()
 
     if (hasID()) {
         if (NamedNodeMap* attrs = namedAttrMap.get()) {
-            Attribute* idItem = attrs->getAttributeItem(idAttr);
+            Attribute* idItem = attrs->getAttributeItem(idAttributeName());
             if (idItem && !idItem->isNull())
                 updateId(nullAtom, idItem->value());
         }
@@ -719,7 +813,7 @@ void Element::removedFromDocument()
 {
     if (hasID()) {
         if (NamedNodeMap* attrs = namedAttrMap.get()) {
-            Attribute* idItem = attrs->getAttributeItem(idAttr);
+            Attribute* idItem = attrs->getAttributeItem(idAttributeName());
             if (idItem && !idItem->isNull())
                 updateId(idItem->value(), nullAtom);
         }
@@ -731,6 +825,7 @@ void Element::removedFromDocument()
 void Element::attach()
 {
     suspendPostAttachCallbacks();
+    RenderWidget::suspendWidgetHierarchyUpdates();
 
     createRendererIfNeeded();
     ContainerNode::attach();
@@ -738,20 +833,25 @@ void Element::attach()
         ElementRareData* data = rareData();
         if (data->needsFocusAppearanceUpdateSoonAfterAttach()) {
             if (isFocusable() && document()->focusedNode() == this)
-                document()->updateFocusAppearanceSoon();
+                document()->updateFocusAppearanceSoon(false /* don't restore selection */);
             data->setNeedsFocusAppearanceUpdateSoonAfterAttach(false);
         }
     }
 
+    RenderWidget::resumeWidgetHierarchyUpdates();
     resumePostAttachCallbacks();
 }
 
 void Element::detach()
 {
+    RenderWidget::suspendWidgetHierarchyUpdates();
+
     cancelFocusAppearanceUpdate();
     if (hasRareData())
         rareData()->resetComputedStyle();
     ContainerNode::detach();
+
+    RenderWidget::resumeWidgetHierarchyUpdates();
 }
 
 bool Element::pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle)
@@ -990,6 +1090,7 @@ void Element::finishParsingChildren()
 void Element::dispatchAttrRemovalEvent(Attribute*)
 {
     ASSERT(!eventDispatchForbidden());
+
 #if 0
     if (!document()->hasListenerType(Document::DOMATTRMODIFIED_LISTENER))
         return;
@@ -1002,6 +1103,7 @@ void Element::dispatchAttrRemovalEvent(Attribute*)
 void Element::dispatchAttrAdditionEvent(Attribute*)
 {
     ASSERT(!eventDispatchForbidden());
+
 #if 0
     if (!document()->hasListenerType(Document::DOMATTRMODIFIED_LISTENER))
         return;
@@ -1036,21 +1138,6 @@ String Element::openTagStartToString() const
     return result;
 }
 
-void Element::updateId(const AtomicString& oldId, const AtomicString& newId)
-{
-    if (!inDocument())
-        return;
-
-    if (oldId == newId)
-        return;
-
-    Document* doc = document();
-    if (!oldId.isEmpty())
-        doc->removeElementById(oldId, this);
-    if (!newId.isEmpty())
-        doc->addElementById(newId, this);
-}
-
 #ifndef NDEBUG
 void Element::formatForDebugger(char* buffer, unsigned length) const
 {
@@ -1062,7 +1149,7 @@ void Element::formatForDebugger(char* buffer, unsigned length) const
         result += s;
     }
           
-    s = getAttribute(idAttr);
+    s = getAttribute(idAttributeName());
     if (s.length() > 0) {
         if (result.length() > 0)
             result += "; ";
@@ -1122,13 +1209,17 @@ PassRefPtr<Attr> Element::removeAttributeNode(Attr* attr, ExceptionCode& ec)
     return static_pointer_cast<Attr>(attrs->removeNamedItem(attr->qualifiedName(), ec));
 }
 
-void Element::setAttributeNS(const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& value, ExceptionCode& ec)
+void Element::setAttributeNS(const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& value, ExceptionCode& ec, FragmentScriptingPermission scriptingPermission)
 {
     String prefix, localName;
     if (!Document::parseQualifiedName(qualifiedName, prefix, localName, ec))
         return;
 
     QualifiedName qName(prefix, localName, namespaceURI);
+
+    if (scriptingPermission == FragmentScriptingNotAllowed && (isEventHandlerAttribute(qName) || isAttributeToRemove(qName, value)))
+        return;
+
     setAttribute(qName, value, ec);
 }
 
@@ -1141,6 +1232,14 @@ void Element::removeAttribute(const String& name, ExceptionCode& ec)
         if (ec == NOT_FOUND_ERR)
             ec = 0;
     }
+    
+#if ENABLE(INSPECTOR)
+    if (Page* page = document()->page()) {
+        if (InspectorController* inspectorController = page->inspectorController())
+            inspectorController->didModifyDOMAttr(this);
+    }
+#endif
+    
 }
 
 void Element::removeAttributeNS(const String& namespaceURI, const String& localName, ExceptionCode& ec)
@@ -1239,7 +1338,7 @@ void Element::updateFocusAppearance(bool /*restorePreviousSelection*/)
         }
     }
     // FIXME: I'm not sure all devices will want this off, but this is
-    // currently turned off for Andriod.
+    // currently turned off for Android.
 #if !ENABLE(DIRECTIONAL_PAD_NAVIGATION)
     else if (renderer() && !renderer()->isWidget())
         renderer()->enclosingLayer()->scrollRectToVisible(getRect());
@@ -1308,7 +1407,7 @@ RenderStyle* Element::computedStyle()
 
     ElementRareData* data = ensureRareData();
     if (!data->m_computedStyle)
-        data->m_computedStyle = document()->styleSelector()->styleForElement(this, parent() ? parent()->computedStyle() : 0);
+        data->m_computedStyle = document()->styleForElementIgnoringPendingStylesheets(this);
     return data->m_computedStyle.get();
 }
 
@@ -1412,7 +1511,7 @@ bool Element::webkitMatchesSelector(const String& selector, ExceptionCode& ec)
 
 KURL Element::getURLAttribute(const QualifiedName& name) const
 {
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
     if (namedAttrMap) {
         if (Attribute* attribute = namedAttrMap->getAttributeItem(name))
             ASSERT(isURLAttribute(attribute));
@@ -1421,4 +1520,9 @@ KURL Element::getURLAttribute(const QualifiedName& name) const
     return document()->completeURL(deprecatedParseURL(getAttribute(name)));
 }
 
+const QualifiedName& Element::rareIDAttributeName() const
+{
+    return rareData()->m_idAttributeName;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.h b/src/3rdparty/webkit/WebCore/dom/Element.h
index d27976a0ea..348ed1c30b 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.h
+++ b/src/3rdparty/webkit/WebCore/dom/Element.h
@@ -26,6 +26,9 @@
 #define Element_h
 
 #include "ContainerNode.h"
+#include "Document.h"
+#include "HTMLNames.h"
+#include "MappedAttributeEntry.h"
 #include "QualifiedName.h"
 #include "ScrollTypes.h"
 
@@ -71,7 +74,7 @@ public:
     DEFINE_ATTRIBUTE_EVENT_LISTENER(select);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(submit);
 
-    // These 4 attribute event handler attributes are overrided by HTMLBodyElement
+    // These four attribute event handler attributes are overridden by HTMLBodyElement
     // and HTMLFrameSetElement to forward to the DOMWindow.
     DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(blur);
     DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(error);
@@ -88,6 +91,14 @@ public:
     DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(selectstart);
+#if ENABLE(TOUCH_EVENTS)
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchstart);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchmove);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchend);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchcancel);
+#endif
+
+    virtual PassRefPtr<DocumentFragment> createContextualFragment(const String&, FragmentScriptingPermission = FragmentScriptingAllowed);
 
     const AtomicString& getIDAttribute() const;
     bool hasAttribute(const QualifiedName&) const;
@@ -104,7 +115,9 @@ public:
     const AtomicString& getAttributeNS(const String& namespaceURI, const String& localName) const;
 
     void setAttribute(const AtomicString& name, const AtomicString& value, ExceptionCode&);
-    void setAttributeNS(const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& value, ExceptionCode&);
+    void setAttributeNS(const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& value, ExceptionCode&, FragmentScriptingPermission = FragmentScriptingAllowed);
+
+    const QualifiedName& idAttributeName() const;
 
     void scrollIntoView(bool alignToTop = true);
     void scrollIntoViewIfNeeded(bool centerIfNeeded = true);
@@ -167,6 +180,9 @@ public:
     // convenience methods which ignore exceptions
     void setAttribute(const QualifiedName&, const AtomicString& value);
     void setBooleanAttribute(const QualifiedName& name, bool);
+    // Please don't use setCStringAttribute in performance-sensitive code;
+    // use a static AtomicString value instead to avoid the conversion overhead.
+    void setCStringAttribute(const QualifiedName&, const char* cStringValue);
 
     virtual NamedNodeMap* attributes() const;
     NamedNodeMap* attributes(bool readonly) const;
@@ -175,7 +191,7 @@ public:
     virtual void attributeChanged(Attribute*, bool preserveDecls = false);
 
     // not part of the DOM
-    void setAttributeMap(PassRefPtr<NamedNodeMap>);
+    void setAttributeMap(PassRefPtr<NamedNodeMap>, FragmentScriptingPermission = FragmentScriptingAllowed);
     NamedNodeMap* attributeMap() const { return namedAttrMap.get(); }
 
     virtual void copyNonAttributeProperties(const Element* /*source*/) { }
@@ -274,6 +290,7 @@ private:
     virtual bool childTypeAllowed(NodeType);
 
     virtual PassRefPtr<Attribute> createAttribute(const QualifiedName&, const AtomicString& value);
+    const QualifiedName& rareIDAttributeName() const;
     
 #ifndef NDEBUG
     virtual void formatForDebugger(char* buffer, unsigned length) const;
@@ -286,10 +303,9 @@ private:
     virtual void updateStyleAttribute() const { }
 
 #if ENABLE(SVG)
-    virtual void updateAnimatedSVGAttribute(const String&) const { }
+    virtual void updateAnimatedSVGAttribute(const QualifiedName&) const { }
 #endif
 
-    void updateFocusAppearanceSoonAfterAttach();
     void cancelFocusAppearanceUpdate();
 
     virtual const AtomicString& virtualPrefix() const { return prefix(); }
@@ -331,6 +347,41 @@ inline Element* Node::parentElement() const
     return parent && parent->isElementNode() ? static_cast<Element*>(parent) : 0;
 }
 
+inline const QualifiedName& Element::idAttributeName() const
+{
+    return hasRareData() ? rareIDAttributeName() : HTMLNames::idAttr;
+}
+
+inline NamedNodeMap* Element::attributes(bool readonly) const
+{
+    if (!m_isStyleAttributeValid)
+        updateStyleAttribute();
+
+#if ENABLE(SVG)
+    if (!m_areSVGAttributesValid)
+        updateAnimatedSVGAttribute(anyQName());
+#endif
+
+    if (!readonly && !namedAttrMap)
+        createAttributeMap();
+    return namedAttrMap.get();
+}
+
+inline void Element::updateId(const AtomicString& oldId, const AtomicString& newId)
+{
+    if (!inDocument())
+        return;
+
+    if (oldId == newId)
+        return;
+
+    Document* doc = document();
+    if (!oldId.isEmpty())
+        doc->removeElementById(oldId, this);
+    if (!newId.isEmpty())
+        doc->addElementById(newId, this);
+}
+
 } //namespace
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.idl b/src/3rdparty/webkit/WebCore/dom/Element.idl
index d90f819b5b..e565bc0dc8 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Element.idl
@@ -22,11 +22,8 @@ module core {
 
     interface [
         CustomMarkFunction,
-        GenerateConstructor,
         GenerateNativeConverter,
-        InlineGetOwnPropertySlot,
-        InterfaceUUID=FEFE9C21-E58C-4b5b-821A-61A514613763,
-        ImplementationUUID=12E5B08E-A680-4baf-9D1E-108AEF7ABBFB
+        InlineGetOwnPropertySlot
     ] Element : Node {
 
         // DOM Level 1 Core
@@ -67,9 +64,7 @@ module core {
         [OldStyleObjC] boolean hasAttributeNS(in [ConvertNullToNullString] DOMString namespaceURI,
                                               in DOMString localName);
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute CSSStyleDeclaration style;
-#endif
 
         // Common extensions
 
@@ -110,7 +105,6 @@ module core {
         NodeList querySelectorAll(in DOMString selectors)
             raises(DOMException);
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // WebKit extension, pending specification.
         boolean webkitMatchesSelector(in DOMString selectors)
             raises(DOMException);
@@ -121,7 +115,6 @@ module core {
         readonly attribute Element previousElementSibling;
         readonly attribute Element nextElementSibling;
         readonly attribute unsigned long childElementCount;
-#endif
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // CSSOM View Module API
@@ -135,7 +128,6 @@ module core {
 #endif
 
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Event handler DOM attributes
         attribute [DontEnum] EventListener onabort;
         attribute [DontEnum] EventListener onblur;
@@ -203,6 +195,11 @@ module core {
         attribute [DontEnum] EventListener onreset;
         attribute [DontEnum] EventListener onsearch;
         attribute [DontEnum] EventListener onselectstart;
+#if defined(ENABLE_TOUCH_EVENTS) && ENABLE_TOUCH_EVENTS
+        attribute [DontEnum] EventListener ontouchstart;
+        attribute [DontEnum] EventListener ontouchmove;
+        attribute [DontEnum] EventListener ontouchend;
+        attribute [DontEnum] EventListener ontouchcancel;
 #endif
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/ElementRareData.h b/src/3rdparty/webkit/WebCore/dom/ElementRareData.h
index 94e0499974..f23ad8e9da 100644
--- a/src/3rdparty/webkit/WebCore/dom/ElementRareData.h
+++ b/src/3rdparty/webkit/WebCore/dom/ElementRareData.h
@@ -27,6 +27,8 @@
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 class ElementRareData : public NodeRareData {
 public:
     ElementRareData();
@@ -38,6 +40,7 @@ public:
 
     IntSize m_minimumSizeForResizing;
     RefPtr<RenderStyle> m_computedStyle;
+    QualifiedName m_idAttributeName;
 };
 
 inline IntSize defaultMinimumSizeForResizing()
@@ -47,6 +50,7 @@ inline IntSize defaultMinimumSizeForResizing()
 
 inline ElementRareData::ElementRareData()
     : m_minimumSizeForResizing(defaultMinimumSizeForResizing())
+    , m_idAttributeName(idAttr)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Entity.idl b/src/3rdparty/webkit/WebCore/dom/Entity.idl
index b15479761a..8dacbe90af 100644
--- a/src/3rdparty/webkit/WebCore/dom/Entity.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Entity.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=5CDB5ACA-F3A7-47ea-B89C-F335E4342C55,
-        ImplementationUUID=DDD2A621-59FD-4bb2-9F95-7061C3FB9F06
-    ] Entity : Node {
+    interface Entity : Node {
         readonly attribute [ConvertNullStringTo=Null] DOMString publicId;
         readonly attribute [ConvertNullStringTo=Null] DOMString systemId;
         readonly attribute [ConvertNullStringTo=Null] DOMString notationName;
diff --git a/src/3rdparty/webkit/WebCore/dom/EntityReference.idl b/src/3rdparty/webkit/WebCore/dom/EntityReference.idl
index 8a206e9f02..f652d9adf7 100644
--- a/src/3rdparty/webkit/WebCore/dom/EntityReference.idl
+++ b/src/3rdparty/webkit/WebCore/dom/EntityReference.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=61BF4A03-19FB-4ac4-A624-5BF0893FDA65,
-        ImplementationUUID=486E1182-CF4F-450b-B411-A584CA42BBD0
-    ] EntityReference : Node {
+    interface EntityReference : Node {
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/ErrorEvent.idl b/src/3rdparty/webkit/WebCore/dom/ErrorEvent.idl
index 6125e1ed02..ad131936a3 100644
--- a/src/3rdparty/webkit/WebCore/dom/ErrorEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/ErrorEvent.idl
@@ -32,7 +32,6 @@ module events {
 
     interface [
         Conditional=WORKERS,
-        GenerateConstructor,
         NoStaticTables
     ] ErrorEvent : Event {
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.cpp b/src/3rdparty/webkit/WebCore/dom/Event.cpp
index ba310ef609..06cc0bd08a 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Event.cpp
@@ -32,6 +32,7 @@ Event::Event()
     : m_canBubble(false)
     , m_cancelable(false)
     , m_propagationStopped(false)
+    , m_immediatePropagationStopped(false)
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
@@ -47,6 +48,7 @@ Event::Event(const AtomicString& eventType, bool canBubbleArg, bool cancelableAr
     , m_canBubble(canBubbleArg)
     , m_cancelable(cancelableArg)
     , m_propagationStopped(false)
+    , m_immediatePropagationStopped(false)
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
@@ -71,6 +73,11 @@ void Event::initEvent(const AtomicString& eventTypeArg, bool canBubbleArg, bool
     m_cancelable = cancelableArg;
 }
 
+bool Event::isCustomEvent() const
+{
+    return false;
+}
+
 bool Event::isUIEvent() const
 {
     return false;
@@ -96,6 +103,11 @@ bool Event::isTextEvent() const
     return false;
 }
 
+bool Event::isCompositionEvent() const
+{
+    return false;
+}
+
 bool Event::isDragEvent() const
 {
     return false;
@@ -131,6 +143,11 @@ bool Event::isPageTransitionEvent() const
     return false;
 }
 
+bool Event::isPopStateEvent() const
+{
+    return false;
+}
+
 bool Event::isProgressEvent() const
 {
     return false;
@@ -176,7 +193,38 @@ bool Event::isErrorEvent() const
     return false;
 }
 #endif
-    
+
+#if ENABLE(TOUCH_EVENTS)
+bool Event::isTouchEvent() const
+{
+    return false;
+}
+#endif
+
+bool Event::fromUserGesture()
+{
+    if (createdByDOM())
+        return false;
+
+    const AtomicString& type = this->type();
+    return
+        // mouse events
+        type == eventNames().clickEvent || type == eventNames().mousedownEvent 
+        || type == eventNames().mouseupEvent || type == eventNames().dblclickEvent 
+        // keyboard events
+        || type == eventNames().keydownEvent || type == eventNames().keypressEvent
+        || type == eventNames().keyupEvent
+#if ENABLE(TOUCH_EVENTS)
+        // touch events
+        || type == eventNames().touchstartEvent || type == eventNames().touchmoveEvent
+        || type == eventNames().touchendEvent || type == eventNames().touchcancelEvent
+#endif
+        // other accepted events
+        || type == eventNames().selectEvent || type == eventNames().changeEvent
+        || type == eventNames().focusEvent || type == eventNames().blurEvent
+        || type == eventNames().submitEvent;
+}
+
 bool Event::storesResultAsString() const
 {
     return false;
@@ -206,4 +254,25 @@ void Event::setUnderlyingEvent(PassRefPtr<Event> ue)
     m_underlyingEvent = ue;
 }
 
+const AtomicString& Event::aliasedType() const
+{
+    if (type() == eventNames().focusinEvent)
+        return eventNames().DOMFocusInEvent;
+    if (type() == eventNames().focusoutEvent)
+        return eventNames().DOMFocusOutEvent;
+    if (type() == eventNames().DOMFocusInEvent)
+        return eventNames().focusinEvent;
+    if (type() == eventNames().DOMFocusOutEvent)
+        return eventNames().focusoutEvent;
+    
+    ASSERT_NOT_REACHED();
+    return type();
+}
+
+bool Event::hasAliasedType() const
+{
+    return type() == eventNames().focusinEvent || type() == eventNames().focusoutEvent ||
+           type() == eventNames().DOMFocusInEvent || type() == eventNames().DOMFocusOutEvent;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.h b/src/3rdparty/webkit/WebCore/dom/Event.h
index 74a2f10a8e..09f1cf4e19 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.h
+++ b/src/3rdparty/webkit/WebCore/dom/Event.h
@@ -75,6 +75,9 @@ namespace WebCore {
         void initEvent(const AtomicString& type, bool canBubble, bool cancelable);
 
         const AtomicString& type() const { return m_type; }
+        
+        const AtomicString& aliasedType() const;
+        bool hasAliasedType() const;
 
         EventTarget* target() const { return m_target.get(); }
         void setTarget(PassRefPtr<EventTarget>);
@@ -88,8 +91,10 @@ namespace WebCore {
         bool bubbles() const { return m_canBubble; }
         bool cancelable() const { return m_cancelable; }
         DOMTimeStamp timeStamp() const { return m_createTime; }
-        void stopPropagation() { m_propagationStopped = true; }
 
+        void stopPropagation() { m_propagationStopped = true; }
+        void stopImmediatePropagation() { m_immediatePropagationStopped = true; }
+        
         // IE Extensions
         EventTarget* srcElement() const { return target(); } // MSIE extension - "the object that fired the event"
 
@@ -98,11 +103,13 @@ namespace WebCore {
 
         Clipboard* clipboardData() const { return isClipboardEvent() ? clipboard() : 0; }
 
+        virtual bool isCustomEvent() const;
         virtual bool isUIEvent() const;
         virtual bool isMouseEvent() const;
         virtual bool isMutationEvent() const;
         virtual bool isKeyboardEvent() const;
         virtual bool isTextEvent() const;
+        virtual bool isCompositionEvent() const;
         virtual bool isDragEvent() const; // a subset of mouse events
         virtual bool isClipboardEvent() const;
         virtual bool isMessageEvent() const;
@@ -110,6 +117,7 @@ namespace WebCore {
         virtual bool isBeforeTextInsertedEvent() const;
         virtual bool isOverflowEvent() const;
         virtual bool isPageTransitionEvent() const;
+        virtual bool isPopStateEvent() const;
         virtual bool isProgressEvent() const;
         virtual bool isXMLHttpRequestProgressEvent() const;
         virtual bool isWebKitAnimationEvent() const;
@@ -124,8 +132,13 @@ namespace WebCore {
 #if ENABLE(WORKERS)
         virtual bool isErrorEvent() const;
 #endif
+#if ENABLE(TOUCH_EVENTS)
+        virtual bool isTouchEvent() const;
+#endif
+        bool fromUserGesture();
         
-        bool propagationStopped() const { return m_propagationStopped; }
+        bool propagationStopped() const { return m_propagationStopped || m_immediatePropagationStopped; }
+        bool immediatePropagationStopped() const { return m_immediatePropagationStopped; }
 
         bool defaultPrevented() const { return m_defaultPrevented; }
         void preventDefault() { if (m_cancelable) m_defaultPrevented = true; }
@@ -161,6 +174,7 @@ namespace WebCore {
         bool m_cancelable;
 
         bool m_propagationStopped;
+        bool m_immediatePropagationStopped;
         bool m_defaultPrevented;
         bool m_defaultHandled;
         bool m_cancelBubble;
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.idl b/src/3rdparty/webkit/WebCore/dom/Event.idl
index 75b6b5ffe9..919fc90a73 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Event.idl
@@ -23,11 +23,8 @@ module events {
     // Introduced in DOM Level 2:
     interface [
         CustomToJS,
-        GenerateConstructor,
         NoStaticTables,
-        Polymorphic,
-        InterfaceUUID=D17495FA-ACAD-4d27-9362-E19E057B189D,
-        ImplementationUUID=CFDCDDB2-5B3F-412d-BDA4-80B23C721549
+        Polymorphic
     ] Event {
 
         // DOM PhaseType
@@ -61,15 +58,18 @@ module events {
         readonly attribute unsigned short   eventPhase;
         readonly attribute boolean          bubbles;
         readonly attribute boolean          cancelable;
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute DOMTimeStamp     timeStamp;
-#endif
+
         void               stopPropagation();
         void               preventDefault();
         [OldStyleObjC] void initEvent(in DOMString eventTypeArg, 
                                       in boolean canBubbleArg, 
                                       in boolean cancelableArg);
 
+        // DOM Level 3 Additions.
+        readonly attribute boolean defaultPrevented;
+        void stopImmediatePropagation();
+
         // IE Extensions
         readonly attribute EventTarget      srcElement;
                  attribute boolean          returnValue;
diff --git a/src/3rdparty/webkit/WebCore/dom/EventException.idl b/src/3rdparty/webkit/WebCore/dom/EventException.idl
index 3d82f851a8..1c8fac6d4d 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventException.idl
+++ b/src/3rdparty/webkit/WebCore/dom/EventException.idl
@@ -30,7 +30,6 @@ module events {
 
     // Introduced in DOM Level 2:
     interface [
-        GenerateConstructor,
         NoStaticTables
     ] EventException {
 
diff --git a/src/3rdparty/webkit/WebCore/dom/EventListener.h b/src/3rdparty/webkit/WebCore/dom/EventListener.h
index f834b31213..8a35922f48 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventListener.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventListener.h
@@ -51,8 +51,8 @@ namespace WebCore {
         virtual bool wasCreatedFromMarkup() const { return false; }
 
 #if USE(JSC)
-        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const { return 0; }
         virtual void markJSFunction(JSC::MarkStack&) { }
+        virtual void invalidateJSFunction(JSC::JSObject*) { }
 #endif
 
         bool isAttribute() const { return virtualisAttribute(); }
diff --git a/src/3rdparty/webkit/WebCore/dom/EventListener.idl b/src/3rdparty/webkit/WebCore/dom/EventListener.idl
index 1edf52f957..023777bf39 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventListener.idl
+++ b/src/3rdparty/webkit/WebCore/dom/EventListener.idl
@@ -25,7 +25,7 @@ module events {
         NoStaticTables,
         ObjCProtocol,
         PureInterface,
-        InterfaceUUID=B04F2AE3-71E2-4ebe-ABFE-EF4938354082,
+        OmitConstructor
     ] EventListener {
         void               handleEvent(in Event evt);
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/EventNames.cpp b/src/3rdparty/webkit/WebCore/dom/EventNames.cpp
index 00191ab2b1..900b8ef757 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventNames.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/EventNames.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/src/3rdparty/webkit/WebCore/dom/EventNames.h b/src/3rdparty/webkit/WebCore/dom/EventNames.h
index 2c4cd32dbe..946e5131fc 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventNames.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventNames.h
@@ -41,6 +41,9 @@ namespace WebCore {
     macro(checking) \
     macro(click) \
     macro(close) \
+    macro(compositionend) \
+    macro(compositionstart) \
+    macro(compositionupdate) \
     macro(connect) \
     macro(contextmenu) \
     macro(copy) \
@@ -57,6 +60,8 @@ namespace WebCore {
     macro(drop) \
     macro(error) \
     macro(focus) \
+    macro(focusin) \
+    macro(focusout) \
     macro(hashchange) \
     macro(input) \
     macro(invalid) \
@@ -81,6 +86,7 @@ namespace WebCore {
     macro(pagehide) \
     macro(pageshow) \
     macro(paste) \
+    macro(popstate) \
     macro(readystatechange) \
     macro(reset) \
     macro(resize) \
@@ -96,10 +102,10 @@ namespace WebCore {
     macro(zoom) \
     \
     macro(DOMActivate) \
-    macro(DOMAttrModified) \
-    macro(DOMCharacterDataModified) \
     macro(DOMFocusIn) \
     macro(DOMFocusOut) \
+    macro(DOMAttrModified) \
+    macro(DOMCharacterDataModified) \
     macro(DOMNodeInserted) \
     macro(DOMNodeInsertedIntoDocument) \
     macro(DOMNodeRemoved) \
@@ -127,6 +133,9 @@ namespace WebCore {
     macro(volumechange) \
     macro(waiting) \
     \
+    macro(webkitbeginfullscreen) \
+    macro(webkitendfullscreen) \
+    \
     macro(progress) \
     macro(stalled) \
     macro(suspend) \
@@ -139,14 +148,22 @@ namespace WebCore {
     \
     macro(orientationchange) \
     \
+    macro(touchstart) \
+    macro(touchmove) \
+    macro(touchend) \
+    macro(touchcancel) \
+    \
+    macro(success) \
+    \
 // end of DOM_EVENT_NAMES_FOR_EACH
 
-    class EventNames {
+    class EventNames : public Noncopyable {
         int dummy; // Needed to make initialization macro work.
-
-    public:
+        // Private to prevent accidental call to EventNames() instead of eventNames()
         EventNames();
+        friend class ThreadGlobalData;
 
+    public:
         #define DOM_EVENT_NAMES_DECLARE(name) AtomicString name##Event;
         DOM_EVENT_NAMES_FOR_EACH(DOM_EVENT_NAMES_DECLARE)
         #undef DOM_EVENT_NAMES_DECLARE
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
index 694e78a618..15987900a2 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
@@ -68,6 +66,11 @@ bool eventDispatchForbidden()
 }
 #endif // NDEBUG
 
+EventTargetData::~EventTargetData()
+{
+    deleteAllValues(eventListenerMap);
+}
+
 EventTarget::~EventTarget()
 {
 }
@@ -157,16 +160,19 @@ bool EventTarget::addEventListener(const AtomicString& eventType, PassRefPtr<Eve
 {
     EventTargetData* d = ensureEventTargetData();
 
-    pair<EventListenerMap::iterator, bool> result = d->eventListenerMap.add(eventType, EventListenerVector());
-    EventListenerVector& entry = result.first->second;
+    pair<EventListenerMap::iterator, bool> result = d->eventListenerMap.add(eventType, 0);
+    EventListenerVector*& entry = result.first->second;
+    const bool isNewEntry = result.second;
+    if (isNewEntry)
+        entry = new EventListenerVector();
 
     RegisteredEventListener registeredListener(listener, useCapture);
-    if (!result.second) { // pre-existing entry
-        if (entry.find(registeredListener) != notFound) // duplicate listener
+    if (!isNewEntry) {
+        if (entry->find(registeredListener) != notFound) // duplicate listener
             return false;
     }
 
-    entry.append(registeredListener);
+    entry->append(registeredListener);
     return true;
 }
 
@@ -179,16 +185,18 @@ bool EventTarget::removeEventListener(const AtomicString& eventType, EventListen
     EventListenerMap::iterator result = d->eventListenerMap.find(eventType);
     if (result == d->eventListenerMap.end())
         return false;
-    EventListenerVector& entry = result->second;
+    EventListenerVector* entry = result->second;
 
     RegisteredEventListener registeredListener(listener, useCapture);
-    size_t index = entry.find(registeredListener);
+    size_t index = entry->find(registeredListener);
     if (index == notFound)
         return false;
 
-    entry.remove(index);
-    if (!entry.size())
+    entry->remove(index);
+    if (entry->isEmpty()) {
+        delete entry;
         d->eventListenerMap.remove(result);
+    }
 
     // Notify firing events planning to invoke the listener at 'index' that
     // they have one less listener to invoke.
@@ -264,10 +272,22 @@ bool EventTarget::fireEventListeners(Event* event)
         return true;
 
     EventListenerMap::iterator result = d->eventListenerMap.find(event->type());
-    if (result == d->eventListenerMap.end())
-        return false;
-    EventListenerVector& entry = result->second;
-
+    if (result != d->eventListenerMap.end())
+        fireEventListeners(event, d, *result->second);
+    
+    // Alias DOMFocusIn/DOMFocusOut to focusin/focusout (and vice versa). Just consider them to be the
+    // same event (triggering one another's handlers).  This mechanism allows us to deprecate or change event
+    // names in the future and still make them be interoperable.
+    if (event->hasAliasedType() && !event->immediatePropagationStopped()) {
+        EventListenerMap::iterator result = d->eventListenerMap.find(event->aliasedType());
+        if (result != d->eventListenerMap.end())
+            fireEventListeners(event, d, *result->second);
+    }
+    return !event->defaultPrevented();
+}
+        
+void EventTarget::fireEventListeners(Event* event, EventTargetData* d, EventListenerVector& entry)
+{
     RefPtr<EventTarget> protect = this;
 
     // Fire all listeners registered for this event. Don't fire listeners removed
@@ -284,13 +304,17 @@ bool EventTarget::fireEventListeners(Event* event)
             continue;
         if (event->eventPhase() == Event::BUBBLING_PHASE && registeredListener.useCapture)
             continue;
+
+        // If stopImmediatePropagation has been called, we just break out immediately, without
+        // handling any more events on this target.
+        if (event->immediatePropagationStopped())
+            break;
+
         // To match Mozilla, the AT_TARGET phase fires both capturing and bubbling
         // event listeners, even though that violates some versions of the DOM spec.
         registeredListener.listener->handleEvent(scriptExecutionContext(), event);
     }
     d->firingEventIterators.removeLast();
-
-    return !event->defaultPrevented();
 }
 
 const EventListenerVector& EventTarget::getEventListeners(const AtomicString& eventType)
@@ -303,7 +327,7 @@ const EventListenerVector& EventTarget::getEventListeners(const AtomicString& ev
     EventListenerMap::iterator it = d->eventListenerMap.find(eventType);
     if (it == d->eventListenerMap.end())
         return emptyVector;
-    return it->second;
+    return *it->second;
 }
 
 void EventTarget::removeAllEventListeners()
@@ -311,6 +335,7 @@ void EventTarget::removeAllEventListeners()
     EventTargetData* d = eventTargetData();
     if (!d)
         return;
+    deleteAllValues(d->eventListenerMap);
     d->eventListenerMap.clear();
 
     // Notify firing events planning to invoke the listener at 'index' that
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.h b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
index 9a1975c490..da98d988a4 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
@@ -36,6 +36,7 @@
 #include "EventNames.h"
 #include "RegisteredEventListener.h"
 #include <wtf/Forward.h>
+#include <wtf/HashMap.h>
 
 namespace WebCore {
 
@@ -76,9 +77,11 @@ namespace WebCore {
     typedef Vector<FiringEventIterator, 1> FiringEventIteratorVector;
 
     typedef Vector<RegisteredEventListener, 1> EventListenerVector;
-    typedef HashMap<AtomicString, EventListenerVector> EventListenerMap;
+    typedef HashMap<AtomicString, EventListenerVector*> EventListenerMap;
+
+    struct EventTargetData : Noncopyable {
+        ~EventTargetData();
 
-    struct EventTargetData {
         EventListenerMap eventListenerMap;
         FiringEventIteratorVector firingEventIterators;
     };
@@ -137,8 +140,8 @@ namespace WebCore {
         bool isFiringEventListeners();
 
 #if USE(JSC)
-        void markEventListeners(JSC::MarkStack&);
-        void invalidateEventListeners();
+        void markJSEventListeners(JSC::MarkStack&);
+        void invalidateJSEventListeners(JSC::JSObject*);
 #endif
 
     protected:
@@ -150,6 +153,8 @@ namespace WebCore {
     private:
         virtual void refEventTarget() = 0;
         virtual void derefEventTarget() = 0;
+        
+        void fireEventListeners(Event*, EventTargetData*, EventListenerVector&);
     };
 
     #define DEFINE_ATTRIBUTE_EVENT_LISTENER(attribute) \
@@ -182,7 +187,7 @@ namespace WebCore {
 #endif
 
 #if USE(JSC)
-    inline void EventTarget::markEventListeners(JSC::MarkStack& markStack)
+    inline void EventTarget::markJSEventListeners(JSC::MarkStack& markStack)
     {
         EventTargetData* d = eventTargetData();
         if (!d)
@@ -190,19 +195,24 @@ namespace WebCore {
 
         EventListenerMap::iterator end = d->eventListenerMap.end();
         for (EventListenerMap::iterator it = d->eventListenerMap.begin(); it != end; ++it) {
-            EventListenerVector& entry = it->second;
+            EventListenerVector& entry = *it->second;
             for (size_t i = 0; i < entry.size(); ++i)
                 entry[i].listener->markJSFunction(markStack);
         }
     }
 
-    inline void EventTarget::invalidateEventListeners()
+    inline void EventTarget::invalidateJSEventListeners(JSC::JSObject* wrapper)
     {
         EventTargetData* d = eventTargetData();
         if (!d)
             return;
 
-        d->eventListenerMap.clear();
+        EventListenerMap::iterator end = d->eventListenerMap.end();
+        for (EventListenerMap::iterator it = d->eventListenerMap.begin(); it != end; ++it) {
+            EventListenerVector& entry = *it->second;
+            for (size_t i = 0; i < entry.size(); ++i)
+                entry[i].listener->invalidateJSFunction(wrapper);
+        }
     }
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.idl b/src/3rdparty/webkit/WebCore/dom/EventTarget.idl
index 844dc32a9c..0cdb6b3eb5 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.idl
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.idl
@@ -24,7 +24,7 @@ module events {
     interface [
         ObjCProtocol,
         PureInterface,
-        InterfaceUUID=1D71C7EC-0BA0-4044-BDFD-56B3E8F5F9D4
+        OmitConstructor
     ] EventTarget {
         [OldStyleObjC] void addEventListener(in DOMString type, 
                                              in EventListener listener, 
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
index c29cb1c0a4..13bb0b2942 100644
--- a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
@@ -22,6 +22,7 @@
 #include "InputElement.h"
 
 #include "BeforeTextInsertedEvent.h"
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "Document.h"
 #include "Event.h"
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.h b/src/3rdparty/webkit/WebCore/dom/InputElement.h
index e0e7110381..a24b4388f1 100644
--- a/src/3rdparty/webkit/WebCore/dom/InputElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.h
@@ -47,8 +47,10 @@ public:
     virtual bool searchEventsShouldBeDispatched() const = 0;
 
     virtual int size() const = 0;
+    virtual const String& suggestedValue() const = 0;
     virtual String value() const = 0;
-    virtual void setValue(const String&) = 0;
+    virtual void setValue(const String&, bool sendChangeEvent = false) = 0;
+    virtual void setValueForUser(const String&) = 0;
 
     virtual String sanitizeValue(const String&) const = 0;
     virtual void setValueFromRenderer(const String&) = 0;
@@ -91,6 +93,9 @@ public:
     String value() const { return m_value; }
     void setValue(const String& value) { m_value = value; }
 
+    const String& suggestedValue() const { return m_suggestedValue; }
+    void setSuggestedValue(const String& value) { m_suggestedValue = value; }
+
     int size() const { return m_size; }
     void setSize(int value) { m_size = value; }
 
@@ -106,6 +111,7 @@ public:
 private:
     AtomicString m_name;
     String m_value;
+    String m_suggestedValue;
     int m_size;
     int m_maxLength;
     int m_cachedSelectionStart;
diff --git a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.cpp b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.cpp
index 6bc825fa21..99c9220759 100644
--- a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.cpp
@@ -80,7 +80,6 @@ KeyboardEvent::KeyboardEvent(const AtomicString& eventType, bool canBubble, bool
 
 KeyboardEvent::~KeyboardEvent()
 {
-    delete m_keyEvent;
 }
 
 void KeyboardEvent::initKeyboardEvent(const AtomicString& type, bool canBubble, bool cancelable, AbstractView* view,
diff --git a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.h b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.h
index 2b0a131782..793ac41212 100644
--- a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.h
@@ -79,7 +79,7 @@ namespace WebCore {
 
         bool altGraphKey() const { return m_altGraphKey; }
     
-        const PlatformKeyboardEvent* keyEvent() const { return m_keyEvent; }
+        const PlatformKeyboardEvent* keyEvent() const { return m_keyEvent.get(); }
 
         int keyCode() const; // key code for keydown and keyup, character for keypress
         int charCode() const; // character code for keypress, 0 for keydown and keyup
@@ -99,7 +99,7 @@ namespace WebCore {
                       const String& keyIdentifier, unsigned keyLocation,
                       bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, bool altGraphKey);
 
-        PlatformKeyboardEvent* m_keyEvent;
+        OwnPtr<PlatformKeyboardEvent> m_keyEvent;
         String m_keyIdentifier;
         unsigned m_keyLocation;
         bool m_altGraphKey : 1;
diff --git a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl
index 58e5da7792..1af3d022e2 100644
--- a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl
@@ -21,9 +21,7 @@
 module events {
 
     // Introduced in DOM Level 3:
-    interface [
-        GenerateConstructor
-    ] KeyboardEvent : UIEvent {
+    interface KeyboardEvent : UIEvent {
 
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         // KeyLocationCode
diff --git a/src/3rdparty/webkit/WebCore/dom/MappedAttributeEntry.h b/src/3rdparty/webkit/WebCore/dom/MappedAttributeEntry.h
index 745ad2347c..ce2464e793 100644
--- a/src/3rdparty/webkit/WebCore/dom/MappedAttributeEntry.h
+++ b/src/3rdparty/webkit/WebCore/dom/MappedAttributeEntry.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
@@ -49,7 +47,9 @@ enum MappedAttributeEntry {
 // When adding new entries, make sure to keep eLastEntry at the end of the list.
     , eLastEntry
 };
-    
+
+enum FragmentScriptingPermission { FragmentScriptingAllowed, FragmentScriptingNotAllowed };
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/MessageChannel.idl b/src/3rdparty/webkit/WebCore/dom/MessageChannel.idl
index 4e0892b4fb..bae5b18344 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessageChannel.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MessageChannel.idl
@@ -26,7 +26,7 @@
 
 module events {
 
-    interface [CustomMarkFunction, NoStaticTables] MessageChannel {
+    interface [CustomConstructor, CustomMarkFunction, NoStaticTables] MessageChannel {
 
         readonly attribute MessagePort port1;
         readonly attribute MessagePort port2;
diff --git a/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl b/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl
index 7e497fcd05..2b47374aea 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl
@@ -27,10 +27,9 @@
 module events {
 
     interface [
-        GenerateConstructor,
         NoStaticTables
     ] MessageEvent : Event {
-        readonly attribute SerializedScriptValue data;
+        readonly attribute [CachedAttribute] SerializedScriptValue data;
 
         readonly attribute DOMString origin;
         readonly attribute DOMString lastEventId;
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
index 9f6e6499cc..10519205d3 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
@@ -41,6 +41,7 @@ namespace WebCore {
 MessagePort::MessagePort(ScriptExecutionContext& scriptExecutionContext)
     : m_entangledChannel(0)
     , m_started(false)
+    , m_closed(false)
     , m_scriptExecutionContext(&scriptExecutionContext)
 {
     m_scriptExecutionContext->createdMessagePort(this);
@@ -131,6 +132,7 @@ void MessagePort::start()
 
 void MessagePort::close()
 {
+    m_closed = true;
     if (!m_entangledChannel)
         return;
     m_entangledChannel->close();
@@ -200,7 +202,7 @@ PassOwnPtr<MessagePortChannelArray> MessagePort::disentanglePorts(const MessageP
     // Walk the incoming array - if there are any duplicate ports, or null ports or cloned ports, throw an error (per section 8.3.3 of the HTML5 spec).
     for (unsigned int i = 0; i < ports->size(); ++i) {
         MessagePort* port = (*ports)[i].get();
-        if (!port || !port->isEntangled() || portSet.contains(port)) {
+        if (!port || port->isCloned() || portSet.contains(port)) {
             ec = INVALID_STATE_ERR;
             return 0;
         }
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.h b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
index 0ab0f505a4..ae1eb22b12 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
@@ -103,7 +103,10 @@ namespace WebCore {
         // Returns null otherwise.
         // NOTE: This is used solely to enable a GC optimization. Some platforms may not be able to determine ownership of the remote port (since it may live cross-process) - those platforms may always return null.
         MessagePort* locallyEntangledPort();
-        bool isEntangled() { return m_entangledChannel; }
+        // A port starts out its life entangled, and remains entangled until it is closed or is cloned.
+        bool isEntangled() { return !m_closed && !isCloned(); }
+        // A port is cloned if its entangled channel has been removed and sent to a new owner via postMessage().
+        bool isCloned() { return !m_entangledChannel; }
 
     private:
         MessagePort(ScriptExecutionContext&);
@@ -116,6 +119,7 @@ namespace WebCore {
         OwnPtr<MessagePortChannel> m_entangledChannel;
 
         bool m_started;
+        bool m_closed;
 
         ScriptExecutionContext* m_scriptExecutionContext;
         EventTargetData m_eventTargetData;
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.idl b/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
index a9149ec874..93124307e9 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
@@ -29,7 +29,6 @@ module events {
     interface [
         CustomMarkFunction,
         EventTarget,
-        GenerateConstructor,
         NoStaticTables
     ] MessagePort {
 // We need to have something as an ObjC binding, because MessagePort is used in MessageEvent, which already has one,
@@ -44,12 +43,12 @@ module events {
         attribute EventListener onmessage;
 
         // EventTarget interface
-        [Custom] void addEventListener(in DOMString type, 
-                                       in EventListener listener, 
-                                       in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type, 
+        [JSCCustom] void addEventListener(in DOMString type, 
                                           in EventListener listener, 
                                           in boolean useCapture);
+        [JSCCustom] void removeEventListener(in DOMString type, 
+                                             in EventListener listener, 
+                                             in boolean useCapture);
         boolean dispatchEvent(in Event evt)
             raises(EventException);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
index 2321b1f50e..192cb92c37 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
@@ -62,7 +62,7 @@ namespace WebCore {
         // Creates a new wrapper for the passed channel.
         static PassOwnPtr<MessagePortChannel> create(PassRefPtr<PlatformMessagePortChannel>);
 
-        // Entangles the channel with a port (called when a port has been cloned, after the clone has been marshalled to its new owning thread and is ready to receive messages).
+        // Entangles the channel with a port (called when a port has been cloned, after the clone has been marshaled to its new owning thread and is ready to receive messages).
         // Returns false if the entanglement failed because the port was closed.
         bool entangleIfOpen(MessagePort*);
 
@@ -78,7 +78,7 @@ namespace WebCore {
         // Returns true if the proxy currently contains messages for this port.
         bool hasPendingActivity();
 
-        class EventData {
+        class EventData : public Noncopyable {
         public:
             static PassOwnPtr<EventData> create(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
 
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl b/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl
index c509459d0e..49385f1072 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl
@@ -20,9 +20,7 @@
 module events {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor
-    ] MouseEvent : UIEvent {
+    interface MouseEvent : UIEvent {
         readonly attribute long             screenX;
         readonly attribute long             screenY;
         readonly attribute long             clientX;
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
index 87815b1bad..15d4e433cf 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
@@ -151,7 +151,7 @@ void MouseRelatedEvent::receivedTarget()
     }
 
     // Adjust layerX/Y to be relative to the layer.
-    // FIXME: We're pretty sure this is the wrong defintion of "layer."
+    // FIXME: We're pretty sure this is the wrong definition of "layer."
     // Our RenderLayer is a more modern concept, and layerX/Y is some
     // other notion about groups of elements (left over from the Netscape 4 days?);
     // we should test and fix this.
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h
index 7649aa9886..fc494d1d98 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
diff --git a/src/3rdparty/webkit/WebCore/dom/MutationEvent.idl b/src/3rdparty/webkit/WebCore/dom/MutationEvent.idl
index ea7a4dd9b4..99a6aaade1 100644
--- a/src/3rdparty/webkit/WebCore/dom/MutationEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MutationEvent.idl
@@ -20,9 +20,7 @@
 module events {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor
-    ] MutationEvent : Event {
+    interface MutationEvent : Event {
 
         // attrChangeType
         const unsigned short MODIFICATION = 1;
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
index d4ec598d88..d8a6ba8ad9 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
@@ -130,7 +130,7 @@ PassRefPtr<Node> NamedNodeMap::setNamedItem(Node* arg, ExceptionCode& ec)
         return 0;
     }
 
-    if (a->name() == idAttr)
+    if (attr->isId())
         m_element->updateId(old ? old->value() : nullAtom, a->value());
 
     // ### slightly inefficient - resizes attribute array twice.
@@ -155,9 +155,9 @@ PassRefPtr<Node> NamedNodeMap::removeNamedItem(const QualifiedName& name, Except
         return 0;
     }
 
-    RefPtr<Node> r = a->createAttrIfNeeded(m_element);
+    RefPtr<Attr> r = a->createAttrIfNeeded(m_element);
 
-    if (name == idAttr)
+    if (r->isId())
         m_element->updateId(a->value(), nullAtom);
 
     removeAttribute(name);
@@ -172,26 +172,23 @@ PassRefPtr<Node> NamedNodeMap::item(unsigned index) const
     return m_attributes[index]->createAttrIfNeeded(m_element);
 }
 
-// We use a boolean parameter instead of calling shouldIgnoreAttributeCase so that the caller
-// can tune the behaviour (hasAttribute is case sensitive whereas getAttribute is not).
-Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
+Attribute* NamedNodeMap::getAttributeItemSlowCase(const String& name, bool shouldIgnoreAttributeCase) const
 {
     unsigned len = length();
-    for (unsigned i = 0; i < len; ++i) {
-        if (!m_attributes[i]->name().hasPrefix() && m_attributes[i]->name().localName() == name)
-            return m_attributes[i].get();
-        if (shouldIgnoreAttributeCase ? equalIgnoringCase(m_attributes[i]->name().toString(), name) : name == m_attributes[i]->name().toString())
-            return m_attributes[i].get();
-    }
-    return 0;
-}
 
-Attribute* NamedNodeMap::getAttributeItem(const QualifiedName& name) const
-{
-    unsigned len = length();
+    // Continue to checking case-insensitively and/or full namespaced names if necessary:
     for (unsigned i = 0; i < len; ++i) {
-        if (m_attributes[i]->name().matches(name))
-            return m_attributes[i].get();
+        const QualifiedName& attrName = m_attributes[i]->name();
+        if (!attrName.hasPrefix()) {
+            if (shouldIgnoreAttributeCase && equalIgnoringCase(name, attrName.localName()))
+                return m_attributes[i].get();
+        } else {
+            // FIXME: Would be faster to do this comparison without calling toString, which
+            // generates a temporary string by concatenation. But this branch is only reached
+            // if the attribute name has a prefix, which is rare in HTML.
+            if (equalPossiblyIgnoringCase(name, attrName.toString(), shouldIgnoreAttributeCase))
+                return m_attributes[i].get();
+        }
     }
     return 0;
 }
@@ -220,8 +217,8 @@ void NamedNodeMap::setAttributes(const NamedNodeMap& other)
 
     // If assigning the map changes the id attribute, we need to call
     // updateId.
-    Attribute *oldId = getAttributeItem(idAttr);
-    Attribute *newId = other.getAttributeItem(idAttr);
+    Attribute* oldId = getAttributeItem(m_element->idAttributeName());
+    Attribute* newId = other.getAttributeItem(m_element->idAttributeName());
 
     if (oldId || newId)
         m_element->updateId(oldId ? oldId->value() : nullAtom, newId ? newId->value() : nullAtom);
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
index 759900b719..d5136b5512 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
+++ b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
@@ -103,12 +103,45 @@ private:
     void detachAttributesFromElement();
     void detachFromElement();
     Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const;
+    Attribute* getAttributeItemSlowCase(const String& name, bool shouldIgnoreAttributeCase) const;
 
     Element* m_element;
     Vector<RefPtr<Attribute> > m_attributes;
     AtomicString m_id;
 };
 
+inline Attribute* NamedNodeMap::getAttributeItem(const QualifiedName& name) const
+{
+    unsigned len = length();
+    for (unsigned i = 0; i < len; ++i) {
+        if (m_attributes[i]->name().matches(name))
+            return m_attributes[i].get();
+    }
+    return 0;
+}
+
+// We use a boolean parameter instead of calling shouldIgnoreAttributeCase so that the caller
+// can tune the behaviour (hasAttribute is case sensitive whereas getAttribute is not).
+inline Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
+{
+    unsigned len = length();
+    bool doSlowCheck = shouldIgnoreAttributeCase;
+    
+    // Optimize for the case where the attribute exists and its name exactly matches.
+    for (unsigned i = 0; i < len; ++i) {
+        const QualifiedName& attrName = m_attributes[i]->name();
+        if (!attrName.hasPrefix()) {
+            if (name == attrName.localName())
+                return m_attributes[i].get();
+        } else
+            doSlowCheck = true;
+    }
+
+    if (doSlowCheck)
+        return getAttributeItemSlowCase(name, shouldIgnoreAttributeCase);
+    return 0;
+}
+
 } //namespace
 
 #undef id
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h b/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h
index 0afa278408..a2886856d1 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h
+++ b/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h
@@ -26,8 +26,8 @@
 #ifndef NamedMappedAttrMap_h
 #define NamedMappedAttrMap_h
 
-#include "ClassNames.h"
 #include "NamedNodeMap.h"
+#include "SpaceSplitString.h"
 
 namespace WebCore {
 
@@ -37,7 +37,7 @@ public:
 
     void clearClass() { m_classNames.clear(); }
     void setClass(const String&);
-    const ClassNames& classNames() const { return m_classNames; }
+    const SpaceSplitString& classNames() const { return m_classNames; }
 
     bool hasMappedAttributes() const { return m_mappedAttributeCount > 0; }
     void declRemoved() { m_mappedAttributeCount--; }
@@ -53,7 +53,7 @@ private:
 
     int declCount() const;
 
-    ClassNames m_classNames;
+    SpaceSplitString m_classNames;
     int m_mappedAttributeCount;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl b/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl
index 8166853f93..4d36577276 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl
+++ b/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl
@@ -22,11 +22,8 @@ module core {
 
     interface [
         CustomMarkFunction,
-        GenerateConstructor,
         HasIndexGetter,
-        HasNameGetter,
-        InterfaceUUID=08DAF7A4-4C32-4709-B72F-622721FF0FB8,
-        ImplementationUUID=A1CC9F5B-092D-4a04-96D9-D7718A8D6242
+        HasNameGetter
     ] NamedNodeMap {
 
         Node getNamedItem(in DOMString name);
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.cpp b/src/3rdparty/webkit/WebCore/dom/Node.cpp
index 612bf18ef3..95f5dce453 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Node.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
@@ -37,6 +37,7 @@
 #include "CString.h"
 #include "ChildNodeList.h"
 #include "ClassNodeList.h"
+#include "ContextMenuController.h"
 #include "DOMImplementation.h"
 #include "Document.h"
 #include "DynamicNodeList.h"
@@ -53,6 +54,7 @@
 #include "InspectorTimelineAgent.h"
 #include "KeyboardEvent.h"
 #include "Logging.h"
+#include "MappedAttribute.h"
 #include "MouseEvent.h"
 #include "MutationEvent.h"
 #include "NameNodeList.h"
@@ -143,7 +145,7 @@ void Node::dumpStatistics()
     size_t attrMaps = 0;
     size_t mappedAttrMaps = 0;
 
-    for (HashSet<Node*>::const_iterator it = liveNodeSet.begin(); it != liveNodeSet.end(); ++it) {
+    for (HashSet<Node*>::iterator it = liveNodeSet.begin(); it != liveNodeSet.end(); ++it) {
         Node* node = *it;
 
         if (node->hasRareData())
@@ -249,7 +251,7 @@ void Node::dumpStatistics()
     printf("  Number of XPathNS nodes: %zu\n", xpathNSNodes);
 
     printf("Element tag name distibution:\n");
-    for (HashMap<String, size_t>::const_iterator it = perTagCount.begin(); it != perTagCount.end(); ++it)
+    for (HashMap<String, size_t>::iterator it = perTagCount.begin(); it != perTagCount.end(); ++it)
         printf("  Number of <%s> tags: %zu\n", it->first.utf8().data(), it->second);
 
     printf("Attribute Maps:\n");
@@ -311,25 +313,20 @@ Node::StyleChange Node::diff(const RenderStyle* s1, const RenderStyle* s2)
 
     // If the pseudoStyles have changed, we want any StyleChange that is not NoChange
     // because setStyle will do the right thing with anything else.
-    if (ch == NoChange && s1->hasPseudoStyle(BEFORE)) {
-        RenderStyle* ps2 = s2->getCachedPseudoStyle(BEFORE);
-        if (!ps2)
-            ch = NoInherit;
-        else {
-            RenderStyle* ps1 = s1->getCachedPseudoStyle(BEFORE);
-            ch = ps1 && *ps1 == *ps2 ? NoChange : NoInherit;
-        }
-    }
-    if (ch == NoChange && s1->hasPseudoStyle(AFTER)) {
-        RenderStyle* ps2 = s2->getCachedPseudoStyle(AFTER);
-        if (!ps2)
-            ch = NoInherit;
-        else {
-            RenderStyle* ps1 = s1->getCachedPseudoStyle(AFTER);
-            ch = ps2 && *ps1 == *ps2 ? NoChange : NoInherit;
+    if (ch == NoChange && s1->hasAnyPublicPseudoStyles()) {
+        for (PseudoId pseudoId = FIRST_PUBLIC_PSEUDOID; ch == NoChange && pseudoId < FIRST_INTERNAL_PSEUDOID; pseudoId = static_cast<PseudoId>(pseudoId + 1)) {
+            if (s1->hasPseudoStyle(pseudoId)) {
+                RenderStyle* ps2 = s2->getCachedPseudoStyle(pseudoId);
+                if (!ps2)
+                    ch = NoInherit;
+                else {
+                    RenderStyle* ps1 = s1->getCachedPseudoStyle(pseudoId);
+                    ch = ps1 && *ps1 == *ps2 ? NoChange : NoInherit;
+                }
+            }
         }
     }
-    
+
     return ch;
 }
 
@@ -410,7 +407,6 @@ Node::Node(Document* document, ConstructionType type)
     , m_hovered(false)
     , m_inActiveChain(false)
     , m_inDetach(false)
-    , m_inSubtreeMark(false)
     , m_hasRareData(false)
     , m_isElement(isElement(type))
     , m_isContainer(isContainer(type))
@@ -421,6 +417,7 @@ Node::Node(Document* document, ConstructionType type)
 #if ENABLE(SVG)
     , m_areSVGAttributesValid(true)
     , m_synchronizingSVGAttributes(false)
+    , m_hasRareSVGData(false)
 #endif
 {
     if (m_document)
@@ -519,6 +516,12 @@ void Node::setDocument(Document* document)
     updateDOMNodeDocument(this, m_document, document);
 #endif
 
+    if (hasRareData() && rareData()->nodeLists()) {
+        if (m_document)
+            m_document->removeNodeListCache();
+        document->addNodeListCache();
+    }
+
     if (m_document)
         m_document->selfOnlyDeref();
 
@@ -674,7 +677,7 @@ void Node::normalize()
 
         // Merge text nodes.
         while (Node* nextSibling = node->nextSibling()) {
-            if (!nextSibling->isTextNode())
+            if (nextSibling->nodeType() != TEXT_NODE)
                 break;
             RefPtr<Text> nextText = static_cast<Text*>(nextSibling);
 
@@ -842,7 +845,7 @@ bool Node::isFocusable() const
         ASSERT(!renderer()->needsLayout());
     else
         // If the node is in a display:none tree it might say it needs style recalc but
-        // the whole document is atually up to date.
+        // the whole document is actually up to date.
         ASSERT(!document()->childNeedsStyleRecalc());
     
     // FIXME: Even if we are not visible, we might have a child that is visible.
@@ -910,7 +913,10 @@ void Node::notifyLocalNodeListsAttributeChanged()
     if (!data->nodeLists())
         return;
 
-    data->nodeLists()->invalidateCachesThatDependOnAttributes();
+    if (!isAttributeNode())
+        data->nodeLists()->invalidateCachesThatDependOnAttributes();
+    else
+        data->nodeLists()->invalidateCaches();
 
     if (data->nodeLists()->isEmpty()) {
         data->clearNodeLists();
@@ -1033,34 +1039,27 @@ Node* Node::traversePreviousSiblingPostOrder(const Node* stayWithin) const
     return 0;
 }
 
-void Node::checkSetPrefix(const AtomicString&, ExceptionCode& ec)
+void Node::checkSetPrefix(const AtomicString& prefix, ExceptionCode& ec)
 {
     // Perform error checking as required by spec for setting Node.prefix. Used by
     // Element::setPrefix() and Attr::setPrefix()
 
     // FIXME: Implement support for INVALID_CHARACTER_ERR: Raised if the specified prefix contains an illegal character.
     
-    // NO_MODIFICATION_ALLOWED_ERR: Raised if this node is readonly.
     if (isReadOnlyNode()) {
         ec = NO_MODIFICATION_ALLOWED_ERR;
         return;
     }
 
-    // FIXME: Implement NAMESPACE_ERR: - Raised if the specified prefix is malformed
-    // We have to comment this out, since it's used for attributes and tag names, and we've only
-    // switched one over.
-    /*
-    // - if the namespaceURI of this node is null,
-    // - if the specified prefix is "xml" and the namespaceURI of this node is different from
-    //   "http://www.w3.org/XML/1998/namespace",
-    // - if this node is an attribute and the specified prefix is "xmlns" and
-    //   the namespaceURI of this node is different from "http://www.w3.org/2000/xmlns/",
-    // - or if this node is an attribute and the qualifiedName of this node is "xmlns" [Namespaces].
-    if ((namespacePart(id()) == noNamespace && id() > ID_LAST_TAG) ||
-        (_prefix == "xml" && String(document()->namespaceURI(id())) != "http://www.w3.org/XML/1998/namespace")) {
+    // FIXME: Raise NAMESPACE_ERR if prefix is malformed per the Namespaces in XML specification.
+
+    const AtomicString& nodeNamespaceURI = namespaceURI();
+    if ((nodeNamespaceURI.isEmpty() && !prefix.isEmpty())
+        || (prefix == xmlAtom && nodeNamespaceURI != XMLNames::xmlNamespaceURI)) {
         ec = NAMESPACE_ERR;
         return;
-    }*/
+    }
+    // Attribute-specific checks are in Attr::setPrefix().
 }
 
 bool Node::canReplaceChild(Node* newChild, Node*)
@@ -1464,7 +1463,7 @@ bool Node::canStartSelection() const
 Node* Node::shadowAncestorNode()
 {
 #if ENABLE(SVG)
-    // SVG elements living in a shadow tree only occour when <use> created them.
+    // SVG elements living in a shadow tree only occur when <use> created them.
     // For these cases we do NOT want to return the shadowParentNode() here
     // but the actual shadow tree element - as main difference to the HTML forms
     // shadow tree concept. (This function _could_ be made virtual - opinions?)
@@ -1653,7 +1652,6 @@ PassRefPtr<Element> Node::querySelector(const String& selectors, ExceptionCode&
 
     // FIXME: we could also optimize for the the [id="foo"] case
     if (strictParsing && inDocument() && querySelectorList.hasOneSelector() && querySelectorList.first()->m_match == CSSSelector::Id) {
-        ASSERT(querySelectorList.first()->attribute() == idAttr);
         Element* element = document()->getElementById(querySelectorList.first()->m_value);
         if (element && (isDocumentNode() || element->isDescendantOf(this)) && selectorChecker.checkSelector(querySelectorList.first(), element))
             return element;
@@ -1763,25 +1761,24 @@ bool Node::isEqualNode(Node *other) const
     return true;
 }
 
-bool Node::isDefaultNamespace(const AtomicString &namespaceURI) const
+bool Node::isDefaultNamespace(const AtomicString& namespaceURIMaybeEmpty) const
 {
-    // Implemented according to
-    // http://www.w3.org/TR/2004/REC-DOM-Level-3-Core-20040407/namespaces-algorithms.html#isDefaultNamespaceAlgo
-    
+    const AtomicString& namespaceURI = namespaceURIMaybeEmpty.isEmpty() ? nullAtom : namespaceURIMaybeEmpty;
+
     switch (nodeType()) {
         case ELEMENT_NODE: {
-            const Element *elem = static_cast<const Element *>(this);
+            const Element* elem = static_cast<const Element*>(this);
             
             if (elem->prefix().isNull())
                 return elem->namespaceURI() == namespaceURI;
 
             if (elem->hasAttributes()) {
-                NamedNodeMap *attrs = elem->attributes();
+                NamedNodeMap* attrs = elem->attributes();
                 
                 for (unsigned i = 0; i < attrs->length(); i++) {
-                    Attribute *attr = attrs->attributeItem(i);
+                    Attribute* attr = attrs->attributeItem(i);
                     
-                    if (attr->localName() == "xmlns")
+                    if (attr->localName() == xmlnsAtom)
                         return attr->value() == namespaceURI;
                 }
             }
@@ -1801,7 +1798,7 @@ bool Node::isDefaultNamespace(const AtomicString &namespaceURI) const
         case DOCUMENT_FRAGMENT_NODE:
             return false;
         case ATTRIBUTE_NODE: {
-            const Attr *attr = static_cast<const Attr *>(this);
+            const Attr* attr = static_cast<const Attr*>(this);
             if (attr->ownerElement())
                 return attr->ownerElement()->isDefaultNamespace(namespaceURI);
             return false;
@@ -1867,12 +1864,12 @@ String Node::lookupNamespaceURI(const String &prefix) const
                 for (unsigned i = 0; i < attrs->length(); i++) {
                     Attribute *attr = attrs->attributeItem(i);
                     
-                    if (attr->prefix() == "xmlns" && attr->localName() == prefix) {
+                    if (attr->prefix() == xmlnsAtom && attr->localName() == prefix) {
                         if (!attr->value().isEmpty())
                             return attr->value();
                         
                         return String();
-                    } else if (attr->localName() == "xmlns" && prefix.isNull()) {
+                    } else if (attr->localName() == xmlnsAtom && prefix.isNull()) {
                         if (!attr->value().isEmpty())
                             return attr->value();
                         
@@ -1922,7 +1919,7 @@ String Node::lookupNamespacePrefix(const AtomicString &_namespaceURI, const Elem
         for (unsigned i = 0; i < attrs->length(); i++) {
             Attribute *attr = attrs->attributeItem(i);
             
-            if (attr->prefix() == "xmlns" &&
+            if (attr->prefix() == xmlnsAtom &&
                 attr->value() == _namespaceURI &&
                 originalElement->lookupNamespaceURI(attr->localName()) == _namespaceURI)
                 return attr->localName();
@@ -2289,6 +2286,19 @@ ContainerNode* Node::eventParentNode()
     return static_cast<ContainerNode*>(parent);
 }
 
+Node* Node::enclosingLinkEventParentOrSelf()
+{
+    for (Node* node = this; node; node = node->eventParentNode()) {
+        // For imagemaps, the enclosing link node is the associated area element not the image itself.
+        // So we don't let images be the enclosingLinkNode, even though isLink sometimes returns true
+        // for them.
+        if (node->isLink() && !node->hasTagName(imgTag))
+            return node;
+    }
+
+    return 0;
+}
+
 // --------
 
 ScriptExecutionContext* Node::scriptExecutionContext() const
@@ -2318,49 +2328,159 @@ void Node::didMoveToNewOwnerDocument()
     setDidMoveToNewOwnerDocumentWasCalled(true);
 }
 
-static inline void updateSVGElementInstancesAfterEventListenerChange(Node* referenceNode)
+#if ENABLE(SVG)
+static inline HashSet<SVGElementInstance*> instancesForSVGElement(Node* node)
+{
+    HashSet<SVGElementInstance*> instances;
+ 
+    ASSERT(node);
+    if (!node->isSVGElement() || node->shadowTreeRootNode())
+        return HashSet<SVGElementInstance*>();
+
+    SVGElement* element = static_cast<SVGElement*>(node);
+    if (!element->isStyled())
+        return HashSet<SVGElementInstance*>();
+
+    SVGStyledElement* styledElement = static_cast<SVGStyledElement*>(element);
+    ASSERT(!styledElement->instanceUpdatesBlocked());
+
+    return styledElement->instancesForElement();
+}
+#endif
+
+static inline bool tryAddEventListener(Node* targetNode, const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+{
+    if (!targetNode->EventTarget::addEventListener(eventType, listener, useCapture))
+        return false;
+
+    if (Document* document = targetNode->document())
+        document->addListenerTypeIfNeeded(eventType);
+
+    return true;
+}
+
+bool Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
 #if !ENABLE(SVG)
-    UNUSED_PARAM(referenceNode);
+    return tryAddEventListener(this, eventType, listener, useCapture);
 #else
-    ASSERT(referenceNode);
-    if (!referenceNode->isSVGElement())
-        return;
+    if (!isSVGElement())
+        return tryAddEventListener(this, eventType, listener, useCapture);
 
-    // Elements living inside a <use> shadow tree, never cause any updates!
-    if (referenceNode->shadowTreeRootNode())
-        return;
+    HashSet<SVGElementInstance*> instances = instancesForSVGElement(this);
+    if (instances.isEmpty())
+        return tryAddEventListener(this, eventType, listener, useCapture);
 
-    // We're possibly (a child of) an element that is referenced by a <use> client
-    // If an event listeners changes on a referenced element, update all instances.
-    for (Node* node = referenceNode; node; node = node->parentNode()) {
-        if (!node->hasID() || !node->isSVGElement())
-            continue;
+    RefPtr<EventListener> listenerForRegularTree = listener;
+    RefPtr<EventListener> listenerForShadowTree = listenerForRegularTree;
 
-        SVGElementInstance::invalidateAllInstancesOfElement(static_cast<SVGElement*>(node));
-        break;
+    // Add event listener to regular DOM element
+    if (!tryAddEventListener(this, eventType, listenerForRegularTree.release(), useCapture))
+        return false;
+
+    // Add event listener to all shadow tree DOM element instances
+    const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
+    for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
+        ASSERT((*it)->shadowTreeElement());
+        ASSERT((*it)->correspondingElement() == this);
+
+        RefPtr<EventListener> listenerForCurrentShadowTreeElement = listenerForShadowTree;
+        bool result = tryAddEventListener((*it)->shadowTreeElement(), eventType, listenerForCurrentShadowTreeElement.release(), useCapture);
+        ASSERT_UNUSED(result, result);
     }
+
+    return true;
 #endif
 }
 
-bool Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+static inline bool tryRemoveEventListener(Node* targetNode, const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    if (!EventTarget::addEventListener(eventType, listener, useCapture))
+    if (!targetNode->EventTarget::removeEventListener(eventType, listener, useCapture))
         return false;
 
-    if (Document* document = this->document())
-        document->addListenerTypeIfNeeded(eventType);
-    updateSVGElementInstancesAfterEventListenerChange(this);
+    // FIXME: Notify Document that the listener has vanished. We need to keep track of a number of
+    // listeners for each type, not just a bool - see https://bugs.webkit.org/show_bug.cgi?id=33861
+
     return true;
 }
 
 bool Node::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    if (!EventTarget::removeEventListener(eventType, listener, useCapture))
+#if !ENABLE(SVG)
+    return tryRemoveEventListener(this, eventType, listener, useCapture);
+#else
+    if (!isSVGElement())
+        return tryRemoveEventListener(this, eventType, listener, useCapture);
+
+    HashSet<SVGElementInstance*> instances = instancesForSVGElement(this);
+    if (instances.isEmpty())
+        return tryRemoveEventListener(this, eventType, listener, useCapture);
+
+    // EventTarget::removeEventListener creates a PassRefPtr around the given EventListener
+    // object when creating a temporary RegisteredEventListener object used to look up the
+    // event listener in a cache. If we want to be able to call removeEventListener() multiple
+    // times on different nodes, we have to delay its immediate destruction, which would happen
+    // after the first call below.
+    RefPtr<EventListener> protector(listener);
+
+    // Remove event listener from regular DOM element
+    if (!tryRemoveEventListener(this, eventType, listener, useCapture))
         return false;
 
-    updateSVGElementInstancesAfterEventListenerChange(this);
+    // Remove event listener from all shadow tree DOM element instances
+    const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
+    for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
+        ASSERT((*it)->correspondingElement() == this);
+
+        SVGElement* shadowTreeElement = (*it)->shadowTreeElement();
+        ASSERT(shadowTreeElement);
+
+        if (tryRemoveEventListener(shadowTreeElement, eventType, listener, useCapture))
+            continue;
+
+        // This case can only be hit for event listeners created from markup
+        ASSERT(listener->wasCreatedFromMarkup());
+
+        // If the event listener 'listener' has been created from markup and has been fired before
+        // then JSLazyEventListener::parseCode() has been called and m_jsFunction of that listener
+        // has been created (read: it's not 0 anymore). During shadow tree creation, the event
+        // listener DOM attribute has been cloned, and another event listener has been setup in
+        // the shadow tree. If that event listener has not been used yet, m_jsFunction is still 0,
+        // and tryRemoveEventListener() above will fail. Work around that very seldom problem.
+        EventTargetData* data = shadowTreeElement->eventTargetData();
+        ASSERT(data);
+
+        EventListenerMap::iterator result = data->eventListenerMap.find(eventType);
+        ASSERT(result != data->eventListenerMap.end());
+
+        EventListenerVector* entry = result->second;
+        ASSERT(entry);
+
+        unsigned int index = 0;
+        bool foundListener = false;
+
+        EventListenerVector::iterator end = entry->end();
+        for (EventListenerVector::iterator it = entry->begin(); it != end; ++it) {
+            if (!(*it).listener->wasCreatedFromMarkup()) {
+                ++index;
+                continue;
+            }
+
+            foundListener = true;
+            entry->remove(index);
+            break;
+        }
+
+        ASSERT(foundListener);
+
+        if (entry->isEmpty()) {                
+            delete entry;
+            data->eventListenerMap.remove(result);
+        }
+    }
+
     return true;
+#endif
 }
 
 EventTargetData* Node::eventTargetData()
@@ -2447,6 +2567,23 @@ bool Node::dispatchEvent(PassRefPtr<Event> prpEvent)
     return dispatchGenericEvent(event.release());
 }
 
+static bool eventHasListeners(const AtomicString& eventType, DOMWindow* window, Node* node, Vector<RefPtr<ContainerNode> >& ancestors)
+{
+    if (window && window->hasEventListeners(eventType))
+        return true;
+
+    if (node->hasEventListeners(eventType))
+        return true;
+
+    for (size_t i = 0; i < ancestors.size(); i++) {
+        ContainerNode* ancestor = ancestors[i].get();
+        if (ancestor->hasEventListeners(eventType))
+            return true;
+    }
+
+   return false;    
+}
+
 bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
 {
     RefPtr<Event> event(prpEvent);
@@ -2455,12 +2592,6 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
     ASSERT(event->target());
     ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
 
-#if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = document()->inspectorTimelineAgent();
-    if (timelineAgent)
-        timelineAgent->willDispatchDOMEvent(*event);
-#endif
-
     // Make a vector of ancestors to send the event to.
     // If the node is not in a document just send the event to it.
     // Be sure to ref all of nodes since event handlers could result in the last reference going away.
@@ -2478,6 +2609,13 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
             targetForWindowEvents = static_cast<Document*>(topLevelContainer)->domWindow();
     }
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = document()->inspectorTimelineAgent();
+    bool timelineAgentIsActive = timelineAgent && eventHasListeners(event->type(), targetForWindowEvents, this, ancestors);
+    if (timelineAgentIsActive)
+        timelineAgent->willDispatchEvent(*event);
+#endif
+
     // Give the target node a chance to do some work before DOM event handlers get a crack.
     void* data = preDispatchEventHandler(event.get());
     if (event->propagationStopped())
@@ -2559,8 +2697,8 @@ doneDispatching:
 
 doneWithDefault:
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
-        timelineAgent->didDispatchDOMEvent();
+    if (timelineAgentIsActive && (timelineAgent = document()->inspectorTimelineAgent()))
+        timelineAgent->didDispatchEvent();
 #endif
 
     Document::updateStyleForAllDocuments();
@@ -2585,7 +2723,8 @@ void Node::dispatchSubtreeModifiedEvent()
 void Node::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent)
 {
     ASSERT(!eventDispatchForbidden());
-    ASSERT(eventType == eventNames().DOMFocusInEvent || eventType == eventNames().DOMFocusOutEvent || eventType == eventNames().DOMActivateEvent);
+    ASSERT(eventType == eventNames().focusinEvent || eventType == eventNames().focusoutEvent || 
+           eventType == eventNames().DOMFocusInEvent || eventType == eventNames().DOMFocusOutEvent || eventType == eventNames().DOMActivateEvent);
     
     bool cancelable = eventType == eventNames().DOMActivateEvent;
     
@@ -2727,7 +2866,7 @@ bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int det
     if (eventType == eventNames().clickEvent && detail == 2) {
         RefPtr<Event> doubleClickEvent = MouseEvent::create(eventNames().dblclickEvent,
             true, cancelable, document()->defaultView(),
-            detail, screenX, screenY, pageX, pageY,
+            detail, screenX, screenY, adjustedPageX, adjustedPageY,
             ctrlKey, altKey, shiftKey, metaKey, button,
             relatedTarget, 0, isSimulated);
         doubleClickEvent->setUnderlyingEvent(underlyingEvent.get());
@@ -2764,14 +2903,27 @@ void Node::dispatchWheelEvent(PlatformWheelEvent& e)
         }
     }
     
-    RefPtr<WheelEvent> we = WheelEvent::create(e.wheelTicksX(), e.wheelTicksY(),
+    WheelEvent::Granularity granularity;
+    switch (e.granularity()) {
+    case ScrollByPageWheelEvent:
+        granularity = WheelEvent::Page;
+        break;
+    case ScrollByPixelWheelEvent:
+    default:
+        granularity = WheelEvent::Pixel;
+        break;
+    }
+    
+    RefPtr<WheelEvent> we = WheelEvent::create(e.wheelTicksX(), e.wheelTicksY(), e.deltaX(), e.deltaY(), granularity,
         document()->defaultView(), e.globalX(), e.globalY(), adjustedPageX, adjustedPageY,
         e.ctrlKey(), e.altKey(), e.shiftKey(), e.metaKey());
 
     we->setAbsoluteLocation(IntPoint(pos.x(), pos.y()));
 
-    if (!dispatchEvent(we.release()))
+    if (!dispatchEvent(we) || we->defaultHandled())
         e.accept();
+
+    we.release();
 }
 
 void Node::dispatchFocusEvent()
@@ -2811,6 +2963,35 @@ void Node::defaultEventHandler(Event* event)
         if (event->isTextEvent())
             if (Frame* frame = document()->frame())
                 frame->eventHandler()->defaultTextInputEventHandler(static_cast<TextEvent*>(event));
+#if ENABLE(PAN_SCROLLING)
+    } else if (eventType == eventNames().mousedownEvent) {
+        MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+        if (mouseEvent->button() == MiddleButton) {
+            if (enclosingLinkEventParentOrSelf())
+                return;
+
+            RenderObject* renderer = this->renderer();
+            while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeScrolledAndHasScrollableArea()))
+                renderer = renderer->parent();
+
+            if (renderer) {
+                if (Frame* frame = document()->frame())
+                    frame->eventHandler()->startPanScrolling(renderer);
+            }
+        }
+#endif
+    } else if (eventType == eventNames().mousewheelEvent && event->isWheelEvent()) {
+        WheelEvent* wheelEvent = static_cast<WheelEvent*>(event);
+        
+        // If we don't have a renderer, send the wheel event to the first node we find with a renderer.
+        // This is needed for <option> and <optgroup> elements so that <select>s get a wheel scroll.
+        Node* startNode = this;
+        while (startNode && !startNode->renderer())
+            startNode = startNode->parent();
+        
+        if (startNode && startNode->renderer())
+            if (Frame* frame = document()->frame())
+                frame->eventHandler()->defaultWheelEventHandler(startNode, wheelEvent);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.h b/src/3rdparty/webkit/WebCore/dom/Node.h
index 35be6d301f..3d716fd1cb 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.h
+++ b/src/3rdparty/webkit/WebCore/dom/Node.h
@@ -27,14 +27,9 @@
 
 #include "EventTarget.h"
 #include "KURLHash.h"
-#include "PlatformString.h"
-#include "RegisteredEventListener.h"
+#include "ScriptWrappable.h"
 #include "TreeShared.h"
-#include "FloatPoint.h"
-#include <wtf/Assertions.h>
 #include <wtf/ListHashSet.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
@@ -46,6 +41,7 @@ class DynamicNodeList;
 class Element;
 class Event;
 class EventListener;
+class FloatPoint;
 class Frame;
 class IntRect;
 class KeyboardEvent;
@@ -81,7 +77,7 @@ const unsigned short DOCUMENT_POSITION_CONTAINED_BY = 0x10;
 const unsigned short DOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC = 0x20;
 
 // this class implements nodes, which can have a parent but no children:
-class Node : public EventTarget, public TreeShared<Node> {
+class Node : public EventTarget, public TreeShared<Node>, public ScriptWrappable {
     friend class Document;
 public:
     enum NodeType {
@@ -206,6 +202,9 @@ public:
     // The node's parent for the purpose of event capture and bubbling.
     virtual ContainerNode* eventParentNode();
 
+    // Returns the enclosing event parent node (or self) that, when clicked, would trigger a navigation.
+    Node* enclosingLinkEventParentOrSelf();
+
     // Node ancestors when concerned about event flow
     void eventAncestors(Vector<RefPtr<ContainerNode> > &ancestors);
 
@@ -252,7 +251,7 @@ public:
     virtual ContainerNode* addChild(PassRefPtr<Node>);
 
     // Called by the parser when this element's close tag is reached,
-    // signalling that all child tags have been parsed and added.
+    // signaling that all child tags have been parsed and added.
     // This is needed for <applet> and <object> elements, which can't lay themselves out
     // until they know all of their nested <param>s. [Radar 3603191, 4040848].
     // Also used for script elements and some SVG elements for similar purposes,
@@ -289,9 +288,6 @@ public:
     void setNeedsStyleRecalc(StyleChangeType changeType = FullStyleChange);
     void setIsLink(bool b = true) { m_isLink = b; }
 
-    bool inSubtreeMark() const { return m_inSubtreeMark; }
-    void setInSubtreeMark(bool b = true) { m_inSubtreeMark = b; }
-
     void lazyAttach();
     virtual bool canLazyAttach();
 
@@ -575,7 +571,10 @@ protected:
     void setTabIndexExplicitly(short);
     
     bool hasRareData() const { return m_hasRareData; }
-    
+#if ENABLE(SVG)
+    bool hasRareSVGData() const { return m_hasRareSVGData; }
+#endif
+
     NodeRareData* rareData() const;
     NodeRareData* ensureRareData();
 
@@ -588,8 +587,6 @@ private:
     virtual void refEventTarget() { ref(); }
     virtual void derefEventTarget() { deref(); }
 
-    void removeAllEventListenersSlowCase();
-
     virtual NodeRareData* createRareData();
     Node* containerChildNode(unsigned index) const;
     unsigned containerChildNodeCount() const;
@@ -623,7 +620,6 @@ private:
     bool m_hovered : 1;
     bool m_inActiveChain : 1;
     bool m_inDetach : 1;
-    bool m_inSubtreeMark : 1;
     bool m_hasRareData : 1;
     const bool m_isElement : 1;
     const bool m_isContainer : 1;
@@ -640,9 +636,10 @@ protected:
 #if ENABLE(SVG)
     mutable bool m_areSVGAttributesValid : 1; // Element
     mutable bool m_synchronizingSVGAttributes : 1; // SVGElement
+    bool m_hasRareSVGData : 1; // SVGElement
 #endif
 
-    // 11 bits remaining
+    // 10 bits remaining
 };
 
 // Used in Node::addSubresourceAttributeURLs() and in addSubresourceStyleURLs()
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.idl b/src/3rdparty/webkit/WebCore/dom/Node.idl
index 45ea132568..048931692b 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Node.idl
@@ -21,16 +21,14 @@
 module core {
 
     interface [
+        CustomHeader,
         CustomMarkFunction,
         CustomPushEventHandlerScope,
         CustomToJS,
         EventTarget,
-        GenerateConstructor,
         GenerateNativeConverter,
         InlineGetOwnPropertySlot,
-        Polymorphic,
-        InterfaceUUID=84BA0D7A-7E3E-4a7b-B6FB-7653E8FB54ED,
-        ImplementationUUID=81B47FDB-94B0-40fd-8E0C-FB2A6E53CC04
+        Polymorphic
     ] Node
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         : Object, EventTarget
@@ -135,17 +133,15 @@ module core {
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
 
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
-        [Custom] void addEventListener(in DOMString type, 
-                                       in EventListener listener, 
-                                       in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type, 
+        [JSCCustom] void addEventListener(in DOMString type, 
                                           in EventListener listener, 
                                           in boolean useCapture);
+        [JSCCustom] void removeEventListener(in DOMString type, 
+                                             in EventListener listener, 
+                                             in boolean useCapture);
         boolean dispatchEvent(in Event event)
             raises(EventException);
 #endif
-#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeFilter.h b/src/3rdparty/webkit/WebCore/dom/NodeFilter.h
index 5a542adb10..53b32e1b6c 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeFilter.h
+++ b/src/3rdparty/webkit/WebCore/dom/NodeFilter.h
@@ -73,8 +73,9 @@ namespace WebCore {
         short acceptNode(ScriptState*, Node*) const;
         void markAggregate(JSC::MarkStack& markStack) { m_condition->markAggregate(markStack); };
 
-        // For non-JS bindings. Silently ignores the JavaScript exception if any.
-        short acceptNode(Node* node) const { return acceptNode(scriptStateFromNode(node), node); }
+        // Do not call these functions. They are just scaffolding to support the Objective-C bindings.
+        // They operate in the main thread normal world, and they swallow JS exceptions.
+        short acceptNode(Node* node) const { return acceptNode(scriptStateFromNode(mainThreadNormalWorld(), node), node); }
 
     private:
         NodeFilter(PassRefPtr<NodeFilterCondition> condition) : m_condition(condition) { }
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeFilter.idl b/src/3rdparty/webkit/WebCore/dom/NodeFilter.idl
index 3cc5e86e35..d721f809e6 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeFilter.idl
+++ b/src/3rdparty/webkit/WebCore/dom/NodeFilter.idl
@@ -21,7 +21,7 @@
 module traversal {
 
     // Introduced in DOM Level 2:
-    interface [GenerateConstructor, CustomMarkFunction, CustomNativeConverter, ObjCProtocol] NodeFilter {
+    interface [CustomMarkFunction, CustomNativeConverter, ObjCProtocol] NodeFilter {
 
         // Constants returned by acceptNode
         const short               FILTER_ACCEPT                  = 1;
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeIterator.h b/src/3rdparty/webkit/WebCore/dom/NodeIterator.h
index 2a992d3ddc..3eec49aac8 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeIterator.h
+++ b/src/3rdparty/webkit/WebCore/dom/NodeIterator.h
@@ -52,9 +52,10 @@ namespace WebCore {
         // This function is called before any node is removed from the document tree.
         void nodeWillBeRemoved(Node*);
 
-        // For non-JS bindings. Silently ignores the JavaScript exception if any.
-        PassRefPtr<Node> nextNode(ExceptionCode& ec) { return nextNode(scriptStateFromNode(referenceNode()), ec); }
-        PassRefPtr<Node> previousNode(ExceptionCode& ec) { return previousNode(scriptStateFromNode(referenceNode()), ec); }
+        // Do not call these functions. They are just scaffolding to support the Objective-C bindings.
+        // They operate in the main thread normal world, and they swallow JS exceptions.
+        PassRefPtr<Node> nextNode(ExceptionCode& ec) { return nextNode(scriptStateFromNode(mainThreadNormalWorld(), referenceNode()), ec); }
+        PassRefPtr<Node> previousNode(ExceptionCode& ec) { return previousNode(scriptStateFromNode(mainThreadNormalWorld(), referenceNode()), ec); }
 
     private:
         NodeIterator(PassRefPtr<Node>, unsigned whatToShow, PassRefPtr<NodeFilter>, bool expandEntityReferences);
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeIterator.idl b/src/3rdparty/webkit/WebCore/dom/NodeIterator.idl
index 8805d07122..e1818a18cd 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeIterator.idl
+++ b/src/3rdparty/webkit/WebCore/dom/NodeIterator.idl
@@ -22,8 +22,7 @@ module traversal {
 
     // Introduced in DOM Level 2:
     interface [
-        CustomMarkFunction,
-        GenerateConstructor
+        CustomMarkFunction
     ] NodeIterator {
         readonly attribute Node root;
         readonly attribute unsigned long whatToShow;
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeList.idl b/src/3rdparty/webkit/WebCore/dom/NodeList.idl
index cf21cc7262..edb2dc7075 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeList.idl
+++ b/src/3rdparty/webkit/WebCore/dom/NodeList.idl
@@ -21,12 +21,9 @@
 module core {
 
     interface [
-        GenerateConstructor,
         HasIndexGetter,
         HasNameGetter,
-        CustomCall,
-        InterfaceUUID=F9A9F6A9-385C-414e-A6F6-E2E0CF574130,
-        ImplementationUUID=BBB49E8B-DB1D-4c4a-B970-D300FB4609FA
+        CustomCall
     ] NodeList {
 
         Node item(in [IsIndex] unsigned long index);
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeRareData.h b/src/3rdparty/webkit/WebCore/dom/NodeRareData.h
index 8b9e1bf5ed..6e9d0e4166 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeRareData.h
+++ b/src/3rdparty/webkit/WebCore/dom/NodeRareData.h
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-struct NodeListsNodeData {
+struct NodeListsNodeData : Noncopyable {
     typedef HashSet<DynamicNodeList*> NodeListSet;
     NodeListSet m_listsWithCaches;
     
@@ -62,7 +62,7 @@ private:
     }
 };
     
-class NodeRareData {
+class NodeRareData : public Noncopyable {
 public:    
     NodeRareData()
         : m_tabIndex(0)
diff --git a/src/3rdparty/webkit/WebCore/dom/Notation.idl b/src/3rdparty/webkit/WebCore/dom/Notation.idl
index a16fde633f..96351d2532 100644
--- a/src/3rdparty/webkit/WebCore/dom/Notation.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Notation.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=6580C703-F5FF-40a7-ACF2-AB80EBC83CA1,
-        ImplementationUUID=A52869F7-A3CE-4f4c-8C27-E369C4ED9FF9
-    ] Notation : Node {
+    interface Notation : Node {
         readonly attribute [ConvertNullStringTo=Null] DOMString publicId;
         readonly attribute [ConvertNullStringTo=Null] DOMString systemId;
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/OptionElement.h b/src/3rdparty/webkit/WebCore/dom/OptionElement.h
index a765d53e26..232c3ee5d7 100644
--- a/src/3rdparty/webkit/WebCore/dom/OptionElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/OptionElement.h
@@ -34,6 +34,7 @@ class OptionElement {
 public:
     virtual ~OptionElement() { }
 
+    virtual bool disabled() const = 0;
     virtual bool selected() const = 0;
     virtual void setSelectedState(bool) = 0;
 
diff --git a/src/3rdparty/webkit/WebCore/dom/OverflowEvent.idl b/src/3rdparty/webkit/WebCore/dom/OverflowEvent.idl
index 4a1bed58a4..0b4f5c6037 100644
--- a/src/3rdparty/webkit/WebCore/dom/OverflowEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/OverflowEvent.idl
@@ -24,9 +24,7 @@
  */
 module events {
 
-    interface [
-        GenerateConstructor
-    ] OverflowEvent : Event {
+    interface OverflowEvent : Event {
         const unsigned short HORIZONTAL = 0;
         const unsigned short VERTICAL   = 1;
         const unsigned short BOTH       = 2;
diff --git a/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.idl b/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.idl
index a09f94b462..8d70f67cf9 100644
--- a/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.idl
@@ -25,9 +25,7 @@
 
 module events {
 
-    interface [
-        GenerateConstructor
-    ] PageTransitionEvent : Event {
+    interface PageTransitionEvent : Event {
 
         readonly attribute boolean persisted;
 
diff --git a/src/3rdparty/webkit/WebCore/dom/PopStateEvent.cpp b/src/3rdparty/webkit/WebCore/dom/PopStateEvent.cpp
new file mode 100644
index 0000000000..b9ad862bc0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/PopStateEvent.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "PopStateEvent.h"
+
+#include "EventNames.h"
+
+namespace WebCore {
+
+PopStateEvent::PopStateEvent(PassRefPtr<SerializedScriptValue> stateObject)
+    : Event(eventNames().popstateEvent, false, true)
+    , m_stateObject(stateObject)
+{
+}
+    
+void PopStateEvent::initPopStateEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> stateObject)
+{
+    if (dispatched())
+        return;
+    
+    initEvent(type, canBubble, cancelable);
+
+    m_stateObject = stateObject;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/PopStateEvent.h b/src/3rdparty/webkit/WebCore/dom/PopStateEvent.h
new file mode 100644
index 0000000000..2fb8d0685b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/PopStateEvent.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef PopStateEvent_h
+#define PopStateEvent_h
+
+#include "Event.h"
+#include "SerializedScriptValue.h"
+
+namespace WebCore {
+
+class SerializedScriptValue;
+
+class PopStateEvent : public Event {
+public:
+    static PassRefPtr<PopStateEvent> create(PassRefPtr<SerializedScriptValue> stateObject)
+    {
+        return adoptRef(new PopStateEvent(stateObject));
+    }
+
+    void initPopStateEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue>);
+    bool isPopStateEvent() const { return true; }
+
+    SerializedScriptValue* state() const { return m_stateObject.get(); }    
+
+private:
+    PopStateEvent(PassRefPtr<SerializedScriptValue>);
+
+    RefPtr<SerializedScriptValue> m_stateObject;
+};
+
+} // namespace WebCore
+
+#endif // PopStateEvent_h
diff --git a/src/3rdparty/webkit/WebCore/dom/PopStateEvent.idl b/src/3rdparty/webkit/WebCore/dom/PopStateEvent.idl
new file mode 100644
index 0000000000..f9c9a71599
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/PopStateEvent.idl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module events {
+
+    interface PopStateEvent : Event {
+        [Custom] void initPopStateEvent(in DOMString typeArg, 
+                               in boolean canBubbleArg, 
+                               in boolean cancelableArg, 
+                               in any stateArg);
+                               
+        readonly attribute [V8CustomGetter] any state;
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/Position.cpp b/src/3rdparty/webkit/WebCore/dom/Position.cpp
index 060b28cfb3..b471a9927f 100644
--- a/src/3rdparty/webkit/WebCore/dom/Position.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Position.cpp
@@ -307,6 +307,27 @@ bool Position::atLastEditingPositionForNode() const
     return m_offset >= lastOffsetForEditing(node());
 }
 
+// A position is considered at editing boundary if one of the following is true:
+// 1. It is the first position in the node and the next visually equivalent position
+//    is non editable.
+// 2. It is the last position in the node and the previous visually equivalent position
+//    is non editable.
+// 3. It is an editable position and both the next and previous visually equivalent
+//    positions are both non editable.
+bool Position::atEditingBoundary() const
+{
+    Position nextPosition = downstream(CanCrossEditingBoundary);
+    if (atFirstEditingPositionForNode() && nextPosition.isNotNull() && !nextPosition.node()->isContentEditable())
+        return true;
+        
+    Position prevPosition = upstream(CanCrossEditingBoundary);
+    if (atLastEditingPositionForNode() && prevPosition.isNotNull() && !prevPosition.node()->isContentEditable())
+        return true;
+        
+    return nextPosition.isNotNull() && !nextPosition.node()->isContentEditable()
+        && prevPosition.isNotNull() && !prevPosition.node()->isContentEditable();
+}
+
 bool Position::atStartOfTree() const
 {
     if (isNull())
@@ -448,7 +469,7 @@ static bool isStreamer(const PositionIterator& pos)
 // and downstream() will return the right one.
 // Also, upstream() will return [boundary, 0] for any of the positions from [boundary, 0] to the first candidate
 // in boundary, where endsOfNodeAreVisuallyDistinctPositions(boundary) is true.
-Position Position::upstream() const
+Position Position::upstream(EditingBoundaryCrossingRule rule) const
 {
     Node* startNode = node();
     if (!startNode)
@@ -460,6 +481,7 @@ Position Position::upstream() const
     PositionIterator currentPos = lastVisible;
     bool startEditable = startNode->isContentEditable();
     Node* lastNode = startNode;
+    bool boundaryCrossed = false;
     for (; !currentPos.atStart(); currentPos.decrement()) {
         Node* currentNode = currentPos.node();
         
@@ -468,12 +490,15 @@ Position Position::upstream() const
         if (currentNode != lastNode) {
             // Don't change editability.
             bool currentEditable = currentNode->isContentEditable();
-            if (startEditable != currentEditable)
-                break;
+            if (startEditable != currentEditable) {
+                if (rule == CannotCrossEditingBoundary)
+                    break;
+                boundaryCrossed = true;
+            }
             lastNode = currentNode;
         }
 
-        // If we've moved to a position that is visually disinct, return the last saved position. There 
+        // If we've moved to a position that is visually distinct, return the last saved position. There 
         // is code below that terminates early if we're *about* to move to a visually distinct position.
         if (endsOfNodeAreVisuallyDistinctPositions(currentNode) && currentNode != boundary)
             return lastVisible;
@@ -483,6 +508,11 @@ Position Position::upstream() const
         if (!renderer || renderer->style()->visibility() != VISIBLE)
             continue;
                  
+        if (rule == CanCrossEditingBoundary && boundaryCrossed) {
+            lastVisible = currentPos;
+            break;
+        }
+        
         // track last visible streamer position
         if (isStreamer(currentPos))
             lastVisible = currentPos;
@@ -560,7 +590,7 @@ Position Position::upstream() const
 // and upstream() will return the left one.
 // Also, downstream() will return the last position in the last atomic node in boundary for all of the positions
 // in boundary after the last candidate, where endsOfNodeAreVisuallyDistinctPositions(boundary).
-Position Position::downstream() const
+Position Position::downstream(EditingBoundaryCrossingRule rule) const
 {
     Node* startNode = node();
     if (!startNode)
@@ -572,6 +602,7 @@ Position Position::downstream() const
     PositionIterator currentPos = lastVisible;
     bool startEditable = startNode->isContentEditable();
     Node* lastNode = startNode;
+    bool boundaryCrossed = false;
     for (; !currentPos.atEnd(); currentPos.increment()) {   
         Node* currentNode = currentPos.node();
         
@@ -580,8 +611,12 @@ Position Position::downstream() const
         if (currentNode != lastNode) {
             // Don't change editability.
             bool currentEditable = currentNode->isContentEditable();
-            if (startEditable != currentEditable)
-                break;
+            if (startEditable != currentEditable) {
+                if (rule == CannotCrossEditingBoundary)
+                    break;
+                boundaryCrossed = true;
+            }
+                
             lastNode = currentNode;
         }
 
@@ -604,6 +639,11 @@ Position Position::downstream() const
         if (!renderer || renderer->style()->visibility() != VISIBLE)
             continue;
             
+        if (rule == CanCrossEditingBoundary && boundaryCrossed) {
+            lastVisible = currentPos;
+            break;
+        }
+        
         // track last visible streamer position
         if (isStreamer(currentPos))
             lastVisible = currentPos;
@@ -704,10 +744,18 @@ bool Position::isCandidate() const
     if (isTableElement(node()) || editingIgnoresContent(node()))
         return (atFirstEditingPositionForNode() || atLastEditingPositionForNode()) && !nodeIsUserSelectNone(node()->parent());
 
-    if (!node()->hasTagName(htmlTag) && renderer->isBlockFlow() && !hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
-       (toRenderBox(renderer)->height() || node()->hasTagName(bodyTag)))
-        return atFirstEditingPositionForNode() && !nodeIsUserSelectNone(node());
-    
+    if (m_anchorNode->hasTagName(htmlTag))
+        return false;
+        
+    if (renderer->isBlockFlow()) {
+        if (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)) {
+            if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer))
+                return atFirstEditingPositionForNode() && !Position::nodeIsUserSelectNone(node());
+            return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(node()) && atEditingBoundary();
+        }
+    } else
+        return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(node()) && atEditingBoundary();
+
     return false;
 }
 
@@ -949,10 +997,32 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
 {
     caretOffset = m_offset;
     RenderObject* renderer = node()->renderer();
+          
     if (!renderer->isText()) {
-        inlineBox = renderer->isBox() ? toRenderBox(renderer)->inlineBoxWrapper() : 0;
-        if (!inlineBox || (caretOffset > inlineBox->caretMinOffset() && caretOffset < inlineBox->caretMaxOffset()))
+        if (!renderer->isRenderButton() && renderer->isBlockFlow() && hasRenderedNonAnonymousDescendantsWithHeight(renderer)) {
+            bool lastPosition = caretOffset == lastOffsetInNode(node());
+            Node* startNode = lastPosition ? node()->childNode(caretOffset - 1) : node()->childNode(caretOffset);
+            while (startNode && (!startNode->renderer() || (startNode->isTextNode() && toRenderText(startNode->renderer())->isAllCollapsibleWhitespace())))
+                startNode = (lastPosition)? startNode->previousSibling(): startNode->nextSibling();
+            if (startNode) {
+                Position pos(startNode, 0);
+                pos = pos.downstream(CanCrossEditingBoundary);
+                pos.getInlineBoxAndOffset(UPSTREAM, primaryDirection, inlineBox, caretOffset);
+                if (lastPosition && inlineBox)
+                    caretOffset = inlineBox->caretMaxOffset();
+                return;
+            }
+        }
+        inlineBox = 0;
+        if (renderer->isBox()) {
+            inlineBox = toRenderBox(renderer)->inlineBoxWrapper();
+            if (!inlineBox || (caretOffset > inlineBox->caretMinOffset() && caretOffset < inlineBox->caretMaxOffset()))
+                return;
+        } else if (!node()->isLink() && node()->isContentEditable()) {
+            Position pos = positionInParentBeforeNode(node()).upstream();
+            pos.getInlineBoxAndOffset(DOWNSTREAM, primaryDirection, inlineBox, caretOffset);
             return;
+        }
     } else {
         RenderText* textRenderer = toRenderText(renderer);
 
@@ -971,12 +1041,13 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
                 return;
             }
 
-            if ((caretOffset == caretMinOffset) ^ (affinity == UPSTREAM))
+            if (((caretOffset == caretMaxOffset) ^ (affinity == DOWNSTREAM))
+                || ((caretOffset == caretMinOffset) ^ (affinity == UPSTREAM)))
                 break;
 
             candidate = box;
         }
-        if (candidate && !box && affinity == DOWNSTREAM) {
+        if (candidate && candidate == textRenderer->lastTextBox() && affinity == DOWNSTREAM) {
             box = searchAheadForBetterMatch(textRenderer);
             if (box)
                 caretOffset = box->caretMinOffset();
@@ -1106,8 +1177,10 @@ void Position::formatForDebugger(char* buffer, unsigned length) const
 
 void Position::showTreeForThis() const
 {
-    if (node())
+    if (node()) {
         node()->showTreeForThis();
+        fprintf(stderr, "offset: %d\n", m_offset);
+    }
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/Position.h b/src/3rdparty/webkit/WebCore/dom/Position.h
index c08872d5f7..fc5849f0a9 100644
--- a/src/3rdparty/webkit/WebCore/dom/Position.h
+++ b/src/3rdparty/webkit/WebCore/dom/Position.h
@@ -56,6 +56,11 @@ public:
         PositionIsBeforeAnchor
     };
 
+    enum EditingBoundaryCrossingRule {
+        CanCrossEditingBoundary,
+        CannotCrossEditingBoundary
+    };
+    
     Position()
         : m_offset(0)
         , m_anchorType(PositionIsOffsetInAnchor)
@@ -130,6 +135,9 @@ public:
     bool atFirstEditingPositionForNode() const;
     bool atLastEditingPositionForNode() const;
 
+    // Returns true if the visually equivalent positions around have different editability
+    bool atEditingBoundary() const;
+    
     bool atStartOfTree() const;
     bool atEndOfTree() const;
 
@@ -139,8 +147,8 @@ public:
     Position trailingWhitespacePosition(EAffinity, bool considerNonCollapsibleWhitespace = false) const;
     
     // These return useful visually equivalent positions.
-    Position upstream() const;
-    Position downstream() const;
+    Position upstream(EditingBoundaryCrossingRule = CannotCrossEditingBoundary) const;
+    Position downstream(EditingBoundaryCrossingRule = CannotCrossEditingBoundary) const;
     
     bool isCandidate() const;
     bool inRenderedText() const;
diff --git a/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp b/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp
index 8d881ba277..f5b65f5849 100644
--- a/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp
@@ -156,10 +156,14 @@ bool PositionIterator::isCandidate() const
     if (isTableElement(m_anchorNode) || editingIgnoresContent(m_anchorNode))
         return (atStartOfNode() || atEndOfNode()) && !Position::nodeIsUserSelectNone(m_anchorNode->parent());
 
-    if (!m_anchorNode->hasTagName(htmlTag) && renderer->isBlockFlow() && !Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
-       (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)))
-        return atStartOfNode() && !Position::nodeIsUserSelectNone(m_anchorNode);
-    
+    if (!m_anchorNode->hasTagName(htmlTag) && renderer->isBlockFlow()) {
+        if (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)) {
+            if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer))
+                return atStartOfNode() && !Position::nodeIsUserSelectNone(m_anchorNode);
+            return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(m_anchorNode) && Position(*this).atEditingBoundary();
+        }
+    }
+
     return false;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
index 72993dd271..92a2b409a4 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
@@ -42,6 +42,7 @@ inline ProcessingInstruction::ProcessingInstruction(Document* document, const St
     , m_cachedSheet(0)
     , m_loading(false)
     , m_alternate(false)
+    , m_createdByParser(false)
 #if ENABLE(XSLT)
     , m_isXSL(false)
 #endif
@@ -138,7 +139,8 @@ void ProcessingInstruction::checkStyleSheet()
             // We need to make a synthetic XSLStyleSheet that is embedded.  It needs to be able
             // to kick off import/include loads that can hang off some parent sheet.
             if (m_isXSL) {
-                m_sheet = XSLStyleSheet::createEmbedded(this, m_localHref);
+                KURL finalURL(ParsedURLString, m_localHref);
+                m_sheet = XSLStyleSheet::createInline(this, finalURL);
                 m_loading = false;
             }
 #endif
@@ -196,24 +198,27 @@ bool ProcessingInstruction::sheetLoaded()
     return false;
 }
 
-void ProcessingInstruction::setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet* sheet)
+void ProcessingInstruction::setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CachedCSSStyleSheet* sheet)
 {
 #if ENABLE(XSLT)
     ASSERT(!m_isXSL);
 #endif
-    RefPtr<CSSStyleSheet> newSheet = CSSStyleSheet::create(this, url, charset);
+    RefPtr<CSSStyleSheet> newSheet = CSSStyleSheet::create(this, href, baseURL, charset);
     m_sheet = newSheet;
-    parseStyleSheet(sheet->sheetText());
+    // We don't need the cross-origin security check here because we are
+    // getting the sheet text in "strict" mode. This enforces a valid CSS MIME
+    // type.
+    parseStyleSheet(sheet->sheetText(true));
     newSheet->setTitle(m_title);
     newSheet->setMedia(MediaList::create(newSheet.get(), m_media));
     newSheet->setDisabled(m_alternate);
 }
 
 #if ENABLE(XSLT)
-void ProcessingInstruction::setXSLStyleSheet(const String& url, const String& sheet)
+void ProcessingInstruction::setXSLStyleSheet(const String& href, const KURL& baseURL, const String& sheet)
 {
     ASSERT(m_isXSL);
-    m_sheet = XSLStyleSheet::create(this, url);
+    m_sheet = XSLStyleSheet::create(this, href, baseURL);
     parseStyleSheet(sheet);
 }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.h b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.h
index 4b7dc86c60..fdb0ec9e3d 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.h
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.h
@@ -68,9 +68,9 @@ private:
     virtual void removedFromDocument();
 
     void checkStyleSheet();
-    virtual void setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet*);
+    virtual void setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CachedCSSStyleSheet*);
 #if ENABLE(XSLT)
-    virtual void setXSLStyleSheet(const String& url, const String& sheet);
+    virtual void setXSLStyleSheet(const String& href, const KURL& baseURL, const String& sheet);
 #endif
 
     bool isLoading() const;
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl
index 578b22e80a..efcc9c1910 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl
@@ -20,11 +20,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=5947E8F8-B5CB-4a51-B883-B91F344F1E13,
-        ImplementationUUID=7EEC0376-3D76-4643-A964-97B8AC1FB6D3
-    ] ProcessingInstruction : Node {
+    interface ProcessingInstruction : Node {
 
         // DOM Level 1
 
@@ -32,11 +28,8 @@ module core {
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString data
                      setter raises(DOMException);
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // interface LinkStyle from DOM Level 2 Style Sheets
         readonly attribute StyleSheet sheet;
-#endif
-
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/ProgressEvent.idl b/src/3rdparty/webkit/WebCore/dom/ProgressEvent.idl
index 2db72af3d0..afdf3a2d89 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProgressEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/ProgressEvent.idl
@@ -25,9 +25,7 @@
 
 module events {
 
-    interface [
-        GenerateConstructor
-    ] ProgressEvent : Event {
+    interface ProgressEvent : Event {
          readonly attribute boolean         lengthComputable;
          readonly attribute unsigned long   loaded;
          readonly attribute unsigned long   total;
diff --git a/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp b/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
index 2c5f39ae57..795bdb687e 100644
--- a/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
@@ -51,7 +51,7 @@ struct QNameComponentsTranslator {
 
 static QNameSet* gNameCache;
 
-QualifiedName::QualifiedName(const AtomicString& p, const AtomicString& l, const AtomicString& n)
+void QualifiedName::init(const AtomicString& p, const AtomicString& l, const AtomicString& n)
 {
     if (!gNameCache)
         gNameCache = new QNameSet;
@@ -62,6 +62,16 @@ QualifiedName::QualifiedName(const AtomicString& p, const AtomicString& l, const
         m_impl->ref();
 }
 
+QualifiedName::QualifiedName(const AtomicString& p, const AtomicString& l, const AtomicString& n)
+{
+    init(p, l, n);
+}
+
+QualifiedName::QualifiedName(const AtomicString& p, const char* l, const AtomicString& n)
+{
+    init(p, AtomicString(l), n);
+}
+
 void QualifiedName::deref()
 {
 #ifdef QNAME_DEFAULT_CONSTRUCTOR
diff --git a/src/3rdparty/webkit/WebCore/dom/QualifiedName.h b/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
index 3b9f5c44be..7581ba121a 100644
--- a/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
+++ b/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
@@ -22,7 +22,7 @@
 #define QualifiedName_h
 
 #include "AtomicString.h"
-#include <wtf/HashFunctions.h>
+#include <wtf/HashTraits.h>
 
 namespace WebCore {
 
@@ -32,7 +32,7 @@ struct QualifiedNameComponents {
     StringImpl* m_namespace;
 };
 
-class QualifiedName {
+class QualifiedName : public FastAllocBase {
 public:
     class QualifiedNameImpl : public RefCounted<QualifiedNameImpl> {
     public:
@@ -57,6 +57,7 @@ public:
     };
 
     QualifiedName(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI);
+    QualifiedName(const AtomicString& prefix, const char* localName, const AtomicString& namespaceURI);
     ~QualifiedName() { deref(); }
 #ifdef QNAME_DEFAULT_CONSTRUCTOR
     QualifiedName() : m_impl(0) { }
@@ -88,6 +89,7 @@ public:
     static void init();
     
 private:
+    void init(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI);
     void ref() const { m_impl->ref(); }
     void deref();
     
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.cpp b/src/3rdparty/webkit/WebCore/dom/Range.cpp
index 122130d5d2..52d1785b5f 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Range.cpp
@@ -666,7 +666,7 @@ PassRefPtr<DocumentFragment> Range::processContents(ActionType action, Exception
     }
 
     // Complex case: Start and end containers are different.
-    // There are three possiblities here:
+    // There are three possibilities here:
     // 1. Start container == commonRoot (End container must be a descendant)
     // 2. End container == commonRoot (Start container must be a descendant)
     // 3. Neither is commonRoot, they are both descendants
@@ -1417,7 +1417,7 @@ void Range::surroundContents(PassRefPtr<Node> passNewParent, ExceptionCode& ec)
     // although this will fail below for another reason).
     if (parentOfNewParent->isCharacterDataNode())
         parentOfNewParent = parentOfNewParent->parentNode();
-    if (!parentOfNewParent->childTypeAllowed(newParent->nodeType())) {
+    if (!parentOfNewParent || !parentOfNewParent->childTypeAllowed(newParent->nodeType())) {
         ec = HIERARCHY_REQUEST_ERR;
         return;
     }
@@ -1595,12 +1595,32 @@ IntRect Range::boundingBox()
 
 void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight)
 {
-    if (!m_start.container() || !m_end.container())
+    Node* startContainer = m_start.container();
+    Node* endContainer = m_end.container();
+
+    if (!startContainer || !endContainer)
         return;
 
+    Node* stopNode = pastLastNode();
+    for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        RenderObject* r = node->renderer();
+        if (!r || !r->isText())
+            continue;
+        RenderText* renderText = toRenderText(r);
+        int startOffset = node == startContainer ? m_start.offset() : 0;
+        int endOffset = node == endContainer ? m_end.offset() : numeric_limits<int>::max();
+        renderText->absoluteRectsForRange(rects, startOffset, endOffset, useSelectionHeight);
+    }
+}
+
+void Range::textQuads(Vector<FloatQuad>& quads, bool useSelectionHeight)
+{
     Node* startContainer = m_start.container();
     Node* endContainer = m_end.container();
 
+    if (!startContainer || !endContainer)
+        return;
+
     Node* stopNode = pastLastNode();
     for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
         RenderObject* r = node->renderer();
@@ -1608,8 +1628,8 @@ void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight)
             continue;
         RenderText* renderText = toRenderText(r);
         int startOffset = node == startContainer ? m_start.offset() : 0;
-        int endOffset = node == endContainer ? m_end.offset() : INT_MAX;
-        renderText->absoluteRectsForRange(rects, startOffset, endOffset, useSelectionHeight);
+        int endOffset = node == endContainer ? m_end.offset() : numeric_limits<int>::max();
+        renderText->absoluteQuadsForRange(quads, startOffset, endOffset, useSelectionHeight);
     }
 }
 
@@ -1910,3 +1930,17 @@ void Range::getBorderAndTextQuads(Vector<FloatQuad>& quads) const
 }
 
 } // namespace WebCore
+
+#ifndef NDEBUG
+
+void showTree(const WebCore::Range* range)
+{
+    if (range && range->boundaryPointsValid()) {
+        WebCore::Position start = range->startPosition();
+        WebCore::Position end = range->endPosition();
+        start.node()->showTreeAndMark(start.node(), "S", end.node(), "E");
+        fprintf(stderr, "start offset: %d, end offset: %d\n", start.deprecatedEditingOffset(), end.deprecatedEditingOffset());
+    }
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.h b/src/3rdparty/webkit/WebCore/dom/Range.h
index e2e282b4ef..fd0f66ae9c 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.h
+++ b/src/3rdparty/webkit/WebCore/dom/Range.h
@@ -105,7 +105,10 @@ public:
     Node* shadowTreeRootNode() const;
 
     IntRect boundingBox();
+    // Not transform-friendly
     void textRects(Vector<IntRect>&, bool useSelectionHeight = false);
+    // Transform-friendly
+    void textQuads(Vector<FloatQuad>&, bool useSelectionHeight = false);
 
     void nodeChildrenChanged(ContainerNode*);
     void nodeWillBeRemoved(Node*);
@@ -155,4 +158,9 @@ inline bool operator!=(const Range& a, const Range& b) { return !(a == b); }
 
 } // namespace
 
+#ifndef NDEBUG
+// Outside the WebCore namespace for ease of invocation from gdb.
+void showTree(const WebCore::Range*);
+#endif
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.idl b/src/3rdparty/webkit/WebCore/dom/Range.idl
index 9024e09468..cd01d614b6 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Range.idl
@@ -21,7 +21,7 @@
 module ranges {
 
     // Introduced in DOM Level 2:
-    interface [GenerateConstructor] Range {
+    interface Range {
 
         readonly attribute Node startContainer
             getter raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/dom/RangeException.h b/src/3rdparty/webkit/WebCore/dom/RangeException.h
index 2eee3b046c..c9f4f5cb70 100644
--- a/src/3rdparty/webkit/WebCore/dom/RangeException.h
+++ b/src/3rdparty/webkit/WebCore/dom/RangeException.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
diff --git a/src/3rdparty/webkit/WebCore/dom/RangeException.idl b/src/3rdparty/webkit/WebCore/dom/RangeException.idl
index d2cf385f0c..100912dc1a 100644
--- a/src/3rdparty/webkit/WebCore/dom/RangeException.idl
+++ b/src/3rdparty/webkit/WebCore/dom/RangeException.idl
@@ -19,9 +19,7 @@
 
 module ranges {
 
-    interface [
-        GenerateConstructor
-    ] RangeException {
+    interface RangeException {
 
         readonly attribute unsigned short   code;
         readonly attribute DOMString        name;
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp b/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
index 827aff390e..731c3ba0ea 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
@@ -177,7 +177,7 @@ void ScriptElementData::evaluateScript(const ScriptSourceCode& sourceCode)
         return;
 
     if (Frame* frame = m_element->document()->frame()) {
-        if (!frame->script()->isEnabled())
+        if (!frame->script()->canExecuteScripts(AboutToExecuteScript))
             return;
 
         m_evaluated = true;
@@ -229,12 +229,14 @@ bool ScriptElementData::shouldExecuteAsJavaScript() const
          We want to accept all the values that either of these browsers accept, but not other values.
      */
     String type = m_scriptElement->typeAttributeValue();
-    if (!type.isEmpty())
-        return MIMETypeRegistry::isSupportedJavaScriptMIMEType(type.stripWhiteSpace().lower());
-
-    String language = m_scriptElement->languageAttributeValue();
-    if (!language.isEmpty())
-        return isSupportedJavaScriptLanguage(language);
+    if (!type.isEmpty()) {
+        if (!MIMETypeRegistry::isSupportedJavaScriptMIMEType(type.stripWhiteSpace().lower()))
+            return false;
+    } else {
+        String language = m_scriptElement->languageAttributeValue();
+        if (!language.isEmpty() && !isSupportedJavaScriptLanguage(language))
+            return false;
+    }    
 
     // No type or language is specified, so we assume the script to be JavaScript.
     // We don't yet support setting event listeners via the 'for' attribute for scripts.
@@ -244,7 +246,13 @@ bool ScriptElementData::shouldExecuteAsJavaScript() const
     // and we support the for syntax in script tags, this check can be removed and we should just
     // return 'true' here.
     String forAttribute = m_scriptElement->forAttributeValue();
-    return forAttribute.isEmpty();
+    String eventAttribute = m_scriptElement->eventAttributeValue();
+    if (forAttribute.isEmpty() || eventAttribute.isEmpty())
+        return true;
+    
+    forAttribute = forAttribute.stripWhiteSpace();
+    eventAttribute = eventAttribute.stripWhiteSpace();
+    return equalIgnoringCase(forAttribute, "window") && (equalIgnoringCase(eventAttribute, "onload") || equalIgnoringCase(eventAttribute, "onload()"));
 }
 
 String ScriptElementData::scriptCharset() const
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptElement.h b/src/3rdparty/webkit/WebCore/dom/ScriptElement.h
index 0aed5e8ffb..fad6fe7256 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptElement.h
@@ -43,6 +43,7 @@ public:
     virtual String typeAttributeValue() const = 0;
     virtual String languageAttributeValue() const = 0;
     virtual String forAttributeValue() const = 0;
+    virtual String eventAttributeValue() const = 0;
 
     virtual void dispatchLoadEvent() = 0;
     virtual void dispatchErrorEvent() = 0;
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp
index f7046e3a4d..c2fe1201dd 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp
@@ -28,7 +28,9 @@
 #include "ScriptExecutionContext.h"
 
 #include "ActiveDOMObject.h"
-#include "Document.h"
+#include "Database.h"
+#include "DatabaseTask.h"
+#include "DatabaseThread.h"
 #include "MessagePort.h"
 #include "SecurityOrigin.h"
 #include "WorkerContext.h"
@@ -44,9 +46,9 @@ namespace WebCore {
 
 class ProcessMessagesSoonTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<ProcessMessagesSoonTask> create()
+    static PassOwnPtr<ProcessMessagesSoonTask> create()
     {
-        return adoptRef(new ProcessMessagesSoonTask);
+        return new ProcessMessagesSoonTask;
     }
 
     virtual void performTask(ScriptExecutionContext* context)
@@ -56,6 +58,9 @@ public:
 };
 
 ScriptExecutionContext::ScriptExecutionContext()
+#if ENABLE(DATABASE)
+    : m_hasOpenDatabases(false)
+#endif
 {
 }
 
@@ -72,8 +77,69 @@ ScriptExecutionContext::~ScriptExecutionContext()
         ASSERT((*iter)->scriptExecutionContext() == this);
         (*iter)->contextDestroyed();
     }
+#if ENABLE(DATABASE)
+    if (m_databaseThread) {
+        ASSERT(m_databaseThread->terminationRequested());
+        m_databaseThread = 0;
+    }
+#endif
+}
+
+#if ENABLE(DATABASE)
+
+DatabaseThread* ScriptExecutionContext::databaseThread()
+{
+    if (!m_databaseThread && !m_hasOpenDatabases) {
+        // Create the database thread on first request - but not if at least one database was already opened,
+        // because in that case we already had a database thread and terminated it and should not create another.
+        m_databaseThread = DatabaseThread::create();
+        if (!m_databaseThread->start())
+            m_databaseThread = 0;
+    }
+
+    return m_databaseThread.get();
+}
+
+void ScriptExecutionContext::addOpenDatabase(Database* database)
+{
+    ASSERT(isContextThread());
+    if (!m_openDatabaseSet)
+        m_openDatabaseSet.set(new DatabaseSet());
+
+    ASSERT(!m_openDatabaseSet->contains(database));
+    m_openDatabaseSet->add(database);
+}
+
+void ScriptExecutionContext::removeOpenDatabase(Database* database)
+{
+    ASSERT(isContextThread());
+    ASSERT(m_openDatabaseSet && m_openDatabaseSet->contains(database));
+    if (!m_openDatabaseSet)
+        return;
+    m_openDatabaseSet->remove(database);
+}
+
+void ScriptExecutionContext::stopDatabases(DatabaseTaskSynchronizer* cleanupSync)
+{
+    ASSERT(isContextThread());
+    if (m_openDatabaseSet) {
+        DatabaseSet::iterator i = m_openDatabaseSet->begin();
+        DatabaseSet::iterator end = m_openDatabaseSet->end();
+        for (; i != end; ++i) {
+            (*i)->stop();
+            if (m_databaseThread)
+                m_databaseThread->unscheduleDatabaseTasks(*i);
+        }
+    }
+    
+    if (m_databaseThread)
+        m_databaseThread->requestTermination(cleanupSync);
+    else if (cleanupSync)
+        cleanupSync->taskCompleted();
 }
 
+#endif
+
 void ScriptExecutionContext::processMessagePortMessagesSoon()
 {
     postTask(ProcessMessagesSoonTask::create());
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
index 398afecb51..f1c79cfeb7 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
@@ -31,17 +31,27 @@
 #include "KURL.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
 #include <wtf/Threading.h>
 
 namespace WebCore {
 
     class ActiveDOMObject;
+#if ENABLE(DATABASE)
+    class Database;
+    class DatabaseTaskSynchronizer;
+    class DatabaseThread;
+#endif
     class DOMTimer;
     class MessagePort;
     class SecurityOrigin;
     class ScriptString;
     class String;
+#if ENABLE(INSPECTOR)
+    class InspectorController;
+#endif
 
     enum MessageDestination {
 #if ENABLE(INSPECTOR)
@@ -58,12 +68,28 @@ namespace WebCore {
         virtual bool isDocument() const { return false; }
         virtual bool isWorkerContext() const { return false; }
 
+#if ENABLE(DATABASE)
+        virtual bool isDatabaseReadOnly() const = 0;
+        virtual void databaseExceededQuota(const String& name) = 0;
+        DatabaseThread* databaseThread();
+        void setHasOpenDatabases() { m_hasOpenDatabases = true; }
+        bool hasOpenDatabases() const { return m_hasOpenDatabases; }
+        void addOpenDatabase(Database*);
+        void removeOpenDatabase(Database*);
+        // When the database cleanup is done, cleanupSync will be signalled.
+        void stopDatabases(DatabaseTaskSynchronizer*);
+#endif
+        virtual bool isContextThread() const = 0;
+
         const KURL& url() const { return virtualURL(); }
         KURL completeURL(const String& url) const { return virtualCompleteURL(url); }
 
         virtual String userAgent(const KURL&) const = 0;
 
         SecurityOrigin* securityOrigin() const { return m_securityOrigin.get(); }
+#if ENABLE(INSPECTOR)
+        virtual InspectorController* inspectorController() const { return 0; }
+#endif
 
         virtual void reportException(const String& errorMessage, int lineNumber, const String& sourceURL) = 0;
         virtual void addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL) = 0;
@@ -92,13 +118,15 @@ namespace WebCore {
         void ref() { refScriptExecutionContext(); }
         void deref() { derefScriptExecutionContext(); }
 
-        class Task : public ThreadSafeShared<Task> {
+        class Task : public Noncopyable {
         public:
             virtual ~Task();
             virtual void performTask(ScriptExecutionContext*) = 0;
+            // Certain tasks get marked specially so that they aren't discarded, and are executed, when the context is shutting down its message queue.
+            virtual bool isCleanupTask() const { return false; }
         };
 
-        virtual void postTask(PassRefPtr<Task>) = 0; // Executes the task on context's thread asynchronously.
+        virtual void postTask(PassOwnPtr<Task>) = 0; // Executes the task on context's thread asynchronously.
 
         void addTimeout(int timeoutId, DOMTimer*);
         void removeTimeout(int timeoutId);
@@ -128,6 +156,13 @@ namespace WebCore {
 
         virtual void refScriptExecutionContext() = 0;
         virtual void derefScriptExecutionContext() = 0;
+
+#if ENABLE(DATABASE)
+        RefPtr<DatabaseThread> m_databaseThread;
+        bool m_hasOpenDatabases; // This never changes back to false, even after the database thread is closed.
+        typedef HashSet<Database* > DatabaseSet;
+        OwnPtr<DatabaseSet> m_openDatabaseSet;
+#endif
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
index 3d2a549cca..e900245655 100644
--- a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
@@ -22,6 +22,7 @@
 #include "SelectElement.h"
 
 #include "CharacterNames.h"
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "Element.h"
 #include "EventHandler.h"
@@ -49,10 +50,10 @@
 
 // Configure platform-specific behavior when focused pop-up receives arrow/space/return keystroke.
 // (PLATFORM(MAC) and PLATFORM(GTK) are always false in Chromium, hence the extra tests.)
-#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
 #define ARROW_KEYS_POP_MENU 1
 #define SPACE_OR_RETURN_POP_MENU 0
-#elif PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(LINUX))
+#elif PLATFORM(GTK) || (PLATFORM(CHROMIUM) && OS(LINUX))
 #define ARROW_KEYS_POP_MENU 0
 #define SPACE_OR_RETURN_POP_MENU 1
 #else
@@ -149,7 +150,7 @@ void SelectElement::setActiveSelectionEndIndex(SelectElementData& data, int inde
 
 void SelectElement::updateListBoxSelection(SelectElementData& data, Element* element, bool deselectOtherOptions)
 {
-    ASSERT(element->renderer() && element->renderer()->isListBox());
+    ASSERT(element->renderer() && (element->renderer()->isListBox() || data.multiple()));
     ASSERT(data.activeSelectionAnchorIndex() >= 0);
 
     unsigned start = min(data.activeSelectionAnchorIndex(), data.activeSelectionEndIndex());
@@ -175,7 +176,7 @@ void SelectElement::updateListBoxSelection(SelectElementData& data, Element* ele
 
 void SelectElement::listBoxOnChange(SelectElementData& data, Element* element)
 {
-    ASSERT(!data.usesMenuList());
+    ASSERT(!data.usesMenuList() || data.multiple());
 
     Vector<bool>& lastOnChangeSelection = data.lastOnChangeSelection(); 
     const Vector<Element*>& items = data.listItems(element);
@@ -221,28 +222,21 @@ void SelectElement::scrollToSelection(SelectElementData& data, Element* element)
         toRenderListBox(renderer)->selectionChanged();
 }
 
-void SelectElement::recalcStyle(SelectElementData& data, Element* element)
+void SelectElement::setOptionsChangedOnRenderer(SelectElementData& data, Element* element)
 {
-    RenderObject* renderer = element->renderer();
-    if (element->childNeedsStyleRecalc() && renderer) {
+    if (RenderObject* renderer = element->renderer()) {
         if (data.usesMenuList())
             toRenderMenuList(renderer)->setOptionsChanged(true);
         else
             toRenderListBox(renderer)->setOptionsChanged(true);
-    } else if (data.shouldRecalcListItems())
-        recalcListItems(data, element);
+    }
 }
 
 void SelectElement::setRecalcListItems(SelectElementData& data, Element* element)
 {
     data.setShouldRecalcListItems(true);
     data.setActiveSelectionAnchorIndex(-1); // Manual selection anchor is reset when manipulating the select programmatically.
-    if (RenderObject* renderer = element->renderer()) {
-        if (data.usesMenuList())
-            toRenderMenuList(renderer)->setOptionsChanged(true);
-        else
-            toRenderListBox(renderer)->setOptionsChanged(true);
-    }
+    setOptionsChangedOnRenderer(data, element);
     element->setNeedsStyleRecalc();
 }
 
@@ -251,6 +245,8 @@ void SelectElement::recalcListItems(SelectElementData& data, const Element* elem
     Vector<Element*>& listItems = data.rawListItems();
     listItems.clear();
 
+    data.setShouldRecalcListItems(false);
+
     OptionElement* foundSelected = 0;
     for (Node* currentNode = element->firstChild(); currentNode;) {
         if (!currentNode->isElementNode()) {
@@ -296,8 +292,6 @@ void SelectElement::recalcListItems(SelectElementData& data, const Element* elem
         // <select>'s subtree at this point.
         currentNode = currentNode->traverseNextSibling(element);
     }
-
-    data.setShouldRecalcListItems(false);
 }
 
 int SelectElement::selectedIndex(const SelectElementData& data, const Element* element)
@@ -348,6 +342,8 @@ void SelectElement::setSelectedIndex(SelectElementData& data, Element* element,
         data.setUserDrivenChange(userDrivenChange);
         if (fireOnChangeNow)
             menuListOnChange(data, element);
+        if (RenderMenuList* menuList = toRenderMenuList(element->renderer()))
+            menuList->didSetSelectedIndex();
     }
 
     if (Frame* frame = element->document()->frame())
@@ -444,7 +440,7 @@ void SelectElement::restoreFormControlState(SelectElementData& data, Element* el
             optionElement->setSelectedState(state[i] == 'X');
     }
 
-    element->setNeedsStyleRecalc();
+    setOptionsChangedOnRenderer(data, element);
 }
 
 void SelectElement::parseMultipleAttribute(SelectElementData& data, Element* element, MappedAttribute* attribute)
@@ -468,27 +464,15 @@ bool SelectElement::appendFormData(SelectElementData& data, Element* element, Fo
 
     for (unsigned i = 0; i < items.size(); ++i) {
         OptionElement* optionElement = toOptionElement(items[i]);
-        if (optionElement && optionElement->selected()) {
+        if (optionElement && optionElement->selected() && !optionElement->disabled()) {
             list.appendData(name, optionElement->value());
             successful = true;
         }
     }
 
-    // FIXME: This case should not happen. Make sure that we select the first option
-    // in any case, otherwise we have no consistency with the DOM interface.
-    // We return the first one if it was a combobox select
-    if (!successful && !data.multiple() && data.size() <= 1 && items.size()) {
-        OptionElement* optionElement = toOptionElement(items[0]);
-        if (optionElement) {
-            const AtomicString& value = optionElement->value();
-            if (value.isNull())
-                list.appendData(name, optionElement->text().stripWhiteSpace());
-            else
-                list.appendData(name, value);
-            successful = true;
-        }
-    }
-
+    // It's possible that this is a menulist with multiple options and nothing
+    // will be submitted (!successful). We won't send a unselected non-disabled
+    // option as fallback. This behavior matches to other browsers.
     return successful;
 } 
 
@@ -518,6 +502,7 @@ void SelectElement::reset(SelectElementData& data, Element* element)
     if (!selectedOption && firstOption && data.usesMenuList())
         firstOption->setSelectedState(true);
 
+    setOptionsChangedOnRenderer(data, element);
     element->setNeedsStyleRecalc();
 }
     
@@ -662,6 +647,52 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
     }
 }
 
+void SelectElement::updateSelectedState(SelectElementData& data, Element* element, int listIndex,
+                                        bool multi, bool shift)
+{
+    ASSERT(listIndex >= 0);
+
+    // Save the selection so it can be compared to the new selection when dispatching change events during mouseup, or after autoscroll finishes.
+    saveLastSelection(data, element);
+
+    data.setActiveSelectionState(true);
+
+    bool shiftSelect = data.multiple() && shift;
+    bool multiSelect = data.multiple() && multi && !shift;
+
+    Element* clickedElement = data.listItems(element)[listIndex];
+    OptionElement* option = toOptionElement(clickedElement);
+    if (option) {
+        // Keep track of whether an active selection (like during drag selection), should select or deselect
+        if (option->selected() && multi)
+            data.setActiveSelectionState(false);
+
+        if (!data.activeSelectionState())
+            option->setSelectedState(false);
+    }
+
+    // If we're not in any special multiple selection mode, then deselect all other items, excluding the clicked option.
+    // If no option was clicked, then this will deselect all items in the list.
+    if (!shiftSelect && !multiSelect)
+        deselectItems(data, element, clickedElement);
+
+    // If the anchor hasn't been set, and we're doing a single selection or a shift selection, then initialize the anchor to the first selected index.
+    if (data.activeSelectionAnchorIndex() < 0 && !multiSelect)
+        setActiveSelectionAnchorIndex(data, element, selectedIndex(data, element));
+
+    // Set the selection state of the clicked option
+    if (option && !clickedElement->disabled())
+        option->setSelectedState(true);
+
+    // If there was no selectedIndex() for the previous initialization, or
+    // If we're doing a single selection, or a multiple selection (using cmd or ctrl), then initialize the anchor index to the listIndex that just got clicked.
+    if (data.activeSelectionAnchorIndex() < 0 || !shiftSelect)
+        setActiveSelectionAnchorIndex(data, element, listIndex);
+
+    setActiveSelectionEndIndex(data, listIndex);
+    updateListBoxSelection(data, element, !multiSelect);
+}
+
 void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
 {
     const Vector<Element*>& listItems = data.listItems(element);
@@ -674,53 +705,11 @@ void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element*
         IntPoint localOffset = roundedIntPoint(element->renderer()->absoluteToLocal(mouseEvent->absoluteLocation(), false, true));
         int listIndex = toRenderListBox(element->renderer())->listIndexAtOffset(localOffset.x(), localOffset.y());
         if (listIndex >= 0) {
-            // Save the selection so it can be compared to the new selection when dispatching change events during mouseup, or after autoscroll finishes.
-            saveLastSelection(data, element);
-
-            data.setActiveSelectionState(true);
-            
-            bool multiSelectKeyPressed = false;
-#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
-            multiSelectKeyPressed = mouseEvent->metaKey();
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
+            updateSelectedState(data, element, listIndex, mouseEvent->metaKey(), mouseEvent->shiftKey());
 #else
-            multiSelectKeyPressed = mouseEvent->ctrlKey();
+            updateSelectedState(data, element, listIndex, mouseEvent->ctrlKey(), mouseEvent->shiftKey());
 #endif
-
-            bool shiftSelect = data.multiple() && mouseEvent->shiftKey();
-            bool multiSelect = data.multiple() && multiSelectKeyPressed && !mouseEvent->shiftKey();
-
-            Element* clickedElement = listItems[listIndex];            
-            OptionElement* option = toOptionElement(clickedElement);
-            if (option) {
-                // Keep track of whether an active selection (like during drag selection), should select or deselect
-                if (option->selected() && multiSelectKeyPressed)
-                    data.setActiveSelectionState(false);
-
-                if (!data.activeSelectionState())
-                    option->setSelectedState(false);
-            }
-            
-            // If we're not in any special multiple selection mode, then deselect all other items, excluding the clicked option.
-            // If no option was clicked, then this will deselect all items in the list.
-            if (!shiftSelect && !multiSelect)
-                deselectItems(data, element, clickedElement);
-
-            // If the anchor hasn't been set, and we're doing a single selection or a shift selection, then initialize the anchor to the first selected index.
-            if (data.activeSelectionAnchorIndex() < 0 && !multiSelect)
-                setActiveSelectionAnchorIndex(data, element, selectedIndex(data, element));
-
-            // Set the selection state of the clicked option
-            if (option && !clickedElement->disabled())
-                option->setSelectedState(true);
-            
-            // If there was no selectedIndex() for the previous initialization, or
-            // If we're doing a single selection, or a multiple selection (using cmd or ctrl), then initialize the anchor index to the listIndex that just got clicked.
-            if (listIndex >= 0 && (data.activeSelectionAnchorIndex() < 0 || !shiftSelect))
-                setActiveSelectionAnchorIndex(data, element, listIndex);
-            
-            setActiveSelectionEndIndex(data, listIndex);
-            updateListBoxSelection(data, element, !multiSelect);
-
             if (Frame* frame = element->document()->frame())
                 frame->eventHandler()->setMouseDownMayStartAutoscroll();
 
@@ -753,7 +742,7 @@ void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element*
             // Save the selection so it can be compared to the new selection when dispatching change events immediately after making the new selection.
             saveLastSelection(data, element);
 
-            ASSERT(endIndex >= 0 && (unsigned) endIndex < listItems.size()); 
+            ASSERT_UNUSED(listItems, endIndex >= 0 && (unsigned) endIndex < listItems.size());
             setActiveSelectionEndIndex(data, endIndex);
             
             // If the anchor is unitialized, or if we're going to deselect all other options, then set the anchor index equal to the end index.
@@ -892,6 +881,8 @@ void SelectElement::typeAheadFind(SelectElementData& data, Element* element, Key
             setSelectedIndex(data, element, listToOptionIndex(data, element, index));
             if (!data.usesMenuList())
                 listBoxOnChange(data, element);
+
+            setOptionsChangedOnRenderer(data, element);
             element->setNeedsStyleRecalc();
             return;
         }
@@ -954,8 +945,8 @@ SelectElementData::SelectElementData()
 
 void SelectElementData::checkListItems(const Element* element) const
 {
-#ifndef NDEBUG
-    const Vector<Element*>& items = m_listItems;
+#if !ASSERT_DISABLED
+    Vector<Element*> items = m_listItems;
     SelectElement::recalcListItems(*const_cast<SelectElementData*>(this), element, false);
     ASSERT(items == m_listItems);
 #else
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectElement.h b/src/3rdparty/webkit/WebCore/dom/SelectElement.h
index 4cc76a03d3..dcb6879ff5 100644
--- a/src/3rdparty/webkit/WebCore/dom/SelectElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/SelectElement.h
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http//www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ -60,6 +61,8 @@ public:
     virtual void setSelectedIndex(int index, bool deselect = true) = 0;
     virtual void setSelectedIndexByUser(int index, bool deselect = true, bool fireOnChangeNow = false) = 0;
 
+    virtual void listBoxSelectItem(int listIndex, bool allowMultiplySelections, bool shift, bool fireOnChangeNow = true) = 0;
+
 protected:
     virtual ~SelectElement() { }
 
@@ -75,7 +78,6 @@ protected:
     static void listBoxOnChange(SelectElementData&, Element*);
     static void menuListOnChange(SelectElementData&, Element*);
     static void scrollToSelection(SelectElementData&, Element*);
-    static void recalcStyle(SelectElementData&, Element*);
     static void setRecalcListItems(SelectElementData&, Element*);
     static void recalcListItems(SelectElementData&, const Element*, bool updateSelectedStates = true);
     static int selectedIndex(const SelectElementData&, const Element*);
@@ -96,10 +98,14 @@ protected:
     static void insertedIntoTree(SelectElementData&, Element*);
     static void accessKeySetSelectedIndex(SelectElementData&, Element*, int index);
     static unsigned optionCount(const SelectElementData&, const Element*);
+
+    static void updateSelectedState(SelectElementData& data, Element* element, int listIndex,
+                                    bool multi, bool shift);
  
 private:
     static void menuListDefaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement*);
     static void listBoxDefaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement*);
+    static void setOptionsChangedOnRenderer(SelectElementData&, Element*);
 };
 
 // HTML/WMLSelectElement hold this struct as member variable
@@ -114,7 +120,14 @@ public:
     int size() const { return m_size; }
     void setSize(int value) { m_size = value; }
 
-    bool usesMenuList() const { return !m_multiple && m_size <= 1; }
+    bool usesMenuList() const
+    {
+#if ENABLE(NO_LISTBOX_RENDERING)
+        return true;
+#else
+        return !m_multiple && m_size <= 1;
+#endif
+    }
 
     int lastOnChangeIndex() const { return m_lastOnChangeIndex; }
     void setLastOnChangeIndex(int value) { m_lastOnChangeIndex = value; }
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectorNodeList.cpp b/src/3rdparty/webkit/WebCore/dom/SelectorNodeList.cpp
index 85b12389b8..bc9703471f 100644
--- a/src/3rdparty/webkit/WebCore/dom/SelectorNodeList.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/SelectorNodeList.cpp
@@ -50,7 +50,6 @@ PassRefPtr<StaticNodeList> createSelectorNodeList(Node* rootNode, const CSSSelec
     CSSStyleSelector::SelectorChecker selectorChecker(document, strictParsing);
 
     if (strictParsing && rootNode->inDocument() && onlySelector && onlySelector->m_match == CSSSelector::Id && !document->containsMultipleElementsWithId(onlySelector->m_value)) {
-        ASSERT(querySelectorList.first()->attribute() == idAttr);
         Element* element = document->getElementById(onlySelector->m_value);
         if (element && (rootNode->isDocumentNode() || element->isDescendantOf(rootNode)) && selectorChecker.checkSelector(onlySelector, element))
             nodes.append(element);
diff --git a/src/3rdparty/webkit/WebCore/dom/ClassNames.cpp b/src/3rdparty/webkit/WebCore/dom/SpaceSplitString.cpp
index 1c5ff4794f..b062dbf133 100644
--- a/src/3rdparty/webkit/WebCore/dom/ClassNames.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/SpaceSplitString.cpp
@@ -19,7 +19,7 @@
  */
 
 #include "config.h"
-#include "ClassNames.h"
+#include "SpaceSplitString.h"
 
 #include <wtf/ASCIICType.h>
 
@@ -41,7 +41,7 @@ static bool hasNonASCIIOrUpper(const String& string)
     return hasUpper || (ored & ~0x7F);
 }
 
-void ClassNamesData::createVector()
+void SpaceSplitStringData::createVector()
 {
     ASSERT(!m_createdVector);
     ASSERT(m_vector.isEmpty());
@@ -70,7 +70,7 @@ void ClassNamesData::createVector()
     m_createdVector = true;
 }
 
-bool ClassNamesData::containsAll(ClassNamesData& other)
+bool SpaceSplitStringData::containsAll(SpaceSplitStringData& other)
 {
     ensureVector();
     other.ensureVector();
diff --git a/src/3rdparty/webkit/WebCore/dom/ClassNames.h b/src/3rdparty/webkit/WebCore/dom/SpaceSplitString.h
index a836606b6b..2ef3fc4473 100644
--- a/src/3rdparty/webkit/WebCore/dom/ClassNames.h
+++ b/src/3rdparty/webkit/WebCore/dom/SpaceSplitString.h
@@ -18,8 +18,8 @@
  *
  */
 
-#ifndef ClassNames_h
-#define ClassNames_h
+#ifndef SpaceSplitString_h
+#define SpaceSplitString_h
 
 #include "AtomicString.h"
 #include <wtf/OwnPtr.h>
@@ -27,9 +27,9 @@
 
 namespace WebCore {
 
-    class ClassNamesData : public Noncopyable {
+    class SpaceSplitStringData : public Noncopyable {
     public:
-        ClassNamesData(const String& string, bool shouldFoldCase)
+        SpaceSplitStringData(const String& string, bool shouldFoldCase)
             : m_string(string), m_shouldFoldCase(shouldFoldCase), m_createdVector(false)
         {
         }
@@ -45,7 +45,7 @@ namespace WebCore {
             return false;
         }
 
-        bool containsAll(ClassNamesData&);
+        bool containsAll(SpaceSplitStringData&);
 
         size_t size() { ensureVector(); return m_vector.size(); }
         const AtomicString& operator[](size_t i) { ensureVector(); ASSERT(i < size()); return m_vector[i]; }
@@ -54,29 +54,29 @@ namespace WebCore {
         void ensureVector() { if (!m_createdVector) createVector(); }
         void createVector();
 
-        typedef Vector<AtomicString, 8> ClassNameVector;
+        typedef Vector<AtomicString, 8> StringVector;
         String m_string;
-        ClassNameVector m_vector;
+        StringVector m_vector;
         bool m_shouldFoldCase;
         bool m_createdVector;
     };
 
-    class ClassNames {
+    class SpaceSplitString {
     public:
-        ClassNames() { }
-        ClassNames(const String& string, bool shouldFoldCase) : m_data(new ClassNamesData(string, shouldFoldCase)) { }
+        SpaceSplitString() { }
+        SpaceSplitString(const String& string, bool shouldFoldCase) : m_data(new SpaceSplitStringData(string, shouldFoldCase)) { }
 
-        void set(const String& string, bool shouldFoldCase) { m_data.set(new ClassNamesData(string, shouldFoldCase)); }
+        void set(const String& string, bool shouldFoldCase) { m_data.set(new SpaceSplitStringData(string, shouldFoldCase)); }
         void clear() { m_data.clear(); }
 
         bool contains(const AtomicString& string) const { return m_data && m_data->contains(string); }
-        bool containsAll(const ClassNames& names) const { return !names.m_data || (m_data && m_data->containsAll(*names.m_data)); }
+        bool containsAll(const SpaceSplitString& names) const { return !names.m_data || (m_data && m_data->containsAll(*names.m_data)); }
 
         size_t size() const { return m_data ? m_data->size() : 0; }
         const AtomicString& operator[](size_t i) const { ASSERT(i < size()); return (*m_data)[i]; }
 
     private:
-        OwnPtr<ClassNamesData> m_data;
+        OwnPtr<SpaceSplitStringData> m_data;
     };
 
     inline bool isClassWhitespace(UChar c)
@@ -86,4 +86,4 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ClassNames_h
+#endif // SpaceSplitString_h
diff --git a/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp b/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp
index a21959df77..f88117981d 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp
@@ -103,7 +103,7 @@ void StyleElement::createSheet(Element* e, const String& text)
         if (screenEval.eval(mediaList.get()) || printEval.eval(mediaList.get())) {
             document->addPendingSheet();
             setLoading(true);
-            m_sheet = CSSStyleSheet::create(e, String(), document->inputEncoding());
+            m_sheet = CSSStyleSheet::create(e, String(), KURL(), document->inputEncoding());
             m_sheet->parseString(text, !document->inCompatMode());
             m_sheet->setMedia(mediaList.get());
             m_sheet->setTitle(e->title());
diff --git a/src/3rdparty/webkit/WebCore/dom/StyleElement.h b/src/3rdparty/webkit/WebCore/dom/StyleElement.h
index 7f83909121..9d3ac84a85 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyleElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/StyleElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006, 2007 Rob Buis
  *
  * This library is free software; you can redistribute it and/or
diff --git a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
index 46ce13780c..3607963a70 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
@@ -234,7 +234,7 @@ void StyledElement::classAttributeChanged(const AtomicString& newClassString)
 
 void StyledElement::parseMappedAttribute(MappedAttribute *attr)
 {
-    if (attr->name() == idAttr) {
+    if (attr->name() == idAttributeName()) {
         // unique id
         setHasID(!attr->isNull());
         if (namedAttrMap) {
@@ -346,7 +346,7 @@ void StyledElement::addCSSColor(MappedAttribute* attr, int id, const String& c)
     // not something that fits the specs.
     
     // we're emulating IEs color parser here. It maps transparent to black, otherwise it tries to build a rgb value
-    // out of everyhting you put in. The algorithm is experimentally determined, but seems to work for all test cases I have.
+    // out of everything you put in. The algorithm is experimentally determined, but seems to work for all test cases I have.
     
     // the length of the color value is rounded up to the next
     // multiple of 3. each part of the rgb triple then gets one third
diff --git a/src/3rdparty/webkit/WebCore/dom/StyledElement.h b/src/3rdparty/webkit/WebCore/dom/StyledElement.h
index 85fa7a75a9..52bffd31e3 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyledElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/StyledElement.h
@@ -66,7 +66,7 @@ public:
     CSSStyleDeclaration* style();
     void invalidateStyleAttribute();
 
-    const ClassNames& classNames() const { ASSERT(hasClass()); ASSERT(mappedAttributes()); return mappedAttributes()->classNames(); }
+    const SpaceSplitString& classNames() const { ASSERT(hasClass()); ASSERT(mappedAttributes()); return mappedAttributes()->classNames(); }
 
     virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Text.idl b/src/3rdparty/webkit/WebCore/dom/Text.idl
index 1b0009d3a4..116eab760d 100644
--- a/src/3rdparty/webkit/WebCore/dom/Text.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Text.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=4EA6B89C-F8E5-462a-A807-519446123184,
-        ImplementationUUID=CB5D61CB-D30D-486e-9BD7-F42B7611C2E5
-    ] Text : CharacterData {
+    interface Text : CharacterData {
 
         // DOM Level 1
 
diff --git a/src/3rdparty/webkit/WebCore/dom/TextEvent.idl b/src/3rdparty/webkit/WebCore/dom/TextEvent.idl
index 779afd1acf..83b0e3bb37 100644
--- a/src/3rdparty/webkit/WebCore/dom/TextEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/TextEvent.idl
@@ -26,9 +26,7 @@
 module events {
 
     // Introduced in DOM Level 3:
-    interface [
-        GenerateConstructor
-    ] TextEvent : UIEvent {
+    interface TextEvent : UIEvent {
 
         readonly attribute DOMString data;
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Tokenizer.h b/src/3rdparty/webkit/WebCore/dom/Tokenizer.h
index ea303f9575..9a9b7b338a 100644
--- a/src/3rdparty/webkit/WebCore/dom/Tokenizer.h
+++ b/src/3rdparty/webkit/WebCore/dom/Tokenizer.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
  * Copyright (C) 2005, 2006 Apple Computer, Inc.
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
@@ -30,7 +28,7 @@ namespace WebCore {
     class SegmentedString;
     class XSSAuditor;
 
-    class Tokenizer {
+    class Tokenizer : public Noncopyable {
     public:
         virtual ~Tokenizer() { }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Touch.cpp b/src/3rdparty/webkit/WebCore/dom/Touch.cpp
new file mode 100644
index 0000000000..4ea83da6dc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/Touch.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "Touch.h"
+
+#include "FrameView.h"
+
+namespace WebCore {
+
+static int contentsX(Frame* frame)
+{
+    if (!frame)
+        return 0;
+    FrameView* frameView = frame->view();
+    if (!frameView)
+        return 0;
+    return frameView->scrollX() / frame->pageZoomFactor();
+}
+
+static int contentsY(Frame* frame)
+{
+    if (!frame)
+        return 0;
+    FrameView* frameView = frame->view();
+    if (!frameView)
+        return 0;
+    return frameView->scrollY() / frame->pageZoomFactor();
+}
+
+Touch::Touch(Frame* frame, EventTarget* target, unsigned identifier, 
+        int screenX, int screenY, int pageX, int pageY)
+    : m_target(target)
+    , m_identifier(identifier)
+    , m_clientX(pageX - contentsX(frame))
+    , m_clientY(pageY - contentsY(frame))
+    , m_screenX(screenX)
+    , m_screenY(screenY)
+    , m_pageX(pageX)
+    , m_pageY(pageY)
+{
+}
+
+} // namespace WebCore
+
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/dom/Touch.h b/src/3rdparty/webkit/WebCore/dom/Touch.h
new file mode 100644
index 0000000000..ceb8ae7a5c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/Touch.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TOUCH_H_
+#define TOUCH_H_
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "EventTarget.h"
+#include "Frame.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class Touch : public RefCounted<Touch> {
+public:
+    static PassRefPtr<Touch> create(Frame* frame, EventTarget* target,
+            unsigned identifier, int screenX, int screenY, int pageX, int pageY)
+    {
+        return adoptRef(new Touch(frame, target, identifier, screenX, 
+                screenY, pageX, pageY));
+    }
+
+    EventTarget* target() const { return m_target.get(); }
+    unsigned identifier() const { return m_identifier; }
+    int clientX() const { return m_clientX; }
+    int clientY() const { return m_clientY; }
+    int screenX() const { return m_screenX; }
+    int screenY() const { return m_screenY; }
+    int pageX() const { return m_pageX; }
+    int pageY() const { return m_pageY; }
+
+private:
+    Touch(Frame* frame, EventTarget* target, unsigned identifier,
+            int screenX, int screenY, int pageX, int pageY);
+
+    RefPtr<EventTarget> m_target;
+    unsigned m_identifier;
+    int m_clientX;
+    int m_clientY;
+    int m_screenX;
+    int m_screenY;
+    int m_pageX;
+    int m_pageY;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(TOUCH_EVENTS)
+
+#endif /* TOUCH_H_ */
diff --git a/src/3rdparty/webkit/WebCore/platform/text/android/TextBreakIteratorInternalICU.cpp b/src/3rdparty/webkit/WebCore/dom/Touch.idl
index 9732e92022..1afc63ab49 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/android/TextBreakIteratorInternalICU.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Touch.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2007, The Android Open Source Project
+ * Copyright 2008, The Android Open Source Project
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,21 +23,18 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "TextBreakIteratorInternalICU.h"
-
-namespace WebCore {
-
-const char* currentSearchLocaleID()
-{
-    // FIXME: Should use system locale.
-    return "";
-}
-
-const char* currentTextBreakLocaleID()
-{
-    // FIXME: Should use system locale.
-    return "en_us";
-}
+module events {
 
+    interface [
+        Conditional=TOUCH_EVENTS
+    ] Touch {
+        readonly attribute long             clientX;
+        readonly attribute long             clientY;
+        readonly attribute long             screenX;
+        readonly attribute long             screenY;
+        readonly attribute long             pageX;
+        readonly attribute long             pageY;
+        readonly attribute EventTarget      target;
+        readonly attribute unsigned long    identifier;
+    };
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/TouchEvent.cpp b/src/3rdparty/webkit/WebCore/dom/TouchEvent.cpp
new file mode 100644
index 0000000000..bcc395ff59
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/TouchEvent.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "TouchEvent.h"
+
+namespace WebCore {
+
+TouchEvent::TouchEvent(TouchList* touches, TouchList* targetTouches,
+        TouchList* changedTouches, const AtomicString& type, 
+        PassRefPtr<AbstractView> view, int screenX, int screenY, int pageX, int pageY,
+        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
+    : MouseRelatedEvent(type, true, true, view, 0, screenX, screenY, pageX, pageY,
+                        ctrlKey, altKey, shiftKey, metaKey)
+    , m_touches(touches)
+    , m_targetTouches(targetTouches)
+    , m_changedTouches(changedTouches)
+{
+}
+
+void TouchEvent::initTouchEvent(TouchList* touches, TouchList* targetTouches,
+        TouchList* changedTouches, const AtomicString& type, 
+        PassRefPtr<AbstractView> view, int screenX, int screenY, int clientX, int clientY,
+        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
+{
+    if (dispatched())
+        return;
+
+    initUIEvent(type, true, true, view, 0);
+
+    m_screenX = screenX;
+    m_screenY = screenY;
+    m_ctrlKey = ctrlKey;
+    m_altKey = altKey;
+    m_shiftKey = shiftKey;
+    m_metaKey = metaKey;
+    initCoordinates(clientX, clientY);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(TOUCH_EVENTS)
diff --git a/src/3rdparty/webkit/WebCore/dom/TouchEvent.h b/src/3rdparty/webkit/WebCore/dom/TouchEvent.h
new file mode 100644
index 0000000000..080a495749
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/TouchEvent.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TouchEvent_h
+#define TouchEvent_h
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "MouseRelatedEvent.h"
+#include "TouchList.h"
+
+namespace WebCore {
+
+class TouchEvent : public MouseRelatedEvent {
+public:
+    static PassRefPtr<TouchEvent> create()
+    {
+        return adoptRef(new TouchEvent);
+    }
+    static PassRefPtr<TouchEvent> create(TouchList* touches, 
+            TouchList* targetTouches, TouchList* changedTouches, 
+            const AtomicString& type, PassRefPtr<AbstractView> view,
+            int screenX, int screenY, int pageX, int pageY,
+            bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
+    {
+        return adoptRef(new TouchEvent(touches, targetTouches, changedTouches,
+                type, view, screenX, screenY, pageX, pageY,
+                ctrlKey, altKey, shiftKey, metaKey));
+    }
+
+    void initTouchEvent(TouchList* touches, TouchList* targetTouches,
+            TouchList* changedTouches, const AtomicString& type, 
+            PassRefPtr<AbstractView> view, int screenX, int screenY, 
+            int clientX, int clientY,
+            bool ctrlKey, bool altKey, bool shiftKey, bool metaKey);
+
+    TouchList* touches() const { return m_touches.get(); }
+    TouchList* targetTouches() const { return m_targetTouches.get(); }
+    TouchList* changedTouches() const { return m_changedTouches.get(); }
+
+private:
+    TouchEvent() {}
+    TouchEvent(TouchList* touches, TouchList* targetTouches,
+            TouchList* changedTouches, const AtomicString& type,
+            PassRefPtr<AbstractView>, int screenX, int screenY, int pageX,
+            int pageY,
+            bool ctrlKey, bool altKey, bool shiftKey, bool metaKey);
+
+    virtual bool isTouchEvent() const { return true; }
+
+    RefPtr<TouchList> m_touches;
+    RefPtr<TouchList> m_targetTouches;
+    RefPtr<TouchList> m_changedTouches;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(TOUCH_EVENTS)
+
+#endif // TouchEvent_h
diff --git a/src/3rdparty/webkit/WebCore/platform/android/FileChooserAndroid.cpp b/src/3rdparty/webkit/WebCore/dom/TouchEvent.idl
index caedc7aa64..0e0d917702 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/FileChooserAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/TouchEvent.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006, The Android Open Source Project
+ * Copyright 2008, The Android Open Source Project
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,38 +23,31 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "FileChooser.h"
-
-#include "Font.h"
-
-namespace WebCore {
-
-String FileChooser::basenameForWidth(const Font& font, int width) const 
-{
-    if (!m_filenames.size())
-        return String();
-    // FIXME: This could be a lot faster, but assuming the data will not
-    // often be much longer than the provided width, this may be fast enough.
-    String output = m_filenames[0].threadsafeCopy();
-    while (font.width(TextRun(output.impl())) > width && output.length() > 4)
-        output = output.replace(output.length() - 4, 4, String("..."));
-    return output;
-}
-
-// The following two strings are used for File Upload form control, ie
-// <input type="file">. The first is the text that appears on the button
-// that when pressed, the user can browse for and select a file. The
-// second string is rendered on the screen when no file has been selected.
-String fileButtonChooseFileLabel()
-{
-    return String("Uploads Disabled");
+module events {
+
+    interface [
+        Conditional=TOUCH_EVENTS
+    ] TouchEvent : UIEvent {
+        readonly attribute TouchList touches;
+        readonly attribute TouchList targetTouches;
+        readonly attribute TouchList changedTouches;
+        readonly attribute boolean ctrlKey;
+        readonly attribute boolean shiftKey;
+        readonly attribute boolean altKey;
+        readonly attribute boolean metaKey;
+
+        void initTouchEvent(in TouchList touches,
+                            in TouchList targetTouches,
+                            in TouchList changedTouches,
+                            in DOMString type,
+                            in DOMWindow view,
+                            in long screenX, 
+                            in long screenY, 
+                            in long clientX, 
+                            in long clientY,
+                            in boolean ctrlKey,
+                            in boolean altKey,
+                            in boolean shiftKey,
+                            in boolean metaKey);
+    };
 }
-
-String fileButtonNoFileSelectedLabel()
-{
-    return String("No file selected");
-}
-
-} // namesapce WebCore
-
diff --git a/src/3rdparty/webkit/WebCore/platform/android/EventLoopAndroid.cpp b/src/3rdparty/webkit/WebCore/dom/TouchList.cpp
index 3a6d7ed0c7..4167e42e6d 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/EventLoopAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/TouchList.cpp
@@ -24,15 +24,20 @@
  */
 
 #include "config.h"
-#include "EventLoop.h"
 
-#include "NotImplemented.h"
+#if ENABLE(TOUCH_EVENTS)
+
+#include "TouchList.h"
 
 namespace WebCore {
 
-void EventLoop::cycle()
+Touch* TouchList::item(unsigned index)
 {
-    notImplemented();
+    if (index >= m_values.size())
+        return 0;
+    return m_values[index].get();
 }
 
 } // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/android/SearchPopupMenuAndroid.cpp b/src/3rdparty/webkit/WebCore/dom/TouchList.h
index 0d67fddb0a..61350b0ed7 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/SearchPopupMenuAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/TouchList.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006, The Android Open Source Project
+ * Copyright 2008, The Android Open Source Project
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,30 +23,38 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "SearchPopupMenu.h"
+#ifndef TOUCHLIST_H_
+#define TOUCHLIST_H_
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "Touch.h"
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
-// Save the past searches stored in 'searchItems' to a database associated with 'name'
-void SearchPopupMenu::saveRecentSearches(const AtomicString& name, const Vector<String>& searchItems) 
-{ 
-}
-
-// Load past searches associated with 'name' from the database to 'searchItems'
-void SearchPopupMenu::loadRecentSearches(const AtomicString& name, Vector<String>& searchItems) 
-{ 
-}
-
-// Create a search popup menu - not sure what else we have to do here
-SearchPopupMenu::SearchPopupMenu(PopupMenuClient* client)
-    : PopupMenu(client) 
-{ 
-}
-        
-bool SearchPopupMenu::enabled()
-{
-    return false;
-}
-
-}  // namespace WebCore
+class TouchList : public RefCounted<TouchList> {
+public:
+    static PassRefPtr<TouchList> create()
+    {
+        return adoptRef(new TouchList);
+    }
+
+    unsigned length() const { return m_values.size(); }
+
+    Touch* item(unsigned);
+
+    void append(const PassRefPtr<Touch> touch) { m_values.append(touch); }
+
+private:
+    TouchList() {}
+
+    Vector<RefPtr<Touch> > m_values;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(TOUCH_EVENTS)
+
+#endif /* TOUCHLIST_H_ */
diff --git a/src/3rdparty/webkit/WebCore/platform/android/SystemTimeAndroid.cpp b/src/3rdparty/webkit/WebCore/dom/TouchList.idl
index a9c862a6c6..ede7bf2e5d 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/SystemTimeAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/TouchList.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2007, The Android Open Source Project
+ * Copyright 2008, The Android Open Source Project
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,15 +23,14 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "SystemTime.h"
+module events {
 
-namespace WebCore {
+    interface [
+        Conditional=TOUCH_EVENTS,
+        HasIndexGetter
+    ] TouchList {
+        readonly attribute unsigned long length;
 
-float userIdleTime()
-{
-    // Needed for PageCache, which we currently have disabled.
-    return 0.0F;
+        Touch item(in unsigned long index);
+    };
 }
-
-}  // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/TransformSourceLibxslt.cpp b/src/3rdparty/webkit/WebCore/dom/TransformSourceLibxslt.cpp
index 33a85e8470..e058438bfb 100644
--- a/src/3rdparty/webkit/WebCore/dom/TransformSourceLibxslt.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/TransformSourceLibxslt.cpp
@@ -24,6 +24,8 @@
  */
 
 #include "config.h"
+
+#if ENABLE(XSLT)
 #include "TransformSource.h"
 
 #include <libxml/tree.h>
@@ -41,3 +43,5 @@ TransformSource::~TransformSource()
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/dom/TreeWalker.h b/src/3rdparty/webkit/WebCore/dom/TreeWalker.h
index 4cc8e9a770..88e59da173 100644
--- a/src/3rdparty/webkit/WebCore/dom/TreeWalker.h
+++ b/src/3rdparty/webkit/WebCore/dom/TreeWalker.h
@@ -52,14 +52,15 @@ namespace WebCore {
         Node* previousNode(ScriptState*);
         Node* nextNode(ScriptState*);
 
-        // For non-JS bindings. Silently ignores the JavaScript exception if any.
-        Node* parentNode() { return parentNode(scriptStateFromNode(m_current.get())); }
-        Node* firstChild() { return firstChild(scriptStateFromNode(m_current.get())); }
-        Node* lastChild() { return lastChild(scriptStateFromNode(m_current.get())); }
-        Node* previousSibling() { return previousSibling(scriptStateFromNode(m_current.get())); }
-        Node* nextSibling() { return nextSibling(scriptStateFromNode(m_current.get())); }
-        Node* previousNode() { return previousNode(scriptStateFromNode(m_current.get())); }
-        Node* nextNode() { return nextNode(scriptStateFromNode(m_current.get())); }
+        // Do not call these functions. They are just scaffolding to support the Objective-C bindings.
+        // They operate in the main thread normal world, and they swallow JS exceptions.
+        Node* parentNode() { return parentNode(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* firstChild() { return firstChild(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* lastChild() { return lastChild(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* previousSibling() { return previousSibling(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* nextSibling() { return nextSibling(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* previousNode() { return previousNode(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* nextNode() { return nextNode(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
 
     private:
         TreeWalker(PassRefPtr<Node>, unsigned whatToShow, PassRefPtr<NodeFilter>, bool expandEntityReferences);
diff --git a/src/3rdparty/webkit/WebCore/dom/TreeWalker.idl b/src/3rdparty/webkit/WebCore/dom/TreeWalker.idl
index 4ff969ec1a..f591128c79 100644
--- a/src/3rdparty/webkit/WebCore/dom/TreeWalker.idl
+++ b/src/3rdparty/webkit/WebCore/dom/TreeWalker.idl
@@ -22,8 +22,7 @@ module traversal {
 
     // Introduced in DOM Level 2:
     interface [
-        CustomMarkFunction,
-        GenerateConstructor
+        CustomMarkFunction
     ] TreeWalker {
         readonly attribute Node root;
         readonly attribute unsigned long whatToShow;
diff --git a/src/3rdparty/webkit/WebCore/dom/UIEvent.idl b/src/3rdparty/webkit/WebCore/dom/UIEvent.idl
index 36d0988fac..88dc108518 100644
--- a/src/3rdparty/webkit/WebCore/dom/UIEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/UIEvent.idl
@@ -20,9 +20,7 @@
 module events {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor
-    ] UIEvent : Event {
+    interface UIEvent : Event {
         readonly attribute DOMWindow            view;
         readonly attribute long                 detail;
         
diff --git a/src/3rdparty/webkit/WebCore/dom/WebKitAnimationEvent.idl b/src/3rdparty/webkit/WebCore/dom/WebKitAnimationEvent.idl
index f87499509d..86ffcc5726 100644
--- a/src/3rdparty/webkit/WebCore/dom/WebKitAnimationEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/WebKitAnimationEvent.idl
@@ -25,9 +25,7 @@
 
 module events {
 
-    interface [
-        GenerateConstructor
-    ] WebKitAnimationEvent : Event {
+    interface WebKitAnimationEvent : Event {
      readonly attribute DOMString          animationName;
      readonly attribute double             elapsedTime;
      void               initWebKitAnimationEvent(in DOMString typeArg,
diff --git a/src/3rdparty/webkit/WebCore/dom/WebKitTransitionEvent.idl b/src/3rdparty/webkit/WebCore/dom/WebKitTransitionEvent.idl
index 8c645cb09f..fa619fa05c 100644
--- a/src/3rdparty/webkit/WebCore/dom/WebKitTransitionEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/WebKitTransitionEvent.idl
@@ -25,9 +25,7 @@
 
 module events {
 
-    interface [
-        GenerateConstructor
-    ] WebKitTransitionEvent : Event {
+    interface WebKitTransitionEvent : Event {
      readonly attribute DOMString          propertyName;
      readonly attribute double             elapsedTime;
      void               initWebKitTransitionEvent(in DOMString typeArg,
diff --git a/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp b/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp
index 2039541d40..0981a57176 100644
--- a/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
- * Copyright (C) 2003, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2005, 2006, 2008, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,21 +31,28 @@ namespace WebCore {
 WheelEvent::WheelEvent()
     : m_wheelDeltaX(0)
     , m_wheelDeltaY(0)
+    , m_rawDeltaX(0)
+    , m_rawDeltaY(0)
+    , m_granularity(Pixel)
 {
 }
 
-WheelEvent::WheelEvent(float wheelTicksX, float wheelTicksY, PassRefPtr<AbstractView> view,
+WheelEvent::WheelEvent(float wheelTicksX, float wheelTicksY, float rawDeltaX, float rawDeltaY,
+                       Granularity granularity, PassRefPtr<AbstractView> view,
                        int screenX, int screenY, int pageX, int pageY,
                        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
     : MouseRelatedEvent(eventNames().mousewheelEvent,
-                        true, true, view, 0, screenX, screenY, pageX, pageY, 
+                        true, true, view, 0, screenX, screenY, pageX, pageY,
                         ctrlKey, altKey, shiftKey, metaKey)
     , m_wheelDeltaX(lroundf(wheelTicksX * 120))
     , m_wheelDeltaY(lroundf(wheelTicksY * 120)) // Normalize to the Windows 120 multiple
+    , m_rawDeltaX(rawDeltaX)
+    , m_rawDeltaY(rawDeltaY)
+    , m_granularity(granularity)
 {
 }
 
-void WheelEvent::initWheelEvent(int wheelDeltaX, int wheelDeltaY, PassRefPtr<AbstractView> view,
+void WheelEvent::initWheelEvent(int rawDeltaX, int rawDeltaY, PassRefPtr<AbstractView> view,
                                 int screenX, int screenY, int pageX, int pageY,
                                 bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
 {
@@ -60,12 +67,25 @@ void WheelEvent::initWheelEvent(int wheelDeltaX, int wheelDeltaY, PassRefPtr<Abs
     m_altKey = altKey;
     m_shiftKey = shiftKey;
     m_metaKey = metaKey;
-    m_wheelDeltaX = wheelDeltaX;
-    m_wheelDeltaY = wheelDeltaY;
+    
+    // Normalize to the Windows 120 multiple
+    m_wheelDeltaX = rawDeltaX * 120;
+    m_wheelDeltaY = rawDeltaY * 120;
+    
+    m_rawDeltaX = rawDeltaX;
+    m_rawDeltaY = rawDeltaY;
+    m_granularity = Pixel;
     
     initCoordinates(pageX, pageY);
 }
 
+void WheelEvent::initWebKitWheelEvent(int rawDeltaX, int rawDeltaY, PassRefPtr<AbstractView> view,
+                                      int screenX, int screenY, int pageX, int pageY,
+                                      bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
+{
+    initWheelEvent(rawDeltaX, rawDeltaY, view, screenX, screenY, pageX, pageY,
+                   ctrlKey, altKey, shiftKey, metaKey);
+}
 
 bool WheelEvent::isWheelEvent() const
 {
diff --git a/src/3rdparty/webkit/WebCore/dom/WheelEvent.h b/src/3rdparty/webkit/WebCore/dom/WheelEvent.h
index 04d54213c5..b085e86eeb 100644
--- a/src/3rdparty/webkit/WebCore/dom/WheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/WheelEvent.h
@@ -2,7 +2,7 @@
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
- * Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,39 +31,55 @@ namespace WebCore {
     // extension: mouse wheel event
     class WheelEvent : public MouseRelatedEvent {
     public:
+        enum Granularity { Pixel, Line, Page };
+
         static PassRefPtr<WheelEvent> create()
         {
             return adoptRef(new WheelEvent);
         }
-        static PassRefPtr<WheelEvent> create(float wheelTicksX, float wheelTicksY, PassRefPtr<AbstractView> view,
+        static PassRefPtr<WheelEvent> create(float wheelTicksX, float wheelTicksY,
+            float rawDeltaX, float rawDeltaY, Granularity granularity, PassRefPtr<AbstractView> view,
             int screenX, int screenY, int pageX, int pageY,
             bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
         {
-            return adoptRef(new WheelEvent(wheelTicksX, wheelTicksY, view, screenX, screenY, pageX, pageY,
+            return adoptRef(new WheelEvent(wheelTicksX, wheelTicksY, rawDeltaX, rawDeltaY,
+                granularity, view, screenX, screenY, pageX, pageY,
                 ctrlKey, altKey, shiftKey, metaKey));
         }
 
-        void initWheelEvent(int wheelDeltaX, int wheelDeltaY, PassRefPtr<AbstractView>,
+        void initWheelEvent(int rawDeltaX, int rawDeltaY, PassRefPtr<AbstractView>,
                             int screenX, int screenY, int pageX, int pageY,
                             bool ctrlKey, bool altKey, bool shiftKey, bool metaKey);
 
+        void initWebKitWheelEvent(int rawDeltaX, int rawDeltaY, PassRefPtr<AbstractView>,
+                                  int screenX, int screenY, int pageX, int pageY,
+                                  bool ctrlKey, bool altKey, bool shiftKey, bool metaKey);
+
         int wheelDelta() const { if (m_wheelDeltaY == 0) return m_wheelDeltaX; return m_wheelDeltaY; }
         int wheelDeltaX() const { return m_wheelDeltaX; }
         int wheelDeltaY() const { return m_wheelDeltaY; }
+        int rawDeltaX() const { return m_rawDeltaX; }
+        int rawDeltaY() const { return m_rawDeltaY; }
+        Granularity granularity() const { return m_granularity; }
 
         // Needed for Objective-C legacy support
         bool isHorizontal() const { return m_wheelDeltaX; }
 
     private:
         WheelEvent();
-        WheelEvent(float wheelTicksX, float wheelTicksY, PassRefPtr<AbstractView>,
+        WheelEvent(float wheelTicksX, float wheelTicksY, float rawDeltaX, float rawDeltaY,
+                   Granularity granularity, PassRefPtr<AbstractView>,
                    int screenX, int screenY, int pageX, int pageY,
                    bool ctrlKey, bool altKey, bool shiftKey, bool metaKey);
 
         virtual bool isWheelEvent() const;
-
+        
         int m_wheelDeltaX;
         int m_wheelDeltaY;
+
+        int m_rawDeltaX;
+        int m_rawDeltaY;
+        Granularity m_granularity;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl b/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl
index 4cba4ac0cb..4c709cef04 100644
--- a/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -21,9 +21,7 @@
 module events {
 
     // Based off of proposed IDL interface for WheelEvent:
-    interface [
-        GenerateConstructor
-    ] WheelEvent : UIEvent {
+    interface WheelEvent : UIEvent {
         readonly attribute long    screenX;
         readonly attribute long    screenY;
         readonly attribute long    clientX;
@@ -59,6 +57,19 @@ module events {
                             in boolean shiftKey,
                             in boolean metaKey);
 #endif /* !defined(LANGUAGE_JAVASCRIPT) */
-    };
 
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        void initWebKitWheelEvent(in long wheelDeltaX,
+                                  in long wheelDeltaY, 
+                                  in DOMWindow view, 
+                                  in long screenX,
+                                  in long screenY,
+                                  in long clientX,
+                                  in long clientY,
+                                  in boolean ctrlKey,
+                                  in boolean altKey,
+                                  in boolean shiftKey,
+                                  in boolean metaKey);
+#endif /* defined(LANGUAGE_JAVASCRIPT) */
+    };
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
index 56f8ff4f6a..94f5e9838a 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
@@ -51,7 +51,6 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "TextResourceDecoder.h"
-#include <wtf/Platform.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
 #include <wtf/Vector.h>
@@ -134,8 +133,8 @@ void XMLTokenizer::write(const SegmentedString& s, bool /*appendData*/)
     
     doWrite(s.toString());
     
-    // After parsing, go ahead and dispatch image beforeload/load events.
-    ImageLoader::dispatchPendingEvents();
+    // After parsing, go ahead and dispatch image beforeload events.
+    ImageLoader::dispatchPendingBeforeLoadEvents();
 }
 
 void XMLTokenizer::handleError(ErrorType type, const char* m, int lineNumber, int columnNumber)
@@ -206,7 +205,11 @@ void XMLTokenizer::exitText()
 void XMLTokenizer::end()
 {
     doEnd();
-    
+
+    // doEnd() could process a script tag, thus pausing parsing.
+    if (m_parserPaused)
+        return;
+
     if (m_sawError)
         insertErrorMessageBlock();
     else {
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
index 3bd15c8cc8..ddf7e6f574 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
@@ -27,6 +27,7 @@
 
 #include "CachedResourceClient.h"
 #include "CachedResourceHandle.h"
+#include "MappedAttributeEntry.h"
 #include "SegmentedString.h"
 #include "StringHash.h"
 #include "Tokenizer.h"
@@ -72,7 +73,7 @@ namespace WebCore {
     class XMLTokenizer : public Tokenizer, public CachedResourceClient {
     public:
         XMLTokenizer(Document*, FrameView* = 0);
-        XMLTokenizer(DocumentFragment*, Element*);
+        XMLTokenizer(DocumentFragment*, Element*, FragmentScriptingPermission);
         ~XMLTokenizer();
 
         enum ErrorType { warning, nonFatal, fatal };
@@ -138,7 +139,7 @@ public:
         void endDocument();
 #endif
     private:
-        friend bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent);
+        friend bool parseXMLDocumentFragment(const String&, DocumentFragment*, Element*, FragmentScriptingPermission);
 
         void initializeParserContext(const char* chunk = 0);
 
@@ -199,6 +200,7 @@ public:
         typedef HashMap<String, String> PrefixForNamespaceMap;
         PrefixForNamespaceMap m_prefixToNamespaceMap;
         SegmentedString m_pendingSrc;
+        FragmentScriptingPermission m_scriptingPermission;
     };
 
 #if ENABLE(XSLT)
@@ -206,7 +208,7 @@ void* xmlDocPtrForString(DocLoader*, const String& source, const String& url);
 #endif
 
 HashMap<String, String> parseAttributes(const String&, bool& attrsOK);
-bool parseXMLDocumentFragment(const String&, DocumentFragment*, Element* parent = 0);
+bool parseXMLDocumentFragment(const String&, DocumentFragment*, Element* parent = 0, FragmentScriptingPermission = FragmentScriptingAllowed);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
index 42c8b9b67b..70c98bd13c 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -51,10 +51,10 @@
 #include "ScriptValue.h"
 #include "TextResourceDecoder.h"
 #include "TransformSource.h"
+#include "XMLNSNames.h"
 #include "XMLTokenizerScope.h"
 #include <libxml/parser.h>
 #include <libxml/parserInternals.h>
-#include <wtf/Platform.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
 #include <wtf/UnusedParam.h>
@@ -168,11 +168,11 @@ public:
         m_callbacks.append(callback);        
     }
     
-    void appendErrorCallback(XMLTokenizer::ErrorType type, const char* message, int lineNumber, int columnNumber)
+    void appendErrorCallback(XMLTokenizer::ErrorType type, const xmlChar* message, int lineNumber, int columnNumber)
     {
         PendingErrorCallback* callback = new PendingErrorCallback;
         
-        callback->message = strdup(message);
+        callback->message = xmlStrdup(message);
         callback->type = type;
         callback->lineNumber = lineNumber;
         callback->columnNumber = columnNumber;
@@ -315,16 +315,16 @@ private:
     struct PendingErrorCallback: public PendingCallback {
         virtual ~PendingErrorCallback() 
         {
-            free(message);
+            xmlFree(message);
         }
         
         virtual void call(XMLTokenizer* tokenizer) 
         {
-            tokenizer->handleError(type, message, lineNumber, columnNumber);
+            tokenizer->handleError(type, reinterpret_cast<char*>(message), lineNumber, columnNumber);
         }
         
         XMLTokenizer::ErrorType type;
-        char* message;
+        xmlChar* message;
         int lineNumber;
         int columnNumber;
     };
@@ -547,10 +547,11 @@ XMLTokenizer::XMLTokenizer(Document* _doc, FrameView* _view)
     , m_pendingScript(0)
     , m_scriptStartLine(0)
     , m_parsingFragment(false)
+    , m_scriptingPermission(FragmentScriptingAllowed)
 {
 }
 
-XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
+XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement, FragmentScriptingPermission scriptingPermission)
     : m_doc(fragment->document())
     , m_view(0)
     , m_context(0)
@@ -573,6 +574,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_pendingScript(0)
     , m_scriptStartLine(0)
     , m_parsingFragment(true)
+    , m_scriptingPermission(scriptingPermission)
 {
     fragment->ref();
     if (m_doc)
@@ -596,9 +598,9 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
         if (NamedNodeMap* attrs = element->attributes()) {
             for (unsigned i = 0; i < attrs->length(); i++) {
                 Attribute* attr = attrs->attributeItem(i);
-                if (attr->localName() == "xmlns")
+                if (attr->localName() == xmlnsAtom)
                     m_defaultNamespaceURI = attr->value();
-                else if (attr->prefix() == "xmlns")
+                else if (attr->prefix() == xmlnsAtom)
                     m_prefixToNamespaceMap.set(attr->localName(), attr->value());
             }
         }
@@ -674,15 +676,15 @@ struct _xmlSAX2Namespace {
 };
 typedef struct _xmlSAX2Namespace xmlSAX2Namespace;
 
-static inline void handleElementNamespaces(Element* newElement, const xmlChar** libxmlNamespaces, int nb_namespaces, ExceptionCode& ec)
+static inline void handleElementNamespaces(Element* newElement, const xmlChar** libxmlNamespaces, int nb_namespaces, ExceptionCode& ec, FragmentScriptingPermission scriptingPermission)
 {
     xmlSAX2Namespace* namespaces = reinterpret_cast<xmlSAX2Namespace*>(libxmlNamespaces);
     for (int i = 0; i < nb_namespaces; i++) {
-        String namespaceQName = "xmlns";
+        AtomicString namespaceQName = xmlnsAtom;
         String namespaceURI = toString(namespaces[i].uri);
         if (namespaces[i].prefix)
             namespaceQName = "xmlns:" + toString(namespaces[i].prefix);
-        newElement->setAttributeNS("http://www.w3.org/2000/xmlns/", namespaceQName, namespaceURI, ec);
+        newElement->setAttributeNS(XMLNSNames::xmlnsNamespaceURI, namespaceQName, namespaceURI, ec, scriptingPermission);
         if (ec) // exception setting attributes
             return;
     }
@@ -697,7 +699,7 @@ struct _xmlSAX2Attributes {
 };
 typedef struct _xmlSAX2Attributes xmlSAX2Attributes;
 
-static inline void handleElementAttributes(Element* newElement, const xmlChar** libxmlAttributes, int nb_attributes, ExceptionCode& ec)
+static inline void handleElementAttributes(Element* newElement, const xmlChar** libxmlAttributes, int nb_attributes, ExceptionCode& ec, FragmentScriptingPermission scriptingPermission)
 {
     xmlSAX2Attributes* attributes = reinterpret_cast<xmlSAX2Attributes*>(libxmlAttributes);
     for (int i = 0; i < nb_attributes; i++) {
@@ -708,7 +710,7 @@ static inline void handleElementAttributes(Element* newElement, const xmlChar**
         String attrURI = attrPrefix.isEmpty() ? String() : toString(attributes[i].uri);
         String attrQName = attrPrefix.isEmpty() ? attrLocalName : attrPrefix + ":" + attrLocalName;
         
-        newElement->setAttributeNS(attrURI, attrQName, attrValue, ec);
+        newElement->setAttributeNS(attrURI, attrQName, attrValue, ec, scriptingPermission);
         if (ec) // exception setting attributes
             return;
     }
@@ -776,17 +778,17 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
     }
     
     ExceptionCode ec = 0;
-    handleElementNamespaces(newElement.get(), libxmlNamespaces, nb_namespaces, ec);
+    handleElementNamespaces(newElement.get(), libxmlNamespaces, nb_namespaces, ec, m_scriptingPermission);
     if (ec) {
         stopParsing();
         return;
     }
 
     ScriptController* jsProxy = m_doc->frame() ? m_doc->frame()->script() : 0;
-    if (jsProxy && m_doc->frame()->script()->isEnabled())
+    if (jsProxy && m_doc->frame()->script()->canExecuteScripts(NotAboutToExecuteScript))
         jsProxy->setEventHandlerLineNumber(lineNumber());
 
-    handleElementAttributes(newElement.get(), libxmlAttributes, nb_attributes, ec);
+    handleElementAttributes(newElement.get(), libxmlAttributes, nb_attributes, ec, m_scriptingPermission);
     if (ec) {
         stopParsing();
         return;
@@ -810,7 +812,7 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
     if (m_view && !newElement->attached())
         newElement->attach();
 
-    if (isFirstElement && m_doc->frame())
+    if (!m_parsingFragment && isFirstElement && m_doc->frame())
         m_doc->frame()->loader()->dispatchDocumentElementAvailable();
 }
 
@@ -829,6 +831,13 @@ void XMLTokenizer::endElementNs()
     Node* n = m_currentNode;
     n->finishParsingChildren();
 
+    if (m_scriptingPermission == FragmentScriptingNotAllowed && n->isElementNode() && toScriptElement(static_cast<Element*>(n))) {
+        popCurrentNode();
+        ExceptionCode ec;       
+        n->remove(ec);
+        return;
+    }
+    
     if (!n->isElementNode() || !m_view) {
         popCurrentNode();
         return;
@@ -899,7 +908,7 @@ void XMLTokenizer::error(ErrorType type, const char* message, va_list args)
     if (m_parserStopped)
         return;
 
-#if COMPILER(MSVC)
+#if COMPILER(MSVC) || COMPILER(RVCT)
     char m[1024];
     vsnprintf(m, sizeof(m) - 1, message, args);
 #else
@@ -909,11 +918,11 @@ void XMLTokenizer::error(ErrorType type, const char* message, va_list args)
 #endif
     
     if (m_parserPaused)
-        m_pendingCallbacks->appendErrorCallback(type, m, lineNumber(), columnNumber());
+        m_pendingCallbacks->appendErrorCallback(type, reinterpret_cast<const xmlChar*>(m), lineNumber(), columnNumber());
     else
         handleError(type, m, lineNumber(), columnNumber());
 
-#if !COMPILER(MSVC)
+#if !COMPILER(MSVC) && !COMPILER(RVCT)
     free(m);
 #endif
 }
@@ -1049,13 +1058,7 @@ void XMLTokenizer::internalSubset(const xmlChar* name, const xmlChar* externalID
         }
 #endif
 
-#if ENABLE(XHTMLMP)
-        m_doc->addChild(DocumentType::create(m_doc, dtdName, extId, toString(systemID)));
-#elif ENABLE(WML)
-        m_doc->addChild(DocumentType::create(m_doc, toString(name), extId, toString(systemID)));
-#else
         m_doc->addChild(DocumentType::create(m_doc, toString(name), toString(externalID), toString(systemID)));
-#endif
     }
 }
 
@@ -1242,7 +1245,7 @@ static void externalSubsetHandler(void* closure, const xmlChar*, const xmlChar*
         || (extId == "-//W3C//DTD XHTML Basic 1.0//EN")
         || (extId == "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN")
         || (extId == "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN")
-#if !ENABLE(XHTMLMP)
+#if ENABLE(XHTMLMP)
         || (extId == "-//WAPFORUM//DTD XHTML Mobile 1.0//EN")
 #endif
        )
@@ -1304,6 +1307,9 @@ void XMLTokenizer::doEnd()
     }
 #endif
 
+    if (m_parserStopped)
+        return;
+
     if (m_context) {
         // Tell libxml we're done.
         {
@@ -1380,12 +1386,12 @@ void XMLTokenizer::resumeParsing()
         end();
 }
 
-bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent)
+bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent, FragmentScriptingPermission scriptingPermission)
 {
     if (!chunk.length())
         return true;
 
-    XMLTokenizer tokenizer(fragment, parent);
+    XMLTokenizer tokenizer(fragment, parent, scriptingPermission);
     
     CString chunkAsUtf8 = chunk.utf8();
     tokenizer.initializeParserContext(chunkAsUtf8.data());
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
index 5c87fe6231..b55942ae8c 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
@@ -52,7 +52,6 @@
 #include "TextResourceDecoder.h"
 #include "TransformSource.h"
 #include <QDebug>
-#include <wtf/Platform.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
 #include <wtf/Vector.h>
@@ -66,7 +65,6 @@ using namespace std;
 
 namespace WebCore {
 
-#if QT_VERSION >= 0x040400
 class EntityResolver : public QXmlStreamEntityResolver {
     virtual QString resolveUndeclaredEntity(const QString &name);
 };
@@ -76,7 +74,6 @@ QString EntityResolver::resolveUndeclaredEntity(const QString &name)
     UChar c = decodeNamedEntity(name.toUtf8().constData());
     return QString(c);
 }
-#endif
 
 // --------------------------------
 
@@ -102,13 +99,12 @@ XMLTokenizer::XMLTokenizer(Document* _doc, FrameView* _view)
     , m_pendingScript(0)
     , m_scriptStartLine(0)
     , m_parsingFragment(false)
+    , m_scriptingPermission(FragmentScriptingAllowed)
 {
-#if QT_VERSION >= 0x040400
     m_stream.setEntityResolver(new EntityResolver);
-#endif
 }
 
-XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
+XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement, FragmentScriptingPermission permission)
     : m_doc(fragment->document())
     , m_view(0)
     , m_wroteText(false)
@@ -130,6 +126,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_pendingScript(0)
     , m_scriptStartLine(0)
     , m_parsingFragment(true)
+    , m_scriptingPermission(permission)
 {
     fragment->ref();
     if (m_doc)
@@ -149,19 +146,6 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     if (elemStack.isEmpty())
         return;
     
-#if QT_VERSION < 0x040400
-    for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
-        if (NamedNodeMap* attrs = element->attributes()) {
-            for (unsigned i = 0; i < attrs->length(); i++) {
-                Attribute* attr = attrs->attributeItem(i);
-                if (attr->localName() == "xmlns")
-                    m_defaultNamespaceURI = attr->value();
-                else if (attr->prefix() == "xmlns")
-                    m_prefixToNamespaceMap.set(attr->localName(), attr->value());
-            }
-        }
-    }
-#else
     QXmlStreamNamespaceDeclarations namespaces;
     for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
         if (NamedNodeMap* attrs = element->attributes()) {
@@ -176,7 +160,6 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     }
     m_stream.addExtraNamespaceDeclarations(namespaces);
     m_stream.setEntityResolver(new EntityResolver);
-#endif
 
     // If the parent element is not in document tree, there may be no xmlns attribute; just default to the parent's namespace.
     if (m_defaultNamespaceURI.isNull() && !parentElement->inDocument())
@@ -190,9 +173,7 @@ XMLTokenizer::~XMLTokenizer()
         m_doc->deref();
     if (m_pendingScript)
         m_pendingScript->removeClient(this);
-#if QT_VERSION >= 0x040400
     delete m_stream.entityResolver();
-#endif
 }
 
 void XMLTokenizer::doWrite(const String& parseString)
@@ -207,27 +188,6 @@ void XMLTokenizer::doWrite(const String& parseString)
 
     QString data(parseString);
     if (!data.isEmpty()) {
-#if QT_VERSION < 0x040400
-        if (!m_sawFirstElement) {
-            int idx = data.indexOf(QLatin1String("<?xml"));
-            if (idx != -1) {
-                int start = idx + 5;
-                int end = data.indexOf(QLatin1String("?>"), start);
-                QString content = data.mid(start, end-start);
-                bool ok = true;
-                HashMap<String, String> attrs = parseAttributes(content, ok);
-                String version = attrs.get("version");
-                String encoding = attrs.get("encoding");
-                ExceptionCode ec = 0;
-                if (!m_parsingFragment) {
-                    if (!version.isEmpty())
-                        m_doc->setXMLVersion(version, ec);
-                    if (!encoding.isEmpty())
-                        m_doc->setXMLEncoding(encoding);
-                }
-            }
-        }
-#endif
         m_stream.addData(data);
         parse();
     }
@@ -297,12 +257,12 @@ void XMLTokenizer::resumeParsing()
         end();
 }
 
-bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent)
+bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent, FragmentScriptingPermission scriptingPermission)
 {
     if (!chunk.length())
         return true;
 
-    XMLTokenizer tokenizer(fragment, parent);
+    XMLTokenizer tokenizer(fragment, parent, scriptingPermission);
     
     tokenizer.write(String("<qxmlstreamdummyelement>"), false);
     tokenizer.write(chunk, false);
@@ -363,19 +323,20 @@ static inline String prefixFromQName(const QString& qName)
 }
 
 static inline void handleElementNamespaces(Element* newElement, const QXmlStreamNamespaceDeclarations &ns,
-                                           ExceptionCode& ec)
+                                           ExceptionCode& ec, FragmentScriptingPermission scriptingPermission)
 {
     for (int i = 0; i < ns.count(); ++i) {
         const QXmlStreamNamespaceDeclaration &decl = ns[i];
         String namespaceURI = decl.namespaceUri();
         String namespaceQName = decl.prefix().isEmpty() ? String("xmlns") : String("xmlns:") + String(decl.prefix());
-        newElement->setAttributeNS("http://www.w3.org/2000/xmlns/", namespaceQName, namespaceURI, ec);
+        newElement->setAttributeNS("http://www.w3.org/2000/xmlns/", namespaceQName, namespaceURI, ec, scriptingPermission);
         if (ec) // exception setting attributes
             return;
     }
 }
 
-static inline void handleElementAttributes(Element* newElement, const QXmlStreamAttributes &attrs, ExceptionCode& ec)
+static inline void handleElementAttributes(Element* newElement, const QXmlStreamAttributes &attrs, ExceptionCode& ec,
+                                           FragmentScriptingPermission scriptingPermission)
 {
     for (int i = 0; i < attrs.count(); ++i) {
         const QXmlStreamAttribute &attr = attrs[i];
@@ -383,7 +344,7 @@ static inline void handleElementAttributes(Element* newElement, const QXmlStream
         String attrValue     = attr.value();
         String attrURI       = attr.namespaceUri().isEmpty() ? String() : String(attr.namespaceUri());
         String attrQName     = attr.qualifiedName();
-        newElement->setAttributeNS(attrURI, attrQName, attrValue, ec);
+        newElement->setAttributeNS(attrURI, attrQName, attrValue, ec, scriptingPermission);
         if (ec) // exception setting attributes
             return;
     }
@@ -485,14 +446,12 @@ void XMLTokenizer::startDocument()
     if (!m_parsingFragment) {
         m_doc->setXMLStandalone(m_stream.isStandaloneDocument(), ec);
 
-#if QT_VERSION >= 0x040400
         QStringRef version = m_stream.documentVersion();
         if (!version.isEmpty())
             m_doc->setXMLVersion(version, ec);
         QStringRef encoding = m_stream.documentEncoding();
         if (!encoding.isEmpty())
             m_doc->setXMLEncoding(encoding);
-#endif
     }
 }
 
@@ -545,13 +504,13 @@ void XMLTokenizer::parseStartElement()
     m_sawFirstElement = true;
 
     ExceptionCode ec = 0;
-    handleElementNamespaces(newElement.get(), m_stream.namespaceDeclarations(), ec);
+    handleElementNamespaces(newElement.get(), m_stream.namespaceDeclarations(), ec, m_scriptingPermission);
     if (ec) {
         stopParsing();
         return;
     }
 
-    handleElementAttributes(newElement.get(), m_stream.attributes(), ec);
+    handleElementAttributes(newElement.get(), m_stream.attributes(), ec, m_scriptingPermission);
     if (ec) {
         stopParsing();
         return;
@@ -581,6 +540,13 @@ void XMLTokenizer::parseEndElement()
     Node* n = m_currentNode;
     n->finishParsingChildren();
 
+    if (m_scriptingPermission == FragmentScriptingNotAllowed && n->isElementNode() && toScriptElement(static_cast<Element*>(n))) {
+        popCurrentNode();
+        ExceptionCode ec;
+        n->remove(ec);
+        return;
+    }
+
     if (!n->isElementNode() || !m_view) {
         if (!m_currentNodeStack.isEmpty())
             popCurrentNode();
@@ -702,83 +668,11 @@ bool XMLTokenizer::hasError() const
     return m_stream.hasError();
 }
 
-#if QT_VERSION < 0x040400
-static QString parseId(const QString &dtd, int *pos, bool *ok)
-{
-    *ok = true;
-    int start = *pos + 1;
-    int end = start;
-    if (dtd.at(*pos) == QLatin1Char('\''))
-        while (start < dtd.length() && dtd.at(end) != QLatin1Char('\''))
-            ++end;
-    else if (dtd.at(*pos) == QLatin1Char('\"'))
-        while (start < dtd.length() && dtd.at(end) != QLatin1Char('\"'))
-            ++end;
-    else {
-        *ok = false;
-        return QString();
-    }
-    *pos = end + 1;
-    return dtd.mid(start, end - start);
-}
-#endif
-
 void XMLTokenizer::parseDtd()
 {
-#if QT_VERSION >= 0x040400
     QStringRef name = m_stream.dtdName();
     QStringRef publicId = m_stream.dtdPublicId();
     QStringRef systemId = m_stream.dtdSystemId();
-#else
-    QString dtd = m_stream.text().toString();
-
-    int start = dtd.indexOf("<!DOCTYPE ") + 10;
-    while (start < dtd.length() && dtd.at(start).isSpace())
-        ++start;
-    int end = start;
-    while (start < dtd.length() && !dtd.at(end).isSpace())
-        ++end;
-    QString name = dtd.mid(start, end - start);
-
-    start = end;
-    while (start < dtd.length() && dtd.at(start).isSpace())
-        ++start;
-    end = start;
-    while (start < dtd.length() && !dtd.at(end).isSpace())
-        ++end;
-    QString id = dtd.mid(start, end - start);
-    start = end;
-    while (start < dtd.length() && dtd.at(start).isSpace())
-        ++start;
-    QString publicId;
-    QString systemId;
-    if (id == QLatin1String("PUBLIC")) {
-        bool ok;
-        publicId = parseId(dtd, &start, &ok);
-        if (!ok) {
-            handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-            return;
-        }
-        while (start < dtd.length() && dtd.at(start).isSpace())
-            ++start;
-        systemId = parseId(dtd, &start, &ok);
-        if (!ok) {
-            handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-            return;
-        }
-    } else if (id == QLatin1String("SYSTEM")) {
-        bool ok;
-        systemId = parseId(dtd, &start, &ok);
-        if (!ok) {
-            handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-            return;
-        }
-    } else if (id == QLatin1String("[") || id == QLatin1String(">")) {
-    } else {
-        handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-        return;
-    }
-#endif    
 
     //qDebug() << dtd << name << publicId << systemId;
     if ((publicId == QLatin1String("-//W3C//DTD XHTML 1.0 Transitional//EN"))
diff --git a/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.cpp b/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.cpp
index d668703861..9e0e7dc8fc 100644
--- a/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.cpp
@@ -193,7 +193,8 @@ void PlatformMessagePortChannel::postMessageToRemote(PassOwnPtr<MessagePortChann
 bool PlatformMessagePortChannel::tryGetMessageFromRemote(OwnPtr<MessagePortChannel::EventData>& result)
 {
     MutexLocker lock(m_mutex);
-    return m_incomingQueue->tryGetMessage(result);
+    result = m_incomingQueue->tryGetMessage();
+    return result;
 }
 
 bool PlatformMessagePortChannel::isConnectedTo(MessagePort* port)
diff --git a/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.h b/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.h
index 0ce2d13ea5..2aad952a36 100644
--- a/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.h
+++ b/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.h
@@ -63,18 +63,14 @@ namespace WebCore {
         public:
             static PassRefPtr<MessagePortQueue> create() { return adoptRef(new MessagePortQueue()); }
 
-            bool tryGetMessage(OwnPtr<MessagePortChannel::EventData>& message)
+            PassOwnPtr<MessagePortChannel::EventData> tryGetMessage()
             {
-                MessagePortChannel::EventData* holder = 0;
-                bool messageAvailable = m_queue.tryGetMessage(holder);
-                if (messageAvailable)
-                    message.set(holder);
-                return messageAvailable;
+                return m_queue.tryGetMessage();
             }
 
             bool appendAndCheckEmpty(PassOwnPtr<MessagePortChannel::EventData> message)
             {
-                return m_queue.appendAndCheckEmpty(message.release());
+                return m_queue.appendAndCheckEmpty(message);
             }
 
             bool isEmpty()
@@ -82,19 +78,10 @@ namespace WebCore {
                 return m_queue.isEmpty();
             }
 
-            ~MessagePortQueue()
-            {
-                // Manually free any items left in the queue, since we can't use OwnPtr internally.
-                MessagePortChannel::EventData* data = 0;
-                while (m_queue.tryGetMessage(data))
-                    delete data;
-            }
         private:
             MessagePortQueue() { }
 
-            // OwnPtr is Noncopyable, so we can't use it as the template type in a MessageQueue. So we just store a pointer to EventData and manually free it in the destructor.
-            // FIXME: Use a lock-free queue implementation to completely eliminate contention when sending/receiving messages.
-            MessageQueue<MessagePortChannel::EventData*> m_queue;
+            MessageQueue<MessagePortChannel::EventData> m_queue;
         };
 
         ~PlatformMessagePortChannel();
diff --git a/src/3rdparty/webkit/WebCore/dom/make_names.pl b/src/3rdparty/webkit/WebCore/dom/make_names.pl
index 6b5ddb40f7..2d92a05fe1 100755
--- a/src/3rdparty/webkit/WebCore/dom/make_names.pl
+++ b/src/3rdparty/webkit/WebCore/dom/make_names.pl
@@ -38,7 +38,8 @@ use InFilesParser;
 use Switch;
 
 my $printFactory = 0; 
-my $printWrapperFactory = 0;
+my $printWrapperFactory = 0; 
+my $printWrapperFactoryV8 = 0; 
 my $tagsFile = "";
 my $attrsFile = "";
 my $outputDir = ".";
@@ -46,7 +47,14 @@ my %tags = ();
 my %attrs = ();
 my %parameters = ();
 my $extraDefines = 0;
-my $preprocessor = "/usr/bin/gcc -E -P -x c++";
+require Config;
+my $gccLocation = "";
+if (($Config::Config{'osname'}) =~ /solaris/i) {
+    $gccLocation = "/usr/sfw/bin/gcc";
+} else {
+    $gccLocation = "/usr/bin/gcc";
+}
+my $preprocessor = $gccLocation . " -E -P -x c++";
 
 GetOptions(
     'tags=s' => \$tagsFile, 
@@ -55,7 +63,8 @@ GetOptions(
     'outputDir=s' => \$outputDir,
     'extraDefines=s' => \$extraDefines,
     'preprocessor=s' => \$preprocessor,
-    'wrapperFactory' => \$printWrapperFactory
+    'wrapperFactory' => \$printWrapperFactory,
+    'wrapperFactoryV8' => \$printWrapperFactoryV8
 );
 
 die "You must specify at least one of --tags <file> or --attrs <file>" unless (length($tagsFile) || length($attrsFile));
@@ -71,7 +80,7 @@ $parameters{namespacePrefix} = $parameters{namespace} unless $parameters{namespa
 mkpath($outputDir);
 my $namesBasePath = "$outputDir/$parameters{namespace}Names";
 my $factoryBasePath = "$outputDir/$parameters{namespace}ElementFactory";
-my $wrapperFactoryBasePath = "$outputDir/JS$parameters{namespace}ElementWrapperFactory";
+my $wrapperFactoryFileName = "$parameters{namespace}ElementWrapperFactory";
 
 printNamesHeaderFile("$namesBasePath.h");
 printNamesCppFile("$namesBasePath.cpp");
@@ -81,9 +90,17 @@ if ($printFactory) {
     printFactoryHeaderFile("$factoryBasePath.h");
 }
 
+die "You cannot specify both --wrapperFactory and --wrapperFactoryV8" if $printWrapperFactory && $printWrapperFactoryV8;
+my $wrapperFactoryType = "";
 if ($printWrapperFactory) {
-    printWrapperFactoryCppFile("$wrapperFactoryBasePath.cpp");
-    printWrapperFactoryHeaderFile("$wrapperFactoryBasePath.h");
+    $wrapperFactoryType = "JS";
+} elsif ($printWrapperFactoryV8) {
+    $wrapperFactoryType = "V8";
+}
+
+if ($wrapperFactoryType) {
+    printWrapperFactoryCppFile($outputDir, $wrapperFactoryType, $wrapperFactoryFileName);
+    printWrapperFactoryHeaderFile($outputDir, $wrapperFactoryType, $wrapperFactoryFileName);
 }
 
 ### Hash initialization
@@ -94,7 +111,6 @@ sub defaultTagPropertyHash
         'constructorNeedsCreatedByParser' => 0,
         'constructorNeedsFormElement' => 0,
         'createWithNew' => 0,
-        'exportString' => 0,
         'interfaceName' => defaultInterfaceName($_[0]),
         # By default, the JSInterfaceName is the same as the interfaceName.
         'JSInterfaceName' => defaultInterfaceName($_[0]),
@@ -104,11 +120,6 @@ sub defaultTagPropertyHash
     );
 }
 
-sub defaultAttrPropertyHash
-{
-    return ('exportString' => 0);
-}
-
 sub defaultParametersHash
 {
     return (
@@ -117,8 +128,7 @@ sub defaultParametersHash
         'namespaceURI' => '',
         'guardFactoryWith' => '',
         'tagsNullNamespace' => 0,
-        'attrsNullNamespace' => 0,
-        'exportStrings' => 0
+        'attrsNullNamespace' => 0
     );
 }
 
@@ -157,7 +167,7 @@ sub attrsHandler
     $attr =~ s/-/_/g;
 
     # Initialize default properties' values.
-    $attrs{$attr} = { defaultAttrPropertyHash($attr) } if !defined($attrs{$attr});
+    $attrs{$attr} = {} if !defined($attrs{$attr});
 
     if ($property) {
         die "Unknown property $property for attribute $attr\n" if !defined($attrs{$attr}{$property});
@@ -220,10 +230,6 @@ sub printMacros
 
     for my $name (sort keys %$namesRef) {
         print F "$macro $name","$suffix;\n";
-
-        if ($parameters{exportStrings} or $names{$name}{exportString}) { 
-            print F "extern char $name", "${suffix}String[];\n";
-        }
     }
 }
 
@@ -534,14 +540,6 @@ DEFINE_GLOBAL(AtomicString, ${lowerNamespace}NamespaceURI, \"$parameters{namespa
         print F "}\n";
     }
 
-    if (keys %tags) {
-        printDefinitionStrings($F, \%tags, "tags");
-    }
-
-    if (keys %attrs) {
-        printDefinitionStrings($F, \%attrs, "attributes");
-    }
-
 print F "\nvoid init()
 {
     static bool initialized = false;
@@ -574,6 +572,7 @@ print F "\nvoid init()
 sub printJSElementIncludes
 {
     my $F = shift;
+    my $wrapperFactoryType = shift;
 
     my %tagsSeen;
     for my $tagName (sort keys %tags) {
@@ -581,7 +580,7 @@ sub printJSElementIncludes
         next if defined($tagsSeen{$JSInterfaceName}) || usesDefaultJSWrapper($tagName);
         $tagsSeen{$JSInterfaceName} = 1;
 
-        print F "#include \"JS${JSInterfaceName}.h\"\n";
+        print F "#include \"${wrapperFactoryType}${JSInterfaceName}.h\"\n";
     }
 }
 
@@ -599,25 +598,6 @@ sub printElementIncludes
     }
 }
 
-sub printDefinitionStrings
-{
-    my ($F, $namesRef, $type) = @_;
-    my $singularType = substr($type, 0, -1);
-    my $shortType = substr($singularType, 0, 4);
-    my $shortCamelType = ucfirst($shortType);
-    print F "\n// " . ucfirst($type) . " as strings\n";
-
-    my %names = %$namesRef;
-    for my $name (sort keys %$namesRef) {
-        next if (!$parameters{exportStrings} and !$names{$name}{exportString});
-
-        my $realName = $name;
-        $realName =~ s/_/-/g;
-
-        print F "char $name","${shortCamelType}String[] = \"$realName\";\n";
-    }
-} 
-
 sub printDefinitions
 {
     my ($F, $namesRef, $type, $namespaceURI) = @_;
@@ -628,19 +608,10 @@ sub printDefinitions
     
     print F "    // " . ucfirst($type) . "\n";
 
-    my %names = %$namesRef;
     for my $name (sort keys %$namesRef) {
-        next if ($parameters{exportStrings} or $names{$name}{exportString});
-
         my $realName = $name;
         $realName =~ s/_/-/g;
-        print F "    const char *$name","${shortCamelType}String = \"$realName\";\n";
-    }
-
-    print "\n";
-
-    for my $name (sort keys %$namesRef) {
-        print F "    new ((void*)&$name","${shortCamelType}) QualifiedName(nullAtom, $name","${shortCamelType}String, $namespaceURI);\n";
+        print F "    new ((void*)&$name","${shortCamelType}) QualifiedName(nullAtom, \"$realName\", $namespaceURI);\n";
     }
 }
 
@@ -846,6 +817,7 @@ sub usesDefaultJSWrapper
 sub printWrapperFunctions
 {
     my $F = shift;
+    my $wrapperFactoryType = shift;
 
     my %tagsSeen;
     for my $tagName (sort keys %tags) {
@@ -860,10 +832,11 @@ sub printWrapperFunctions
             print F "#if ${conditionalString}\n\n";
         }
 
-        # Hack for the media tags
-        # FIXME: This should have been done via a CustomWrapper attribute and a separate *Custom file.
-        if ($tags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
-            print F <<END
+        if ($wrapperFactoryType eq "JS") {
+            # Hack for the media tags
+            # FIXME: This should have been done via a CustomWrapper attribute and a separate *Custom file.
+            if ($tags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
+                print F <<END
 static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
 {
     if (!MediaPlayer::isAvailable())
@@ -873,8 +846,8 @@ static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObjec
 
 END
 ;
-        } else {
-            print F <<END
+            } else {
+                print F <<END
 static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
 {
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, ${JSInterfaceName}, element.get());
@@ -882,6 +855,16 @@ static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObjec
 
 END
 ;
+            }
+        } elsif ($wrapperFactoryType eq "V8") {
+            print F <<END
+static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element)
+{
+    return toV8(static_cast<${JSInterfaceName}*>(element));
+}
+
+END
+;
         }
 
         if ($conditional) {
@@ -892,9 +875,11 @@ END
 
 sub printWrapperFactoryCppFile
 {
-    my $cppPath = shift;
+    my $outputDir = shift;
+    my $wrapperFactoryType = shift;
+    my $wrapperFactoryFileName = shift;
     my $F;
-    open F, ">$cppPath";
+    open F, ">" . $outputDir . "/" . $wrapperFactoryType . $wrapperFactoryFileName . ".cpp";
 
     printLicenseHeader($F);
 
@@ -902,38 +887,73 @@ sub printWrapperFactoryCppFile
 
     print F "#if $parameters{guardFactoryWith}\n\n" if $parameters{guardFactoryWith};
 
-    print F "#include \"JS$parameters{namespace}ElementWrapperFactory.h\"\n";
+    print F "#include \"$wrapperFactoryType$parameters{namespace}ElementWrapperFactory.h\"\n";
 
-    printJSElementIncludes($F);
+    printJSElementIncludes($F, $wrapperFactoryType);
 
     print F "\n#include \"$parameters{namespace}Names.h\"\n\n";
 
     printElementIncludes($F);
 
     print F "\n#include <wtf/StdLibExtras.h>\n\n";
-    
-    print F <<END
+
+    if ($wrapperFactoryType eq "JS") {    
+        print F <<END
 using namespace JSC;
+END
+;
+    } elsif ($wrapperFactoryType eq "V8") {
+        print F <<END
+#include "V8$parameters{namespace}Element.h"
+        
+#include <v8.h>
+END
+;
+    }
+
+    print F <<END
 
 namespace WebCore {
 
 using namespace $parameters{namespace}Names;
 
+END
+;
+    if ($wrapperFactoryType eq "JS") {
+        print F <<END
 typedef JSNode* (*Create$parameters{namespace}ElementWrapperFunction)(ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{namespace}Element>);
 
 END
 ;
+    } elsif ($wrapperFactoryType eq "V8") {
+        print F <<END
+typedef v8::Handle<v8::Value> (*Create$parameters{namespace}ElementWrapperFunction)($parameters{namespace}Element*);
 
-    printWrapperFunctions($F);
+END
+;
+    }
 
-    print F <<END
+    printWrapperFunctions($F, $wrapperFactoryType);
+
+    if ($wrapperFactoryType eq "JS") {
+        print F <<END
 JSNode* createJS$parameters{namespace}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
-{   
+{
+    typedef HashMap<WebCore::AtomicStringImpl*, Create$parameters{namespace}ElementWrapperFunction> FunctionMap;
+    DEFINE_STATIC_LOCAL(FunctionMap, map, ());
+    if (map.isEmpty()) {
+END
+;
+    } elsif ($wrapperFactoryType eq "V8") {
+        print F <<END
+v8::Handle<v8::Value> createV8$parameters{namespace}Wrapper($parameters{namespace}Element* element, bool forceNewObject)
+{
     typedef HashMap<WebCore::AtomicStringImpl*, Create$parameters{namespace}ElementWrapperFunction> FunctionMap;
     DEFINE_STATIC_LOCAL(FunctionMap, map, ());
     if (map.isEmpty()) {
 END
 ;
+    }
 
     for my $tag (sort keys %tags) {
         # Do not add the name to the map if it does not have a JS wrapper constructor or uses the default wrapper.
@@ -957,8 +977,22 @@ END
     }
     Create$parameters{namespace}ElementWrapperFunction createWrapperFunction = map.get(element->localName().impl());
     if (createWrapperFunction)
+END
+;
+    if ($wrapperFactoryType eq "JS") {
+        print F <<END
         return createWrapperFunction(exec, globalObject, element);
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{namespace}Element, element.get());
+END
+;
+    } elsif ($wrapperFactoryType eq "V8") {
+        print F <<END
+        return createWrapperFunction(element);
+    return V8$parameters{namespace}Element::wrap(element, forceNewObject);
+END
+;
+    }
+    print F <<END
 }
 
 }
@@ -973,18 +1007,21 @@ END
 
 sub printWrapperFactoryHeaderFile
 {
-    my $headerPath = shift;
+    my $outputDir = shift;
+    my $wrapperFactoryType = shift;
+    my $wrapperFactoryFileName = shift;
     my $F;
-    open F, ">$headerPath";
+    open F, ">" . $outputDir . "/" . $wrapperFactoryType . $wrapperFactoryFileName . ".h";
 
     printLicenseHeader($F);
 
-    print F "#ifndef JS$parameters{namespace}ElementWrapperFactory_h\n";
-    print F "#define JS$parameters{namespace}ElementWrapperFactory_h\n\n";
+    print F "#ifndef $wrapperFactoryType$parameters{namespace}ElementWrapperFactory_h\n";
+    print F "#define $wrapperFactoryType$parameters{namespace}ElementWrapperFactory_h\n\n";
 
     print F "#if $parameters{guardFactoryWith}\n" if $parameters{guardFactoryWith};
 
-    print F <<END
+    if ($wrapperFactoryType eq "JS") {
+        print F <<END
 #include <wtf/Forward.h>
 
 namespace JSC {
@@ -1003,10 +1040,23 @@ namespace WebCore {
  
 END
 ;
+    } elsif ($wrapperFactoryType eq "V8") {
+        print F <<END
+#include <v8.h>
+
+namespace WebCore {
+
+    class $parameters{namespace}Element;
+
+    v8::Handle<v8::Value> createV8$parameters{namespace}Wrapper($parameters{namespace}Element*, bool);
+}
+END
+;
+    }
 
     print F "#endif // $parameters{guardFactoryWith}\n\n" if $parameters{guardFactoryWith};
 
-    print F "#endif // JS$parameters{namespace}ElementWrapperFactory_h\n";
+    print F "#endif // $wrapperFactoryType$parameters{namespace}ElementWrapperFactory_h\n";
 
     close F;
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/AppendNodeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/AppendNodeCommand.cpp
index ef79e9c6d0..6178641013 100644
--- a/src/3rdparty/webkit/WebCore/editing/AppendNodeCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/AppendNodeCommand.cpp
@@ -44,12 +44,18 @@ AppendNodeCommand::AppendNodeCommand(PassRefPtr<Element> parent, PassRefPtr<Node
 
 void AppendNodeCommand::doApply()
 {
+    if (!m_parent->isContentEditable() && m_parent->attached())
+        return;
+        
     ExceptionCode ec;
     m_parent->appendChild(m_node.get(), ec);
 }
 
 void AppendNodeCommand::doUnapply()
 {
+    if (!m_parent->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_node->remove(ec);
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
index 7a8f02504c..1c739ec5f7 100644
--- a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
@@ -137,7 +137,7 @@ void StyleChange::reconcileTextDecorationProperties(CSSMutableStyleDeclaration*
         textDecoration = textDecorationsInEffect;
     }
 
-    // If text-decration is set to "none", remove the property because we don't want to add redundant "text-decoration: none".
+    // If text-decoration is set to "none", remove the property because we don't want to add redundant "text-decoration: none".
     if (textDecoration && !textDecoration->isValueList())
         style->removeProperty(CSSPropertyTextDecoration);
 }
@@ -250,7 +250,7 @@ void StyleChange::extractTextStyles(CSSMutableStyleDeclaration* style)
                 else
                     m_applyFontSize = "7";
             }
-            // Huge quirk in Microsft Entourage is that they understand CSS font-size, but also write 
+            // Huge quirk in Microsoft Entourage is that they understand CSS font-size, but also write 
             // out legacy 1-7 values in font tags (I guess for mailers that are not CSS-savvy at all, 
             // like Eudora). Yes, they write out *both*. We need to write out both as well.
         }
@@ -302,7 +302,9 @@ static bool isEmptyFontTag(const Node *node)
 
     const Element *elem = static_cast<const Element *>(node);
     NamedNodeMap *map = elem->attributes(true); // true for read-only
-    return (!map || map->length() == 1) && elem->getAttribute(classAttr) == styleSpanClassString();
+    if (!map)
+        return true;
+    return map->isEmpty() || (map->length() == 1 && elem->getAttribute(classAttr) == styleSpanClassString());
 }
 
 static PassRefPtr<Element> createFontElement(Document* document)
@@ -449,8 +451,8 @@ PassRefPtr<CSSMutableStyleDeclaration> editingStyleAtPosition(Position pos, Shou
 
 void prepareEditingStyleToApplyAt(CSSMutableStyleDeclaration* editingStyle, Position pos)
 {
-    // ReplaceSelectionCommand::handleStyleSpans() requiers that this function only removes the editing style.
-    // If this function was modified in the futureto delete all redundant properties, then add a boolean value to indicate
+    // ReplaceSelectionCommand::handleStyleSpans() requires that this function only removes the editing style.
+    // If this function was modified in the future to delete all redundant properties, then add a boolean value to indicate
     // which one of editingStyleAtPosition or computedStyle is called.
     RefPtr<CSSMutableStyleDeclaration> style = editingStyleAtPosition(pos);
     style->diff(editingStyle);
diff --git a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
index 1617be8eca..fff76a6c71 100644
--- a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
@@ -746,8 +746,9 @@ void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Positi
 {
     // First we clone the outerNode
     
-    RefPtr<Node> lastNode = outerNode->cloneNode(isTableElement(outerNode));
-    appendNode(lastNode, blockElement);
+    RefPtr<Node> topNode = outerNode->cloneNode(isTableElement(outerNode));
+    appendNode(topNode, blockElement);
+    RefPtr<Node> lastNode = topNode;
 
     if (start.node() != outerNode) {
         Vector<RefPtr<Node> > ancestors;
@@ -769,12 +770,23 @@ void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Positi
     // Handle the case of paragraphs with more than one node,
     // cloning all the siblings until end.node() is reached.
     
-    if (start.node() != end.node()) {
-        for (Node* n = start.node()->nextSibling(); n != NULL; n = n->nextSibling()) {
+    if (start.node() != end.node() && !start.node()->isDescendantOf(end.node())) {
+        // If end is not a descendant of outerNode we need to
+        // find the first common ancestor and adjust the insertion
+        // point accordingly.
+        while (!end.node()->isDescendantOf(outerNode)) {
+            outerNode = outerNode->parentNode();
+            topNode = topNode->parentNode();
+        }
+            
+        for (Node* n = start.node()->traverseNextSibling(outerNode); n; n = n->nextSibling()) {
+            if (n->parentNode() != start.node()->parentNode())
+                lastNode = topNode->lastChild();
+
             RefPtr<Node> clonedNode = n->cloneNode(true);
             insertNodeAfter(clonedNode, lastNode);
             lastNode = clonedNode.release();
-            if (n == end.node())
+            if (n == end.node() || end.node()->isDescendantOf(n))
                 break;
         }
     }
@@ -938,6 +950,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     ASSERT(destination.deepEquivalent().node()->inDocument());
 
     cleanupAfterDeletion();
+    ASSERT(destination.deepEquivalent().node()->inDocument());
 
     // Add a br if pruning an empty block level element caused a collapse. For example:
     // foo^
@@ -959,6 +972,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     destinationIndex = TextIterator::rangeLength(startToDestinationRange.get(), true);
     
     setEndingSelection(destination);
+    ASSERT(endingSelection().isCaretOrRange());
     applyCommandToComposite(ReplaceSelectionCommand::create(document(), fragment, true, false, !preserveStyle, false, true));
     
     // If the selection is in an empty paragraph, restore styles from the old empty paragraph to the new empty paragraph.
@@ -1078,7 +1092,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     
     Position caretPos(caret.deepEquivalent());
     // A line break is either a br or a preserved newline.
-    ASSERT(caretPos.node()->hasTagName(brTag) || caretPos.node()->isTextNode() && caretPos.node()->renderer()->style()->preserveNewline());
+    ASSERT(caretPos.node()->hasTagName(brTag) || (caretPos.node()->isTextNode() && caretPos.node()->renderer()->style()->preserveNewline()));
     
     if (caretPos.node()->hasTagName(brTag)) {
         Position beforeBR(positionInParentBeforeNode(caretPos.node()));
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp
index c154426689..d999f84cdb 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp
@@ -66,7 +66,7 @@ static bool isDeletableElement(const Node* node)
     if (!node || !node->isHTMLElement() || !node->inDocument() || !node->isContentEditable())
         return false;
 
-    // In general we want to only draw the UI arround object of a certain area, but we still keep the min width/height to
+    // In general we want to only draw the UI around object of a certain area, but we still keep the min width/height to
     // make sure we don't end up with very thin or very short elements getting the UI.
     const int minimumArea = 2500;
     const int minimumWidth = 48;
@@ -187,7 +187,7 @@ void DeleteButtonController::respondToChangedSelection(const VisibleSelection& o
 void DeleteButtonController::createDeletionUI()
 {
     RefPtr<HTMLDivElement> container = new HTMLDivElement(divTag, m_target->document());
-    container->setAttribute(idAttr, containerElementIdentifier);
+    container->setAttribute(container->idAttributeName(), containerElementIdentifier);
 
     CSSMutableStyleDeclaration* style = container->getInlineStyleDecl();
     style->setProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
@@ -202,7 +202,7 @@ void DeleteButtonController::createDeletionUI()
     style->setProperty(CSSPropertyLeft, "0");
 
     RefPtr<HTMLDivElement> outline = new HTMLDivElement(divTag, m_target->document());
-    outline->setAttribute(idAttr, outlineElementIdentifier);
+    outline->setAttribute(outline->idAttributeName(), outlineElementIdentifier);
 
     const int borderWidth = 4;
     const int borderRadius = 6;
@@ -225,7 +225,7 @@ void DeleteButtonController::createDeletionUI()
         return;
 
     RefPtr<DeleteButton> button = new DeleteButton(m_target->document());
-    button->setAttribute(idAttr, buttonElementIdentifier);
+    button->setAttribute(button->idAttributeName(), buttonElementIdentifier);
 
     const int buttonWidth = 30;
     const int buttonHeight = 30;
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h
index 713ae8bccb..1286c075a5 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h
@@ -36,7 +36,7 @@ class HTMLElement;
 class RenderObject;
 class VisibleSelection;
 
-class DeleteButtonController {
+class DeleteButtonController : public Noncopyable {
 public:
     DeleteButtonController(Frame*);
 
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteFromTextNodeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/DeleteFromTextNodeCommand.cpp
index e942fef357..f1d79af4aa 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteFromTextNodeCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteFromTextNodeCommand.cpp
@@ -45,6 +45,9 @@ void DeleteFromTextNodeCommand::doApply()
 {
     ASSERT(m_node);
 
+    if (!m_node->isContentEditable())
+        return;
+
     ExceptionCode ec = 0;
     m_text = m_node->substringData(m_offset, m_count, ec);
     if (ec)
@@ -57,6 +60,9 @@ void DeleteFromTextNodeCommand::doUnapply()
 {
     ASSERT(m_node);
 
+    if (!m_node->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_node->insertData(m_offset, m_text, ec);
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp
index fbb5aea13a..5e81d50554 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp
@@ -121,7 +121,7 @@ void DeleteSelectionCommand::initializeStartEnd(Position& start, Position& end)
     else if (end.node()->hasTagName(hrTag))
         end = Position(end.node(), 1);
     
-    // FIXME: This is only used so that moveParagraphs can avoid the bugs in special element expanion.
+    // FIXME: This is only used so that moveParagraphs can avoid the bugs in special element expansion.
     if (!m_expandForSpecialElements)
         return;
     
@@ -161,6 +161,20 @@ void DeleteSelectionCommand::initializeStartEnd(Position& start, Position& end)
     }
 }
 
+void DeleteSelectionCommand::setStartingSelectionOnSmartDelete(const Position& start, const Position& end)
+{
+    VisiblePosition newBase;
+    VisiblePosition newExtent;
+    if (startingSelection().isBaseFirst()) {
+        newBase = start;
+        newExtent = end;
+    } else {
+        newBase = end;
+        newExtent = start;        
+    }
+    setStartingSelection(VisibleSelection(newBase, newExtent));            
+}
+    
 void DeleteSelectionCommand::initializePositionData()
 {
     Position start, end;
@@ -230,6 +244,8 @@ void DeleteSelectionCommand::initializePositionData()
             m_upstreamStart = pos.upstream();
             m_downstreamStart = pos.downstream();
             m_leadingWhitespace = m_upstreamStart.leadingWhitespacePosition(visiblePos.affinity());
+
+            setStartingSelectionOnSmartDelete(m_upstreamStart, m_upstreamEnd);
         }
         
         // trailing whitespace is only considered for smart delete if there is no leading
@@ -241,6 +257,8 @@ void DeleteSelectionCommand::initializePositionData()
             m_upstreamEnd = pos.upstream();
             m_downstreamEnd = pos.downstream();
             m_trailingWhitespace = m_downstreamEnd.trailingWhitespacePosition(VP_DEFAULT_AFFINITY);
+
+            setStartingSelectionOnSmartDelete(m_downstreamStart, m_downstreamEnd);
         }
     }
     
@@ -589,9 +607,18 @@ void DeleteSelectionCommand::mergeParagraphs()
     // The rule for merging into an empty block is: only do so if its farther to the right.
     // FIXME: Consider RTL.
     if (!m_startsAtEmptyLine && isStartOfParagraph(mergeDestination) && startOfParagraphToMove.absoluteCaretBounds().x() > mergeDestination.absoluteCaretBounds().x()) {
-        ASSERT(mergeDestination.deepEquivalent().downstream().node()->hasTagName(brTag));
-        removeNodeAndPruneAncestors(mergeDestination.deepEquivalent().downstream().node());
-        m_endingPosition = startOfParagraphToMove.deepEquivalent();
+        if (mergeDestination.deepEquivalent().downstream().node()->hasTagName(brTag)) {
+            removeNodeAndPruneAncestors(mergeDestination.deepEquivalent().downstream().node());
+            m_endingPosition = startOfParagraphToMove.deepEquivalent();
+            return;
+        }
+    }
+    
+    // Block images, tables and horizontal rules cannot be made inline with content at mergeDestination.  If there is 
+    // any (!isStartOfParagraph(mergeDestination)), don't merge, just move the caret to just before the selection we deleted.
+    // See https://bugs.webkit.org/show_bug.cgi?id=25439
+    if (isRenderedAsNonInlineTableImageOrHR(startOfParagraphToMove.deepEquivalent().node()) && !isStartOfParagraph(mergeDestination)) {
+        m_endingPosition = m_upstreamStart;
         return;
     }
     
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h
index c8872efd44..20f52f499c 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h
@@ -51,6 +51,7 @@ private:
     virtual bool preservesTypingStyle() const;
 
     void initializeStartEnd(Position&, Position&);
+    void setStartingSelectionOnSmartDelete(const Position&, const Position&);
     void initializePositionData();
     void saveTypingStyleState();
     void insertPlaceholderForAncestorBlockContent();
diff --git a/src/3rdparty/webkit/WebCore/editing/Editor.cpp b/src/3rdparty/webkit/WebCore/editing/Editor.cpp
index 3f3f736ec7..1061dd2d04 100644
--- a/src/3rdparty/webkit/WebCore/editing/Editor.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/Editor.cpp
@@ -30,6 +30,7 @@
 #include "AXObjectCache.h"
 #include "ApplyStyleCommand.h"
 #include "CharacterNames.h"
+#include "CompositionEvent.h"
 #include "CreateLinkCommand.h"
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSMutableStyleDeclaration.h"
@@ -831,7 +832,7 @@ TriState Editor::selectionHasStyle(CSSStyleDeclaration* style) const
                 TriState nodeState = triStateOfStyleInComputedStyle(style, nodeStyle.get(), !node->isTextNode());
                 if (node == m_frame->selection()->start().node())
                     state = nodeState;
-                else if (state != nodeState) {
+                else if (state != nodeState && node->isTextNode()) {
                     state = MixedTriState;
                     break;
                 }
@@ -1013,7 +1014,10 @@ void Editor::cut()
     }
     RefPtr<Range> selection = selectedRange();
     if (shouldDeleteRange(selection.get())) {
-        Pasteboard::generalPasteboard()->writeSelection(selection.get(), canSmartCopyOrDelete(), m_frame);
+        if (isNodeInTextFormControl(m_frame->selection()->start().node()))
+            Pasteboard::generalPasteboard()->writePlainText(m_frame->selectedText());
+        else
+            Pasteboard::generalPasteboard()->writeSelection(selection.get(), canSmartCopyOrDelete(), m_frame);
         didWriteSelectionToPasteboard();
         deleteSelectionWithSmartDelete(canSmartCopyOrDelete());
     }
@@ -1027,13 +1031,17 @@ void Editor::copy()
         systemBeep();
         return;
     }
-    
-    Document* document = m_frame->document();
-    if (HTMLImageElement* imageElement = imageElementFromImageDocument(document))
-        Pasteboard::generalPasteboard()->writeImage(imageElement, document->url(), document->title());
-    else
-        Pasteboard::generalPasteboard()->writeSelection(selectedRange().get(), canSmartCopyOrDelete(), m_frame);
-    
+
+    if (isNodeInTextFormControl(m_frame->selection()->start().node()))
+        Pasteboard::generalPasteboard()->writePlainText(m_frame->selectedText());
+    else {
+        Document* document = m_frame->document();
+        if (HTMLImageElement* imageElement = imageElementFromImageDocument(document))
+            Pasteboard::generalPasteboard()->writeImage(imageElement, document->url(), document->title());
+        else
+            Pasteboard::generalPasteboard()->writeSelection(selectedRange().get(), canSmartCopyOrDelete(), m_frame);
+    }
+
     didWriteSelectionToPasteboard();
 }
 
@@ -1059,6 +1067,8 @@ void Editor::paste()
 
 void Editor::pasteAsPlainText()
 {
+    if (tryDHTMLPaste())
+        return;
     if (!canPaste())
         return;
     pasteAsPlainTextWithPasteboard(Pasteboard::generalPasteboard());
@@ -1353,6 +1363,16 @@ void Editor::confirmComposition(const String& text, bool preserveSelection)
         return;
     }
     
+    // Dispatch a compositionend event to the focused node.
+    // We should send this event before sending a TextEvent as written in Section 6.2.2 and 6.2.3 of
+    // the DOM Event specification.
+    Node* target = m_frame->document()->focusedNode();
+    if (target) {
+        RefPtr<CompositionEvent> event = CompositionEvent::create(eventNames().compositionendEvent, m_frame->domWindow(), text);
+        ExceptionCode ec = 0;
+        target->dispatchEvent(event, ec);
+    }
+
     // If text is empty, then delete the old composition here.  If text is non-empty, InsertTextCommand::input
     // will delete the old composition with an optimized replace operation.
     if (text.isEmpty())
@@ -1363,8 +1383,11 @@ void Editor::confirmComposition(const String& text, bool preserveSelection)
 
     insertText(text, 0);
 
-    if (preserveSelection)
+    if (preserveSelection) {
         m_frame->selection()->setSelection(oldSelection, false, false);
+        // An open typing command that disagrees about current selection would cause issues with typing later on.
+        TypingCommand::closeTyping(m_lastEditCommand.get());
+    }
 
     setIgnoreCompositionSelectionChange(false);
 }
@@ -1379,7 +1402,38 @@ void Editor::setComposition(const String& text, const Vector<CompositionUnderlin
         setIgnoreCompositionSelectionChange(false);
         return;
     }
-    
+
+    Node* target = m_frame->document()->focusedNode();
+    if (target) {
+        // Dispatch an appropriate composition event to the focused node.
+        // We check the composition status and choose an appropriate composition event since this
+        // function is used for three purposes:
+        // 1. Starting a new composition.
+        //    Send a compositionstart event when this function creates a new composition node, i.e.
+        //    m_compositionNode == 0 && !text.isEmpty().
+        // 2. Updating the existing composition node.
+        //    Send a compositionupdate event when this function updates the existing composition
+        //    node, i.e. m_compositionNode != 0 && !text.isEmpty().
+        // 3. Canceling the ongoing composition.
+        //    Send a compositionend event when function deletes the existing composition node, i.e.
+        //    m_compositionNode != 0 && test.isEmpty().
+        RefPtr<CompositionEvent> event;
+        if (!m_compositionNode) {
+            // We should send a compositionstart event only when the given text is not empty because this
+            // function doesn't create a composition node when the text is empty.
+            if (!text.isEmpty())
+                event = CompositionEvent::create(eventNames().compositionstartEvent, m_frame->domWindow(), text);
+        } else {
+            if (!text.isEmpty())
+                event = CompositionEvent::create(eventNames().compositionupdateEvent, m_frame->domWindow(), text);
+            else
+              event = CompositionEvent::create(eventNames().compositionendEvent, m_frame->domWindow(), text);
+        }
+        ExceptionCode ec = 0;
+        if (event.get())
+            target->dispatchEvent(event, ec);
+    }
+
     // If text is empty, then delete the old composition here.  If text is non-empty, InsertTextCommand::input
     // will delete the old composition with an optimized replace operation.
     if (text.isEmpty())
@@ -1438,7 +1492,7 @@ void Editor::learnSpelling()
     if (!client())
         return;
         
-    // FIXME: We don't call this on the Mac, and it should remove misppelling markers around the 
+    // FIXME: We don't call this on the Mac, and it should remove misspelling markers around the 
     // learned word, see <rdar://problem/5396072>.
 
     String text = frame()->selectedText();
@@ -1754,8 +1808,9 @@ static String findFirstMisspellingOrBadGrammarInRange(EditorClient* client, Rang
         }
         if (lastIteration || totalLengthProcessed + currentLength >= totalRangeLength)
             break;
-        setStart(paragraphRange.get(), startOfNextParagraph(paragraphRange->endPosition()));
-        setEnd(paragraphRange.get(), endOfParagraph(paragraphRange->startPosition()));
+        VisiblePosition newParagraphStart = startOfNextParagraph(paragraphRange->endPosition());
+        setStart(paragraphRange.get(), newParagraphStart);
+        setEnd(paragraphRange.get(), endOfParagraph(newParagraphStart));
         firstIteration = false;
         totalLengthProcessed += currentLength;
     }
@@ -2693,6 +2748,9 @@ bool Editor::insideVisibleArea(const IntPoint& point) const
         return true;
     
     RenderPart* renderer = frame->ownerRenderer();
+    if (!renderer)
+        return false;
+
     RenderBlock* container = renderer->containingBlock();
     if (!(container->style()->overflowX() == OHIDDEN || container->style()->overflowY() == OHIDDEN))
         return true;
@@ -2719,6 +2777,9 @@ bool Editor::insideVisibleArea(Range* range) const
         return true;
     
     RenderPart* renderer = frame->ownerRenderer();
+    if (!renderer)
+        return false;
+
     RenderBlock* container = renderer->containingBlock();
     if (!(container->style()->overflowX() == OHIDDEN || container->style()->overflowY() == OHIDDEN))
         return true;
diff --git a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
index 3379b3c12f..34fa46d2e8 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
@@ -32,6 +32,7 @@
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "Chrome.h"
 #include "CreateLinkCommand.h"
 #include "DocumentFragment.h"
 #include "Editor.h"
@@ -256,10 +257,10 @@ static int verticalScrollDistance(Frame* frame)
     RenderStyle* style = renderer->style();
     if (!style)
         return 0;
-    if (!(style->overflowY() == OSCROLL || style->overflowY() == OAUTO || renderer->isTextArea()))
+    if (!(style->overflowY() == OSCROLL || style->overflowY() == OAUTO || focusedNode->isContentEditable()))
         return 0;
     int height = toRenderBox(renderer)->clientHeight();
-    return max((height + 1) / 2, height - cAmountToKeepWhenPaging);
+    return max(max<int>(height * Scrollbar::minFractionToStepWhenPaging(), height - Scrollbar::maxOverlapBetweenPages()), 1);
 }
 
 static RefPtr<Range> unionDOMRanges(Range* a, Range* b)
@@ -471,7 +472,7 @@ static bool executeInsertHorizontalRule(Frame* frame, Event*, EditorCommandSourc
 {
     RefPtr<HTMLHRElement> hr = new HTMLHRElement(hrTag, frame->document());
     if (!value.isEmpty())
-        hr->setAttribute(idAttr, value);
+        hr->setAttribute(hr->idAttributeName(), value);
     return executeInsertNode(frame, hr.release());
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
index 808a2f8ef3..0f3975b0c1 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
@@ -76,7 +76,12 @@ bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCu
         return false;
 
     // Find the list item enclosing the current paragraph
-    Element* selectedListItem = static_cast<Element*>(enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()));
+    Element* selectedListItem = static_cast<Element*>(enclosingBlock(lastNodeInSelectedParagraph));
+    // FIXME: enclosingBlock shouldn't return the passed in element.  See the
+    // comment on the function about how to fix rather than having to adjust here.
+    if (selectedListItem == lastNodeInSelectedParagraph)
+        selectedListItem = static_cast<Element*>(enclosingBlock(lastNodeInSelectedParagraph->parentNode()));
+
     // FIXME: we need to deal with the case where there is no li (malformed HTML)
     if (!selectedListItem->hasTagName(liTag))
         return false;
@@ -129,17 +134,8 @@ void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& endOfCurr
         targetBlockquote = 0;
 }
 
-void IndentOutdentCommand::indentRegion()
+void IndentOutdentCommand::indentRegion(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection)
 {
-    VisibleSelection selection = selectionForParagraphIteration(endingSelection());
-    VisiblePosition startOfSelection = selection.visibleStart();
-    VisiblePosition endOfSelection = selection.visibleEnd();
-    int startIndex = indexForVisiblePosition(startOfSelection);
-    int endIndex = indexForVisiblePosition(endOfSelection);
-
-    ASSERT(!startOfSelection.isNull());
-    ASSERT(!endOfSelection.isNull());
-
     // Special case empty unsplittable elements because there's nothing to split
     // and there's nothing to move.
     Position start = startOfSelection.deepEquivalent().downstream();
@@ -162,6 +158,12 @@ void IndentOutdentCommand::indentRegion()
             blockquoteForNextIndent = 0;
         else
             indentIntoBlockquote(endOfCurrentParagraph, endOfNextParagraph, blockquoteForNextIndent);
+
+        // indentIntoBlockquote could move more than one paragraph if the paragraph
+        // is in a list item or a table. As a result, endAfterSelection could refer to a position
+        // no longer in the document.
+        if (endAfterSelection.isNotNull() && !endAfterSelection.deepEquivalent().node()->inDocument())
+            break;
         // Sanity check: Make sure our moveParagraph calls didn't remove endOfNextParagraph.deepEquivalent().node()
         // If somehow we did, return to prevent crashes.
         if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
@@ -169,14 +171,7 @@ void IndentOutdentCommand::indentRegion()
             return;
         }
         endOfCurrentParagraph = endOfNextParagraph;
-    }
-    
-    updateLayout();
-    
-    RefPtr<Range> startRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, 0, true);
-    RefPtr<Range> endRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endIndex, 0, true);
-    if (startRange && endRange)
-        setEndingSelection(VisibleSelection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
+    }   
 }
 
 void IndentOutdentCommand::outdentParagraph()
@@ -242,36 +237,40 @@ void IndentOutdentCommand::outdentParagraph()
     moveParagraph(startOfParagraph(visibleStartOfParagraph), endOfParagraph(visibleEndOfParagraph), VisiblePosition(Position(placeholder.get(), 0)), true);
 }
 
-void IndentOutdentCommand::outdentRegion()
+void IndentOutdentCommand::outdentRegion(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection)
 {
-    VisiblePosition startOfSelection = endingSelection().visibleStart();
-    VisiblePosition endOfSelection = endingSelection().visibleEnd();
     VisiblePosition endOfLastParagraph = endOfParagraph(endOfSelection);
 
-    ASSERT(!startOfSelection.isNull());
-    ASSERT(!endOfSelection.isNull());
-
     if (endOfParagraph(startOfSelection) == endOfLastParagraph) {
         outdentParagraph();
         return;
     }
-
+    
     Position originalSelectionEnd = endingSelection().end();
-    setEndingSelection(endingSelection().visibleStart());
-    outdentParagraph();
-    Position originalSelectionStart = endingSelection().start();
-    VisiblePosition endOfCurrentParagraph = endOfParagraph(endOfParagraph(endingSelection().visibleStart()).next(true));
+    VisiblePosition endOfCurrentParagraph = endOfParagraph(startOfSelection);
     VisiblePosition endAfterSelection = endOfParagraph(endOfParagraph(endOfSelection).next());
+
     while (endOfCurrentParagraph != endAfterSelection) {
         VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
         if (endOfCurrentParagraph == endOfLastParagraph)
             setEndingSelection(VisibleSelection(originalSelectionEnd, DOWNSTREAM));
         else
             setEndingSelection(endOfCurrentParagraph);
+        
         outdentParagraph();
+        
+        // outdentParagraph could move more than one paragraph if the paragraph
+        // is in a list item. As a result, endAfterSelection and endOfNextParagraph
+        // could refer to positions no longer in the document.
+        if (endAfterSelection.isNotNull() && !endAfterSelection.deepEquivalent().node()->inDocument())
+            break;
+            
+        if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
+            endOfCurrentParagraph = endingSelection().end();
+            endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
+        }
         endOfCurrentParagraph = endOfNextParagraph;
     }
-    setEndingSelection(VisibleSelection(originalSelectionStart, endingSelection().end(), DOWNSTREAM));
 }
 
 void IndentOutdentCommand::doApply()
@@ -295,10 +294,27 @@ void IndentOutdentCommand::doApply()
     if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
         setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
 
+    VisibleSelection selection = selectionForParagraphIteration(endingSelection());
+    VisiblePosition startOfSelection = selection.visibleStart();
+    VisiblePosition endOfSelection = selection.visibleEnd();
+    
+    int startIndex = indexForVisiblePosition(startOfSelection);
+    int endIndex = indexForVisiblePosition(endOfSelection);
+    
+    ASSERT(!startOfSelection.isNull());
+    ASSERT(!endOfSelection.isNull());
+    
     if (m_typeOfAction == Indent)
-        indentRegion();
+        indentRegion(startOfSelection, endOfSelection);
     else
-        outdentRegion();
+        outdentRegion(startOfSelection, endOfSelection);
+
+    updateLayout();
+    
+    RefPtr<Range> startRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, 0, true);
+    RefPtr<Range> endRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endIndex, 0, true);
+    if (startRange && endRange)
+        setEndingSelection(VisibleSelection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
index 817b4c80da..8705bf103c 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
@@ -46,8 +46,8 @@ private:
     virtual void doApply();
     virtual EditAction editingAction() const { return m_typeOfAction == Indent ? EditActionIndent : EditActionOutdent; }
 
-    void indentRegion();
-    void outdentRegion();
+    void indentRegion(const VisiblePosition&, const VisiblePosition&);
+    void outdentRegion(const VisiblePosition&, const VisiblePosition&);
     void outdentParagraph();
     bool tryIndentingAsListItem(const VisiblePosition&);
     void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>&);
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertIntoTextNodeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertIntoTextNodeCommand.cpp
index 4905faeb80..9c3423a1dd 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertIntoTextNodeCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertIntoTextNodeCommand.cpp
@@ -43,12 +43,18 @@ InsertIntoTextNodeCommand::InsertIntoTextNodeCommand(PassRefPtr<Text> node, unsi
 
 void InsertIntoTextNodeCommand::doApply()
 {
+    if (!m_node->isContentEditable())
+        return;
+    
     ExceptionCode ec;
     m_node->insertData(m_offset, m_text, ec);
 }
 
 void InsertIntoTextNodeCommand::doUnapply()
 {
+    if (!m_node->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_node->deleteData(m_offset, m_text.length(), ec);
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertNodeBeforeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertNodeBeforeCommand.cpp
index 4f6096332f..2ce98464a1 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertNodeBeforeCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertNodeBeforeCommand.cpp
@@ -46,7 +46,7 @@ InsertNodeBeforeCommand::InsertNodeBeforeCommand(PassRefPtr<Node> insertChild, P
 void InsertNodeBeforeCommand::doApply()
 {
     Node* parent = m_refChild->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec;
@@ -55,6 +55,9 @@ void InsertNodeBeforeCommand::doApply()
 
 void InsertNodeBeforeCommand::doUnapply()
 {
+    if (!m_insertChild->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_insertChild->remove(ec);
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
index 695f46a974..058b961a80 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
@@ -44,6 +44,22 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+// When inserting a new line, we want to avoid nesting empty divs if we can.  Otherwise, when
+// pasting, it's easy to have each new line be a div deeper than the previous.  E.g., in the case
+// below, we want to insert at ^ instead of |.
+// <div>foo<div>bar</div>|</div>^
+static Element* highestVisuallyEquivalentDiv(Element* startBlock)
+{
+    Element* curBlock = startBlock;
+    while (!curBlock->nextSibling() && curBlock->parentElement()->hasTagName(divTag)) {
+        NamedNodeMap* attributes = curBlock->parentElement()->attributes(true);
+        if (attributes && !attributes->isEmpty())
+            break;
+        curBlock = curBlock->parentElement();
+    }
+    return curBlock;
+}
+
 InsertParagraphSeparatorCommand::InsertParagraphSeparatorCommand(Document *document, bool mustUseDefaultParagraphElement) 
     : CompositeEditCommand(document)
     , m_mustUseDefaultParagraphElement(mustUseDefaultParagraphElement)
@@ -214,7 +230,13 @@ void InsertParagraphSeparatorCommand::doApply()
                 // When inserting the newline after the blockquote, we don't want to apply the original style after the insertion
                 shouldApplyStyleAfterInsertion = false;
             }
-            insertNodeAfter(blockToInsert, startBlock);
+
+            // Most of the time we want to stay at the nesting level of the startBlock (e.g., when nesting within lists).  However,
+            // for div nodes, this can result in nested div tags that are hard to break out of.
+            Element* siblingNode = startBlock;
+            if (blockToInsert->hasTagName(divTag))
+                siblingNode = highestVisuallyEquivalentDiv(startBlock);
+            insertNodeAfter(blockToInsert, siblingNode);
         }
 
         // Recreate the same structure in the new paragraph.
diff --git a/src/3rdparty/webkit/WebCore/editing/JoinTextNodesCommand.cpp b/src/3rdparty/webkit/WebCore/editing/JoinTextNodesCommand.cpp
index f981481074..fa0987db61 100644
--- a/src/3rdparty/webkit/WebCore/editing/JoinTextNodesCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/JoinTextNodesCommand.cpp
@@ -45,6 +45,10 @@ void JoinTextNodesCommand::doApply()
     if (m_text1->nextSibling() != m_text2)
         return;
 
+    Node* parent = m_text2->parentNode();
+    if (!parent || !parent->isContentEditable())
+        return;
+    
     ExceptionCode ec = 0;
     m_text2->insertData(0, m_text1->data(), ec);
     if (ec)
@@ -59,7 +63,7 @@ void JoinTextNodesCommand::doUnapply()
         return;
 
     Node* parent = m_text2->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec = 0;
diff --git a/src/3rdparty/webkit/WebCore/editing/MergeIdenticalElementsCommand.cpp b/src/3rdparty/webkit/WebCore/editing/MergeIdenticalElementsCommand.cpp
index 99ba286dbd..f56f726fa3 100644
--- a/src/3rdparty/webkit/WebCore/editing/MergeIdenticalElementsCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/MergeIdenticalElementsCommand.cpp
@@ -42,7 +42,7 @@ MergeIdenticalElementsCommand::MergeIdenticalElementsCommand(PassRefPtr<Element>
 
 void MergeIdenticalElementsCommand::doApply()
 {
-    if (m_element1->nextSibling() != m_element2)
+    if (m_element1->nextSibling() != m_element2 || !m_element1->isContentEditable() || !m_element2->isContentEditable())
         return;
 
     m_atChild = m_element2->firstChild();
@@ -68,7 +68,7 @@ void MergeIdenticalElementsCommand::doUnapply()
     RefPtr<Node> atChild = m_atChild.release();
 
     Node* parent = m_element2->parent();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec = 0;
diff --git a/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp
index 0a2d3f4b0a..62f638fb36 100644
--- a/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp
@@ -31,8 +31,8 @@
 
 namespace WebCore {
 
-MoveSelectionCommand::MoveSelectionCommand(PassRefPtr<DocumentFragment> fragment, const Position& position, bool smartMove) 
-    : CompositeEditCommand(position.node()->document()), m_fragment(fragment), m_position(position), m_smartMove(smartMove)
+MoveSelectionCommand::MoveSelectionCommand(PassRefPtr<DocumentFragment> fragment, const Position& position, bool smartInsert, bool smartDelete) 
+    : CompositeEditCommand(position.node()->document()), m_fragment(fragment), m_position(position), m_smartInsert(smartInsert), m_smartDelete(smartDelete)
 {
     ASSERT(m_fragment);
 }
@@ -60,7 +60,7 @@ void MoveSelectionCommand::doApply()
         pos = Position(positionNode, positionOffset);
     }
 
-    deleteSelection(m_smartMove);
+    deleteSelection(m_smartDelete);
 
     // If the node for the destination has been removed as a result of the deletion,
     // set the destination to the ending point after the deletion.
@@ -74,7 +74,7 @@ void MoveSelectionCommand::doApply()
         // Document was modified out from under us.
         return;
     }
-    applyCommandToComposite(ReplaceSelectionCommand::create(positionNode->document(), m_fragment, true, m_smartMove));
+    applyCommandToComposite(ReplaceSelectionCommand::create(positionNode->document(), m_fragment, true, m_smartInsert));
 }
 
 EditAction MoveSelectionCommand::editingAction() const
diff --git a/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.h b/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.h
index 253c02c2d1..6780caa425 100644
--- a/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.h
@@ -34,20 +34,21 @@ class DocumentFragment;
 
 class MoveSelectionCommand : public CompositeEditCommand {
 public:
-    static PassRefPtr<MoveSelectionCommand> create(PassRefPtr<DocumentFragment> fragment, const Position& position, bool smartMove = false)
+    static PassRefPtr<MoveSelectionCommand> create(PassRefPtr<DocumentFragment> fragment, const Position& position, bool smartInsert = false, bool smartDelete = false)
     {
-        return adoptRef(new MoveSelectionCommand(fragment, position, smartMove));
+        return adoptRef(new MoveSelectionCommand(fragment, position, smartInsert, smartDelete));
     }
 
 private:
-    MoveSelectionCommand(PassRefPtr<DocumentFragment>, const Position&, bool smartMove);
+    MoveSelectionCommand(PassRefPtr<DocumentFragment>, const Position&, bool smartInsert, bool smartDelete);
 
     virtual void doApply();
     virtual EditAction editingAction() const;
     
     RefPtr<DocumentFragment> m_fragment;
     Position m_position;
-    bool m_smartMove;
+    bool m_smartInsert;
+    bool m_smartDelete;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/RemoveNodeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/RemoveNodeCommand.cpp
index 62a36be0ff..f6d6a4b4c1 100644
--- a/src/3rdparty/webkit/WebCore/editing/RemoveNodeCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/RemoveNodeCommand.cpp
@@ -42,7 +42,7 @@ RemoveNodeCommand::RemoveNodeCommand(PassRefPtr<Node> node)
 void RemoveNodeCommand::doApply()
 {
     Node* parent = m_node->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     m_parent = parent;
@@ -56,7 +56,7 @@ void RemoveNodeCommand::doUnapply()
 {
     RefPtr<Node> parent = m_parent.release();
     RefPtr<Node> refChild = m_refChild.release();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec;
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
index b40dab2453..e4acf850db 100644
--- a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -104,6 +104,22 @@ static bool isInterchangeConvertedSpaceSpan(const Node *node)
            static_cast<const HTMLElement *>(node)->getAttribute(classAttr) == convertedSpaceSpanClassString;
 }
 
+static Position positionAvoidingPrecedingNodes(Position pos)
+{
+    // If we're already on a break, it's probably a placeholder and we shouldn't change our position.
+    if (pos.node()->hasTagName(brTag))
+        return pos;
+
+    // We also stop when changing block flow elements because even though the visual position is the
+    // same.  E.g.,
+    //   <div>foo^</div>^
+    // The two positions above are the same visual position, but we want to stay in the same block.
+    Node* stopNode = pos.node()->enclosingBlockFlowElement();
+    while (stopNode != pos.node() && VisiblePosition(pos) == VisiblePosition(pos.next()))
+        pos = pos.next();
+    return pos;
+}
+
 ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* fragment, bool matchStyle, const VisibleSelection& selection)
     : m_document(document),
       m_fragment(fragment),
@@ -468,6 +484,17 @@ void ReplaceSelectionCommand::negateStyleRulesThatAffectAppearance()
                 e->getInlineStyleDecl()->setProperty(CSSPropertyDisplay, CSSValueInline);
             if (e->renderer() && e->renderer()->style()->floating() != FNONE)
                 e->getInlineStyleDecl()->setProperty(CSSPropertyFloat, CSSValueNone);
+
+            // Undo the effects of page zoom if we have an absolute font size.  When we copy, we
+            // compute the new font size as an absolute size so pasting will cause the zoom to be
+            // applied twice.
+            if (e->renderer() && e->renderer()->style() && e->renderer()->style()->effectiveZoom() != 1.0
+                && e->renderer()->style()->fontDescription().isAbsoluteSize()) {
+                float newSize = e->renderer()->style()->fontDescription().specifiedSize() / e->renderer()->style()->effectiveZoom();
+                ExceptionCode ec = 0;
+                e->style()->setProperty(CSSPropertyFontSize, String::number(newSize), false, ec);
+                ASSERT(!ec);
+            }
         }
         if (node == m_lastLeafInserted)
             break;
@@ -638,10 +665,11 @@ void ReplaceSelectionCommand::handleStyleSpans()
     }
     
     // There are non-redundant styles on sourceDocumentStyleSpan, but there is no
-    // copiedRangeStyleSpan.  Clear the redundant styles from sourceDocumentStyleSpan
-    // and return.
+    // copiedRangeStyleSpan.  Remove the span, because it could be surrounding block elements,
+    // and apply the styles to its children.
     if (sourceDocumentStyle->length() > 0 && !copiedRangeStyleSpan) {
-        setNodeAttribute(static_cast<Element*>(sourceDocumentStyleSpan), styleAttr, sourceDocumentStyle->cssText());
+        copyStyleToChildren(sourceDocumentStyleSpan, sourceDocumentStyle.get()); 
+        removeNodePreservingChildren(sourceDocumentStyleSpan);
         return;
     }
     
@@ -673,6 +701,34 @@ void ReplaceSelectionCommand::handleStyleSpans()
     setNodeAttribute(static_cast<Element*>(copiedRangeStyleSpan), styleAttr, copiedRangeStyle->cssText());
 }
 
+// Take the style attribute of a span and apply it to it's children instead.  This allows us to
+// convert invalid HTML where a span contains block elements into valid HTML while preserving
+// styles.
+void ReplaceSelectionCommand::copyStyleToChildren(Node* parentNode, const CSSMutableStyleDeclaration* parentStyle)
+{
+    ASSERT(parentNode->hasTagName(spanTag));
+    for (Node* childNode = parentNode->firstChild(); childNode; childNode = childNode->nextSibling()) {
+        if (childNode->isTextNode() || !isBlock(childNode) || childNode->hasTagName(preTag)) {
+            // In this case, put a span tag around the child node.
+            RefPtr<Node> newSpan = parentNode->cloneNode(false);
+            setNodeAttribute(static_cast<Element*>(newSpan.get()), styleAttr, parentStyle->cssText());
+            insertNodeAfter(newSpan, childNode);
+            ExceptionCode ec = 0;
+            newSpan->appendChild(childNode, ec);
+            ASSERT(!ec);
+            childNode = newSpan.get();
+        } else if (childNode->isHTMLElement()) {
+            // Copy the style attribute and merge them into the child node.  We don't want to override
+            // existing styles, so don't clobber on merge.
+            RefPtr<CSSMutableStyleDeclaration> newStyle = parentStyle->copy();
+            HTMLElement* childElement = static_cast<HTMLElement*>(childNode);
+            RefPtr<CSSMutableStyleDeclaration> existingStyles = childElement->getInlineStyleDecl()->copy();
+            existingStyles->merge(newStyle.get(), false);
+            setNodeAttribute(childElement, styleAttr, existingStyles->cssText());
+        }
+    }
+}
+
 void ReplaceSelectionCommand::mergeEndIfNeeded()
 {
     if (!m_shouldMergeEnd)
@@ -752,9 +808,7 @@ void ReplaceSelectionCommand::doApply()
     bool startIsInsideMailBlockquote = nearestMailBlockquote(insertionPos.node());
     
     if ((selectionStartWasStartOfParagraph && selectionEndWasEndOfParagraph && !startIsInsideMailBlockquote) ||
-        startBlock == currentRoot ||
-        (startBlock && startBlock->renderer() && startBlock->renderer()->isListItem()) ||
-        selectionIsPlainText)
+        startBlock == currentRoot || isListItem(startBlock) || selectionIsPlainText)
         m_preventNesting = false;
     
     if (selection.isRange()) {
@@ -847,7 +901,12 @@ void ReplaceSelectionCommand::doApply()
         frame->clearTypingStyle();
     
     bool handledStyleSpans = handleStyleSpansBeforeInsertion(fragment, insertionPos);
-    
+
+    // We don't want the destination to end up inside nodes that weren't selected.  To avoid that, we move the
+    // position forward without changing the visible position so we're still at the same visible location, but
+    // outside of preceding tags.
+    insertionPos = positionAvoidingPrecedingNodes(insertionPos);
+
     // FIXME: When pasting rich content we're often prevented from heading down the fast path by style spans.  Try
     // again here if they've been removed.
     
@@ -871,12 +930,20 @@ void ReplaceSelectionCommand::doApply()
     RefPtr<Node> node = refNode->nextSibling();
     
     fragment.removeNode(refNode);
-    insertNodeAtAndUpdateNodesInserted(refNode, insertionPos);
+
+    Node* blockStart = enclosingBlock(insertionPos.node());
+    if ((isListElement(refNode.get()) || (isStyleSpan(refNode.get()) && isListElement(refNode->firstChild())))
+        && blockStart->renderer()->isListItem())
+        refNode = insertAsListItems(refNode, blockStart, insertionPos);
+    else
+        insertNodeAtAndUpdateNodesInserted(refNode, insertionPos);
 
     // Mutation events (bug 22634) may have already removed the inserted content
     if (!refNode->inDocument())
         return;
 
+    bool plainTextFragment = isPlainTextMarkup(refNode.get());
+
     while (node) {
         Node* next = node->nextSibling();
         fragment.removeNode(node);
@@ -887,6 +954,8 @@ void ReplaceSelectionCommand::doApply()
             return;
 
         refNode = node;
+        if (node && plainTextFragment)
+            plainTextFragment = isPlainTextMarkup(node.get());
         node = next;
     }
     
@@ -913,7 +982,7 @@ void ReplaceSelectionCommand::doApply()
     
     bool interchangeNewlineAtEnd = fragment.hasInterchangeNewlineAtEnd();
 
-    if (shouldRemoveEndBR(endBR, originalVisPosBeforeEndBR))
+    if (endBR && (plainTextFragment || shouldRemoveEndBR(endBR, originalVisPosBeforeEndBR)))
         removeNodeAndPruneAncestors(endBR);
     
     // Determine whether or not we should merge the end of inserted content with what's after it before we do
@@ -956,9 +1025,15 @@ void ReplaceSelectionCommand::doApply()
         if (selectionEndWasEndOfParagraph || !isEndOfParagraph(endOfInsertedContent) || next.isNull()) {
             if (!isStartOfParagraph(endOfInsertedContent)) {
                 setEndingSelection(endOfInsertedContent);
-                // Use a default paragraph element (a plain div) for the empty paragraph, using the last paragraph
-                // block's style seems to annoy users.
-                insertParagraphSeparator(true);
+                Node* enclosingNode = enclosingBlock(endOfInsertedContent.deepEquivalent().node());
+                if (isListItem(enclosingNode)) {
+                    RefPtr<Node> newListItem = createListItemElement(document());
+                    insertNodeAfter(newListItem, enclosingNode);
+                    setEndingSelection(VisiblePosition(Position(newListItem, 0)));
+                } else
+                    // Use a default paragraph element (a plain div) for the empty paragraph, using the last paragraph
+                    // block's style seems to annoy users.
+                    insertParagraphSeparator(true);
 
                 // Select up to the paragraph separator that was added.
                 lastPositionToSelect = endingSelection().visibleStart().deepEquivalent();
@@ -1020,6 +1095,11 @@ void ReplaceSelectionCommand::doApply()
         }
     }
     
+    // If we are dealing with a fragment created from plain text
+    // no style matching is necessary.
+    if (plainTextFragment)
+        m_matchStyle = false;
+        
     completeHTMLReplacement(lastPositionToSelect);
 }
 
@@ -1102,6 +1182,47 @@ void ReplaceSelectionCommand::insertNodeBeforeAndUpdateNodesInserted(PassRefPtr<
     updateNodesInserted(nodeToUpdate);
 }
 
+// If the user is inserting a list into an existing list, instead of nesting the list,
+// we put the list items into the existing list.
+Node* ReplaceSelectionCommand::insertAsListItems(PassRefPtr<Node> listElement, Node* insertionBlock, const Position& insertPos)
+{
+    while (listElement->hasChildNodes() && isListElement(listElement->firstChild()) && listElement->childNodeCount() == 1)
+        listElement = listElement->firstChild();
+
+    bool isStart = isStartOfParagraph(insertPos);
+    bool isEnd = isEndOfParagraph(insertPos);
+    bool isMiddle = !isStart && !isEnd;
+    Node* lastNode = insertionBlock;
+
+    // If we're in the middle of a list item, we should split it into two separate
+    // list items and insert these nodes between them.
+    if (isMiddle) {
+        int textNodeOffset = insertPos.offsetInContainerNode();
+        if (insertPos.node()->isTextNode() && textNodeOffset > 0)
+            splitTextNode(static_cast<Text*>(insertPos.node()), textNodeOffset);
+        splitTreeToNode(insertPos.node(), lastNode, true);
+    }
+
+    while (RefPtr<Node> listItem = listElement->firstChild()) {
+        ExceptionCode ec = 0;
+        listElement->removeChild(listItem.get(), ec);
+        ASSERT(!ec);
+        if (isStart || isMiddle)
+            insertNodeBefore(listItem, lastNode);
+        else if (isEnd) {
+            insertNodeAfter(listItem, lastNode);
+            lastNode = listItem.get();
+        } else
+            ASSERT_NOT_REACHED();
+    }
+    if (isStart || isMiddle)
+        lastNode = lastNode->previousSibling();
+    if (isMiddle)
+        insertNodeAfter(createListItemElement(document()), lastNode);
+    updateNodesInserted(lastNode);
+    return lastNode;
+}
+
 void ReplaceSelectionCommand::updateNodesInserted(Node *node)
 {
     if (!node)
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h
index 1cb93c369b..e995e79f61 100644
--- a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h
@@ -54,6 +54,7 @@ private:
     void insertNodeAfterAndUpdateNodesInserted(PassRefPtr<Node> insertChild, Node* refChild);
     void insertNodeAtAndUpdateNodesInserted(PassRefPtr<Node>, const Position&);
     void insertNodeBeforeAndUpdateNodesInserted(PassRefPtr<Node> insertChild, Node* refChild);
+    Node* insertAsListItems(PassRefPtr<Node>, Node* insertionNode, const Position&);
 
     void updateNodesInserted(Node*);
     bool shouldRemoveEndBR(Node*, const VisiblePosition&);
@@ -68,6 +69,7 @@ private:
     
     void negateStyleRulesThatAffectAppearance();
     void handleStyleSpans();
+    void copyStyleToChildren(Node* parentNode, const CSSMutableStyleDeclaration* parentStyle);
     void handlePasteAsQuotationNode();
     
     virtual void removeNodePreservingChildren(Node*);
diff --git a/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp b/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
index 00672f225c..1af4ac3ef2 100644
--- a/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,6 +47,8 @@
 #include "Range.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
+#include "SecureTextInput.h"
+#include "Settings.h"
 #include "TextIterator.h"
 #include "TypingCommand.h"
 #include "htmlediting.h"
@@ -64,12 +66,16 @@ const int NoXPosForVerticalArrowNavigation = INT_MIN;
 SelectionController::SelectionController(Frame* frame, bool isDragCaretController)
     : m_frame(frame)
     , m_xPosForVerticalArrowNavigation(NoXPosForVerticalArrowNavigation)
+    , m_granularity(CharacterGranularity)
+    , m_caretBlinkTimer(this, &SelectionController::caretBlinkTimerFired)
     , m_needsLayout(true)
     , m_absCaretBoundsDirty(true)
     , m_lastChangeWasHorizontalExtension(false)
     , m_isDragCaretController(isDragCaretController)
     , m_isCaretBlinkingSuspended(false)
     , m_focused(frame && frame->page() && frame->page()->focusController()->focusedFrame() == frame)
+    , m_caretVisible(isDragCaretController)
+    , m_caretPaint(true)
 {
 }
 
@@ -99,19 +105,21 @@ void SelectionController::moveTo(const Position &base, const Position &extent, E
     setSelection(VisibleSelection(base, extent, affinity), true, true, userTriggered);
 }
 
-void SelectionController::setSelection(const VisibleSelection& s, bool closeTyping, bool clearTypingStyle, bool userTriggered)
+void SelectionController::setSelection(const VisibleSelection& s, bool closeTyping, bool clearTypingStyle, bool userTriggered, TextGranularity granularity)
 {
+    m_granularity = granularity;
+
     m_lastChangeWasHorizontalExtension = false;
 
     if (m_isDragCaretController) {
         invalidateCaretRect();
-        m_sel = s;
+        m_selection = s;
         m_needsLayout = true;
         invalidateCaretRect();
         return;
     }
     if (!m_frame) {
-        m_sel = s;
+        m_selection = s;
         return;
     }
 
@@ -133,19 +141,20 @@ void SelectionController::setSelection(const VisibleSelection& s, bool closeTypi
     if (clearTypingStyle)
         m_frame->clearTypingStyle();
         
-    if (m_sel == s)
+    if (m_selection == s)
         return;
     
-    VisibleSelection oldSelection = m_sel;
+    VisibleSelection oldSelection = m_selection;
 
-    m_sel = s;
+    m_selection = s;
     
     m_needsLayout = true;
     
     if (!s.isNone())
         m_frame->setFocusedNodeIfNeeded();
     
-    m_frame->selectionLayoutChanged();
+    updateAppearance();
+
     // Always clear the x position used for vertical arrow navigation.
     // It will be restored by the vertical arrow navigation code if necessary.
     m_xPosForVerticalArrowNavigation = NoXPosForVerticalArrowNavigation;
@@ -183,10 +192,10 @@ void SelectionController::nodeWillBeRemoved(Node *node)
     if (node && highestAncestor(node)->nodeType() == Node::DOCUMENT_FRAGMENT_NODE)
         return;
     
-    bool baseRemoved = removingNodeRemovesPosition(node, m_sel.base());
-    bool extentRemoved = removingNodeRemovesPosition(node, m_sel.extent());
-    bool startRemoved = removingNodeRemovesPosition(node, m_sel.start());
-    bool endRemoved = removingNodeRemovesPosition(node, m_sel.end());
+    bool baseRemoved = removingNodeRemovesPosition(node, m_selection.base());
+    bool extentRemoved = removingNodeRemovesPosition(node, m_selection.extent());
+    bool startRemoved = removingNodeRemovesPosition(node, m_selection.start());
+    bool endRemoved = removingNodeRemovesPosition(node, m_selection.end());
     
     bool clearRenderTreeSelection = false;
     bool clearDOMTreeSelection = false;
@@ -200,12 +209,12 @@ void SelectionController::nodeWillBeRemoved(Node *node)
         // Change the base and extent to the start and end, but don't re-validate the
         // selection, since doing so could move the start and end into the node
         // that is about to be removed.
-        if (m_sel.isBaseFirst())
-            m_sel.setWithoutValidation(m_sel.start(), m_sel.end());
+        if (m_selection.isBaseFirst())
+            m_selection.setWithoutValidation(m_selection.start(), m_selection.end());
         else
-            m_sel.setWithoutValidation(m_sel.end(), m_sel.start());
+            m_selection.setWithoutValidation(m_selection.end(), m_selection.start());
     // FIXME: This could be more efficient if we had an isNodeInRange function on Ranges.
-    } else if (comparePositions(m_sel.start(), Position(node, 0)) == -1 && comparePositions(m_sel.end(), Position(node, 0)) == 1) {
+    } else if (comparePositions(m_selection.start(), Position(node, 0)) == -1 && comparePositions(m_selection.end(), Position(node, 0)) == 1) {
         // If we did nothing here, when this node's renderer was destroyed, the rect that it 
         // occupied would be invalidated, but, selection gaps that change as a result of 
         // the removal wouldn't be invalidated.
@@ -214,7 +223,7 @@ void SelectionController::nodeWillBeRemoved(Node *node)
     }
 
     if (clearRenderTreeSelection) {
-        RefPtr<Document> document = m_sel.start().node()->document();
+        RefPtr<Document> document = m_selection.start().node()->document();
         document->updateStyleIfNeeded();
         if (RenderView* view = toRenderView(document->renderer()))
             view->clearSelection();
@@ -231,26 +240,26 @@ void SelectionController::willBeModified(EAlteration alter, EDirection direction
     if (m_lastChangeWasHorizontalExtension)
         return;
 
-    Position start = m_sel.start();
-    Position end = m_sel.end();
+    Position start = m_selection.start();
+    Position end = m_selection.end();
     // FIXME: This is probably not correct for right and left when the direction is RTL.
     switch (direction) {
         case RIGHT:
         case FORWARD:
-            m_sel.setBase(start);
-            m_sel.setExtent(end);
+            m_selection.setBase(start);
+            m_selection.setExtent(end);
             break;
         case LEFT:
         case BACKWARD:
-            m_sel.setBase(end);
-            m_sel.setExtent(start);
+            m_selection.setBase(end);
+            m_selection.setExtent(start);
             break;
     }
 }
 
 TextDirection SelectionController::directionOfEnclosingBlock()
 {
-    Node* n = m_sel.extent().node();
+    Node* n = m_selection.extent().node();
     Node* enclosingBlockNode = enclosingBlock(n);
     if (!enclosingBlockNode)
         return LTR;
@@ -260,9 +269,36 @@ TextDirection SelectionController::directionOfEnclosingBlock()
     return LTR;
 }
 
+VisiblePosition SelectionController::positionForPlatform(bool isGetStart) const
+{
+    Position pos;
+    Settings* settings = m_frame ? m_frame->settings() : 0;
+    if (settings && settings->editingBehavior() == EditingMacBehavior)
+        pos = isGetStart ? m_selection.start() : m_selection.end();
+    else {
+        // Linux and Windows always extend selections from the extent endpoint.
+        // FIXME: VisibleSelection should be fixed to ensure as an invariant that
+        // base/extent always point to the same nodes as start/end, but which points
+        // to which depends on the value of isBaseFirst. Then this can be changed
+        // to just return m_sel.extent().
+        pos = m_selection.isBaseFirst() ? m_selection.end() : m_selection.start();
+    }
+    return VisiblePosition(pos, m_selection.affinity());
+}
+
+VisiblePosition SelectionController::startForPlatform() const
+{
+    return positionForPlatform(true);
+}
+
+VisiblePosition SelectionController::endForPlatform() const
+{
+    return positionForPlatform(false);
+}
+
 VisiblePosition SelectionController::modifyExtendingRight(TextGranularity granularity)
 {
-    VisiblePosition pos(m_sel.extent(), m_sel.affinity());
+    VisiblePosition pos(m_selection.extent(), m_selection.affinity());
 
     // The difference between modifyExtendingRight and modifyExtendingForward is:
     // modifyExtendingForward always extends forward logically.
@@ -293,11 +329,11 @@ VisiblePosition SelectionController::modifyExtendingRight(TextGranularity granul
             pos = modifyExtendingForward(granularity);
     }
     return pos;
-}    
+}
         
 VisiblePosition SelectionController::modifyExtendingForward(TextGranularity granularity)
 {
-    VisiblePosition pos(m_sel.extent(), m_sel.affinity());
+    VisiblePosition pos(m_selection.extent(), m_selection.affinity());
     switch (granularity) {
         case CharacterGranularity:
             pos = pos.next(true);
@@ -315,16 +351,18 @@ VisiblePosition SelectionController::modifyExtendingForward(TextGranularity gran
             pos = nextParagraphPosition(pos, xPosForVerticalArrowNavigation(EXTENT));
             break;
         case SentenceBoundary:
-            pos = endOfSentence(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = endOfSentence(endForPlatform());
             break;
         case LineBoundary:
-            pos = logicalEndOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = endForPlatform();
+            pos.setAffinity(UPSTREAM);
+            pos = logicalEndOfLine(pos);
             break;
         case ParagraphBoundary:
-            pos = endOfParagraph(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = endOfParagraph(endForPlatform());
             break;
         case DocumentBoundary:
-            pos = VisiblePosition(m_sel.end(), m_sel.affinity());
+            pos = endForPlatform();
             if (isEditablePosition(pos.deepEquivalent()))
                 pos = endOfEditableContent(pos);
             else
@@ -341,9 +379,9 @@ VisiblePosition SelectionController::modifyMovingRight(TextGranularity granulari
     switch (granularity) {
         case CharacterGranularity:
             if (isRange()) 
-                pos = VisiblePosition(m_sel.end(), m_sel.affinity());
+                pos = VisiblePosition(m_selection.end(), m_selection.affinity());
             else
-                pos = VisiblePosition(m_sel.extent(), m_sel.affinity()).right(true);
+                pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).right(true);
             break;
         case WordGranularity:
         case SentenceGranularity:
@@ -367,38 +405,38 @@ VisiblePosition SelectionController::modifyMovingForward(TextGranularity granula
     switch (granularity) {
         case CharacterGranularity:
             if (isRange()) 
-                pos = VisiblePosition(m_sel.end(), m_sel.affinity());
+                pos = VisiblePosition(m_selection.end(), m_selection.affinity());
             else
-                pos = VisiblePosition(m_sel.extent(), m_sel.affinity()).next(true);
+                pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).next(true);
             break;
         case WordGranularity:
-            pos = nextWordPosition(VisiblePosition(m_sel.extent(), m_sel.affinity()));
+            pos = nextWordPosition(VisiblePosition(m_selection.extent(), m_selection.affinity()));
             break;
         case SentenceGranularity:
-            pos = nextSentencePosition(VisiblePosition(m_sel.extent(), m_sel.affinity()));
+            pos = nextSentencePosition(VisiblePosition(m_selection.extent(), m_selection.affinity()));
             break;
         case LineGranularity: {
             // down-arrowing from a range selection that ends at the start of a line needs
             // to leave the selection at that line start (no need to call nextLinePosition!)
-            pos = VisiblePosition(m_sel.end(), m_sel.affinity());
+            pos = endForPlatform();
             if (!isRange() || !isStartOfLine(pos))
                 pos = nextLinePosition(pos, xPosForVerticalArrowNavigation(START));
             break;
         }
         case ParagraphGranularity:
-            pos = nextParagraphPosition(VisiblePosition(m_sel.end(), m_sel.affinity()), xPosForVerticalArrowNavigation(START));
+            pos = nextParagraphPosition(endForPlatform(), xPosForVerticalArrowNavigation(START));
             break;
         case SentenceBoundary:
-            pos = endOfSentence(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = endOfSentence(endForPlatform());
             break;
         case LineBoundary:
-            pos = logicalEndOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = logicalEndOfLine(endForPlatform());
             break;
         case ParagraphBoundary:
-            pos = endOfParagraph(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = endOfParagraph(endForPlatform());
             break;
         case DocumentBoundary:
-            pos = VisiblePosition(m_sel.end(), m_sel.affinity());
+            pos = endForPlatform();
             if (isEditablePosition(pos.deepEquivalent()))
                 pos = endOfEditableContent(pos);
             else
@@ -411,7 +449,7 @@ VisiblePosition SelectionController::modifyMovingForward(TextGranularity granula
 
 VisiblePosition SelectionController::modifyExtendingLeft(TextGranularity granularity)
 {
-    VisiblePosition pos(m_sel.extent(), m_sel.affinity());
+    VisiblePosition pos(m_selection.extent(), m_selection.affinity());
 
     // The difference between modifyExtendingLeft and modifyExtendingBackward is:
     // modifyExtendingBackward always extends backward logically.
@@ -445,7 +483,7 @@ VisiblePosition SelectionController::modifyExtendingLeft(TextGranularity granula
        
 VisiblePosition SelectionController::modifyExtendingBackward(TextGranularity granularity)
 {
-    VisiblePosition pos(m_sel.extent(), m_sel.affinity());
+    VisiblePosition pos(m_selection.extent(), m_selection.affinity());
 
     // Extending a selection backward by word or character from just after a table selects
     // the table.  This "makes sense" from the user perspective, esp. when deleting.
@@ -468,16 +506,16 @@ VisiblePosition SelectionController::modifyExtendingBackward(TextGranularity gra
             pos = previousParagraphPosition(pos, xPosForVerticalArrowNavigation(EXTENT));
             break;
         case SentenceBoundary:
-            pos = startOfSentence(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = startOfSentence(startForPlatform());
             break;
         case LineBoundary:
-            pos = logicalStartOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = logicalStartOfLine(startForPlatform());
             break;
         case ParagraphBoundary:
-            pos = startOfParagraph(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = startOfParagraph(startForPlatform());
             break;
         case DocumentBoundary:
-            pos = VisiblePosition(m_sel.start(), m_sel.affinity());
+            pos = startForPlatform();
             if (isEditablePosition(pos.deepEquivalent()))
                 pos = startOfEditableContent(pos);
             else 
@@ -493,9 +531,9 @@ VisiblePosition SelectionController::modifyMovingLeft(TextGranularity granularit
     switch (granularity) {
         case CharacterGranularity:
             if (isRange()) 
-                pos = VisiblePosition(m_sel.start(), m_sel.affinity());
+                pos = VisiblePosition(m_selection.start(), m_selection.affinity());
             else
-                pos = VisiblePosition(m_sel.extent(), m_sel.affinity()).left(true);
+                pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).left(true);
             break;
         case WordGranularity:
         case SentenceGranularity:
@@ -518,33 +556,33 @@ VisiblePosition SelectionController::modifyMovingBackward(TextGranularity granul
     switch (granularity) {
         case CharacterGranularity:
             if (isRange()) 
-                pos = VisiblePosition(m_sel.start(), m_sel.affinity());
+                pos = VisiblePosition(m_selection.start(), m_selection.affinity());
             else
-                pos = VisiblePosition(m_sel.extent(), m_sel.affinity()).previous(true);
+                pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).previous(true);
             break;
         case WordGranularity:
-            pos = previousWordPosition(VisiblePosition(m_sel.extent(), m_sel.affinity()));
+            pos = previousWordPosition(VisiblePosition(m_selection.extent(), m_selection.affinity()));
             break;
         case SentenceGranularity:
-            pos = previousSentencePosition(VisiblePosition(m_sel.extent(), m_sel.affinity()));
+            pos = previousSentencePosition(VisiblePosition(m_selection.extent(), m_selection.affinity()));
             break;
         case LineGranularity:
-            pos = previousLinePosition(VisiblePosition(m_sel.start(), m_sel.affinity()), xPosForVerticalArrowNavigation(START));
+            pos = previousLinePosition(startForPlatform(), xPosForVerticalArrowNavigation(START));
             break;
         case ParagraphGranularity:
-            pos = previousParagraphPosition(VisiblePosition(m_sel.start(), m_sel.affinity()), xPosForVerticalArrowNavigation(START));
+            pos = previousParagraphPosition(startForPlatform(), xPosForVerticalArrowNavigation(START));
             break;
         case SentenceBoundary:
-            pos = startOfSentence(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = startOfSentence(startForPlatform());
             break;
         case LineBoundary:
-            pos = logicalStartOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = logicalStartOfLine(startForPlatform());
             break;
         case ParagraphBoundary:
-            pos = startOfParagraph(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = startOfParagraph(startForPlatform());
             break;
         case DocumentBoundary:
-            pos = VisiblePosition(m_sel.start(), m_sel.affinity());
+            pos = startForPlatform();
             if (isEditablePosition(pos.deepEquivalent()))
                 pos = startOfEditableContent(pos);
             else 
@@ -558,7 +596,7 @@ bool SelectionController::modify(EAlteration alter, EDirection dir, TextGranular
 {
     if (userTriggered) {
         SelectionController trialSelectionController;
-        trialSelectionController.setSelection(m_sel);
+        trialSelectionController.setSelection(m_selection);
         trialSelectionController.setLastChangeWasHorizontalExtension(m_lastChangeWasHorizontalExtension);
         trialSelectionController.modify(alter, dir, granularity, false);
 
@@ -567,9 +605,6 @@ bool SelectionController::modify(EAlteration alter, EDirection dir, TextGranular
             return false;
     }
 
-    if (m_frame)
-        m_frame->setSelectionGranularity(granularity);
-    
     willBeModified(alter, dir);
 
     VisiblePosition pos;
@@ -602,7 +637,7 @@ bool SelectionController::modify(EAlteration alter, EDirection dir, TextGranular
 
     if (pos.isNull())
         return false;
-    
+
     // Some of the above operations set an xPosForVerticalArrowNavigation.
     // Setting a selection will clear it, so save it to possibly restore later.
     // Note: the START position type is arbitrary because it is unused, it would be
@@ -621,14 +656,9 @@ bool SelectionController::modify(EAlteration alter, EDirection dir, TextGranular
     if (granularity == LineGranularity || granularity == ParagraphGranularity)
         m_xPosForVerticalArrowNavigation = x;
 
-    if (userTriggered) {
-        // User modified selection change also sets the granularity back to character.
-        // NOTE: The one exception is that we need to keep word granularity to
-        // preserve smart delete behavior when extending by word (e.g. double-click),
-        // then shift-option-right arrow, then delete needs to smart delete, per TextEdit.
-        if (!(alter == EXTEND && granularity == WordGranularity && m_frame->selectionGranularity() == WordGranularity))
-            m_frame->setSelectionGranularity(CharacterGranularity);
-    }
+    if (userTriggered)
+        m_granularity = CharacterGranularity;
+
 
     setNeedsLayout();
 
@@ -654,7 +684,7 @@ bool SelectionController::modify(EAlteration alter, int verticalDistance, bool u
 
     if (userTriggered) {
         SelectionController trialSelectionController;
-        trialSelectionController.setSelection(m_sel);
+        trialSelectionController.setSelection(m_selection);
         trialSelectionController.setLastChangeWasHorizontalExtension(m_lastChangeWasHorizontalExtension);
         trialSelectionController.modify(alter, verticalDistance, false);
 
@@ -673,14 +703,14 @@ bool SelectionController::modify(EAlteration alter, int verticalDistance, bool u
     int xPos = 0;
     switch (alter) {
         case MOVE:
-            pos = VisiblePosition(up ? m_sel.start() : m_sel.end(), m_sel.affinity());
+            pos = VisiblePosition(up ? m_selection.start() : m_selection.end(), m_selection.affinity());
             xPos = xPosForVerticalArrowNavigation(up ? START : END);
-            m_sel.setAffinity(up ? UPSTREAM : DOWNSTREAM);
+            m_selection.setAffinity(up ? UPSTREAM : DOWNSTREAM);
             break;
         case EXTEND:
-            pos = VisiblePosition(m_sel.extent(), m_sel.affinity());
+            pos = VisiblePosition(m_selection.extent(), m_selection.affinity());
             xPos = xPosForVerticalArrowNavigation(EXTENT);
-            m_sel.setAffinity(DOWNSTREAM);
+            m_selection.setAffinity(DOWNSTREAM);
             break;
     }
 
@@ -723,23 +753,13 @@ bool SelectionController::modify(EAlteration alter, int verticalDistance, bool u
     }
 
     if (userTriggered)
-        m_frame->setSelectionGranularity(CharacterGranularity);
+        m_granularity = CharacterGranularity;
 
     m_lastChangeWasHorizontalExtension = alter == EXTEND;
 
     return true;
 }
 
-bool SelectionController::expandUsingGranularity(TextGranularity granularity)
-{
-    if (isNone())
-        return false;
-
-    m_sel.expandUsingGranularity(granularity);
-    m_needsLayout = true;
-    return true;
-}
-
 int SelectionController::xPosForVerticalArrowNavigation(EPositionType type)
 {
     int x = 0;
@@ -750,16 +770,16 @@ int SelectionController::xPosForVerticalArrowNavigation(EPositionType type)
     Position pos;
     switch (type) {
         case START:
-            pos = m_sel.start();
+            pos = m_selection.start();
             break;
         case END:
-            pos = m_sel.end();
+            pos = m_selection.end();
             break;
         case BASE:
-            pos = m_sel.base();
+            pos = m_selection.base();
             break;
         case EXTENT:
-            pos = m_sel.extent();
+            pos = m_selection.extent();
             break;
     }
 
@@ -768,7 +788,7 @@ int SelectionController::xPosForVerticalArrowNavigation(EPositionType type)
         return x;
         
     if (m_xPosForVerticalArrowNavigation == NoXPosForVerticalArrowNavigation) {
-        VisiblePosition visiblePosition(pos, m_sel.affinity());
+        VisiblePosition visiblePosition(pos, m_selection.affinity());
         // VisiblePosition creation can fail here if a node containing the selection becomes visibility:hidden
         // after the selection is created and before this function is called.
         x = visiblePosition.isNotNull() ? visiblePosition.xOffsetForVerticalNavigation() : 0;
@@ -782,27 +802,28 @@ int SelectionController::xPosForVerticalArrowNavigation(EPositionType type)
 
 void SelectionController::clear()
 {
+    m_granularity = CharacterGranularity;
     setSelection(VisibleSelection());
 }
 
 void SelectionController::setBase(const VisiblePosition &pos, bool userTriggered)
 {
-    setSelection(VisibleSelection(pos.deepEquivalent(), m_sel.extent(), pos.affinity()), true, true, userTriggered);
+    setSelection(VisibleSelection(pos.deepEquivalent(), m_selection.extent(), pos.affinity()), true, true, userTriggered);
 }
 
 void SelectionController::setExtent(const VisiblePosition &pos, bool userTriggered)
 {
-    setSelection(VisibleSelection(m_sel.base(), pos.deepEquivalent(), pos.affinity()), true, true, userTriggered);
+    setSelection(VisibleSelection(m_selection.base(), pos.deepEquivalent(), pos.affinity()), true, true, userTriggered);
 }
 
 void SelectionController::setBase(const Position &pos, EAffinity affinity, bool userTriggered)
 {
-    setSelection(VisibleSelection(pos, m_sel.extent(), affinity), true, true, userTriggered);
+    setSelection(VisibleSelection(pos, m_selection.extent(), affinity), true, true, userTriggered);
 }
 
 void SelectionController::setExtent(const Position &pos, EAffinity affinity, bool userTriggered)
 {
-    setSelection(VisibleSelection(m_sel.base(), pos, affinity), true, true, userTriggered);
+    setSelection(VisibleSelection(m_selection.base(), pos, affinity), true, true, userTriggered);
 }
 
 void SelectionController::setNeedsLayout(bool flag)
@@ -812,17 +833,17 @@ void SelectionController::setNeedsLayout(bool flag)
 
 void SelectionController::layout()
 {
-    if (isNone() || !m_sel.start().node()->inDocument() || !m_sel.end().node()->inDocument()) {
+    if (isNone() || !m_selection.start().node()->inDocument() || !m_selection.end().node()->inDocument()) {
         m_caretRect = IntRect();
         return;
     }
 
-    m_sel.start().node()->document()->updateStyleIfNeeded();
+    m_selection.start().node()->document()->updateStyleIfNeeded();
     
     m_caretRect = IntRect();
         
     if (isCaret()) {
-        VisiblePosition pos(m_sel.start(), m_sel.affinity());
+        VisiblePosition pos(m_selection.start(), m_selection.affinity());
         if (pos.isNotNull()) {
             ASSERT(pos.deepEquivalent().node()->renderer());
             
@@ -835,7 +856,6 @@ void SelectionController::layout()
             RenderObject* caretPainter = caretRenderer();
 
             // Compute an offset between the renderer and the caretPainter
-            IntSize offsetFromPainter;
             bool unrooted = false;
             while (renderer != caretPainter) {
                 RenderObject* containerObject = renderer->container();
@@ -843,15 +863,12 @@ void SelectionController::layout()
                     unrooted = true;
                     break;
                 }
-                offsetFromPainter += renderer->offsetFromContainer(containerObject);
+                localRect.move(renderer->offsetFromContainer(containerObject, localRect.location()));
                 renderer = containerObject;
             }
             
-            if (!unrooted) {
-                // Move the caret rect to the coords of the painter
-                localRect.move(offsetFromPainter);
+            if (!unrooted)
                 m_caretRect = localRect;
-            }
             
             m_absCaretBoundsDirty = true;
         }
@@ -862,7 +879,7 @@ void SelectionController::layout()
 
 RenderObject* SelectionController::caretRenderer() const
 {
-    Node* node = m_sel.start().node();
+    Node* node = m_selection.start().node();
     if (!node)
         return 0;
 
@@ -945,18 +962,27 @@ bool SelectionController::recomputeCaretRect()
     if (RenderView* view = toRenderView(m_frame->document()->renderer())) {
         // FIXME: make caret repainting container-aware.
         view->repaintRectangleInViewAndCompositedLayers(oldAbsoluteCaretRepaintBounds, false);
-        view->repaintRectangleInViewAndCompositedLayers(m_absoluteCaretRepaintBounds, false);
+        if (shouldRepaintCaret(view))
+            view->repaintRectangleInViewAndCompositedLayers(m_absoluteCaretRepaintBounds, false);
     }
 
     return true;
 }
 
+bool SelectionController::shouldRepaintCaret(const RenderView* view) const
+{
+    ASSERT(view);
+    Frame* frame = view->frameView() ? view->frameView()->frame() : 0; // The frame where the selection started.
+    bool caretBrowsing = frame && frame->settings() && frame->settings()->caretBrowsingEnabled();
+    return (caretBrowsing || isContentEditable());
+}
+
 void SelectionController::invalidateCaretRect()
 {
     if (!isCaret())
         return;
 
-    Document* d = m_sel.start().node()->document();
+    Document* d = m_selection.start().node()->document();
 
     // recomputeCaretRect will always return false for the drag caret,
     // because its m_frame is always 0.
@@ -976,30 +1002,38 @@ void SelectionController::invalidateCaretRect()
     m_needsLayout = true;
 
     if (!caretRectChanged) {
-        if (RenderView* view = toRenderView(d->renderer()))
+        RenderView* view = toRenderView(d->renderer());
+        if (view && shouldRepaintCaret(view))
             view->repaintRectangleInViewAndCompositedLayers(caretRepaintRect(), false);
     }
 }
 
-void SelectionController::paintCaret(GraphicsContext* p, int tx, int ty, const IntRect& clipRect)
+void SelectionController::paintCaret(GraphicsContext* context, int tx, int ty, const IntRect& clipRect)
 {
-    if (! m_sel.isCaret())
+#if ENABLE(TEXT_CARET)
+    if (!m_caretVisible)
+        return;
+    if (!m_caretPaint)
+        return;
+    if (!m_selection.isCaret())
         return;
-
-    if (m_needsLayout)
-        layout();
 
     IntRect drawingRect = localCaretRect();
     drawingRect.move(tx, ty);
     IntRect caret = intersection(drawingRect, clipRect);
-    if (!caret.isEmpty()) {
-        Color caretColor = Color::black;
-        Element* element = rootEditableElement();
-        if (element && element->renderer())
-            caretColor = element->renderer()->style()->color();
+    if (caret.isEmpty())
+        return;
 
-        p->fillRect(caret, caretColor);
+    Color caretColor = Color::black;
+    ColorSpace colorSpace = DeviceColorSpace;
+    Element* element = rootEditableElement();
+    if (element && element->renderer()) {
+        caretColor = element->renderer()->style()->color();
+        colorSpace = element->renderer()->style()->colorSpace();
     }
+
+    context->fillRect(caret, caretColor, colorSpace);
+#endif
 }
 
 void SelectionController::debugRenderer(RenderObject *r, bool selected) const
@@ -1020,10 +1054,10 @@ void SelectionController::debugRenderer(RenderObject *r, bool selected) const
         int textLength = text.length();
         if (selected) {
             int offset = 0;
-            if (r->node() == m_sel.start().node())
-                offset = m_sel.start().deprecatedEditingOffset();
-            else if (r->node() == m_sel.end().node())
-                offset = m_sel.end().deprecatedEditingOffset();
+            if (r->node() == m_selection.start().node())
+                offset = m_selection.start().deprecatedEditingOffset();
+            else if (r->node() == m_selection.end().node())
+                offset = m_selection.end().deprecatedEditingOffset();
                 
             int pos;
             InlineTextBox *box = textRenderer->findNextInlineTextBox(offset, pos);
@@ -1097,11 +1131,11 @@ bool SelectionController::contains(const IntPoint& point)
     if (visiblePos.isNull())
         return false;
         
-    if (m_sel.visibleStart().isNull() || m_sel.visibleEnd().isNull())
+    if (m_selection.visibleStart().isNull() || m_selection.visibleEnd().isNull())
         return false;
         
-    Position start(m_sel.visibleStart().deepEquivalent());
-    Position end(m_sel.visibleEnd().deepEquivalent());
+    Position start(m_selection.visibleStart().deepEquivalent());
+    Position end(m_selection.visibleEnd().deepEquivalent());
     Position p(visiblePos.deepEquivalent());
 
     return comparePositions(start, p) <= 0 && comparePositions(p, end) <= 0;
@@ -1167,7 +1201,7 @@ void SelectionController::selectAll()
     
     Node* root = 0;
     if (isContentEditable())
-        root = highestEditableRoot(m_sel.start());
+        root = highestEditableRoot(m_selection.start());
     else {
         root = shadowTreeRootNode();
         if (!root)
@@ -1259,7 +1293,7 @@ void SelectionController::focusedOrActiveStateChanged()
     // Caret appears in the active frame.
     if (activeAndFocused)
         m_frame->setSelectionFromNone();
-    m_frame->setCaretVisible(activeAndFocused);
+    setCaretVisible(activeAndFocused);
 
     // Update for caps lock state
     m_frame->eventHandler()->capsLockStateMayHaveChanged();
@@ -1276,7 +1310,7 @@ void SelectionController::focusedOrActiveStateChanged()
 
     // Secure keyboard entry is set by the active frame.
     if (m_frame->document()->useSecureKeyboardEntryWhenActive())
-        m_frame->setUseSecureKeyboardEntry(activeAndFocused);
+        setUseSecureKeyboardEntry(activeAndFocused);
 }
 
 void SelectionController::pageActivationChanged()
@@ -1284,6 +1318,20 @@ void SelectionController::pageActivationChanged()
     focusedOrActiveStateChanged();
 }
 
+void SelectionController::updateSecureKeyboardEntryIfActive()
+{
+    if (m_frame->document() && isFocusedAndActive())
+        setUseSecureKeyboardEntry(m_frame->document()->useSecureKeyboardEntryWhenActive());
+}
+
+void SelectionController::setUseSecureKeyboardEntry(bool enable)
+{
+    if (enable)
+        enableSecureTextInput();
+    else
+        disableSecureTextInput();
+}
+
 void SelectionController::setFocused(bool flag)
 {
     if (m_focused == flag)
@@ -1298,16 +1346,110 @@ bool SelectionController::isFocusedAndActive() const
     return m_focused && m_frame->page() && m_frame->page()->focusController()->isActive();
 }
 
+void SelectionController::updateAppearance()
+{
+    ASSERT(!m_isDragCaretController);
+
+#if ENABLE(TEXT_CARET)
+    bool caretRectChanged = recomputeCaretRect();
+
+    bool caretBrowsing = m_frame->settings() && m_frame->settings()->caretBrowsingEnabled();
+    bool shouldBlink = m_caretVisible
+        && isCaret() && (isContentEditable() || caretBrowsing);
+
+    // If the caret moved, stop the blink timer so we can restart with a
+    // black caret in the new location.
+    if (caretRectChanged || !shouldBlink)
+        m_caretBlinkTimer.stop();
+
+    // Start blinking with a black caret. Be sure not to restart if we're
+    // already blinking in the right location.
+    if (shouldBlink && !m_caretBlinkTimer.isActive()) {
+        if (double blinkInterval = m_frame->page()->theme()->caretBlinkInterval())
+            m_caretBlinkTimer.startRepeating(blinkInterval);
+
+        if (!m_caretPaint) {
+            m_caretPaint = true;
+            invalidateCaretRect();
+        }
+    }
+#endif
+
+    RenderView* view = m_frame->contentRenderer();
+    if (!view)
+        return;
+
+    VisibleSelection selection = this->selection();
+
+    if (!selection.isRange()) {
+        view->clearSelection();
+        return;
+    }
+
+    // Use the rightmost candidate for the start of the selection, and the leftmost candidate for the end of the selection.
+    // Example: foo <a>bar</a>.  Imagine that a line wrap occurs after 'foo', and that 'bar' is selected.   If we pass [foo, 3]
+    // as the start of the selection, the selection painting code will think that content on the line containing 'foo' is selected
+    // and will fill the gap before 'bar'.
+    Position startPos = selection.start();
+    Position candidate = startPos.downstream();
+    if (candidate.isCandidate())
+        startPos = candidate;
+    Position endPos = selection.end();
+    candidate = endPos.upstream();
+    if (candidate.isCandidate())
+        endPos = candidate;
+
+    // We can get into a state where the selection endpoints map to the same VisiblePosition when a selection is deleted
+    // because we don't yet notify the SelectionController of text removal.
+    if (startPos.isNotNull() && endPos.isNotNull() && selection.visibleStart() != selection.visibleEnd()) {
+        RenderObject* startRenderer = startPos.node()->renderer();
+        RenderObject* endRenderer = endPos.node()->renderer();
+        view->setSelection(startRenderer, startPos.deprecatedEditingOffset(), endRenderer, endPos.deprecatedEditingOffset());
+    }
+}
+
+void SelectionController::setCaretVisible(bool flag)
+{
+    if (m_caretVisible == flag)
+        return;
+    clearCaretRectIfNeeded();
+    m_caretVisible = flag;
+    updateAppearance();
+}
+
+void SelectionController::clearCaretRectIfNeeded()
+{
+#if ENABLE(TEXT_CARET)
+    if (!m_caretPaint)
+        return;
+    m_caretPaint = false;
+    invalidateCaretRect();
+#endif
+}
+
+void SelectionController::caretBlinkTimerFired(Timer<SelectionController>*)
+{
+#if ENABLE(TEXT_CARET)
+    ASSERT(m_caretVisible);
+    ASSERT(isCaret());
+    bool caretPaint = m_caretPaint;
+    if (isCaretBlinkingSuspended() && caretPaint)
+        return;
+    m_caretPaint = !caretPaint;
+    invalidateCaretRect();
+#endif
+}
+
 #ifndef NDEBUG
 
 void SelectionController::formatForDebugger(char* buffer, unsigned length) const
 {
-    m_sel.formatForDebugger(buffer, length);
+    m_selection.formatForDebugger(buffer, length);
 }
 
 void SelectionController::showTreeForThis() const
 {
-    m_sel.showTreeForThis();
+    m_selection.showTreeForThis();
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/editing/SelectionController.h b/src/3rdparty/webkit/WebCore/editing/SelectionController.h
index 4a13a3094a..a48e39a43c 100644
--- a/src/3rdparty/webkit/WebCore/editing/SelectionController.h
+++ b/src/3rdparty/webkit/WebCore/editing/SelectionController.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,6 +28,7 @@
 
 #include "IntRect.h"
 #include "Range.h"
+#include "Timer.h"
 #include "VisibleSelection.h"
 #include <wtf/Noncopyable.h>
 
@@ -36,6 +37,7 @@ namespace WebCore {
 class Frame;
 class GraphicsContext;
 class RenderObject;
+class RenderView;
 class VisiblePosition;
 
 class SelectionController : public Noncopyable {
@@ -45,10 +47,10 @@ public:
 
     SelectionController(Frame* = 0, bool isDragCaretController = false);
 
-    Element* rootEditableElement() const { return m_sel.rootEditableElement(); }
-    bool isContentEditable() const { return m_sel.isContentEditable(); }
-    bool isContentRichlyEditable() const { return m_sel.isContentRichlyEditable(); }
-    Node* shadowTreeRootNode() const { return m_sel.shadowTreeRootNode(); }
+    Element* rootEditableElement() const { return m_selection.rootEditableElement(); }
+    bool isContentEditable() const { return m_selection.isContentEditable(); }
+    bool isContentRichlyEditable() const { return m_selection.isContentRichlyEditable(); }
+    Node* shadowTreeRootNode() const { return m_selection.shadowTreeRootNode(); }
      
     void moveTo(const Range*, EAffinity, bool userTriggered = false);
     void moveTo(const VisiblePosition&, bool userTriggered = false);
@@ -56,8 +58,9 @@ public:
     void moveTo(const Position&, EAffinity, bool userTriggered = false);
     void moveTo(const Position&, const Position&, EAffinity, bool userTriggered = false);
 
-    const VisibleSelection& selection() const { return m_sel; }
-    void setSelection(const VisibleSelection&, bool closeTyping = true, bool clearTypingStyle = true, bool userTriggered = false);
+    const VisibleSelection& selection() const { return m_selection; }
+    void setSelection(const VisibleSelection&, bool closeTyping = true, bool clearTypingStyle = true, bool userTriggered = false, TextGranularity = CharacterGranularity);
+    void setSelection(const VisibleSelection& selection, TextGranularity granularity) { setSelection(selection, true, true, false, granularity); }
     bool setSelectedRange(Range*, EAffinity, bool closeTyping);
     void selectAll();
     void clear();
@@ -67,23 +70,23 @@ public:
 
     bool contains(const IntPoint&);
 
-    VisibleSelection::SelectionType selectionType() const { return m_sel.selectionType(); }
+    VisibleSelection::SelectionType selectionType() const { return m_selection.selectionType(); }
 
-    EAffinity affinity() const { return m_sel.affinity(); }
+    EAffinity affinity() const { return m_selection.affinity(); }
 
     bool modify(EAlteration, EDirection, TextGranularity, bool userTriggered = false);
     bool modify(EAlteration, int verticalDistance, bool userTriggered = false);
-    bool expandUsingGranularity(TextGranularity);
+    TextGranularity granularity() const { return m_granularity; }
 
     void setBase(const VisiblePosition&, bool userTriggered = false);
     void setBase(const Position&, EAffinity, bool userTriggered = false);
     void setExtent(const VisiblePosition&, bool userTriggered = false);
     void setExtent(const Position&, EAffinity, bool userTriggered = false);
 
-    Position base() const { return m_sel.base(); }
-    Position extent() const { return m_sel.extent(); }
-    Position start() const { return m_sel.start(); }
-    Position end() const { return m_sel.end(); }
+    Position base() const { return m_selection.base(); }
+    Position extent() const { return m_selection.extent(); }
+    Position start() const { return m_selection.start(); }
+    Position end() const { return m_selection.end(); }
 
     // Return the renderer that is responsible for painting the caret (in the selection start node)
     RenderObject* caretRenderer() const;
@@ -97,19 +100,21 @@ public:
     void setLastChangeWasHorizontalExtension(bool b) { m_lastChangeWasHorizontalExtension = b; }
     void willBeModified(EAlteration, EDirection);
     
-    bool isNone() const { return m_sel.isNone(); }
-    bool isCaret() const { return m_sel.isCaret(); }
-    bool isRange() const { return m_sel.isRange(); }
-    bool isCaretOrRange() const { return m_sel.isCaretOrRange(); }
+    bool isNone() const { return m_selection.isNone(); }
+    bool isCaret() const { return m_selection.isCaret(); }
+    bool isRange() const { return m_selection.isRange(); }
+    bool isCaretOrRange() const { return m_selection.isCaretOrRange(); }
     bool isInPasswordField() const;
-    bool isAll(StayInEditableContent stayInEditableContent = MustStayInEditableContent) const { return m_sel.isAll(stayInEditableContent); }
+    bool isAll(StayInEditableContent stayInEditableContent = MustStayInEditableContent) const { return m_selection.isAll(stayInEditableContent); }
     
-    PassRefPtr<Range> toNormalizedRange() const { return m_sel.toNormalizedRange(); }
+    PassRefPtr<Range> toNormalizedRange() const { return m_selection.toNormalizedRange(); }
 
     void debugRenderer(RenderObject*, bool selected) const;
     
     void nodeWillBeRemoved(Node*);
 
+    void setCaretVisible(bool = true);
+    void clearCaretRectIfNeeded();
     bool recomputeCaretRect(); // returns true if caret rect moved
     void invalidateCaretRect();
     void paintCaret(GraphicsContext*, int tx, int ty, const IntRect& clipRect);
@@ -124,6 +129,11 @@ public:
     bool isFocusedAndActive() const;
     void pageActivationChanged();
 
+    // Painting.
+    void updateAppearance();
+
+    void updateSecureKeyboardEntryIfActive();
+
 #ifndef NDEBUG
     void formatForDebugger(char* buffer, unsigned length) const;
     void showTreeForThis() const;
@@ -134,6 +144,10 @@ private:
 
     TextDirection directionOfEnclosingBlock();
 
+    VisiblePosition positionForPlatform(bool isGetStart) const;
+    VisiblePosition startForPlatform() const;
+    VisiblePosition endForPlatform() const;
+
     VisiblePosition modifyExtendingRight(TextGranularity);
     VisiblePosition modifyExtendingForward(TextGranularity);
     VisiblePosition modifyMovingRight(TextGranularity);
@@ -145,47 +159,49 @@ private:
 
     void layout();
     IntRect caretRepaintRect() const;
+    bool shouldRepaintCaret(const RenderView* view) const;
 
     int xPosForVerticalArrowNavigation(EPositionType);
     
-#if PLATFORM(MAC) || PLATFORM(GTK)
     void notifyAccessibilityForSelectionChange();
-#else
-    void notifyAccessibilityForSelectionChange() {};
-#endif
 
     void focusedOrActiveStateChanged();
     bool caretRendersInsideNode(Node*) const;
     
     IntRect absoluteBoundsForLocalRect(const IntRect&) const;
 
+    void caretBlinkTimerFired(Timer<SelectionController>*);
+
+    void setUseSecureKeyboardEntry(bool);
+
     Frame* m_frame;
+
     int m_xPosForVerticalArrowNavigation;
 
-    VisibleSelection m_sel;
+    VisibleSelection m_selection;
+    TextGranularity m_granularity;
 
-    IntRect m_caretRect;        // caret rect in coords local to the renderer responsible for painting the caret
-    IntRect m_absCaretBounds;   // absolute bounding rect for the caret
+    Timer<SelectionController> m_caretBlinkTimer;
+
+    IntRect m_caretRect; // caret rect in coords local to the renderer responsible for painting the caret
+    IntRect m_absCaretBounds; // absolute bounding rect for the caret
     IntRect m_absoluteCaretRepaintBounds;
     
-    bool m_needsLayout : 1;       // true if the caret and expectedVisible rectangles need to be calculated
-    bool m_absCaretBoundsDirty: 1;
-    bool m_lastChangeWasHorizontalExtension : 1;
-    bool m_isDragCaretController : 1;
-    bool m_isCaretBlinkingSuspended : 1;
-    bool m_focused : 1;
-
+    bool m_needsLayout; // true if m_caretRect and m_absCaretBounds need to be calculated
+    bool m_absCaretBoundsDirty;
+    bool m_lastChangeWasHorizontalExtension;
+    bool m_isDragCaretController;
+    bool m_isCaretBlinkingSuspended;
+    bool m_focused;
+    bool m_caretVisible;
+    bool m_caretPaint;
 };
 
-inline bool operator==(const SelectionController& a, const SelectionController& b)
-{
-    return a.start() == b.start() && a.end() == b.end() && a.affinity() == b.affinity();
-}
-
-inline bool operator!=(const SelectionController& a, const SelectionController& b)
+#if !(PLATFORM(MAC) || PLATFORM(GTK))
+inline void SelectionController::notifyAccessibilityForSelectionChange()
 {
-    return !(a == b);
 }
+#endif
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp b/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp
index 35dfc6f044..2998c6acd7 100644
--- a/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp
@@ -41,35 +41,39 @@ SplitElementCommand::SplitElementCommand(PassRefPtr<Element> element, PassRefPtr
     ASSERT(m_atChild->parentNode() == m_element2);
 }
 
-void SplitElementCommand::doApply()
+void SplitElementCommand::executeApply()
 {
-    RefPtr<Element> prefixElement = m_element2->cloneElementWithoutChildren();
-
     if (m_atChild->parentNode() != m_element2)
         return;
-
+    
     Vector<RefPtr<Node> > children;
     for (Node* node = m_element2->firstChild(); node != m_atChild; node = node->nextSibling())
         children.append(node);
-
+    
     ExceptionCode ec = 0;
-
+    
     Node* parent = m_element2->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
-    parent->insertBefore(prefixElement.get(), m_element2.get(), ec);
+    parent->insertBefore(m_element1.get(), m_element2.get(), ec);
     if (ec)
         return;
-    m_element1 = prefixElement.release();
-
+    
     size_t size = children.size();
     for (size_t i = 0; i < size; ++i)
         m_element1->appendChild(children[i], ec);
 }
+    
+void SplitElementCommand::doApply()
+{
+    m_element1 = m_element2->cloneElementWithoutChildren();
+    
+    executeApply();
+}
 
 void SplitElementCommand::doUnapply()
 {
-    if (!m_element1)
+    if (!m_element1 || !m_element1->isContentEditable() || !m_element2->isContentEditable())
         return;
 
     Vector<RefPtr<Node> > children;
@@ -85,7 +89,14 @@ void SplitElementCommand::doUnapply()
         m_element2->insertBefore(children[i].get(), refChild.get(), ec);
 
     m_element1->remove(ec);
-    m_element1 = 0;
 }
 
+void SplitElementCommand::doReapply()
+{
+    if (!m_element1)
+        return;
+    
+    executeApply();
+}
+    
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.h b/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.h
index 2732762046..7ea8f5bf87 100644
--- a/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.h
@@ -42,6 +42,8 @@ private:
 
     virtual void doApply();
     virtual void doUnapply();
+    virtual void doReapply();
+    void executeApply();
 
     RefPtr<Element> m_element1;
     RefPtr<Element> m_element2;
diff --git a/src/3rdparty/webkit/WebCore/editing/SplitTextNodeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/SplitTextNodeCommand.cpp
index 3b04e0169e..15daa49cd3 100644
--- a/src/3rdparty/webkit/WebCore/editing/SplitTextNodeCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SplitTextNodeCommand.cpp
@@ -49,6 +49,10 @@ SplitTextNodeCommand::SplitTextNodeCommand(PassRefPtr<Text> text, int offset)
 
 void SplitTextNodeCommand::doApply()
 {
+    Node* parent = m_text2->parentNode();
+    if (!parent || !parent->isContentEditable())
+        return;
+
     ExceptionCode ec = 0;
 
     String prefixText = m_text2->substringData(0, m_offset, ec);
@@ -59,9 +63,6 @@ void SplitTextNodeCommand::doApply()
     ASSERT(prefixTextNode);
     document()->copyMarkers(m_text2.get(), 0, m_offset, prefixTextNode.get(), 0);
 
-    Node* parent = m_text2->parentNode();
-    if (!parent)
-        return;
     parent->insertBefore(prefixTextNode.get(), m_text2.get(), ec);
     if (ec)
         return;
@@ -72,7 +73,7 @@ void SplitTextNodeCommand::doApply()
 
 void SplitTextNodeCommand::doUnapply()
 {
-    if (!m_text1)
+    if (!m_text1 || !m_text1->isContentEditable())
         return;
 
     ASSERT(m_text1->document() == document());
diff --git a/src/3rdparty/webkit/WebCore/editing/TextAffinity.h b/src/3rdparty/webkit/WebCore/editing/TextAffinity.h
index a5565c7e10..5310ca96f2 100644
--- a/src/3rdparty/webkit/WebCore/editing/TextAffinity.h
+++ b/src/3rdparty/webkit/WebCore/editing/TextAffinity.h
@@ -26,8 +26,6 @@
 #ifndef TextAffinity_h
 #define TextAffinity_h
 
-#include <wtf/Platform.h>
-
 #ifdef __OBJC__
 #include <AppKit/NSTextView.h>
 #endif
diff --git a/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp b/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp
index d36849c012..a386c6e67d 100644
--- a/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -73,11 +73,17 @@ public:
 #if USE(ICU_UNICODE) && !UCONFIG_NO_COLLATION
 
 private:
+    bool isBadMatch(const UChar*, size_t length) const;
+
     String m_target;
     Vector<UChar> m_buffer;
     size_t m_overlap;
     bool m_atBreak;
 
+    bool m_targetRequiresKanaWorkaround;
+    Vector<UChar> m_normalizedTarget;
+    mutable Vector<UChar> m_normalizedMatch;
+
 #else
 
 private:
@@ -150,7 +156,7 @@ static inline Node* parentCrossingShadowBoundaries(Node* node)
     return node->shadowParentNode();
 }
 
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
 
 static unsigned depthCrossingShadowBoundaries(Node* node)
 {
@@ -218,7 +224,7 @@ static void pushFullyClippedState(BitStack& stack, Node* node)
 
     // Push true if this node full clips its contents, or if a parent already has fully
     // clipped and this is not a node that ignores its container's clip.
-    stack.push(fullyClipsContents(node) || stack.top() && !ignoresContainerClip(node));
+    stack.push(fullyClipsContents(node) || (stack.top() && !ignoresContainerClip(node)));
 }
 
 static void setUpFullyClippedStack(BitStack& stack, Node* node)
@@ -705,6 +711,28 @@ static bool shouldEmitExtraNewlineForNode(Node* node)
     return false;
 }
 
+static int collapsedSpaceLength(RenderText* renderer, int textEnd)
+{
+    const UChar* characters = renderer->text()->characters();
+    int length = renderer->text()->length();
+    for (int i = textEnd; i < length; ++i) {
+        if (!renderer->style()->isCollapsibleWhiteSpace(characters[i]))
+            return i - textEnd;
+    }
+
+    return length - textEnd;
+}
+
+static int maxOffsetIncludingCollapsedSpaces(Node* node)
+{
+    int offset = caretMaxOffset(node);
+
+    if (node->renderer() && node->renderer()->isText())
+        offset += collapsedSpaceLength(toRenderText(node->renderer()), offset);
+
+    return offset;
+}
+
 // Whether or not we should emit a character as we enter m_node (if it's a container) or as we hit it (if it's atomic).
 bool TextIterator::shouldRepresentNodeOffsetZero()
 {
@@ -1029,7 +1057,9 @@ void SimplifiedBackwardsTextIterator::advance()
         m_node = next;
         if (m_node)
             pushFullyClippedState(m_fullyClippedStack, m_node);
-        m_offset = m_node ? caretMaxOffset(m_node) : 0;
+        // For the purpose of word boundary detection,
+        // we should iterate all visible text and trailing (collapsed) whitespaces. 
+        m_offset = m_node ? maxOffsetIncludingCollapsedSpaces(m_node) : 0;
         m_handledNode = false;
         m_handledChildren = false;
         
@@ -1465,9 +1495,212 @@ static inline void unlockSearcher()
 #endif
 }
 
+// ICU's search ignores the distinction between small kana letters and ones
+// that are not small, and also characters that differ only in the voicing
+// marks when considering only primary collation strength diffrences.
+// This is not helpful for end users, since these differences make words
+// distinct, so for our purposes we need these to be considered.
+// The Unicode folks do not think the collation algorithm should be
+// changed. To work around this, we would like to tailor the ICU searcher,
+// but we can't get that to work yet. So instead, we check for cases where
+// these differences occur, and skip those matches.
+
+// We refer to the above technique as the "kana workaround". The next few
+// functions are helper functinos for the kana workaround.
+
+static inline bool isKanaLetter(UChar character)
+{
+    // Hiragana letters.
+    if (character >= 0x3041 && character <= 0x3096)
+        return true;
+
+    // Katakana letters.
+    if (character >= 0x30A1 && character <= 0x30FA)
+        return true;
+    if (character >= 0x31F0 && character <= 0x31FF)
+        return true;
+
+    // Halfwidth katakana letters.
+    if (character >= 0xFF66 && character <= 0xFF9D && character != 0xFF70)
+        return true;
+
+    return false;
+}
+
+static inline bool isSmallKanaLetter(UChar character)
+{
+    ASSERT(isKanaLetter(character));
+
+    switch (character) {
+    case 0x3041: // HIRAGANA LETTER SMALL A
+    case 0x3043: // HIRAGANA LETTER SMALL I
+    case 0x3045: // HIRAGANA LETTER SMALL U
+    case 0x3047: // HIRAGANA LETTER SMALL E
+    case 0x3049: // HIRAGANA LETTER SMALL O
+    case 0x3063: // HIRAGANA LETTER SMALL TU
+    case 0x3083: // HIRAGANA LETTER SMALL YA
+    case 0x3085: // HIRAGANA LETTER SMALL YU
+    case 0x3087: // HIRAGANA LETTER SMALL YO
+    case 0x308E: // HIRAGANA LETTER SMALL WA
+    case 0x3095: // HIRAGANA LETTER SMALL KA
+    case 0x3096: // HIRAGANA LETTER SMALL KE
+    case 0x30A1: // KATAKANA LETTER SMALL A
+    case 0x30A3: // KATAKANA LETTER SMALL I
+    case 0x30A5: // KATAKANA LETTER SMALL U
+    case 0x30A7: // KATAKANA LETTER SMALL E
+    case 0x30A9: // KATAKANA LETTER SMALL O
+    case 0x30C3: // KATAKANA LETTER SMALL TU
+    case 0x30E3: // KATAKANA LETTER SMALL YA
+    case 0x30E5: // KATAKANA LETTER SMALL YU
+    case 0x30E7: // KATAKANA LETTER SMALL YO
+    case 0x30EE: // KATAKANA LETTER SMALL WA
+    case 0x30F5: // KATAKANA LETTER SMALL KA
+    case 0x30F6: // KATAKANA LETTER SMALL KE
+    case 0x31F0: // KATAKANA LETTER SMALL KU
+    case 0x31F1: // KATAKANA LETTER SMALL SI
+    case 0x31F2: // KATAKANA LETTER SMALL SU
+    case 0x31F3: // KATAKANA LETTER SMALL TO
+    case 0x31F4: // KATAKANA LETTER SMALL NU
+    case 0x31F5: // KATAKANA LETTER SMALL HA
+    case 0x31F6: // KATAKANA LETTER SMALL HI
+    case 0x31F7: // KATAKANA LETTER SMALL HU
+    case 0x31F8: // KATAKANA LETTER SMALL HE
+    case 0x31F9: // KATAKANA LETTER SMALL HO
+    case 0x31FA: // KATAKANA LETTER SMALL MU
+    case 0x31FB: // KATAKANA LETTER SMALL RA
+    case 0x31FC: // KATAKANA LETTER SMALL RI
+    case 0x31FD: // KATAKANA LETTER SMALL RU
+    case 0x31FE: // KATAKANA LETTER SMALL RE
+    case 0x31FF: // KATAKANA LETTER SMALL RO
+    case 0xFF67: // HALFWIDTH KATAKANA LETTER SMALL A
+    case 0xFF68: // HALFWIDTH KATAKANA LETTER SMALL I
+    case 0xFF69: // HALFWIDTH KATAKANA LETTER SMALL U
+    case 0xFF6A: // HALFWIDTH KATAKANA LETTER SMALL E
+    case 0xFF6B: // HALFWIDTH KATAKANA LETTER SMALL O
+    case 0xFF6C: // HALFWIDTH KATAKANA LETTER SMALL YA
+    case 0xFF6D: // HALFWIDTH KATAKANA LETTER SMALL YU
+    case 0xFF6E: // HALFWIDTH KATAKANA LETTER SMALL YO
+    case 0xFF6F: // HALFWIDTH KATAKANA LETTER SMALL TU
+        return true;
+    }
+    return false;
+}
+
+enum VoicedSoundMarkType { NoVoicedSoundMark, VoicedSoundMark, SemiVoicedSoundMark };
+
+static inline VoicedSoundMarkType composedVoicedSoundMark(UChar character)
+{
+    ASSERT(isKanaLetter(character));
+
+    switch (character) {
+    case 0x304C: // HIRAGANA LETTER GA
+    case 0x304E: // HIRAGANA LETTER GI
+    case 0x3050: // HIRAGANA LETTER GU
+    case 0x3052: // HIRAGANA LETTER GE
+    case 0x3054: // HIRAGANA LETTER GO
+    case 0x3056: // HIRAGANA LETTER ZA
+    case 0x3058: // HIRAGANA LETTER ZI
+    case 0x305A: // HIRAGANA LETTER ZU
+    case 0x305C: // HIRAGANA LETTER ZE
+    case 0x305E: // HIRAGANA LETTER ZO
+    case 0x3060: // HIRAGANA LETTER DA
+    case 0x3062: // HIRAGANA LETTER DI
+    case 0x3065: // HIRAGANA LETTER DU
+    case 0x3067: // HIRAGANA LETTER DE
+    case 0x3069: // HIRAGANA LETTER DO
+    case 0x3070: // HIRAGANA LETTER BA
+    case 0x3073: // HIRAGANA LETTER BI
+    case 0x3076: // HIRAGANA LETTER BU
+    case 0x3079: // HIRAGANA LETTER BE
+    case 0x307C: // HIRAGANA LETTER BO
+    case 0x3094: // HIRAGANA LETTER VU
+    case 0x30AC: // KATAKANA LETTER GA
+    case 0x30AE: // KATAKANA LETTER GI
+    case 0x30B0: // KATAKANA LETTER GU
+    case 0x30B2: // KATAKANA LETTER GE
+    case 0x30B4: // KATAKANA LETTER GO
+    case 0x30B6: // KATAKANA LETTER ZA
+    case 0x30B8: // KATAKANA LETTER ZI
+    case 0x30BA: // KATAKANA LETTER ZU
+    case 0x30BC: // KATAKANA LETTER ZE
+    case 0x30BE: // KATAKANA LETTER ZO
+    case 0x30C0: // KATAKANA LETTER DA
+    case 0x30C2: // KATAKANA LETTER DI
+    case 0x30C5: // KATAKANA LETTER DU
+    case 0x30C7: // KATAKANA LETTER DE
+    case 0x30C9: // KATAKANA LETTER DO
+    case 0x30D0: // KATAKANA LETTER BA
+    case 0x30D3: // KATAKANA LETTER BI
+    case 0x30D6: // KATAKANA LETTER BU
+    case 0x30D9: // KATAKANA LETTER BE
+    case 0x30DC: // KATAKANA LETTER BO
+    case 0x30F4: // KATAKANA LETTER VU
+    case 0x30F7: // KATAKANA LETTER VA
+    case 0x30F8: // KATAKANA LETTER VI
+    case 0x30F9: // KATAKANA LETTER VE
+    case 0x30FA: // KATAKANA LETTER VO
+        return VoicedSoundMark;
+    case 0x3071: // HIRAGANA LETTER PA
+    case 0x3074: // HIRAGANA LETTER PI
+    case 0x3077: // HIRAGANA LETTER PU
+    case 0x307A: // HIRAGANA LETTER PE
+    case 0x307D: // HIRAGANA LETTER PO
+    case 0x30D1: // KATAKANA LETTER PA
+    case 0x30D4: // KATAKANA LETTER PI
+    case 0x30D7: // KATAKANA LETTER PU
+    case 0x30DA: // KATAKANA LETTER PE
+    case 0x30DD: // KATAKANA LETTER PO
+        return SemiVoicedSoundMark;
+    }
+    return NoVoicedSoundMark;
+}
+
+static inline bool isCombiningVoicedSoundMark(UChar character)
+{
+    switch (character) {
+    case 0x3099: // COMBINING KATAKANA-HIRAGANA VOICED SOUND MARK
+    case 0x309A: // COMBINING KATAKANA-HIRAGANA SEMI-VOICED SOUND MARK
+        return true;
+    }
+    return false;
+}
+
+static inline bool containsKanaLetters(const String& pattern)
+{
+    const UChar* characters = pattern.characters();
+    unsigned length = pattern.length();
+    for (unsigned i = 0; i < length; ++i) {
+        if (isKanaLetter(characters[i]))
+            return true;
+    }
+    return false;
+}
+
+static void normalizeCharacters(const UChar* characters, unsigned length, Vector<UChar>& buffer)
+{
+    ASSERT(length);
+
+    buffer.resize(length);
+
+    UErrorCode status = U_ZERO_ERROR;
+    size_t bufferSize = unorm_normalize(characters, length, UNORM_NFC, 0, buffer.data(), length, &status);
+    ASSERT(status == U_ZERO_ERROR || status == U_STRING_NOT_TERMINATED_WARNING || status == U_BUFFER_OVERFLOW_ERROR);
+    ASSERT(bufferSize);
+
+    buffer.resize(bufferSize);
+
+    if (status == U_ZERO_ERROR || status == U_STRING_NOT_TERMINATED_WARNING)
+        return;
+
+    status = U_ZERO_ERROR;
+    unorm_normalize(characters, length, UNORM_NFC, 0, buffer.data(), bufferSize, &status);
+    ASSERT(status == U_STRING_NOT_TERMINATED_WARNING);
+}
+
 inline SearchBuffer::SearchBuffer(const String& target, bool isCaseSensitive)
     : m_target(target)
     , m_atBreak(true)
+    , m_targetRequiresKanaWorkaround(containsKanaLetters(m_target))
 {
     ASSERT(!m_target.isEmpty());
 
@@ -1497,6 +1730,10 @@ inline SearchBuffer::SearchBuffer(const String& target, bool isCaseSensitive)
     UErrorCode status = U_ZERO_ERROR;
     usearch_setPattern(searcher, m_target.characters(), targetLength, &status);
     ASSERT(status == U_ZERO_ERROR);
+
+    // The kana workaround requires a normalized copy of the target string.
+    if (m_targetRequiresKanaWorkaround)
+        normalizeCharacters(m_target.characters(), m_target.length(), m_normalizedTarget);
 }
 
 inline SearchBuffer::~SearchBuffer()
@@ -1534,6 +1771,66 @@ inline void SearchBuffer::reachedBreak()
     m_atBreak = true;
 }
 
+inline bool SearchBuffer::isBadMatch(const UChar* match, size_t matchLength) const
+{
+    // This function implements the kana workaround. If usearch treats
+    // it as a match, but we do not want to, then it's a "bad match".
+    if (!m_targetRequiresKanaWorkaround)
+        return false;
+
+    // Normalize into a match buffer. We reuse a single buffer rather than
+    // creating a new one each time.
+    normalizeCharacters(match, matchLength, m_normalizedMatch);
+
+    const UChar* a = m_normalizedTarget.begin();
+    const UChar* aEnd = m_normalizedTarget.end();
+
+    const UChar* b = m_normalizedMatch.begin();
+    const UChar* bEnd = m_normalizedMatch.end();
+
+    while (true) {
+        // Skip runs of non-kana-letter characters. This is necessary so we can
+        // correctly handle strings where the target and match have different-length
+        // runs of characters that match, while still double checking the correctness
+        // of matches of kana letters with other kana letters.
+        while (a != aEnd && !isKanaLetter(*a))
+            ++a;
+        while (b != bEnd && !isKanaLetter(*b))
+            ++b;
+
+        // If we reached the end of either the target or the match, we should have
+        // reached the end of both; both should have the same number of kana letters.
+        if (a == aEnd || b == bEnd) {
+            ASSERT(a == aEnd);
+            ASSERT(b == bEnd);
+            return false;
+        }
+
+        // Check for differences in the kana letter character itself.
+        if (isSmallKanaLetter(*a) != isSmallKanaLetter(*b))
+            return true;
+        if (composedVoicedSoundMark(*a) != composedVoicedSoundMark(*b))
+            return true;
+        ++a;
+        ++b;
+
+        // Check for differences in combining voiced sound marks found after the letter.
+        while (1) {
+            if (!(a != aEnd && isCombiningVoicedSoundMark(*a))) {
+                if (b != bEnd && isCombiningVoicedSoundMark(*b))
+                    return true;
+                break;
+            }
+            if (!(b != bEnd && isCombiningVoicedSoundMark(*b)))
+                return true;
+            if (*a != *b)
+                return true;
+            ++a;
+            ++b;
+        }
+    }
+}
+
 inline size_t SearchBuffer::search(size_t& start)
 {
     size_t size = m_buffer.size();
@@ -1553,6 +1850,8 @@ inline size_t SearchBuffer::search(size_t& start)
 
     int matchStart = usearch_first(searcher, &status);
     ASSERT(status == U_ZERO_ERROR);
+
+nextMatch:
     if (!(matchStart >= 0 && static_cast<size_t>(matchStart) < size)) {
         ASSERT(matchStart == USEARCH_DONE);
         return 0;
@@ -1567,12 +1866,22 @@ inline size_t SearchBuffer::search(size_t& start)
         return 0;
     }
 
+    size_t matchedLength = usearch_getMatchedLength(searcher);
+    ASSERT(matchStart + matchedLength <= size);
+
+    // If this match is "bad", move on to the next match.
+    if (isBadMatch(m_buffer.data() + matchStart, matchedLength)) {
+        matchStart = usearch_next(searcher, &status);
+        ASSERT(status == U_ZERO_ERROR);
+        goto nextMatch;
+    }
+
     size_t newSize = size - (matchStart + 1);
     memmove(m_buffer.data(), m_buffer.data() + matchStart + 1, newSize * sizeof(UChar));
     m_buffer.shrink(newSize);
 
     start = size - matchStart;
-    return usearch_getMatchedLength(searcher);
+    return matchedLength;
 }
 
 #else // !ICU_UNICODE
@@ -1728,16 +2037,25 @@ PassRefPtr<Range> TextIterator::rangeFromLocationAndLength(Element* scope, int r
         
         // Fix textRunRange->endPosition(), but only if foundStart || foundEnd, because it is only
         // in those cases that textRunRange is used.
-        if (foundStart || foundEnd) {
+        if (foundEnd) {
             // FIXME: This is a workaround for the fact that the end of a run is often at the wrong
             // position for emitted '\n's.
             if (len == 1 && it.characters()[0] == '\n') {
-                Position runStart = textRunRange->startPosition();
-                Position runEnd = VisiblePosition(runStart).next().deepEquivalent();
-                if (runEnd.isNotNull()) {
+                scope->document()->updateLayoutIgnorePendingStylesheets();
+                it.advance();
+                if (!it.atEnd()) {
+                    RefPtr<Range> range = it.range();
                     ExceptionCode ec = 0;
-                    textRunRange->setEnd(runEnd.node(), runEnd.deprecatedEditingOffset(), ec);
+                    textRunRange->setEnd(range->startContainer(), range->startOffset(), ec);
                     ASSERT(!ec);
+                } else {
+                    Position runStart = textRunRange->startPosition();
+                    Position runEnd = VisiblePosition(runStart).next().deepEquivalent();
+                    if (runEnd.isNotNull()) {
+                        ExceptionCode ec = 0;
+                        textRunRange->setEnd(runEnd.node(), runEnd.deprecatedEditingOffset(), ec);
+                        ASSERT(!ec);
+                    }
                 }
             }
         }
diff --git a/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp b/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
index f5901d7967..1c9db906ea 100644
--- a/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
@@ -90,7 +90,7 @@ void TypingCommand::deleteKeyPressed(Document *document, bool smartDelete, TextG
     ASSERT(frame);
     
     EditCommand* lastEditCommand = frame->editor()->lastEditCommand();
-    if (isOpenForMoreTypingCommand(lastEditCommand)) {
+    if (granularity == CharacterGranularity && isOpenForMoreTypingCommand(lastEditCommand)) {
         static_cast<TypingCommand*>(lastEditCommand)->deleteKeyPressed(granularity, killRing);
         return;
     }
@@ -109,7 +109,7 @@ void TypingCommand::forwardDeleteKeyPressed(Document *document, bool smartDelete
     ASSERT(frame);
     
     EditCommand* lastEditCommand = frame->editor()->lastEditCommand();
-    if (isOpenForMoreTypingCommand(lastEditCommand)) {
+    if (granularity == CharacterGranularity && isOpenForMoreTypingCommand(lastEditCommand)) {
         static_cast<TypingCommand*>(lastEditCommand)->forwardDeleteKeyPressed(granularity, killRing);
         return;
     }
@@ -450,6 +450,10 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
             }
             
             VisiblePosition visibleStart(endingSelection().visibleStart());
+            // If we have a caret selection on an empty cell, we have nothing to do.
+            if (isEmptyTableCell(visibleStart.deepEquivalent().node()))
+                return;
+
             // If the caret is at the start of a paragraph after a table, move content into the last table cell.
             if (isStartOfParagraph(visibleStart) && isFirstPositionAfterTable(visibleStart.previous(true))) {
                 // Unless the caret is just before a table.  We don't want to move a table into the last table cell.
diff --git a/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
index 206de86334..c818da12e8 100644
--- a/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
@@ -43,7 +43,6 @@ namespace WebCore {
 
 VisibleSelection::VisibleSelection()
     : m_affinity(DOWNSTREAM)
-    , m_granularity(CharacterGranularity)
     , m_selectionType(NoSelection)
     , m_baseIsFirst(true)
 {
@@ -53,7 +52,6 @@ VisibleSelection::VisibleSelection(const Position& pos, EAffinity affinity)
     : m_base(pos)
     , m_extent(pos)
     , m_affinity(affinity)
-    , m_granularity(CharacterGranularity)
 {
     validate();
 }
@@ -62,7 +60,6 @@ VisibleSelection::VisibleSelection(const Position& base, const Position& extent,
     : m_base(base)
     , m_extent(extent)
     , m_affinity(affinity)
-    , m_granularity(CharacterGranularity)
 {
     validate();
 }
@@ -71,7 +68,6 @@ VisibleSelection::VisibleSelection(const VisiblePosition& pos)
     : m_base(pos.deepEquivalent())
     , m_extent(pos.deepEquivalent())
     , m_affinity(pos.affinity())
-    , m_granularity(CharacterGranularity)
 {
     validate();
 }
@@ -80,7 +76,6 @@ VisibleSelection::VisibleSelection(const VisiblePosition& base, const VisiblePos
     : m_base(base.deepEquivalent())
     , m_extent(extent.deepEquivalent())
     , m_affinity(base.affinity())
-    , m_granularity(CharacterGranularity)
 {
     validate();
 }
@@ -89,7 +84,6 @@ VisibleSelection::VisibleSelection(const Range* range, EAffinity affinity)
     : m_base(range->startPosition())
     , m_extent(range->endPosition())
     , m_affinity(affinity)
-    , m_granularity(CharacterGranularity)
 {
     validate();
 }
@@ -190,8 +184,7 @@ bool VisibleSelection::expandUsingGranularity(TextGranularity granularity)
     if (isNone())
         return false;
 
-    m_granularity = granularity;
-    validate();
+    validate(granularity);
     return true;
 }
 
@@ -237,7 +230,7 @@ void VisibleSelection::appendTrailingWhitespace()
 
     for (; charIt.length(); charIt.advance(1)) {
         UChar c = charIt.characters()[0];
-        if (!isSpaceOrNewline(c) && c != noBreakSpace || c == '\n')
+        if ((!isSpaceOrNewline(c) && c != noBreakSpace) || c == '\n')
             break;
         m_end = charIt.range()->endPosition();
     }
@@ -268,7 +261,7 @@ void VisibleSelection::setBaseAndExtentToDeepEquivalents()
         m_baseIsFirst = comparePositions(m_base, m_extent) <= 0;
 }
 
-void VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity()
+void VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity(TextGranularity granularity)
 {
     if (m_baseIsFirst) {
         m_start = m_base;
@@ -278,7 +271,7 @@ void VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity()
         m_end = m_base;
     }
 
-    switch (m_granularity) {
+    switch (granularity) {
         case CharacterGranularity:
             // Don't do any expansion.
             break;
@@ -301,7 +294,7 @@ void VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity()
             VisiblePosition wordEnd(endOfWord(originalEnd, side));
             VisiblePosition end(wordEnd);
             
-            if (isEndOfParagraph(originalEnd)) {
+            if (isEndOfParagraph(originalEnd) && !isEmptyTableCell(m_start.node())) {
                 // Select the paragraph break (the space from the end of a paragraph to the start of 
                 // the next one) to match TextEdit.
                 end = wordEnd.next();
@@ -408,10 +401,10 @@ void VisibleSelection::updateSelectionType()
         m_affinity = DOWNSTREAM;
 }
 
-void VisibleSelection::validate()
+void VisibleSelection::validate(TextGranularity granularity)
 {
     setBaseAndExtentToDeepEquivalents();
-    setStartAndEndFromBaseAndExtentRespectingGranularity();
+    setStartAndEndFromBaseAndExtentRespectingGranularity(granularity);
     adjustSelectionToAvoidCrossingEditingBoundaries();
     updateSelectionType();
 
@@ -441,7 +434,6 @@ void VisibleSelection::setWithoutValidation(const Position& base, const Position
     ASSERT(!extent.isNull());
     ASSERT(base != extent);
     ASSERT(m_affinity == DOWNSTREAM);
-    ASSERT(m_granularity == CharacterGranularity);
     m_base = base;
     m_extent = extent;
     m_baseIsFirst = comparePositions(base, extent) <= 0;
diff --git a/src/3rdparty/webkit/WebCore/editing/VisibleSelection.h b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.h
index e346b27e72..4ce2b92828 100644
--- a/src/3rdparty/webkit/WebCore/editing/VisibleSelection.h
+++ b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.h
@@ -81,8 +81,7 @@ public:
     void appendTrailingWhitespace();
 
     bool expandUsingGranularity(TextGranularity granularity);
-    TextGranularity granularity() const { return m_granularity; }
-
+    
     // We don't yet support multi-range selections, so we only ever have one range to return.
     PassRefPtr<Range> firstRange() const;
 
@@ -106,22 +105,25 @@ public:
     void setWithoutValidation(const Position&, const Position&);
 
 private:
-    void validate();
+    void validate(TextGranularity = CharacterGranularity);
 
     // Support methods for validate()
     void setBaseAndExtentToDeepEquivalents();
-    void setStartAndEndFromBaseAndExtentRespectingGranularity();
+    void setStartAndEndFromBaseAndExtentRespectingGranularity(TextGranularity);
     void adjustSelectionToAvoidCrossingEditingBoundaries();
     void updateSelectionType();
 
-    // FIXME: These should all be VisiblePositions
+    // We need to store these as Positions because VisibleSelection is
+    // used to store values in editing commands for use when
+    // undoing the command. We need to be able to create a selection that, while currently
+    // invalid, will be valid once the changes are undone.
+    
     Position m_base;   // Where the first click happened
     Position m_extent; // Where the end click happened
     Position m_start;  // Leftmost position when expanded to respect granularity
     Position m_end;    // Rightmost position when expanded to respect granularity
 
     EAffinity m_affinity;           // the upstream/downstream affinity of the caret
-    TextGranularity m_granularity;  // granularity of start/end selection
 
     // these are cached, can be recalculated by validate()
     SelectionType m_selectionType;    // None, Caret, Range
@@ -130,7 +132,7 @@ private:
 
 inline bool operator==(const VisibleSelection& a, const VisibleSelection& b)
 {
-    return a.start() == b.start() && a.end() == b.end() && a.affinity() == b.affinity() && a.granularity() == b.granularity() && a.isBaseFirst() == b.isBaseFirst();
+    return a.start() == b.start() && a.end() == b.end() && a.affinity() == b.affinity() && a.isBaseFirst() == b.isBaseFirst();
 }
 
 inline bool operator!=(const VisibleSelection& a, const VisibleSelection& b)
diff --git a/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.cpp b/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.cpp
index 7622c1e814..5fa0b397a6 100644
--- a/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.cpp
@@ -38,35 +38,37 @@ WrapContentsInDummySpanCommand::WrapContentsInDummySpanCommand(PassRefPtr<Elemen
     ASSERT(m_element);
 }
 
-void WrapContentsInDummySpanCommand::doApply()
+void WrapContentsInDummySpanCommand::executeApply()
 {
     Vector<RefPtr<Node> > children;
     for (Node* child = m_element->firstChild(); child; child = child->nextSibling())
         children.append(child);
-
-    RefPtr<HTMLElement> span = createStyleSpanElement(document());
- 
+    
     ExceptionCode ec;
-
+    
     size_t size = children.size();
     for (size_t i = 0; i < size; ++i)
-        span->appendChild(children[i].release(), ec);
-
-    m_element->appendChild(span.get(), ec);
-
-    m_dummySpan = span.release();
+        m_dummySpan->appendChild(children[i].release(), ec);
+    
+    m_element->appendChild(m_dummySpan.get(), ec);
 }
 
+void WrapContentsInDummySpanCommand::doApply()
+{
+    m_dummySpan = createStyleSpanElement(document());
+    
+    executeApply();
+}
+    
 void WrapContentsInDummySpanCommand::doUnapply()
 {
     ASSERT(m_element);
 
-    RefPtr<HTMLElement> span = m_dummySpan.release();
-    if (!span)
+    if (!m_dummySpan || !m_element->isContentEditable())
         return;
 
     Vector<RefPtr<Node> > children;
-    for (Node* child = span->firstChild(); child; child = child->nextSibling())
+    for (Node* child = m_dummySpan->firstChild(); child; child = child->nextSibling())
         children.append(child);
 
     ExceptionCode ec;
@@ -75,7 +77,17 @@ void WrapContentsInDummySpanCommand::doUnapply()
     for (size_t i = 0; i < size; ++i)
         m_element->appendChild(children[i].release(), ec);
 
-    span->remove(ec);
+    m_dummySpan->remove(ec);
 }
 
+void WrapContentsInDummySpanCommand::doReapply()
+{
+    ASSERT(m_element);
+    
+    if (!m_dummySpan || !m_element->isContentEditable())
+        return;
+
+    executeApply();
+}
+    
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.h b/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.h
index b12131a35f..be3af6623a 100644
--- a/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.h
@@ -44,6 +44,8 @@ private:
 
     virtual void doApply();
     virtual void doUnapply();
+    virtual void doReapply();
+    void executeApply();
 
     RefPtr<Element> m_element;
     RefPtr<HTMLElement> m_dummySpan;
diff --git a/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp b/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
index d19ef6b687..7127535fef 100644
--- a/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
@@ -289,7 +289,7 @@ VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& positio
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.node()) ? positionInParentAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
     
-    if (p.node() && !p.node()->isDescendantOf(highestRoot))
+    if (p.node() && p.node() != highestRoot && !p.node()->isDescendantOf(highestRoot))
         return VisiblePosition();
     
     return VisiblePosition(p);
@@ -310,7 +310,7 @@ VisiblePosition lastEditablePositionBeforePositionInRoot(const Position& positio
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.node()) ? positionInParentBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
     
-    if (p.node() && !p.node()->isDescendantOf(highestRoot))
+    if (p.node() && p.node() != highestRoot && !p.node()->isDescendantOf(highestRoot))
         return VisiblePosition();
     
     return VisiblePosition(p);
@@ -474,26 +474,33 @@ bool validBlockTag(const AtomicString& blockTag)
     DEFINE_STATIC_LOCAL(HashSet<AtomicString>, blockTags, ());
     if (blockTags.isEmpty()) {
         blockTags.add(addressTag.localName());
+        blockTags.add(articleTag.localName());
+        blockTags.add(asideTag.localName());
         blockTags.add(blockquoteTag.localName());
         blockTags.add(ddTag.localName());
         blockTags.add(divTag.localName());
         blockTags.add(dlTag.localName());
         blockTags.add(dtTag.localName());
+        blockTags.add(footerTag.localName());
         blockTags.add(h1Tag.localName());
         blockTags.add(h2Tag.localName());
         blockTags.add(h3Tag.localName());
         blockTags.add(h4Tag.localName());
         blockTags.add(h5Tag.localName());
         blockTags.add(h6Tag.localName());
+        blockTags.add(headerTag.localName());
+        blockTags.add(hgroupTag.localName());
         blockTags.add(navTag.localName());
         blockTags.add(pTag.localName());
         blockTags.add(preTag.localName());
+        blockTags.add(sectionTag.localName());
     }
     return blockTags.contains(blockTag);
 }
 
 static Node* firstInSpecialElement(const Position& pos)
 {
+    // FIXME: This begins at pos.node(), which doesn't necessarily contain pos (suppose pos was [img, 0]).  See <rdar://problem/5027702>.
     Node* rootEditableElement = pos.node()->rootEditableElement();
     for (Node* n = pos.node(); n && n->rootEditableElement() == rootEditableElement; n = n->parentNode())
         if (isSpecialElement(n)) {
@@ -509,6 +516,7 @@ static Node* firstInSpecialElement(const Position& pos)
 
 static Node* lastInSpecialElement(const Position& pos)
 {
+    // FIXME: This begins at pos.node(), which doesn't necessarily contain pos (suppose pos was [img, 0]).  See <rdar://problem/5027702>.
     Node* rootEditableElement = pos.node()->rootEditableElement();
     for (Node* n = pos.node(); n && n->rootEditableElement() == rootEditableElement; n = n->parentNode())
         if (isSpecialElement(n)) {
@@ -651,6 +659,11 @@ bool isListElement(Node *n)
     return (n && (n->hasTagName(ulTag) || n->hasTagName(olTag) || n->hasTagName(dlTag)));
 }
 
+bool isListItem(Node *n)
+{
+    return n && n->renderer() && n->renderer()->isListItem();
+}
+
 Node* enclosingNodeWithTag(const Position& p, const QualifiedName& tagName)
 {
     if (p.isNull())
@@ -772,7 +785,7 @@ static Node* appendedSublist(Node* listItem)
     for (Node* n = listItem->nextSibling(); n; n = n->nextSibling()) {
         if (isListElement(n))
             return static_cast<HTMLElement*>(n);
-        if (n->renderer() && n->renderer()->isListItem())
+        if (isListItem(listItem))
             return 0;
     }
     
@@ -849,6 +862,11 @@ bool isTableCell(const Node* node)
     return r->isTableCell();
 }
 
+bool isEmptyTableCell(const Node* node)
+{
+    return node && node->renderer() && (node->renderer()->isTableCell() || (node->renderer()->isBR() && node->parentNode()->renderer() && node->parentNode()->renderer()->isTableCell()));     
+}
+
 PassRefPtr<HTMLElement> createDefaultParagraphElement(Document* document)
 {
     return new HTMLDivElement(divTag, document);
@@ -899,6 +917,16 @@ Node *tabSpanNode(const Node *node)
     return isTabSpanTextNode(node) ? node->parentNode() : 0;
 }
 
+bool isNodeInTextFormControl(Node* node)
+{
+    if (!node)
+        return false;
+    Node* ancestor = node->shadowAncestorNode();
+    if (ancestor == node)
+        return false;
+    return ancestor->isElementNode() && static_cast<Element*>(ancestor)->isTextFormControl();
+}
+    
 Position positionBeforeTabSpan(const Position& pos)
 {
     Node *node = pos.node();
@@ -971,7 +999,7 @@ unsigned numEnclosingMailBlockquotes(const Position& p)
 
 bool isMailBlockquote(const Node *node)
 {
-    if (!node || (!node->isElementNode() && !node->hasTagName(blockquoteTag)))
+    if (!node || !node->hasTagName(blockquoteTag))
         return false;
         
     return static_cast<const Element *>(node)->getAttribute("type") == "cite";
@@ -1077,6 +1105,14 @@ bool isNodeVisiblyContainedWithin(Node* node, const Range* selectedRange)
         && visiblePositionAfterNode(node) == selectedRange->endPosition();
 }
 
+bool isRenderedAsNonInlineTableImageOrHR(const Node* node)
+{
+    if (!node)
+        return false;
+    RenderObject* renderer = node->renderer();
+    return renderer && ((renderer->isTable() && !renderer->isInline()) || (renderer->isImage() && !renderer->isInline()) || renderer->isHR());
+}
+
 PassRefPtr<Range> avoidIntersectionWithNode(const Range* range, Node* node)
 {
     if (!range)
diff --git a/src/3rdparty/webkit/WebCore/editing/htmlediting.h b/src/3rdparty/webkit/WebCore/editing/htmlediting.h
index f44181c762..1559fa5596 100644
--- a/src/3rdparty/webkit/WebCore/editing/htmlediting.h
+++ b/src/3rdparty/webkit/WebCore/editing/htmlediting.h
@@ -87,11 +87,14 @@ bool isTabSpanTextNode(const Node*);
 bool isMailBlockquote(const Node*);
 bool isTableElement(Node*);
 bool isTableCell(const Node*);
+bool isEmptyTableCell(const Node*);
 bool isTableStructureNode(const Node*);
 bool isListElement(Node*);
+bool isListItem(Node*);
 bool isNodeRendered(const Node*);
 bool isNodeVisiblyContainedWithin(Node*, const Range*);
-    
+bool isRenderedAsNonInlineTableImageOrHR(const Node*);
+bool isNodeInTextFormControl(Node* node);
     
 // -------------------------------------------------------------------------
 // Position
diff --git a/src/3rdparty/webkit/WebCore/editing/markup.cpp b/src/3rdparty/webkit/WebCore/editing/markup.cpp
index 47714e7371..787dad992b 100644
--- a/src/3rdparty/webkit/WebCore/editing/markup.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/markup.cpp
@@ -55,6 +55,7 @@
 #include "Range.h"
 #include "VisibleSelection.h"
 #include "TextIterator.h"
+#include "XMLNSNames.h"
 #include "htmlediting.h"
 #include "visible_units.h"
 #include <wtf/StdLibExtras.h>
@@ -314,15 +315,15 @@ static bool shouldAddNamespaceElem(const Element* elem)
 
 static bool shouldAddNamespaceAttr(const Attribute* attr, HashMap<AtomicStringImpl*, AtomicStringImpl*>& namespaces)
 {
+    namespaces.checkConsistency();
+
     // Don't add namespace attributes twice
-    DEFINE_STATIC_LOCAL(const AtomicString, xmlnsURI, ("http://www.w3.org/2000/xmlns/"));
-    DEFINE_STATIC_LOCAL(const QualifiedName, xmlnsAttr, (nullAtom, "xmlns", xmlnsURI));
-    if (attr->name() == xmlnsAttr) {
+    if (attr->name() == XMLNSNames::xmlnsAttr) {
         namespaces.set(emptyAtom.impl(), attr->value().impl());
         return false;
     }
     
-    QualifiedName xmlnsPrefixAttr("xmlns", attr->localName(), xmlnsURI);
+    QualifiedName xmlnsPrefixAttr(xmlnsAtom, attr->localName(), XMLNSNames::xmlnsNamespaceURI);
     if (attr->name() == xmlnsPrefixAttr) {
         namespaces.set(attr->localName().impl(), attr->value().impl());
         return false;
@@ -333,6 +334,7 @@ static bool shouldAddNamespaceAttr(const Attribute* attr, HashMap<AtomicStringIm
 
 static void appendNamespace(Vector<UChar>& result, const AtomicString& prefix, const AtomicString& ns, HashMap<AtomicStringImpl*, AtomicStringImpl*>& namespaces)
 {
+    namespaces.checkConsistency();
     if (ns.isEmpty())
         return;
         
@@ -341,9 +343,8 @@ static void appendNamespace(Vector<UChar>& result, const AtomicString& prefix, c
     AtomicStringImpl* foundNS = namespaces.get(pre);
     if (foundNS != ns.impl()) {
         namespaces.set(pre, ns.impl());
-        DEFINE_STATIC_LOCAL(const String, xmlns, ("xmlns"));
         result.append(' ');
-        append(result, xmlns);
+        append(result, xmlnsAtom.string());
         if (!prefix.isEmpty()) {
             result.append(':');
             append(result, prefix);
@@ -394,6 +395,9 @@ enum RangeFullySelectsNode { DoesFullySelectNode, DoesNotFullySelectNode };
 
 static void appendStartMarkup(Vector<UChar>& result, const Node* node, const Range* range, EAnnotateForInterchange annotate, bool convertBlocksToInlines = false, HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0, RangeFullySelectsNode rangeFullySelectsNode = DoesFullySelectNode)
 {
+    if (namespaces)
+        namespaces->checkConsistency();
+
     bool documentIsHTML = node->document()->isHTMLDocument();
     switch (node->nodeType()) {
         case Node::TEXT_NODE: {
@@ -1052,13 +1056,9 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
     return joinMarkups(preMarkups, markups);
 }
 
-PassRefPtr<DocumentFragment> createFragmentFromMarkup(Document* document, const String& markup, const String& baseURL)
+PassRefPtr<DocumentFragment> createFragmentFromMarkup(Document* document, const String& markup, const String& baseURL, FragmentScriptingPermission scriptingPermission)
 {
-    ASSERT(document->documentElement()->isHTMLElement());
-    // FIXME: What if the document element is not an HTML element?
-    HTMLElement *element = static_cast<HTMLElement*>(document->documentElement());
-
-    RefPtr<DocumentFragment> fragment = element->createContextualFragment(markup);
+    RefPtr<DocumentFragment> fragment = document->documentElement()->createContextualFragment(markup, scriptingPermission);
 
     if (fragment && !baseURL.isEmpty() && baseURL != blankURL() && baseURL != document->baseURL())
         completeURLs(fragment.get(), baseURL);
@@ -1129,6 +1129,17 @@ static void fillContainerFromString(ContainerNode* paragraph, const String& stri
     }
 }
 
+bool isPlainTextMarkup(Node *node)
+{
+    if (!node->isElementNode() || !node->hasTagName(divTag) || static_cast<Element*>(node)->attributes()->length())
+        return false;
+    
+    if (node->childNodeCount() == 1 && (node->firstChild()->isTextNode() || (node->firstChild()->firstChild())))
+        return true;
+    
+    return (node->childNodeCount() == 2 && isTabSpanTextNode(node->firstChild()->firstChild()) && node->firstChild()->nextSibling()->isTextNode());
+}
+
 PassRefPtr<DocumentFragment> createFragmentFromText(Range* context, const String& text)
 {
     if (!context)
diff --git a/src/3rdparty/webkit/WebCore/editing/markup.h b/src/3rdparty/webkit/WebCore/editing/markup.h
index 6b7333cc7e..5ace04aeef 100644
--- a/src/3rdparty/webkit/WebCore/editing/markup.h
+++ b/src/3rdparty/webkit/WebCore/editing/markup.h
@@ -27,6 +27,7 @@
 #define markup_h
 
 #include "HTMLInterchange.h"
+#include "MappedAttributeEntry.h"
 #include <wtf/Forward.h>
 #include <wtf/Vector.h>
 
@@ -41,9 +42,11 @@ namespace WebCore {
     enum EChildrenOnly { IncludeNode, ChildrenOnly };
 
     PassRefPtr<DocumentFragment> createFragmentFromText(Range* context, const String& text);
-    PassRefPtr<DocumentFragment> createFragmentFromMarkup(Document*, const String& markup, const String& baseURL);
+    PassRefPtr<DocumentFragment> createFragmentFromMarkup(Document*, const String& markup, const String& baseURL, FragmentScriptingPermission = FragmentScriptingAllowed);
     PassRefPtr<DocumentFragment> createFragmentFromNodes(Document*, const Vector<Node*>&);
 
+    bool isPlainTextMarkup(Node *node);
+
     String createMarkup(const Range*,
         Vector<Node*>* = 0, EAnnotateForInterchange = DoNotAnnotateForInterchange, bool convertBlocksToInlines = false);
     String createMarkup(const Node*, EChildrenOnly = IncludeNode, Vector<Node*>* = 0);
diff --git a/src/3rdparty/webkit/WebCore/editing/visible_units.cpp b/src/3rdparty/webkit/WebCore/editing/visible_units.cpp
index c96fdfd5c2..3d85ad196a 100644
--- a/src/3rdparty/webkit/WebCore/editing/visible_units.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/visible_units.cpp
@@ -31,6 +31,7 @@
 #include "HTMLNames.h"
 #include "RenderBlock.h"
 #include "RenderLayer.h"
+#include "RenderObject.h"
 #include "TextBoundaries.h"
 #include "TextBreakIterator.h"
 #include "TextIterator.h"
@@ -253,6 +254,12 @@ static VisiblePosition nextBoundary(const VisiblePosition& c, BoundarySearchFunc
     return VisiblePosition(pos, VP_UPSTREAM_IF_POSSIBLE);
 }
 
+static bool canHaveCursor(RenderObject* o)
+{
+    return (o->isText() && toRenderText(o)->linesBoundingBox().height())
+        || (o->isBox() && toRenderBox(o)->borderBoundingBox().height());
+}
+
 // ---------
 
 static unsigned startWordBoundary(const UChar* characters, unsigned length, unsigned offset, BoundarySearchContextAvailability mayHaveMoreContext, bool& needMoreContext)
@@ -569,8 +576,12 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
     visiblePosition.getInlineBoxAndOffset(box, ignoredCaretOffset);
     if (box) {
         root = box->root()->prevRootBox();
-        if (root)
+        // We want to skip zero height boxes.
+        // This could happen in case it is a TrailingFloatsRootInlineBox.
+        if (root && root->height())
             containingBlock = renderer->containingBlock();
+        else
+            root = 0;
     }
 
     if (!root) {
@@ -586,17 +597,20 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
                 break;
             Position pos(n, caretMinOffset(n));
             if (pos.isCandidate()) {
-                ASSERT(n->renderer());
-                Position maxPos(n, caretMaxOffset(n));
-                maxPos.getInlineBoxAndOffset(DOWNSTREAM, box, ignoredCaretOffset);
-                if (box) {
-                    // previous root line box found
-                    root = box->root();
-                    containingBlock = n->renderer()->containingBlock();
-                    break;
+                RenderObject* o = n->renderer();
+                ASSERT(o);
+                if (canHaveCursor(o)) {
+                    Position maxPos(n, caretMaxOffset(n));
+                    maxPos.getInlineBoxAndOffset(DOWNSTREAM, box, ignoredCaretOffset);
+                    if (box) {
+                        // previous root line box found
+                        root = box->root();
+                        containingBlock = n->renderer()->containingBlock();
+                        break;
+                    }
+
+                    return VisiblePosition(pos, DOWNSTREAM);
                 }
-
-                return VisiblePosition(pos, DOWNSTREAM);
             }
             n = previousLeafWithSameEditability(n);
         }
@@ -671,8 +685,12 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int x)
     visiblePosition.getInlineBoxAndOffset(box, ignoredCaretOffset);
     if (box) {
         root = box->root()->nextRootBox();
-        if (root)
+        // We want to skip zero height boxes.
+        // This could happen in case it is a TrailingFloatsRootInlineBox.
+        if (root && root->height())
             containingBlock = renderer->containingBlock();
+        else
+            root = 0;
     }
 
     if (!root) {
@@ -776,12 +794,6 @@ VisiblePosition nextSentencePosition(const VisiblePosition &c)
     return c.honorEditableBoundaryAtOrBefore(next);
 }
 
-static bool renderedAsNonInlineTableOrHR(RenderObject* renderer)
-{
-    return renderer && ((renderer->isTable() && !renderer->isInline()) || renderer->isHR());
-}
-
-// FIXME: Broken for positions before/after images that aren't inline (5027702)
 VisiblePosition startOfParagraph(const VisiblePosition& c)
 {
     Position p = c.deepEquivalent();
@@ -790,7 +802,7 @@ VisiblePosition startOfParagraph(const VisiblePosition& c)
     if (!startNode)
         return VisiblePosition();
     
-    if (renderedAsNonInlineTableOrHR(startNode->renderer()) && p.atLastEditingPositionForNode())
+    if (isRenderedAsNonInlineTableImageOrHR(startNode))
         return firstDeepEditingPositionForNode(startNode);
 
     Node* startBlock = enclosingBlock(startNode);
@@ -841,7 +853,6 @@ VisiblePosition startOfParagraph(const VisiblePosition& c)
     return VisiblePosition(node, offset, DOWNSTREAM);
 }
 
-// FIXME: Broken for positions before/after images that aren't inline (5027702)
 VisiblePosition endOfParagraph(const VisiblePosition &c)
 {    
     if (c.isNull())
@@ -850,7 +861,7 @@ VisiblePosition endOfParagraph(const VisiblePosition &c)
     Position p = c.deepEquivalent();
     Node* startNode = p.node();
 
-    if (renderedAsNonInlineTableOrHR(startNode->renderer()) && p.atFirstEditingPositionForNode())
+    if (isRenderedAsNonInlineTableImageOrHR(startNode))
         return lastDeepEditingPositionForNode(startNode);
     
     Node* startBlock = enclosingBlock(startNode);
diff --git a/src/3rdparty/webkit/WebCore/generated/ArrayPrototype.lut.h b/src/3rdparty/webkit/WebCore/generated/ArrayPrototype.lut.h
deleted file mode 100644
index d3d7d36580..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/ArrayPrototype.lut.h
+++ /dev/null
@@ -1,34 +0,0 @@
-// Automatically generated from ../../JavaScriptCore/runtime/ArrayPrototype.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
-
-#include "Lookup.h"
-
-namespace JSC {
-
-static const struct HashTableValue arrayTableValues[22] = {
-   { "toString", DontEnum|Function, (intptr_t)arrayProtoFuncToString, (intptr_t)0 },
-   { "toLocaleString", DontEnum|Function, (intptr_t)arrayProtoFuncToLocaleString, (intptr_t)0 },
-   { "concat", DontEnum|Function, (intptr_t)arrayProtoFuncConcat, (intptr_t)1 },
-   { "join", DontEnum|Function, (intptr_t)arrayProtoFuncJoin, (intptr_t)1 },
-   { "pop", DontEnum|Function, (intptr_t)arrayProtoFuncPop, (intptr_t)0 },
-   { "push", DontEnum|Function, (intptr_t)arrayProtoFuncPush, (intptr_t)1 },
-   { "reverse", DontEnum|Function, (intptr_t)arrayProtoFuncReverse, (intptr_t)0 },
-   { "shift", DontEnum|Function, (intptr_t)arrayProtoFuncShift, (intptr_t)0 },
-   { "slice", DontEnum|Function, (intptr_t)arrayProtoFuncSlice, (intptr_t)2 },
-   { "sort", DontEnum|Function, (intptr_t)arrayProtoFuncSort, (intptr_t)1 },
-   { "splice", DontEnum|Function, (intptr_t)arrayProtoFuncSplice, (intptr_t)2 },
-   { "unshift", DontEnum|Function, (intptr_t)arrayProtoFuncUnShift, (intptr_t)1 },
-   { "every", DontEnum|Function, (intptr_t)arrayProtoFuncEvery, (intptr_t)1 },
-   { "forEach", DontEnum|Function, (intptr_t)arrayProtoFuncForEach, (intptr_t)1 },
-   { "some", DontEnum|Function, (intptr_t)arrayProtoFuncSome, (intptr_t)1 },
-   { "indexOf", DontEnum|Function, (intptr_t)arrayProtoFuncIndexOf, (intptr_t)1 },
-   { "lastIndexOf", DontEnum|Function, (intptr_t)arrayProtoFuncLastIndexOf, (intptr_t)1 },
-   { "filter", DontEnum|Function, (intptr_t)arrayProtoFuncFilter, (intptr_t)1 },
-   { "reduce", DontEnum|Function, (intptr_t)arrayProtoFuncReduce, (intptr_t)1 },
-   { "reduceRight", DontEnum|Function, (intptr_t)arrayProtoFuncReduceRight, (intptr_t)1 },
-   { "map", DontEnum|Function, (intptr_t)arrayProtoFuncMap, (intptr_t)1 },
-   { 0, 0, 0, 0 }
-};
-
-extern JSC_CONST_HASHTABLE HashTable arrayTable =
-    { 65, 63, arrayTableValues, 0 };
-} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
index 20e3fcbe6a..de393288ee 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
@@ -76,7 +76,7 @@
 /* Copy the first part of user declarations.  */
 
 /* Line 189 of yacc.c  */
-#line 1 "../css/CSSGrammar.y"
+#line 1 "css\\CSSGrammar.y"
 
 
 /*
@@ -137,7 +137,7 @@ using namespace HTMLNames;
 
 
 /* Line 189 of yacc.c  */
-#line 141 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+#line 141 "C:/dev/webkit-2.0/WebCore/generated/CSSGrammar.tab.c"
 
 /* Enabling traces.  */
 #ifndef YYDEBUG
@@ -238,7 +238,7 @@ typedef union YYSTYPE
 {
 
 /* Line 214 of yacc.c  */
-#line 62 "../css/CSSGrammar.y"
+#line 62 "css\\CSSGrammar.y"
 
     bool boolean;
     char character;
@@ -265,7 +265,7 @@ typedef union YYSTYPE
 
 
 /* Line 214 of yacc.c  */
-#line 269 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+#line 269 "C:/dev/webkit-2.0/WebCore/generated/CSSGrammar.tab.c"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
@@ -276,7 +276,7 @@ typedef union YYSTYPE
 /* Copy the second part of user declarations.  */
 
 /* Line 264 of yacc.c  */
-#line 86 "../css/CSSGrammar.y"
+#line 86 "css\\CSSGrammar.y"
 
 
 static inline int cssyyerror(const char*)
@@ -292,7 +292,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 
 /* Line 264 of yacc.c  */
-#line 296 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+#line 296 "C:/dev/webkit-2.0/WebCore/generated/CSSGrammar.tab.c"
 
 #ifdef short
 # undef short
@@ -507,16 +507,16 @@ union yyalloc
 /* YYFINAL -- State number of the termination state.  */
 #define YYFINAL  24
 /* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   1275
+#define YYLAST   1452
 
 /* YYNTOKENS -- Number of terminals.  */
 #define YYNTOKENS  86
 /* YYNNTS -- Number of nonterminals.  */
-#define YYNNTS  90
+#define YYNNTS  84
 /* YYNRULES -- Number of rules.  */
-#define YYNRULES  268
+#define YYNRULES  265
 /* YYNRULES -- Number of states.  */
-#define YYNSTATES  516
+#define YYNSTATES  512
 
 /* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX.  */
 #define YYUNDEFTOK  2
@@ -568,162 +568,162 @@ static const yytype_uint8 yytranslate[] =
    YYRHS.  */
 static const yytype_uint16 yyprhs[] =
 {
-       0,     0,     3,    11,    14,    17,    20,    23,    26,    29,
-      32,    34,    36,    43,    50,    56,    62,    68,    74,    80,
-      81,    84,    85,    88,    91,    92,    94,    96,    98,   104,
-     108,   112,   113,   117,   119,   120,   124,   125,   129,   130,
-     134,   136,   138,   140,   142,   144,   146,   148,   150,   152,
-     153,   157,   159,   161,   163,   165,   167,   169,   171,   173,
-     175,   182,   189,   193,   197,   205,   213,   214,   218,   220,
-     223,   225,   229,   231,   234,   238,   243,   247,   253,   258,
-     263,   270,   275,   283,   286,   292,   296,   301,   304,   311,
-     315,   319,   320,   323,   325,   327,   330,   331,   336,   344,
-     346,   352,   353,   357,   358,   360,   362,   364,   369,   370,
-     372,   374,   379,   382,   390,   397,   400,   409,   411,   413,
-     414,   418,   425,   427,   433,   435,   437,   441,   445,   453,
-     457,   461,   464,   467,   470,   472,   474,   480,   482,   487,
-     490,   493,   495,   497,   500,   504,   507,   509,   512,   515,
-     517,   520,   522,   525,   529,   532,   534,   536,   538,   541,
-     544,   546,   548,   550,   552,   554,   557,   560,   565,   574,
-     580,   590,   592,   594,   596,   598,   600,   602,   604,   606,
-     609,   613,   618,   623,   628,   635,   637,   640,   642,   646,
-     648,   651,   654,   658,   663,   667,   673,   678,   683,   690,
-     696,   699,   702,   709,   716,   719,   723,   728,   731,   734,
-     737,   738,   740,   744,   747,   750,   753,   754,   756,   759,
-     762,   765,   768,   772,   775,   778,   780,   783,   785,   788,
-     791,   794,   797,   800,   803,   806,   809,   812,   815,   818,
-     821,   824,   827,   830,   833,   836,   839,   842,   845,   848,
-     851,   854,   856,   862,   866,   869,   872,   874,   877,   881,
-     885,   888,   892,   894,   896,   899,   905,   909,   911
+       0,     0,     3,     8,    11,    14,    17,    20,    23,    26,
+      29,    36,    43,    49,    55,    61,    67,    73,    74,    77,
+      78,    81,    84,    85,    87,    89,    91,    97,   101,   105,
+     106,   110,   112,   114,   116,   118,   120,   122,   124,   126,
+     128,   130,   132,   133,   137,   139,   141,   143,   145,   147,
+     149,   151,   153,   155,   157,   159,   166,   173,   177,   181,
+     189,   197,   198,   202,   204,   207,   209,   213,   215,   218,
+     222,   227,   231,   237,   242,   247,   254,   259,   267,   270,
+     276,   280,   285,   288,   295,   302,   306,   310,   311,   314,
+     316,   318,   321,   322,   327,   335,   337,   343,   344,   348,
+     349,   351,   353,   355,   360,   361,   363,   365,   370,   373,
+     381,   388,   391,   400,   402,   404,   405,   409,   416,   418,
+     424,   426,   428,   432,   436,   444,   448,   452,   455,   458,
+     461,   463,   464,   466,   468,   474,   476,   481,   484,   487,
+     489,   491,   494,   498,   501,   503,   506,   509,   511,   514,
+     516,   519,   523,   526,   528,   530,   532,   535,   538,   540,
+     542,   544,   546,   548,   551,   554,   559,   568,   574,   584,
+     586,   588,   590,   592,   594,   596,   598,   600,   603,   607,
+     614,   622,   629,   636,   638,   641,   643,   647,   649,   652,
+     655,   659,   663,   668,   672,   678,   683,   688,   695,   701,
+     704,   707,   714,   721,   724,   728,   733,   736,   739,   742,
+     743,   745,   749,   752,   756,   759,   762,   765,   766,   768,
+     771,   774,   777,   780,   784,   787,   790,   792,   795,   797,
+     800,   803,   806,   809,   812,   815,   818,   821,   824,   827,
+     830,   833,   836,   839,   842,   845,   848,   851,   854,   857,
+     860,   863,   866,   868,   874,   878,   881,   884,   886,   889,
+     893,   897,   900,   906,   910,   912
 };
 
 /* YYRHS -- A `-1'-separated list of the rules' RHS.  */
 static const yytype_int16 yyrhs[] =
 {
-      87,     0,    -1,    96,    98,    97,   101,   102,   103,   104,
-      -1,    89,    96,    -1,    91,    96,    -1,    93,    96,    -1,
-      94,    96,    -1,    95,    96,    -1,    92,    96,    -1,    90,
-      96,    -1,   105,    -1,   110,    -1,    28,    71,    96,    88,
-      96,    72,    -1,    30,    71,    96,   134,    96,    72,    -1,
-      29,    71,    96,   156,    72,    -1,    38,    71,    96,   113,
-      72,    -1,    32,    71,    96,   161,    72,    -1,    33,     5,
-      96,   126,    72,    -1,    34,    71,    96,   142,    72,    -1,
-      -1,    96,     5,    -1,    -1,    97,     6,    -1,    97,     5,
-      -1,    -1,   100,    -1,    72,    -1,     0,    -1,    26,    96,
-      12,    96,    73,    -1,    26,     1,   174,    -1,    26,     1,
-      73,    -1,    -1,   101,   110,    97,    -1,   170,    -1,    -1,
-     102,   111,    97,    -1,    -1,   103,   117,    97,    -1,    -1,
-     104,   106,    97,    -1,   141,    -1,   129,    -1,   137,    -1,
-     138,    -1,   131,    -1,   105,    -1,   173,    -1,   169,    -1,
-     171,    -1,    -1,   107,   109,    97,    -1,   141,    -1,   137,
-      -1,   138,    -1,   131,    -1,   108,    -1,   173,    -1,   169,
-      -1,   171,    -1,   172,    -1,    22,    96,   119,    96,   127,
-      73,    -1,    22,    96,   119,    96,   127,   174,    -1,    22,
-       1,    73,    -1,    22,     1,   174,    -1,    35,    96,   127,
-      71,    96,   113,    72,    -1,    36,    96,   112,    71,    96,
-     113,    72,    -1,    -1,    37,     5,   128,    -1,   115,    -1,
-     114,   115,    -1,   114,    -1,     1,   175,     1,    -1,     1,
-      -1,   114,     1,    -1,   115,    73,    96,    -1,   115,   175,
-      73,    96,    -1,     1,    73,    96,    -1,     1,   175,     1,
-      73,    96,    -1,   114,   115,    73,    96,    -1,   114,     1,
-      73,    96,    -1,   114,     1,   175,     1,    73,    96,    -1,
-     116,    17,    96,   161,    -1,   116,    96,    71,    96,   156,
-      72,    96,    -1,   116,     1,    -1,   116,    17,    96,     1,
-     161,    -1,   116,    17,    96,    -1,   116,    17,    96,     1,
-      -1,    13,    96,    -1,    27,    96,   118,   119,    96,    73,
-      -1,    27,     1,   174,    -1,    27,     1,    73,    -1,    -1,
-      13,     5,    -1,    12,    -1,    66,    -1,    13,    96,    -1,
-      -1,    17,    96,   161,    96,    -1,    74,    96,   120,    96,
-     121,    75,    96,    -1,   122,    -1,   123,    96,    43,    96,
-     122,    -1,    -1,    43,    96,   123,    -1,    -1,    41,    -1,
-      42,    -1,   123,    -1,   125,    96,   130,   124,    -1,    -1,
-     128,    -1,   126,    -1,   128,    76,    96,   126,    -1,   128,
-       1,    -1,    24,    96,   128,    71,    96,   107,   168,    -1,
-      24,    96,    71,    96,   107,   168,    -1,    13,    96,    -1,
-      31,    96,   132,    96,    71,    96,   133,    72,    -1,    13,
-      -1,    12,    -1,    -1,   133,   134,    96,    -1,   135,    96,
-      71,    96,   156,    72,    -1,   136,    -1,   135,    96,    76,
-      96,   136,    -1,    63,    -1,    13,    -1,    23,     1,   174,
-      -1,    23,     1,    73,    -1,    25,    96,    71,    96,   156,
-      72,    96,    -1,    25,     1,   174,    -1,    25,     1,    73,
-      -1,    77,    96,    -1,    78,    96,    -1,    79,    96,    -1,
-      80,    -1,    77,    -1,   142,    71,    96,   156,    99,    -1,
-     144,    -1,   142,    76,    96,   144,    -1,   142,     1,    -1,
-     144,     5,    -1,   146,    -1,   143,    -1,   143,   146,    -1,
-     144,   139,   146,    -1,   144,     1,    -1,    21,    -1,    20,
-      21,    -1,    13,    21,    -1,   147,    -1,   147,   148,    -1,
-     148,    -1,   145,   147,    -1,   145,   147,   148,    -1,   145,
-     148,    -1,    13,    -1,    20,    -1,   149,    -1,   148,   149,
-      -1,   148,     1,    -1,    16,    -1,    15,    -1,   150,    -1,
-     152,    -1,   155,    -1,    18,    13,    -1,    13,    96,    -1,
-      19,    96,   151,    81,    -1,    19,    96,   151,   153,    96,
-     154,    96,    81,    -1,    19,    96,   145,   151,    81,    -1,
-      19,    96,   145,   151,   153,    96,   154,    96,    81,    -1,
-      82,    -1,     7,    -1,     8,    -1,     9,    -1,    10,    -1,
-      11,    -1,    13,    -1,    12,    -1,    17,    13,    -1,    17,
-      17,    13,    -1,    17,    67,    14,    75,    -1,    17,    67,
-      65,    75,    -1,    17,    67,    13,    75,    -1,    17,    68,
-      96,   146,    96,    75,    -1,   158,    -1,   157,   158,    -1,
-     157,    -1,     1,   175,     1,    -1,     1,    -1,   157,     1,
-      -1,   157,   175,    -1,   158,    73,    96,    -1,   158,   175,
-      73,    96,    -1,     1,    73,    96,    -1,     1,   175,     1,
-      73,    96,    -1,   157,   158,    73,    96,    -1,   157,     1,
-      73,    96,    -1,   157,     1,   175,     1,    73,    96,    -1,
-     159,    17,    96,   161,   160,    -1,   165,    96,    -1,   159,
-       1,    -1,   159,    17,    96,     1,   161,   160,    -1,   159,
-      17,    96,   161,   160,     1,    -1,    40,    96,    -1,   159,
-      17,    96,    -1,   159,    17,    96,     1,    -1,   159,   174,
-      -1,    13,    96,    -1,    40,    96,    -1,    -1,   163,    -1,
-     161,   162,   163,    -1,   161,     1,    -1,    83,    96,    -1,
-      76,    96,    -1,    -1,   164,    -1,   140,   164,    -1,    12,
-      96,    -1,    13,    96,    -1,    62,    96,    -1,   140,    62,
-      96,    -1,    66,    96,    -1,    69,    96,    -1,   167,    -1,
-      84,    96,    -1,   166,    -1,   165,    96,    -1,    85,    96,
-      -1,    65,    96,    -1,    64,    96,    -1,    63,    96,    -1,
-      48,    96,    -1,    49,    96,    -1,    50,    96,    -1,    51,
-      96,    -1,    52,    96,    -1,    53,    96,    -1,    54,    96,
-      -1,    55,    96,    -1,    56,    96,    -1,    57,    96,    -1,
-      58,    96,    -1,    59,    96,    -1,    60,    96,    -1,    61,
-      96,    -1,    46,    96,    -1,    45,    96,    -1,    47,    96,
-      -1,    44,    96,    -1,    70,    -1,    67,    96,   161,    75,
-      96,    -1,    67,    96,     1,    -1,    15,    96,    -1,    16,
-      96,    -1,    99,    -1,     1,    99,    -1,    39,     1,   174,
-      -1,    39,     1,    73,    -1,   169,    97,    -1,   170,   169,
-      97,    -1,   110,    -1,   129,    -1,     1,   174,    -1,    71,
-       1,   175,     1,    99,    -1,    71,     1,    99,    -1,   174,
-      -1,   175,     1,   174,    -1
+      87,     0,    -1,    95,    97,    96,   100,    -1,    88,    95,
+      -1,    90,    95,    -1,    92,    95,    -1,    93,    95,    -1,
+      94,    95,    -1,    91,    95,    -1,    89,    95,    -1,    28,
+      71,    95,   101,    95,    72,    -1,    30,    71,    95,   130,
+      95,    72,    -1,    29,    71,    95,   153,    72,    -1,    38,
+      71,    95,   109,    72,    -1,    32,    71,    95,   158,    72,
+      -1,    33,     5,    95,   122,    72,    -1,    34,    71,    95,
+     139,    72,    -1,    -1,    95,     5,    -1,    -1,    96,     6,
+      -1,    96,     5,    -1,    -1,    99,    -1,    72,    -1,     0,
+      -1,    26,    95,    12,    95,    73,    -1,    26,     1,   168,
+      -1,    26,     1,    73,    -1,    -1,   100,   102,    96,    -1,
+     138,    -1,   125,    -1,   133,    -1,   134,    -1,   127,    -1,
+     113,    -1,   106,    -1,   107,    -1,   101,    -1,   167,    -1,
+     166,    -1,    -1,   103,   105,    96,    -1,   138,    -1,   133,
+      -1,   134,    -1,   127,    -1,   104,    -1,   167,    -1,   166,
+      -1,   113,    -1,   106,    -1,   107,    -1,   125,    -1,    22,
+      95,   115,    95,   123,    73,    -1,    22,    95,   115,    95,
+     123,   168,    -1,    22,     1,    73,    -1,    22,     1,   168,
+      -1,    35,    95,   123,    71,    95,   109,    72,    -1,    36,
+      95,   108,    71,    95,   109,    72,    -1,    -1,    37,     5,
+     124,    -1,   111,    -1,   110,   111,    -1,   110,    -1,     1,
+     169,     1,    -1,     1,    -1,   110,     1,    -1,   111,    73,
+      95,    -1,   111,   169,    73,    95,    -1,     1,    73,    95,
+      -1,     1,   169,     1,    73,    95,    -1,   110,   111,    73,
+      95,    -1,   110,     1,    73,    95,    -1,   110,     1,   169,
+       1,    73,    95,    -1,   112,    17,    95,   158,    -1,   112,
+      95,    71,    95,   153,    72,    95,    -1,   112,     1,    -1,
+     112,    17,    95,     1,   158,    -1,   112,    17,    95,    -1,
+     112,    17,    95,     1,    -1,    13,    95,    -1,    27,    95,
+     114,   115,    95,    73,    -1,    27,    95,   114,   115,    95,
+     168,    -1,    27,     1,   168,    -1,    27,     1,    73,    -1,
+      -1,    13,    95,    -1,    12,    -1,    66,    -1,    13,    95,
+      -1,    -1,    17,    95,   158,    95,    -1,    74,    95,   116,
+      95,   117,    75,    95,    -1,   118,    -1,   119,    95,    43,
+      95,   118,    -1,    -1,    43,    95,   119,    -1,    -1,    41,
+      -1,    42,    -1,   119,    -1,   121,    95,   126,   120,    -1,
+      -1,   124,    -1,   122,    -1,   124,    76,    95,   122,    -1,
+     124,     1,    -1,    24,    95,   124,    71,    95,   103,   165,
+      -1,    24,    95,    71,    95,   103,   165,    -1,    13,    95,
+      -1,    31,    95,   128,    95,    71,    95,   129,    72,    -1,
+      13,    -1,    12,    -1,    -1,   129,   130,    95,    -1,   131,
+      95,    71,    95,   153,    72,    -1,   132,    -1,   131,    95,
+      76,    95,   132,    -1,    63,    -1,    13,    -1,    23,     1,
+     168,    -1,    23,     1,    73,    -1,    25,    95,    71,    95,
+     153,    72,    95,    -1,    25,     1,   168,    -1,    25,     1,
+      73,    -1,    77,    95,    -1,    78,    95,    -1,    79,    95,
+      -1,   137,    -1,    -1,    80,    -1,    77,    -1,   139,    71,
+      95,   153,    98,    -1,   141,    -1,   139,    76,    95,   141,
+      -1,   139,     1,    -1,   141,     5,    -1,   143,    -1,   140,
+      -1,   140,   143,    -1,   141,   135,   143,    -1,   141,     1,
+      -1,    21,    -1,    20,    21,    -1,    13,    21,    -1,   144,
+      -1,   144,   145,    -1,   145,    -1,   142,   144,    -1,   142,
+     144,   145,    -1,   142,   145,    -1,    13,    -1,    20,    -1,
+     146,    -1,   145,   146,    -1,   145,     1,    -1,    16,    -1,
+      15,    -1,   147,    -1,   149,    -1,   152,    -1,    18,    13,
+      -1,    13,    95,    -1,    19,    95,   148,    81,    -1,    19,
+      95,   148,   150,    95,   151,    95,    81,    -1,    19,    95,
+     142,   148,    81,    -1,    19,    95,   142,   148,   150,    95,
+     151,    95,    81,    -1,    82,    -1,     7,    -1,     8,    -1,
+       9,    -1,    10,    -1,    11,    -1,    13,    -1,    12,    -1,
+      17,    13,    -1,    17,    17,    13,    -1,    17,    67,    95,
+      14,    95,    75,    -1,    17,    67,    95,   136,    65,    95,
+      75,    -1,    17,    67,    95,    13,    95,    75,    -1,    17,
+      68,    95,   143,    95,    75,    -1,   155,    -1,   154,   155,
+      -1,   154,    -1,     1,   169,     1,    -1,     1,    -1,   154,
+       1,    -1,   154,   169,    -1,   155,    73,    95,    -1,   155,
+     169,    95,    -1,   155,   169,    73,    95,    -1,     1,    73,
+      95,    -1,     1,   169,     1,    73,    95,    -1,   154,   155,
+      73,    95,    -1,   154,     1,    73,    95,    -1,   154,     1,
+     169,     1,    73,    95,    -1,   156,    17,    95,   158,   157,
+      -1,   162,    95,    -1,   156,     1,    -1,   156,    17,    95,
+       1,   158,   157,    -1,   156,    17,    95,   158,   157,     1,
+      -1,    40,    95,    -1,   156,    17,    95,    -1,   156,    17,
+      95,     1,    -1,   156,   168,    -1,    13,    95,    -1,    40,
+      95,    -1,    -1,   160,    -1,   158,   159,   160,    -1,   158,
+     169,    -1,   158,   169,     1,    -1,   158,     1,    -1,    83,
+      95,    -1,    76,    95,    -1,    -1,   161,    -1,   137,   161,
+      -1,    12,    95,    -1,    13,    95,    -1,    62,    95,    -1,
+     137,    62,    95,    -1,    66,    95,    -1,    69,    95,    -1,
+     164,    -1,    84,    95,    -1,   163,    -1,   162,    95,    -1,
+      85,    95,    -1,    65,    95,    -1,    64,    95,    -1,    63,
+      95,    -1,    48,    95,    -1,    49,    95,    -1,    50,    95,
+      -1,    51,    95,    -1,    52,    95,    -1,    53,    95,    -1,
+      54,    95,    -1,    55,    95,    -1,    56,    95,    -1,    57,
+      95,    -1,    58,    95,    -1,    59,    95,    -1,    60,    95,
+      -1,    61,    95,    -1,    46,    95,    -1,    45,    95,    -1,
+      47,    95,    -1,    44,    95,    -1,    70,    -1,    67,    95,
+     158,    75,    95,    -1,    67,    95,     1,    -1,    15,    95,
+      -1,    16,    95,    -1,    98,    -1,     1,    98,    -1,    39,
+       1,   168,    -1,    39,     1,    73,    -1,     1,   168,    -1,
+      71,     1,   169,     1,    98,    -1,    71,     1,    98,    -1,
+     168,    -1,   169,     1,   168,    -1
 };
 
 /* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
 static const yytype_uint16 yyrline[] =
 {
-       0,   271,   271,   272,   273,   274,   275,   276,   277,   278,
-     282,   283,   287,   293,   299,   305,   311,   325,   332,   342,
-     343,   346,   348,   349,   352,   354,   359,   360,   364,   370,
-     372,   376,   378,   383,   387,   389,   396,   398,   401,   403,
-     411,   412,   413,   414,   415,   419,   420,   421,   422,   426,
-     427,   438,   439,   440,   441,   445,   446,   447,   448,   449,
-     454,   457,   460,   463,   469,   473,   479,   483,   489,   492,
-     497,   500,   503,   506,   512,   515,   518,   521,   524,   529,
-     532,   538,   542,   546,   550,   554,   559,   566,   572,   577,
-     578,   582,   583,   587,   588,   592,   598,   601,   607,   614,
-     619,   626,   629,   635,   638,   641,   647,   652,   660,   663,
-     667,   672,   677,   683,   686,   692,   698,   705,   706,   710,
-     711,   719,   725,   730,   739,   740,   764,   767,   773,   777,
-     780,   786,   787,   788,   792,   793,   797,   803,   812,   820,
-     826,   832,   835,   839,   855,   875,   881,   882,   883,   887,
-     892,   899,   905,   915,   927,   940,   948,   956,   959,   972,
-     978,   986,   998,   999,  1000,  1004,  1015,  1026,  1031,  1037,
-    1045,  1057,  1060,  1063,  1066,  1069,  1072,  1078,  1079,  1083,
-    1113,  1133,  1151,  1169,  1188,  1203,  1206,  1211,  1214,  1217,
-    1220,  1223,  1229,  1232,  1235,  1238,  1241,  1246,  1249,  1255,
-    1269,  1281,  1285,  1292,  1297,  1302,  1307,  1312,  1319,  1325,
-    1326,  1330,  1335,  1349,  1355,  1358,  1361,  1367,  1368,  1369,
-    1370,  1376,  1377,  1378,  1379,  1380,  1381,  1383,  1386,  1389,
-    1395,  1396,  1397,  1398,  1399,  1400,  1401,  1402,  1403,  1404,
-    1405,  1406,  1407,  1408,  1409,  1410,  1411,  1412,  1413,  1414,
-    1415,  1426,  1434,  1443,  1459,  1460,  1467,  1470,  1476,  1479,
-    1485,  1486,  1490,  1496,  1502,  1520,  1521,  1525,  1526
+       0,   269,   269,   270,   271,   272,   273,   274,   275,   276,
+     280,   286,   292,   298,   304,   318,   325,   335,   336,   339,
+     341,   342,   345,   347,   352,   353,   357,   363,   365,   369,
+     371,   379,   380,   381,   382,   383,   384,   385,   386,   390,
+     393,   394,   398,   399,   410,   411,   412,   413,   417,   418,
+     419,   420,   421,   422,   423,   428,   431,   434,   437,   443,
+     447,   453,   457,   463,   466,   471,   474,   477,   480,   486,
+     489,   492,   495,   498,   503,   506,   512,   516,   520,   524,
+     528,   533,   540,   546,   550,   553,   556,   562,   563,   567,
+     568,   572,   578,   581,   587,   594,   599,   606,   609,   615,
+     618,   621,   627,   632,   640,   643,   647,   652,   657,   663,
+     666,   672,   678,   685,   686,   690,   691,   699,   705,   710,
+     719,   720,   744,   747,   753,   757,   760,   766,   767,   768,
+     772,   773,   777,   778,   782,   788,   798,   807,   813,   819,
+     822,   826,   842,   862,   868,   869,   870,   874,   879,   886,
+     892,   902,   914,   927,   935,   943,   946,   959,   965,   973,
+     985,   986,   987,   991,  1002,  1013,  1018,  1024,  1032,  1044,
+    1047,  1050,  1053,  1056,  1059,  1065,  1066,  1070,  1100,  1120,
+    1138,  1156,  1175,  1190,  1193,  1198,  1201,  1204,  1207,  1210,
+    1216,  1219,  1222,  1225,  1228,  1231,  1236,  1239,  1245,  1259,
+    1271,  1275,  1282,  1287,  1292,  1297,  1302,  1309,  1315,  1316,
+    1320,  1325,  1339,  1342,  1345,  1351,  1354,  1357,  1363,  1364,
+    1365,  1366,  1372,  1373,  1374,  1375,  1376,  1377,  1379,  1382,
+    1385,  1391,  1392,  1393,  1394,  1395,  1396,  1397,  1398,  1399,
+    1400,  1401,  1402,  1403,  1404,  1405,  1406,  1407,  1408,  1409,
+    1410,  1411,  1422,  1430,  1439,  1455,  1456,  1463,  1466,  1472,
+    1475,  1481,  1499,  1502,  1508,  1509
 };
 #endif
 
@@ -746,29 +746,27 @@ static const char *const yytname[] =
   "SECS", "HERZ", "KHERZ", "DIMEN", "PERCENTAGE", "FLOATTOKEN", "INTEGER",
   "URI", "FUNCTION", "NOTFUNCTION", "UNICODERANGE", "VARCALL", "'{'",
   "'}'", "';'", "'('", "')'", "','", "'+'", "'~'", "'>'", "'-'", "']'",
-  "'='", "'/'", "'#'", "'%'", "$accept", "stylesheet",
-  "valid_rule_or_import", "webkit_rule", "webkit_keyframe_rule",
-  "webkit_decls", "webkit_variables_decls", "webkit_value",
-  "webkit_mediaquery", "webkit_selector", "maybe_space", "maybe_sgml",
-  "maybe_charset", "closing_brace", "charset", "import_list",
-  "variables_list", "namespace_list", "rule_list", "valid_rule", "rule",
-  "block_rule_list", "block_valid_rule", "block_rule", "import",
-  "variables_rule", "variables_media_list", "variables_declaration_list",
-  "variables_decl_list", "variables_declaration", "variable_name",
-  "namespace", "maybe_ns_prefix", "string_or_uri", "media_feature",
-  "maybe_media_value", "media_query_exp", "media_query_exp_list",
-  "maybe_and_media_query_exp_list", "maybe_media_restrictor",
-  "media_query", "maybe_media_list", "media_list", "media", "medium",
-  "keyframes", "keyframe_name", "keyframes_rule", "keyframe_rule",
-  "key_list", "key", "page", "font_face", "combinator", "unary_operator",
+  "'='", "'/'", "'#'", "'%'", "$accept", "stylesheet", "webkit_rule",
+  "webkit_keyframe_rule", "webkit_decls", "webkit_variables_decls",
+  "webkit_value", "webkit_mediaquery", "webkit_selector", "maybe_space",
+  "maybe_sgml", "maybe_charset", "closing_brace", "charset", "rule_list",
+  "valid_rule", "rule", "block_rule_list", "block_valid_rule",
+  "block_rule", "import", "variables_rule", "variables_media_list",
+  "variables_declaration_list", "variables_decl_list",
+  "variables_declaration", "variable_name", "namespace", "maybe_ns_prefix",
+  "string_or_uri", "media_feature", "maybe_media_value", "media_query_exp",
+  "media_query_exp_list", "maybe_and_media_query_exp_list",
+  "maybe_media_restrictor", "media_query", "maybe_media_list",
+  "media_list", "media", "medium", "keyframes", "keyframe_name",
+  "keyframes_rule", "keyframe_rule", "key_list", "key", "page",
+  "font_face", "combinator", "maybe_unary_operator", "unary_operator",
   "ruleset", "selector_list", "selector_with_trailing_whitespace",
   "selector", "namespace_selector", "simple_selector", "element_name",
   "specifier_list", "specifier", "class", "attr_name", "attrib", "match",
   "ident_or_string", "pseudo", "declaration_list", "decl_list",
   "declaration", "property", "prio", "expr", "operator", "term",
   "unary_term", "variable_reference", "function", "hexcolor", "save_block",
-  "invalid_at", "invalid_at_list", "invalid_import", "invalid_media",
-  "invalid_rule", "invalid_block", "invalid_block_list", 0
+  "invalid_at", "invalid_rule", "invalid_block", "invalid_block_list", 0
 };
 #endif
 
@@ -793,64 +791,64 @@ static const yytype_uint16 yytoknum[] =
 static const yytype_uint8 yyr1[] =
 {
        0,    86,    87,    87,    87,    87,    87,    87,    87,    87,
-      88,    88,    89,    90,    91,    92,    93,    94,    95,    96,
-      96,    97,    97,    97,    98,    98,    99,    99,   100,   100,
-     100,   101,   101,   101,   102,   102,   103,   103,   104,   104,
+      88,    89,    90,    91,    92,    93,    94,    95,    95,    96,
+      96,    96,    97,    97,    98,    98,    99,    99,    99,   100,
+     100,   101,   101,   101,   101,   101,   101,   101,   101,   102,
+     102,   102,   103,   103,   104,   104,   104,   104,   105,   105,
      105,   105,   105,   105,   105,   106,   106,   106,   106,   107,
-     107,   108,   108,   108,   108,   109,   109,   109,   109,   109,
-     110,   110,   110,   110,   111,   111,   112,   112,   113,   113,
-     113,   113,   113,   113,   114,   114,   114,   114,   114,   114,
-     114,   115,   115,   115,   115,   115,   115,   116,   117,   117,
-     117,   118,   118,   119,   119,   120,   121,   121,   122,   123,
-     123,   124,   124,   125,   125,   125,   126,   126,   127,   127,
-     128,   128,   128,   129,   129,   130,   131,   132,   132,   133,
-     133,   134,   135,   135,   136,   136,   137,   137,   138,   138,
-     138,   139,   139,   139,   140,   140,   141,   142,   142,   142,
-     143,   144,   144,   144,   144,   144,   145,   145,   145,   146,
-     146,   146,   146,   146,   146,   147,   147,   148,   148,   148,
-     149,   149,   149,   149,   149,   150,   151,   152,   152,   152,
-     152,   153,   153,   153,   153,   153,   153,   154,   154,   155,
-     155,   155,   155,   155,   155,   156,   156,   156,   156,   156,
-     156,   156,   157,   157,   157,   157,   157,   157,   157,   158,
-     158,   158,   158,   158,   158,   158,   158,   158,   159,   160,
-     160,   161,   161,   161,   162,   162,   162,   163,   163,   163,
-     163,   163,   163,   163,   163,   163,   163,   163,   163,   163,
-     164,   164,   164,   164,   164,   164,   164,   164,   164,   164,
-     164,   164,   164,   164,   164,   164,   164,   164,   164,   164,
-     164,   165,   166,   166,   167,   167,   168,   168,   169,   169,
-     170,   170,   171,   172,   173,   174,   174,   175,   175
+     107,   108,   108,   109,   109,   109,   109,   109,   109,   110,
+     110,   110,   110,   110,   110,   110,   111,   111,   111,   111,
+     111,   111,   112,   113,   113,   113,   113,   114,   114,   115,
+     115,   116,   117,   117,   118,   119,   119,   120,   120,   121,
+     121,   121,   122,   122,   123,   123,   124,   124,   124,   125,
+     125,   126,   127,   128,   128,   129,   129,   130,   131,   131,
+     132,   132,   133,   133,   134,   134,   134,   135,   135,   135,
+     136,   136,   137,   137,   138,   139,   139,   139,   140,   141,
+     141,   141,   141,   141,   142,   142,   142,   143,   143,   143,
+     143,   143,   143,   144,   144,   145,   145,   145,   146,   146,
+     146,   146,   146,   147,   148,   149,   149,   149,   149,   150,
+     150,   150,   150,   150,   150,   151,   151,   152,   152,   152,
+     152,   152,   152,   153,   153,   153,   153,   153,   153,   153,
+     154,   154,   154,   154,   154,   154,   154,   154,   155,   155,
+     155,   155,   155,   155,   155,   155,   155,   156,   157,   157,
+     158,   158,   158,   158,   158,   159,   159,   159,   160,   160,
+     160,   160,   160,   160,   160,   160,   160,   160,   160,   160,
+     160,   161,   161,   161,   161,   161,   161,   161,   161,   161,
+     161,   161,   161,   161,   161,   161,   161,   161,   161,   161,
+     161,   161,   162,   163,   163,   164,   164,   165,   165,   166,
+     166,   167,   168,   168,   169,   169
 };
 
 /* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN.  */
 static const yytype_uint8 yyr2[] =
 {
-       0,     2,     7,     2,     2,     2,     2,     2,     2,     2,
-       1,     1,     6,     6,     5,     5,     5,     5,     5,     0,
-       2,     0,     2,     2,     0,     1,     1,     1,     5,     3,
-       3,     0,     3,     1,     0,     3,     0,     3,     0,     3,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     0,
+       0,     2,     4,     2,     2,     2,     2,     2,     2,     2,
+       6,     6,     5,     5,     5,     5,     5,     0,     2,     0,
+       2,     2,     0,     1,     1,     1,     5,     3,     3,     0,
        3,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       6,     6,     3,     3,     7,     7,     0,     3,     1,     2,
-       1,     3,     1,     2,     3,     4,     3,     5,     4,     4,
-       6,     4,     7,     2,     5,     3,     4,     2,     6,     3,
-       3,     0,     2,     1,     1,     2,     0,     4,     7,     1,
-       5,     0,     3,     0,     1,     1,     1,     4,     0,     1,
-       1,     4,     2,     7,     6,     2,     8,     1,     1,     0,
-       3,     6,     1,     5,     1,     1,     3,     3,     7,     3,
-       3,     2,     2,     2,     1,     1,     5,     1,     4,     2,
-       2,     1,     1,     2,     3,     2,     1,     2,     2,     1,
-       2,     1,     2,     3,     2,     1,     1,     1,     2,     2,
-       1,     1,     1,     1,     1,     2,     2,     4,     8,     5,
-       9,     1,     1,     1,     1,     1,     1,     1,     1,     2,
-       3,     4,     4,     4,     6,     1,     2,     1,     3,     1,
-       2,     2,     3,     4,     3,     5,     4,     4,     6,     5,
-       2,     2,     6,     6,     2,     3,     4,     2,     2,     2,
-       0,     1,     3,     2,     2,     2,     0,     1,     2,     2,
-       2,     2,     3,     2,     2,     1,     2,     1,     2,     2,
+       1,     1,     0,     3,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     6,     6,     3,     3,     7,
+       7,     0,     3,     1,     2,     1,     3,     1,     2,     3,
+       4,     3,     5,     4,     4,     6,     4,     7,     2,     5,
+       3,     4,     2,     6,     6,     3,     3,     0,     2,     1,
+       1,     2,     0,     4,     7,     1,     5,     0,     3,     0,
+       1,     1,     1,     4,     0,     1,     1,     4,     2,     7,
+       6,     2,     8,     1,     1,     0,     3,     6,     1,     5,
+       1,     1,     3,     3,     7,     3,     3,     2,     2,     2,
+       1,     0,     1,     1,     5,     1,     4,     2,     2,     1,
+       1,     2,     3,     2,     1,     2,     2,     1,     2,     1,
+       2,     3,     2,     1,     1,     1,     2,     2,     1,     1,
+       1,     1,     1,     2,     2,     4,     8,     5,     9,     1,
+       1,     1,     1,     1,     1,     1,     1,     2,     3,     6,
+       7,     6,     6,     1,     2,     1,     3,     1,     2,     2,
+       3,     3,     4,     3,     5,     4,     4,     6,     5,     2,
+       2,     6,     6,     2,     3,     4,     2,     2,     2,     0,
+       1,     3,     2,     3,     2,     2,     2,     0,     1,     2,
+       2,     2,     2,     3,     2,     2,     1,     2,     1,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     1,     5,     3,     2,     2,     1,     2,     3,     3,
-       2,     3,     1,     1,     2,     5,     3,     1,     3
+       2,     2,     1,     5,     3,     2,     2,     1,     2,     3,
+       3,     2,     5,     3,     1,     3
 };
 
 /* YYDEFACT[STATE-NAME] -- Default rule to reduce with in state
@@ -858,472 +856,508 @@ static const yytype_uint8 yyr2[] =
    means the default is an error.  */
 static const yytype_uint16 yydefact[] =
 {
-      19,     0,     0,     0,     0,     0,     0,     0,     0,    19,
-      19,    19,    19,    19,    19,    19,    24,    19,    19,    19,
-      19,    19,    19,    19,     1,     3,     9,     4,     8,     5,
-       6,     7,    20,     0,    21,    25,     0,     0,     0,     0,
-     103,     0,     0,     0,     0,    31,   155,   161,   160,     0,
-       0,    19,   156,   146,     0,     0,    19,     0,    19,    19,
-      10,    11,    41,    44,    42,    43,    40,     0,   142,     0,
-       0,   141,   149,     0,   157,   162,   163,   164,   189,    19,
-      19,   251,     0,     0,   185,     0,    19,   125,   124,    19,
-      19,   122,    19,    19,    19,    19,    19,    19,    19,    19,
-      19,    19,    19,    19,    19,    19,    19,    19,    19,    19,
-      19,    19,    19,    19,    19,    19,    19,    19,    19,    19,
-      19,   135,   134,    19,    19,     0,     0,   211,   217,    19,
-     227,   225,   104,   105,    19,    99,   106,    19,     0,     0,
-      72,    19,     0,     0,    68,     0,     0,    30,    29,    19,
-      23,    22,     0,    34,    21,    33,   148,   179,     0,     0,
-      19,   165,     0,   147,     0,     0,     0,   103,     0,     0,
-       0,     0,   139,    19,    19,   143,   145,   140,    19,    19,
-      19,     0,   155,   156,   152,     0,     0,   159,   158,    19,
-     267,     0,   208,   204,    14,   190,   186,     0,    19,     0,
-     201,    19,   207,   200,     0,     0,   219,   220,   254,   255,
-     250,   248,   247,   249,   233,   234,   235,   236,   237,   238,
-     239,   240,   241,   242,   243,   244,   245,   246,   221,   232,
-     231,   230,   223,     0,   224,   226,   229,    19,   218,   213,
-      16,    19,    19,     0,   228,     0,     0,     0,    17,    18,
-      19,     0,    87,    15,    73,    69,    19,     0,    83,    19,
-       0,     0,     0,     0,    36,    21,   260,    21,   180,     0,
-       0,     0,     0,    19,     0,     0,     0,    62,    63,    93,
-      94,    19,   127,   126,    19,   110,     0,   130,   129,    19,
-     118,   117,    19,    12,     0,     0,   131,   132,   133,   144,
-       0,   194,   188,    19,     0,    19,     0,   192,    19,     0,
-      13,    19,    19,   253,     0,   222,   215,   214,   212,    19,
-      19,    19,    19,   101,    76,    71,    19,     0,    19,    74,
-      19,     0,    19,    27,    26,   266,     0,    28,   259,   258,
-      19,    19,    38,    21,    32,   261,   183,   181,   182,    19,
-     166,    19,     0,   172,   173,   174,   175,   176,   167,   171,
-      19,   108,    49,   112,    19,    19,     0,     0,     0,     0,
-      19,   268,   197,     0,   196,   193,   206,     0,     0,     0,
-      19,    95,    96,     0,   115,    19,   107,    19,    79,     0,
-      78,    75,    86,     0,     0,     0,   103,    66,     0,     0,
-      21,    35,     0,   169,    19,     0,     0,     0,     0,    49,
-     103,     0,    19,   136,   195,    19,     0,    19,     0,     0,
-     123,   252,    19,     0,   100,     0,    77,    19,     0,     0,
-     265,     0,     0,     0,     0,    91,     0,    45,    21,   262,
-      47,    48,    46,    37,   184,     0,   178,   177,    19,    60,
-      61,     0,   256,    55,    21,   263,    54,    52,    53,    51,
-     114,    57,    58,    59,    56,     0,   111,    19,   119,   198,
-     202,   209,   203,   121,     0,    19,   102,    80,    19,    19,
-     103,    19,    90,    89,     0,     0,   264,    39,    19,     0,
-     257,    50,   113,   128,     0,     0,    98,    82,     0,     0,
-       0,    92,    19,     0,   168,   116,    19,    97,     0,     0,
-       0,   170,   120,    64,    65,    88
+      17,     0,     0,     0,     0,     0,     0,     0,     0,    17,
+      17,    17,    17,    17,    17,    17,    22,    17,    17,    17,
+      17,    17,    17,    17,     1,     3,     9,     4,     8,     5,
+       6,     7,    18,     0,    19,    23,     0,     0,     0,     0,
+      99,     0,     0,     0,     0,    29,   153,   159,   158,     0,
+       0,    17,   154,   144,     0,     0,    17,     0,     0,    17,
+      17,    17,    17,    37,    38,    36,    32,    35,    33,    34,
+      31,     0,   140,     0,     0,   139,   147,     0,   155,   160,
+     161,   162,   187,    17,    17,   252,     0,     0,   183,     0,
+      17,   121,   120,    17,    17,   118,    17,    17,    17,    17,
+      17,    17,    17,    17,    17,    17,    17,    17,    17,    17,
+      17,    17,    17,    17,    17,    17,    17,    17,    17,    17,
+      17,    17,    17,    17,    17,   133,   132,    17,    17,     0,
+       0,   210,   218,    17,   228,   226,   100,   101,    17,    95,
+     102,    17,     0,     0,    67,    17,     0,     0,    63,     0,
+       0,    28,    27,    17,    21,    20,     0,   146,   177,     0,
+      17,    17,   163,     0,   145,     0,     0,     0,    99,     0,
+       0,     0,    87,     0,    99,    61,     0,   137,    17,    17,
+     141,   143,   138,    17,    17,    17,     0,   153,   154,   150,
+       0,     0,   157,   156,    17,   264,     0,   207,   203,    12,
+     188,   184,     0,    17,     0,   200,    17,   206,   199,     0,
+       0,   220,   221,   255,   256,   251,   249,   248,   250,   234,
+     235,   236,   237,   238,   239,   240,   241,   242,   243,   244,
+     245,   246,   247,   222,   233,   232,   231,   224,     0,   225,
+     227,   230,    17,   219,   214,    14,    17,    17,     0,     0,
+     229,     0,     0,     0,    15,    16,    17,     0,    82,    13,
+      68,    64,    17,     0,    78,    17,     0,     0,     0,     0,
+       0,    39,    19,    41,    40,   178,   131,     0,    17,     0,
+       0,     0,    57,    58,    89,    90,    17,   123,   122,    17,
+     106,     0,   126,   125,    17,    86,    85,    17,     0,   114,
+     113,    17,     0,     0,     0,     0,    10,     0,     0,   127,
+     128,   129,   142,     0,   193,   186,    17,     0,    17,     0,
+     190,    17,   191,     0,    11,    17,    17,   254,     0,   223,
+     216,   215,   211,   213,    17,    17,    17,    17,    97,    71,
+      66,    17,     0,    17,    69,    17,     0,    17,    25,    24,
+     263,     0,    26,   261,     0,    30,    17,    17,     0,   130,
+      17,   164,    17,     0,   170,   171,   172,   173,   174,   165,
+     169,    17,   104,    42,   108,    17,    17,     0,    88,    17,
+       0,    17,    99,    17,     0,     0,    17,   265,   196,     0,
+     195,   192,   205,     0,     0,     0,    17,    91,    92,     0,
+     111,    17,   103,    17,    74,     0,    73,    70,    81,     0,
+       0,     0,   260,   259,     0,     0,    17,     0,   167,    17,
+       0,     0,     0,    42,    99,     0,     0,    17,     0,     0,
+       0,   134,   194,    17,     0,    17,     0,     0,   119,   253,
+      17,     0,    96,     0,    72,    17,     0,     0,   262,   181,
+     179,     0,   182,     0,   176,   175,    17,    55,    56,     0,
+     257,    48,    19,    52,    53,    51,    54,    47,    45,    46,
+      44,   110,    50,    49,     0,   107,    17,    83,    84,   115,
+       0,     0,   197,   201,   208,   202,   117,     0,    17,    98,
+      75,    17,   180,    17,     0,   258,    43,   109,   124,     0,
+      59,    60,     0,    94,    77,     0,   166,   112,    17,    93,
+     168,   116
 };
 
 /* YYDEFGOTO[NTERM-NUM].  */
 static const yytype_int16 yydefgoto[] =
 {
-      -1,     8,    59,     9,    10,    11,    12,    13,    14,    15,
-     246,    45,    34,   452,    35,   153,   264,   342,   399,    60,
-     438,   408,   453,   454,   439,   343,   433,   142,   143,   144,
-     145,   400,   485,   281,   320,   423,   135,   136,   386,   137,
-     285,   406,   407,    62,   323,    63,   292,   494,    89,    90,
-      91,    64,    65,   181,   125,    66,    67,    68,    69,    70,
-      71,    72,    73,    74,    75,   276,    76,   360,   448,    77,
-      82,    83,    84,    85,   418,   126,   243,   127,   128,   129,
-     130,   131,   460,   461,   155,   462,   463,   464,   190,   191
+      -1,     8,     9,    10,    11,    12,    13,    14,    15,   252,
+      45,    34,   460,    35,   156,    62,   272,   422,   461,   462,
+      63,    64,   305,   146,   147,   148,   149,    65,   298,   286,
+     335,   441,   139,   140,   402,   141,   290,   302,   303,    66,
+     338,    67,   301,   499,    93,    94,    95,    68,    69,   186,
+     358,   129,    70,    71,    72,    73,    74,    75,    76,    77,
+      78,    79,   281,    80,   371,   456,    81,    86,    87,    88,
+      89,   436,   130,   248,   131,   132,   133,   134,   135,   471,
+     472,   473,   195,   249
 };
 
 /* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
    STATE-NUM.  */
-#define YYPACT_NINF -240
+#define YYPACT_NINF -394
 static const yytype_int16 yypact[] =
 {
-     616,    -4,    91,   115,   122,    66,   194,   201,    72,  -240,
-    -240,  -240,  -240,  -240,  -240,  -240,    36,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,   244,   244,   244,   244,   244,
-     244,   244,  -240,   489,  -240,  -240,   844,   343,    25,  1131,
-     347,   557,   333,    -3,    37,    34,   257,  -240,  -240,   310,
-     291,  -240,   304,  -240,   495,   346,  -240,   220,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,  -240,  -240,    80,   640,   330,
-     703,  -240,   777,   152,  -240,  -240,  -240,  -240,   143,  -240,
-    -240,  -240,   278,   433,   212,   203,  -240,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,   964,   917,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,  -240,    41,  -240,   281,   163,
-     313,  -240,   290,   174,   326,   243,   362,  -240,  -240,  -240,
-    -240,  -240,   375,   359,  -240,   357,  -240,  -240,   387,    22,
-    -240,  -240,    32,  -240,   355,   179,   374,   295,   378,   200,
-     275,   183,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
-    -240,   640,  -240,  -240,   777,   191,   564,  -240,  -240,  -240,
-    -240,   404,   244,   244,  -240,   440,   337,    63,  -240,     4,
-    -240,  -240,  -240,   244,   185,   123,   244,   244,   244,   244,
-     244,   244,   244,   244,   244,   244,   244,   244,   244,   244,
-     244,   244,   244,   244,   244,   244,   244,   244,   244,   244,
-     244,   244,   244,  1068,   244,   244,   244,  -240,  -240,  -240,
-    -240,  -240,  -240,  1190,   244,   294,   233,   305,  -240,  -240,
-    -240,   418,   244,  -240,   493,   350,  -240,   129,  -240,  -240,
-     206,     3,   167,   513,     8,  -240,    42,  -240,  -240,   388,
-     389,   394,   557,   257,   304,   464,   286,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,  -240,   124,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,   343,   557,   244,   244,   244,  -240,
-     712,   244,   514,  -240,   479,  -240,   413,   244,  -240,   544,
-    -240,  -240,  -240,  -240,   991,   244,   244,   244,  -240,  -240,
-    -240,  -240,  -240,   446,   244,   547,  -240,   491,  -240,   244,
-    -240,   766,  -240,  -240,  -240,  -240,   492,  -240,  -240,  -240,
-    -240,  -240,   481,  -240,    42,    42,  -240,  -240,  -240,  -240,
-     244,  -240,   384,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
-    -240,   398,   244,  -240,  -240,  -240,   343,   208,   154,   353,
-    -240,  -240,   244,   552,   244,   244,  1190,   470,   343,    25,
-    -240,   244,   180,   160,   244,  -240,  -240,  -240,   244,   626,
-     244,   244,  1190,   618,   343,     3,   301,   227,   486,   921,
-    -240,    42,    56,  -240,  -240,   431,   638,    90,   437,   244,
-     347,   425,  -240,  -240,   244,  -240,   470,  -240,   181,   466,
-    -240,   244,  -240,   473,  -240,   160,   244,  -240,   692,   496,
-    -240,   441,   546,   487,   639,   311,   413,  -240,  -240,  -240,
-    -240,  -240,  -240,    42,  -240,   431,  -240,  -240,  -240,  -240,
-    -240,     3,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,   437,  -240,  -240,   244,   244,
-    -240,   244,  -240,  -240,  1131,  -240,    41,   244,  -240,  -240,
-     400,  -240,  -240,  -240,   558,    12,  -240,    42,  -240,     1,
-    -240,    42,  -240,   244,    13,   840,   244,   244,   333,   146,
-     333,  -240,  -240,     2,  -240,  -240,  -240,   244,   499,   540,
-     178,  -240,   244,  -240,  -240,  -240
+     466,   -18,    14,   125,   131,    42,   141,   164,    68,  -394,
+    -394,  -394,  -394,  -394,  -394,  -394,    37,  -394,  -394,  -394,
+    -394,  -394,  -394,  -394,  -394,    67,    67,    67,    67,    67,
+      67,    67,  -394,   453,  -394,  -394,   964,   304,   317,  1248,
+     246,   524,    36,   -25,    38,   481,   231,  -394,  -394,   341,
+     257,  -394,   270,  -394,   354,   327,  -394,   253,   416,  -394,
+    -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,
+    -394,    75,   598,   196,   674,  -394,   680,   154,  -394,  -394,
+    -394,  -394,    -4,  -394,  -394,  -394,   261,   413,   118,   198,
+    -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,
+    -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,
+    -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,
+    -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,   782,
+     960,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,
+       2,  -394,   281,    78,   339,  -394,   320,   173,   351,   219,
+     398,  -394,  -394,  -394,  -394,  -394,   739,  -394,  -394,   410,
+    -394,  -394,  -394,   447,  -394,   366,    23,   406,   298,   407,
+     182,   419,   297,   429,   326,    29,   171,  -394,  -394,  -394,
+    -394,  -394,  -394,  -394,  -394,  -394,   598,  -394,  -394,   680,
+     372,   456,  -394,  -394,  -394,  -394,   435,    67,    67,  -394,
+     434,   386,    91,  -394,   279,  -394,  -394,  -394,    67,   213,
+     129,    67,    67,    67,    67,    67,    67,    67,    67,    67,
+      67,    67,    67,    67,    67,    67,    67,    67,    67,    67,
+      67,    67,    67,    67,    67,    67,    67,    67,  1185,    67,
+      67,    67,  -394,  -394,  -394,  -394,  -394,  -394,  1307,   509,
+      67,   333,    27,   365,  -394,  -394,  -394,   437,    67,  -394,
+     444,   393,  -394,     4,  -394,  -394,   235,   177,    22,   418,
+     500,  -394,  -394,  -394,  -394,  -394,    60,   524,   231,   270,
+     493,   157,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,
+    -394,    86,  -394,  -394,  -394,  -394,  -394,  -394,   352,  -394,
+    -394,  -394,   440,   146,   507,   445,  -394,   304,   524,    67,
+      67,    67,  -394,   607,    67,   465,  -394,   518,  -394,   418,
+      67,  -394,    67,   661,  -394,  -394,  -394,  -394,  1034,    67,
+      67,    67,  -394,   418,  -394,  -394,  -394,  -394,   477,    67,
+     475,  -394,   522,  -394,    67,  -394,  1111,  -394,  -394,  -394,
+    -394,   529,  -394,  -394,   479,   481,  -394,  -394,   461,  -394,
+    -394,    67,  -394,   200,  -394,  -394,  -394,  -394,  -394,  -394,
+    -394,  -394,   389,    67,  -394,  -394,  -394,   304,    67,  -394,
+     271,  -394,    -3,  -394,    64,   236,  -394,  -394,    67,   525,
+      67,    67,  1307,   587,   304,   317,  -394,    67,    35,   190,
+      67,  -394,  -394,  -394,    67,   533,    67,    67,  1307,   735,
+     304,   177,  -394,  -394,     3,    81,  -394,   185,  -394,  -394,
+     457,   534,  1380,    67,   246,   505,   322,  -394,    36,   179,
+      36,  -394,    67,  -394,   587,  -394,   227,   511,  -394,    67,
+    -394,   472,  -394,   190,    67,  -394,   809,   519,  -394,  -394,
+    -394,   208,  -394,   457,  -394,  -394,  -394,  -394,  -394,   177,
+    -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,
+    -394,  -394,  -394,  -394,  1380,  -394,  -394,  -394,  -394,    67,
+     523,   537,    67,  -394,    67,  -394,  -394,  1248,  -394,     2,
+      67,  -394,  -394,  -394,    -1,  -394,   481,  -394,    67,   392,
+    -394,  -394,   883,    67,    67,     1,  -394,  -394,  -394,    67,
+    -394,    67
 };
 
 /* YYPGOTO[NTERM-NUM].  */
 static const yytype_int16 yypgoto[] =
 {
-    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
-       0,  -125,  -240,  -236,  -240,  -240,  -240,  -240,  -240,   168,
-    -240,   213,  -240,  -240,   -20,  -240,  -240,   -84,  -240,   483,
-    -240,  -240,  -240,   142,  -240,  -240,   249,   222,  -240,  -240,
-     -39,   241,  -165,  -232,  -240,  -126,  -240,  -240,   144,  -240,
-     272,  -110,  -106,  -240,  -240,   -91,   611,  -240,   391,   530,
-     -60,   630,   -38,   -42,  -240,   421,  -240,   354,   269,  -240,
-    -239,  -240,   632,  -240,   308,  -173,  -240,   482,   601,   -33,
-    -240,  -240,   267,   -17,  -240,   334,  -240,   335,   -16,   -18
+    -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,     0,
+    -269,  -394,  -236,  -394,  -394,   441,  -394,   167,  -394,  -394,
+    -393,  -386,  -394,   -24,  -394,   454,  -394,  -240,  -394,   312,
+    -394,  -394,   221,   178,  -394,  -394,   -39,   256,  -166,  -151,
+    -394,  -145,  -394,  -394,   130,  -394,   260,  -126,   -90,  -394,
+    -394,   399,   -59,   589,  -394,   357,   506,   -56,   594,   -50,
+     -47,  -394,   400,  -394,   318,   247,  -394,  -252,  -394,   601,
+    -394,   267,  -194,  -394,   455,   573,   -12,  -394,  -394,   230,
+     579,   581,    92,    44
 };
 
 /* YYTABLE[YYPACT[STATE-NUM]].  What to do in state STATE-NUM.  If
    positive, shift that token.  If negative, reduce the rule which
    number is the opposite.  If zero, do what YYDEFACT says.
    If YYTABLE_NINF, syntax error.  */
-#define YYTABLE_NINF -217
+#define YYTABLE_NINF -218
 static const yytype_int16 yytable[] =
 {
-      16,   138,   286,   333,    86,   306,    32,    32,   175,    25,
-      26,    27,    28,    29,    30,    31,    61,    36,    37,    38,
-      39,    40,    41,    42,   279,   335,    87,   148,   154,   266,
-      32,   188,   185,    44,   186,   269,   270,    32,    87,   150,
-     151,    32,    32,   340,   341,   273,   -19,   150,   151,   149,
-      86,   162,   274,    53,   165,   368,   167,   169,   170,   171,
-     314,    32,    33,  -191,   306,   197,   199,    17,   146,   202,
-     147,    21,    24,   152,   146,   334,    88,   308,   280,   192,
-     193,   172,   504,   511,   -19,   505,   203,   271,    88,   204,
-     205,   363,   206,   207,   208,   209,   210,   211,   212,   213,
-     214,   215,   216,   217,   218,   219,   220,   221,   222,   223,
-     224,   225,   226,   227,   228,   229,   230,   231,   232,   233,
-     234,   299,   251,   235,   236,   363,   257,   411,    32,   244,
-     306,   444,   413,   265,   245,  -191,   377,   247,   267,   419,
-     344,   252,   345,   188,   188,   260,   300,   363,   278,   262,
-     283,   173,   288,   187,   333,   429,   174,  -151,   393,   430,
-     272,  -109,    18,  -109,   172,    32,   365,    47,    48,    49,
-      50,    51,    32,   294,   295,   254,   455,   304,   296,   297,
-     298,  -199,   472,    32,    32,    32,    19,   141,    32,   301,
-      32,   279,   187,    20,   311,   364,  -154,   422,   307,   312,
-     365,   309,   330,   416,   200,    32,    47,    48,    49,    50,
-      51,    32,   349,    32,   146,   490,   189,   -67,   401,   428,
-     201,   168,   365,  -151,  -151,   -19,   334,  -151,  -151,  -151,
-    -151,  -151,    32,   455,   134,   249,   327,   315,    32,   174,
-     337,   316,   317,   336,   258,   280,   -70,   339,   -19,    32,
-     324,   515,  -199,  -199,  -199,   293,   329,   310,   188,   331,
-     259,    86,  -154,  -154,   432,    22,  -154,  -154,  -154,  -154,
-    -154,   289,    23,   350,   146,   443,   321,   332,   156,   412,
-      32,   361,   456,   146,   362,   198,   371,   290,   291,   366,
-     371,   -19,   367,   353,   354,   355,   356,   357,   457,    32,
-      32,   495,   458,   372,   161,   374,    32,   319,   375,   371,
-      32,   378,   379,   487,   -19,   499,    32,   459,   322,   381,
-     382,   383,   384,   157,   484,   163,   388,   158,   390,   491,
-     391,   176,   394,    86,   140,   177,   132,   133,    32,   456,
-     396,   397,   132,   133,    78,    86,   141,   166,    32,   402,
-     194,   350,    32,   248,   176,   457,    79,   371,   177,   458,
-     405,    86,   253,   261,   409,   410,   284,   358,   359,   134,
-     414,   466,  -108,   371,   459,   134,   263,   159,   160,   371,
-     421,    54,   440,    80,   146,   425,   250,   426,   132,   133,
-     450,   353,   354,   355,   356,   357,   152,   146,   435,   256,
-     268,  -137,  -137,    32,   445,   302,  -137,   178,   179,   180,
-     305,  -103,   468,    81,   508,   469,   509,   471,   483,   325,
-     486,   134,   474,   328,  -138,  -138,   146,   477,   277,  -138,
-     178,   179,   180,  -187,   195,   486,    32,   333,   451,   132,
-     133,   132,   133,   446,   447,   146,    79,   282,   489,   146,
-      46,   287,    47,    48,    49,    50,    51,    52,    53,    54,
-      55,    56,    57,   346,   347,   403,   359,   493,    58,   348,
-    -210,   239,   134,    80,   134,   496,   152,   351,   497,   498,
-     373,   500,  -216,  -216,   146,  -216,  -216,   434,   503,   385,
-      43,   -19,   389,   395,   -19,   507,   164,   467,   -19,   -19,
-     -19,   -19,   510,    81,   146,  -187,   512,   -19,   398,   334,
-     417,   146,   479,   303,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,   473,  -216,
-    -216,  -210,  -210,  -210,  -205,   376,   241,  -216,   475,    32,
-    -216,   480,   -19,   242,  -216,  -216,    92,    93,   481,    94,
-      95,   -19,    32,   501,   146,   187,   326,   437,   478,  -150,
-      46,   513,    47,    48,    49,    50,    51,    52,    53,    47,
-      48,    49,    50,    51,   146,   146,   338,   370,    96,    97,
-      98,    99,   100,   101,   102,   103,   104,   105,   106,   107,
-     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
-     118,   119,   514,   120,    81,  -205,  -205,  -205,   146,   239,
-     387,   121,   465,   146,   122,   415,   255,   502,   123,   124,
-    -216,  -216,   424,  -216,  -216,  -150,  -150,   431,   506,  -150,
-    -150,  -150,  -150,  -150,     1,     2,     3,   476,     4,     5,
-       6,   420,   139,    46,     7,    47,    48,    49,    50,    51,
-      52,    53,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,   369,  -216,  -216,   -81,
-     -81,   -81,   275,   239,   241,  -216,   352,   146,  -216,   427,
-     184,   242,  -216,  -216,  -216,  -216,   404,  -216,  -216,   146,
-     146,   449,   482,   187,   488,   196,   182,  -153,    47,    48,
-      49,    50,    51,   183,   470,   318,   238,    47,    48,    49,
-      50,    51,   492,   441,   442,     0,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-       0,  -216,  -216,   -84,   -84,   -84,     0,   392,   241,  -216,
-       0,    32,  -216,     0,     0,   242,  -216,  -216,    92,    93,
-       0,    94,    95,  -153,  -153,     0,     0,  -153,  -153,  -153,
-    -153,  -153,    47,    48,    49,    50,    51,     0,     0,     0,
+      16,   142,   291,   355,    32,   319,    32,   -17,    32,    25,
+      26,    27,    28,    29,    30,    31,   180,    36,    37,    38,
+      39,    40,    41,    42,   190,    90,   191,    32,    32,   463,
+     193,   350,    32,    44,    32,   284,   464,   144,   136,   137,
+      32,    32,    32,    32,   328,   -17,   150,    21,   151,   145,
+     153,   163,   440,    17,   166,   384,   168,   170,   172,   173,
+     174,   175,   176,    33,   348,    32,   304,   150,    24,   194,
+     336,   138,    32,   356,   357,    90,   177,   345,   449,   177,
+     506,   463,   510,   197,   198,    18,    32,   374,   464,   285,
+     208,  -189,   319,   209,   210,   352,   211,   212,   213,   214,
+     215,   216,   217,   218,   219,   220,   221,   222,   223,   224,
+     225,   226,   227,   228,   229,   230,   231,   232,   233,   234,
+     235,   236,   237,   238,   239,   425,   196,   240,   241,   393,
+     312,   202,   204,   250,    32,   152,   349,   125,   251,   313,
+     126,   253,   437,   193,   193,   258,   178,   374,   431,   266,
+     255,   179,   409,   268,   179,   192,   450,   375,   447,  -149,
+     276,   277,   376,  -189,   364,   365,   366,   367,   368,    47,
+      48,    49,    50,    51,   260,   448,    32,   348,   307,   308,
+     374,   207,   465,   309,   310,   311,   145,    32,   257,   150,
+      32,   203,   263,   496,   314,    32,    19,   181,   434,   205,
+     325,   182,    20,   320,   322,   326,   323,   364,   365,   366,
+     367,   368,    22,    32,   446,   206,   429,  -105,    32,  -105,
+     264,   360,   376,   495,   -17,  -149,  -149,  -198,   485,  -149,
+    -149,  -149,  -149,  -149,   465,    23,   265,   181,   369,   370,
+      32,   182,   329,   306,   317,   -65,   330,   331,   150,   349,
+     -62,    32,   157,   294,   169,   376,   339,   283,   -17,   288,
+     452,   293,   344,   296,   138,   346,   193,  -135,  -135,   150,
+     162,   466,  -135,   183,   184,   185,    32,   467,   361,   -17,
+     319,   418,   370,   492,   -17,   324,   372,   136,   137,   373,
+     -17,   164,   -17,   502,   377,    90,   468,   378,  -198,  -198,
+    -198,   380,    32,    32,   342,    82,   347,  -136,  -136,    32,
+     297,   351,  -136,   183,   184,   185,   388,    83,   390,   -17,
+     138,   391,    32,   466,   -17,   394,   395,    32,   167,   467,
+      91,    32,   469,   199,   397,   398,   399,   400,    32,   136,
+     137,   404,   427,   406,    84,   407,   334,   410,   468,   -17,
+     -17,   -17,   321,   254,   158,   165,   414,   415,   159,   -17,
+     417,   353,   361,   470,   284,    90,   -17,   136,   137,   289,
+      32,   420,   138,   192,    85,   423,   424,  -152,   337,   426,
+      92,   428,    90,   430,   469,   475,   432,    47,    48,    49,
+      50,    51,   259,   150,    32,   477,   439,  -104,    90,   267,
+     138,   443,   -99,   444,   480,    91,   481,   387,   160,   161,
+     150,   387,   256,  -185,   200,   470,   451,   171,   285,   453,
+     -17,   -17,   150,   275,   262,   387,    83,   479,   -17,   -17,
+     136,   137,   387,   482,    32,   484,   315,   150,   340,   282,
+     487,   299,   300,  -152,  -152,   490,   413,  -152,  -152,  -152,
+    -152,  -152,    32,    84,    43,    92,   494,   192,   -17,   318,
+     278,  -148,    32,   138,   507,   -17,   343,   279,    53,   454,
+     455,    47,    48,    49,    50,    51,   498,   150,   150,   287,
+     292,   387,   -17,    85,   150,  -185,   154,   155,   503,   150,
+     150,   504,   295,   505,     1,     2,     3,   387,     4,     5,
+       6,   354,   509,   387,     7,   150,   362,   316,   511,  -212,
+     333,   381,   382,   458,  -212,   150,   383,   341,   478,   389,
+     401,  -212,  -212,   405,  -212,  -212,   416,  -148,  -148,    32,
+     411,  -148,  -148,  -148,  -148,  -148,   150,    46,   386,    47,
+      48,    49,    50,    51,    52,    53,   150,   488,   403,  -212,
+     150,   353,   412,  -212,  -212,  -212,  -212,  -212,  -212,  -212,
+    -212,  -212,  -212,  -212,  -212,  -212,  -212,  -212,  -212,  -212,
+    -212,  -212,  -212,  -212,  -212,  -212,  -212,   476,  -212,  -212,
+    -212,  -212,  -212,   486,  -212,  -212,  -212,  -209,   244,  -212,
+     474,   491,  -212,  -212,  -212,   500,   150,   271,   433,  -217,
+    -217,   261,  -217,  -217,   150,   150,   445,   457,   192,   501,
+     379,    46,  -151,    47,    48,    49,    50,    51,    52,    53,
+     442,   489,    47,    48,    49,    50,    51,   435,   421,   508,
+     143,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,   438,  -217,  -217,   150,  -209,
+    -209,  -204,   392,   246,  -217,   385,    32,  -217,   189,   280,
+     247,  -217,  -217,    96,    97,   359,    98,    99,  -151,  -151,
+     363,   419,  -151,  -151,  -151,  -151,  -151,   187,   201,    47,
+      48,    49,    50,    51,   188,    47,    48,    49,    50,    51,
+     493,   483,   243,   332,   497,   100,   101,   102,   103,   104,
+     105,   106,   107,   108,   109,   110,   111,   112,   113,   114,
+     115,   116,   117,   118,   119,   120,   121,   122,   123,     0,
+     124,    85,  -204,  -204,  -204,   273,   244,   274,   125,    -2,
+     269,   126,     0,     0,     0,   127,   128,  -217,  -217,     0,
+    -217,  -217,    46,     0,    47,    48,    49,    50,    51,    52,
+      53,    54,    55,    56,    57,     0,    58,     0,     0,     0,
+      59,     0,     0,     0,    60,    61,     0,     0,   270,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,     0,  -217,  -217,   150,   -76,   -76,     0,
+     244,   246,  -217,     0,     0,  -217,     0,     0,   247,  -217,
+    -217,  -217,  -217,     0,  -217,  -217,   100,   101,   102,   103,
+     104,   105,   106,   107,   108,   109,   110,   111,   112,   113,
+     114,   115,   116,   117,   242,   119,   120,   121,     0,     0,
+       0,     0,     0,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,     0,  -217,  -217,
+     150,   -79,   -79,     0,   244,   246,  -217,     0,   -17,  -217,
+       0,     0,   247,  -217,  -217,  -217,  -217,     0,  -217,  -217,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-      96,    97,    98,    99,   100,   101,   102,   103,   104,   105,
-     106,   107,   108,   109,   110,   111,   112,   113,   114,   115,
-     116,   117,   118,   119,     0,   120,    81,   -85,   -85,   -85,
-       0,   239,     0,   121,     0,   -19,   122,     0,     0,    32,
-     123,   124,  -216,  -216,     0,  -216,  -216,    46,     0,    47,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,     0,  -217,  -217,   150,     0,     0,     0,   -17,   246,
+    -217,   244,     0,  -217,     0,     0,   247,  -217,  -217,    32,
+       0,     0,  -217,  -217,     0,  -217,  -217,    46,     0,    47,
       48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-       0,     0,     0,     0,     0,    58,     0,     0,     0,     0,
-       0,     0,     0,     0,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,     0,  -216,
-    -216,     0,     0,     0,     0,   -19,   241,  -216,   239,     0,
-    -216,    -2,   436,   242,  -216,  -216,     0,     0,     0,  -216,
-    -216,     0,  -216,  -216,    46,     0,    47,    48,    49,    50,
-      51,    52,    53,    54,    55,    56,    57,     0,     0,     0,
-       0,     0,    58,     0,     0,     0,     0,     0,     0,     0,
-     152,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,     0,  -216,  -216,     0,   240,
-       0,     0,   239,   241,  -216,     0,     0,  -216,     0,     0,
-     242,  -216,  -216,  -216,  -216,     0,  -216,  -216,    96,    97,
-      98,    99,   100,   101,   102,   103,   104,   105,   106,   107,
-     108,   109,   110,   111,   112,   113,   237,   115,   116,   117,
-       0,     0,     0,     0,     0,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,     0,
-    -216,  -216,     0,     0,     0,     0,   380,   241,  -216,   313,
-       0,  -216,     0,    32,   242,  -216,  -216,     0,     0,     0,
-      92,    93,     0,    94,    95,     0,     0,     0,     0,     0,
+       0,    58,     0,     0,     0,    59,     0,     0,     0,    60,
+      61,     0,     0,     0,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,     0,  -217,
+    -217,   150,   245,     0,     0,   244,   246,  -217,     0,     0,
+    -217,     0,     0,   247,  -217,  -217,  -217,  -217,     0,  -217,
+    -217,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,     0,  -217,  -217,   150,     0,     0,     0,   396,
+     246,  -217,   408,     0,  -217,     0,    32,   247,  -217,  -217,
+       0,     0,     0,    96,    97,     0,    98,    99,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,    96,    97,    98,    99,   100,   101,   102,   103,
-     104,   105,   106,   107,   108,   109,   110,   111,   112,   113,
-     114,   115,   116,   117,   118,   119,    32,   120,    81,     0,
-       0,     0,     0,    92,    93,   121,    94,    95,   122,     0,
-       0,     0,   123,   124,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,    96,    97,    98,    99,   100,
+       0,     0,     0,     0,     0,   100,   101,   102,   103,   104,
+     105,   106,   107,   108,   109,   110,   111,   112,   113,   114,
+     115,   116,   117,   118,   119,   120,   121,   122,   123,     0,
+     124,    85,   -80,   -80,   -80,     0,   327,     0,   125,     0,
+      32,   126,     0,     0,     0,   127,   128,    96,    97,     0,
+      98,    99,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,   100,
      101,   102,   103,   104,   105,   106,   107,   108,   109,   110,
-     111,   112,   113,   114,   115,   116,   117,   118,   119,     0,
-     120,    81,    92,    93,     0,    94,    95,     0,   121,     0,
-       0,   122,     0,     0,     0,   123,   124,     0,     0,     0,
+     111,   112,   113,   114,   115,   116,   117,   118,   119,   120,
+     121,   122,   123,    32,   124,    85,     0,     0,     0,     0,
+      96,    97,   125,    98,    99,   126,     0,     0,     0,   127,
+     128,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,   100,   101,   102,   103,   104,   105,   106,   107,
+     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
+     118,   119,   120,   121,   122,   123,     0,   124,    85,    96,
+      97,     0,    98,    99,     0,   125,     0,     0,   126,     0,
+       0,     0,   127,   128,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,   100,   101,   102,   103,   104,   105,   106,   107,   108,
+     109,   110,   111,   112,   113,   114,   115,   116,   117,   118,
+     119,   120,   121,   122,   123,     0,   124,    85,     0,     0,
+     348,   459,     0,     0,   125,     0,     0,   126,     0,     0,
+       0,   127,   128,    46,     0,    47,    48,    49,    50,    51,
+      52,    53,    54,    55,    56,    57,     0,    58,     0,     0,
+       0,    59,     0,     0,     0,    60,    61,     0,     0,   270,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,    96,    97,    98,    99,   100,   101,
-     102,   103,   104,   105,   106,   107,   108,   109,   110,   111,
-     112,   113,   114,   115,   116,   117,   118,   119,     0,   120,
-      81,     0,     0,     0,     0,     0,     0,   121,     0,     0,
-     122,     0,     0,     0,   123,   124
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,   349
 };
 
 static const yytype_int16 yycheck[] =
 {
-       0,    40,   167,     0,    37,     1,     5,     5,    68,     9,
-      10,    11,    12,    13,    14,    15,    36,    17,    18,    19,
-      20,    21,    22,    23,    12,   261,    13,    43,    45,   154,
-       5,    73,    70,    33,    72,    13,    14,     5,    13,     5,
-       6,     5,     5,    35,    36,    13,     5,     5,     6,    12,
-      83,    51,    20,    21,    54,   294,    56,    57,    58,    59,
-     233,     5,    26,     0,     1,    83,    84,    71,    71,    85,
-      73,     5,     0,    39,    71,    72,    63,    73,    66,    79,
-      80,     1,    81,    81,    43,    72,    86,    65,    63,    89,
-      90,     1,    92,    93,    94,    95,    96,    97,    98,    99,
+       0,    40,   168,   272,     5,     1,     5,     5,     5,     9,
+      10,    11,    12,    13,    14,    15,    72,    17,    18,    19,
+      20,    21,    22,    23,    74,    37,    76,     5,     5,   422,
+      77,   267,     5,    33,     5,    12,   422,     1,    41,    42,
+       5,     5,     5,     5,   238,    43,    71,     5,    73,    13,
+      12,    51,    17,    71,    54,   307,    56,    57,    58,    59,
+      60,    61,    62,    26,     0,     5,    37,    71,     0,    73,
+      43,    74,     5,    13,    14,    87,     1,    73,    75,     1,
+      81,   474,    81,    83,    84,    71,     5,     1,   474,    66,
+      90,     0,     1,    93,    94,    73,    96,    97,    98,    99,
      100,   101,   102,   103,   104,   105,   106,   107,   108,   109,
      110,   111,   112,   113,   114,   115,   116,   117,   118,   119,
-     120,   181,   140,   123,   124,     1,   144,   366,     5,   129,
-       1,    75,   368,   153,   134,    72,   309,   137,   155,   378,
-     265,   141,   267,   185,   186,   145,   184,     1,   164,   149,
-     166,    71,   168,     1,     0,   394,    76,     5,   331,   395,
-     160,    71,    71,    73,     1,     5,    76,    15,    16,    17,
-      18,    19,     5,   173,   174,     1,   408,   195,   178,   179,
-     180,     0,     1,     5,     5,     5,    71,    13,     5,   189,
-       5,    12,     1,    71,    71,    71,     5,    17,   198,    76,
-      76,   201,    73,   376,     1,     5,    15,    16,    17,    18,
-      19,     5,   272,     5,    71,   451,    73,    71,   343,   392,
-      17,     1,    76,    71,    72,     5,    72,    75,    76,    77,
-      78,    79,     5,   465,    74,    72,   254,   237,     5,    76,
-      73,   241,   242,   261,     1,    66,    72,   263,     5,     5,
-     250,    73,    71,    72,    73,    72,   256,    72,   300,   259,
-      17,   294,    71,    72,    37,    71,    75,    76,    77,    78,
-      79,    71,    71,   273,    71,   400,    43,    71,    21,    71,
-       5,   281,   408,    71,   284,    73,   302,    12,    13,   289,
-     306,    71,   292,     7,     8,     9,    10,    11,   408,     5,
-       5,   474,   408,   303,    13,   305,     5,    13,   308,   325,
-       5,   311,   312,   438,    71,   480,     5,   408,    13,   319,
-     320,   321,   322,    13,    13,    21,   326,    17,   328,   454,
-     330,     1,   332,   366,     1,     5,    41,    42,     5,   465,
-     340,   341,    41,    42,     1,   378,    13,     1,     5,   349,
-      72,   351,     5,    72,     1,   465,    13,   373,     5,   465,
-     360,   394,    72,     1,   364,   365,    71,    81,    82,    74,
-     370,   410,    71,   389,   465,    74,     1,    67,    68,   395,
-     380,    22,   399,    40,    71,   385,    73,   387,    41,    42,
-     406,     7,     8,     9,    10,    11,    39,    71,   398,    73,
-      13,    71,    72,     5,   404,     1,    76,    77,    78,    79,
-      73,    13,   412,    70,   498,   415,   500,   417,   434,     1,
-     436,    74,   422,    73,    71,    72,    71,   427,    73,    76,
-      77,    78,    79,     0,     1,   451,     5,     0,     1,    41,
-      42,    41,    42,    12,    13,    71,    13,    73,   448,    71,
-      13,    73,    15,    16,    17,    18,    19,    20,    21,    22,
-      23,    24,    25,    75,    75,    81,    82,   467,    31,    75,
-       0,     1,    74,    40,    74,   475,    39,    13,   478,   479,
-       1,   481,    12,    13,    71,    15,    16,     1,   488,    43,
-       1,     5,     1,     1,     5,   495,     1,    72,    12,    13,
-       5,    12,   502,    70,    71,    72,   506,    12,    27,    72,
-      40,    71,    71,    73,    44,    45,    46,    47,    48,    49,
-      50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
-      60,    61,    62,    63,    64,    65,    66,    67,    72,    69,
-      70,    71,    72,    73,     0,     1,    76,    77,    75,     5,
-      80,     5,    66,    83,    84,    85,    12,    13,    71,    15,
-      16,    66,     5,     5,    71,     1,    73,   399,    72,     5,
-      13,    72,    15,    16,    17,    18,    19,    20,    21,    15,
-      16,    17,    18,    19,    71,    71,    73,    73,    44,    45,
-      46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
-      56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-      66,    67,    72,    69,    70,    71,    72,    73,    71,     1,
-      73,    77,   409,    71,    80,    73,   143,   485,    84,    85,
-      12,    13,   383,    15,    16,    71,    72,   396,   494,    75,
-      76,    77,    78,    79,    28,    29,    30,   425,    32,    33,
-      34,   379,    41,    13,    38,    15,    16,    17,    18,    19,
-      20,    21,    44,    45,    46,    47,    48,    49,    50,    51,
-      52,    53,    54,    55,    56,    57,    58,    59,    60,    61,
-      62,    63,    64,    65,    66,    67,   295,    69,    70,    71,
-      72,    73,   162,     1,    76,    77,   275,    71,    80,    73,
-      70,    83,    84,    85,    12,    13,   352,    15,    16,    71,
-      71,    73,    73,     1,   445,    83,    13,     5,    15,    16,
-      17,    18,    19,    20,   416,   243,   125,    15,    16,    17,
-      18,    19,   465,   399,   399,    -1,    44,    45,    46,    47,
+     120,   121,   122,   123,   124,   377,    82,   127,   128,   323,
+     186,    87,    88,   133,     5,    43,    72,    77,   138,   189,
+      80,   141,   394,   190,   191,   145,    71,     1,   384,   149,
+      72,    76,   346,   153,    76,     1,    75,    71,   410,     5,
+     160,   161,    76,    72,     7,     8,     9,    10,    11,    15,
+      16,    17,    18,    19,     1,   411,     5,     0,   178,   179,
+       1,    89,   422,   183,   184,   185,    13,     5,   144,    71,
+       5,    73,   148,   462,   194,     5,    71,     1,   392,     1,
+      71,     5,    71,   203,   204,    76,   206,     7,     8,     9,
+      10,    11,    71,     5,   408,    17,   382,    71,     5,    73,
+       1,   277,    76,   459,     5,    71,    72,     0,     1,    75,
+      76,    77,    78,    79,   474,    71,    17,     1,    81,    82,
+       5,     5,   242,    72,   200,    72,   246,   247,    71,    72,
+      71,     5,    21,    71,     1,    76,   256,   165,     5,   167,
+      75,   169,   262,   171,    74,   265,   313,    71,    72,    71,
+      13,   422,    76,    77,    78,    79,     5,   422,   278,     0,
+       1,    81,    82,    75,     5,    72,   286,    41,    42,   289,
+      71,    21,    13,   487,   294,   307,   422,   297,    71,    72,
+      73,   301,     5,     5,   260,     1,    71,    71,    72,     5,
+      13,   267,    76,    77,    78,    79,   316,    13,   318,    40,
+      74,   321,     5,   474,    71,   325,   326,     5,     1,   474,
+      13,     5,   422,    72,   334,   335,   336,   337,     5,    41,
+      42,   341,    71,   343,    40,   345,    13,   347,   474,    70,
+      71,    72,    73,    72,    13,     1,   356,   357,    17,     5,
+     360,   269,   362,   422,    12,   377,    12,    41,    42,    71,
+       5,   371,    74,     1,    70,   375,   376,     5,    13,   379,
+      63,   381,   394,   383,   474,   424,   386,    15,    16,    17,
+      18,    19,    72,    71,     5,    73,   396,    71,   410,     1,
+      74,   401,    13,   403,   428,    13,   430,   315,    67,    68,
+      71,   319,    73,     0,     1,   474,   416,     1,    66,   419,
+      66,     5,    71,    13,    73,   333,    13,   427,    12,    13,
+      41,    42,   340,   433,     5,   435,     1,    71,     1,    73,
+     440,    12,    13,    71,    72,   445,   354,    75,    76,    77,
+      78,    79,     5,    40,     1,    63,   456,     1,     5,    73,
+      13,     5,     5,    74,    72,    12,    73,    20,    21,    12,
+      13,    15,    16,    17,    18,    19,   476,    71,    71,    73,
+      73,   389,    66,    70,    71,    72,     5,     6,   488,    71,
+      71,   491,    73,   493,    28,    29,    30,   405,    32,    33,
+      34,     1,   502,   411,    38,    71,    13,    73,   508,     0,
+       1,    71,     5,   421,     5,    71,    71,    73,   426,     1,
+      43,    12,    13,     1,    15,    16,    65,    71,    72,     5,
+       1,    75,    76,    77,    78,    79,    71,    13,    73,    15,
+      16,    17,    18,    19,    20,    21,    71,    75,    73,    40,
+      71,   459,    73,    44,    45,    46,    47,    48,    49,    50,
+      51,    52,    53,    54,    55,    56,    57,    58,    59,    60,
+      61,    62,    63,    64,    65,    66,    67,    72,    69,    70,
+      71,    72,    73,    72,    75,    76,    77,     0,     1,    80,
+     423,    72,    83,    84,    85,    72,    71,   156,    73,    12,
+      13,   147,    15,    16,    71,    71,    73,    73,     1,    72,
+     298,    13,     5,    15,    16,    17,    18,    19,    20,    21,
+     399,   443,    15,    16,    17,    18,    19,    40,   372,   499,
+      41,    44,    45,    46,    47,    48,    49,    50,    51,    52,
+      53,    54,    55,    56,    57,    58,    59,    60,    61,    62,
+      63,    64,    65,    66,    67,   395,    69,    70,    71,    72,
+      73,     0,     1,    76,    77,   308,     5,    80,    74,   163,
+      83,    84,    85,    12,    13,   276,    15,    16,    71,    72,
+     280,   363,    75,    76,    77,    78,    79,    13,    87,    15,
+      16,    17,    18,    19,    20,    15,    16,    17,    18,    19,
+     453,   434,   129,   248,   474,    44,    45,    46,    47,    48,
+      49,    50,    51,    52,    53,    54,    55,    56,    57,    58,
+      59,    60,    61,    62,    63,    64,    65,    66,    67,    -1,
+      69,    70,    71,    72,    73,   156,     1,   156,    77,     0,
+       1,    80,    -1,    -1,    -1,    84,    85,    12,    13,    -1,
+      15,    16,    13,    -1,    15,    16,    17,    18,    19,    20,
+      21,    22,    23,    24,    25,    -1,    27,    -1,    -1,    -1,
+      31,    -1,    -1,    -1,    35,    36,    -1,    -1,    39,    44,
+      45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
+      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
+      65,    66,    67,    -1,    69,    70,    71,    72,    73,    -1,
+       1,    76,    77,    -1,    -1,    80,    -1,    -1,    83,    84,
+      85,    12,    13,    -1,    15,    16,    44,    45,    46,    47,
       48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
-      -1,    69,    70,    71,    72,    73,    -1,     1,    76,    77,
-      -1,     5,    80,    -1,    -1,    83,    84,    85,    12,    13,
-      -1,    15,    16,    71,    72,    -1,    -1,    75,    76,    77,
-      78,    79,    15,    16,    17,    18,    19,    -1,    -1,    -1,
+      58,    59,    60,    61,    62,    63,    64,    65,    -1,    -1,
+      -1,    -1,    -1,    44,    45,    46,    47,    48,    49,    50,
+      51,    52,    53,    54,    55,    56,    57,    58,    59,    60,
+      61,    62,    63,    64,    65,    66,    67,    -1,    69,    70,
+      71,    72,    73,    -1,     1,    76,    77,    -1,     5,    80,
+      -1,    -1,    83,    84,    85,    12,    13,    -1,    15,    16,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      44,    45,    46,    47,    48,    49,    50,    51,    52,    53,
-      54,    55,    56,    57,    58,    59,    60,    61,    62,    63,
-      64,    65,    66,    67,    -1,    69,    70,    71,    72,    73,
-      -1,     1,    -1,    77,    -1,     5,    80,    -1,    -1,     5,
-      84,    85,    12,    13,    -1,    15,    16,    13,    -1,    15,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,    45,    46,
+      47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
+      57,    58,    59,    60,    61,    62,    63,    64,    65,    66,
+      67,    -1,    69,    70,    71,    -1,    -1,    -1,    75,    76,
+      77,     1,    -1,    80,    -1,    -1,    83,    84,    85,     5,
+      -1,    -1,    12,    13,    -1,    15,    16,    13,    -1,    15,
       16,    17,    18,    19,    20,    21,    22,    23,    24,    25,
-      -1,    -1,    -1,    -1,    -1,    31,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,    49,
+      -1,    27,    -1,    -1,    -1,    31,    -1,    -1,    -1,    35,
+      36,    -1,    -1,    -1,    44,    45,    46,    47,    48,    49,
       50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
       60,    61,    62,    63,    64,    65,    66,    67,    -1,    69,
-      70,    -1,    -1,    -1,    -1,    75,    76,    77,     1,    -1,
-      80,     0,     1,    83,    84,    85,    -1,    -1,    -1,    12,
-      13,    -1,    15,    16,    13,    -1,    15,    16,    17,    18,
-      19,    20,    21,    22,    23,    24,    25,    -1,    -1,    -1,
-      -1,    -1,    31,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      39,    44,    45,    46,    47,    48,    49,    50,    51,    52,
-      53,    54,    55,    56,    57,    58,    59,    60,    61,    62,
-      63,    64,    65,    66,    67,    -1,    69,    70,    -1,    72,
-      -1,    -1,     1,    76,    77,    -1,    -1,    80,    -1,    -1,
-      83,    84,    85,    12,    13,    -1,    15,    16,    44,    45,
+      70,    71,    72,    -1,    -1,     1,    76,    77,    -1,    -1,
+      80,    -1,    -1,    83,    84,    85,    12,    13,    -1,    15,
+      16,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,    45,
       46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
       56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
+      66,    67,    -1,    69,    70,    71,    -1,    -1,    -1,    75,
+      76,    77,     1,    -1,    80,    -1,     5,    83,    84,    85,
+      -1,    -1,    -1,    12,    13,    -1,    15,    16,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,
       49,    50,    51,    52,    53,    54,    55,    56,    57,    58,
       59,    60,    61,    62,    63,    64,    65,    66,    67,    -1,
-      69,    70,    -1,    -1,    -1,    -1,    75,    76,    77,     1,
-      -1,    80,    -1,     5,    83,    84,    85,    -1,    -1,    -1,
-      12,    13,    -1,    15,    16,    -1,    -1,    -1,    -1,    -1,
+      69,    70,    71,    72,    73,    -1,     1,    -1,    77,    -1,
+       5,    80,    -1,    -1,    -1,    84,    85,    12,    13,    -1,
+      15,    16,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,
+      45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
+      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
+      65,    66,    67,     5,    69,    70,    -1,    -1,    -1,    -1,
+      12,    13,    77,    15,    16,    80,    -1,    -1,    -1,    84,
+      85,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    44,    45,    46,    47,    48,    49,    50,    51,
       52,    53,    54,    55,    56,    57,    58,    59,    60,    61,
-      62,    63,    64,    65,    66,    67,     5,    69,    70,    -1,
-      -1,    -1,    -1,    12,    13,    77,    15,    16,    80,    -1,
+      62,    63,    64,    65,    66,    67,    -1,    69,    70,    12,
+      13,    -1,    15,    16,    -1,    77,    -1,    -1,    80,    -1,
       -1,    -1,    84,    85,    -1,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,
-      49,    50,    51,    52,    53,    54,    55,    56,    57,    58,
-      59,    60,    61,    62,    63,    64,    65,    66,    67,    -1,
-      69,    70,    12,    13,    -1,    15,    16,    -1,    77,    -1,
-      -1,    80,    -1,    -1,    -1,    84,    85,    -1,    -1,    -1,
+      -1,    44,    45,    46,    47,    48,    49,    50,    51,    52,
+      53,    54,    55,    56,    57,    58,    59,    60,    61,    62,
+      63,    64,    65,    66,    67,    -1,    69,    70,    -1,    -1,
+       0,     1,    -1,    -1,    77,    -1,    -1,    80,    -1,    -1,
+      -1,    84,    85,    13,    -1,    15,    16,    17,    18,    19,
+      20,    21,    22,    23,    24,    25,    -1,    27,    -1,    -1,
+      -1,    31,    -1,    -1,    -1,    35,    36,    -1,    -1,    39,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,    49,
-      50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
-      60,    61,    62,    63,    64,    65,    66,    67,    -1,    69,
-      70,    -1,    -1,    -1,    -1,    -1,    -1,    77,    -1,    -1,
-      80,    -1,    -1,    -1,    84,    85
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    72
 };
 
 /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
    symbol of state STATE-NUM.  */
 static const yytype_uint8 yystos[] =
 {
-       0,    28,    29,    30,    32,    33,    34,    38,    87,    89,
-      90,    91,    92,    93,    94,    95,    96,    71,    71,    71,
-      71,     5,    71,    71,     0,    96,    96,    96,    96,    96,
-      96,    96,     5,    26,    98,   100,    96,    96,    96,    96,
-      96,    96,    96,     1,    96,    97,    13,    15,    16,    17,
-      18,    19,    20,    21,    22,    23,    24,    25,    31,    88,
-     105,   110,   129,   131,   137,   138,   141,   142,   143,   144,
-     145,   146,   147,   148,   149,   150,   152,   155,     1,    13,
-      40,    70,   156,   157,   158,   159,   165,    13,    63,   134,
-     135,   136,    12,    13,    15,    16,    44,    45,    46,    47,
-      48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
-      69,    77,    80,    84,    85,   140,   161,   163,   164,   165,
-     166,   167,    41,    42,    74,   122,   123,   125,   126,   142,
-       1,    13,   113,   114,   115,   116,    71,    73,   174,    12,
-       5,     6,    39,   101,   169,   170,    21,    13,    17,    67,
-      68,    13,    96,    21,     1,    96,     1,    96,     1,    96,
-      96,    96,     1,    71,    76,   146,     1,     5,    77,    78,
-      79,   139,    13,    20,   147,   148,   148,     1,   149,    73,
-     174,   175,    96,    96,    72,     1,   158,   175,    73,   175,
-       1,    17,   174,    96,    96,    96,    96,    96,    96,    96,
-      96,    96,    96,    96,    96,    96,    96,    96,    96,    96,
-      96,    96,    96,    96,    96,    96,    96,    96,    96,    96,
-      96,    96,    96,    96,    96,    96,    96,    62,   164,     1,
-      72,    76,    83,   162,    96,    96,    96,    96,    72,    72,
-      73,   175,    96,    72,     1,   115,    73,   175,     1,    17,
-      96,     1,    96,     1,   102,   110,    97,   169,    13,    13,
-      14,    65,    96,    13,    20,   145,   151,    73,   174,    12,
-      66,   119,    73,   174,    71,   126,   128,    73,   174,    71,
-      12,    13,   132,    72,    96,    96,    96,    96,    96,   146,
-     148,    96,     1,    73,   175,    73,     1,    96,    73,    96,
-      72,    71,    76,     1,   161,    96,    96,    96,   163,    13,
-     120,    43,    13,   130,    96,     1,    73,   175,    73,    96,
-      73,    96,    71,     0,    72,    99,   175,    73,    73,   174,
-      35,    36,   103,   111,    97,    97,    75,    75,    75,   146,
-      96,    13,   151,     7,     8,     9,    10,    11,    81,    82,
-     153,    96,    96,     1,    71,    76,    96,    96,   156,   144,
-      73,   174,    96,     1,    96,    96,     1,   161,    96,    96,
-      75,    96,    96,    96,    96,    43,   124,    73,    96,     1,
-      96,    96,     1,   161,    96,     1,    96,    96,    27,   104,
-     117,    97,    96,    81,   153,    96,   127,   128,   107,    96,
-      96,   156,    71,    99,    96,    73,   161,    40,   160,   156,
-     136,    96,    17,   121,   122,    96,    96,    73,   161,   156,
-      99,   127,    37,   112,     1,    96,     1,   105,   106,   110,
-     169,   171,   173,    97,    75,    96,    12,    13,   154,    73,
-     174,     1,    99,   108,   109,   129,   131,   137,   138,   141,
-     168,   169,   171,   172,   173,   107,   126,    72,    96,    96,
-     160,    96,     1,    72,    96,    75,   123,    96,    72,    71,
-       5,    71,    73,   174,    13,   118,   174,    97,   154,    96,
-      99,    97,   168,    96,   133,   161,    96,    96,    96,   128,
-      96,     5,   119,    96,    81,    72,   134,    96,   113,   113,
-      96,    81,    96,    72,    72,    73
+       0,    28,    29,    30,    32,    33,    34,    38,    87,    88,
+      89,    90,    91,    92,    93,    94,    95,    71,    71,    71,
+      71,     5,    71,    71,     0,    95,    95,    95,    95,    95,
+      95,    95,     5,    26,    97,    99,    95,    95,    95,    95,
+      95,    95,    95,     1,    95,    96,    13,    15,    16,    17,
+      18,    19,    20,    21,    22,    23,    24,    25,    27,    31,
+      35,    36,   101,   106,   107,   113,   125,   127,   133,   134,
+     138,   139,   140,   141,   142,   143,   144,   145,   146,   147,
+     149,   152,     1,    13,    40,    70,   153,   154,   155,   156,
+     162,    13,    63,   130,   131,   132,    12,    13,    15,    16,
+      44,    45,    46,    47,    48,    49,    50,    51,    52,    53,
+      54,    55,    56,    57,    58,    59,    60,    61,    62,    63,
+      64,    65,    66,    67,    69,    77,    80,    84,    85,   137,
+     158,   160,   161,   162,   163,   164,    41,    42,    74,   118,
+     119,   121,   122,   139,     1,    13,   109,   110,   111,   112,
+      71,    73,   168,    12,     5,     6,   100,    21,    13,    17,
+      67,    68,    13,    95,    21,     1,    95,     1,    95,     1,
+      95,     1,    95,    95,    95,    95,    95,     1,    71,    76,
+     143,     1,     5,    77,    78,    79,   135,    13,    20,   144,
+     145,   145,     1,   146,    73,   168,   169,    95,    95,    72,
+       1,   155,   169,    73,   169,     1,    17,   168,    95,    95,
+      95,    95,    95,    95,    95,    95,    95,    95,    95,    95,
+      95,    95,    95,    95,    95,    95,    95,    95,    95,    95,
+      95,    95,    95,    95,    95,    95,    95,    95,    95,    95,
+      95,    95,    62,   161,     1,    72,    76,    83,   159,   169,
+      95,    95,    95,    95,    72,    72,    73,   169,    95,    72,
+       1,   111,    73,   169,     1,    17,    95,     1,    95,     1,
+      39,   101,   102,   166,   167,    13,    95,    95,    13,    20,
+     142,   148,    73,   168,    12,    66,   115,    73,   168,    71,
+     122,   124,    73,   168,    71,    73,   168,    13,   114,    12,
+      13,   128,   123,   124,    37,   108,    72,    95,    95,    95,
+      95,    95,   143,   145,    95,     1,    73,   169,    73,     1,
+      95,    73,    95,    95,    72,    71,    76,     1,   158,    95,
+      95,    95,   160,     1,    13,   116,    43,    13,   126,    95,
+       1,    73,   169,    73,    95,    73,    95,    71,     0,    72,
+      98,   169,    73,   168,     1,    96,    13,    14,   136,   137,
+     143,    95,    13,   148,     7,     8,     9,    10,    11,    81,
+      82,   150,    95,    95,     1,    71,    76,    95,    95,   115,
+      95,    71,     5,    71,   153,   141,    73,   168,    95,     1,
+      95,    95,     1,   158,    95,    95,    75,    95,    95,    95,
+      95,    43,   120,    73,    95,     1,    95,    95,     1,   158,
+      95,     1,    73,   168,    95,    95,    65,    95,    81,   150,
+      95,   123,   103,    95,    95,   153,    95,    71,    95,   124,
+      95,    98,    95,    73,   158,    40,   157,   153,   132,    95,
+      17,   117,   118,    95,    95,    73,   158,   153,    98,    75,
+      75,    95,    75,    95,    12,    13,   151,    73,   168,     1,
+      98,   104,   105,   106,   107,   113,   125,   127,   133,   134,
+     138,   165,   166,   167,   103,   122,    72,    73,   168,    95,
+     109,   109,    95,   157,    95,     1,    72,    95,    75,   119,
+      95,    72,    75,   151,    95,    98,    96,   165,    95,   129,
+      72,    72,   158,    95,    95,    95,    81,    72,   130,    95,
+      81,    95
 };
 
 #define yyerrok		(yyerrstatus = 0)
@@ -2133,46 +2167,46 @@ yyreduce:
   YY_REDUCE_PRINT (yyn);
   switch (yyn)
     {
-        case 12:
+        case 10:
 
 /* Line 1455 of yacc.c  */
-#line 287 "../css/CSSGrammar.y"
+#line 280 "css\\CSSGrammar.y"
     {
         static_cast<CSSParser*>(parser)->m_rule = (yyvsp[(4) - (6)].rule);
     ;}
     break;
 
-  case 13:
+  case 11:
 
 /* Line 1455 of yacc.c  */
-#line 293 "../css/CSSGrammar.y"
+#line 286 "css\\CSSGrammar.y"
     {
         static_cast<CSSParser*>(parser)->m_keyframe = (yyvsp[(4) - (6)].keyframeRule);
     ;}
     break;
 
-  case 14:
+  case 12:
 
 /* Line 1455 of yacc.c  */
-#line 299 "../css/CSSGrammar.y"
+#line 292 "css\\CSSGrammar.y"
     {
         /* can be empty */
     ;}
     break;
 
-  case 15:
+  case 13:
 
 /* Line 1455 of yacc.c  */
-#line 305 "../css/CSSGrammar.y"
+#line 298 "css\\CSSGrammar.y"
     {
         /* can be empty */
     ;}
     break;
 
-  case 16:
+  case 14:
 
 /* Line 1455 of yacc.c  */
-#line 311 "../css/CSSGrammar.y"
+#line 304 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         if ((yyvsp[(4) - (5)].valueList)) {
@@ -2186,20 +2220,20 @@ yyreduce:
     ;}
     break;
 
-  case 17:
+  case 15:
 
 /* Line 1455 of yacc.c  */
-#line 325 "../css/CSSGrammar.y"
+#line 318 "css\\CSSGrammar.y"
     {
          CSSParser* p = static_cast<CSSParser*>(parser);
          p->m_mediaQuery = p->sinkFloatingMediaQuery((yyvsp[(4) - (5)].mediaQuery));
      ;}
     break;
 
-  case 18:
+  case 16:
 
 /* Line 1455 of yacc.c  */
-#line 332 "../css/CSSGrammar.y"
+#line 325 "css\\CSSGrammar.y"
     {
         if ((yyvsp[(4) - (5)].selectorList)) {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2209,18 +2243,18 @@ yyreduce:
     ;}
     break;
 
-  case 25:
+  case 23:
 
 /* Line 1455 of yacc.c  */
-#line 354 "../css/CSSGrammar.y"
+#line 347 "css\\CSSGrammar.y"
     {
   ;}
     break;
 
-  case 28:
+  case 26:
 
 /* Line 1455 of yacc.c  */
-#line 364 "../css/CSSGrammar.y"
+#line 357 "css\\CSSGrammar.y"
     {
      CSSParser* p = static_cast<CSSParser*>(parser);
      (yyval.rule) = static_cast<CSSParser*>(parser)->createCharsetRule((yyvsp[(3) - (5)].string));
@@ -2229,26 +2263,26 @@ yyreduce:
   ;}
     break;
 
-  case 29:
+  case 27:
 
 /* Line 1455 of yacc.c  */
-#line 370 "../css/CSSGrammar.y"
+#line 363 "css\\CSSGrammar.y"
     {
   ;}
     break;
 
-  case 30:
+  case 28:
 
 /* Line 1455 of yacc.c  */
-#line 372 "../css/CSSGrammar.y"
+#line 365 "css\\CSSGrammar.y"
     {
   ;}
     break;
 
-  case 32:
+  case 30:
 
 /* Line 1455 of yacc.c  */
-#line 378 "../css/CSSGrammar.y"
+#line 371 "css\\CSSGrammar.y"
     {
      CSSParser* p = static_cast<CSSParser*>(parser);
      if ((yyvsp[(2) - (3)].rule) && p->m_styleSheet)
@@ -2256,47 +2290,26 @@ yyreduce:
  ;}
     break;
 
-  case 33:
-
-/* Line 1455 of yacc.c  */
-#line 383 "../css/CSSGrammar.y"
-    {
- ;}
-    break;
-
-  case 35:
-
-/* Line 1455 of yacc.c  */
-#line 389 "../css/CSSGrammar.y"
-    {
-    CSSParser* p = static_cast<CSSParser*>(parser);
-     if ((yyvsp[(2) - (3)].rule) && p->m_styleSheet)
-         p->m_styleSheet->append((yyvsp[(2) - (3)].rule));
-;}
-    break;
-
   case 39:
 
 /* Line 1455 of yacc.c  */
-#line 403 "../css/CSSGrammar.y"
+#line 390 "css\\CSSGrammar.y"
     {
-     CSSParser* p = static_cast<CSSParser*>(parser);
-     if ((yyvsp[(2) - (3)].rule) && p->m_styleSheet)
-         p->m_styleSheet->append((yyvsp[(2) - (3)].rule));
- ;}
+        static_cast<CSSParser*>(parser)->m_hadSyntacticallyValidCSSRule = true;
+    ;}
     break;
 
-  case 49:
+  case 42:
 
 /* Line 1455 of yacc.c  */
-#line 426 "../css/CSSGrammar.y"
+#line 398 "css\\CSSGrammar.y"
     { (yyval.ruleList) = 0; ;}
     break;
 
-  case 50:
+  case 43:
 
 /* Line 1455 of yacc.c  */
-#line 427 "../css/CSSGrammar.y"
+#line 399 "css\\CSSGrammar.y"
     {
       (yyval.ruleList) = (yyvsp[(1) - (3)].ruleList);
       if ((yyvsp[(2) - (3)].rule)) {
@@ -2307,91 +2320,91 @@ yyreduce:
   ;}
     break;
 
-  case 60:
+  case 55:
 
 /* Line 1455 of yacc.c  */
-#line 454 "../css/CSSGrammar.y"
+#line 428 "css\\CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createImportRule((yyvsp[(3) - (6)].string), (yyvsp[(5) - (6)].mediaList));
     ;}
     break;
 
-  case 61:
+  case 56:
 
 /* Line 1455 of yacc.c  */
-#line 457 "../css/CSSGrammar.y"
+#line 431 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 62:
+  case 57:
 
 /* Line 1455 of yacc.c  */
-#line 460 "../css/CSSGrammar.y"
+#line 434 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 63:
+  case 58:
 
 /* Line 1455 of yacc.c  */
-#line 463 "../css/CSSGrammar.y"
+#line 437 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 64:
+  case 59:
 
 /* Line 1455 of yacc.c  */
-#line 469 "../css/CSSGrammar.y"
+#line 443 "css\\CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createVariablesRule((yyvsp[(3) - (7)].mediaList), true);
     ;}
     break;
 
-  case 65:
+  case 60:
 
 /* Line 1455 of yacc.c  */
-#line 473 "../css/CSSGrammar.y"
+#line 447 "css\\CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createVariablesRule((yyvsp[(3) - (7)].mediaList), false);
     ;}
     break;
 
-  case 66:
+  case 61:
 
 /* Line 1455 of yacc.c  */
-#line 479 "../css/CSSGrammar.y"
+#line 453 "css\\CSSGrammar.y"
     {
         (yyval.mediaList) = static_cast<CSSParser*>(parser)->createMediaList();
     ;}
     break;
 
-  case 67:
+  case 62:
 
 /* Line 1455 of yacc.c  */
-#line 483 "../css/CSSGrammar.y"
+#line 457 "css\\CSSGrammar.y"
     {
         (yyval.mediaList) = (yyvsp[(3) - (3)].mediaList);
     ;}
     break;
 
-  case 68:
+  case 63:
 
 /* Line 1455 of yacc.c  */
-#line 489 "../css/CSSGrammar.y"
+#line 463 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
-  case 69:
+  case 64:
 
 /* Line 1455 of yacc.c  */
-#line 492 "../css/CSSGrammar.y"
+#line 466 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
         if ((yyvsp[(2) - (2)].boolean))
@@ -2399,82 +2412,82 @@ yyreduce:
     ;}
     break;
 
-  case 70:
+  case 65:
 
 /* Line 1455 of yacc.c  */
-#line 497 "../css/CSSGrammar.y"
+#line 471 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
-  case 71:
+  case 66:
 
 /* Line 1455 of yacc.c  */
-#line 500 "../css/CSSGrammar.y"
+#line 474 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 72:
+  case 67:
 
 /* Line 1455 of yacc.c  */
-#line 503 "../css/CSSGrammar.y"
+#line 477 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 73:
+  case 68:
 
 /* Line 1455 of yacc.c  */
-#line 506 "../css/CSSGrammar.y"
+#line 480 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
     ;}
     break;
 
-  case 74:
+  case 69:
 
 /* Line 1455 of yacc.c  */
-#line 512 "../css/CSSGrammar.y"
+#line 486 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (3)].boolean);
     ;}
     break;
 
-  case 75:
+  case 70:
 
 /* Line 1455 of yacc.c  */
-#line 515 "../css/CSSGrammar.y"
+#line 489 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 76:
+  case 71:
 
 /* Line 1455 of yacc.c  */
-#line 518 "../css/CSSGrammar.y"
+#line 492 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 77:
+  case 72:
 
 /* Line 1455 of yacc.c  */
-#line 521 "../css/CSSGrammar.y"
+#line 495 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 78:
+  case 73:
 
 /* Line 1455 of yacc.c  */
-#line 524 "../css/CSSGrammar.y"
+#line 498 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
         if ((yyvsp[(2) - (4)].boolean))
@@ -2482,155 +2495,181 @@ yyreduce:
     ;}
     break;
 
-  case 79:
+  case 74:
 
 /* Line 1455 of yacc.c  */
-#line 529 "../css/CSSGrammar.y"
+#line 503 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
     ;}
     break;
 
-  case 80:
+  case 75:
 
 /* Line 1455 of yacc.c  */
-#line 532 "../css/CSSGrammar.y"
+#line 506 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (6)].boolean);
     ;}
     break;
 
-  case 81:
+  case 76:
 
 /* Line 1455 of yacc.c  */
-#line 538 "../css/CSSGrammar.y"
+#line 512 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = static_cast<CSSParser*>(parser)->addVariable((yyvsp[(1) - (4)].string), (yyvsp[(4) - (4)].valueList));
     ;}
     break;
 
-  case 82:
+  case 77:
 
 /* Line 1455 of yacc.c  */
-#line 542 "../css/CSSGrammar.y"
+#line 516 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = static_cast<CSSParser*>(parser)->addVariableDeclarationBlock((yyvsp[(1) - (7)].string));
     ;}
     break;
 
-  case 83:
+  case 78:
 
 /* Line 1455 of yacc.c  */
-#line 546 "../css/CSSGrammar.y"
+#line 520 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 84:
+  case 79:
 
 /* Line 1455 of yacc.c  */
-#line 550 "../css/CSSGrammar.y"
+#line 524 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 85:
+  case 80:
 
 /* Line 1455 of yacc.c  */
-#line 554 "../css/CSSGrammar.y"
+#line 528 "css\\CSSGrammar.y"
     {
         /* @variables { varname: } Just reduce away this variable with no value. */
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 86:
+  case 81:
 
 /* Line 1455 of yacc.c  */
-#line 559 "../css/CSSGrammar.y"
+#line 533 "css\\CSSGrammar.y"
     {
         /* if we come across rules with invalid values like this case: @variables { varname: *; }, just discard the property/value pair */
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 87:
+  case 82:
 
 /* Line 1455 of yacc.c  */
-#line 566 "../css/CSSGrammar.y"
+#line 540 "css\\CSSGrammar.y"
     {
         (yyval.string) = (yyvsp[(1) - (2)].string);
     ;}
     break;
 
-  case 88:
+  case 83:
 
 /* Line 1455 of yacc.c  */
-#line 572 "../css/CSSGrammar.y"
+#line 546 "css\\CSSGrammar.y"
     {
-    CSSParser* p = static_cast<CSSParser*>(parser);
-    if (p->m_styleSheet)
-        p->m_styleSheet->addNamespace(p, (yyvsp[(3) - (6)].string), (yyvsp[(4) - (6)].string));
+    static_cast<CSSParser*>(parser)->addNamespace((yyvsp[(3) - (6)].string), (yyvsp[(4) - (6)].string));
+    (yyval.rule) = 0;
 ;}
     break;
 
-  case 91:
+  case 84:
+
+/* Line 1455 of yacc.c  */
+#line 550 "css\\CSSGrammar.y"
+    {
+    (yyval.rule) = 0;
+;}
+    break;
+
+  case 85:
+
+/* Line 1455 of yacc.c  */
+#line 553 "css\\CSSGrammar.y"
+    {
+    (yyval.rule) = 0;
+;}
+    break;
+
+  case 86:
 
 /* Line 1455 of yacc.c  */
-#line 582 "../css/CSSGrammar.y"
+#line 556 "css\\CSSGrammar.y"
+    {
+    (yyval.rule) = 0;
+;}
+    break;
+
+  case 87:
+
+/* Line 1455 of yacc.c  */
+#line 562 "css\\CSSGrammar.y"
     { (yyval.string).characters = 0; ;}
     break;
 
-  case 92:
+  case 88:
 
 /* Line 1455 of yacc.c  */
-#line 583 "../css/CSSGrammar.y"
+#line 563 "css\\CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
-  case 95:
+  case 91:
 
 /* Line 1455 of yacc.c  */
-#line 592 "../css/CSSGrammar.y"
+#line 572 "css\\CSSGrammar.y"
     {
         (yyval.string) = (yyvsp[(1) - (2)].string);
     ;}
     break;
 
-  case 96:
+  case 92:
 
 /* Line 1455 of yacc.c  */
-#line 598 "../css/CSSGrammar.y"
+#line 578 "css\\CSSGrammar.y"
     {
         (yyval.valueList) = 0;
     ;}
     break;
 
-  case 97:
+  case 93:
 
 /* Line 1455 of yacc.c  */
-#line 601 "../css/CSSGrammar.y"
+#line 581 "css\\CSSGrammar.y"
     {
         (yyval.valueList) = (yyvsp[(3) - (4)].valueList);
     ;}
     break;
 
-  case 98:
+  case 94:
 
 /* Line 1455 of yacc.c  */
-#line 607 "../css/CSSGrammar.y"
+#line 587 "css\\CSSGrammar.y"
     {
         (yyvsp[(3) - (7)].string).lower();
         (yyval.mediaQueryExp) = static_cast<CSSParser*>(parser)->createFloatingMediaQueryExp((yyvsp[(3) - (7)].string), (yyvsp[(5) - (7)].valueList));
     ;}
     break;
 
-  case 99:
+  case 95:
 
 /* Line 1455 of yacc.c  */
-#line 614 "../css/CSSGrammar.y"
+#line 594 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.mediaQueryExpList) = p->createFloatingMediaQueryExpList();
@@ -2638,75 +2677,75 @@ yyreduce:
     ;}
     break;
 
-  case 100:
+  case 96:
 
 /* Line 1455 of yacc.c  */
-#line 619 "../css/CSSGrammar.y"
+#line 599 "css\\CSSGrammar.y"
     {
         (yyval.mediaQueryExpList) = (yyvsp[(1) - (5)].mediaQueryExpList);
         (yyval.mediaQueryExpList)->append(static_cast<CSSParser*>(parser)->sinkFloatingMediaQueryExp((yyvsp[(5) - (5)].mediaQueryExp)));
     ;}
     break;
 
-  case 101:
+  case 97:
 
 /* Line 1455 of yacc.c  */
-#line 626 "../css/CSSGrammar.y"
+#line 606 "css\\CSSGrammar.y"
     {
         (yyval.mediaQueryExpList) = static_cast<CSSParser*>(parser)->createFloatingMediaQueryExpList();
     ;}
     break;
 
-  case 102:
+  case 98:
 
 /* Line 1455 of yacc.c  */
-#line 629 "../css/CSSGrammar.y"
+#line 609 "css\\CSSGrammar.y"
     {
         (yyval.mediaQueryExpList) = (yyvsp[(3) - (3)].mediaQueryExpList);
     ;}
     break;
 
-  case 103:
+  case 99:
 
 /* Line 1455 of yacc.c  */
-#line 635 "../css/CSSGrammar.y"
+#line 615 "css\\CSSGrammar.y"
     {
         (yyval.mediaQueryRestrictor) = MediaQuery::None;
     ;}
     break;
 
-  case 104:
+  case 100:
 
 /* Line 1455 of yacc.c  */
-#line 638 "../css/CSSGrammar.y"
+#line 618 "css\\CSSGrammar.y"
     {
         (yyval.mediaQueryRestrictor) = MediaQuery::Only;
     ;}
     break;
 
-  case 105:
+  case 101:
 
 /* Line 1455 of yacc.c  */
-#line 641 "../css/CSSGrammar.y"
+#line 621 "css\\CSSGrammar.y"
     {
         (yyval.mediaQueryRestrictor) = MediaQuery::Not;
     ;}
     break;
 
-  case 106:
+  case 102:
 
 /* Line 1455 of yacc.c  */
-#line 647 "../css/CSSGrammar.y"
+#line 627 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.mediaQuery) = p->createFloatingMediaQuery(p->sinkFloatingMediaQueryExpList((yyvsp[(1) - (1)].mediaQueryExpList)));
     ;}
     break;
 
-  case 107:
+  case 103:
 
 /* Line 1455 of yacc.c  */
-#line 652 "../css/CSSGrammar.y"
+#line 632 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyvsp[(3) - (4)].string).lower();
@@ -2714,19 +2753,19 @@ yyreduce:
     ;}
     break;
 
-  case 108:
+  case 104:
 
 /* Line 1455 of yacc.c  */
-#line 660 "../css/CSSGrammar.y"
+#line 640 "css\\CSSGrammar.y"
     {
         (yyval.mediaList) = static_cast<CSSParser*>(parser)->createMediaList();
      ;}
     break;
 
-  case 110:
+  case 106:
 
 /* Line 1455 of yacc.c  */
-#line 667 "../css/CSSGrammar.y"
+#line 647 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.mediaList) = p->createMediaList();
@@ -2734,10 +2773,10 @@ yyreduce:
     ;}
     break;
 
-  case 111:
+  case 107:
 
 /* Line 1455 of yacc.c  */
-#line 672 "../css/CSSGrammar.y"
+#line 652 "css\\CSSGrammar.y"
     {
         (yyval.mediaList) = (yyvsp[(1) - (4)].mediaList);
         if ((yyval.mediaList))
@@ -2745,63 +2784,63 @@ yyreduce:
     ;}
     break;
 
-  case 112:
+  case 108:
 
 /* Line 1455 of yacc.c  */
-#line 677 "../css/CSSGrammar.y"
+#line 657 "css\\CSSGrammar.y"
     {
         (yyval.mediaList) = 0;
     ;}
     break;
 
-  case 113:
+  case 109:
 
 /* Line 1455 of yacc.c  */
-#line 683 "../css/CSSGrammar.y"
+#line 663 "css\\CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createMediaRule((yyvsp[(3) - (7)].mediaList), (yyvsp[(6) - (7)].ruleList));
     ;}
     break;
 
-  case 114:
+  case 110:
 
 /* Line 1455 of yacc.c  */
-#line 686 "../css/CSSGrammar.y"
+#line 666 "css\\CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createMediaRule(0, (yyvsp[(5) - (6)].ruleList));
     ;}
     break;
 
-  case 115:
+  case 111:
 
 /* Line 1455 of yacc.c  */
-#line 692 "../css/CSSGrammar.y"
+#line 672 "css\\CSSGrammar.y"
     {
       (yyval.string) = (yyvsp[(1) - (2)].string);
   ;}
     break;
 
-  case 116:
+  case 112:
 
 /* Line 1455 of yacc.c  */
-#line 698 "../css/CSSGrammar.y"
+#line 678 "css\\CSSGrammar.y"
     {
         (yyval.rule) = (yyvsp[(7) - (8)].keyframesRule);
         (yyvsp[(7) - (8)].keyframesRule)->setNameInternal((yyvsp[(3) - (8)].string));
     ;}
     break;
 
-  case 119:
+  case 115:
 
 /* Line 1455 of yacc.c  */
-#line 710 "../css/CSSGrammar.y"
+#line 690 "css\\CSSGrammar.y"
     { (yyval.keyframesRule) = static_cast<CSSParser*>(parser)->createKeyframesRule(); ;}
     break;
 
-  case 120:
+  case 116:
 
 /* Line 1455 of yacc.c  */
-#line 711 "../css/CSSGrammar.y"
+#line 691 "css\\CSSGrammar.y"
     {
         (yyval.keyframesRule) = (yyvsp[(1) - (3)].keyframesRule);
         if ((yyvsp[(2) - (3)].keyframeRule))
@@ -2809,19 +2848,19 @@ yyreduce:
     ;}
     break;
 
-  case 121:
+  case 117:
 
 /* Line 1455 of yacc.c  */
-#line 719 "../css/CSSGrammar.y"
+#line 699 "css\\CSSGrammar.y"
     {
         (yyval.keyframeRule) = static_cast<CSSParser*>(parser)->createKeyframeRule((yyvsp[(1) - (6)].valueList));
     ;}
     break;
 
-  case 122:
+  case 118:
 
 /* Line 1455 of yacc.c  */
-#line 725 "../css/CSSGrammar.y"
+#line 705 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = p->createFloatingValueList();
@@ -2829,10 +2868,10 @@ yyreduce:
     ;}
     break;
 
-  case 123:
+  case 119:
 
 /* Line 1455 of yacc.c  */
-#line 730 "../css/CSSGrammar.y"
+#line 710 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = (yyvsp[(1) - (5)].valueList);
@@ -2841,17 +2880,17 @@ yyreduce:
     ;}
     break;
 
-  case 124:
+  case 120:
 
 /* Line 1455 of yacc.c  */
-#line 739 "../css/CSSGrammar.y"
+#line 719 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).isInt = false; (yyval.value).fValue = (yyvsp[(1) - (1)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER; ;}
     break;
 
-  case 125:
+  case 121:
 
 /* Line 1455 of yacc.c  */
-#line 740 "../css/CSSGrammar.y"
+#line 720 "css\\CSSGrammar.y"
     {
         (yyval.value).id = 0; (yyval.value).isInt = false; (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER;
         CSSParserString& str = (yyvsp[(1) - (1)].string);
@@ -2864,99 +2903,113 @@ yyreduce:
     ;}
     break;
 
-  case 126:
+  case 122:
 
 /* Line 1455 of yacc.c  */
-#line 764 "../css/CSSGrammar.y"
+#line 744 "css\\CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
-  case 127:
+  case 123:
 
 /* Line 1455 of yacc.c  */
-#line 767 "../css/CSSGrammar.y"
+#line 747 "css\\CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
-  case 128:
+  case 124:
 
 /* Line 1455 of yacc.c  */
-#line 774 "../css/CSSGrammar.y"
+#line 754 "css\\CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createFontFaceRule();
     ;}
     break;
 
-  case 129:
+  case 125:
 
 /* Line 1455 of yacc.c  */
-#line 777 "../css/CSSGrammar.y"
+#line 757 "css\\CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
-  case 130:
+  case 126:
 
 /* Line 1455 of yacc.c  */
-#line 780 "../css/CSSGrammar.y"
+#line 760 "css\\CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
-  case 131:
+  case 127:
 
 /* Line 1455 of yacc.c  */
-#line 786 "../css/CSSGrammar.y"
+#line 766 "css\\CSSGrammar.y"
     { (yyval.relation) = CSSSelector::DirectAdjacent; ;}
     break;
 
-  case 132:
+  case 128:
 
 /* Line 1455 of yacc.c  */
-#line 787 "../css/CSSGrammar.y"
+#line 767 "css\\CSSGrammar.y"
     { (yyval.relation) = CSSSelector::IndirectAdjacent; ;}
     break;
 
-  case 133:
+  case 129:
 
 /* Line 1455 of yacc.c  */
-#line 788 "../css/CSSGrammar.y"
+#line 768 "css\\CSSGrammar.y"
     { (yyval.relation) = CSSSelector::Child; ;}
     break;
 
-  case 134:
+  case 130:
 
 /* Line 1455 of yacc.c  */
-#line 792 "../css/CSSGrammar.y"
+#line 772 "css\\CSSGrammar.y"
+    { (yyval.integer) = (yyvsp[(1) - (1)].integer); ;}
+    break;
+
+  case 131:
+
+/* Line 1455 of yacc.c  */
+#line 773 "css\\CSSGrammar.y"
+    { (yyval.integer) = 1; ;}
+    break;
+
+  case 132:
+
+/* Line 1455 of yacc.c  */
+#line 777 "css\\CSSGrammar.y"
     { (yyval.integer) = -1; ;}
     break;
 
-  case 135:
+  case 133:
 
 /* Line 1455 of yacc.c  */
-#line 793 "../css/CSSGrammar.y"
+#line 778 "css\\CSSGrammar.y"
     { (yyval.integer) = 1; ;}
     break;
 
-  case 136:
+  case 134:
 
 /* Line 1455 of yacc.c  */
-#line 797 "../css/CSSGrammar.y"
+#line 782 "css\\CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createStyleRule((yyvsp[(1) - (5)].selectorList));
     ;}
     break;
 
-  case 137:
+  case 135:
 
 /* Line 1455 of yacc.c  */
-#line 803 "../css/CSSGrammar.y"
+#line 788 "css\\CSSGrammar.y"
     {
         if ((yyvsp[(1) - (1)].selector)) {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2964,64 +3017,66 @@ yyreduce:
             deleteAllValues(*(yyval.selectorList));
             (yyval.selectorList)->shrink(0);
             (yyval.selectorList)->append(p->sinkFloatingSelector((yyvsp[(1) - (1)].selector)));
+            p->updateLastSelectorLine();
         }
     ;}
     break;
 
-  case 138:
+  case 136:
 
 /* Line 1455 of yacc.c  */
-#line 812 "../css/CSSGrammar.y"
+#line 798 "css\\CSSGrammar.y"
     {
         if ((yyvsp[(1) - (4)].selectorList) && (yyvsp[(4) - (4)].selector)) {
             CSSParser* p = static_cast<CSSParser*>(parser);
             (yyval.selectorList) = (yyvsp[(1) - (4)].selectorList);
             (yyval.selectorList)->append(p->sinkFloatingSelector((yyvsp[(4) - (4)].selector)));
+            p->updateLastSelectorLine();
         } else
             (yyval.selectorList) = 0;
     ;}
     break;
 
-  case 139:
+  case 137:
 
 /* Line 1455 of yacc.c  */
-#line 820 "../css/CSSGrammar.y"
+#line 807 "css\\CSSGrammar.y"
     {
         (yyval.selectorList) = 0;
     ;}
     break;
 
-  case 140:
+  case 138:
 
 /* Line 1455 of yacc.c  */
-#line 826 "../css/CSSGrammar.y"
+#line 813 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (2)].selector);
     ;}
     break;
 
-  case 141:
+  case 139:
 
 /* Line 1455 of yacc.c  */
-#line 832 "../css/CSSGrammar.y"
+#line 819 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
     ;}
     break;
 
-  case 142:
+  case 140:
 
 /* Line 1455 of yacc.c  */
-#line 836 "../css/CSSGrammar.y"
+#line 823 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
     ;}
     break;
 
-  case 143:
+  case 141:
 
 /* Line 1455 of yacc.c  */
-#line 840 "../css/CSSGrammar.y"
+#line 827 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(2) - (2)].selector);
         if (!(yyvsp[(1) - (2)].selector))
@@ -3039,10 +3094,10 @@ yyreduce:
     ;}
     break;
 
-  case 144:
+  case 142:
 
 /* Line 1455 of yacc.c  */
-#line 855 "../css/CSSGrammar.y"
+#line 842 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(3) - (3)].selector);
         if (!(yyvsp[(1) - (3)].selector))
@@ -3065,40 +3120,40 @@ yyreduce:
     ;}
     break;
 
-  case 145:
+  case 143:
 
 /* Line 1455 of yacc.c  */
-#line 875 "../css/CSSGrammar.y"
+#line 862 "css\\CSSGrammar.y"
     {
         (yyval.selector) = 0;
     ;}
     break;
 
-  case 146:
+  case 144:
 
 /* Line 1455 of yacc.c  */
-#line 881 "../css/CSSGrammar.y"
+#line 868 "css\\CSSGrammar.y"
     { (yyval.string).characters = 0; (yyval.string).length = 0; ;}
     break;
 
-  case 147:
+  case 145:
 
 /* Line 1455 of yacc.c  */
-#line 882 "../css/CSSGrammar.y"
+#line 869 "css\\CSSGrammar.y"
     { static UChar star = '*'; (yyval.string).characters = &star; (yyval.string).length = 1; ;}
     break;
 
-  case 148:
+  case 146:
 
 /* Line 1455 of yacc.c  */
-#line 883 "../css/CSSGrammar.y"
+#line 870 "css\\CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
-  case 149:
+  case 147:
 
 /* Line 1455 of yacc.c  */
-#line 887 "../css/CSSGrammar.y"
+#line 874 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3106,10 +3161,10 @@ yyreduce:
     ;}
     break;
 
-  case 150:
+  case 148:
 
 /* Line 1455 of yacc.c  */
-#line 892 "../css/CSSGrammar.y"
+#line 879 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(2) - (2)].selector);
         if ((yyval.selector)) {
@@ -3119,10 +3174,10 @@ yyreduce:
     ;}
     break;
 
-  case 151:
+  case 149:
 
 /* Line 1455 of yacc.c  */
-#line 899 "../css/CSSGrammar.y"
+#line 886 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3131,10 +3186,10 @@ yyreduce:
     ;}
     break;
 
-  case 152:
+  case 150:
 
 /* Line 1455 of yacc.c  */
-#line 905 "../css/CSSGrammar.y"
+#line 892 "css\\CSSGrammar.y"
     {
         AtomicString namespacePrefix = (yyvsp[(1) - (2)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3147,10 +3202,10 @@ yyreduce:
     ;}
     break;
 
-  case 153:
+  case 151:
 
 /* Line 1455 of yacc.c  */
-#line 915 "../css/CSSGrammar.y"
+#line 902 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(3) - (3)].selector);
         if ((yyval.selector)) {
@@ -3165,10 +3220,10 @@ yyreduce:
     ;}
     break;
 
-  case 154:
+  case 152:
 
 /* Line 1455 of yacc.c  */
-#line 927 "../css/CSSGrammar.y"
+#line 914 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(2) - (2)].selector);
         if ((yyval.selector)) {
@@ -3181,10 +3236,10 @@ yyreduce:
     ;}
     break;
 
-  case 155:
+  case 153:
 
 /* Line 1455 of yacc.c  */
-#line 940 "../css/CSSGrammar.y"
+#line 927 "css\\CSSGrammar.y"
     {
         CSSParserString& str = (yyvsp[(1) - (1)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3195,10 +3250,10 @@ yyreduce:
     ;}
     break;
 
-  case 156:
+  case 154:
 
 /* Line 1455 of yacc.c  */
-#line 948 "../css/CSSGrammar.y"
+#line 935 "css\\CSSGrammar.y"
     {
         static UChar star = '*';
         (yyval.string).characters = &star;
@@ -3206,19 +3261,19 @@ yyreduce:
     ;}
     break;
 
-  case 157:
+  case 155:
 
 /* Line 1455 of yacc.c  */
-#line 956 "../css/CSSGrammar.y"
+#line 943 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
     ;}
     break;
 
-  case 158:
+  case 156:
 
 /* Line 1455 of yacc.c  */
-#line 959 "../css/CSSGrammar.y"
+#line 946 "css\\CSSGrammar.y"
     {
         if (!(yyvsp[(2) - (2)].selector))
             (yyval.selector) = 0;
@@ -3234,19 +3289,19 @@ yyreduce:
     ;}
     break;
 
-  case 159:
+  case 157:
 
 /* Line 1455 of yacc.c  */
-#line 972 "../css/CSSGrammar.y"
+#line 959 "css\\CSSGrammar.y"
     {
         (yyval.selector) = 0;
     ;}
     break;
 
-  case 160:
+  case 158:
 
 /* Line 1455 of yacc.c  */
-#line 978 "../css/CSSGrammar.y"
+#line 965 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3257,10 +3312,10 @@ yyreduce:
     ;}
     break;
 
-  case 161:
+  case 159:
 
 /* Line 1455 of yacc.c  */
-#line 986 "../css/CSSGrammar.y"
+#line 973 "css\\CSSGrammar.y"
     {
         if ((yyvsp[(1) - (1)].string).characters[0] >= '0' && (yyvsp[(1) - (1)].string).characters[0] <= '9') {
             (yyval.selector) = 0;
@@ -3275,10 +3330,10 @@ yyreduce:
     ;}
     break;
 
-  case 165:
+  case 163:
 
 /* Line 1455 of yacc.c  */
-#line 1004 "../css/CSSGrammar.y"
+#line 991 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3289,10 +3344,10 @@ yyreduce:
     ;}
     break;
 
-  case 166:
+  case 164:
 
 /* Line 1455 of yacc.c  */
-#line 1015 "../css/CSSGrammar.y"
+#line 1002 "css\\CSSGrammar.y"
     {
         CSSParserString& str = (yyvsp[(1) - (2)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3303,10 +3358,10 @@ yyreduce:
     ;}
     break;
 
-  case 167:
+  case 165:
 
 /* Line 1455 of yacc.c  */
-#line 1026 "../css/CSSGrammar.y"
+#line 1013 "css\\CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->setAttribute(QualifiedName(nullAtom, (yyvsp[(3) - (4)].string), nullAtom));
@@ -3314,10 +3369,10 @@ yyreduce:
     ;}
     break;
 
-  case 168:
+  case 166:
 
 /* Line 1455 of yacc.c  */
-#line 1031 "../css/CSSGrammar.y"
+#line 1018 "css\\CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->setAttribute(QualifiedName(nullAtom, (yyvsp[(3) - (8)].string), nullAtom));
@@ -3326,10 +3381,10 @@ yyreduce:
     ;}
     break;
 
-  case 169:
+  case 167:
 
 /* Line 1455 of yacc.c  */
-#line 1037 "../css/CSSGrammar.y"
+#line 1024 "css\\CSSGrammar.y"
     {
         AtomicString namespacePrefix = (yyvsp[(3) - (5)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3340,10 +3395,10 @@ yyreduce:
     ;}
     break;
 
-  case 170:
+  case 168:
 
 /* Line 1455 of yacc.c  */
-#line 1045 "../css/CSSGrammar.y"
+#line 1032 "css\\CSSGrammar.y"
     {
         AtomicString namespacePrefix = (yyvsp[(3) - (9)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3355,64 +3410,64 @@ yyreduce:
     ;}
     break;
 
-  case 171:
+  case 169:
 
 /* Line 1455 of yacc.c  */
-#line 1057 "../css/CSSGrammar.y"
+#line 1044 "css\\CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Exact;
     ;}
     break;
 
-  case 172:
+  case 170:
 
 /* Line 1455 of yacc.c  */
-#line 1060 "../css/CSSGrammar.y"
+#line 1047 "css\\CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::List;
     ;}
     break;
 
-  case 173:
+  case 171:
 
 /* Line 1455 of yacc.c  */
-#line 1063 "../css/CSSGrammar.y"
+#line 1050 "css\\CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Hyphen;
     ;}
     break;
 
-  case 174:
+  case 172:
 
 /* Line 1455 of yacc.c  */
-#line 1066 "../css/CSSGrammar.y"
+#line 1053 "css\\CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Begin;
     ;}
     break;
 
-  case 175:
+  case 173:
 
 /* Line 1455 of yacc.c  */
-#line 1069 "../css/CSSGrammar.y"
+#line 1056 "css\\CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::End;
     ;}
     break;
 
-  case 176:
+  case 174:
 
 /* Line 1455 of yacc.c  */
-#line 1072 "../css/CSSGrammar.y"
+#line 1059 "css\\CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Contain;
     ;}
     break;
 
-  case 179:
+  case 177:
 
 /* Line 1455 of yacc.c  */
-#line 1083 "../css/CSSGrammar.y"
+#line 1070 "css\\CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->m_match = CSSSelector::PseudoClass;
@@ -3445,10 +3500,10 @@ yyreduce:
     ;}
     break;
 
-  case 180:
+  case 178:
 
 /* Line 1455 of yacc.c  */
-#line 1113 "../css/CSSGrammar.y"
+#line 1100 "css\\CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->m_match = CSSSelector::PseudoElement;
@@ -3470,16 +3525,16 @@ yyreduce:
     ;}
     break;
 
-  case 181:
+  case 179:
 
 /* Line 1455 of yacc.c  */
-#line 1133 "../css/CSSGrammar.y"
+#line 1120 "css\\CSSGrammar.y"
     {
         CSSParser *p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
         (yyval.selector)->m_match = CSSSelector::PseudoClass;
-        (yyval.selector)->setArgument((yyvsp[(3) - (4)].string));
-        (yyval.selector)->m_value = (yyvsp[(2) - (4)].string);
+        (yyval.selector)->setArgument((yyvsp[(4) - (6)].string));
+        (yyval.selector)->m_value = (yyvsp[(2) - (6)].string);
         CSSSelector::PseudoType type = (yyval.selector)->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
             (yyval.selector) = 0;
@@ -3493,16 +3548,16 @@ yyreduce:
     ;}
     break;
 
-  case 182:
+  case 180:
 
 /* Line 1455 of yacc.c  */
-#line 1151 "../css/CSSGrammar.y"
+#line 1138 "css\\CSSGrammar.y"
     {
         CSSParser *p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
         (yyval.selector)->m_match = CSSSelector::PseudoClass;
-        (yyval.selector)->setArgument(String::number((yyvsp[(3) - (4)].number)));
-        (yyval.selector)->m_value = (yyvsp[(2) - (4)].string);
+        (yyval.selector)->setArgument(String::number((yyvsp[(4) - (7)].integer) * (yyvsp[(5) - (7)].number)));
+        (yyval.selector)->m_value = (yyvsp[(2) - (7)].string);
         CSSSelector::PseudoType type = (yyval.selector)->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
             (yyval.selector) = 0;
@@ -3516,17 +3571,17 @@ yyreduce:
     ;}
     break;
 
-  case 183:
+  case 181:
 
 /* Line 1455 of yacc.c  */
-#line 1169 "../css/CSSGrammar.y"
+#line 1156 "css\\CSSGrammar.y"
     {
         CSSParser *p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
         (yyval.selector)->m_match = CSSSelector::PseudoClass;
-        (yyval.selector)->setArgument((yyvsp[(3) - (4)].string));
-        (yyvsp[(2) - (4)].string).lower();
-        (yyval.selector)->m_value = (yyvsp[(2) - (4)].string);
+        (yyval.selector)->setArgument((yyvsp[(4) - (6)].string));
+        (yyvsp[(2) - (6)].string).lower();
+        (yyval.selector)->m_value = (yyvsp[(2) - (6)].string);
         CSSSelector::PseudoType type = (yyval.selector)->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
             (yyval.selector) = 0;
@@ -3540,12 +3595,12 @@ yyreduce:
     ;}
     break;
 
-  case 184:
+  case 182:
 
 /* Line 1455 of yacc.c  */
-#line 1188 "../css/CSSGrammar.y"
+#line 1175 "css\\CSSGrammar.y"
     {
-        if (!(yyvsp[(4) - (6)].selector) || (yyvsp[(4) - (6)].selector)->simpleSelector() || (yyvsp[(4) - (6)].selector)->tagHistory())
+        if (!(yyvsp[(4) - (6)].selector) || (yyvsp[(4) - (6)].selector)->simpleSelector() || (yyvsp[(4) - (6)].selector)->tagHistory() || (yyvsp[(4) - (6)].selector)->matchesPseudoElement())
             (yyval.selector) = 0;
         else {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3558,19 +3613,19 @@ yyreduce:
     ;}
     break;
 
-  case 185:
+  case 183:
 
 /* Line 1455 of yacc.c  */
-#line 1203 "../css/CSSGrammar.y"
+#line 1190 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
-  case 186:
+  case 184:
 
 /* Line 1455 of yacc.c  */
-#line 1206 "../css/CSSGrammar.y"
+#line 1193 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
         if ( (yyvsp[(2) - (2)].boolean) )
@@ -3578,91 +3633,100 @@ yyreduce:
     ;}
     break;
 
-  case 187:
+  case 185:
 
 /* Line 1455 of yacc.c  */
-#line 1211 "../css/CSSGrammar.y"
+#line 1198 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
-  case 188:
+  case 186:
 
 /* Line 1455 of yacc.c  */
-#line 1214 "../css/CSSGrammar.y"
+#line 1201 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 189:
+  case 187:
 
 /* Line 1455 of yacc.c  */
-#line 1217 "../css/CSSGrammar.y"
+#line 1204 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 190:
+  case 188:
 
 /* Line 1455 of yacc.c  */
-#line 1220 "../css/CSSGrammar.y"
+#line 1207 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
     ;}
     break;
 
-  case 191:
+  case 189:
 
 /* Line 1455 of yacc.c  */
-#line 1223 "../css/CSSGrammar.y"
+#line 1210 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
     ;}
     break;
 
-  case 192:
+  case 190:
 
 /* Line 1455 of yacc.c  */
-#line 1229 "../css/CSSGrammar.y"
+#line 1216 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (3)].boolean);
     ;}
     break;
 
-  case 193:
+  case 191:
 
 /* Line 1455 of yacc.c  */
-#line 1232 "../css/CSSGrammar.y"
+#line 1219 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 194:
+  case 192:
 
 /* Line 1455 of yacc.c  */
-#line 1235 "../css/CSSGrammar.y"
+#line 1222 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 195:
+  case 193:
 
 /* Line 1455 of yacc.c  */
-#line 1238 "../css/CSSGrammar.y"
+#line 1225 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 196:
+  case 194:
+
+/* Line 1455 of yacc.c  */
+#line 1228 "css\\CSSGrammar.y"
+    {
+        (yyval.boolean) = false;
+    ;}
+    break;
+
+  case 195:
 
 /* Line 1455 of yacc.c  */
-#line 1241 "../css/CSSGrammar.y"
+#line 1231 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
         if ((yyvsp[(2) - (4)].boolean))
@@ -3670,28 +3734,28 @@ yyreduce:
     ;}
     break;
 
-  case 197:
+  case 196:
 
 /* Line 1455 of yacc.c  */
-#line 1246 "../css/CSSGrammar.y"
+#line 1236 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
     ;}
     break;
 
-  case 198:
+  case 197:
 
 /* Line 1455 of yacc.c  */
-#line 1249 "../css/CSSGrammar.y"
+#line 1239 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (6)].boolean);
     ;}
     break;
 
-  case 199:
+  case 198:
 
 /* Line 1455 of yacc.c  */
-#line 1255 "../css/CSSGrammar.y"
+#line 1245 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3707,10 +3771,10 @@ yyreduce:
     ;}
     break;
 
-  case 200:
+  case 199:
 
 /* Line 1455 of yacc.c  */
-#line 1269 "../css/CSSGrammar.y"
+#line 1259 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         p->m_valueList = new CSSParserValueList;
@@ -3724,19 +3788,19 @@ yyreduce:
     ;}
     break;
 
-  case 201:
+  case 200:
 
 /* Line 1455 of yacc.c  */
-#line 1281 "../css/CSSGrammar.y"
+#line 1271 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 202:
+  case 201:
 
 /* Line 1455 of yacc.c  */
-#line 1285 "../css/CSSGrammar.y"
+#line 1275 "css\\CSSGrammar.y"
     {
         /* The default movable type template has letter-spacing: .none;  Handle this by looking for
         error tokens at the start of an expr, recover the expr and then treat as an error, cleaning
@@ -3745,83 +3809,83 @@ yyreduce:
     ;}
     break;
 
-  case 203:
+  case 202:
 
 /* Line 1455 of yacc.c  */
-#line 1292 "../css/CSSGrammar.y"
+#line 1282 "css\\CSSGrammar.y"
     {
         /* When we encounter something like p {color: red !important fail;} we should drop the declaration */
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 204:
+  case 203:
 
 /* Line 1455 of yacc.c  */
-#line 1297 "../css/CSSGrammar.y"
+#line 1287 "css\\CSSGrammar.y"
     {
         /* Handle this case: div { text-align: center; !important } Just reduce away the stray !important. */
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 205:
+  case 204:
 
 /* Line 1455 of yacc.c  */
-#line 1302 "../css/CSSGrammar.y"
+#line 1292 "css\\CSSGrammar.y"
     {
         /* div { font-family: } Just reduce away this property with no value. */
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 206:
+  case 205:
 
 /* Line 1455 of yacc.c  */
-#line 1307 "../css/CSSGrammar.y"
+#line 1297 "css\\CSSGrammar.y"
     {
         /* if we come across rules with invalid values like this case: p { weight: *; }, just discard the rule */
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 207:
+  case 206:
 
 /* Line 1455 of yacc.c  */
-#line 1312 "../css/CSSGrammar.y"
+#line 1302 "css\\CSSGrammar.y"
     {
         /* if we come across: div { color{;color:maroon} }, ignore everything within curly brackets */
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 208:
+  case 207:
 
 /* Line 1455 of yacc.c  */
-#line 1319 "../css/CSSGrammar.y"
+#line 1309 "css\\CSSGrammar.y"
     {
         (yyval.integer) = cssPropertyID((yyvsp[(1) - (2)].string));
     ;}
     break;
 
-  case 209:
+  case 208:
 
 /* Line 1455 of yacc.c  */
-#line 1325 "../css/CSSGrammar.y"
+#line 1315 "css\\CSSGrammar.y"
     { (yyval.boolean) = true; ;}
     break;
 
-  case 210:
+  case 209:
 
 /* Line 1455 of yacc.c  */
-#line 1326 "../css/CSSGrammar.y"
+#line 1316 "css\\CSSGrammar.y"
     { (yyval.boolean) = false; ;}
     break;
 
-  case 211:
+  case 210:
 
 /* Line 1455 of yacc.c  */
-#line 1330 "../css/CSSGrammar.y"
+#line 1320 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = p->createFloatingValueList();
@@ -3829,10 +3893,10 @@ yyreduce:
     ;}
     break;
 
-  case 212:
+  case 211:
 
 /* Line 1455 of yacc.c  */
-#line 1335 "../css/CSSGrammar.y"
+#line 1325 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = (yyvsp[(1) - (3)].valueList);
@@ -3849,10 +3913,19 @@ yyreduce:
     ;}
     break;
 
+  case 212:
+
+/* Line 1455 of yacc.c  */
+#line 1339 "css\\CSSGrammar.y"
+    {
+        (yyval.valueList) = 0;
+    ;}
+    break;
+
   case 213:
 
 /* Line 1455 of yacc.c  */
-#line 1349 "../css/CSSGrammar.y"
+#line 1342 "css\\CSSGrammar.y"
     {
         (yyval.valueList) = 0;
     ;}
@@ -3861,55 +3934,64 @@ yyreduce:
   case 214:
 
 /* Line 1455 of yacc.c  */
-#line 1355 "../css/CSSGrammar.y"
+#line 1345 "css\\CSSGrammar.y"
     {
-        (yyval.character) = '/';
+        (yyval.valueList) = 0;
     ;}
     break;
 
   case 215:
 
 /* Line 1455 of yacc.c  */
-#line 1358 "../css/CSSGrammar.y"
+#line 1351 "css\\CSSGrammar.y"
     {
-        (yyval.character) = ',';
+        (yyval.character) = '/';
     ;}
     break;
 
   case 216:
 
 /* Line 1455 of yacc.c  */
-#line 1361 "../css/CSSGrammar.y"
+#line 1354 "css\\CSSGrammar.y"
+    {
+        (yyval.character) = ',';
+    ;}
+    break;
+
+  case 217:
+
+/* Line 1455 of yacc.c  */
+#line 1357 "css\\CSSGrammar.y"
     {
         (yyval.character) = 0;
   ;}
     break;
 
-  case 217:
+  case 218:
 
 /* Line 1455 of yacc.c  */
-#line 1367 "../css/CSSGrammar.y"
+#line 1363 "css\\CSSGrammar.y"
     { (yyval.value) = (yyvsp[(1) - (1)].value); ;}
     break;
 
-  case 218:
+  case 219:
 
 /* Line 1455 of yacc.c  */
-#line 1368 "../css/CSSGrammar.y"
+#line 1364 "css\\CSSGrammar.y"
     { (yyval.value) = (yyvsp[(2) - (2)].value); (yyval.value).fValue *= (yyvsp[(1) - (2)].integer); ;}
     break;
 
-  case 219:
+  case 220:
 
 /* Line 1455 of yacc.c  */
-#line 1369 "../css/CSSGrammar.y"
+#line 1365 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_STRING; ;}
     break;
 
-  case 220:
+  case 221:
 
 /* Line 1455 of yacc.c  */
-#line 1370 "../css/CSSGrammar.y"
+#line 1366 "css\\CSSGrammar.y"
     {
       (yyval.value).id = cssValueKeywordID((yyvsp[(1) - (2)].string));
       (yyval.value).unit = CSSPrimitiveValue::CSS_IDENT;
@@ -3917,219 +3999,219 @@ yyreduce:
   ;}
     break;
 
-  case 221:
+  case 222:
 
 /* Line 1455 of yacc.c  */
-#line 1376 "../css/CSSGrammar.y"
+#line 1372 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_DIMENSION; ;}
     break;
 
-  case 222:
+  case 223:
 
 /* Line 1455 of yacc.c  */
-#line 1377 "../css/CSSGrammar.y"
+#line 1373 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(2) - (3)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_DIMENSION; ;}
     break;
 
-  case 223:
+  case 224:
 
 /* Line 1455 of yacc.c  */
-#line 1378 "../css/CSSGrammar.y"
+#line 1374 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_URI; ;}
     break;
 
-  case 224:
+  case 225:
 
 /* Line 1455 of yacc.c  */
-#line 1379 "../css/CSSGrammar.y"
+#line 1375 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_UNICODE_RANGE; ;}
     break;
 
-  case 225:
+  case 226:
 
 /* Line 1455 of yacc.c  */
-#line 1380 "../css/CSSGrammar.y"
+#line 1376 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (1)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; ;}
     break;
 
-  case 226:
+  case 227:
 
 /* Line 1455 of yacc.c  */
-#line 1381 "../css/CSSGrammar.y"
+#line 1377 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = CSSParserString(); (yyval.value).unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; ;}
     break;
 
-  case 227:
+  case 228:
 
 /* Line 1455 of yacc.c  */
-#line 1383 "../css/CSSGrammar.y"
+#line 1379 "css\\CSSGrammar.y"
     {
       (yyval.value) = (yyvsp[(1) - (1)].value);
   ;}
     break;
 
-  case 228:
+  case 229:
 
 /* Line 1455 of yacc.c  */
-#line 1386 "../css/CSSGrammar.y"
+#line 1382 "css\\CSSGrammar.y"
     {
       (yyval.value) = (yyvsp[(1) - (2)].value);
   ;}
     break;
 
-  case 229:
+  case 230:
 
 /* Line 1455 of yacc.c  */
-#line 1389 "../css/CSSGrammar.y"
+#line 1385 "css\\CSSGrammar.y"
     { /* Handle width: %; */
       (yyval.value).id = 0; (yyval.value).unit = 0;
   ;}
     break;
 
-  case 230:
+  case 231:
 
 /* Line 1455 of yacc.c  */
-#line 1395 "../css/CSSGrammar.y"
+#line 1391 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).isInt = true; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER; ;}
     break;
 
-  case 231:
+  case 232:
 
 /* Line 1455 of yacc.c  */
-#line 1396 "../css/CSSGrammar.y"
+#line 1392 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).isInt = false; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER; ;}
     break;
 
-  case 232:
+  case 233:
 
 /* Line 1455 of yacc.c  */
-#line 1397 "../css/CSSGrammar.y"
+#line 1393 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PERCENTAGE; ;}
     break;
 
-  case 233:
+  case 234:
 
 /* Line 1455 of yacc.c  */
-#line 1398 "../css/CSSGrammar.y"
+#line 1394 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PX; ;}
     break;
 
-  case 234:
+  case 235:
 
 /* Line 1455 of yacc.c  */
-#line 1399 "../css/CSSGrammar.y"
+#line 1395 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_CM; ;}
     break;
 
-  case 235:
+  case 236:
 
 /* Line 1455 of yacc.c  */
-#line 1400 "../css/CSSGrammar.y"
+#line 1396 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_MM; ;}
     break;
 
-  case 236:
+  case 237:
 
 /* Line 1455 of yacc.c  */
-#line 1401 "../css/CSSGrammar.y"
+#line 1397 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_IN; ;}
     break;
 
-  case 237:
+  case 238:
 
 /* Line 1455 of yacc.c  */
-#line 1402 "../css/CSSGrammar.y"
+#line 1398 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PT; ;}
     break;
 
-  case 238:
+  case 239:
 
 /* Line 1455 of yacc.c  */
-#line 1403 "../css/CSSGrammar.y"
+#line 1399 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PC; ;}
     break;
 
-  case 239:
+  case 240:
 
 /* Line 1455 of yacc.c  */
-#line 1404 "../css/CSSGrammar.y"
+#line 1400 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_DEG; ;}
     break;
 
-  case 240:
+  case 241:
 
 /* Line 1455 of yacc.c  */
-#line 1405 "../css/CSSGrammar.y"
+#line 1401 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_RAD; ;}
     break;
 
-  case 241:
+  case 242:
 
 /* Line 1455 of yacc.c  */
-#line 1406 "../css/CSSGrammar.y"
+#line 1402 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_GRAD; ;}
     break;
 
-  case 242:
+  case 243:
 
 /* Line 1455 of yacc.c  */
-#line 1407 "../css/CSSGrammar.y"
+#line 1403 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_TURN; ;}
     break;
 
-  case 243:
+  case 244:
 
 /* Line 1455 of yacc.c  */
-#line 1408 "../css/CSSGrammar.y"
+#line 1404 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_MS; ;}
     break;
 
-  case 244:
+  case 245:
 
 /* Line 1455 of yacc.c  */
-#line 1409 "../css/CSSGrammar.y"
+#line 1405 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_S; ;}
     break;
 
-  case 245:
+  case 246:
 
 /* Line 1455 of yacc.c  */
-#line 1410 "../css/CSSGrammar.y"
+#line 1406 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_HZ; ;}
     break;
 
-  case 246:
+  case 247:
 
 /* Line 1455 of yacc.c  */
-#line 1411 "../css/CSSGrammar.y"
+#line 1407 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_KHZ; ;}
     break;
 
-  case 247:
+  case 248:
 
 /* Line 1455 of yacc.c  */
-#line 1412 "../css/CSSGrammar.y"
+#line 1408 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_EMS; ;}
     break;
 
-  case 248:
+  case 249:
 
 /* Line 1455 of yacc.c  */
-#line 1413 "../css/CSSGrammar.y"
+#line 1409 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSParserValue::Q_EMS; ;}
     break;
 
-  case 249:
+  case 250:
 
 /* Line 1455 of yacc.c  */
-#line 1414 "../css/CSSGrammar.y"
+#line 1410 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_EXS; ;}
     break;
 
-  case 250:
+  case 251:
 
 /* Line 1455 of yacc.c  */
-#line 1415 "../css/CSSGrammar.y"
+#line 1411 "css\\CSSGrammar.y"
     {
       (yyval.value).id = 0;
       (yyval.value).fValue = (yyvsp[(1) - (2)].number);
@@ -4140,10 +4222,10 @@ yyreduce:
   ;}
     break;
 
-  case 251:
+  case 252:
 
 /* Line 1455 of yacc.c  */
-#line 1426 "../css/CSSGrammar.y"
+#line 1422 "css\\CSSGrammar.y"
     {
       (yyval.value).id = 0;
       (yyval.value).string = (yyvsp[(1) - (1)].string);
@@ -4151,10 +4233,10 @@ yyreduce:
   ;}
     break;
 
-  case 252:
+  case 253:
 
 /* Line 1455 of yacc.c  */
-#line 1434 "../css/CSSGrammar.y"
+#line 1430 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         CSSParserFunction* f = p->createFloatingFunction();
@@ -4166,10 +4248,10 @@ yyreduce:
     ;}
     break;
 
-  case 253:
+  case 254:
 
 /* Line 1455 of yacc.c  */
-#line 1443 "../css/CSSGrammar.y"
+#line 1439 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         CSSParserFunction* f = p->createFloatingFunction();
@@ -4181,87 +4263,87 @@ yyreduce:
   ;}
     break;
 
-  case 254:
+  case 255:
 
 /* Line 1455 of yacc.c  */
-#line 1459 "../css/CSSGrammar.y"
+#line 1455 "css\\CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
-  case 255:
+  case 256:
 
 /* Line 1455 of yacc.c  */
-#line 1460 "../css/CSSGrammar.y"
+#line 1456 "css\\CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
-  case 256:
+  case 257:
 
 /* Line 1455 of yacc.c  */
-#line 1467 "../css/CSSGrammar.y"
+#line 1463 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 257:
+  case 258:
 
 /* Line 1455 of yacc.c  */
-#line 1470 "../css/CSSGrammar.y"
+#line 1466 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 258:
+  case 259:
 
 /* Line 1455 of yacc.c  */
-#line 1476 "../css/CSSGrammar.y"
+#line 1472 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 259:
+  case 260:
 
 /* Line 1455 of yacc.c  */
-#line 1479 "../css/CSSGrammar.y"
+#line 1475 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 262:
+  case 261:
 
 /* Line 1455 of yacc.c  */
-#line 1490 "../css/CSSGrammar.y"
+#line 1481 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 263:
+  case 262:
 
 /* Line 1455 of yacc.c  */
-#line 1496 "../css/CSSGrammar.y"
+#line 1499 "css\\CSSGrammar.y"
     {
-        (yyval.rule) = 0;
+        static_cast<CSSParser*>(parser)->invalidBlockHit();
     ;}
     break;
 
-  case 264:
+  case 263:
 
 /* Line 1455 of yacc.c  */
-#line 1502 "../css/CSSGrammar.y"
+#line 1502 "css\\CSSGrammar.y"
     {
-        (yyval.rule) = 0;
+        static_cast<CSSParser*>(parser)->invalidBlockHit();
     ;}
     break;
 
 
 
 /* Line 1455 of yacc.c  */
-#line 4265 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+#line 4347 "C:/dev/webkit-2.0/WebCore/generated/CSSGrammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -4473,6 +4555,6 @@ yyreturn:
 
 
 /* Line 1675 of yacc.c  */
-#line 1529 "../css/CSSGrammar.y"
+#line 1512 "css\\CSSGrammar.y"
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h
index ad6b20ad8b..31d6cce7c5 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h
@@ -115,7 +115,7 @@ typedef union YYSTYPE
 {
 
 /* Line 1676 of yacc.c  */
-#line 62 "../css/CSSGrammar.y"
+#line 62 "css\\CSSGrammar.y"
 
     bool boolean;
     char character;
@@ -142,7 +142,7 @@ typedef union YYSTYPE
 
 
 /* Line 1676 of yacc.c  */
-#line 144 "WebCore/tmp/../generated/CSSGrammar.tab.h"
+#line 144 "C:/dev/webkit-2.0/WebCore/generated/CSSGrammar.tab.h"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
index 919eb24850..e6ed0105c3 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
@@ -1,4 +1,4 @@
-/* ANSI-C code produced by gperf version 3.0.3 */
+/* ANSI-C code produced by gperf version 3.0.1 */
 /* Command-line: gperf -a -L ANSI-C -E -C -c -o -t --key-positions='*' -NfindProp -Hhash_prop -Wwordlist_prop -D -s 2 CSSPropertyNames.gperf  */
 
 #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \
@@ -37,7 +37,7 @@ struct props {
     const char* name;
     int id;
 };
-/* maximum key range = 1808, duplicates = 0 */
+/* maximum key range = 2138, duplicates = 0 */
 
 #ifdef __GNUC__
 __inline
@@ -51,32 +51,32 @@ hash_prop (register const char *str, register unsigned int len)
 {
   static const unsigned short asso_values[] =
     {
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814,    0, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814,    5,    0,   75,
-         0,    0,  345,    5,  315,    0,   10,    0,  105,    0,
-         5,    0,   55,   30,    5,   25,    0,  140,   75,   15,
-       375,  395,   10, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144,    0, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144,    5,    0,   75,
+         0,    0,  410,  160,  360,    0,   15,   15,    5,    5,
+         0,    0,   85,   20,    0,    0,    0,  195,   40,   15,
+       290,  745,   40, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144
     };
   register int hval = len;
 
@@ -217,582 +217,585 @@ hash_prop (register const char *str, register unsigned int len)
 
 #ifdef __GNUC__
 __inline
-#ifdef __GNUC_STDC_INLINE__
-__attribute__ ((__gnu_inline__))
-#endif
 #endif
 const struct props *
 findProp (register const char *str, register unsigned int len)
 {
   enum
     {
-      TOTAL_KEYWORDS = 280,
+      TOTAL_KEYWORDS = 283,
       MIN_WORD_LENGTH = 3,
       MAX_WORD_LENGTH = 43,
       MIN_HASH_VALUE = 6,
-      MAX_HASH_VALUE = 1813
+      MAX_HASH_VALUE = 2143
     };
 
   static const struct props wordlist_prop[] =
     {
-#line 50 "CSSPropertyNames.gperf"
-      {"bottom", CSSPropertyBottom},
-#line 148 "CSSPropertyNames.gperf"
-      {"zoom", CSSPropertyZoom},
 #line 23 "CSSPropertyNames.gperf"
       {"border", CSSPropertyBorder},
-#line 268 "CSSPropertyNames.gperf"
-      {"marker", CSSPropertyMarker},
+#line 50 "CSSPropertyNames.gperf"
+      {"bottom", CSSPropertyBottom},
 #line 24 "CSSPropertyNames.gperf"
       {"border-bottom", CSSPropertyBorderBottom},
-#line 270 "CSSPropertyNames.gperf"
-      {"marker-mid", CSSPropertyMarkerMid},
-#line 78 "CSSPropertyNames.gperf"
-      {"margin", CSSPropertyMargin},
-#line 286 "CSSPropertyNames.gperf"
-      {"kerning", CSSPropertyKerning},
-#line 269 "CSSPropertyNames.gperf"
-      {"marker-end", CSSPropertyMarkerEnd},
-#line 79 "CSSPropertyNames.gperf"
-      {"margin-bottom", CSSPropertyMarginBottom},
-#line 252 "CSSPropertyNames.gperf"
+#line 276 "CSSPropertyNames.gperf"
+      {"stroke", CSSPropertyStroke},
+#line 255 "CSSPropertyNames.gperf"
       {"mask", CSSPropertyMask},
+#line 271 "CSSPropertyNames.gperf"
+      {"marker", CSSPropertyMarker},
+#line 272 "CSSPropertyNames.gperf"
+      {"marker-end", CSSPropertyMarkerEnd},
+#line 142 "CSSPropertyNames.gperf"
+      {"widows", CSSPropertyWidows},
+#line 286 "CSSPropertyNames.gperf"
+      {"dominant-baseline", CSSPropertyDominantBaseline},
 #line 273 "CSSPropertyNames.gperf"
-      {"stroke", CSSPropertyStroke},
+      {"marker-mid", CSSPropertyMarkerMid},
+#line 274 "CSSPropertyNames.gperf"
+      {"marker-start", CSSPropertyMarkerStart},
 #line 111 "CSSPropertyNames.gperf"
       {"size", CSSPropertySize},
 #line 144 "CSSPropertyNames.gperf"
       {"word-break", CSSPropertyWordBreak},
-#line 288 "CSSPropertyNames.gperf"
-      {"writing-mode", CSSPropertyWritingMode},
-#line 163 "CSSPropertyNames.gperf"
-      {"-webkit-binding", CSSPropertyWebkitBinding},
 #line 109 "CSSPropertyNames.gperf"
       {"resize", CSSPropertyResize},
-#line 267 "CSSPropertyNames.gperf"
-      {"image-rendering", CSSPropertyImageRendering},
+#line 281 "CSSPropertyNames.gperf"
+      {"stroke-miterlimit", CSSPropertyStrokeMiterlimit},
+#line 148 "CSSPropertyNames.gperf"
+      {"zoom", CSSPropertyZoom},
+#line 280 "CSSPropertyNames.gperf"
+      {"stroke-linejoin", CSSPropertyStrokeLinejoin},
+#line 243 "CSSPropertyNames.gperf"
+      {"-webkit-transition", CSSPropertyWebkitTransition},
 #line 149 "CSSPropertyNames.gperf"
       {"-webkit-animation", CSSPropertyWebkitAnimation},
-#line 166 "CSSPropertyNames.gperf"
-      {"-webkit-border-image", CSSPropertyWebkitBorderImage},
-#line 206 "CSSPropertyNames.gperf"
+#line 208 "CSSPropertyNames.gperf"
       {"-webkit-mask", CSSPropertyWebkitMask},
-#line 136 "CSSPropertyNames.gperf"
-      {"top", CSSPropertyTop},
-#line 142 "CSSPropertyNames.gperf"
-      {"widows", CSSPropertyWidows},
-#line 271 "CSSPropertyNames.gperf"
-      {"marker-start", CSSPropertyMarkerStart},
-#line 154 "CSSPropertyNames.gperf"
+#line 196 "CSSPropertyNames.gperf"
+      {"-webkit-line-break", CSSPropertyWebkitLineBreak},
+#line 155 "CSSPropertyNames.gperf"
       {"-webkit-animation-name", CSSPropertyWebkitAnimationName},
-#line 102 "CSSPropertyNames.gperf"
-      {"page", CSSPropertyPage},
-#line 211 "CSSPropertyNames.gperf"
-      {"-webkit-mask-image", CSSPropertyWebkitMaskImage},
-#line 43 "CSSPropertyNames.gperf"
-      {"border-top", CSSPropertyBorderTop},
-#line 97 "CSSPropertyNames.gperf"
-      {"padding", CSSPropertyPadding},
-#line 241 "CSSPropertyNames.gperf"
-      {"-webkit-transition", CSSPropertyWebkitTransition},
-#line 212 "CSSPropertyNames.gperf"
-      {"-webkit-mask-origin", CSSPropertyWebkitMaskOrigin},
-#line 98 "CSSPropertyNames.gperf"
-      {"padding-bottom", CSSPropertyPaddingBottom},
-#line 82 "CSSPropertyNames.gperf"
-      {"margin-top", CSSPropertyMarginTop},
-#line 198 "CSSPropertyNames.gperf"
-      {"-webkit-margin-start", CSSPropertyWebkitMarginStart},
+#line 112 "CSSPropertyNames.gperf"
+      {"src", CSSPropertySrc},
 #line 55 "CSSPropertyNames.gperf"
       {"content", CSSPropertyContent},
-#line 107 "CSSPropertyNames.gperf"
-      {"position", CSSPropertyPosition},
 #line 59 "CSSPropertyNames.gperf"
       {"direction", CSSPropertyDirection},
-#line 219 "CSSPropertyNames.gperf"
+#line 54 "CSSPropertyNames.gperf"
+      {"color", CSSPropertyColor},
+#line 136 "CSSPropertyNames.gperf"
+      {"top", CSSPropertyTop},
+#line 52 "CSSPropertyNames.gperf"
+      {"clear", CSSPropertyClear},
+#line 31 "CSSPropertyNames.gperf"
+      {"border-color", CSSPropertyBorderColor},
+#line 107 "CSSPropertyNames.gperf"
+      {"position", CSSPropertyPosition},
+#line 43 "CSSPropertyNames.gperf"
+      {"border-top", CSSPropertyBorderTop},
+#line 25 "CSSPropertyNames.gperf"
+      {"border-bottom-color", CSSPropertyBorderBottomColor},
+#line 221 "CSSPropertyNames.gperf"
       {"-webkit-mask-size", CSSPropertyWebkitMaskSize},
-#line 112 "CSSPropertyNames.gperf"
-      {"src", CSSPropertySrc},
 #line 146 "CSSPropertyNames.gperf"
       {"word-wrap", CSSPropertyWordWrap},
-#line 221 "CSSPropertyNames.gperf"
+#line 223 "CSSPropertyNames.gperf"
       {"-webkit-nbsp-mode", CSSPropertyWebkitNbspMode},
-#line 105 "CSSPropertyNames.gperf"
-      {"page-break-inside", CSSPropertyPageBreakInside},
-#line 216 "CSSPropertyNames.gperf"
-      {"-webkit-mask-repeat", CSSPropertyWebkitMaskRepeat},
-#line 101 "CSSPropertyNames.gperf"
-      {"padding-top", CSSPropertyPaddingTop},
-#line 222 "CSSPropertyNames.gperf"
-      {"-webkit-padding-start", CSSPropertyWebkitPaddingStart},
+#line 106 "CSSPropertyNames.gperf"
+      {"pointer-events", CSSPropertyPointerEvents},
 #line 151 "CSSPropertyNames.gperf"
       {"-webkit-animation-direction", CSSPropertyWebkitAnimationDirection},
-#line 213 "CSSPropertyNames.gperf"
+#line 215 "CSSPropertyNames.gperf"
       {"-webkit-mask-position", CSSPropertyWebkitMaskPosition},
-#line 194 "CSSPropertyNames.gperf"
-      {"-webkit-line-break", CSSPropertyWebkitLineBreak},
-#line 278 "CSSPropertyNames.gperf"
-      {"stroke-miterlimit", CSSPropertyStrokeMiterlimit},
-#line 227 "CSSPropertyNames.gperf"
-      {"-webkit-rtl-ordering", CSSPropertyWebkitRtlOrdering},
-#line 277 "CSSPropertyNames.gperf"
-      {"stroke-linejoin", CSSPropertyStrokeLinejoin},
-#line 283 "CSSPropertyNames.gperf"
-      {"dominant-baseline", CSSPropertyDominantBaseline},
+#line 218 "CSSPropertyNames.gperf"
+      {"-webkit-mask-repeat", CSSPropertyWebkitMaskRepeat},
+#line 53 "CSSPropertyNames.gperf"
+      {"clip", CSSPropertyClip},
+#line 261 "CSSPropertyNames.gperf"
+      {"stop-color", CSSPropertyStopColor},
+#line 78 "CSSPropertyNames.gperf"
+      {"margin", CSSPropertyMargin},
 #line 51 "CSSPropertyNames.gperf"
       {"caption-side", CSSPropertyCaptionSide},
-#line 106 "CSSPropertyNames.gperf"
-      {"pointer-events", CSSPropertyPointerEvents},
-#line 54 "CSSPropertyNames.gperf"
-      {"color", CSSPropertyColor},
-#line 41 "CSSPropertyNames.gperf"
-      {"border-spacing", CSSPropertyBorderSpacing},
-#line 52 "CSSPropertyNames.gperf"
-      {"clear", CSSPropertyClear},
+#line 44 "CSSPropertyNames.gperf"
+      {"border-top-color", CSSPropertyBorderTopColor},
+#line 289 "CSSPropertyNames.gperf"
+      {"kerning", CSSPropertyKerning},
+#line 79 "CSSPropertyNames.gperf"
+      {"margin-bottom", CSSPropertyMarginBottom},
+#line 30 "CSSPropertyNames.gperf"
+      {"border-collapse", CSSPropertyBorderCollapse},
+#line 291 "CSSPropertyNames.gperf"
+      {"writing-mode", CSSPropertyWritingMode},
+#line 263 "CSSPropertyNames.gperf"
+      {"color-interpolation", CSSPropertyColorInterpolation},
+#line 279 "CSSPropertyNames.gperf"
+      {"stroke-linecap", CSSPropertyStrokeLinecap},
+#line 284 "CSSPropertyNames.gperf"
+      {"alignment-baseline", CSSPropertyAlignmentBaseline},
+#line 164 "CSSPropertyNames.gperf"
+      {"-webkit-binding", CSSPropertyWebkitBinding},
+#line 89 "CSSPropertyNames.gperf"
+      {"outline", CSSPropertyOutline},
 #line 36 "CSSPropertyNames.gperf"
       {"border-radius", CSSPropertyBorderRadius},
+#line 229 "CSSPropertyNames.gperf"
+      {"-webkit-rtl-ordering", CSSPropertyWebkitRtlOrdering},
+#line 167 "CSSPropertyNames.gperf"
+      {"-webkit-border-image", CSSPropertyWebkitBorderImage},
 #line 108 "CSSPropertyNames.gperf"
       {"quotes", CSSPropertyQuotes},
-#line 145 "CSSPropertyNames.gperf"
-      {"word-spacing", CSSPropertyWordSpacing},
-#line 31 "CSSPropertyNames.gperf"
-      {"border-color", CSSPropertyBorderColor},
 #line 200 "CSSPropertyNames.gperf"
-      {"-webkit-marquee", CSSPropertyWebkitMarquee},
-#line 25 "CSSPropertyNames.gperf"
-      {"border-bottom-color", CSSPropertyBorderBottomColor},
-#line 152 "CSSPropertyNames.gperf"
-      {"-webkit-animation-duration", CSSPropertyWebkitAnimationDuration},
-#line 246 "CSSPropertyNames.gperf"
-      {"-webkit-user-drag", CSSPropertyWebkitUserDrag},
-#line 167 "CSSPropertyNames.gperf"
-      {"-webkit-border-radius", CSSPropertyWebkitBorderRadius},
-#line 210 "CSSPropertyNames.gperf"
+      {"-webkit-margin-start", CSSPropertyWebkitMarginStart},
+#line 197 "CSSPropertyNames.gperf"
+      {"-webkit-line-clamp", CSSPropertyWebkitLineClamp},
+#line 214 "CSSPropertyNames.gperf"
+      {"-webkit-mask-origin", CSSPropertyWebkitMaskOrigin},
+#line 211 "CSSPropertyNames.gperf"
+      {"-webkit-mask-clip", CSSPropertyWebkitMaskClip},
+#line 212 "CSSPropertyNames.gperf"
       {"-webkit-mask-composite", CSSPropertyWebkitMaskComposite},
-#line 263 "CSSPropertyNames.gperf"
+#line 213 "CSSPropertyNames.gperf"
+      {"-webkit-mask-image", CSSPropertyWebkitMaskImage},
+#line 168 "CSSPropertyNames.gperf"
+      {"-webkit-border-radius", CSSPropertyWebkitBorderRadius},
+#line 102 "CSSPropertyNames.gperf"
+      {"page", CSSPropertyPage},
+#line 266 "CSSPropertyNames.gperf"
       {"color-rendering", CSSPropertyColorRendering},
-#line 137 "CSSPropertyNames.gperf"
-      {"unicode-bidi", CSSPropertyUnicodeBidi},
-#line 53 "CSSPropertyNames.gperf"
-      {"clip", CSSPropertyClip},
-#line 243 "CSSPropertyNames.gperf"
+#line 97 "CSSPropertyNames.gperf"
+      {"padding", CSSPropertyPadding},
+#line 245 "CSSPropertyNames.gperf"
       {"-webkit-transition-duration", CSSPropertyWebkitTransitionDuration},
-#line 157 "CSSPropertyNames.gperf"
-      {"-webkit-appearance", CSSPropertyWebkitAppearance},
-#line 10 "CSSPropertyNames.gperf"
-      {"background", CSSPropertyBackground},
-#line 138 "CSSPropertyNames.gperf"
-      {"unicode-range", CSSPropertyUnicodeRange},
+#line 82 "CSSPropertyNames.gperf"
+      {"margin-top", CSSPropertyMarginTop},
+#line 98 "CSSPropertyNames.gperf"
+      {"padding-bottom", CSSPropertyPaddingBottom},
+#line 202 "CSSPropertyNames.gperf"
+      {"-webkit-marquee", CSSPropertyWebkitMarquee},
+#line 152 "CSSPropertyNames.gperf"
+      {"-webkit-animation-duration", CSSPropertyWebkitAnimationDuration},
 #line 58 "CSSPropertyNames.gperf"
       {"cursor", CSSPropertyCursor},
-#line 89 "CSSPropertyNames.gperf"
-      {"outline", CSSPropertyOutline},
-#line 14 "CSSPropertyNames.gperf"
-      {"background-image", CSSPropertyBackgroundImage},
-#line 44 "CSSPropertyNames.gperf"
-      {"border-top-color", CSSPropertyBorderTopColor},
-#line 15 "CSSPropertyNames.gperf"
-      {"background-origin", CSSPropertyBackgroundOrigin},
+#line 137 "CSSPropertyNames.gperf"
+      {"unicode-bidi", CSSPropertyUnicodeBidi},
 #line 57 "CSSPropertyNames.gperf"
       {"counter-reset", CSSPropertyCounterReset},
-#line 258 "CSSPropertyNames.gperf"
-      {"stop-color", CSSPropertyStopColor},
-#line 281 "CSSPropertyNames.gperf"
-      {"alignment-baseline", CSSPropertyAlignmentBaseline},
-#line 22 "CSSPropertyNames.gperf"
-      {"background-size", CSSPropertyBackgroundSize},
-#line 203 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-repetition", CSSPropertyWebkitMarqueeRepetition},
-#line 276 "CSSPropertyNames.gperf"
-      {"stroke-linecap", CSSPropertyStrokeLinecap},
-#line 161 "CSSPropertyNames.gperf"
-      {"-webkit-background-origin", CSSPropertyWebkitBackgroundOrigin},
+#line 181 "CSSPropertyNames.gperf"
+      {"-webkit-color-correction", CSSPropertyWebkitColorCorrection},
+#line 105 "CSSPropertyNames.gperf"
+      {"page-break-inside", CSSPropertyPageBreakInside},
+#line 90 "CSSPropertyNames.gperf"
+      {"outline-color", CSSPropertyOutlineColor},
+#line 116 "CSSPropertyNames.gperf"
+      {"text-indent", CSSPropertyTextIndent},
+#line 251 "CSSPropertyNames.gperf"
+      {"-webkit-variable-declaration-block", CSSPropertyWebkitVariableDeclarationBlock},
+#line 224 "CSSPropertyNames.gperf"
+      {"-webkit-padding-start", CSSPropertyWebkitPaddingStart},
+#line 158 "CSSPropertyNames.gperf"
+      {"-webkit-appearance", CSSPropertyWebkitAppearance},
+#line 139 "CSSPropertyNames.gperf"
+      {"vertical-align", CSSPropertyVerticalAlign},
+#line 250 "CSSPropertyNames.gperf"
+      {"-webkit-user-select", CSSPropertyWebkitUserSelect},
+#line 192 "CSSPropertyNames.gperf"
+      {"-webkit-columns", CSSPropertyWebkitColumns},
+#line 225 "CSSPropertyNames.gperf"
+      {"-webkit-perspective", CSSPropertyWebkitPerspective},
+#line 147 "CSSPropertyNames.gperf"
+      {"z-index", CSSPropertyZIndex},
+#line 176 "CSSPropertyNames.gperf"
+      {"-webkit-box-orient", CSSPropertyWebkitBoxOrient},
+#line 41 "CSSPropertyNames.gperf"
+      {"border-spacing", CSSPropertyBorderSpacing},
+#line 174 "CSSPropertyNames.gperf"
+      {"-webkit-box-lines", CSSPropertyWebkitBoxLines},
 #line 72 "CSSPropertyNames.gperf"
       {"letter-spacing", CSSPropertyLetterSpacing},
-#line 204 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-speed", CSSPropertyWebkitMarqueeSpeed},
-#line 209 "CSSPropertyNames.gperf"
-      {"-webkit-mask-clip", CSSPropertyWebkitMaskClip},
-#line 153 "CSSPropertyNames.gperf"
+#line 270 "CSSPropertyNames.gperf"
+      {"image-rendering", CSSPropertyImageRendering},
+#line 101 "CSSPropertyNames.gperf"
+      {"padding-top", CSSPropertyPaddingTop},
+#line 123 "CSSPropertyNames.gperf"
+      {"text-overline", CSSPropertyTextOverline},
+#line 145 "CSSPropertyNames.gperf"
+      {"word-spacing", CSSPropertyWordSpacing},
+#line 154 "CSSPropertyNames.gperf"
       {"-webkit-animation-iteration-count", CSSPropertyWebkitAnimationIterationCount},
-#line 201 "CSSPropertyNames.gperf"
+#line 234 "CSSPropertyNames.gperf"
+      {"-webkit-text-stroke", CSSPropertyWebkitTextStroke},
+#line 203 "CSSPropertyNames.gperf"
       {"-webkit-marquee-direction", CSSPropertyWebkitMarqueeDirection},
-#line 162 "CSSPropertyNames.gperf"
-      {"-webkit-background-size", CSSPropertyWebkitBackgroundSize},
-#line 202 "CSSPropertyNames.gperf"
+#line 184 "CSSPropertyNames.gperf"
+      {"-webkit-column-break-inside", CSSPropertyWebkitColumnBreakInside},
+#line 125 "CSSPropertyNames.gperf"
+      {"text-overline-mode", CSSPropertyTextOverlineMode},
+#line 204 "CSSPropertyNames.gperf"
       {"-webkit-marquee-increment", CSSPropertyWebkitMarqueeIncrement},
-#line 19 "CSSPropertyNames.gperf"
-      {"background-repeat", CSSPropertyBackgroundRepeat},
-#line 223 "CSSPropertyNames.gperf"
-      {"-webkit-perspective", CSSPropertyWebkitPerspective},
-#line 110 "CSSPropertyNames.gperf"
-      {"right", CSSPropertyRight},
+#line 206 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-speed", CSSPropertyWebkitMarqueeSpeed},
+#line 205 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-repetition", CSSPropertyWebkitMarqueeRepetition},
 #line 56 "CSSPropertyNames.gperf"
       {"counter-increment", CSSPropertyCounterIncrement},
+#line 254 "CSSPropertyNames.gperf"
+      {"clip-rule", CSSPropertyClipRule},
 #line 143 "CSSPropertyNames.gperf"
       {"width", CSSPropertyWidth},
-#line 16 "CSSPropertyNames.gperf"
-      {"background-position", CSSPropertyBackgroundPosition},
-#line 86 "CSSPropertyNames.gperf"
-      {"min-width", CSSPropertyMinWidth},
-#line 224 "CSSPropertyNames.gperf"
-      {"-webkit-perspective-origin", CSSPropertyWebkitPerspectiveOrigin},
-#line 37 "CSSPropertyNames.gperf"
-      {"border-right", CSSPropertyBorderRight},
+#line 115 "CSSPropertyNames.gperf"
+      {"text-decoration", CSSPropertyTextDecoration},
 #line 49 "CSSPropertyNames.gperf"
       {"border-width", CSSPropertyBorderWidth},
-#line 63 "CSSPropertyNames.gperf"
-      {"font", CSSPropertyFont},
-#line 81 "CSSPropertyNames.gperf"
-      {"margin-right", CSSPropertyMarginRight},
+#line 86 "CSSPropertyNames.gperf"
+      {"min-width", CSSPropertyMinWidth},
+#line 199 "CSSPropertyNames.gperf"
+      {"-webkit-margin-collapse", CSSPropertyWebkitMarginCollapse},
 #line 29 "CSSPropertyNames.gperf"
       {"border-bottom-width", CSSPropertyBorderBottomWidth},
-#line 253 "CSSPropertyNames.gperf"
-      {"enable-background", CSSPropertyEnableBackground},
-#line 280 "CSSPropertyNames.gperf"
+#line 283 "CSSPropertyNames.gperf"
       {"stroke-width", CSSPropertyStrokeWidth},
-#line 190 "CSSPropertyNames.gperf"
-      {"-webkit-columns", CSSPropertyWebkitColumns},
-#line 195 "CSSPropertyNames.gperf"
-      {"-webkit-line-clamp", CSSPropertyWebkitLineClamp},
-#line 260 "CSSPropertyNames.gperf"
-      {"color-interpolation", CSSPropertyColorInterpolation},
-#line 164 "CSSPropertyNames.gperf"
-      {"-webkit-border-fit", CSSPropertyWebkitBorderFit},
-#line 289 "CSSPropertyNames.gperf"
-      {"-webkit-shadow", CSSPropertyWebkitShadow},
-#line 65 "CSSPropertyNames.gperf"
-      {"font-size", CSSPropertyFontSize},
-#line 30 "CSSPropertyNames.gperf"
-      {"border-collapse", CSSPropertyBorderCollapse},
-#line 116 "CSSPropertyNames.gperf"
-      {"text-indent", CSSPropertyTextIndent},
-#line 147 "CSSPropertyNames.gperf"
-      {"z-index", CSSPropertyZIndex},
-#line 139 "CSSPropertyNames.gperf"
-      {"vertical-align", CSSPropertyVerticalAlign},
-#line 182 "CSSPropertyNames.gperf"
-      {"-webkit-column-break-inside", CSSPropertyWebkitColumnBreakInside},
-#line 100 "CSSPropertyNames.gperf"
-      {"padding-right", CSSPropertyPaddingRight},
 #line 248 "CSSPropertyNames.gperf"
-      {"-webkit-user-select", CSSPropertyWebkitUserSelect},
-#line 48 "CSSPropertyNames.gperf"
-      {"border-top-width", CSSPropertyBorderTopWidth},
-#line 128 "CSSPropertyNames.gperf"
-      {"text-rendering", CSSPropertyTextRendering},
-#line 88 "CSSPropertyNames.gperf"
-      {"orphans", CSSPropertyOrphans},
-#line 175 "CSSPropertyNames.gperf"
-      {"-webkit-box-orient", CSSPropertyWebkitBoxOrient},
-#line 235 "CSSPropertyNames.gperf"
-      {"-webkit-transform", CSSPropertyWebkitTransform},
-#line 184 "CSSPropertyNames.gperf"
-      {"-webkit-column-gap", CSSPropertyWebkitColumnGap},
-#line 197 "CSSPropertyNames.gperf"
-      {"-webkit-margin-collapse", CSSPropertyWebkitMarginCollapse},
-#line 160 "CSSPropertyNames.gperf"
-      {"-webkit-background-composite", CSSPropertyWebkitBackgroundComposite},
-#line 196 "CSSPropertyNames.gperf"
+      {"-webkit-user-drag", CSSPropertyWebkitUserDrag},
+#line 198 "CSSPropertyNames.gperf"
       {"-webkit-margin-bottom-collapse", CSSPropertyWebkitMarginBottomCollapse},
-#line 13 "CSSPropertyNames.gperf"
-      {"background-color", CSSPropertyBackgroundColor},
-#line 232 "CSSPropertyNames.gperf"
-      {"-webkit-text-stroke", CSSPropertyWebkitTextStroke},
-#line 272 "CSSPropertyNames.gperf"
-      {"shape-rendering", CSSPropertyShapeRendering},
-#line 104 "CSSPropertyNames.gperf"
-      {"page-break-before", CSSPropertyPageBreakBefore},
-#line 236 "CSSPropertyNames.gperf"
-      {"-webkit-transform-origin", CSSPropertyWebkitTransformOrigin},
-#line 103 "CSSPropertyNames.gperf"
-      {"page-break-after", CSSPropertyPageBreakAfter},
-#line 90 "CSSPropertyNames.gperf"
-      {"outline-color", CSSPropertyOutlineColor},
-#line 208 "CSSPropertyNames.gperf"
-      {"-webkit-mask-box-image", CSSPropertyWebkitMaskBoxImage},
-#line 179 "CSSPropertyNames.gperf"
-      {"-webkit-box-sizing", CSSPropertyWebkitBoxSizing},
+#line 63 "CSSPropertyNames.gperf"
+      {"font", CSSPropertyFont},
+#line 171 "CSSPropertyNames.gperf"
+      {"-webkit-box-direction", CSSPropertyWebkitBoxDirection},
 #line 71 "CSSPropertyNames.gperf"
       {"left", CSSPropertyLeft},
-#line 239 "CSSPropertyNames.gperf"
-      {"-webkit-transform-origin-z", CSSPropertyWebkitTransformOriginZ},
-#line 68 "CSSPropertyNames.gperf"
-      {"font-variant", CSSPropertyFontVariant},
+#line 257 "CSSPropertyNames.gperf"
+      {"filter", CSSPropertyFilter},
+#line 267 "CSSPropertyNames.gperf"
+      {"fill", CSSPropertyFill},
 #line 62 "CSSPropertyNames.gperf"
       {"float", CSSPropertyFloat},
-#line 254 "CSSPropertyNames.gperf"
-      {"filter", CSSPropertyFilter},
 #line 32 "CSSPropertyNames.gperf"
       {"border-left", CSSPropertyBorderLeft},
-#line 207 "CSSPropertyNames.gperf"
+#line 124 "CSSPropertyNames.gperf"
+      {"text-overline-color", CSSPropertyTextOverlineColor},
+#line 235 "CSSPropertyNames.gperf"
+      {"-webkit-text-stroke-color", CSSPropertyWebkitTextStrokeColor},
+#line 138 "CSSPropertyNames.gperf"
+      {"unicode-range", CSSPropertyUnicodeRange},
+#line 216 "CSSPropertyNames.gperf"
+      {"-webkit-mask-position-x", CSSPropertyWebkitMaskPositionX},
+#line 219 "CSSPropertyNames.gperf"
+      {"-webkit-mask-repeat-x", CSSPropertyWebkitMaskRepeatX},
+#line 88 "CSSPropertyNames.gperf"
+      {"orphans", CSSPropertyOrphans},
+#line 165 "CSSPropertyNames.gperf"
+      {"-webkit-border-fit", CSSPropertyWebkitBorderFit},
+#line 65 "CSSPropertyNames.gperf"
+      {"font-size", CSSPropertyFontSize},
+#line 10 "CSSPropertyNames.gperf"
+      {"background", CSSPropertyBackground},
+#line 128 "CSSPropertyNames.gperf"
+      {"text-rendering", CSSPropertyTextRendering},
+#line 237 "CSSPropertyNames.gperf"
+      {"-webkit-transform", CSSPropertyWebkitTransform},
+#line 114 "CSSPropertyNames.gperf"
+      {"text-align", CSSPropertyTextAlign},
+#line 68 "CSSPropertyNames.gperf"
+      {"font-variant", CSSPropertyFontVariant},
+#line 48 "CSSPropertyNames.gperf"
+      {"border-top-width", CSSPropertyBorderTopWidth},
+#line 256 "CSSPropertyNames.gperf"
+      {"enable-background", CSSPropertyEnableBackground},
+#line 94 "CSSPropertyNames.gperf"
+      {"overflow", CSSPropertyOverflow},
+#line 201 "CSSPropertyNames.gperf"
+      {"-webkit-margin-top-collapse", CSSPropertyWebkitMarginTopCollapse},
+#line 153 "CSSPropertyNames.gperf"
+      {"-webkit-animation-fill-mode", CSSPropertyWebkitAnimationFillMode},
+#line 226 "CSSPropertyNames.gperf"
+      {"-webkit-perspective-origin", CSSPropertyWebkitPerspectiveOrigin},
+#line 131 "CSSPropertyNames.gperf"
+      {"text-underline", CSSPropertyTextUnderline},
+#line 22 "CSSPropertyNames.gperf"
+      {"background-size", CSSPropertyBackgroundSize},
+#line 258 "CSSPropertyNames.gperf"
+      {"flood-color", CSSPropertyFloodColor},
+#line 170 "CSSPropertyNames.gperf"
+      {"-webkit-box-align", CSSPropertyWebkitBoxAlign},
+#line 169 "CSSPropertyNames.gperf"
+      {"-webkit-border-vertical-spacing", CSSPropertyWebkitBorderVerticalSpacing},
+#line 33 "CSSPropertyNames.gperf"
+      {"border-left-color", CSSPropertyBorderLeftColor},
+#line 193 "CSSPropertyNames.gperf"
+      {"-webkit-font-size-delta", CSSPropertyWebkitFontSizeDelta},
+#line 133 "CSSPropertyNames.gperf"
+      {"text-underline-mode", CSSPropertyTextUnderlineMode},
+#line 177 "CSSPropertyNames.gperf"
+      {"-webkit-box-pack", CSSPropertyWebkitBoxPack},
+#line 110 "CSSPropertyNames.gperf"
+      {"right", CSSPropertyRight},
+#line 209 "CSSPropertyNames.gperf"
       {"-webkit-mask-attachment", CSSPropertyWebkitMaskAttachment},
-#line 115 "CSSPropertyNames.gperf"
-      {"text-decoration", CSSPropertyTextDecoration},
+#line 187 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule", CSSPropertyWebkitColumnRule},
+#line 37 "CSSPropertyNames.gperf"
+      {"border-right", CSSPropertyBorderRight},
+#line 210 "CSSPropertyNames.gperf"
+      {"-webkit-mask-box-image", CSSPropertyWebkitMaskBoxImage},
+#line 180 "CSSPropertyNames.gperf"
+      {"-webkit-box-sizing", CSSPropertyWebkitBoxSizing},
+#line 163 "CSSPropertyNames.gperf"
+      {"-webkit-background-size", CSSPropertyWebkitBackgroundSize},
+#line 13 "CSSPropertyNames.gperf"
+      {"background-color", CSSPropertyBackgroundColor},
+#line 141 "CSSPropertyNames.gperf"
+      {"white-space", CSSPropertyWhiteSpace},
+#line 16 "CSSPropertyNames.gperf"
+      {"background-position", CSSPropertyBackgroundPosition},
+#line 19 "CSSPropertyNames.gperf"
+      {"background-repeat", CSSPropertyBackgroundRepeat},
+#line 186 "CSSPropertyNames.gperf"
+      {"-webkit-column-gap", CSSPropertyWebkitColumnGap},
+#line 252 "CSSPropertyNames.gperf"
+      {"-webkit-dashboard-region", CSSPropertyWebkitDashboardRegion},
+#line 93 "CSSPropertyNames.gperf"
+      {"outline-width", CSSPropertyOutlineWidth},
+#line 132 "CSSPropertyNames.gperf"
+      {"text-underline-color", CSSPropertyTextUnderlineColor},
+#line 265 "CSSPropertyNames.gperf"
+      {"color-profile", CSSPropertyColorProfile},
 #line 80 "CSSPropertyNames.gperf"
       {"margin-left", CSSPropertyMarginLeft},
+#line 233 "CSSPropertyNames.gperf"
+      {"-webkit-text-size-adjust", CSSPropertyWebkitTextSizeAdjust},
+#line 185 "CSSPropertyNames.gperf"
+      {"-webkit-column-count", CSSPropertyWebkitColumnCount},
+#line 188 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule-color", CSSPropertyWebkitColumnRuleColor},
+#line 264 "CSSPropertyNames.gperf"
+      {"color-interpolation-filters", CSSPropertyColorInterpolationFilters},
+#line 38 "CSSPropertyNames.gperf"
+      {"border-right-color", CSSPropertyBorderRightColor},
+#line 253 "CSSPropertyNames.gperf"
+      {"clip-path", CSSPropertyClipPath},
+#line 275 "CSSPropertyNames.gperf"
+      {"shape-rendering", CSSPropertyShapeRendering},
+#line 15 "CSSPropertyNames.gperf"
+      {"background-origin", CSSPropertyBackgroundOrigin},
+#line 292 "CSSPropertyNames.gperf"
+      {"-webkit-svg-shadow", CSSPropertyWebkitSvgShadow},
+#line 269 "CSSPropertyNames.gperf"
+      {"fill-rule", CSSPropertyFillRule},
 #line 12 "CSSPropertyNames.gperf"
       {"background-clip", CSSPropertyBackgroundClip},
-#line 199 "CSSPropertyNames.gperf"
-      {"-webkit-margin-top-collapse", CSSPropertyWebkitMarginTopCollapse},
-#line 168 "CSSPropertyNames.gperf"
-      {"-webkit-border-vertical-spacing", CSSPropertyWebkitBorderVerticalSpacing},
-#line 251 "CSSPropertyNames.gperf"
-      {"clip-rule", CSSPropertyClipRule},
-#line 170 "CSSPropertyNames.gperf"
-      {"-webkit-box-direction", CSSPropertyWebkitBoxDirection},
-#line 141 "CSSPropertyNames.gperf"
-      {"white-space", CSSPropertyWhiteSpace},
-#line 114 "CSSPropertyNames.gperf"
-      {"text-align", CSSPropertyTextAlign},
-#line 217 "CSSPropertyNames.gperf"
-      {"-webkit-mask-repeat-x", CSSPropertyWebkitMaskRepeatX},
-#line 159 "CSSPropertyNames.gperf"
+#line 238 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin", CSSPropertyWebkitTransformOrigin},
+#line 14 "CSSPropertyNames.gperf"
+      {"background-image", CSSPropertyBackgroundImage},
+#line 26 "CSSPropertyNames.gperf"
+      {"border-bottom-left-radius", CSSPropertyBorderBottomLeftRadius},
+#line 162 "CSSPropertyNames.gperf"
+      {"-webkit-background-origin", CSSPropertyWebkitBackgroundOrigin},
+#line 160 "CSSPropertyNames.gperf"
       {"-webkit-background-clip", CSSPropertyWebkitBackgroundClip},
-#line 218 "CSSPropertyNames.gperf"
-      {"-webkit-mask-repeat-y", CSSPropertyWebkitMaskRepeatY},
-#line 169 "CSSPropertyNames.gperf"
-      {"-webkit-box-align", CSSPropertyWebkitBoxAlign},
-#line 214 "CSSPropertyNames.gperf"
-      {"-webkit-mask-position-x", CSSPropertyWebkitMaskPositionX},
+#line 161 "CSSPropertyNames.gperf"
+      {"-webkit-background-composite", CSSPropertyWebkitBackgroundComposite},
+#line 241 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin-z", CSSPropertyWebkitTransformOriginZ},
 #line 99 "CSSPropertyNames.gperf"
       {"padding-left", CSSPropertyPaddingLeft},
+#line 129 "CSSPropertyNames.gperf"
+      {"text-shadow", CSSPropertyTextShadow},
+#line 84 "CSSPropertyNames.gperf"
+      {"max-width", CSSPropertyMaxWidth},
+#line 104 "CSSPropertyNames.gperf"
+      {"page-break-before", CSSPropertyPageBreakBefore},
+#line 103 "CSSPropertyNames.gperf"
+      {"page-break-after", CSSPropertyPageBreakAfter},
+#line 81 "CSSPropertyNames.gperf"
+      {"margin-right", CSSPropertyMarginRight},
 #line 191 "CSSPropertyNames.gperf"
-      {"-webkit-font-size-delta", CSSPropertyWebkitFontSizeDelta},
+      {"-webkit-column-width", CSSPropertyWebkitColumnWidth},
+#line 179 "CSSPropertyNames.gperf"
+      {"-webkit-box-shadow", CSSPropertyWebkitBoxShadow},
+#line 45 "CSSPropertyNames.gperf"
+      {"border-top-left-radius", CSSPropertyBorderTopLeftRadius},
+#line 130 "CSSPropertyNames.gperf"
+      {"text-transform", CSSPropertyTextTransform},
+#line 127 "CSSPropertyNames.gperf"
+      {"text-overline-width", CSSPropertyTextOverlineWidth},
+#line 236 "CSSPropertyNames.gperf"
+      {"-webkit-text-stroke-width", CSSPropertyWebkitTextStrokeWidth},
+#line 290 "CSSPropertyNames.gperf"
+      {"text-anchor", CSSPropertyTextAnchor},
 #line 27 "CSSPropertyNames.gperf"
       {"border-bottom-right-radius", CSSPropertyBorderBottomRightRadius},
-#line 87 "CSSPropertyNames.gperf"
-      {"opacity", CSSPropertyOpacity},
-#line 38 "CSSPropertyNames.gperf"
-      {"border-right-color", CSSPropertyBorderRightColor},
-#line 176 "CSSPropertyNames.gperf"
-      {"-webkit-box-pack", CSSPropertyWebkitBoxPack},
-#line 173 "CSSPropertyNames.gperf"
-      {"-webkit-box-lines", CSSPropertyWebkitBoxLines},
 #line 42 "CSSPropertyNames.gperf"
       {"border-style", CSSPropertyBorderStyle},
-#line 215 "CSSPropertyNames.gperf"
-      {"-webkit-mask-position-y", CSSPropertyWebkitMaskPositionY},
-#line 94 "CSSPropertyNames.gperf"
-      {"overflow", CSSPropertyOverflow},
+#line 74 "CSSPropertyNames.gperf"
+      {"list-style", CSSPropertyListStyle},
+#line 183 "CSSPropertyNames.gperf"
+      {"-webkit-column-break-before", CSSPropertyWebkitColumnBreakBefore},
+#line 95 "CSSPropertyNames.gperf"
+      {"overflow-x", CSSPropertyOverflowX},
+#line 182 "CSSPropertyNames.gperf"
+      {"-webkit-column-break-after", CSSPropertyWebkitColumnBreakAfter},
+#line 122 "CSSPropertyNames.gperf"
+      {"text-overflow", CSSPropertyTextOverflow},
 #line 28 "CSSPropertyNames.gperf"
       {"border-bottom-style", CSSPropertyBorderBottomStyle},
-#line 264 "CSSPropertyNames.gperf"
-      {"fill", CSSPropertyFill},
+#line 260 "CSSPropertyNames.gperf"
+      {"lighting-color", CSSPropertyLightingColor},
+#line 100 "CSSPropertyNames.gperf"
+      {"padding-right", CSSPropertyPaddingRight},
+#line 227 "CSSPropertyNames.gperf"
+      {"-webkit-perspective-origin-x", CSSPropertyWebkitPerspectiveOriginX},
+#line 285 "CSSPropertyNames.gperf"
+      {"baseline-shift", CSSPropertyBaselineShift},
+#line 175 "CSSPropertyNames.gperf"
+      {"-webkit-box-ordinal-group", CSSPropertyWebkitBoxOrdinalGroup},
+#line 166 "CSSPropertyNames.gperf"
+      {"-webkit-border-horizontal-spacing", CSSPropertyWebkitBorderHorizontalSpacing},
+#line 140 "CSSPropertyNames.gperf"
+      {"visibility", CSSPropertyVisibility},
+#line 35 "CSSPropertyNames.gperf"
+      {"border-left-width", CSSPropertyBorderLeftWidth},
+#line 244 "CSSPropertyNames.gperf"
+      {"-webkit-transition-delay", CSSPropertyWebkitTransitionDelay},
 #line 150 "CSSPropertyNames.gperf"
       {"-webkit-animation-delay", CSSPropertyWebkitAnimationDelay},
-#line 279 "CSSPropertyNames.gperf"
-      {"stroke-opacity", CSSPropertyStrokeOpacity},
-#line 123 "CSSPropertyNames.gperf"
-      {"text-overline", CSSPropertyTextOverline},
-#line 183 "CSSPropertyNames.gperf"
-      {"-webkit-column-count", CSSPropertyWebkitColumnCount},
-#line 125 "CSSPropertyNames.gperf"
-      {"text-overline-mode", CSSPropertyTextOverlineMode},
 #line 46 "CSSPropertyNames.gperf"
       {"border-top-right-radius", CSSPropertyBorderTopRightRadius},
-#line 242 "CSSPropertyNames.gperf"
-      {"-webkit-transition-delay", CSSPropertyWebkitTransitionDelay},
+#line 178 "CSSPropertyNames.gperf"
+      {"-webkit-box-reflect", CSSPropertyWebkitBoxReflect},
+#line 231 "CSSPropertyNames.gperf"
+      {"-webkit-text-fill-color", CSSPropertyWebkitTextFillColor},
+#line 17 "CSSPropertyNames.gperf"
+      {"background-position-x", CSSPropertyBackgroundPositionX},
 #line 60 "CSSPropertyNames.gperf"
       {"display", CSSPropertyDisplay},
-#line 93 "CSSPropertyNames.gperf"
-      {"outline-width", CSSPropertyOutlineWidth},
-#line 244 "CSSPropertyNames.gperf"
-      {"-webkit-transition-property", CSSPropertyWebkitTransitionProperty},
+#line 20 "CSSPropertyNames.gperf"
+      {"background-repeat-x", CSSPropertyBackgroundRepeatX},
 #line 47 "CSSPropertyNames.gperf"
       {"border-top-style", CSSPropertyBorderTopStyle},
-#line 185 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule", CSSPropertyWebkitColumnRule},
-#line 140 "CSSPropertyNames.gperf"
-      {"visibility", CSSPropertyVisibility},
-#line 250 "CSSPropertyNames.gperf"
-      {"clip-path", CSSPropertyClipPath},
-#line 259 "CSSPropertyNames.gperf"
-      {"stop-opacity", CSSPropertyStopOpacity},
-#line 249 "CSSPropertyNames.gperf"
-      {"-webkit-variable-declaration-block", CSSPropertyWebkitVariableDeclarationBlock},
-#line 231 "CSSPropertyNames.gperf"
-      {"-webkit-text-size-adjust", CSSPropertyWebkitTextSizeAdjust},
-#line 233 "CSSPropertyNames.gperf"
-      {"-webkit-text-stroke-color", CSSPropertyWebkitTextStrokeColor},
-#line 257 "CSSPropertyNames.gperf"
-      {"lighting-color", CSSPropertyLightingColor},
+#line 66 "CSSPropertyNames.gperf"
+      {"font-stretch", CSSPropertyFontStretch},
+#line 76 "CSSPropertyNames.gperf"
+      {"list-style-position", CSSPropertyListStylePosition},
+#line 135 "CSSPropertyNames.gperf"
+      {"text-underline-width", CSSPropertyTextUnderlineWidth},
 #line 70 "CSSPropertyNames.gperf"
       {"height", CSSPropertyHeight},
-#line 255 "CSSPropertyNames.gperf"
-      {"flood-color", CSSPropertyFloodColor},
-#line 156 "CSSPropertyNames.gperf"
-      {"-webkit-animation-timing-function", CSSPropertyWebkitAnimationTimingFunction},
-#line 131 "CSSPropertyNames.gperf"
-      {"text-underline", CSSPropertyTextUnderline},
 #line 85 "CSSPropertyNames.gperf"
       {"min-height", CSSPropertyMinHeight},
-#line 155 "CSSPropertyNames.gperf"
+#line 73 "CSSPropertyNames.gperf"
+      {"line-height", CSSPropertyLineHeight},
+#line 217 "CSSPropertyNames.gperf"
+      {"-webkit-mask-position-y", CSSPropertyWebkitMaskPositionY},
+#line 190 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule-width", CSSPropertyWebkitColumnRuleWidth},
+#line 220 "CSSPropertyNames.gperf"
+      {"-webkit-mask-repeat-y", CSSPropertyWebkitMaskRepeatY},
+#line 40 "CSSPropertyNames.gperf"
+      {"border-right-width", CSSPropertyBorderRightWidth},
+#line 247 "CSSPropertyNames.gperf"
+      {"-webkit-transition-timing-function", CSSPropertyWebkitTransitionTimingFunction},
+#line 87 "CSSPropertyNames.gperf"
+      {"opacity", CSSPropertyOpacity},
+#line 156 "CSSPropertyNames.gperf"
       {"-webkit-animation-play-state", CSSPropertyWebkitAnimationPlayState},
-#line 133 "CSSPropertyNames.gperf"
-      {"text-underline-mode", CSSPropertyTextUnderlineMode},
-#line 26 "CSSPropertyNames.gperf"
-      {"border-bottom-left-radius", CSSPropertyBorderBottomLeftRadius},
 #line 11 "CSSPropertyNames.gperf"
       {"background-attachment", CSSPropertyBackgroundAttachment},
-#line 33 "CSSPropertyNames.gperf"
-      {"border-left-color", CSSPropertyBorderLeftColor},
-#line 74 "CSSPropertyNames.gperf"
-      {"list-style", CSSPropertyListStyle},
-#line 165 "CSSPropertyNames.gperf"
-      {"-webkit-border-horizontal-spacing", CSSPropertyWebkitBorderHorizontalSpacing},
-#line 245 "CSSPropertyNames.gperf"
-      {"-webkit-transition-timing-function", CSSPropertyWebkitTransitionTimingFunction},
+#line 157 "CSSPropertyNames.gperf"
+      {"-webkit-animation-timing-function", CSSPropertyWebkitAnimationTimingFunction},
+#line 239 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin-x", CSSPropertyWebkitTransformOriginX},
+#line 222 "CSSPropertyNames.gperf"
+      {"-webkit-match-nearest-mail-blockquote-color", CSSPropertyWebkitMatchNearestMailBlockquoteColor},
+#line 61 "CSSPropertyNames.gperf"
+      {"empty-cells", CSSPropertyEmptyCells},
+#line 282 "CSSPropertyNames.gperf"
+      {"stroke-opacity", CSSPropertyStrokeOpacity},
 #line 75 "CSSPropertyNames.gperf"
       {"list-style-image", CSSPropertyListStyleImage},
-#line 40 "CSSPropertyNames.gperf"
-      {"border-right-width", CSSPropertyBorderRightWidth},
-#line 189 "CSSPropertyNames.gperf"
-      {"-webkit-column-width", CSSPropertyWebkitColumnWidth},
-#line 20 "CSSPropertyNames.gperf"
-      {"background-repeat-x", CSSPropertyBackgroundRepeatX},
 #line 69 "CSSPropertyNames.gperf"
       {"font-weight", CSSPropertyFontWeight},
-#line 262 "CSSPropertyNames.gperf"
-      {"color-profile", CSSPropertyColorProfile},
-#line 45 "CSSPropertyNames.gperf"
-      {"border-top-left-radius", CSSPropertyBorderTopLeftRadius},
-#line 21 "CSSPropertyNames.gperf"
-      {"background-repeat-y", CSSPropertyBackgroundRepeatY},
-#line 17 "CSSPropertyNames.gperf"
-      {"background-position-x", CSSPropertyBackgroundPositionX},
-#line 84 "CSSPropertyNames.gperf"
-      {"max-width", CSSPropertyMaxWidth},
-#line 225 "CSSPropertyNames.gperf"
-      {"-webkit-perspective-origin-x", CSSPropertyWebkitPerspectiveOriginX},
-#line 181 "CSSPropertyNames.gperf"
-      {"-webkit-column-break-before", CSSPropertyWebkitColumnBreakBefore},
-#line 180 "CSSPropertyNames.gperf"
-      {"-webkit-column-break-after", CSSPropertyWebkitColumnBreakAfter},
-#line 18 "CSSPropertyNames.gperf"
-      {"background-position-y", CSSPropertyBackgroundPositionY},
-#line 192 "CSSPropertyNames.gperf"
-      {"-webkit-font-smoothing", CSSPropertyWebkitFontSmoothing},
-#line 174 "CSSPropertyNames.gperf"
-      {"-webkit-box-ordinal-group", CSSPropertyWebkitBoxOrdinalGroup},
-#line 205 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-style", CSSPropertyWebkitMarqueeStyle},
-#line 226 "CSSPropertyNames.gperf"
-      {"-webkit-perspective-origin-y", CSSPropertyWebkitPerspectiveOriginY},
-#line 129 "CSSPropertyNames.gperf"
-      {"text-shadow", CSSPropertyTextShadow},
-#line 73 "CSSPropertyNames.gperf"
-      {"line-height", CSSPropertyLineHeight},
-#line 76 "CSSPropertyNames.gperf"
-      {"list-style-position", CSSPropertyListStylePosition},
-#line 113 "CSSPropertyNames.gperf"
-      {"table-layout", CSSPropertyTableLayout},
-#line 178 "CSSPropertyNames.gperf"
-      {"-webkit-box-shadow", CSSPropertyWebkitBoxShadow},
-#line 124 "CSSPropertyNames.gperf"
-      {"text-overline-color", CSSPropertyTextOverlineColor},
-#line 61 "CSSPropertyNames.gperf"
-      {"empty-cells", CSSPropertyEmptyCells},
-#line 234 "CSSPropertyNames.gperf"
-      {"-webkit-text-stroke-width", CSSPropertyWebkitTextStrokeWidth},
-#line 130 "CSSPropertyNames.gperf"
-      {"text-transform", CSSPropertyTextTransform},
-#line 66 "CSSPropertyNames.gperf"
-      {"font-stretch", CSSPropertyFontStretch},
 #line 92 "CSSPropertyNames.gperf"
       {"outline-style", CSSPropertyOutlineStyle},
-#line 287 "CSSPropertyNames.gperf"
-      {"text-anchor", CSSPropertyTextAnchor},
-#line 186 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule-color", CSSPropertyWebkitColumnRuleColor},
-#line 274 "CSSPropertyNames.gperf"
+#line 113 "CSSPropertyNames.gperf"
+      {"table-layout", CSSPropertyTableLayout},
+#line 246 "CSSPropertyNames.gperf"
+      {"-webkit-transition-property", CSSPropertyWebkitTransitionProperty},
+#line 194 "CSSPropertyNames.gperf"
+      {"-webkit-font-smoothing", CSSPropertyWebkitFontSmoothing},
+#line 262 "CSSPropertyNames.gperf"
+      {"stop-opacity", CSSPropertyStopOpacity},
+#line 207 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-style", CSSPropertyWebkitMarqueeStyle},
+#line 91 "CSSPropertyNames.gperf"
+      {"outline-offset", CSSPropertyOutlineOffset},
+#line 172 "CSSPropertyNames.gperf"
+      {"-webkit-box-flex", CSSPropertyWebkitBoxFlex},
+#line 126 "CSSPropertyNames.gperf"
+      {"text-overline-style", CSSPropertyTextOverlineStyle},
+#line 277 "CSSPropertyNames.gperf"
       {"stroke-dasharray", CSSPropertyStrokeDasharray},
-#line 35 "CSSPropertyNames.gperf"
-      {"border-left-width", CSSPropertyBorderLeftWidth},
-#line 266 "CSSPropertyNames.gperf"
-      {"fill-rule", CSSPropertyFillRule},
-#line 237 "CSSPropertyNames.gperf"
-      {"-webkit-transform-origin-x", CSSPropertyWebkitTransformOriginX},
-#line 282 "CSSPropertyNames.gperf"
-      {"baseline-shift", CSSPropertyBaselineShift},
-#line 132 "CSSPropertyNames.gperf"
-      {"text-underline-color", CSSPropertyTextUnderlineColor},
-#line 238 "CSSPropertyNames.gperf"
-      {"-webkit-transform-origin-y", CSSPropertyWebkitTransformOriginY},
-#line 261 "CSSPropertyNames.gperf"
-      {"color-interpolation-filters", CSSPropertyColorInterpolationFilters},
-#line 39 "CSSPropertyNames.gperf"
-      {"border-right-style", CSSPropertyBorderRightStyle},
 #line 67 "CSSPropertyNames.gperf"
       {"font-style", CSSPropertyFontStyle},
-#line 127 "CSSPropertyNames.gperf"
-      {"text-overline-width", CSSPropertyTextOverlineWidth},
-#line 95 "CSSPropertyNames.gperf"
-      {"overflow-x", CSSPropertyOverflowX},
-#line 122 "CSSPropertyNames.gperf"
-      {"text-overflow", CSSPropertyTextOverflow},
-#line 177 "CSSPropertyNames.gperf"
-      {"-webkit-box-reflect", CSSPropertyWebkitBoxReflect},
-#line 247 "CSSPropertyNames.gperf"
-      {"-webkit-user-modify", CSSPropertyWebkitUserModify},
-#line 188 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule-width", CSSPropertyWebkitColumnRuleWidth},
-#line 96 "CSSPropertyNames.gperf"
-      {"overflow-y", CSSPropertyOverflowY},
-#line 240 "CSSPropertyNames.gperf"
-      {"-webkit-transform-style", CSSPropertyWebkitTransformStyle},
-#line 91 "CSSPropertyNames.gperf"
-      {"outline-offset", CSSPropertyOutlineOffset},
-#line 135 "CSSPropertyNames.gperf"
-      {"text-underline-width", CSSPropertyTextUnderlineWidth},
-#line 256 "CSSPropertyNames.gperf"
-      {"flood-opacity", CSSPropertyFloodOpacity},
 #line 34 "CSSPropertyNames.gperf"
       {"border-left-style", CSSPropertyBorderLeftStyle},
 #line 83 "CSSPropertyNames.gperf"
       {"max-height", CSSPropertyMaxHeight},
-#line 230 "CSSPropertyNames.gperf"
-      {"-webkit-text-security", CSSPropertyWebkitTextSecurity},
-#line 193 "CSSPropertyNames.gperf"
-      {"-webkit-highlight", CSSPropertyWebkitHighlight},
-#line 265 "CSSPropertyNames.gperf"
-      {"fill-opacity", CSSPropertyFillOpacity},
-#line 275 "CSSPropertyNames.gperf"
+#line 278 "CSSPropertyNames.gperf"
       {"stroke-dashoffset", CSSPropertyStrokeDashoffset},
-#line 126 "CSSPropertyNames.gperf"
-      {"text-overline-style", CSSPropertyTextOverlineStyle},
-#line 77 "CSSPropertyNames.gperf"
-      {"list-style-type", CSSPropertyListStyleType},
-#line 220 "CSSPropertyNames.gperf"
-      {"-webkit-match-nearest-mail-blockquote-color", CSSPropertyWebkitMatchNearestMailBlockquoteColor},
-#line 187 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule-style", CSSPropertyWebkitColumnRuleStyle},
-#line 158 "CSSPropertyNames.gperf"
-      {"-webkit-backface-visibility", CSSPropertyWebkitBackfaceVisibility},
-#line 229 "CSSPropertyNames.gperf"
-      {"-webkit-text-fill-color", CSSPropertyWebkitTextFillColor},
+#line 242 "CSSPropertyNames.gperf"
+      {"-webkit-transform-style", CSSPropertyWebkitTransformStyle},
+#line 96 "CSSPropertyNames.gperf"
+      {"overflow-y", CSSPropertyOverflowY},
+#line 228 "CSSPropertyNames.gperf"
+      {"-webkit-perspective-origin-y", CSSPropertyWebkitPerspectiveOriginY},
 #line 134 "CSSPropertyNames.gperf"
       {"text-underline-style", CSSPropertyTextUnderlineStyle},
-#line 285 "CSSPropertyNames.gperf"
-      {"glyph-orientation-vertical", CSSPropertyGlyphOrientationVertical},
-#line 64 "CSSPropertyNames.gperf"
-      {"font-family", CSSPropertyFontFamily},
-#line 171 "CSSPropertyNames.gperf"
-      {"-webkit-box-flex", CSSPropertyWebkitBoxFlex},
+#line 189 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule-style", CSSPropertyWebkitColumnRuleStyle},
+#line 39 "CSSPropertyNames.gperf"
+      {"border-right-style", CSSPropertyBorderRightStyle},
+#line 18 "CSSPropertyNames.gperf"
+      {"background-position-y", CSSPropertyBackgroundPositionY},
+#line 21 "CSSPropertyNames.gperf"
+      {"background-repeat-y", CSSPropertyBackgroundRepeatY},
+#line 230 "CSSPropertyNames.gperf"
+      {"-webkit-text-decorations-in-effect", CSSPropertyWebkitTextDecorationsInEffect},
+#line 259 "CSSPropertyNames.gperf"
+      {"flood-opacity", CSSPropertyFloodOpacity},
+#line 268 "CSSPropertyNames.gperf"
+      {"fill-opacity", CSSPropertyFillOpacity},
+#line 232 "CSSPropertyNames.gperf"
+      {"-webkit-text-security", CSSPropertyWebkitTextSecurity},
+#line 240 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin-y", CSSPropertyWebkitTransformOriginY},
 #line 117 "CSSPropertyNames.gperf"
       {"text-line-through", CSSPropertyTextLineThrough},
 #line 119 "CSSPropertyNames.gperf"
       {"text-line-through-mode", CSSPropertyTextLineThroughMode},
-#line 228 "CSSPropertyNames.gperf"
-      {"-webkit-text-decorations-in-effect", CSSPropertyWebkitTextDecorationsInEffect},
-#line 284 "CSSPropertyNames.gperf"
-      {"glyph-orientation-horizontal", CSSPropertyGlyphOrientationHorizontal},
-#line 172 "CSSPropertyNames.gperf"
-      {"-webkit-box-flex-group", CSSPropertyWebkitBoxFlexGroup},
+#line 249 "CSSPropertyNames.gperf"
+      {"-webkit-user-modify", CSSPropertyWebkitUserModify},
+#line 159 "CSSPropertyNames.gperf"
+      {"-webkit-backface-visibility", CSSPropertyWebkitBackfaceVisibility},
+#line 195 "CSSPropertyNames.gperf"
+      {"-webkit-highlight", CSSPropertyWebkitHighlight},
 #line 118 "CSSPropertyNames.gperf"
       {"text-line-through-color", CSSPropertyTextLineThroughColor},
+#line 173 "CSSPropertyNames.gperf"
+      {"-webkit-box-flex-group", CSSPropertyWebkitBoxFlexGroup},
+#line 288 "CSSPropertyNames.gperf"
+      {"glyph-orientation-vertical", CSSPropertyGlyphOrientationVertical},
+#line 64 "CSSPropertyNames.gperf"
+      {"font-family", CSSPropertyFontFamily},
+#line 77 "CSSPropertyNames.gperf"
+      {"list-style-type", CSSPropertyListStyleType},
 #line 121 "CSSPropertyNames.gperf"
       {"text-line-through-width", CSSPropertyTextLineThroughWidth},
+#line 287 "CSSPropertyNames.gperf"
+      {"glyph-orientation-horizontal", CSSPropertyGlyphOrientationHorizontal},
 #line 120 "CSSPropertyNames.gperf"
       {"text-line-through-style", CSSPropertyTextLineThroughStyle}
     };
@@ -800,153 +803,172 @@ findProp (register const char *str, register unsigned int len)
   static const short lookup[] =
     {
        -1,  -1,  -1,  -1,  -1,  -1,   0,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,   1,  -1,   2,  -1,  -1,  -1,
-       -1,   3,  -1,   4,  -1,   5,   6,   7,  -1,  -1,
-        8,  -1,  -1,   9,  10,  -1,  11,  -1,  -1,  12,
-       13,  -1,  14,  -1,  -1,  15,  16,  -1,  -1,  -1,
-       17,  -1,  18,  -1,  -1,  19,  -1,  20,  21,  -1,
-       -1,  22,  23,  -1,  -1,  -1,  -1,  24,  -1,  25,
-       -1,  -1,  -1,  26,  -1,  27,  -1,  28,  29,  30,
-       -1,  -1,  -1,  -1,  31,  32,  -1,  -1,  -1,  -1,
-       33,  -1,  34,  35,  36,  -1,  -1,  37,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  38,  39,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  40,  -1,  -1,
-       -1,  -1,  41,  -1,  -1,  -1,  -1,  -1,  -1,  42,
-       -1,  -1,  -1,  -1,  -1,  -1,  43,  -1,  -1,  -1,
-       -1,  44,  -1,  -1,  -1,  -1,  -1,  45,  -1,  -1,
-       -1,  46,  -1,  47,  -1,  -1,  -1,  48,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  49,  -1,  -1,  -1,  -1,
-       50,  -1,  51,  -1,  -1,  -1,  -1,  52,  -1,  -1,
-       -1,  -1,  -1,  -1,  53,  -1,  -1,  -1,  -1,  -1,
-       54,  -1,  -1,  -1,  55,  56,  -1,  -1,  57,  -1,
-       -1,  58,  59,  -1,  -1,  -1,  -1,  60,  -1,  -1,
-       61,  -1,  -1,  -1,  62,  -1,  63,  64,  -1,  -1,
-       -1,  65,  66,  -1,  -1,  67,  -1,  -1,  -1,  -1,
-       -1,  -1,  68,  -1,  -1,  -1,  -1,  -1,  -1,  69,
-       -1,  -1,  70,  71,  -1,  72,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  73,  -1,  -1,  74,  75,  -1,  -1,
-       -1,  76,  -1,  -1,  -1,  -1,  77,  78,  79,  -1,
-       -1,  -1,  -1,  -1,  -1,  80,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  81,  -1,  82,  83,  -1,  -1,  84,
-       85,  -1,  -1,  -1,  86,  -1,  87,  88,  -1,  -1,
-       -1,  -1,  -1,  89,  -1,  90,  -1,  -1,  91,  -1,
-       92,  -1,  -1,  -1,  -1,  -1,  -1,  93,  -1,  -1,
-       -1,  -1,  -1,  -1,  94,  -1,  -1,  -1,  -1,  -1,
-       95,  -1,  96,  -1,  -1,  97,  -1,  -1,  -1,  98,
-       -1,  -1,  -1,  -1,  99,  -1, 100, 101,  -1,  -1,
-       -1,  -1, 102,  -1, 103,  -1,  -1, 104,  -1, 105,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 106,  -1,  -1,
-       -1,  -1, 107,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      108,  -1,  -1, 109, 110,  -1,  -1,  -1, 111, 112,
-       -1,  -1,  -1,  -1, 113, 114, 115, 116,  -1, 117,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 118, 119, 120,
-       -1, 121,  -1,  -1, 122,  -1,  -1, 123, 124,  -1,
-       -1,  -1, 125, 126,  -1,  -1,  -1,  -1, 127,  -1,
-       -1,  -1,  -1, 128,  -1, 129, 130,  -1,  -1, 131,
-      132,  -1, 133,  -1, 134,  -1, 135,  -1, 136,  -1,
-       -1,  -1, 137, 138, 139,  -1, 140, 141,  -1,  -1,
-      142, 143,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 144,  -1, 145,  -1,  -1,  -1,  -1,  -1,  -1,
-      146, 147,  -1,  -1,  -1, 148,  -1, 149,  -1,  -1,
-       -1, 150,  -1,  -1, 151,  -1, 152,  -1,  -1,  -1,
-       -1, 153,  -1,  -1,  -1, 154, 155,  -1, 156,  -1,
+       -1,   1,  -1,  -1,  -1,  -1,  -1,  -1,   2,  -1,
+       -1,   3,  -1,  -1,  -1,  -1,  -1,  -1,  -1,   4,
+       -1,   5,  -1,  -1,  -1,   6,   7,   8,  -1,  -1,
+        9,  -1,  10,  -1,  11,  12,  13,  14,  -1,  15,
+       16,  -1,  -1,  17,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  18,  -1,  -1,  -1,  -1,  19,  -1,  -1,
+       -1,  -1,  -1,  20,  -1,  -1,  -1,  21,  22,  -1,
+       -1,  -1,  23,  -1,  24,  25,  -1,  -1,  26,  -1,
+       27,  -1,  28,  29,  -1,  30,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  31,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  32,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  33,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  34,  -1,  35,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  36,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  37,  -1,  -1,  38,  -1,  -1,  -1,  -1,  39,
+       -1,  -1,  -1,  -1,  -1,  40,  41,  42,  -1,  -1,
+       -1,  43,  44,  -1,  -1,  -1,  -1,  -1,  45,  -1,
+       46,  -1,  47,  -1,  48,  -1,  -1,  -1,  -1,  49,
+       -1,  -1,  -1,  50,  -1,  51,  -1,  52,  -1,  -1,
+       -1,  -1,  -1,  53,  -1,  54,  -1,  -1,  -1,  -1,
+       55,  56,  -1,  -1,  -1,  57,  -1,  -1,  58,  -1,
+       -1,  -1,  -1,  -1,  59,  -1,  -1,  60,  -1,  -1,
+       -1,  -1,  61,  62,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  63,  -1,  -1,  64,  65,  -1,  66,  -1,  -1,
+       -1,  -1,  67,  -1,  -1,  68,  -1,  -1,  -1,  69,
+       70,  71,  -1,  -1,  -1,  -1,  72,  -1,  -1,  -1,
+       -1,  -1,  73,  74,  75,  -1,  -1,  76,  -1,  -1,
+       -1,  -1,  -1,  77,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  78,  -1,  -1,  79,  -1,  80,  -1,  81,  82,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  83,  84,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  85,  -1,  -1,  86,  87,  88,
+       -1,  -1,  89,  -1,  90,  91,  92,  -1,  93,  -1,
+       -1,  -1,  94,  95,  96,  97,  -1,  98,  99,  -1,
+      100, 101,  -1,  -1,  -1,  -1, 102, 103,  -1,  -1,
+       -1,  -1,  -1,  -1, 104,  -1,  -1,  -1,  -1,  -1,
+      105,  -1,  -1,  -1,  -1, 106,  -1, 107,  -1, 108,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 109, 110,
+       -1,  -1, 111,  -1,  -1,  -1,  -1, 112,  -1,  -1,
+      113,  -1,  -1,  -1, 114,  -1, 115,  -1,  -1, 116,
+       -1, 117,  -1,  -1, 118, 119, 120,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 121,  -1,  -1,  -1,  -1,  -1,
+      122,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 123,  -1,
+       -1,  -1,  -1, 124,  -1,  -1, 125, 126, 127, 128,
+      129,  -1,  -1,  -1, 130,  -1,  -1, 131,  -1,  -1,
+      132,  -1, 133,  -1,  -1,  -1, 134, 135, 136,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 137,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 138,  -1,  -1,
+       -1, 139,  -1,  -1, 140, 141, 142, 143,  -1,  -1,
+       -1, 144, 145, 146, 147,  -1, 148,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 149,  -1,  -1, 150, 151,
+       -1,  -1, 152,  -1,  -1,  -1,  -1, 153, 154,  -1,
+       -1,  -1,  -1, 155,  -1,  -1, 156,  -1,  -1,  -1,
+       -1, 157,  -1,  -1, 158,  -1,  -1, 159,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 160,  -1,
+       -1,  -1,  -1,  -1, 161,  -1,  -1,  -1, 162,  -1,
+      163,  -1,  -1, 164,  -1,  -1, 165,  -1,  -1, 166,
+      167,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 168,  -1, 169, 170,  -1,
+       -1,  -1,  -1,  -1, 171, 172,  -1, 173, 174, 175,
+      176,  -1,  -1,  -1, 177,  -1, 178,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 179,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 180,  -1,  -1, 181,  -1,
+       -1,  -1,  -1, 182,  -1,  -1, 183, 184,  -1,  -1,
+       -1, 185,  -1,  -1, 186,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 187,  -1,  -1,
+       -1, 188, 189,  -1,  -1, 190,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 191,  -1,
+       -1,  -1, 192,  -1, 193,  -1,  -1,  -1,  -1, 194,
+       -1,  -1,  -1,  -1,  -1, 195,  -1,  -1,  -1,  -1,
+       -1, 196,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 197,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 198,  -1,  -1, 199,  -1, 200,  -1,  -1,
+      201, 202,  -1, 203, 204,  -1,  -1,  -1,  -1, 205,
+       -1,  -1,  -1, 206,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 207, 208, 209,  -1,  -1, 210,  -1,
+      211,  -1,  -1,  -1,  -1,  -1,  -1, 212,  -1,  -1,
+       -1,  -1,  -1,  -1, 213,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 214,  -1,  -1,  -1,  -1, 215, 216,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 217,  -1,  -1, 218, 219,  -1, 220,
+       -1, 221,  -1,  -1,  -1,  -1,  -1, 222,  -1, 223,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 224, 225,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 226, 227,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 228,  -1,
+      229, 230,  -1, 231, 232,  -1,  -1, 233, 234,  -1,
+       -1, 235,  -1, 236,  -1,  -1, 237,  -1, 238,  -1,
+       -1, 239,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 240,
+       -1, 241,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 242,  -1,  -1,  -1,
+       -1,  -1,  -1, 243,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 244,  -1,  -1,  -1,  -1, 245,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 246,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 247,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 157, 158, 159,  -1,
-       -1,  -1, 160, 161,  -1,  -1, 162, 163, 164,  -1,
-       -1, 165, 166,  -1,  -1,  -1,  -1, 167, 168,  -1,
-       -1,  -1,  -1, 169, 170,  -1,  -1,  -1,  -1, 171,
-       -1,  -1,  -1, 172,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 173,  -1,  -1,  -1, 174,  -1,
-      175,  -1,  -1, 176,  -1,  -1,  -1,  -1, 177, 178,
-       -1,  -1, 179, 180,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 181,  -1,  -1,  -1, 182,  -1,  -1, 183,
-      184,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 185,
-       -1,  -1, 186,  -1, 187,  -1,  -1,  -1,  -1, 188,
-      189,  -1,  -1,  -1, 190,  -1,  -1,  -1,  -1,  -1,
-       -1, 191,  -1,  -1,  -1,  -1, 192,  -1, 193, 194,
-      195,  -1,  -1, 196, 197,  -1,  -1,  -1,  -1,  -1,
-      198, 199, 200,  -1,  -1, 201,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 202, 203,  -1,  -1,  -1,  -1,  -1,
-       -1, 204,  -1, 205,  -1,  -1,  -1,  -1,  -1,  -1,
-      206,  -1,  -1,  -1, 207,  -1, 208,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 209,  -1,
-       -1,  -1, 210,  -1, 211,  -1, 212,  -1,  -1, 213,
-       -1,  -1,  -1, 214,  -1,  -1,  -1, 215,  -1,  -1,
-       -1, 216,  -1,  -1,  -1,  -1, 217, 218,  -1,  -1,
-      219, 220,  -1, 221,  -1,  -1, 222,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 223,  -1,  -1, 224,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 225, 226, 227,
-       -1, 228,  -1,  -1,  -1, 229,  -1,  -1,  -1, 230,
-       -1,  -1, 231,  -1,  -1,  -1,  -1,  -1, 232,  -1,
-       -1, 233,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      234,  -1,  -1,  -1,  -1,  -1, 235, 236,  -1,  -1,
-       -1,  -1,  -1,  -1, 237,  -1,  -1,  -1,  -1,  -1,
-       -1, 238,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 239,
-      240, 241,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 248,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 249,  -1,  -1,  -1,  -1,  -1,
+       -1, 250,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 242,  -1,  -1,  -1,  -1,  -1, 243,  -1,
-       -1,  -1,  -1,  -1,  -1, 244,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 245,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      246,  -1,  -1, 247,  -1,  -1,  -1,  -1,  -1, 248,
-       -1,  -1,  -1,  -1, 249, 250,  -1,  -1,  -1,  -1,
-      251,  -1,  -1, 252,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 251,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 253,
-       -1,  -1,  -1,  -1,  -1, 254,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 255,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 256,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 257,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 258,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 252,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      253,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 254,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      255,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 256,  -1,  -1,
+       -1,  -1,  -1, 257,  -1, 258,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 259,  -1,  -1,  -1,  -1, 260,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 261,  -1, 262,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 259,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      263,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 264,  -1,
-      265,  -1,  -1,  -1,  -1,  -1,  -1, 266,  -1,  -1,
-       -1,  -1,  -1, 267,  -1,  -1,  -1,  -1,  -1,  -1,
+      260,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 261,  -1,  -1, 262,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      268,  -1,  -1,  -1,  -1,  -1, 269,  -1,  -1,  -1,
+       -1, 263,  -1,  -1, 264,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 265,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 266,  -1,
+       -1,  -1, 267,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 268,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 270,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 271,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 269,  -1,  -1,  -1,  -1,  -1, 270,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 271,  -1,  -1,
+       -1,  -1,  -1,  -1, 272,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 273,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 274,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 272,  -1,  -1,  -1,  -1, 273,  -1,  -1,
+       -1,  -1,  -1, 275,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 276,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 274,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 277,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 275,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 278,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      279,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 276,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 277,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -956,11 +978,12 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 280,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 281,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 278,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -980,7 +1003,20 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 279
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 282
     };
 
   if (len <= MAX_WORD_LENGTH && len >= MIN_WORD_LENGTH)
@@ -1002,9 +1038,9 @@ findProp (register const char *str, register unsigned int len)
     }
   return 0;
 }
-#line 290 "CSSPropertyNames.gperf"
+#line 293 "CSSPropertyNames.gperf"
 
-static const char * const propertyNameStrings[280] = {
+static const char * const propertyNameStrings[283] = {
 "background",
 "background-attachment",
 "background-clip",
@@ -1148,6 +1184,7 @@ static const char * const propertyNameStrings[280] = {
 "-webkit-animation-delay",
 "-webkit-animation-direction",
 "-webkit-animation-duration",
+"-webkit-animation-fill-mode",
 "-webkit-animation-iteration-count",
 "-webkit-animation-name",
 "-webkit-animation-play-state",
@@ -1175,6 +1212,7 @@ static const char * const propertyNameStrings[280] = {
 "-webkit-box-reflect",
 "-webkit-box-shadow",
 "-webkit-box-sizing",
+"-webkit-color-correction",
 "-webkit-column-break-after",
 "-webkit-column-break-before",
 "-webkit-column-break-inside",
@@ -1245,6 +1283,7 @@ static const char * const propertyNameStrings[280] = {
 "-webkit-user-modify",
 "-webkit-user-select",
 "-webkit-variable-declaration-block",
+"-webkit-dashboard-region",
 "clip-path",
 "clip-rule",
 "mask",
@@ -1284,7 +1323,7 @@ static const char * const propertyNameStrings[280] = {
 "kerning",
 "text-anchor",
 "writing-mode",
-"-webkit-shadow",
+"-webkit-svg-shadow",
 };
 const char* getPropertyName(CSSPropertyID id)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
index 8957af8f2b..f758781fba 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
@@ -148,147 +148,150 @@ enum CSSPropertyID {
     CSSPropertyWebkitAnimationDelay = 1141,
     CSSPropertyWebkitAnimationDirection = 1142,
     CSSPropertyWebkitAnimationDuration = 1143,
-    CSSPropertyWebkitAnimationIterationCount = 1144,
-    CSSPropertyWebkitAnimationName = 1145,
-    CSSPropertyWebkitAnimationPlayState = 1146,
-    CSSPropertyWebkitAnimationTimingFunction = 1147,
-    CSSPropertyWebkitAppearance = 1148,
-    CSSPropertyWebkitBackfaceVisibility = 1149,
-    CSSPropertyWebkitBackgroundClip = 1150,
-    CSSPropertyWebkitBackgroundComposite = 1151,
-    CSSPropertyWebkitBackgroundOrigin = 1152,
-    CSSPropertyWebkitBackgroundSize = 1153,
-    CSSPropertyWebkitBinding = 1154,
-    CSSPropertyWebkitBorderFit = 1155,
-    CSSPropertyWebkitBorderHorizontalSpacing = 1156,
-    CSSPropertyWebkitBorderImage = 1157,
-    CSSPropertyWebkitBorderRadius = 1158,
-    CSSPropertyWebkitBorderVerticalSpacing = 1159,
-    CSSPropertyWebkitBoxAlign = 1160,
-    CSSPropertyWebkitBoxDirection = 1161,
-    CSSPropertyWebkitBoxFlex = 1162,
-    CSSPropertyWebkitBoxFlexGroup = 1163,
-    CSSPropertyWebkitBoxLines = 1164,
-    CSSPropertyWebkitBoxOrdinalGroup = 1165,
-    CSSPropertyWebkitBoxOrient = 1166,
-    CSSPropertyWebkitBoxPack = 1167,
-    CSSPropertyWebkitBoxReflect = 1168,
-    CSSPropertyWebkitBoxShadow = 1169,
-    CSSPropertyWebkitBoxSizing = 1170,
-    CSSPropertyWebkitColumnBreakAfter = 1171,
-    CSSPropertyWebkitColumnBreakBefore = 1172,
-    CSSPropertyWebkitColumnBreakInside = 1173,
-    CSSPropertyWebkitColumnCount = 1174,
-    CSSPropertyWebkitColumnGap = 1175,
-    CSSPropertyWebkitColumnRule = 1176,
-    CSSPropertyWebkitColumnRuleColor = 1177,
-    CSSPropertyWebkitColumnRuleStyle = 1178,
-    CSSPropertyWebkitColumnRuleWidth = 1179,
-    CSSPropertyWebkitColumnWidth = 1180,
-    CSSPropertyWebkitColumns = 1181,
-    CSSPropertyWebkitFontSizeDelta = 1182,
-    CSSPropertyWebkitFontSmoothing = 1183,
-    CSSPropertyWebkitHighlight = 1184,
-    CSSPropertyWebkitLineBreak = 1185,
-    CSSPropertyWebkitLineClamp = 1186,
-    CSSPropertyWebkitMarginBottomCollapse = 1187,
-    CSSPropertyWebkitMarginCollapse = 1188,
-    CSSPropertyWebkitMarginStart = 1189,
-    CSSPropertyWebkitMarginTopCollapse = 1190,
-    CSSPropertyWebkitMarquee = 1191,
-    CSSPropertyWebkitMarqueeDirection = 1192,
-    CSSPropertyWebkitMarqueeIncrement = 1193,
-    CSSPropertyWebkitMarqueeRepetition = 1194,
-    CSSPropertyWebkitMarqueeSpeed = 1195,
-    CSSPropertyWebkitMarqueeStyle = 1196,
-    CSSPropertyWebkitMask = 1197,
-    CSSPropertyWebkitMaskAttachment = 1198,
-    CSSPropertyWebkitMaskBoxImage = 1199,
-    CSSPropertyWebkitMaskClip = 1200,
-    CSSPropertyWebkitMaskComposite = 1201,
-    CSSPropertyWebkitMaskImage = 1202,
-    CSSPropertyWebkitMaskOrigin = 1203,
-    CSSPropertyWebkitMaskPosition = 1204,
-    CSSPropertyWebkitMaskPositionX = 1205,
-    CSSPropertyWebkitMaskPositionY = 1206,
-    CSSPropertyWebkitMaskRepeat = 1207,
-    CSSPropertyWebkitMaskRepeatX = 1208,
-    CSSPropertyWebkitMaskRepeatY = 1209,
-    CSSPropertyWebkitMaskSize = 1210,
-    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1211,
-    CSSPropertyWebkitNbspMode = 1212,
-    CSSPropertyWebkitPaddingStart = 1213,
-    CSSPropertyWebkitPerspective = 1214,
-    CSSPropertyWebkitPerspectiveOrigin = 1215,
-    CSSPropertyWebkitPerspectiveOriginX = 1216,
-    CSSPropertyWebkitPerspectiveOriginY = 1217,
-    CSSPropertyWebkitRtlOrdering = 1218,
-    CSSPropertyWebkitTextDecorationsInEffect = 1219,
-    CSSPropertyWebkitTextFillColor = 1220,
-    CSSPropertyWebkitTextSecurity = 1221,
-    CSSPropertyWebkitTextSizeAdjust = 1222,
-    CSSPropertyWebkitTextStroke = 1223,
-    CSSPropertyWebkitTextStrokeColor = 1224,
-    CSSPropertyWebkitTextStrokeWidth = 1225,
-    CSSPropertyWebkitTransform = 1226,
-    CSSPropertyWebkitTransformOrigin = 1227,
-    CSSPropertyWebkitTransformOriginX = 1228,
-    CSSPropertyWebkitTransformOriginY = 1229,
-    CSSPropertyWebkitTransformOriginZ = 1230,
-    CSSPropertyWebkitTransformStyle = 1231,
-    CSSPropertyWebkitTransition = 1232,
-    CSSPropertyWebkitTransitionDelay = 1233,
-    CSSPropertyWebkitTransitionDuration = 1234,
-    CSSPropertyWebkitTransitionProperty = 1235,
-    CSSPropertyWebkitTransitionTimingFunction = 1236,
-    CSSPropertyWebkitUserDrag = 1237,
-    CSSPropertyWebkitUserModify = 1238,
-    CSSPropertyWebkitUserSelect = 1239,
-    CSSPropertyWebkitVariableDeclarationBlock = 1240,
-    CSSPropertyClipPath = 1241,
-    CSSPropertyClipRule = 1242,
-    CSSPropertyMask = 1243,
-    CSSPropertyEnableBackground = 1244,
-    CSSPropertyFilter = 1245,
-    CSSPropertyFloodColor = 1246,
-    CSSPropertyFloodOpacity = 1247,
-    CSSPropertyLightingColor = 1248,
-    CSSPropertyStopColor = 1249,
-    CSSPropertyStopOpacity = 1250,
-    CSSPropertyColorInterpolation = 1251,
-    CSSPropertyColorInterpolationFilters = 1252,
-    CSSPropertyColorProfile = 1253,
-    CSSPropertyColorRendering = 1254,
-    CSSPropertyFill = 1255,
-    CSSPropertyFillOpacity = 1256,
-    CSSPropertyFillRule = 1257,
-    CSSPropertyImageRendering = 1258,
-    CSSPropertyMarker = 1259,
-    CSSPropertyMarkerEnd = 1260,
-    CSSPropertyMarkerMid = 1261,
-    CSSPropertyMarkerStart = 1262,
-    CSSPropertyShapeRendering = 1263,
-    CSSPropertyStroke = 1264,
-    CSSPropertyStrokeDasharray = 1265,
-    CSSPropertyStrokeDashoffset = 1266,
-    CSSPropertyStrokeLinecap = 1267,
-    CSSPropertyStrokeLinejoin = 1268,
-    CSSPropertyStrokeMiterlimit = 1269,
-    CSSPropertyStrokeOpacity = 1270,
-    CSSPropertyStrokeWidth = 1271,
-    CSSPropertyAlignmentBaseline = 1272,
-    CSSPropertyBaselineShift = 1273,
-    CSSPropertyDominantBaseline = 1274,
-    CSSPropertyGlyphOrientationHorizontal = 1275,
-    CSSPropertyGlyphOrientationVertical = 1276,
-    CSSPropertyKerning = 1277,
-    CSSPropertyTextAnchor = 1278,
-    CSSPropertyWritingMode = 1279,
-    CSSPropertyWebkitShadow = 1280,
+    CSSPropertyWebkitAnimationFillMode = 1144,
+    CSSPropertyWebkitAnimationIterationCount = 1145,
+    CSSPropertyWebkitAnimationName = 1146,
+    CSSPropertyWebkitAnimationPlayState = 1147,
+    CSSPropertyWebkitAnimationTimingFunction = 1148,
+    CSSPropertyWebkitAppearance = 1149,
+    CSSPropertyWebkitBackfaceVisibility = 1150,
+    CSSPropertyWebkitBackgroundClip = 1151,
+    CSSPropertyWebkitBackgroundComposite = 1152,
+    CSSPropertyWebkitBackgroundOrigin = 1153,
+    CSSPropertyWebkitBackgroundSize = 1154,
+    CSSPropertyWebkitBinding = 1155,
+    CSSPropertyWebkitBorderFit = 1156,
+    CSSPropertyWebkitBorderHorizontalSpacing = 1157,
+    CSSPropertyWebkitBorderImage = 1158,
+    CSSPropertyWebkitBorderRadius = 1159,
+    CSSPropertyWebkitBorderVerticalSpacing = 1160,
+    CSSPropertyWebkitBoxAlign = 1161,
+    CSSPropertyWebkitBoxDirection = 1162,
+    CSSPropertyWebkitBoxFlex = 1163,
+    CSSPropertyWebkitBoxFlexGroup = 1164,
+    CSSPropertyWebkitBoxLines = 1165,
+    CSSPropertyWebkitBoxOrdinalGroup = 1166,
+    CSSPropertyWebkitBoxOrient = 1167,
+    CSSPropertyWebkitBoxPack = 1168,
+    CSSPropertyWebkitBoxReflect = 1169,
+    CSSPropertyWebkitBoxShadow = 1170,
+    CSSPropertyWebkitBoxSizing = 1171,
+    CSSPropertyWebkitColorCorrection = 1172,
+    CSSPropertyWebkitColumnBreakAfter = 1173,
+    CSSPropertyWebkitColumnBreakBefore = 1174,
+    CSSPropertyWebkitColumnBreakInside = 1175,
+    CSSPropertyWebkitColumnCount = 1176,
+    CSSPropertyWebkitColumnGap = 1177,
+    CSSPropertyWebkitColumnRule = 1178,
+    CSSPropertyWebkitColumnRuleColor = 1179,
+    CSSPropertyWebkitColumnRuleStyle = 1180,
+    CSSPropertyWebkitColumnRuleWidth = 1181,
+    CSSPropertyWebkitColumnWidth = 1182,
+    CSSPropertyWebkitColumns = 1183,
+    CSSPropertyWebkitFontSizeDelta = 1184,
+    CSSPropertyWebkitFontSmoothing = 1185,
+    CSSPropertyWebkitHighlight = 1186,
+    CSSPropertyWebkitLineBreak = 1187,
+    CSSPropertyWebkitLineClamp = 1188,
+    CSSPropertyWebkitMarginBottomCollapse = 1189,
+    CSSPropertyWebkitMarginCollapse = 1190,
+    CSSPropertyWebkitMarginStart = 1191,
+    CSSPropertyWebkitMarginTopCollapse = 1192,
+    CSSPropertyWebkitMarquee = 1193,
+    CSSPropertyWebkitMarqueeDirection = 1194,
+    CSSPropertyWebkitMarqueeIncrement = 1195,
+    CSSPropertyWebkitMarqueeRepetition = 1196,
+    CSSPropertyWebkitMarqueeSpeed = 1197,
+    CSSPropertyWebkitMarqueeStyle = 1198,
+    CSSPropertyWebkitMask = 1199,
+    CSSPropertyWebkitMaskAttachment = 1200,
+    CSSPropertyWebkitMaskBoxImage = 1201,
+    CSSPropertyWebkitMaskClip = 1202,
+    CSSPropertyWebkitMaskComposite = 1203,
+    CSSPropertyWebkitMaskImage = 1204,
+    CSSPropertyWebkitMaskOrigin = 1205,
+    CSSPropertyWebkitMaskPosition = 1206,
+    CSSPropertyWebkitMaskPositionX = 1207,
+    CSSPropertyWebkitMaskPositionY = 1208,
+    CSSPropertyWebkitMaskRepeat = 1209,
+    CSSPropertyWebkitMaskRepeatX = 1210,
+    CSSPropertyWebkitMaskRepeatY = 1211,
+    CSSPropertyWebkitMaskSize = 1212,
+    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1213,
+    CSSPropertyWebkitNbspMode = 1214,
+    CSSPropertyWebkitPaddingStart = 1215,
+    CSSPropertyWebkitPerspective = 1216,
+    CSSPropertyWebkitPerspectiveOrigin = 1217,
+    CSSPropertyWebkitPerspectiveOriginX = 1218,
+    CSSPropertyWebkitPerspectiveOriginY = 1219,
+    CSSPropertyWebkitRtlOrdering = 1220,
+    CSSPropertyWebkitTextDecorationsInEffect = 1221,
+    CSSPropertyWebkitTextFillColor = 1222,
+    CSSPropertyWebkitTextSecurity = 1223,
+    CSSPropertyWebkitTextSizeAdjust = 1224,
+    CSSPropertyWebkitTextStroke = 1225,
+    CSSPropertyWebkitTextStrokeColor = 1226,
+    CSSPropertyWebkitTextStrokeWidth = 1227,
+    CSSPropertyWebkitTransform = 1228,
+    CSSPropertyWebkitTransformOrigin = 1229,
+    CSSPropertyWebkitTransformOriginX = 1230,
+    CSSPropertyWebkitTransformOriginY = 1231,
+    CSSPropertyWebkitTransformOriginZ = 1232,
+    CSSPropertyWebkitTransformStyle = 1233,
+    CSSPropertyWebkitTransition = 1234,
+    CSSPropertyWebkitTransitionDelay = 1235,
+    CSSPropertyWebkitTransitionDuration = 1236,
+    CSSPropertyWebkitTransitionProperty = 1237,
+    CSSPropertyWebkitTransitionTimingFunction = 1238,
+    CSSPropertyWebkitUserDrag = 1239,
+    CSSPropertyWebkitUserModify = 1240,
+    CSSPropertyWebkitUserSelect = 1241,
+    CSSPropertyWebkitVariableDeclarationBlock = 1242,
+    CSSPropertyWebkitDashboardRegion = 1243,
+    CSSPropertyClipPath = 1244,
+    CSSPropertyClipRule = 1245,
+    CSSPropertyMask = 1246,
+    CSSPropertyEnableBackground = 1247,
+    CSSPropertyFilter = 1248,
+    CSSPropertyFloodColor = 1249,
+    CSSPropertyFloodOpacity = 1250,
+    CSSPropertyLightingColor = 1251,
+    CSSPropertyStopColor = 1252,
+    CSSPropertyStopOpacity = 1253,
+    CSSPropertyColorInterpolation = 1254,
+    CSSPropertyColorInterpolationFilters = 1255,
+    CSSPropertyColorProfile = 1256,
+    CSSPropertyColorRendering = 1257,
+    CSSPropertyFill = 1258,
+    CSSPropertyFillOpacity = 1259,
+    CSSPropertyFillRule = 1260,
+    CSSPropertyImageRendering = 1261,
+    CSSPropertyMarker = 1262,
+    CSSPropertyMarkerEnd = 1263,
+    CSSPropertyMarkerMid = 1264,
+    CSSPropertyMarkerStart = 1265,
+    CSSPropertyShapeRendering = 1266,
+    CSSPropertyStroke = 1267,
+    CSSPropertyStrokeDasharray = 1268,
+    CSSPropertyStrokeDashoffset = 1269,
+    CSSPropertyStrokeLinecap = 1270,
+    CSSPropertyStrokeLinejoin = 1271,
+    CSSPropertyStrokeMiterlimit = 1272,
+    CSSPropertyStrokeOpacity = 1273,
+    CSSPropertyStrokeWidth = 1274,
+    CSSPropertyAlignmentBaseline = 1275,
+    CSSPropertyBaselineShift = 1276,
+    CSSPropertyDominantBaseline = 1277,
+    CSSPropertyGlyphOrientationHorizontal = 1278,
+    CSSPropertyGlyphOrientationVertical = 1279,
+    CSSPropertyKerning = 1280,
+    CSSPropertyTextAnchor = 1281,
+    CSSPropertyWritingMode = 1282,
+    CSSPropertyWebkitSvgShadow = 1283,
 };
 
 const int firstCSSProperty = 1001;
-const int numCSSProperties = 280;
+const int numCSSProperties = 283;
 const size_t maxCSSPropertyNameLength = 43;
 
 const char* getPropertyName(CSSPropertyID);
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
index c2143c523e..89b1c4a4de 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
+++ b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
@@ -1,4 +1,4 @@
-/* ANSI-C code produced by gperf version 3.0.3 */
+/* ANSI-C code produced by gperf version 3.0.1 */
 /* Command-line: gperf -L ANSI-C -E -C -n -o -t --key-positions='*' -NfindValue -Hhash_val -Wwordlist_value -D CSSValueKeywords.gperf  */
 
 #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \
@@ -38,7 +38,7 @@ struct css_value {
     const char* name;
     int id;
 };
-/* maximum key range = 7172, duplicates = 0 */
+/* maximum key range = 7159, duplicates = 0 */
 
 #ifdef __GNUC__
 __inline
@@ -52,38 +52,50 @@ hash_val (register const char *str, register unsigned int len)
 {
   static const unsigned short asso_values[] =
     {
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172,  500,   17, 7172, 7172,    0,
-        55,    5,   50,   40,   35,   30,   25,   20, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172,    5,  245,   15,
-       200,    0,  695,  401,  825,   35,  136,   86,   10,   20,
-        30,   10,   45,  127,  370,    5,   80,  450,    1,  456,
-       936, 1021,   95,    0, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159,  360,    3, 7159, 7159,    0,
+        55,   15,   50,   45,   40,   30,   20,    5, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159,    0,  250,   55,
+       295,    5,  950,    1,   16,   30,  356,  737,   25,    5,
+        40,   15,  100,  287,  570,   10,   10,  275,    7,  496,
+       875,  750,  145,    5, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159
     };
   register int hval = 0;
 
   switch (len)
     {
       default:
+        hval += asso_values[(unsigned char)str[34]];
+      /*FALLTHROUGH*/
+      case 34:
+        hval += asso_values[(unsigned char)str[33]];
+      /*FALLTHROUGH*/
+      case 33:
+        hval += asso_values[(unsigned char)str[32]];
+      /*FALLTHROUGH*/
+      case 32:
+        hval += asso_values[(unsigned char)str[31]];
+      /*FALLTHROUGH*/
+      case 31:
         hval += asso_values[(unsigned char)str[30]];
       /*FALLTHROUGH*/
       case 30:
@@ -182,1118 +194,1243 @@ hash_val (register const char *str, register unsigned int len)
 
 #ifdef __GNUC__
 __inline
-#ifdef __GNUC_STDC_INLINE__
-__attribute__ ((__gnu_inline__))
-#endif
 #endif
 const struct css_value *
 findValue (register const char *str, register unsigned int len)
 {
   enum
     {
-      TOTAL_KEYWORDS = 549,
+      TOTAL_KEYWORDS = 613,
       MIN_WORD_LENGTH = 2,
-      MAX_WORD_LENGTH = 31,
+      MAX_WORD_LENGTH = 35,
       MIN_HASH_VALUE = 0,
-      MAX_HASH_VALUE = 7171
+      MAX_HASH_VALUE = 7158
     };
 
   static const struct css_value wordlist_value[] =
     {
 #line 40 "CSSValueKeywords.gperf"
       {"100", CSSValue100},
-#line 42 "CSSValueKeywords.gperf"
-      {"300", CSSValue300},
-#line 289 "CSSValueKeywords.gperf"
-      {"end", CSSValueEnd},
-#line 557 "CSSValueKeywords.gperf"
-      {"lr", CSSValueLr},
 #line 48 "CSSValueKeywords.gperf"
       {"900", CSSValue900},
-#line 146 "CSSValueKeywords.gperf"
-      {"sub", CSSValueSub},
+#line 34 "CSSValueKeywords.gperf"
+      {"all", CSSValueAll},
+#line 42 "CSSValueKeywords.gperf"
+      {"300", CSSValue300},
 #line 47 "CSSValueKeywords.gperf"
       {"800", CSSValue800},
+#line 345 "CSSValueKeywords.gperf"
+      {"end", CSSValueEnd},
 #line 46 "CSSValueKeywords.gperf"
       {"700", CSSValue700},
+#line 621 "CSSValueKeywords.gperf"
+      {"lr", CSSValueLr},
 #line 45 "CSSValueKeywords.gperf"
       {"600", CSSValue600},
 #line 44 "CSSValueKeywords.gperf"
       {"500", CSSValue500},
-#line 34 "CSSValueKeywords.gperf"
-      {"all", CSSValueAll},
 #line 43 "CSSValueKeywords.gperf"
       {"400", CSSValue400},
 #line 41 "CSSValueKeywords.gperf"
       {"200", CSSValue200},
-#line 494 "CSSValueKeywords.gperf"
+#line 623 "CSSValueKeywords.gperf"
+      {"tb", CSSValueTb},
+#line 15 "CSSValueKeywords.gperf"
+      {"inset", CSSValueInset},
+#line 146 "CSSValueKeywords.gperf"
+      {"sub", CSSValueSub},
+#line 520 "CSSValueKeywords.gperf"
+      {"indigo", CSSValueIndigo},
+#line 559 "CSSValueKeywords.gperf"
       {"oldlace", CSSValueOldlace},
+#line 571 "CSSValueKeywords.gperf"
+      {"plum", CSSValuePlum},
 #line 71 "CSSValueKeywords.gperf"
       {"cursive", CSSValueCursive},
-#line 243 "CSSValueKeywords.gperf"
+#line 239 "CSSValueKeywords.gperf"
+      {"inline", CSSValueInline},
+#line 16 "CSSValueKeywords.gperf"
+      {"groove", CSSValueGroove},
+#line 213 "CSSValueKeywords.gperf"
+      {"oromo", CSSValueOromo},
+#line 13 "CSSValueKeywords.gperf"
+      {"none", CSSValueNone},
+#line 360 "CSSValueKeywords.gperf"
+      {"infinite", CSSValueInfinite},
+#line 232 "CSSValueKeywords.gperf"
+      {"armenian", CSSValueArmenian},
+#line 299 "CSSValueKeywords.gperf"
       {"above", CSSValueAbove},
-#line 253 "CSSValueKeywords.gperf"
+#line 590 "CSSValueKeywords.gperf"
+      {"tomato", CSSValueTomato},
+#line 36 "CSSValueKeywords.gperf"
+      {"normal", CSSValueNormal},
+#line 309 "CSSValueKeywords.gperf"
       {"cross", CSSValueCross},
-#line 415 "CSSValueKeywords.gperf"
+#line 352 "CSSValueKeywords.gperf"
+      {"multiple", CSSValueMultiple},
+#line 480 "CSSValueKeywords.gperf"
       {"coral", CSSValueCoral},
-#line 13 "CSSValueKeywords.gperf"
-      {"none", CSSValueNone},
-#line 506 "CSSValueKeywords.gperf"
-      {"plum", CSSValuePlum},
-#line 559 "CSSValueKeywords.gperf"
-      {"tb", CSSValueTb},
+#line 371 "CSSValueKeywords.gperf"
+      {"ellipsis", CSSValueEllipsis},
+#line 217 "CSSValueKeywords.gperf"
+      {"somali", CSSValueSomali},
+#line 272 "CSSValueKeywords.gperf"
+      {"e-resize", CSSValueEResize},
+#line 278 "CSSValueKeywords.gperf"
+      {"s-resize", CSSValueSResize},
+#line 180 "CSSValueKeywords.gperf"
+      {"mongolian", CSSValueMongolian},
+#line 431 "CSSValueKeywords.gperf"
+      {"content", CSSValueContent},
 #line 86 "CSSValueKeywords.gperf"
       {"purple", CSSValuePurple},
-#line 252 "CSSValueKeywords.gperf"
+#line 275 "CSSValueKeywords.gperf"
+      {"n-resize", CSSValueNResize},
+#line 435 "CSSValueKeywords.gperf"
+      {"contain", CSSValueContain},
+#line 437 "CSSValueKeywords.gperf"
+      {"logical", CSSValueLogical},
+#line 616 "CSSValueKeywords.gperf"
+      {"no-change", CSSValueNoChange},
+#line 308 "CSSValueKeywords.gperf"
       {"crop", CSSValueCrop},
-#line 36 "CSSValueKeywords.gperf"
-      {"normal", CSSValueNormal},
-#line 183 "CSSValueKeywords.gperf"
-      {"inline", CSSValueInline},
-#line 176 "CSSValueKeywords.gperf"
-      {"armenian", CSSValueArmenian},
-#line 242 "CSSValueKeywords.gperf"
+#line 77 "CSSValueKeywords.gperf"
+      {"blue", CSSValueBlue},
+#line 444 "CSSValueKeywords.gperf"
+      {"ease", CSSValueEase},
+#line 588 "CSSValueKeywords.gperf"
+      {"tan", CSSValueTan},
+#line 462 "CSSValueKeywords.gperf"
+      {"srgb", CSSValueSrgb},
+#line 53 "CSSValueKeywords.gperf"
+      {"large", CSSValueLarge},
+#line 479 "CSSValueKeywords.gperf"
+      {"chocolate", CSSValueChocolate},
+#line 258 "CSSValueKeywords.gperf"
+      {"auto", CSSValueAuto},
+#line 618 "CSSValueKeywords.gperf"
+      {"lr-tb", CSSValueLrTb},
+#line 298 "CSSValueKeywords.gperf"
       {"collapse", CSSValueCollapse},
 #line 73 "CSSValueKeywords.gperf"
       {"monospace", CSSValueMonospace},
-#line 216 "CSSValueKeywords.gperf"
-      {"e-resize", CSSValueEResize},
-#line 379 "CSSValueKeywords.gperf"
-      {"lines", CSSValueLines},
-#line 222 "CSSValueKeywords.gperf"
-      {"s-resize", CSSValueSResize},
-#line 315 "CSSValueKeywords.gperf"
-      {"ellipsis", CSSValueEllipsis},
-#line 84 "CSSValueKeywords.gperf"
-      {"olive", CSSValueOlive},
-#line 210 "CSSValueKeywords.gperf"
-      {"alias", CSSValueAlias},
-#line 81 "CSSValueKeywords.gperf"
-      {"lime", CSSValueLime},
-#line 164 "CSSValueKeywords.gperf"
-      {"circle", CSSValueCircle},
-#line 478 "CSSValueKeywords.gperf"
-      {"linen", CSSValueLinen},
-#line 219 "CSSValueKeywords.gperf"
-      {"n-resize", CSSValueNResize},
-#line 15 "CSSValueKeywords.gperf"
-      {"inset", CSSValueInset},
-#line 296 "CSSValueKeywords.gperf"
-      {"multiple", CSSValueMultiple},
-#line 414 "CSSValueKeywords.gperf"
-      {"chocolate", CSSValueChocolate},
-#line 314 "CSSValueKeywords.gperf"
-      {"clip", CSSValueClip},
-#line 375 "CSSValueKeywords.gperf"
-      {"contain", CSSValueContain},
-#line 418 "CSSValueKeywords.gperf"
-      {"crimson", CSSValueCrimson},
-#line 417 "CSSValueKeywords.gperf"
-      {"cornsilk", CSSValueCornsilk},
-#line 187 "CSSValueKeywords.gperf"
+#line 292 "CSSValueKeywords.gperf"
+      {"ltr", CSSValueLtr},
+#line 188 "CSSValueKeywords.gperf"
+      {"thai", CSSValueThai},
+#line 85 "CSSValueKeywords.gperf"
+      {"orange", CSSValueOrange},
+#line 18 "CSSValueKeywords.gperf"
+      {"outset", CSSValueOutset},
+#line 576 "CSSValueKeywords.gperf"
+      {"salmon", CSSValueSalmon},
+#line 544 "CSSValueKeywords.gperf"
+      {"magenta", CSSValueMagenta},
+#line 419 "CSSValueKeywords.gperf"
+      {"caret", CSSValueCaret},
+#line 82 "CSSValueKeywords.gperf"
+      {"maroon", CSSValueMaroon},
+#line 245 "CSSValueKeywords.gperf"
+      {"table", CSSValueTable},
+#line 51 "CSSValueKeywords.gperf"
+      {"small", CSSValueSmall},
+#line 613 "CSSValueKeywords.gperf"
+      {"hanging", CSSValueHanging},
+#line 474 "CSSValueKeywords.gperf"
+      {"blueviolet", CSSValueBlueviolet},
+#line 243 "CSSValueKeywords.gperf"
       {"compact", CSSValueCompact},
-#line 279 "CSSValueKeywords.gperf"
+#line 266 "CSSValueKeywords.gperf"
+      {"alias", CSSValueAlias},
+#line 178 "CSSValueKeywords.gperf"
+      {"lao", CSSValueLao},
+#line 215 "CSSValueKeywords.gperf"
+      {"sidama", CSSValueSidama},
+#line 335 "CSSValueKeywords.gperf"
       {"scroll", CSSValueScroll},
-#line 254 "CSSValueKeywords.gperf"
-      {"embed", CSSValueEmbed},
-#line 525 "CSSValueKeywords.gperf"
-      {"tomato", CSSValueTomato},
+#line 343 "CSSValueKeywords.gperf"
+      {"stretch", CSSValueStretch},
+#line 313 "CSSValueKeywords.gperf"
+      {"hide", CSSValueHide},
+#line 162 "CSSValueKeywords.gperf"
+      {"inside", CSSValueInside},
+#line 84 "CSSValueKeywords.gperf"
+      {"olive", CSSValueOlive},
+#line 347 "CSSValueKeywords.gperf"
+      {"horizontal", CSSValueHorizontal},
+#line 300 "CSSValueKeywords.gperf"
+      {"absolute", CSSValueAbsolute},
 #line 150 "CSSValueKeywords.gperf"
       {"top", CSSValueTop},
-#line 264 "CSSValueKeywords.gperf"
+#line 310 "CSSValueKeywords.gperf"
+      {"embed", CSSValueEmbed},
+#line 514 "CSSValueKeywords.gperf"
+      {"gold", CSSValueGold},
+#line 463 "CSSValueKeywords.gperf"
+      {"mini", CSSValueMini},
+#line 439 "CSSValueKeywords.gperf"
+      {"lines", CSSValueLines},
+#line 351 "CSSValueKeywords.gperf"
+      {"single", CSSValueSingle},
+#line 235 "CSSValueKeywords.gperf"
+      {"hiragana", CSSValueHiragana},
+#line 81 "CSSValueKeywords.gperf"
+      {"lime", CSSValueLime},
+#line 320 "CSSValueKeywords.gperf"
       {"loud", CSSValueLoud},
-#line 371 "CSSValueKeywords.gperf"
-      {"content", CSSValueContent},
-#line 77 "CSSValueKeywords.gperf"
-      {"blue", CSSValueBlue},
-#line 263 "CSSValueKeywords.gperf"
-      {"local", CSSValueLocal},
-#line 527 "CSSValueKeywords.gperf"
-      {"violet", CSSValueViolet},
-#line 505 "CSSValueKeywords.gperf"
-      {"pink", CSSValuePink},
-#line 284 "CSSValueKeywords.gperf"
+#line 340 "CSSValueKeywords.gperf"
       {"thin", CSSValueThin},
-#line 51 "CSSValueKeywords.gperf"
-      {"small", CSSValueSmall},
 #line 21 "CSSValueKeywords.gperf"
       {"solid", CSSValueSolid},
+#line 543 "CSSValueKeywords.gperf"
+      {"linen", CSSValueLinen},
+#line 319 "CSSValueKeywords.gperf"
+      {"local", CSSValueLocal},
+#line 589 "CSSValueKeywords.gperf"
+      {"thistle", CSSValueThistle},
+#line 392 "CSSValueKeywords.gperf"
+      {"listitem", CSSValueListitem},
 #line 24 "CSSValueKeywords.gperf"
       {"icon", CSSValueIcon},
 #line 12 "CSSValueKeywords.gperf"
       {"initial", CSSValueInitial},
-#line 82 "CSSValueKeywords.gperf"
-      {"maroon", CSSValueMaroon},
-#line 384 "CSSValueKeywords.gperf"
-      {"ease", CSSValueEase},
-#line 511 "CSSValueKeywords.gperf"
-      {"salmon", CSSValueSalmon},
-#line 523 "CSSValueKeywords.gperf"
-      {"tan", CSSValueTan},
-#line 359 "CSSValueKeywords.gperf"
-      {"caret", CSSValueCaret},
-#line 524 "CSSValueKeywords.gperf"
-      {"thistle", CSSValueThistle},
-#line 189 "CSSValueKeywords.gperf"
-      {"table", CSSValueTable},
-#line 283 "CSSValueKeywords.gperf"
-      {"thick", CSSValueThick},
-#line 492 "CSSValueKeywords.gperf"
+#line 187 "CSSValueKeywords.gperf"
+      {"tibetan", CSSValueTibetan},
+#line 105 "CSSValueKeywords.gperf"
+      {"highlight", CSSValueHighlight},
+#line 484 "CSSValueKeywords.gperf"
+      {"cyan", CSSValueCyan},
+#line 483 "CSSValueKeywords.gperf"
+      {"crimson", CSSValueCrimson},
+#line 117 "CSSValueKeywords.gperf"
+      {"threedhighlight", CSSValueThreedhighlight},
+#line 592 "CSSValueKeywords.gperf"
+      {"violet", CSSValueViolet},
+#line 164 "CSSValueKeywords.gperf"
+      {"circle", CSSValueCircle},
+#line 370 "CSSValueKeywords.gperf"
+      {"clip", CSSValueClip},
+#line 535 "CSSValueKeywords.gperf"
+      {"lightsalmon", CSSValueLightsalmon},
+#line 557 "CSSValueKeywords.gperf"
       {"moccasin", CSSValueMoccasin},
-#line 554 "CSSValueKeywords.gperf"
-      {"lr-tb", CSSValueLrTb},
-#line 162 "CSSValueKeywords.gperf"
-      {"inside", CSSValueInside},
-#line 305 "CSSValueKeywords.gperf"
-      {"slide", CSSValueSlide},
-#line 145 "CSSValueKeywords.gperf"
-      {"middle", CSSValueMiddle},
-#line 405 "CSSValueKeywords.gperf"
-      {"azure", CSSValueAzure},
+#line 206 "CSSValueKeywords.gperf"
+      {"ethiopic", CSSValueEthiopic},
+#line 603 "CSSValueKeywords.gperf"
+      {"butt", CSSValueButt},
+#line 356 "CSSValueKeywords.gperf"
+      {"up", CSSValueUp},
+#line 185 "CSSValueKeywords.gperf"
+      {"urdu", CSSValueUrdu},
+#line 622 "CSSValueKeywords.gperf"
+      {"rl", CSSValueRl},
+#line 312 "CSSValueKeywords.gperf"
+      {"hand", CSSValueHand},
 #line 75 "CSSValueKeywords.gperf"
       {"aqua", CSSValueAqua},
-#line 419 "CSSValueKeywords.gperf"
-      {"cyan", CSSValueCyan},
-#line 558 "CSSValueKeywords.gperf"
-      {"rl", CSSValueRl},
-#line 324 "CSSValueKeywords.gperf"
+#line 211 "CSSValueKeywords.gperf"
+      {"hangul", CSSValueHangul},
+#line 470 "CSSValueKeywords.gperf"
+      {"azure", CSSValueAzure},
+#line 386 "CSSValueKeywords.gperf"
+      {"button", CSSValueButton},
+#line 112 "CSSValueKeywords.gperf"
+      {"match", CSSValueMatch},
+#line 262 "CSSValueKeywords.gperf"
+      {"move", CSSValueMove},
+#line 380 "CSSValueKeywords.gperf"
       {"space", CSSValueSpace},
-#line 409 "CSSValueKeywords.gperf"
-      {"blueviolet", CSSValueBlueviolet},
-#line 184 "CSSValueKeywords.gperf"
-      {"block", CSSValueBlock},
-#line 163 "CSSValueKeywords.gperf"
-      {"disc", CSSValueDisc},
-#line 335 "CSSValueKeywords.gperf"
-      {"listitem", CSSValueListitem},
-#line 16 "CSSValueKeywords.gperf"
-      {"groove", CSSValueGroove},
-#line 236 "CSSValueKeywords.gperf"
-      {"ltr", CSSValueLtr},
-#line 202 "CSSValueKeywords.gperf"
-      {"auto", CSSValueAuto},
-#line 457 "CSSValueKeywords.gperf"
-      {"khaki", CSSValueKhaki},
-#line 455 "CSSValueKeywords.gperf"
-      {"indigo", CSSValueIndigo},
-#line 556 "CSSValueKeywords.gperf"
+#line 182 "CSSValueKeywords.gperf"
+      {"octal", CSSValueOctal},
+#line 358 "CSSValueKeywords.gperf"
+      {"slow", CSSValueSlow},
+#line 144 "CSSValueKeywords.gperf"
+      {"baseline", CSSValueBaseline},
+#line 585 "CSSValueKeywords.gperf"
+      {"snow", CSSValueSnow},
+#line 338 "CSSValueKeywords.gperf"
+      {"static", CSSValueStatic},
+#line 337 "CSSValueKeywords.gperf"
+      {"show", CSSValueShow},
+#line 161 "CSSValueKeywords.gperf"
+      {"outside", CSSValueOutside},
+#line 306 "CSSValueKeywords.gperf"
+      {"both", CSSValueBoth},
+#line 591 "CSSValueKeywords.gperf"
+      {"turquoise", CSSValueTurquoise},
+#line 37 "CSSValueKeywords.gperf"
+      {"bold", CSSValueBold},
+#line 367 "CSSValueKeywords.gperf"
+      {"ignore", CSSValueIgnore},
+#line 108 "CSSValueKeywords.gperf"
+      {"inactivecaption", CSSValueInactivecaption},
+#line 151 "CSSValueKeywords.gperf"
+      {"bottom", CSSValueBottom},
+#line 612 "CSSValueKeywords.gperf"
+      {"alphabetic", CSSValueAlphabetic},
+#line 562 "CSSValueKeywords.gperf"
+      {"orchid", CSSValueOrchid},
+#line 620 "CSSValueKeywords.gperf"
       {"tb-rl", CSSValueTbRl},
-#line 381 "CSSValueKeywords.gperf"
+#line 32 "CSSValueKeywords.gperf"
+      {"italic", CSSValueItalic},
+#line 441 "CSSValueKeywords.gperf"
       {"paused", CSSValuePaused},
+#line 361 "CSSValueKeywords.gperf"
+      {"slide", CSSValueSlide},
+#line 33 "CSSValueKeywords.gperf"
+      {"oblique", CSSValueOblique},
+#line 438 "CSSValueKeywords.gperf"
+      {"visual", CSSValueVisual},
+#line 614 "CSSValueKeywords.gperf"
+      {"mathematical", CSSValueMathematical},
 #line 22 "CSSValueKeywords.gperf"
       {"double", CSSValueDouble},
-#line 147 "CSSValueKeywords.gperf"
-      {"super", CSSValueSuper},
-#line 63 "CSSValueKeywords.gperf"
-      {"condensed", CSSValueCondensed},
-#line 241 "CSSValueKeywords.gperf"
+#line 297 "CSSValueKeywords.gperf"
       {"visible", CSSValueVisible},
-#line 37 "CSSValueKeywords.gperf"
-      {"bold", CSSValueBold},
-#line 520 "CSSValueKeywords.gperf"
-      {"snow", CSSValueSnow},
-#line 249 "CSSValueKeywords.gperf"
-      {"blink", CSSValueBlink},
-#line 206 "CSSValueKeywords.gperf"
-      {"move", CSSValueMove},
-#line 302 "CSSValueKeywords.gperf"
-      {"slow", CSSValueSlow},
-#line 385 "CSSValueKeywords.gperf"
-      {"linear", CSSValueLinear},
-#line 88 "CSSValueKeywords.gperf"
-      {"silver", CSSValueSilver},
-#line 260 "CSSValueKeywords.gperf"
-      {"landscape", CSSValueLandscape},
-#line 281 "CSSValueKeywords.gperf"
-      {"show", CSSValueShow},
+#line 457 "CSSValueKeywords.gperf"
+      {"antialiased", CSSValueAntialiased},
 #line 23 "CSSValueKeywords.gperf"
       {"caption", CSSValueCaption},
-#line 18 "CSSValueKeywords.gperf"
-      {"outset", CSSValueOutset},
-#line 396 "CSSValueKeywords.gperf"
-      {"stroke", CSSValueStroke},
-#line 531 "CSSValueKeywords.gperf"
-      {"nonzero", CSSValueNonzero},
-#line 295 "CSSValueKeywords.gperf"
-      {"single", CSSValueSingle},
 #line 11 "CSSValueKeywords.gperf"
       {"inherit", CSSValueInherit},
-#line 300 "CSSValueKeywords.gperf"
-      {"up", CSSValueUp},
-#line 130 "CSSValueKeywords.gperf"
-      {"no-repeat", CSSValueNoRepeat},
-#line 76 "CSSValueKeywords.gperf"
-      {"black", CSSValueBlack},
-#line 223 "CSSValueKeywords.gperf"
+#line 145 "CSSValueKeywords.gperf"
+      {"middle", CSSValueMiddle},
+#line 446 "CSSValueKeywords.gperf"
+      {"ease-in", CSSValueEaseIn},
+#line 440 "CSSValueKeywords.gperf"
+      {"running", CSSValueRunning},
+#line 279 "CSSValueKeywords.gperf"
       {"w-resize", CSSValueWResize},
-#line 432 "CSSValueKeywords.gperf"
-      {"darksalmon", CSSValueDarksalmon},
-#line 304 "CSSValueKeywords.gperf"
-      {"infinite", CSSValueInfinite},
-#line 225 "CSSValueKeywords.gperf"
+#line 513 "CSSValueKeywords.gperf"
+      {"ghostwhite", CSSValueGhostwhite},
+#line 163 "CSSValueKeywords.gperf"
+      {"disc", CSSValueDisc},
+#line 14 "CSSValueKeywords.gperf"
+      {"hidden", CSSValueHidden},
+#line 433 "CSSValueKeywords.gperf"
+      {"padding", CSSValuePadding},
+#line 200 "CSSValueKeywords.gperf"
+      {"amharic", CSSValueAmharic},
+#line 581 "CSSValueKeywords.gperf"
+      {"skyblue", CSSValueSkyblue},
+#line 100 "CSSValueKeywords.gperf"
+      {"buttonhighlight", CSSValueButtonhighlight},
+#line 316 "CSSValueKeywords.gperf"
+      {"landscape", CSSValueLandscape},
+#line 246 "CSSValueKeywords.gperf"
+      {"inline-table", CSSValueInlineTable},
+#line 465 "CSSValueKeywords.gperf"
+      {"application", CSSValueApplication},
+#line 259 "CSSValueKeywords.gperf"
+      {"crosshair", CSSValueCrosshair},
+#line 267 "CSSValueKeywords.gperf"
+      {"progress", CSSValueProgress},
+#line 241 "CSSValueKeywords.gperf"
+      {"list-item", CSSValueListItem},
+#line 253 "CSSValueKeywords.gperf"
+      {"table-cell", CSSValueTableCell},
+#line 281 "CSSValueKeywords.gperf"
       {"ns-resize", CSSValueNsResize},
-#line 108 "CSSValueKeywords.gperf"
-      {"inactivecaption", CSSValueInactivecaption},
-#line 144 "CSSValueKeywords.gperf"
-      {"baseline", CSSValueBaseline},
-#line 368 "CSSValueKeywords.gperf"
-      {"round", CSSValueRound},
-#line 238 "CSSValueKeywords.gperf"
+#line 63 "CSSValueKeywords.gperf"
+      {"condensed", CSSValueCondensed},
+#line 197 "CSSValueKeywords.gperf"
+      {"afar", CSSValueAfar},
+#line 376 "CSSValueKeywords.gperf"
+      {"continuous", CSSValueContinuous},
+#line 330 "CSSValueKeywords.gperf"
+      {"portrait", CSSValuePortrait},
+#line 130 "CSSValueKeywords.gperf"
+      {"no-repeat", CSSValueNoRepeat},
+#line 582 "CSSValueKeywords.gperf"
+      {"slateblue", CSSValueSlateblue},
+#line 294 "CSSValueKeywords.gperf"
       {"capitalize", CSSValueCapitalize},
-#line 244 "CSSValueKeywords.gperf"
-      {"absolute", CSSValueAbsolute},
-#line 490 "CSSValueKeywords.gperf"
-      {"mintcream", CSSValueMintcream},
-#line 33 "CSSValueKeywords.gperf"
-      {"oblique", CSSValueOblique},
-#line 327 "CSSValueKeywords.gperf"
+#line 619 "CSSValueKeywords.gperf"
+      {"rl-tb", CSSValueRlTb},
+#line 602 "CSSValueKeywords.gperf"
+      {"crispedges", CSSValueCrispedges},
+#line 293 "CSSValueKeywords.gperf"
+      {"rtl", CSSValueRtl},
+#line 58 "CSSValueKeywords.gperf"
+      {"larger", CSSValueLarger},
+#line 96 "CSSValueKeywords.gperf"
+      {"activecaption", CSSValueActivecaption},
+#line 383 "CSSValueKeywords.gperf"
       {"radio", CSSValueRadio},
-#line 53 "CSSValueKeywords.gperf"
-      {"large", CSSValueLarge},
-#line 274 "CSSValueKeywords.gperf"
-      {"portrait", CSSValuePortrait},
-#line 449 "CSSValueKeywords.gperf"
-      {"gold", CSSValueGold},
+#line 20 "CSSValueKeywords.gperf"
+      {"dashed", CSSValueDashed},
+#line 35 "CSSValueKeywords.gperf"
+      {"small-caps", CSSValueSmallCaps},
+#line 147 "CSSValueKeywords.gperf"
+      {"super", CSSValueSuper},
+#line 477 "CSSValueKeywords.gperf"
+      {"cadetblue", CSSValueCadetblue},
+#line 596 "CSSValueKeywords.gperf"
+      {"nonzero", CSSValueNonzero},
+#line 475 "CSSValueKeywords.gperf"
+      {"brown", CSSValueBrown},
+#line 90 "CSSValueKeywords.gperf"
+      {"white", CSSValueWhite},
+#line 362 "CSSValueKeywords.gperf"
+      {"alternate", CSSValueAlternate},
+#line 302 "CSSValueKeywords.gperf"
+      {"avoid", CSSValueAvoid},
 #line 57 "CSSValueKeywords.gperf"
       {"smaller", CSSValueSmaller},
-#line 438 "CSSValueKeywords.gperf"
-      {"darkviolet", CSSValueDarkviolet},
-#line 378 "CSSValueKeywords.gperf"
-      {"visual", CSSValueVisual},
-#line 454 "CSSValueKeywords.gperf"
+#line 447 "CSSValueKeywords.gperf"
+      {"ease-out", CSSValueEaseOut},
+#line 17 "CSSValueKeywords.gperf"
+      {"ridge", CSSValueRidge},
+#line 50 "CSSValueKeywords.gperf"
+      {"x-small", CSSValueXSmall},
+#line 88 "CSSValueKeywords.gperf"
+      {"silver", CSSValueSilver},
+#line 254 "CSSValueKeywords.gperf"
+      {"table-caption", CSSValueTableCaption},
+#line 219 "CSSValueKeywords.gperf"
+      {"tigre", CSSValueTigre},
+#line 27 "CSSValueKeywords.gperf"
+      {"small-caption", CSSValueSmallCaption},
+#line 111 "CSSValueKeywords.gperf"
+      {"infotext", CSSValueInfotext},
+#line 155 "CSSValueKeywords.gperf"
+      {"right", CSSValueRight},
+#line 341 "CSSValueKeywords.gperf"
+      {"underline", CSSValueUnderline},
+#line 445 "CSSValueKeywords.gperf"
+      {"linear", CSSValueLinear},
+#line 171 "CSSValueKeywords.gperf"
+      {"cambodian", CSSValueCambodian},
+#line 467 "CSSValueKeywords.gperf"
+      {"aliceblue", CSSValueAliceblue},
+#line 527 "CSSValueKeywords.gperf"
+      {"lightblue", CSSValueLightblue},
+#line 314 "CSSValueKeywords.gperf"
+      {"higher", CSSValueHigher},
+#line 19 "CSSValueKeywords.gperf"
+      {"dotted", CSSValueDotted},
+#line 564 "CSSValueKeywords.gperf"
+      {"palegreen", CSSValuePalegreen},
+#line 141 "CSSValueKeywords.gperf"
+      {"xor", CSSValueXor},
+#line 154 "CSSValueKeywords.gperf"
+      {"left", CSSValueLeft},
+#line 519 "CSSValueKeywords.gperf"
       {"indianred", CSSValueIndianred},
-#line 85 "CSSValueKeywords.gperf"
-      {"orange", CSSValueOrange},
-#line 161 "CSSValueKeywords.gperf"
-      {"outside", CSSValueOutside},
-#line 205 "CSSValueKeywords.gperf"
-      {"pointer", CSSValuePointer},
-#line 90 "CSSValueKeywords.gperf"
-      {"white", CSSValueWhite},
-#line 526 "CSSValueKeywords.gperf"
-      {"turquoise", CSSValueTurquoise},
-#line 212 "CSSValueKeywords.gperf"
-      {"no-drop", CSSValueNoDrop},
+#line 39 "CSSValueKeywords.gperf"
+      {"lighter", CSSValueLighter},
+#line 586 "CSSValueKeywords.gperf"
+      {"springgreen", CSSValueSpringgreen},
+#line 80 "CSSValueKeywords.gperf"
+      {"green", CSSValueGreen},
+#line 482 "CSSValueKeywords.gperf"
+      {"cornsilk", CSSValueCornsilk},
+#line 79 "CSSValueKeywords.gperf"
+      {"gray", CSSValueGray},
+#line 428 "CSSValueKeywords.gperf"
+      {"round", CSSValueRound},
+#line 181 "CSSValueKeywords.gperf"
+      {"myanmar", CSSValueMyanmar},
+#line 554 "CSSValueKeywords.gperf"
+      {"midnightblue", CSSValueMidnightblue},
+#line 366 "CSSValueKeywords.gperf"
+      {"element", CSSValueElement},
 #line 555 "CSSValueKeywords.gperf"
-      {"rl-tb", CSSValueRlTb},
-#line 394 "CSSValueKeywords.gperf"
-      {"painted", CSSValuePainted},
-#line 208 "CSSValueKeywords.gperf"
+      {"mintcream", CSSValueMintcream},
+#line 242 "CSSValueKeywords.gperf"
+      {"run-in", CSSValueRunIn},
+#line 449 "CSSValueKeywords.gperf"
+      {"document", CSSValueDocument},
+#line 540 "CSSValueKeywords.gperf"
+      {"lightsteelblue", CSSValueLightsteelblue},
+#line 264 "CSSValueKeywords.gperf"
       {"cell", CSSValueCell},
-#line 246 "CSSValueKeywords.gperf"
-      {"avoid", CSSValueAvoid},
-#line 275 "CSSValueKeywords.gperf"
+#line 179 "CSSValueKeywords.gperf"
+      {"malayalam", CSSValueMalayalam},
+#line 532 "CSSValueKeywords.gperf"
+      {"lightgreen", CSSValueLightgreen},
+#line 92 "CSSValueKeywords.gperf"
+      {"transparent", CSSValueTransparent},
+#line 542 "CSSValueKeywords.gperf"
+      {"limegreen", CSSValueLimegreen},
+#line 456 "CSSValueKeywords.gperf"
+      {"stroke", CSSValueStroke},
+#line 368 "CSSValueKeywords.gperf"
+      {"intrinsic", CSSValueIntrinsic},
+#line 454 "CSSValueKeywords.gperf"
+      {"painted", CSSValuePainted},
+#line 536 "CSSValueKeywords.gperf"
+      {"lightseagreen", CSSValueLightseagreen},
+#line 331 "CSSValueKeywords.gperf"
       {"pre", CSSValuePre},
+#line 289 "CSSValueKeywords.gperf"
+      {"all-scroll", CSSValueAllScroll},
+#line 288 "CSSValueKeywords.gperf"
+      {"help", CSSValueHelp},
+#line 175 "CSSValueKeywords.gperf"
+      {"gurmukhi", CSSValueGurmukhi},
+#line 348 "CSSValueKeywords.gperf"
+      {"vertical", CSSValueVertical},
+#line 528 "CSSValueKeywords.gperf"
+      {"lightcoral", CSSValueLightcoral},
+#line 384 "CSSValueKeywords.gperf"
+      {"push-button", CSSValuePushButton},
+#line 323 "CSSValueKeywords.gperf"
+      {"mix", CSSValueMix},
+#line 287 "CSSValueKeywords.gperf"
+      {"wait", CSSValueWait},
+#line 344 "CSSValueKeywords.gperf"
+      {"start", CSSValueStart},
+#line 252 "CSSValueKeywords.gperf"
+      {"table-column", CSSValueTableColumn},
+#line 268 "CSSValueKeywords.gperf"
+      {"no-drop", CSSValueNoDrop},
+#line 315 "CSSValueKeywords.gperf"
+      {"invert", CSSValueInvert},
+#line 307 "CSSValueKeywords.gperf"
+      {"close-quote", CSSValueCloseQuote},
+#line 183 "CSSValueKeywords.gperf"
+      {"oriya", CSSValueOriya},
+#line 464 "CSSValueKeywords.gperf"
+      {"floating", CSSValueFloating},
+#line 143 "CSSValueKeywords.gperf"
+      {"plus-lighter", CSSValuePlusLighter},
+#line 184 "CSSValueKeywords.gperf"
+      {"persian", CSSValuePersian},
+#line 240 "CSSValueKeywords.gperf"
+      {"block", CSSValueBlock},
 #line 165 "CSSValueKeywords.gperf"
       {"square", CSSValueSquare},
-#line 397 "CSSValueKeywords.gperf"
-      {"antialiased", CSSValueAntialiased},
-#line 539 "CSSValueKeywords.gperf"
-      {"butt", CSSValueButt},
-#line 410 "CSSValueKeywords.gperf"
-      {"brown", CSSValueBrown},
-#line 32 "CSSValueKeywords.gperf"
-      {"italic", CSSValueItalic},
-#line 538 "CSSValueKeywords.gperf"
-      {"crispedges", CSSValueCrispedges},
-#line 516 "CSSValueKeywords.gperf"
-      {"skyblue", CSSValueSkyblue},
-#line 330 "CSSValueKeywords.gperf"
-      {"button", CSSValueButton},
-#line 529 "CSSValueKeywords.gperf"
-      {"whitesmoke", CSSValueWhitesmoke},
-#line 282 "CSSValueKeywords.gperf"
-      {"static", CSSValueStatic},
-#line 237 "CSSValueKeywords.gperf"
-      {"rtl", CSSValueRtl},
-#line 404 "CSSValueKeywords.gperf"
-      {"aquamarine", CSSValueAquamarine},
-#line 310 "CSSValueKeywords.gperf"
-      {"element", CSSValueElement},
-#line 292 "CSSValueKeywords.gperf"
-      {"vertical", CSSValueVertical},
-#line 151 "CSSValueKeywords.gperf"
-      {"bottom", CSSValueBottom},
+#line 451 "CSSValueKeywords.gperf"
+      {"visiblepainted", CSSValueVisiblepainted},
+#line 210 "CSSValueKeywords.gperf"
+      {"hangul-consonant", CSSValueHangulConsonant},
+#line 134 "CSSValueKeywords.gperf"
+      {"source-in", CSSValueSourceIn},
+#line 261 "CSSValueKeywords.gperf"
+      {"pointer", CSSValuePointer},
+#line 472 "CSSValueKeywords.gperf"
+      {"bisque", CSSValueBisque},
+#line 598 "CSSValueKeywords.gperf"
+      {"accumulate", CSSValueAccumulate},
+#line 119 "CSSValueKeywords.gperf"
+      {"threedshadow", CSSValueThreedshadow},
+#line 339 "CSSValueKeywords.gperf"
+      {"thick", CSSValueThick},
+#line 561 "CSSValueKeywords.gperf"
+      {"orangered", CSSValueOrangered},
+#line 132 "CSSValueKeywords.gperf"
+      {"copy", CSSValueCopy},
 #line 114 "CSSValueKeywords.gperf"
       {"scrollbar", CSSValueScrollbar},
-#line 395 "CSSValueKeywords.gperf"
-      {"fill", CSSValueFill},
-#line 369 "CSSValueKeywords.gperf"
-      {"border", CSSValueBorder},
-#line 35 "CSSValueKeywords.gperf"
-      {"small-caps", CSSValueSmallCaps},
-#line 211 "CSSValueKeywords.gperf"
-      {"progress", CSSValueProgress},
-#line 380 "CSSValueKeywords.gperf"
-      {"running", CSSValueRunning},
+#line 324 "CSSValueKeywords.gperf"
+      {"no-close-quote", CSSValueNoCloseQuote},
+#line 459 "CSSValueKeywords.gperf"
+      {"optimizespeed", CSSValueOptimizespeed},
+#line 570 "CSSValueKeywords.gperf"
+      {"pink", CSSValuePink},
+#line 604 "CSSValueKeywords.gperf"
+      {"miter", CSSValueMiter},
+#line 442 "CSSValueKeywords.gperf"
+      {"flat", CSSValueFlat},
+#line 359 "CSSValueKeywords.gperf"
+      {"fast", CSSValueFast},
 #line 38 "CSSValueKeywords.gperf"
       {"bolder", CSSValueBolder},
-#line 402 "CSSValueKeywords.gperf"
-      {"aliceblue", CSSValueAliceblue},
-#line 197 "CSSValueKeywords.gperf"
-      {"table-cell", CSSValueTableCell},
-#line 376 "CSSValueKeywords.gperf"
+#line 436 "CSSValueKeywords.gperf"
       {"cover", CSSValueCover},
-#line 386 "CSSValueKeywords.gperf"
-      {"ease-in", CSSValueEaseIn},
-#line 92 "CSSValueKeywords.gperf"
-      {"transparent", CSSValueTransparent},
+#line 469 "CSSValueKeywords.gperf"
+      {"aquamarine", CSSValueAquamarine},
+#line 429 "CSSValueKeywords.gperf"
+      {"border", CSSValueBorder},
+#line 136 "CSSValueKeywords.gperf"
+      {"source-atop", CSSValueSourceAtop},
+#line 89 "CSSValueKeywords.gperf"
+      {"teal", CSSValueTeal},
+#line 25 "CSSValueKeywords.gperf"
+      {"menu", CSSValueMenu},
+#line 375 "CSSValueKeywords.gperf"
+      {"wave", CSSValueWave},
+#line 387 "CSSValueKeywords.gperf"
+      {"button-bevel", CSSValueButtonBevel},
+#line 325 "CSSValueKeywords.gperf"
+      {"no-open-quote", CSSValueNoOpenQuote},
+#line 529 "CSSValueKeywords.gperf"
+      {"lightcyan", CSSValueLightcyan},
+#line 118 "CSSValueKeywords.gperf"
+      {"threedlightshadow", CSSValueThreedlightshadow},
+#line 52 "CSSValueKeywords.gperf"
+      {"medium", CSSValueMedium},
+#line 170 "CSSValueKeywords.gperf"
+      {"bengali", CSSValueBengali},
+#line 355 "CSSValueKeywords.gperf"
+      {"ahead", CSSValueAhead},
+#line 284 "CSSValueKeywords.gperf"
+      {"col-resize", CSSValueColResize},
+#line 579 "CSSValueKeywords.gperf"
+      {"seashell", CSSValueSeashell},
+#line 473 "CSSValueKeywords.gperf"
+      {"blanchedalmond", CSSValueBlanchedalmond},
+#line 76 "CSSValueKeywords.gperf"
+      {"black", CSSValueBlack},
+#line 518 "CSSValueKeywords.gperf"
+      {"hotpink", CSSValueHotpink},
+#line 78 "CSSValueKeywords.gperf"
+      {"fuchsia", CSSValueFuchsia},
+#line 357 "CSSValueKeywords.gperf"
+      {"down", CSSValueDown},
+#line 409 "CSSValueKeywords.gperf"
+      {"menulist", CSSValueMenulist},
+#line 566 "CSSValueKeywords.gperf"
+      {"palevioletred", CSSValuePalevioletred},
 #line 515 "CSSValueKeywords.gperf"
-      {"sienna", CSSValueSienna},
-#line 391 "CSSValueKeywords.gperf"
-      {"visiblepainted", CSSValueVisiblepainted},
-#line 285 "CSSValueKeywords.gperf"
-      {"underline", CSSValueUnderline},
-#line 17 "CSSValueKeywords.gperf"
-      {"ridge", CSSValueRidge},
-#line 96 "CSSValueKeywords.gperf"
-      {"activecaption", CSSValueActivecaption},
-#line 180 "CSSValueKeywords.gperf"
-      {"katakana", CSSValueKatakana},
+      {"goldenrod", CSSValueGoldenrod},
+#line 534 "CSSValueKeywords.gperf"
+      {"lightpink", CSSValueLightpink},
+#line 569 "CSSValueKeywords.gperf"
+      {"peru", CSSValuePeru},
+#line 455 "CSSValueKeywords.gperf"
+      {"fill", CSSValueFill},
+#line 176 "CSSValueKeywords.gperf"
+      {"kannada", CSSValueKannada},
+#line 373 "CSSValueKeywords.gperf"
+      {"dot-dash", CSSValueDotDash},
+#line 492 "CSSValueKeywords.gperf"
+      {"darkmagenta", CSSValueDarkmagenta},
+#line 174 "CSSValueKeywords.gperf"
+      {"gujarati", CSSValueGujarati},
+#line 448 "CSSValueKeywords.gperf"
+      {"ease-in-out", CSSValueEaseInOut},
+#line 390 "CSSValueKeywords.gperf"
+      {"list-button", CSSValueListButton},
+#line 116 "CSSValueKeywords.gperf"
+      {"threedface", CSSValueThreedface},
+#line 220 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-tig", CSSValueEthiopicHalehameTig},
 #line 124 "CSSValueKeywords.gperf"
       {"currentcolor", CSSValueCurrentcolor},
-#line 231 "CSSValueKeywords.gperf"
-      {"wait", CSSValueWait},
-#line 299 "CSSValueKeywords.gperf"
-      {"ahead", CSSValueAhead},
-#line 185 "CSSValueKeywords.gperf"
-      {"list-item", CSSValueListItem},
-#line 377 "CSSValueKeywords.gperf"
-      {"logical", CSSValueLogical},
-#line 186 "CSSValueKeywords.gperf"
-      {"run-in", CSSValueRunIn},
-#line 259 "CSSValueKeywords.gperf"
-      {"invert", CSSValueInvert},
-#line 373 "CSSValueKeywords.gperf"
-      {"padding", CSSValuePadding},
-#line 306 "CSSValueKeywords.gperf"
-      {"alternate", CSSValueAlternate},
-#line 257 "CSSValueKeywords.gperf"
-      {"hide", CSSValueHide},
+#line 172 "CSSValueKeywords.gperf"
+      {"khmer", CSSValueKhmer},
+#line 503 "CSSValueKeywords.gperf"
+      {"darkviolet", CSSValueDarkviolet},
+#line 106 "CSSValueKeywords.gperf"
+      {"highlighttext", CSSValueHighlighttext},
+#line 497 "CSSValueKeywords.gperf"
+      {"darksalmon", CSSValueDarksalmon},
+#line 305 "CSSValueKeywords.gperf"
+      {"blink", CSSValueBlink},
+#line 574 "CSSValueKeywords.gperf"
+      {"royalblue", CSSValueRoyalblue},
+#line 580 "CSSValueKeywords.gperf"
+      {"sienna", CSSValueSienna},
+#line 349 "CSSValueKeywords.gperf"
+      {"inline-axis", CSSValueInlineAxis},
+#line 168 "CSSValueKeywords.gperf"
+      {"arabic-indic", CSSValueArabicIndic},
+#line 135 "CSSValueKeywords.gperf"
+      {"source-out", CSSValueSourceOut},
+#line 237 "CSSValueKeywords.gperf"
+      {"hiragana-iroha", CSSValueHiraganaIroha},
+#line 101 "CSSValueKeywords.gperf"
+      {"buttonshadow", CSSValueButtonshadow},
 #line 59 "CSSValueKeywords.gperf"
       {"wider", CSSValueWider},
-#line 233 "CSSValueKeywords.gperf"
-      {"all-scroll", CSSValueAllScroll},
-#line 190 "CSSValueKeywords.gperf"
-      {"inline-table", CSSValueInlineTable},
-#line 19 "CSSValueKeywords.gperf"
-      {"dotted", CSSValueDotted},
-#line 540 "CSSValueKeywords.gperf"
-      {"miter", CSSValueMiter},
-#line 477 "CSSValueKeywords.gperf"
-      {"limegreen", CSSValueLimegreen},
-#line 312 "CSSValueKeywords.gperf"
-      {"intrinsic", CSSValueIntrinsic},
-#line 141 "CSSValueKeywords.gperf"
-      {"xor", CSSValueXor},
-#line 495 "CSSValueKeywords.gperf"
+#line 468 "CSSValueKeywords.gperf"
+      {"antiquewhite", CSSValueAntiquewhite},
+#line 54 "CSSValueKeywords.gperf"
+      {"x-large", CSSValueXLarge},
+#line 208 "CSSValueKeywords.gperf"
+      {"ethiopic-abegede", CSSValueEthiopicAbegede},
+#line 207 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-gez", CSSValueEthiopicHalehameGez},
+#line 593 "CSSValueKeywords.gperf"
+      {"wheat", CSSValueWheat},
+#line 295 "CSSValueKeywords.gperf"
+      {"uppercase", CSSValueUppercase},
+#line 102 "CSSValueKeywords.gperf"
+      {"buttontext", CSSValueButtontext},
+#line 317 "CSSValueKeywords.gperf"
+      {"level", CSSValueLevel},
+#line 560 "CSSValueKeywords.gperf"
       {"olivedrab", CSSValueOlivedrab},
-#line 188 "CSSValueKeywords.gperf"
-      {"inline-block", CSSValueInlineBlock},
-#line 134 "CSSValueKeywords.gperf"
-      {"source-in", CSSValueSourceIn},
-#line 316 "CSSValueKeywords.gperf"
-      {"discard", CSSValueDiscard},
-#line 501 "CSSValueKeywords.gperf"
-      {"palevioletred", CSSValuePalevioletred},
-#line 27 "CSSValueKeywords.gperf"
-      {"small-caption", CSSValueSmallCaption},
-#line 399 "CSSValueKeywords.gperf"
-      {"optimizespeed", CSSValueOptimizespeed},
-#line 389 "CSSValueKeywords.gperf"
-      {"document", CSSValueDocument},
-#line 89 "CSSValueKeywords.gperf"
-      {"teal", CSSValueTeal},
-#line 58 "CSSValueKeywords.gperf"
-      {"larger", CSSValueLarger},
-#line 116 "CSSValueKeywords.gperf"
-      {"threedface", CSSValueThreedface},
-#line 407 "CSSValueKeywords.gperf"
-      {"bisque", CSSValueBisque},
-#line 382 "CSSValueKeywords.gperf"
-      {"flat", CSSValueFlat},
-#line 412 "CSSValueKeywords.gperf"
-      {"cadetblue", CSSValueCadetblue},
-#line 517 "CSSValueKeywords.gperf"
-      {"slateblue", CSSValueSlateblue},
-#line 393 "CSSValueKeywords.gperf"
-      {"visiblestroke", CSSValueVisiblestroke},
+#line 512 "CSSValueKeywords.gperf"
+      {"gainsboro", CSSValueGainsboro},
+#line 186 "CSSValueKeywords.gperf"
+      {"telugu", CSSValueTelugu},
+#line 607 "CSSValueKeywords.gperf"
+      {"after-edge", CSSValueAfterEdge},
+#line 332 "CSSValueKeywords.gperf"
+      {"pre-line", CSSValuePreLine},
 #line 87 "CSSValueKeywords.gperf"
       {"red", CSSValueRed},
-#line 198 "CSSValueKeywords.gperf"
-      {"table-caption", CSSValueTableCaption},
-#line 136 "CSSValueKeywords.gperf"
-      {"source-atop", CSSValueSourceAtop},
-#line 427 "CSSValueKeywords.gperf"
-      {"darkmagenta", CSSValueDarkmagenta},
-#line 50 "CSSValueKeywords.gperf"
-      {"x-small", CSSValueXSmall},
-#line 535 "CSSValueKeywords.gperf"
-      {"srgb", CSSValueSrgb},
-#line 228 "CSSValueKeywords.gperf"
-      {"col-resize", CSSValueColResize},
-#line 239 "CSSValueKeywords.gperf"
-      {"uppercase", CSSValueUppercase},
-#line 303 "CSSValueKeywords.gperf"
-      {"fast", CSSValueFast},
+#line 508 "CSSValueKeywords.gperf"
+      {"dodgerblue", CSSValueDodgerblue},
+#line 83 "CSSValueKeywords.gperf"
+      {"navy", CSSValueNavy},
+#line 391 "CSSValueKeywords.gperf"
+      {"listbox", CSSValueListbox},
+#line 450 "CSSValueKeywords.gperf"
+      {"reset", CSSValueReset},
+#line 369 "CSSValueKeywords.gperf"
+      {"min-intrinsic", CSSValueMinIntrinsic},
+#line 109 "CSSValueKeywords.gperf"
+      {"inactivecaptiontext", CSSValueInactivecaptiontext},
+#line 260 "CSSValueKeywords.gperf"
+      {"default", CSSValueDefault},
+#line 471 "CSSValueKeywords.gperf"
+      {"beige", CSSValueBeige},
+#line 244 "CSSValueKeywords.gperf"
+      {"inline-block", CSSValueInlineBlock},
+#line 321 "CSSValueKeywords.gperf"
+      {"lower", CSSValueLower},
+#line 334 "CSSValueKeywords.gperf"
+      {"relative", CSSValueRelative},
 #line 131 "CSSValueKeywords.gperf"
       {"clear", CSSValueClear},
-#line 431 "CSSValueKeywords.gperf"
-      {"darkred", CSSValueDarkred},
-#line 499 "CSSValueKeywords.gperf"
-      {"palegreen", CSSValuePalegreen},
-#line 320 "CSSValueKeywords.gperf"
-      {"continuous", CSSValueContinuous},
-#line 80 "CSSValueKeywords.gperf"
-      {"green", CSSValueGreen},
-#line 291 "CSSValueKeywords.gperf"
-      {"horizontal", CSSValueHorizontal},
-#line 288 "CSSValueKeywords.gperf"
-      {"start", CSSValueStart},
-#line 319 "CSSValueKeywords.gperf"
-      {"wave", CSSValueWave},
+#line 372 "CSSValueKeywords.gperf"
+      {"discard", CSSValueDiscard},
+#line 103 "CSSValueKeywords.gperf"
+      {"captiontext", CSSValueCaptiontext},
 #line 166 "CSSValueKeywords.gperf"
       {"decimal", CSSValueDecimal},
+#line 583 "CSSValueKeywords.gperf"
+      {"slategray", CSSValueSlategray},
 #line 156 "CSSValueKeywords.gperf"
       {"center", CSSValueCenter},
-#line 261 "CSSValueKeywords.gperf"
-      {"level", CSSValueLevel},
-#line 25 "CSSValueKeywords.gperf"
-      {"menu", CSSValueMenu},
-#line 267 "CSSValueKeywords.gperf"
-      {"mix", CSSValueMix},
-#line 544 "CSSValueKeywords.gperf"
+#line 584 "CSSValueKeywords.gperf"
+      {"slategrey", CSSValueSlategrey},
+#line 99 "CSSValueKeywords.gperf"
+      {"buttonface", CSSValueButtonface},
+#line 563 "CSSValueKeywords.gperf"
+      {"palegoldenrod", CSSValuePalegoldenrod},
+#line 608 "CSSValueKeywords.gperf"
       {"central", CSSValueCentral},
-#line 154 "CSSValueKeywords.gperf"
-      {"left", CSSValueLeft},
-#line 14 "CSSValueKeywords.gperf"
-      {"hidden", CSSValueHidden},
-#line 504 "CSSValueKeywords.gperf"
-      {"peru", CSSValuePeru},
-#line 479 "CSSValueKeywords.gperf"
-      {"magenta", CSSValueMagenta},
-#line 278 "CSSValueKeywords.gperf"
-      {"relative", CSSValueRelative},
-#line 132 "CSSValueKeywords.gperf"
-      {"copy", CSSValueCopy},
+#line 269 "CSSValueKeywords.gperf"
+      {"not-allowed", CSSValueNotAllowed},
 #line 301 "CSSValueKeywords.gperf"
-      {"down", CSSValueDown},
-#line 52 "CSSValueKeywords.gperf"
-      {"medium", CSSValueMedium},
-#line 220 "CSSValueKeywords.gperf"
-      {"se-resize", CSSValueSeResize},
-#line 390 "CSSValueKeywords.gperf"
-      {"reset", CSSValueReset},
-#line 509 "CSSValueKeywords.gperf"
-      {"royalblue", CSSValueRoyalblue},
-#line 420 "CSSValueKeywords.gperf"
-      {"darkblue", CSSValueDarkblue},
-#line 217 "CSSValueKeywords.gperf"
-      {"ne-resize", CSSValueNeResize},
-#line 311 "CSSValueKeywords.gperf"
-      {"ignore", CSSValueIgnore},
-#line 97 "CSSValueKeywords.gperf"
-      {"appworkspace", CSSValueAppworkspace},
-#line 251 "CSSValueKeywords.gperf"
-      {"close-quote", CSSValueCloseQuote},
-#line 392 "CSSValueKeywords.gperf"
-      {"visiblefill", CSSValueVisiblefill},
-#line 496 "CSSValueKeywords.gperf"
-      {"orangered", CSSValueOrangered},
+      {"always", CSSValueAlways},
+#line 296 "CSSValueKeywords.gperf"
+      {"lowercase", CSSValueLowercase},
+#line 202 "CSSValueKeywords.gperf"
+      {"amharic-abegede", CSSValueAmharicAbegede},
+#line 280 "CSSValueKeywords.gperf"
+      {"ew-resize", CSSValueEwResize},
+#line 277 "CSSValueKeywords.gperf"
+      {"sw-resize", CSSValueSwResize},
+#line 318 "CSSValueKeywords.gperf"
+      {"line-through", CSSValueLineThrough},
+#line 594 "CSSValueKeywords.gperf"
+      {"whitesmoke", CSSValueWhitesmoke},
+#line 466 "CSSValueKeywords.gperf"
+      {"fullscreen", CSSValueFullscreen},
 #line 120 "CSSValueKeywords.gperf"
       {"window", CSSValueWindow},
-#line 528 "CSSValueKeywords.gperf"
-      {"wheat", CSSValueWheat},
-#line 497 "CSSValueKeywords.gperf"
-      {"orchid", CSSValueOrchid},
-#line 450 "CSSValueKeywords.gperf"
-      {"goldenrod", CSSValueGoldenrod},
-#line 127 "CSSValueKeywords.gperf"
-      {"repeat", CSSValueRepeat},
-#line 256 "CSSValueKeywords.gperf"
-      {"hand", CSSValueHand},
-#line 280 "CSSValueKeywords.gperf"
-      {"separate", CSSValueSeparate},
-#line 268 "CSSValueKeywords.gperf"
-      {"no-close-quote", CSSValueNoCloseQuote},
-#line 313 "CSSValueKeywords.gperf"
-      {"min-intrinsic", CSSValueMinIntrinsic},
-#line 351 "CSSValueKeywords.gperf"
-      {"menulist", CSSValueMenulist},
-#line 203 "CSSValueKeywords.gperf"
-      {"crosshair", CSSValueCrosshair},
-#line 458 "CSSValueKeywords.gperf"
+#line 66 "CSSValueKeywords.gperf"
+      {"expanded", CSSValueExpanded},
+#line 517 "CSSValueKeywords.gperf"
+      {"honeydew", CSSValueHoneydew},
+#line 274 "CSSValueKeywords.gperf"
+      {"nw-resize", CSSValueNwResize},
+#line 326 "CSSValueKeywords.gperf"
+      {"nowrap", CSSValueNowrap},
+#line 523 "CSSValueKeywords.gperf"
       {"lavender", CSSValueLavender},
+#line 233 "CSSValueKeywords.gperf"
+      {"georgian", CSSValueGeorgian},
+#line 49 "CSSValueKeywords.gperf"
+      {"xx-small", CSSValueXxSmall},
 #line 133 "CSSValueKeywords.gperf"
       {"source-over", CSSValueSourceOver},
+#line 511 "CSSValueKeywords.gperf"
+      {"forestgreen", CSSValueForestgreen},
+#line 198 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-aa-et", CSSValueEthiopicHalehameAaEt},
+#line 125 "CSSValueKeywords.gperf"
+      {"grey", CSSValueGrey},
+#line 201 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-am-et", CSSValueEthiopicHalehameAmEt},
+#line 452 "CSSValueKeywords.gperf"
+      {"visiblefill", CSSValueVisiblefill},
+#line 558 "CSSValueKeywords.gperf"
+      {"navajowhite", CSSValueNavajowhite},
+#line 303 "CSSValueKeywords.gperf"
+      {"below", CSSValueBelow},
+#line 286 "CSSValueKeywords.gperf"
+      {"text", CSSValueText},
+#line 605 "CSSValueKeywords.gperf"
+      {"bevel", CSSValueBevel},
+#line 214 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-om-et", CSSValueEthiopicHalehameOmEt},
 #line 276 "CSSValueKeywords.gperf"
-      {"pre-line", CSSValuePreLine},
-#line 424 "CSSValueKeywords.gperf"
-      {"darkgreen", CSSValueDarkgreen},
-#line 434 "CSSValueKeywords.gperf"
-      {"darkslateblue", CSSValueDarkslateblue},
-#line 269 "CSSValueKeywords.gperf"
-      {"no-open-quote", CSSValueNoOpenQuote},
-#line 433 "CSSValueKeywords.gperf"
-      {"darkseagreen", CSSValueDarkseagreen},
-#line 429 "CSSValueKeywords.gperf"
-      {"darkorange", CSSValueDarkorange},
-#line 548 "CSSValueKeywords.gperf"
-      {"alphabetic", CSSValueAlphabetic},
-#line 265 "CSSValueKeywords.gperf"
-      {"lower", CSSValueLower},
-#line 387 "CSSValueKeywords.gperf"
-      {"ease-out", CSSValueEaseOut},
-#line 552 "CSSValueKeywords.gperf"
-      {"no-change", CSSValueNoChange},
-#line 287 "CSSValueKeywords.gperf"
-      {"stretch", CSSValueStretch},
-#line 196 "CSSValueKeywords.gperf"
-      {"table-column", CSSValueTableColumn},
-#line 240 "CSSValueKeywords.gperf"
-      {"lowercase", CSSValueLowercase},
-#line 428 "CSSValueKeywords.gperf"
-      {"darkolivegreen", CSSValueDarkolivegreen},
-#line 521 "CSSValueKeywords.gperf"
-      {"springgreen", CSSValueSpringgreen},
+      {"se-resize", CSSValueSeResize},
+#line 556 "CSSValueKeywords.gperf"
+      {"mistyrose", CSSValueMistyrose},
+#line 218 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-so-et", CSSValueEthiopicHalehameSoEt},
+#line 432 "CSSValueKeywords.gperf"
+      {"content-box", CSSValueContentBox},
 #line 541 "CSSValueKeywords.gperf"
-      {"bevel", CSSValueBevel},
-#line 179 "CSSValueKeywords.gperf"
-      {"hiragana", CSSValueHiragana},
+      {"lightyellow", CSSValueLightyellow},
+#line 531 "CSSValueKeywords.gperf"
+      {"lightgray", CSSValueLightgray},
+#line 226 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-ti-et", CSSValueEthiopicHalehameTiEt},
 #line 533 "CSSValueKeywords.gperf"
-      {"accumulate", CSSValueAccumulate},
-#line 247 "CSSValueKeywords.gperf"
-      {"below", CSSValueBelow},
-#line 270 "CSSValueKeywords.gperf"
-      {"nowrap", CSSValueNowrap},
-#line 69 "CSSValueKeywords.gperf"
-      {"serif", CSSValueSerif},
-#line 447 "CSSValueKeywords.gperf"
-      {"gainsboro", CSSValueGainsboro},
-#line 224 "CSSValueKeywords.gperf"
-      {"ew-resize", CSSValueEwResize},
-#line 221 "CSSValueKeywords.gperf"
-      {"sw-resize", CSSValueSwResize},
-#line 135 "CSSValueKeywords.gperf"
-      {"source-out", CSSValueSourceOut},
-#line 406 "CSSValueKeywords.gperf"
-      {"beige", CSSValueBeige},
-#line 60 "CSSValueKeywords.gperf"
-      {"narrower", CSSValueNarrower},
-#line 218 "CSSValueKeywords.gperf"
-      {"nw-resize", CSSValueNwResize},
-#line 334 "CSSValueKeywords.gperf"
-      {"listbox", CSSValueListbox},
-#line 453 "CSSValueKeywords.gperf"
-      {"hotpink", CSSValueHotpink},
-#line 99 "CSSValueKeywords.gperf"
-      {"buttonface", CSSValueButtonface},
-#line 498 "CSSValueKeywords.gperf"
-      {"palegoldenrod", CSSValuePalegoldenrod},
-#line 536 "CSSValueKeywords.gperf"
-      {"linearrgb", CSSValueLinearrgb},
-#line 20 "CSSValueKeywords.gperf"
-      {"dashed", CSSValueDashed},
-#line 111 "CSSValueKeywords.gperf"
-      {"infotext", CSSValueInfotext},
-#line 112 "CSSValueKeywords.gperf"
-      {"match", CSSValueMatch},
-#line 322 "CSSValueKeywords.gperf"
-      {"break-all", CSSValueBreakAll},
-#line 250 "CSSValueKeywords.gperf"
-      {"both", CSSValueBoth},
-#line 413 "CSSValueKeywords.gperf"
-      {"chartreuse", CSSValueChartreuse},
-#line 510 "CSSValueKeywords.gperf"
-      {"saddlebrown", CSSValueSaddlebrown},
-#line 331 "CSSValueKeywords.gperf"
-      {"button-bevel", CSSValueButtonBevel},
-#line 426 "CSSValueKeywords.gperf"
-      {"darkkhaki", CSSValueDarkkhaki},
-#line 66 "CSSValueKeywords.gperf"
-      {"expanded", CSSValueExpanded},
-#line 232 "CSSValueKeywords.gperf"
-      {"help", CSSValueHelp},
-#line 444 "CSSValueKeywords.gperf"
-      {"firebrick", CSSValueFirebrick},
-#line 532 "CSSValueKeywords.gperf"
-      {"evenodd", CSSValueEvenodd},
-#line 142 "CSSValueKeywords.gperf"
-      {"plus-darker", CSSValuePlusDarker},
+      {"lightgrey", CSSValueLightgrey},
+#line 265 "CSSValueKeywords.gperf"
+      {"context-menu", CSSValueContextMenu},
 #line 273 "CSSValueKeywords.gperf"
-      {"overline", CSSValueOverline},
-#line 421 "CSSValueKeywords.gperf"
-      {"darkcyan", CSSValueDarkcyan},
-#line 293 "CSSValueKeywords.gperf"
-      {"inline-axis", CSSValueInlineAxis},
-#line 107 "CSSValueKeywords.gperf"
-      {"inactiveborder", CSSValueInactiveborder},
-#line 446 "CSSValueKeywords.gperf"
-      {"forestgreen", CSSValueForestgreen},
-#line 103 "CSSValueKeywords.gperf"
-      {"captiontext", CSSValueCaptiontext},
-#line 534 "CSSValueKeywords.gperf"
-      {"new", CSSValueNew},
-#line 79 "CSSValueKeywords.gperf"
-      {"gray", CSSValueGray},
-#line 194 "CSSValueKeywords.gperf"
+      {"ne-resize", CSSValueNeResize},
+#line 611 "CSSValueKeywords.gperf"
+      {"ideographic", CSSValueIdeographic},
+#line 478 "CSSValueKeywords.gperf"
+      {"chartreuse", CSSValueChartreuse},
+#line 522 "CSSValueKeywords.gperf"
+      {"khaki", CSSValueKhaki},
+#line 250 "CSSValueKeywords.gperf"
       {"table-row", CSSValueTableRow},
-#line 333 "CSSValueKeywords.gperf"
-      {"list-button", CSSValueListButton},
-#line 550 "CSSValueKeywords.gperf"
-      {"mathematical", CSSValueMathematical},
-#line 213 "CSSValueKeywords.gperf"
-      {"not-allowed", CSSValueNotAllowed},
-#line 443 "CSSValueKeywords.gperf"
-      {"dodgerblue", CSSValueDodgerblue},
-#line 491 "CSSValueKeywords.gperf"
-      {"mistyrose", CSSValueMistyrose},
-#line 174 "CSSValueKeywords.gperf"
-      {"upper-latin", CSSValueUpperLatin},
-#line 109 "CSSValueKeywords.gperf"
-      {"inactivecaptiontext", CSSValueInactivecaptiontext},
-#line 513 "CSSValueKeywords.gperf"
+#line 600 "CSSValueKeywords.gperf"
+      {"linearrgb", CSSValueLinearrgb},
+#line 538 "CSSValueKeywords.gperf"
+      {"lightslategray", CSSValueLightslategray},
+#line 539 "CSSValueKeywords.gperf"
+      {"lightslategrey", CSSValueLightslategrey},
+#line 525 "CSSValueKeywords.gperf"
+      {"lawngreen", CSSValueLawngreen},
+#line 587 "CSSValueKeywords.gperf"
+      {"steelblue", CSSValueSteelblue},
+#line 127 "CSSValueKeywords.gperf"
+      {"repeat", CSSValueRepeat},
+#line 546 "CSSValueKeywords.gperf"
+      {"mediumblue", CSSValueMediumblue},
+#line 578 "CSSValueKeywords.gperf"
       {"seagreen", CSSValueSeagreen},
-#line 356 "CSSValueKeywords.gperf"
-      {"slider-vertical", CSSValueSliderVertical},
-#line 54 "CSSValueKeywords.gperf"
-      {"x-large", CSSValueXLarge},
-#line 83 "CSSValueKeywords.gperf"
-      {"navy", CSSValueNavy},
-#line 64 "CSSValueKeywords.gperf"
-      {"semi-condensed", CSSValueSemiCondensed},
-#line 78 "CSSValueKeywords.gperf"
-      {"fuchsia", CSSValueFuchsia},
-#line 422 "CSSValueKeywords.gperf"
-      {"darkgoldenrod", CSSValueDarkgoldenrod},
-#line 297 "CSSValueKeywords.gperf"
-      {"forwards", CSSValueForwards},
-#line 514 "CSSValueKeywords.gperf"
-      {"seashell", CSSValueSeashell},
-#line 298 "CSSValueKeywords.gperf"
-      {"backwards", CSSValueBackwards},
-#line 119 "CSSValueKeywords.gperf"
-      {"threedshadow", CSSValueThreedshadow},
-#line 383 "CSSValueKeywords.gperf"
-      {"preserve-3d", CSSValuePreserve3d},
-#line 439 "CSSValueKeywords.gperf"
-      {"deeppink", CSSValueDeeppink},
-#line 500 "CSSValueKeywords.gperf"
+#line 336 "CSSValueKeywords.gperf"
+      {"separate", CSSValueSeparate},
+#line 565 "CSSValueKeywords.gperf"
       {"paleturquoise", CSSValuePaleturquoise},
-#line 204 "CSSValueKeywords.gperf"
-      {"default", CSSValueDefault},
+#line 485 "CSSValueKeywords.gperf"
+      {"darkblue", CSSValueDarkblue},
 #line 138 "CSSValueKeywords.gperf"
       {"destination-in", CSSValueDestinationIn},
-#line 408 "CSSValueKeywords.gperf"
-      {"blanchedalmond", CSSValueBlanchedalmond},
-#line 553 "CSSValueKeywords.gperf"
-      {"reset-size", CSSValueResetSize},
-#line 522 "CSSValueKeywords.gperf"
-      {"steelblue", CSSValueSteelblue},
-#line 70 "CSSValueKeywords.gperf"
-      {"sans-serif", CSSValueSansSerif},
-#line 343 "CSSValueKeywords.gperf"
-      {"media-slider", CSSValueMediaSlider},
-#line 230 "CSSValueKeywords.gperf"
-      {"text", CSSValueText},
-#line 95 "CSSValueKeywords.gperf"
-      {"activeborder", CSSValueActiveborder},
-#line 294 "CSSValueKeywords.gperf"
-      {"block-axis", CSSValueBlockAxis},
-#line 290 "CSSValueKeywords.gperf"
-      {"reverse", CSSValueReverse},
-#line 248 "CSSValueKeywords.gperf"
-      {"bidi-override", CSSValueBidiOverride},
-#line 102 "CSSValueKeywords.gperf"
-      {"buttontext", CSSValueButtontext},
-#line 140 "CSSValueKeywords.gperf"
-      {"destination-atop", CSSValueDestinationAtop},
-#line 481 "CSSValueKeywords.gperf"
-      {"mediumblue", CSSValueMediumblue},
-#line 488 "CSSValueKeywords.gperf"
-      {"mediumvioletred", CSSValueMediumvioletred},
-#line 456 "CSSValueKeywords.gperf"
-      {"ivory", CSSValueIvory},
-#line 388 "CSSValueKeywords.gperf"
-      {"ease-in-out", CSSValueEaseInOut},
+#line 476 "CSSValueKeywords.gperf"
+      {"burlywood", CSSValueBurlywood},
+#line 599 "CSSValueKeywords.gperf"
+      {"new", CSSValueNew},
+#line 550 "CSSValueKeywords.gperf"
+      {"mediumslateblue", CSSValueMediumslateblue},
+#line 196 "CSSValueKeywords.gperf"
+      {"upper-latin", CSSValueUpperLatin},
+#line 499 "CSSValueKeywords.gperf"
+      {"darkslateblue", CSSValueDarkslateblue},
 #line 549 "CSSValueKeywords.gperf"
-      {"hanging", CSSValueHanging},
-#line 372 "CSSValueKeywords.gperf"
-      {"content-box", CSSValueContentBox},
-#line 470 "CSSValueKeywords.gperf"
-      {"lightsalmon", CSSValueLightsalmon},
-#line 398 "CSSValueKeywords.gperf"
+      {"mediumseagreen", CSSValueMediumseagreen},
+#line 104 "CSSValueKeywords.gperf"
+      {"graytext", CSSValueGraytext},
+#line 458 "CSSValueKeywords.gperf"
       {"subpixel-antialiased", CSSValueSubpixelAntialiased},
-#line 411 "CSSValueKeywords.gperf"
-      {"burlywood", CSSValueBurlywood},
-#line 448 "CSSValueKeywords.gperf"
-      {"ghostwhite", CSSValueGhostwhite},
-#line 177 "CSSValueKeywords.gperf"
-      {"georgian", CSSValueGeorgian},
-#line 430 "CSSValueKeywords.gperf"
-      {"darkorchid", CSSValueDarkorchid},
-#line 245 "CSSValueKeywords.gperf"
-      {"always", CSSValueAlways},
+#line 489 "CSSValueKeywords.gperf"
+      {"darkgreen", CSSValueDarkgreen},
+#line 140 "CSSValueKeywords.gperf"
+      {"destination-atop", CSSValueDestinationAtop},
+#line 494 "CSSValueKeywords.gperf"
+      {"darkorange", CSSValueDarkorange},
+#line 195 "CSSValueKeywords.gperf"
+      {"upper-alpha", CSSValueUpperAlpha},
+#line 498 "CSSValueKeywords.gperf"
+      {"darkseagreen", CSSValueDarkseagreen},
+#line 377 "CSSValueKeywords.gperf"
+      {"skip-white-space", CSSValueSkipWhiteSpace},
 #line 169 "CSSValueKeywords.gperf"
-      {"upper-roman", CSSValueUpperRoman},
-#line 172 "CSSValueKeywords.gperf"
-      {"lower-latin", CSSValueLowerLatin},
+      {"binary", CSSValueBinary},
+#line 521 "CSSValueKeywords.gperf"
+      {"ivory", CSSValueIvory},
 #line 460 "CSSValueKeywords.gperf"
-      {"lawngreen", CSSValueLawngreen},
-#line 49 "CSSValueKeywords.gperf"
-      {"xx-small", CSSValueXxSmall},
-#line 485 "CSSValueKeywords.gperf"
-      {"mediumslateblue", CSSValueMediumslateblue},
-#line 271 "CSSValueKeywords.gperf"
-      {"open-quote", CSSValueOpenQuote},
-#line 484 "CSSValueKeywords.gperf"
-      {"mediumseagreen", CSSValueMediumseagreen},
-#line 326 "CSSValueKeywords.gperf"
-      {"checkbox", CSSValueCheckbox},
-#line 157 "CSSValueKeywords.gperf"
-      {"justify", CSSValueJustify},
-#line 227 "CSSValueKeywords.gperf"
-      {"nwse-resize", CSSValueNwseResize},
-#line 255 "CSSValueKeywords.gperf"
-      {"fixed", CSSValueFixed},
+      {"optimizelegibility", CSSValueOptimizelegibility},
+#line 69 "CSSValueKeywords.gperf"
+      {"serif", CSSValueSerif},
+#line 60 "CSSValueKeywords.gperf"
+      {"narrower", CSSValueNarrower},
+#line 575 "CSSValueKeywords.gperf"
+      {"saddlebrown", CSSValueSaddlebrown},
+#line 209 "CSSValueKeywords.gperf"
+      {"ethiopic-abegede-gez", CSSValueEthiopicAbegedeGez},
 #line 72 "CSSValueKeywords.gperf"
       {"fantasy", CSSValueFantasy},
-#line 437 "CSSValueKeywords.gperf"
-      {"darkturquoise", CSSValueDarkturquoise},
-#line 469 "CSSValueKeywords.gperf"
-      {"lightpink", CSSValueLightpink},
-#line 277 "CSSValueKeywords.gperf"
-      {"pre-wrap", CSSValuePreWrap},
-#line 125 "CSSValueKeywords.gperf"
-      {"grey", CSSValueGrey},
-#line 483 "CSSValueKeywords.gperf"
-      {"mediumpurple", CSSValueMediumpurple},
-#line 519 "CSSValueKeywords.gperf"
-      {"slategrey", CSSValueSlategrey},
-#line 329 "CSSValueKeywords.gperf"
-      {"square-button", CSSValueSquareButton},
-#line 518 "CSSValueKeywords.gperf"
-      {"slategray", CSSValueSlategray},
-#line 442 "CSSValueKeywords.gperf"
-      {"dimgrey", CSSValueDimgrey},
-#line 137 "CSSValueKeywords.gperf"
-      {"destination-over", CSSValueDestinationOver},
-#line 441 "CSSValueKeywords.gperf"
-      {"dimgray", CSSValueDimgray},
-#line 209 "CSSValueKeywords.gperf"
-      {"context-menu", CSSValueContextMenu},
-#line 401 "CSSValueKeywords.gperf"
-      {"geometricprecision", CSSValueGeometricprecision},
-#line 91 "CSSValueKeywords.gperf"
-      {"yellow", CSSValueYellow},
-#line 317 "CSSValueKeywords.gperf"
-      {"dot-dash", CSSValueDotDash},
-#line 489 "CSSValueKeywords.gperf"
-      {"midnightblue", CSSValueMidnightblue},
-#line 155 "CSSValueKeywords.gperf"
-      {"right", CSSValueRight},
-#line 98 "CSSValueKeywords.gperf"
-      {"background", CSSValueBackground},
-#line 39 "CSSValueKeywords.gperf"
-      {"lighter", CSSValueLighter},
-#line 366 "CSSValueKeywords.gperf"
-      {"textarea", CSSValueTextarea},
-#line 226 "CSSValueKeywords.gperf"
-      {"nesw-resize", CSSValueNeswResize},
-#line 480 "CSSValueKeywords.gperf"
-      {"mediumaquamarine", CSSValueMediumaquamarine},
-#line 110 "CSSValueKeywords.gperf"
-      {"infobackground", CSSValueInfobackground},
-#line 113 "CSSValueKeywords.gperf"
-      {"menutext", CSSValueMenutext},
-#line 551 "CSSValueKeywords.gperf"
-      {"use-script", CSSValueUseScript},
+#line 414 "CSSValueKeywords.gperf"
+      {"progress-bar", CSSValueProgressBar},
 #line 493 "CSSValueKeywords.gperf"
-      {"navajowhite", CSSValueNavajowhite},
-#line 61 "CSSValueKeywords.gperf"
-      {"ultra-condensed", CSSValueUltraCondensed},
-#line 463 "CSSValueKeywords.gperf"
-      {"lightcoral", CSSValueLightcoral},
-#line 143 "CSSValueKeywords.gperf"
-      {"plus-lighter", CSSValuePlusLighter},
-#line 367 "CSSValueKeywords.gperf"
-      {"caps-lock-indicator", CSSValueCapsLockIndicator},
-#line 168 "CSSValueKeywords.gperf"
-      {"lower-roman", CSSValueLowerRoman},
+      {"darkolivegreen", CSSValueDarkolivegreen},
+#line 31 "CSSValueKeywords.gperf"
+      {"status-bar", CSSValueStatusBar},
+#line 506 "CSSValueKeywords.gperf"
+      {"dimgray", CSSValueDimgray},
 #line 507 "CSSValueKeywords.gperf"
-      {"powderblue", CSSValuePowderblue},
-#line 101 "CSSValueKeywords.gperf"
-      {"buttonshadow", CSSValueButtonshadow},
+      {"dimgrey", CSSValueDimgrey},
+#line 567 "CSSValueKeywords.gperf"
+      {"papayawhip", CSSValuePapayawhip},
+#line 453 "CSSValueKeywords.gperf"
+      {"visiblestroke", CSSValueVisiblestroke},
+#line 374 "CSSValueKeywords.gperf"
+      {"dot-dot-dash", CSSValueDotDotDash},
+#line 236 "CSSValueKeywords.gperf"
+      {"katakana", CSSValueKatakana},
+#line 194 "CSSValueKeywords.gperf"
+      {"lower-latin", CSSValueLowerLatin},
+#line 216 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-sid-et", CSSValueEthiopicHalehameSidEt},
+#line 283 "CSSValueKeywords.gperf"
+      {"nwse-resize", CSSValueNwseResize},
+#line 193 "CSSValueKeywords.gperf"
+      {"lower-alpha", CSSValueLowerAlpha},
 #line 139 "CSSValueKeywords.gperf"
       {"destination-out", CSSValueDestinationOut},
-#line 543 "CSSValueKeywords.gperf"
-      {"after-edge", CSSValueAfterEdge},
-#line 425 "CSSValueKeywords.gperf"
-      {"darkgrey", CSSValueDarkgrey},
-#line 423 "CSSValueKeywords.gperf"
-      {"darkgray", CSSValueDarkgray},
-#line 416 "CSSValueKeywords.gperf"
-      {"cornflowerblue", CSSValueCornflowerblue},
-#line 328 "CSSValueKeywords.gperf"
-      {"push-button", CSSValuePushButton},
-#line 31 "CSSValueKeywords.gperf"
-      {"status-bar", CSSValueStatusBar},
-#line 229 "CSSValueKeywords.gperf"
-      {"row-resize", CSSValueRowResize},
-#line 121 "CSSValueKeywords.gperf"
-      {"windowframe", CSSValueWindowframe},
-#line 175 "CSSValueKeywords.gperf"
+#line 231 "CSSValueKeywords.gperf"
       {"hebrew", CSSValueHebrew},
-#line 122 "CSSValueKeywords.gperf"
-      {"windowtext", CSSValueWindowtext},
-#line 436 "CSSValueKeywords.gperf"
-      {"darkslategrey", CSSValueDarkslategrey},
-#line 435 "CSSValueKeywords.gperf"
-      {"darkslategray", CSSValueDarkslategray},
-#line 547 "CSSValueKeywords.gperf"
-      {"ideographic", CSSValueIdeographic},
-#line 207 "CSSValueKeywords.gperf"
-      {"vertical-text", CSSValueVerticalText},
-#line 173 "CSSValueKeywords.gperf"
-      {"upper-alpha", CSSValueUpperAlpha},
-#line 403 "CSSValueKeywords.gperf"
-      {"antiquewhite", CSSValueAntiquewhite},
-#line 115 "CSSValueKeywords.gperf"
-      {"threeddarkshadow", CSSValueThreeddarkshadow},
-#line 537 "CSSValueKeywords.gperf"
+#line 617 "CSSValueKeywords.gperf"
+      {"reset-size", CSSValueResetSize},
+#line 597 "CSSValueKeywords.gperf"
+      {"evenodd", CSSValueEvenodd},
+#line 107 "CSSValueKeywords.gperf"
+      {"inactiveborder", CSSValueInactiveborder},
+#line 157 "CSSValueKeywords.gperf"
+      {"justify", CSSValueJustify},
+#line 385 "CSSValueKeywords.gperf"
+      {"square-button", CSSValueSquareButton},
+#line 329 "CSSValueKeywords.gperf"
+      {"overline", CSSValueOverline},
+#line 389 "CSSValueKeywords.gperf"
+      {"inner-spin-button", CSSValueInnerSpinButton},
+#line 486 "CSSValueKeywords.gperf"
+      {"darkcyan", CSSValueDarkcyan},
+#line 113 "CSSValueKeywords.gperf"
+      {"menutext", CSSValueMenutext},
+#line 225 "CSSValueKeywords.gperf"
+      {"tigrinya-et", CSSValueTigrinyaEt},
+#line 64 "CSSValueKeywords.gperf"
+      {"semi-condensed", CSSValueSemiCondensed},
+#line 496 "CSSValueKeywords.gperf"
+      {"darkred", CSSValueDarkred},
+#line 601 "CSSValueKeywords.gperf"
       {"optimizequality", CSSValueOptimizequality},
+#line 203 "CSSValueKeywords.gperf"
+      {"ethiopic-abegede-am-et", CSSValueEthiopicAbegedeAmEt},
 #line 148 "CSSValueKeywords.gperf"
       {"text-top", CSSValueTextTop},
-#line 445 "CSSValueKeywords.gperf"
+#line 510 "CSSValueKeywords.gperf"
       {"floralwhite", CSSValueFloralwhite},
-#line 178 "CSSValueKeywords.gperf"
-      {"cjk-ideographic", CSSValueCjkIdeographic},
-#line 370 "CSSValueKeywords.gperf"
-      {"border-box", CSSValueBorderBox},
-#line 452 "CSSValueKeywords.gperf"
-      {"honeydew", CSSValueHoneydew},
-#line 272 "CSSValueKeywords.gperf"
-      {"overlay", CSSValueOverlay},
-#line 323 "CSSValueKeywords.gperf"
-      {"break-word", CSSValueBreakWord},
-#line 462 "CSSValueKeywords.gperf"
-      {"lightblue", CSSValueLightblue},
-#line 512 "CSSValueKeywords.gperf"
-      {"sandybrown", CSSValueSandybrown},
-#line 508 "CSSValueKeywords.gperf"
-      {"rosybrown", CSSValueRosybrown},
-#line 451 "CSSValueKeywords.gperf"
-      {"greenyellow", CSSValueGreenyellow},
-#line 400 "CSSValueKeywords.gperf"
-      {"optimizelegibility", CSSValueOptimizelegibility},
-#line 374 "CSSValueKeywords.gperf"
+#line 70 "CSSValueKeywords.gperf"
+      {"sans-serif", CSSValueSansSerif},
+#line 434 "CSSValueKeywords.gperf"
       {"padding-box", CSSValuePaddingBox},
-#line 182 "CSSValueKeywords.gperf"
-      {"katakana-iroha", CSSValueKatakanaIroha},
-#line 321 "CSSValueKeywords.gperf"
-      {"skip-white-space", CSSValueSkipWhiteSpace},
-#line 482 "CSSValueKeywords.gperf"
-      {"mediumorchid", CSSValueMediumorchid},
-#line 475 "CSSValueKeywords.gperf"
-      {"lightsteelblue", CSSValueLightsteelblue},
-#line 467 "CSSValueKeywords.gperf"
-      {"lightgreen", CSSValueLightgreen},
-#line 65 "CSSValueKeywords.gperf"
-      {"semi-expanded", CSSValueSemiExpanded},
-#line 471 "CSSValueKeywords.gperf"
-      {"lightseagreen", CSSValueLightseagreen},
-#line 352 "CSSValueKeywords.gperf"
-      {"menulist-button", CSSValueMenulistButton},
-#line 355 "CSSValueKeywords.gperf"
-      {"slider-horizontal", CSSValueSliderHorizontal},
-#line 128 "CSSValueKeywords.gperf"
-      {"repeat-x", CSSValueRepeatX},
-#line 170 "CSSValueKeywords.gperf"
-      {"lower-greek", CSSValueLowerGreek},
-#line 487 "CSSValueKeywords.gperf"
-      {"mediumturquoise", CSSValueMediumturquoise},
-#line 171 "CSSValueKeywords.gperf"
-      {"lower-alpha", CSSValueLowerAlpha},
 #line 55 "CSSValueKeywords.gperf"
       {"xx-large", CSSValueXxLarge},
-#line 104 "CSSValueKeywords.gperf"
-      {"graytext", CSSValueGraytext},
-#line 129 "CSSValueKeywords.gperf"
-      {"repeat-y", CSSValueRepeatY},
-#line 502 "CSSValueKeywords.gperf"
-      {"papayawhip", CSSValuePapayawhip},
-#line 365 "CSSValueKeywords.gperf"
-      {"textfield", CSSValueTextfield},
+#line 553 "CSSValueKeywords.gperf"
+      {"mediumvioletred", CSSValueMediumvioletred},
+#line 228 "CSSValueKeywords.gperf"
+      {"ethiopic-abegede-ti-et", CSSValueEthiopicAbegedeTiEt},
+#line 91 "CSSValueKeywords.gperf"
+      {"yellow", CSSValueYellow},
+#line 327 "CSSValueKeywords.gperf"
+      {"open-quote", CSSValueOpenQuote},
+#line 61 "CSSValueKeywords.gperf"
+      {"ultra-condensed", CSSValueUltraCondensed},
+#line 547 "CSSValueKeywords.gperf"
+      {"mediumorchid", CSSValueMediumorchid},
+#line 524 "CSSValueKeywords.gperf"
+      {"lavenderblush", CSSValueLavenderblush},
+#line 199 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-aa-er", CSSValueEthiopicHalehameAaEr},
+#line 495 "CSSValueKeywords.gperf"
+      {"darkorchid", CSSValueDarkorchid},
+#line 410 "CSSValueKeywords.gperf"
+      {"menulist-button", CSSValueMenulistButton},
+#line 401 "CSSValueKeywords.gperf"
+      {"media-slider", CSSValueMediaSlider},
+#line 234 "CSSValueKeywords.gperf"
+      {"cjk-ideographic", CSSValueCjkIdeographic},
+#line 426 "CSSValueKeywords.gperf"
+      {"textarea", CSSValueTextarea},
+#line 381 "CSSValueKeywords.gperf"
+      {"after-white-space", CSSValueAfterWhiteSpace},
+#line 110 "CSSValueKeywords.gperf"
+      {"infobackground", CSSValueInfobackground},
+#line 416 "CSSValueKeywords.gperf"
+      {"slider-vertical", CSSValueSliderVertical},
+#line 222 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-ti-er", CSSValueEthiopicHalehameTiEr},
+#line 95 "CSSValueKeywords.gperf"
+      {"activeborder", CSSValueActiveborder},
+#line 516 "CSSValueKeywords.gperf"
+      {"greenyellow", CSSValueGreenyellow},
+#line 443 "CSSValueKeywords.gperf"
+      {"preserve-3d", CSSValuePreserve3d},
+#line 548 "CSSValueKeywords.gperf"
+      {"mediumpurple", CSSValueMediumpurple},
+#line 263 "CSSValueKeywords.gperf"
+      {"vertical-text", CSSValueVerticalText},
+#line 311 "CSSValueKeywords.gperf"
+      {"fixed", CSSValueFixed},
+#line 378 "CSSValueKeywords.gperf"
+      {"break-all", CSSValueBreakAll},
+#line 615 "CSSValueKeywords.gperf"
+      {"use-script", CSSValueUseScript},
+#line 413 "CSSValueKeywords.gperf"
+      {"outer-spin-button", CSSValueOuterSpinButton},
+#line 173 "CSSValueKeywords.gperf"
+      {"devanagari", CSSValueDevanagari},
 #line 149 "CSSValueKeywords.gperf"
       {"text-bottom", CSSValueTextBottom},
-#line 542 "CSSValueKeywords.gperf"
+#line 137 "CSSValueKeywords.gperf"
+      {"destination-over", CSSValueDestinationOver},
+#line 191 "CSSValueKeywords.gperf"
+      {"upper-roman", CSSValueUpperRoman},
+#line 205 "CSSValueKeywords.gperf"
+      {"cjk-heavenly-stem", CSSValueCjkHeavenlyStem},
+#line 350 "CSSValueKeywords.gperf"
+      {"block-axis", CSSValueBlockAxis},
+#line 353 "CSSValueKeywords.gperf"
+      {"forwards", CSSValueForwards},
+#line 251 "CSSValueKeywords.gperf"
+      {"table-column-group", CSSValueTableColumnGroup},
+#line 606 "CSSValueKeywords.gperf"
       {"before-edge", CSSValueBeforeEdge},
-#line 62 "CSSValueKeywords.gperf"
-      {"extra-condensed", CSSValueExtraCondensed},
-#line 459 "CSSValueKeywords.gperf"
-      {"lavenderblush", CSSValueLavenderblush},
-#line 346 "CSSValueKeywords.gperf"
-      {"media-volume-slider", CSSValueMediaVolumeSlider},
+#line 415 "CSSValueKeywords.gperf"
+      {"slider-horizontal", CSSValueSliderHorizontal},
+#line 537 "CSSValueKeywords.gperf"
+      {"lightskyblue", CSSValueLightskyblue},
 #line 26 "CSSValueKeywords.gperf"
       {"message-box", CSSValueMessageBox},
-#line 353 "CSSValueKeywords.gperf"
+#line 545 "CSSValueKeywords.gperf"
+      {"mediumaquamarine", CSSValueMediumaquamarine},
+#line 304 "CSSValueKeywords.gperf"
+      {"bidi-override", CSSValueBidiOverride},
+#line 572 "CSSValueKeywords.gperf"
+      {"powderblue", CSSValuePowderblue},
+#line 388 "CSSValueKeywords.gperf"
+      {"default-button", CSSValueDefaultButton},
+#line 487 "CSSValueKeywords.gperf"
+      {"darkgoldenrod", CSSValueDarkgoldenrod},
+#line 97 "CSSValueKeywords.gperf"
+      {"appworkspace", CSSValueAppworkspace},
+#line 190 "CSSValueKeywords.gperf"
+      {"lower-roman", CSSValueLowerRoman},
+#line 122 "CSSValueKeywords.gperf"
+      {"windowtext", CSSValueWindowtext},
+#line 411 "CSSValueKeywords.gperf"
       {"menulist-text", CSSValueMenulistText},
-#line 486 "CSSValueKeywords.gperf"
+#line 461 "CSSValueKeywords.gperf"
+      {"geometricprecision", CSSValueGeometricprecision},
+#line 333 "CSSValueKeywords.gperf"
+      {"pre-wrap", CSSValuePreWrap},
+#line 394 "CSSValueKeywords.gperf"
+      {"media-mute-button", CSSValueMediaMuteButton},
+#line 346 "CSSValueKeywords.gperf"
+      {"reverse", CSSValueReverse},
+#line 488 "CSSValueKeywords.gperf"
+      {"darkgray", CSSValueDarkgray},
+#line 490 "CSSValueKeywords.gperf"
+      {"darkgrey", CSSValueDarkgrey},
+#line 282 "CSSValueKeywords.gperf"
+      {"nesw-resize", CSSValueNeswResize},
+#line 551 "CSSValueKeywords.gperf"
       {"mediumspringgreen", CSSValueMediumspringgreen},
-#line 464 "CSSValueKeywords.gperf"
-      {"lightcyan", CSSValueLightcyan},
-#line 308 "CSSValueKeywords.gperf"
-      {"read-write", CSSValueReadWrite},
-#line 258 "CSSValueKeywords.gperf"
-      {"higher", CSSValueHigher},
-#line 530 "CSSValueKeywords.gperf"
+#line 142 "CSSValueKeywords.gperf"
+      {"plus-darker", CSSValuePlusDarker},
+#line 500 "CSSValueKeywords.gperf"
+      {"darkslategray", CSSValueDarkslategray},
+#line 501 "CSSValueKeywords.gperf"
+      {"darkslategrey", CSSValueDarkslategrey},
+#line 285 "CSSValueKeywords.gperf"
+      {"row-resize", CSSValueRowResize},
+#line 577 "CSSValueKeywords.gperf"
+      {"sandybrown", CSSValueSandybrown},
+#line 221 "CSSValueKeywords.gperf"
+      {"tigrinya-er", CSSValueTigrinyaEr},
+#line 62 "CSSValueKeywords.gperf"
+      {"extra-condensed", CSSValueExtraCondensed},
+#line 98 "CSSValueKeywords.gperf"
+      {"background", CSSValueBackground},
+#line 430 "CSSValueKeywords.gperf"
+      {"border-box", CSSValueBorderBox},
+#line 552 "CSSValueKeywords.gperf"
+      {"mediumturquoise", CSSValueMediumturquoise},
+#line 502 "CSSValueKeywords.gperf"
+      {"darkturquoise", CSSValueDarkturquoise},
+#line 115 "CSSValueKeywords.gperf"
+      {"threeddarkshadow", CSSValueThreeddarkshadow},
+#line 224 "CSSValueKeywords.gperf"
+      {"ethiopic-abegede-ti-er", CSSValueEthiopicAbegedeTiEr},
+#line 573 "CSSValueKeywords.gperf"
+      {"rosybrown", CSSValueRosybrown},
+#line 328 "CSSValueKeywords.gperf"
+      {"overlay", CSSValueOverlay},
+#line 491 "CSSValueKeywords.gperf"
+      {"darkkhaki", CSSValueDarkkhaki},
+#line 481 "CSSValueKeywords.gperf"
+      {"cornflowerblue", CSSValueCornflowerblue},
+#line 402 "CSSValueKeywords.gperf"
+      {"media-sliderthumb", CSSValueMediaSliderthumb},
+#line 418 "CSSValueKeywords.gperf"
+      {"sliderthumb-vertical", CSSValueSliderthumbVertical},
+#line 595 "CSSValueKeywords.gperf"
       {"yellowgreen", CSSValueYellowgreen},
-#line 318 "CSSValueKeywords.gperf"
-      {"dot-dot-dash", CSSValueDotDotDash},
-#line 461 "CSSValueKeywords.gperf"
-      {"lemonchiffon", CSSValueLemonchiffon},
-#line 307 "CSSValueKeywords.gperf"
-      {"read-only", CSSValueReadOnly},
-#line 360 "CSSValueKeywords.gperf"
-      {"searchfield", CSSValueSearchfield},
-#line 181 "CSSValueKeywords.gperf"
-      {"hiragana-iroha", CSSValueHiraganaIroha},
-#line 195 "CSSValueKeywords.gperf"
-      {"table-column-group", CSSValueTableColumnGroup},
-#line 118 "CSSValueKeywords.gperf"
-      {"threedlightshadow", CSSValueThreedlightshadow},
-#line 201 "CSSValueKeywords.gperf"
+#line 354 "CSSValueKeywords.gperf"
+      {"backwards", CSSValueBackwards},
+#line 248 "CSSValueKeywords.gperf"
+      {"table-header-group", CSSValueTableHeaderGroup},
+#line 129 "CSSValueKeywords.gperf"
+      {"repeat-y", CSSValueRepeatY},
+#line 509 "CSSValueKeywords.gperf"
+      {"firebrick", CSSValueFirebrick},
+#line 382 "CSSValueKeywords.gperf"
+      {"checkbox", CSSValueCheckbox},
+#line 404 "CSSValueKeywords.gperf"
+      {"media-volume-slider", CSSValueMediaVolumeSlider},
+#line 230 "CSSValueKeywords.gperf"
+      {"upper-norwegian", CSSValueUpperNorwegian},
+#line 530 "CSSValueKeywords.gperf"
+      {"lightgoldenrodyellow", CSSValueLightgoldenrodyellow},
+#line 65 "CSSValueKeywords.gperf"
+      {"semi-expanded", CSSValueSemiExpanded},
+#line 417 "CSSValueKeywords.gperf"
+      {"sliderthumb-horizontal", CSSValueSliderthumbHorizontal},
+#line 425 "CSSValueKeywords.gperf"
+      {"textfield", CSSValueTextfield},
+#line 238 "CSSValueKeywords.gperf"
+      {"katakana-iroha", CSSValueKatakanaIroha},
+#line 128 "CSSValueKeywords.gperf"
+      {"repeat-x", CSSValueRepeatX},
+#line 227 "CSSValueKeywords.gperf"
+      {"tigrinya-et-abegede", CSSValueTigrinyaEtAbegede},
+#line 257 "CSSValueKeywords.gperf"
       {"-wap-marquee", CSSValueWapMarquee},
-#line 337 "CSSValueKeywords.gperf"
-      {"media-mute-button", CSSValueMediaMuteButton},
+#line 189 "CSSValueKeywords.gperf"
+      {"upper-hexadecimal", CSSValueUpperHexadecimal},
 #line 68 "CSSValueKeywords.gperf"
       {"ultra-expanded", CSSValueUltraExpanded},
-#line 332 "CSSValueKeywords.gperf"
-      {"default-button", CSSValueDefaultButton},
-#line 93 "CSSValueKeywords.gperf"
-      {"-webkit-link", CSSValueWebkitLink},
-#line 167 "CSSValueKeywords.gperf"
-      {"decimal-leading-zero", CSSValueDecimalLeadingZero},
-#line 358 "CSSValueKeywords.gperf"
-      {"sliderthumb-vertical", CSSValueSliderthumbVertical},
-#line 94 "CSSValueKeywords.gperf"
-      {"-webkit-activelink", CSSValueWebkitActivelink},
-#line 476 "CSSValueKeywords.gperf"
-      {"lightyellow", CSSValueLightyellow},
-#line 440 "CSSValueKeywords.gperf"
-      {"deepskyblue", CSSValueDeepskyblue},
-#line 191 "CSSValueKeywords.gperf"
+#line 229 "CSSValueKeywords.gperf"
+      {"upper-greek", CSSValueUpperGreek},
+#line 247 "CSSValueKeywords.gperf"
       {"table-row-group", CSSValueTableRowGroup},
-#line 344 "CSSValueKeywords.gperf"
-      {"media-sliderthumb", CSSValueMediaSliderthumb},
-#line 160 "CSSValueKeywords.gperf"
-      {"-webkit-center", CSSValueWebkitCenter},
-#line 339 "CSSValueKeywords.gperf"
-      {"media-seek-back-button", CSSValueMediaSeekBackButton},
-#line 30 "CSSValueKeywords.gperf"
-      {"-webkit-control", CSSValueWebkitControl},
-#line 262 "CSSValueKeywords.gperf"
-      {"line-through", CSSValueLineThrough},
-#line 153 "CSSValueKeywords.gperf"
-      {"-webkit-auto", CSSValueWebkitAuto},
-#line 468 "CSSValueKeywords.gperf"
-      {"lightgrey", CSSValueLightgrey},
-#line 466 "CSSValueKeywords.gperf"
-      {"lightgray", CSSValueLightgray},
-#line 325 "CSSValueKeywords.gperf"
-      {"after-white-space", CSSValueAfterWhiteSpace},
-#line 472 "CSSValueKeywords.gperf"
-      {"lightskyblue", CSSValueLightskyblue},
-#line 503 "CSSValueKeywords.gperf"
-      {"peachpuff", CSSValuePeachpuff},
-#line 338 "CSSValueKeywords.gperf"
+#line 526 "CSSValueKeywords.gperf"
+      {"lemonchiffon", CSSValueLemonchiffon},
+#line 212 "CSSValueKeywords.gperf"
+      {"lower-norwegian", CSSValueLowerNorwegian},
+#line 420 "CSSValueKeywords.gperf"
+      {"searchfield", CSSValueSearchfield},
+#line 395 "CSSValueKeywords.gperf"
       {"media-play-button", CSSValueMediaPlayButton},
-#line 341 "CSSValueKeywords.gperf"
-      {"media-rewind-button", CSSValueMediaRewindButton},
-#line 117 "CSSValueKeywords.gperf"
-      {"threedhighlight", CSSValueThreedhighlight},
+#line 427 "CSSValueKeywords.gperf"
+      {"caps-lock-indicator", CSSValueCapsLockIndicator},
+#line 504 "CSSValueKeywords.gperf"
+      {"deeppink", CSSValueDeeppink},
+#line 121 "CSSValueKeywords.gperf"
+      {"windowframe", CSSValueWindowframe},
+#line 177 "CSSValueKeywords.gperf"
+      {"lower-hexadecimal", CSSValueLowerHexadecimal},
+#line 192 "CSSValueKeywords.gperf"
+      {"lower-greek", CSSValueLowerGreek},
+#line 363 "CSSValueKeywords.gperf"
+      {"read-only", CSSValueReadOnly},
+#line 167 "CSSValueKeywords.gperf"
+      {"decimal-leading-zero", CSSValueDecimalLeadingZero},
+#line 405 "CSSValueKeywords.gperf"
+      {"media-volume-sliderthumb", CSSValueMediaVolumeSliderthumb},
+#line 364 "CSSValueKeywords.gperf"
+      {"read-write", CSSValueReadWrite},
 #line 67 "CSSValueKeywords.gperf"
       {"extra-expanded", CSSValueExtraExpanded},
-#line 474 "CSSValueKeywords.gperf"
-      {"lightslategrey", CSSValueLightslategrey},
-#line 473 "CSSValueKeywords.gperf"
-      {"lightslategray", CSSValueLightslategray},
-#line 214 "CSSValueKeywords.gperf"
-      {"-webkit-zoom-in", CSSValueWebkitZoomIn},
-#line 193 "CSSValueKeywords.gperf"
+#line 249 "CSSValueKeywords.gperf"
       {"table-footer-group", CSSValueTableFooterGroup},
-#line 354 "CSSValueKeywords.gperf"
+#line 223 "CSSValueKeywords.gperf"
+      {"tigrinya-er-abegede", CSSValueTigrinyaErAbegede},
+#line 568 "CSSValueKeywords.gperf"
+      {"peachpuff", CSSValuePeachpuff},
+#line 379 "CSSValueKeywords.gperf"
+      {"break-word", CSSValueBreakWord},
+#line 398 "CSSValueKeywords.gperf"
+      {"media-rewind-button", CSSValueMediaRewindButton},
+#line 400 "CSSValueKeywords.gperf"
+      {"media-toggle-closed-captions-button", CSSValueMediaToggleClosedCaptionsButton},
+#line 204 "CSSValueKeywords.gperf"
+      {"cjk-earthly-branch", CSSValueCjkEarthlyBranch},
+#line 153 "CSSValueKeywords.gperf"
+      {"-webkit-auto", CSSValueWebkitAuto},
+#line 412 "CSSValueKeywords.gperf"
       {"menulist-textfield", CSSValueMenulistTextfield},
+#line 408 "CSSValueKeywords.gperf"
+      {"media-time-remaining-display", CSSValueMediaTimeRemainingDisplay},
+#line 403 "CSSValueKeywords.gperf"
+      {"media-volume-slider-container", CSSValueMediaVolumeSliderContainer},
+#line 270 "CSSValueKeywords.gperf"
+      {"-webkit-zoom-in", CSSValueWebkitZoomIn},
+#line 159 "CSSValueKeywords.gperf"
+      {"-webkit-right", CSSValueWebkitRight},
+#line 160 "CSSValueKeywords.gperf"
+      {"-webkit-center", CSSValueWebkitCenter},
+#line 393 "CSSValueKeywords.gperf"
+      {"media-fullscreen-button", CSSValueMediaFullscreenButton},
+#line 610 "CSSValueKeywords.gperf"
+      {"text-after-edge", CSSValueTextAfterEdge},
+#line 30 "CSSValueKeywords.gperf"
+      {"-webkit-control", CSSValueWebkitControl},
+#line 505 "CSSValueKeywords.gperf"
+      {"deepskyblue", CSSValueDeepskyblue},
+#line 290 "CSSValueKeywords.gperf"
+      {"-webkit-grab", CSSValueWebkitGrab},
+#line 93 "CSSValueKeywords.gperf"
+      {"-webkit-link", CSSValueWebkitLink},
+#line 271 "CSSValueKeywords.gperf"
+      {"-webkit-zoom-out", CSSValueWebkitZoomOut},
+#line 396 "CSSValueKeywords.gperf"
+      {"media-seek-back-button", CSSValueMediaSeekBackButton},
+#line 126 "CSSValueKeywords.gperf"
+      {"-webkit-text", CSSValueWebkitText},
+#line 94 "CSSValueKeywords.gperf"
+      {"-webkit-activelink", CSSValueWebkitActivelink},
+#line 609 "CSSValueKeywords.gperf"
+      {"text-before-edge", CSSValueTextBeforeEdge},
+#line 421 "CSSValueKeywords.gperf"
+      {"searchfield-decoration", CSSValueSearchfieldDecoration},
 #line 158 "CSSValueKeywords.gperf"
       {"-webkit-left", CSSValueWebkitLeft},
-#line 345 "CSSValueKeywords.gperf"
-      {"media-volume-slider-container", CSSValueMediaVolumeSliderContainer},
-#line 105 "CSSValueKeywords.gperf"
-      {"highlight", CSSValueHighlight},
-#line 286 "CSSValueKeywords.gperf"
-      {"-webkit-nowrap", CSSValueWebkitNowrap},
-#line 192 "CSSValueKeywords.gperf"
-      {"table-header-group", CSSValueTableHeaderGroup},
-#line 266 "CSSValueKeywords.gperf"
-      {"-webkit-marquee", CSSValueWebkitMarquee},
-#line 348 "CSSValueKeywords.gperf"
+#line 424 "CSSValueKeywords.gperf"
+      {"searchfield-cancel-button", CSSValueSearchfieldCancelButton},
+#line 406 "CSSValueKeywords.gperf"
       {"media-controls-background", CSSValueMediaControlsBackground},
-#line 234 "CSSValueKeywords.gperf"
-      {"-webkit-grab", CSSValueWebkitGrab},
+#line 255 "CSSValueKeywords.gperf"
+      {"-webkit-box", CSSValueWebkitBox},
+#line 291 "CSSValueKeywords.gperf"
+      {"-webkit-grabbing", CSSValueWebkitGrabbing},
+#line 322 "CSSValueKeywords.gperf"
+      {"-webkit-marquee", CSSValueWebkitMarquee},
 #line 29 "CSSValueKeywords.gperf"
       {"-webkit-small-control", CSSValueWebkitSmallControl},
-#line 126 "CSSValueKeywords.gperf"
-      {"-webkit-text", CSSValueWebkitText},
 #line 28 "CSSValueKeywords.gperf"
       {"-webkit-mini-control", CSSValueWebkitMiniControl},
-#line 336 "CSSValueKeywords.gperf"
-      {"media-fullscreen-button", CSSValueMediaFullscreenButton},
-#line 215 "CSSValueKeywords.gperf"
-      {"-webkit-zoom-out", CSSValueWebkitZoomOut},
-#line 100 "CSSValueKeywords.gperf"
-      {"buttonhighlight", CSSValueButtonhighlight},
-#line 199 "CSSValueKeywords.gperf"
-      {"-webkit-box", CSSValueWebkitBox},
-#line 357 "CSSValueKeywords.gperf"
-      {"sliderthumb-horizontal", CSSValueSliderthumbHorizontal},
-#line 361 "CSSValueKeywords.gperf"
-      {"searchfield-decoration", CSSValueSearchfieldDecoration},
-#line 152 "CSSValueKeywords.gperf"
-      {"-webkit-baseline-middle", CSSValueWebkitBaselineMiddle},
-#line 347 "CSSValueKeywords.gperf"
-      {"media-volume-sliderthumb", CSSValueMediaVolumeSliderthumb},
+#line 342 "CSSValueKeywords.gperf"
+      {"-webkit-nowrap", CSSValueWebkitNowrap},
+#line 407 "CSSValueKeywords.gperf"
+      {"media-current-time-display", CSSValueMediaCurrentTimeDisplay},
 #line 74 "CSSValueKeywords.gperf"
       {"-webkit-body", CSSValueWebkitBody},
-#line 465 "CSSValueKeywords.gperf"
-      {"lightgoldenrodyellow", CSSValueLightgoldenrodyellow},
-#line 546 "CSSValueKeywords.gperf"
-      {"text-after-edge", CSSValueTextAfterEdge},
-#line 350 "CSSValueKeywords.gperf"
-      {"media-time-remaining-display", CSSValueMediaTimeRemainingDisplay},
-#line 159 "CSSValueKeywords.gperf"
-      {"-webkit-right", CSSValueWebkitRight},
-#line 545 "CSSValueKeywords.gperf"
-      {"text-before-edge", CSSValueTextBeforeEdge},
-#line 235 "CSSValueKeywords.gperf"
-      {"-webkit-grabbing", CSSValueWebkitGrabbing},
-#line 200 "CSSValueKeywords.gperf"
-      {"-webkit-inline-box", CSSValueWebkitInlineBox},
-#line 349 "CSSValueKeywords.gperf"
-      {"media-current-time-display", CSSValueMediaCurrentTimeDisplay},
-#line 106 "CSSValueKeywords.gperf"
-      {"highlighttext", CSSValueHighlighttext},
-#line 364 "CSSValueKeywords.gperf"
-      {"searchfield-cancel-button", CSSValueSearchfieldCancelButton},
-#line 340 "CSSValueKeywords.gperf"
-      {"media-seek-forward-button", CSSValueMediaSeekForwardButton},
-#line 342 "CSSValueKeywords.gperf"
+#line 152 "CSSValueKeywords.gperf"
+      {"-webkit-baseline-middle", CSSValueWebkitBaselineMiddle},
+#line 399 "CSSValueKeywords.gperf"
       {"media-return-to-realtime-button", CSSValueMediaReturnToRealtimeButton},
-#line 362 "CSSValueKeywords.gperf"
-      {"searchfield-results-decoration", CSSValueSearchfieldResultsDecoration},
-#line 363 "CSSValueKeywords.gperf"
+#line 256 "CSSValueKeywords.gperf"
+      {"-webkit-inline-box", CSSValueWebkitInlineBox},
+#line 423 "CSSValueKeywords.gperf"
       {"searchfield-results-button", CSSValueSearchfieldResultsButton},
-#line 309 "CSSValueKeywords.gperf"
+#line 422 "CSSValueKeywords.gperf"
+      {"searchfield-results-decoration", CSSValueSearchfieldResultsDecoration},
+#line 365 "CSSValueKeywords.gperf"
       {"read-write-plaintext-only", CSSValueReadWritePlaintextOnly},
+#line 397 "CSSValueKeywords.gperf"
+      {"media-seek-forward-button", CSSValueMediaSeekForwardButton},
 #line 123 "CSSValueKeywords.gperf"
       {"-webkit-focus-ring-color", CSSValueWebkitFocusRingColor},
 #line 56 "CSSValueKeywords.gperf"
@@ -1304,328 +1441,341 @@ findValue (register const char *str, register unsigned int len)
     {
         0,  -1,  -1,  -1,  -1,   1,  -1,  -1,  -1,  -1,
         2,  -1,  -1,  -1,  -1,   3,  -1,  -1,  -1,  -1,
-        4,   5,  -1,  -1,  -1,   6,  -1,  -1,  -1,  -1,
-        7,  -1,  -1,  -1,  -1,   8,  -1,  -1,  -1,  -1,
-        9,  -1,  -1,  -1,  -1,  10,  -1,  -1,  -1,  -1,
-       11,  -1,  -1,  -1,  -1,  12,  -1,  -1,  -1,  -1,
-       13,  -1,  14,  -1,  -1,  -1,  15,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  16,  -1,  -1,  -1,  -1,
-       17,  -1,  -1,  -1,  -1,  18,  19,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  20,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  21,  -1,  -1,  -1,
-       22,  -1,  -1,  -1,  -1,  23,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       24,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       25,  -1,  -1,  -1,  -1,  26,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  27,  -1,  28,  -1,  -1,
-       -1,  29,  30,  -1,  -1,  31,  -1,  32,  -1,  -1,
-       -1,  33,  -1,  -1,  -1,  -1,  34,  -1,  -1,  -1,
-       -1,  35,  -1,  -1,  -1,  -1,  36,  37,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  38,  -1,  -1,  -1,  -1,
-       -1,  39,  -1,  -1,  -1,  40,  41,  -1,  -1,  -1,
-       42,  43,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  44,  -1,  -1,  -1,  45,  -1,  -1,  -1,  -1,
-       46,  -1,  -1,  -1,  -1,  47,  -1,  -1,  -1,  -1,
-       48,  -1,  49,  -1,  -1,  -1,  50,  -1,  -1,  -1,
-       51,  -1,  -1,  -1,  -1,  -1,  52,  -1,  -1,  -1,
-       53,  -1,  54,  -1,  -1,  -1,  -1,  55,  -1,  -1,
-       -1,  56,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       57,  -1,  -1,  -1,  -1,  58,  -1,  -1,  -1,  -1,
-       59,  60,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       61,  -1,  -1,  -1,  -1,  62,  -1,  -1,  -1,  -1,
-       63,  -1,  -1,  -1,  -1,  64,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  65,  66,  -1,  -1,  -1,
-       67,  -1,  68,  -1,  -1,  69,  -1,  70,  -1,  -1,
-       71,  72,  -1,  -1,  -1,  -1,  73,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  74,  -1,  -1,  -1,
-       -1,  75,  -1,  -1,  -1,  76,  -1,  -1,  -1,  -1,
-       77,  -1,  78,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  79,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  80,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  81,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  82,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  83,  -1,  -1,  84,  85,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  86,  -1,  -1,
-       -1,  87,  88,  -1,  -1,  -1,  89,  -1,  -1,  -1,
-       -1,  90,  -1,  91,  -1,  92,  -1,  93,  -1,  -1,
-       94,  -1,  -1,  -1,  -1,  -1,  95,  96,  -1,  -1,
-       -1,  97,  -1,  -1,  -1,  -1,  98,  -1,  -1,  -1,
-       -1,  99, 100,  -1,  -1, 101,  -1,  -1,  -1,  -1,
-       -1, 102, 103,  -1,  -1,  -1, 104,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 105,  -1,  -1,  -1,
-      106,  -1, 107,  -1,  -1, 108,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 109,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 110,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 111,  -1, 112,  -1,  -1, 113,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 114,  -1,  -1,  -1,
-       -1,  -1, 115,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 116,  -1,  -1,  -1, 117, 118, 119,  -1,  -1,
+        4,  -1,  -1,  -1,  -1,   5,  -1,  -1,  -1,  -1,
+        6,  -1,  -1,  -1,  -1,   7,  -1,  -1,  -1,  -1,
+        8,  -1,  -1,  -1,  -1,   9,  -1,  -1,  -1,  -1,
+       10,  -1,  -1,  -1,  -1,  11,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  12,  -1,  -1,  -1,  -1,
+       13,  -1,  14,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  15,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       16,  -1,  -1,  -1,  -1,  -1,  -1,  17,  -1,  -1,
+       -1,  -1,  -1,  -1,  18,  19,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  20,  -1,
+       -1,  -1,  -1,  -1,  -1,  21,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       22,  23,  -1,  -1,  -1,  24,  -1,  25,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  26,  -1,  -1,  -1,  -1,
+       27,  -1,  -1,  -1,  -1,  28,  -1,  29,  -1,  -1,
+       30,  -1,  -1,  -1,  -1,  31,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  32,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  33,  -1,  -1,  -1,  -1,  34,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  35,  -1,  -1,  -1,  36,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  37,  38,  -1,
+       39,  40,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       41,  -1,  -1,  -1,  -1,  42,  -1,  43,  -1,  -1,
+       44,  -1,  -1,  -1,  -1,  45,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  46,  -1,  -1,  -1,
+       -1,  47,  -1,  -1,  -1,  48,  -1,  49,  50,  -1,
+       51,  -1,  -1,  -1,  -1,  52,  -1,  -1,  -1,  -1,
+       53,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       54,  55,  56,  -1,  -1,  57,  58,  -1,  -1,  -1,
+       59,  -1,  -1,  -1,  -1,  60,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  61,  -1,  -1,  -1,  -1,
+       62,  -1,  -1,  63,  -1,  -1,  -1,  -1,  -1,  64,
+       65,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  66,  -1,  -1,  -1,  67,  68,  -1,  -1,  -1,
+       69,  70,  71,  -1,  -1,  72,  -1,  -1,  73,  -1,
+       -1,  74,  -1,  -1,  -1,  75,  -1,  76,  -1,  -1,
+       77,  78,  -1,  -1,  -1,  -1,  79,  -1,  -1,  -1,
+       -1,  80,  81,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  82,  -1,  -1,  83,  84,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  85,  -1,  -1,  -1,
+       86,  87,  -1,  -1,  -1,  88,  89,  -1,  -1,  -1,
+       -1,  90,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  91,  92,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  93,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  94,  -1,  -1,  -1,
+       95,  96,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       97,  -1,  -1,  98,  -1,  -1,  99,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 100,  -1, 101,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 102,  -1,  -1,  -1,  -1,
+      103,  -1, 104,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 105,  -1,  -1, 106,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 107, 108, 109,  -1,  -1,
+       -1,  -1, 110,  -1,  -1,  -1,  -1, 111,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 112,  -1,  -1,
+       -1, 113,  -1,  -1,  -1,  -1, 114, 115,  -1,  -1,
+      116, 117,  -1,  -1,  -1, 118,  -1,  -1,  -1,  -1,
+       -1, 119,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
       120,  -1,  -1,  -1,  -1,  -1, 121, 122,  -1,  -1,
-      123, 124,  -1,  -1,  -1, 125, 126,  -1,  -1,  -1,
-      127,  -1, 128,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 129,  -1,  -1, 130,  -1,  -1,  -1,  -1,
-       -1, 131,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 132,  -1,  -1,  -1,  -1, 133, 134,  -1,  -1,
-       -1,  -1,  -1, 135,  -1,  -1,  -1, 136,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 137,  -1,  -1,  -1, 138,  -1,  -1,  -1,
-      139, 140,  -1,  -1,  -1, 141,  -1,  -1,  -1,  -1,
-       -1, 142,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      143,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 144,  -1,  -1,  -1,
-       -1, 145,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      146,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 147,  -1,  -1, 148, 149,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 150,  -1,
-      151,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      152, 153,  -1,  -1,  -1, 154, 155,  -1,  -1,  -1,
-      156,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      157, 158,  -1,  -1,  -1, 159,  -1,  -1,  -1,  -1,
-      160,  -1,  -1,  -1,  -1,  -1, 161, 162,  -1,  -1,
-      163, 164,  -1,  -1,  -1, 165, 166,  -1,  -1,  -1,
-      167,  -1,  -1,  -1,  -1, 168,  -1,  -1,  -1,  -1,
-       -1, 169, 170,  -1,  -1, 171,  -1, 172,  -1,  -1,
-       -1, 173, 174,  -1,  -1,  -1, 175, 176,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      177, 178,  -1,  -1,  -1, 179, 180,  -1,  -1,  -1,
-       -1, 181,  -1,  -1,  -1,  -1, 182,  -1,  -1,  -1,
-      183, 184, 185,  -1,  -1, 186,  -1,  -1,  -1,  -1,
-      187,  -1,  -1,  -1,  -1, 188, 189, 190,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 191, 192, 193,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 194,  -1,  -1,  -1,
-       -1, 195,  -1,  -1,  -1,  -1, 196,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 197,  -1,  -1,  -1,
-      198,  -1, 199,  -1,  -1, 200,  -1,  -1,  -1,  -1,
-      201, 202,  -1,  -1,  -1, 203,  -1,  -1, 204,  -1,
-      205,  -1,  -1,  -1,  -1, 206,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 207,  -1,  -1, 208,  -1,
-       -1,  -1,  -1,  -1,  -1, 209,  -1,  -1,  -1,  -1,
-      210,  -1,  -1,  -1,  -1,  -1, 211, 212, 213,  -1,
-      214,  -1,  -1,  -1,  -1, 215,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 216,
-      217,  -1,  -1,  -1,  -1, 218, 219,  -1,  -1,  -1,
-       -1, 220,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      221, 222,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      223,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      224,  -1,  -1,  -1,  -1,  -1,  -1, 225,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 226,  -1,  -1,  -1,  -1,
-      227, 228,  -1,  -1,  -1, 229,  -1, 230,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 231, 232,  -1,  -1,  -1,
-       -1, 233,  -1,  -1,  -1, 234,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 235, 236,  -1, 237,  -1,
-       -1, 238,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      239,  -1, 240,  -1,  -1, 241,  -1,  -1,  -1,  -1,
-      242,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 243,  -1,  -1,  -1,  -1,  -1, 244,  -1,  -1,
-      245, 246, 247,  -1,  -1,  -1,  -1, 248,  -1,  -1,
-       -1, 249,  -1,  -1,  -1,  -1,  -1,  -1, 250,  -1,
-       -1, 251,  -1,  -1,  -1, 252, 253, 254,  -1,  -1,
-      255,  -1,  -1,  -1,  -1,  -1,  -1, 256,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 257,
-       -1, 258,  -1,  -1,  -1, 259,  -1,  -1,  -1,  -1,
-      260, 261,  -1,  -1,  -1,  -1,  -1, 262,  -1,  -1,
-      263,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 264,  -1,  -1,
-       -1, 265,  -1,  -1, 266,  -1,  -1, 267,  -1,  -1,
-       -1,  -1, 268,  -1,  -1,  -1,  -1, 269,  -1,  -1,
-       -1, 270,  -1,  -1,  -1, 271,  -1,  -1, 272,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      273,  -1,  -1,  -1,  -1, 274, 275,  -1,  -1,  -1,
-       -1,  -1,  -1, 276,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 277,  -1, 278,  -1,  -1,  -1,
-       -1,  -1, 279,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      280,  -1,  -1,  -1,  -1,  -1, 281,  -1,  -1,  -1,
-       -1, 282,  -1,  -1,  -1, 283,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 284,  -1,  -1,  -1,  -1,  -1, 285,  -1,
-       -1,  -1,  -1, 286,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 287, 288,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 289,  -1, 290,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 291,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 292,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 293,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 294,  -1,  -1,  -1,  -1,  -1, 295,  -1,  -1,
-      296,  -1, 297,  -1,  -1, 298,  -1,  -1,  -1,  -1,
-       -1, 299,  -1,  -1,  -1, 300,  -1,  -1,  -1,  -1,
-      301, 302, 303, 304,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 305,  -1, 306,  -1, 307,  -1,  -1,
-       -1, 308,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 309,  -1,  -1,  -1, 310, 311,  -1,  -1,
-       -1, 312,  -1,  -1,  -1,  -1, 313,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 314,  -1,  -1,  -1,  -1,  -1,  -1, 315,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 123,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 124,
+      125, 126, 127,  -1,  -1, 128,  -1,  -1, 129,  -1,
+       -1, 130,  -1, 131,  -1, 132,  -1, 133,  -1,  -1,
+       -1, 134, 135, 136,  -1,  -1, 137,  -1,  -1,  -1,
+       -1,  -1, 138, 139,  -1, 140,  -1, 141,  -1,  -1,
+      142, 143,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      144,  -1,  -1, 145, 146,  -1,  -1,  -1, 147,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 148, 149,  -1,  -1,
+       -1, 150,  -1,  -1,  -1, 151,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 152,  -1,  -1,  -1,  -1,
+       -1,  -1, 153,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 154,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 155,  -1,  -1,  -1, 156,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 157,  -1,  -1,  -1,  -1, 158,  -1,  -1,  -1,
+       -1, 159,  -1,  -1,  -1, 160,  -1,  -1, 161,  -1,
+      162, 163,  -1,  -1,  -1, 164,  -1,  -1,  -1,  -1,
+      165,  -1,  -1, 166,  -1, 167,  -1, 168, 169,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 170,  -1,  -1,
+      171,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 172, 173,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      174, 175,  -1,  -1,  -1, 176,  -1,  -1,  -1, 177,
+      178,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      179,  -1,  -1,  -1,  -1,  -1, 180, 181,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      182,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 183,  -1,  -1,  -1, 184,  -1,  -1,  -1,  -1,
+      185,  -1,  -1,  -1,  -1,  -1,  -1, 186,  -1,  -1,
+       -1,  -1,  -1, 187,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 188,  -1, 189,  -1, 190,  -1,  -1,
+      191, 192,  -1,  -1,  -1,  -1,  -1,  -1, 193,  -1,
+      194, 195,  -1,  -1,  -1, 196, 197,  -1, 198, 199,
+      200, 201,  -1,  -1,  -1, 202, 203,  -1,  -1,  -1,
+      204,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 205, 206,
+       -1,  -1,  -1,  -1,  -1,  -1, 207, 208,  -1,  -1,
+       -1, 209, 210,  -1,  -1, 211,  -1,  -1, 212,  -1,
+      213, 214, 215,  -1,  -1, 216,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 217,  -1, 218,  -1,  -1,  -1,  -1,
+      219,  -1,  -1,  -1, 220, 221,  -1, 222,  -1,  -1,
+       -1,  -1, 223,  -1,  -1, 224, 225,  -1,  -1, 226,
+      227,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      228, 229,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 230,  -1,  -1,  -1,  -1,  -1, 231, 232,  -1,
+       -1,  -1,  -1, 233,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 234, 235,  -1,  -1, 236,  -1,  -1,  -1,  -1,
+      237,  -1,  -1, 238,  -1,  -1, 239, 240,  -1,  -1,
+       -1, 241,  -1,  -1,  -1,  -1, 242,  -1,  -1, 243,
+      244,  -1,  -1,  -1,  -1,  -1,  -1, 245,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 246, 247,  -1,  -1,  -1, 248,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 249,  -1,  -1,
+       -1, 250,  -1, 251,  -1, 252,  -1, 253, 254,  -1,
+       -1, 255, 256,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      257,  -1,  -1,  -1,  -1, 258,  -1, 259, 260,  -1,
+       -1, 261,  -1,  -1,  -1, 262,  -1,  -1,  -1,  -1,
+      263,  -1,  -1,  -1,  -1, 264, 265, 266,  -1,  -1,
+      267,  -1, 268,  -1,  -1, 269,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 270,  -1, 271,  -1, 272,
+       -1,  -1,  -1,  -1,  -1, 273,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 274, 275,
+      276, 277,  -1,  -1,  -1, 278,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 279,  -1,  -1,  -1,  -1,
+       -1, 280,  -1,  -1,  -1,  -1, 281, 282, 283,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 284,  -1,
+      285,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      286,  -1, 287,  -1,  -1,  -1, 288,  -1,  -1,  -1,
+      289,  -1,  -1,  -1,  -1, 290, 291, 292,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 293,  -1, 294,  -1, 295,  -1,  -1,  -1,  -1,
+      296, 297,  -1,  -1,  -1, 298,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 299,  -1,  -1,  -1, 300,  -1,  -1,
+       -1,  -1, 301,  -1, 302,  -1, 303, 304, 305,  -1,
+       -1,  -1,  -1,  -1,  -1, 306, 307,  -1,  -1,  -1,
+      308,  -1,  -1,  -1,  -1, 309,  -1, 310,  -1,  -1,
+       -1,  -1,  -1,  -1, 311,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 312,
+       -1,  -1, 313,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 314,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 315,
        -1, 316,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 317,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 318,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 319,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      320,  -1,  -1,  -1,  -1,  -1, 321,  -1,  -1,  -1,
-       -1, 322, 323,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 324,  -1,  -1, 325,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 326, 327,  -1, 328,
-       -1,  -1, 329,  -1,  -1, 330,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 331, 332,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 333,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 334,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 335,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 336,  -1,  -1,  -1,  -1, 337,  -1,  -1,  -1,
-       -1, 338,  -1,  -1,  -1,  -1,  -1, 339,  -1,  -1,
-       -1, 340,  -1,  -1,  -1, 341,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 342,  -1,  -1,  -1,  -1,
-      343,  -1,  -1,  -1,  -1, 344,  -1,  -1,  -1,  -1,
-      345,  -1,  -1,  -1,  -1, 346, 347,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 348,  -1,  -1,  -1,
-       -1,  -1, 349,  -1,  -1,  -1, 350,  -1,  -1,  -1,
-       -1,  -1, 351,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 352,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      353,  -1,  -1,  -1,  -1, 354, 355, 356,  -1,  -1,
-      357,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 358,  -1,  -1,
-       -1, 359,  -1,  -1,  -1,  -1, 360, 361, 362,  -1,
-       -1,  -1, 363,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 364,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 365, 366,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 367,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 368, 369,  -1, 370, 371,  -1,  -1,  -1, 372,
-       -1, 373,  -1,  -1,  -1,  -1,  -1, 374,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 375,  -1,
-       -1, 376, 377,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 378,  -1, 379,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 380,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 381, 382,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      383,  -1, 384,  -1,  -1,  -1, 385, 386,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 387,  -1,
-       -1, 388,  -1, 389,  -1,  -1, 390,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 391,  -1,  -1,  -1,
-       -1,  -1, 392,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 317,  -1,  -1, 318,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 319,  -1,  -1, 320,  -1,  -1,
+       -1, 321,  -1, 322,  -1,  -1,  -1, 323,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 324, 325,  -1,  -1,
+      326,  -1,  -1,  -1,  -1, 327,  -1,  -1,  -1,  -1,
+       -1, 328,  -1,  -1,  -1,  -1, 329,  -1,  -1,  -1,
+       -1, 330,  -1,  -1,  -1, 331,  -1,  -1,  -1,  -1,
+       -1, 332, 333,  -1,  -1,  -1, 334,  -1,  -1,  -1,
+       -1,  -1, 335,  -1,  -1,  -1,  -1, 336,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 337,  -1, 338,  -1,  -1,
+      339, 340,  -1,  -1,  -1,  -1,  -1, 341,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      342, 343,  -1,  -1,  -1, 344, 345, 346,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 347,  -1,  -1,  -1, 348,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 349,  -1,  -1,  -1,
+      350,  -1,  -1,  -1,  -1, 351, 352,  -1, 353,  -1,
+       -1,  -1,  -1, 354,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 355,  -1,  -1,  -1,  -1, 356,
+       -1,  -1, 357, 358,  -1,  -1,  -1, 359,  -1,  -1,
+       -1,  -1, 360, 361,  -1, 362, 363,  -1,  -1,  -1,
+       -1,  -1, 364, 365,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 366,  -1, 367, 368,  -1,  -1,
+       -1, 369, 370, 371, 372,  -1, 373,  -1,  -1,  -1,
+      374,  -1,  -1,  -1,  -1,  -1, 375, 376, 377,  -1,
+       -1, 378, 379,  -1,  -1, 380,  -1,  -1,  -1, 381,
+       -1,  -1,  -1,  -1, 382,  -1,  -1, 383,  -1, 384,
+       -1,  -1,  -1,  -1,  -1, 385,  -1,  -1, 386,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 387,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      388,  -1,  -1,  -1, 389,  -1, 390,  -1,  -1,  -1,
+       -1,  -1, 391,  -1, 392,  -1,  -1,  -1,  -1, 393,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 394,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      395,  -1, 396,  -1,  -1, 397,  -1,  -1,  -1,  -1,
+       -1, 398, 399,  -1,  -1,  -1,  -1, 400,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 401,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      402,  -1,  -1, 403,  -1, 404,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 405,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 406,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 407,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 408,  -1,  -1,  -1,
+       -1, 409, 410, 411,  -1, 412,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 413,  -1, 414,  -1,  -1, 415,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 416,  -1,
+       -1, 417,  -1,  -1,  -1,  -1, 418,  -1, 419,  -1,
+      420,  -1,  -1,  -1,  -1,  -1, 421,  -1,  -1,  -1,
+       -1, 422,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 423,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 424, 425,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 426,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      427,  -1, 428,  -1,  -1,  -1,  -1, 429,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 430,
+      431, 432,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 433,
+      434,  -1, 435,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 436,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 437,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      438,  -1, 439,  -1,  -1, 440, 441,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 442,  -1,  -1,
+       -1,  -1,  -1, 443,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 444,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 445,  -1,  -1,  -1, 446,  -1, 447,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 448,  -1, 449,  -1,  -1,
+      450,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 451,  -1,  -1,  -1,  -1,  -1,  -1, 452,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 453,  -1,  -1,  -1, 454,  -1, 455,  -1,  -1,
+      456,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 457,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 458,
+       -1,  -1, 459,  -1,  -1,  -1, 460,  -1,  -1,  -1,
+       -1, 461,  -1,  -1, 462, 463,  -1,  -1,  -1,  -1,
+       -1, 464,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 465,  -1,  -1,  -1,  -1, 466,  -1,  -1,
+       -1,  -1,  -1, 467,  -1,  -1,  -1,  -1,  -1,  -1,
+      468,  -1,  -1,  -1,  -1, 469,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 470, 471,  -1,  -1, 472, 473,
+       -1,  -1,  -1, 474,  -1,  -1,  -1, 475,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 476,  -1,  -1,
+       -1,  -1, 477,  -1,  -1,  -1,  -1, 478,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 479,  -1, 480,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 481, 482,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      483,  -1, 484,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 485,  -1,  -1, 486,  -1, 487,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 488, 489,  -1,  -1,  -1,  -1,
+       -1,  -1, 490,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 491,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 492,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 493,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 494,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 495,  -1,  -1,  -1,  -1,
+       -1, 496, 497,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 498,  -1,
+      499,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 500,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      393,  -1, 394,  -1,  -1,  -1, 395, 396,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 397,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 398,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 399, 400, 401,  -1,
-       -1, 402,  -1,  -1,  -1, 403,  -1,  -1, 404,  -1,
-       -1,  -1,  -1,  -1,  -1, 405, 406,  -1,  -1,  -1,
-       -1,  -1, 407, 408,  -1,  -1, 409,  -1,  -1,  -1,
-       -1, 410,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 411,  -1,  -1,
-      412,  -1,  -1,  -1,  -1,  -1,  -1, 413, 414,  -1,
-       -1,  -1,  -1, 415,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 416,  -1,  -1,  -1,  -1, 417,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 418, 419,  -1, 420,  -1,
-       -1, 421,  -1,  -1, 422,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 501,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 502,  -1,  -1, 503,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 504,  -1,  -1,  -1,  -1,  -1,  -1,
+      505, 506,  -1,  -1,  -1,  -1, 507,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 508, 509,  -1,  -1,  -1,
+       -1,  -1,  -1, 510,  -1,  -1,  -1,  -1, 511,  -1,
+       -1, 512,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 513,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 514,
+       -1,  -1,  -1, 515,  -1,  -1,  -1,  -1, 516,  -1,
+      517,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 423,  -1,
-       -1,  -1,  -1, 424,  -1,  -1, 425,  -1,  -1,  -1,
-       -1,  -1, 426,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 518,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 519,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 427,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 428,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 429,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      520,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 521,  -1,
+      522,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 523,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      430,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 431,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 524,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 525,
+       -1,  -1,  -1,  -1,  -1,  -1, 526,  -1,  -1,  -1,
+       -1, 527,  -1,  -1,  -1,  -1, 528,  -1,  -1,  -1,
+       -1,  -1, 529,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 530,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 432,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 433,  -1,  -1,  -1, 434, 435,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 436,  -1,  -1,
-       -1,  -1, 437,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 438,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 439,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 531,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 532,
+       -1,  -1, 533,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 440,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 441,  -1,
-       -1,  -1,  -1,  -1, 442,  -1,  -1, 443,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 444,  -1,  -1,
-       -1,  -1, 445,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 446, 447, 448,  -1,  -1,
-       -1, 449,  -1,  -1,  -1,  -1,  -1, 450,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      451, 452,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 453,  -1,  -1,  -1,  -1, 454,  -1,
+       -1,  -1,  -1, 534,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 535,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 536,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 455,  -1,  -1,
-       -1, 456,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      457,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 458,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 537,  -1,  -1,  -1, 538,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 539,  -1,  -1,
+       -1, 540,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 459,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 460,
-       -1,  -1,  -1,  -1,  -1,  -1, 461,  -1,  -1,  -1,
-       -1, 462, 463,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 464,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 465,  -1,  -1,  -1,
+      541,  -1,  -1,  -1,  -1, 542,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 466,  -1,  -1,  -1,
+       -1,  -1,  -1, 543,  -1, 544,  -1,  -1,  -1,  -1,
+      545,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 546,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 547,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 467,  -1,  -1,
-       -1, 468,  -1,  -1,  -1,  -1,  -1, 469,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 548,  -1,  -1, 549,  -1,  -1,  -1,  -1,
+      550,  -1, 551,  -1,  -1,  -1,  -1, 552,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 553,  -1,  -1,  -1,
+       -1,  -1, 554,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 470,  -1,  -1,
-       -1, 471,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 555,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 472,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 556,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 557,
+       -1,  -1, 558, 559,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 473,  -1,  -1,  -1,  -1,  -1,  -1,
-      474,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 560,  -1,  -1,  -1,
+       -1,  -1,  -1, 561,  -1, 562,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      475, 476,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 477,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 478,  -1,  -1,
-       -1, 479,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 480,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 481,  -1,
-      482,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 483,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 484,  -1, 485,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1634,166 +1784,157 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 486,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 563,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 487,  -1,  -1,
-       -1,  -1,  -1,  -1, 488,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 489,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 564,  -1,  -1, 565,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 490,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 491,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 566,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 492,  -1,  -1,  -1,  -1,
+       -1, 567,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 568,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 569,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 570,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 493,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 494,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 495,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 496,  -1,  -1,
-       -1,  -1, 497,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 498,  -1,
-       -1,  -1,  -1, 499,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 571,  -1,  -1,  -1,
+       -1,  -1, 572,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 500, 501,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      502,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 503,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 504,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 505,  -1,  -1,
-       -1,  -1, 506,  -1,  -1,  -1,  -1,  -1, 507,  -1,
-       -1,  -1,  -1, 508,  -1,  -1,  -1, 509,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 510,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 511,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 573,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 512,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 574,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 575,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 513,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 514,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 515,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 516,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 517,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 518, 519,  -1,
+       -1, 576,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 577,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 520,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 521,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 522,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 523,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 524, 525,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 526,  -1,
+       -1,  -1, 578,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 579,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 527,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 580,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      581,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 582,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      528,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 583,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 529,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 584,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 585,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 586,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 587,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 530,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 588,
+       -1,  -1, 589,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 590,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 591,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 592,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 593,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 531,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 532,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 533,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 534,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 594,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 595,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 596,  -1, 597,  -1,  -1,  -1,  -1, 598,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 599,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 600,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 601,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 535,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 536,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 537,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 602,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 603,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 538,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 604,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1804,11 +1945,8 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 539,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 540,  -1,
-       -1,  -1,  -1,  -1,  -1, 541,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1818,12 +1956,14 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 605,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 606,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1836,8 +1976,8 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 542,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 607,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1858,7 +1998,6 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      543,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1879,9 +2018,9 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      544,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 608,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1893,7 +2032,6 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      545,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1919,6 +2057,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 609,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1926,13 +2065,13 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 546,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 610,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1952,7 +2091,6 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 547,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1992,6 +2130,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 611,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -2015,11 +2154,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 548
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 612
     };
 
   if (len <= MAX_WORD_LENGTH && len >= MIN_WORD_LENGTH)
@@ -2041,7 +2176,7 @@ findValue (register const char *str, register unsigned int len)
     }
   return 0;
 }
-#line 560 "CSSValueKeywords.gperf"
+#line 624 "CSSValueKeywords.gperf"
 
 static const char * const valueList[] = {
 "",
@@ -2202,6 +2337,28 @@ static const char * const valueList[] = {
 "square", 
 "decimal", 
 "decimal-leading-zero", 
+"arabic-indic", 
+"binary", 
+"bengali", 
+"cambodian", 
+"khmer", 
+"devanagari", 
+"gujarati", 
+"gurmukhi", 
+"kannada", 
+"lower-hexadecimal", 
+"lao", 
+"malayalam", 
+"mongolian", 
+"myanmar", 
+"octal", 
+"oriya", 
+"persian", 
+"urdu", 
+"telugu", 
+"tibetan", 
+"thai", 
+"upper-hexadecimal", 
 "lower-roman", 
 "upper-roman", 
 "lower-greek", 
@@ -2209,6 +2366,40 @@ static const char * const valueList[] = {
 "lower-latin", 
 "upper-alpha", 
 "upper-latin", 
+"afar", 
+"ethiopic-halehame-aa-et", 
+"ethiopic-halehame-aa-er", 
+"amharic", 
+"ethiopic-halehame-am-et", 
+"amharic-abegede", 
+"ethiopic-abegede-am-et", 
+"cjk-earthly-branch", 
+"cjk-heavenly-stem", 
+"ethiopic", 
+"ethiopic-halehame-gez", 
+"ethiopic-abegede", 
+"ethiopic-abegede-gez", 
+"hangul-consonant", 
+"hangul", 
+"lower-norwegian", 
+"oromo", 
+"ethiopic-halehame-om-et", 
+"sidama", 
+"ethiopic-halehame-sid-et", 
+"somali", 
+"ethiopic-halehame-so-et", 
+"tigre", 
+"ethiopic-halehame-tig", 
+"tigrinya-er", 
+"ethiopic-halehame-ti-er", 
+"tigrinya-er-abegede", 
+"ethiopic-abegede-ti-er", 
+"tigrinya-et", 
+"ethiopic-halehame-ti-et", 
+"tigrinya-et-abegede", 
+"ethiopic-abegede-ti-et", 
+"upper-greek", 
+"upper-norwegian", 
 "hebrew", 
 "armenian", 
 "georgian", 
@@ -2367,6 +2558,7 @@ static const char * const valueList[] = {
 "button", 
 "button-bevel", 
 "default-button", 
+"inner-spin-button", 
 "list-button", 
 "listbox", 
 "listitem", 
@@ -2377,6 +2569,7 @@ static const char * const valueList[] = {
 "media-seek-forward-button", 
 "media-rewind-button", 
 "media-return-to-realtime-button", 
+"media-toggle-closed-captions-button", 
 "media-slider", 
 "media-sliderthumb", 
 "media-volume-slider-container", 
@@ -2389,6 +2582,8 @@ static const char * const valueList[] = {
 "menulist-button", 
 "menulist-text", 
 "menulist-textfield", 
+"outer-spin-button", 
+"progress-bar", 
 "slider-horizontal", 
 "slider-vertical", 
 "sliderthumb-horizontal", 
@@ -2436,6 +2631,11 @@ static const char * const valueList[] = {
 "optimizespeed", 
 "optimizelegibility", 
 "geometricprecision", 
+"srgb", 
+"mini", 
+"floating", 
+"application", 
+"fullscreen", 
 "aliceblue", 
 "antiquewhite", 
 "aquamarine", 
@@ -2569,7 +2769,6 @@ static const char * const valueList[] = {
 "evenodd", 
 "accumulate", 
 "new", 
-"srgb", 
 "linearrgb", 
 "optimizequality", 
 "crispedges", 
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
index e05d7ed4fc..d79e6584e6 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
@@ -161,400 +161,464 @@ const int CSSValueCircle = 154;
 const int CSSValueSquare = 155;
 const int CSSValueDecimal = 156;
 const int CSSValueDecimalLeadingZero = 157;
-const int CSSValueLowerRoman = 158;
-const int CSSValueUpperRoman = 159;
-const int CSSValueLowerGreek = 160;
-const int CSSValueLowerAlpha = 161;
-const int CSSValueLowerLatin = 162;
-const int CSSValueUpperAlpha = 163;
-const int CSSValueUpperLatin = 164;
-const int CSSValueHebrew = 165;
-const int CSSValueArmenian = 166;
-const int CSSValueGeorgian = 167;
-const int CSSValueCjkIdeographic = 168;
-const int CSSValueHiragana = 169;
-const int CSSValueKatakana = 170;
-const int CSSValueHiraganaIroha = 171;
-const int CSSValueKatakanaIroha = 172;
-const int CSSValueInline = 173;
-const int CSSValueBlock = 174;
-const int CSSValueListItem = 175;
-const int CSSValueRunIn = 176;
-const int CSSValueCompact = 177;
-const int CSSValueInlineBlock = 178;
-const int CSSValueTable = 179;
-const int CSSValueInlineTable = 180;
-const int CSSValueTableRowGroup = 181;
-const int CSSValueTableHeaderGroup = 182;
-const int CSSValueTableFooterGroup = 183;
-const int CSSValueTableRow = 184;
-const int CSSValueTableColumnGroup = 185;
-const int CSSValueTableColumn = 186;
-const int CSSValueTableCell = 187;
-const int CSSValueTableCaption = 188;
-const int CSSValueWebkitBox = 189;
-const int CSSValueWebkitInlineBox = 190;
-const int CSSValueWapMarquee = 191;
-const int CSSValueAuto = 192;
-const int CSSValueCrosshair = 193;
-const int CSSValueDefault = 194;
-const int CSSValuePointer = 195;
-const int CSSValueMove = 196;
-const int CSSValueVerticalText = 197;
-const int CSSValueCell = 198;
-const int CSSValueContextMenu = 199;
-const int CSSValueAlias = 200;
-const int CSSValueProgress = 201;
-const int CSSValueNoDrop = 202;
-const int CSSValueNotAllowed = 203;
-const int CSSValueWebkitZoomIn = 204;
-const int CSSValueWebkitZoomOut = 205;
-const int CSSValueEResize = 206;
-const int CSSValueNeResize = 207;
-const int CSSValueNwResize = 208;
-const int CSSValueNResize = 209;
-const int CSSValueSeResize = 210;
-const int CSSValueSwResize = 211;
-const int CSSValueSResize = 212;
-const int CSSValueWResize = 213;
-const int CSSValueEwResize = 214;
-const int CSSValueNsResize = 215;
-const int CSSValueNeswResize = 216;
-const int CSSValueNwseResize = 217;
-const int CSSValueColResize = 218;
-const int CSSValueRowResize = 219;
-const int CSSValueText = 220;
-const int CSSValueWait = 221;
-const int CSSValueHelp = 222;
-const int CSSValueAllScroll = 223;
-const int CSSValueWebkitGrab = 224;
-const int CSSValueWebkitGrabbing = 225;
-const int CSSValueLtr = 226;
-const int CSSValueRtl = 227;
-const int CSSValueCapitalize = 228;
-const int CSSValueUppercase = 229;
-const int CSSValueLowercase = 230;
-const int CSSValueVisible = 231;
-const int CSSValueCollapse = 232;
-const int CSSValueAbove = 233;
-const int CSSValueAbsolute = 234;
-const int CSSValueAlways = 235;
-const int CSSValueAvoid = 236;
-const int CSSValueBelow = 237;
-const int CSSValueBidiOverride = 238;
-const int CSSValueBlink = 239;
-const int CSSValueBoth = 240;
-const int CSSValueCloseQuote = 241;
-const int CSSValueCrop = 242;
-const int CSSValueCross = 243;
-const int CSSValueEmbed = 244;
-const int CSSValueFixed = 245;
-const int CSSValueHand = 246;
-const int CSSValueHide = 247;
-const int CSSValueHigher = 248;
-const int CSSValueInvert = 249;
-const int CSSValueLandscape = 250;
-const int CSSValueLevel = 251;
-const int CSSValueLineThrough = 252;
-const int CSSValueLocal = 253;
-const int CSSValueLoud = 254;
-const int CSSValueLower = 255;
-const int CSSValueWebkitMarquee = 256;
-const int CSSValueMix = 257;
-const int CSSValueNoCloseQuote = 258;
-const int CSSValueNoOpenQuote = 259;
-const int CSSValueNowrap = 260;
-const int CSSValueOpenQuote = 261;
-const int CSSValueOverlay = 262;
-const int CSSValueOverline = 263;
-const int CSSValuePortrait = 264;
-const int CSSValuePre = 265;
-const int CSSValuePreLine = 266;
-const int CSSValuePreWrap = 267;
-const int CSSValueRelative = 268;
-const int CSSValueScroll = 269;
-const int CSSValueSeparate = 270;
-const int CSSValueShow = 271;
-const int CSSValueStatic = 272;
-const int CSSValueThick = 273;
-const int CSSValueThin = 274;
-const int CSSValueUnderline = 275;
-const int CSSValueWebkitNowrap = 276;
-const int CSSValueStretch = 277;
-const int CSSValueStart = 278;
-const int CSSValueEnd = 279;
-const int CSSValueReverse = 280;
-const int CSSValueHorizontal = 281;
-const int CSSValueVertical = 282;
-const int CSSValueInlineAxis = 283;
-const int CSSValueBlockAxis = 284;
-const int CSSValueSingle = 285;
-const int CSSValueMultiple = 286;
-const int CSSValueForwards = 287;
-const int CSSValueBackwards = 288;
-const int CSSValueAhead = 289;
-const int CSSValueUp = 290;
-const int CSSValueDown = 291;
-const int CSSValueSlow = 292;
-const int CSSValueFast = 293;
-const int CSSValueInfinite = 294;
-const int CSSValueSlide = 295;
-const int CSSValueAlternate = 296;
-const int CSSValueReadOnly = 297;
-const int CSSValueReadWrite = 298;
-const int CSSValueReadWritePlaintextOnly = 299;
-const int CSSValueElement = 300;
-const int CSSValueIgnore = 301;
-const int CSSValueIntrinsic = 302;
-const int CSSValueMinIntrinsic = 303;
-const int CSSValueClip = 304;
-const int CSSValueEllipsis = 305;
-const int CSSValueDiscard = 306;
-const int CSSValueDotDash = 307;
-const int CSSValueDotDotDash = 308;
-const int CSSValueWave = 309;
-const int CSSValueContinuous = 310;
-const int CSSValueSkipWhiteSpace = 311;
-const int CSSValueBreakAll = 312;
-const int CSSValueBreakWord = 313;
-const int CSSValueSpace = 314;
-const int CSSValueAfterWhiteSpace = 315;
-const int CSSValueCheckbox = 316;
-const int CSSValueRadio = 317;
-const int CSSValuePushButton = 318;
-const int CSSValueSquareButton = 319;
-const int CSSValueButton = 320;
-const int CSSValueButtonBevel = 321;
-const int CSSValueDefaultButton = 322;
-const int CSSValueListButton = 323;
-const int CSSValueListbox = 324;
-const int CSSValueListitem = 325;
-const int CSSValueMediaFullscreenButton = 326;
-const int CSSValueMediaMuteButton = 327;
-const int CSSValueMediaPlayButton = 328;
-const int CSSValueMediaSeekBackButton = 329;
-const int CSSValueMediaSeekForwardButton = 330;
-const int CSSValueMediaRewindButton = 331;
-const int CSSValueMediaReturnToRealtimeButton = 332;
-const int CSSValueMediaSlider = 333;
-const int CSSValueMediaSliderthumb = 334;
-const int CSSValueMediaVolumeSliderContainer = 335;
-const int CSSValueMediaVolumeSlider = 336;
-const int CSSValueMediaVolumeSliderthumb = 337;
-const int CSSValueMediaControlsBackground = 338;
-const int CSSValueMediaCurrentTimeDisplay = 339;
-const int CSSValueMediaTimeRemainingDisplay = 340;
-const int CSSValueMenulist = 341;
-const int CSSValueMenulistButton = 342;
-const int CSSValueMenulistText = 343;
-const int CSSValueMenulistTextfield = 344;
-const int CSSValueSliderHorizontal = 345;
-const int CSSValueSliderVertical = 346;
-const int CSSValueSliderthumbHorizontal = 347;
-const int CSSValueSliderthumbVertical = 348;
-const int CSSValueCaret = 349;
-const int CSSValueSearchfield = 350;
-const int CSSValueSearchfieldDecoration = 351;
-const int CSSValueSearchfieldResultsDecoration = 352;
-const int CSSValueSearchfieldResultsButton = 353;
-const int CSSValueSearchfieldCancelButton = 354;
-const int CSSValueTextfield = 355;
-const int CSSValueTextarea = 356;
-const int CSSValueCapsLockIndicator = 357;
-const int CSSValueRound = 358;
-const int CSSValueBorder = 359;
-const int CSSValueBorderBox = 360;
-const int CSSValueContent = 361;
-const int CSSValueContentBox = 362;
-const int CSSValuePadding = 363;
-const int CSSValuePaddingBox = 364;
-const int CSSValueContain = 365;
-const int CSSValueCover = 366;
-const int CSSValueLogical = 367;
-const int CSSValueVisual = 368;
-const int CSSValueLines = 369;
-const int CSSValueRunning = 370;
-const int CSSValuePaused = 371;
-const int CSSValueFlat = 372;
-const int CSSValuePreserve3d = 373;
-const int CSSValueEase = 374;
-const int CSSValueLinear = 375;
-const int CSSValueEaseIn = 376;
-const int CSSValueEaseOut = 377;
-const int CSSValueEaseInOut = 378;
-const int CSSValueDocument = 379;
-const int CSSValueReset = 380;
-const int CSSValueVisiblepainted = 381;
-const int CSSValueVisiblefill = 382;
-const int CSSValueVisiblestroke = 383;
-const int CSSValuePainted = 384;
-const int CSSValueFill = 385;
-const int CSSValueStroke = 386;
-const int CSSValueAntialiased = 387;
-const int CSSValueSubpixelAntialiased = 388;
-const int CSSValueOptimizespeed = 389;
-const int CSSValueOptimizelegibility = 390;
-const int CSSValueGeometricprecision = 391;
-const int CSSValueAliceblue = 392;
-const int CSSValueAntiquewhite = 393;
-const int CSSValueAquamarine = 394;
-const int CSSValueAzure = 395;
-const int CSSValueBeige = 396;
-const int CSSValueBisque = 397;
-const int CSSValueBlanchedalmond = 398;
-const int CSSValueBlueviolet = 399;
-const int CSSValueBrown = 400;
-const int CSSValueBurlywood = 401;
-const int CSSValueCadetblue = 402;
-const int CSSValueChartreuse = 403;
-const int CSSValueChocolate = 404;
-const int CSSValueCoral = 405;
-const int CSSValueCornflowerblue = 406;
-const int CSSValueCornsilk = 407;
-const int CSSValueCrimson = 408;
-const int CSSValueCyan = 409;
-const int CSSValueDarkblue = 410;
-const int CSSValueDarkcyan = 411;
-const int CSSValueDarkgoldenrod = 412;
-const int CSSValueDarkgray = 413;
-const int CSSValueDarkgreen = 414;
-const int CSSValueDarkgrey = 415;
-const int CSSValueDarkkhaki = 416;
-const int CSSValueDarkmagenta = 417;
-const int CSSValueDarkolivegreen = 418;
-const int CSSValueDarkorange = 419;
-const int CSSValueDarkorchid = 420;
-const int CSSValueDarkred = 421;
-const int CSSValueDarksalmon = 422;
-const int CSSValueDarkseagreen = 423;
-const int CSSValueDarkslateblue = 424;
-const int CSSValueDarkslategray = 425;
-const int CSSValueDarkslategrey = 426;
-const int CSSValueDarkturquoise = 427;
-const int CSSValueDarkviolet = 428;
-const int CSSValueDeeppink = 429;
-const int CSSValueDeepskyblue = 430;
-const int CSSValueDimgray = 431;
-const int CSSValueDimgrey = 432;
-const int CSSValueDodgerblue = 433;
-const int CSSValueFirebrick = 434;
-const int CSSValueFloralwhite = 435;
-const int CSSValueForestgreen = 436;
-const int CSSValueGainsboro = 437;
-const int CSSValueGhostwhite = 438;
-const int CSSValueGold = 439;
-const int CSSValueGoldenrod = 440;
-const int CSSValueGreenyellow = 441;
-const int CSSValueHoneydew = 442;
-const int CSSValueHotpink = 443;
-const int CSSValueIndianred = 444;
-const int CSSValueIndigo = 445;
-const int CSSValueIvory = 446;
-const int CSSValueKhaki = 447;
-const int CSSValueLavender = 448;
-const int CSSValueLavenderblush = 449;
-const int CSSValueLawngreen = 450;
-const int CSSValueLemonchiffon = 451;
-const int CSSValueLightblue = 452;
-const int CSSValueLightcoral = 453;
-const int CSSValueLightcyan = 454;
-const int CSSValueLightgoldenrodyellow = 455;
-const int CSSValueLightgray = 456;
-const int CSSValueLightgreen = 457;
-const int CSSValueLightgrey = 458;
-const int CSSValueLightpink = 459;
-const int CSSValueLightsalmon = 460;
-const int CSSValueLightseagreen = 461;
-const int CSSValueLightskyblue = 462;
-const int CSSValueLightslategray = 463;
-const int CSSValueLightslategrey = 464;
-const int CSSValueLightsteelblue = 465;
-const int CSSValueLightyellow = 466;
-const int CSSValueLimegreen = 467;
-const int CSSValueLinen = 468;
-const int CSSValueMagenta = 469;
-const int CSSValueMediumaquamarine = 470;
-const int CSSValueMediumblue = 471;
-const int CSSValueMediumorchid = 472;
-const int CSSValueMediumpurple = 473;
-const int CSSValueMediumseagreen = 474;
-const int CSSValueMediumslateblue = 475;
-const int CSSValueMediumspringgreen = 476;
-const int CSSValueMediumturquoise = 477;
-const int CSSValueMediumvioletred = 478;
-const int CSSValueMidnightblue = 479;
-const int CSSValueMintcream = 480;
-const int CSSValueMistyrose = 481;
-const int CSSValueMoccasin = 482;
-const int CSSValueNavajowhite = 483;
-const int CSSValueOldlace = 484;
-const int CSSValueOlivedrab = 485;
-const int CSSValueOrangered = 486;
-const int CSSValueOrchid = 487;
-const int CSSValuePalegoldenrod = 488;
-const int CSSValuePalegreen = 489;
-const int CSSValuePaleturquoise = 490;
-const int CSSValuePalevioletred = 491;
-const int CSSValuePapayawhip = 492;
-const int CSSValuePeachpuff = 493;
-const int CSSValuePeru = 494;
-const int CSSValuePink = 495;
-const int CSSValuePlum = 496;
-const int CSSValuePowderblue = 497;
-const int CSSValueRosybrown = 498;
-const int CSSValueRoyalblue = 499;
-const int CSSValueSaddlebrown = 500;
-const int CSSValueSalmon = 501;
-const int CSSValueSandybrown = 502;
-const int CSSValueSeagreen = 503;
-const int CSSValueSeashell = 504;
-const int CSSValueSienna = 505;
-const int CSSValueSkyblue = 506;
-const int CSSValueSlateblue = 507;
-const int CSSValueSlategray = 508;
-const int CSSValueSlategrey = 509;
-const int CSSValueSnow = 510;
-const int CSSValueSpringgreen = 511;
-const int CSSValueSteelblue = 512;
-const int CSSValueTan = 513;
-const int CSSValueThistle = 514;
-const int CSSValueTomato = 515;
-const int CSSValueTurquoise = 516;
-const int CSSValueViolet = 517;
-const int CSSValueWheat = 518;
-const int CSSValueWhitesmoke = 519;
-const int CSSValueYellowgreen = 520;
-const int CSSValueNonzero = 521;
-const int CSSValueEvenodd = 522;
-const int CSSValueAccumulate = 523;
-const int CSSValueNew = 524;
-const int CSSValueSrgb = 525;
-const int CSSValueLinearrgb = 526;
-const int CSSValueOptimizequality = 527;
-const int CSSValueCrispedges = 528;
-const int CSSValueButt = 529;
-const int CSSValueMiter = 530;
-const int CSSValueBevel = 531;
-const int CSSValueBeforeEdge = 532;
-const int CSSValueAfterEdge = 533;
-const int CSSValueCentral = 534;
-const int CSSValueTextBeforeEdge = 535;
-const int CSSValueTextAfterEdge = 536;
-const int CSSValueIdeographic = 537;
-const int CSSValueAlphabetic = 538;
-const int CSSValueHanging = 539;
-const int CSSValueMathematical = 540;
-const int CSSValueUseScript = 541;
-const int CSSValueNoChange = 542;
-const int CSSValueResetSize = 543;
-const int CSSValueLrTb = 544;
-const int CSSValueRlTb = 545;
-const int CSSValueTbRl = 546;
-const int CSSValueLr = 547;
-const int CSSValueRl = 548;
-const int CSSValueTb = 549;
-const int numCSSValueKeywords = 550;
-const size_t maxCSSValueKeywordLength = 31;
+const int CSSValueArabicIndic = 158;
+const int CSSValueBinary = 159;
+const int CSSValueBengali = 160;
+const int CSSValueCambodian = 161;
+const int CSSValueKhmer = 162;
+const int CSSValueDevanagari = 163;
+const int CSSValueGujarati = 164;
+const int CSSValueGurmukhi = 165;
+const int CSSValueKannada = 166;
+const int CSSValueLowerHexadecimal = 167;
+const int CSSValueLao = 168;
+const int CSSValueMalayalam = 169;
+const int CSSValueMongolian = 170;
+const int CSSValueMyanmar = 171;
+const int CSSValueOctal = 172;
+const int CSSValueOriya = 173;
+const int CSSValuePersian = 174;
+const int CSSValueUrdu = 175;
+const int CSSValueTelugu = 176;
+const int CSSValueTibetan = 177;
+const int CSSValueThai = 178;
+const int CSSValueUpperHexadecimal = 179;
+const int CSSValueLowerRoman = 180;
+const int CSSValueUpperRoman = 181;
+const int CSSValueLowerGreek = 182;
+const int CSSValueLowerAlpha = 183;
+const int CSSValueLowerLatin = 184;
+const int CSSValueUpperAlpha = 185;
+const int CSSValueUpperLatin = 186;
+const int CSSValueAfar = 187;
+const int CSSValueEthiopicHalehameAaEt = 188;
+const int CSSValueEthiopicHalehameAaEr = 189;
+const int CSSValueAmharic = 190;
+const int CSSValueEthiopicHalehameAmEt = 191;
+const int CSSValueAmharicAbegede = 192;
+const int CSSValueEthiopicAbegedeAmEt = 193;
+const int CSSValueCjkEarthlyBranch = 194;
+const int CSSValueCjkHeavenlyStem = 195;
+const int CSSValueEthiopic = 196;
+const int CSSValueEthiopicHalehameGez = 197;
+const int CSSValueEthiopicAbegede = 198;
+const int CSSValueEthiopicAbegedeGez = 199;
+const int CSSValueHangulConsonant = 200;
+const int CSSValueHangul = 201;
+const int CSSValueLowerNorwegian = 202;
+const int CSSValueOromo = 203;
+const int CSSValueEthiopicHalehameOmEt = 204;
+const int CSSValueSidama = 205;
+const int CSSValueEthiopicHalehameSidEt = 206;
+const int CSSValueSomali = 207;
+const int CSSValueEthiopicHalehameSoEt = 208;
+const int CSSValueTigre = 209;
+const int CSSValueEthiopicHalehameTig = 210;
+const int CSSValueTigrinyaEr = 211;
+const int CSSValueEthiopicHalehameTiEr = 212;
+const int CSSValueTigrinyaErAbegede = 213;
+const int CSSValueEthiopicAbegedeTiEr = 214;
+const int CSSValueTigrinyaEt = 215;
+const int CSSValueEthiopicHalehameTiEt = 216;
+const int CSSValueTigrinyaEtAbegede = 217;
+const int CSSValueEthiopicAbegedeTiEt = 218;
+const int CSSValueUpperGreek = 219;
+const int CSSValueUpperNorwegian = 220;
+const int CSSValueHebrew = 221;
+const int CSSValueArmenian = 222;
+const int CSSValueGeorgian = 223;
+const int CSSValueCjkIdeographic = 224;
+const int CSSValueHiragana = 225;
+const int CSSValueKatakana = 226;
+const int CSSValueHiraganaIroha = 227;
+const int CSSValueKatakanaIroha = 228;
+const int CSSValueInline = 229;
+const int CSSValueBlock = 230;
+const int CSSValueListItem = 231;
+const int CSSValueRunIn = 232;
+const int CSSValueCompact = 233;
+const int CSSValueInlineBlock = 234;
+const int CSSValueTable = 235;
+const int CSSValueInlineTable = 236;
+const int CSSValueTableRowGroup = 237;
+const int CSSValueTableHeaderGroup = 238;
+const int CSSValueTableFooterGroup = 239;
+const int CSSValueTableRow = 240;
+const int CSSValueTableColumnGroup = 241;
+const int CSSValueTableColumn = 242;
+const int CSSValueTableCell = 243;
+const int CSSValueTableCaption = 244;
+const int CSSValueWebkitBox = 245;
+const int CSSValueWebkitInlineBox = 246;
+const int CSSValueWapMarquee = 247;
+const int CSSValueAuto = 248;
+const int CSSValueCrosshair = 249;
+const int CSSValueDefault = 250;
+const int CSSValuePointer = 251;
+const int CSSValueMove = 252;
+const int CSSValueVerticalText = 253;
+const int CSSValueCell = 254;
+const int CSSValueContextMenu = 255;
+const int CSSValueAlias = 256;
+const int CSSValueProgress = 257;
+const int CSSValueNoDrop = 258;
+const int CSSValueNotAllowed = 259;
+const int CSSValueWebkitZoomIn = 260;
+const int CSSValueWebkitZoomOut = 261;
+const int CSSValueEResize = 262;
+const int CSSValueNeResize = 263;
+const int CSSValueNwResize = 264;
+const int CSSValueNResize = 265;
+const int CSSValueSeResize = 266;
+const int CSSValueSwResize = 267;
+const int CSSValueSResize = 268;
+const int CSSValueWResize = 269;
+const int CSSValueEwResize = 270;
+const int CSSValueNsResize = 271;
+const int CSSValueNeswResize = 272;
+const int CSSValueNwseResize = 273;
+const int CSSValueColResize = 274;
+const int CSSValueRowResize = 275;
+const int CSSValueText = 276;
+const int CSSValueWait = 277;
+const int CSSValueHelp = 278;
+const int CSSValueAllScroll = 279;
+const int CSSValueWebkitGrab = 280;
+const int CSSValueWebkitGrabbing = 281;
+const int CSSValueLtr = 282;
+const int CSSValueRtl = 283;
+const int CSSValueCapitalize = 284;
+const int CSSValueUppercase = 285;
+const int CSSValueLowercase = 286;
+const int CSSValueVisible = 287;
+const int CSSValueCollapse = 288;
+const int CSSValueAbove = 289;
+const int CSSValueAbsolute = 290;
+const int CSSValueAlways = 291;
+const int CSSValueAvoid = 292;
+const int CSSValueBelow = 293;
+const int CSSValueBidiOverride = 294;
+const int CSSValueBlink = 295;
+const int CSSValueBoth = 296;
+const int CSSValueCloseQuote = 297;
+const int CSSValueCrop = 298;
+const int CSSValueCross = 299;
+const int CSSValueEmbed = 300;
+const int CSSValueFixed = 301;
+const int CSSValueHand = 302;
+const int CSSValueHide = 303;
+const int CSSValueHigher = 304;
+const int CSSValueInvert = 305;
+const int CSSValueLandscape = 306;
+const int CSSValueLevel = 307;
+const int CSSValueLineThrough = 308;
+const int CSSValueLocal = 309;
+const int CSSValueLoud = 310;
+const int CSSValueLower = 311;
+const int CSSValueWebkitMarquee = 312;
+const int CSSValueMix = 313;
+const int CSSValueNoCloseQuote = 314;
+const int CSSValueNoOpenQuote = 315;
+const int CSSValueNowrap = 316;
+const int CSSValueOpenQuote = 317;
+const int CSSValueOverlay = 318;
+const int CSSValueOverline = 319;
+const int CSSValuePortrait = 320;
+const int CSSValuePre = 321;
+const int CSSValuePreLine = 322;
+const int CSSValuePreWrap = 323;
+const int CSSValueRelative = 324;
+const int CSSValueScroll = 325;
+const int CSSValueSeparate = 326;
+const int CSSValueShow = 327;
+const int CSSValueStatic = 328;
+const int CSSValueThick = 329;
+const int CSSValueThin = 330;
+const int CSSValueUnderline = 331;
+const int CSSValueWebkitNowrap = 332;
+const int CSSValueStretch = 333;
+const int CSSValueStart = 334;
+const int CSSValueEnd = 335;
+const int CSSValueReverse = 336;
+const int CSSValueHorizontal = 337;
+const int CSSValueVertical = 338;
+const int CSSValueInlineAxis = 339;
+const int CSSValueBlockAxis = 340;
+const int CSSValueSingle = 341;
+const int CSSValueMultiple = 342;
+const int CSSValueForwards = 343;
+const int CSSValueBackwards = 344;
+const int CSSValueAhead = 345;
+const int CSSValueUp = 346;
+const int CSSValueDown = 347;
+const int CSSValueSlow = 348;
+const int CSSValueFast = 349;
+const int CSSValueInfinite = 350;
+const int CSSValueSlide = 351;
+const int CSSValueAlternate = 352;
+const int CSSValueReadOnly = 353;
+const int CSSValueReadWrite = 354;
+const int CSSValueReadWritePlaintextOnly = 355;
+const int CSSValueElement = 356;
+const int CSSValueIgnore = 357;
+const int CSSValueIntrinsic = 358;
+const int CSSValueMinIntrinsic = 359;
+const int CSSValueClip = 360;
+const int CSSValueEllipsis = 361;
+const int CSSValueDiscard = 362;
+const int CSSValueDotDash = 363;
+const int CSSValueDotDotDash = 364;
+const int CSSValueWave = 365;
+const int CSSValueContinuous = 366;
+const int CSSValueSkipWhiteSpace = 367;
+const int CSSValueBreakAll = 368;
+const int CSSValueBreakWord = 369;
+const int CSSValueSpace = 370;
+const int CSSValueAfterWhiteSpace = 371;
+const int CSSValueCheckbox = 372;
+const int CSSValueRadio = 373;
+const int CSSValuePushButton = 374;
+const int CSSValueSquareButton = 375;
+const int CSSValueButton = 376;
+const int CSSValueButtonBevel = 377;
+const int CSSValueDefaultButton = 378;
+const int CSSValueInnerSpinButton = 379;
+const int CSSValueListButton = 380;
+const int CSSValueListbox = 381;
+const int CSSValueListitem = 382;
+const int CSSValueMediaFullscreenButton = 383;
+const int CSSValueMediaMuteButton = 384;
+const int CSSValueMediaPlayButton = 385;
+const int CSSValueMediaSeekBackButton = 386;
+const int CSSValueMediaSeekForwardButton = 387;
+const int CSSValueMediaRewindButton = 388;
+const int CSSValueMediaReturnToRealtimeButton = 389;
+const int CSSValueMediaToggleClosedCaptionsButton = 390;
+const int CSSValueMediaSlider = 391;
+const int CSSValueMediaSliderthumb = 392;
+const int CSSValueMediaVolumeSliderContainer = 393;
+const int CSSValueMediaVolumeSlider = 394;
+const int CSSValueMediaVolumeSliderthumb = 395;
+const int CSSValueMediaControlsBackground = 396;
+const int CSSValueMediaCurrentTimeDisplay = 397;
+const int CSSValueMediaTimeRemainingDisplay = 398;
+const int CSSValueMenulist = 399;
+const int CSSValueMenulistButton = 400;
+const int CSSValueMenulistText = 401;
+const int CSSValueMenulistTextfield = 402;
+const int CSSValueOuterSpinButton = 403;
+const int CSSValueProgressBar = 404;
+const int CSSValueSliderHorizontal = 405;
+const int CSSValueSliderVertical = 406;
+const int CSSValueSliderthumbHorizontal = 407;
+const int CSSValueSliderthumbVertical = 408;
+const int CSSValueCaret = 409;
+const int CSSValueSearchfield = 410;
+const int CSSValueSearchfieldDecoration = 411;
+const int CSSValueSearchfieldResultsDecoration = 412;
+const int CSSValueSearchfieldResultsButton = 413;
+const int CSSValueSearchfieldCancelButton = 414;
+const int CSSValueTextfield = 415;
+const int CSSValueTextarea = 416;
+const int CSSValueCapsLockIndicator = 417;
+const int CSSValueRound = 418;
+const int CSSValueBorder = 419;
+const int CSSValueBorderBox = 420;
+const int CSSValueContent = 421;
+const int CSSValueContentBox = 422;
+const int CSSValuePadding = 423;
+const int CSSValuePaddingBox = 424;
+const int CSSValueContain = 425;
+const int CSSValueCover = 426;
+const int CSSValueLogical = 427;
+const int CSSValueVisual = 428;
+const int CSSValueLines = 429;
+const int CSSValueRunning = 430;
+const int CSSValuePaused = 431;
+const int CSSValueFlat = 432;
+const int CSSValuePreserve3d = 433;
+const int CSSValueEase = 434;
+const int CSSValueLinear = 435;
+const int CSSValueEaseIn = 436;
+const int CSSValueEaseOut = 437;
+const int CSSValueEaseInOut = 438;
+const int CSSValueDocument = 439;
+const int CSSValueReset = 440;
+const int CSSValueVisiblepainted = 441;
+const int CSSValueVisiblefill = 442;
+const int CSSValueVisiblestroke = 443;
+const int CSSValuePainted = 444;
+const int CSSValueFill = 445;
+const int CSSValueStroke = 446;
+const int CSSValueAntialiased = 447;
+const int CSSValueSubpixelAntialiased = 448;
+const int CSSValueOptimizespeed = 449;
+const int CSSValueOptimizelegibility = 450;
+const int CSSValueGeometricprecision = 451;
+const int CSSValueSrgb = 452;
+const int CSSValueMini = 453;
+const int CSSValueFloating = 454;
+const int CSSValueApplication = 455;
+const int CSSValueFullscreen = 456;
+const int CSSValueAliceblue = 457;
+const int CSSValueAntiquewhite = 458;
+const int CSSValueAquamarine = 459;
+const int CSSValueAzure = 460;
+const int CSSValueBeige = 461;
+const int CSSValueBisque = 462;
+const int CSSValueBlanchedalmond = 463;
+const int CSSValueBlueviolet = 464;
+const int CSSValueBrown = 465;
+const int CSSValueBurlywood = 466;
+const int CSSValueCadetblue = 467;
+const int CSSValueChartreuse = 468;
+const int CSSValueChocolate = 469;
+const int CSSValueCoral = 470;
+const int CSSValueCornflowerblue = 471;
+const int CSSValueCornsilk = 472;
+const int CSSValueCrimson = 473;
+const int CSSValueCyan = 474;
+const int CSSValueDarkblue = 475;
+const int CSSValueDarkcyan = 476;
+const int CSSValueDarkgoldenrod = 477;
+const int CSSValueDarkgray = 478;
+const int CSSValueDarkgreen = 479;
+const int CSSValueDarkgrey = 480;
+const int CSSValueDarkkhaki = 481;
+const int CSSValueDarkmagenta = 482;
+const int CSSValueDarkolivegreen = 483;
+const int CSSValueDarkorange = 484;
+const int CSSValueDarkorchid = 485;
+const int CSSValueDarkred = 486;
+const int CSSValueDarksalmon = 487;
+const int CSSValueDarkseagreen = 488;
+const int CSSValueDarkslateblue = 489;
+const int CSSValueDarkslategray = 490;
+const int CSSValueDarkslategrey = 491;
+const int CSSValueDarkturquoise = 492;
+const int CSSValueDarkviolet = 493;
+const int CSSValueDeeppink = 494;
+const int CSSValueDeepskyblue = 495;
+const int CSSValueDimgray = 496;
+const int CSSValueDimgrey = 497;
+const int CSSValueDodgerblue = 498;
+const int CSSValueFirebrick = 499;
+const int CSSValueFloralwhite = 500;
+const int CSSValueForestgreen = 501;
+const int CSSValueGainsboro = 502;
+const int CSSValueGhostwhite = 503;
+const int CSSValueGold = 504;
+const int CSSValueGoldenrod = 505;
+const int CSSValueGreenyellow = 506;
+const int CSSValueHoneydew = 507;
+const int CSSValueHotpink = 508;
+const int CSSValueIndianred = 509;
+const int CSSValueIndigo = 510;
+const int CSSValueIvory = 511;
+const int CSSValueKhaki = 512;
+const int CSSValueLavender = 513;
+const int CSSValueLavenderblush = 514;
+const int CSSValueLawngreen = 515;
+const int CSSValueLemonchiffon = 516;
+const int CSSValueLightblue = 517;
+const int CSSValueLightcoral = 518;
+const int CSSValueLightcyan = 519;
+const int CSSValueLightgoldenrodyellow = 520;
+const int CSSValueLightgray = 521;
+const int CSSValueLightgreen = 522;
+const int CSSValueLightgrey = 523;
+const int CSSValueLightpink = 524;
+const int CSSValueLightsalmon = 525;
+const int CSSValueLightseagreen = 526;
+const int CSSValueLightskyblue = 527;
+const int CSSValueLightslategray = 528;
+const int CSSValueLightslategrey = 529;
+const int CSSValueLightsteelblue = 530;
+const int CSSValueLightyellow = 531;
+const int CSSValueLimegreen = 532;
+const int CSSValueLinen = 533;
+const int CSSValueMagenta = 534;
+const int CSSValueMediumaquamarine = 535;
+const int CSSValueMediumblue = 536;
+const int CSSValueMediumorchid = 537;
+const int CSSValueMediumpurple = 538;
+const int CSSValueMediumseagreen = 539;
+const int CSSValueMediumslateblue = 540;
+const int CSSValueMediumspringgreen = 541;
+const int CSSValueMediumturquoise = 542;
+const int CSSValueMediumvioletred = 543;
+const int CSSValueMidnightblue = 544;
+const int CSSValueMintcream = 545;
+const int CSSValueMistyrose = 546;
+const int CSSValueMoccasin = 547;
+const int CSSValueNavajowhite = 548;
+const int CSSValueOldlace = 549;
+const int CSSValueOlivedrab = 550;
+const int CSSValueOrangered = 551;
+const int CSSValueOrchid = 552;
+const int CSSValuePalegoldenrod = 553;
+const int CSSValuePalegreen = 554;
+const int CSSValuePaleturquoise = 555;
+const int CSSValuePalevioletred = 556;
+const int CSSValuePapayawhip = 557;
+const int CSSValuePeachpuff = 558;
+const int CSSValuePeru = 559;
+const int CSSValuePink = 560;
+const int CSSValuePlum = 561;
+const int CSSValuePowderblue = 562;
+const int CSSValueRosybrown = 563;
+const int CSSValueRoyalblue = 564;
+const int CSSValueSaddlebrown = 565;
+const int CSSValueSalmon = 566;
+const int CSSValueSandybrown = 567;
+const int CSSValueSeagreen = 568;
+const int CSSValueSeashell = 569;
+const int CSSValueSienna = 570;
+const int CSSValueSkyblue = 571;
+const int CSSValueSlateblue = 572;
+const int CSSValueSlategray = 573;
+const int CSSValueSlategrey = 574;
+const int CSSValueSnow = 575;
+const int CSSValueSpringgreen = 576;
+const int CSSValueSteelblue = 577;
+const int CSSValueTan = 578;
+const int CSSValueThistle = 579;
+const int CSSValueTomato = 580;
+const int CSSValueTurquoise = 581;
+const int CSSValueViolet = 582;
+const int CSSValueWheat = 583;
+const int CSSValueWhitesmoke = 584;
+const int CSSValueYellowgreen = 585;
+const int CSSValueNonzero = 586;
+const int CSSValueEvenodd = 587;
+const int CSSValueAccumulate = 588;
+const int CSSValueNew = 589;
+const int CSSValueLinearrgb = 590;
+const int CSSValueOptimizequality = 591;
+const int CSSValueCrispedges = 592;
+const int CSSValueButt = 593;
+const int CSSValueMiter = 594;
+const int CSSValueBevel = 595;
+const int CSSValueBeforeEdge = 596;
+const int CSSValueAfterEdge = 597;
+const int CSSValueCentral = 598;
+const int CSSValueTextBeforeEdge = 599;
+const int CSSValueTextAfterEdge = 600;
+const int CSSValueIdeographic = 601;
+const int CSSValueAlphabetic = 602;
+const int CSSValueHanging = 603;
+const int CSSValueMathematical = 604;
+const int CSSValueUseScript = 605;
+const int CSSValueNoChange = 606;
+const int CSSValueResetSize = 607;
+const int CSSValueLrTb = 608;
+const int CSSValueRlTb = 609;
+const int CSSValueTbRl = 610;
+const int CSSValueLr = 611;
+const int CSSValueRl = 612;
+const int CSSValueTb = 613;
+const int numCSSValueKeywords = 614;
+const size_t maxCSSValueKeywordLength = 35;
 
 const char* getValueName(unsigned short id);
 
diff --git a/src/3rdparty/webkit/WebCore/generated/ColorData.c b/src/3rdparty/webkit/WebCore/generated/ColorData.c
index 5d64dda558..4fb1beae49 100644
--- a/src/3rdparty/webkit/WebCore/generated/ColorData.c
+++ b/src/3rdparty/webkit/WebCore/generated/ColorData.c
@@ -1,4 +1,4 @@
-/* ANSI-C code produced by gperf version 3.0.3 */
+/* ANSI-C code produced by gperf version 3.0.1 */
 /* Command-line: gperf -CDEot -L ANSI-C --includes --key-positions='*' -N findColor -D -s 2  */
 
 #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \
@@ -141,9 +141,6 @@ hash (register const char *str, register unsigned int len)
 
 #ifdef __GNUC__
 __inline
-#ifdef __GNUC_STDC_INLINE__
-__attribute__ ((__gnu_inline__))
-#endif
 #endif
 const struct NamedColor *
 findColor (register const char *str, register unsigned int len)
diff --git a/src/3rdparty/webkit/WebCore/generated/DatePrototype.lut.h b/src/3rdparty/webkit/WebCore/generated/DatePrototype.lut.h
deleted file mode 100644
index 507cf91549..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/DatePrototype.lut.h
+++ /dev/null
@@ -1,59 +0,0 @@
-// Automatically generated from ../../JavaScriptCore/runtime/DatePrototype.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
-
-#include "Lookup.h"
-
-namespace JSC {
-
-static const struct HashTableValue dateTableValues[47] = {
-   { "toString", DontEnum|Function, (intptr_t)dateProtoFuncToString, (intptr_t)0 },
-   { "toISOString", DontEnum|Function, (intptr_t)dateProtoFuncToISOString, (intptr_t)0 },
-   { "toUTCString", DontEnum|Function, (intptr_t)dateProtoFuncToUTCString, (intptr_t)0 },
-   { "toDateString", DontEnum|Function, (intptr_t)dateProtoFuncToDateString, (intptr_t)0 },
-   { "toTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToTimeString, (intptr_t)0 },
-   { "toLocaleString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleString, (intptr_t)0 },
-   { "toLocaleDateString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleDateString, (intptr_t)0 },
-   { "toLocaleTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleTimeString, (intptr_t)0 },
-   { "valueOf", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
-   { "getTime", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
-   { "getFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetFullYear, (intptr_t)0 },
-   { "getUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCFullYear, (intptr_t)0 },
-   { "toGMTString", DontEnum|Function, (intptr_t)dateProtoFuncToGMTString, (intptr_t)0 },
-   { "getMonth", DontEnum|Function, (intptr_t)dateProtoFuncGetMonth, (intptr_t)0 },
-   { "getUTCMonth", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCMonth, (intptr_t)0 },
-   { "getDate", DontEnum|Function, (intptr_t)dateProtoFuncGetDate, (intptr_t)0 },
-   { "getUTCDate", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCDate, (intptr_t)0 },
-   { "getDay", DontEnum|Function, (intptr_t)dateProtoFuncGetDay, (intptr_t)0 },
-   { "getUTCDay", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCDay, (intptr_t)0 },
-   { "getHours", DontEnum|Function, (intptr_t)dateProtoFuncGetHours, (intptr_t)0 },
-   { "getUTCHours", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCHours, (intptr_t)0 },
-   { "getMinutes", DontEnum|Function, (intptr_t)dateProtoFuncGetMinutes, (intptr_t)0 },
-   { "getUTCMinutes", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCMinutes, (intptr_t)0 },
-   { "getSeconds", DontEnum|Function, (intptr_t)dateProtoFuncGetSeconds, (intptr_t)0 },
-   { "getUTCSeconds", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCSeconds, (intptr_t)0 },
-   { "getMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncGetMilliSeconds, (intptr_t)0 },
-   { "getUTCMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCMilliseconds, (intptr_t)0 },
-   { "getTimezoneOffset", DontEnum|Function, (intptr_t)dateProtoFuncGetTimezoneOffset, (intptr_t)0 },
-   { "setTime", DontEnum|Function, (intptr_t)dateProtoFuncSetTime, (intptr_t)1 },
-   { "setMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncSetMilliSeconds, (intptr_t)1 },
-   { "setUTCMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCMilliseconds, (intptr_t)1 },
-   { "setSeconds", DontEnum|Function, (intptr_t)dateProtoFuncSetSeconds, (intptr_t)2 },
-   { "setUTCSeconds", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCSeconds, (intptr_t)2 },
-   { "setMinutes", DontEnum|Function, (intptr_t)dateProtoFuncSetMinutes, (intptr_t)3 },
-   { "setUTCMinutes", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCMinutes, (intptr_t)3 },
-   { "setHours", DontEnum|Function, (intptr_t)dateProtoFuncSetHours, (intptr_t)4 },
-   { "setUTCHours", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCHours, (intptr_t)4 },
-   { "setDate", DontEnum|Function, (intptr_t)dateProtoFuncSetDate, (intptr_t)1 },
-   { "setUTCDate", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCDate, (intptr_t)1 },
-   { "setMonth", DontEnum|Function, (intptr_t)dateProtoFuncSetMonth, (intptr_t)2 },
-   { "setUTCMonth", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCMonth, (intptr_t)2 },
-   { "setFullYear", DontEnum|Function, (intptr_t)dateProtoFuncSetFullYear, (intptr_t)3 },
-   { "setUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCFullYear, (intptr_t)3 },
-   { "setYear", DontEnum|Function, (intptr_t)dateProtoFuncSetYear, (intptr_t)1 },
-   { "getYear", DontEnum|Function, (intptr_t)dateProtoFuncGetYear, (intptr_t)0 },
-   { "toJSON", DontEnum|Function, (intptr_t)dateProtoFuncToJSON, (intptr_t)0 },
-   { 0, 0, 0, 0 }
-};
-
-extern JSC_CONST_HASHTABLE HashTable dateTable =
-    { 134, 127, dateTableValues, 0 };
-} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/DocTypeStrings.cpp b/src/3rdparty/webkit/WebCore/generated/DocTypeStrings.cpp
index d69b1b6c8e..2aab9b9010 100644
--- a/src/3rdparty/webkit/WebCore/generated/DocTypeStrings.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/DocTypeStrings.cpp
@@ -1,4 +1,4 @@
-/* ANSI-C code produced by gperf version 3.0.3 */
+/* ANSI-C code produced by gperf version 3.0.1 */
 /* Command-line: gperf -CEot -L ANSI-C --includes --key-positions='*' -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards  */
 
 #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \
@@ -331,9 +331,6 @@ hash (register const char *str, register unsigned int len)
 
 #ifdef __GNUC__
 __inline
-#ifdef __GNUC_STDC_INLINE__
-__attribute__ ((__gnu_inline__))
-#endif
 #endif
 const struct PubIDInfo *
 findDoctypeEntry (register const char *str, register unsigned int len)
diff --git a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
deleted file mode 100644
index 95fc52dda9..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
+++ /dev/null
@@ -1,5607 +0,0 @@
-
-/* A Bison parser, made by GNU Bison 2.4.1.  */
-
-/* Skeleton implementation for Bison's Yacc-like parsers in C
-   
-      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
-   Free Software Foundation, Inc.
-   
-   This program is free software: you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-   
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-   
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
-
-/* As a special exception, you may create a larger work that contains
-   part or all of the Bison parser skeleton and distribute that work
-   under terms of your choice, so long as that work isn't itself a
-   parser generator using the skeleton or a modified version thereof
-   as a parser skeleton.  Alternatively, if you modify or redistribute
-   the parser skeleton itself, you may (at your option) remove this
-   special exception, which will cause the skeleton and the resulting
-   Bison output files to be licensed under the GNU General Public
-   License without this special exception.
-   
-   This special exception was added by the Free Software Foundation in
-   version 2.2 of Bison.  */
-
-/* C LALR(1) parser skeleton written by Richard Stallman, by
-   simplifying the original so-called "semantic" parser.  */
-
-/* All symbols defined below should begin with yy or YY, to avoid
-   infringing on user name space.  This should be done even for local
-   variables, as they might otherwise be expanded by user macros.
-   There are some unavoidable exceptions within include files to
-   define necessary library symbols; they are noted "INFRINGES ON
-   USER NAME SPACE" below.  */
-
-/* Identify Bison output.  */
-#define YYBISON 1
-
-/* Bison version.  */
-#define YYBISON_VERSION "2.4.1"
-
-/* Skeleton name.  */
-#define YYSKELETON_NAME "yacc.c"
-
-/* Pure parsers.  */
-#define YYPURE 1
-
-/* Push parsers.  */
-#define YYPUSH 0
-
-/* Pull parsers.  */
-#define YYPULL 1
-
-/* Using locations.  */
-#define YYLSP_NEEDED 1
-
-/* Substitute the variable and function names.  */
-#define yyparse         jscyyparse
-#define yylex           jscyylex
-#define yyerror         jscyyerror
-#define yylval          jscyylval
-#define yychar          jscyychar
-#define yydebug         jscyydebug
-#define yynerrs         jscyynerrs
-#define yylloc          jscyylloc
-
-/* Copy the first part of user declarations.  */
-
-/* Line 189 of yacc.c  */
-#line 3 "../../JavaScriptCore/parser/Grammar.y"
-
-
-/*
- *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
- *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
-
-#include "config.h"
-
-#include "JSObject.h"
-#include "JSString.h"
-#include "Lexer.h"
-#include "NodeConstructors.h"
-#include "NodeInfo.h"
-#include <stdlib.h>
-#include <string.h>
-#include <wtf/MathExtras.h>
-
-#define YYMALLOC fastMalloc
-#define YYFREE fastFree
-
-#define YYMAXDEPTH 10000
-#define YYENABLE_NLS 0
-
-// Default values for bison.
-#define YYDEBUG 0 // Set to 1 to debug a parse error.
-#define jscyydebug 0 // Set to 1 to debug a parse error.
-#if !PLATFORM(DARWIN)
-// Avoid triggering warnings in older bison by not setting this on the Darwin platform.
-// FIXME: Is this still needed?
-#define YYERROR_VERBOSE
-#endif
-
-int jscyyerror(const char*);
-
-static inline bool allowAutomaticSemicolon(JSC::Lexer&, int);
-
-#define GLOBAL_DATA static_cast<JSGlobalData*>(globalPtr)
-#define AUTO_SEMICOLON do { if (!allowAutomaticSemicolon(*GLOBAL_DATA->lexer, yychar)) YYABORT; } while (0)
-
-using namespace JSC;
-using namespace std;
-
-static ExpressionNode* makeAssignNode(JSGlobalData*, ExpressionNode* left, Operator, ExpressionNode* right, bool leftHasAssignments, bool rightHasAssignments, int start, int divot, int end);
-static ExpressionNode* makePrefixNode(JSGlobalData*, ExpressionNode*, Operator, int start, int divot, int end);
-static ExpressionNode* makePostfixNode(JSGlobalData*, ExpressionNode*, Operator, int start, int divot, int end);
-static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData*, const Identifier& getOrSet, const Identifier& name, ParameterNode*, FunctionBodyNode*, const SourceCode&);
-static ExpressionNodeInfo makeFunctionCallNode(JSGlobalData*, ExpressionNodeInfo function, ArgumentsNodeInfo, int start, int divot, int end);
-static ExpressionNode* makeTypeOfNode(JSGlobalData*, ExpressionNode*);
-static ExpressionNode* makeDeleteNode(JSGlobalData*, ExpressionNode*, int start, int divot, int end);
-static ExpressionNode* makeNegateNode(JSGlobalData*, ExpressionNode*);
-static NumberNode* makeNumberNode(JSGlobalData*, double);
-static ExpressionNode* makeBitwiseNotNode(JSGlobalData*, ExpressionNode*);
-static ExpressionNode* makeMultNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static ExpressionNode* makeDivNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static ExpressionNode* makeAddNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static ExpressionNode* makeSubNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static ExpressionNode* makeLeftShiftNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static ExpressionNode* makeRightShiftNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static StatementNode* makeVarStatementNode(JSGlobalData*, ExpressionNode*);
-static ExpressionNode* combineCommaNodes(JSGlobalData*, ExpressionNode* list, ExpressionNode* init);
-
-#if COMPILER(MSVC)
-
-#pragma warning(disable: 4065)
-#pragma warning(disable: 4244)
-#pragma warning(disable: 4702)
-
-#endif
-
-#define YYPARSE_PARAM globalPtr
-#define YYLEX_PARAM globalPtr
-
-template <typename T> inline NodeDeclarationInfo<T> createNodeDeclarationInfo(T node,
-    ParserArenaData<DeclarationStacks::VarStack>* varDecls,
-    ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
-    CodeFeatures info, int numConstants) 
-{
-    ASSERT((info & ~AllFeatures) == 0);
-    NodeDeclarationInfo<T> result = { node, varDecls, funcDecls, info, numConstants };
-    return result;
-}
-
-template <typename T> inline NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
-{
-    ASSERT((info & ~AllFeatures) == 0);
-    NodeInfo<T> result = { node, info, numConstants };
-    return result;
-}
-
-template <typename T> inline T mergeDeclarationLists(T decls1, T decls2) 
-{
-    // decls1 or both are null
-    if (!decls1)
-        return decls2;
-    // only decls1 is non-null
-    if (!decls2)
-        return decls1;
-
-    // Both are non-null
-    decls1->data.append(decls2->data);
-    
-    // Manually release as much as possible from the now-defunct declaration lists
-    // to avoid accumulating so many unused heap allocated vectors.
-    decls2->data.clear();
-
-    return decls1;
-}
-
-static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
-{
-    if (!varDecls)
-        varDecls = new (globalData) ParserArenaData<DeclarationStacks::VarStack>;
-
-    varDecls->data.append(make_pair(&ident, attrs));
-}
-
-static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
-{
-    unsigned attrs = DeclarationStacks::IsConstant;
-    if (decl->hasInitializer())
-        attrs |= DeclarationStacks::HasInitializer;        
-    appendToVarDeclarationList(globalData, varDecls, decl->ident(), attrs);
-}
-
-
-
-/* Line 189 of yacc.c  */
-#line 225 "WebCore/tmp/../generated/Grammar.tab.c"
-
-/* Enabling traces.  */
-#ifndef YYDEBUG
-# define YYDEBUG 0
-#endif
-
-/* Enabling verbose error messages.  */
-#ifdef YYERROR_VERBOSE
-# undef YYERROR_VERBOSE
-# define YYERROR_VERBOSE 1
-#else
-# define YYERROR_VERBOSE 0
-#endif
-
-/* Enabling the token table.  */
-#ifndef YYTOKEN_TABLE
-# define YYTOKEN_TABLE 0
-#endif
-
-
-/* Tokens.  */
-#ifndef YYTOKENTYPE
-# define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     NULLTOKEN = 258,
-     TRUETOKEN = 259,
-     FALSETOKEN = 260,
-     BREAK = 261,
-     CASE = 262,
-     DEFAULT = 263,
-     FOR = 264,
-     NEW = 265,
-     VAR = 266,
-     CONSTTOKEN = 267,
-     CONTINUE = 268,
-     FUNCTION = 269,
-     RETURN = 270,
-     VOIDTOKEN = 271,
-     DELETETOKEN = 272,
-     IF = 273,
-     THISTOKEN = 274,
-     DO = 275,
-     WHILE = 276,
-     INTOKEN = 277,
-     INSTANCEOF = 278,
-     TYPEOF = 279,
-     SWITCH = 280,
-     WITH = 281,
-     RESERVED = 282,
-     THROW = 283,
-     TRY = 284,
-     CATCH = 285,
-     FINALLY = 286,
-     DEBUGGER = 287,
-     IF_WITHOUT_ELSE = 288,
-     ELSE = 289,
-     EQEQ = 290,
-     NE = 291,
-     STREQ = 292,
-     STRNEQ = 293,
-     LE = 294,
-     GE = 295,
-     OR = 296,
-     AND = 297,
-     PLUSPLUS = 298,
-     MINUSMINUS = 299,
-     LSHIFT = 300,
-     RSHIFT = 301,
-     URSHIFT = 302,
-     PLUSEQUAL = 303,
-     MINUSEQUAL = 304,
-     MULTEQUAL = 305,
-     DIVEQUAL = 306,
-     LSHIFTEQUAL = 307,
-     RSHIFTEQUAL = 308,
-     URSHIFTEQUAL = 309,
-     ANDEQUAL = 310,
-     MODEQUAL = 311,
-     XOREQUAL = 312,
-     OREQUAL = 313,
-     OPENBRACE = 314,
-     CLOSEBRACE = 315,
-     NUMBER = 316,
-     IDENT = 317,
-     STRING = 318,
-     AUTOPLUSPLUS = 319,
-     AUTOMINUSMINUS = 320
-   };
-#endif
-
-
-
-#if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
-typedef union YYSTYPE
-{
-
-/* Line 214 of yacc.c  */
-#line 146 "../../JavaScriptCore/parser/Grammar.y"
-
-    int                 intValue;
-    double              doubleValue;
-    const Identifier*   ident;
-
-    // expression subtrees
-    ExpressionNodeInfo  expressionNode;
-    FuncDeclNodeInfo    funcDeclNode;
-    PropertyNodeInfo    propertyNode;
-    ArgumentsNodeInfo   argumentsNode;
-    ConstDeclNodeInfo   constDeclNode;
-    CaseBlockNodeInfo   caseBlockNode;
-    CaseClauseNodeInfo  caseClauseNode;
-    FuncExprNodeInfo    funcExprNode;
-
-    // statement nodes
-    StatementNodeInfo   statementNode;
-    FunctionBodyNode*   functionBodyNode;
-    ProgramNode*        programNode;
-
-    SourceElementsInfo  sourceElements;
-    PropertyListInfo    propertyList;
-    ArgumentListInfo    argumentList;
-    VarDeclListInfo     varDeclList;
-    ConstDeclListInfo   constDeclList;
-    ClauseListInfo      clauseList;
-    ElementListInfo     elementList;
-    ParameterListInfo   parameterList;
-
-    Operator            op;
-
-
-
-/* Line 214 of yacc.c  */
-#line 360 "WebCore/tmp/../generated/Grammar.tab.c"
-} YYSTYPE;
-# define YYSTYPE_IS_TRIVIAL 1
-# define yystype YYSTYPE /* obsolescent; will be withdrawn */
-# define YYSTYPE_IS_DECLARED 1
-#endif
-
-#if ! defined YYLTYPE && ! defined YYLTYPE_IS_DECLARED
-typedef struct YYLTYPE
-{
-  int first_line;
-  int first_column;
-  int last_line;
-  int last_column;
-} YYLTYPE;
-# define yyltype YYLTYPE /* obsolescent; will be withdrawn */
-# define YYLTYPE_IS_DECLARED 1
-# define YYLTYPE_IS_TRIVIAL 1
-#endif
-
-
-/* Copy the second part of user declarations.  */
-
-/* Line 264 of yacc.c  */
-#line 178 "../../JavaScriptCore/parser/Grammar.y"
-
-
-template <typename T> inline void setStatementLocation(StatementNode* statement, const T& start, const T& end)
-{
-    statement->setLoc(start.first_line, end.last_line);
-}
-
-static inline void setExceptionLocation(ThrowableExpressionData* node, unsigned start, unsigned divot, unsigned end)
-{
-    node->setExceptionSourceCode(divot, divot - start, end - divot);
-}
-
-
-
-/* Line 264 of yacc.c  */
-#line 400 "WebCore/tmp/../generated/Grammar.tab.c"
-
-#ifdef short
-# undef short
-#endif
-
-#ifdef YYTYPE_UINT8
-typedef YYTYPE_UINT8 yytype_uint8;
-#else
-typedef unsigned char yytype_uint8;
-#endif
-
-#ifdef YYTYPE_INT8
-typedef YYTYPE_INT8 yytype_int8;
-#elif (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-typedef signed char yytype_int8;
-#else
-typedef short int yytype_int8;
-#endif
-
-#ifdef YYTYPE_UINT16
-typedef YYTYPE_UINT16 yytype_uint16;
-#else
-typedef unsigned short int yytype_uint16;
-#endif
-
-#ifdef YYTYPE_INT16
-typedef YYTYPE_INT16 yytype_int16;
-#else
-typedef short int yytype_int16;
-#endif
-
-#ifndef YYSIZE_T
-# ifdef __SIZE_TYPE__
-#  define YYSIZE_T __SIZE_TYPE__
-# elif defined size_t
-#  define YYSIZE_T size_t
-# elif ! defined YYSIZE_T && (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-#  include <stddef.h> /* INFRINGES ON USER NAME SPACE */
-#  define YYSIZE_T size_t
-# else
-#  define YYSIZE_T unsigned int
-# endif
-#endif
-
-#define YYSIZE_MAXIMUM ((YYSIZE_T) -1)
-
-#ifndef YY_
-# if YYENABLE_NLS
-#  if ENABLE_NLS
-#   include <libintl.h> /* INFRINGES ON USER NAME SPACE */
-#   define YY_(msgid) dgettext ("bison-runtime", msgid)
-#  endif
-# endif
-# ifndef YY_
-#  define YY_(msgid) msgid
-# endif
-#endif
-
-/* Suppress unused-variable warnings by "using" E.  */
-#if ! defined lint || defined __GNUC__
-# define YYUSE(e) ((void) (e))
-#else
-# define YYUSE(e) /* empty */
-#endif
-
-/* Identity function, used to suppress warnings about constant conditions.  */
-#ifndef lint
-# define YYID(n) (n)
-#else
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static int
-YYID (int yyi)
-#else
-static int
-YYID (yyi)
-    int yyi;
-#endif
-{
-  return yyi;
-}
-#endif
-
-#if ! defined yyoverflow || YYERROR_VERBOSE
-
-/* The parser invokes alloca or malloc; define the necessary symbols.  */
-
-# ifdef YYSTACK_USE_ALLOCA
-#  if YYSTACK_USE_ALLOCA
-#   ifdef __GNUC__
-#    define YYSTACK_ALLOC __builtin_alloca
-#   elif defined __BUILTIN_VA_ARG_INCR
-#    include <alloca.h> /* INFRINGES ON USER NAME SPACE */
-#   elif defined _AIX
-#    define YYSTACK_ALLOC __alloca
-#   elif defined _MSC_VER
-#    include <malloc.h> /* INFRINGES ON USER NAME SPACE */
-#    define alloca _alloca
-#   else
-#    define YYSTACK_ALLOC alloca
-#    if ! defined _ALLOCA_H && ! defined _STDLIB_H && (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-#     include <stdlib.h> /* INFRINGES ON USER NAME SPACE */
-#     ifndef _STDLIB_H
-#      define _STDLIB_H 1
-#     endif
-#    endif
-#   endif
-#  endif
-# endif
-
-# ifdef YYSTACK_ALLOC
-   /* Pacify GCC's `empty if-body' warning.  */
-#  define YYSTACK_FREE(Ptr) do { /* empty */; } while (YYID (0))
-#  ifndef YYSTACK_ALLOC_MAXIMUM
-    /* The OS might guarantee only one guard page at the bottom of the stack,
-       and a page size can be as small as 4096 bytes.  So we cannot safely
-       invoke alloca (N) if N exceeds 4096.  Use a slightly smaller number
-       to allow for a few compiler-allocated temporary stack slots.  */
-#   define YYSTACK_ALLOC_MAXIMUM 4032 /* reasonable circa 2006 */
-#  endif
-# else
-#  define YYSTACK_ALLOC YYMALLOC
-#  define YYSTACK_FREE YYFREE
-#  ifndef YYSTACK_ALLOC_MAXIMUM
-#   define YYSTACK_ALLOC_MAXIMUM YYSIZE_MAXIMUM
-#  endif
-#  if (defined __cplusplus && ! defined _STDLIB_H \
-       && ! ((defined YYMALLOC || defined malloc) \
-	     && (defined YYFREE || defined free)))
-#   include <stdlib.h> /* INFRINGES ON USER NAME SPACE */
-#   ifndef _STDLIB_H
-#    define _STDLIB_H 1
-#   endif
-#  endif
-#  ifndef YYMALLOC
-#   define YYMALLOC malloc
-#   if ! defined malloc && ! defined _STDLIB_H && (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-void *malloc (YYSIZE_T); /* INFRINGES ON USER NAME SPACE */
-#   endif
-#  endif
-#  ifndef YYFREE
-#   define YYFREE free
-#   if ! defined free && ! defined _STDLIB_H && (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-void free (void *); /* INFRINGES ON USER NAME SPACE */
-#   endif
-#  endif
-# endif
-#endif /* ! defined yyoverflow || YYERROR_VERBOSE */
-
-
-#if (! defined yyoverflow \
-     && (! defined __cplusplus \
-	 || (defined YYLTYPE_IS_TRIVIAL && YYLTYPE_IS_TRIVIAL \
-	     && defined YYSTYPE_IS_TRIVIAL && YYSTYPE_IS_TRIVIAL)))
-
-/* A type that is properly aligned for any stack member.  */
-union yyalloc
-{
-  yytype_int16 yyss_alloc;
-  YYSTYPE yyvs_alloc;
-  YYLTYPE yyls_alloc;
-};
-
-/* The size of the maximum gap between one aligned stack and the next.  */
-# define YYSTACK_GAP_MAXIMUM (sizeof (union yyalloc) - 1)
-
-/* The size of an array large to enough to hold all stacks, each with
-   N elements.  */
-# define YYSTACK_BYTES(N) \
-     ((N) * (sizeof (yytype_int16) + sizeof (YYSTYPE) + sizeof (YYLTYPE)) \
-      + 2 * YYSTACK_GAP_MAXIMUM)
-
-/* Copy COUNT objects from FROM to TO.  The source and destination do
-   not overlap.  */
-# ifndef YYCOPY
-#  if defined __GNUC__ && 1 < __GNUC__
-#   define YYCOPY(To, From, Count) \
-      __builtin_memcpy (To, From, (Count) * sizeof (*(From)))
-#  else
-#   define YYCOPY(To, From, Count)		\
-      do					\
-	{					\
-	  YYSIZE_T yyi;				\
-	  for (yyi = 0; yyi < (Count); yyi++)	\
-	    (To)[yyi] = (From)[yyi];		\
-	}					\
-      while (YYID (0))
-#  endif
-# endif
-
-/* Relocate STACK from its old location to the new one.  The
-   local variables YYSIZE and YYSTACKSIZE give the old and new number of
-   elements in the stack, and YYPTR gives the new location of the
-   stack.  Advance YYPTR to a properly aligned location for the next
-   stack.  */
-# define YYSTACK_RELOCATE(Stack_alloc, Stack)				\
-    do									\
-      {									\
-	YYSIZE_T yynewbytes;						\
-	YYCOPY (&yyptr->Stack_alloc, Stack, yysize);			\
-	Stack = &yyptr->Stack_alloc;					\
-	yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \
-	yyptr += yynewbytes / sizeof (*yyptr);				\
-      }									\
-    while (YYID (0))
-
-#endif
-
-/* YYFINAL -- State number of the termination state.  */
-#define YYFINAL  206
-/* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   2349
-
-/* YYNTOKENS -- Number of terminals.  */
-#define YYNTOKENS  88
-/* YYNNTS -- Number of nonterminals.  */
-#define YYNNTS  194
-/* YYNRULES -- Number of rules.  */
-#define YYNRULES  597
-/* YYNRULES -- Number of states.  */
-#define YYNSTATES  1082
-
-/* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX.  */
-#define YYUNDEFTOK  2
-#define YYMAXUTOK   320
-
-#define YYTRANSLATE(YYX)						\
-  ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK)
-
-/* YYTRANSLATE[YYLEX] -- Bison symbol number corresponding to YYLEX.  */
-static const yytype_uint8 yytranslate[] =
-{
-       0,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,    77,     2,     2,     2,    79,    82,     2,
-      68,    69,    78,    74,    70,    75,    73,    66,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,    67,    87,
-      80,    86,    81,    85,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,    71,     2,    72,    83,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,    84,     2,    76,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     1,     2,     3,     4,
-       5,     6,     7,     8,     9,    10,    11,    12,    13,    14,
-      15,    16,    17,    18,    19,    20,    21,    22,    23,    24,
-      25,    26,    27,    28,    29,    30,    31,    32,    33,    34,
-      35,    36,    37,    38,    39,    40,    41,    42,    43,    44,
-      45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
-      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
-      65
-};
-
-#if YYDEBUG
-/* YYPRHS[YYN] -- Index of the first RHS symbol of rule number YYN in
-   YYRHS.  */
-static const yytype_uint16 yyprhs[] =
-{
-       0,     0,     3,     5,     7,     9,    11,    13,    15,    17,
-      21,    25,    29,    37,    46,    48,    52,    54,    57,    61,
-      66,    68,    70,    72,    74,    78,    82,    86,    92,    95,
-     100,   101,   103,   105,   108,   110,   112,   117,   121,   125,
-     127,   132,   136,   140,   142,   145,   147,   150,   153,   156,
-     161,   165,   168,   171,   176,   180,   183,   187,   189,   193,
-     195,   197,   199,   201,   203,   206,   209,   211,   214,   217,
-     220,   223,   226,   229,   232,   235,   238,   241,   244,   247,
-     250,   252,   254,   256,   258,   260,   264,   268,   272,   274,
-     278,   282,   286,   288,   292,   296,   298,   302,   306,   308,
-     312,   316,   320,   322,   326,   330,   334,   336,   340,   344,
-     348,   352,   356,   360,   362,   366,   370,   374,   378,   382,
-     384,   388,   392,   396,   400,   404,   408,   410,   414,   418,
-     422,   426,   428,   432,   436,   440,   444,   446,   450,   454,
-     458,   462,   464,   468,   470,   474,   476,   480,   482,   486,
-     488,   492,   494,   498,   500,   504,   506,   510,   512,   516,
-     518,   522,   524,   528,   530,   534,   536,   540,   542,   546,
-     548,   552,   554,   560,   562,   568,   570,   576,   578,   582,
-     584,   588,   590,   594,   596,   598,   600,   602,   604,   606,
-     608,   610,   612,   614,   616,   618,   620,   624,   626,   630,
-     632,   636,   638,   640,   642,   644,   646,   648,   650,   652,
-     654,   656,   658,   660,   662,   664,   666,   668,   670,   673,
-     677,   681,   685,   687,   690,   694,   699,   701,   704,   708,
-     713,   717,   721,   723,   727,   729,   732,   735,   738,   740,
-     743,   746,   752,   760,   768,   776,   782,   792,   803,   811,
-     820,   830,   831,   833,   834,   836,   839,   842,   846,   850,
-     853,   856,   860,   864,   867,   870,   874,   878,   884,   890,
-     894,   900,   901,   903,   905,   908,   912,   917,   920,   924,
-     928,   932,   936,   941,   949,   959,   962,   965,   973,   982,
-     989,   997,  1005,  1014,  1016,  1020,  1021,  1023,  1024,  1026,
-    1028,  1031,  1033,  1035,  1037,  1039,  1041,  1043,  1045,  1049,
-    1053,  1057,  1065,  1074,  1076,  1080,  1082,  1085,  1089,  1094,
-    1096,  1098,  1100,  1102,  1106,  1110,  1114,  1120,  1123,  1128,
-    1129,  1131,  1133,  1136,  1138,  1140,  1145,  1149,  1153,  1155,
-    1160,  1164,  1168,  1170,  1173,  1175,  1178,  1181,  1184,  1189,
-    1193,  1196,  1199,  1204,  1208,  1211,  1215,  1217,  1221,  1223,
-    1225,  1227,  1229,  1231,  1234,  1237,  1239,  1242,  1245,  1248,
-    1251,  1254,  1257,  1260,  1263,  1266,  1269,  1272,  1275,  1278,
-    1280,  1282,  1284,  1286,  1288,  1292,  1296,  1300,  1302,  1306,
-    1310,  1314,  1316,  1320,  1324,  1326,  1330,  1334,  1336,  1340,
-    1344,  1348,  1350,  1354,  1358,  1362,  1364,  1368,  1372,  1376,
-    1380,  1384,  1388,  1390,  1394,  1398,  1402,  1406,  1410,  1412,
-    1416,  1420,  1424,  1428,  1432,  1436,  1438,  1442,  1446,  1450,
-    1454,  1456,  1460,  1464,  1468,  1472,  1474,  1478,  1482,  1486,
-    1490,  1492,  1496,  1498,  1502,  1504,  1508,  1510,  1514,  1516,
-    1520,  1522,  1526,  1528,  1532,  1534,  1538,  1540,  1544,  1546,
-    1550,  1552,  1556,  1558,  1562,  1564,  1568,  1570,  1574,  1576,
-    1580,  1582,  1588,  1590,  1596,  1598,  1604,  1606,  1610,  1612,
-    1616,  1618,  1622,  1624,  1626,  1628,  1630,  1632,  1634,  1636,
-    1638,  1640,  1642,  1644,  1646,  1648,  1652,  1654,  1658,  1660,
-    1664,  1666,  1668,  1670,  1672,  1674,  1676,  1678,  1680,  1682,
-    1684,  1686,  1688,  1690,  1692,  1694,  1696,  1698,  1701,  1705,
-    1709,  1713,  1715,  1718,  1722,  1727,  1729,  1732,  1736,  1741,
-    1745,  1749,  1751,  1755,  1757,  1760,  1763,  1766,  1768,  1771,
-    1774,  1780,  1788,  1796,  1804,  1810,  1820,  1831,  1839,  1848,
-    1858,  1859,  1861,  1862,  1864,  1867,  1870,  1874,  1878,  1881,
-    1884,  1888,  1892,  1895,  1898,  1902,  1906,  1912,  1918,  1922,
-    1928,  1929,  1931,  1933,  1936,  1940,  1945,  1948,  1952,  1956,
-    1960,  1964,  1969,  1977,  1987,  1990,  1993,  2001,  2010,  2017,
-    2025,  2033,  2042,  2044,  2048,  2049,  2051,  2053
-};
-
-/* YYRHS -- A `-1'-separated list of the rules' RHS.  */
-static const yytype_int16 yyrhs[] =
-{
-     184,     0,    -1,     3,    -1,     4,    -1,     5,    -1,    61,
-      -1,    63,    -1,    66,    -1,    51,    -1,    62,    67,   143,
-      -1,    63,    67,   143,    -1,    61,    67,   143,    -1,    62,
-      62,    68,    69,    59,   183,    60,    -1,    62,    62,    68,
-     182,    69,    59,   183,    60,    -1,    90,    -1,    91,    70,
-      90,    -1,    93,    -1,    59,    60,    -1,    59,    91,    60,
-      -1,    59,    91,    70,    60,    -1,    19,    -1,    89,    -1,
-      94,    -1,    62,    -1,    68,   147,    69,    -1,    71,    96,
-      72,    -1,    71,    95,    72,    -1,    71,    95,    70,    96,
-      72,    -1,    96,   143,    -1,    95,    70,    96,   143,    -1,
-      -1,    97,    -1,    70,    -1,    97,    70,    -1,    92,    -1,
-     181,    -1,    98,    71,   147,    72,    -1,    98,    73,    62,
-      -1,    10,    98,   104,    -1,    93,    -1,    99,    71,   147,
-      72,    -1,    99,    73,    62,    -1,    10,    98,   104,    -1,
-      98,    -1,    10,   100,    -1,    99,    -1,    10,   100,    -1,
-      98,   104,    -1,   102,   104,    -1,   102,    71,   147,    72,
-      -1,   102,    73,    62,    -1,    99,   104,    -1,   103,   104,
-      -1,   103,    71,   147,    72,    -1,   103,    73,    62,    -1,
-      68,    69,    -1,    68,   105,    69,    -1,   143,    -1,   105,
-      70,   143,    -1,   100,    -1,   102,    -1,   101,    -1,   103,
-      -1,   106,    -1,   106,    43,    -1,   106,    44,    -1,   107,
-      -1,   107,    43,    -1,   107,    44,    -1,    17,   111,    -1,
-      16,   111,    -1,    24,   111,    -1,    43,   111,    -1,    64,
-     111,    -1,    44,   111,    -1,    65,   111,    -1,    74,   111,
-      -1,    75,   111,    -1,    76,   111,    -1,    77,   111,    -1,
-     108,    -1,   110,    -1,   109,    -1,   110,    -1,   111,    -1,
-     113,    78,   111,    -1,   113,    66,   111,    -1,   113,    79,
-     111,    -1,   112,    -1,   114,    78,   111,    -1,   114,    66,
-     111,    -1,   114,    79,   111,    -1,   113,    -1,   115,    74,
-     113,    -1,   115,    75,   113,    -1,   114,    -1,   116,    74,
-     113,    -1,   116,    75,   113,    -1,   115,    -1,   117,    45,
-     115,    -1,   117,    46,   115,    -1,   117,    47,   115,    -1,
-     116,    -1,   118,    45,   115,    -1,   118,    46,   115,    -1,
-     118,    47,   115,    -1,   117,    -1,   119,    80,   117,    -1,
-     119,    81,   117,    -1,   119,    39,   117,    -1,   119,    40,
-     117,    -1,   119,    23,   117,    -1,   119,    22,   117,    -1,
-     117,    -1,   120,    80,   117,    -1,   120,    81,   117,    -1,
-     120,    39,   117,    -1,   120,    40,   117,    -1,   120,    23,
-     117,    -1,   118,    -1,   121,    80,   117,    -1,   121,    81,
-     117,    -1,   121,    39,   117,    -1,   121,    40,   117,    -1,
-     121,    23,   117,    -1,   121,    22,   117,    -1,   119,    -1,
-     122,    35,   119,    -1,   122,    36,   119,    -1,   122,    37,
-     119,    -1,   122,    38,   119,    -1,   120,    -1,   123,    35,
-     120,    -1,   123,    36,   120,    -1,   123,    37,   120,    -1,
-     123,    38,   120,    -1,   121,    -1,   124,    35,   119,    -1,
-     124,    36,   119,    -1,   124,    37,   119,    -1,   124,    38,
-     119,    -1,   122,    -1,   125,    82,   122,    -1,   123,    -1,
-     126,    82,   123,    -1,   124,    -1,   127,    82,   122,    -1,
-     125,    -1,   128,    83,   125,    -1,   126,    -1,   129,    83,
-     126,    -1,   127,    -1,   130,    83,   125,    -1,   128,    -1,
-     131,    84,   128,    -1,   129,    -1,   132,    84,   129,    -1,
-     130,    -1,   133,    84,   128,    -1,   131,    -1,   134,    42,
-     131,    -1,   132,    -1,   135,    42,   132,    -1,   133,    -1,
-     136,    42,   131,    -1,   134,    -1,   137,    41,   134,    -1,
-     135,    -1,   138,    41,   135,    -1,   136,    -1,   139,    41,
-     134,    -1,   137,    -1,   137,    85,   143,    67,   143,    -1,
-     138,    -1,   138,    85,   144,    67,   144,    -1,   139,    -1,
-     139,    85,   143,    67,   143,    -1,   140,    -1,   106,   146,
-     143,    -1,   141,    -1,   106,   146,   144,    -1,   142,    -1,
-     107,   146,   143,    -1,    86,    -1,    48,    -1,    49,    -1,
-      50,    -1,    51,    -1,    52,    -1,    53,    -1,    54,    -1,
-      55,    -1,    57,    -1,    58,    -1,    56,    -1,   143,    -1,
-     147,    70,   143,    -1,   144,    -1,   148,    70,   144,    -1,
-     145,    -1,   149,    70,   143,    -1,   151,    -1,   152,    -1,
-     155,    -1,   180,    -1,   160,    -1,   161,    -1,   162,    -1,
-     163,    -1,   166,    -1,   167,    -1,   168,    -1,   169,    -1,
-     170,    -1,   176,    -1,   177,    -1,   178,    -1,   179,    -1,
-      59,    60,    -1,    59,   185,    60,    -1,    11,   153,    87,
-      -1,    11,   153,     1,    -1,    62,    -1,    62,   158,    -1,
-     153,    70,    62,    -1,   153,    70,    62,   158,    -1,    62,
-      -1,    62,   159,    -1,   154,    70,    62,    -1,   154,    70,
-      62,   159,    -1,    12,   156,    87,    -1,    12,   156,     1,
-      -1,   157,    -1,   156,    70,   157,    -1,    62,    -1,    62,
-     158,    -1,    86,   143,    -1,    86,   144,    -1,    87,    -1,
-     149,    87,    -1,   149,     1,    -1,    18,    68,   147,    69,
-     150,    -1,    18,    68,   147,    69,   150,    34,   150,    -1,
-      20,   150,    21,    68,   147,    69,    87,    -1,    20,   150,
-      21,    68,   147,    69,     1,    -1,    21,    68,   147,    69,
-     150,    -1,     9,    68,   165,    87,   164,    87,   164,    69,
-     150,    -1,     9,    68,    11,   154,    87,   164,    87,   164,
-      69,   150,    -1,     9,    68,   106,    22,   147,    69,   150,
-      -1,     9,    68,    11,    62,    22,   147,    69,   150,    -1,
-       9,    68,    11,    62,   159,    22,   147,    69,   150,    -1,
-      -1,   147,    -1,    -1,   148,    -1,    13,    87,    -1,    13,
-       1,    -1,    13,    62,    87,    -1,    13,    62,     1,    -1,
-       6,    87,    -1,     6,     1,    -1,     6,    62,    87,    -1,
-       6,    62,     1,    -1,    15,    87,    -1,    15,     1,    -1,
-      15,   147,    87,    -1,    15,   147,     1,    -1,    26,    68,
-     147,    69,   150,    -1,    25,    68,   147,    69,   171,    -1,
-      59,   172,    60,    -1,    59,   172,   175,   172,    60,    -1,
-      -1,   173,    -1,   174,    -1,   173,   174,    -1,     7,   147,
-      67,    -1,     7,   147,    67,   185,    -1,     8,    67,    -1,
-       8,    67,   185,    -1,    62,    67,   150,    -1,    28,   147,
-      87,    -1,    28,   147,     1,    -1,    29,   151,    31,   151,
-      -1,    29,   151,    30,    68,    62,    69,   151,    -1,    29,
-     151,    30,    68,    62,    69,   151,    31,   151,    -1,    32,
-      87,    -1,    32,     1,    -1,    14,    62,    68,    69,    59,
-     183,    60,    -1,    14,    62,    68,   182,    69,    59,   183,
-      60,    -1,    14,    68,    69,    59,   183,    60,    -1,    14,
-      68,   182,    69,    59,   183,    60,    -1,    14,    62,    68,
-      69,    59,   183,    60,    -1,    14,    62,    68,   182,    69,
-      59,   183,    60,    -1,    62,    -1,   182,    70,    62,    -1,
-      -1,   281,    -1,    -1,   185,    -1,   150,    -1,   185,   150,
-      -1,     3,    -1,     4,    -1,     5,    -1,    61,    -1,    63,
-      -1,    66,    -1,    51,    -1,    62,    67,   240,    -1,    63,
-      67,   240,    -1,    61,    67,   240,    -1,    62,    62,    68,
-      69,    59,   280,    60,    -1,    62,    62,    68,   279,    69,
-      59,   280,    60,    -1,   187,    -1,   188,    70,   187,    -1,
-     190,    -1,    59,    60,    -1,    59,   188,    60,    -1,    59,
-     188,    70,    60,    -1,    19,    -1,   186,    -1,   191,    -1,
-      62,    -1,    68,   244,    69,    -1,    71,   193,    72,    -1,
-      71,   192,    72,    -1,    71,   192,    70,   193,    72,    -1,
-     193,   240,    -1,   192,    70,   193,   240,    -1,    -1,   194,
-      -1,    70,    -1,   194,    70,    -1,   189,    -1,   278,    -1,
-     195,    71,   244,    72,    -1,   195,    73,    62,    -1,    10,
-     195,   201,    -1,   190,    -1,   196,    71,   244,    72,    -1,
-     196,    73,    62,    -1,    10,   195,   201,    -1,   195,    -1,
-      10,   197,    -1,   196,    -1,    10,   197,    -1,   195,   201,
-      -1,   199,   201,    -1,   199,    71,   244,    72,    -1,   199,
-      73,    62,    -1,   196,   201,    -1,   200,   201,    -1,   200,
-      71,   244,    72,    -1,   200,    73,    62,    -1,    68,    69,
-      -1,    68,   202,    69,    -1,   240,    -1,   202,    70,   240,
-      -1,   197,    -1,   199,    -1,   198,    -1,   200,    -1,   203,
-      -1,   203,    43,    -1,   203,    44,    -1,   204,    -1,   204,
-      43,    -1,   204,    44,    -1,    17,   208,    -1,    16,   208,
-      -1,    24,   208,    -1,    43,   208,    -1,    64,   208,    -1,
-      44,   208,    -1,    65,   208,    -1,    74,   208,    -1,    75,
-     208,    -1,    76,   208,    -1,    77,   208,    -1,   205,    -1,
-     207,    -1,   206,    -1,   207,    -1,   208,    -1,   210,    78,
-     208,    -1,   210,    66,   208,    -1,   210,    79,   208,    -1,
-     209,    -1,   211,    78,   208,    -1,   211,    66,   208,    -1,
-     211,    79,   208,    -1,   210,    -1,   212,    74,   210,    -1,
-     212,    75,   210,    -1,   211,    -1,   213,    74,   210,    -1,
-     213,    75,   210,    -1,   212,    -1,   214,    45,   212,    -1,
-     214,    46,   212,    -1,   214,    47,   212,    -1,   213,    -1,
-     215,    45,   212,    -1,   215,    46,   212,    -1,   215,    47,
-     212,    -1,   214,    -1,   216,    80,   214,    -1,   216,    81,
-     214,    -1,   216,    39,   214,    -1,   216,    40,   214,    -1,
-     216,    23,   214,    -1,   216,    22,   214,    -1,   214,    -1,
-     217,    80,   214,    -1,   217,    81,   214,    -1,   217,    39,
-     214,    -1,   217,    40,   214,    -1,   217,    23,   214,    -1,
-     215,    -1,   218,    80,   214,    -1,   218,    81,   214,    -1,
-     218,    39,   214,    -1,   218,    40,   214,    -1,   218,    23,
-     214,    -1,   218,    22,   214,    -1,   216,    -1,   219,    35,
-     216,    -1,   219,    36,   216,    -1,   219,    37,   216,    -1,
-     219,    38,   216,    -1,   217,    -1,   220,    35,   217,    -1,
-     220,    36,   217,    -1,   220,    37,   217,    -1,   220,    38,
-     217,    -1,   218,    -1,   221,    35,   216,    -1,   221,    36,
-     216,    -1,   221,    37,   216,    -1,   221,    38,   216,    -1,
-     219,    -1,   222,    82,   219,    -1,   220,    -1,   223,    82,
-     220,    -1,   221,    -1,   224,    82,   219,    -1,   222,    -1,
-     225,    83,   222,    -1,   223,    -1,   226,    83,   223,    -1,
-     224,    -1,   227,    83,   222,    -1,   225,    -1,   228,    84,
-     225,    -1,   226,    -1,   229,    84,   226,    -1,   227,    -1,
-     230,    84,   225,    -1,   228,    -1,   231,    42,   228,    -1,
-     229,    -1,   232,    42,   229,    -1,   230,    -1,   233,    42,
-     228,    -1,   231,    -1,   234,    41,   231,    -1,   232,    -1,
-     235,    41,   232,    -1,   233,    -1,   236,    41,   231,    -1,
-     234,    -1,   234,    85,   240,    67,   240,    -1,   235,    -1,
-     235,    85,   241,    67,   241,    -1,   236,    -1,   236,    85,
-     240,    67,   240,    -1,   237,    -1,   203,   243,   240,    -1,
-     238,    -1,   203,   243,   241,    -1,   239,    -1,   204,   243,
-     240,    -1,    86,    -1,    48,    -1,    49,    -1,    50,    -1,
-      51,    -1,    52,    -1,    53,    -1,    54,    -1,    55,    -1,
-      57,    -1,    58,    -1,    56,    -1,   240,    -1,   244,    70,
-     240,    -1,   241,    -1,   245,    70,   241,    -1,   242,    -1,
-     246,    70,   240,    -1,   248,    -1,   249,    -1,   252,    -1,
-     277,    -1,   257,    -1,   258,    -1,   259,    -1,   260,    -1,
-     263,    -1,   264,    -1,   265,    -1,   266,    -1,   267,    -1,
-     273,    -1,   274,    -1,   275,    -1,   276,    -1,    59,    60,
-      -1,    59,   281,    60,    -1,    11,   250,    87,    -1,    11,
-     250,     1,    -1,    62,    -1,    62,   255,    -1,   250,    70,
-      62,    -1,   250,    70,    62,   255,    -1,    62,    -1,    62,
-     256,    -1,   251,    70,    62,    -1,   251,    70,    62,   256,
-      -1,    12,   253,    87,    -1,    12,   253,     1,    -1,   254,
-      -1,   253,    70,   254,    -1,    62,    -1,    62,   255,    -1,
-      86,   240,    -1,    86,   241,    -1,    87,    -1,   246,    87,
-      -1,   246,     1,    -1,    18,    68,   244,    69,   247,    -1,
-      18,    68,   244,    69,   247,    34,   247,    -1,    20,   247,
-      21,    68,   244,    69,    87,    -1,    20,   247,    21,    68,
-     244,    69,     1,    -1,    21,    68,   244,    69,   247,    -1,
-       9,    68,   262,    87,   261,    87,   261,    69,   247,    -1,
-       9,    68,    11,   251,    87,   261,    87,   261,    69,   247,
-      -1,     9,    68,   203,    22,   244,    69,   247,    -1,     9,
-      68,    11,    62,    22,   244,    69,   247,    -1,     9,    68,
-      11,    62,   256,    22,   244,    69,   247,    -1,    -1,   244,
-      -1,    -1,   245,    -1,    13,    87,    -1,    13,     1,    -1,
-      13,    62,    87,    -1,    13,    62,     1,    -1,     6,    87,
-      -1,     6,     1,    -1,     6,    62,    87,    -1,     6,    62,
-       1,    -1,    15,    87,    -1,    15,     1,    -1,    15,   244,
-      87,    -1,    15,   244,     1,    -1,    26,    68,   244,    69,
-     247,    -1,    25,    68,   244,    69,   268,    -1,    59,   269,
-      60,    -1,    59,   269,   272,   269,    60,    -1,    -1,   270,
-      -1,   271,    -1,   270,   271,    -1,     7,   244,    67,    -1,
-       7,   244,    67,   281,    -1,     8,    67,    -1,     8,    67,
-     281,    -1,    62,    67,   247,    -1,    28,   244,    87,    -1,
-      28,   244,     1,    -1,    29,   248,    31,   248,    -1,    29,
-     248,    30,    68,    62,    69,   248,    -1,    29,   248,    30,
-      68,    62,    69,   248,    31,   248,    -1,    32,    87,    -1,
-      32,     1,    -1,    14,    62,    68,    69,    59,   280,    60,
-      -1,    14,    62,    68,   279,    69,    59,   280,    60,    -1,
-      14,    68,    69,    59,   280,    60,    -1,    14,    68,   279,
-      69,    59,   280,    60,    -1,    14,    62,    68,    69,    59,
-     280,    60,    -1,    14,    62,    68,   279,    69,    59,   280,
-      60,    -1,    62,    -1,   279,    70,    62,    -1,    -1,   281,
-      -1,   247,    -1,   281,   247,    -1
-};
-
-/* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
-static const yytype_uint16 yyrline[] =
-{
-       0,   293,   293,   294,   295,   296,   297,   298,   309,   323,
-     324,   325,   326,   327,   339,   343,   350,   351,   352,   354,
-     358,   359,   360,   361,   362,   366,   367,   368,   372,   376,
-     384,   385,   389,   390,   394,   395,   396,   400,   404,   411,
-     412,   416,   420,   427,   428,   435,   436,   443,   444,   445,
-     449,   455,   456,   457,   461,   468,   469,   473,   477,   484,
-     485,   489,   490,   494,   495,   496,   500,   501,   502,   506,
-     507,   508,   509,   510,   511,   512,   513,   514,   515,   516,
-     519,   520,   524,   525,   529,   530,   531,   532,   536,   537,
-     539,   541,   546,   547,   548,   552,   553,   555,   560,   561,
-     562,   563,   567,   568,   569,   570,   574,   575,   576,   577,
-     578,   579,   582,   588,   589,   590,   591,   592,   593,   600,
-     601,   602,   603,   604,   605,   609,   616,   617,   618,   619,
-     620,   624,   625,   627,   629,   631,   636,   637,   639,   640,
-     642,   647,   648,   652,   653,   658,   659,   663,   664,   668,
-     669,   674,   675,   680,   681,   685,   686,   691,   692,   697,
-     698,   702,   703,   708,   709,   714,   715,   719,   720,   725,
-     726,   730,   731,   736,   737,   742,   743,   748,   749,   756,
-     757,   764,   765,   772,   773,   774,   775,   776,   777,   778,
-     779,   780,   781,   782,   783,   787,   788,   792,   793,   797,
-     798,   802,   803,   804,   805,   806,   807,   808,   809,   810,
-     811,   812,   813,   814,   815,   816,   817,   818,   822,   824,
-     829,   831,   837,   844,   853,   861,   874,   881,   890,   898,
-     911,   913,   919,   927,   939,   940,   944,   948,   952,   956,
-     958,   963,   966,   976,   978,   980,   982,   988,   995,  1004,
-    1010,  1021,  1022,  1026,  1027,  1031,  1035,  1039,  1043,  1050,
-    1053,  1056,  1059,  1065,  1068,  1071,  1074,  1080,  1086,  1092,
-    1093,  1102,  1103,  1107,  1113,  1123,  1124,  1128,  1129,  1133,
-    1139,  1143,  1150,  1156,  1162,  1172,  1174,  1179,  1180,  1191,
-    1192,  1199,  1200,  1210,  1213,  1219,  1220,  1224,  1225,  1230,
-    1237,  1248,  1249,  1250,  1251,  1252,  1253,  1254,  1258,  1259,
-    1260,  1261,  1262,  1266,  1267,  1271,  1272,  1273,  1275,  1279,
-    1280,  1281,  1282,  1283,  1287,  1288,  1289,  1293,  1294,  1297,
-    1299,  1303,  1304,  1308,  1309,  1310,  1311,  1312,  1316,  1317,
-    1318,  1319,  1323,  1324,  1328,  1329,  1333,  1334,  1335,  1336,
-    1340,  1341,  1342,  1343,  1347,  1348,  1352,  1353,  1357,  1358,
-    1362,  1363,  1367,  1368,  1369,  1373,  1374,  1375,  1379,  1380,
-    1381,  1382,  1383,  1384,  1385,  1386,  1387,  1388,  1389,  1392,
-    1393,  1397,  1398,  1402,  1403,  1404,  1405,  1409,  1410,  1411,
-    1412,  1416,  1417,  1418,  1422,  1423,  1424,  1428,  1429,  1430,
-    1431,  1435,  1436,  1437,  1438,  1442,  1443,  1444,  1445,  1446,
-    1447,  1448,  1452,  1453,  1454,  1455,  1456,  1457,  1461,  1462,
-    1463,  1464,  1465,  1466,  1467,  1471,  1472,  1473,  1474,  1475,
-    1479,  1480,  1481,  1482,  1483,  1487,  1488,  1489,  1490,  1491,
-    1495,  1496,  1500,  1501,  1505,  1506,  1510,  1511,  1515,  1516,
-    1520,  1521,  1525,  1526,  1530,  1531,  1535,  1536,  1540,  1541,
-    1545,  1546,  1550,  1551,  1555,  1556,  1560,  1561,  1565,  1566,
-    1570,  1571,  1575,  1576,  1580,  1581,  1585,  1586,  1590,  1591,
-    1595,  1596,  1600,  1601,  1602,  1603,  1604,  1605,  1606,  1607,
-    1608,  1609,  1610,  1611,  1615,  1616,  1620,  1621,  1625,  1626,
-    1630,  1631,  1632,  1633,  1634,  1635,  1636,  1637,  1638,  1639,
-    1640,  1641,  1642,  1643,  1644,  1645,  1646,  1650,  1651,  1655,
-    1656,  1660,  1661,  1662,  1663,  1667,  1668,  1669,  1670,  1674,
-    1675,  1679,  1680,  1684,  1685,  1689,  1693,  1697,  1701,  1702,
-    1706,  1707,  1711,  1712,  1713,  1714,  1715,  1716,  1717,  1718,
-    1721,  1723,  1726,  1728,  1732,  1733,  1734,  1735,  1739,  1740,
-    1741,  1742,  1746,  1747,  1748,  1749,  1753,  1757,  1761,  1762,
-    1765,  1767,  1771,  1772,  1776,  1777,  1781,  1782,  1786,  1790,
-    1791,  1795,  1796,  1797,  1801,  1802,  1806,  1807,  1811,  1812,
-    1813,  1814,  1818,  1819,  1822,  1824,  1828,  1829
-};
-#endif
-
-#if YYDEBUG || YYERROR_VERBOSE || YYTOKEN_TABLE
-/* YYTNAME[SYMBOL-NUM] -- String name of the symbol SYMBOL-NUM.
-   First, the terminals, then, starting at YYNTOKENS, nonterminals.  */
-static const char *const yytname[] =
-{
-  "$end", "error", "$undefined", "NULLTOKEN", "TRUETOKEN", "FALSETOKEN",
-  "BREAK", "CASE", "DEFAULT", "FOR", "NEW", "VAR", "CONSTTOKEN",
-  "CONTINUE", "FUNCTION", "RETURN", "VOIDTOKEN", "DELETETOKEN", "IF",
-  "THISTOKEN", "DO", "WHILE", "INTOKEN", "INSTANCEOF", "TYPEOF", "SWITCH",
-  "WITH", "RESERVED", "THROW", "TRY", "CATCH", "FINALLY", "DEBUGGER",
-  "IF_WITHOUT_ELSE", "ELSE", "EQEQ", "NE", "STREQ", "STRNEQ", "LE", "GE",
-  "OR", "AND", "PLUSPLUS", "MINUSMINUS", "LSHIFT", "RSHIFT", "URSHIFT",
-  "PLUSEQUAL", "MINUSEQUAL", "MULTEQUAL", "DIVEQUAL", "LSHIFTEQUAL",
-  "RSHIFTEQUAL", "URSHIFTEQUAL", "ANDEQUAL", "MODEQUAL", "XOREQUAL",
-  "OREQUAL", "OPENBRACE", "CLOSEBRACE", "NUMBER", "IDENT", "STRING",
-  "AUTOPLUSPLUS", "AUTOMINUSMINUS", "'/'", "':'", "'('", "')'", "','",
-  "'['", "']'", "'.'", "'+'", "'-'", "'~'", "'!'", "'*'", "'%'", "'<'",
-  "'>'", "'&'", "'^'", "'|'", "'?'", "'='", "';'", "$accept", "Literal",
-  "Property", "PropertyList", "PrimaryExpr", "PrimaryExprNoBrace",
-  "ArrayLiteral", "ElementList", "ElisionOpt", "Elision", "MemberExpr",
-  "MemberExprNoBF", "NewExpr", "NewExprNoBF", "CallExpr", "CallExprNoBF",
-  "Arguments", "ArgumentList", "LeftHandSideExpr", "LeftHandSideExprNoBF",
-  "PostfixExpr", "PostfixExprNoBF", "UnaryExprCommon", "UnaryExpr",
-  "UnaryExprNoBF", "MultiplicativeExpr", "MultiplicativeExprNoBF",
-  "AdditiveExpr", "AdditiveExprNoBF", "ShiftExpr", "ShiftExprNoBF",
-  "RelationalExpr", "RelationalExprNoIn", "RelationalExprNoBF",
-  "EqualityExpr", "EqualityExprNoIn", "EqualityExprNoBF", "BitwiseANDExpr",
-  "BitwiseANDExprNoIn", "BitwiseANDExprNoBF", "BitwiseXORExpr",
-  "BitwiseXORExprNoIn", "BitwiseXORExprNoBF", "BitwiseORExpr",
-  "BitwiseORExprNoIn", "BitwiseORExprNoBF", "LogicalANDExpr",
-  "LogicalANDExprNoIn", "LogicalANDExprNoBF", "LogicalORExpr",
-  "LogicalORExprNoIn", "LogicalORExprNoBF", "ConditionalExpr",
-  "ConditionalExprNoIn", "ConditionalExprNoBF", "AssignmentExpr",
-  "AssignmentExprNoIn", "AssignmentExprNoBF", "AssignmentOperator", "Expr",
-  "ExprNoIn", "ExprNoBF", "Statement", "Block", "VariableStatement",
-  "VariableDeclarationList", "VariableDeclarationListNoIn",
-  "ConstStatement", "ConstDeclarationList", "ConstDeclaration",
-  "Initializer", "InitializerNoIn", "EmptyStatement", "ExprStatement",
-  "IfStatement", "IterationStatement", "ExprOpt", "ExprNoInOpt",
-  "ContinueStatement", "BreakStatement", "ReturnStatement",
-  "WithStatement", "SwitchStatement", "CaseBlock", "CaseClausesOpt",
-  "CaseClauses", "CaseClause", "DefaultClause", "LabelledStatement",
-  "ThrowStatement", "TryStatement", "DebuggerStatement",
-  "FunctionDeclaration", "FunctionExpr", "FormalParameterList",
-  "FunctionBody", "Program", "SourceElements", "Literal_NoNode",
-  "Property_NoNode", "PropertyList_NoNode", "PrimaryExpr_NoNode",
-  "PrimaryExprNoBrace_NoNode", "ArrayLiteral_NoNode", "ElementList_NoNode",
-  "ElisionOpt_NoNode", "Elision_NoNode", "MemberExpr_NoNode",
-  "MemberExprNoBF_NoNode", "NewExpr_NoNode", "NewExprNoBF_NoNode",
-  "CallExpr_NoNode", "CallExprNoBF_NoNode", "Arguments_NoNode",
-  "ArgumentList_NoNode", "LeftHandSideExpr_NoNode",
-  "LeftHandSideExprNoBF_NoNode", "PostfixExpr_NoNode",
-  "PostfixExprNoBF_NoNode", "UnaryExprCommon_NoNode", "UnaryExpr_NoNode",
-  "UnaryExprNoBF_NoNode", "MultiplicativeExpr_NoNode",
-  "MultiplicativeExprNoBF_NoNode", "AdditiveExpr_NoNode",
-  "AdditiveExprNoBF_NoNode", "ShiftExpr_NoNode", "ShiftExprNoBF_NoNode",
-  "RelationalExpr_NoNode", "RelationalExprNoIn_NoNode",
-  "RelationalExprNoBF_NoNode", "EqualityExpr_NoNode",
-  "EqualityExprNoIn_NoNode", "EqualityExprNoBF_NoNode",
-  "BitwiseANDExpr_NoNode", "BitwiseANDExprNoIn_NoNode",
-  "BitwiseANDExprNoBF_NoNode", "BitwiseXORExpr_NoNode",
-  "BitwiseXORExprNoIn_NoNode", "BitwiseXORExprNoBF_NoNode",
-  "BitwiseORExpr_NoNode", "BitwiseORExprNoIn_NoNode",
-  "BitwiseORExprNoBF_NoNode", "LogicalANDExpr_NoNode",
-  "LogicalANDExprNoIn_NoNode", "LogicalANDExprNoBF_NoNode",
-  "LogicalORExpr_NoNode", "LogicalORExprNoIn_NoNode",
-  "LogicalORExprNoBF_NoNode", "ConditionalExpr_NoNode",
-  "ConditionalExprNoIn_NoNode", "ConditionalExprNoBF_NoNode",
-  "AssignmentExpr_NoNode", "AssignmentExprNoIn_NoNode",
-  "AssignmentExprNoBF_NoNode", "AssignmentOperator_NoNode", "Expr_NoNode",
-  "ExprNoIn_NoNode", "ExprNoBF_NoNode", "Statement_NoNode", "Block_NoNode",
-  "VariableStatement_NoNode", "VariableDeclarationList_NoNode",
-  "VariableDeclarationListNoIn_NoNode", "ConstStatement_NoNode",
-  "ConstDeclarationList_NoNode", "ConstDeclaration_NoNode",
-  "Initializer_NoNode", "InitializerNoIn_NoNode", "EmptyStatement_NoNode",
-  "ExprStatement_NoNode", "IfStatement_NoNode",
-  "IterationStatement_NoNode", "ExprOpt_NoNode", "ExprNoInOpt_NoNode",
-  "ContinueStatement_NoNode", "BreakStatement_NoNode",
-  "ReturnStatement_NoNode", "WithStatement_NoNode",
-  "SwitchStatement_NoNode", "CaseBlock_NoNode", "CaseClausesOpt_NoNode",
-  "CaseClauses_NoNode", "CaseClause_NoNode", "DefaultClause_NoNode",
-  "LabelledStatement_NoNode", "ThrowStatement_NoNode",
-  "TryStatement_NoNode", "DebuggerStatement_NoNode",
-  "FunctionDeclaration_NoNode", "FunctionExpr_NoNode",
-  "FormalParameterList_NoNode", "FunctionBody_NoNode",
-  "SourceElements_NoNode", 0
-};
-#endif
-
-# ifdef YYPRINT
-/* YYTOKNUM[YYLEX-NUM] -- Internal token number corresponding to
-   token YYLEX-NUM.  */
-static const yytype_uint16 yytoknum[] =
-{
-       0,   256,   257,   258,   259,   260,   261,   262,   263,   264,
-     265,   266,   267,   268,   269,   270,   271,   272,   273,   274,
-     275,   276,   277,   278,   279,   280,   281,   282,   283,   284,
-     285,   286,   287,   288,   289,   290,   291,   292,   293,   294,
-     295,   296,   297,   298,   299,   300,   301,   302,   303,   304,
-     305,   306,   307,   308,   309,   310,   311,   312,   313,   314,
-     315,   316,   317,   318,   319,   320,    47,    58,    40,    41,
-      44,    91,    93,    46,    43,    45,   126,    33,    42,    37,
-      60,    62,    38,    94,   124,    63,    61,    59
-};
-# endif
-
-/* YYR1[YYN] -- Symbol number of symbol that rule YYN derives.  */
-static const yytype_uint16 yyr1[] =
-{
-       0,    88,    89,    89,    89,    89,    89,    89,    89,    90,
-      90,    90,    90,    90,    91,    91,    92,    92,    92,    92,
-      93,    93,    93,    93,    93,    94,    94,    94,    95,    95,
-      96,    96,    97,    97,    98,    98,    98,    98,    98,    99,
-      99,    99,    99,   100,   100,   101,   101,   102,   102,   102,
-     102,   103,   103,   103,   103,   104,   104,   105,   105,   106,
-     106,   107,   107,   108,   108,   108,   109,   109,   109,   110,
-     110,   110,   110,   110,   110,   110,   110,   110,   110,   110,
-     111,   111,   112,   112,   113,   113,   113,   113,   114,   114,
-     114,   114,   115,   115,   115,   116,   116,   116,   117,   117,
-     117,   117,   118,   118,   118,   118,   119,   119,   119,   119,
-     119,   119,   119,   120,   120,   120,   120,   120,   120,   121,
-     121,   121,   121,   121,   121,   121,   122,   122,   122,   122,
-     122,   123,   123,   123,   123,   123,   124,   124,   124,   124,
-     124,   125,   125,   126,   126,   127,   127,   128,   128,   129,
-     129,   130,   130,   131,   131,   132,   132,   133,   133,   134,
-     134,   135,   135,   136,   136,   137,   137,   138,   138,   139,
-     139,   140,   140,   141,   141,   142,   142,   143,   143,   144,
-     144,   145,   145,   146,   146,   146,   146,   146,   146,   146,
-     146,   146,   146,   146,   146,   147,   147,   148,   148,   149,
-     149,   150,   150,   150,   150,   150,   150,   150,   150,   150,
-     150,   150,   150,   150,   150,   150,   150,   150,   151,   151,
-     152,   152,   153,   153,   153,   153,   154,   154,   154,   154,
-     155,   155,   156,   156,   157,   157,   158,   159,   160,   161,
-     161,   162,   162,   163,   163,   163,   163,   163,   163,   163,
-     163,   164,   164,   165,   165,   166,   166,   166,   166,   167,
-     167,   167,   167,   168,   168,   168,   168,   169,   170,   171,
-     171,   172,   172,   173,   173,   174,   174,   175,   175,   176,
-     177,   177,   178,   178,   178,   179,   179,   180,   180,   181,
-     181,   181,   181,   182,   182,   183,   183,   184,   184,   185,
-     185,   186,   186,   186,   186,   186,   186,   186,   187,   187,
-     187,   187,   187,   188,   188,   189,   189,   189,   189,   190,
-     190,   190,   190,   190,   191,   191,   191,   192,   192,   193,
-     193,   194,   194,   195,   195,   195,   195,   195,   196,   196,
-     196,   196,   197,   197,   198,   198,   199,   199,   199,   199,
-     200,   200,   200,   200,   201,   201,   202,   202,   203,   203,
-     204,   204,   205,   205,   205,   206,   206,   206,   207,   207,
-     207,   207,   207,   207,   207,   207,   207,   207,   207,   208,
-     208,   209,   209,   210,   210,   210,   210,   211,   211,   211,
-     211,   212,   212,   212,   213,   213,   213,   214,   214,   214,
-     214,   215,   215,   215,   215,   216,   216,   216,   216,   216,
-     216,   216,   217,   217,   217,   217,   217,   217,   218,   218,
-     218,   218,   218,   218,   218,   219,   219,   219,   219,   219,
-     220,   220,   220,   220,   220,   221,   221,   221,   221,   221,
-     222,   222,   223,   223,   224,   224,   225,   225,   226,   226,
-     227,   227,   228,   228,   229,   229,   230,   230,   231,   231,
-     232,   232,   233,   233,   234,   234,   235,   235,   236,   236,
-     237,   237,   238,   238,   239,   239,   240,   240,   241,   241,
-     242,   242,   243,   243,   243,   243,   243,   243,   243,   243,
-     243,   243,   243,   243,   244,   244,   245,   245,   246,   246,
-     247,   247,   247,   247,   247,   247,   247,   247,   247,   247,
-     247,   247,   247,   247,   247,   247,   247,   248,   248,   249,
-     249,   250,   250,   250,   250,   251,   251,   251,   251,   252,
-     252,   253,   253,   254,   254,   255,   256,   257,   258,   258,
-     259,   259,   260,   260,   260,   260,   260,   260,   260,   260,
-     261,   261,   262,   262,   263,   263,   263,   263,   264,   264,
-     264,   264,   265,   265,   265,   265,   266,   267,   268,   268,
-     269,   269,   270,   270,   271,   271,   272,   272,   273,   274,
-     274,   275,   275,   275,   276,   276,   277,   277,   278,   278,
-     278,   278,   279,   279,   280,   280,   281,   281
-};
-
-/* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN.  */
-static const yytype_uint8 yyr2[] =
-{
-       0,     2,     1,     1,     1,     1,     1,     1,     1,     3,
-       3,     3,     7,     8,     1,     3,     1,     2,     3,     4,
-       1,     1,     1,     1,     3,     3,     3,     5,     2,     4,
-       0,     1,     1,     2,     1,     1,     4,     3,     3,     1,
-       4,     3,     3,     1,     2,     1,     2,     2,     2,     4,
-       3,     2,     2,     4,     3,     2,     3,     1,     3,     1,
-       1,     1,     1,     1,     2,     2,     1,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       1,     1,     1,     1,     1,     3,     3,     3,     1,     3,
-       3,     3,     1,     3,     3,     1,     3,     3,     1,     3,
-       3,     3,     1,     3,     3,     3,     1,     3,     3,     3,
-       3,     3,     3,     1,     3,     3,     3,     3,     3,     1,
-       3,     3,     3,     3,     3,     3,     1,     3,     3,     3,
-       3,     1,     3,     3,     3,     3,     1,     3,     3,     3,
-       3,     1,     3,     1,     3,     1,     3,     1,     3,     1,
-       3,     1,     3,     1,     3,     1,     3,     1,     3,     1,
-       3,     1,     3,     1,     3,     1,     3,     1,     3,     1,
-       3,     1,     5,     1,     5,     1,     5,     1,     3,     1,
-       3,     1,     3,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     3,     1,     3,     1,
-       3,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     2,     3,
-       3,     3,     1,     2,     3,     4,     1,     2,     3,     4,
-       3,     3,     1,     3,     1,     2,     2,     2,     1,     2,
-       2,     5,     7,     7,     7,     5,     9,    10,     7,     8,
-       9,     0,     1,     0,     1,     2,     2,     3,     3,     2,
-       2,     3,     3,     2,     2,     3,     3,     5,     5,     3,
-       5,     0,     1,     1,     2,     3,     4,     2,     3,     3,
-       3,     3,     4,     7,     9,     2,     2,     7,     8,     6,
-       7,     7,     8,     1,     3,     0,     1,     0,     1,     1,
-       2,     1,     1,     1,     1,     1,     1,     1,     3,     3,
-       3,     7,     8,     1,     3,     1,     2,     3,     4,     1,
-       1,     1,     1,     3,     3,     3,     5,     2,     4,     0,
-       1,     1,     2,     1,     1,     4,     3,     3,     1,     4,
-       3,     3,     1,     2,     1,     2,     2,     2,     4,     3,
-       2,     2,     4,     3,     2,     3,     1,     3,     1,     1,
-       1,     1,     1,     2,     2,     1,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     1,
-       1,     1,     1,     1,     3,     3,     3,     1,     3,     3,
-       3,     1,     3,     3,     1,     3,     3,     1,     3,     3,
-       3,     1,     3,     3,     3,     1,     3,     3,     3,     3,
-       3,     3,     1,     3,     3,     3,     3,     3,     1,     3,
-       3,     3,     3,     3,     3,     1,     3,     3,     3,     3,
-       1,     3,     3,     3,     3,     1,     3,     3,     3,     3,
-       1,     3,     1,     3,     1,     3,     1,     3,     1,     3,
-       1,     3,     1,     3,     1,     3,     1,     3,     1,     3,
-       1,     3,     1,     3,     1,     3,     1,     3,     1,     3,
-       1,     5,     1,     5,     1,     5,     1,     3,     1,     3,
-       1,     3,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     3,     1,     3,     1,     3,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     2,     3,     3,
-       3,     1,     2,     3,     4,     1,     2,     3,     4,     3,
-       3,     1,     3,     1,     2,     2,     2,     1,     2,     2,
-       5,     7,     7,     7,     5,     9,    10,     7,     8,     9,
-       0,     1,     0,     1,     2,     2,     3,     3,     2,     2,
-       3,     3,     2,     2,     3,     3,     5,     5,     3,     5,
-       0,     1,     1,     2,     3,     4,     2,     3,     3,     3,
-       3,     4,     7,     9,     2,     2,     7,     8,     6,     7,
-       7,     8,     1,     3,     0,     1,     1,     2
-};
-
-/* YYDEFACT[STATE-NAME] -- Default rule to reduce with in state
-   STATE-NUM when YYTABLE doesn't specify something else to do.  Zero
-   means the default is an error.  */
-static const yytype_uint16 yydefact[] =
-{
-     297,     2,     3,     4,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,    20,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     8,     0,     5,    23,
-       6,     0,     0,     7,     0,    30,     0,     0,     0,     0,
-     238,    21,    39,    22,    45,    61,    62,    66,    82,    83,
-      88,    95,   102,   119,   136,   145,   151,   157,   163,   169,
-     175,   181,   199,     0,   299,   201,   202,   203,   205,   206,
-     207,   208,   209,   210,   211,   212,   213,   214,   215,   216,
-     217,   204,     0,   298,   260,     0,   259,   253,     0,     0,
-       0,    23,    34,    16,    43,    46,    35,   222,     0,   234,
-       0,   232,   256,     0,   255,     0,   264,   263,    43,    59,
-      60,    63,    80,    81,    84,    92,    98,   106,   126,   141,
-     147,   153,   159,   165,   171,   177,   195,     0,    63,    70,
-      69,     0,     0,     0,    71,     0,     0,     0,     0,   286,
-     285,    72,    74,   218,     0,     0,    73,    75,     0,    32,
-       0,     0,    31,    76,    77,    78,    79,     0,     0,     0,
-      51,     0,     0,    52,    67,    68,   184,   185,   186,   187,
-     188,   189,   190,   191,   194,   192,   193,   183,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,   240,     0,   239,     1,   300,   262,   261,
-       0,    63,   113,   131,   143,   149,   155,   161,   167,   173,
-     179,   197,   254,     0,    43,    44,     0,     0,    17,     0,
-       0,     0,    14,     0,     0,     0,    42,     0,   223,   221,
-       0,   220,   235,   231,     0,   230,   258,   257,     0,    47,
-       0,     0,    48,    64,    65,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-     266,     0,   265,     0,     0,     0,     0,     0,   281,   280,
-       0,     0,   219,   279,    24,    30,    26,    25,    28,    33,
-      55,     0,    57,     0,    41,     0,    54,   182,    90,    89,
-      91,    96,    97,   103,   104,   105,   125,   124,   122,   123,
-     120,   121,   137,   138,   139,   140,   146,   152,   158,   164,
-     170,     0,   200,   226,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,   251,    38,     0,   293,     0,     0,     0,
-       0,     0,     0,    18,     0,     0,    37,   236,   224,   233,
-       0,     0,     0,    50,   178,    86,    85,    87,    93,    94,
-      99,   100,   101,   112,   111,   109,   110,   107,   108,   127,
-     128,   129,   130,   142,   148,   154,   160,   166,     0,   196,
-       0,     0,     0,     0,     0,     0,   282,     0,    56,     0,
-      40,    53,     0,     0,     0,   227,     0,   251,     0,    63,
-     180,   118,   116,   117,   114,   115,   132,   133,   134,   135,
-     144,   150,   156,   162,   168,     0,   198,   252,     0,     0,
-       0,   295,     0,     0,    11,     0,     9,    10,    19,    15,
-      36,   225,   295,     0,    49,     0,   241,     0,   245,   271,
-     268,   267,     0,    27,    29,    58,   176,     0,   237,     0,
-     228,     0,     0,     0,   251,   295,     0,   301,   302,   303,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,   319,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,   307,     0,   304,   322,   305,     0,     0,   306,
-       0,   329,     0,     0,     0,     0,   537,     0,   320,   338,
-     321,   344,   360,   361,   365,   381,   382,   387,   394,   401,
-     418,   435,   444,   450,   456,   462,   468,   474,   480,   498,
-       0,   596,   500,   501,   502,   504,   505,   506,   507,   508,
-     509,   510,   511,   512,   513,   514,   515,   516,   503,   296,
-     295,   294,     0,     0,     0,   295,   172,     0,     0,     0,
-       0,   272,   273,     0,     0,     0,   229,   251,   248,   174,
-       0,     0,   295,   559,     0,   558,   552,     0,     0,     0,
-     322,   333,   315,   342,   345,   334,   521,     0,   533,     0,
-     531,   555,     0,   554,     0,   563,   562,   342,   358,   359,
-     362,   379,   380,   383,   391,   397,   405,   425,   440,   446,
-     452,   458,   464,   470,   476,   494,     0,   362,   369,   368,
-       0,     0,     0,   370,     0,     0,     0,     0,   585,   584,
-     371,   373,   517,     0,     0,   372,   374,     0,   331,     0,
-       0,   330,   375,   376,   377,   378,   289,     0,     0,     0,
-     350,     0,     0,   351,   366,   367,   483,   484,   485,   486,
-     487,   488,   489,   490,   493,   491,   492,   482,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,   539,     0,   538,   597,     0,   295,     0,
-     287,     0,   242,   244,   243,     0,     0,   269,   271,   274,
-     283,   249,     0,     0,     0,   291,     0,   561,   560,     0,
-     362,   412,   430,   442,   448,   454,   460,   466,   472,   478,
-     496,   553,     0,   342,   343,     0,     0,   316,     0,     0,
-       0,   313,     0,     0,     0,   341,     0,   522,   520,     0,
-     519,   534,   530,     0,   529,   557,   556,     0,   346,     0,
-       0,   347,   363,   364,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,   565,
-       0,   564,     0,     0,     0,     0,     0,   580,   579,     0,
-       0,   518,   578,   323,   329,   325,   324,   327,   332,   354,
-       0,   356,     0,   340,     0,   353,   481,   389,   388,   390,
-     395,   396,   402,   403,   404,   424,   423,   421,   422,   419,
-     420,   436,   437,   438,   439,   445,   451,   457,   463,   469,
-       0,   499,   290,     0,   295,   288,   275,   277,     0,     0,
-     250,     0,   246,   292,   525,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,   550,   337,     0,   592,     0,     0,
-       0,     0,     0,     0,   317,     0,     0,   336,   535,   523,
-     532,     0,     0,     0,   349,   477,   385,   384,   386,   392,
-     393,   398,   399,   400,   411,   410,   408,   409,   406,   407,
-     426,   427,   428,   429,   441,   447,   453,   459,   465,     0,
-     495,     0,     0,     0,     0,     0,     0,   581,     0,   355,
-       0,   339,   352,     0,    12,     0,   276,   278,   270,   284,
-     247,     0,     0,   526,     0,   550,     0,   362,   479,   417,
-     415,   416,   413,   414,   431,   432,   433,   434,   443,   449,
-     455,   461,   467,     0,   497,   551,     0,     0,     0,   594,
-       0,     0,   310,     0,   308,   309,   318,   314,   335,   524,
-     594,     0,   348,     0,   540,     0,   544,   570,   567,   566,
-       0,   326,   328,   357,   475,    13,     0,   536,     0,   527,
-       0,     0,     0,   550,   594,     0,     0,   595,   594,   593,
-       0,     0,     0,   594,   471,     0,     0,     0,     0,   571,
-     572,     0,     0,     0,   528,   550,   547,   473,     0,     0,
-     594,   588,     0,   594,     0,   586,     0,   541,   543,   542,
-       0,     0,   568,   570,   573,   582,   548,     0,     0,     0,
-     590,     0,   589,     0,   594,   587,   574,   576,     0,     0,
-     549,     0,   545,   591,   311,     0,   575,   577,   569,   583,
-     546,   312
-};
-
-/* YYDEFGOTO[NTERM-NUM].  */
-static const yytype_int16 yydefgoto[] =
-{
-      -1,    41,   232,   233,    92,    93,    43,   150,   151,   152,
-     108,    44,   109,    45,   110,    46,   160,   301,   128,    47,
-     112,    48,   113,   114,    50,   115,    51,   116,    52,   117,
-      53,   118,   213,    54,   119,   214,    55,   120,   215,    56,
-     121,   216,    57,   122,   217,    58,   123,   218,    59,   124,
-     219,    60,   125,   220,    61,   126,   221,    62,   336,   437,
-     222,    63,    64,    65,    66,    98,   334,    67,   100,   101,
-     238,   415,    68,    69,    70,    71,   438,   223,    72,    73,
-      74,    75,    76,   460,   570,   571,   572,   718,    77,    78,
-      79,    80,    81,    96,   358,   517,    82,    83,   518,   751,
-     752,   591,   592,   520,   649,   650,   651,   607,   521,   608,
-     522,   609,   523,   660,   820,   627,   524,   611,   525,   612,
-     613,   527,   614,   528,   615,   529,   616,   530,   617,   732,
-     531,   618,   733,   532,   619,   734,   533,   620,   735,   534,
-     621,   736,   535,   622,   737,   536,   623,   738,   537,   624,
-     739,   538,   625,   740,   539,   867,   975,   741,   540,   541,
-     542,   543,   597,   865,   544,   599,   600,   757,   953,   545,
-     546,   547,   548,   976,   742,   549,   550,   551,   552,   553,
-     998,  1028,  1029,  1030,  1053,   554,   555,   556,   557,   558,
-     595,   889,  1016,   559
-};
-
-/* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
-   STATE-NUM.  */
-#define YYPACT_NINF -941
-static const yytype_int16 yypact[] =
-{
-    1516,  -941,  -941,  -941,    44,    -2,   839,    26,   178,    73,
-     192,   954,  2114,  2114,   189,  -941,  1516,   207,  2114,   245,
-     275,  2114,   226,    47,  2114,  2114,  -941,  1200,  -941,   280,
-    -941,  2114,  2114,  -941,  2114,    20,  2114,  2114,  2114,  2114,
-    -941,  -941,  -941,  -941,   350,  -941,   361,  2201,  -941,  -941,
-    -941,     6,   -21,   437,   446,   264,   269,   315,   306,   364,
-       9,  -941,  -941,    69,  -941,  -941,  -941,  -941,  -941,  -941,
-    -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,
-    -941,  -941,   417,  1516,  -941,    88,  -941,  1670,   839,    25,
-     435,  -941,  -941,  -941,   390,  -941,  -941,   338,    96,   338,
-     151,  -941,  -941,    90,  -941,   365,  -941,  -941,   390,  -941,
-     394,  2224,  -941,  -941,  -941,   215,   255,   483,   509,   504,
-     374,   377,   380,   424,    14,  -941,  -941,   163,   445,  -941,
-    -941,  2114,   452,  2114,  -941,  2114,  2114,   164,   486,  -941,
-    -941,  -941,  -941,  -941,  1279,  1516,  -941,  -941,   495,  -941,
-     311,  1706,   400,  -941,  -941,  -941,  -941,  1781,  2114,   418,
-    -941,  2114,   432,  -941,  -941,  -941,  -941,  -941,  -941,  -941,
-    -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  2114,  2114,
-    2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,
-    2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,
-    2114,  2114,  2114,  -941,  2114,  -941,  -941,  -941,  -941,  -941,
-     442,   737,   483,   355,   583,   428,   440,   453,   491,    17,
-    -941,  -941,   481,   469,   390,  -941,   505,   187,  -941,   513,
-      -5,   521,  -941,   177,  2114,   539,  -941,  2114,  -941,  -941,
-     545,  -941,  -941,  -941,   178,  -941,  -941,  -941,   236,  -941,
-    2114,   547,  -941,  -941,  -941,  2114,  2114,  2114,  2114,  2114,
-    2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,
-    2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,
-    -941,  2114,  -941,   499,   548,   559,   582,   617,  -941,  -941,
-     556,   226,  -941,  -941,  -941,    20,  -941,  -941,  -941,  -941,
-    -941,   628,  -941,   314,  -941,   329,  -941,  -941,  -941,  -941,
-    -941,   215,   215,   255,   255,   255,   483,   483,   483,   483,
-     483,   483,   509,   509,   509,   509,   504,   374,   377,   380,
-     424,   546,  -941,    29,   -11,  2114,  2114,  2114,  2114,  2114,
-    2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,
-    2114,  2114,  2114,  2114,  -941,   256,  -941,   567,   632,  2114,
-     563,  2114,  2114,  -941,   586,   358,  -941,  -941,   338,  -941,
-     574,   635,   436,  -941,  -941,  -941,  -941,  -941,   215,   215,
-     255,   255,   255,   483,   483,   483,   483,   483,   483,   509,
-     509,   509,   509,   504,   374,   377,   380,   424,   571,  -941,
-    1516,  2114,  1516,   584,  1516,   591,  -941,  1817,  -941,  2114,
-    -941,  -941,  2114,  2114,  2114,   656,   598,  2114,   648,  2224,
-    -941,   483,   483,   483,   483,   483,   355,   355,   355,   355,
-     583,   428,   440,   453,   491,   639,  -941,   614,   608,   649,
-     662,  1595,   651,   650,  -941,   283,  -941,  -941,  -941,  -941,
-    -941,  -941,  1595,   660,  -941,  2114,   681,   670,  -941,   716,
-    -941,  -941,   657,  -941,  -941,  -941,  -941,   680,  -941,  2114,
-     647,   654,  1516,  2114,  2114,  1595,   677,  -941,  -941,  -941,
-     141,   688,  1122,   707,   712,   179,   717,  1087,  2150,  2150,
-     728,  -941,  1595,   730,  2150,   732,   743,  2150,   754,    91,
-    2150,  2150,  -941,  1358,  -941,   755,  -941,  2150,  2150,  -941,
-    2150,   714,  2150,  2150,  2150,  2150,  -941,   756,  -941,  -941,
-    -941,   403,  -941,   434,  2240,  -941,  -941,  -941,   257,   581,
-     498,   619,   630,   747,   769,   753,   828,    23,  -941,  -941,
-     185,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,
-    -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  1595,
-    1595,  -941,   819,   685,   821,  1595,  -941,  1516,   171,  2114,
-     219,   716,  -941,   226,  1516,   692,  -941,  2114,  -941,  -941,
-     810,   822,  1595,  -941,   183,  -941,  1892,  1122,   305,   609,
-    -941,  -941,  -941,   441,  -941,  -941,   797,   195,   797,   203,
-    -941,  -941,   197,  -941,   816,  -941,  -941,   441,  -941,   447,
-    2263,  -941,  -941,  -941,   262,   698,   515,   640,   638,   812,
-     802,   811,   845,    28,  -941,  -941,   208,   739,  -941,  -941,
-    2150,   868,  2150,  -941,  2150,  2150,   216,   777,  -941,  -941,
-    -941,  -941,  -941,  1437,  1595,  -941,  -941,   740,  -941,   449,
-    1928,   827,  -941,  -941,  -941,  -941,  -941,  2003,  2150,   837,
-    -941,  2150,   841,  -941,  -941,  -941,  -941,  -941,  -941,  -941,
-    -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  2150,  2150,
-    2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,
-    2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,
-    2150,  2150,  2150,  -941,  2150,  -941,  -941,   844,  1595,   847,
-    -941,   848,  -941,  -941,  -941,     8,   842,  -941,   716,  -941,
-     880,  -941,  1516,   849,  1516,  -941,   859,  -941,  -941,   860,
-    2185,   515,   357,   655,   843,   838,   840,   884,   150,  -941,
-    -941,   857,   846,   441,  -941,   861,   299,  -941,   863,   181,
-     870,  -941,   284,  2150,   866,  -941,  2150,  -941,  -941,   873,
-    -941,  -941,  -941,   712,  -941,  -941,  -941,   301,  -941,  2150,
-     876,  -941,  -941,  -941,  2150,  2150,  2150,  2150,  2150,  2150,
-    2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,
-    2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  -941,
-    2150,  -941,   749,   871,   751,   757,   766,  -941,  -941,   872,
-     754,  -941,  -941,  -941,   714,  -941,  -941,  -941,  -941,  -941,
-     778,  -941,   464,  -941,   511,  -941,  -941,  -941,  -941,  -941,
-     262,   262,   698,   698,   698,   515,   515,   515,   515,   515,
-     515,   640,   640,   640,   640,   638,   812,   802,   811,   845,
-     878,  -941,  -941,   891,  1595,  -941,  1516,  1516,   894,   226,
-    -941,  1516,  -941,  -941,    39,    -7,  2150,  2150,  2150,  2150,
-    2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,
-    2150,  2150,  2150,  2150,  2150,  -941,   307,  -941,   897,   781,
-    2150,   892,  2150,  2150,  -941,   683,   522,  -941,  -941,   797,
-    -941,   902,   785,   525,  -941,  -941,  -941,  -941,  -941,   262,
-     262,   698,   698,   698,   515,   515,   515,   515,   515,   515,
-     640,   640,   640,   640,   638,   812,   802,   811,   845,   895,
-    -941,  1595,  2150,  1595,   904,  1595,   907,  -941,  2039,  -941,
-    2150,  -941,  -941,  2150,  -941,   906,  1516,  1516,  -941,  -941,
-    -941,  2150,  2150,   950,   912,  2150,   793,  2263,  -941,   515,
-     515,   515,   515,   515,   357,   357,   357,   357,   655,   843,
-     838,   840,   884,   908,  -941,   909,   889,   918,   796,  1595,
-     921,   919,  -941,   313,  -941,  -941,  -941,  -941,  -941,  -941,
-    1595,   923,  -941,  2150,   949,   798,  -941,   977,  -941,  -941,
-     916,  -941,  -941,  -941,  -941,  -941,   803,  -941,  2150,   900,
-     901,  1595,  2150,  2150,  1595,   928,   935,  1595,  1595,  -941,
-     937,   805,   939,  1595,  -941,  1595,   217,  2150,   237,   977,
-    -941,   754,  1595,   807,  -941,  2150,  -941,  -941,   931,   941,
-    1595,  -941,   942,  1595,   944,  -941,   946,  -941,  -941,  -941,
-      37,   940,  -941,   977,  -941,   973,  -941,  1595,   943,  1595,
-    -941,   948,  -941,   951,  1595,  -941,  1595,  1595,   961,   754,
-    -941,  1595,  -941,  -941,  -941,   963,  1595,  1595,  -941,  -941,
-    -941,  -941
-};
-
-/* YYPGOTO[NTERM-NUM].  */
-static const yytype_int16 yypgoto[] =
-{
-    -941,  -941,   645,  -941,  -941,     0,  -941,  -941,   715,  -941,
-      22,  -941,   186,  -941,  -941,  -941,   -29,  -941,   479,  -941,
-    -941,  -941,     3,   169,  -941,   105,  -941,   230,  -941,   725,
-    -941,   138,   423,  -941,  -174,   668,  -941,    31,   679,  -941,
-      40,   676,  -941,    42,   678,  -941,    68,   682,  -941,  -941,
-    -941,  -941,  -941,  -941,  -941,   -35,  -305,  -941,   172,    18,
-    -941,  -941,   -15,   -20,  -941,  -941,  -941,  -941,  -941,   791,
-     -91,   566,  -941,  -941,  -941,  -941,  -407,  -941,  -941,  -941,
-    -941,  -941,  -941,  -941,   319,  -941,   471,  -941,  -941,  -941,
-    -941,  -941,  -941,  -941,  -235,  -441,  -941,   -23,  -941,   148,
-    -941,  -941,  -432,  -941,  -941,   231,  -941,  -450,  -941,  -449,
-    -941,  -941,  -941,  -511,  -941,   167,  -941,  -941,  -941,  -329,
-     263,  -941,  -661,  -941,  -460,  -941,  -428,  -941,  -480,   -70,
-    -941,  -679,   170,  -941,  -673,   166,  -941,  -663,   173,  -941,
-    -660,   174,  -941,  -657,   165,  -941,  -941,  -941,  -941,  -941,
-    -941,  -941,  -601,  -841,  -941,  -302,  -473,  -941,  -941,  -454,
-    -493,  -941,  -941,  -941,  -941,  -941,   290,  -592,    46,  -941,
-    -941,  -941,  -941,  -940,  -941,  -941,  -941,  -941,  -941,  -941,
-    -941,     5,  -941,    49,  -941,  -941,  -941,  -941,  -941,  -941,
-    -941,  -760,  -652,  -468
-};
-
-/* YYTABLE[YYPACT[STATE-NUM]].  What to do in state STATE-NUM.  If
-   positive, shift that token.  If negative, reduce the rule which
-   number is the opposite.  If zero, do what YYDEFACT says.
-   If YYTABLE_NINF, syntax error.  */
-#define YYTABLE_NINF -1
-static const yytype_uint16 yytable[] =
-{
-      42,   132,   138,    49,   144,   637,   761,   902,   242,   519,
-     471,   564,   663,   371,   626,  1010,    42,   163,   845,    49,
-     519,   830,   831,   326,   636,   846,   958,    42,    94,   127,
-      49,   420,   593,   594,   581,   643,   847,   647,   631,   137,
-     848,   973,   974,   519,   849,    84,   435,   436,   139,   817,
-     201,   413,   148,   182,   183,   278,   821,   360,   350,   416,
-     519,   951,   361,   954,   701,   236,    87,   580,   207,   797,
-     203,   519,   179,  1038,   102,   856,   417,   826,   281,   249,
-     955,   252,   755,    42,   180,   181,    49,   226,    97,   208,
-     149,   246,   638,   227,   202,  1058,   768,   239,   771,   279,
-     393,   850,   351,   851,  1066,   706,    85,   800,   702,   468,
-     224,  1007,   526,   798,   924,   414,   298,   909,   910,   707,
-     440,   925,   302,   526,   711,   952,   978,   519,   519,   207,
-     293,    86,   926,   519,   140,   103,   927,   743,   744,   204,
-     928,   726,   583,   307,    42,    42,   526,    49,    49,   283,
-     519,   285,   243,   286,   287,   898,   205,   802,   731,   804,
-     104,   805,   806,   526,   280,   288,   240,   331,   579,   332,
-     723,  1037,   713,   905,   526,   209,   303,   247,   639,   305,
-     601,   129,   130,   241,   727,   822,   703,   134,   824,   706,
-     812,   881,    95,   141,   142,   354,   758,   929,   765,   930,
-     146,   147,   367,   584,   762,   153,   154,   155,   156,   799,
-     563,   519,   519,   841,   842,   843,   844,   807,  1048,   178,
-     374,   244,   678,  1021,   832,   833,   834,   716,   585,   327,
-     526,   526,   885,   281,   281,   882,   526,   363,   245,   328,
-      99,   602,   329,   891,   398,  1051,   399,   364,   892,   356,
-     282,   289,   365,   526,   105,   704,   357,   131,   714,   835,
-     836,   837,   838,   839,   840,   759,   603,   853,   372,   330,
-     728,   406,   705,   763,   225,   133,   519,   451,   800,   717,
-     896,   256,   760,   255,   766,    27,   800,   311,   312,   982,
-     764,   984,   985,   257,   258,   801,   903,  1052,   356,   193,
-     194,   195,   196,   808,  1049,   370,   394,   989,   774,   920,
-     921,   922,   923,   135,   526,   526,   395,   937,   356,   396,
-     911,   912,   913,   679,   444,   439,   446,   447,   775,   259,
-     260,   322,   323,   324,   325,   680,   681,  1002,  1022,  1003,
-     776,   777,  1004,   136,   894,   356,   397,   145,   308,   309,
-     310,   197,   562,   418,   895,   914,   915,   916,   917,   918,
-     919,   887,  1039,   887,   378,   379,  1042,   745,   888,   887,
-     901,  1046,   464,   746,   465,   887,   977,   466,   337,   526,
-     868,   295,  1020,   296,   281,   456,   410,   458,  1061,   461,
-     199,  1063,  1024,   956,   338,   339,   869,   870,   198,   281,
-      42,   411,    42,    49,    42,    49,   200,    49,   389,   390,
-     391,   392,  1075,   945,   313,   314,   315,   206,   157,   457,
-     566,   158,   519,   159,   237,   375,   376,   377,   281,   157,
-     450,   467,   161,   248,   162,   340,   341,   871,   872,   731,
-     959,   960,   961,   962,   963,   731,   731,   731,   731,   731,
-     731,   731,   731,   731,   731,   731,   274,   578,   157,   995,
-     275,   234,   157,   235,   276,   250,   277,   251,   187,   188,
-     299,   657,    42,   284,   658,    49,   659,   994,  1006,   996,
-     304,   999,   184,   185,   186,   189,   190,   575,   253,   254,
-     111,   380,   381,   382,   306,   228,   229,   230,   231,   519,
-     111,   519,   657,   519,   333,   661,   281,   662,   454,   657,
-     346,  1017,   753,   111,   754,   657,   290,   291,   769,   814,
-     770,   815,  1017,   347,   731,   526,   191,   192,   261,   262,
-     263,   264,   265,   349,   800,  1033,   941,   348,  1055,   270,
-     271,   272,   273,   684,   685,   686,  1017,   519,   266,   267,
-    1017,   352,   712,   720,  1050,  1017,   353,  1036,   519,   721,
-     780,   781,   782,   706,   294,   281,   211,    42,   400,   281,
-      49,  1047,  1017,   355,    42,  1017,  1079,    49,  1056,   519,
-     359,   800,   519,   942,   731,   519,   519,   715,   362,   268,
-     269,   519,   800,   519,   988,   800,  1017,   992,  1076,  1077,
-     519,   366,   526,  1070,   526,  1072,   526,   368,   519,   373,
-     111,   519,   111,   412,   111,   111,   401,  1080,   342,   343,
-     344,   345,   706,   706,   405,   519,   441,   519,   402,   281,
-     111,   445,   519,   452,   519,   519,   111,   111,   455,   519,
-     111,   687,   688,   459,   519,   519,   448,   229,   230,   231,
-     526,   403,   281,   462,   610,   682,   683,   111,   689,   690,
-     470,   526,   783,   784,   610,   693,   694,   695,   696,   747,
-     748,   749,   750,   789,   790,   791,   792,   610,   469,   785,
-     786,   111,   526,   111,   281,   526,   404,   281,   526,   526,
-     873,   874,   875,   876,   526,   474,   526,   408,   409,   691,
-     692,   442,   443,   526,   453,   443,   473,   860,   475,   862,
-     560,   526,   561,   111,   526,   567,   111,   472,   281,   565,
-     787,   788,    42,   569,    42,    49,   573,    49,   526,   111,
-     526,   476,   443,   414,   111,   526,   582,   526,   526,   568,
-     281,   577,   526,   986,   748,   749,   750,   526,   526,   574,
-     281,   628,   629,   730,   709,   443,   586,   633,   111,   335,
-     111,   722,   281,   640,   641,   426,   427,   428,   429,   596,
-     645,   646,   778,   779,   598,   652,   653,   654,   655,   604,
-     253,   254,   772,   773,   648,   166,   167,   168,   169,   170,
-     171,   172,   173,   174,   175,   176,   630,   610,   632,   610,
-     634,   610,   610,   964,   965,   966,   967,   809,   810,   813,
-     800,   635,   212,   503,   111,   419,   656,   610,   931,   800,
-     933,   800,   644,   177,   610,   610,   934,   800,   610,   697,
-     419,   419,   111,   946,   947,   935,   800,   699,   111,   949,
-     111,   111,     1,     2,     3,   610,   950,   939,   940,    88,
-     980,   981,   698,    89,   991,   981,    42,    42,    15,    49,
-      49,    42,  1011,   800,    49,  1015,   981,  1026,   800,   610,
-     700,   610,  1032,   800,  1044,   981,  1057,   800,   708,   724,
-     111,   710,   725,   756,   767,   794,   111,   796,   111,   803,
-      26,   111,   111,   419,   793,   795,   111,   818,    90,   823,
-      28,    91,    30,   825,   852,    33,   854,    34,   855,   857,
-      35,   859,   316,   317,   318,   319,   320,   321,   861,   863,
-     610,   878,   864,   610,   879,   877,   880,   883,   897,   886,
-     890,   207,   207,   884,   111,   899,   610,   893,   904,   932,
-     936,   610,   827,   828,   829,   943,    42,    42,   111,    49,
-      49,   944,   419,   111,   948,   106,   979,     1,     2,     3,
-     983,   990,   993,   997,    88,   610,  1005,   610,    89,  1000,
-      12,    13,  1008,    15,  1009,  1012,  1013,  1014,    18,   800,
-    1018,  1019,  1023,  1025,  1027,  1031,   952,  1040,  1035,   383,
-     384,   385,   386,   387,   388,  1041,  1043,    24,    25,  1045,
-    1059,  1060,  1062,  1064,  1069,    26,  1065,  1067,  1073,   449,
-     407,  1074,  1071,    90,   430,    28,    91,    30,    31,    32,
-      33,  1078,    34,  1081,   432,    35,   431,   433,    36,    37,
-      38,    39,   434,   610,   957,   369,   576,   858,   906,   907,
-     908,   107,   719,   987,   969,   938,   972,   968,   111,   957,
-     957,   610,   970,   900,   971,  1034,   111,   610,  1068,   610,
-     610,   212,   421,   422,   423,   424,   425,   212,   212,   212,
-     212,   212,   212,   212,   212,   212,   212,   212,  1054,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,   605,     0,
-     477,   478,   479,     0,     0,     0,     0,   587,     0,   610,
-       0,   588,     0,   488,   489,   610,   491,   610,     0,     0,
-     610,   494,     0,     0,     0,     0,     0,     0,   610,   957,
-       0,     0,   610,     0,     0,   477,   478,   479,     0,     0,
-     500,   501,   587,     0,     0,     0,   588,     0,   502,   212,
-       0,   491,     0,     0,     0,     0,   589,     0,   504,   590,
-     506,   507,   508,   509,     0,   510,     0,     0,   511,     0,
-     610,   512,   513,   514,   515,     0,     0,     0,     0,     0,
-       0,     0,     0,   502,   606,   610,     0,     0,     0,   957,
-     610,   589,     0,   504,   590,   506,     0,     0,   509,     0,
-     510,     0,     0,   511,   610,     0,     0,     0,   212,     0,
-       0,     0,   610,     1,     2,     3,     4,     0,     0,     5,
-       6,     7,     8,     9,    10,    11,    12,    13,    14,    15,
-      16,    17,     0,     0,    18,    19,    20,     0,    21,    22,
-       0,     0,    23,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,    24,    25,     0,     0,     0,     0,     0,
-       0,    26,     0,     0,     0,     0,     0,     0,     0,    27,
-     143,    28,    29,    30,    31,    32,    33,     0,    34,     0,
-       0,    35,     0,     0,    36,    37,    38,    39,     0,     0,
-       0,     0,     1,     2,     3,     4,     0,    40,     5,     6,
-       7,     8,     9,    10,    11,    12,    13,    14,    15,    16,
-      17,     0,     0,    18,    19,    20,     0,    21,    22,     0,
-       0,    23,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,    24,    25,     0,     0,     0,     0,     0,     0,
-      26,     0,     0,     0,     0,     0,     0,     0,    27,   292,
-      28,    29,    30,    31,    32,    33,     0,    34,     0,     0,
-      35,     0,     0,    36,    37,    38,    39,     0,     0,     0,
-       0,   477,   478,   479,   480,     0,    40,   481,   482,   483,
-     484,   485,   486,   487,   488,   489,   490,   491,   492,   493,
-       0,     0,   494,   495,   496,     0,   497,   498,     0,     0,
-     499,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,   500,   501,     0,     0,     0,     0,     0,     0,   502,
-       0,     0,     0,     0,     0,     0,     0,   503,   642,   504,
-     505,   506,   507,   508,   509,     0,   510,     0,     0,   511,
-       0,     0,   512,   513,   514,   515,     0,     0,     0,     0,
-     477,   478,   479,   480,     0,   516,   481,   482,   483,   484,
-     485,   486,   487,   488,   489,   490,   491,   492,   493,     0,
-       0,   494,   495,   496,     0,   497,   498,     0,     0,   499,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-     500,   501,     0,     0,     0,     0,     0,     0,   502,     0,
-       0,     0,     0,     0,     0,     0,   503,   811,   504,   505,
-     506,   507,   508,   509,     0,   510,     0,     0,   511,     0,
-       0,   512,   513,   514,   515,     0,     0,     0,     0,     1,
-       2,     3,     4,     0,   516,     5,     6,     7,     8,     9,
-      10,    11,    12,    13,    14,    15,    16,    17,     0,     0,
-      18,    19,    20,     0,    21,    22,     0,     0,    23,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,    24,
-      25,     0,     0,     0,     0,     0,     0,    26,     0,     0,
-       0,     0,     0,     0,     0,    27,     0,    28,    29,    30,
-      31,    32,    33,     0,    34,     0,     0,    35,     0,     0,
-      36,    37,    38,    39,     0,     0,     0,     0,   477,   478,
-     479,   480,     0,    40,   481,   482,   483,   484,   485,   486,
-     487,   488,   489,   490,   491,   492,   493,     0,     0,   494,
-     495,   496,     0,   497,   498,     0,     0,   499,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,   500,   501,
-       0,     0,     0,     0,     0,     0,   502,     0,     0,     0,
-       0,     0,     0,     0,   503,     0,   504,   505,   506,   507,
-     508,   509,     0,   510,     0,     0,   511,     0,     0,   512,
-     513,   514,   515,     1,     2,     3,     0,     0,     0,     0,
-      88,   210,   516,     0,    89,     0,    12,    13,     0,    15,
-       0,     0,     0,     0,    18,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     1,
-       2,     3,     0,    24,    25,     0,    88,     0,     0,     0,
-      89,    26,    12,    13,     0,    15,     0,     0,     0,    90,
-      18,    28,    91,    30,    31,    32,    33,     0,    34,     0,
-       0,    35,     0,     0,    36,    37,    38,    39,     0,    24,
-      25,     0,     0,     0,     0,     0,     0,    26,     0,     0,
-       0,     0,     0,     0,     0,    90,     0,    28,    91,    30,
-      31,    32,    33,     0,    34,     0,     0,    35,   297,     0,
-      36,    37,    38,    39,     1,     2,     3,     0,     0,     0,
-       0,    88,     0,     0,     0,    89,     0,    12,    13,     0,
-      15,     0,     0,     0,     0,    18,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       1,     2,     3,     0,    24,    25,     0,    88,     0,     0,
-       0,    89,    26,    12,    13,     0,    15,     0,     0,     0,
-      90,    18,    28,    91,    30,    31,    32,    33,     0,    34,
-     300,     0,    35,     0,     0,    36,    37,    38,    39,     0,
-      24,    25,     0,     0,     0,     0,     0,     0,    26,     0,
-       0,     0,     0,     0,     0,     0,    90,     0,    28,    91,
-      30,    31,    32,    33,     0,    34,     0,     0,    35,   463,
-       0,    36,    37,    38,    39,   477,   478,   479,     0,     0,
-       0,     0,   587,   729,     0,     0,   588,     0,   488,   489,
-       0,   491,     0,     0,     0,     0,   494,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,   477,   478,   479,     0,   500,   501,     0,   587,     0,
-       0,     0,   588,   502,   488,   489,     0,   491,     0,     0,
-       0,   589,   494,   504,   590,   506,   507,   508,   509,     0,
-     510,     0,     0,   511,     0,     0,   512,   513,   514,   515,
-       0,   500,   501,     0,     0,     0,     0,     0,     0,   502,
-       0,     0,     0,     0,     0,     0,     0,   589,     0,   504,
-     590,   506,   507,   508,   509,     0,   510,     0,     0,   511,
-     816,     0,   512,   513,   514,   515,   477,   478,   479,     0,
-       0,     0,     0,   587,     0,     0,     0,   588,     0,   488,
-     489,     0,   491,     0,     0,     0,     0,   494,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,   477,   478,   479,     0,   500,   501,     0,   587,
-       0,     0,     0,   588,   502,   488,   489,     0,   491,     0,
-       0,     0,   589,   494,   504,   590,   506,   507,   508,   509,
-       0,   510,   819,     0,   511,     0,     0,   512,   513,   514,
-     515,     0,   500,   501,     0,     0,     0,     0,     0,     0,
-     502,     0,     0,     0,     0,     0,     0,     0,   589,     0,
-     504,   590,   506,   507,   508,   509,     0,   510,     0,     0,
-     511,  1001,     0,   512,   513,   514,   515,     1,     2,     3,
-       0,     0,     0,     0,    88,     0,     0,     0,    89,     0,
-      12,    13,     0,    15,     0,     0,     0,     0,    18,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,   477,   478,   479,     0,    24,    25,     0,
-     587,     0,     0,     0,   588,    26,   488,   489,     0,   491,
-       0,     0,     0,    90,   494,    28,    91,    30,    31,    32,
-      33,     0,    34,     0,     0,    35,     0,     0,    36,    37,
-      38,    39,     0,   500,   501,     0,     0,     0,     0,     0,
-       0,   502,     0,     0,     0,     0,     0,   866,     0,   589,
-       0,   504,   590,   506,   507,   508,   509,     0,   510,     0,
-       0,   511,     0,     0,   512,   513,   514,   515,   772,   773,
-       0,     0,     0,   666,   667,   668,   669,   670,   671,   672,
-     673,   674,   675,   676,   164,   165,     0,     0,     0,   166,
-     167,   168,   169,   170,   171,   172,   173,   174,   175,   176,
-       0,     0,     0,     0,     0,     0,     0,   253,   254,     0,
-       0,   677,   166,   167,   168,   169,   170,   171,   172,   173,
-     174,   175,   176,   664,   665,     0,     0,   177,   666,   667,
-     668,   669,   670,   671,   672,   673,   674,   675,   676,     0,
-       0,     0,     0,     0,     0,     0,   772,   773,     0,     0,
-     177,   666,   667,   668,   669,   670,   671,   672,   673,   674,
-     675,   676,     0,     0,     0,     0,   677,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,   677
-};
-
-static const yytype_int16 yycheck[] =
-{
-       0,    16,    22,     0,    27,   498,   598,   767,    99,   441,
-     417,   452,   523,   248,   487,   955,    16,    46,   697,    16,
-     452,   682,   683,   197,   497,   698,   867,    27,     6,    11,
-      27,   336,   482,   482,   475,   503,   699,   510,   492,    21,
-     700,   882,   883,   475,   701,     1,   351,   352,     1,   650,
-      41,    22,    34,    74,    75,    41,   657,    62,    41,    70,
-     492,    22,    67,    70,    41,    94,    68,   474,    83,    41,
-       1,   503,    66,  1013,     1,    67,    87,   678,    70,   108,
-      87,   110,   593,    83,    78,    79,    83,    62,    62,     1,
-      70,     1,     1,    68,    85,  1035,   607,     1,   609,    85,
-     274,   702,    85,   704,    67,   559,    62,    70,    85,   414,
-      88,   952,   441,    85,   793,    86,   151,   778,   779,   560,
-     355,   794,   157,   452,   565,    86,   886,   559,   560,   144,
-     145,    87,   795,   565,    87,    62,   796,   587,   587,    70,
-     797,   582,     1,   178,   144,   145,   475,   144,   145,   131,
-     582,   133,     1,   135,   136,   756,    87,   630,   586,   632,
-      87,   634,   635,   492,     1,     1,    70,   202,   473,   204,
-     577,  1012,     1,   774,   503,    87,   158,    87,    87,   161,
-       1,    12,    13,    87,     1,   658,     1,    18,   661,   643,
-     644,    41,     6,    24,    25,   224,     1,   798,     1,   800,
-      31,    32,   237,    62,     1,    36,    37,    38,    39,     1,
-     445,   643,   644,   693,   694,   695,   696,     1,     1,    47,
-     255,    70,   524,   983,   684,   685,   686,     8,    87,   198,
-     559,   560,   743,    70,    70,    85,   565,    60,    87,   199,
-      62,    62,   200,    62,   279,     8,   281,    70,    67,    62,
-      87,    87,   234,   582,    62,    70,    69,    68,    87,   687,
-     688,   689,   690,   691,   692,    70,    87,   708,   250,   201,
-      87,   291,    87,    70,    88,    68,   708,   368,    70,    60,
-     753,    66,    87,   111,    87,    59,    70,   182,   183,   890,
-      87,   892,   893,    78,    79,    87,   769,    60,    62,    35,
-      36,    37,    38,    87,    87,    69,   275,   899,   610,   789,
-     790,   791,   792,    68,   643,   644,   276,   810,    62,   277,
-     780,   781,   782,    66,   359,    69,   361,   362,    66,    74,
-      75,   193,   194,   195,   196,    78,    79,   938,   990,   940,
-      78,    79,   943,    68,    60,    62,   278,    67,   179,   180,
-     181,    82,    69,   335,    70,   783,   784,   785,   786,   787,
-     788,    62,  1014,    62,   259,   260,  1018,    62,    69,    62,
-      69,  1023,   407,    68,   409,    62,    69,   412,    23,   708,
-      23,    70,    69,    72,    70,   400,    72,   402,  1040,   404,
-      84,  1043,   993,   866,    39,    40,    39,    40,    83,    70,
-     400,    72,   402,   400,   404,   402,    42,   404,   270,   271,
-     272,   273,  1064,   854,   184,   185,   186,     0,    68,   401,
-     455,    71,   854,    73,    86,   256,   257,   258,    70,    68,
-      72,   413,    71,    68,    73,    80,    81,    80,    81,   867,
-     868,   869,   870,   871,   872,   873,   874,   875,   876,   877,
-     878,   879,   880,   881,   882,   883,    82,   472,    68,   932,
-      83,    71,    68,    73,    84,    71,    42,    73,    22,    23,
-      70,    68,   472,    21,    71,   472,    73,   931,   951,   933,
-      62,   935,    45,    46,    47,    39,    40,   469,    43,    44,
-      11,   261,   262,   263,    62,    60,    61,    62,    63,   931,
-      21,   933,    68,   935,    62,    71,    70,    73,    72,    68,
-      82,   979,    71,    34,    73,    68,    30,    31,    71,    70,
-      73,    72,   990,    83,   952,   854,    80,    81,    45,    46,
-      47,    22,    23,    42,    70,  1008,    72,    84,  1031,    35,
-      36,    37,    38,    45,    46,    47,  1014,   979,    39,    40,
-    1018,    70,   567,   573,  1027,  1023,    87,  1011,   990,   574,
-      45,    46,    47,  1017,    69,    70,    87,   567,    69,    70,
-     567,  1025,  1040,    68,   574,  1043,  1069,   574,  1032,  1011,
-      67,    70,  1014,    72,  1012,  1017,  1018,   569,    67,    80,
-      81,  1023,    70,  1025,    72,    70,  1064,    72,  1066,  1067,
-    1032,    62,   931,  1057,   933,  1059,   935,    62,  1040,    62,
-     131,  1043,   133,    67,   135,   136,    68,  1071,    35,    36,
-      37,    38,  1076,  1077,    68,  1057,    59,  1059,    69,    70,
-     151,    68,  1064,    59,  1066,  1067,   157,   158,    67,  1071,
-     161,    22,    23,    59,  1076,  1077,    60,    61,    62,    63,
-     979,    69,    70,    62,   487,    74,    75,   178,    39,    40,
-      62,   990,    22,    23,   497,    35,    36,    37,    38,    60,
-      61,    62,    63,    35,    36,    37,    38,   510,    22,    39,
-      40,   202,  1011,   204,    70,  1014,    69,    70,  1017,  1018,
-      35,    36,    37,    38,  1023,    87,  1025,    69,    70,    80,
-      81,    69,    70,  1032,    69,    70,    67,   722,    59,   724,
-      59,  1040,    62,   234,  1043,    34,   237,    69,    70,    59,
-      80,    81,   722,     7,   724,   722,    69,   724,  1057,   250,
-    1059,    69,    70,    86,   255,  1064,    59,  1066,  1067,    69,
-      70,    87,  1071,    60,    61,    62,    63,  1076,  1077,    69,
-      70,   488,   489,   586,    69,    70,    68,   494,   279,    22,
-     281,    69,    70,   500,   501,   342,   343,   344,   345,    62,
-     507,   508,    74,    75,    62,   512,   513,   514,   515,    62,
-      43,    44,    43,    44,    70,    48,    49,    50,    51,    52,
-      53,    54,    55,    56,    57,    58,    68,   630,    68,   632,
-      68,   634,   635,   873,   874,   875,   876,    30,    31,    69,
-      70,    68,    87,    59,   335,   336,    60,   650,    69,    70,
-      69,    70,    67,    86,   657,   658,    69,    70,   661,    82,
-     351,   352,   353,   856,   857,    69,    70,    84,   359,   859,
-     361,   362,     3,     4,     5,   678,   861,    69,    70,    10,
-      69,    70,    83,    14,    69,    70,   856,   857,    19,   856,
-     857,   861,    69,    70,   861,    69,    70,    69,    70,   702,
-      42,   704,    69,    70,    69,    70,    69,    70,    59,    69,
-     401,    60,    60,    86,    68,    83,   407,    42,   409,    21,
-      51,   412,   413,   414,    82,    84,   417,    70,    59,    62,
-      61,    62,    63,    62,    60,    66,    59,    68,    60,    67,
-      71,    31,   187,   188,   189,   190,   191,   192,    69,    60,
-     753,    83,    62,   756,    84,    82,    42,    70,    62,    68,
-      67,   946,   947,    87,   455,    62,   769,    67,    62,    68,
-      68,   774,   679,   680,   681,    67,   946,   947,   469,   946,
-     947,    60,   473,   474,    60,     1,    59,     3,     4,     5,
-      68,    59,    67,    59,    10,   798,    60,   800,    14,    62,
-      16,    17,    22,    19,    62,    67,    87,    59,    24,    70,
-      59,    62,    59,    34,     7,    69,    86,    59,    87,   264,
-     265,   266,   267,   268,   269,    60,    59,    43,    44,    60,
-      69,    60,    60,    59,    31,    51,    60,    67,    60,   364,
-     295,    60,    69,    59,   346,    61,    62,    63,    64,    65,
-      66,    60,    68,    60,   348,    71,   347,   349,    74,    75,
-      76,    77,   350,   866,   867,   244,   470,   718,   775,   776,
-     777,    87,   571,   895,   878,   814,   881,   877,   569,   882,
-     883,   884,   879,   763,   880,  1009,   577,   890,  1053,   892,
-     893,   336,   337,   338,   339,   340,   341,   342,   343,   344,
-     345,   346,   347,   348,   349,   350,   351,   352,  1029,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,     1,    -1,
-       3,     4,     5,    -1,    -1,    -1,    -1,    10,    -1,   932,
-      -1,    14,    -1,    16,    17,   938,    19,   940,    -1,    -1,
-     943,    24,    -1,    -1,    -1,    -1,    -1,    -1,   951,   952,
-      -1,    -1,   955,    -1,    -1,     3,     4,     5,    -1,    -1,
-      43,    44,    10,    -1,    -1,    -1,    14,    -1,    51,   414,
-      -1,    19,    -1,    -1,    -1,    -1,    59,    -1,    61,    62,
-      63,    64,    65,    66,    -1,    68,    -1,    -1,    71,    -1,
-     993,    74,    75,    76,    77,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    51,    87,  1008,    -1,    -1,    -1,  1012,
-    1013,    59,    -1,    61,    62,    63,    -1,    -1,    66,    -1,
-      68,    -1,    -1,    71,  1027,    -1,    -1,    -1,   473,    -1,
-      -1,    -1,  1035,     3,     4,     5,     6,    -1,    -1,     9,
-      10,    11,    12,    13,    14,    15,    16,    17,    18,    19,
-      20,    21,    -1,    -1,    24,    25,    26,    -1,    28,    29,
-      -1,    -1,    32,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    43,    44,    -1,    -1,    -1,    -1,    -1,
-      -1,    51,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    59,
-      60,    61,    62,    63,    64,    65,    66,    -1,    68,    -1,
-      -1,    71,    -1,    -1,    74,    75,    76,    77,    -1,    -1,
-      -1,    -1,     3,     4,     5,     6,    -1,    87,     9,    10,
-      11,    12,    13,    14,    15,    16,    17,    18,    19,    20,
-      21,    -1,    -1,    24,    25,    26,    -1,    28,    29,    -1,
-      -1,    32,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    43,    44,    -1,    -1,    -1,    -1,    -1,    -1,
-      51,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    59,    60,
-      61,    62,    63,    64,    65,    66,    -1,    68,    -1,    -1,
-      71,    -1,    -1,    74,    75,    76,    77,    -1,    -1,    -1,
-      -1,     3,     4,     5,     6,    -1,    87,     9,    10,    11,
-      12,    13,    14,    15,    16,    17,    18,    19,    20,    21,
-      -1,    -1,    24,    25,    26,    -1,    28,    29,    -1,    -1,
-      32,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    43,    44,    -1,    -1,    -1,    -1,    -1,    -1,    51,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    59,    60,    61,
-      62,    63,    64,    65,    66,    -1,    68,    -1,    -1,    71,
-      -1,    -1,    74,    75,    76,    77,    -1,    -1,    -1,    -1,
-       3,     4,     5,     6,    -1,    87,     9,    10,    11,    12,
-      13,    14,    15,    16,    17,    18,    19,    20,    21,    -1,
-      -1,    24,    25,    26,    -1,    28,    29,    -1,    -1,    32,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      43,    44,    -1,    -1,    -1,    -1,    -1,    -1,    51,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    59,    60,    61,    62,
-      63,    64,    65,    66,    -1,    68,    -1,    -1,    71,    -1,
-      -1,    74,    75,    76,    77,    -1,    -1,    -1,    -1,     3,
-       4,     5,     6,    -1,    87,     9,    10,    11,    12,    13,
-      14,    15,    16,    17,    18,    19,    20,    21,    -1,    -1,
-      24,    25,    26,    -1,    28,    29,    -1,    -1,    32,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    43,
-      44,    -1,    -1,    -1,    -1,    -1,    -1,    51,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    59,    -1,    61,    62,    63,
-      64,    65,    66,    -1,    68,    -1,    -1,    71,    -1,    -1,
-      74,    75,    76,    77,    -1,    -1,    -1,    -1,     3,     4,
-       5,     6,    -1,    87,     9,    10,    11,    12,    13,    14,
-      15,    16,    17,    18,    19,    20,    21,    -1,    -1,    24,
-      25,    26,    -1,    28,    29,    -1,    -1,    32,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    43,    44,
-      -1,    -1,    -1,    -1,    -1,    -1,    51,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    59,    -1,    61,    62,    63,    64,
-      65,    66,    -1,    68,    -1,    -1,    71,    -1,    -1,    74,
-      75,    76,    77,     3,     4,     5,    -1,    -1,    -1,    -1,
-      10,    11,    87,    -1,    14,    -1,    16,    17,    -1,    19,
-      -1,    -1,    -1,    -1,    24,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,     3,
-       4,     5,    -1,    43,    44,    -1,    10,    -1,    -1,    -1,
-      14,    51,    16,    17,    -1,    19,    -1,    -1,    -1,    59,
-      24,    61,    62,    63,    64,    65,    66,    -1,    68,    -1,
-      -1,    71,    -1,    -1,    74,    75,    76,    77,    -1,    43,
-      44,    -1,    -1,    -1,    -1,    -1,    -1,    51,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    59,    -1,    61,    62,    63,
-      64,    65,    66,    -1,    68,    -1,    -1,    71,    72,    -1,
-      74,    75,    76,    77,     3,     4,     5,    -1,    -1,    -1,
-      -1,    10,    -1,    -1,    -1,    14,    -1,    16,    17,    -1,
-      19,    -1,    -1,    -1,    -1,    24,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-       3,     4,     5,    -1,    43,    44,    -1,    10,    -1,    -1,
-      -1,    14,    51,    16,    17,    -1,    19,    -1,    -1,    -1,
-      59,    24,    61,    62,    63,    64,    65,    66,    -1,    68,
-      69,    -1,    71,    -1,    -1,    74,    75,    76,    77,    -1,
-      43,    44,    -1,    -1,    -1,    -1,    -1,    -1,    51,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    59,    -1,    61,    62,
-      63,    64,    65,    66,    -1,    68,    -1,    -1,    71,    72,
-      -1,    74,    75,    76,    77,     3,     4,     5,    -1,    -1,
-      -1,    -1,    10,    11,    -1,    -1,    14,    -1,    16,    17,
-      -1,    19,    -1,    -1,    -1,    -1,    24,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,     3,     4,     5,    -1,    43,    44,    -1,    10,    -1,
-      -1,    -1,    14,    51,    16,    17,    -1,    19,    -1,    -1,
-      -1,    59,    24,    61,    62,    63,    64,    65,    66,    -1,
-      68,    -1,    -1,    71,    -1,    -1,    74,    75,    76,    77,
-      -1,    43,    44,    -1,    -1,    -1,    -1,    -1,    -1,    51,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    59,    -1,    61,
-      62,    63,    64,    65,    66,    -1,    68,    -1,    -1,    71,
-      72,    -1,    74,    75,    76,    77,     3,     4,     5,    -1,
-      -1,    -1,    -1,    10,    -1,    -1,    -1,    14,    -1,    16,
-      17,    -1,    19,    -1,    -1,    -1,    -1,    24,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,     3,     4,     5,    -1,    43,    44,    -1,    10,
-      -1,    -1,    -1,    14,    51,    16,    17,    -1,    19,    -1,
-      -1,    -1,    59,    24,    61,    62,    63,    64,    65,    66,
-      -1,    68,    69,    -1,    71,    -1,    -1,    74,    75,    76,
-      77,    -1,    43,    44,    -1,    -1,    -1,    -1,    -1,    -1,
-      51,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    59,    -1,
-      61,    62,    63,    64,    65,    66,    -1,    68,    -1,    -1,
-      71,    72,    -1,    74,    75,    76,    77,     3,     4,     5,
-      -1,    -1,    -1,    -1,    10,    -1,    -1,    -1,    14,    -1,
-      16,    17,    -1,    19,    -1,    -1,    -1,    -1,    24,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,     3,     4,     5,    -1,    43,    44,    -1,
-      10,    -1,    -1,    -1,    14,    51,    16,    17,    -1,    19,
-      -1,    -1,    -1,    59,    24,    61,    62,    63,    64,    65,
-      66,    -1,    68,    -1,    -1,    71,    -1,    -1,    74,    75,
-      76,    77,    -1,    43,    44,    -1,    -1,    -1,    -1,    -1,
-      -1,    51,    -1,    -1,    -1,    -1,    -1,    22,    -1,    59,
-      -1,    61,    62,    63,    64,    65,    66,    -1,    68,    -1,
-      -1,    71,    -1,    -1,    74,    75,    76,    77,    43,    44,
-      -1,    -1,    -1,    48,    49,    50,    51,    52,    53,    54,
-      55,    56,    57,    58,    43,    44,    -1,    -1,    -1,    48,
-      49,    50,    51,    52,    53,    54,    55,    56,    57,    58,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    43,    44,    -1,
-      -1,    86,    48,    49,    50,    51,    52,    53,    54,    55,
-      56,    57,    58,    43,    44,    -1,    -1,    86,    48,    49,
-      50,    51,    52,    53,    54,    55,    56,    57,    58,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    43,    44,    -1,    -1,
-      86,    48,    49,    50,    51,    52,    53,    54,    55,    56,
-      57,    58,    -1,    -1,    -1,    -1,    86,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    86
-};
-
-/* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
-   symbol of state STATE-NUM.  */
-static const yytype_uint16 yystos[] =
-{
-       0,     3,     4,     5,     6,     9,    10,    11,    12,    13,
-      14,    15,    16,    17,    18,    19,    20,    21,    24,    25,
-      26,    28,    29,    32,    43,    44,    51,    59,    61,    62,
-      63,    64,    65,    66,    68,    71,    74,    75,    76,    77,
-      87,    89,    93,    94,    99,   101,   103,   107,   109,   110,
-     112,   114,   116,   118,   121,   124,   127,   130,   133,   136,
-     139,   142,   145,   149,   150,   151,   152,   155,   160,   161,
-     162,   163,   166,   167,   168,   169,   170,   176,   177,   178,
-     179,   180,   184,   185,     1,    62,    87,    68,    10,    14,
-      59,    62,    92,    93,    98,   100,   181,    62,   153,    62,
-     156,   157,     1,    62,    87,    62,     1,    87,    98,   100,
-     102,   106,   108,   110,   111,   113,   115,   117,   119,   122,
-     125,   128,   131,   134,   137,   140,   143,   147,   106,   111,
-     111,    68,   150,    68,   111,    68,    68,   147,   151,     1,
-      87,   111,   111,    60,   185,    67,   111,   111,   147,    70,
-      95,    96,    97,   111,   111,   111,   111,    68,    71,    73,
-     104,    71,    73,   104,    43,    44,    48,    49,    50,    51,
-      52,    53,    54,    55,    56,    57,    58,    86,   146,    66,
-      78,    79,    74,    75,    45,    46,    47,    22,    23,    39,
-      40,    80,    81,    35,    36,    37,    38,    82,    83,    84,
-      42,    41,    85,     1,    70,    87,     0,   150,     1,    87,
-      11,   106,   117,   120,   123,   126,   129,   132,   135,   138,
-     141,   144,   148,   165,    98,   100,    62,    68,    60,    61,
-      62,    63,    90,    91,    71,    73,   104,    86,   158,     1,
-      70,    87,   158,     1,    70,    87,     1,    87,    68,   104,
-      71,    73,   104,    43,    44,   146,    66,    78,    79,    74,
-      75,    45,    46,    47,    22,    23,    39,    40,    80,    81,
-      35,    36,    37,    38,    82,    83,    84,    42,    41,    85,
-       1,    70,    87,   147,    21,   147,   147,   147,     1,    87,
-      30,    31,    60,   150,    69,    70,    72,    72,   143,    70,
-      69,   105,   143,   147,    62,   147,    62,   143,   111,   111,
-     111,   113,   113,   115,   115,   115,   117,   117,   117,   117,
-     117,   117,   119,   119,   119,   119,   122,   125,   128,   131,
-     134,   143,   143,    62,   154,    22,   146,    23,    39,    40,
-      80,    81,    35,    36,    37,    38,    82,    83,    84,    42,
-      41,    85,    70,    87,   104,    68,    62,    69,   182,    67,
-      62,    67,    67,    60,    70,   147,    62,   143,    62,   157,
-      69,   182,   147,    62,   143,   111,   111,   111,   113,   113,
-     115,   115,   115,   117,   117,   117,   117,   117,   117,   119,
-     119,   119,   119,   122,   125,   128,   131,   134,   143,   143,
-      69,    68,    69,    69,    69,    68,   151,    96,    69,    70,
-      72,    72,    67,    22,    86,   159,    70,    87,   147,   106,
-     144,   117,   117,   117,   117,   117,   120,   120,   120,   120,
-     123,   126,   129,   132,   135,   144,   144,   147,   164,    69,
-     182,    59,    69,    70,   143,    68,   143,   143,    60,    90,
-      72,   158,    59,    69,    72,    67,   150,   147,   150,    59,
-     171,   150,    62,    72,   143,   143,   143,   147,   144,    22,
-      62,   164,    69,    67,    87,    59,    69,     3,     4,     5,
-       6,     9,    10,    11,    12,    13,    14,    15,    16,    17,
-      18,    19,    20,    21,    24,    25,    26,    28,    29,    32,
-      43,    44,    51,    59,    61,    62,    63,    64,    65,    66,
-      68,    71,    74,    75,    76,    77,    87,   183,   186,   190,
-     191,   196,   198,   200,   204,   206,   207,   209,   211,   213,
-     215,   218,   221,   224,   227,   230,   233,   236,   239,   242,
-     246,   247,   248,   249,   252,   257,   258,   259,   260,   263,
-     264,   265,   266,   267,   273,   274,   275,   276,   277,   281,
-      59,    62,    69,   182,   183,    59,   143,    34,    69,     7,
-     172,   173,   174,    69,    69,   147,   159,    87,   150,   144,
-     164,   183,    59,     1,    62,    87,    68,    10,    14,    59,
-      62,   189,   190,   195,   197,   278,    62,   250,    62,   253,
-     254,     1,    62,    87,    62,     1,    87,   195,   197,   199,
-     203,   205,   207,   208,   210,   212,   214,   216,   219,   222,
-     225,   228,   231,   234,   237,   240,   244,   203,   208,   208,
-      68,   247,    68,   208,    68,    68,   244,   248,     1,    87,
-     208,   208,    60,   281,    67,   208,   208,   244,    70,   192,
-     193,   194,   208,   208,   208,   208,    60,    68,    71,    73,
-     201,    71,    73,   201,    43,    44,    48,    49,    50,    51,
-      52,    53,    54,    55,    56,    57,    58,    86,   243,    66,
-      78,    79,    74,    75,    45,    46,    47,    22,    23,    39,
-      40,    80,    81,    35,    36,    37,    38,    82,    83,    84,
-      42,    41,    85,     1,    70,    87,   247,   183,    59,    69,
-      60,   183,   150,     1,    87,   147,     8,    60,   175,   174,
-     151,   150,    69,   164,    69,    60,   183,     1,    87,    11,
-     203,   214,   217,   220,   223,   226,   229,   232,   235,   238,
-     241,   245,   262,   195,   197,    62,    68,    60,    61,    62,
-      63,   187,   188,    71,    73,   201,    86,   255,     1,    70,
-      87,   255,     1,    70,    87,     1,    87,    68,   201,    71,
-      73,   201,    43,    44,   243,    66,    78,    79,    74,    75,
-      45,    46,    47,    22,    23,    39,    40,    80,    81,    35,
-      36,    37,    38,    82,    83,    84,    42,    41,    85,     1,
-      70,    87,   244,    21,   244,   244,   244,     1,    87,    30,
-      31,    60,   247,    69,    70,    72,    72,   240,    70,    69,
-     202,   240,   244,    62,   244,    62,   240,   208,   208,   208,
-     210,   210,   212,   212,   212,   214,   214,   214,   214,   214,
-     214,   216,   216,   216,   216,   219,   222,   225,   228,   231,
-     240,   240,    60,   183,    59,    60,    67,    67,   172,    31,
-     150,    69,   150,    60,    62,   251,    22,   243,    23,    39,
-      40,    80,    81,    35,    36,    37,    38,    82,    83,    84,
-      42,    41,    85,    70,    87,   201,    68,    62,    69,   279,
-      67,    62,    67,    67,    60,    70,   244,    62,   240,    62,
-     254,    69,   279,   244,    62,   240,   208,   208,   208,   210,
-     210,   212,   212,   212,   214,   214,   214,   214,   214,   214,
-     216,   216,   216,   216,   219,   222,   225,   228,   231,   240,
-     240,    69,    68,    69,    69,    69,    68,   248,   193,    69,
-      70,    72,    72,    67,    60,   183,   185,   185,    60,   151,
-     150,    22,    86,   256,    70,    87,   244,   203,   241,   214,
-     214,   214,   214,   214,   217,   217,   217,   217,   220,   223,
-     226,   229,   232,   241,   241,   244,   261,    69,   279,    59,
-      69,    70,   240,    68,   240,   240,    60,   187,    72,   255,
-      59,    69,    72,    67,   247,   244,   247,    59,   268,   247,
-      62,    72,   240,   240,   240,    60,   244,   241,    22,    62,
-     261,    69,    67,    87,    59,    69,   280,   281,    59,    62,
-      69,   279,   280,    59,   240,    34,    69,     7,   269,   270,
-     271,    69,    69,   244,   256,    87,   247,   241,   261,   280,
-      59,    60,   280,    59,    69,    60,   280,   247,     1,    87,
-     244,     8,    60,   272,   271,   248,   247,    69,   261,    69,
-      60,   280,    60,   280,    59,    60,    67,    67,   269,    31,
-     247,    69,   247,    60,    60,   280,   281,   281,    60,   248,
-     247,    60
-};
-
-#define yyerrok		(yyerrstatus = 0)
-#define yyclearin	(yychar = YYEMPTY)
-#define YYEMPTY		(-2)
-#define YYEOF		0
-
-#define YYACCEPT	goto yyacceptlab
-#define YYABORT		goto yyabortlab
-#define YYERROR		goto yyerrorlab
-
-
-/* Like YYERROR except do call yyerror.  This remains here temporarily
-   to ease the transition to the new meaning of YYERROR, for GCC.
-   Once GCC version 2 has supplanted version 1, this can go.  */
-
-#define YYFAIL		goto yyerrlab
-
-#define YYRECOVERING()  (!!yyerrstatus)
-
-#define YYBACKUP(Token, Value)					\
-do								\
-  if (yychar == YYEMPTY && yylen == 1)				\
-    {								\
-      yychar = (Token);						\
-      yylval = (Value);						\
-      yytoken = YYTRANSLATE (yychar);				\
-      YYPOPSTACK (1);						\
-      goto yybackup;						\
-    }								\
-  else								\
-    {								\
-      yyerror (YY_("syntax error: cannot back up")); \
-      YYERROR;							\
-    }								\
-while (YYID (0))
-
-
-#define YYTERROR	1
-#define YYERRCODE	256
-
-
-/* YYLLOC_DEFAULT -- Set CURRENT to span from RHS[1] to RHS[N].
-   If N is 0, then set CURRENT to the empty location which ends
-   the previous symbol: RHS[0] (always defined).  */
-
-#define YYRHSLOC(Rhs, K) ((Rhs)[K])
-#ifndef YYLLOC_DEFAULT
-# define YYLLOC_DEFAULT(Current, Rhs, N)				\
-    do									\
-      if (YYID (N))                                                    \
-	{								\
-	  (Current).first_line   = YYRHSLOC (Rhs, 1).first_line;	\
-	  (Current).first_column = YYRHSLOC (Rhs, 1).first_column;	\
-	  (Current).last_line    = YYRHSLOC (Rhs, N).last_line;		\
-	  (Current).last_column  = YYRHSLOC (Rhs, N).last_column;	\
-	}								\
-      else								\
-	{								\
-	  (Current).first_line   = (Current).last_line   =		\
-	    YYRHSLOC (Rhs, 0).last_line;				\
-	  (Current).first_column = (Current).last_column =		\
-	    YYRHSLOC (Rhs, 0).last_column;				\
-	}								\
-    while (YYID (0))
-#endif
-
-
-/* YY_LOCATION_PRINT -- Print the location on the stream.
-   This macro was not mandated originally: define only if we know
-   we won't break user code: when these are the locations we know.  */
-
-#ifndef YY_LOCATION_PRINT
-# if YYLTYPE_IS_TRIVIAL
-#  define YY_LOCATION_PRINT(File, Loc)			\
-     fprintf (File, "%d.%d-%d.%d",			\
-	      (Loc).first_line, (Loc).first_column,	\
-	      (Loc).last_line,  (Loc).last_column)
-# else
-#  define YY_LOCATION_PRINT(File, Loc) ((void) 0)
-# endif
-#endif
-
-
-/* YYLEX -- calling `yylex' with the right arguments.  */
-
-#ifdef YYLEX_PARAM
-# define YYLEX yylex (&yylval, &yylloc, YYLEX_PARAM)
-#else
-# define YYLEX yylex (&yylval, &yylloc)
-#endif
-
-/* Enable debugging if requested.  */
-#if YYDEBUG
-
-# ifndef YYFPRINTF
-#  include <stdio.h> /* INFRINGES ON USER NAME SPACE */
-#  define YYFPRINTF fprintf
-# endif
-
-# define YYDPRINTF(Args)			\
-do {						\
-  if (yydebug)					\
-    YYFPRINTF Args;				\
-} while (YYID (0))
-
-# define YY_SYMBOL_PRINT(Title, Type, Value, Location)			  \
-do {									  \
-  if (yydebug)								  \
-    {									  \
-      YYFPRINTF (stderr, "%s ", Title);					  \
-      yy_symbol_print (stderr,						  \
-		  Type, Value, Location); \
-      YYFPRINTF (stderr, "\n");						  \
-    }									  \
-} while (YYID (0))
-
-
-/*--------------------------------.
-| Print this symbol on YYOUTPUT.  |
-`--------------------------------*/
-
-/*ARGSUSED*/
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static void
-yy_symbol_value_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep, YYLTYPE const * const yylocationp)
-#else
-static void
-yy_symbol_value_print (yyoutput, yytype, yyvaluep, yylocationp)
-    FILE *yyoutput;
-    int yytype;
-    YYSTYPE const * const yyvaluep;
-    YYLTYPE const * const yylocationp;
-#endif
-{
-  if (!yyvaluep)
-    return;
-  YYUSE (yylocationp);
-# ifdef YYPRINT
-  if (yytype < YYNTOKENS)
-    YYPRINT (yyoutput, yytoknum[yytype], *yyvaluep);
-# else
-  YYUSE (yyoutput);
-# endif
-  switch (yytype)
-    {
-      default:
-	break;
-    }
-}
-
-
-/*--------------------------------.
-| Print this symbol on YYOUTPUT.  |
-`--------------------------------*/
-
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static void
-yy_symbol_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep, YYLTYPE const * const yylocationp)
-#else
-static void
-yy_symbol_print (yyoutput, yytype, yyvaluep, yylocationp)
-    FILE *yyoutput;
-    int yytype;
-    YYSTYPE const * const yyvaluep;
-    YYLTYPE const * const yylocationp;
-#endif
-{
-  if (yytype < YYNTOKENS)
-    YYFPRINTF (yyoutput, "token %s (", yytname[yytype]);
-  else
-    YYFPRINTF (yyoutput, "nterm %s (", yytname[yytype]);
-
-  YY_LOCATION_PRINT (yyoutput, *yylocationp);
-  YYFPRINTF (yyoutput, ": ");
-  yy_symbol_value_print (yyoutput, yytype, yyvaluep, yylocationp);
-  YYFPRINTF (yyoutput, ")");
-}
-
-/*------------------------------------------------------------------.
-| yy_stack_print -- Print the state stack from its BOTTOM up to its |
-| TOP (included).                                                   |
-`------------------------------------------------------------------*/
-
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static void
-yy_stack_print (yytype_int16 *yybottom, yytype_int16 *yytop)
-#else
-static void
-yy_stack_print (yybottom, yytop)
-    yytype_int16 *yybottom;
-    yytype_int16 *yytop;
-#endif
-{
-  YYFPRINTF (stderr, "Stack now");
-  for (; yybottom <= yytop; yybottom++)
-    {
-      int yybot = *yybottom;
-      YYFPRINTF (stderr, " %d", yybot);
-    }
-  YYFPRINTF (stderr, "\n");
-}
-
-# define YY_STACK_PRINT(Bottom, Top)				\
-do {								\
-  if (yydebug)							\
-    yy_stack_print ((Bottom), (Top));				\
-} while (YYID (0))
-
-
-/*------------------------------------------------.
-| Report that the YYRULE is going to be reduced.  |
-`------------------------------------------------*/
-
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static void
-yy_reduce_print (YYSTYPE *yyvsp, YYLTYPE *yylsp, int yyrule)
-#else
-static void
-yy_reduce_print (yyvsp, yylsp, yyrule)
-    YYSTYPE *yyvsp;
-    YYLTYPE *yylsp;
-    int yyrule;
-#endif
-{
-  int yynrhs = yyr2[yyrule];
-  int yyi;
-  unsigned long int yylno = yyrline[yyrule];
-  YYFPRINTF (stderr, "Reducing stack by rule %d (line %lu):\n",
-	     yyrule - 1, yylno);
-  /* The symbols being reduced.  */
-  for (yyi = 0; yyi < yynrhs; yyi++)
-    {
-      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
-      yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi],
-		       &(yyvsp[(yyi + 1) - (yynrhs)])
-		       , &(yylsp[(yyi + 1) - (yynrhs)])		       );
-      YYFPRINTF (stderr, "\n");
-    }
-}
-
-# define YY_REDUCE_PRINT(Rule)		\
-do {					\
-  if (yydebug)				\
-    yy_reduce_print (yyvsp, yylsp, Rule); \
-} while (YYID (0))
-
-/* Nonzero means print parse trace.  It is left uninitialized so that
-   multiple parsers can coexist.  */
-int yydebug;
-#else /* !YYDEBUG */
-# define YYDPRINTF(Args)
-# define YY_SYMBOL_PRINT(Title, Type, Value, Location)
-# define YY_STACK_PRINT(Bottom, Top)
-# define YY_REDUCE_PRINT(Rule)
-#endif /* !YYDEBUG */
-
-
-/* YYINITDEPTH -- initial size of the parser's stacks.  */
-#ifndef	YYINITDEPTH
-# define YYINITDEPTH 200
-#endif
-
-/* YYMAXDEPTH -- maximum size the stacks can grow to (effective only
-   if the built-in stack extension method is used).
-
-   Do not make this value too large; the results are undefined if
-   YYSTACK_ALLOC_MAXIMUM < YYSTACK_BYTES (YYMAXDEPTH)
-   evaluated with infinite-precision integer arithmetic.  */
-
-#ifndef YYMAXDEPTH
-# define YYMAXDEPTH 10000
-#endif
-
-
-
-#if YYERROR_VERBOSE
-
-# ifndef yystrlen
-#  if defined __GLIBC__ && defined _STRING_H
-#   define yystrlen strlen
-#  else
-/* Return the length of YYSTR.  */
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static YYSIZE_T
-yystrlen (const char *yystr)
-#else
-static YYSIZE_T
-yystrlen (yystr)
-    const char *yystr;
-#endif
-{
-  YYSIZE_T yylen;
-  for (yylen = 0; yystr[yylen]; yylen++)
-    continue;
-  return yylen;
-}
-#  endif
-# endif
-
-# ifndef yystpcpy
-#  if defined __GLIBC__ && defined _STRING_H && defined _GNU_SOURCE
-#   define yystpcpy stpcpy
-#  else
-/* Copy YYSRC to YYDEST, returning the address of the terminating '\0' in
-   YYDEST.  */
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static char *
-yystpcpy (char *yydest, const char *yysrc)
-#else
-static char *
-yystpcpy (yydest, yysrc)
-    char *yydest;
-    const char *yysrc;
-#endif
-{
-  char *yyd = yydest;
-  const char *yys = yysrc;
-
-  while ((*yyd++ = *yys++) != '\0')
-    continue;
-
-  return yyd - 1;
-}
-#  endif
-# endif
-
-# ifndef yytnamerr
-/* Copy to YYRES the contents of YYSTR after stripping away unnecessary
-   quotes and backslashes, so that it's suitable for yyerror.  The
-   heuristic is that double-quoting is unnecessary unless the string
-   contains an apostrophe, a comma, or backslash (other than
-   backslash-backslash).  YYSTR is taken from yytname.  If YYRES is
-   null, do not copy; instead, return the length of what the result
-   would have been.  */
-static YYSIZE_T
-yytnamerr (char *yyres, const char *yystr)
-{
-  if (*yystr == '"')
-    {
-      YYSIZE_T yyn = 0;
-      char const *yyp = yystr;
-
-      for (;;)
-	switch (*++yyp)
-	  {
-	  case '\'':
-	  case ',':
-	    goto do_not_strip_quotes;
-
-	  case '\\':
-	    if (*++yyp != '\\')
-	      goto do_not_strip_quotes;
-	    /* Fall through.  */
-	  default:
-	    if (yyres)
-	      yyres[yyn] = *yyp;
-	    yyn++;
-	    break;
-
-	  case '"':
-	    if (yyres)
-	      yyres[yyn] = '\0';
-	    return yyn;
-	  }
-    do_not_strip_quotes: ;
-    }
-
-  if (! yyres)
-    return yystrlen (yystr);
-
-  return yystpcpy (yyres, yystr) - yyres;
-}
-# endif
-
-/* Copy into YYRESULT an error message about the unexpected token
-   YYCHAR while in state YYSTATE.  Return the number of bytes copied,
-   including the terminating null byte.  If YYRESULT is null, do not
-   copy anything; just return the number of bytes that would be
-   copied.  As a special case, return 0 if an ordinary "syntax error"
-   message will do.  Return YYSIZE_MAXIMUM if overflow occurs during
-   size calculation.  */
-static YYSIZE_T
-yysyntax_error (char *yyresult, int yystate, int yychar)
-{
-  int yyn = yypact[yystate];
-
-  if (! (YYPACT_NINF < yyn && yyn <= YYLAST))
-    return 0;
-  else
-    {
-      int yytype = YYTRANSLATE (yychar);
-      YYSIZE_T yysize0 = yytnamerr (0, yytname[yytype]);
-      YYSIZE_T yysize = yysize0;
-      YYSIZE_T yysize1;
-      int yysize_overflow = 0;
-      enum { YYERROR_VERBOSE_ARGS_MAXIMUM = 5 };
-      char const *yyarg[YYERROR_VERBOSE_ARGS_MAXIMUM];
-      int yyx;
-
-# if 0
-      /* This is so xgettext sees the translatable formats that are
-	 constructed on the fly.  */
-      YY_("syntax error, unexpected %s");
-      YY_("syntax error, unexpected %s, expecting %s");
-      YY_("syntax error, unexpected %s, expecting %s or %s");
-      YY_("syntax error, unexpected %s, expecting %s or %s or %s");
-      YY_("syntax error, unexpected %s, expecting %s or %s or %s or %s");
-# endif
-      char *yyfmt;
-      char const *yyf;
-      static char const yyunexpected[] = "syntax error, unexpected %s";
-      static char const yyexpecting[] = ", expecting %s";
-      static char const yyor[] = " or %s";
-      char yyformat[sizeof yyunexpected
-		    + sizeof yyexpecting - 1
-		    + ((YYERROR_VERBOSE_ARGS_MAXIMUM - 2)
-		       * (sizeof yyor - 1))];
-      char const *yyprefix = yyexpecting;
-
-      /* Start YYX at -YYN if negative to avoid negative indexes in
-	 YYCHECK.  */
-      int yyxbegin = yyn < 0 ? -yyn : 0;
-
-      /* Stay within bounds of both yycheck and yytname.  */
-      int yychecklim = YYLAST - yyn + 1;
-      int yyxend = yychecklim < YYNTOKENS ? yychecklim : YYNTOKENS;
-      int yycount = 1;
-
-      yyarg[0] = yytname[yytype];
-      yyfmt = yystpcpy (yyformat, yyunexpected);
-
-      for (yyx = yyxbegin; yyx < yyxend; ++yyx)
-	if (yycheck[yyx + yyn] == yyx && yyx != YYTERROR)
-	  {
-	    if (yycount == YYERROR_VERBOSE_ARGS_MAXIMUM)
-	      {
-		yycount = 1;
-		yysize = yysize0;
-		yyformat[sizeof yyunexpected - 1] = '\0';
-		break;
-	      }
-	    yyarg[yycount++] = yytname[yyx];
-	    yysize1 = yysize + yytnamerr (0, yytname[yyx]);
-	    yysize_overflow |= (yysize1 < yysize);
-	    yysize = yysize1;
-	    yyfmt = yystpcpy (yyfmt, yyprefix);
-	    yyprefix = yyor;
-	  }
-
-      yyf = YY_(yyformat);
-      yysize1 = yysize + yystrlen (yyf);
-      yysize_overflow |= (yysize1 < yysize);
-      yysize = yysize1;
-
-      if (yysize_overflow)
-	return YYSIZE_MAXIMUM;
-
-      if (yyresult)
-	{
-	  /* Avoid sprintf, as that infringes on the user's name space.
-	     Don't have undefined behavior even if the translation
-	     produced a string with the wrong number of "%s"s.  */
-	  char *yyp = yyresult;
-	  int yyi = 0;
-	  while ((*yyp = *yyf) != '\0')
-	    {
-	      if (*yyp == '%' && yyf[1] == 's' && yyi < yycount)
-		{
-		  yyp += yytnamerr (yyp, yyarg[yyi++]);
-		  yyf += 2;
-		}
-	      else
-		{
-		  yyp++;
-		  yyf++;
-		}
-	    }
-	}
-      return yysize;
-    }
-}
-#endif /* YYERROR_VERBOSE */
-
-
-/*-----------------------------------------------.
-| Release the memory associated to this symbol.  |
-`-----------------------------------------------*/
-
-/*ARGSUSED*/
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static void
-yydestruct (const char *yymsg, int yytype, YYSTYPE *yyvaluep, YYLTYPE *yylocationp)
-#else
-static void
-yydestruct (yymsg, yytype, yyvaluep, yylocationp)
-    const char *yymsg;
-    int yytype;
-    YYSTYPE *yyvaluep;
-    YYLTYPE *yylocationp;
-#endif
-{
-  YYUSE (yyvaluep);
-  YYUSE (yylocationp);
-
-  if (!yymsg)
-    yymsg = "Deleting";
-  YY_SYMBOL_PRINT (yymsg, yytype, yyvaluep, yylocationp);
-
-  switch (yytype)
-    {
-
-      default:
-	break;
-    }
-}
-
-/* Prevent warnings from -Wmissing-prototypes.  */
-#ifdef YYPARSE_PARAM
-#if defined __STDC__ || defined __cplusplus
-int yyparse (void *YYPARSE_PARAM);
-#else
-int yyparse ();
-#endif
-#else /* ! YYPARSE_PARAM */
-#if defined __STDC__ || defined __cplusplus
-int yyparse (void);
-#else
-int yyparse ();
-#endif
-#endif /* ! YYPARSE_PARAM */
-
-
-
-
-
-/*-------------------------.
-| yyparse or yypush_parse.  |
-`-------------------------*/
-
-#ifdef YYPARSE_PARAM
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-int
-yyparse (void *YYPARSE_PARAM)
-#else
-int
-yyparse (YYPARSE_PARAM)
-    void *YYPARSE_PARAM;
-#endif
-#else /* ! YYPARSE_PARAM */
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-int
-yyparse (void)
-#else
-int
-yyparse ()
-
-#endif
-#endif
-{
-/* The lookahead symbol.  */
-int yychar;
-
-/* The semantic value of the lookahead symbol.  */
-YYSTYPE yylval;
-
-/* Location data for the lookahead symbol.  */
-YYLTYPE yylloc;
-
-    /* Number of syntax errors so far.  */
-    int yynerrs;
-
-    int yystate;
-    /* Number of tokens to shift before error messages enabled.  */
-    int yyerrstatus;
-
-    /* The stacks and their tools:
-       `yyss': related to states.
-       `yyvs': related to semantic values.
-       `yyls': related to locations.
-
-       Refer to the stacks thru separate pointers, to allow yyoverflow
-       to reallocate them elsewhere.  */
-
-    /* The state stack.  */
-    yytype_int16 yyssa[YYINITDEPTH];
-    yytype_int16 *yyss;
-    yytype_int16 *yyssp;
-
-    /* The semantic value stack.  */
-    YYSTYPE yyvsa[YYINITDEPTH];
-    YYSTYPE *yyvs;
-    YYSTYPE *yyvsp;
-
-    /* The location stack.  */
-    YYLTYPE yylsa[YYINITDEPTH];
-    YYLTYPE *yyls;
-    YYLTYPE *yylsp;
-
-    /* The locations where the error started and ended.  */
-    YYLTYPE yyerror_range[2];
-
-    YYSIZE_T yystacksize;
-
-  int yyn;
-  int yyresult;
-  /* Lookahead token as an internal (translated) token number.  */
-  int yytoken;
-  /* The variables used to return semantic value and location from the
-     action routines.  */
-  YYSTYPE yyval;
-  YYLTYPE yyloc;
-
-#if YYERROR_VERBOSE
-  /* Buffer for error messages, and its allocated size.  */
-  char yymsgbuf[128];
-  char *yymsg = yymsgbuf;
-  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
-#endif
-
-#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N), yylsp -= (N))
-
-  /* The number of symbols on the RHS of the reduced rule.
-     Keep to zero when no symbol should be popped.  */
-  int yylen = 0;
-
-  yytoken = 0;
-  yyss = yyssa;
-  yyvs = yyvsa;
-  yyls = yylsa;
-  yystacksize = YYINITDEPTH;
-
-  YYDPRINTF ((stderr, "Starting parse\n"));
-
-  yystate = 0;
-  yyerrstatus = 0;
-  yynerrs = 0;
-  yychar = YYEMPTY; /* Cause a token to be read.  */
-
-  /* Initialize stack pointers.
-     Waste one element of value and location stack
-     so that they stay on the same level as the state stack.
-     The wasted elements are never initialized.  */
-  yyssp = yyss;
-  yyvsp = yyvs;
-  yylsp = yyls;
-
-#if YYLTYPE_IS_TRIVIAL
-  /* Initialize the default location before parsing starts.  */
-  yylloc.first_line   = yylloc.last_line   = 1;
-  yylloc.first_column = yylloc.last_column = 1;
-#endif
-
-  goto yysetstate;
-
-/*------------------------------------------------------------.
-| yynewstate -- Push a new state, which is found in yystate.  |
-`------------------------------------------------------------*/
- yynewstate:
-  /* In all cases, when you get here, the value and location stacks
-     have just been pushed.  So pushing a state here evens the stacks.  */
-  yyssp++;
-
- yysetstate:
-  *yyssp = yystate;
-
-  if (yyss + yystacksize - 1 <= yyssp)
-    {
-      /* Get the current used size of the three stacks, in elements.  */
-      YYSIZE_T yysize = yyssp - yyss + 1;
-
-#ifdef yyoverflow
-      {
-	/* Give user a chance to reallocate the stack.  Use copies of
-	   these so that the &'s don't force the real ones into
-	   memory.  */
-	YYSTYPE *yyvs1 = yyvs;
-	yytype_int16 *yyss1 = yyss;
-	YYLTYPE *yyls1 = yyls;
-
-	/* Each stack pointer address is followed by the size of the
-	   data in use in that stack, in bytes.  This used to be a
-	   conditional around just the two extra args, but that might
-	   be undefined if yyoverflow is a macro.  */
-	yyoverflow (YY_("memory exhausted"),
-		    &yyss1, yysize * sizeof (*yyssp),
-		    &yyvs1, yysize * sizeof (*yyvsp),
-		    &yyls1, yysize * sizeof (*yylsp),
-		    &yystacksize);
-
-	yyls = yyls1;
-	yyss = yyss1;
-	yyvs = yyvs1;
-      }
-#else /* no yyoverflow */
-# ifndef YYSTACK_RELOCATE
-      goto yyexhaustedlab;
-# else
-      /* Extend the stack our own way.  */
-      if (YYMAXDEPTH <= yystacksize)
-	goto yyexhaustedlab;
-      yystacksize *= 2;
-      if (YYMAXDEPTH < yystacksize)
-	yystacksize = YYMAXDEPTH;
-
-      {
-	yytype_int16 *yyss1 = yyss;
-	union yyalloc *yyptr =
-	  (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize));
-	if (! yyptr)
-	  goto yyexhaustedlab;
-	YYSTACK_RELOCATE (yyss_alloc, yyss);
-	YYSTACK_RELOCATE (yyvs_alloc, yyvs);
-	YYSTACK_RELOCATE (yyls_alloc, yyls);
-#  undef YYSTACK_RELOCATE
-	if (yyss1 != yyssa)
-	  YYSTACK_FREE (yyss1);
-      }
-# endif
-#endif /* no yyoverflow */
-
-      yyssp = yyss + yysize - 1;
-      yyvsp = yyvs + yysize - 1;
-      yylsp = yyls + yysize - 1;
-
-      YYDPRINTF ((stderr, "Stack size increased to %lu\n",
-		  (unsigned long int) yystacksize));
-
-      if (yyss + yystacksize - 1 <= yyssp)
-	YYABORT;
-    }
-
-  YYDPRINTF ((stderr, "Entering state %d\n", yystate));
-
-  if (yystate == YYFINAL)
-    YYACCEPT;
-
-  goto yybackup;
-
-/*-----------.
-| yybackup.  |
-`-----------*/
-yybackup:
-
-  /* Do appropriate processing given the current state.  Read a
-     lookahead token if we need one and don't already have one.  */
-
-  /* First try to decide what to do without reference to lookahead token.  */
-  yyn = yypact[yystate];
-  if (yyn == YYPACT_NINF)
-    goto yydefault;
-
-  /* Not known => get a lookahead token if don't already have one.  */
-
-  /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol.  */
-  if (yychar == YYEMPTY)
-    {
-      YYDPRINTF ((stderr, "Reading a token: "));
-      yychar = YYLEX;
-    }
-
-  if (yychar <= YYEOF)
-    {
-      yychar = yytoken = YYEOF;
-      YYDPRINTF ((stderr, "Now at end of input.\n"));
-    }
-  else
-    {
-      yytoken = YYTRANSLATE (yychar);
-      YY_SYMBOL_PRINT ("Next token is", yytoken, &yylval, &yylloc);
-    }
-
-  /* If the proper action on seeing token YYTOKEN is to reduce or to
-     detect an error, take that action.  */
-  yyn += yytoken;
-  if (yyn < 0 || YYLAST < yyn || yycheck[yyn] != yytoken)
-    goto yydefault;
-  yyn = yytable[yyn];
-  if (yyn <= 0)
-    {
-      if (yyn == 0 || yyn == YYTABLE_NINF)
-	goto yyerrlab;
-      yyn = -yyn;
-      goto yyreduce;
-    }
-
-  /* Count tokens shifted since error; after three, turn off error
-     status.  */
-  if (yyerrstatus)
-    yyerrstatus--;
-
-  /* Shift the lookahead token.  */
-  YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
-
-  /* Discard the shifted token.  */
-  yychar = YYEMPTY;
-
-  yystate = yyn;
-  *++yyvsp = yylval;
-  *++yylsp = yylloc;
-  goto yynewstate;
-
-
-/*-----------------------------------------------------------.
-| yydefault -- do the default action for the current state.  |
-`-----------------------------------------------------------*/
-yydefault:
-  yyn = yydefact[yystate];
-  if (yyn == 0)
-    goto yyerrlab;
-  goto yyreduce;
-
-
-/*-----------------------------.
-| yyreduce -- Do a reduction.  |
-`-----------------------------*/
-yyreduce:
-  /* yyn is the number of a rule to reduce with.  */
-  yylen = yyr2[yyn];
-
-  /* If YYLEN is nonzero, implement the default value of the action:
-     `$$ = $1'.
-
-     Otherwise, the following line sets YYVAL to garbage.
-     This behavior is undocumented and Bison
-     users should not rely upon it.  Assigning to YYVAL
-     unconditionally makes the parser a bit smaller, and it avoids a
-     GCC warning that YYVAL may be used uninitialized.  */
-  yyval = yyvsp[1-yylen];
-
-  /* Default location.  */
-  YYLLOC_DEFAULT (yyloc, (yylsp - yylen), yylen);
-  YY_REDUCE_PRINT (yyn);
-  switch (yyn)
-    {
-        case 2:
-
-/* Line 1455 of yacc.c  */
-#line 293 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); ;}
-    break;
-
-  case 3:
-
-/* Line 1455 of yacc.c  */
-#line 294 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
-    break;
-
-  case 4:
-
-/* Line 1455 of yacc.c  */
-#line 295 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
-    break;
-
-  case 5:
-
-/* Line 1455 of yacc.c  */
-#line 296 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, (yyvsp[(1) - (1)].doubleValue)), 0, 1); ;}
-    break;
-
-  case 6:
-
-/* Line 1455 of yacc.c  */
-#line 297 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
-    break;
-
-  case 7:
-
-/* Line 1455 of yacc.c  */
-#line 298 "../../JavaScriptCore/parser/Grammar.y"
-    {
-                                            Lexer& l = *GLOBAL_DATA->lexer;
-                                            const Identifier* pattern;
-                                            const Identifier* flags;
-                                            if (!l.scanRegExp(pattern, flags))
-                                                YYABORT;
-                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, *pattern, *flags);
-                                            int size = pattern->size() + 2; // + 2 for the two /'s
-                                            setExceptionLocation(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
-                                            (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
-                                        ;}
-    break;
-
-  case 8:
-
-/* Line 1455 of yacc.c  */
-#line 309 "../../JavaScriptCore/parser/Grammar.y"
-    {
-                                            Lexer& l = *GLOBAL_DATA->lexer;
-                                            const Identifier* pattern;
-                                            const Identifier* flags;
-                                            if (!l.scanRegExp(pattern, flags, '='))
-                                                YYABORT;
-                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, *pattern, *flags);
-                                            int size = pattern->size() + 2; // + 2 for the two /'s
-                                            setExceptionLocation(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
-                                            (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
-                                        ;}
-    break;
-
-  case 9:
-
-/* Line 1455 of yacc.c  */
-#line 323 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 10:
-
-/* Line 1455 of yacc.c  */
-#line 324 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 11:
-
-/* Line 1455 of yacc.c  */
-#line 325 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, (yyvsp[(1) - (3)].doubleValue), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 12:
-
-/* Line 1455 of yacc.c  */
-#line 326 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (7)].ident), *(yyvsp[(2) - (7)].ident), 0, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); if (!(yyval.propertyNode).m_node) YYABORT; ;}
-    break;
-
-  case 13:
-
-/* Line 1455 of yacc.c  */
-#line 328 "../../JavaScriptCore/parser/Grammar.y"
-    {
-                                                                 (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (8)].ident), *(yyvsp[(2) - (8)].ident), (yyvsp[(4) - (8)].parameterList).m_node.head, (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line)), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
-                                                                 if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
-                                                                     (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments(); 
-                                                                 setStatementLocation((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)])); 
-                                                                 if (!(yyval.propertyNode).m_node) 
-                                                                     YYABORT; 
-                                                             ;}
-    break;
-
-  case 14:
-
-/* Line 1455 of yacc.c  */
-#line 339 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyList).m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
-                                          (yyval.propertyList).m_node.tail = (yyval.propertyList).m_node.head;
-                                          (yyval.propertyList).m_features = (yyvsp[(1) - (1)].propertyNode).m_features;
-                                          (yyval.propertyList).m_numConstants = (yyvsp[(1) - (1)].propertyNode).m_numConstants; ;}
-    break;
-
-  case 15:
-
-/* Line 1455 of yacc.c  */
-#line 343 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyList).m_node.head = (yyvsp[(1) - (3)].propertyList).m_node.head;
-                                          (yyval.propertyList).m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
-                                          (yyval.propertyList).m_features = (yyvsp[(1) - (3)].propertyList).m_features | (yyvsp[(3) - (3)].propertyNode).m_features;
-                                          (yyval.propertyList).m_numConstants = (yyvsp[(1) - (3)].propertyList).m_numConstants + (yyvsp[(3) - (3)].propertyNode).m_numConstants; ;}
-    break;
-
-  case 17:
-
-/* Line 1455 of yacc.c  */
-#line 351 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
-    break;
-
-  case 18:
-
-/* Line 1455 of yacc.c  */
-#line 352 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
-    break;
-
-  case 19:
-
-/* Line 1455 of yacc.c  */
-#line 354 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
-    break;
-
-  case 20:
-
-/* Line 1455 of yacc.c  */
-#line 358 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
-    break;
-
-  case 23:
-
-/* Line 1455 of yacc.c  */
-#line 361 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
-    break;
-
-  case 24:
-
-/* Line 1455 of yacc.c  */
-#line 362 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = (yyvsp[(2) - (3)].expressionNode); ;}
-    break;
-
-  case 25:
-
-/* Line 1455 of yacc.c  */
-#line 366 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
-    break;
-
-  case 26:
-
-/* Line 1455 of yacc.c  */
-#line 367 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
-    break;
-
-  case 27:
-
-/* Line 1455 of yacc.c  */
-#line 368 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
-    break;
-
-  case 28:
-
-/* Line 1455 of yacc.c  */
-#line 372 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.elementList).m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
-                                          (yyval.elementList).m_node.tail = (yyval.elementList).m_node.head;
-                                          (yyval.elementList).m_features = (yyvsp[(2) - (2)].expressionNode).m_features;
-                                          (yyval.elementList).m_numConstants = (yyvsp[(2) - (2)].expressionNode).m_numConstants; ;}
-    break;
-
-  case 29:
-
-/* Line 1455 of yacc.c  */
-#line 377 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.elementList).m_node.head = (yyvsp[(1) - (4)].elementList).m_node.head;
-                                          (yyval.elementList).m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
-                                          (yyval.elementList).m_features = (yyvsp[(1) - (4)].elementList).m_features | (yyvsp[(4) - (4)].expressionNode).m_features;
-                                          (yyval.elementList).m_numConstants = (yyvsp[(1) - (4)].elementList).m_numConstants + (yyvsp[(4) - (4)].expressionNode).m_numConstants; ;}
-    break;
-
-  case 30:
-
-/* Line 1455 of yacc.c  */
-#line 384 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.intValue) = 0; ;}
-    break;
-
-  case 32:
-
-/* Line 1455 of yacc.c  */
-#line 389 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.intValue) = 1; ;}
-    break;
-
-  case 33:
-
-/* Line 1455 of yacc.c  */
-#line 390 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.intValue) = (yyvsp[(1) - (2)].intValue) + 1; ;}
-    break;
-
-  case 35:
-
-/* Line 1455 of yacc.c  */
-#line 395 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>((yyvsp[(1) - (1)].funcExprNode).m_node, (yyvsp[(1) - (1)].funcExprNode).m_features, (yyvsp[(1) - (1)].funcExprNode).m_numConstants); ;}
-    break;
-
-  case 36:
-
-/* Line 1455 of yacc.c  */
-#line 396 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 37:
-
-/* Line 1455 of yacc.c  */
-#line 400 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
-                                        ;}
-    break;
-
-  case 38:
-
-/* Line 1455 of yacc.c  */
-#line 404 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
-                                        ;}
-    break;
-
-  case 40:
-
-/* Line 1455 of yacc.c  */
-#line 412 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 41:
-
-/* Line 1455 of yacc.c  */
-#line 416 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
-                                        ;}
-    break;
-
-  case 42:
-
-/* Line 1455 of yacc.c  */
-#line 420 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
-                                        ;}
-    break;
-
-  case 44:
-
-/* Line 1455 of yacc.c  */
-#line 428 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 46:
-
-/* Line 1455 of yacc.c  */
-#line 436 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants);
-                                        ;}
-    break;
-
-  case 47:
-
-/* Line 1455 of yacc.c  */
-#line 443 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
-    break;
-
-  case 48:
-
-/* Line 1455 of yacc.c  */
-#line 444 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
-    break;
-
-  case 49:
-
-/* Line 1455 of yacc.c  */
-#line 445 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 50:
-
-/* Line 1455 of yacc.c  */
-#line 449 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 51:
-
-/* Line 1455 of yacc.c  */
-#line 455 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
-    break;
-
-  case 52:
-
-/* Line 1455 of yacc.c  */
-#line 456 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
-    break;
-
-  case 53:
-
-/* Line 1455 of yacc.c  */
-#line 457 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 54:
-
-/* Line 1455 of yacc.c  */
-#line 461 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 55:
-
-/* Line 1455 of yacc.c  */
-#line 468 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
-    break;
-
-  case 56:
-
-/* Line 1455 of yacc.c  */
-#line 469 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
-    break;
-
-  case 57:
-
-/* Line 1455 of yacc.c  */
-#line 473 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.argumentList).m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
-                                          (yyval.argumentList).m_node.tail = (yyval.argumentList).m_node.head;
-                                          (yyval.argumentList).m_features = (yyvsp[(1) - (1)].expressionNode).m_features;
-                                          (yyval.argumentList).m_numConstants = (yyvsp[(1) - (1)].expressionNode).m_numConstants; ;}
-    break;
-
-  case 58:
-
-/* Line 1455 of yacc.c  */
-#line 477 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.argumentList).m_node.head = (yyvsp[(1) - (3)].argumentList).m_node.head;
-                                          (yyval.argumentList).m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
-                                          (yyval.argumentList).m_features = (yyvsp[(1) - (3)].argumentList).m_features | (yyvsp[(3) - (3)].expressionNode).m_features;
-                                          (yyval.argumentList).m_numConstants = (yyvsp[(1) - (3)].argumentList).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants; ;}
-    break;
-
-  case 64:
-
-/* Line 1455 of yacc.c  */
-#line 495 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 65:
-
-/* Line 1455 of yacc.c  */
-#line 496 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 67:
-
-/* Line 1455 of yacc.c  */
-#line 501 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 68:
-
-/* Line 1455 of yacc.c  */
-#line 502 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 69:
-
-/* Line 1455 of yacc.c  */
-#line 506 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDeleteNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 70:
-
-/* Line 1455 of yacc.c  */
-#line 507 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
-    break;
-
-  case 71:
-
-/* Line 1455 of yacc.c  */
-#line 508 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeTypeOfNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 72:
-
-/* Line 1455 of yacc.c  */
-#line 509 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 73:
-
-/* Line 1455 of yacc.c  */
-#line 510 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 74:
-
-/* Line 1455 of yacc.c  */
-#line 511 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 75:
-
-/* Line 1455 of yacc.c  */
-#line 512 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 76:
-
-/* Line 1455 of yacc.c  */
-#line 513 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 77:
-
-/* Line 1455 of yacc.c  */
-#line 514 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNegateNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 78:
-
-/* Line 1455 of yacc.c  */
-#line 515 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeBitwiseNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 79:
-
-/* Line 1455 of yacc.c  */
-#line 516 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 85:
-
-/* Line 1455 of yacc.c  */
-#line 530 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 86:
-
-/* Line 1455 of yacc.c  */
-#line 531 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 87:
-
-/* Line 1455 of yacc.c  */
-#line 532 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 89:
-
-/* Line 1455 of yacc.c  */
-#line 538 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 90:
-
-/* Line 1455 of yacc.c  */
-#line 540 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 91:
-
-/* Line 1455 of yacc.c  */
-#line 542 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 93:
-
-/* Line 1455 of yacc.c  */
-#line 547 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 94:
-
-/* Line 1455 of yacc.c  */
-#line 548 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 96:
-
-/* Line 1455 of yacc.c  */
-#line 554 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 97:
-
-/* Line 1455 of yacc.c  */
-#line 556 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 99:
-
-/* Line 1455 of yacc.c  */
-#line 561 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 100:
-
-/* Line 1455 of yacc.c  */
-#line 562 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 101:
-
-/* Line 1455 of yacc.c  */
-#line 563 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 103:
-
-/* Line 1455 of yacc.c  */
-#line 568 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 104:
-
-/* Line 1455 of yacc.c  */
-#line 569 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 105:
-
-/* Line 1455 of yacc.c  */
-#line 570 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 107:
-
-/* Line 1455 of yacc.c  */
-#line 575 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 108:
-
-/* Line 1455 of yacc.c  */
-#line 576 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 109:
-
-/* Line 1455 of yacc.c  */
-#line 577 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 110:
-
-/* Line 1455 of yacc.c  */
-#line 578 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 111:
-
-/* Line 1455 of yacc.c  */
-#line 579 "../../JavaScriptCore/parser/Grammar.y"
-    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 112:
-
-/* Line 1455 of yacc.c  */
-#line 582 "../../JavaScriptCore/parser/Grammar.y"
-    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 114:
-
-/* Line 1455 of yacc.c  */
-#line 589 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 115:
-
-/* Line 1455 of yacc.c  */
-#line 590 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 116:
-
-/* Line 1455 of yacc.c  */
-#line 591 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 117:
-
-/* Line 1455 of yacc.c  */
-#line 592 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 118:
-
-/* Line 1455 of yacc.c  */
-#line 594 "../../JavaScriptCore/parser/Grammar.y"
-    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 120:
-
-/* Line 1455 of yacc.c  */
-#line 601 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 121:
-
-/* Line 1455 of yacc.c  */
-#line 602 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 122:
-
-/* Line 1455 of yacc.c  */
-#line 603 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 123:
-
-/* Line 1455 of yacc.c  */
-#line 604 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 124:
-
-/* Line 1455 of yacc.c  */
-#line 606 "../../JavaScriptCore/parser/Grammar.y"
-    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 125:
-
-/* Line 1455 of yacc.c  */
-#line 610 "../../JavaScriptCore/parser/Grammar.y"
-    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 127:
-
-/* Line 1455 of yacc.c  */
-#line 617 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 128:
-
-/* Line 1455 of yacc.c  */
-#line 618 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 129:
-
-/* Line 1455 of yacc.c  */
-#line 619 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 130:
-
-/* Line 1455 of yacc.c  */
-#line 620 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 132:
-
-/* Line 1455 of yacc.c  */
-#line 626 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 133:
-
-/* Line 1455 of yacc.c  */
-#line 628 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 134:
-
-/* Line 1455 of yacc.c  */
-#line 630 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 135:
-
-/* Line 1455 of yacc.c  */
-#line 632 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 137:
-
-/* Line 1455 of yacc.c  */
-#line 638 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 138:
-
-/* Line 1455 of yacc.c  */
-#line 639 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 139:
-
-/* Line 1455 of yacc.c  */
-#line 641 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 140:
-
-/* Line 1455 of yacc.c  */
-#line 643 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 142:
-
-/* Line 1455 of yacc.c  */
-#line 648 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 144:
-
-/* Line 1455 of yacc.c  */
-#line 654 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 146:
-
-/* Line 1455 of yacc.c  */
-#line 659 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 148:
-
-/* Line 1455 of yacc.c  */
-#line 664 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 150:
-
-/* Line 1455 of yacc.c  */
-#line 670 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 152:
-
-/* Line 1455 of yacc.c  */
-#line 676 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 154:
-
-/* Line 1455 of yacc.c  */
-#line 681 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 156:
-
-/* Line 1455 of yacc.c  */
-#line 687 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 158:
-
-/* Line 1455 of yacc.c  */
-#line 693 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 160:
-
-/* Line 1455 of yacc.c  */
-#line 698 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 162:
-
-/* Line 1455 of yacc.c  */
-#line 704 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 164:
-
-/* Line 1455 of yacc.c  */
-#line 710 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 166:
-
-/* Line 1455 of yacc.c  */
-#line 715 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 168:
-
-/* Line 1455 of yacc.c  */
-#line 721 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 170:
-
-/* Line 1455 of yacc.c  */
-#line 726 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 172:
-
-/* Line 1455 of yacc.c  */
-#line 732 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 174:
-
-/* Line 1455 of yacc.c  */
-#line 738 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 176:
-
-/* Line 1455 of yacc.c  */
-#line 744 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 178:
-
-/* Line 1455 of yacc.c  */
-#line 750 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
-                                                                                                     (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 180:
-
-/* Line 1455 of yacc.c  */
-#line 758 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
-                                                                                                     (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants);
-                                        ;}
-    break;
-
-  case 182:
-
-/* Line 1455 of yacc.c  */
-#line 766 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature,
-                                                                                                     (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 183:
-
-/* Line 1455 of yacc.c  */
-#line 772 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpEqual; ;}
-    break;
-
-  case 184:
-
-/* Line 1455 of yacc.c  */
-#line 773 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpPlusEq; ;}
-    break;
-
-  case 185:
-
-/* Line 1455 of yacc.c  */
-#line 774 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpMinusEq; ;}
-    break;
-
-  case 186:
-
-/* Line 1455 of yacc.c  */
-#line 775 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpMultEq; ;}
-    break;
-
-  case 187:
-
-/* Line 1455 of yacc.c  */
-#line 776 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpDivEq; ;}
-    break;
-
-  case 188:
-
-/* Line 1455 of yacc.c  */
-#line 777 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpLShift; ;}
-    break;
-
-  case 189:
-
-/* Line 1455 of yacc.c  */
-#line 778 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpRShift; ;}
-    break;
-
-  case 190:
-
-/* Line 1455 of yacc.c  */
-#line 779 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpURShift; ;}
-    break;
-
-  case 191:
-
-/* Line 1455 of yacc.c  */
-#line 780 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpAndEq; ;}
-    break;
-
-  case 192:
-
-/* Line 1455 of yacc.c  */
-#line 781 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpXOrEq; ;}
-    break;
-
-  case 193:
-
-/* Line 1455 of yacc.c  */
-#line 782 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpOrEq; ;}
-    break;
-
-  case 194:
-
-/* Line 1455 of yacc.c  */
-#line 783 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpModEq; ;}
-    break;
-
-  case 196:
-
-/* Line 1455 of yacc.c  */
-#line 788 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 198:
-
-/* Line 1455 of yacc.c  */
-#line 793 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 200:
-
-/* Line 1455 of yacc.c  */
-#line 798 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 218:
-
-/* Line 1455 of yacc.c  */
-#line 822 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
-    break;
-
-  case 219:
-
-/* Line 1455 of yacc.c  */
-#line 824 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
-    break;
-
-  case 220:
-
-/* Line 1455 of yacc.c  */
-#line 829 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
-    break;
-
-  case 221:
-
-/* Line 1455 of yacc.c  */
-#line 831 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
-                                          AUTO_SEMICOLON; ;}
-    break;
-
-  case 222:
-
-/* Line 1455 of yacc.c  */
-#line 837 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.varDeclList).m_node = 0;
-                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
-                                          (yyval.varDeclList).m_numConstants = 0;
-                                        ;}
-    break;
-
-  case 223:
-
-/* Line 1455 of yacc.c  */
-#line 844 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
-                                          (yyval.varDeclList).m_node = node;
-                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features;
-                                          (yyval.varDeclList).m_numConstants = (yyvsp[(2) - (2)].expressionNode).m_numConstants;
-                                        ;}
-    break;
-
-  case 224:
-
-/* Line 1455 of yacc.c  */
-#line 854 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
-                                          (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (3)].ident), 0);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = (yyvsp[(1) - (3)].varDeclList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          (yyval.varDeclList).m_numConstants = (yyvsp[(1) - (3)].varDeclList).m_numConstants;
-                                        ;}
-    break;
-
-  case 225:
-
-/* Line 1455 of yacc.c  */
-#line 862 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
-                                          (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = (yyvsp[(1) - (4)].varDeclList).m_features | ((*(yyvsp[(3) - (4)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (4)].expressionNode).m_features;
-                                          (yyval.varDeclList).m_numConstants = (yyvsp[(1) - (4)].varDeclList).m_numConstants + (yyvsp[(4) - (4)].expressionNode).m_numConstants;
-                                        ;}
-    break;
-
-  case 226:
-
-/* Line 1455 of yacc.c  */
-#line 874 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.varDeclList).m_node = 0;
-                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
-                                          (yyval.varDeclList).m_numConstants = 0;
-                                        ;}
-    break;
-
-  case 227:
-
-/* Line 1455 of yacc.c  */
-#line 881 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
-                                          (yyval.varDeclList).m_node = node;
-                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features;
-                                          (yyval.varDeclList).m_numConstants = (yyvsp[(2) - (2)].expressionNode).m_numConstants;
-                                        ;}
-    break;
-
-  case 228:
-
-/* Line 1455 of yacc.c  */
-#line 891 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
-                                          (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (3)].ident), 0);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = (yyvsp[(1) - (3)].varDeclList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          (yyval.varDeclList).m_numConstants = (yyvsp[(1) - (3)].varDeclList).m_numConstants;
-                                        ;}
-    break;
-
-  case 229:
-
-/* Line 1455 of yacc.c  */
-#line 899 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
-                                          (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = (yyvsp[(1) - (4)].varDeclList).m_features | ((*(yyvsp[(3) - (4)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (4)].expressionNode).m_features;
-                                          (yyval.varDeclList).m_numConstants = (yyvsp[(1) - (4)].varDeclList).m_numConstants + (yyvsp[(4) - (4)].expressionNode).m_numConstants;
-                                        ;}
-    break;
-
-  case 230:
-
-/* Line 1455 of yacc.c  */
-#line 911 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
-    break;
-
-  case 231:
-
-/* Line 1455 of yacc.c  */
-#line 914 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 232:
-
-/* Line 1455 of yacc.c  */
-#line 919 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (1)].constDeclNode).m_node;
-                                          (yyval.constDeclList).m_node.tail = (yyval.constDeclList).m_node.head;
-                                          (yyval.constDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.constDeclList).m_varDeclarations, (yyvsp[(1) - (1)].constDeclNode).m_node);
-                                          (yyval.constDeclList).m_funcDeclarations = 0; 
-                                          (yyval.constDeclList).m_features = (yyvsp[(1) - (1)].constDeclNode).m_features;
-                                          (yyval.constDeclList).m_numConstants = (yyvsp[(1) - (1)].constDeclNode).m_numConstants;
-    ;}
-    break;
-
-  case 233:
-
-/* Line 1455 of yacc.c  */
-#line 928 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
-                                          (yyvsp[(1) - (3)].constDeclList).m_node.tail->m_next = (yyvsp[(3) - (3)].constDeclNode).m_node;
-                                          (yyval.constDeclList).m_node.tail = (yyvsp[(3) - (3)].constDeclNode).m_node;
-                                          (yyval.constDeclList).m_varDeclarations = (yyvsp[(1) - (3)].constDeclList).m_varDeclarations;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.constDeclList).m_varDeclarations, (yyvsp[(3) - (3)].constDeclNode).m_node);
-                                          (yyval.constDeclList).m_funcDeclarations = 0;
-                                          (yyval.constDeclList).m_features = (yyvsp[(1) - (3)].constDeclList).m_features | (yyvsp[(3) - (3)].constDeclNode).m_features;
-                                          (yyval.constDeclList).m_numConstants = (yyvsp[(1) - (3)].constDeclList).m_numConstants + (yyvsp[(3) - (3)].constDeclNode).m_numConstants; ;}
-    break;
-
-  case 234:
-
-/* Line 1455 of yacc.c  */
-#line 939 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
-    break;
-
-  case 235:
-
-/* Line 1455 of yacc.c  */
-#line 940 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 236:
-
-/* Line 1455 of yacc.c  */
-#line 944 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
-    break;
-
-  case 237:
-
-/* Line 1455 of yacc.c  */
-#line 948 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
-    break;
-
-  case 238:
-
-/* Line 1455 of yacc.c  */
-#line 952 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
-    break;
-
-  case 239:
-
-/* Line 1455 of yacc.c  */
-#line 956 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
-    break;
-
-  case 240:
-
-/* Line 1455 of yacc.c  */
-#line 958 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 241:
-
-/* Line 1455 of yacc.c  */
-#line 964 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
-    break;
-
-  case 242:
-
-/* Line 1455 of yacc.c  */
-#line 967 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
-                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
-                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
-                                                                                         (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
-                                                                                         (yyvsp[(3) - (7)].expressionNode).m_numConstants + (yyvsp[(5) - (7)].statementNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants); 
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(4) - (7)])); ;}
-    break;
-
-  case 243:
-
-/* Line 1455 of yacc.c  */
-#line 976 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
-                                             setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
-    break;
-
-  case 244:
-
-/* Line 1455 of yacc.c  */
-#line 978 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
-                                             setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
-    break;
-
-  case 245:
-
-/* Line 1455 of yacc.c  */
-#line 980 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
-    break;
-
-  case 246:
-
-/* Line 1455 of yacc.c  */
-#line 983 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
-                                                                                         (yyvsp[(3) - (9)].expressionNode).m_features | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
-                                                                                         (yyvsp[(3) - (9)].expressionNode).m_numConstants + (yyvsp[(5) - (9)].expressionNode).m_numConstants + (yyvsp[(7) - (9)].expressionNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); 
-                                        ;}
-    break;
-
-  case 247:
-
-/* Line 1455 of yacc.c  */
-#line 989 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
-                                                                                         mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_varDeclarations, (yyvsp[(10) - (10)].statementNode).m_varDeclarations),
-                                                                                         mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_funcDeclarations, (yyvsp[(10) - (10)].statementNode).m_funcDeclarations),
-                                                                                         (yyvsp[(4) - (10)].varDeclList).m_features | (yyvsp[(6) - (10)].expressionNode).m_features | (yyvsp[(8) - (10)].expressionNode).m_features | (yyvsp[(10) - (10)].statementNode).m_features,
-                                                                                         (yyvsp[(4) - (10)].varDeclList).m_numConstants + (yyvsp[(6) - (10)].expressionNode).m_numConstants + (yyvsp[(8) - (10)].expressionNode).m_numConstants + (yyvsp[(10) - (10)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (10)]), (yylsp[(9) - (10)])); ;}
-    break;
-
-  case 248:
-
-/* Line 1455 of yacc.c  */
-#line 996 "../../JavaScriptCore/parser/Grammar.y"
-    {
-                                            ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
-                                            setExceptionLocation(node, (yylsp[(3) - (7)]).first_column, (yylsp[(3) - (7)]).last_column, (yylsp[(5) - (7)]).last_column);
-                                            (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(7) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations,
-                                                                                           (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
-                                                                                           (yyvsp[(3) - (7)].expressionNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants);
-                                            setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(6) - (7)]));
-                                        ;}
-    break;
-
-  case 249:
-
-/* Line 1455 of yacc.c  */
-#line 1005 "../../JavaScriptCore/parser/Grammar.y"
-    { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
-                                          setExceptionLocation(forIn, (yylsp[(4) - (8)]).first_column, (yylsp[(5) - (8)]).first_column + 1, (yylsp[(6) - (8)]).last_column);
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, *(yyvsp[(4) - (8)].ident), DeclarationStacks::HasInitializer);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, (yyvsp[(8) - (8)].statementNode).m_funcDeclarations, ((*(yyvsp[(4) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(6) - (8)].expressionNode).m_features | (yyvsp[(8) - (8)].statementNode).m_features, (yyvsp[(6) - (8)].expressionNode).m_numConstants + (yyvsp[(8) - (8)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (8)]), (yylsp[(7) - (8)])); ;}
-    break;
-
-  case 250:
-
-/* Line 1455 of yacc.c  */
-#line 1011 "../../JavaScriptCore/parser/Grammar.y"
-    { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
-                                          setExceptionLocation(forIn, (yylsp[(4) - (9)]).first_column, (yylsp[(6) - (9)]).first_column + 1, (yylsp[(7) - (9)]).last_column);
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, *(yyvsp[(4) - (9)].ident), DeclarationStacks::HasInitializer);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations,
-                                                                                         ((*(yyvsp[(4) - (9)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
-                                                                                         (yyvsp[(5) - (9)].expressionNode).m_numConstants + (yyvsp[(7) - (9)].expressionNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); ;}
-    break;
-
-  case 251:
-
-/* Line 1455 of yacc.c  */
-#line 1021 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
-    break;
-
-  case 253:
-
-/* Line 1455 of yacc.c  */
-#line 1026 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
-    break;
-
-  case 255:
-
-/* Line 1455 of yacc.c  */
-#line 1031 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
-    break;
-
-  case 256:
-
-/* Line 1455 of yacc.c  */
-#line 1035 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 257:
-
-/* Line 1455 of yacc.c  */
-#line 1039 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
-    break;
-
-  case 258:
-
-/* Line 1455 of yacc.c  */
-#line 1043 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 259:
-
-/* Line 1455 of yacc.c  */
-#line 1050 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
-    break;
-
-  case 260:
-
-/* Line 1455 of yacc.c  */
-#line 1053 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 261:
-
-/* Line 1455 of yacc.c  */
-#line 1056 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
-    break;
-
-  case 262:
-
-/* Line 1455 of yacc.c  */
-#line 1059 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 263:
-
-/* Line 1455 of yacc.c  */
-#line 1065 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
-    break;
-
-  case 264:
-
-/* Line 1455 of yacc.c  */
-#line 1068 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 265:
-
-/* Line 1455 of yacc.c  */
-#line 1071 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
-    break;
-
-  case 266:
-
-/* Line 1455 of yacc.c  */
-#line 1074 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 267:
-
-/* Line 1455 of yacc.c  */
-#line 1080 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
-                                                                                         (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features | WithFeature, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
-    break;
-
-  case 268:
-
-/* Line 1455 of yacc.c  */
-#line 1086 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
-                                                                                         (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].caseBlockNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].caseBlockNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
-    break;
-
-  case 269:
-
-/* Line 1455 of yacc.c  */
-#line 1092 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
-    break;
-
-  case 270:
-
-/* Line 1455 of yacc.c  */
-#line 1094 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
-                                                                                         mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_varDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_varDeclarations), (yyvsp[(4) - (5)].clauseList).m_varDeclarations),
-                                                                                         mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_funcDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_funcDeclarations), (yyvsp[(4) - (5)].clauseList).m_funcDeclarations),
-                                                                                         (yyvsp[(2) - (5)].clauseList).m_features | (yyvsp[(3) - (5)].caseClauseNode).m_features | (yyvsp[(4) - (5)].clauseList).m_features,
-                                                                                         (yyvsp[(2) - (5)].clauseList).m_numConstants + (yyvsp[(3) - (5)].caseClauseNode).m_numConstants + (yyvsp[(4) - (5)].clauseList).m_numConstants); ;}
-    break;
-
-  case 271:
-
-/* Line 1455 of yacc.c  */
-#line 1102 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.clauseList).m_node.head = 0; (yyval.clauseList).m_node.tail = 0; (yyval.clauseList).m_varDeclarations = 0; (yyval.clauseList).m_funcDeclarations = 0; (yyval.clauseList).m_features = 0; (yyval.clauseList).m_numConstants = 0; ;}
-    break;
-
-  case 273:
-
-/* Line 1455 of yacc.c  */
-#line 1107 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.clauseList).m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
-                                          (yyval.clauseList).m_node.tail = (yyval.clauseList).m_node.head;
-                                          (yyval.clauseList).m_varDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_varDeclarations;
-                                          (yyval.clauseList).m_funcDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_funcDeclarations; 
-                                          (yyval.clauseList).m_features = (yyvsp[(1) - (1)].caseClauseNode).m_features;
-                                          (yyval.clauseList).m_numConstants = (yyvsp[(1) - (1)].caseClauseNode).m_numConstants; ;}
-    break;
-
-  case 274:
-
-/* Line 1455 of yacc.c  */
-#line 1113 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.clauseList).m_node.head = (yyvsp[(1) - (2)].clauseList).m_node.head;
-                                          (yyval.clauseList).m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
-                                          (yyval.clauseList).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_varDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_varDeclarations);
-                                          (yyval.clauseList).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_funcDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_funcDeclarations);
-                                          (yyval.clauseList).m_features = (yyvsp[(1) - (2)].clauseList).m_features | (yyvsp[(2) - (2)].caseClauseNode).m_features;
-                                          (yyval.clauseList).m_numConstants = (yyvsp[(1) - (2)].clauseList).m_numConstants + (yyvsp[(2) - (2)].caseClauseNode).m_numConstants;
-                                        ;}
-    break;
-
-  case 275:
-
-/* Line 1455 of yacc.c  */
-#line 1123 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 276:
-
-/* Line 1455 of yacc.c  */
-#line 1124 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
-    break;
-
-  case 277:
-
-/* Line 1455 of yacc.c  */
-#line 1128 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
-    break;
-
-  case 278:
-
-/* Line 1455 of yacc.c  */
-#line 1129 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
-    break;
-
-  case 279:
-
-/* Line 1455 of yacc.c  */
-#line 1133 "../../JavaScriptCore/parser/Grammar.y"
-    { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(3) - (3)].statementNode).m_varDeclarations, (yyvsp[(3) - (3)].statementNode).m_funcDeclarations, (yyvsp[(3) - (3)].statementNode).m_features, (yyvsp[(3) - (3)].statementNode).m_numConstants); ;}
-    break;
-
-  case 280:
-
-/* Line 1455 of yacc.c  */
-#line 1139 "../../JavaScriptCore/parser/Grammar.y"
-    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
-                                        ;}
-    break;
-
-  case 281:
-
-/* Line 1455 of yacc.c  */
-#line 1143 "../../JavaScriptCore/parser/Grammar.y"
-    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; 
-                                        ;}
-    break;
-
-  case 282:
-
-/* Line 1455 of yacc.c  */
-#line 1150 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
-                                                                                         mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_varDeclarations, (yyvsp[(4) - (4)].statementNode).m_varDeclarations),
-                                                                                         mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_funcDeclarations, (yyvsp[(4) - (4)].statementNode).m_funcDeclarations),
-                                                                                         (yyvsp[(2) - (4)].statementNode).m_features | (yyvsp[(4) - (4)].statementNode).m_features,
-                                                                                         (yyvsp[(2) - (4)].statementNode).m_numConstants + (yyvsp[(4) - (4)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (4)]), (yylsp[(2) - (4)])); ;}
-    break;
-
-  case 283:
-
-/* Line 1455 of yacc.c  */
-#line 1156 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
-                                                                                         mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
-                                                                                         mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
-                                                                                         (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features | CatchFeature,
-                                                                                         (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(2) - (7)])); ;}
-    break;
-
-  case 284:
-
-/* Line 1455 of yacc.c  */
-#line 1163 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
-                                                                                         mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_varDeclarations, (yyvsp[(7) - (9)].statementNode).m_varDeclarations), (yyvsp[(9) - (9)].statementNode).m_varDeclarations),
-                                                                                         mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_funcDeclarations, (yyvsp[(7) - (9)].statementNode).m_funcDeclarations), (yyvsp[(9) - (9)].statementNode).m_funcDeclarations),
-                                                                                         (yyvsp[(2) - (9)].statementNode).m_features | (yyvsp[(7) - (9)].statementNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features | CatchFeature,
-                                                                                         (yyvsp[(2) - (9)].statementNode).m_numConstants + (yyvsp[(7) - (9)].statementNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(2) - (9)])); ;}
-    break;
-
-  case 285:
-
-/* Line 1455 of yacc.c  */
-#line 1172 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
-    break;
-
-  case 286:
-
-/* Line 1455 of yacc.c  */
-#line 1174 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 287:
-
-/* Line 1455 of yacc.c  */
-#line 1179 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)->body()); ;}
-    break;
-
-  case 288:
-
-/* Line 1455 of yacc.c  */
-#line 1181 "../../JavaScriptCore/parser/Grammar.y"
-    {
-          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0);
-          if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
-              (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments();
-          setStatementLocation((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)]));
-          (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)->body());
-      ;}
-    break;
-
-  case 289:
-
-/* Line 1455 of yacc.c  */
-#line 1191 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(5) - (6)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(4) - (6)].intValue), (yyvsp[(6) - (6)].intValue), (yylsp[(4) - (6)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(5) - (6)].functionBodyNode), (yylsp[(4) - (6)]), (yylsp[(6) - (6)])); ;}
-    break;
-
-  case 290:
-
-/* Line 1455 of yacc.c  */
-#line 1193 "../../JavaScriptCore/parser/Grammar.y"
-    {
-          (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line), (yyvsp[(3) - (7)].parameterList).m_node.head), (yyvsp[(3) - (7)].parameterList).m_features | ClosureFeature, 0);
-          if ((yyvsp[(3) - (7)].parameterList).m_features & ArgumentsFeature)
-              (yyvsp[(6) - (7)].functionBodyNode)->setUsesArguments();
-          setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)]));
-      ;}
-    break;
-
-  case 291:
-
-/* Line 1455 of yacc.c  */
-#line 1199 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); ;}
-    break;
-
-  case 292:
-
-/* Line 1455 of yacc.c  */
-#line 1201 "../../JavaScriptCore/parser/Grammar.y"
-    {
-          (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
-          if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
-              (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments();
-          setStatementLocation((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)]));
-      ;}
-    break;
-
-  case 293:
-
-/* Line 1455 of yacc.c  */
-#line 1210 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.parameterList).m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
-                                          (yyval.parameterList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
-                                          (yyval.parameterList).m_node.tail = (yyval.parameterList).m_node.head; ;}
-    break;
-
-  case 294:
-
-/* Line 1455 of yacc.c  */
-#line 1213 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.parameterList).m_node.head = (yyvsp[(1) - (3)].parameterList).m_node.head;
-                                          (yyval.parameterList).m_features = (yyvsp[(1) - (3)].parameterList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          (yyval.parameterList).m_node.tail = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].parameterList).m_node.tail, *(yyvsp[(3) - (3)].ident));  ;}
-    break;
-
-  case 295:
-
-/* Line 1455 of yacc.c  */
-#line 1219 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
-    break;
-
-  case 296:
-
-/* Line 1455 of yacc.c  */
-#line 1220 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
-    break;
-
-  case 297:
-
-/* Line 1455 of yacc.c  */
-#line 1224 "../../JavaScriptCore/parser/Grammar.y"
-    { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
-    break;
-
-  case 298:
-
-/* Line 1455 of yacc.c  */
-#line 1225 "../../JavaScriptCore/parser/Grammar.y"
-    { GLOBAL_DATA->parser->didFinishParsing((yyvsp[(1) - (1)].sourceElements).m_node, (yyvsp[(1) - (1)].sourceElements).m_varDeclarations, (yyvsp[(1) - (1)].sourceElements).m_funcDeclarations, (yyvsp[(1) - (1)].sourceElements).m_features, 
-                                                                                (yylsp[(1) - (1)]).last_line, (yyvsp[(1) - (1)].sourceElements).m_numConstants); ;}
-    break;
-
-  case 299:
-
-/* Line 1455 of yacc.c  */
-#line 1230 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.sourceElements).m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
-                                          (yyval.sourceElements).m_node->append((yyvsp[(1) - (1)].statementNode).m_node);
-                                          (yyval.sourceElements).m_varDeclarations = (yyvsp[(1) - (1)].statementNode).m_varDeclarations;
-                                          (yyval.sourceElements).m_funcDeclarations = (yyvsp[(1) - (1)].statementNode).m_funcDeclarations;
-                                          (yyval.sourceElements).m_features = (yyvsp[(1) - (1)].statementNode).m_features;
-                                          (yyval.sourceElements).m_numConstants = (yyvsp[(1) - (1)].statementNode).m_numConstants;
-                                        ;}
-    break;
-
-  case 300:
-
-/* Line 1455 of yacc.c  */
-#line 1237 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.sourceElements).m_node->append((yyvsp[(2) - (2)].statementNode).m_node);
-                                          (yyval.sourceElements).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_varDeclarations, (yyvsp[(2) - (2)].statementNode).m_varDeclarations);
-                                          (yyval.sourceElements).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (2)].statementNode).m_funcDeclarations);
-                                          (yyval.sourceElements).m_features = (yyvsp[(1) - (2)].sourceElements).m_features | (yyvsp[(2) - (2)].statementNode).m_features;
-                                          (yyval.sourceElements).m_numConstants = (yyvsp[(1) - (2)].sourceElements).m_numConstants + (yyvsp[(2) - (2)].statementNode).m_numConstants;
-                                        ;}
-    break;
-
-  case 304:
-
-/* Line 1455 of yacc.c  */
-#line 1251 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 305:
-
-/* Line 1455 of yacc.c  */
-#line 1252 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 306:
-
-/* Line 1455 of yacc.c  */
-#line 1253 "../../JavaScriptCore/parser/Grammar.y"
-    { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
-    break;
-
-  case 307:
-
-/* Line 1455 of yacc.c  */
-#line 1254 "../../JavaScriptCore/parser/Grammar.y"
-    { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
-    break;
-
-  case 308:
-
-/* Line 1455 of yacc.c  */
-#line 1258 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 309:
-
-/* Line 1455 of yacc.c  */
-#line 1259 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 310:
-
-/* Line 1455 of yacc.c  */
-#line 1260 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 311:
-
-/* Line 1455 of yacc.c  */
-#line 1261 "../../JavaScriptCore/parser/Grammar.y"
-    { if (*(yyvsp[(1) - (7)].ident) != "get" && *(yyvsp[(1) - (7)].ident) != "set") YYABORT; ;}
-    break;
-
-  case 312:
-
-/* Line 1455 of yacc.c  */
-#line 1262 "../../JavaScriptCore/parser/Grammar.y"
-    { if (*(yyvsp[(1) - (8)].ident) != "get" && *(yyvsp[(1) - (8)].ident) != "set") YYABORT; ;}
-    break;
-
-  case 316:
-
-/* Line 1455 of yacc.c  */
-#line 1272 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 317:
-
-/* Line 1455 of yacc.c  */
-#line 1273 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 318:
-
-/* Line 1455 of yacc.c  */
-#line 1275 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 322:
-
-/* Line 1455 of yacc.c  */
-#line 1282 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 517:
-
-/* Line 1455 of yacc.c  */
-#line 1650 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 518:
-
-/* Line 1455 of yacc.c  */
-#line 1651 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 520:
-
-/* Line 1455 of yacc.c  */
-#line 1656 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 521:
-
-/* Line 1455 of yacc.c  */
-#line 1660 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 522:
-
-/* Line 1455 of yacc.c  */
-#line 1661 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 525:
-
-/* Line 1455 of yacc.c  */
-#line 1667 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 526:
-
-/* Line 1455 of yacc.c  */
-#line 1668 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 530:
-
-/* Line 1455 of yacc.c  */
-#line 1675 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 533:
-
-/* Line 1455 of yacc.c  */
-#line 1684 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 534:
-
-/* Line 1455 of yacc.c  */
-#line 1685 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 539:
-
-/* Line 1455 of yacc.c  */
-#line 1702 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 555:
-
-/* Line 1455 of yacc.c  */
-#line 1733 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 557:
-
-/* Line 1455 of yacc.c  */
-#line 1735 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 559:
-
-/* Line 1455 of yacc.c  */
-#line 1740 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 561:
-
-/* Line 1455 of yacc.c  */
-#line 1742 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 563:
-
-/* Line 1455 of yacc.c  */
-#line 1747 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 565:
-
-/* Line 1455 of yacc.c  */
-#line 1749 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 568:
-
-/* Line 1455 of yacc.c  */
-#line 1761 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 569:
-
-/* Line 1455 of yacc.c  */
-#line 1762 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 578:
-
-/* Line 1455 of yacc.c  */
-#line 1786 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 580:
-
-/* Line 1455 of yacc.c  */
-#line 1791 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 585:
-
-/* Line 1455 of yacc.c  */
-#line 1802 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 592:
-
-/* Line 1455 of yacc.c  */
-#line 1818 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-
-
-/* Line 1455 of yacc.c  */
-#line 5119 "WebCore/tmp/../generated/Grammar.tab.c"
-      default: break;
-    }
-  YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
-
-  YYPOPSTACK (yylen);
-  yylen = 0;
-  YY_STACK_PRINT (yyss, yyssp);
-
-  *++yyvsp = yyval;
-  *++yylsp = yyloc;
-
-  /* Now `shift' the result of the reduction.  Determine what state
-     that goes to, based on the state we popped back to and the rule
-     number reduced by.  */
-
-  yyn = yyr1[yyn];
-
-  yystate = yypgoto[yyn - YYNTOKENS] + *yyssp;
-  if (0 <= yystate && yystate <= YYLAST && yycheck[yystate] == *yyssp)
-    yystate = yytable[yystate];
-  else
-    yystate = yydefgoto[yyn - YYNTOKENS];
-
-  goto yynewstate;
-
-
-/*------------------------------------.
-| yyerrlab -- here on detecting error |
-`------------------------------------*/
-yyerrlab:
-  /* If not already recovering from an error, report this error.  */
-  if (!yyerrstatus)
-    {
-      ++yynerrs;
-#if ! YYERROR_VERBOSE
-      yyerror (YY_("syntax error"));
-#else
-      {
-	YYSIZE_T yysize = yysyntax_error (0, yystate, yychar);
-	if (yymsg_alloc < yysize && yymsg_alloc < YYSTACK_ALLOC_MAXIMUM)
-	  {
-	    YYSIZE_T yyalloc = 2 * yysize;
-	    if (! (yysize <= yyalloc && yyalloc <= YYSTACK_ALLOC_MAXIMUM))
-	      yyalloc = YYSTACK_ALLOC_MAXIMUM;
-	    if (yymsg != yymsgbuf)
-	      YYSTACK_FREE (yymsg);
-	    yymsg = (char *) YYSTACK_ALLOC (yyalloc);
-	    if (yymsg)
-	      yymsg_alloc = yyalloc;
-	    else
-	      {
-		yymsg = yymsgbuf;
-		yymsg_alloc = sizeof yymsgbuf;
-	      }
-	  }
-
-	if (0 < yysize && yysize <= yymsg_alloc)
-	  {
-	    (void) yysyntax_error (yymsg, yystate, yychar);
-	    yyerror (yymsg);
-	  }
-	else
-	  {
-	    yyerror (YY_("syntax error"));
-	    if (yysize != 0)
-	      goto yyexhaustedlab;
-	  }
-      }
-#endif
-    }
-
-  yyerror_range[0] = yylloc;
-
-  if (yyerrstatus == 3)
-    {
-      /* If just tried and failed to reuse lookahead token after an
-	 error, discard it.  */
-
-      if (yychar <= YYEOF)
-	{
-	  /* Return failure if at end of input.  */
-	  if (yychar == YYEOF)
-	    YYABORT;
-	}
-      else
-	{
-	  yydestruct ("Error: discarding",
-		      yytoken, &yylval, &yylloc);
-	  yychar = YYEMPTY;
-	}
-    }
-
-  /* Else will try to reuse lookahead token after shifting the error
-     token.  */
-  goto yyerrlab1;
-
-
-/*---------------------------------------------------.
-| yyerrorlab -- error raised explicitly by YYERROR.  |
-`---------------------------------------------------*/
-yyerrorlab:
-
-  /* Pacify compilers like GCC when the user code never invokes
-     YYERROR and the label yyerrorlab therefore never appears in user
-     code.  */
-  if (/*CONSTCOND*/ 0)
-     goto yyerrorlab;
-
-  yyerror_range[0] = yylsp[1-yylen];
-  /* Do not reclaim the symbols of the rule which action triggered
-     this YYERROR.  */
-  YYPOPSTACK (yylen);
-  yylen = 0;
-  YY_STACK_PRINT (yyss, yyssp);
-  yystate = *yyssp;
-  goto yyerrlab1;
-
-
-/*-------------------------------------------------------------.
-| yyerrlab1 -- common code for both syntax error and YYERROR.  |
-`-------------------------------------------------------------*/
-yyerrlab1:
-  yyerrstatus = 3;	/* Each real token shifted decrements this.  */
-
-  for (;;)
-    {
-      yyn = yypact[yystate];
-      if (yyn != YYPACT_NINF)
-	{
-	  yyn += YYTERROR;
-	  if (0 <= yyn && yyn <= YYLAST && yycheck[yyn] == YYTERROR)
-	    {
-	      yyn = yytable[yyn];
-	      if (0 < yyn)
-		break;
-	    }
-	}
-
-      /* Pop the current state because it cannot handle the error token.  */
-      if (yyssp == yyss)
-	YYABORT;
-
-      yyerror_range[0] = *yylsp;
-      yydestruct ("Error: popping",
-		  yystos[yystate], yyvsp, yylsp);
-      YYPOPSTACK (1);
-      yystate = *yyssp;
-      YY_STACK_PRINT (yyss, yyssp);
-    }
-
-  *++yyvsp = yylval;
-
-  yyerror_range[1] = yylloc;
-  /* Using YYLLOC is tempting, but would change the location of
-     the lookahead.  YYLOC is available though.  */
-  YYLLOC_DEFAULT (yyloc, (yyerror_range - 1), 2);
-  *++yylsp = yyloc;
-
-  /* Shift the error token.  */
-  YY_SYMBOL_PRINT ("Shifting", yystos[yyn], yyvsp, yylsp);
-
-  yystate = yyn;
-  goto yynewstate;
-
-
-/*-------------------------------------.
-| yyacceptlab -- YYACCEPT comes here.  |
-`-------------------------------------*/
-yyacceptlab:
-  yyresult = 0;
-  goto yyreturn;
-
-/*-----------------------------------.
-| yyabortlab -- YYABORT comes here.  |
-`-----------------------------------*/
-yyabortlab:
-  yyresult = 1;
-  goto yyreturn;
-
-#if !defined(yyoverflow) || YYERROR_VERBOSE
-/*-------------------------------------------------.
-| yyexhaustedlab -- memory exhaustion comes here.  |
-`-------------------------------------------------*/
-yyexhaustedlab:
-  yyerror (YY_("memory exhausted"));
-  yyresult = 2;
-  /* Fall through.  */
-#endif
-
-yyreturn:
-  if (yychar != YYEMPTY)
-     yydestruct ("Cleanup: discarding lookahead",
-		 yytoken, &yylval, &yylloc);
-  /* Do not reclaim the symbols of the rule which action triggered
-     this YYABORT or YYACCEPT.  */
-  YYPOPSTACK (yylen);
-  YY_STACK_PRINT (yyss, yyssp);
-  while (yyssp != yyss)
-    {
-      yydestruct ("Cleanup: popping",
-		  yystos[*yyssp], yyvsp, yylsp);
-      YYPOPSTACK (1);
-    }
-#ifndef yyoverflow
-  if (yyss != yyssa)
-    YYSTACK_FREE (yyss);
-#endif
-#if YYERROR_VERBOSE
-  if (yymsg != yymsgbuf)
-    YYSTACK_FREE (yymsg);
-#endif
-  /* Make sure YYID is used.  */
-  return YYID (yyresult);
-}
-
-
-
-/* Line 1675 of yacc.c  */
-#line 1834 "../../JavaScriptCore/parser/Grammar.y"
-
-
-#undef GLOBAL_DATA
-
-static ExpressionNode* makeAssignNode(JSGlobalData* globalData, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
-{
-    if (!loc->isLocation())
-        return new (globalData) AssignErrorNode(globalData, loc, op, expr, divot, divot - start, end - divot);
-
-    if (loc->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(loc);
-        if (op == OpEqual) {
-            AssignResolveNode* node = new (globalData) AssignResolveNode(globalData, resolve->identifier(), expr, exprHasAssignments);
-            setExceptionLocation(node, start, divot, end);
-            return node;
-        } else
-            return new (globalData) ReadModifyResolveNode(globalData, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
-    }
-    if (loc->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
-        if (op == OpEqual)
-            return new (globalData) AssignBracketNode(globalData, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
-        else {
-            ReadModifyBracketNode* node = new (globalData) ReadModifyBracketNode(globalData, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
-            node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
-            return node;
-        }
-    }
-    ASSERT(loc->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
-    if (op == OpEqual)
-        return new (globalData) AssignDotNode(globalData, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
-
-    ReadModifyDotNode* node = new (globalData) ReadModifyDotNode(globalData, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
-    node->setSubexpressionInfo(dot->divot(), dot->endOffset());
-    return node;
-}
-
-static ExpressionNode* makePrefixNode(JSGlobalData* globalData, ExpressionNode* expr, Operator op, int start, int divot, int end)
-{
-    if (!expr->isLocation())
-        return new (globalData) PrefixErrorNode(globalData, expr, op, divot, divot - start, end - divot);
-    
-    if (expr->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (globalData) PrefixResolveNode(globalData, resolve->identifier(), op, divot, divot - start, end - divot);
-    }
-    if (expr->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new (globalData) PrefixBracketNode(globalData, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
-        node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
-        return node;
-    }
-    ASSERT(expr->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new (globalData) PrefixDotNode(globalData, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
-    node->setSubexpressionInfo(dot->divot(), dot->startOffset());
-    return node;
-}
-
-static ExpressionNode* makePostfixNode(JSGlobalData* globalData, ExpressionNode* expr, Operator op, int start, int divot, int end)
-{ 
-    if (!expr->isLocation())
-        return new (globalData) PostfixErrorNode(globalData, expr, op, divot, divot - start, end - divot);
-    
-    if (expr->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (globalData) PostfixResolveNode(globalData, resolve->identifier(), op, divot, divot - start, end - divot);
-    }
-    if (expr->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new (globalData) PostfixBracketNode(globalData, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
-        node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
-        return node;
-        
-    }
-    ASSERT(expr->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new (globalData) PostfixDotNode(globalData, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
-    node->setSubexpressionInfo(dot->divot(), dot->endOffset());
-    return node;
-}
-
-static ExpressionNodeInfo makeFunctionCallNode(JSGlobalData* globalData, ExpressionNodeInfo func, ArgumentsNodeInfo args, int start, int divot, int end)
-{
-    CodeFeatures features = func.m_features | args.m_features;
-    int numConstants = func.m_numConstants + args.m_numConstants;
-    if (!func.m_node->isLocation())
-        return createNodeInfo<ExpressionNode*>(new (globalData) FunctionCallValueNode(globalData, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
-    if (func.m_node->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(func.m_node);
-        const Identifier& identifier = resolve->identifier();
-        if (identifier == globalData->propertyNames->eval)
-            return createNodeInfo<ExpressionNode*>(new (globalData) EvalFunctionCallNode(globalData, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
-        return createNodeInfo<ExpressionNode*>(new (globalData) FunctionCallResolveNode(globalData, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
-    }
-    if (func.m_node->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func.m_node);
-        FunctionCallBracketNode* node = new (globalData) FunctionCallBracketNode(globalData, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
-        node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
-        return createNodeInfo<ExpressionNode*>(node, features, numConstants);
-    }
-    ASSERT(func.m_node->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(func.m_node);
-    FunctionCallDotNode* node;
-    if (dot->identifier() == globalData->propertyNames->call)
-        node = new (globalData) CallFunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
-    else if (dot->identifier() == globalData->propertyNames->apply)
-        node = new (globalData) ApplyFunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
-    else
-        node = new (globalData) FunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
-    node->setSubexpressionInfo(dot->divot(), dot->endOffset());
-    return createNodeInfo<ExpressionNode*>(node, features, numConstants);
-}
-
-static ExpressionNode* makeTypeOfNode(JSGlobalData* globalData, ExpressionNode* expr)
-{
-    if (expr->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (globalData) TypeOfResolveNode(globalData, resolve->identifier());
-    }
-    return new (globalData) TypeOfValueNode(globalData, expr);
-}
-
-static ExpressionNode* makeDeleteNode(JSGlobalData* globalData, ExpressionNode* expr, int start, int divot, int end)
-{
-    if (!expr->isLocation())
-        return new (globalData) DeleteValueNode(globalData, expr);
-    if (expr->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (globalData) DeleteResolveNode(globalData, resolve->identifier(), divot, divot - start, end - divot);
-    }
-    if (expr->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        return new (globalData) DeleteBracketNode(globalData, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
-    }
-    ASSERT(expr->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    return new (globalData) DeleteDotNode(globalData, dot->base(), dot->identifier(), divot, divot - start, end - divot);
-}
-
-static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData* globalData, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
-{
-    PropertyNode::Type type;
-    if (getOrSet == "get")
-        type = PropertyNode::Getter;
-    else if (getOrSet == "set")
-        type = PropertyNode::Setter;
-    else
-        return 0;
-    return new (globalData) PropertyNode(globalData, name, new (globalData) FuncExprNode(globalData, globalData->propertyNames->nullIdentifier, body, source, params), type);
-}
-
-static ExpressionNode* makeNegateNode(JSGlobalData* globalData, ExpressionNode* n)
-{
-    if (n->isNumber()) {
-        NumberNode* number = static_cast<NumberNode*>(n);
-
-        if (number->value() > 0.0) {
-            number->setValue(-number->value());
-            return number;
-        }
-    }
-
-    return new (globalData) NegateNode(globalData, n);
-}
-
-static NumberNode* makeNumberNode(JSGlobalData* globalData, double d)
-{
-    return new (globalData) NumberNode(globalData, d);
-}
-
-static ExpressionNode* makeBitwiseNotNode(JSGlobalData* globalData, ExpressionNode* expr)
-{
-    if (expr->isNumber())
-        return makeNumberNode(globalData, ~toInt32(static_cast<NumberNode*>(expr)->value()));
-    return new (globalData) BitwiseNotNode(globalData, expr);
-}
-
-static ExpressionNode* makeMultNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    expr1 = expr1->stripUnaryPlus();
-    expr2 = expr2->stripUnaryPlus();
-
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
-
-    if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
-        return new (globalData) UnaryPlusNode(globalData, expr2);
-
-    if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
-        return new (globalData) UnaryPlusNode(globalData, expr1);
-
-    return new (globalData) MultNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-static ExpressionNode* makeDivNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    expr1 = expr1->stripUnaryPlus();
-    expr2 = expr2->stripUnaryPlus();
-
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
-    return new (globalData) DivNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-static ExpressionNode* makeAddNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
-    return new (globalData) AddNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-static ExpressionNode* makeSubNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    expr1 = expr1->stripUnaryPlus();
-    expr2 = expr2->stripUnaryPlus();
-
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
-    return new (globalData) SubNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-static ExpressionNode* makeLeftShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (globalData) LeftShiftNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-static ExpressionNode* makeRightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (globalData) RightShiftNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-// Called by yyparse on error.
-int yyerror(const char*)
-{
-    return 1;
-}
-
-// May we automatically insert a semicolon?
-static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
-{
-    return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
-}
-
-static ExpressionNode* combineCommaNodes(JSGlobalData* globalData, ExpressionNode* list, ExpressionNode* init)
-{
-    if (!list)
-        return init;
-    if (list->isCommaNode()) {
-        static_cast<CommaNode*>(list)->append(init);
-        return list;
-    }
-    return new (globalData) CommaNode(globalData, list, init);
-}
-
-// We turn variable declarations into either assignments or empty
-// statements (which later get stripped out), because the actual
-// declaration work is hoisted up to the start of the function body
-static StatementNode* makeVarStatementNode(JSGlobalData* globalData, ExpressionNode* expr)
-{
-    if (!expr)
-        return new (globalData) EmptyStatementNode(globalData);
-    return new (globalData) VarStatementNode(globalData, expr);
-}
-
diff --git a/src/3rdparty/webkit/WebCore/generated/Grammar.h b/src/3rdparty/webkit/WebCore/generated/Grammar.h
deleted file mode 100644
index e555cfbb88..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/Grammar.h
+++ /dev/null
@@ -1,173 +0,0 @@
-
-/* A Bison parser, made by GNU Bison 2.4.1.  */
-
-/* Skeleton interface for Bison's Yacc-like parsers in C
-   
-      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
-   Free Software Foundation, Inc.
-   
-   This program is free software: you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-   
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-   
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
-
-/* As a special exception, you may create a larger work that contains
-   part or all of the Bison parser skeleton and distribute that work
-   under terms of your choice, so long as that work isn't itself a
-   parser generator using the skeleton or a modified version thereof
-   as a parser skeleton.  Alternatively, if you modify or redistribute
-   the parser skeleton itself, you may (at your option) remove this
-   special exception, which will cause the skeleton and the resulting
-   Bison output files to be licensed under the GNU General Public
-   License without this special exception.
-   
-   This special exception was added by the Free Software Foundation in
-   version 2.2 of Bison.  */
-
-
-/* Tokens.  */
-#ifndef YYTOKENTYPE
-# define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     NULLTOKEN = 258,
-     TRUETOKEN = 259,
-     FALSETOKEN = 260,
-     BREAK = 261,
-     CASE = 262,
-     DEFAULT = 263,
-     FOR = 264,
-     NEW = 265,
-     VAR = 266,
-     CONSTTOKEN = 267,
-     CONTINUE = 268,
-     FUNCTION = 269,
-     RETURN = 270,
-     VOIDTOKEN = 271,
-     DELETETOKEN = 272,
-     IF = 273,
-     THISTOKEN = 274,
-     DO = 275,
-     WHILE = 276,
-     INTOKEN = 277,
-     INSTANCEOF = 278,
-     TYPEOF = 279,
-     SWITCH = 280,
-     WITH = 281,
-     RESERVED = 282,
-     THROW = 283,
-     TRY = 284,
-     CATCH = 285,
-     FINALLY = 286,
-     DEBUGGER = 287,
-     IF_WITHOUT_ELSE = 288,
-     ELSE = 289,
-     EQEQ = 290,
-     NE = 291,
-     STREQ = 292,
-     STRNEQ = 293,
-     LE = 294,
-     GE = 295,
-     OR = 296,
-     AND = 297,
-     PLUSPLUS = 298,
-     MINUSMINUS = 299,
-     LSHIFT = 300,
-     RSHIFT = 301,
-     URSHIFT = 302,
-     PLUSEQUAL = 303,
-     MINUSEQUAL = 304,
-     MULTEQUAL = 305,
-     DIVEQUAL = 306,
-     LSHIFTEQUAL = 307,
-     RSHIFTEQUAL = 308,
-     URSHIFTEQUAL = 309,
-     ANDEQUAL = 310,
-     MODEQUAL = 311,
-     XOREQUAL = 312,
-     OREQUAL = 313,
-     OPENBRACE = 314,
-     CLOSEBRACE = 315,
-     NUMBER = 316,
-     IDENT = 317,
-     STRING = 318,
-     AUTOPLUSPLUS = 319,
-     AUTOMINUSMINUS = 320
-   };
-#endif
-
-
-
-#if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
-typedef union YYSTYPE
-{
-
-/* Line 1676 of yacc.c  */
-#line 146 "../../JavaScriptCore/parser/Grammar.y"
-
-    int                 intValue;
-    double              doubleValue;
-    const Identifier*   ident;
-
-    // expression subtrees
-    ExpressionNodeInfo  expressionNode;
-    FuncDeclNodeInfo    funcDeclNode;
-    PropertyNodeInfo    propertyNode;
-    ArgumentsNodeInfo   argumentsNode;
-    ConstDeclNodeInfo   constDeclNode;
-    CaseBlockNodeInfo   caseBlockNode;
-    CaseClauseNodeInfo  caseClauseNode;
-    FuncExprNodeInfo    funcExprNode;
-
-    // statement nodes
-    StatementNodeInfo   statementNode;
-    FunctionBodyNode*   functionBodyNode;
-    ProgramNode*        programNode;
-
-    SourceElementsInfo  sourceElements;
-    PropertyListInfo    propertyList;
-    ArgumentListInfo    argumentList;
-    VarDeclListInfo     varDeclList;
-    ConstDeclListInfo   constDeclList;
-    ClauseListInfo      clauseList;
-    ElementListInfo     elementList;
-    ParameterListInfo   parameterList;
-
-    Operator            op;
-
-
-
-/* Line 1676 of yacc.c  */
-#line 151 "WebCore/tmp/../generated/Grammar.tab.h"
-} YYSTYPE;
-# define YYSTYPE_IS_TRIVIAL 1
-# define yystype YYSTYPE /* obsolescent; will be withdrawn */
-# define YYSTYPE_IS_DECLARED 1
-#endif
-
-
-
-#if ! defined YYLTYPE && ! defined YYLTYPE_IS_DECLARED
-typedef struct YYLTYPE
-{
-  int first_line;
-  int first_column;
-  int last_line;
-  int last_column;
-} YYLTYPE;
-# define yyltype YYLTYPE /* obsolescent; will be withdrawn */
-# define YYLTYPE_IS_DECLARED 1
-# define YYLTYPE_IS_TRIVIAL 1
-#endif
-
-
-
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp
index 4cb475fab3..c5afe7eaef 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp
@@ -84,6 +84,7 @@
 #include "HTMLOptionElement.h"
 #include "HTMLParagraphElement.h"
 #include "HTMLParamElement.h"
+#include "HTMLProgressElement.h"
 #include "HTMLQuoteElement.h"
 #include "HTMLScriptElement.h"
 #include "HTMLSelectElement.h"
@@ -393,6 +394,14 @@ static PassRefPtr<HTMLElement> paramConstructor(const QualifiedName& tagName, Do
     return new HTMLParamElement(tagName, document);
 }
 
+#if ENABLE(PROGRESS_TAG)
+
+static PassRefPtr<HTMLElement> progressConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
+{
+    return HTMLProgressElement::create(tagName, document);
+}
+
+#endif
 static PassRefPtr<HTMLElement> quoteConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
     return new HTMLQuoteElement(tagName, document);
@@ -565,6 +574,10 @@ static void createFunctionMap()
     addTag(pTag, paragraphConstructor);
     addTag(paramTag, paramConstructor);
     addTag(preTag, preConstructor);
+#if ENABLE(PROGRESS_TAG)
+    addTag(progressTag, progressConstructor);
+#endif
+
     addTag(qTag, quoteConstructor);
     addTag(scriptTag, scriptConstructor);
     addTag(selectTag, selectConstructor);
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLEntityNames.c b/src/3rdparty/webkit/WebCore/generated/HTMLEntityNames.c
index 761f29d1cb..8bd9d97464 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLEntityNames.c
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLEntityNames.c
@@ -1,4 +1,4 @@
-/* ANSI-C code produced by gperf version 3.0.3 */
+/* ANSI-C code produced by gperf version 3.0.1 */
 /* Command-line: gperf -a -L ANSI-C -C -G -c -o -t --includes --key-positions='*' -N findEntity -D -s 2  */
 
 #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \
@@ -521,9 +521,6 @@ static const short lookup[] =
 
 #ifdef __GNUC__
 __inline
-#ifdef __GNUC_STDC_INLINE__
-__attribute__ ((__gnu_inline__))
-#endif
 #endif
 const struct Entity *
 findEntity (register const char *str, register unsigned int len)
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
index 06d1f1fb8d..a1c2d5d225 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
@@ -51,6 +51,8 @@ DEFINE_GLOBAL(QualifiedName, acronymTag, nullAtom, "acronym", xhtmlNamespaceURI)
 DEFINE_GLOBAL(QualifiedName, addressTag, nullAtom, "address", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, appletTag, nullAtom, "applet", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, areaTag, nullAtom, "area", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, articleTag, nullAtom, "article", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, asideTag, nullAtom, "aside", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, audioTag, nullAtom, "audio", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, bTag, nullAtom, "b", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, baseTag, nullAtom, "base", xhtmlNamespaceURI);
@@ -84,6 +86,7 @@ DEFINE_GLOBAL(QualifiedName, emTag, nullAtom, "em", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, embedTag, nullAtom, "embed", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, fieldsetTag, nullAtom, "fieldset", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, fontTag, nullAtom, "font", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, footerTag, nullAtom, "footer", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, formTag, nullAtom, "form", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, frameTag, nullAtom, "frame", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, framesetTag, nullAtom, "frameset", xhtmlNamespaceURI);
@@ -94,6 +97,8 @@ DEFINE_GLOBAL(QualifiedName, h4Tag, nullAtom, "h4", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, h5Tag, nullAtom, "h5", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, h6Tag, nullAtom, "h6", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, headTag, nullAtom, "head", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, headerTag, nullAtom, "header", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, hgroupTag, nullAtom, "hgroup", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, hrTag, nullAtom, "hr", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, htmlTag, nullAtom, "html", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, iTag, nullAtom, "i", xhtmlNamespaceURI);
@@ -129,6 +134,7 @@ DEFINE_GLOBAL(QualifiedName, pTag, nullAtom, "p", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, paramTag, nullAtom, "param", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, plaintextTag, nullAtom, "plaintext", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, preTag, nullAtom, "pre", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, progressTag, nullAtom, "progress", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, qTag, nullAtom, "q", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, rpTag, nullAtom, "rp", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, rtTag, nullAtom, "rt", xhtmlNamespaceURI);
@@ -136,6 +142,7 @@ DEFINE_GLOBAL(QualifiedName, rubyTag, nullAtom, "ruby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, sTag, nullAtom, "s", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, sampTag, nullAtom, "samp", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, scriptTag, nullAtom, "script", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, sectionTag, nullAtom, "section", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, selectTag, nullAtom, "select", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, smallTag, nullAtom, "small", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, sourceTag, nullAtom, "source", xhtmlNamespaceURI);
@@ -172,6 +179,8 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&addressTag,
         (WebCore::QualifiedName*)&appletTag,
         (WebCore::QualifiedName*)&areaTag,
+        (WebCore::QualifiedName*)&articleTag,
+        (WebCore::QualifiedName*)&asideTag,
         (WebCore::QualifiedName*)&audioTag,
         (WebCore::QualifiedName*)&bTag,
         (WebCore::QualifiedName*)&baseTag,
@@ -205,6 +214,7 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&embedTag,
         (WebCore::QualifiedName*)&fieldsetTag,
         (WebCore::QualifiedName*)&fontTag,
+        (WebCore::QualifiedName*)&footerTag,
         (WebCore::QualifiedName*)&formTag,
         (WebCore::QualifiedName*)&frameTag,
         (WebCore::QualifiedName*)&framesetTag,
@@ -215,6 +225,8 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&h5Tag,
         (WebCore::QualifiedName*)&h6Tag,
         (WebCore::QualifiedName*)&headTag,
+        (WebCore::QualifiedName*)&headerTag,
+        (WebCore::QualifiedName*)&hgroupTag,
         (WebCore::QualifiedName*)&hrTag,
         (WebCore::QualifiedName*)&htmlTag,
         (WebCore::QualifiedName*)&iTag,
@@ -250,6 +262,7 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&paramTag,
         (WebCore::QualifiedName*)&plaintextTag,
         (WebCore::QualifiedName*)&preTag,
+        (WebCore::QualifiedName*)&progressTag,
         (WebCore::QualifiedName*)&qTag,
         (WebCore::QualifiedName*)&rpTag,
         (WebCore::QualifiedName*)&rtTag,
@@ -257,6 +270,7 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&sTag,
         (WebCore::QualifiedName*)&sampTag,
         (WebCore::QualifiedName*)&scriptTag,
+        (WebCore::QualifiedName*)&sectionTag,
         (WebCore::QualifiedName*)&selectTag,
         (WebCore::QualifiedName*)&smallTag,
         (WebCore::QualifiedName*)&sourceTag,
@@ -283,7 +297,7 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&wbrTag,
         (WebCore::QualifiedName*)&xmpTag,
     };
-    *size = 116;
+    *size = 123;
     return HTMLTags;
 }
 
@@ -298,22 +312,35 @@ DEFINE_GLOBAL(QualifiedName, alinkAttr, nullAtom, "alink", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, altAttr, nullAtom, "alt", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, archiveAttr, nullAtom, "archive", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_activedescendantAttr, nullAtom, "aria_activedescendant", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_atomicAttr, nullAtom, "aria_atomic", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_busyAttr, nullAtom, "aria_busy", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_checkedAttr, nullAtom, "aria_checked", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_controlsAttr, nullAtom, "aria_controls", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_describedbyAttr, nullAtom, "aria_describedby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_disabledAttr, nullAtom, "aria_disabled", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_dropeffectAttr, nullAtom, "aria_dropeffect", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_expandedAttr, nullAtom, "aria_expanded", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_flowtoAttr, nullAtom, "aria_flowto", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_grabbedAttr, nullAtom, "aria_grabbed", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_haspopupAttr, nullAtom, "aria_haspopup", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_hiddenAttr, nullAtom, "aria_hidden", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_labelAttr, nullAtom, "aria_label", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_labeledbyAttr, nullAtom, "aria_labeledby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_labelledbyAttr, nullAtom, "aria_labelledby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_levelAttr, nullAtom, "aria_level", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_liveAttr, nullAtom, "aria_live", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_multiselectableAttr, nullAtom, "aria_multiselectable", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_orientationAttr, nullAtom, "aria_orientation", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_ownsAttr, nullAtom, "aria_owns", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_pressedAttr, nullAtom, "aria_pressed", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_readonlyAttr, nullAtom, "aria_readonly", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_relevantAttr, nullAtom, "aria_relevant", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_requiredAttr, nullAtom, "aria_required", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_selectedAttr, nullAtom, "aria_selected", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valuemaxAttr, nullAtom, "aria_valuemax", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valueminAttr, nullAtom, "aria_valuemin", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valuenowAttr, nullAtom, "aria_valuenow", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valuetextAttr, nullAtom, "aria_valuetext", xhtmlNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, autobufferAttr, nullAtom, "autobuffer", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, autocompleteAttr, nullAtom, "autocomplete", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, autofocusAttr, nullAtom, "autofocus", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, autoplayAttr, nullAtom, "autoplay", xhtmlNamespaceURI);
@@ -359,6 +386,7 @@ DEFINE_GLOBAL(QualifiedName, disabledAttr, nullAtom, "disabled", xhtmlNamespaceU
 DEFINE_GLOBAL(QualifiedName, draggableAttr, nullAtom, "draggable", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, enctypeAttr, nullAtom, "enctype", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, endAttr, nullAtom, "end", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, eventAttr, nullAtom, "event", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, expandedAttr, nullAtom, "expanded", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, faceAttr, nullAtom, "face", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, focusedAttr, nullAtom, "focused", xhtmlNamespaceURI);
@@ -433,6 +461,8 @@ DEFINE_GLOBAL(QualifiedName, onemptiedAttr, nullAtom, "onemptied", xhtmlNamespac
 DEFINE_GLOBAL(QualifiedName, onendedAttr, nullAtom, "onended", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onerrorAttr, nullAtom, "onerror", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onfocusAttr, nullAtom, "onfocus", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onfocusinAttr, nullAtom, "onfocusin", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onfocusoutAttr, nullAtom, "onfocusout", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onhashchangeAttr, nullAtom, "onhashchange", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, oninputAttr, nullAtom, "oninput", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, oninvalidAttr, nullAtom, "oninvalid", xhtmlNamespaceURI);
@@ -458,6 +488,7 @@ DEFINE_GLOBAL(QualifiedName, onpasteAttr, nullAtom, "onpaste", xhtmlNamespaceURI
 DEFINE_GLOBAL(QualifiedName, onpauseAttr, nullAtom, "onpause", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onplayAttr, nullAtom, "onplay", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onplayingAttr, nullAtom, "onplaying", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onpopstateAttr, nullAtom, "onpopstate", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onprogressAttr, nullAtom, "onprogress", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onratechangeAttr, nullAtom, "onratechange", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onresetAttr, nullAtom, "onreset", xhtmlNamespaceURI);
@@ -473,12 +504,18 @@ DEFINE_GLOBAL(QualifiedName, onstorageAttr, nullAtom, "onstorage", xhtmlNamespac
 DEFINE_GLOBAL(QualifiedName, onsubmitAttr, nullAtom, "onsubmit", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onsuspendAttr, nullAtom, "onsuspend", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, ontimeupdateAttr, nullAtom, "ontimeupdate", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, ontouchcancelAttr, nullAtom, "ontouchcancel", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, ontouchendAttr, nullAtom, "ontouchend", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, ontouchmoveAttr, nullAtom, "ontouchmove", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, ontouchstartAttr, nullAtom, "ontouchstart", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onunloadAttr, nullAtom, "onunload", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onvolumechangeAttr, nullAtom, "onvolumechange", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onwaitingAttr, nullAtom, "onwaiting", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onwebkitanimationendAttr, nullAtom, "onwebkitanimationend", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onwebkitanimationiterationAttr, nullAtom, "onwebkitanimationiteration", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onwebkitanimationstartAttr, nullAtom, "onwebkitanimationstart", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onwebkitbeginfullscreenAttr, nullAtom, "onwebkitbeginfullscreen", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onwebkitendfullscreenAttr, nullAtom, "onwebkitendfullscreen", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onwebkittransitionendAttr, nullAtom, "onwebkittransitionend", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, patternAttr, nullAtom, "pattern", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, placeholderAttr, nullAtom, "placeholder", xhtmlNamespaceURI);
@@ -486,6 +523,7 @@ DEFINE_GLOBAL(QualifiedName, playcountAttr, nullAtom, "playcount", xhtmlNamespac
 DEFINE_GLOBAL(QualifiedName, pluginurlAttr, nullAtom, "pluginurl", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, posterAttr, nullAtom, "poster", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, precisionAttr, nullAtom, "precision", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, preloadAttr, nullAtom, "preload", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, primaryAttr, nullAtom, "primary", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, profileAttr, nullAtom, "profile", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, progressAttr, nullAtom, "progress", xhtmlNamespaceURI);
@@ -499,6 +537,7 @@ DEFINE_GLOBAL(QualifiedName, roleAttr, nullAtom, "role", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, rowsAttr, nullAtom, "rows", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, rowspanAttr, nullAtom, "rowspan", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, rulesAttr, nullAtom, "rules", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, sandboxAttr, nullAtom, "sandbox", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, schemeAttr, nullAtom, "scheme", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, scopeAttr, nullAtom, "scope", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, scrollamountAttr, nullAtom, "scrollamount", xhtmlNamespaceURI);
@@ -514,6 +553,7 @@ DEFINE_GLOBAL(QualifiedName, spellcheckAttr, nullAtom, "spellcheck", xhtmlNamesp
 DEFINE_GLOBAL(QualifiedName, srcAttr, nullAtom, "src", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, standbyAttr, nullAtom, "standby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, startAttr, nullAtom, "start", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, stepAttr, nullAtom, "step", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, styleAttr, nullAtom, "style", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, summaryAttr, nullAtom, "summary", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, tabindexAttr, nullAtom, "tabindex", xhtmlNamespaceURI);
@@ -550,22 +590,35 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&altAttr,
         (WebCore::QualifiedName*)&archiveAttr,
         (WebCore::QualifiedName*)&aria_activedescendantAttr,
+        (WebCore::QualifiedName*)&aria_atomicAttr,
+        (WebCore::QualifiedName*)&aria_busyAttr,
         (WebCore::QualifiedName*)&aria_checkedAttr,
+        (WebCore::QualifiedName*)&aria_controlsAttr,
         (WebCore::QualifiedName*)&aria_describedbyAttr,
         (WebCore::QualifiedName*)&aria_disabledAttr,
+        (WebCore::QualifiedName*)&aria_dropeffectAttr,
+        (WebCore::QualifiedName*)&aria_expandedAttr,
+        (WebCore::QualifiedName*)&aria_flowtoAttr,
+        (WebCore::QualifiedName*)&aria_grabbedAttr,
+        (WebCore::QualifiedName*)&aria_haspopupAttr,
         (WebCore::QualifiedName*)&aria_hiddenAttr,
         (WebCore::QualifiedName*)&aria_labelAttr,
         (WebCore::QualifiedName*)&aria_labeledbyAttr,
         (WebCore::QualifiedName*)&aria_labelledbyAttr,
         (WebCore::QualifiedName*)&aria_levelAttr,
+        (WebCore::QualifiedName*)&aria_liveAttr,
+        (WebCore::QualifiedName*)&aria_multiselectableAttr,
+        (WebCore::QualifiedName*)&aria_orientationAttr,
+        (WebCore::QualifiedName*)&aria_ownsAttr,
         (WebCore::QualifiedName*)&aria_pressedAttr,
         (WebCore::QualifiedName*)&aria_readonlyAttr,
+        (WebCore::QualifiedName*)&aria_relevantAttr,
         (WebCore::QualifiedName*)&aria_requiredAttr,
+        (WebCore::QualifiedName*)&aria_selectedAttr,
         (WebCore::QualifiedName*)&aria_valuemaxAttr,
         (WebCore::QualifiedName*)&aria_valueminAttr,
         (WebCore::QualifiedName*)&aria_valuenowAttr,
         (WebCore::QualifiedName*)&aria_valuetextAttr,
-        (WebCore::QualifiedName*)&autobufferAttr,
         (WebCore::QualifiedName*)&autocompleteAttr,
         (WebCore::QualifiedName*)&autofocusAttr,
         (WebCore::QualifiedName*)&autoplayAttr,
@@ -611,6 +664,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&draggableAttr,
         (WebCore::QualifiedName*)&enctypeAttr,
         (WebCore::QualifiedName*)&endAttr,
+        (WebCore::QualifiedName*)&eventAttr,
         (WebCore::QualifiedName*)&expandedAttr,
         (WebCore::QualifiedName*)&faceAttr,
         (WebCore::QualifiedName*)&focusedAttr,
@@ -685,6 +739,8 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onendedAttr,
         (WebCore::QualifiedName*)&onerrorAttr,
         (WebCore::QualifiedName*)&onfocusAttr,
+        (WebCore::QualifiedName*)&onfocusinAttr,
+        (WebCore::QualifiedName*)&onfocusoutAttr,
         (WebCore::QualifiedName*)&onhashchangeAttr,
         (WebCore::QualifiedName*)&oninputAttr,
         (WebCore::QualifiedName*)&oninvalidAttr,
@@ -710,6 +766,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onpauseAttr,
         (WebCore::QualifiedName*)&onplayAttr,
         (WebCore::QualifiedName*)&onplayingAttr,
+        (WebCore::QualifiedName*)&onpopstateAttr,
         (WebCore::QualifiedName*)&onprogressAttr,
         (WebCore::QualifiedName*)&onratechangeAttr,
         (WebCore::QualifiedName*)&onresetAttr,
@@ -725,12 +782,18 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onsubmitAttr,
         (WebCore::QualifiedName*)&onsuspendAttr,
         (WebCore::QualifiedName*)&ontimeupdateAttr,
+        (WebCore::QualifiedName*)&ontouchcancelAttr,
+        (WebCore::QualifiedName*)&ontouchendAttr,
+        (WebCore::QualifiedName*)&ontouchmoveAttr,
+        (WebCore::QualifiedName*)&ontouchstartAttr,
         (WebCore::QualifiedName*)&onunloadAttr,
         (WebCore::QualifiedName*)&onvolumechangeAttr,
         (WebCore::QualifiedName*)&onwaitingAttr,
         (WebCore::QualifiedName*)&onwebkitanimationendAttr,
         (WebCore::QualifiedName*)&onwebkitanimationiterationAttr,
         (WebCore::QualifiedName*)&onwebkitanimationstartAttr,
+        (WebCore::QualifiedName*)&onwebkitbeginfullscreenAttr,
+        (WebCore::QualifiedName*)&onwebkitendfullscreenAttr,
         (WebCore::QualifiedName*)&onwebkittransitionendAttr,
         (WebCore::QualifiedName*)&patternAttr,
         (WebCore::QualifiedName*)&placeholderAttr,
@@ -738,6 +801,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&pluginurlAttr,
         (WebCore::QualifiedName*)&posterAttr,
         (WebCore::QualifiedName*)&precisionAttr,
+        (WebCore::QualifiedName*)&preloadAttr,
         (WebCore::QualifiedName*)&primaryAttr,
         (WebCore::QualifiedName*)&profileAttr,
         (WebCore::QualifiedName*)&progressAttr,
@@ -751,6 +815,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&rowsAttr,
         (WebCore::QualifiedName*)&rowspanAttr,
         (WebCore::QualifiedName*)&rulesAttr,
+        (WebCore::QualifiedName*)&sandboxAttr,
         (WebCore::QualifiedName*)&schemeAttr,
         (WebCore::QualifiedName*)&scopeAttr,
         (WebCore::QualifiedName*)&scrollamountAttr,
@@ -766,6 +831,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&srcAttr,
         (WebCore::QualifiedName*)&standbyAttr,
         (WebCore::QualifiedName*)&startAttr,
+        (WebCore::QualifiedName*)&stepAttr,
         (WebCore::QualifiedName*)&styleAttr,
         (WebCore::QualifiedName*)&summaryAttr,
         (WebCore::QualifiedName*)&tabindexAttr,
@@ -788,15 +854,10 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&widthAttr,
         (WebCore::QualifiedName*)&wrapAttr,
     };
-    *size = 247;
+    *size = 273;
     return HTMLAttr;
 }
 
-// Tags as strings
-
-// Attributes as strings
-char classAttrString[] = "class";
-
 void init()
 {
     static bool initialized = false;
@@ -813,732 +874,403 @@ void init()
     new ((void*)&xhtmlNamespaceURI) AtomicString(xhtmlNS);
 
     // Tags
-    const char *aTagString = "a";
-    const char *abbrTagString = "abbr";
-    const char *acronymTagString = "acronym";
-    const char *addressTagString = "address";
-    const char *appletTagString = "applet";
-    const char *areaTagString = "area";
-    const char *audioTagString = "audio";
-    const char *bTagString = "b";
-    const char *baseTagString = "base";
-    const char *basefontTagString = "basefont";
-    const char *bdoTagString = "bdo";
-    const char *bigTagString = "big";
-    const char *blockquoteTagString = "blockquote";
-    const char *bodyTagString = "body";
-    const char *brTagString = "br";
-    const char *buttonTagString = "button";
-    const char *canvasTagString = "canvas";
-    const char *captionTagString = "caption";
-    const char *centerTagString = "center";
-    const char *citeTagString = "cite";
-    const char *codeTagString = "code";
-    const char *colTagString = "col";
-    const char *colgroupTagString = "colgroup";
-    const char *datagridTagString = "datagrid";
-    const char *datalistTagString = "datalist";
-    const char *dcellTagString = "dcell";
-    const char *dcolTagString = "dcol";
-    const char *ddTagString = "dd";
-    const char *delTagString = "del";
-    const char *dfnTagString = "dfn";
-    const char *dirTagString = "dir";
-    const char *divTagString = "div";
-    const char *dlTagString = "dl";
-    const char *drowTagString = "drow";
-    const char *dtTagString = "dt";
-    const char *emTagString = "em";
-    const char *embedTagString = "embed";
-    const char *fieldsetTagString = "fieldset";
-    const char *fontTagString = "font";
-    const char *formTagString = "form";
-    const char *frameTagString = "frame";
-    const char *framesetTagString = "frameset";
-    const char *h1TagString = "h1";
-    const char *h2TagString = "h2";
-    const char *h3TagString = "h3";
-    const char *h4TagString = "h4";
-    const char *h5TagString = "h5";
-    const char *h6TagString = "h6";
-    const char *headTagString = "head";
-    const char *hrTagString = "hr";
-    const char *htmlTagString = "html";
-    const char *iTagString = "i";
-    const char *iframeTagString = "iframe";
-    const char *imageTagString = "image";
-    const char *imgTagString = "img";
-    const char *inputTagString = "input";
-    const char *insTagString = "ins";
-    const char *isindexTagString = "isindex";
-    const char *kbdTagString = "kbd";
-    const char *keygenTagString = "keygen";
-    const char *labelTagString = "label";
-    const char *layerTagString = "layer";
-    const char *legendTagString = "legend";
-    const char *liTagString = "li";
-    const char *linkTagString = "link";
-    const char *listingTagString = "listing";
-    const char *mapTagString = "map";
-    const char *marqueeTagString = "marquee";
-    const char *menuTagString = "menu";
-    const char *metaTagString = "meta";
-    const char *navTagString = "nav";
-    const char *nobrTagString = "nobr";
-    const char *noembedTagString = "noembed";
-    const char *noframesTagString = "noframes";
-    const char *nolayerTagString = "nolayer";
-    const char *noscriptTagString = "noscript";
-    const char *objectTagString = "object";
-    const char *olTagString = "ol";
-    const char *optgroupTagString = "optgroup";
-    const char *optionTagString = "option";
-    const char *pTagString = "p";
-    const char *paramTagString = "param";
-    const char *plaintextTagString = "plaintext";
-    const char *preTagString = "pre";
-    const char *qTagString = "q";
-    const char *rpTagString = "rp";
-    const char *rtTagString = "rt";
-    const char *rubyTagString = "ruby";
-    const char *sTagString = "s";
-    const char *sampTagString = "samp";
-    const char *scriptTagString = "script";
-    const char *selectTagString = "select";
-    const char *smallTagString = "small";
-    const char *sourceTagString = "source";
-    const char *spanTagString = "span";
-    const char *strikeTagString = "strike";
-    const char *strongTagString = "strong";
-    const char *styleTagString = "style";
-    const char *subTagString = "sub";
-    const char *supTagString = "sup";
-    const char *tableTagString = "table";
-    const char *tbodyTagString = "tbody";
-    const char *tdTagString = "td";
-    const char *textareaTagString = "textarea";
-    const char *tfootTagString = "tfoot";
-    const char *thTagString = "th";
-    const char *theadTagString = "thead";
-    const char *titleTagString = "title";
-    const char *trTagString = "tr";
-    const char *ttTagString = "tt";
-    const char *uTagString = "u";
-    const char *ulTagString = "ul";
-    const char *varTagString = "var";
-    const char *videoTagString = "video";
-    const char *wbrTagString = "wbr";
-    const char *xmpTagString = "xmp";
-    new ((void*)&aTag) QualifiedName(nullAtom, aTagString, xhtmlNS);
-    new ((void*)&abbrTag) QualifiedName(nullAtom, abbrTagString, xhtmlNS);
-    new ((void*)&acronymTag) QualifiedName(nullAtom, acronymTagString, xhtmlNS);
-    new ((void*)&addressTag) QualifiedName(nullAtom, addressTagString, xhtmlNS);
-    new ((void*)&appletTag) QualifiedName(nullAtom, appletTagString, xhtmlNS);
-    new ((void*)&areaTag) QualifiedName(nullAtom, areaTagString, xhtmlNS);
-    new ((void*)&audioTag) QualifiedName(nullAtom, audioTagString, xhtmlNS);
-    new ((void*)&bTag) QualifiedName(nullAtom, bTagString, xhtmlNS);
-    new ((void*)&baseTag) QualifiedName(nullAtom, baseTagString, xhtmlNS);
-    new ((void*)&basefontTag) QualifiedName(nullAtom, basefontTagString, xhtmlNS);
-    new ((void*)&bdoTag) QualifiedName(nullAtom, bdoTagString, xhtmlNS);
-    new ((void*)&bigTag) QualifiedName(nullAtom, bigTagString, xhtmlNS);
-    new ((void*)&blockquoteTag) QualifiedName(nullAtom, blockquoteTagString, xhtmlNS);
-    new ((void*)&bodyTag) QualifiedName(nullAtom, bodyTagString, xhtmlNS);
-    new ((void*)&brTag) QualifiedName(nullAtom, brTagString, xhtmlNS);
-    new ((void*)&buttonTag) QualifiedName(nullAtom, buttonTagString, xhtmlNS);
-    new ((void*)&canvasTag) QualifiedName(nullAtom, canvasTagString, xhtmlNS);
-    new ((void*)&captionTag) QualifiedName(nullAtom, captionTagString, xhtmlNS);
-    new ((void*)&centerTag) QualifiedName(nullAtom, centerTagString, xhtmlNS);
-    new ((void*)&citeTag) QualifiedName(nullAtom, citeTagString, xhtmlNS);
-    new ((void*)&codeTag) QualifiedName(nullAtom, codeTagString, xhtmlNS);
-    new ((void*)&colTag) QualifiedName(nullAtom, colTagString, xhtmlNS);
-    new ((void*)&colgroupTag) QualifiedName(nullAtom, colgroupTagString, xhtmlNS);
-    new ((void*)&datagridTag) QualifiedName(nullAtom, datagridTagString, xhtmlNS);
-    new ((void*)&datalistTag) QualifiedName(nullAtom, datalistTagString, xhtmlNS);
-    new ((void*)&dcellTag) QualifiedName(nullAtom, dcellTagString, xhtmlNS);
-    new ((void*)&dcolTag) QualifiedName(nullAtom, dcolTagString, xhtmlNS);
-    new ((void*)&ddTag) QualifiedName(nullAtom, ddTagString, xhtmlNS);
-    new ((void*)&delTag) QualifiedName(nullAtom, delTagString, xhtmlNS);
-    new ((void*)&dfnTag) QualifiedName(nullAtom, dfnTagString, xhtmlNS);
-    new ((void*)&dirTag) QualifiedName(nullAtom, dirTagString, xhtmlNS);
-    new ((void*)&divTag) QualifiedName(nullAtom, divTagString, xhtmlNS);
-    new ((void*)&dlTag) QualifiedName(nullAtom, dlTagString, xhtmlNS);
-    new ((void*)&drowTag) QualifiedName(nullAtom, drowTagString, xhtmlNS);
-    new ((void*)&dtTag) QualifiedName(nullAtom, dtTagString, xhtmlNS);
-    new ((void*)&emTag) QualifiedName(nullAtom, emTagString, xhtmlNS);
-    new ((void*)&embedTag) QualifiedName(nullAtom, embedTagString, xhtmlNS);
-    new ((void*)&fieldsetTag) QualifiedName(nullAtom, fieldsetTagString, xhtmlNS);
-    new ((void*)&fontTag) QualifiedName(nullAtom, fontTagString, xhtmlNS);
-    new ((void*)&formTag) QualifiedName(nullAtom, formTagString, xhtmlNS);
-    new ((void*)&frameTag) QualifiedName(nullAtom, frameTagString, xhtmlNS);
-    new ((void*)&framesetTag) QualifiedName(nullAtom, framesetTagString, xhtmlNS);
-    new ((void*)&h1Tag) QualifiedName(nullAtom, h1TagString, xhtmlNS);
-    new ((void*)&h2Tag) QualifiedName(nullAtom, h2TagString, xhtmlNS);
-    new ((void*)&h3Tag) QualifiedName(nullAtom, h3TagString, xhtmlNS);
-    new ((void*)&h4Tag) QualifiedName(nullAtom, h4TagString, xhtmlNS);
-    new ((void*)&h5Tag) QualifiedName(nullAtom, h5TagString, xhtmlNS);
-    new ((void*)&h6Tag) QualifiedName(nullAtom, h6TagString, xhtmlNS);
-    new ((void*)&headTag) QualifiedName(nullAtom, headTagString, xhtmlNS);
-    new ((void*)&hrTag) QualifiedName(nullAtom, hrTagString, xhtmlNS);
-    new ((void*)&htmlTag) QualifiedName(nullAtom, htmlTagString, xhtmlNS);
-    new ((void*)&iTag) QualifiedName(nullAtom, iTagString, xhtmlNS);
-    new ((void*)&iframeTag) QualifiedName(nullAtom, iframeTagString, xhtmlNS);
-    new ((void*)&imageTag) QualifiedName(nullAtom, imageTagString, xhtmlNS);
-    new ((void*)&imgTag) QualifiedName(nullAtom, imgTagString, xhtmlNS);
-    new ((void*)&inputTag) QualifiedName(nullAtom, inputTagString, xhtmlNS);
-    new ((void*)&insTag) QualifiedName(nullAtom, insTagString, xhtmlNS);
-    new ((void*)&isindexTag) QualifiedName(nullAtom, isindexTagString, xhtmlNS);
-    new ((void*)&kbdTag) QualifiedName(nullAtom, kbdTagString, xhtmlNS);
-    new ((void*)&keygenTag) QualifiedName(nullAtom, keygenTagString, xhtmlNS);
-    new ((void*)&labelTag) QualifiedName(nullAtom, labelTagString, xhtmlNS);
-    new ((void*)&layerTag) QualifiedName(nullAtom, layerTagString, xhtmlNS);
-    new ((void*)&legendTag) QualifiedName(nullAtom, legendTagString, xhtmlNS);
-    new ((void*)&liTag) QualifiedName(nullAtom, liTagString, xhtmlNS);
-    new ((void*)&linkTag) QualifiedName(nullAtom, linkTagString, xhtmlNS);
-    new ((void*)&listingTag) QualifiedName(nullAtom, listingTagString, xhtmlNS);
-    new ((void*)&mapTag) QualifiedName(nullAtom, mapTagString, xhtmlNS);
-    new ((void*)&marqueeTag) QualifiedName(nullAtom, marqueeTagString, xhtmlNS);
-    new ((void*)&menuTag) QualifiedName(nullAtom, menuTagString, xhtmlNS);
-    new ((void*)&metaTag) QualifiedName(nullAtom, metaTagString, xhtmlNS);
-    new ((void*)&navTag) QualifiedName(nullAtom, navTagString, xhtmlNS);
-    new ((void*)&nobrTag) QualifiedName(nullAtom, nobrTagString, xhtmlNS);
-    new ((void*)&noembedTag) QualifiedName(nullAtom, noembedTagString, xhtmlNS);
-    new ((void*)&noframesTag) QualifiedName(nullAtom, noframesTagString, xhtmlNS);
-    new ((void*)&nolayerTag) QualifiedName(nullAtom, nolayerTagString, xhtmlNS);
-    new ((void*)&noscriptTag) QualifiedName(nullAtom, noscriptTagString, xhtmlNS);
-    new ((void*)&objectTag) QualifiedName(nullAtom, objectTagString, xhtmlNS);
-    new ((void*)&olTag) QualifiedName(nullAtom, olTagString, xhtmlNS);
-    new ((void*)&optgroupTag) QualifiedName(nullAtom, optgroupTagString, xhtmlNS);
-    new ((void*)&optionTag) QualifiedName(nullAtom, optionTagString, xhtmlNS);
-    new ((void*)&pTag) QualifiedName(nullAtom, pTagString, xhtmlNS);
-    new ((void*)&paramTag) QualifiedName(nullAtom, paramTagString, xhtmlNS);
-    new ((void*)&plaintextTag) QualifiedName(nullAtom, plaintextTagString, xhtmlNS);
-    new ((void*)&preTag) QualifiedName(nullAtom, preTagString, xhtmlNS);
-    new ((void*)&qTag) QualifiedName(nullAtom, qTagString, xhtmlNS);
-    new ((void*)&rpTag) QualifiedName(nullAtom, rpTagString, xhtmlNS);
-    new ((void*)&rtTag) QualifiedName(nullAtom, rtTagString, xhtmlNS);
-    new ((void*)&rubyTag) QualifiedName(nullAtom, rubyTagString, xhtmlNS);
-    new ((void*)&sTag) QualifiedName(nullAtom, sTagString, xhtmlNS);
-    new ((void*)&sampTag) QualifiedName(nullAtom, sampTagString, xhtmlNS);
-    new ((void*)&scriptTag) QualifiedName(nullAtom, scriptTagString, xhtmlNS);
-    new ((void*)&selectTag) QualifiedName(nullAtom, selectTagString, xhtmlNS);
-    new ((void*)&smallTag) QualifiedName(nullAtom, smallTagString, xhtmlNS);
-    new ((void*)&sourceTag) QualifiedName(nullAtom, sourceTagString, xhtmlNS);
-    new ((void*)&spanTag) QualifiedName(nullAtom, spanTagString, xhtmlNS);
-    new ((void*)&strikeTag) QualifiedName(nullAtom, strikeTagString, xhtmlNS);
-    new ((void*)&strongTag) QualifiedName(nullAtom, strongTagString, xhtmlNS);
-    new ((void*)&styleTag) QualifiedName(nullAtom, styleTagString, xhtmlNS);
-    new ((void*)&subTag) QualifiedName(nullAtom, subTagString, xhtmlNS);
-    new ((void*)&supTag) QualifiedName(nullAtom, supTagString, xhtmlNS);
-    new ((void*)&tableTag) QualifiedName(nullAtom, tableTagString, xhtmlNS);
-    new ((void*)&tbodyTag) QualifiedName(nullAtom, tbodyTagString, xhtmlNS);
-    new ((void*)&tdTag) QualifiedName(nullAtom, tdTagString, xhtmlNS);
-    new ((void*)&textareaTag) QualifiedName(nullAtom, textareaTagString, xhtmlNS);
-    new ((void*)&tfootTag) QualifiedName(nullAtom, tfootTagString, xhtmlNS);
-    new ((void*)&thTag) QualifiedName(nullAtom, thTagString, xhtmlNS);
-    new ((void*)&theadTag) QualifiedName(nullAtom, theadTagString, xhtmlNS);
-    new ((void*)&titleTag) QualifiedName(nullAtom, titleTagString, xhtmlNS);
-    new ((void*)&trTag) QualifiedName(nullAtom, trTagString, xhtmlNS);
-    new ((void*)&ttTag) QualifiedName(nullAtom, ttTagString, xhtmlNS);
-    new ((void*)&uTag) QualifiedName(nullAtom, uTagString, xhtmlNS);
-    new ((void*)&ulTag) QualifiedName(nullAtom, ulTagString, xhtmlNS);
-    new ((void*)&varTag) QualifiedName(nullAtom, varTagString, xhtmlNS);
-    new ((void*)&videoTag) QualifiedName(nullAtom, videoTagString, xhtmlNS);
-    new ((void*)&wbrTag) QualifiedName(nullAtom, wbrTagString, xhtmlNS);
-    new ((void*)&xmpTag) QualifiedName(nullAtom, xmpTagString, xhtmlNS);
+    new ((void*)&aTag) QualifiedName(nullAtom, "a", xhtmlNS);
+    new ((void*)&abbrTag) QualifiedName(nullAtom, "abbr", xhtmlNS);
+    new ((void*)&acronymTag) QualifiedName(nullAtom, "acronym", xhtmlNS);
+    new ((void*)&addressTag) QualifiedName(nullAtom, "address", xhtmlNS);
+    new ((void*)&appletTag) QualifiedName(nullAtom, "applet", xhtmlNS);
+    new ((void*)&areaTag) QualifiedName(nullAtom, "area", xhtmlNS);
+    new ((void*)&articleTag) QualifiedName(nullAtom, "article", xhtmlNS);
+    new ((void*)&asideTag) QualifiedName(nullAtom, "aside", xhtmlNS);
+    new ((void*)&audioTag) QualifiedName(nullAtom, "audio", xhtmlNS);
+    new ((void*)&bTag) QualifiedName(nullAtom, "b", xhtmlNS);
+    new ((void*)&baseTag) QualifiedName(nullAtom, "base", xhtmlNS);
+    new ((void*)&basefontTag) QualifiedName(nullAtom, "basefont", xhtmlNS);
+    new ((void*)&bdoTag) QualifiedName(nullAtom, "bdo", xhtmlNS);
+    new ((void*)&bigTag) QualifiedName(nullAtom, "big", xhtmlNS);
+    new ((void*)&blockquoteTag) QualifiedName(nullAtom, "blockquote", xhtmlNS);
+    new ((void*)&bodyTag) QualifiedName(nullAtom, "body", xhtmlNS);
+    new ((void*)&brTag) QualifiedName(nullAtom, "br", xhtmlNS);
+    new ((void*)&buttonTag) QualifiedName(nullAtom, "button", xhtmlNS);
+    new ((void*)&canvasTag) QualifiedName(nullAtom, "canvas", xhtmlNS);
+    new ((void*)&captionTag) QualifiedName(nullAtom, "caption", xhtmlNS);
+    new ((void*)&centerTag) QualifiedName(nullAtom, "center", xhtmlNS);
+    new ((void*)&citeTag) QualifiedName(nullAtom, "cite", xhtmlNS);
+    new ((void*)&codeTag) QualifiedName(nullAtom, "code", xhtmlNS);
+    new ((void*)&colTag) QualifiedName(nullAtom, "col", xhtmlNS);
+    new ((void*)&colgroupTag) QualifiedName(nullAtom, "colgroup", xhtmlNS);
+    new ((void*)&datagridTag) QualifiedName(nullAtom, "datagrid", xhtmlNS);
+    new ((void*)&datalistTag) QualifiedName(nullAtom, "datalist", xhtmlNS);
+    new ((void*)&dcellTag) QualifiedName(nullAtom, "dcell", xhtmlNS);
+    new ((void*)&dcolTag) QualifiedName(nullAtom, "dcol", xhtmlNS);
+    new ((void*)&ddTag) QualifiedName(nullAtom, "dd", xhtmlNS);
+    new ((void*)&delTag) QualifiedName(nullAtom, "del", xhtmlNS);
+    new ((void*)&dfnTag) QualifiedName(nullAtom, "dfn", xhtmlNS);
+    new ((void*)&dirTag) QualifiedName(nullAtom, "dir", xhtmlNS);
+    new ((void*)&divTag) QualifiedName(nullAtom, "div", xhtmlNS);
+    new ((void*)&dlTag) QualifiedName(nullAtom, "dl", xhtmlNS);
+    new ((void*)&drowTag) QualifiedName(nullAtom, "drow", xhtmlNS);
+    new ((void*)&dtTag) QualifiedName(nullAtom, "dt", xhtmlNS);
+    new ((void*)&emTag) QualifiedName(nullAtom, "em", xhtmlNS);
+    new ((void*)&embedTag) QualifiedName(nullAtom, "embed", xhtmlNS);
+    new ((void*)&fieldsetTag) QualifiedName(nullAtom, "fieldset", xhtmlNS);
+    new ((void*)&fontTag) QualifiedName(nullAtom, "font", xhtmlNS);
+    new ((void*)&footerTag) QualifiedName(nullAtom, "footer", xhtmlNS);
+    new ((void*)&formTag) QualifiedName(nullAtom, "form", xhtmlNS);
+    new ((void*)&frameTag) QualifiedName(nullAtom, "frame", xhtmlNS);
+    new ((void*)&framesetTag) QualifiedName(nullAtom, "frameset", xhtmlNS);
+    new ((void*)&h1Tag) QualifiedName(nullAtom, "h1", xhtmlNS);
+    new ((void*)&h2Tag) QualifiedName(nullAtom, "h2", xhtmlNS);
+    new ((void*)&h3Tag) QualifiedName(nullAtom, "h3", xhtmlNS);
+    new ((void*)&h4Tag) QualifiedName(nullAtom, "h4", xhtmlNS);
+    new ((void*)&h5Tag) QualifiedName(nullAtom, "h5", xhtmlNS);
+    new ((void*)&h6Tag) QualifiedName(nullAtom, "h6", xhtmlNS);
+    new ((void*)&headTag) QualifiedName(nullAtom, "head", xhtmlNS);
+    new ((void*)&headerTag) QualifiedName(nullAtom, "header", xhtmlNS);
+    new ((void*)&hgroupTag) QualifiedName(nullAtom, "hgroup", xhtmlNS);
+    new ((void*)&hrTag) QualifiedName(nullAtom, "hr", xhtmlNS);
+    new ((void*)&htmlTag) QualifiedName(nullAtom, "html", xhtmlNS);
+    new ((void*)&iTag) QualifiedName(nullAtom, "i", xhtmlNS);
+    new ((void*)&iframeTag) QualifiedName(nullAtom, "iframe", xhtmlNS);
+    new ((void*)&imageTag) QualifiedName(nullAtom, "image", xhtmlNS);
+    new ((void*)&imgTag) QualifiedName(nullAtom, "img", xhtmlNS);
+    new ((void*)&inputTag) QualifiedName(nullAtom, "input", xhtmlNS);
+    new ((void*)&insTag) QualifiedName(nullAtom, "ins", xhtmlNS);
+    new ((void*)&isindexTag) QualifiedName(nullAtom, "isindex", xhtmlNS);
+    new ((void*)&kbdTag) QualifiedName(nullAtom, "kbd", xhtmlNS);
+    new ((void*)&keygenTag) QualifiedName(nullAtom, "keygen", xhtmlNS);
+    new ((void*)&labelTag) QualifiedName(nullAtom, "label", xhtmlNS);
+    new ((void*)&layerTag) QualifiedName(nullAtom, "layer", xhtmlNS);
+    new ((void*)&legendTag) QualifiedName(nullAtom, "legend", xhtmlNS);
+    new ((void*)&liTag) QualifiedName(nullAtom, "li", xhtmlNS);
+    new ((void*)&linkTag) QualifiedName(nullAtom, "link", xhtmlNS);
+    new ((void*)&listingTag) QualifiedName(nullAtom, "listing", xhtmlNS);
+    new ((void*)&mapTag) QualifiedName(nullAtom, "map", xhtmlNS);
+    new ((void*)&marqueeTag) QualifiedName(nullAtom, "marquee", xhtmlNS);
+    new ((void*)&menuTag) QualifiedName(nullAtom, "menu", xhtmlNS);
+    new ((void*)&metaTag) QualifiedName(nullAtom, "meta", xhtmlNS);
+    new ((void*)&navTag) QualifiedName(nullAtom, "nav", xhtmlNS);
+    new ((void*)&nobrTag) QualifiedName(nullAtom, "nobr", xhtmlNS);
+    new ((void*)&noembedTag) QualifiedName(nullAtom, "noembed", xhtmlNS);
+    new ((void*)&noframesTag) QualifiedName(nullAtom, "noframes", xhtmlNS);
+    new ((void*)&nolayerTag) QualifiedName(nullAtom, "nolayer", xhtmlNS);
+    new ((void*)&noscriptTag) QualifiedName(nullAtom, "noscript", xhtmlNS);
+    new ((void*)&objectTag) QualifiedName(nullAtom, "object", xhtmlNS);
+    new ((void*)&olTag) QualifiedName(nullAtom, "ol", xhtmlNS);
+    new ((void*)&optgroupTag) QualifiedName(nullAtom, "optgroup", xhtmlNS);
+    new ((void*)&optionTag) QualifiedName(nullAtom, "option", xhtmlNS);
+    new ((void*)&pTag) QualifiedName(nullAtom, "p", xhtmlNS);
+    new ((void*)&paramTag) QualifiedName(nullAtom, "param", xhtmlNS);
+    new ((void*)&plaintextTag) QualifiedName(nullAtom, "plaintext", xhtmlNS);
+    new ((void*)&preTag) QualifiedName(nullAtom, "pre", xhtmlNS);
+    new ((void*)&progressTag) QualifiedName(nullAtom, "progress", xhtmlNS);
+    new ((void*)&qTag) QualifiedName(nullAtom, "q", xhtmlNS);
+    new ((void*)&rpTag) QualifiedName(nullAtom, "rp", xhtmlNS);
+    new ((void*)&rtTag) QualifiedName(nullAtom, "rt", xhtmlNS);
+    new ((void*)&rubyTag) QualifiedName(nullAtom, "ruby", xhtmlNS);
+    new ((void*)&sTag) QualifiedName(nullAtom, "s", xhtmlNS);
+    new ((void*)&sampTag) QualifiedName(nullAtom, "samp", xhtmlNS);
+    new ((void*)&scriptTag) QualifiedName(nullAtom, "script", xhtmlNS);
+    new ((void*)&sectionTag) QualifiedName(nullAtom, "section", xhtmlNS);
+    new ((void*)&selectTag) QualifiedName(nullAtom, "select", xhtmlNS);
+    new ((void*)&smallTag) QualifiedName(nullAtom, "small", xhtmlNS);
+    new ((void*)&sourceTag) QualifiedName(nullAtom, "source", xhtmlNS);
+    new ((void*)&spanTag) QualifiedName(nullAtom, "span", xhtmlNS);
+    new ((void*)&strikeTag) QualifiedName(nullAtom, "strike", xhtmlNS);
+    new ((void*)&strongTag) QualifiedName(nullAtom, "strong", xhtmlNS);
+    new ((void*)&styleTag) QualifiedName(nullAtom, "style", xhtmlNS);
+    new ((void*)&subTag) QualifiedName(nullAtom, "sub", xhtmlNS);
+    new ((void*)&supTag) QualifiedName(nullAtom, "sup", xhtmlNS);
+    new ((void*)&tableTag) QualifiedName(nullAtom, "table", xhtmlNS);
+    new ((void*)&tbodyTag) QualifiedName(nullAtom, "tbody", xhtmlNS);
+    new ((void*)&tdTag) QualifiedName(nullAtom, "td", xhtmlNS);
+    new ((void*)&textareaTag) QualifiedName(nullAtom, "textarea", xhtmlNS);
+    new ((void*)&tfootTag) QualifiedName(nullAtom, "tfoot", xhtmlNS);
+    new ((void*)&thTag) QualifiedName(nullAtom, "th", xhtmlNS);
+    new ((void*)&theadTag) QualifiedName(nullAtom, "thead", xhtmlNS);
+    new ((void*)&titleTag) QualifiedName(nullAtom, "title", xhtmlNS);
+    new ((void*)&trTag) QualifiedName(nullAtom, "tr", xhtmlNS);
+    new ((void*)&ttTag) QualifiedName(nullAtom, "tt", xhtmlNS);
+    new ((void*)&uTag) QualifiedName(nullAtom, "u", xhtmlNS);
+    new ((void*)&ulTag) QualifiedName(nullAtom, "ul", xhtmlNS);
+    new ((void*)&varTag) QualifiedName(nullAtom, "var", xhtmlNS);
+    new ((void*)&videoTag) QualifiedName(nullAtom, "video", xhtmlNS);
+    new ((void*)&wbrTag) QualifiedName(nullAtom, "wbr", xhtmlNS);
+    new ((void*)&xmpTag) QualifiedName(nullAtom, "xmp", xhtmlNS);
     // Attributes
-    const char *abbrAttrString = "abbr";
-    const char *acceptAttrString = "accept";
-    const char *accept_charsetAttrString = "accept-charset";
-    const char *accesskeyAttrString = "accesskey";
-    const char *actionAttrString = "action";
-    const char *alignAttrString = "align";
-    const char *alinkAttrString = "alink";
-    const char *altAttrString = "alt";
-    const char *archiveAttrString = "archive";
-    const char *aria_activedescendantAttrString = "aria-activedescendant";
-    const char *aria_checkedAttrString = "aria-checked";
-    const char *aria_describedbyAttrString = "aria-describedby";
-    const char *aria_disabledAttrString = "aria-disabled";
-    const char *aria_hiddenAttrString = "aria-hidden";
-    const char *aria_labelAttrString = "aria-label";
-    const char *aria_labeledbyAttrString = "aria-labeledby";
-    const char *aria_labelledbyAttrString = "aria-labelledby";
-    const char *aria_levelAttrString = "aria-level";
-    const char *aria_pressedAttrString = "aria-pressed";
-    const char *aria_readonlyAttrString = "aria-readonly";
-    const char *aria_requiredAttrString = "aria-required";
-    const char *aria_valuemaxAttrString = "aria-valuemax";
-    const char *aria_valueminAttrString = "aria-valuemin";
-    const char *aria_valuenowAttrString = "aria-valuenow";
-    const char *aria_valuetextAttrString = "aria-valuetext";
-    const char *autobufferAttrString = "autobuffer";
-    const char *autocompleteAttrString = "autocomplete";
-    const char *autofocusAttrString = "autofocus";
-    const char *autoplayAttrString = "autoplay";
-    const char *autosaveAttrString = "autosave";
-    const char *axisAttrString = "axis";
-    const char *backgroundAttrString = "background";
-    const char *behaviorAttrString = "behavior";
-    const char *bgcolorAttrString = "bgcolor";
-    const char *bgpropertiesAttrString = "bgproperties";
-    const char *borderAttrString = "border";
-    const char *bordercolorAttrString = "bordercolor";
-    const char *cellborderAttrString = "cellborder";
-    const char *cellpaddingAttrString = "cellpadding";
-    const char *cellspacingAttrString = "cellspacing";
-    const char *challengeAttrString = "challenge";
-    const char *charAttrString = "char";
-    const char *charoffAttrString = "charoff";
-    const char *charsetAttrString = "charset";
-    const char *checkedAttrString = "checked";
-    const char *citeAttrString = "cite";
-    const char *classidAttrString = "classid";
-    const char *clearAttrString = "clear";
-    const char *codeAttrString = "code";
-    const char *codebaseAttrString = "codebase";
-    const char *codetypeAttrString = "codetype";
-    const char *colorAttrString = "color";
-    const char *colsAttrString = "cols";
-    const char *colspanAttrString = "colspan";
-    const char *compactAttrString = "compact";
-    const char *compositeAttrString = "composite";
-    const char *contentAttrString = "content";
-    const char *contenteditableAttrString = "contenteditable";
-    const char *controlsAttrString = "controls";
-    const char *coordsAttrString = "coords";
-    const char *dataAttrString = "data";
-    const char *datetimeAttrString = "datetime";
-    const char *declareAttrString = "declare";
-    const char *deferAttrString = "defer";
-    const char *dirAttrString = "dir";
-    const char *directionAttrString = "direction";
-    const char *disabledAttrString = "disabled";
-    const char *draggableAttrString = "draggable";
-    const char *enctypeAttrString = "enctype";
-    const char *endAttrString = "end";
-    const char *expandedAttrString = "expanded";
-    const char *faceAttrString = "face";
-    const char *focusedAttrString = "focused";
-    const char *forAttrString = "for";
-    const char *formnovalidateAttrString = "formnovalidate";
-    const char *frameAttrString = "frame";
-    const char *frameborderAttrString = "frameborder";
-    const char *headersAttrString = "headers";
-    const char *heightAttrString = "height";
-    const char *hiddenAttrString = "hidden";
-    const char *hrefAttrString = "href";
-    const char *hreflangAttrString = "hreflang";
-    const char *hspaceAttrString = "hspace";
-    const char *http_equivAttrString = "http-equiv";
-    const char *idAttrString = "id";
-    const char *incrementalAttrString = "incremental";
-    const char *indeterminateAttrString = "indeterminate";
-    const char *ismapAttrString = "ismap";
-    const char *keytypeAttrString = "keytype";
-    const char *labelAttrString = "label";
-    const char *langAttrString = "lang";
-    const char *languageAttrString = "language";
-    const char *leftmarginAttrString = "leftmargin";
-    const char *linkAttrString = "link";
-    const char *listAttrString = "list";
-    const char *longdescAttrString = "longdesc";
-    const char *loopAttrString = "loop";
-    const char *loopendAttrString = "loopend";
-    const char *loopstartAttrString = "loopstart";
-    const char *lowsrcAttrString = "lowsrc";
-    const char *manifestAttrString = "manifest";
-    const char *marginheightAttrString = "marginheight";
-    const char *marginwidthAttrString = "marginwidth";
-    const char *maxAttrString = "max";
-    const char *maxlengthAttrString = "maxlength";
-    const char *mayscriptAttrString = "mayscript";
-    const char *mediaAttrString = "media";
-    const char *methodAttrString = "method";
-    const char *minAttrString = "min";
-    const char *multipleAttrString = "multiple";
-    const char *nameAttrString = "name";
-    const char *nohrefAttrString = "nohref";
-    const char *noresizeAttrString = "noresize";
-    const char *noshadeAttrString = "noshade";
-    const char *novalidateAttrString = "novalidate";
-    const char *nowrapAttrString = "nowrap";
-    const char *objectAttrString = "object";
-    const char *onabortAttrString = "onabort";
-    const char *onbeforecopyAttrString = "onbeforecopy";
-    const char *onbeforecutAttrString = "onbeforecut";
-    const char *onbeforeloadAttrString = "onbeforeload";
-    const char *onbeforepasteAttrString = "onbeforepaste";
-    const char *onbeforeunloadAttrString = "onbeforeunload";
-    const char *onblurAttrString = "onblur";
-    const char *oncanplayAttrString = "oncanplay";
-    const char *oncanplaythroughAttrString = "oncanplaythrough";
-    const char *onchangeAttrString = "onchange";
-    const char *onclickAttrString = "onclick";
-    const char *oncontextmenuAttrString = "oncontextmenu";
-    const char *oncopyAttrString = "oncopy";
-    const char *oncutAttrString = "oncut";
-    const char *ondblclickAttrString = "ondblclick";
-    const char *ondragAttrString = "ondrag";
-    const char *ondragendAttrString = "ondragend";
-    const char *ondragenterAttrString = "ondragenter";
-    const char *ondragleaveAttrString = "ondragleave";
-    const char *ondragoverAttrString = "ondragover";
-    const char *ondragstartAttrString = "ondragstart";
-    const char *ondropAttrString = "ondrop";
-    const char *ondurationchangeAttrString = "ondurationchange";
-    const char *onemptiedAttrString = "onemptied";
-    const char *onendedAttrString = "onended";
-    const char *onerrorAttrString = "onerror";
-    const char *onfocusAttrString = "onfocus";
-    const char *onhashchangeAttrString = "onhashchange";
-    const char *oninputAttrString = "oninput";
-    const char *oninvalidAttrString = "oninvalid";
-    const char *onkeydownAttrString = "onkeydown";
-    const char *onkeypressAttrString = "onkeypress";
-    const char *onkeyupAttrString = "onkeyup";
-    const char *onloadAttrString = "onload";
-    const char *onloadeddataAttrString = "onloadeddata";
-    const char *onloadedmetadataAttrString = "onloadedmetadata";
-    const char *onloadstartAttrString = "onloadstart";
-    const char *onmousedownAttrString = "onmousedown";
-    const char *onmousemoveAttrString = "onmousemove";
-    const char *onmouseoutAttrString = "onmouseout";
-    const char *onmouseoverAttrString = "onmouseover";
-    const char *onmouseupAttrString = "onmouseup";
-    const char *onmousewheelAttrString = "onmousewheel";
-    const char *onofflineAttrString = "onoffline";
-    const char *ononlineAttrString = "ononline";
-    const char *onorientationchangeAttrString = "onorientationchange";
-    const char *onpagehideAttrString = "onpagehide";
-    const char *onpageshowAttrString = "onpageshow";
-    const char *onpasteAttrString = "onpaste";
-    const char *onpauseAttrString = "onpause";
-    const char *onplayAttrString = "onplay";
-    const char *onplayingAttrString = "onplaying";
-    const char *onprogressAttrString = "onprogress";
-    const char *onratechangeAttrString = "onratechange";
-    const char *onresetAttrString = "onreset";
-    const char *onresizeAttrString = "onresize";
-    const char *onscrollAttrString = "onscroll";
-    const char *onsearchAttrString = "onsearch";
-    const char *onseekedAttrString = "onseeked";
-    const char *onseekingAttrString = "onseeking";
-    const char *onselectAttrString = "onselect";
-    const char *onselectstartAttrString = "onselectstart";
-    const char *onstalledAttrString = "onstalled";
-    const char *onstorageAttrString = "onstorage";
-    const char *onsubmitAttrString = "onsubmit";
-    const char *onsuspendAttrString = "onsuspend";
-    const char *ontimeupdateAttrString = "ontimeupdate";
-    const char *onunloadAttrString = "onunload";
-    const char *onvolumechangeAttrString = "onvolumechange";
-    const char *onwaitingAttrString = "onwaiting";
-    const char *onwebkitanimationendAttrString = "onwebkitanimationend";
-    const char *onwebkitanimationiterationAttrString = "onwebkitanimationiteration";
-    const char *onwebkitanimationstartAttrString = "onwebkitanimationstart";
-    const char *onwebkittransitionendAttrString = "onwebkittransitionend";
-    const char *patternAttrString = "pattern";
-    const char *placeholderAttrString = "placeholder";
-    const char *playcountAttrString = "playcount";
-    const char *pluginurlAttrString = "pluginurl";
-    const char *posterAttrString = "poster";
-    const char *precisionAttrString = "precision";
-    const char *primaryAttrString = "primary";
-    const char *profileAttrString = "profile";
-    const char *progressAttrString = "progress";
-    const char *promptAttrString = "prompt";
-    const char *readonlyAttrString = "readonly";
-    const char *relAttrString = "rel";
-    const char *requiredAttrString = "required";
-    const char *resultsAttrString = "results";
-    const char *revAttrString = "rev";
-    const char *roleAttrString = "role";
-    const char *rowsAttrString = "rows";
-    const char *rowspanAttrString = "rowspan";
-    const char *rulesAttrString = "rules";
-    const char *schemeAttrString = "scheme";
-    const char *scopeAttrString = "scope";
-    const char *scrollamountAttrString = "scrollamount";
-    const char *scrolldelayAttrString = "scrolldelay";
-    const char *scrollingAttrString = "scrolling";
-    const char *selectedAttrString = "selected";
-    const char *shapeAttrString = "shape";
-    const char *sizeAttrString = "size";
-    const char *sortableAttrString = "sortable";
-    const char *sortdirectionAttrString = "sortdirection";
-    const char *spanAttrString = "span";
-    const char *spellcheckAttrString = "spellcheck";
-    const char *srcAttrString = "src";
-    const char *standbyAttrString = "standby";
-    const char *startAttrString = "start";
-    const char *styleAttrString = "style";
-    const char *summaryAttrString = "summary";
-    const char *tabindexAttrString = "tabindex";
-    const char *tableborderAttrString = "tableborder";
-    const char *targetAttrString = "target";
-    const char *textAttrString = "text";
-    const char *titleAttrString = "title";
-    const char *topAttrString = "top";
-    const char *topmarginAttrString = "topmargin";
-    const char *truespeedAttrString = "truespeed";
-    const char *typeAttrString = "type";
-    const char *usemapAttrString = "usemap";
-    const char *valignAttrString = "valign";
-    const char *valueAttrString = "value";
-    const char *valuetypeAttrString = "valuetype";
-    const char *versionAttrString = "version";
-    const char *viewsourceAttrString = "viewsource";
-    const char *vlinkAttrString = "vlink";
-    const char *vspaceAttrString = "vspace";
-    const char *widthAttrString = "width";
-    const char *wrapAttrString = "wrap";
-    new ((void*)&abbrAttr) QualifiedName(nullAtom, abbrAttrString, nullAtom);
-    new ((void*)&acceptAttr) QualifiedName(nullAtom, acceptAttrString, nullAtom);
-    new ((void*)&accept_charsetAttr) QualifiedName(nullAtom, accept_charsetAttrString, nullAtom);
-    new ((void*)&accesskeyAttr) QualifiedName(nullAtom, accesskeyAttrString, nullAtom);
-    new ((void*)&actionAttr) QualifiedName(nullAtom, actionAttrString, nullAtom);
-    new ((void*)&alignAttr) QualifiedName(nullAtom, alignAttrString, nullAtom);
-    new ((void*)&alinkAttr) QualifiedName(nullAtom, alinkAttrString, nullAtom);
-    new ((void*)&altAttr) QualifiedName(nullAtom, altAttrString, nullAtom);
-    new ((void*)&archiveAttr) QualifiedName(nullAtom, archiveAttrString, nullAtom);
-    new ((void*)&aria_activedescendantAttr) QualifiedName(nullAtom, aria_activedescendantAttrString, nullAtom);
-    new ((void*)&aria_checkedAttr) QualifiedName(nullAtom, aria_checkedAttrString, nullAtom);
-    new ((void*)&aria_describedbyAttr) QualifiedName(nullAtom, aria_describedbyAttrString, nullAtom);
-    new ((void*)&aria_disabledAttr) QualifiedName(nullAtom, aria_disabledAttrString, nullAtom);
-    new ((void*)&aria_hiddenAttr) QualifiedName(nullAtom, aria_hiddenAttrString, nullAtom);
-    new ((void*)&aria_labelAttr) QualifiedName(nullAtom, aria_labelAttrString, nullAtom);
-    new ((void*)&aria_labeledbyAttr) QualifiedName(nullAtom, aria_labeledbyAttrString, nullAtom);
-    new ((void*)&aria_labelledbyAttr) QualifiedName(nullAtom, aria_labelledbyAttrString, nullAtom);
-    new ((void*)&aria_levelAttr) QualifiedName(nullAtom, aria_levelAttrString, nullAtom);
-    new ((void*)&aria_pressedAttr) QualifiedName(nullAtom, aria_pressedAttrString, nullAtom);
-    new ((void*)&aria_readonlyAttr) QualifiedName(nullAtom, aria_readonlyAttrString, nullAtom);
-    new ((void*)&aria_requiredAttr) QualifiedName(nullAtom, aria_requiredAttrString, nullAtom);
-    new ((void*)&aria_valuemaxAttr) QualifiedName(nullAtom, aria_valuemaxAttrString, nullAtom);
-    new ((void*)&aria_valueminAttr) QualifiedName(nullAtom, aria_valueminAttrString, nullAtom);
-    new ((void*)&aria_valuenowAttr) QualifiedName(nullAtom, aria_valuenowAttrString, nullAtom);
-    new ((void*)&aria_valuetextAttr) QualifiedName(nullAtom, aria_valuetextAttrString, nullAtom);
-    new ((void*)&autobufferAttr) QualifiedName(nullAtom, autobufferAttrString, nullAtom);
-    new ((void*)&autocompleteAttr) QualifiedName(nullAtom, autocompleteAttrString, nullAtom);
-    new ((void*)&autofocusAttr) QualifiedName(nullAtom, autofocusAttrString, nullAtom);
-    new ((void*)&autoplayAttr) QualifiedName(nullAtom, autoplayAttrString, nullAtom);
-    new ((void*)&autosaveAttr) QualifiedName(nullAtom, autosaveAttrString, nullAtom);
-    new ((void*)&axisAttr) QualifiedName(nullAtom, axisAttrString, nullAtom);
-    new ((void*)&backgroundAttr) QualifiedName(nullAtom, backgroundAttrString, nullAtom);
-    new ((void*)&behaviorAttr) QualifiedName(nullAtom, behaviorAttrString, nullAtom);
-    new ((void*)&bgcolorAttr) QualifiedName(nullAtom, bgcolorAttrString, nullAtom);
-    new ((void*)&bgpropertiesAttr) QualifiedName(nullAtom, bgpropertiesAttrString, nullAtom);
-    new ((void*)&borderAttr) QualifiedName(nullAtom, borderAttrString, nullAtom);
-    new ((void*)&bordercolorAttr) QualifiedName(nullAtom, bordercolorAttrString, nullAtom);
-    new ((void*)&cellborderAttr) QualifiedName(nullAtom, cellborderAttrString, nullAtom);
-    new ((void*)&cellpaddingAttr) QualifiedName(nullAtom, cellpaddingAttrString, nullAtom);
-    new ((void*)&cellspacingAttr) QualifiedName(nullAtom, cellspacingAttrString, nullAtom);
-    new ((void*)&challengeAttr) QualifiedName(nullAtom, challengeAttrString, nullAtom);
-    new ((void*)&charAttr) QualifiedName(nullAtom, charAttrString, nullAtom);
-    new ((void*)&charoffAttr) QualifiedName(nullAtom, charoffAttrString, nullAtom);
-    new ((void*)&charsetAttr) QualifiedName(nullAtom, charsetAttrString, nullAtom);
-    new ((void*)&checkedAttr) QualifiedName(nullAtom, checkedAttrString, nullAtom);
-    new ((void*)&citeAttr) QualifiedName(nullAtom, citeAttrString, nullAtom);
-    new ((void*)&classAttr) QualifiedName(nullAtom, classAttrString, nullAtom);
-    new ((void*)&classidAttr) QualifiedName(nullAtom, classidAttrString, nullAtom);
-    new ((void*)&clearAttr) QualifiedName(nullAtom, clearAttrString, nullAtom);
-    new ((void*)&codeAttr) QualifiedName(nullAtom, codeAttrString, nullAtom);
-    new ((void*)&codebaseAttr) QualifiedName(nullAtom, codebaseAttrString, nullAtom);
-    new ((void*)&codetypeAttr) QualifiedName(nullAtom, codetypeAttrString, nullAtom);
-    new ((void*)&colorAttr) QualifiedName(nullAtom, colorAttrString, nullAtom);
-    new ((void*)&colsAttr) QualifiedName(nullAtom, colsAttrString, nullAtom);
-    new ((void*)&colspanAttr) QualifiedName(nullAtom, colspanAttrString, nullAtom);
-    new ((void*)&compactAttr) QualifiedName(nullAtom, compactAttrString, nullAtom);
-    new ((void*)&compositeAttr) QualifiedName(nullAtom, compositeAttrString, nullAtom);
-    new ((void*)&contentAttr) QualifiedName(nullAtom, contentAttrString, nullAtom);
-    new ((void*)&contenteditableAttr) QualifiedName(nullAtom, contenteditableAttrString, nullAtom);
-    new ((void*)&controlsAttr) QualifiedName(nullAtom, controlsAttrString, nullAtom);
-    new ((void*)&coordsAttr) QualifiedName(nullAtom, coordsAttrString, nullAtom);
-    new ((void*)&dataAttr) QualifiedName(nullAtom, dataAttrString, nullAtom);
-    new ((void*)&datetimeAttr) QualifiedName(nullAtom, datetimeAttrString, nullAtom);
-    new ((void*)&declareAttr) QualifiedName(nullAtom, declareAttrString, nullAtom);
-    new ((void*)&deferAttr) QualifiedName(nullAtom, deferAttrString, nullAtom);
-    new ((void*)&dirAttr) QualifiedName(nullAtom, dirAttrString, nullAtom);
-    new ((void*)&directionAttr) QualifiedName(nullAtom, directionAttrString, nullAtom);
-    new ((void*)&disabledAttr) QualifiedName(nullAtom, disabledAttrString, nullAtom);
-    new ((void*)&draggableAttr) QualifiedName(nullAtom, draggableAttrString, nullAtom);
-    new ((void*)&enctypeAttr) QualifiedName(nullAtom, enctypeAttrString, nullAtom);
-    new ((void*)&endAttr) QualifiedName(nullAtom, endAttrString, nullAtom);
-    new ((void*)&expandedAttr) QualifiedName(nullAtom, expandedAttrString, nullAtom);
-    new ((void*)&faceAttr) QualifiedName(nullAtom, faceAttrString, nullAtom);
-    new ((void*)&focusedAttr) QualifiedName(nullAtom, focusedAttrString, nullAtom);
-    new ((void*)&forAttr) QualifiedName(nullAtom, forAttrString, nullAtom);
-    new ((void*)&formnovalidateAttr) QualifiedName(nullAtom, formnovalidateAttrString, nullAtom);
-    new ((void*)&frameAttr) QualifiedName(nullAtom, frameAttrString, nullAtom);
-    new ((void*)&frameborderAttr) QualifiedName(nullAtom, frameborderAttrString, nullAtom);
-    new ((void*)&headersAttr) QualifiedName(nullAtom, headersAttrString, nullAtom);
-    new ((void*)&heightAttr) QualifiedName(nullAtom, heightAttrString, nullAtom);
-    new ((void*)&hiddenAttr) QualifiedName(nullAtom, hiddenAttrString, nullAtom);
-    new ((void*)&hrefAttr) QualifiedName(nullAtom, hrefAttrString, nullAtom);
-    new ((void*)&hreflangAttr) QualifiedName(nullAtom, hreflangAttrString, nullAtom);
-    new ((void*)&hspaceAttr) QualifiedName(nullAtom, hspaceAttrString, nullAtom);
-    new ((void*)&http_equivAttr) QualifiedName(nullAtom, http_equivAttrString, nullAtom);
-    new ((void*)&idAttr) QualifiedName(nullAtom, idAttrString, nullAtom);
-    new ((void*)&incrementalAttr) QualifiedName(nullAtom, incrementalAttrString, nullAtom);
-    new ((void*)&indeterminateAttr) QualifiedName(nullAtom, indeterminateAttrString, nullAtom);
-    new ((void*)&ismapAttr) QualifiedName(nullAtom, ismapAttrString, nullAtom);
-    new ((void*)&keytypeAttr) QualifiedName(nullAtom, keytypeAttrString, nullAtom);
-    new ((void*)&labelAttr) QualifiedName(nullAtom, labelAttrString, nullAtom);
-    new ((void*)&langAttr) QualifiedName(nullAtom, langAttrString, nullAtom);
-    new ((void*)&languageAttr) QualifiedName(nullAtom, languageAttrString, nullAtom);
-    new ((void*)&leftmarginAttr) QualifiedName(nullAtom, leftmarginAttrString, nullAtom);
-    new ((void*)&linkAttr) QualifiedName(nullAtom, linkAttrString, nullAtom);
-    new ((void*)&listAttr) QualifiedName(nullAtom, listAttrString, nullAtom);
-    new ((void*)&longdescAttr) QualifiedName(nullAtom, longdescAttrString, nullAtom);
-    new ((void*)&loopAttr) QualifiedName(nullAtom, loopAttrString, nullAtom);
-    new ((void*)&loopendAttr) QualifiedName(nullAtom, loopendAttrString, nullAtom);
-    new ((void*)&loopstartAttr) QualifiedName(nullAtom, loopstartAttrString, nullAtom);
-    new ((void*)&lowsrcAttr) QualifiedName(nullAtom, lowsrcAttrString, nullAtom);
-    new ((void*)&manifestAttr) QualifiedName(nullAtom, manifestAttrString, nullAtom);
-    new ((void*)&marginheightAttr) QualifiedName(nullAtom, marginheightAttrString, nullAtom);
-    new ((void*)&marginwidthAttr) QualifiedName(nullAtom, marginwidthAttrString, nullAtom);
-    new ((void*)&maxAttr) QualifiedName(nullAtom, maxAttrString, nullAtom);
-    new ((void*)&maxlengthAttr) QualifiedName(nullAtom, maxlengthAttrString, nullAtom);
-    new ((void*)&mayscriptAttr) QualifiedName(nullAtom, mayscriptAttrString, nullAtom);
-    new ((void*)&mediaAttr) QualifiedName(nullAtom, mediaAttrString, nullAtom);
-    new ((void*)&methodAttr) QualifiedName(nullAtom, methodAttrString, nullAtom);
-    new ((void*)&minAttr) QualifiedName(nullAtom, minAttrString, nullAtom);
-    new ((void*)&multipleAttr) QualifiedName(nullAtom, multipleAttrString, nullAtom);
-    new ((void*)&nameAttr) QualifiedName(nullAtom, nameAttrString, nullAtom);
-    new ((void*)&nohrefAttr) QualifiedName(nullAtom, nohrefAttrString, nullAtom);
-    new ((void*)&noresizeAttr) QualifiedName(nullAtom, noresizeAttrString, nullAtom);
-    new ((void*)&noshadeAttr) QualifiedName(nullAtom, noshadeAttrString, nullAtom);
-    new ((void*)&novalidateAttr) QualifiedName(nullAtom, novalidateAttrString, nullAtom);
-    new ((void*)&nowrapAttr) QualifiedName(nullAtom, nowrapAttrString, nullAtom);
-    new ((void*)&objectAttr) QualifiedName(nullAtom, objectAttrString, nullAtom);
-    new ((void*)&onabortAttr) QualifiedName(nullAtom, onabortAttrString, nullAtom);
-    new ((void*)&onbeforecopyAttr) QualifiedName(nullAtom, onbeforecopyAttrString, nullAtom);
-    new ((void*)&onbeforecutAttr) QualifiedName(nullAtom, onbeforecutAttrString, nullAtom);
-    new ((void*)&onbeforeloadAttr) QualifiedName(nullAtom, onbeforeloadAttrString, nullAtom);
-    new ((void*)&onbeforepasteAttr) QualifiedName(nullAtom, onbeforepasteAttrString, nullAtom);
-    new ((void*)&onbeforeunloadAttr) QualifiedName(nullAtom, onbeforeunloadAttrString, nullAtom);
-    new ((void*)&onblurAttr) QualifiedName(nullAtom, onblurAttrString, nullAtom);
-    new ((void*)&oncanplayAttr) QualifiedName(nullAtom, oncanplayAttrString, nullAtom);
-    new ((void*)&oncanplaythroughAttr) QualifiedName(nullAtom, oncanplaythroughAttrString, nullAtom);
-    new ((void*)&onchangeAttr) QualifiedName(nullAtom, onchangeAttrString, nullAtom);
-    new ((void*)&onclickAttr) QualifiedName(nullAtom, onclickAttrString, nullAtom);
-    new ((void*)&oncontextmenuAttr) QualifiedName(nullAtom, oncontextmenuAttrString, nullAtom);
-    new ((void*)&oncopyAttr) QualifiedName(nullAtom, oncopyAttrString, nullAtom);
-    new ((void*)&oncutAttr) QualifiedName(nullAtom, oncutAttrString, nullAtom);
-    new ((void*)&ondblclickAttr) QualifiedName(nullAtom, ondblclickAttrString, nullAtom);
-    new ((void*)&ondragAttr) QualifiedName(nullAtom, ondragAttrString, nullAtom);
-    new ((void*)&ondragendAttr) QualifiedName(nullAtom, ondragendAttrString, nullAtom);
-    new ((void*)&ondragenterAttr) QualifiedName(nullAtom, ondragenterAttrString, nullAtom);
-    new ((void*)&ondragleaveAttr) QualifiedName(nullAtom, ondragleaveAttrString, nullAtom);
-    new ((void*)&ondragoverAttr) QualifiedName(nullAtom, ondragoverAttrString, nullAtom);
-    new ((void*)&ondragstartAttr) QualifiedName(nullAtom, ondragstartAttrString, nullAtom);
-    new ((void*)&ondropAttr) QualifiedName(nullAtom, ondropAttrString, nullAtom);
-    new ((void*)&ondurationchangeAttr) QualifiedName(nullAtom, ondurationchangeAttrString, nullAtom);
-    new ((void*)&onemptiedAttr) QualifiedName(nullAtom, onemptiedAttrString, nullAtom);
-    new ((void*)&onendedAttr) QualifiedName(nullAtom, onendedAttrString, nullAtom);
-    new ((void*)&onerrorAttr) QualifiedName(nullAtom, onerrorAttrString, nullAtom);
-    new ((void*)&onfocusAttr) QualifiedName(nullAtom, onfocusAttrString, nullAtom);
-    new ((void*)&onhashchangeAttr) QualifiedName(nullAtom, onhashchangeAttrString, nullAtom);
-    new ((void*)&oninputAttr) QualifiedName(nullAtom, oninputAttrString, nullAtom);
-    new ((void*)&oninvalidAttr) QualifiedName(nullAtom, oninvalidAttrString, nullAtom);
-    new ((void*)&onkeydownAttr) QualifiedName(nullAtom, onkeydownAttrString, nullAtom);
-    new ((void*)&onkeypressAttr) QualifiedName(nullAtom, onkeypressAttrString, nullAtom);
-    new ((void*)&onkeyupAttr) QualifiedName(nullAtom, onkeyupAttrString, nullAtom);
-    new ((void*)&onloadAttr) QualifiedName(nullAtom, onloadAttrString, nullAtom);
-    new ((void*)&onloadeddataAttr) QualifiedName(nullAtom, onloadeddataAttrString, nullAtom);
-    new ((void*)&onloadedmetadataAttr) QualifiedName(nullAtom, onloadedmetadataAttrString, nullAtom);
-    new ((void*)&onloadstartAttr) QualifiedName(nullAtom, onloadstartAttrString, nullAtom);
-    new ((void*)&onmousedownAttr) QualifiedName(nullAtom, onmousedownAttrString, nullAtom);
-    new ((void*)&onmousemoveAttr) QualifiedName(nullAtom, onmousemoveAttrString, nullAtom);
-    new ((void*)&onmouseoutAttr) QualifiedName(nullAtom, onmouseoutAttrString, nullAtom);
-    new ((void*)&onmouseoverAttr) QualifiedName(nullAtom, onmouseoverAttrString, nullAtom);
-    new ((void*)&onmouseupAttr) QualifiedName(nullAtom, onmouseupAttrString, nullAtom);
-    new ((void*)&onmousewheelAttr) QualifiedName(nullAtom, onmousewheelAttrString, nullAtom);
-    new ((void*)&onofflineAttr) QualifiedName(nullAtom, onofflineAttrString, nullAtom);
-    new ((void*)&ononlineAttr) QualifiedName(nullAtom, ononlineAttrString, nullAtom);
-    new ((void*)&onorientationchangeAttr) QualifiedName(nullAtom, onorientationchangeAttrString, nullAtom);
-    new ((void*)&onpagehideAttr) QualifiedName(nullAtom, onpagehideAttrString, nullAtom);
-    new ((void*)&onpageshowAttr) QualifiedName(nullAtom, onpageshowAttrString, nullAtom);
-    new ((void*)&onpasteAttr) QualifiedName(nullAtom, onpasteAttrString, nullAtom);
-    new ((void*)&onpauseAttr) QualifiedName(nullAtom, onpauseAttrString, nullAtom);
-    new ((void*)&onplayAttr) QualifiedName(nullAtom, onplayAttrString, nullAtom);
-    new ((void*)&onplayingAttr) QualifiedName(nullAtom, onplayingAttrString, nullAtom);
-    new ((void*)&onprogressAttr) QualifiedName(nullAtom, onprogressAttrString, nullAtom);
-    new ((void*)&onratechangeAttr) QualifiedName(nullAtom, onratechangeAttrString, nullAtom);
-    new ((void*)&onresetAttr) QualifiedName(nullAtom, onresetAttrString, nullAtom);
-    new ((void*)&onresizeAttr) QualifiedName(nullAtom, onresizeAttrString, nullAtom);
-    new ((void*)&onscrollAttr) QualifiedName(nullAtom, onscrollAttrString, nullAtom);
-    new ((void*)&onsearchAttr) QualifiedName(nullAtom, onsearchAttrString, nullAtom);
-    new ((void*)&onseekedAttr) QualifiedName(nullAtom, onseekedAttrString, nullAtom);
-    new ((void*)&onseekingAttr) QualifiedName(nullAtom, onseekingAttrString, nullAtom);
-    new ((void*)&onselectAttr) QualifiedName(nullAtom, onselectAttrString, nullAtom);
-    new ((void*)&onselectstartAttr) QualifiedName(nullAtom, onselectstartAttrString, nullAtom);
-    new ((void*)&onstalledAttr) QualifiedName(nullAtom, onstalledAttrString, nullAtom);
-    new ((void*)&onstorageAttr) QualifiedName(nullAtom, onstorageAttrString, nullAtom);
-    new ((void*)&onsubmitAttr) QualifiedName(nullAtom, onsubmitAttrString, nullAtom);
-    new ((void*)&onsuspendAttr) QualifiedName(nullAtom, onsuspendAttrString, nullAtom);
-    new ((void*)&ontimeupdateAttr) QualifiedName(nullAtom, ontimeupdateAttrString, nullAtom);
-    new ((void*)&onunloadAttr) QualifiedName(nullAtom, onunloadAttrString, nullAtom);
-    new ((void*)&onvolumechangeAttr) QualifiedName(nullAtom, onvolumechangeAttrString, nullAtom);
-    new ((void*)&onwaitingAttr) QualifiedName(nullAtom, onwaitingAttrString, nullAtom);
-    new ((void*)&onwebkitanimationendAttr) QualifiedName(nullAtom, onwebkitanimationendAttrString, nullAtom);
-    new ((void*)&onwebkitanimationiterationAttr) QualifiedName(nullAtom, onwebkitanimationiterationAttrString, nullAtom);
-    new ((void*)&onwebkitanimationstartAttr) QualifiedName(nullAtom, onwebkitanimationstartAttrString, nullAtom);
-    new ((void*)&onwebkittransitionendAttr) QualifiedName(nullAtom, onwebkittransitionendAttrString, nullAtom);
-    new ((void*)&patternAttr) QualifiedName(nullAtom, patternAttrString, nullAtom);
-    new ((void*)&placeholderAttr) QualifiedName(nullAtom, placeholderAttrString, nullAtom);
-    new ((void*)&playcountAttr) QualifiedName(nullAtom, playcountAttrString, nullAtom);
-    new ((void*)&pluginurlAttr) QualifiedName(nullAtom, pluginurlAttrString, nullAtom);
-    new ((void*)&posterAttr) QualifiedName(nullAtom, posterAttrString, nullAtom);
-    new ((void*)&precisionAttr) QualifiedName(nullAtom, precisionAttrString, nullAtom);
-    new ((void*)&primaryAttr) QualifiedName(nullAtom, primaryAttrString, nullAtom);
-    new ((void*)&profileAttr) QualifiedName(nullAtom, profileAttrString, nullAtom);
-    new ((void*)&progressAttr) QualifiedName(nullAtom, progressAttrString, nullAtom);
-    new ((void*)&promptAttr) QualifiedName(nullAtom, promptAttrString, nullAtom);
-    new ((void*)&readonlyAttr) QualifiedName(nullAtom, readonlyAttrString, nullAtom);
-    new ((void*)&relAttr) QualifiedName(nullAtom, relAttrString, nullAtom);
-    new ((void*)&requiredAttr) QualifiedName(nullAtom, requiredAttrString, nullAtom);
-    new ((void*)&resultsAttr) QualifiedName(nullAtom, resultsAttrString, nullAtom);
-    new ((void*)&revAttr) QualifiedName(nullAtom, revAttrString, nullAtom);
-    new ((void*)&roleAttr) QualifiedName(nullAtom, roleAttrString, nullAtom);
-    new ((void*)&rowsAttr) QualifiedName(nullAtom, rowsAttrString, nullAtom);
-    new ((void*)&rowspanAttr) QualifiedName(nullAtom, rowspanAttrString, nullAtom);
-    new ((void*)&rulesAttr) QualifiedName(nullAtom, rulesAttrString, nullAtom);
-    new ((void*)&schemeAttr) QualifiedName(nullAtom, schemeAttrString, nullAtom);
-    new ((void*)&scopeAttr) QualifiedName(nullAtom, scopeAttrString, nullAtom);
-    new ((void*)&scrollamountAttr) QualifiedName(nullAtom, scrollamountAttrString, nullAtom);
-    new ((void*)&scrolldelayAttr) QualifiedName(nullAtom, scrolldelayAttrString, nullAtom);
-    new ((void*)&scrollingAttr) QualifiedName(nullAtom, scrollingAttrString, nullAtom);
-    new ((void*)&selectedAttr) QualifiedName(nullAtom, selectedAttrString, nullAtom);
-    new ((void*)&shapeAttr) QualifiedName(nullAtom, shapeAttrString, nullAtom);
-    new ((void*)&sizeAttr) QualifiedName(nullAtom, sizeAttrString, nullAtom);
-    new ((void*)&sortableAttr) QualifiedName(nullAtom, sortableAttrString, nullAtom);
-    new ((void*)&sortdirectionAttr) QualifiedName(nullAtom, sortdirectionAttrString, nullAtom);
-    new ((void*)&spanAttr) QualifiedName(nullAtom, spanAttrString, nullAtom);
-    new ((void*)&spellcheckAttr) QualifiedName(nullAtom, spellcheckAttrString, nullAtom);
-    new ((void*)&srcAttr) QualifiedName(nullAtom, srcAttrString, nullAtom);
-    new ((void*)&standbyAttr) QualifiedName(nullAtom, standbyAttrString, nullAtom);
-    new ((void*)&startAttr) QualifiedName(nullAtom, startAttrString, nullAtom);
-    new ((void*)&styleAttr) QualifiedName(nullAtom, styleAttrString, nullAtom);
-    new ((void*)&summaryAttr) QualifiedName(nullAtom, summaryAttrString, nullAtom);
-    new ((void*)&tabindexAttr) QualifiedName(nullAtom, tabindexAttrString, nullAtom);
-    new ((void*)&tableborderAttr) QualifiedName(nullAtom, tableborderAttrString, nullAtom);
-    new ((void*)&targetAttr) QualifiedName(nullAtom, targetAttrString, nullAtom);
-    new ((void*)&textAttr) QualifiedName(nullAtom, textAttrString, nullAtom);
-    new ((void*)&titleAttr) QualifiedName(nullAtom, titleAttrString, nullAtom);
-    new ((void*)&topAttr) QualifiedName(nullAtom, topAttrString, nullAtom);
-    new ((void*)&topmarginAttr) QualifiedName(nullAtom, topmarginAttrString, nullAtom);
-    new ((void*)&truespeedAttr) QualifiedName(nullAtom, truespeedAttrString, nullAtom);
-    new ((void*)&typeAttr) QualifiedName(nullAtom, typeAttrString, nullAtom);
-    new ((void*)&usemapAttr) QualifiedName(nullAtom, usemapAttrString, nullAtom);
-    new ((void*)&valignAttr) QualifiedName(nullAtom, valignAttrString, nullAtom);
-    new ((void*)&valueAttr) QualifiedName(nullAtom, valueAttrString, nullAtom);
-    new ((void*)&valuetypeAttr) QualifiedName(nullAtom, valuetypeAttrString, nullAtom);
-    new ((void*)&versionAttr) QualifiedName(nullAtom, versionAttrString, nullAtom);
-    new ((void*)&viewsourceAttr) QualifiedName(nullAtom, viewsourceAttrString, nullAtom);
-    new ((void*)&vlinkAttr) QualifiedName(nullAtom, vlinkAttrString, nullAtom);
-    new ((void*)&vspaceAttr) QualifiedName(nullAtom, vspaceAttrString, nullAtom);
-    new ((void*)&widthAttr) QualifiedName(nullAtom, widthAttrString, nullAtom);
-    new ((void*)&wrapAttr) QualifiedName(nullAtom, wrapAttrString, nullAtom);
+    new ((void*)&abbrAttr) QualifiedName(nullAtom, "abbr", nullAtom);
+    new ((void*)&acceptAttr) QualifiedName(nullAtom, "accept", nullAtom);
+    new ((void*)&accept_charsetAttr) QualifiedName(nullAtom, "accept-charset", nullAtom);
+    new ((void*)&accesskeyAttr) QualifiedName(nullAtom, "accesskey", nullAtom);
+    new ((void*)&actionAttr) QualifiedName(nullAtom, "action", nullAtom);
+    new ((void*)&alignAttr) QualifiedName(nullAtom, "align", nullAtom);
+    new ((void*)&alinkAttr) QualifiedName(nullAtom, "alink", nullAtom);
+    new ((void*)&altAttr) QualifiedName(nullAtom, "alt", nullAtom);
+    new ((void*)&archiveAttr) QualifiedName(nullAtom, "archive", nullAtom);
+    new ((void*)&aria_activedescendantAttr) QualifiedName(nullAtom, "aria-activedescendant", nullAtom);
+    new ((void*)&aria_atomicAttr) QualifiedName(nullAtom, "aria-atomic", nullAtom);
+    new ((void*)&aria_busyAttr) QualifiedName(nullAtom, "aria-busy", nullAtom);
+    new ((void*)&aria_checkedAttr) QualifiedName(nullAtom, "aria-checked", nullAtom);
+    new ((void*)&aria_controlsAttr) QualifiedName(nullAtom, "aria-controls", nullAtom);
+    new ((void*)&aria_describedbyAttr) QualifiedName(nullAtom, "aria-describedby", nullAtom);
+    new ((void*)&aria_disabledAttr) QualifiedName(nullAtom, "aria-disabled", nullAtom);
+    new ((void*)&aria_dropeffectAttr) QualifiedName(nullAtom, "aria-dropeffect", nullAtom);
+    new ((void*)&aria_expandedAttr) QualifiedName(nullAtom, "aria-expanded", nullAtom);
+    new ((void*)&aria_flowtoAttr) QualifiedName(nullAtom, "aria-flowto", nullAtom);
+    new ((void*)&aria_grabbedAttr) QualifiedName(nullAtom, "aria-grabbed", nullAtom);
+    new ((void*)&aria_haspopupAttr) QualifiedName(nullAtom, "aria-haspopup", nullAtom);
+    new ((void*)&aria_hiddenAttr) QualifiedName(nullAtom, "aria-hidden", nullAtom);
+    new ((void*)&aria_labelAttr) QualifiedName(nullAtom, "aria-label", nullAtom);
+    new ((void*)&aria_labeledbyAttr) QualifiedName(nullAtom, "aria-labeledby", nullAtom);
+    new ((void*)&aria_labelledbyAttr) QualifiedName(nullAtom, "aria-labelledby", nullAtom);
+    new ((void*)&aria_levelAttr) QualifiedName(nullAtom, "aria-level", nullAtom);
+    new ((void*)&aria_liveAttr) QualifiedName(nullAtom, "aria-live", nullAtom);
+    new ((void*)&aria_multiselectableAttr) QualifiedName(nullAtom, "aria-multiselectable", nullAtom);
+    new ((void*)&aria_orientationAttr) QualifiedName(nullAtom, "aria-orientation", nullAtom);
+    new ((void*)&aria_ownsAttr) QualifiedName(nullAtom, "aria-owns", nullAtom);
+    new ((void*)&aria_pressedAttr) QualifiedName(nullAtom, "aria-pressed", nullAtom);
+    new ((void*)&aria_readonlyAttr) QualifiedName(nullAtom, "aria-readonly", nullAtom);
+    new ((void*)&aria_relevantAttr) QualifiedName(nullAtom, "aria-relevant", nullAtom);
+    new ((void*)&aria_requiredAttr) QualifiedName(nullAtom, "aria-required", nullAtom);
+    new ((void*)&aria_selectedAttr) QualifiedName(nullAtom, "aria-selected", nullAtom);
+    new ((void*)&aria_valuemaxAttr) QualifiedName(nullAtom, "aria-valuemax", nullAtom);
+    new ((void*)&aria_valueminAttr) QualifiedName(nullAtom, "aria-valuemin", nullAtom);
+    new ((void*)&aria_valuenowAttr) QualifiedName(nullAtom, "aria-valuenow", nullAtom);
+    new ((void*)&aria_valuetextAttr) QualifiedName(nullAtom, "aria-valuetext", nullAtom);
+    new ((void*)&autocompleteAttr) QualifiedName(nullAtom, "autocomplete", nullAtom);
+    new ((void*)&autofocusAttr) QualifiedName(nullAtom, "autofocus", nullAtom);
+    new ((void*)&autoplayAttr) QualifiedName(nullAtom, "autoplay", nullAtom);
+    new ((void*)&autosaveAttr) QualifiedName(nullAtom, "autosave", nullAtom);
+    new ((void*)&axisAttr) QualifiedName(nullAtom, "axis", nullAtom);
+    new ((void*)&backgroundAttr) QualifiedName(nullAtom, "background", nullAtom);
+    new ((void*)&behaviorAttr) QualifiedName(nullAtom, "behavior", nullAtom);
+    new ((void*)&bgcolorAttr) QualifiedName(nullAtom, "bgcolor", nullAtom);
+    new ((void*)&bgpropertiesAttr) QualifiedName(nullAtom, "bgproperties", nullAtom);
+    new ((void*)&borderAttr) QualifiedName(nullAtom, "border", nullAtom);
+    new ((void*)&bordercolorAttr) QualifiedName(nullAtom, "bordercolor", nullAtom);
+    new ((void*)&cellborderAttr) QualifiedName(nullAtom, "cellborder", nullAtom);
+    new ((void*)&cellpaddingAttr) QualifiedName(nullAtom, "cellpadding", nullAtom);
+    new ((void*)&cellspacingAttr) QualifiedName(nullAtom, "cellspacing", nullAtom);
+    new ((void*)&challengeAttr) QualifiedName(nullAtom, "challenge", nullAtom);
+    new ((void*)&charAttr) QualifiedName(nullAtom, "char", nullAtom);
+    new ((void*)&charoffAttr) QualifiedName(nullAtom, "charoff", nullAtom);
+    new ((void*)&charsetAttr) QualifiedName(nullAtom, "charset", nullAtom);
+    new ((void*)&checkedAttr) QualifiedName(nullAtom, "checked", nullAtom);
+    new ((void*)&citeAttr) QualifiedName(nullAtom, "cite", nullAtom);
+    new ((void*)&classAttr) QualifiedName(nullAtom, "class", nullAtom);
+    new ((void*)&classidAttr) QualifiedName(nullAtom, "classid", nullAtom);
+    new ((void*)&clearAttr) QualifiedName(nullAtom, "clear", nullAtom);
+    new ((void*)&codeAttr) QualifiedName(nullAtom, "code", nullAtom);
+    new ((void*)&codebaseAttr) QualifiedName(nullAtom, "codebase", nullAtom);
+    new ((void*)&codetypeAttr) QualifiedName(nullAtom, "codetype", nullAtom);
+    new ((void*)&colorAttr) QualifiedName(nullAtom, "color", nullAtom);
+    new ((void*)&colsAttr) QualifiedName(nullAtom, "cols", nullAtom);
+    new ((void*)&colspanAttr) QualifiedName(nullAtom, "colspan", nullAtom);
+    new ((void*)&compactAttr) QualifiedName(nullAtom, "compact", nullAtom);
+    new ((void*)&compositeAttr) QualifiedName(nullAtom, "composite", nullAtom);
+    new ((void*)&contentAttr) QualifiedName(nullAtom, "content", nullAtom);
+    new ((void*)&contenteditableAttr) QualifiedName(nullAtom, "contenteditable", nullAtom);
+    new ((void*)&controlsAttr) QualifiedName(nullAtom, "controls", nullAtom);
+    new ((void*)&coordsAttr) QualifiedName(nullAtom, "coords", nullAtom);
+    new ((void*)&dataAttr) QualifiedName(nullAtom, "data", nullAtom);
+    new ((void*)&datetimeAttr) QualifiedName(nullAtom, "datetime", nullAtom);
+    new ((void*)&declareAttr) QualifiedName(nullAtom, "declare", nullAtom);
+    new ((void*)&deferAttr) QualifiedName(nullAtom, "defer", nullAtom);
+    new ((void*)&dirAttr) QualifiedName(nullAtom, "dir", nullAtom);
+    new ((void*)&directionAttr) QualifiedName(nullAtom, "direction", nullAtom);
+    new ((void*)&disabledAttr) QualifiedName(nullAtom, "disabled", nullAtom);
+    new ((void*)&draggableAttr) QualifiedName(nullAtom, "draggable", nullAtom);
+    new ((void*)&enctypeAttr) QualifiedName(nullAtom, "enctype", nullAtom);
+    new ((void*)&endAttr) QualifiedName(nullAtom, "end", nullAtom);
+    new ((void*)&eventAttr) QualifiedName(nullAtom, "event", nullAtom);
+    new ((void*)&expandedAttr) QualifiedName(nullAtom, "expanded", nullAtom);
+    new ((void*)&faceAttr) QualifiedName(nullAtom, "face", nullAtom);
+    new ((void*)&focusedAttr) QualifiedName(nullAtom, "focused", nullAtom);
+    new ((void*)&forAttr) QualifiedName(nullAtom, "for", nullAtom);
+    new ((void*)&formnovalidateAttr) QualifiedName(nullAtom, "formnovalidate", nullAtom);
+    new ((void*)&frameAttr) QualifiedName(nullAtom, "frame", nullAtom);
+    new ((void*)&frameborderAttr) QualifiedName(nullAtom, "frameborder", nullAtom);
+    new ((void*)&headersAttr) QualifiedName(nullAtom, "headers", nullAtom);
+    new ((void*)&heightAttr) QualifiedName(nullAtom, "height", nullAtom);
+    new ((void*)&hiddenAttr) QualifiedName(nullAtom, "hidden", nullAtom);
+    new ((void*)&hrefAttr) QualifiedName(nullAtom, "href", nullAtom);
+    new ((void*)&hreflangAttr) QualifiedName(nullAtom, "hreflang", nullAtom);
+    new ((void*)&hspaceAttr) QualifiedName(nullAtom, "hspace", nullAtom);
+    new ((void*)&http_equivAttr) QualifiedName(nullAtom, "http-equiv", nullAtom);
+    new ((void*)&idAttr) QualifiedName(nullAtom, "id", nullAtom);
+    new ((void*)&incrementalAttr) QualifiedName(nullAtom, "incremental", nullAtom);
+    new ((void*)&indeterminateAttr) QualifiedName(nullAtom, "indeterminate", nullAtom);
+    new ((void*)&ismapAttr) QualifiedName(nullAtom, "ismap", nullAtom);
+    new ((void*)&keytypeAttr) QualifiedName(nullAtom, "keytype", nullAtom);
+    new ((void*)&labelAttr) QualifiedName(nullAtom, "label", nullAtom);
+    new ((void*)&langAttr) QualifiedName(nullAtom, "lang", nullAtom);
+    new ((void*)&languageAttr) QualifiedName(nullAtom, "language", nullAtom);
+    new ((void*)&leftmarginAttr) QualifiedName(nullAtom, "leftmargin", nullAtom);
+    new ((void*)&linkAttr) QualifiedName(nullAtom, "link", nullAtom);
+    new ((void*)&listAttr) QualifiedName(nullAtom, "list", nullAtom);
+    new ((void*)&longdescAttr) QualifiedName(nullAtom, "longdesc", nullAtom);
+    new ((void*)&loopAttr) QualifiedName(nullAtom, "loop", nullAtom);
+    new ((void*)&loopendAttr) QualifiedName(nullAtom, "loopend", nullAtom);
+    new ((void*)&loopstartAttr) QualifiedName(nullAtom, "loopstart", nullAtom);
+    new ((void*)&lowsrcAttr) QualifiedName(nullAtom, "lowsrc", nullAtom);
+    new ((void*)&manifestAttr) QualifiedName(nullAtom, "manifest", nullAtom);
+    new ((void*)&marginheightAttr) QualifiedName(nullAtom, "marginheight", nullAtom);
+    new ((void*)&marginwidthAttr) QualifiedName(nullAtom, "marginwidth", nullAtom);
+    new ((void*)&maxAttr) QualifiedName(nullAtom, "max", nullAtom);
+    new ((void*)&maxlengthAttr) QualifiedName(nullAtom, "maxlength", nullAtom);
+    new ((void*)&mayscriptAttr) QualifiedName(nullAtom, "mayscript", nullAtom);
+    new ((void*)&mediaAttr) QualifiedName(nullAtom, "media", nullAtom);
+    new ((void*)&methodAttr) QualifiedName(nullAtom, "method", nullAtom);
+    new ((void*)&minAttr) QualifiedName(nullAtom, "min", nullAtom);
+    new ((void*)&multipleAttr) QualifiedName(nullAtom, "multiple", nullAtom);
+    new ((void*)&nameAttr) QualifiedName(nullAtom, "name", nullAtom);
+    new ((void*)&nohrefAttr) QualifiedName(nullAtom, "nohref", nullAtom);
+    new ((void*)&noresizeAttr) QualifiedName(nullAtom, "noresize", nullAtom);
+    new ((void*)&noshadeAttr) QualifiedName(nullAtom, "noshade", nullAtom);
+    new ((void*)&novalidateAttr) QualifiedName(nullAtom, "novalidate", nullAtom);
+    new ((void*)&nowrapAttr) QualifiedName(nullAtom, "nowrap", nullAtom);
+    new ((void*)&objectAttr) QualifiedName(nullAtom, "object", nullAtom);
+    new ((void*)&onabortAttr) QualifiedName(nullAtom, "onabort", nullAtom);
+    new ((void*)&onbeforecopyAttr) QualifiedName(nullAtom, "onbeforecopy", nullAtom);
+    new ((void*)&onbeforecutAttr) QualifiedName(nullAtom, "onbeforecut", nullAtom);
+    new ((void*)&onbeforeloadAttr) QualifiedName(nullAtom, "onbeforeload", nullAtom);
+    new ((void*)&onbeforepasteAttr) QualifiedName(nullAtom, "onbeforepaste", nullAtom);
+    new ((void*)&onbeforeunloadAttr) QualifiedName(nullAtom, "onbeforeunload", nullAtom);
+    new ((void*)&onblurAttr) QualifiedName(nullAtom, "onblur", nullAtom);
+    new ((void*)&oncanplayAttr) QualifiedName(nullAtom, "oncanplay", nullAtom);
+    new ((void*)&oncanplaythroughAttr) QualifiedName(nullAtom, "oncanplaythrough", nullAtom);
+    new ((void*)&onchangeAttr) QualifiedName(nullAtom, "onchange", nullAtom);
+    new ((void*)&onclickAttr) QualifiedName(nullAtom, "onclick", nullAtom);
+    new ((void*)&oncontextmenuAttr) QualifiedName(nullAtom, "oncontextmenu", nullAtom);
+    new ((void*)&oncopyAttr) QualifiedName(nullAtom, "oncopy", nullAtom);
+    new ((void*)&oncutAttr) QualifiedName(nullAtom, "oncut", nullAtom);
+    new ((void*)&ondblclickAttr) QualifiedName(nullAtom, "ondblclick", nullAtom);
+    new ((void*)&ondragAttr) QualifiedName(nullAtom, "ondrag", nullAtom);
+    new ((void*)&ondragendAttr) QualifiedName(nullAtom, "ondragend", nullAtom);
+    new ((void*)&ondragenterAttr) QualifiedName(nullAtom, "ondragenter", nullAtom);
+    new ((void*)&ondragleaveAttr) QualifiedName(nullAtom, "ondragleave", nullAtom);
+    new ((void*)&ondragoverAttr) QualifiedName(nullAtom, "ondragover", nullAtom);
+    new ((void*)&ondragstartAttr) QualifiedName(nullAtom, "ondragstart", nullAtom);
+    new ((void*)&ondropAttr) QualifiedName(nullAtom, "ondrop", nullAtom);
+    new ((void*)&ondurationchangeAttr) QualifiedName(nullAtom, "ondurationchange", nullAtom);
+    new ((void*)&onemptiedAttr) QualifiedName(nullAtom, "onemptied", nullAtom);
+    new ((void*)&onendedAttr) QualifiedName(nullAtom, "onended", nullAtom);
+    new ((void*)&onerrorAttr) QualifiedName(nullAtom, "onerror", nullAtom);
+    new ((void*)&onfocusAttr) QualifiedName(nullAtom, "onfocus", nullAtom);
+    new ((void*)&onfocusinAttr) QualifiedName(nullAtom, "onfocusin", nullAtom);
+    new ((void*)&onfocusoutAttr) QualifiedName(nullAtom, "onfocusout", nullAtom);
+    new ((void*)&onhashchangeAttr) QualifiedName(nullAtom, "onhashchange", nullAtom);
+    new ((void*)&oninputAttr) QualifiedName(nullAtom, "oninput", nullAtom);
+    new ((void*)&oninvalidAttr) QualifiedName(nullAtom, "oninvalid", nullAtom);
+    new ((void*)&onkeydownAttr) QualifiedName(nullAtom, "onkeydown", nullAtom);
+    new ((void*)&onkeypressAttr) QualifiedName(nullAtom, "onkeypress", nullAtom);
+    new ((void*)&onkeyupAttr) QualifiedName(nullAtom, "onkeyup", nullAtom);
+    new ((void*)&onloadAttr) QualifiedName(nullAtom, "onload", nullAtom);
+    new ((void*)&onloadeddataAttr) QualifiedName(nullAtom, "onloadeddata", nullAtom);
+    new ((void*)&onloadedmetadataAttr) QualifiedName(nullAtom, "onloadedmetadata", nullAtom);
+    new ((void*)&onloadstartAttr) QualifiedName(nullAtom, "onloadstart", nullAtom);
+    new ((void*)&onmousedownAttr) QualifiedName(nullAtom, "onmousedown", nullAtom);
+    new ((void*)&onmousemoveAttr) QualifiedName(nullAtom, "onmousemove", nullAtom);
+    new ((void*)&onmouseoutAttr) QualifiedName(nullAtom, "onmouseout", nullAtom);
+    new ((void*)&onmouseoverAttr) QualifiedName(nullAtom, "onmouseover", nullAtom);
+    new ((void*)&onmouseupAttr) QualifiedName(nullAtom, "onmouseup", nullAtom);
+    new ((void*)&onmousewheelAttr) QualifiedName(nullAtom, "onmousewheel", nullAtom);
+    new ((void*)&onofflineAttr) QualifiedName(nullAtom, "onoffline", nullAtom);
+    new ((void*)&ononlineAttr) QualifiedName(nullAtom, "ononline", nullAtom);
+    new ((void*)&onorientationchangeAttr) QualifiedName(nullAtom, "onorientationchange", nullAtom);
+    new ((void*)&onpagehideAttr) QualifiedName(nullAtom, "onpagehide", nullAtom);
+    new ((void*)&onpageshowAttr) QualifiedName(nullAtom, "onpageshow", nullAtom);
+    new ((void*)&onpasteAttr) QualifiedName(nullAtom, "onpaste", nullAtom);
+    new ((void*)&onpauseAttr) QualifiedName(nullAtom, "onpause", nullAtom);
+    new ((void*)&onplayAttr) QualifiedName(nullAtom, "onplay", nullAtom);
+    new ((void*)&onplayingAttr) QualifiedName(nullAtom, "onplaying", nullAtom);
+    new ((void*)&onpopstateAttr) QualifiedName(nullAtom, "onpopstate", nullAtom);
+    new ((void*)&onprogressAttr) QualifiedName(nullAtom, "onprogress", nullAtom);
+    new ((void*)&onratechangeAttr) QualifiedName(nullAtom, "onratechange", nullAtom);
+    new ((void*)&onresetAttr) QualifiedName(nullAtom, "onreset", nullAtom);
+    new ((void*)&onresizeAttr) QualifiedName(nullAtom, "onresize", nullAtom);
+    new ((void*)&onscrollAttr) QualifiedName(nullAtom, "onscroll", nullAtom);
+    new ((void*)&onsearchAttr) QualifiedName(nullAtom, "onsearch", nullAtom);
+    new ((void*)&onseekedAttr) QualifiedName(nullAtom, "onseeked", nullAtom);
+    new ((void*)&onseekingAttr) QualifiedName(nullAtom, "onseeking", nullAtom);
+    new ((void*)&onselectAttr) QualifiedName(nullAtom, "onselect", nullAtom);
+    new ((void*)&onselectstartAttr) QualifiedName(nullAtom, "onselectstart", nullAtom);
+    new ((void*)&onstalledAttr) QualifiedName(nullAtom, "onstalled", nullAtom);
+    new ((void*)&onstorageAttr) QualifiedName(nullAtom, "onstorage", nullAtom);
+    new ((void*)&onsubmitAttr) QualifiedName(nullAtom, "onsubmit", nullAtom);
+    new ((void*)&onsuspendAttr) QualifiedName(nullAtom, "onsuspend", nullAtom);
+    new ((void*)&ontimeupdateAttr) QualifiedName(nullAtom, "ontimeupdate", nullAtom);
+    new ((void*)&ontouchcancelAttr) QualifiedName(nullAtom, "ontouchcancel", nullAtom);
+    new ((void*)&ontouchendAttr) QualifiedName(nullAtom, "ontouchend", nullAtom);
+    new ((void*)&ontouchmoveAttr) QualifiedName(nullAtom, "ontouchmove", nullAtom);
+    new ((void*)&ontouchstartAttr) QualifiedName(nullAtom, "ontouchstart", nullAtom);
+    new ((void*)&onunloadAttr) QualifiedName(nullAtom, "onunload", nullAtom);
+    new ((void*)&onvolumechangeAttr) QualifiedName(nullAtom, "onvolumechange", nullAtom);
+    new ((void*)&onwaitingAttr) QualifiedName(nullAtom, "onwaiting", nullAtom);
+    new ((void*)&onwebkitanimationendAttr) QualifiedName(nullAtom, "onwebkitanimationend", nullAtom);
+    new ((void*)&onwebkitanimationiterationAttr) QualifiedName(nullAtom, "onwebkitanimationiteration", nullAtom);
+    new ((void*)&onwebkitanimationstartAttr) QualifiedName(nullAtom, "onwebkitanimationstart", nullAtom);
+    new ((void*)&onwebkitbeginfullscreenAttr) QualifiedName(nullAtom, "onwebkitbeginfullscreen", nullAtom);
+    new ((void*)&onwebkitendfullscreenAttr) QualifiedName(nullAtom, "onwebkitendfullscreen", nullAtom);
+    new ((void*)&onwebkittransitionendAttr) QualifiedName(nullAtom, "onwebkittransitionend", nullAtom);
+    new ((void*)&patternAttr) QualifiedName(nullAtom, "pattern", nullAtom);
+    new ((void*)&placeholderAttr) QualifiedName(nullAtom, "placeholder", nullAtom);
+    new ((void*)&playcountAttr) QualifiedName(nullAtom, "playcount", nullAtom);
+    new ((void*)&pluginurlAttr) QualifiedName(nullAtom, "pluginurl", nullAtom);
+    new ((void*)&posterAttr) QualifiedName(nullAtom, "poster", nullAtom);
+    new ((void*)&precisionAttr) QualifiedName(nullAtom, "precision", nullAtom);
+    new ((void*)&preloadAttr) QualifiedName(nullAtom, "preload", nullAtom);
+    new ((void*)&primaryAttr) QualifiedName(nullAtom, "primary", nullAtom);
+    new ((void*)&profileAttr) QualifiedName(nullAtom, "profile", nullAtom);
+    new ((void*)&progressAttr) QualifiedName(nullAtom, "progress", nullAtom);
+    new ((void*)&promptAttr) QualifiedName(nullAtom, "prompt", nullAtom);
+    new ((void*)&readonlyAttr) QualifiedName(nullAtom, "readonly", nullAtom);
+    new ((void*)&relAttr) QualifiedName(nullAtom, "rel", nullAtom);
+    new ((void*)&requiredAttr) QualifiedName(nullAtom, "required", nullAtom);
+    new ((void*)&resultsAttr) QualifiedName(nullAtom, "results", nullAtom);
+    new ((void*)&revAttr) QualifiedName(nullAtom, "rev", nullAtom);
+    new ((void*)&roleAttr) QualifiedName(nullAtom, "role", nullAtom);
+    new ((void*)&rowsAttr) QualifiedName(nullAtom, "rows", nullAtom);
+    new ((void*)&rowspanAttr) QualifiedName(nullAtom, "rowspan", nullAtom);
+    new ((void*)&rulesAttr) QualifiedName(nullAtom, "rules", nullAtom);
+    new ((void*)&sandboxAttr) QualifiedName(nullAtom, "sandbox", nullAtom);
+    new ((void*)&schemeAttr) QualifiedName(nullAtom, "scheme", nullAtom);
+    new ((void*)&scopeAttr) QualifiedName(nullAtom, "scope", nullAtom);
+    new ((void*)&scrollamountAttr) QualifiedName(nullAtom, "scrollamount", nullAtom);
+    new ((void*)&scrolldelayAttr) QualifiedName(nullAtom, "scrolldelay", nullAtom);
+    new ((void*)&scrollingAttr) QualifiedName(nullAtom, "scrolling", nullAtom);
+    new ((void*)&selectedAttr) QualifiedName(nullAtom, "selected", nullAtom);
+    new ((void*)&shapeAttr) QualifiedName(nullAtom, "shape", nullAtom);
+    new ((void*)&sizeAttr) QualifiedName(nullAtom, "size", nullAtom);
+    new ((void*)&sortableAttr) QualifiedName(nullAtom, "sortable", nullAtom);
+    new ((void*)&sortdirectionAttr) QualifiedName(nullAtom, "sortdirection", nullAtom);
+    new ((void*)&spanAttr) QualifiedName(nullAtom, "span", nullAtom);
+    new ((void*)&spellcheckAttr) QualifiedName(nullAtom, "spellcheck", nullAtom);
+    new ((void*)&srcAttr) QualifiedName(nullAtom, "src", nullAtom);
+    new ((void*)&standbyAttr) QualifiedName(nullAtom, "standby", nullAtom);
+    new ((void*)&startAttr) QualifiedName(nullAtom, "start", nullAtom);
+    new ((void*)&stepAttr) QualifiedName(nullAtom, "step", nullAtom);
+    new ((void*)&styleAttr) QualifiedName(nullAtom, "style", nullAtom);
+    new ((void*)&summaryAttr) QualifiedName(nullAtom, "summary", nullAtom);
+    new ((void*)&tabindexAttr) QualifiedName(nullAtom, "tabindex", nullAtom);
+    new ((void*)&tableborderAttr) QualifiedName(nullAtom, "tableborder", nullAtom);
+    new ((void*)&targetAttr) QualifiedName(nullAtom, "target", nullAtom);
+    new ((void*)&textAttr) QualifiedName(nullAtom, "text", nullAtom);
+    new ((void*)&titleAttr) QualifiedName(nullAtom, "title", nullAtom);
+    new ((void*)&topAttr) QualifiedName(nullAtom, "top", nullAtom);
+    new ((void*)&topmarginAttr) QualifiedName(nullAtom, "topmargin", nullAtom);
+    new ((void*)&truespeedAttr) QualifiedName(nullAtom, "truespeed", nullAtom);
+    new ((void*)&typeAttr) QualifiedName(nullAtom, "type", nullAtom);
+    new ((void*)&usemapAttr) QualifiedName(nullAtom, "usemap", nullAtom);
+    new ((void*)&valignAttr) QualifiedName(nullAtom, "valign", nullAtom);
+    new ((void*)&valueAttr) QualifiedName(nullAtom, "value", nullAtom);
+    new ((void*)&valuetypeAttr) QualifiedName(nullAtom, "valuetype", nullAtom);
+    new ((void*)&versionAttr) QualifiedName(nullAtom, "version", nullAtom);
+    new ((void*)&viewsourceAttr) QualifiedName(nullAtom, "viewsource", nullAtom);
+    new ((void*)&vlinkAttr) QualifiedName(nullAtom, "vlink", nullAtom);
+    new ((void*)&vspaceAttr) QualifiedName(nullAtom, "vspace", nullAtom);
+    new ((void*)&widthAttr) QualifiedName(nullAtom, "width", nullAtom);
+    new ((void*)&wrapAttr) QualifiedName(nullAtom, "wrap", nullAtom);
 }
 
 } }
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
index 6fd108e31f..004dfad6ed 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
@@ -47,6 +47,8 @@ extern const WebCore::QualifiedName acronymTag;
 extern const WebCore::QualifiedName addressTag;
 extern const WebCore::QualifiedName appletTag;
 extern const WebCore::QualifiedName areaTag;
+extern const WebCore::QualifiedName articleTag;
+extern const WebCore::QualifiedName asideTag;
 extern const WebCore::QualifiedName audioTag;
 extern const WebCore::QualifiedName bTag;
 extern const WebCore::QualifiedName baseTag;
@@ -80,6 +82,7 @@ extern const WebCore::QualifiedName emTag;
 extern const WebCore::QualifiedName embedTag;
 extern const WebCore::QualifiedName fieldsetTag;
 extern const WebCore::QualifiedName fontTag;
+extern const WebCore::QualifiedName footerTag;
 extern const WebCore::QualifiedName formTag;
 extern const WebCore::QualifiedName frameTag;
 extern const WebCore::QualifiedName framesetTag;
@@ -90,6 +93,8 @@ extern const WebCore::QualifiedName h4Tag;
 extern const WebCore::QualifiedName h5Tag;
 extern const WebCore::QualifiedName h6Tag;
 extern const WebCore::QualifiedName headTag;
+extern const WebCore::QualifiedName headerTag;
+extern const WebCore::QualifiedName hgroupTag;
 extern const WebCore::QualifiedName hrTag;
 extern const WebCore::QualifiedName htmlTag;
 extern const WebCore::QualifiedName iTag;
@@ -125,6 +130,7 @@ extern const WebCore::QualifiedName pTag;
 extern const WebCore::QualifiedName paramTag;
 extern const WebCore::QualifiedName plaintextTag;
 extern const WebCore::QualifiedName preTag;
+extern const WebCore::QualifiedName progressTag;
 extern const WebCore::QualifiedName qTag;
 extern const WebCore::QualifiedName rpTag;
 extern const WebCore::QualifiedName rtTag;
@@ -132,6 +138,7 @@ extern const WebCore::QualifiedName rubyTag;
 extern const WebCore::QualifiedName sTag;
 extern const WebCore::QualifiedName sampTag;
 extern const WebCore::QualifiedName scriptTag;
+extern const WebCore::QualifiedName sectionTag;
 extern const WebCore::QualifiedName selectTag;
 extern const WebCore::QualifiedName smallTag;
 extern const WebCore::QualifiedName sourceTag;
@@ -168,22 +175,35 @@ extern const WebCore::QualifiedName alinkAttr;
 extern const WebCore::QualifiedName altAttr;
 extern const WebCore::QualifiedName archiveAttr;
 extern const WebCore::QualifiedName aria_activedescendantAttr;
+extern const WebCore::QualifiedName aria_atomicAttr;
+extern const WebCore::QualifiedName aria_busyAttr;
 extern const WebCore::QualifiedName aria_checkedAttr;
+extern const WebCore::QualifiedName aria_controlsAttr;
 extern const WebCore::QualifiedName aria_describedbyAttr;
 extern const WebCore::QualifiedName aria_disabledAttr;
+extern const WebCore::QualifiedName aria_dropeffectAttr;
+extern const WebCore::QualifiedName aria_expandedAttr;
+extern const WebCore::QualifiedName aria_flowtoAttr;
+extern const WebCore::QualifiedName aria_grabbedAttr;
+extern const WebCore::QualifiedName aria_haspopupAttr;
 extern const WebCore::QualifiedName aria_hiddenAttr;
 extern const WebCore::QualifiedName aria_labelAttr;
 extern const WebCore::QualifiedName aria_labeledbyAttr;
 extern const WebCore::QualifiedName aria_labelledbyAttr;
 extern const WebCore::QualifiedName aria_levelAttr;
+extern const WebCore::QualifiedName aria_liveAttr;
+extern const WebCore::QualifiedName aria_multiselectableAttr;
+extern const WebCore::QualifiedName aria_orientationAttr;
+extern const WebCore::QualifiedName aria_ownsAttr;
 extern const WebCore::QualifiedName aria_pressedAttr;
 extern const WebCore::QualifiedName aria_readonlyAttr;
+extern const WebCore::QualifiedName aria_relevantAttr;
 extern const WebCore::QualifiedName aria_requiredAttr;
+extern const WebCore::QualifiedName aria_selectedAttr;
 extern const WebCore::QualifiedName aria_valuemaxAttr;
 extern const WebCore::QualifiedName aria_valueminAttr;
 extern const WebCore::QualifiedName aria_valuenowAttr;
 extern const WebCore::QualifiedName aria_valuetextAttr;
-extern const WebCore::QualifiedName autobufferAttr;
 extern const WebCore::QualifiedName autocompleteAttr;
 extern const WebCore::QualifiedName autofocusAttr;
 extern const WebCore::QualifiedName autoplayAttr;
@@ -205,7 +225,6 @@ extern const WebCore::QualifiedName charsetAttr;
 extern const WebCore::QualifiedName checkedAttr;
 extern const WebCore::QualifiedName citeAttr;
 extern const WebCore::QualifiedName classAttr;
-extern char classAttrString[];
 extern const WebCore::QualifiedName classidAttr;
 extern const WebCore::QualifiedName clearAttr;
 extern const WebCore::QualifiedName codeAttr;
@@ -230,6 +249,7 @@ extern const WebCore::QualifiedName disabledAttr;
 extern const WebCore::QualifiedName draggableAttr;
 extern const WebCore::QualifiedName enctypeAttr;
 extern const WebCore::QualifiedName endAttr;
+extern const WebCore::QualifiedName eventAttr;
 extern const WebCore::QualifiedName expandedAttr;
 extern const WebCore::QualifiedName faceAttr;
 extern const WebCore::QualifiedName focusedAttr;
@@ -304,6 +324,8 @@ extern const WebCore::QualifiedName onemptiedAttr;
 extern const WebCore::QualifiedName onendedAttr;
 extern const WebCore::QualifiedName onerrorAttr;
 extern const WebCore::QualifiedName onfocusAttr;
+extern const WebCore::QualifiedName onfocusinAttr;
+extern const WebCore::QualifiedName onfocusoutAttr;
 extern const WebCore::QualifiedName onhashchangeAttr;
 extern const WebCore::QualifiedName oninputAttr;
 extern const WebCore::QualifiedName oninvalidAttr;
@@ -329,6 +351,7 @@ extern const WebCore::QualifiedName onpasteAttr;
 extern const WebCore::QualifiedName onpauseAttr;
 extern const WebCore::QualifiedName onplayAttr;
 extern const WebCore::QualifiedName onplayingAttr;
+extern const WebCore::QualifiedName onpopstateAttr;
 extern const WebCore::QualifiedName onprogressAttr;
 extern const WebCore::QualifiedName onratechangeAttr;
 extern const WebCore::QualifiedName onresetAttr;
@@ -344,12 +367,18 @@ extern const WebCore::QualifiedName onstorageAttr;
 extern const WebCore::QualifiedName onsubmitAttr;
 extern const WebCore::QualifiedName onsuspendAttr;
 extern const WebCore::QualifiedName ontimeupdateAttr;
+extern const WebCore::QualifiedName ontouchcancelAttr;
+extern const WebCore::QualifiedName ontouchendAttr;
+extern const WebCore::QualifiedName ontouchmoveAttr;
+extern const WebCore::QualifiedName ontouchstartAttr;
 extern const WebCore::QualifiedName onunloadAttr;
 extern const WebCore::QualifiedName onvolumechangeAttr;
 extern const WebCore::QualifiedName onwaitingAttr;
 extern const WebCore::QualifiedName onwebkitanimationendAttr;
 extern const WebCore::QualifiedName onwebkitanimationiterationAttr;
 extern const WebCore::QualifiedName onwebkitanimationstartAttr;
+extern const WebCore::QualifiedName onwebkitbeginfullscreenAttr;
+extern const WebCore::QualifiedName onwebkitendfullscreenAttr;
 extern const WebCore::QualifiedName onwebkittransitionendAttr;
 extern const WebCore::QualifiedName patternAttr;
 extern const WebCore::QualifiedName placeholderAttr;
@@ -357,6 +386,7 @@ extern const WebCore::QualifiedName playcountAttr;
 extern const WebCore::QualifiedName pluginurlAttr;
 extern const WebCore::QualifiedName posterAttr;
 extern const WebCore::QualifiedName precisionAttr;
+extern const WebCore::QualifiedName preloadAttr;
 extern const WebCore::QualifiedName primaryAttr;
 extern const WebCore::QualifiedName profileAttr;
 extern const WebCore::QualifiedName progressAttr;
@@ -370,6 +400,7 @@ extern const WebCore::QualifiedName roleAttr;
 extern const WebCore::QualifiedName rowsAttr;
 extern const WebCore::QualifiedName rowspanAttr;
 extern const WebCore::QualifiedName rulesAttr;
+extern const WebCore::QualifiedName sandboxAttr;
 extern const WebCore::QualifiedName schemeAttr;
 extern const WebCore::QualifiedName scopeAttr;
 extern const WebCore::QualifiedName scrollamountAttr;
@@ -385,6 +416,7 @@ extern const WebCore::QualifiedName spellcheckAttr;
 extern const WebCore::QualifiedName srcAttr;
 extern const WebCore::QualifiedName standbyAttr;
 extern const WebCore::QualifiedName startAttr;
+extern const WebCore::QualifiedName stepAttr;
 extern const WebCore::QualifiedName styleAttr;
 extern const WebCore::QualifiedName summaryAttr;
 extern const WebCore::QualifiedName tabindexAttr;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
index bee17acaf0..ab5a9f79b0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
@@ -27,8 +27,6 @@
 #include "AbstractWorker.h"
 #include "Event.h"
 #include "EventListener.h"
-#include "Frame.h"
-#include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "RegisteredEventListener.h"
@@ -45,8 +43,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSAbstractWorker);
 
 static const HashTableValue JSAbstractWorkerTableValues[3] =
 {
-    { "onerror", DontDelete, (intptr_t)jsAbstractWorkerOnerror, (intptr_t)setJSAbstractWorkerOnerror },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsAbstractWorkerConstructor, (intptr_t)0 },
+    { "onerror", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAbstractWorkerOnerror), (intptr_t)setJSAbstractWorkerOnerror },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAbstractWorkerConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -85,7 +83,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -108,9 +106,9 @@ bool JSAbstractWorkerConstructor::getOwnPropertyDescriptor(ExecState* exec, cons
 
 static const HashTableValue JSAbstractWorkerPrototypeTableValues[4] =
 {
-    { "addEventListener", DontDelete|Function, (intptr_t)jsAbstractWorkerPrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsAbstractWorkerPrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsAbstractWorkerPrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { "addEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsAbstractWorkerPrototypeFunctionAddEventListener), (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsAbstractWorkerPrototypeFunctionRemoveEventListener), (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsAbstractWorkerPrototypeFunctionDispatchEvent), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -148,14 +146,14 @@ JSAbstractWorker::JSAbstractWorker(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSAbstractWorker::~JSAbstractWorker()
 {
-    impl()->invalidateEventListeners();
+    impl()->invalidateJSEventListeners(this);
     forgetDOMObject(this, impl());
 }
 
 void JSAbstractWorker::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
-    impl()->markEventListeners(markStack);
+    impl()->markJSEventListeners(markStack);
 }
 
 JSObject* JSAbstractWorker::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -173,21 +171,23 @@ bool JSAbstractWorker::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSAbstractWorker, Base>(exec, &JSAbstractWorkerTable, this, propertyName, descriptor);
 }
 
-JSValue jsAbstractWorkerOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAbstractWorkerOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAbstractWorker* castedThis = static_cast<JSAbstractWorker*>(asObject(slot.slotBase()));
+    JSAbstractWorker* castedThis = static_cast<JSAbstractWorker*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     AbstractWorker* imp = static_cast<AbstractWorker*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsAbstractWorkerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAbstractWorkerConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAbstractWorker* domObject = static_cast<JSAbstractWorker*>(asObject(slot.slotBase()));
+    JSAbstractWorker* domObject = static_cast<JSAbstractWorker*>(asObject(slotBase));
     return JSAbstractWorker::getConstructor(exec, domObject->globalObject());
 }
 void JSAbstractWorker::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -199,10 +199,7 @@ void setJSAbstractWorkerOnerror(ExecState* exec, JSObject* thisObject, JSValue v
 {
     UNUSED_PARAM(exec);
     AbstractWorker* imp = static_cast<AbstractWorker*>(static_cast<JSAbstractWorker*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSAbstractWorker::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h
index 882c091a0c..9cace65bef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(WORKERS)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -46,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -77,7 +76,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSAbstractWorkerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -91,9 +90,9 @@ JSC::JSValue JSC_HOST_CALL jsAbstractWorkerPrototypeFunctionRemoveEventListener(
 JSC::JSValue JSC_HOST_CALL jsAbstractWorkerPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsAbstractWorkerOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAbstractWorkerOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSAbstractWorkerOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsAbstractWorkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAbstractWorkerConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
index 89cfed1e28..2f484049c9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
@@ -38,14 +38,15 @@ ASSERT_CLASS_FITS_IN_CELL(JSAttr);
 
 /* Hash table */
 
-static const HashTableValue JSAttrTableValues[7] =
-{
-    { "name", DontDelete|ReadOnly, (intptr_t)jsAttrName, (intptr_t)0 },
-    { "specified", DontDelete|ReadOnly, (intptr_t)jsAttrSpecified, (intptr_t)0 },
-    { "value", DontDelete, (intptr_t)jsAttrValue, (intptr_t)setJSAttrValue },
-    { "ownerElement", DontDelete|ReadOnly, (intptr_t)jsAttrOwnerElement, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsAttrStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsAttrConstructor, (intptr_t)0 },
+static const HashTableValue JSAttrTableValues[8] =
+{
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAttrName), (intptr_t)0 },
+    { "specified", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAttrSpecified), (intptr_t)0 },
+    { "value", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAttrValue), (intptr_t)setJSAttrValue },
+    { "ownerElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAttrOwnerElement), (intptr_t)0 },
+    { "isId", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAttrIsId), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAttrStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAttrConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -84,7 +85,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -146,49 +147,63 @@ bool JSAttr::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propert
     return getStaticValueDescriptor<JSAttr, Base>(exec, &JSAttrTable, this, propertyName, descriptor);
 }
 
-JSValue jsAttrName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slot.slotBase()));
+    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->name());
+    JSValue result = jsStringOrNull(exec, imp->name());
+    return result;
 }
 
-JSValue jsAttrSpecified(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrSpecified(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slot.slotBase()));
+    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(castedThis->impl());
-    return jsBoolean(imp->specified());
+    JSValue result = jsBoolean(imp->specified());
+    return result;
 }
 
-JSValue jsAttrValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slot.slotBase()));
+    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->value());
+    JSValue result = jsStringOrNull(exec, imp->value());
+    return result;
 }
 
-JSValue jsAttrOwnerElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrOwnerElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slot.slotBase()));
+    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->ownerElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->ownerElement()));
+    return result;
 }
 
-JSValue jsAttrStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrIsId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slot.slotBase()));
+    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = jsBoolean(imp->isId());
+    return result;
 }
 
-JSValue jsAttrConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAttr* domObject = static_cast<JSAttr*>(asObject(slot.slotBase()));
+    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Attr* imp = static_cast<Attr*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
+}
+
+JSValue jsAttrConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSAttr* domObject = static_cast<JSAttr*>(asObject(slotBase));
     return JSAttr::getConstructor(exec, domObject->globalObject());
 }
 void JSAttr::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.h b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
index 1562011af2..ef556d921d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -68,7 +68,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSAttrPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -77,13 +77,14 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsAttrName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsAttrSpecified(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsAttrValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAttrName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsAttrSpecified(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsAttrValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSAttrValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsAttrOwnerElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsAttrStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsAttrConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAttrOwnerElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsAttrIsId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsAttrStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsAttrConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
index 348c086f99..8b383b608f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
@@ -34,7 +34,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSBarInfo);
 
 static const HashTableValue JSBarInfoTableValues[2] =
 {
-    { "visible", DontDelete|ReadOnly, (intptr_t)jsBarInfoVisible, (intptr_t)0 },
+    { "visible", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsBarInfoVisible), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -94,12 +94,13 @@ bool JSBarInfo::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return getStaticValueDescriptor<JSBarInfo, Base>(exec, &JSBarInfoTable, this, propertyName, descriptor);
 }
 
-JSValue jsBarInfoVisible(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsBarInfoVisible(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSBarInfo* castedThis = static_cast<JSBarInfo*>(asObject(slot.slotBase()));
+    JSBarInfo* castedThis = static_cast<JSBarInfo*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     BarInfo* imp = static_cast<BarInfo*>(castedThis->impl());
-    return jsBoolean(imp->visible());
+    JSValue result = jsBoolean(imp->visible());
+    return result;
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, BarInfo* object)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
index 9c389a1010..5e5cd7660f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
@@ -21,7 +21,6 @@
 #ifndef JSBarInfo_h
 #define JSBarInfo_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     BarInfo* impl() const { return m_impl.get(); }
@@ -65,7 +64,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSBarInfoPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -74,7 +73,7 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsBarInfoVisible(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsBarInfoVisible(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.cpp
index a7ec5771b7..743d55d354 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.cpp
@@ -37,8 +37,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSBeforeLoadEvent);
 
 static const HashTableValue JSBeforeLoadEventTableValues[3] =
 {
-    { "url", DontDelete|ReadOnly, (intptr_t)jsBeforeLoadEventUrl, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsBeforeLoadEventConstructor, (intptr_t)0 },
+    { "url", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsBeforeLoadEventUrl), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsBeforeLoadEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -100,7 +100,7 @@ bool JSBeforeLoadEventConstructor::getOwnPropertyDescriptor(ExecState* exec, con
 
 static const HashTableValue JSBeforeLoadEventPrototypeTableValues[2] =
 {
-    { "initBeforeLoadEvent", DontDelete|Function, (intptr_t)jsBeforeLoadEventPrototypeFunctionInitBeforeLoadEvent, (intptr_t)4 },
+    { "initBeforeLoadEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsBeforeLoadEventPrototypeFunctionInitBeforeLoadEvent), (intptr_t)4 },
     { 0, 0, 0, 0 }
 };
 
@@ -150,17 +150,18 @@ bool JSBeforeLoadEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSBeforeLoadEvent, Base>(exec, &JSBeforeLoadEventTable, this, propertyName, descriptor);
 }
 
-JSValue jsBeforeLoadEventUrl(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsBeforeLoadEventUrl(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSBeforeLoadEvent* castedThis = static_cast<JSBeforeLoadEvent*>(asObject(slot.slotBase()));
+    JSBeforeLoadEvent* castedThis = static_cast<JSBeforeLoadEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     BeforeLoadEvent* imp = static_cast<BeforeLoadEvent*>(castedThis->impl());
-    return jsString(exec, imp->url());
+    JSValue result = jsString(exec, imp->url());
+    return result;
 }
 
-JSValue jsBeforeLoadEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsBeforeLoadEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSBeforeLoadEvent* domObject = static_cast<JSBeforeLoadEvent*>(asObject(slot.slotBase()));
+    JSBeforeLoadEvent* domObject = static_cast<JSBeforeLoadEvent*>(asObject(slotBase));
     return JSBeforeLoadEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSBeforeLoadEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.h b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.h
index e5751927f5..aa71a613ce 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSBeforeLoadEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -70,8 +70,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsBeforeLoadEventPrototypeFunctionInitBeforeLoadEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsBeforeLoadEventUrl(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsBeforeLoadEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsBeforeLoadEventUrl(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsBeforeLoadEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBlob.cpp b/src/3rdparty/webkit/WebCore/generated/JSBlob.cpp
new file mode 100644
index 0000000000..9843d8f7f6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSBlob.cpp
@@ -0,0 +1,174 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSBlob.h"
+
+#include "Blob.h"
+#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSBlob);
+
+/* Hash table */
+
+static const HashTableValue JSBlobTableValues[3] =
+{
+    { "size", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsBlobSize), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsBlobConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSBlobTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 1, JSBlobTableValues, 0 };
+#else
+    { 4, 3, JSBlobTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSBlobConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSBlobConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSBlobConstructorTableValues, 0 };
+#else
+    { 1, 0, JSBlobConstructorTableValues, 0 };
+#endif
+
+class JSBlobConstructor : public DOMConstructorObject {
+public:
+    JSBlobConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSBlobConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSBlobPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSBlobConstructor::s_info = { "BlobConstructor", 0, &JSBlobConstructorTable, 0 };
+
+bool JSBlobConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSBlobConstructor, DOMObject>(exec, &JSBlobConstructorTable, this, propertyName, slot);
+}
+
+bool JSBlobConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSBlobConstructor, DOMObject>(exec, &JSBlobConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSBlobPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSBlobPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSBlobPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSBlobPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSBlobPrototype::s_info = { "BlobPrototype", 0, &JSBlobPrototypeTable, 0 };
+
+JSObject* JSBlobPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSBlob>(exec, globalObject);
+}
+
+const ClassInfo JSBlob::s_info = { "Blob", 0, &JSBlobTable, 0 };
+
+JSBlob::JSBlob(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Blob> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSBlob::~JSBlob()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSBlob::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSBlobPrototype(JSBlobPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSBlob::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSBlob, Base>(exec, &JSBlobTable, this, propertyName, slot);
+}
+
+bool JSBlob::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSBlob, Base>(exec, &JSBlobTable, this, propertyName, descriptor);
+}
+
+JSValue jsBlobSize(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSBlob* castedThis = static_cast<JSBlob*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Blob* imp = static_cast<Blob*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->size());
+    return result;
+}
+
+JSValue jsBlobConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSBlob* domObject = static_cast<JSBlob*>(asObject(slotBase));
+    return JSBlob::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSBlob::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSBlobConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Blob* object)
+{
+    return getDOMObjectWrapper<JSBlob>(exec, globalObject, object);
+}
+Blob* toBlob(JSC::JSValue value)
+{
+    return value.inherits(&JSBlob::s_info) ? static_cast<JSBlob*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBlob.h b/src/3rdparty/webkit/WebCore/generated/JSBlob.h
new file mode 100644
index 0000000000..1bb0f2cb9b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSBlob.h
@@ -0,0 +1,82 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSBlob_h
+#define JSBlob_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class Blob;
+
+class JSBlob : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSBlob(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<Blob>);
+    virtual ~JSBlob();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+    Blob* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<Blob> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Blob*);
+Blob* toBlob(JSC::JSValue);
+
+class JSBlobPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSBlobPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+// Attributes
+
+JSC::JSValue jsBlobSize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsBlobConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
index bdc4a93a50..798c558ee9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
@@ -34,7 +34,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSCDATASection);
 
 static const HashTableValue JSCDATASectionTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCDATASectionConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCDATASectionConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -73,7 +73,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -135,9 +135,9 @@ bool JSCDATASection::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSCDATASection, Base>(exec, &JSCDATASectionTable, this, propertyName, descriptor);
 }
 
-JSValue jsCDATASectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCDATASectionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCDATASection* domObject = static_cast<JSCDATASection*>(asObject(slot.slotBase()));
+    JSCDATASection* domObject = static_cast<JSCDATASection*>(asObject(slotBase));
     return JSCDATASection::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCDATASection::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
index 80b824c22f..05d74f40e0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCDATASectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,7 +66,7 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCDATASectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCDATASectionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
index 52c01c7e8d..516dd6b83c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
@@ -35,8 +35,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSCharsetRule);
 
 static const HashTableValue JSCSSCharsetRuleTableValues[3] =
 {
-    { "encoding", DontDelete, (intptr_t)jsCSSCharsetRuleEncoding, (intptr_t)setJSCSSCharsetRuleEncoding },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSCharsetRuleConstructor, (intptr_t)0 },
+    { "encoding", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSCharsetRuleEncoding), (intptr_t)setJSCSSCharsetRuleEncoding },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSCharsetRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -75,7 +75,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -137,17 +137,18 @@ bool JSCSSCharsetRule::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSCSSCharsetRule, Base>(exec, &JSCSSCharsetRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSCharsetRuleEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSCharsetRuleEncoding(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSCharsetRule* castedThis = static_cast<JSCSSCharsetRule*>(asObject(slot.slotBase()));
+    JSCSSCharsetRule* castedThis = static_cast<JSCSSCharsetRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSCharsetRule* imp = static_cast<CSSCharsetRule*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->encoding());
+    JSValue result = jsStringOrNull(exec, imp->encoding());
+    return result;
 }
 
-JSValue jsCSSCharsetRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSCharsetRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSCharsetRule* domObject = static_cast<JSCSSCharsetRule*>(asObject(slot.slotBase()));
+    JSCSSCharsetRule* domObject = static_cast<JSCSSCharsetRule*>(asObject(slotBase));
     return JSCSSCharsetRule::getConstructor(exec, domObject->globalObject());
 }
 void JSCSSCharsetRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -157,7 +158,8 @@ void JSCSSCharsetRule::put(ExecState* exec, const Identifier& propertyName, JSVa
 
 void setJSCSSCharsetRuleEncoding(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CSSCharsetRule* imp = static_cast<CSSCharsetRule*>(static_cast<JSCSSCharsetRule*>(thisObject)->impl());
+    JSCSSCharsetRule* castedThisObj = static_cast<JSCSSCharsetRule*>(thisObject);
+    CSSCharsetRule* imp = static_cast<CSSCharsetRule*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setEncoding(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
index 971cfb1218..e0a824509d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSCharsetRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,9 +66,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSCharsetRuleEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSCharsetRuleEncoding(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCSSCharsetRuleEncoding(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCSSCharsetRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSCharsetRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
index 012e437d57..dccbab49a3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
@@ -37,8 +37,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSFontFaceRule);
 
 static const HashTableValue JSCSSFontFaceRuleTableValues[3] =
 {
-    { "style", DontDelete|ReadOnly, (intptr_t)jsCSSFontFaceRuleStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSFontFaceRuleConstructor, (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSFontFaceRuleStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSFontFaceRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -139,17 +139,18 @@ bool JSCSSFontFaceRule::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSCSSFontFaceRule, Base>(exec, &JSCSSFontFaceRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSFontFaceRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSFontFaceRuleStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSFontFaceRule* castedThis = static_cast<JSCSSFontFaceRule*>(asObject(slot.slotBase()));
+    JSCSSFontFaceRule* castedThis = static_cast<JSCSSFontFaceRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSFontFaceRule* imp = static_cast<CSSFontFaceRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsCSSFontFaceRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSFontFaceRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSFontFaceRule* domObject = static_cast<JSCSSFontFaceRule*>(asObject(slot.slotBase()));
+    JSCSSFontFaceRule* domObject = static_cast<JSCSSFontFaceRule*>(asObject(slotBase));
     return JSCSSFontFaceRule::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCSSFontFaceRule::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
index 6a6acb2066..8e5b69b69b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -56,7 +56,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSFontFaceRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -65,8 +65,8 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSFontFaceRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSFontFaceRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSFontFaceRuleStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSFontFaceRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
index e3ae98324a..6589147666 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
@@ -39,10 +39,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSImportRule);
 
 static const HashTableValue JSCSSImportRuleTableValues[5] =
 {
-    { "href", DontDelete|ReadOnly, (intptr_t)jsCSSImportRuleHref, (intptr_t)0 },
-    { "media", DontDelete|ReadOnly, (intptr_t)jsCSSImportRuleMedia, (intptr_t)0 },
-    { "styleSheet", DontDelete|ReadOnly, (intptr_t)jsCSSImportRuleStyleSheet, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSImportRuleConstructor, (intptr_t)0 },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSImportRuleHref), (intptr_t)0 },
+    { "media", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSImportRuleMedia), (intptr_t)0 },
+    { "styleSheet", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSImportRuleStyleSheet), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSImportRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -143,33 +143,36 @@ bool JSCSSImportRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSCSSImportRule, Base>(exec, &JSCSSImportRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSImportRuleHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSImportRule* castedThis = static_cast<JSCSSImportRule*>(asObject(slot.slotBase()));
+    JSCSSImportRule* castedThis = static_cast<JSCSSImportRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSImportRule* imp = static_cast<CSSImportRule*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->href());
+    JSValue result = jsStringOrNull(exec, imp->href());
+    return result;
 }
 
-JSValue jsCSSImportRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleMedia(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSImportRule* castedThis = static_cast<JSCSSImportRule*>(asObject(slot.slotBase()));
+    JSCSSImportRule* castedThis = static_cast<JSCSSImportRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSImportRule* imp = static_cast<CSSImportRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    return result;
 }
 
-JSValue jsCSSImportRuleStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleStyleSheet(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSImportRule* castedThis = static_cast<JSCSSImportRule*>(asObject(slot.slotBase()));
+    JSCSSImportRule* castedThis = static_cast<JSCSSImportRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSImportRule* imp = static_cast<CSSImportRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->styleSheet()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->styleSheet()));
+    return result;
 }
 
-JSValue jsCSSImportRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSImportRule* domObject = static_cast<JSCSSImportRule*>(asObject(slot.slotBase()));
+    JSCSSImportRule* domObject = static_cast<JSCSSImportRule*>(asObject(slotBase));
     return JSCSSImportRule::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCSSImportRule::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
index 14e289a503..2db5698245 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -56,7 +56,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSImportRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -65,10 +65,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSImportRuleHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSImportRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSImportRuleStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSImportRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSImportRuleHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSImportRuleMedia(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSImportRuleStyleSheet(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSImportRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
index fbb26e899c..b7999b88be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
@@ -40,9 +40,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSMediaRule);
 
 static const HashTableValue JSCSSMediaRuleTableValues[4] =
 {
-    { "media", DontDelete|ReadOnly, (intptr_t)jsCSSMediaRuleMedia, (intptr_t)0 },
-    { "cssRules", DontDelete|ReadOnly, (intptr_t)jsCSSMediaRuleCssRules, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSMediaRuleConstructor, (intptr_t)0 },
+    { "media", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSMediaRuleMedia), (intptr_t)0 },
+    { "cssRules", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSMediaRuleCssRules), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSMediaRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -104,8 +104,8 @@ bool JSCSSMediaRuleConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSCSSMediaRulePrototypeTableValues[3] =
 {
-    { "insertRule", DontDelete|Function, (intptr_t)jsCSSMediaRulePrototypeFunctionInsertRule, (intptr_t)2 },
-    { "deleteRule", DontDelete|Function, (intptr_t)jsCSSMediaRulePrototypeFunctionDeleteRule, (intptr_t)1 },
+    { "insertRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSMediaRulePrototypeFunctionInsertRule), (intptr_t)2 },
+    { "deleteRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSMediaRulePrototypeFunctionDeleteRule), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -155,25 +155,27 @@ bool JSCSSMediaRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSCSSMediaRule, Base>(exec, &JSCSSMediaRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSMediaRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSMediaRuleMedia(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSMediaRule* castedThis = static_cast<JSCSSMediaRule*>(asObject(slot.slotBase()));
+    JSCSSMediaRule* castedThis = static_cast<JSCSSMediaRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSMediaRule* imp = static_cast<CSSMediaRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    return result;
 }
 
-JSValue jsCSSMediaRuleCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSMediaRuleCssRules(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSMediaRule* castedThis = static_cast<JSCSSMediaRule*>(asObject(slot.slotBase()));
+    JSCSSMediaRule* castedThis = static_cast<JSCSSMediaRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSMediaRule* imp = static_cast<CSSMediaRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->cssRules()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->cssRules()));
+    return result;
 }
 
-JSValue jsCSSMediaRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSMediaRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSMediaRule* domObject = static_cast<JSCSSMediaRule*>(asObject(slot.slotBase()));
+    JSCSSMediaRule* domObject = static_cast<JSCSSMediaRule*>(asObject(slotBase));
     return JSCSSMediaRule::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCSSMediaRule::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
index 225e70a475..04f64b226f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSMediaRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -71,9 +71,9 @@ JSC::JSValue JSC_HOST_CALL jsCSSMediaRulePrototypeFunctionInsertRule(JSC::ExecSt
 JSC::JSValue JSC_HOST_CALL jsCSSMediaRulePrototypeFunctionDeleteRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCSSMediaRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSMediaRuleCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSMediaRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSMediaRuleMedia(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSMediaRuleCssRules(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSMediaRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
index b1da3b9994..a6b5c7dadf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
@@ -38,9 +38,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSPageRule);
 
 static const HashTableValue JSCSSPageRuleTableValues[4] =
 {
-    { "selectorText", DontDelete, (intptr_t)jsCSSPageRuleSelectorText, (intptr_t)setJSCSSPageRuleSelectorText },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsCSSPageRuleStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSPageRuleConstructor, (intptr_t)0 },
+    { "selectorText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPageRuleSelectorText), (intptr_t)setJSCSSPageRuleSelectorText },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPageRuleStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPageRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -141,25 +141,27 @@ bool JSCSSPageRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSCSSPageRule, Base>(exec, &JSCSSPageRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSPageRuleSelectorText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPageRuleSelectorText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSPageRule* castedThis = static_cast<JSCSSPageRule*>(asObject(slot.slotBase()));
+    JSCSSPageRule* castedThis = static_cast<JSCSSPageRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSPageRule* imp = static_cast<CSSPageRule*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->selectorText());
+    JSValue result = jsStringOrNull(exec, imp->selectorText());
+    return result;
 }
 
-JSValue jsCSSPageRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPageRuleStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSPageRule* castedThis = static_cast<JSCSSPageRule*>(asObject(slot.slotBase()));
+    JSCSSPageRule* castedThis = static_cast<JSCSSPageRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSPageRule* imp = static_cast<CSSPageRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsCSSPageRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPageRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSPageRule* domObject = static_cast<JSCSSPageRule*>(asObject(slot.slotBase()));
+    JSCSSPageRule* domObject = static_cast<JSCSSPageRule*>(asObject(slotBase));
     return JSCSSPageRule::getConstructor(exec, domObject->globalObject());
 }
 void JSCSSPageRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -169,7 +171,8 @@ void JSCSSPageRule::put(ExecState* exec, const Identifier& propertyName, JSValue
 
 void setJSCSSPageRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CSSPageRule* imp = static_cast<CSSPageRule*>(static_cast<JSCSSPageRule*>(thisObject)->impl());
+    JSCSSPageRule* castedThisObj = static_cast<JSCSSPageRule*>(thisObject);
+    CSSPageRule* imp = static_cast<CSSPageRule*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setSelectorText(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
index 8ba0942d62..9058b665f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSPageRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,10 +66,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSPageRuleSelectorText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPageRuleSelectorText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCSSPageRuleSelectorText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCSSPageRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPageRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPageRuleStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPageRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
index ea0517cd8a..369ef0801d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
@@ -44,8 +44,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSPrimitiveValue);
 
 static const HashTableValue JSCSSPrimitiveValueTableValues[3] =
 {
-    { "primitiveType", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValuePrimitiveType, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSPrimitiveValueConstructor, (intptr_t)0 },
+    { "primitiveType", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValuePrimitiveType), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -60,32 +60,32 @@ static JSC_CONST_HASHTABLE HashTable JSCSSPrimitiveValueTable =
 
 static const HashTableValue JSCSSPrimitiveValueConstructorTableValues[27] =
 {
-    { "CSS_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_UNKNOWN, (intptr_t)0 },
-    { "CSS_NUMBER", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_NUMBER, (intptr_t)0 },
-    { "CSS_PERCENTAGE", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PERCENTAGE, (intptr_t)0 },
-    { "CSS_EMS", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_EMS, (intptr_t)0 },
-    { "CSS_EXS", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_EXS, (intptr_t)0 },
-    { "CSS_PX", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PX, (intptr_t)0 },
-    { "CSS_CM", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_CM, (intptr_t)0 },
-    { "CSS_MM", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_MM, (intptr_t)0 },
-    { "CSS_IN", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_IN, (intptr_t)0 },
-    { "CSS_PT", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PT, (intptr_t)0 },
-    { "CSS_PC", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PC, (intptr_t)0 },
-    { "CSS_DEG", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_DEG, (intptr_t)0 },
-    { "CSS_RAD", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_RAD, (intptr_t)0 },
-    { "CSS_GRAD", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_GRAD, (intptr_t)0 },
-    { "CSS_MS", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_MS, (intptr_t)0 },
-    { "CSS_S", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_S, (intptr_t)0 },
-    { "CSS_HZ", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_HZ, (intptr_t)0 },
-    { "CSS_KHZ", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_KHZ, (intptr_t)0 },
-    { "CSS_DIMENSION", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_DIMENSION, (intptr_t)0 },
-    { "CSS_STRING", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_STRING, (intptr_t)0 },
-    { "CSS_URI", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_URI, (intptr_t)0 },
-    { "CSS_IDENT", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_IDENT, (intptr_t)0 },
-    { "CSS_ATTR", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_ATTR, (intptr_t)0 },
-    { "CSS_COUNTER", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_COUNTER, (intptr_t)0 },
-    { "CSS_RECT", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_RECT, (intptr_t)0 },
-    { "CSS_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_RGBCOLOR, (intptr_t)0 },
+    { "CSS_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_UNKNOWN), (intptr_t)0 },
+    { "CSS_NUMBER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_NUMBER), (intptr_t)0 },
+    { "CSS_PERCENTAGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PERCENTAGE), (intptr_t)0 },
+    { "CSS_EMS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_EMS), (intptr_t)0 },
+    { "CSS_EXS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_EXS), (intptr_t)0 },
+    { "CSS_PX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PX), (intptr_t)0 },
+    { "CSS_CM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_CM), (intptr_t)0 },
+    { "CSS_MM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_MM), (intptr_t)0 },
+    { "CSS_IN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_IN), (intptr_t)0 },
+    { "CSS_PT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PT), (intptr_t)0 },
+    { "CSS_PC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PC), (intptr_t)0 },
+    { "CSS_DEG", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_DEG), (intptr_t)0 },
+    { "CSS_RAD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_RAD), (intptr_t)0 },
+    { "CSS_GRAD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_GRAD), (intptr_t)0 },
+    { "CSS_MS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_MS), (intptr_t)0 },
+    { "CSS_S", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_S), (intptr_t)0 },
+    { "CSS_HZ", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_HZ), (intptr_t)0 },
+    { "CSS_KHZ", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_KHZ), (intptr_t)0 },
+    { "CSS_DIMENSION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_DIMENSION), (intptr_t)0 },
+    { "CSS_STRING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_STRING), (intptr_t)0 },
+    { "CSS_URI", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_URI), (intptr_t)0 },
+    { "CSS_IDENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_IDENT), (intptr_t)0 },
+    { "CSS_ATTR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_ATTR), (intptr_t)0 },
+    { "CSS_COUNTER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_COUNTER), (intptr_t)0 },
+    { "CSS_RECT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_RECT), (intptr_t)0 },
+    { "CSS_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_RGBCOLOR), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -110,7 +110,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -133,39 +133,39 @@ bool JSCSSPrimitiveValueConstructor::getOwnPropertyDescriptor(ExecState* exec, c
 
 static const HashTableValue JSCSSPrimitiveValuePrototypeTableValues[34] =
 {
-    { "CSS_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_UNKNOWN, (intptr_t)0 },
-    { "CSS_NUMBER", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_NUMBER, (intptr_t)0 },
-    { "CSS_PERCENTAGE", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PERCENTAGE, (intptr_t)0 },
-    { "CSS_EMS", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_EMS, (intptr_t)0 },
-    { "CSS_EXS", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_EXS, (intptr_t)0 },
-    { "CSS_PX", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PX, (intptr_t)0 },
-    { "CSS_CM", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_CM, (intptr_t)0 },
-    { "CSS_MM", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_MM, (intptr_t)0 },
-    { "CSS_IN", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_IN, (intptr_t)0 },
-    { "CSS_PT", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PT, (intptr_t)0 },
-    { "CSS_PC", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PC, (intptr_t)0 },
-    { "CSS_DEG", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_DEG, (intptr_t)0 },
-    { "CSS_RAD", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_RAD, (intptr_t)0 },
-    { "CSS_GRAD", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_GRAD, (intptr_t)0 },
-    { "CSS_MS", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_MS, (intptr_t)0 },
-    { "CSS_S", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_S, (intptr_t)0 },
-    { "CSS_HZ", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_HZ, (intptr_t)0 },
-    { "CSS_KHZ", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_KHZ, (intptr_t)0 },
-    { "CSS_DIMENSION", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_DIMENSION, (intptr_t)0 },
-    { "CSS_STRING", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_STRING, (intptr_t)0 },
-    { "CSS_URI", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_URI, (intptr_t)0 },
-    { "CSS_IDENT", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_IDENT, (intptr_t)0 },
-    { "CSS_ATTR", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_ATTR, (intptr_t)0 },
-    { "CSS_COUNTER", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_COUNTER, (intptr_t)0 },
-    { "CSS_RECT", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_RECT, (intptr_t)0 },
-    { "CSS_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_RGBCOLOR, (intptr_t)0 },
-    { "setFloatValue", DontDelete|Function, (intptr_t)jsCSSPrimitiveValuePrototypeFunctionSetFloatValue, (intptr_t)2 },
-    { "getFloatValue", DontDelete|Function, (intptr_t)jsCSSPrimitiveValuePrototypeFunctionGetFloatValue, (intptr_t)1 },
-    { "setStringValue", DontDelete|Function, (intptr_t)jsCSSPrimitiveValuePrototypeFunctionSetStringValue, (intptr_t)2 },
-    { "getStringValue", DontDelete|Function, (intptr_t)jsCSSPrimitiveValuePrototypeFunctionGetStringValue, (intptr_t)0 },
-    { "getCounterValue", DontDelete|Function, (intptr_t)jsCSSPrimitiveValuePrototypeFunctionGetCounterValue, (intptr_t)0 },
-    { "getRectValue", DontDelete|Function, (intptr_t)jsCSSPrimitiveValuePrototypeFunctionGetRectValue, (intptr_t)0 },
-    { "getRGBColorValue", DontDelete|Function, (intptr_t)jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue, (intptr_t)0 },
+    { "CSS_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_UNKNOWN), (intptr_t)0 },
+    { "CSS_NUMBER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_NUMBER), (intptr_t)0 },
+    { "CSS_PERCENTAGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PERCENTAGE), (intptr_t)0 },
+    { "CSS_EMS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_EMS), (intptr_t)0 },
+    { "CSS_EXS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_EXS), (intptr_t)0 },
+    { "CSS_PX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PX), (intptr_t)0 },
+    { "CSS_CM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_CM), (intptr_t)0 },
+    { "CSS_MM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_MM), (intptr_t)0 },
+    { "CSS_IN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_IN), (intptr_t)0 },
+    { "CSS_PT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PT), (intptr_t)0 },
+    { "CSS_PC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PC), (intptr_t)0 },
+    { "CSS_DEG", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_DEG), (intptr_t)0 },
+    { "CSS_RAD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_RAD), (intptr_t)0 },
+    { "CSS_GRAD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_GRAD), (intptr_t)0 },
+    { "CSS_MS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_MS), (intptr_t)0 },
+    { "CSS_S", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_S), (intptr_t)0 },
+    { "CSS_HZ", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_HZ), (intptr_t)0 },
+    { "CSS_KHZ", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_KHZ), (intptr_t)0 },
+    { "CSS_DIMENSION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_DIMENSION), (intptr_t)0 },
+    { "CSS_STRING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_STRING), (intptr_t)0 },
+    { "CSS_URI", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_URI), (intptr_t)0 },
+    { "CSS_IDENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_IDENT), (intptr_t)0 },
+    { "CSS_ATTR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_ATTR), (intptr_t)0 },
+    { "CSS_COUNTER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_COUNTER), (intptr_t)0 },
+    { "CSS_RECT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_RECT), (intptr_t)0 },
+    { "CSS_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_RGBCOLOR), (intptr_t)0 },
+    { "setFloatValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSPrimitiveValuePrototypeFunctionSetFloatValue), (intptr_t)2 },
+    { "getFloatValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSPrimitiveValuePrototypeFunctionGetFloatValue), (intptr_t)1 },
+    { "setStringValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSPrimitiveValuePrototypeFunctionSetStringValue), (intptr_t)2 },
+    { "getStringValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSPrimitiveValuePrototypeFunctionGetStringValue), (intptr_t)0 },
+    { "getCounterValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSPrimitiveValuePrototypeFunctionGetCounterValue), (intptr_t)0 },
+    { "getRectValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSPrimitiveValuePrototypeFunctionGetRectValue), (intptr_t)0 },
+    { "getRGBColorValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -215,17 +215,18 @@ bool JSCSSPrimitiveValue::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSCSSPrimitiveValue, Base>(exec, &JSCSSPrimitiveValueTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSPrimitiveValuePrimitiveType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPrimitiveValuePrimitiveType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSPrimitiveValue* castedThis = static_cast<JSCSSPrimitiveValue*>(asObject(slot.slotBase()));
+    JSCSSPrimitiveValue* castedThis = static_cast<JSCSSPrimitiveValue*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThis->impl());
-    return jsNumber(exec, imp->primitiveType());
+    JSValue result = jsNumber(exec, imp->primitiveType());
+    return result;
 }
 
-JSValue jsCSSPrimitiveValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPrimitiveValueConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSPrimitiveValue* domObject = static_cast<JSCSSPrimitiveValue*>(asObject(slot.slotBase()));
+    JSCSSPrimitiveValue* domObject = static_cast<JSCSSPrimitiveValue*>(asObject(slotBase));
     return JSCSSPrimitiveValue::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCSSPrimitiveValue::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -343,132 +344,132 @@ JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue(ExecS
 
 // Constant getters
 
-JSValue jsCSSPrimitiveValueCSS_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsCSSPrimitiveValueCSS_NUMBER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_NUMBER(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsCSSPrimitiveValueCSS_PERCENTAGE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PERCENTAGE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsCSSPrimitiveValueCSS_EMS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_EMS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsCSSPrimitiveValueCSS_EXS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_EXS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsCSSPrimitiveValueCSS_PX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PX(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValue jsCSSPrimitiveValueCSS_CM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_CM(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValue jsCSSPrimitiveValueCSS_MM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_MM(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValue jsCSSPrimitiveValueCSS_IN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_IN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValue jsCSSPrimitiveValueCSS_PT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValue jsCSSPrimitiveValueCSS_PC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PC(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValue jsCSSPrimitiveValueCSS_DEG(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_DEG(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
-JSValue jsCSSPrimitiveValueCSS_RAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_RAD(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(12));
 }
 
-JSValue jsCSSPrimitiveValueCSS_GRAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_GRAD(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(13));
 }
 
-JSValue jsCSSPrimitiveValueCSS_MS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_MS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(14));
 }
 
-JSValue jsCSSPrimitiveValueCSS_S(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_S(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(15));
 }
 
-JSValue jsCSSPrimitiveValueCSS_HZ(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_HZ(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValue jsCSSPrimitiveValueCSS_KHZ(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_KHZ(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(17));
 }
 
-JSValue jsCSSPrimitiveValueCSS_DIMENSION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_DIMENSION(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(18));
 }
 
-JSValue jsCSSPrimitiveValueCSS_STRING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_STRING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(19));
 }
 
-JSValue jsCSSPrimitiveValueCSS_URI(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_URI(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(20));
 }
 
-JSValue jsCSSPrimitiveValueCSS_IDENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_IDENT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(21));
 }
 
-JSValue jsCSSPrimitiveValueCSS_ATTR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_ATTR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(22));
 }
 
-JSValue jsCSSPrimitiveValueCSS_COUNTER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_COUNTER(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(23));
 }
 
-JSValue jsCSSPrimitiveValueCSS_RECT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_RECT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(24));
 }
 
-JSValue jsCSSPrimitiveValueCSS_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_RGBCOLOR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(25));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
index c015d4cdd6..124ecef5fb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSPrimitiveValuePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -76,36 +76,36 @@ JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRectValue(JSC:
 JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCSSPrimitiveValuePrimitiveType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValuePrimitiveType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsCSSPrimitiveValueCSS_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_NUMBER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_PERCENTAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_EMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_EXS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_PX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_CM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_MM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_PT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_PC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_DEG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_RAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_GRAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_MS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_S(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_HZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_KHZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_DIMENSION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_STRING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_URI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_IDENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_ATTR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_COUNTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_RECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_NUMBER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PERCENTAGE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_EMS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_EXS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_CM(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_MM(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_IN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PC(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_DEG(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_RAD(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_GRAD(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_MS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_S(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_HZ(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_KHZ(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_DIMENSION(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_STRING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_URI(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_IDENT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_ATTR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_COUNTER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_RECT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_RGBCOLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
index 8d9905610e..cb24a1211d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
@@ -39,11 +39,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSRule);
 
 static const HashTableValue JSCSSRuleTableValues[6] =
 {
-    { "type", DontDelete|ReadOnly, (intptr_t)jsCSSRuleType, (intptr_t)0 },
-    { "cssText", DontDelete, (intptr_t)jsCSSRuleCssText, (intptr_t)setJSCSSRuleCssText },
-    { "parentStyleSheet", DontDelete|ReadOnly, (intptr_t)jsCSSRuleParentStyleSheet, (intptr_t)0 },
-    { "parentRule", DontDelete|ReadOnly, (intptr_t)jsCSSRuleParentRule, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSRuleConstructor, (intptr_t)0 },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleType), (intptr_t)0 },
+    { "cssText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleCssText), (intptr_t)setJSCSSRuleCssText },
+    { "parentStyleSheet", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleParentStyleSheet), (intptr_t)0 },
+    { "parentRule", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleParentRule), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -58,16 +58,16 @@ static JSC_CONST_HASHTABLE HashTable JSCSSRuleTable =
 
 static const HashTableValue JSCSSRuleConstructorTableValues[11] =
 {
-    { "UNKNOWN_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleUNKNOWN_RULE, (intptr_t)0 },
-    { "STYLE_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleSTYLE_RULE, (intptr_t)0 },
-    { "CHARSET_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleCHARSET_RULE, (intptr_t)0 },
-    { "IMPORT_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleIMPORT_RULE, (intptr_t)0 },
-    { "MEDIA_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleMEDIA_RULE, (intptr_t)0 },
-    { "FONT_FACE_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleFONT_FACE_RULE, (intptr_t)0 },
-    { "PAGE_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRulePAGE_RULE, (intptr_t)0 },
-    { "VARIABLES_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleVARIABLES_RULE, (intptr_t)0 },
-    { "WEBKIT_KEYFRAMES_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleWEBKIT_KEYFRAMES_RULE, (intptr_t)0 },
-    { "WEBKIT_KEYFRAME_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleWEBKIT_KEYFRAME_RULE, (intptr_t)0 },
+    { "UNKNOWN_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleUNKNOWN_RULE), (intptr_t)0 },
+    { "STYLE_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleSTYLE_RULE), (intptr_t)0 },
+    { "CHARSET_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleCHARSET_RULE), (intptr_t)0 },
+    { "IMPORT_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleIMPORT_RULE), (intptr_t)0 },
+    { "MEDIA_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleMEDIA_RULE), (intptr_t)0 },
+    { "FONT_FACE_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleFONT_FACE_RULE), (intptr_t)0 },
+    { "PAGE_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRulePAGE_RULE), (intptr_t)0 },
+    { "VARIABLES_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleVARIABLES_RULE), (intptr_t)0 },
+    { "WEBKIT_KEYFRAMES_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleWEBKIT_KEYFRAMES_RULE), (intptr_t)0 },
+    { "WEBKIT_KEYFRAME_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleWEBKIT_KEYFRAME_RULE), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -92,7 +92,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -115,16 +115,16 @@ bool JSCSSRuleConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ident
 
 static const HashTableValue JSCSSRulePrototypeTableValues[11] =
 {
-    { "UNKNOWN_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleUNKNOWN_RULE, (intptr_t)0 },
-    { "STYLE_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleSTYLE_RULE, (intptr_t)0 },
-    { "CHARSET_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleCHARSET_RULE, (intptr_t)0 },
-    { "IMPORT_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleIMPORT_RULE, (intptr_t)0 },
-    { "MEDIA_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleMEDIA_RULE, (intptr_t)0 },
-    { "FONT_FACE_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleFONT_FACE_RULE, (intptr_t)0 },
-    { "PAGE_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRulePAGE_RULE, (intptr_t)0 },
-    { "VARIABLES_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleVARIABLES_RULE, (intptr_t)0 },
-    { "WEBKIT_KEYFRAMES_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleWEBKIT_KEYFRAMES_RULE, (intptr_t)0 },
-    { "WEBKIT_KEYFRAME_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleWEBKIT_KEYFRAME_RULE, (intptr_t)0 },
+    { "UNKNOWN_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleUNKNOWN_RULE), (intptr_t)0 },
+    { "STYLE_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleSTYLE_RULE), (intptr_t)0 },
+    { "CHARSET_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleCHARSET_RULE), (intptr_t)0 },
+    { "IMPORT_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleIMPORT_RULE), (intptr_t)0 },
+    { "MEDIA_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleMEDIA_RULE), (intptr_t)0 },
+    { "FONT_FACE_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleFONT_FACE_RULE), (intptr_t)0 },
+    { "PAGE_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRulePAGE_RULE), (intptr_t)0 },
+    { "VARIABLES_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleVARIABLES_RULE), (intptr_t)0 },
+    { "WEBKIT_KEYFRAMES_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleWEBKIT_KEYFRAMES_RULE), (intptr_t)0 },
+    { "WEBKIT_KEYFRAME_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleWEBKIT_KEYFRAME_RULE), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -180,41 +180,45 @@ bool JSCSSRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return getStaticValueDescriptor<JSCSSRule, Base>(exec, &JSCSSRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSRuleType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slot.slotBase()));
+    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(castedThis->impl());
-    return jsNumber(exec, imp->type());
+    JSValue result = jsNumber(exec, imp->type());
+    return result;
 }
 
-JSValue jsCSSRuleCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleCssText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slot.slotBase()));
+    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->cssText());
+    JSValue result = jsStringOrNull(exec, imp->cssText());
+    return result;
 }
 
-JSValue jsCSSRuleParentStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleParentStyleSheet(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slot.slotBase()));
+    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentStyleSheet()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentStyleSheet()));
+    return result;
 }
 
-JSValue jsCSSRuleParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleParentRule(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slot.slotBase()));
+    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentRule()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentRule()));
+    return result;
 }
 
-JSValue jsCSSRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSRule* domObject = static_cast<JSCSSRule*>(asObject(slot.slotBase()));
+    JSCSSRule* domObject = static_cast<JSCSSRule*>(asObject(slotBase));
     return JSCSSRule::getConstructor(exec, domObject->globalObject());
 }
 void JSCSSRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -224,7 +228,8 @@ void JSCSSRule::put(ExecState* exec, const Identifier& propertyName, JSValue val
 
 void setJSCSSRuleCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CSSRule* imp = static_cast<CSSRule*>(static_cast<JSCSSRule*>(thisObject)->impl());
+    JSCSSRule* castedThisObj = static_cast<JSCSSRule*>(thisObject);
+    CSSRule* imp = static_cast<CSSRule*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setCssText(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -237,52 +242,52 @@ JSValue JSCSSRule::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 
 // Constant getters
 
-JSValue jsCSSRuleUNKNOWN_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleUNKNOWN_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsCSSRuleSTYLE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleSTYLE_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsCSSRuleCHARSET_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleCHARSET_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsCSSRuleIMPORT_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleIMPORT_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsCSSRuleMEDIA_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleMEDIA_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsCSSRuleFONT_FACE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleFONT_FACE_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValue jsCSSRulePAGE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRulePAGE_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValue jsCSSRuleVARIABLES_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleVARIABLES_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValue jsCSSRuleWEBKIT_KEYFRAMES_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleWEBKIT_KEYFRAMES_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValue jsCSSRuleWEBKIT_KEYFRAME_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleWEBKIT_KEYFRAME_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
index afc609c0a5..59f509a7a6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
@@ -21,7 +21,6 @@
 #ifndef JSCSSRule_h
 #define JSCSSRule_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -69,7 +68,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,24 +77,24 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSRuleType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleCssText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCSSRuleCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCSSRuleParentStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleParentStyleSheet(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleParentRule(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsCSSRuleUNKNOWN_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleSTYLE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleCHARSET_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleIMPORT_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleMEDIA_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleFONT_FACE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRulePAGE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleVARIABLES_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleWEBKIT_KEYFRAMES_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleWEBKIT_KEYFRAME_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleUNKNOWN_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleSTYLE_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleCHARSET_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleIMPORT_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleMEDIA_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleFONT_FACE_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRulePAGE_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleVARIABLES_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleWEBKIT_KEYFRAMES_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleWEBKIT_KEYFRAME_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
index 0bb58c2212..9cb7f1d379 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
@@ -39,8 +39,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSRuleList);
 
 static const HashTableValue JSCSSRuleListTableValues[3] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsCSSRuleListLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSRuleListConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleListLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -102,7 +102,7 @@ bool JSCSSRuleListConstructor::getOwnPropertyDescriptor(ExecState* exec, const I
 
 static const HashTableValue JSCSSRuleListPrototypeTableValues[2] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsCSSRuleListPrototypeFunctionItem, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSRuleListPrototypeFunctionItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -193,24 +193,25 @@ bool JSCSSRuleList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, P
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsCSSRuleListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleListLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSRuleList* castedThis = static_cast<JSCSSRuleList*>(asObject(slot.slotBase()));
+    JSCSSRuleList* castedThis = static_cast<JSCSSRuleList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSRuleList* imp = static_cast<CSSRuleList*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsCSSRuleListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSRuleList* domObject = static_cast<JSCSSRuleList*>(asObject(slot.slotBase()));
+    JSCSSRuleList* domObject = static_cast<JSCSSRuleList*>(asObject(slotBase));
     return JSCSSRuleList::getConstructor(exec, domObject->globalObject());
 }
-void JSCSSRuleList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSCSSRuleList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<CSSRuleList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSCSSRuleList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -233,10 +234,10 @@ JSValue JSC_HOST_CALL jsCSSRuleListPrototypeFunctionItem(ExecState* exec, JSObje
 }
 
 
-JSValue JSCSSRuleList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSCSSRuleList::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSCSSRuleList* thisObj = static_cast<JSCSSRuleList*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<CSSRuleList*>(thisObj->impl())->item(slot.index()));
+    JSCSSRuleList* thisObj = static_cast<JSCSSRuleList*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<CSSRuleList*>(thisObj->impl())->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CSSRuleList* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
index 8b4a59d370..dc9acb5bdc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
@@ -21,7 +21,6 @@
 #ifndef JSCSSRuleList_h
 #define JSCSSRuleList_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,12 +43,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     CSSRuleList* impl() const { return m_impl.get(); }
 
@@ -57,7 +56,7 @@ private:
     RefPtr<CSSRuleList> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CSSRuleList*);
@@ -73,7 +72,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSRuleListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -85,8 +84,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsCSSRuleListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCSSRuleListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleListLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
index 5fbf98695d..9195aefa80 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
@@ -31,6 +31,7 @@
 #include "KURL.h"
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
 #include <runtime/PropertyNameArray.h>
 #include <wtf/GetPtr.h>
 
@@ -44,10 +45,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleDeclaration);
 
 static const HashTableValue JSCSSStyleDeclarationTableValues[5] =
 {
-    { "cssText", DontDelete, (intptr_t)jsCSSStyleDeclarationCssText, (intptr_t)setJSCSSStyleDeclarationCssText },
-    { "length", DontDelete|ReadOnly, (intptr_t)jsCSSStyleDeclarationLength, (intptr_t)0 },
-    { "parentRule", DontDelete|ReadOnly, (intptr_t)jsCSSStyleDeclarationParentRule, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSStyleDeclarationConstructor, (intptr_t)0 },
+    { "cssText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleDeclarationCssText), (intptr_t)setJSCSSStyleDeclarationCssText },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleDeclarationLength), (intptr_t)0 },
+    { "parentRule", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleDeclarationParentRule), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleDeclarationConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -86,7 +87,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -109,14 +110,14 @@ bool JSCSSStyleDeclarationConstructor::getOwnPropertyDescriptor(ExecState* exec,
 
 static const HashTableValue JSCSSStyleDeclarationPrototypeTableValues[9] =
 {
-    { "getPropertyValue", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue, (intptr_t)1 },
-    { "getPropertyCSSValue", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValue, (intptr_t)1 },
-    { "removeProperty", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionRemoveProperty, (intptr_t)1 },
-    { "getPropertyPriority", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriority, (intptr_t)1 },
-    { "setProperty", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionSetProperty, (intptr_t)3 },
-    { "item", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionItem, (intptr_t)1 },
-    { "getPropertyShorthand", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthand, (intptr_t)1 },
-    { "isPropertyImplicit", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit, (intptr_t)1 },
+    { "getPropertyValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue), (intptr_t)1 },
+    { "getPropertyCSSValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValue), (intptr_t)1 },
+    { "removeProperty", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionRemoveProperty), (intptr_t)1 },
+    { "getPropertyPriority", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriority), (intptr_t)1 },
+    { "setProperty", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionSetProperty), (intptr_t)3 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionItem), (intptr_t)1 },
+    { "getPropertyShorthand", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthand), (intptr_t)1 },
+    { "isPropertyImplicit", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -171,7 +172,7 @@ bool JSCSSStyleDeclaration::getOwnPropertySlot(ExecState* exec, const Identifier
     }
     bool ok;
     unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CSSStyleDeclaration*>(impl())->length()) {
+    if (ok) {
         slot.setCustomIndex(this, index, indexGetter);
         return true;
     }
@@ -217,33 +218,36 @@ bool JSCSSStyleDeclaration::getOwnPropertySlot(ExecState* exec, unsigned propert
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsCSSStyleDeclarationCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationCssText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleDeclaration* castedThis = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
+    JSCSSStyleDeclaration* castedThis = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->cssText());
+    JSValue result = jsStringOrNull(exec, imp->cssText());
+    return result;
 }
 
-JSValue jsCSSStyleDeclarationLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleDeclaration* castedThis = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
+    JSCSSStyleDeclaration* castedThis = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsCSSStyleDeclarationParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationParentRule(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleDeclaration* castedThis = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
+    JSCSSStyleDeclaration* castedThis = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentRule()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentRule()));
+    return result;
 }
 
-JSValue jsCSSStyleDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleDeclaration* domObject = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
+    JSCSSStyleDeclaration* domObject = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
     return JSCSSStyleDeclaration::getConstructor(exec, domObject->globalObject());
 }
 void JSCSSStyleDeclaration::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -255,17 +259,18 @@ void JSCSSStyleDeclaration::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSCSSStyleDeclarationCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(static_cast<JSCSSStyleDeclaration*>(thisObject)->impl());
+    JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(thisObject);
+    CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setCssText(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
 }
 
-void JSCSSStyleDeclaration::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSCSSStyleDeclaration::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<CSSStyleDeclaration*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSCSSStyleDeclaration::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -358,7 +363,7 @@ JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionItem(ExecState* exec
     unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValue result = jsStringOrNull(exec, imp->item(index));
+    JSC::JSValue result = jsString(exec, imp->item(index));
     return result;
 }
 
@@ -391,10 +396,10 @@ JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit(E
 }
 
 
-JSValue JSCSSStyleDeclaration::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSCSSStyleDeclaration::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
-    return jsStringOrNull(exec, thisObj->impl()->item(slot.index()));
+    JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
+    return jsStringOrNull(exec, thisObj->impl()->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CSSStyleDeclaration* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
index 48c6a9b8d9..6372894235 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
@@ -21,7 +21,6 @@
 #ifndef JSCSSStyleDeclaration_h
 #define JSCSSStyleDeclaration_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -46,12 +45,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     CSSStyleDeclaration* impl() const { return m_impl.get(); }
 
@@ -59,10 +58,10 @@ private:
     RefPtr<CSSStyleDeclaration> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 private:
     static bool canGetItemsForName(JSC::ExecState*, CSSStyleDeclaration*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CSSStyleDeclaration*);
@@ -78,7 +77,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSStyleDeclarationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -97,11 +96,11 @@ JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyShor
 JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCSSStyleDeclarationCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleDeclarationCssText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCSSStyleDeclarationCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCSSStyleDeclarationLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSStyleDeclarationParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSStyleDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleDeclarationLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSStyleDeclarationParentRule(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSStyleDeclarationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
index d44bb5c383..28d9dc7c95 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
@@ -38,9 +38,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleRule);
 
 static const HashTableValue JSCSSStyleRuleTableValues[4] =
 {
-    { "selectorText", DontDelete, (intptr_t)jsCSSStyleRuleSelectorText, (intptr_t)setJSCSSStyleRuleSelectorText },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsCSSStyleRuleStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSStyleRuleConstructor, (intptr_t)0 },
+    { "selectorText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleRuleSelectorText), (intptr_t)setJSCSSStyleRuleSelectorText },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleRuleStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -141,25 +141,27 @@ bool JSCSSStyleRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSCSSStyleRule, Base>(exec, &JSCSSStyleRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSStyleRuleSelectorText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleRuleSelectorText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleRule* castedThis = static_cast<JSCSSStyleRule*>(asObject(slot.slotBase()));
+    JSCSSStyleRule* castedThis = static_cast<JSCSSStyleRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleRule* imp = static_cast<CSSStyleRule*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->selectorText());
+    JSValue result = jsStringOrNull(exec, imp->selectorText());
+    return result;
 }
 
-JSValue jsCSSStyleRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleRuleStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleRule* castedThis = static_cast<JSCSSStyleRule*>(asObject(slot.slotBase()));
+    JSCSSStyleRule* castedThis = static_cast<JSCSSStyleRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleRule* imp = static_cast<CSSStyleRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsCSSStyleRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleRule* domObject = static_cast<JSCSSStyleRule*>(asObject(slot.slotBase()));
+    JSCSSStyleRule* domObject = static_cast<JSCSSStyleRule*>(asObject(slotBase));
     return JSCSSStyleRule::getConstructor(exec, domObject->globalObject());
 }
 void JSCSSStyleRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -169,7 +171,8 @@ void JSCSSStyleRule::put(ExecState* exec, const Identifier& propertyName, JSValu
 
 void setJSCSSStyleRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CSSStyleRule* imp = static_cast<CSSStyleRule*>(static_cast<JSCSSStyleRule*>(thisObject)->impl());
+    JSCSSStyleRule* castedThisObj = static_cast<JSCSSStyleRule*>(thisObject);
+    CSSStyleRule* imp = static_cast<CSSStyleRule*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setSelectorText(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
index fc72cbfcaf..10cff11bf2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSStyleRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,10 +66,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSStyleRuleSelectorText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleRuleSelectorText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCSSStyleRuleSelectorText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCSSStyleRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSStyleRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleRuleStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSStyleRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
index e2d45bc6e4..881ae804a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
@@ -40,10 +40,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleSheet);
 
 static const HashTableValue JSCSSStyleSheetTableValues[5] =
 {
-    { "ownerRule", DontDelete|ReadOnly, (intptr_t)jsCSSStyleSheetOwnerRule, (intptr_t)0 },
-    { "cssRules", DontDelete|ReadOnly, (intptr_t)jsCSSStyleSheetCssRules, (intptr_t)0 },
-    { "rules", DontDelete|ReadOnly, (intptr_t)jsCSSStyleSheetRules, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSStyleSheetConstructor, (intptr_t)0 },
+    { "ownerRule", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleSheetOwnerRule), (intptr_t)0 },
+    { "cssRules", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleSheetCssRules), (intptr_t)0 },
+    { "rules", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleSheetRules), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleSheetConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -82,7 +82,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -105,10 +105,10 @@ bool JSCSSStyleSheetConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSCSSStyleSheetPrototypeTableValues[5] =
 {
-    { "insertRule", DontDelete|Function, (intptr_t)jsCSSStyleSheetPrototypeFunctionInsertRule, (intptr_t)2 },
-    { "deleteRule", DontDelete|Function, (intptr_t)jsCSSStyleSheetPrototypeFunctionDeleteRule, (intptr_t)1 },
-    { "addRule", DontDelete|Function, (intptr_t)jsCSSStyleSheetPrototypeFunctionAddRule, (intptr_t)3 },
-    { "removeRule", DontDelete|Function, (intptr_t)jsCSSStyleSheetPrototypeFunctionRemoveRule, (intptr_t)1 },
+    { "insertRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleSheetPrototypeFunctionInsertRule), (intptr_t)2 },
+    { "deleteRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleSheetPrototypeFunctionDeleteRule), (intptr_t)1 },
+    { "addRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleSheetPrototypeFunctionAddRule), (intptr_t)3 },
+    { "removeRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleSheetPrototypeFunctionRemoveRule), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -158,33 +158,36 @@ bool JSCSSStyleSheet::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSCSSStyleSheet, Base>(exec, &JSCSSStyleSheetTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSStyleSheetOwnerRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetOwnerRule(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleSheet* castedThis = static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()));
+    JSCSSStyleSheet* castedThis = static_cast<JSCSSStyleSheet*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->ownerRule()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->ownerRule()));
+    return result;
 }
 
-JSValue jsCSSStyleSheetCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetCssRules(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleSheet* castedThis = static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()));
+    JSCSSStyleSheet* castedThis = static_cast<JSCSSStyleSheet*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->cssRules()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->cssRules()));
+    return result;
 }
 
-JSValue jsCSSStyleSheetRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetRules(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleSheet* castedThis = static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()));
+    JSCSSStyleSheet* castedThis = static_cast<JSCSSStyleSheet*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->rules()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->rules()));
+    return result;
 }
 
-JSValue jsCSSStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleSheet* domObject = static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()));
+    JSCSSStyleSheet* domObject = static_cast<JSCSSStyleSheet*>(asObject(slotBase));
     return JSCSSStyleSheet::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCSSStyleSheet::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
index 4df8ea3a81..a577b0b6ee 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSStyleSheetPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,10 +73,10 @@ JSC::JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionAddRule(JSC::ExecStat
 JSC::JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionRemoveRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCSSStyleSheetOwnerRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSStyleSheetCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSStyleSheetRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleSheetOwnerRule(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSStyleSheetCssRules(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSStyleSheetRules(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSStyleSheetConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
index 1cb1b7582c..bd0d76813f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
@@ -36,9 +36,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSValue);
 
 static const HashTableValue JSCSSValueTableValues[4] =
 {
-    { "cssText", DontDelete, (intptr_t)jsCSSValueCssText, (intptr_t)setJSCSSValueCssText },
-    { "cssValueType", DontDelete|ReadOnly, (intptr_t)jsCSSValueCssValueType, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSValueConstructor, (intptr_t)0 },
+    { "cssText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCssText), (intptr_t)setJSCSSValueCssText },
+    { "cssValueType", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCssValueType), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -53,10 +53,10 @@ static JSC_CONST_HASHTABLE HashTable JSCSSValueTable =
 
 static const HashTableValue JSCSSValueConstructorTableValues[5] =
 {
-    { "CSS_INHERIT", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_INHERIT, (intptr_t)0 },
-    { "CSS_PRIMITIVE_VALUE", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_PRIMITIVE_VALUE, (intptr_t)0 },
-    { "CSS_VALUE_LIST", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_VALUE_LIST, (intptr_t)0 },
-    { "CSS_CUSTOM", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_CUSTOM, (intptr_t)0 },
+    { "CSS_INHERIT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_INHERIT), (intptr_t)0 },
+    { "CSS_PRIMITIVE_VALUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_PRIMITIVE_VALUE), (intptr_t)0 },
+    { "CSS_VALUE_LIST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_VALUE_LIST), (intptr_t)0 },
+    { "CSS_CUSTOM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_CUSTOM), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -104,10 +104,10 @@ bool JSCSSValueConstructor::getOwnPropertyDescriptor(ExecState* exec, const Iden
 
 static const HashTableValue JSCSSValuePrototypeTableValues[5] =
 {
-    { "CSS_INHERIT", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_INHERIT, (intptr_t)0 },
-    { "CSS_PRIMITIVE_VALUE", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_PRIMITIVE_VALUE, (intptr_t)0 },
-    { "CSS_VALUE_LIST", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_VALUE_LIST, (intptr_t)0 },
-    { "CSS_CUSTOM", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_CUSTOM, (intptr_t)0 },
+    { "CSS_INHERIT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_INHERIT), (intptr_t)0 },
+    { "CSS_PRIMITIVE_VALUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_PRIMITIVE_VALUE), (intptr_t)0 },
+    { "CSS_VALUE_LIST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_VALUE_LIST), (intptr_t)0 },
+    { "CSS_CUSTOM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_CUSTOM), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -163,25 +163,27 @@ bool JSCSSValue::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     return getStaticValueDescriptor<JSCSSValue, Base>(exec, &JSCSSValueTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSValueCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueCssText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSValue* castedThis = static_cast<JSCSSValue*>(asObject(slot.slotBase()));
+    JSCSSValue* castedThis = static_cast<JSCSSValue*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSValue* imp = static_cast<CSSValue*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->cssText());
+    JSValue result = jsStringOrNull(exec, imp->cssText());
+    return result;
 }
 
-JSValue jsCSSValueCssValueType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueCssValueType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSValue* castedThis = static_cast<JSCSSValue*>(asObject(slot.slotBase()));
+    JSCSSValue* castedThis = static_cast<JSCSSValue*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSValue* imp = static_cast<CSSValue*>(castedThis->impl());
-    return jsNumber(exec, imp->cssValueType());
+    JSValue result = jsNumber(exec, imp->cssValueType());
+    return result;
 }
 
-JSValue jsCSSValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSValue* domObject = static_cast<JSCSSValue*>(asObject(slot.slotBase()));
+    JSCSSValue* domObject = static_cast<JSCSSValue*>(asObject(slotBase));
     return JSCSSValue::getConstructor(exec, domObject->globalObject());
 }
 void JSCSSValue::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -191,7 +193,8 @@ void JSCSSValue::put(ExecState* exec, const Identifier& propertyName, JSValue va
 
 void setJSCSSValueCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CSSValue* imp = static_cast<CSSValue*>(static_cast<JSCSSValue*>(thisObject)->impl());
+    JSCSSValue* castedThisObj = static_cast<JSCSSValue*>(thisObject);
+    CSSValue* imp = static_cast<CSSValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setCssText(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -204,22 +207,22 @@ JSValue JSCSSValue::getConstructor(ExecState* exec, JSGlobalObject* globalObject
 
 // Constant getters
 
-JSValue jsCSSValueCSS_INHERIT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_INHERIT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsCSSValueCSS_PRIMITIVE_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_PRIMITIVE_VALUE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsCSSValueCSS_VALUE_LIST(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_VALUE_LIST(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsCSSValueCSS_CUSTOM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_CUSTOM(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
index cd54be1b29..25d6435342 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
@@ -21,7 +21,6 @@
 #ifndef JSCSSValue_h
 #define JSCSSValue_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -69,7 +68,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSValuePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,16 +77,16 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSValueCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCssText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCSSValueCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCSSValueCssValueType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCssValueType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSValueConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsCSSValueCSS_INHERIT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSValueCSS_PRIMITIVE_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSValueCSS_VALUE_LIST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSValueCSS_CUSTOM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCSS_INHERIT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSValueCSS_PRIMITIVE_VALUE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSValueCSS_VALUE_LIST(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSValueCSS_CUSTOM(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
index 3e78786db2..eb00df59b3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
@@ -39,8 +39,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSValueList);
 
 static const HashTableValue JSCSSValueListTableValues[3] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsCSSValueListLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSValueListConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueListLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -102,7 +102,7 @@ bool JSCSSValueListConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSCSSValueListPrototypeTableValues[2] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsCSSValueListPrototypeFunctionItem, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSValueListPrototypeFunctionItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -187,24 +187,25 @@ bool JSCSSValueList::getOwnPropertySlot(ExecState* exec, unsigned propertyName,
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsCSSValueListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueListLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSValueList* castedThis = static_cast<JSCSSValueList*>(asObject(slot.slotBase()));
+    JSCSSValueList* castedThis = static_cast<JSCSSValueList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSValueList* imp = static_cast<CSSValueList*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsCSSValueListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSValueList* domObject = static_cast<JSCSSValueList*>(asObject(slot.slotBase()));
+    JSCSSValueList* domObject = static_cast<JSCSSValueList*>(asObject(slotBase));
     return JSCSSValueList::getConstructor(exec, domObject->globalObject());
 }
-void JSCSSValueList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSCSSValueList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<CSSValueList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSCSSValueList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -227,10 +228,10 @@ JSValue JSC_HOST_CALL jsCSSValueListPrototypeFunctionItem(ExecState* exec, JSObj
 }
 
 
-JSValue JSCSSValueList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSCSSValueList::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSCSSValueList* thisObj = static_cast<JSCSSValueList*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<CSSValueList*>(thisObj->impl())->item(slot.index()));
+    JSCSSValueList* thisObj = static_cast<JSCSSValueList*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<CSSValueList*>(thisObj->impl())->item(index));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
index c57887e9c0..9521200c14 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
@@ -40,14 +40,14 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 };
 
 
@@ -61,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSValueListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,8 +73,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsCSSValueListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCSSValueListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSValueListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueListLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSValueListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
index 975d56dce6..be86d72372 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
@@ -41,10 +41,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSVariablesDeclaration);
 
 static const HashTableValue JSCSSVariablesDeclarationTableValues[5] =
 {
-    { "cssText", DontDelete, (intptr_t)jsCSSVariablesDeclarationCssText, (intptr_t)setJSCSSVariablesDeclarationCssText },
-    { "length", DontDelete|ReadOnly, (intptr_t)jsCSSVariablesDeclarationLength, (intptr_t)0 },
-    { "parentRule", DontDelete|ReadOnly, (intptr_t)jsCSSVariablesDeclarationParentRule, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSVariablesDeclarationConstructor, (intptr_t)0 },
+    { "cssText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSVariablesDeclarationCssText), (intptr_t)setJSCSSVariablesDeclarationCssText },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSVariablesDeclarationLength), (intptr_t)0 },
+    { "parentRule", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSVariablesDeclarationParentRule), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSVariablesDeclarationConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -83,7 +83,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -106,10 +106,10 @@ bool JSCSSVariablesDeclarationConstructor::getOwnPropertyDescriptor(ExecState* e
 
 static const HashTableValue JSCSSVariablesDeclarationPrototypeTableValues[5] =
 {
-    { "getVariableValue", DontDelete|Function, (intptr_t)jsCSSVariablesDeclarationPrototypeFunctionGetVariableValue, (intptr_t)1 },
-    { "removeVariable", DontDelete|Function, (intptr_t)jsCSSVariablesDeclarationPrototypeFunctionRemoveVariable, (intptr_t)1 },
-    { "setVariable", DontDelete|Function, (intptr_t)jsCSSVariablesDeclarationPrototypeFunctionSetVariable, (intptr_t)2 },
-    { "item", DontDelete|Function, (intptr_t)jsCSSVariablesDeclarationPrototypeFunctionItem, (intptr_t)1 },
+    { "getVariableValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSVariablesDeclarationPrototypeFunctionGetVariableValue), (intptr_t)1 },
+    { "removeVariable", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSVariablesDeclarationPrototypeFunctionRemoveVariable), (intptr_t)1 },
+    { "setVariable", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSVariablesDeclarationPrototypeFunctionSetVariable), (intptr_t)2 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSVariablesDeclarationPrototypeFunctionItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -164,7 +164,7 @@ bool JSCSSVariablesDeclaration::getOwnPropertySlot(ExecState* exec, const Identi
     }
     bool ok;
     unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CSSVariablesDeclaration*>(impl())->length()) {
+    if (ok) {
         slot.setCustomIndex(this, index, indexGetter);
         return true;
     }
@@ -200,33 +200,36 @@ bool JSCSSVariablesDeclaration::getOwnPropertySlot(ExecState* exec, unsigned pro
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsCSSVariablesDeclarationCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationCssText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSVariablesDeclaration* castedThis = static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()));
+    JSCSSVariablesDeclaration* castedThis = static_cast<JSCSSVariablesDeclaration*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThis->impl());
-    return jsString(exec, imp->cssText());
+    JSValue result = jsString(exec, imp->cssText());
+    return result;
 }
 
-JSValue jsCSSVariablesDeclarationLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSVariablesDeclaration* castedThis = static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()));
+    JSCSSVariablesDeclaration* castedThis = static_cast<JSCSSVariablesDeclaration*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsCSSVariablesDeclarationParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationParentRule(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSVariablesDeclaration* castedThis = static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()));
+    JSCSSVariablesDeclaration* castedThis = static_cast<JSCSSVariablesDeclaration*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentRule()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentRule()));
+    return result;
 }
 
-JSValue jsCSSVariablesDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSVariablesDeclaration* domObject = static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()));
+    JSCSSVariablesDeclaration* domObject = static_cast<JSCSSVariablesDeclaration*>(asObject(slotBase));
     return JSCSSVariablesDeclaration::getConstructor(exec, domObject->globalObject());
 }
 void JSCSSVariablesDeclaration::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -236,15 +239,16 @@ void JSCSSVariablesDeclaration::put(ExecState* exec, const Identifier& propertyN
 
 void setJSCSSVariablesDeclarationCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(static_cast<JSCSSVariablesDeclaration*>(thisObject)->impl());
+    JSCSSVariablesDeclaration* castedThisObj = static_cast<JSCSSVariablesDeclaration*>(thisObject);
+    CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThisObj->impl());
     imp->setCssText(value.toString(exec));
 }
 
-void JSCSSVariablesDeclaration::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSCSSVariablesDeclaration::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<CSSVariablesDeclaration*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSCSSVariablesDeclaration::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -313,10 +317,10 @@ JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionItem(ExecState*
 }
 
 
-JSValue JSCSSVariablesDeclaration::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSCSSVariablesDeclaration::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSCSSVariablesDeclaration* thisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()));
-    return jsStringOrNull(exec, thisObj->impl()->item(slot.index()));
+    JSCSSVariablesDeclaration* thisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(slotBase));
+    return jsStringOrNull(exec, thisObj->impl()->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CSSVariablesDeclaration* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
index 1eee675ea2..5dc91c7db0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
@@ -21,7 +21,6 @@
 #ifndef JSCSSVariablesDeclaration_h
 #define JSCSSVariablesDeclaration_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,10 +44,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     CSSVariablesDeclaration* impl() const { return m_impl.get(); }
 
@@ -56,7 +55,7 @@ private:
     RefPtr<CSSVariablesDeclaration> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CSSVariablesDeclaration*);
@@ -72,7 +71,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSVariablesDeclarationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -87,11 +86,11 @@ JSC::JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionSetVariable
 JSC::JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCSSVariablesDeclarationCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesDeclarationCssText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCSSVariablesDeclarationCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCSSVariablesDeclarationLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSVariablesDeclarationParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSVariablesDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesDeclarationLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSVariablesDeclarationParentRule(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSVariablesDeclarationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
index 488812350b..93f127ca7a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
@@ -38,9 +38,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSVariablesRule);
 
 static const HashTableValue JSCSSVariablesRuleTableValues[4] =
 {
-    { "media", DontDelete|ReadOnly, (intptr_t)jsCSSVariablesRuleMedia, (intptr_t)0 },
-    { "variables", DontDelete|ReadOnly, (intptr_t)jsCSSVariablesRuleVariables, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSVariablesRuleConstructor, (intptr_t)0 },
+    { "media", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSVariablesRuleMedia), (intptr_t)0 },
+    { "variables", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSVariablesRuleVariables), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSVariablesRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -141,25 +141,27 @@ bool JSCSSVariablesRule::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSCSSVariablesRule, Base>(exec, &JSCSSVariablesRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSVariablesRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesRuleMedia(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSVariablesRule* castedThis = static_cast<JSCSSVariablesRule*>(asObject(slot.slotBase()));
+    JSCSSVariablesRule* castedThis = static_cast<JSCSSVariablesRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSVariablesRule* imp = static_cast<CSSVariablesRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    return result;
 }
 
-JSValue jsCSSVariablesRuleVariables(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesRuleVariables(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSVariablesRule* castedThis = static_cast<JSCSSVariablesRule*>(asObject(slot.slotBase()));
+    JSCSSVariablesRule* castedThis = static_cast<JSCSSVariablesRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSVariablesRule* imp = static_cast<CSSVariablesRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->variables()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->variables()));
+    return result;
 }
 
-JSValue jsCSSVariablesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSVariablesRule* domObject = static_cast<JSCSSVariablesRule*>(asObject(slot.slotBase()));
+    JSCSSVariablesRule* domObject = static_cast<JSCSSVariablesRule*>(asObject(slotBase));
     return JSCSSVariablesRule::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCSSVariablesRule::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
index f3bee08b1e..efa589386d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -56,7 +56,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSVariablesRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -65,9 +65,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSVariablesRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSVariablesRuleVariables(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSVariablesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesRuleMedia(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSVariablesRuleVariables(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSVariablesRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
deleted file mode 100644
index 05be08c335..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
+++ /dev/null
@@ -1,155 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasArray.h"
-
-#include "CanvasArray.h"
-#include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasArray);
-
-/* Hash table */
-
-static const HashTableValue JSCanvasArrayTableValues[2] =
-{
-    { "length", DontDelete|ReadOnly, (intptr_t)jsCanvasArrayLength, (intptr_t)0 },
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasArrayTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasArrayTableValues, 0 };
-#else
-    { 2, 1, JSCanvasArrayTableValues, 0 };
-#endif
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasArrayPrototypeTableValues[3] =
-{
-    { "sizeInBytes", DontDelete|Function, (intptr_t)jsCanvasArrayPrototypeFunctionSizeInBytes, (intptr_t)0 },
-    { "alignedSizeInBytes", DontDelete|Function, (intptr_t)jsCanvasArrayPrototypeFunctionAlignedSizeInBytes, (intptr_t)0 },
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 3, JSCanvasArrayPrototypeTableValues, 0 };
-#else
-    { 4, 3, JSCanvasArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasArrayPrototype::s_info = { "CanvasArrayPrototype", 0, &JSCanvasArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasArray>(exec, globalObject);
-}
-
-bool JSCanvasArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<JSObject>(exec, &JSCanvasArrayPrototypeTable, this, propertyName, slot);
-}
-
-bool JSCanvasArrayPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    return getStaticFunctionDescriptor<JSObject>(exec, &JSCanvasArrayPrototypeTable, this, propertyName, descriptor);
-}
-
-const ClassInfo JSCanvasArray::s_info = { "CanvasArray", 0, &JSCanvasArrayTable, 0 };
-
-JSCanvasArray::JSCanvasArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasArray> impl)
-    : DOMObjectWithGlobalPointer(structure, globalObject)
-    , m_impl(impl)
-{
-}
-
-JSCanvasArray::~JSCanvasArray()
-{
-    forgetDOMObject(this, impl());
-}
-
-JSObject* JSCanvasArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasArrayPrototype(JSCanvasArrayPrototype::createStructure(globalObject->objectPrototype()));
-}
-
-bool JSCanvasArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticValueSlot<JSCanvasArray, Base>(exec, &JSCanvasArrayTable, this, propertyName, slot);
-}
-
-bool JSCanvasArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    return getStaticValueDescriptor<JSCanvasArray, Base>(exec, &JSCanvasArrayTable, this, propertyName, descriptor);
-}
-
-JSValue jsCanvasArrayLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSCanvasArray* castedThis = static_cast<JSCanvasArray*>(asObject(slot.slotBase()));
-    UNUSED_PARAM(exec);
-    CanvasArray* imp = static_cast<CanvasArray*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
-}
-
-JSValue JSC_HOST_CALL jsCanvasArrayPrototypeFunctionSizeInBytes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasArray::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasArray* castedThisObj = static_cast<JSCanvasArray*>(asObject(thisValue));
-    CanvasArray* imp = static_cast<CanvasArray*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = jsNumber(exec, imp->sizeInBytes());
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasArrayPrototypeFunctionAlignedSizeInBytes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasArray::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasArray* castedThisObj = static_cast<JSCanvasArray*>(asObject(thisValue));
-    CanvasArray* imp = static_cast<CanvasArray*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = jsNumber(exec, imp->alignedSizeInBytes());
-    return result;
-}
-
-CanvasArray* toCanvasArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasArray::s_info) ? static_cast<JSCanvasArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp
deleted file mode 100644
index 7099ce9efc..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasArrayBuffer.h"
-
-#include "CanvasArrayBuffer.h"
-#include <runtime/JSNumberCell.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasArrayBuffer);
-
-/* Hash table */
-
-static const HashTableValue JSCanvasArrayBufferTableValues[2] =
-{
-    { "byteLength", DontDelete|ReadOnly, (intptr_t)jsCanvasArrayBufferByteLength, (intptr_t)0 },
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasArrayBufferTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasArrayBufferTableValues, 0 };
-#else
-    { 2, 1, JSCanvasArrayBufferTableValues, 0 };
-#endif
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasArrayBufferPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasArrayBufferPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasArrayBufferPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasArrayBufferPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasArrayBufferPrototype::s_info = { "CanvasArrayBufferPrototype", 0, &JSCanvasArrayBufferPrototypeTable, 0 };
-
-JSObject* JSCanvasArrayBufferPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasArrayBuffer>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasArrayBuffer::s_info = { "CanvasArrayBuffer", 0, &JSCanvasArrayBufferTable, 0 };
-
-JSCanvasArrayBuffer::JSCanvasArrayBuffer(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasArrayBuffer> impl)
-    : DOMObjectWithGlobalPointer(structure, globalObject)
-    , m_impl(impl)
-{
-}
-
-JSCanvasArrayBuffer::~JSCanvasArrayBuffer()
-{
-    forgetDOMObject(this, impl());
-}
-
-JSObject* JSCanvasArrayBuffer::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasArrayBufferPrototype(JSCanvasArrayBufferPrototype::createStructure(globalObject->objectPrototype()));
-}
-
-bool JSCanvasArrayBuffer::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticValueSlot<JSCanvasArrayBuffer, Base>(exec, &JSCanvasArrayBufferTable, this, propertyName, slot);
-}
-
-bool JSCanvasArrayBuffer::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    return getStaticValueDescriptor<JSCanvasArrayBuffer, Base>(exec, &JSCanvasArrayBufferTable, this, propertyName, descriptor);
-}
-
-JSValue jsCanvasArrayBufferByteLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSCanvasArrayBuffer* castedThis = static_cast<JSCanvasArrayBuffer*>(asObject(slot.slotBase()));
-    UNUSED_PARAM(exec);
-    CanvasArrayBuffer* imp = static_cast<CanvasArrayBuffer*>(castedThis->impl());
-    return jsNumber(exec, imp->byteLength());
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArrayBuffer* object)
-{
-    return getDOMObjectWrapper<JSCanvasArrayBuffer>(exec, globalObject, object);
-}
-CanvasArrayBuffer* toCanvasArrayBuffer(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasArrayBuffer::s_info) ? static_cast<JSCanvasArrayBuffer*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.cpp
deleted file mode 100644
index ec31899cfc..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.cpp
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasByteArray.h"
-
-#include "CanvasByteArray.h"
-#include <runtime/PropertyNameArray.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasByteArray);
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasByteArrayPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasByteArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasByteArrayPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasByteArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasByteArrayPrototype::s_info = { "CanvasByteArrayPrototype", 0, &JSCanvasByteArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasByteArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasByteArray>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasByteArray::s_info = { "CanvasByteArray", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasByteArray::JSCanvasByteArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasByteArray> impl)
-    : JSCanvasArray(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasByteArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasByteArrayPrototype(JSCanvasByteArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasByteArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, index));
-        return true;
-    }
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-bool JSCanvasByteArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasByteArray*>(impl())->length()) {
-        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
-        return true;
-    }
-    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-}
-
-bool JSCanvasByteArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    if (propertyName < static_cast<CanvasByteArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, propertyName));
-        return true;
-    }
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-void JSCanvasByteArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok) {
-        indexSetter(exec, index, value);
-        return;
-    }
-    Base::put(exec, propertyName, value, slot);
-}
-
-void JSCanvasByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
-{
-    indexSetter(exec, propertyName, value);
-    return;
-}
-
-void JSCanvasByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    for (unsigned i = 0; i < static_cast<CanvasByteArray*>(impl())->length(); ++i)
-        propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-
-JSValue JSCanvasByteArray::getByIndex(ExecState* exec, unsigned index)
-{
-    return jsNumber(exec, static_cast<CanvasByteArray*>(impl())->item(index));
-}
-CanvasByteArray* toCanvasByteArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasByteArray::s_info) ? static_cast<JSCanvasByteArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.cpp
deleted file mode 100644
index 7c98ea850f..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.cpp
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasFloatArray.h"
-
-#include "CanvasFloatArray.h"
-#include <runtime/PropertyNameArray.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasFloatArray);
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasFloatArrayPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasFloatArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasFloatArrayPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasFloatArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasFloatArrayPrototype::s_info = { "CanvasFloatArrayPrototype", 0, &JSCanvasFloatArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasFloatArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasFloatArray>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasFloatArray::s_info = { "CanvasFloatArray", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasFloatArray::JSCanvasFloatArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasFloatArray> impl)
-    : JSCanvasArray(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasFloatArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasFloatArrayPrototype(JSCanvasFloatArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasFloatArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasFloatArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, index));
-        return true;
-    }
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-bool JSCanvasFloatArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasFloatArray*>(impl())->length()) {
-        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
-        return true;
-    }
-    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-}
-
-bool JSCanvasFloatArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    if (propertyName < static_cast<CanvasFloatArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, propertyName));
-        return true;
-    }
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-void JSCanvasFloatArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok) {
-        indexSetter(exec, index, value);
-        return;
-    }
-    Base::put(exec, propertyName, value, slot);
-}
-
-void JSCanvasFloatArray::put(ExecState* exec, unsigned propertyName, JSValue value)
-{
-    indexSetter(exec, propertyName, value);
-    return;
-}
-
-void JSCanvasFloatArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    for (unsigned i = 0; i < static_cast<CanvasFloatArray*>(impl())->length(); ++i)
-        propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-
-JSValue JSCanvasFloatArray::getByIndex(ExecState* exec, unsigned index)
-{
-    return jsNumber(exec, static_cast<CanvasFloatArray*>(impl())->item(index));
-}
-CanvasFloatArray* toCanvasFloatArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasFloatArray::s_info) ? static_cast<JSCanvasFloatArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
index 4d2bfa3345..a581685aef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
@@ -36,7 +36,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSCanvasGradient);
 
 static const HashTableValue JSCanvasGradientPrototypeTableValues[2] =
 {
-    { "addColorStop", DontDelete|Function, (intptr_t)jsCanvasGradientPrototypeFunctionAddColorStop, (intptr_t)2 },
+    { "addColorStop", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasGradientPrototypeFunctionAddColorStop), (intptr_t)2 },
     { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
index bd7aa3d852..2ee730192e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
@@ -21,7 +21,6 @@
 #ifndef JSCanvasGradient_h
 #define JSCanvasGradient_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -41,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     CanvasGradient* impl() const { return m_impl.get(); }
@@ -65,7 +64,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCanvasGradientPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.cpp
deleted file mode 100644
index 33fe75b87e..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.cpp
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasIntArray.h"
-
-#include "CanvasIntArray.h"
-#include <runtime/PropertyNameArray.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasIntArray);
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasIntArrayPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasIntArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasIntArrayPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasIntArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasIntArrayPrototype::s_info = { "CanvasIntArrayPrototype", 0, &JSCanvasIntArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasIntArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasIntArray>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasIntArray::s_info = { "CanvasIntArray", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasIntArray::JSCanvasIntArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasIntArray> impl)
-    : JSCanvasArray(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasIntArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasIntArrayPrototype(JSCanvasIntArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasIntArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasIntArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, index));
-        return true;
-    }
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-bool JSCanvasIntArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasIntArray*>(impl())->length()) {
-        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
-        return true;
-    }
-    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-}
-
-bool JSCanvasIntArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    if (propertyName < static_cast<CanvasIntArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, propertyName));
-        return true;
-    }
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-void JSCanvasIntArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok) {
-        indexSetter(exec, index, value);
-        return;
-    }
-    Base::put(exec, propertyName, value, slot);
-}
-
-void JSCanvasIntArray::put(ExecState* exec, unsigned propertyName, JSValue value)
-{
-    indexSetter(exec, propertyName, value);
-    return;
-}
-
-void JSCanvasIntArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    for (unsigned i = 0; i < static_cast<CanvasIntArray*>(impl())->length(); ++i)
-        propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-
-JSValue JSCanvasIntArray::getByIndex(ExecState* exec, unsigned index)
-{
-    return jsNumber(exec, static_cast<CanvasIntArray*>(impl())->item(index));
-}
-CanvasIntArray* toCanvasIntArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasIntArray::s_info) ? static_cast<JSCanvasIntArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
index 7574813f2e..7b68be7b58 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
@@ -21,7 +21,6 @@
 #ifndef JSCanvasPattern_h
 #define JSCanvasPattern_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -41,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     CanvasPattern* impl() const { return m_impl.get(); }
@@ -63,7 +62,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCanvasPatternPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
index 07710a1935..a874f81f66 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
@@ -36,8 +36,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSCanvasRenderingContext);
 
 static const HashTableValue JSCanvasRenderingContextTableValues[3] =
 {
-    { "canvas", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContextCanvas, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCanvasRenderingContextConstructor, (intptr_t)0 },
+    { "canvas", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContextCanvas), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContextConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,7 +76,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -144,17 +144,18 @@ bool JSCanvasRenderingContext::getOwnPropertyDescriptor(ExecState* exec, const I
     return getStaticValueDescriptor<JSCanvasRenderingContext, Base>(exec, &JSCanvasRenderingContextTable, this, propertyName, descriptor);
 }
 
-JSValue jsCanvasRenderingContextCanvas(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContextCanvas(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext* castedThis = static_cast<JSCanvasRenderingContext*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext* castedThis = static_cast<JSCanvasRenderingContext*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext* imp = static_cast<CanvasRenderingContext*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->canvas()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->canvas()));
+    return result;
 }
 
-JSValue jsCanvasRenderingContextConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContextConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext* domObject = static_cast<JSCanvasRenderingContext*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext* domObject = static_cast<JSCanvasRenderingContext*>(asObject(slotBase));
     return JSCanvasRenderingContext::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCanvasRenderingContext::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h
index a8b56a4c41..4d7b74d0b6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h
@@ -21,7 +21,6 @@
 #ifndef JSCanvasRenderingContext_h
 #define JSCanvasRenderingContext_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -66,7 +65,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCanvasRenderingContextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,8 +74,8 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCanvasRenderingContextCanvas(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContextConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContextCanvas(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCanvasRenderingContextConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
index 97b4d7250a..a991e8d018 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
@@ -47,22 +47,22 @@ ASSERT_CLASS_FITS_IN_CELL(JSCanvasRenderingContext2D);
 
 static const HashTableValue JSCanvasRenderingContext2DTableValues[17] =
 {
-    { "globalAlpha", DontDelete, (intptr_t)jsCanvasRenderingContext2DGlobalAlpha, (intptr_t)setJSCanvasRenderingContext2DGlobalAlpha },
-    { "globalCompositeOperation", DontDelete, (intptr_t)jsCanvasRenderingContext2DGlobalCompositeOperation, (intptr_t)setJSCanvasRenderingContext2DGlobalCompositeOperation },
-    { "lineWidth", DontDelete, (intptr_t)jsCanvasRenderingContext2DLineWidth, (intptr_t)setJSCanvasRenderingContext2DLineWidth },
-    { "lineCap", DontDelete, (intptr_t)jsCanvasRenderingContext2DLineCap, (intptr_t)setJSCanvasRenderingContext2DLineCap },
-    { "lineJoin", DontDelete, (intptr_t)jsCanvasRenderingContext2DLineJoin, (intptr_t)setJSCanvasRenderingContext2DLineJoin },
-    { "miterLimit", DontDelete, (intptr_t)jsCanvasRenderingContext2DMiterLimit, (intptr_t)setJSCanvasRenderingContext2DMiterLimit },
-    { "shadowOffsetX", DontDelete, (intptr_t)jsCanvasRenderingContext2DShadowOffsetX, (intptr_t)setJSCanvasRenderingContext2DShadowOffsetX },
-    { "shadowOffsetY", DontDelete, (intptr_t)jsCanvasRenderingContext2DShadowOffsetY, (intptr_t)setJSCanvasRenderingContext2DShadowOffsetY },
-    { "shadowBlur", DontDelete, (intptr_t)jsCanvasRenderingContext2DShadowBlur, (intptr_t)setJSCanvasRenderingContext2DShadowBlur },
-    { "shadowColor", DontDelete, (intptr_t)jsCanvasRenderingContext2DShadowColor, (intptr_t)setJSCanvasRenderingContext2DShadowColor },
-    { "font", DontDelete, (intptr_t)jsCanvasRenderingContext2DFont, (intptr_t)setJSCanvasRenderingContext2DFont },
-    { "textAlign", DontDelete, (intptr_t)jsCanvasRenderingContext2DTextAlign, (intptr_t)setJSCanvasRenderingContext2DTextAlign },
-    { "textBaseline", DontDelete, (intptr_t)jsCanvasRenderingContext2DTextBaseline, (intptr_t)setJSCanvasRenderingContext2DTextBaseline },
-    { "strokeStyle", DontDelete, (intptr_t)jsCanvasRenderingContext2DStrokeStyle, (intptr_t)setJSCanvasRenderingContext2DStrokeStyle },
-    { "fillStyle", DontDelete, (intptr_t)jsCanvasRenderingContext2DFillStyle, (intptr_t)setJSCanvasRenderingContext2DFillStyle },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCanvasRenderingContext2DConstructor, (intptr_t)0 },
+    { "globalAlpha", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DGlobalAlpha), (intptr_t)setJSCanvasRenderingContext2DGlobalAlpha },
+    { "globalCompositeOperation", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DGlobalCompositeOperation), (intptr_t)setJSCanvasRenderingContext2DGlobalCompositeOperation },
+    { "lineWidth", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DLineWidth), (intptr_t)setJSCanvasRenderingContext2DLineWidth },
+    { "lineCap", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DLineCap), (intptr_t)setJSCanvasRenderingContext2DLineCap },
+    { "lineJoin", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DLineJoin), (intptr_t)setJSCanvasRenderingContext2DLineJoin },
+    { "miterLimit", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DMiterLimit), (intptr_t)setJSCanvasRenderingContext2DMiterLimit },
+    { "shadowOffsetX", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DShadowOffsetX), (intptr_t)setJSCanvasRenderingContext2DShadowOffsetX },
+    { "shadowOffsetY", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DShadowOffsetY), (intptr_t)setJSCanvasRenderingContext2DShadowOffsetY },
+    { "shadowBlur", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DShadowBlur), (intptr_t)setJSCanvasRenderingContext2DShadowBlur },
+    { "shadowColor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DShadowColor), (intptr_t)setJSCanvasRenderingContext2DShadowColor },
+    { "font", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DFont), (intptr_t)setJSCanvasRenderingContext2DFont },
+    { "textAlign", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DTextAlign), (intptr_t)setJSCanvasRenderingContext2DTextAlign },
+    { "textBaseline", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DTextBaseline), (intptr_t)setJSCanvasRenderingContext2DTextBaseline },
+    { "strokeStyle", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DStrokeStyle), (intptr_t)setJSCanvasRenderingContext2DStrokeStyle },
+    { "fillStyle", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DFillStyle), (intptr_t)setJSCanvasRenderingContext2DFillStyle },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -101,7 +101,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -124,50 +124,50 @@ bool JSCanvasRenderingContext2DConstructor::getOwnPropertyDescriptor(ExecState*
 
 static const HashTableValue JSCanvasRenderingContext2DPrototypeTableValues[45] =
 {
-    { "save", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSave, (intptr_t)0 },
-    { "restore", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionRestore, (intptr_t)0 },
-    { "scale", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionScale, (intptr_t)2 },
-    { "rotate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionRotate, (intptr_t)1 },
-    { "translate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionTranslate, (intptr_t)2 },
-    { "transform", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionTransform, (intptr_t)6 },
-    { "setTransform", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetTransform, (intptr_t)6 },
-    { "createLinearGradient", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradient, (intptr_t)4 },
-    { "createRadialGradient", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradient, (intptr_t)6 },
-    { "clearRect", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionClearRect, (intptr_t)4 },
-    { "fillRect", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionFillRect, (intptr_t)4 },
-    { "beginPath", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionBeginPath, (intptr_t)0 },
-    { "closePath", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionClosePath, (intptr_t)0 },
-    { "moveTo", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionMoveTo, (intptr_t)2 },
-    { "lineTo", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionLineTo, (intptr_t)2 },
-    { "quadraticCurveTo", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveTo, (intptr_t)4 },
-    { "bezierCurveTo", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionBezierCurveTo, (intptr_t)6 },
-    { "arcTo", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionArcTo, (intptr_t)5 },
-    { "rect", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionRect, (intptr_t)4 },
-    { "arc", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionArc, (intptr_t)6 },
-    { "fill", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionFill, (intptr_t)0 },
-    { "stroke", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionStroke, (intptr_t)0 },
-    { "clip", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionClip, (intptr_t)0 },
-    { "isPointInPath", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionIsPointInPath, (intptr_t)2 },
-    { "fillText", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionFillText, (intptr_t)0 },
-    { "strokeText", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionStrokeText, (intptr_t)0 },
-    { "measureText", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionMeasureText, (intptr_t)1 },
-    { "setAlpha", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetAlpha, (intptr_t)1 },
-    { "setCompositeOperation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetCompositeOperation, (intptr_t)1 },
-    { "setLineWidth", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetLineWidth, (intptr_t)1 },
-    { "setLineCap", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetLineCap, (intptr_t)1 },
-    { "setLineJoin", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetLineJoin, (intptr_t)1 },
-    { "setMiterLimit", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetMiterLimit, (intptr_t)1 },
-    { "clearShadow", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionClearShadow, (intptr_t)0 },
-    { "setStrokeColor", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColor, (intptr_t)0 },
-    { "setFillColor", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetFillColor, (intptr_t)0 },
-    { "strokeRect", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionStrokeRect, (intptr_t)0 },
-    { "drawImage", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionDrawImage, (intptr_t)0 },
-    { "drawImageFromRect", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRect, (intptr_t)0 },
-    { "setShadow", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetShadow, (intptr_t)0 },
-    { "createPattern", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionCreatePattern, (intptr_t)0 },
-    { "createImageData", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionCreateImageData, (intptr_t)2 },
-    { "getImageData", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionGetImageData, (intptr_t)4 },
-    { "putImageData", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionPutImageData, (intptr_t)0 },
+    { "save", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSave), (intptr_t)0 },
+    { "restore", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionRestore), (intptr_t)0 },
+    { "scale", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionScale), (intptr_t)2 },
+    { "rotate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionRotate), (intptr_t)1 },
+    { "translate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionTranslate), (intptr_t)2 },
+    { "transform", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionTransform), (intptr_t)6 },
+    { "setTransform", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetTransform), (intptr_t)6 },
+    { "createLinearGradient", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradient), (intptr_t)4 },
+    { "createRadialGradient", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradient), (intptr_t)6 },
+    { "clearRect", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionClearRect), (intptr_t)4 },
+    { "fillRect", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionFillRect), (intptr_t)4 },
+    { "beginPath", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionBeginPath), (intptr_t)0 },
+    { "closePath", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionClosePath), (intptr_t)0 },
+    { "moveTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionMoveTo), (intptr_t)2 },
+    { "lineTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionLineTo), (intptr_t)2 },
+    { "quadraticCurveTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveTo), (intptr_t)4 },
+    { "bezierCurveTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionBezierCurveTo), (intptr_t)6 },
+    { "arcTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionArcTo), (intptr_t)5 },
+    { "rect", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionRect), (intptr_t)4 },
+    { "arc", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionArc), (intptr_t)6 },
+    { "fill", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionFill), (intptr_t)0 },
+    { "stroke", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionStroke), (intptr_t)0 },
+    { "clip", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionClip), (intptr_t)0 },
+    { "isPointInPath", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionIsPointInPath), (intptr_t)2 },
+    { "fillText", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionFillText), (intptr_t)0 },
+    { "strokeText", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionStrokeText), (intptr_t)0 },
+    { "measureText", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionMeasureText), (intptr_t)1 },
+    { "setAlpha", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetAlpha), (intptr_t)1 },
+    { "setCompositeOperation", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetCompositeOperation), (intptr_t)1 },
+    { "setLineWidth", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetLineWidth), (intptr_t)1 },
+    { "setLineCap", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetLineCap), (intptr_t)1 },
+    { "setLineJoin", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetLineJoin), (intptr_t)1 },
+    { "setMiterLimit", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetMiterLimit), (intptr_t)1 },
+    { "clearShadow", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionClearShadow), (intptr_t)0 },
+    { "setStrokeColor", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColor), (intptr_t)0 },
+    { "setFillColor", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetFillColor), (intptr_t)0 },
+    { "strokeRect", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionStrokeRect), (intptr_t)0 },
+    { "drawImage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionDrawImage), (intptr_t)0 },
+    { "drawImageFromRect", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRect), (intptr_t)0 },
+    { "setShadow", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetShadow), (intptr_t)0 },
+    { "createPattern", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionCreatePattern), (intptr_t)0 },
+    { "createImageData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionCreateImageData), (intptr_t)2 },
+    { "getImageData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionGetImageData), (intptr_t)4 },
+    { "putImageData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionPutImageData), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -217,125 +217,138 @@ bool JSCanvasRenderingContext2D::getOwnPropertyDescriptor(ExecState* exec, const
     return getStaticValueDescriptor<JSCanvasRenderingContext2D, Base>(exec, &JSCanvasRenderingContext2DTable, this, propertyName, descriptor);
 }
 
-JSValue jsCanvasRenderingContext2DGlobalAlpha(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DGlobalAlpha(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsNumber(exec, imp->globalAlpha());
+    JSValue result = jsNumber(exec, imp->globalAlpha());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DGlobalCompositeOperation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DGlobalCompositeOperation(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsString(exec, imp->globalCompositeOperation());
+    JSValue result = jsString(exec, imp->globalCompositeOperation());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DLineWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DLineWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsNumber(exec, imp->lineWidth());
+    JSValue result = jsNumber(exec, imp->lineWidth());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DLineCap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DLineCap(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsString(exec, imp->lineCap());
+    JSValue result = jsString(exec, imp->lineCap());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DLineJoin(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DLineJoin(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsString(exec, imp->lineJoin());
+    JSValue result = jsString(exec, imp->lineJoin());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DMiterLimit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DMiterLimit(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsNumber(exec, imp->miterLimit());
+    JSValue result = jsNumber(exec, imp->miterLimit());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DShadowOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowOffsetX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsNumber(exec, imp->shadowOffsetX());
+    JSValue result = jsNumber(exec, imp->shadowOffsetX());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DShadowOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowOffsetY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsNumber(exec, imp->shadowOffsetY());
+    JSValue result = jsNumber(exec, imp->shadowOffsetY());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DShadowBlur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowBlur(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsNumber(exec, imp->shadowBlur());
+    JSValue result = jsNumber(exec, imp->shadowBlur());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DShadowColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowColor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsString(exec, imp->shadowColor());
+    JSValue result = jsString(exec, imp->shadowColor());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DFont(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DFont(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsString(exec, imp->font());
+    JSValue result = jsString(exec, imp->font());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DTextAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DTextAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsString(exec, imp->textAlign());
+    JSValue result = jsString(exec, imp->textAlign());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DTextBaseline(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DTextBaseline(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsString(exec, imp->textBaseline());
+    JSValue result = jsString(exec, imp->textBaseline());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DStrokeStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DStrokeStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     return castedThis->strokeStyle(exec);
 }
 
-JSValue jsCanvasRenderingContext2DFillStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DFillStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     return castedThis->fillStyle(exec);
 }
 
-JSValue jsCanvasRenderingContext2DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* domObject = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* domObject = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     return JSCanvasRenderingContext2D::getConstructor(exec, domObject->globalObject());
 }
 void JSCanvasRenderingContext2D::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -345,79 +358,92 @@ void JSCanvasRenderingContext2D::put(ExecState* exec, const Identifier& property
 
 void setJSCanvasRenderingContext2DGlobalAlpha(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setGlobalAlpha(value.toFloat(exec));
 }
 
 void setJSCanvasRenderingContext2DGlobalCompositeOperation(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setGlobalCompositeOperation(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSCanvasRenderingContext2DLineWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setLineWidth(value.toFloat(exec));
 }
 
 void setJSCanvasRenderingContext2DLineCap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setLineCap(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSCanvasRenderingContext2DLineJoin(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setLineJoin(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSCanvasRenderingContext2DMiterLimit(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setMiterLimit(value.toFloat(exec));
 }
 
 void setJSCanvasRenderingContext2DShadowOffsetX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setShadowOffsetX(value.toFloat(exec));
 }
 
 void setJSCanvasRenderingContext2DShadowOffsetY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setShadowOffsetY(value.toFloat(exec));
 }
 
 void setJSCanvasRenderingContext2DShadowBlur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setShadowBlur(value.toFloat(exec));
 }
 
 void setJSCanvasRenderingContext2DShadowColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setShadowColor(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSCanvasRenderingContext2DFont(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setFont(value.toString(exec));
 }
 
 void setJSCanvasRenderingContext2DTextAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setTextAlign(value.toString(exec));
 }
 
 void setJSCanvasRenderingContext2DTextBaseline(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setTextBaseline(value.toString(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
index 5637651a1d..218e455be5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -77,7 +77,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCanvasRenderingContext2DPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -132,37 +132,37 @@ JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionGetImageDa
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionPutImageData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DGlobalCompositeOperation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DGlobalCompositeOperation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DGlobalCompositeOperation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DLineWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DLineWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DLineWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DLineCap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DLineCap(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DLineCap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DLineJoin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DLineJoin(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DLineJoin(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DMiterLimit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DMiterLimit(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DMiterLimit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DShadowOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DShadowOffsetX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DShadowOffsetX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DShadowOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DShadowOffsetY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DShadowOffsetY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DShadowBlur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DShadowBlur(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DShadowBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DShadowColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DShadowColor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DShadowColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DFont(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DFont(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DFont(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DTextAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DTextAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DTextAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DTextBaseline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DTextBaseline(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DTextBaseline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DStrokeStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DStrokeStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DStrokeStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DFillStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DFillStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DFillStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp
deleted file mode 100644
index 7ed7f058cf..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp
+++ /dev/null
@@ -1,4528 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasRenderingContext3D.h"
-
-#include "CanvasActiveInfo.h"
-#include "CanvasArray.h"
-#include "CanvasBuffer.h"
-#include "CanvasFloatArray.h"
-#include "CanvasFramebuffer.h"
-#include "CanvasIntArray.h"
-#include "CanvasProgram.h"
-#include "CanvasRenderbuffer.h"
-#include "CanvasRenderingContext3D.h"
-#include "CanvasShader.h"
-#include "CanvasTexture.h"
-#include "CanvasUnsignedByteArray.h"
-#include "JSCanvasActiveInfo.h"
-#include "JSCanvasArray.h"
-#include "JSCanvasBuffer.h"
-#include "JSCanvasFloatArray.h"
-#include "JSCanvasFramebuffer.h"
-#include "JSCanvasIntArray.h"
-#include "JSCanvasProgram.h"
-#include "JSCanvasRenderbuffer.h"
-#include "JSCanvasShader.h"
-#include "JSCanvasTexture.h"
-#include "JSCanvasUnsignedByteArray.h"
-#include "KURL.h"
-#include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
-#include <runtime/JSString.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasRenderingContext3D);
-
-/* Hash table */
-
-static const HashTableValue JSCanvasRenderingContext3DTableValues[2] =
-{
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCanvasRenderingContext3DConstructor, (intptr_t)0 },
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasRenderingContext3DTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasRenderingContext3DTableValues, 0 };
-#else
-    { 2, 1, JSCanvasRenderingContext3DTableValues, 0 };
-#endif
-
-/* Hash table for constructor */
-
-static const HashTableValue JSCanvasRenderingContext3DConstructorTableValues[303] =
-{
-    { "DEPTH_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_BUFFER_BIT, (intptr_t)0 },
-    { "STENCIL_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BUFFER_BIT, (intptr_t)0 },
-    { "COLOR_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_BUFFER_BIT, (intptr_t)0 },
-    { "FALSE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFALSE, (intptr_t)0 },
-    { "TRUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRUE, (intptr_t)0 },
-    { "POINTS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOINTS, (intptr_t)0 },
-    { "LINES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINES, (intptr_t)0 },
-    { "LINE_LOOP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_LOOP, (intptr_t)0 },
-    { "LINE_STRIP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_STRIP, (intptr_t)0 },
-    { "TRIANGLES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLES, (intptr_t)0 },
-    { "TRIANGLE_STRIP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLE_STRIP, (intptr_t)0 },
-    { "TRIANGLE_FAN", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLE_FAN, (intptr_t)0 },
-    { "ZERO", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DZERO, (intptr_t)0 },
-    { "ONE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE, (intptr_t)0 },
-    { "SRC_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_COLOR, (intptr_t)0 },
-    { "ONE_MINUS_SRC_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_SRC_COLOR, (intptr_t)0 },
-    { "SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_ALPHA, (intptr_t)0 },
-    { "ONE_MINUS_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_SRC_ALPHA, (intptr_t)0 },
-    { "DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDST_ALPHA, (intptr_t)0 },
-    { "ONE_MINUS_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_DST_ALPHA, (intptr_t)0 },
-    { "DST_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDST_COLOR, (intptr_t)0 },
-    { "ONE_MINUS_DST_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_DST_COLOR, (intptr_t)0 },
-    { "SRC_ALPHA_SATURATE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_ALPHA_SATURATE, (intptr_t)0 },
-    { "FUNC_ADD", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_ADD, (intptr_t)0 },
-    { "BLEND_EQUATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION, (intptr_t)0 },
-    { "BLEND_EQUATION_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION_RGB, (intptr_t)0 },
-    { "BLEND_EQUATION_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION_ALPHA, (intptr_t)0 },
-    { "FUNC_SUBTRACT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_SUBTRACT, (intptr_t)0 },
-    { "FUNC_REVERSE_SUBTRACT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_REVERSE_SUBTRACT, (intptr_t)0 },
-    { "BLEND_DST_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_DST_RGB, (intptr_t)0 },
-    { "BLEND_SRC_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_SRC_RGB, (intptr_t)0 },
-    { "BLEND_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_DST_ALPHA, (intptr_t)0 },
-    { "BLEND_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_SRC_ALPHA, (intptr_t)0 },
-    { "CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCONSTANT_COLOR, (intptr_t)0 },
-    { "ONE_MINUS_CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_CONSTANT_COLOR, (intptr_t)0 },
-    { "CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCONSTANT_ALPHA, (intptr_t)0 },
-    { "ONE_MINUS_CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_CONSTANT_ALPHA, (intptr_t)0 },
-    { "BLEND_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_COLOR, (intptr_t)0 },
-    { "ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DARRAY_BUFFER, (intptr_t)0 },
-    { "ELEMENT_ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER, (intptr_t)0 },
-    { "ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DARRAY_BUFFER_BINDING, (intptr_t)0 },
-    { "ELEMENT_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER_BINDING, (intptr_t)0 },
-    { "STREAM_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTREAM_DRAW, (intptr_t)0 },
-    { "STATIC_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTATIC_DRAW, (intptr_t)0 },
-    { "DYNAMIC_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDYNAMIC_DRAW, (intptr_t)0 },
-    { "BUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBUFFER_SIZE, (intptr_t)0 },
-    { "BUFFER_USAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBUFFER_USAGE, (intptr_t)0 },
-    { "CURRENT_VERTEX_ATTRIB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCURRENT_VERTEX_ATTRIB, (intptr_t)0 },
-    { "FRONT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT, (intptr_t)0 },
-    { "BACK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBACK, (intptr_t)0 },
-    { "FRONT_AND_BACK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT_AND_BACK, (intptr_t)0 },
-    { "TEXTURE_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_2D, (intptr_t)0 },
-    { "CULL_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCULL_FACE, (intptr_t)0 },
-    { "BLEND", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND, (intptr_t)0 },
-    { "DITHER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDITHER, (intptr_t)0 },
-    { "STENCIL_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_TEST, (intptr_t)0 },
-    { "DEPTH_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_TEST, (intptr_t)0 },
-    { "SCISSOR_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSCISSOR_TEST, (intptr_t)0 },
-    { "POLYGON_OFFSET_FILL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_FILL, (intptr_t)0 },
-    { "SAMPLE_ALPHA_TO_COVERAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_ALPHA_TO_COVERAGE, (intptr_t)0 },
-    { "SAMPLE_COVERAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE, (intptr_t)0 },
-    { "NO_ERROR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNO_ERROR, (intptr_t)0 },
-    { "INVALID_ENUM", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_ENUM, (intptr_t)0 },
-    { "INVALID_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_VALUE, (intptr_t)0 },
-    { "INVALID_OPERATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_OPERATION, (intptr_t)0 },
-    { "OUT_OF_MEMORY", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DOUT_OF_MEMORY, (intptr_t)0 },
-    { "CW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCW, (intptr_t)0 },
-    { "CCW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCCW, (intptr_t)0 },
-    { "LINE_WIDTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_WIDTH, (intptr_t)0 },
-    { "ALIASED_POINT_SIZE_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALIASED_POINT_SIZE_RANGE, (intptr_t)0 },
-    { "ALIASED_LINE_WIDTH_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALIASED_LINE_WIDTH_RANGE, (intptr_t)0 },
-    { "CULL_FACE_MODE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCULL_FACE_MODE, (intptr_t)0 },
-    { "FRONT_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT_FACE, (intptr_t)0 },
-    { "DEPTH_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_RANGE, (intptr_t)0 },
-    { "DEPTH_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_WRITEMASK, (intptr_t)0 },
-    { "DEPTH_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_CLEAR_VALUE, (intptr_t)0 },
-    { "DEPTH_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_FUNC, (intptr_t)0 },
-    { "STENCIL_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_CLEAR_VALUE, (intptr_t)0 },
-    { "STENCIL_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_FUNC, (intptr_t)0 },
-    { "STENCIL_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_FAIL, (intptr_t)0 },
-    { "STENCIL_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_FAIL, (intptr_t)0 },
-    { "STENCIL_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_PASS, (intptr_t)0 },
-    { "STENCIL_REF", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_REF, (intptr_t)0 },
-    { "STENCIL_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_VALUE_MASK, (intptr_t)0 },
-    { "STENCIL_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_WRITEMASK, (intptr_t)0 },
-    { "STENCIL_BACK_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_FUNC, (intptr_t)0 },
-    { "STENCIL_BACK_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_FAIL, (intptr_t)0 },
-    { "STENCIL_BACK_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_FAIL, (intptr_t)0 },
-    { "STENCIL_BACK_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_PASS, (intptr_t)0 },
-    { "STENCIL_BACK_REF", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_REF, (intptr_t)0 },
-    { "STENCIL_BACK_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_VALUE_MASK, (intptr_t)0 },
-    { "STENCIL_BACK_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_WRITEMASK, (intptr_t)0 },
-    { "VIEWPORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVIEWPORT, (intptr_t)0 },
-    { "SCISSOR_BOX", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSCISSOR_BOX, (intptr_t)0 },
-    { "COLOR_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_CLEAR_VALUE, (intptr_t)0 },
-    { "COLOR_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_WRITEMASK, (intptr_t)0 },
-    { "UNPACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNPACK_ALIGNMENT, (intptr_t)0 },
-    { "PACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPACK_ALIGNMENT, (intptr_t)0 },
-    { "MAX_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_TEXTURE_SIZE, (intptr_t)0 },
-    { "MAX_VIEWPORT_DIMS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VIEWPORT_DIMS, (intptr_t)0 },
-    { "SUBPIXEL_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSUBPIXEL_BITS, (intptr_t)0 },
-    { "RED_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRED_BITS, (intptr_t)0 },
-    { "GREEN_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGREEN_BITS, (intptr_t)0 },
-    { "BLUE_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLUE_BITS, (intptr_t)0 },
-    { "ALPHA_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALPHA_BITS, (intptr_t)0 },
-    { "DEPTH_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_BITS, (intptr_t)0 },
-    { "STENCIL_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BITS, (intptr_t)0 },
-    { "POLYGON_OFFSET_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_UNITS, (intptr_t)0 },
-    { "POLYGON_OFFSET_FACTOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_FACTOR, (intptr_t)0 },
-    { "TEXTURE_BINDING_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_BINDING_2D, (intptr_t)0 },
-    { "SAMPLE_BUFFERS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_BUFFERS, (intptr_t)0 },
-    { "SAMPLES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLES, (intptr_t)0 },
-    { "SAMPLE_COVERAGE_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE_VALUE, (intptr_t)0 },
-    { "SAMPLE_COVERAGE_INVERT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE_INVERT, (intptr_t)0 },
-    { "NUM_COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNUM_COMPRESSED_TEXTURE_FORMATS, (intptr_t)0 },
-    { "COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOMPRESSED_TEXTURE_FORMATS, (intptr_t)0 },
-    { "DONT_CARE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDONT_CARE, (intptr_t)0 },
-    { "FASTEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFASTEST, (intptr_t)0 },
-    { "NICEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNICEST, (intptr_t)0 },
-    { "GENERATE_MIPMAP_HINT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGENERATE_MIPMAP_HINT, (intptr_t)0 },
-    { "BYTE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBYTE, (intptr_t)0 },
-    { "UNSIGNED_BYTE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_BYTE, (intptr_t)0 },
-    { "SHORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHORT, (intptr_t)0 },
-    { "UNSIGNED_SHORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT, (intptr_t)0 },
-    { "INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT, (intptr_t)0 },
-    { "UNSIGNED_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_INT, (intptr_t)0 },
-    { "FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT, (intptr_t)0 },
-    { "FIXED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFIXED, (intptr_t)0 },
-    { "DEPTH_COMPONENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_COMPONENT, (intptr_t)0 },
-    { "ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALPHA, (intptr_t)0 },
-    { "RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB, (intptr_t)0 },
-    { "RGBA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGBA, (intptr_t)0 },
-    { "LUMINANCE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLUMINANCE, (intptr_t)0 },
-    { "LUMINANCE_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLUMINANCE_ALPHA, (intptr_t)0 },
-    { "UNSIGNED_SHORT_4_4_4_4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_4_4_4_4, (intptr_t)0 },
-    { "UNSIGNED_SHORT_5_5_5_1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_5_5_5_1, (intptr_t)0 },
-    { "UNSIGNED_SHORT_5_6_5", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_5_6_5, (intptr_t)0 },
-    { "FRAGMENT_SHADER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAGMENT_SHADER, (intptr_t)0 },
-    { "VERTEX_SHADER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_SHADER, (intptr_t)0 },
-    { "MAX_VERTEX_ATTRIBS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_ATTRIBS, (intptr_t)0 },
-    { "MAX_VERTEX_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_UNIFORM_VECTORS, (intptr_t)0 },
-    { "MAX_VARYING_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VARYING_VECTORS, (intptr_t)0 },
-    { "MAX_COMBINED_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_COMBINED_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
-    { "MAX_VERTEX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
-    { "MAX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
-    { "MAX_FRAGMENT_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_FRAGMENT_UNIFORM_VECTORS, (intptr_t)0 },
-    { "SHADER_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_TYPE, (intptr_t)0 },
-    { "DELETE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDELETE_STATUS, (intptr_t)0 },
-    { "LINK_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINK_STATUS, (intptr_t)0 },
-    { "VALIDATE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVALIDATE_STATUS, (intptr_t)0 },
-    { "ATTACHED_SHADERS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DATTACHED_SHADERS, (intptr_t)0 },
-    { "ACTIVE_UNIFORMS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_UNIFORMS, (intptr_t)0 },
-    { "ACTIVE_UNIFORM_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_UNIFORM_MAX_LENGTH, (intptr_t)0 },
-    { "ACTIVE_ATTRIBUTES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_ATTRIBUTES, (intptr_t)0 },
-    { "ACTIVE_ATTRIBUTE_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_ATTRIBUTE_MAX_LENGTH, (intptr_t)0 },
-    { "SHADING_LANGUAGE_VERSION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADING_LANGUAGE_VERSION, (intptr_t)0 },
-    { "CURRENT_PROGRAM", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCURRENT_PROGRAM, (intptr_t)0 },
-    { "NEVER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEVER, (intptr_t)0 },
-    { "LESS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLESS, (intptr_t)0 },
-    { "EQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DEQUAL, (intptr_t)0 },
-    { "LEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLEQUAL, (intptr_t)0 },
-    { "GREATER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGREATER, (intptr_t)0 },
-    { "NOTEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNOTEQUAL, (intptr_t)0 },
-    { "GEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGEQUAL, (intptr_t)0 },
-    { "ALWAYS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALWAYS, (intptr_t)0 },
-    { "KEEP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DKEEP, (intptr_t)0 },
-    { "REPLACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DREPLACE, (intptr_t)0 },
-    { "INCR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINCR, (intptr_t)0 },
-    { "DECR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDECR, (intptr_t)0 },
-    { "INVERT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVERT, (intptr_t)0 },
-    { "INCR_WRAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINCR_WRAP, (intptr_t)0 },
-    { "DECR_WRAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDECR_WRAP, (intptr_t)0 },
-    { "VENDOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVENDOR, (intptr_t)0 },
-    { "RENDERER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERER, (intptr_t)0 },
-    { "VERSION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERSION, (intptr_t)0 },
-    { "EXTENSIONS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DEXTENSIONS, (intptr_t)0 },
-    { "NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST, (intptr_t)0 },
-    { "LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR, (intptr_t)0 },
-    { "NEAREST_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST_MIPMAP_NEAREST, (intptr_t)0 },
-    { "LINEAR_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR_MIPMAP_NEAREST, (intptr_t)0 },
-    { "NEAREST_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST_MIPMAP_LINEAR, (intptr_t)0 },
-    { "LINEAR_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR_MIPMAP_LINEAR, (intptr_t)0 },
-    { "TEXTURE_MAG_FILTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_MAG_FILTER, (intptr_t)0 },
-    { "TEXTURE_MIN_FILTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_MIN_FILTER, (intptr_t)0 },
-    { "TEXTURE_WRAP_S", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_WRAP_S, (intptr_t)0 },
-    { "TEXTURE_WRAP_T", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_WRAP_T, (intptr_t)0 },
-    { "TEXTURE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP, (intptr_t)0 },
-    { "TEXTURE_BINDING_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_BINDING_CUBE_MAP, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_POSITIVE_X", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_X, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_NEGATIVE_X", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_X, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_POSITIVE_Y", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Y, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_NEGATIVE_Y", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Y, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_POSITIVE_Z", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Z, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_NEGATIVE_Z", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Z, (intptr_t)0 },
-    { "MAX_CUBE_MAP_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_CUBE_MAP_TEXTURE_SIZE, (intptr_t)0 },
-    { "TEXTURE0", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE0, (intptr_t)0 },
-    { "TEXTURE1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE1, (intptr_t)0 },
-    { "TEXTURE2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE2, (intptr_t)0 },
-    { "TEXTURE3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE3, (intptr_t)0 },
-    { "TEXTURE4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE4, (intptr_t)0 },
-    { "TEXTURE5", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE5, (intptr_t)0 },
-    { "TEXTURE6", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE6, (intptr_t)0 },
-    { "TEXTURE7", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE7, (intptr_t)0 },
-    { "TEXTURE8", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE8, (intptr_t)0 },
-    { "TEXTURE9", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE9, (intptr_t)0 },
-    { "TEXTURE10", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE10, (intptr_t)0 },
-    { "TEXTURE11", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE11, (intptr_t)0 },
-    { "TEXTURE12", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE12, (intptr_t)0 },
-    { "TEXTURE13", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE13, (intptr_t)0 },
-    { "TEXTURE14", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE14, (intptr_t)0 },
-    { "TEXTURE15", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE15, (intptr_t)0 },
-    { "TEXTURE16", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE16, (intptr_t)0 },
-    { "TEXTURE17", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE17, (intptr_t)0 },
-    { "TEXTURE18", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE18, (intptr_t)0 },
-    { "TEXTURE19", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE19, (intptr_t)0 },
-    { "TEXTURE20", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE20, (intptr_t)0 },
-    { "TEXTURE21", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE21, (intptr_t)0 },
-    { "TEXTURE22", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE22, (intptr_t)0 },
-    { "TEXTURE23", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE23, (intptr_t)0 },
-    { "TEXTURE24", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE24, (intptr_t)0 },
-    { "TEXTURE25", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE25, (intptr_t)0 },
-    { "TEXTURE26", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE26, (intptr_t)0 },
-    { "TEXTURE27", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE27, (intptr_t)0 },
-    { "TEXTURE28", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE28, (intptr_t)0 },
-    { "TEXTURE29", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE29, (intptr_t)0 },
-    { "TEXTURE30", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE30, (intptr_t)0 },
-    { "TEXTURE31", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE31, (intptr_t)0 },
-    { "ACTIVE_TEXTURE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_TEXTURE, (intptr_t)0 },
-    { "REPEAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DREPEAT, (intptr_t)0 },
-    { "CLAMP_TO_EDGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCLAMP_TO_EDGE, (intptr_t)0 },
-    { "MIRRORED_REPEAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMIRRORED_REPEAT, (intptr_t)0 },
-    { "FLOAT_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC2, (intptr_t)0 },
-    { "FLOAT_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC3, (intptr_t)0 },
-    { "FLOAT_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC4, (intptr_t)0 },
-    { "INT_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC2, (intptr_t)0 },
-    { "INT_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC3, (intptr_t)0 },
-    { "INT_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC4, (intptr_t)0 },
-    { "BOOL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL, (intptr_t)0 },
-    { "BOOL_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC2, (intptr_t)0 },
-    { "BOOL_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC3, (intptr_t)0 },
-    { "BOOL_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC4, (intptr_t)0 },
-    { "FLOAT_MAT2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT2, (intptr_t)0 },
-    { "FLOAT_MAT3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT3, (intptr_t)0 },
-    { "FLOAT_MAT4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT4, (intptr_t)0 },
-    { "SAMPLER_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLER_2D, (intptr_t)0 },
-    { "SAMPLER_CUBE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLER_CUBE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_ENABLED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_ENABLED, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_SIZE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_STRIDE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_STRIDE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_TYPE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_NORMALIZED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_NORMALIZED, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_POINTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_POINTER, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_BUFFER_BINDING, (intptr_t)0 },
-    { "IMPLEMENTATION_COLOR_READ_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_TYPE, (intptr_t)0 },
-    { "IMPLEMENTATION_COLOR_READ_FORMAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_FORMAT, (intptr_t)0 },
-    { "COMPILE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOMPILE_STATUS, (intptr_t)0 },
-    { "INFO_LOG_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINFO_LOG_LENGTH, (intptr_t)0 },
-    { "SHADER_SOURCE_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_SOURCE_LENGTH, (intptr_t)0 },
-    { "SHADER_COMPILER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_COMPILER, (intptr_t)0 },
-    { "SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_BINARY_FORMATS, (intptr_t)0 },
-    { "NUM_SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNUM_SHADER_BINARY_FORMATS, (intptr_t)0 },
-    { "LOW_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLOW_FLOAT, (intptr_t)0 },
-    { "MEDIUM_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMEDIUM_FLOAT, (intptr_t)0 },
-    { "HIGH_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DHIGH_FLOAT, (intptr_t)0 },
-    { "LOW_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLOW_INT, (intptr_t)0 },
-    { "MEDIUM_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMEDIUM_INT, (intptr_t)0 },
-    { "HIGH_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DHIGH_INT, (intptr_t)0 },
-    { "FRAMEBUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER, (intptr_t)0 },
-    { "RENDERBUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER, (intptr_t)0 },
-    { "RGBA4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGBA4, (intptr_t)0 },
-    { "RGB5_A1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB5_A1, (intptr_t)0 },
-    { "RGB565", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB565, (intptr_t)0 },
-    { "DEPTH_COMPONENT16", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_COMPONENT16, (intptr_t)0 },
-    { "STENCIL_INDEX", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_INDEX, (intptr_t)0 },
-    { "STENCIL_INDEX8", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_INDEX8, (intptr_t)0 },
-    { "RENDERBUFFER_WIDTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_WIDTH, (intptr_t)0 },
-    { "RENDERBUFFER_HEIGHT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_HEIGHT, (intptr_t)0 },
-    { "RENDERBUFFER_INTERNAL_FORMAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_INTERNAL_FORMAT, (intptr_t)0 },
-    { "RENDERBUFFER_RED_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_RED_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_GREEN_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_GREEN_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_BLUE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_BLUE_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_ALPHA_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_ALPHA_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_DEPTH_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_DEPTH_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_STENCIL_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_STENCIL_SIZE, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_OBJECT_NAME", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_NAME, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE, (intptr_t)0 },
-    { "COLOR_ATTACHMENT0", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_ATTACHMENT0, (intptr_t)0 },
-    { "DEPTH_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_ATTACHMENT, (intptr_t)0 },
-    { "STENCIL_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_ATTACHMENT, (intptr_t)0 },
-    { "NONE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNONE, (intptr_t)0 },
-    { "FRAMEBUFFER_COMPLETE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_COMPLETE, (intptr_t)0 },
-    { "FRAMEBUFFER_INCOMPLETE_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_ATTACHMENT, (intptr_t)0 },
-    { "FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT, (intptr_t)0 },
-    { "FRAMEBUFFER_INCOMPLETE_DIMENSIONS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_DIMENSIONS, (intptr_t)0 },
-    { "FRAMEBUFFER_UNSUPPORTED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_UNSUPPORTED, (intptr_t)0 },
-    { "FRAMEBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_BINDING, (intptr_t)0 },
-    { "RENDERBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_BINDING, (intptr_t)0 },
-    { "MAX_RENDERBUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_RENDERBUFFER_SIZE, (intptr_t)0 },
-    { "INVALID_FRAMEBUFFER_OPERATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_FRAMEBUFFER_OPERATION, (intptr_t)0 },
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasRenderingContext3DConstructorTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 32767, JSCanvasRenderingContext3DConstructorTableValues, 0 };
-#else
-    { 1063, 1023, JSCanvasRenderingContext3DConstructorTableValues, 0 };
-#endif
-
-class JSCanvasRenderingContext3DConstructor : public DOMConstructorObject {
-public:
-    JSCanvasRenderingContext3DConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-        : DOMConstructorObject(JSCanvasRenderingContext3DConstructor::createStructure(globalObject->objectPrototype()), globalObject)
-    {
-        putDirect(exec->propertyNames().prototype, JSCanvasRenderingContext3DPrototype::self(exec, globalObject), None);
-    }
-    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
-    virtual const ClassInfo* classInfo() const { return &s_info; }
-    static const ClassInfo s_info;
-
-    static PassRefPtr<Structure> createStructure(JSValue proto) 
-    { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
-    }
-    
-protected:
-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
-};
-
-const ClassInfo JSCanvasRenderingContext3DConstructor::s_info = { "CanvasRenderingContext3DConstructor", 0, &JSCanvasRenderingContext3DConstructorTable, 0 };
-
-bool JSCanvasRenderingContext3DConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticValueSlot<JSCanvasRenderingContext3DConstructor, DOMObject>(exec, &JSCanvasRenderingContext3DConstructorTable, this, propertyName, slot);
-}
-
-bool JSCanvasRenderingContext3DConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    return getStaticValueDescriptor<JSCanvasRenderingContext3DConstructor, DOMObject>(exec, &JSCanvasRenderingContext3DConstructorTable, this, propertyName, descriptor);
-}
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasRenderingContext3DPrototypeTableValues[453] =
-{
-    { "DEPTH_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_BUFFER_BIT, (intptr_t)0 },
-    { "STENCIL_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BUFFER_BIT, (intptr_t)0 },
-    { "COLOR_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_BUFFER_BIT, (intptr_t)0 },
-    { "FALSE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFALSE, (intptr_t)0 },
-    { "TRUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRUE, (intptr_t)0 },
-    { "POINTS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOINTS, (intptr_t)0 },
-    { "LINES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINES, (intptr_t)0 },
-    { "LINE_LOOP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_LOOP, (intptr_t)0 },
-    { "LINE_STRIP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_STRIP, (intptr_t)0 },
-    { "TRIANGLES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLES, (intptr_t)0 },
-    { "TRIANGLE_STRIP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLE_STRIP, (intptr_t)0 },
-    { "TRIANGLE_FAN", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLE_FAN, (intptr_t)0 },
-    { "ZERO", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DZERO, (intptr_t)0 },
-    { "ONE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE, (intptr_t)0 },
-    { "SRC_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_COLOR, (intptr_t)0 },
-    { "ONE_MINUS_SRC_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_SRC_COLOR, (intptr_t)0 },
-    { "SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_ALPHA, (intptr_t)0 },
-    { "ONE_MINUS_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_SRC_ALPHA, (intptr_t)0 },
-    { "DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDST_ALPHA, (intptr_t)0 },
-    { "ONE_MINUS_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_DST_ALPHA, (intptr_t)0 },
-    { "DST_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDST_COLOR, (intptr_t)0 },
-    { "ONE_MINUS_DST_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_DST_COLOR, (intptr_t)0 },
-    { "SRC_ALPHA_SATURATE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_ALPHA_SATURATE, (intptr_t)0 },
-    { "FUNC_ADD", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_ADD, (intptr_t)0 },
-    { "BLEND_EQUATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION, (intptr_t)0 },
-    { "BLEND_EQUATION_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION_RGB, (intptr_t)0 },
-    { "BLEND_EQUATION_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION_ALPHA, (intptr_t)0 },
-    { "FUNC_SUBTRACT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_SUBTRACT, (intptr_t)0 },
-    { "FUNC_REVERSE_SUBTRACT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_REVERSE_SUBTRACT, (intptr_t)0 },
-    { "BLEND_DST_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_DST_RGB, (intptr_t)0 },
-    { "BLEND_SRC_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_SRC_RGB, (intptr_t)0 },
-    { "BLEND_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_DST_ALPHA, (intptr_t)0 },
-    { "BLEND_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_SRC_ALPHA, (intptr_t)0 },
-    { "CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCONSTANT_COLOR, (intptr_t)0 },
-    { "ONE_MINUS_CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_CONSTANT_COLOR, (intptr_t)0 },
-    { "CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCONSTANT_ALPHA, (intptr_t)0 },
-    { "ONE_MINUS_CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_CONSTANT_ALPHA, (intptr_t)0 },
-    { "BLEND_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_COLOR, (intptr_t)0 },
-    { "ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DARRAY_BUFFER, (intptr_t)0 },
-    { "ELEMENT_ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER, (intptr_t)0 },
-    { "ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DARRAY_BUFFER_BINDING, (intptr_t)0 },
-    { "ELEMENT_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER_BINDING, (intptr_t)0 },
-    { "STREAM_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTREAM_DRAW, (intptr_t)0 },
-    { "STATIC_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTATIC_DRAW, (intptr_t)0 },
-    { "DYNAMIC_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDYNAMIC_DRAW, (intptr_t)0 },
-    { "BUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBUFFER_SIZE, (intptr_t)0 },
-    { "BUFFER_USAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBUFFER_USAGE, (intptr_t)0 },
-    { "CURRENT_VERTEX_ATTRIB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCURRENT_VERTEX_ATTRIB, (intptr_t)0 },
-    { "FRONT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT, (intptr_t)0 },
-    { "BACK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBACK, (intptr_t)0 },
-    { "FRONT_AND_BACK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT_AND_BACK, (intptr_t)0 },
-    { "TEXTURE_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_2D, (intptr_t)0 },
-    { "CULL_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCULL_FACE, (intptr_t)0 },
-    { "BLEND", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND, (intptr_t)0 },
-    { "DITHER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDITHER, (intptr_t)0 },
-    { "STENCIL_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_TEST, (intptr_t)0 },
-    { "DEPTH_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_TEST, (intptr_t)0 },
-    { "SCISSOR_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSCISSOR_TEST, (intptr_t)0 },
-    { "POLYGON_OFFSET_FILL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_FILL, (intptr_t)0 },
-    { "SAMPLE_ALPHA_TO_COVERAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_ALPHA_TO_COVERAGE, (intptr_t)0 },
-    { "SAMPLE_COVERAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE, (intptr_t)0 },
-    { "NO_ERROR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNO_ERROR, (intptr_t)0 },
-    { "INVALID_ENUM", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_ENUM, (intptr_t)0 },
-    { "INVALID_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_VALUE, (intptr_t)0 },
-    { "INVALID_OPERATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_OPERATION, (intptr_t)0 },
-    { "OUT_OF_MEMORY", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DOUT_OF_MEMORY, (intptr_t)0 },
-    { "CW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCW, (intptr_t)0 },
-    { "CCW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCCW, (intptr_t)0 },
-    { "LINE_WIDTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_WIDTH, (intptr_t)0 },
-    { "ALIASED_POINT_SIZE_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALIASED_POINT_SIZE_RANGE, (intptr_t)0 },
-    { "ALIASED_LINE_WIDTH_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALIASED_LINE_WIDTH_RANGE, (intptr_t)0 },
-    { "CULL_FACE_MODE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCULL_FACE_MODE, (intptr_t)0 },
-    { "FRONT_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT_FACE, (intptr_t)0 },
-    { "DEPTH_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_RANGE, (intptr_t)0 },
-    { "DEPTH_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_WRITEMASK, (intptr_t)0 },
-    { "DEPTH_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_CLEAR_VALUE, (intptr_t)0 },
-    { "DEPTH_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_FUNC, (intptr_t)0 },
-    { "STENCIL_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_CLEAR_VALUE, (intptr_t)0 },
-    { "STENCIL_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_FUNC, (intptr_t)0 },
-    { "STENCIL_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_FAIL, (intptr_t)0 },
-    { "STENCIL_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_FAIL, (intptr_t)0 },
-    { "STENCIL_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_PASS, (intptr_t)0 },
-    { "STENCIL_REF", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_REF, (intptr_t)0 },
-    { "STENCIL_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_VALUE_MASK, (intptr_t)0 },
-    { "STENCIL_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_WRITEMASK, (intptr_t)0 },
-    { "STENCIL_BACK_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_FUNC, (intptr_t)0 },
-    { "STENCIL_BACK_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_FAIL, (intptr_t)0 },
-    { "STENCIL_BACK_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_FAIL, (intptr_t)0 },
-    { "STENCIL_BACK_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_PASS, (intptr_t)0 },
-    { "STENCIL_BACK_REF", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_REF, (intptr_t)0 },
-    { "STENCIL_BACK_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_VALUE_MASK, (intptr_t)0 },
-    { "STENCIL_BACK_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_WRITEMASK, (intptr_t)0 },
-    { "VIEWPORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVIEWPORT, (intptr_t)0 },
-    { "SCISSOR_BOX", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSCISSOR_BOX, (intptr_t)0 },
-    { "COLOR_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_CLEAR_VALUE, (intptr_t)0 },
-    { "COLOR_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_WRITEMASK, (intptr_t)0 },
-    { "UNPACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNPACK_ALIGNMENT, (intptr_t)0 },
-    { "PACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPACK_ALIGNMENT, (intptr_t)0 },
-    { "MAX_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_TEXTURE_SIZE, (intptr_t)0 },
-    { "MAX_VIEWPORT_DIMS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VIEWPORT_DIMS, (intptr_t)0 },
-    { "SUBPIXEL_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSUBPIXEL_BITS, (intptr_t)0 },
-    { "RED_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRED_BITS, (intptr_t)0 },
-    { "GREEN_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGREEN_BITS, (intptr_t)0 },
-    { "BLUE_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLUE_BITS, (intptr_t)0 },
-    { "ALPHA_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALPHA_BITS, (intptr_t)0 },
-    { "DEPTH_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_BITS, (intptr_t)0 },
-    { "STENCIL_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BITS, (intptr_t)0 },
-    { "POLYGON_OFFSET_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_UNITS, (intptr_t)0 },
-    { "POLYGON_OFFSET_FACTOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_FACTOR, (intptr_t)0 },
-    { "TEXTURE_BINDING_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_BINDING_2D, (intptr_t)0 },
-    { "SAMPLE_BUFFERS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_BUFFERS, (intptr_t)0 },
-    { "SAMPLES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLES, (intptr_t)0 },
-    { "SAMPLE_COVERAGE_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE_VALUE, (intptr_t)0 },
-    { "SAMPLE_COVERAGE_INVERT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE_INVERT, (intptr_t)0 },
-    { "NUM_COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNUM_COMPRESSED_TEXTURE_FORMATS, (intptr_t)0 },
-    { "COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOMPRESSED_TEXTURE_FORMATS, (intptr_t)0 },
-    { "DONT_CARE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDONT_CARE, (intptr_t)0 },
-    { "FASTEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFASTEST, (intptr_t)0 },
-    { "NICEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNICEST, (intptr_t)0 },
-    { "GENERATE_MIPMAP_HINT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGENERATE_MIPMAP_HINT, (intptr_t)0 },
-    { "BYTE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBYTE, (intptr_t)0 },
-    { "UNSIGNED_BYTE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_BYTE, (intptr_t)0 },
-    { "SHORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHORT, (intptr_t)0 },
-    { "UNSIGNED_SHORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT, (intptr_t)0 },
-    { "INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT, (intptr_t)0 },
-    { "UNSIGNED_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_INT, (intptr_t)0 },
-    { "FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT, (intptr_t)0 },
-    { "FIXED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFIXED, (intptr_t)0 },
-    { "DEPTH_COMPONENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_COMPONENT, (intptr_t)0 },
-    { "ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALPHA, (intptr_t)0 },
-    { "RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB, (intptr_t)0 },
-    { "RGBA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGBA, (intptr_t)0 },
-    { "LUMINANCE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLUMINANCE, (intptr_t)0 },
-    { "LUMINANCE_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLUMINANCE_ALPHA, (intptr_t)0 },
-    { "UNSIGNED_SHORT_4_4_4_4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_4_4_4_4, (intptr_t)0 },
-    { "UNSIGNED_SHORT_5_5_5_1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_5_5_5_1, (intptr_t)0 },
-    { "UNSIGNED_SHORT_5_6_5", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_5_6_5, (intptr_t)0 },
-    { "FRAGMENT_SHADER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAGMENT_SHADER, (intptr_t)0 },
-    { "VERTEX_SHADER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_SHADER, (intptr_t)0 },
-    { "MAX_VERTEX_ATTRIBS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_ATTRIBS, (intptr_t)0 },
-    { "MAX_VERTEX_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_UNIFORM_VECTORS, (intptr_t)0 },
-    { "MAX_VARYING_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VARYING_VECTORS, (intptr_t)0 },
-    { "MAX_COMBINED_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_COMBINED_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
-    { "MAX_VERTEX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
-    { "MAX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
-    { "MAX_FRAGMENT_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_FRAGMENT_UNIFORM_VECTORS, (intptr_t)0 },
-    { "SHADER_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_TYPE, (intptr_t)0 },
-    { "DELETE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDELETE_STATUS, (intptr_t)0 },
-    { "LINK_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINK_STATUS, (intptr_t)0 },
-    { "VALIDATE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVALIDATE_STATUS, (intptr_t)0 },
-    { "ATTACHED_SHADERS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DATTACHED_SHADERS, (intptr_t)0 },
-    { "ACTIVE_UNIFORMS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_UNIFORMS, (intptr_t)0 },
-    { "ACTIVE_UNIFORM_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_UNIFORM_MAX_LENGTH, (intptr_t)0 },
-    { "ACTIVE_ATTRIBUTES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_ATTRIBUTES, (intptr_t)0 },
-    { "ACTIVE_ATTRIBUTE_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_ATTRIBUTE_MAX_LENGTH, (intptr_t)0 },
-    { "SHADING_LANGUAGE_VERSION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADING_LANGUAGE_VERSION, (intptr_t)0 },
-    { "CURRENT_PROGRAM", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCURRENT_PROGRAM, (intptr_t)0 },
-    { "NEVER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEVER, (intptr_t)0 },
-    { "LESS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLESS, (intptr_t)0 },
-    { "EQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DEQUAL, (intptr_t)0 },
-    { "LEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLEQUAL, (intptr_t)0 },
-    { "GREATER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGREATER, (intptr_t)0 },
-    { "NOTEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNOTEQUAL, (intptr_t)0 },
-    { "GEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGEQUAL, (intptr_t)0 },
-    { "ALWAYS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALWAYS, (intptr_t)0 },
-    { "KEEP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DKEEP, (intptr_t)0 },
-    { "REPLACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DREPLACE, (intptr_t)0 },
-    { "INCR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINCR, (intptr_t)0 },
-    { "DECR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDECR, (intptr_t)0 },
-    { "INVERT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVERT, (intptr_t)0 },
-    { "INCR_WRAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINCR_WRAP, (intptr_t)0 },
-    { "DECR_WRAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDECR_WRAP, (intptr_t)0 },
-    { "VENDOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVENDOR, (intptr_t)0 },
-    { "RENDERER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERER, (intptr_t)0 },
-    { "VERSION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERSION, (intptr_t)0 },
-    { "EXTENSIONS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DEXTENSIONS, (intptr_t)0 },
-    { "NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST, (intptr_t)0 },
-    { "LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR, (intptr_t)0 },
-    { "NEAREST_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST_MIPMAP_NEAREST, (intptr_t)0 },
-    { "LINEAR_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR_MIPMAP_NEAREST, (intptr_t)0 },
-    { "NEAREST_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST_MIPMAP_LINEAR, (intptr_t)0 },
-    { "LINEAR_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR_MIPMAP_LINEAR, (intptr_t)0 },
-    { "TEXTURE_MAG_FILTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_MAG_FILTER, (intptr_t)0 },
-    { "TEXTURE_MIN_FILTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_MIN_FILTER, (intptr_t)0 },
-    { "TEXTURE_WRAP_S", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_WRAP_S, (intptr_t)0 },
-    { "TEXTURE_WRAP_T", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_WRAP_T, (intptr_t)0 },
-    { "TEXTURE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP, (intptr_t)0 },
-    { "TEXTURE_BINDING_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_BINDING_CUBE_MAP, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_POSITIVE_X", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_X, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_NEGATIVE_X", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_X, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_POSITIVE_Y", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Y, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_NEGATIVE_Y", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Y, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_POSITIVE_Z", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Z, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_NEGATIVE_Z", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Z, (intptr_t)0 },
-    { "MAX_CUBE_MAP_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_CUBE_MAP_TEXTURE_SIZE, (intptr_t)0 },
-    { "TEXTURE0", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE0, (intptr_t)0 },
-    { "TEXTURE1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE1, (intptr_t)0 },
-    { "TEXTURE2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE2, (intptr_t)0 },
-    { "TEXTURE3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE3, (intptr_t)0 },
-    { "TEXTURE4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE4, (intptr_t)0 },
-    { "TEXTURE5", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE5, (intptr_t)0 },
-    { "TEXTURE6", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE6, (intptr_t)0 },
-    { "TEXTURE7", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE7, (intptr_t)0 },
-    { "TEXTURE8", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE8, (intptr_t)0 },
-    { "TEXTURE9", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE9, (intptr_t)0 },
-    { "TEXTURE10", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE10, (intptr_t)0 },
-    { "TEXTURE11", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE11, (intptr_t)0 },
-    { "TEXTURE12", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE12, (intptr_t)0 },
-    { "TEXTURE13", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE13, (intptr_t)0 },
-    { "TEXTURE14", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE14, (intptr_t)0 },
-    { "TEXTURE15", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE15, (intptr_t)0 },
-    { "TEXTURE16", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE16, (intptr_t)0 },
-    { "TEXTURE17", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE17, (intptr_t)0 },
-    { "TEXTURE18", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE18, (intptr_t)0 },
-    { "TEXTURE19", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE19, (intptr_t)0 },
-    { "TEXTURE20", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE20, (intptr_t)0 },
-    { "TEXTURE21", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE21, (intptr_t)0 },
-    { "TEXTURE22", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE22, (intptr_t)0 },
-    { "TEXTURE23", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE23, (intptr_t)0 },
-    { "TEXTURE24", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE24, (intptr_t)0 },
-    { "TEXTURE25", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE25, (intptr_t)0 },
-    { "TEXTURE26", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE26, (intptr_t)0 },
-    { "TEXTURE27", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE27, (intptr_t)0 },
-    { "TEXTURE28", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE28, (intptr_t)0 },
-    { "TEXTURE29", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE29, (intptr_t)0 },
-    { "TEXTURE30", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE30, (intptr_t)0 },
-    { "TEXTURE31", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE31, (intptr_t)0 },
-    { "ACTIVE_TEXTURE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_TEXTURE, (intptr_t)0 },
-    { "REPEAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DREPEAT, (intptr_t)0 },
-    { "CLAMP_TO_EDGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCLAMP_TO_EDGE, (intptr_t)0 },
-    { "MIRRORED_REPEAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMIRRORED_REPEAT, (intptr_t)0 },
-    { "FLOAT_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC2, (intptr_t)0 },
-    { "FLOAT_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC3, (intptr_t)0 },
-    { "FLOAT_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC4, (intptr_t)0 },
-    { "INT_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC2, (intptr_t)0 },
-    { "INT_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC3, (intptr_t)0 },
-    { "INT_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC4, (intptr_t)0 },
-    { "BOOL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL, (intptr_t)0 },
-    { "BOOL_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC2, (intptr_t)0 },
-    { "BOOL_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC3, (intptr_t)0 },
-    { "BOOL_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC4, (intptr_t)0 },
-    { "FLOAT_MAT2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT2, (intptr_t)0 },
-    { "FLOAT_MAT3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT3, (intptr_t)0 },
-    { "FLOAT_MAT4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT4, (intptr_t)0 },
-    { "SAMPLER_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLER_2D, (intptr_t)0 },
-    { "SAMPLER_CUBE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLER_CUBE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_ENABLED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_ENABLED, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_SIZE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_STRIDE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_STRIDE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_TYPE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_NORMALIZED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_NORMALIZED, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_POINTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_POINTER, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_BUFFER_BINDING, (intptr_t)0 },
-    { "IMPLEMENTATION_COLOR_READ_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_TYPE, (intptr_t)0 },
-    { "IMPLEMENTATION_COLOR_READ_FORMAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_FORMAT, (intptr_t)0 },
-    { "COMPILE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOMPILE_STATUS, (intptr_t)0 },
-    { "INFO_LOG_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINFO_LOG_LENGTH, (intptr_t)0 },
-    { "SHADER_SOURCE_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_SOURCE_LENGTH, (intptr_t)0 },
-    { "SHADER_COMPILER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_COMPILER, (intptr_t)0 },
-    { "SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_BINARY_FORMATS, (intptr_t)0 },
-    { "NUM_SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNUM_SHADER_BINARY_FORMATS, (intptr_t)0 },
-    { "LOW_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLOW_FLOAT, (intptr_t)0 },
-    { "MEDIUM_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMEDIUM_FLOAT, (intptr_t)0 },
-    { "HIGH_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DHIGH_FLOAT, (intptr_t)0 },
-    { "LOW_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLOW_INT, (intptr_t)0 },
-    { "MEDIUM_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMEDIUM_INT, (intptr_t)0 },
-    { "HIGH_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DHIGH_INT, (intptr_t)0 },
-    { "FRAMEBUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER, (intptr_t)0 },
-    { "RENDERBUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER, (intptr_t)0 },
-    { "RGBA4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGBA4, (intptr_t)0 },
-    { "RGB5_A1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB5_A1, (intptr_t)0 },
-    { "RGB565", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB565, (intptr_t)0 },
-    { "DEPTH_COMPONENT16", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_COMPONENT16, (intptr_t)0 },
-    { "STENCIL_INDEX", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_INDEX, (intptr_t)0 },
-    { "STENCIL_INDEX8", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_INDEX8, (intptr_t)0 },
-    { "RENDERBUFFER_WIDTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_WIDTH, (intptr_t)0 },
-    { "RENDERBUFFER_HEIGHT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_HEIGHT, (intptr_t)0 },
-    { "RENDERBUFFER_INTERNAL_FORMAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_INTERNAL_FORMAT, (intptr_t)0 },
-    { "RENDERBUFFER_RED_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_RED_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_GREEN_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_GREEN_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_BLUE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_BLUE_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_ALPHA_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_ALPHA_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_DEPTH_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_DEPTH_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_STENCIL_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_STENCIL_SIZE, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_OBJECT_NAME", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_NAME, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE, (intptr_t)0 },
-    { "COLOR_ATTACHMENT0", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_ATTACHMENT0, (intptr_t)0 },
-    { "DEPTH_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_ATTACHMENT, (intptr_t)0 },
-    { "STENCIL_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_ATTACHMENT, (intptr_t)0 },
-    { "NONE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNONE, (intptr_t)0 },
-    { "FRAMEBUFFER_COMPLETE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_COMPLETE, (intptr_t)0 },
-    { "FRAMEBUFFER_INCOMPLETE_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_ATTACHMENT, (intptr_t)0 },
-    { "FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT, (intptr_t)0 },
-    { "FRAMEBUFFER_INCOMPLETE_DIMENSIONS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_DIMENSIONS, (intptr_t)0 },
-    { "FRAMEBUFFER_UNSUPPORTED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_UNSUPPORTED, (intptr_t)0 },
-    { "FRAMEBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_BINDING, (intptr_t)0 },
-    { "RENDERBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_BINDING, (intptr_t)0 },
-    { "MAX_RENDERBUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_RENDERBUFFER_SIZE, (intptr_t)0 },
-    { "INVALID_FRAMEBUFFER_OPERATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_FRAMEBUFFER_OPERATION, (intptr_t)0 },
-    { "sizeInBytes", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionSizeInBytes, (intptr_t)1 },
-    { "activeTexture", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionActiveTexture, (intptr_t)1 },
-    { "attachShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionAttachShader, (intptr_t)2 },
-    { "bindAttribLocation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBindAttribLocation, (intptr_t)3 },
-    { "bindBuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBindBuffer, (intptr_t)2 },
-    { "bindFramebuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBindFramebuffer, (intptr_t)2 },
-    { "bindRenderbuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBindRenderbuffer, (intptr_t)2 },
-    { "bindTexture", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBindTexture, (intptr_t)2 },
-    { "blendColor", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBlendColor, (intptr_t)4 },
-    { "blendEquation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBlendEquation, (intptr_t)1 },
-    { "blendEquationSeparate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBlendEquationSeparate, (intptr_t)2 },
-    { "blendFunc", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBlendFunc, (intptr_t)2 },
-    { "blendFuncSeparate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBlendFuncSeparate, (intptr_t)4 },
-    { "bufferData", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBufferData, (intptr_t)0 },
-    { "bufferSubData", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBufferSubData, (intptr_t)0 },
-    { "checkFramebufferStatus", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCheckFramebufferStatus, (intptr_t)1 },
-    { "clear", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionClear, (intptr_t)1 },
-    { "clearColor", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionClearColor, (intptr_t)4 },
-    { "clearDepth", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionClearDepth, (intptr_t)1 },
-    { "clearStencil", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionClearStencil, (intptr_t)1 },
-    { "colorMask", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionColorMask, (intptr_t)4 },
-    { "compileShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCompileShader, (intptr_t)1 },
-    { "copyTexImage2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCopyTexImage2D, (intptr_t)8 },
-    { "copyTexSubImage2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCopyTexSubImage2D, (intptr_t)8 },
-    { "createBuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateBuffer, (intptr_t)0 },
-    { "createFramebuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateFramebuffer, (intptr_t)0 },
-    { "createProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateProgram, (intptr_t)0 },
-    { "createRenderbuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateRenderbuffer, (intptr_t)0 },
-    { "createShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateShader, (intptr_t)1 },
-    { "createTexture", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateTexture, (intptr_t)0 },
-    { "cullFace", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCullFace, (intptr_t)1 },
-    { "deleteBuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteBuffer, (intptr_t)1 },
-    { "deleteFramebuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteFramebuffer, (intptr_t)1 },
-    { "deleteProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteProgram, (intptr_t)1 },
-    { "deleteRenderbuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteRenderbuffer, (intptr_t)1 },
-    { "deleteShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteShader, (intptr_t)1 },
-    { "deleteTexture", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteTexture, (intptr_t)1 },
-    { "depthFunc", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDepthFunc, (intptr_t)1 },
-    { "depthMask", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDepthMask, (intptr_t)1 },
-    { "depthRange", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDepthRange, (intptr_t)2 },
-    { "detachShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDetachShader, (intptr_t)2 },
-    { "disable", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDisable, (intptr_t)1 },
-    { "disableVertexAttribArray", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDisableVertexAttribArray, (intptr_t)1 },
-    { "drawArrays", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDrawArrays, (intptr_t)3 },
-    { "drawElements", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDrawElements, (intptr_t)4 },
-    { "enable", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionEnable, (intptr_t)1 },
-    { "enableVertexAttribArray", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionEnableVertexAttribArray, (intptr_t)1 },
-    { "finish", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFinish, (intptr_t)0 },
-    { "flush", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFlush, (intptr_t)0 },
-    { "framebufferRenderbuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFramebufferRenderbuffer, (intptr_t)4 },
-    { "framebufferTexture2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFramebufferTexture2D, (intptr_t)5 },
-    { "frontFace", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFrontFace, (intptr_t)1 },
-    { "generateMipmap", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGenerateMipmap, (intptr_t)1 },
-    { "getActiveAttrib", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetActiveAttrib, (intptr_t)2 },
-    { "getActiveUniform", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetActiveUniform, (intptr_t)2 },
-    { "getAttribLocation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetAttribLocation, (intptr_t)2 },
-    { "getBoolean", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBoolean, (intptr_t)1 },
-    { "getBooleanv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBooleanv, (intptr_t)1 },
-    { "getBufferParameteri", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteri, (intptr_t)2 },
-    { "getBufferParameteriv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteriv, (intptr_t)2 },
-    { "getError", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetError, (intptr_t)0 },
-    { "getFloat", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetFloat, (intptr_t)1 },
-    { "getFloatv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetFloatv, (intptr_t)1 },
-    { "getFramebufferAttachmentParameteri", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteri, (intptr_t)3 },
-    { "getFramebufferAttachmentParameteriv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteriv, (intptr_t)3 },
-    { "getInteger", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetInteger, (intptr_t)1 },
-    { "getIntegerv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetIntegerv, (intptr_t)1 },
-    { "getProgrami", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetProgrami, (intptr_t)2 },
-    { "getProgramiv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetProgramiv, (intptr_t)2 },
-    { "getProgramInfoLog", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetProgramInfoLog, (intptr_t)1 },
-    { "getRenderbufferParameteri", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteri, (intptr_t)2 },
-    { "getRenderbufferParameteriv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteriv, (intptr_t)2 },
-    { "getShaderi", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetShaderi, (intptr_t)2 },
-    { "getShaderiv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetShaderiv, (intptr_t)2 },
-    { "getShaderInfoLog", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetShaderInfoLog, (intptr_t)1 },
-    { "getShaderSource", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetShaderSource, (intptr_t)1 },
-    { "getString", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetString, (intptr_t)1 },
-    { "getTexParameterf", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterf, (intptr_t)2 },
-    { "getTexParameterfv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterfv, (intptr_t)2 },
-    { "getTexParameteri", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteri, (intptr_t)2 },
-    { "getTexParameteriv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteriv, (intptr_t)2 },
-    { "getUniformf", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetUniformf, (intptr_t)2 },
-    { "getUniformfv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetUniformfv, (intptr_t)2 },
-    { "getUniformi", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetUniformi, (intptr_t)2 },
-    { "getUniformiv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetUniformiv, (intptr_t)2 },
-    { "getUniformLocation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetUniformLocation, (intptr_t)2 },
-    { "getVertexAttribf", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribf, (intptr_t)2 },
-    { "getVertexAttribfv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribfv, (intptr_t)2 },
-    { "getVertexAttribi", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribi, (intptr_t)2 },
-    { "getVertexAttribiv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribiv, (intptr_t)2 },
-    { "getVertexAttribOffset", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribOffset, (intptr_t)2 },
-    { "hint", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionHint, (intptr_t)2 },
-    { "isBuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsBuffer, (intptr_t)1 },
-    { "isEnabled", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsEnabled, (intptr_t)1 },
-    { "isFramebuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsFramebuffer, (intptr_t)1 },
-    { "isProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsProgram, (intptr_t)1 },
-    { "isRenderbuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsRenderbuffer, (intptr_t)1 },
-    { "isShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsShader, (intptr_t)1 },
-    { "isTexture", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsTexture, (intptr_t)1 },
-    { "lineWidth", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionLineWidth, (intptr_t)1 },
-    { "linkProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionLinkProgram, (intptr_t)1 },
-    { "pixelStorei", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionPixelStorei, (intptr_t)2 },
-    { "polygonOffset", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionPolygonOffset, (intptr_t)2 },
-    { "readPixels", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionReadPixels, (intptr_t)6 },
-    { "releaseShaderCompiler", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionReleaseShaderCompiler, (intptr_t)0 },
-    { "renderbufferStorage", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionRenderbufferStorage, (intptr_t)4 },
-    { "sampleCoverage", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionSampleCoverage, (intptr_t)2 },
-    { "scissor", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionScissor, (intptr_t)4 },
-    { "shaderSource", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionShaderSource, (intptr_t)2 },
-    { "stencilFunc", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilFunc, (intptr_t)3 },
-    { "stencilFuncSeparate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilFuncSeparate, (intptr_t)4 },
-    { "stencilMask", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilMask, (intptr_t)1 },
-    { "stencilMaskSeparate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilMaskSeparate, (intptr_t)2 },
-    { "stencilOp", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilOp, (intptr_t)3 },
-    { "stencilOpSeparate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilOpSeparate, (intptr_t)4 },
-    { "texParameterf", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionTexParameterf, (intptr_t)3 },
-    { "texParameteri", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionTexParameteri, (intptr_t)3 },
-    { "texImage2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionTexImage2D, (intptr_t)0 },
-    { "texSubImage2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionTexSubImage2D, (intptr_t)0 },
-    { "uniform1f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform1f, (intptr_t)2 },
-    { "uniform1fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform1fv, (intptr_t)2 },
-    { "uniform1i", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform1i, (intptr_t)2 },
-    { "uniform1iv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform1iv, (intptr_t)2 },
-    { "uniform2f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform2f, (intptr_t)3 },
-    { "uniform2fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform2fv, (intptr_t)2 },
-    { "uniform2i", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform2i, (intptr_t)3 },
-    { "uniform2iv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform2iv, (intptr_t)2 },
-    { "uniform3f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform3f, (intptr_t)4 },
-    { "uniform3fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform3fv, (intptr_t)2 },
-    { "uniform3i", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform3i, (intptr_t)4 },
-    { "uniform3iv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform3iv, (intptr_t)2 },
-    { "uniform4f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform4f, (intptr_t)5 },
-    { "uniform4fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform4fv, (intptr_t)2 },
-    { "uniform4i", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform4i, (intptr_t)5 },
-    { "uniform4iv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform4iv, (intptr_t)2 },
-    { "uniformMatrix2fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix2fv, (intptr_t)3 },
-    { "uniformMatrix3fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix3fv, (intptr_t)3 },
-    { "uniformMatrix4fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix4fv, (intptr_t)3 },
-    { "useProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUseProgram, (intptr_t)1 },
-    { "validateProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionValidateProgram, (intptr_t)1 },
-    { "vertexAttrib1f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1f, (intptr_t)2 },
-    { "vertexAttrib1fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1fv, (intptr_t)2 },
-    { "vertexAttrib2f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2f, (intptr_t)3 },
-    { "vertexAttrib2fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2fv, (intptr_t)2 },
-    { "vertexAttrib3f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3f, (intptr_t)4 },
-    { "vertexAttrib3fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3fv, (intptr_t)2 },
-    { "vertexAttrib4f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4f, (intptr_t)5 },
-    { "vertexAttrib4fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4fv, (intptr_t)2 },
-    { "vertexAttribPointer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttribPointer, (intptr_t)6 },
-    { "viewport", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionViewport, (intptr_t)4 },
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasRenderingContext3DPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 65535, JSCanvasRenderingContext3DPrototypeTableValues, 0 };
-#else
-    { 1104, 1023, JSCanvasRenderingContext3DPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasRenderingContext3DPrototype::s_info = { "CanvasRenderingContext3DPrototype", 0, &JSCanvasRenderingContext3DPrototypeTable, 0 };
-
-JSObject* JSCanvasRenderingContext3DPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasRenderingContext3D>(exec, globalObject);
-}
-
-bool JSCanvasRenderingContext3DPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticPropertySlot<JSCanvasRenderingContext3DPrototype, JSObject>(exec, &JSCanvasRenderingContext3DPrototypeTable, this, propertyName, slot);
-}
-
-bool JSCanvasRenderingContext3DPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    return getStaticPropertyDescriptor<JSCanvasRenderingContext3DPrototype, JSObject>(exec, &JSCanvasRenderingContext3DPrototypeTable, this, propertyName, descriptor);
-}
-
-const ClassInfo JSCanvasRenderingContext3D::s_info = { "CanvasRenderingContext3D", &JSCanvasRenderingContext::s_info, &JSCanvasRenderingContext3DTable, 0 };
-
-JSCanvasRenderingContext3D::JSCanvasRenderingContext3D(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasRenderingContext3D> impl)
-    : JSCanvasRenderingContext(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasRenderingContext3D::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasRenderingContext3DPrototype(JSCanvasRenderingContext3DPrototype::createStructure(JSCanvasRenderingContextPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasRenderingContext3D::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticValueSlot<JSCanvasRenderingContext3D, Base>(exec, &JSCanvasRenderingContext3DTable, this, propertyName, slot);
-}
-
-bool JSCanvasRenderingContext3D::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    return getStaticValueDescriptor<JSCanvasRenderingContext3D, Base>(exec, &JSCanvasRenderingContext3DTable, this, propertyName, descriptor);
-}
-
-JSValue jsCanvasRenderingContext3DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSCanvasRenderingContext3D* domObject = static_cast<JSCanvasRenderingContext3D*>(asObject(slot.slotBase()));
-    return JSCanvasRenderingContext3D::getConstructor(exec, domObject->globalObject());
-}
-JSValue JSCanvasRenderingContext3D::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMConstructor<JSCanvasRenderingContext3DConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionSizeInBytes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    unsigned type = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->sizeInBytes(type, ec));
-    setDOMException(exec, ec);
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionActiveTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned texture = args.at(0).toInt32(exec);
-
-    imp->activeTexture(texture);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionAttachShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    CanvasShader* shader = toCanvasShader(args.at(1));
-
-    imp->attachShader(program, shader);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindAttribLocation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    unsigned index = args.at(1).toInt32(exec);
-    const UString& name = args.at(2).toString(exec);
-
-    imp->bindAttribLocation(program, index, name);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    CanvasBuffer* buffer = toCanvasBuffer(args.at(1));
-
-    imp->bindBuffer(target, buffer);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    CanvasFramebuffer* framebuffer = toCanvasFramebuffer(args.at(1));
-
-    imp->bindFramebuffer(target, framebuffer);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    CanvasRenderbuffer* renderbuffer = toCanvasRenderbuffer(args.at(1));
-
-    imp->bindRenderbuffer(target, renderbuffer);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    CanvasTexture* texture = toCanvasTexture(args.at(1));
-
-    imp->bindTexture(target, texture);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    double red = args.at(0).toNumber(exec);
-    double green = args.at(1).toNumber(exec);
-    double blue = args.at(2).toNumber(exec);
-    double alpha = args.at(3).toNumber(exec);
-
-    imp->blendColor(red, green, blue, alpha);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendEquation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned mode = args.at(0).toInt32(exec);
-
-    imp->blendEquation(mode);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendEquationSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned modeRGB = args.at(0).toInt32(exec);
-    unsigned modeAlpha = args.at(1).toInt32(exec);
-
-    imp->blendEquationSeparate(modeRGB, modeAlpha);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendFunc(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned sfactor = args.at(0).toInt32(exec);
-    unsigned dfactor = args.at(1).toInt32(exec);
-
-    imp->blendFunc(sfactor, dfactor);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendFuncSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned srcRGB = args.at(0).toInt32(exec);
-    unsigned dstRGB = args.at(1).toInt32(exec);
-    unsigned srcAlpha = args.at(2).toInt32(exec);
-    unsigned dstAlpha = args.at(3).toInt32(exec);
-
-    imp->blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBufferData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->bufferData(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBufferSubData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->bufferSubData(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCheckFramebufferStatus(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->checkFramebufferStatus(target));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned mask = args.at(0).toInt32(exec);
-
-    imp->clear(mask);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    double red = args.at(0).toNumber(exec);
-    double green = args.at(1).toNumber(exec);
-    double blue = args.at(2).toNumber(exec);
-    double alpha = args.at(3).toNumber(exec);
-
-    imp->clearColor(red, green, blue, alpha);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearDepth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    double depth = args.at(0).toNumber(exec);
-
-    imp->clearDepth(depth);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearStencil(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int s = args.at(0).toInt32(exec);
-
-    imp->clearStencil(s);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionColorMask(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    bool red = args.at(0).toBoolean(exec);
-    bool green = args.at(1).toBoolean(exec);
-    bool blue = args.at(2).toBoolean(exec);
-    bool alpha = args.at(3).toBoolean(exec);
-
-    imp->colorMask(red, green, blue, alpha);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCompileShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-
-    imp->compileShader(shader);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCopyTexImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    int level = args.at(1).toInt32(exec);
-    unsigned internalformat = args.at(2).toInt32(exec);
-    int x = args.at(3).toInt32(exec);
-    int y = args.at(4).toInt32(exec);
-    unsigned width = args.at(5).toInt32(exec);
-    unsigned height = args.at(6).toInt32(exec);
-    int border = args.at(7).toInt32(exec);
-
-    imp->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCopyTexSubImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    int level = args.at(1).toInt32(exec);
-    int xoffset = args.at(2).toInt32(exec);
-    int yoffset = args.at(3).toInt32(exec);
-    int x = args.at(4).toInt32(exec);
-    int y = args.at(5).toInt32(exec);
-    unsigned width = args.at(6).toInt32(exec);
-    unsigned height = args.at(7).toInt32(exec);
-
-    imp->copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createBuffer()));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createFramebuffer()));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createProgram()));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createRenderbuffer()));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned type = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createShader(type)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createTexture()));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCullFace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned mode = args.at(0).toInt32(exec);
-
-    imp->cullFace(mode);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasBuffer* buffer = toCanvasBuffer(args.at(0));
-
-    imp->deleteBuffer(buffer);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasFramebuffer* framebuffer = toCanvasFramebuffer(args.at(0));
-
-    imp->deleteFramebuffer(framebuffer);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-
-    imp->deleteProgram(program);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasRenderbuffer* renderbuffer = toCanvasRenderbuffer(args.at(0));
-
-    imp->deleteRenderbuffer(renderbuffer);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-
-    imp->deleteShader(shader);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasTexture* texture = toCanvasTexture(args.at(0));
-
-    imp->deleteTexture(texture);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthFunc(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned func = args.at(0).toInt32(exec);
-
-    imp->depthFunc(func);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthMask(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    bool flag = args.at(0).toBoolean(exec);
-
-    imp->depthMask(flag);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    double zNear = args.at(0).toNumber(exec);
-    double zFar = args.at(1).toNumber(exec);
-
-    imp->depthRange(zNear, zFar);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDetachShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    CanvasShader* shader = toCanvasShader(args.at(1));
-
-    imp->detachShader(program, shader);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDisable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned cap = args.at(0).toInt32(exec);
-
-    imp->disable(cap);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDisableVertexAttribArray(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned index = args.at(0).toInt32(exec);
-
-    imp->disableVertexAttribArray(index);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDrawArrays(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned mode = args.at(0).toInt32(exec);
-    int first = args.at(1).toInt32(exec);
-    unsigned count = args.at(2).toInt32(exec);
-
-    imp->drawArrays(mode, first, count);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDrawElements(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned mode = args.at(0).toInt32(exec);
-    int count = args.at(1).toInt32(exec);
-    unsigned type = args.at(2).toInt32(exec);
-    unsigned offset = args.at(3).toInt32(exec);
-
-    imp->drawElements(mode, count, type, offset);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionEnable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned cap = args.at(0).toInt32(exec);
-
-    imp->enable(cap);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionEnableVertexAttribArray(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned index = args.at(0).toInt32(exec);
-
-    imp->enableVertexAttribArray(index);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFinish(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-    imp->finish();
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFlush(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-    imp->flush();
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebufferRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned attachment = args.at(1).toInt32(exec);
-    unsigned renderbuffertarget = args.at(2).toInt32(exec);
-    CanvasRenderbuffer* renderbuffer = toCanvasRenderbuffer(args.at(3));
-
-    imp->framebufferRenderbuffer(target, attachment, renderbuffertarget, renderbuffer);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebufferTexture2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned attachment = args.at(1).toInt32(exec);
-    unsigned textarget = args.at(2).toInt32(exec);
-    CanvasTexture* texture = toCanvasTexture(args.at(3));
-    int level = args.at(4).toInt32(exec);
-
-    imp->framebufferTexture2D(target, attachment, textarget, texture, level);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFrontFace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned mode = args.at(0).toInt32(exec);
-
-    imp->frontFace(mode);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGenerateMipmap(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-
-    imp->generateMipmap(target);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveAttrib(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    unsigned index = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getActiveAttrib(program, index, ec)));
-    setDOMException(exec, ec);
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveUniform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    unsigned index = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getActiveUniform(program, index, ec)));
-    setDOMException(exec, ec);
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetAttribLocation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    const UString& name = args.at(1).toString(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getAttribLocation(program, name));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBoolean(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned pname = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = jsBoolean(imp->getBoolean(pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBooleanv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned pname = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getBooleanv(pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getBufferParameteri(target, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteriv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getBufferParameteriv(target, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetError(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getError());
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFloat(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned pname = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getFloat(pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFloatv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned pname = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getFloatv(pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned attachment = args.at(1).toInt32(exec);
-    unsigned pname = args.at(2).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getFramebufferAttachmentParameteri(target, attachment, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteriv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned attachment = args.at(1).toInt32(exec);
-    unsigned pname = args.at(2).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getFramebufferAttachmentParameteriv(target, attachment, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetInteger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned pname = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getInteger(pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetIntegerv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned pname = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getIntegerv(pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgrami(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getProgrami(program, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgramiv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getProgramiv(program, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgramInfoLog(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-
-
-    JSC::JSValue result = jsString(exec, imp->getProgramInfoLog(program));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getRenderbufferParameteri(target, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteriv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getRenderbufferParameteriv(target, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderi(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getShaderi(shader, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderiv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getShaderiv(shader, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderInfoLog(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-
-
-    JSC::JSValue result = jsString(exec, imp->getShaderInfoLog(shader));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderSource(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-
-
-    JSC::JSValue result = jsString(exec, imp->getShaderSource(shader));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned name = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = jsString(exec, imp->getString(name));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getTexParameterf(target, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterfv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getTexParameterfv(target, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getTexParameteri(target, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteriv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getTexParameteriv(target, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    int location = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getUniformf(program, location));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformfv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    int location = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getUniformfv(program, location)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformi(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    int location = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getUniformi(program, location));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformiv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    int location = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getUniformiv(program, location)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformLocation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    const UString& name = args.at(1).toString(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getUniformLocation(program, name));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned index = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getVertexAttribf(index, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribfv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned index = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getVertexAttribfv(index, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribi(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned index = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getVertexAttribi(index, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribiv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned index = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getVertexAttribiv(index, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribOffset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned index = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getVertexAttribOffset(index, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionHint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned mode = args.at(1).toInt32(exec);
-
-    imp->hint(target, mode);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasBuffer* buffer = toCanvasBuffer(args.at(0));
-
-
-    JSC::JSValue result = jsBoolean(imp->isBuffer(buffer));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned cap = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = jsBoolean(imp->isEnabled(cap));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasFramebuffer* framebuffer = toCanvasFramebuffer(args.at(0));
-
-
-    JSC::JSValue result = jsBoolean(imp->isFramebuffer(framebuffer));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-
-
-    JSC::JSValue result = jsBoolean(imp->isProgram(program));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasRenderbuffer* renderbuffer = toCanvasRenderbuffer(args.at(0));
-
-
-    JSC::JSValue result = jsBoolean(imp->isRenderbuffer(renderbuffer));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-
-
-    JSC::JSValue result = jsBoolean(imp->isShader(shader));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasTexture* texture = toCanvasTexture(args.at(0));
-
-
-    JSC::JSValue result = jsBoolean(imp->isTexture(texture));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLineWidth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    double width = args.at(0).toNumber(exec);
-
-    imp->lineWidth(width);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLinkProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-
-    imp->linkProgram(program);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPixelStorei(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned pname = args.at(0).toInt32(exec);
-    int param = args.at(1).toInt32(exec);
-
-    imp->pixelStorei(pname, param);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPolygonOffset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    double factor = args.at(0).toNumber(exec);
-    double units = args.at(1).toNumber(exec);
-
-    imp->polygonOffset(factor, units);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReadPixels(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int x = args.at(0).toInt32(exec);
-    int y = args.at(1).toInt32(exec);
-    unsigned width = args.at(2).toInt32(exec);
-    unsigned height = args.at(3).toInt32(exec);
-    unsigned format = args.at(4).toInt32(exec);
-    unsigned type = args.at(5).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->readPixels(x, y, width, height, format, type)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReleaseShaderCompiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-    imp->releaseShaderCompiler();
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionRenderbufferStorage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned internalformat = args.at(1).toInt32(exec);
-    unsigned width = args.at(2).toInt32(exec);
-    unsigned height = args.at(3).toInt32(exec);
-
-    imp->renderbufferStorage(target, internalformat, width, height);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionSampleCoverage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    double value = args.at(0).toNumber(exec);
-    bool invert = args.at(1).toBoolean(exec);
-
-    imp->sampleCoverage(value, invert);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionScissor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int x = args.at(0).toInt32(exec);
-    int y = args.at(1).toInt32(exec);
-    unsigned width = args.at(2).toInt32(exec);
-    unsigned height = args.at(3).toInt32(exec);
-
-    imp->scissor(x, y, width, height);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionShaderSource(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-    const UString& string = args.at(1).toString(exec);
-
-    imp->shaderSource(shader, string);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilFunc(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned func = args.at(0).toInt32(exec);
-    int ref = args.at(1).toInt32(exec);
-    unsigned mask = args.at(2).toInt32(exec);
-
-    imp->stencilFunc(func, ref, mask);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilFuncSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned face = args.at(0).toInt32(exec);
-    unsigned func = args.at(1).toInt32(exec);
-    int ref = args.at(2).toInt32(exec);
-    unsigned mask = args.at(3).toInt32(exec);
-
-    imp->stencilFuncSeparate(face, func, ref, mask);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilMask(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned mask = args.at(0).toInt32(exec);
-
-    imp->stencilMask(mask);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilMaskSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned face = args.at(0).toInt32(exec);
-    unsigned mask = args.at(1).toInt32(exec);
-
-    imp->stencilMaskSeparate(face, mask);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilOp(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned fail = args.at(0).toInt32(exec);
-    unsigned zfail = args.at(1).toInt32(exec);
-    unsigned zpass = args.at(2).toInt32(exec);
-
-    imp->stencilOp(fail, zfail, zpass);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilOpSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned face = args.at(0).toInt32(exec);
-    unsigned fail = args.at(1).toInt32(exec);
-    unsigned zfail = args.at(2).toInt32(exec);
-    unsigned zpass = args.at(3).toInt32(exec);
-
-    imp->stencilOpSeparate(face, fail, zfail, zpass);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexParameterf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-    float param = args.at(2).toFloat(exec);
-
-    imp->texParameterf(target, pname, param);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-    int param = args.at(2).toInt32(exec);
-
-    imp->texParameteri(target, pname, param);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->texImage2D(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexSubImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->texSubImage2D(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-
-    imp->uniform1f(location, x);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform1fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    int x = args.at(1).toInt32(exec);
-
-    imp->uniform1i(location, x);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform1iv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-    float y = args.at(2).toFloat(exec);
-
-    imp->uniform2f(location, x, y);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform2fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    int x = args.at(1).toInt32(exec);
-    int y = args.at(2).toInt32(exec);
-
-    imp->uniform2i(location, x, y);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform2iv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-    float y = args.at(2).toFloat(exec);
-    float z = args.at(3).toFloat(exec);
-
-    imp->uniform3f(location, x, y, z);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform3fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    int x = args.at(1).toInt32(exec);
-    int y = args.at(2).toInt32(exec);
-    int z = args.at(3).toInt32(exec);
-
-    imp->uniform3i(location, x, y, z);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform3iv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-    float y = args.at(2).toFloat(exec);
-    float z = args.at(3).toFloat(exec);
-    float w = args.at(4).toFloat(exec);
-
-    imp->uniform4f(location, x, y, z, w);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform4fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    int x = args.at(1).toInt32(exec);
-    int y = args.at(2).toInt32(exec);
-    int z = args.at(3).toInt32(exec);
-    int w = args.at(4).toInt32(exec);
-
-    imp->uniform4i(location, x, y, z, w);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform4iv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix2fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniformMatrix2fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix3fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniformMatrix3fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix4fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniformMatrix4fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUseProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-
-    imp->useProgram(program);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionValidateProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-
-    imp->validateProgram(program);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned indx = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-
-    imp->vertexAttrib1f(indx, x);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->vertexAttrib1fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned indx = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-    float y = args.at(2).toFloat(exec);
-
-    imp->vertexAttrib2f(indx, x, y);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->vertexAttrib2fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned indx = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-    float y = args.at(2).toFloat(exec);
-    float z = args.at(3).toFloat(exec);
-
-    imp->vertexAttrib3f(indx, x, y, z);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->vertexAttrib3fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned indx = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-    float y = args.at(2).toFloat(exec);
-    float z = args.at(3).toFloat(exec);
-    float w = args.at(4).toFloat(exec);
-
-    imp->vertexAttrib4f(indx, x, y, z, w);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->vertexAttrib4fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttribPointer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned indx = args.at(0).toInt32(exec);
-    int size = args.at(1).toInt32(exec);
-    unsigned type = args.at(2).toInt32(exec);
-    bool normalized = args.at(3).toBoolean(exec);
-    int stride = args.at(4).toInt32(exec);
-    unsigned offset = args.at(5).toInt32(exec);
-
-    imp->vertexAttribPointer(indx, size, type, normalized, stride, offset);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionViewport(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int x = args.at(0).toInt32(exec);
-    int y = args.at(1).toInt32(exec);
-    unsigned width = args.at(2).toInt32(exec);
-    unsigned height = args.at(3).toInt32(exec);
-
-    imp->viewport(x, y, width, height);
-    return jsUndefined();
-}
-
-// Constant getters
-
-JSValue jsCanvasRenderingContext3DDEPTH_BUFFER_BIT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x00000100));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BUFFER_BIT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x00000400));
-}
-
-JSValue jsCanvasRenderingContext3DCOLOR_BUFFER_BIT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x00004000));
-}
-
-JSValue jsCanvasRenderingContext3DFALSE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0));
-}
-
-JSValue jsCanvasRenderingContext3DTRUE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(1));
-}
-
-JSValue jsCanvasRenderingContext3DPOINTS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0000));
-}
-
-JSValue jsCanvasRenderingContext3DLINES(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0001));
-}
-
-JSValue jsCanvasRenderingContext3DLINE_LOOP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0002));
-}
-
-JSValue jsCanvasRenderingContext3DLINE_STRIP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0003));
-}
-
-JSValue jsCanvasRenderingContext3DTRIANGLES(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0004));
-}
-
-JSValue jsCanvasRenderingContext3DTRIANGLE_STRIP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0005));
-}
-
-JSValue jsCanvasRenderingContext3DTRIANGLE_FAN(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0006));
-}
-
-JSValue jsCanvasRenderingContext3DZERO(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0));
-}
-
-JSValue jsCanvasRenderingContext3DONE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(1));
-}
-
-JSValue jsCanvasRenderingContext3DSRC_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0300));
-}
-
-JSValue jsCanvasRenderingContext3DONE_MINUS_SRC_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0301));
-}
-
-JSValue jsCanvasRenderingContext3DSRC_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0302));
-}
-
-JSValue jsCanvasRenderingContext3DONE_MINUS_SRC_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0303));
-}
-
-JSValue jsCanvasRenderingContext3DDST_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0304));
-}
-
-JSValue jsCanvasRenderingContext3DONE_MINUS_DST_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0305));
-}
-
-JSValue jsCanvasRenderingContext3DDST_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0306));
-}
-
-JSValue jsCanvasRenderingContext3DONE_MINUS_DST_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0307));
-}
-
-JSValue jsCanvasRenderingContext3DSRC_ALPHA_SATURATE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0308));
-}
-
-JSValue jsCanvasRenderingContext3DFUNC_ADD(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8006));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_EQUATION(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8009));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_EQUATION_RGB(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8009));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_EQUATION_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x883D));
-}
-
-JSValue jsCanvasRenderingContext3DFUNC_SUBTRACT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x800A));
-}
-
-JSValue jsCanvasRenderingContext3DFUNC_REVERSE_SUBTRACT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x800B));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_DST_RGB(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80C8));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_SRC_RGB(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80C9));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_DST_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80CA));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_SRC_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80CB));
-}
-
-JSValue jsCanvasRenderingContext3DCONSTANT_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8001));
-}
-
-JSValue jsCanvasRenderingContext3DONE_MINUS_CONSTANT_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8002));
-}
-
-JSValue jsCanvasRenderingContext3DCONSTANT_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8003));
-}
-
-JSValue jsCanvasRenderingContext3DONE_MINUS_CONSTANT_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8004));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8005));
-}
-
-JSValue jsCanvasRenderingContext3DARRAY_BUFFER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8892));
-}
-
-JSValue jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8893));
-}
-
-JSValue jsCanvasRenderingContext3DARRAY_BUFFER_BINDING(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8894));
-}
-
-JSValue jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER_BINDING(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8895));
-}
-
-JSValue jsCanvasRenderingContext3DSTREAM_DRAW(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x88E0));
-}
-
-JSValue jsCanvasRenderingContext3DSTATIC_DRAW(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x88E4));
-}
-
-JSValue jsCanvasRenderingContext3DDYNAMIC_DRAW(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x88E8));
-}
-
-JSValue jsCanvasRenderingContext3DBUFFER_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8764));
-}
-
-JSValue jsCanvasRenderingContext3DBUFFER_USAGE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8765));
-}
-
-JSValue jsCanvasRenderingContext3DCURRENT_VERTEX_ATTRIB(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8626));
-}
-
-JSValue jsCanvasRenderingContext3DFRONT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0404));
-}
-
-JSValue jsCanvasRenderingContext3DBACK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0405));
-}
-
-JSValue jsCanvasRenderingContext3DFRONT_AND_BACK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0408));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_2D(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0DE1));
-}
-
-JSValue jsCanvasRenderingContext3DCULL_FACE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B44));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0BE2));
-}
-
-JSValue jsCanvasRenderingContext3DDITHER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0BD0));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_TEST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B90));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_TEST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B71));
-}
-
-JSValue jsCanvasRenderingContext3DSCISSOR_TEST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0C11));
-}
-
-JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_FILL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8037));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLE_ALPHA_TO_COVERAGE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x809E));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80A0));
-}
-
-JSValue jsCanvasRenderingContext3DNO_ERROR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0));
-}
-
-JSValue jsCanvasRenderingContext3DINVALID_ENUM(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0500));
-}
-
-JSValue jsCanvasRenderingContext3DINVALID_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0501));
-}
-
-JSValue jsCanvasRenderingContext3DINVALID_OPERATION(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0502));
-}
-
-JSValue jsCanvasRenderingContext3DOUT_OF_MEMORY(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0505));
-}
-
-JSValue jsCanvasRenderingContext3DCW(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0900));
-}
-
-JSValue jsCanvasRenderingContext3DCCW(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0901));
-}
-
-JSValue jsCanvasRenderingContext3DLINE_WIDTH(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B21));
-}
-
-JSValue jsCanvasRenderingContext3DALIASED_POINT_SIZE_RANGE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x846D));
-}
-
-JSValue jsCanvasRenderingContext3DALIASED_LINE_WIDTH_RANGE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x846E));
-}
-
-JSValue jsCanvasRenderingContext3DCULL_FACE_MODE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B45));
-}
-
-JSValue jsCanvasRenderingContext3DFRONT_FACE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B46));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_RANGE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B70));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_WRITEMASK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B72));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_CLEAR_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B73));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_FUNC(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B74));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_CLEAR_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B91));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_FUNC(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B92));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_FAIL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B94));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_FAIL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B95));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_PASS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B96));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_REF(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B97));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_VALUE_MASK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B93));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_WRITEMASK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B98));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BACK_FUNC(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8800));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BACK_FAIL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8801));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_FAIL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8802));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_PASS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8803));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BACK_REF(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CA3));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BACK_VALUE_MASK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CA4));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BACK_WRITEMASK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CA5));
-}
-
-JSValue jsCanvasRenderingContext3DVIEWPORT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0BA2));
-}
-
-JSValue jsCanvasRenderingContext3DSCISSOR_BOX(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0C10));
-}
-
-JSValue jsCanvasRenderingContext3DCOLOR_CLEAR_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0C22));
-}
-
-JSValue jsCanvasRenderingContext3DCOLOR_WRITEMASK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0C23));
-}
-
-JSValue jsCanvasRenderingContext3DUNPACK_ALIGNMENT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0CF5));
-}
-
-JSValue jsCanvasRenderingContext3DPACK_ALIGNMENT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D05));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_TEXTURE_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D33));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_VIEWPORT_DIMS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D3A));
-}
-
-JSValue jsCanvasRenderingContext3DSUBPIXEL_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D50));
-}
-
-JSValue jsCanvasRenderingContext3DRED_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D52));
-}
-
-JSValue jsCanvasRenderingContext3DGREEN_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D53));
-}
-
-JSValue jsCanvasRenderingContext3DBLUE_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D54));
-}
-
-JSValue jsCanvasRenderingContext3DALPHA_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D55));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D56));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D57));
-}
-
-JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_UNITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2A00));
-}
-
-JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_FACTOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8038));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_BINDING_2D(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8069));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLE_BUFFERS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80A8));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLES(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80A9));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80AA));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE_INVERT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80AB));
-}
-
-JSValue jsCanvasRenderingContext3DNUM_COMPRESSED_TEXTURE_FORMATS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x86A2));
-}
-
-JSValue jsCanvasRenderingContext3DCOMPRESSED_TEXTURE_FORMATS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x86A3));
-}
-
-JSValue jsCanvasRenderingContext3DDONT_CARE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1100));
-}
-
-JSValue jsCanvasRenderingContext3DFASTEST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1101));
-}
-
-JSValue jsCanvasRenderingContext3DNICEST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1102));
-}
-
-JSValue jsCanvasRenderingContext3DGENERATE_MIPMAP_HINT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8192));
-}
-
-JSValue jsCanvasRenderingContext3DBYTE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1400));
-}
-
-JSValue jsCanvasRenderingContext3DUNSIGNED_BYTE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1401));
-}
-
-JSValue jsCanvasRenderingContext3DSHORT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1402));
-}
-
-JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1403));
-}
-
-JSValue jsCanvasRenderingContext3DINT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1404));
-}
-
-JSValue jsCanvasRenderingContext3DUNSIGNED_INT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1405));
-}
-
-JSValue jsCanvasRenderingContext3DFLOAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1406));
-}
-
-JSValue jsCanvasRenderingContext3DFIXED(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x140C));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_COMPONENT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1902));
-}
-
-JSValue jsCanvasRenderingContext3DALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1906));
-}
-
-JSValue jsCanvasRenderingContext3DRGB(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1907));
-}
-
-JSValue jsCanvasRenderingContext3DRGBA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1908));
-}
-
-JSValue jsCanvasRenderingContext3DLUMINANCE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1909));
-}
-
-JSValue jsCanvasRenderingContext3DLUMINANCE_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x190A));
-}
-
-JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_4_4_4_4(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8033));
-}
-
-JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_5_5_5_1(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8034));
-}
-
-JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_5_6_5(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8363));
-}
-
-JSValue jsCanvasRenderingContext3DFRAGMENT_SHADER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B30));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_SHADER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B31));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_VERTEX_ATTRIBS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8869));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_VERTEX_UNIFORM_VECTORS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DFB));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_VARYING_VECTORS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DFC));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_COMBINED_TEXTURE_IMAGE_UNITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B4D));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_VERTEX_TEXTURE_IMAGE_UNITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B4C));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_TEXTURE_IMAGE_UNITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8872));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_FRAGMENT_UNIFORM_VECTORS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DFD));
-}
-
-JSValue jsCanvasRenderingContext3DSHADER_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B4F));
-}
-
-JSValue jsCanvasRenderingContext3DDELETE_STATUS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B80));
-}
-
-JSValue jsCanvasRenderingContext3DLINK_STATUS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B82));
-}
-
-JSValue jsCanvasRenderingContext3DVALIDATE_STATUS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B83));
-}
-
-JSValue jsCanvasRenderingContext3DATTACHED_SHADERS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B85));
-}
-
-JSValue jsCanvasRenderingContext3DACTIVE_UNIFORMS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B86));
-}
-
-JSValue jsCanvasRenderingContext3DACTIVE_UNIFORM_MAX_LENGTH(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B87));
-}
-
-JSValue jsCanvasRenderingContext3DACTIVE_ATTRIBUTES(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B89));
-}
-
-JSValue jsCanvasRenderingContext3DACTIVE_ATTRIBUTE_MAX_LENGTH(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B8A));
-}
-
-JSValue jsCanvasRenderingContext3DSHADING_LANGUAGE_VERSION(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B8C));
-}
-
-JSValue jsCanvasRenderingContext3DCURRENT_PROGRAM(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B8D));
-}
-
-JSValue jsCanvasRenderingContext3DNEVER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0200));
-}
-
-JSValue jsCanvasRenderingContext3DLESS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0201));
-}
-
-JSValue jsCanvasRenderingContext3DEQUAL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0202));
-}
-
-JSValue jsCanvasRenderingContext3DLEQUAL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0203));
-}
-
-JSValue jsCanvasRenderingContext3DGREATER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0204));
-}
-
-JSValue jsCanvasRenderingContext3DNOTEQUAL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0205));
-}
-
-JSValue jsCanvasRenderingContext3DGEQUAL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0206));
-}
-
-JSValue jsCanvasRenderingContext3DALWAYS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0207));
-}
-
-JSValue jsCanvasRenderingContext3DKEEP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1E00));
-}
-
-JSValue jsCanvasRenderingContext3DREPLACE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1E01));
-}
-
-JSValue jsCanvasRenderingContext3DINCR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1E02));
-}
-
-JSValue jsCanvasRenderingContext3DDECR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1E03));
-}
-
-JSValue jsCanvasRenderingContext3DINVERT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x150A));
-}
-
-JSValue jsCanvasRenderingContext3DINCR_WRAP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8507));
-}
-
-JSValue jsCanvasRenderingContext3DDECR_WRAP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8508));
-}
-
-JSValue jsCanvasRenderingContext3DVENDOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1F00));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1F01));
-}
-
-JSValue jsCanvasRenderingContext3DVERSION(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1F02));
-}
-
-JSValue jsCanvasRenderingContext3DEXTENSIONS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1F03));
-}
-
-JSValue jsCanvasRenderingContext3DNEAREST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2600));
-}
-
-JSValue jsCanvasRenderingContext3DLINEAR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2601));
-}
-
-JSValue jsCanvasRenderingContext3DNEAREST_MIPMAP_NEAREST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2700));
-}
-
-JSValue jsCanvasRenderingContext3DLINEAR_MIPMAP_NEAREST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2701));
-}
-
-JSValue jsCanvasRenderingContext3DNEAREST_MIPMAP_LINEAR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2702));
-}
-
-JSValue jsCanvasRenderingContext3DLINEAR_MIPMAP_LINEAR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2703));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_MAG_FILTER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2800));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_MIN_FILTER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2801));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_WRAP_S(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2802));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_WRAP_T(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2803));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1702));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8513));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_BINDING_CUBE_MAP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8514));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_X(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8515));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_X(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8516));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Y(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8517));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Y(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8518));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Z(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8519));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Z(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x851A));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_CUBE_MAP_TEXTURE_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x851C));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE0(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C0));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE1(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C1));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE2(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C2));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE3(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C3));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE4(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C4));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE5(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C5));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE6(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C6));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE7(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C7));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE8(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C8));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE9(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C9));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE10(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84CA));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE11(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84CB));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE12(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84CC));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE13(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84CD));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE14(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84CE));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE15(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84CF));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE16(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D0));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE17(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D1));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE18(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D2));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE19(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D3));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE20(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D4));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE21(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D5));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE22(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D6));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE23(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D7));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE24(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D8));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE25(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D9));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE26(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84DA));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE27(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84DB));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE28(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84DC));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE29(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84DD));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE30(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84DE));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE31(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84DF));
-}
-
-JSValue jsCanvasRenderingContext3DACTIVE_TEXTURE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84E0));
-}
-
-JSValue jsCanvasRenderingContext3DREPEAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2901));
-}
-
-JSValue jsCanvasRenderingContext3DCLAMP_TO_EDGE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x812F));
-}
-
-JSValue jsCanvasRenderingContext3DMIRRORED_REPEAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8370));
-}
-
-JSValue jsCanvasRenderingContext3DFLOAT_VEC2(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B50));
-}
-
-JSValue jsCanvasRenderingContext3DFLOAT_VEC3(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B51));
-}
-
-JSValue jsCanvasRenderingContext3DFLOAT_VEC4(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B52));
-}
-
-JSValue jsCanvasRenderingContext3DINT_VEC2(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B53));
-}
-
-JSValue jsCanvasRenderingContext3DINT_VEC3(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B54));
-}
-
-JSValue jsCanvasRenderingContext3DINT_VEC4(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B55));
-}
-
-JSValue jsCanvasRenderingContext3DBOOL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B56));
-}
-
-JSValue jsCanvasRenderingContext3DBOOL_VEC2(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B57));
-}
-
-JSValue jsCanvasRenderingContext3DBOOL_VEC3(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B58));
-}
-
-JSValue jsCanvasRenderingContext3DBOOL_VEC4(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B59));
-}
-
-JSValue jsCanvasRenderingContext3DFLOAT_MAT2(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B5A));
-}
-
-JSValue jsCanvasRenderingContext3DFLOAT_MAT3(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B5B));
-}
-
-JSValue jsCanvasRenderingContext3DFLOAT_MAT4(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B5C));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLER_2D(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B5E));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLER_CUBE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B60));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_ENABLED(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8622));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8623));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_STRIDE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8624));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8625));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_NORMALIZED(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x886A));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_POINTER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8645));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_BUFFER_BINDING(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x889F));
-}
-
-JSValue jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B9A));
-}
-
-JSValue jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_FORMAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B9B));
-}
-
-JSValue jsCanvasRenderingContext3DCOMPILE_STATUS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B81));
-}
-
-JSValue jsCanvasRenderingContext3DINFO_LOG_LENGTH(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B84));
-}
-
-JSValue jsCanvasRenderingContext3DSHADER_SOURCE_LENGTH(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B88));
-}
-
-JSValue jsCanvasRenderingContext3DSHADER_COMPILER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DFA));
-}
-
-JSValue jsCanvasRenderingContext3DSHADER_BINARY_FORMATS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF8));
-}
-
-JSValue jsCanvasRenderingContext3DNUM_SHADER_BINARY_FORMATS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF9));
-}
-
-JSValue jsCanvasRenderingContext3DLOW_FLOAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF0));
-}
-
-JSValue jsCanvasRenderingContext3DMEDIUM_FLOAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF1));
-}
-
-JSValue jsCanvasRenderingContext3DHIGH_FLOAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF2));
-}
-
-JSValue jsCanvasRenderingContext3DLOW_INT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF3));
-}
-
-JSValue jsCanvasRenderingContext3DMEDIUM_INT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF4));
-}
-
-JSValue jsCanvasRenderingContext3DHIGH_INT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF5));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D40));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D41));
-}
-
-JSValue jsCanvasRenderingContext3DRGBA4(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8056));
-}
-
-JSValue jsCanvasRenderingContext3DRGB5_A1(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8057));
-}
-
-JSValue jsCanvasRenderingContext3DRGB565(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D62));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_COMPONENT16(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x81A5));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_INDEX(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1901));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_INDEX8(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D48));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_WIDTH(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D42));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_HEIGHT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D43));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_INTERNAL_FORMAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D44));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_RED_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D50));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_GREEN_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D51));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_BLUE_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D52));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_ALPHA_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D53));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_DEPTH_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D54));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_STENCIL_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D55));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD0));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_NAME(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD1));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD2));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD3));
-}
-
-JSValue jsCanvasRenderingContext3DCOLOR_ATTACHMENT0(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CE0));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_ATTACHMENT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D00));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_ATTACHMENT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D20));
-}
-
-JSValue jsCanvasRenderingContext3DNONE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_COMPLETE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD5));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_ATTACHMENT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD6));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD7));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_DIMENSIONS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD9));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_UNSUPPORTED(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CDD));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_BINDING(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CA6));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_BINDING(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CA7));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_RENDERBUFFER_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84E8));
-}
-
-JSValue jsCanvasRenderingContext3DINVALID_FRAMEBUFFER_OPERATION(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0506));
-}
-
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h
deleted file mode 100644
index 75ad4d16f1..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h
+++ /dev/null
@@ -1,555 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSCanvasRenderingContext3D_h
-#define JSCanvasRenderingContext3D_h
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasRenderingContext.h"
-
-namespace WebCore {
-
-class CanvasRenderingContext3D;
-
-class JSCanvasRenderingContext3D : public JSCanvasRenderingContext {
-    typedef JSCanvasRenderingContext Base;
-public:
-    JSCanvasRenderingContext3D(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasRenderingContext3D>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-
-    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
-
-    // Custom functions
-    JSC::JSValue bufferData(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue bufferSubData(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue texImage2D(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue texSubImage2D(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform1fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform1iv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform2fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform2iv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform3fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform3iv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform4fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform4iv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniformMatrix2fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniformMatrix3fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniformMatrix4fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue vertexAttrib1fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue vertexAttrib2fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue vertexAttrib3fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue vertexAttrib4fv(JSC::ExecState*, const JSC::ArgList&);
-protected:
-    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-};
-
-
-class JSCanvasRenderingContext3DPrototype : public JSC::JSObject {
-    typedef JSC::JSObject Base;
-public:
-    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-    JSCanvasRenderingContext3DPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-protected:
-    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-};
-
-// Functions
-
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionSizeInBytes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionActiveTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionAttachShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindAttribLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendEquation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendEquationSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendFunc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendFuncSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBufferData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBufferSubData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCheckFramebufferStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearDepth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearStencil(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionColorMask(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCompileShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCopyTexImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCopyTexSubImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCullFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthFunc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthMask(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDetachShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDisable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDisableVertexAttribArray(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDrawArrays(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDrawElements(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionEnable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionEnableVertexAttribArray(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFinish(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFlush(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebufferRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebufferTexture2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFrontFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGenerateMipmap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveAttrib(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveUniform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetAttribLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBoolean(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBooleanv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteriv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetError(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFloat(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFloatv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteriv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetInteger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetIntegerv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgrami(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgramiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgramInfoLog(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteriv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderi(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderInfoLog(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderSource(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterfv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteriv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformfv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformi(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribfv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribi(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribOffset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionHint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLineWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLinkProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPixelStorei(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPolygonOffset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReadPixels(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReleaseShaderCompiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionRenderbufferStorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionSampleCoverage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionScissor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionShaderSource(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilFunc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilFuncSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilMask(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilMaskSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilOp(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilOpSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexParameterf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexSubImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix2fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix3fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix4fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUseProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionValidateProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttribPointer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionViewport(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-// Attributes
-
-JSC::JSValue jsCanvasRenderingContext3DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-// Constants
-
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_BUFFER_BIT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BUFFER_BIT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCOLOR_BUFFER_BIT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFALSE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTRUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DPOINTS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINES(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINE_LOOP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINE_STRIP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTRIANGLES(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTRIANGLE_STRIP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTRIANGLE_FAN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DZERO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSRC_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_SRC_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSRC_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_SRC_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDST_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_DST_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDST_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_DST_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSRC_ALPHA_SATURATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFUNC_ADD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_EQUATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_EQUATION_RGB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_EQUATION_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFUNC_SUBTRACT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFUNC_REVERSE_SUBTRACT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_DST_RGB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_SRC_RGB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_DST_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_SRC_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCONSTANT_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_CONSTANT_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCONSTANT_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_CONSTANT_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DARRAY_BUFFER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DARRAY_BUFFER_BINDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER_BINDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTREAM_DRAW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTATIC_DRAW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDYNAMIC_DRAW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBUFFER_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBUFFER_USAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCURRENT_VERTEX_ATTRIB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRONT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBACK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRONT_AND_BACK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_2D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCULL_FACE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDITHER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_TEST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_TEST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSCISSOR_TEST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_FILL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLE_ALPHA_TO_COVERAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNO_ERROR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINVALID_ENUM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINVALID_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINVALID_OPERATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DOUT_OF_MEMORY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCCW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINE_WIDTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DALIASED_POINT_SIZE_RANGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DALIASED_LINE_WIDTH_RANGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCULL_FACE_MODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRONT_FACE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_RANGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_WRITEMASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_CLEAR_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_FUNC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_CLEAR_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_FUNC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_FAIL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_FAIL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_PASS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_REF(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_VALUE_MASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_WRITEMASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_FUNC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_FAIL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_FAIL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_PASS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_REF(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_VALUE_MASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_WRITEMASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVIEWPORT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSCISSOR_BOX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCOLOR_CLEAR_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCOLOR_WRITEMASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DUNPACK_ALIGNMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DPACK_ALIGNMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_TEXTURE_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_VIEWPORT_DIMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSUBPIXEL_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRED_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DGREEN_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLUE_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DALPHA_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_UNITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_FACTOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_BINDING_2D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLE_BUFFERS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLES(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE_INVERT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNUM_COMPRESSED_TEXTURE_FORMATS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCOMPRESSED_TEXTURE_FORMATS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDONT_CARE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFASTEST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNICEST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DGENERATE_MIPMAP_HINT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBYTE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_BYTE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSHORT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_INT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFLOAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFIXED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_COMPONENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRGB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRGBA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLUMINANCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLUMINANCE_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_4_4_4_4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_5_5_5_1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_5_6_5(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAGMENT_SHADER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_SHADER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_VERTEX_ATTRIBS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_VERTEX_UNIFORM_VECTORS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_VARYING_VECTORS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_COMBINED_TEXTURE_IMAGE_UNITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_VERTEX_TEXTURE_IMAGE_UNITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_TEXTURE_IMAGE_UNITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_FRAGMENT_UNIFORM_VECTORS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSHADER_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDELETE_STATUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINK_STATUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVALIDATE_STATUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DATTACHED_SHADERS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DACTIVE_UNIFORMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DACTIVE_UNIFORM_MAX_LENGTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DACTIVE_ATTRIBUTES(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DACTIVE_ATTRIBUTE_MAX_LENGTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSHADING_LANGUAGE_VERSION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCURRENT_PROGRAM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNEVER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLESS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DEQUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLEQUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DGREATER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNOTEQUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DGEQUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DALWAYS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DKEEP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DREPLACE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINCR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDECR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINVERT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINCR_WRAP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDECR_WRAP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVENDOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERSION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DEXTENSIONS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNEAREST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINEAR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNEAREST_MIPMAP_NEAREST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINEAR_MIPMAP_NEAREST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNEAREST_MIPMAP_LINEAR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINEAR_MIPMAP_LINEAR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_MAG_FILTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_MIN_FILTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_WRAP_S(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_WRAP_T(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_BINDING_CUBE_MAP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_X(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_X(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Y(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Y(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Z(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Z(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_CUBE_MAP_TEXTURE_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE0(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE5(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE6(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE7(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE8(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE9(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE10(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE11(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE12(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE13(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE14(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE15(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE16(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE17(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE18(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE19(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE20(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE21(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE22(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE23(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE24(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE25(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE26(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE27(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE28(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE29(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE30(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE31(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DACTIVE_TEXTURE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DREPEAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCLAMP_TO_EDGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMIRRORED_REPEAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFLOAT_VEC2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFLOAT_VEC3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFLOAT_VEC4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINT_VEC2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINT_VEC3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINT_VEC4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBOOL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBOOL_VEC2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBOOL_VEC3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBOOL_VEC4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFLOAT_MAT2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFLOAT_MAT3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFLOAT_MAT4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLER_2D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLER_CUBE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_ENABLED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_STRIDE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_NORMALIZED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_POINTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_BUFFER_BINDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_FORMAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCOMPILE_STATUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINFO_LOG_LENGTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSHADER_SOURCE_LENGTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSHADER_COMPILER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSHADER_BINARY_FORMATS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNUM_SHADER_BINARY_FORMATS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLOW_FLOAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMEDIUM_FLOAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DHIGH_FLOAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLOW_INT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMEDIUM_INT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DHIGH_INT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRGBA4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRGB5_A1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRGB565(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_COMPONENT16(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_INDEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_INDEX8(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_WIDTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_HEIGHT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_INTERNAL_FORMAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_RED_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_GREEN_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_BLUE_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_ALPHA_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_DEPTH_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_STENCIL_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_NAME(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCOLOR_ATTACHMENT0(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_ATTACHMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_ATTACHMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_COMPLETE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_ATTACHMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_DIMENSIONS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_UNSUPPORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_BINDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_BINDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_RENDERBUFFER_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINVALID_FRAMEBUFFER_OPERATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.cpp
deleted file mode 100644
index cdda2a3c76..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.cpp
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasShortArray.h"
-
-#include "CanvasShortArray.h"
-#include <runtime/PropertyNameArray.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasShortArray);
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasShortArrayPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasShortArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasShortArrayPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasShortArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasShortArrayPrototype::s_info = { "CanvasShortArrayPrototype", 0, &JSCanvasShortArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasShortArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasShortArray>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasShortArray::s_info = { "CanvasShortArray", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasShortArray::JSCanvasShortArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasShortArray> impl)
-    : JSCanvasArray(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasShortArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasShortArrayPrototype(JSCanvasShortArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasShortArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasShortArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, index));
-        return true;
-    }
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-bool JSCanvasShortArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasShortArray*>(impl())->length()) {
-        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
-        return true;
-    }
-    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-}
-
-bool JSCanvasShortArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    if (propertyName < static_cast<CanvasShortArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, propertyName));
-        return true;
-    }
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-void JSCanvasShortArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok) {
-        indexSetter(exec, index, value);
-        return;
-    }
-    Base::put(exec, propertyName, value, slot);
-}
-
-void JSCanvasShortArray::put(ExecState* exec, unsigned propertyName, JSValue value)
-{
-    indexSetter(exec, propertyName, value);
-    return;
-}
-
-void JSCanvasShortArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    for (unsigned i = 0; i < static_cast<CanvasShortArray*>(impl())->length(); ++i)
-        propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-
-JSValue JSCanvasShortArray::getByIndex(ExecState* exec, unsigned index)
-{
-    return jsNumber(exec, static_cast<CanvasShortArray*>(impl())->item(index));
-}
-CanvasShortArray* toCanvasShortArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasShortArray::s_info) ? static_cast<JSCanvasShortArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.cpp
deleted file mode 100644
index ee1c32f64a..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.cpp
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasUnsignedByteArray.h"
-
-#include "CanvasUnsignedByteArray.h"
-#include <runtime/PropertyNameArray.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasUnsignedByteArray);
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasUnsignedByteArrayPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasUnsignedByteArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasUnsignedByteArrayPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasUnsignedByteArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasUnsignedByteArrayPrototype::s_info = { "CanvasUnsignedByteArrayPrototype", 0, &JSCanvasUnsignedByteArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasUnsignedByteArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasUnsignedByteArray>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasUnsignedByteArray::s_info = { "CanvasUnsignedByteArray", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasUnsignedByteArray::JSCanvasUnsignedByteArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasUnsignedByteArray> impl)
-    : JSCanvasArray(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasUnsignedByteArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasUnsignedByteArrayPrototype(JSCanvasUnsignedByteArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasUnsignedByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasUnsignedByteArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, index));
-        return true;
-    }
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-bool JSCanvasUnsignedByteArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasUnsignedByteArray*>(impl())->length()) {
-        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
-        return true;
-    }
-    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-}
-
-bool JSCanvasUnsignedByteArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    if (propertyName < static_cast<CanvasUnsignedByteArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, propertyName));
-        return true;
-    }
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-void JSCanvasUnsignedByteArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok) {
-        indexSetter(exec, index, value);
-        return;
-    }
-    Base::put(exec, propertyName, value, slot);
-}
-
-void JSCanvasUnsignedByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
-{
-    indexSetter(exec, propertyName, value);
-    return;
-}
-
-void JSCanvasUnsignedByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    for (unsigned i = 0; i < static_cast<CanvasUnsignedByteArray*>(impl())->length(); ++i)
-        propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-
-JSValue JSCanvasUnsignedByteArray::getByIndex(ExecState* exec, unsigned index)
-{
-    return jsNumber(exec, static_cast<CanvasUnsignedByteArray*>(impl())->item(index));
-}
-CanvasUnsignedByteArray* toCanvasUnsignedByteArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasUnsignedByteArray::s_info) ? static_cast<JSCanvasUnsignedByteArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.cpp
deleted file mode 100644
index 8a736562f2..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.cpp
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasUnsignedIntArray.h"
-
-#include "CanvasUnsignedIntArray.h"
-#include <runtime/PropertyNameArray.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasUnsignedIntArray);
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasUnsignedIntArrayPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasUnsignedIntArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasUnsignedIntArrayPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasUnsignedIntArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasUnsignedIntArrayPrototype::s_info = { "CanvasUnsignedIntArrayPrototype", 0, &JSCanvasUnsignedIntArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasUnsignedIntArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasUnsignedIntArray>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasUnsignedIntArray::s_info = { "CanvasUnsignedIntArray", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasUnsignedIntArray::JSCanvasUnsignedIntArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasUnsignedIntArray> impl)
-    : JSCanvasArray(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasUnsignedIntArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasUnsignedIntArrayPrototype(JSCanvasUnsignedIntArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasUnsignedIntArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasUnsignedIntArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, index));
-        return true;
-    }
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-bool JSCanvasUnsignedIntArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasUnsignedIntArray*>(impl())->length()) {
-        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
-        return true;
-    }
-    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-}
-
-bool JSCanvasUnsignedIntArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    if (propertyName < static_cast<CanvasUnsignedIntArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, propertyName));
-        return true;
-    }
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-void JSCanvasUnsignedIntArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok) {
-        indexSetter(exec, index, value);
-        return;
-    }
-    Base::put(exec, propertyName, value, slot);
-}
-
-void JSCanvasUnsignedIntArray::put(ExecState* exec, unsigned propertyName, JSValue value)
-{
-    indexSetter(exec, propertyName, value);
-    return;
-}
-
-void JSCanvasUnsignedIntArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    for (unsigned i = 0; i < static_cast<CanvasUnsignedIntArray*>(impl())->length(); ++i)
-        propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-
-JSValue JSCanvasUnsignedIntArray::getByIndex(ExecState* exec, unsigned index)
-{
-    return jsNumber(exec, static_cast<CanvasUnsignedIntArray*>(impl())->item(index));
-}
-CanvasUnsignedIntArray* toCanvasUnsignedIntArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasUnsignedIntArray::s_info) ? static_cast<JSCanvasUnsignedIntArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.cpp
deleted file mode 100644
index a15275e7b2..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.cpp
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasUnsignedShortArray.h"
-
-#include "CanvasUnsignedShortArray.h"
-#include <runtime/PropertyNameArray.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasUnsignedShortArray);
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasUnsignedShortArrayPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasUnsignedShortArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasUnsignedShortArrayPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasUnsignedShortArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasUnsignedShortArrayPrototype::s_info = { "CanvasUnsignedShortArrayPrototype", 0, &JSCanvasUnsignedShortArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasUnsignedShortArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasUnsignedShortArray>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasUnsignedShortArray::s_info = { "CanvasUnsignedShortArray", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasUnsignedShortArray::JSCanvasUnsignedShortArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasUnsignedShortArray> impl)
-    : JSCanvasArray(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasUnsignedShortArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasUnsignedShortArrayPrototype(JSCanvasUnsignedShortArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasUnsignedShortArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasUnsignedShortArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, index));
-        return true;
-    }
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-bool JSCanvasUnsignedShortArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasUnsignedShortArray*>(impl())->length()) {
-        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
-        return true;
-    }
-    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-}
-
-bool JSCanvasUnsignedShortArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    if (propertyName < static_cast<CanvasUnsignedShortArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, propertyName));
-        return true;
-    }
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-void JSCanvasUnsignedShortArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok) {
-        indexSetter(exec, index, value);
-        return;
-    }
-    Base::put(exec, propertyName, value, slot);
-}
-
-void JSCanvasUnsignedShortArray::put(ExecState* exec, unsigned propertyName, JSValue value)
-{
-    indexSetter(exec, propertyName, value);
-    return;
-}
-
-void JSCanvasUnsignedShortArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    for (unsigned i = 0; i < static_cast<CanvasUnsignedShortArray*>(impl())->length(); ++i)
-        propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-
-JSValue JSCanvasUnsignedShortArray::getByIndex(ExecState* exec, unsigned index)
-{
-    return jsNumber(exec, static_cast<CanvasUnsignedShortArray*>(impl())->item(index));
-}
-CanvasUnsignedShortArray* toCanvasUnsignedShortArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasUnsignedShortArray::s_info) ? static_cast<JSCanvasUnsignedShortArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h
deleted file mode 100644
index e9e512787e..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSCanvasUnsignedShortArray_h
-#define JSCanvasUnsignedShortArray_h
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasUnsignedShortArray.h"
-#include "JSCanvasArray.h"
-
-namespace WebCore {
-
-class CanvasUnsignedShortArray;
-
-class JSCanvasUnsignedShortArray : public JSCanvasArray {
-    typedef JSCanvasArray Base;
-public:
-    JSCanvasUnsignedShortArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasUnsignedShortArray>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
-    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    CanvasUnsignedShortArray* impl() const
-    {
-        return static_cast<CanvasUnsignedShortArray*>(Base::impl());
-    }
-protected:
-    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
-    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
-};
-
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasUnsignedShortArray*);
-CanvasUnsignedShortArray* toCanvasUnsignedShortArray(JSC::JSValue);
-
-class JSCanvasUnsignedShortArrayPrototype : public JSC::JSObject {
-    typedef JSC::JSObject Base;
-public:
-    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-    JSCanvasUnsignedShortArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
-};
-
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
index 214888830f..30332ebae3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
@@ -39,9 +39,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSCharacterData);
 
 static const HashTableValue JSCharacterDataTableValues[4] =
 {
-    { "data", DontDelete, (intptr_t)jsCharacterDataData, (intptr_t)setJSCharacterDataData },
-    { "length", DontDelete|ReadOnly, (intptr_t)jsCharacterDataLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCharacterDataConstructor, (intptr_t)0 },
+    { "data", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCharacterDataData), (intptr_t)setJSCharacterDataData },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCharacterDataLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCharacterDataConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -103,11 +103,11 @@ bool JSCharacterDataConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSCharacterDataPrototypeTableValues[6] =
 {
-    { "substringData", DontDelete|Function, (intptr_t)jsCharacterDataPrototypeFunctionSubstringData, (intptr_t)2 },
-    { "appendData", DontDelete|Function, (intptr_t)jsCharacterDataPrototypeFunctionAppendData, (intptr_t)1 },
-    { "insertData", DontDelete|Function, (intptr_t)jsCharacterDataPrototypeFunctionInsertData, (intptr_t)2 },
-    { "deleteData", DontDelete|Function, (intptr_t)jsCharacterDataPrototypeFunctionDeleteData, (intptr_t)2 },
-    { "replaceData", DontDelete|Function, (intptr_t)jsCharacterDataPrototypeFunctionReplaceData, (intptr_t)3 },
+    { "substringData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCharacterDataPrototypeFunctionSubstringData), (intptr_t)2 },
+    { "appendData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCharacterDataPrototypeFunctionAppendData), (intptr_t)1 },
+    { "insertData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCharacterDataPrototypeFunctionInsertData), (intptr_t)2 },
+    { "deleteData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCharacterDataPrototypeFunctionDeleteData), (intptr_t)2 },
+    { "replaceData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCharacterDataPrototypeFunctionReplaceData), (intptr_t)3 },
     { 0, 0, 0, 0 }
 };
 
@@ -157,25 +157,27 @@ bool JSCharacterData::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSCharacterData, Base>(exec, &JSCharacterDataTable, this, propertyName, descriptor);
 }
 
-JSValue jsCharacterDataData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCharacterDataData(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCharacterData* castedThis = static_cast<JSCharacterData*>(asObject(slot.slotBase()));
+    JSCharacterData* castedThis = static_cast<JSCharacterData*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CharacterData* imp = static_cast<CharacterData*>(castedThis->impl());
-    return jsString(exec, imp->data());
+    JSValue result = jsString(exec, imp->data());
+    return result;
 }
 
-JSValue jsCharacterDataLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCharacterDataLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCharacterData* castedThis = static_cast<JSCharacterData*>(asObject(slot.slotBase()));
+    JSCharacterData* castedThis = static_cast<JSCharacterData*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CharacterData* imp = static_cast<CharacterData*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsCharacterDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCharacterDataConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCharacterData* domObject = static_cast<JSCharacterData*>(asObject(slot.slotBase()));
+    JSCharacterData* domObject = static_cast<JSCharacterData*>(asObject(slotBase));
     return JSCharacterData::getConstructor(exec, domObject->globalObject());
 }
 void JSCharacterData::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -185,7 +187,8 @@ void JSCharacterData::put(ExecState* exec, const Identifier& propertyName, JSVal
 
 void setJSCharacterDataData(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CharacterData* imp = static_cast<CharacterData*>(static_cast<JSCharacterData*>(thisObject)->impl());
+    JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(thisObject);
+    CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setData(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
index f06e22b715..4df2ac88a1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -59,7 +59,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCharacterDataPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,10 +75,10 @@ JSC::JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionDeleteData(JSC::ExecS
 JSC::JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionReplaceData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCharacterDataData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCharacterDataData(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCharacterDataData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCharacterDataLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCharacterDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCharacterDataLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCharacterDataConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
index 48dccd3dfc..bf449679b0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
@@ -35,13 +35,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSClientRect);
 
 static const HashTableValue JSClientRectTableValues[8] =
 {
-    { "top", DontDelete|ReadOnly, (intptr_t)jsClientRectTop, (intptr_t)0 },
-    { "right", DontDelete|ReadOnly, (intptr_t)jsClientRectRight, (intptr_t)0 },
-    { "bottom", DontDelete|ReadOnly, (intptr_t)jsClientRectBottom, (intptr_t)0 },
-    { "left", DontDelete|ReadOnly, (intptr_t)jsClientRectLeft, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsClientRectWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsClientRectHeight, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsClientRectConstructor, (intptr_t)0 },
+    { "top", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectTop), (intptr_t)0 },
+    { "right", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectRight), (intptr_t)0 },
+    { "bottom", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectBottom), (intptr_t)0 },
+    { "left", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectLeft), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectHeight), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -148,57 +148,63 @@ bool JSClientRect::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<JSClientRect, Base>(exec, &JSClientRectTable, this, propertyName, descriptor);
 }
 
-JSValue jsClientRectTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectTop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slot.slotBase()));
+    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ClientRect* imp = static_cast<ClientRect*>(castedThis->impl());
-    return jsNumber(exec, imp->top());
+    JSValue result = jsNumber(exec, imp->top());
+    return result;
 }
 
-JSValue jsClientRectRight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectRight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slot.slotBase()));
+    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ClientRect* imp = static_cast<ClientRect*>(castedThis->impl());
-    return jsNumber(exec, imp->right());
+    JSValue result = jsNumber(exec, imp->right());
+    return result;
 }
 
-JSValue jsClientRectBottom(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectBottom(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slot.slotBase()));
+    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ClientRect* imp = static_cast<ClientRect*>(castedThis->impl());
-    return jsNumber(exec, imp->bottom());
+    JSValue result = jsNumber(exec, imp->bottom());
+    return result;
 }
 
-JSValue jsClientRectLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectLeft(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slot.slotBase()));
+    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ClientRect* imp = static_cast<ClientRect*>(castedThis->impl());
-    return jsNumber(exec, imp->left());
+    JSValue result = jsNumber(exec, imp->left());
+    return result;
 }
 
-JSValue jsClientRectWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slot.slotBase()));
+    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ClientRect* imp = static_cast<ClientRect*>(castedThis->impl());
-    return jsNumber(exec, imp->width());
+    JSValue result = jsNumber(exec, imp->width());
+    return result;
 }
 
-JSValue jsClientRectHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slot.slotBase()));
+    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ClientRect* imp = static_cast<ClientRect*>(castedThis->impl());
-    return jsNumber(exec, imp->height());
+    JSValue result = jsNumber(exec, imp->height());
+    return result;
 }
 
-JSValue jsClientRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRect* domObject = static_cast<JSClientRect*>(asObject(slot.slotBase()));
+    JSClientRect* domObject = static_cast<JSClientRect*>(asObject(slotBase));
     return JSClientRect::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSClientRect::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.h b/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
index 18962f259c..b5d8303610 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
@@ -21,7 +21,6 @@
 #ifndef JSClientRect_h
 #define JSClientRect_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -66,7 +65,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSClientRectPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,13 +74,13 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsClientRectTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClientRectRight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClientRectBottom(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClientRectLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClientRectWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClientRectHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClientRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectTop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClientRectRight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClientRectBottom(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClientRectLeft(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClientRectWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClientRectHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClientRectConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
index ff9d96308e..e7a432aa43 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
@@ -40,8 +40,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSClientRectList);
 
 static const HashTableValue JSClientRectListTableValues[3] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsClientRectListLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsClientRectListConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectListLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -103,7 +103,7 @@ bool JSClientRectListConstructor::getOwnPropertyDescriptor(ExecState* exec, cons
 
 static const HashTableValue JSClientRectListPrototypeTableValues[2] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsClientRectListPrototypeFunctionItem, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsClientRectListPrototypeFunctionItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -194,24 +194,25 @@ bool JSClientRectList::getOwnPropertySlot(ExecState* exec, unsigned propertyName
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsClientRectListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectListLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRectList* castedThis = static_cast<JSClientRectList*>(asObject(slot.slotBase()));
+    JSClientRectList* castedThis = static_cast<JSClientRectList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ClientRectList* imp = static_cast<ClientRectList*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsClientRectListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRectList* domObject = static_cast<JSClientRectList*>(asObject(slot.slotBase()));
+    JSClientRectList* domObject = static_cast<JSClientRectList*>(asObject(slotBase));
     return JSClientRectList::getConstructor(exec, domObject->globalObject());
 }
-void JSClientRectList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSClientRectList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<ClientRectList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSClientRectList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -238,10 +239,10 @@ JSValue JSC_HOST_CALL jsClientRectListPrototypeFunctionItem(ExecState* exec, JSO
 }
 
 
-JSValue JSClientRectList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSClientRectList::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSClientRectList* thisObj = static_cast<JSClientRectList*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<ClientRectList*>(thisObj->impl())->item(slot.index()));
+    JSClientRectList* thisObj = static_cast<JSClientRectList*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<ClientRectList*>(thisObj->impl())->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, ClientRectList* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
index ce8cb3f209..1a856f9ee1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
@@ -21,7 +21,6 @@
 #ifndef JSClientRectList_h
 #define JSClientRectList_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,10 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     ClientRectList* impl() const { return m_impl.get(); }
 
@@ -55,7 +54,7 @@ private:
     RefPtr<ClientRectList> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, ClientRectList*);
@@ -71,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSClientRectListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -83,8 +82,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsClientRectListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsClientRectListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClientRectListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectListLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClientRectListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
index 8f4a7d4715..36d19f867e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
@@ -38,11 +38,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSClipboard);
 
 static const HashTableValue JSClipboardTableValues[6] =
 {
-    { "dropEffect", DontDelete, (intptr_t)jsClipboardDropEffect, (intptr_t)setJSClipboardDropEffect },
-    { "effectAllowed", DontDelete, (intptr_t)jsClipboardEffectAllowed, (intptr_t)setJSClipboardEffectAllowed },
-    { "types", DontDelete|ReadOnly, (intptr_t)jsClipboardTypes, (intptr_t)0 },
-    { "files", DontDelete|ReadOnly, (intptr_t)jsClipboardFiles, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsClipboardConstructor, (intptr_t)0 },
+    { "dropEffect", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClipboardDropEffect), (intptr_t)setJSClipboardDropEffect },
+    { "effectAllowed", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClipboardEffectAllowed), (intptr_t)setJSClipboardEffectAllowed },
+    { "types", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClipboardTypes), (intptr_t)0 },
+    { "files", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClipboardFiles), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClipboardConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -104,10 +104,10 @@ bool JSClipboardConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ide
 
 static const HashTableValue JSClipboardPrototypeTableValues[5] =
 {
-    { "clearData", DontDelete|Function, (intptr_t)jsClipboardPrototypeFunctionClearData, (intptr_t)1 },
-    { "getData", DontDelete|Function, (intptr_t)jsClipboardPrototypeFunctionGetData, (intptr_t)1 },
-    { "setData", DontDelete|Function, (intptr_t)jsClipboardPrototypeFunctionSetData, (intptr_t)2 },
-    { "setDragImage", DontDelete|Function, (intptr_t)jsClipboardPrototypeFunctionSetDragImage, (intptr_t)3 },
+    { "clearData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsClipboardPrototypeFunctionClearData), (intptr_t)1 },
+    { "getData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsClipboardPrototypeFunctionGetData), (intptr_t)1 },
+    { "setData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsClipboardPrototypeFunctionSetData), (intptr_t)2 },
+    { "setDragImage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsClipboardPrototypeFunctionSetDragImage), (intptr_t)3 },
     { 0, 0, 0, 0 }
 };
 
@@ -163,39 +163,42 @@ bool JSClipboard::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
     return getStaticValueDescriptor<JSClipboard, Base>(exec, &JSClipboardTable, this, propertyName, descriptor);
 }
 
-JSValue jsClipboardDropEffect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardDropEffect(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slot.slotBase()));
+    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Clipboard* imp = static_cast<Clipboard*>(castedThis->impl());
-    return jsStringOrUndefined(exec, imp->dropEffect());
+    JSValue result = jsStringOrUndefined(exec, imp->dropEffect());
+    return result;
 }
 
-JSValue jsClipboardEffectAllowed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardEffectAllowed(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slot.slotBase()));
+    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Clipboard* imp = static_cast<Clipboard*>(castedThis->impl());
-    return jsStringOrUndefined(exec, imp->effectAllowed());
+    JSValue result = jsStringOrUndefined(exec, imp->effectAllowed());
+    return result;
 }
 
-JSValue jsClipboardTypes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardTypes(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slot.slotBase()));
+    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slotBase));
     return castedThis->types(exec);
 }
 
-JSValue jsClipboardFiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardFiles(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slot.slotBase()));
+    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Clipboard* imp = static_cast<Clipboard*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->files()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->files()));
+    return result;
 }
 
-JSValue jsClipboardConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClipboard* domObject = static_cast<JSClipboard*>(asObject(slot.slotBase()));
+    JSClipboard* domObject = static_cast<JSClipboard*>(asObject(slotBase));
     return JSClipboard::getConstructor(exec, domObject->globalObject());
 }
 void JSClipboard::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -205,13 +208,15 @@ void JSClipboard::put(ExecState* exec, const Identifier& propertyName, JSValue v
 
 void setJSClipboardDropEffect(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Clipboard* imp = static_cast<Clipboard*>(static_cast<JSClipboard*>(thisObject)->impl());
+    JSClipboard* castedThisObj = static_cast<JSClipboard*>(thisObject);
+    Clipboard* imp = static_cast<Clipboard*>(castedThisObj->impl());
     imp->setDropEffect(value.toString(exec));
 }
 
 void setJSClipboardEffectAllowed(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Clipboard* imp = static_cast<Clipboard*>(static_cast<JSClipboard*>(thisObject)->impl());
+    JSClipboard* castedThisObj = static_cast<JSClipboard*>(thisObject);
+    Clipboard* imp = static_cast<Clipboard*>(castedThisObj->impl());
     imp->setEffectAllowed(value.toString(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
index e4458a7a6e..827ce05f1e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
@@ -21,7 +21,6 @@
 #ifndef JSClipboard_h
 #define JSClipboard_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -78,7 +77,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSClipboardPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -93,13 +92,13 @@ JSC::JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionSetData(JSC::ExecState*,
 JSC::JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionSetDragImage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsClipboardDropEffect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClipboardDropEffect(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSClipboardDropEffect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsClipboardEffectAllowed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClipboardEffectAllowed(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSClipboardEffectAllowed(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsClipboardTypes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClipboardFiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClipboardConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClipboardTypes(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClipboardFiles(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClipboardConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSComment.cpp b/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
index 770a3f2494..425208eacc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
@@ -34,7 +34,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSComment);
 
 static const HashTableValue JSCommentTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCommentConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCommentConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -73,7 +73,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -135,9 +135,9 @@ bool JSComment::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return getStaticValueDescriptor<JSComment, Base>(exec, &JSCommentTable, this, propertyName, descriptor);
 }
 
-JSValue jsCommentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCommentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSComment* domObject = static_cast<JSComment*>(asObject(slot.slotBase()));
+    JSComment* domObject = static_cast<JSComment*>(asObject(slotBase));
     return JSComment::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSComment::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSComment.h b/src/3rdparty/webkit/WebCore/generated/JSComment.h
index e88ddf42c7..0df7c652d8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSComment.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSComment.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -56,7 +56,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCommentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -65,7 +65,7 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCommentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCommentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCompositionEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSCompositionEvent.cpp
new file mode 100644
index 0000000000..5fc7f58581
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCompositionEvent.cpp
@@ -0,0 +1,191 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSCompositionEvent.h"
+
+#include "CompositionEvent.h"
+#include "JSDOMWindow.h"
+#include "KURL.h"
+#include <runtime/Error.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCompositionEvent);
+
+/* Hash table */
+
+static const HashTableValue JSCompositionEventTableValues[3] =
+{
+    { "data", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCompositionEventData), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCompositionEventConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCompositionEventTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 3, JSCompositionEventTableValues, 0 };
+#else
+    { 4, 3, JSCompositionEventTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSCompositionEventConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCompositionEventConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCompositionEventConstructorTableValues, 0 };
+#else
+    { 1, 0, JSCompositionEventConstructorTableValues, 0 };
+#endif
+
+class JSCompositionEventConstructor : public DOMConstructorObject {
+public:
+    JSCompositionEventConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSCompositionEventConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSCompositionEventPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSCompositionEventConstructor::s_info = { "CompositionEventConstructor", 0, &JSCompositionEventConstructorTable, 0 };
+
+bool JSCompositionEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCompositionEventConstructor, DOMObject>(exec, &JSCompositionEventConstructorTable, this, propertyName, slot);
+}
+
+bool JSCompositionEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCompositionEventConstructor, DOMObject>(exec, &JSCompositionEventConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCompositionEventPrototypeTableValues[2] =
+{
+    { "initCompositionEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCompositionEventPrototypeFunctionInitCompositionEvent), (intptr_t)5 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCompositionEventPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCompositionEventPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSCompositionEventPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCompositionEventPrototype::s_info = { "CompositionEventPrototype", 0, &JSCompositionEventPrototypeTable, 0 };
+
+JSObject* JSCompositionEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCompositionEvent>(exec, globalObject);
+}
+
+bool JSCompositionEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSCompositionEventPrototypeTable, this, propertyName, slot);
+}
+
+bool JSCompositionEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSCompositionEventPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSCompositionEvent::s_info = { "CompositionEvent", &JSUIEvent::s_info, &JSCompositionEventTable, 0 };
+
+JSCompositionEvent::JSCompositionEvent(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CompositionEvent> impl)
+    : JSUIEvent(structure, globalObject, impl)
+{
+}
+
+JSObject* JSCompositionEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCompositionEventPrototype(JSCompositionEventPrototype::createStructure(JSUIEventPrototype::self(exec, globalObject)));
+}
+
+bool JSCompositionEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCompositionEvent, Base>(exec, &JSCompositionEventTable, this, propertyName, slot);
+}
+
+bool JSCompositionEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCompositionEvent, Base>(exec, &JSCompositionEventTable, this, propertyName, descriptor);
+}
+
+JSValue jsCompositionEventData(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSCompositionEvent* castedThis = static_cast<JSCompositionEvent*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    CompositionEvent* imp = static_cast<CompositionEvent*>(castedThis->impl());
+    JSValue result = jsString(exec, imp->data());
+    return result;
+}
+
+JSValue jsCompositionEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSCompositionEvent* domObject = static_cast<JSCompositionEvent*>(asObject(slotBase));
+    return JSCompositionEvent::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSCompositionEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSCompositionEventConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsCompositionEventPrototypeFunctionInitCompositionEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCompositionEvent::s_info))
+        return throwError(exec, TypeError);
+    JSCompositionEvent* castedThisObj = static_cast<JSCompositionEvent*>(asObject(thisValue));
+    CompositionEvent* imp = static_cast<CompositionEvent*>(castedThisObj->impl());
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    DOMWindow* viewArg = toDOMWindow(args.at(3));
+    const UString& dataArg = args.at(4).toString(exec);
+
+    imp->initCompositionEvent(typeArg, canBubbleArg, cancelableArg, viewArg, dataArg);
+    return jsUndefined();
+}
+
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h b/src/3rdparty/webkit/WebCore/generated/JSCompositionEvent.h
index 688ca0c01d..69364029d0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCompositionEvent.h
@@ -18,68 +18,61 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef JSCanvasShortArray_h
-#define JSCanvasShortArray_h
+#ifndef JSCompositionEvent_h
+#define JSCompositionEvent_h
 
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasShortArray.h"
-#include "JSCanvasArray.h"
+#include "JSUIEvent.h"
 
 namespace WebCore {
 
-class CanvasShortArray;
+class CompositionEvent;
 
-class JSCanvasShortArray : public JSCanvasArray {
-    typedef JSCanvasArray Base;
+class JSCompositionEvent : public JSUIEvent {
+    typedef JSUIEvent Base;
 public:
-    JSCanvasShortArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasShortArray>);
+    JSCompositionEvent(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CompositionEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
-    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    CanvasShortArray* impl() const
-    {
-        return static_cast<CanvasShortArray*>(Base::impl());
-    }
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
-    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasShortArray*);
-CanvasShortArray* toCanvasShortArray(JSC::JSValue);
 
-class JSCanvasShortArrayPrototype : public JSC::JSObject {
+class JSCompositionEventPrototype : public JSC::JSObject {
     typedef JSC::JSObject Base;
 public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
-    JSCanvasShortArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+    JSCompositionEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
+// Functions
 
-} // namespace WebCore
+JSC::JSValue JSC_HOST_CALL jsCompositionEventPrototypeFunctionInitCompositionEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsCompositionEventData(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCompositionEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
-#endif // ENABLE(3D_CANVAS)
+} // namespace WebCore
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp b/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
index 06578909b1..964d333810 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
@@ -36,7 +36,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSConsole);
 
 static const HashTableValue JSConsoleTableValues[2] =
 {
-    { "profiles", DontDelete|ReadOnly, (intptr_t)jsConsoleProfiles, (intptr_t)0 },
+    { "profiles", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsConsoleProfiles), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -49,24 +49,25 @@ static JSC_CONST_HASHTABLE HashTable JSConsoleTable =
 
 /* Hash table for prototype */
 
-static const HashTableValue JSConsolePrototypeTableValues[17] =
+static const HashTableValue JSConsolePrototypeTableValues[18] =
 {
-    { "debug", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionDebug, (intptr_t)0 },
-    { "error", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionError, (intptr_t)0 },
-    { "info", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionInfo, (intptr_t)0 },
-    { "log", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionLog, (intptr_t)0 },
-    { "warn", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionWarn, (intptr_t)0 },
-    { "dir", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionDir, (intptr_t)0 },
-    { "dirxml", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionDirxml, (intptr_t)0 },
-    { "trace", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionTrace, (intptr_t)0 },
-    { "assert", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionAssert, (intptr_t)1 },
-    { "count", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionCount, (intptr_t)0 },
-    { "profile", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionProfile, (intptr_t)1 },
-    { "profileEnd", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionProfileEnd, (intptr_t)1 },
-    { "time", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionTime, (intptr_t)1 },
-    { "timeEnd", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionTimeEnd, (intptr_t)1 },
-    { "group", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionGroup, (intptr_t)0 },
-    { "groupEnd", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionGroupEnd, (intptr_t)0 },
+    { "debug", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionDebug), (intptr_t)0 },
+    { "error", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionError), (intptr_t)0 },
+    { "info", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionInfo), (intptr_t)0 },
+    { "log", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionLog), (intptr_t)0 },
+    { "warn", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionWarn), (intptr_t)0 },
+    { "dir", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionDir), (intptr_t)0 },
+    { "dirxml", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionDirxml), (intptr_t)0 },
+    { "trace", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionTrace), (intptr_t)0 },
+    { "assert", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionAssert), (intptr_t)1 },
+    { "count", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionCount), (intptr_t)0 },
+    { "markTimeline", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionMarkTimeline), (intptr_t)0 },
+    { "profile", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionProfile), (intptr_t)1 },
+    { "profileEnd", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionProfileEnd), (intptr_t)1 },
+    { "time", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionTime), (intptr_t)1 },
+    { "timeEnd", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionTimeEnd), (intptr_t)1 },
+    { "group", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionGroup), (intptr_t)0 },
+    { "groupEnd", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionGroupEnd), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -74,7 +75,7 @@ static JSC_CONST_HASHTABLE HashTable JSConsolePrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 511, JSConsolePrototypeTableValues, 0 };
 #else
-    { 35, 31, JSConsolePrototypeTableValues, 0 };
+    { 65, 63, JSConsolePrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSConsolePrototype::s_info = { "ConsolePrototype", 0, &JSConsolePrototypeTable, 0 };
@@ -122,9 +123,9 @@ bool JSConsole::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return getStaticValueDescriptor<JSConsole, Base>(exec, &JSConsoleTable, this, propertyName, descriptor);
 }
 
-JSValue jsConsoleProfiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsConsoleProfiles(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSConsole* castedThis = static_cast<JSConsole*>(asObject(slot.slotBase()));
+    JSConsole* castedThis = static_cast<JSConsole*>(asObject(slotBase));
     return castedThis->profiles(exec);
 }
 
@@ -259,6 +260,19 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionCount(ExecState* exec, JSObject*
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionMarkTimeline(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSConsole::s_info))
+        return throwError(exec, TypeError);
+    JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
+    Console* imp = static_cast<Console*>(castedThisObj->impl());
+    ScriptCallStack callStack(exec, args, 0);
+
+    imp->markTimeline(&callStack);
+    return jsUndefined();
+}
+
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfile(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSConsole.h b/src/3rdparty/webkit/WebCore/generated/JSConsole.h
index c55cc0ef21..b518a293c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSConsole.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSConsole.h
@@ -21,7 +21,6 @@
 #ifndef JSConsole_h
 #define JSConsole_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 
@@ -70,7 +69,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSConsolePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -89,6 +88,7 @@ JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDirxml(JSC::ExecState*, JSC
 JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTrace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionAssert(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionCount(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionMarkTimeline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfile(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfileEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
@@ -97,7 +97,7 @@ JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionGroup(JSC::ExecState*, JSC:
 JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionGroupEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsConsoleProfiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsConsoleProfiles(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
index 348bcc60b0..0feb66c62e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
@@ -35,13 +35,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSCoordinates);
 
 static const HashTableValue JSCoordinatesTableValues[8] =
 {
-    { "latitude", DontDelete|ReadOnly, (intptr_t)jsCoordinatesLatitude, (intptr_t)0 },
-    { "longitude", DontDelete|ReadOnly, (intptr_t)jsCoordinatesLongitude, (intptr_t)0 },
-    { "altitude", DontDelete|ReadOnly, (intptr_t)jsCoordinatesAltitude, (intptr_t)0 },
-    { "accuracy", DontDelete|ReadOnly, (intptr_t)jsCoordinatesAccuracy, (intptr_t)0 },
-    { "altitudeAccuracy", DontDelete|ReadOnly, (intptr_t)jsCoordinatesAltitudeAccuracy, (intptr_t)0 },
-    { "heading", DontDelete|ReadOnly, (intptr_t)jsCoordinatesHeading, (intptr_t)0 },
-    { "speed", DontDelete|ReadOnly, (intptr_t)jsCoordinatesSpeed, (intptr_t)0 },
+    { "latitude", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCoordinatesLatitude), (intptr_t)0 },
+    { "longitude", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCoordinatesLongitude), (intptr_t)0 },
+    { "altitude", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCoordinatesAltitude), (intptr_t)0 },
+    { "accuracy", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCoordinatesAccuracy), (intptr_t)0 },
+    { "altitudeAccuracy", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCoordinatesAltitudeAccuracy), (intptr_t)0 },
+    { "heading", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCoordinatesHeading), (intptr_t)0 },
+    { "speed", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCoordinatesSpeed), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -101,51 +101,54 @@ bool JSCoordinates::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSCoordinates, Base>(exec, &JSCoordinatesTable, this, propertyName, descriptor);
 }
 
-JSValue jsCoordinatesLatitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCoordinatesLatitude(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slot.slotBase()));
+    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Coordinates* imp = static_cast<Coordinates*>(castedThis->impl());
-    return jsNumber(exec, imp->latitude());
+    JSValue result = jsNumber(exec, imp->latitude());
+    return result;
 }
 
-JSValue jsCoordinatesLongitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCoordinatesLongitude(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slot.slotBase()));
+    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Coordinates* imp = static_cast<Coordinates*>(castedThis->impl());
-    return jsNumber(exec, imp->longitude());
+    JSValue result = jsNumber(exec, imp->longitude());
+    return result;
 }
 
-JSValue jsCoordinatesAltitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCoordinatesAltitude(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slot.slotBase()));
+    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slotBase));
     return castedThis->altitude(exec);
 }
 
-JSValue jsCoordinatesAccuracy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCoordinatesAccuracy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slot.slotBase()));
+    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Coordinates* imp = static_cast<Coordinates*>(castedThis->impl());
-    return jsNumber(exec, imp->accuracy());
+    JSValue result = jsNumber(exec, imp->accuracy());
+    return result;
 }
 
-JSValue jsCoordinatesAltitudeAccuracy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCoordinatesAltitudeAccuracy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slot.slotBase()));
+    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slotBase));
     return castedThis->altitudeAccuracy(exec);
 }
 
-JSValue jsCoordinatesHeading(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCoordinatesHeading(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slot.slotBase()));
+    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slotBase));
     return castedThis->heading(exec);
 }
 
-JSValue jsCoordinatesSpeed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCoordinatesSpeed(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slot.slotBase()));
+    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slotBase));
     return castedThis->speed(exec);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
index be0408b24f..3e7c6676cf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
@@ -21,7 +21,6 @@
 #ifndef JSCoordinates_h
 #define JSCoordinates_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 
@@ -71,7 +70,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCoordinatesPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,13 +79,13 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCoordinatesLatitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCoordinatesLongitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCoordinatesAltitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCoordinatesAccuracy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCoordinatesAltitudeAccuracy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCoordinatesHeading(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCoordinatesSpeed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCoordinatesLatitude(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCoordinatesLongitude(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCoordinatesAltitude(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCoordinatesAccuracy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCoordinatesAltitudeAccuracy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCoordinatesHeading(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCoordinatesSpeed(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
index 7c22959905..8aa34b2117 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
@@ -36,10 +36,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSCounter);
 
 static const HashTableValue JSCounterTableValues[5] =
 {
-    { "identifier", DontDelete|ReadOnly, (intptr_t)jsCounterIdentifier, (intptr_t)0 },
-    { "listStyle", DontDelete|ReadOnly, (intptr_t)jsCounterListStyle, (intptr_t)0 },
-    { "separator", DontDelete|ReadOnly, (intptr_t)jsCounterSeparator, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCounterConstructor, (intptr_t)0 },
+    { "identifier", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCounterIdentifier), (intptr_t)0 },
+    { "listStyle", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCounterListStyle), (intptr_t)0 },
+    { "separator", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCounterSeparator), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCounterConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -78,7 +78,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -146,33 +146,36 @@ bool JSCounter::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return getStaticValueDescriptor<JSCounter, Base>(exec, &JSCounterTable, this, propertyName, descriptor);
 }
 
-JSValue jsCounterIdentifier(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterIdentifier(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCounter* castedThis = static_cast<JSCounter*>(asObject(slot.slotBase()));
+    JSCounter* castedThis = static_cast<JSCounter*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Counter* imp = static_cast<Counter*>(castedThis->impl());
-    return jsString(exec, imp->identifier());
+    JSValue result = jsString(exec, imp->identifier());
+    return result;
 }
 
-JSValue jsCounterListStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterListStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCounter* castedThis = static_cast<JSCounter*>(asObject(slot.slotBase()));
+    JSCounter* castedThis = static_cast<JSCounter*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Counter* imp = static_cast<Counter*>(castedThis->impl());
-    return jsString(exec, imp->listStyle());
+    JSValue result = jsString(exec, imp->listStyle());
+    return result;
 }
 
-JSValue jsCounterSeparator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterSeparator(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCounter* castedThis = static_cast<JSCounter*>(asObject(slot.slotBase()));
+    JSCounter* castedThis = static_cast<JSCounter*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Counter* imp = static_cast<Counter*>(castedThis->impl());
-    return jsString(exec, imp->separator());
+    JSValue result = jsString(exec, imp->separator());
+    return result;
 }
 
-JSValue jsCounterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCounter* domObject = static_cast<JSCounter*>(asObject(slot.slotBase()));
+    JSCounter* domObject = static_cast<JSCounter*>(asObject(slotBase));
     return JSCounter::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCounter::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.h b/src/3rdparty/webkit/WebCore/generated/JSCounter.h
index 9827a48870..d6386847f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.h
@@ -21,7 +21,6 @@
 #ifndef JSCounter_h
 #define JSCounter_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -66,7 +65,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCounterPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,10 +74,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCounterIdentifier(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCounterListStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCounterSeparator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCounterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCounterIdentifier(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCounterListStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCounterSeparator(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCounterConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCustomEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSCustomEvent.cpp
new file mode 100644
index 0000000000..97b6b4981d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCustomEvent.cpp
@@ -0,0 +1,187 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSCustomEvent.h"
+
+#include "CustomEvent.h"
+#include <runtime/Error.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCustomEvent);
+
+/* Hash table */
+
+static const HashTableValue JSCustomEventTableValues[3] =
+{
+    { "detail", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCustomEventDetail), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCustomEventConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCustomEventTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 1, JSCustomEventTableValues, 0 };
+#else
+    { 4, 3, JSCustomEventTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSCustomEventConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCustomEventConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCustomEventConstructorTableValues, 0 };
+#else
+    { 1, 0, JSCustomEventConstructorTableValues, 0 };
+#endif
+
+class JSCustomEventConstructor : public DOMConstructorObject {
+public:
+    JSCustomEventConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSCustomEventConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSCustomEventPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSCustomEventConstructor::s_info = { "CustomEventConstructor", 0, &JSCustomEventConstructorTable, 0 };
+
+bool JSCustomEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCustomEventConstructor, DOMObject>(exec, &JSCustomEventConstructorTable, this, propertyName, slot);
+}
+
+bool JSCustomEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCustomEventConstructor, DOMObject>(exec, &JSCustomEventConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCustomEventPrototypeTableValues[2] =
+{
+    { "initCustomEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCustomEventPrototypeFunctionInitCustomEvent), (intptr_t)4 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCustomEventPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCustomEventPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSCustomEventPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCustomEventPrototype::s_info = { "CustomEventPrototype", 0, &JSCustomEventPrototypeTable, 0 };
+
+JSObject* JSCustomEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCustomEvent>(exec, globalObject);
+}
+
+bool JSCustomEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSCustomEventPrototypeTable, this, propertyName, slot);
+}
+
+bool JSCustomEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSCustomEventPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSCustomEvent::s_info = { "CustomEvent", &JSEvent::s_info, &JSCustomEventTable, 0 };
+
+JSCustomEvent::JSCustomEvent(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CustomEvent> impl)
+    : JSEvent(structure, globalObject, impl)
+{
+}
+
+JSObject* JSCustomEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCustomEventPrototype(JSCustomEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
+}
+
+bool JSCustomEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCustomEvent, Base>(exec, &JSCustomEventTable, this, propertyName, slot);
+}
+
+bool JSCustomEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCustomEvent, Base>(exec, &JSCustomEventTable, this, propertyName, descriptor);
+}
+
+JSValue jsCustomEventDetail(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSCustomEvent* castedThis = static_cast<JSCustomEvent*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    CustomEvent* imp = static_cast<CustomEvent*>(castedThis->impl());
+    JSValue result = imp->detail().jsValue();;
+    return result;
+}
+
+JSValue jsCustomEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSCustomEvent* domObject = static_cast<JSCustomEvent*>(asObject(slotBase));
+    return JSCustomEvent::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSCustomEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSCustomEventConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsCustomEventPrototypeFunctionInitCustomEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCustomEvent::s_info))
+        return throwError(exec, TypeError);
+    JSCustomEvent* castedThisObj = static_cast<JSCustomEvent*>(asObject(thisValue));
+    CustomEvent* imp = static_cast<CustomEvent*>(castedThisObj->impl());
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    ScriptValue detailArg = args.at(3);
+
+    imp->initCustomEvent(typeArg, canBubbleArg, cancelableArg, detailArg);
+    return jsUndefined();
+}
+
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCustomEvent.h b/src/3rdparty/webkit/WebCore/generated/JSCustomEvent.h
new file mode 100644
index 0000000000..1ad0955a07
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCustomEvent.h
@@ -0,0 +1,78 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCustomEvent_h
+#define JSCustomEvent_h
+
+#include "JSEvent.h"
+
+namespace WebCore {
+
+class CustomEvent;
+
+class JSCustomEvent : public JSEvent {
+    typedef JSEvent Base;
+public:
+    JSCustomEvent(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CustomEvent>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+
+class JSCustomEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSCustomEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsCustomEventPrototypeFunctionInitCustomEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsCustomEventDetail(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCustomEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
index 17a527ee98..fabf7572d4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
@@ -27,8 +27,6 @@
 #include "DOMApplicationCache.h"
 #include "Event.h"
 #include "EventListener.h"
-#include "Frame.h"
-#include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "RegisteredEventListener.h"
@@ -46,15 +44,15 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMApplicationCache);
 
 static const HashTableValue JSDOMApplicationCacheTableValues[10] =
 {
-    { "status", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheStatus, (intptr_t)0 },
-    { "onchecking", DontDelete, (intptr_t)jsDOMApplicationCacheOnchecking, (intptr_t)setJSDOMApplicationCacheOnchecking },
-    { "onerror", DontDelete, (intptr_t)jsDOMApplicationCacheOnerror, (intptr_t)setJSDOMApplicationCacheOnerror },
-    { "onnoupdate", DontDelete, (intptr_t)jsDOMApplicationCacheOnnoupdate, (intptr_t)setJSDOMApplicationCacheOnnoupdate },
-    { "ondownloading", DontDelete, (intptr_t)jsDOMApplicationCacheOndownloading, (intptr_t)setJSDOMApplicationCacheOndownloading },
-    { "onprogress", DontDelete, (intptr_t)jsDOMApplicationCacheOnprogress, (intptr_t)setJSDOMApplicationCacheOnprogress },
-    { "onupdateready", DontDelete, (intptr_t)jsDOMApplicationCacheOnupdateready, (intptr_t)setJSDOMApplicationCacheOnupdateready },
-    { "oncached", DontDelete, (intptr_t)jsDOMApplicationCacheOncached, (intptr_t)setJSDOMApplicationCacheOncached },
-    { "onobsolete", DontDelete, (intptr_t)jsDOMApplicationCacheOnobsolete, (intptr_t)setJSDOMApplicationCacheOnobsolete },
+    { "status", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheStatus), (intptr_t)0 },
+    { "onchecking", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOnchecking), (intptr_t)setJSDOMApplicationCacheOnchecking },
+    { "onerror", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOnerror), (intptr_t)setJSDOMApplicationCacheOnerror },
+    { "onnoupdate", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOnnoupdate), (intptr_t)setJSDOMApplicationCacheOnnoupdate },
+    { "ondownloading", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOndownloading), (intptr_t)setJSDOMApplicationCacheOndownloading },
+    { "onprogress", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOnprogress), (intptr_t)setJSDOMApplicationCacheOnprogress },
+    { "onupdateready", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOnupdateready), (intptr_t)setJSDOMApplicationCacheOnupdateready },
+    { "oncached", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOncached), (intptr_t)setJSDOMApplicationCacheOncached },
+    { "onobsolete", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOnobsolete), (intptr_t)setJSDOMApplicationCacheOnobsolete },
     { 0, 0, 0, 0 }
 };
 
@@ -69,17 +67,17 @@ static JSC_CONST_HASHTABLE HashTable JSDOMApplicationCacheTable =
 
 static const HashTableValue JSDOMApplicationCachePrototypeTableValues[12] =
 {
-    { "UNCACHED", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheUNCACHED, (intptr_t)0 },
-    { "IDLE", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheIDLE, (intptr_t)0 },
-    { "CHECKING", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheCHECKING, (intptr_t)0 },
-    { "DOWNLOADING", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheDOWNLOADING, (intptr_t)0 },
-    { "UPDATEREADY", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheUPDATEREADY, (intptr_t)0 },
-    { "OBSOLETE", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheOBSOLETE, (intptr_t)0 },
-    { "update", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionUpdate, (intptr_t)0 },
-    { "swapCache", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionSwapCache, (intptr_t)0 },
-    { "addEventListener", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { "UNCACHED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheUNCACHED), (intptr_t)0 },
+    { "IDLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheIDLE), (intptr_t)0 },
+    { "CHECKING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheCHECKING), (intptr_t)0 },
+    { "DOWNLOADING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheDOWNLOADING), (intptr_t)0 },
+    { "UPDATEREADY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheUPDATEREADY), (intptr_t)0 },
+    { "OBSOLETE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOBSOLETE), (intptr_t)0 },
+    { "update", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMApplicationCachePrototypeFunctionUpdate), (intptr_t)0 },
+    { "swapCache", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMApplicationCachePrototypeFunctionSwapCache), (intptr_t)0 },
+    { "addEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMApplicationCachePrototypeFunctionAddEventListener), (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMApplicationCachePrototypeFunctionRemoveEventListener), (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMApplicationCachePrototypeFunctionDispatchEvent), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -117,14 +115,14 @@ JSDOMApplicationCache::JSDOMApplicationCache(NonNullPassRefPtr<Structure> struct
 
 JSDOMApplicationCache::~JSDOMApplicationCache()
 {
-    impl()->invalidateEventListeners();
+    impl()->invalidateJSEventListeners(this);
     forgetDOMObject(this, impl());
 }
 
 void JSDOMApplicationCache::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
-    impl()->markEventListeners(markStack);
+    impl()->markJSEventListeners(markStack);
 }
 
 JSObject* JSDOMApplicationCache::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -142,106 +140,123 @@ bool JSDOMApplicationCache::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSDOMApplicationCache, Base>(exec, &JSDOMApplicationCacheTable, this, propertyName, descriptor);
 }
 
-JSValue jsDOMApplicationCacheStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheStatus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
-    return jsNumber(exec, imp->status());
+    JSValue result = jsNumber(exec, imp->status());
+    return result;
 }
 
-JSValue jsDOMApplicationCacheOnchecking(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnchecking(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->onchecking()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMApplicationCacheOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMApplicationCacheOnnoupdate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnnoupdate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->onnoupdate()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMApplicationCacheOndownloading(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOndownloading(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->ondownloading()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMApplicationCacheOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnprogress(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->onprogress()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMApplicationCacheOnupdateready(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnupdateready(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->onupdateready()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMApplicationCacheOncached(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOncached(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->oncached()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMApplicationCacheOnobsolete(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnobsolete(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->onobsolete()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
@@ -255,80 +270,56 @@ void setJSDOMApplicationCacheOnchecking(ExecState* exec, JSObject* thisObject, J
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnchecking(globalObject->createJSAttributeEventListener(value));
+    imp->setOnchecking(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMApplicationCacheOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMApplicationCacheOnnoupdate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnnoupdate(globalObject->createJSAttributeEventListener(value));
+    imp->setOnnoupdate(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMApplicationCacheOndownloading(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndownloading(globalObject->createJSAttributeEventListener(value));
+    imp->setOndownloading(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMApplicationCacheOnprogress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
+    imp->setOnprogress(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMApplicationCacheOnupdateready(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnupdateready(globalObject->createJSAttributeEventListener(value));
+    imp->setOnupdateready(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMApplicationCacheOncached(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncached(globalObject->createJSAttributeEventListener(value));
+    imp->setOncached(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMApplicationCacheOnobsolete(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnobsolete(globalObject->createJSAttributeEventListener(value));
+    imp->setOnobsolete(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionUpdate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -395,32 +386,32 @@ JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionDispatchEvent(ExecSt
 
 // Constant getters
 
-JSValue jsDOMApplicationCacheUNCACHED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheUNCACHED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsDOMApplicationCacheIDLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheIDLE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsDOMApplicationCacheCHECKING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheCHECKING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsDOMApplicationCacheDOWNLOADING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheDOWNLOADING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsDOMApplicationCacheUPDATEREADY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheUPDATEREADY(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsDOMApplicationCacheOBSOLETE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheOBSOLETE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
index 2ee87d4c9d..32b97e0c87 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -46,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -76,7 +75,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDOMApplicationCachePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -92,31 +91,31 @@ JSC::JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionRemoveEventList
 JSC::JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDOMApplicationCacheStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMApplicationCacheOnchecking(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheStatus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMApplicationCacheOnchecking(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOnchecking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMApplicationCacheOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMApplicationCacheOnnoupdate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOnnoupdate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOnnoupdate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMApplicationCacheOndownloading(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOndownloading(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOndownloading(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMApplicationCacheOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOnprogress(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMApplicationCacheOnupdateready(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOnupdateready(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOnupdateready(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMApplicationCacheOncached(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOncached(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOncached(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMApplicationCacheOnobsolete(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOnobsolete(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOnobsolete(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 // Constants
 
-JSC::JSValue jsDOMApplicationCacheUNCACHED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMApplicationCacheIDLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMApplicationCacheCHECKING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMApplicationCacheDOWNLOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMApplicationCacheUPDATEREADY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMApplicationCacheOBSOLETE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheUNCACHED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMApplicationCacheIDLE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMApplicationCacheCHECKING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMApplicationCacheDOWNLOADING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMApplicationCacheUPDATEREADY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMApplicationCacheOBSOLETE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
index ff889051a8..49da4d0673 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
@@ -38,10 +38,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMCoreException);
 
 static const HashTableValue JSDOMCoreExceptionTableValues[5] =
 {
-    { "code", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionCode, (intptr_t)0 },
-    { "name", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionName, (intptr_t)0 },
-    { "message", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionMessage, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDOMCoreExceptionConstructor, (intptr_t)0 },
+    { "code", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionCode), (intptr_t)0 },
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionName), (intptr_t)0 },
+    { "message", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionMessage), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -56,28 +56,28 @@ static JSC_CONST_HASHTABLE HashTable JSDOMCoreExceptionTable =
 
 static const HashTableValue JSDOMCoreExceptionConstructorTableValues[23] =
 {
-    { "INDEX_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINDEX_SIZE_ERR, (intptr_t)0 },
-    { "DOMSTRING_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionDOMSTRING_SIZE_ERR, (intptr_t)0 },
-    { "HIERARCHY_REQUEST_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionHIERARCHY_REQUEST_ERR, (intptr_t)0 },
-    { "WRONG_DOCUMENT_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionWRONG_DOCUMENT_ERR, (intptr_t)0 },
-    { "INVALID_CHARACTER_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_CHARACTER_ERR, (intptr_t)0 },
-    { "NO_DATA_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNO_DATA_ALLOWED_ERR, (intptr_t)0 },
-    { "NO_MODIFICATION_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR, (intptr_t)0 },
-    { "NOT_FOUND_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNOT_FOUND_ERR, (intptr_t)0 },
-    { "NOT_SUPPORTED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNOT_SUPPORTED_ERR, (intptr_t)0 },
-    { "INUSE_ATTRIBUTE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR, (intptr_t)0 },
-    { "INVALID_STATE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_STATE_ERR, (intptr_t)0 },
-    { "SYNTAX_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionSYNTAX_ERR, (intptr_t)0 },
-    { "INVALID_MODIFICATION_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_MODIFICATION_ERR, (intptr_t)0 },
-    { "NAMESPACE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNAMESPACE_ERR, (intptr_t)0 },
-    { "INVALID_ACCESS_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_ACCESS_ERR, (intptr_t)0 },
-    { "VALIDATION_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionVALIDATION_ERR, (intptr_t)0 },
-    { "TYPE_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionTYPE_MISMATCH_ERR, (intptr_t)0 },
-    { "SECURITY_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionSECURITY_ERR, (intptr_t)0 },
-    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNETWORK_ERR, (intptr_t)0 },
-    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionABORT_ERR, (intptr_t)0 },
-    { "URL_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionURL_MISMATCH_ERR, (intptr_t)0 },
-    { "QUOTA_EXCEEDED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionQUOTA_EXCEEDED_ERR, (intptr_t)0 },
+    { "INDEX_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINDEX_SIZE_ERR), (intptr_t)0 },
+    { "DOMSTRING_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionDOMSTRING_SIZE_ERR), (intptr_t)0 },
+    { "HIERARCHY_REQUEST_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionHIERARCHY_REQUEST_ERR), (intptr_t)0 },
+    { "WRONG_DOCUMENT_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionWRONG_DOCUMENT_ERR), (intptr_t)0 },
+    { "INVALID_CHARACTER_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_CHARACTER_ERR), (intptr_t)0 },
+    { "NO_DATA_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNO_DATA_ALLOWED_ERR), (intptr_t)0 },
+    { "NO_MODIFICATION_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR), (intptr_t)0 },
+    { "NOT_FOUND_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNOT_FOUND_ERR), (intptr_t)0 },
+    { "NOT_SUPPORTED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNOT_SUPPORTED_ERR), (intptr_t)0 },
+    { "INUSE_ATTRIBUTE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR), (intptr_t)0 },
+    { "INVALID_STATE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_STATE_ERR), (intptr_t)0 },
+    { "SYNTAX_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionSYNTAX_ERR), (intptr_t)0 },
+    { "INVALID_MODIFICATION_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_MODIFICATION_ERR), (intptr_t)0 },
+    { "NAMESPACE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNAMESPACE_ERR), (intptr_t)0 },
+    { "INVALID_ACCESS_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_ACCESS_ERR), (intptr_t)0 },
+    { "VALIDATION_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionVALIDATION_ERR), (intptr_t)0 },
+    { "TYPE_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionTYPE_MISMATCH_ERR), (intptr_t)0 },
+    { "SECURITY_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionSECURITY_ERR), (intptr_t)0 },
+    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNETWORK_ERR), (intptr_t)0 },
+    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionABORT_ERR), (intptr_t)0 },
+    { "URL_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionURL_MISMATCH_ERR), (intptr_t)0 },
+    { "QUOTA_EXCEEDED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionQUOTA_EXCEEDED_ERR), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -102,7 +102,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -125,29 +125,29 @@ bool JSDOMCoreExceptionConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 static const HashTableValue JSDOMCoreExceptionPrototypeTableValues[24] =
 {
-    { "INDEX_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINDEX_SIZE_ERR, (intptr_t)0 },
-    { "DOMSTRING_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionDOMSTRING_SIZE_ERR, (intptr_t)0 },
-    { "HIERARCHY_REQUEST_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionHIERARCHY_REQUEST_ERR, (intptr_t)0 },
-    { "WRONG_DOCUMENT_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionWRONG_DOCUMENT_ERR, (intptr_t)0 },
-    { "INVALID_CHARACTER_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_CHARACTER_ERR, (intptr_t)0 },
-    { "NO_DATA_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNO_DATA_ALLOWED_ERR, (intptr_t)0 },
-    { "NO_MODIFICATION_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR, (intptr_t)0 },
-    { "NOT_FOUND_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNOT_FOUND_ERR, (intptr_t)0 },
-    { "NOT_SUPPORTED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNOT_SUPPORTED_ERR, (intptr_t)0 },
-    { "INUSE_ATTRIBUTE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR, (intptr_t)0 },
-    { "INVALID_STATE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_STATE_ERR, (intptr_t)0 },
-    { "SYNTAX_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionSYNTAX_ERR, (intptr_t)0 },
-    { "INVALID_MODIFICATION_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_MODIFICATION_ERR, (intptr_t)0 },
-    { "NAMESPACE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNAMESPACE_ERR, (intptr_t)0 },
-    { "INVALID_ACCESS_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_ACCESS_ERR, (intptr_t)0 },
-    { "VALIDATION_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionVALIDATION_ERR, (intptr_t)0 },
-    { "TYPE_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionTYPE_MISMATCH_ERR, (intptr_t)0 },
-    { "SECURITY_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionSECURITY_ERR, (intptr_t)0 },
-    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNETWORK_ERR, (intptr_t)0 },
-    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionABORT_ERR, (intptr_t)0 },
-    { "URL_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionURL_MISMATCH_ERR, (intptr_t)0 },
-    { "QUOTA_EXCEEDED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionQUOTA_EXCEEDED_ERR, (intptr_t)0 },
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsDOMCoreExceptionPrototypeFunctionToString, (intptr_t)0 },
+    { "INDEX_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINDEX_SIZE_ERR), (intptr_t)0 },
+    { "DOMSTRING_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionDOMSTRING_SIZE_ERR), (intptr_t)0 },
+    { "HIERARCHY_REQUEST_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionHIERARCHY_REQUEST_ERR), (intptr_t)0 },
+    { "WRONG_DOCUMENT_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionWRONG_DOCUMENT_ERR), (intptr_t)0 },
+    { "INVALID_CHARACTER_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_CHARACTER_ERR), (intptr_t)0 },
+    { "NO_DATA_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNO_DATA_ALLOWED_ERR), (intptr_t)0 },
+    { "NO_MODIFICATION_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR), (intptr_t)0 },
+    { "NOT_FOUND_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNOT_FOUND_ERR), (intptr_t)0 },
+    { "NOT_SUPPORTED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNOT_SUPPORTED_ERR), (intptr_t)0 },
+    { "INUSE_ATTRIBUTE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR), (intptr_t)0 },
+    { "INVALID_STATE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_STATE_ERR), (intptr_t)0 },
+    { "SYNTAX_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionSYNTAX_ERR), (intptr_t)0 },
+    { "INVALID_MODIFICATION_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_MODIFICATION_ERR), (intptr_t)0 },
+    { "NAMESPACE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNAMESPACE_ERR), (intptr_t)0 },
+    { "INVALID_ACCESS_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_ACCESS_ERR), (intptr_t)0 },
+    { "VALIDATION_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionVALIDATION_ERR), (intptr_t)0 },
+    { "TYPE_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionTYPE_MISMATCH_ERR), (intptr_t)0 },
+    { "SECURITY_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionSECURITY_ERR), (intptr_t)0 },
+    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNETWORK_ERR), (intptr_t)0 },
+    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionABORT_ERR), (intptr_t)0 },
+    { "URL_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionURL_MISMATCH_ERR), (intptr_t)0 },
+    { "QUOTA_EXCEEDED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionQUOTA_EXCEEDED_ERR), (intptr_t)0 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsDOMCoreExceptionPrototypeFunctionToString), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -203,33 +203,36 @@ bool JSDOMCoreException::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSDOMCoreException, Base>(exec, &JSDOMCoreExceptionTable, this, propertyName, descriptor);
 }
 
-JSValue jsDOMCoreExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionCode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMCoreException* castedThis = static_cast<JSDOMCoreException*>(asObject(slot.slotBase()));
+    JSDOMCoreException* castedThis = static_cast<JSDOMCoreException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMCoreException* imp = static_cast<DOMCoreException*>(castedThis->impl());
-    return jsNumber(exec, imp->code());
+    JSValue result = jsNumber(exec, imp->code());
+    return result;
 }
 
-JSValue jsDOMCoreExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMCoreException* castedThis = static_cast<JSDOMCoreException*>(asObject(slot.slotBase()));
+    JSDOMCoreException* castedThis = static_cast<JSDOMCoreException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMCoreException* imp = static_cast<DOMCoreException*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsDOMCoreExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMCoreException* castedThis = static_cast<JSDOMCoreException*>(asObject(slot.slotBase()));
+    JSDOMCoreException* castedThis = static_cast<JSDOMCoreException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMCoreException* imp = static_cast<DOMCoreException*>(castedThis->impl());
-    return jsString(exec, imp->message());
+    JSValue result = jsString(exec, imp->message());
+    return result;
 }
 
-JSValue jsDOMCoreExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMCoreException* domObject = static_cast<JSDOMCoreException*>(asObject(slot.slotBase()));
+    JSDOMCoreException* domObject = static_cast<JSDOMCoreException*>(asObject(slotBase));
     return JSDOMCoreException::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSDOMCoreException::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -252,112 +255,112 @@ JSValue JSC_HOST_CALL jsDOMCoreExceptionPrototypeFunctionToString(ExecState* exe
 
 // Constant getters
 
-JSValue jsDOMCoreExceptionINDEX_SIZE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINDEX_SIZE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsDOMCoreExceptionDOMSTRING_SIZE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionDOMSTRING_SIZE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsDOMCoreExceptionWRONG_DOCUMENT_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionWRONG_DOCUMENT_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsDOMCoreExceptionINVALID_CHARACTER_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_CHARACTER_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValue jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValue jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValue jsDOMCoreExceptionNOT_FOUND_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNOT_FOUND_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValue jsDOMCoreExceptionNOT_SUPPORTED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNOT_SUPPORTED_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValue jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValue jsDOMCoreExceptionINVALID_STATE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_STATE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
-JSValue jsDOMCoreExceptionSYNTAX_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionSYNTAX_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(12));
 }
 
-JSValue jsDOMCoreExceptionINVALID_MODIFICATION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_MODIFICATION_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(13));
 }
 
-JSValue jsDOMCoreExceptionNAMESPACE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNAMESPACE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(14));
 }
 
-JSValue jsDOMCoreExceptionINVALID_ACCESS_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_ACCESS_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(15));
 }
 
-JSValue jsDOMCoreExceptionVALIDATION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionVALIDATION_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValue jsDOMCoreExceptionTYPE_MISMATCH_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionTYPE_MISMATCH_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(17));
 }
 
-JSValue jsDOMCoreExceptionSECURITY_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionSECURITY_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(18));
 }
 
-JSValue jsDOMCoreExceptionNETWORK_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNETWORK_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(19));
 }
 
-JSValue jsDOMCoreExceptionABORT_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionABORT_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(20));
 }
 
-JSValue jsDOMCoreExceptionURL_MISMATCH_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionURL_MISMATCH_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(21));
 }
 
-JSValue jsDOMCoreExceptionQUOTA_EXCEEDED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionQUOTA_EXCEEDED_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(22));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
index 0d99c15e4e..8896060798 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
@@ -21,7 +21,6 @@
 #ifndef JSDOMCoreException_h
 #define JSDOMCoreException_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -68,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDOMCoreExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,34 +79,34 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsDOMCoreExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDOMCoreExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionCode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsDOMCoreExceptionINDEX_SIZE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionDOMSTRING_SIZE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionWRONG_DOCUMENT_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionINVALID_CHARACTER_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionNOT_FOUND_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionNOT_SUPPORTED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionINVALID_STATE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionSYNTAX_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionINVALID_MODIFICATION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionNAMESPACE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionINVALID_ACCESS_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionVALIDATION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionTYPE_MISMATCH_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionSECURITY_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionNETWORK_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionABORT_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionURL_MISMATCH_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionQUOTA_EXCEEDED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionINDEX_SIZE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionDOMSTRING_SIZE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionWRONG_DOCUMENT_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionINVALID_CHARACTER_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionNOT_FOUND_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionNOT_SUPPORTED_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionINVALID_STATE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionSYNTAX_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionINVALID_MODIFICATION_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionNAMESPACE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionINVALID_ACCESS_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionVALIDATION_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionTYPE_MISMATCH_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionSECURITY_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionNETWORK_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionABORT_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionURL_MISMATCH_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionQUOTA_EXCEEDED_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMFormData.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMFormData.cpp
new file mode 100644
index 0000000000..34037bc279
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMFormData.cpp
@@ -0,0 +1,193 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSDOMFormData.h"
+
+#include "DOMFormData.h"
+#include <runtime/Error.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSDOMFormData);
+
+/* Hash table */
+
+static const HashTableValue JSDOMFormDataTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMFormDataConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSDOMFormDataTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSDOMFormDataTableValues, 0 };
+#else
+    { 2, 1, JSDOMFormDataTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSDOMFormDataConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSDOMFormDataConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSDOMFormDataConstructorTableValues, 0 };
+#else
+    { 1, 0, JSDOMFormDataConstructorTableValues, 0 };
+#endif
+
+class JSDOMFormDataConstructor : public DOMConstructorObject {
+public:
+    JSDOMFormDataConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSDOMFormDataConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSDOMFormDataPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+    static JSObject* constructDOMFormData(ExecState* exec, JSObject* constructor, const ArgList&)
+    {
+        return asObject(toJS(exec, static_cast<JSDOMFormDataConstructor*>(constructor)->globalObject(), DOMFormData::create()));
+    }
+    virtual ConstructType getConstructData(ConstructData& constructData)
+    {
+        constructData.native.function = constructDOMFormData;
+        return ConstructTypeHost;
+    }
+};
+
+const ClassInfo JSDOMFormDataConstructor::s_info = { "FormDataConstructor", 0, &JSDOMFormDataConstructorTable, 0 };
+
+bool JSDOMFormDataConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDOMFormDataConstructor, DOMObject>(exec, &JSDOMFormDataConstructorTable, this, propertyName, slot);
+}
+
+bool JSDOMFormDataConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDOMFormDataConstructor, DOMObject>(exec, &JSDOMFormDataConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSDOMFormDataPrototypeTableValues[2] =
+{
+    { "append", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMFormDataPrototypeFunctionAppend), (intptr_t)2 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSDOMFormDataPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSDOMFormDataPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSDOMFormDataPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSDOMFormDataPrototype::s_info = { "FormDataPrototype", 0, &JSDOMFormDataPrototypeTable, 0 };
+
+JSObject* JSDOMFormDataPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSDOMFormData>(exec, globalObject);
+}
+
+bool JSDOMFormDataPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSDOMFormDataPrototypeTable, this, propertyName, slot);
+}
+
+bool JSDOMFormDataPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSDOMFormDataPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSDOMFormData::s_info = { "FormData", 0, &JSDOMFormDataTable, 0 };
+
+JSDOMFormData::JSDOMFormData(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<DOMFormData> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSDOMFormData::~JSDOMFormData()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSDOMFormData::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSDOMFormDataPrototype(JSDOMFormDataPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSDOMFormData::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDOMFormData, Base>(exec, &JSDOMFormDataTable, this, propertyName, slot);
+}
+
+bool JSDOMFormData::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDOMFormData, Base>(exec, &JSDOMFormDataTable, this, propertyName, descriptor);
+}
+
+JSValue jsDOMFormDataConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMFormData* domObject = static_cast<JSDOMFormData*>(asObject(slotBase));
+    return JSDOMFormData::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSDOMFormData::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSDOMFormDataConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsDOMFormDataPrototypeFunctionAppend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSDOMFormData::s_info))
+        return throwError(exec, TypeError);
+    JSDOMFormData* castedThisObj = static_cast<JSDOMFormData*>(asObject(thisValue));
+    return castedThisObj->append(exec, args);
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMFormData* object)
+{
+    return getDOMObjectWrapper<JSDOMFormData>(exec, globalObject, object);
+}
+DOMFormData* toDOMFormData(JSC::JSValue value)
+{
+    return value.inherits(&JSDOMFormData::s_info) ? static_cast<JSDOMFormData*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h b/src/3rdparty/webkit/WebCore/generated/JSDOMFormData.h
index 0d67612e93..66b9bd86fd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMFormData.h
@@ -18,25 +18,22 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef JSCanvasArray_h
-#define JSCanvasArray_h
+#ifndef JSDOMFormData_h
+#define JSDOMFormData_h
 
-#if ENABLE(3D_CANVAS)
-
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
 namespace WebCore {
 
-class CanvasArray;
+class DOMFormData;
 
-class JSCanvasArray : public DOMObjectWithGlobalPointer {
+class JSDOMFormData : public DOMObjectWithGlobalPointer {
     typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSCanvasArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasArray>);
-    virtual ~JSCanvasArray();
+    JSDOMFormData(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<DOMFormData>);
+    virtual ~JSDOMFormData();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -45,21 +42,25 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    CanvasArray* impl() const { return m_impl.get(); }
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+
+    // Custom functions
+    JSC::JSValue append(JSC::ExecState*, const JSC::ArgList&);
+    DOMFormData* impl() const { return m_impl.get(); }
 
 private:
-    RefPtr<CanvasArray> m_impl;
+    RefPtr<DOMFormData> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasArray*);
-CanvasArray* toCanvasArray(JSC::JSValue);
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DOMFormData*);
+DOMFormData* toDOMFormData(JSC::JSValue);
 
-class JSCanvasArrayPrototype : public JSC::JSObject {
+class JSDOMFormDataPrototype : public JSC::JSObject {
     typedef JSC::JSObject Base;
 public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -69,23 +70,20 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
-    JSCanvasArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+    JSDOMFormDataPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
 
-JSC::JSValue JSC_HOST_CALL jsCanvasArrayPrototypeFunctionSizeInBytes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasArrayPrototypeFunctionAlignedSizeInBytes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMFormDataPrototypeFunctionAppend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCanvasArrayLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMFormDataConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
-
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
index 268647b033..5dcd137261 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
@@ -44,7 +44,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMImplementation);
 
 static const HashTableValue JSDOMImplementationTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDOMImplementationConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMImplementationConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -83,7 +83,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -106,11 +106,11 @@ bool JSDOMImplementationConstructor::getOwnPropertyDescriptor(ExecState* exec, c
 
 static const HashTableValue JSDOMImplementationPrototypeTableValues[6] =
 {
-    { "hasFeature", DontDelete|Function, (intptr_t)jsDOMImplementationPrototypeFunctionHasFeature, (intptr_t)2 },
-    { "createDocumentType", DontDelete|Function, (intptr_t)jsDOMImplementationPrototypeFunctionCreateDocumentType, (intptr_t)3 },
-    { "createDocument", DontDelete|Function, (intptr_t)jsDOMImplementationPrototypeFunctionCreateDocument, (intptr_t)3 },
-    { "createCSSStyleSheet", DontDelete|Function, (intptr_t)jsDOMImplementationPrototypeFunctionCreateCSSStyleSheet, (intptr_t)2 },
-    { "createHTMLDocument", DontDelete|Function, (intptr_t)jsDOMImplementationPrototypeFunctionCreateHTMLDocument, (intptr_t)1 },
+    { "hasFeature", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMImplementationPrototypeFunctionHasFeature), (intptr_t)2 },
+    { "createDocumentType", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMImplementationPrototypeFunctionCreateDocumentType), (intptr_t)3 },
+    { "createDocument", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMImplementationPrototypeFunctionCreateDocument), (intptr_t)3 },
+    { "createCSSStyleSheet", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMImplementationPrototypeFunctionCreateCSSStyleSheet), (intptr_t)2 },
+    { "createHTMLDocument", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMImplementationPrototypeFunctionCreateHTMLDocument), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -166,9 +166,9 @@ bool JSDOMImplementation::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSDOMImplementation, Base>(exec, &JSDOMImplementationTable, this, propertyName, descriptor);
 }
 
-JSValue jsDOMImplementationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMImplementationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMImplementation* domObject = static_cast<JSDOMImplementation*>(asObject(slot.slotBase()));
+    JSDOMImplementation* domObject = static_cast<JSDOMImplementation*>(asObject(slotBase));
     return JSDOMImplementation::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSDOMImplementation::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
index 8dc907fa8b..873fb15469 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
@@ -21,7 +21,6 @@
 #ifndef JSDOMImplementation_h
 #define JSDOMImplementation_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -68,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDOMImplementationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -84,7 +83,7 @@ JSC::JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateCSSStyleShe
 JSC::JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateHTMLDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDOMImplementationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMImplementationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
index ecd336a369..71b1003075 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
@@ -38,7 +38,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMParser);
 
 static const HashTableValue JSDOMParserTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDOMParserConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMParserConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -109,7 +109,7 @@ bool JSDOMParserConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ide
 
 static const HashTableValue JSDOMParserPrototypeTableValues[2] =
 {
-    { "parseFromString", DontDelete|Function, (intptr_t)jsDOMParserPrototypeFunctionParseFromString, (intptr_t)2 },
+    { "parseFromString", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMParserPrototypeFunctionParseFromString), (intptr_t)2 },
     { 0, 0, 0, 0 }
 };
 
@@ -165,9 +165,9 @@ bool JSDOMParser::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
     return getStaticValueDescriptor<JSDOMParser, Base>(exec, &JSDOMParserTable, this, propertyName, descriptor);
 }
 
-JSValue jsDOMParserConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMParserConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMParser* domObject = static_cast<JSDOMParser*>(asObject(slot.slotBase()));
+    JSDOMParser* domObject = static_cast<JSDOMParser*>(asObject(slotBase));
     return JSDOMParser::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSDOMParser::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
index 8788ff2fbf..5b6ac1243f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
@@ -21,7 +21,6 @@
 #ifndef JSDOMParser_h
 #define JSDOMParser_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -68,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDOMParserPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,7 +79,7 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsDOMParserPrototypeFunctionParseFromString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDOMParserConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMParserConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
index e3a69b0d39..5958ca49fb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
@@ -42,17 +42,17 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMSelection);
 
 static const HashTableValue JSDOMSelectionTableValues[12] =
 {
-    { "anchorNode", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionAnchorNode, (intptr_t)0 },
-    { "anchorOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionAnchorOffset, (intptr_t)0 },
-    { "focusNode", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionFocusNode, (intptr_t)0 },
-    { "focusOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionFocusOffset, (intptr_t)0 },
-    { "isCollapsed", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionIsCollapsed, (intptr_t)0 },
-    { "rangeCount", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionRangeCount, (intptr_t)0 },
-    { "baseNode", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionBaseNode, (intptr_t)0 },
-    { "baseOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionBaseOffset, (intptr_t)0 },
-    { "extentNode", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionExtentNode, (intptr_t)0 },
-    { "extentOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionExtentOffset, (intptr_t)0 },
-    { "type", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionType, (intptr_t)0 },
+    { "anchorNode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionAnchorNode), (intptr_t)0 },
+    { "anchorOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionAnchorOffset), (intptr_t)0 },
+    { "focusNode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionFocusNode), (intptr_t)0 },
+    { "focusOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionFocusOffset), (intptr_t)0 },
+    { "isCollapsed", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionIsCollapsed), (intptr_t)0 },
+    { "rangeCount", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionRangeCount), (intptr_t)0 },
+    { "baseNode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionBaseNode), (intptr_t)0 },
+    { "baseOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionBaseOffset), (intptr_t)0 },
+    { "extentNode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionExtentNode), (intptr_t)0 },
+    { "extentOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionExtentOffset), (intptr_t)0 },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionType), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -67,21 +67,21 @@ static JSC_CONST_HASHTABLE HashTable JSDOMSelectionTable =
 
 static const HashTableValue JSDOMSelectionPrototypeTableValues[16] =
 {
-    { "collapse", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionCollapse, (intptr_t)2 },
-    { "collapseToEnd", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionCollapseToEnd, (intptr_t)0 },
-    { "collapseToStart", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionCollapseToStart, (intptr_t)0 },
-    { "deleteFromDocument", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionDeleteFromDocument, (intptr_t)0 },
-    { "containsNode", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionContainsNode, (intptr_t)2 },
-    { "selectAllChildren", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSelectAllChildren, (intptr_t)1 },
-    { "extend", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionExtend, (intptr_t)2 },
-    { "getRangeAt", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionGetRangeAt, (intptr_t)1 },
-    { "removeAllRanges", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionRemoveAllRanges, (intptr_t)0 },
-    { "addRange", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionAddRange, (intptr_t)1 },
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsDOMSelectionPrototypeFunctionToString, (intptr_t)0 },
-    { "modify", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionModify, (intptr_t)3 },
-    { "setBaseAndExtent", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSetBaseAndExtent, (intptr_t)4 },
-    { "setPosition", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSetPosition, (intptr_t)2 },
-    { "empty", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionEmpty, (intptr_t)0 },
+    { "collapse", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionCollapse), (intptr_t)2 },
+    { "collapseToEnd", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionCollapseToEnd), (intptr_t)0 },
+    { "collapseToStart", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionCollapseToStart), (intptr_t)0 },
+    { "deleteFromDocument", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionDeleteFromDocument), (intptr_t)0 },
+    { "containsNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionContainsNode), (intptr_t)2 },
+    { "selectAllChildren", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionSelectAllChildren), (intptr_t)1 },
+    { "extend", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionExtend), (intptr_t)2 },
+    { "getRangeAt", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionGetRangeAt), (intptr_t)1 },
+    { "removeAllRanges", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionRemoveAllRanges), (intptr_t)0 },
+    { "addRange", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionAddRange), (intptr_t)1 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionToString), (intptr_t)0 },
+    { "modify", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionModify), (intptr_t)3 },
+    { "setBaseAndExtent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionSetBaseAndExtent), (intptr_t)4 },
+    { "setPosition", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionSetPosition), (intptr_t)2 },
+    { "empty", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionEmpty), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -137,92 +137,103 @@ bool JSDOMSelection::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSDOMSelection, Base>(exec, &JSDOMSelectionTable, this, propertyName, descriptor);
 }
 
-JSValue jsDOMSelectionAnchorNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionAnchorNode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->anchorNode()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->anchorNode()));
+    return result;
 }
 
-JSValue jsDOMSelectionAnchorOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionAnchorOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return jsNumber(exec, imp->anchorOffset());
+    JSValue result = jsNumber(exec, imp->anchorOffset());
+    return result;
 }
 
-JSValue jsDOMSelectionFocusNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionFocusNode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->focusNode()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->focusNode()));
+    return result;
 }
 
-JSValue jsDOMSelectionFocusOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionFocusOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return jsNumber(exec, imp->focusOffset());
+    JSValue result = jsNumber(exec, imp->focusOffset());
+    return result;
 }
 
-JSValue jsDOMSelectionIsCollapsed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionIsCollapsed(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return jsBoolean(imp->isCollapsed());
+    JSValue result = jsBoolean(imp->isCollapsed());
+    return result;
 }
 
-JSValue jsDOMSelectionRangeCount(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionRangeCount(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return jsNumber(exec, imp->rangeCount());
+    JSValue result = jsNumber(exec, imp->rangeCount());
+    return result;
 }
 
-JSValue jsDOMSelectionBaseNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionBaseNode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->baseNode()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->baseNode()));
+    return result;
 }
 
-JSValue jsDOMSelectionBaseOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionBaseOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return jsNumber(exec, imp->baseOffset());
+    JSValue result = jsNumber(exec, imp->baseOffset());
+    return result;
 }
 
-JSValue jsDOMSelectionExtentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionExtentNode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->extentNode()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->extentNode()));
+    return result;
 }
 
-JSValue jsDOMSelectionExtentOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionExtentOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return jsNumber(exec, imp->extentOffset());
+    JSValue result = jsNumber(exec, imp->extentOffset());
+    return result;
 }
 
-JSValue jsDOMSelectionType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
index 863723fdc4..688c2a08da 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
@@ -21,7 +21,6 @@
 #ifndef JSDOMSelection_h
 #define JSDOMSelection_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     DOMSelection* impl() const { return m_impl.get(); }
@@ -67,7 +66,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDOMSelectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -93,17 +92,17 @@ JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSetPosition(JSC::ExecS
 JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionEmpty(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDOMSelectionAnchorNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionAnchorOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionFocusNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionFocusOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionIsCollapsed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionRangeCount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionBaseNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionBaseOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionExtentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionExtentOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionAnchorNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionAnchorOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionFocusNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionFocusOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionIsCollapsed(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionRangeCount(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionBaseNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionBaseOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionExtentNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionExtentOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
index d270e374be..42b847f7e1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
@@ -37,6 +37,7 @@
 #include "JSAttr.h"
 #include "JSBarInfo.h"
 #include "JSBeforeLoadEvent.h"
+#include "JSBlob.h"
 #include "JSCDATASection.h"
 #include "JSCSSCharsetRule.h"
 #include "JSCSSFontFaceRule.h"
@@ -53,16 +54,7 @@
 #include "JSCSSValueList.h"
 #include "JSCSSVariablesDeclaration.h"
 #include "JSCSSVariablesRule.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasByteArray.h"
-#include "JSCanvasFloatArray.h"
-#include "JSCanvasIntArray.h"
 #include "JSCanvasRenderingContext2D.h"
-#include "JSCanvasRenderingContext3D.h"
-#include "JSCanvasShortArray.h"
-#include "JSCanvasUnsignedByteArray.h"
-#include "JSCanvasUnsignedIntArray.h"
-#include "JSCanvasUnsignedShortArray.h"
 #include "JSCharacterData.h"
 #include "JSClientRect.h"
 #include "JSClientRectList.h"
@@ -73,13 +65,13 @@
 #include "JSDOMApplicationCache.h"
 #include "JSDOMBinding.h"
 #include "JSDOMCoreException.h"
+#include "JSDOMFormData.h"
 #include "JSDOMImplementation.h"
 #include "JSDOMParser.h"
 #include "JSDOMSelection.h"
 #include "JSDOMWindow.h"
 #include "JSDOMWindowCustom.h"
 #include "JSDOMWindowShell.h"
-#include "JSDatabase.h"
 #include "JSDocument.h"
 #include "JSDocumentFragment.h"
 #include "JSDocumentType.h"
@@ -158,6 +150,7 @@
 #include "JSHTMLTitleElement.h"
 #include "JSHTMLUListElement.h"
 #include "JSHTMLVideoElement.h"
+#include "JSImageData.h"
 #include "JSKeyboardEvent.h"
 #include "JSMedia.h"
 #include "JSMediaError.h"
@@ -185,20 +178,123 @@
 #include "JSRange.h"
 #include "JSRangeException.h"
 #include "JSRect.h"
+#include "JSSVGAElement.h"
 #include "JSSVGAngle.h"
+#include "JSSVGAnimatedAngle.h"
+#include "JSSVGAnimatedBoolean.h"
+#include "JSSVGAnimatedEnumeration.h"
+#include "JSSVGAnimatedInteger.h"
+#include "JSSVGAnimatedLength.h"
+#include "JSSVGAnimatedLengthList.h"
+#include "JSSVGAnimatedNumber.h"
+#include "JSSVGAnimatedNumberList.h"
+#include "JSSVGAnimatedPreserveAspectRatio.h"
+#include "JSSVGAnimatedRect.h"
+#include "JSSVGAnimatedString.h"
+#include "JSSVGAnimatedTransformList.h"
+#include "JSSVGCircleElement.h"
+#include "JSSVGClipPathElement.h"
 #include "JSSVGColor.h"
+#include "JSSVGComponentTransferFunctionElement.h"
+#include "JSSVGCursorElement.h"
+#include "JSSVGDefsElement.h"
+#include "JSSVGDescElement.h"
+#include "JSSVGDocument.h"
+#include "JSSVGElement.h"
+#include "JSSVGElementInstance.h"
+#include "JSSVGElementInstanceList.h"
+#include "JSSVGEllipseElement.h"
 #include "JSSVGException.h"
+#include "JSSVGFEBlendElement.h"
+#include "JSSVGFEColorMatrixElement.h"
+#include "JSSVGFEComponentTransferElement.h"
+#include "JSSVGFECompositeElement.h"
+#include "JSSVGFEDiffuseLightingElement.h"
+#include "JSSVGFEDisplacementMapElement.h"
+#include "JSSVGFEDistantLightElement.h"
+#include "JSSVGFEFloodElement.h"
+#include "JSSVGFEFuncAElement.h"
+#include "JSSVGFEFuncBElement.h"
+#include "JSSVGFEFuncGElement.h"
+#include "JSSVGFEFuncRElement.h"
+#include "JSSVGFEGaussianBlurElement.h"
+#include "JSSVGFEImageElement.h"
+#include "JSSVGFEMergeElement.h"
+#include "JSSVGFEMergeNodeElement.h"
+#include "JSSVGFEMorphologyElement.h"
+#include "JSSVGFEOffsetElement.h"
+#include "JSSVGFEPointLightElement.h"
+#include "JSSVGFESpecularLightingElement.h"
+#include "JSSVGFESpotLightElement.h"
+#include "JSSVGFETileElement.h"
+#include "JSSVGFETurbulenceElement.h"
+#include "JSSVGFilterElement.h"
+#include "JSSVGGElement.h"
 #include "JSSVGGradientElement.h"
+#include "JSSVGImageElement.h"
 #include "JSSVGLength.h"
+#include "JSSVGLengthList.h"
+#include "JSSVGLineElement.h"
+#include "JSSVGLinearGradientElement.h"
 #include "JSSVGMarkerElement.h"
+#include "JSSVGMaskElement.h"
+#include "JSSVGMatrix.h"
+#include "JSSVGMetadataElement.h"
+#include "JSSVGNumber.h"
+#include "JSSVGNumberList.h"
 #include "JSSVGPaint.h"
+#include "JSSVGPathElement.h"
 #include "JSSVGPathSeg.h"
+#include "JSSVGPathSegArcAbs.h"
+#include "JSSVGPathSegArcRel.h"
+#include "JSSVGPathSegClosePath.h"
+#include "JSSVGPathSegCurvetoCubicAbs.h"
+#include "JSSVGPathSegCurvetoCubicRel.h"
+#include "JSSVGPathSegCurvetoCubicSmoothAbs.h"
+#include "JSSVGPathSegCurvetoCubicSmoothRel.h"
+#include "JSSVGPathSegCurvetoQuadraticAbs.h"
+#include "JSSVGPathSegCurvetoQuadraticRel.h"
+#include "JSSVGPathSegCurvetoQuadraticSmoothAbs.h"
+#include "JSSVGPathSegCurvetoQuadraticSmoothRel.h"
+#include "JSSVGPathSegLinetoAbs.h"
+#include "JSSVGPathSegLinetoHorizontalAbs.h"
+#include "JSSVGPathSegLinetoHorizontalRel.h"
+#include "JSSVGPathSegLinetoRel.h"
+#include "JSSVGPathSegLinetoVerticalAbs.h"
+#include "JSSVGPathSegLinetoVerticalRel.h"
+#include "JSSVGPathSegList.h"
+#include "JSSVGPathSegMovetoAbs.h"
+#include "JSSVGPathSegMovetoRel.h"
+#include "JSSVGPatternElement.h"
+#include "JSSVGPoint.h"
+#include "JSSVGPointList.h"
+#include "JSSVGPolygonElement.h"
+#include "JSSVGPolylineElement.h"
 #include "JSSVGPreserveAspectRatio.h"
+#include "JSSVGRadialGradientElement.h"
+#include "JSSVGRect.h"
+#include "JSSVGRectElement.h"
 #include "JSSVGRenderingIntent.h"
+#include "JSSVGSVGElement.h"
+#include "JSSVGScriptElement.h"
+#include "JSSVGStopElement.h"
+#include "JSSVGStringList.h"
+#include "JSSVGStyleElement.h"
+#include "JSSVGSwitchElement.h"
+#include "JSSVGSymbolElement.h"
+#include "JSSVGTRefElement.h"
+#include "JSSVGTSpanElement.h"
 #include "JSSVGTextContentElement.h"
+#include "JSSVGTextElement.h"
 #include "JSSVGTextPathElement.h"
+#include "JSSVGTextPositioningElement.h"
+#include "JSSVGTitleElement.h"
 #include "JSSVGTransform.h"
+#include "JSSVGTransformList.h"
 #include "JSSVGUnitTypes.h"
+#include "JSSVGUseElement.h"
+#include "JSSVGViewElement.h"
+#include "JSSVGZoomEvent.h"
 #include "JSScreen.h"
 #include "JSSharedWorker.h"
 #include "JSStorage.h"
@@ -208,7 +304,17 @@
 #include "JSText.h"
 #include "JSTextEvent.h"
 #include "JSTextMetrics.h"
+#include "JSTouchEvent.h"
 #include "JSUIEvent.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLByteArray.h"
+#include "JSWebGLFloatArray.h"
+#include "JSWebGLIntArray.h"
+#include "JSWebGLRenderingContext.h"
+#include "JSWebGLShortArray.h"
+#include "JSWebGLUnsignedByteArray.h"
+#include "JSWebGLUnsignedIntArray.h"
+#include "JSWebGLUnsignedShortArray.h"
 #include "JSWebKitAnimationEvent.h"
 #include "JSWebKitCSSKeyframeRule.h"
 #include "JSWebKitCSSKeyframesRule.h"
@@ -216,6 +322,7 @@
 #include "JSWebKitCSSTransformValue.h"
 #include "JSWebKitPoint.h"
 #include "JSWebKitTransitionEvent.h"
+#include "JSWebSocket.h"
 #include "JSWheelEvent.h"
 #include "JSWorker.h"
 #include "JSXMLHttpRequest.h"
@@ -246,389 +353,502 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindow);
 
 /* Hash table */
 
-static const HashTableValue JSDOMWindowTableValues[296] =
-{
-    { "screen", DontDelete|ReadOnly, (intptr_t)jsDOMWindowScreen, (intptr_t)0 },
-    { "history", DontDelete|ReadOnly, (intptr_t)jsDOMWindowHistory, (intptr_t)0 },
-    { "locationbar", DontDelete, (intptr_t)jsDOMWindowLocationbar, (intptr_t)setJSDOMWindowLocationbar },
-    { "menubar", DontDelete, (intptr_t)jsDOMWindowMenubar, (intptr_t)setJSDOMWindowMenubar },
-    { "personalbar", DontDelete, (intptr_t)jsDOMWindowPersonalbar, (intptr_t)setJSDOMWindowPersonalbar },
-    { "scrollbars", DontDelete, (intptr_t)jsDOMWindowScrollbars, (intptr_t)setJSDOMWindowScrollbars },
-    { "statusbar", DontDelete, (intptr_t)jsDOMWindowStatusbar, (intptr_t)setJSDOMWindowStatusbar },
-    { "toolbar", DontDelete, (intptr_t)jsDOMWindowToolbar, (intptr_t)setJSDOMWindowToolbar },
-    { "navigator", DontDelete, (intptr_t)jsDOMWindowNavigator, (intptr_t)setJSDOMWindowNavigator },
-    { "clientInformation", DontDelete, (intptr_t)jsDOMWindowClientInformation, (intptr_t)setJSDOMWindowClientInformation },
-    { "location", DontDelete, (intptr_t)jsDOMWindowLocation, (intptr_t)setJSDOMWindowLocation },
-    { "event", DontDelete, (intptr_t)jsDOMWindowEvent, (intptr_t)setJSDOMWindowEvent },
-    { "crypto", DontDelete|ReadOnly, (intptr_t)jsDOMWindowCrypto, (intptr_t)0 },
-    { "frameElement", DontDelete|ReadOnly, (intptr_t)jsDOMWindowFrameElement, (intptr_t)0 },
-    { "offscreenBuffering", DontDelete, (intptr_t)jsDOMWindowOffscreenBuffering, (intptr_t)setJSDOMWindowOffscreenBuffering },
-    { "outerHeight", DontDelete, (intptr_t)jsDOMWindowOuterHeight, (intptr_t)setJSDOMWindowOuterHeight },
-    { "outerWidth", DontDelete, (intptr_t)jsDOMWindowOuterWidth, (intptr_t)setJSDOMWindowOuterWidth },
-    { "innerHeight", DontDelete, (intptr_t)jsDOMWindowInnerHeight, (intptr_t)setJSDOMWindowInnerHeight },
-    { "innerWidth", DontDelete, (intptr_t)jsDOMWindowInnerWidth, (intptr_t)setJSDOMWindowInnerWidth },
-    { "screenX", DontDelete, (intptr_t)jsDOMWindowScreenX, (intptr_t)setJSDOMWindowScreenX },
-    { "screenY", DontDelete, (intptr_t)jsDOMWindowScreenY, (intptr_t)setJSDOMWindowScreenY },
-    { "screenLeft", DontDelete, (intptr_t)jsDOMWindowScreenLeft, (intptr_t)setJSDOMWindowScreenLeft },
-    { "screenTop", DontDelete, (intptr_t)jsDOMWindowScreenTop, (intptr_t)setJSDOMWindowScreenTop },
-    { "scrollX", DontDelete, (intptr_t)jsDOMWindowScrollX, (intptr_t)setJSDOMWindowScrollX },
-    { "scrollY", DontDelete, (intptr_t)jsDOMWindowScrollY, (intptr_t)setJSDOMWindowScrollY },
-    { "pageXOffset", DontDelete|ReadOnly, (intptr_t)jsDOMWindowPageXOffset, (intptr_t)0 },
-    { "pageYOffset", DontDelete|ReadOnly, (intptr_t)jsDOMWindowPageYOffset, (intptr_t)0 },
-    { "closed", DontDelete|ReadOnly, (intptr_t)jsDOMWindowClosed, (intptr_t)0 },
-    { "length", DontDelete, (intptr_t)jsDOMWindowLength, (intptr_t)setJSDOMWindowLength },
-    { "name", DontDelete, (intptr_t)jsDOMWindowName, (intptr_t)setJSDOMWindowName },
-    { "status", DontDelete, (intptr_t)jsDOMWindowStatus, (intptr_t)setJSDOMWindowStatus },
-    { "defaultStatus", DontDelete, (intptr_t)jsDOMWindowDefaultStatus, (intptr_t)setJSDOMWindowDefaultStatus },
-    { "defaultstatus", DontDelete, (intptr_t)jsDOMWindowDefaultstatus, (intptr_t)setJSDOMWindowDefaultstatus },
-    { "self", DontDelete, (intptr_t)jsDOMWindowSelf, (intptr_t)setJSDOMWindowSelf },
-    { "window", DontDelete|ReadOnly, (intptr_t)jsDOMWindowWindow, (intptr_t)0 },
-    { "frames", DontDelete, (intptr_t)jsDOMWindowFrames, (intptr_t)setJSDOMWindowFrames },
-    { "opener", DontDelete, (intptr_t)jsDOMWindowOpener, (intptr_t)setJSDOMWindowOpener },
-    { "parent", DontDelete, (intptr_t)jsDOMWindowParent, (intptr_t)setJSDOMWindowParent },
-    { "top", DontDelete, (intptr_t)jsDOMWindowTop, (intptr_t)setJSDOMWindowTop },
-    { "document", DontDelete|ReadOnly, (intptr_t)jsDOMWindowDocument, (intptr_t)0 },
-    { "media", DontDelete|ReadOnly, (intptr_t)jsDOMWindowMedia, (intptr_t)0 },
-    { "devicePixelRatio", DontDelete, (intptr_t)jsDOMWindowDevicePixelRatio, (intptr_t)setJSDOMWindowDevicePixelRatio },
-    { "applicationCache", DontDelete|ReadOnly, (intptr_t)jsDOMWindowApplicationCache, (intptr_t)0 },
-    { "sessionStorage", DontDelete|ReadOnly, (intptr_t)jsDOMWindowSessionStorage, (intptr_t)0 },
-    { "localStorage", DontDelete|ReadOnly, (intptr_t)jsDOMWindowLocalStorage, (intptr_t)0 },
-    { "console", DontDelete, (intptr_t)jsDOMWindowConsole, (intptr_t)setJSDOMWindowConsole },
-    { "onabort", DontDelete, (intptr_t)jsDOMWindowOnabort, (intptr_t)setJSDOMWindowOnabort },
-    { "onbeforeunload", DontDelete, (intptr_t)jsDOMWindowOnbeforeunload, (intptr_t)setJSDOMWindowOnbeforeunload },
-    { "onblur", DontDelete, (intptr_t)jsDOMWindowOnblur, (intptr_t)setJSDOMWindowOnblur },
-    { "oncanplay", DontDelete, (intptr_t)jsDOMWindowOncanplay, (intptr_t)setJSDOMWindowOncanplay },
-    { "oncanplaythrough", DontDelete, (intptr_t)jsDOMWindowOncanplaythrough, (intptr_t)setJSDOMWindowOncanplaythrough },
-    { "onchange", DontDelete, (intptr_t)jsDOMWindowOnchange, (intptr_t)setJSDOMWindowOnchange },
-    { "onclick", DontDelete, (intptr_t)jsDOMWindowOnclick, (intptr_t)setJSDOMWindowOnclick },
-    { "oncontextmenu", DontDelete, (intptr_t)jsDOMWindowOncontextmenu, (intptr_t)setJSDOMWindowOncontextmenu },
-    { "ondblclick", DontDelete, (intptr_t)jsDOMWindowOndblclick, (intptr_t)setJSDOMWindowOndblclick },
-    { "ondrag", DontDelete, (intptr_t)jsDOMWindowOndrag, (intptr_t)setJSDOMWindowOndrag },
-    { "ondragend", DontDelete, (intptr_t)jsDOMWindowOndragend, (intptr_t)setJSDOMWindowOndragend },
-    { "ondragenter", DontDelete, (intptr_t)jsDOMWindowOndragenter, (intptr_t)setJSDOMWindowOndragenter },
-    { "ondragleave", DontDelete, (intptr_t)jsDOMWindowOndragleave, (intptr_t)setJSDOMWindowOndragleave },
-    { "ondragover", DontDelete, (intptr_t)jsDOMWindowOndragover, (intptr_t)setJSDOMWindowOndragover },
-    { "ondragstart", DontDelete, (intptr_t)jsDOMWindowOndragstart, (intptr_t)setJSDOMWindowOndragstart },
-    { "ondrop", DontDelete, (intptr_t)jsDOMWindowOndrop, (intptr_t)setJSDOMWindowOndrop },
-    { "ondurationchange", DontDelete, (intptr_t)jsDOMWindowOndurationchange, (intptr_t)setJSDOMWindowOndurationchange },
-    { "onemptied", DontDelete, (intptr_t)jsDOMWindowOnemptied, (intptr_t)setJSDOMWindowOnemptied },
-    { "onended", DontDelete, (intptr_t)jsDOMWindowOnended, (intptr_t)setJSDOMWindowOnended },
-    { "onerror", DontDelete, (intptr_t)jsDOMWindowOnerror, (intptr_t)setJSDOMWindowOnerror },
-    { "onfocus", DontDelete, (intptr_t)jsDOMWindowOnfocus, (intptr_t)setJSDOMWindowOnfocus },
-    { "onhashchange", DontDelete, (intptr_t)jsDOMWindowOnhashchange, (intptr_t)setJSDOMWindowOnhashchange },
-    { "oninput", DontDelete, (intptr_t)jsDOMWindowOninput, (intptr_t)setJSDOMWindowOninput },
-    { "oninvalid", DontDelete, (intptr_t)jsDOMWindowOninvalid, (intptr_t)setJSDOMWindowOninvalid },
-    { "onkeydown", DontDelete, (intptr_t)jsDOMWindowOnkeydown, (intptr_t)setJSDOMWindowOnkeydown },
-    { "onkeypress", DontDelete, (intptr_t)jsDOMWindowOnkeypress, (intptr_t)setJSDOMWindowOnkeypress },
-    { "onkeyup", DontDelete, (intptr_t)jsDOMWindowOnkeyup, (intptr_t)setJSDOMWindowOnkeyup },
-    { "onload", DontDelete, (intptr_t)jsDOMWindowOnload, (intptr_t)setJSDOMWindowOnload },
-    { "onloadeddata", DontDelete, (intptr_t)jsDOMWindowOnloadeddata, (intptr_t)setJSDOMWindowOnloadeddata },
-    { "onloadedmetadata", DontDelete, (intptr_t)jsDOMWindowOnloadedmetadata, (intptr_t)setJSDOMWindowOnloadedmetadata },
-    { "onloadstart", DontDelete, (intptr_t)jsDOMWindowOnloadstart, (intptr_t)setJSDOMWindowOnloadstart },
-    { "onmessage", DontDelete, (intptr_t)jsDOMWindowOnmessage, (intptr_t)setJSDOMWindowOnmessage },
-    { "onmousedown", DontDelete, (intptr_t)jsDOMWindowOnmousedown, (intptr_t)setJSDOMWindowOnmousedown },
-    { "onmousemove", DontDelete, (intptr_t)jsDOMWindowOnmousemove, (intptr_t)setJSDOMWindowOnmousemove },
-    { "onmouseout", DontDelete, (intptr_t)jsDOMWindowOnmouseout, (intptr_t)setJSDOMWindowOnmouseout },
-    { "onmouseover", DontDelete, (intptr_t)jsDOMWindowOnmouseover, (intptr_t)setJSDOMWindowOnmouseover },
-    { "onmouseup", DontDelete, (intptr_t)jsDOMWindowOnmouseup, (intptr_t)setJSDOMWindowOnmouseup },
-    { "onmousewheel", DontDelete, (intptr_t)jsDOMWindowOnmousewheel, (intptr_t)setJSDOMWindowOnmousewheel },
-    { "onoffline", DontDelete, (intptr_t)jsDOMWindowOnoffline, (intptr_t)setJSDOMWindowOnoffline },
-    { "ononline", DontDelete, (intptr_t)jsDOMWindowOnonline, (intptr_t)setJSDOMWindowOnonline },
-    { "onpagehide", DontDelete, (intptr_t)jsDOMWindowOnpagehide, (intptr_t)setJSDOMWindowOnpagehide },
-    { "onpageshow", DontDelete, (intptr_t)jsDOMWindowOnpageshow, (intptr_t)setJSDOMWindowOnpageshow },
-    { "onpause", DontDelete, (intptr_t)jsDOMWindowOnpause, (intptr_t)setJSDOMWindowOnpause },
-    { "onplay", DontDelete, (intptr_t)jsDOMWindowOnplay, (intptr_t)setJSDOMWindowOnplay },
-    { "onplaying", DontDelete, (intptr_t)jsDOMWindowOnplaying, (intptr_t)setJSDOMWindowOnplaying },
-    { "onprogress", DontDelete, (intptr_t)jsDOMWindowOnprogress, (intptr_t)setJSDOMWindowOnprogress },
-    { "onratechange", DontDelete, (intptr_t)jsDOMWindowOnratechange, (intptr_t)setJSDOMWindowOnratechange },
-    { "onresize", DontDelete, (intptr_t)jsDOMWindowOnresize, (intptr_t)setJSDOMWindowOnresize },
-    { "onscroll", DontDelete, (intptr_t)jsDOMWindowOnscroll, (intptr_t)setJSDOMWindowOnscroll },
-    { "onseeked", DontDelete, (intptr_t)jsDOMWindowOnseeked, (intptr_t)setJSDOMWindowOnseeked },
-    { "onseeking", DontDelete, (intptr_t)jsDOMWindowOnseeking, (intptr_t)setJSDOMWindowOnseeking },
-    { "onselect", DontDelete, (intptr_t)jsDOMWindowOnselect, (intptr_t)setJSDOMWindowOnselect },
-    { "onstalled", DontDelete, (intptr_t)jsDOMWindowOnstalled, (intptr_t)setJSDOMWindowOnstalled },
-    { "onstorage", DontDelete, (intptr_t)jsDOMWindowOnstorage, (intptr_t)setJSDOMWindowOnstorage },
-    { "onsubmit", DontDelete, (intptr_t)jsDOMWindowOnsubmit, (intptr_t)setJSDOMWindowOnsubmit },
-    { "onsuspend", DontDelete, (intptr_t)jsDOMWindowOnsuspend, (intptr_t)setJSDOMWindowOnsuspend },
-    { "ontimeupdate", DontDelete, (intptr_t)jsDOMWindowOntimeupdate, (intptr_t)setJSDOMWindowOntimeupdate },
-    { "onunload", DontDelete, (intptr_t)jsDOMWindowOnunload, (intptr_t)setJSDOMWindowOnunload },
-    { "onvolumechange", DontDelete, (intptr_t)jsDOMWindowOnvolumechange, (intptr_t)setJSDOMWindowOnvolumechange },
-    { "onwaiting", DontDelete, (intptr_t)jsDOMWindowOnwaiting, (intptr_t)setJSDOMWindowOnwaiting },
-    { "onreset", DontDelete, (intptr_t)jsDOMWindowOnreset, (intptr_t)setJSDOMWindowOnreset },
-    { "onsearch", DontDelete, (intptr_t)jsDOMWindowOnsearch, (intptr_t)setJSDOMWindowOnsearch },
-    { "onwebkitanimationend", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationend, (intptr_t)setJSDOMWindowOnwebkitanimationend },
-    { "onwebkitanimationiteration", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationiteration, (intptr_t)setJSDOMWindowOnwebkitanimationiteration },
-    { "onwebkitanimationstart", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationstart, (intptr_t)setJSDOMWindowOnwebkitanimationstart },
-    { "onwebkittransitionend", DontDelete, (intptr_t)jsDOMWindowOnwebkittransitionend, (intptr_t)setJSDOMWindowOnwebkittransitionend },
-    { "StyleSheet", DontDelete, (intptr_t)jsDOMWindowStyleSheetConstructor, (intptr_t)setJSDOMWindowStyleSheetConstructor },
-    { "CSSStyleSheet", DontDelete, (intptr_t)jsDOMWindowCSSStyleSheetConstructor, (intptr_t)setJSDOMWindowCSSStyleSheetConstructor },
-    { "CSSValue", DontDelete, (intptr_t)jsDOMWindowCSSValueConstructor, (intptr_t)setJSDOMWindowCSSValueConstructor },
-    { "CSSPrimitiveValue", DontDelete, (intptr_t)jsDOMWindowCSSPrimitiveValueConstructor, (intptr_t)setJSDOMWindowCSSPrimitiveValueConstructor },
-    { "CSSValueList", DontDelete, (intptr_t)jsDOMWindowCSSValueListConstructor, (intptr_t)setJSDOMWindowCSSValueListConstructor },
-    { "WebKitCSSTransformValue", DontDelete, (intptr_t)jsDOMWindowWebKitCSSTransformValueConstructor, (intptr_t)setJSDOMWindowWebKitCSSTransformValueConstructor },
-    { "CSSRule", DontDelete, (intptr_t)jsDOMWindowCSSRuleConstructor, (intptr_t)setJSDOMWindowCSSRuleConstructor },
-    { "CSSCharsetRule", DontDelete, (intptr_t)jsDOMWindowCSSCharsetRuleConstructor, (intptr_t)setJSDOMWindowCSSCharsetRuleConstructor },
-    { "CSSFontFaceRule", DontDelete, (intptr_t)jsDOMWindowCSSFontFaceRuleConstructor, (intptr_t)setJSDOMWindowCSSFontFaceRuleConstructor },
-    { "CSSImportRule", DontDelete, (intptr_t)jsDOMWindowCSSImportRuleConstructor, (intptr_t)setJSDOMWindowCSSImportRuleConstructor },
-    { "CSSMediaRule", DontDelete, (intptr_t)jsDOMWindowCSSMediaRuleConstructor, (intptr_t)setJSDOMWindowCSSMediaRuleConstructor },
-    { "CSSPageRule", DontDelete, (intptr_t)jsDOMWindowCSSPageRuleConstructor, (intptr_t)setJSDOMWindowCSSPageRuleConstructor },
-    { "CSSStyleRule", DontDelete, (intptr_t)jsDOMWindowCSSStyleRuleConstructor, (intptr_t)setJSDOMWindowCSSStyleRuleConstructor },
-    { "CSSVariablesRule", DontDelete, (intptr_t)jsDOMWindowCSSVariablesRuleConstructor, (intptr_t)setJSDOMWindowCSSVariablesRuleConstructor },
-    { "CSSVariablesDeclaration", DontDelete, (intptr_t)jsDOMWindowCSSVariablesDeclarationConstructor, (intptr_t)setJSDOMWindowCSSVariablesDeclarationConstructor },
-    { "CSSStyleDeclaration", DontDelete, (intptr_t)jsDOMWindowCSSStyleDeclarationConstructor, (intptr_t)setJSDOMWindowCSSStyleDeclarationConstructor },
-    { "MediaList", DontDelete, (intptr_t)jsDOMWindowMediaListConstructor, (intptr_t)setJSDOMWindowMediaListConstructor },
-    { "Counter", DontDelete, (intptr_t)jsDOMWindowCounterConstructor, (intptr_t)setJSDOMWindowCounterConstructor },
-    { "CSSRuleList", DontDelete, (intptr_t)jsDOMWindowCSSRuleListConstructor, (intptr_t)setJSDOMWindowCSSRuleListConstructor },
-    { "Rect", DontDelete, (intptr_t)jsDOMWindowRectConstructor, (intptr_t)setJSDOMWindowRectConstructor },
-    { "RGBColor", DontDelete, (intptr_t)jsDOMWindowRGBColorConstructor, (intptr_t)setJSDOMWindowRGBColorConstructor },
-    { "StyleSheetList", DontDelete, (intptr_t)jsDOMWindowStyleSheetListConstructor, (intptr_t)setJSDOMWindowStyleSheetListConstructor },
-    { "DOMException", DontDelete, (intptr_t)jsDOMWindowDOMExceptionConstructor, (intptr_t)setJSDOMWindowDOMExceptionConstructor },
-    { "DOMImplementation", DontDelete, (intptr_t)jsDOMWindowDOMImplementationConstructor, (intptr_t)setJSDOMWindowDOMImplementationConstructor },
-    { "DocumentFragment", DontDelete, (intptr_t)jsDOMWindowDocumentFragmentConstructor, (intptr_t)setJSDOMWindowDocumentFragmentConstructor },
-    { "Document", DontDelete, (intptr_t)jsDOMWindowDocumentConstructor, (intptr_t)setJSDOMWindowDocumentConstructor },
-    { "Node", DontDelete, (intptr_t)jsDOMWindowNodeConstructor, (intptr_t)setJSDOMWindowNodeConstructor },
-    { "NodeList", DontDelete, (intptr_t)jsDOMWindowNodeListConstructor, (intptr_t)setJSDOMWindowNodeListConstructor },
-    { "NamedNodeMap", DontDelete, (intptr_t)jsDOMWindowNamedNodeMapConstructor, (intptr_t)setJSDOMWindowNamedNodeMapConstructor },
-    { "CharacterData", DontDelete, (intptr_t)jsDOMWindowCharacterDataConstructor, (intptr_t)setJSDOMWindowCharacterDataConstructor },
-    { "Attr", DontDelete, (intptr_t)jsDOMWindowAttrConstructor, (intptr_t)setJSDOMWindowAttrConstructor },
-    { "Element", DontDelete, (intptr_t)jsDOMWindowElementConstructor, (intptr_t)setJSDOMWindowElementConstructor },
-    { "Text", DontDelete, (intptr_t)jsDOMWindowTextConstructor, (intptr_t)setJSDOMWindowTextConstructor },
-    { "Comment", DontDelete, (intptr_t)jsDOMWindowCommentConstructor, (intptr_t)setJSDOMWindowCommentConstructor },
-    { "CDATASection", DontDelete, (intptr_t)jsDOMWindowCDATASectionConstructor, (intptr_t)setJSDOMWindowCDATASectionConstructor },
-    { "DocumentType", DontDelete, (intptr_t)jsDOMWindowDocumentTypeConstructor, (intptr_t)setJSDOMWindowDocumentTypeConstructor },
-    { "Notation", DontDelete, (intptr_t)jsDOMWindowNotationConstructor, (intptr_t)setJSDOMWindowNotationConstructor },
-    { "Entity", DontDelete, (intptr_t)jsDOMWindowEntityConstructor, (intptr_t)setJSDOMWindowEntityConstructor },
-    { "EntityReference", DontDelete, (intptr_t)jsDOMWindowEntityReferenceConstructor, (intptr_t)setJSDOMWindowEntityReferenceConstructor },
-    { "ProcessingInstruction", DontDelete, (intptr_t)jsDOMWindowProcessingInstructionConstructor, (intptr_t)setJSDOMWindowProcessingInstructionConstructor },
-    { "HTMLDocument", DontDelete, (intptr_t)jsDOMWindowHTMLDocumentConstructor, (intptr_t)setJSDOMWindowHTMLDocumentConstructor },
-    { "HTMLElement", DontDelete, (intptr_t)jsDOMWindowHTMLElementConstructor, (intptr_t)setJSDOMWindowHTMLElementConstructor },
-    { "HTMLAnchorElement", DontDelete, (intptr_t)jsDOMWindowHTMLAnchorElementConstructor, (intptr_t)setJSDOMWindowHTMLAnchorElementConstructor },
-    { "HTMLAppletElement", DontDelete, (intptr_t)jsDOMWindowHTMLAppletElementConstructor, (intptr_t)setJSDOMWindowHTMLAppletElementConstructor },
-    { "HTMLAreaElement", DontDelete, (intptr_t)jsDOMWindowHTMLAreaElementConstructor, (intptr_t)setJSDOMWindowHTMLAreaElementConstructor },
-    { "HTMLBRElement", DontDelete, (intptr_t)jsDOMWindowHTMLBRElementConstructor, (intptr_t)setJSDOMWindowHTMLBRElementConstructor },
-    { "HTMLBaseElement", DontDelete, (intptr_t)jsDOMWindowHTMLBaseElementConstructor, (intptr_t)setJSDOMWindowHTMLBaseElementConstructor },
-    { "HTMLBaseFontElement", DontDelete, (intptr_t)jsDOMWindowHTMLBaseFontElementConstructor, (intptr_t)setJSDOMWindowHTMLBaseFontElementConstructor },
-    { "HTMLBlockquoteElement", DontDelete, (intptr_t)jsDOMWindowHTMLBlockquoteElementConstructor, (intptr_t)setJSDOMWindowHTMLBlockquoteElementConstructor },
-    { "HTMLBodyElement", DontDelete, (intptr_t)jsDOMWindowHTMLBodyElementConstructor, (intptr_t)setJSDOMWindowHTMLBodyElementConstructor },
-    { "HTMLButtonElement", DontDelete, (intptr_t)jsDOMWindowHTMLButtonElementConstructor, (intptr_t)setJSDOMWindowHTMLButtonElementConstructor },
-    { "HTMLCanvasElement", DontDelete, (intptr_t)jsDOMWindowHTMLCanvasElementConstructor, (intptr_t)setJSDOMWindowHTMLCanvasElementConstructor },
+static const HashTableValue JSDOMWindowTableValues[409] =
+{
+    { "screen", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScreen), (intptr_t)0 },
+    { "history", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHistory), (intptr_t)0 },
+    { "locationbar", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowLocationbar), (intptr_t)setJSDOMWindowLocationbar },
+    { "menubar", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMenubar), (intptr_t)setJSDOMWindowMenubar },
+    { "personalbar", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowPersonalbar), (intptr_t)setJSDOMWindowPersonalbar },
+    { "scrollbars", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScrollbars), (intptr_t)setJSDOMWindowScrollbars },
+    { "statusbar", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowStatusbar), (intptr_t)setJSDOMWindowStatusbar },
+    { "toolbar", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowToolbar), (intptr_t)setJSDOMWindowToolbar },
+    { "navigator", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowNavigator), (intptr_t)setJSDOMWindowNavigator },
+    { "clientInformation", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowClientInformation), (intptr_t)setJSDOMWindowClientInformation },
+    { "location", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowLocation), (intptr_t)setJSDOMWindowLocation },
+    { "event", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowEvent), (intptr_t)setJSDOMWindowEvent },
+    { "crypto", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCrypto), (intptr_t)0 },
+    { "frameElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowFrameElement), (intptr_t)0 },
+    { "offscreenBuffering", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOffscreenBuffering), (intptr_t)setJSDOMWindowOffscreenBuffering },
+    { "outerHeight", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOuterHeight), (intptr_t)setJSDOMWindowOuterHeight },
+    { "outerWidth", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOuterWidth), (intptr_t)setJSDOMWindowOuterWidth },
+    { "innerHeight", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowInnerHeight), (intptr_t)setJSDOMWindowInnerHeight },
+    { "innerWidth", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowInnerWidth), (intptr_t)setJSDOMWindowInnerWidth },
+    { "screenX", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScreenX), (intptr_t)setJSDOMWindowScreenX },
+    { "screenY", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScreenY), (intptr_t)setJSDOMWindowScreenY },
+    { "screenLeft", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScreenLeft), (intptr_t)setJSDOMWindowScreenLeft },
+    { "screenTop", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScreenTop), (intptr_t)setJSDOMWindowScreenTop },
+    { "scrollX", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScrollX), (intptr_t)setJSDOMWindowScrollX },
+    { "scrollY", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScrollY), (intptr_t)setJSDOMWindowScrollY },
+    { "pageXOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowPageXOffset), (intptr_t)0 },
+    { "pageYOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowPageYOffset), (intptr_t)0 },
+    { "closed", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowClosed), (intptr_t)0 },
+    { "length", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowLength), (intptr_t)setJSDOMWindowLength },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowName), (intptr_t)setJSDOMWindowName },
+    { "status", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowStatus), (intptr_t)setJSDOMWindowStatus },
+    { "defaultStatus", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDefaultStatus), (intptr_t)setJSDOMWindowDefaultStatus },
+    { "defaultstatus", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDefaultstatus), (intptr_t)setJSDOMWindowDefaultstatus },
+    { "self", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSelf), (intptr_t)setJSDOMWindowSelf },
+    { "window", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWindow), (intptr_t)0 },
+    { "frames", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowFrames), (intptr_t)setJSDOMWindowFrames },
+    { "opener", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOpener), (intptr_t)setJSDOMWindowOpener },
+    { "parent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowParent), (intptr_t)setJSDOMWindowParent },
+    { "top", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowTop), (intptr_t)setJSDOMWindowTop },
+    { "document", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDocument), (intptr_t)0 },
+    { "media", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMedia), (intptr_t)0 },
+    { "devicePixelRatio", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDevicePixelRatio), (intptr_t)setJSDOMWindowDevicePixelRatio },
+    { "applicationCache", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowApplicationCache), (intptr_t)0 },
+    { "sessionStorage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSessionStorage), (intptr_t)0 },
+    { "localStorage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowLocalStorage), (intptr_t)0 },
+    { "console", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowConsole), (intptr_t)setJSDOMWindowConsole },
+    { "onabort", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnabort), (intptr_t)setJSDOMWindowOnabort },
+    { "onbeforeunload", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnbeforeunload), (intptr_t)setJSDOMWindowOnbeforeunload },
+    { "onblur", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnblur), (intptr_t)setJSDOMWindowOnblur },
+    { "oncanplay", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOncanplay), (intptr_t)setJSDOMWindowOncanplay },
+    { "oncanplaythrough", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOncanplaythrough), (intptr_t)setJSDOMWindowOncanplaythrough },
+    { "onchange", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnchange), (intptr_t)setJSDOMWindowOnchange },
+    { "onclick", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnclick), (intptr_t)setJSDOMWindowOnclick },
+    { "oncontextmenu", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOncontextmenu), (intptr_t)setJSDOMWindowOncontextmenu },
+    { "ondblclick", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndblclick), (intptr_t)setJSDOMWindowOndblclick },
+    { "ondrag", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndrag), (intptr_t)setJSDOMWindowOndrag },
+    { "ondragend", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndragend), (intptr_t)setJSDOMWindowOndragend },
+    { "ondragenter", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndragenter), (intptr_t)setJSDOMWindowOndragenter },
+    { "ondragleave", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndragleave), (intptr_t)setJSDOMWindowOndragleave },
+    { "ondragover", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndragover), (intptr_t)setJSDOMWindowOndragover },
+    { "ondragstart", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndragstart), (intptr_t)setJSDOMWindowOndragstart },
+    { "ondrop", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndrop), (intptr_t)setJSDOMWindowOndrop },
+    { "ondurationchange", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndurationchange), (intptr_t)setJSDOMWindowOndurationchange },
+    { "onemptied", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnemptied), (intptr_t)setJSDOMWindowOnemptied },
+    { "onended", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnended), (intptr_t)setJSDOMWindowOnended },
+    { "onerror", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnerror), (intptr_t)setJSDOMWindowOnerror },
+    { "onfocus", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnfocus), (intptr_t)setJSDOMWindowOnfocus },
+    { "onhashchange", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnhashchange), (intptr_t)setJSDOMWindowOnhashchange },
+    { "oninput", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOninput), (intptr_t)setJSDOMWindowOninput },
+    { "oninvalid", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOninvalid), (intptr_t)setJSDOMWindowOninvalid },
+    { "onkeydown", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnkeydown), (intptr_t)setJSDOMWindowOnkeydown },
+    { "onkeypress", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnkeypress), (intptr_t)setJSDOMWindowOnkeypress },
+    { "onkeyup", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnkeyup), (intptr_t)setJSDOMWindowOnkeyup },
+    { "onload", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnload), (intptr_t)setJSDOMWindowOnload },
+    { "onloadeddata", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnloadeddata), (intptr_t)setJSDOMWindowOnloadeddata },
+    { "onloadedmetadata", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnloadedmetadata), (intptr_t)setJSDOMWindowOnloadedmetadata },
+    { "onloadstart", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnloadstart), (intptr_t)setJSDOMWindowOnloadstart },
+    { "onmessage", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnmessage), (intptr_t)setJSDOMWindowOnmessage },
+    { "onmousedown", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnmousedown), (intptr_t)setJSDOMWindowOnmousedown },
+    { "onmousemove", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnmousemove), (intptr_t)setJSDOMWindowOnmousemove },
+    { "onmouseout", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnmouseout), (intptr_t)setJSDOMWindowOnmouseout },
+    { "onmouseover", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnmouseover), (intptr_t)setJSDOMWindowOnmouseover },
+    { "onmouseup", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnmouseup), (intptr_t)setJSDOMWindowOnmouseup },
+    { "onmousewheel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnmousewheel), (intptr_t)setJSDOMWindowOnmousewheel },
+    { "onoffline", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnoffline), (intptr_t)setJSDOMWindowOnoffline },
+    { "ononline", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnonline), (intptr_t)setJSDOMWindowOnonline },
+    { "onpagehide", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnpagehide), (intptr_t)setJSDOMWindowOnpagehide },
+    { "onpageshow", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnpageshow), (intptr_t)setJSDOMWindowOnpageshow },
+    { "onpause", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnpause), (intptr_t)setJSDOMWindowOnpause },
+    { "onplay", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnplay), (intptr_t)setJSDOMWindowOnplay },
+    { "onplaying", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnplaying), (intptr_t)setJSDOMWindowOnplaying },
+    { "onpopstate", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnpopstate), (intptr_t)setJSDOMWindowOnpopstate },
+    { "onprogress", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnprogress), (intptr_t)setJSDOMWindowOnprogress },
+    { "onratechange", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnratechange), (intptr_t)setJSDOMWindowOnratechange },
+    { "onresize", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnresize), (intptr_t)setJSDOMWindowOnresize },
+    { "onscroll", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnscroll), (intptr_t)setJSDOMWindowOnscroll },
+    { "onseeked", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnseeked), (intptr_t)setJSDOMWindowOnseeked },
+    { "onseeking", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnseeking), (intptr_t)setJSDOMWindowOnseeking },
+    { "onselect", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnselect), (intptr_t)setJSDOMWindowOnselect },
+    { "onstalled", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnstalled), (intptr_t)setJSDOMWindowOnstalled },
+    { "onstorage", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnstorage), (intptr_t)setJSDOMWindowOnstorage },
+    { "onsubmit", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnsubmit), (intptr_t)setJSDOMWindowOnsubmit },
+    { "onsuspend", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnsuspend), (intptr_t)setJSDOMWindowOnsuspend },
+    { "ontimeupdate", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOntimeupdate), (intptr_t)setJSDOMWindowOntimeupdate },
+    { "onunload", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnunload), (intptr_t)setJSDOMWindowOnunload },
+    { "onvolumechange", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnvolumechange), (intptr_t)setJSDOMWindowOnvolumechange },
+    { "onwaiting", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnwaiting), (intptr_t)setJSDOMWindowOnwaiting },
+    { "onreset", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnreset), (intptr_t)setJSDOMWindowOnreset },
+    { "onsearch", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnsearch), (intptr_t)setJSDOMWindowOnsearch },
+    { "onwebkitanimationend", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnwebkitanimationend), (intptr_t)setJSDOMWindowOnwebkitanimationend },
+    { "onwebkitanimationiteration", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnwebkitanimationiteration), (intptr_t)setJSDOMWindowOnwebkitanimationiteration },
+    { "onwebkitanimationstart", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnwebkitanimationstart), (intptr_t)setJSDOMWindowOnwebkitanimationstart },
+    { "onwebkittransitionend", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnwebkittransitionend), (intptr_t)setJSDOMWindowOnwebkittransitionend },
+    { "ontouchstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOntouchstart), (intptr_t)setJSDOMWindowOntouchstart },
+    { "ontouchmove", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOntouchmove), (intptr_t)setJSDOMWindowOntouchmove },
+    { "ontouchend", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOntouchend), (intptr_t)setJSDOMWindowOntouchend },
+    { "ontouchcancel", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOntouchcancel), (intptr_t)setJSDOMWindowOntouchcancel },
+    { "StyleSheet", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowStyleSheetConstructor), (intptr_t)setJSDOMWindowStyleSheetConstructor },
+    { "CSSStyleSheet", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSStyleSheetConstructor), (intptr_t)setJSDOMWindowCSSStyleSheetConstructor },
+    { "CSSValue", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSValueConstructor), (intptr_t)setJSDOMWindowCSSValueConstructor },
+    { "CSSPrimitiveValue", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSPrimitiveValueConstructor), (intptr_t)setJSDOMWindowCSSPrimitiveValueConstructor },
+    { "CSSValueList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSValueListConstructor), (intptr_t)setJSDOMWindowCSSValueListConstructor },
+    { "WebKitCSSTransformValue", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebKitCSSTransformValueConstructor), (intptr_t)setJSDOMWindowWebKitCSSTransformValueConstructor },
+    { "CSSRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSRuleConstructor), (intptr_t)setJSDOMWindowCSSRuleConstructor },
+    { "CSSCharsetRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSCharsetRuleConstructor), (intptr_t)setJSDOMWindowCSSCharsetRuleConstructor },
+    { "CSSFontFaceRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSFontFaceRuleConstructor), (intptr_t)setJSDOMWindowCSSFontFaceRuleConstructor },
+    { "CSSImportRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSImportRuleConstructor), (intptr_t)setJSDOMWindowCSSImportRuleConstructor },
+    { "CSSMediaRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSMediaRuleConstructor), (intptr_t)setJSDOMWindowCSSMediaRuleConstructor },
+    { "CSSPageRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSPageRuleConstructor), (intptr_t)setJSDOMWindowCSSPageRuleConstructor },
+    { "CSSStyleRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSStyleRuleConstructor), (intptr_t)setJSDOMWindowCSSStyleRuleConstructor },
+    { "CSSVariablesRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSVariablesRuleConstructor), (intptr_t)setJSDOMWindowCSSVariablesRuleConstructor },
+    { "CSSVariablesDeclaration", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSVariablesDeclarationConstructor), (intptr_t)setJSDOMWindowCSSVariablesDeclarationConstructor },
+    { "CSSStyleDeclaration", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSStyleDeclarationConstructor), (intptr_t)setJSDOMWindowCSSStyleDeclarationConstructor },
+    { "MediaList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMediaListConstructor), (intptr_t)setJSDOMWindowMediaListConstructor },
+    { "Counter", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCounterConstructor), (intptr_t)setJSDOMWindowCounterConstructor },
+    { "CSSRuleList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSRuleListConstructor), (intptr_t)setJSDOMWindowCSSRuleListConstructor },
+    { "Rect", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowRectConstructor), (intptr_t)setJSDOMWindowRectConstructor },
+    { "RGBColor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowRGBColorConstructor), (intptr_t)setJSDOMWindowRGBColorConstructor },
+    { "StyleSheetList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowStyleSheetListConstructor), (intptr_t)setJSDOMWindowStyleSheetListConstructor },
+    { "DOMException", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDOMExceptionConstructor), (intptr_t)setJSDOMWindowDOMExceptionConstructor },
+    { "DOMImplementation", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDOMImplementationConstructor), (intptr_t)setJSDOMWindowDOMImplementationConstructor },
+    { "DocumentFragment", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDocumentFragmentConstructor), (intptr_t)setJSDOMWindowDocumentFragmentConstructor },
+    { "Document", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDocumentConstructor), (intptr_t)setJSDOMWindowDocumentConstructor },
+    { "Node", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowNodeConstructor), (intptr_t)setJSDOMWindowNodeConstructor },
+    { "NodeList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowNodeListConstructor), (intptr_t)setJSDOMWindowNodeListConstructor },
+    { "NamedNodeMap", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowNamedNodeMapConstructor), (intptr_t)setJSDOMWindowNamedNodeMapConstructor },
+    { "CharacterData", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCharacterDataConstructor), (intptr_t)setJSDOMWindowCharacterDataConstructor },
+    { "Attr", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowAttrConstructor), (intptr_t)setJSDOMWindowAttrConstructor },
+    { "Element", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowElementConstructor), (intptr_t)setJSDOMWindowElementConstructor },
+    { "Text", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowTextConstructor), (intptr_t)setJSDOMWindowTextConstructor },
+    { "Comment", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCommentConstructor), (intptr_t)setJSDOMWindowCommentConstructor },
+    { "CDATASection", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCDATASectionConstructor), (intptr_t)setJSDOMWindowCDATASectionConstructor },
+    { "DocumentType", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDocumentTypeConstructor), (intptr_t)setJSDOMWindowDocumentTypeConstructor },
+    { "Notation", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowNotationConstructor), (intptr_t)setJSDOMWindowNotationConstructor },
+    { "Entity", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowEntityConstructor), (intptr_t)setJSDOMWindowEntityConstructor },
+    { "EntityReference", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowEntityReferenceConstructor), (intptr_t)setJSDOMWindowEntityReferenceConstructor },
+    { "ProcessingInstruction", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowProcessingInstructionConstructor), (intptr_t)setJSDOMWindowProcessingInstructionConstructor },
+    { "HTMLDocument", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLDocumentConstructor), (intptr_t)setJSDOMWindowHTMLDocumentConstructor },
+    { "HTMLElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLElementConstructor), (intptr_t)setJSDOMWindowHTMLElementConstructor },
+    { "HTMLAnchorElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLAnchorElementConstructor), (intptr_t)setJSDOMWindowHTMLAnchorElementConstructor },
+    { "HTMLAppletElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLAppletElementConstructor), (intptr_t)setJSDOMWindowHTMLAppletElementConstructor },
+    { "HTMLAreaElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLAreaElementConstructor), (intptr_t)setJSDOMWindowHTMLAreaElementConstructor },
+    { "HTMLBRElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLBRElementConstructor), (intptr_t)setJSDOMWindowHTMLBRElementConstructor },
+    { "HTMLBaseElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLBaseElementConstructor), (intptr_t)setJSDOMWindowHTMLBaseElementConstructor },
+    { "HTMLBaseFontElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLBaseFontElementConstructor), (intptr_t)setJSDOMWindowHTMLBaseFontElementConstructor },
+    { "HTMLBlockquoteElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLBlockquoteElementConstructor), (intptr_t)setJSDOMWindowHTMLBlockquoteElementConstructor },
+    { "HTMLBodyElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLBodyElementConstructor), (intptr_t)setJSDOMWindowHTMLBodyElementConstructor },
+    { "HTMLButtonElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLButtonElementConstructor), (intptr_t)setJSDOMWindowHTMLButtonElementConstructor },
+    { "HTMLCanvasElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLCanvasElementConstructor), (intptr_t)setJSDOMWindowHTMLCanvasElementConstructor },
 #if ENABLE(DATAGRID)
-    { "HTMLDataGridElement", DontDelete, (intptr_t)jsDOMWindowHTMLDataGridElementConstructor, (intptr_t)setJSDOMWindowHTMLDataGridElementConstructor },
+    { "HTMLDataGridElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLDataGridElementConstructor), (intptr_t)setJSDOMWindowHTMLDataGridElementConstructor },
 #endif
 #if ENABLE(DATAGRID)
-    { "HTMLDataGridCellElement", DontDelete, (intptr_t)jsDOMWindowHTMLDataGridCellElementConstructor, (intptr_t)setJSDOMWindowHTMLDataGridCellElementConstructor },
+    { "HTMLDataGridCellElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLDataGridCellElementConstructor), (intptr_t)setJSDOMWindowHTMLDataGridCellElementConstructor },
 #endif
 #if ENABLE(DATAGRID)
-    { "HTMLDataGridColElement", DontDelete, (intptr_t)jsDOMWindowHTMLDataGridColElementConstructor, (intptr_t)setJSDOMWindowHTMLDataGridColElementConstructor },
+    { "HTMLDataGridColElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLDataGridColElementConstructor), (intptr_t)setJSDOMWindowHTMLDataGridColElementConstructor },
 #endif
-    { "HTMLDListElement", DontDelete, (intptr_t)jsDOMWindowHTMLDListElementConstructor, (intptr_t)setJSDOMWindowHTMLDListElementConstructor },
-    { "HTMLDirectoryElement", DontDelete, (intptr_t)jsDOMWindowHTMLDirectoryElementConstructor, (intptr_t)setJSDOMWindowHTMLDirectoryElementConstructor },
-    { "HTMLDivElement", DontDelete, (intptr_t)jsDOMWindowHTMLDivElementConstructor, (intptr_t)setJSDOMWindowHTMLDivElementConstructor },
-    { "HTMLEmbedElement", DontDelete, (intptr_t)jsDOMWindowHTMLEmbedElementConstructor, (intptr_t)setJSDOMWindowHTMLEmbedElementConstructor },
-    { "HTMLFieldSetElement", DontDelete, (intptr_t)jsDOMWindowHTMLFieldSetElementConstructor, (intptr_t)setJSDOMWindowHTMLFieldSetElementConstructor },
-    { "HTMLFontElement", DontDelete, (intptr_t)jsDOMWindowHTMLFontElementConstructor, (intptr_t)setJSDOMWindowHTMLFontElementConstructor },
-    { "HTMLFormElement", DontDelete, (intptr_t)jsDOMWindowHTMLFormElementConstructor, (intptr_t)setJSDOMWindowHTMLFormElementConstructor },
-    { "HTMLFrameElement", DontDelete, (intptr_t)jsDOMWindowHTMLFrameElementConstructor, (intptr_t)setJSDOMWindowHTMLFrameElementConstructor },
-    { "HTMLFrameSetElement", DontDelete, (intptr_t)jsDOMWindowHTMLFrameSetElementConstructor, (intptr_t)setJSDOMWindowHTMLFrameSetElementConstructor },
-    { "HTMLHRElement", DontDelete, (intptr_t)jsDOMWindowHTMLHRElementConstructor, (intptr_t)setJSDOMWindowHTMLHRElementConstructor },
-    { "HTMLHeadElement", DontDelete, (intptr_t)jsDOMWindowHTMLHeadElementConstructor, (intptr_t)setJSDOMWindowHTMLHeadElementConstructor },
-    { "HTMLHeadingElement", DontDelete, (intptr_t)jsDOMWindowHTMLHeadingElementConstructor, (intptr_t)setJSDOMWindowHTMLHeadingElementConstructor },
-    { "HTMLHtmlElement", DontDelete, (intptr_t)jsDOMWindowHTMLHtmlElementConstructor, (intptr_t)setJSDOMWindowHTMLHtmlElementConstructor },
-    { "HTMLIFrameElement", DontDelete, (intptr_t)jsDOMWindowHTMLIFrameElementConstructor, (intptr_t)setJSDOMWindowHTMLIFrameElementConstructor },
-    { "HTMLImageElement", DontDelete, (intptr_t)jsDOMWindowHTMLImageElementConstructor, (intptr_t)setJSDOMWindowHTMLImageElementConstructor },
-    { "HTMLInputElement", DontDelete, (intptr_t)jsDOMWindowHTMLInputElementConstructor, (intptr_t)setJSDOMWindowHTMLInputElementConstructor },
-    { "HTMLIsIndexElement", DontDelete, (intptr_t)jsDOMWindowHTMLIsIndexElementConstructor, (intptr_t)setJSDOMWindowHTMLIsIndexElementConstructor },
-    { "HTMLLIElement", DontDelete, (intptr_t)jsDOMWindowHTMLLIElementConstructor, (intptr_t)setJSDOMWindowHTMLLIElementConstructor },
-    { "HTMLLabelElement", DontDelete, (intptr_t)jsDOMWindowHTMLLabelElementConstructor, (intptr_t)setJSDOMWindowHTMLLabelElementConstructor },
-    { "HTMLLegendElement", DontDelete, (intptr_t)jsDOMWindowHTMLLegendElementConstructor, (intptr_t)setJSDOMWindowHTMLLegendElementConstructor },
-    { "HTMLLinkElement", DontDelete, (intptr_t)jsDOMWindowHTMLLinkElementConstructor, (intptr_t)setJSDOMWindowHTMLLinkElementConstructor },
-    { "HTMLMapElement", DontDelete, (intptr_t)jsDOMWindowHTMLMapElementConstructor, (intptr_t)setJSDOMWindowHTMLMapElementConstructor },
-    { "HTMLMarqueeElement", DontDelete, (intptr_t)jsDOMWindowHTMLMarqueeElementConstructor, (intptr_t)setJSDOMWindowHTMLMarqueeElementConstructor },
-    { "HTMLMenuElement", DontDelete, (intptr_t)jsDOMWindowHTMLMenuElementConstructor, (intptr_t)setJSDOMWindowHTMLMenuElementConstructor },
-    { "HTMLMetaElement", DontDelete, (intptr_t)jsDOMWindowHTMLMetaElementConstructor, (intptr_t)setJSDOMWindowHTMLMetaElementConstructor },
-    { "HTMLModElement", DontDelete, (intptr_t)jsDOMWindowHTMLModElementConstructor, (intptr_t)setJSDOMWindowHTMLModElementConstructor },
-    { "HTMLOListElement", DontDelete, (intptr_t)jsDOMWindowHTMLOListElementConstructor, (intptr_t)setJSDOMWindowHTMLOListElementConstructor },
-    { "HTMLObjectElement", DontDelete, (intptr_t)jsDOMWindowHTMLObjectElementConstructor, (intptr_t)setJSDOMWindowHTMLObjectElementConstructor },
-    { "HTMLOptGroupElement", DontDelete, (intptr_t)jsDOMWindowHTMLOptGroupElementConstructor, (intptr_t)setJSDOMWindowHTMLOptGroupElementConstructor },
-    { "HTMLOptionElement", DontDelete, (intptr_t)jsDOMWindowHTMLOptionElementConstructor, (intptr_t)setJSDOMWindowHTMLOptionElementConstructor },
-    { "HTMLParagraphElement", DontDelete, (intptr_t)jsDOMWindowHTMLParagraphElementConstructor, (intptr_t)setJSDOMWindowHTMLParagraphElementConstructor },
-    { "HTMLParamElement", DontDelete, (intptr_t)jsDOMWindowHTMLParamElementConstructor, (intptr_t)setJSDOMWindowHTMLParamElementConstructor },
-    { "HTMLPreElement", DontDelete, (intptr_t)jsDOMWindowHTMLPreElementConstructor, (intptr_t)setJSDOMWindowHTMLPreElementConstructor },
-    { "HTMLQuoteElement", DontDelete, (intptr_t)jsDOMWindowHTMLQuoteElementConstructor, (intptr_t)setJSDOMWindowHTMLQuoteElementConstructor },
-    { "HTMLScriptElement", DontDelete, (intptr_t)jsDOMWindowHTMLScriptElementConstructor, (intptr_t)setJSDOMWindowHTMLScriptElementConstructor },
-    { "HTMLSelectElement", DontDelete, (intptr_t)jsDOMWindowHTMLSelectElementConstructor, (intptr_t)setJSDOMWindowHTMLSelectElementConstructor },
-    { "HTMLStyleElement", DontDelete, (intptr_t)jsDOMWindowHTMLStyleElementConstructor, (intptr_t)setJSDOMWindowHTMLStyleElementConstructor },
-    { "HTMLTableCaptionElement", DontDelete, (intptr_t)jsDOMWindowHTMLTableCaptionElementConstructor, (intptr_t)setJSDOMWindowHTMLTableCaptionElementConstructor },
-    { "HTMLTableCellElement", DontDelete, (intptr_t)jsDOMWindowHTMLTableCellElementConstructor, (intptr_t)setJSDOMWindowHTMLTableCellElementConstructor },
-    { "HTMLTableColElement", DontDelete, (intptr_t)jsDOMWindowHTMLTableColElementConstructor, (intptr_t)setJSDOMWindowHTMLTableColElementConstructor },
-    { "HTMLTableElement", DontDelete, (intptr_t)jsDOMWindowHTMLTableElementConstructor, (intptr_t)setJSDOMWindowHTMLTableElementConstructor },
-    { "HTMLTableRowElement", DontDelete, (intptr_t)jsDOMWindowHTMLTableRowElementConstructor, (intptr_t)setJSDOMWindowHTMLTableRowElementConstructor },
-    { "HTMLTableSectionElement", DontDelete, (intptr_t)jsDOMWindowHTMLTableSectionElementConstructor, (intptr_t)setJSDOMWindowHTMLTableSectionElementConstructor },
-    { "HTMLTextAreaElement", DontDelete, (intptr_t)jsDOMWindowHTMLTextAreaElementConstructor, (intptr_t)setJSDOMWindowHTMLTextAreaElementConstructor },
-    { "HTMLTitleElement", DontDelete, (intptr_t)jsDOMWindowHTMLTitleElementConstructor, (intptr_t)setJSDOMWindowHTMLTitleElementConstructor },
-    { "HTMLUListElement", DontDelete, (intptr_t)jsDOMWindowHTMLUListElementConstructor, (intptr_t)setJSDOMWindowHTMLUListElementConstructor },
-    { "HTMLCollection", DontDelete, (intptr_t)jsDOMWindowHTMLCollectionConstructor, (intptr_t)setJSDOMWindowHTMLCollectionConstructor },
-    { "HTMLAllCollection", DontDelete, (intptr_t)jsDOMWindowHTMLAllCollectionConstructor, (intptr_t)setJSDOMWindowHTMLAllCollectionConstructor },
-    { "Image", DontDelete, (intptr_t)jsDOMWindowImageConstructor, (intptr_t)setJSDOMWindowImageConstructor },
-    { "Option", DontDelete, (intptr_t)jsDOMWindowOptionConstructor, (intptr_t)setJSDOMWindowOptionConstructor },
-    { "CanvasRenderingContext2D", DontDelete, (intptr_t)jsDOMWindowCanvasRenderingContext2DConstructor, (intptr_t)setJSDOMWindowCanvasRenderingContext2DConstructor },
+    { "HTMLDListElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLDListElementConstructor), (intptr_t)setJSDOMWindowHTMLDListElementConstructor },
+    { "HTMLDirectoryElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLDirectoryElementConstructor), (intptr_t)setJSDOMWindowHTMLDirectoryElementConstructor },
+    { "HTMLDivElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLDivElementConstructor), (intptr_t)setJSDOMWindowHTMLDivElementConstructor },
+    { "HTMLEmbedElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLEmbedElementConstructor), (intptr_t)setJSDOMWindowHTMLEmbedElementConstructor },
+    { "HTMLFieldSetElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLFieldSetElementConstructor), (intptr_t)setJSDOMWindowHTMLFieldSetElementConstructor },
+    { "HTMLFontElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLFontElementConstructor), (intptr_t)setJSDOMWindowHTMLFontElementConstructor },
+    { "HTMLFormElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLFormElementConstructor), (intptr_t)setJSDOMWindowHTMLFormElementConstructor },
+    { "HTMLFrameElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLFrameElementConstructor), (intptr_t)setJSDOMWindowHTMLFrameElementConstructor },
+    { "HTMLFrameSetElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLFrameSetElementConstructor), (intptr_t)setJSDOMWindowHTMLFrameSetElementConstructor },
+    { "HTMLHRElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLHRElementConstructor), (intptr_t)setJSDOMWindowHTMLHRElementConstructor },
+    { "HTMLHeadElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLHeadElementConstructor), (intptr_t)setJSDOMWindowHTMLHeadElementConstructor },
+    { "HTMLHeadingElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLHeadingElementConstructor), (intptr_t)setJSDOMWindowHTMLHeadingElementConstructor },
+    { "HTMLHtmlElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLHtmlElementConstructor), (intptr_t)setJSDOMWindowHTMLHtmlElementConstructor },
+    { "HTMLIFrameElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLIFrameElementConstructor), (intptr_t)setJSDOMWindowHTMLIFrameElementConstructor },
+    { "HTMLImageElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLImageElementConstructor), (intptr_t)setJSDOMWindowHTMLImageElementConstructor },
+    { "HTMLInputElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLInputElementConstructor), (intptr_t)setJSDOMWindowHTMLInputElementConstructor },
+    { "HTMLIsIndexElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLIsIndexElementConstructor), (intptr_t)setJSDOMWindowHTMLIsIndexElementConstructor },
+    { "HTMLLIElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLLIElementConstructor), (intptr_t)setJSDOMWindowHTMLLIElementConstructor },
+    { "HTMLLabelElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLLabelElementConstructor), (intptr_t)setJSDOMWindowHTMLLabelElementConstructor },
+    { "HTMLLegendElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLLegendElementConstructor), (intptr_t)setJSDOMWindowHTMLLegendElementConstructor },
+    { "HTMLLinkElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLLinkElementConstructor), (intptr_t)setJSDOMWindowHTMLLinkElementConstructor },
+    { "HTMLMapElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLMapElementConstructor), (intptr_t)setJSDOMWindowHTMLMapElementConstructor },
+    { "HTMLMarqueeElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLMarqueeElementConstructor), (intptr_t)setJSDOMWindowHTMLMarqueeElementConstructor },
+    { "HTMLMenuElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLMenuElementConstructor), (intptr_t)setJSDOMWindowHTMLMenuElementConstructor },
+    { "HTMLMetaElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLMetaElementConstructor), (intptr_t)setJSDOMWindowHTMLMetaElementConstructor },
+    { "HTMLModElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLModElementConstructor), (intptr_t)setJSDOMWindowHTMLModElementConstructor },
+    { "HTMLOListElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLOListElementConstructor), (intptr_t)setJSDOMWindowHTMLOListElementConstructor },
+    { "HTMLObjectElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLObjectElementConstructor), (intptr_t)setJSDOMWindowHTMLObjectElementConstructor },
+    { "HTMLOptGroupElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLOptGroupElementConstructor), (intptr_t)setJSDOMWindowHTMLOptGroupElementConstructor },
+    { "HTMLOptionElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLOptionElementConstructor), (intptr_t)setJSDOMWindowHTMLOptionElementConstructor },
+    { "HTMLParagraphElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLParagraphElementConstructor), (intptr_t)setJSDOMWindowHTMLParagraphElementConstructor },
+    { "HTMLParamElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLParamElementConstructor), (intptr_t)setJSDOMWindowHTMLParamElementConstructor },
+    { "HTMLPreElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLPreElementConstructor), (intptr_t)setJSDOMWindowHTMLPreElementConstructor },
+    { "HTMLQuoteElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLQuoteElementConstructor), (intptr_t)setJSDOMWindowHTMLQuoteElementConstructor },
+    { "HTMLScriptElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLScriptElementConstructor), (intptr_t)setJSDOMWindowHTMLScriptElementConstructor },
+    { "HTMLSelectElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLSelectElementConstructor), (intptr_t)setJSDOMWindowHTMLSelectElementConstructor },
+    { "HTMLStyleElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLStyleElementConstructor), (intptr_t)setJSDOMWindowHTMLStyleElementConstructor },
+    { "HTMLTableCaptionElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTableCaptionElementConstructor), (intptr_t)setJSDOMWindowHTMLTableCaptionElementConstructor },
+    { "HTMLTableCellElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTableCellElementConstructor), (intptr_t)setJSDOMWindowHTMLTableCellElementConstructor },
+    { "HTMLTableColElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTableColElementConstructor), (intptr_t)setJSDOMWindowHTMLTableColElementConstructor },
+    { "HTMLTableElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTableElementConstructor), (intptr_t)setJSDOMWindowHTMLTableElementConstructor },
+    { "HTMLTableRowElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTableRowElementConstructor), (intptr_t)setJSDOMWindowHTMLTableRowElementConstructor },
+    { "HTMLTableSectionElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTableSectionElementConstructor), (intptr_t)setJSDOMWindowHTMLTableSectionElementConstructor },
+    { "HTMLTextAreaElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTextAreaElementConstructor), (intptr_t)setJSDOMWindowHTMLTextAreaElementConstructor },
+    { "HTMLTitleElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTitleElementConstructor), (intptr_t)setJSDOMWindowHTMLTitleElementConstructor },
+    { "HTMLUListElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLUListElementConstructor), (intptr_t)setJSDOMWindowHTMLUListElementConstructor },
+    { "HTMLCollection", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLCollectionConstructor), (intptr_t)setJSDOMWindowHTMLCollectionConstructor },
+    { "HTMLAllCollection", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLAllCollectionConstructor), (intptr_t)setJSDOMWindowHTMLAllCollectionConstructor },
+    { "Image", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowImageConstructor), (intptr_t)setJSDOMWindowImageConstructor },
+    { "Option", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOptionConstructor), (intptr_t)setJSDOMWindowOptionConstructor },
+    { "CanvasRenderingContext2D", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCanvasRenderingContext2DConstructor), (intptr_t)setJSDOMWindowCanvasRenderingContext2DConstructor },
+    { "ImageData", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowImageDataConstructor), (intptr_t)setJSDOMWindowImageDataConstructor },
 #if ENABLE(3D_CANVAS)
-    { "CanvasRenderingContext3D", DontDelete, (intptr_t)jsDOMWindowCanvasRenderingContext3DConstructor, (intptr_t)setJSDOMWindowCanvasRenderingContext3DConstructor },
+    { "WebGLRenderingContext", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLRenderingContextConstructor), (intptr_t)setJSDOMWindowWebGLRenderingContextConstructor },
 #endif
-    { "TextMetrics", DontDelete, (intptr_t)jsDOMWindowTextMetricsConstructor, (intptr_t)setJSDOMWindowTextMetricsConstructor },
+    { "TextMetrics", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowTextMetricsConstructor), (intptr_t)setJSDOMWindowTextMetricsConstructor },
 #if ENABLE(3D_CANVAS)
-    { "CanvasArrayBuffer", DontDelete, (intptr_t)jsDOMWindowCanvasArrayBufferConstructor, (intptr_t)setJSDOMWindowCanvasArrayBufferConstructor },
+    { "WebGLArrayBuffer", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLArrayBufferConstructor), (intptr_t)setJSDOMWindowWebGLArrayBufferConstructor },
 #endif
 #if ENABLE(3D_CANVAS)
-    { "CanvasByteArray", DontDelete, (intptr_t)jsDOMWindowCanvasByteArrayConstructor, (intptr_t)setJSDOMWindowCanvasByteArrayConstructor },
+    { "WebGLByteArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLByteArrayConstructor), (intptr_t)setJSDOMWindowWebGLByteArrayConstructor },
 #endif
 #if ENABLE(3D_CANVAS)
-    { "CanvasUnsignedByteArray", DontDelete, (intptr_t)jsDOMWindowCanvasUnsignedByteArrayConstructor, (intptr_t)setJSDOMWindowCanvasUnsignedByteArrayConstructor },
+    { "WebGLUnsignedByteArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLUnsignedByteArrayConstructor), (intptr_t)setJSDOMWindowWebGLUnsignedByteArrayConstructor },
 #endif
 #if ENABLE(3D_CANVAS)
-    { "CanvasShortArray", DontDelete, (intptr_t)jsDOMWindowCanvasShortArrayConstructor, (intptr_t)setJSDOMWindowCanvasShortArrayConstructor },
+    { "WebGLShortArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLShortArrayConstructor), (intptr_t)setJSDOMWindowWebGLShortArrayConstructor },
 #endif
 #if ENABLE(3D_CANVAS)
-    { "CanvasUnsignedShortArray", DontDelete, (intptr_t)jsDOMWindowCanvasUnsignedShortArrayConstructor, (intptr_t)setJSDOMWindowCanvasUnsignedShortArrayConstructor },
+    { "WebGLUnsignedShortArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLUnsignedShortArrayConstructor), (intptr_t)setJSDOMWindowWebGLUnsignedShortArrayConstructor },
 #endif
 #if ENABLE(3D_CANVAS)
-    { "CanvasIntArray", DontDelete, (intptr_t)jsDOMWindowCanvasIntArrayConstructor, (intptr_t)setJSDOMWindowCanvasIntArrayConstructor },
+    { "WebGLIntArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLIntArrayConstructor), (intptr_t)setJSDOMWindowWebGLIntArrayConstructor },
 #endif
 #if ENABLE(3D_CANVAS)
-    { "CanvasUnsignedIntArray", DontDelete, (intptr_t)jsDOMWindowCanvasUnsignedIntArrayConstructor, (intptr_t)setJSDOMWindowCanvasUnsignedIntArrayConstructor },
+    { "WebGLUnsignedIntArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLUnsignedIntArrayConstructor), (intptr_t)setJSDOMWindowWebGLUnsignedIntArrayConstructor },
 #endif
 #if ENABLE(3D_CANVAS)
-    { "CanvasFloatArray", DontDelete, (intptr_t)jsDOMWindowCanvasFloatArrayConstructor, (intptr_t)setJSDOMWindowCanvasFloatArrayConstructor },
+    { "WebGLFloatArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLFloatArrayConstructor), (intptr_t)setJSDOMWindowWebGLFloatArrayConstructor },
 #endif
-    { "Event", DontDelete, (intptr_t)jsDOMWindowEventConstructor, (intptr_t)setJSDOMWindowEventConstructor },
-    { "BeforeLoadEvent", DontDelete, (intptr_t)jsDOMWindowBeforeLoadEventConstructor, (intptr_t)setJSDOMWindowBeforeLoadEventConstructor },
-    { "KeyboardEvent", DontDelete, (intptr_t)jsDOMWindowKeyboardEventConstructor, (intptr_t)setJSDOMWindowKeyboardEventConstructor },
-    { "MouseEvent", DontDelete, (intptr_t)jsDOMWindowMouseEventConstructor, (intptr_t)setJSDOMWindowMouseEventConstructor },
-    { "MutationEvent", DontDelete, (intptr_t)jsDOMWindowMutationEventConstructor, (intptr_t)setJSDOMWindowMutationEventConstructor },
-    { "OverflowEvent", DontDelete, (intptr_t)jsDOMWindowOverflowEventConstructor, (intptr_t)setJSDOMWindowOverflowEventConstructor },
-    { "PageTransitionEvent", DontDelete, (intptr_t)jsDOMWindowPageTransitionEventConstructor, (intptr_t)setJSDOMWindowPageTransitionEventConstructor },
-    { "ProgressEvent", DontDelete, (intptr_t)jsDOMWindowProgressEventConstructor, (intptr_t)setJSDOMWindowProgressEventConstructor },
-    { "TextEvent", DontDelete, (intptr_t)jsDOMWindowTextEventConstructor, (intptr_t)setJSDOMWindowTextEventConstructor },
-    { "UIEvent", DontDelete, (intptr_t)jsDOMWindowUIEventConstructor, (intptr_t)setJSDOMWindowUIEventConstructor },
-    { "WebKitAnimationEvent", DontDelete, (intptr_t)jsDOMWindowWebKitAnimationEventConstructor, (intptr_t)setJSDOMWindowWebKitAnimationEventConstructor },
-    { "WebKitTransitionEvent", DontDelete, (intptr_t)jsDOMWindowWebKitTransitionEventConstructor, (intptr_t)setJSDOMWindowWebKitTransitionEventConstructor },
-    { "WheelEvent", DontDelete, (intptr_t)jsDOMWindowWheelEventConstructor, (intptr_t)setJSDOMWindowWheelEventConstructor },
-    { "MessageEvent", DontDelete, (intptr_t)jsDOMWindowMessageEventConstructor, (intptr_t)setJSDOMWindowMessageEventConstructor },
-    { "EventException", DontDelete, (intptr_t)jsDOMWindowEventExceptionConstructor, (intptr_t)setJSDOMWindowEventExceptionConstructor },
-    { "WebKitCSSKeyframeRule", DontDelete, (intptr_t)jsDOMWindowWebKitCSSKeyframeRuleConstructor, (intptr_t)setJSDOMWindowWebKitCSSKeyframeRuleConstructor },
-    { "WebKitCSSKeyframesRule", DontDelete, (intptr_t)jsDOMWindowWebKitCSSKeyframesRuleConstructor, (intptr_t)setJSDOMWindowWebKitCSSKeyframesRuleConstructor },
-    { "WebKitCSSMatrix", DontDelete, (intptr_t)jsDOMWindowWebKitCSSMatrixConstructor, (intptr_t)setJSDOMWindowWebKitCSSMatrixConstructor },
-    { "WebKitPoint", DontDelete, (intptr_t)jsDOMWindowWebKitPointConstructor, (intptr_t)setJSDOMWindowWebKitPointConstructor },
-    { "Clipboard", DontDelete, (intptr_t)jsDOMWindowClipboardConstructor, (intptr_t)setJSDOMWindowClipboardConstructor },
-    { "File", DontDelete, (intptr_t)jsDOMWindowFileConstructor, (intptr_t)setJSDOMWindowFileConstructor },
-    { "FileList", DontDelete, (intptr_t)jsDOMWindowFileListConstructor, (intptr_t)setJSDOMWindowFileListConstructor },
-    { "NodeFilter", DontDelete, (intptr_t)jsDOMWindowNodeFilterConstructor, (intptr_t)setJSDOMWindowNodeFilterConstructor },
-    { "Range", DontDelete, (intptr_t)jsDOMWindowRangeConstructor, (intptr_t)setJSDOMWindowRangeConstructor },
-    { "RangeException", DontDelete, (intptr_t)jsDOMWindowRangeExceptionConstructor, (intptr_t)setJSDOMWindowRangeExceptionConstructor },
-    { "EventSource", DontDelete, (intptr_t)jsDOMWindowEventSourceConstructor, (intptr_t)setJSDOMWindowEventSourceConstructor },
-    { "XMLDocument", DontDelete, (intptr_t)jsDOMWindowXMLDocumentConstructor, (intptr_t)setJSDOMWindowXMLDocumentConstructor },
-    { "DOMParser", DontDelete, (intptr_t)jsDOMWindowDOMParserConstructor, (intptr_t)setJSDOMWindowDOMParserConstructor },
-    { "XMLSerializer", DontDelete, (intptr_t)jsDOMWindowXMLSerializerConstructor, (intptr_t)setJSDOMWindowXMLSerializerConstructor },
-    { "XMLHttpRequest", DontDelete, (intptr_t)jsDOMWindowXMLHttpRequestConstructor, (intptr_t)setJSDOMWindowXMLHttpRequestConstructor },
-    { "XMLHttpRequestUpload", DontDelete, (intptr_t)jsDOMWindowXMLHttpRequestUploadConstructor, (intptr_t)setJSDOMWindowXMLHttpRequestUploadConstructor },
-    { "XMLHttpRequestException", DontDelete, (intptr_t)jsDOMWindowXMLHttpRequestExceptionConstructor, (intptr_t)setJSDOMWindowXMLHttpRequestExceptionConstructor },
+    { "Event", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowEventConstructor), (intptr_t)setJSDOMWindowEventConstructor },
+    { "BeforeLoadEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowBeforeLoadEventConstructor), (intptr_t)setJSDOMWindowBeforeLoadEventConstructor },
+    { "KeyboardEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowKeyboardEventConstructor), (intptr_t)setJSDOMWindowKeyboardEventConstructor },
+    { "MouseEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMouseEventConstructor), (intptr_t)setJSDOMWindowMouseEventConstructor },
+    { "MutationEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMutationEventConstructor), (intptr_t)setJSDOMWindowMutationEventConstructor },
+    { "OverflowEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOverflowEventConstructor), (intptr_t)setJSDOMWindowOverflowEventConstructor },
+    { "PageTransitionEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowPageTransitionEventConstructor), (intptr_t)setJSDOMWindowPageTransitionEventConstructor },
+    { "ProgressEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowProgressEventConstructor), (intptr_t)setJSDOMWindowProgressEventConstructor },
+    { "TextEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowTextEventConstructor), (intptr_t)setJSDOMWindowTextEventConstructor },
+    { "UIEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowUIEventConstructor), (intptr_t)setJSDOMWindowUIEventConstructor },
+    { "WebKitAnimationEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebKitAnimationEventConstructor), (intptr_t)setJSDOMWindowWebKitAnimationEventConstructor },
+    { "WebKitTransitionEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebKitTransitionEventConstructor), (intptr_t)setJSDOMWindowWebKitTransitionEventConstructor },
+    { "WheelEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWheelEventConstructor), (intptr_t)setJSDOMWindowWheelEventConstructor },
+    { "MessageEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMessageEventConstructor), (intptr_t)setJSDOMWindowMessageEventConstructor },
+    { "EventException", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowEventExceptionConstructor), (intptr_t)setJSDOMWindowEventExceptionConstructor },
+    { "WebKitCSSKeyframeRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebKitCSSKeyframeRuleConstructor), (intptr_t)setJSDOMWindowWebKitCSSKeyframeRuleConstructor },
+    { "WebKitCSSKeyframesRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebKitCSSKeyframesRuleConstructor), (intptr_t)setJSDOMWindowWebKitCSSKeyframesRuleConstructor },
+    { "WebKitCSSMatrix", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebKitCSSMatrixConstructor), (intptr_t)setJSDOMWindowWebKitCSSMatrixConstructor },
+    { "WebKitPoint", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebKitPointConstructor), (intptr_t)setJSDOMWindowWebKitPointConstructor },
+    { "Clipboard", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowClipboardConstructor), (intptr_t)setJSDOMWindowClipboardConstructor },
+    { "File", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowFileConstructor), (intptr_t)setJSDOMWindowFileConstructor },
+    { "FileList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowFileListConstructor), (intptr_t)setJSDOMWindowFileListConstructor },
+    { "Blob", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowBlobConstructor), (intptr_t)setJSDOMWindowBlobConstructor },
+    { "NodeFilter", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowNodeFilterConstructor), (intptr_t)setJSDOMWindowNodeFilterConstructor },
+    { "Range", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowRangeConstructor), (intptr_t)setJSDOMWindowRangeConstructor },
+    { "RangeException", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowRangeExceptionConstructor), (intptr_t)setJSDOMWindowRangeExceptionConstructor },
+    { "EventSource", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowEventSourceConstructor), (intptr_t)setJSDOMWindowEventSourceConstructor },
+    { "XMLDocument", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXMLDocumentConstructor), (intptr_t)setJSDOMWindowXMLDocumentConstructor },
+    { "DOMParser", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDOMParserConstructor), (intptr_t)setJSDOMWindowDOMParserConstructor },
+    { "XMLSerializer", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXMLSerializerConstructor), (intptr_t)setJSDOMWindowXMLSerializerConstructor },
+    { "XMLHttpRequest", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXMLHttpRequestConstructor), (intptr_t)setJSDOMWindowXMLHttpRequestConstructor },
+    { "XMLHttpRequestUpload", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXMLHttpRequestUploadConstructor), (intptr_t)setJSDOMWindowXMLHttpRequestUploadConstructor },
+    { "XMLHttpRequestException", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXMLHttpRequestExceptionConstructor), (intptr_t)setJSDOMWindowXMLHttpRequestExceptionConstructor },
 #if ENABLE(XSLT)
-    { "XSLTProcessor", DontDelete, (intptr_t)jsDOMWindowXSLTProcessorConstructor, (intptr_t)setJSDOMWindowXSLTProcessorConstructor },
+    { "XSLTProcessor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXSLTProcessorConstructor), (intptr_t)setJSDOMWindowXSLTProcessorConstructor },
 #endif
-    { "MessagePort", DontDelete, (intptr_t)jsDOMWindowMessagePortConstructor, (intptr_t)setJSDOMWindowMessagePortConstructor },
-    { "MessageChannel", DontDelete, (intptr_t)jsDOMWindowMessageChannelConstructor, (intptr_t)setJSDOMWindowMessageChannelConstructor },
-    { "Worker", DontDelete, (intptr_t)jsDOMWindowWorkerConstructor, (intptr_t)setJSDOMWindowWorkerConstructor },
-    { "SharedWorker", DontDelete, (intptr_t)jsDOMWindowSharedWorkerConstructor, (intptr_t)setJSDOMWindowSharedWorkerConstructor },
-    { "Plugin", DontDelete, (intptr_t)jsDOMWindowPluginConstructor, (intptr_t)setJSDOMWindowPluginConstructor },
-    { "PluginArray", DontDelete, (intptr_t)jsDOMWindowPluginArrayConstructor, (intptr_t)setJSDOMWindowPluginArrayConstructor },
-    { "MimeType", DontDelete, (intptr_t)jsDOMWindowMimeTypeConstructor, (intptr_t)setJSDOMWindowMimeTypeConstructor },
-    { "MimeTypeArray", DontDelete, (intptr_t)jsDOMWindowMimeTypeArrayConstructor, (intptr_t)setJSDOMWindowMimeTypeArrayConstructor },
-    { "ClientRect", DontDelete, (intptr_t)jsDOMWindowClientRectConstructor, (intptr_t)setJSDOMWindowClientRectConstructor },
-    { "ClientRectList", DontDelete, (intptr_t)jsDOMWindowClientRectListConstructor, (intptr_t)setJSDOMWindowClientRectListConstructor },
-    { "Storage", DontDelete, (intptr_t)jsDOMWindowStorageConstructor, (intptr_t)setJSDOMWindowStorageConstructor },
-    { "StorageEvent", DontDelete, (intptr_t)jsDOMWindowStorageEventConstructor, (intptr_t)setJSDOMWindowStorageEventConstructor },
+    { "MessagePort", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMessagePortConstructor), (intptr_t)setJSDOMWindowMessagePortConstructor },
+    { "MessageChannel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMessageChannelConstructor), (intptr_t)setJSDOMWindowMessageChannelConstructor },
+    { "Worker", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWorkerConstructor), (intptr_t)setJSDOMWindowWorkerConstructor },
+    { "SharedWorker", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSharedWorkerConstructor), (intptr_t)setJSDOMWindowSharedWorkerConstructor },
+    { "WebSocket", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebSocketConstructor), (intptr_t)setJSDOMWindowWebSocketConstructor },
+    { "Plugin", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowPluginConstructor), (intptr_t)setJSDOMWindowPluginConstructor },
+    { "PluginArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowPluginArrayConstructor), (intptr_t)setJSDOMWindowPluginArrayConstructor },
+    { "MimeType", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMimeTypeConstructor), (intptr_t)setJSDOMWindowMimeTypeConstructor },
+    { "MimeTypeArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMimeTypeArrayConstructor), (intptr_t)setJSDOMWindowMimeTypeArrayConstructor },
+    { "ClientRect", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowClientRectConstructor), (intptr_t)setJSDOMWindowClientRectConstructor },
+    { "ClientRectList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowClientRectListConstructor), (intptr_t)setJSDOMWindowClientRectListConstructor },
+    { "Storage", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowStorageConstructor), (intptr_t)setJSDOMWindowStorageConstructor },
+    { "StorageEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowStorageEventConstructor), (intptr_t)setJSDOMWindowStorageEventConstructor },
 #if ENABLE(VIDEO)
-    { "Audio", DontDelete, (intptr_t)jsDOMWindowAudioConstructor, (intptr_t)setJSDOMWindowAudioConstructor },
+    { "Audio", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowAudioConstructor), (intptr_t)setJSDOMWindowAudioConstructor },
 #endif
 #if ENABLE(VIDEO)
-    { "HTMLAudioElement", DontDelete, (intptr_t)jsDOMWindowHTMLAudioElementConstructor, (intptr_t)setJSDOMWindowHTMLAudioElementConstructor },
+    { "HTMLAudioElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLAudioElementConstructor), (intptr_t)setJSDOMWindowHTMLAudioElementConstructor },
 #endif
 #if ENABLE(VIDEO)
-    { "HTMLMediaElement", DontDelete, (intptr_t)jsDOMWindowHTMLMediaElementConstructor, (intptr_t)setJSDOMWindowHTMLMediaElementConstructor },
+    { "HTMLMediaElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLMediaElementConstructor), (intptr_t)setJSDOMWindowHTMLMediaElementConstructor },
 #endif
 #if ENABLE(VIDEO)
-    { "HTMLVideoElement", DontDelete, (intptr_t)jsDOMWindowHTMLVideoElementConstructor, (intptr_t)setJSDOMWindowHTMLVideoElementConstructor },
+    { "HTMLVideoElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLVideoElementConstructor), (intptr_t)setJSDOMWindowHTMLVideoElementConstructor },
 #endif
 #if ENABLE(VIDEO)
-    { "MediaError", DontDelete, (intptr_t)jsDOMWindowMediaErrorConstructor, (intptr_t)setJSDOMWindowMediaErrorConstructor },
+    { "MediaError", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMediaErrorConstructor), (intptr_t)setJSDOMWindowMediaErrorConstructor },
 #endif
-    { "XPathEvaluator", DontDelete, (intptr_t)jsDOMWindowXPathEvaluatorConstructor, (intptr_t)setJSDOMWindowXPathEvaluatorConstructor },
-    { "XPathResult", DontDelete, (intptr_t)jsDOMWindowXPathResultConstructor, (intptr_t)setJSDOMWindowXPathResultConstructor },
-    { "XPathException", DontDelete, (intptr_t)jsDOMWindowXPathExceptionConstructor, (intptr_t)setJSDOMWindowXPathExceptionConstructor },
-    { "SVGAngle", DontDelete, (intptr_t)jsDOMWindowSVGAngleConstructor, (intptr_t)setJSDOMWindowSVGAngleConstructor },
-    { "SVGColor", DontDelete, (intptr_t)jsDOMWindowSVGColorConstructor, (intptr_t)setJSDOMWindowSVGColorConstructor },
-    { "SVGException", DontDelete, (intptr_t)jsDOMWindowSVGExceptionConstructor, (intptr_t)setJSDOMWindowSVGExceptionConstructor },
-    { "SVGGradientElement", DontDelete, (intptr_t)jsDOMWindowSVGGradientElementConstructor, (intptr_t)setJSDOMWindowSVGGradientElementConstructor },
-    { "SVGLength", DontDelete, (intptr_t)jsDOMWindowSVGLengthConstructor, (intptr_t)setJSDOMWindowSVGLengthConstructor },
-    { "SVGMarkerElement", DontDelete, (intptr_t)jsDOMWindowSVGMarkerElementConstructor, (intptr_t)setJSDOMWindowSVGMarkerElementConstructor },
-    { "SVGPaint", DontDelete, (intptr_t)jsDOMWindowSVGPaintConstructor, (intptr_t)setJSDOMWindowSVGPaintConstructor },
-    { "SVGPathSeg", DontDelete, (intptr_t)jsDOMWindowSVGPathSegConstructor, (intptr_t)setJSDOMWindowSVGPathSegConstructor },
-    { "SVGPreserveAspectRatio", DontDelete, (intptr_t)jsDOMWindowSVGPreserveAspectRatioConstructor, (intptr_t)setJSDOMWindowSVGPreserveAspectRatioConstructor },
-    { "SVGRenderingIntent", DontDelete, (intptr_t)jsDOMWindowSVGRenderingIntentConstructor, (intptr_t)setJSDOMWindowSVGRenderingIntentConstructor },
-    { "SVGTextContentElement", DontDelete, (intptr_t)jsDOMWindowSVGTextContentElementConstructor, (intptr_t)setJSDOMWindowSVGTextContentElementConstructor },
-    { "SVGTextPathElement", DontDelete, (intptr_t)jsDOMWindowSVGTextPathElementConstructor, (intptr_t)setJSDOMWindowSVGTextPathElementConstructor },
-    { "SVGTransform", DontDelete, (intptr_t)jsDOMWindowSVGTransformConstructor, (intptr_t)setJSDOMWindowSVGTransformConstructor },
-    { "SVGUnitTypes", DontDelete, (intptr_t)jsDOMWindowSVGUnitTypesConstructor, (intptr_t)setJSDOMWindowSVGUnitTypesConstructor },
+    { "XPathEvaluator", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXPathEvaluatorConstructor), (intptr_t)setJSDOMWindowXPathEvaluatorConstructor },
+    { "XPathResult", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXPathResultConstructor), (intptr_t)setJSDOMWindowXPathResultConstructor },
+    { "XPathException", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXPathExceptionConstructor), (intptr_t)setJSDOMWindowXPathExceptionConstructor },
+    { "SVGAElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAElementConstructor), (intptr_t)setJSDOMWindowSVGAElementConstructor },
+    { "SVGAngle", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAngleConstructor), (intptr_t)setJSDOMWindowSVGAngleConstructor },
+    { "SVGAnimatedAngle", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedAngleConstructor), (intptr_t)setJSDOMWindowSVGAnimatedAngleConstructor },
+    { "SVGAnimatedBoolean", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedBooleanConstructor), (intptr_t)setJSDOMWindowSVGAnimatedBooleanConstructor },
+    { "SVGAnimatedEnumeration", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedEnumerationConstructor), (intptr_t)setJSDOMWindowSVGAnimatedEnumerationConstructor },
+    { "SVGAnimatedInteger", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedIntegerConstructor), (intptr_t)setJSDOMWindowSVGAnimatedIntegerConstructor },
+    { "SVGAnimatedLength", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedLengthConstructor), (intptr_t)setJSDOMWindowSVGAnimatedLengthConstructor },
+    { "SVGAnimatedLengthList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedLengthListConstructor), (intptr_t)setJSDOMWindowSVGAnimatedLengthListConstructor },
+    { "SVGAnimatedNumber", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedNumberConstructor), (intptr_t)setJSDOMWindowSVGAnimatedNumberConstructor },
+    { "SVGAnimatedNumberList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedNumberListConstructor), (intptr_t)setJSDOMWindowSVGAnimatedNumberListConstructor },
+    { "SVGAnimatedPreserveAspectRatio", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedPreserveAspectRatioConstructor), (intptr_t)setJSDOMWindowSVGAnimatedPreserveAspectRatioConstructor },
+    { "SVGAnimatedRect", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedRectConstructor), (intptr_t)setJSDOMWindowSVGAnimatedRectConstructor },
+    { "SVGAnimatedString", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedStringConstructor), (intptr_t)setJSDOMWindowSVGAnimatedStringConstructor },
+    { "SVGAnimatedTransformList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedTransformListConstructor), (intptr_t)setJSDOMWindowSVGAnimatedTransformListConstructor },
+    { "SVGCircleElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGCircleElementConstructor), (intptr_t)setJSDOMWindowSVGCircleElementConstructor },
+    { "SVGClipPathElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGClipPathElementConstructor), (intptr_t)setJSDOMWindowSVGClipPathElementConstructor },
+    { "SVGColor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGColorConstructor), (intptr_t)setJSDOMWindowSVGColorConstructor },
+    { "SVGCursorElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGCursorElementConstructor), (intptr_t)setJSDOMWindowSVGCursorElementConstructor },
+    { "SVGDefsElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGDefsElementConstructor), (intptr_t)setJSDOMWindowSVGDefsElementConstructor },
+    { "SVGDescElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGDescElementConstructor), (intptr_t)setJSDOMWindowSVGDescElementConstructor },
+    { "SVGDocument", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGDocumentConstructor), (intptr_t)setJSDOMWindowSVGDocumentConstructor },
+    { "SVGElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGElementConstructor), (intptr_t)setJSDOMWindowSVGElementConstructor },
+    { "SVGElementInstance", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGElementInstanceConstructor), (intptr_t)setJSDOMWindowSVGElementInstanceConstructor },
+    { "SVGElementInstanceList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGElementInstanceListConstructor), (intptr_t)setJSDOMWindowSVGElementInstanceListConstructor },
+    { "SVGEllipseElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGEllipseElementConstructor), (intptr_t)setJSDOMWindowSVGEllipseElementConstructor },
+    { "SVGException", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGExceptionConstructor), (intptr_t)setJSDOMWindowSVGExceptionConstructor },
+    { "SVGGElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGGElementConstructor), (intptr_t)setJSDOMWindowSVGGElementConstructor },
+    { "SVGGradientElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGGradientElementConstructor), (intptr_t)setJSDOMWindowSVGGradientElementConstructor },
+    { "SVGImageElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGImageElementConstructor), (intptr_t)setJSDOMWindowSVGImageElementConstructor },
+    { "SVGLength", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGLengthConstructor), (intptr_t)setJSDOMWindowSVGLengthConstructor },
+    { "SVGLengthList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGLengthListConstructor), (intptr_t)setJSDOMWindowSVGLengthListConstructor },
+    { "SVGLinearGradientElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGLinearGradientElementConstructor), (intptr_t)setJSDOMWindowSVGLinearGradientElementConstructor },
+    { "SVGLineElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGLineElementConstructor), (intptr_t)setJSDOMWindowSVGLineElementConstructor },
+    { "SVGMarkerElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGMarkerElementConstructor), (intptr_t)setJSDOMWindowSVGMarkerElementConstructor },
+    { "SVGMaskElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGMaskElementConstructor), (intptr_t)setJSDOMWindowSVGMaskElementConstructor },
+    { "SVGMatrix", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGMatrixConstructor), (intptr_t)setJSDOMWindowSVGMatrixConstructor },
+    { "SVGMetadataElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGMetadataElementConstructor), (intptr_t)setJSDOMWindowSVGMetadataElementConstructor },
+    { "SVGNumber", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGNumberConstructor), (intptr_t)setJSDOMWindowSVGNumberConstructor },
+    { "SVGNumberList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGNumberListConstructor), (intptr_t)setJSDOMWindowSVGNumberListConstructor },
+    { "SVGPaint", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPaintConstructor), (intptr_t)setJSDOMWindowSVGPaintConstructor },
+    { "SVGPathElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathElementConstructor), (intptr_t)setJSDOMWindowSVGPathElementConstructor },
+    { "SVGPathSeg", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegConstructor), (intptr_t)setJSDOMWindowSVGPathSegConstructor },
+    { "SVGPathSegArcAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegArcAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegArcAbsConstructor },
+    { "SVGPathSegArcRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegArcRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegArcRelConstructor },
+    { "SVGPathSegClosePath", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegClosePathConstructor), (intptr_t)setJSDOMWindowSVGPathSegClosePathConstructor },
+    { "SVGPathSegCurvetoCubicAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoCubicAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoCubicAbsConstructor },
+    { "SVGPathSegCurvetoCubicRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoCubicRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoCubicRelConstructor },
+    { "SVGPathSegCurvetoCubicSmoothAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoCubicSmoothAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoCubicSmoothAbsConstructor },
+    { "SVGPathSegCurvetoCubicSmoothRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoCubicSmoothRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoCubicSmoothRelConstructor },
+    { "SVGPathSegCurvetoQuadraticAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoQuadraticAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoQuadraticAbsConstructor },
+    { "SVGPathSegCurvetoQuadraticRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoQuadraticRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoQuadraticRelConstructor },
+    { "SVGPathSegCurvetoQuadraticSmoothAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoQuadraticSmoothAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoQuadraticSmoothAbsConstructor },
+    { "SVGPathSegCurvetoQuadraticSmoothRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoQuadraticSmoothRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoQuadraticSmoothRelConstructor },
+    { "SVGPathSegLinetoAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegLinetoAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegLinetoAbsConstructor },
+    { "SVGPathSegLinetoHorizontalAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegLinetoHorizontalAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegLinetoHorizontalAbsConstructor },
+    { "SVGPathSegLinetoHorizontalRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegLinetoHorizontalRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegLinetoHorizontalRelConstructor },
+    { "SVGPathSegLinetoRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegLinetoRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegLinetoRelConstructor },
+    { "SVGPathSegLinetoVerticalAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegLinetoVerticalAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegLinetoVerticalAbsConstructor },
+    { "SVGPathSegLinetoVerticalRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegLinetoVerticalRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegLinetoVerticalRelConstructor },
+    { "SVGPathSegList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegListConstructor), (intptr_t)setJSDOMWindowSVGPathSegListConstructor },
+    { "SVGPathSegMovetoAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegMovetoAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegMovetoAbsConstructor },
+    { "SVGPathSegMovetoRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegMovetoRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegMovetoRelConstructor },
+    { "SVGPatternElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPatternElementConstructor), (intptr_t)setJSDOMWindowSVGPatternElementConstructor },
+    { "SVGPoint", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPointConstructor), (intptr_t)setJSDOMWindowSVGPointConstructor },
+    { "SVGPointList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPointListConstructor), (intptr_t)setJSDOMWindowSVGPointListConstructor },
+    { "SVGPolygonElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPolygonElementConstructor), (intptr_t)setJSDOMWindowSVGPolygonElementConstructor },
+    { "SVGPolylineElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPolylineElementConstructor), (intptr_t)setJSDOMWindowSVGPolylineElementConstructor },
+    { "SVGPreserveAspectRatio", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPreserveAspectRatioConstructor), (intptr_t)setJSDOMWindowSVGPreserveAspectRatioConstructor },
+    { "SVGRadialGradientElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGRadialGradientElementConstructor), (intptr_t)setJSDOMWindowSVGRadialGradientElementConstructor },
+    { "SVGRect", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGRectConstructor), (intptr_t)setJSDOMWindowSVGRectConstructor },
+    { "SVGRectElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGRectElementConstructor), (intptr_t)setJSDOMWindowSVGRectElementConstructor },
+    { "SVGRenderingIntent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGRenderingIntentConstructor), (intptr_t)setJSDOMWindowSVGRenderingIntentConstructor },
+    { "SVGScriptElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGScriptElementConstructor), (intptr_t)setJSDOMWindowSVGScriptElementConstructor },
+    { "SVGStopElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGStopElementConstructor), (intptr_t)setJSDOMWindowSVGStopElementConstructor },
+    { "SVGStringList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGStringListConstructor), (intptr_t)setJSDOMWindowSVGStringListConstructor },
+    { "SVGStyleElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGStyleElementConstructor), (intptr_t)setJSDOMWindowSVGStyleElementConstructor },
+    { "SVGSVGElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGSVGElementConstructor), (intptr_t)setJSDOMWindowSVGSVGElementConstructor },
+    { "SVGSwitchElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGSwitchElementConstructor), (intptr_t)setJSDOMWindowSVGSwitchElementConstructor },
+    { "SVGSymbolElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGSymbolElementConstructor), (intptr_t)setJSDOMWindowSVGSymbolElementConstructor },
+    { "SVGTextContentElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTextContentElementConstructor), (intptr_t)setJSDOMWindowSVGTextContentElementConstructor },
+    { "SVGTextElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTextElementConstructor), (intptr_t)setJSDOMWindowSVGTextElementConstructor },
+    { "SVGTextPathElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTextPathElementConstructor), (intptr_t)setJSDOMWindowSVGTextPathElementConstructor },
+    { "SVGTextPositioningElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTextPositioningElementConstructor), (intptr_t)setJSDOMWindowSVGTextPositioningElementConstructor },
+    { "SVGTitleElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTitleElementConstructor), (intptr_t)setJSDOMWindowSVGTitleElementConstructor },
+    { "SVGTransform", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTransformConstructor), (intptr_t)setJSDOMWindowSVGTransformConstructor },
+    { "SVGTransformList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTransformListConstructor), (intptr_t)setJSDOMWindowSVGTransformListConstructor },
+    { "SVGTRefElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTRefElementConstructor), (intptr_t)setJSDOMWindowSVGTRefElementConstructor },
+    { "SVGTSpanElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTSpanElementConstructor), (intptr_t)setJSDOMWindowSVGTSpanElementConstructor },
+    { "SVGUnitTypes", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGUnitTypesConstructor), (intptr_t)setJSDOMWindowSVGUnitTypesConstructor },
+    { "SVGUseElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGUseElementConstructor), (intptr_t)setJSDOMWindowSVGUseElementConstructor },
+    { "SVGViewElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGViewElementConstructor), (intptr_t)setJSDOMWindowSVGViewElementConstructor },
+    { "SVGZoomEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGZoomEventConstructor), (intptr_t)setJSDOMWindowSVGZoomEventConstructor },
+    { "SVGComponentTransferFunctionElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGComponentTransferFunctionElementConstructor), (intptr_t)setJSDOMWindowSVGComponentTransferFunctionElementConstructor },
+    { "SVGFEBlendElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEBlendElementConstructor), (intptr_t)setJSDOMWindowSVGFEBlendElementConstructor },
+    { "SVGFEColorMatrixElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEColorMatrixElementConstructor), (intptr_t)setJSDOMWindowSVGFEColorMatrixElementConstructor },
+    { "SVGFEComponentTransferElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEComponentTransferElementConstructor), (intptr_t)setJSDOMWindowSVGFEComponentTransferElementConstructor },
+    { "SVGFECompositeElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFECompositeElementConstructor), (intptr_t)setJSDOMWindowSVGFECompositeElementConstructor },
+    { "SVGFEDiffuseLightingElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEDiffuseLightingElementConstructor), (intptr_t)setJSDOMWindowSVGFEDiffuseLightingElementConstructor },
+    { "SVGFEDisplacementMapElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEDisplacementMapElementConstructor), (intptr_t)setJSDOMWindowSVGFEDisplacementMapElementConstructor },
+    { "SVGFEDistantLightElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEDistantLightElementConstructor), (intptr_t)setJSDOMWindowSVGFEDistantLightElementConstructor },
+    { "SVGFEFloodElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEFloodElementConstructor), (intptr_t)setJSDOMWindowSVGFEFloodElementConstructor },
+    { "SVGFEFuncAElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEFuncAElementConstructor), (intptr_t)setJSDOMWindowSVGFEFuncAElementConstructor },
+    { "SVGFEFuncBElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEFuncBElementConstructor), (intptr_t)setJSDOMWindowSVGFEFuncBElementConstructor },
+    { "SVGFEFuncGElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEFuncGElementConstructor), (intptr_t)setJSDOMWindowSVGFEFuncGElementConstructor },
+    { "SVGFEFuncRElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEFuncRElementConstructor), (intptr_t)setJSDOMWindowSVGFEFuncRElementConstructor },
+    { "SVGFEGaussianBlurElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEGaussianBlurElementConstructor), (intptr_t)setJSDOMWindowSVGFEGaussianBlurElementConstructor },
+    { "SVGFEImageElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEImageElementConstructor), (intptr_t)setJSDOMWindowSVGFEImageElementConstructor },
+    { "SVGFEMergeElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEMergeElementConstructor), (intptr_t)setJSDOMWindowSVGFEMergeElementConstructor },
+    { "SVGFEMergeNodeElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEMergeNodeElementConstructor), (intptr_t)setJSDOMWindowSVGFEMergeNodeElementConstructor },
+    { "SVGFEMorphologyElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEMorphologyElementConstructor), (intptr_t)setJSDOMWindowSVGFEMorphologyElementConstructor },
+    { "SVGFEOffsetElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEOffsetElementConstructor), (intptr_t)setJSDOMWindowSVGFEOffsetElementConstructor },
+    { "SVGFEPointLightElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEPointLightElementConstructor), (intptr_t)setJSDOMWindowSVGFEPointLightElementConstructor },
+    { "SVGFESpecularLightingElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFESpecularLightingElementConstructor), (intptr_t)setJSDOMWindowSVGFESpecularLightingElementConstructor },
+    { "SVGFESpotLightElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFESpotLightElementConstructor), (intptr_t)setJSDOMWindowSVGFESpotLightElementConstructor },
+    { "SVGFETileElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFETileElementConstructor), (intptr_t)setJSDOMWindowSVGFETileElementConstructor },
+    { "SVGFETurbulenceElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFETurbulenceElementConstructor), (intptr_t)setJSDOMWindowSVGFETurbulenceElementConstructor },
+    { "SVGFilterElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFilterElementConstructor), (intptr_t)setJSDOMWindowSVGFilterElementConstructor },
+    { "TouchEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowTouchEventConstructor), (intptr_t)setJSDOMWindowTouchEventConstructor },
+    { "FormData", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowFormDataConstructor), (intptr_t)setJSDOMWindowFormDataConstructor },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSDOMWindowTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 65535, JSDOMWindowTableValues, 0 };
+    { 2097151, JSDOMWindowTableValues, 0 };
 #else
-    { 1067, 1023, JSDOMWindowTableValues, 0 };
+    { 1110, 1023, JSDOMWindowTableValues, 0 };
 #endif
 
 /* Hash table for prototype */
 
 static const HashTableValue JSDOMWindowPrototypeTableValues[37] =
 {
-    { "getSelection", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionGetSelection, (intptr_t)0 },
-    { "focus", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionFocus, (intptr_t)0 },
-    { "blur", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionBlur, (intptr_t)0 },
-    { "close", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionClose, (intptr_t)0 },
-    { "print", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionPrint, (intptr_t)0 },
-    { "stop", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionStop, (intptr_t)0 },
-    { "open", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionOpen, (intptr_t)3 },
-    { "showModalDialog", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionShowModalDialog, (intptr_t)3 },
-    { "alert", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionAlert, (intptr_t)1 },
-    { "confirm", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionConfirm, (intptr_t)1 },
-    { "prompt", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionPrompt, (intptr_t)2 },
-    { "find", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionFind, (intptr_t)7 },
-    { "scrollBy", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionScrollBy, (intptr_t)2 },
-    { "scrollTo", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionScrollTo, (intptr_t)2 },
-    { "scroll", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionScroll, (intptr_t)2 },
-    { "moveBy", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionMoveBy, (intptr_t)2 },
-    { "moveTo", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionMoveTo, (intptr_t)2 },
-    { "resizeBy", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionResizeBy, (intptr_t)2 },
-    { "resizeTo", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionResizeTo, (intptr_t)2 },
-    { "getComputedStyle", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionGetComputedStyle, (intptr_t)2 },
-    { "getMatchedCSSRules", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionGetMatchedCSSRules, (intptr_t)3 },
-    { "webkitConvertPointFromPageToNode", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionWebkitConvertPointFromPageToNode, (intptr_t)2 },
-    { "webkitConvertPointFromNodeToPage", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionWebkitConvertPointFromNodeToPage, (intptr_t)2 },
-    { "openDatabase", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionOpenDatabase, (intptr_t)4 },
-    { "postMessage", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionPostMessage, (intptr_t)3 },
-    { "setTimeout", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionSetTimeout, (intptr_t)2 },
-    { "clearTimeout", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionClearTimeout, (intptr_t)1 },
-    { "setInterval", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionSetInterval, (intptr_t)2 },
-    { "clearInterval", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionClearInterval, (intptr_t)1 },
-    { "atob", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionAtob, (intptr_t)1 },
-    { "btoa", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionBtoa, (intptr_t)1 },
-    { "addEventListener", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionDispatchEvent, (intptr_t)1 },
-    { "captureEvents", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionCaptureEvents, (intptr_t)0 },
-    { "releaseEvents", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionReleaseEvents, (intptr_t)0 },
+    { "getSelection", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionGetSelection), (intptr_t)0 },
+    { "focus", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionFocus), (intptr_t)0 },
+    { "blur", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionBlur), (intptr_t)0 },
+    { "close", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionClose), (intptr_t)0 },
+    { "print", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionPrint), (intptr_t)0 },
+    { "stop", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionStop), (intptr_t)0 },
+    { "open", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionOpen), (intptr_t)3 },
+    { "showModalDialog", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionShowModalDialog), (intptr_t)3 },
+    { "alert", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionAlert), (intptr_t)1 },
+    { "confirm", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionConfirm), (intptr_t)1 },
+    { "prompt", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionPrompt), (intptr_t)2 },
+    { "find", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionFind), (intptr_t)7 },
+    { "scrollBy", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionScrollBy), (intptr_t)2 },
+    { "scrollTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionScrollTo), (intptr_t)2 },
+    { "scroll", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionScroll), (intptr_t)2 },
+    { "moveBy", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionMoveBy), (intptr_t)2 },
+    { "moveTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionMoveTo), (intptr_t)2 },
+    { "resizeBy", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionResizeBy), (intptr_t)2 },
+    { "resizeTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionResizeTo), (intptr_t)2 },
+    { "getComputedStyle", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionGetComputedStyle), (intptr_t)2 },
+    { "getMatchedCSSRules", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionGetMatchedCSSRules), (intptr_t)3 },
+    { "webkitConvertPointFromPageToNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionWebkitConvertPointFromPageToNode), (intptr_t)2 },
+    { "webkitConvertPointFromNodeToPage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionWebkitConvertPointFromNodeToPage), (intptr_t)2 },
+    { "openDatabase", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionOpenDatabase), (intptr_t)5 },
+    { "postMessage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionPostMessage), (intptr_t)3 },
+    { "setTimeout", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionSetTimeout), (intptr_t)2 },
+    { "clearTimeout", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionClearTimeout), (intptr_t)1 },
+    { "setInterval", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionSetInterval), (intptr_t)2 },
+    { "clearInterval", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionClearInterval), (intptr_t)1 },
+    { "atob", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionAtob), (intptr_t)1 },
+    { "btoa", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionBtoa), (intptr_t)1 },
+    { "addEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionAddEventListener), (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionRemoveEventListener), (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionDispatchEvent), (intptr_t)1 },
+    { "captureEvents", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionCaptureEvents), (intptr_t)0 },
+    { "releaseEvents", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionReleaseEvents), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -665,1784 +885,2038 @@ JSDOMWindow::JSDOMWindow(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMW
 
 JSDOMWindow::~JSDOMWindow()
 {
-    impl()->invalidateEventListeners();
+    impl()->invalidateJSEventListeners(this);
 }
 
-JSValue jsDOMWindowScreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreen(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->screen()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->screen()));
+    return result;
 }
 
-JSValue jsDOMWindowHistory(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHistory(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     return castedThis->history(exec);
 }
 
-JSValue jsDOMWindowLocationbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLocationbar(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->locationbar()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->locationbar()));
+    return result;
 }
 
-JSValue jsDOMWindowMenubar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMenubar(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->menubar()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->menubar()));
+    return result;
 }
 
-JSValue jsDOMWindowPersonalbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPersonalbar(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->personalbar()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->personalbar()));
+    return result;
 }
 
-JSValue jsDOMWindowScrollbars(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScrollbars(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->scrollbars()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->scrollbars()));
+    return result;
 }
 
-JSValue jsDOMWindowStatusbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStatusbar(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->statusbar()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->statusbar()));
+    return result;
 }
 
-JSValue jsDOMWindowToolbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowToolbar(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->toolbar()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->toolbar()));
+    return result;
 }
 
-JSValue jsDOMWindowNavigator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNavigator(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->navigator()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->navigator()));
+    return result;
 }
 
-JSValue jsDOMWindowClientInformation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClientInformation(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->clientInformation()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->clientInformation()));
+    return result;
 }
 
-JSValue jsDOMWindowLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLocation(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     return castedThis->location(exec);
 }
 
-JSValue jsDOMWindowEvent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEvent(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->event(exec);
 }
 
-JSValue jsDOMWindowCrypto(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCrypto(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->crypto(exec);
 }
 
-JSValue jsDOMWindowFrameElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowFrameElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     return checkNodeSecurity(exec, imp->frameElement()) ? toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->frameElement())) : jsUndefined();
 }
 
-JSValue jsDOMWindowOffscreenBuffering(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOffscreenBuffering(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsBoolean(imp->offscreenBuffering());
+    JSValue result = jsBoolean(imp->offscreenBuffering());
+    return result;
 }
 
-JSValue jsDOMWindowOuterHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOuterHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->outerHeight());
+    JSValue result = jsNumber(exec, imp->outerHeight());
+    return result;
 }
 
-JSValue jsDOMWindowOuterWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOuterWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->outerWidth());
+    JSValue result = jsNumber(exec, imp->outerWidth());
+    return result;
 }
 
-JSValue jsDOMWindowInnerHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowInnerHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->innerHeight());
+    JSValue result = jsNumber(exec, imp->innerHeight());
+    return result;
 }
 
-JSValue jsDOMWindowInnerWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowInnerWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->innerWidth());
+    JSValue result = jsNumber(exec, imp->innerWidth());
+    return result;
 }
 
-JSValue jsDOMWindowScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->screenX());
+    JSValue result = jsNumber(exec, imp->screenX());
+    return result;
 }
 
-JSValue jsDOMWindowScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->screenY());
+    JSValue result = jsNumber(exec, imp->screenY());
+    return result;
 }
 
-JSValue jsDOMWindowScreenLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenLeft(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->screenLeft());
+    JSValue result = jsNumber(exec, imp->screenLeft());
+    return result;
 }
 
-JSValue jsDOMWindowScreenTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenTop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->screenTop());
+    JSValue result = jsNumber(exec, imp->screenTop());
+    return result;
 }
 
-JSValue jsDOMWindowScrollX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScrollX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->scrollX());
+    JSValue result = jsNumber(exec, imp->scrollX());
+    return result;
 }
 
-JSValue jsDOMWindowScrollY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScrollY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->scrollY());
+    JSValue result = jsNumber(exec, imp->scrollY());
+    return result;
 }
 
-JSValue jsDOMWindowPageXOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPageXOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->pageXOffset());
+    JSValue result = jsNumber(exec, imp->pageXOffset());
+    return result;
 }
 
-JSValue jsDOMWindowPageYOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPageYOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->pageYOffset());
+    JSValue result = jsNumber(exec, imp->pageYOffset());
+    return result;
 }
 
-JSValue jsDOMWindowClosed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClosed(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsBoolean(imp->closed());
+    JSValue result = jsBoolean(imp->closed());
+    return result;
 }
 
-JSValue jsDOMWindowLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsDOMWindowName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsDOMWindowStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStatus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsString(exec, imp->status());
+    JSValue result = jsString(exec, imp->status());
+    return result;
 }
 
-JSValue jsDOMWindowDefaultStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDefaultStatus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsString(exec, imp->defaultStatus());
+    JSValue result = jsString(exec, imp->defaultStatus());
+    return result;
 }
 
-JSValue jsDOMWindowDefaultstatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDefaultstatus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsString(exec, imp->defaultstatus());
+    JSValue result = jsString(exec, imp->defaultstatus());
+    return result;
 }
 
-JSValue jsDOMWindowSelf(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSelf(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->self()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->self()));
+    return result;
 }
 
-JSValue jsDOMWindowWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWindow(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->window()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->window()));
+    return result;
 }
 
-JSValue jsDOMWindowFrames(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowFrames(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->frames()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->frames()));
+    return result;
 }
 
-JSValue jsDOMWindowOpener(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOpener(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->opener()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->opener()));
+    return result;
 }
 
-JSValue jsDOMWindowParent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowParent(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parent()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parent()));
+    return result;
 }
 
-JSValue jsDOMWindowTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->top()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->top()));
+    return result;
 }
 
-JSValue jsDOMWindowDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocument(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->document()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->document()));
+    return result;
 }
 
-JSValue jsDOMWindowMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMedia(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    return result;
 }
 
-JSValue jsDOMWindowDevicePixelRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDevicePixelRatio(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->devicePixelRatio());
+    JSValue result = jsNumber(exec, imp->devicePixelRatio());
+    return result;
 }
 
-JSValue jsDOMWindowApplicationCache(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowApplicationCache(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->applicationCache()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->applicationCache()));
+    return result;
 }
 
-JSValue jsDOMWindowSessionStorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSessionStorage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->sessionStorage()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->sessionStorage()));
+    return result;
 }
 
-JSValue jsDOMWindowLocalStorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLocalStorage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    UNUSED_PARAM(exec);
+    ExceptionCode ec = 0;
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->localStorage()));
+    JSC::JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->localStorage(ec)));
+    setDOMException(exec, ec);
+    return result;
 }
 
-JSValue jsDOMWindowConsole(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowConsole(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->console()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->console()));
+    return result;
 }
 
-JSValue jsDOMWindowOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnabort(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onabort()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnbeforeunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnbeforeunload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforeunload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnblur(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onblur()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOncanplay(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOncanplay(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->oncanplay()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOncanplaythrough(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOncanplaythrough(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->oncanplaythrough()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnchange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onchange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnclick(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onclick()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOncontextmenu(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->oncontextmenu()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndblclick(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondblclick()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndrag(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondrag()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndragend(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondragend()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndragenter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondragenter()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndragleave(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondragleave()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndragover(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondragover()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndragstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondragstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndrop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondrop()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndurationchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndurationchange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondurationchange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnemptied(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnemptied(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onemptied()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnended(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnended(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onended()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnfocus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onfocus()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnhashchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnhashchange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onhashchange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOninput(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->oninput()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOninvalid(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOninvalid(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->oninvalid()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnkeydown(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onkeydown()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnkeypress(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onkeypress()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnkeyup(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onkeyup()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnloadeddata(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnloadeddata(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onloadeddata()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnloadedmetadata(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnloadedmetadata(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onloadedmetadata()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnloadstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnloadstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onloadstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onmessage()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmousedown(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onmousedown()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmousemove(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onmousemove()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmouseout(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseout()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmouseover(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseover()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmouseup(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseup()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmousewheel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onmousewheel()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnoffline(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnoffline(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onoffline()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnonline(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnonline(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ononline()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnpagehide(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnpagehide(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onpagehide()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnpageshow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnpageshow(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onpageshow()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnpause(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnpause(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onpause()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnplay(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnplay(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onplay()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnplaying(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnplaying(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onplaying()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnpopstate(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
+    if (EventListener* listener = imp->onpopstate()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnprogress(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onprogress()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnratechange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnratechange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onratechange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnresize(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onresize()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnscroll(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onscroll()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnseeked(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnseeked(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onseeked()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnseeking(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnseeking(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onseeking()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnselect(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onselect()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnstalled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnstalled(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onstalled()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnstorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnstorage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onstorage()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnsubmit(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onsubmit()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnsuspend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnsuspend(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onsuspend()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOntimeupdate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOntimeupdate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ontimeupdate()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnunload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onunload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnvolumechange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnvolumechange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onvolumechange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnwaiting(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnwaiting(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onwaiting()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnreset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onreset()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnsearch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onsearch()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnwebkitanimationend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnwebkitanimationend(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onwebkitanimationend()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnwebkitanimationiteration(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnwebkitanimationiteration(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onwebkitanimationiteration()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnwebkitanimationstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnwebkitanimationstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onwebkitanimationstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnwebkittransitionend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnwebkittransitionend(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onwebkittransitionend()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOntouchstart(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchstart()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOntouchmove(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchmove()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOntouchend(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchend()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOntouchcancel(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchcancel()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStyleSheetConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSStyleSheet::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSStyleSheetConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSStyleSheet::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSValueConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSValue::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSPrimitiveValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSPrimitiveValueConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSPrimitiveValue::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSValueListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSValueListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSValueList::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowWebKitCSSTransformValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSTransformValueConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSWebKitCSSTransformValue::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSCharsetRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSCharsetRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSCharsetRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSFontFaceRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSFontFaceRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSFontFaceRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSImportRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSImportRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSImportRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSMediaRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSMediaRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSMediaRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSPageRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSPageRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSPageRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSStyleRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSStyleRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSStyleRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSVariablesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSVariablesRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSVariablesRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSVariablesDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSVariablesDeclarationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSVariablesDeclaration::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSStyleDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSStyleDeclarationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSStyleDeclaration::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowMediaListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMediaListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMediaList::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCounterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCounterConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCounter::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSRuleListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSRuleListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSRuleList::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowRectConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSRect::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowRGBColorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowRGBColorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSRGBColor::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowStyleSheetListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStyleSheetListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSStyleSheetList::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowDOMExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDOMExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSDOMCoreException::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowDOMImplementationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDOMImplementationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSDOMImplementation::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowDocumentFragmentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocumentFragmentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSDocumentFragment::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocumentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSDocument::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowNodeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNodeConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSNode::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowNodeListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNodeListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSNodeList::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowNamedNodeMapConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNamedNodeMapConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSNamedNodeMap::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCharacterDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCharacterDataConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCharacterData::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowAttrConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowAttrConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSAttr::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowTextConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTextConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSText::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCommentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCommentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSComment::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCDATASectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCDATASectionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCDATASection::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowDocumentTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocumentTypeConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSDocumentType::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowNotationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNotationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSNotation::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowEntityConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEntityConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSEntity::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowEntityReferenceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEntityReferenceConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSEntityReference::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowProcessingInstructionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowProcessingInstructionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSProcessingInstruction::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDocumentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLDocument::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLAnchorElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAnchorElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLAnchorElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLAppletElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAppletElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLAppletElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAreaElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLAreaElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLBRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBRElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLBRElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLBaseElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBaseElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLBaseElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLBaseFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBaseFontElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLBaseFontElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLBlockquoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBlockquoteElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLBlockquoteElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLBodyElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBodyElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLBodyElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLButtonElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLButtonElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLButtonElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLCanvasElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLCanvasElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLCanvasElement::getConstructor(exec, castedThis);
 }
 
 #if ENABLE(DATAGRID)
-JSValue jsDOMWindowHTMLDataGridElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDataGridElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLDataGridElement::getConstructor(exec, castedThis);
@@ -2450,9 +2924,9 @@ JSValue jsDOMWindowHTMLDataGridElementConstructor(ExecState* exec, const Identif
 #endif
 
 #if ENABLE(DATAGRID)
-JSValue jsDOMWindowHTMLDataGridCellElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDataGridCellElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLDataGridCellElement::getConstructor(exec, castedThis);
@@ -2460,887 +2934,911 @@ JSValue jsDOMWindowHTMLDataGridCellElementConstructor(ExecState* exec, const Ide
 #endif
 
 #if ENABLE(DATAGRID)
-JSValue jsDOMWindowHTMLDataGridColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDataGridColElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLDataGridColElement::getConstructor(exec, castedThis);
 }
 #endif
 
-JSValue jsDOMWindowHTMLDListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDListElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLDListElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLDirectoryElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDirectoryElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLDirectoryElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLDivElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDivElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLDivElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLEmbedElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLEmbedElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLEmbedElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLFieldSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFieldSetElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLFieldSetElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFontElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLFontElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLFormElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFormElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLFormElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFrameElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLFrameElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLFrameSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFrameSetElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLFrameSetElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLHRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHRElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLHRElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLHeadElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHeadElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLHeadElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLHeadingElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHeadingElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLHeadingElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLHtmlElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHtmlElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLHtmlElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLIFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLIFrameElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLIFrameElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLImageElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLImageElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLImageElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLInputElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLInputElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLInputElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLIsIndexElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLIsIndexElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLIsIndexElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLLIElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLIElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLLIElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLLabelElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLabelElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLLabelElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLLegendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLegendElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLLegendElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLLinkElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLinkElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLLinkElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMapElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLMapElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLMarqueeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMarqueeElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLMarqueeElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLMenuElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMenuElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLMenuElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLMetaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMetaElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLMetaElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLModElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLModElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLModElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLOListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLOListElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLOListElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLObjectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLObjectElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLObjectElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLOptGroupElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLOptGroupElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLOptGroupElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLOptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLOptionElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLOptionElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLParagraphElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLParagraphElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLParagraphElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLParamElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLParamElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLParamElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLPreElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLPreElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLPreElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLQuoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLQuoteElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLQuoteElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLScriptElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLScriptElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLScriptElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLSelectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLSelectElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLSelectElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLStyleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLStyleElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLStyleElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTableCaptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableCaptionElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTableCaptionElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTableCellElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableCellElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTableCellElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTableColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableColElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTableColElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTableElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTableElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTableRowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableRowElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTableRowElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTableSectionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableSectionElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTableSectionElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTextAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTextAreaElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTextAreaElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTitleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTitleElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTitleElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLUListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLUListElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLUListElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLCollectionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLCollection::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLAllCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAllCollectionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLAllCollection::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowImageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowImageConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->image(exec);
 }
 
-JSValue jsDOMWindowOptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->option(exec);
 }
 
-JSValue jsDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCanvasRenderingContext2D::getConstructor(exec, castedThis);
 }
 
+JSValue jsDOMWindowImageDataConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSImageData::getConstructor(exec, castedThis);
+}
+
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasRenderingContext3DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLRenderingContextConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return JSCanvasRenderingContext3D::getConstructor(exec, castedThis);
+    return JSWebGLRenderingContext::getConstructor(exec, castedThis);
 }
 #endif
 
-JSValue jsDOMWindowTextMetricsConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTextMetricsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSTextMetrics::getConstructor(exec, castedThis);
 }
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasArrayBufferConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLArrayBufferConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasArrayBuffer(exec);
+    return castedThis->webGLArrayBuffer(exec);
 }
 #endif
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasByteArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLByteArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasByteArray(exec);
+    return castedThis->webGLByteArray(exec);
 }
 #endif
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasUnsignedByteArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLUnsignedByteArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasUnsignedByteArray(exec);
+    return castedThis->webGLUnsignedByteArray(exec);
 }
 #endif
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasShortArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLShortArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasShortArray(exec);
+    return castedThis->webGLShortArray(exec);
 }
 #endif
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasUnsignedShortArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLUnsignedShortArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasUnsignedShortArray(exec);
+    return castedThis->webGLUnsignedShortArray(exec);
 }
 #endif
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasIntArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLIntArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasIntArray(exec);
+    return castedThis->webGLIntArray(exec);
 }
 #endif
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasUnsignedIntArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLUnsignedIntArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasUnsignedIntArray(exec);
+    return castedThis->webGLUnsignedIntArray(exec);
 }
 #endif
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasFloatArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLFloatArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasFloatArray(exec);
+    return castedThis->webGLFloatArray(exec);
 }
 #endif
 
-JSValue jsDOMWindowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowBeforeLoadEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowBeforeLoadEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSBeforeLoadEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowKeyboardEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowKeyboardEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSKeyboardEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowMouseEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMouseEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMouseEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowMutationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMutationEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMutationEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowOverflowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOverflowEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSOverflowEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowPageTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPageTransitionEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSPageTransitionEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowProgressEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSProgressEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowTextEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTextEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSTextEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowUIEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowUIEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSUIEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowWebKitAnimationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitAnimationEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSWebKitAnimationEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowWebKitTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitTransitionEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSWebKitTransitionEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowWheelEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWheelEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSWheelEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMessageEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMessageEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowEventExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEventExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSEventException::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowWebKitCSSKeyframeRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSKeyframeRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSWebKitCSSKeyframeRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowWebKitCSSKeyframesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSKeyframesRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSWebKitCSSKeyframesRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowWebKitCSSMatrixConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSMatrixConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->webKitCSSMatrix(exec);
 }
 
-JSValue jsDOMWindowWebKitPointConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitPointConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->webKitPoint(exec);
 }
 
-JSValue jsDOMWindowClipboardConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClipboardConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSClipboard::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowFileConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowFileConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSFile::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowFileListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowFileListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSFileList::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowNodeFilterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowBlobConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSBlob::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowNodeFilterConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSNodeFilter::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowRangeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowRangeConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSRange::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowRangeExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowRangeExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSRangeException::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowEventSourceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEventSourceConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->eventSource(exec);
 }
 
-JSValue jsDOMWindowXMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLDocumentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSDocument::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowDOMParserConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDOMParserConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSDOMParser::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowXMLSerializerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLSerializerConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSXMLSerializer::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowXMLHttpRequestConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLHttpRequestConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->xmlHttpRequest(exec);
 }
 
-JSValue jsDOMWindowXMLHttpRequestUploadConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLHttpRequestUploadConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSXMLHttpRequestUpload::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowXMLHttpRequestExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLHttpRequestExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSXMLHttpRequestException::getConstructor(exec, castedThis);
 }
 
 #if ENABLE(XSLT)
-JSValue jsDOMWindowXSLTProcessorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXSLTProcessorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->xsltProcessor(exec);
 }
 #endif
 
-JSValue jsDOMWindowMessagePortConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMessagePortConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMessagePort::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowMessageChannelConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMessageChannelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->messageChannel(exec);
 }
 
-JSValue jsDOMWindowWorkerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWorkerConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->worker(exec);
 }
 
-JSValue jsDOMWindowSharedWorkerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSharedWorkerConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->sharedWorker(exec);
 }
 
-JSValue jsDOMWindowPluginConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebSocketConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThis->webSocket(exec);
+}
+
+JSValue jsDOMWindowPluginConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSPlugin::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowPluginArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPluginArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSPluginArray::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowMimeTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMimeTypeConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMimeType::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowMimeTypeArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMimeTypeArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMimeTypeArray::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowClientRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClientRectConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSClientRect::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowClientRectListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClientRectListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSClientRectList::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowStorageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStorageConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSStorage::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowStorageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStorageEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSStorageEvent::getConstructor(exec, castedThis);
 }
 
 #if ENABLE(VIDEO)
-JSValue jsDOMWindowAudioConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowAudioConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->audio(exec);
@@ -3348,9 +3846,9 @@ JSValue jsDOMWindowAudioConstructor(ExecState* exec, const Identifier&, const Pr
 #endif
 
 #if ENABLE(VIDEO)
-JSValue jsDOMWindowHTMLAudioElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAudioElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLAudioElement::getConstructor(exec, castedThis);
@@ -3358,9 +3856,9 @@ JSValue jsDOMWindowHTMLAudioElementConstructor(ExecState* exec, const Identifier
 #endif
 
 #if ENABLE(VIDEO)
-JSValue jsDOMWindowHTMLMediaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMediaElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLMediaElement::getConstructor(exec, castedThis);
@@ -3368,9 +3866,9 @@ JSValue jsDOMWindowHTMLMediaElementConstructor(ExecState* exec, const Identifier
 #endif
 
 #if ENABLE(VIDEO)
-JSValue jsDOMWindowHTMLVideoElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLVideoElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLVideoElement::getConstructor(exec, castedThis);
@@ -3378,151 +3876,991 @@ JSValue jsDOMWindowHTMLVideoElementConstructor(ExecState* exec, const Identifier
 #endif
 
 #if ENABLE(VIDEO)
-JSValue jsDOMWindowMediaErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMediaErrorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMediaError::getConstructor(exec, castedThis);
 }
 #endif
 
-JSValue jsDOMWindowXPathEvaluatorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXPathEvaluatorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSXPathEvaluator::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowXPathResultConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXPathResultConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSXPathResult::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowXPathExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXPathExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSXPathException::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGAngleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGAElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAngleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGAngle::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGColorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGAnimatedAngleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedAngle::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedBooleanConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedBoolean::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedEnumerationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedEnumeration::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedIntegerConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedInteger::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedLengthConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedLength::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedLengthListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedLengthList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedNumberConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedNumber::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedNumberListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedNumberList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedPreserveAspectRatioConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedPreserveAspectRatio::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedRectConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedRect::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedStringConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedString::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedTransformListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedTransformList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGCircleElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGCircleElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGClipPathElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGClipPathElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGColorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGColor::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGCursorElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGCursorElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGDefsElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGDefsElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGDescElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGDescElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGDocumentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGDocument::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGElementInstanceConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGElementInstance::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGElementInstanceListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGElementInstanceList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGEllipseElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGEllipseElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGException::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGGradientElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGGElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGGElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGGradientElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGGradientElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGLengthConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGImageElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGImageElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGLengthConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGLength::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGMarkerElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGLengthListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGLengthList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGLinearGradientElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGLinearGradientElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGLineElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGLineElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGMarkerElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGMarkerElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGPaintConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGMaskElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGMaskElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGMatrixConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGMatrix::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGMetadataElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGMetadataElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGNumberConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGNumber::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGNumberListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGNumberList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPaintConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGPaint::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGPathSegConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGPathElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGPathSeg::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGPathSegArcAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegArcAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegArcRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegArcRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegClosePathConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegClosePath::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoCubicAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoCubicAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoCubicRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoCubicRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoCubicSmoothAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoCubicSmoothAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoCubicSmoothRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoCubicSmoothRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoQuadraticAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoQuadraticAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoQuadraticRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoQuadraticRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoQuadraticSmoothAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoQuadraticSmoothAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoQuadraticSmoothRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoQuadraticSmoothRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegLinetoAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegLinetoAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegLinetoHorizontalAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegLinetoHorizontalAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegLinetoHorizontalRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegLinetoHorizontalRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegLinetoRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegLinetoRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegLinetoVerticalAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegLinetoVerticalAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegLinetoVerticalRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegLinetoVerticalRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegMovetoAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegMovetoAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegMovetoRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegMovetoRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPatternElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPatternElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPointConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPoint::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPointListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPointList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPolygonElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPolygonElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPolylineElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPolylineElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGPreserveAspectRatio::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGRenderingIntentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGRadialGradientElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGRadialGradientElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGRectConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGRect::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGRectElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGRectElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGRenderingIntentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGRenderingIntent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGTextContentElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGScriptElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGScriptElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGStopElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGStopElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGStringListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGStringList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGStyleElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGStyleElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGSVGElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGSVGElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGSwitchElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGSwitchElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGSymbolElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGSymbolElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGTextContentElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGTextContentElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGTextPathElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGTextElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGTextElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGTextPathElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGTextPathElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGTransformConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGTextPositioningElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGTextPositioningElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGTitleElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGTitleElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGTransformConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGTransform::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGUnitTypesConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGTransformListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGTransformList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGTRefElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGTRefElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGTSpanElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGTSpanElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGUnitTypesConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGUnitTypes::getConstructor(exec, castedThis);
 }
 
+JSValue jsDOMWindowSVGUseElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGUseElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGViewElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGViewElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGZoomEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGZoomEvent::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGComponentTransferFunctionElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGComponentTransferFunctionElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEBlendElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEBlendElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEColorMatrixElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEColorMatrixElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEComponentTransferElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEComponentTransferElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFECompositeElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFECompositeElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEDiffuseLightingElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEDiffuseLightingElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEDisplacementMapElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEDisplacementMapElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEDistantLightElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEDistantLightElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEFloodElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEFloodElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEFuncAElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEFuncAElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEFuncBElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEFuncBElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEFuncGElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEFuncGElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEFuncRElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEFuncRElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEGaussianBlurElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEGaussianBlurElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEImageElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEImageElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEMergeElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEMergeElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEMergeNodeElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEMergeNodeElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEMorphologyElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEMorphologyElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEOffsetElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEOffsetElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEPointLightElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEPointLightElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFESpecularLightingElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFESpecularLightingElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFESpotLightElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFESpotLightElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFETileElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFETileElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFETurbulenceElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFETurbulenceElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFilterElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFilterElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowTouchEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSTouchEvent::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowFormDataConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSDOMFormData::getConstructor(exec, castedThis);
+}
+
 void setJSDOMWindowLocationbar(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -3700,7 +5038,8 @@ void setJSDOMWindowName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
-    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMWindow* castedThisObj = static_cast<JSDOMWindow*>(thisObject);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     imp->setName(value.toString(exec));
 }
 
@@ -3708,7 +5047,8 @@ void setJSDOMWindowStatus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
-    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMWindow* castedThisObj = static_cast<JSDOMWindow*>(thisObject);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     imp->setStatus(value.toString(exec));
 }
 
@@ -3716,7 +5056,8 @@ void setJSDOMWindowDefaultStatus(ExecState* exec, JSObject* thisObject, JSValue
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
-    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMWindow* castedThisObj = static_cast<JSDOMWindow*>(thisObject);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     imp->setDefaultStatus(value.toString(exec));
 }
 
@@ -3724,7 +5065,8 @@ void setJSDOMWindowDefaultstatus(ExecState* exec, JSObject* thisObject, JSValue
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
-    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMWindow* castedThisObj = static_cast<JSDOMWindow*>(thisObject);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     imp->setDefaultstatus(value.toString(exec));
 }
 
@@ -3790,8 +5132,7 @@ void setJSDOMWindowOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
+    imp->setOnabort(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnbeforeunload(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3800,8 +5141,7 @@ void setJSDOMWindowOnbeforeunload(ExecState* exec, JSObject* thisObject, JSValue
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnbeforeunload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforeunload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3810,8 +5150,7 @@ void setJSDOMWindowOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnblur(globalObject->createJSAttributeEventListener(value));
+    imp->setOnblur(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOncanplay(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3820,8 +5159,7 @@ void setJSDOMWindowOncanplay(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOncanplay(globalObject->createJSAttributeEventListener(value));
+    imp->setOncanplay(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOncanplaythrough(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3830,8 +5168,7 @@ void setJSDOMWindowOncanplaythrough(ExecState* exec, JSObject* thisObject, JSVal
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOncanplaythrough(globalObject->createJSAttributeEventListener(value));
+    imp->setOncanplaythrough(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3840,8 +5177,7 @@ void setJSDOMWindowOnchange(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnchange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnchange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3850,8 +5186,7 @@ void setJSDOMWindowOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnclick(globalObject->createJSAttributeEventListener(value));
+    imp->setOnclick(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3860,8 +5195,7 @@ void setJSDOMWindowOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
+    imp->setOncontextmenu(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndblclick(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3870,8 +5204,7 @@ void setJSDOMWindowOndblclick(ExecState* exec, JSObject* thisObject, JSValue val
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
+    imp->setOndblclick(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3880,8 +5213,7 @@ void setJSDOMWindowOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndrag(globalObject->createJSAttributeEventListener(value));
+    imp->setOndrag(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndragend(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3890,8 +5222,7 @@ void setJSDOMWindowOndragend(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndragend(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragend(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndragenter(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3900,8 +5231,7 @@ void setJSDOMWindowOndragenter(ExecState* exec, JSObject* thisObject, JSValue va
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragenter(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndragleave(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3910,8 +5240,7 @@ void setJSDOMWindowOndragleave(ExecState* exec, JSObject* thisObject, JSValue va
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragleave(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndragover(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3920,8 +5249,7 @@ void setJSDOMWindowOndragover(ExecState* exec, JSObject* thisObject, JSValue val
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndragover(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragover(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndragstart(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3930,8 +5258,7 @@ void setJSDOMWindowOndragstart(ExecState* exec, JSObject* thisObject, JSValue va
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragstart(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3940,8 +5267,7 @@ void setJSDOMWindowOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndrop(globalObject->createJSAttributeEventListener(value));
+    imp->setOndrop(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndurationchange(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3950,8 +5276,7 @@ void setJSDOMWindowOndurationchange(ExecState* exec, JSObject* thisObject, JSVal
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndurationchange(globalObject->createJSAttributeEventListener(value));
+    imp->setOndurationchange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnemptied(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3960,8 +5285,7 @@ void setJSDOMWindowOnemptied(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnemptied(globalObject->createJSAttributeEventListener(value));
+    imp->setOnemptied(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnended(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3970,8 +5294,7 @@ void setJSDOMWindowOnended(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnended(globalObject->createJSAttributeEventListener(value));
+    imp->setOnended(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3980,8 +5303,7 @@ void setJSDOMWindowOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3990,8 +5312,7 @@ void setJSDOMWindowOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
+    imp->setOnfocus(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnhashchange(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4000,8 +5321,7 @@ void setJSDOMWindowOnhashchange(ExecState* exec, JSObject* thisObject, JSValue v
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnhashchange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnhashchange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOninput(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4010,8 +5330,7 @@ void setJSDOMWindowOninput(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOninput(globalObject->createJSAttributeEventListener(value));
+    imp->setOninput(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOninvalid(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4020,8 +5339,7 @@ void setJSDOMWindowOninvalid(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOninvalid(globalObject->createJSAttributeEventListener(value));
+    imp->setOninvalid(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4030,8 +5348,7 @@ void setJSDOMWindowOnkeydown(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeydown(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnkeypress(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4040,8 +5357,7 @@ void setJSDOMWindowOnkeypress(ExecState* exec, JSObject* thisObject, JSValue val
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeypress(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4050,8 +5366,7 @@ void setJSDOMWindowOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeyup(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnload(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4060,8 +5375,7 @@ void setJSDOMWindowOnload(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnloadeddata(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4070,8 +5384,7 @@ void setJSDOMWindowOnloadeddata(ExecState* exec, JSObject* thisObject, JSValue v
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnloadeddata(globalObject->createJSAttributeEventListener(value));
+    imp->setOnloadeddata(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnloadedmetadata(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4080,8 +5393,7 @@ void setJSDOMWindowOnloadedmetadata(ExecState* exec, JSObject* thisObject, JSVal
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnloadedmetadata(globalObject->createJSAttributeEventListener(value));
+    imp->setOnloadedmetadata(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnloadstart(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4090,8 +5402,7 @@ void setJSDOMWindowOnloadstart(ExecState* exec, JSObject* thisObject, JSValue va
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnloadstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOnloadstart(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4100,8 +5411,7 @@ void setJSDOMWindowOnmessage(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmessage(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnmousedown(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4110,8 +5420,7 @@ void setJSDOMWindowOnmousedown(ExecState* exec, JSObject* thisObject, JSValue va
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousedown(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnmousemove(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4120,8 +5429,7 @@ void setJSDOMWindowOnmousemove(ExecState* exec, JSObject* thisObject, JSValue va
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousemove(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnmouseout(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4130,8 +5438,7 @@ void setJSDOMWindowOnmouseout(ExecState* exec, JSObject* thisObject, JSValue val
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseout(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnmouseover(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4140,8 +5447,7 @@ void setJSDOMWindowOnmouseover(ExecState* exec, JSObject* thisObject, JSValue va
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseover(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4150,8 +5456,7 @@ void setJSDOMWindowOnmouseup(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseup(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4160,8 +5465,7 @@ void setJSDOMWindowOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue v
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousewheel(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnoffline(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4170,8 +5474,7 @@ void setJSDOMWindowOnoffline(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnoffline(globalObject->createJSAttributeEventListener(value));
+    imp->setOnoffline(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnonline(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4180,8 +5483,7 @@ void setJSDOMWindowOnonline(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnonline(globalObject->createJSAttributeEventListener(value));
+    imp->setOnonline(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnpagehide(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4190,8 +5492,7 @@ void setJSDOMWindowOnpagehide(ExecState* exec, JSObject* thisObject, JSValue val
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnpagehide(globalObject->createJSAttributeEventListener(value));
+    imp->setOnpagehide(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnpageshow(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4200,8 +5501,7 @@ void setJSDOMWindowOnpageshow(ExecState* exec, JSObject* thisObject, JSValue val
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnpageshow(globalObject->createJSAttributeEventListener(value));
+    imp->setOnpageshow(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnpause(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4210,8 +5510,7 @@ void setJSDOMWindowOnpause(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnpause(globalObject->createJSAttributeEventListener(value));
+    imp->setOnpause(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnplay(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4220,8 +5519,7 @@ void setJSDOMWindowOnplay(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnplay(globalObject->createJSAttributeEventListener(value));
+    imp->setOnplay(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnplaying(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4230,8 +5528,16 @@ void setJSDOMWindowOnplaying(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnplaying(globalObject->createJSAttributeEventListener(value));
+    imp->setOnplaying(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSDOMWindowOnpopstate(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    imp->setOnpopstate(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnprogress(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4240,8 +5546,7 @@ void setJSDOMWindowOnprogress(ExecState* exec, JSObject* thisObject, JSValue val
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
+    imp->setOnprogress(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnratechange(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4250,8 +5555,7 @@ void setJSDOMWindowOnratechange(ExecState* exec, JSObject* thisObject, JSValue v
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnratechange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnratechange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnresize(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4260,8 +5564,7 @@ void setJSDOMWindowOnresize(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnresize(globalObject->createJSAttributeEventListener(value));
+    imp->setOnresize(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4270,8 +5573,7 @@ void setJSDOMWindowOnscroll(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
+    imp->setOnscroll(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnseeked(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4280,8 +5582,7 @@ void setJSDOMWindowOnseeked(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnseeked(globalObject->createJSAttributeEventListener(value));
+    imp->setOnseeked(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnseeking(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4290,8 +5591,7 @@ void setJSDOMWindowOnseeking(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnseeking(globalObject->createJSAttributeEventListener(value));
+    imp->setOnseeking(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4300,8 +5600,7 @@ void setJSDOMWindowOnselect(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnselect(globalObject->createJSAttributeEventListener(value));
+    imp->setOnselect(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnstalled(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4310,8 +5609,7 @@ void setJSDOMWindowOnstalled(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnstalled(globalObject->createJSAttributeEventListener(value));
+    imp->setOnstalled(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnstorage(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4320,8 +5618,7 @@ void setJSDOMWindowOnstorage(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnstorage(globalObject->createJSAttributeEventListener(value));
+    imp->setOnstorage(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4330,8 +5627,7 @@ void setJSDOMWindowOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsubmit(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnsuspend(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4340,8 +5636,7 @@ void setJSDOMWindowOnsuspend(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnsuspend(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsuspend(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOntimeupdate(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4350,8 +5645,7 @@ void setJSDOMWindowOntimeupdate(ExecState* exec, JSObject* thisObject, JSValue v
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOntimeupdate(globalObject->createJSAttributeEventListener(value));
+    imp->setOntimeupdate(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnunload(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4360,8 +5654,7 @@ void setJSDOMWindowOnunload(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnunload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnunload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnvolumechange(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4370,8 +5663,7 @@ void setJSDOMWindowOnvolumechange(ExecState* exec, JSObject* thisObject, JSValue
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnvolumechange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnvolumechange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnwaiting(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4380,8 +5672,7 @@ void setJSDOMWindowOnwaiting(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwaiting(globalObject->createJSAttributeEventListener(value));
+    imp->setOnwaiting(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4390,8 +5681,7 @@ void setJSDOMWindowOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnreset(globalObject->createJSAttributeEventListener(value));
+    imp->setOnreset(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4400,8 +5690,7 @@ void setJSDOMWindowOnsearch(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsearch(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnwebkitanimationend(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4410,8 +5699,7 @@ void setJSDOMWindowOnwebkitanimationend(ExecState* exec, JSObject* thisObject, J
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkitanimationend(globalObject->createJSAttributeEventListener(value));
+    imp->setOnwebkitanimationend(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnwebkitanimationiteration(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4420,8 +5708,7 @@ void setJSDOMWindowOnwebkitanimationiteration(ExecState* exec, JSObject* thisObj
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkitanimationiteration(globalObject->createJSAttributeEventListener(value));
+    imp->setOnwebkitanimationiteration(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnwebkitanimationstart(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4430,8 +5717,7 @@ void setJSDOMWindowOnwebkitanimationstart(ExecState* exec, JSObject* thisObject,
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkitanimationstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOnwebkitanimationstart(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnwebkittransitionend(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4440,8 +5726,43 @@ void setJSDOMWindowOnwebkittransitionend(ExecState* exec, JSObject* thisObject,
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkittransitionend(globalObject->createJSAttributeEventListener(value));
+    imp->setOnwebkittransitionend(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSDOMWindowOntouchstart(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    imp->setOntouchstart(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSDOMWindowOntouchmove(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    imp->setOntouchmove(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSDOMWindowOntouchend(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    imp->setOntouchend(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSDOMWindowOntouchcancel(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    imp->setOntouchcancel(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowStyleSheetConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -5292,12 +6613,20 @@ void setJSDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, JSObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasRenderingContext2D"), value);
 }
 
-void setJSDOMWindowCanvasRenderingContext3DConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+void setJSDOMWindowImageDataConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasRenderingContext3D"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "ImageData"), value);
+}
+
+void setJSDOMWindowWebGLRenderingContextConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLRenderingContext"), value);
 }
 
 void setJSDOMWindowTextMetricsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -5308,68 +6637,68 @@ void setJSDOMWindowTextMetricsConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "TextMetrics"), value);
 }
 
-void setJSDOMWindowCanvasArrayBufferConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+void setJSDOMWindowWebGLArrayBufferConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasArrayBuffer"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLArrayBuffer"), value);
 }
 
-void setJSDOMWindowCanvasByteArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+void setJSDOMWindowWebGLByteArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasByteArray"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLByteArray"), value);
 }
 
-void setJSDOMWindowCanvasUnsignedByteArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+void setJSDOMWindowWebGLUnsignedByteArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasUnsignedByteArray"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLUnsignedByteArray"), value);
 }
 
-void setJSDOMWindowCanvasShortArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+void setJSDOMWindowWebGLShortArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasShortArray"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLShortArray"), value);
 }
 
-void setJSDOMWindowCanvasUnsignedShortArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+void setJSDOMWindowWebGLUnsignedShortArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasUnsignedShortArray"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLUnsignedShortArray"), value);
 }
 
-void setJSDOMWindowCanvasIntArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+void setJSDOMWindowWebGLIntArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasIntArray"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLIntArray"), value);
 }
 
-void setJSDOMWindowCanvasUnsignedIntArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+void setJSDOMWindowWebGLUnsignedIntArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasUnsignedIntArray"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLUnsignedIntArray"), value);
 }
 
-void setJSDOMWindowCanvasFloatArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+void setJSDOMWindowWebGLFloatArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasFloatArray"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLFloatArray"), value);
 }
 
 void setJSDOMWindowEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -5548,6 +6877,14 @@ void setJSDOMWindowFileListConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "FileList"), value);
 }
 
+void setJSDOMWindowBlobConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Blob"), value);
+}
+
 void setJSDOMWindowNodeFilterConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5668,6 +7005,14 @@ void setJSDOMWindowSharedWorkerConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SharedWorker"), value);
 }
 
+void setJSDOMWindowWebSocketConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebSocket"), value);
+}
+
 void setJSDOMWindowPluginConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5796,6 +7141,14 @@ void setJSDOMWindowXPathExceptionConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XPathException"), value);
 }
 
+void setJSDOMWindowSVGAElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAElement"), value);
+}
+
 void setJSDOMWindowSVGAngleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5804,6 +7157,118 @@ void setJSDOMWindowSVGAngleConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAngle"), value);
 }
 
+void setJSDOMWindowSVGAnimatedAngleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedAngle"), value);
+}
+
+void setJSDOMWindowSVGAnimatedBooleanConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedBoolean"), value);
+}
+
+void setJSDOMWindowSVGAnimatedEnumerationConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedEnumeration"), value);
+}
+
+void setJSDOMWindowSVGAnimatedIntegerConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedInteger"), value);
+}
+
+void setJSDOMWindowSVGAnimatedLengthConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedLength"), value);
+}
+
+void setJSDOMWindowSVGAnimatedLengthListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedLengthList"), value);
+}
+
+void setJSDOMWindowSVGAnimatedNumberConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedNumber"), value);
+}
+
+void setJSDOMWindowSVGAnimatedNumberListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedNumberList"), value);
+}
+
+void setJSDOMWindowSVGAnimatedPreserveAspectRatioConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedPreserveAspectRatio"), value);
+}
+
+void setJSDOMWindowSVGAnimatedRectConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedRect"), value);
+}
+
+void setJSDOMWindowSVGAnimatedStringConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedString"), value);
+}
+
+void setJSDOMWindowSVGAnimatedTransformListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedTransformList"), value);
+}
+
+void setJSDOMWindowSVGCircleElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGCircleElement"), value);
+}
+
+void setJSDOMWindowSVGClipPathElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGClipPathElement"), value);
+}
+
 void setJSDOMWindowSVGColorConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5812,6 +7277,70 @@ void setJSDOMWindowSVGColorConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGColor"), value);
 }
 
+void setJSDOMWindowSVGCursorElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGCursorElement"), value);
+}
+
+void setJSDOMWindowSVGDefsElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGDefsElement"), value);
+}
+
+void setJSDOMWindowSVGDescElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGDescElement"), value);
+}
+
+void setJSDOMWindowSVGDocumentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGDocument"), value);
+}
+
+void setJSDOMWindowSVGElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGElement"), value);
+}
+
+void setJSDOMWindowSVGElementInstanceConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGElementInstance"), value);
+}
+
+void setJSDOMWindowSVGElementInstanceListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGElementInstanceList"), value);
+}
+
+void setJSDOMWindowSVGEllipseElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGEllipseElement"), value);
+}
+
 void setJSDOMWindowSVGExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5820,6 +7349,14 @@ void setJSDOMWindowSVGExceptionConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGException"), value);
 }
 
+void setJSDOMWindowSVGGElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGGElement"), value);
+}
+
 void setJSDOMWindowSVGGradientElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5828,6 +7365,14 @@ void setJSDOMWindowSVGGradientElementConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGGradientElement"), value);
 }
 
+void setJSDOMWindowSVGImageElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGImageElement"), value);
+}
+
 void setJSDOMWindowSVGLengthConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5836,6 +7381,30 @@ void setJSDOMWindowSVGLengthConstructor(ExecState* exec, JSObject* thisObject, J
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGLength"), value);
 }
 
+void setJSDOMWindowSVGLengthListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGLengthList"), value);
+}
+
+void setJSDOMWindowSVGLinearGradientElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGLinearGradientElement"), value);
+}
+
+void setJSDOMWindowSVGLineElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGLineElement"), value);
+}
+
 void setJSDOMWindowSVGMarkerElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5844,6 +7413,46 @@ void setJSDOMWindowSVGMarkerElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGMarkerElement"), value);
 }
 
+void setJSDOMWindowSVGMaskElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGMaskElement"), value);
+}
+
+void setJSDOMWindowSVGMatrixConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGMatrix"), value);
+}
+
+void setJSDOMWindowSVGMetadataElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGMetadataElement"), value);
+}
+
+void setJSDOMWindowSVGNumberConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGNumber"), value);
+}
+
+void setJSDOMWindowSVGNumberListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGNumberList"), value);
+}
+
 void setJSDOMWindowSVGPaintConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5852,6 +7461,14 @@ void setJSDOMWindowSVGPaintConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPaint"), value);
 }
 
+void setJSDOMWindowSVGPathElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathElement"), value);
+}
+
 void setJSDOMWindowSVGPathSegConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5860,6 +7477,206 @@ void setJSDOMWindowSVGPathSegConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSeg"), value);
 }
 
+void setJSDOMWindowSVGPathSegArcAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegArcAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegArcRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegArcRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegClosePathConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegClosePath"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoCubicAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoCubicAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoCubicRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoCubicRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoCubicSmoothAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoCubicSmoothAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoCubicSmoothRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoCubicSmoothRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoQuadraticAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoQuadraticAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoQuadraticRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoQuadraticRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoQuadraticSmoothAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoQuadraticSmoothAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoQuadraticSmoothRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoQuadraticSmoothRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegLinetoAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegLinetoAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegLinetoHorizontalAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegLinetoHorizontalAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegLinetoHorizontalRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegLinetoHorizontalRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegLinetoRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegLinetoRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegLinetoVerticalAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegLinetoVerticalAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegLinetoVerticalRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegLinetoVerticalRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegList"), value);
+}
+
+void setJSDOMWindowSVGPathSegMovetoAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegMovetoAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegMovetoRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegMovetoRel"), value);
+}
+
+void setJSDOMWindowSVGPatternElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPatternElement"), value);
+}
+
+void setJSDOMWindowSVGPointConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPoint"), value);
+}
+
+void setJSDOMWindowSVGPointListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPointList"), value);
+}
+
+void setJSDOMWindowSVGPolygonElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPolygonElement"), value);
+}
+
+void setJSDOMWindowSVGPolylineElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPolylineElement"), value);
+}
+
 void setJSDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5868,6 +7685,30 @@ void setJSDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPreserveAspectRatio"), value);
 }
 
+void setJSDOMWindowSVGRadialGradientElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGRadialGradientElement"), value);
+}
+
+void setJSDOMWindowSVGRectConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGRect"), value);
+}
+
+void setJSDOMWindowSVGRectElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGRectElement"), value);
+}
+
 void setJSDOMWindowSVGRenderingIntentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5876,6 +7717,62 @@ void setJSDOMWindowSVGRenderingIntentConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGRenderingIntent"), value);
 }
 
+void setJSDOMWindowSVGScriptElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGScriptElement"), value);
+}
+
+void setJSDOMWindowSVGStopElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGStopElement"), value);
+}
+
+void setJSDOMWindowSVGStringListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGStringList"), value);
+}
+
+void setJSDOMWindowSVGStyleElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGStyleElement"), value);
+}
+
+void setJSDOMWindowSVGSVGElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGSVGElement"), value);
+}
+
+void setJSDOMWindowSVGSwitchElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGSwitchElement"), value);
+}
+
+void setJSDOMWindowSVGSymbolElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGSymbolElement"), value);
+}
+
 void setJSDOMWindowSVGTextContentElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5884,6 +7781,14 @@ void setJSDOMWindowSVGTextContentElementConstructor(ExecState* exec, JSObject* t
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTextContentElement"), value);
 }
 
+void setJSDOMWindowSVGTextElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTextElement"), value);
+}
+
 void setJSDOMWindowSVGTextPathElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5892,6 +7797,22 @@ void setJSDOMWindowSVGTextPathElementConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTextPathElement"), value);
 }
 
+void setJSDOMWindowSVGTextPositioningElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTextPositioningElement"), value);
+}
+
+void setJSDOMWindowSVGTitleElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTitleElement"), value);
+}
+
 void setJSDOMWindowSVGTransformConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5900,6 +7821,30 @@ void setJSDOMWindowSVGTransformConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTransform"), value);
 }
 
+void setJSDOMWindowSVGTransformListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTransformList"), value);
+}
+
+void setJSDOMWindowSVGTRefElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTRefElement"), value);
+}
+
+void setJSDOMWindowSVGTSpanElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTSpanElement"), value);
+}
+
 void setJSDOMWindowSVGUnitTypesConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5908,6 +7853,246 @@ void setJSDOMWindowSVGUnitTypesConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGUnitTypes"), value);
 }
 
+void setJSDOMWindowSVGUseElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGUseElement"), value);
+}
+
+void setJSDOMWindowSVGViewElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGViewElement"), value);
+}
+
+void setJSDOMWindowSVGZoomEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGZoomEvent"), value);
+}
+
+void setJSDOMWindowSVGComponentTransferFunctionElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGComponentTransferFunctionElement"), value);
+}
+
+void setJSDOMWindowSVGFEBlendElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEBlendElement"), value);
+}
+
+void setJSDOMWindowSVGFEColorMatrixElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEColorMatrixElement"), value);
+}
+
+void setJSDOMWindowSVGFEComponentTransferElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEComponentTransferElement"), value);
+}
+
+void setJSDOMWindowSVGFECompositeElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFECompositeElement"), value);
+}
+
+void setJSDOMWindowSVGFEDiffuseLightingElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEDiffuseLightingElement"), value);
+}
+
+void setJSDOMWindowSVGFEDisplacementMapElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEDisplacementMapElement"), value);
+}
+
+void setJSDOMWindowSVGFEDistantLightElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEDistantLightElement"), value);
+}
+
+void setJSDOMWindowSVGFEFloodElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEFloodElement"), value);
+}
+
+void setJSDOMWindowSVGFEFuncAElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEFuncAElement"), value);
+}
+
+void setJSDOMWindowSVGFEFuncBElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEFuncBElement"), value);
+}
+
+void setJSDOMWindowSVGFEFuncGElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEFuncGElement"), value);
+}
+
+void setJSDOMWindowSVGFEFuncRElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEFuncRElement"), value);
+}
+
+void setJSDOMWindowSVGFEGaussianBlurElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEGaussianBlurElement"), value);
+}
+
+void setJSDOMWindowSVGFEImageElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEImageElement"), value);
+}
+
+void setJSDOMWindowSVGFEMergeElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEMergeElement"), value);
+}
+
+void setJSDOMWindowSVGFEMergeNodeElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEMergeNodeElement"), value);
+}
+
+void setJSDOMWindowSVGFEMorphologyElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEMorphologyElement"), value);
+}
+
+void setJSDOMWindowSVGFEOffsetElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEOffsetElement"), value);
+}
+
+void setJSDOMWindowSVGFEPointLightElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEPointLightElement"), value);
+}
+
+void setJSDOMWindowSVGFESpecularLightingElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFESpecularLightingElement"), value);
+}
+
+void setJSDOMWindowSVGFESpotLightElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFESpotLightElement"), value);
+}
+
+void setJSDOMWindowSVGFETileElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFETileElement"), value);
+}
+
+void setJSDOMWindowSVGFETurbulenceElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFETurbulenceElement"), value);
+}
+
+void setJSDOMWindowSVGFilterElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFilterElement"), value);
+}
+
+void setJSDOMWindowTouchEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "TouchEvent"), value);
+}
+
+void setJSDOMWindowFormDataConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "FormData"), value);
+}
+
 JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionGetSelection(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -6290,17 +8475,7 @@ JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionOpenDatabase(ExecState* exec,
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
-    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    const UString& name = args.at(0).toString(exec);
-    const UString& version = args.at(1).toString(exec);
-    const UString& displayName = args.at(2).toString(exec);
-    unsigned estimatedSize = args.at(3).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->openDatabase(name, version, displayName, estimatedSize, ec)));
-    setDOMException(exec, ec);
-    return result;
+    return castedThisObj->openDatabase(exec, args);
 }
 
 JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -6372,7 +8547,14 @@ JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAtob(ExecState* exec, JSObject
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThisObj->atob(exec, args);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    const UString& string = valueToStringWithNullCheck(exec, args.at(0));
+
+
+    JSC::JSValue result = jsString(exec, imp->atob(string, ec));
+    setDOMException(exec, ec);
+    return result;
 }
 
 JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionBtoa(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -6383,7 +8565,14 @@ JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionBtoa(ExecState* exec, JSObject
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThisObj->btoa(exec, args);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    const UString& string = valueToStringWithNullCheck(exec, args.at(0));
+
+
+    JSC::JSValue result = jsString(exec, imp->btoa(string, ec));
+    setDOMException(exec, ec);
+    return result;
 }
 
 JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
index 5a087e7afb..a6f325305c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
@@ -43,16 +43,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
     virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction, unsigned attributes);
     virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
@@ -66,14 +65,14 @@ public:
     JSC::JSValue crypto(JSC::ExecState*) const;
     JSC::JSValue image(JSC::ExecState*) const;
     JSC::JSValue option(JSC::ExecState*) const;
-    JSC::JSValue canvasArrayBuffer(JSC::ExecState*) const;
-    JSC::JSValue canvasByteArray(JSC::ExecState*) const;
-    JSC::JSValue canvasUnsignedByteArray(JSC::ExecState*) const;
-    JSC::JSValue canvasShortArray(JSC::ExecState*) const;
-    JSC::JSValue canvasUnsignedShortArray(JSC::ExecState*) const;
-    JSC::JSValue canvasIntArray(JSC::ExecState*) const;
-    JSC::JSValue canvasUnsignedIntArray(JSC::ExecState*) const;
-    JSC::JSValue canvasFloatArray(JSC::ExecState*) const;
+    JSC::JSValue webGLArrayBuffer(JSC::ExecState*) const;
+    JSC::JSValue webGLByteArray(JSC::ExecState*) const;
+    JSC::JSValue webGLUnsignedByteArray(JSC::ExecState*) const;
+    JSC::JSValue webGLShortArray(JSC::ExecState*) const;
+    JSC::JSValue webGLUnsignedShortArray(JSC::ExecState*) const;
+    JSC::JSValue webGLIntArray(JSC::ExecState*) const;
+    JSC::JSValue webGLUnsignedIntArray(JSC::ExecState*) const;
+    JSC::JSValue webGLFloatArray(JSC::ExecState*) const;
     JSC::JSValue webKitCSSMatrix(JSC::ExecState*) const;
     JSC::JSValue webKitPoint(JSC::ExecState*) const;
     JSC::JSValue eventSource(JSC::ExecState*) const;
@@ -82,16 +81,16 @@ public:
     JSC::JSValue messageChannel(JSC::ExecState*) const;
     JSC::JSValue worker(JSC::ExecState*) const;
     JSC::JSValue sharedWorker(JSC::ExecState*) const;
+    JSC::JSValue webSocket(JSC::ExecState*) const;
     JSC::JSValue audio(JSC::ExecState*) const;
 
     // Custom functions
     JSC::JSValue open(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue showModalDialog(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue openDatabase(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue postMessage(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue setTimeout(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue setInterval(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue atob(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue btoa(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     DOMWindow* impl() const
@@ -114,7 +113,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDOMWindowPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -161,583 +160,809 @@ JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionCaptureEvents(JSC::ExecSt
 JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionReleaseEvents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDOMWindowScreen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowHistory(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowLocationbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScreen(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowHistory(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowLocationbar(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowLocationbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMenubar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMenubar(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMenubar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowPersonalbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowPersonalbar(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowPersonalbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowScrollbars(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScrollbars(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowScrollbars(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowStatusbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowStatusbar(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowStatusbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowToolbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowToolbar(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowToolbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowNavigator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowNavigator(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowNavigator(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowClientInformation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowClientInformation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowClientInformation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowLocation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowEvent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowEvent(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCrypto(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowFrameElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowOffscreenBuffering(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCrypto(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowFrameElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowOffscreenBuffering(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOffscreenBuffering(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOuterHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOuterHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOuterHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOuterWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOuterWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOuterWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowInnerHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowInnerHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowInnerHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowInnerWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowInnerWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowInnerWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScreenX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowScreenX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScreenY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowScreenY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowScreenLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScreenLeft(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowScreenLeft(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowScreenTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScreenTop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowScreenTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowScrollX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScrollX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowScrollX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowScrollY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScrollY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowScrollY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowPageXOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowPageYOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowClosed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowPageXOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowPageYOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowClosed(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowStatus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDefaultStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDefaultStatus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDefaultStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDefaultstatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDefaultstatus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDefaultstatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSelf(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSelf(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSelf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowFrames(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWindow(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowFrames(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowFrames(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOpener(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOpener(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOpener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowParent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowParent(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowParent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowTop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowDevicePixelRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDocument(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowMedia(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowDevicePixelRatio(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDevicePixelRatio(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowApplicationCache(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowSessionStorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowLocalStorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowConsole(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowApplicationCache(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowSessionStorage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowLocalStorage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowConsole(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowConsole(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnabort(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnbeforeunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnbeforeunload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnbeforeunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnblur(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOncanplay(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOncanplay(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOncanplay(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOncanplaythrough(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOncanplaythrough(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOncanplaythrough(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnclick(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOncontextmenu(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndblclick(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndrag(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndragend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndragenter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndragleave(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndragover(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndragstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndrop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndurationchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndurationchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndurationchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnemptied(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnemptied(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnemptied(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnended(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnended(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnended(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnfocus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnhashchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnhashchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnhashchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOninput(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOninvalid(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOninvalid(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOninvalid(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnkeydown(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnkeypress(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnkeyup(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnloadeddata(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnloadeddata(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnloadeddata(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnloadedmetadata(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnloadedmetadata(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnloadedmetadata(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnloadstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnloadstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnloadstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnmessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnmousedown(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnmousemove(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnmouseout(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnmouseover(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnmouseup(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnmousewheel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnoffline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnoffline(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnoffline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnonline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnonline(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnonline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnpagehide(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnpagehide(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnpagehide(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnpageshow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnpageshow(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnpageshow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnpause(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnpause(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnpause(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnplay(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnplay(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnplay(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnplaying(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnplaying(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnplaying(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnpopstate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowOnpopstate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnprogress(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnratechange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnratechange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnratechange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnresize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnscroll(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnseeked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnseeked(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnseeked(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnseeking(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnseeking(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnseeking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnselect(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnstalled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnstalled(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnstalled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnstorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnstorage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnstorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnsubmit(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnsuspend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnsuspend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnsuspend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOntimeupdate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOntimeupdate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOntimeupdate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnunload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnvolumechange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnvolumechange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnvolumechange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnwaiting(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnwaiting(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnwaiting(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnreset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnsearch(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnwebkitanimationend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnwebkitanimationend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnwebkitanimationend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnwebkitanimationiteration(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnwebkitanimationiteration(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnwebkitanimationiteration(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnwebkitanimationstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnwebkitanimationstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnwebkitanimationstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnwebkittransitionend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnwebkittransitionend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnwebkittransitionend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOntouchstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowOntouchstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOntouchmove(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowOntouchmove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOntouchend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowOntouchend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOntouchcancel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowOntouchcancel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowStyleSheetConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowStyleSheetConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSStyleSheetConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSStyleSheetConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSValueConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSPrimitiveValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSPrimitiveValueConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSPrimitiveValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSValueListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSValueListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSValueListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWebKitCSSTransformValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebKitCSSTransformValueConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWebKitCSSTransformValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSCharsetRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSCharsetRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSCharsetRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSFontFaceRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSFontFaceRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSFontFaceRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSImportRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSImportRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSImportRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSMediaRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSMediaRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSMediaRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSPageRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSPageRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSPageRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSStyleRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSStyleRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSStyleRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSVariablesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSVariablesRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSVariablesRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSVariablesDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSVariablesDeclarationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSVariablesDeclarationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSStyleDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSStyleDeclarationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSStyleDeclarationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMediaListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMediaListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMediaListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCounterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCounterConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCounterConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSRuleListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSRuleListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSRuleListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowRectConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowRectConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowRGBColorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowRGBColorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowRGBColorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowStyleSheetListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowStyleSheetListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowStyleSheetListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDOMExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDOMExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDOMExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDOMImplementationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDOMImplementationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDOMImplementationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDocumentFragmentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDocumentFragmentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDocumentFragmentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDocumentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowNodeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowNodeConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowNodeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowNodeListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowNodeListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowNodeListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowNamedNodeMapConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowNamedNodeMapConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowNamedNodeMapConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCharacterDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCharacterDataConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCharacterDataConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowAttrConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowAttrConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowAttrConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowTextConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowTextConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowTextConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCommentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCommentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCommentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCDATASectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCDATASectionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCDATASectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDocumentTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDocumentTypeConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDocumentTypeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowNotationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowNotationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowNotationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowEntityConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowEntityConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowEntityConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowEntityReferenceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowEntityReferenceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowEntityReferenceConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowProcessingInstructionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowProcessingInstructionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowProcessingInstructionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLDocumentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLAnchorElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLAnchorElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLAnchorElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLAppletElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLAppletElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLAppletElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLAreaElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLAreaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLBRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLBRElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLBRElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLBaseElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLBaseElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLBaseElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLBaseFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLBaseFontElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLBaseFontElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLBlockquoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLBlockquoteElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLBlockquoteElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLBodyElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLBodyElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLBodyElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLButtonElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLButtonElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLButtonElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLCanvasElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLCanvasElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLCanvasElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLDataGridElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLDataGridElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLDataGridElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLDataGridCellElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLDataGridCellElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLDataGridCellElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLDataGridColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLDataGridColElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLDataGridColElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLDListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLDListElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLDListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLDirectoryElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLDirectoryElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLDirectoryElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLDivElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLDivElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLDivElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLEmbedElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLEmbedElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLEmbedElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLFieldSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLFieldSetElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLFieldSetElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLFontElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLFontElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLFormElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLFormElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLFormElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLFrameElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLFrameElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLFrameSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLFrameSetElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLFrameSetElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLHRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLHRElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLHRElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLHeadElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLHeadElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLHeadElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLHeadingElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLHeadingElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLHeadingElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLHtmlElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLHtmlElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLHtmlElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLIFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLIFrameElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLIFrameElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLImageElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLImageElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLImageElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLInputElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLInputElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLInputElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLIsIndexElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLIsIndexElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLIsIndexElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLLIElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLLIElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLLIElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLLabelElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLLabelElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLLabelElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLLegendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLLegendElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLLegendElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLLinkElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLLinkElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLLinkElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLMapElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLMapElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLMarqueeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLMarqueeElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLMarqueeElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLMenuElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLMenuElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLMenuElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLMetaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLMetaElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLMetaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLModElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLModElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLModElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLOListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLOListElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLOListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLObjectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLObjectElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLObjectElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLOptGroupElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLOptGroupElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLOptGroupElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLOptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLOptionElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLOptionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLParagraphElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLParagraphElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLParagraphElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLParamElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLParamElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLParamElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLPreElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLPreElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLPreElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLQuoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLQuoteElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLQuoteElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLScriptElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLScriptElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLScriptElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLSelectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLSelectElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLSelectElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLStyleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLStyleElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLStyleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTableCaptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTableCaptionElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTableCaptionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTableCellElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTableCellElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTableCellElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTableColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTableColElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTableColElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTableElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTableElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTableElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTableRowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTableRowElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTableRowElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTableSectionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTableSectionElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTableSectionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTextAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTextAreaElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTextAreaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTitleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTitleElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTitleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLUListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLUListElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLUListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLCollectionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLCollectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLAllCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLAllCollectionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLAllCollectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowImageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowImageConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowImageConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasRenderingContext3DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasRenderingContext3DConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowTextMetricsConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowImageDataConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowImageDataConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLRenderingContextConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLRenderingContextConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowTextMetricsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowTextMetricsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasArrayBufferConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasArrayBufferConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasByteArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasByteArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasUnsignedByteArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasUnsignedByteArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasShortArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasShortArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasUnsignedShortArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasUnsignedShortArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasIntArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasIntArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasUnsignedIntArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasUnsignedIntArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasFloatArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasFloatArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebGLArrayBufferConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLArrayBufferConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLByteArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLByteArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLUnsignedByteArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLUnsignedByteArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLShortArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLShortArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLUnsignedShortArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLUnsignedShortArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLIntArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLIntArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLUnsignedIntArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLUnsignedIntArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLFloatArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLFloatArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowBeforeLoadEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowBeforeLoadEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowBeforeLoadEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowKeyboardEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowKeyboardEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowKeyboardEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMouseEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMouseEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMouseEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMutationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMutationEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMutationEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOverflowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOverflowEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOverflowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowPageTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowPageTransitionEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowPageTransitionEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowProgressEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowProgressEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowTextEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowTextEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowTextEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowUIEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowUIEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowUIEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWebKitAnimationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebKitAnimationEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWebKitAnimationEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWebKitTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebKitTransitionEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWebKitTransitionEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWheelEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWheelEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWheelEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMessageEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMessageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowEventExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowEventExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowEventExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWebKitCSSMatrixConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebKitCSSMatrixConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWebKitCSSMatrixConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWebKitPointConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebKitPointConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWebKitPointConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowClipboardConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowClipboardConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowClipboardConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowFileConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowFileConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowFileConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowFileListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowFileListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowFileListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowNodeFilterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowBlobConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowBlobConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowNodeFilterConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowNodeFilterConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowRangeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowRangeConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowRangeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowRangeExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowRangeExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowRangeExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowEventSourceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowEventSourceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowEventSourceConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXMLDocumentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXMLDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDOMParserConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDOMParserConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDOMParserConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXMLSerializerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXMLSerializerConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXMLSerializerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXMLHttpRequestConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXMLHttpRequestConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXMLHttpRequestConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXMLHttpRequestUploadConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXMLHttpRequestUploadConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXMLHttpRequestUploadConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXMLHttpRequestExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXMLHttpRequestExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXMLHttpRequestExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXSLTProcessorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXSLTProcessorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXSLTProcessorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMessagePortConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMessagePortConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMessagePortConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMessageChannelConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMessageChannelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMessageChannelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWorkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWorkerConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWorkerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSharedWorkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSharedWorkerConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSharedWorkerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowPluginConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebSocketConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebSocketConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowPluginConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowPluginConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowPluginArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowPluginArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowPluginArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMimeTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMimeTypeConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMimeTypeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMimeTypeArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMimeTypeArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMimeTypeArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowClientRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowClientRectConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowClientRectConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowClientRectListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowClientRectListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowClientRectListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowStorageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowStorageConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowStorageConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowStorageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowStorageEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowStorageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowAudioConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowAudioConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowAudioConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLAudioElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLAudioElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLAudioElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLMediaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLMediaElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLMediaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLVideoElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLVideoElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLVideoElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMediaErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMediaErrorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMediaErrorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXPathEvaluatorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXPathEvaluatorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXPathEvaluatorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXPathResultConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXPathResultConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXPathResultConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXPathExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXPathExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXPathExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGAngleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGAElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAngleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGAngleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGColorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGAnimatedAngleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedAngleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedBooleanConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedBooleanConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedEnumerationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedEnumerationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedIntegerConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedIntegerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedLengthConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedLengthConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedLengthListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedLengthListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedNumberConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedNumberConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedNumberListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedNumberListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedPreserveAspectRatioConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedPreserveAspectRatioConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedRectConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedRectConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedStringConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedStringConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedTransformListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedTransformListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGCircleElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGCircleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGClipPathElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGClipPathElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGColorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGColorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGCursorElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGCursorElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGDefsElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGDefsElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGDescElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGDescElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGDocumentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGElementInstanceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGElementInstanceConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGElementInstanceListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGElementInstanceListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGEllipseElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGEllipseElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGGradientElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGGElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGGElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGGradientElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGGradientElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGLengthConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGImageElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGImageElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGLengthConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGLengthConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGMarkerElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGLengthListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGLengthListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGLinearGradientElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGLinearGradientElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGLineElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGLineElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGMarkerElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGMarkerElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGPaintConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGMaskElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGMaskElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGMatrixConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGMatrixConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGMetadataElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGMetadataElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGNumberConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGNumberConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGNumberListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGNumberListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPaintConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGPaintConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGPathSegConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGPathElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGPathSegConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGPreserveAspectRatioConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGPathSegArcAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegArcAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegArcRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegArcRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegClosePathConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegClosePathConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoCubicAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoCubicAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoCubicRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoCubicRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoCubicSmoothAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoCubicSmoothAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoCubicSmoothRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoCubicSmoothRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoQuadraticAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoQuadraticAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoQuadraticRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoQuadraticRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoQuadraticSmoothAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoQuadraticSmoothAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoQuadraticSmoothRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoQuadraticSmoothRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegLinetoAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegLinetoAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegLinetoHorizontalAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegLinetoHorizontalAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegLinetoHorizontalRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegLinetoHorizontalRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegLinetoRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegLinetoRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegLinetoVerticalAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegLinetoVerticalAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegLinetoVerticalRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegLinetoVerticalRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegMovetoAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegMovetoAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegMovetoRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegMovetoRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPatternElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPatternElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPointConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPointConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPointListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPointListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPolygonElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPolygonElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPolylineElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPolylineElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPreserveAspectRatioConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGPreserveAspectRatioConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGRenderingIntentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGRadialGradientElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGRadialGradientElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGRectConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGRectConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGRectElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGRectElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGRenderingIntentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGRenderingIntentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGTextContentElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGScriptElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGScriptElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGStopElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGStopElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGStringListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGStringListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGStyleElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGStyleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGSVGElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGSVGElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGSwitchElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGSwitchElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGSymbolElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGSymbolElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTextContentElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGTextContentElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGTextPathElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGTextElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGTextElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTextPathElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGTextPathElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGTransformConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGTextPositioningElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGTextPositioningElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTitleElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGTitleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTransformConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGTransformConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGUnitTypesConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGTransformListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGTransformListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTRefElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGTRefElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTSpanElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGTSpanElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGUnitTypesConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGUnitTypesConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGUseElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGUseElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGViewElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGViewElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGZoomEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGZoomEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGComponentTransferFunctionElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGComponentTransferFunctionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEBlendElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEBlendElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEColorMatrixElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEColorMatrixElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEComponentTransferElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEComponentTransferElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFECompositeElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFECompositeElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEDiffuseLightingElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEDiffuseLightingElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEDisplacementMapElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEDisplacementMapElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEDistantLightElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEDistantLightElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEFloodElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEFloodElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEFuncAElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEFuncAElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEFuncBElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEFuncBElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEFuncGElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEFuncGElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEFuncRElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEFuncRElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEGaussianBlurElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEGaussianBlurElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEImageElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEImageElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEMergeElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEMergeElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEMergeNodeElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEMergeNodeElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEMorphologyElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEMorphologyElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEOffsetElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEOffsetElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEPointLightElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEPointLightElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFESpecularLightingElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFESpecularLightingElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFESpotLightElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFESpotLightElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFETileElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFETileElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFETurbulenceElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFETurbulenceElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFilterElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFilterElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowTouchEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowTouchEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowFormDataConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowFormDataConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindowBase.lut.h b/src/3rdparty/webkit/WebCore/generated/JSDOMWindowBase.lut.h
deleted file mode 100644
index e69de29bb2..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindowBase.lut.h
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
index 42b91d171e..98e88b2bd3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
@@ -40,13 +40,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSDataGridColumn);
 
 static const HashTableValue JSDataGridColumnTableValues[8] =
 {
-    { "id", DontDelete, (intptr_t)jsDataGridColumnId, (intptr_t)setJSDataGridColumnId },
-    { "label", DontDelete, (intptr_t)jsDataGridColumnLabel, (intptr_t)setJSDataGridColumnLabel },
-    { "type", DontDelete, (intptr_t)jsDataGridColumnType, (intptr_t)setJSDataGridColumnType },
-    { "sortable", DontDelete, (intptr_t)jsDataGridColumnSortable, (intptr_t)setJSDataGridColumnSortable },
-    { "sortDirection", DontDelete, (intptr_t)jsDataGridColumnSortDirection, (intptr_t)setJSDataGridColumnSortDirection },
-    { "primary", DontDelete, (intptr_t)jsDataGridColumnPrimary, (intptr_t)setJSDataGridColumnPrimary },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDataGridColumnConstructor, (intptr_t)0 },
+    { "id", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnId), (intptr_t)setJSDataGridColumnId },
+    { "label", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnLabel), (intptr_t)setJSDataGridColumnLabel },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnType), (intptr_t)setJSDataGridColumnType },
+    { "sortable", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSortable), (intptr_t)setJSDataGridColumnSortable },
+    { "sortDirection", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSortDirection), (intptr_t)setJSDataGridColumnSortDirection },
+    { "primary", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnPrimary), (intptr_t)setJSDataGridColumnPrimary },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -61,12 +61,12 @@ static JSC_CONST_HASHTABLE HashTable JSDataGridColumnTable =
 
 static const HashTableValue JSDataGridColumnConstructorTableValues[7] =
 {
-    { "NEVER_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNEVER_SORTED, (intptr_t)0 },
-    { "ALWAYS_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnALWAYS_SORTED, (intptr_t)0 },
-    { "SOMETIMES_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSOMETIMES_SORTED, (intptr_t)0 },
-    { "NATURAL_SORT", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNATURAL_SORT, (intptr_t)0 },
-    { "SORT_ASCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORT_ASCENDING, (intptr_t)0 },
-    { "SORC_DESCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORC_DESCENDING, (intptr_t)0 },
+    { "NEVER_SORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnNEVER_SORTED), (intptr_t)0 },
+    { "ALWAYS_SORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnALWAYS_SORTED), (intptr_t)0 },
+    { "SOMETIMES_SORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSOMETIMES_SORTED), (intptr_t)0 },
+    { "NATURAL_SORT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnNATURAL_SORT), (intptr_t)0 },
+    { "SORT_ASCENDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSORT_ASCENDING), (intptr_t)0 },
+    { "SORC_DESCENDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSORC_DESCENDING), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -91,7 +91,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -114,12 +114,12 @@ bool JSDataGridColumnConstructor::getOwnPropertyDescriptor(ExecState* exec, cons
 
 static const HashTableValue JSDataGridColumnPrototypeTableValues[7] =
 {
-    { "NEVER_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNEVER_SORTED, (intptr_t)0 },
-    { "ALWAYS_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnALWAYS_SORTED, (intptr_t)0 },
-    { "SOMETIMES_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSOMETIMES_SORTED, (intptr_t)0 },
-    { "NATURAL_SORT", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNATURAL_SORT, (intptr_t)0 },
-    { "SORT_ASCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORT_ASCENDING, (intptr_t)0 },
-    { "SORC_DESCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORC_DESCENDING, (intptr_t)0 },
+    { "NEVER_SORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnNEVER_SORTED), (intptr_t)0 },
+    { "ALWAYS_SORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnALWAYS_SORTED), (intptr_t)0 },
+    { "SOMETIMES_SORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSOMETIMES_SORTED), (intptr_t)0 },
+    { "NATURAL_SORT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnNATURAL_SORT), (intptr_t)0 },
+    { "SORT_ASCENDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSORT_ASCENDING), (intptr_t)0 },
+    { "SORC_DESCENDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSORC_DESCENDING), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -175,57 +175,63 @@ bool JSDataGridColumn::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSDataGridColumn, Base>(exec, &JSDataGridColumnTable, this, propertyName, descriptor);
 }
 
-JSValue jsDataGridColumnId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slot.slotBase()));
+    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumn* imp = static_cast<DataGridColumn*>(castedThis->impl());
-    return jsString(exec, imp->id());
+    JSValue result = jsString(exec, imp->id());
+    return result;
 }
 
-JSValue jsDataGridColumnLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnLabel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slot.slotBase()));
+    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumn* imp = static_cast<DataGridColumn*>(castedThis->impl());
-    return jsString(exec, imp->label());
+    JSValue result = jsString(exec, imp->label());
+    return result;
 }
 
-JSValue jsDataGridColumnType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slot.slotBase()));
+    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumn* imp = static_cast<DataGridColumn*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsDataGridColumnSortable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnSortable(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slot.slotBase()));
+    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumn* imp = static_cast<DataGridColumn*>(castedThis->impl());
-    return jsNumber(exec, imp->sortable());
+    JSValue result = jsNumber(exec, imp->sortable());
+    return result;
 }
 
-JSValue jsDataGridColumnSortDirection(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnSortDirection(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slot.slotBase()));
+    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumn* imp = static_cast<DataGridColumn*>(castedThis->impl());
-    return jsNumber(exec, imp->sortDirection());
+    JSValue result = jsNumber(exec, imp->sortDirection());
+    return result;
 }
 
-JSValue jsDataGridColumnPrimary(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnPrimary(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slot.slotBase()));
+    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumn* imp = static_cast<DataGridColumn*>(castedThis->impl());
-    return jsBoolean(imp->primary());
+    JSValue result = jsBoolean(imp->primary());
+    return result;
 }
 
-JSValue jsDataGridColumnConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumn* domObject = static_cast<JSDataGridColumn*>(asObject(slot.slotBase()));
+    JSDataGridColumn* domObject = static_cast<JSDataGridColumn*>(asObject(slotBase));
     return JSDataGridColumn::getConstructor(exec, domObject->globalObject());
 }
 void JSDataGridColumn::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -235,37 +241,43 @@ void JSDataGridColumn::put(ExecState* exec, const Identifier& propertyName, JSVa
 
 void setJSDataGridColumnId(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    JSDataGridColumn* castedThisObj = static_cast<JSDataGridColumn*>(thisObject);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(castedThisObj->impl());
     imp->setId(value.toString(exec));
 }
 
 void setJSDataGridColumnLabel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    JSDataGridColumn* castedThisObj = static_cast<JSDataGridColumn*>(thisObject);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(castedThisObj->impl());
     imp->setLabel(value.toString(exec));
 }
 
 void setJSDataGridColumnType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    JSDataGridColumn* castedThisObj = static_cast<JSDataGridColumn*>(thisObject);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(castedThisObj->impl());
     imp->setType(value.toString(exec));
 }
 
 void setJSDataGridColumnSortable(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    JSDataGridColumn* castedThisObj = static_cast<JSDataGridColumn*>(thisObject);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(castedThisObj->impl());
     imp->setSortable(value.toInt32(exec));
 }
 
 void setJSDataGridColumnSortDirection(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    JSDataGridColumn* castedThisObj = static_cast<JSDataGridColumn*>(thisObject);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(castedThisObj->impl());
     imp->setSortDirection(value.toInt32(exec));
 }
 
 void setJSDataGridColumnPrimary(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    JSDataGridColumn* castedThisObj = static_cast<JSDataGridColumn*>(thisObject);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(castedThisObj->impl());
     imp->setPrimary(value.toBoolean(exec));
 }
 
@@ -276,32 +288,32 @@ JSValue JSDataGridColumn::getConstructor(ExecState* exec, JSGlobalObject* global
 
 // Constant getters
 
-JSValue jsDataGridColumnNEVER_SORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDataGridColumnNEVER_SORTED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsDataGridColumnALWAYS_SORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDataGridColumnALWAYS_SORTED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsDataGridColumnSOMETIMES_SORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDataGridColumnSOMETIMES_SORTED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsDataGridColumnNATURAL_SORT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDataGridColumnNATURAL_SORT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsDataGridColumnSORT_ASCENDING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDataGridColumnSORT_ASCENDING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsDataGridColumnSORC_DESCENDING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDataGridColumnSORC_DESCENDING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
index c53c99ded5..a5af609149 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(DATAGRID)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -46,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -71,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDataGridColumnPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,27 +79,27 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsDataGridColumnId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDataGridColumnId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDataGridColumnLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnLabel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDataGridColumnLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDataGridColumnType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDataGridColumnType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDataGridColumnSortable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnSortable(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDataGridColumnSortable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDataGridColumnSortDirection(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnSortDirection(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDataGridColumnSortDirection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDataGridColumnPrimary(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnPrimary(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDataGridColumnPrimary(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDataGridColumnConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsDataGridColumnNEVER_SORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnALWAYS_SORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnSOMETIMES_SORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnNATURAL_SORT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnSORT_ASCENDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnSORC_DESCENDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnNEVER_SORTED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnALWAYS_SORTED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnSOMETIMES_SORTED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnNATURAL_SORT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnSORT_ASCENDING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnSORC_DESCENDING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
index 945c257d0f..fb3b94d8a1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
@@ -44,10 +44,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSDataGridColumnList);
 
 static const HashTableValue JSDataGridColumnListTableValues[5] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnListLength, (intptr_t)0 },
-    { "sortColumn", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnListSortColumn, (intptr_t)0 },
-    { "primaryColumn", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnListPrimaryColumn, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDataGridColumnListConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnListLength), (intptr_t)0 },
+    { "sortColumn", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnListSortColumn), (intptr_t)0 },
+    { "primaryColumn", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnListPrimaryColumn), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -86,7 +86,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -109,11 +109,11 @@ bool JSDataGridColumnListConstructor::getOwnPropertyDescriptor(ExecState* exec,
 
 static const HashTableValue JSDataGridColumnListPrototypeTableValues[6] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionItem, (intptr_t)1 },
-    { "add", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionAdd, (intptr_t)5 },
-    { "remove", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionRemove, (intptr_t)1 },
-    { "move", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionMove, (intptr_t)2 },
-    { "clear", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionClear, (intptr_t)0 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDataGridColumnListPrototypeFunctionItem), (intptr_t)1 },
+    { "add", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDataGridColumnListPrototypeFunctionAdd), (intptr_t)5 },
+    { "remove", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDataGridColumnListPrototypeFunctionRemove), (intptr_t)1 },
+    { "move", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDataGridColumnListPrototypeFunctionMove), (intptr_t)2 },
+    { "clear", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDataGridColumnListPrototypeFunctionClear), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -214,40 +214,43 @@ bool JSDataGridColumnList::getOwnPropertySlot(ExecState* exec, unsigned property
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsDataGridColumnListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnListLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumnList* castedThis = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    JSDataGridColumnList* castedThis = static_cast<JSDataGridColumnList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsDataGridColumnListSortColumn(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnListSortColumn(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumnList* castedThis = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    JSDataGridColumnList* castedThis = static_cast<JSDataGridColumnList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->sortColumn()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->sortColumn()));
+    return result;
 }
 
-JSValue jsDataGridColumnListPrimaryColumn(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnListPrimaryColumn(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumnList* castedThis = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    JSDataGridColumnList* castedThis = static_cast<JSDataGridColumnList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->primaryColumn()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->primaryColumn()));
+    return result;
 }
 
-JSValue jsDataGridColumnListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumnList* domObject = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    JSDataGridColumnList* domObject = static_cast<JSDataGridColumnList*>(asObject(slotBase));
     return JSDataGridColumnList::getConstructor(exec, domObject->globalObject());
 }
-void JSDataGridColumnList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSDataGridColumnList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<DataGridColumnList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSDataGridColumnList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -331,10 +334,10 @@ JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionClear(ExecState* exec
 }
 
 
-JSValue JSDataGridColumnList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSDataGridColumnList::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<DataGridColumnList*>(thisObj->impl())->item(slot.index()));
+    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<DataGridColumnList*>(thisObj->impl())->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DataGridColumnList* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
index ac4d33e56a..2033a978f0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(DATAGRID)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -46,10 +45,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     DataGridColumnList* impl() const { return m_impl.get(); }
 
@@ -57,10 +56,10 @@ private:
     RefPtr<DataGridColumnList> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 private:
     static bool canGetItemsForName(JSC::ExecState*, DataGridColumnList*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DataGridColumnList*);
@@ -76,7 +75,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDataGridColumnListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -92,10 +91,10 @@ JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionMove(JSC::ExecSt
 JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDataGridColumnListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnListSortColumn(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnListPrimaryColumn(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnListLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnListSortColumn(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnListPrimaryColumn(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp b/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
index c5ac44db90..9aef24edfa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
@@ -40,7 +40,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDatabase);
 
 static const HashTableValue JSDatabaseTableValues[2] =
 {
-    { "version", DontDelete|ReadOnly, (intptr_t)jsDatabaseVersion, (intptr_t)0 },
+    { "version", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDatabaseVersion), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -55,9 +55,9 @@ static JSC_CONST_HASHTABLE HashTable JSDatabaseTable =
 
 static const HashTableValue JSDatabasePrototypeTableValues[4] =
 {
-    { "changeVersion", DontDelete|Function, (intptr_t)jsDatabasePrototypeFunctionChangeVersion, (intptr_t)5 },
-    { "transaction", DontDelete|Function, (intptr_t)jsDatabasePrototypeFunctionTransaction, (intptr_t)3 },
-    { "readTransaction", DontDelete|Function, (intptr_t)jsDatabasePrototypeFunctionReadTransaction, (intptr_t)3 },
+    { "changeVersion", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDatabasePrototypeFunctionChangeVersion), (intptr_t)5 },
+    { "transaction", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDatabasePrototypeFunctionTransaction), (intptr_t)3 },
+    { "readTransaction", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDatabasePrototypeFunctionReadTransaction), (intptr_t)3 },
     { 0, 0, 0, 0 }
 };
 
@@ -113,12 +113,13 @@ bool JSDatabase::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     return getStaticValueDescriptor<JSDatabase, Base>(exec, &JSDatabaseTable, this, propertyName, descriptor);
 }
 
-JSValue jsDatabaseVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDatabaseVersion(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDatabase* castedThis = static_cast<JSDatabase*>(asObject(slot.slotBase()));
+    JSDatabase* castedThis = static_cast<JSDatabase*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Database* imp = static_cast<Database*>(castedThis->impl());
-    return jsString(exec, imp->version());
+    JSValue result = jsString(exec, imp->version());
+    return result;
 }
 
 JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionChangeVersion(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDatabase.h b/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
index 03534275f9..76563e3247 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(DATABASE)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 
@@ -74,7 +73,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDatabasePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -88,7 +87,7 @@ JSC::JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionTransaction(JSC::ExecState
 JSC::JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionReadTransaction(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDatabaseVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDatabaseVersion(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.cpp
index 3fbc67ce2d..f290b353d0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.cpp
@@ -40,7 +40,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDedicatedWorkerContext);
 
 static const HashTableValue JSDedicatedWorkerContextTableValues[2] =
 {
-    { "onmessage", DontDelete, (intptr_t)jsDedicatedWorkerContextOnmessage, (intptr_t)setJSDedicatedWorkerContextOnmessage },
+    { "onmessage", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDedicatedWorkerContextOnmessage), (intptr_t)setJSDedicatedWorkerContextOnmessage },
     { 0, 0, 0, 0 }
 };
 
@@ -55,7 +55,7 @@ static JSC_CONST_HASHTABLE HashTable JSDedicatedWorkerContextTable =
 
 static const HashTableValue JSDedicatedWorkerContextPrototypeTableValues[2] =
 {
-    { "postMessage", DontDelete|Function, (intptr_t)jsDedicatedWorkerContextPrototypeFunctionPostMessage, (intptr_t)2 },
+    { "postMessage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDedicatedWorkerContextPrototypeFunctionPostMessage), (intptr_t)2 },
     { 0, 0, 0, 0 }
 };
 
@@ -108,14 +108,16 @@ bool JSDedicatedWorkerContext::getOwnPropertyDescriptor(ExecState* exec, const I
     return getStaticValueDescriptor<JSDedicatedWorkerContext, Base>(exec, getJSDedicatedWorkerContextTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsDedicatedWorkerContextOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDedicatedWorkerContextOnmessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDedicatedWorkerContext* castedThis = static_cast<JSDedicatedWorkerContext*>(asObject(slot.slotBase()));
+    JSDedicatedWorkerContext* castedThis = static_cast<JSDedicatedWorkerContext*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DedicatedWorkerContext* imp = static_cast<DedicatedWorkerContext*>(castedThis->impl());
     if (EventListener* listener = imp->onmessage()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
@@ -129,8 +131,7 @@ void setJSDedicatedWorkerContextOnmessage(ExecState* exec, JSObject* thisObject,
 {
     UNUSED_PARAM(exec);
     DedicatedWorkerContext* imp = static_cast<DedicatedWorkerContext*>(static_cast<JSDedicatedWorkerContext*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDedicatedWorkerContext*>(thisObject);
-    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmessage(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSC_HOST_CALL jsDedicatedWorkerContextPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
index 2e658425c1..a7ee45f10d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 
@@ -68,7 +68,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDedicatedWorkerContextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,7 +80,7 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsDedicatedWorkerContextPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDedicatedWorkerContextOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDedicatedWorkerContextOnmessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDedicatedWorkerContextOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
index 1fb3b467ef..055cc4d916 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
@@ -36,7 +36,6 @@
 #include "EntityReference.h"
 #include "Event.h"
 #include "EventListener.h"
-#include "Frame.h"
 #include "HTMLCollection.h"
 #include "HTMLElement.h"
 #include "HTMLHeadElement.h"
@@ -46,7 +45,6 @@
 #include "JSCanvasRenderingContext2D.h"
 #include "JSComment.h"
 #include "JSCustomXPathNSResolver.h"
-#include "JSDOMGlobalObject.h"
 #include "JSDOMImplementation.h"
 #include "JSDOMSelection.h"
 #include "JSDOMWindow.h"
@@ -98,86 +96,90 @@ ASSERT_CLASS_FITS_IN_CELL(JSDocument);
 
 /* Hash table */
 
-static const HashTableValue JSDocumentTableValues[71] =
-{
-    { "doctype", DontDelete|ReadOnly, (intptr_t)jsDocumentDoctype, (intptr_t)0 },
-    { "implementation", DontDelete|ReadOnly, (intptr_t)jsDocumentImplementation, (intptr_t)0 },
-    { "documentElement", DontDelete|ReadOnly, (intptr_t)jsDocumentDocumentElement, (intptr_t)0 },
-    { "inputEncoding", DontDelete|ReadOnly, (intptr_t)jsDocumentInputEncoding, (intptr_t)0 },
-    { "xmlEncoding", DontDelete|ReadOnly, (intptr_t)jsDocumentXMLEncoding, (intptr_t)0 },
-    { "xmlVersion", DontDelete, (intptr_t)jsDocumentXMLVersion, (intptr_t)setJSDocumentXMLVersion },
-    { "xmlStandalone", DontDelete, (intptr_t)jsDocumentXMLStandalone, (intptr_t)setJSDocumentXMLStandalone },
-    { "documentURI", DontDelete, (intptr_t)jsDocumentDocumentURI, (intptr_t)setJSDocumentDocumentURI },
-    { "defaultView", DontDelete|ReadOnly, (intptr_t)jsDocumentDefaultView, (intptr_t)0 },
-    { "styleSheets", DontDelete|ReadOnly, (intptr_t)jsDocumentStyleSheets, (intptr_t)0 },
-    { "title", DontDelete, (intptr_t)jsDocumentTitle, (intptr_t)setJSDocumentTitle },
-    { "referrer", DontDelete|ReadOnly, (intptr_t)jsDocumentReferrer, (intptr_t)0 },
-    { "domain", DontDelete, (intptr_t)jsDocumentDomain, (intptr_t)setJSDocumentDomain },
-    { "URL", DontDelete|ReadOnly, (intptr_t)jsDocumentURL, (intptr_t)0 },
-    { "cookie", DontDelete, (intptr_t)jsDocumentCookie, (intptr_t)setJSDocumentCookie },
-    { "body", DontDelete, (intptr_t)jsDocumentBody, (intptr_t)setJSDocumentBody },
-    { "head", DontDelete|ReadOnly, (intptr_t)jsDocumentHead, (intptr_t)0 },
-    { "images", DontDelete|ReadOnly, (intptr_t)jsDocumentImages, (intptr_t)0 },
-    { "applets", DontDelete|ReadOnly, (intptr_t)jsDocumentApplets, (intptr_t)0 },
-    { "links", DontDelete|ReadOnly, (intptr_t)jsDocumentLinks, (intptr_t)0 },
-    { "forms", DontDelete|ReadOnly, (intptr_t)jsDocumentForms, (intptr_t)0 },
-    { "anchors", DontDelete|ReadOnly, (intptr_t)jsDocumentAnchors, (intptr_t)0 },
-    { "lastModified", DontDelete|ReadOnly, (intptr_t)jsDocumentLastModified, (intptr_t)0 },
-    { "location", DontDelete, (intptr_t)jsDocumentLocation, (intptr_t)setJSDocumentLocation },
-    { "charset", DontDelete, (intptr_t)jsDocumentCharset, (intptr_t)setJSDocumentCharset },
-    { "defaultCharset", DontDelete|ReadOnly, (intptr_t)jsDocumentDefaultCharset, (intptr_t)0 },
-    { "readyState", DontDelete|ReadOnly, (intptr_t)jsDocumentReadyState, (intptr_t)0 },
-    { "characterSet", DontDelete|ReadOnly, (intptr_t)jsDocumentCharacterSet, (intptr_t)0 },
-    { "preferredStylesheetSet", DontDelete|ReadOnly, (intptr_t)jsDocumentPreferredStylesheetSet, (intptr_t)0 },
-    { "selectedStylesheetSet", DontDelete, (intptr_t)jsDocumentSelectedStylesheetSet, (intptr_t)setJSDocumentSelectedStylesheetSet },
-    { "onabort", DontDelete|DontEnum, (intptr_t)jsDocumentOnabort, (intptr_t)setJSDocumentOnabort },
-    { "onblur", DontDelete|DontEnum, (intptr_t)jsDocumentOnblur, (intptr_t)setJSDocumentOnblur },
-    { "onchange", DontDelete|DontEnum, (intptr_t)jsDocumentOnchange, (intptr_t)setJSDocumentOnchange },
-    { "onclick", DontDelete|DontEnum, (intptr_t)jsDocumentOnclick, (intptr_t)setJSDocumentOnclick },
-    { "oncontextmenu", DontDelete|DontEnum, (intptr_t)jsDocumentOncontextmenu, (intptr_t)setJSDocumentOncontextmenu },
-    { "ondblclick", DontDelete|DontEnum, (intptr_t)jsDocumentOndblclick, (intptr_t)setJSDocumentOndblclick },
-    { "ondrag", DontDelete|DontEnum, (intptr_t)jsDocumentOndrag, (intptr_t)setJSDocumentOndrag },
-    { "ondragend", DontDelete|DontEnum, (intptr_t)jsDocumentOndragend, (intptr_t)setJSDocumentOndragend },
-    { "ondragenter", DontDelete|DontEnum, (intptr_t)jsDocumentOndragenter, (intptr_t)setJSDocumentOndragenter },
-    { "ondragleave", DontDelete|DontEnum, (intptr_t)jsDocumentOndragleave, (intptr_t)setJSDocumentOndragleave },
-    { "ondragover", DontDelete|DontEnum, (intptr_t)jsDocumentOndragover, (intptr_t)setJSDocumentOndragover },
-    { "ondragstart", DontDelete|DontEnum, (intptr_t)jsDocumentOndragstart, (intptr_t)setJSDocumentOndragstart },
-    { "ondrop", DontDelete|DontEnum, (intptr_t)jsDocumentOndrop, (intptr_t)setJSDocumentOndrop },
-    { "onerror", DontDelete|DontEnum, (intptr_t)jsDocumentOnerror, (intptr_t)setJSDocumentOnerror },
-    { "onfocus", DontDelete|DontEnum, (intptr_t)jsDocumentOnfocus, (intptr_t)setJSDocumentOnfocus },
-    { "oninput", DontDelete|DontEnum, (intptr_t)jsDocumentOninput, (intptr_t)setJSDocumentOninput },
-    { "oninvalid", DontDelete|DontEnum, (intptr_t)jsDocumentOninvalid, (intptr_t)setJSDocumentOninvalid },
-    { "onkeydown", DontDelete|DontEnum, (intptr_t)jsDocumentOnkeydown, (intptr_t)setJSDocumentOnkeydown },
-    { "onkeypress", DontDelete|DontEnum, (intptr_t)jsDocumentOnkeypress, (intptr_t)setJSDocumentOnkeypress },
-    { "onkeyup", DontDelete|DontEnum, (intptr_t)jsDocumentOnkeyup, (intptr_t)setJSDocumentOnkeyup },
-    { "onload", DontDelete|DontEnum, (intptr_t)jsDocumentOnload, (intptr_t)setJSDocumentOnload },
-    { "onmousedown", DontDelete|DontEnum, (intptr_t)jsDocumentOnmousedown, (intptr_t)setJSDocumentOnmousedown },
-    { "onmousemove", DontDelete|DontEnum, (intptr_t)jsDocumentOnmousemove, (intptr_t)setJSDocumentOnmousemove },
-    { "onmouseout", DontDelete|DontEnum, (intptr_t)jsDocumentOnmouseout, (intptr_t)setJSDocumentOnmouseout },
-    { "onmouseover", DontDelete|DontEnum, (intptr_t)jsDocumentOnmouseover, (intptr_t)setJSDocumentOnmouseover },
-    { "onmouseup", DontDelete|DontEnum, (intptr_t)jsDocumentOnmouseup, (intptr_t)setJSDocumentOnmouseup },
-    { "onmousewheel", DontDelete|DontEnum, (intptr_t)jsDocumentOnmousewheel, (intptr_t)setJSDocumentOnmousewheel },
-    { "onscroll", DontDelete|DontEnum, (intptr_t)jsDocumentOnscroll, (intptr_t)setJSDocumentOnscroll },
-    { "onselect", DontDelete|DontEnum, (intptr_t)jsDocumentOnselect, (intptr_t)setJSDocumentOnselect },
-    { "onsubmit", DontDelete|DontEnum, (intptr_t)jsDocumentOnsubmit, (intptr_t)setJSDocumentOnsubmit },
-    { "onbeforecut", DontDelete|DontEnum, (intptr_t)jsDocumentOnbeforecut, (intptr_t)setJSDocumentOnbeforecut },
-    { "oncut", DontDelete|DontEnum, (intptr_t)jsDocumentOncut, (intptr_t)setJSDocumentOncut },
-    { "onbeforecopy", DontDelete|DontEnum, (intptr_t)jsDocumentOnbeforecopy, (intptr_t)setJSDocumentOnbeforecopy },
-    { "oncopy", DontDelete|DontEnum, (intptr_t)jsDocumentOncopy, (intptr_t)setJSDocumentOncopy },
-    { "onbeforepaste", DontDelete|DontEnum, (intptr_t)jsDocumentOnbeforepaste, (intptr_t)setJSDocumentOnbeforepaste },
-    { "onpaste", DontDelete|DontEnum, (intptr_t)jsDocumentOnpaste, (intptr_t)setJSDocumentOnpaste },
-    { "onreset", DontDelete|DontEnum, (intptr_t)jsDocumentOnreset, (intptr_t)setJSDocumentOnreset },
-    { "onsearch", DontDelete|DontEnum, (intptr_t)jsDocumentOnsearch, (intptr_t)setJSDocumentOnsearch },
-    { "onselectstart", DontDelete|DontEnum, (intptr_t)jsDocumentOnselectstart, (intptr_t)setJSDocumentOnselectstart },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDocumentConstructor, (intptr_t)0 },
+static const HashTableValue JSDocumentTableValues[75] =
+{
+    { "doctype", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentDoctype), (intptr_t)0 },
+    { "implementation", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentImplementation), (intptr_t)0 },
+    { "documentElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentDocumentElement), (intptr_t)0 },
+    { "inputEncoding", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentInputEncoding), (intptr_t)0 },
+    { "xmlEncoding", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentXMLEncoding), (intptr_t)0 },
+    { "xmlVersion", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentXMLVersion), (intptr_t)setJSDocumentXMLVersion },
+    { "xmlStandalone", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentXMLStandalone), (intptr_t)setJSDocumentXMLStandalone },
+    { "documentURI", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentDocumentURI), (intptr_t)setJSDocumentDocumentURI },
+    { "defaultView", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentDefaultView), (intptr_t)0 },
+    { "styleSheets", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentStyleSheets), (intptr_t)0 },
+    { "title", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTitle), (intptr_t)setJSDocumentTitle },
+    { "referrer", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentReferrer), (intptr_t)0 },
+    { "domain", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentDomain), (intptr_t)setJSDocumentDomain },
+    { "URL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentURL), (intptr_t)0 },
+    { "cookie", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentCookie), (intptr_t)setJSDocumentCookie },
+    { "body", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentBody), (intptr_t)setJSDocumentBody },
+    { "head", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentHead), (intptr_t)0 },
+    { "images", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentImages), (intptr_t)0 },
+    { "applets", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentApplets), (intptr_t)0 },
+    { "links", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentLinks), (intptr_t)0 },
+    { "forms", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentForms), (intptr_t)0 },
+    { "anchors", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentAnchors), (intptr_t)0 },
+    { "lastModified", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentLastModified), (intptr_t)0 },
+    { "location", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentLocation), (intptr_t)setJSDocumentLocation },
+    { "charset", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentCharset), (intptr_t)setJSDocumentCharset },
+    { "defaultCharset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentDefaultCharset), (intptr_t)0 },
+    { "readyState", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentReadyState), (intptr_t)0 },
+    { "characterSet", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentCharacterSet), (intptr_t)0 },
+    { "preferredStylesheetSet", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentPreferredStylesheetSet), (intptr_t)0 },
+    { "selectedStylesheetSet", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentSelectedStylesheetSet), (intptr_t)setJSDocumentSelectedStylesheetSet },
+    { "onabort", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnabort), (intptr_t)setJSDocumentOnabort },
+    { "onblur", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnblur), (intptr_t)setJSDocumentOnblur },
+    { "onchange", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnchange), (intptr_t)setJSDocumentOnchange },
+    { "onclick", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnclick), (intptr_t)setJSDocumentOnclick },
+    { "oncontextmenu", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOncontextmenu), (intptr_t)setJSDocumentOncontextmenu },
+    { "ondblclick", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndblclick), (intptr_t)setJSDocumentOndblclick },
+    { "ondrag", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndrag), (intptr_t)setJSDocumentOndrag },
+    { "ondragend", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndragend), (intptr_t)setJSDocumentOndragend },
+    { "ondragenter", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndragenter), (intptr_t)setJSDocumentOndragenter },
+    { "ondragleave", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndragleave), (intptr_t)setJSDocumentOndragleave },
+    { "ondragover", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndragover), (intptr_t)setJSDocumentOndragover },
+    { "ondragstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndragstart), (intptr_t)setJSDocumentOndragstart },
+    { "ondrop", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndrop), (intptr_t)setJSDocumentOndrop },
+    { "onerror", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnerror), (intptr_t)setJSDocumentOnerror },
+    { "onfocus", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnfocus), (intptr_t)setJSDocumentOnfocus },
+    { "oninput", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOninput), (intptr_t)setJSDocumentOninput },
+    { "oninvalid", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOninvalid), (intptr_t)setJSDocumentOninvalid },
+    { "onkeydown", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnkeydown), (intptr_t)setJSDocumentOnkeydown },
+    { "onkeypress", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnkeypress), (intptr_t)setJSDocumentOnkeypress },
+    { "onkeyup", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnkeyup), (intptr_t)setJSDocumentOnkeyup },
+    { "onload", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnload), (intptr_t)setJSDocumentOnload },
+    { "onmousedown", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnmousedown), (intptr_t)setJSDocumentOnmousedown },
+    { "onmousemove", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnmousemove), (intptr_t)setJSDocumentOnmousemove },
+    { "onmouseout", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnmouseout), (intptr_t)setJSDocumentOnmouseout },
+    { "onmouseover", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnmouseover), (intptr_t)setJSDocumentOnmouseover },
+    { "onmouseup", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnmouseup), (intptr_t)setJSDocumentOnmouseup },
+    { "onmousewheel", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnmousewheel), (intptr_t)setJSDocumentOnmousewheel },
+    { "onscroll", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnscroll), (intptr_t)setJSDocumentOnscroll },
+    { "onselect", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnselect), (intptr_t)setJSDocumentOnselect },
+    { "onsubmit", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnsubmit), (intptr_t)setJSDocumentOnsubmit },
+    { "onbeforecut", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnbeforecut), (intptr_t)setJSDocumentOnbeforecut },
+    { "oncut", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOncut), (intptr_t)setJSDocumentOncut },
+    { "onbeforecopy", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnbeforecopy), (intptr_t)setJSDocumentOnbeforecopy },
+    { "oncopy", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOncopy), (intptr_t)setJSDocumentOncopy },
+    { "onbeforepaste", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnbeforepaste), (intptr_t)setJSDocumentOnbeforepaste },
+    { "onpaste", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnpaste), (intptr_t)setJSDocumentOnpaste },
+    { "onreset", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnreset), (intptr_t)setJSDocumentOnreset },
+    { "onsearch", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnsearch), (intptr_t)setJSDocumentOnsearch },
+    { "onselectstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnselectstart), (intptr_t)setJSDocumentOnselectstart },
+    { "ontouchstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOntouchstart), (intptr_t)setJSDocumentOntouchstart },
+    { "ontouchmove", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOntouchmove), (intptr_t)setJSDocumentOntouchmove },
+    { "ontouchend", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOntouchend), (intptr_t)setJSDocumentOntouchend },
+    { "ontouchcancel", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOntouchcancel), (intptr_t)setJSDocumentOntouchcancel },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSDocumentTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 2047, JSDocumentTableValues, 0 };
+    { 8191, JSDocumentTableValues, 0 };
 #else
-    { 260, 255, JSDocumentTableValues, 0 };
+    { 262, 255, JSDocumentTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -208,7 +210,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -231,43 +233,43 @@ bool JSDocumentConstructor::getOwnPropertyDescriptor(ExecState* exec, const Iden
 
 static const HashTableValue JSDocumentPrototypeTableValues[38] =
 {
-    { "createElement", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateElement, (intptr_t)1 },
-    { "createDocumentFragment", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateDocumentFragment, (intptr_t)0 },
-    { "createTextNode", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateTextNode, (intptr_t)1 },
-    { "createComment", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateComment, (intptr_t)1 },
-    { "createCDATASection", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateCDATASection, (intptr_t)1 },
-    { "createProcessingInstruction", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateProcessingInstruction, (intptr_t)2 },
-    { "createAttribute", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateAttribute, (intptr_t)1 },
-    { "createEntityReference", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateEntityReference, (intptr_t)1 },
-    { "getElementsByTagName", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetElementsByTagName, (intptr_t)1 },
-    { "importNode", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionImportNode, (intptr_t)2 },
-    { "createElementNS", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateElementNS, (intptr_t)2 },
-    { "createAttributeNS", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateAttributeNS, (intptr_t)2 },
-    { "getElementsByTagNameNS", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetElementsByTagNameNS, (intptr_t)2 },
-    { "getElementById", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetElementById, (intptr_t)1 },
-    { "adoptNode", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionAdoptNode, (intptr_t)1 },
-    { "createEvent", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateEvent, (intptr_t)1 },
-    { "createRange", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateRange, (intptr_t)0 },
-    { "createNodeIterator", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateNodeIterator, (intptr_t)4 },
-    { "createTreeWalker", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateTreeWalker, (intptr_t)4 },
-    { "getOverrideStyle", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetOverrideStyle, (intptr_t)2 },
-    { "createExpression", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateExpression, (intptr_t)2 },
-    { "createNSResolver", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateNSResolver, (intptr_t)1 },
-    { "evaluate", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionEvaluate, (intptr_t)5 },
-    { "execCommand", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionExecCommand, (intptr_t)3 },
-    { "queryCommandEnabled", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionQueryCommandEnabled, (intptr_t)1 },
-    { "queryCommandIndeterm", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionQueryCommandIndeterm, (intptr_t)1 },
-    { "queryCommandState", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionQueryCommandState, (intptr_t)1 },
-    { "queryCommandSupported", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionQueryCommandSupported, (intptr_t)1 },
-    { "queryCommandValue", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionQueryCommandValue, (intptr_t)1 },
-    { "getElementsByName", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetElementsByName, (intptr_t)1 },
-    { "elementFromPoint", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionElementFromPoint, (intptr_t)2 },
-    { "caretRangeFromPoint", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCaretRangeFromPoint, (intptr_t)2 },
-    { "getSelection", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetSelection, (intptr_t)0 },
-    { "getCSSCanvasContext", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetCSSCanvasContext, (intptr_t)4 },
-    { "getElementsByClassName", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetElementsByClassName, (intptr_t)1 },
-    { "querySelector", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionQuerySelector, (intptr_t)1 },
-    { "querySelectorAll", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionQuerySelectorAll, (intptr_t)1 },
+    { "createElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateElement), (intptr_t)1 },
+    { "createDocumentFragment", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateDocumentFragment), (intptr_t)0 },
+    { "createTextNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateTextNode), (intptr_t)1 },
+    { "createComment", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateComment), (intptr_t)1 },
+    { "createCDATASection", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateCDATASection), (intptr_t)1 },
+    { "createProcessingInstruction", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateProcessingInstruction), (intptr_t)2 },
+    { "createAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateAttribute), (intptr_t)1 },
+    { "createEntityReference", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateEntityReference), (intptr_t)1 },
+    { "getElementsByTagName", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetElementsByTagName), (intptr_t)1 },
+    { "importNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionImportNode), (intptr_t)2 },
+    { "createElementNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateElementNS), (intptr_t)2 },
+    { "createAttributeNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateAttributeNS), (intptr_t)2 },
+    { "getElementsByTagNameNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetElementsByTagNameNS), (intptr_t)2 },
+    { "getElementById", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetElementById), (intptr_t)1 },
+    { "adoptNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionAdoptNode), (intptr_t)1 },
+    { "createEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateEvent), (intptr_t)1 },
+    { "createRange", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateRange), (intptr_t)0 },
+    { "createNodeIterator", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateNodeIterator), (intptr_t)4 },
+    { "createTreeWalker", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateTreeWalker), (intptr_t)4 },
+    { "getOverrideStyle", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetOverrideStyle), (intptr_t)2 },
+    { "createExpression", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateExpression), (intptr_t)2 },
+    { "createNSResolver", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateNSResolver), (intptr_t)1 },
+    { "evaluate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionEvaluate), (intptr_t)5 },
+    { "execCommand", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionExecCommand), (intptr_t)3 },
+    { "queryCommandEnabled", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionQueryCommandEnabled), (intptr_t)1 },
+    { "queryCommandIndeterm", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionQueryCommandIndeterm), (intptr_t)1 },
+    { "queryCommandState", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionQueryCommandState), (intptr_t)1 },
+    { "queryCommandSupported", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionQueryCommandSupported), (intptr_t)1 },
+    { "queryCommandValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionQueryCommandValue), (intptr_t)1 },
+    { "getElementsByName", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetElementsByName), (intptr_t)1 },
+    { "elementFromPoint", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionElementFromPoint), (intptr_t)2 },
+    { "caretRangeFromPoint", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCaretRangeFromPoint), (intptr_t)2 },
+    { "getSelection", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetSelection), (intptr_t)0 },
+    { "getCSSCanvasContext", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetCSSCanvasContext), (intptr_t)4 },
+    { "getElementsByClassName", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetElementsByClassName), (intptr_t)1 },
+    { "querySelector", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionQuerySelector), (intptr_t)1 },
+    { "querySelectorAll", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionQuerySelectorAll), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -302,725 +304,884 @@ JSDocument::JSDocument(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject
 {
 }
 
-JSDocument::~JSDocument()
-{
-    forgetDOMObject(this, static_cast<Document*>(impl()));
-}
-
 JSObject* JSDocument::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
     return new (exec) JSDocumentPrototype(JSDocumentPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
-JSValue jsDocumentDoctype(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDoctype(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->doctype()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->doctype()));
+    return result;
 }
 
-JSValue jsDocumentImplementation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentImplementation(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->implementation()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->implementation()));
+    return result;
 }
 
-JSValue jsDocumentDocumentElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDocumentElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->documentElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->documentElement()));
+    return result;
 }
 
-JSValue jsDocumentInputEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentInputEncoding(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->inputEncoding());
+    JSValue result = jsStringOrNull(exec, imp->inputEncoding());
+    return result;
 }
 
-JSValue jsDocumentXMLEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentXMLEncoding(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->xmlEncoding());
+    JSValue result = jsStringOrNull(exec, imp->xmlEncoding());
+    return result;
 }
 
-JSValue jsDocumentXMLVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentXMLVersion(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->xmlVersion());
+    JSValue result = jsStringOrNull(exec, imp->xmlVersion());
+    return result;
 }
 
-JSValue jsDocumentXMLStandalone(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentXMLStandalone(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsBoolean(imp->xmlStandalone());
+    JSValue result = jsBoolean(imp->xmlStandalone());
+    return result;
 }
 
-JSValue jsDocumentDocumentURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDocumentURI(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->documentURI());
+    JSValue result = jsStringOrNull(exec, imp->documentURI());
+    return result;
 }
 
-JSValue jsDocumentDefaultView(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDefaultView(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->defaultView()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->defaultView()));
+    return result;
 }
 
-JSValue jsDocumentStyleSheets(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentStyleSheets(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->styleSheets()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->styleSheets()));
+    return result;
 }
 
-JSValue jsDocumentTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTitle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsString(exec, imp->title());
+    JSValue result = jsString(exec, imp->title());
+    return result;
 }
 
-JSValue jsDocumentReferrer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentReferrer(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsString(exec, imp->referrer());
+    JSValue result = jsString(exec, imp->referrer());
+    return result;
 }
 
-JSValue jsDocumentDomain(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDomain(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsString(exec, imp->domain());
+    JSValue result = jsString(exec, imp->domain());
+    return result;
 }
 
-JSValue jsDocumentURL(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentURL(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsString(exec, imp->url());
+    JSValue result = jsString(exec, imp->url());
+    return result;
 }
 
-JSValue jsDocumentCookie(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentCookie(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
-    UNUSED_PARAM(exec);
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
+    ExceptionCode ec = 0;
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsString(exec, imp->cookie());
+    JSC::JSValue result = jsString(exec, imp->cookie(ec));
+    setDOMException(exec, ec);
+    return result;
 }
 
-JSValue jsDocumentBody(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentBody(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->body()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->body()));
+    return result;
 }
 
-JSValue jsDocumentHead(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentHead(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->head()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->head()));
+    return result;
 }
 
-JSValue jsDocumentImages(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentImages(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->images()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->images()));
+    return result;
 }
 
-JSValue jsDocumentApplets(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentApplets(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->applets()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->applets()));
+    return result;
 }
 
-JSValue jsDocumentLinks(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentLinks(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->links()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->links()));
+    return result;
 }
 
-JSValue jsDocumentForms(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentForms(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->forms()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->forms()));
+    return result;
 }
 
-JSValue jsDocumentAnchors(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentAnchors(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->anchors()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->anchors()));
+    return result;
 }
 
-JSValue jsDocumentLastModified(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentLastModified(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsString(exec, imp->lastModified());
+    JSValue result = jsString(exec, imp->lastModified());
+    return result;
 }
 
-JSValue jsDocumentLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentLocation(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     return castedThis->location(exec);
 }
 
-JSValue jsDocumentCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentCharset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrUndefined(exec, imp->charset());
+    JSValue result = jsStringOrUndefined(exec, imp->charset());
+    return result;
 }
 
-JSValue jsDocumentDefaultCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDefaultCharset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrUndefined(exec, imp->defaultCharset());
+    JSValue result = jsStringOrUndefined(exec, imp->defaultCharset());
+    return result;
 }
 
-JSValue jsDocumentReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentReadyState(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrUndefined(exec, imp->readyState());
+    JSValue result = jsStringOrUndefined(exec, imp->readyState());
+    return result;
 }
 
-JSValue jsDocumentCharacterSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentCharacterSet(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->characterSet());
+    JSValue result = jsStringOrNull(exec, imp->characterSet());
+    return result;
 }
 
-JSValue jsDocumentPreferredStylesheetSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentPreferredStylesheetSet(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->preferredStylesheetSet());
+    JSValue result = jsStringOrNull(exec, imp->preferredStylesheetSet());
+    return result;
 }
 
-JSValue jsDocumentSelectedStylesheetSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentSelectedStylesheetSet(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->selectedStylesheetSet());
+    JSValue result = jsStringOrNull(exec, imp->selectedStylesheetSet());
+    return result;
 }
 
-JSValue jsDocumentOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnabort(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onabort()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnblur(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onblur()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnchange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onchange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnclick(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onclick()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOncontextmenu(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->oncontextmenu()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndblclick(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondblclick()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndrag(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondrag()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndragend(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondragend()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndragenter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondragenter()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndragleave(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondragleave()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndragover(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondragover()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndragstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondragstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndrop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondrop()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnfocus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onfocus()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOninput(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->oninput()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOninvalid(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOninvalid(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->oninvalid()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnkeydown(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onkeydown()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnkeypress(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onkeypress()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnkeyup(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onkeyup()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnmousedown(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onmousedown()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnmousemove(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onmousemove()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnmouseout(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseout()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnmouseover(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseover()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnmouseup(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseup()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnmousewheel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onmousewheel()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnscroll(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onscroll()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnselect(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onselect()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnsubmit(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onsubmit()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnbeforecut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnbeforecut(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforecut()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOncut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOncut(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->oncut()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnbeforecopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnbeforecopy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforecopy()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOncopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOncopy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->oncopy()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnbeforepaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnbeforepaste(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforepaste()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnpaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnpaste(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onpaste()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnreset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onreset()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnsearch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onsearch()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnselectstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnselectstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onselectstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOntouchstart(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchstart()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOntouchmove(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* domObject = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchmove()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOntouchend(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchend()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOntouchcancel(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchcancel()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDocument* domObject = static_cast<JSDocument*>(asObject(slotBase));
     return JSDocument::getConstructor(exec, domObject->globalObject());
 }
 void JSDocument::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -1030,7 +1191,8 @@ void JSDocument::put(ExecState* exec, const Identifier& propertyName, JSValue va
 
 void setJSDocumentXMLVersion(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setXMLVersion(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -1038,7 +1200,8 @@ void setJSDocumentXMLVersion(ExecState* exec, JSObject* thisObject, JSValue valu
 
 void setJSDocumentXMLStandalone(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setXMLStandalone(value.toBoolean(exec), ec);
     setDOMException(exec, ec);
@@ -1046,19 +1209,22 @@ void setJSDocumentXMLStandalone(ExecState* exec, JSObject* thisObject, JSValue v
 
 void setJSDocumentDocumentURI(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     imp->setDocumentURI(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSDocumentTitle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     imp->setTitle(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSDocumentDomain(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setDomain(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -1066,13 +1232,17 @@ void setJSDocumentDomain(ExecState* exec, JSObject* thisObject, JSValue value)
 
 void setJSDocumentCookie(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    imp->setCookie(valueToStringWithNullCheck(exec, value));
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    imp->setCookie(valueToStringWithNullCheck(exec, value), ec);
+    setDOMException(exec, ec);
 }
 
 void setJSDocumentBody(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setBody(toHTMLElement(value), ec);
     setDOMException(exec, ec);
@@ -1085,13 +1255,15 @@ void setJSDocumentLocation(ExecState* exec, JSObject* thisObject, JSValue value)
 
 void setJSDocumentCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     imp->setCharset(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSDocumentSelectedStylesheetSet(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     imp->setSelectedStylesheetSet(valueToStringWithNullCheck(exec, value));
 }
 
@@ -1099,390 +1271,301 @@ void setJSDocumentOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
+    imp->setOnabort(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnblur(globalObject->createJSAttributeEventListener(value));
+    imp->setOnblur(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnchange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnchange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnclick(globalObject->createJSAttributeEventListener(value));
+    imp->setOnclick(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
+    imp->setOncontextmenu(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndblclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
+    imp->setOndblclick(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndrag(globalObject->createJSAttributeEventListener(value));
+    imp->setOndrag(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndragend(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragend(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragend(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndragenter(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragenter(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndragleave(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragleave(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndragover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragover(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragover(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndragstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragstart(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndrop(globalObject->createJSAttributeEventListener(value));
+    imp->setOndrop(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
+    imp->setOnfocus(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOninput(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOninput(globalObject->createJSAttributeEventListener(value));
+    imp->setOninput(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOninvalid(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOninvalid(globalObject->createJSAttributeEventListener(value));
+    imp->setOninvalid(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeydown(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnkeypress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeypress(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeyup(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnmousedown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousedown(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnmousemove(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousemove(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnmouseout(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseout(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnmouseover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseover(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseup(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousewheel(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
+    imp->setOnscroll(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnselect(globalObject->createJSAttributeEventListener(value));
+    imp->setOnselect(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsubmit(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnbeforecut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforecut(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforecut(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOncut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncut(globalObject->createJSAttributeEventListener(value));
+    imp->setOncut(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforecopy(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforecopy(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOncopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncopy(globalObject->createJSAttributeEventListener(value));
+    imp->setOncopy(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforepaste(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforepaste(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnpaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnpaste(globalObject->createJSAttributeEventListener(value));
+    imp->setOnpaste(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnreset(globalObject->createJSAttributeEventListener(value));
+    imp->setOnreset(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsearch(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnselectstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnselectstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOnselectstart(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSDocumentOntouchstart(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    imp->setOntouchstart(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSDocumentOntouchmove(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    imp->setOntouchmove(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSDocumentOntouchend(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    imp->setOntouchend(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSDocumentOntouchcancel(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    imp->setOntouchcancel(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSDocument::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.h b/src/3rdparty/webkit/WebCore/generated/JSDocument.h
index 7b72b9b145..f44c5ab9df 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.h
@@ -34,7 +34,6 @@ class JSDocument : public JSNode {
     typedef JSNode Base;
 public:
     JSDocument(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<Document>);
-    virtual ~JSDocument();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -85,7 +84,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDocumentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -133,125 +132,133 @@ JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelector(JSC::ExecSta
 JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDocumentDoctype(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentImplementation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentDocumentElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentInputEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentXMLEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentXMLVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentDoctype(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentImplementation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentDocumentElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentInputEncoding(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentXMLEncoding(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentXMLVersion(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentXMLVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentXMLStandalone(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentXMLStandalone(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentXMLStandalone(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentDocumentURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentDocumentURI(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentDocumentURI(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentDefaultView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentStyleSheets(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentDefaultView(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentStyleSheets(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentTitle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentReferrer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentDomain(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentReferrer(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentDomain(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentDomain(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentURL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentCookie(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentURL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentCookie(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentCookie(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentBody(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentBody(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentBody(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentHead(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentImages(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentApplets(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentLinks(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentForms(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentAnchors(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentLastModified(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentHead(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentImages(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentApplets(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentLinks(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentForms(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentAnchors(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentLastModified(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentLocation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentCharset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentDefaultCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentCharacterSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentPreferredStylesheetSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentSelectedStylesheetSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentDefaultCharset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentReadyState(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentCharacterSet(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentPreferredStylesheetSet(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentSelectedStylesheetSet(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentSelectedStylesheetSet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnabort(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnblur(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnclick(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOncontextmenu(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndblclick(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndrag(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndragend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndragenter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndragleave(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndragover(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndragstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndrop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnfocus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOninput(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOninvalid(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOninvalid(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOninvalid(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnkeydown(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnkeypress(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnkeyup(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnmousedown(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnmousemove(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnmouseout(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnmouseover(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnmouseup(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnmousewheel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnscroll(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnselect(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnsubmit(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnbeforecut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnbeforecut(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnbeforecut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOncut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOncut(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOncut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnbeforecopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnbeforecopy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnbeforecopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOncopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOncopy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOncopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnbeforepaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnbeforepaste(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnbeforepaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnpaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnpaste(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnpaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnreset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnsearch(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnselectstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnselectstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnselectstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOntouchstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDocumentOntouchstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOntouchmove(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDocumentOntouchmove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOntouchend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDocumentOntouchend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOntouchcancel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDocumentOntouchcancel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
index 19a132e21e..478c673694 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
@@ -40,7 +40,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDocumentFragment);
 
 static const HashTableValue JSDocumentFragmentTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDocumentFragmentConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentFragmentConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -102,8 +102,8 @@ bool JSDocumentFragmentConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 static const HashTableValue JSDocumentFragmentPrototypeTableValues[3] =
 {
-    { "querySelector", DontDelete|Function, (intptr_t)jsDocumentFragmentPrototypeFunctionQuerySelector, (intptr_t)1 },
-    { "querySelectorAll", DontDelete|Function, (intptr_t)jsDocumentFragmentPrototypeFunctionQuerySelectorAll, (intptr_t)1 },
+    { "querySelector", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentFragmentPrototypeFunctionQuerySelector), (intptr_t)1 },
+    { "querySelectorAll", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentFragmentPrototypeFunctionQuerySelectorAll), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -153,9 +153,9 @@ bool JSDocumentFragment::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSDocumentFragment, Base>(exec, &JSDocumentFragmentTable, this, propertyName, descriptor);
 }
 
-JSValue jsDocumentFragmentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentFragmentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentFragment* domObject = static_cast<JSDocumentFragment*>(asObject(slot.slotBase()));
+    JSDocumentFragment* domObject = static_cast<JSDocumentFragment*>(asObject(slotBase));
     return JSDocumentFragment::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSDocumentFragment::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
index 83120bf7e6..a834d4107a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDocumentFragmentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -71,7 +71,7 @@ JSC::JSValue JSC_HOST_CALL jsDocumentFragmentPrototypeFunctionQuerySelector(JSC:
 JSC::JSValue JSC_HOST_CALL jsDocumentFragmentPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDocumentFragmentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentFragmentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
index 3ca49ddc02..5b3b1281a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
@@ -38,13 +38,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSDocumentType);
 
 static const HashTableValue JSDocumentTypeTableValues[8] =
 {
-    { "name", DontDelete|ReadOnly, (intptr_t)jsDocumentTypeName, (intptr_t)0 },
-    { "entities", DontDelete|ReadOnly, (intptr_t)jsDocumentTypeEntities, (intptr_t)0 },
-    { "notations", DontDelete|ReadOnly, (intptr_t)jsDocumentTypeNotations, (intptr_t)0 },
-    { "publicId", DontDelete|ReadOnly, (intptr_t)jsDocumentTypePublicId, (intptr_t)0 },
-    { "systemId", DontDelete|ReadOnly, (intptr_t)jsDocumentTypeSystemId, (intptr_t)0 },
-    { "internalSubset", DontDelete|ReadOnly, (intptr_t)jsDocumentTypeInternalSubset, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDocumentTypeConstructor, (intptr_t)0 },
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTypeName), (intptr_t)0 },
+    { "entities", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTypeEntities), (intptr_t)0 },
+    { "notations", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTypeNotations), (intptr_t)0 },
+    { "publicId", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTypePublicId), (intptr_t)0 },
+    { "systemId", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTypeSystemId), (intptr_t)0 },
+    { "internalSubset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTypeInternalSubset), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTypeConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -83,7 +83,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -145,57 +145,63 @@ bool JSDocumentType::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSDocumentType, Base>(exec, &JSDocumentTypeTable, this, propertyName, descriptor);
 }
 
-JSValue jsDocumentTypeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slot.slotBase()));
+    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsDocumentTypeEntities(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeEntities(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slot.slotBase()));
+    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->entities()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->entities()));
+    return result;
 }
 
-JSValue jsDocumentTypeNotations(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeNotations(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slot.slotBase()));
+    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->notations()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->notations()));
+    return result;
 }
 
-JSValue jsDocumentTypePublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypePublicId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slot.slotBase()));
+    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->publicId());
+    JSValue result = jsStringOrNull(exec, imp->publicId());
+    return result;
 }
 
-JSValue jsDocumentTypeSystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeSystemId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slot.slotBase()));
+    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->systemId());
+    JSValue result = jsStringOrNull(exec, imp->systemId());
+    return result;
 }
 
-JSValue jsDocumentTypeInternalSubset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeInternalSubset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slot.slotBase()));
+    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->internalSubset());
+    JSValue result = jsStringOrNull(exec, imp->internalSubset());
+    return result;
 }
 
-JSValue jsDocumentTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentType* domObject = static_cast<JSDocumentType*>(asObject(slot.slotBase()));
+    JSDocumentType* domObject = static_cast<JSDocumentType*>(asObject(slotBase));
     return JSDocumentType::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSDocumentType::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
index 72da9be7dc..2ef2ce050d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -62,7 +62,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDocumentTypePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -71,13 +71,13 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsDocumentTypeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentTypeEntities(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentTypeNotations(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentTypePublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentTypeSystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentTypeInternalSubset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypeName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentTypeEntities(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentTypeNotations(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentTypePublicId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentTypeSystemId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentTypeInternalSubset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentTypeConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
index 3d3187f6d9..f62a0f3843 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
@@ -28,12 +28,10 @@
 #include "ClientRectList.h"
 #include "Element.h"
 #include "EventListener.h"
-#include "Frame.h"
 #include "JSAttr.h"
 #include "JSCSSStyleDeclaration.h"
 #include "JSClientRect.h"
 #include "JSClientRectList.h"
-#include "JSDOMGlobalObject.h"
 #include "JSElement.h"
 #include "JSEventListener.h"
 #include "JSNodeList.h"
@@ -53,68 +51,72 @@ ASSERT_CLASS_FITS_IN_CELL(JSElement);
 
 /* Hash table */
 
-static const HashTableValue JSElementTableValues[61] =
-{
-    { "tagName", DontDelete|ReadOnly, (intptr_t)jsElementTagName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsElementStyle, (intptr_t)0 },
-    { "offsetLeft", DontDelete|ReadOnly, (intptr_t)jsElementOffsetLeft, (intptr_t)0 },
-    { "offsetTop", DontDelete|ReadOnly, (intptr_t)jsElementOffsetTop, (intptr_t)0 },
-    { "offsetWidth", DontDelete|ReadOnly, (intptr_t)jsElementOffsetWidth, (intptr_t)0 },
-    { "offsetHeight", DontDelete|ReadOnly, (intptr_t)jsElementOffsetHeight, (intptr_t)0 },
-    { "offsetParent", DontDelete|ReadOnly, (intptr_t)jsElementOffsetParent, (intptr_t)0 },
-    { "clientLeft", DontDelete|ReadOnly, (intptr_t)jsElementClientLeft, (intptr_t)0 },
-    { "clientTop", DontDelete|ReadOnly, (intptr_t)jsElementClientTop, (intptr_t)0 },
-    { "clientWidth", DontDelete|ReadOnly, (intptr_t)jsElementClientWidth, (intptr_t)0 },
-    { "clientHeight", DontDelete|ReadOnly, (intptr_t)jsElementClientHeight, (intptr_t)0 },
-    { "scrollLeft", DontDelete, (intptr_t)jsElementScrollLeft, (intptr_t)setJSElementScrollLeft },
-    { "scrollTop", DontDelete, (intptr_t)jsElementScrollTop, (intptr_t)setJSElementScrollTop },
-    { "scrollWidth", DontDelete|ReadOnly, (intptr_t)jsElementScrollWidth, (intptr_t)0 },
-    { "scrollHeight", DontDelete|ReadOnly, (intptr_t)jsElementScrollHeight, (intptr_t)0 },
-    { "firstElementChild", DontDelete|ReadOnly, (intptr_t)jsElementFirstElementChild, (intptr_t)0 },
-    { "lastElementChild", DontDelete|ReadOnly, (intptr_t)jsElementLastElementChild, (intptr_t)0 },
-    { "previousElementSibling", DontDelete|ReadOnly, (intptr_t)jsElementPreviousElementSibling, (intptr_t)0 },
-    { "nextElementSibling", DontDelete|ReadOnly, (intptr_t)jsElementNextElementSibling, (intptr_t)0 },
-    { "childElementCount", DontDelete|ReadOnly, (intptr_t)jsElementChildElementCount, (intptr_t)0 },
-    { "onabort", DontDelete|DontEnum, (intptr_t)jsElementOnabort, (intptr_t)setJSElementOnabort },
-    { "onblur", DontDelete|DontEnum, (intptr_t)jsElementOnblur, (intptr_t)setJSElementOnblur },
-    { "onchange", DontDelete|DontEnum, (intptr_t)jsElementOnchange, (intptr_t)setJSElementOnchange },
-    { "onclick", DontDelete|DontEnum, (intptr_t)jsElementOnclick, (intptr_t)setJSElementOnclick },
-    { "oncontextmenu", DontDelete|DontEnum, (intptr_t)jsElementOncontextmenu, (intptr_t)setJSElementOncontextmenu },
-    { "ondblclick", DontDelete|DontEnum, (intptr_t)jsElementOndblclick, (intptr_t)setJSElementOndblclick },
-    { "ondrag", DontDelete|DontEnum, (intptr_t)jsElementOndrag, (intptr_t)setJSElementOndrag },
-    { "ondragend", DontDelete|DontEnum, (intptr_t)jsElementOndragend, (intptr_t)setJSElementOndragend },
-    { "ondragenter", DontDelete|DontEnum, (intptr_t)jsElementOndragenter, (intptr_t)setJSElementOndragenter },
-    { "ondragleave", DontDelete|DontEnum, (intptr_t)jsElementOndragleave, (intptr_t)setJSElementOndragleave },
-    { "ondragover", DontDelete|DontEnum, (intptr_t)jsElementOndragover, (intptr_t)setJSElementOndragover },
-    { "ondragstart", DontDelete|DontEnum, (intptr_t)jsElementOndragstart, (intptr_t)setJSElementOndragstart },
-    { "ondrop", DontDelete|DontEnum, (intptr_t)jsElementOndrop, (intptr_t)setJSElementOndrop },
-    { "onerror", DontDelete|DontEnum, (intptr_t)jsElementOnerror, (intptr_t)setJSElementOnerror },
-    { "onfocus", DontDelete|DontEnum, (intptr_t)jsElementOnfocus, (intptr_t)setJSElementOnfocus },
-    { "oninput", DontDelete|DontEnum, (intptr_t)jsElementOninput, (intptr_t)setJSElementOninput },
-    { "oninvalid", DontDelete|DontEnum, (intptr_t)jsElementOninvalid, (intptr_t)setJSElementOninvalid },
-    { "onkeydown", DontDelete|DontEnum, (intptr_t)jsElementOnkeydown, (intptr_t)setJSElementOnkeydown },
-    { "onkeypress", DontDelete|DontEnum, (intptr_t)jsElementOnkeypress, (intptr_t)setJSElementOnkeypress },
-    { "onkeyup", DontDelete|DontEnum, (intptr_t)jsElementOnkeyup, (intptr_t)setJSElementOnkeyup },
-    { "onload", DontDelete|DontEnum, (intptr_t)jsElementOnload, (intptr_t)setJSElementOnload },
-    { "onmousedown", DontDelete|DontEnum, (intptr_t)jsElementOnmousedown, (intptr_t)setJSElementOnmousedown },
-    { "onmousemove", DontDelete|DontEnum, (intptr_t)jsElementOnmousemove, (intptr_t)setJSElementOnmousemove },
-    { "onmouseout", DontDelete|DontEnum, (intptr_t)jsElementOnmouseout, (intptr_t)setJSElementOnmouseout },
-    { "onmouseover", DontDelete|DontEnum, (intptr_t)jsElementOnmouseover, (intptr_t)setJSElementOnmouseover },
-    { "onmouseup", DontDelete|DontEnum, (intptr_t)jsElementOnmouseup, (intptr_t)setJSElementOnmouseup },
-    { "onmousewheel", DontDelete|DontEnum, (intptr_t)jsElementOnmousewheel, (intptr_t)setJSElementOnmousewheel },
-    { "onscroll", DontDelete|DontEnum, (intptr_t)jsElementOnscroll, (intptr_t)setJSElementOnscroll },
-    { "onselect", DontDelete|DontEnum, (intptr_t)jsElementOnselect, (intptr_t)setJSElementOnselect },
-    { "onsubmit", DontDelete|DontEnum, (intptr_t)jsElementOnsubmit, (intptr_t)setJSElementOnsubmit },
-    { "onbeforecut", DontDelete|DontEnum, (intptr_t)jsElementOnbeforecut, (intptr_t)setJSElementOnbeforecut },
-    { "oncut", DontDelete|DontEnum, (intptr_t)jsElementOncut, (intptr_t)setJSElementOncut },
-    { "onbeforecopy", DontDelete|DontEnum, (intptr_t)jsElementOnbeforecopy, (intptr_t)setJSElementOnbeforecopy },
-    { "oncopy", DontDelete|DontEnum, (intptr_t)jsElementOncopy, (intptr_t)setJSElementOncopy },
-    { "onbeforepaste", DontDelete|DontEnum, (intptr_t)jsElementOnbeforepaste, (intptr_t)setJSElementOnbeforepaste },
-    { "onpaste", DontDelete|DontEnum, (intptr_t)jsElementOnpaste, (intptr_t)setJSElementOnpaste },
-    { "onreset", DontDelete|DontEnum, (intptr_t)jsElementOnreset, (intptr_t)setJSElementOnreset },
-    { "onsearch", DontDelete|DontEnum, (intptr_t)jsElementOnsearch, (intptr_t)setJSElementOnsearch },
-    { "onselectstart", DontDelete|DontEnum, (intptr_t)jsElementOnselectstart, (intptr_t)setJSElementOnselectstart },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsElementConstructor, (intptr_t)0 },
+static const HashTableValue JSElementTableValues[65] =
+{
+    { "tagName", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementTagName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementStyle), (intptr_t)0 },
+    { "offsetLeft", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOffsetLeft), (intptr_t)0 },
+    { "offsetTop", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOffsetTop), (intptr_t)0 },
+    { "offsetWidth", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOffsetWidth), (intptr_t)0 },
+    { "offsetHeight", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOffsetHeight), (intptr_t)0 },
+    { "offsetParent", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOffsetParent), (intptr_t)0 },
+    { "clientLeft", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementClientLeft), (intptr_t)0 },
+    { "clientTop", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementClientTop), (intptr_t)0 },
+    { "clientWidth", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementClientWidth), (intptr_t)0 },
+    { "clientHeight", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementClientHeight), (intptr_t)0 },
+    { "scrollLeft", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementScrollLeft), (intptr_t)setJSElementScrollLeft },
+    { "scrollTop", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementScrollTop), (intptr_t)setJSElementScrollTop },
+    { "scrollWidth", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementScrollWidth), (intptr_t)0 },
+    { "scrollHeight", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementScrollHeight), (intptr_t)0 },
+    { "firstElementChild", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementFirstElementChild), (intptr_t)0 },
+    { "lastElementChild", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementLastElementChild), (intptr_t)0 },
+    { "previousElementSibling", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementPreviousElementSibling), (intptr_t)0 },
+    { "nextElementSibling", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementNextElementSibling), (intptr_t)0 },
+    { "childElementCount", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementChildElementCount), (intptr_t)0 },
+    { "onabort", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnabort), (intptr_t)setJSElementOnabort },
+    { "onblur", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnblur), (intptr_t)setJSElementOnblur },
+    { "onchange", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnchange), (intptr_t)setJSElementOnchange },
+    { "onclick", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnclick), (intptr_t)setJSElementOnclick },
+    { "oncontextmenu", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOncontextmenu), (intptr_t)setJSElementOncontextmenu },
+    { "ondblclick", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndblclick), (intptr_t)setJSElementOndblclick },
+    { "ondrag", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndrag), (intptr_t)setJSElementOndrag },
+    { "ondragend", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndragend), (intptr_t)setJSElementOndragend },
+    { "ondragenter", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndragenter), (intptr_t)setJSElementOndragenter },
+    { "ondragleave", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndragleave), (intptr_t)setJSElementOndragleave },
+    { "ondragover", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndragover), (intptr_t)setJSElementOndragover },
+    { "ondragstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndragstart), (intptr_t)setJSElementOndragstart },
+    { "ondrop", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndrop), (intptr_t)setJSElementOndrop },
+    { "onerror", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnerror), (intptr_t)setJSElementOnerror },
+    { "onfocus", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnfocus), (intptr_t)setJSElementOnfocus },
+    { "oninput", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOninput), (intptr_t)setJSElementOninput },
+    { "oninvalid", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOninvalid), (intptr_t)setJSElementOninvalid },
+    { "onkeydown", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnkeydown), (intptr_t)setJSElementOnkeydown },
+    { "onkeypress", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnkeypress), (intptr_t)setJSElementOnkeypress },
+    { "onkeyup", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnkeyup), (intptr_t)setJSElementOnkeyup },
+    { "onload", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnload), (intptr_t)setJSElementOnload },
+    { "onmousedown", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnmousedown), (intptr_t)setJSElementOnmousedown },
+    { "onmousemove", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnmousemove), (intptr_t)setJSElementOnmousemove },
+    { "onmouseout", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnmouseout), (intptr_t)setJSElementOnmouseout },
+    { "onmouseover", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnmouseover), (intptr_t)setJSElementOnmouseover },
+    { "onmouseup", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnmouseup), (intptr_t)setJSElementOnmouseup },
+    { "onmousewheel", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnmousewheel), (intptr_t)setJSElementOnmousewheel },
+    { "onscroll", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnscroll), (intptr_t)setJSElementOnscroll },
+    { "onselect", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnselect), (intptr_t)setJSElementOnselect },
+    { "onsubmit", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnsubmit), (intptr_t)setJSElementOnsubmit },
+    { "onbeforecut", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnbeforecut), (intptr_t)setJSElementOnbeforecut },
+    { "oncut", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOncut), (intptr_t)setJSElementOncut },
+    { "onbeforecopy", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnbeforecopy), (intptr_t)setJSElementOnbeforecopy },
+    { "oncopy", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOncopy), (intptr_t)setJSElementOncopy },
+    { "onbeforepaste", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnbeforepaste), (intptr_t)setJSElementOnbeforepaste },
+    { "onpaste", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnpaste), (intptr_t)setJSElementOnpaste },
+    { "onreset", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnreset), (intptr_t)setJSElementOnreset },
+    { "onsearch", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnsearch), (intptr_t)setJSElementOnsearch },
+    { "onselectstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnselectstart), (intptr_t)setJSElementOnselectstart },
+    { "ontouchstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOntouchstart), (intptr_t)setJSElementOntouchstart },
+    { "ontouchmove", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOntouchmove), (intptr_t)setJSElementOntouchmove },
+    { "ontouchend", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOntouchend), (intptr_t)setJSElementOntouchend },
+    { "ontouchcancel", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOntouchcancel), (intptr_t)setJSElementOntouchcancel },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -122,7 +124,7 @@ static JSC_CONST_HASHTABLE HashTable JSElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 8191, JSElementTableValues, 0 };
 #else
-    { 141, 127, JSElementTableValues, 0 };
+    { 144, 127, JSElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -153,7 +155,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -176,34 +178,34 @@ bool JSElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ident
 
 static const HashTableValue JSElementPrototypeTableValues[29] =
 {
-    { "getAttribute", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetAttribute, (intptr_t)1 },
-    { "setAttribute", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionSetAttribute, (intptr_t)2 },
-    { "removeAttribute", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionRemoveAttribute, (intptr_t)1 },
-    { "getAttributeNode", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetAttributeNode, (intptr_t)1 },
-    { "setAttributeNode", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionSetAttributeNode, (intptr_t)1 },
-    { "removeAttributeNode", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionRemoveAttributeNode, (intptr_t)1 },
-    { "getElementsByTagName", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetElementsByTagName, (intptr_t)1 },
-    { "getAttributeNS", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetAttributeNS, (intptr_t)2 },
-    { "setAttributeNS", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionSetAttributeNS, (intptr_t)3 },
-    { "removeAttributeNS", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionRemoveAttributeNS, (intptr_t)2 },
-    { "getElementsByTagNameNS", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetElementsByTagNameNS, (intptr_t)2 },
-    { "getAttributeNodeNS", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetAttributeNodeNS, (intptr_t)2 },
-    { "setAttributeNodeNS", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionSetAttributeNodeNS, (intptr_t)1 },
-    { "hasAttribute", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionHasAttribute, (intptr_t)1 },
-    { "hasAttributeNS", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionHasAttributeNS, (intptr_t)2 },
-    { "focus", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionFocus, (intptr_t)0 },
-    { "blur", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionBlur, (intptr_t)0 },
-    { "scrollIntoView", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionScrollIntoView, (intptr_t)1 },
-    { "contains", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionContains, (intptr_t)1 },
-    { "scrollIntoViewIfNeeded", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionScrollIntoViewIfNeeded, (intptr_t)1 },
-    { "scrollByLines", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionScrollByLines, (intptr_t)1 },
-    { "scrollByPages", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionScrollByPages, (intptr_t)1 },
-    { "getElementsByClassName", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetElementsByClassName, (intptr_t)1 },
-    { "querySelector", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionQuerySelector, (intptr_t)1 },
-    { "querySelectorAll", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionQuerySelectorAll, (intptr_t)1 },
-    { "webkitMatchesSelector", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionWebkitMatchesSelector, (intptr_t)1 },
-    { "getClientRects", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetClientRects, (intptr_t)0 },
-    { "getBoundingClientRect", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetBoundingClientRect, (intptr_t)0 },
+    { "getAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetAttribute), (intptr_t)1 },
+    { "setAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionSetAttribute), (intptr_t)2 },
+    { "removeAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionRemoveAttribute), (intptr_t)1 },
+    { "getAttributeNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetAttributeNode), (intptr_t)1 },
+    { "setAttributeNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionSetAttributeNode), (intptr_t)1 },
+    { "removeAttributeNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionRemoveAttributeNode), (intptr_t)1 },
+    { "getElementsByTagName", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetElementsByTagName), (intptr_t)1 },
+    { "getAttributeNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetAttributeNS), (intptr_t)2 },
+    { "setAttributeNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionSetAttributeNS), (intptr_t)3 },
+    { "removeAttributeNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionRemoveAttributeNS), (intptr_t)2 },
+    { "getElementsByTagNameNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetElementsByTagNameNS), (intptr_t)2 },
+    { "getAttributeNodeNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetAttributeNodeNS), (intptr_t)2 },
+    { "setAttributeNodeNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionSetAttributeNodeNS), (intptr_t)1 },
+    { "hasAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionHasAttribute), (intptr_t)1 },
+    { "hasAttributeNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionHasAttributeNS), (intptr_t)2 },
+    { "focus", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionFocus), (intptr_t)0 },
+    { "blur", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionBlur), (intptr_t)0 },
+    { "scrollIntoView", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionScrollIntoView), (intptr_t)1 },
+    { "contains", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionContains), (intptr_t)1 },
+    { "scrollIntoViewIfNeeded", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionScrollIntoViewIfNeeded), (intptr_t)1 },
+    { "scrollByLines", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionScrollByLines), (intptr_t)1 },
+    { "scrollByPages", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionScrollByPages), (intptr_t)1 },
+    { "getElementsByClassName", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetElementsByClassName), (intptr_t)1 },
+    { "querySelector", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionQuerySelector), (intptr_t)1 },
+    { "querySelectorAll", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionQuerySelectorAll), (intptr_t)1 },
+    { "webkitMatchesSelector", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionWebkitMatchesSelector), (intptr_t)1 },
+    { "getClientRects", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetClientRects), (intptr_t)0 },
+    { "getBoundingClientRect", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetBoundingClientRect), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -243,637 +245,791 @@ JSObject* JSElement::createPrototype(ExecState* exec, JSGlobalObject* globalObje
     return new (exec) JSElementPrototype(JSElementPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
-JSValue jsElementTagName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementTagName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->tagName());
+    JSValue result = jsStringOrNull(exec, imp->tagName());
+    return result;
 }
 
-JSValue jsElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsElementOffsetLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetLeft(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->offsetLeft());
+    JSValue result = jsNumber(exec, imp->offsetLeft());
+    return result;
 }
 
-JSValue jsElementOffsetTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetTop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->offsetTop());
+    JSValue result = jsNumber(exec, imp->offsetTop());
+    return result;
 }
 
-JSValue jsElementOffsetWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->offsetWidth());
+    JSValue result = jsNumber(exec, imp->offsetWidth());
+    return result;
 }
 
-JSValue jsElementOffsetHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->offsetHeight());
+    JSValue result = jsNumber(exec, imp->offsetHeight());
+    return result;
 }
 
-JSValue jsElementOffsetParent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetParent(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->offsetParent()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->offsetParent()));
+    return result;
 }
 
-JSValue jsElementClientLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientLeft(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->clientLeft());
+    JSValue result = jsNumber(exec, imp->clientLeft());
+    return result;
 }
 
-JSValue jsElementClientTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientTop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->clientTop());
+    JSValue result = jsNumber(exec, imp->clientTop());
+    return result;
 }
 
-JSValue jsElementClientWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->clientWidth());
+    JSValue result = jsNumber(exec, imp->clientWidth());
+    return result;
 }
 
-JSValue jsElementClientHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->clientHeight());
+    JSValue result = jsNumber(exec, imp->clientHeight());
+    return result;
 }
 
-JSValue jsElementScrollLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollLeft(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->scrollLeft());
+    JSValue result = jsNumber(exec, imp->scrollLeft());
+    return result;
 }
 
-JSValue jsElementScrollTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollTop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->scrollTop());
+    JSValue result = jsNumber(exec, imp->scrollTop());
+    return result;
 }
 
-JSValue jsElementScrollWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->scrollWidth());
+    JSValue result = jsNumber(exec, imp->scrollWidth());
+    return result;
 }
 
-JSValue jsElementScrollHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->scrollHeight());
+    JSValue result = jsNumber(exec, imp->scrollHeight());
+    return result;
 }
 
-JSValue jsElementFirstElementChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementFirstElementChild(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->firstElementChild()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->firstElementChild()));
+    return result;
 }
 
-JSValue jsElementLastElementChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementLastElementChild(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->lastElementChild()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->lastElementChild()));
+    return result;
 }
 
-JSValue jsElementPreviousElementSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementPreviousElementSibling(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->previousElementSibling()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->previousElementSibling()));
+    return result;
 }
 
-JSValue jsElementNextElementSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementNextElementSibling(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nextElementSibling()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nextElementSibling()));
+    return result;
 }
 
-JSValue jsElementChildElementCount(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementChildElementCount(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->childElementCount());
+    JSValue result = jsNumber(exec, imp->childElementCount());
+    return result;
 }
 
-JSValue jsElementOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnabort(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onabort()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnblur(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onblur()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnchange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onchange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnclick(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onclick()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOncontextmenu(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->oncontextmenu()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndblclick(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondblclick()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndrag(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondrag()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndragend(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondragend()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndragenter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondragenter()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndragleave(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondragleave()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndragover(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondragover()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndragstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondragstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndrop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondrop()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnfocus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onfocus()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOninput(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->oninput()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOninvalid(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOninvalid(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->oninvalid()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnkeydown(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onkeydown()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnkeypress(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onkeypress()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnkeyup(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onkeyup()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnmousedown(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onmousedown()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnmousemove(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onmousemove()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnmouseout(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseout()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnmouseover(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseover()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnmouseup(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseup()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnmousewheel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onmousewheel()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnscroll(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onscroll()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnselect(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onselect()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnsubmit(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onsubmit()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnbeforecut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnbeforecut(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforecut()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOncut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOncut(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->oncut()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnbeforecopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnbeforecopy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforecopy()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOncopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOncopy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->oncopy()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnbeforepaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnbeforepaste(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforepaste()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnpaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnpaste(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onpaste()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnreset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onreset()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnsearch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onsearch()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnselectstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnselectstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onselectstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsElementOntouchstart(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchstart()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsElementOntouchmove(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchmove()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsElementOntouchend(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchend()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsElementOntouchcancel(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchcancel()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* domObject = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* domObject = static_cast<JSElement*>(asObject(slotBase));
     return JSElement::getConstructor(exec, domObject->globalObject());
 }
 void JSElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -883,13 +1039,15 @@ void JSElement::put(ExecState* exec, const Identifier& propertyName, JSValue val
 
 void setJSElementScrollLeft(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSElement* castedThisObj = static_cast<JSElement*>(thisObject);
+    Element* imp = static_cast<Element*>(castedThisObj->impl());
     imp->setScrollLeft(value.toInt32(exec));
 }
 
 void setJSElementScrollTop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSElement* castedThisObj = static_cast<JSElement*>(thisObject);
+    Element* imp = static_cast<Element*>(castedThisObj->impl());
     imp->setScrollTop(value.toInt32(exec));
 }
 
@@ -897,390 +1055,301 @@ void setJSElementOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
+    imp->setOnabort(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnblur(globalObject->createJSAttributeEventListener(value));
+    imp->setOnblur(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnchange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnchange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnclick(globalObject->createJSAttributeEventListener(value));
+    imp->setOnclick(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
+    imp->setOncontextmenu(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndblclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
+    imp->setOndblclick(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndrag(globalObject->createJSAttributeEventListener(value));
+    imp->setOndrag(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndragend(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragend(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragend(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndragenter(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragenter(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndragleave(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragleave(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndragover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragover(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragover(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndragstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragstart(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndrop(globalObject->createJSAttributeEventListener(value));
+    imp->setOndrop(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
+    imp->setOnfocus(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOninput(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOninput(globalObject->createJSAttributeEventListener(value));
+    imp->setOninput(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOninvalid(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOninvalid(globalObject->createJSAttributeEventListener(value));
+    imp->setOninvalid(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeydown(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnkeypress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeypress(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeyup(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnmousedown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousedown(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnmousemove(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousemove(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnmouseout(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseout(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnmouseover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseover(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseup(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousewheel(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
+    imp->setOnscroll(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnselect(globalObject->createJSAttributeEventListener(value));
+    imp->setOnselect(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsubmit(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnbeforecut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforecut(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforecut(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOncut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncut(globalObject->createJSAttributeEventListener(value));
+    imp->setOncut(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforecopy(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforecopy(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOncopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncopy(globalObject->createJSAttributeEventListener(value));
+    imp->setOncopy(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforepaste(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforepaste(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnpaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnpaste(globalObject->createJSAttributeEventListener(value));
+    imp->setOnpaste(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnreset(globalObject->createJSAttributeEventListener(value));
+    imp->setOnreset(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsearch(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnselectstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnselectstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOnselectstart(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSElementOntouchstart(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    imp->setOntouchstart(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSElementOntouchmove(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    imp->setOntouchmove(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSElementOntouchend(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    imp->setOntouchend(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSElementOntouchcancel(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    imp->setOntouchcancel(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.h b/src/3rdparty/webkit/WebCore/generated/JSElement.h
index 141d115067..e8038f84a9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -86,7 +86,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -125,107 +125,115 @@ JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetClientRects(JSC::ExecSta
 JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetBoundingClientRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsElementTagName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementOffsetLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementOffsetTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementOffsetWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementOffsetHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementOffsetParent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementClientLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementClientTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementClientWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementClientHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementScrollLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementTagName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementOffsetLeft(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementOffsetTop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementOffsetWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementOffsetHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementOffsetParent(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementClientLeft(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementClientTop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementClientWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementClientHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementScrollLeft(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementScrollLeft(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementScrollTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementScrollTop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementScrollTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementScrollWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementScrollHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementFirstElementChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementLastElementChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementPreviousElementSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementNextElementSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementChildElementCount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementScrollWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementScrollHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementFirstElementChild(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementLastElementChild(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementPreviousElementSibling(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementNextElementSibling(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementChildElementCount(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementOnabort(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnblur(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnclick(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOncontextmenu(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndblclick(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndrag(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndragend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndragenter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndragleave(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndragover(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndragstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndrop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnfocus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOninput(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOninvalid(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOninvalid(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOninvalid(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnkeydown(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnkeypress(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnkeyup(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnmousedown(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnmousemove(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnmouseout(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnmouseover(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnmouseup(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnmousewheel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnscroll(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnselect(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnsubmit(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnbeforecut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnbeforecut(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnbeforecut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOncut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOncut(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOncut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnbeforecopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnbeforecopy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnbeforecopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOncopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOncopy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOncopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnbeforepaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnbeforepaste(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnbeforepaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnpaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnpaste(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnpaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnreset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnsearch(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnselectstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnselectstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnselectstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOntouchstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSElementOntouchstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOntouchmove(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSElementOntouchmove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOntouchend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSElementOntouchend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOntouchcancel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSElementOntouchcancel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp b/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
index 6f870e4edf..c68e3e1cab 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
@@ -35,10 +35,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSEntity);
 
 static const HashTableValue JSEntityTableValues[5] =
 {
-    { "publicId", DontDelete|ReadOnly, (intptr_t)jsEntityPublicId, (intptr_t)0 },
-    { "systemId", DontDelete|ReadOnly, (intptr_t)jsEntitySystemId, (intptr_t)0 },
-    { "notationName", DontDelete|ReadOnly, (intptr_t)jsEntityNotationName, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsEntityConstructor, (intptr_t)0 },
+    { "publicId", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEntityPublicId), (intptr_t)0 },
+    { "systemId", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEntitySystemId), (intptr_t)0 },
+    { "notationName", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEntityNotationName), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEntityConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -139,33 +139,36 @@ bool JSEntity::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prope
     return getStaticValueDescriptor<JSEntity, Base>(exec, &JSEntityTable, this, propertyName, descriptor);
 }
 
-JSValue jsEntityPublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityPublicId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEntity* castedThis = static_cast<JSEntity*>(asObject(slot.slotBase()));
+    JSEntity* castedThis = static_cast<JSEntity*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Entity* imp = static_cast<Entity*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->publicId());
+    JSValue result = jsStringOrNull(exec, imp->publicId());
+    return result;
 }
 
-JSValue jsEntitySystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntitySystemId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEntity* castedThis = static_cast<JSEntity*>(asObject(slot.slotBase()));
+    JSEntity* castedThis = static_cast<JSEntity*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Entity* imp = static_cast<Entity*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->systemId());
+    JSValue result = jsStringOrNull(exec, imp->systemId());
+    return result;
 }
 
-JSValue jsEntityNotationName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityNotationName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEntity* castedThis = static_cast<JSEntity*>(asObject(slot.slotBase()));
+    JSEntity* castedThis = static_cast<JSEntity*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Entity* imp = static_cast<Entity*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->notationName());
+    JSValue result = jsStringOrNull(exec, imp->notationName());
+    return result;
 }
 
-JSValue jsEntityConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEntity* domObject = static_cast<JSEntity*>(asObject(slot.slotBase()));
+    JSEntity* domObject = static_cast<JSEntity*>(asObject(slotBase));
     return JSEntity::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSEntity::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntity.h b/src/3rdparty/webkit/WebCore/generated/JSEntity.h
index 6ea4fe5b0d..c85ce4d6da 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntity.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntity.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -56,7 +56,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSEntityPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -65,10 +65,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsEntityPublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEntitySystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEntityNotationName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEntityConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEntityPublicId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEntitySystemId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEntityNotationName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEntityConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
index 505374aa5b..7e449601f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
@@ -34,7 +34,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSEntityReference);
 
 static const HashTableValue JSEntityReferenceTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsEntityReferenceConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEntityReferenceConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -73,7 +73,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -135,9 +135,9 @@ bool JSEntityReference::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSEntityReference, Base>(exec, &JSEntityReferenceTable, this, propertyName, descriptor);
 }
 
-JSValue jsEntityReferenceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityReferenceConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEntityReference* domObject = static_cast<JSEntityReference*>(asObject(slot.slotBase()));
+    JSEntityReference* domObject = static_cast<JSEntityReference*>(asObject(slotBase));
     return JSEntityReference::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSEntityReference::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
index bec01e657a..ae6d142bf0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -56,7 +56,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSEntityReferencePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -65,7 +65,7 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsEntityReferenceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEntityReferenceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp
index ef9a080c7d..3d73ee849f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp
@@ -41,10 +41,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSErrorEvent);
 
 static const HashTableValue JSErrorEventTableValues[5] =
 {
-    { "message", DontDelete|ReadOnly, (intptr_t)jsErrorEventMessage, (intptr_t)0 },
-    { "filename", DontDelete|ReadOnly, (intptr_t)jsErrorEventFilename, (intptr_t)0 },
-    { "lineno", DontDelete|ReadOnly, (intptr_t)jsErrorEventLineno, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsErrorEventConstructor, (intptr_t)0 },
+    { "message", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsErrorEventMessage), (intptr_t)0 },
+    { "filename", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsErrorEventFilename), (intptr_t)0 },
+    { "lineno", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsErrorEventLineno), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsErrorEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -83,7 +83,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -106,7 +106,7 @@ bool JSErrorEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Id
 
 static const HashTableValue JSErrorEventPrototypeTableValues[2] =
 {
-    { "initErrorEvent", DontDelete|Function, (intptr_t)jsErrorEventPrototypeFunctionInitErrorEvent, (intptr_t)6 },
+    { "initErrorEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsErrorEventPrototypeFunctionInitErrorEvent), (intptr_t)6 },
     { 0, 0, 0, 0 }
 };
 
@@ -164,33 +164,36 @@ bool JSErrorEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<JSErrorEvent, Base>(exec, getJSErrorEventTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsErrorEventMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsErrorEventMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSErrorEvent* castedThis = static_cast<JSErrorEvent*>(asObject(slot.slotBase()));
+    JSErrorEvent* castedThis = static_cast<JSErrorEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ErrorEvent* imp = static_cast<ErrorEvent*>(castedThis->impl());
-    return jsString(exec, imp->message());
+    JSValue result = jsString(exec, imp->message());
+    return result;
 }
 
-JSValue jsErrorEventFilename(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsErrorEventFilename(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSErrorEvent* castedThis = static_cast<JSErrorEvent*>(asObject(slot.slotBase()));
+    JSErrorEvent* castedThis = static_cast<JSErrorEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ErrorEvent* imp = static_cast<ErrorEvent*>(castedThis->impl());
-    return jsString(exec, imp->filename());
+    JSValue result = jsString(exec, imp->filename());
+    return result;
 }
 
-JSValue jsErrorEventLineno(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsErrorEventLineno(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSErrorEvent* castedThis = static_cast<JSErrorEvent*>(asObject(slot.slotBase()));
+    JSErrorEvent* castedThis = static_cast<JSErrorEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ErrorEvent* imp = static_cast<ErrorEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->lineno());
+    JSValue result = jsNumber(exec, imp->lineno());
+    return result;
 }
 
-JSValue jsErrorEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsErrorEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSErrorEvent* domObject = static_cast<JSErrorEvent*>(asObject(slot.slotBase()));
+    JSErrorEvent* domObject = static_cast<JSErrorEvent*>(asObject(slotBase));
     return JSErrorEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSErrorEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h
index 080b573573..546957ff93 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -60,7 +60,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSErrorEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,10 +72,10 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsErrorEventPrototypeFunctionInitErrorEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsErrorEventMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsErrorEventFilename(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsErrorEventLineno(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsErrorEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsErrorEventMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsErrorEventFilename(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsErrorEventLineno(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsErrorEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
index 67eefd0076..e5618ad8df 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
@@ -38,20 +38,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSEvent);
 
 /* Hash table */
 
-static const HashTableValue JSEventTableValues[13] =
-{
-    { "type", DontDelete|ReadOnly, (intptr_t)jsEventType, (intptr_t)0 },
-    { "target", DontDelete|ReadOnly, (intptr_t)jsEventTarget, (intptr_t)0 },
-    { "currentTarget", DontDelete|ReadOnly, (intptr_t)jsEventCurrentTarget, (intptr_t)0 },
-    { "eventPhase", DontDelete|ReadOnly, (intptr_t)jsEventEventPhase, (intptr_t)0 },
-    { "bubbles", DontDelete|ReadOnly, (intptr_t)jsEventBubbles, (intptr_t)0 },
-    { "cancelable", DontDelete|ReadOnly, (intptr_t)jsEventCancelable, (intptr_t)0 },
-    { "timeStamp", DontDelete|ReadOnly, (intptr_t)jsEventTimeStamp, (intptr_t)0 },
-    { "srcElement", DontDelete|ReadOnly, (intptr_t)jsEventSrcElement, (intptr_t)0 },
-    { "returnValue", DontDelete, (intptr_t)jsEventReturnValue, (intptr_t)setJSEventReturnValue },
-    { "cancelBubble", DontDelete, (intptr_t)jsEventCancelBubble, (intptr_t)setJSEventCancelBubble },
-    { "clipboardData", DontDelete|ReadOnly, (intptr_t)jsEventClipboardData, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsEventConstructor, (intptr_t)0 },
+static const HashTableValue JSEventTableValues[14] =
+{
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventType), (intptr_t)0 },
+    { "target", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventTarget), (intptr_t)0 },
+    { "currentTarget", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCurrentTarget), (intptr_t)0 },
+    { "eventPhase", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventEventPhase), (intptr_t)0 },
+    { "bubbles", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventBubbles), (intptr_t)0 },
+    { "cancelable", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCancelable), (intptr_t)0 },
+    { "timeStamp", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventTimeStamp), (intptr_t)0 },
+    { "defaultPrevented", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventDefaultPrevented), (intptr_t)0 },
+    { "srcElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSrcElement), (intptr_t)0 },
+    { "returnValue", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventReturnValue), (intptr_t)setJSEventReturnValue },
+    { "cancelBubble", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCancelBubble), (intptr_t)setJSEventCancelBubble },
+    { "clipboardData", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventClipboardData), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -66,25 +67,25 @@ static JSC_CONST_HASHTABLE HashTable JSEventTable =
 
 static const HashTableValue JSEventConstructorTableValues[20] =
 {
-    { "CAPTURING_PHASE", DontDelete|ReadOnly, (intptr_t)jsEventCAPTURING_PHASE, (intptr_t)0 },
-    { "AT_TARGET", DontDelete|ReadOnly, (intptr_t)jsEventAT_TARGET, (intptr_t)0 },
-    { "BUBBLING_PHASE", DontDelete|ReadOnly, (intptr_t)jsEventBUBBLING_PHASE, (intptr_t)0 },
-    { "MOUSEDOWN", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEDOWN, (intptr_t)0 },
-    { "MOUSEUP", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEUP, (intptr_t)0 },
-    { "MOUSEOVER", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEOVER, (intptr_t)0 },
-    { "MOUSEOUT", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEOUT, (intptr_t)0 },
-    { "MOUSEMOVE", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEMOVE, (intptr_t)0 },
-    { "MOUSEDRAG", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEDRAG, (intptr_t)0 },
-    { "CLICK", DontDelete|ReadOnly, (intptr_t)jsEventCLICK, (intptr_t)0 },
-    { "DBLCLICK", DontDelete|ReadOnly, (intptr_t)jsEventDBLCLICK, (intptr_t)0 },
-    { "KEYDOWN", DontDelete|ReadOnly, (intptr_t)jsEventKEYDOWN, (intptr_t)0 },
-    { "KEYUP", DontDelete|ReadOnly, (intptr_t)jsEventKEYUP, (intptr_t)0 },
-    { "KEYPRESS", DontDelete|ReadOnly, (intptr_t)jsEventKEYPRESS, (intptr_t)0 },
-    { "DRAGDROP", DontDelete|ReadOnly, (intptr_t)jsEventDRAGDROP, (intptr_t)0 },
-    { "FOCUS", DontDelete|ReadOnly, (intptr_t)jsEventFOCUS, (intptr_t)0 },
-    { "BLUR", DontDelete|ReadOnly, (intptr_t)jsEventBLUR, (intptr_t)0 },
-    { "SELECT", DontDelete|ReadOnly, (intptr_t)jsEventSELECT, (intptr_t)0 },
-    { "CHANGE", DontDelete|ReadOnly, (intptr_t)jsEventCHANGE, (intptr_t)0 },
+    { "CAPTURING_PHASE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCAPTURING_PHASE), (intptr_t)0 },
+    { "AT_TARGET", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventAT_TARGET), (intptr_t)0 },
+    { "BUBBLING_PHASE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventBUBBLING_PHASE), (intptr_t)0 },
+    { "MOUSEDOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEDOWN), (intptr_t)0 },
+    { "MOUSEUP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEUP), (intptr_t)0 },
+    { "MOUSEOVER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEOVER), (intptr_t)0 },
+    { "MOUSEOUT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEOUT), (intptr_t)0 },
+    { "MOUSEMOVE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEMOVE), (intptr_t)0 },
+    { "MOUSEDRAG", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEDRAG), (intptr_t)0 },
+    { "CLICK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCLICK), (intptr_t)0 },
+    { "DBLCLICK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventDBLCLICK), (intptr_t)0 },
+    { "KEYDOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventKEYDOWN), (intptr_t)0 },
+    { "KEYUP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventKEYUP), (intptr_t)0 },
+    { "KEYPRESS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventKEYPRESS), (intptr_t)0 },
+    { "DRAGDROP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventDRAGDROP), (intptr_t)0 },
+    { "FOCUS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventFOCUS), (intptr_t)0 },
+    { "BLUR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventBLUR), (intptr_t)0 },
+    { "SELECT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSELECT), (intptr_t)0 },
+    { "CHANGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCHANGE), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -109,7 +110,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -130,30 +131,31 @@ bool JSEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identif
 
 /* Hash table for prototype */
 
-static const HashTableValue JSEventPrototypeTableValues[23] =
-{
-    { "CAPTURING_PHASE", DontDelete|ReadOnly, (intptr_t)jsEventCAPTURING_PHASE, (intptr_t)0 },
-    { "AT_TARGET", DontDelete|ReadOnly, (intptr_t)jsEventAT_TARGET, (intptr_t)0 },
-    { "BUBBLING_PHASE", DontDelete|ReadOnly, (intptr_t)jsEventBUBBLING_PHASE, (intptr_t)0 },
-    { "MOUSEDOWN", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEDOWN, (intptr_t)0 },
-    { "MOUSEUP", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEUP, (intptr_t)0 },
-    { "MOUSEOVER", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEOVER, (intptr_t)0 },
-    { "MOUSEOUT", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEOUT, (intptr_t)0 },
-    { "MOUSEMOVE", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEMOVE, (intptr_t)0 },
-    { "MOUSEDRAG", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEDRAG, (intptr_t)0 },
-    { "CLICK", DontDelete|ReadOnly, (intptr_t)jsEventCLICK, (intptr_t)0 },
-    { "DBLCLICK", DontDelete|ReadOnly, (intptr_t)jsEventDBLCLICK, (intptr_t)0 },
-    { "KEYDOWN", DontDelete|ReadOnly, (intptr_t)jsEventKEYDOWN, (intptr_t)0 },
-    { "KEYUP", DontDelete|ReadOnly, (intptr_t)jsEventKEYUP, (intptr_t)0 },
-    { "KEYPRESS", DontDelete|ReadOnly, (intptr_t)jsEventKEYPRESS, (intptr_t)0 },
-    { "DRAGDROP", DontDelete|ReadOnly, (intptr_t)jsEventDRAGDROP, (intptr_t)0 },
-    { "FOCUS", DontDelete|ReadOnly, (intptr_t)jsEventFOCUS, (intptr_t)0 },
-    { "BLUR", DontDelete|ReadOnly, (intptr_t)jsEventBLUR, (intptr_t)0 },
-    { "SELECT", DontDelete|ReadOnly, (intptr_t)jsEventSELECT, (intptr_t)0 },
-    { "CHANGE", DontDelete|ReadOnly, (intptr_t)jsEventCHANGE, (intptr_t)0 },
-    { "stopPropagation", DontDelete|Function, (intptr_t)jsEventPrototypeFunctionStopPropagation, (intptr_t)0 },
-    { "preventDefault", DontDelete|Function, (intptr_t)jsEventPrototypeFunctionPreventDefault, (intptr_t)0 },
-    { "initEvent", DontDelete|Function, (intptr_t)jsEventPrototypeFunctionInitEvent, (intptr_t)3 },
+static const HashTableValue JSEventPrototypeTableValues[24] =
+{
+    { "CAPTURING_PHASE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCAPTURING_PHASE), (intptr_t)0 },
+    { "AT_TARGET", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventAT_TARGET), (intptr_t)0 },
+    { "BUBBLING_PHASE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventBUBBLING_PHASE), (intptr_t)0 },
+    { "MOUSEDOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEDOWN), (intptr_t)0 },
+    { "MOUSEUP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEUP), (intptr_t)0 },
+    { "MOUSEOVER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEOVER), (intptr_t)0 },
+    { "MOUSEOUT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEOUT), (intptr_t)0 },
+    { "MOUSEMOVE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEMOVE), (intptr_t)0 },
+    { "MOUSEDRAG", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEDRAG), (intptr_t)0 },
+    { "CLICK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCLICK), (intptr_t)0 },
+    { "DBLCLICK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventDBLCLICK), (intptr_t)0 },
+    { "KEYDOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventKEYDOWN), (intptr_t)0 },
+    { "KEYUP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventKEYUP), (intptr_t)0 },
+    { "KEYPRESS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventKEYPRESS), (intptr_t)0 },
+    { "DRAGDROP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventDRAGDROP), (intptr_t)0 },
+    { "FOCUS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventFOCUS), (intptr_t)0 },
+    { "BLUR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventBLUR), (intptr_t)0 },
+    { "SELECT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSELECT), (intptr_t)0 },
+    { "CHANGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCHANGE), (intptr_t)0 },
+    { "stopPropagation", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventPrototypeFunctionStopPropagation), (intptr_t)0 },
+    { "preventDefault", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventPrototypeFunctionPreventDefault), (intptr_t)0 },
+    { "initEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventPrototypeFunctionInitEvent), (intptr_t)3 },
+    { "stopImmediatePropagation", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventPrototypeFunctionStopImmediatePropagation), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -161,7 +163,7 @@ static JSC_CONST_HASHTABLE HashTable JSEventPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 8191, JSEventPrototypeTableValues, 0 };
 #else
-    { 68, 63, JSEventPrototypeTableValues, 0 };
+    { 69, 63, JSEventPrototypeTableValues, 0 };
 #endif
 
 static const HashTable* getJSEventPrototypeTable(ExecState* exec)
@@ -217,95 +219,114 @@ bool JSEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& proper
     return getStaticValueDescriptor<JSEvent, Base>(exec, getJSEventTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsEventType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsEventTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventTarget(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->target()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->target()));
+    return result;
 }
 
-JSValue jsEventCurrentTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventCurrentTarget(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->currentTarget()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->currentTarget()));
+    return result;
 }
 
-JSValue jsEventEventPhase(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventEventPhase(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return jsNumber(exec, imp->eventPhase());
+    JSValue result = jsNumber(exec, imp->eventPhase());
+    return result;
 }
 
-JSValue jsEventBubbles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventBubbles(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return jsBoolean(imp->bubbles());
+    JSValue result = jsBoolean(imp->bubbles());
+    return result;
 }
 
-JSValue jsEventCancelable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventCancelable(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return jsBoolean(imp->cancelable());
+    JSValue result = jsBoolean(imp->cancelable());
+    return result;
 }
 
-JSValue jsEventTimeStamp(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventTimeStamp(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return jsNumber(exec, imp->timeStamp());
+    JSValue result = jsNumber(exec, imp->timeStamp());
+    return result;
 }
 
-JSValue jsEventSrcElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventDefaultPrevented(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->srcElement()));
+    JSValue result = jsBoolean(imp->defaultPrevented());
+    return result;
 }
 
-JSValue jsEventReturnValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventSrcElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return jsBoolean(imp->returnValue());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->srcElement()));
+    return result;
 }
 
-JSValue jsEventCancelBubble(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventReturnValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return jsBoolean(imp->cancelBubble());
+    JSValue result = jsBoolean(imp->returnValue());
+    return result;
 }
 
-JSValue jsEventClipboardData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventCancelBubble(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Event* imp = static_cast<Event*>(castedThis->impl());
+    JSValue result = jsBoolean(imp->cancelBubble());
+    return result;
+}
+
+JSValue jsEventClipboardData(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     return castedThis->clipboardData(exec);
 }
 
-JSValue jsEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* domObject = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* domObject = static_cast<JSEvent*>(asObject(slotBase));
     return JSEvent::getConstructor(exec, domObject->globalObject());
 }
 void JSEvent::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -315,13 +336,15 @@ void JSEvent::put(ExecState* exec, const Identifier& propertyName, JSValue value
 
 void setJSEventReturnValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Event* imp = static_cast<Event*>(static_cast<JSEvent*>(thisObject)->impl());
+    JSEvent* castedThisObj = static_cast<JSEvent*>(thisObject);
+    Event* imp = static_cast<Event*>(castedThisObj->impl());
     imp->setReturnValue(value.toBoolean(exec));
 }
 
 void setJSEventCancelBubble(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Event* imp = static_cast<Event*>(static_cast<JSEvent*>(thisObject)->impl());
+    JSEvent* castedThisObj = static_cast<JSEvent*>(thisObject);
+    Event* imp = static_cast<Event*>(castedThisObj->impl());
     imp->setCancelBubble(value.toBoolean(exec));
 }
 
@@ -369,99 +392,111 @@ JSValue JSC_HOST_CALL jsEventPrototypeFunctionInitEvent(ExecState* exec, JSObjec
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsEventPrototypeFunctionStopImmediatePropagation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSEvent::s_info))
+        return throwError(exec, TypeError);
+    JSEvent* castedThisObj = static_cast<JSEvent*>(asObject(thisValue));
+    Event* imp = static_cast<Event*>(castedThisObj->impl());
+
+    imp->stopImmediatePropagation();
+    return jsUndefined();
+}
+
 // Constant getters
 
-JSValue jsEventCAPTURING_PHASE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventCAPTURING_PHASE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsEventAT_TARGET(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventAT_TARGET(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsEventBUBBLING_PHASE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventBUBBLING_PHASE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsEventMOUSEDOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEDOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsEventMOUSEUP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEUP(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsEventMOUSEOVER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEOVER(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsEventMOUSEOUT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEOUT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValue jsEventMOUSEMOVE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEMOVE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValue jsEventMOUSEDRAG(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEDRAG(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(32));
 }
 
-JSValue jsEventCLICK(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventCLICK(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(64));
 }
 
-JSValue jsEventDBLCLICK(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventDBLCLICK(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(128));
 }
 
-JSValue jsEventKEYDOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventKEYDOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(256));
 }
 
-JSValue jsEventKEYUP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventKEYUP(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(512));
 }
 
-JSValue jsEventKEYPRESS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventKEYPRESS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1024));
 }
 
-JSValue jsEventDRAGDROP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventDRAGDROP(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2048));
 }
 
-JSValue jsEventFOCUS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventFOCUS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4096));
 }
 
-JSValue jsEventBLUR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventBLUR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8192));
 }
 
-JSValue jsEventSELECT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventSELECT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(16384));
 }
 
-JSValue jsEventCHANGE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventCHANGE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(32768));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.h b/src/3rdparty/webkit/WebCore/generated/JSEvent.h
index 0249fe1eee..bb5e141521 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.h
@@ -21,7 +21,6 @@
 #ifndef JSEvent_h
 #define JSEvent_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -72,7 +71,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -84,43 +83,45 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsEventPrototypeFunctionStopPropagation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsEventPrototypeFunctionPreventDefault(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsEventPrototypeFunctionInitEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsEventPrototypeFunctionStopImmediatePropagation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsEventType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventCurrentTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventEventPhase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventBubbles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventCancelable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventTimeStamp(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventSrcElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventReturnValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventTarget(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventCurrentTarget(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventEventPhase(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventBubbles(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventCancelable(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventTimeStamp(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventDefaultPrevented(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventSrcElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventReturnValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSEventReturnValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsEventCancelBubble(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventCancelBubble(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSEventCancelBubble(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsEventClipboardData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventClipboardData(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsEventCAPTURING_PHASE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventAT_TARGET(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventBUBBLING_PHASE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventMOUSEDOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventMOUSEUP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventMOUSEOVER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventMOUSEOUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventMOUSEMOVE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventMOUSEDRAG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventCLICK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventDBLCLICK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventKEYDOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventKEYUP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventKEYPRESS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventDRAGDROP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventFOCUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventBLUR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventSELECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventCHANGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventCAPTURING_PHASE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventAT_TARGET(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventBUBBLING_PHASE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventMOUSEDOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventMOUSEUP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventMOUSEOVER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventMOUSEOUT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventMOUSEMOVE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventMOUSEDRAG(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventCLICK(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventDBLCLICK(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventKEYDOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventKEYUP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventKEYPRESS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventDRAGDROP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventFOCUS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventBLUR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventSELECT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventCHANGE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
index bd25734f55..0851732e91 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
@@ -38,10 +38,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSEventException);
 
 static const HashTableValue JSEventExceptionTableValues[5] =
 {
-    { "code", DontDelete|ReadOnly, (intptr_t)jsEventExceptionCode, (intptr_t)0 },
-    { "name", DontDelete|ReadOnly, (intptr_t)jsEventExceptionName, (intptr_t)0 },
-    { "message", DontDelete|ReadOnly, (intptr_t)jsEventExceptionMessage, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsEventExceptionConstructor, (intptr_t)0 },
+    { "code", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventExceptionCode), (intptr_t)0 },
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventExceptionName), (intptr_t)0 },
+    { "message", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventExceptionMessage), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventExceptionConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -56,7 +56,7 @@ static JSC_CONST_HASHTABLE HashTable JSEventExceptionTable =
 
 static const HashTableValue JSEventExceptionConstructorTableValues[2] =
 {
-    { "UNSPECIFIED_EVENT_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR, (intptr_t)0 },
+    { "UNSPECIFIED_EVENT_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -104,8 +104,8 @@ bool JSEventExceptionConstructor::getOwnPropertyDescriptor(ExecState* exec, cons
 
 static const HashTableValue JSEventExceptionPrototypeTableValues[3] =
 {
-    { "UNSPECIFIED_EVENT_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR, (intptr_t)0 },
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsEventExceptionPrototypeFunctionToString, (intptr_t)0 },
+    { "UNSPECIFIED_EVENT_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR), (intptr_t)0 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsEventExceptionPrototypeFunctionToString), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -169,33 +169,36 @@ bool JSEventException::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSEventException, Base>(exec, getJSEventExceptionTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsEventExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionCode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventException* castedThis = static_cast<JSEventException*>(asObject(slot.slotBase()));
+    JSEventException* castedThis = static_cast<JSEventException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventException* imp = static_cast<EventException*>(castedThis->impl());
-    return jsNumber(exec, imp->code());
+    JSValue result = jsNumber(exec, imp->code());
+    return result;
 }
 
-JSValue jsEventExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventException* castedThis = static_cast<JSEventException*>(asObject(slot.slotBase()));
+    JSEventException* castedThis = static_cast<JSEventException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventException* imp = static_cast<EventException*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsEventExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventException* castedThis = static_cast<JSEventException*>(asObject(slot.slotBase()));
+    JSEventException* castedThis = static_cast<JSEventException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventException* imp = static_cast<EventException*>(castedThis->impl());
-    return jsString(exec, imp->message());
+    JSValue result = jsString(exec, imp->message());
+    return result;
 }
 
-JSValue jsEventExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventException* domObject = static_cast<JSEventException*>(asObject(slot.slotBase()));
+    JSEventException* domObject = static_cast<JSEventException*>(asObject(slotBase));
     return JSEventException::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSEventException::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -218,7 +221,7 @@ JSValue JSC_HOST_CALL jsEventExceptionPrototypeFunctionToString(ExecState* exec,
 
 // Constant getters
 
-JSValue jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.h b/src/3rdparty/webkit/WebCore/generated/JSEventException.h
index 694cbad65a..e8595844ed 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.h
@@ -21,7 +21,6 @@
 #ifndef JSEventException_h
 #define JSEventException_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -68,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSEventExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,13 +79,13 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsEventExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsEventExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventExceptionCode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventExceptionName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventExceptionMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp
index 526d8af573..ebf5a56453 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp
@@ -27,8 +27,6 @@
 #include "Event.h"
 #include "EventListener.h"
 #include "EventSource.h"
-#include "Frame.h"
-#include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "KURL.h"
@@ -48,11 +46,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSEventSource);
 
 static const HashTableValue JSEventSourceTableValues[6] =
 {
-    { "URL", DontDelete|ReadOnly, (intptr_t)jsEventSourceURL, (intptr_t)0 },
-    { "readyState", DontDelete|ReadOnly, (intptr_t)jsEventSourceReadyState, (intptr_t)0 },
-    { "onopen", DontDelete, (intptr_t)jsEventSourceOnopen, (intptr_t)setJSEventSourceOnopen },
-    { "onmessage", DontDelete, (intptr_t)jsEventSourceOnmessage, (intptr_t)setJSEventSourceOnmessage },
-    { "onerror", DontDelete, (intptr_t)jsEventSourceOnerror, (intptr_t)setJSEventSourceOnerror },
+    { "URL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceURL), (intptr_t)0 },
+    { "readyState", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceReadyState), (intptr_t)0 },
+    { "onopen", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceOnopen), (intptr_t)setJSEventSourceOnopen },
+    { "onmessage", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceOnmessage), (intptr_t)setJSEventSourceOnmessage },
+    { "onerror", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceOnerror), (intptr_t)setJSEventSourceOnerror },
     { 0, 0, 0, 0 }
 };
 
@@ -67,13 +65,13 @@ static JSC_CONST_HASHTABLE HashTable JSEventSourceTable =
 
 static const HashTableValue JSEventSourcePrototypeTableValues[8] =
 {
-    { "CONNECTING", DontDelete|ReadOnly, (intptr_t)jsEventSourceCONNECTING, (intptr_t)0 },
-    { "OPEN", DontDelete|ReadOnly, (intptr_t)jsEventSourceOPEN, (intptr_t)0 },
-    { "CLOSED", DontDelete|ReadOnly, (intptr_t)jsEventSourceCLOSED, (intptr_t)0 },
-    { "close", DontDelete|Function, (intptr_t)jsEventSourcePrototypeFunctionClose, (intptr_t)0 },
-    { "addEventListener", DontDelete|Function, (intptr_t)jsEventSourcePrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsEventSourcePrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsEventSourcePrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { "CONNECTING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceCONNECTING), (intptr_t)0 },
+    { "OPEN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceOPEN), (intptr_t)0 },
+    { "CLOSED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceCLOSED), (intptr_t)0 },
+    { "close", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventSourcePrototypeFunctionClose), (intptr_t)0 },
+    { "addEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventSourcePrototypeFunctionAddEventListener), (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventSourcePrototypeFunctionRemoveEventListener), (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventSourcePrototypeFunctionDispatchEvent), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -119,14 +117,14 @@ JSEventSource::JSEventSource(NonNullPassRefPtr<Structure> structure, JSDOMGlobal
 
 JSEventSource::~JSEventSource()
 {
-    impl()->invalidateEventListeners();
+    impl()->invalidateJSEventListeners(this);
     forgetDOMObject(this, impl());
 }
 
 void JSEventSource::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
-    impl()->markEventListeners(markStack);
+    impl()->markJSEventListeners(markStack);
 }
 
 JSObject* JSEventSource::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -144,54 +142,62 @@ bool JSEventSource::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSEventSource, Base>(exec, getJSEventSourceTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsEventSourceURL(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventSourceURL(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slot.slotBase()));
+    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(castedThis->impl());
-    return jsString(exec, imp->url());
+    JSValue result = jsString(exec, imp->url());
+    return result;
 }
 
-JSValue jsEventSourceReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventSourceReadyState(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slot.slotBase()));
+    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(castedThis->impl());
-    return jsNumber(exec, imp->readyState());
+    JSValue result = jsNumber(exec, imp->readyState());
+    return result;
 }
 
-JSValue jsEventSourceOnopen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventSourceOnopen(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slot.slotBase()));
+    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(castedThis->impl());
     if (EventListener* listener = imp->onopen()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsEventSourceOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventSourceOnmessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slot.slotBase()));
+    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(castedThis->impl());
     if (EventListener* listener = imp->onmessage()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsEventSourceOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventSourceOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slot.slotBase()));
+    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
@@ -205,30 +211,21 @@ void setJSEventSourceOnopen(ExecState* exec, JSObject* thisObject, JSValue value
 {
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(static_cast<JSEventSource*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnopen(globalObject->createJSAttributeEventListener(value));
+    imp->setOnopen(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSEventSourceOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(static_cast<JSEventSource*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmessage(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSEventSourceOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(static_cast<JSEventSource*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionClose(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -279,17 +276,17 @@ JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionDispatchEvent(ExecState* exe
 
 // Constant getters
 
-JSValue jsEventSourceCONNECTING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventSourceCONNECTING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsEventSourceOPEN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventSourceOPEN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsEventSourceCLOSED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventSourceCLOSED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventSource.h b/src/3rdparty/webkit/WebCore/generated/JSEventSource.h
index 4d5803b421..9ad5cf847f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventSource.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventSource.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(EVENTSOURCE)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -46,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -76,7 +75,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSEventSourcePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -91,19 +90,19 @@ JSC::JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionRemoveEventListener(JSC
 JSC::JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsEventSourceURL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventSourceReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventSourceOnopen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSourceURL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventSourceReadyState(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventSourceOnopen(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSEventSourceOnopen(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsEventSourceOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSourceOnmessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSEventSourceOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsEventSourceOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSourceOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSEventSourceOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 // Constants
 
-JSC::JSValue jsEventSourceCONNECTING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventSourceOPEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventSourceCLOSED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSourceCONNECTING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventSourceOPEN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventSourceCLOSED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
index 59192af6d2..d85bcdc301 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
@@ -35,19 +35,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSFile);
 
 /* Hash table */
 
-static const HashTableValue JSFileTableValues[4] =
+static const HashTableValue JSFileTableValues[6] =
 {
-    { "fileName", DontDelete|ReadOnly, (intptr_t)jsFileFileName, (intptr_t)0 },
-    { "fileSize", DontDelete|ReadOnly, (intptr_t)jsFileFileSize, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsFileConstructor, (intptr_t)0 },
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsFileName), (intptr_t)0 },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsFileType), (intptr_t)0 },
+    { "fileName", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsFileFileName), (intptr_t)0 },
+    { "fileSize", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsFileFileSize), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsFileConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSFileTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 7, JSFileTableValues, 0 };
+    { 127, JSFileTableValues, 0 };
 #else
-    { 8, 7, JSFileTableValues, 0 };
+    { 17, 15, JSFileTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -78,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -118,22 +120,16 @@ JSObject* JSFilePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
     return getDOMPrototype<JSFile>(exec, globalObject);
 }
 
-const ClassInfo JSFile::s_info = { "File", 0, &JSFileTable, 0 };
+const ClassInfo JSFile::s_info = { "File", &JSBlob::s_info, &JSFileTable, 0 };
 
 JSFile::JSFile(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<File> impl)
-    : DOMObjectWithGlobalPointer(structure, globalObject)
-    , m_impl(impl)
+    : JSBlob(structure, globalObject, impl)
 {
 }
 
-JSFile::~JSFile()
-{
-    forgetDOMObject(this, impl());
-}
-
 JSObject* JSFile::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSFilePrototype(JSFilePrototype::createStructure(globalObject->objectPrototype()));
+    return new (exec) JSFilePrototype(JSFilePrototype::createStructure(JSBlobPrototype::self(exec, globalObject)));
 }
 
 bool JSFile::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -146,25 +142,45 @@ bool JSFile::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propert
     return getStaticValueDescriptor<JSFile, Base>(exec, &JSFileTable, this, propertyName, descriptor);
 }
 
-JSValue jsFileFileName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileName(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSFile* castedThis = static_cast<JSFile*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    File* imp = static_cast<File*>(castedThis->impl());
+    JSValue result = jsString(exec, imp->name());
+    return result;
+}
+
+JSValue jsFileType(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSFile* castedThis = static_cast<JSFile*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    File* imp = static_cast<File*>(castedThis->impl());
+    JSValue result = jsString(exec, imp->type());
+    return result;
+}
+
+JSValue jsFileFileName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFile* castedThis = static_cast<JSFile*>(asObject(slot.slotBase()));
+    JSFile* castedThis = static_cast<JSFile*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     File* imp = static_cast<File*>(castedThis->impl());
-    return jsString(exec, imp->fileName());
+    JSValue result = jsString(exec, imp->fileName());
+    return result;
 }
 
-JSValue jsFileFileSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileFileSize(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFile* castedThis = static_cast<JSFile*>(asObject(slot.slotBase()));
+    JSFile* castedThis = static_cast<JSFile*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     File* imp = static_cast<File*>(castedThis->impl());
-    return jsNumber(exec, imp->fileSize());
+    JSValue result = jsNumber(exec, imp->fileSize());
+    return result;
 }
 
-JSValue jsFileConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFile* domObject = static_cast<JSFile*>(asObject(slot.slotBase()));
+    JSFile* domObject = static_cast<JSFile*>(asObject(slotBase));
     return JSFile::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSFile::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.h b/src/3rdparty/webkit/WebCore/generated/JSFile.h
index 3a5ed41ae5..98365684f9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFile.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSFile.h
@@ -21,20 +21,17 @@
 #ifndef JSFile_h
 #define JSFile_h
 
-#include "DOMObjectWithSVGContext.h"
-#include "JSDOMBinding.h"
-#include <runtime/JSGlobalObject.h>
-#include <runtime/ObjectPrototype.h>
+#include "File.h"
+#include "JSBlob.h"
 
 namespace WebCore {
 
 class File;
 
-class JSFile : public DOMObjectWithGlobalPointer {
-    typedef DOMObjectWithGlobalPointer Base;
+class JSFile : public JSBlob {
+    typedef JSBlob Base;
 public:
     JSFile(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<File>);
-    virtual ~JSFile();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,14 +40,14 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
-    File* impl() const { return m_impl.get(); }
-
-private:
-    RefPtr<File> m_impl;
+    File* impl() const
+    {
+        return static_cast<File*>(Base::impl());
+    }
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -66,7 +63,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSFilePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,9 +72,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsFileFileName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsFileFileSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsFileConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsFileName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsFileType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsFileFileName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsFileFileSize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsFileConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
index 50e1f0aba3..2140f2cc4e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
@@ -40,8 +40,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSFileList);
 
 static const HashTableValue JSFileListTableValues[3] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsFileListLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsFileListConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsFileListLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsFileListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -103,7 +103,7 @@ bool JSFileListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Iden
 
 static const HashTableValue JSFileListPrototypeTableValues[2] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsFileListPrototypeFunctionItem, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsFileListPrototypeFunctionItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -194,24 +194,25 @@ bool JSFileList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Prop
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsFileListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileListLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFileList* castedThis = static_cast<JSFileList*>(asObject(slot.slotBase()));
+    JSFileList* castedThis = static_cast<JSFileList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     FileList* imp = static_cast<FileList*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsFileListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFileList* domObject = static_cast<JSFileList*>(asObject(slot.slotBase()));
+    JSFileList* domObject = static_cast<JSFileList*>(asObject(slotBase));
     return JSFileList::getConstructor(exec, domObject->globalObject());
 }
-void JSFileList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSFileList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<FileList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSFileList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -238,10 +239,10 @@ JSValue JSC_HOST_CALL jsFileListPrototypeFunctionItem(ExecState* exec, JSObject*
 }
 
 
-JSValue JSFileList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFileList::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSFileList* thisObj = static_cast<JSFileList*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<FileList*>(thisObj->impl())->item(slot.index()));
+    JSFileList* thisObj = static_cast<JSFileList*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<FileList*>(thisObj->impl())->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, FileList* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFileList.h b/src/3rdparty/webkit/WebCore/generated/JSFileList.h
index 495f47a2b2..07c60bf841 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFileList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSFileList.h
@@ -21,7 +21,6 @@
 #ifndef JSFileList_h
 #define JSFileList_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,10 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     FileList* impl() const { return m_impl.get(); }
 
@@ -55,7 +54,7 @@ private:
     RefPtr<FileList> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, FileList*);
@@ -71,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSFileListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -83,8 +82,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsFileListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsFileListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsFileListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsFileListLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsFileListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
index be50fac15d..78022dc698 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
@@ -19,11 +19,12 @@
 */
 
 #include "config.h"
+
+#if ENABLE(GEOLOCATION)
+
 #include "JSGeolocation.h"
 
 #include "Geolocation.h"
-#include "Geoposition.h"
-#include "JSGeoposition.h"
 #include <runtime/Error.h>
 #include <wtf/GetPtr.h>
 
@@ -33,28 +34,13 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSGeolocation);
 
-/* Hash table */
-
-static const HashTableValue JSGeolocationTableValues[2] =
-{
-    { "lastPosition", DontDelete|ReadOnly, (intptr_t)jsGeolocationLastPosition, (intptr_t)0 },
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSGeolocationTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSGeolocationTableValues, 0 };
-#else
-    { 2, 1, JSGeolocationTableValues, 0 };
-#endif
-
 /* Hash table for prototype */
 
 static const HashTableValue JSGeolocationPrototypeTableValues[4] =
 {
-    { "getCurrentPosition", DontDelete|Function, (intptr_t)jsGeolocationPrototypeFunctionGetCurrentPosition, (intptr_t)3 },
-    { "watchPosition", DontDelete|Function, (intptr_t)jsGeolocationPrototypeFunctionWatchPosition, (intptr_t)3 },
-    { "clearWatch", DontDelete|Function, (intptr_t)jsGeolocationPrototypeFunctionClearWatch, (intptr_t)1 },
+    { "getCurrentPosition", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsGeolocationPrototypeFunctionGetCurrentPosition), (intptr_t)3 },
+    { "watchPosition", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsGeolocationPrototypeFunctionWatchPosition), (intptr_t)3 },
+    { "clearWatch", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsGeolocationPrototypeFunctionClearWatch), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -82,7 +68,7 @@ bool JSGeolocationPrototype::getOwnPropertyDescriptor(ExecState* exec, const Ide
     return getStaticFunctionDescriptor<JSObject>(exec, &JSGeolocationPrototypeTable, this, propertyName, descriptor);
 }
 
-const ClassInfo JSGeolocation::s_info = { "Geolocation", 0, &JSGeolocationTable, 0 };
+const ClassInfo JSGeolocation::s_info = { "Geolocation", 0, 0, 0 };
 
 JSGeolocation::JSGeolocation(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Geolocation> impl)
     : DOMObjectWithGlobalPointer(structure, globalObject)
@@ -100,24 +86,6 @@ JSObject* JSGeolocation::createPrototype(ExecState* exec, JSGlobalObject* global
     return new (exec) JSGeolocationPrototype(JSGeolocationPrototype::createStructure(globalObject->objectPrototype()));
 }
 
-bool JSGeolocation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticValueSlot<JSGeolocation, Base>(exec, &JSGeolocationTable, this, propertyName, slot);
-}
-
-bool JSGeolocation::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    return getStaticValueDescriptor<JSGeolocation, Base>(exec, &JSGeolocationTable, this, propertyName, descriptor);
-}
-
-JSValue jsGeolocationLastPosition(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSGeolocation* castedThis = static_cast<JSGeolocation*>(asObject(slot.slotBase()));
-    UNUSED_PARAM(exec);
-    Geolocation* imp = static_cast<Geolocation*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->lastPosition()));
-}
-
 JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionGetCurrentPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -159,3 +127,5 @@ Geolocation* toGeolocation(JSC::JSValue value)
 }
 
 }
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
index e948667880..fdc024467a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
@@ -21,7 +21,8 @@
 #ifndef JSGeolocation_h
 #define JSGeolocation_h
 
-#include "DOMObjectWithSVGContext.h"
+#if ENABLE(GEOLOCATION)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -36,14 +37,12 @@ public:
     JSGeolocation(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<Geolocation>);
     virtual ~JSGeolocation();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 
@@ -55,7 +54,7 @@ public:
 private:
     RefPtr<Geolocation> m_impl;
 protected:
-    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Geolocation*);
@@ -71,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSGeolocationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -83,10 +82,9 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionGetCurrentPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionWatchPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionClearWatch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-// Attributes
-
-JSC::JSValue jsGeolocationLastPosition(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
+#endif // ENABLE(GEOLOCATION)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
index ab42d2b185..806fab626a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
@@ -19,6 +19,9 @@
 */
 
 #include "config.h"
+
+#if ENABLE(GEOLOCATION)
+
 #include "JSGeoposition.h"
 
 #include "Coordinates.h"
@@ -37,8 +40,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSGeoposition);
 
 static const HashTableValue JSGeopositionTableValues[3] =
 {
-    { "coords", DontDelete|ReadOnly, (intptr_t)jsGeopositionCoords, (intptr_t)0 },
-    { "timestamp", DontDelete|ReadOnly, (intptr_t)jsGeopositionTimestamp, (intptr_t)0 },
+    { "coords", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsGeopositionCoords), (intptr_t)0 },
+    { "timestamp", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsGeopositionTimestamp), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -98,20 +101,22 @@ bool JSGeoposition::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSGeoposition, Base>(exec, &JSGeopositionTable, this, propertyName, descriptor);
 }
 
-JSValue jsGeopositionCoords(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsGeopositionCoords(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSGeoposition* castedThis = static_cast<JSGeoposition*>(asObject(slot.slotBase()));
+    JSGeoposition* castedThis = static_cast<JSGeoposition*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Geoposition* imp = static_cast<Geoposition*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->coords()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->coords()));
+    return result;
 }
 
-JSValue jsGeopositionTimestamp(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsGeopositionTimestamp(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSGeoposition* castedThis = static_cast<JSGeoposition*>(asObject(slot.slotBase()));
+    JSGeoposition* castedThis = static_cast<JSGeoposition*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Geoposition* imp = static_cast<Geoposition*>(castedThis->impl());
-    return jsNumber(exec, imp->timestamp());
+    JSValue result = jsNumber(exec, imp->timestamp());
+    return result;
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Geoposition* object)
@@ -124,3 +129,5 @@ Geoposition* toGeoposition(JSC::JSValue value)
 }
 
 }
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
index a58a41e676..31a1f139d1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
@@ -21,7 +21,8 @@
 #ifndef JSGeoposition_h
 #define JSGeoposition_h
 
-#include "DOMObjectWithSVGContext.h"
+#if ENABLE(GEOLOCATION)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     Geoposition* impl() const { return m_impl.get(); }
@@ -65,7 +66,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSGeopositionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -74,9 +75,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsGeopositionCoords(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsGeopositionTimestamp(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsGeopositionCoords(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsGeopositionTimestamp(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
+#endif // ENABLE(GEOLOCATION)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAllCollection.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAllCollection.cpp
index 4a8fc83920..1a61ed2aae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAllCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAllCollection.cpp
@@ -43,8 +43,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLAllCollection);
 
 static const HashTableValue JSHTMLAllCollectionTableValues[3] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsHTMLAllCollectionLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLAllCollectionConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAllCollectionLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAllCollectionConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -83,7 +83,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -106,9 +106,9 @@ bool JSHTMLAllCollectionConstructor::getOwnPropertyDescriptor(ExecState* exec, c
 
 static const HashTableValue JSHTMLAllCollectionPrototypeTableValues[4] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsHTMLAllCollectionPrototypeFunctionItem, (intptr_t)1 },
-    { "namedItem", DontDelete|Function, (intptr_t)jsHTMLAllCollectionPrototypeFunctionNamedItem, (intptr_t)1 },
-    { "tags", DontDelete|Function, (intptr_t)jsHTMLAllCollectionPrototypeFunctionTags, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLAllCollectionPrototypeFunctionItem), (intptr_t)1 },
+    { "namedItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLAllCollectionPrototypeFunctionNamedItem), (intptr_t)1 },
+    { "tags", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLAllCollectionPrototypeFunctionTags), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -217,24 +217,25 @@ bool JSHTMLAllCollection::getOwnPropertySlot(ExecState* exec, unsigned propertyN
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsHTMLAllCollectionLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAllCollectionLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAllCollection* castedThis = static_cast<JSHTMLAllCollection*>(asObject(slot.slotBase()));
+    JSHTMLAllCollection* castedThis = static_cast<JSHTMLAllCollection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAllCollection* imp = static_cast<HTMLAllCollection*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsHTMLAllCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAllCollectionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAllCollection* domObject = static_cast<JSHTMLAllCollection*>(asObject(slot.slotBase()));
+    JSHTMLAllCollection* domObject = static_cast<JSHTMLAllCollection*>(asObject(slotBase));
     return JSHTMLAllCollection::getConstructor(exec, domObject->globalObject());
 }
-void JSHTMLAllCollection::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSHTMLAllCollection::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<HTMLAllCollection*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSHTMLAllCollection::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -275,10 +276,10 @@ JSValue JSC_HOST_CALL jsHTMLAllCollectionPrototypeFunctionTags(ExecState* exec,
 }
 
 
-JSValue JSHTMLAllCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSHTMLAllCollection::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSHTMLAllCollection* thisObj = static_cast<JSHTMLAllCollection*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<HTMLAllCollection*>(thisObj->impl())->item(slot.index()));
+    JSHTMLAllCollection* thisObj = static_cast<JSHTMLAllCollection*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<HTMLAllCollection*>(thisObj->impl())->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, HTMLAllCollection* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAllCollection.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAllCollection.h
index 000986e68a..dc235e823d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAllCollection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAllCollection.h
@@ -21,7 +21,6 @@
 #ifndef JSHTMLAllCollection_h
 #define JSHTMLAllCollection_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/CallData.h>
 #include <runtime/JSGlobalObject.h>
@@ -45,12 +44,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     virtual bool toBoolean(JSC::ExecState*) const { return false; };
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
@@ -63,10 +62,10 @@ private:
     RefPtr<HTMLAllCollection> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | JSC::MasqueradesAsUndefined | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLAllCollection*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, HTMLAllCollection*);
@@ -82,7 +81,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLAllCollectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -96,8 +95,8 @@ JSC::JSValue JSC_HOST_CALL jsHTMLAllCollectionPrototypeFunctionNamedItem(JSC::Ex
 JSC::JSValue JSC_HOST_CALL jsHTMLAllCollectionPrototypeFunctionTags(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLAllCollectionLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAllCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAllCollectionLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLAllCollectionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
index 3ba82017e0..0ed6afb1a4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
@@ -38,26 +38,26 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLAnchorElement);
 
 static const HashTableValue JSHTMLAnchorElementTableValues[21] =
 {
-    { "accessKey", DontDelete, (intptr_t)jsHTMLAnchorElementAccessKey, (intptr_t)setJSHTMLAnchorElementAccessKey },
-    { "charset", DontDelete, (intptr_t)jsHTMLAnchorElementCharset, (intptr_t)setJSHTMLAnchorElementCharset },
-    { "coords", DontDelete, (intptr_t)jsHTMLAnchorElementCoords, (intptr_t)setJSHTMLAnchorElementCoords },
-    { "href", DontDelete, (intptr_t)jsHTMLAnchorElementHref, (intptr_t)setJSHTMLAnchorElementHref },
-    { "hreflang", DontDelete, (intptr_t)jsHTMLAnchorElementHreflang, (intptr_t)setJSHTMLAnchorElementHreflang },
-    { "name", DontDelete, (intptr_t)jsHTMLAnchorElementName, (intptr_t)setJSHTMLAnchorElementName },
-    { "rel", DontDelete, (intptr_t)jsHTMLAnchorElementRel, (intptr_t)setJSHTMLAnchorElementRel },
-    { "rev", DontDelete, (intptr_t)jsHTMLAnchorElementRev, (intptr_t)setJSHTMLAnchorElementRev },
-    { "shape", DontDelete, (intptr_t)jsHTMLAnchorElementShape, (intptr_t)setJSHTMLAnchorElementShape },
-    { "target", DontDelete, (intptr_t)jsHTMLAnchorElementTarget, (intptr_t)setJSHTMLAnchorElementTarget },
-    { "type", DontDelete, (intptr_t)jsHTMLAnchorElementType, (intptr_t)setJSHTMLAnchorElementType },
-    { "hash", DontDelete|ReadOnly, (intptr_t)jsHTMLAnchorElementHash, (intptr_t)0 },
-    { "host", DontDelete|ReadOnly, (intptr_t)jsHTMLAnchorElementHost, (intptr_t)0 },
-    { "hostname", DontDelete|ReadOnly, (intptr_t)jsHTMLAnchorElementHostname, (intptr_t)0 },
-    { "pathname", DontDelete|ReadOnly, (intptr_t)jsHTMLAnchorElementPathname, (intptr_t)0 },
-    { "port", DontDelete|ReadOnly, (intptr_t)jsHTMLAnchorElementPort, (intptr_t)0 },
-    { "protocol", DontDelete|ReadOnly, (intptr_t)jsHTMLAnchorElementProtocol, (intptr_t)0 },
-    { "search", DontDelete|ReadOnly, (intptr_t)jsHTMLAnchorElementSearch, (intptr_t)0 },
-    { "text", DontDelete|ReadOnly, (intptr_t)jsHTMLAnchorElementText, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLAnchorElementConstructor, (intptr_t)0 },
+    { "accessKey", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementAccessKey), (intptr_t)setJSHTMLAnchorElementAccessKey },
+    { "charset", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementCharset), (intptr_t)setJSHTMLAnchorElementCharset },
+    { "coords", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementCoords), (intptr_t)setJSHTMLAnchorElementCoords },
+    { "href", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementHref), (intptr_t)setJSHTMLAnchorElementHref },
+    { "hreflang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementHreflang), (intptr_t)setJSHTMLAnchorElementHreflang },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementName), (intptr_t)setJSHTMLAnchorElementName },
+    { "rel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementRel), (intptr_t)setJSHTMLAnchorElementRel },
+    { "rev", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementRev), (intptr_t)setJSHTMLAnchorElementRev },
+    { "shape", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementShape), (intptr_t)setJSHTMLAnchorElementShape },
+    { "target", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementTarget), (intptr_t)setJSHTMLAnchorElementTarget },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementType), (intptr_t)setJSHTMLAnchorElementType },
+    { "hash", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementHash), (intptr_t)setJSHTMLAnchorElementHash },
+    { "host", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementHost), (intptr_t)setJSHTMLAnchorElementHost },
+    { "hostname", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementHostname), (intptr_t)setJSHTMLAnchorElementHostname },
+    { "pathname", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementPathname), (intptr_t)setJSHTMLAnchorElementPathname },
+    { "port", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementPort), (intptr_t)setJSHTMLAnchorElementPort },
+    { "protocol", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementProtocol), (intptr_t)setJSHTMLAnchorElementProtocol },
+    { "search", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementSearch), (intptr_t)setJSHTMLAnchorElementSearch },
+    { "text", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementText), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAnchorElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -96,7 +96,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -119,7 +119,7 @@ bool JSHTMLAnchorElementConstructor::getOwnPropertyDescriptor(ExecState* exec, c
 
 static const HashTableValue JSHTMLAnchorElementPrototypeTableValues[2] =
 {
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsHTMLAnchorElementPrototypeFunctionToString, (intptr_t)0 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLAnchorElementPrototypeFunctionToString), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -169,161 +169,180 @@ bool JSHTMLAnchorElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSHTMLAnchorElement, Base>(exec, &JSHTMLAnchorElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLAnchorElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementAccessKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::accesskeyAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::accesskeyAttr));
+    return result;
 }
 
-JSValue jsHTMLAnchorElementCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementCharset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::charsetAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::charsetAttr));
+    return result;
 }
 
-JSValue jsHTMLAnchorElementCoords(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementCoords(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::coordsAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::coordsAttr));
+    return result;
 }
 
-JSValue jsHTMLAnchorElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->getURLAttribute(HTMLNames::hrefAttr));
+    JSValue result = jsString(exec, imp->getURLAttribute(HTMLNames::hrefAttr));
+    return result;
 }
 
-JSValue jsHTMLAnchorElementHreflang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementHreflang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::hreflangAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::hreflangAttr));
+    return result;
 }
 
-JSValue jsHTMLAnchorElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
+    return result;
 }
 
-JSValue jsHTMLAnchorElementRel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementRel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::relAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::relAttr));
+    return result;
 }
 
-JSValue jsHTMLAnchorElementRev(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementRev(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::revAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::revAttr));
+    return result;
 }
 
-JSValue jsHTMLAnchorElementShape(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementShape(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::shapeAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::shapeAttr));
+    return result;
 }
 
-JSValue jsHTMLAnchorElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementTarget(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::targetAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::targetAttr));
+    return result;
 }
 
-JSValue jsHTMLAnchorElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::typeAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::typeAttr));
+    return result;
 }
 
-JSValue jsHTMLAnchorElementHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementHash(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->hash());
+    JSValue result = jsString(exec, imp->hash());
+    return result;
 }
 
-JSValue jsHTMLAnchorElementHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementHost(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->host());
+    JSValue result = jsString(exec, imp->host());
+    return result;
 }
 
-JSValue jsHTMLAnchorElementHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementHostname(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->hostname());
+    JSValue result = jsString(exec, imp->hostname());
+    return result;
 }
 
-JSValue jsHTMLAnchorElementPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementPathname(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->pathname());
+    JSValue result = jsString(exec, imp->pathname());
+    return result;
 }
 
-JSValue jsHTMLAnchorElementPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementPort(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->port());
+    JSValue result = jsString(exec, imp->port());
+    return result;
 }
 
-JSValue jsHTMLAnchorElementProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementProtocol(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->protocol());
+    JSValue result = jsString(exec, imp->protocol());
+    return result;
 }
 
-JSValue jsHTMLAnchorElementSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementSearch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->search());
+    JSValue result = jsString(exec, imp->search());
+    return result;
 }
 
-JSValue jsHTMLAnchorElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThis->impl());
-    return jsString(exec, imp->text());
+    JSValue result = jsString(exec, imp->text());
+    return result;
 }
 
-JSValue jsHTMLAnchorElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAnchorElement* domObject = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
+    JSHTMLAnchorElement* domObject = static_cast<JSHTMLAnchorElement*>(asObject(slotBase));
     return JSHTMLAnchorElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLAnchorElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -333,70 +352,130 @@ void JSHTMLAnchorElement::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSHTMLAnchorElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::accesskeyAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAnchorElementCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::charsetAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAnchorElementCoords(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::coordsAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAnchorElementHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::hrefAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAnchorElementHreflang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::hreflangAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAnchorElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::nameAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAnchorElementRel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::relAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAnchorElementRev(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::revAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAnchorElementShape(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::shapeAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAnchorElementTarget(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::targetAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAnchorElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::typeAttr, valueToStringWithNullCheck(exec, value));
 }
 
+void setJSHTMLAnchorElementHash(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
+    imp->setHash(valueToStringWithNullCheck(exec, value));
+}
+
+void setJSHTMLAnchorElementHost(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
+    imp->setHost(valueToStringWithNullCheck(exec, value));
+}
+
+void setJSHTMLAnchorElementHostname(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
+    imp->setHostname(valueToStringWithNullCheck(exec, value));
+}
+
+void setJSHTMLAnchorElementPathname(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
+    imp->setPathname(valueToStringWithNullCheck(exec, value));
+}
+
+void setJSHTMLAnchorElementPort(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
+    imp->setPort(valueToStringWithNullCheck(exec, value));
+}
+
+void setJSHTMLAnchorElementProtocol(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
+    imp->setProtocol(valueToStringWithNullCheck(exec, value));
+}
+
+void setJSHTMLAnchorElementSearch(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(thisObject);
+    HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
+    imp->setSearch(valueToStringWithNullCheck(exec, value));
+}
+
 JSValue JSHTMLAnchorElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 {
     return getDOMConstructor<JSHTMLAnchorElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
index db460ea494..62a152c0eb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -59,7 +59,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLAnchorElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -71,37 +71,44 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsHTMLAnchorElementPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLAnchorElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementAccessKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAnchorElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAnchorElementCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementCharset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAnchorElementCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAnchorElementCoords(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementCoords(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAnchorElementCoords(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAnchorElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAnchorElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAnchorElementHreflang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementHreflang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAnchorElementHreflang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAnchorElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAnchorElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAnchorElementRel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementRel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAnchorElementRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAnchorElementRev(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementRev(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAnchorElementRev(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAnchorElementShape(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementShape(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAnchorElementShape(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAnchorElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementTarget(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAnchorElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAnchorElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAnchorElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAnchorElementHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAnchorElementHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAnchorElementHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAnchorElementPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAnchorElementPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAnchorElementProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAnchorElementSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAnchorElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAnchorElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementHash(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLAnchorElementHash(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementHost(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLAnchorElementHost(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementHostname(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLAnchorElementHostname(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementPathname(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLAnchorElementPathname(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementPort(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLAnchorElementPort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementProtocol(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLAnchorElementProtocol(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementSearch(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLAnchorElementSearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLAnchorElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
index df39815510..6e3537d37d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
@@ -21,7 +21,6 @@
 #include "config.h"
 #include "JSHTMLAppletElement.h"
 
-#include "AtomicString.h"
 #include "HTMLAppletElement.h"
 #include "HTMLNames.h"
 #include "JSHTMLAppletElementCustom.h"
@@ -39,18 +38,18 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLAppletElement);
 
 static const HashTableValue JSHTMLAppletElementTableValues[13] =
 {
-    { "align", DontDelete, (intptr_t)jsHTMLAppletElementAlign, (intptr_t)setJSHTMLAppletElementAlign },
-    { "alt", DontDelete, (intptr_t)jsHTMLAppletElementAlt, (intptr_t)setJSHTMLAppletElementAlt },
-    { "archive", DontDelete, (intptr_t)jsHTMLAppletElementArchive, (intptr_t)setJSHTMLAppletElementArchive },
-    { "code", DontDelete, (intptr_t)jsHTMLAppletElementCode, (intptr_t)setJSHTMLAppletElementCode },
-    { "codeBase", DontDelete, (intptr_t)jsHTMLAppletElementCodeBase, (intptr_t)setJSHTMLAppletElementCodeBase },
-    { "height", DontDelete, (intptr_t)jsHTMLAppletElementHeight, (intptr_t)setJSHTMLAppletElementHeight },
-    { "hspace", DontDelete, (intptr_t)jsHTMLAppletElementHspace, (intptr_t)setJSHTMLAppletElementHspace },
-    { "name", DontDelete, (intptr_t)jsHTMLAppletElementName, (intptr_t)setJSHTMLAppletElementName },
-    { "object", DontDelete, (intptr_t)jsHTMLAppletElementObject, (intptr_t)setJSHTMLAppletElementObject },
-    { "vspace", DontDelete, (intptr_t)jsHTMLAppletElementVspace, (intptr_t)setJSHTMLAppletElementVspace },
-    { "width", DontDelete, (intptr_t)jsHTMLAppletElementWidth, (intptr_t)setJSHTMLAppletElementWidth },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLAppletElementConstructor, (intptr_t)0 },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAppletElementAlign), (intptr_t)setJSHTMLAppletElementAlign },
+    { "alt", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAppletElementAlt), (intptr_t)setJSHTMLAppletElementAlt },
+    { "archive", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAppletElementArchive), (intptr_t)setJSHTMLAppletElementArchive },
+    { "code", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAppletElementCode), (intptr_t)setJSHTMLAppletElementCode },
+    { "codeBase", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAppletElementCodeBase), (intptr_t)setJSHTMLAppletElementCodeBase },
+    { "height", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAppletElementHeight), (intptr_t)setJSHTMLAppletElementHeight },
+    { "hspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAppletElementHspace), (intptr_t)setJSHTMLAppletElementHspace },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAppletElementName), (intptr_t)setJSHTMLAppletElementName },
+    { "object", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAppletElementObject), (intptr_t)setJSHTMLAppletElementObject },
+    { "vspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAppletElementVspace), (intptr_t)setJSHTMLAppletElementVspace },
+    { "width", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAppletElementWidth), (intptr_t)setJSHTMLAppletElementWidth },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAppletElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -89,7 +88,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -143,10 +142,6 @@ JSObject* JSHTMLAppletElement::createPrototype(ExecState* exec, JSGlobalObject*
 
 bool JSHTMLAppletElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (canGetItemsForName(exec, static_cast<HTMLAppletElement*>(impl()), propertyName)) {
-        slot.setCustom(this, nameGetter);
-        return true;
-    }
     if (getOwnPropertySlotDelegate(exec, propertyName, slot))
         return true;
     return getStaticValueSlot<JSHTMLAppletElement, Base>(exec, &JSHTMLAppletElementTable, this, propertyName, slot);
@@ -154,108 +149,113 @@ bool JSHTMLAppletElement::getOwnPropertySlot(ExecState* exec, const Identifier&
 
 bool JSHTMLAppletElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    if (canGetItemsForName(exec, static_cast<HTMLAppletElement*>(impl()), propertyName)) {
-        PropertySlot slot;
-        slot.setCustom(this, nameGetter);
-        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-        return true;
-    }
     if (getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))
         return true;
     return getStaticValueDescriptor<JSHTMLAppletElement, Base>(exec, &JSHTMLAppletElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLAppletElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()));
+    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::alignAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::alignAttr));
+    return result;
 }
 
-JSValue jsHTMLAppletElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementAlt(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()));
+    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::altAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::altAttr));
+    return result;
 }
 
-JSValue jsHTMLAppletElementArchive(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementArchive(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()));
+    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::archiveAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::archiveAttr));
+    return result;
 }
 
-JSValue jsHTMLAppletElementCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementCode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()));
+    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::codeAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::codeAttr));
+    return result;
 }
 
-JSValue jsHTMLAppletElementCodeBase(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementCodeBase(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()));
+    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::codebaseAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::codebaseAttr));
+    return result;
 }
 
-JSValue jsHTMLAppletElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()));
+    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::heightAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::heightAttr));
+    return result;
 }
 
-JSValue jsHTMLAppletElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementHspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()));
+    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::hspaceAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::hspaceAttr));
+    return result;
 }
 
-JSValue jsHTMLAppletElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()));
+    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
+    return result;
 }
 
-JSValue jsHTMLAppletElementObject(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementObject(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()));
+    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::objectAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::objectAttr));
+    return result;
 }
 
-JSValue jsHTMLAppletElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementVspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()));
+    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::vspaceAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::vspaceAttr));
+    return result;
 }
 
-JSValue jsHTMLAppletElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()));
+    JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::widthAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::widthAttr));
+    return result;
 }
 
-JSValue jsHTMLAppletElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAppletElement* domObject = static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()));
+    JSHTMLAppletElement* domObject = static_cast<JSHTMLAppletElement*>(asObject(slotBase));
     return JSHTMLAppletElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLAppletElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -267,67 +267,78 @@ void JSHTMLAppletElement::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSHTMLAppletElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
+    JSHTMLAppletElement* castedThisObj = static_cast<JSHTMLAppletElement*>(thisObject);
+    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::alignAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAppletElementAlt(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
+    JSHTMLAppletElement* castedThisObj = static_cast<JSHTMLAppletElement*>(thisObject);
+    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::altAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAppletElementArchive(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
+    JSHTMLAppletElement* castedThisObj = static_cast<JSHTMLAppletElement*>(thisObject);
+    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::archiveAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAppletElementCode(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
+    JSHTMLAppletElement* castedThisObj = static_cast<JSHTMLAppletElement*>(thisObject);
+    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::codeAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAppletElementCodeBase(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
+    JSHTMLAppletElement* castedThisObj = static_cast<JSHTMLAppletElement*>(thisObject);
+    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::codebaseAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAppletElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
+    JSHTMLAppletElement* castedThisObj = static_cast<JSHTMLAppletElement*>(thisObject);
+    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::heightAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAppletElementHspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
+    JSHTMLAppletElement* castedThisObj = static_cast<JSHTMLAppletElement*>(thisObject);
+    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::hspaceAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAppletElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
+    JSHTMLAppletElement* castedThisObj = static_cast<JSHTMLAppletElement*>(thisObject);
+    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::nameAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAppletElementObject(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
+    JSHTMLAppletElement* castedThisObj = static_cast<JSHTMLAppletElement*>(thisObject);
+    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::objectAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAppletElementVspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
+    JSHTMLAppletElement* castedThisObj = static_cast<JSHTMLAppletElement*>(thisObject);
+    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::vspaceAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAppletElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
+    JSHTMLAppletElement* castedThisObj = static_cast<JSHTMLAppletElement*>(thisObject);
+    HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::widthAttr, valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
index 68eee1af26..ea4917644a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
@@ -52,9 +52,6 @@ public:
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-private:
-    static bool canGetItemsForName(JSC::ExecState*, HTMLAppletElement*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
@@ -66,7 +63,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLAppletElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,29 +72,29 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLAppletElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAppletElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAppletElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAppletElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAppletElementAlt(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAppletElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAppletElementArchive(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAppletElementArchive(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAppletElementArchive(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAppletElementCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAppletElementCode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAppletElementCode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAppletElementCodeBase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAppletElementCodeBase(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAppletElementCodeBase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAppletElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAppletElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAppletElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAppletElementHspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAppletElementHspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAppletElementHspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAppletElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAppletElementName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAppletElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAppletElementObject(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAppletElementObject(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAppletElementObject(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAppletElementVspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAppletElementVspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAppletElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAppletElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAppletElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAppletElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAppletElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAppletElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
index 50ca8804e8..d47873728b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
@@ -37,21 +37,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLAreaElement);
 
 static const HashTableValue JSHTMLAreaElementTableValues[16] =
 {
-    { "accessKey", DontDelete, (intptr_t)jsHTMLAreaElementAccessKey, (intptr_t)setJSHTMLAreaElementAccessKey },
-    { "alt", DontDelete, (intptr_t)jsHTMLAreaElementAlt, (intptr_t)setJSHTMLAreaElementAlt },
-    { "coords", DontDelete, (intptr_t)jsHTMLAreaElementCoords, (intptr_t)setJSHTMLAreaElementCoords },
-    { "href", DontDelete, (intptr_t)jsHTMLAreaElementHref, (intptr_t)setJSHTMLAreaElementHref },
-    { "noHref", DontDelete, (intptr_t)jsHTMLAreaElementNoHref, (intptr_t)setJSHTMLAreaElementNoHref },
-    { "shape", DontDelete, (intptr_t)jsHTMLAreaElementShape, (intptr_t)setJSHTMLAreaElementShape },
-    { "target", DontDelete, (intptr_t)jsHTMLAreaElementTarget, (intptr_t)setJSHTMLAreaElementTarget },
-    { "hash", DontDelete|ReadOnly, (intptr_t)jsHTMLAreaElementHash, (intptr_t)0 },
-    { "host", DontDelete|ReadOnly, (intptr_t)jsHTMLAreaElementHost, (intptr_t)0 },
-    { "hostname", DontDelete|ReadOnly, (intptr_t)jsHTMLAreaElementHostname, (intptr_t)0 },
-    { "pathname", DontDelete|ReadOnly, (intptr_t)jsHTMLAreaElementPathname, (intptr_t)0 },
-    { "port", DontDelete|ReadOnly, (intptr_t)jsHTMLAreaElementPort, (intptr_t)0 },
-    { "protocol", DontDelete|ReadOnly, (intptr_t)jsHTMLAreaElementProtocol, (intptr_t)0 },
-    { "search", DontDelete|ReadOnly, (intptr_t)jsHTMLAreaElementSearch, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLAreaElementConstructor, (intptr_t)0 },
+    { "accessKey", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAreaElementAccessKey), (intptr_t)setJSHTMLAreaElementAccessKey },
+    { "alt", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAreaElementAlt), (intptr_t)setJSHTMLAreaElementAlt },
+    { "coords", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAreaElementCoords), (intptr_t)setJSHTMLAreaElementCoords },
+    { "href", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAreaElementHref), (intptr_t)setJSHTMLAreaElementHref },
+    { "noHref", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAreaElementNoHref), (intptr_t)setJSHTMLAreaElementNoHref },
+    { "shape", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAreaElementShape), (intptr_t)setJSHTMLAreaElementShape },
+    { "target", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAreaElementTarget), (intptr_t)setJSHTMLAreaElementTarget },
+    { "hash", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAreaElementHash), (intptr_t)0 },
+    { "host", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAreaElementHost), (intptr_t)0 },
+    { "hostname", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAreaElementHostname), (intptr_t)0 },
+    { "pathname", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAreaElementPathname), (intptr_t)0 },
+    { "port", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAreaElementPort), (intptr_t)0 },
+    { "protocol", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAreaElementProtocol), (intptr_t)0 },
+    { "search", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAreaElementSearch), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAreaElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -90,7 +90,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -152,121 +152,135 @@ bool JSHTMLAreaElement::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSHTMLAreaElement, Base>(exec, &JSHTMLAreaElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLAreaElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementAccessKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::accesskeyAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::accesskeyAttr));
+    return result;
 }
 
-JSValue jsHTMLAreaElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementAlt(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::altAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::altAttr));
+    return result;
 }
 
-JSValue jsHTMLAreaElementCoords(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementCoords(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::coordsAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::coordsAttr));
+    return result;
 }
 
-JSValue jsHTMLAreaElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->getURLAttribute(HTMLNames::hrefAttr));
+    JSValue result = jsString(exec, imp->getURLAttribute(HTMLNames::hrefAttr));
+    return result;
 }
 
-JSValue jsHTMLAreaElementNoHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementNoHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThis->impl());
-    return jsBoolean(imp->noHref());
+    JSValue result = jsBoolean(imp->noHref());
+    return result;
 }
 
-JSValue jsHTMLAreaElementShape(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementShape(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::shapeAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::shapeAttr));
+    return result;
 }
 
-JSValue jsHTMLAreaElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementTarget(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::targetAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::targetAttr));
+    return result;
 }
 
-JSValue jsHTMLAreaElementHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementHash(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->hash());
+    JSValue result = jsString(exec, imp->hash());
+    return result;
 }
 
-JSValue jsHTMLAreaElementHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementHost(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->host());
+    JSValue result = jsString(exec, imp->host());
+    return result;
 }
 
-JSValue jsHTMLAreaElementHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementHostname(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->hostname());
+    JSValue result = jsString(exec, imp->hostname());
+    return result;
 }
 
-JSValue jsHTMLAreaElementPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementPathname(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->pathname());
+    JSValue result = jsString(exec, imp->pathname());
+    return result;
 }
 
-JSValue jsHTMLAreaElementPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementPort(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->port());
+    JSValue result = jsString(exec, imp->port());
+    return result;
 }
 
-JSValue jsHTMLAreaElementProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementProtocol(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->protocol());
+    JSValue result = jsString(exec, imp->protocol());
+    return result;
 }
 
-JSValue jsHTMLAreaElementSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementSearch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->search());
+    JSValue result = jsString(exec, imp->search());
+    return result;
 }
 
-JSValue jsHTMLAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAreaElement* domObject = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLAreaElement* domObject = static_cast<JSHTMLAreaElement*>(asObject(slotBase));
     return JSHTMLAreaElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLAreaElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -276,43 +290,50 @@ void JSHTMLAreaElement::put(ExecState* exec, const Identifier& propertyName, JSV
 
 void setJSHTMLAreaElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
+    JSHTMLAreaElement* castedThisObj = static_cast<JSHTMLAreaElement*>(thisObject);
+    HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::accesskeyAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAreaElementAlt(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
+    JSHTMLAreaElement* castedThisObj = static_cast<JSHTMLAreaElement*>(thisObject);
+    HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::altAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAreaElementCoords(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
+    JSHTMLAreaElement* castedThisObj = static_cast<JSHTMLAreaElement*>(thisObject);
+    HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::coordsAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAreaElementHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
+    JSHTMLAreaElement* castedThisObj = static_cast<JSHTMLAreaElement*>(thisObject);
+    HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::hrefAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAreaElementNoHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
+    JSHTMLAreaElement* castedThisObj = static_cast<JSHTMLAreaElement*>(thisObject);
+    HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThisObj->impl());
     imp->setNoHref(value.toBoolean(exec));
 }
 
 void setJSHTMLAreaElementShape(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
+    JSHTMLAreaElement* castedThisObj = static_cast<JSHTMLAreaElement*>(thisObject);
+    HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::shapeAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLAreaElementTarget(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
+    JSHTMLAreaElement* castedThisObj = static_cast<JSHTMLAreaElement*>(thisObject);
+    HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::targetAttr, valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
index e2edf7b4c9..265183b939 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLAreaElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,28 +66,28 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLAreaElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementAccessKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAreaElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAreaElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementAlt(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAreaElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAreaElementCoords(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementCoords(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAreaElementCoords(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAreaElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAreaElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAreaElementNoHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementNoHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAreaElementNoHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAreaElementShape(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementShape(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAreaElementShape(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAreaElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementTarget(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLAreaElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLAreaElementHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAreaElementHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAreaElementHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAreaElementPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAreaElementPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAreaElementProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAreaElementSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementHash(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLAreaElementHost(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLAreaElementHostname(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLAreaElementPathname(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLAreaElementPort(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLAreaElementProtocol(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLAreaElementSearch(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLAreaElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
index 991a0b55c0..2abc82398b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
@@ -37,7 +37,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLAudioElement);
 
 static const HashTableValue JSHTMLAudioElementTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLAudioElementConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLAudioElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,7 +76,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -138,9 +138,9 @@ bool JSHTMLAudioElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSHTMLAudioElement, Base>(exec, &JSHTMLAudioElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLAudioElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAudioElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLAudioElement* domObject = static_cast<JSHTMLAudioElement*>(asObject(slot.slotBase()));
+    JSHTMLAudioElement* domObject = static_cast<JSHTMLAudioElement*>(asObject(slotBase));
     return JSHTMLAudioElement::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSHTMLAudioElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
index b8cd9addaf..487877aa0b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLAudioElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -67,7 +67,7 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLAudioElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAudioElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
index 23e43af769..530f5f40c8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
@@ -37,8 +37,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLBRElement);
 
 static const HashTableValue JSHTMLBRElementTableValues[3] =
 {
-    { "clear", DontDelete, (intptr_t)jsHTMLBRElementClear, (intptr_t)setJSHTMLBRElementClear },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLBRElementConstructor, (intptr_t)0 },
+    { "clear", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBRElementClear), (intptr_t)setJSHTMLBRElementClear },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBRElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -139,17 +139,18 @@ bool JSHTMLBRElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSHTMLBRElement, Base>(exec, &JSHTMLBRElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLBRElementClear(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBRElementClear(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBRElement* castedThis = static_cast<JSHTMLBRElement*>(asObject(slot.slotBase()));
+    JSHTMLBRElement* castedThis = static_cast<JSHTMLBRElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBRElement* imp = static_cast<HTMLBRElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::clearAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::clearAttr));
+    return result;
 }
 
-JSValue jsHTMLBRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBRElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBRElement* domObject = static_cast<JSHTMLBRElement*>(asObject(slot.slotBase()));
+    JSHTMLBRElement* domObject = static_cast<JSHTMLBRElement*>(asObject(slotBase));
     return JSHTMLBRElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLBRElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -159,7 +160,8 @@ void JSHTMLBRElement::put(ExecState* exec, const Identifier& propertyName, JSVal
 
 void setJSHTMLBRElementClear(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLBRElement* imp = static_cast<HTMLBRElement*>(static_cast<JSHTMLBRElement*>(thisObject)->impl());
+    JSHTMLBRElement* castedThisObj = static_cast<JSHTMLBRElement*>(thisObject);
+    HTMLBRElement* imp = static_cast<HTMLBRElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::clearAttr, valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
index 6e6a691f30..162ec038ca 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLBRElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,9 +66,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLBRElementClear(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBRElementClear(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBRElementClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBRElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
index fe57b25c09..205333ad72 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
@@ -37,9 +37,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLBaseElement);
 
 static const HashTableValue JSHTMLBaseElementTableValues[4] =
 {
-    { "href", DontDelete, (intptr_t)jsHTMLBaseElementHref, (intptr_t)setJSHTMLBaseElementHref },
-    { "target", DontDelete, (intptr_t)jsHTMLBaseElementTarget, (intptr_t)setJSHTMLBaseElementTarget },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLBaseElementConstructor, (intptr_t)0 },
+    { "href", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBaseElementHref), (intptr_t)setJSHTMLBaseElementHref },
+    { "target", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBaseElementTarget), (intptr_t)setJSHTMLBaseElementTarget },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBaseElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -78,7 +78,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -140,25 +140,27 @@ bool JSHTMLBaseElement::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSHTMLBaseElement, Base>(exec, &JSHTMLBaseElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLBaseElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBaseElement* castedThis = static_cast<JSHTMLBaseElement*>(asObject(slot.slotBase()));
+    JSHTMLBaseElement* castedThis = static_cast<JSHTMLBaseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBaseElement* imp = static_cast<HTMLBaseElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::hrefAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::hrefAttr));
+    return result;
 }
 
-JSValue jsHTMLBaseElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseElementTarget(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBaseElement* castedThis = static_cast<JSHTMLBaseElement*>(asObject(slot.slotBase()));
+    JSHTMLBaseElement* castedThis = static_cast<JSHTMLBaseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBaseElement* imp = static_cast<HTMLBaseElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::targetAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::targetAttr));
+    return result;
 }
 
-JSValue jsHTMLBaseElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBaseElement* domObject = static_cast<JSHTMLBaseElement*>(asObject(slot.slotBase()));
+    JSHTMLBaseElement* domObject = static_cast<JSHTMLBaseElement*>(asObject(slotBase));
     return JSHTMLBaseElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLBaseElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -168,13 +170,15 @@ void JSHTMLBaseElement::put(ExecState* exec, const Identifier& propertyName, JSV
 
 void setJSHTMLBaseElementHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLBaseElement* imp = static_cast<HTMLBaseElement*>(static_cast<JSHTMLBaseElement*>(thisObject)->impl());
+    JSHTMLBaseElement* castedThisObj = static_cast<JSHTMLBaseElement*>(thisObject);
+    HTMLBaseElement* imp = static_cast<HTMLBaseElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::hrefAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLBaseElementTarget(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLBaseElement* imp = static_cast<HTMLBaseElement*>(static_cast<JSHTMLBaseElement*>(thisObject)->impl());
+    JSHTMLBaseElement* castedThisObj = static_cast<JSHTMLBaseElement*>(thisObject);
+    HTMLBaseElement* imp = static_cast<HTMLBaseElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::targetAttr, valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
index 6e86fb6407..8fd6f41455 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLBaseElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,11 +66,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLBaseElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBaseElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBaseElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBaseElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBaseElementTarget(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBaseElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBaseElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBaseElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
index 806680fa23..877c8b5629 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
@@ -38,10 +38,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLBaseFontElement);
 
 static const HashTableValue JSHTMLBaseFontElementTableValues[5] =
 {
-    { "color", DontDelete, (intptr_t)jsHTMLBaseFontElementColor, (intptr_t)setJSHTMLBaseFontElementColor },
-    { "face", DontDelete, (intptr_t)jsHTMLBaseFontElementFace, (intptr_t)setJSHTMLBaseFontElementFace },
-    { "size", DontDelete, (intptr_t)jsHTMLBaseFontElementSize, (intptr_t)setJSHTMLBaseFontElementSize },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLBaseFontElementConstructor, (intptr_t)0 },
+    { "color", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBaseFontElementColor), (intptr_t)setJSHTMLBaseFontElementColor },
+    { "face", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBaseFontElementFace), (intptr_t)setJSHTMLBaseFontElementFace },
+    { "size", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBaseFontElementSize), (intptr_t)setJSHTMLBaseFontElementSize },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBaseFontElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -142,33 +142,36 @@ bool JSHTMLBaseFontElement::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSHTMLBaseFontElement, Base>(exec, &JSHTMLBaseFontElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLBaseFontElementColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseFontElementColor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBaseFontElement* castedThis = static_cast<JSHTMLBaseFontElement*>(asObject(slot.slotBase()));
+    JSHTMLBaseFontElement* castedThis = static_cast<JSHTMLBaseFontElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::colorAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::colorAttr));
+    return result;
 }
 
-JSValue jsHTMLBaseFontElementFace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseFontElementFace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBaseFontElement* castedThis = static_cast<JSHTMLBaseFontElement*>(asObject(slot.slotBase()));
+    JSHTMLBaseFontElement* castedThis = static_cast<JSHTMLBaseFontElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::faceAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::faceAttr));
+    return result;
 }
 
-JSValue jsHTMLBaseFontElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseFontElementSize(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBaseFontElement* castedThis = static_cast<JSHTMLBaseFontElement*>(asObject(slot.slotBase()));
+    JSHTMLBaseFontElement* castedThis = static_cast<JSHTMLBaseFontElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(castedThis->impl());
-    return jsNumber(exec, imp->size());
+    JSValue result = jsNumber(exec, imp->size());
+    return result;
 }
 
-JSValue jsHTMLBaseFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseFontElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBaseFontElement* domObject = static_cast<JSHTMLBaseFontElement*>(asObject(slot.slotBase()));
+    JSHTMLBaseFontElement* domObject = static_cast<JSHTMLBaseFontElement*>(asObject(slotBase));
     return JSHTMLBaseFontElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLBaseFontElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -178,19 +181,22 @@ void JSHTMLBaseFontElement::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSHTMLBaseFontElementColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(static_cast<JSHTMLBaseFontElement*>(thisObject)->impl());
+    JSHTMLBaseFontElement* castedThisObj = static_cast<JSHTMLBaseFontElement*>(thisObject);
+    HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::colorAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLBaseFontElementFace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(static_cast<JSHTMLBaseFontElement*>(thisObject)->impl());
+    JSHTMLBaseFontElement* castedThisObj = static_cast<JSHTMLBaseFontElement*>(thisObject);
+    HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::faceAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLBaseFontElementSize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(static_cast<JSHTMLBaseFontElement*>(thisObject)->impl());
+    JSHTMLBaseFontElement* castedThisObj = static_cast<JSHTMLBaseFontElement*>(thisObject);
+    HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(castedThisObj->impl());
     imp->setSize(value.toInt32(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
index 02a5ece11c..23c34ceaa5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLBaseFontElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,13 +66,13 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLBaseFontElementColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBaseFontElementColor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBaseFontElementColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBaseFontElementFace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBaseFontElementFace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBaseFontElementFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBaseFontElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBaseFontElementSize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBaseFontElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBaseFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBaseFontElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
index 1d65349877..87bd7834cc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
@@ -37,8 +37,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLBlockquoteElement);
 
 static const HashTableValue JSHTMLBlockquoteElementTableValues[3] =
 {
-    { "cite", DontDelete, (intptr_t)jsHTMLBlockquoteElementCite, (intptr_t)setJSHTMLBlockquoteElementCite },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLBlockquoteElementConstructor, (intptr_t)0 },
+    { "cite", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBlockquoteElementCite), (intptr_t)setJSHTMLBlockquoteElementCite },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBlockquoteElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -139,17 +139,18 @@ bool JSHTMLBlockquoteElement::getOwnPropertyDescriptor(ExecState* exec, const Id
     return getStaticValueDescriptor<JSHTMLBlockquoteElement, Base>(exec, &JSHTMLBlockquoteElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLBlockquoteElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBlockquoteElementCite(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBlockquoteElement* castedThis = static_cast<JSHTMLBlockquoteElement*>(asObject(slot.slotBase()));
+    JSHTMLBlockquoteElement* castedThis = static_cast<JSHTMLBlockquoteElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBlockquoteElement* imp = static_cast<HTMLBlockquoteElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::citeAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::citeAttr));
+    return result;
 }
 
-JSValue jsHTMLBlockquoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBlockquoteElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBlockquoteElement* domObject = static_cast<JSHTMLBlockquoteElement*>(asObject(slot.slotBase()));
+    JSHTMLBlockquoteElement* domObject = static_cast<JSHTMLBlockquoteElement*>(asObject(slotBase));
     return JSHTMLBlockquoteElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLBlockquoteElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -159,7 +160,8 @@ void JSHTMLBlockquoteElement::put(ExecState* exec, const Identifier& propertyNam
 
 void setJSHTMLBlockquoteElementCite(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLBlockquoteElement* imp = static_cast<HTMLBlockquoteElement*>(static_cast<JSHTMLBlockquoteElement*>(thisObject)->impl());
+    JSHTMLBlockquoteElement* castedThisObj = static_cast<JSHTMLBlockquoteElement*>(thisObject);
+    HTMLBlockquoteElement* imp = static_cast<HTMLBlockquoteElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::citeAttr, valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
index acead7b4d3..834bbd01e0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLBlockquoteElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,9 +66,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLBlockquoteElementCite(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBlockquoteElementCite(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBlockquoteElementCite(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBlockquoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBlockquoteElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
index 5e817991a1..b39bdf6552 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
@@ -22,10 +22,8 @@
 #include "JSHTMLBodyElement.h"
 
 #include "EventListener.h"
-#include "Frame.h"
 #include "HTMLBodyElement.h"
 #include "HTMLNames.h"
-#include "JSDOMGlobalObject.h"
 #include "JSEventListener.h"
 #include "KURL.h"
 #include <runtime/JSString.h>
@@ -39,23 +37,24 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLBodyElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLBodyElementTableValues[16] =
-{
-    { "aLink", DontDelete, (intptr_t)jsHTMLBodyElementALink, (intptr_t)setJSHTMLBodyElementALink },
-    { "background", DontDelete, (intptr_t)jsHTMLBodyElementBackground, (intptr_t)setJSHTMLBodyElementBackground },
-    { "bgColor", DontDelete, (intptr_t)jsHTMLBodyElementBgColor, (intptr_t)setJSHTMLBodyElementBgColor },
-    { "link", DontDelete, (intptr_t)jsHTMLBodyElementLink, (intptr_t)setJSHTMLBodyElementLink },
-    { "text", DontDelete, (intptr_t)jsHTMLBodyElementText, (intptr_t)setJSHTMLBodyElementText },
-    { "vLink", DontDelete, (intptr_t)jsHTMLBodyElementVLink, (intptr_t)setJSHTMLBodyElementVLink },
-    { "onbeforeunload", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnbeforeunload, (intptr_t)setJSHTMLBodyElementOnbeforeunload },
-    { "onhashchange", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnhashchange, (intptr_t)setJSHTMLBodyElementOnhashchange },
-    { "onmessage", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnmessage, (intptr_t)setJSHTMLBodyElementOnmessage },
-    { "onoffline", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnoffline, (intptr_t)setJSHTMLBodyElementOnoffline },
-    { "ononline", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnonline, (intptr_t)setJSHTMLBodyElementOnonline },
-    { "onresize", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnresize, (intptr_t)setJSHTMLBodyElementOnresize },
-    { "onstorage", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnstorage, (intptr_t)setJSHTMLBodyElementOnstorage },
-    { "onunload", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnunload, (intptr_t)setJSHTMLBodyElementOnunload },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLBodyElementConstructor, (intptr_t)0 },
+static const HashTableValue JSHTMLBodyElementTableValues[17] =
+{
+    { "aLink", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementALink), (intptr_t)setJSHTMLBodyElementALink },
+    { "background", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementBackground), (intptr_t)setJSHTMLBodyElementBackground },
+    { "bgColor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementBgColor), (intptr_t)setJSHTMLBodyElementBgColor },
+    { "link", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementLink), (intptr_t)setJSHTMLBodyElementLink },
+    { "text", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementText), (intptr_t)setJSHTMLBodyElementText },
+    { "vLink", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementVLink), (intptr_t)setJSHTMLBodyElementVLink },
+    { "onbeforeunload", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnbeforeunload), (intptr_t)setJSHTMLBodyElementOnbeforeunload },
+    { "onhashchange", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnhashchange), (intptr_t)setJSHTMLBodyElementOnhashchange },
+    { "onmessage", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnmessage), (intptr_t)setJSHTMLBodyElementOnmessage },
+    { "onoffline", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnoffline), (intptr_t)setJSHTMLBodyElementOnoffline },
+    { "ononline", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnonline), (intptr_t)setJSHTMLBodyElementOnonline },
+    { "onpopstate", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnpopstate), (intptr_t)setJSHTMLBodyElementOnpopstate },
+    { "onresize", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnresize), (intptr_t)setJSHTMLBodyElementOnresize },
+    { "onstorage", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnstorage), (intptr_t)setJSHTMLBodyElementOnstorage },
+    { "onunload", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnunload), (intptr_t)setJSHTMLBodyElementOnunload },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -94,7 +93,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -156,153 +155,189 @@ bool JSHTMLBodyElement::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSHTMLBodyElement, Base>(exec, &JSHTMLBodyElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLBodyElementALink(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementALink(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::alinkAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::alinkAttr));
+    return result;
 }
 
-JSValue jsHTMLBodyElementBackground(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementBackground(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::backgroundAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::backgroundAttr));
+    return result;
 }
 
-JSValue jsHTMLBodyElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementBgColor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::bgcolorAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::bgcolorAttr));
+    return result;
 }
 
-JSValue jsHTMLBodyElementLink(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementLink(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::linkAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::linkAttr));
+    return result;
 }
 
-JSValue jsHTMLBodyElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::textAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::textAttr));
+    return result;
 }
 
-JSValue jsHTMLBodyElementVLink(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementVLink(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::vlinkAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::vlinkAttr));
+    return result;
 }
 
-JSValue jsHTMLBodyElementOnbeforeunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementOnbeforeunload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforeunload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLBodyElementOnhashchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementOnhashchange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
     if (EventListener* listener = imp->onhashchange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLBodyElementOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementOnmessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
     if (EventListener* listener = imp->onmessage()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLBodyElementOnoffline(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementOnoffline(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
     if (EventListener* listener = imp->onoffline()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLBodyElementOnonline(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementOnonline(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
     if (EventListener* listener = imp->ononline()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLBodyElementOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementOnpopstate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
+    if (EventListener* listener = imp->onpopstate()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsHTMLBodyElementOnresize(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
     if (EventListener* listener = imp->onresize()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLBodyElementOnstorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementOnstorage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
     if (EventListener* listener = imp->onstorage()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLBodyElementOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementOnunload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
     if (EventListener* listener = imp->onunload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLBodyElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLBodyElement* domObject = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    JSHTMLBodyElement* domObject = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
     return JSHTMLBodyElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLBodyElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -312,37 +347,43 @@ void JSHTMLBodyElement::put(ExecState* exec, const Identifier& propertyName, JSV
 
 void setJSHTMLBodyElementALink(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
+    JSHTMLBodyElement* castedThisObj = static_cast<JSHTMLBodyElement*>(thisObject);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::alinkAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLBodyElementBackground(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
+    JSHTMLBodyElement* castedThisObj = static_cast<JSHTMLBodyElement*>(thisObject);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::backgroundAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLBodyElementBgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
+    JSHTMLBodyElement* castedThisObj = static_cast<JSHTMLBodyElement*>(thisObject);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::bgcolorAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLBodyElementLink(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
+    JSHTMLBodyElement* castedThisObj = static_cast<JSHTMLBodyElement*>(thisObject);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::linkAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLBodyElementText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
+    JSHTMLBodyElement* castedThisObj = static_cast<JSHTMLBodyElement*>(thisObject);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::textAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLBodyElementVLink(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
+    JSHTMLBodyElement* castedThisObj = static_cast<JSHTMLBodyElement*>(thisObject);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::vlinkAttr, valueToStringWithNullCheck(exec, value));
 }
 
@@ -350,80 +391,63 @@ void setJSHTMLBodyElementOnbeforeunload(ExecState* exec, JSObject* thisObject, J
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforeunload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforeunload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSHTMLBodyElementOnhashchange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnhashchange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnhashchange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSHTMLBodyElementOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmessage(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSHTMLBodyElementOnoffline(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnoffline(globalObject->createJSAttributeEventListener(value));
+    imp->setOnoffline(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSHTMLBodyElementOnonline(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnonline(globalObject->createJSAttributeEventListener(value));
+    imp->setOnonline(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSHTMLBodyElementOnpopstate(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
+    imp->setOnpopstate(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSHTMLBodyElementOnresize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnresize(globalObject->createJSAttributeEventListener(value));
+    imp->setOnresize(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSHTMLBodyElementOnstorage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnstorage(globalObject->createJSAttributeEventListener(value));
+    imp->setOnstorage(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSHTMLBodyElementOnunload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnunload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnunload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSHTMLBodyElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
index 8f4e94026d..185a4f2856 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLBodyElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,35 +66,37 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLBodyElementALink(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementALink(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementALink(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBodyElementBackground(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementBackground(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementBackground(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBodyElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementBgColor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBodyElementLink(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementLink(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementLink(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBodyElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBodyElementVLink(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementVLink(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementVLink(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBodyElementOnbeforeunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementOnbeforeunload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementOnbeforeunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBodyElementOnhashchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementOnhashchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementOnhashchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBodyElementOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementOnmessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBodyElementOnoffline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementOnoffline(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementOnoffline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBodyElementOnonline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementOnonline(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementOnonline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBodyElementOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementOnpopstate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLBodyElementOnpopstate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementOnresize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBodyElementOnstorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementOnstorage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementOnstorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBodyElementOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementOnunload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBodyElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
index 1874cb7915..8eccb371ac 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
@@ -39,19 +39,20 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLButtonElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLButtonElementTableValues[12] =
-{
-    { "form", DontDelete|ReadOnly, (intptr_t)jsHTMLButtonElementForm, (intptr_t)0 },
-    { "formNoValidate", DontDelete, (intptr_t)jsHTMLButtonElementFormNoValidate, (intptr_t)setJSHTMLButtonElementFormNoValidate },
-    { "validity", DontDelete|ReadOnly, (intptr_t)jsHTMLButtonElementValidity, (intptr_t)0 },
-    { "accessKey", DontDelete, (intptr_t)jsHTMLButtonElementAccessKey, (intptr_t)setJSHTMLButtonElementAccessKey },
-    { "disabled", DontDelete, (intptr_t)jsHTMLButtonElementDisabled, (intptr_t)setJSHTMLButtonElementDisabled },
-    { "autofocus", DontDelete, (intptr_t)jsHTMLButtonElementAutofocus, (intptr_t)setJSHTMLButtonElementAutofocus },
-    { "name", DontDelete, (intptr_t)jsHTMLButtonElementName, (intptr_t)setJSHTMLButtonElementName },
-    { "type", DontDelete|ReadOnly, (intptr_t)jsHTMLButtonElementType, (intptr_t)0 },
-    { "value", DontDelete, (intptr_t)jsHTMLButtonElementValue, (intptr_t)setJSHTMLButtonElementValue },
-    { "willValidate", DontDelete|ReadOnly, (intptr_t)jsHTMLButtonElementWillValidate, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLButtonElementConstructor, (intptr_t)0 },
+static const HashTableValue JSHTMLButtonElementTableValues[13] =
+{
+    { "form", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLButtonElementForm), (intptr_t)0 },
+    { "formNoValidate", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLButtonElementFormNoValidate), (intptr_t)setJSHTMLButtonElementFormNoValidate },
+    { "validity", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLButtonElementValidity), (intptr_t)0 },
+    { "accessKey", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLButtonElementAccessKey), (intptr_t)setJSHTMLButtonElementAccessKey },
+    { "disabled", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLButtonElementDisabled), (intptr_t)setJSHTMLButtonElementDisabled },
+    { "autofocus", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLButtonElementAutofocus), (intptr_t)setJSHTMLButtonElementAutofocus },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLButtonElementName), (intptr_t)setJSHTMLButtonElementName },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLButtonElementType), (intptr_t)0 },
+    { "value", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLButtonElementValue), (intptr_t)setJSHTMLButtonElementValue },
+    { "willValidate", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLButtonElementWillValidate), (intptr_t)0 },
+    { "validationMessage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLButtonElementValidationMessage), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLButtonElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -90,7 +91,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -113,9 +114,9 @@ bool JSHTMLButtonElementConstructor::getOwnPropertyDescriptor(ExecState* exec, c
 
 static const HashTableValue JSHTMLButtonElementPrototypeTableValues[4] =
 {
-    { "checkValidity", DontDelete|Function, (intptr_t)jsHTMLButtonElementPrototypeFunctionCheckValidity, (intptr_t)0 },
-    { "setCustomValidity", DontDelete|Function, (intptr_t)jsHTMLButtonElementPrototypeFunctionSetCustomValidity, (intptr_t)1 },
-    { "click", DontDelete|Function, (intptr_t)jsHTMLButtonElementPrototypeFunctionClick, (intptr_t)0 },
+    { "checkValidity", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLButtonElementPrototypeFunctionCheckValidity), (intptr_t)0 },
+    { "setCustomValidity", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLButtonElementPrototypeFunctionSetCustomValidity), (intptr_t)1 },
+    { "click", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLButtonElementPrototypeFunctionClick), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -165,89 +166,108 @@ bool JSHTMLButtonElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSHTMLButtonElement, Base>(exec, &JSHTMLButtonElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLButtonElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementForm(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()));
+    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    return result;
 }
 
-JSValue jsHTMLButtonElementFormNoValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementFormNoValidate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()));
+    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThis->impl());
-    return jsBoolean(imp->formNoValidate());
+    JSValue result = jsBoolean(imp->formNoValidate());
+    return result;
 }
 
-JSValue jsHTMLButtonElementValidity(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementValidity(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()));
+    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->validity()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->validity()));
+    return result;
 }
 
-JSValue jsHTMLButtonElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementAccessKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()));
+    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThis->impl());
-    return jsString(exec, imp->accessKey());
+    JSValue result = jsString(exec, imp->accessKey());
+    return result;
 }
 
-JSValue jsHTMLButtonElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementDisabled(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()));
+    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThis->impl());
-    return jsBoolean(imp->disabled());
+    JSValue result = jsBoolean(imp->disabled());
+    return result;
+}
+
+JSValue jsHTMLButtonElementAutofocus(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThis->impl());
+    JSValue result = jsBoolean(imp->autofocus());
+    return result;
 }
 
-JSValue jsHTMLButtonElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()));
+    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThis->impl());
-    return jsBoolean(imp->autofocus());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsHTMLButtonElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()));
+    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsHTMLButtonElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()));
+    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->value());
+    return result;
 }
 
-JSValue jsHTMLButtonElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementWillValidate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()));
+    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThis->impl());
-    return jsString(exec, imp->value());
+    JSValue result = jsBoolean(imp->willValidate());
+    return result;
 }
 
-JSValue jsHTMLButtonElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementValidationMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()));
+    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThis->impl());
-    return jsBoolean(imp->willValidate());
+    JSValue result = jsString(exec, imp->validationMessage());
+    return result;
 }
 
-JSValue jsHTMLButtonElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLButtonElement* domObject = static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()));
+    JSHTMLButtonElement* domObject = static_cast<JSHTMLButtonElement*>(asObject(slotBase));
     return JSHTMLButtonElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLButtonElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -257,37 +277,43 @@ void JSHTMLButtonElement::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSHTMLButtonElementFormNoValidate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
+    JSHTMLButtonElement* castedThisObj = static_cast<JSHTMLButtonElement*>(thisObject);
+    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThisObj->impl());
     imp->setFormNoValidate(value.toBoolean(exec));
 }
 
 void setJSHTMLButtonElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
+    JSHTMLButtonElement* castedThisObj = static_cast<JSHTMLButtonElement*>(thisObject);
+    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThisObj->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLButtonElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
+    JSHTMLButtonElement* castedThisObj = static_cast<JSHTMLButtonElement*>(thisObject);
+    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThisObj->impl());
     imp->setDisabled(value.toBoolean(exec));
 }
 
 void setJSHTMLButtonElementAutofocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
+    JSHTMLButtonElement* castedThisObj = static_cast<JSHTMLButtonElement*>(thisObject);
+    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThisObj->impl());
     imp->setAutofocus(value.toBoolean(exec));
 }
 
 void setJSHTMLButtonElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
+    JSHTMLButtonElement* castedThisObj = static_cast<JSHTMLButtonElement*>(thisObject);
+    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThisObj->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLButtonElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
+    JSHTMLButtonElement* castedThisObj = static_cast<JSHTMLButtonElement*>(thisObject);
+    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThisObj->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
index 3b8204b83d..1ad0a48de4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -59,7 +59,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLButtonElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,23 +73,24 @@ JSC::JSValue JSC_HOST_CALL jsHTMLButtonElementPrototypeFunctionSetCustomValidity
 JSC::JSValue JSC_HOST_CALL jsHTMLButtonElementPrototypeFunctionClick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLButtonElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLButtonElementFormNoValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementForm(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLButtonElementFormNoValidate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLButtonElementFormNoValidate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLButtonElementValidity(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLButtonElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementValidity(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLButtonElementAccessKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLButtonElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLButtonElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementDisabled(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLButtonElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLButtonElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementAutofocus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLButtonElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLButtonElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLButtonElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLButtonElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLButtonElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLButtonElementValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLButtonElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLButtonElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLButtonElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementWillValidate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLButtonElementValidationMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLButtonElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
index 5c7e058f54..ea916727b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
@@ -22,7 +22,6 @@
 #include "JSHTMLCanvasElement.h"
 
 #include "HTMLCanvasElement.h"
-#include "JSCanvasRenderingContext2D.h"
 #include "KURL.h"
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
@@ -39,9 +38,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLCanvasElement);
 
 static const HashTableValue JSHTMLCanvasElementTableValues[4] =
 {
-    { "width", DontDelete, (intptr_t)jsHTMLCanvasElementWidth, (intptr_t)setJSHTMLCanvasElementWidth },
-    { "height", DontDelete, (intptr_t)jsHTMLCanvasElementHeight, (intptr_t)setJSHTMLCanvasElementHeight },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLCanvasElementConstructor, (intptr_t)0 },
+    { "width", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLCanvasElementWidth), (intptr_t)setJSHTMLCanvasElementWidth },
+    { "height", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLCanvasElementHeight), (intptr_t)setJSHTMLCanvasElementHeight },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLCanvasElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -103,8 +102,8 @@ bool JSHTMLCanvasElementConstructor::getOwnPropertyDescriptor(ExecState* exec, c
 
 static const HashTableValue JSHTMLCanvasElementPrototypeTableValues[3] =
 {
-    { "toDataURL", DontDelete|Function, (intptr_t)jsHTMLCanvasElementPrototypeFunctionToDataURL, (intptr_t)1 },
-    { "getContext", DontDelete|Function, (intptr_t)jsHTMLCanvasElementPrototypeFunctionGetContext, (intptr_t)1 },
+    { "toDataURL", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLCanvasElementPrototypeFunctionToDataURL), (intptr_t)1 },
+    { "getContext", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLCanvasElementPrototypeFunctionGetContext), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -154,25 +153,27 @@ bool JSHTMLCanvasElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSHTMLCanvasElement, Base>(exec, &JSHTMLCanvasElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLCanvasElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLCanvasElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLCanvasElement* castedThis = static_cast<JSHTMLCanvasElement*>(asObject(slot.slotBase()));
+    JSHTMLCanvasElement* castedThis = static_cast<JSHTMLCanvasElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(castedThis->impl());
-    return jsNumber(exec, imp->width());
+    JSValue result = jsNumber(exec, imp->width());
+    return result;
 }
 
-JSValue jsHTMLCanvasElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLCanvasElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLCanvasElement* castedThis = static_cast<JSHTMLCanvasElement*>(asObject(slot.slotBase()));
+    JSHTMLCanvasElement* castedThis = static_cast<JSHTMLCanvasElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(castedThis->impl());
-    return jsNumber(exec, imp->height());
+    JSValue result = jsNumber(exec, imp->height());
+    return result;
 }
 
-JSValue jsHTMLCanvasElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLCanvasElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLCanvasElement* domObject = static_cast<JSHTMLCanvasElement*>(asObject(slot.slotBase()));
+    JSHTMLCanvasElement* domObject = static_cast<JSHTMLCanvasElement*>(asObject(slotBase));
     return JSHTMLCanvasElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLCanvasElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -182,13 +183,15 @@ void JSHTMLCanvasElement::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSHTMLCanvasElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(thisObject)->impl());
+    JSHTMLCanvasElement* castedThisObj = static_cast<JSHTMLCanvasElement*>(thisObject);
+    HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(castedThisObj->impl());
     imp->setWidth(value.toInt32(exec));
 }
 
 void setJSHTMLCanvasElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(thisObject)->impl());
+    JSHTMLCanvasElement* castedThisObj = static_cast<JSHTMLCanvasElement*>(thisObject);
+    HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(castedThisObj->impl());
     imp->setHeight(value.toInt32(exec));
 }
 
@@ -219,12 +222,7 @@ JSValue JSC_HOST_CALL jsHTMLCanvasElementPrototypeFunctionGetContext(ExecState*
     if (!thisValue.inherits(&JSHTMLCanvasElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLCanvasElement* castedThisObj = static_cast<JSHTMLCanvasElement*>(asObject(thisValue));
-    HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(castedThisObj->impl());
-    const UString& contextId = args.at(0).toString(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getContext(contextId)));
-    return result;
+    return castedThisObj->getContext(exec, args);
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
index 012b6dfb2b..827197dff9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
@@ -40,12 +40,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+
+    // Custom functions
+    JSC::JSValue getContext(JSC::ExecState*, const JSC::ArgList&);
 protected:
     static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +64,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLCanvasElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -74,11 +77,11 @@ JSC::JSValue JSC_HOST_CALL jsHTMLCanvasElementPrototypeFunctionToDataURL(JSC::Ex
 JSC::JSValue JSC_HOST_CALL jsHTMLCanvasElementPrototypeFunctionGetContext(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLCanvasElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLCanvasElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLCanvasElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLCanvasElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLCanvasElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLCanvasElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLCanvasElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLCanvasElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
index 213b3c5868..c00ee33b84 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
@@ -40,8 +40,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLCollection);
 
 static const HashTableValue JSHTMLCollectionTableValues[3] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsHTMLCollectionLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLCollectionConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLCollectionLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLCollectionConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -103,8 +103,8 @@ bool JSHTMLCollectionConstructor::getOwnPropertyDescriptor(ExecState* exec, cons
 
 static const HashTableValue JSHTMLCollectionPrototypeTableValues[3] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsHTMLCollectionPrototypeFunctionItem, (intptr_t)1 },
-    { "namedItem", DontDelete|Function, (intptr_t)jsHTMLCollectionPrototypeFunctionNamedItem, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLCollectionPrototypeFunctionItem), (intptr_t)1 },
+    { "namedItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLCollectionPrototypeFunctionNamedItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -213,24 +213,25 @@ bool JSHTMLCollection::getOwnPropertySlot(ExecState* exec, unsigned propertyName
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsHTMLCollectionLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLCollectionLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLCollection* castedThis = static_cast<JSHTMLCollection*>(asObject(slot.slotBase()));
+    JSHTMLCollection* castedThis = static_cast<JSHTMLCollection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLCollection* imp = static_cast<HTMLCollection*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsHTMLCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLCollectionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLCollection* domObject = static_cast<JSHTMLCollection*>(asObject(slot.slotBase()));
+    JSHTMLCollection* domObject = static_cast<JSHTMLCollection*>(asObject(slotBase));
     return JSHTMLCollection::getConstructor(exec, domObject->globalObject());
 }
-void JSHTMLCollection::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSHTMLCollection::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<HTMLCollection*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSHTMLCollection::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -257,10 +258,10 @@ JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionNamedItem(ExecState* exec
 }
 
 
-JSValue JSHTMLCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSHTMLCollection::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSHTMLCollection* thisObj = static_cast<JSHTMLCollection*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<HTMLCollection*>(thisObj->impl())->item(slot.index()));
+    JSHTMLCollection* thisObj = static_cast<JSHTMLCollection*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<HTMLCollection*>(thisObj->impl())->item(index));
 }
 HTMLCollection* toHTMLCollection(JSC::JSValue value)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
index e14a2c2109..93bb1feab3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
@@ -21,7 +21,6 @@
 #ifndef JSHTMLCollection_h
 #define JSHTMLCollection_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/CallData.h>
 #include <runtime/JSGlobalObject.h>
@@ -45,12 +44,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom functions
@@ -62,10 +61,10 @@ private:
     RefPtr<HTMLCollection> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLCollection*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, HTMLCollection*);
@@ -81,7 +80,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLCollectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -94,8 +93,8 @@ JSC::JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionItem(JSC::ExecState*
 JSC::JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLCollectionLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLCollectionLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLCollectionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
index bd1f70366b..a98059cb97 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
@@ -34,8 +34,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLDListElement);
 
 static const HashTableValue JSHTMLDListElementTableValues[3] =
 {
-    { "compact", DontDelete, (intptr_t)jsHTMLDListElementCompact, (intptr_t)setJSHTMLDListElementCompact },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLDListElementConstructor, (intptr_t)0 },
+    { "compact", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDListElementCompact), (intptr_t)setJSHTMLDListElementCompact },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDListElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -74,7 +74,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -136,17 +136,18 @@ bool JSHTMLDListElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSHTMLDListElement, Base>(exec, &JSHTMLDListElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLDListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDListElementCompact(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDListElement* castedThis = static_cast<JSHTMLDListElement*>(asObject(slot.slotBase()));
+    JSHTMLDListElement* castedThis = static_cast<JSHTMLDListElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDListElement* imp = static_cast<HTMLDListElement*>(castedThis->impl());
-    return jsBoolean(imp->compact());
+    JSValue result = jsBoolean(imp->compact());
+    return result;
 }
 
-JSValue jsHTMLDListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDListElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDListElement* domObject = static_cast<JSHTMLDListElement*>(asObject(slot.slotBase()));
+    JSHTMLDListElement* domObject = static_cast<JSHTMLDListElement*>(asObject(slotBase));
     return JSHTMLDListElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLDListElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -156,7 +157,8 @@ void JSHTMLDListElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSHTMLDListElementCompact(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDListElement* imp = static_cast<HTMLDListElement*>(static_cast<JSHTMLDListElement*>(thisObject)->impl());
+    JSHTMLDListElement* castedThisObj = static_cast<JSHTMLDListElement*>(thisObject);
+    HTMLDListElement* imp = static_cast<HTMLDListElement*>(castedThisObj->impl());
     imp->setCompact(value.toBoolean(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
index 4d602c98ee..fc2cf5ec06 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLDListElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,9 +66,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLDListElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDListElementCompact(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDListElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDListElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp
index 089228dffc..9801e7582e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp
@@ -40,12 +40,12 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLDataGridCellElement);
 
 static const HashTableValue JSHTMLDataGridCellElementTableValues[7] =
 {
-    { "label", DontDelete, (intptr_t)jsHTMLDataGridCellElementLabel, (intptr_t)setJSHTMLDataGridCellElementLabel },
-    { "focused", DontDelete, (intptr_t)jsHTMLDataGridCellElementFocused, (intptr_t)setJSHTMLDataGridCellElementFocused },
-    { "checked", DontDelete, (intptr_t)jsHTMLDataGridCellElementChecked, (intptr_t)setJSHTMLDataGridCellElementChecked },
-    { "indeterminate", DontDelete, (intptr_t)jsHTMLDataGridCellElementIndeterminate, (intptr_t)setJSHTMLDataGridCellElementIndeterminate },
-    { "progress", DontDelete, (intptr_t)jsHTMLDataGridCellElementProgress, (intptr_t)setJSHTMLDataGridCellElementProgress },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLDataGridCellElementConstructor, (intptr_t)0 },
+    { "label", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridCellElementLabel), (intptr_t)setJSHTMLDataGridCellElementLabel },
+    { "focused", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridCellElementFocused), (intptr_t)setJSHTMLDataGridCellElementFocused },
+    { "checked", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridCellElementChecked), (intptr_t)setJSHTMLDataGridCellElementChecked },
+    { "indeterminate", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridCellElementIndeterminate), (intptr_t)setJSHTMLDataGridCellElementIndeterminate },
+    { "progress", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridCellElementProgress), (intptr_t)setJSHTMLDataGridCellElementProgress },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridCellElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -84,7 +84,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -146,49 +146,54 @@ bool JSHTMLDataGridCellElement::getOwnPropertyDescriptor(ExecState* exec, const
     return getStaticValueDescriptor<JSHTMLDataGridCellElement, Base>(exec, &JSHTMLDataGridCellElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLDataGridCellElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridCellElementLabel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridCellElement* castedThis = static_cast<JSHTMLDataGridCellElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridCellElement* castedThis = static_cast<JSHTMLDataGridCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(castedThis->impl());
-    return jsString(exec, imp->label());
+    JSValue result = jsString(exec, imp->label());
+    return result;
 }
 
-JSValue jsHTMLDataGridCellElementFocused(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridCellElementFocused(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridCellElement* castedThis = static_cast<JSHTMLDataGridCellElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridCellElement* castedThis = static_cast<JSHTMLDataGridCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(castedThis->impl());
-    return jsBoolean(imp->focused());
+    JSValue result = jsBoolean(imp->focused());
+    return result;
 }
 
-JSValue jsHTMLDataGridCellElementChecked(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridCellElementChecked(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridCellElement* castedThis = static_cast<JSHTMLDataGridCellElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridCellElement* castedThis = static_cast<JSHTMLDataGridCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(castedThis->impl());
-    return jsBoolean(imp->checked());
+    JSValue result = jsBoolean(imp->checked());
+    return result;
 }
 
-JSValue jsHTMLDataGridCellElementIndeterminate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridCellElementIndeterminate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridCellElement* castedThis = static_cast<JSHTMLDataGridCellElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridCellElement* castedThis = static_cast<JSHTMLDataGridCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(castedThis->impl());
-    return jsBoolean(imp->indeterminate());
+    JSValue result = jsBoolean(imp->indeterminate());
+    return result;
 }
 
-JSValue jsHTMLDataGridCellElementProgress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridCellElementProgress(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridCellElement* castedThis = static_cast<JSHTMLDataGridCellElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridCellElement* castedThis = static_cast<JSHTMLDataGridCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(castedThis->impl());
-    return jsNumber(exec, imp->progress());
+    JSValue result = jsNumber(exec, imp->progress());
+    return result;
 }
 
-JSValue jsHTMLDataGridCellElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridCellElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridCellElement* domObject = static_cast<JSHTMLDataGridCellElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridCellElement* domObject = static_cast<JSHTMLDataGridCellElement*>(asObject(slotBase));
     return JSHTMLDataGridCellElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLDataGridCellElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -198,31 +203,36 @@ void JSHTMLDataGridCellElement::put(ExecState* exec, const Identifier& propertyN
 
 void setJSHTMLDataGridCellElementLabel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(static_cast<JSHTMLDataGridCellElement*>(thisObject)->impl());
+    JSHTMLDataGridCellElement* castedThisObj = static_cast<JSHTMLDataGridCellElement*>(thisObject);
+    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(castedThisObj->impl());
     imp->setLabel(value.toString(exec));
 }
 
 void setJSHTMLDataGridCellElementFocused(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(static_cast<JSHTMLDataGridCellElement*>(thisObject)->impl());
+    JSHTMLDataGridCellElement* castedThisObj = static_cast<JSHTMLDataGridCellElement*>(thisObject);
+    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(castedThisObj->impl());
     imp->setFocused(value.toBoolean(exec));
 }
 
 void setJSHTMLDataGridCellElementChecked(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(static_cast<JSHTMLDataGridCellElement*>(thisObject)->impl());
+    JSHTMLDataGridCellElement* castedThisObj = static_cast<JSHTMLDataGridCellElement*>(thisObject);
+    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(castedThisObj->impl());
     imp->setChecked(value.toBoolean(exec));
 }
 
 void setJSHTMLDataGridCellElementIndeterminate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(static_cast<JSHTMLDataGridCellElement*>(thisObject)->impl());
+    JSHTMLDataGridCellElement* castedThisObj = static_cast<JSHTMLDataGridCellElement*>(thisObject);
+    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(castedThisObj->impl());
     imp->setIndeterminate(value.toBoolean(exec));
 }
 
 void setJSHTMLDataGridCellElementProgress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(static_cast<JSHTMLDataGridCellElement*>(thisObject)->impl());
+    JSHTMLDataGridCellElement* castedThisObj = static_cast<JSHTMLDataGridCellElement*>(thisObject);
+    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(castedThisObj->impl());
     imp->setProgress(value.toFloat(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h
index 5bdeff2a86..8f8b013bdf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -59,7 +59,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLDataGridCellElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,17 +68,17 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLDataGridCellElementLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridCellElementLabel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridCellElementLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridCellElementFocused(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridCellElementFocused(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridCellElementFocused(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridCellElementChecked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridCellElementChecked(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridCellElementChecked(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridCellElementIndeterminate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridCellElementIndeterminate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridCellElementIndeterminate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridCellElementProgress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridCellElementProgress(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridCellElementProgress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridCellElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridCellElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
index 9a85c51f83..04b2a14284 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
@@ -40,12 +40,12 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLDataGridColElement);
 
 static const HashTableValue JSHTMLDataGridColElementTableValues[7] =
 {
-    { "label", DontDelete, (intptr_t)jsHTMLDataGridColElementLabel, (intptr_t)setJSHTMLDataGridColElementLabel },
-    { "type", DontDelete, (intptr_t)jsHTMLDataGridColElementType, (intptr_t)setJSHTMLDataGridColElementType },
-    { "sortable", DontDelete, (intptr_t)jsHTMLDataGridColElementSortable, (intptr_t)setJSHTMLDataGridColElementSortable },
-    { "sortDirection", DontDelete, (intptr_t)jsHTMLDataGridColElementSortDirection, (intptr_t)setJSHTMLDataGridColElementSortDirection },
-    { "primary", DontDelete, (intptr_t)jsHTMLDataGridColElementPrimary, (intptr_t)setJSHTMLDataGridColElementPrimary },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLDataGridColElementConstructor, (intptr_t)0 },
+    { "label", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridColElementLabel), (intptr_t)setJSHTMLDataGridColElementLabel },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridColElementType), (intptr_t)setJSHTMLDataGridColElementType },
+    { "sortable", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridColElementSortable), (intptr_t)setJSHTMLDataGridColElementSortable },
+    { "sortDirection", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridColElementSortDirection), (intptr_t)setJSHTMLDataGridColElementSortDirection },
+    { "primary", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridColElementPrimary), (intptr_t)setJSHTMLDataGridColElementPrimary },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridColElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -84,7 +84,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -146,49 +146,54 @@ bool JSHTMLDataGridColElement::getOwnPropertyDescriptor(ExecState* exec, const I
     return getStaticValueDescriptor<JSHTMLDataGridColElement, Base>(exec, &JSHTMLDataGridColElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLDataGridColElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridColElementLabel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridColElement* castedThis = static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridColElement* castedThis = static_cast<JSHTMLDataGridColElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(castedThis->impl());
-    return jsString(exec, imp->label());
+    JSValue result = jsString(exec, imp->label());
+    return result;
 }
 
-JSValue jsHTMLDataGridColElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridColElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridColElement* castedThis = static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridColElement* castedThis = static_cast<JSHTMLDataGridColElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsHTMLDataGridColElementSortable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridColElementSortable(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridColElement* castedThis = static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridColElement* castedThis = static_cast<JSHTMLDataGridColElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(castedThis->impl());
-    return jsNumber(exec, imp->sortable());
+    JSValue result = jsNumber(exec, imp->sortable());
+    return result;
 }
 
-JSValue jsHTMLDataGridColElementSortDirection(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridColElementSortDirection(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridColElement* castedThis = static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridColElement* castedThis = static_cast<JSHTMLDataGridColElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(castedThis->impl());
-    return jsNumber(exec, imp->sortDirection());
+    JSValue result = jsNumber(exec, imp->sortDirection());
+    return result;
 }
 
-JSValue jsHTMLDataGridColElementPrimary(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridColElementPrimary(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridColElement* castedThis = static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridColElement* castedThis = static_cast<JSHTMLDataGridColElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(castedThis->impl());
-    return jsBoolean(imp->primary());
+    JSValue result = jsBoolean(imp->primary());
+    return result;
 }
 
-JSValue jsHTMLDataGridColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridColElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridColElement* domObject = static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridColElement* domObject = static_cast<JSHTMLDataGridColElement*>(asObject(slotBase));
     return JSHTMLDataGridColElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLDataGridColElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -198,31 +203,36 @@ void JSHTMLDataGridColElement::put(ExecState* exec, const Identifier& propertyNa
 
 void setJSHTMLDataGridColElementLabel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(thisObject)->impl());
+    JSHTMLDataGridColElement* castedThisObj = static_cast<JSHTMLDataGridColElement*>(thisObject);
+    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(castedThisObj->impl());
     imp->setLabel(value.toString(exec));
 }
 
 void setJSHTMLDataGridColElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(thisObject)->impl());
+    JSHTMLDataGridColElement* castedThisObj = static_cast<JSHTMLDataGridColElement*>(thisObject);
+    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(castedThisObj->impl());
     imp->setType(value.toString(exec));
 }
 
 void setJSHTMLDataGridColElementSortable(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(thisObject)->impl());
+    JSHTMLDataGridColElement* castedThisObj = static_cast<JSHTMLDataGridColElement*>(thisObject);
+    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(castedThisObj->impl());
     imp->setSortable(value.toInt32(exec));
 }
 
 void setJSHTMLDataGridColElementSortDirection(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(thisObject)->impl());
+    JSHTMLDataGridColElement* castedThisObj = static_cast<JSHTMLDataGridColElement*>(thisObject);
+    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(castedThisObj->impl());
     imp->setSortDirection(value.toInt32(exec));
 }
 
 void setJSHTMLDataGridColElementPrimary(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(thisObject)->impl());
+    JSHTMLDataGridColElement* castedThisObj = static_cast<JSHTMLDataGridColElement*>(thisObject);
+    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(castedThisObj->impl());
     imp->setPrimary(value.toBoolean(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h
index 473a1fc8da..4290a14320 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -59,7 +59,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLDataGridColElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,17 +68,17 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLDataGridColElementLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridColElementLabel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridColElementLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridColElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridColElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridColElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridColElementSortable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridColElementSortable(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridColElementSortable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridColElementSortDirection(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridColElementSortDirection(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridColElementSortDirection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridColElementPrimary(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridColElementPrimary(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridColElementPrimary(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridColElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
index 217df53238..4e4076909b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
@@ -39,12 +39,12 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLDataGridElement);
 
 static const HashTableValue JSHTMLDataGridElementTableValues[7] =
 {
-    { "dataSource", DontDelete, (intptr_t)jsHTMLDataGridElementDataSource, (intptr_t)setJSHTMLDataGridElementDataSource },
-    { "columns", DontDelete|ReadOnly, (intptr_t)jsHTMLDataGridElementColumns, (intptr_t)0 },
-    { "autofocus", DontDelete, (intptr_t)jsHTMLDataGridElementAutofocus, (intptr_t)setJSHTMLDataGridElementAutofocus },
-    { "disabled", DontDelete, (intptr_t)jsHTMLDataGridElementDisabled, (intptr_t)setJSHTMLDataGridElementDisabled },
-    { "multiple", DontDelete, (intptr_t)jsHTMLDataGridElementMultiple, (intptr_t)setJSHTMLDataGridElementMultiple },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLDataGridElementConstructor, (intptr_t)0 },
+    { "dataSource", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridElementDataSource), (intptr_t)setJSHTMLDataGridElementDataSource },
+    { "columns", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridElementColumns), (intptr_t)0 },
+    { "autofocus", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridElementAutofocus), (intptr_t)setJSHTMLDataGridElementAutofocus },
+    { "disabled", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridElementDisabled), (intptr_t)setJSHTMLDataGridElementDisabled },
+    { "multiple", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridElementMultiple), (intptr_t)setJSHTMLDataGridElementMultiple },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -83,7 +83,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -145,47 +145,51 @@ bool JSHTMLDataGridElement::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSHTMLDataGridElement, Base>(exec, &JSHTMLDataGridElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLDataGridElementDataSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridElementDataSource(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridElement* castedThis = static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridElement* castedThis = static_cast<JSHTMLDataGridElement*>(asObject(slotBase));
     return castedThis->dataSource(exec);
 }
 
-JSValue jsHTMLDataGridElementColumns(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridElementColumns(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridElement* castedThis = static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridElement* castedThis = static_cast<JSHTMLDataGridElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->columns()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->columns()));
+    return result;
 }
 
-JSValue jsHTMLDataGridElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridElementAutofocus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridElement* castedThis = static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridElement* castedThis = static_cast<JSHTMLDataGridElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(castedThis->impl());
-    return jsBoolean(imp->autofocus());
+    JSValue result = jsBoolean(imp->autofocus());
+    return result;
 }
 
-JSValue jsHTMLDataGridElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridElementDisabled(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridElement* castedThis = static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridElement* castedThis = static_cast<JSHTMLDataGridElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(castedThis->impl());
-    return jsBoolean(imp->disabled());
+    JSValue result = jsBoolean(imp->disabled());
+    return result;
 }
 
-JSValue jsHTMLDataGridElementMultiple(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridElementMultiple(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridElement* castedThis = static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridElement* castedThis = static_cast<JSHTMLDataGridElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(castedThis->impl());
-    return jsBoolean(imp->multiple());
+    JSValue result = jsBoolean(imp->multiple());
+    return result;
 }
 
-JSValue jsHTMLDataGridElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridElement* domObject = static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridElement* domObject = static_cast<JSHTMLDataGridElement*>(asObject(slotBase));
     return JSHTMLDataGridElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLDataGridElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -200,19 +204,22 @@ void setJSHTMLDataGridElementDataSource(ExecState* exec, JSObject* thisObject, J
 
 void setJSHTMLDataGridElementAutofocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(static_cast<JSHTMLDataGridElement*>(thisObject)->impl());
+    JSHTMLDataGridElement* castedThisObj = static_cast<JSHTMLDataGridElement*>(thisObject);
+    HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(castedThisObj->impl());
     imp->setAutofocus(value.toBoolean(exec));
 }
 
 void setJSHTMLDataGridElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(static_cast<JSHTMLDataGridElement*>(thisObject)->impl());
+    JSHTMLDataGridElement* castedThisObj = static_cast<JSHTMLDataGridElement*>(thisObject);
+    HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(castedThisObj->impl());
     imp->setDisabled(value.toBoolean(exec));
 }
 
 void setJSHTMLDataGridElementMultiple(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(static_cast<JSHTMLDataGridElement*>(thisObject)->impl());
+    JSHTMLDataGridElement* castedThisObj = static_cast<JSHTMLDataGridElement*>(thisObject);
+    HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(castedThisObj->impl());
     imp->setMultiple(value.toBoolean(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
index eedca14cc0..775c893282 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -63,7 +63,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLDataGridElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,16 +72,16 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLDataGridElementDataSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridElementDataSource(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridElementDataSource(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridElementColumns(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLDataGridElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridElementColumns(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLDataGridElementAutofocus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridElementDisabled(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridElementMultiple(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridElementMultiple(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridElementMultiple(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp
index c9ca32614a..0123394da7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp
@@ -37,10 +37,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLDataGridRowElement);
 
 static const HashTableValue JSHTMLDataGridRowElementTableValues[5] =
 {
-    { "selected", DontDelete, (intptr_t)jsHTMLDataGridRowElementSelected, (intptr_t)setJSHTMLDataGridRowElementSelected },
-    { "focused", DontDelete, (intptr_t)jsHTMLDataGridRowElementFocused, (intptr_t)setJSHTMLDataGridRowElementFocused },
-    { "expanded", DontDelete, (intptr_t)jsHTMLDataGridRowElementExpanded, (intptr_t)setJSHTMLDataGridRowElementExpanded },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLDataGridRowElementConstructor, (intptr_t)0 },
+    { "selected", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridRowElementSelected), (intptr_t)setJSHTMLDataGridRowElementSelected },
+    { "focused", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridRowElementFocused), (intptr_t)setJSHTMLDataGridRowElementFocused },
+    { "expanded", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridRowElementExpanded), (intptr_t)setJSHTMLDataGridRowElementExpanded },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataGridRowElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -141,33 +141,36 @@ bool JSHTMLDataGridRowElement::getOwnPropertyDescriptor(ExecState* exec, const I
     return getStaticValueDescriptor<JSHTMLDataGridRowElement, Base>(exec, &JSHTMLDataGridRowElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLDataGridRowElementSelected(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridRowElementSelected(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridRowElement* castedThis = static_cast<JSHTMLDataGridRowElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridRowElement* castedThis = static_cast<JSHTMLDataGridRowElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridRowElement* imp = static_cast<HTMLDataGridRowElement*>(castedThis->impl());
-    return jsBoolean(imp->selected());
+    JSValue result = jsBoolean(imp->selected());
+    return result;
 }
 
-JSValue jsHTMLDataGridRowElementFocused(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridRowElementFocused(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridRowElement* castedThis = static_cast<JSHTMLDataGridRowElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridRowElement* castedThis = static_cast<JSHTMLDataGridRowElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridRowElement* imp = static_cast<HTMLDataGridRowElement*>(castedThis->impl());
-    return jsBoolean(imp->focused());
+    JSValue result = jsBoolean(imp->focused());
+    return result;
 }
 
-JSValue jsHTMLDataGridRowElementExpanded(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridRowElementExpanded(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridRowElement* castedThis = static_cast<JSHTMLDataGridRowElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridRowElement* castedThis = static_cast<JSHTMLDataGridRowElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataGridRowElement* imp = static_cast<HTMLDataGridRowElement*>(castedThis->impl());
-    return jsBoolean(imp->expanded());
+    JSValue result = jsBoolean(imp->expanded());
+    return result;
 }
 
-JSValue jsHTMLDataGridRowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataGridRowElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataGridRowElement* domObject = static_cast<JSHTMLDataGridRowElement*>(asObject(slot.slotBase()));
+    JSHTMLDataGridRowElement* domObject = static_cast<JSHTMLDataGridRowElement*>(asObject(slotBase));
     return JSHTMLDataGridRowElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLDataGridRowElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -177,19 +180,22 @@ void JSHTMLDataGridRowElement::put(ExecState* exec, const Identifier& propertyNa
 
 void setJSHTMLDataGridRowElementSelected(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridRowElement* imp = static_cast<HTMLDataGridRowElement*>(static_cast<JSHTMLDataGridRowElement*>(thisObject)->impl());
+    JSHTMLDataGridRowElement* castedThisObj = static_cast<JSHTMLDataGridRowElement*>(thisObject);
+    HTMLDataGridRowElement* imp = static_cast<HTMLDataGridRowElement*>(castedThisObj->impl());
     imp->setSelected(value.toBoolean(exec));
 }
 
 void setJSHTMLDataGridRowElementFocused(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridRowElement* imp = static_cast<HTMLDataGridRowElement*>(static_cast<JSHTMLDataGridRowElement*>(thisObject)->impl());
+    JSHTMLDataGridRowElement* castedThisObj = static_cast<JSHTMLDataGridRowElement*>(thisObject);
+    HTMLDataGridRowElement* imp = static_cast<HTMLDataGridRowElement*>(castedThisObj->impl());
     imp->setFocused(value.toBoolean(exec));
 }
 
 void setJSHTMLDataGridRowElementExpanded(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDataGridRowElement* imp = static_cast<HTMLDataGridRowElement*>(static_cast<JSHTMLDataGridRowElement*>(thisObject)->impl());
+    JSHTMLDataGridRowElement* castedThisObj = static_cast<JSHTMLDataGridRowElement*>(thisObject);
+    HTMLDataGridRowElement* imp = static_cast<HTMLDataGridRowElement*>(castedThisObj->impl());
     imp->setExpanded(value.toBoolean(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h
index 23163184b9..e7322c5fa5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -59,7 +59,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLDataGridRowElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,13 +68,13 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLDataGridRowElementSelected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridRowElementSelected(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridRowElementSelected(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridRowElementFocused(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridRowElementFocused(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridRowElementFocused(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridRowElementExpanded(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridRowElementExpanded(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDataGridRowElementExpanded(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDataGridRowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridRowElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.cpp
index 4f88a2bdf6..3b9f91b5c3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.cpp
@@ -39,8 +39,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLDataListElement);
 
 static const HashTableValue JSHTMLDataListElementTableValues[3] =
 {
-    { "options", DontDelete|ReadOnly, (intptr_t)jsHTMLDataListElementOptions, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLDataListElementConstructor, (intptr_t)0 },
+    { "options", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataListElementOptions), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDataListElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -141,17 +141,18 @@ bool JSHTMLDataListElement::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSHTMLDataListElement, Base>(exec, &JSHTMLDataListElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLDataListElementOptions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataListElementOptions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataListElement* castedThis = static_cast<JSHTMLDataListElement*>(asObject(slot.slotBase()));
+    JSHTMLDataListElement* castedThis = static_cast<JSHTMLDataListElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDataListElement* imp = static_cast<HTMLDataListElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->options()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->options()));
+    return result;
 }
 
-JSValue jsHTMLDataListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDataListElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDataListElement* domObject = static_cast<JSHTMLDataListElement*>(asObject(slot.slotBase()));
+    JSHTMLDataListElement* domObject = static_cast<JSHTMLDataListElement*>(asObject(slotBase));
     return JSHTMLDataListElement::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSHTMLDataListElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.h
index 79c6274a80..0ab9d84a75 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLDataListElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -67,8 +67,8 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLDataListElementOptions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLDataListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataListElementOptions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLDataListElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
index 6c1a334d98..c2fa8db7db 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
@@ -34,8 +34,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLDirectoryElement);
 
 static const HashTableValue JSHTMLDirectoryElementTableValues[3] =
 {
-    { "compact", DontDelete, (intptr_t)jsHTMLDirectoryElementCompact, (intptr_t)setJSHTMLDirectoryElementCompact },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLDirectoryElementConstructor, (intptr_t)0 },
+    { "compact", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDirectoryElementCompact), (intptr_t)setJSHTMLDirectoryElementCompact },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDirectoryElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -74,7 +74,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -136,17 +136,18 @@ bool JSHTMLDirectoryElement::getOwnPropertyDescriptor(ExecState* exec, const Ide
     return getStaticValueDescriptor<JSHTMLDirectoryElement, Base>(exec, &JSHTMLDirectoryElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLDirectoryElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDirectoryElementCompact(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDirectoryElement* castedThis = static_cast<JSHTMLDirectoryElement*>(asObject(slot.slotBase()));
+    JSHTMLDirectoryElement* castedThis = static_cast<JSHTMLDirectoryElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDirectoryElement* imp = static_cast<HTMLDirectoryElement*>(castedThis->impl());
-    return jsBoolean(imp->compact());
+    JSValue result = jsBoolean(imp->compact());
+    return result;
 }
 
-JSValue jsHTMLDirectoryElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDirectoryElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDirectoryElement* domObject = static_cast<JSHTMLDirectoryElement*>(asObject(slot.slotBase()));
+    JSHTMLDirectoryElement* domObject = static_cast<JSHTMLDirectoryElement*>(asObject(slotBase));
     return JSHTMLDirectoryElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLDirectoryElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -156,7 +157,8 @@ void JSHTMLDirectoryElement::put(ExecState* exec, const Identifier& propertyName
 
 void setJSHTMLDirectoryElementCompact(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDirectoryElement* imp = static_cast<HTMLDirectoryElement*>(static_cast<JSHTMLDirectoryElement*>(thisObject)->impl());
+    JSHTMLDirectoryElement* castedThisObj = static_cast<JSHTMLDirectoryElement*>(thisObject);
+    HTMLDirectoryElement* imp = static_cast<HTMLDirectoryElement*>(castedThisObj->impl());
     imp->setCompact(value.toBoolean(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
index 71661a36f4..7a805bcb9d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLDirectoryElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,9 +66,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLDirectoryElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDirectoryElementCompact(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDirectoryElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDirectoryElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDirectoryElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
index 78da25f695..eaaf3ec7c9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
@@ -36,8 +36,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLDivElement);
 
 static const HashTableValue JSHTMLDivElementTableValues[3] =
 {
-    { "align", DontDelete, (intptr_t)jsHTMLDivElementAlign, (intptr_t)setJSHTMLDivElementAlign },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLDivElementConstructor, (intptr_t)0 },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDivElementAlign), (intptr_t)setJSHTMLDivElementAlign },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDivElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,7 +76,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -138,17 +138,18 @@ bool JSHTMLDivElement::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSHTMLDivElement, Base>(exec, &JSHTMLDivElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLDivElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDivElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDivElement* castedThis = static_cast<JSHTMLDivElement*>(asObject(slot.slotBase()));
+    JSHTMLDivElement* castedThis = static_cast<JSHTMLDivElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDivElement* imp = static_cast<HTMLDivElement*>(castedThis->impl());
-    return jsString(exec, imp->align());
+    JSValue result = jsString(exec, imp->align());
+    return result;
 }
 
-JSValue jsHTMLDivElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDivElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDivElement* domObject = static_cast<JSHTMLDivElement*>(asObject(slot.slotBase()));
+    JSHTMLDivElement* domObject = static_cast<JSHTMLDivElement*>(asObject(slotBase));
     return JSHTMLDivElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLDivElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -158,7 +159,8 @@ void JSHTMLDivElement::put(ExecState* exec, const Identifier& propertyName, JSVa
 
 void setJSHTMLDivElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDivElement* imp = static_cast<HTMLDivElement*>(static_cast<JSHTMLDivElement*>(thisObject)->impl());
+    JSHTMLDivElement* castedThisObj = static_cast<JSHTMLDivElement*>(thisObject);
+    HTMLDivElement* imp = static_cast<HTMLDivElement*>(castedThisObj->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
index 7806e45f00..38547b8f43 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLDivElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,9 +66,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLDivElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDivElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDivElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDivElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDivElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
index e45c9ec6e2..9f62dc2967 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
@@ -43,22 +43,22 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLDocument);
 
 static const HashTableValue JSHTMLDocumentTableValues[17] =
 {
-    { "embeds", DontDelete|ReadOnly, (intptr_t)jsHTMLDocumentEmbeds, (intptr_t)0 },
-    { "plugins", DontDelete|ReadOnly, (intptr_t)jsHTMLDocumentPlugins, (intptr_t)0 },
-    { "scripts", DontDelete|ReadOnly, (intptr_t)jsHTMLDocumentScripts, (intptr_t)0 },
-    { "all", 0, (intptr_t)jsHTMLDocumentAll, (intptr_t)setJSHTMLDocumentAll },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsHTMLDocumentWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsHTMLDocumentHeight, (intptr_t)0 },
-    { "dir", DontDelete, (intptr_t)jsHTMLDocumentDir, (intptr_t)setJSHTMLDocumentDir },
-    { "designMode", DontDelete, (intptr_t)jsHTMLDocumentDesignMode, (intptr_t)setJSHTMLDocumentDesignMode },
-    { "compatMode", DontDelete|ReadOnly, (intptr_t)jsHTMLDocumentCompatMode, (intptr_t)0 },
-    { "activeElement", DontDelete|ReadOnly, (intptr_t)jsHTMLDocumentActiveElement, (intptr_t)0 },
-    { "bgColor", DontDelete, (intptr_t)jsHTMLDocumentBgColor, (intptr_t)setJSHTMLDocumentBgColor },
-    { "fgColor", DontDelete, (intptr_t)jsHTMLDocumentFgColor, (intptr_t)setJSHTMLDocumentFgColor },
-    { "alinkColor", DontDelete, (intptr_t)jsHTMLDocumentAlinkColor, (intptr_t)setJSHTMLDocumentAlinkColor },
-    { "linkColor", DontDelete, (intptr_t)jsHTMLDocumentLinkColor, (intptr_t)setJSHTMLDocumentLinkColor },
-    { "vlinkColor", DontDelete, (intptr_t)jsHTMLDocumentVlinkColor, (intptr_t)setJSHTMLDocumentVlinkColor },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLDocumentConstructor, (intptr_t)0 },
+    { "embeds", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentEmbeds), (intptr_t)0 },
+    { "plugins", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentPlugins), (intptr_t)0 },
+    { "scripts", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentScripts), (intptr_t)0 },
+    { "all", 0, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentAll), (intptr_t)setJSHTMLDocumentAll },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentHeight), (intptr_t)0 },
+    { "dir", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentDir), (intptr_t)setJSHTMLDocumentDir },
+    { "designMode", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentDesignMode), (intptr_t)setJSHTMLDocumentDesignMode },
+    { "compatMode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentCompatMode), (intptr_t)0 },
+    { "activeElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentActiveElement), (intptr_t)0 },
+    { "bgColor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentBgColor), (intptr_t)setJSHTMLDocumentBgColor },
+    { "fgColor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentFgColor), (intptr_t)setJSHTMLDocumentFgColor },
+    { "alinkColor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentAlinkColor), (intptr_t)setJSHTMLDocumentAlinkColor },
+    { "linkColor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentLinkColor), (intptr_t)setJSHTMLDocumentLinkColor },
+    { "vlinkColor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentVlinkColor), (intptr_t)setJSHTMLDocumentVlinkColor },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLDocumentConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -97,7 +97,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -120,14 +120,14 @@ bool JSHTMLDocumentConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSHTMLDocumentPrototypeTableValues[9] =
 {
-    { "open", DontDelete|Function, (intptr_t)jsHTMLDocumentPrototypeFunctionOpen, (intptr_t)0 },
-    { "close", DontDelete|Function, (intptr_t)jsHTMLDocumentPrototypeFunctionClose, (intptr_t)0 },
-    { "write", DontDelete|Function, (intptr_t)jsHTMLDocumentPrototypeFunctionWrite, (intptr_t)1 },
-    { "writeln", DontDelete|Function, (intptr_t)jsHTMLDocumentPrototypeFunctionWriteln, (intptr_t)1 },
-    { "clear", DontDelete|Function, (intptr_t)jsHTMLDocumentPrototypeFunctionClear, (intptr_t)0 },
-    { "captureEvents", DontDelete|Function, (intptr_t)jsHTMLDocumentPrototypeFunctionCaptureEvents, (intptr_t)0 },
-    { "releaseEvents", DontDelete|Function, (intptr_t)jsHTMLDocumentPrototypeFunctionReleaseEvents, (intptr_t)0 },
-    { "hasFocus", DontDelete|Function, (intptr_t)jsHTMLDocumentPrototypeFunctionHasFocus, (intptr_t)0 },
+    { "open", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLDocumentPrototypeFunctionOpen), (intptr_t)0 },
+    { "close", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLDocumentPrototypeFunctionClose), (intptr_t)0 },
+    { "write", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLDocumentPrototypeFunctionWrite), (intptr_t)1 },
+    { "writeln", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLDocumentPrototypeFunctionWriteln), (intptr_t)1 },
+    { "clear", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLDocumentPrototypeFunctionClear), (intptr_t)0 },
+    { "captureEvents", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLDocumentPrototypeFunctionCaptureEvents), (intptr_t)0 },
+    { "releaseEvents", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLDocumentPrototypeFunctionReleaseEvents), (intptr_t)0 },
+    { "hasFocus", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLDocumentPrototypeFunctionHasFocus), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -187,127 +187,141 @@ bool JSHTMLDocument::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSHTMLDocument, Base>(exec, &JSHTMLDocumentTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLDocumentEmbeds(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentEmbeds(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->embeds()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->embeds()));
+    return result;
 }
 
-JSValue jsHTMLDocumentPlugins(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentPlugins(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->plugins()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->plugins()));
+    return result;
 }
 
-JSValue jsHTMLDocumentScripts(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentScripts(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->scripts()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->scripts()));
+    return result;
 }
 
-JSValue jsHTMLDocumentAll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentAll(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slotBase));
     return castedThis->all(exec);
 }
 
-JSValue jsHTMLDocumentWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThis->impl());
-    return jsNumber(exec, imp->width());
+    JSValue result = jsNumber(exec, imp->width());
+    return result;
 }
 
-JSValue jsHTMLDocumentHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThis->impl());
-    return jsNumber(exec, imp->height());
+    JSValue result = jsNumber(exec, imp->height());
+    return result;
 }
 
-JSValue jsHTMLDocumentDir(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentDir(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThis->impl());
-    return jsString(exec, imp->dir());
+    JSValue result = jsString(exec, imp->dir());
+    return result;
 }
 
-JSValue jsHTMLDocumentDesignMode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentDesignMode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThis->impl());
-    return jsString(exec, imp->designMode());
+    JSValue result = jsString(exec, imp->designMode());
+    return result;
 }
 
-JSValue jsHTMLDocumentCompatMode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentCompatMode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThis->impl());
-    return jsString(exec, imp->compatMode());
+    JSValue result = jsString(exec, imp->compatMode());
+    return result;
 }
 
-JSValue jsHTMLDocumentActiveElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentActiveElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->activeElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->activeElement()));
+    return result;
 }
 
-JSValue jsHTMLDocumentBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentBgColor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThis->impl());
-    return jsString(exec, imp->bgColor());
+    JSValue result = jsString(exec, imp->bgColor());
+    return result;
 }
 
-JSValue jsHTMLDocumentFgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentFgColor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThis->impl());
-    return jsString(exec, imp->fgColor());
+    JSValue result = jsString(exec, imp->fgColor());
+    return result;
 }
 
-JSValue jsHTMLDocumentAlinkColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentAlinkColor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThis->impl());
-    return jsString(exec, imp->alinkColor());
+    JSValue result = jsString(exec, imp->alinkColor());
+    return result;
 }
 
-JSValue jsHTMLDocumentLinkColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentLinkColor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThis->impl());
-    return jsString(exec, imp->linkColor());
+    JSValue result = jsString(exec, imp->linkColor());
+    return result;
 }
 
-JSValue jsHTMLDocumentVlinkColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentVlinkColor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThis->impl());
-    return jsString(exec, imp->vlinkColor());
+    JSValue result = jsString(exec, imp->vlinkColor());
+    return result;
 }
 
-JSValue jsHTMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLDocument* domObject = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* domObject = static_cast<JSHTMLDocument*>(asObject(slotBase));
     return JSHTMLDocument::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLDocument::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -322,43 +336,50 @@ void setJSHTMLDocumentAll(ExecState* exec, JSObject* thisObject, JSValue value)
 
 void setJSHTMLDocumentDir(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
+    JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(thisObject);
+    HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
     imp->setDir(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLDocumentDesignMode(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
+    JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(thisObject);
+    HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
     imp->setDesignMode(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLDocumentBgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
+    JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(thisObject);
+    HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
     imp->setBgColor(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLDocumentFgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
+    JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(thisObject);
+    HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
     imp->setFgColor(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLDocumentAlinkColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
+    JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(thisObject);
+    HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
     imp->setAlinkColor(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLDocumentLinkColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
+    JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(thisObject);
+    HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
     imp->setLinkColor(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLDocumentVlinkColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
+    JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(thisObject);
+    HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
     imp->setVlinkColor(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
index feb5b8856d..b71f37ae93 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLDocument*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 
@@ -71,7 +71,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLDocumentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -90,30 +90,30 @@ JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionReleaseEvents(JSC::Exe
 JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionHasFocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLDocumentEmbeds(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLDocumentPlugins(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLDocumentScripts(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLDocumentAll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentEmbeds(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLDocumentPlugins(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLDocumentScripts(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLDocumentAll(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDocumentAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDocumentWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLDocumentHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLDocumentDir(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLDocumentHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLDocumentDir(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDocumentDir(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDocumentDesignMode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentDesignMode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDocumentDesignMode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDocumentCompatMode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLDocumentActiveElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLDocumentBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentCompatMode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLDocumentActiveElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLDocumentBgColor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDocumentBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDocumentFgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentFgColor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDocumentFgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDocumentAlinkColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentAlinkColor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDocumentAlinkColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDocumentLinkColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentLinkColor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDocumentLinkColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDocumentVlinkColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentVlinkColor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLDocumentVlinkColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
index 86d32d2615..ef172aabb3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
@@ -43,21 +43,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLElement);
 
 static const HashTableValue JSHTMLElementTableValues[16] =
 {
-    { "id", DontDelete, (intptr_t)jsHTMLElementId, (intptr_t)setJSHTMLElementId },
-    { "title", DontDelete, (intptr_t)jsHTMLElementTitle, (intptr_t)setJSHTMLElementTitle },
-    { "lang", DontDelete, (intptr_t)jsHTMLElementLang, (intptr_t)setJSHTMLElementLang },
-    { "dir", DontDelete, (intptr_t)jsHTMLElementDir, (intptr_t)setJSHTMLElementDir },
-    { "className", DontDelete, (intptr_t)jsHTMLElementClassName, (intptr_t)setJSHTMLElementClassName },
-    { "tabIndex", DontDelete, (intptr_t)jsHTMLElementTabIndex, (intptr_t)setJSHTMLElementTabIndex },
-    { "draggable", DontDelete, (intptr_t)jsHTMLElementDraggable, (intptr_t)setJSHTMLElementDraggable },
-    { "innerHTML", DontDelete, (intptr_t)jsHTMLElementInnerHTML, (intptr_t)setJSHTMLElementInnerHTML },
-    { "innerText", DontDelete, (intptr_t)jsHTMLElementInnerText, (intptr_t)setJSHTMLElementInnerText },
-    { "outerHTML", DontDelete, (intptr_t)jsHTMLElementOuterHTML, (intptr_t)setJSHTMLElementOuterHTML },
-    { "outerText", DontDelete, (intptr_t)jsHTMLElementOuterText, (intptr_t)setJSHTMLElementOuterText },
-    { "children", DontDelete|ReadOnly, (intptr_t)jsHTMLElementChildren, (intptr_t)0 },
-    { "contentEditable", DontDelete, (intptr_t)jsHTMLElementContentEditable, (intptr_t)setJSHTMLElementContentEditable },
-    { "isContentEditable", DontDelete|ReadOnly, (intptr_t)jsHTMLElementIsContentEditable, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLElementConstructor, (intptr_t)0 },
+    { "id", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLElementId), (intptr_t)setJSHTMLElementId },
+    { "title", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLElementTitle), (intptr_t)setJSHTMLElementTitle },
+    { "lang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLElementLang), (intptr_t)setJSHTMLElementLang },
+    { "dir", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLElementDir), (intptr_t)setJSHTMLElementDir },
+    { "className", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLElementClassName), (intptr_t)setJSHTMLElementClassName },
+    { "tabIndex", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLElementTabIndex), (intptr_t)setJSHTMLElementTabIndex },
+    { "draggable", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLElementDraggable), (intptr_t)setJSHTMLElementDraggable },
+    { "innerHTML", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLElementInnerHTML), (intptr_t)setJSHTMLElementInnerHTML },
+    { "innerText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLElementInnerText), (intptr_t)setJSHTMLElementInnerText },
+    { "outerHTML", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLElementOuterHTML), (intptr_t)setJSHTMLElementOuterHTML },
+    { "outerText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLElementOuterText), (intptr_t)setJSHTMLElementOuterText },
+    { "children", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLElementChildren), (intptr_t)0 },
+    { "contentEditable", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLElementContentEditable), (intptr_t)setJSHTMLElementContentEditable },
+    { "isContentEditable", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLElementIsContentEditable), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -96,7 +96,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -119,9 +119,9 @@ bool JSHTMLElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const I
 
 static const HashTableValue JSHTMLElementPrototypeTableValues[4] =
 {
-    { "insertAdjacentElement", DontDelete|Function, (intptr_t)jsHTMLElementPrototypeFunctionInsertAdjacentElement, (intptr_t)2 },
-    { "insertAdjacentHTML", DontDelete|Function, (intptr_t)jsHTMLElementPrototypeFunctionInsertAdjacentHTML, (intptr_t)2 },
-    { "insertAdjacentText", DontDelete|Function, (intptr_t)jsHTMLElementPrototypeFunctionInsertAdjacentText, (intptr_t)2 },
+    { "insertAdjacentElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLElementPrototypeFunctionInsertAdjacentElement), (intptr_t)2 },
+    { "insertAdjacentHTML", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLElementPrototypeFunctionInsertAdjacentHTML), (intptr_t)2 },
+    { "insertAdjacentText", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLElementPrototypeFunctionInsertAdjacentText), (intptr_t)2 },
     { 0, 0, 0, 0 }
 };
 
@@ -171,121 +171,135 @@ bool JSHTMLElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSHTMLElement, Base>(exec, &JSHTMLElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLElementId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::idAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::idAttr));
+    return result;
 }
 
-JSValue jsHTMLElementTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementTitle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::titleAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::titleAttr));
+    return result;
 }
 
-JSValue jsHTMLElementLang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementLang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::langAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::langAttr));
+    return result;
 }
 
-JSValue jsHTMLElementDir(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementDir(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::dirAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::dirAttr));
+    return result;
 }
 
-JSValue jsHTMLElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::classAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::classAttr));
+    return result;
 }
 
-JSValue jsHTMLElementTabIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementTabIndex(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(castedThis->impl());
-    return jsNumber(exec, imp->tabIndex());
+    JSValue result = jsNumber(exec, imp->tabIndex());
+    return result;
 }
 
-JSValue jsHTMLElementDraggable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementDraggable(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(castedThis->impl());
-    return jsBoolean(imp->draggable());
+    JSValue result = jsBoolean(imp->draggable());
+    return result;
 }
 
-JSValue jsHTMLElementInnerHTML(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementInnerHTML(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(castedThis->impl());
-    return jsString(exec, imp->innerHTML());
+    JSValue result = jsString(exec, imp->innerHTML());
+    return result;
 }
 
-JSValue jsHTMLElementInnerText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementInnerText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(castedThis->impl());
-    return jsString(exec, imp->innerText());
+    JSValue result = jsString(exec, imp->innerText());
+    return result;
 }
 
-JSValue jsHTMLElementOuterHTML(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementOuterHTML(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(castedThis->impl());
-    return jsString(exec, imp->outerHTML());
+    JSValue result = jsString(exec, imp->outerHTML());
+    return result;
 }
 
-JSValue jsHTMLElementOuterText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementOuterText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(castedThis->impl());
-    return jsString(exec, imp->outerText());
+    JSValue result = jsString(exec, imp->outerText());
+    return result;
 }
 
-JSValue jsHTMLElementChildren(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementChildren(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->children()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->children()));
+    return result;
 }
 
-JSValue jsHTMLElementContentEditable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementContentEditable(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(castedThis->impl());
-    return jsString(exec, imp->contentEditable());
+    JSValue result = jsString(exec, imp->contentEditable());
+    return result;
 }
 
-JSValue jsHTMLElementIsContentEditable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementIsContentEditable(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(castedThis->impl());
-    return jsBoolean(imp->isContentEditable());
+    JSValue result = jsBoolean(imp->isContentEditable());
+    return result;
 }
 
-JSValue jsHTMLElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLElement* domObject = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* domObject = static_cast<JSHTMLElement*>(asObject(slotBase));
     return JSHTMLElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -295,49 +309,57 @@ void JSHTMLElement::put(ExecState* exec, const Identifier& propertyName, JSValue
 
 void setJSHTMLElementId(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
+    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(thisObject);
+    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::idAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLElementTitle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
+    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(thisObject);
+    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::titleAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLElementLang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
+    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(thisObject);
+    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::langAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLElementDir(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
+    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(thisObject);
+    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::dirAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLElementClassName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
+    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(thisObject);
+    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::classAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLElementTabIndex(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
+    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(thisObject);
+    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     imp->setTabIndex(value.toInt32(exec));
 }
 
 void setJSHTMLElementDraggable(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
+    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(thisObject);
+    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     imp->setDraggable(value.toBoolean(exec));
 }
 
 void setJSHTMLElementInnerHTML(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
+    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(thisObject);
+    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setInnerHTML(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -345,7 +367,8 @@ void setJSHTMLElementInnerHTML(ExecState* exec, JSObject* thisObject, JSValue va
 
 void setJSHTMLElementInnerText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
+    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(thisObject);
+    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setInnerText(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -353,7 +376,8 @@ void setJSHTMLElementInnerText(ExecState* exec, JSObject* thisObject, JSValue va
 
 void setJSHTMLElementOuterHTML(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
+    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(thisObject);
+    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setOuterHTML(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -361,7 +385,8 @@ void setJSHTMLElementOuterHTML(ExecState* exec, JSObject* thisObject, JSValue va
 
 void setJSHTMLElementOuterText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
+    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(thisObject);
+    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setOuterText(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -369,7 +394,8 @@ void setJSHTMLElementOuterText(ExecState* exec, JSObject* thisObject, JSValue va
 
 void setJSHTMLElementContentEditable(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
+    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(thisObject);
+    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     imp->setContentEditable(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
index 6928db7093..9ace7d23f2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;
@@ -67,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -81,33 +81,33 @@ JSC::JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentHTML(JSC:
 JSC::JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLElementId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLElementId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLElementTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementTitle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLElementTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLElementLang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementLang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLElementLang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLElementDir(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementDir(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLElementDir(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLElementClassName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLElementTabIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementTabIndex(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLElementTabIndex(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLElementDraggable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementDraggable(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLElementDraggable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLElementInnerHTML(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementInnerHTML(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLElementInnerHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLElementInnerText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementInnerText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLElementInnerText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLElementOuterHTML(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementOuterHTML(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLElementOuterHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLElementOuterText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementOuterText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLElementOuterText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLElementChildren(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLElementContentEditable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementChildren(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLElementContentEditable(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLElementContentEditable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLElementIsContentEditable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementIsContentEditable(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.cpp
index 4921ebd7a8..5377d1d54e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.cpp
@@ -82,6 +82,7 @@
 #include "JSHTMLOptionElement.h"
 #include "JSHTMLParagraphElement.h"
 #include "JSHTMLParamElement.h"
+#include "JSHTMLProgressElement.h"
 #include "JSHTMLQuoteElement.h"
 #include "JSHTMLScriptElement.h"
 #include "JSHTMLSourceElement.h"
@@ -150,6 +151,7 @@
 #include "HTMLOptionElement.h"
 #include "HTMLParagraphElement.h"
 #include "HTMLParamElement.h"
+#include "HTMLProgressElement.h"
 #include "HTMLQuoteElement.h"
 #include "HTMLScriptElement.h"
 #include "HTMLSelectElement.h"
@@ -460,6 +462,15 @@ static JSNode* createHTMLParamElementWrapper(ExecState* exec, JSDOMGlobalObject*
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, HTMLParamElement, element.get());
 }
 
+#if ENABLE(PROGRESS_TAG)
+
+static JSNode* createHTMLProgressElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, HTMLProgressElement, element.get());
+}
+
+#endif
+
 static JSNode* createHTMLQuoteElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLElement> element)
 {
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, HTMLQuoteElement, element.get());
@@ -533,7 +544,7 @@ static JSNode* createHTMLVideoElementWrapper(ExecState* exec, JSDOMGlobalObject*
 #endif
 
 JSNode* createJSHTMLWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLElement> element)
-{   
+{
     typedef HashMap<WebCore::AtomicStringImpl*, CreateHTMLElementWrapperFunction> FunctionMap;
     DEFINE_STATIC_LOCAL(FunctionMap, map, ());
     if (map.isEmpty()) {
@@ -610,6 +621,9 @@ JSNode* createJSHTMLWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, Pa
        map.set(pTag.localName().impl(), createHTMLParagraphElementWrapper);
        map.set(paramTag.localName().impl(), createHTMLParamElementWrapper);
        map.set(preTag.localName().impl(), createHTMLPreElementWrapper);
+#if ENABLE(PROGRESS_TAG)
+       map.set(progressTag.localName().impl(), createHTMLProgressElementWrapper);
+#endif
        map.set(qTag.localName().impl(), createHTMLQuoteElementWrapper);
        map.set(scriptTag.localName().impl(), createHTMLScriptElementWrapper);
        map.set(selectTag.localName().impl(), createHTMLSelectElementWrapper);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
index 1d43b5ef68..c39c0f973f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
@@ -21,7 +21,6 @@
 #include "config.h"
 #include "JSHTMLEmbedElement.h"
 
-#include "AtomicString.h"
 #include "HTMLEmbedElement.h"
 #include "HTMLNames.h"
 #include "JSDOMBinding.h"
@@ -43,13 +42,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLEmbedElement);
 
 static const HashTableValue JSHTMLEmbedElementTableValues[8] =
 {
-    { "align", DontDelete, (intptr_t)jsHTMLEmbedElementAlign, (intptr_t)setJSHTMLEmbedElementAlign },
-    { "height", DontDelete, (intptr_t)jsHTMLEmbedElementHeight, (intptr_t)setJSHTMLEmbedElementHeight },
-    { "name", DontDelete, (intptr_t)jsHTMLEmbedElementName, (intptr_t)setJSHTMLEmbedElementName },
-    { "src", DontDelete, (intptr_t)jsHTMLEmbedElementSrc, (intptr_t)setJSHTMLEmbedElementSrc },
-    { "type", DontDelete, (intptr_t)jsHTMLEmbedElementType, (intptr_t)setJSHTMLEmbedElementType },
-    { "width", DontDelete, (intptr_t)jsHTMLEmbedElementWidth, (intptr_t)setJSHTMLEmbedElementWidth },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLEmbedElementConstructor, (intptr_t)0 },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLEmbedElementAlign), (intptr_t)setJSHTMLEmbedElementAlign },
+    { "height", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLEmbedElementHeight), (intptr_t)setJSHTMLEmbedElementHeight },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLEmbedElementName), (intptr_t)setJSHTMLEmbedElementName },
+    { "src", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLEmbedElementSrc), (intptr_t)setJSHTMLEmbedElementSrc },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLEmbedElementType), (intptr_t)setJSHTMLEmbedElementType },
+    { "width", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLEmbedElementWidth), (intptr_t)setJSHTMLEmbedElementWidth },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLEmbedElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -88,7 +87,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -111,7 +110,7 @@ bool JSHTMLEmbedElementConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 static const HashTableValue JSHTMLEmbedElementPrototypeTableValues[2] =
 {
-    { "getSVGDocument", DontDelete|Function, (intptr_t)jsHTMLEmbedElementPrototypeFunctionGetSVGDocument, (intptr_t)0 },
+    { "getSVGDocument", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLEmbedElementPrototypeFunctionGetSVGDocument), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -153,10 +152,6 @@ JSObject* JSHTMLEmbedElement::createPrototype(ExecState* exec, JSGlobalObject* g
 
 bool JSHTMLEmbedElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (canGetItemsForName(exec, static_cast<HTMLEmbedElement*>(impl()), propertyName)) {
-        slot.setCustom(this, nameGetter);
-        return true;
-    }
     if (getOwnPropertySlotDelegate(exec, propertyName, slot))
         return true;
     return getStaticValueSlot<JSHTMLEmbedElement, Base>(exec, &JSHTMLEmbedElementTable, this, propertyName, slot);
@@ -164,68 +159,68 @@ bool JSHTMLEmbedElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
 
 bool JSHTMLEmbedElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    if (canGetItemsForName(exec, static_cast<HTMLEmbedElement*>(impl()), propertyName)) {
-        PropertySlot slot;
-        slot.setCustom(this, nameGetter);
-        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-        return true;
-    }
     if (getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))
         return true;
     return getStaticValueDescriptor<JSHTMLEmbedElement, Base>(exec, &JSHTMLEmbedElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLEmbedElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()));
+    JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::alignAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::alignAttr));
+    return result;
 }
 
-JSValue jsHTMLEmbedElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()));
+    JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::heightAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::heightAttr));
+    return result;
 }
 
-JSValue jsHTMLEmbedElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()));
+    JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
+    return result;
 }
 
-JSValue jsHTMLEmbedElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementSrc(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()));
+    JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::srcAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::srcAttr));
+    return result;
 }
 
-JSValue jsHTMLEmbedElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()));
+    JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::typeAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::typeAttr));
+    return result;
 }
 
-JSValue jsHTMLEmbedElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()));
+    JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::widthAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::widthAttr));
+    return result;
 }
 
-JSValue jsHTMLEmbedElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLEmbedElement* domObject = static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()));
+    JSHTMLEmbedElement* domObject = static_cast<JSHTMLEmbedElement*>(asObject(slotBase));
     return JSHTMLEmbedElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLEmbedElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -237,37 +232,43 @@ void JSHTMLEmbedElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSHTMLEmbedElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
+    JSHTMLEmbedElement* castedThisObj = static_cast<JSHTMLEmbedElement*>(thisObject);
+    HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::alignAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLEmbedElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
+    JSHTMLEmbedElement* castedThisObj = static_cast<JSHTMLEmbedElement*>(thisObject);
+    HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::heightAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLEmbedElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
+    JSHTMLEmbedElement* castedThisObj = static_cast<JSHTMLEmbedElement*>(thisObject);
+    HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::nameAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLEmbedElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
+    JSHTMLEmbedElement* castedThisObj = static_cast<JSHTMLEmbedElement*>(thisObject);
+    HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::srcAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLEmbedElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
+    JSHTMLEmbedElement* castedThisObj = static_cast<JSHTMLEmbedElement*>(thisObject);
+    HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::typeAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLEmbedElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
+    JSHTMLEmbedElement* castedThisObj = static_cast<JSHTMLEmbedElement*>(thisObject);
+    HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::widthAttr, valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
index e7c27cc5a8..1032ec69aa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
@@ -52,9 +52,6 @@ public:
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-private:
-    static bool canGetItemsForName(JSC::ExecState*, HTMLEmbedElement*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
@@ -68,7 +65,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLEmbedElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,19 +77,19 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsHTMLEmbedElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLEmbedElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLEmbedElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLEmbedElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLEmbedElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLEmbedElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLEmbedElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLEmbedElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLEmbedElementName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLEmbedElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLEmbedElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLEmbedElementSrc(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLEmbedElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLEmbedElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLEmbedElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLEmbedElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLEmbedElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLEmbedElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLEmbedElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLEmbedElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLEmbedElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
index d161eae85a..1838a5a56b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
@@ -25,8 +25,10 @@
 #include "HTMLFormElement.h"
 #include "JSHTMLFormElement.h"
 #include "JSValidityState.h"
+#include "KURL.h"
 #include "ValidityState.h"
 #include <runtime/Error.h>
+#include <runtime/JSString.h>
 #include <wtf/GetPtr.h>
 
 using namespace JSC;
@@ -37,12 +39,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLFieldSetElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLFieldSetElementTableValues[5] =
+static const HashTableValue JSHTMLFieldSetElementTableValues[6] =
 {
-    { "form", DontDelete|ReadOnly, (intptr_t)jsHTMLFieldSetElementForm, (intptr_t)0 },
-    { "validity", DontDelete|ReadOnly, (intptr_t)jsHTMLFieldSetElementValidity, (intptr_t)0 },
-    { "willValidate", DontDelete|ReadOnly, (intptr_t)jsHTMLFieldSetElementWillValidate, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLFieldSetElementConstructor, (intptr_t)0 },
+    { "form", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFieldSetElementForm), (intptr_t)0 },
+    { "validity", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFieldSetElementValidity), (intptr_t)0 },
+    { "willValidate", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFieldSetElementWillValidate), (intptr_t)0 },
+    { "validationMessage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFieldSetElementValidationMessage), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFieldSetElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -50,7 +53,7 @@ static JSC_CONST_HASHTABLE HashTable JSHTMLFieldSetElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 7, JSHTMLFieldSetElementTableValues, 0 };
 #else
-    { 8, 7, JSHTMLFieldSetElementTableValues, 0 };
+    { 16, 15, JSHTMLFieldSetElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -81,7 +84,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -104,8 +107,8 @@ bool JSHTMLFieldSetElementConstructor::getOwnPropertyDescriptor(ExecState* exec,
 
 static const HashTableValue JSHTMLFieldSetElementPrototypeTableValues[3] =
 {
-    { "checkValidity", DontDelete|Function, (intptr_t)jsHTMLFieldSetElementPrototypeFunctionCheckValidity, (intptr_t)0 },
-    { "setCustomValidity", DontDelete|Function, (intptr_t)jsHTMLFieldSetElementPrototypeFunctionSetCustomValidity, (intptr_t)1 },
+    { "checkValidity", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLFieldSetElementPrototypeFunctionCheckValidity), (intptr_t)0 },
+    { "setCustomValidity", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLFieldSetElementPrototypeFunctionSetCustomValidity), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -155,33 +158,45 @@ bool JSHTMLFieldSetElement::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSHTMLFieldSetElement, Base>(exec, &JSHTMLFieldSetElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLFieldSetElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFieldSetElementForm(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFieldSetElement* castedThis = static_cast<JSHTMLFieldSetElement*>(asObject(slot.slotBase()));
+    JSHTMLFieldSetElement* castedThis = static_cast<JSHTMLFieldSetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFieldSetElement* imp = static_cast<HTMLFieldSetElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    return result;
 }
 
-JSValue jsHTMLFieldSetElementValidity(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFieldSetElementValidity(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFieldSetElement* castedThis = static_cast<JSHTMLFieldSetElement*>(asObject(slot.slotBase()));
+    JSHTMLFieldSetElement* castedThis = static_cast<JSHTMLFieldSetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFieldSetElement* imp = static_cast<HTMLFieldSetElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->validity()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->validity()));
+    return result;
 }
 
-JSValue jsHTMLFieldSetElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFieldSetElementWillValidate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFieldSetElement* castedThis = static_cast<JSHTMLFieldSetElement*>(asObject(slot.slotBase()));
+    JSHTMLFieldSetElement* castedThis = static_cast<JSHTMLFieldSetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFieldSetElement* imp = static_cast<HTMLFieldSetElement*>(castedThis->impl());
-    return jsBoolean(imp->willValidate());
+    JSValue result = jsBoolean(imp->willValidate());
+    return result;
+}
+
+JSValue jsHTMLFieldSetElementValidationMessage(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLFieldSetElement* castedThis = static_cast<JSHTMLFieldSetElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLFieldSetElement* imp = static_cast<HTMLFieldSetElement*>(castedThis->impl());
+    JSValue result = jsString(exec, imp->validationMessage());
+    return result;
 }
 
-JSValue jsHTMLFieldSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFieldSetElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFieldSetElement* domObject = static_cast<JSHTMLFieldSetElement*>(asObject(slot.slotBase()));
+    JSHTMLFieldSetElement* domObject = static_cast<JSHTMLFieldSetElement*>(asObject(slotBase));
     return JSHTMLFieldSetElement::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSHTMLFieldSetElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
index f23e5fac44..939f119b75 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLFieldSetElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -71,10 +71,11 @@ JSC::JSValue JSC_HOST_CALL jsHTMLFieldSetElementPrototypeFunctionCheckValidity(J
 JSC::JSValue JSC_HOST_CALL jsHTMLFieldSetElementPrototypeFunctionSetCustomValidity(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLFieldSetElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLFieldSetElementValidity(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLFieldSetElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLFieldSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFieldSetElementForm(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLFieldSetElementValidity(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLFieldSetElementWillValidate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLFieldSetElementValidationMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLFieldSetElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
index 720a0b9bd4..c98c3646e3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
@@ -36,10 +36,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLFontElement);
 
 static const HashTableValue JSHTMLFontElementTableValues[5] =
 {
-    { "color", DontDelete, (intptr_t)jsHTMLFontElementColor, (intptr_t)setJSHTMLFontElementColor },
-    { "face", DontDelete, (intptr_t)jsHTMLFontElementFace, (intptr_t)setJSHTMLFontElementFace },
-    { "size", DontDelete, (intptr_t)jsHTMLFontElementSize, (intptr_t)setJSHTMLFontElementSize },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLFontElementConstructor, (intptr_t)0 },
+    { "color", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFontElementColor), (intptr_t)setJSHTMLFontElementColor },
+    { "face", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFontElementFace), (intptr_t)setJSHTMLFontElementFace },
+    { "size", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFontElementSize), (intptr_t)setJSHTMLFontElementSize },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFontElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -78,7 +78,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -140,33 +140,36 @@ bool JSHTMLFontElement::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSHTMLFontElement, Base>(exec, &JSHTMLFontElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLFontElementColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFontElementColor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFontElement* castedThis = static_cast<JSHTMLFontElement*>(asObject(slot.slotBase()));
+    JSHTMLFontElement* castedThis = static_cast<JSHTMLFontElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFontElement* imp = static_cast<HTMLFontElement*>(castedThis->impl());
-    return jsString(exec, imp->color());
+    JSValue result = jsString(exec, imp->color());
+    return result;
 }
 
-JSValue jsHTMLFontElementFace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFontElementFace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFontElement* castedThis = static_cast<JSHTMLFontElement*>(asObject(slot.slotBase()));
+    JSHTMLFontElement* castedThis = static_cast<JSHTMLFontElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFontElement* imp = static_cast<HTMLFontElement*>(castedThis->impl());
-    return jsString(exec, imp->face());
+    JSValue result = jsString(exec, imp->face());
+    return result;
 }
 
-JSValue jsHTMLFontElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFontElementSize(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFontElement* castedThis = static_cast<JSHTMLFontElement*>(asObject(slot.slotBase()));
+    JSHTMLFontElement* castedThis = static_cast<JSHTMLFontElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFontElement* imp = static_cast<HTMLFontElement*>(castedThis->impl());
-    return jsString(exec, imp->size());
+    JSValue result = jsString(exec, imp->size());
+    return result;
 }
 
-JSValue jsHTMLFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFontElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFontElement* domObject = static_cast<JSHTMLFontElement*>(asObject(slot.slotBase()));
+    JSHTMLFontElement* domObject = static_cast<JSHTMLFontElement*>(asObject(slotBase));
     return JSHTMLFontElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLFontElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -176,19 +179,22 @@ void JSHTMLFontElement::put(ExecState* exec, const Identifier& propertyName, JSV
 
 void setJSHTMLFontElementColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFontElement* imp = static_cast<HTMLFontElement*>(static_cast<JSHTMLFontElement*>(thisObject)->impl());
+    JSHTMLFontElement* castedThisObj = static_cast<JSHTMLFontElement*>(thisObject);
+    HTMLFontElement* imp = static_cast<HTMLFontElement*>(castedThisObj->impl());
     imp->setColor(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFontElementFace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFontElement* imp = static_cast<HTMLFontElement*>(static_cast<JSHTMLFontElement*>(thisObject)->impl());
+    JSHTMLFontElement* castedThisObj = static_cast<JSHTMLFontElement*>(thisObject);
+    HTMLFontElement* imp = static_cast<HTMLFontElement*>(castedThisObj->impl());
     imp->setFace(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFontElementSize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFontElement* imp = static_cast<HTMLFontElement*>(static_cast<JSHTMLFontElement*>(thisObject)->impl());
+    JSHTMLFontElement* castedThisObj = static_cast<JSHTMLFontElement*>(thisObject);
+    HTMLFontElement* imp = static_cast<HTMLFontElement*>(castedThisObj->impl());
     imp->setSize(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
index cb4670c688..57a5df975e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLFontElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,13 +66,13 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLFontElementColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFontElementColor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFontElementColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFontElementFace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFontElementFace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFontElementFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFontElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFontElementSize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFontElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFontElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
index bd11b4074f..ab6ee148f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
@@ -42,17 +42,17 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLFormElement);
 
 static const HashTableValue JSHTMLFormElementTableValues[12] =
 {
-    { "elements", DontDelete|ReadOnly, (intptr_t)jsHTMLFormElementElements, (intptr_t)0 },
-    { "length", DontDelete|ReadOnly, (intptr_t)jsHTMLFormElementLength, (intptr_t)0 },
-    { "name", DontDelete, (intptr_t)jsHTMLFormElementName, (intptr_t)setJSHTMLFormElementName },
-    { "noValidate", DontDelete, (intptr_t)jsHTMLFormElementNoValidate, (intptr_t)setJSHTMLFormElementNoValidate },
-    { "acceptCharset", DontDelete, (intptr_t)jsHTMLFormElementAcceptCharset, (intptr_t)setJSHTMLFormElementAcceptCharset },
-    { "action", DontDelete, (intptr_t)jsHTMLFormElementAction, (intptr_t)setJSHTMLFormElementAction },
-    { "encoding", DontDelete, (intptr_t)jsHTMLFormElementEncoding, (intptr_t)setJSHTMLFormElementEncoding },
-    { "enctype", DontDelete, (intptr_t)jsHTMLFormElementEnctype, (intptr_t)setJSHTMLFormElementEnctype },
-    { "method", DontDelete, (intptr_t)jsHTMLFormElementMethod, (intptr_t)setJSHTMLFormElementMethod },
-    { "target", DontDelete, (intptr_t)jsHTMLFormElementTarget, (intptr_t)setJSHTMLFormElementTarget },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLFormElementConstructor, (intptr_t)0 },
+    { "elements", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFormElementElements), (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFormElementLength), (intptr_t)0 },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFormElementName), (intptr_t)setJSHTMLFormElementName },
+    { "noValidate", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFormElementNoValidate), (intptr_t)setJSHTMLFormElementNoValidate },
+    { "acceptCharset", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFormElementAcceptCharset), (intptr_t)setJSHTMLFormElementAcceptCharset },
+    { "action", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFormElementAction), (intptr_t)setJSHTMLFormElementAction },
+    { "encoding", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFormElementEncoding), (intptr_t)setJSHTMLFormElementEncoding },
+    { "enctype", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFormElementEnctype), (intptr_t)setJSHTMLFormElementEnctype },
+    { "method", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFormElementMethod), (intptr_t)setJSHTMLFormElementMethod },
+    { "target", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFormElementTarget), (intptr_t)setJSHTMLFormElementTarget },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFormElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -91,7 +91,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -114,9 +114,9 @@ bool JSHTMLFormElementConstructor::getOwnPropertyDescriptor(ExecState* exec, con
 
 static const HashTableValue JSHTMLFormElementPrototypeTableValues[4] =
 {
-    { "submit", DontDelete|Function, (intptr_t)jsHTMLFormElementPrototypeFunctionSubmit, (intptr_t)0 },
-    { "reset", DontDelete|Function, (intptr_t)jsHTMLFormElementPrototypeFunctionReset, (intptr_t)0 },
-    { "checkValidity", DontDelete|Function, (intptr_t)jsHTMLFormElementPrototypeFunctionCheckValidity, (intptr_t)0 },
+    { "submit", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLFormElementPrototypeFunctionSubmit), (intptr_t)0 },
+    { "reset", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLFormElementPrototypeFunctionReset), (intptr_t)0 },
+    { "checkValidity", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLFormElementPrototypeFunctionCheckValidity), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -202,89 +202,99 @@ bool JSHTMLFormElement::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSHTMLFormElement, Base>(exec, &JSHTMLFormElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLFormElementElements(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementElements(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
+    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->elements()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->elements()));
+    return result;
 }
 
-JSValue jsHTMLFormElementLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
+    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsHTMLFormElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
+    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsHTMLFormElementNoValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementNoValidate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
+    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThis->impl());
-    return jsBoolean(imp->noValidate());
+    JSValue result = jsBoolean(imp->noValidate());
+    return result;
 }
 
-JSValue jsHTMLFormElementAcceptCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementAcceptCharset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
+    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThis->impl());
-    return jsString(exec, imp->acceptCharset());
+    JSValue result = jsString(exec, imp->acceptCharset());
+    return result;
 }
 
-JSValue jsHTMLFormElementAction(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementAction(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
+    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThis->impl());
-    return jsString(exec, imp->action());
+    JSValue result = jsString(exec, imp->action());
+    return result;
 }
 
-JSValue jsHTMLFormElementEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementEncoding(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
+    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThis->impl());
-    return jsString(exec, imp->encoding());
+    JSValue result = jsString(exec, imp->encoding());
+    return result;
 }
 
-JSValue jsHTMLFormElementEnctype(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementEnctype(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
+    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThis->impl());
-    return jsString(exec, imp->enctype());
+    JSValue result = jsString(exec, imp->enctype());
+    return result;
 }
 
-JSValue jsHTMLFormElementMethod(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementMethod(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
+    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThis->impl());
-    return jsString(exec, imp->method());
+    JSValue result = jsString(exec, imp->method());
+    return result;
 }
 
-JSValue jsHTMLFormElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementTarget(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
+    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThis->impl());
-    return jsString(exec, imp->target());
+    JSValue result = jsString(exec, imp->target());
+    return result;
 }
 
-JSValue jsHTMLFormElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFormElement* domObject = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
+    JSHTMLFormElement* domObject = static_cast<JSHTMLFormElement*>(asObject(slotBase));
     return JSHTMLFormElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLFormElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -294,57 +304,65 @@ void JSHTMLFormElement::put(ExecState* exec, const Identifier& propertyName, JSV
 
 void setJSHTMLFormElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
+    JSHTMLFormElement* castedThisObj = static_cast<JSHTMLFormElement*>(thisObject);
+    HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThisObj->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFormElementNoValidate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
+    JSHTMLFormElement* castedThisObj = static_cast<JSHTMLFormElement*>(thisObject);
+    HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThisObj->impl());
     imp->setNoValidate(value.toBoolean(exec));
 }
 
 void setJSHTMLFormElementAcceptCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
+    JSHTMLFormElement* castedThisObj = static_cast<JSHTMLFormElement*>(thisObject);
+    HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThisObj->impl());
     imp->setAcceptCharset(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFormElementAction(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
+    JSHTMLFormElement* castedThisObj = static_cast<JSHTMLFormElement*>(thisObject);
+    HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThisObj->impl());
     imp->setAction(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFormElementEncoding(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
+    JSHTMLFormElement* castedThisObj = static_cast<JSHTMLFormElement*>(thisObject);
+    HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThisObj->impl());
     imp->setEncoding(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFormElementEnctype(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
+    JSHTMLFormElement* castedThisObj = static_cast<JSHTMLFormElement*>(thisObject);
+    HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThisObj->impl());
     imp->setEnctype(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFormElementMethod(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
+    JSHTMLFormElement* castedThisObj = static_cast<JSHTMLFormElement*>(thisObject);
+    HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThisObj->impl());
     imp->setMethod(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFormElementTarget(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
+    JSHTMLFormElement* castedThisObj = static_cast<JSHTMLFormElement*>(thisObject);
+    HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThisObj->impl());
     imp->setTarget(valueToStringWithNullCheck(exec, value));
 }
 
-void JSHTMLFormElement::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSHTMLFormElement::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<HTMLFormElement*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSHTMLFormElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -387,10 +405,10 @@ JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionCheckValidity(ExecState*
 }
 
 
-JSValue JSHTMLFormElement::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSHTMLFormElement::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSHTMLFormElement* thisObj = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<HTMLFormElement*>(thisObj->impl())->item(slot.index()));
+    JSHTMLFormElement* thisObj = static_cast<JSHTMLFormElement*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<HTMLFormElement*>(thisObj->impl())->item(index));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
index b022fd6ad1..f2f1c38d13 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
@@ -40,20 +40,20 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom functions
     JSC::JSValue submit(JSC::ExecState*, const JSC::ArgList&);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLFormElement*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 
@@ -67,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLFormElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -81,25 +81,25 @@ JSC::JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionReset(JSC::ExecStat
 JSC::JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionCheckValidity(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLFormElementElements(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLFormElementLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLFormElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFormElementElements(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLFormElementLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLFormElementName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFormElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFormElementNoValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFormElementNoValidate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFormElementNoValidate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFormElementAcceptCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFormElementAcceptCharset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFormElementAcceptCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFormElementAction(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFormElementAction(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFormElementAction(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFormElementEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFormElementEncoding(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFormElementEncoding(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFormElementEnctype(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFormElementEnctype(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFormElementEnctype(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFormElementMethod(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFormElementMethod(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFormElementMethod(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFormElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFormElementTarget(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFormElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFormElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFormElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
index 4ddb621a90..c5a227ed15 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
@@ -46,20 +46,20 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLFrameElement);
 
 static const HashTableValue JSHTMLFrameElementTableValues[15] =
 {
-    { "frameBorder", DontDelete, (intptr_t)jsHTMLFrameElementFrameBorder, (intptr_t)setJSHTMLFrameElementFrameBorder },
-    { "longDesc", DontDelete, (intptr_t)jsHTMLFrameElementLongDesc, (intptr_t)setJSHTMLFrameElementLongDesc },
-    { "marginHeight", DontDelete, (intptr_t)jsHTMLFrameElementMarginHeight, (intptr_t)setJSHTMLFrameElementMarginHeight },
-    { "marginWidth", DontDelete, (intptr_t)jsHTMLFrameElementMarginWidth, (intptr_t)setJSHTMLFrameElementMarginWidth },
-    { "name", DontDelete, (intptr_t)jsHTMLFrameElementName, (intptr_t)setJSHTMLFrameElementName },
-    { "noResize", DontDelete, (intptr_t)jsHTMLFrameElementNoResize, (intptr_t)setJSHTMLFrameElementNoResize },
-    { "scrolling", DontDelete, (intptr_t)jsHTMLFrameElementScrolling, (intptr_t)setJSHTMLFrameElementScrolling },
-    { "src", DontDelete, (intptr_t)jsHTMLFrameElementSrc, (intptr_t)setJSHTMLFrameElementSrc },
-    { "contentDocument", DontDelete|ReadOnly, (intptr_t)jsHTMLFrameElementContentDocument, (intptr_t)0 },
-    { "contentWindow", DontDelete|ReadOnly, (intptr_t)jsHTMLFrameElementContentWindow, (intptr_t)0 },
-    { "location", DontDelete, (intptr_t)jsHTMLFrameElementLocation, (intptr_t)setJSHTMLFrameElementLocation },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsHTMLFrameElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsHTMLFrameElementHeight, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLFrameElementConstructor, (intptr_t)0 },
+    { "frameBorder", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameElementFrameBorder), (intptr_t)setJSHTMLFrameElementFrameBorder },
+    { "longDesc", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameElementLongDesc), (intptr_t)setJSHTMLFrameElementLongDesc },
+    { "marginHeight", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameElementMarginHeight), (intptr_t)setJSHTMLFrameElementMarginHeight },
+    { "marginWidth", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameElementMarginWidth), (intptr_t)setJSHTMLFrameElementMarginWidth },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameElementName), (intptr_t)setJSHTMLFrameElementName },
+    { "noResize", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameElementNoResize), (intptr_t)setJSHTMLFrameElementNoResize },
+    { "scrolling", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameElementScrolling), (intptr_t)setJSHTMLFrameElementScrolling },
+    { "src", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameElementSrc), (intptr_t)setJSHTMLFrameElementSrc },
+    { "contentDocument", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameElementContentDocument), (intptr_t)0 },
+    { "contentWindow", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameElementContentWindow), (intptr_t)0 },
+    { "location", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameElementLocation), (intptr_t)setJSHTMLFrameElementLocation },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameElementHeight), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -98,7 +98,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -121,7 +121,7 @@ bool JSHTMLFrameElementConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 static const HashTableValue JSHTMLFrameElementPrototypeTableValues[2] =
 {
-    { "getSVGDocument", DontDelete|Function, (intptr_t)jsHTMLFrameElementPrototypeFunctionGetSVGDocument, (intptr_t)0 },
+    { "getSVGDocument", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLFrameElementPrototypeFunctionGetSVGDocument), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -171,112 +171,124 @@ bool JSHTMLFrameElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSHTMLFrameElement, Base>(exec, &JSHTMLFrameElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLFrameElementFrameBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementFrameBorder(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::frameborderAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::frameborderAttr));
+    return result;
 }
 
-JSValue jsHTMLFrameElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementLongDesc(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::longdescAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::longdescAttr));
+    return result;
 }
 
-JSValue jsHTMLFrameElementMarginHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementMarginHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::marginheightAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::marginheightAttr));
+    return result;
 }
 
-JSValue jsHTMLFrameElementMarginWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementMarginWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::marginwidthAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::marginwidthAttr));
+    return result;
 }
 
-JSValue jsHTMLFrameElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
+    return result;
 }
 
-JSValue jsHTMLFrameElementNoResize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementNoResize(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsBoolean(imp->noResize());
+    JSValue result = jsBoolean(imp->noResize());
+    return result;
 }
 
-JSValue jsHTMLFrameElementScrolling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementScrolling(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::scrollingAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::scrollingAttr));
+    return result;
 }
 
-JSValue jsHTMLFrameElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementSrc(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getURLAttribute(HTMLNames::srcAttr));
+    JSValue result = jsString(exec, imp->getURLAttribute(HTMLNames::srcAttr));
+    return result;
 }
 
-JSValue jsHTMLFrameElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementContentDocument(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slotBase));
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
     return checkNodeSecurity(exec, imp->contentDocument()) ? toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->contentDocument())) : jsUndefined();
 }
 
-JSValue jsHTMLFrameElementContentWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementContentWindow(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->contentWindow()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->contentWindow()));
+    return result;
 }
 
-JSValue jsHTMLFrameElementLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementLocation(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->location());
+    JSValue result = jsString(exec, imp->location());
+    return result;
 }
 
-JSValue jsHTMLFrameElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsNumber(exec, imp->width());
+    JSValue result = jsNumber(exec, imp->width());
+    return result;
 }
 
-JSValue jsHTMLFrameElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsNumber(exec, imp->height());
+    JSValue result = jsNumber(exec, imp->height());
+    return result;
 }
 
-JSValue jsHTMLFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameElement* domObject = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameElement* domObject = static_cast<JSHTMLFrameElement*>(asObject(slotBase));
     return JSHTMLFrameElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLFrameElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -286,43 +298,50 @@ void JSHTMLFrameElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSHTMLFrameElementFrameBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
+    JSHTMLFrameElement* castedThisObj = static_cast<JSHTMLFrameElement*>(thisObject);
+    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::frameborderAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFrameElementLongDesc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
+    JSHTMLFrameElement* castedThisObj = static_cast<JSHTMLFrameElement*>(thisObject);
+    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::longdescAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFrameElementMarginHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
+    JSHTMLFrameElement* castedThisObj = static_cast<JSHTMLFrameElement*>(thisObject);
+    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::marginheightAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFrameElementMarginWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
+    JSHTMLFrameElement* castedThisObj = static_cast<JSHTMLFrameElement*>(thisObject);
+    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::marginwidthAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFrameElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
+    JSHTMLFrameElement* castedThisObj = static_cast<JSHTMLFrameElement*>(thisObject);
+    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::nameAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFrameElementNoResize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
+    JSHTMLFrameElement* castedThisObj = static_cast<JSHTMLFrameElement*>(thisObject);
+    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThisObj->impl());
     imp->setNoResize(value.toBoolean(exec));
 }
 
 void setJSHTMLFrameElementScrolling(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
+    JSHTMLFrameElement* castedThisObj = static_cast<JSHTMLFrameElement*>(thisObject);
+    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::scrollingAttr, valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
index 7894c4f7e0..f40ca1aaca 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -63,7 +63,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLFrameElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,29 +75,29 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsHTMLFrameElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLFrameElementFrameBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementFrameBorder(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameElementFrameBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameElementLongDesc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementLongDesc(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameElementLongDesc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameElementMarginHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementMarginHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameElementMarginHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameElementMarginWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementMarginWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameElementMarginWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameElementNoResize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementNoResize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameElementNoResize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameElementScrolling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementScrolling(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameElementScrolling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementSrc(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLFrameElementContentWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLFrameElementLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementContentDocument(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLFrameElementContentWindow(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLFrameElementLocation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameElementLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLFrameElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLFrameElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLFrameElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
index 9e506a006d..1c5e78841e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
@@ -23,9 +23,7 @@
 
 #include "AtomicString.h"
 #include "EventListener.h"
-#include "Frame.h"
 #include "HTMLFrameSetElement.h"
-#include "JSDOMGlobalObject.h"
 #include "JSEventListener.h"
 #include "KURL.h"
 #include <runtime/JSString.h>
@@ -39,19 +37,20 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLFrameSetElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLFrameSetElementTableValues[12] =
-{
-    { "cols", DontDelete, (intptr_t)jsHTMLFrameSetElementCols, (intptr_t)setJSHTMLFrameSetElementCols },
-    { "rows", DontDelete, (intptr_t)jsHTMLFrameSetElementRows, (intptr_t)setJSHTMLFrameSetElementRows },
-    { "onbeforeunload", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnbeforeunload, (intptr_t)setJSHTMLFrameSetElementOnbeforeunload },
-    { "onhashchange", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnhashchange, (intptr_t)setJSHTMLFrameSetElementOnhashchange },
-    { "onmessage", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnmessage, (intptr_t)setJSHTMLFrameSetElementOnmessage },
-    { "onoffline", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnoffline, (intptr_t)setJSHTMLFrameSetElementOnoffline },
-    { "ononline", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnonline, (intptr_t)setJSHTMLFrameSetElementOnonline },
-    { "onresize", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnresize, (intptr_t)setJSHTMLFrameSetElementOnresize },
-    { "onstorage", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnstorage, (intptr_t)setJSHTMLFrameSetElementOnstorage },
-    { "onunload", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnunload, (intptr_t)setJSHTMLFrameSetElementOnunload },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLFrameSetElementConstructor, (intptr_t)0 },
+static const HashTableValue JSHTMLFrameSetElementTableValues[13] =
+{
+    { "cols", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementCols), (intptr_t)setJSHTMLFrameSetElementCols },
+    { "rows", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementRows), (intptr_t)setJSHTMLFrameSetElementRows },
+    { "onbeforeunload", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnbeforeunload), (intptr_t)setJSHTMLFrameSetElementOnbeforeunload },
+    { "onhashchange", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnhashchange), (intptr_t)setJSHTMLFrameSetElementOnhashchange },
+    { "onmessage", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnmessage), (intptr_t)setJSHTMLFrameSetElementOnmessage },
+    { "onoffline", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnoffline), (intptr_t)setJSHTMLFrameSetElementOnoffline },
+    { "ononline", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnonline), (intptr_t)setJSHTMLFrameSetElementOnonline },
+    { "onpopstate", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnpopstate), (intptr_t)setJSHTMLFrameSetElementOnpopstate },
+    { "onresize", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnresize), (intptr_t)setJSHTMLFrameSetElementOnresize },
+    { "onstorage", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnstorage), (intptr_t)setJSHTMLFrameSetElementOnstorage },
+    { "onunload", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnunload), (intptr_t)setJSHTMLFrameSetElementOnunload },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -90,7 +89,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -162,121 +161,153 @@ bool JSHTMLFrameSetElement::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSHTMLFrameSetElement, Base>(exec, &JSHTMLFrameSetElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLFrameSetElementCols(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementCols(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThis->impl());
-    return jsString(exec, imp->cols());
+    JSValue result = jsString(exec, imp->cols());
+    return result;
 }
 
-JSValue jsHTMLFrameSetElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementRows(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThis->impl());
-    return jsString(exec, imp->rows());
+    JSValue result = jsString(exec, imp->rows());
+    return result;
 }
 
-JSValue jsHTMLFrameSetElementOnbeforeunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementOnbeforeunload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforeunload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLFrameSetElementOnhashchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementOnhashchange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThis->impl());
     if (EventListener* listener = imp->onhashchange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLFrameSetElementOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementOnmessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThis->impl());
     if (EventListener* listener = imp->onmessage()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLFrameSetElementOnoffline(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementOnoffline(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThis->impl());
     if (EventListener* listener = imp->onoffline()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLFrameSetElementOnonline(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementOnonline(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThis->impl());
     if (EventListener* listener = imp->ononline()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLFrameSetElementOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementOnpopstate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThis->impl());
+    if (EventListener* listener = imp->onpopstate()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsHTMLFrameSetElementOnresize(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThis->impl());
     if (EventListener* listener = imp->onresize()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLFrameSetElementOnstorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementOnstorage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThis->impl());
     if (EventListener* listener = imp->onstorage()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLFrameSetElementOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementOnunload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThis->impl());
     if (EventListener* listener = imp->onunload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsHTMLFrameSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLFrameSetElement* domObject = static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()));
+    JSHTMLFrameSetElement* domObject = static_cast<JSHTMLFrameSetElement*>(asObject(slotBase));
     return JSHTMLFrameSetElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLFrameSetElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -286,13 +317,15 @@ void JSHTMLFrameSetElement::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSHTMLFrameSetElementCols(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
+    JSHTMLFrameSetElement* castedThisObj = static_cast<JSHTMLFrameSetElement*>(thisObject);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThisObj->impl());
     imp->setCols(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFrameSetElementRows(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
+    JSHTMLFrameSetElement* castedThisObj = static_cast<JSHTMLFrameSetElement*>(thisObject);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThisObj->impl());
     imp->setRows(valueToStringWithNullCheck(exec, value));
 }
 
@@ -300,80 +333,63 @@ void setJSHTMLFrameSetElementOnbeforeunload(ExecState* exec, JSObject* thisObjec
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforeunload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforeunload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSHTMLFrameSetElementOnhashchange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnhashchange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnhashchange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSHTMLFrameSetElementOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmessage(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSHTMLFrameSetElementOnoffline(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnoffline(globalObject->createJSAttributeEventListener(value));
+    imp->setOnoffline(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSHTMLFrameSetElementOnonline(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnonline(globalObject->createJSAttributeEventListener(value));
+    imp->setOnonline(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSHTMLFrameSetElementOnpopstate(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
+    imp->setOnpopstate(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSHTMLFrameSetElementOnresize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnresize(globalObject->createJSAttributeEventListener(value));
+    imp->setOnresize(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSHTMLFrameSetElementOnstorage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnstorage(globalObject->createJSAttributeEventListener(value));
+    imp->setOnstorage(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSHTMLFrameSetElementOnunload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnunload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnunload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSHTMLFrameSetElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
index 216fa594fd..c4ee5990d2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -48,7 +48,7 @@ protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLFrameSetElement*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 
@@ -60,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLFrameSetElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -69,27 +69,29 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLFrameSetElementCols(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameSetElementCols(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameSetElementCols(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameSetElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameSetElementRows(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameSetElementRows(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameSetElementOnbeforeunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameSetElementOnbeforeunload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameSetElementOnbeforeunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameSetElementOnhashchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameSetElementOnhashchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameSetElementOnhashchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameSetElementOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameSetElementOnmessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameSetElementOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameSetElementOnoffline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameSetElementOnoffline(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameSetElementOnoffline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameSetElementOnonline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameSetElementOnonline(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameSetElementOnonline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameSetElementOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameSetElementOnpopstate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLFrameSetElementOnpopstate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameSetElementOnresize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameSetElementOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameSetElementOnstorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameSetElementOnstorage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameSetElementOnstorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameSetElementOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameSetElementOnunload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameSetElementOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameSetElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
index e58b90d5b0..7a4735fce4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
@@ -36,11 +36,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLHRElement);
 
 static const HashTableValue JSHTMLHRElementTableValues[6] =
 {
-    { "align", DontDelete, (intptr_t)jsHTMLHRElementAlign, (intptr_t)setJSHTMLHRElementAlign },
-    { "noShade", DontDelete, (intptr_t)jsHTMLHRElementNoShade, (intptr_t)setJSHTMLHRElementNoShade },
-    { "size", DontDelete, (intptr_t)jsHTMLHRElementSize, (intptr_t)setJSHTMLHRElementSize },
-    { "width", DontDelete, (intptr_t)jsHTMLHRElementWidth, (intptr_t)setJSHTMLHRElementWidth },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLHRElementConstructor, (intptr_t)0 },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLHRElementAlign), (intptr_t)setJSHTMLHRElementAlign },
+    { "noShade", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLHRElementNoShade), (intptr_t)setJSHTMLHRElementNoShade },
+    { "size", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLHRElementSize), (intptr_t)setJSHTMLHRElementSize },
+    { "width", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLHRElementWidth), (intptr_t)setJSHTMLHRElementWidth },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLHRElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -141,41 +141,45 @@ bool JSHTMLHRElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSHTMLHRElement, Base>(exec, &JSHTMLHRElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLHRElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHRElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLHRElement* castedThis = static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()));
+    JSHTMLHRElement* castedThis = static_cast<JSHTMLHRElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(castedThis->impl());
-    return jsString(exec, imp->align());
+    JSValue result = jsString(exec, imp->align());
+    return result;
 }
 
-JSValue jsHTMLHRElementNoShade(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHRElementNoShade(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLHRElement* castedThis = static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()));
+    JSHTMLHRElement* castedThis = static_cast<JSHTMLHRElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(castedThis->impl());
-    return jsBoolean(imp->noShade());
+    JSValue result = jsBoolean(imp->noShade());
+    return result;
 }
 
-JSValue jsHTMLHRElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHRElementSize(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLHRElement* castedThis = static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()));
+    JSHTMLHRElement* castedThis = static_cast<JSHTMLHRElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(castedThis->impl());
-    return jsString(exec, imp->size());
+    JSValue result = jsString(exec, imp->size());
+    return result;
 }
 
-JSValue jsHTMLHRElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHRElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLHRElement* castedThis = static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()));
+    JSHTMLHRElement* castedThis = static_cast<JSHTMLHRElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(castedThis->impl());
-    return jsString(exec, imp->width());
+    JSValue result = jsString(exec, imp->width());
+    return result;
 }
 
-JSValue jsHTMLHRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHRElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLHRElement* domObject = static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()));
+    JSHTMLHRElement* domObject = static_cast<JSHTMLHRElement*>(asObject(slotBase));
     return JSHTMLHRElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLHRElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -185,25 +189,29 @@ void JSHTMLHRElement::put(ExecState* exec, const Identifier& propertyName, JSVal
 
 void setJSHTMLHRElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(thisObject)->impl());
+    JSHTMLHRElement* castedThisObj = static_cast<JSHTMLHRElement*>(thisObject);
+    HTMLHRElement* imp = static_cast<HTMLHRElement*>(castedThisObj->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLHRElementNoShade(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(thisObject)->impl());
+    JSHTMLHRElement* castedThisObj = static_cast<JSHTMLHRElement*>(thisObject);
+    HTMLHRElement* imp = static_cast<HTMLHRElement*>(castedThisObj->impl());
     imp->setNoShade(value.toBoolean(exec));
 }
 
 void setJSHTMLHRElementSize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(thisObject)->impl());
+    JSHTMLHRElement* castedThisObj = static_cast<JSHTMLHRElement*>(thisObject);
+    HTMLHRElement* imp = static_cast<HTMLHRElement*>(castedThisObj->impl());
     imp->setSize(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLHRElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(thisObject)->impl());
+    JSHTMLHRElement* castedThisObj = static_cast<JSHTMLHRElement*>(thisObject);
+    HTMLHRElement* imp = static_cast<HTMLHRElement*>(castedThisObj->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
index 4472820053..62cac05a24 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLHRElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,15 +66,15 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLHRElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHRElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLHRElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLHRElementNoShade(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHRElementNoShade(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLHRElementNoShade(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLHRElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHRElementSize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLHRElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLHRElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHRElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLHRElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLHRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHRElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
index ab10942173..3c77712d36 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
@@ -36,8 +36,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLHeadElement);
 
 static const HashTableValue JSHTMLHeadElementTableValues[3] =
 {
-    { "profile", DontDelete, (intptr_t)jsHTMLHeadElementProfile, (intptr_t)setJSHTMLHeadElementProfile },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLHeadElementConstructor, (intptr_t)0 },
+    { "profile", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLHeadElementProfile), (intptr_t)setJSHTMLHeadElementProfile },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLHeadElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,7 +76,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -138,17 +138,18 @@ bool JSHTMLHeadElement::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSHTMLHeadElement, Base>(exec, &JSHTMLHeadElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLHeadElementProfile(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHeadElementProfile(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLHeadElement* castedThis = static_cast<JSHTMLHeadElement*>(asObject(slot.slotBase()));
+    JSHTMLHeadElement* castedThis = static_cast<JSHTMLHeadElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLHeadElement* imp = static_cast<HTMLHeadElement*>(castedThis->impl());
-    return jsString(exec, imp->profile());
+    JSValue result = jsString(exec, imp->profile());
+    return result;
 }
 
-JSValue jsHTMLHeadElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHeadElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLHeadElement* domObject = static_cast<JSHTMLHeadElement*>(asObject(slot.slotBase()));
+    JSHTMLHeadElement* domObject = static_cast<JSHTMLHeadElement*>(asObject(slotBase));
     return JSHTMLHeadElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLHeadElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -158,7 +159,8 @@ void JSHTMLHeadElement::put(ExecState* exec, const Identifier& propertyName, JSV
 
 void setJSHTMLHeadElementProfile(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLHeadElement* imp = static_cast<HTMLHeadElement*>(static_cast<JSHTMLHeadElement*>(thisObject)->impl());
+    JSHTMLHeadElement* castedThisObj = static_cast<JSHTMLHeadElement*>(thisObject);
+    HTMLHeadElement* imp = static_cast<HTMLHeadElement*>(castedThisObj->impl());
     imp->setProfile(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
index 585eb601f4..5f61f507f9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLHeadElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,9 +66,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLHeadElementProfile(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHeadElementProfile(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLHeadElementProfile(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLHeadElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHeadElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
index 5409279bae..b024cd3da0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
@@ -36,8 +36,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLHeadingElement);
 
 static const HashTableValue JSHTMLHeadingElementTableValues[3] =
 {
-    { "align", DontDelete, (intptr_t)jsHTMLHeadingElementAlign, (intptr_t)setJSHTMLHeadingElementAlign },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLHeadingElementConstructor, (intptr_t)0 },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLHeadingElementAlign), (intptr_t)setJSHTMLHeadingElementAlign },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLHeadingElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,7 +76,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -138,17 +138,18 @@ bool JSHTMLHeadingElement::getOwnPropertyDescriptor(ExecState* exec, const Ident
     return getStaticValueDescriptor<JSHTMLHeadingElement, Base>(exec, &JSHTMLHeadingElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLHeadingElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHeadingElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLHeadingElement* castedThis = static_cast<JSHTMLHeadingElement*>(asObject(slot.slotBase()));
+    JSHTMLHeadingElement* castedThis = static_cast<JSHTMLHeadingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLHeadingElement* imp = static_cast<HTMLHeadingElement*>(castedThis->impl());
-    return jsString(exec, imp->align());
+    JSValue result = jsString(exec, imp->align());
+    return result;
 }
 
-JSValue jsHTMLHeadingElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHeadingElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLHeadingElement* domObject = static_cast<JSHTMLHeadingElement*>(asObject(slot.slotBase()));
+    JSHTMLHeadingElement* domObject = static_cast<JSHTMLHeadingElement*>(asObject(slotBase));
     return JSHTMLHeadingElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLHeadingElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -158,7 +159,8 @@ void JSHTMLHeadingElement::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSHTMLHeadingElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLHeadingElement* imp = static_cast<HTMLHeadingElement*>(static_cast<JSHTMLHeadingElement*>(thisObject)->impl());
+    JSHTMLHeadingElement* castedThisObj = static_cast<JSHTMLHeadingElement*>(thisObject);
+    HTMLHeadingElement* imp = static_cast<HTMLHeadingElement*>(castedThisObj->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
index a33f6f61ea..0c08e0afe9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLHeadingElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,9 +66,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLHeadingElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHeadingElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLHeadingElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLHeadingElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHeadingElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
index f9c9b3ea91..105daf4035 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
@@ -36,8 +36,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLHtmlElement);
 
 static const HashTableValue JSHTMLHtmlElementTableValues[3] =
 {
-    { "version", DontDelete, (intptr_t)jsHTMLHtmlElementVersion, (intptr_t)setJSHTMLHtmlElementVersion },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLHtmlElementConstructor, (intptr_t)0 },
+    { "version", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLHtmlElementVersion), (intptr_t)setJSHTMLHtmlElementVersion },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLHtmlElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,7 +76,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -138,17 +138,18 @@ bool JSHTMLHtmlElement::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSHTMLHtmlElement, Base>(exec, &JSHTMLHtmlElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLHtmlElementVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHtmlElementVersion(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLHtmlElement* castedThis = static_cast<JSHTMLHtmlElement*>(asObject(slot.slotBase()));
+    JSHTMLHtmlElement* castedThis = static_cast<JSHTMLHtmlElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLHtmlElement* imp = static_cast<HTMLHtmlElement*>(castedThis->impl());
-    return jsString(exec, imp->version());
+    JSValue result = jsString(exec, imp->version());
+    return result;
 }
 
-JSValue jsHTMLHtmlElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHtmlElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLHtmlElement* domObject = static_cast<JSHTMLHtmlElement*>(asObject(slot.slotBase()));
+    JSHTMLHtmlElement* domObject = static_cast<JSHTMLHtmlElement*>(asObject(slotBase));
     return JSHTMLHtmlElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLHtmlElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -158,7 +159,8 @@ void JSHTMLHtmlElement::put(ExecState* exec, const Identifier& propertyName, JSV
 
 void setJSHTMLHtmlElementVersion(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLHtmlElement* imp = static_cast<HTMLHtmlElement*>(static_cast<JSHTMLHtmlElement*>(thisObject)->impl());
+    JSHTMLHtmlElement* castedThisObj = static_cast<JSHTMLHtmlElement*>(thisObject);
+    HTMLHtmlElement* imp = static_cast<HTMLHtmlElement*>(castedThisObj->impl());
     imp->setVersion(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
index 37b9bdd73d..844ad31405 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLHtmlElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,9 +66,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLHtmlElementVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHtmlElementVersion(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLHtmlElementVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLHtmlElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHtmlElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
index ea1d18c5a2..c9db0fffc1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
@@ -43,21 +43,22 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLIFrameElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLIFrameElementTableValues[14] =
-{
-    { "align", DontDelete, (intptr_t)jsHTMLIFrameElementAlign, (intptr_t)setJSHTMLIFrameElementAlign },
-    { "frameBorder", DontDelete, (intptr_t)jsHTMLIFrameElementFrameBorder, (intptr_t)setJSHTMLIFrameElementFrameBorder },
-    { "height", DontDelete, (intptr_t)jsHTMLIFrameElementHeight, (intptr_t)setJSHTMLIFrameElementHeight },
-    { "longDesc", DontDelete, (intptr_t)jsHTMLIFrameElementLongDesc, (intptr_t)setJSHTMLIFrameElementLongDesc },
-    { "marginHeight", DontDelete, (intptr_t)jsHTMLIFrameElementMarginHeight, (intptr_t)setJSHTMLIFrameElementMarginHeight },
-    { "marginWidth", DontDelete, (intptr_t)jsHTMLIFrameElementMarginWidth, (intptr_t)setJSHTMLIFrameElementMarginWidth },
-    { "name", DontDelete, (intptr_t)jsHTMLIFrameElementName, (intptr_t)setJSHTMLIFrameElementName },
-    { "scrolling", DontDelete, (intptr_t)jsHTMLIFrameElementScrolling, (intptr_t)setJSHTMLIFrameElementScrolling },
-    { "src", DontDelete, (intptr_t)jsHTMLIFrameElementSrc, (intptr_t)setJSHTMLIFrameElementSrc },
-    { "width", DontDelete, (intptr_t)jsHTMLIFrameElementWidth, (intptr_t)setJSHTMLIFrameElementWidth },
-    { "contentDocument", DontDelete|ReadOnly, (intptr_t)jsHTMLIFrameElementContentDocument, (intptr_t)0 },
-    { "contentWindow", DontDelete|ReadOnly, (intptr_t)jsHTMLIFrameElementContentWindow, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLIFrameElementConstructor, (intptr_t)0 },
+static const HashTableValue JSHTMLIFrameElementTableValues[15] =
+{
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIFrameElementAlign), (intptr_t)setJSHTMLIFrameElementAlign },
+    { "frameBorder", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIFrameElementFrameBorder), (intptr_t)setJSHTMLIFrameElementFrameBorder },
+    { "height", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIFrameElementHeight), (intptr_t)setJSHTMLIFrameElementHeight },
+    { "longDesc", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIFrameElementLongDesc), (intptr_t)setJSHTMLIFrameElementLongDesc },
+    { "marginHeight", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIFrameElementMarginHeight), (intptr_t)setJSHTMLIFrameElementMarginHeight },
+    { "marginWidth", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIFrameElementMarginWidth), (intptr_t)setJSHTMLIFrameElementMarginWidth },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIFrameElementName), (intptr_t)setJSHTMLIFrameElementName },
+    { "sandbox", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIFrameElementSandbox), (intptr_t)setJSHTMLIFrameElementSandbox },
+    { "scrolling", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIFrameElementScrolling), (intptr_t)setJSHTMLIFrameElementScrolling },
+    { "src", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIFrameElementSrc), (intptr_t)setJSHTMLIFrameElementSrc },
+    { "width", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIFrameElementWidth), (intptr_t)setJSHTMLIFrameElementWidth },
+    { "contentDocument", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIFrameElementContentDocument), (intptr_t)0 },
+    { "contentWindow", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIFrameElementContentWindow), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIFrameElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -96,7 +97,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -119,7 +120,7 @@ bool JSHTMLIFrameElementConstructor::getOwnPropertyDescriptor(ExecState* exec, c
 
 static const HashTableValue JSHTMLIFrameElementPrototypeTableValues[2] =
 {
-    { "getSVGDocument", DontDelete|Function, (intptr_t)jsHTMLIFrameElementPrototypeFunctionGetSVGDocument, (intptr_t)0 },
+    { "getSVGDocument", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLIFrameElementPrototypeFunctionGetSVGDocument), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -169,104 +170,124 @@ bool JSHTMLIFrameElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSHTMLIFrameElement, Base>(exec, &JSHTMLIFrameElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLIFrameElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::alignAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::alignAttr));
+    return result;
 }
 
-JSValue jsHTMLIFrameElementFrameBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementFrameBorder(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::frameborderAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::frameborderAttr));
+    return result;
 }
 
-JSValue jsHTMLIFrameElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::heightAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::heightAttr));
+    return result;
 }
 
-JSValue jsHTMLIFrameElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementLongDesc(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::longdescAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::longdescAttr));
+    return result;
 }
 
-JSValue jsHTMLIFrameElementMarginHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementMarginHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::marginheightAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::marginheightAttr));
+    return result;
 }
 
-JSValue jsHTMLIFrameElementMarginWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementMarginWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::marginwidthAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::marginwidthAttr));
+    return result;
 }
 
-JSValue jsHTMLIFrameElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
+    return result;
 }
 
-JSValue jsHTMLIFrameElementScrolling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementSandbox(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::scrollingAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::sandboxAttr));
+    return result;
 }
 
-JSValue jsHTMLIFrameElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementScrolling(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::srcAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::scrollingAttr));
+    return result;
+}
+
+JSValue jsHTMLIFrameElementSrc(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::srcAttr));
+    return result;
 }
 
-JSValue jsHTMLIFrameElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::widthAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::widthAttr));
+    return result;
 }
 
-JSValue jsHTMLIFrameElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementContentDocument(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slotBase));
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
     return checkNodeSecurity(exec, imp->contentDocument()) ? toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->contentDocument())) : jsUndefined();
 }
 
-JSValue jsHTMLIFrameElementContentWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementContentWindow(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->contentWindow()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->contentWindow()));
+    return result;
 }
 
-JSValue jsHTMLIFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIFrameElement* domObject = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
+    JSHTMLIFrameElement* domObject = static_cast<JSHTMLIFrameElement*>(asObject(slotBase));
     return JSHTMLIFrameElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLIFrameElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -276,49 +297,64 @@ void JSHTMLIFrameElement::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSHTMLIFrameElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
+    JSHTMLIFrameElement* castedThisObj = static_cast<JSHTMLIFrameElement*>(thisObject);
+    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::alignAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLIFrameElementFrameBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
+    JSHTMLIFrameElement* castedThisObj = static_cast<JSHTMLIFrameElement*>(thisObject);
+    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::frameborderAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLIFrameElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
+    JSHTMLIFrameElement* castedThisObj = static_cast<JSHTMLIFrameElement*>(thisObject);
+    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::heightAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLIFrameElementLongDesc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
+    JSHTMLIFrameElement* castedThisObj = static_cast<JSHTMLIFrameElement*>(thisObject);
+    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::longdescAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLIFrameElementMarginHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
+    JSHTMLIFrameElement* castedThisObj = static_cast<JSHTMLIFrameElement*>(thisObject);
+    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::marginheightAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLIFrameElementMarginWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
+    JSHTMLIFrameElement* castedThisObj = static_cast<JSHTMLIFrameElement*>(thisObject);
+    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::marginwidthAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLIFrameElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
+    JSHTMLIFrameElement* castedThisObj = static_cast<JSHTMLIFrameElement*>(thisObject);
+    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::nameAttr, valueToStringWithNullCheck(exec, value));
 }
 
+void setJSHTMLIFrameElementSandbox(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSHTMLIFrameElement* castedThisObj = static_cast<JSHTMLIFrameElement*>(thisObject);
+    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThisObj->impl());
+    imp->setAttribute(HTMLNames::sandboxAttr, valueToStringWithNullCheck(exec, value));
+}
+
 void setJSHTMLIFrameElementScrolling(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
+    JSHTMLIFrameElement* castedThisObj = static_cast<JSHTMLIFrameElement*>(thisObject);
+    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::scrollingAttr, valueToStringWithNullCheck(exec, value));
 }
 
@@ -329,7 +365,8 @@ void setJSHTMLIFrameElementSrc(ExecState* exec, JSObject* thisObject, JSValue va
 
 void setJSHTMLIFrameElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
+    JSHTMLIFrameElement* castedThisObj = static_cast<JSHTMLIFrameElement*>(thisObject);
+    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::widthAttr, valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
index 6153f7986e..fa035285bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -62,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLIFrameElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -74,29 +74,31 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsHTMLIFrameElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLIFrameElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLIFrameElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLIFrameElementFrameBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementFrameBorder(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLIFrameElementFrameBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLIFrameElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLIFrameElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLIFrameElementLongDesc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementLongDesc(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLIFrameElementLongDesc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLIFrameElementMarginHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementMarginHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLIFrameElementMarginHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLIFrameElementMarginWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementMarginWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLIFrameElementMarginWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLIFrameElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLIFrameElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLIFrameElementScrolling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementSandbox(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLIFrameElementSandbox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementScrolling(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLIFrameElementScrolling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLIFrameElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementSrc(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLIFrameElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLIFrameElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLIFrameElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLIFrameElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLIFrameElementContentWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLIFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementContentDocument(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLIFrameElementContentWindow(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLIFrameElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
index 7a6e0f7046..4b8742e583 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
@@ -38,25 +38,25 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLImageElement);
 
 static const HashTableValue JSHTMLImageElementTableValues[20] =
 {
-    { "name", DontDelete, (intptr_t)jsHTMLImageElementName, (intptr_t)setJSHTMLImageElementName },
-    { "align", DontDelete, (intptr_t)jsHTMLImageElementAlign, (intptr_t)setJSHTMLImageElementAlign },
-    { "alt", DontDelete, (intptr_t)jsHTMLImageElementAlt, (intptr_t)setJSHTMLImageElementAlt },
-    { "border", DontDelete, (intptr_t)jsHTMLImageElementBorder, (intptr_t)setJSHTMLImageElementBorder },
-    { "height", DontDelete, (intptr_t)jsHTMLImageElementHeight, (intptr_t)setJSHTMLImageElementHeight },
-    { "hspace", DontDelete, (intptr_t)jsHTMLImageElementHspace, (intptr_t)setJSHTMLImageElementHspace },
-    { "isMap", DontDelete, (intptr_t)jsHTMLImageElementIsMap, (intptr_t)setJSHTMLImageElementIsMap },
-    { "longDesc", DontDelete, (intptr_t)jsHTMLImageElementLongDesc, (intptr_t)setJSHTMLImageElementLongDesc },
-    { "src", DontDelete, (intptr_t)jsHTMLImageElementSrc, (intptr_t)setJSHTMLImageElementSrc },
-    { "useMap", DontDelete, (intptr_t)jsHTMLImageElementUseMap, (intptr_t)setJSHTMLImageElementUseMap },
-    { "vspace", DontDelete, (intptr_t)jsHTMLImageElementVspace, (intptr_t)setJSHTMLImageElementVspace },
-    { "width", DontDelete, (intptr_t)jsHTMLImageElementWidth, (intptr_t)setJSHTMLImageElementWidth },
-    { "complete", DontDelete|ReadOnly, (intptr_t)jsHTMLImageElementComplete, (intptr_t)0 },
-    { "lowsrc", DontDelete, (intptr_t)jsHTMLImageElementLowsrc, (intptr_t)setJSHTMLImageElementLowsrc },
-    { "naturalHeight", DontDelete|ReadOnly, (intptr_t)jsHTMLImageElementNaturalHeight, (intptr_t)0 },
-    { "naturalWidth", DontDelete|ReadOnly, (intptr_t)jsHTMLImageElementNaturalWidth, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsHTMLImageElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsHTMLImageElementY, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLImageElementConstructor, (intptr_t)0 },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementName), (intptr_t)setJSHTMLImageElementName },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementAlign), (intptr_t)setJSHTMLImageElementAlign },
+    { "alt", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementAlt), (intptr_t)setJSHTMLImageElementAlt },
+    { "border", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementBorder), (intptr_t)setJSHTMLImageElementBorder },
+    { "height", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementHeight), (intptr_t)setJSHTMLImageElementHeight },
+    { "hspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementHspace), (intptr_t)setJSHTMLImageElementHspace },
+    { "isMap", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementIsMap), (intptr_t)setJSHTMLImageElementIsMap },
+    { "longDesc", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementLongDesc), (intptr_t)setJSHTMLImageElementLongDesc },
+    { "src", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementSrc), (intptr_t)setJSHTMLImageElementSrc },
+    { "useMap", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementUseMap), (intptr_t)setJSHTMLImageElementUseMap },
+    { "vspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementVspace), (intptr_t)setJSHTMLImageElementVspace },
+    { "width", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementWidth), (intptr_t)setJSHTMLImageElementWidth },
+    { "complete", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementComplete), (intptr_t)0 },
+    { "lowsrc", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementLowsrc), (intptr_t)setJSHTMLImageElementLowsrc },
+    { "naturalHeight", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementNaturalHeight), (intptr_t)0 },
+    { "naturalWidth", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementNaturalWidth), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementY), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLImageElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -95,7 +95,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -157,153 +157,171 @@ bool JSHTMLImageElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSHTMLImageElement, Base>(exec, &JSHTMLImageElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLImageElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
+    return result;
 }
 
-JSValue jsHTMLImageElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::alignAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::alignAttr));
+    return result;
 }
 
-JSValue jsHTMLImageElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementAlt(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::altAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::altAttr));
+    return result;
 }
 
-JSValue jsHTMLImageElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementBorder(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::borderAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::borderAttr));
+    return result;
 }
 
-JSValue jsHTMLImageElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsNumber(exec, imp->height());
+    JSValue result = jsNumber(exec, imp->height());
+    return result;
 }
 
-JSValue jsHTMLImageElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementHspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsNumber(exec, imp->hspace());
+    JSValue result = jsNumber(exec, imp->hspace());
+    return result;
 }
 
-JSValue jsHTMLImageElementIsMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementIsMap(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsBoolean(imp->isMap());
+    JSValue result = jsBoolean(imp->isMap());
+    return result;
 }
 
-JSValue jsHTMLImageElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementLongDesc(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsString(exec, imp->getURLAttribute(HTMLNames::longdescAttr));
+    JSValue result = jsString(exec, imp->getURLAttribute(HTMLNames::longdescAttr));
+    return result;
 }
 
-JSValue jsHTMLImageElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementSrc(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsString(exec, imp->getURLAttribute(HTMLNames::srcAttr));
+    JSValue result = jsString(exec, imp->getURLAttribute(HTMLNames::srcAttr));
+    return result;
 }
 
-JSValue jsHTMLImageElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementUseMap(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::usemapAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::usemapAttr));
+    return result;
 }
 
-JSValue jsHTMLImageElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementVspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsNumber(exec, imp->vspace());
+    JSValue result = jsNumber(exec, imp->vspace());
+    return result;
 }
 
-JSValue jsHTMLImageElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsNumber(exec, imp->width());
+    JSValue result = jsNumber(exec, imp->width());
+    return result;
 }
 
-JSValue jsHTMLImageElementComplete(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementComplete(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsBoolean(imp->complete());
+    JSValue result = jsBoolean(imp->complete());
+    return result;
 }
 
-JSValue jsHTMLImageElementLowsrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementLowsrc(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsString(exec, imp->getURLAttribute(HTMLNames::lowsrcAttr));
+    JSValue result = jsString(exec, imp->getURLAttribute(HTMLNames::lowsrcAttr));
+    return result;
 }
 
-JSValue jsHTMLImageElementNaturalHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementNaturalHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsNumber(exec, imp->naturalHeight());
+    JSValue result = jsNumber(exec, imp->naturalHeight());
+    return result;
 }
 
-JSValue jsHTMLImageElementNaturalWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementNaturalWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsNumber(exec, imp->naturalWidth());
+    JSValue result = jsNumber(exec, imp->naturalWidth());
+    return result;
 }
 
-JSValue jsHTMLImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsHTMLImageElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
-JSValue jsHTMLImageElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLImageElement* domObject = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
+    JSHTMLImageElement* domObject = static_cast<JSHTMLImageElement*>(asObject(slotBase));
     return JSHTMLImageElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLImageElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -313,79 +331,92 @@ void JSHTMLImageElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSHTMLImageElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
+    JSHTMLImageElement* castedThisObj = static_cast<JSHTMLImageElement*>(thisObject);
+    HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::nameAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLImageElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
+    JSHTMLImageElement* castedThisObj = static_cast<JSHTMLImageElement*>(thisObject);
+    HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::alignAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLImageElementAlt(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
+    JSHTMLImageElement* castedThisObj = static_cast<JSHTMLImageElement*>(thisObject);
+    HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::altAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLImageElementBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
+    JSHTMLImageElement* castedThisObj = static_cast<JSHTMLImageElement*>(thisObject);
+    HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::borderAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLImageElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
+    JSHTMLImageElement* castedThisObj = static_cast<JSHTMLImageElement*>(thisObject);
+    HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThisObj->impl());
     imp->setHeight(value.toInt32(exec));
 }
 
 void setJSHTMLImageElementHspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
+    JSHTMLImageElement* castedThisObj = static_cast<JSHTMLImageElement*>(thisObject);
+    HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThisObj->impl());
     imp->setHspace(value.toInt32(exec));
 }
 
 void setJSHTMLImageElementIsMap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
+    JSHTMLImageElement* castedThisObj = static_cast<JSHTMLImageElement*>(thisObject);
+    HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThisObj->impl());
     imp->setIsMap(value.toBoolean(exec));
 }
 
 void setJSHTMLImageElementLongDesc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
+    JSHTMLImageElement* castedThisObj = static_cast<JSHTMLImageElement*>(thisObject);
+    HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::longdescAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLImageElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
+    JSHTMLImageElement* castedThisObj = static_cast<JSHTMLImageElement*>(thisObject);
+    HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::srcAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLImageElementUseMap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
+    JSHTMLImageElement* castedThisObj = static_cast<JSHTMLImageElement*>(thisObject);
+    HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::usemapAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLImageElementVspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
+    JSHTMLImageElement* castedThisObj = static_cast<JSHTMLImageElement*>(thisObject);
+    HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThisObj->impl());
     imp->setVspace(value.toInt32(exec));
 }
 
 void setJSHTMLImageElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
+    JSHTMLImageElement* castedThisObj = static_cast<JSHTMLImageElement*>(thisObject);
+    HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThisObj->impl());
     imp->setWidth(value.toInt32(exec));
 }
 
 void setJSHTMLImageElementLowsrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
+    JSHTMLImageElement* castedThisObj = static_cast<JSHTMLImageElement*>(thisObject);
+    HTMLImageElement* imp = static_cast<HTMLImageElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::lowsrcAttr, valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
index 403a98b2f0..9a368bca33 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLImageElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,38 +66,38 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLImageElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLImageElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLImageElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLImageElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLImageElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementAlt(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLImageElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLImageElementBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementBorder(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLImageElementBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLImageElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLImageElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLImageElementHspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementHspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLImageElementHspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLImageElementIsMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementIsMap(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLImageElementIsMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLImageElementLongDesc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementLongDesc(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLImageElementLongDesc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLImageElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementSrc(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLImageElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLImageElementUseMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementUseMap(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLImageElementUseMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLImageElementVspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementVspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLImageElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLImageElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLImageElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLImageElementComplete(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLImageElementLowsrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementComplete(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLImageElementLowsrc(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLImageElementLowsrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLImageElementNaturalHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLImageElementNaturalWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLImageElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLImageElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLImageElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementNaturalHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLImageElementNaturalWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLImageElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLImageElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLImageElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
index 5b65ab8ed7..3556c365ce 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
@@ -22,11 +22,15 @@
 #include "JSHTMLInputElement.h"
 
 #include "FileList.h"
+#include "HTMLElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "HTMLOptionElement.h"
 #include "JSFileList.h"
+#include "JSHTMLElement.h"
 #include "JSHTMLFormElement.h"
+#include "JSHTMLOptionElement.h"
 #include "JSValidityState.h"
 #include "KURL.h"
 #include "ValidityState.h"
@@ -43,40 +47,46 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLInputElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLInputElementTableValues[33] =
-{
-    { "defaultValue", DontDelete, (intptr_t)jsHTMLInputElementDefaultValue, (intptr_t)setJSHTMLInputElementDefaultValue },
-    { "defaultChecked", DontDelete, (intptr_t)jsHTMLInputElementDefaultChecked, (intptr_t)setJSHTMLInputElementDefaultChecked },
-    { "form", DontDelete|ReadOnly, (intptr_t)jsHTMLInputElementForm, (intptr_t)0 },
-    { "formNoValidate", DontDelete, (intptr_t)jsHTMLInputElementFormNoValidate, (intptr_t)setJSHTMLInputElementFormNoValidate },
-    { "validity", DontDelete|ReadOnly, (intptr_t)jsHTMLInputElementValidity, (intptr_t)0 },
-    { "accept", DontDelete, (intptr_t)jsHTMLInputElementAccept, (intptr_t)setJSHTMLInputElementAccept },
-    { "accessKey", DontDelete, (intptr_t)jsHTMLInputElementAccessKey, (intptr_t)setJSHTMLInputElementAccessKey },
-    { "align", DontDelete, (intptr_t)jsHTMLInputElementAlign, (intptr_t)setJSHTMLInputElementAlign },
-    { "alt", DontDelete, (intptr_t)jsHTMLInputElementAlt, (intptr_t)setJSHTMLInputElementAlt },
-    { "checked", DontDelete, (intptr_t)jsHTMLInputElementChecked, (intptr_t)setJSHTMLInputElementChecked },
-    { "disabled", DontDelete, (intptr_t)jsHTMLInputElementDisabled, (intptr_t)setJSHTMLInputElementDisabled },
-    { "autofocus", DontDelete, (intptr_t)jsHTMLInputElementAutofocus, (intptr_t)setJSHTMLInputElementAutofocus },
-    { "max", DontDelete, (intptr_t)jsHTMLInputElementMax, (intptr_t)setJSHTMLInputElementMax },
-    { "maxLength", DontDelete, (intptr_t)jsHTMLInputElementMaxLength, (intptr_t)setJSHTMLInputElementMaxLength },
-    { "min", DontDelete, (intptr_t)jsHTMLInputElementMin, (intptr_t)setJSHTMLInputElementMin },
-    { "multiple", DontDelete, (intptr_t)jsHTMLInputElementMultiple, (intptr_t)setJSHTMLInputElementMultiple },
-    { "name", DontDelete, (intptr_t)jsHTMLInputElementName, (intptr_t)setJSHTMLInputElementName },
-    { "pattern", DontDelete, (intptr_t)jsHTMLInputElementPattern, (intptr_t)setJSHTMLInputElementPattern },
-    { "placeholder", DontDelete, (intptr_t)jsHTMLInputElementPlaceholder, (intptr_t)setJSHTMLInputElementPlaceholder },
-    { "readOnly", DontDelete, (intptr_t)jsHTMLInputElementReadOnly, (intptr_t)setJSHTMLInputElementReadOnly },
-    { "required", DontDelete, (intptr_t)jsHTMLInputElementRequired, (intptr_t)setJSHTMLInputElementRequired },
-    { "size", DontDelete, (intptr_t)jsHTMLInputElementSize, (intptr_t)setJSHTMLInputElementSize },
-    { "src", DontDelete, (intptr_t)jsHTMLInputElementSrc, (intptr_t)setJSHTMLInputElementSrc },
-    { "type", DontDelete, (intptr_t)jsHTMLInputElementType, (intptr_t)setJSHTMLInputElementType },
-    { "useMap", DontDelete, (intptr_t)jsHTMLInputElementUseMap, (intptr_t)setJSHTMLInputElementUseMap },
-    { "value", DontDelete, (intptr_t)jsHTMLInputElementValue, (intptr_t)setJSHTMLInputElementValue },
-    { "willValidate", DontDelete|ReadOnly, (intptr_t)jsHTMLInputElementWillValidate, (intptr_t)0 },
-    { "indeterminate", DontDelete, (intptr_t)jsHTMLInputElementIndeterminate, (intptr_t)setJSHTMLInputElementIndeterminate },
-    { "selectionStart", DontDelete, (intptr_t)jsHTMLInputElementSelectionStart, (intptr_t)setJSHTMLInputElementSelectionStart },
-    { "selectionEnd", DontDelete, (intptr_t)jsHTMLInputElementSelectionEnd, (intptr_t)setJSHTMLInputElementSelectionEnd },
-    { "files", DontDelete|ReadOnly, (intptr_t)jsHTMLInputElementFiles, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLInputElementConstructor, (intptr_t)0 },
+static const HashTableValue JSHTMLInputElementTableValues[39] =
+{
+    { "defaultValue", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementDefaultValue), (intptr_t)setJSHTMLInputElementDefaultValue },
+    { "defaultChecked", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementDefaultChecked), (intptr_t)setJSHTMLInputElementDefaultChecked },
+    { "form", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementForm), (intptr_t)0 },
+    { "formNoValidate", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementFormNoValidate), (intptr_t)setJSHTMLInputElementFormNoValidate },
+    { "validity", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementValidity), (intptr_t)0 },
+    { "accept", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementAccept), (intptr_t)setJSHTMLInputElementAccept },
+    { "accessKey", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementAccessKey), (intptr_t)setJSHTMLInputElementAccessKey },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementAlign), (intptr_t)setJSHTMLInputElementAlign },
+    { "alt", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementAlt), (intptr_t)setJSHTMLInputElementAlt },
+    { "checked", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementChecked), (intptr_t)setJSHTMLInputElementChecked },
+    { "disabled", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementDisabled), (intptr_t)setJSHTMLInputElementDisabled },
+    { "autofocus", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementAutofocus), (intptr_t)setJSHTMLInputElementAutofocus },
+    { "list", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementList), (intptr_t)0 },
+    { "max", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementMax), (intptr_t)setJSHTMLInputElementMax },
+    { "maxLength", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementMaxLength), (intptr_t)setJSHTMLInputElementMaxLength },
+    { "min", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementMin), (intptr_t)setJSHTMLInputElementMin },
+    { "multiple", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementMultiple), (intptr_t)setJSHTMLInputElementMultiple },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementName), (intptr_t)setJSHTMLInputElementName },
+    { "pattern", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementPattern), (intptr_t)setJSHTMLInputElementPattern },
+    { "placeholder", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementPlaceholder), (intptr_t)setJSHTMLInputElementPlaceholder },
+    { "readOnly", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementReadOnly), (intptr_t)setJSHTMLInputElementReadOnly },
+    { "required", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementRequired), (intptr_t)setJSHTMLInputElementRequired },
+    { "size", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementSize), (intptr_t)setJSHTMLInputElementSize },
+    { "src", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementSrc), (intptr_t)setJSHTMLInputElementSrc },
+    { "step", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementStep), (intptr_t)setJSHTMLInputElementStep },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementType), (intptr_t)setJSHTMLInputElementType },
+    { "useMap", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementUseMap), (intptr_t)setJSHTMLInputElementUseMap },
+    { "value", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementValue), (intptr_t)setJSHTMLInputElementValue },
+    { "valueAsDate", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementValueAsDate), (intptr_t)setJSHTMLInputElementValueAsDate },
+    { "valueAsNumber", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementValueAsNumber), (intptr_t)setJSHTMLInputElementValueAsNumber },
+    { "selectedOption", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementSelectedOption), (intptr_t)0 },
+    { "willValidate", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementWillValidate), (intptr_t)0 },
+    { "validationMessage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementValidationMessage), (intptr_t)0 },
+    { "indeterminate", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementIndeterminate), (intptr_t)setJSHTMLInputElementIndeterminate },
+    { "selectionStart", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementSelectionStart), (intptr_t)setJSHTMLInputElementSelectionStart },
+    { "selectionEnd", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementSelectionEnd), (intptr_t)setJSHTMLInputElementSelectionEnd },
+    { "files", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementFiles), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLInputElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -84,7 +94,7 @@ static JSC_CONST_HASHTABLE HashTable JSHTMLInputElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 2047, JSHTMLInputElementTableValues, 0 };
 #else
-    { 73, 63, JSHTMLInputElementTableValues, 0 };
+    { 133, 127, JSHTMLInputElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -115,7 +125,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -136,21 +146,23 @@ bool JSHTMLInputElementConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 /* Hash table for prototype */
 
-static const HashTableValue JSHTMLInputElementPrototypeTableValues[6] =
+static const HashTableValue JSHTMLInputElementPrototypeTableValues[8] =
 {
-    { "checkValidity", DontDelete|Function, (intptr_t)jsHTMLInputElementPrototypeFunctionCheckValidity, (intptr_t)0 },
-    { "setCustomValidity", DontDelete|Function, (intptr_t)jsHTMLInputElementPrototypeFunctionSetCustomValidity, (intptr_t)1 },
-    { "select", DontDelete|Function, (intptr_t)jsHTMLInputElementPrototypeFunctionSelect, (intptr_t)0 },
-    { "click", DontDelete|Function, (intptr_t)jsHTMLInputElementPrototypeFunctionClick, (intptr_t)0 },
-    { "setSelectionRange", DontDelete|Function, (intptr_t)jsHTMLInputElementPrototypeFunctionSetSelectionRange, (intptr_t)2 },
+    { "stepUp", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLInputElementPrototypeFunctionStepUp), (intptr_t)1 },
+    { "stepDown", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLInputElementPrototypeFunctionStepDown), (intptr_t)1 },
+    { "checkValidity", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLInputElementPrototypeFunctionCheckValidity), (intptr_t)0 },
+    { "setCustomValidity", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLInputElementPrototypeFunctionSetCustomValidity), (intptr_t)1 },
+    { "select", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLInputElementPrototypeFunctionSelect), (intptr_t)0 },
+    { "click", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLInputElementPrototypeFunctionClick), (intptr_t)0 },
+    { "setSelectionRange", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLInputElementPrototypeFunctionSetSelectionRange), (intptr_t)2 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSHTMLInputElementPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 15, JSHTMLInputElementPrototypeTableValues, 0 };
+    { 16383, JSHTMLInputElementPrototypeTableValues, 0 };
 #else
-    { 16, 15, JSHTMLInputElementPrototypeTableValues, 0 };
+    { 17, 15, JSHTMLInputElementPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSHTMLInputElementPrototype::s_info = { "HTMLInputElementPrototype", 0, &JSHTMLInputElementPrototypeTable, 0 };
@@ -192,251 +204,333 @@ bool JSHTMLInputElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSHTMLInputElement, Base>(exec, &JSHTMLInputElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLInputElementDefaultValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementDefaultValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsString(exec, imp->defaultValue());
+    JSValue result = jsString(exec, imp->defaultValue());
+    return result;
 }
 
-JSValue jsHTMLInputElementDefaultChecked(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementDefaultChecked(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsBoolean(imp->defaultChecked());
+    JSValue result = jsBoolean(imp->defaultChecked());
+    return result;
 }
 
-JSValue jsHTMLInputElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementForm(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    return result;
 }
 
-JSValue jsHTMLInputElementFormNoValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementFormNoValidate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsBoolean(imp->formNoValidate());
+    JSValue result = jsBoolean(imp->formNoValidate());
+    return result;
 }
 
-JSValue jsHTMLInputElementValidity(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementValidity(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->validity()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->validity()));
+    return result;
+}
+
+JSValue jsHTMLInputElementAccept(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
+    JSValue result = jsString(exec, imp->accept());
+    return result;
+}
+
+JSValue jsHTMLInputElementAccessKey(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
+    JSValue result = jsString(exec, imp->accessKey());
+    return result;
 }
 
-JSValue jsHTMLInputElementAccept(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsString(exec, imp->accept());
+    JSValue result = jsString(exec, imp->align());
+    return result;
 }
 
-JSValue jsHTMLInputElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementAlt(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsString(exec, imp->accessKey());
+    JSValue result = jsString(exec, imp->alt());
+    return result;
 }
 
-JSValue jsHTMLInputElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementChecked(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsString(exec, imp->align());
+    JSValue result = jsBoolean(imp->checked());
+    return result;
 }
 
-JSValue jsHTMLInputElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementDisabled(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsString(exec, imp->alt());
+    JSValue result = jsBoolean(imp->disabled());
+    return result;
 }
 
-JSValue jsHTMLInputElementChecked(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementAutofocus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsBoolean(imp->checked());
+    JSValue result = jsBoolean(imp->autofocus());
+    return result;
 }
 
-JSValue jsHTMLInputElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementList(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsBoolean(imp->disabled());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->list()));
+    return result;
 }
 
-JSValue jsHTMLInputElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementMax(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsBoolean(imp->autofocus());
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::maxAttr));
+    return result;
 }
 
-JSValue jsHTMLInputElementMax(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementMaxLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::maxAttr));
+    JSValue result = jsNumber(exec, imp->maxLength());
+    return result;
 }
 
-JSValue jsHTMLInputElementMaxLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementMin(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsNumber(exec, imp->maxLength());
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::minAttr));
+    return result;
 }
 
-JSValue jsHTMLInputElementMin(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementMultiple(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::minAttr));
+    JSValue result = jsBoolean(imp->multiple());
+    return result;
 }
 
-JSValue jsHTMLInputElementMultiple(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsBoolean(imp->multiple());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsHTMLInputElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementPattern(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::patternAttr));
+    return result;
 }
 
-JSValue jsHTMLInputElementPattern(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementPlaceholder(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::patternAttr));
+    JSValue result = jsString(exec, imp->placeholder());
+    return result;
 }
 
-JSValue jsHTMLInputElementPlaceholder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementReadOnly(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsString(exec, imp->placeholder());
+    JSValue result = jsBoolean(imp->readOnly());
+    return result;
 }
 
-JSValue jsHTMLInputElementReadOnly(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsBoolean(imp->readOnly());
+    JSValue result = jsBoolean(imp->required());
+    return result;
 }
 
-JSValue jsHTMLInputElementRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementSize(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsBoolean(imp->required());
+    JSValue result = jsNumber(exec, imp->size());
+    return result;
 }
 
-JSValue jsHTMLInputElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementSrc(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsNumber(exec, imp->size());
+    JSValue result = jsString(exec, imp->src());
+    return result;
 }
 
-JSValue jsHTMLInputElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementStep(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsString(exec, imp->src());
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::stepAttr));
+    return result;
 }
 
-JSValue jsHTMLInputElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     return castedThis->type(exec);
 }
 
-JSValue jsHTMLInputElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementUseMap(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
+    JSValue result = jsString(exec, imp->useMap());
+    return result;
+}
+
+JSValue jsHTMLInputElementValue(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
+    JSValue result = jsString(exec, imp->value());
+    return result;
+}
+
+JSValue jsHTMLInputElementValueAsDate(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
+    JSValue result = jsDateOrNull(exec, imp->valueAsDate());
+    return result;
+}
+
+JSValue jsHTMLInputElementValueAsNumber(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsString(exec, imp->useMap());
+    JSValue result = jsNumber(exec, imp->valueAsNumber());
+    return result;
 }
 
-JSValue jsHTMLInputElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementSelectedOption(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsString(exec, imp->value());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->selectedOption()));
+    return result;
 }
 
-JSValue jsHTMLInputElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementWillValidate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsBoolean(imp->willValidate());
+    JSValue result = jsBoolean(imp->willValidate());
+    return result;
 }
 
-JSValue jsHTMLInputElementIndeterminate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementValidationMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return jsBoolean(imp->indeterminate());
+    JSValue result = jsString(exec, imp->validationMessage());
+    return result;
 }
 
-JSValue jsHTMLInputElementSelectionStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementIndeterminate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
+    JSValue result = jsBoolean(imp->indeterminate());
+    return result;
+}
+
+JSValue jsHTMLInputElementSelectionStart(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     return castedThis->selectionStart(exec);
 }
 
-JSValue jsHTMLInputElementSelectionEnd(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementSelectionEnd(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     return castedThis->selectionEnd(exec);
 }
 
-JSValue jsHTMLInputElementFiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementFiles(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->files()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->files()));
+    return result;
 }
 
-JSValue jsHTMLInputElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLInputElement* domObject = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    JSHTMLInputElement* domObject = static_cast<JSHTMLInputElement*>(asObject(slotBase));
     return JSHTMLInputElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLInputElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -446,73 +540,85 @@ void JSHTMLInputElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSHTMLInputElementDefaultValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setDefaultValue(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLInputElementDefaultChecked(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setDefaultChecked(value.toBoolean(exec));
 }
 
 void setJSHTMLInputElementFormNoValidate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setFormNoValidate(value.toBoolean(exec));
 }
 
 void setJSHTMLInputElementAccept(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setAccept(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLInputElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLInputElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLInputElementAlt(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setAlt(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLInputElementChecked(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setChecked(value.toBoolean(exec));
 }
 
 void setJSHTMLInputElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setDisabled(value.toBoolean(exec));
 }
 
 void setJSHTMLInputElementAutofocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setAutofocus(value.toBoolean(exec));
 }
 
 void setJSHTMLInputElementMax(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setAttribute(HTMLNames::maxAttr, value.toString(exec));
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
+    imp->setAttribute(HTMLNames::maxAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLInputElementMaxLength(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setMaxLength(value.toInt32(exec), ec);
     setDOMException(exec, ec);
@@ -520,79 +626,117 @@ void setJSHTMLInputElementMaxLength(ExecState* exec, JSObject* thisObject, JSVal
 
 void setJSHTMLInputElementMin(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setAttribute(HTMLNames::minAttr, value.toString(exec));
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
+    imp->setAttribute(HTMLNames::minAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLInputElementMultiple(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setMultiple(value.toBoolean(exec));
 }
 
 void setJSHTMLInputElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLInputElementPattern(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setAttribute(HTMLNames::patternAttr, value.toString(exec));
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
+    imp->setAttribute(HTMLNames::patternAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLInputElementPlaceholder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setPlaceholder(value.toString(exec));
 }
 
 void setJSHTMLInputElementReadOnly(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setReadOnly(value.toBoolean(exec));
 }
 
 void setJSHTMLInputElementRequired(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setRequired(value.toBoolean(exec));
 }
 
 void setJSHTMLInputElementSize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setSize(value.toInt32(exec));
 }
 
 void setJSHTMLInputElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setSrc(valueToStringWithNullCheck(exec, value));
 }
 
+void setJSHTMLInputElementStep(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
+    imp->setAttribute(HTMLNames::stepAttr, valueToStringWithNullCheck(exec, value));
+}
+
 void setJSHTMLInputElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLInputElementUseMap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setUseMap(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLInputElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
+void setJSHTMLInputElementValueAsDate(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    imp->setValueAsDate(valueToDate(exec, value), ec);
+    setDOMException(exec, ec);
+}
+
+void setJSHTMLInputElementValueAsNumber(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    imp->setValueAsNumber(value.toNumber(exec), ec);
+    setDOMException(exec, ec);
+}
+
 void setJSHTMLInputElementIndeterminate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(thisObject);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
     imp->setIndeterminate(value.toBoolean(exec));
 }
 
@@ -611,6 +755,52 @@ JSValue JSHTMLInputElement::getConstructor(ExecState* exec, JSGlobalObject* glob
     return getDOMConstructor<JSHTMLInputElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
+JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionStepUp(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLInputElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(asObject(thisValue));
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+
+    int argsCount = args.size();
+    if (argsCount < 1) {
+        imp->stepUp(ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    int n = args.at(0).toInt32(exec);
+
+    imp->stepUp(n, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionStepDown(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLInputElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(asObject(thisValue));
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+
+    int argsCount = args.size();
+    if (argsCount < 1) {
+        imp->stepDown(ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    int n = args.at(0).toInt32(exec);
+
+    imp->stepDown(n, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
 JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionCheckValidity(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
index 5ed72b60a0..85d1c4006d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -69,7 +69,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLInputElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,6 +78,8 @@ protected:
 
 // Functions
 
+JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionStepUp(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionStepDown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionCheckValidity(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSetCustomValidity(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSelect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
@@ -85,65 +87,74 @@ JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionClick(JSC::ExecSta
 JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSetSelectionRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLInputElementDefaultValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementDefaultValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementDefaultValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementDefaultChecked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementDefaultChecked(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementDefaultChecked(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLInputElementFormNoValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementForm(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLInputElementFormNoValidate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementFormNoValidate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementValidity(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLInputElementAccept(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementValidity(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLInputElementAccept(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementAccept(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementAccessKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementAlt(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementChecked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementChecked(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementChecked(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementDisabled(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementAutofocus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementMax(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementList(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLInputElementMax(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementMax(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementMaxLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementMaxLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementMaxLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementMin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementMin(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementMin(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementMultiple(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementMultiple(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementMultiple(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementPattern(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementPattern(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementPattern(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementPlaceholder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementPlaceholder(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementPlaceholder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementReadOnly(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementReadOnly(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementReadOnly(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementRequired(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementSize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementSrc(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementStep(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLInputElementStep(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementUseMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementUseMap(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementUseMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLInputElementIndeterminate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementValueAsDate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLInputElementValueAsDate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementValueAsNumber(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLInputElementValueAsNumber(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementSelectedOption(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLInputElementWillValidate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLInputElementValidationMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLInputElementIndeterminate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementIndeterminate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementSelectionStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementSelectionStart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementSelectionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementSelectionEnd(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementSelectionEnd(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLInputElementSelectionEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLInputElementFiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLInputElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementFiles(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLInputElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
index 41814f42fc..4ad29e014c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
@@ -38,9 +38,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLIsIndexElement);
 
 static const HashTableValue JSHTMLIsIndexElementTableValues[4] =
 {
-    { "form", DontDelete|ReadOnly, (intptr_t)jsHTMLIsIndexElementForm, (intptr_t)0 },
-    { "prompt", DontDelete, (intptr_t)jsHTMLIsIndexElementPrompt, (intptr_t)setJSHTMLIsIndexElementPrompt },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLIsIndexElementConstructor, (intptr_t)0 },
+    { "form", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIsIndexElementForm), (intptr_t)0 },
+    { "prompt", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIsIndexElementPrompt), (intptr_t)setJSHTMLIsIndexElementPrompt },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLIsIndexElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -141,25 +141,27 @@ bool JSHTMLIsIndexElement::getOwnPropertyDescriptor(ExecState* exec, const Ident
     return getStaticValueDescriptor<JSHTMLIsIndexElement, Base>(exec, &JSHTMLIsIndexElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLIsIndexElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIsIndexElementForm(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIsIndexElement* castedThis = static_cast<JSHTMLIsIndexElement*>(asObject(slot.slotBase()));
+    JSHTMLIsIndexElement* castedThis = static_cast<JSHTMLIsIndexElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLIsIndexElement* imp = static_cast<HTMLIsIndexElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    return result;
 }
 
-JSValue jsHTMLIsIndexElementPrompt(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIsIndexElementPrompt(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIsIndexElement* castedThis = static_cast<JSHTMLIsIndexElement*>(asObject(slot.slotBase()));
+    JSHTMLIsIndexElement* castedThis = static_cast<JSHTMLIsIndexElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLIsIndexElement* imp = static_cast<HTMLIsIndexElement*>(castedThis->impl());
-    return jsString(exec, imp->prompt());
+    JSValue result = jsString(exec, imp->prompt());
+    return result;
 }
 
-JSValue jsHTMLIsIndexElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIsIndexElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLIsIndexElement* domObject = static_cast<JSHTMLIsIndexElement*>(asObject(slot.slotBase()));
+    JSHTMLIsIndexElement* domObject = static_cast<JSHTMLIsIndexElement*>(asObject(slotBase));
     return JSHTMLIsIndexElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLIsIndexElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -169,7 +171,8 @@ void JSHTMLIsIndexElement::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSHTMLIsIndexElementPrompt(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLIsIndexElement* imp = static_cast<HTMLIsIndexElement*>(static_cast<JSHTMLIsIndexElement*>(thisObject)->impl());
+    JSHTMLIsIndexElement* castedThisObj = static_cast<JSHTMLIsIndexElement*>(thisObject);
+    HTMLIsIndexElement* imp = static_cast<HTMLIsIndexElement*>(castedThisObj->impl());
     imp->setPrompt(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
index 8f21361e63..0f15e56472 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLIsIndexElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,10 +66,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLIsIndexElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLIsIndexElementPrompt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIsIndexElementForm(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLIsIndexElementPrompt(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLIsIndexElementPrompt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLIsIndexElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIsIndexElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
index 2cc828c8cf..6290419e45 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
@@ -37,9 +37,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLLIElement);
 
 static const HashTableValue JSHTMLLIElementTableValues[4] =
 {
-    { "type", DontDelete, (intptr_t)jsHTMLLIElementType, (intptr_t)setJSHTMLLIElementType },
-    { "value", DontDelete, (intptr_t)jsHTMLLIElementValue, (intptr_t)setJSHTMLLIElementValue },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLLIElementConstructor, (intptr_t)0 },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLIElementType), (intptr_t)setJSHTMLLIElementType },
+    { "value", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLIElementValue), (intptr_t)setJSHTMLLIElementValue },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLIElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -78,7 +78,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -140,25 +140,27 @@ bool JSHTMLLIElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSHTMLLIElement, Base>(exec, &JSHTMLLIElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLLIElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLIElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLIElement* castedThis = static_cast<JSHTMLLIElement*>(asObject(slot.slotBase()));
+    JSHTMLLIElement* castedThis = static_cast<JSHTMLLIElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLIElement* imp = static_cast<HTMLLIElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsHTMLLIElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLIElementValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLIElement* castedThis = static_cast<JSHTMLLIElement*>(asObject(slot.slotBase()));
+    JSHTMLLIElement* castedThis = static_cast<JSHTMLLIElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLIElement* imp = static_cast<HTMLLIElement*>(castedThis->impl());
-    return jsNumber(exec, imp->value());
+    JSValue result = jsNumber(exec, imp->value());
+    return result;
 }
 
-JSValue jsHTMLLIElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLIElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLIElement* domObject = static_cast<JSHTMLLIElement*>(asObject(slot.slotBase()));
+    JSHTMLLIElement* domObject = static_cast<JSHTMLLIElement*>(asObject(slotBase));
     return JSHTMLLIElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLLIElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -168,13 +170,15 @@ void JSHTMLLIElement::put(ExecState* exec, const Identifier& propertyName, JSVal
 
 void setJSHTMLLIElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLLIElement* imp = static_cast<HTMLLIElement*>(static_cast<JSHTMLLIElement*>(thisObject)->impl());
+    JSHTMLLIElement* castedThisObj = static_cast<JSHTMLLIElement*>(thisObject);
+    HTMLLIElement* imp = static_cast<HTMLLIElement*>(castedThisObj->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLLIElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLLIElement* imp = static_cast<HTMLLIElement*>(static_cast<JSHTMLLIElement*>(thisObject)->impl());
+    JSHTMLLIElement* castedThisObj = static_cast<JSHTMLLIElement*>(thisObject);
+    HTMLLIElement* imp = static_cast<HTMLLIElement*>(castedThisObj->impl());
     imp->setValue(value.toInt32(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
index 948746cd60..aa4b467328 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLLIElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,11 +66,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLLIElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLIElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLLIElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLLIElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLIElementValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLLIElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLLIElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLIElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
index 214ed4f427..ab18e075f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
@@ -38,10 +38,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLLabelElement);
 
 static const HashTableValue JSHTMLLabelElementTableValues[5] =
 {
-    { "form", DontDelete|ReadOnly, (intptr_t)jsHTMLLabelElementForm, (intptr_t)0 },
-    { "accessKey", DontDelete, (intptr_t)jsHTMLLabelElementAccessKey, (intptr_t)setJSHTMLLabelElementAccessKey },
-    { "htmlFor", DontDelete, (intptr_t)jsHTMLLabelElementHtmlFor, (intptr_t)setJSHTMLLabelElementHtmlFor },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLLabelElementConstructor, (intptr_t)0 },
+    { "form", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLabelElementForm), (intptr_t)0 },
+    { "accessKey", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLabelElementAccessKey), (intptr_t)setJSHTMLLabelElementAccessKey },
+    { "htmlFor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLabelElementHtmlFor), (intptr_t)setJSHTMLLabelElementHtmlFor },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLabelElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -142,33 +142,36 @@ bool JSHTMLLabelElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSHTMLLabelElement, Base>(exec, &JSHTMLLabelElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLLabelElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLabelElementForm(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLabelElement* castedThis = static_cast<JSHTMLLabelElement*>(asObject(slot.slotBase()));
+    JSHTMLLabelElement* castedThis = static_cast<JSHTMLLabelElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    return result;
 }
 
-JSValue jsHTMLLabelElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLabelElementAccessKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLabelElement* castedThis = static_cast<JSHTMLLabelElement*>(asObject(slot.slotBase()));
+    JSHTMLLabelElement* castedThis = static_cast<JSHTMLLabelElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(castedThis->impl());
-    return jsString(exec, imp->accessKey());
+    JSValue result = jsString(exec, imp->accessKey());
+    return result;
 }
 
-JSValue jsHTMLLabelElementHtmlFor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLabelElementHtmlFor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLabelElement* castedThis = static_cast<JSHTMLLabelElement*>(asObject(slot.slotBase()));
+    JSHTMLLabelElement* castedThis = static_cast<JSHTMLLabelElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(castedThis->impl());
-    return jsString(exec, imp->htmlFor());
+    JSValue result = jsString(exec, imp->htmlFor());
+    return result;
 }
 
-JSValue jsHTMLLabelElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLabelElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLabelElement* domObject = static_cast<JSHTMLLabelElement*>(asObject(slot.slotBase()));
+    JSHTMLLabelElement* domObject = static_cast<JSHTMLLabelElement*>(asObject(slotBase));
     return JSHTMLLabelElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLLabelElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -178,13 +181,15 @@ void JSHTMLLabelElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSHTMLLabelElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(static_cast<JSHTMLLabelElement*>(thisObject)->impl());
+    JSHTMLLabelElement* castedThisObj = static_cast<JSHTMLLabelElement*>(thisObject);
+    HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(castedThisObj->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLLabelElementHtmlFor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(static_cast<JSHTMLLabelElement*>(thisObject)->impl());
+    JSHTMLLabelElement* castedThisObj = static_cast<JSHTMLLabelElement*>(thisObject);
+    HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(castedThisObj->impl());
     imp->setHtmlFor(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
index 3577f5fa5b..2907b6ba73 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLLabelElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,12 +66,12 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLLabelElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLLabelElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLabelElementForm(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLLabelElementAccessKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLLabelElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLLabelElementHtmlFor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLabelElementHtmlFor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLLabelElementHtmlFor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLLabelElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLabelElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
index 000b301c0c..bb7ce714a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
@@ -38,10 +38,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLLegendElement);
 
 static const HashTableValue JSHTMLLegendElementTableValues[5] =
 {
-    { "form", DontDelete|ReadOnly, (intptr_t)jsHTMLLegendElementForm, (intptr_t)0 },
-    { "accessKey", DontDelete, (intptr_t)jsHTMLLegendElementAccessKey, (intptr_t)setJSHTMLLegendElementAccessKey },
-    { "align", DontDelete, (intptr_t)jsHTMLLegendElementAlign, (intptr_t)setJSHTMLLegendElementAlign },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLLegendElementConstructor, (intptr_t)0 },
+    { "form", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLegendElementForm), (intptr_t)0 },
+    { "accessKey", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLegendElementAccessKey), (intptr_t)setJSHTMLLegendElementAccessKey },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLegendElementAlign), (intptr_t)setJSHTMLLegendElementAlign },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLegendElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -142,33 +142,36 @@ bool JSHTMLLegendElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSHTMLLegendElement, Base>(exec, &JSHTMLLegendElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLLegendElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLegendElementForm(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLegendElement* castedThis = static_cast<JSHTMLLegendElement*>(asObject(slot.slotBase()));
+    JSHTMLLegendElement* castedThis = static_cast<JSHTMLLegendElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    return result;
 }
 
-JSValue jsHTMLLegendElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLegendElementAccessKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLegendElement* castedThis = static_cast<JSHTMLLegendElement*>(asObject(slot.slotBase()));
+    JSHTMLLegendElement* castedThis = static_cast<JSHTMLLegendElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(castedThis->impl());
-    return jsString(exec, imp->accessKey());
+    JSValue result = jsString(exec, imp->accessKey());
+    return result;
 }
 
-JSValue jsHTMLLegendElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLegendElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLegendElement* castedThis = static_cast<JSHTMLLegendElement*>(asObject(slot.slotBase()));
+    JSHTMLLegendElement* castedThis = static_cast<JSHTMLLegendElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(castedThis->impl());
-    return jsString(exec, imp->align());
+    JSValue result = jsString(exec, imp->align());
+    return result;
 }
 
-JSValue jsHTMLLegendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLegendElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLegendElement* domObject = static_cast<JSHTMLLegendElement*>(asObject(slot.slotBase()));
+    JSHTMLLegendElement* domObject = static_cast<JSHTMLLegendElement*>(asObject(slotBase));
     return JSHTMLLegendElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLLegendElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -178,13 +181,15 @@ void JSHTMLLegendElement::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSHTMLLegendElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(static_cast<JSHTMLLegendElement*>(thisObject)->impl());
+    JSHTMLLegendElement* castedThisObj = static_cast<JSHTMLLegendElement*>(thisObject);
+    HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(castedThisObj->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLLegendElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(static_cast<JSHTMLLegendElement*>(thisObject)->impl());
+    JSHTMLLegendElement* castedThisObj = static_cast<JSHTMLLegendElement*>(thisObject);
+    HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(castedThisObj->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
index 420e05d0c7..7d5fcff507 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLLegendElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,12 +66,12 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLLegendElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLLegendElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLegendElementForm(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLLegendElementAccessKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLLegendElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLLegendElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLegendElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLLegendElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLLegendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLegendElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
index 3283d26b96..7fa9799558 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
@@ -38,17 +38,17 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLLinkElement);
 
 static const HashTableValue JSHTMLLinkElementTableValues[12] =
 {
-    { "disabled", DontDelete, (intptr_t)jsHTMLLinkElementDisabled, (intptr_t)setJSHTMLLinkElementDisabled },
-    { "charset", DontDelete, (intptr_t)jsHTMLLinkElementCharset, (intptr_t)setJSHTMLLinkElementCharset },
-    { "href", DontDelete, (intptr_t)jsHTMLLinkElementHref, (intptr_t)setJSHTMLLinkElementHref },
-    { "hreflang", DontDelete, (intptr_t)jsHTMLLinkElementHreflang, (intptr_t)setJSHTMLLinkElementHreflang },
-    { "media", DontDelete, (intptr_t)jsHTMLLinkElementMedia, (intptr_t)setJSHTMLLinkElementMedia },
-    { "rel", DontDelete, (intptr_t)jsHTMLLinkElementRel, (intptr_t)setJSHTMLLinkElementRel },
-    { "rev", DontDelete, (intptr_t)jsHTMLLinkElementRev, (intptr_t)setJSHTMLLinkElementRev },
-    { "target", DontDelete, (intptr_t)jsHTMLLinkElementTarget, (intptr_t)setJSHTMLLinkElementTarget },
-    { "type", DontDelete, (intptr_t)jsHTMLLinkElementType, (intptr_t)setJSHTMLLinkElementType },
-    { "sheet", DontDelete|ReadOnly, (intptr_t)jsHTMLLinkElementSheet, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLLinkElementConstructor, (intptr_t)0 },
+    { "disabled", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLinkElementDisabled), (intptr_t)setJSHTMLLinkElementDisabled },
+    { "charset", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLinkElementCharset), (intptr_t)setJSHTMLLinkElementCharset },
+    { "href", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLinkElementHref), (intptr_t)setJSHTMLLinkElementHref },
+    { "hreflang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLinkElementHreflang), (intptr_t)setJSHTMLLinkElementHreflang },
+    { "media", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLinkElementMedia), (intptr_t)setJSHTMLLinkElementMedia },
+    { "rel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLinkElementRel), (intptr_t)setJSHTMLLinkElementRel },
+    { "rev", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLinkElementRev), (intptr_t)setJSHTMLLinkElementRev },
+    { "target", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLinkElementTarget), (intptr_t)setJSHTMLLinkElementTarget },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLinkElementType), (intptr_t)setJSHTMLLinkElementType },
+    { "sheet", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLinkElementSheet), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLLinkElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -87,7 +87,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -149,89 +149,99 @@ bool JSHTMLLinkElement::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSHTMLLinkElement, Base>(exec, &JSHTMLLinkElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLLinkElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementDisabled(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()));
+    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThis->impl());
-    return jsBoolean(imp->disabled());
+    JSValue result = jsBoolean(imp->disabled());
+    return result;
 }
 
-JSValue jsHTMLLinkElementCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementCharset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()));
+    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThis->impl());
-    return jsString(exec, imp->charset());
+    JSValue result = jsString(exec, imp->charset());
+    return result;
 }
 
-JSValue jsHTMLLinkElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()));
+    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThis->impl());
-    return jsString(exec, imp->href());
+    JSValue result = jsString(exec, imp->href());
+    return result;
 }
 
-JSValue jsHTMLLinkElementHreflang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementHreflang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()));
+    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThis->impl());
-    return jsString(exec, imp->hreflang());
+    JSValue result = jsString(exec, imp->hreflang());
+    return result;
 }
 
-JSValue jsHTMLLinkElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementMedia(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()));
+    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThis->impl());
-    return jsString(exec, imp->media());
+    JSValue result = jsString(exec, imp->media());
+    return result;
 }
 
-JSValue jsHTMLLinkElementRel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementRel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()));
+    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThis->impl());
-    return jsString(exec, imp->rel());
+    JSValue result = jsString(exec, imp->rel());
+    return result;
 }
 
-JSValue jsHTMLLinkElementRev(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementRev(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()));
+    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThis->impl());
-    return jsString(exec, imp->rev());
+    JSValue result = jsString(exec, imp->rev());
+    return result;
 }
 
-JSValue jsHTMLLinkElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementTarget(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()));
+    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThis->impl());
-    return jsString(exec, imp->target());
+    JSValue result = jsString(exec, imp->target());
+    return result;
 }
 
-JSValue jsHTMLLinkElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()));
+    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsHTMLLinkElementSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementSheet(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()));
+    JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->sheet()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->sheet()));
+    return result;
 }
 
-JSValue jsHTMLLinkElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLLinkElement* domObject = static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()));
+    JSHTMLLinkElement* domObject = static_cast<JSHTMLLinkElement*>(asObject(slotBase));
     return JSHTMLLinkElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLLinkElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -241,55 +251,64 @@ void JSHTMLLinkElement::put(ExecState* exec, const Identifier& propertyName, JSV
 
 void setJSHTMLLinkElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
+    JSHTMLLinkElement* castedThisObj = static_cast<JSHTMLLinkElement*>(thisObject);
+    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThisObj->impl());
     imp->setDisabled(value.toBoolean(exec));
 }
 
 void setJSHTMLLinkElementCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
+    JSHTMLLinkElement* castedThisObj = static_cast<JSHTMLLinkElement*>(thisObject);
+    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThisObj->impl());
     imp->setCharset(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLLinkElementHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
+    JSHTMLLinkElement* castedThisObj = static_cast<JSHTMLLinkElement*>(thisObject);
+    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThisObj->impl());
     imp->setHref(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLLinkElementHreflang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
+    JSHTMLLinkElement* castedThisObj = static_cast<JSHTMLLinkElement*>(thisObject);
+    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThisObj->impl());
     imp->setHreflang(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLLinkElementMedia(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
+    JSHTMLLinkElement* castedThisObj = static_cast<JSHTMLLinkElement*>(thisObject);
+    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThisObj->impl());
     imp->setMedia(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLLinkElementRel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
+    JSHTMLLinkElement* castedThisObj = static_cast<JSHTMLLinkElement*>(thisObject);
+    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThisObj->impl());
     imp->setRel(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLLinkElementRev(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
+    JSHTMLLinkElement* castedThisObj = static_cast<JSHTMLLinkElement*>(thisObject);
+    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThisObj->impl());
     imp->setRev(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLLinkElementTarget(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
+    JSHTMLLinkElement* castedThisObj = static_cast<JSHTMLLinkElement*>(thisObject);
+    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThisObj->impl());
     imp->setTarget(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLLinkElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
+    JSHTMLLinkElement* castedThisObj = static_cast<JSHTMLLinkElement*>(thisObject);
+    HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(castedThisObj->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
index 5ea21470f0..202e95c66d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLLinkElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,26 +66,26 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLLinkElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLinkElementDisabled(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLLinkElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLLinkElementCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLinkElementCharset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLLinkElementCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLLinkElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLinkElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLLinkElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLLinkElementHreflang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLinkElementHreflang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLLinkElementHreflang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLLinkElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLinkElementMedia(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLLinkElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLLinkElementRel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLinkElementRel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLLinkElementRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLLinkElementRev(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLinkElementRev(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLLinkElementRev(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLLinkElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLinkElementTarget(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLLinkElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLLinkElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLinkElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLLinkElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLLinkElementSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLLinkElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLinkElementSheet(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLLinkElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
index d4fc27d519..1ddb2394c6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
@@ -38,9 +38,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLMapElement);
 
 static const HashTableValue JSHTMLMapElementTableValues[4] =
 {
-    { "areas", DontDelete|ReadOnly, (intptr_t)jsHTMLMapElementAreas, (intptr_t)0 },
-    { "name", DontDelete, (intptr_t)jsHTMLMapElementName, (intptr_t)setJSHTMLMapElementName },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLMapElementConstructor, (intptr_t)0 },
+    { "areas", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMapElementAreas), (intptr_t)0 },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMapElementName), (intptr_t)setJSHTMLMapElementName },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMapElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -141,25 +141,27 @@ bool JSHTMLMapElement::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSHTMLMapElement, Base>(exec, &JSHTMLMapElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLMapElementAreas(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMapElementAreas(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMapElement* castedThis = static_cast<JSHTMLMapElement*>(asObject(slot.slotBase()));
+    JSHTMLMapElement* castedThis = static_cast<JSHTMLMapElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMapElement* imp = static_cast<HTMLMapElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->areas()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->areas()));
+    return result;
 }
 
-JSValue jsHTMLMapElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMapElementName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMapElement* castedThis = static_cast<JSHTMLMapElement*>(asObject(slot.slotBase()));
+    JSHTMLMapElement* castedThis = static_cast<JSHTMLMapElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMapElement* imp = static_cast<HTMLMapElement*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsHTMLMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMapElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMapElement* domObject = static_cast<JSHTMLMapElement*>(asObject(slot.slotBase()));
+    JSHTMLMapElement* domObject = static_cast<JSHTMLMapElement*>(asObject(slotBase));
     return JSHTMLMapElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLMapElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -169,7 +171,8 @@ void JSHTMLMapElement::put(ExecState* exec, const Identifier& propertyName, JSVa
 
 void setJSHTMLMapElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMapElement* imp = static_cast<HTMLMapElement*>(static_cast<JSHTMLMapElement*>(thisObject)->impl());
+    JSHTMLMapElement* castedThisObj = static_cast<JSHTMLMapElement*>(thisObject);
+    HTMLMapElement* imp = static_cast<HTMLMapElement*>(castedThisObj->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
index 231209421e..5b081b80f2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLMapElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,10 +66,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLMapElementAreas(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMapElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMapElementAreas(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMapElementName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMapElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMapElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
index 9db661af8a..bdd74004ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
@@ -35,7 +35,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLMarqueeElement);
 
 static const HashTableValue JSHTMLMarqueeElementTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLMarqueeElementConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMarqueeElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -74,7 +74,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -97,8 +97,8 @@ bool JSHTMLMarqueeElementConstructor::getOwnPropertyDescriptor(ExecState* exec,
 
 static const HashTableValue JSHTMLMarqueeElementPrototypeTableValues[3] =
 {
-    { "start", DontDelete|Function, (intptr_t)jsHTMLMarqueeElementPrototypeFunctionStart, (intptr_t)0 },
-    { "stop", DontDelete|Function, (intptr_t)jsHTMLMarqueeElementPrototypeFunctionStop, (intptr_t)0 },
+    { "start", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLMarqueeElementPrototypeFunctionStart), (intptr_t)0 },
+    { "stop", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLMarqueeElementPrototypeFunctionStop), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -148,9 +148,9 @@ bool JSHTMLMarqueeElement::getOwnPropertyDescriptor(ExecState* exec, const Ident
     return getStaticValueDescriptor<JSHTMLMarqueeElement, Base>(exec, &JSHTMLMarqueeElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLMarqueeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMarqueeElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMarqueeElement* domObject = static_cast<JSHTMLMarqueeElement*>(asObject(slot.slotBase()));
+    JSHTMLMarqueeElement* domObject = static_cast<JSHTMLMarqueeElement*>(asObject(slotBase));
     return JSHTMLMarqueeElement::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSHTMLMarqueeElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
index de9770a410..b1318919ed 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLMarqueeElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -71,7 +71,7 @@ JSC::JSValue JSC_HOST_CALL jsHTMLMarqueeElementPrototypeFunctionStart(JSC::ExecS
 JSC::JSValue JSC_HOST_CALL jsHTMLMarqueeElementPrototypeFunctionStop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLMarqueeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMarqueeElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
index f3f3a8d741..5c40472bdd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
@@ -43,32 +43,34 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLMediaElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLMediaElementTableValues[25] =
-{
-    { "error", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementError, (intptr_t)0 },
-    { "src", DontDelete, (intptr_t)jsHTMLMediaElementSrc, (intptr_t)setJSHTMLMediaElementSrc },
-    { "currentSrc", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementCurrentSrc, (intptr_t)0 },
-    { "networkState", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNetworkState, (intptr_t)0 },
-    { "autobuffer", DontDelete, (intptr_t)jsHTMLMediaElementAutobuffer, (intptr_t)setJSHTMLMediaElementAutobuffer },
-    { "buffered", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementBuffered, (intptr_t)0 },
-    { "readyState", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementReadyState, (intptr_t)0 },
-    { "seeking", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementSeeking, (intptr_t)0 },
-    { "currentTime", DontDelete, (intptr_t)jsHTMLMediaElementCurrentTime, (intptr_t)setJSHTMLMediaElementCurrentTime },
-    { "startTime", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementStartTime, (intptr_t)0 },
-    { "duration", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementDuration, (intptr_t)0 },
-    { "paused", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementPaused, (intptr_t)0 },
-    { "defaultPlaybackRate", DontDelete, (intptr_t)jsHTMLMediaElementDefaultPlaybackRate, (intptr_t)setJSHTMLMediaElementDefaultPlaybackRate },
-    { "playbackRate", DontDelete, (intptr_t)jsHTMLMediaElementPlaybackRate, (intptr_t)setJSHTMLMediaElementPlaybackRate },
-    { "played", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementPlayed, (intptr_t)0 },
-    { "seekable", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementSeekable, (intptr_t)0 },
-    { "ended", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementEnded, (intptr_t)0 },
-    { "autoplay", DontDelete, (intptr_t)jsHTMLMediaElementAutoplay, (intptr_t)setJSHTMLMediaElementAutoplay },
-    { "loop", DontDelete, (intptr_t)jsHTMLMediaElementLoop, (intptr_t)setJSHTMLMediaElementLoop },
-    { "controls", DontDelete, (intptr_t)jsHTMLMediaElementControls, (intptr_t)setJSHTMLMediaElementControls },
-    { "volume", DontDelete, (intptr_t)jsHTMLMediaElementVolume, (intptr_t)setJSHTMLMediaElementVolume },
-    { "muted", DontDelete, (intptr_t)jsHTMLMediaElementMuted, (intptr_t)setJSHTMLMediaElementMuted },
-    { "webkitPreservesPitch", DontDelete, (intptr_t)jsHTMLMediaElementWebkitPreservesPitch, (intptr_t)setJSHTMLMediaElementWebkitPreservesPitch },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLMediaElementConstructor, (intptr_t)0 },
+static const HashTableValue JSHTMLMediaElementTableValues[27] =
+{
+    { "error", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementError), (intptr_t)0 },
+    { "src", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementSrc), (intptr_t)setJSHTMLMediaElementSrc },
+    { "currentSrc", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementCurrentSrc), (intptr_t)0 },
+    { "networkState", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementNetworkState), (intptr_t)0 },
+    { "preload", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementPreload), (intptr_t)setJSHTMLMediaElementPreload },
+    { "buffered", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementBuffered), (intptr_t)0 },
+    { "readyState", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementReadyState), (intptr_t)0 },
+    { "seeking", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementSeeking), (intptr_t)0 },
+    { "currentTime", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementCurrentTime), (intptr_t)setJSHTMLMediaElementCurrentTime },
+    { "startTime", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementStartTime), (intptr_t)0 },
+    { "duration", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementDuration), (intptr_t)0 },
+    { "paused", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementPaused), (intptr_t)0 },
+    { "defaultPlaybackRate", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementDefaultPlaybackRate), (intptr_t)setJSHTMLMediaElementDefaultPlaybackRate },
+    { "playbackRate", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementPlaybackRate), (intptr_t)setJSHTMLMediaElementPlaybackRate },
+    { "played", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementPlayed), (intptr_t)0 },
+    { "seekable", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementSeekable), (intptr_t)0 },
+    { "ended", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementEnded), (intptr_t)0 },
+    { "autoplay", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementAutoplay), (intptr_t)setJSHTMLMediaElementAutoplay },
+    { "loop", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementLoop), (intptr_t)setJSHTMLMediaElementLoop },
+    { "controls", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementControls), (intptr_t)setJSHTMLMediaElementControls },
+    { "volume", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementVolume), (intptr_t)setJSHTMLMediaElementVolume },
+    { "muted", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementMuted), (intptr_t)setJSHTMLMediaElementMuted },
+    { "webkitPreservesPitch", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementWebkitPreservesPitch), (intptr_t)setJSHTMLMediaElementWebkitPreservesPitch },
+    { "webkitHasClosedCaptions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementWebkitHasClosedCaptions), (intptr_t)0 },
+    { "webkitClosedCaptionsVisible", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementWebkitClosedCaptionsVisible), (intptr_t)setJSHTMLMediaElementWebkitClosedCaptionsVisible },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,23 +78,23 @@ static JSC_CONST_HASHTABLE HashTable JSHTMLMediaElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 1023, JSHTMLMediaElementTableValues, 0 };
 #else
-    { 68, 63, JSHTMLMediaElementTableValues, 0 };
+    { 69, 63, JSHTMLMediaElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
 
 static const HashTableValue JSHTMLMediaElementConstructorTableValues[11] =
 {
-    { "NETWORK_EMPTY", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_EMPTY, (intptr_t)0 },
-    { "NETWORK_IDLE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_IDLE, (intptr_t)0 },
-    { "NETWORK_LOADING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_LOADING, (intptr_t)0 },
-    { "NETWORK_LOADED", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_LOADED, (intptr_t)0 },
-    { "NETWORK_NO_SOURCE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_NO_SOURCE, (intptr_t)0 },
-    { "HAVE_NOTHING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_NOTHING, (intptr_t)0 },
-    { "HAVE_METADATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_METADATA, (intptr_t)0 },
-    { "HAVE_CURRENT_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_CURRENT_DATA, (intptr_t)0 },
-    { "HAVE_FUTURE_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_FUTURE_DATA, (intptr_t)0 },
-    { "HAVE_ENOUGH_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_ENOUGH_DATA, (intptr_t)0 },
+    { "NETWORK_EMPTY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementNETWORK_EMPTY), (intptr_t)0 },
+    { "NETWORK_IDLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementNETWORK_IDLE), (intptr_t)0 },
+    { "NETWORK_LOADING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementNETWORK_LOADING), (intptr_t)0 },
+    { "NETWORK_LOADED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementNETWORK_LOADED), (intptr_t)0 },
+    { "NETWORK_NO_SOURCE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementNETWORK_NO_SOURCE), (intptr_t)0 },
+    { "HAVE_NOTHING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementHAVE_NOTHING), (intptr_t)0 },
+    { "HAVE_METADATA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementHAVE_METADATA), (intptr_t)0 },
+    { "HAVE_CURRENT_DATA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementHAVE_CURRENT_DATA), (intptr_t)0 },
+    { "HAVE_FUTURE_DATA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementHAVE_FUTURE_DATA), (intptr_t)0 },
+    { "HAVE_ENOUGH_DATA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementHAVE_ENOUGH_DATA), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -117,7 +119,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -140,20 +142,20 @@ bool JSHTMLMediaElementConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 static const HashTableValue JSHTMLMediaElementPrototypeTableValues[15] =
 {
-    { "NETWORK_EMPTY", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_EMPTY, (intptr_t)0 },
-    { "NETWORK_IDLE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_IDLE, (intptr_t)0 },
-    { "NETWORK_LOADING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_LOADING, (intptr_t)0 },
-    { "NETWORK_LOADED", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_LOADED, (intptr_t)0 },
-    { "NETWORK_NO_SOURCE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_NO_SOURCE, (intptr_t)0 },
-    { "HAVE_NOTHING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_NOTHING, (intptr_t)0 },
-    { "HAVE_METADATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_METADATA, (intptr_t)0 },
-    { "HAVE_CURRENT_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_CURRENT_DATA, (intptr_t)0 },
-    { "HAVE_FUTURE_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_FUTURE_DATA, (intptr_t)0 },
-    { "HAVE_ENOUGH_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_ENOUGH_DATA, (intptr_t)0 },
-    { "load", DontDelete|Function, (intptr_t)jsHTMLMediaElementPrototypeFunctionLoad, (intptr_t)0 },
-    { "canPlayType", DontDelete|Function, (intptr_t)jsHTMLMediaElementPrototypeFunctionCanPlayType, (intptr_t)1 },
-    { "play", DontDelete|Function, (intptr_t)jsHTMLMediaElementPrototypeFunctionPlay, (intptr_t)0 },
-    { "pause", DontDelete|Function, (intptr_t)jsHTMLMediaElementPrototypeFunctionPause, (intptr_t)0 },
+    { "NETWORK_EMPTY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementNETWORK_EMPTY), (intptr_t)0 },
+    { "NETWORK_IDLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementNETWORK_IDLE), (intptr_t)0 },
+    { "NETWORK_LOADING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementNETWORK_LOADING), (intptr_t)0 },
+    { "NETWORK_LOADED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementNETWORK_LOADED), (intptr_t)0 },
+    { "NETWORK_NO_SOURCE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementNETWORK_NO_SOURCE), (intptr_t)0 },
+    { "HAVE_NOTHING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementHAVE_NOTHING), (intptr_t)0 },
+    { "HAVE_METADATA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementHAVE_METADATA), (intptr_t)0 },
+    { "HAVE_CURRENT_DATA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementHAVE_CURRENT_DATA), (intptr_t)0 },
+    { "HAVE_FUTURE_DATA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementHAVE_FUTURE_DATA), (intptr_t)0 },
+    { "HAVE_ENOUGH_DATA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMediaElementHAVE_ENOUGH_DATA), (intptr_t)0 },
+    { "load", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLMediaElementPrototypeFunctionLoad), (intptr_t)0 },
+    { "canPlayType", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLMediaElementPrototypeFunctionCanPlayType), (intptr_t)1 },
+    { "play", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLMediaElementPrototypeFunctionPlay), (intptr_t)0 },
+    { "pause", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLMediaElementPrototypeFunctionPause), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -203,193 +205,234 @@ bool JSHTMLMediaElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSHTMLMediaElement, Base>(exec, &JSHTMLMediaElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLMediaElementError(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementError(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->error()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->error()));
+    return result;
 }
 
-JSValue jsHTMLMediaElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementSrc(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsString(exec, imp->src());
+    JSValue result = jsString(exec, imp->src());
+    return result;
 }
 
-JSValue jsHTMLMediaElementCurrentSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementCurrentSrc(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsString(exec, imp->currentSrc());
+    JSValue result = jsString(exec, imp->currentSrc());
+    return result;
 }
 
-JSValue jsHTMLMediaElementNetworkState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementNetworkState(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsNumber(exec, imp->networkState());
+    JSValue result = jsNumber(exec, imp->networkState());
+    return result;
 }
 
-JSValue jsHTMLMediaElementAutobuffer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementPreload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsBoolean(imp->autobuffer());
+    JSValue result = jsString(exec, imp->preload());
+    return result;
 }
 
-JSValue jsHTMLMediaElementBuffered(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementBuffered(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->buffered()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->buffered()));
+    return result;
 }
 
-JSValue jsHTMLMediaElementReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementReadyState(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsNumber(exec, imp->readyState());
+    JSValue result = jsNumber(exec, imp->readyState());
+    return result;
 }
 
-JSValue jsHTMLMediaElementSeeking(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementSeeking(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsBoolean(imp->seeking());
+    JSValue result = jsBoolean(imp->seeking());
+    return result;
 }
 
-JSValue jsHTMLMediaElementCurrentTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementCurrentTime(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsNumber(exec, imp->currentTime());
+    JSValue result = jsNumber(exec, imp->currentTime());
+    return result;
 }
 
-JSValue jsHTMLMediaElementStartTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementStartTime(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsNumber(exec, imp->startTime());
+    JSValue result = jsNumber(exec, imp->startTime());
+    return result;
 }
 
-JSValue jsHTMLMediaElementDuration(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementDuration(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsNumber(exec, imp->duration());
+    JSValue result = jsNumber(exec, imp->duration());
+    return result;
 }
 
-JSValue jsHTMLMediaElementPaused(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementPaused(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsBoolean(imp->paused());
+    JSValue result = jsBoolean(imp->paused());
+    return result;
 }
 
-JSValue jsHTMLMediaElementDefaultPlaybackRate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementDefaultPlaybackRate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsNumber(exec, imp->defaultPlaybackRate());
+    JSValue result = jsNumber(exec, imp->defaultPlaybackRate());
+    return result;
+}
+
+JSValue jsHTMLMediaElementPlaybackRate(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->playbackRate());
+    return result;
+}
+
+JSValue jsHTMLMediaElementPlayed(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->played()));
+    return result;
 }
 
-JSValue jsHTMLMediaElementPlaybackRate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementSeekable(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsNumber(exec, imp->playbackRate());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->seekable()));
+    return result;
 }
 
-JSValue jsHTMLMediaElementPlayed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementEnded(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->played()));
+    JSValue result = jsBoolean(imp->ended());
+    return result;
 }
 
-JSValue jsHTMLMediaElementSeekable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementAutoplay(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->seekable()));
+    JSValue result = jsBoolean(imp->autoplay());
+    return result;
 }
 
-JSValue jsHTMLMediaElementEnded(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementLoop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsBoolean(imp->ended());
+    JSValue result = jsBoolean(imp->loop());
+    return result;
 }
 
-JSValue jsHTMLMediaElementAutoplay(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementControls(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsBoolean(imp->autoplay());
+    JSValue result = jsBoolean(imp->controls());
+    return result;
 }
 
-JSValue jsHTMLMediaElementLoop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementVolume(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsBoolean(imp->loop());
+    JSValue result = jsNumber(exec, imp->volume());
+    return result;
 }
 
-JSValue jsHTMLMediaElementControls(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementMuted(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsBoolean(imp->controls());
+    JSValue result = jsBoolean(imp->muted());
+    return result;
 }
 
-JSValue jsHTMLMediaElementVolume(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementWebkitPreservesPitch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsNumber(exec, imp->volume());
+    JSValue result = jsBoolean(imp->webkitPreservesPitch());
+    return result;
 }
 
-JSValue jsHTMLMediaElementMuted(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementWebkitHasClosedCaptions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsBoolean(imp->muted());
+    JSValue result = jsBoolean(imp->webkitHasClosedCaptions());
+    return result;
 }
 
-JSValue jsHTMLMediaElementWebkitPreservesPitch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementWebkitClosedCaptionsVisible(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThis->impl());
-    return jsBoolean(imp->webkitPreservesPitch());
+    JSValue result = jsBoolean(imp->webkitClosedCaptionsVisible());
+    return result;
 }
 
-JSValue jsHTMLMediaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMediaElement* domObject = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
+    JSHTMLMediaElement* domObject = static_cast<JSHTMLMediaElement*>(asObject(slotBase));
     return JSHTMLMediaElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLMediaElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -399,19 +442,22 @@ void JSHTMLMediaElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSHTMLMediaElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
+    JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(thisObject);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
     imp->setSrc(value.toString(exec));
 }
 
-void setJSHTMLMediaElementAutobuffer(ExecState* exec, JSObject* thisObject, JSValue value)
+void setJSHTMLMediaElementPreload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setAutobuffer(value.toBoolean(exec));
+    JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(thisObject);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
+    imp->setPreload(value.toString(exec));
 }
 
 void setJSHTMLMediaElementCurrentTime(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
+    JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(thisObject);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setCurrentTime(value.toFloat(exec), ec);
     setDOMException(exec, ec);
@@ -419,37 +465,43 @@ void setJSHTMLMediaElementCurrentTime(ExecState* exec, JSObject* thisObject, JSV
 
 void setJSHTMLMediaElementDefaultPlaybackRate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
+    JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(thisObject);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
     imp->setDefaultPlaybackRate(value.toFloat(exec));
 }
 
 void setJSHTMLMediaElementPlaybackRate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
+    JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(thisObject);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
     imp->setPlaybackRate(value.toFloat(exec));
 }
 
 void setJSHTMLMediaElementAutoplay(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
+    JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(thisObject);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
     imp->setAutoplay(value.toBoolean(exec));
 }
 
 void setJSHTMLMediaElementLoop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
+    JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(thisObject);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
     imp->setLoop(value.toBoolean(exec));
 }
 
 void setJSHTMLMediaElementControls(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
+    JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(thisObject);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
     imp->setControls(value.toBoolean(exec));
 }
 
 void setJSHTMLMediaElementVolume(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
+    JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(thisObject);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setVolume(value.toFloat(exec), ec);
     setDOMException(exec, ec);
@@ -457,16 +509,25 @@ void setJSHTMLMediaElementVolume(ExecState* exec, JSObject* thisObject, JSValue
 
 void setJSHTMLMediaElementMuted(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
+    JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(thisObject);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
     imp->setMuted(value.toBoolean(exec));
 }
 
 void setJSHTMLMediaElementWebkitPreservesPitch(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
+    JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(thisObject);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
     imp->setWebkitPreservesPitch(value.toBoolean(exec));
 }
 
+void setJSHTMLMediaElementWebkitClosedCaptionsVisible(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(thisObject);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
+    imp->setWebkitClosedCaptionsVisible(value.toBoolean(exec));
+}
+
 JSValue JSHTMLMediaElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 {
     return getDOMConstructor<JSHTMLMediaElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
@@ -481,7 +542,7 @@ JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionLoad(ExecState* exec, J
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
-    imp->load(ec);
+    imp->load(processingUserGesture(exec), ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
@@ -508,7 +569,7 @@ JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionPlay(ExecState* exec, J
     JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(asObject(thisValue));
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
 
-    imp->play();
+    imp->play(processingUserGesture(exec));
     return jsUndefined();
 }
 
@@ -520,58 +581,58 @@ JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionPause(ExecState* exec,
     JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(asObject(thisValue));
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
 
-    imp->pause();
+    imp->pause(processingUserGesture(exec));
     return jsUndefined();
 }
 
 // Constant getters
 
-JSValue jsHTMLMediaElementNETWORK_EMPTY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementNETWORK_EMPTY(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsHTMLMediaElementNETWORK_IDLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementNETWORK_IDLE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsHTMLMediaElementNETWORK_LOADING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementNETWORK_LOADING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsHTMLMediaElementNETWORK_LOADED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementNETWORK_LOADED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsHTMLMediaElementNETWORK_NO_SOURCE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementNETWORK_NO_SOURCE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsHTMLMediaElementHAVE_NOTHING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementHAVE_NOTHING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsHTMLMediaElementHAVE_METADATA(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementHAVE_METADATA(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsHTMLMediaElementHAVE_CURRENT_DATA(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementHAVE_CURRENT_DATA(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsHTMLMediaElementHAVE_FUTURE_DATA(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementHAVE_FUTURE_DATA(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsHTMLMediaElementHAVE_ENOUGH_DATA(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementHAVE_ENOUGH_DATA(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
index 66ea4cf2bf..6c073c5cf4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLMediaElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -76,53 +76,56 @@ JSC::JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionPlay(JSC::ExecStat
 JSC::JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionPause(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLMediaElementError(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementError(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementSrc(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMediaElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMediaElementCurrentSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementNetworkState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementAutobuffer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementAutobuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMediaElementBuffered(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementSeeking(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementCurrentTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementCurrentSrc(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementNetworkState(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementPreload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLMediaElementPreload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementBuffered(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementReadyState(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementSeeking(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementCurrentTime(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMediaElementCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMediaElementStartTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementDuration(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementPaused(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementDefaultPlaybackRate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementStartTime(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementDuration(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementPaused(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementDefaultPlaybackRate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMediaElementDefaultPlaybackRate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMediaElementPlaybackRate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementPlaybackRate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMediaElementPlaybackRate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMediaElementPlayed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementSeekable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementEnded(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementAutoplay(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementPlayed(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementSeekable(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementEnded(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementAutoplay(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMediaElementAutoplay(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMediaElementLoop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementLoop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMediaElementLoop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMediaElementControls(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementControls(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMediaElementControls(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMediaElementVolume(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementVolume(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMediaElementVolume(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMediaElementMuted(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementMuted(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMediaElementMuted(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMediaElementWebkitPreservesPitch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementWebkitPreservesPitch(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMediaElementWebkitPreservesPitch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMediaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementWebkitHasClosedCaptions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementWebkitClosedCaptionsVisible(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLMediaElementWebkitClosedCaptionsVisible(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsHTMLMediaElementNETWORK_EMPTY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementNETWORK_IDLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementNETWORK_LOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementNETWORK_LOADED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementNETWORK_NO_SOURCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementHAVE_NOTHING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementHAVE_METADATA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementHAVE_CURRENT_DATA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementHAVE_FUTURE_DATA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLMediaElementHAVE_ENOUGH_DATA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementNETWORK_EMPTY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementNETWORK_IDLE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementNETWORK_LOADING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementNETWORK_LOADED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementNETWORK_NO_SOURCE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementHAVE_NOTHING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementHAVE_METADATA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementHAVE_CURRENT_DATA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementHAVE_FUTURE_DATA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLMediaElementHAVE_ENOUGH_DATA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
index 67daa6ede6..e83695742b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
@@ -34,8 +34,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLMenuElement);
 
 static const HashTableValue JSHTMLMenuElementTableValues[3] =
 {
-    { "compact", DontDelete, (intptr_t)jsHTMLMenuElementCompact, (intptr_t)setJSHTMLMenuElementCompact },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLMenuElementConstructor, (intptr_t)0 },
+    { "compact", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMenuElementCompact), (intptr_t)setJSHTMLMenuElementCompact },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMenuElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -74,7 +74,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -136,17 +136,18 @@ bool JSHTMLMenuElement::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSHTMLMenuElement, Base>(exec, &JSHTMLMenuElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLMenuElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMenuElementCompact(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMenuElement* castedThis = static_cast<JSHTMLMenuElement*>(asObject(slot.slotBase()));
+    JSHTMLMenuElement* castedThis = static_cast<JSHTMLMenuElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMenuElement* imp = static_cast<HTMLMenuElement*>(castedThis->impl());
-    return jsBoolean(imp->compact());
+    JSValue result = jsBoolean(imp->compact());
+    return result;
 }
 
-JSValue jsHTMLMenuElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMenuElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMenuElement* domObject = static_cast<JSHTMLMenuElement*>(asObject(slot.slotBase()));
+    JSHTMLMenuElement* domObject = static_cast<JSHTMLMenuElement*>(asObject(slotBase));
     return JSHTMLMenuElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLMenuElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -156,7 +157,8 @@ void JSHTMLMenuElement::put(ExecState* exec, const Identifier& propertyName, JSV
 
 void setJSHTMLMenuElementCompact(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMenuElement* imp = static_cast<HTMLMenuElement*>(static_cast<JSHTMLMenuElement*>(thisObject)->impl());
+    JSHTMLMenuElement* castedThisObj = static_cast<JSHTMLMenuElement*>(thisObject);
+    HTMLMenuElement* imp = static_cast<HTMLMenuElement*>(castedThisObj->impl());
     imp->setCompact(value.toBoolean(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
index d778342787..c15729bf73 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLMenuElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,9 +66,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLMenuElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMenuElementCompact(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMenuElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMenuElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMenuElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
index b32b1d1bdd..314d0a899d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
@@ -36,11 +36,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLMetaElement);
 
 static const HashTableValue JSHTMLMetaElementTableValues[6] =
 {
-    { "content", DontDelete, (intptr_t)jsHTMLMetaElementContent, (intptr_t)setJSHTMLMetaElementContent },
-    { "httpEquiv", DontDelete, (intptr_t)jsHTMLMetaElementHttpEquiv, (intptr_t)setJSHTMLMetaElementHttpEquiv },
-    { "name", DontDelete, (intptr_t)jsHTMLMetaElementName, (intptr_t)setJSHTMLMetaElementName },
-    { "scheme", DontDelete, (intptr_t)jsHTMLMetaElementScheme, (intptr_t)setJSHTMLMetaElementScheme },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLMetaElementConstructor, (intptr_t)0 },
+    { "content", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMetaElementContent), (intptr_t)setJSHTMLMetaElementContent },
+    { "httpEquiv", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMetaElementHttpEquiv), (intptr_t)setJSHTMLMetaElementHttpEquiv },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMetaElementName), (intptr_t)setJSHTMLMetaElementName },
+    { "scheme", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMetaElementScheme), (intptr_t)setJSHTMLMetaElementScheme },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLMetaElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -141,41 +141,45 @@ bool JSHTMLMetaElement::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSHTMLMetaElement, Base>(exec, &JSHTMLMetaElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLMetaElementContent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMetaElementContent(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMetaElement* castedThis = static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()));
+    JSHTMLMetaElement* castedThis = static_cast<JSHTMLMetaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(castedThis->impl());
-    return jsString(exec, imp->content());
+    JSValue result = jsString(exec, imp->content());
+    return result;
 }
 
-JSValue jsHTMLMetaElementHttpEquiv(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMetaElementHttpEquiv(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMetaElement* castedThis = static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()));
+    JSHTMLMetaElement* castedThis = static_cast<JSHTMLMetaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(castedThis->impl());
-    return jsString(exec, imp->httpEquiv());
+    JSValue result = jsString(exec, imp->httpEquiv());
+    return result;
 }
 
-JSValue jsHTMLMetaElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMetaElementName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMetaElement* castedThis = static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()));
+    JSHTMLMetaElement* castedThis = static_cast<JSHTMLMetaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsHTMLMetaElementScheme(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMetaElementScheme(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMetaElement* castedThis = static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()));
+    JSHTMLMetaElement* castedThis = static_cast<JSHTMLMetaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(castedThis->impl());
-    return jsString(exec, imp->scheme());
+    JSValue result = jsString(exec, imp->scheme());
+    return result;
 }
 
-JSValue jsHTMLMetaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMetaElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLMetaElement* domObject = static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()));
+    JSHTMLMetaElement* domObject = static_cast<JSHTMLMetaElement*>(asObject(slotBase));
     return JSHTMLMetaElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLMetaElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -185,25 +189,29 @@ void JSHTMLMetaElement::put(ExecState* exec, const Identifier& propertyName, JSV
 
 void setJSHTMLMetaElementContent(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(thisObject)->impl());
+    JSHTMLMetaElement* castedThisObj = static_cast<JSHTMLMetaElement*>(thisObject);
+    HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(castedThisObj->impl());
     imp->setContent(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLMetaElementHttpEquiv(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(thisObject)->impl());
+    JSHTMLMetaElement* castedThisObj = static_cast<JSHTMLMetaElement*>(thisObject);
+    HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(castedThisObj->impl());
     imp->setHttpEquiv(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLMetaElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(thisObject)->impl());
+    JSHTMLMetaElement* castedThisObj = static_cast<JSHTMLMetaElement*>(thisObject);
+    HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(castedThisObj->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLMetaElementScheme(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(thisObject)->impl());
+    JSHTMLMetaElement* castedThisObj = static_cast<JSHTMLMetaElement*>(thisObject);
+    HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(castedThisObj->impl());
     imp->setScheme(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
index 4ff2b8eabf..9f873278fe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLMetaElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,15 +66,15 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLMetaElementContent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMetaElementContent(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMetaElementContent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMetaElementHttpEquiv(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMetaElementHttpEquiv(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMetaElementHttpEquiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMetaElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMetaElementName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMetaElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMetaElementScheme(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMetaElementScheme(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLMetaElementScheme(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLMetaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMetaElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
index d4405769a8..8b6fae1010 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
@@ -36,9 +36,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLModElement);
 
 static const HashTableValue JSHTMLModElementTableValues[4] =
 {
-    { "cite", DontDelete, (intptr_t)jsHTMLModElementCite, (intptr_t)setJSHTMLModElementCite },
-    { "dateTime", DontDelete, (intptr_t)jsHTMLModElementDateTime, (intptr_t)setJSHTMLModElementDateTime },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLModElementConstructor, (intptr_t)0 },
+    { "cite", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLModElementCite), (intptr_t)setJSHTMLModElementCite },
+    { "dateTime", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLModElementDateTime), (intptr_t)setJSHTMLModElementDateTime },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLModElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -139,25 +139,27 @@ bool JSHTMLModElement::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSHTMLModElement, Base>(exec, &JSHTMLModElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLModElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLModElementCite(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLModElement* castedThis = static_cast<JSHTMLModElement*>(asObject(slot.slotBase()));
+    JSHTMLModElement* castedThis = static_cast<JSHTMLModElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLModElement* imp = static_cast<HTMLModElement*>(castedThis->impl());
-    return jsString(exec, imp->cite());
+    JSValue result = jsString(exec, imp->cite());
+    return result;
 }
 
-JSValue jsHTMLModElementDateTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLModElementDateTime(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLModElement* castedThis = static_cast<JSHTMLModElement*>(asObject(slot.slotBase()));
+    JSHTMLModElement* castedThis = static_cast<JSHTMLModElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLModElement* imp = static_cast<HTMLModElement*>(castedThis->impl());
-    return jsString(exec, imp->dateTime());
+    JSValue result = jsString(exec, imp->dateTime());
+    return result;
 }
 
-JSValue jsHTMLModElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLModElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLModElement* domObject = static_cast<JSHTMLModElement*>(asObject(slot.slotBase()));
+    JSHTMLModElement* domObject = static_cast<JSHTMLModElement*>(asObject(slotBase));
     return JSHTMLModElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLModElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -167,13 +169,15 @@ void JSHTMLModElement::put(ExecState* exec, const Identifier& propertyName, JSVa
 
 void setJSHTMLModElementCite(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLModElement* imp = static_cast<HTMLModElement*>(static_cast<JSHTMLModElement*>(thisObject)->impl());
+    JSHTMLModElement* castedThisObj = static_cast<JSHTMLModElement*>(thisObject);
+    HTMLModElement* imp = static_cast<HTMLModElement*>(castedThisObj->impl());
     imp->setCite(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLModElementDateTime(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLModElement* imp = static_cast<HTMLModElement*>(static_cast<JSHTMLModElement*>(thisObject)->impl());
+    JSHTMLModElement* castedThisObj = static_cast<JSHTMLModElement*>(thisObject);
+    HTMLModElement* imp = static_cast<HTMLModElement*>(castedThisObj->impl());
     imp->setDateTime(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
index a2aed451bb..964582f428 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLModElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,11 +66,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLModElementCite(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLModElementCite(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLModElementCite(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLModElementDateTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLModElementDateTime(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLModElementDateTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLModElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLModElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
index 105c49e636..4871e6d623 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
@@ -37,10 +37,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLOListElement);
 
 static const HashTableValue JSHTMLOListElementTableValues[5] =
 {
-    { "compact", DontDelete, (intptr_t)jsHTMLOListElementCompact, (intptr_t)setJSHTMLOListElementCompact },
-    { "start", DontDelete, (intptr_t)jsHTMLOListElementStart, (intptr_t)setJSHTMLOListElementStart },
-    { "type", DontDelete, (intptr_t)jsHTMLOListElementType, (intptr_t)setJSHTMLOListElementType },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLOListElementConstructor, (intptr_t)0 },
+    { "compact", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOListElementCompact), (intptr_t)setJSHTMLOListElementCompact },
+    { "start", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOListElementStart), (intptr_t)setJSHTMLOListElementStart },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOListElementType), (intptr_t)setJSHTMLOListElementType },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOListElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -141,33 +141,36 @@ bool JSHTMLOListElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSHTMLOListElement, Base>(exec, &JSHTMLOListElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLOListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOListElementCompact(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOListElement* castedThis = static_cast<JSHTMLOListElement*>(asObject(slot.slotBase()));
+    JSHTMLOListElement* castedThis = static_cast<JSHTMLOListElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLOListElement* imp = static_cast<HTMLOListElement*>(castedThis->impl());
-    return jsBoolean(imp->compact());
+    JSValue result = jsBoolean(imp->compact());
+    return result;
 }
 
-JSValue jsHTMLOListElementStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOListElementStart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOListElement* castedThis = static_cast<JSHTMLOListElement*>(asObject(slot.slotBase()));
+    JSHTMLOListElement* castedThis = static_cast<JSHTMLOListElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLOListElement* imp = static_cast<HTMLOListElement*>(castedThis->impl());
-    return jsNumber(exec, imp->start());
+    JSValue result = jsNumber(exec, imp->start());
+    return result;
 }
 
-JSValue jsHTMLOListElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOListElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOListElement* castedThis = static_cast<JSHTMLOListElement*>(asObject(slot.slotBase()));
+    JSHTMLOListElement* castedThis = static_cast<JSHTMLOListElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLOListElement* imp = static_cast<HTMLOListElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsHTMLOListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOListElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOListElement* domObject = static_cast<JSHTMLOListElement*>(asObject(slot.slotBase()));
+    JSHTMLOListElement* domObject = static_cast<JSHTMLOListElement*>(asObject(slotBase));
     return JSHTMLOListElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLOListElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -177,19 +180,22 @@ void JSHTMLOListElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSHTMLOListElementCompact(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLOListElement* imp = static_cast<HTMLOListElement*>(static_cast<JSHTMLOListElement*>(thisObject)->impl());
+    JSHTMLOListElement* castedThisObj = static_cast<JSHTMLOListElement*>(thisObject);
+    HTMLOListElement* imp = static_cast<HTMLOListElement*>(castedThisObj->impl());
     imp->setCompact(value.toBoolean(exec));
 }
 
 void setJSHTMLOListElementStart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLOListElement* imp = static_cast<HTMLOListElement*>(static_cast<JSHTMLOListElement*>(thisObject)->impl());
+    JSHTMLOListElement* castedThisObj = static_cast<JSHTMLOListElement*>(thisObject);
+    HTMLOListElement* imp = static_cast<HTMLOListElement*>(castedThisObj->impl());
     imp->setStart(value.toInt32(exec));
 }
 
 void setJSHTMLOListElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLOListElement* imp = static_cast<HTMLOListElement*>(static_cast<JSHTMLOListElement*>(thisObject)->impl());
+    JSHTMLOListElement* castedThisObj = static_cast<JSHTMLOListElement*>(thisObject);
+    HTMLOListElement* imp = static_cast<HTMLOListElement*>(castedThisObj->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
index 9ecb940949..39b552870b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLOListElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,13 +66,13 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLOListElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOListElementCompact(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLOListElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLOListElementStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOListElementStart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLOListElementStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLOListElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOListElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLOListElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLOListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOListElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
index 7203ff1f5d..973a893195 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
@@ -21,7 +21,6 @@
 #include "config.h"
 #include "JSHTMLObjectElement.h"
 
-#include "AtomicString.h"
 #include "Document.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
@@ -48,26 +47,26 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLObjectElement);
 
 static const HashTableValue JSHTMLObjectElementTableValues[21] =
 {
-    { "form", DontDelete|ReadOnly, (intptr_t)jsHTMLObjectElementForm, (intptr_t)0 },
-    { "code", DontDelete, (intptr_t)jsHTMLObjectElementCode, (intptr_t)setJSHTMLObjectElementCode },
-    { "align", DontDelete, (intptr_t)jsHTMLObjectElementAlign, (intptr_t)setJSHTMLObjectElementAlign },
-    { "archive", DontDelete, (intptr_t)jsHTMLObjectElementArchive, (intptr_t)setJSHTMLObjectElementArchive },
-    { "border", DontDelete, (intptr_t)jsHTMLObjectElementBorder, (intptr_t)setJSHTMLObjectElementBorder },
-    { "codeBase", DontDelete, (intptr_t)jsHTMLObjectElementCodeBase, (intptr_t)setJSHTMLObjectElementCodeBase },
-    { "codeType", DontDelete, (intptr_t)jsHTMLObjectElementCodeType, (intptr_t)setJSHTMLObjectElementCodeType },
-    { "data", DontDelete, (intptr_t)jsHTMLObjectElementData, (intptr_t)setJSHTMLObjectElementData },
-    { "declare", DontDelete, (intptr_t)jsHTMLObjectElementDeclare, (intptr_t)setJSHTMLObjectElementDeclare },
-    { "height", DontDelete, (intptr_t)jsHTMLObjectElementHeight, (intptr_t)setJSHTMLObjectElementHeight },
-    { "hspace", DontDelete, (intptr_t)jsHTMLObjectElementHspace, (intptr_t)setJSHTMLObjectElementHspace },
-    { "name", DontDelete, (intptr_t)jsHTMLObjectElementName, (intptr_t)setJSHTMLObjectElementName },
-    { "standby", DontDelete, (intptr_t)jsHTMLObjectElementStandby, (intptr_t)setJSHTMLObjectElementStandby },
-    { "type", DontDelete, (intptr_t)jsHTMLObjectElementType, (intptr_t)setJSHTMLObjectElementType },
-    { "useMap", DontDelete, (intptr_t)jsHTMLObjectElementUseMap, (intptr_t)setJSHTMLObjectElementUseMap },
-    { "vspace", DontDelete, (intptr_t)jsHTMLObjectElementVspace, (intptr_t)setJSHTMLObjectElementVspace },
-    { "width", DontDelete, (intptr_t)jsHTMLObjectElementWidth, (intptr_t)setJSHTMLObjectElementWidth },
-    { "willValidate", DontDelete|ReadOnly, (intptr_t)jsHTMLObjectElementWillValidate, (intptr_t)0 },
-    { "contentDocument", DontDelete|ReadOnly, (intptr_t)jsHTMLObjectElementContentDocument, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLObjectElementConstructor, (intptr_t)0 },
+    { "form", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementForm), (intptr_t)0 },
+    { "code", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementCode), (intptr_t)setJSHTMLObjectElementCode },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementAlign), (intptr_t)setJSHTMLObjectElementAlign },
+    { "archive", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementArchive), (intptr_t)setJSHTMLObjectElementArchive },
+    { "border", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementBorder), (intptr_t)setJSHTMLObjectElementBorder },
+    { "codeBase", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementCodeBase), (intptr_t)setJSHTMLObjectElementCodeBase },
+    { "codeType", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementCodeType), (intptr_t)setJSHTMLObjectElementCodeType },
+    { "data", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementData), (intptr_t)setJSHTMLObjectElementData },
+    { "declare", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementDeclare), (intptr_t)setJSHTMLObjectElementDeclare },
+    { "height", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementHeight), (intptr_t)setJSHTMLObjectElementHeight },
+    { "hspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementHspace), (intptr_t)setJSHTMLObjectElementHspace },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementName), (intptr_t)setJSHTMLObjectElementName },
+    { "standby", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementStandby), (intptr_t)setJSHTMLObjectElementStandby },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementType), (intptr_t)setJSHTMLObjectElementType },
+    { "useMap", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementUseMap), (intptr_t)setJSHTMLObjectElementUseMap },
+    { "vspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementVspace), (intptr_t)setJSHTMLObjectElementVspace },
+    { "width", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementWidth), (intptr_t)setJSHTMLObjectElementWidth },
+    { "willValidate", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementWillValidate), (intptr_t)0 },
+    { "contentDocument", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementContentDocument), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLObjectElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -106,7 +105,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -129,7 +128,7 @@ bool JSHTMLObjectElementConstructor::getOwnPropertyDescriptor(ExecState* exec, c
 
 static const HashTableValue JSHTMLObjectElementPrototypeTableValues[2] =
 {
-    { "getSVGDocument", DontDelete|Function, (intptr_t)jsHTMLObjectElementPrototypeFunctionGetSVGDocument, (intptr_t)0 },
+    { "getSVGDocument", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLObjectElementPrototypeFunctionGetSVGDocument), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -171,10 +170,6 @@ JSObject* JSHTMLObjectElement::createPrototype(ExecState* exec, JSGlobalObject*
 
 bool JSHTMLObjectElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (canGetItemsForName(exec, static_cast<HTMLObjectElement*>(impl()), propertyName)) {
-        slot.setCustom(this, nameGetter);
-        return true;
-    }
     if (getOwnPropertySlotDelegate(exec, propertyName, slot))
         return true;
     return getStaticValueSlot<JSHTMLObjectElement, Base>(exec, &JSHTMLObjectElementTable, this, propertyName, slot);
@@ -182,171 +177,183 @@ bool JSHTMLObjectElement::getOwnPropertySlot(ExecState* exec, const Identifier&
 
 bool JSHTMLObjectElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    if (canGetItemsForName(exec, static_cast<HTMLObjectElement*>(impl()), propertyName)) {
-        PropertySlot slot;
-        slot.setCustom(this, nameGetter);
-        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-        return true;
-    }
     if (getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))
         return true;
     return getStaticValueDescriptor<JSHTMLObjectElement, Base>(exec, &JSHTMLObjectElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLObjectElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementForm(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    return result;
 }
 
-JSValue jsHTMLObjectElementCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementCode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::codeAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::codeAttr));
+    return result;
 }
 
-JSValue jsHTMLObjectElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::alignAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::alignAttr));
+    return result;
 }
 
-JSValue jsHTMLObjectElementArchive(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementArchive(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::archiveAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::archiveAttr));
+    return result;
 }
 
-JSValue jsHTMLObjectElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementBorder(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::borderAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::borderAttr));
+    return result;
 }
 
-JSValue jsHTMLObjectElementCodeBase(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementCodeBase(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::codebaseAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::codebaseAttr));
+    return result;
 }
 
-JSValue jsHTMLObjectElementCodeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementCodeType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::codetypeAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::codetypeAttr));
+    return result;
 }
 
-JSValue jsHTMLObjectElementData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementData(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->getURLAttribute(HTMLNames::dataAttr));
+    JSValue result = jsString(exec, imp->getURLAttribute(HTMLNames::dataAttr));
+    return result;
 }
 
-JSValue jsHTMLObjectElementDeclare(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementDeclare(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsBoolean(imp->declare());
+    JSValue result = jsBoolean(imp->declare());
+    return result;
 }
 
-JSValue jsHTMLObjectElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::heightAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::heightAttr));
+    return result;
 }
 
-JSValue jsHTMLObjectElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementHspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsNumber(exec, imp->hspace());
+    JSValue result = jsNumber(exec, imp->hspace());
+    return result;
 }
 
-JSValue jsHTMLObjectElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
+    return result;
 }
 
-JSValue jsHTMLObjectElementStandby(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementStandby(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::standbyAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::standbyAttr));
+    return result;
 }
 
-JSValue jsHTMLObjectElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::typeAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::typeAttr));
+    return result;
 }
 
-JSValue jsHTMLObjectElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementUseMap(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::usemapAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::usemapAttr));
+    return result;
 }
 
-JSValue jsHTMLObjectElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementVspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsNumber(exec, imp->vspace());
+    JSValue result = jsNumber(exec, imp->vspace());
+    return result;
 }
 
-JSValue jsHTMLObjectElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::widthAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::widthAttr));
+    return result;
 }
 
-JSValue jsHTMLObjectElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementWillValidate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsBoolean(imp->willValidate());
+    JSValue result = jsBoolean(imp->willValidate());
+    return result;
 }
 
-JSValue jsHTMLObjectElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementContentDocument(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
     return checkNodeSecurity(exec, imp->contentDocument()) ? toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->contentDocument())) : jsUndefined();
 }
 
-JSValue jsHTMLObjectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLObjectElement* domObject = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    JSHTMLObjectElement* domObject = static_cast<JSHTMLObjectElement*>(asObject(slotBase));
     return JSHTMLObjectElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLObjectElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -358,97 +365,113 @@ void JSHTMLObjectElement::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSHTMLObjectElementCode(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::codeAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::alignAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementArchive(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::archiveAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::borderAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementCodeBase(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::codebaseAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementCodeType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::codetypeAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementData(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::dataAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementDeclare(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setDeclare(value.toBoolean(exec));
 }
 
 void setJSHTMLObjectElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::heightAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementHspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setHspace(value.toInt32(exec));
 }
 
 void setJSHTMLObjectElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::nameAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementStandby(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::standbyAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::typeAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementUseMap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::usemapAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementVspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setVspace(value.toInt32(exec));
 }
 
 void setJSHTMLObjectElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
+    JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(thisObject);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::widthAttr, valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
index 4dd52adc56..515477454f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
@@ -52,9 +52,6 @@ public:
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-private:
-    static bool canGetItemsForName(JSC::ExecState*, HTMLObjectElement*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
@@ -68,7 +65,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLObjectElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,42 +77,42 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsHTMLObjectElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLObjectElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLObjectElementCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementForm(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLObjectElementCode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementCode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementArchive(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementArchive(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementArchive(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementBorder(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementCodeBase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementCodeBase(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementCodeBase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementCodeType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementCodeType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementCodeType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementData(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementDeclare(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementDeclare(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementDeclare(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementHspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementHspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementHspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementStandby(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementStandby(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementStandby(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementUseMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementUseMap(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementUseMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementVspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementVspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLObjectElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLObjectElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLObjectElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLObjectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementWillValidate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLObjectElementContentDocument(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLObjectElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
index 340f910375..899fb1900b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
@@ -36,9 +36,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLOptGroupElement);
 
 static const HashTableValue JSHTMLOptGroupElementTableValues[4] =
 {
-    { "disabled", DontDelete, (intptr_t)jsHTMLOptGroupElementDisabled, (intptr_t)setJSHTMLOptGroupElementDisabled },
-    { "label", DontDelete, (intptr_t)jsHTMLOptGroupElementLabel, (intptr_t)setJSHTMLOptGroupElementLabel },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLOptGroupElementConstructor, (intptr_t)0 },
+    { "disabled", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOptGroupElementDisabled), (intptr_t)setJSHTMLOptGroupElementDisabled },
+    { "label", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOptGroupElementLabel), (intptr_t)setJSHTMLOptGroupElementLabel },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOptGroupElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -139,25 +139,27 @@ bool JSHTMLOptGroupElement::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSHTMLOptGroupElement, Base>(exec, &JSHTMLOptGroupElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLOptGroupElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptGroupElementDisabled(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOptGroupElement* castedThis = static_cast<JSHTMLOptGroupElement*>(asObject(slot.slotBase()));
+    JSHTMLOptGroupElement* castedThis = static_cast<JSHTMLOptGroupElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLOptGroupElement* imp = static_cast<HTMLOptGroupElement*>(castedThis->impl());
-    return jsBoolean(imp->disabled());
+    JSValue result = jsBoolean(imp->disabled());
+    return result;
 }
 
-JSValue jsHTMLOptGroupElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptGroupElementLabel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOptGroupElement* castedThis = static_cast<JSHTMLOptGroupElement*>(asObject(slot.slotBase()));
+    JSHTMLOptGroupElement* castedThis = static_cast<JSHTMLOptGroupElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLOptGroupElement* imp = static_cast<HTMLOptGroupElement*>(castedThis->impl());
-    return jsString(exec, imp->label());
+    JSValue result = jsString(exec, imp->label());
+    return result;
 }
 
-JSValue jsHTMLOptGroupElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptGroupElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOptGroupElement* domObject = static_cast<JSHTMLOptGroupElement*>(asObject(slot.slotBase()));
+    JSHTMLOptGroupElement* domObject = static_cast<JSHTMLOptGroupElement*>(asObject(slotBase));
     return JSHTMLOptGroupElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLOptGroupElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -167,13 +169,15 @@ void JSHTMLOptGroupElement::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSHTMLOptGroupElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLOptGroupElement* imp = static_cast<HTMLOptGroupElement*>(static_cast<JSHTMLOptGroupElement*>(thisObject)->impl());
+    JSHTMLOptGroupElement* castedThisObj = static_cast<JSHTMLOptGroupElement*>(thisObject);
+    HTMLOptGroupElement* imp = static_cast<HTMLOptGroupElement*>(castedThisObj->impl());
     imp->setDisabled(value.toBoolean(exec));
 }
 
 void setJSHTMLOptGroupElementLabel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLOptGroupElement* imp = static_cast<HTMLOptGroupElement*>(static_cast<JSHTMLOptGroupElement*>(thisObject)->impl());
+    JSHTMLOptGroupElement* castedThisObj = static_cast<JSHTMLOptGroupElement*>(thisObject);
+    HTMLOptGroupElement* imp = static_cast<HTMLOptGroupElement*>(castedThisObj->impl());
     imp->setLabel(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
index 1d57815b75..5ee9e8052b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLOptGroupElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,11 +66,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLOptGroupElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptGroupElementDisabled(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLOptGroupElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLOptGroupElementLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptGroupElementLabel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLOptGroupElementLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLOptGroupElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptGroupElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
index b10d41cadc..efe14feb0d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
@@ -39,15 +39,15 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLOptionElement);
 
 static const HashTableValue JSHTMLOptionElementTableValues[10] =
 {
-    { "form", DontDelete|ReadOnly, (intptr_t)jsHTMLOptionElementForm, (intptr_t)0 },
-    { "defaultSelected", DontDelete, (intptr_t)jsHTMLOptionElementDefaultSelected, (intptr_t)setJSHTMLOptionElementDefaultSelected },
-    { "text", DontDelete, (intptr_t)jsHTMLOptionElementText, (intptr_t)setJSHTMLOptionElementText },
-    { "index", DontDelete|ReadOnly, (intptr_t)jsHTMLOptionElementIndex, (intptr_t)0 },
-    { "disabled", DontDelete, (intptr_t)jsHTMLOptionElementDisabled, (intptr_t)setJSHTMLOptionElementDisabled },
-    { "label", DontDelete, (intptr_t)jsHTMLOptionElementLabel, (intptr_t)setJSHTMLOptionElementLabel },
-    { "selected", DontDelete, (intptr_t)jsHTMLOptionElementSelected, (intptr_t)setJSHTMLOptionElementSelected },
-    { "value", DontDelete, (intptr_t)jsHTMLOptionElementValue, (intptr_t)setJSHTMLOptionElementValue },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLOptionElementConstructor, (intptr_t)0 },
+    { "form", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOptionElementForm), (intptr_t)0 },
+    { "defaultSelected", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOptionElementDefaultSelected), (intptr_t)setJSHTMLOptionElementDefaultSelected },
+    { "text", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOptionElementText), (intptr_t)setJSHTMLOptionElementText },
+    { "index", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOptionElementIndex), (intptr_t)0 },
+    { "disabled", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOptionElementDisabled), (intptr_t)setJSHTMLOptionElementDisabled },
+    { "label", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOptionElementLabel), (intptr_t)setJSHTMLOptionElementLabel },
+    { "selected", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOptionElementSelected), (intptr_t)setJSHTMLOptionElementSelected },
+    { "value", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOptionElementValue), (intptr_t)setJSHTMLOptionElementValue },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOptionElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -86,7 +86,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -148,73 +148,81 @@ bool JSHTMLOptionElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSHTMLOptionElement, Base>(exec, &JSHTMLOptionElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLOptionElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementForm(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()));
+    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    return result;
 }
 
-JSValue jsHTMLOptionElementDefaultSelected(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementDefaultSelected(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()));
+    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(castedThis->impl());
-    return jsBoolean(imp->defaultSelected());
+    JSValue result = jsBoolean(imp->defaultSelected());
+    return result;
 }
 
-JSValue jsHTMLOptionElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()));
+    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(castedThis->impl());
-    return jsString(exec, imp->text());
+    JSValue result = jsString(exec, imp->text());
+    return result;
 }
 
-JSValue jsHTMLOptionElementIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementIndex(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()));
+    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(castedThis->impl());
-    return jsNumber(exec, imp->index());
+    JSValue result = jsNumber(exec, imp->index());
+    return result;
 }
 
-JSValue jsHTMLOptionElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementDisabled(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()));
+    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(castedThis->impl());
-    return jsBoolean(imp->disabled());
+    JSValue result = jsBoolean(imp->disabled());
+    return result;
 }
 
-JSValue jsHTMLOptionElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementLabel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()));
+    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(castedThis->impl());
-    return jsString(exec, imp->label());
+    JSValue result = jsString(exec, imp->label());
+    return result;
 }
 
-JSValue jsHTMLOptionElementSelected(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementSelected(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()));
+    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(castedThis->impl());
-    return jsBoolean(imp->selected());
+    JSValue result = jsBoolean(imp->selected());
+    return result;
 }
 
-JSValue jsHTMLOptionElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()));
+    JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(castedThis->impl());
-    return jsString(exec, imp->value());
+    JSValue result = jsString(exec, imp->value());
+    return result;
 }
 
-JSValue jsHTMLOptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOptionElement* domObject = static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()));
+    JSHTMLOptionElement* domObject = static_cast<JSHTMLOptionElement*>(asObject(slotBase));
     return JSHTMLOptionElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLOptionElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -224,13 +232,15 @@ void JSHTMLOptionElement::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSHTMLOptionElementDefaultSelected(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
+    JSHTMLOptionElement* castedThisObj = static_cast<JSHTMLOptionElement*>(thisObject);
+    HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(castedThisObj->impl());
     imp->setDefaultSelected(value.toBoolean(exec));
 }
 
 void setJSHTMLOptionElementText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
+    JSHTMLOptionElement* castedThisObj = static_cast<JSHTMLOptionElement*>(thisObject);
+    HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setText(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -238,25 +248,29 @@ void setJSHTMLOptionElementText(ExecState* exec, JSObject* thisObject, JSValue v
 
 void setJSHTMLOptionElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
+    JSHTMLOptionElement* castedThisObj = static_cast<JSHTMLOptionElement*>(thisObject);
+    HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(castedThisObj->impl());
     imp->setDisabled(value.toBoolean(exec));
 }
 
 void setJSHTMLOptionElementLabel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
+    JSHTMLOptionElement* castedThisObj = static_cast<JSHTMLOptionElement*>(thisObject);
+    HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(castedThisObj->impl());
     imp->setLabel(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLOptionElementSelected(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
+    JSHTMLOptionElement* castedThisObj = static_cast<JSHTMLOptionElement*>(thisObject);
+    HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(castedThisObj->impl());
     imp->setSelected(value.toBoolean(exec));
 }
 
 void setJSHTMLOptionElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
+    JSHTMLOptionElement* castedThisObj = static_cast<JSHTMLOptionElement*>(thisObject);
+    HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(castedThisObj->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
index 44a2d3e76b..488c711d34 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -63,7 +63,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLOptionElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,21 +72,21 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLOptionElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLOptionElementDefaultSelected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptionElementForm(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLOptionElementDefaultSelected(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLOptionElementDefaultSelected(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLOptionElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptionElementText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLOptionElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLOptionElementIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLOptionElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptionElementIndex(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLOptionElementDisabled(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLOptionElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLOptionElementLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptionElementLabel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLOptionElementLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLOptionElementSelected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptionElementSelected(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLOptionElementSelected(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLOptionElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptionElementValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLOptionElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLOptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptionElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp
index 1b6f6e6e66..cd824466f3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp
@@ -34,26 +34,74 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLOptionsCollection);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLOptionsCollectionTableValues[3] =
+static const HashTableValue JSHTMLOptionsCollectionTableValues[4] =
 {
-    { "selectedIndex", DontDelete, (intptr_t)jsHTMLOptionsCollectionSelectedIndex, (intptr_t)setJSHTMLOptionsCollectionSelectedIndex },
-    { "length", DontDelete, (intptr_t)jsHTMLOptionsCollectionLength, (intptr_t)setJSHTMLOptionsCollectionLength },
+    { "selectedIndex", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOptionsCollectionSelectedIndex), (intptr_t)setJSHTMLOptionsCollectionSelectedIndex },
+    { "length", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOptionsCollectionLength), (intptr_t)setJSHTMLOptionsCollectionLength },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLOptionsCollectionConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSHTMLOptionsCollectionTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 3, JSHTMLOptionsCollectionTableValues, 0 };
+    { 15, JSHTMLOptionsCollectionTableValues, 0 };
 #else
-    { 4, 3, JSHTMLOptionsCollectionTableValues, 0 };
+    { 9, 7, JSHTMLOptionsCollectionTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSHTMLOptionsCollectionConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSHTMLOptionsCollectionConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSHTMLOptionsCollectionConstructorTableValues, 0 };
+#else
+    { 1, 0, JSHTMLOptionsCollectionConstructorTableValues, 0 };
+#endif
+
+class JSHTMLOptionsCollectionConstructor : public DOMConstructorObject {
+public:
+    JSHTMLOptionsCollectionConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSHTMLOptionsCollectionConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSHTMLOptionsCollectionPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSHTMLOptionsCollectionConstructor::s_info = { "HTMLOptionsCollectionConstructor", 0, &JSHTMLOptionsCollectionConstructorTable, 0 };
+
+bool JSHTMLOptionsCollectionConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSHTMLOptionsCollectionConstructor, DOMObject>(exec, &JSHTMLOptionsCollectionConstructorTable, this, propertyName, slot);
+}
+
+bool JSHTMLOptionsCollectionConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLOptionsCollectionConstructor, DOMObject>(exec, &JSHTMLOptionsCollectionConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLOptionsCollectionPrototypeTableValues[3] =
 {
-    { "add", DontDelete|Function, (intptr_t)jsHTMLOptionsCollectionPrototypeFunctionAdd, (intptr_t)2 },
-    { "remove", DontDelete|Function, (intptr_t)jsHTMLOptionsCollectionPrototypeFunctionRemove, (intptr_t)1 },
+    { "add", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLOptionsCollectionPrototypeFunctionAdd), (intptr_t)2 },
+    { "remove", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLOptionsCollectionPrototypeFunctionRemove), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -103,20 +151,26 @@ bool JSHTMLOptionsCollection::getOwnPropertyDescriptor(ExecState* exec, const Id
     return getStaticValueDescriptor<JSHTMLOptionsCollection, Base>(exec, &JSHTMLOptionsCollectionTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLOptionsCollectionSelectedIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionsCollectionSelectedIndex(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOptionsCollection* castedThis = static_cast<JSHTMLOptionsCollection*>(asObject(slot.slotBase()));
+    JSHTMLOptionsCollection* castedThis = static_cast<JSHTMLOptionsCollection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(castedThis->impl());
-    return jsNumber(exec, imp->selectedIndex());
+    JSValue result = jsNumber(exec, imp->selectedIndex());
+    return result;
 }
 
-JSValue jsHTMLOptionsCollectionLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionsCollectionLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLOptionsCollection* castedThis = static_cast<JSHTMLOptionsCollection*>(asObject(slot.slotBase()));
+    JSHTMLOptionsCollection* castedThis = static_cast<JSHTMLOptionsCollection*>(asObject(slotBase));
     return castedThis->length(exec);
 }
 
+JSValue jsHTMLOptionsCollectionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLOptionsCollection* domObject = static_cast<JSHTMLOptionsCollection*>(asObject(slotBase));
+    return JSHTMLOptionsCollection::getConstructor(exec, domObject->globalObject());
+}
 void JSHTMLOptionsCollection::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     bool ok;
@@ -136,7 +190,8 @@ void JSHTMLOptionsCollection::put(ExecState* exec, unsigned propertyName, JSValu
 
 void setJSHTMLOptionsCollectionSelectedIndex(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(static_cast<JSHTMLOptionsCollection*>(thisObject)->impl());
+    JSHTMLOptionsCollection* castedThisObj = static_cast<JSHTMLOptionsCollection*>(thisObject);
+    HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(castedThisObj->impl());
     imp->setSelectedIndex(value.toInt32(exec));
 }
 
@@ -145,6 +200,11 @@ void setJSHTMLOptionsCollectionLength(ExecState* exec, JSObject* thisObject, JSV
     static_cast<JSHTMLOptionsCollection*>(thisObject)->setLength(exec, value);
 }
 
+JSValue JSHTMLOptionsCollection::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSHTMLOptionsCollectionConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsHTMLOptionsCollectionPrototypeFunctionAdd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
index 034fa1b27e..09f2798404 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom attributes
     JSC::JSValue length(JSC::ExecState*) const;
@@ -74,7 +75,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLOptionsCollectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -87,10 +88,11 @@ JSC::JSValue JSC_HOST_CALL jsHTMLOptionsCollectionPrototypeFunctionAdd(JSC::Exec
 JSC::JSValue JSC_HOST_CALL jsHTMLOptionsCollectionPrototypeFunctionRemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLOptionsCollectionSelectedIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptionsCollectionSelectedIndex(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLOptionsCollectionSelectedIndex(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLOptionsCollectionLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptionsCollectionLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLOptionsCollectionLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptionsCollectionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
index 098d111c0b..0372294275 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
@@ -36,8 +36,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLParagraphElement);
 
 static const HashTableValue JSHTMLParagraphElementTableValues[3] =
 {
-    { "align", DontDelete, (intptr_t)jsHTMLParagraphElementAlign, (intptr_t)setJSHTMLParagraphElementAlign },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLParagraphElementConstructor, (intptr_t)0 },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLParagraphElementAlign), (intptr_t)setJSHTMLParagraphElementAlign },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLParagraphElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,7 +76,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -138,17 +138,18 @@ bool JSHTMLParagraphElement::getOwnPropertyDescriptor(ExecState* exec, const Ide
     return getStaticValueDescriptor<JSHTMLParagraphElement, Base>(exec, &JSHTMLParagraphElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLParagraphElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParagraphElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLParagraphElement* castedThis = static_cast<JSHTMLParagraphElement*>(asObject(slot.slotBase()));
+    JSHTMLParagraphElement* castedThis = static_cast<JSHTMLParagraphElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLParagraphElement* imp = static_cast<HTMLParagraphElement*>(castedThis->impl());
-    return jsString(exec, imp->align());
+    JSValue result = jsString(exec, imp->align());
+    return result;
 }
 
-JSValue jsHTMLParagraphElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParagraphElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLParagraphElement* domObject = static_cast<JSHTMLParagraphElement*>(asObject(slot.slotBase()));
+    JSHTMLParagraphElement* domObject = static_cast<JSHTMLParagraphElement*>(asObject(slotBase));
     return JSHTMLParagraphElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLParagraphElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -158,7 +159,8 @@ void JSHTMLParagraphElement::put(ExecState* exec, const Identifier& propertyName
 
 void setJSHTMLParagraphElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLParagraphElement* imp = static_cast<HTMLParagraphElement*>(static_cast<JSHTMLParagraphElement*>(thisObject)->impl());
+    JSHTMLParagraphElement* castedThisObj = static_cast<JSHTMLParagraphElement*>(thisObject);
+    HTMLParagraphElement* imp = static_cast<HTMLParagraphElement*>(castedThisObj->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
index fc15b12b89..27b29fb6a1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLParagraphElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,9 +66,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLParagraphElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLParagraphElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLParagraphElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLParagraphElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLParagraphElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
index 51eb728b63..c58876de3c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
@@ -36,11 +36,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLParamElement);
 
 static const HashTableValue JSHTMLParamElementTableValues[6] =
 {
-    { "name", DontDelete, (intptr_t)jsHTMLParamElementName, (intptr_t)setJSHTMLParamElementName },
-    { "type", DontDelete, (intptr_t)jsHTMLParamElementType, (intptr_t)setJSHTMLParamElementType },
-    { "value", DontDelete, (intptr_t)jsHTMLParamElementValue, (intptr_t)setJSHTMLParamElementValue },
-    { "valueType", DontDelete, (intptr_t)jsHTMLParamElementValueType, (intptr_t)setJSHTMLParamElementValueType },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLParamElementConstructor, (intptr_t)0 },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLParamElementName), (intptr_t)setJSHTMLParamElementName },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLParamElementType), (intptr_t)setJSHTMLParamElementType },
+    { "value", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLParamElementValue), (intptr_t)setJSHTMLParamElementValue },
+    { "valueType", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLParamElementValueType), (intptr_t)setJSHTMLParamElementValueType },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLParamElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -141,41 +141,45 @@ bool JSHTMLParamElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSHTMLParamElement, Base>(exec, &JSHTMLParamElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLParamElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParamElementName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLParamElement* castedThis = static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()));
+    JSHTMLParamElement* castedThis = static_cast<JSHTMLParamElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsHTMLParamElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParamElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLParamElement* castedThis = static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()));
+    JSHTMLParamElement* castedThis = static_cast<JSHTMLParamElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsHTMLParamElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParamElementValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLParamElement* castedThis = static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()));
+    JSHTMLParamElement* castedThis = static_cast<JSHTMLParamElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(castedThis->impl());
-    return jsString(exec, imp->value());
+    JSValue result = jsString(exec, imp->value());
+    return result;
 }
 
-JSValue jsHTMLParamElementValueType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParamElementValueType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLParamElement* castedThis = static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()));
+    JSHTMLParamElement* castedThis = static_cast<JSHTMLParamElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(castedThis->impl());
-    return jsString(exec, imp->valueType());
+    JSValue result = jsString(exec, imp->valueType());
+    return result;
 }
 
-JSValue jsHTMLParamElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParamElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLParamElement* domObject = static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()));
+    JSHTMLParamElement* domObject = static_cast<JSHTMLParamElement*>(asObject(slotBase));
     return JSHTMLParamElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLParamElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -185,25 +189,29 @@ void JSHTMLParamElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSHTMLParamElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(thisObject)->impl());
+    JSHTMLParamElement* castedThisObj = static_cast<JSHTMLParamElement*>(thisObject);
+    HTMLParamElement* imp = static_cast<HTMLParamElement*>(castedThisObj->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLParamElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(thisObject)->impl());
+    JSHTMLParamElement* castedThisObj = static_cast<JSHTMLParamElement*>(thisObject);
+    HTMLParamElement* imp = static_cast<HTMLParamElement*>(castedThisObj->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLParamElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(thisObject)->impl());
+    JSHTMLParamElement* castedThisObj = static_cast<JSHTMLParamElement*>(thisObject);
+    HTMLParamElement* imp = static_cast<HTMLParamElement*>(castedThisObj->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLParamElementValueType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(thisObject)->impl());
+    JSHTMLParamElement* castedThisObj = static_cast<JSHTMLParamElement*>(thisObject);
+    HTMLParamElement* imp = static_cast<HTMLParamElement*>(castedThisObj->impl());
     imp->setValueType(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
index be8f7b8f51..83553c08e5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLParamElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,15 +66,15 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLParamElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLParamElementName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLParamElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLParamElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLParamElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLParamElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLParamElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLParamElementValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLParamElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLParamElementValueType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLParamElementValueType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLParamElementValueType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLParamElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLParamElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
index d06b203b86..8b01c59f1a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
@@ -35,9 +35,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLPreElement);
 
 static const HashTableValue JSHTMLPreElementTableValues[4] =
 {
-    { "width", DontDelete, (intptr_t)jsHTMLPreElementWidth, (intptr_t)setJSHTMLPreElementWidth },
-    { "wrap", DontDelete, (intptr_t)jsHTMLPreElementWrap, (intptr_t)setJSHTMLPreElementWrap },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLPreElementConstructor, (intptr_t)0 },
+    { "width", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLPreElementWidth), (intptr_t)setJSHTMLPreElementWidth },
+    { "wrap", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLPreElementWrap), (intptr_t)setJSHTMLPreElementWrap },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLPreElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,7 +76,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -138,25 +138,27 @@ bool JSHTMLPreElement::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSHTMLPreElement, Base>(exec, &JSHTMLPreElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLPreElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLPreElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLPreElement* castedThis = static_cast<JSHTMLPreElement*>(asObject(slot.slotBase()));
+    JSHTMLPreElement* castedThis = static_cast<JSHTMLPreElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLPreElement* imp = static_cast<HTMLPreElement*>(castedThis->impl());
-    return jsNumber(exec, imp->width());
+    JSValue result = jsNumber(exec, imp->width());
+    return result;
 }
 
-JSValue jsHTMLPreElementWrap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLPreElementWrap(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLPreElement* castedThis = static_cast<JSHTMLPreElement*>(asObject(slot.slotBase()));
+    JSHTMLPreElement* castedThis = static_cast<JSHTMLPreElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLPreElement* imp = static_cast<HTMLPreElement*>(castedThis->impl());
-    return jsBoolean(imp->wrap());
+    JSValue result = jsBoolean(imp->wrap());
+    return result;
 }
 
-JSValue jsHTMLPreElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLPreElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLPreElement* domObject = static_cast<JSHTMLPreElement*>(asObject(slot.slotBase()));
+    JSHTMLPreElement* domObject = static_cast<JSHTMLPreElement*>(asObject(slotBase));
     return JSHTMLPreElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLPreElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -166,13 +168,15 @@ void JSHTMLPreElement::put(ExecState* exec, const Identifier& propertyName, JSVa
 
 void setJSHTMLPreElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLPreElement* imp = static_cast<HTMLPreElement*>(static_cast<JSHTMLPreElement*>(thisObject)->impl());
+    JSHTMLPreElement* castedThisObj = static_cast<JSHTMLPreElement*>(thisObject);
+    HTMLPreElement* imp = static_cast<HTMLPreElement*>(castedThisObj->impl());
     imp->setWidth(value.toInt32(exec));
 }
 
 void setJSHTMLPreElementWrap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLPreElement* imp = static_cast<HTMLPreElement*>(static_cast<JSHTMLPreElement*>(thisObject)->impl());
+    JSHTMLPreElement* castedThisObj = static_cast<JSHTMLPreElement*>(thisObject);
+    HTMLPreElement* imp = static_cast<HTMLPreElement*>(castedThisObj->impl());
     imp->setWrap(value.toBoolean(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
index ef78b720a2..69162a9df2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLPreElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,11 +66,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLPreElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLPreElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLPreElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLPreElementWrap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLPreElementWrap(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLPreElementWrap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLPreElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLPreElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLProgressElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLProgressElement.cpp
new file mode 100644
index 0000000000..aedc074921
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLProgressElement.cpp
@@ -0,0 +1,216 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(PROGRESS_TAG)
+
+#include "JSHTMLProgressElement.h"
+
+#include "HTMLFormElement.h"
+#include "HTMLProgressElement.h"
+#include "JSHTMLFormElement.h"
+#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLProgressElement);
+
+/* Hash table */
+
+static const HashTableValue JSHTMLProgressElementTableValues[6] =
+{
+    { "value", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLProgressElementValue), (intptr_t)setJSHTMLProgressElementValue },
+    { "max", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLProgressElementMax), (intptr_t)setJSHTMLProgressElementMax },
+    { "position", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLProgressElementPosition), (intptr_t)0 },
+    { "form", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLProgressElementForm), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLProgressElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSHTMLProgressElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 7, JSHTMLProgressElementTableValues, 0 };
+#else
+    { 16, 15, JSHTMLProgressElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSHTMLProgressElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSHTMLProgressElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSHTMLProgressElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSHTMLProgressElementConstructorTableValues, 0 };
+#endif
+
+class JSHTMLProgressElementConstructor : public DOMConstructorObject {
+public:
+    JSHTMLProgressElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSHTMLProgressElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSHTMLProgressElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSHTMLProgressElementConstructor::s_info = { "HTMLProgressElementConstructor", 0, &JSHTMLProgressElementConstructorTable, 0 };
+
+bool JSHTMLProgressElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSHTMLProgressElementConstructor, DOMObject>(exec, &JSHTMLProgressElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSHTMLProgressElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLProgressElementConstructor, DOMObject>(exec, &JSHTMLProgressElementConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSHTMLProgressElementPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSHTMLProgressElementPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSHTMLProgressElementPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSHTMLProgressElementPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSHTMLProgressElementPrototype::s_info = { "HTMLProgressElementPrototype", 0, &JSHTMLProgressElementPrototypeTable, 0 };
+
+JSObject* JSHTMLProgressElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSHTMLProgressElement>(exec, globalObject);
+}
+
+const ClassInfo JSHTMLProgressElement::s_info = { "HTMLProgressElement", &JSHTMLElement::s_info, &JSHTMLProgressElementTable, 0 };
+
+JSHTMLProgressElement::JSHTMLProgressElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLProgressElement> impl)
+    : JSHTMLElement(structure, globalObject, impl)
+{
+}
+
+JSObject* JSHTMLProgressElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSHTMLProgressElementPrototype(JSHTMLProgressElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
+}
+
+bool JSHTMLProgressElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSHTMLProgressElement, Base>(exec, &JSHTMLProgressElementTable, this, propertyName, slot);
+}
+
+bool JSHTMLProgressElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLProgressElement, Base>(exec, &JSHTMLProgressElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsHTMLProgressElementValue(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLProgressElement* castedThis = static_cast<JSHTMLProgressElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLProgressElement* imp = static_cast<HTMLProgressElement*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->value());
+    return result;
+}
+
+JSValue jsHTMLProgressElementMax(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLProgressElement* castedThis = static_cast<JSHTMLProgressElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLProgressElement* imp = static_cast<HTMLProgressElement*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->max());
+    return result;
+}
+
+JSValue jsHTMLProgressElementPosition(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLProgressElement* castedThis = static_cast<JSHTMLProgressElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLProgressElement* imp = static_cast<HTMLProgressElement*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->position());
+    return result;
+}
+
+JSValue jsHTMLProgressElementForm(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLProgressElement* castedThis = static_cast<JSHTMLProgressElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLProgressElement* imp = static_cast<HTMLProgressElement*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    return result;
+}
+
+JSValue jsHTMLProgressElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLProgressElement* domObject = static_cast<JSHTMLProgressElement*>(asObject(slotBase));
+    return JSHTMLProgressElement::getConstructor(exec, domObject->globalObject());
+}
+void JSHTMLProgressElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSHTMLProgressElement, Base>(exec, propertyName, value, &JSHTMLProgressElementTable, this, slot);
+}
+
+void setJSHTMLProgressElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSHTMLProgressElement* castedThisObj = static_cast<JSHTMLProgressElement*>(thisObject);
+    HTMLProgressElement* imp = static_cast<HTMLProgressElement*>(castedThisObj->impl());
+    imp->setValue(value.toNumber(exec));
+}
+
+void setJSHTMLProgressElementMax(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSHTMLProgressElement* castedThisObj = static_cast<JSHTMLProgressElement*>(thisObject);
+    HTMLProgressElement* imp = static_cast<HTMLProgressElement*>(castedThisObj->impl());
+    imp->setMax(value.toNumber(exec));
+}
+
+JSValue JSHTMLProgressElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSHTMLProgressElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+
+}
+
+#endif // ENABLE(PROGRESS_TAG)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLProgressElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLProgressElement.h
new file mode 100644
index 0000000000..d993038393
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLProgressElement.h
@@ -0,0 +1,83 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSHTMLProgressElement_h
+#define JSHTMLProgressElement_h
+
+#if ENABLE(PROGRESS_TAG)
+
+#include "JSHTMLElement.h"
+
+namespace WebCore {
+
+class HTMLProgressElement;
+
+class JSHTMLProgressElement : public JSHTMLElement {
+    typedef JSHTMLElement Base;
+public:
+    JSHTMLProgressElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLProgressElement>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+
+class JSHTMLProgressElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSHTMLProgressElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+// Attributes
+
+JSC::JSValue jsHTMLProgressElementValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLProgressElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLProgressElementMax(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSHTMLProgressElementMax(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLProgressElementPosition(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLProgressElementForm(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLProgressElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif // ENABLE(PROGRESS_TAG)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
index c1b9957a2e..00a486ac6c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
@@ -36,8 +36,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLQuoteElement);
 
 static const HashTableValue JSHTMLQuoteElementTableValues[3] =
 {
-    { "cite", DontDelete, (intptr_t)jsHTMLQuoteElementCite, (intptr_t)setJSHTMLQuoteElementCite },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLQuoteElementConstructor, (intptr_t)0 },
+    { "cite", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLQuoteElementCite), (intptr_t)setJSHTMLQuoteElementCite },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLQuoteElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,7 +76,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -138,17 +138,18 @@ bool JSHTMLQuoteElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSHTMLQuoteElement, Base>(exec, &JSHTMLQuoteElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLQuoteElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLQuoteElementCite(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLQuoteElement* castedThis = static_cast<JSHTMLQuoteElement*>(asObject(slot.slotBase()));
+    JSHTMLQuoteElement* castedThis = static_cast<JSHTMLQuoteElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLQuoteElement* imp = static_cast<HTMLQuoteElement*>(castedThis->impl());
-    return jsString(exec, imp->cite());
+    JSValue result = jsString(exec, imp->cite());
+    return result;
 }
 
-JSValue jsHTMLQuoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLQuoteElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLQuoteElement* domObject = static_cast<JSHTMLQuoteElement*>(asObject(slot.slotBase()));
+    JSHTMLQuoteElement* domObject = static_cast<JSHTMLQuoteElement*>(asObject(slotBase));
     return JSHTMLQuoteElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLQuoteElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -158,7 +159,8 @@ void JSHTMLQuoteElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSHTMLQuoteElementCite(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLQuoteElement* imp = static_cast<HTMLQuoteElement*>(static_cast<JSHTMLQuoteElement*>(thisObject)->impl());
+    JSHTMLQuoteElement* castedThisObj = static_cast<JSHTMLQuoteElement*>(thisObject);
+    HTMLQuoteElement* imp = static_cast<HTMLQuoteElement*>(castedThisObj->impl());
     imp->setCite(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
index f0f1248950..3d20c3b4fb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLQuoteElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,9 +66,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLQuoteElementCite(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLQuoteElementCite(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLQuoteElementCite(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLQuoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLQuoteElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
index 4e396986d8..429c340d1e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
@@ -36,14 +36,14 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLScriptElement);
 
 static const HashTableValue JSHTMLScriptElementTableValues[9] =
 {
-    { "text", DontDelete, (intptr_t)jsHTMLScriptElementText, (intptr_t)setJSHTMLScriptElementText },
-    { "htmlFor", DontDelete, (intptr_t)jsHTMLScriptElementHtmlFor, (intptr_t)setJSHTMLScriptElementHtmlFor },
-    { "event", DontDelete, (intptr_t)jsHTMLScriptElementEvent, (intptr_t)setJSHTMLScriptElementEvent },
-    { "charset", DontDelete, (intptr_t)jsHTMLScriptElementCharset, (intptr_t)setJSHTMLScriptElementCharset },
-    { "defer", DontDelete, (intptr_t)jsHTMLScriptElementDefer, (intptr_t)setJSHTMLScriptElementDefer },
-    { "src", DontDelete, (intptr_t)jsHTMLScriptElementSrc, (intptr_t)setJSHTMLScriptElementSrc },
-    { "type", DontDelete, (intptr_t)jsHTMLScriptElementType, (intptr_t)setJSHTMLScriptElementType },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLScriptElementConstructor, (intptr_t)0 },
+    { "text", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLScriptElementText), (intptr_t)setJSHTMLScriptElementText },
+    { "htmlFor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLScriptElementHtmlFor), (intptr_t)setJSHTMLScriptElementHtmlFor },
+    { "event", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLScriptElementEvent), (intptr_t)setJSHTMLScriptElementEvent },
+    { "charset", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLScriptElementCharset), (intptr_t)setJSHTMLScriptElementCharset },
+    { "defer", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLScriptElementDefer), (intptr_t)setJSHTMLScriptElementDefer },
+    { "src", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLScriptElementSrc), (intptr_t)setJSHTMLScriptElementSrc },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLScriptElementType), (intptr_t)setJSHTMLScriptElementType },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLScriptElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -82,7 +82,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -144,65 +144,72 @@ bool JSHTMLScriptElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSHTMLScriptElement, Base>(exec, &JSHTMLScriptElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLScriptElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLScriptElement* castedThis = static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()));
+    JSHTMLScriptElement* castedThis = static_cast<JSHTMLScriptElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(castedThis->impl());
-    return jsString(exec, imp->text());
+    JSValue result = jsString(exec, imp->text());
+    return result;
 }
 
-JSValue jsHTMLScriptElementHtmlFor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementHtmlFor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLScriptElement* castedThis = static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()));
+    JSHTMLScriptElement* castedThis = static_cast<JSHTMLScriptElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(castedThis->impl());
-    return jsString(exec, imp->htmlFor());
+    JSValue result = jsString(exec, imp->htmlFor());
+    return result;
 }
 
-JSValue jsHTMLScriptElementEvent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementEvent(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLScriptElement* castedThis = static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()));
+    JSHTMLScriptElement* castedThis = static_cast<JSHTMLScriptElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(castedThis->impl());
-    return jsString(exec, imp->event());
+    JSValue result = jsString(exec, imp->event());
+    return result;
 }
 
-JSValue jsHTMLScriptElementCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementCharset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLScriptElement* castedThis = static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()));
+    JSHTMLScriptElement* castedThis = static_cast<JSHTMLScriptElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(castedThis->impl());
-    return jsString(exec, imp->charset());
+    JSValue result = jsString(exec, imp->charset());
+    return result;
 }
 
-JSValue jsHTMLScriptElementDefer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementDefer(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLScriptElement* castedThis = static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()));
+    JSHTMLScriptElement* castedThis = static_cast<JSHTMLScriptElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(castedThis->impl());
-    return jsBoolean(imp->defer());
+    JSValue result = jsBoolean(imp->defer());
+    return result;
 }
 
-JSValue jsHTMLScriptElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementSrc(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLScriptElement* castedThis = static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()));
+    JSHTMLScriptElement* castedThis = static_cast<JSHTMLScriptElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(castedThis->impl());
-    return jsString(exec, imp->src());
+    JSValue result = jsString(exec, imp->src());
+    return result;
 }
 
-JSValue jsHTMLScriptElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLScriptElement* castedThis = static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()));
+    JSHTMLScriptElement* castedThis = static_cast<JSHTMLScriptElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsHTMLScriptElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLScriptElement* domObject = static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()));
+    JSHTMLScriptElement* domObject = static_cast<JSHTMLScriptElement*>(asObject(slotBase));
     return JSHTMLScriptElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLScriptElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -212,43 +219,50 @@ void JSHTMLScriptElement::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSHTMLScriptElementText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
+    JSHTMLScriptElement* castedThisObj = static_cast<JSHTMLScriptElement*>(thisObject);
+    HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(castedThisObj->impl());
     imp->setText(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLScriptElementHtmlFor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
+    JSHTMLScriptElement* castedThisObj = static_cast<JSHTMLScriptElement*>(thisObject);
+    HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(castedThisObj->impl());
     imp->setHtmlFor(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLScriptElementEvent(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
+    JSHTMLScriptElement* castedThisObj = static_cast<JSHTMLScriptElement*>(thisObject);
+    HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(castedThisObj->impl());
     imp->setEvent(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLScriptElementCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
+    JSHTMLScriptElement* castedThisObj = static_cast<JSHTMLScriptElement*>(thisObject);
+    HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(castedThisObj->impl());
     imp->setCharset(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLScriptElementDefer(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
+    JSHTMLScriptElement* castedThisObj = static_cast<JSHTMLScriptElement*>(thisObject);
+    HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(castedThisObj->impl());
     imp->setDefer(value.toBoolean(exec));
 }
 
 void setJSHTMLScriptElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
+    JSHTMLScriptElement* castedThisObj = static_cast<JSHTMLScriptElement*>(thisObject);
+    HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(castedThisObj->impl());
     imp->setSrc(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLScriptElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
+    JSHTMLScriptElement* castedThisObj = static_cast<JSHTMLScriptElement*>(thisObject);
+    HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(castedThisObj->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
index 93f4dba079..65c3763772 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLScriptElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,21 +66,21 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLScriptElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLScriptElementText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLScriptElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLScriptElementHtmlFor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLScriptElementHtmlFor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLScriptElementHtmlFor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLScriptElementEvent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLScriptElementEvent(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLScriptElementEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLScriptElementCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLScriptElementCharset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLScriptElementCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLScriptElementDefer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLScriptElementDefer(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLScriptElementDefer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLScriptElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLScriptElementSrc(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLScriptElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLScriptElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLScriptElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLScriptElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLScriptElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLScriptElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
index 5feda47605..c931c7643d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
@@ -47,22 +47,23 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLSelectElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLSelectElementTableValues[15] =
-{
-    { "type", DontDelete|ReadOnly, (intptr_t)jsHTMLSelectElementType, (intptr_t)0 },
-    { "selectedIndex", DontDelete, (intptr_t)jsHTMLSelectElementSelectedIndex, (intptr_t)setJSHTMLSelectElementSelectedIndex },
-    { "value", DontDelete, (intptr_t)jsHTMLSelectElementValue, (intptr_t)setJSHTMLSelectElementValue },
-    { "length", DontDelete, (intptr_t)jsHTMLSelectElementLength, (intptr_t)setJSHTMLSelectElementLength },
-    { "form", DontDelete|ReadOnly, (intptr_t)jsHTMLSelectElementForm, (intptr_t)0 },
-    { "validity", DontDelete|ReadOnly, (intptr_t)jsHTMLSelectElementValidity, (intptr_t)0 },
-    { "willValidate", DontDelete|ReadOnly, (intptr_t)jsHTMLSelectElementWillValidate, (intptr_t)0 },
-    { "options", DontDelete|ReadOnly, (intptr_t)jsHTMLSelectElementOptions, (intptr_t)0 },
-    { "disabled", DontDelete, (intptr_t)jsHTMLSelectElementDisabled, (intptr_t)setJSHTMLSelectElementDisabled },
-    { "autofocus", DontDelete, (intptr_t)jsHTMLSelectElementAutofocus, (intptr_t)setJSHTMLSelectElementAutofocus },
-    { "multiple", DontDelete, (intptr_t)jsHTMLSelectElementMultiple, (intptr_t)setJSHTMLSelectElementMultiple },
-    { "name", DontDelete, (intptr_t)jsHTMLSelectElementName, (intptr_t)setJSHTMLSelectElementName },
-    { "size", DontDelete, (intptr_t)jsHTMLSelectElementSize, (intptr_t)setJSHTMLSelectElementSize },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLSelectElementConstructor, (intptr_t)0 },
+static const HashTableValue JSHTMLSelectElementTableValues[16] =
+{
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSelectElementType), (intptr_t)0 },
+    { "selectedIndex", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSelectElementSelectedIndex), (intptr_t)setJSHTMLSelectElementSelectedIndex },
+    { "value", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSelectElementValue), (intptr_t)setJSHTMLSelectElementValue },
+    { "length", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSelectElementLength), (intptr_t)setJSHTMLSelectElementLength },
+    { "form", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSelectElementForm), (intptr_t)0 },
+    { "validity", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSelectElementValidity), (intptr_t)0 },
+    { "willValidate", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSelectElementWillValidate), (intptr_t)0 },
+    { "validationMessage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSelectElementValidationMessage), (intptr_t)0 },
+    { "options", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSelectElementOptions), (intptr_t)0 },
+    { "disabled", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSelectElementDisabled), (intptr_t)setJSHTMLSelectElementDisabled },
+    { "autofocus", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSelectElementAutofocus), (intptr_t)setJSHTMLSelectElementAutofocus },
+    { "multiple", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSelectElementMultiple), (intptr_t)setJSHTMLSelectElementMultiple },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSelectElementName), (intptr_t)setJSHTMLSelectElementName },
+    { "size", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSelectElementSize), (intptr_t)setJSHTMLSelectElementSize },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSelectElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -101,7 +102,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -124,12 +125,12 @@ bool JSHTMLSelectElementConstructor::getOwnPropertyDescriptor(ExecState* exec, c
 
 static const HashTableValue JSHTMLSelectElementPrototypeTableValues[7] =
 {
-    { "checkValidity", DontDelete|Function, (intptr_t)jsHTMLSelectElementPrototypeFunctionCheckValidity, (intptr_t)0 },
-    { "setCustomValidity", DontDelete|Function, (intptr_t)jsHTMLSelectElementPrototypeFunctionSetCustomValidity, (intptr_t)1 },
-    { "add", DontDelete|Function, (intptr_t)jsHTMLSelectElementPrototypeFunctionAdd, (intptr_t)2 },
-    { "remove", DontDelete|Function, (intptr_t)jsHTMLSelectElementPrototypeFunctionRemove, (intptr_t)0 },
-    { "item", DontDelete|Function, (intptr_t)jsHTMLSelectElementPrototypeFunctionItem, (intptr_t)1 },
-    { "namedItem", DontDelete|Function, (intptr_t)jsHTMLSelectElementPrototypeFunctionNamedItem, (intptr_t)1 },
+    { "checkValidity", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLSelectElementPrototypeFunctionCheckValidity), (intptr_t)0 },
+    { "setCustomValidity", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLSelectElementPrototypeFunctionSetCustomValidity), (intptr_t)1 },
+    { "add", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLSelectElementPrototypeFunctionAdd), (intptr_t)2 },
+    { "remove", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLSelectElementPrototypeFunctionRemove), (intptr_t)0 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLSelectElementPrototypeFunctionItem), (intptr_t)1 },
+    { "namedItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLSelectElementPrototypeFunctionNamedItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -214,113 +215,135 @@ bool JSHTMLSelectElement::getOwnPropertySlot(ExecState* exec, unsigned propertyN
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsHTMLSelectElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
+    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsHTMLSelectElementSelectedIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementSelectedIndex(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
+    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThis->impl());
-    return jsNumber(exec, imp->selectedIndex());
+    JSValue result = jsNumber(exec, imp->selectedIndex());
+    return result;
 }
 
-JSValue jsHTMLSelectElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
+    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThis->impl());
-    return jsString(exec, imp->value());
+    JSValue result = jsString(exec, imp->value());
+    return result;
 }
 
-JSValue jsHTMLSelectElementLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
+    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsHTMLSelectElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementForm(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
+    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    return result;
 }
 
-JSValue jsHTMLSelectElementValidity(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementValidity(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
+    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->validity()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->validity()));
+    return result;
 }
 
-JSValue jsHTMLSelectElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementWillValidate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
+    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThis->impl());
-    return jsBoolean(imp->willValidate());
+    JSValue result = jsBoolean(imp->willValidate());
+    return result;
 }
 
-JSValue jsHTMLSelectElementOptions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementValidationMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
+    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->options()));
+    JSValue result = jsString(exec, imp->validationMessage());
+    return result;
 }
 
-JSValue jsHTMLSelectElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementOptions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
+    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThis->impl());
-    return jsBoolean(imp->disabled());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->options()));
+    return result;
 }
 
-JSValue jsHTMLSelectElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementDisabled(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
+    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThis->impl());
-    return jsBoolean(imp->autofocus());
+    JSValue result = jsBoolean(imp->disabled());
+    return result;
 }
 
-JSValue jsHTMLSelectElementMultiple(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementAutofocus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
+    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThis->impl());
-    return jsBoolean(imp->multiple());
+    JSValue result = jsBoolean(imp->autofocus());
+    return result;
 }
 
-JSValue jsHTMLSelectElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementMultiple(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
+    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsBoolean(imp->multiple());
+    return result;
 }
 
-JSValue jsHTMLSelectElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
+    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThis->impl());
-    return jsNumber(exec, imp->size());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsHTMLSelectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementSize(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSelectElement* domObject = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
+    JSHTMLSelectElement* castedThis = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->size());
+    return result;
+}
+
+JSValue jsHTMLSelectElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLSelectElement* domObject = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
     return JSHTMLSelectElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLSelectElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -342,19 +365,22 @@ void JSHTMLSelectElement::put(ExecState* exec, unsigned propertyName, JSValue va
 
 void setJSHTMLSelectElementSelectedIndex(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
+    JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(thisObject);
+    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
     imp->setSelectedIndex(value.toInt32(exec));
 }
 
 void setJSHTMLSelectElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
+    JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(thisObject);
+    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLSelectElementLength(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
+    JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(thisObject);
+    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setLength(value.toInt32(exec), ec);
     setDOMException(exec, ec);
@@ -362,39 +388,44 @@ void setJSHTMLSelectElementLength(ExecState* exec, JSObject* thisObject, JSValue
 
 void setJSHTMLSelectElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
+    JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(thisObject);
+    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
     imp->setDisabled(value.toBoolean(exec));
 }
 
 void setJSHTMLSelectElementAutofocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
+    JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(thisObject);
+    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
     imp->setAutofocus(value.toBoolean(exec));
 }
 
 void setJSHTMLSelectElementMultiple(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
+    JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(thisObject);
+    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
     imp->setMultiple(value.toBoolean(exec));
 }
 
 void setJSHTMLSelectElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
+    JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(thisObject);
+    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLSelectElementSize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
+    JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(thisObject);
+    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
     imp->setSize(value.toInt32(exec));
 }
 
-void JSHTMLSelectElement::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSHTMLSelectElement::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<HTMLSelectElement*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSHTMLSelectElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -486,10 +517,10 @@ JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionNamedItem(ExecState* e
 }
 
 
-JSValue JSHTMLSelectElement::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSHTMLSelectElement::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSHTMLSelectElement* thisObj = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<HTMLSelectElement*>(thisObj->impl())->item(slot.index()));
+    JSHTMLSelectElement* thisObj = static_cast<JSHTMLSelectElement*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<HTMLSelectElement*>(thisObj->impl())->item(index));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
index 32066cdf95..4479f4a523 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
@@ -42,17 +42,17 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom functions
     JSC::JSValue remove(JSC::ExecState*, const JSC::ArgList&);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
 
@@ -67,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLSelectElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -84,28 +84,29 @@ JSC::JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionItem(JSC::ExecSta
 JSC::JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLSelectElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLSelectElementSelectedIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLSelectElementSelectedIndex(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLSelectElementSelectedIndex(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLSelectElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLSelectElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLSelectElementLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLSelectElementLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLSelectElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLSelectElementValidity(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLSelectElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLSelectElementOptions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLSelectElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementForm(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLSelectElementValidity(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLSelectElementWillValidate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLSelectElementValidationMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLSelectElementOptions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLSelectElementDisabled(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLSelectElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLSelectElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementAutofocus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLSelectElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLSelectElementMultiple(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementMultiple(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLSelectElementMultiple(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLSelectElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLSelectElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLSelectElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementSize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLSelectElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLSelectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
index 377c409539..dba22d61d9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
@@ -39,10 +39,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLSourceElement);
 
 static const HashTableValue JSHTMLSourceElementTableValues[5] =
 {
-    { "src", DontDelete, (intptr_t)jsHTMLSourceElementSrc, (intptr_t)setJSHTMLSourceElementSrc },
-    { "type", DontDelete, (intptr_t)jsHTMLSourceElementType, (intptr_t)setJSHTMLSourceElementType },
-    { "media", DontDelete, (intptr_t)jsHTMLSourceElementMedia, (intptr_t)setJSHTMLSourceElementMedia },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLSourceElementConstructor, (intptr_t)0 },
+    { "src", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSourceElementSrc), (intptr_t)setJSHTMLSourceElementSrc },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSourceElementType), (intptr_t)setJSHTMLSourceElementType },
+    { "media", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSourceElementMedia), (intptr_t)setJSHTMLSourceElementMedia },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLSourceElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -143,33 +143,36 @@ bool JSHTMLSourceElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSHTMLSourceElement, Base>(exec, &JSHTMLSourceElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLSourceElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSourceElementSrc(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSourceElement* castedThis = static_cast<JSHTMLSourceElement*>(asObject(slot.slotBase()));
+    JSHTMLSourceElement* castedThis = static_cast<JSHTMLSourceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(castedThis->impl());
-    return jsString(exec, imp->src());
+    JSValue result = jsString(exec, imp->src());
+    return result;
 }
 
-JSValue jsHTMLSourceElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSourceElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSourceElement* castedThis = static_cast<JSHTMLSourceElement*>(asObject(slot.slotBase()));
+    JSHTMLSourceElement* castedThis = static_cast<JSHTMLSourceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsHTMLSourceElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSourceElementMedia(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSourceElement* castedThis = static_cast<JSHTMLSourceElement*>(asObject(slot.slotBase()));
+    JSHTMLSourceElement* castedThis = static_cast<JSHTMLSourceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(castedThis->impl());
-    return jsString(exec, imp->media());
+    JSValue result = jsString(exec, imp->media());
+    return result;
 }
 
-JSValue jsHTMLSourceElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSourceElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLSourceElement* domObject = static_cast<JSHTMLSourceElement*>(asObject(slot.slotBase()));
+    JSHTMLSourceElement* domObject = static_cast<JSHTMLSourceElement*>(asObject(slotBase));
     return JSHTMLSourceElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLSourceElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -179,19 +182,22 @@ void JSHTMLSourceElement::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSHTMLSourceElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(static_cast<JSHTMLSourceElement*>(thisObject)->impl());
+    JSHTMLSourceElement* castedThisObj = static_cast<JSHTMLSourceElement*>(thisObject);
+    HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(castedThisObj->impl());
     imp->setSrc(value.toString(exec));
 }
 
 void setJSHTMLSourceElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(static_cast<JSHTMLSourceElement*>(thisObject)->impl());
+    JSHTMLSourceElement* castedThisObj = static_cast<JSHTMLSourceElement*>(thisObject);
+    HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(castedThisObj->impl());
     imp->setType(value.toString(exec));
 }
 
 void setJSHTMLSourceElementMedia(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(static_cast<JSHTMLSourceElement*>(thisObject)->impl());
+    JSHTMLSourceElement* castedThisObj = static_cast<JSHTMLSourceElement*>(thisObject);
+    HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(castedThisObj->impl());
     imp->setMedia(value.toString(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
index f66761e09c..8c06f859ce 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -59,7 +59,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLSourceElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,13 +68,13 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLSourceElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSourceElementSrc(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLSourceElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLSourceElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSourceElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLSourceElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLSourceElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSourceElementMedia(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLSourceElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLSourceElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSourceElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
index 5137a97d32..7db29ddd1c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
@@ -38,11 +38,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLStyleElement);
 
 static const HashTableValue JSHTMLStyleElementTableValues[6] =
 {
-    { "disabled", DontDelete, (intptr_t)jsHTMLStyleElementDisabled, (intptr_t)setJSHTMLStyleElementDisabled },
-    { "media", DontDelete, (intptr_t)jsHTMLStyleElementMedia, (intptr_t)setJSHTMLStyleElementMedia },
-    { "type", DontDelete, (intptr_t)jsHTMLStyleElementType, (intptr_t)setJSHTMLStyleElementType },
-    { "sheet", DontDelete|ReadOnly, (intptr_t)jsHTMLStyleElementSheet, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLStyleElementConstructor, (intptr_t)0 },
+    { "disabled", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLStyleElementDisabled), (intptr_t)setJSHTMLStyleElementDisabled },
+    { "media", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLStyleElementMedia), (intptr_t)setJSHTMLStyleElementMedia },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLStyleElementType), (intptr_t)setJSHTMLStyleElementType },
+    { "sheet", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLStyleElementSheet), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLStyleElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -143,41 +143,45 @@ bool JSHTMLStyleElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSHTMLStyleElement, Base>(exec, &JSHTMLStyleElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLStyleElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLStyleElementDisabled(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLStyleElement* castedThis = static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()));
+    JSHTMLStyleElement* castedThis = static_cast<JSHTMLStyleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(castedThis->impl());
-    return jsBoolean(imp->disabled());
+    JSValue result = jsBoolean(imp->disabled());
+    return result;
 }
 
-JSValue jsHTMLStyleElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLStyleElementMedia(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLStyleElement* castedThis = static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()));
+    JSHTMLStyleElement* castedThis = static_cast<JSHTMLStyleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(castedThis->impl());
-    return jsString(exec, imp->media());
+    JSValue result = jsString(exec, imp->media());
+    return result;
 }
 
-JSValue jsHTMLStyleElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLStyleElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLStyleElement* castedThis = static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()));
+    JSHTMLStyleElement* castedThis = static_cast<JSHTMLStyleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsHTMLStyleElementSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLStyleElementSheet(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLStyleElement* castedThis = static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()));
+    JSHTMLStyleElement* castedThis = static_cast<JSHTMLStyleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->sheet()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->sheet()));
+    return result;
 }
 
-JSValue jsHTMLStyleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLStyleElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLStyleElement* domObject = static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()));
+    JSHTMLStyleElement* domObject = static_cast<JSHTMLStyleElement*>(asObject(slotBase));
     return JSHTMLStyleElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLStyleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -187,19 +191,22 @@ void JSHTMLStyleElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSHTMLStyleElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(thisObject)->impl());
+    JSHTMLStyleElement* castedThisObj = static_cast<JSHTMLStyleElement*>(thisObject);
+    HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(castedThisObj->impl());
     imp->setDisabled(value.toBoolean(exec));
 }
 
 void setJSHTMLStyleElementMedia(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(thisObject)->impl());
+    JSHTMLStyleElement* castedThisObj = static_cast<JSHTMLStyleElement*>(thisObject);
+    HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(castedThisObj->impl());
     imp->setMedia(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLStyleElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(thisObject)->impl());
+    JSHTMLStyleElement* castedThisObj = static_cast<JSHTMLStyleElement*>(thisObject);
+    HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(castedThisObj->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
index c05261ce64..7427e2eb4b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLStyleElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,14 +66,14 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLStyleElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLStyleElementDisabled(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLStyleElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLStyleElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLStyleElementMedia(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLStyleElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLStyleElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLStyleElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLStyleElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLStyleElementSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLStyleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLStyleElementSheet(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLStyleElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
index 4b81e96df1..50b7388a59 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
@@ -36,8 +36,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableCaptionElement);
 
 static const HashTableValue JSHTMLTableCaptionElementTableValues[3] =
 {
-    { "align", DontDelete, (intptr_t)jsHTMLTableCaptionElementAlign, (intptr_t)setJSHTMLTableCaptionElementAlign },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLTableCaptionElementConstructor, (intptr_t)0 },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCaptionElementAlign), (intptr_t)setJSHTMLTableCaptionElementAlign },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCaptionElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,7 +76,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -138,17 +138,18 @@ bool JSHTMLTableCaptionElement::getOwnPropertyDescriptor(ExecState* exec, const
     return getStaticValueDescriptor<JSHTMLTableCaptionElement, Base>(exec, &JSHTMLTableCaptionElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLTableCaptionElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCaptionElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCaptionElement* castedThis = static_cast<JSHTMLTableCaptionElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCaptionElement* castedThis = static_cast<JSHTMLTableCaptionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCaptionElement* imp = static_cast<HTMLTableCaptionElement*>(castedThis->impl());
-    return jsString(exec, imp->align());
+    JSValue result = jsString(exec, imp->align());
+    return result;
 }
 
-JSValue jsHTMLTableCaptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCaptionElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCaptionElement* domObject = static_cast<JSHTMLTableCaptionElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCaptionElement* domObject = static_cast<JSHTMLTableCaptionElement*>(asObject(slotBase));
     return JSHTMLTableCaptionElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLTableCaptionElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -158,7 +159,8 @@ void JSHTMLTableCaptionElement::put(ExecState* exec, const Identifier& propertyN
 
 void setJSHTMLTableCaptionElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableCaptionElement* imp = static_cast<HTMLTableCaptionElement*>(static_cast<JSHTMLTableCaptionElement*>(thisObject)->impl());
+    JSHTMLTableCaptionElement* castedThisObj = static_cast<JSHTMLTableCaptionElement*>(thisObject);
+    HTMLTableCaptionElement* imp = static_cast<HTMLTableCaptionElement*>(castedThisObj->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
index 4dafac523e..cf8626d485 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -63,7 +63,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLTableCaptionElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,9 +72,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLTableCaptionElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCaptionElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableCaptionElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableCaptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCaptionElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
index 5ff1e49cfc..cfae224eb0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
@@ -37,22 +37,22 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableCellElement);
 
 static const HashTableValue JSHTMLTableCellElementTableValues[17] =
 {
-    { "cellIndex", DontDelete|ReadOnly, (intptr_t)jsHTMLTableCellElementCellIndex, (intptr_t)0 },
-    { "abbr", DontDelete, (intptr_t)jsHTMLTableCellElementAbbr, (intptr_t)setJSHTMLTableCellElementAbbr },
-    { "align", DontDelete, (intptr_t)jsHTMLTableCellElementAlign, (intptr_t)setJSHTMLTableCellElementAlign },
-    { "axis", DontDelete, (intptr_t)jsHTMLTableCellElementAxis, (intptr_t)setJSHTMLTableCellElementAxis },
-    { "bgColor", DontDelete, (intptr_t)jsHTMLTableCellElementBgColor, (intptr_t)setJSHTMLTableCellElementBgColor },
-    { "ch", DontDelete, (intptr_t)jsHTMLTableCellElementCh, (intptr_t)setJSHTMLTableCellElementCh },
-    { "chOff", DontDelete, (intptr_t)jsHTMLTableCellElementChOff, (intptr_t)setJSHTMLTableCellElementChOff },
-    { "colSpan", DontDelete, (intptr_t)jsHTMLTableCellElementColSpan, (intptr_t)setJSHTMLTableCellElementColSpan },
-    { "headers", DontDelete, (intptr_t)jsHTMLTableCellElementHeaders, (intptr_t)setJSHTMLTableCellElementHeaders },
-    { "height", DontDelete, (intptr_t)jsHTMLTableCellElementHeight, (intptr_t)setJSHTMLTableCellElementHeight },
-    { "noWrap", DontDelete, (intptr_t)jsHTMLTableCellElementNoWrap, (intptr_t)setJSHTMLTableCellElementNoWrap },
-    { "rowSpan", DontDelete, (intptr_t)jsHTMLTableCellElementRowSpan, (intptr_t)setJSHTMLTableCellElementRowSpan },
-    { "scope", DontDelete, (intptr_t)jsHTMLTableCellElementScope, (intptr_t)setJSHTMLTableCellElementScope },
-    { "vAlign", DontDelete, (intptr_t)jsHTMLTableCellElementVAlign, (intptr_t)setJSHTMLTableCellElementVAlign },
-    { "width", DontDelete, (intptr_t)jsHTMLTableCellElementWidth, (intptr_t)setJSHTMLTableCellElementWidth },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLTableCellElementConstructor, (intptr_t)0 },
+    { "cellIndex", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementCellIndex), (intptr_t)0 },
+    { "abbr", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementAbbr), (intptr_t)setJSHTMLTableCellElementAbbr },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementAlign), (intptr_t)setJSHTMLTableCellElementAlign },
+    { "axis", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementAxis), (intptr_t)setJSHTMLTableCellElementAxis },
+    { "bgColor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementBgColor), (intptr_t)setJSHTMLTableCellElementBgColor },
+    { "ch", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementCh), (intptr_t)setJSHTMLTableCellElementCh },
+    { "chOff", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementChOff), (intptr_t)setJSHTMLTableCellElementChOff },
+    { "colSpan", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementColSpan), (intptr_t)setJSHTMLTableCellElementColSpan },
+    { "headers", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementHeaders), (intptr_t)setJSHTMLTableCellElementHeaders },
+    { "height", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementHeight), (intptr_t)setJSHTMLTableCellElementHeight },
+    { "noWrap", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementNoWrap), (intptr_t)setJSHTMLTableCellElementNoWrap },
+    { "rowSpan", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementRowSpan), (intptr_t)setJSHTMLTableCellElementRowSpan },
+    { "scope", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementScope), (intptr_t)setJSHTMLTableCellElementScope },
+    { "vAlign", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementVAlign), (intptr_t)setJSHTMLTableCellElementVAlign },
+    { "width", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementWidth), (intptr_t)setJSHTMLTableCellElementWidth },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableCellElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -91,7 +91,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -153,129 +153,144 @@ bool JSHTMLTableCellElement::getOwnPropertyDescriptor(ExecState* exec, const Ide
     return getStaticValueDescriptor<JSHTMLTableCellElement, Base>(exec, &JSHTMLTableCellElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLTableCellElementCellIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementCellIndex(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThis->impl());
-    return jsNumber(exec, imp->cellIndex());
+    JSValue result = jsNumber(exec, imp->cellIndex());
+    return result;
 }
 
-JSValue jsHTMLTableCellElementAbbr(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementAbbr(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThis->impl());
-    return jsString(exec, imp->abbr());
+    JSValue result = jsString(exec, imp->abbr());
+    return result;
 }
 
-JSValue jsHTMLTableCellElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThis->impl());
-    return jsString(exec, imp->align());
+    JSValue result = jsString(exec, imp->align());
+    return result;
 }
 
-JSValue jsHTMLTableCellElementAxis(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementAxis(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThis->impl());
-    return jsString(exec, imp->axis());
+    JSValue result = jsString(exec, imp->axis());
+    return result;
 }
 
-JSValue jsHTMLTableCellElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementBgColor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThis->impl());
-    return jsString(exec, imp->bgColor());
+    JSValue result = jsString(exec, imp->bgColor());
+    return result;
 }
 
-JSValue jsHTMLTableCellElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementCh(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThis->impl());
-    return jsString(exec, imp->ch());
+    JSValue result = jsString(exec, imp->ch());
+    return result;
 }
 
-JSValue jsHTMLTableCellElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementChOff(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThis->impl());
-    return jsString(exec, imp->chOff());
+    JSValue result = jsString(exec, imp->chOff());
+    return result;
 }
 
-JSValue jsHTMLTableCellElementColSpan(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementColSpan(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThis->impl());
-    return jsNumber(exec, imp->colSpan());
+    JSValue result = jsNumber(exec, imp->colSpan());
+    return result;
 }
 
-JSValue jsHTMLTableCellElementHeaders(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementHeaders(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThis->impl());
-    return jsString(exec, imp->headers());
+    JSValue result = jsString(exec, imp->headers());
+    return result;
 }
 
-JSValue jsHTMLTableCellElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThis->impl());
-    return jsString(exec, imp->height());
+    JSValue result = jsString(exec, imp->height());
+    return result;
 }
 
-JSValue jsHTMLTableCellElementNoWrap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementNoWrap(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThis->impl());
-    return jsBoolean(imp->noWrap());
+    JSValue result = jsBoolean(imp->noWrap());
+    return result;
 }
 
-JSValue jsHTMLTableCellElementRowSpan(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementRowSpan(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThis->impl());
-    return jsNumber(exec, imp->rowSpan());
+    JSValue result = jsNumber(exec, imp->rowSpan());
+    return result;
 }
 
-JSValue jsHTMLTableCellElementScope(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementScope(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThis->impl());
-    return jsString(exec, imp->scope());
+    JSValue result = jsString(exec, imp->scope());
+    return result;
 }
 
-JSValue jsHTMLTableCellElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementVAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThis->impl());
-    return jsString(exec, imp->vAlign());
+    JSValue result = jsString(exec, imp->vAlign());
+    return result;
 }
 
-JSValue jsHTMLTableCellElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThis->impl());
-    return jsString(exec, imp->width());
+    JSValue result = jsString(exec, imp->width());
+    return result;
 }
 
-JSValue jsHTMLTableCellElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableCellElement* domObject = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
+    JSHTMLTableCellElement* domObject = static_cast<JSHTMLTableCellElement*>(asObject(slotBase));
     return JSHTMLTableCellElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLTableCellElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -285,85 +300,99 @@ void JSHTMLTableCellElement::put(ExecState* exec, const Identifier& propertyName
 
 void setJSHTMLTableCellElementAbbr(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
+    JSHTMLTableCellElement* castedThisObj = static_cast<JSHTMLTableCellElement*>(thisObject);
+    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThisObj->impl());
     imp->setAbbr(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableCellElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
+    JSHTMLTableCellElement* castedThisObj = static_cast<JSHTMLTableCellElement*>(thisObject);
+    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThisObj->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableCellElementAxis(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
+    JSHTMLTableCellElement* castedThisObj = static_cast<JSHTMLTableCellElement*>(thisObject);
+    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThisObj->impl());
     imp->setAxis(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableCellElementBgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
+    JSHTMLTableCellElement* castedThisObj = static_cast<JSHTMLTableCellElement*>(thisObject);
+    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThisObj->impl());
     imp->setBgColor(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableCellElementCh(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
+    JSHTMLTableCellElement* castedThisObj = static_cast<JSHTMLTableCellElement*>(thisObject);
+    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThisObj->impl());
     imp->setCh(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableCellElementChOff(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
+    JSHTMLTableCellElement* castedThisObj = static_cast<JSHTMLTableCellElement*>(thisObject);
+    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThisObj->impl());
     imp->setChOff(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableCellElementColSpan(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
+    JSHTMLTableCellElement* castedThisObj = static_cast<JSHTMLTableCellElement*>(thisObject);
+    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThisObj->impl());
     imp->setColSpan(value.toInt32(exec));
 }
 
 void setJSHTMLTableCellElementHeaders(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
+    JSHTMLTableCellElement* castedThisObj = static_cast<JSHTMLTableCellElement*>(thisObject);
+    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThisObj->impl());
     imp->setHeaders(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableCellElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
+    JSHTMLTableCellElement* castedThisObj = static_cast<JSHTMLTableCellElement*>(thisObject);
+    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThisObj->impl());
     imp->setHeight(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableCellElementNoWrap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
+    JSHTMLTableCellElement* castedThisObj = static_cast<JSHTMLTableCellElement*>(thisObject);
+    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThisObj->impl());
     imp->setNoWrap(value.toBoolean(exec));
 }
 
 void setJSHTMLTableCellElementRowSpan(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
+    JSHTMLTableCellElement* castedThisObj = static_cast<JSHTMLTableCellElement*>(thisObject);
+    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThisObj->impl());
     imp->setRowSpan(value.toInt32(exec));
 }
 
 void setJSHTMLTableCellElementScope(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
+    JSHTMLTableCellElement* castedThisObj = static_cast<JSHTMLTableCellElement*>(thisObject);
+    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThisObj->impl());
     imp->setScope(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableCellElementVAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
+    JSHTMLTableCellElement* castedThisObj = static_cast<JSHTMLTableCellElement*>(thisObject);
+    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThisObj->impl());
     imp->setVAlign(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableCellElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
+    JSHTMLTableCellElement* castedThisObj = static_cast<JSHTMLTableCellElement*>(thisObject);
+    HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(castedThisObj->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
index baa70fc131..53da80c1ac 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLTableCellElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,36 +66,36 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLTableCellElementCellIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLTableCellElementAbbr(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementCellIndex(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLTableCellElementAbbr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableCellElementAbbr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableCellElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableCellElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableCellElementAxis(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementAxis(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableCellElementAxis(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableCellElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementBgColor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableCellElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableCellElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementCh(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableCellElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableCellElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementChOff(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableCellElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableCellElementColSpan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementColSpan(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableCellElementColSpan(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableCellElementHeaders(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementHeaders(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableCellElementHeaders(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableCellElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableCellElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableCellElementNoWrap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementNoWrap(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableCellElementNoWrap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableCellElementRowSpan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementRowSpan(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableCellElementRowSpan(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableCellElementScope(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementScope(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableCellElementScope(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableCellElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementVAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableCellElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableCellElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableCellElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableCellElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
index 8bfb70a671..4e20ba548d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
@@ -37,13 +37,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableColElement);
 
 static const HashTableValue JSHTMLTableColElementTableValues[8] =
 {
-    { "align", DontDelete, (intptr_t)jsHTMLTableColElementAlign, (intptr_t)setJSHTMLTableColElementAlign },
-    { "ch", DontDelete, (intptr_t)jsHTMLTableColElementCh, (intptr_t)setJSHTMLTableColElementCh },
-    { "chOff", DontDelete, (intptr_t)jsHTMLTableColElementChOff, (intptr_t)setJSHTMLTableColElementChOff },
-    { "span", DontDelete, (intptr_t)jsHTMLTableColElementSpan, (intptr_t)setJSHTMLTableColElementSpan },
-    { "vAlign", DontDelete, (intptr_t)jsHTMLTableColElementVAlign, (intptr_t)setJSHTMLTableColElementVAlign },
-    { "width", DontDelete, (intptr_t)jsHTMLTableColElementWidth, (intptr_t)setJSHTMLTableColElementWidth },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLTableColElementConstructor, (intptr_t)0 },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableColElementAlign), (intptr_t)setJSHTMLTableColElementAlign },
+    { "ch", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableColElementCh), (intptr_t)setJSHTMLTableColElementCh },
+    { "chOff", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableColElementChOff), (intptr_t)setJSHTMLTableColElementChOff },
+    { "span", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableColElementSpan), (intptr_t)setJSHTMLTableColElementSpan },
+    { "vAlign", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableColElementVAlign), (intptr_t)setJSHTMLTableColElementVAlign },
+    { "width", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableColElementWidth), (intptr_t)setJSHTMLTableColElementWidth },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableColElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -82,7 +82,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -144,57 +144,63 @@ bool JSHTMLTableColElement::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSHTMLTableColElement, Base>(exec, &JSHTMLTableColElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLTableColElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableColElement* castedThis = static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()));
+    JSHTMLTableColElement* castedThis = static_cast<JSHTMLTableColElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(castedThis->impl());
-    return jsString(exec, imp->align());
+    JSValue result = jsString(exec, imp->align());
+    return result;
 }
 
-JSValue jsHTMLTableColElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementCh(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableColElement* castedThis = static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()));
+    JSHTMLTableColElement* castedThis = static_cast<JSHTMLTableColElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(castedThis->impl());
-    return jsString(exec, imp->ch());
+    JSValue result = jsString(exec, imp->ch());
+    return result;
 }
 
-JSValue jsHTMLTableColElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementChOff(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableColElement* castedThis = static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()));
+    JSHTMLTableColElement* castedThis = static_cast<JSHTMLTableColElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(castedThis->impl());
-    return jsString(exec, imp->chOff());
+    JSValue result = jsString(exec, imp->chOff());
+    return result;
 }
 
-JSValue jsHTMLTableColElementSpan(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementSpan(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableColElement* castedThis = static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()));
+    JSHTMLTableColElement* castedThis = static_cast<JSHTMLTableColElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(castedThis->impl());
-    return jsNumber(exec, imp->span());
+    JSValue result = jsNumber(exec, imp->span());
+    return result;
 }
 
-JSValue jsHTMLTableColElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementVAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableColElement* castedThis = static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()));
+    JSHTMLTableColElement* castedThis = static_cast<JSHTMLTableColElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(castedThis->impl());
-    return jsString(exec, imp->vAlign());
+    JSValue result = jsString(exec, imp->vAlign());
+    return result;
 }
 
-JSValue jsHTMLTableColElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableColElement* castedThis = static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()));
+    JSHTMLTableColElement* castedThis = static_cast<JSHTMLTableColElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(castedThis->impl());
-    return jsString(exec, imp->width());
+    JSValue result = jsString(exec, imp->width());
+    return result;
 }
 
-JSValue jsHTMLTableColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableColElement* domObject = static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()));
+    JSHTMLTableColElement* domObject = static_cast<JSHTMLTableColElement*>(asObject(slotBase));
     return JSHTMLTableColElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLTableColElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -204,37 +210,43 @@ void JSHTMLTableColElement::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSHTMLTableColElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
+    JSHTMLTableColElement* castedThisObj = static_cast<JSHTMLTableColElement*>(thisObject);
+    HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(castedThisObj->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableColElementCh(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
+    JSHTMLTableColElement* castedThisObj = static_cast<JSHTMLTableColElement*>(thisObject);
+    HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(castedThisObj->impl());
     imp->setCh(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableColElementChOff(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
+    JSHTMLTableColElement* castedThisObj = static_cast<JSHTMLTableColElement*>(thisObject);
+    HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(castedThisObj->impl());
     imp->setChOff(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableColElementSpan(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
+    JSHTMLTableColElement* castedThisObj = static_cast<JSHTMLTableColElement*>(thisObject);
+    HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(castedThisObj->impl());
     imp->setSpan(value.toInt32(exec));
 }
 
 void setJSHTMLTableColElementVAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
+    JSHTMLTableColElement* castedThisObj = static_cast<JSHTMLTableColElement*>(thisObject);
+    HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(castedThisObj->impl());
     imp->setVAlign(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableColElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
+    JSHTMLTableColElement* castedThisObj = static_cast<JSHTMLTableColElement*>(thisObject);
+    HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(castedThisObj->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
index f761d518d0..7fc08223be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLTableColElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,19 +66,19 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLTableColElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableColElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableColElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableColElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableColElementCh(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableColElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableColElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableColElementChOff(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableColElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableColElementSpan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableColElementSpan(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableColElementSpan(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableColElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableColElementVAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableColElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableColElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableColElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableColElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableColElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
index 1cafa0048b..7709c6167f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
@@ -45,21 +45,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableElement);
 
 static const HashTableValue JSHTMLTableElementTableValues[16] =
 {
-    { "caption", DontDelete, (intptr_t)jsHTMLTableElementCaption, (intptr_t)setJSHTMLTableElementCaption },
-    { "tHead", DontDelete, (intptr_t)jsHTMLTableElementTHead, (intptr_t)setJSHTMLTableElementTHead },
-    { "tFoot", DontDelete, (intptr_t)jsHTMLTableElementTFoot, (intptr_t)setJSHTMLTableElementTFoot },
-    { "rows", DontDelete|ReadOnly, (intptr_t)jsHTMLTableElementRows, (intptr_t)0 },
-    { "tBodies", DontDelete|ReadOnly, (intptr_t)jsHTMLTableElementTBodies, (intptr_t)0 },
-    { "align", DontDelete, (intptr_t)jsHTMLTableElementAlign, (intptr_t)setJSHTMLTableElementAlign },
-    { "bgColor", DontDelete, (intptr_t)jsHTMLTableElementBgColor, (intptr_t)setJSHTMLTableElementBgColor },
-    { "border", DontDelete, (intptr_t)jsHTMLTableElementBorder, (intptr_t)setJSHTMLTableElementBorder },
-    { "cellPadding", DontDelete, (intptr_t)jsHTMLTableElementCellPadding, (intptr_t)setJSHTMLTableElementCellPadding },
-    { "cellSpacing", DontDelete, (intptr_t)jsHTMLTableElementCellSpacing, (intptr_t)setJSHTMLTableElementCellSpacing },
-    { "frame", DontDelete, (intptr_t)jsHTMLTableElementFrame, (intptr_t)setJSHTMLTableElementFrame },
-    { "rules", DontDelete, (intptr_t)jsHTMLTableElementRules, (intptr_t)setJSHTMLTableElementRules },
-    { "summary", DontDelete, (intptr_t)jsHTMLTableElementSummary, (intptr_t)setJSHTMLTableElementSummary },
-    { "width", DontDelete, (intptr_t)jsHTMLTableElementWidth, (intptr_t)setJSHTMLTableElementWidth },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLTableElementConstructor, (intptr_t)0 },
+    { "caption", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableElementCaption), (intptr_t)setJSHTMLTableElementCaption },
+    { "tHead", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableElementTHead), (intptr_t)setJSHTMLTableElementTHead },
+    { "tFoot", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableElementTFoot), (intptr_t)setJSHTMLTableElementTFoot },
+    { "rows", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableElementRows), (intptr_t)0 },
+    { "tBodies", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableElementTBodies), (intptr_t)0 },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableElementAlign), (intptr_t)setJSHTMLTableElementAlign },
+    { "bgColor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableElementBgColor), (intptr_t)setJSHTMLTableElementBgColor },
+    { "border", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableElementBorder), (intptr_t)setJSHTMLTableElementBorder },
+    { "cellPadding", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableElementCellPadding), (intptr_t)setJSHTMLTableElementCellPadding },
+    { "cellSpacing", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableElementCellSpacing), (intptr_t)setJSHTMLTableElementCellSpacing },
+    { "frame", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableElementFrame), (intptr_t)setJSHTMLTableElementFrame },
+    { "rules", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableElementRules), (intptr_t)setJSHTMLTableElementRules },
+    { "summary", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableElementSummary), (intptr_t)setJSHTMLTableElementSummary },
+    { "width", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableElementWidth), (intptr_t)setJSHTMLTableElementWidth },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -98,7 +98,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -121,14 +121,14 @@ bool JSHTMLTableElementConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 static const HashTableValue JSHTMLTableElementPrototypeTableValues[9] =
 {
-    { "createTHead", DontDelete|Function, (intptr_t)jsHTMLTableElementPrototypeFunctionCreateTHead, (intptr_t)0 },
-    { "deleteTHead", DontDelete|Function, (intptr_t)jsHTMLTableElementPrototypeFunctionDeleteTHead, (intptr_t)0 },
-    { "createTFoot", DontDelete|Function, (intptr_t)jsHTMLTableElementPrototypeFunctionCreateTFoot, (intptr_t)0 },
-    { "deleteTFoot", DontDelete|Function, (intptr_t)jsHTMLTableElementPrototypeFunctionDeleteTFoot, (intptr_t)0 },
-    { "createCaption", DontDelete|Function, (intptr_t)jsHTMLTableElementPrototypeFunctionCreateCaption, (intptr_t)0 },
-    { "deleteCaption", DontDelete|Function, (intptr_t)jsHTMLTableElementPrototypeFunctionDeleteCaption, (intptr_t)0 },
-    { "insertRow", DontDelete|Function, (intptr_t)jsHTMLTableElementPrototypeFunctionInsertRow, (intptr_t)1 },
-    { "deleteRow", DontDelete|Function, (intptr_t)jsHTMLTableElementPrototypeFunctionDeleteRow, (intptr_t)1 },
+    { "createTHead", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTableElementPrototypeFunctionCreateTHead), (intptr_t)0 },
+    { "deleteTHead", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTableElementPrototypeFunctionDeleteTHead), (intptr_t)0 },
+    { "createTFoot", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTableElementPrototypeFunctionCreateTFoot), (intptr_t)0 },
+    { "deleteTFoot", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTableElementPrototypeFunctionDeleteTFoot), (intptr_t)0 },
+    { "createCaption", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTableElementPrototypeFunctionCreateCaption), (intptr_t)0 },
+    { "deleteCaption", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTableElementPrototypeFunctionDeleteCaption), (intptr_t)0 },
+    { "insertRow", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTableElementPrototypeFunctionInsertRow), (intptr_t)1 },
+    { "deleteRow", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTableElementPrototypeFunctionDeleteRow), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -178,121 +178,135 @@ bool JSHTMLTableElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSHTMLTableElement, Base>(exec, &JSHTMLTableElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLTableElementCaption(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementCaption(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
+    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->caption()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->caption()));
+    return result;
 }
 
-JSValue jsHTMLTableElementTHead(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementTHead(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
+    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->tHead()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->tHead()));
+    return result;
 }
 
-JSValue jsHTMLTableElementTFoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementTFoot(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
+    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->tFoot()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->tFoot()));
+    return result;
 }
 
-JSValue jsHTMLTableElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementRows(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
+    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->rows()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->rows()));
+    return result;
 }
 
-JSValue jsHTMLTableElementTBodies(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementTBodies(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
+    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->tBodies()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->tBodies()));
+    return result;
 }
 
-JSValue jsHTMLTableElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
+    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThis->impl());
-    return jsString(exec, imp->align());
+    JSValue result = jsString(exec, imp->align());
+    return result;
 }
 
-JSValue jsHTMLTableElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementBgColor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
+    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThis->impl());
-    return jsString(exec, imp->bgColor());
+    JSValue result = jsString(exec, imp->bgColor());
+    return result;
 }
 
-JSValue jsHTMLTableElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementBorder(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
+    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThis->impl());
-    return jsString(exec, imp->border());
+    JSValue result = jsString(exec, imp->border());
+    return result;
 }
 
-JSValue jsHTMLTableElementCellPadding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementCellPadding(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
+    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThis->impl());
-    return jsString(exec, imp->cellPadding());
+    JSValue result = jsString(exec, imp->cellPadding());
+    return result;
 }
 
-JSValue jsHTMLTableElementCellSpacing(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementCellSpacing(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
+    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThis->impl());
-    return jsString(exec, imp->cellSpacing());
+    JSValue result = jsString(exec, imp->cellSpacing());
+    return result;
 }
 
-JSValue jsHTMLTableElementFrame(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementFrame(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
+    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThis->impl());
-    return jsString(exec, imp->frame());
+    JSValue result = jsString(exec, imp->frame());
+    return result;
 }
 
-JSValue jsHTMLTableElementRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementRules(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
+    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThis->impl());
-    return jsString(exec, imp->rules());
+    JSValue result = jsString(exec, imp->rules());
+    return result;
 }
 
-JSValue jsHTMLTableElementSummary(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementSummary(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
+    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThis->impl());
-    return jsString(exec, imp->summary());
+    JSValue result = jsString(exec, imp->summary());
+    return result;
 }
 
-JSValue jsHTMLTableElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
+    JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThis->impl());
-    return jsString(exec, imp->width());
+    JSValue result = jsString(exec, imp->width());
+    return result;
 }
 
-JSValue jsHTMLTableElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableElement* domObject = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
+    JSHTMLTableElement* domObject = static_cast<JSHTMLTableElement*>(asObject(slotBase));
     return JSHTMLTableElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLTableElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -302,7 +316,8 @@ void JSHTMLTableElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSHTMLTableElementCaption(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
+    JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(thisObject);
+    HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setCaption(toHTMLTableCaptionElement(value), ec);
     setDOMException(exec, ec);
@@ -310,7 +325,8 @@ void setJSHTMLTableElementCaption(ExecState* exec, JSObject* thisObject, JSValue
 
 void setJSHTMLTableElementTHead(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
+    JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(thisObject);
+    HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setTHead(toHTMLTableSectionElement(value), ec);
     setDOMException(exec, ec);
@@ -318,7 +334,8 @@ void setJSHTMLTableElementTHead(ExecState* exec, JSObject* thisObject, JSValue v
 
 void setJSHTMLTableElementTFoot(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
+    JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(thisObject);
+    HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setTFoot(toHTMLTableSectionElement(value), ec);
     setDOMException(exec, ec);
@@ -326,55 +343,64 @@ void setJSHTMLTableElementTFoot(ExecState* exec, JSObject* thisObject, JSValue v
 
 void setJSHTMLTableElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
+    JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(thisObject);
+    HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableElementBgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
+    JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(thisObject);
+    HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     imp->setBgColor(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableElementBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
+    JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(thisObject);
+    HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     imp->setBorder(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableElementCellPadding(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
+    JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(thisObject);
+    HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     imp->setCellPadding(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableElementCellSpacing(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
+    JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(thisObject);
+    HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     imp->setCellSpacing(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableElementFrame(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
+    JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(thisObject);
+    HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     imp->setFrame(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableElementRules(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
+    JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(thisObject);
+    HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     imp->setRules(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableElementSummary(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
+    JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(thisObject);
+    HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     imp->setSummary(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
+    JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(thisObject);
+    HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
index 9bc9dc7c77..ddf795fd4e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -59,7 +59,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLTableElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,33 +78,33 @@ JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionInsertRow(JSC::Exe
 JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLTableElementCaption(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementCaption(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableElementCaption(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableElementTHead(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementTHead(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableElementTHead(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableElementTFoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementTFoot(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableElementTFoot(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLTableElementTBodies(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLTableElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementRows(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLTableElementTBodies(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLTableElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementBgColor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableElementBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementBorder(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableElementBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableElementCellPadding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementCellPadding(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableElementCellPadding(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableElementCellSpacing(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementCellSpacing(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableElementCellSpacing(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableElementFrame(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementFrame(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableElementFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableElementRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementRules(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableElementRules(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableElementSummary(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementSummary(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableElementSummary(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
index 6dd162288b..b9659eaeb9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
@@ -42,15 +42,15 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableRowElement);
 
 static const HashTableValue JSHTMLTableRowElementTableValues[10] =
 {
-    { "rowIndex", DontDelete|ReadOnly, (intptr_t)jsHTMLTableRowElementRowIndex, (intptr_t)0 },
-    { "sectionRowIndex", DontDelete|ReadOnly, (intptr_t)jsHTMLTableRowElementSectionRowIndex, (intptr_t)0 },
-    { "cells", DontDelete|ReadOnly, (intptr_t)jsHTMLTableRowElementCells, (intptr_t)0 },
-    { "align", DontDelete, (intptr_t)jsHTMLTableRowElementAlign, (intptr_t)setJSHTMLTableRowElementAlign },
-    { "bgColor", DontDelete, (intptr_t)jsHTMLTableRowElementBgColor, (intptr_t)setJSHTMLTableRowElementBgColor },
-    { "ch", DontDelete, (intptr_t)jsHTMLTableRowElementCh, (intptr_t)setJSHTMLTableRowElementCh },
-    { "chOff", DontDelete, (intptr_t)jsHTMLTableRowElementChOff, (intptr_t)setJSHTMLTableRowElementChOff },
-    { "vAlign", DontDelete, (intptr_t)jsHTMLTableRowElementVAlign, (intptr_t)setJSHTMLTableRowElementVAlign },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLTableRowElementConstructor, (intptr_t)0 },
+    { "rowIndex", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableRowElementRowIndex), (intptr_t)0 },
+    { "sectionRowIndex", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableRowElementSectionRowIndex), (intptr_t)0 },
+    { "cells", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableRowElementCells), (intptr_t)0 },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableRowElementAlign), (intptr_t)setJSHTMLTableRowElementAlign },
+    { "bgColor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableRowElementBgColor), (intptr_t)setJSHTMLTableRowElementBgColor },
+    { "ch", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableRowElementCh), (intptr_t)setJSHTMLTableRowElementCh },
+    { "chOff", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableRowElementChOff), (intptr_t)setJSHTMLTableRowElementChOff },
+    { "vAlign", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableRowElementVAlign), (intptr_t)setJSHTMLTableRowElementVAlign },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableRowElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -89,7 +89,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -112,8 +112,8 @@ bool JSHTMLTableRowElementConstructor::getOwnPropertyDescriptor(ExecState* exec,
 
 static const HashTableValue JSHTMLTableRowElementPrototypeTableValues[3] =
 {
-    { "insertCell", DontDelete|Function, (intptr_t)jsHTMLTableRowElementPrototypeFunctionInsertCell, (intptr_t)1 },
-    { "deleteCell", DontDelete|Function, (intptr_t)jsHTMLTableRowElementPrototypeFunctionDeleteCell, (intptr_t)1 },
+    { "insertCell", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTableRowElementPrototypeFunctionInsertCell), (intptr_t)1 },
+    { "deleteCell", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTableRowElementPrototypeFunctionDeleteCell), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -163,73 +163,81 @@ bool JSHTMLTableRowElement::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSHTMLTableRowElement, Base>(exec, &JSHTMLTableRowElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLTableRowElementRowIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementRowIndex(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()));
+    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThis->impl());
-    return jsNumber(exec, imp->rowIndex());
+    JSValue result = jsNumber(exec, imp->rowIndex());
+    return result;
 }
 
-JSValue jsHTMLTableRowElementSectionRowIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementSectionRowIndex(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()));
+    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThis->impl());
-    return jsNumber(exec, imp->sectionRowIndex());
+    JSValue result = jsNumber(exec, imp->sectionRowIndex());
+    return result;
 }
 
-JSValue jsHTMLTableRowElementCells(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementCells(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()));
+    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->cells()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->cells()));
+    return result;
 }
 
-JSValue jsHTMLTableRowElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()));
+    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThis->impl());
-    return jsString(exec, imp->align());
+    JSValue result = jsString(exec, imp->align());
+    return result;
 }
 
-JSValue jsHTMLTableRowElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementBgColor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()));
+    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThis->impl());
-    return jsString(exec, imp->bgColor());
+    JSValue result = jsString(exec, imp->bgColor());
+    return result;
 }
 
-JSValue jsHTMLTableRowElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementCh(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()));
+    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThis->impl());
-    return jsString(exec, imp->ch());
+    JSValue result = jsString(exec, imp->ch());
+    return result;
 }
 
-JSValue jsHTMLTableRowElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementChOff(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()));
+    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThis->impl());
-    return jsString(exec, imp->chOff());
+    JSValue result = jsString(exec, imp->chOff());
+    return result;
 }
 
-JSValue jsHTMLTableRowElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementVAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()));
+    JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThis->impl());
-    return jsString(exec, imp->vAlign());
+    JSValue result = jsString(exec, imp->vAlign());
+    return result;
 }
 
-JSValue jsHTMLTableRowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableRowElement* domObject = static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()));
+    JSHTMLTableRowElement* domObject = static_cast<JSHTMLTableRowElement*>(asObject(slotBase));
     return JSHTMLTableRowElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLTableRowElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -239,31 +247,36 @@ void JSHTMLTableRowElement::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSHTMLTableRowElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(thisObject)->impl());
+    JSHTMLTableRowElement* castedThisObj = static_cast<JSHTMLTableRowElement*>(thisObject);
+    HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThisObj->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableRowElementBgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(thisObject)->impl());
+    JSHTMLTableRowElement* castedThisObj = static_cast<JSHTMLTableRowElement*>(thisObject);
+    HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThisObj->impl());
     imp->setBgColor(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableRowElementCh(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(thisObject)->impl());
+    JSHTMLTableRowElement* castedThisObj = static_cast<JSHTMLTableRowElement*>(thisObject);
+    HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThisObj->impl());
     imp->setCh(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableRowElementChOff(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(thisObject)->impl());
+    JSHTMLTableRowElement* castedThisObj = static_cast<JSHTMLTableRowElement*>(thisObject);
+    HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThisObj->impl());
     imp->setChOff(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableRowElementVAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(thisObject)->impl());
+    JSHTMLTableRowElement* castedThisObj = static_cast<JSHTMLTableRowElement*>(thisObject);
+    HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThisObj->impl());
     imp->setVAlign(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
index a997475bc4..6fc6e41401 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -59,7 +59,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLTableRowElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,20 +72,20 @@ JSC::JSValue JSC_HOST_CALL jsHTMLTableRowElementPrototypeFunctionInsertCell(JSC:
 JSC::JSValue JSC_HOST_CALL jsHTMLTableRowElementPrototypeFunctionDeleteCell(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLTableRowElementRowIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLTableRowElementSectionRowIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLTableRowElementCells(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLTableRowElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableRowElementRowIndex(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLTableRowElementSectionRowIndex(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLTableRowElementCells(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLTableRowElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableRowElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableRowElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableRowElementBgColor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableRowElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableRowElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableRowElementCh(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableRowElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableRowElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableRowElementChOff(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableRowElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableRowElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableRowElementVAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableRowElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableRowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableRowElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
index b00b883d91..04a1c9ade3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
@@ -41,12 +41,12 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableSectionElement);
 
 static const HashTableValue JSHTMLTableSectionElementTableValues[7] =
 {
-    { "align", DontDelete, (intptr_t)jsHTMLTableSectionElementAlign, (intptr_t)setJSHTMLTableSectionElementAlign },
-    { "ch", DontDelete, (intptr_t)jsHTMLTableSectionElementCh, (intptr_t)setJSHTMLTableSectionElementCh },
-    { "chOff", DontDelete, (intptr_t)jsHTMLTableSectionElementChOff, (intptr_t)setJSHTMLTableSectionElementChOff },
-    { "vAlign", DontDelete, (intptr_t)jsHTMLTableSectionElementVAlign, (intptr_t)setJSHTMLTableSectionElementVAlign },
-    { "rows", DontDelete|ReadOnly, (intptr_t)jsHTMLTableSectionElementRows, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLTableSectionElementConstructor, (intptr_t)0 },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableSectionElementAlign), (intptr_t)setJSHTMLTableSectionElementAlign },
+    { "ch", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableSectionElementCh), (intptr_t)setJSHTMLTableSectionElementCh },
+    { "chOff", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableSectionElementChOff), (intptr_t)setJSHTMLTableSectionElementChOff },
+    { "vAlign", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableSectionElementVAlign), (intptr_t)setJSHTMLTableSectionElementVAlign },
+    { "rows", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableSectionElementRows), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTableSectionElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -85,7 +85,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -108,8 +108,8 @@ bool JSHTMLTableSectionElementConstructor::getOwnPropertyDescriptor(ExecState* e
 
 static const HashTableValue JSHTMLTableSectionElementPrototypeTableValues[3] =
 {
-    { "insertRow", DontDelete|Function, (intptr_t)jsHTMLTableSectionElementPrototypeFunctionInsertRow, (intptr_t)1 },
-    { "deleteRow", DontDelete|Function, (intptr_t)jsHTMLTableSectionElementPrototypeFunctionDeleteRow, (intptr_t)1 },
+    { "insertRow", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTableSectionElementPrototypeFunctionInsertRow), (intptr_t)1 },
+    { "deleteRow", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTableSectionElementPrototypeFunctionDeleteRow), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -159,49 +159,54 @@ bool JSHTMLTableSectionElement::getOwnPropertyDescriptor(ExecState* exec, const
     return getStaticValueDescriptor<JSHTMLTableSectionElement, Base>(exec, &JSHTMLTableSectionElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLTableSectionElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableSectionElement* castedThis = static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()));
+    JSHTMLTableSectionElement* castedThis = static_cast<JSHTMLTableSectionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(castedThis->impl());
-    return jsString(exec, imp->align());
+    JSValue result = jsString(exec, imp->align());
+    return result;
 }
 
-JSValue jsHTMLTableSectionElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementCh(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableSectionElement* castedThis = static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()));
+    JSHTMLTableSectionElement* castedThis = static_cast<JSHTMLTableSectionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(castedThis->impl());
-    return jsString(exec, imp->ch());
+    JSValue result = jsString(exec, imp->ch());
+    return result;
 }
 
-JSValue jsHTMLTableSectionElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementChOff(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableSectionElement* castedThis = static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()));
+    JSHTMLTableSectionElement* castedThis = static_cast<JSHTMLTableSectionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(castedThis->impl());
-    return jsString(exec, imp->chOff());
+    JSValue result = jsString(exec, imp->chOff());
+    return result;
 }
 
-JSValue jsHTMLTableSectionElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementVAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableSectionElement* castedThis = static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()));
+    JSHTMLTableSectionElement* castedThis = static_cast<JSHTMLTableSectionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(castedThis->impl());
-    return jsString(exec, imp->vAlign());
+    JSValue result = jsString(exec, imp->vAlign());
+    return result;
 }
 
-JSValue jsHTMLTableSectionElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementRows(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableSectionElement* castedThis = static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()));
+    JSHTMLTableSectionElement* castedThis = static_cast<JSHTMLTableSectionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->rows()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->rows()));
+    return result;
 }
 
-JSValue jsHTMLTableSectionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTableSectionElement* domObject = static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()));
+    JSHTMLTableSectionElement* domObject = static_cast<JSHTMLTableSectionElement*>(asObject(slotBase));
     return JSHTMLTableSectionElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLTableSectionElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -211,25 +216,29 @@ void JSHTMLTableSectionElement::put(ExecState* exec, const Identifier& propertyN
 
 void setJSHTMLTableSectionElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(thisObject)->impl());
+    JSHTMLTableSectionElement* castedThisObj = static_cast<JSHTMLTableSectionElement*>(thisObject);
+    HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(castedThisObj->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableSectionElementCh(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(thisObject)->impl());
+    JSHTMLTableSectionElement* castedThisObj = static_cast<JSHTMLTableSectionElement*>(thisObject);
+    HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(castedThisObj->impl());
     imp->setCh(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableSectionElementChOff(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(thisObject)->impl());
+    JSHTMLTableSectionElement* castedThisObj = static_cast<JSHTMLTableSectionElement*>(thisObject);
+    HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(castedThisObj->impl());
     imp->setChOff(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTableSectionElementVAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(thisObject)->impl());
+    JSHTMLTableSectionElement* castedThisObj = static_cast<JSHTMLTableSectionElement*>(thisObject);
+    HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(castedThisObj->impl());
     imp->setVAlign(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
index 6760be581a..a5a2dd6d6d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -65,7 +65,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLTableSectionElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,16 +78,16 @@ JSC::JSValue JSC_HOST_CALL jsHTMLTableSectionElementPrototypeFunctionInsertRow(J
 JSC::JSValue JSC_HOST_CALL jsHTMLTableSectionElementPrototypeFunctionDeleteRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLTableSectionElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableSectionElementAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableSectionElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableSectionElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableSectionElementCh(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableSectionElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableSectionElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableSectionElementChOff(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableSectionElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableSectionElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableSectionElementVAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTableSectionElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTableSectionElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLTableSectionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableSectionElementRows(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLTableSectionElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
index fdd60b4908..acf2ad7dde 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
@@ -41,36 +41,37 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLTextAreaElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLTextAreaElementTableValues[21] =
-{
-    { "defaultValue", DontDelete, (intptr_t)jsHTMLTextAreaElementDefaultValue, (intptr_t)setJSHTMLTextAreaElementDefaultValue },
-    { "form", DontDelete|ReadOnly, (intptr_t)jsHTMLTextAreaElementForm, (intptr_t)0 },
-    { "validity", DontDelete|ReadOnly, (intptr_t)jsHTMLTextAreaElementValidity, (intptr_t)0 },
-    { "accessKey", DontDelete, (intptr_t)jsHTMLTextAreaElementAccessKey, (intptr_t)setJSHTMLTextAreaElementAccessKey },
-    { "cols", DontDelete, (intptr_t)jsHTMLTextAreaElementCols, (intptr_t)setJSHTMLTextAreaElementCols },
-    { "disabled", DontDelete, (intptr_t)jsHTMLTextAreaElementDisabled, (intptr_t)setJSHTMLTextAreaElementDisabled },
-    { "autofocus", DontDelete, (intptr_t)jsHTMLTextAreaElementAutofocus, (intptr_t)setJSHTMLTextAreaElementAutofocus },
-    { "maxLength", DontDelete, (intptr_t)jsHTMLTextAreaElementMaxLength, (intptr_t)setJSHTMLTextAreaElementMaxLength },
-    { "name", DontDelete, (intptr_t)jsHTMLTextAreaElementName, (intptr_t)setJSHTMLTextAreaElementName },
-    { "placeholder", DontDelete, (intptr_t)jsHTMLTextAreaElementPlaceholder, (intptr_t)setJSHTMLTextAreaElementPlaceholder },
-    { "readOnly", DontDelete, (intptr_t)jsHTMLTextAreaElementReadOnly, (intptr_t)setJSHTMLTextAreaElementReadOnly },
-    { "required", DontDelete, (intptr_t)jsHTMLTextAreaElementRequired, (intptr_t)setJSHTMLTextAreaElementRequired },
-    { "rows", DontDelete, (intptr_t)jsHTMLTextAreaElementRows, (intptr_t)setJSHTMLTextAreaElementRows },
-    { "type", DontDelete|ReadOnly, (intptr_t)jsHTMLTextAreaElementType, (intptr_t)0 },
-    { "value", DontDelete, (intptr_t)jsHTMLTextAreaElementValue, (intptr_t)setJSHTMLTextAreaElementValue },
-    { "textLength", DontDelete|ReadOnly, (intptr_t)jsHTMLTextAreaElementTextLength, (intptr_t)0 },
-    { "willValidate", DontDelete|ReadOnly, (intptr_t)jsHTMLTextAreaElementWillValidate, (intptr_t)0 },
-    { "selectionStart", DontDelete, (intptr_t)jsHTMLTextAreaElementSelectionStart, (intptr_t)setJSHTMLTextAreaElementSelectionStart },
-    { "selectionEnd", DontDelete, (intptr_t)jsHTMLTextAreaElementSelectionEnd, (intptr_t)setJSHTMLTextAreaElementSelectionEnd },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLTextAreaElementConstructor, (intptr_t)0 },
+static const HashTableValue JSHTMLTextAreaElementTableValues[22] =
+{
+    { "defaultValue", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementDefaultValue), (intptr_t)setJSHTMLTextAreaElementDefaultValue },
+    { "form", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementForm), (intptr_t)0 },
+    { "validity", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementValidity), (intptr_t)0 },
+    { "accessKey", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementAccessKey), (intptr_t)setJSHTMLTextAreaElementAccessKey },
+    { "cols", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementCols), (intptr_t)setJSHTMLTextAreaElementCols },
+    { "disabled", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementDisabled), (intptr_t)setJSHTMLTextAreaElementDisabled },
+    { "autofocus", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementAutofocus), (intptr_t)setJSHTMLTextAreaElementAutofocus },
+    { "maxLength", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementMaxLength), (intptr_t)setJSHTMLTextAreaElementMaxLength },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementName), (intptr_t)setJSHTMLTextAreaElementName },
+    { "placeholder", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementPlaceholder), (intptr_t)setJSHTMLTextAreaElementPlaceholder },
+    { "readOnly", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementReadOnly), (intptr_t)setJSHTMLTextAreaElementReadOnly },
+    { "required", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementRequired), (intptr_t)setJSHTMLTextAreaElementRequired },
+    { "rows", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementRows), (intptr_t)setJSHTMLTextAreaElementRows },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementType), (intptr_t)0 },
+    { "value", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementValue), (intptr_t)setJSHTMLTextAreaElementValue },
+    { "textLength", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementTextLength), (intptr_t)0 },
+    { "willValidate", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementWillValidate), (intptr_t)0 },
+    { "validationMessage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementValidationMessage), (intptr_t)0 },
+    { "selectionStart", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementSelectionStart), (intptr_t)setJSHTMLTextAreaElementSelectionStart },
+    { "selectionEnd", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementSelectionEnd), (intptr_t)setJSHTMLTextAreaElementSelectionEnd },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTextAreaElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSHTMLTextAreaElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 255, JSHTMLTextAreaElementTableValues, 0 };
+    { 4095, JSHTMLTextAreaElementTableValues, 0 };
 #else
-    { 67, 63, JSHTMLTextAreaElementTableValues, 0 };
+    { 68, 63, JSHTMLTextAreaElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -101,7 +102,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -124,10 +125,10 @@ bool JSHTMLTextAreaElementConstructor::getOwnPropertyDescriptor(ExecState* exec,
 
 static const HashTableValue JSHTMLTextAreaElementPrototypeTableValues[5] =
 {
-    { "select", DontDelete|Function, (intptr_t)jsHTMLTextAreaElementPrototypeFunctionSelect, (intptr_t)0 },
-    { "checkValidity", DontDelete|Function, (intptr_t)jsHTMLTextAreaElementPrototypeFunctionCheckValidity, (intptr_t)0 },
-    { "setCustomValidity", DontDelete|Function, (intptr_t)jsHTMLTextAreaElementPrototypeFunctionSetCustomValidity, (intptr_t)1 },
-    { "setSelectionRange", DontDelete|Function, (intptr_t)jsHTMLTextAreaElementPrototypeFunctionSetSelectionRange, (intptr_t)2 },
+    { "select", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTextAreaElementPrototypeFunctionSelect), (intptr_t)0 },
+    { "checkValidity", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTextAreaElementPrototypeFunctionCheckValidity), (intptr_t)0 },
+    { "setCustomValidity", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTextAreaElementPrototypeFunctionSetCustomValidity), (intptr_t)1 },
+    { "setSelectionRange", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLTextAreaElementPrototypeFunctionSetSelectionRange), (intptr_t)2 },
     { 0, 0, 0, 0 }
 };
 
@@ -177,161 +178,189 @@ bool JSHTMLTextAreaElement::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSHTMLTextAreaElement, Base>(exec, &JSHTMLTextAreaElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLTextAreaElementDefaultValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementDefaultValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->defaultValue());
+    JSValue result = jsString(exec, imp->defaultValue());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementForm(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementValidity(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementValidity(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->validity()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->validity()));
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementAccessKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->accessKey());
+    JSValue result = jsString(exec, imp->accessKey());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementCols(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementCols(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsNumber(exec, imp->cols());
+    JSValue result = jsNumber(exec, imp->cols());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementDisabled(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsBoolean(imp->disabled());
+    JSValue result = jsBoolean(imp->disabled());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementAutofocus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsBoolean(imp->autofocus());
+    JSValue result = jsBoolean(imp->autofocus());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementMaxLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementMaxLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsNumber(exec, imp->maxLength());
+    JSValue result = jsNumber(exec, imp->maxLength());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementPlaceholder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementPlaceholder(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::placeholderAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::placeholderAttr));
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementReadOnly(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementReadOnly(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsBoolean(imp->readOnly());
+    JSValue result = jsBoolean(imp->readOnly());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsBoolean(imp->required());
+    JSValue result = jsBoolean(imp->required());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementRows(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsNumber(exec, imp->rows());
+    JSValue result = jsNumber(exec, imp->rows());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsString(exec, imp->value());
+    JSValue result = jsString(exec, imp->value());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementTextLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementTextLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsNumber(exec, imp->textLength());
+    JSValue result = jsNumber(exec, imp->textLength());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementWillValidate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsBoolean(imp->willValidate());
+    JSValue result = jsBoolean(imp->willValidate());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementSelectionStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementValidationMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsNumber(exec, imp->selectionStart());
+    JSValue result = jsString(exec, imp->validationMessage());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementSelectionEnd(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementSelectionStart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
-    return jsNumber(exec, imp->selectionEnd());
+    JSValue result = jsNumber(exec, imp->selectionStart());
+    return result;
 }
 
-JSValue jsHTMLTextAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementSelectionEnd(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTextAreaElement* domObject = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->selectionEnd());
+    return result;
+}
+
+JSValue jsHTMLTextAreaElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLTextAreaElement* domObject = static_cast<JSHTMLTextAreaElement*>(asObject(slotBase));
     return JSHTMLTextAreaElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLTextAreaElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -341,37 +370,43 @@ void JSHTMLTextAreaElement::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSHTMLTextAreaElementDefaultValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(thisObject);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
     imp->setDefaultValue(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTextAreaElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(thisObject);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTextAreaElementCols(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(thisObject);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
     imp->setCols(value.toInt32(exec));
 }
 
 void setJSHTMLTextAreaElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(thisObject);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
     imp->setDisabled(value.toBoolean(exec));
 }
 
 void setJSHTMLTextAreaElementAutofocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(thisObject);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
     imp->setAutofocus(value.toBoolean(exec));
 }
 
 void setJSHTMLTextAreaElementMaxLength(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(thisObject);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setMaxLength(value.toInt32(exec), ec);
     setDOMException(exec, ec);
@@ -379,49 +414,57 @@ void setJSHTMLTextAreaElementMaxLength(ExecState* exec, JSObject* thisObject, JS
 
 void setJSHTMLTextAreaElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(thisObject);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTextAreaElementPlaceholder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(thisObject);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
     imp->setAttribute(HTMLNames::placeholderAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTextAreaElementReadOnly(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(thisObject);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
     imp->setReadOnly(value.toBoolean(exec));
 }
 
 void setJSHTMLTextAreaElementRequired(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(thisObject);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
     imp->setRequired(value.toBoolean(exec));
 }
 
 void setJSHTMLTextAreaElementRows(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(thisObject);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
     imp->setRows(value.toInt32(exec));
 }
 
 void setJSHTMLTextAreaElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(thisObject);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLTextAreaElementSelectionStart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(thisObject);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
     imp->setSelectionStart(value.toInt32(exec));
 }
 
 void setJSHTMLTextAreaElementSelectionEnd(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(thisObject);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
     imp->setSelectionEnd(value.toInt32(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
index 3b36f3a2cc..293c20b131 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -59,7 +59,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLTextAreaElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -74,40 +74,41 @@ JSC::JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSetCustomValidi
 JSC::JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSetSelectionRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLTextAreaElementDefaultValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementDefaultValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTextAreaElementDefaultValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTextAreaElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLTextAreaElementValidity(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLTextAreaElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementForm(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLTextAreaElementValidity(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLTextAreaElementAccessKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTextAreaElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTextAreaElementCols(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementCols(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTextAreaElementCols(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTextAreaElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementDisabled(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTextAreaElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTextAreaElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementAutofocus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTextAreaElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTextAreaElementMaxLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementMaxLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTextAreaElementMaxLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTextAreaElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTextAreaElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTextAreaElementPlaceholder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementPlaceholder(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTextAreaElementPlaceholder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTextAreaElementReadOnly(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementReadOnly(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTextAreaElementReadOnly(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTextAreaElementRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTextAreaElementRequired(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTextAreaElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementRows(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTextAreaElementRows(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTextAreaElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLTextAreaElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLTextAreaElementValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTextAreaElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTextAreaElementTextLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLTextAreaElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLTextAreaElementSelectionStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementTextLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLTextAreaElementWillValidate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLTextAreaElementValidationMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLTextAreaElementSelectionStart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTextAreaElementSelectionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTextAreaElementSelectionEnd(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementSelectionEnd(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTextAreaElementSelectionEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTextAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
index fe642d3e35..043b719529 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
@@ -36,8 +36,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLTitleElement);
 
 static const HashTableValue JSHTMLTitleElementTableValues[3] =
 {
-    { "text", DontDelete, (intptr_t)jsHTMLTitleElementText, (intptr_t)setJSHTMLTitleElementText },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLTitleElementConstructor, (intptr_t)0 },
+    { "text", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTitleElementText), (intptr_t)setJSHTMLTitleElementText },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLTitleElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,7 +76,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -138,17 +138,18 @@ bool JSHTMLTitleElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSHTMLTitleElement, Base>(exec, &JSHTMLTitleElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLTitleElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTitleElementText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTitleElement* castedThis = static_cast<JSHTMLTitleElement*>(asObject(slot.slotBase()));
+    JSHTMLTitleElement* castedThis = static_cast<JSHTMLTitleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLTitleElement* imp = static_cast<HTMLTitleElement*>(castedThis->impl());
-    return jsString(exec, imp->text());
+    JSValue result = jsString(exec, imp->text());
+    return result;
 }
 
-JSValue jsHTMLTitleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTitleElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLTitleElement* domObject = static_cast<JSHTMLTitleElement*>(asObject(slot.slotBase()));
+    JSHTMLTitleElement* domObject = static_cast<JSHTMLTitleElement*>(asObject(slotBase));
     return JSHTMLTitleElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLTitleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -158,7 +159,8 @@ void JSHTMLTitleElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSHTMLTitleElementText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLTitleElement* imp = static_cast<HTMLTitleElement*>(static_cast<JSHTMLTitleElement*>(thisObject)->impl());
+    JSHTMLTitleElement* castedThisObj = static_cast<JSHTMLTitleElement*>(thisObject);
+    HTMLTitleElement* imp = static_cast<HTMLTitleElement*>(castedThisObj->impl());
     imp->setText(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
index 8cc7ecac3d..958f2906c4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLTitleElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,9 +66,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLTitleElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTitleElementText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLTitleElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLTitleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTitleElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
index 58bc2094a7..a369972ad8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
@@ -36,9 +36,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLUListElement);
 
 static const HashTableValue JSHTMLUListElementTableValues[4] =
 {
-    { "compact", DontDelete, (intptr_t)jsHTMLUListElementCompact, (intptr_t)setJSHTMLUListElementCompact },
-    { "type", DontDelete, (intptr_t)jsHTMLUListElementType, (intptr_t)setJSHTMLUListElementType },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLUListElementConstructor, (intptr_t)0 },
+    { "compact", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLUListElementCompact), (intptr_t)setJSHTMLUListElementCompact },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLUListElementType), (intptr_t)setJSHTMLUListElementType },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLUListElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -139,25 +139,27 @@ bool JSHTMLUListElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSHTMLUListElement, Base>(exec, &JSHTMLUListElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLUListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLUListElementCompact(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLUListElement* castedThis = static_cast<JSHTMLUListElement*>(asObject(slot.slotBase()));
+    JSHTMLUListElement* castedThis = static_cast<JSHTMLUListElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLUListElement* imp = static_cast<HTMLUListElement*>(castedThis->impl());
-    return jsBoolean(imp->compact());
+    JSValue result = jsBoolean(imp->compact());
+    return result;
 }
 
-JSValue jsHTMLUListElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLUListElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLUListElement* castedThis = static_cast<JSHTMLUListElement*>(asObject(slot.slotBase()));
+    JSHTMLUListElement* castedThis = static_cast<JSHTMLUListElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLUListElement* imp = static_cast<HTMLUListElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsHTMLUListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLUListElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLUListElement* domObject = static_cast<JSHTMLUListElement*>(asObject(slot.slotBase()));
+    JSHTMLUListElement* domObject = static_cast<JSHTMLUListElement*>(asObject(slotBase));
     return JSHTMLUListElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLUListElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -167,13 +169,15 @@ void JSHTMLUListElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSHTMLUListElementCompact(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLUListElement* imp = static_cast<HTMLUListElement*>(static_cast<JSHTMLUListElement*>(thisObject)->impl());
+    JSHTMLUListElement* castedThisObj = static_cast<JSHTMLUListElement*>(thisObject);
+    HTMLUListElement* imp = static_cast<HTMLUListElement*>(castedThisObj->impl());
     imp->setCompact(value.toBoolean(exec));
 }
 
 void setJSHTMLUListElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLUListElement* imp = static_cast<HTMLUListElement*>(static_cast<JSHTMLUListElement*>(thisObject)->impl());
+    JSHTMLUListElement* castedThisObj = static_cast<JSHTMLUListElement*>(thisObject);
+    HTMLUListElement* imp = static_cast<HTMLUListElement*>(castedThisObj->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
index d65d7cbcb8..2c858a45df 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLUListElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,11 +66,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsHTMLUListElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLUListElementCompact(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLUListElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLUListElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLUListElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLUListElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLUListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLUListElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
index b8f2da34e0..fbd5d3d4da 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
@@ -26,6 +26,7 @@
 
 #include "HTMLVideoElement.h"
 #include "KURL.h"
+#include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
 #include <wtf/GetPtr.h>
@@ -38,14 +39,16 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLVideoElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLVideoElementTableValues[7] =
+static const HashTableValue JSHTMLVideoElementTableValues[9] =
 {
-    { "width", DontDelete, (intptr_t)jsHTMLVideoElementWidth, (intptr_t)setJSHTMLVideoElementWidth },
-    { "height", DontDelete, (intptr_t)jsHTMLVideoElementHeight, (intptr_t)setJSHTMLVideoElementHeight },
-    { "videoWidth", DontDelete|ReadOnly, (intptr_t)jsHTMLVideoElementVideoWidth, (intptr_t)0 },
-    { "videoHeight", DontDelete|ReadOnly, (intptr_t)jsHTMLVideoElementVideoHeight, (intptr_t)0 },
-    { "poster", DontDelete, (intptr_t)jsHTMLVideoElementPoster, (intptr_t)setJSHTMLVideoElementPoster },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLVideoElementConstructor, (intptr_t)0 },
+    { "width", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLVideoElementWidth), (intptr_t)setJSHTMLVideoElementWidth },
+    { "height", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLVideoElementHeight), (intptr_t)setJSHTMLVideoElementHeight },
+    { "videoWidth", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLVideoElementVideoWidth), (intptr_t)0 },
+    { "videoHeight", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLVideoElementVideoHeight), (intptr_t)0 },
+    { "poster", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLVideoElementPoster), (intptr_t)setJSHTMLVideoElementPoster },
+    { "webkitSupportsFullscreen", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLVideoElementWebkitSupportsFullscreen), (intptr_t)0 },
+    { "webkitDisplayingFullscreen", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLVideoElementWebkitDisplayingFullscreen), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLVideoElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -53,7 +56,7 @@ static JSC_CONST_HASHTABLE HashTable JSHTMLVideoElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 31, JSHTMLVideoElementTableValues, 0 };
 #else
-    { 17, 15, JSHTMLVideoElementTableValues, 0 };
+    { 18, 15, JSHTMLVideoElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -84,7 +87,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -105,16 +108,20 @@ bool JSHTMLVideoElementConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 /* Hash table for prototype */
 
-static const HashTableValue JSHTMLVideoElementPrototypeTableValues[1] =
+static const HashTableValue JSHTMLVideoElementPrototypeTableValues[5] =
 {
+    { "webkitEnterFullscreen", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLVideoElementPrototypeFunctionWebkitEnterFullscreen), (intptr_t)0 },
+    { "webkitExitFullscreen", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLVideoElementPrototypeFunctionWebkitExitFullscreen), (intptr_t)0 },
+    { "webkitEnterFullScreen", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLVideoElementPrototypeFunctionWebkitEnterFullScreen), (intptr_t)0 },
+    { "webkitExitFullScreen", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHTMLVideoElementPrototypeFunctionWebkitExitFullScreen), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSHTMLVideoElementPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSHTMLVideoElementPrototypeTableValues, 0 };
+    { 3, JSHTMLVideoElementPrototypeTableValues, 0 };
 #else
-    { 1, 0, JSHTMLVideoElementPrototypeTableValues, 0 };
+    { 8, 7, JSHTMLVideoElementPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSHTMLVideoElementPrototype::s_info = { "HTMLVideoElementPrototype", 0, &JSHTMLVideoElementPrototypeTable, 0 };
@@ -124,6 +131,16 @@ JSObject* JSHTMLVideoElementPrototype::self(ExecState* exec, JSGlobalObject* glo
     return getDOMPrototype<JSHTMLVideoElement>(exec, globalObject);
 }
 
+bool JSHTMLVideoElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSHTMLVideoElementPrototypeTable, this, propertyName, slot);
+}
+
+bool JSHTMLVideoElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLVideoElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLVideoElement::s_info = { "HTMLVideoElement", &JSHTMLMediaElement::s_info, &JSHTMLVideoElementTable, 0 };
 
 JSHTMLVideoElement::JSHTMLVideoElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLVideoElement> impl)
@@ -146,49 +163,72 @@ bool JSHTMLVideoElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSHTMLVideoElement, Base>(exec, &JSHTMLVideoElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsHTMLVideoElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLVideoElement* castedThis = static_cast<JSHTMLVideoElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->width());
+    return result;
+}
+
+JSValue jsHTMLVideoElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSHTMLVideoElement* castedThis = static_cast<JSHTMLVideoElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->height());
+    return result;
+}
+
+JSValue jsHTMLVideoElementVideoWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLVideoElement* castedThis = static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()));
+    JSHTMLVideoElement* castedThis = static_cast<JSHTMLVideoElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(castedThis->impl());
-    return jsNumber(exec, imp->width());
+    JSValue result = jsNumber(exec, imp->videoWidth());
+    return result;
 }
 
-JSValue jsHTMLVideoElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementVideoHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLVideoElement* castedThis = static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()));
+    JSHTMLVideoElement* castedThis = static_cast<JSHTMLVideoElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(castedThis->impl());
-    return jsNumber(exec, imp->height());
+    JSValue result = jsNumber(exec, imp->videoHeight());
+    return result;
 }
 
-JSValue jsHTMLVideoElementVideoWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementPoster(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLVideoElement* castedThis = static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()));
+    JSHTMLVideoElement* castedThis = static_cast<JSHTMLVideoElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(castedThis->impl());
-    return jsNumber(exec, imp->videoWidth());
+    JSValue result = jsString(exec, imp->poster());
+    return result;
 }
 
-JSValue jsHTMLVideoElementVideoHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementWebkitSupportsFullscreen(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLVideoElement* castedThis = static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()));
+    JSHTMLVideoElement* castedThis = static_cast<JSHTMLVideoElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(castedThis->impl());
-    return jsNumber(exec, imp->videoHeight());
+    JSValue result = jsBoolean(imp->webkitSupportsFullscreen());
+    return result;
 }
 
-JSValue jsHTMLVideoElementPoster(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementWebkitDisplayingFullscreen(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLVideoElement* castedThis = static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()));
+    JSHTMLVideoElement* castedThis = static_cast<JSHTMLVideoElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(castedThis->impl());
-    return jsString(exec, imp->poster());
+    JSValue result = jsBoolean(imp->webkitDisplayingFullscreen());
+    return result;
 }
 
-JSValue jsHTMLVideoElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHTMLVideoElement* domObject = static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()));
+    JSHTMLVideoElement* domObject = static_cast<JSHTMLVideoElement*>(asObject(slotBase));
     return JSHTMLVideoElement::getConstructor(exec, domObject->globalObject());
 }
 void JSHTMLVideoElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -198,19 +238,22 @@ void JSHTMLVideoElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSHTMLVideoElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(thisObject)->impl());
+    JSHTMLVideoElement* castedThisObj = static_cast<JSHTMLVideoElement*>(thisObject);
+    HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(castedThisObj->impl());
     imp->setWidth(value.toInt32(exec));
 }
 
 void setJSHTMLVideoElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(thisObject)->impl());
+    JSHTMLVideoElement* castedThisObj = static_cast<JSHTMLVideoElement*>(thisObject);
+    HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(castedThisObj->impl());
     imp->setHeight(value.toInt32(exec));
 }
 
 void setJSHTMLVideoElementPoster(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(thisObject)->impl());
+    JSHTMLVideoElement* castedThisObj = static_cast<JSHTMLVideoElement*>(thisObject);
+    HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(castedThisObj->impl());
     imp->setPoster(valueToStringWithNullCheck(exec, value));
 }
 
@@ -219,6 +262,58 @@ JSValue JSHTMLVideoElement::getConstructor(ExecState* exec, JSGlobalObject* glob
     return getDOMConstructor<JSHTMLVideoElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
+JSValue JSC_HOST_CALL jsHTMLVideoElementPrototypeFunctionWebkitEnterFullscreen(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLVideoElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLVideoElement* castedThisObj = static_cast<JSHTMLVideoElement*>(asObject(thisValue));
+    HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+
+    imp->webkitEnterFullscreen(processingUserGesture(exec), ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsHTMLVideoElementPrototypeFunctionWebkitExitFullscreen(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLVideoElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLVideoElement* castedThisObj = static_cast<JSHTMLVideoElement*>(asObject(thisValue));
+    HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(castedThisObj->impl());
+
+    imp->webkitExitFullscreen();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsHTMLVideoElementPrototypeFunctionWebkitEnterFullScreen(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLVideoElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLVideoElement* castedThisObj = static_cast<JSHTMLVideoElement*>(asObject(thisValue));
+    HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+
+    imp->webkitEnterFullScreen(processingUserGesture(exec), ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsHTMLVideoElementPrototypeFunctionWebkitExitFullScreen(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLVideoElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLVideoElement* castedThisObj = static_cast<JSHTMLVideoElement*>(asObject(thisValue));
+    HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(castedThisObj->impl());
+
+    imp->webkitExitFullScreen();
+    return jsUndefined();
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
index 7a6010967f..e4d01319d4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,26 +57,36 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHTMLVideoElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsHTMLVideoElementPrototypeFunctionWebkitEnterFullscreen(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLVideoElementPrototypeFunctionWebkitExitFullscreen(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLVideoElementPrototypeFunctionWebkitEnterFullScreen(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLVideoElementPrototypeFunctionWebkitExitFullScreen(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHTMLVideoElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLVideoElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLVideoElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLVideoElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLVideoElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLVideoElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLVideoElementVideoWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLVideoElementVideoHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsHTMLVideoElementPoster(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLVideoElementVideoWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLVideoElementVideoHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLVideoElementPoster(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLVideoElementPoster(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLVideoElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLVideoElementWebkitSupportsFullscreen(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLVideoElementWebkitDisplayingFullscreen(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsHTMLVideoElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp b/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
index 02be6baaf4..3bbc14728e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
@@ -37,7 +37,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSHistory);
 
 static const HashTableValue JSHistoryTableValues[2] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsHistoryLength, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHistoryLength), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -50,11 +50,13 @@ static JSC_CONST_HASHTABLE HashTable JSHistoryTable =
 
 /* Hash table for prototype */
 
-static const HashTableValue JSHistoryPrototypeTableValues[4] =
+static const HashTableValue JSHistoryPrototypeTableValues[6] =
 {
-    { "back", DontDelete|Function, (intptr_t)jsHistoryPrototypeFunctionBack, (intptr_t)0 },
-    { "forward", DontDelete|Function, (intptr_t)jsHistoryPrototypeFunctionForward, (intptr_t)0 },
-    { "go", DontDelete|Function, (intptr_t)jsHistoryPrototypeFunctionGo, (intptr_t)1 },
+    { "back", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHistoryPrototypeFunctionBack), (intptr_t)0 },
+    { "forward", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHistoryPrototypeFunctionForward), (intptr_t)0 },
+    { "go", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHistoryPrototypeFunctionGo), (intptr_t)1 },
+    { "pushState", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHistoryPrototypeFunctionPushState), (intptr_t)3 },
+    { "replaceState", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsHistoryPrototypeFunctionReplaceState), (intptr_t)3 },
     { 0, 0, 0, 0 }
 };
 
@@ -62,7 +64,7 @@ static JSC_CONST_HASHTABLE HashTable JSHistoryPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 31, JSHistoryPrototypeTableValues, 0 };
 #else
-    { 9, 7, JSHistoryPrototypeTableValues, 0 };
+    { 17, 15, JSHistoryPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSHistoryPrototype::s_info = { "HistoryPrototype", 0, &JSHistoryPrototypeTable, 0 };
@@ -114,12 +116,13 @@ bool JSHistory::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return getStaticValueDescriptor<JSHistory, Base>(exec, &JSHistoryTable, this, propertyName, descriptor);
 }
 
-JSValue jsHistoryLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHistoryLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSHistory* castedThis = static_cast<JSHistory*>(asObject(slot.slotBase()));
+    JSHistory* castedThis = static_cast<JSHistory*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     History* imp = static_cast<History*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
 void JSHistory::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -166,6 +169,24 @@ JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionGo(ExecState* exec, JSObject*, J
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionPushState(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHistory::s_info))
+        return throwError(exec, TypeError);
+    JSHistory* castedThisObj = static_cast<JSHistory*>(asObject(thisValue));
+    return castedThisObj->pushState(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionReplaceState(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHistory::s_info))
+        return throwError(exec, TypeError);
+    JSHistory* castedThisObj = static_cast<JSHistory*>(asObject(thisValue));
+    return castedThisObj->replaceState(exec, args);
+}
+
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, History* object)
 {
     return getDOMObjectWrapper<JSHistory>(exec, globalObject, object);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHistory.h b/src/3rdparty/webkit/WebCore/generated/JSHistory.h
index a08fc19c34..43e14edd97 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHistory.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHistory.h
@@ -21,7 +21,6 @@
 #ifndef JSHistory_h
 #define JSHistory_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -47,11 +46,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
+
+    // Custom functions
+    JSC::JSValue pushState(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue replaceState(JSC::ExecState*, const JSC::ArgList&);
     History* impl() const { return m_impl.get(); }
 
 private:
@@ -73,7 +76,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSHistoryPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -85,9 +88,11 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionBack(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionForward(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionGo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionPushState(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionReplaceState(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsHistoryLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHistoryLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
index 1de3c43b60..2385ad4db7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
@@ -35,9 +35,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSImageData);
 
 static const HashTableValue JSImageDataTableValues[4] =
 {
-    { "width", DontDelete|ReadOnly, (intptr_t)jsImageDataWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsImageDataHeight, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsImageDataConstructor, (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsImageDataWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsImageDataHeight), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsImageDataConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,7 +76,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -144,25 +144,27 @@ bool JSImageData::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
     return getStaticValueDescriptor<JSImageData, Base>(exec, &JSImageDataTable, this, propertyName, descriptor);
 }
 
-JSValue jsImageDataWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsImageDataWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSImageData* castedThis = static_cast<JSImageData*>(asObject(slot.slotBase()));
+    JSImageData* castedThis = static_cast<JSImageData*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ImageData* imp = static_cast<ImageData*>(castedThis->impl());
-    return jsNumber(exec, imp->width());
+    JSValue result = jsNumber(exec, imp->width());
+    return result;
 }
 
-JSValue jsImageDataHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsImageDataHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSImageData* castedThis = static_cast<JSImageData*>(asObject(slot.slotBase()));
+    JSImageData* castedThis = static_cast<JSImageData*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ImageData* imp = static_cast<ImageData*>(castedThis->impl());
-    return jsNumber(exec, imp->height());
+    JSValue result = jsNumber(exec, imp->height());
+    return result;
 }
 
-JSValue jsImageDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsImageDataConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSImageData* domObject = static_cast<JSImageData*>(asObject(slot.slotBase()));
+    JSImageData* domObject = static_cast<JSImageData*>(asObject(slotBase));
     return JSImageData::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSImageData::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSImageData.h b/src/3rdparty/webkit/WebCore/generated/JSImageData.h
index 0c42e5b972..591eab3dfc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSImageData.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSImageData.h
@@ -21,7 +21,6 @@
 #ifndef JSImageData_h
 #define JSImageData_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -66,7 +65,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSImageDataPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,9 +74,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsImageDataWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsImageDataHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsImageDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsImageDataWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsImageDataHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsImageDataConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInjectedScriptHost.cpp b/src/3rdparty/webkit/WebCore/generated/JSInjectedScriptHost.cpp
new file mode 100644
index 0000000000..9ef01a2e9e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSInjectedScriptHost.cpp
@@ -0,0 +1,360 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "JSInjectedScriptHost.h"
+
+#include "InjectedScriptHost.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSInjectedScriptHost);
+
+/* Hash table */
+
+static const HashTableValue JSInjectedScriptHostTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsInjectedScriptHostConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSInjectedScriptHostTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSInjectedScriptHostTableValues, 0 };
+#else
+    { 2, 1, JSInjectedScriptHostTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSInjectedScriptHostConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSInjectedScriptHostConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSInjectedScriptHostConstructorTableValues, 0 };
+#else
+    { 1, 0, JSInjectedScriptHostConstructorTableValues, 0 };
+#endif
+
+class JSInjectedScriptHostConstructor : public DOMConstructorObject {
+public:
+    JSInjectedScriptHostConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSInjectedScriptHostConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSInjectedScriptHostPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSInjectedScriptHostConstructor::s_info = { "InjectedScriptHostConstructor", 0, &JSInjectedScriptHostConstructorTable, 0 };
+
+bool JSInjectedScriptHostConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSInjectedScriptHostConstructor, DOMObject>(exec, &JSInjectedScriptHostConstructorTable, this, propertyName, slot);
+}
+
+bool JSInjectedScriptHostConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSInjectedScriptHostConstructor, DOMObject>(exec, &JSInjectedScriptHostConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSInjectedScriptHostPrototypeTableValues[16] =
+{
+    { "clearConsoleMessages", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInjectedScriptHostPrototypeFunctionClearConsoleMessages), (intptr_t)0 },
+    { "copyText", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInjectedScriptHostPrototypeFunctionCopyText), (intptr_t)1 },
+    { "nodeForId", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInjectedScriptHostPrototypeFunctionNodeForId), (intptr_t)1 },
+    { "pushNodePathToFrontend", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInjectedScriptHostPrototypeFunctionPushNodePathToFrontend), (intptr_t)3 },
+    { "addNodesToSearchResult", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInjectedScriptHostPrototypeFunctionAddNodesToSearchResult), (intptr_t)1 },
+    { "pushNodeByPathToFrontend", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInjectedScriptHostPrototypeFunctionPushNodeByPathToFrontend), (intptr_t)1 },
+    { "currentCallFrame", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInjectedScriptHostPrototypeFunctionCurrentCallFrame), (intptr_t)0 },
+    { "isActivation", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInjectedScriptHostPrototypeFunctionIsActivation), (intptr_t)1 },
+    { "databaseForId", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInjectedScriptHostPrototypeFunctionDatabaseForId), (intptr_t)1 },
+    { "selectDatabase", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInjectedScriptHostPrototypeFunctionSelectDatabase), (intptr_t)1 },
+    { "selectDOMStorage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInjectedScriptHostPrototypeFunctionSelectDOMStorage), (intptr_t)1 },
+    { "didCreateWorker", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInjectedScriptHostPrototypeFunctionDidCreateWorker), (intptr_t)3 },
+    { "didDestroyWorker", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInjectedScriptHostPrototypeFunctionDidDestroyWorker), (intptr_t)1 },
+    { "nextWorkerId", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInjectedScriptHostPrototypeFunctionNextWorkerId), (intptr_t)0 },
+    { "reportDidDispatchOnInjectedScript", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInjectedScriptHostPrototypeFunctionReportDidDispatchOnInjectedScript), (intptr_t)3 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSInjectedScriptHostPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 127, JSInjectedScriptHostPrototypeTableValues, 0 };
+#else
+    { 34, 31, JSInjectedScriptHostPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSInjectedScriptHostPrototype::s_info = { "InjectedScriptHostPrototype", 0, &JSInjectedScriptHostPrototypeTable, 0 };
+
+JSObject* JSInjectedScriptHostPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSInjectedScriptHost>(exec, globalObject);
+}
+
+bool JSInjectedScriptHostPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSInjectedScriptHostPrototypeTable, this, propertyName, slot);
+}
+
+bool JSInjectedScriptHostPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSInjectedScriptHostPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSInjectedScriptHost::s_info = { "InjectedScriptHost", 0, &JSInjectedScriptHostTable, 0 };
+
+JSInjectedScriptHost::JSInjectedScriptHost(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<InjectedScriptHost> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSInjectedScriptHost::~JSInjectedScriptHost()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSInjectedScriptHost::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSInjectedScriptHostPrototype(JSInjectedScriptHostPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSInjectedScriptHost::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSInjectedScriptHost, Base>(exec, &JSInjectedScriptHostTable, this, propertyName, slot);
+}
+
+bool JSInjectedScriptHost::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSInjectedScriptHost, Base>(exec, &JSInjectedScriptHostTable, this, propertyName, descriptor);
+}
+
+JSValue jsInjectedScriptHostConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSInjectedScriptHost* domObject = static_cast<JSInjectedScriptHost*>(asObject(slotBase));
+    return JSInjectedScriptHost::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSInjectedScriptHost::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSInjectedScriptHostConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionClearConsoleMessages(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInjectedScriptHost::s_info))
+        return throwError(exec, TypeError);
+    JSInjectedScriptHost* castedThisObj = static_cast<JSInjectedScriptHost*>(asObject(thisValue));
+    InjectedScriptHost* imp = static_cast<InjectedScriptHost*>(castedThisObj->impl());
+
+    imp->clearConsoleMessages();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionCopyText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInjectedScriptHost::s_info))
+        return throwError(exec, TypeError);
+    JSInjectedScriptHost* castedThisObj = static_cast<JSInjectedScriptHost*>(asObject(thisValue));
+    InjectedScriptHost* imp = static_cast<InjectedScriptHost*>(castedThisObj->impl());
+    const UString& text = args.at(0).toString(exec);
+
+    imp->copyText(text);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionNodeForId(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInjectedScriptHost::s_info))
+        return throwError(exec, TypeError);
+    JSInjectedScriptHost* castedThisObj = static_cast<JSInjectedScriptHost*>(asObject(thisValue));
+    return castedThisObj->nodeForId(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionPushNodePathToFrontend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInjectedScriptHost::s_info))
+        return throwError(exec, TypeError);
+    JSInjectedScriptHost* castedThisObj = static_cast<JSInjectedScriptHost*>(asObject(thisValue));
+    return castedThisObj->pushNodePathToFrontend(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionAddNodesToSearchResult(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInjectedScriptHost::s_info))
+        return throwError(exec, TypeError);
+    JSInjectedScriptHost* castedThisObj = static_cast<JSInjectedScriptHost*>(asObject(thisValue));
+    InjectedScriptHost* imp = static_cast<InjectedScriptHost*>(castedThisObj->impl());
+    const UString& nodeIds = args.at(0).toString(exec);
+
+    imp->addNodesToSearchResult(nodeIds);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionPushNodeByPathToFrontend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInjectedScriptHost::s_info))
+        return throwError(exec, TypeError);
+    JSInjectedScriptHost* castedThisObj = static_cast<JSInjectedScriptHost*>(asObject(thisValue));
+    InjectedScriptHost* imp = static_cast<InjectedScriptHost*>(castedThisObj->impl());
+    const UString& path = args.at(0).toString(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->pushNodeByPathToFrontend(path));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionCurrentCallFrame(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInjectedScriptHost::s_info))
+        return throwError(exec, TypeError);
+    JSInjectedScriptHost* castedThisObj = static_cast<JSInjectedScriptHost*>(asObject(thisValue));
+    return castedThisObj->currentCallFrame(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionIsActivation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInjectedScriptHost::s_info))
+        return throwError(exec, TypeError);
+    JSInjectedScriptHost* castedThisObj = static_cast<JSInjectedScriptHost*>(asObject(thisValue));
+    return castedThisObj->isActivation(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionDatabaseForId(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInjectedScriptHost::s_info))
+        return throwError(exec, TypeError);
+    JSInjectedScriptHost* castedThisObj = static_cast<JSInjectedScriptHost*>(asObject(thisValue));
+    return castedThisObj->databaseForId(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionSelectDatabase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInjectedScriptHost::s_info))
+        return throwError(exec, TypeError);
+    JSInjectedScriptHost* castedThisObj = static_cast<JSInjectedScriptHost*>(asObject(thisValue));
+    return castedThisObj->selectDatabase(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionSelectDOMStorage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInjectedScriptHost::s_info))
+        return throwError(exec, TypeError);
+    JSInjectedScriptHost* castedThisObj = static_cast<JSInjectedScriptHost*>(asObject(thisValue));
+    return castedThisObj->selectDOMStorage(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionDidCreateWorker(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInjectedScriptHost::s_info))
+        return throwError(exec, TypeError);
+    JSInjectedScriptHost* castedThisObj = static_cast<JSInjectedScriptHost*>(asObject(thisValue));
+    InjectedScriptHost* imp = static_cast<InjectedScriptHost*>(castedThisObj->impl());
+    int id = args.at(0).toInt32(exec);
+    const UString& url = args.at(1).toString(exec);
+    bool isFakeWorker = args.at(2).toBoolean(exec);
+
+    imp->didCreateWorker(id, url, isFakeWorker);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionDidDestroyWorker(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInjectedScriptHost::s_info))
+        return throwError(exec, TypeError);
+    JSInjectedScriptHost* castedThisObj = static_cast<JSInjectedScriptHost*>(asObject(thisValue));
+    InjectedScriptHost* imp = static_cast<InjectedScriptHost*>(castedThisObj->impl());
+    int id = args.at(0).toInt32(exec);
+
+    imp->didDestroyWorker(id);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionNextWorkerId(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInjectedScriptHost::s_info))
+        return throwError(exec, TypeError);
+    JSInjectedScriptHost* castedThisObj = static_cast<JSInjectedScriptHost*>(asObject(thisValue));
+    InjectedScriptHost* imp = static_cast<InjectedScriptHost*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsNumber(exec, imp->nextWorkerId());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionReportDidDispatchOnInjectedScript(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInjectedScriptHost::s_info))
+        return throwError(exec, TypeError);
+    JSInjectedScriptHost* castedThisObj = static_cast<JSInjectedScriptHost*>(asObject(thisValue));
+    return castedThisObj->reportDidDispatchOnInjectedScript(exec, args);
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, InjectedScriptHost* object)
+{
+    return getDOMObjectWrapper<JSInjectedScriptHost>(exec, globalObject, object);
+}
+InjectedScriptHost* toInjectedScriptHost(JSC::JSValue value)
+{
+    return value.inherits(&JSInjectedScriptHost::s_info) ? static_cast<JSInjectedScriptHost*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInjectedScriptHost.h b/src/3rdparty/webkit/WebCore/generated/JSInjectedScriptHost.h
new file mode 100644
index 0000000000..fd7eb22250
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSInjectedScriptHost.h
@@ -0,0 +1,114 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSInjectedScriptHost_h
+#define JSInjectedScriptHost_h
+
+#if ENABLE(INSPECTOR)
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class InjectedScriptHost;
+
+class JSInjectedScriptHost : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSInjectedScriptHost(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<InjectedScriptHost>);
+    virtual ~JSInjectedScriptHost();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+
+    // Custom functions
+    JSC::JSValue nodeForId(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue pushNodePathToFrontend(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue currentCallFrame(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue isActivation(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue databaseForId(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue selectDatabase(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue selectDOMStorage(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue reportDidDispatchOnInjectedScript(JSC::ExecState*, const JSC::ArgList&);
+    InjectedScriptHost* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<InjectedScriptHost> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, InjectedScriptHost*);
+InjectedScriptHost* toInjectedScriptHost(JSC::JSValue);
+
+class JSInjectedScriptHostPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSInjectedScriptHostPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionClearConsoleMessages(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionCopyText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionNodeForId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionPushNodePathToFrontend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionAddNodesToSearchResult(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionPushNodeByPathToFrontend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionCurrentCallFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionIsActivation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionDatabaseForId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionSelectDatabase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionSelectDOMStorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionDidCreateWorker(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionDidDestroyWorker(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionNextWorkerId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionReportDidDispatchOnInjectedScript(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsInjectedScriptHostConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
index bea3845d77..484dac05c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
@@ -19,14 +19,13 @@
 */
 
 #include "config.h"
+
+#if ENABLE(INSPECTOR)
+
 #include "JSInspectorBackend.h"
 
-#include "DOMWindow.h"
 #include "InspectorBackend.h"
-#include "JSNode.h"
-#include "KURL.h"
 #include <runtime/Error.h>
-#include <runtime/JSString.h>
 #include <wtf/GetPtr.h>
 
 using namespace JSC;
@@ -39,7 +38,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSInspectorBackend);
 
 static const HashTableValue JSInspectorBackendTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsInspectorBackendConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsInspectorBackendConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -78,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -99,93 +98,75 @@ bool JSInspectorBackendConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 /* Hash table for prototype */
 
-static const HashTableValue JSInspectorBackendPrototypeTableValues[78] =
-{
-    { "hideDOMNodeHighlight", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHideDOMNodeHighlight, (intptr_t)0 },
-    { "highlightDOMNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHighlightDOMNode, (intptr_t)1 },
-    { "loaded", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionLoaded, (intptr_t)0 },
-    { "windowUnloading", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionWindowUnloading, (intptr_t)0 },
-    { "attach", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAttach, (intptr_t)0 },
-    { "detach", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDetach, (intptr_t)0 },
-    { "closeWindow", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionCloseWindow, (intptr_t)0 },
-    { "clearMessages", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionClearMessages, (intptr_t)1 },
-    { "toggleNodeSearch", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionToggleNodeSearch, (intptr_t)0 },
-    { "isWindowVisible", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionIsWindowVisible, (intptr_t)0 },
-    { "searchingForNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSearchingForNode, (intptr_t)0 },
-    { "addResourceSourceToFrame", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAddResourceSourceToFrame, (intptr_t)2 },
-    { "addSourceToFrame", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAddSourceToFrame, (intptr_t)3 },
-    { "search", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSearch, (intptr_t)2 },
-    { "getDatabaseTableNames", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetDatabaseTableNames, (intptr_t)2 },
-    { "setting", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetting, (intptr_t)1 },
-    { "setSetting", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetSetting, (intptr_t)2 },
-    { "inspectedWindow", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionInspectedWindow, (intptr_t)0 },
-    { "localizedStringsURL", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionLocalizedStringsURL, (intptr_t)0 },
-    { "hiddenPanels", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHiddenPanels, (intptr_t)0 },
-    { "platform", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionPlatform, (intptr_t)0 },
-    { "port", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionPort, (intptr_t)0 },
-    { "startTimelineProfiler", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStartTimelineProfiler, (intptr_t)0 },
-    { "stopTimelineProfiler", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStopTimelineProfiler, (intptr_t)0 },
-    { "timelineProfilerEnabled", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionTimelineProfilerEnabled, (intptr_t)0 },
-    { "moveByUnrestricted", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionMoveByUnrestricted, (intptr_t)2 },
-    { "setAttachedWindowHeight", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetAttachedWindowHeight, (intptr_t)1 },
-    { "wrapCallback", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionWrapCallback, (intptr_t)1 },
-    { "resourceTrackingEnabled", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionResourceTrackingEnabled, (intptr_t)0 },
-    { "enableResourceTracking", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionEnableResourceTracking, (intptr_t)1 },
-    { "disableResourceTracking", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDisableResourceTracking, (intptr_t)1 },
-    { "storeLastActivePanel", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStoreLastActivePanel, (intptr_t)1 },
-    { "debuggerEnabled", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDebuggerEnabled, (intptr_t)0 },
-    { "enableDebugger", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionEnableDebugger, (intptr_t)1 },
-    { "disableDebugger", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDisableDebugger, (intptr_t)1 },
-    { "addBreakpoint", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAddBreakpoint, (intptr_t)3 },
-    { "updateBreakpoint", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionUpdateBreakpoint, (intptr_t)3 },
-    { "removeBreakpoint", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionRemoveBreakpoint, (intptr_t)2 },
-    { "pauseInDebugger", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionPauseInDebugger, (intptr_t)0 },
-    { "resumeDebugger", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionResumeDebugger, (intptr_t)0 },
-    { "stepOverStatementInDebugger", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStepOverStatementInDebugger, (intptr_t)0 },
-    { "stepIntoStatementInDebugger", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStepIntoStatementInDebugger, (intptr_t)0 },
-    { "stepOutOfFunctionInDebugger", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStepOutOfFunctionInDebugger, (intptr_t)0 },
-    { "currentCallFrame", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionCurrentCallFrame, (intptr_t)0 },
-    { "pauseOnExceptions", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionPauseOnExceptions, (intptr_t)0 },
-    { "setPauseOnExceptions", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetPauseOnExceptions, (intptr_t)1 },
-    { "profilerEnabled", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionProfilerEnabled, (intptr_t)0 },
-    { "enableProfiler", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionEnableProfiler, (intptr_t)1 },
-    { "disableProfiler", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDisableProfiler, (intptr_t)1 },
-    { "startProfiling", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStartProfiling, (intptr_t)0 },
-    { "stopProfiling", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStopProfiling, (intptr_t)0 },
-    { "getProfileHeaders", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetProfileHeaders, (intptr_t)1 },
-    { "getProfile", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetProfile, (intptr_t)2 },
-    { "dispatchOnInjectedScript", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript, (intptr_t)4 },
-    { "getChildNodes", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetChildNodes, (intptr_t)2 },
-    { "setAttribute", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetAttribute, (intptr_t)4 },
-    { "removeAttribute", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionRemoveAttribute, (intptr_t)3 },
-    { "setTextNodeValue", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetTextNodeValue, (intptr_t)3 },
-    { "getEventListenersForNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetEventListenersForNode, (intptr_t)2 },
-    { "copyNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionCopyNode, (intptr_t)1 },
-    { "removeNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionRemoveNode, (intptr_t)2 },
-    { "getCookies", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetCookies, (intptr_t)2 },
-    { "deleteCookie", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDeleteCookie, (intptr_t)2 },
-    { "nodeForId", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionNodeForId, (intptr_t)1 },
-    { "wrapObject", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionWrapObject, (intptr_t)2 },
-    { "unwrapObject", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionUnwrapObject, (intptr_t)1 },
-    { "releaseWrapperObjectGroup", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionReleaseWrapperObjectGroup, (intptr_t)1 },
-    { "pushNodePathToFrontend", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionPushNodePathToFrontend, (intptr_t)2 },
-    { "addNodesToSearchResult", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAddNodesToSearchResult, (intptr_t)1 },
-    { "selectDatabase", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSelectDatabase, (intptr_t)1 },
-    { "databaseForId", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDatabaseForId, (intptr_t)1 },
-    { "selectDOMStorage", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSelectDOMStorage, (intptr_t)1 },
-    { "getDOMStorageEntries", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetDOMStorageEntries, (intptr_t)2 },
-    { "setDOMStorageItem", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetDOMStorageItem, (intptr_t)4 },
-    { "removeDOMStorageItem", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionRemoveDOMStorageItem, (intptr_t)3 },
-    { "reportDidDispatchOnInjectedScript", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionReportDidDispatchOnInjectedScript, (intptr_t)3 },
-    { "didEvaluateForTestInFrontend", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDidEvaluateForTestInFrontend, (intptr_t)2 },
+static const HashTableValue JSInspectorBackendPrototypeTableValues[60] =
+{
+    { "storeLastActivePanel", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionStoreLastActivePanel), (intptr_t)1 },
+    { "saveFrontendSettings", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionSaveFrontendSettings), (intptr_t)1 },
+    { "enableSearchingForNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionEnableSearchingForNode), (intptr_t)0 },
+    { "disableSearchingForNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionDisableSearchingForNode), (intptr_t)0 },
+    { "enableResourceTracking", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionEnableResourceTracking), (intptr_t)1 },
+    { "disableResourceTracking", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionDisableResourceTracking), (intptr_t)1 },
+    { "getResourceContent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionGetResourceContent), (intptr_t)2 },
+    { "reloadPage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionReloadPage), (intptr_t)0 },
+    { "startTimelineProfiler", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionStartTimelineProfiler), (intptr_t)0 },
+    { "stopTimelineProfiler", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionStopTimelineProfiler), (intptr_t)0 },
+    { "enableDebugger", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionEnableDebugger), (intptr_t)1 },
+    { "disableDebugger", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionDisableDebugger), (intptr_t)1 },
+    { "setBreakpoint", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionSetBreakpoint), (intptr_t)4 },
+    { "removeBreakpoint", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionRemoveBreakpoint), (intptr_t)2 },
+    { "activateBreakpoints", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionActivateBreakpoints), (intptr_t)0 },
+    { "deactivateBreakpoints", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionDeactivateBreakpoints), (intptr_t)0 },
+    { "pauseInDebugger", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionPauseInDebugger), (intptr_t)0 },
+    { "resumeDebugger", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionResumeDebugger), (intptr_t)0 },
+    { "stepOverStatementInDebugger", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionStepOverStatementInDebugger), (intptr_t)0 },
+    { "stepIntoStatementInDebugger", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionStepIntoStatementInDebugger), (intptr_t)0 },
+    { "stepOutOfFunctionInDebugger", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionStepOutOfFunctionInDebugger), (intptr_t)0 },
+    { "setPauseOnExceptionsState", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionSetPauseOnExceptionsState), (intptr_t)1 },
+    { "enableProfiler", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionEnableProfiler), (intptr_t)1 },
+    { "disableProfiler", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionDisableProfiler), (intptr_t)1 },
+    { "startProfiling", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionStartProfiling), (intptr_t)0 },
+    { "stopProfiling", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionStopProfiling), (intptr_t)0 },
+    { "getProfileHeaders", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionGetProfileHeaders), (intptr_t)1 },
+    { "getProfile", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionGetProfile), (intptr_t)2 },
+    { "setInjectedScriptSource", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionSetInjectedScriptSource), (intptr_t)1 },
+    { "dispatchOnInjectedScript", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript), (intptr_t)5 },
+    { "addScriptToEvaluateOnLoad", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionAddScriptToEvaluateOnLoad), (intptr_t)1 },
+    { "removeAllScriptsToEvaluateOnLoad", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionRemoveAllScriptsToEvaluateOnLoad), (intptr_t)0 },
+    { "getChildNodes", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionGetChildNodes), (intptr_t)2 },
+    { "setAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionSetAttribute), (intptr_t)4 },
+    { "removeAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionRemoveAttribute), (intptr_t)3 },
+    { "setTextNodeValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionSetTextNodeValue), (intptr_t)3 },
+    { "getEventListenersForNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionGetEventListenersForNode), (intptr_t)2 },
+    { "copyNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionCopyNode), (intptr_t)1 },
+    { "removeNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionRemoveNode), (intptr_t)2 },
+    { "highlightDOMNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionHighlightDOMNode), (intptr_t)1 },
+    { "hideDOMNodeHighlight", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionHideDOMNodeHighlight), (intptr_t)0 },
+    { "getStyles", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionGetStyles), (intptr_t)3 },
+    { "getAllStyles", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionGetAllStyles), (intptr_t)1 },
+    { "getInlineStyle", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionGetInlineStyle), (intptr_t)2 },
+    { "getComputedStyle", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionGetComputedStyle), (intptr_t)2 },
+    { "applyStyleText", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionApplyStyleText), (intptr_t)4 },
+    { "setStyleText", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionSetStyleText), (intptr_t)3 },
+    { "setStyleProperty", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionSetStyleProperty), (intptr_t)4 },
+    { "toggleStyleEnabled", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionToggleStyleEnabled), (intptr_t)4 },
+    { "setRuleSelector", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionSetRuleSelector), (intptr_t)4 },
+    { "addRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionAddRule), (intptr_t)3 },
+    { "getCookies", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionGetCookies), (intptr_t)1 },
+    { "deleteCookie", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionDeleteCookie), (intptr_t)2 },
+    { "releaseWrapperObjectGroup", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionReleaseWrapperObjectGroup), (intptr_t)2 },
+    { "didEvaluateForTestInFrontend", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionDidEvaluateForTestInFrontend), (intptr_t)2 },
+    { "getDatabaseTableNames", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionGetDatabaseTableNames), (intptr_t)2 },
+    { "getDOMStorageEntries", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionGetDOMStorageEntries), (intptr_t)2 },
+    { "setDOMStorageItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionSetDOMStorageItem), (intptr_t)4 },
+    { "removeDOMStorageItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorBackendPrototypeFunctionRemoveDOMStorageItem), (intptr_t)3 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSInspectorBackendPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 4095, JSInspectorBackendPrototypeTableValues, 0 };
+    { 16383, JSInspectorBackendPrototypeTableValues, 0 };
 #else
-    { 267, 255, JSInspectorBackendPrototypeTableValues, 0 };
+    { 139, 127, JSInspectorBackendPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSInspectorBackendPrototype::s_info = { "InspectorBackendPrototype", 0, &JSInspectorBackendPrototypeTable, 0 };
@@ -233,9 +214,9 @@ bool JSInspectorBackend::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSInspectorBackend, Base>(exec, &JSInspectorBackendTable, this, propertyName, descriptor);
 }
 
-JSValue jsInspectorBackendConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsInspectorBackendConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSInspectorBackend* domObject = static_cast<JSInspectorBackend*>(asObject(slot.slotBase()));
+    JSInspectorBackend* domObject = static_cast<JSInspectorBackend*>(asObject(slotBase));
     return JSInspectorBackend::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSInspectorBackend::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -243,40 +224,33 @@ JSValue JSInspectorBackend::getConstructor(ExecState* exec, JSGlobalObject* glob
     return getDOMConstructor<JSInspectorBackendConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHideDOMNodeHighlight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStoreLastActivePanel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    const UString& panelName = args.at(0).toString(exec);
 
-    imp->hideDOMNodeHighlight();
+    imp->storeLastActivePanel(panelName);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHighlightDOMNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->highlightDOMNode(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionLoaded(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSaveFrontendSettings(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    const UString& settings = args.at(0).toString(exec);
 
-    imp->loaded();
+    imp->saveFrontendSettings(settings);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWindowUnloading(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableSearchingForNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -284,11 +258,11 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWindowUnloading(ExecSta
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
 
-    imp->windowUnloading();
+    imp->enableSearchingForNode();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAttach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableSearchingForNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -296,48 +270,51 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAttach(ExecState* exec,
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
 
-    imp->attach();
+    imp->disableSearchingForNode();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDetach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableResourceTracking(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
 
-    imp->detach();
+    imp->enableResourceTracking(always);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCloseWindow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableResourceTracking(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
 
-    imp->closeWindow();
+    imp->disableResourceTracking(always);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionClearMessages(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetResourceContent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    bool clearUI = args.at(0).toBoolean(exec);
+    int callId = args.at(0).toInt32(exec);
+    unsigned identifier = args.at(1).toInt32(exec);
 
-    imp->clearMessages(clearUI);
+    imp->getResourceContent(callId, identifier);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionToggleNodeSearch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionReloadPage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -345,24 +322,11 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionToggleNodeSearch(ExecSt
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
 
-    imp->toggleNodeSearch();
+    imp->reloadPage();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionIsWindowVisible(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = jsBoolean(imp->isWindowVisible());
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSearchingForNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartTimelineProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -370,118 +334,79 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSearchingForNode(ExecSt
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
 
-
-    JSC::JSValue result = jsBoolean(imp->searchingForNode());
-    return result;
+    imp->startTimelineProfiler();
+    return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddResourceSourceToFrame(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopTimelineProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    int identifier = args.at(0).toInt32(exec);
-    Node* frame = toNode(args.at(1));
 
-    imp->addResourceSourceToFrame(identifier, frame);
+    imp->stopTimelineProfiler();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddSourceToFrame(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    const UString& mimeType = args.at(0).toString(exec);
-    const UString& sourceValue = args.at(1).toString(exec);
-    Node* frame = toNode(args.at(2));
-
-
-    JSC::JSValue result = jsBoolean(imp->addSourceToFrame(mimeType, sourceValue, frame));
-    return result;
-}
+    bool always = args.at(0).toBoolean(exec);
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSearch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->search(exec, args);
+    imp->enableDebugger(always);
+    return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetDatabaseTableNames(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    int callId = args.at(0).toInt32(exec);
-    int databaseId = args.at(1).toInt32(exec);
+    bool always = args.at(0).toBoolean(exec);
 
-    imp->getDatabaseTableNames(callId, databaseId);
+    imp->disableDebugger(always);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetting(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->setting(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetSetting(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->setSetting(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionInspectedWindow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->inspectedWindow(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionLocalizedStringsURL(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetBreakpoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    const UString& sourceID = args.at(0).toString(exec);
+    unsigned lineNumber = args.at(1).toInt32(exec);
+    bool enabled = args.at(2).toBoolean(exec);
+    const UString& condition = args.at(3).toString(exec);
 
-
-    JSC::JSValue result = jsString(exec, imp->localizedStringsURL());
-    return result;
+    imp->setBreakpoint(sourceID, lineNumber, enabled, condition);
+    return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHiddenPanels(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveBreakpoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    const UString& sourceID = args.at(0).toString(exec);
+    unsigned lineNumber = args.at(1).toInt32(exec);
 
-
-    JSC::JSValue result = jsString(exec, imp->hiddenPanels());
-    return result;
+    imp->removeBreakpoint(sourceID, lineNumber);
+    return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPlatform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionActivateBreakpoints(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -489,12 +414,11 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPlatform(ExecState* exe
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
 
-
-    JSC::JSValue result = jsString(exec, imp->platform());
-    return result;
+    imp->activateBreakpoints();
+    return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPort(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDeactivateBreakpoints(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -502,12 +426,11 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPort(ExecState* exec, J
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
 
-
-    JSC::JSValue result = jsString(exec, imp->port());
-    return result;
+    imp->deactivateBreakpoints();
+    return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartTimelineProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPauseInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -515,11 +438,11 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartTimelineProfiler(E
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
 
-    imp->startTimelineProfiler();
+    imp->pauseInDebugger();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopTimelineProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionResumeDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -527,11 +450,11 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopTimelineProfiler(Ex
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
 
-    imp->stopTimelineProfiler();
+    imp->resumeDebugger();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionTimelineProfilerEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStepOverStatementInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -539,61 +462,48 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionTimelineProfilerEnabled
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
 
-
-    JSC::JSValue result = jsBoolean(imp->timelineProfilerEnabled());
-    return result;
+    imp->stepOverStatementInDebugger();
+    return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionMoveByUnrestricted(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStepIntoStatementInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    float x = args.at(0).toFloat(exec);
-    float y = args.at(1).toFloat(exec);
 
-    imp->moveWindowBy(x, y);
+    imp->stepIntoStatementInDebugger();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttachedWindowHeight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStepOutOfFunctionInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    unsigned height = args.at(0).toInt32(exec);
 
-    imp->setAttachedWindowHeight(height);
+    imp->stepOutOfFunctionInDebugger();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWrapCallback(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->wrapCallback(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionResourceTrackingEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetPauseOnExceptionsState(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int pauseOnExceptionsState = args.at(0).toInt32(exec);
 
-
-    JSC::JSValue result = jsBoolean(imp->resourceTrackingEnabled());
-    return result;
+    imp->setPauseOnExceptionsState(pauseOnExceptionsState);
+    return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableResourceTracking(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -602,11 +512,11 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableResourceTracking(
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     bool always = args.at(0).toBoolean(exec);
 
-    imp->enableResourceTracking(always);
+    imp->enableProfiler(always);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableResourceTracking(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -615,119 +525,105 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableResourceTracking
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     bool always = args.at(0).toBoolean(exec);
 
-    imp->disableResourceTracking(always);
+    imp->disableProfiler(always);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStoreLastActivePanel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartProfiling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    const UString& panelName = args.at(0).toString(exec);
 
-    imp->storeLastActivePanel(panelName);
+    imp->startProfiling();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDebuggerEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = jsBoolean(imp->debuggerEnabled());
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopProfiling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    bool always = args.at(0).toBoolean(exec);
 
-    imp->enableDebugger(always);
+    imp->stopProfiling();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfileHeaders(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    bool always = args.at(0).toBoolean(exec);
+    int callId = args.at(0).toInt32(exec);
 
-    imp->disableDebugger(always);
+    imp->getProfileHeaders(callId);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddBreakpoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfile(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    const UString& sourceID = args.at(0).toString(exec);
-    unsigned lineNumber = args.at(1).toInt32(exec);
-    const UString& condition = args.at(2).toString(exec);
+    int callId = args.at(0).toInt32(exec);
+    unsigned uid = args.at(1).toInt32(exec);
 
-    imp->addBreakpoint(sourceID, lineNumber, condition);
+    imp->getProfile(callId, uid);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionUpdateBreakpoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetInjectedScriptSource(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    const UString& sourceID = args.at(0).toString(exec);
-    unsigned lineNumber = args.at(1).toInt32(exec);
-    const UString& condition = args.at(2).toString(exec);
+    const UString& scriptSource = args.at(0).toString(exec);
 
-    imp->updateBreakpoint(sourceID, lineNumber, condition);
+    imp->setInjectedScriptSource(scriptSource);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveBreakpoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    const UString& sourceID = args.at(0).toString(exec);
-    unsigned lineNumber = args.at(1).toInt32(exec);
+    int callId = args.at(0).toInt32(exec);
+    int injectedScriptId = args.at(1).toInt32(exec);
+    const UString& methodName = args.at(2).toString(exec);
+    const UString& arguments = args.at(3).toString(exec);
+    bool async = args.at(4).toBoolean(exec);
 
-    imp->removeBreakpoint(sourceID, lineNumber);
+    imp->dispatchOnInjectedScript(callId, injectedScriptId, methodName, arguments, async);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPauseInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddScriptToEvaluateOnLoad(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    const UString& scriptSource = args.at(0).toString(exec);
 
-    imp->pauseInDebugger();
+    imp->addScriptToEvaluateOnLoad(scriptSource);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionResumeDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveAllScriptsToEvaluateOnLoad(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -735,133 +631,125 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionResumeDebugger(ExecStat
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
 
-    imp->resumeDebugger();
+    imp->removeAllScriptsToEvaluateOnLoad();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStepOverStatementInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetChildNodes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int nodeId = args.at(1).toInt32(exec);
 
-    imp->stepOverStatementInDebugger();
+    imp->getChildNodes(callId, nodeId);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStepIntoStatementInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int elementId = args.at(1).toInt32(exec);
+    const UString& name = args.at(2).toString(exec);
+    const UString& value = args.at(3).toString(exec);
 
-    imp->stepIntoStatementInDebugger();
+    imp->setAttribute(callId, elementId, name, value);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStepOutOfFunctionInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int elementId = args.at(1).toInt32(exec);
+    const UString& name = args.at(2).toString(exec);
 
-    imp->stepOutOfFunctionInDebugger();
+    imp->removeAttribute(callId, elementId, name);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCurrentCallFrame(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->currentCallFrame(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPauseOnExceptions(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = jsBoolean(imp->pauseOnExceptions());
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetPauseOnExceptions(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetTextNodeValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    bool pauseOnExceptions = args.at(0).toBoolean(exec);
+    int callId = args.at(0).toInt32(exec);
+    int nodeId = args.at(1).toInt32(exec);
+    const UString& value = args.at(2).toString(exec);
 
-    imp->setPauseOnExceptions(pauseOnExceptions);
+    imp->setTextNodeValue(callId, nodeId, value);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionProfilerEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetEventListenersForNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int nodeId = args.at(1).toInt32(exec);
 
-
-    JSC::JSValue result = jsBoolean(imp->profilerEnabled());
-    return result;
+    imp->getEventListenersForNode(callId, nodeId);
+    return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCopyNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    bool always = args.at(0).toBoolean(exec);
+    int nodeId = args.at(0).toInt32(exec);
 
-    imp->enableProfiler(always);
+    imp->copyNode(nodeId);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    bool always = args.at(0).toBoolean(exec);
+    int callId = args.at(0).toInt32(exec);
+    int nodeId = args.at(1).toInt32(exec);
 
-    imp->disableProfiler(always);
+    imp->removeNode(callId, nodeId);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartProfiling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHighlightDOMNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int nodeId = args.at(0).toInt32(exec);
 
-    imp->startProfiling();
+    imp->highlightDOMNode(nodeId);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopProfiling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHideDOMNodeHighlight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -869,11 +757,11 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopProfiling(ExecState
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
 
-    imp->stopProfiling();
+    imp->hideDOMNodeHighlight();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfileHeaders(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetStyles(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -881,12 +769,14 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfileHeaders(ExecS
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     int callId = args.at(0).toInt32(exec);
+    int nodeId = args.at(1).toInt32(exec);
+    bool authOnly = args.at(2).toBoolean(exec);
 
-    imp->getProfileHeaders(callId);
+    imp->getStyles(callId, nodeId, authOnly);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfile(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetAllStyles(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -894,13 +784,12 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfile(ExecState* e
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     int callId = args.at(0).toInt32(exec);
-    unsigned uid = args.at(1).toInt32(exec);
 
-    imp->getProfile(callId, uid);
+    imp->getAllStyles(callId);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetInlineStyle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -908,15 +797,13 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDispatchOnInjectedScrip
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     int callId = args.at(0).toInt32(exec);
-    const UString& methodName = args.at(1).toString(exec);
-    const UString& arguments = args.at(2).toString(exec);
-    bool async = args.at(3).toBoolean(exec);
+    int nodeId = args.at(1).toInt32(exec);
 
-    imp->dispatchOnInjectedScript(callId, methodName, arguments, async);
+    imp->getInlineStyle(callId, nodeId);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetChildNodes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetComputedStyle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -926,11 +813,11 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetChildNodes(ExecState
     int callId = args.at(0).toInt32(exec);
     int nodeId = args.at(1).toInt32(exec);
 
-    imp->getChildNodes(callId, nodeId);
+    imp->getComputedStyle(callId, nodeId);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionApplyStyleText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -938,15 +825,15 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttribute(ExecState*
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     int callId = args.at(0).toInt32(exec);
-    int elementId = args.at(1).toInt32(exec);
-    const UString& name = args.at(2).toString(exec);
-    const UString& value = args.at(3).toString(exec);
+    int styleId = args.at(1).toInt32(exec);
+    const UString& styleText = args.at(2).toString(exec);
+    const UString& propertyName = args.at(3).toString(exec);
 
-    imp->setAttribute(callId, elementId, name, value);
+    imp->applyStyleText(callId, styleId, styleText, propertyName);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetStyleText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -954,14 +841,14 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveAttribute(ExecSta
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     int callId = args.at(0).toInt32(exec);
-    int elementId = args.at(1).toInt32(exec);
-    const UString& name = args.at(2).toString(exec);
+    int styleId = args.at(1).toInt32(exec);
+    const UString& styleText = args.at(2).toString(exec);
 
-    imp->removeAttribute(callId, elementId, name);
+    imp->setStyleText(callId, styleId, styleText);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetTextNodeValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetStyleProperty(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -969,14 +856,15 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetTextNodeValue(ExecSt
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     int callId = args.at(0).toInt32(exec);
-    int nodeId = args.at(1).toInt32(exec);
-    const UString& value = args.at(2).toString(exec);
+    int styleId = args.at(1).toInt32(exec);
+    const UString& name = args.at(2).toString(exec);
+    const UString& value = args.at(3).toString(exec);
 
-    imp->setTextNodeValue(callId, nodeId, value);
+    imp->setStyleProperty(callId, styleId, name, value);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetEventListenersForNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionToggleStyleEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -984,26 +872,31 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetEventListenersForNod
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     int callId = args.at(0).toInt32(exec);
-    int nodeId = args.at(1).toInt32(exec);
+    int styleId = args.at(1).toInt32(exec);
+    const UString& propertyName = args.at(2).toString(exec);
+    bool disabled = args.at(3).toBoolean(exec);
 
-    imp->getEventListenersForNode(callId, nodeId);
+    imp->toggleStyleEnabled(callId, styleId, propertyName, disabled);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCopyNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetRuleSelector(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    int nodeId = args.at(0).toInt32(exec);
+    int callId = args.at(0).toInt32(exec);
+    int ruleId = args.at(1).toInt32(exec);
+    const UString& selector = args.at(2).toString(exec);
+    int selectedNodeId = args.at(3).toInt32(exec);
 
-    imp->copyNode(nodeId);
+    imp->setRuleSelector(callId, ruleId, selector, selectedNodeId);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -1011,9 +904,10 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveNode(ExecState* e
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     int callId = args.at(0).toInt32(exec);
-    int nodeId = args.at(1).toInt32(exec);
+    const UString& selector = args.at(1).toString(exec);
+    int selectedNodeId = args.at(2).toInt32(exec);
 
-    imp->removeNode(callId, nodeId);
+    imp->addRule(callId, selector, selectedNodeId);
     return jsUndefined();
 }
 
@@ -1025,9 +919,8 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetCookies(ExecState* e
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     int callId = args.at(0).toInt32(exec);
-    const UString& domain = args.at(1).toString(exec);
 
-    imp->getCookies(callId, domain);
+    imp->getCookies(callId);
     return jsUndefined();
 }
 
@@ -1045,33 +938,6 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDeleteCookie(ExecState*
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionNodeForId(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->nodeForId(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWrapObject(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->wrapObject(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionUnwrapObject(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->unwrapObject(exec, args);
-}
-
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionReleaseWrapperObjectGroup(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -1079,59 +945,39 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionReleaseWrapperObjectGro
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    const UString& objectGroup = args.at(0).toString(exec);
+    int injectedScriptId = args.at(0).toInt32(exec);
+    const UString& objectGroup = args.at(1).toString(exec);
 
-    imp->releaseWrapperObjectGroup(objectGroup);
+    imp->releaseWrapperObjectGroup(injectedScriptId, objectGroup);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPushNodePathToFrontend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->pushNodePathToFrontend(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddNodesToSearchResult(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDidEvaluateForTestInFrontend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    const UString& nodeIds = args.at(0).toString(exec);
+    int callId = args.at(0).toInt32(exec);
+    const UString& jsonResult = args.at(1).toString(exec);
 
-    imp->addNodesToSearchResult(nodeIds);
+    imp->didEvaluateForTestInFrontend(callId, jsonResult);
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDatabase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->selectDatabase(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDatabaseForId(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetDatabaseTableNames(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->databaseForId(exec, args);
-}
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int databaseId = args.at(1).toInt32(exec);
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDOMStorage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->selectDOMStorage(exec, args);
+    imp->getDatabaseTableNames(callId, databaseId);
+    return jsUndefined();
 }
 
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetDOMStorageEntries(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -1179,35 +1025,6 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveDOMStorageItem(Ex
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionReportDidDispatchOnInjectedScript(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    int callId = args.at(0).toInt32(exec);
-    const UString& result = args.at(1).toString(exec);
-    bool isException = args.at(2).toBoolean(exec);
-
-    imp->reportDidDispatchOnInjectedScript(callId, result, isException);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDidEvaluateForTestInFrontend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSInspectorBackend::s_info))
-        return throwError(exec, TypeError);
-    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    int callId = args.at(0).toInt32(exec);
-    const UString& jsonResult = args.at(1).toString(exec);
-
-    imp->didEvaluateForTestInFrontend(callId, jsonResult);
-    return jsUndefined();
-}
-
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, InspectorBackend* object)
 {
     return getDOMObjectWrapper<JSInspectorBackend>(exec, globalObject, object);
@@ -1218,3 +1035,5 @@ InspectorBackend* toInspectorBackend(JSC::JSValue value)
 }
 
 }
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
index 7c220dc481..fdc7a05add 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
@@ -21,7 +21,8 @@
 #ifndef JSInspectorBackend_h
 #define JSInspectorBackend_h
 
-#include "DOMObjectWithSVGContext.h"
+#if ENABLE(INSPECTOR)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,26 +44,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
-
-    // Custom functions
-    JSC::JSValue highlightDOMNode(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue search(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue setting(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue setSetting(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue inspectedWindow(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue wrapCallback(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue currentCallFrame(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue nodeForId(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue wrapObject(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue unwrapObject(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue pushNodePathToFrontend(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue selectDatabase(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue databaseForId(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue selectDOMStorage(JSC::ExecState*, const JSC::ArgList&);
     InspectorBackend* impl() const { return m_impl.get(); }
 
 private:
@@ -84,7 +69,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSInspectorBackendPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -93,60 +78,38 @@ protected:
 
 // Functions
 
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHideDOMNodeHighlight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHighlightDOMNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionLoaded(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWindowUnloading(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAttach(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDetach(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCloseWindow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionClearMessages(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionToggleNodeSearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionIsWindowVisible(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSearchingForNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddResourceSourceToFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddSourceToFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetDatabaseTableNames(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetting(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetSetting(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionInspectedWindow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionLocalizedStringsURL(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHiddenPanels(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPlatform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartTimelineProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopTimelineProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionTimelineProfilerEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionMoveByUnrestricted(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttachedWindowHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWrapCallback(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionResourceTrackingEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStoreLastActivePanel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSaveFrontendSettings(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableSearchingForNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableSearchingForNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableResourceTracking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableResourceTracking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStoreLastActivePanel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDebuggerEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetResourceContent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionReloadPage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartTimelineProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopTimelineProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddBreakpoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionUpdateBreakpoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetBreakpoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveBreakpoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionActivateBreakpoints(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDeactivateBreakpoints(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPauseInDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionResumeDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStepOverStatementInDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStepIntoStatementInDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStepOutOfFunctionInDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCurrentCallFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPauseOnExceptions(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetPauseOnExceptions(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionProfilerEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetPauseOnExceptionsState(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartProfiling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopProfiling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfileHeaders(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfile(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetInjectedScriptSource(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddScriptToEvaluateOnLoad(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveAllScriptsToEvaluateOnLoad(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetChildNodes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
@@ -154,26 +117,32 @@ JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetTextNodeValue(J
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetEventListenersForNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCopyNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHighlightDOMNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHideDOMNodeHighlight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetStyles(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetAllStyles(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetInlineStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetComputedStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionApplyStyleText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetStyleText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetStyleProperty(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionToggleStyleEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetRuleSelector(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetCookies(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDeleteCookie(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionNodeForId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWrapObject(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionUnwrapObject(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionReleaseWrapperObjectGroup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPushNodePathToFrontend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddNodesToSearchResult(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDatabase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDatabaseForId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDOMStorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDidEvaluateForTestInFrontend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetDatabaseTableNames(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetDOMStorageEntries(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetDOMStorageItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveDOMStorageItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionReportDidDispatchOnInjectedScript(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDidEvaluateForTestInFrontend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsInspectorBackendConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsInspectorBackendConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
+#endif // ENABLE(INSPECTOR)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorFrontendHost.cpp b/src/3rdparty/webkit/WebCore/generated/JSInspectorFrontendHost.cpp
new file mode 100644
index 0000000000..c4140c52ab
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorFrontendHost.cpp
@@ -0,0 +1,383 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "JSInspectorFrontendHost.h"
+
+#include "InspectorFrontendHost.h"
+#include "KURL.h"
+#include <runtime/Error.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSInspectorFrontendHost);
+
+/* Hash table */
+
+static const HashTableValue JSInspectorFrontendHostTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsInspectorFrontendHostConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSInspectorFrontendHostTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSInspectorFrontendHostTableValues, 0 };
+#else
+    { 2, 1, JSInspectorFrontendHostTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSInspectorFrontendHostConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSInspectorFrontendHostConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSInspectorFrontendHostConstructorTableValues, 0 };
+#else
+    { 1, 0, JSInspectorFrontendHostConstructorTableValues, 0 };
+#endif
+
+class JSInspectorFrontendHostConstructor : public DOMConstructorObject {
+public:
+    JSInspectorFrontendHostConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSInspectorFrontendHostConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSInspectorFrontendHostPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSInspectorFrontendHostConstructor::s_info = { "InspectorFrontendHostConstructor", 0, &JSInspectorFrontendHostConstructorTable, 0 };
+
+bool JSInspectorFrontendHostConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSInspectorFrontendHostConstructor, DOMObject>(exec, &JSInspectorFrontendHostConstructorTable, this, propertyName, slot);
+}
+
+bool JSInspectorFrontendHostConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSInspectorFrontendHostConstructor, DOMObject>(exec, &JSInspectorFrontendHostConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSInspectorFrontendHostPrototypeTableValues[16] =
+{
+    { "loaded", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorFrontendHostPrototypeFunctionLoaded), (intptr_t)0 },
+    { "attach", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorFrontendHostPrototypeFunctionAttach), (intptr_t)0 },
+    { "detach", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorFrontendHostPrototypeFunctionDetach), (intptr_t)0 },
+    { "closeWindow", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorFrontendHostPrototypeFunctionCloseWindow), (intptr_t)0 },
+    { "bringToFront", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorFrontendHostPrototypeFunctionBringToFront), (intptr_t)0 },
+    { "inspectedURLChanged", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorFrontendHostPrototypeFunctionInspectedURLChanged), (intptr_t)1 },
+    { "canAttachWindow", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorFrontendHostPrototypeFunctionCanAttachWindow), (intptr_t)0 },
+    { "setAttachedWindowHeight", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorFrontendHostPrototypeFunctionSetAttachedWindowHeight), (intptr_t)1 },
+    { "moveWindowBy", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorFrontendHostPrototypeFunctionMoveWindowBy), (intptr_t)2 },
+    { "localizedStringsURL", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorFrontendHostPrototypeFunctionLocalizedStringsURL), (intptr_t)0 },
+    { "hiddenPanels", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorFrontendHostPrototypeFunctionHiddenPanels), (intptr_t)0 },
+    { "platform", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorFrontendHostPrototypeFunctionPlatform), (intptr_t)0 },
+    { "port", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorFrontendHostPrototypeFunctionPort), (intptr_t)0 },
+    { "copyText", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorFrontendHostPrototypeFunctionCopyText), (intptr_t)1 },
+    { "showContextMenu", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsInspectorFrontendHostPrototypeFunctionShowContextMenu), (intptr_t)2 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSInspectorFrontendHostPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 255, JSInspectorFrontendHostPrototypeTableValues, 0 };
+#else
+    { 36, 31, JSInspectorFrontendHostPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSInspectorFrontendHostPrototype::s_info = { "InspectorFrontendHostPrototype", 0, &JSInspectorFrontendHostPrototypeTable, 0 };
+
+JSObject* JSInspectorFrontendHostPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSInspectorFrontendHost>(exec, globalObject);
+}
+
+bool JSInspectorFrontendHostPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSInspectorFrontendHostPrototypeTable, this, propertyName, slot);
+}
+
+bool JSInspectorFrontendHostPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSInspectorFrontendHostPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSInspectorFrontendHost::s_info = { "InspectorFrontendHost", 0, &JSInspectorFrontendHostTable, 0 };
+
+JSInspectorFrontendHost::JSInspectorFrontendHost(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<InspectorFrontendHost> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSInspectorFrontendHost::~JSInspectorFrontendHost()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSInspectorFrontendHost::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSInspectorFrontendHostPrototype(JSInspectorFrontendHostPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSInspectorFrontendHost::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSInspectorFrontendHost, Base>(exec, &JSInspectorFrontendHostTable, this, propertyName, slot);
+}
+
+bool JSInspectorFrontendHost::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSInspectorFrontendHost, Base>(exec, &JSInspectorFrontendHostTable, this, propertyName, descriptor);
+}
+
+JSValue jsInspectorFrontendHostConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSInspectorFrontendHost* domObject = static_cast<JSInspectorFrontendHost*>(asObject(slotBase));
+    return JSInspectorFrontendHost::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSInspectorFrontendHost::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSInspectorFrontendHostConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionLoaded(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorFrontendHost::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorFrontendHost* castedThisObj = static_cast<JSInspectorFrontendHost*>(asObject(thisValue));
+    InspectorFrontendHost* imp = static_cast<InspectorFrontendHost*>(castedThisObj->impl());
+
+    imp->loaded();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionAttach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorFrontendHost::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorFrontendHost* castedThisObj = static_cast<JSInspectorFrontendHost*>(asObject(thisValue));
+    InspectorFrontendHost* imp = static_cast<InspectorFrontendHost*>(castedThisObj->impl());
+
+    imp->attach();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionDetach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorFrontendHost::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorFrontendHost* castedThisObj = static_cast<JSInspectorFrontendHost*>(asObject(thisValue));
+    InspectorFrontendHost* imp = static_cast<InspectorFrontendHost*>(castedThisObj->impl());
+
+    imp->detach();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionCloseWindow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorFrontendHost::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorFrontendHost* castedThisObj = static_cast<JSInspectorFrontendHost*>(asObject(thisValue));
+    InspectorFrontendHost* imp = static_cast<InspectorFrontendHost*>(castedThisObj->impl());
+
+    imp->closeWindow();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionBringToFront(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorFrontendHost::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorFrontendHost* castedThisObj = static_cast<JSInspectorFrontendHost*>(asObject(thisValue));
+    InspectorFrontendHost* imp = static_cast<InspectorFrontendHost*>(castedThisObj->impl());
+
+    imp->bringToFront();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionInspectedURLChanged(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorFrontendHost::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorFrontendHost* castedThisObj = static_cast<JSInspectorFrontendHost*>(asObject(thisValue));
+    InspectorFrontendHost* imp = static_cast<InspectorFrontendHost*>(castedThisObj->impl());
+    const UString& newURL = args.at(0).toString(exec);
+
+    imp->inspectedURLChanged(newURL);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionCanAttachWindow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorFrontendHost::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorFrontendHost* castedThisObj = static_cast<JSInspectorFrontendHost*>(asObject(thisValue));
+    InspectorFrontendHost* imp = static_cast<InspectorFrontendHost*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->canAttachWindow());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionSetAttachedWindowHeight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorFrontendHost::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorFrontendHost* castedThisObj = static_cast<JSInspectorFrontendHost*>(asObject(thisValue));
+    InspectorFrontendHost* imp = static_cast<InspectorFrontendHost*>(castedThisObj->impl());
+    unsigned height = args.at(0).toInt32(exec);
+
+    imp->setAttachedWindowHeight(height);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionMoveWindowBy(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorFrontendHost::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorFrontendHost* castedThisObj = static_cast<JSInspectorFrontendHost*>(asObject(thisValue));
+    InspectorFrontendHost* imp = static_cast<InspectorFrontendHost*>(castedThisObj->impl());
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+
+    imp->moveWindowBy(x, y);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionLocalizedStringsURL(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorFrontendHost::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorFrontendHost* castedThisObj = static_cast<JSInspectorFrontendHost*>(asObject(thisValue));
+    InspectorFrontendHost* imp = static_cast<InspectorFrontendHost*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsString(exec, imp->localizedStringsURL());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionHiddenPanels(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorFrontendHost::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorFrontendHost* castedThisObj = static_cast<JSInspectorFrontendHost*>(asObject(thisValue));
+    InspectorFrontendHost* imp = static_cast<InspectorFrontendHost*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsString(exec, imp->hiddenPanels());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionPlatform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorFrontendHost::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorFrontendHost* castedThisObj = static_cast<JSInspectorFrontendHost*>(asObject(thisValue));
+    InspectorFrontendHost* imp = static_cast<InspectorFrontendHost*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsString(exec, imp->platform());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionPort(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorFrontendHost::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorFrontendHost* castedThisObj = static_cast<JSInspectorFrontendHost*>(asObject(thisValue));
+    InspectorFrontendHost* imp = static_cast<InspectorFrontendHost*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsString(exec, imp->port());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionCopyText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorFrontendHost::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorFrontendHost* castedThisObj = static_cast<JSInspectorFrontendHost*>(asObject(thisValue));
+    InspectorFrontendHost* imp = static_cast<InspectorFrontendHost*>(castedThisObj->impl());
+    const UString& text = args.at(0).toString(exec);
+
+    imp->copyText(text);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionShowContextMenu(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorFrontendHost::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorFrontendHost* castedThisObj = static_cast<JSInspectorFrontendHost*>(asObject(thisValue));
+    return castedThisObj->showContextMenu(exec, args);
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, InspectorFrontendHost* object)
+{
+    return getDOMObjectWrapper<JSInspectorFrontendHost>(exec, globalObject, object);
+}
+InspectorFrontendHost* toInspectorFrontendHost(JSC::JSValue value)
+{
+    return value.inherits(&JSInspectorFrontendHost::s_info) ? static_cast<JSInspectorFrontendHost*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorFrontendHost.h b/src/3rdparty/webkit/WebCore/generated/JSInspectorFrontendHost.h
new file mode 100644
index 0000000000..2e113d7fbf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorFrontendHost.h
@@ -0,0 +1,107 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSInspectorFrontendHost_h
+#define JSInspectorFrontendHost_h
+
+#if ENABLE(INSPECTOR)
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class InspectorFrontendHost;
+
+class JSInspectorFrontendHost : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSInspectorFrontendHost(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<InspectorFrontendHost>);
+    virtual ~JSInspectorFrontendHost();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+
+    // Custom functions
+    JSC::JSValue showContextMenu(JSC::ExecState*, const JSC::ArgList&);
+    InspectorFrontendHost* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<InspectorFrontendHost> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, InspectorFrontendHost*);
+InspectorFrontendHost* toInspectorFrontendHost(JSC::JSValue);
+
+class JSInspectorFrontendHostPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSInspectorFrontendHostPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionLoaded(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionAttach(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionDetach(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionCloseWindow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionBringToFront(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionInspectedURLChanged(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionCanAttachWindow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionSetAttachedWindowHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionMoveWindowBy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionLocalizedStringsURL(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionHiddenPanels(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionPlatform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionPort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionCopyText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorFrontendHostPrototypeFunctionShowContextMenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsInspectorFrontendHostConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
index 2acd1afcfb..1017258d7d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
@@ -42,13 +42,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSJavaScriptCallFrame);
 
 static const HashTableValue JSJavaScriptCallFrameTableValues[8] =
 {
-    { "caller", DontDelete|ReadOnly, (intptr_t)jsJavaScriptCallFrameCaller, (intptr_t)0 },
-    { "sourceID", DontDelete|ReadOnly, (intptr_t)jsJavaScriptCallFrameSourceID, (intptr_t)0 },
-    { "line", DontDelete|ReadOnly, (intptr_t)jsJavaScriptCallFrameLine, (intptr_t)0 },
-    { "scopeChain", DontDelete|ReadOnly, (intptr_t)jsJavaScriptCallFrameScopeChain, (intptr_t)0 },
-    { "thisObject", DontDelete|ReadOnly, (intptr_t)jsJavaScriptCallFrameThisObject, (intptr_t)0 },
-    { "functionName", DontDelete|ReadOnly, (intptr_t)jsJavaScriptCallFrameFunctionName, (intptr_t)0 },
-    { "type", DontDelete|ReadOnly, (intptr_t)jsJavaScriptCallFrameType, (intptr_t)0 },
+    { "caller", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsJavaScriptCallFrameCaller), (intptr_t)0 },
+    { "sourceID", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsJavaScriptCallFrameSourceID), (intptr_t)0 },
+    { "line", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsJavaScriptCallFrameLine), (intptr_t)0 },
+    { "scopeChain", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsJavaScriptCallFrameScopeChain), (intptr_t)0 },
+    { "thisObject", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsJavaScriptCallFrameThisObject), (intptr_t)0 },
+    { "functionName", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsJavaScriptCallFrameFunctionName), (intptr_t)0 },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsJavaScriptCallFrameType), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -63,7 +63,7 @@ static JSC_CONST_HASHTABLE HashTable JSJavaScriptCallFrameTable =
 
 static const HashTableValue JSJavaScriptCallFramePrototypeTableValues[2] =
 {
-    { "evaluate", DontDelete|Function, (intptr_t)jsJavaScriptCallFramePrototypeFunctionEvaluate, (intptr_t)1 },
+    { "evaluate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsJavaScriptCallFramePrototypeFunctionEvaluate), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -119,53 +119,57 @@ bool JSJavaScriptCallFrame::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSJavaScriptCallFrame, Base>(exec, &JSJavaScriptCallFrameTable, this, propertyName, descriptor);
 }
 
-JSValue jsJavaScriptCallFrameCaller(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameCaller(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSJavaScriptCallFrame* castedThis = static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()));
+    JSJavaScriptCallFrame* castedThis = static_cast<JSJavaScriptCallFrame*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     JavaScriptCallFrame* imp = static_cast<JavaScriptCallFrame*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->caller()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->caller()));
+    return result;
 }
 
-JSValue jsJavaScriptCallFrameSourceID(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameSourceID(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSJavaScriptCallFrame* castedThis = static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()));
+    JSJavaScriptCallFrame* castedThis = static_cast<JSJavaScriptCallFrame*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     JavaScriptCallFrame* imp = static_cast<JavaScriptCallFrame*>(castedThis->impl());
-    return jsNumber(exec, imp->sourceID());
+    JSValue result = jsNumber(exec, imp->sourceID());
+    return result;
 }
 
-JSValue jsJavaScriptCallFrameLine(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameLine(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSJavaScriptCallFrame* castedThis = static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()));
+    JSJavaScriptCallFrame* castedThis = static_cast<JSJavaScriptCallFrame*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     JavaScriptCallFrame* imp = static_cast<JavaScriptCallFrame*>(castedThis->impl());
-    return jsNumber(exec, imp->line());
+    JSValue result = jsNumber(exec, imp->line());
+    return result;
 }
 
-JSValue jsJavaScriptCallFrameScopeChain(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameScopeChain(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSJavaScriptCallFrame* castedThis = static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()));
+    JSJavaScriptCallFrame* castedThis = static_cast<JSJavaScriptCallFrame*>(asObject(slotBase));
     return castedThis->scopeChain(exec);
 }
 
-JSValue jsJavaScriptCallFrameThisObject(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameThisObject(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSJavaScriptCallFrame* castedThis = static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()));
+    JSJavaScriptCallFrame* castedThis = static_cast<JSJavaScriptCallFrame*>(asObject(slotBase));
     return castedThis->thisObject(exec);
 }
 
-JSValue jsJavaScriptCallFrameFunctionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameFunctionName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSJavaScriptCallFrame* castedThis = static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()));
+    JSJavaScriptCallFrame* castedThis = static_cast<JSJavaScriptCallFrame*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     JavaScriptCallFrame* imp = static_cast<JavaScriptCallFrame*>(castedThis->impl());
-    return jsString(exec, imp->functionName());
+    JSValue result = jsString(exec, imp->functionName());
+    return result;
 }
 
-JSValue jsJavaScriptCallFrameType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSJavaScriptCallFrame* castedThis = static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()));
+    JSJavaScriptCallFrame* castedThis = static_cast<JSJavaScriptCallFrame*>(asObject(slotBase));
     return castedThis->type(exec);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
index a209147b50..c8ab722db0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 
@@ -77,7 +76,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSJavaScriptCallFramePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -89,13 +88,13 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsJavaScriptCallFramePrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsJavaScriptCallFrameCaller(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsJavaScriptCallFrameSourceID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsJavaScriptCallFrameLine(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsJavaScriptCallFrameScopeChain(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsJavaScriptCallFrameThisObject(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsJavaScriptCallFrameFunctionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsJavaScriptCallFrameType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsJavaScriptCallFrameCaller(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsJavaScriptCallFrameSourceID(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsJavaScriptCallFrameLine(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsJavaScriptCallFrameScopeChain(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsJavaScriptCallFrameThisObject(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsJavaScriptCallFrameFunctionName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsJavaScriptCallFrameType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
index 4beaa591f2..bbe463a464 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
@@ -39,14 +39,14 @@ ASSERT_CLASS_FITS_IN_CELL(JSKeyboardEvent);
 
 static const HashTableValue JSKeyboardEventTableValues[9] =
 {
-    { "keyIdentifier", DontDelete|ReadOnly, (intptr_t)jsKeyboardEventKeyIdentifier, (intptr_t)0 },
-    { "keyLocation", DontDelete|ReadOnly, (intptr_t)jsKeyboardEventKeyLocation, (intptr_t)0 },
-    { "ctrlKey", DontDelete|ReadOnly, (intptr_t)jsKeyboardEventCtrlKey, (intptr_t)0 },
-    { "shiftKey", DontDelete|ReadOnly, (intptr_t)jsKeyboardEventShiftKey, (intptr_t)0 },
-    { "altKey", DontDelete|ReadOnly, (intptr_t)jsKeyboardEventAltKey, (intptr_t)0 },
-    { "metaKey", DontDelete|ReadOnly, (intptr_t)jsKeyboardEventMetaKey, (intptr_t)0 },
-    { "altGraphKey", DontDelete|ReadOnly, (intptr_t)jsKeyboardEventAltGraphKey, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsKeyboardEventConstructor, (intptr_t)0 },
+    { "keyIdentifier", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsKeyboardEventKeyIdentifier), (intptr_t)0 },
+    { "keyLocation", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsKeyboardEventKeyLocation), (intptr_t)0 },
+    { "ctrlKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsKeyboardEventCtrlKey), (intptr_t)0 },
+    { "shiftKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsKeyboardEventShiftKey), (intptr_t)0 },
+    { "altKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsKeyboardEventAltKey), (intptr_t)0 },
+    { "metaKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsKeyboardEventMetaKey), (intptr_t)0 },
+    { "altGraphKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsKeyboardEventAltGraphKey), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsKeyboardEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -85,7 +85,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -108,7 +108,7 @@ bool JSKeyboardEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSKeyboardEventPrototypeTableValues[2] =
 {
-    { "initKeyboardEvent", DontDelete|Function, (intptr_t)jsKeyboardEventPrototypeFunctionInitKeyboardEvent, (intptr_t)11 },
+    { "initKeyboardEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsKeyboardEventPrototypeFunctionInitKeyboardEvent), (intptr_t)11 },
     { 0, 0, 0, 0 }
 };
 
@@ -158,65 +158,72 @@ bool JSKeyboardEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSKeyboardEvent, Base>(exec, &JSKeyboardEventTable, this, propertyName, descriptor);
 }
 
-JSValue jsKeyboardEventKeyIdentifier(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventKeyIdentifier(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSKeyboardEvent* castedThis = static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()));
+    JSKeyboardEvent* castedThis = static_cast<JSKeyboardEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(castedThis->impl());
-    return jsString(exec, imp->keyIdentifier());
+    JSValue result = jsString(exec, imp->keyIdentifier());
+    return result;
 }
 
-JSValue jsKeyboardEventKeyLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventKeyLocation(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSKeyboardEvent* castedThis = static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()));
+    JSKeyboardEvent* castedThis = static_cast<JSKeyboardEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->keyLocation());
+    JSValue result = jsNumber(exec, imp->keyLocation());
+    return result;
 }
 
-JSValue jsKeyboardEventCtrlKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventCtrlKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSKeyboardEvent* castedThis = static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()));
+    JSKeyboardEvent* castedThis = static_cast<JSKeyboardEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(castedThis->impl());
-    return jsBoolean(imp->ctrlKey());
+    JSValue result = jsBoolean(imp->ctrlKey());
+    return result;
 }
 
-JSValue jsKeyboardEventShiftKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventShiftKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSKeyboardEvent* castedThis = static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()));
+    JSKeyboardEvent* castedThis = static_cast<JSKeyboardEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(castedThis->impl());
-    return jsBoolean(imp->shiftKey());
+    JSValue result = jsBoolean(imp->shiftKey());
+    return result;
 }
 
-JSValue jsKeyboardEventAltKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventAltKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSKeyboardEvent* castedThis = static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()));
+    JSKeyboardEvent* castedThis = static_cast<JSKeyboardEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(castedThis->impl());
-    return jsBoolean(imp->altKey());
+    JSValue result = jsBoolean(imp->altKey());
+    return result;
 }
 
-JSValue jsKeyboardEventMetaKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventMetaKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSKeyboardEvent* castedThis = static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()));
+    JSKeyboardEvent* castedThis = static_cast<JSKeyboardEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(castedThis->impl());
-    return jsBoolean(imp->metaKey());
+    JSValue result = jsBoolean(imp->metaKey());
+    return result;
 }
 
-JSValue jsKeyboardEventAltGraphKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventAltGraphKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSKeyboardEvent* castedThis = static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()));
+    JSKeyboardEvent* castedThis = static_cast<JSKeyboardEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(castedThis->impl());
-    return jsBoolean(imp->altGraphKey());
+    JSValue result = jsBoolean(imp->altGraphKey());
+    return result;
 }
 
-JSValue jsKeyboardEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSKeyboardEvent* domObject = static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()));
+    JSKeyboardEvent* domObject = static_cast<JSKeyboardEvent*>(asObject(slotBase));
     return JSKeyboardEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSKeyboardEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
index 7d6093323f..1dde4c52eb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSKeyboardEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -70,14 +70,14 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsKeyboardEventPrototypeFunctionInitKeyboardEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsKeyboardEventKeyIdentifier(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsKeyboardEventKeyLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsKeyboardEventCtrlKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsKeyboardEventShiftKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsKeyboardEventAltKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsKeyboardEventMetaKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsKeyboardEventAltGraphKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsKeyboardEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventKeyIdentifier(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsKeyboardEventKeyLocation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsKeyboardEventCtrlKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsKeyboardEventShiftKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsKeyboardEventAltKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsKeyboardEventMetaKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsKeyboardEventAltGraphKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsKeyboardEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
index bb4d56cf05..5568905566 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
@@ -38,14 +38,14 @@ ASSERT_CLASS_FITS_IN_CELL(JSLocation);
 
 static const HashTableValue JSLocationTableValues[9] =
 {
-    { "href", DontDelete, (intptr_t)jsLocationHref, (intptr_t)setJSLocationHref },
-    { "protocol", DontDelete, (intptr_t)jsLocationProtocol, (intptr_t)setJSLocationProtocol },
-    { "host", DontDelete, (intptr_t)jsLocationHost, (intptr_t)setJSLocationHost },
-    { "hostname", DontDelete, (intptr_t)jsLocationHostname, (intptr_t)setJSLocationHostname },
-    { "port", DontDelete, (intptr_t)jsLocationPort, (intptr_t)setJSLocationPort },
-    { "pathname", DontDelete, (intptr_t)jsLocationPathname, (intptr_t)setJSLocationPathname },
-    { "search", DontDelete, (intptr_t)jsLocationSearch, (intptr_t)setJSLocationSearch },
-    { "hash", DontDelete, (intptr_t)jsLocationHash, (intptr_t)setJSLocationHash },
+    { "href", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsLocationHref), (intptr_t)setJSLocationHref },
+    { "protocol", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsLocationProtocol), (intptr_t)setJSLocationProtocol },
+    { "host", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsLocationHost), (intptr_t)setJSLocationHost },
+    { "hostname", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsLocationHostname), (intptr_t)setJSLocationHostname },
+    { "port", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsLocationPort), (intptr_t)setJSLocationPort },
+    { "pathname", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsLocationPathname), (intptr_t)setJSLocationPathname },
+    { "search", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsLocationSearch), (intptr_t)setJSLocationSearch },
+    { "hash", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsLocationHash), (intptr_t)setJSLocationHash },
     { 0, 0, 0, 0 }
 };
 
@@ -60,10 +60,10 @@ static JSC_CONST_HASHTABLE HashTable JSLocationTable =
 
 static const HashTableValue JSLocationPrototypeTableValues[5] =
 {
-    { "assign", DontDelete|Function, (intptr_t)jsLocationPrototypeFunctionAssign, (intptr_t)1 },
-    { "replace", DontDelete|Function, (intptr_t)jsLocationPrototypeFunctionReplace, (intptr_t)1 },
-    { "reload", DontDelete|Function, (intptr_t)jsLocationPrototypeFunctionReload, (intptr_t)0 },
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsLocationPrototypeFunctionToString, (intptr_t)0 },
+    { "assign", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsLocationPrototypeFunctionAssign), (intptr_t)1 },
+    { "replace", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsLocationPrototypeFunctionReplace), (intptr_t)1 },
+    { "reload", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsLocationPrototypeFunctionReload), (intptr_t)0 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsLocationPrototypeFunctionToString), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -130,68 +130,76 @@ bool JSLocation::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     return getStaticValueDescriptor<JSLocation, Base>(exec, &JSLocationTable, this, propertyName, descriptor);
 }
 
-JSValue jsLocationHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slot.slotBase()));
+    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(castedThis->impl());
-    return jsString(exec, imp->href());
+    JSValue result = jsString(exec, imp->href());
+    return result;
 }
 
-JSValue jsLocationProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationProtocol(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slot.slotBase()));
+    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(castedThis->impl());
-    return jsString(exec, imp->protocol());
+    JSValue result = jsString(exec, imp->protocol());
+    return result;
 }
 
-JSValue jsLocationHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationHost(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slot.slotBase()));
+    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(castedThis->impl());
-    return jsString(exec, imp->host());
+    JSValue result = jsString(exec, imp->host());
+    return result;
 }
 
-JSValue jsLocationHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationHostname(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slot.slotBase()));
+    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(castedThis->impl());
-    return jsString(exec, imp->hostname());
+    JSValue result = jsString(exec, imp->hostname());
+    return result;
 }
 
-JSValue jsLocationPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationPort(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slot.slotBase()));
+    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(castedThis->impl());
-    return jsString(exec, imp->port());
+    JSValue result = jsString(exec, imp->port());
+    return result;
 }
 
-JSValue jsLocationPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationPathname(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slot.slotBase()));
+    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(castedThis->impl());
-    return jsString(exec, imp->pathname());
+    JSValue result = jsString(exec, imp->pathname());
+    return result;
 }
 
-JSValue jsLocationSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationSearch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slot.slotBase()));
+    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(castedThis->impl());
-    return jsString(exec, imp->search());
+    JSValue result = jsString(exec, imp->search());
+    return result;
 }
 
-JSValue jsLocationHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationHash(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slot.slotBase()));
+    JSLocation* castedThis = static_cast<JSLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(castedThis->impl());
-    return jsString(exec, imp->hash());
+    JSValue result = jsString(exec, imp->hash());
+    return result;
 }
 
 void JSLocation::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSLocation.h b/src/3rdparty/webkit/WebCore/generated/JSLocation.h
index 2948ce6bbe..6532fea6e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSLocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSLocation.h
@@ -21,7 +21,6 @@
 #ifndef JSLocation_h
 #define JSLocation_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -47,11 +46,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
 
     // Custom attributes
@@ -90,7 +89,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
@@ -108,21 +107,21 @@ JSC::JSValue JSC_HOST_CALL jsLocationPrototypeFunctionReload(JSC::ExecState*, JS
 JSC::JSValue JSC_HOST_CALL jsLocationPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsLocationHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsLocationHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSLocationHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsLocationProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsLocationProtocol(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSLocationProtocol(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsLocationHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsLocationHost(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSLocationHost(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsLocationHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsLocationHostname(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSLocationHostname(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsLocationPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsLocationPort(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSLocationPort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsLocationPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsLocationPathname(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSLocationPathname(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsLocationSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsLocationSearch(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSLocationSearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsLocationHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsLocationHash(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSLocationHash(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp b/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
index 93cde9f624..1579c2b8f1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
@@ -37,8 +37,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSMedia);
 
 static const HashTableValue JSMediaTableValues[3] =
 {
-    { "type", DontDelete|ReadOnly, (intptr_t)jsMediaType, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsMediaConstructor, (intptr_t)0 },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMediaType), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMediaConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -100,7 +100,7 @@ bool JSMediaConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identif
 
 static const HashTableValue JSMediaPrototypeTableValues[2] =
 {
-    { "matchMedium", DontDelete|Function, (intptr_t)jsMediaPrototypeFunctionMatchMedium, (intptr_t)1 },
+    { "matchMedium", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsMediaPrototypeFunctionMatchMedium), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -156,17 +156,18 @@ bool JSMedia::getOwnPropertyDescriptor(ExecState* exec, const Identifier& proper
     return getStaticValueDescriptor<JSMedia, Base>(exec, &JSMediaTable, this, propertyName, descriptor);
 }
 
-JSValue jsMediaType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMedia* castedThis = static_cast<JSMedia*>(asObject(slot.slotBase()));
+    JSMedia* castedThis = static_cast<JSMedia*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Media* imp = static_cast<Media*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsMediaConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMedia* domObject = static_cast<JSMedia*>(asObject(slot.slotBase()));
+    JSMedia* domObject = static_cast<JSMedia*>(asObject(slotBase));
     return JSMedia::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSMedia::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMedia.h b/src/3rdparty/webkit/WebCore/generated/JSMedia.h
index fec492b05a..28515c9802 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMedia.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMedia.h
@@ -21,7 +21,6 @@
 #ifndef JSMedia_h
 #define JSMedia_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -68,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSMediaPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,8 +79,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsMediaPrototypeFunctionMatchMedium(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsMediaType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMediaConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMediaConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
index 534a585dc0..5846799215 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
@@ -38,8 +38,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSMediaError);
 
 static const HashTableValue JSMediaErrorTableValues[3] =
 {
-    { "code", DontDelete|ReadOnly, (intptr_t)jsMediaErrorCode, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsMediaErrorConstructor, (intptr_t)0 },
+    { "code", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMediaErrorCode), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMediaErrorConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -54,10 +54,10 @@ static JSC_CONST_HASHTABLE HashTable JSMediaErrorTable =
 
 static const HashTableValue JSMediaErrorConstructorTableValues[5] =
 {
-    { "MEDIA_ERR_ABORTED", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_ABORTED, (intptr_t)0 },
-    { "MEDIA_ERR_NETWORK", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_NETWORK, (intptr_t)0 },
-    { "MEDIA_ERR_DECODE", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_DECODE, (intptr_t)0 },
-    { "MEDIA_ERR_SRC_NOT_SUPPORTED", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED, (intptr_t)0 },
+    { "MEDIA_ERR_ABORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMediaErrorMEDIA_ERR_ABORTED), (intptr_t)0 },
+    { "MEDIA_ERR_NETWORK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMediaErrorMEDIA_ERR_NETWORK), (intptr_t)0 },
+    { "MEDIA_ERR_DECODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMediaErrorMEDIA_ERR_DECODE), (intptr_t)0 },
+    { "MEDIA_ERR_SRC_NOT_SUPPORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -82,7 +82,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -105,10 +105,10 @@ bool JSMediaErrorConstructor::getOwnPropertyDescriptor(ExecState* exec, const Id
 
 static const HashTableValue JSMediaErrorPrototypeTableValues[5] =
 {
-    { "MEDIA_ERR_ABORTED", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_ABORTED, (intptr_t)0 },
-    { "MEDIA_ERR_NETWORK", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_NETWORK, (intptr_t)0 },
-    { "MEDIA_ERR_DECODE", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_DECODE, (intptr_t)0 },
-    { "MEDIA_ERR_SRC_NOT_SUPPORTED", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED, (intptr_t)0 },
+    { "MEDIA_ERR_ABORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMediaErrorMEDIA_ERR_ABORTED), (intptr_t)0 },
+    { "MEDIA_ERR_NETWORK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMediaErrorMEDIA_ERR_NETWORK), (intptr_t)0 },
+    { "MEDIA_ERR_DECODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMediaErrorMEDIA_ERR_DECODE), (intptr_t)0 },
+    { "MEDIA_ERR_SRC_NOT_SUPPORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -164,17 +164,18 @@ bool JSMediaError::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<JSMediaError, Base>(exec, &JSMediaErrorTable, this, propertyName, descriptor);
 }
 
-JSValue jsMediaErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaErrorCode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMediaError* castedThis = static_cast<JSMediaError*>(asObject(slot.slotBase()));
+    JSMediaError* castedThis = static_cast<JSMediaError*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MediaError* imp = static_cast<MediaError*>(castedThis->impl());
-    return jsNumber(exec, imp->code());
+    JSValue result = jsNumber(exec, imp->code());
+    return result;
 }
 
-JSValue jsMediaErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaErrorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMediaError* domObject = static_cast<JSMediaError*>(asObject(slot.slotBase()));
+    JSMediaError* domObject = static_cast<JSMediaError*>(asObject(slotBase));
     return JSMediaError::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSMediaError::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -184,22 +185,22 @@ JSValue JSMediaError::getConstructor(ExecState* exec, JSGlobalObject* globalObje
 
 // Constant getters
 
-JSValue jsMediaErrorMEDIA_ERR_ABORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMediaErrorMEDIA_ERR_ABORTED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsMediaErrorMEDIA_ERR_NETWORK(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMediaErrorMEDIA_ERR_NETWORK(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsMediaErrorMEDIA_ERR_DECODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMediaErrorMEDIA_ERR_DECODE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaError.h b/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
index 847dd0e967..7fff14f6fa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(VIDEO)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -70,7 +69,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSMediaErrorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -79,14 +78,14 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsMediaErrorCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMediaErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaErrorCode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMediaErrorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsMediaErrorMEDIA_ERR_ABORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMediaErrorMEDIA_ERR_NETWORK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMediaErrorMEDIA_ERR_DECODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaErrorMEDIA_ERR_ABORTED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMediaErrorMEDIA_ERR_NETWORK(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMediaErrorMEDIA_ERR_DECODE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
index e7b758edf3..73882e8e1f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
@@ -38,9 +38,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSMediaList);
 
 static const HashTableValue JSMediaListTableValues[4] =
 {
-    { "mediaText", DontDelete, (intptr_t)jsMediaListMediaText, (intptr_t)setJSMediaListMediaText },
-    { "length", DontDelete|ReadOnly, (intptr_t)jsMediaListLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsMediaListConstructor, (intptr_t)0 },
+    { "mediaText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMediaListMediaText), (intptr_t)setJSMediaListMediaText },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMediaListLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMediaListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -102,9 +102,9 @@ bool JSMediaListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ide
 
 static const HashTableValue JSMediaListPrototypeTableValues[4] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsMediaListPrototypeFunctionItem, (intptr_t)1 },
-    { "deleteMedium", DontDelete|Function, (intptr_t)jsMediaListPrototypeFunctionDeleteMedium, (intptr_t)1 },
-    { "appendMedium", DontDelete|Function, (intptr_t)jsMediaListPrototypeFunctionAppendMedium, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsMediaListPrototypeFunctionItem), (intptr_t)1 },
+    { "deleteMedium", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsMediaListPrototypeFunctionDeleteMedium), (intptr_t)1 },
+    { "appendMedium", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsMediaListPrototypeFunctionAppendMedium), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -159,7 +159,7 @@ bool JSMediaList::getOwnPropertySlot(ExecState* exec, const Identifier& property
     }
     bool ok;
     unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<MediaList*>(impl())->length()) {
+    if (ok) {
         slot.setCustomIndex(this, index, indexGetter);
         return true;
     }
@@ -195,25 +195,27 @@ bool JSMediaList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Pro
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsMediaListMediaText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaListMediaText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMediaList* castedThis = static_cast<JSMediaList*>(asObject(slot.slotBase()));
+    JSMediaList* castedThis = static_cast<JSMediaList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MediaList* imp = static_cast<MediaList*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->mediaText());
+    JSValue result = jsStringOrNull(exec, imp->mediaText());
+    return result;
 }
 
-JSValue jsMediaListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaListLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMediaList* castedThis = static_cast<JSMediaList*>(asObject(slot.slotBase()));
+    JSMediaList* castedThis = static_cast<JSMediaList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MediaList* imp = static_cast<MediaList*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsMediaListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMediaList* domObject = static_cast<JSMediaList*>(asObject(slot.slotBase()));
+    JSMediaList* domObject = static_cast<JSMediaList*>(asObject(slotBase));
     return JSMediaList::getConstructor(exec, domObject->globalObject());
 }
 void JSMediaList::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -223,17 +225,18 @@ void JSMediaList::put(ExecState* exec, const Identifier& propertyName, JSValue v
 
 void setJSMediaListMediaText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    MediaList* imp = static_cast<MediaList*>(static_cast<JSMediaList*>(thisObject)->impl());
+    JSMediaList* castedThisObj = static_cast<JSMediaList*>(thisObject);
+    MediaList* imp = static_cast<MediaList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setMediaText(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
 }
 
-void JSMediaList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSMediaList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<MediaList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSMediaList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -286,10 +289,10 @@ JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionAppendMedium(ExecState* exec,
 }
 
 
-JSValue JSMediaList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSMediaList::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSMediaList* thisObj = static_cast<JSMediaList*>(asObject(slot.slotBase()));
-    return jsStringOrNull(exec, thisObj->impl()->item(slot.index()));
+    JSMediaList* thisObj = static_cast<JSMediaList*>(asObject(slotBase));
+    return jsStringOrNull(exec, thisObj->impl()->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, MediaList* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaList.h b/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
index 30853dfc76..e7dbc6c3d6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
@@ -21,7 +21,6 @@
 #ifndef JSMediaList_h
 #define JSMediaList_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,10 +44,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     MediaList* impl() const { return m_impl.get(); }
 
@@ -56,7 +55,7 @@ private:
     RefPtr<MediaList> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, MediaList*);
@@ -72,7 +71,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSMediaListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -86,10 +85,10 @@ JSC::JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionDeleteMedium(JSC::ExecSta
 JSC::JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionAppendMedium(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsMediaListMediaText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaListMediaText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSMediaListMediaText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsMediaListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMediaListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaListLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMediaListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
index 8ba6f014d0..90a47543fb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
@@ -36,8 +36,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSMessageChannel);
 
 static const HashTableValue JSMessageChannelTableValues[3] =
 {
-    { "port1", DontDelete|ReadOnly, (intptr_t)jsMessageChannelPort1, (intptr_t)0 },
-    { "port2", DontDelete|ReadOnly, (intptr_t)jsMessageChannelPort2, (intptr_t)0 },
+    { "port1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMessageChannelPort1), (intptr_t)0 },
+    { "port2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMessageChannelPort2), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -105,20 +105,22 @@ bool JSMessageChannel::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSMessageChannel, Base>(exec, getJSMessageChannelTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsMessageChannelPort1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageChannelPort1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMessageChannel* castedThis = static_cast<JSMessageChannel*>(asObject(slot.slotBase()));
+    JSMessageChannel* castedThis = static_cast<JSMessageChannel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MessageChannel* imp = static_cast<MessageChannel*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->port1()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->port1()));
+    return result;
 }
 
-JSValue jsMessageChannelPort2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageChannelPort2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMessageChannel* castedThis = static_cast<JSMessageChannel*>(asObject(slot.slotBase()));
+    JSMessageChannel* castedThis = static_cast<JSMessageChannel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MessageChannel* imp = static_cast<MessageChannel*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->port2()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->port2()));
+    return result;
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, MessageChannel* object)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
index 8b8b1271a0..847e95be8c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
@@ -21,7 +21,6 @@
 #ifndef JSMessageChannel_h
 #define JSMessageChannel_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -67,7 +66,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSMessageChannelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -76,8 +75,8 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsMessageChannelPort1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMessageChannelPort2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageChannelPort1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMessageChannelPort2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
index f308150dda..6d98d87e5d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
@@ -40,12 +40,12 @@ ASSERT_CLASS_FITS_IN_CELL(JSMessageEvent);
 
 static const HashTableValue JSMessageEventTableValues[7] =
 {
-    { "data", DontDelete|ReadOnly, (intptr_t)jsMessageEventData, (intptr_t)0 },
-    { "origin", DontDelete|ReadOnly, (intptr_t)jsMessageEventOrigin, (intptr_t)0 },
-    { "lastEventId", DontDelete|ReadOnly, (intptr_t)jsMessageEventLastEventId, (intptr_t)0 },
-    { "source", DontDelete|ReadOnly, (intptr_t)jsMessageEventSource, (intptr_t)0 },
-    { "ports", DontDelete|ReadOnly, (intptr_t)jsMessageEventPorts, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsMessageEventConstructor, (intptr_t)0 },
+    { "data", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMessageEventData), (intptr_t)0 },
+    { "origin", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMessageEventOrigin), (intptr_t)0 },
+    { "lastEventId", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMessageEventLastEventId), (intptr_t)0 },
+    { "source", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMessageEventSource), (intptr_t)0 },
+    { "ports", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMessageEventPorts), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMessageEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -84,7 +84,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -107,7 +107,7 @@ bool JSMessageEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSMessageEventPrototypeTableValues[2] =
 {
-    { "initMessageEvent", DontDelete|Function, (intptr_t)jsMessageEventPrototypeFunctionInitMessageEvent, (intptr_t)8 },
+    { "initMessageEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsMessageEventPrototypeFunctionInitMessageEvent), (intptr_t)8 },
     { 0, 0, 0, 0 }
 };
 
@@ -148,6 +148,8 @@ const ClassInfo JSMessageEvent::s_info = { "MessageEvent", &JSEvent::s_info, 0,
 JSMessageEvent::JSMessageEvent(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<MessageEvent> impl)
     : JSEvent(structure, globalObject, impl)
 {
+    for (unsigned i = Base::AnonymousSlotCount; i < AnonymousSlotCount; i++)
+        putAnonymousValue(i, JSValue());
 }
 
 JSObject* JSMessageEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -165,47 +167,54 @@ bool JSMessageEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSMessageEvent, Base>(exec, getJSMessageEventTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsMessageEventData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventData(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMessageEvent* castedThis = static_cast<JSMessageEvent*>(asObject(slot.slotBase()));
+    JSMessageEvent* castedThis = static_cast<JSMessageEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
+    if (JSValue cachedValue = castedThis->getAnonymousValue(JSMessageEvent::dataSlot))
+        return cachedValue;
     MessageEvent* imp = static_cast<MessageEvent*>(castedThis->impl());
-    return imp->data()->deserialize(exec);
+    JSValue result = imp->data() ? imp->data()->deserialize(exec, castedThis->globalObject()) : jsNull();
+    castedThis->putAnonymousValue(JSMessageEvent::dataSlot, result);
+    return result;
 }
 
-JSValue jsMessageEventOrigin(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventOrigin(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMessageEvent* castedThis = static_cast<JSMessageEvent*>(asObject(slot.slotBase()));
+    JSMessageEvent* castedThis = static_cast<JSMessageEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MessageEvent* imp = static_cast<MessageEvent*>(castedThis->impl());
-    return jsString(exec, imp->origin());
+    JSValue result = jsString(exec, imp->origin());
+    return result;
 }
 
-JSValue jsMessageEventLastEventId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventLastEventId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMessageEvent* castedThis = static_cast<JSMessageEvent*>(asObject(slot.slotBase()));
+    JSMessageEvent* castedThis = static_cast<JSMessageEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MessageEvent* imp = static_cast<MessageEvent*>(castedThis->impl());
-    return jsString(exec, imp->lastEventId());
+    JSValue result = jsString(exec, imp->lastEventId());
+    return result;
 }
 
-JSValue jsMessageEventSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventSource(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMessageEvent* castedThis = static_cast<JSMessageEvent*>(asObject(slot.slotBase()));
+    JSMessageEvent* castedThis = static_cast<JSMessageEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MessageEvent* imp = static_cast<MessageEvent*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->source()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->source()));
+    return result;
 }
 
-JSValue jsMessageEventPorts(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventPorts(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMessageEvent* castedThis = static_cast<JSMessageEvent*>(asObject(slot.slotBase()));
+    JSMessageEvent* castedThis = static_cast<JSMessageEvent*>(asObject(slotBase));
     return castedThis->ports(exec);
 }
 
-JSValue jsMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMessageEvent* domObject = static_cast<JSMessageEvent*>(asObject(slot.slotBase()));
+    JSMessageEvent* domObject = static_cast<JSMessageEvent*>(asObject(slotBase));
     return JSMessageEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSMessageEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
index d109987307..61cfc091a9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
@@ -39,16 +39,21 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+    static const unsigned dataSlot = 0 + Base::AnonymousSlotCount;
+    using JSEvent::putAnonymousValue;
+    using JSEvent::getAnonymousValue;
 
     // Custom attributes
     JSC::JSValue ports(JSC::ExecState*) const;
 
     // Custom functions
     JSC::JSValue initMessageEvent(JSC::ExecState*, const JSC::ArgList&);
+public:
+    static const unsigned AnonymousSlotCount = 1 + Base::AnonymousSlotCount;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -64,7 +69,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSMessageEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -76,12 +81,12 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsMessageEventPrototypeFunctionInitMessageEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsMessageEventData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMessageEventOrigin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMessageEventLastEventId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMessageEventSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMessageEventPorts(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageEventData(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMessageEventOrigin(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMessageEventLastEventId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMessageEventSource(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMessageEventPorts(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMessageEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
index a65091c441..668a3ec992 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
@@ -23,8 +23,6 @@
 
 #include "Event.h"
 #include "EventListener.h"
-#include "Frame.h"
-#include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "MessagePort.h"
@@ -43,8 +41,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSMessagePort);
 
 static const HashTableValue JSMessagePortTableValues[3] =
 {
-    { "onmessage", DontDelete, (intptr_t)jsMessagePortOnmessage, (intptr_t)setJSMessagePortOnmessage },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsMessagePortConstructor, (intptr_t)0 },
+    { "onmessage", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMessagePortOnmessage), (intptr_t)setJSMessagePortOnmessage },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMessagePortConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -83,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -106,12 +104,12 @@ bool JSMessagePortConstructor::getOwnPropertyDescriptor(ExecState* exec, const I
 
 static const HashTableValue JSMessagePortPrototypeTableValues[7] =
 {
-    { "postMessage", DontDelete|Function, (intptr_t)jsMessagePortPrototypeFunctionPostMessage, (intptr_t)2 },
-    { "start", DontDelete|Function, (intptr_t)jsMessagePortPrototypeFunctionStart, (intptr_t)0 },
-    { "close", DontDelete|Function, (intptr_t)jsMessagePortPrototypeFunctionClose, (intptr_t)0 },
-    { "addEventListener", DontDelete|Function, (intptr_t)jsMessagePortPrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsMessagePortPrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsMessagePortPrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { "postMessage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsMessagePortPrototypeFunctionPostMessage), (intptr_t)2 },
+    { "start", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsMessagePortPrototypeFunctionStart), (intptr_t)0 },
+    { "close", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsMessagePortPrototypeFunctionClose), (intptr_t)0 },
+    { "addEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsMessagePortPrototypeFunctionAddEventListener), (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsMessagePortPrototypeFunctionRemoveEventListener), (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsMessagePortPrototypeFunctionDispatchEvent), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -157,7 +155,7 @@ JSMessagePort::JSMessagePort(NonNullPassRefPtr<Structure> structure, JSDOMGlobal
 
 JSMessagePort::~JSMessagePort()
 {
-    impl()->invalidateEventListeners();
+    impl()->invalidateJSEventListeners(this);
     forgetDOMObject(this, impl());
 }
 
@@ -176,21 +174,23 @@ bool JSMessagePort::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSMessagePort, Base>(exec, getJSMessagePortTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsMessagePortOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessagePortOnmessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMessagePort* castedThis = static_cast<JSMessagePort*>(asObject(slot.slotBase()));
+    JSMessagePort* castedThis = static_cast<JSMessagePort*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MessagePort* imp = static_cast<MessagePort*>(castedThis->impl());
     if (EventListener* listener = imp->onmessage()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsMessagePortConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessagePortConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMessagePort* domObject = static_cast<JSMessagePort*>(asObject(slot.slotBase()));
+    JSMessagePort* domObject = static_cast<JSMessagePort*>(asObject(slotBase));
     return JSMessagePort::getConstructor(exec, domObject->globalObject());
 }
 void JSMessagePort::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -202,10 +202,7 @@ void setJSMessagePortOnmessage(ExecState* exec, JSObject* thisObject, JSValue va
 {
     UNUSED_PARAM(exec);
     MessagePort* imp = static_cast<MessagePort*>(static_cast<JSMessagePort*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmessage(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSMessagePort::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
index 6d3aa6147d..ae71b9fc40 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
@@ -21,7 +21,6 @@
 #ifndef JSMessagePort_h
 #define JSMessagePort_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -76,7 +75,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSMessagePortPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -93,9 +92,9 @@ JSC::JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionRemoveEventListener(JSC
 JSC::JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsMessagePortOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessagePortOnmessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSMessagePortOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsMessagePortConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessagePortConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
index c91aaebc00..ea13dd16d9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
@@ -38,11 +38,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSMimeType);
 
 static const HashTableValue JSMimeTypeTableValues[6] =
 {
-    { "type", DontDelete|ReadOnly, (intptr_t)jsMimeTypeType, (intptr_t)0 },
-    { "suffixes", DontDelete|ReadOnly, (intptr_t)jsMimeTypeSuffixes, (intptr_t)0 },
-    { "description", DontDelete|ReadOnly, (intptr_t)jsMimeTypeDescription, (intptr_t)0 },
-    { "enabledPlugin", DontDelete|ReadOnly, (intptr_t)jsMimeTypeEnabledPlugin, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsMimeTypeConstructor, (intptr_t)0 },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMimeTypeType), (intptr_t)0 },
+    { "suffixes", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMimeTypeSuffixes), (intptr_t)0 },
+    { "description", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMimeTypeDescription), (intptr_t)0 },
+    { "enabledPlugin", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMimeTypeEnabledPlugin), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMimeTypeConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -149,41 +149,45 @@ bool JSMimeType::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     return getStaticValueDescriptor<JSMimeType, Base>(exec, &JSMimeTypeTable, this, propertyName, descriptor);
 }
 
-JSValue jsMimeTypeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMimeType* castedThis = static_cast<JSMimeType*>(asObject(slot.slotBase()));
+    JSMimeType* castedThis = static_cast<JSMimeType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MimeType* imp = static_cast<MimeType*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsMimeTypeSuffixes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeSuffixes(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMimeType* castedThis = static_cast<JSMimeType*>(asObject(slot.slotBase()));
+    JSMimeType* castedThis = static_cast<JSMimeType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MimeType* imp = static_cast<MimeType*>(castedThis->impl());
-    return jsString(exec, imp->suffixes());
+    JSValue result = jsString(exec, imp->suffixes());
+    return result;
 }
 
-JSValue jsMimeTypeDescription(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeDescription(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMimeType* castedThis = static_cast<JSMimeType*>(asObject(slot.slotBase()));
+    JSMimeType* castedThis = static_cast<JSMimeType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MimeType* imp = static_cast<MimeType*>(castedThis->impl());
-    return jsString(exec, imp->description());
+    JSValue result = jsString(exec, imp->description());
+    return result;
 }
 
-JSValue jsMimeTypeEnabledPlugin(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeEnabledPlugin(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMimeType* castedThis = static_cast<JSMimeType*>(asObject(slot.slotBase()));
+    JSMimeType* castedThis = static_cast<JSMimeType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MimeType* imp = static_cast<MimeType*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->enabledPlugin()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->enabledPlugin()));
+    return result;
 }
 
-JSValue jsMimeTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMimeType* domObject = static_cast<JSMimeType*>(asObject(slot.slotBase()));
+    JSMimeType* domObject = static_cast<JSMimeType*>(asObject(slotBase));
     return JSMimeType::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSMimeType::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeType.h b/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
index e3ee635536..24fd2539c0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
@@ -21,7 +21,6 @@
 #ifndef JSMimeType_h
 #define JSMimeType_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -66,7 +65,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSMimeTypePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,11 +74,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsMimeTypeType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMimeTypeSuffixes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMimeTypeDescription(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMimeTypeEnabledPlugin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMimeTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMimeTypeSuffixes(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMimeTypeDescription(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMimeTypeEnabledPlugin(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMimeTypeConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
index 3c7b7404ab..abcf59311e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
@@ -40,8 +40,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSMimeTypeArray);
 
 static const HashTableValue JSMimeTypeArrayTableValues[3] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsMimeTypeArrayLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsMimeTypeArrayConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMimeTypeArrayLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMimeTypeArrayConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -103,8 +103,8 @@ bool JSMimeTypeArrayConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSMimeTypeArrayPrototypeTableValues[3] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsMimeTypeArrayPrototypeFunctionItem, (intptr_t)1 },
-    { "namedItem", DontDelete|Function, (intptr_t)jsMimeTypeArrayPrototypeFunctionNamedItem, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsMimeTypeArrayPrototypeFunctionItem), (intptr_t)1 },
+    { "namedItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsMimeTypeArrayPrototypeFunctionNamedItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -205,24 +205,25 @@ bool JSMimeTypeArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName,
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsMimeTypeArrayLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeArrayLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMimeTypeArray* castedThis = static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()));
+    JSMimeTypeArray* castedThis = static_cast<JSMimeTypeArray*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MimeTypeArray* imp = static_cast<MimeTypeArray*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsMimeTypeArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMimeTypeArray* domObject = static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()));
+    JSMimeTypeArray* domObject = static_cast<JSMimeTypeArray*>(asObject(slotBase));
     return JSMimeTypeArray::getConstructor(exec, domObject->globalObject());
 }
-void JSMimeTypeArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSMimeTypeArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<MimeTypeArray*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSMimeTypeArray::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -259,10 +260,10 @@ JSValue JSC_HOST_CALL jsMimeTypeArrayPrototypeFunctionNamedItem(ExecState* exec,
 }
 
 
-JSValue JSMimeTypeArray::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSMimeTypeArray::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSMimeTypeArray* thisObj = static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<MimeTypeArray*>(thisObj->impl())->item(slot.index()));
+    JSMimeTypeArray* thisObj = static_cast<JSMimeTypeArray*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<MimeTypeArray*>(thisObj->impl())->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, MimeTypeArray* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
index 87b74382de..671d11f04d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
@@ -21,7 +21,6 @@
 #ifndef JSMimeTypeArray_h
 #define JSMimeTypeArray_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,10 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     MimeTypeArray* impl() const { return m_impl.get(); }
 
@@ -55,10 +54,10 @@ private:
     RefPtr<MimeTypeArray> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 private:
     static bool canGetItemsForName(JSC::ExecState*, MimeTypeArray*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, MimeTypeArray*);
@@ -74,7 +73,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSMimeTypeArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -87,8 +86,8 @@ JSC::JSValue JSC_HOST_CALL jsMimeTypeArrayPrototypeFunctionItem(JSC::ExecState*,
 JSC::JSValue JSC_HOST_CALL jsMimeTypeArrayPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsMimeTypeArrayLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMimeTypeArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeArrayLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMimeTypeArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
index 47c4b14b32..3959e49c80 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
@@ -43,24 +43,24 @@ ASSERT_CLASS_FITS_IN_CELL(JSMouseEvent);
 
 static const HashTableValue JSMouseEventTableValues[19] =
 {
-    { "screenX", DontDelete|ReadOnly, (intptr_t)jsMouseEventScreenX, (intptr_t)0 },
-    { "screenY", DontDelete|ReadOnly, (intptr_t)jsMouseEventScreenY, (intptr_t)0 },
-    { "clientX", DontDelete|ReadOnly, (intptr_t)jsMouseEventClientX, (intptr_t)0 },
-    { "clientY", DontDelete|ReadOnly, (intptr_t)jsMouseEventClientY, (intptr_t)0 },
-    { "ctrlKey", DontDelete|ReadOnly, (intptr_t)jsMouseEventCtrlKey, (intptr_t)0 },
-    { "shiftKey", DontDelete|ReadOnly, (intptr_t)jsMouseEventShiftKey, (intptr_t)0 },
-    { "altKey", DontDelete|ReadOnly, (intptr_t)jsMouseEventAltKey, (intptr_t)0 },
-    { "metaKey", DontDelete|ReadOnly, (intptr_t)jsMouseEventMetaKey, (intptr_t)0 },
-    { "button", DontDelete|ReadOnly, (intptr_t)jsMouseEventButton, (intptr_t)0 },
-    { "relatedTarget", DontDelete|ReadOnly, (intptr_t)jsMouseEventRelatedTarget, (intptr_t)0 },
-    { "offsetX", DontDelete|ReadOnly, (intptr_t)jsMouseEventOffsetX, (intptr_t)0 },
-    { "offsetY", DontDelete|ReadOnly, (intptr_t)jsMouseEventOffsetY, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsMouseEventX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsMouseEventY, (intptr_t)0 },
-    { "fromElement", DontDelete|ReadOnly, (intptr_t)jsMouseEventFromElement, (intptr_t)0 },
-    { "toElement", DontDelete|ReadOnly, (intptr_t)jsMouseEventToElement, (intptr_t)0 },
-    { "dataTransfer", DontDelete|ReadOnly, (intptr_t)jsMouseEventDataTransfer, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsMouseEventConstructor, (intptr_t)0 },
+    { "screenX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventScreenX), (intptr_t)0 },
+    { "screenY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventScreenY), (intptr_t)0 },
+    { "clientX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventClientX), (intptr_t)0 },
+    { "clientY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventClientY), (intptr_t)0 },
+    { "ctrlKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventCtrlKey), (intptr_t)0 },
+    { "shiftKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventShiftKey), (intptr_t)0 },
+    { "altKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventAltKey), (intptr_t)0 },
+    { "metaKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventMetaKey), (intptr_t)0 },
+    { "button", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventButton), (intptr_t)0 },
+    { "relatedTarget", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventRelatedTarget), (intptr_t)0 },
+    { "offsetX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventOffsetX), (intptr_t)0 },
+    { "offsetY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventOffsetY), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventY), (intptr_t)0 },
+    { "fromElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventFromElement), (intptr_t)0 },
+    { "toElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventToElement), (intptr_t)0 },
+    { "dataTransfer", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventDataTransfer), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMouseEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -99,7 +99,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -122,7 +122,7 @@ bool JSMouseEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Id
 
 static const HashTableValue JSMouseEventPrototypeTableValues[2] =
 {
-    { "initMouseEvent", DontDelete|Function, (intptr_t)jsMouseEventPrototypeFunctionInitMouseEvent, (intptr_t)15 },
+    { "initMouseEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsMouseEventPrototypeFunctionInitMouseEvent), (intptr_t)15 },
     { 0, 0, 0, 0 }
 };
 
@@ -172,145 +172,162 @@ bool JSMouseEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<JSMouseEvent, Base>(exec, &JSMouseEventTable, this, propertyName, descriptor);
 }
 
-JSValue jsMouseEventScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventScreenX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->screenX());
+    JSValue result = jsNumber(exec, imp->screenX());
+    return result;
 }
 
-JSValue jsMouseEventScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventScreenY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->screenY());
+    JSValue result = jsNumber(exec, imp->screenY());
+    return result;
 }
 
-JSValue jsMouseEventClientX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventClientX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->clientX());
+    JSValue result = jsNumber(exec, imp->clientX());
+    return result;
 }
 
-JSValue jsMouseEventClientY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventClientY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->clientY());
+    JSValue result = jsNumber(exec, imp->clientY());
+    return result;
 }
 
-JSValue jsMouseEventCtrlKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventCtrlKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return jsBoolean(imp->ctrlKey());
+    JSValue result = jsBoolean(imp->ctrlKey());
+    return result;
 }
 
-JSValue jsMouseEventShiftKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventShiftKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return jsBoolean(imp->shiftKey());
+    JSValue result = jsBoolean(imp->shiftKey());
+    return result;
 }
 
-JSValue jsMouseEventAltKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventAltKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return jsBoolean(imp->altKey());
+    JSValue result = jsBoolean(imp->altKey());
+    return result;
 }
 
-JSValue jsMouseEventMetaKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventMetaKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return jsBoolean(imp->metaKey());
+    JSValue result = jsBoolean(imp->metaKey());
+    return result;
 }
 
-JSValue jsMouseEventButton(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventButton(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->button());
+    JSValue result = jsNumber(exec, imp->button());
+    return result;
 }
 
-JSValue jsMouseEventRelatedTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventRelatedTarget(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->relatedTarget()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->relatedTarget()));
+    return result;
 }
 
-JSValue jsMouseEventOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventOffsetX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->offsetX());
+    JSValue result = jsNumber(exec, imp->offsetX());
+    return result;
 }
 
-JSValue jsMouseEventOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventOffsetY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->offsetY());
+    JSValue result = jsNumber(exec, imp->offsetY());
+    return result;
 }
 
-JSValue jsMouseEventX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsMouseEventY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
-JSValue jsMouseEventFromElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventFromElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->fromElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->fromElement()));
+    return result;
 }
 
-JSValue jsMouseEventToElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventToElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->toElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->toElement()));
+    return result;
 }
 
-JSValue jsMouseEventDataTransfer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventDataTransfer(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->dataTransfer()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->dataTransfer()));
+    return result;
 }
 
-JSValue jsMouseEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMouseEvent* domObject = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
+    JSMouseEvent* domObject = static_cast<JSMouseEvent*>(asObject(slotBase));
     return JSMouseEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSMouseEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
index c7a6e9e37a..73d441c3f5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSMouseEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -70,24 +70,24 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsMouseEventPrototypeFunctionInitMouseEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsMouseEventScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventClientX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventClientY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventCtrlKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventShiftKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventAltKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventMetaKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventButton(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventRelatedTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventFromElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventToElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventDataTransfer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMouseEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventScreenX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventScreenY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventClientX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventClientY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventCtrlKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventShiftKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventAltKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventMetaKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventButton(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventRelatedTarget(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventOffsetX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventOffsetY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventFromElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventToElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventDataTransfer(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMouseEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
index 6565d4069f..155c1cc3b3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
@@ -40,12 +40,12 @@ ASSERT_CLASS_FITS_IN_CELL(JSMutationEvent);
 
 static const HashTableValue JSMutationEventTableValues[7] =
 {
-    { "relatedNode", DontDelete|ReadOnly, (intptr_t)jsMutationEventRelatedNode, (intptr_t)0 },
-    { "prevValue", DontDelete|ReadOnly, (intptr_t)jsMutationEventPrevValue, (intptr_t)0 },
-    { "newValue", DontDelete|ReadOnly, (intptr_t)jsMutationEventNewValue, (intptr_t)0 },
-    { "attrName", DontDelete|ReadOnly, (intptr_t)jsMutationEventAttrName, (intptr_t)0 },
-    { "attrChange", DontDelete|ReadOnly, (intptr_t)jsMutationEventAttrChange, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsMutationEventConstructor, (intptr_t)0 },
+    { "relatedNode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMutationEventRelatedNode), (intptr_t)0 },
+    { "prevValue", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMutationEventPrevValue), (intptr_t)0 },
+    { "newValue", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMutationEventNewValue), (intptr_t)0 },
+    { "attrName", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMutationEventAttrName), (intptr_t)0 },
+    { "attrChange", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMutationEventAttrChange), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMutationEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -60,9 +60,9 @@ static JSC_CONST_HASHTABLE HashTable JSMutationEventTable =
 
 static const HashTableValue JSMutationEventConstructorTableValues[4] =
 {
-    { "MODIFICATION", DontDelete|ReadOnly, (intptr_t)jsMutationEventMODIFICATION, (intptr_t)0 },
-    { "ADDITION", DontDelete|ReadOnly, (intptr_t)jsMutationEventADDITION, (intptr_t)0 },
-    { "REMOVAL", DontDelete|ReadOnly, (intptr_t)jsMutationEventREMOVAL, (intptr_t)0 },
+    { "MODIFICATION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMutationEventMODIFICATION), (intptr_t)0 },
+    { "ADDITION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMutationEventADDITION), (intptr_t)0 },
+    { "REMOVAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMutationEventREMOVAL), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -87,7 +87,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -110,10 +110,10 @@ bool JSMutationEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSMutationEventPrototypeTableValues[5] =
 {
-    { "MODIFICATION", DontDelete|ReadOnly, (intptr_t)jsMutationEventMODIFICATION, (intptr_t)0 },
-    { "ADDITION", DontDelete|ReadOnly, (intptr_t)jsMutationEventADDITION, (intptr_t)0 },
-    { "REMOVAL", DontDelete|ReadOnly, (intptr_t)jsMutationEventREMOVAL, (intptr_t)0 },
-    { "initMutationEvent", DontDelete|Function, (intptr_t)jsMutationEventPrototypeFunctionInitMutationEvent, (intptr_t)8 },
+    { "MODIFICATION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMutationEventMODIFICATION), (intptr_t)0 },
+    { "ADDITION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMutationEventADDITION), (intptr_t)0 },
+    { "REMOVAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsMutationEventREMOVAL), (intptr_t)0 },
+    { "initMutationEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsMutationEventPrototypeFunctionInitMutationEvent), (intptr_t)8 },
     { 0, 0, 0, 0 }
 };
 
@@ -163,49 +163,54 @@ bool JSMutationEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSMutationEvent, Base>(exec, &JSMutationEventTable, this, propertyName, descriptor);
 }
 
-JSValue jsMutationEventRelatedNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventRelatedNode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMutationEvent* castedThis = static_cast<JSMutationEvent*>(asObject(slot.slotBase()));
+    JSMutationEvent* castedThis = static_cast<JSMutationEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MutationEvent* imp = static_cast<MutationEvent*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->relatedNode()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->relatedNode()));
+    return result;
 }
 
-JSValue jsMutationEventPrevValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventPrevValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMutationEvent* castedThis = static_cast<JSMutationEvent*>(asObject(slot.slotBase()));
+    JSMutationEvent* castedThis = static_cast<JSMutationEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MutationEvent* imp = static_cast<MutationEvent*>(castedThis->impl());
-    return jsString(exec, imp->prevValue());
+    JSValue result = jsString(exec, imp->prevValue());
+    return result;
 }
 
-JSValue jsMutationEventNewValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventNewValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMutationEvent* castedThis = static_cast<JSMutationEvent*>(asObject(slot.slotBase()));
+    JSMutationEvent* castedThis = static_cast<JSMutationEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MutationEvent* imp = static_cast<MutationEvent*>(castedThis->impl());
-    return jsString(exec, imp->newValue());
+    JSValue result = jsString(exec, imp->newValue());
+    return result;
 }
 
-JSValue jsMutationEventAttrName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventAttrName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMutationEvent* castedThis = static_cast<JSMutationEvent*>(asObject(slot.slotBase()));
+    JSMutationEvent* castedThis = static_cast<JSMutationEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MutationEvent* imp = static_cast<MutationEvent*>(castedThis->impl());
-    return jsString(exec, imp->attrName());
+    JSValue result = jsString(exec, imp->attrName());
+    return result;
 }
 
-JSValue jsMutationEventAttrChange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventAttrChange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMutationEvent* castedThis = static_cast<JSMutationEvent*>(asObject(slot.slotBase()));
+    JSMutationEvent* castedThis = static_cast<JSMutationEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     MutationEvent* imp = static_cast<MutationEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->attrChange());
+    JSValue result = jsNumber(exec, imp->attrChange());
+    return result;
 }
 
-JSValue jsMutationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSMutationEvent* domObject = static_cast<JSMutationEvent*>(asObject(slot.slotBase()));
+    JSMutationEvent* domObject = static_cast<JSMutationEvent*>(asObject(slotBase));
     return JSMutationEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSMutationEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -235,17 +240,17 @@ JSValue JSC_HOST_CALL jsMutationEventPrototypeFunctionInitMutationEvent(ExecStat
 
 // Constant getters
 
-JSValue jsMutationEventMODIFICATION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMutationEventMODIFICATION(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsMutationEventADDITION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMutationEventADDITION(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsMutationEventREMOVAL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMutationEventREMOVAL(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
index 2fbd82bc27..5d25a94db8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSMutationEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -70,17 +70,17 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsMutationEventPrototypeFunctionInitMutationEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsMutationEventRelatedNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMutationEventPrevValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMutationEventNewValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMutationEventAttrName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMutationEventAttrChange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMutationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventRelatedNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMutationEventPrevValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMutationEventNewValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMutationEventAttrName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMutationEventAttrChange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMutationEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsMutationEventMODIFICATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMutationEventADDITION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMutationEventREMOVAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventMODIFICATION(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMutationEventADDITION(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsMutationEventREMOVAL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
index e9c79a1e28..7aed66cca3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
@@ -40,8 +40,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSNamedNodeMap);
 
 static const HashTableValue JSNamedNodeMapTableValues[3] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsNamedNodeMapLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsNamedNodeMapConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNamedNodeMapLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNamedNodeMapConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -103,13 +103,13 @@ bool JSNamedNodeMapConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSNamedNodeMapPrototypeTableValues[8] =
 {
-    { "getNamedItem", DontDelete|Function, (intptr_t)jsNamedNodeMapPrototypeFunctionGetNamedItem, (intptr_t)1 },
-    { "setNamedItem", DontDelete|Function, (intptr_t)jsNamedNodeMapPrototypeFunctionSetNamedItem, (intptr_t)1 },
-    { "removeNamedItem", DontDelete|Function, (intptr_t)jsNamedNodeMapPrototypeFunctionRemoveNamedItem, (intptr_t)1 },
-    { "item", DontDelete|Function, (intptr_t)jsNamedNodeMapPrototypeFunctionItem, (intptr_t)1 },
-    { "getNamedItemNS", DontDelete|Function, (intptr_t)jsNamedNodeMapPrototypeFunctionGetNamedItemNS, (intptr_t)2 },
-    { "setNamedItemNS", DontDelete|Function, (intptr_t)jsNamedNodeMapPrototypeFunctionSetNamedItemNS, (intptr_t)1 },
-    { "removeNamedItemNS", DontDelete|Function, (intptr_t)jsNamedNodeMapPrototypeFunctionRemoveNamedItemNS, (intptr_t)2 },
+    { "getNamedItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNamedNodeMapPrototypeFunctionGetNamedItem), (intptr_t)1 },
+    { "setNamedItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNamedNodeMapPrototypeFunctionSetNamedItem), (intptr_t)1 },
+    { "removeNamedItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNamedNodeMapPrototypeFunctionRemoveNamedItem), (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNamedNodeMapPrototypeFunctionItem), (intptr_t)1 },
+    { "getNamedItemNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNamedNodeMapPrototypeFunctionGetNamedItemNS), (intptr_t)2 },
+    { "setNamedItemNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNamedNodeMapPrototypeFunctionSetNamedItemNS), (intptr_t)1 },
+    { "removeNamedItemNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNamedNodeMapPrototypeFunctionRemoveNamedItemNS), (intptr_t)2 },
     { 0, 0, 0, 0 }
 };
 
@@ -218,24 +218,25 @@ bool JSNamedNodeMap::getOwnPropertySlot(ExecState* exec, unsigned propertyName,
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsNamedNodeMapLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNamedNodeMapLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNamedNodeMap* castedThis = static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()));
+    JSNamedNodeMap* castedThis = static_cast<JSNamedNodeMap*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsNamedNodeMapConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNamedNodeMapConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNamedNodeMap* domObject = static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()));
+    JSNamedNodeMap* domObject = static_cast<JSNamedNodeMap*>(asObject(slotBase));
     return JSNamedNodeMap::getConstructor(exec, domObject->globalObject());
 }
-void JSNamedNodeMap::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSNamedNodeMap::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<NamedNodeMap*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSNamedNodeMap::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -352,10 +353,10 @@ JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionRemoveNamedItemNS(ExecState
 }
 
 
-JSValue JSNamedNodeMap::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSNamedNodeMap::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSNamedNodeMap* thisObj = static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<NamedNodeMap*>(thisObj->impl())->item(slot.index()));
+    JSNamedNodeMap* thisObj = static_cast<JSNamedNodeMap*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<NamedNodeMap*>(thisObj->impl())->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, NamedNodeMap* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
index 305877b71c..0fa1fdf0eb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
@@ -21,7 +21,6 @@
 #ifndef JSNamedNodeMap_h
 #define JSNamedNodeMap_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,12 +43,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     NamedNodeMap* impl() const { return m_impl.get(); }
 
@@ -57,10 +56,10 @@ private:
     RefPtr<NamedNodeMap> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 private:
     static bool canGetItemsForName(JSC::ExecState*, NamedNodeMap*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, NamedNodeMap*);
@@ -76,7 +75,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSNamedNodeMapPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -94,8 +93,8 @@ JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionSetNamedItemNS(JSC::Ex
 JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionRemoveNamedItemNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsNamedNodeMapLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNamedNodeMapConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNamedNodeMapLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNamedNodeMapConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp b/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
index 1c8e190b27..6a4fe416ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
@@ -41,20 +41,20 @@ ASSERT_CLASS_FITS_IN_CELL(JSNavigator);
 
 static const HashTableValue JSNavigatorTableValues[15] =
 {
-    { "appCodeName", DontDelete|ReadOnly, (intptr_t)jsNavigatorAppCodeName, (intptr_t)0 },
-    { "appName", DontDelete|ReadOnly, (intptr_t)jsNavigatorAppName, (intptr_t)0 },
-    { "appVersion", DontDelete|ReadOnly, (intptr_t)jsNavigatorAppVersion, (intptr_t)0 },
-    { "language", DontDelete|ReadOnly, (intptr_t)jsNavigatorLanguage, (intptr_t)0 },
-    { "userAgent", DontDelete|ReadOnly, (intptr_t)jsNavigatorUserAgent, (intptr_t)0 },
-    { "platform", DontDelete|ReadOnly, (intptr_t)jsNavigatorPlatform, (intptr_t)0 },
-    { "plugins", DontDelete|ReadOnly, (intptr_t)jsNavigatorPlugins, (intptr_t)0 },
-    { "mimeTypes", DontDelete|ReadOnly, (intptr_t)jsNavigatorMimeTypes, (intptr_t)0 },
-    { "product", DontDelete|ReadOnly, (intptr_t)jsNavigatorProduct, (intptr_t)0 },
-    { "productSub", DontDelete|ReadOnly, (intptr_t)jsNavigatorProductSub, (intptr_t)0 },
-    { "vendor", DontDelete|ReadOnly, (intptr_t)jsNavigatorVendor, (intptr_t)0 },
-    { "vendorSub", DontDelete|ReadOnly, (intptr_t)jsNavigatorVendorSub, (intptr_t)0 },
-    { "cookieEnabled", DontDelete|ReadOnly, (intptr_t)jsNavigatorCookieEnabled, (intptr_t)0 },
-    { "onLine", DontDelete|ReadOnly, (intptr_t)jsNavigatorOnLine, (intptr_t)0 },
+    { "appCodeName", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorAppCodeName), (intptr_t)0 },
+    { "appName", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorAppName), (intptr_t)0 },
+    { "appVersion", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorAppVersion), (intptr_t)0 },
+    { "language", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorLanguage), (intptr_t)0 },
+    { "userAgent", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorUserAgent), (intptr_t)0 },
+    { "platform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorPlatform), (intptr_t)0 },
+    { "plugins", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorPlugins), (intptr_t)0 },
+    { "mimeTypes", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorMimeTypes), (intptr_t)0 },
+    { "product", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorProduct), (intptr_t)0 },
+    { "productSub", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorProductSub), (intptr_t)0 },
+    { "vendor", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorVendor), (intptr_t)0 },
+    { "vendorSub", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorVendorSub), (intptr_t)0 },
+    { "cookieEnabled", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorCookieEnabled), (intptr_t)0 },
+    { "onLine", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorOnLine), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -67,18 +67,20 @@ static JSC_CONST_HASHTABLE HashTable JSNavigatorTable =
 
 /* Hash table for prototype */
 
-static const HashTableValue JSNavigatorPrototypeTableValues[3] =
+static const HashTableValue JSNavigatorPrototypeTableValues[5] =
 {
-    { "javaEnabled", DontDelete|Function, (intptr_t)jsNavigatorPrototypeFunctionJavaEnabled, (intptr_t)0 },
-    { "getStorageUpdates", DontDelete|Function, (intptr_t)jsNavigatorPrototypeFunctionGetStorageUpdates, (intptr_t)0 },
+    { "javaEnabled", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNavigatorPrototypeFunctionJavaEnabled), (intptr_t)0 },
+    { "getStorageUpdates", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNavigatorPrototypeFunctionGetStorageUpdates), (intptr_t)0 },
+    { "registerProtocolHandler", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNavigatorPrototypeFunctionRegisterProtocolHandler), (intptr_t)3 },
+    { "registerContentHandler", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNavigatorPrototypeFunctionRegisterContentHandler), (intptr_t)3 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSNavigatorPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSNavigatorPrototypeTableValues, 0 };
+    { 31, JSNavigatorPrototypeTableValues, 0 };
 #else
-    { 4, 3, JSNavigatorPrototypeTableValues, 0 };
+    { 9, 7, JSNavigatorPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSNavigatorPrototype::s_info = { "NavigatorPrototype", 0, &JSNavigatorPrototypeTable, 0 };
@@ -126,116 +128,130 @@ bool JSNavigator::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
     return getStaticValueDescriptor<JSNavigator, Base>(exec, &JSNavigatorTable, this, propertyName, descriptor);
 }
 
-JSValue jsNavigatorAppCodeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorAppCodeName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slot.slotBase()));
+    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(castedThis->impl());
-    return jsString(exec, imp->appCodeName());
+    JSValue result = jsString(exec, imp->appCodeName());
+    return result;
 }
 
-JSValue jsNavigatorAppName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorAppName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slot.slotBase()));
+    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(castedThis->impl());
-    return jsString(exec, imp->appName());
+    JSValue result = jsString(exec, imp->appName());
+    return result;
 }
 
-JSValue jsNavigatorAppVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorAppVersion(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slot.slotBase()));
+    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(castedThis->impl());
-    return jsString(exec, imp->appVersion());
+    JSValue result = jsString(exec, imp->appVersion());
+    return result;
 }
 
-JSValue jsNavigatorLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slot.slotBase()));
+    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(castedThis->impl());
-    return jsString(exec, imp->language());
+    JSValue result = jsString(exec, imp->language());
+    return result;
 }
 
-JSValue jsNavigatorUserAgent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorUserAgent(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slot.slotBase()));
+    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(castedThis->impl());
-    return jsString(exec, imp->userAgent());
+    JSValue result = jsString(exec, imp->userAgent());
+    return result;
 }
 
-JSValue jsNavigatorPlatform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorPlatform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slot.slotBase()));
+    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(castedThis->impl());
-    return jsString(exec, imp->platform());
+    JSValue result = jsString(exec, imp->platform());
+    return result;
 }
 
-JSValue jsNavigatorPlugins(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorPlugins(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slot.slotBase()));
+    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->plugins()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->plugins()));
+    return result;
 }
 
-JSValue jsNavigatorMimeTypes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorMimeTypes(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slot.slotBase()));
+    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->mimeTypes()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->mimeTypes()));
+    return result;
 }
 
-JSValue jsNavigatorProduct(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorProduct(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slot.slotBase()));
+    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(castedThis->impl());
-    return jsString(exec, imp->product());
+    JSValue result = jsString(exec, imp->product());
+    return result;
 }
 
-JSValue jsNavigatorProductSub(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorProductSub(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slot.slotBase()));
+    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(castedThis->impl());
-    return jsString(exec, imp->productSub());
+    JSValue result = jsString(exec, imp->productSub());
+    return result;
 }
 
-JSValue jsNavigatorVendor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorVendor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slot.slotBase()));
+    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(castedThis->impl());
-    return jsString(exec, imp->vendor());
+    JSValue result = jsString(exec, imp->vendor());
+    return result;
 }
 
-JSValue jsNavigatorVendorSub(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorVendorSub(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slot.slotBase()));
+    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(castedThis->impl());
-    return jsString(exec, imp->vendorSub());
+    JSValue result = jsString(exec, imp->vendorSub());
+    return result;
 }
 
-JSValue jsNavigatorCookieEnabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorCookieEnabled(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slot.slotBase()));
+    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(castedThis->impl());
-    return jsBoolean(imp->cookieEnabled());
+    JSValue result = jsBoolean(imp->cookieEnabled());
+    return result;
 }
 
-JSValue jsNavigatorOnLine(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorOnLine(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slot.slotBase()));
+    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(castedThis->impl());
-    return jsBoolean(imp->onLine());
+    JSValue result = jsBoolean(imp->onLine());
+    return result;
 }
 
 JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionJavaEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -263,6 +279,40 @@ JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionGetStorageUpdates(ExecState* e
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionRegisterProtocolHandler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSNavigator::s_info))
+        return throwError(exec, TypeError);
+    JSNavigator* castedThisObj = static_cast<JSNavigator*>(asObject(thisValue));
+    Navigator* imp = static_cast<Navigator*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    const UString& scheme = args.at(0).toString(exec);
+    const UString& url = args.at(1).toString(exec);
+    const UString& title = args.at(2).toString(exec);
+
+    imp->registerProtocolHandler(scheme, url, title, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionRegisterContentHandler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSNavigator::s_info))
+        return throwError(exec, TypeError);
+    JSNavigator* castedThisObj = static_cast<JSNavigator*>(asObject(thisValue));
+    Navigator* imp = static_cast<Navigator*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    const UString& mimeType = args.at(0).toString(exec);
+    const UString& url = args.at(1).toString(exec);
+    const UString& title = args.at(2).toString(exec);
+
+    imp->registerContentHandler(mimeType, url, title, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Navigator* object)
 {
     return getDOMObjectWrapper<JSNavigator>(exec, globalObject, object);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNavigator.h b/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
index 5847e96d1f..52fc05d1d9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
@@ -21,7 +21,6 @@
 #ifndef JSNavigator_h
 #define JSNavigator_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -69,7 +68,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSNavigatorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,22 +79,24 @@ protected:
 
 JSC::JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionJavaEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionGetStorageUpdates(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionRegisterProtocolHandler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionRegisterContentHandler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsNavigatorAppCodeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNavigatorAppName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNavigatorAppVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNavigatorLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNavigatorUserAgent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNavigatorPlatform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNavigatorPlugins(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNavigatorMimeTypes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNavigatorProduct(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNavigatorProductSub(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNavigatorVendor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNavigatorVendorSub(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNavigatorCookieEnabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNavigatorOnLine(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorAppCodeName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNavigatorAppName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNavigatorAppVersion(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNavigatorLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNavigatorUserAgent(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNavigatorPlatform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNavigatorPlugins(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNavigatorMimeTypes(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNavigatorProduct(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNavigatorProductSub(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNavigatorVendor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNavigatorVendorSub(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNavigatorCookieEnabled(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNavigatorOnLine(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
index e3a20067a9..47dafd44d6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
@@ -50,24 +50,24 @@ ASSERT_CLASS_FITS_IN_CELL(JSNode);
 
 static const HashTableValue JSNodeTableValues[19] =
 {
-    { "nodeName", DontDelete|ReadOnly, (intptr_t)jsNodeNodeName, (intptr_t)0 },
-    { "nodeValue", DontDelete, (intptr_t)jsNodeNodeValue, (intptr_t)setJSNodeNodeValue },
-    { "nodeType", DontDelete|ReadOnly, (intptr_t)jsNodeNodeType, (intptr_t)0 },
-    { "parentNode", DontDelete|ReadOnly, (intptr_t)jsNodeParentNode, (intptr_t)0 },
-    { "childNodes", DontDelete|ReadOnly, (intptr_t)jsNodeChildNodes, (intptr_t)0 },
-    { "firstChild", DontDelete|ReadOnly, (intptr_t)jsNodeFirstChild, (intptr_t)0 },
-    { "lastChild", DontDelete|ReadOnly, (intptr_t)jsNodeLastChild, (intptr_t)0 },
-    { "previousSibling", DontDelete|ReadOnly, (intptr_t)jsNodePreviousSibling, (intptr_t)0 },
-    { "nextSibling", DontDelete|ReadOnly, (intptr_t)jsNodeNextSibling, (intptr_t)0 },
-    { "attributes", DontDelete|ReadOnly, (intptr_t)jsNodeAttributes, (intptr_t)0 },
-    { "ownerDocument", DontDelete|ReadOnly, (intptr_t)jsNodeOwnerDocument, (intptr_t)0 },
-    { "namespaceURI", DontDelete|ReadOnly, (intptr_t)jsNodeNamespaceURI, (intptr_t)0 },
-    { "prefix", DontDelete, (intptr_t)jsNodePrefix, (intptr_t)setJSNodePrefix },
-    { "localName", DontDelete|ReadOnly, (intptr_t)jsNodeLocalName, (intptr_t)0 },
-    { "baseURI", DontDelete|ReadOnly, (intptr_t)jsNodeBaseURI, (intptr_t)0 },
-    { "textContent", DontDelete, (intptr_t)jsNodeTextContent, (intptr_t)setJSNodeTextContent },
-    { "parentElement", DontDelete|ReadOnly, (intptr_t)jsNodeParentElement, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsNodeConstructor, (intptr_t)0 },
+    { "nodeName", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeNodeName), (intptr_t)0 },
+    { "nodeValue", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeNodeValue), (intptr_t)setJSNodeNodeValue },
+    { "nodeType", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeNodeType), (intptr_t)0 },
+    { "parentNode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeParentNode), (intptr_t)0 },
+    { "childNodes", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeChildNodes), (intptr_t)0 },
+    { "firstChild", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFirstChild), (intptr_t)0 },
+    { "lastChild", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeLastChild), (intptr_t)0 },
+    { "previousSibling", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodePreviousSibling), (intptr_t)0 },
+    { "nextSibling", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeNextSibling), (intptr_t)0 },
+    { "attributes", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeAttributes), (intptr_t)0 },
+    { "ownerDocument", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeOwnerDocument), (intptr_t)0 },
+    { "namespaceURI", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeNamespaceURI), (intptr_t)0 },
+    { "prefix", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodePrefix), (intptr_t)setJSNodePrefix },
+    { "localName", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeLocalName), (intptr_t)0 },
+    { "baseURI", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeBaseURI), (intptr_t)0 },
+    { "textContent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeTextContent), (intptr_t)setJSNodeTextContent },
+    { "parentElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeParentElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -82,24 +82,24 @@ static JSC_CONST_HASHTABLE HashTable JSNodeTable =
 
 static const HashTableValue JSNodeConstructorTableValues[19] =
 {
-    { "ELEMENT_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeELEMENT_NODE, (intptr_t)0 },
-    { "ATTRIBUTE_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeATTRIBUTE_NODE, (intptr_t)0 },
-    { "TEXT_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeTEXT_NODE, (intptr_t)0 },
-    { "CDATA_SECTION_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeCDATA_SECTION_NODE, (intptr_t)0 },
-    { "ENTITY_REFERENCE_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeENTITY_REFERENCE_NODE, (intptr_t)0 },
-    { "ENTITY_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeENTITY_NODE, (intptr_t)0 },
-    { "PROCESSING_INSTRUCTION_NODE", DontDelete|ReadOnly, (intptr_t)jsNodePROCESSING_INSTRUCTION_NODE, (intptr_t)0 },
-    { "COMMENT_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeCOMMENT_NODE, (intptr_t)0 },
-    { "DOCUMENT_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_NODE, (intptr_t)0 },
-    { "DOCUMENT_TYPE_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_TYPE_NODE, (intptr_t)0 },
-    { "DOCUMENT_FRAGMENT_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_FRAGMENT_NODE, (intptr_t)0 },
-    { "NOTATION_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeNOTATION_NODE, (intptr_t)0 },
-    { "DOCUMENT_POSITION_DISCONNECTED", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_POSITION_DISCONNECTED, (intptr_t)0 },
-    { "DOCUMENT_POSITION_PRECEDING", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_POSITION_PRECEDING, (intptr_t)0 },
-    { "DOCUMENT_POSITION_FOLLOWING", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_POSITION_FOLLOWING, (intptr_t)0 },
-    { "DOCUMENT_POSITION_CONTAINS", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_POSITION_CONTAINS, (intptr_t)0 },
-    { "DOCUMENT_POSITION_CONTAINED_BY", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_POSITION_CONTAINED_BY, (intptr_t)0 },
-    { "DOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC, (intptr_t)0 },
+    { "ELEMENT_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeELEMENT_NODE), (intptr_t)0 },
+    { "ATTRIBUTE_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeATTRIBUTE_NODE), (intptr_t)0 },
+    { "TEXT_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeTEXT_NODE), (intptr_t)0 },
+    { "CDATA_SECTION_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeCDATA_SECTION_NODE), (intptr_t)0 },
+    { "ENTITY_REFERENCE_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeENTITY_REFERENCE_NODE), (intptr_t)0 },
+    { "ENTITY_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeENTITY_NODE), (intptr_t)0 },
+    { "PROCESSING_INSTRUCTION_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodePROCESSING_INSTRUCTION_NODE), (intptr_t)0 },
+    { "COMMENT_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeCOMMENT_NODE), (intptr_t)0 },
+    { "DOCUMENT_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_NODE), (intptr_t)0 },
+    { "DOCUMENT_TYPE_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_TYPE_NODE), (intptr_t)0 },
+    { "DOCUMENT_FRAGMENT_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_FRAGMENT_NODE), (intptr_t)0 },
+    { "NOTATION_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeNOTATION_NODE), (intptr_t)0 },
+    { "DOCUMENT_POSITION_DISCONNECTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_POSITION_DISCONNECTED), (intptr_t)0 },
+    { "DOCUMENT_POSITION_PRECEDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_POSITION_PRECEDING), (intptr_t)0 },
+    { "DOCUMENT_POSITION_FOLLOWING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_POSITION_FOLLOWING), (intptr_t)0 },
+    { "DOCUMENT_POSITION_CONTAINS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_POSITION_CONTAINS), (intptr_t)0 },
+    { "DOCUMENT_POSITION_CONTAINED_BY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_POSITION_CONTAINED_BY), (intptr_t)0 },
+    { "DOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -124,7 +124,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -147,42 +147,42 @@ bool JSNodeConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifi
 
 static const HashTableValue JSNodePrototypeTableValues[37] =
 {
-    { "ELEMENT_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeELEMENT_NODE, (intptr_t)0 },
-    { "ATTRIBUTE_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeATTRIBUTE_NODE, (intptr_t)0 },
-    { "TEXT_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeTEXT_NODE, (intptr_t)0 },
-    { "CDATA_SECTION_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeCDATA_SECTION_NODE, (intptr_t)0 },
-    { "ENTITY_REFERENCE_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeENTITY_REFERENCE_NODE, (intptr_t)0 },
-    { "ENTITY_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeENTITY_NODE, (intptr_t)0 },
-    { "PROCESSING_INSTRUCTION_NODE", DontDelete|ReadOnly, (intptr_t)jsNodePROCESSING_INSTRUCTION_NODE, (intptr_t)0 },
-    { "COMMENT_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeCOMMENT_NODE, (intptr_t)0 },
-    { "DOCUMENT_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_NODE, (intptr_t)0 },
-    { "DOCUMENT_TYPE_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_TYPE_NODE, (intptr_t)0 },
-    { "DOCUMENT_FRAGMENT_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_FRAGMENT_NODE, (intptr_t)0 },
-    { "NOTATION_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeNOTATION_NODE, (intptr_t)0 },
-    { "DOCUMENT_POSITION_DISCONNECTED", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_POSITION_DISCONNECTED, (intptr_t)0 },
-    { "DOCUMENT_POSITION_PRECEDING", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_POSITION_PRECEDING, (intptr_t)0 },
-    { "DOCUMENT_POSITION_FOLLOWING", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_POSITION_FOLLOWING, (intptr_t)0 },
-    { "DOCUMENT_POSITION_CONTAINS", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_POSITION_CONTAINS, (intptr_t)0 },
-    { "DOCUMENT_POSITION_CONTAINED_BY", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_POSITION_CONTAINED_BY, (intptr_t)0 },
-    { "DOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC", DontDelete|ReadOnly, (intptr_t)jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC, (intptr_t)0 },
-    { "insertBefore", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionInsertBefore, (intptr_t)2 },
-    { "replaceChild", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionReplaceChild, (intptr_t)2 },
-    { "removeChild", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionRemoveChild, (intptr_t)1 },
-    { "appendChild", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionAppendChild, (intptr_t)1 },
-    { "hasChildNodes", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionHasChildNodes, (intptr_t)0 },
-    { "cloneNode", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionCloneNode, (intptr_t)1 },
-    { "normalize", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionNormalize, (intptr_t)0 },
-    { "isSupported", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionIsSupported, (intptr_t)2 },
-    { "hasAttributes", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionHasAttributes, (intptr_t)0 },
-    { "isSameNode", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionIsSameNode, (intptr_t)1 },
-    { "isEqualNode", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionIsEqualNode, (intptr_t)1 },
-    { "lookupPrefix", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionLookupPrefix, (intptr_t)1 },
-    { "isDefaultNamespace", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionIsDefaultNamespace, (intptr_t)1 },
-    { "lookupNamespaceURI", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionLookupNamespaceURI, (intptr_t)1 },
-    { "compareDocumentPosition", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionCompareDocumentPosition, (intptr_t)1 },
-    { "addEventListener", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { "ELEMENT_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeELEMENT_NODE), (intptr_t)0 },
+    { "ATTRIBUTE_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeATTRIBUTE_NODE), (intptr_t)0 },
+    { "TEXT_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeTEXT_NODE), (intptr_t)0 },
+    { "CDATA_SECTION_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeCDATA_SECTION_NODE), (intptr_t)0 },
+    { "ENTITY_REFERENCE_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeENTITY_REFERENCE_NODE), (intptr_t)0 },
+    { "ENTITY_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeENTITY_NODE), (intptr_t)0 },
+    { "PROCESSING_INSTRUCTION_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodePROCESSING_INSTRUCTION_NODE), (intptr_t)0 },
+    { "COMMENT_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeCOMMENT_NODE), (intptr_t)0 },
+    { "DOCUMENT_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_NODE), (intptr_t)0 },
+    { "DOCUMENT_TYPE_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_TYPE_NODE), (intptr_t)0 },
+    { "DOCUMENT_FRAGMENT_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_FRAGMENT_NODE), (intptr_t)0 },
+    { "NOTATION_NODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeNOTATION_NODE), (intptr_t)0 },
+    { "DOCUMENT_POSITION_DISCONNECTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_POSITION_DISCONNECTED), (intptr_t)0 },
+    { "DOCUMENT_POSITION_PRECEDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_POSITION_PRECEDING), (intptr_t)0 },
+    { "DOCUMENT_POSITION_FOLLOWING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_POSITION_FOLLOWING), (intptr_t)0 },
+    { "DOCUMENT_POSITION_CONTAINS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_POSITION_CONTAINS), (intptr_t)0 },
+    { "DOCUMENT_POSITION_CONTAINED_BY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_POSITION_CONTAINED_BY), (intptr_t)0 },
+    { "DOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC), (intptr_t)0 },
+    { "insertBefore", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionInsertBefore), (intptr_t)2 },
+    { "replaceChild", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionReplaceChild), (intptr_t)2 },
+    { "removeChild", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionRemoveChild), (intptr_t)1 },
+    { "appendChild", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionAppendChild), (intptr_t)1 },
+    { "hasChildNodes", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionHasChildNodes), (intptr_t)0 },
+    { "cloneNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionCloneNode), (intptr_t)1 },
+    { "normalize", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionNormalize), (intptr_t)0 },
+    { "isSupported", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionIsSupported), (intptr_t)2 },
+    { "hasAttributes", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionHasAttributes), (intptr_t)0 },
+    { "isSameNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionIsSameNode), (intptr_t)1 },
+    { "isEqualNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionIsEqualNode), (intptr_t)1 },
+    { "lookupPrefix", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionLookupPrefix), (intptr_t)1 },
+    { "isDefaultNamespace", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionIsDefaultNamespace), (intptr_t)1 },
+    { "lookupNamespaceURI", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionLookupNamespaceURI), (intptr_t)1 },
+    { "compareDocumentPosition", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionCompareDocumentPosition), (intptr_t)1 },
+    { "addEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionAddEventListener), (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionRemoveEventListener), (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodePrototypeFunctionDispatchEvent), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -220,7 +220,7 @@ JSNode::JSNode(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* global
 
 JSNode::~JSNode()
 {
-    impl()->invalidateEventListeners();
+    impl()->invalidateJSEventListeners(this);
     forgetDOMNode(this, impl(), impl()->document());
 }
 
@@ -229,145 +229,162 @@ JSObject* JSNode::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
     return new (exec) JSNodePrototype(JSNodePrototype::createStructure(globalObject->objectPrototype()));
 }
 
-JSValue jsNodeNodeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeNodeName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->nodeName());
+    JSValue result = jsStringOrNull(exec, imp->nodeName());
+    return result;
 }
 
-JSValue jsNodeNodeValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeNodeValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->nodeValue());
+    JSValue result = jsStringOrNull(exec, imp->nodeValue());
+    return result;
 }
 
-JSValue jsNodeNodeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeNodeType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return jsNumber(exec, imp->nodeType());
+    JSValue result = jsNumber(exec, imp->nodeType());
+    return result;
 }
 
-JSValue jsNodeParentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeParentNode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentNode()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentNode()));
+    return result;
 }
 
-JSValue jsNodeChildNodes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeChildNodes(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->childNodes()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->childNodes()));
+    return result;
 }
 
-JSValue jsNodeFirstChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeFirstChild(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->firstChild()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->firstChild()));
+    return result;
 }
 
-JSValue jsNodeLastChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeLastChild(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->lastChild()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->lastChild()));
+    return result;
 }
 
-JSValue jsNodePreviousSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodePreviousSibling(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->previousSibling()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->previousSibling()));
+    return result;
 }
 
-JSValue jsNodeNextSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeNextSibling(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nextSibling()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nextSibling()));
+    return result;
 }
 
-JSValue jsNodeAttributes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeAttributes(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->attributes()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->attributes()));
+    return result;
 }
 
-JSValue jsNodeOwnerDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeOwnerDocument(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->ownerDocument()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->ownerDocument()));
+    return result;
 }
 
-JSValue jsNodeNamespaceURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeNamespaceURI(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->namespaceURI());
+    JSValue result = jsStringOrNull(exec, imp->namespaceURI());
+    return result;
 }
 
-JSValue jsNodePrefix(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodePrefix(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->prefix());
+    JSValue result = jsStringOrNull(exec, imp->prefix());
+    return result;
 }
 
-JSValue jsNodeLocalName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeLocalName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->localName());
+    JSValue result = jsStringOrNull(exec, imp->localName());
+    return result;
 }
 
-JSValue jsNodeBaseURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeBaseURI(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->baseURI());
+    JSValue result = jsStringOrNull(exec, imp->baseURI());
+    return result;
 }
 
-JSValue jsNodeTextContent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeTextContent(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->textContent());
+    JSValue result = jsStringOrNull(exec, imp->textContent());
+    return result;
 }
 
-JSValue jsNodeParentElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeParentElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* castedThis = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* castedThis = static_cast<JSNode*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentElement()));
+    return result;
 }
 
-JSValue jsNodeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNode* domObject = static_cast<JSNode*>(asObject(slot.slotBase()));
+    JSNode* domObject = static_cast<JSNode*>(asObject(slotBase));
     return JSNode::getConstructor(exec, domObject->globalObject());
 }
 void JSNode::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -377,7 +394,8 @@ void JSNode::put(ExecState* exec, const Identifier& propertyName, JSValue value,
 
 void setJSNodeNodeValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSNode* castedThisObj = static_cast<JSNode*>(thisObject);
+    Node* imp = static_cast<Node*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setNodeValue(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -385,7 +403,8 @@ void setJSNodeNodeValue(ExecState* exec, JSObject* thisObject, JSValue value)
 
 void setJSNodePrefix(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSNode* castedThisObj = static_cast<JSNode*>(thisObject);
+    Node* imp = static_cast<Node*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setPrefix(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -393,7 +412,8 @@ void setJSNodePrefix(ExecState* exec, JSObject* thisObject, JSValue value)
 
 void setJSNodeTextContent(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSNode* castedThisObj = static_cast<JSNode*>(thisObject);
+    Node* imp = static_cast<Node*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setTextContent(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -627,92 +647,92 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionDispatchEvent(ExecState* exec, JSOb
 
 // Constant getters
 
-JSValue jsNodeELEMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeELEMENT_NODE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsNodeATTRIBUTE_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeATTRIBUTE_NODE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsNodeTEXT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeTEXT_NODE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsNodeCDATA_SECTION_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeCDATA_SECTION_NODE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsNodeENTITY_REFERENCE_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeENTITY_REFERENCE_NODE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValue jsNodeENTITY_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeENTITY_NODE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValue jsNodePROCESSING_INSTRUCTION_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodePROCESSING_INSTRUCTION_NODE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValue jsNodeCOMMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeCOMMENT_NODE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValue jsNodeDOCUMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_NODE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValue jsNodeDOCUMENT_TYPE_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_TYPE_NODE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValue jsNodeDOCUMENT_FRAGMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_FRAGMENT_NODE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
-JSValue jsNodeNOTATION_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeNOTATION_NODE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(12));
 }
 
-JSValue jsNodeDOCUMENT_POSITION_DISCONNECTED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_DISCONNECTED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x01));
 }
 
-JSValue jsNodeDOCUMENT_POSITION_PRECEDING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_PRECEDING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x02));
 }
 
-JSValue jsNodeDOCUMENT_POSITION_FOLLOWING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_FOLLOWING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x04));
 }
 
-JSValue jsNodeDOCUMENT_POSITION_CONTAINS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_CONTAINS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x08));
 }
 
-JSValue jsNodeDOCUMENT_POSITION_CONTAINED_BY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_CONTAINED_BY(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x10));
 }
 
-JSValue jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x20));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.h b/src/3rdparty/webkit/WebCore/generated/JSNode.h
index 0398122458..be6dd235dd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.h
@@ -21,7 +21,6 @@
 #ifndef JSNode_h
 #define JSNode_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/Lookup.h>
@@ -46,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -94,7 +93,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSNodePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -123,48 +122,49 @@ JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionRemoveEventListener(JSC::ExecS
 JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsNodeNodeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeNodeValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeNodeName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeNodeValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSNodeNodeValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsNodeNodeType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeParentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeChildNodes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFirstChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeLastChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodePreviousSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeNextSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeAttributes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeOwnerDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeNamespaceURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodePrefix(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeNodeType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeParentNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeChildNodes(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFirstChild(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeLastChild(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodePreviousSibling(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeNextSibling(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeAttributes(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeOwnerDocument(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeNamespaceURI(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodePrefix(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSNodePrefix(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsNodeLocalName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeBaseURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeTextContent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeLocalName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeBaseURI(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeTextContent(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSNodeTextContent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsNodeParentElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeParentElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsNodeELEMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeATTRIBUTE_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeTEXT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeCDATA_SECTION_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeENTITY_REFERENCE_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeENTITY_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodePROCESSING_INSTRUCTION_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeCOMMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeDOCUMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeDOCUMENT_TYPE_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeDOCUMENT_FRAGMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeNOTATION_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeDOCUMENT_POSITION_DISCONNECTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeDOCUMENT_POSITION_PRECEDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeDOCUMENT_POSITION_FOLLOWING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeDOCUMENT_POSITION_CONTAINS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeDOCUMENT_POSITION_CONTAINED_BY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeELEMENT_NODE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeATTRIBUTE_NODE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeTEXT_NODE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeCDATA_SECTION_NODE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeENTITY_REFERENCE_NODE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeENTITY_NODE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodePROCESSING_INSTRUCTION_NODE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeCOMMENT_NODE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeDOCUMENT_NODE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeDOCUMENT_TYPE_NODE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeDOCUMENT_FRAGMENT_NODE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeNOTATION_NODE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_DISCONNECTED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_PRECEDING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_FOLLOWING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_CONTAINS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_CONTAINED_BY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
 #endif
+#include "JSNodeCustom.h"
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
index 22726f68d0..59da9f8383 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
@@ -35,7 +35,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSNodeFilter);
 
 static const HashTableValue JSNodeFilterTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsNodeFilterConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -50,22 +50,22 @@ static JSC_CONST_HASHTABLE HashTable JSNodeFilterTable =
 
 static const HashTableValue JSNodeFilterConstructorTableValues[17] =
 {
-    { "FILTER_ACCEPT", DontDelete|ReadOnly, (intptr_t)jsNodeFilterFILTER_ACCEPT, (intptr_t)0 },
-    { "FILTER_REJECT", DontDelete|ReadOnly, (intptr_t)jsNodeFilterFILTER_REJECT, (intptr_t)0 },
-    { "FILTER_SKIP", DontDelete|ReadOnly, (intptr_t)jsNodeFilterFILTER_SKIP, (intptr_t)0 },
-    { "SHOW_ALL", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_ALL, (intptr_t)0 },
-    { "SHOW_ELEMENT", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_ELEMENT, (intptr_t)0 },
-    { "SHOW_ATTRIBUTE", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_ATTRIBUTE, (intptr_t)0 },
-    { "SHOW_TEXT", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_TEXT, (intptr_t)0 },
-    { "SHOW_CDATA_SECTION", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_CDATA_SECTION, (intptr_t)0 },
-    { "SHOW_ENTITY_REFERENCE", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_ENTITY_REFERENCE, (intptr_t)0 },
-    { "SHOW_ENTITY", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_ENTITY, (intptr_t)0 },
-    { "SHOW_PROCESSING_INSTRUCTION", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_PROCESSING_INSTRUCTION, (intptr_t)0 },
-    { "SHOW_COMMENT", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_COMMENT, (intptr_t)0 },
-    { "SHOW_DOCUMENT", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_DOCUMENT, (intptr_t)0 },
-    { "SHOW_DOCUMENT_TYPE", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_DOCUMENT_TYPE, (intptr_t)0 },
-    { "SHOW_DOCUMENT_FRAGMENT", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_DOCUMENT_FRAGMENT, (intptr_t)0 },
-    { "SHOW_NOTATION", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_NOTATION, (intptr_t)0 },
+    { "FILTER_ACCEPT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterFILTER_ACCEPT), (intptr_t)0 },
+    { "FILTER_REJECT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterFILTER_REJECT), (intptr_t)0 },
+    { "FILTER_SKIP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterFILTER_SKIP), (intptr_t)0 },
+    { "SHOW_ALL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_ALL), (intptr_t)0 },
+    { "SHOW_ELEMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_ELEMENT), (intptr_t)0 },
+    { "SHOW_ATTRIBUTE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_ATTRIBUTE), (intptr_t)0 },
+    { "SHOW_TEXT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_TEXT), (intptr_t)0 },
+    { "SHOW_CDATA_SECTION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_CDATA_SECTION), (intptr_t)0 },
+    { "SHOW_ENTITY_REFERENCE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_ENTITY_REFERENCE), (intptr_t)0 },
+    { "SHOW_ENTITY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_ENTITY), (intptr_t)0 },
+    { "SHOW_PROCESSING_INSTRUCTION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_PROCESSING_INSTRUCTION), (intptr_t)0 },
+    { "SHOW_COMMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_COMMENT), (intptr_t)0 },
+    { "SHOW_DOCUMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_DOCUMENT), (intptr_t)0 },
+    { "SHOW_DOCUMENT_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_DOCUMENT_TYPE), (intptr_t)0 },
+    { "SHOW_DOCUMENT_FRAGMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_DOCUMENT_FRAGMENT), (intptr_t)0 },
+    { "SHOW_NOTATION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_NOTATION), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -90,7 +90,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -113,23 +113,23 @@ bool JSNodeFilterConstructor::getOwnPropertyDescriptor(ExecState* exec, const Id
 
 static const HashTableValue JSNodeFilterPrototypeTableValues[18] =
 {
-    { "FILTER_ACCEPT", DontDelete|ReadOnly, (intptr_t)jsNodeFilterFILTER_ACCEPT, (intptr_t)0 },
-    { "FILTER_REJECT", DontDelete|ReadOnly, (intptr_t)jsNodeFilterFILTER_REJECT, (intptr_t)0 },
-    { "FILTER_SKIP", DontDelete|ReadOnly, (intptr_t)jsNodeFilterFILTER_SKIP, (intptr_t)0 },
-    { "SHOW_ALL", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_ALL, (intptr_t)0 },
-    { "SHOW_ELEMENT", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_ELEMENT, (intptr_t)0 },
-    { "SHOW_ATTRIBUTE", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_ATTRIBUTE, (intptr_t)0 },
-    { "SHOW_TEXT", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_TEXT, (intptr_t)0 },
-    { "SHOW_CDATA_SECTION", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_CDATA_SECTION, (intptr_t)0 },
-    { "SHOW_ENTITY_REFERENCE", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_ENTITY_REFERENCE, (intptr_t)0 },
-    { "SHOW_ENTITY", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_ENTITY, (intptr_t)0 },
-    { "SHOW_PROCESSING_INSTRUCTION", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_PROCESSING_INSTRUCTION, (intptr_t)0 },
-    { "SHOW_COMMENT", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_COMMENT, (intptr_t)0 },
-    { "SHOW_DOCUMENT", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_DOCUMENT, (intptr_t)0 },
-    { "SHOW_DOCUMENT_TYPE", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_DOCUMENT_TYPE, (intptr_t)0 },
-    { "SHOW_DOCUMENT_FRAGMENT", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_DOCUMENT_FRAGMENT, (intptr_t)0 },
-    { "SHOW_NOTATION", DontDelete|ReadOnly, (intptr_t)jsNodeFilterSHOW_NOTATION, (intptr_t)0 },
-    { "acceptNode", DontDelete|Function, (intptr_t)jsNodeFilterPrototypeFunctionAcceptNode, (intptr_t)1 },
+    { "FILTER_ACCEPT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterFILTER_ACCEPT), (intptr_t)0 },
+    { "FILTER_REJECT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterFILTER_REJECT), (intptr_t)0 },
+    { "FILTER_SKIP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterFILTER_SKIP), (intptr_t)0 },
+    { "SHOW_ALL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_ALL), (intptr_t)0 },
+    { "SHOW_ELEMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_ELEMENT), (intptr_t)0 },
+    { "SHOW_ATTRIBUTE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_ATTRIBUTE), (intptr_t)0 },
+    { "SHOW_TEXT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_TEXT), (intptr_t)0 },
+    { "SHOW_CDATA_SECTION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_CDATA_SECTION), (intptr_t)0 },
+    { "SHOW_ENTITY_REFERENCE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_ENTITY_REFERENCE), (intptr_t)0 },
+    { "SHOW_ENTITY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_ENTITY), (intptr_t)0 },
+    { "SHOW_PROCESSING_INSTRUCTION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_PROCESSING_INSTRUCTION), (intptr_t)0 },
+    { "SHOW_COMMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_COMMENT), (intptr_t)0 },
+    { "SHOW_DOCUMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_DOCUMENT), (intptr_t)0 },
+    { "SHOW_DOCUMENT_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_DOCUMENT_TYPE), (intptr_t)0 },
+    { "SHOW_DOCUMENT_FRAGMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_DOCUMENT_FRAGMENT), (intptr_t)0 },
+    { "SHOW_NOTATION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeFilterSHOW_NOTATION), (intptr_t)0 },
+    { "acceptNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodeFilterPrototypeFunctionAcceptNode), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -185,9 +185,9 @@ bool JSNodeFilter::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<JSNodeFilter, Base>(exec, &JSNodeFilterTable, this, propertyName, descriptor);
 }
 
-JSValue jsNodeFilterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeFilterConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNodeFilter* domObject = static_cast<JSNodeFilter*>(asObject(slot.slotBase()));
+    JSNodeFilter* domObject = static_cast<JSNodeFilter*>(asObject(slotBase));
     return JSNodeFilter::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSNodeFilter::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -206,82 +206,82 @@ JSValue JSC_HOST_CALL jsNodeFilterPrototypeFunctionAcceptNode(ExecState* exec, J
 
 // Constant getters
 
-JSValue jsNodeFilterFILTER_ACCEPT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterFILTER_ACCEPT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsNodeFilterFILTER_REJECT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterFILTER_REJECT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsNodeFilterFILTER_SKIP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterFILTER_SKIP(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsNodeFilterSHOW_ALL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_ALL(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0xFFFFFFFF));
 }
 
-JSValue jsNodeFilterSHOW_ELEMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_ELEMENT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x00000001));
 }
 
-JSValue jsNodeFilterSHOW_ATTRIBUTE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_ATTRIBUTE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x00000002));
 }
 
-JSValue jsNodeFilterSHOW_TEXT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_TEXT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x00000004));
 }
 
-JSValue jsNodeFilterSHOW_CDATA_SECTION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_CDATA_SECTION(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x00000008));
 }
 
-JSValue jsNodeFilterSHOW_ENTITY_REFERENCE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_ENTITY_REFERENCE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x00000010));
 }
 
-JSValue jsNodeFilterSHOW_ENTITY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_ENTITY(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x00000020));
 }
 
-JSValue jsNodeFilterSHOW_PROCESSING_INSTRUCTION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_PROCESSING_INSTRUCTION(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x00000040));
 }
 
-JSValue jsNodeFilterSHOW_COMMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_COMMENT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x00000080));
 }
 
-JSValue jsNodeFilterSHOW_DOCUMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_DOCUMENT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x00000100));
 }
 
-JSValue jsNodeFilterSHOW_DOCUMENT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_DOCUMENT_TYPE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x00000200));
 }
 
-JSValue jsNodeFilterSHOW_DOCUMENT_FRAGMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_DOCUMENT_FRAGMENT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x00000400));
 }
 
-JSValue jsNodeFilterSHOW_NOTATION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_NOTATION(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0x00000800));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
index c59011a0e0..a1548d1474 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
@@ -21,7 +21,6 @@
 #ifndef JSNodeFilter_h
 #define JSNodeFilter_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -73,7 +72,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSNodeFilterPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -85,25 +84,25 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsNodeFilterPrototypeFunctionAcceptNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsNodeFilterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsNodeFilterFILTER_ACCEPT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFilterFILTER_REJECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFilterFILTER_SKIP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFilterSHOW_ALL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFilterSHOW_ELEMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFilterSHOW_ATTRIBUTE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFilterSHOW_TEXT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFilterSHOW_CDATA_SECTION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFilterSHOW_ENTITY_REFERENCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFilterSHOW_ENTITY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFilterSHOW_PROCESSING_INSTRUCTION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFilterSHOW_COMMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFilterSHOW_DOCUMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFilterSHOW_DOCUMENT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFilterSHOW_DOCUMENT_FRAGMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeFilterSHOW_NOTATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterFILTER_ACCEPT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFilterFILTER_REJECT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFilterFILTER_SKIP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFilterSHOW_ALL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFilterSHOW_ELEMENT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFilterSHOW_ATTRIBUTE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFilterSHOW_TEXT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFilterSHOW_CDATA_SECTION(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFilterSHOW_ENTITY_REFERENCE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFilterSHOW_ENTITY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFilterSHOW_PROCESSING_INSTRUCTION(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFilterSHOW_COMMENT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFilterSHOW_DOCUMENT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFilterSHOW_DOCUMENT_TYPE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFilterSHOW_DOCUMENT_FRAGMENT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeFilterSHOW_NOTATION(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
index 8570d246fe..2ffc2b52cb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
@@ -40,13 +40,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSNodeIterator);
 
 static const HashTableValue JSNodeIteratorTableValues[8] =
 {
-    { "root", DontDelete|ReadOnly, (intptr_t)jsNodeIteratorRoot, (intptr_t)0 },
-    { "whatToShow", DontDelete|ReadOnly, (intptr_t)jsNodeIteratorWhatToShow, (intptr_t)0 },
-    { "filter", DontDelete|ReadOnly, (intptr_t)jsNodeIteratorFilter, (intptr_t)0 },
-    { "expandEntityReferences", DontDelete|ReadOnly, (intptr_t)jsNodeIteratorExpandEntityReferences, (intptr_t)0 },
-    { "referenceNode", DontDelete|ReadOnly, (intptr_t)jsNodeIteratorReferenceNode, (intptr_t)0 },
-    { "pointerBeforeReferenceNode", DontDelete|ReadOnly, (intptr_t)jsNodeIteratorPointerBeforeReferenceNode, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsNodeIteratorConstructor, (intptr_t)0 },
+    { "root", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeIteratorRoot), (intptr_t)0 },
+    { "whatToShow", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeIteratorWhatToShow), (intptr_t)0 },
+    { "filter", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeIteratorFilter), (intptr_t)0 },
+    { "expandEntityReferences", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeIteratorExpandEntityReferences), (intptr_t)0 },
+    { "referenceNode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeIteratorReferenceNode), (intptr_t)0 },
+    { "pointerBeforeReferenceNode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeIteratorPointerBeforeReferenceNode), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeIteratorConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -85,7 +85,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -108,9 +108,9 @@ bool JSNodeIteratorConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSNodeIteratorPrototypeTableValues[4] =
 {
-    { "nextNode", DontDelete|Function, (intptr_t)jsNodeIteratorPrototypeFunctionNextNode, (intptr_t)0 },
-    { "previousNode", DontDelete|Function, (intptr_t)jsNodeIteratorPrototypeFunctionPreviousNode, (intptr_t)0 },
-    { "detach", DontDelete|Function, (intptr_t)jsNodeIteratorPrototypeFunctionDetach, (intptr_t)0 },
+    { "nextNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodeIteratorPrototypeFunctionNextNode), (intptr_t)0 },
+    { "previousNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodeIteratorPrototypeFunctionPreviousNode), (intptr_t)0 },
+    { "detach", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodeIteratorPrototypeFunctionDetach), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -166,57 +166,63 @@ bool JSNodeIterator::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSNodeIterator, Base>(exec, &JSNodeIteratorTable, this, propertyName, descriptor);
 }
 
-JSValue jsNodeIteratorRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorRoot(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNodeIterator* castedThis = static_cast<JSNodeIterator*>(asObject(slot.slotBase()));
+    JSNodeIterator* castedThis = static_cast<JSNodeIterator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->root()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->root()));
+    return result;
 }
 
-JSValue jsNodeIteratorWhatToShow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorWhatToShow(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNodeIterator* castedThis = static_cast<JSNodeIterator*>(asObject(slot.slotBase()));
+    JSNodeIterator* castedThis = static_cast<JSNodeIterator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(castedThis->impl());
-    return jsNumber(exec, imp->whatToShow());
+    JSValue result = jsNumber(exec, imp->whatToShow());
+    return result;
 }
 
-JSValue jsNodeIteratorFilter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorFilter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNodeIterator* castedThis = static_cast<JSNodeIterator*>(asObject(slot.slotBase()));
+    JSNodeIterator* castedThis = static_cast<JSNodeIterator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->filter()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->filter()));
+    return result;
 }
 
-JSValue jsNodeIteratorExpandEntityReferences(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorExpandEntityReferences(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNodeIterator* castedThis = static_cast<JSNodeIterator*>(asObject(slot.slotBase()));
+    JSNodeIterator* castedThis = static_cast<JSNodeIterator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(castedThis->impl());
-    return jsBoolean(imp->expandEntityReferences());
+    JSValue result = jsBoolean(imp->expandEntityReferences());
+    return result;
 }
 
-JSValue jsNodeIteratorReferenceNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorReferenceNode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNodeIterator* castedThis = static_cast<JSNodeIterator*>(asObject(slot.slotBase()));
+    JSNodeIterator* castedThis = static_cast<JSNodeIterator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->referenceNode()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->referenceNode()));
+    return result;
 }
 
-JSValue jsNodeIteratorPointerBeforeReferenceNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorPointerBeforeReferenceNode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNodeIterator* castedThis = static_cast<JSNodeIterator*>(asObject(slot.slotBase()));
+    JSNodeIterator* castedThis = static_cast<JSNodeIterator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(castedThis->impl());
-    return jsBoolean(imp->pointerBeforeReferenceNode());
+    JSValue result = jsBoolean(imp->pointerBeforeReferenceNode());
+    return result;
 }
 
-JSValue jsNodeIteratorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNodeIterator* domObject = static_cast<JSNodeIterator*>(asObject(slot.slotBase()));
+    JSNodeIterator* domObject = static_cast<JSNodeIterator*>(asObject(slotBase));
     return JSNodeIterator::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSNodeIterator::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
index 64bf10f93e..67fc1c7ee8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
@@ -21,7 +21,6 @@
 #ifndef JSNodeIterator_h
 #define JSNodeIterator_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -74,7 +73,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSNodeIteratorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -88,13 +87,13 @@ JSC::JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionPreviousNode(JSC::Exec
 JSC::JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionDetach(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsNodeIteratorRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeIteratorWhatToShow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeIteratorFilter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeIteratorExpandEntityReferences(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeIteratorReferenceNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeIteratorPointerBeforeReferenceNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeIteratorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeIteratorRoot(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeIteratorWhatToShow(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeIteratorFilter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeIteratorExpandEntityReferences(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeIteratorReferenceNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeIteratorPointerBeforeReferenceNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeIteratorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
index 3f3131e24e..65bdae60a3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
@@ -41,8 +41,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSNodeList);
 
 static const HashTableValue JSNodeListTableValues[3] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsNodeListLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsNodeListConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeListLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNodeListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -104,7 +104,7 @@ bool JSNodeListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Iden
 
 static const HashTableValue JSNodeListPrototypeTableValues[2] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsNodeListPrototypeFunctionItem, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsNodeListPrototypeFunctionItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -205,24 +205,25 @@ bool JSNodeList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Prop
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsNodeListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeListLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNodeList* castedThis = static_cast<JSNodeList*>(asObject(slot.slotBase()));
+    JSNodeList* castedThis = static_cast<JSNodeList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     NodeList* imp = static_cast<NodeList*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsNodeListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNodeList* domObject = static_cast<JSNodeList*>(asObject(slot.slotBase()));
+    JSNodeList* domObject = static_cast<JSNodeList*>(asObject(slotBase));
     return JSNodeList::getConstructor(exec, domObject->globalObject());
 }
-void JSNodeList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSNodeList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<NodeList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSNodeList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -249,10 +250,10 @@ JSValue JSC_HOST_CALL jsNodeListPrototypeFunctionItem(ExecState* exec, JSObject*
 }
 
 
-JSValue JSNodeList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSNodeList::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSNodeList* thisObj = static_cast<JSNodeList*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<NodeList*>(thisObj->impl())->item(slot.index()));
+    JSNodeList* thisObj = static_cast<JSNodeList*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<NodeList*>(thisObj->impl())->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, NodeList* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeList.h b/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
index 76840f061f..ea14186f3d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
@@ -21,7 +21,6 @@
 #ifndef JSNodeList_h
 #define JSNodeList_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/CallData.h>
 #include <runtime/JSGlobalObject.h>
@@ -45,12 +44,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     NodeList* impl() const { return m_impl.get(); }
 
@@ -58,10 +57,10 @@ private:
     RefPtr<NodeList> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 private:
     static bool canGetItemsForName(JSC::ExecState*, NodeList*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, NodeList*);
@@ -77,7 +76,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSNodeListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -89,8 +88,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsNodeListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsNodeListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNodeListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeListLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNodeListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp b/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
index bf91e7cafc..296eb1ebfb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
@@ -35,9 +35,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSNotation);
 
 static const HashTableValue JSNotationTableValues[4] =
 {
-    { "publicId", DontDelete|ReadOnly, (intptr_t)jsNotationPublicId, (intptr_t)0 },
-    { "systemId", DontDelete|ReadOnly, (intptr_t)jsNotationSystemId, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsNotationConstructor, (intptr_t)0 },
+    { "publicId", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNotationPublicId), (intptr_t)0 },
+    { "systemId", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNotationSystemId), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNotationConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,7 +76,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -138,25 +138,27 @@ bool JSNotation::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     return getStaticValueDescriptor<JSNotation, Base>(exec, &JSNotationTable, this, propertyName, descriptor);
 }
 
-JSValue jsNotationPublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNotationPublicId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNotation* castedThis = static_cast<JSNotation*>(asObject(slot.slotBase()));
+    JSNotation* castedThis = static_cast<JSNotation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Notation* imp = static_cast<Notation*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->publicId());
+    JSValue result = jsStringOrNull(exec, imp->publicId());
+    return result;
 }
 
-JSValue jsNotationSystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNotationSystemId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNotation* castedThis = static_cast<JSNotation*>(asObject(slot.slotBase()));
+    JSNotation* castedThis = static_cast<JSNotation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Notation* imp = static_cast<Notation*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->systemId());
+    JSValue result = jsStringOrNull(exec, imp->systemId());
+    return result;
 }
 
-JSValue jsNotationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNotationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSNotation* domObject = static_cast<JSNotation*>(asObject(slot.slotBase()));
+    JSNotation* domObject = static_cast<JSNotation*>(asObject(slotBase));
     return JSNotation::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSNotation::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNotation.h b/src/3rdparty/webkit/WebCore/generated/JSNotation.h
index 79656a23f4..d3d9df4595 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNotation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNotation.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -56,7 +56,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSNotationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -65,9 +65,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsNotationPublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNotationSystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsNotationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNotationPublicId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNotationSystemId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsNotationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSONObject.lut.h b/src/3rdparty/webkit/WebCore/generated/JSONObject.lut.h
deleted file mode 100644
index ce685c273f..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSONObject.lut.h
+++ /dev/null
@@ -1,15 +0,0 @@
-// Automatically generated from ../../JavaScriptCore/runtime/JSONObject.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
-
-#include "Lookup.h"
-
-namespace JSC {
-
-static const struct HashTableValue jsonTableValues[3] = {
-   { "parse", DontEnum|Function, (intptr_t)JSONProtoFuncParse, (intptr_t)1 },
-   { "stringify", DontEnum|Function, (intptr_t)JSONProtoFuncStringify, (intptr_t)1 },
-   { 0, 0, 0, 0 }
-};
-
-extern JSC_CONST_HASHTABLE HashTable jsonTable =
-    { 4, 3, jsonTableValues, 0 };
-} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
index fdc3a64c8b..5f67dfd459 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
@@ -36,10 +36,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSOverflowEvent);
 
 static const HashTableValue JSOverflowEventTableValues[5] =
 {
-    { "orient", DontDelete|ReadOnly, (intptr_t)jsOverflowEventOrient, (intptr_t)0 },
-    { "horizontalOverflow", DontDelete|ReadOnly, (intptr_t)jsOverflowEventHorizontalOverflow, (intptr_t)0 },
-    { "verticalOverflow", DontDelete|ReadOnly, (intptr_t)jsOverflowEventVerticalOverflow, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsOverflowEventConstructor, (intptr_t)0 },
+    { "orient", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsOverflowEventOrient), (intptr_t)0 },
+    { "horizontalOverflow", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsOverflowEventHorizontalOverflow), (intptr_t)0 },
+    { "verticalOverflow", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsOverflowEventVerticalOverflow), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsOverflowEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -54,9 +54,9 @@ static JSC_CONST_HASHTABLE HashTable JSOverflowEventTable =
 
 static const HashTableValue JSOverflowEventConstructorTableValues[4] =
 {
-    { "HORIZONTAL", DontDelete|ReadOnly, (intptr_t)jsOverflowEventHORIZONTAL, (intptr_t)0 },
-    { "VERTICAL", DontDelete|ReadOnly, (intptr_t)jsOverflowEventVERTICAL, (intptr_t)0 },
-    { "BOTH", DontDelete|ReadOnly, (intptr_t)jsOverflowEventBOTH, (intptr_t)0 },
+    { "HORIZONTAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsOverflowEventHORIZONTAL), (intptr_t)0 },
+    { "VERTICAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsOverflowEventVERTICAL), (intptr_t)0 },
+    { "BOTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsOverflowEventBOTH), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -104,10 +104,10 @@ bool JSOverflowEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSOverflowEventPrototypeTableValues[5] =
 {
-    { "HORIZONTAL", DontDelete|ReadOnly, (intptr_t)jsOverflowEventHORIZONTAL, (intptr_t)0 },
-    { "VERTICAL", DontDelete|ReadOnly, (intptr_t)jsOverflowEventVERTICAL, (intptr_t)0 },
-    { "BOTH", DontDelete|ReadOnly, (intptr_t)jsOverflowEventBOTH, (intptr_t)0 },
-    { "initOverflowEvent", DontDelete|Function, (intptr_t)jsOverflowEventPrototypeFunctionInitOverflowEvent, (intptr_t)3 },
+    { "HORIZONTAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsOverflowEventHORIZONTAL), (intptr_t)0 },
+    { "VERTICAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsOverflowEventVERTICAL), (intptr_t)0 },
+    { "BOTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsOverflowEventBOTH), (intptr_t)0 },
+    { "initOverflowEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsOverflowEventPrototypeFunctionInitOverflowEvent), (intptr_t)3 },
     { 0, 0, 0, 0 }
 };
 
@@ -157,33 +157,36 @@ bool JSOverflowEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSOverflowEvent, Base>(exec, &JSOverflowEventTable, this, propertyName, descriptor);
 }
 
-JSValue jsOverflowEventOrient(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsOverflowEventOrient(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSOverflowEvent* castedThis = static_cast<JSOverflowEvent*>(asObject(slot.slotBase()));
+    JSOverflowEvent* castedThis = static_cast<JSOverflowEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     OverflowEvent* imp = static_cast<OverflowEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->orient());
+    JSValue result = jsNumber(exec, imp->orient());
+    return result;
 }
 
-JSValue jsOverflowEventHorizontalOverflow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsOverflowEventHorizontalOverflow(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSOverflowEvent* castedThis = static_cast<JSOverflowEvent*>(asObject(slot.slotBase()));
+    JSOverflowEvent* castedThis = static_cast<JSOverflowEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     OverflowEvent* imp = static_cast<OverflowEvent*>(castedThis->impl());
-    return jsBoolean(imp->horizontalOverflow());
+    JSValue result = jsBoolean(imp->horizontalOverflow());
+    return result;
 }
 
-JSValue jsOverflowEventVerticalOverflow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsOverflowEventVerticalOverflow(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSOverflowEvent* castedThis = static_cast<JSOverflowEvent*>(asObject(slot.slotBase()));
+    JSOverflowEvent* castedThis = static_cast<JSOverflowEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     OverflowEvent* imp = static_cast<OverflowEvent*>(castedThis->impl());
-    return jsBoolean(imp->verticalOverflow());
+    JSValue result = jsBoolean(imp->verticalOverflow());
+    return result;
 }
 
-JSValue jsOverflowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsOverflowEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSOverflowEvent* domObject = static_cast<JSOverflowEvent*>(asObject(slot.slotBase()));
+    JSOverflowEvent* domObject = static_cast<JSOverflowEvent*>(asObject(slotBase));
     return JSOverflowEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSOverflowEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -208,17 +211,17 @@ JSValue JSC_HOST_CALL jsOverflowEventPrototypeFunctionInitOverflowEvent(ExecStat
 
 // Constant getters
 
-JSValue jsOverflowEventHORIZONTAL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsOverflowEventHORIZONTAL(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsOverflowEventVERTICAL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsOverflowEventVERTICAL(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsOverflowEventBOTH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsOverflowEventBOTH(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
index e9e10d345c..132438a8c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSOverflowEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -70,15 +70,15 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsOverflowEventPrototypeFunctionInitOverflowEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsOverflowEventOrient(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsOverflowEventHorizontalOverflow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsOverflowEventVerticalOverflow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsOverflowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventOrient(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsOverflowEventHorizontalOverflow(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsOverflowEventVerticalOverflow(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsOverflowEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsOverflowEventHORIZONTAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsOverflowEventVERTICAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsOverflowEventBOTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventHORIZONTAL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsOverflowEventVERTICAL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsOverflowEventBOTH(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.cpp
index 55d5a5430b..eb34b9a37e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.cpp
@@ -35,8 +35,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSPageTransitionEvent);
 
 static const HashTableValue JSPageTransitionEventTableValues[3] =
 {
-    { "persisted", DontDelete|ReadOnly, (intptr_t)jsPageTransitionEventPersisted, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsPageTransitionEventConstructor, (intptr_t)0 },
+    { "persisted", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPageTransitionEventPersisted), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPageTransitionEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -75,7 +75,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -98,7 +98,7 @@ bool JSPageTransitionEventConstructor::getOwnPropertyDescriptor(ExecState* exec,
 
 static const HashTableValue JSPageTransitionEventPrototypeTableValues[2] =
 {
-    { "initPageTransitionEvent", DontDelete|Function, (intptr_t)jsPageTransitionEventPrototypeFunctionInitPageTransitionEvent, (intptr_t)4 },
+    { "initPageTransitionEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsPageTransitionEventPrototypeFunctionInitPageTransitionEvent), (intptr_t)4 },
     { 0, 0, 0, 0 }
 };
 
@@ -148,17 +148,18 @@ bool JSPageTransitionEvent::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSPageTransitionEvent, Base>(exec, &JSPageTransitionEventTable, this, propertyName, descriptor);
 }
 
-JSValue jsPageTransitionEventPersisted(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPageTransitionEventPersisted(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSPageTransitionEvent* castedThis = static_cast<JSPageTransitionEvent*>(asObject(slot.slotBase()));
+    JSPageTransitionEvent* castedThis = static_cast<JSPageTransitionEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     PageTransitionEvent* imp = static_cast<PageTransitionEvent*>(castedThis->impl());
-    return jsBoolean(imp->persisted());
+    JSValue result = jsBoolean(imp->persisted());
+    return result;
 }
 
-JSValue jsPageTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPageTransitionEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSPageTransitionEvent* domObject = static_cast<JSPageTransitionEvent*>(asObject(slot.slotBase()));
+    JSPageTransitionEvent* domObject = static_cast<JSPageTransitionEvent*>(asObject(slotBase));
     return JSPageTransitionEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSPageTransitionEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.h b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.h
index 6e385580f3..6438274b3e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSPageTransitionEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -70,8 +70,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsPageTransitionEventPrototypeFunctionInitPageTransitionEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsPageTransitionEventPersisted(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsPageTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPageTransitionEventPersisted(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsPageTransitionEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
index 1c7b6ec608..3aa88359cd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
@@ -42,11 +42,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSPlugin);
 
 static const HashTableValue JSPluginTableValues[6] =
 {
-    { "name", DontDelete|ReadOnly, (intptr_t)jsPluginName, (intptr_t)0 },
-    { "filename", DontDelete|ReadOnly, (intptr_t)jsPluginFilename, (intptr_t)0 },
-    { "description", DontDelete|ReadOnly, (intptr_t)jsPluginDescription, (intptr_t)0 },
-    { "length", DontDelete|ReadOnly, (intptr_t)jsPluginLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsPluginConstructor, (intptr_t)0 },
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPluginName), (intptr_t)0 },
+    { "filename", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPluginFilename), (intptr_t)0 },
+    { "description", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPluginDescription), (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPluginLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPluginConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -85,7 +85,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -108,8 +108,8 @@ bool JSPluginConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identi
 
 static const HashTableValue JSPluginPrototypeTableValues[3] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsPluginPrototypeFunctionItem, (intptr_t)1 },
-    { "namedItem", DontDelete|Function, (intptr_t)jsPluginPrototypeFunctionNamedItem, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsPluginPrototypeFunctionItem), (intptr_t)1 },
+    { "namedItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsPluginPrototypeFunctionNamedItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -210,48 +210,52 @@ bool JSPlugin::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Proper
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsPluginName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSPlugin* castedThis = static_cast<JSPlugin*>(asObject(slot.slotBase()));
+    JSPlugin* castedThis = static_cast<JSPlugin*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Plugin* imp = static_cast<Plugin*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsPluginFilename(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginFilename(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSPlugin* castedThis = static_cast<JSPlugin*>(asObject(slot.slotBase()));
+    JSPlugin* castedThis = static_cast<JSPlugin*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Plugin* imp = static_cast<Plugin*>(castedThis->impl());
-    return jsString(exec, imp->filename());
+    JSValue result = jsString(exec, imp->filename());
+    return result;
 }
 
-JSValue jsPluginDescription(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginDescription(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSPlugin* castedThis = static_cast<JSPlugin*>(asObject(slot.slotBase()));
+    JSPlugin* castedThis = static_cast<JSPlugin*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Plugin* imp = static_cast<Plugin*>(castedThis->impl());
-    return jsString(exec, imp->description());
+    JSValue result = jsString(exec, imp->description());
+    return result;
 }
 
-JSValue jsPluginLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSPlugin* castedThis = static_cast<JSPlugin*>(asObject(slot.slotBase()));
+    JSPlugin* castedThis = static_cast<JSPlugin*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Plugin* imp = static_cast<Plugin*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsPluginConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSPlugin* domObject = static_cast<JSPlugin*>(asObject(slot.slotBase()));
+    JSPlugin* domObject = static_cast<JSPlugin*>(asObject(slotBase));
     return JSPlugin::getConstructor(exec, domObject->globalObject());
 }
-void JSPlugin::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSPlugin::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<Plugin*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSPlugin::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -288,10 +292,10 @@ JSValue JSC_HOST_CALL jsPluginPrototypeFunctionNamedItem(ExecState* exec, JSObje
 }
 
 
-JSValue JSPlugin::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSPlugin::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSPlugin* thisObj = static_cast<JSPlugin*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<Plugin*>(thisObj->impl())->item(slot.index()));
+    JSPlugin* thisObj = static_cast<JSPlugin*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<Plugin*>(thisObj->impl())->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Plugin* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPlugin.h b/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
index 03da3df267..0202694484 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
@@ -21,7 +21,6 @@
 #ifndef JSPlugin_h
 #define JSPlugin_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,10 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     Plugin* impl() const { return m_impl.get(); }
 
@@ -55,10 +54,10 @@ private:
     RefPtr<Plugin> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 private:
     static bool canGetItemsForName(JSC::ExecState*, Plugin*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Plugin*);
@@ -74,7 +73,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSPluginPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -87,11 +86,11 @@ JSC::JSValue JSC_HOST_CALL jsPluginPrototypeFunctionItem(JSC::ExecState*, JSC::J
 JSC::JSValue JSC_HOST_CALL jsPluginPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsPluginName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsPluginFilename(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsPluginDescription(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsPluginLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsPluginConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsPluginFilename(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsPluginDescription(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsPluginLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsPluginConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
index 38a9346107..99f88a9618 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
@@ -40,8 +40,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSPluginArray);
 
 static const HashTableValue JSPluginArrayTableValues[3] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsPluginArrayLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsPluginArrayConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPluginArrayLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPluginArrayConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -103,9 +103,9 @@ bool JSPluginArrayConstructor::getOwnPropertyDescriptor(ExecState* exec, const I
 
 static const HashTableValue JSPluginArrayPrototypeTableValues[4] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsPluginArrayPrototypeFunctionItem, (intptr_t)1 },
-    { "namedItem", DontDelete|Function, (intptr_t)jsPluginArrayPrototypeFunctionNamedItem, (intptr_t)1 },
-    { "refresh", DontDelete|Function, (intptr_t)jsPluginArrayPrototypeFunctionRefresh, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsPluginArrayPrototypeFunctionItem), (intptr_t)1 },
+    { "namedItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsPluginArrayPrototypeFunctionNamedItem), (intptr_t)1 },
+    { "refresh", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsPluginArrayPrototypeFunctionRefresh), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -206,24 +206,25 @@ bool JSPluginArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, P
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsPluginArrayLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginArrayLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSPluginArray* castedThis = static_cast<JSPluginArray*>(asObject(slot.slotBase()));
+    JSPluginArray* castedThis = static_cast<JSPluginArray*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     PluginArray* imp = static_cast<PluginArray*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsPluginArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSPluginArray* domObject = static_cast<JSPluginArray*>(asObject(slot.slotBase()));
+    JSPluginArray* domObject = static_cast<JSPluginArray*>(asObject(slotBase));
     return JSPluginArray::getConstructor(exec, domObject->globalObject());
 }
-void JSPluginArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSPluginArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<PluginArray*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSPluginArray::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -273,10 +274,10 @@ JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionRefresh(ExecState* exec, JSO
 }
 
 
-JSValue JSPluginArray::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSPluginArray::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSPluginArray* thisObj = static_cast<JSPluginArray*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<PluginArray*>(thisObj->impl())->item(slot.index()));
+    JSPluginArray* thisObj = static_cast<JSPluginArray*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<PluginArray*>(thisObj->impl())->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, PluginArray* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
index 9c2e6ef093..e87988b248 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
@@ -21,7 +21,6 @@
 #ifndef JSPluginArray_h
 #define JSPluginArray_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,10 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     PluginArray* impl() const { return m_impl.get(); }
 
@@ -55,10 +54,10 @@ private:
     RefPtr<PluginArray> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 private:
     static bool canGetItemsForName(JSC::ExecState*, PluginArray*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, PluginArray*);
@@ -74,7 +73,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSPluginArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -88,8 +87,8 @@ JSC::JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionNamedItem(JSC::ExecStat
 JSC::JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionRefresh(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsPluginArrayLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsPluginArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginArrayLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsPluginArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPopStateEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSPopStateEvent.cpp
new file mode 100644
index 0000000000..7d58bef830
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSPopStateEvent.cpp
@@ -0,0 +1,181 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSPopStateEvent.h"
+
+#include "PopStateEvent.h"
+#include "SerializedScriptValue.h"
+#include <runtime/Error.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSPopStateEvent);
+
+/* Hash table */
+
+static const HashTableValue JSPopStateEventTableValues[3] =
+{
+    { "state", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPopStateEventState), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPopStateEventConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSPopStateEventTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 7, JSPopStateEventTableValues, 0 };
+#else
+    { 5, 3, JSPopStateEventTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSPopStateEventConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSPopStateEventConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSPopStateEventConstructorTableValues, 0 };
+#else
+    { 1, 0, JSPopStateEventConstructorTableValues, 0 };
+#endif
+
+class JSPopStateEventConstructor : public DOMConstructorObject {
+public:
+    JSPopStateEventConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSPopStateEventConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSPopStateEventPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSPopStateEventConstructor::s_info = { "PopStateEventConstructor", 0, &JSPopStateEventConstructorTable, 0 };
+
+bool JSPopStateEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSPopStateEventConstructor, DOMObject>(exec, &JSPopStateEventConstructorTable, this, propertyName, slot);
+}
+
+bool JSPopStateEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSPopStateEventConstructor, DOMObject>(exec, &JSPopStateEventConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSPopStateEventPrototypeTableValues[2] =
+{
+    { "initPopStateEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsPopStateEventPrototypeFunctionInitPopStateEvent), (intptr_t)4 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSPopStateEventPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSPopStateEventPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSPopStateEventPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSPopStateEventPrototype::s_info = { "PopStateEventPrototype", 0, &JSPopStateEventPrototypeTable, 0 };
+
+JSObject* JSPopStateEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSPopStateEvent>(exec, globalObject);
+}
+
+bool JSPopStateEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSPopStateEventPrototypeTable, this, propertyName, slot);
+}
+
+bool JSPopStateEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSPopStateEventPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSPopStateEvent::s_info = { "PopStateEvent", &JSEvent::s_info, &JSPopStateEventTable, 0 };
+
+JSPopStateEvent::JSPopStateEvent(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<PopStateEvent> impl)
+    : JSEvent(structure, globalObject, impl)
+{
+}
+
+JSObject* JSPopStateEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSPopStateEventPrototype(JSPopStateEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
+}
+
+bool JSPopStateEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSPopStateEvent, Base>(exec, &JSPopStateEventTable, this, propertyName, slot);
+}
+
+bool JSPopStateEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSPopStateEvent, Base>(exec, &JSPopStateEventTable, this, propertyName, descriptor);
+}
+
+JSValue jsPopStateEventState(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSPopStateEvent* castedThis = static_cast<JSPopStateEvent*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    PopStateEvent* imp = static_cast<PopStateEvent*>(castedThis->impl());
+    JSValue result = imp->state() ? imp->state()->deserialize(exec, castedThis->globalObject()) : jsNull();
+    return result;
+}
+
+JSValue jsPopStateEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSPopStateEvent* domObject = static_cast<JSPopStateEvent*>(asObject(slotBase));
+    return JSPopStateEvent::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSPopStateEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSPopStateEventConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsPopStateEventPrototypeFunctionInitPopStateEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSPopStateEvent::s_info))
+        return throwError(exec, TypeError);
+    JSPopStateEvent* castedThisObj = static_cast<JSPopStateEvent*>(asObject(thisValue));
+    return castedThisObj->initPopStateEvent(exec, args);
+}
+
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPopStateEvent.h b/src/3rdparty/webkit/WebCore/generated/JSPopStateEvent.h
new file mode 100644
index 0000000000..69197d1b4c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSPopStateEvent.h
@@ -0,0 +1,81 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSPopStateEvent_h
+#define JSPopStateEvent_h
+
+#include "JSEvent.h"
+
+namespace WebCore {
+
+class PopStateEvent;
+
+class JSPopStateEvent : public JSEvent {
+    typedef JSEvent Base;
+public:
+    JSPopStateEvent(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<PopStateEvent>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+
+    // Custom functions
+    JSC::JSValue initPopStateEvent(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+
+class JSPopStateEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSPopStateEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsPopStateEventPrototypeFunctionInitPopStateEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsPopStateEventState(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsPopStateEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
index fffa0c1efb..4e024a5170 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
@@ -19,6 +19,9 @@
 */
 
 #include "config.h"
+
+#if ENABLE(GEOLOCATION)
+
 #include "JSPositionError.h"
 
 #include "KURL.h"
@@ -37,9 +40,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSPositionError);
 
 static const HashTableValue JSPositionErrorTableValues[4] =
 {
-    { "code", DontDelete|ReadOnly, (intptr_t)jsPositionErrorCode, (intptr_t)0 },
-    { "message", DontDelete|ReadOnly, (intptr_t)jsPositionErrorMessage, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsPositionErrorConstructor, (intptr_t)0 },
+    { "code", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPositionErrorCode), (intptr_t)0 },
+    { "message", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPositionErrorMessage), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPositionErrorConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -52,12 +55,11 @@ static JSC_CONST_HASHTABLE HashTable JSPositionErrorTable =
 
 /* Hash table for constructor */
 
-static const HashTableValue JSPositionErrorConstructorTableValues[5] =
+static const HashTableValue JSPositionErrorConstructorTableValues[4] =
 {
-    { "UNKNOWN_ERROR", DontDelete|ReadOnly, (intptr_t)jsPositionErrorUNKNOWN_ERROR, (intptr_t)0 },
-    { "PERMISSION_DENIED", DontDelete|ReadOnly, (intptr_t)jsPositionErrorPERMISSION_DENIED, (intptr_t)0 },
-    { "POSITION_UNAVAILABLE", DontDelete|ReadOnly, (intptr_t)jsPositionErrorPOSITION_UNAVAILABLE, (intptr_t)0 },
-    { "TIMEOUT", DontDelete|ReadOnly, (intptr_t)jsPositionErrorTIMEOUT, (intptr_t)0 },
+    { "PERMISSION_DENIED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPositionErrorPERMISSION_DENIED), (intptr_t)0 },
+    { "POSITION_UNAVAILABLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPositionErrorPOSITION_UNAVAILABLE), (intptr_t)0 },
+    { "TIMEOUT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPositionErrorTIMEOUT), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -65,7 +67,7 @@ static JSC_CONST_HASHTABLE HashTable JSPositionErrorConstructorTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 127, JSPositionErrorConstructorTableValues, 0 };
 #else
-    { 10, 7, JSPositionErrorConstructorTableValues, 0 };
+    { 9, 7, JSPositionErrorConstructorTableValues, 0 };
 #endif
 
 class JSPositionErrorConstructor : public DOMConstructorObject {
@@ -82,7 +84,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -103,12 +105,11 @@ bool JSPositionErrorConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 /* Hash table for prototype */
 
-static const HashTableValue JSPositionErrorPrototypeTableValues[5] =
+static const HashTableValue JSPositionErrorPrototypeTableValues[4] =
 {
-    { "UNKNOWN_ERROR", DontDelete|ReadOnly, (intptr_t)jsPositionErrorUNKNOWN_ERROR, (intptr_t)0 },
-    { "PERMISSION_DENIED", DontDelete|ReadOnly, (intptr_t)jsPositionErrorPERMISSION_DENIED, (intptr_t)0 },
-    { "POSITION_UNAVAILABLE", DontDelete|ReadOnly, (intptr_t)jsPositionErrorPOSITION_UNAVAILABLE, (intptr_t)0 },
-    { "TIMEOUT", DontDelete|ReadOnly, (intptr_t)jsPositionErrorTIMEOUT, (intptr_t)0 },
+    { "PERMISSION_DENIED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPositionErrorPERMISSION_DENIED), (intptr_t)0 },
+    { "POSITION_UNAVAILABLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPositionErrorPOSITION_UNAVAILABLE), (intptr_t)0 },
+    { "TIMEOUT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsPositionErrorTIMEOUT), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -116,7 +117,7 @@ static JSC_CONST_HASHTABLE HashTable JSPositionErrorPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 127, JSPositionErrorPrototypeTableValues, 0 };
 #else
-    { 10, 7, JSPositionErrorPrototypeTableValues, 0 };
+    { 9, 7, JSPositionErrorPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSPositionErrorPrototype::s_info = { "PositionErrorPrototype", 0, &JSPositionErrorPrototypeTable, 0 };
@@ -164,25 +165,27 @@ bool JSPositionError::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSPositionError, Base>(exec, &JSPositionErrorTable, this, propertyName, descriptor);
 }
 
-JSValue jsPositionErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPositionErrorCode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSPositionError* castedThis = static_cast<JSPositionError*>(asObject(slot.slotBase()));
+    JSPositionError* castedThis = static_cast<JSPositionError*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     PositionError* imp = static_cast<PositionError*>(castedThis->impl());
-    return jsNumber(exec, imp->code());
+    JSValue result = jsNumber(exec, imp->code());
+    return result;
 }
 
-JSValue jsPositionErrorMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPositionErrorMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSPositionError* castedThis = static_cast<JSPositionError*>(asObject(slot.slotBase()));
+    JSPositionError* castedThis = static_cast<JSPositionError*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     PositionError* imp = static_cast<PositionError*>(castedThis->impl());
-    return jsString(exec, imp->message());
+    JSValue result = jsString(exec, imp->message());
+    return result;
 }
 
-JSValue jsPositionErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPositionErrorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSPositionError* domObject = static_cast<JSPositionError*>(asObject(slot.slotBase()));
+    JSPositionError* domObject = static_cast<JSPositionError*>(asObject(slotBase));
     return JSPositionError::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSPositionError::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -192,22 +195,17 @@ JSValue JSPositionError::getConstructor(ExecState* exec, JSGlobalObject* globalO
 
 // Constant getters
 
-JSValue jsPositionErrorUNKNOWN_ERROR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0));
-}
-
-JSValue jsPositionErrorPERMISSION_DENIED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsPositionErrorPERMISSION_DENIED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsPositionErrorPOSITION_UNAVAILABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsPositionErrorPOSITION_UNAVAILABLE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsPositionErrorTIMEOUT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsPositionErrorTIMEOUT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
@@ -222,3 +220,5 @@ PositionError* toPositionError(JSC::JSValue value)
 }
 
 }
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPositionError.h b/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
index 01ba3e77cc..01cd5e5b9b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
@@ -21,7 +21,8 @@
 #ifndef JSPositionError_h
 #define JSPositionError_h
 
-#include "DOMObjectWithSVGContext.h"
+#if ENABLE(GEOLOCATION)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -68,7 +69,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSPositionErrorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -77,16 +78,17 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsPositionErrorCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsPositionErrorMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsPositionErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorCode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsPositionErrorMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsPositionErrorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsPositionErrorUNKNOWN_ERROR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsPositionErrorPERMISSION_DENIED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsPositionErrorPOSITION_UNAVAILABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsPositionErrorTIMEOUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorPERMISSION_DENIED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsPositionErrorPOSITION_UNAVAILABLE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsPositionErrorTIMEOUT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
+#endif // ENABLE(GEOLOCATION)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
index 8c8de3ad3e..6949956c40 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
@@ -37,10 +37,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSProcessingInstruction);
 
 static const HashTableValue JSProcessingInstructionTableValues[5] =
 {
-    { "target", DontDelete|ReadOnly, (intptr_t)jsProcessingInstructionTarget, (intptr_t)0 },
-    { "data", DontDelete, (intptr_t)jsProcessingInstructionData, (intptr_t)setJSProcessingInstructionData },
-    { "sheet", DontDelete|ReadOnly, (intptr_t)jsProcessingInstructionSheet, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsProcessingInstructionConstructor, (intptr_t)0 },
+    { "target", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsProcessingInstructionTarget), (intptr_t)0 },
+    { "data", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsProcessingInstructionData), (intptr_t)setJSProcessingInstructionData },
+    { "sheet", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsProcessingInstructionSheet), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsProcessingInstructionConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -141,33 +141,36 @@ bool JSProcessingInstruction::getOwnPropertyDescriptor(ExecState* exec, const Id
     return getStaticValueDescriptor<JSProcessingInstruction, Base>(exec, &JSProcessingInstructionTable, this, propertyName, descriptor);
 }
 
-JSValue jsProcessingInstructionTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProcessingInstructionTarget(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSProcessingInstruction* castedThis = static_cast<JSProcessingInstruction*>(asObject(slot.slotBase()));
+    JSProcessingInstruction* castedThis = static_cast<JSProcessingInstruction*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ProcessingInstruction* imp = static_cast<ProcessingInstruction*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->target());
+    JSValue result = jsStringOrNull(exec, imp->target());
+    return result;
 }
 
-JSValue jsProcessingInstructionData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProcessingInstructionData(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSProcessingInstruction* castedThis = static_cast<JSProcessingInstruction*>(asObject(slot.slotBase()));
+    JSProcessingInstruction* castedThis = static_cast<JSProcessingInstruction*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ProcessingInstruction* imp = static_cast<ProcessingInstruction*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->data());
+    JSValue result = jsStringOrNull(exec, imp->data());
+    return result;
 }
 
-JSValue jsProcessingInstructionSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProcessingInstructionSheet(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSProcessingInstruction* castedThis = static_cast<JSProcessingInstruction*>(asObject(slot.slotBase()));
+    JSProcessingInstruction* castedThis = static_cast<JSProcessingInstruction*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ProcessingInstruction* imp = static_cast<ProcessingInstruction*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->sheet()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->sheet()));
+    return result;
 }
 
-JSValue jsProcessingInstructionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProcessingInstructionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSProcessingInstruction* domObject = static_cast<JSProcessingInstruction*>(asObject(slot.slotBase()));
+    JSProcessingInstruction* domObject = static_cast<JSProcessingInstruction*>(asObject(slotBase));
     return JSProcessingInstruction::getConstructor(exec, domObject->globalObject());
 }
 void JSProcessingInstruction::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -177,7 +180,8 @@ void JSProcessingInstruction::put(ExecState* exec, const Identifier& propertyNam
 
 void setJSProcessingInstructionData(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    ProcessingInstruction* imp = static_cast<ProcessingInstruction*>(static_cast<JSProcessingInstruction*>(thisObject)->impl());
+    JSProcessingInstruction* castedThisObj = static_cast<JSProcessingInstruction*>(thisObject);
+    ProcessingInstruction* imp = static_cast<ProcessingInstruction*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setData(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
index b3c239b4fb..6650da8403 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSProcessingInstructionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,11 +66,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsProcessingInstructionTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsProcessingInstructionData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProcessingInstructionTarget(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsProcessingInstructionData(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSProcessingInstructionData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsProcessingInstructionSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsProcessingInstructionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProcessingInstructionSheet(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsProcessingInstructionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
index c74e80d540..e31f79a240 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
@@ -36,10 +36,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSProgressEvent);
 
 static const HashTableValue JSProgressEventTableValues[5] =
 {
-    { "lengthComputable", DontDelete|ReadOnly, (intptr_t)jsProgressEventLengthComputable, (intptr_t)0 },
-    { "loaded", DontDelete|ReadOnly, (intptr_t)jsProgressEventLoaded, (intptr_t)0 },
-    { "total", DontDelete|ReadOnly, (intptr_t)jsProgressEventTotal, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsProgressEventConstructor, (intptr_t)0 },
+    { "lengthComputable", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsProgressEventLengthComputable), (intptr_t)0 },
+    { "loaded", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsProgressEventLoaded), (intptr_t)0 },
+    { "total", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsProgressEventTotal), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsProgressEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -78,7 +78,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -101,7 +101,7 @@ bool JSProgressEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSProgressEventPrototypeTableValues[2] =
 {
-    { "initProgressEvent", DontDelete|Function, (intptr_t)jsProgressEventPrototypeFunctionInitProgressEvent, (intptr_t)6 },
+    { "initProgressEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsProgressEventPrototypeFunctionInitProgressEvent), (intptr_t)6 },
     { 0, 0, 0, 0 }
 };
 
@@ -151,33 +151,36 @@ bool JSProgressEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSProgressEvent, Base>(exec, &JSProgressEventTable, this, propertyName, descriptor);
 }
 
-JSValue jsProgressEventLengthComputable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProgressEventLengthComputable(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSProgressEvent* castedThis = static_cast<JSProgressEvent*>(asObject(slot.slotBase()));
+    JSProgressEvent* castedThis = static_cast<JSProgressEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ProgressEvent* imp = static_cast<ProgressEvent*>(castedThis->impl());
-    return jsBoolean(imp->lengthComputable());
+    JSValue result = jsBoolean(imp->lengthComputable());
+    return result;
 }
 
-JSValue jsProgressEventLoaded(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProgressEventLoaded(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSProgressEvent* castedThis = static_cast<JSProgressEvent*>(asObject(slot.slotBase()));
+    JSProgressEvent* castedThis = static_cast<JSProgressEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ProgressEvent* imp = static_cast<ProgressEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->loaded());
+    JSValue result = jsNumber(exec, imp->loaded());
+    return result;
 }
 
-JSValue jsProgressEventTotal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProgressEventTotal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSProgressEvent* castedThis = static_cast<JSProgressEvent*>(asObject(slot.slotBase()));
+    JSProgressEvent* castedThis = static_cast<JSProgressEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ProgressEvent* imp = static_cast<ProgressEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->total());
+    JSValue result = jsNumber(exec, imp->total());
+    return result;
 }
 
-JSValue jsProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProgressEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSProgressEvent* domObject = static_cast<JSProgressEvent*>(asObject(slot.slotBase()));
+    JSProgressEvent* domObject = static_cast<JSProgressEvent*>(asObject(slotBase));
     return JSProgressEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSProgressEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
index 34e1985612..113ca8ee25 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSProgressEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -70,10 +70,10 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsProgressEventPrototypeFunctionInitProgressEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsProgressEventLengthComputable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsProgressEventLoaded(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsProgressEventTotal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProgressEventLengthComputable(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsProgressEventLoaded(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsProgressEventTotal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsProgressEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
index e45ce667a9..b34ae178bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
@@ -36,10 +36,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSRGBColor);
 
 static const HashTableValue JSRGBColorTableValues[5] =
 {
-    { "red", DontDelete|ReadOnly, (intptr_t)jsRGBColorRed, (intptr_t)0 },
-    { "green", DontDelete|ReadOnly, (intptr_t)jsRGBColorGreen, (intptr_t)0 },
-    { "blue", DontDelete|ReadOnly, (intptr_t)jsRGBColorBlue, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsRGBColorConstructor, (intptr_t)0 },
+    { "red", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRGBColorRed), (intptr_t)0 },
+    { "green", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRGBColorGreen), (intptr_t)0 },
+    { "blue", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRGBColorBlue), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRGBColorConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -78,7 +78,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -146,33 +146,36 @@ bool JSRGBColor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     return getStaticValueDescriptor<JSRGBColor, Base>(exec, &JSRGBColorTable, this, propertyName, descriptor);
 }
 
-JSValue jsRGBColorRed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorRed(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRGBColor* castedThis = static_cast<JSRGBColor*>(asObject(slot.slotBase()));
+    JSRGBColor* castedThis = static_cast<JSRGBColor*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     RGBColor* imp = static_cast<RGBColor*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->red()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->red()));
+    return result;
 }
 
-JSValue jsRGBColorGreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorGreen(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRGBColor* castedThis = static_cast<JSRGBColor*>(asObject(slot.slotBase()));
+    JSRGBColor* castedThis = static_cast<JSRGBColor*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     RGBColor* imp = static_cast<RGBColor*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->green()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->green()));
+    return result;
 }
 
-JSValue jsRGBColorBlue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorBlue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRGBColor* castedThis = static_cast<JSRGBColor*>(asObject(slot.slotBase()));
+    JSRGBColor* castedThis = static_cast<JSRGBColor*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     RGBColor* imp = static_cast<RGBColor*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->blue()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->blue()));
+    return result;
 }
 
-JSValue jsRGBColorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRGBColor* domObject = static_cast<JSRGBColor*>(asObject(slot.slotBase()));
+    JSRGBColor* domObject = static_cast<JSRGBColor*>(asObject(slotBase));
     return JSRGBColor::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSRGBColor::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h
index 2e6c715c82..cb2bd329f6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h
@@ -21,7 +21,6 @@
 #ifndef JSRGBColor_h
 #define JSRGBColor_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -66,7 +65,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSRGBColorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,10 +74,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsRGBColorRed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRGBColorGreen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRGBColorBlue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRGBColorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRGBColorRed(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRGBColorGreen(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRGBColorBlue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRGBColorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
index bc9979b249..2aa005e348 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
@@ -47,13 +47,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSRange);
 
 static const HashTableValue JSRangeTableValues[8] =
 {
-    { "startContainer", DontDelete|ReadOnly, (intptr_t)jsRangeStartContainer, (intptr_t)0 },
-    { "startOffset", DontDelete|ReadOnly, (intptr_t)jsRangeStartOffset, (intptr_t)0 },
-    { "endContainer", DontDelete|ReadOnly, (intptr_t)jsRangeEndContainer, (intptr_t)0 },
-    { "endOffset", DontDelete|ReadOnly, (intptr_t)jsRangeEndOffset, (intptr_t)0 },
-    { "collapsed", DontDelete|ReadOnly, (intptr_t)jsRangeCollapsed, (intptr_t)0 },
-    { "commonAncestorContainer", DontDelete|ReadOnly, (intptr_t)jsRangeCommonAncestorContainer, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsRangeConstructor, (intptr_t)0 },
+    { "startContainer", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeStartContainer), (intptr_t)0 },
+    { "startOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeStartOffset), (intptr_t)0 },
+    { "endContainer", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeEndContainer), (intptr_t)0 },
+    { "endOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeEndOffset), (intptr_t)0 },
+    { "collapsed", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeCollapsed), (intptr_t)0 },
+    { "commonAncestorContainer", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeCommonAncestorContainer), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -68,14 +68,14 @@ static JSC_CONST_HASHTABLE HashTable JSRangeTable =
 
 static const HashTableValue JSRangeConstructorTableValues[9] =
 {
-    { "START_TO_START", DontDelete|ReadOnly, (intptr_t)jsRangeSTART_TO_START, (intptr_t)0 },
-    { "START_TO_END", DontDelete|ReadOnly, (intptr_t)jsRangeSTART_TO_END, (intptr_t)0 },
-    { "END_TO_END", DontDelete|ReadOnly, (intptr_t)jsRangeEND_TO_END, (intptr_t)0 },
-    { "END_TO_START", DontDelete|ReadOnly, (intptr_t)jsRangeEND_TO_START, (intptr_t)0 },
-    { "NODE_BEFORE", DontDelete|ReadOnly, (intptr_t)jsRangeNODE_BEFORE, (intptr_t)0 },
-    { "NODE_AFTER", DontDelete|ReadOnly, (intptr_t)jsRangeNODE_AFTER, (intptr_t)0 },
-    { "NODE_BEFORE_AND_AFTER", DontDelete|ReadOnly, (intptr_t)jsRangeNODE_BEFORE_AND_AFTER, (intptr_t)0 },
-    { "NODE_INSIDE", DontDelete|ReadOnly, (intptr_t)jsRangeNODE_INSIDE, (intptr_t)0 },
+    { "START_TO_START", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeSTART_TO_START), (intptr_t)0 },
+    { "START_TO_END", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeSTART_TO_END), (intptr_t)0 },
+    { "END_TO_END", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeEND_TO_END), (intptr_t)0 },
+    { "END_TO_START", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeEND_TO_START), (intptr_t)0 },
+    { "NODE_BEFORE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeNODE_BEFORE), (intptr_t)0 },
+    { "NODE_AFTER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeNODE_AFTER), (intptr_t)0 },
+    { "NODE_BEFORE_AND_AFTER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeNODE_BEFORE_AND_AFTER), (intptr_t)0 },
+    { "NODE_INSIDE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeNODE_INSIDE), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -100,7 +100,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -123,40 +123,40 @@ bool JSRangeConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identif
 
 static const HashTableValue JSRangePrototypeTableValues[35] =
 {
-    { "START_TO_START", DontDelete|ReadOnly, (intptr_t)jsRangeSTART_TO_START, (intptr_t)0 },
-    { "START_TO_END", DontDelete|ReadOnly, (intptr_t)jsRangeSTART_TO_END, (intptr_t)0 },
-    { "END_TO_END", DontDelete|ReadOnly, (intptr_t)jsRangeEND_TO_END, (intptr_t)0 },
-    { "END_TO_START", DontDelete|ReadOnly, (intptr_t)jsRangeEND_TO_START, (intptr_t)0 },
-    { "NODE_BEFORE", DontDelete|ReadOnly, (intptr_t)jsRangeNODE_BEFORE, (intptr_t)0 },
-    { "NODE_AFTER", DontDelete|ReadOnly, (intptr_t)jsRangeNODE_AFTER, (intptr_t)0 },
-    { "NODE_BEFORE_AND_AFTER", DontDelete|ReadOnly, (intptr_t)jsRangeNODE_BEFORE_AND_AFTER, (intptr_t)0 },
-    { "NODE_INSIDE", DontDelete|ReadOnly, (intptr_t)jsRangeNODE_INSIDE, (intptr_t)0 },
-    { "setStart", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionSetStart, (intptr_t)2 },
-    { "setEnd", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionSetEnd, (intptr_t)2 },
-    { "setStartBefore", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionSetStartBefore, (intptr_t)1 },
-    { "setStartAfter", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionSetStartAfter, (intptr_t)1 },
-    { "setEndBefore", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionSetEndBefore, (intptr_t)1 },
-    { "setEndAfter", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionSetEndAfter, (intptr_t)1 },
-    { "collapse", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionCollapse, (intptr_t)1 },
-    { "selectNode", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionSelectNode, (intptr_t)1 },
-    { "selectNodeContents", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionSelectNodeContents, (intptr_t)1 },
-    { "compareBoundaryPoints", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionCompareBoundaryPoints, (intptr_t)2 },
-    { "deleteContents", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionDeleteContents, (intptr_t)0 },
-    { "extractContents", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionExtractContents, (intptr_t)0 },
-    { "cloneContents", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionCloneContents, (intptr_t)0 },
-    { "insertNode", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionInsertNode, (intptr_t)1 },
-    { "surroundContents", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionSurroundContents, (intptr_t)1 },
-    { "cloneRange", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionCloneRange, (intptr_t)0 },
-    { "toString", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionToString, (intptr_t)0 },
-    { "detach", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionDetach, (intptr_t)0 },
-    { "getClientRects", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionGetClientRects, (intptr_t)0 },
-    { "getBoundingClientRect", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionGetBoundingClientRect, (intptr_t)0 },
-    { "createContextualFragment", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionCreateContextualFragment, (intptr_t)1 },
-    { "intersectsNode", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionIntersectsNode, (intptr_t)1 },
-    { "compareNode", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionCompareNode, (intptr_t)1 },
-    { "comparePoint", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionComparePoint, (intptr_t)2 },
-    { "isPointInRange", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionIsPointInRange, (intptr_t)2 },
-    { "expand", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionExpand, (intptr_t)1 },
+    { "START_TO_START", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeSTART_TO_START), (intptr_t)0 },
+    { "START_TO_END", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeSTART_TO_END), (intptr_t)0 },
+    { "END_TO_END", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeEND_TO_END), (intptr_t)0 },
+    { "END_TO_START", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeEND_TO_START), (intptr_t)0 },
+    { "NODE_BEFORE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeNODE_BEFORE), (intptr_t)0 },
+    { "NODE_AFTER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeNODE_AFTER), (intptr_t)0 },
+    { "NODE_BEFORE_AND_AFTER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeNODE_BEFORE_AND_AFTER), (intptr_t)0 },
+    { "NODE_INSIDE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeNODE_INSIDE), (intptr_t)0 },
+    { "setStart", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionSetStart), (intptr_t)2 },
+    { "setEnd", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionSetEnd), (intptr_t)2 },
+    { "setStartBefore", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionSetStartBefore), (intptr_t)1 },
+    { "setStartAfter", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionSetStartAfter), (intptr_t)1 },
+    { "setEndBefore", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionSetEndBefore), (intptr_t)1 },
+    { "setEndAfter", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionSetEndAfter), (intptr_t)1 },
+    { "collapse", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionCollapse), (intptr_t)1 },
+    { "selectNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionSelectNode), (intptr_t)1 },
+    { "selectNodeContents", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionSelectNodeContents), (intptr_t)1 },
+    { "compareBoundaryPoints", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionCompareBoundaryPoints), (intptr_t)2 },
+    { "deleteContents", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionDeleteContents), (intptr_t)0 },
+    { "extractContents", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionExtractContents), (intptr_t)0 },
+    { "cloneContents", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionCloneContents), (intptr_t)0 },
+    { "insertNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionInsertNode), (intptr_t)1 },
+    { "surroundContents", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionSurroundContents), (intptr_t)1 },
+    { "cloneRange", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionCloneRange), (intptr_t)0 },
+    { "toString", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionToString), (intptr_t)0 },
+    { "detach", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionDetach), (intptr_t)0 },
+    { "getClientRects", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionGetClientRects), (intptr_t)0 },
+    { "getBoundingClientRect", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionGetBoundingClientRect), (intptr_t)0 },
+    { "createContextualFragment", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionCreateContextualFragment), (intptr_t)1 },
+    { "intersectsNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionIntersectsNode), (intptr_t)1 },
+    { "compareNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionCompareNode), (intptr_t)1 },
+    { "comparePoint", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionComparePoint), (intptr_t)2 },
+    { "isPointInRange", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionIsPointInRange), (intptr_t)2 },
+    { "expand", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsRangePrototypeFunctionExpand), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -212,9 +212,9 @@ bool JSRange::getOwnPropertyDescriptor(ExecState* exec, const Identifier& proper
     return getStaticValueDescriptor<JSRange, Base>(exec, &JSRangeTable, this, propertyName, descriptor);
 }
 
-JSValue jsRangeStartContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeStartContainer(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRange* castedThis = static_cast<JSRange*>(asObject(slot.slotBase()));
+    JSRange* castedThis = static_cast<JSRange*>(asObject(slotBase));
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(castedThis->impl());
     JSC::JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->startContainer(ec)));
@@ -222,9 +222,9 @@ JSValue jsRangeStartContainer(ExecState* exec, const Identifier&, const Property
     return result;
 }
 
-JSValue jsRangeStartOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeStartOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRange* castedThis = static_cast<JSRange*>(asObject(slot.slotBase()));
+    JSRange* castedThis = static_cast<JSRange*>(asObject(slotBase));
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(castedThis->impl());
     JSC::JSValue result = jsNumber(exec, imp->startOffset(ec));
@@ -232,9 +232,9 @@ JSValue jsRangeStartOffset(ExecState* exec, const Identifier&, const PropertySlo
     return result;
 }
 
-JSValue jsRangeEndContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeEndContainer(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRange* castedThis = static_cast<JSRange*>(asObject(slot.slotBase()));
+    JSRange* castedThis = static_cast<JSRange*>(asObject(slotBase));
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(castedThis->impl());
     JSC::JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->endContainer(ec)));
@@ -242,9 +242,9 @@ JSValue jsRangeEndContainer(ExecState* exec, const Identifier&, const PropertySl
     return result;
 }
 
-JSValue jsRangeEndOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeEndOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRange* castedThis = static_cast<JSRange*>(asObject(slot.slotBase()));
+    JSRange* castedThis = static_cast<JSRange*>(asObject(slotBase));
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(castedThis->impl());
     JSC::JSValue result = jsNumber(exec, imp->endOffset(ec));
@@ -252,9 +252,9 @@ JSValue jsRangeEndOffset(ExecState* exec, const Identifier&, const PropertySlot&
     return result;
 }
 
-JSValue jsRangeCollapsed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeCollapsed(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRange* castedThis = static_cast<JSRange*>(asObject(slot.slotBase()));
+    JSRange* castedThis = static_cast<JSRange*>(asObject(slotBase));
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(castedThis->impl());
     JSC::JSValue result = jsBoolean(imp->collapsed(ec));
@@ -262,9 +262,9 @@ JSValue jsRangeCollapsed(ExecState* exec, const Identifier&, const PropertySlot&
     return result;
 }
 
-JSValue jsRangeCommonAncestorContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeCommonAncestorContainer(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRange* castedThis = static_cast<JSRange*>(asObject(slot.slotBase()));
+    JSRange* castedThis = static_cast<JSRange*>(asObject(slotBase));
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(castedThis->impl());
     JSC::JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->commonAncestorContainer(ec)));
@@ -272,9 +272,9 @@ JSValue jsRangeCommonAncestorContainer(ExecState* exec, const Identifier&, const
     return result;
 }
 
-JSValue jsRangeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRange* domObject = static_cast<JSRange*>(asObject(slot.slotBase()));
+    JSRange* domObject = static_cast<JSRange*>(asObject(slotBase));
     return JSRange::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSRange::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -679,42 +679,42 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionExpand(ExecState* exec, JSObject*,
 
 // Constant getters
 
-JSValue jsRangeSTART_TO_START(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeSTART_TO_START(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsRangeSTART_TO_END(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeSTART_TO_END(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsRangeEND_TO_END(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeEND_TO_END(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsRangeEND_TO_START(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeEND_TO_START(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsRangeNODE_BEFORE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeNODE_BEFORE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsRangeNODE_AFTER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeNODE_AFTER(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsRangeNODE_BEFORE_AND_AFTER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeNODE_BEFORE_AND_AFTER(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsRangeNODE_INSIDE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeNODE_INSIDE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.h b/src/3rdparty/webkit/WebCore/generated/JSRange.h
index 8b45a3f1e7..8f58949225 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.h
@@ -21,7 +21,6 @@
 #ifndef JSRange_h
 #define JSRange_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -68,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSRangePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -105,23 +104,23 @@ JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionIsPointInRange(JSC::ExecState
 JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionExpand(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsRangeStartContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeStartOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeEndContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeEndOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeCollapsed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeCommonAncestorContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeStartContainer(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeStartOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeEndContainer(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeEndOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeCollapsed(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeCommonAncestorContainer(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsRangeSTART_TO_START(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeSTART_TO_END(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeEND_TO_END(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeEND_TO_START(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeNODE_BEFORE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeNODE_AFTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeNODE_BEFORE_AND_AFTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeNODE_INSIDE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeSTART_TO_START(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeSTART_TO_END(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeEND_TO_END(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeEND_TO_START(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeNODE_BEFORE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeNODE_AFTER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeNODE_BEFORE_AND_AFTER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeNODE_INSIDE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
index bbb172d09c..16bdf59a5f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
@@ -38,10 +38,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSRangeException);
 
 static const HashTableValue JSRangeExceptionTableValues[5] =
 {
-    { "code", DontDelete|ReadOnly, (intptr_t)jsRangeExceptionCode, (intptr_t)0 },
-    { "name", DontDelete|ReadOnly, (intptr_t)jsRangeExceptionName, (intptr_t)0 },
-    { "message", DontDelete|ReadOnly, (intptr_t)jsRangeExceptionMessage, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsRangeExceptionConstructor, (intptr_t)0 },
+    { "code", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeExceptionCode), (intptr_t)0 },
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeExceptionName), (intptr_t)0 },
+    { "message", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeExceptionMessage), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeExceptionConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -56,8 +56,8 @@ static JSC_CONST_HASHTABLE HashTable JSRangeExceptionTable =
 
 static const HashTableValue JSRangeExceptionConstructorTableValues[3] =
 {
-    { "BAD_BOUNDARYPOINTS_ERR", DontDelete|ReadOnly, (intptr_t)jsRangeExceptionBAD_BOUNDARYPOINTS_ERR, (intptr_t)0 },
-    { "INVALID_NODE_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)jsRangeExceptionINVALID_NODE_TYPE_ERR, (intptr_t)0 },
+    { "BAD_BOUNDARYPOINTS_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeExceptionBAD_BOUNDARYPOINTS_ERR), (intptr_t)0 },
+    { "INVALID_NODE_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeExceptionINVALID_NODE_TYPE_ERR), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -82,7 +82,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -105,9 +105,9 @@ bool JSRangeExceptionConstructor::getOwnPropertyDescriptor(ExecState* exec, cons
 
 static const HashTableValue JSRangeExceptionPrototypeTableValues[4] =
 {
-    { "BAD_BOUNDARYPOINTS_ERR", DontDelete|ReadOnly, (intptr_t)jsRangeExceptionBAD_BOUNDARYPOINTS_ERR, (intptr_t)0 },
-    { "INVALID_NODE_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)jsRangeExceptionINVALID_NODE_TYPE_ERR, (intptr_t)0 },
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsRangeExceptionPrototypeFunctionToString, (intptr_t)0 },
+    { "BAD_BOUNDARYPOINTS_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeExceptionBAD_BOUNDARYPOINTS_ERR), (intptr_t)0 },
+    { "INVALID_NODE_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRangeExceptionINVALID_NODE_TYPE_ERR), (intptr_t)0 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsRangeExceptionPrototypeFunctionToString), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -163,33 +163,36 @@ bool JSRangeException::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSRangeException, Base>(exec, &JSRangeExceptionTable, this, propertyName, descriptor);
 }
 
-JSValue jsRangeExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeExceptionCode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRangeException* castedThis = static_cast<JSRangeException*>(asObject(slot.slotBase()));
+    JSRangeException* castedThis = static_cast<JSRangeException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     RangeException* imp = static_cast<RangeException*>(castedThis->impl());
-    return jsNumber(exec, imp->code());
+    JSValue result = jsNumber(exec, imp->code());
+    return result;
 }
 
-JSValue jsRangeExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeExceptionName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRangeException* castedThis = static_cast<JSRangeException*>(asObject(slot.slotBase()));
+    JSRangeException* castedThis = static_cast<JSRangeException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     RangeException* imp = static_cast<RangeException*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsRangeExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeExceptionMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRangeException* castedThis = static_cast<JSRangeException*>(asObject(slot.slotBase()));
+    JSRangeException* castedThis = static_cast<JSRangeException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     RangeException* imp = static_cast<RangeException*>(castedThis->impl());
-    return jsString(exec, imp->message());
+    JSValue result = jsString(exec, imp->message());
+    return result;
 }
 
-JSValue jsRangeExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRangeException* domObject = static_cast<JSRangeException*>(asObject(slot.slotBase()));
+    JSRangeException* domObject = static_cast<JSRangeException*>(asObject(slotBase));
     return JSRangeException::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSRangeException::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -212,12 +215,12 @@ JSValue JSC_HOST_CALL jsRangeExceptionPrototypeFunctionToString(ExecState* exec,
 
 // Constant getters
 
-JSValue jsRangeExceptionBAD_BOUNDARYPOINTS_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeExceptionBAD_BOUNDARYPOINTS_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsRangeExceptionINVALID_NODE_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeExceptionINVALID_NODE_TYPE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRangeException.h b/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
index 1a9e2ae414..a8908d09a4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
@@ -21,7 +21,6 @@
 #ifndef JSRangeException_h
 #define JSRangeException_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -68,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSRangeExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,14 +79,14 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsRangeExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsRangeExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeExceptionCode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeExceptionName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeExceptionMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsRangeExceptionBAD_BOUNDARYPOINTS_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRangeExceptionINVALID_NODE_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeExceptionBAD_BOUNDARYPOINTS_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRangeExceptionINVALID_NODE_TYPE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
index e57d6882ba..f36ddb4433 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
@@ -36,11 +36,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSRect);
 
 static const HashTableValue JSRectTableValues[6] =
 {
-    { "top", DontDelete|ReadOnly, (intptr_t)jsRectTop, (intptr_t)0 },
-    { "right", DontDelete|ReadOnly, (intptr_t)jsRectRight, (intptr_t)0 },
-    { "bottom", DontDelete|ReadOnly, (intptr_t)jsRectBottom, (intptr_t)0 },
-    { "left", DontDelete|ReadOnly, (intptr_t)jsRectLeft, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsRectConstructor, (intptr_t)0 },
+    { "top", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRectTop), (intptr_t)0 },
+    { "right", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRectRight), (intptr_t)0 },
+    { "bottom", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRectBottom), (intptr_t)0 },
+    { "left", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRectLeft), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsRectConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -147,41 +147,45 @@ bool JSRect::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propert
     return getStaticValueDescriptor<JSRect, Base>(exec, &JSRectTable, this, propertyName, descriptor);
 }
 
-JSValue jsRectTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRectTop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRect* castedThis = static_cast<JSRect*>(asObject(slot.slotBase()));
+    JSRect* castedThis = static_cast<JSRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Rect* imp = static_cast<Rect*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->top()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->top()));
+    return result;
 }
 
-JSValue jsRectRight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRectRight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRect* castedThis = static_cast<JSRect*>(asObject(slot.slotBase()));
+    JSRect* castedThis = static_cast<JSRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Rect* imp = static_cast<Rect*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->right()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->right()));
+    return result;
 }
 
-JSValue jsRectBottom(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRectBottom(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRect* castedThis = static_cast<JSRect*>(asObject(slot.slotBase()));
+    JSRect* castedThis = static_cast<JSRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Rect* imp = static_cast<Rect*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->bottom()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->bottom()));
+    return result;
 }
 
-JSValue jsRectLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRectLeft(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRect* castedThis = static_cast<JSRect*>(asObject(slot.slotBase()));
+    JSRect* castedThis = static_cast<JSRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Rect* imp = static_cast<Rect*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->left()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->left()));
+    return result;
 }
 
-JSValue jsRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRectConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSRect* domObject = static_cast<JSRect*>(asObject(slot.slotBase()));
+    JSRect* domObject = static_cast<JSRect*>(asObject(slotBase));
     return JSRect::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSRect::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRect.h b/src/3rdparty/webkit/WebCore/generated/JSRect.h
index 476a5a2900..1e75c6d928 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRect.h
@@ -21,7 +21,6 @@
 #ifndef JSRect_h
 #define JSRect_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -66,7 +65,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSRectPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,11 +74,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsRectTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRectRight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRectBottom(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRectLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRectTop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRectRight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRectBottom(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRectLeft(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsRectConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
index 79fdc893f9..59f2d02232 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
@@ -40,8 +40,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSSQLError);
 
 static const HashTableValue JSSQLErrorTableValues[3] =
 {
-    { "code", DontDelete|ReadOnly, (intptr_t)jsSQLErrorCode, (intptr_t)0 },
-    { "message", DontDelete|ReadOnly, (intptr_t)jsSQLErrorMessage, (intptr_t)0 },
+    { "code", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSQLErrorCode), (intptr_t)0 },
+    { "message", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSQLErrorMessage), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -101,20 +101,22 @@ bool JSSQLError::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     return getStaticValueDescriptor<JSSQLError, Base>(exec, &JSSQLErrorTable, this, propertyName, descriptor);
 }
 
-JSValue jsSQLErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLErrorCode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSQLError* castedThis = static_cast<JSSQLError*>(asObject(slot.slotBase()));
+    JSSQLError* castedThis = static_cast<JSSQLError*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SQLError* imp = static_cast<SQLError*>(castedThis->impl());
-    return jsNumber(exec, imp->code());
+    JSValue result = jsNumber(exec, imp->code());
+    return result;
 }
 
-JSValue jsSQLErrorMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLErrorMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSQLError* castedThis = static_cast<JSSQLError*>(asObject(slot.slotBase()));
+    JSSQLError* castedThis = static_cast<JSSQLError*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SQLError* imp = static_cast<SQLError*>(castedThis->impl());
-    return jsString(exec, imp->message());
+    JSValue result = jsString(exec, imp->message());
+    return result;
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SQLError* object)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLError.h b/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
index 536845262d..25731d4bbf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(DATABASE)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     SQLError* impl() const { return m_impl.get(); }
@@ -67,7 +66,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSQLErrorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -76,8 +75,8 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSQLErrorCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSQLErrorMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSQLErrorCode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSQLErrorMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
index fa85ad64d6..0a7da45f49 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
@@ -40,9 +40,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSSQLResultSet);
 
 static const HashTableValue JSSQLResultSetTableValues[4] =
 {
-    { "rows", DontDelete|ReadOnly, (intptr_t)jsSQLResultSetRows, (intptr_t)0 },
-    { "insertId", DontDelete|ReadOnly, (intptr_t)jsSQLResultSetInsertId, (intptr_t)0 },
-    { "rowsAffected", DontDelete|ReadOnly, (intptr_t)jsSQLResultSetRowsAffected, (intptr_t)0 },
+    { "rows", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSQLResultSetRows), (intptr_t)0 },
+    { "insertId", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSQLResultSetInsertId), (intptr_t)0 },
+    { "rowsAffected", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSQLResultSetRowsAffected), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -102,17 +102,18 @@ bool JSSQLResultSet::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSSQLResultSet, Base>(exec, &JSSQLResultSetTable, this, propertyName, descriptor);
 }
 
-JSValue jsSQLResultSetRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLResultSetRows(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSQLResultSet* castedThis = static_cast<JSSQLResultSet*>(asObject(slot.slotBase()));
+    JSSQLResultSet* castedThis = static_cast<JSSQLResultSet*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SQLResultSet* imp = static_cast<SQLResultSet*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->rows()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->rows()));
+    return result;
 }
 
-JSValue jsSQLResultSetInsertId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLResultSetInsertId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSQLResultSet* castedThis = static_cast<JSSQLResultSet*>(asObject(slot.slotBase()));
+    JSSQLResultSet* castedThis = static_cast<JSSQLResultSet*>(asObject(slotBase));
     ExceptionCode ec = 0;
     SQLResultSet* imp = static_cast<SQLResultSet*>(castedThis->impl());
     JSC::JSValue result = jsNumber(exec, imp->insertId(ec));
@@ -120,12 +121,13 @@ JSValue jsSQLResultSetInsertId(ExecState* exec, const Identifier&, const Propert
     return result;
 }
 
-JSValue jsSQLResultSetRowsAffected(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLResultSetRowsAffected(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSQLResultSet* castedThis = static_cast<JSSQLResultSet*>(asObject(slot.slotBase()));
+    JSSQLResultSet* castedThis = static_cast<JSSQLResultSet*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SQLResultSet* imp = static_cast<SQLResultSet*>(castedThis->impl());
-    return jsNumber(exec, imp->rowsAffected());
+    JSValue result = jsNumber(exec, imp->rowsAffected());
+    return result;
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SQLResultSet* object)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
index b1551f240c..b400dfe4ee 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(DATABASE)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     SQLResultSet* impl() const { return m_impl.get(); }
@@ -67,7 +66,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSQLResultSetPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -76,9 +75,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSQLResultSetRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSQLResultSetInsertId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSQLResultSetRowsAffected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSQLResultSetRows(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSQLResultSetInsertId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSQLResultSetRowsAffected(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp
index 090e4f7323..3a66624e6a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp
@@ -39,7 +39,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSSQLResultSetRowList);
 
 static const HashTableValue JSSQLResultSetRowListTableValues[2] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsSQLResultSetRowListLength, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSQLResultSetRowListLength), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -54,7 +54,7 @@ static JSC_CONST_HASHTABLE HashTable JSSQLResultSetRowListTable =
 
 static const HashTableValue JSSQLResultSetRowListPrototypeTableValues[2] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsSQLResultSetRowListPrototypeFunctionItem, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSQLResultSetRowListPrototypeFunctionItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -110,12 +110,13 @@ bool JSSQLResultSetRowList::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSSQLResultSetRowList, Base>(exec, &JSSQLResultSetRowListTable, this, propertyName, descriptor);
 }
 
-JSValue jsSQLResultSetRowListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLResultSetRowListLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSQLResultSetRowList* castedThis = static_cast<JSSQLResultSetRowList*>(asObject(slot.slotBase()));
+    JSSQLResultSetRowList* castedThis = static_cast<JSSQLResultSetRowList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SQLResultSetRowList* imp = static_cast<SQLResultSetRowList*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
 JSValue JSC_HOST_CALL jsSQLResultSetRowListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
index 67b8fd2cd3..9fd72c9398 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(DATABASE)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 
@@ -72,7 +71,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSQLResultSetRowListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -84,7 +83,7 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSQLResultSetRowListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSQLResultSetRowListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSQLResultSetRowListLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp
index e165dad4f7..e84cb4e67e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp
@@ -38,7 +38,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSSQLTransaction);
 
 static const HashTableValue JSSQLTransactionPrototypeTableValues[2] =
 {
-    { "executeSql", DontDelete|Function, (intptr_t)jsSQLTransactionPrototypeFunctionExecuteSql, (intptr_t)4 },
+    { "executeSql", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSQLTransactionPrototypeFunctionExecuteSql), (intptr_t)4 },
     { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
index 7438597812..98467ec656 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(DATABASE)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 
@@ -70,7 +69,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSQLTransactionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp
index da1045d048..9646194d86 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp
@@ -52,21 +52,22 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGAElementTableValues[14] =
-{
-    { "target", DontDelete|ReadOnly, (intptr_t)jsSVGAElementTarget, (intptr_t)0 },
-    { "href", DontDelete|ReadOnly, (intptr_t)jsSVGAElementHref, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGAElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGAElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGAElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGAElementXmllang, (intptr_t)setJSSVGAElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGAElementXmlspace, (intptr_t)setJSSVGAElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGAElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGAElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGAElementStyle, (intptr_t)0 },
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGAElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGAElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGAElementFarthestViewportElement, (intptr_t)0 },
+static const HashTableValue JSSVGAElementTableValues[15] =
+{
+    { "target", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAElementTarget), (intptr_t)0 },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAElementHref), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAElementXmllang), (intptr_t)setJSSVGAElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAElementXmlspace), (intptr_t)setJSSVGAElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAElementStyle), (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAElementFarthestViewportElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -74,19 +75,66 @@ static JSC_CONST_HASHTABLE HashTable JSSVGAElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 127, JSSVGAElementTableValues, 0 };
 #else
-    { 33, 31, JSSVGAElementTableValues, 0 };
+    { 34, 31, JSSVGAElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAElementConstructorTableValues, 0 };
 #endif
 
+class JSSVGAElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGAElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAElementConstructor::s_info = { "SVGAElementConstructor", 0, &JSSVGAElementConstructorTable, 0 };
+
+bool JSSVGAElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAElementConstructor, DOMObject>(exec, &JSSVGAElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAElementConstructor, DOMObject>(exec, &JSSVGAElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAElementPrototypeTableValues[7] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGAElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGAElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGAElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGAElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGAElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGAElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -136,115 +184,133 @@ bool JSSVGAElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSSVGAElement, Base>(exec, &JSSVGAElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementTarget(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slot.slotBase()));
+    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->targetAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGAElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slot.slotBase()));
+    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGAElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slot.slotBase()));
+    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGAElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slot.slotBase()));
+    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGAElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slot.slotBase()));
+    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGAElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slot.slotBase()));
+    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGAElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slot.slotBase()));
+    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGAElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slot.slotBase()));
+    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGAElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slot.slotBase()));
+    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGAElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slot.slotBase()));
+    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGAElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slot.slotBase()));
+    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGAElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slot.slotBase()));
+    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGAElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slot.slotBase()));
+    JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
+JSValue jsSVGAElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAElement* domObject = static_cast<JSSVGAElement*>(asObject(slotBase));
+    return JSSVGAElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGAElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAElement, Base>(exec, propertyName, value, &JSSVGAElementTable, this, slot);
@@ -252,16 +318,23 @@ void JSSVGAElement::put(ExecState* exec, const Identifier& propertyName, JSValue
 
 void setJSSVGAElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(thisObject)->impl());
+    JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(thisObject);
+    SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGAElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(thisObject)->impl());
+    JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(thisObject);
+    SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGAElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -299,7 +372,7 @@ JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetBBox(ExecState* exec, JSO
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -312,7 +385,7 @@ JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetCTM(ExecState* exec, JSOb
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -325,7 +398,7 @@ JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetScreenCTM(ExecState* exec
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -340,7 +413,7 @@ JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetTransformToElement(ExecSt
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
index f54337b402..7cb78a5707 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,21 +79,22 @@ JSC::JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetScreenCTM(JSC::ExecS
 JSC::JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGAElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementTarget(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGAElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGAElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGAElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGAElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp
index 40e8262d79..fec0bc8d6f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp
@@ -38,21 +38,69 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAltGlyphElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGAltGlyphElementTableValues[4] =
+static const HashTableValue JSSVGAltGlyphElementTableValues[5] =
 {
-    { "glyphRef", DontDelete, (intptr_t)jsSVGAltGlyphElementGlyphRef, (intptr_t)setJSSVGAltGlyphElementGlyphRef },
-    { "format", DontDelete, (intptr_t)jsSVGAltGlyphElementFormat, (intptr_t)setJSSVGAltGlyphElementFormat },
-    { "href", DontDelete|ReadOnly, (intptr_t)jsSVGAltGlyphElementHref, (intptr_t)0 },
+    { "glyphRef", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAltGlyphElementGlyphRef), (intptr_t)setJSSVGAltGlyphElementGlyphRef },
+    { "format", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAltGlyphElementFormat), (intptr_t)setJSSVGAltGlyphElementFormat },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAltGlyphElementHref), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAltGlyphElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGAltGlyphElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 3, JSSVGAltGlyphElementTableValues, 0 };
+    { 7, JSSVGAltGlyphElementTableValues, 0 };
 #else
     { 8, 7, JSSVGAltGlyphElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAltGlyphElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAltGlyphElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAltGlyphElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAltGlyphElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGAltGlyphElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGAltGlyphElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAltGlyphElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAltGlyphElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAltGlyphElementConstructor::s_info = { "SVGAltGlyphElementConstructor", 0, &JSSVGAltGlyphElementConstructorTable, 0 };
+
+bool JSSVGAltGlyphElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAltGlyphElementConstructor, DOMObject>(exec, &JSSVGAltGlyphElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAltGlyphElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAltGlyphElementConstructor, DOMObject>(exec, &JSSVGAltGlyphElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAltGlyphElementPrototypeTableValues[1] =
@@ -96,31 +144,39 @@ bool JSSVGAltGlyphElement::getOwnPropertyDescriptor(ExecState* exec, const Ident
     return getStaticValueDescriptor<JSSVGAltGlyphElement, Base>(exec, &JSSVGAltGlyphElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAltGlyphElementGlyphRef(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAltGlyphElementGlyphRef(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAltGlyphElement* castedThis = static_cast<JSSVGAltGlyphElement*>(asObject(slot.slotBase()));
+    JSSVGAltGlyphElement* castedThis = static_cast<JSSVGAltGlyphElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(castedThis->impl());
-    return jsString(exec, imp->glyphRef());
+    JSValue result = jsString(exec, imp->glyphRef());
+    return result;
 }
 
-JSValue jsSVGAltGlyphElementFormat(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAltGlyphElementFormat(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAltGlyphElement* castedThis = static_cast<JSSVGAltGlyphElement*>(asObject(slot.slotBase()));
+    JSSVGAltGlyphElement* castedThis = static_cast<JSSVGAltGlyphElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(castedThis->impl());
-    return jsString(exec, imp->format());
+    JSValue result = jsString(exec, imp->format());
+    return result;
 }
 
-JSValue jsSVGAltGlyphElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAltGlyphElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAltGlyphElement* castedThis = static_cast<JSSVGAltGlyphElement*>(asObject(slot.slotBase()));
+    JSSVGAltGlyphElement* castedThis = static_cast<JSSVGAltGlyphElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
+JSValue jsSVGAltGlyphElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAltGlyphElement* domObject = static_cast<JSSVGAltGlyphElement*>(asObject(slotBase));
+    return JSSVGAltGlyphElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGAltGlyphElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAltGlyphElement, Base>(exec, propertyName, value, &JSSVGAltGlyphElementTable, this, slot);
@@ -128,7 +184,8 @@ void JSSVGAltGlyphElement::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSSVGAltGlyphElementGlyphRef(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(static_cast<JSSVGAltGlyphElement*>(thisObject)->impl());
+    JSSVGAltGlyphElement* castedThisObj = static_cast<JSSVGAltGlyphElement*>(thisObject);
+    SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setGlyphRef(value.toString(exec), ec);
     setDOMException(exec, ec);
@@ -136,12 +193,18 @@ void setJSSVGAltGlyphElementGlyphRef(ExecState* exec, JSObject* thisObject, JSVa
 
 void setJSSVGAltGlyphElementFormat(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(static_cast<JSSVGAltGlyphElement*>(thisObject)->impl());
+    JSSVGAltGlyphElement* castedThisObj = static_cast<JSSVGAltGlyphElement*>(thisObject);
+    SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setFormat(value.toString(exec), ec);
     setDOMException(exec, ec);
 }
 
+JSValue JSSVGAltGlyphElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAltGlyphElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
index 050f980cdd..28190f4764 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAltGlyphElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,11 +69,12 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGAltGlyphElementGlyphRef(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAltGlyphElementGlyphRef(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGAltGlyphElementGlyphRef(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGAltGlyphElementFormat(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAltGlyphElementFormat(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGAltGlyphElementFormat(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGAltGlyphElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAltGlyphElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAltGlyphElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
index e6d47956d2..28cbcfbc04 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
@@ -41,11 +41,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAngle);
 
 static const HashTableValue JSSVGAngleTableValues[6] =
 {
-    { "unitType", DontDelete|ReadOnly, (intptr_t)jsSVGAngleUnitType, (intptr_t)0 },
-    { "value", DontDelete, (intptr_t)jsSVGAngleValue, (intptr_t)setJSSVGAngleValue },
-    { "valueInSpecifiedUnits", DontDelete, (intptr_t)jsSVGAngleValueInSpecifiedUnits, (intptr_t)setJSSVGAngleValueInSpecifiedUnits },
-    { "valueAsString", DontDelete, (intptr_t)jsSVGAngleValueAsString, (intptr_t)setJSSVGAngleValueAsString },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGAngleConstructor, (intptr_t)0 },
+    { "unitType", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAngleUnitType), (intptr_t)0 },
+    { "value", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAngleValue), (intptr_t)setJSSVGAngleValue },
+    { "valueInSpecifiedUnits", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAngleValueInSpecifiedUnits), (intptr_t)setJSSVGAngleValueInSpecifiedUnits },
+    { "valueAsString", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAngleValueAsString), (intptr_t)setJSSVGAngleValueAsString },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAngleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -60,11 +60,11 @@ static JSC_CONST_HASHTABLE HashTable JSSVGAngleTable =
 
 static const HashTableValue JSSVGAngleConstructorTableValues[6] =
 {
-    { "SVG_ANGLETYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGAngleSVG_ANGLETYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_ANGLETYPE_UNSPECIFIED", DontDelete|ReadOnly, (intptr_t)jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED, (intptr_t)0 },
-    { "SVG_ANGLETYPE_DEG", DontDelete|ReadOnly, (intptr_t)jsSVGAngleSVG_ANGLETYPE_DEG, (intptr_t)0 },
-    { "SVG_ANGLETYPE_RAD", DontDelete|ReadOnly, (intptr_t)jsSVGAngleSVG_ANGLETYPE_RAD, (intptr_t)0 },
-    { "SVG_ANGLETYPE_GRAD", DontDelete|ReadOnly, (intptr_t)jsSVGAngleSVG_ANGLETYPE_GRAD, (intptr_t)0 },
+    { "SVG_ANGLETYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAngleSVG_ANGLETYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_ANGLETYPE_UNSPECIFIED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED), (intptr_t)0 },
+    { "SVG_ANGLETYPE_DEG", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAngleSVG_ANGLETYPE_DEG), (intptr_t)0 },
+    { "SVG_ANGLETYPE_RAD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAngleSVG_ANGLETYPE_RAD), (intptr_t)0 },
+    { "SVG_ANGLETYPE_GRAD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAngleSVG_ANGLETYPE_GRAD), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -89,7 +89,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -112,13 +112,13 @@ bool JSSVGAngleConstructor::getOwnPropertyDescriptor(ExecState* exec, const Iden
 
 static const HashTableValue JSSVGAnglePrototypeTableValues[8] =
 {
-    { "SVG_ANGLETYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGAngleSVG_ANGLETYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_ANGLETYPE_UNSPECIFIED", DontDelete|ReadOnly, (intptr_t)jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED, (intptr_t)0 },
-    { "SVG_ANGLETYPE_DEG", DontDelete|ReadOnly, (intptr_t)jsSVGAngleSVG_ANGLETYPE_DEG, (intptr_t)0 },
-    { "SVG_ANGLETYPE_RAD", DontDelete|ReadOnly, (intptr_t)jsSVGAngleSVG_ANGLETYPE_RAD, (intptr_t)0 },
-    { "SVG_ANGLETYPE_GRAD", DontDelete|ReadOnly, (intptr_t)jsSVGAngleSVG_ANGLETYPE_GRAD, (intptr_t)0 },
-    { "newValueSpecifiedUnits", DontDelete|Function, (intptr_t)jsSVGAnglePrototypeFunctionNewValueSpecifiedUnits, (intptr_t)2 },
-    { "convertToSpecifiedUnits", DontDelete|Function, (intptr_t)jsSVGAnglePrototypeFunctionConvertToSpecifiedUnits, (intptr_t)1 },
+    { "SVG_ANGLETYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAngleSVG_ANGLETYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_ANGLETYPE_UNSPECIFIED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED), (intptr_t)0 },
+    { "SVG_ANGLETYPE_DEG", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAngleSVG_ANGLETYPE_DEG), (intptr_t)0 },
+    { "SVG_ANGLETYPE_RAD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAngleSVG_ANGLETYPE_RAD), (intptr_t)0 },
+    { "SVG_ANGLETYPE_GRAD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAngleSVG_ANGLETYPE_GRAD), (intptr_t)0 },
+    { "newValueSpecifiedUnits", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAnglePrototypeFunctionNewValueSpecifiedUnits), (intptr_t)2 },
+    { "convertToSpecifiedUnits", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAnglePrototypeFunctionConvertToSpecifiedUnits), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -148,8 +148,8 @@ bool JSSVGAnglePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identi
 
 const ClassInfo JSSVGAngle::s_info = { "SVGAngle", 0, &JSSVGAngleTable, 0 };
 
-JSSVGAngle::JSSVGAngle(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAngle> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGAngle::JSSVGAngle(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<SVGAngle> > impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -157,6 +157,7 @@ JSSVGAngle::JSSVGAngle(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject
 JSSVGAngle::~JSSVGAngle()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGAngle::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -174,42 +175,46 @@ bool JSSVGAngle::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     return getStaticValueDescriptor<JSSVGAngle, Base>(exec, &JSSVGAngleTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAngleUnitType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAngleUnitType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAngle* castedThis = static_cast<JSSVGAngle*>(asObject(slot.slotBase()));
+    JSSVGAngle* castedThis = static_cast<JSSVGAngle*>(asObject(slotBase));
     UNUSED_PARAM(exec);
-    SVGAngle* imp = static_cast<SVGAngle*>(castedThis->impl());
-    return jsNumber(exec, imp->unitType());
+    SVGAngle imp(*castedThis->impl());
+    JSValue result =  jsNumber(exec, imp.unitType());
+    return result;
 }
 
-JSValue jsSVGAngleValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAngleValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAngle* castedThis = static_cast<JSSVGAngle*>(asObject(slot.slotBase()));
+    JSSVGAngle* castedThis = static_cast<JSSVGAngle*>(asObject(slotBase));
     UNUSED_PARAM(exec);
-    SVGAngle* imp = static_cast<SVGAngle*>(castedThis->impl());
-    return jsNumber(exec, imp->value());
+    SVGAngle imp(*castedThis->impl());
+    JSValue result =  jsNumber(exec, imp.value());
+    return result;
 }
 
-JSValue jsSVGAngleValueInSpecifiedUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAngleValueInSpecifiedUnits(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAngle* castedThis = static_cast<JSSVGAngle*>(asObject(slot.slotBase()));
+    JSSVGAngle* castedThis = static_cast<JSSVGAngle*>(asObject(slotBase));
     UNUSED_PARAM(exec);
-    SVGAngle* imp = static_cast<SVGAngle*>(castedThis->impl());
-    return jsNumber(exec, imp->valueInSpecifiedUnits());
+    SVGAngle imp(*castedThis->impl());
+    JSValue result =  jsNumber(exec, imp.valueInSpecifiedUnits());
+    return result;
 }
 
-JSValue jsSVGAngleValueAsString(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAngleValueAsString(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAngle* castedThis = static_cast<JSSVGAngle*>(asObject(slot.slotBase()));
+    JSSVGAngle* castedThis = static_cast<JSSVGAngle*>(asObject(slotBase));
     UNUSED_PARAM(exec);
-    SVGAngle* imp = static_cast<SVGAngle*>(castedThis->impl());
-    return jsString(exec, imp->valueAsString());
+    SVGAngle imp(*castedThis->impl());
+    JSValue result =  jsString(exec, imp.valueAsString());
+    return result;
 }
 
-JSValue jsSVGAngleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAngleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    UNUSED_PARAM(slot);
-    return JSSVGAngle::getConstructor(exec, deprecatedGlobalObjectForPrototype(exec));
+    JSSVGAngle* domObject = static_cast<JSSVGAngle*>(asObject(slotBase));
+    return JSSVGAngle::getConstructor(exec, domObject->globalObject());
 }
 void JSSVGAngle::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
@@ -218,26 +223,29 @@ void JSSVGAngle::put(ExecState* exec, const Identifier& propertyName, JSValue va
 
 void setJSSVGAngleValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(thisObject)->impl());
-    imp->setValue(value.toFloat(exec));
-    if (static_cast<JSSVGAngle*>(thisObject)->context())
-        static_cast<JSSVGAngle*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAngle*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGAngle* castedThisObj = static_cast<JSSVGAngle*>(thisObject);
+    JSSVGPODTypeWrapper<SVGAngle> * imp = static_cast<JSSVGPODTypeWrapper<SVGAngle> *>(castedThisObj->impl());
+    SVGAngle podImp(*imp);
+    podImp.setValue(value.toFloat(exec));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 void setJSSVGAngleValueInSpecifiedUnits(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(thisObject)->impl());
-    imp->setValueInSpecifiedUnits(value.toFloat(exec));
-    if (static_cast<JSSVGAngle*>(thisObject)->context())
-        static_cast<JSSVGAngle*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAngle*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGAngle* castedThisObj = static_cast<JSSVGAngle*>(thisObject);
+    JSSVGPODTypeWrapper<SVGAngle> * imp = static_cast<JSSVGPODTypeWrapper<SVGAngle> *>(castedThisObj->impl());
+    SVGAngle podImp(*imp);
+    podImp.setValueInSpecifiedUnits(value.toFloat(exec));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 void setJSSVGAngleValueAsString(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(thisObject)->impl());
-    imp->setValueAsString(valueToStringWithNullCheck(exec, value));
-    if (static_cast<JSSVGAngle*>(thisObject)->context())
-        static_cast<JSSVGAngle*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAngle*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGAngle* castedThisObj = static_cast<JSSVGAngle*>(thisObject);
+    JSSVGPODTypeWrapper<SVGAngle> * imp = static_cast<JSSVGPODTypeWrapper<SVGAngle> *>(castedThisObj->impl());
+    SVGAngle podImp(*imp);
+    podImp.setValueAsString(valueToStringWithNullCheck(exec, value));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 JSValue JSSVGAngle::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -251,11 +259,13 @@ JSValue JSC_HOST_CALL jsSVGAnglePrototypeFunctionNewValueSpecifiedUnits(ExecStat
     if (!thisValue.inherits(&JSSVGAngle::s_info))
         return throwError(exec, TypeError);
     JSSVGAngle* castedThisObj = static_cast<JSSVGAngle*>(asObject(thisValue));
-    SVGAngle* imp = static_cast<SVGAngle*>(castedThisObj->impl());
+    JSSVGPODTypeWrapper<SVGAngle> * imp = static_cast<JSSVGPODTypeWrapper<SVGAngle> *>(castedThisObj->impl());
+    SVGAngle podImp(*imp);
     unsigned short unitType = args.at(0).toInt32(exec);
     float valueInSpecifiedUnits = args.at(1).toFloat(exec);
 
-    imp->newValueSpecifiedUnits(unitType, valueInSpecifiedUnits);
+    podImp.newValueSpecifiedUnits(unitType, valueInSpecifiedUnits);
+    imp->commitChange(podImp, castedThisObj);
     return jsUndefined();
 }
 
@@ -265,47 +275,49 @@ JSValue JSC_HOST_CALL jsSVGAnglePrototypeFunctionConvertToSpecifiedUnits(ExecSta
     if (!thisValue.inherits(&JSSVGAngle::s_info))
         return throwError(exec, TypeError);
     JSSVGAngle* castedThisObj = static_cast<JSSVGAngle*>(asObject(thisValue));
-    SVGAngle* imp = static_cast<SVGAngle*>(castedThisObj->impl());
+    JSSVGPODTypeWrapper<SVGAngle> * imp = static_cast<JSSVGPODTypeWrapper<SVGAngle> *>(castedThisObj->impl());
+    SVGAngle podImp(*imp);
     unsigned short unitType = args.at(0).toInt32(exec);
 
-    imp->convertToSpecifiedUnits(unitType);
+    podImp.convertToSpecifiedUnits(unitType);
+    imp->commitChange(podImp, castedThisObj);
     return jsUndefined();
 }
 
 // Constant getters
 
-JSValue jsSVGAngleSVG_ANGLETYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGAngleSVG_ANGLETYPE_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGAngleSVG_ANGLETYPE_DEG(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGAngleSVG_ANGLETYPE_DEG(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGAngleSVG_ANGLETYPE_RAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGAngleSVG_ANGLETYPE_RAD(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsSVGAngleSVG_ANGLETYPE_GRAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGAngleSVG_ANGLETYPE_GRAD(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAngle* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JSSVGPODTypeWrapper<SVGAngle>* object, SVGElement* context)
 {
-    return getDOMObjectWrapper<JSSVGAngle>(exec, globalObject, object, context);
+    return getDOMObjectWrapper<JSSVGAngle, JSSVGPODTypeWrapper<SVGAngle> >(exec, globalObject, object, context);
 }
-SVGAngle* toSVGAngle(JSC::JSValue value)
+SVGAngle toSVGAngle(JSC::JSValue value)
 {
-    return value.inherits(&JSSVGAngle::s_info) ? static_cast<JSSVGAngle*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGAngle::s_info) ? (SVGAngle) *static_cast<JSSVGAngle*>(asObject(value))->impl() : SVGAngle();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
index 42fdbbda6d..bbd7ea91a6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
@@ -23,20 +23,19 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
+#include "JSSVGPODTypeWrapper.h"
+#include "SVGAngle.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
 namespace WebCore {
 
-class SVGAngle;
-
-class JSSVGAngle : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGAngle : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGAngle(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAngle>, SVGElement* context);
+    JSSVGAngle(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<JSSVGPODTypeWrapper<SVGAngle> >);
     virtual ~JSSVGAngle();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -47,20 +46,20 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
-    SVGAngle* impl() const { return m_impl.get(); }
+    JSSVGPODTypeWrapper<SVGAngle> * impl() const { return m_impl.get(); }
 
 private:
-    RefPtr<SVGAngle> m_impl;
+    RefPtr<JSSVGPODTypeWrapper<SVGAngle> > m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAngle*, SVGElement* context);
-SVGAngle* toSVGAngle(JSC::JSValue);
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<SVGAngle>*, SVGElement*);
+SVGAngle toSVGAngle(JSC::JSValue);
 
 class JSSVGAnglePrototype : public JSC::JSObject {
     typedef JSC::JSObject Base;
@@ -72,7 +71,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnglePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -85,21 +84,21 @@ JSC::JSValue JSC_HOST_CALL jsSVGAnglePrototypeFunctionNewValueSpecifiedUnits(JSC
 JSC::JSValue JSC_HOST_CALL jsSVGAnglePrototypeFunctionConvertToSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGAngleUnitType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAngleValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleUnitType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAngleValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGAngleValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGAngleValueInSpecifiedUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleValueInSpecifiedUnits(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGAngleValueInSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGAngleValueAsString(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleValueAsString(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGAngleValueAsString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGAngleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGAngleSVG_ANGLETYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAngleSVG_ANGLETYPE_DEG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAngleSVG_ANGLETYPE_RAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAngleSVG_ANGLETYPE_GRAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleSVG_ANGLETYPE_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAngleSVG_ANGLETYPE_DEG(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAngleSVG_ANGLETYPE_RAD(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAngleSVG_ANGLETYPE_GRAD(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.cpp
index 5e93bc8f1e..81cc9c3cfa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimateColorElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGAnimateColorElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimateColorElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimateColorElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimateColorElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGAnimateColorElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAnimateColorElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimateColorElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimateColorElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAnimateColorElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGAnimateColorElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGAnimateColorElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAnimateColorElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAnimateColorElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAnimateColorElementConstructor::s_info = { "SVGAnimateColorElementConstructor", 0, &JSSVGAnimateColorElementConstructorTable, 0 };
+
+bool JSSVGAnimateColorElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimateColorElementConstructor, DOMObject>(exec, &JSSVGAnimateColorElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimateColorElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimateColorElementConstructor, DOMObject>(exec, &JSSVGAnimateColorElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnimateColorElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGAnimateColorElementPrototype::self(ExecState* exec, JSGlobalObjec
     return getDOMPrototype<JSSVGAnimateColorElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGAnimateColorElement::s_info = { "SVGAnimateColorElement", &JSSVGAnimationElement::s_info, 0, 0 };
+const ClassInfo JSSVGAnimateColorElement::s_info = { "SVGAnimateColorElement", &JSSVGAnimationElement::s_info, &JSSVGAnimateColorElementTable, 0 };
 
 JSSVGAnimateColorElement::JSSVGAnimateColorElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimateColorElement> impl)
     : JSSVGAnimationElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGAnimateColorElement::createPrototype(ExecState* exec, JSGlobalObj
     return new (exec) JSSVGAnimateColorElementPrototype(JSSVGAnimateColorElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGAnimateColorElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimateColorElement, Base>(exec, &JSSVGAnimateColorElementTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimateColorElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimateColorElement, Base>(exec, &JSSVGAnimateColorElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGAnimateColorElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAnimateColorElement* domObject = static_cast<JSSVGAnimateColorElement*>(asObject(slotBase));
+    return JSSVGAnimateColorElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGAnimateColorElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAnimateColorElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h
index 52ab586e15..46c2b80f9a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h
@@ -35,16 +35,19 @@ class JSSVGAnimateColorElement : public JSSVGAnimationElement {
 public:
     JSSVGAnimateColorElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimateColorElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimateColorElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGAnimateColorElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.cpp
index 74c10191fa..01bade1f06 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimateElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGAnimateElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimateElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimateElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimateElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGAnimateElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAnimateElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimateElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimateElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAnimateElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGAnimateElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGAnimateElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAnimateElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAnimateElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAnimateElementConstructor::s_info = { "SVGAnimateElementConstructor", 0, &JSSVGAnimateElementConstructorTable, 0 };
+
+bool JSSVGAnimateElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimateElementConstructor, DOMObject>(exec, &JSSVGAnimateElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimateElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimateElementConstructor, DOMObject>(exec, &JSSVGAnimateElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnimateElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGAnimateElementPrototype::self(ExecState* exec, JSGlobalObject* gl
     return getDOMPrototype<JSSVGAnimateElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGAnimateElement::s_info = { "SVGAnimateElement", &JSSVGAnimationElement::s_info, 0, 0 };
+const ClassInfo JSSVGAnimateElement::s_info = { "SVGAnimateElement", &JSSVGAnimationElement::s_info, &JSSVGAnimateElementTable, 0 };
 
 JSSVGAnimateElement::JSSVGAnimateElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimateElement> impl)
     : JSSVGAnimationElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGAnimateElement::createPrototype(ExecState* exec, JSGlobalObject*
     return new (exec) JSSVGAnimateElementPrototype(JSSVGAnimateElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGAnimateElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimateElement, Base>(exec, &JSSVGAnimateElementTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimateElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimateElement, Base>(exec, &JSSVGAnimateElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGAnimateElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAnimateElement* domObject = static_cast<JSSVGAnimateElement*>(asObject(slotBase));
+    return JSSVGAnimateElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGAnimateElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAnimateElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h
index 0ffe6decef..88f9c9d7ff 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h
@@ -35,16 +35,19 @@ class JSSVGAnimateElement : public JSSVGAnimationElement {
 public:
     JSSVGAnimateElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimateElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimateElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGAnimateElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.cpp
index fedfcbc1dc..efe5e63e51 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimateTransformElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGAnimateTransformElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimateTransformElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimateTransformElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimateTransformElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGAnimateTransformElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAnimateTransformElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimateTransformElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimateTransformElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAnimateTransformElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGAnimateTransformElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGAnimateTransformElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAnimateTransformElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAnimateTransformElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAnimateTransformElementConstructor::s_info = { "SVGAnimateTransformElementConstructor", 0, &JSSVGAnimateTransformElementConstructorTable, 0 };
+
+bool JSSVGAnimateTransformElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimateTransformElementConstructor, DOMObject>(exec, &JSSVGAnimateTransformElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimateTransformElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimateTransformElementConstructor, DOMObject>(exec, &JSSVGAnimateTransformElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnimateTransformElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGAnimateTransformElementPrototype::self(ExecState* exec, JSGlobalO
     return getDOMPrototype<JSSVGAnimateTransformElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGAnimateTransformElement::s_info = { "SVGAnimateTransformElement", &JSSVGAnimationElement::s_info, 0, 0 };
+const ClassInfo JSSVGAnimateTransformElement::s_info = { "SVGAnimateTransformElement", &JSSVGAnimationElement::s_info, &JSSVGAnimateTransformElementTable, 0 };
 
 JSSVGAnimateTransformElement::JSSVGAnimateTransformElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimateTransformElement> impl)
     : JSSVGAnimationElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGAnimateTransformElement::createPrototype(ExecState* exec, JSGloba
     return new (exec) JSSVGAnimateTransformElementPrototype(JSSVGAnimateTransformElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGAnimateTransformElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimateTransformElement, Base>(exec, &JSSVGAnimateTransformElementTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimateTransformElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimateTransformElement, Base>(exec, &JSSVGAnimateTransformElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGAnimateTransformElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAnimateTransformElement* domObject = static_cast<JSSVGAnimateTransformElement*>(asObject(slotBase));
+    return JSSVGAnimateTransformElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGAnimateTransformElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAnimateTransformElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h
index 3a99234598..edc8846d91 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h
@@ -35,16 +35,19 @@ class JSSVGAnimateTransformElement : public JSSVGAnimationElement {
 public:
     JSSVGAnimateTransformElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimateTransformElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimateTransformElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGAnimateTransformElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp
index 599f5ca287..4b5b713fec 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp
@@ -25,7 +25,6 @@
 #include "JSSVGAnimatedAngle.h"
 
 #include "JSSVGAngle.h"
-#include "SVGAngle.h"
 #include <wtf/GetPtr.h>
 
 using namespace JSC;
@@ -36,20 +35,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedAngle);
 
 /* Hash table */
 
-static const HashTableValue JSSVGAnimatedAngleTableValues[3] =
+static const HashTableValue JSSVGAnimatedAngleTableValues[4] =
 {
-    { "baseVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedAngleBaseVal, (intptr_t)0 },
-    { "animVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedAngleAnimVal, (intptr_t)0 },
+    { "baseVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedAngleBaseVal), (intptr_t)0 },
+    { "animVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedAngleAnimVal), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedAngleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedAngleTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGAnimatedAngleTableValues, 0 };
+    { 3, JSSVGAnimatedAngleTableValues, 0 };
 #else
-    { 4, 3, JSSVGAnimatedAngleTableValues, 0 };
+    { 8, 7, JSSVGAnimatedAngleTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAnimatedAngleConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedAngleConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimatedAngleConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAnimatedAngleConstructorTableValues, 0 };
+#endif
+
+class JSSVGAnimatedAngleConstructor : public DOMConstructorObject {
+public:
+    JSSVGAnimatedAngleConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAnimatedAngleConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAnimatedAnglePrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAnimatedAngleConstructor::s_info = { "SVGAnimatedAngleConstructor", 0, &JSSVGAnimatedAngleConstructorTable, 0 };
+
+bool JSSVGAnimatedAngleConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimatedAngleConstructor, DOMObject>(exec, &JSSVGAnimatedAngleConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimatedAngleConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedAngleConstructor, DOMObject>(exec, &JSSVGAnimatedAngleConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnimatedAnglePrototypeTableValues[1] =
@@ -73,8 +120,8 @@ JSObject* JSSVGAnimatedAnglePrototype::self(ExecState* exec, JSGlobalObject* glo
 
 const ClassInfo JSSVGAnimatedAngle::s_info = { "SVGAnimatedAngle", 0, &JSSVGAnimatedAngleTable, 0 };
 
-JSSVGAnimatedAngle::JSSVGAnimatedAngle(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedAngle> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGAnimatedAngle::JSSVGAnimatedAngle(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedAngle> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -82,6 +129,7 @@ JSSVGAnimatedAngle::JSSVGAnimatedAngle(NonNullPassRefPtr<Structure> structure, J
 JSSVGAnimatedAngle::~JSSVGAnimatedAngle()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGAnimatedAngle::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -99,20 +147,32 @@ bool JSSVGAnimatedAngle::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSSVGAnimatedAngle, Base>(exec, &JSSVGAnimatedAngleTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAnimatedAngleBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedAngleBaseVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedAngle* castedThis = static_cast<JSSVGAnimatedAngle*>(asObject(slot.slotBase()));
+    JSSVGAnimatedAngle* castedThis = static_cast<JSSVGAnimatedAngle*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedAngle* imp = static_cast<SVGAnimatedAngle*>(castedThis->impl());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->baseVal()), castedThis->context());
+    JSValue result = toJS(exec, castedThis->globalObject(), JSSVGDynamicPODTypeWrapperCache<SVGAngle, SVGAnimatedAngle>::lookupOrCreateWrapper(imp, &SVGAnimatedAngle::baseVal, &SVGAnimatedAngle::setBaseVal).get(), JSSVGContextCache::svgContextForDOMObject(castedThis));;
+    return result;
 }
 
-JSValue jsSVGAnimatedAngleAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedAngleAnimVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedAngle* castedThis = static_cast<JSSVGAnimatedAngle*>(asObject(slot.slotBase()));
+    JSSVGAnimatedAngle* castedThis = static_cast<JSSVGAnimatedAngle*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedAngle* imp = static_cast<SVGAnimatedAngle*>(castedThis->impl());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->animVal()), castedThis->context());
+    JSValue result = toJS(exec, castedThis->globalObject(), JSSVGDynamicPODTypeWrapperCache<SVGAngle, SVGAnimatedAngle>::lookupOrCreateWrapper(imp, &SVGAnimatedAngle::animVal, &SVGAnimatedAngle::setAnimVal).get(), JSSVGContextCache::svgContextForDOMObject(castedThis));;
+    return result;
+}
+
+JSValue jsSVGAnimatedAngleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAnimatedAngle* domObject = static_cast<JSSVGAnimatedAngle*>(asObject(slotBase));
+    return JSSVGAnimatedAngle::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGAnimatedAngle::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAnimatedAngleConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnimatedAngle* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
index c822dc770f..b349624f84 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -31,10 +30,10 @@
 
 namespace WebCore {
 
-class JSSVGAnimatedAngle : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGAnimatedAngle : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGAnimatedAngle(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedAngle>, SVGElement* context);
+    JSSVGAnimatedAngle(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedAngle>);
     virtual ~JSSVGAnimatedAngle();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -44,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGAnimatedAngle* impl() const { return m_impl.get(); }
 
 private:
@@ -66,7 +66,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimatedAnglePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,8 +75,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGAnimatedAngleBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAnimatedAngleAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedAngleBaseVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedAngleAnimVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedAngleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp
index 131b358697..1d2fb11db2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp
@@ -34,20 +34,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedBoolean);
 
 /* Hash table */
 
-static const HashTableValue JSSVGAnimatedBooleanTableValues[3] =
+static const HashTableValue JSSVGAnimatedBooleanTableValues[4] =
 {
-    { "baseVal", DontDelete, (intptr_t)jsSVGAnimatedBooleanBaseVal, (intptr_t)setJSSVGAnimatedBooleanBaseVal },
-    { "animVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedBooleanAnimVal, (intptr_t)0 },
+    { "baseVal", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedBooleanBaseVal), (intptr_t)setJSSVGAnimatedBooleanBaseVal },
+    { "animVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedBooleanAnimVal), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedBooleanConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedBooleanTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGAnimatedBooleanTableValues, 0 };
+    { 3, JSSVGAnimatedBooleanTableValues, 0 };
 #else
-    { 4, 3, JSSVGAnimatedBooleanTableValues, 0 };
+    { 8, 7, JSSVGAnimatedBooleanTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAnimatedBooleanConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedBooleanConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimatedBooleanConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAnimatedBooleanConstructorTableValues, 0 };
+#endif
+
+class JSSVGAnimatedBooleanConstructor : public DOMConstructorObject {
+public:
+    JSSVGAnimatedBooleanConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAnimatedBooleanConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAnimatedBooleanPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAnimatedBooleanConstructor::s_info = { "SVGAnimatedBooleanConstructor", 0, &JSSVGAnimatedBooleanConstructorTable, 0 };
+
+bool JSSVGAnimatedBooleanConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimatedBooleanConstructor, DOMObject>(exec, &JSSVGAnimatedBooleanConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimatedBooleanConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedBooleanConstructor, DOMObject>(exec, &JSSVGAnimatedBooleanConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnimatedBooleanPrototypeTableValues[1] =
@@ -71,8 +119,8 @@ JSObject* JSSVGAnimatedBooleanPrototype::self(ExecState* exec, JSGlobalObject* g
 
 const ClassInfo JSSVGAnimatedBoolean::s_info = { "SVGAnimatedBoolean", 0, &JSSVGAnimatedBooleanTable, 0 };
 
-JSSVGAnimatedBoolean::JSSVGAnimatedBoolean(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedBoolean> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGAnimatedBoolean::JSSVGAnimatedBoolean(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedBoolean> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -80,6 +128,7 @@ JSSVGAnimatedBoolean::JSSVGAnimatedBoolean(NonNullPassRefPtr<Structure> structur
 JSSVGAnimatedBoolean::~JSSVGAnimatedBoolean()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGAnimatedBoolean::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -97,22 +146,29 @@ bool JSSVGAnimatedBoolean::getOwnPropertyDescriptor(ExecState* exec, const Ident
     return getStaticValueDescriptor<JSSVGAnimatedBoolean, Base>(exec, &JSSVGAnimatedBooleanTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAnimatedBooleanBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedBooleanBaseVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedBoolean* castedThis = static_cast<JSSVGAnimatedBoolean*>(asObject(slot.slotBase()));
+    JSSVGAnimatedBoolean* castedThis = static_cast<JSSVGAnimatedBoolean*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedBoolean* imp = static_cast<SVGAnimatedBoolean*>(castedThis->impl());
-    return jsBoolean(imp->baseVal());
+    JSValue result = jsBoolean(imp->baseVal());
+    return result;
 }
 
-JSValue jsSVGAnimatedBooleanAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedBooleanAnimVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedBoolean* castedThis = static_cast<JSSVGAnimatedBoolean*>(asObject(slot.slotBase()));
+    JSSVGAnimatedBoolean* castedThis = static_cast<JSSVGAnimatedBoolean*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedBoolean* imp = static_cast<SVGAnimatedBoolean*>(castedThis->impl());
-    return jsBoolean(imp->animVal());
+    JSValue result = jsBoolean(imp->animVal());
+    return result;
 }
 
+JSValue jsSVGAnimatedBooleanConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAnimatedBoolean* domObject = static_cast<JSSVGAnimatedBoolean*>(asObject(slotBase));
+    return JSSVGAnimatedBoolean::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGAnimatedBoolean::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAnimatedBoolean, Base>(exec, propertyName, value, &JSSVGAnimatedBooleanTable, this, slot);
@@ -120,10 +176,15 @@ void JSSVGAnimatedBoolean::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSSVGAnimatedBooleanBaseVal(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGAnimatedBoolean* imp = static_cast<SVGAnimatedBoolean*>(static_cast<JSSVGAnimatedBoolean*>(thisObject)->impl());
+    JSSVGAnimatedBoolean* castedThisObj = static_cast<JSSVGAnimatedBoolean*>(thisObject);
+    SVGAnimatedBoolean* imp = static_cast<SVGAnimatedBoolean*>(castedThisObj->impl());
     imp->setBaseVal(value.toBoolean(exec));
-    if (static_cast<JSSVGAnimatedBoolean*>(thisObject)->context())
-        static_cast<JSSVGAnimatedBoolean*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAnimatedBoolean*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGAnimatedBoolean::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAnimatedBooleanConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnimatedBoolean* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
index c6690a269f..c6800065d2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -31,10 +30,10 @@
 
 namespace WebCore {
 
-class JSSVGAnimatedBoolean : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGAnimatedBoolean : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGAnimatedBoolean(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedBoolean>, SVGElement* context);
+    JSSVGAnimatedBoolean(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedBoolean>);
     virtual ~JSSVGAnimatedBoolean();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -45,9 +44,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGAnimatedBoolean* impl() const { return m_impl.get(); }
 
 private:
@@ -67,7 +67,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimatedBooleanPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -76,9 +76,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGAnimatedBooleanBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedBooleanBaseVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGAnimatedBooleanBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGAnimatedBooleanAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedBooleanAnimVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedBooleanConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp
index 6a27988b32..6c3231a9f1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp
@@ -35,20 +35,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedEnumeration);
 
 /* Hash table */
 
-static const HashTableValue JSSVGAnimatedEnumerationTableValues[3] =
+static const HashTableValue JSSVGAnimatedEnumerationTableValues[4] =
 {
-    { "baseVal", DontDelete, (intptr_t)jsSVGAnimatedEnumerationBaseVal, (intptr_t)setJSSVGAnimatedEnumerationBaseVal },
-    { "animVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedEnumerationAnimVal, (intptr_t)0 },
+    { "baseVal", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedEnumerationBaseVal), (intptr_t)setJSSVGAnimatedEnumerationBaseVal },
+    { "animVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedEnumerationAnimVal), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedEnumerationConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedEnumerationTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGAnimatedEnumerationTableValues, 0 };
+    { 3, JSSVGAnimatedEnumerationTableValues, 0 };
 #else
-    { 4, 3, JSSVGAnimatedEnumerationTableValues, 0 };
+    { 8, 7, JSSVGAnimatedEnumerationTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAnimatedEnumerationConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedEnumerationConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimatedEnumerationConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAnimatedEnumerationConstructorTableValues, 0 };
+#endif
+
+class JSSVGAnimatedEnumerationConstructor : public DOMConstructorObject {
+public:
+    JSSVGAnimatedEnumerationConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAnimatedEnumerationConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAnimatedEnumerationPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAnimatedEnumerationConstructor::s_info = { "SVGAnimatedEnumerationConstructor", 0, &JSSVGAnimatedEnumerationConstructorTable, 0 };
+
+bool JSSVGAnimatedEnumerationConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimatedEnumerationConstructor, DOMObject>(exec, &JSSVGAnimatedEnumerationConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimatedEnumerationConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedEnumerationConstructor, DOMObject>(exec, &JSSVGAnimatedEnumerationConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnimatedEnumerationPrototypeTableValues[1] =
@@ -72,8 +120,8 @@ JSObject* JSSVGAnimatedEnumerationPrototype::self(ExecState* exec, JSGlobalObjec
 
 const ClassInfo JSSVGAnimatedEnumeration::s_info = { "SVGAnimatedEnumeration", 0, &JSSVGAnimatedEnumerationTable, 0 };
 
-JSSVGAnimatedEnumeration::JSSVGAnimatedEnumeration(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedEnumeration> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGAnimatedEnumeration::JSSVGAnimatedEnumeration(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedEnumeration> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -81,6 +129,7 @@ JSSVGAnimatedEnumeration::JSSVGAnimatedEnumeration(NonNullPassRefPtr<Structure>
 JSSVGAnimatedEnumeration::~JSSVGAnimatedEnumeration()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGAnimatedEnumeration::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -98,22 +147,29 @@ bool JSSVGAnimatedEnumeration::getOwnPropertyDescriptor(ExecState* exec, const I
     return getStaticValueDescriptor<JSSVGAnimatedEnumeration, Base>(exec, &JSSVGAnimatedEnumerationTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAnimatedEnumerationBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedEnumerationBaseVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedEnumeration* castedThis = static_cast<JSSVGAnimatedEnumeration*>(asObject(slot.slotBase()));
+    JSSVGAnimatedEnumeration* castedThis = static_cast<JSSVGAnimatedEnumeration*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedEnumeration* imp = static_cast<SVGAnimatedEnumeration*>(castedThis->impl());
-    return jsNumber(exec, imp->baseVal());
+    JSValue result = jsNumber(exec, imp->baseVal());
+    return result;
 }
 
-JSValue jsSVGAnimatedEnumerationAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedEnumerationAnimVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedEnumeration* castedThis = static_cast<JSSVGAnimatedEnumeration*>(asObject(slot.slotBase()));
+    JSSVGAnimatedEnumeration* castedThis = static_cast<JSSVGAnimatedEnumeration*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedEnumeration* imp = static_cast<SVGAnimatedEnumeration*>(castedThis->impl());
-    return jsNumber(exec, imp->animVal());
+    JSValue result = jsNumber(exec, imp->animVal());
+    return result;
 }
 
+JSValue jsSVGAnimatedEnumerationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAnimatedEnumeration* domObject = static_cast<JSSVGAnimatedEnumeration*>(asObject(slotBase));
+    return JSSVGAnimatedEnumeration::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGAnimatedEnumeration::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAnimatedEnumeration, Base>(exec, propertyName, value, &JSSVGAnimatedEnumerationTable, this, slot);
@@ -121,10 +177,15 @@ void JSSVGAnimatedEnumeration::put(ExecState* exec, const Identifier& propertyNa
 
 void setJSSVGAnimatedEnumerationBaseVal(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGAnimatedEnumeration* imp = static_cast<SVGAnimatedEnumeration*>(static_cast<JSSVGAnimatedEnumeration*>(thisObject)->impl());
+    JSSVGAnimatedEnumeration* castedThisObj = static_cast<JSSVGAnimatedEnumeration*>(thisObject);
+    SVGAnimatedEnumeration* imp = static_cast<SVGAnimatedEnumeration*>(castedThisObj->impl());
     imp->setBaseVal(value.toInt32(exec));
-    if (static_cast<JSSVGAnimatedEnumeration*>(thisObject)->context())
-        static_cast<JSSVGAnimatedEnumeration*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAnimatedEnumeration*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGAnimatedEnumeration::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAnimatedEnumerationConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnimatedEnumeration* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
index 6f036d5857..9b7a0c8090 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -31,10 +30,10 @@
 
 namespace WebCore {
 
-class JSSVGAnimatedEnumeration : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGAnimatedEnumeration : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGAnimatedEnumeration(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedEnumeration>, SVGElement* context);
+    JSSVGAnimatedEnumeration(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedEnumeration>);
     virtual ~JSSVGAnimatedEnumeration();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -45,9 +44,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGAnimatedEnumeration* impl() const { return m_impl.get(); }
 
 private:
@@ -67,7 +67,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimatedEnumerationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -76,9 +76,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGAnimatedEnumerationBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedEnumerationBaseVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGAnimatedEnumerationBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGAnimatedEnumerationAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedEnumerationAnimVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedEnumerationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp
index 86c388b660..8600be2250 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp
@@ -35,20 +35,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedInteger);
 
 /* Hash table */
 
-static const HashTableValue JSSVGAnimatedIntegerTableValues[3] =
+static const HashTableValue JSSVGAnimatedIntegerTableValues[4] =
 {
-    { "baseVal", DontDelete, (intptr_t)jsSVGAnimatedIntegerBaseVal, (intptr_t)setJSSVGAnimatedIntegerBaseVal },
-    { "animVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedIntegerAnimVal, (intptr_t)0 },
+    { "baseVal", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedIntegerBaseVal), (intptr_t)setJSSVGAnimatedIntegerBaseVal },
+    { "animVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedIntegerAnimVal), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedIntegerConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedIntegerTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGAnimatedIntegerTableValues, 0 };
+    { 3, JSSVGAnimatedIntegerTableValues, 0 };
 #else
-    { 4, 3, JSSVGAnimatedIntegerTableValues, 0 };
+    { 8, 7, JSSVGAnimatedIntegerTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAnimatedIntegerConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedIntegerConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimatedIntegerConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAnimatedIntegerConstructorTableValues, 0 };
+#endif
+
+class JSSVGAnimatedIntegerConstructor : public DOMConstructorObject {
+public:
+    JSSVGAnimatedIntegerConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAnimatedIntegerConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAnimatedIntegerPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAnimatedIntegerConstructor::s_info = { "SVGAnimatedIntegerConstructor", 0, &JSSVGAnimatedIntegerConstructorTable, 0 };
+
+bool JSSVGAnimatedIntegerConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimatedIntegerConstructor, DOMObject>(exec, &JSSVGAnimatedIntegerConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimatedIntegerConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedIntegerConstructor, DOMObject>(exec, &JSSVGAnimatedIntegerConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnimatedIntegerPrototypeTableValues[1] =
@@ -72,8 +120,8 @@ JSObject* JSSVGAnimatedIntegerPrototype::self(ExecState* exec, JSGlobalObject* g
 
 const ClassInfo JSSVGAnimatedInteger::s_info = { "SVGAnimatedInteger", 0, &JSSVGAnimatedIntegerTable, 0 };
 
-JSSVGAnimatedInteger::JSSVGAnimatedInteger(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedInteger> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGAnimatedInteger::JSSVGAnimatedInteger(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedInteger> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -81,6 +129,7 @@ JSSVGAnimatedInteger::JSSVGAnimatedInteger(NonNullPassRefPtr<Structure> structur
 JSSVGAnimatedInteger::~JSSVGAnimatedInteger()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGAnimatedInteger::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -98,22 +147,29 @@ bool JSSVGAnimatedInteger::getOwnPropertyDescriptor(ExecState* exec, const Ident
     return getStaticValueDescriptor<JSSVGAnimatedInteger, Base>(exec, &JSSVGAnimatedIntegerTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAnimatedIntegerBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedIntegerBaseVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedInteger* castedThis = static_cast<JSSVGAnimatedInteger*>(asObject(slot.slotBase()));
+    JSSVGAnimatedInteger* castedThis = static_cast<JSSVGAnimatedInteger*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedInteger* imp = static_cast<SVGAnimatedInteger*>(castedThis->impl());
-    return jsNumber(exec, imp->baseVal());
+    JSValue result = jsNumber(exec, imp->baseVal());
+    return result;
 }
 
-JSValue jsSVGAnimatedIntegerAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedIntegerAnimVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedInteger* castedThis = static_cast<JSSVGAnimatedInteger*>(asObject(slot.slotBase()));
+    JSSVGAnimatedInteger* castedThis = static_cast<JSSVGAnimatedInteger*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedInteger* imp = static_cast<SVGAnimatedInteger*>(castedThis->impl());
-    return jsNumber(exec, imp->animVal());
+    JSValue result = jsNumber(exec, imp->animVal());
+    return result;
 }
 
+JSValue jsSVGAnimatedIntegerConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAnimatedInteger* domObject = static_cast<JSSVGAnimatedInteger*>(asObject(slotBase));
+    return JSSVGAnimatedInteger::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGAnimatedInteger::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAnimatedInteger, Base>(exec, propertyName, value, &JSSVGAnimatedIntegerTable, this, slot);
@@ -121,10 +177,15 @@ void JSSVGAnimatedInteger::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSSVGAnimatedIntegerBaseVal(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGAnimatedInteger* imp = static_cast<SVGAnimatedInteger*>(static_cast<JSSVGAnimatedInteger*>(thisObject)->impl());
+    JSSVGAnimatedInteger* castedThisObj = static_cast<JSSVGAnimatedInteger*>(thisObject);
+    SVGAnimatedInteger* imp = static_cast<SVGAnimatedInteger*>(castedThisObj->impl());
     imp->setBaseVal(value.toInt32(exec));
-    if (static_cast<JSSVGAnimatedInteger*>(thisObject)->context())
-        static_cast<JSSVGAnimatedInteger*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAnimatedInteger*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGAnimatedInteger::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAnimatedIntegerConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnimatedInteger* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
index 113f0b2f68..3ba417dad1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -31,10 +30,10 @@
 
 namespace WebCore {
 
-class JSSVGAnimatedInteger : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGAnimatedInteger : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGAnimatedInteger(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedInteger>, SVGElement* context);
+    JSSVGAnimatedInteger(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedInteger>);
     virtual ~JSSVGAnimatedInteger();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -45,9 +44,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGAnimatedInteger* impl() const { return m_impl.get(); }
 
 private:
@@ -67,7 +67,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimatedIntegerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -76,9 +76,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGAnimatedIntegerBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedIntegerBaseVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGAnimatedIntegerBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGAnimatedIntegerAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedIntegerAnimVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedIntegerConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp
index f5fff5eff6..fe49d1bfd7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp
@@ -35,20 +35,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedLength);
 
 /* Hash table */
 
-static const HashTableValue JSSVGAnimatedLengthTableValues[3] =
+static const HashTableValue JSSVGAnimatedLengthTableValues[4] =
 {
-    { "baseVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedLengthBaseVal, (intptr_t)0 },
-    { "animVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedLengthAnimVal, (intptr_t)0 },
+    { "baseVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedLengthBaseVal), (intptr_t)0 },
+    { "animVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedLengthAnimVal), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedLengthConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedLengthTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGAnimatedLengthTableValues, 0 };
+    { 3, JSSVGAnimatedLengthTableValues, 0 };
 #else
-    { 4, 3, JSSVGAnimatedLengthTableValues, 0 };
+    { 8, 7, JSSVGAnimatedLengthTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAnimatedLengthConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedLengthConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimatedLengthConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAnimatedLengthConstructorTableValues, 0 };
+#endif
+
+class JSSVGAnimatedLengthConstructor : public DOMConstructorObject {
+public:
+    JSSVGAnimatedLengthConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAnimatedLengthConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAnimatedLengthPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAnimatedLengthConstructor::s_info = { "SVGAnimatedLengthConstructor", 0, &JSSVGAnimatedLengthConstructorTable, 0 };
+
+bool JSSVGAnimatedLengthConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimatedLengthConstructor, DOMObject>(exec, &JSSVGAnimatedLengthConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimatedLengthConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedLengthConstructor, DOMObject>(exec, &JSSVGAnimatedLengthConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnimatedLengthPrototypeTableValues[1] =
@@ -72,8 +120,8 @@ JSObject* JSSVGAnimatedLengthPrototype::self(ExecState* exec, JSGlobalObject* gl
 
 const ClassInfo JSSVGAnimatedLength::s_info = { "SVGAnimatedLength", 0, &JSSVGAnimatedLengthTable, 0 };
 
-JSSVGAnimatedLength::JSSVGAnimatedLength(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedLength> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGAnimatedLength::JSSVGAnimatedLength(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedLength> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -81,6 +129,7 @@ JSSVGAnimatedLength::JSSVGAnimatedLength(NonNullPassRefPtr<Structure> structure,
 JSSVGAnimatedLength::~JSSVGAnimatedLength()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGAnimatedLength::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -98,20 +147,32 @@ bool JSSVGAnimatedLength::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSSVGAnimatedLength, Base>(exec, &JSSVGAnimatedLengthTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAnimatedLengthBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedLengthBaseVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedLength* castedThis = static_cast<JSSVGAnimatedLength*>(asObject(slot.slotBase()));
+    JSSVGAnimatedLength* castedThis = static_cast<JSSVGAnimatedLength*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedLength* imp = static_cast<SVGAnimatedLength*>(castedThis->impl());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGDynamicPODTypeWrapperCache<SVGLength, SVGAnimatedLength>::lookupOrCreateWrapper(imp, &SVGAnimatedLength::baseVal, &SVGAnimatedLength::setBaseVal).get(), castedThis->context());
+    JSValue result = toJS(exec, castedThis->globalObject(), JSSVGDynamicPODTypeWrapperCache<SVGLength, SVGAnimatedLength>::lookupOrCreateWrapper(imp, &SVGAnimatedLength::baseVal, &SVGAnimatedLength::setBaseVal).get(), JSSVGContextCache::svgContextForDOMObject(castedThis));;
+    return result;
 }
 
-JSValue jsSVGAnimatedLengthAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedLengthAnimVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedLength* castedThis = static_cast<JSSVGAnimatedLength*>(asObject(slot.slotBase()));
+    JSSVGAnimatedLength* castedThis = static_cast<JSSVGAnimatedLength*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedLength* imp = static_cast<SVGAnimatedLength*>(castedThis->impl());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGDynamicPODTypeWrapperCache<SVGLength, SVGAnimatedLength>::lookupOrCreateWrapper(imp, &SVGAnimatedLength::animVal, &SVGAnimatedLength::setAnimVal).get(), castedThis->context());
+    JSValue result = toJS(exec, castedThis->globalObject(), JSSVGDynamicPODTypeWrapperCache<SVGLength, SVGAnimatedLength>::lookupOrCreateWrapper(imp, &SVGAnimatedLength::animVal, &SVGAnimatedLength::setAnimVal).get(), JSSVGContextCache::svgContextForDOMObject(castedThis));;
+    return result;
+}
+
+JSValue jsSVGAnimatedLengthConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAnimatedLength* domObject = static_cast<JSSVGAnimatedLength*>(asObject(slotBase));
+    return JSSVGAnimatedLength::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGAnimatedLength::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAnimatedLengthConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnimatedLength* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
index 671eed8bf7..a82dbb290d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -31,10 +30,10 @@
 
 namespace WebCore {
 
-class JSSVGAnimatedLength : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGAnimatedLength : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGAnimatedLength(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedLength>, SVGElement* context);
+    JSSVGAnimatedLength(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedLength>);
     virtual ~JSSVGAnimatedLength();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -44,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGAnimatedLength* impl() const { return m_impl.get(); }
 
 private:
@@ -66,7 +66,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimatedLengthPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,8 +75,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGAnimatedLengthBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAnimatedLengthAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedLengthBaseVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedLengthAnimVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedLengthConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp
index 5525640c01..04e78228af 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp
@@ -36,20 +36,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedLengthList);
 
 /* Hash table */
 
-static const HashTableValue JSSVGAnimatedLengthListTableValues[3] =
+static const HashTableValue JSSVGAnimatedLengthListTableValues[4] =
 {
-    { "baseVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedLengthListBaseVal, (intptr_t)0 },
-    { "animVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedLengthListAnimVal, (intptr_t)0 },
+    { "baseVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedLengthListBaseVal), (intptr_t)0 },
+    { "animVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedLengthListAnimVal), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedLengthListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedLengthListTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGAnimatedLengthListTableValues, 0 };
+    { 3, JSSVGAnimatedLengthListTableValues, 0 };
 #else
-    { 4, 3, JSSVGAnimatedLengthListTableValues, 0 };
+    { 8, 7, JSSVGAnimatedLengthListTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAnimatedLengthListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedLengthListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimatedLengthListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAnimatedLengthListConstructorTableValues, 0 };
+#endif
+
+class JSSVGAnimatedLengthListConstructor : public DOMConstructorObject {
+public:
+    JSSVGAnimatedLengthListConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAnimatedLengthListConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAnimatedLengthListPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAnimatedLengthListConstructor::s_info = { "SVGAnimatedLengthListConstructor", 0, &JSSVGAnimatedLengthListConstructorTable, 0 };
+
+bool JSSVGAnimatedLengthListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimatedLengthListConstructor, DOMObject>(exec, &JSSVGAnimatedLengthListConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimatedLengthListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedLengthListConstructor, DOMObject>(exec, &JSSVGAnimatedLengthListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnimatedLengthListPrototypeTableValues[1] =
@@ -73,8 +121,8 @@ JSObject* JSSVGAnimatedLengthListPrototype::self(ExecState* exec, JSGlobalObject
 
 const ClassInfo JSSVGAnimatedLengthList::s_info = { "SVGAnimatedLengthList", 0, &JSSVGAnimatedLengthListTable, 0 };
 
-JSSVGAnimatedLengthList::JSSVGAnimatedLengthList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedLengthList> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGAnimatedLengthList::JSSVGAnimatedLengthList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedLengthList> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -82,6 +130,7 @@ JSSVGAnimatedLengthList::JSSVGAnimatedLengthList(NonNullPassRefPtr<Structure> st
 JSSVGAnimatedLengthList::~JSSVGAnimatedLengthList()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGAnimatedLengthList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -99,20 +148,32 @@ bool JSSVGAnimatedLengthList::getOwnPropertyDescriptor(ExecState* exec, const Id
     return getStaticValueDescriptor<JSSVGAnimatedLengthList, Base>(exec, &JSSVGAnimatedLengthListTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAnimatedLengthListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedLengthListBaseVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedLengthList* castedThis = static_cast<JSSVGAnimatedLengthList*>(asObject(slot.slotBase()));
+    JSSVGAnimatedLengthList* castedThis = static_cast<JSSVGAnimatedLengthList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedLengthList* imp = static_cast<SVGAnimatedLengthList*>(castedThis->impl());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->baseVal()), castedThis->context());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->baseVal()), JSSVGContextCache::svgContextForDOMObject(castedThis));
+    return result;
 }
 
-JSValue jsSVGAnimatedLengthListAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedLengthListAnimVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedLengthList* castedThis = static_cast<JSSVGAnimatedLengthList*>(asObject(slot.slotBase()));
+    JSSVGAnimatedLengthList* castedThis = static_cast<JSSVGAnimatedLengthList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedLengthList* imp = static_cast<SVGAnimatedLengthList*>(castedThis->impl());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->animVal()), castedThis->context());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->animVal()), JSSVGContextCache::svgContextForDOMObject(castedThis));
+    return result;
+}
+
+JSValue jsSVGAnimatedLengthListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAnimatedLengthList* domObject = static_cast<JSSVGAnimatedLengthList*>(asObject(slotBase));
+    return JSSVGAnimatedLengthList::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGAnimatedLengthList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAnimatedLengthListConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnimatedLengthList* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
index aa32b122e4..843c8eefb5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -31,10 +30,10 @@
 
 namespace WebCore {
 
-class JSSVGAnimatedLengthList : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGAnimatedLengthList : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGAnimatedLengthList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedLengthList>, SVGElement* context);
+    JSSVGAnimatedLengthList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedLengthList>);
     virtual ~JSSVGAnimatedLengthList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -44,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGAnimatedLengthList* impl() const { return m_impl.get(); }
 
 private:
@@ -66,7 +66,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimatedLengthListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,8 +75,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGAnimatedLengthListBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAnimatedLengthListAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedLengthListBaseVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedLengthListAnimVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedLengthListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp
index 69f1490fe9..8c79e7472e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp
@@ -35,20 +35,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedNumber);
 
 /* Hash table */
 
-static const HashTableValue JSSVGAnimatedNumberTableValues[3] =
+static const HashTableValue JSSVGAnimatedNumberTableValues[4] =
 {
-    { "baseVal", DontDelete, (intptr_t)jsSVGAnimatedNumberBaseVal, (intptr_t)setJSSVGAnimatedNumberBaseVal },
-    { "animVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedNumberAnimVal, (intptr_t)0 },
+    { "baseVal", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedNumberBaseVal), (intptr_t)setJSSVGAnimatedNumberBaseVal },
+    { "animVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedNumberAnimVal), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedNumberConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedNumberTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGAnimatedNumberTableValues, 0 };
+    { 3, JSSVGAnimatedNumberTableValues, 0 };
 #else
-    { 4, 3, JSSVGAnimatedNumberTableValues, 0 };
+    { 8, 7, JSSVGAnimatedNumberTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAnimatedNumberConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedNumberConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimatedNumberConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAnimatedNumberConstructorTableValues, 0 };
+#endif
+
+class JSSVGAnimatedNumberConstructor : public DOMConstructorObject {
+public:
+    JSSVGAnimatedNumberConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAnimatedNumberConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAnimatedNumberPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAnimatedNumberConstructor::s_info = { "SVGAnimatedNumberConstructor", 0, &JSSVGAnimatedNumberConstructorTable, 0 };
+
+bool JSSVGAnimatedNumberConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimatedNumberConstructor, DOMObject>(exec, &JSSVGAnimatedNumberConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimatedNumberConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedNumberConstructor, DOMObject>(exec, &JSSVGAnimatedNumberConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnimatedNumberPrototypeTableValues[1] =
@@ -72,8 +120,8 @@ JSObject* JSSVGAnimatedNumberPrototype::self(ExecState* exec, JSGlobalObject* gl
 
 const ClassInfo JSSVGAnimatedNumber::s_info = { "SVGAnimatedNumber", 0, &JSSVGAnimatedNumberTable, 0 };
 
-JSSVGAnimatedNumber::JSSVGAnimatedNumber(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedNumber> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGAnimatedNumber::JSSVGAnimatedNumber(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedNumber> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -81,6 +129,7 @@ JSSVGAnimatedNumber::JSSVGAnimatedNumber(NonNullPassRefPtr<Structure> structure,
 JSSVGAnimatedNumber::~JSSVGAnimatedNumber()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGAnimatedNumber::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -98,22 +147,29 @@ bool JSSVGAnimatedNumber::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSSVGAnimatedNumber, Base>(exec, &JSSVGAnimatedNumberTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAnimatedNumberBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedNumberBaseVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedNumber* castedThis = static_cast<JSSVGAnimatedNumber*>(asObject(slot.slotBase()));
+    JSSVGAnimatedNumber* castedThis = static_cast<JSSVGAnimatedNumber*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedNumber* imp = static_cast<SVGAnimatedNumber*>(castedThis->impl());
-    return jsNumber(exec, imp->baseVal());
+    JSValue result = jsNumber(exec, imp->baseVal());
+    return result;
 }
 
-JSValue jsSVGAnimatedNumberAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedNumberAnimVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedNumber* castedThis = static_cast<JSSVGAnimatedNumber*>(asObject(slot.slotBase()));
+    JSSVGAnimatedNumber* castedThis = static_cast<JSSVGAnimatedNumber*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedNumber* imp = static_cast<SVGAnimatedNumber*>(castedThis->impl());
-    return jsNumber(exec, imp->animVal());
+    JSValue result = jsNumber(exec, imp->animVal());
+    return result;
 }
 
+JSValue jsSVGAnimatedNumberConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAnimatedNumber* domObject = static_cast<JSSVGAnimatedNumber*>(asObject(slotBase));
+    return JSSVGAnimatedNumber::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGAnimatedNumber::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAnimatedNumber, Base>(exec, propertyName, value, &JSSVGAnimatedNumberTable, this, slot);
@@ -121,10 +177,15 @@ void JSSVGAnimatedNumber::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSSVGAnimatedNumberBaseVal(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGAnimatedNumber* imp = static_cast<SVGAnimatedNumber*>(static_cast<JSSVGAnimatedNumber*>(thisObject)->impl());
+    JSSVGAnimatedNumber* castedThisObj = static_cast<JSSVGAnimatedNumber*>(thisObject);
+    SVGAnimatedNumber* imp = static_cast<SVGAnimatedNumber*>(castedThisObj->impl());
     imp->setBaseVal(value.toFloat(exec));
-    if (static_cast<JSSVGAnimatedNumber*>(thisObject)->context())
-        static_cast<JSSVGAnimatedNumber*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAnimatedNumber*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGAnimatedNumber::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAnimatedNumberConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnimatedNumber* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
index 4c49a920bd..c2f8b21582 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -31,10 +30,10 @@
 
 namespace WebCore {
 
-class JSSVGAnimatedNumber : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGAnimatedNumber : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGAnimatedNumber(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedNumber>, SVGElement* context);
+    JSSVGAnimatedNumber(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedNumber>);
     virtual ~JSSVGAnimatedNumber();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -45,9 +44,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGAnimatedNumber* impl() const { return m_impl.get(); }
 
 private:
@@ -67,7 +67,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimatedNumberPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -76,9 +76,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGAnimatedNumberBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedNumberBaseVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGAnimatedNumberBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGAnimatedNumberAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedNumberAnimVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedNumberConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp
index 0fa8afa3d0..661665dafe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp
@@ -36,20 +36,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedNumberList);
 
 /* Hash table */
 
-static const HashTableValue JSSVGAnimatedNumberListTableValues[3] =
+static const HashTableValue JSSVGAnimatedNumberListTableValues[4] =
 {
-    { "baseVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedNumberListBaseVal, (intptr_t)0 },
-    { "animVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedNumberListAnimVal, (intptr_t)0 },
+    { "baseVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedNumberListBaseVal), (intptr_t)0 },
+    { "animVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedNumberListAnimVal), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedNumberListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedNumberListTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGAnimatedNumberListTableValues, 0 };
+    { 3, JSSVGAnimatedNumberListTableValues, 0 };
 #else
-    { 4, 3, JSSVGAnimatedNumberListTableValues, 0 };
+    { 8, 7, JSSVGAnimatedNumberListTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAnimatedNumberListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedNumberListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimatedNumberListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAnimatedNumberListConstructorTableValues, 0 };
+#endif
+
+class JSSVGAnimatedNumberListConstructor : public DOMConstructorObject {
+public:
+    JSSVGAnimatedNumberListConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAnimatedNumberListConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAnimatedNumberListPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAnimatedNumberListConstructor::s_info = { "SVGAnimatedNumberListConstructor", 0, &JSSVGAnimatedNumberListConstructorTable, 0 };
+
+bool JSSVGAnimatedNumberListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimatedNumberListConstructor, DOMObject>(exec, &JSSVGAnimatedNumberListConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimatedNumberListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedNumberListConstructor, DOMObject>(exec, &JSSVGAnimatedNumberListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnimatedNumberListPrototypeTableValues[1] =
@@ -73,8 +121,8 @@ JSObject* JSSVGAnimatedNumberListPrototype::self(ExecState* exec, JSGlobalObject
 
 const ClassInfo JSSVGAnimatedNumberList::s_info = { "SVGAnimatedNumberList", 0, &JSSVGAnimatedNumberListTable, 0 };
 
-JSSVGAnimatedNumberList::JSSVGAnimatedNumberList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedNumberList> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGAnimatedNumberList::JSSVGAnimatedNumberList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedNumberList> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -82,6 +130,7 @@ JSSVGAnimatedNumberList::JSSVGAnimatedNumberList(NonNullPassRefPtr<Structure> st
 JSSVGAnimatedNumberList::~JSSVGAnimatedNumberList()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGAnimatedNumberList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -99,20 +148,32 @@ bool JSSVGAnimatedNumberList::getOwnPropertyDescriptor(ExecState* exec, const Id
     return getStaticValueDescriptor<JSSVGAnimatedNumberList, Base>(exec, &JSSVGAnimatedNumberListTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAnimatedNumberListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedNumberListBaseVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedNumberList* castedThis = static_cast<JSSVGAnimatedNumberList*>(asObject(slot.slotBase()));
+    JSSVGAnimatedNumberList* castedThis = static_cast<JSSVGAnimatedNumberList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedNumberList* imp = static_cast<SVGAnimatedNumberList*>(castedThis->impl());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->baseVal()), castedThis->context());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->baseVal()), JSSVGContextCache::svgContextForDOMObject(castedThis));
+    return result;
 }
 
-JSValue jsSVGAnimatedNumberListAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedNumberListAnimVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedNumberList* castedThis = static_cast<JSSVGAnimatedNumberList*>(asObject(slot.slotBase()));
+    JSSVGAnimatedNumberList* castedThis = static_cast<JSSVGAnimatedNumberList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedNumberList* imp = static_cast<SVGAnimatedNumberList*>(castedThis->impl());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->animVal()), castedThis->context());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->animVal()), JSSVGContextCache::svgContextForDOMObject(castedThis));
+    return result;
+}
+
+JSValue jsSVGAnimatedNumberListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAnimatedNumberList* domObject = static_cast<JSSVGAnimatedNumberList*>(asObject(slotBase));
+    return JSSVGAnimatedNumberList::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGAnimatedNumberList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAnimatedNumberListConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnimatedNumberList* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
index 4b61561e96..4cb2c4c184 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -31,10 +30,10 @@
 
 namespace WebCore {
 
-class JSSVGAnimatedNumberList : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGAnimatedNumberList : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGAnimatedNumberList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedNumberList>, SVGElement* context);
+    JSSVGAnimatedNumberList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedNumberList>);
     virtual ~JSSVGAnimatedNumberList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -44,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGAnimatedNumberList* impl() const { return m_impl.get(); }
 
 private:
@@ -66,7 +66,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimatedNumberListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,8 +75,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGAnimatedNumberListBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAnimatedNumberListAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedNumberListBaseVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedNumberListAnimVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedNumberListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp
index b64ee3ac69..2a5aae267d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp
@@ -25,7 +25,6 @@
 #include "JSSVGAnimatedPreserveAspectRatio.h"
 
 #include "JSSVGPreserveAspectRatio.h"
-#include "SVGPreserveAspectRatio.h"
 #include <wtf/GetPtr.h>
 
 using namespace JSC;
@@ -36,20 +35,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedPreserveAspectRatio);
 
 /* Hash table */
 
-static const HashTableValue JSSVGAnimatedPreserveAspectRatioTableValues[3] =
+static const HashTableValue JSSVGAnimatedPreserveAspectRatioTableValues[4] =
 {
-    { "baseVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedPreserveAspectRatioBaseVal, (intptr_t)0 },
-    { "animVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedPreserveAspectRatioAnimVal, (intptr_t)0 },
+    { "baseVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedPreserveAspectRatioBaseVal), (intptr_t)0 },
+    { "animVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedPreserveAspectRatioAnimVal), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedPreserveAspectRatioConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedPreserveAspectRatioTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGAnimatedPreserveAspectRatioTableValues, 0 };
+    { 3, JSSVGAnimatedPreserveAspectRatioTableValues, 0 };
 #else
-    { 4, 3, JSSVGAnimatedPreserveAspectRatioTableValues, 0 };
+    { 8, 7, JSSVGAnimatedPreserveAspectRatioTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAnimatedPreserveAspectRatioConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedPreserveAspectRatioConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimatedPreserveAspectRatioConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAnimatedPreserveAspectRatioConstructorTableValues, 0 };
+#endif
+
+class JSSVGAnimatedPreserveAspectRatioConstructor : public DOMConstructorObject {
+public:
+    JSSVGAnimatedPreserveAspectRatioConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAnimatedPreserveAspectRatioConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAnimatedPreserveAspectRatioPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAnimatedPreserveAspectRatioConstructor::s_info = { "SVGAnimatedPreserveAspectRatioConstructor", 0, &JSSVGAnimatedPreserveAspectRatioConstructorTable, 0 };
+
+bool JSSVGAnimatedPreserveAspectRatioConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimatedPreserveAspectRatioConstructor, DOMObject>(exec, &JSSVGAnimatedPreserveAspectRatioConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimatedPreserveAspectRatioConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedPreserveAspectRatioConstructor, DOMObject>(exec, &JSSVGAnimatedPreserveAspectRatioConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnimatedPreserveAspectRatioPrototypeTableValues[1] =
@@ -73,8 +120,8 @@ JSObject* JSSVGAnimatedPreserveAspectRatioPrototype::self(ExecState* exec, JSGlo
 
 const ClassInfo JSSVGAnimatedPreserveAspectRatio::s_info = { "SVGAnimatedPreserveAspectRatio", 0, &JSSVGAnimatedPreserveAspectRatioTable, 0 };
 
-JSSVGAnimatedPreserveAspectRatio::JSSVGAnimatedPreserveAspectRatio(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedPreserveAspectRatio> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGAnimatedPreserveAspectRatio::JSSVGAnimatedPreserveAspectRatio(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedPreserveAspectRatio> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -82,6 +129,7 @@ JSSVGAnimatedPreserveAspectRatio::JSSVGAnimatedPreserveAspectRatio(NonNullPassRe
 JSSVGAnimatedPreserveAspectRatio::~JSSVGAnimatedPreserveAspectRatio()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGAnimatedPreserveAspectRatio::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -99,20 +147,32 @@ bool JSSVGAnimatedPreserveAspectRatio::getOwnPropertyDescriptor(ExecState* exec,
     return getStaticValueDescriptor<JSSVGAnimatedPreserveAspectRatio, Base>(exec, &JSSVGAnimatedPreserveAspectRatioTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAnimatedPreserveAspectRatioBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedPreserveAspectRatioBaseVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedPreserveAspectRatio* castedThis = static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(slot.slotBase()));
+    JSSVGAnimatedPreserveAspectRatio* castedThis = static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedPreserveAspectRatio* imp = static_cast<SVGAnimatedPreserveAspectRatio*>(castedThis->impl());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->baseVal()), castedThis->context());
+    JSValue result = toJS(exec, castedThis->globalObject(), JSSVGDynamicPODTypeWrapperCache<SVGPreserveAspectRatio, SVGAnimatedPreserveAspectRatio>::lookupOrCreateWrapper(imp, &SVGAnimatedPreserveAspectRatio::baseVal, &SVGAnimatedPreserveAspectRatio::setBaseVal).get(), JSSVGContextCache::svgContextForDOMObject(castedThis));;
+    return result;
 }
 
-JSValue jsSVGAnimatedPreserveAspectRatioAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedPreserveAspectRatioAnimVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedPreserveAspectRatio* castedThis = static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(slot.slotBase()));
+    JSSVGAnimatedPreserveAspectRatio* castedThis = static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedPreserveAspectRatio* imp = static_cast<SVGAnimatedPreserveAspectRatio*>(castedThis->impl());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->animVal()), castedThis->context());
+    JSValue result = toJS(exec, castedThis->globalObject(), JSSVGDynamicPODTypeWrapperCache<SVGPreserveAspectRatio, SVGAnimatedPreserveAspectRatio>::lookupOrCreateWrapper(imp, &SVGAnimatedPreserveAspectRatio::animVal, &SVGAnimatedPreserveAspectRatio::setAnimVal).get(), JSSVGContextCache::svgContextForDOMObject(castedThis));;
+    return result;
+}
+
+JSValue jsSVGAnimatedPreserveAspectRatioConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAnimatedPreserveAspectRatio* domObject = static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(slotBase));
+    return JSSVGAnimatedPreserveAspectRatio::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGAnimatedPreserveAspectRatio::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAnimatedPreserveAspectRatioConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnimatedPreserveAspectRatio* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
index eca4cb650c..2a6f1c8eb4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -31,10 +30,10 @@
 
 namespace WebCore {
 
-class JSSVGAnimatedPreserveAspectRatio : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGAnimatedPreserveAspectRatio : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGAnimatedPreserveAspectRatio(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedPreserveAspectRatio>, SVGElement* context);
+    JSSVGAnimatedPreserveAspectRatio(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedPreserveAspectRatio>);
     virtual ~JSSVGAnimatedPreserveAspectRatio();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -44,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGAnimatedPreserveAspectRatio* impl() const { return m_impl.get(); }
 
 private:
@@ -66,7 +66,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimatedPreserveAspectRatioPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,8 +75,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGAnimatedPreserveAspectRatioBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAnimatedPreserveAspectRatioAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedPreserveAspectRatioBaseVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedPreserveAspectRatioAnimVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedPreserveAspectRatioConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp
index 0db579b5e0..47021de549 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp
@@ -36,20 +36,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedRect);
 
 /* Hash table */
 
-static const HashTableValue JSSVGAnimatedRectTableValues[3] =
+static const HashTableValue JSSVGAnimatedRectTableValues[4] =
 {
-    { "baseVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedRectBaseVal, (intptr_t)0 },
-    { "animVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedRectAnimVal, (intptr_t)0 },
+    { "baseVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedRectBaseVal), (intptr_t)0 },
+    { "animVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedRectAnimVal), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedRectConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedRectTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGAnimatedRectTableValues, 0 };
+    { 3, JSSVGAnimatedRectTableValues, 0 };
 #else
-    { 4, 3, JSSVGAnimatedRectTableValues, 0 };
+    { 8, 7, JSSVGAnimatedRectTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAnimatedRectConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedRectConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimatedRectConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAnimatedRectConstructorTableValues, 0 };
+#endif
+
+class JSSVGAnimatedRectConstructor : public DOMConstructorObject {
+public:
+    JSSVGAnimatedRectConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAnimatedRectConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAnimatedRectPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAnimatedRectConstructor::s_info = { "SVGAnimatedRectConstructor", 0, &JSSVGAnimatedRectConstructorTable, 0 };
+
+bool JSSVGAnimatedRectConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimatedRectConstructor, DOMObject>(exec, &JSSVGAnimatedRectConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimatedRectConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedRectConstructor, DOMObject>(exec, &JSSVGAnimatedRectConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnimatedRectPrototypeTableValues[1] =
@@ -73,8 +121,8 @@ JSObject* JSSVGAnimatedRectPrototype::self(ExecState* exec, JSGlobalObject* glob
 
 const ClassInfo JSSVGAnimatedRect::s_info = { "SVGAnimatedRect", 0, &JSSVGAnimatedRectTable, 0 };
 
-JSSVGAnimatedRect::JSSVGAnimatedRect(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedRect> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGAnimatedRect::JSSVGAnimatedRect(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedRect> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -82,6 +130,7 @@ JSSVGAnimatedRect::JSSVGAnimatedRect(NonNullPassRefPtr<Structure> structure, JSD
 JSSVGAnimatedRect::~JSSVGAnimatedRect()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGAnimatedRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -99,20 +148,32 @@ bool JSSVGAnimatedRect::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSSVGAnimatedRect, Base>(exec, &JSSVGAnimatedRectTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAnimatedRectBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedRectBaseVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedRect* castedThis = static_cast<JSSVGAnimatedRect*>(asObject(slot.slotBase()));
+    JSSVGAnimatedRect* castedThis = static_cast<JSSVGAnimatedRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedRect* imp = static_cast<SVGAnimatedRect*>(castedThis->impl());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGDynamicPODTypeWrapperCache<FloatRect, SVGAnimatedRect>::lookupOrCreateWrapper(imp, &SVGAnimatedRect::baseVal, &SVGAnimatedRect::setBaseVal).get(), castedThis->context());
+    JSValue result = toJS(exec, castedThis->globalObject(), JSSVGDynamicPODTypeWrapperCache<FloatRect, SVGAnimatedRect>::lookupOrCreateWrapper(imp, &SVGAnimatedRect::baseVal, &SVGAnimatedRect::setBaseVal).get(), JSSVGContextCache::svgContextForDOMObject(castedThis));;
+    return result;
 }
 
-JSValue jsSVGAnimatedRectAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedRectAnimVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedRect* castedThis = static_cast<JSSVGAnimatedRect*>(asObject(slot.slotBase()));
+    JSSVGAnimatedRect* castedThis = static_cast<JSSVGAnimatedRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedRect* imp = static_cast<SVGAnimatedRect*>(castedThis->impl());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGDynamicPODTypeWrapperCache<FloatRect, SVGAnimatedRect>::lookupOrCreateWrapper(imp, &SVGAnimatedRect::animVal, &SVGAnimatedRect::setAnimVal).get(), castedThis->context());
+    JSValue result = toJS(exec, castedThis->globalObject(), JSSVGDynamicPODTypeWrapperCache<FloatRect, SVGAnimatedRect>::lookupOrCreateWrapper(imp, &SVGAnimatedRect::animVal, &SVGAnimatedRect::setAnimVal).get(), JSSVGContextCache::svgContextForDOMObject(castedThis));;
+    return result;
+}
+
+JSValue jsSVGAnimatedRectConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAnimatedRect* domObject = static_cast<JSSVGAnimatedRect*>(asObject(slotBase));
+    return JSSVGAnimatedRect::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGAnimatedRect::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAnimatedRectConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnimatedRect* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
index 904a78c320..e90dc80ddb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -31,10 +30,10 @@
 
 namespace WebCore {
 
-class JSSVGAnimatedRect : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGAnimatedRect : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGAnimatedRect(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedRect>, SVGElement* context);
+    JSSVGAnimatedRect(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedRect>);
     virtual ~JSSVGAnimatedRect();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -44,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGAnimatedRect* impl() const { return m_impl.get(); }
 
 private:
@@ -66,7 +66,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimatedRectPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,8 +75,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGAnimatedRectBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAnimatedRectAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedRectBaseVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedRectAnimVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedRectConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp
index a26a070781..d4e4c598ce 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp
@@ -37,20 +37,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedString);
 
 /* Hash table */
 
-static const HashTableValue JSSVGAnimatedStringTableValues[3] =
+static const HashTableValue JSSVGAnimatedStringTableValues[4] =
 {
-    { "baseVal", DontDelete, (intptr_t)jsSVGAnimatedStringBaseVal, (intptr_t)setJSSVGAnimatedStringBaseVal },
-    { "animVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedStringAnimVal, (intptr_t)0 },
+    { "baseVal", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedStringBaseVal), (intptr_t)setJSSVGAnimatedStringBaseVal },
+    { "animVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedStringAnimVal), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedStringConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedStringTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGAnimatedStringTableValues, 0 };
+    { 3, JSSVGAnimatedStringTableValues, 0 };
 #else
-    { 4, 3, JSSVGAnimatedStringTableValues, 0 };
+    { 8, 7, JSSVGAnimatedStringTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAnimatedStringConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedStringConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimatedStringConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAnimatedStringConstructorTableValues, 0 };
+#endif
+
+class JSSVGAnimatedStringConstructor : public DOMConstructorObject {
+public:
+    JSSVGAnimatedStringConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAnimatedStringConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAnimatedStringPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAnimatedStringConstructor::s_info = { "SVGAnimatedStringConstructor", 0, &JSSVGAnimatedStringConstructorTable, 0 };
+
+bool JSSVGAnimatedStringConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimatedStringConstructor, DOMObject>(exec, &JSSVGAnimatedStringConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimatedStringConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedStringConstructor, DOMObject>(exec, &JSSVGAnimatedStringConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnimatedStringPrototypeTableValues[1] =
@@ -74,8 +122,8 @@ JSObject* JSSVGAnimatedStringPrototype::self(ExecState* exec, JSGlobalObject* gl
 
 const ClassInfo JSSVGAnimatedString::s_info = { "SVGAnimatedString", 0, &JSSVGAnimatedStringTable, 0 };
 
-JSSVGAnimatedString::JSSVGAnimatedString(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedString> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGAnimatedString::JSSVGAnimatedString(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedString> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -83,6 +131,7 @@ JSSVGAnimatedString::JSSVGAnimatedString(NonNullPassRefPtr<Structure> structure,
 JSSVGAnimatedString::~JSSVGAnimatedString()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGAnimatedString::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -100,22 +149,29 @@ bool JSSVGAnimatedString::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSSVGAnimatedString, Base>(exec, &JSSVGAnimatedStringTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAnimatedStringBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedStringBaseVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedString* castedThis = static_cast<JSSVGAnimatedString*>(asObject(slot.slotBase()));
+    JSSVGAnimatedString* castedThis = static_cast<JSSVGAnimatedString*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedString* imp = static_cast<SVGAnimatedString*>(castedThis->impl());
-    return jsString(exec, imp->baseVal());
+    JSValue result = jsString(exec, imp->baseVal());
+    return result;
 }
 
-JSValue jsSVGAnimatedStringAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedStringAnimVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedString* castedThis = static_cast<JSSVGAnimatedString*>(asObject(slot.slotBase()));
+    JSSVGAnimatedString* castedThis = static_cast<JSSVGAnimatedString*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedString* imp = static_cast<SVGAnimatedString*>(castedThis->impl());
-    return jsString(exec, imp->animVal());
+    JSValue result = jsString(exec, imp->animVal());
+    return result;
 }
 
+JSValue jsSVGAnimatedStringConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAnimatedString* domObject = static_cast<JSSVGAnimatedString*>(asObject(slotBase));
+    return JSSVGAnimatedString::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGAnimatedString::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAnimatedString, Base>(exec, propertyName, value, &JSSVGAnimatedStringTable, this, slot);
@@ -123,10 +179,15 @@ void JSSVGAnimatedString::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSSVGAnimatedStringBaseVal(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGAnimatedString* imp = static_cast<SVGAnimatedString*>(static_cast<JSSVGAnimatedString*>(thisObject)->impl());
+    JSSVGAnimatedString* castedThisObj = static_cast<JSSVGAnimatedString*>(thisObject);
+    SVGAnimatedString* imp = static_cast<SVGAnimatedString*>(castedThisObj->impl());
     imp->setBaseVal(value.toString(exec));
-    if (static_cast<JSSVGAnimatedString*>(thisObject)->context())
-        static_cast<JSSVGAnimatedString*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAnimatedString*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGAnimatedString::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAnimatedStringConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnimatedString* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
index 216e643d71..c7b8219387 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -31,10 +30,10 @@
 
 namespace WebCore {
 
-class JSSVGAnimatedString : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGAnimatedString : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGAnimatedString(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedString>, SVGElement* context);
+    JSSVGAnimatedString(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedString>);
     virtual ~JSSVGAnimatedString();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -45,9 +44,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGAnimatedString* impl() const { return m_impl.get(); }
 
 private:
@@ -67,7 +67,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimatedStringPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -76,9 +76,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGAnimatedStringBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedStringBaseVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGAnimatedStringBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGAnimatedStringAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedStringAnimVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedStringConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp
index 62c3121455..6c1c38b437 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp
@@ -36,20 +36,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedTransformList);
 
 /* Hash table */
 
-static const HashTableValue JSSVGAnimatedTransformListTableValues[3] =
+static const HashTableValue JSSVGAnimatedTransformListTableValues[4] =
 {
-    { "baseVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedTransformListBaseVal, (intptr_t)0 },
-    { "animVal", DontDelete|ReadOnly, (intptr_t)jsSVGAnimatedTransformListAnimVal, (intptr_t)0 },
+    { "baseVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedTransformListBaseVal), (intptr_t)0 },
+    { "animVal", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedTransformListAnimVal), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimatedTransformListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedTransformListTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGAnimatedTransformListTableValues, 0 };
+    { 3, JSSVGAnimatedTransformListTableValues, 0 };
 #else
-    { 4, 3, JSSVGAnimatedTransformListTableValues, 0 };
+    { 8, 7, JSSVGAnimatedTransformListTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGAnimatedTransformListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGAnimatedTransformListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGAnimatedTransformListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGAnimatedTransformListConstructorTableValues, 0 };
+#endif
+
+class JSSVGAnimatedTransformListConstructor : public DOMConstructorObject {
+public:
+    JSSVGAnimatedTransformListConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGAnimatedTransformListConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGAnimatedTransformListPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGAnimatedTransformListConstructor::s_info = { "SVGAnimatedTransformListConstructor", 0, &JSSVGAnimatedTransformListConstructorTable, 0 };
+
+bool JSSVGAnimatedTransformListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGAnimatedTransformListConstructor, DOMObject>(exec, &JSSVGAnimatedTransformListConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGAnimatedTransformListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedTransformListConstructor, DOMObject>(exec, &JSSVGAnimatedTransformListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnimatedTransformListPrototypeTableValues[1] =
@@ -73,8 +121,8 @@ JSObject* JSSVGAnimatedTransformListPrototype::self(ExecState* exec, JSGlobalObj
 
 const ClassInfo JSSVGAnimatedTransformList::s_info = { "SVGAnimatedTransformList", 0, &JSSVGAnimatedTransformListTable, 0 };
 
-JSSVGAnimatedTransformList::JSSVGAnimatedTransformList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedTransformList> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGAnimatedTransformList::JSSVGAnimatedTransformList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimatedTransformList> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -82,6 +130,7 @@ JSSVGAnimatedTransformList::JSSVGAnimatedTransformList(NonNullPassRefPtr<Structu
 JSSVGAnimatedTransformList::~JSSVGAnimatedTransformList()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGAnimatedTransformList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -99,20 +148,32 @@ bool JSSVGAnimatedTransformList::getOwnPropertyDescriptor(ExecState* exec, const
     return getStaticValueDescriptor<JSSVGAnimatedTransformList, Base>(exec, &JSSVGAnimatedTransformListTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAnimatedTransformListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedTransformListBaseVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedTransformList* castedThis = static_cast<JSSVGAnimatedTransformList*>(asObject(slot.slotBase()));
+    JSSVGAnimatedTransformList* castedThis = static_cast<JSSVGAnimatedTransformList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedTransformList* imp = static_cast<SVGAnimatedTransformList*>(castedThis->impl());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->baseVal()), castedThis->context());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->baseVal()), JSSVGContextCache::svgContextForDOMObject(castedThis));
+    return result;
 }
 
-JSValue jsSVGAnimatedTransformListAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedTransformListAnimVal(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimatedTransformList* castedThis = static_cast<JSSVGAnimatedTransformList*>(asObject(slot.slotBase()));
+    JSSVGAnimatedTransformList* castedThis = static_cast<JSSVGAnimatedTransformList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimatedTransformList* imp = static_cast<SVGAnimatedTransformList*>(castedThis->impl());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->animVal()), castedThis->context());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->animVal()), JSSVGContextCache::svgContextForDOMObject(castedThis));
+    return result;
+}
+
+JSValue jsSVGAnimatedTransformListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGAnimatedTransformList* domObject = static_cast<JSSVGAnimatedTransformList*>(asObject(slotBase));
+    return JSSVGAnimatedTransformList::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGAnimatedTransformList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGAnimatedTransformListConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnimatedTransformList* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
index 3c7b0a2557..3875110f05 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -31,10 +30,10 @@
 
 namespace WebCore {
 
-class JSSVGAnimatedTransformList : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGAnimatedTransformList : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGAnimatedTransformList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedTransformList>, SVGElement* context);
+    JSSVGAnimatedTransformList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimatedTransformList>);
     virtual ~JSSVGAnimatedTransformList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -44,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGAnimatedTransformList* impl() const { return m_impl.get(); }
 
 private:
@@ -66,7 +66,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimatedTransformListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,8 +75,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGAnimatedTransformListBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAnimatedTransformListAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedTransformListBaseVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedTransformListAnimVal(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimatedTransformListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp
index cb4800790f..ecb0c15236 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp
@@ -44,11 +44,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimationElement);
 
 static const HashTableValue JSSVGAnimationElementTableValues[6] =
 {
-    { "targetElement", DontDelete|ReadOnly, (intptr_t)jsSVGAnimationElementTargetElement, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGAnimationElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGAnimationElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGAnimationElementSystemLanguage, (intptr_t)0 },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGAnimationElementExternalResourcesRequired, (intptr_t)0 },
+    { "targetElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimationElementTargetElement), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimationElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimationElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimationElementSystemLanguage), (intptr_t)0 },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGAnimationElementExternalResourcesRequired), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -63,14 +63,14 @@ static JSC_CONST_HASHTABLE HashTable JSSVGAnimationElementTable =
 
 static const HashTableValue JSSVGAnimationElementPrototypeTableValues[9] =
 {
-    { "getStartTime", DontDelete|Function, (intptr_t)jsSVGAnimationElementPrototypeFunctionGetStartTime, (intptr_t)0 },
-    { "getCurrentTime", DontDelete|Function, (intptr_t)jsSVGAnimationElementPrototypeFunctionGetCurrentTime, (intptr_t)0 },
-    { "getSimpleDuration", DontDelete|Function, (intptr_t)jsSVGAnimationElementPrototypeFunctionGetSimpleDuration, (intptr_t)0 },
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGAnimationElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "beginElement", DontDelete|Function, (intptr_t)jsSVGAnimationElementPrototypeFunctionBeginElement, (intptr_t)0 },
-    { "beginElementAt", DontDelete|Function, (intptr_t)jsSVGAnimationElementPrototypeFunctionBeginElementAt, (intptr_t)1 },
-    { "endElement", DontDelete|Function, (intptr_t)jsSVGAnimationElementPrototypeFunctionEndElement, (intptr_t)0 },
-    { "endElementAt", DontDelete|Function, (intptr_t)jsSVGAnimationElementPrototypeFunctionEndElementAt, (intptr_t)1 },
+    { "getStartTime", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAnimationElementPrototypeFunctionGetStartTime), (intptr_t)0 },
+    { "getCurrentTime", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAnimationElementPrototypeFunctionGetCurrentTime), (intptr_t)0 },
+    { "getSimpleDuration", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAnimationElementPrototypeFunctionGetSimpleDuration), (intptr_t)0 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAnimationElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "beginElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAnimationElementPrototypeFunctionBeginElement), (intptr_t)0 },
+    { "beginElementAt", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAnimationElementPrototypeFunctionBeginElementAt), (intptr_t)1 },
+    { "endElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAnimationElementPrototypeFunctionEndElement), (intptr_t)0 },
+    { "endElementAt", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGAnimationElementPrototypeFunctionEndElementAt), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -120,45 +120,50 @@ bool JSSVGAnimationElement::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSSVGAnimationElement, Base>(exec, &JSSVGAnimationElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGAnimationElementTargetElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimationElementTargetElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimationElement* castedThis = static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()));
+    JSSVGAnimationElement* castedThis = static_cast<JSSVGAnimationElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->targetElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->targetElement()));
+    return result;
 }
 
-JSValue jsSVGAnimationElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimationElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimationElement* castedThis = static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()));
+    JSSVGAnimationElement* castedThis = static_cast<JSSVGAnimationElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGAnimationElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimationElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimationElement* castedThis = static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()));
+    JSSVGAnimationElement* castedThis = static_cast<JSSVGAnimationElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGAnimationElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimationElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimationElement* castedThis = static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()));
+    JSSVGAnimationElement* castedThis = static_cast<JSSVGAnimationElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGAnimationElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimationElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGAnimationElement* castedThis = static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()));
+    JSSVGAnimationElement* castedThis = static_cast<JSSVGAnimationElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
 JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetStartTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
index e36dc3a15c..f7fdf4f38b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 protected:
@@ -60,7 +60,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGAnimationElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -79,11 +79,11 @@ JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionEndElement(JSC:
 JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionEndElementAt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGAnimationElementTargetElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAnimationElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAnimationElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAnimationElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGAnimationElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimationElementTargetElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimationElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimationElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimationElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGAnimationElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp
index 49859f6108..69dc9da95b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp
@@ -53,22 +53,23 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGCircleElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGCircleElementTableValues[15] =
-{
-    { "cx", DontDelete|ReadOnly, (intptr_t)jsSVGCircleElementCx, (intptr_t)0 },
-    { "cy", DontDelete|ReadOnly, (intptr_t)jsSVGCircleElementCy, (intptr_t)0 },
-    { "r", DontDelete|ReadOnly, (intptr_t)jsSVGCircleElementR, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGCircleElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGCircleElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGCircleElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGCircleElementXmllang, (intptr_t)setJSSVGCircleElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGCircleElementXmlspace, (intptr_t)setJSSVGCircleElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGCircleElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGCircleElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGCircleElementStyle, (intptr_t)0 },
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGCircleElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGCircleElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGCircleElementFarthestViewportElement, (intptr_t)0 },
+static const HashTableValue JSSVGCircleElementTableValues[16] =
+{
+    { "cx", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCircleElementCx), (intptr_t)0 },
+    { "cy", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCircleElementCy), (intptr_t)0 },
+    { "r", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCircleElementR), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCircleElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCircleElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCircleElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCircleElementXmllang), (intptr_t)setJSSVGCircleElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCircleElementXmlspace), (intptr_t)setJSSVGCircleElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCircleElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCircleElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCircleElementStyle), (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCircleElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCircleElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCircleElementFarthestViewportElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCircleElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,19 +77,66 @@ static JSC_CONST_HASHTABLE HashTable JSSVGCircleElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 127, JSSVGCircleElementTableValues, 0 };
 #else
-    { 34, 31, JSSVGCircleElementTableValues, 0 };
+    { 35, 31, JSSVGCircleElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGCircleElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGCircleElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGCircleElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGCircleElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGCircleElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGCircleElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGCircleElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGCircleElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGCircleElementConstructor::s_info = { "SVGCircleElementConstructor", 0, &JSSVGCircleElementConstructorTable, 0 };
+
+bool JSSVGCircleElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGCircleElementConstructor, DOMObject>(exec, &JSSVGCircleElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGCircleElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGCircleElementConstructor, DOMObject>(exec, &JSSVGCircleElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGCircleElementPrototypeTableValues[7] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGCircleElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGCircleElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGCircleElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGCircleElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGCircleElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGCircleElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGCircleElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGCircleElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGCircleElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGCircleElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGCircleElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGCircleElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -138,124 +186,143 @@ bool JSSVGCircleElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSSVGCircleElement, Base>(exec, &JSSVGCircleElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGCircleElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementCx(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()));
+    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cxAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGCircleElementCy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementCy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()));
+    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cyAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGCircleElementR(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementR(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()));
+    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->rAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGCircleElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()));
+    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGCircleElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()));
+    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGCircleElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()));
+    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGCircleElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()));
+    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGCircleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()));
+    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGCircleElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()));
+    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGCircleElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()));
+    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGCircleElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()));
+    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGCircleElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()));
+    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGCircleElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()));
+    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGCircleElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()));
+    JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
+JSValue jsSVGCircleElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGCircleElement* domObject = static_cast<JSSVGCircleElement*>(asObject(slotBase));
+    return JSSVGCircleElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGCircleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGCircleElement, Base>(exec, propertyName, value, &JSSVGCircleElementTable, this, slot);
@@ -263,16 +330,23 @@ void JSSVGCircleElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSSVGCircleElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(thisObject)->impl());
+    JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(thisObject);
+    SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGCircleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(thisObject)->impl());
+    JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(thisObject);
+    SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGCircleElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGCircleElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -310,7 +384,7 @@ JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetBBox(ExecState* exec
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -323,7 +397,7 @@ JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetCTM(ExecState* exec,
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -336,7 +410,7 @@ JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetScreenCTM(ExecState*
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -351,7 +425,7 @@ JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetTransformToElement(E
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
index 0633d2ec91..3e88706ce9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGCircleElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,22 +79,23 @@ JSC::JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetScreenCTM(JSC::
 JSC::JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGCircleElementCx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCircleElementCy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCircleElementR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCircleElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCircleElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCircleElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCircleElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementCx(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCircleElementCy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCircleElementR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCircleElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCircleElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCircleElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCircleElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGCircleElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGCircleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGCircleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGCircleElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCircleElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCircleElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCircleElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCircleElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCircleElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCircleElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCircleElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCircleElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCircleElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCircleElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCircleElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp
index 07a73e06bc..340051c410 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp
@@ -53,20 +53,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGClipPathElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGClipPathElementTableValues[13] =
-{
-    { "clipPathUnits", DontDelete|ReadOnly, (intptr_t)jsSVGClipPathElementClipPathUnits, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGClipPathElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGClipPathElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGClipPathElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGClipPathElementXmllang, (intptr_t)setJSSVGClipPathElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGClipPathElementXmlspace, (intptr_t)setJSSVGClipPathElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGClipPathElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGClipPathElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGClipPathElementStyle, (intptr_t)0 },
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGClipPathElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGClipPathElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGClipPathElementFarthestViewportElement, (intptr_t)0 },
+static const HashTableValue JSSVGClipPathElementTableValues[14] =
+{
+    { "clipPathUnits", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGClipPathElementClipPathUnits), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGClipPathElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGClipPathElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGClipPathElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGClipPathElementXmllang), (intptr_t)setJSSVGClipPathElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGClipPathElementXmlspace), (intptr_t)setJSSVGClipPathElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGClipPathElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGClipPathElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGClipPathElementStyle), (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGClipPathElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGClipPathElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGClipPathElementFarthestViewportElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGClipPathElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -74,19 +75,66 @@ static JSC_CONST_HASHTABLE HashTable JSSVGClipPathElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 127, JSSVGClipPathElementTableValues, 0 };
 #else
-    { 34, 31, JSSVGClipPathElementTableValues, 0 };
+    { 35, 31, JSSVGClipPathElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGClipPathElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGClipPathElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGClipPathElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGClipPathElementConstructorTableValues, 0 };
 #endif
 
+class JSSVGClipPathElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGClipPathElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGClipPathElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGClipPathElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGClipPathElementConstructor::s_info = { "SVGClipPathElementConstructor", 0, &JSSVGClipPathElementConstructorTable, 0 };
+
+bool JSSVGClipPathElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGClipPathElementConstructor, DOMObject>(exec, &JSSVGClipPathElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGClipPathElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGClipPathElementConstructor, DOMObject>(exec, &JSSVGClipPathElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGClipPathElementPrototypeTableValues[7] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGClipPathElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGClipPathElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGClipPathElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGClipPathElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGClipPathElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGClipPathElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGClipPathElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGClipPathElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGClipPathElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGClipPathElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGClipPathElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGClipPathElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -136,106 +184,123 @@ bool JSSVGClipPathElement::getOwnPropertyDescriptor(ExecState* exec, const Ident
     return getStaticValueDescriptor<JSSVGClipPathElement, Base>(exec, &JSSVGClipPathElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGClipPathElementClipPathUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementClipPathUnits(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()));
+    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->clipPathUnitsAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGClipPathElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()));
+    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGClipPathElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()));
+    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGClipPathElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()));
+    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGClipPathElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()));
+    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGClipPathElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()));
+    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGClipPathElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()));
+    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGClipPathElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()));
+    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGClipPathElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()));
+    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGClipPathElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()));
+    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGClipPathElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()));
+    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGClipPathElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()));
+    JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
+JSValue jsSVGClipPathElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGClipPathElement* domObject = static_cast<JSSVGClipPathElement*>(asObject(slotBase));
+    return JSSVGClipPathElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGClipPathElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGClipPathElement, Base>(exec, propertyName, value, &JSSVGClipPathElementTable, this, slot);
@@ -243,16 +308,23 @@ void JSSVGClipPathElement::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSSVGClipPathElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(thisObject)->impl());
+    JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(thisObject);
+    SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGClipPathElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(thisObject)->impl());
+    JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(thisObject);
+    SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGClipPathElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGClipPathElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -290,7 +362,7 @@ JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetBBox(ExecState* ex
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -303,7 +375,7 @@ JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetCTM(ExecState* exe
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -316,7 +388,7 @@ JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetScreenCTM(ExecStat
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -331,7 +403,7 @@ JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetTransformToElement
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
index 881825409a..b7ecfc02ac 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGClipPathElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,20 +79,21 @@ JSC::JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetScreenCTM(JSC
 JSC::JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGClipPathElementClipPathUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGClipPathElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGClipPathElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGClipPathElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGClipPathElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementClipPathUnits(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGClipPathElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGClipPathElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGClipPathElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGClipPathElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGClipPathElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGClipPathElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGClipPathElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGClipPathElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGClipPathElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGClipPathElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGClipPathElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGClipPathElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGClipPathElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGClipPathElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGClipPathElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGClipPathElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGClipPathElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGClipPathElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGClipPathElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
index 7a89671104..caaae6ceba 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
@@ -41,9 +41,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGColor);
 
 static const HashTableValue JSSVGColorTableValues[4] =
 {
-    { "colorType", DontDelete|ReadOnly, (intptr_t)jsSVGColorColorType, (intptr_t)0 },
-    { "rgbColor", DontDelete|ReadOnly, (intptr_t)jsSVGColorRgbColor, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGColorConstructor, (intptr_t)0 },
+    { "colorType", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGColorColorType), (intptr_t)0 },
+    { "rgbColor", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGColorRgbColor), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGColorConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -58,10 +58,10 @@ static JSC_CONST_HASHTABLE HashTable JSSVGColorTable =
 
 static const HashTableValue JSSVGColorConstructorTableValues[5] =
 {
-    { "SVG_COLORTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGColorSVG_COLORTYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_COLORTYPE_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGColorSVG_COLORTYPE_RGBCOLOR, (intptr_t)0 },
-    { "SVG_COLORTYPE_RGBCOLOR_ICCCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR, (intptr_t)0 },
-    { "SVG_COLORTYPE_CURRENTCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGColorSVG_COLORTYPE_CURRENTCOLOR, (intptr_t)0 },
+    { "SVG_COLORTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGColorSVG_COLORTYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_COLORTYPE_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGColorSVG_COLORTYPE_RGBCOLOR), (intptr_t)0 },
+    { "SVG_COLORTYPE_RGBCOLOR_ICCCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR), (intptr_t)0 },
+    { "SVG_COLORTYPE_CURRENTCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGColorSVG_COLORTYPE_CURRENTCOLOR), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -86,7 +86,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -109,13 +109,13 @@ bool JSSVGColorConstructor::getOwnPropertyDescriptor(ExecState* exec, const Iden
 
 static const HashTableValue JSSVGColorPrototypeTableValues[8] =
 {
-    { "SVG_COLORTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGColorSVG_COLORTYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_COLORTYPE_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGColorSVG_COLORTYPE_RGBCOLOR, (intptr_t)0 },
-    { "SVG_COLORTYPE_RGBCOLOR_ICCCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR, (intptr_t)0 },
-    { "SVG_COLORTYPE_CURRENTCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGColorSVG_COLORTYPE_CURRENTCOLOR, (intptr_t)0 },
-    { "setRGBColor", DontDelete|Function, (intptr_t)jsSVGColorPrototypeFunctionSetRGBColor, (intptr_t)1 },
-    { "setRGBColorICCColor", DontDelete|Function, (intptr_t)jsSVGColorPrototypeFunctionSetRGBColorICCColor, (intptr_t)2 },
-    { "setColor", DontDelete|Function, (intptr_t)jsSVGColorPrototypeFunctionSetColor, (intptr_t)3 },
+    { "SVG_COLORTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGColorSVG_COLORTYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_COLORTYPE_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGColorSVG_COLORTYPE_RGBCOLOR), (intptr_t)0 },
+    { "SVG_COLORTYPE_RGBCOLOR_ICCCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR), (intptr_t)0 },
+    { "SVG_COLORTYPE_CURRENTCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGColorSVG_COLORTYPE_CURRENTCOLOR), (intptr_t)0 },
+    { "setRGBColor", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGColorPrototypeFunctionSetRGBColor), (intptr_t)1 },
+    { "setRGBColorICCColor", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGColorPrototypeFunctionSetRGBColorICCColor), (intptr_t)2 },
+    { "setColor", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGColorPrototypeFunctionSetColor), (intptr_t)3 },
     { 0, 0, 0, 0 }
 };
 
@@ -165,25 +165,27 @@ bool JSSVGColor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     return getStaticValueDescriptor<JSSVGColor, Base>(exec, &JSSVGColorTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGColorColorType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGColorColorType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGColor* castedThis = static_cast<JSSVGColor*>(asObject(slot.slotBase()));
+    JSSVGColor* castedThis = static_cast<JSSVGColor*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGColor* imp = static_cast<SVGColor*>(castedThis->impl());
-    return jsNumber(exec, imp->colorType());
+    JSValue result = jsNumber(exec, imp->colorType());
+    return result;
 }
 
-JSValue jsSVGColorRgbColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGColorRgbColor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGColor* castedThis = static_cast<JSSVGColor*>(asObject(slot.slotBase()));
+    JSSVGColor* castedThis = static_cast<JSSVGColor*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGColor* imp = static_cast<SVGColor*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->rgbColor()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->rgbColor()));
+    return result;
 }
 
-JSValue jsSVGColorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGColorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGColor* domObject = static_cast<JSSVGColor*>(asObject(slot.slotBase()));
+    JSSVGColor* domObject = static_cast<JSSVGColor*>(asObject(slotBase));
     return JSSVGColor::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGColor::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -241,22 +243,22 @@ JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetColor(ExecState* exec, JSObj
 
 // Constant getters
 
-JSValue jsSVGColorSVG_COLORTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGColorSVG_COLORTYPE_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGColorSVG_COLORTYPE_CURRENTCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGColorSVG_COLORTYPE_CURRENTCOLOR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
index 220f73e09d..11ffff1120 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGColorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,15 +75,15 @@ JSC::JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetRGBColorICCColor(JSC::E
 JSC::JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGColorColorType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGColorRgbColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGColorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorColorType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGColorRgbColor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGColorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGColorSVG_COLORTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGColorSVG_COLORTYPE_CURRENTCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorSVG_COLORTYPE_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGColorSVG_COLORTYPE_CURRENTCOLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
index f346d07687..540c56ee5a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
@@ -40,14 +40,14 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGComponentTransferFunctionElement);
 
 static const HashTableValue JSSVGComponentTransferFunctionElementTableValues[9] =
 {
-    { "type", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementType, (intptr_t)0 },
-    { "tableValues", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementTableValues, (intptr_t)0 },
-    { "slope", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementSlope, (intptr_t)0 },
-    { "intercept", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementIntercept, (intptr_t)0 },
-    { "amplitude", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementAmplitude, (intptr_t)0 },
-    { "exponent", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementExponent, (intptr_t)0 },
-    { "offset", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementOffset, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementConstructor, (intptr_t)0 },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementType), (intptr_t)0 },
+    { "tableValues", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementTableValues), (intptr_t)0 },
+    { "slope", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementSlope), (intptr_t)0 },
+    { "intercept", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementIntercept), (intptr_t)0 },
+    { "amplitude", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementAmplitude), (intptr_t)0 },
+    { "exponent", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementExponent), (intptr_t)0 },
+    { "offset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementOffset), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -62,12 +62,12 @@ static JSC_CONST_HASHTABLE HashTable JSSVGComponentTransferFunctionElementTable
 
 static const HashTableValue JSSVGComponentTransferFunctionElementConstructorTableValues[7] =
 {
-    { "SVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_FECOMPONENTTRANSFER_TYPE_IDENTITY", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY, (intptr_t)0 },
-    { "SVG_FECOMPONENTTRANSFER_TYPE_TABLE", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE, (intptr_t)0 },
-    { "SVG_FECOMPONENTTRANSFER_TYPE_DISCRETE", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE, (intptr_t)0 },
-    { "SVG_FECOMPONENTTRANSFER_TYPE_LINEAR", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR, (intptr_t)0 },
-    { "SVG_FECOMPONENTTRANSFER_TYPE_GAMMA", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA, (intptr_t)0 },
+    { "SVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_FECOMPONENTTRANSFER_TYPE_IDENTITY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY), (intptr_t)0 },
+    { "SVG_FECOMPONENTTRANSFER_TYPE_TABLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE), (intptr_t)0 },
+    { "SVG_FECOMPONENTTRANSFER_TYPE_DISCRETE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE), (intptr_t)0 },
+    { "SVG_FECOMPONENTTRANSFER_TYPE_LINEAR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR), (intptr_t)0 },
+    { "SVG_FECOMPONENTTRANSFER_TYPE_GAMMA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -92,7 +92,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -115,12 +115,12 @@ bool JSSVGComponentTransferFunctionElementConstructor::getOwnPropertyDescriptor(
 
 static const HashTableValue JSSVGComponentTransferFunctionElementPrototypeTableValues[7] =
 {
-    { "SVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_FECOMPONENTTRANSFER_TYPE_IDENTITY", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY, (intptr_t)0 },
-    { "SVG_FECOMPONENTTRANSFER_TYPE_TABLE", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE, (intptr_t)0 },
-    { "SVG_FECOMPONENTTRANSFER_TYPE_DISCRETE", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE, (intptr_t)0 },
-    { "SVG_FECOMPONENTTRANSFER_TYPE_LINEAR", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR, (intptr_t)0 },
-    { "SVG_FECOMPONENTTRANSFER_TYPE_GAMMA", DontDelete|ReadOnly, (intptr_t)jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA, (intptr_t)0 },
+    { "SVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_FECOMPONENTTRANSFER_TYPE_IDENTITY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY), (intptr_t)0 },
+    { "SVG_FECOMPONENTTRANSFER_TYPE_TABLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE), (intptr_t)0 },
+    { "SVG_FECOMPONENTTRANSFER_TYPE_DISCRETE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE), (intptr_t)0 },
+    { "SVG_FECOMPONENTTRANSFER_TYPE_LINEAR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR), (intptr_t)0 },
+    { "SVG_FECOMPONENTTRANSFER_TYPE_GAMMA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -170,72 +170,79 @@ bool JSSVGComponentTransferFunctionElement::getOwnPropertyDescriptor(ExecState*
     return getStaticValueDescriptor<JSSVGComponentTransferFunctionElement, Base>(exec, &JSSVGComponentTransferFunctionElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGComponentTransferFunctionElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGComponentTransferFunctionElement* castedThis = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()));
+    JSSVGComponentTransferFunctionElement* castedThis = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->typeAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGComponentTransferFunctionElementTableValues(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementTableValues(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGComponentTransferFunctionElement* castedThis = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()));
+    JSSVGComponentTransferFunctionElement* castedThis = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumberList> obj = imp->tableValuesAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGComponentTransferFunctionElementSlope(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementSlope(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGComponentTransferFunctionElement* castedThis = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()));
+    JSSVGComponentTransferFunctionElement* castedThis = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->slopeAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGComponentTransferFunctionElementIntercept(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementIntercept(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGComponentTransferFunctionElement* castedThis = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()));
+    JSSVGComponentTransferFunctionElement* castedThis = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->interceptAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGComponentTransferFunctionElementAmplitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementAmplitude(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGComponentTransferFunctionElement* castedThis = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()));
+    JSSVGComponentTransferFunctionElement* castedThis = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->amplitudeAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGComponentTransferFunctionElementExponent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementExponent(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGComponentTransferFunctionElement* castedThis = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()));
+    JSSVGComponentTransferFunctionElement* castedThis = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->exponentAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGComponentTransferFunctionElementOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGComponentTransferFunctionElement* castedThis = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()));
+    JSSVGComponentTransferFunctionElement* castedThis = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->offsetAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGComponentTransferFunctionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGComponentTransferFunctionElement* domObject = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()));
+    JSSVGComponentTransferFunctionElement* domObject = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slotBase));
     return JSSVGComponentTransferFunctionElement::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGComponentTransferFunctionElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -245,32 +252,32 @@ JSValue JSSVGComponentTransferFunctionElement::getConstructor(ExecState* exec, J
 
 // Constant getters
 
-JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
index b7cf7c418f..2284828313 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGComponentTransferFunctionElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -70,22 +70,22 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGComponentTransferFunctionElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGComponentTransferFunctionElementTableValues(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGComponentTransferFunctionElementSlope(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGComponentTransferFunctionElementIntercept(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGComponentTransferFunctionElementAmplitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGComponentTransferFunctionElementExponent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGComponentTransferFunctionElementOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGComponentTransferFunctionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGComponentTransferFunctionElementTableValues(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSlope(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGComponentTransferFunctionElementIntercept(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGComponentTransferFunctionElementAmplitude(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGComponentTransferFunctionElementExponent(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGComponentTransferFunctionElementOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGComponentTransferFunctionElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp
index 80c0c0e875..6085fe5ab2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp
@@ -41,30 +41,78 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGCursorElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGCursorElementTableValues[8] =
-{
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGCursorElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGCursorElementY, (intptr_t)0 },
-    { "href", DontDelete|ReadOnly, (intptr_t)jsSVGCursorElementHref, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGCursorElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGCursorElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGCursorElementSystemLanguage, (intptr_t)0 },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGCursorElementExternalResourcesRequired, (intptr_t)0 },
+static const HashTableValue JSSVGCursorElementTableValues[9] =
+{
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCursorElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCursorElementY), (intptr_t)0 },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCursorElementHref), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCursorElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCursorElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCursorElementSystemLanguage), (intptr_t)0 },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCursorElementExternalResourcesRequired), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGCursorElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGCursorElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 31, JSSVGCursorElementTableValues, 0 };
+    { 63, JSSVGCursorElementTableValues, 0 };
+#else
+    { 18, 15, JSSVGCursorElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGCursorElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGCursorElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGCursorElementConstructorTableValues, 0 };
 #else
-    { 17, 15, JSSVGCursorElementTableValues, 0 };
+    { 1, 0, JSSVGCursorElementConstructorTableValues, 0 };
 #endif
 
+class JSSVGCursorElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGCursorElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGCursorElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGCursorElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGCursorElementConstructor::s_info = { "SVGCursorElementConstructor", 0, &JSSVGCursorElementConstructorTable, 0 };
+
+bool JSSVGCursorElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGCursorElementConstructor, DOMObject>(exec, &JSSVGCursorElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGCursorElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGCursorElementConstructor, DOMObject>(exec, &JSSVGCursorElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGCursorElementPrototypeTableValues[2] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGCursorElementPrototypeFunctionHasExtension, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGCursorElementPrototypeFunctionHasExtension), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -114,64 +162,81 @@ bool JSSVGCursorElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSSVGCursorElement, Base>(exec, &JSSVGCursorElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGCursorElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCursorElement* castedThis = static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()));
+    JSSVGCursorElement* castedThis = static_cast<JSSVGCursorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGCursorElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCursorElement* castedThis = static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()));
+    JSSVGCursorElement* castedThis = static_cast<JSSVGCursorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGCursorElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCursorElement* castedThis = static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()));
+    JSSVGCursorElement* castedThis = static_cast<JSSVGCursorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGCursorElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCursorElement* castedThis = static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()));
+    JSSVGCursorElement* castedThis = static_cast<JSSVGCursorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGCursorElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCursorElement* castedThis = static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()));
+    JSSVGCursorElement* castedThis = static_cast<JSSVGCursorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGCursorElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCursorElement* castedThis = static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()));
+    JSSVGCursorElement* castedThis = static_cast<JSSVGCursorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGCursorElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGCursorElement* castedThis = static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()));
+    JSSVGCursorElement* castedThis = static_cast<JSSVGCursorElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
+}
+
+JSValue jsSVGCursorElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGCursorElement* domObject = static_cast<JSSVGCursorElement*>(asObject(slotBase));
+    return JSSVGCursorElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGCursorElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGCursorElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGCursorElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
index ef61751652..1901eb77ca 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -60,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGCursorElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,13 +73,14 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGCursorElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGCursorElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCursorElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCursorElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCursorElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCursorElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCursorElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGCursorElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCursorElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCursorElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCursorElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCursorElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCursorElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCursorElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCursorElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGCursorElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp
index 4ff5cf8cda..e72d26e155 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp
@@ -52,19 +52,20 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGDefsElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGDefsElementTableValues[12] =
-{
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGDefsElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGDefsElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGDefsElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGDefsElementXmllang, (intptr_t)setJSSVGDefsElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGDefsElementXmlspace, (intptr_t)setJSSVGDefsElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGDefsElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGDefsElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGDefsElementStyle, (intptr_t)0 },
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGDefsElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGDefsElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGDefsElementFarthestViewportElement, (intptr_t)0 },
+static const HashTableValue JSSVGDefsElementTableValues[13] =
+{
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDefsElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDefsElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDefsElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDefsElementXmllang), (intptr_t)setJSSVGDefsElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDefsElementXmlspace), (intptr_t)setJSSVGDefsElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDefsElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDefsElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDefsElementStyle), (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDefsElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDefsElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDefsElementFarthestViewportElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDefsElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -72,19 +73,66 @@ static JSC_CONST_HASHTABLE HashTable JSSVGDefsElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 127, JSSVGDefsElementTableValues, 0 };
 #else
-    { 33, 31, JSSVGDefsElementTableValues, 0 };
+    { 34, 31, JSSVGDefsElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGDefsElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGDefsElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGDefsElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGDefsElementConstructorTableValues, 0 };
 #endif
 
+class JSSVGDefsElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGDefsElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGDefsElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGDefsElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGDefsElementConstructor::s_info = { "SVGDefsElementConstructor", 0, &JSSVGDefsElementConstructorTable, 0 };
+
+bool JSSVGDefsElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGDefsElementConstructor, DOMObject>(exec, &JSSVGDefsElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGDefsElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGDefsElementConstructor, DOMObject>(exec, &JSSVGDefsElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGDefsElementPrototypeTableValues[7] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGDefsElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGDefsElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGDefsElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGDefsElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGDefsElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGDefsElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGDefsElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGDefsElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGDefsElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGDefsElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGDefsElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGDefsElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -134,97 +182,113 @@ bool JSSVGDefsElement::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSSVGDefsElement, Base>(exec, &JSSVGDefsElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGDefsElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()));
+    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGDefsElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()));
+    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGDefsElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()));
+    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGDefsElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()));
+    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGDefsElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()));
+    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGDefsElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()));
+    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGDefsElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()));
+    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGDefsElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()));
+    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGDefsElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()));
+    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGDefsElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()));
+    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGDefsElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()));
+    JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
+JSValue jsSVGDefsElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGDefsElement* domObject = static_cast<JSSVGDefsElement*>(asObject(slotBase));
+    return JSSVGDefsElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGDefsElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGDefsElement, Base>(exec, propertyName, value, &JSSVGDefsElementTable, this, slot);
@@ -232,16 +296,23 @@ void JSSVGDefsElement::put(ExecState* exec, const Identifier& propertyName, JSVa
 
 void setJSSVGDefsElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(thisObject)->impl());
+    JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(thisObject);
+    SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGDefsElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(thisObject)->impl());
+    JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(thisObject);
+    SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGDefsElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGDefsElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -279,7 +350,7 @@ JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetBBox(ExecState* exec,
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -292,7 +363,7 @@ JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetCTM(ExecState* exec, J
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -305,7 +376,7 @@ JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetScreenCTM(ExecState* e
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -320,7 +391,7 @@ JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetTransformToElement(Exe
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
index da6470b8de..5def53b845 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGDefsElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,19 +79,20 @@ JSC::JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetScreenCTM(JSC::Ex
 JSC::JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGDefsElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGDefsElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGDefsElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGDefsElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGDefsElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGDefsElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGDefsElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGDefsElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGDefsElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGDefsElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGDefsElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGDefsElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGDefsElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGDefsElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGDefsElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGDefsElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGDefsElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGDefsElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGDefsElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGDefsElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGDefsElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGDefsElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp
index 1c566c8a9c..31a294d2c3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp
@@ -44,12 +44,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGDescElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGDescElementTableValues[5] =
+static const HashTableValue JSSVGDescElementTableValues[6] =
 {
-    { "xmllang", DontDelete, (intptr_t)jsSVGDescElementXmllang, (intptr_t)setJSSVGDescElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGDescElementXmlspace, (intptr_t)setJSSVGDescElementXmlspace },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGDescElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGDescElementStyle, (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDescElementXmllang), (intptr_t)setJSSVGDescElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDescElementXmlspace), (intptr_t)setJSSVGDescElementXmlspace },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDescElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDescElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDescElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -57,14 +58,61 @@ static JSC_CONST_HASHTABLE HashTable JSSVGDescElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 15, JSSVGDescElementTableValues, 0 };
 #else
-    { 9, 7, JSSVGDescElementTableValues, 0 };
+    { 16, 15, JSSVGDescElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGDescElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGDescElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGDescElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGDescElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGDescElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGDescElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGDescElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGDescElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGDescElementConstructor::s_info = { "SVGDescElementConstructor", 0, &JSSVGDescElementConstructorTable, 0 };
+
+bool JSSVGDescElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGDescElementConstructor, DOMObject>(exec, &JSSVGDescElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGDescElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGDescElementConstructor, DOMObject>(exec, &JSSVGDescElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGDescElementPrototypeTableValues[2] =
 {
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGDescElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGDescElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -114,39 +162,48 @@ bool JSSVGDescElement::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSSVGDescElement, Base>(exec, &JSSVGDescElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGDescElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDescElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDescElement* castedThis = static_cast<JSSVGDescElement*>(asObject(slot.slotBase()));
+    JSSVGDescElement* castedThis = static_cast<JSSVGDescElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDescElement* imp = static_cast<SVGDescElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGDescElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDescElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDescElement* castedThis = static_cast<JSSVGDescElement*>(asObject(slot.slotBase()));
+    JSSVGDescElement* castedThis = static_cast<JSSVGDescElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDescElement* imp = static_cast<SVGDescElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGDescElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDescElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDescElement* castedThis = static_cast<JSSVGDescElement*>(asObject(slot.slotBase()));
+    JSSVGDescElement* castedThis = static_cast<JSSVGDescElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDescElement* imp = static_cast<SVGDescElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGDescElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDescElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDescElement* castedThis = static_cast<JSSVGDescElement*>(asObject(slot.slotBase()));
+    JSSVGDescElement* castedThis = static_cast<JSSVGDescElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDescElement* imp = static_cast<SVGDescElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
+JSValue jsSVGDescElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGDescElement* domObject = static_cast<JSSVGDescElement*>(asObject(slotBase));
+    return JSSVGDescElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGDescElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGDescElement, Base>(exec, propertyName, value, &JSSVGDescElementTable, this, slot);
@@ -154,16 +211,23 @@ void JSSVGDescElement::put(ExecState* exec, const Identifier& propertyName, JSVa
 
 void setJSSVGDescElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGDescElement* imp = static_cast<SVGDescElement*>(static_cast<JSSVGDescElement*>(thisObject)->impl());
+    JSSVGDescElement* castedThisObj = static_cast<JSSVGDescElement*>(thisObject);
+    SVGDescElement* imp = static_cast<SVGDescElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGDescElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGDescElement* imp = static_cast<SVGDescElement*>(static_cast<JSSVGDescElement*>(thisObject)->impl());
+    JSSVGDescElement* castedThisObj = static_cast<JSSVGDescElement*>(thisObject);
+    SVGDescElement* imp = static_cast<SVGDescElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGDescElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGDescElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGDescElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
index 1f43e7a85b..ea0d49a001 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGDescElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,12 +74,13 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGDescElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGDescElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDescElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGDescElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGDescElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDescElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGDescElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGDescElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGDescElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDescElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGDescElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGDescElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp
index 15632fb113..bdb5323847 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp
@@ -40,24 +40,72 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGDocument);
 
 /* Hash table */
 
-static const HashTableValue JSSVGDocumentTableValues[2] =
+static const HashTableValue JSSVGDocumentTableValues[3] =
 {
-    { "rootElement", DontDelete|ReadOnly, (intptr_t)jsSVGDocumentRootElement, (intptr_t)0 },
+    { "rootElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDocumentRootElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGDocumentConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGDocumentTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGDocumentTableValues, 0 };
+    { 1, JSSVGDocumentTableValues, 0 };
 #else
-    { 2, 1, JSSVGDocumentTableValues, 0 };
+    { 4, 3, JSSVGDocumentTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGDocumentConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGDocumentConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGDocumentConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGDocumentConstructorTableValues, 0 };
+#endif
+
+class JSSVGDocumentConstructor : public DOMConstructorObject {
+public:
+    JSSVGDocumentConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGDocumentConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGDocumentPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGDocumentConstructor::s_info = { "SVGDocumentConstructor", 0, &JSSVGDocumentConstructorTable, 0 };
+
+bool JSSVGDocumentConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGDocumentConstructor, DOMObject>(exec, &JSSVGDocumentConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGDocumentConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGDocumentConstructor, DOMObject>(exec, &JSSVGDocumentConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGDocumentPrototypeTableValues[2] =
 {
-    { "createEvent", DontDelete|Function, (intptr_t)jsSVGDocumentPrototypeFunctionCreateEvent, (intptr_t)1 },
+    { "createEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGDocumentPrototypeFunctionCreateEvent), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -107,12 +155,23 @@ bool JSSVGDocument::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSSVGDocument, Base>(exec, &JSSVGDocumentTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGDocumentRootElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDocumentRootElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGDocument* castedThis = static_cast<JSSVGDocument*>(asObject(slot.slotBase()));
+    JSSVGDocument* castedThis = static_cast<JSSVGDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGDocument* imp = static_cast<SVGDocument*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->rootElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->rootElement()));
+    return result;
+}
+
+JSValue jsSVGDocumentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGDocument* domObject = static_cast<JSSVGDocument*>(asObject(slotBase));
+    return JSSVGDocument::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGDocument::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGDocumentConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGDocumentPrototypeFunctionCreateEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
index 47c6b157cd..00bbd83fd9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -60,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGDocumentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,7 +73,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGDocumentPrototypeFunctionCreateEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGDocumentRootElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDocumentRootElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGDocumentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
index c4cc3a48ac..23d2460287 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
@@ -41,12 +41,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGElementTableValues[5] =
+static const HashTableValue JSSVGElementTableValues[6] =
 {
-    { "id", DontDelete, (intptr_t)jsSVGElementId, (intptr_t)setJSSVGElementId },
-    { "xmlbase", DontDelete, (intptr_t)jsSVGElementXmlbase, (intptr_t)setJSSVGElementXmlbase },
-    { "ownerSVGElement", DontDelete|ReadOnly, (intptr_t)jsSVGElementOwnerSVGElement, (intptr_t)0 },
-    { "viewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGElementViewportElement, (intptr_t)0 },
+    { "id", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementId), (intptr_t)setJSSVGElementId },
+    { "xmlbase", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementXmlbase), (intptr_t)setJSSVGElementXmlbase },
+    { "ownerSVGElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementOwnerSVGElement), (intptr_t)0 },
+    { "viewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementViewportElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -54,9 +55,56 @@ static JSC_CONST_HASHTABLE HashTable JSSVGElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 15, JSSVGElementTableValues, 0 };
 #else
-    { 9, 7, JSSVGElementTableValues, 0 };
+    { 16, 15, JSSVGElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGElementConstructor::s_info = { "SVGElementConstructor", 0, &JSSVGElementConstructorTable, 0 };
+
+bool JSSVGElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGElementConstructor, DOMObject>(exec, &JSSVGElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGElementConstructor, DOMObject>(exec, &JSSVGElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGElementPrototypeTableValues[1] =
@@ -100,38 +148,47 @@ bool JSSVGElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<JSSVGElement, Base>(exec, &JSSVGElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGElementId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElement* castedThis = static_cast<JSSVGElement*>(asObject(slot.slotBase()));
+    JSSVGElement* castedThis = static_cast<JSSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElement* imp = static_cast<SVGElement*>(castedThis->impl());
-    return jsString(exec, imp->getAttribute(HTMLNames::idAttr));
+    JSValue result = jsString(exec, imp->getAttribute(HTMLNames::idAttr));
+    return result;
 }
 
-JSValue jsSVGElementXmlbase(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementXmlbase(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElement* castedThis = static_cast<JSSVGElement*>(asObject(slot.slotBase()));
+    JSSVGElement* castedThis = static_cast<JSSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElement* imp = static_cast<SVGElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlbase());
+    JSValue result = jsString(exec, imp->xmlbase());
+    return result;
 }
 
-JSValue jsSVGElementOwnerSVGElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementOwnerSVGElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElement* castedThis = static_cast<JSSVGElement*>(asObject(slot.slotBase()));
+    JSSVGElement* castedThis = static_cast<JSSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElement* imp = static_cast<SVGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->ownerSVGElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->ownerSVGElement()));
+    return result;
 }
 
-JSValue jsSVGElementViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElement* castedThis = static_cast<JSSVGElement*>(asObject(slot.slotBase()));
+    JSSVGElement* castedThis = static_cast<JSSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElement* imp = static_cast<SVGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->viewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->viewportElement()));
+    return result;
 }
 
+JSValue jsSVGElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGElement* domObject = static_cast<JSSVGElement*>(asObject(slotBase));
+    return JSSVGElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGElement, Base>(exec, propertyName, value, &JSSVGElementTable, this, slot);
@@ -139,7 +196,8 @@ void JSSVGElement::put(ExecState* exec, const Identifier& propertyName, JSValue
 
 void setJSSVGElementId(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(thisObject)->impl());
+    JSSVGElement* castedThisObj = static_cast<JSSVGElement*>(thisObject);
+    SVGElement* imp = static_cast<SVGElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setAttribute(HTMLNames::idAttr, valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -147,12 +205,18 @@ void setJSSVGElementId(ExecState* exec, JSObject* thisObject, JSValue value)
 
 void setJSSVGElementXmlbase(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(thisObject)->impl());
+    JSSVGElement* castedThisObj = static_cast<JSSVGElement*>(thisObject);
+    SVGElement* imp = static_cast<SVGElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setXmlbase(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
 }
 
+JSValue JSSVGElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 SVGElement* toSVGElement(JSC::JSValue value)
 {
     return value.inherits(&JSSVGElement::s_info) ? static_cast<JSSVGElement*>(asObject(value))->impl() : 0;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
index 111f9b90d5..3ef3ac8d5c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGElement* impl() const
     {
         return static_cast<SVGElement*>(Base::impl());
@@ -64,7 +65,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,12 +74,13 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGElementId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementXmlbase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementXmlbase(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementXmlbase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementOwnerSVGElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGElementViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementOwnerSVGElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGElementViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp
index 1bb0736acb..549591d26b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp
@@ -26,8 +26,6 @@
 
 #include "Event.h"
 #include "EventListener.h"
-#include "Frame.h"
-#include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "JSSVGElement.h"
@@ -49,56 +47,57 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGElementInstance);
 
 /* Hash table */
 
-static const HashTableValue JSSVGElementInstanceTableValues[49] =
-{
-    { "correspondingElement", DontDelete|ReadOnly, (intptr_t)jsSVGElementInstanceCorrespondingElement, (intptr_t)0 },
-    { "correspondingUseElement", DontDelete|ReadOnly, (intptr_t)jsSVGElementInstanceCorrespondingUseElement, (intptr_t)0 },
-    { "parentNode", DontDelete|ReadOnly, (intptr_t)jsSVGElementInstanceParentNode, (intptr_t)0 },
-    { "childNodes", DontDelete|ReadOnly, (intptr_t)jsSVGElementInstanceChildNodes, (intptr_t)0 },
-    { "firstChild", DontDelete|ReadOnly, (intptr_t)jsSVGElementInstanceFirstChild, (intptr_t)0 },
-    { "lastChild", DontDelete|ReadOnly, (intptr_t)jsSVGElementInstanceLastChild, (intptr_t)0 },
-    { "previousSibling", DontDelete|ReadOnly, (intptr_t)jsSVGElementInstancePreviousSibling, (intptr_t)0 },
-    { "nextSibling", DontDelete|ReadOnly, (intptr_t)jsSVGElementInstanceNextSibling, (intptr_t)0 },
-    { "onabort", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnabort, (intptr_t)setJSSVGElementInstanceOnabort },
-    { "onblur", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnblur, (intptr_t)setJSSVGElementInstanceOnblur },
-    { "onchange", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnchange, (intptr_t)setJSSVGElementInstanceOnchange },
-    { "onclick", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnclick, (intptr_t)setJSSVGElementInstanceOnclick },
-    { "oncontextmenu", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOncontextmenu, (intptr_t)setJSSVGElementInstanceOncontextmenu },
-    { "ondblclick", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOndblclick, (intptr_t)setJSSVGElementInstanceOndblclick },
-    { "onerror", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnerror, (intptr_t)setJSSVGElementInstanceOnerror },
-    { "onfocus", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnfocus, (intptr_t)setJSSVGElementInstanceOnfocus },
-    { "oninput", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOninput, (intptr_t)setJSSVGElementInstanceOninput },
-    { "onkeydown", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnkeydown, (intptr_t)setJSSVGElementInstanceOnkeydown },
-    { "onkeypress", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnkeypress, (intptr_t)setJSSVGElementInstanceOnkeypress },
-    { "onkeyup", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnkeyup, (intptr_t)setJSSVGElementInstanceOnkeyup },
-    { "onload", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnload, (intptr_t)setJSSVGElementInstanceOnload },
-    { "onmousedown", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnmousedown, (intptr_t)setJSSVGElementInstanceOnmousedown },
-    { "onmousemove", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnmousemove, (intptr_t)setJSSVGElementInstanceOnmousemove },
-    { "onmouseout", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnmouseout, (intptr_t)setJSSVGElementInstanceOnmouseout },
-    { "onmouseover", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnmouseover, (intptr_t)setJSSVGElementInstanceOnmouseover },
-    { "onmouseup", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnmouseup, (intptr_t)setJSSVGElementInstanceOnmouseup },
-    { "onmousewheel", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnmousewheel, (intptr_t)setJSSVGElementInstanceOnmousewheel },
-    { "onbeforecut", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnbeforecut, (intptr_t)setJSSVGElementInstanceOnbeforecut },
-    { "oncut", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOncut, (intptr_t)setJSSVGElementInstanceOncut },
-    { "onbeforecopy", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnbeforecopy, (intptr_t)setJSSVGElementInstanceOnbeforecopy },
-    { "oncopy", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOncopy, (intptr_t)setJSSVGElementInstanceOncopy },
-    { "onbeforepaste", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnbeforepaste, (intptr_t)setJSSVGElementInstanceOnbeforepaste },
-    { "onpaste", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnpaste, (intptr_t)setJSSVGElementInstanceOnpaste },
-    { "ondragenter", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOndragenter, (intptr_t)setJSSVGElementInstanceOndragenter },
-    { "ondragover", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOndragover, (intptr_t)setJSSVGElementInstanceOndragover },
-    { "ondragleave", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOndragleave, (intptr_t)setJSSVGElementInstanceOndragleave },
-    { "ondrop", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOndrop, (intptr_t)setJSSVGElementInstanceOndrop },
-    { "ondragstart", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOndragstart, (intptr_t)setJSSVGElementInstanceOndragstart },
-    { "ondrag", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOndrag, (intptr_t)setJSSVGElementInstanceOndrag },
-    { "ondragend", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOndragend, (intptr_t)setJSSVGElementInstanceOndragend },
-    { "onreset", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnreset, (intptr_t)setJSSVGElementInstanceOnreset },
-    { "onresize", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnresize, (intptr_t)setJSSVGElementInstanceOnresize },
-    { "onscroll", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnscroll, (intptr_t)setJSSVGElementInstanceOnscroll },
-    { "onsearch", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnsearch, (intptr_t)setJSSVGElementInstanceOnsearch },
-    { "onselect", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnselect, (intptr_t)setJSSVGElementInstanceOnselect },
-    { "onselectstart", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnselectstart, (intptr_t)setJSSVGElementInstanceOnselectstart },
-    { "onsubmit", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnsubmit, (intptr_t)setJSSVGElementInstanceOnsubmit },
-    { "onunload", DontDelete|DontEnum, (intptr_t)jsSVGElementInstanceOnunload, (intptr_t)setJSSVGElementInstanceOnunload },
+static const HashTableValue JSSVGElementInstanceTableValues[50] =
+{
+    { "correspondingElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceCorrespondingElement), (intptr_t)0 },
+    { "correspondingUseElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceCorrespondingUseElement), (intptr_t)0 },
+    { "parentNode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceParentNode), (intptr_t)0 },
+    { "childNodes", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceChildNodes), (intptr_t)0 },
+    { "firstChild", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceFirstChild), (intptr_t)0 },
+    { "lastChild", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceLastChild), (intptr_t)0 },
+    { "previousSibling", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstancePreviousSibling), (intptr_t)0 },
+    { "nextSibling", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceNextSibling), (intptr_t)0 },
+    { "onabort", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnabort), (intptr_t)setJSSVGElementInstanceOnabort },
+    { "onblur", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnblur), (intptr_t)setJSSVGElementInstanceOnblur },
+    { "onchange", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnchange), (intptr_t)setJSSVGElementInstanceOnchange },
+    { "onclick", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnclick), (intptr_t)setJSSVGElementInstanceOnclick },
+    { "oncontextmenu", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOncontextmenu), (intptr_t)setJSSVGElementInstanceOncontextmenu },
+    { "ondblclick", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOndblclick), (intptr_t)setJSSVGElementInstanceOndblclick },
+    { "onerror", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnerror), (intptr_t)setJSSVGElementInstanceOnerror },
+    { "onfocus", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnfocus), (intptr_t)setJSSVGElementInstanceOnfocus },
+    { "oninput", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOninput), (intptr_t)setJSSVGElementInstanceOninput },
+    { "onkeydown", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnkeydown), (intptr_t)setJSSVGElementInstanceOnkeydown },
+    { "onkeypress", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnkeypress), (intptr_t)setJSSVGElementInstanceOnkeypress },
+    { "onkeyup", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnkeyup), (intptr_t)setJSSVGElementInstanceOnkeyup },
+    { "onload", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnload), (intptr_t)setJSSVGElementInstanceOnload },
+    { "onmousedown", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnmousedown), (intptr_t)setJSSVGElementInstanceOnmousedown },
+    { "onmousemove", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnmousemove), (intptr_t)setJSSVGElementInstanceOnmousemove },
+    { "onmouseout", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnmouseout), (intptr_t)setJSSVGElementInstanceOnmouseout },
+    { "onmouseover", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnmouseover), (intptr_t)setJSSVGElementInstanceOnmouseover },
+    { "onmouseup", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnmouseup), (intptr_t)setJSSVGElementInstanceOnmouseup },
+    { "onmousewheel", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnmousewheel), (intptr_t)setJSSVGElementInstanceOnmousewheel },
+    { "onbeforecut", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnbeforecut), (intptr_t)setJSSVGElementInstanceOnbeforecut },
+    { "oncut", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOncut), (intptr_t)setJSSVGElementInstanceOncut },
+    { "onbeforecopy", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnbeforecopy), (intptr_t)setJSSVGElementInstanceOnbeforecopy },
+    { "oncopy", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOncopy), (intptr_t)setJSSVGElementInstanceOncopy },
+    { "onbeforepaste", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnbeforepaste), (intptr_t)setJSSVGElementInstanceOnbeforepaste },
+    { "onpaste", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnpaste), (intptr_t)setJSSVGElementInstanceOnpaste },
+    { "ondragenter", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOndragenter), (intptr_t)setJSSVGElementInstanceOndragenter },
+    { "ondragover", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOndragover), (intptr_t)setJSSVGElementInstanceOndragover },
+    { "ondragleave", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOndragleave), (intptr_t)setJSSVGElementInstanceOndragleave },
+    { "ondrop", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOndrop), (intptr_t)setJSSVGElementInstanceOndrop },
+    { "ondragstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOndragstart), (intptr_t)setJSSVGElementInstanceOndragstart },
+    { "ondrag", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOndrag), (intptr_t)setJSSVGElementInstanceOndrag },
+    { "ondragend", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOndragend), (intptr_t)setJSSVGElementInstanceOndragend },
+    { "onreset", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnreset), (intptr_t)setJSSVGElementInstanceOnreset },
+    { "onresize", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnresize), (intptr_t)setJSSVGElementInstanceOnresize },
+    { "onscroll", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnscroll), (intptr_t)setJSSVGElementInstanceOnscroll },
+    { "onsearch", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnsearch), (intptr_t)setJSSVGElementInstanceOnsearch },
+    { "onselect", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnselect), (intptr_t)setJSSVGElementInstanceOnselect },
+    { "onselectstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnselectstart), (intptr_t)setJSSVGElementInstanceOnselectstart },
+    { "onsubmit", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnsubmit), (intptr_t)setJSSVGElementInstanceOnsubmit },
+    { "onunload", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceOnunload), (intptr_t)setJSSVGElementInstanceOnunload },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -109,13 +108,60 @@ static JSC_CONST_HASHTABLE HashTable JSSVGElementInstanceTable =
     { 137, 127, JSSVGElementInstanceTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGElementInstanceConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGElementInstanceConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGElementInstanceConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGElementInstanceConstructorTableValues, 0 };
+#endif
+
+class JSSVGElementInstanceConstructor : public DOMConstructorObject {
+public:
+    JSSVGElementInstanceConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGElementInstanceConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGElementInstancePrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGElementInstanceConstructor::s_info = { "SVGElementInstanceConstructor", 0, &JSSVGElementInstanceConstructorTable, 0 };
+
+bool JSSVGElementInstanceConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGElementInstanceConstructor, DOMObject>(exec, &JSSVGElementInstanceConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGElementInstanceConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGElementInstanceConstructor, DOMObject>(exec, &JSSVGElementInstanceConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGElementInstancePrototypeTableValues[4] =
 {
-    { "addEventListener", DontDelete|Function, (intptr_t)jsSVGElementInstancePrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsSVGElementInstancePrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsSVGElementInstancePrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { "addEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGElementInstancePrototypeFunctionAddEventListener), (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGElementInstancePrototypeFunctionRemoveEventListener), (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGElementInstancePrototypeFunctionDispatchEvent), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -171,550 +217,643 @@ bool JSSVGElementInstance::getOwnPropertyDescriptor(ExecState* exec, const Ident
     return getStaticValueDescriptor<JSSVGElementInstance, Base>(exec, &JSSVGElementInstanceTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGElementInstanceCorrespondingElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceCorrespondingElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->correspondingElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->correspondingElement()));
+    return result;
 }
 
-JSValue jsSVGElementInstanceCorrespondingUseElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceCorrespondingUseElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->correspondingUseElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->correspondingUseElement()));
+    return result;
 }
 
-JSValue jsSVGElementInstanceParentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceParentNode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentNode()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentNode()));
+    return result;
 }
 
-JSValue jsSVGElementInstanceChildNodes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceChildNodes(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->childNodes()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->childNodes()));
+    return result;
 }
 
-JSValue jsSVGElementInstanceFirstChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceFirstChild(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->firstChild()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->firstChild()));
+    return result;
 }
 
-JSValue jsSVGElementInstanceLastChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceLastChild(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->lastChild()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->lastChild()));
+    return result;
 }
 
-JSValue jsSVGElementInstancePreviousSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstancePreviousSibling(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->previousSibling()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->previousSibling()));
+    return result;
 }
 
-JSValue jsSVGElementInstanceNextSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceNextSibling(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nextSibling()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nextSibling()));
+    return result;
 }
 
-JSValue jsSVGElementInstanceOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnabort(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onabort()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnblur(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onblur()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnchange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onchange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnclick(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onclick()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOncontextmenu(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->oncontextmenu()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndblclick(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->ondblclick()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnfocus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onfocus()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOninput(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->oninput()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnkeydown(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onkeydown()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnkeypress(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onkeypress()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnkeyup(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onkeyup()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmousedown(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onmousedown()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmousemove(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onmousemove()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmouseout(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseout()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmouseover(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseover()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmouseup(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseup()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmousewheel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onmousewheel()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnbeforecut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnbeforecut(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforecut()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOncut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOncut(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->oncut()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnbeforecopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnbeforecopy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforecopy()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOncopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOncopy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->oncopy()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnbeforepaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnbeforepaste(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforepaste()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnpaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnpaste(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onpaste()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndragenter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->ondragenter()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndragover(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->ondragover()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndragleave(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->ondragleave()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndrop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->ondrop()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndragstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->ondragstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndrag(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->ondrag()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndragend(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->ondragend()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnreset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onreset()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnresize(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onresize()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnscroll(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onscroll()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnsearch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onsearch()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnselect(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onselect()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnselectstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnselectstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onselectstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnsubmit(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onsubmit()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsSVGElementInstanceOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnunload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
+    JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThis->impl());
     if (EventListener* listener = imp->onunload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
+JSValue jsSVGElementInstanceConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGElementInstance* domObject = static_cast<JSSVGElementInstance*>(asObject(slotBase));
+    return JSSVGElementInstance::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGElementInstance::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGElementInstance, Base>(exec, propertyName, value, &JSSVGElementInstanceTable, this, slot);
@@ -724,400 +863,285 @@ void setJSSVGElementInstanceOnabort(ExecState* exec, JSObject* thisObject, JSVal
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
+    imp->setOnabort(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnblur(globalObject->createJSAttributeEventListener(value));
+    imp->setOnblur(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnchange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnchange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnclick(globalObject->createJSAttributeEventListener(value));
+    imp->setOnclick(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
+    imp->setOncontextmenu(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOndblclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
+    imp->setOndblclick(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
+    imp->setOnfocus(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOninput(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOninput(globalObject->createJSAttributeEventListener(value));
+    imp->setOninput(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeydown(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnkeypress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeypress(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeyup(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnmousedown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousedown(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnmousemove(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousemove(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnmouseout(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseout(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnmouseover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseover(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseup(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousewheel(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnbeforecut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforecut(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforecut(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOncut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncut(globalObject->createJSAttributeEventListener(value));
+    imp->setOncut(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforecopy(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforecopy(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOncopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncopy(globalObject->createJSAttributeEventListener(value));
+    imp->setOncopy(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforepaste(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforepaste(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnpaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnpaste(globalObject->createJSAttributeEventListener(value));
+    imp->setOnpaste(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOndragenter(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragenter(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOndragover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragover(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragover(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOndragleave(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragleave(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndrop(globalObject->createJSAttributeEventListener(value));
+    imp->setOndrop(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOndragstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragstart(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndrag(globalObject->createJSAttributeEventListener(value));
+    imp->setOndrag(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOndragend(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragend(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragend(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnreset(globalObject->createJSAttributeEventListener(value));
+    imp->setOnreset(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnresize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnresize(globalObject->createJSAttributeEventListener(value));
+    imp->setOnresize(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
+    imp->setOnscroll(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsearch(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnselect(globalObject->createJSAttributeEventListener(value));
+    imp->setOnselect(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnselectstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnselectstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOnselectstart(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsubmit(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSSVGElementInstanceOnunload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnunload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnunload(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+JSValue JSSVGElementInstance::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGElementInstanceConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
index 57a150fb0e..38a3ab6b91 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -47,13 +46,14 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
 
     virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom functions
     JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
@@ -79,7 +79,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGElementInstancePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -93,94 +93,95 @@ JSC::JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionRemoveEventListe
 JSC::JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGElementInstanceCorrespondingElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGElementInstanceCorrespondingUseElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGElementInstanceParentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGElementInstanceChildNodes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGElementInstanceFirstChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGElementInstanceLastChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGElementInstancePreviousSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGElementInstanceNextSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGElementInstanceOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceCorrespondingElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGElementInstanceCorrespondingUseElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGElementInstanceParentNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGElementInstanceChildNodes(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGElementInstanceFirstChild(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGElementInstanceLastChild(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGElementInstancePreviousSibling(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGElementInstanceNextSibling(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGElementInstanceOnabort(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnblur(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnclick(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOncontextmenu(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOndblclick(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnfocus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOninput(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnkeydown(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnkeypress(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnkeyup(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnmousedown(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnmousemove(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnmouseout(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnmouseover(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnmouseup(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnmousewheel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnbeforecut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnbeforecut(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnbeforecut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOncut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOncut(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOncut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnbeforecopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnbeforecopy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnbeforecopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOncopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOncopy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOncopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnbeforepaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnbeforepaste(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnbeforepaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnpaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnpaste(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnpaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOndragenter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOndragover(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOndragleave(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOndrop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOndragstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOndrag(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOndragend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnreset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnresize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnscroll(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnsearch(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnselect(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnselectstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnselectstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnselectstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnsubmit(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGElementInstanceOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnunload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGElementInstanceOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp
index 893cc760ec..bd217c70ab 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp
@@ -39,24 +39,72 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGElementInstanceList);
 
 /* Hash table */
 
-static const HashTableValue JSSVGElementInstanceListTableValues[2] =
+static const HashTableValue JSSVGElementInstanceListTableValues[3] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsSVGElementInstanceListLength, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceListLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGElementInstanceListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGElementInstanceListTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGElementInstanceListTableValues, 0 };
+    { 15, JSSVGElementInstanceListTableValues, 0 };
 #else
-    { 2, 1, JSSVGElementInstanceListTableValues, 0 };
+    { 5, 3, JSSVGElementInstanceListTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGElementInstanceListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGElementInstanceListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGElementInstanceListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGElementInstanceListConstructorTableValues, 0 };
+#endif
+
+class JSSVGElementInstanceListConstructor : public DOMConstructorObject {
+public:
+    JSSVGElementInstanceListConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGElementInstanceListConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGElementInstanceListPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGElementInstanceListConstructor::s_info = { "SVGElementInstanceListConstructor", 0, &JSSVGElementInstanceListConstructorTable, 0 };
+
+bool JSSVGElementInstanceListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGElementInstanceListConstructor, DOMObject>(exec, &JSSVGElementInstanceListConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGElementInstanceListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGElementInstanceListConstructor, DOMObject>(exec, &JSSVGElementInstanceListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGElementInstanceListPrototypeTableValues[2] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsSVGElementInstanceListPrototypeFunctionItem, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGElementInstanceListPrototypeFunctionItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -112,12 +160,23 @@ bool JSSVGElementInstanceList::getOwnPropertyDescriptor(ExecState* exec, const I
     return getStaticValueDescriptor<JSSVGElementInstanceList, Base>(exec, &JSSVGElementInstanceListTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGElementInstanceListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceListLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGElementInstanceList* castedThis = static_cast<JSSVGElementInstanceList*>(asObject(slot.slotBase()));
+    JSSVGElementInstanceList* castedThis = static_cast<JSSVGElementInstanceList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGElementInstanceList* imp = static_cast<SVGElementInstanceList*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
+}
+
+JSValue jsSVGElementInstanceListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGElementInstanceList* domObject = static_cast<JSSVGElementInstanceList*>(asObject(slotBase));
+    return JSSVGElementInstanceList::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGElementInstanceList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGElementInstanceListConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGElementInstanceListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
index 257f405323..1306031e3b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -46,9 +45,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGElementInstanceList* impl() const { return m_impl.get(); }
 
 private:
@@ -70,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGElementInstanceListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -82,7 +82,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGElementInstanceListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGElementInstanceListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceListLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGElementInstanceListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp
index 358e63ae26..da1a5cef60 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp
@@ -43,6 +43,30 @@
 #include "JSSVGDefsElement.h"
 #include "JSSVGDescElement.h"
 #include "JSSVGEllipseElement.h"
+#include "JSSVGFEBlendElement.h"
+#include "JSSVGFEColorMatrixElement.h"
+#include "JSSVGFEComponentTransferElement.h"
+#include "JSSVGFECompositeElement.h"
+#include "JSSVGFEDiffuseLightingElement.h"
+#include "JSSVGFEDisplacementMapElement.h"
+#include "JSSVGFEDistantLightElement.h"
+#include "JSSVGFEFloodElement.h"
+#include "JSSVGFEFuncAElement.h"
+#include "JSSVGFEFuncBElement.h"
+#include "JSSVGFEFuncGElement.h"
+#include "JSSVGFEFuncRElement.h"
+#include "JSSVGFEGaussianBlurElement.h"
+#include "JSSVGFEImageElement.h"
+#include "JSSVGFEMergeElement.h"
+#include "JSSVGFEMergeNodeElement.h"
+#include "JSSVGFEMorphologyElement.h"
+#include "JSSVGFEOffsetElement.h"
+#include "JSSVGFEPointLightElement.h"
+#include "JSSVGFESpecularLightingElement.h"
+#include "JSSVGFESpotLightElement.h"
+#include "JSSVGFETileElement.h"
+#include "JSSVGFETurbulenceElement.h"
+#include "JSSVGFilterElement.h"
 #include "JSSVGFontElement.h"
 #include "JSSVGFontFaceElement.h"
 #include "JSSVGFontFaceFormatElement.h"
@@ -94,6 +118,30 @@
 #include "SVGDefsElement.h"
 #include "SVGDescElement.h"
 #include "SVGEllipseElement.h"
+#include "SVGFEBlendElement.h"
+#include "SVGFEColorMatrixElement.h"
+#include "SVGFEComponentTransferElement.h"
+#include "SVGFECompositeElement.h"
+#include "SVGFEDiffuseLightingElement.h"
+#include "SVGFEDisplacementMapElement.h"
+#include "SVGFEDistantLightElement.h"
+#include "SVGFEFloodElement.h"
+#include "SVGFEFuncAElement.h"
+#include "SVGFEFuncBElement.h"
+#include "SVGFEFuncGElement.h"
+#include "SVGFEFuncRElement.h"
+#include "SVGFEGaussianBlurElement.h"
+#include "SVGFEImageElement.h"
+#include "SVGFEMergeElement.h"
+#include "SVGFEMergeNodeElement.h"
+#include "SVGFEMorphologyElement.h"
+#include "SVGFEOffsetElement.h"
+#include "SVGFEPointLightElement.h"
+#include "SVGFESpecularLightingElement.h"
+#include "SVGFESpotLightElement.h"
+#include "SVGFETileElement.h"
+#include "SVGFETurbulenceElement.h"
+#include "SVGFilterElement.h"
 #include "SVGFontElement.h"
 #include "SVGFontFaceElement.h"
 #include "SVGFontFaceFormatElement.h"
@@ -198,6 +246,126 @@ static JSNode* createSVGEllipseElementWrapper(ExecState* exec, JSDOMGlobalObject
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGEllipseElement, element.get());
 }
 
+static JSNode* createSVGFEBlendElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEBlendElement, element.get());
+}
+
+static JSNode* createSVGFEColorMatrixElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEColorMatrixElement, element.get());
+}
+
+static JSNode* createSVGFEComponentTransferElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEComponentTransferElement, element.get());
+}
+
+static JSNode* createSVGFECompositeElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFECompositeElement, element.get());
+}
+
+static JSNode* createSVGFEDiffuseLightingElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEDiffuseLightingElement, element.get());
+}
+
+static JSNode* createSVGFEDisplacementMapElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEDisplacementMapElement, element.get());
+}
+
+static JSNode* createSVGFEDistantLightElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEDistantLightElement, element.get());
+}
+
+static JSNode* createSVGFEFloodElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEFloodElement, element.get());
+}
+
+static JSNode* createSVGFEFuncAElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEFuncAElement, element.get());
+}
+
+static JSNode* createSVGFEFuncBElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEFuncBElement, element.get());
+}
+
+static JSNode* createSVGFEFuncGElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEFuncGElement, element.get());
+}
+
+static JSNode* createSVGFEFuncRElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEFuncRElement, element.get());
+}
+
+static JSNode* createSVGFEGaussianBlurElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEGaussianBlurElement, element.get());
+}
+
+static JSNode* createSVGFEImageElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEImageElement, element.get());
+}
+
+static JSNode* createSVGFEMergeElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEMergeElement, element.get());
+}
+
+static JSNode* createSVGFEMergeNodeElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEMergeNodeElement, element.get());
+}
+
+static JSNode* createSVGFEMorphologyElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEMorphologyElement, element.get());
+}
+
+static JSNode* createSVGFEOffsetElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEOffsetElement, element.get());
+}
+
+static JSNode* createSVGFEPointLightElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFEPointLightElement, element.get());
+}
+
+static JSNode* createSVGFESpecularLightingElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFESpecularLightingElement, element.get());
+}
+
+static JSNode* createSVGFESpotLightElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFESpotLightElement, element.get());
+}
+
+static JSNode* createSVGFETileElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFETileElement, element.get());
+}
+
+static JSNode* createSVGFETurbulenceElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFETurbulenceElement, element.get());
+}
+
+static JSNode* createSVGFilterElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFilterElement, element.get());
+}
+
 static JSNode* createSVGFontElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
 {
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGFontElement, element.get());
@@ -379,7 +547,7 @@ static JSNode* createSVGViewElementWrapper(ExecState* exec, JSDOMGlobalObject* g
 }
 
 JSNode* createJSSVGWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
-{   
+{
     typedef HashMap<WebCore::AtomicStringImpl*, CreateSVGElementWrapperFunction> FunctionMap;
     DEFINE_STATIC_LOCAL(FunctionMap, map, ());
     if (map.isEmpty()) {
@@ -394,6 +562,30 @@ JSNode* createJSSVGWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, Pas
        map.set(defsTag.localName().impl(), createSVGDefsElementWrapper);
        map.set(descTag.localName().impl(), createSVGDescElementWrapper);
        map.set(ellipseTag.localName().impl(), createSVGEllipseElementWrapper);
+       map.set(feBlendTag.localName().impl(), createSVGFEBlendElementWrapper);
+       map.set(feColorMatrixTag.localName().impl(), createSVGFEColorMatrixElementWrapper);
+       map.set(feComponentTransferTag.localName().impl(), createSVGFEComponentTransferElementWrapper);
+       map.set(feCompositeTag.localName().impl(), createSVGFECompositeElementWrapper);
+       map.set(feDiffuseLightingTag.localName().impl(), createSVGFEDiffuseLightingElementWrapper);
+       map.set(feDisplacementMapTag.localName().impl(), createSVGFEDisplacementMapElementWrapper);
+       map.set(feDistantLightTag.localName().impl(), createSVGFEDistantLightElementWrapper);
+       map.set(feFloodTag.localName().impl(), createSVGFEFloodElementWrapper);
+       map.set(feFuncATag.localName().impl(), createSVGFEFuncAElementWrapper);
+       map.set(feFuncBTag.localName().impl(), createSVGFEFuncBElementWrapper);
+       map.set(feFuncGTag.localName().impl(), createSVGFEFuncGElementWrapper);
+       map.set(feFuncRTag.localName().impl(), createSVGFEFuncRElementWrapper);
+       map.set(feGaussianBlurTag.localName().impl(), createSVGFEGaussianBlurElementWrapper);
+       map.set(feImageTag.localName().impl(), createSVGFEImageElementWrapper);
+       map.set(feMergeTag.localName().impl(), createSVGFEMergeElementWrapper);
+       map.set(feMergeNodeTag.localName().impl(), createSVGFEMergeNodeElementWrapper);
+       map.set(feMorphologyTag.localName().impl(), createSVGFEMorphologyElementWrapper);
+       map.set(feOffsetTag.localName().impl(), createSVGFEOffsetElementWrapper);
+       map.set(fePointLightTag.localName().impl(), createSVGFEPointLightElementWrapper);
+       map.set(feSpecularLightingTag.localName().impl(), createSVGFESpecularLightingElementWrapper);
+       map.set(feSpotLightTag.localName().impl(), createSVGFESpotLightElementWrapper);
+       map.set(feTileTag.localName().impl(), createSVGFETileElementWrapper);
+       map.set(feTurbulenceTag.localName().impl(), createSVGFETurbulenceElementWrapper);
+       map.set(filterTag.localName().impl(), createSVGFilterElementWrapper);
        map.set(fontTag.localName().impl(), createSVGFontElementWrapper);
        map.set(font_faceTag.localName().impl(), createSVGFontFaceElementWrapper);
        map.set(font_face_formatTag.localName().impl(), createSVGFontFaceFormatElementWrapper);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp
index 0307240bc6..5f476b7c51 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp
@@ -53,23 +53,24 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGEllipseElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGEllipseElementTableValues[16] =
-{
-    { "cx", DontDelete|ReadOnly, (intptr_t)jsSVGEllipseElementCx, (intptr_t)0 },
-    { "cy", DontDelete|ReadOnly, (intptr_t)jsSVGEllipseElementCy, (intptr_t)0 },
-    { "rx", DontDelete|ReadOnly, (intptr_t)jsSVGEllipseElementRx, (intptr_t)0 },
-    { "ry", DontDelete|ReadOnly, (intptr_t)jsSVGEllipseElementRy, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGEllipseElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGEllipseElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGEllipseElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGEllipseElementXmllang, (intptr_t)setJSSVGEllipseElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGEllipseElementXmlspace, (intptr_t)setJSSVGEllipseElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGEllipseElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGEllipseElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGEllipseElementStyle, (intptr_t)0 },
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGEllipseElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGEllipseElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGEllipseElementFarthestViewportElement, (intptr_t)0 },
+static const HashTableValue JSSVGEllipseElementTableValues[17] =
+{
+    { "cx", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementCx), (intptr_t)0 },
+    { "cy", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementCy), (intptr_t)0 },
+    { "rx", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementRx), (intptr_t)0 },
+    { "ry", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementRy), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementXmllang), (intptr_t)setJSSVGEllipseElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementXmlspace), (intptr_t)setJSSVGEllipseElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementStyle), (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementFarthestViewportElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGEllipseElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,19 +78,66 @@ static JSC_CONST_HASHTABLE HashTable JSSVGEllipseElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 127, JSSVGEllipseElementTableValues, 0 };
 #else
-    { 35, 31, JSSVGEllipseElementTableValues, 0 };
+    { 36, 31, JSSVGEllipseElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGEllipseElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGEllipseElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGEllipseElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGEllipseElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGEllipseElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGEllipseElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGEllipseElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGEllipseElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGEllipseElementConstructor::s_info = { "SVGEllipseElementConstructor", 0, &JSSVGEllipseElementConstructorTable, 0 };
+
+bool JSSVGEllipseElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGEllipseElementConstructor, DOMObject>(exec, &JSSVGEllipseElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGEllipseElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGEllipseElementConstructor, DOMObject>(exec, &JSSVGEllipseElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGEllipseElementPrototypeTableValues[7] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGEllipseElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGEllipseElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGEllipseElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGEllipseElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGEllipseElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGEllipseElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGEllipseElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGEllipseElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGEllipseElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGEllipseElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGEllipseElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGEllipseElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -139,133 +187,153 @@ bool JSSVGEllipseElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSSVGEllipseElement, Base>(exec, &JSSVGEllipseElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGEllipseElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementCx(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
+    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cxAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGEllipseElementCy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementCy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
+    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cyAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGEllipseElementRx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementRx(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
+    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->rxAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGEllipseElementRy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementRy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
+    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->ryAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGEllipseElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
+    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGEllipseElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
+    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGEllipseElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
+    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGEllipseElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
+    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGEllipseElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
+    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGEllipseElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
+    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGEllipseElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
+    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGEllipseElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
+    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGEllipseElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
+    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGEllipseElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
+    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGEllipseElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
+    JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
+JSValue jsSVGEllipseElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGEllipseElement* domObject = static_cast<JSSVGEllipseElement*>(asObject(slotBase));
+    return JSSVGEllipseElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGEllipseElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGEllipseElement, Base>(exec, propertyName, value, &JSSVGEllipseElementTable, this, slot);
@@ -273,16 +341,23 @@ void JSSVGEllipseElement::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSSVGEllipseElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(thisObject)->impl());
+    JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(thisObject);
+    SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGEllipseElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(thisObject)->impl());
+    JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(thisObject);
+    SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGEllipseElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGEllipseElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -320,7 +395,7 @@ JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetBBox(ExecState* exe
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -333,7 +408,7 @@ JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetCTM(ExecState* exec
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -346,7 +421,7 @@ JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetScreenCTM(ExecState
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -361,7 +436,7 @@ JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetTransformToElement(
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
index 100dfa12d9..6f4f99ad1a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGEllipseElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,23 +79,24 @@ JSC::JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetScreenCTM(JSC:
 JSC::JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGEllipseElementCx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGEllipseElementCy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGEllipseElementRx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGEllipseElementRy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGEllipseElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGEllipseElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGEllipseElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGEllipseElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementCx(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGEllipseElementCy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGEllipseElementRx(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGEllipseElementRy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGEllipseElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGEllipseElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGEllipseElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGEllipseElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGEllipseElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGEllipseElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGEllipseElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGEllipseElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGEllipseElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGEllipseElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGEllipseElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGEllipseElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGEllipseElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGEllipseElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGEllipseElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGEllipseElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGEllipseElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGEllipseElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGEllipseElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
index 8906774565..57fba2f155 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
@@ -41,10 +41,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGException);
 
 static const HashTableValue JSSVGExceptionTableValues[5] =
 {
-    { "code", DontDelete|ReadOnly, (intptr_t)jsSVGExceptionCode, (intptr_t)0 },
-    { "name", DontDelete|ReadOnly, (intptr_t)jsSVGExceptionName, (intptr_t)0 },
-    { "message", DontDelete|ReadOnly, (intptr_t)jsSVGExceptionMessage, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGExceptionConstructor, (intptr_t)0 },
+    { "code", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGExceptionCode), (intptr_t)0 },
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGExceptionName), (intptr_t)0 },
+    { "message", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGExceptionMessage), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGExceptionConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -59,9 +59,9 @@ static JSC_CONST_HASHTABLE HashTable JSSVGExceptionTable =
 
 static const HashTableValue JSSVGExceptionConstructorTableValues[4] =
 {
-    { "SVG_WRONG_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)jsSVGExceptionSVG_WRONG_TYPE_ERR, (intptr_t)0 },
-    { "SVG_INVALID_VALUE_ERR", DontDelete|ReadOnly, (intptr_t)jsSVGExceptionSVG_INVALID_VALUE_ERR, (intptr_t)0 },
-    { "SVG_MATRIX_NOT_INVERTABLE", DontDelete|ReadOnly, (intptr_t)jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE, (intptr_t)0 },
+    { "SVG_WRONG_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGExceptionSVG_WRONG_TYPE_ERR), (intptr_t)0 },
+    { "SVG_INVALID_VALUE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGExceptionSVG_INVALID_VALUE_ERR), (intptr_t)0 },
+    { "SVG_MATRIX_NOT_INVERTABLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -86,7 +86,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -109,10 +109,10 @@ bool JSSVGExceptionConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSSVGExceptionPrototypeTableValues[5] =
 {
-    { "SVG_WRONG_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)jsSVGExceptionSVG_WRONG_TYPE_ERR, (intptr_t)0 },
-    { "SVG_INVALID_VALUE_ERR", DontDelete|ReadOnly, (intptr_t)jsSVGExceptionSVG_INVALID_VALUE_ERR, (intptr_t)0 },
-    { "SVG_MATRIX_NOT_INVERTABLE", DontDelete|ReadOnly, (intptr_t)jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE, (intptr_t)0 },
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsSVGExceptionPrototypeFunctionToString, (intptr_t)0 },
+    { "SVG_WRONG_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGExceptionSVG_WRONG_TYPE_ERR), (intptr_t)0 },
+    { "SVG_INVALID_VALUE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGExceptionSVG_INVALID_VALUE_ERR), (intptr_t)0 },
+    { "SVG_MATRIX_NOT_INVERTABLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE), (intptr_t)0 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsSVGExceptionPrototypeFunctionToString), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -142,8 +142,8 @@ bool JSSVGExceptionPrototype::getOwnPropertyDescriptor(ExecState* exec, const Id
 
 const ClassInfo JSSVGException::s_info = { "SVGException", 0, &JSSVGExceptionTable, 0 };
 
-JSSVGException::JSSVGException(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGException> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGException::JSSVGException(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGException> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -151,6 +151,7 @@ JSSVGException::JSSVGException(NonNullPassRefPtr<Structure> structure, JSDOMGlob
 JSSVGException::~JSSVGException()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -168,34 +169,37 @@ bool JSSVGException::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSSVGException, Base>(exec, &JSSVGExceptionTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGExceptionCode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGException* castedThis = static_cast<JSSVGException*>(asObject(slot.slotBase()));
+    JSSVGException* castedThis = static_cast<JSSVGException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGException* imp = static_cast<SVGException*>(castedThis->impl());
-    return jsNumber(exec, imp->code());
+    JSValue result = jsNumber(exec, imp->code());
+    return result;
 }
 
-JSValue jsSVGExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGExceptionName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGException* castedThis = static_cast<JSSVGException*>(asObject(slot.slotBase()));
+    JSSVGException* castedThis = static_cast<JSSVGException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGException* imp = static_cast<SVGException*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsSVGExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGExceptionMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGException* castedThis = static_cast<JSSVGException*>(asObject(slot.slotBase()));
+    JSSVGException* castedThis = static_cast<JSSVGException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGException* imp = static_cast<SVGException*>(castedThis->impl());
-    return jsString(exec, imp->message());
+    JSValue result = jsString(exec, imp->message());
+    return result;
 }
 
-JSValue jsSVGExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    UNUSED_PARAM(slot);
-    return JSSVGException::getConstructor(exec, deprecatedGlobalObjectForPrototype(exec));
+    JSSVGException* domObject = static_cast<JSSVGException*>(asObject(slotBase));
+    return JSSVGException::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGException::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 {
@@ -217,17 +221,17 @@ JSValue JSC_HOST_CALL jsSVGExceptionPrototypeFunctionToString(ExecState* exec, J
 
 // Constant getters
 
-JSValue jsSVGExceptionSVG_WRONG_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGExceptionSVG_WRONG_TYPE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGExceptionSVG_INVALID_VALUE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGExceptionSVG_INVALID_VALUE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGException.h b/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
index 21f4221f71..41cdd3ff0b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -33,10 +32,10 @@ namespace WebCore {
 
 class SVGException;
 
-class JSSVGException : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGException : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGException(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGException>, SVGElement* context);
+    JSSVGException(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGException>);
     virtual ~JSSVGException();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -46,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -71,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -83,15 +82,15 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionCode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGExceptionName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGExceptionMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGExceptionSVG_WRONG_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGExceptionSVG_INVALID_VALUE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionSVG_WRONG_TYPE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGExceptionSVG_INVALID_VALUE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
index d32f27638a..c028223c7f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
@@ -46,17 +46,17 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEBlendElement);
 
 static const HashTableValue JSSVGFEBlendElementTableValues[12] =
 {
-    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementIn1, (intptr_t)0 },
-    { "in2", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementIn2, (intptr_t)0 },
-    { "mode", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementMode, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementHeight, (intptr_t)0 },
-    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementResult, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGFEBlendElementConstructor, (intptr_t)0 },
+    { "in1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementIn1), (intptr_t)0 },
+    { "in2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementIn2), (intptr_t)0 },
+    { "mode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementMode), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementHeight), (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementResult), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -71,12 +71,12 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFEBlendElementTable =
 
 static const HashTableValue JSSVGFEBlendElementConstructorTableValues[7] =
 {
-    { "SVG_FEBLEND_MODE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN, (intptr_t)0 },
-    { "SVG_FEBLEND_MODE_NORMAL", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL, (intptr_t)0 },
-    { "SVG_FEBLEND_MODE_MULTIPLY", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY, (intptr_t)0 },
-    { "SVG_FEBLEND_MODE_SCREEN", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN, (intptr_t)0 },
-    { "SVG_FEBLEND_MODE_DARKEN", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN, (intptr_t)0 },
-    { "SVG_FEBLEND_MODE_LIGHTEN", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN, (intptr_t)0 },
+    { "SVG_FEBLEND_MODE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN), (intptr_t)0 },
+    { "SVG_FEBLEND_MODE_NORMAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL), (intptr_t)0 },
+    { "SVG_FEBLEND_MODE_MULTIPLY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY), (intptr_t)0 },
+    { "SVG_FEBLEND_MODE_SCREEN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN), (intptr_t)0 },
+    { "SVG_FEBLEND_MODE_DARKEN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN), (intptr_t)0 },
+    { "SVG_FEBLEND_MODE_LIGHTEN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -101,7 +101,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -124,13 +124,13 @@ bool JSSVGFEBlendElementConstructor::getOwnPropertyDescriptor(ExecState* exec, c
 
 static const HashTableValue JSSVGFEBlendElementPrototypeTableValues[8] =
 {
-    { "SVG_FEBLEND_MODE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN, (intptr_t)0 },
-    { "SVG_FEBLEND_MODE_NORMAL", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL, (intptr_t)0 },
-    { "SVG_FEBLEND_MODE_MULTIPLY", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY, (intptr_t)0 },
-    { "SVG_FEBLEND_MODE_SCREEN", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN, (intptr_t)0 },
-    { "SVG_FEBLEND_MODE_DARKEN", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN, (intptr_t)0 },
-    { "SVG_FEBLEND_MODE_LIGHTEN", DontDelete|ReadOnly, (intptr_t)jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN, (intptr_t)0 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFEBlendElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "SVG_FEBLEND_MODE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN), (intptr_t)0 },
+    { "SVG_FEBLEND_MODE_NORMAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL), (intptr_t)0 },
+    { "SVG_FEBLEND_MODE_MULTIPLY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY), (intptr_t)0 },
+    { "SVG_FEBLEND_MODE_SCREEN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN), (intptr_t)0 },
+    { "SVG_FEBLEND_MODE_DARKEN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN), (intptr_t)0 },
+    { "SVG_FEBLEND_MODE_LIGHTEN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN), (intptr_t)0 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFEBlendElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -180,98 +180,108 @@ bool JSSVGFEBlendElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSSVGFEBlendElement, Base>(exec, &JSSVGFEBlendElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEBlendElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementIn1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()));
+    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEBlendElementIn2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementIn2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()));
+    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->in2Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEBlendElementMode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementMode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()));
+    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->modeAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEBlendElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()));
+    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEBlendElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()));
+    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEBlendElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()));
+    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEBlendElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()));
+    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEBlendElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementResult(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()));
+    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEBlendElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()));
+    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEBlendElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()));
+    JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGFEBlendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEBlendElement* domObject = static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()));
+    JSSVGFEBlendElement* domObject = static_cast<JSSVGFEBlendElement*>(asObject(slotBase));
     return JSSVGFEBlendElement::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGFEBlendElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -295,32 +305,32 @@ JSValue JSC_HOST_CALL jsSVGFEBlendElementPrototypeFunctionGetPresentationAttribu
 
 // Constant getters
 
-JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
index 910f9b80b4..71b6f1d0e9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEBlendElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,25 +73,25 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGFEBlendElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFEBlendElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEBlendElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEBlendElementMode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEBlendElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEBlendElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEBlendElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEBlendElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEBlendElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEBlendElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEBlendElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEBlendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementIn1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEBlendElementIn2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEBlendElementMode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEBlendElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEBlendElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEBlendElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEBlendElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEBlendElementResult(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEBlendElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEBlendElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEBlendElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
index 0f1d439d1a..d9c6755be8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
@@ -47,17 +47,17 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEColorMatrixElement);
 
 static const HashTableValue JSSVGFEColorMatrixElementTableValues[12] =
 {
-    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementIn1, (intptr_t)0 },
-    { "type", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementType, (intptr_t)0 },
-    { "values", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementValues, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementHeight, (intptr_t)0 },
-    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementResult, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementConstructor, (intptr_t)0 },
+    { "in1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementIn1), (intptr_t)0 },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementType), (intptr_t)0 },
+    { "values", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementValues), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementHeight), (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementResult), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -72,11 +72,11 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFEColorMatrixElementTable =
 
 static const HashTableValue JSSVGFEColorMatrixElementConstructorTableValues[6] =
 {
-    { "SVG_FECOLORMATRIX_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_FECOLORMATRIX_TYPE_MATRIX", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX, (intptr_t)0 },
-    { "SVG_FECOLORMATRIX_TYPE_SATURATE", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE, (intptr_t)0 },
-    { "SVG_FECOLORMATRIX_TYPE_HUEROTATE", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE, (intptr_t)0 },
-    { "SVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA, (intptr_t)0 },
+    { "SVG_FECOLORMATRIX_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_FECOLORMATRIX_TYPE_MATRIX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX), (intptr_t)0 },
+    { "SVG_FECOLORMATRIX_TYPE_SATURATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE), (intptr_t)0 },
+    { "SVG_FECOLORMATRIX_TYPE_HUEROTATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE), (intptr_t)0 },
+    { "SVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -101,7 +101,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -124,12 +124,12 @@ bool JSSVGFEColorMatrixElementConstructor::getOwnPropertyDescriptor(ExecState* e
 
 static const HashTableValue JSSVGFEColorMatrixElementPrototypeTableValues[7] =
 {
-    { "SVG_FECOLORMATRIX_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_FECOLORMATRIX_TYPE_MATRIX", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX, (intptr_t)0 },
-    { "SVG_FECOLORMATRIX_TYPE_SATURATE", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE, (intptr_t)0 },
-    { "SVG_FECOLORMATRIX_TYPE_HUEROTATE", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE, (intptr_t)0 },
-    { "SVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA", DontDelete|ReadOnly, (intptr_t)jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA, (intptr_t)0 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFEColorMatrixElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "SVG_FECOLORMATRIX_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_FECOLORMATRIX_TYPE_MATRIX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX), (intptr_t)0 },
+    { "SVG_FECOLORMATRIX_TYPE_SATURATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE), (intptr_t)0 },
+    { "SVG_FECOLORMATRIX_TYPE_HUEROTATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE), (intptr_t)0 },
+    { "SVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA), (intptr_t)0 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFEColorMatrixElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -179,98 +179,108 @@ bool JSSVGFEColorMatrixElement::getOwnPropertyDescriptor(ExecState* exec, const
     return getStaticValueDescriptor<JSSVGFEColorMatrixElement, Base>(exec, &JSSVGFEColorMatrixElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEColorMatrixElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementIn1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()));
+    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEColorMatrixElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()));
+    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->typeAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEColorMatrixElementValues(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementValues(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()));
+    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumberList> obj = imp->valuesAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEColorMatrixElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()));
+    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEColorMatrixElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()));
+    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEColorMatrixElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()));
+    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEColorMatrixElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()));
+    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEColorMatrixElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementResult(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()));
+    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEColorMatrixElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()));
+    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEColorMatrixElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()));
+    JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGFEColorMatrixElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEColorMatrixElement* domObject = static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()));
+    JSSVGFEColorMatrixElement* domObject = static_cast<JSSVGFEColorMatrixElement*>(asObject(slotBase));
     return JSSVGFEColorMatrixElement::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGFEColorMatrixElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -294,27 +304,27 @@ JSValue JSC_HOST_CALL jsSVGFEColorMatrixElementPrototypeFunctionGetPresentationA
 
 // Constant getters
 
-JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
index 5c9305ec80..40def0ba02 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEColorMatrixElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,24 +73,24 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGFEColorMatrixElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFEColorMatrixElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEColorMatrixElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEColorMatrixElementValues(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEColorMatrixElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEColorMatrixElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEColorMatrixElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEColorMatrixElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEColorMatrixElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEColorMatrixElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEColorMatrixElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEColorMatrixElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementIn1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEColorMatrixElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEColorMatrixElementValues(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEColorMatrixElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEColorMatrixElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEColorMatrixElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEColorMatrixElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEColorMatrixElementResult(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEColorMatrixElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEColorMatrixElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEColorMatrixElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp
index f39674fb3c..e6c61b80a5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp
@@ -43,16 +43,17 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEComponentTransferElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFEComponentTransferElementTableValues[9] =
-{
-    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFEComponentTransferElementIn1, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEComponentTransferElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEComponentTransferElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEComponentTransferElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFEComponentTransferElementHeight, (intptr_t)0 },
-    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFEComponentTransferElementResult, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFEComponentTransferElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFEComponentTransferElementStyle, (intptr_t)0 },
+static const HashTableValue JSSVGFEComponentTransferElementTableValues[10] =
+{
+    { "in1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEComponentTransferElementIn1), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEComponentTransferElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEComponentTransferElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEComponentTransferElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEComponentTransferElementHeight), (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEComponentTransferElementResult), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEComponentTransferElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEComponentTransferElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEComponentTransferElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -60,14 +61,61 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFEComponentTransferElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 255, JSSVGFEComponentTransferElementTableValues, 0 };
 #else
-    { 18, 15, JSSVGFEComponentTransferElementTableValues, 0 };
+    { 34, 31, JSSVGFEComponentTransferElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEComponentTransferElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEComponentTransferElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEComponentTransferElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFEComponentTransferElementConstructorTableValues, 0 };
 #endif
 
+class JSSVGFEComponentTransferElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFEComponentTransferElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFEComponentTransferElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEComponentTransferElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFEComponentTransferElementConstructor::s_info = { "SVGFEComponentTransferElementConstructor", 0, &JSSVGFEComponentTransferElementConstructorTable, 0 };
+
+bool JSSVGFEComponentTransferElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEComponentTransferElementConstructor, DOMObject>(exec, &JSSVGFEComponentTransferElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFEComponentTransferElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEComponentTransferElementConstructor, DOMObject>(exec, &JSSVGFEComponentTransferElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEComponentTransferElementPrototypeTableValues[2] =
 {
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFEComponentTransferElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFEComponentTransferElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -117,75 +165,93 @@ bool JSSVGFEComponentTransferElement::getOwnPropertyDescriptor(ExecState* exec,
     return getStaticValueDescriptor<JSSVGFEComponentTransferElement, Base>(exec, &JSSVGFEComponentTransferElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEComponentTransferElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementIn1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()));
+    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEComponentTransferElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()));
+    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEComponentTransferElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()));
+    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEComponentTransferElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()));
+    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEComponentTransferElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()));
+    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEComponentTransferElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementResult(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()));
+    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEComponentTransferElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()));
+    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEComponentTransferElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()));
+    JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
+}
+
+JSValue jsSVGFEComponentTransferElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFEComponentTransferElement* domObject = static_cast<JSSVGFEComponentTransferElement*>(asObject(slotBase));
+    return JSSVGFEComponentTransferElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFEComponentTransferElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFEComponentTransferElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGFEComponentTransferElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
index 265d70ce68..774b99ba48 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -60,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEComponentTransferElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,14 +73,15 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGFEComponentTransferElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFEComponentTransferElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEComponentTransferElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEComponentTransferElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEComponentTransferElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEComponentTransferElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEComponentTransferElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEComponentTransferElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEComponentTransferElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementIn1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEComponentTransferElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEComponentTransferElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEComponentTransferElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEComponentTransferElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEComponentTransferElementResult(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEComponentTransferElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEComponentTransferElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEComponentTransferElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
index c0de8f71d2..29e9a2c5f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
@@ -47,21 +47,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFECompositeElement);
 
 static const HashTableValue JSSVGFECompositeElementTableValues[16] =
 {
-    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementIn1, (intptr_t)0 },
-    { "in2", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementIn2, (intptr_t)0 },
-    { "operator", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementOperator, (intptr_t)0 },
-    { "k1", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementK1, (intptr_t)0 },
-    { "k2", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementK2, (intptr_t)0 },
-    { "k3", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementK3, (intptr_t)0 },
-    { "k4", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementK4, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementHeight, (intptr_t)0 },
-    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementResult, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGFECompositeElementConstructor, (intptr_t)0 },
+    { "in1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementIn1), (intptr_t)0 },
+    { "in2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementIn2), (intptr_t)0 },
+    { "operator", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementOperator), (intptr_t)0 },
+    { "k1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementK1), (intptr_t)0 },
+    { "k2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementK2), (intptr_t)0 },
+    { "k3", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementK3), (intptr_t)0 },
+    { "k4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementK4), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementHeight), (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementResult), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,13 +76,13 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFECompositeElementTable =
 
 static const HashTableValue JSSVGFECompositeElementConstructorTableValues[8] =
 {
-    { "SVG_FECOMPOSITE_OPERATOR_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN, (intptr_t)0 },
-    { "SVG_FECOMPOSITE_OPERATOR_OVER", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER, (intptr_t)0 },
-    { "SVG_FECOMPOSITE_OPERATOR_IN", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN, (intptr_t)0 },
-    { "SVG_FECOMPOSITE_OPERATOR_OUT", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT, (intptr_t)0 },
-    { "SVG_FECOMPOSITE_OPERATOR_ATOP", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP, (intptr_t)0 },
-    { "SVG_FECOMPOSITE_OPERATOR_XOR", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR, (intptr_t)0 },
-    { "SVG_FECOMPOSITE_OPERATOR_ARITHMETIC", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC, (intptr_t)0 },
+    { "SVG_FECOMPOSITE_OPERATOR_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN), (intptr_t)0 },
+    { "SVG_FECOMPOSITE_OPERATOR_OVER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER), (intptr_t)0 },
+    { "SVG_FECOMPOSITE_OPERATOR_IN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN), (intptr_t)0 },
+    { "SVG_FECOMPOSITE_OPERATOR_OUT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT), (intptr_t)0 },
+    { "SVG_FECOMPOSITE_OPERATOR_ATOP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP), (intptr_t)0 },
+    { "SVG_FECOMPOSITE_OPERATOR_XOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR), (intptr_t)0 },
+    { "SVG_FECOMPOSITE_OPERATOR_ARITHMETIC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -107,7 +107,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -130,14 +130,14 @@ bool JSSVGFECompositeElementConstructor::getOwnPropertyDescriptor(ExecState* exe
 
 static const HashTableValue JSSVGFECompositeElementPrototypeTableValues[9] =
 {
-    { "SVG_FECOMPOSITE_OPERATOR_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN, (intptr_t)0 },
-    { "SVG_FECOMPOSITE_OPERATOR_OVER", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER, (intptr_t)0 },
-    { "SVG_FECOMPOSITE_OPERATOR_IN", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN, (intptr_t)0 },
-    { "SVG_FECOMPOSITE_OPERATOR_OUT", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT, (intptr_t)0 },
-    { "SVG_FECOMPOSITE_OPERATOR_ATOP", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP, (intptr_t)0 },
-    { "SVG_FECOMPOSITE_OPERATOR_XOR", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR, (intptr_t)0 },
-    { "SVG_FECOMPOSITE_OPERATOR_ARITHMETIC", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC, (intptr_t)0 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFECompositeElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "SVG_FECOMPOSITE_OPERATOR_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN), (intptr_t)0 },
+    { "SVG_FECOMPOSITE_OPERATOR_OVER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER), (intptr_t)0 },
+    { "SVG_FECOMPOSITE_OPERATOR_IN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN), (intptr_t)0 },
+    { "SVG_FECOMPOSITE_OPERATOR_OUT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT), (intptr_t)0 },
+    { "SVG_FECOMPOSITE_OPERATOR_ATOP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP), (intptr_t)0 },
+    { "SVG_FECOMPOSITE_OPERATOR_XOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR), (intptr_t)0 },
+    { "SVG_FECOMPOSITE_OPERATOR_ARITHMETIC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC), (intptr_t)0 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFECompositeElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -187,134 +187,148 @@ bool JSSVGFECompositeElement::getOwnPropertyDescriptor(ExecState* exec, const Id
     return getStaticValueDescriptor<JSSVGFECompositeElement, Base>(exec, &JSSVGFECompositeElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFECompositeElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementIn1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
+    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFECompositeElementIn2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementIn2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
+    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->in2Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFECompositeElementOperator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementOperator(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
+    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->_operatorAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFECompositeElementK1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementK1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
+    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->k1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFECompositeElementK2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementK2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
+    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->k2Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFECompositeElementK3(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementK3(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
+    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->k3Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFECompositeElementK4(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementK4(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
+    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->k4Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFECompositeElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
+    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFECompositeElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
+    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFECompositeElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
+    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFECompositeElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
+    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFECompositeElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementResult(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
+    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFECompositeElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
+    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFECompositeElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
+    JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGFECompositeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFECompositeElement* domObject = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
+    JSSVGFECompositeElement* domObject = static_cast<JSSVGFECompositeElement*>(asObject(slotBase));
     return JSSVGFECompositeElement::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGFECompositeElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -338,37 +352,37 @@ JSValue JSC_HOST_CALL jsSVGFECompositeElementPrototypeFunctionGetPresentationAtt
 
 // Constant getters
 
-JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
index 70cb296578..31b2dc7df4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFECompositeElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,30 +73,30 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGFECompositeElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFECompositeElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementOperator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementK1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementK2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementK3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementK4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementIn1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementIn2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementOperator(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementK1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementK2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementK3(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementK4(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementResult(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp
index 86349cd3b3..3ddd044428 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp
@@ -44,20 +44,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEDiffuseLightingElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFEDiffuseLightingElementTableValues[13] =
-{
-    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFEDiffuseLightingElementIn1, (intptr_t)0 },
-    { "surfaceScale", DontDelete|ReadOnly, (intptr_t)jsSVGFEDiffuseLightingElementSurfaceScale, (intptr_t)0 },
-    { "diffuseConstant", DontDelete|ReadOnly, (intptr_t)jsSVGFEDiffuseLightingElementDiffuseConstant, (intptr_t)0 },
-    { "kernelUnitLengthX", DontDelete|ReadOnly, (intptr_t)jsSVGFEDiffuseLightingElementKernelUnitLengthX, (intptr_t)0 },
-    { "kernelUnitLengthY", DontDelete|ReadOnly, (intptr_t)jsSVGFEDiffuseLightingElementKernelUnitLengthY, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEDiffuseLightingElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEDiffuseLightingElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEDiffuseLightingElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFEDiffuseLightingElementHeight, (intptr_t)0 },
-    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFEDiffuseLightingElementResult, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFEDiffuseLightingElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFEDiffuseLightingElementStyle, (intptr_t)0 },
+static const HashTableValue JSSVGFEDiffuseLightingElementTableValues[14] =
+{
+    { "in1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDiffuseLightingElementIn1), (intptr_t)0 },
+    { "surfaceScale", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDiffuseLightingElementSurfaceScale), (intptr_t)0 },
+    { "diffuseConstant", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDiffuseLightingElementDiffuseConstant), (intptr_t)0 },
+    { "kernelUnitLengthX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDiffuseLightingElementKernelUnitLengthX), (intptr_t)0 },
+    { "kernelUnitLengthY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDiffuseLightingElementKernelUnitLengthY), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDiffuseLightingElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDiffuseLightingElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDiffuseLightingElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDiffuseLightingElementHeight), (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDiffuseLightingElementResult), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDiffuseLightingElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDiffuseLightingElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDiffuseLightingElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -65,14 +66,61 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFEDiffuseLightingElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 255, JSSVGFEDiffuseLightingElementTableValues, 0 };
 #else
-    { 34, 31, JSSVGFEDiffuseLightingElementTableValues, 0 };
+    { 35, 31, JSSVGFEDiffuseLightingElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEDiffuseLightingElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEDiffuseLightingElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEDiffuseLightingElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFEDiffuseLightingElementConstructorTableValues, 0 };
 #endif
 
+class JSSVGFEDiffuseLightingElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFEDiffuseLightingElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFEDiffuseLightingElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEDiffuseLightingElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFEDiffuseLightingElementConstructor::s_info = { "SVGFEDiffuseLightingElementConstructor", 0, &JSSVGFEDiffuseLightingElementConstructorTable, 0 };
+
+bool JSSVGFEDiffuseLightingElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEDiffuseLightingElementConstructor, DOMObject>(exec, &JSSVGFEDiffuseLightingElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFEDiffuseLightingElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEDiffuseLightingElementConstructor, DOMObject>(exec, &JSSVGFEDiffuseLightingElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEDiffuseLightingElementPrototypeTableValues[2] =
 {
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFEDiffuseLightingElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFEDiffuseLightingElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -122,111 +170,133 @@ bool JSSVGFEDiffuseLightingElement::getOwnPropertyDescriptor(ExecState* exec, co
     return getStaticValueDescriptor<JSSVGFEDiffuseLightingElement, Base>(exec, &JSSVGFEDiffuseLightingElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEDiffuseLightingElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementIn1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDiffuseLightingElementSurfaceScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementSurfaceScale(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->surfaceScaleAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDiffuseLightingElementDiffuseConstant(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementDiffuseConstant(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->diffuseConstantAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->kernelUnitLengthXAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->kernelUnitLengthYAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDiffuseLightingElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDiffuseLightingElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDiffuseLightingElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDiffuseLightingElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDiffuseLightingElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementResult(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDiffuseLightingElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDiffuseLightingElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
+}
+
+JSValue jsSVGFEDiffuseLightingElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFEDiffuseLightingElement* domObject = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slotBase));
+    return JSSVGFEDiffuseLightingElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFEDiffuseLightingElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFEDiffuseLightingElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGFEDiffuseLightingElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
index 442cb7118d..d11dda70d0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -60,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEDiffuseLightingElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,18 +73,19 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGFEDiffuseLightingElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFEDiffuseLightingElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDiffuseLightingElementSurfaceScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDiffuseLightingElementDiffuseConstant(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDiffuseLightingElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDiffuseLightingElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDiffuseLightingElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDiffuseLightingElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDiffuseLightingElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDiffuseLightingElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDiffuseLightingElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementIn1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDiffuseLightingElementSurfaceScale(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDiffuseLightingElementDiffuseConstant(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDiffuseLightingElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDiffuseLightingElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDiffuseLightingElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDiffuseLightingElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDiffuseLightingElementResult(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDiffuseLightingElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDiffuseLightingElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDiffuseLightingElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
index 6bdd56e34d..90624cc6d8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
@@ -47,19 +47,19 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEDisplacementMapElement);
 
 static const HashTableValue JSSVGFEDisplacementMapElementTableValues[14] =
 {
-    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementIn1, (intptr_t)0 },
-    { "in2", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementIn2, (intptr_t)0 },
-    { "scale", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementScale, (intptr_t)0 },
-    { "xChannelSelector", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementXChannelSelector, (intptr_t)0 },
-    { "yChannelSelector", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementYChannelSelector, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementHeight, (intptr_t)0 },
-    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementResult, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementConstructor, (intptr_t)0 },
+    { "in1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementIn1), (intptr_t)0 },
+    { "in2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementIn2), (intptr_t)0 },
+    { "scale", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementScale), (intptr_t)0 },
+    { "xChannelSelector", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementXChannelSelector), (intptr_t)0 },
+    { "yChannelSelector", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementYChannelSelector), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementHeight), (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementResult), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -74,11 +74,11 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFEDisplacementMapElementTable =
 
 static const HashTableValue JSSVGFEDisplacementMapElementConstructorTableValues[6] =
 {
-    { "SVG_CHANNEL_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN, (intptr_t)0 },
-    { "SVG_CHANNEL_R", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementSVG_CHANNEL_R, (intptr_t)0 },
-    { "SVG_CHANNEL_G", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementSVG_CHANNEL_G, (intptr_t)0 },
-    { "SVG_CHANNEL_B", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementSVG_CHANNEL_B, (intptr_t)0 },
-    { "SVG_CHANNEL_A", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementSVG_CHANNEL_A, (intptr_t)0 },
+    { "SVG_CHANNEL_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN), (intptr_t)0 },
+    { "SVG_CHANNEL_R", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementSVG_CHANNEL_R), (intptr_t)0 },
+    { "SVG_CHANNEL_G", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementSVG_CHANNEL_G), (intptr_t)0 },
+    { "SVG_CHANNEL_B", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementSVG_CHANNEL_B), (intptr_t)0 },
+    { "SVG_CHANNEL_A", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementSVG_CHANNEL_A), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -103,7 +103,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -126,12 +126,12 @@ bool JSSVGFEDisplacementMapElementConstructor::getOwnPropertyDescriptor(ExecStat
 
 static const HashTableValue JSSVGFEDisplacementMapElementPrototypeTableValues[7] =
 {
-    { "SVG_CHANNEL_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN, (intptr_t)0 },
-    { "SVG_CHANNEL_R", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementSVG_CHANNEL_R, (intptr_t)0 },
-    { "SVG_CHANNEL_G", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementSVG_CHANNEL_G, (intptr_t)0 },
-    { "SVG_CHANNEL_B", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementSVG_CHANNEL_B, (intptr_t)0 },
-    { "SVG_CHANNEL_A", DontDelete|ReadOnly, (intptr_t)jsSVGFEDisplacementMapElementSVG_CHANNEL_A, (intptr_t)0 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFEDisplacementMapElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "SVG_CHANNEL_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN), (intptr_t)0 },
+    { "SVG_CHANNEL_R", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementSVG_CHANNEL_R), (intptr_t)0 },
+    { "SVG_CHANNEL_G", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementSVG_CHANNEL_G), (intptr_t)0 },
+    { "SVG_CHANNEL_B", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementSVG_CHANNEL_B), (intptr_t)0 },
+    { "SVG_CHANNEL_A", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDisplacementMapElementSVG_CHANNEL_A), (intptr_t)0 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFEDisplacementMapElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -181,116 +181,128 @@ bool JSSVGFEDisplacementMapElement::getOwnPropertyDescriptor(ExecState* exec, co
     return getStaticValueDescriptor<JSSVGFEDisplacementMapElement, Base>(exec, &JSSVGFEDisplacementMapElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEDisplacementMapElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementIn1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()));
+    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDisplacementMapElementIn2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementIn2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()));
+    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->in2Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDisplacementMapElementScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementScale(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()));
+    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->scaleAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDisplacementMapElementXChannelSelector(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementXChannelSelector(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()));
+    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->xChannelSelectorAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDisplacementMapElementYChannelSelector(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementYChannelSelector(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()));
+    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->yChannelSelectorAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDisplacementMapElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()));
+    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDisplacementMapElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()));
+    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDisplacementMapElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()));
+    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDisplacementMapElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()));
+    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDisplacementMapElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementResult(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()));
+    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDisplacementMapElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()));
+    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDisplacementMapElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()));
+    JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGFEDisplacementMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDisplacementMapElement* domObject = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()));
+    JSSVGFEDisplacementMapElement* domObject = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slotBase));
     return JSSVGFEDisplacementMapElement::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGFEDisplacementMapElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -314,27 +326,27 @@ JSValue JSC_HOST_CALL jsSVGFEDisplacementMapElementPrototypeFunctionGetPresentat
 
 // Constant getters
 
-JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_R(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_R(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_G(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_G(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_B(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_B(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_A(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_A(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
index d5eafcea00..b2686557e5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEDisplacementMapElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,26 +73,26 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGFEDisplacementMapElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFEDisplacementMapElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementXChannelSelector(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementYChannelSelector(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementIn1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementIn2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementScale(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementXChannelSelector(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementYChannelSelector(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementResult(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_R(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_G(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_B(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_A(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_R(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_G(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_B(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_A(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp
index 858627d891..b5cdd505f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp
@@ -36,10 +36,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEDistantLightElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFEDistantLightElementTableValues[3] =
+static const HashTableValue JSSVGFEDistantLightElementTableValues[4] =
 {
-    { "azimuth", DontDelete|ReadOnly, (intptr_t)jsSVGFEDistantLightElementAzimuth, (intptr_t)0 },
-    { "elevation", DontDelete|ReadOnly, (intptr_t)jsSVGFEDistantLightElementElevation, (intptr_t)0 },
+    { "azimuth", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDistantLightElementAzimuth), (intptr_t)0 },
+    { "elevation", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDistantLightElementElevation), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEDistantLightElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -47,9 +48,56 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFEDistantLightElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 15, JSSVGFEDistantLightElementTableValues, 0 };
 #else
-    { 5, 3, JSSVGFEDistantLightElementTableValues, 0 };
+    { 9, 7, JSSVGFEDistantLightElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEDistantLightElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEDistantLightElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEDistantLightElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFEDistantLightElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFEDistantLightElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFEDistantLightElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFEDistantLightElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEDistantLightElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFEDistantLightElementConstructor::s_info = { "SVGFEDistantLightElementConstructor", 0, &JSSVGFEDistantLightElementConstructorTable, 0 };
+
+bool JSSVGFEDistantLightElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEDistantLightElementConstructor, DOMObject>(exec, &JSSVGFEDistantLightElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFEDistantLightElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEDistantLightElementConstructor, DOMObject>(exec, &JSSVGFEDistantLightElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEDistantLightElementPrototypeTableValues[1] =
@@ -93,22 +141,34 @@ bool JSSVGFEDistantLightElement::getOwnPropertyDescriptor(ExecState* exec, const
     return getStaticValueDescriptor<JSSVGFEDistantLightElement, Base>(exec, &JSSVGFEDistantLightElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEDistantLightElementAzimuth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDistantLightElementAzimuth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDistantLightElement* castedThis = static_cast<JSSVGFEDistantLightElement*>(asObject(slot.slotBase()));
+    JSSVGFEDistantLightElement* castedThis = static_cast<JSSVGFEDistantLightElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDistantLightElement* imp = static_cast<SVGFEDistantLightElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->azimuthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEDistantLightElementElevation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDistantLightElementElevation(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEDistantLightElement* castedThis = static_cast<JSSVGFEDistantLightElement*>(asObject(slot.slotBase()));
+    JSSVGFEDistantLightElement* castedThis = static_cast<JSSVGFEDistantLightElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEDistantLightElement* imp = static_cast<SVGFEDistantLightElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->elevationAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
+}
+
+JSValue jsSVGFEDistantLightElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFEDistantLightElement* domObject = static_cast<JSSVGFEDistantLightElement*>(asObject(slotBase));
+    return JSSVGFEDistantLightElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFEDistantLightElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFEDistantLightElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
index becbe95dd8..9d130c0062 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -58,7 +59,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEDistantLightElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -67,8 +68,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGFEDistantLightElementAzimuth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEDistantLightElementElevation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDistantLightElementAzimuth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDistantLightElementElevation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEDistantLightElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
index 3ee186ce46..5a2c1a6ddf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
@@ -45,14 +45,14 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFloodElement);
 
 static const HashTableValue JSSVGFEFloodElementTableValues[9] =
 {
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementHeight, (intptr_t)0 },
-    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementResult, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGFEFloodElementConstructor, (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEFloodElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEFloodElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEFloodElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEFloodElementHeight), (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEFloodElementResult), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEFloodElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEFloodElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEFloodElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -91,7 +91,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -114,7 +114,7 @@ bool JSSVGFEFloodElementConstructor::getOwnPropertyDescriptor(ExecState* exec, c
 
 static const HashTableValue JSSVGFEFloodElementPrototypeTableValues[2] =
 {
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFEFloodElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFEFloodElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -164,71 +164,78 @@ bool JSSVGFEFloodElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSSVGFEFloodElement, Base>(exec, &JSSVGFEFloodElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEFloodElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()));
+    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEFloodElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()));
+    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEFloodElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()));
+    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEFloodElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()));
+    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEFloodElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementResult(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()));
+    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEFloodElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()));
+    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEFloodElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()));
+    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGFEFloodElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEFloodElement* domObject = static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()));
+    JSSVGFEFloodElement* domObject = static_cast<JSSVGFEFloodElement*>(asObject(slotBase));
     return JSSVGFEFloodElement::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGFEFloodElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
index 2dccbf8bdd..bcb961d1f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEFloodElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,14 +73,14 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGFEFloodElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFEFloodElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEFloodElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEFloodElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEFloodElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEFloodElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEFloodElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEFloodElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEFloodElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEFloodElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEFloodElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEFloodElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEFloodElementResult(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEFloodElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEFloodElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEFloodElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.cpp
index c7072bebe1..66661ed4fa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncAElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGFEFuncAElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEFuncAElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEFuncAElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEFuncAElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGFEFuncAElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEFuncAElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEFuncAElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEFuncAElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFEFuncAElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFEFuncAElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFEFuncAElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFEFuncAElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEFuncAElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFEFuncAElementConstructor::s_info = { "SVGFEFuncAElementConstructor", 0, &JSSVGFEFuncAElementConstructorTable, 0 };
+
+bool JSSVGFEFuncAElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEFuncAElementConstructor, DOMObject>(exec, &JSSVGFEFuncAElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFEFuncAElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEFuncAElementConstructor, DOMObject>(exec, &JSSVGFEFuncAElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEFuncAElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGFEFuncAElementPrototype::self(ExecState* exec, JSGlobalObject* gl
     return getDOMPrototype<JSSVGFEFuncAElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGFEFuncAElement::s_info = { "SVGFEFuncAElement", &JSSVGComponentTransferFunctionElement::s_info, 0, 0 };
+const ClassInfo JSSVGFEFuncAElement::s_info = { "SVGFEFuncAElement", &JSSVGComponentTransferFunctionElement::s_info, &JSSVGFEFuncAElementTable, 0 };
 
 JSSVGFEFuncAElement::JSSVGFEFuncAElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEFuncAElement> impl)
     : JSSVGComponentTransferFunctionElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGFEFuncAElement::createPrototype(ExecState* exec, JSGlobalObject*
     return new (exec) JSSVGFEFuncAElementPrototype(JSSVGFEFuncAElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGFEFuncAElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEFuncAElement, Base>(exec, &JSSVGFEFuncAElementTable, this, propertyName, slot);
+}
+
+bool JSSVGFEFuncAElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEFuncAElement, Base>(exec, &JSSVGFEFuncAElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGFEFuncAElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFEFuncAElement* domObject = static_cast<JSSVGFEFuncAElement*>(asObject(slotBase));
+    return JSSVGFEFuncAElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFEFuncAElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFEFuncAElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h
index 91657332d6..020beb7bcd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h
@@ -35,16 +35,19 @@ class JSSVGFEFuncAElement : public JSSVGComponentTransferFunctionElement {
 public:
     JSSVGFEFuncAElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEFuncAElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEFuncAElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGFEFuncAElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.cpp
index 565dfcb469..5f32e8404b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncBElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGFEFuncBElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEFuncBElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEFuncBElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEFuncBElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGFEFuncBElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEFuncBElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEFuncBElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEFuncBElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFEFuncBElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFEFuncBElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFEFuncBElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFEFuncBElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEFuncBElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFEFuncBElementConstructor::s_info = { "SVGFEFuncBElementConstructor", 0, &JSSVGFEFuncBElementConstructorTable, 0 };
+
+bool JSSVGFEFuncBElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEFuncBElementConstructor, DOMObject>(exec, &JSSVGFEFuncBElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFEFuncBElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEFuncBElementConstructor, DOMObject>(exec, &JSSVGFEFuncBElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEFuncBElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGFEFuncBElementPrototype::self(ExecState* exec, JSGlobalObject* gl
     return getDOMPrototype<JSSVGFEFuncBElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGFEFuncBElement::s_info = { "SVGFEFuncBElement", &JSSVGComponentTransferFunctionElement::s_info, 0, 0 };
+const ClassInfo JSSVGFEFuncBElement::s_info = { "SVGFEFuncBElement", &JSSVGComponentTransferFunctionElement::s_info, &JSSVGFEFuncBElementTable, 0 };
 
 JSSVGFEFuncBElement::JSSVGFEFuncBElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEFuncBElement> impl)
     : JSSVGComponentTransferFunctionElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGFEFuncBElement::createPrototype(ExecState* exec, JSGlobalObject*
     return new (exec) JSSVGFEFuncBElementPrototype(JSSVGFEFuncBElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGFEFuncBElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEFuncBElement, Base>(exec, &JSSVGFEFuncBElementTable, this, propertyName, slot);
+}
+
+bool JSSVGFEFuncBElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEFuncBElement, Base>(exec, &JSSVGFEFuncBElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGFEFuncBElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFEFuncBElement* domObject = static_cast<JSSVGFEFuncBElement*>(asObject(slotBase));
+    return JSSVGFEFuncBElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFEFuncBElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFEFuncBElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h
index 712f096901..7404606f61 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h
@@ -35,16 +35,19 @@ class JSSVGFEFuncBElement : public JSSVGComponentTransferFunctionElement {
 public:
     JSSVGFEFuncBElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEFuncBElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEFuncBElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGFEFuncBElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.cpp
index 536c1218d8..7e90448980 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncGElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGFEFuncGElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEFuncGElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEFuncGElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEFuncGElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGFEFuncGElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEFuncGElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEFuncGElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEFuncGElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFEFuncGElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFEFuncGElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFEFuncGElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFEFuncGElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEFuncGElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFEFuncGElementConstructor::s_info = { "SVGFEFuncGElementConstructor", 0, &JSSVGFEFuncGElementConstructorTable, 0 };
+
+bool JSSVGFEFuncGElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEFuncGElementConstructor, DOMObject>(exec, &JSSVGFEFuncGElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFEFuncGElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEFuncGElementConstructor, DOMObject>(exec, &JSSVGFEFuncGElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEFuncGElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGFEFuncGElementPrototype::self(ExecState* exec, JSGlobalObject* gl
     return getDOMPrototype<JSSVGFEFuncGElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGFEFuncGElement::s_info = { "SVGFEFuncGElement", &JSSVGComponentTransferFunctionElement::s_info, 0, 0 };
+const ClassInfo JSSVGFEFuncGElement::s_info = { "SVGFEFuncGElement", &JSSVGComponentTransferFunctionElement::s_info, &JSSVGFEFuncGElementTable, 0 };
 
 JSSVGFEFuncGElement::JSSVGFEFuncGElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEFuncGElement> impl)
     : JSSVGComponentTransferFunctionElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGFEFuncGElement::createPrototype(ExecState* exec, JSGlobalObject*
     return new (exec) JSSVGFEFuncGElementPrototype(JSSVGFEFuncGElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGFEFuncGElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEFuncGElement, Base>(exec, &JSSVGFEFuncGElementTable, this, propertyName, slot);
+}
+
+bool JSSVGFEFuncGElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEFuncGElement, Base>(exec, &JSSVGFEFuncGElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGFEFuncGElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFEFuncGElement* domObject = static_cast<JSSVGFEFuncGElement*>(asObject(slotBase));
+    return JSSVGFEFuncGElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFEFuncGElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFEFuncGElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h
index ecb6430a8f..8cc4cdce72 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h
@@ -35,16 +35,19 @@ class JSSVGFEFuncGElement : public JSSVGComponentTransferFunctionElement {
 public:
     JSSVGFEFuncGElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEFuncGElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEFuncGElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGFEFuncGElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.cpp
index 2f321f9e7d..3d7e636b7e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncRElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGFEFuncRElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEFuncRElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEFuncRElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEFuncRElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGFEFuncRElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEFuncRElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEFuncRElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEFuncRElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFEFuncRElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFEFuncRElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFEFuncRElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFEFuncRElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEFuncRElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFEFuncRElementConstructor::s_info = { "SVGFEFuncRElementConstructor", 0, &JSSVGFEFuncRElementConstructorTable, 0 };
+
+bool JSSVGFEFuncRElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEFuncRElementConstructor, DOMObject>(exec, &JSSVGFEFuncRElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFEFuncRElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEFuncRElementConstructor, DOMObject>(exec, &JSSVGFEFuncRElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEFuncRElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGFEFuncRElementPrototype::self(ExecState* exec, JSGlobalObject* gl
     return getDOMPrototype<JSSVGFEFuncRElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGFEFuncRElement::s_info = { "SVGFEFuncRElement", &JSSVGComponentTransferFunctionElement::s_info, 0, 0 };
+const ClassInfo JSSVGFEFuncRElement::s_info = { "SVGFEFuncRElement", &JSSVGComponentTransferFunctionElement::s_info, &JSSVGFEFuncRElementTable, 0 };
 
 JSSVGFEFuncRElement::JSSVGFEFuncRElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEFuncRElement> impl)
     : JSSVGComponentTransferFunctionElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGFEFuncRElement::createPrototype(ExecState* exec, JSGlobalObject*
     return new (exec) JSSVGFEFuncRElementPrototype(JSSVGFEFuncRElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGFEFuncRElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEFuncRElement, Base>(exec, &JSSVGFEFuncRElementTable, this, propertyName, slot);
+}
+
+bool JSSVGFEFuncRElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEFuncRElement, Base>(exec, &JSSVGFEFuncRElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGFEFuncRElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFEFuncRElement* domObject = static_cast<JSSVGFEFuncRElement*>(asObject(slotBase));
+    return JSSVGFEFuncRElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFEFuncRElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFEFuncRElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h
index f338fae5b0..ea5d8120fb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h
@@ -35,16 +35,19 @@ class JSSVGFEFuncRElement : public JSSVGComponentTransferFunctionElement {
 public:
     JSSVGFEFuncRElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEFuncRElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEFuncRElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGFEFuncRElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp
index 5302f91242..0d4e38596e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp
@@ -44,18 +44,19 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEGaussianBlurElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFEGaussianBlurElementTableValues[11] =
-{
-    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFEGaussianBlurElementIn1, (intptr_t)0 },
-    { "stdDeviationX", DontDelete|ReadOnly, (intptr_t)jsSVGFEGaussianBlurElementStdDeviationX, (intptr_t)0 },
-    { "stdDeviationY", DontDelete|ReadOnly, (intptr_t)jsSVGFEGaussianBlurElementStdDeviationY, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEGaussianBlurElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEGaussianBlurElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEGaussianBlurElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFEGaussianBlurElementHeight, (intptr_t)0 },
-    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFEGaussianBlurElementResult, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFEGaussianBlurElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFEGaussianBlurElementStyle, (intptr_t)0 },
+static const HashTableValue JSSVGFEGaussianBlurElementTableValues[12] =
+{
+    { "in1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEGaussianBlurElementIn1), (intptr_t)0 },
+    { "stdDeviationX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEGaussianBlurElementStdDeviationX), (intptr_t)0 },
+    { "stdDeviationY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEGaussianBlurElementStdDeviationY), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEGaussianBlurElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEGaussianBlurElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEGaussianBlurElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEGaussianBlurElementHeight), (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEGaussianBlurElementResult), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEGaussianBlurElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEGaussianBlurElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEGaussianBlurElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -66,12 +67,59 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFEGaussianBlurElementTable =
     { 34, 31, JSSVGFEGaussianBlurElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEGaussianBlurElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEGaussianBlurElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEGaussianBlurElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFEGaussianBlurElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFEGaussianBlurElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFEGaussianBlurElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFEGaussianBlurElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEGaussianBlurElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFEGaussianBlurElementConstructor::s_info = { "SVGFEGaussianBlurElementConstructor", 0, &JSSVGFEGaussianBlurElementConstructorTable, 0 };
+
+bool JSSVGFEGaussianBlurElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEGaussianBlurElementConstructor, DOMObject>(exec, &JSSVGFEGaussianBlurElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFEGaussianBlurElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEGaussianBlurElementConstructor, DOMObject>(exec, &JSSVGFEGaussianBlurElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEGaussianBlurElementPrototypeTableValues[3] =
 {
-    { "setStdDeviation", DontDelete|Function, (intptr_t)jsSVGFEGaussianBlurElementPrototypeFunctionSetStdDeviation, (intptr_t)2 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFEGaussianBlurElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "setStdDeviation", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFEGaussianBlurElementPrototypeFunctionSetStdDeviation), (intptr_t)2 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFEGaussianBlurElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -121,93 +169,113 @@ bool JSSVGFEGaussianBlurElement::getOwnPropertyDescriptor(ExecState* exec, const
     return getStaticValueDescriptor<JSSVGFEGaussianBlurElement, Base>(exec, &JSSVGFEGaussianBlurElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEGaussianBlurElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementIn1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()));
+    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEGaussianBlurElementStdDeviationX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementStdDeviationX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()));
+    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->stdDeviationXAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEGaussianBlurElementStdDeviationY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementStdDeviationY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()));
+    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->stdDeviationYAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEGaussianBlurElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()));
+    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEGaussianBlurElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()));
+    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEGaussianBlurElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()));
+    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEGaussianBlurElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()));
+    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEGaussianBlurElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementResult(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()));
+    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEGaussianBlurElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()));
+    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEGaussianBlurElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()));
+    JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
+}
+
+JSValue jsSVGFEGaussianBlurElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFEGaussianBlurElement* domObject = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slotBase));
+    return JSSVGFEGaussianBlurElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFEGaussianBlurElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFEGaussianBlurElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGFEGaussianBlurElementPrototypeFunctionSetStdDeviation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
index 77157260c1..fdf00a29dc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -60,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEGaussianBlurElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,16 +74,17 @@ JSC::JSValue JSC_HOST_CALL jsSVGFEGaussianBlurElementPrototypeFunctionSetStdDevi
 JSC::JSValue JSC_HOST_CALL jsSVGFEGaussianBlurElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFEGaussianBlurElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEGaussianBlurElementStdDeviationX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEGaussianBlurElementStdDeviationY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEGaussianBlurElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEGaussianBlurElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEGaussianBlurElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEGaussianBlurElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEGaussianBlurElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEGaussianBlurElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEGaussianBlurElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementIn1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEGaussianBlurElementStdDeviationX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEGaussianBlurElementStdDeviationY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEGaussianBlurElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEGaussianBlurElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEGaussianBlurElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEGaussianBlurElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEGaussianBlurElementResult(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEGaussianBlurElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEGaussianBlurElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEGaussianBlurElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp
index a2d2be6172..4a241ce97c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp
@@ -31,6 +31,7 @@
 #include "JSCSSValue.h"
 #include "JSSVGAnimatedBoolean.h"
 #include "JSSVGAnimatedLength.h"
+#include "JSSVGAnimatedPreserveAspectRatio.h"
 #include "JSSVGAnimatedString.h"
 #include "KURL.h"
 #include "SVGFEImageElement.h"
@@ -46,19 +47,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEImageElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFEImageElementTableValues[12] =
+static const HashTableValue JSSVGFEImageElementTableValues[14] =
 {
-    { "href", DontDelete|ReadOnly, (intptr_t)jsSVGFEImageElementHref, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGFEImageElementXmllang, (intptr_t)setJSSVGFEImageElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGFEImageElementXmlspace, (intptr_t)setJSSVGFEImageElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGFEImageElementExternalResourcesRequired, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEImageElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEImageElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEImageElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFEImageElementHeight, (intptr_t)0 },
-    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFEImageElementResult, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFEImageElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFEImageElementStyle, (intptr_t)0 },
+    { "preserveAspectRatio", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEImageElementPreserveAspectRatio), (intptr_t)0 },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEImageElementHref), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEImageElementXmllang), (intptr_t)setJSSVGFEImageElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEImageElementXmlspace), (intptr_t)setJSSVGFEImageElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEImageElementExternalResourcesRequired), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEImageElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEImageElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEImageElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEImageElementHeight), (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEImageElementResult), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEImageElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEImageElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEImageElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -69,11 +72,58 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFEImageElementTable =
     { 33, 31, JSSVGFEImageElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEImageElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEImageElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEImageElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFEImageElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFEImageElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFEImageElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFEImageElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEImageElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFEImageElementConstructor::s_info = { "SVGFEImageElementConstructor", 0, &JSSVGFEImageElementConstructorTable, 0 };
+
+bool JSSVGFEImageElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEImageElementConstructor, DOMObject>(exec, &JSSVGFEImageElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFEImageElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEImageElementConstructor, DOMObject>(exec, &JSSVGFEImageElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEImageElementPrototypeTableValues[2] =
 {
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFEImageElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFEImageElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -123,102 +173,128 @@ bool JSSVGFEImageElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSSVGFEImageElement, Base>(exec, &JSSVGFEImageElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEImageElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementPreserveAspectRatio(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
+}
+
+JSValue jsSVGFEImageElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()));
+    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEImageElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()));
+    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGFEImageElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()));
+    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGFEImageElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()));
+    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()));
+    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEImageElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()));
+    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEImageElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()));
+    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEImageElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()));
+    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEImageElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementResult(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()));
+    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEImageElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()));
+    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEImageElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()));
+    JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
+JSValue jsSVGFEImageElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFEImageElement* domObject = static_cast<JSSVGFEImageElement*>(asObject(slotBase));
+    return JSSVGFEImageElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGFEImageElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGFEImageElement, Base>(exec, propertyName, value, &JSSVGFEImageElementTable, this, slot);
@@ -226,16 +302,23 @@ void JSSVGFEImageElement::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSSVGFEImageElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(thisObject)->impl());
+    JSSVGFEImageElement* castedThisObj = static_cast<JSSVGFEImageElement*>(thisObject);
+    SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGFEImageElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(thisObject)->impl());
+    JSSVGFEImageElement* castedThisObj = static_cast<JSSVGFEImageElement*>(thisObject);
+    SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGFEImageElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFEImageElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGFEImageElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
index 616d7e5896..0474a1517f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEImageElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,19 +74,21 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGFEImageElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFEImageElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEImageElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementPreserveAspectRatio(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEImageElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEImageElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGFEImageElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGFEImageElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGFEImageElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGFEImageElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEImageElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEImageElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEImageElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEImageElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEImageElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEImageElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEImageElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEImageElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEImageElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEImageElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEImageElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEImageElementResult(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEImageElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEImageElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEImageElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp
index 37c6fd889c..9ee2dbccfe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp
@@ -43,15 +43,16 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEMergeElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFEMergeElementTableValues[8] =
-{
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEMergeElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEMergeElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEMergeElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFEMergeElementHeight, (intptr_t)0 },
-    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFEMergeElementResult, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFEMergeElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFEMergeElementStyle, (intptr_t)0 },
+static const HashTableValue JSSVGFEMergeElementTableValues[9] =
+{
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMergeElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMergeElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMergeElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMergeElementHeight), (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMergeElementResult), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMergeElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMergeElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMergeElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -59,14 +60,61 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFEMergeElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 255, JSSVGFEMergeElementTableValues, 0 };
 #else
-    { 17, 15, JSSVGFEMergeElementTableValues, 0 };
+    { 18, 15, JSSVGFEMergeElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEMergeElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEMergeElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEMergeElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFEMergeElementConstructorTableValues, 0 };
 #endif
 
+class JSSVGFEMergeElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFEMergeElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFEMergeElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEMergeElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFEMergeElementConstructor::s_info = { "SVGFEMergeElementConstructor", 0, &JSSVGFEMergeElementConstructorTable, 0 };
+
+bool JSSVGFEMergeElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEMergeElementConstructor, DOMObject>(exec, &JSSVGFEMergeElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFEMergeElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEMergeElementConstructor, DOMObject>(exec, &JSSVGFEMergeElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEMergeElementPrototypeTableValues[2] =
 {
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFEMergeElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFEMergeElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -116,66 +164,83 @@ bool JSSVGFEMergeElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSSVGFEMergeElement, Base>(exec, &JSSVGFEMergeElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEMergeElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMergeElement* castedThis = static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()));
+    JSSVGFEMergeElement* castedThis = static_cast<JSSVGFEMergeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMergeElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMergeElement* castedThis = static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()));
+    JSSVGFEMergeElement* castedThis = static_cast<JSSVGFEMergeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMergeElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMergeElement* castedThis = static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()));
+    JSSVGFEMergeElement* castedThis = static_cast<JSSVGFEMergeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMergeElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMergeElement* castedThis = static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()));
+    JSSVGFEMergeElement* castedThis = static_cast<JSSVGFEMergeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMergeElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementResult(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMergeElement* castedThis = static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()));
+    JSSVGFEMergeElement* castedThis = static_cast<JSSVGFEMergeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMergeElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMergeElement* castedThis = static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()));
+    JSSVGFEMergeElement* castedThis = static_cast<JSSVGFEMergeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMergeElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMergeElement* castedThis = static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()));
+    JSSVGFEMergeElement* castedThis = static_cast<JSSVGFEMergeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
+}
+
+JSValue jsSVGFEMergeElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFEMergeElement* domObject = static_cast<JSSVGFEMergeElement*>(asObject(slotBase));
+    return JSSVGFEMergeElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFEMergeElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFEMergeElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGFEMergeElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
index 112f064629..19686b2f89 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -60,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEMergeElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,13 +73,14 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGFEMergeElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFEMergeElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMergeElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMergeElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMergeElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMergeElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMergeElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMergeElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMergeElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMergeElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMergeElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMergeElementResult(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMergeElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMergeElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMergeElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp
index c128a14d0b..b2bb3baf2e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp
@@ -36,19 +36,67 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEMergeNodeElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFEMergeNodeElementTableValues[2] =
+static const HashTableValue JSSVGFEMergeNodeElementTableValues[3] =
 {
-    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFEMergeNodeElementIn1, (intptr_t)0 },
+    { "in1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMergeNodeElementIn1), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMergeNodeElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGFEMergeNodeElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGFEMergeNodeElementTableValues, 0 };
+    { 1, JSSVGFEMergeNodeElementTableValues, 0 };
 #else
-    { 2, 1, JSSVGFEMergeNodeElementTableValues, 0 };
+    { 4, 3, JSSVGFEMergeNodeElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEMergeNodeElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEMergeNodeElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEMergeNodeElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFEMergeNodeElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFEMergeNodeElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFEMergeNodeElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFEMergeNodeElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEMergeNodeElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFEMergeNodeElementConstructor::s_info = { "SVGFEMergeNodeElementConstructor", 0, &JSSVGFEMergeNodeElementConstructorTable, 0 };
+
+bool JSSVGFEMergeNodeElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEMergeNodeElementConstructor, DOMObject>(exec, &JSSVGFEMergeNodeElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFEMergeNodeElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEMergeNodeElementConstructor, DOMObject>(exec, &JSSVGFEMergeNodeElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEMergeNodeElementPrototypeTableValues[1] =
@@ -92,13 +140,24 @@ bool JSSVGFEMergeNodeElement::getOwnPropertyDescriptor(ExecState* exec, const Id
     return getStaticValueDescriptor<JSSVGFEMergeNodeElement, Base>(exec, &JSSVGFEMergeNodeElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEMergeNodeElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeNodeElementIn1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMergeNodeElement* castedThis = static_cast<JSSVGFEMergeNodeElement*>(asObject(slot.slotBase()));
+    JSSVGFEMergeNodeElement* castedThis = static_cast<JSSVGFEMergeNodeElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMergeNodeElement* imp = static_cast<SVGFEMergeNodeElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
+}
+
+JSValue jsSVGFEMergeNodeElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFEMergeNodeElement* domObject = static_cast<JSSVGFEMergeNodeElement*>(asObject(slotBase));
+    return JSSVGFEMergeNodeElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFEMergeNodeElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFEMergeNodeElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
index 966eacf6fe..ba7c563251 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -58,7 +59,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEMergeNodeElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -67,7 +68,8 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGFEMergeNodeElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeNodeElementIn1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMergeNodeElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.cpp
index b8b7ae5ff5..3515a7be4c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.cpp
@@ -47,18 +47,18 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEMorphologyElement);
 
 static const HashTableValue JSSVGFEMorphologyElementTableValues[13] =
 {
-    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementIn1, (intptr_t)0 },
-    { "operator", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementOperator, (intptr_t)0 },
-    { "radiusX", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementRadiusX, (intptr_t)0 },
-    { "radiusY", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementRadiusY, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementHeight, (intptr_t)0 },
-    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementResult, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGFEMorphologyElementConstructor, (intptr_t)0 },
+    { "in1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementIn1), (intptr_t)0 },
+    { "operator", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementOperator), (intptr_t)0 },
+    { "radiusX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementRadiusX), (intptr_t)0 },
+    { "radiusY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementRadiusY), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementHeight), (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementResult), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -73,9 +73,9 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFEMorphologyElementTable =
 
 static const HashTableValue JSSVGFEMorphologyElementConstructorTableValues[4] =
 {
-    { "SVG_MORPHOLOGY_OPERATOR_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN, (intptr_t)0 },
-    { "SVG_MORPHOLOGY_OPERATOR_ERODE", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE, (intptr_t)0 },
-    { "SVG_MORPHOLOGY_OPERATOR_DILATE", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE, (intptr_t)0 },
+    { "SVG_MORPHOLOGY_OPERATOR_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN), (intptr_t)0 },
+    { "SVG_MORPHOLOGY_OPERATOR_ERODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE), (intptr_t)0 },
+    { "SVG_MORPHOLOGY_OPERATOR_DILATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -100,7 +100,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -123,11 +123,11 @@ bool JSSVGFEMorphologyElementConstructor::getOwnPropertyDescriptor(ExecState* ex
 
 static const HashTableValue JSSVGFEMorphologyElementPrototypeTableValues[6] =
 {
-    { "SVG_MORPHOLOGY_OPERATOR_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN, (intptr_t)0 },
-    { "SVG_MORPHOLOGY_OPERATOR_ERODE", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE, (intptr_t)0 },
-    { "SVG_MORPHOLOGY_OPERATOR_DILATE", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE, (intptr_t)0 },
-    { "setRadius", DontDelete|Function, (intptr_t)jsSVGFEMorphologyElementPrototypeFunctionSetRadius, (intptr_t)2 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFEMorphologyElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "SVG_MORPHOLOGY_OPERATOR_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN), (intptr_t)0 },
+    { "SVG_MORPHOLOGY_OPERATOR_ERODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE), (intptr_t)0 },
+    { "SVG_MORPHOLOGY_OPERATOR_DILATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE), (intptr_t)0 },
+    { "setRadius", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFEMorphologyElementPrototypeFunctionSetRadius), (intptr_t)2 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFEMorphologyElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -177,107 +177,118 @@ bool JSSVGFEMorphologyElement::getOwnPropertyDescriptor(ExecState* exec, const I
     return getStaticValueDescriptor<JSSVGFEMorphologyElement, Base>(exec, &JSSVGFEMorphologyElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEMorphologyElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMorphologyElementIn1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMorphologyElementOperator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMorphologyElementOperator(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->_operatorAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMorphologyElementRadiusX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMorphologyElementRadiusX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->radiusXAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMorphologyElementRadiusY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMorphologyElementRadiusY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->radiusYAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMorphologyElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMorphologyElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMorphologyElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMorphologyElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMorphologyElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMorphologyElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMorphologyElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMorphologyElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMorphologyElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMorphologyElementResult(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMorphologyElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMorphologyElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEMorphologyElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMorphologyElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGFEMorphologyElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMorphologyElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEMorphologyElement* domObject = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    JSSVGFEMorphologyElement* domObject = static_cast<JSSVGFEMorphologyElement*>(asObject(slotBase));
     return JSSVGFEMorphologyElement::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGFEMorphologyElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -315,17 +326,17 @@ JSValue JSC_HOST_CALL jsSVGFEMorphologyElementPrototypeFunctionGetPresentationAt
 
 // Constant getters
 
-JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.h
index 8db6463811..8c7fe3cf7d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEMorphologyElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -74,23 +74,23 @@ JSC::JSValue JSC_HOST_CALL jsSVGFEMorphologyElementPrototypeFunctionSetRadius(JS
 JSC::JSValue JSC_HOST_CALL jsSVGFEMorphologyElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFEMorphologyElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMorphologyElementOperator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMorphologyElementRadiusX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMorphologyElementRadiusY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMorphologyElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMorphologyElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMorphologyElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMorphologyElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMorphologyElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMorphologyElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMorphologyElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMorphologyElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementIn1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMorphologyElementOperator(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMorphologyElementRadiusX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMorphologyElementRadiusY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMorphologyElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMorphologyElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMorphologyElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMorphologyElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMorphologyElementResult(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMorphologyElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMorphologyElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMorphologyElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp
index baae276fd0..d1f9837f9a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp
@@ -44,18 +44,19 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEOffsetElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFEOffsetElementTableValues[11] =
-{
-    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFEOffsetElementIn1, (intptr_t)0 },
-    { "dx", DontDelete|ReadOnly, (intptr_t)jsSVGFEOffsetElementDx, (intptr_t)0 },
-    { "dy", DontDelete|ReadOnly, (intptr_t)jsSVGFEOffsetElementDy, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEOffsetElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEOffsetElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEOffsetElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFEOffsetElementHeight, (intptr_t)0 },
-    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFEOffsetElementResult, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFEOffsetElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFEOffsetElementStyle, (intptr_t)0 },
+static const HashTableValue JSSVGFEOffsetElementTableValues[12] =
+{
+    { "in1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEOffsetElementIn1), (intptr_t)0 },
+    { "dx", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEOffsetElementDx), (intptr_t)0 },
+    { "dy", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEOffsetElementDy), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEOffsetElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEOffsetElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEOffsetElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEOffsetElementHeight), (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEOffsetElementResult), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEOffsetElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEOffsetElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEOffsetElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -66,11 +67,58 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFEOffsetElementTable =
     { 35, 31, JSSVGFEOffsetElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEOffsetElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEOffsetElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEOffsetElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFEOffsetElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFEOffsetElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFEOffsetElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFEOffsetElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEOffsetElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFEOffsetElementConstructor::s_info = { "SVGFEOffsetElementConstructor", 0, &JSSVGFEOffsetElementConstructorTable, 0 };
+
+bool JSSVGFEOffsetElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEOffsetElementConstructor, DOMObject>(exec, &JSSVGFEOffsetElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFEOffsetElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEOffsetElementConstructor, DOMObject>(exec, &JSSVGFEOffsetElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEOffsetElementPrototypeTableValues[2] =
 {
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFEOffsetElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFEOffsetElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -120,93 +168,113 @@ bool JSSVGFEOffsetElement::getOwnPropertyDescriptor(ExecState* exec, const Ident
     return getStaticValueDescriptor<JSSVGFEOffsetElement, Base>(exec, &JSSVGFEOffsetElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEOffsetElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementIn1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()));
+    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEOffsetElementDx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementDx(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()));
+    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->dxAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEOffsetElementDy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementDy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()));
+    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->dyAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEOffsetElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()));
+    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEOffsetElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()));
+    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEOffsetElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()));
+    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEOffsetElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()));
+    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEOffsetElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementResult(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()));
+    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEOffsetElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()));
+    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEOffsetElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()));
+    JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
+}
+
+JSValue jsSVGFEOffsetElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFEOffsetElement* domObject = static_cast<JSSVGFEOffsetElement*>(asObject(slotBase));
+    return JSSVGFEOffsetElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFEOffsetElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFEOffsetElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGFEOffsetElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
index 3d7387e701..fe6a05bbda 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -60,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEOffsetElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,16 +73,17 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGFEOffsetElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFEOffsetElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEOffsetElementDx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEOffsetElementDy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEOffsetElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEOffsetElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEOffsetElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEOffsetElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEOffsetElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEOffsetElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEOffsetElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementIn1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEOffsetElementDx(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEOffsetElementDy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEOffsetElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEOffsetElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEOffsetElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEOffsetElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEOffsetElementResult(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEOffsetElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEOffsetElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEOffsetElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp
index 18cd26b351..ae11bbc6ed 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp
@@ -36,21 +36,69 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEPointLightElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFEPointLightElementTableValues[4] =
+static const HashTableValue JSSVGFEPointLightElementTableValues[5] =
 {
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEPointLightElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEPointLightElementY, (intptr_t)0 },
-    { "z", DontDelete|ReadOnly, (intptr_t)jsSVGFEPointLightElementZ, (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEPointLightElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEPointLightElementY), (intptr_t)0 },
+    { "z", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEPointLightElementZ), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFEPointLightElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGFEPointLightElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 3, JSSVGFEPointLightElementTableValues, 0 };
+    { 15, JSSVGFEPointLightElementTableValues, 0 };
 #else
-    { 8, 7, JSSVGFEPointLightElementTableValues, 0 };
+    { 9, 7, JSSVGFEPointLightElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEPointLightElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEPointLightElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEPointLightElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFEPointLightElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFEPointLightElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFEPointLightElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFEPointLightElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEPointLightElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFEPointLightElementConstructor::s_info = { "SVGFEPointLightElementConstructor", 0, &JSSVGFEPointLightElementConstructorTable, 0 };
+
+bool JSSVGFEPointLightElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEPointLightElementConstructor, DOMObject>(exec, &JSSVGFEPointLightElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFEPointLightElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEPointLightElementConstructor, DOMObject>(exec, &JSSVGFEPointLightElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEPointLightElementPrototypeTableValues[1] =
@@ -94,31 +142,44 @@ bool JSSVGFEPointLightElement::getOwnPropertyDescriptor(ExecState* exec, const I
     return getStaticValueDescriptor<JSSVGFEPointLightElement, Base>(exec, &JSSVGFEPointLightElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEPointLightElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEPointLightElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEPointLightElement* castedThis = static_cast<JSSVGFEPointLightElement*>(asObject(slot.slotBase()));
+    JSSVGFEPointLightElement* castedThis = static_cast<JSSVGFEPointLightElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEPointLightElement* imp = static_cast<SVGFEPointLightElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEPointLightElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEPointLightElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEPointLightElement* castedThis = static_cast<JSSVGFEPointLightElement*>(asObject(slot.slotBase()));
+    JSSVGFEPointLightElement* castedThis = static_cast<JSSVGFEPointLightElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEPointLightElement* imp = static_cast<SVGFEPointLightElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFEPointLightElementZ(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEPointLightElementZ(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFEPointLightElement* castedThis = static_cast<JSSVGFEPointLightElement*>(asObject(slot.slotBase()));
+    JSSVGFEPointLightElement* castedThis = static_cast<JSSVGFEPointLightElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFEPointLightElement* imp = static_cast<SVGFEPointLightElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->zAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
+}
+
+JSValue jsSVGFEPointLightElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFEPointLightElement* domObject = static_cast<JSSVGFEPointLightElement*>(asObject(slotBase));
+    return JSSVGFEPointLightElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFEPointLightElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFEPointLightElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
index fa8fe77489..8635350e39 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -58,7 +59,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFEPointLightElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -67,9 +68,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGFEPointLightElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEPointLightElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFEPointLightElementZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEPointLightElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEPointLightElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEPointLightElementZ(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFEPointLightElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp
index 0a3b923b09..e86ee290bf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp
@@ -44,19 +44,20 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFESpecularLightingElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFESpecularLightingElementTableValues[12] =
-{
-    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFESpecularLightingElementIn1, (intptr_t)0 },
-    { "surfaceScale", DontDelete|ReadOnly, (intptr_t)jsSVGFESpecularLightingElementSurfaceScale, (intptr_t)0 },
-    { "specularConstant", DontDelete|ReadOnly, (intptr_t)jsSVGFESpecularLightingElementSpecularConstant, (intptr_t)0 },
-    { "specularExponent", DontDelete|ReadOnly, (intptr_t)jsSVGFESpecularLightingElementSpecularExponent, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFESpecularLightingElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFESpecularLightingElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFESpecularLightingElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFESpecularLightingElementHeight, (intptr_t)0 },
-    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFESpecularLightingElementResult, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFESpecularLightingElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFESpecularLightingElementStyle, (intptr_t)0 },
+static const HashTableValue JSSVGFESpecularLightingElementTableValues[13] =
+{
+    { "in1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpecularLightingElementIn1), (intptr_t)0 },
+    { "surfaceScale", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpecularLightingElementSurfaceScale), (intptr_t)0 },
+    { "specularConstant", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpecularLightingElementSpecularConstant), (intptr_t)0 },
+    { "specularExponent", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpecularLightingElementSpecularExponent), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpecularLightingElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpecularLightingElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpecularLightingElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpecularLightingElementHeight), (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpecularLightingElementResult), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpecularLightingElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpecularLightingElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpecularLightingElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -67,11 +68,58 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFESpecularLightingElementTable =
     { 36, 31, JSSVGFESpecularLightingElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFESpecularLightingElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFESpecularLightingElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFESpecularLightingElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFESpecularLightingElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFESpecularLightingElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFESpecularLightingElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFESpecularLightingElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFESpecularLightingElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFESpecularLightingElementConstructor::s_info = { "SVGFESpecularLightingElementConstructor", 0, &JSSVGFESpecularLightingElementConstructorTable, 0 };
+
+bool JSSVGFESpecularLightingElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFESpecularLightingElementConstructor, DOMObject>(exec, &JSSVGFESpecularLightingElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFESpecularLightingElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFESpecularLightingElementConstructor, DOMObject>(exec, &JSSVGFESpecularLightingElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFESpecularLightingElementPrototypeTableValues[2] =
 {
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFESpecularLightingElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFESpecularLightingElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -121,102 +169,123 @@ bool JSSVGFESpecularLightingElement::getOwnPropertyDescriptor(ExecState* exec, c
     return getStaticValueDescriptor<JSSVGFESpecularLightingElement, Base>(exec, &JSSVGFESpecularLightingElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFESpecularLightingElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementIn1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpecularLightingElementSurfaceScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementSurfaceScale(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->surfaceScaleAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpecularLightingElementSpecularConstant(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementSpecularConstant(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->specularConstantAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpecularLightingElementSpecularExponent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementSpecularExponent(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->specularExponentAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpecularLightingElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpecularLightingElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpecularLightingElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpecularLightingElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpecularLightingElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementResult(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpecularLightingElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpecularLightingElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()));
+    JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
+}
+
+JSValue jsSVGFESpecularLightingElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFESpecularLightingElement* domObject = static_cast<JSSVGFESpecularLightingElement*>(asObject(slotBase));
+    return JSSVGFESpecularLightingElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFESpecularLightingElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFESpecularLightingElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGFESpecularLightingElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
index 09c903f914..823f4f86e1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -60,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFESpecularLightingElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,17 +73,18 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGFESpecularLightingElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFESpecularLightingElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpecularLightingElementSurfaceScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpecularLightingElementSpecularConstant(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpecularLightingElementSpecularExponent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpecularLightingElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpecularLightingElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpecularLightingElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpecularLightingElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpecularLightingElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpecularLightingElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpecularLightingElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementIn1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpecularLightingElementSurfaceScale(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpecularLightingElementSpecularConstant(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpecularLightingElementSpecularExponent(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpecularLightingElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpecularLightingElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpecularLightingElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpecularLightingElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpecularLightingElementResult(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpecularLightingElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpecularLightingElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpecularLightingElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp
index f555c17818..e7be244587 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp
@@ -36,16 +36,17 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFESpotLightElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFESpotLightElementTableValues[9] =
-{
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFESpotLightElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFESpotLightElementY, (intptr_t)0 },
-    { "z", DontDelete|ReadOnly, (intptr_t)jsSVGFESpotLightElementZ, (intptr_t)0 },
-    { "pointsAtX", DontDelete|ReadOnly, (intptr_t)jsSVGFESpotLightElementPointsAtX, (intptr_t)0 },
-    { "pointsAtY", DontDelete|ReadOnly, (intptr_t)jsSVGFESpotLightElementPointsAtY, (intptr_t)0 },
-    { "pointsAtZ", DontDelete|ReadOnly, (intptr_t)jsSVGFESpotLightElementPointsAtZ, (intptr_t)0 },
-    { "specularExponent", DontDelete|ReadOnly, (intptr_t)jsSVGFESpotLightElementSpecularExponent, (intptr_t)0 },
-    { "limitingConeAngle", DontDelete|ReadOnly, (intptr_t)jsSVGFESpotLightElementLimitingConeAngle, (intptr_t)0 },
+static const HashTableValue JSSVGFESpotLightElementTableValues[10] =
+{
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpotLightElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpotLightElementY), (intptr_t)0 },
+    { "z", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpotLightElementZ), (intptr_t)0 },
+    { "pointsAtX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpotLightElementPointsAtX), (intptr_t)0 },
+    { "pointsAtY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpotLightElementPointsAtY), (intptr_t)0 },
+    { "pointsAtZ", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpotLightElementPointsAtZ), (intptr_t)0 },
+    { "specularExponent", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpotLightElementSpecularExponent), (intptr_t)0 },
+    { "limitingConeAngle", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpotLightElementLimitingConeAngle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFESpotLightElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -53,9 +54,56 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFESpotLightElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 15, JSSVGFESpotLightElementTableValues, 0 };
 #else
-    { 16, 15, JSSVGFESpotLightElementTableValues, 0 };
+    { 32, 31, JSSVGFESpotLightElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFESpotLightElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFESpotLightElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFESpotLightElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFESpotLightElementConstructorTableValues, 0 };
 #endif
 
+class JSSVGFESpotLightElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFESpotLightElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFESpotLightElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFESpotLightElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFESpotLightElementConstructor::s_info = { "SVGFESpotLightElementConstructor", 0, &JSSVGFESpotLightElementConstructorTable, 0 };
+
+bool JSSVGFESpotLightElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFESpotLightElementConstructor, DOMObject>(exec, &JSSVGFESpotLightElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFESpotLightElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFESpotLightElementConstructor, DOMObject>(exec, &JSSVGFESpotLightElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFESpotLightElementPrototypeTableValues[1] =
@@ -99,76 +147,94 @@ bool JSSVGFESpotLightElement::getOwnPropertyDescriptor(ExecState* exec, const Id
     return getStaticValueDescriptor<JSSVGFESpotLightElement, Base>(exec, &JSSVGFESpotLightElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFESpotLightElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()));
+    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpotLightElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()));
+    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpotLightElementZ(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementZ(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()));
+    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->zAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpotLightElementPointsAtX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementPointsAtX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()));
+    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->pointsAtXAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpotLightElementPointsAtY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementPointsAtY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()));
+    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->pointsAtYAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpotLightElementPointsAtZ(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementPointsAtZ(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()));
+    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->pointsAtZAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpotLightElementSpecularExponent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementSpecularExponent(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()));
+    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->specularExponentAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFESpotLightElementLimitingConeAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementLimitingConeAngle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()));
+    JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->limitingConeAngleAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
+}
+
+JSValue jsSVGFESpotLightElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFESpotLightElement* domObject = static_cast<JSSVGFESpotLightElement*>(asObject(slotBase));
+    return JSSVGFESpotLightElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFESpotLightElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFESpotLightElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
index 8a3a4ab325..3fcb08f890 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -58,7 +59,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFESpotLightElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -67,14 +68,15 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGFESpotLightElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpotLightElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpotLightElementZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpotLightElementPointsAtX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpotLightElementPointsAtY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpotLightElementPointsAtZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpotLightElementSpecularExponent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFESpotLightElementLimitingConeAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpotLightElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpotLightElementZ(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpotLightElementPointsAtX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpotLightElementPointsAtY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpotLightElementPointsAtZ(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpotLightElementSpecularExponent(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpotLightElementLimitingConeAngle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFESpotLightElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp
index 2ee08397b6..c235675e81 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp
@@ -43,16 +43,17 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFETileElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFETileElementTableValues[9] =
-{
-    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFETileElementIn1, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFETileElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFETileElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFETileElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFETileElementHeight, (intptr_t)0 },
-    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFETileElementResult, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFETileElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFETileElementStyle, (intptr_t)0 },
+static const HashTableValue JSSVGFETileElementTableValues[10] =
+{
+    { "in1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETileElementIn1), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETileElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETileElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETileElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETileElementHeight), (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETileElementResult), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETileElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETileElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETileElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -60,14 +61,61 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFETileElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 255, JSSVGFETileElementTableValues, 0 };
 #else
-    { 18, 15, JSSVGFETileElementTableValues, 0 };
+    { 34, 31, JSSVGFETileElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFETileElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFETileElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFETileElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFETileElementConstructorTableValues, 0 };
 #endif
 
+class JSSVGFETileElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFETileElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFETileElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFETileElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFETileElementConstructor::s_info = { "SVGFETileElementConstructor", 0, &JSSVGFETileElementConstructorTable, 0 };
+
+bool JSSVGFETileElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFETileElementConstructor, DOMObject>(exec, &JSSVGFETileElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFETileElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFETileElementConstructor, DOMObject>(exec, &JSSVGFETileElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFETileElementPrototypeTableValues[2] =
 {
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFETileElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFETileElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -117,75 +165,93 @@ bool JSSVGFETileElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSSVGFETileElement, Base>(exec, &JSSVGFETileElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFETileElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementIn1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()));
+    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETileElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()));
+    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETileElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()));
+    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETileElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()));
+    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETileElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()));
+    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETileElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementResult(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()));
+    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETileElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()));
+    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETileElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()));
+    JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
+}
+
+JSValue jsSVGFETileElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFETileElement* domObject = static_cast<JSSVGFETileElement*>(asObject(slotBase));
+    return JSSVGFETileElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFETileElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFETileElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGFETileElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
index f1e489e062..b5a4c29ef7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -60,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFETileElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,14 +73,15 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGFETileElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFETileElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETileElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETileElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETileElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETileElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETileElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETileElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETileElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementIn1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETileElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETileElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETileElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETileElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETileElementResult(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETileElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETileElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETileElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
index 845cdb6a3c..7e8c090438 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
@@ -48,20 +48,20 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFETurbulenceElement);
 
 static const HashTableValue JSSVGFETurbulenceElementTableValues[15] =
 {
-    { "baseFrequencyX", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementBaseFrequencyX, (intptr_t)0 },
-    { "baseFrequencyY", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementBaseFrequencyY, (intptr_t)0 },
-    { "numOctaves", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementNumOctaves, (intptr_t)0 },
-    { "seed", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementSeed, (intptr_t)0 },
-    { "stitchTiles", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementStitchTiles, (intptr_t)0 },
-    { "type", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementType, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementHeight, (intptr_t)0 },
-    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementResult, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGFETurbulenceElementConstructor, (intptr_t)0 },
+    { "baseFrequencyX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementBaseFrequencyX), (intptr_t)0 },
+    { "baseFrequencyY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementBaseFrequencyY), (intptr_t)0 },
+    { "numOctaves", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementNumOctaves), (intptr_t)0 },
+    { "seed", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementSeed), (intptr_t)0 },
+    { "stitchTiles", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementStitchTiles), (intptr_t)0 },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementType), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementHeight), (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementResult), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,12 +76,12 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFETurbulenceElementTable =
 
 static const HashTableValue JSSVGFETurbulenceElementConstructorTableValues[7] =
 {
-    { "SVG_TURBULENCE_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_TURBULENCE_TYPE_FRACTALNOISE", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE, (intptr_t)0 },
-    { "SVG_TURBULENCE_TYPE_TURBULENCE", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE, (intptr_t)0 },
-    { "SVG_STITCHTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_STITCHTYPE_STITCH", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH, (intptr_t)0 },
-    { "SVG_STITCHTYPE_NOSTITCH", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH, (intptr_t)0 },
+    { "SVG_TURBULENCE_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_TURBULENCE_TYPE_FRACTALNOISE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE), (intptr_t)0 },
+    { "SVG_TURBULENCE_TYPE_TURBULENCE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE), (intptr_t)0 },
+    { "SVG_STITCHTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_STITCHTYPE_STITCH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH), (intptr_t)0 },
+    { "SVG_STITCHTYPE_NOSTITCH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -106,7 +106,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -129,13 +129,13 @@ bool JSSVGFETurbulenceElementConstructor::getOwnPropertyDescriptor(ExecState* ex
 
 static const HashTableValue JSSVGFETurbulenceElementPrototypeTableValues[8] =
 {
-    { "SVG_TURBULENCE_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_TURBULENCE_TYPE_FRACTALNOISE", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE, (intptr_t)0 },
-    { "SVG_TURBULENCE_TYPE_TURBULENCE", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE, (intptr_t)0 },
-    { "SVG_STITCHTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_STITCHTYPE_STITCH", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH, (intptr_t)0 },
-    { "SVG_STITCHTYPE_NOSTITCH", DontDelete|ReadOnly, (intptr_t)jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH, (intptr_t)0 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFETurbulenceElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "SVG_TURBULENCE_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_TURBULENCE_TYPE_FRACTALNOISE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE), (intptr_t)0 },
+    { "SVG_TURBULENCE_TYPE_TURBULENCE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE), (intptr_t)0 },
+    { "SVG_STITCHTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_STITCHTYPE_STITCH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH), (intptr_t)0 },
+    { "SVG_STITCHTYPE_NOSTITCH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH), (intptr_t)0 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFETurbulenceElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -185,125 +185,138 @@ bool JSSVGFETurbulenceElement::getOwnPropertyDescriptor(ExecState* exec, const I
     return getStaticValueDescriptor<JSSVGFETurbulenceElement, Base>(exec, &JSSVGFETurbulenceElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFETurbulenceElementBaseFrequencyX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementBaseFrequencyX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()));
+    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->baseFrequencyXAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETurbulenceElementBaseFrequencyY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementBaseFrequencyY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()));
+    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->baseFrequencyYAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETurbulenceElementNumOctaves(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementNumOctaves(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()));
+    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThis->impl());
     RefPtr<SVGAnimatedInteger> obj = imp->numOctavesAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETurbulenceElementSeed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementSeed(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()));
+    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->seedAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETurbulenceElementStitchTiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementStitchTiles(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()));
+    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->stitchTilesAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETurbulenceElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()));
+    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->typeAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETurbulenceElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()));
+    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETurbulenceElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()));
+    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETurbulenceElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()));
+    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETurbulenceElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()));
+    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETurbulenceElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementResult(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()));
+    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETurbulenceElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()));
+    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFETurbulenceElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()));
+    JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGFETurbulenceElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFETurbulenceElement* domObject = static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()));
+    JSSVGFETurbulenceElement* domObject = static_cast<JSSVGFETurbulenceElement*>(asObject(slotBase));
     return JSSVGFETurbulenceElement::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGFETurbulenceElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -327,32 +340,32 @@ JSValue JSC_HOST_CALL jsSVGFETurbulenceElementPrototypeFunctionGetPresentationAt
 
 // Constant getters
 
-JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
index 7d100b68eb..954820bc51 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFETurbulenceElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,28 +73,28 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGFETurbulenceElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFETurbulenceElementBaseFrequencyX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementBaseFrequencyY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementNumOctaves(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementSeed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementStitchTiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementBaseFrequencyX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementBaseFrequencyY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementNumOctaves(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementSeed(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementStitchTiles(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementResult(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp
index 33463226b3..f7a818a2d7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp
@@ -48,22 +48,23 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFilterElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFilterElementTableValues[15] =
-{
-    { "filterUnits", DontDelete|ReadOnly, (intptr_t)jsSVGFilterElementFilterUnits, (intptr_t)0 },
-    { "primitiveUnits", DontDelete|ReadOnly, (intptr_t)jsSVGFilterElementPrimitiveUnits, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFilterElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFilterElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFilterElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFilterElementHeight, (intptr_t)0 },
-    { "filterResX", DontDelete|ReadOnly, (intptr_t)jsSVGFilterElementFilterResX, (intptr_t)0 },
-    { "filterResY", DontDelete|ReadOnly, (intptr_t)jsSVGFilterElementFilterResY, (intptr_t)0 },
-    { "href", DontDelete|ReadOnly, (intptr_t)jsSVGFilterElementHref, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGFilterElementXmllang, (intptr_t)setJSSVGFilterElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGFilterElementXmlspace, (intptr_t)setJSSVGFilterElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGFilterElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFilterElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFilterElementStyle, (intptr_t)0 },
+static const HashTableValue JSSVGFilterElementTableValues[16] =
+{
+    { "filterUnits", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFilterElementFilterUnits), (intptr_t)0 },
+    { "primitiveUnits", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFilterElementPrimitiveUnits), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFilterElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFilterElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFilterElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFilterElementHeight), (intptr_t)0 },
+    { "filterResX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFilterElementFilterResX), (intptr_t)0 },
+    { "filterResY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFilterElementFilterResY), (intptr_t)0 },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFilterElementHref), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFilterElementXmllang), (intptr_t)setJSSVGFilterElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFilterElementXmlspace), (intptr_t)setJSSVGFilterElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFilterElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFilterElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFilterElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFilterElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -74,12 +75,59 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFilterElementTable =
     { 35, 31, JSSVGFilterElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFilterElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFilterElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFilterElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFilterElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFilterElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFilterElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFilterElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFilterElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFilterElementConstructor::s_info = { "SVGFilterElementConstructor", 0, &JSSVGFilterElementConstructorTable, 0 };
+
+bool JSSVGFilterElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFilterElementConstructor, DOMObject>(exec, &JSSVGFilterElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFilterElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFilterElementConstructor, DOMObject>(exec, &JSSVGFilterElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFilterElementPrototypeTableValues[3] =
 {
-    { "setFilterRes", DontDelete|Function, (intptr_t)jsSVGFilterElementPrototypeFunctionSetFilterRes, (intptr_t)2 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFilterElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "setFilterRes", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFilterElementPrototypeFunctionSetFilterRes), (intptr_t)2 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGFilterElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -129,129 +177,148 @@ bool JSSVGFilterElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSSVGFilterElement, Base>(exec, &JSSVGFilterElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFilterElementFilterUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementFilterUnits(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()));
+    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->filterUnitsAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFilterElementPrimitiveUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementPrimitiveUnits(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()));
+    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->primitiveUnitsAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFilterElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()));
+    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFilterElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()));
+    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFilterElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()));
+    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFilterElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()));
+    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFilterElementFilterResX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementFilterResX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()));
+    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThis->impl());
     RefPtr<SVGAnimatedInteger> obj = imp->filterResXAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFilterElementFilterResY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementFilterResY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()));
+    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThis->impl());
     RefPtr<SVGAnimatedInteger> obj = imp->filterResYAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFilterElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()));
+    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFilterElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()));
+    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGFilterElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()));
+    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGFilterElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()));
+    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFilterElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()));
+    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGFilterElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()));
+    JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
+JSValue jsSVGFilterElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFilterElement* domObject = static_cast<JSSVGFilterElement*>(asObject(slotBase));
+    return JSSVGFilterElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGFilterElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGFilterElement, Base>(exec, propertyName, value, &JSSVGFilterElementTable, this, slot);
@@ -259,16 +326,23 @@ void JSSVGFilterElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSSVGFilterElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(thisObject)->impl());
+    JSSVGFilterElement* castedThisObj = static_cast<JSSVGFilterElement*>(thisObject);
+    SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGFilterElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(thisObject)->impl());
+    JSSVGFilterElement* castedThisObj = static_cast<JSSVGFilterElement*>(thisObject);
+    SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGFilterElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFilterElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGFilterElementPrototypeFunctionSetFilterRes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
index 9e0b45fad6..4be9970c26 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFilterElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -74,22 +75,23 @@ JSC::JSValue JSC_HOST_CALL jsSVGFilterElementPrototypeFunctionSetFilterRes(JSC::
 JSC::JSValue JSC_HOST_CALL jsSVGFilterElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFilterElementFilterUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFilterElementPrimitiveUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFilterElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFilterElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFilterElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFilterElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFilterElementFilterResX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFilterElementFilterResY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFilterElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFilterElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementFilterUnits(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFilterElementPrimitiveUnits(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFilterElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFilterElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFilterElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFilterElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFilterElementFilterResX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFilterElementFilterResY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFilterElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFilterElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGFilterElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGFilterElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGFilterElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGFilterElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFilterElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFilterElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFilterElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFilterElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGFilterElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.cpp
index bf274c32ba..955512884b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGFontElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGFontElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFontElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFontElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFontElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGFontElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFontElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFontElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFontElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFontElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFontElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFontElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFontElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFontElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFontElementConstructor::s_info = { "SVGFontElementConstructor", 0, &JSSVGFontElementConstructorTable, 0 };
+
+bool JSSVGFontElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFontElementConstructor, DOMObject>(exec, &JSSVGFontElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFontElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFontElementConstructor, DOMObject>(exec, &JSSVGFontElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFontElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGFontElementPrototype::self(ExecState* exec, JSGlobalObject* globa
     return getDOMPrototype<JSSVGFontElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGFontElement::s_info = { "SVGFontElement", &JSSVGElement::s_info, 0, 0 };
+const ClassInfo JSSVGFontElement::s_info = { "SVGFontElement", &JSSVGElement::s_info, &JSSVGFontElementTable, 0 };
 
 JSSVGFontElement::JSSVGFontElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFontElement> impl)
     : JSSVGElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGFontElement::createPrototype(ExecState* exec, JSGlobalObject* glo
     return new (exec) JSSVGFontElementPrototype(JSSVGFontElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGFontElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFontElement, Base>(exec, &JSSVGFontElementTable, this, propertyName, slot);
+}
+
+bool JSSVGFontElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFontElement, Base>(exec, &JSSVGFontElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGFontElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFontElement* domObject = static_cast<JSSVGFontElement*>(asObject(slotBase));
+    return JSSVGFontElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFontElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFontElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h
index e6ce8a21d8..5a24023fb9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h
@@ -35,16 +35,19 @@ class JSSVGFontElement : public JSSVGElement {
 public:
     JSSVGFontElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFontElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFontElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGFontElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.cpp
index 4048562021..31082326d1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGFontFaceElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFontFaceElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFontFaceElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFontFaceElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGFontFaceElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFontFaceElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFontFaceElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFontFaceElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFontFaceElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFontFaceElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFontFaceElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFontFaceElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFontFaceElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFontFaceElementConstructor::s_info = { "SVGFontFaceElementConstructor", 0, &JSSVGFontFaceElementConstructorTable, 0 };
+
+bool JSSVGFontFaceElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFontFaceElementConstructor, DOMObject>(exec, &JSSVGFontFaceElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFontFaceElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFontFaceElementConstructor, DOMObject>(exec, &JSSVGFontFaceElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFontFaceElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGFontFaceElementPrototype::self(ExecState* exec, JSGlobalObject* g
     return getDOMPrototype<JSSVGFontFaceElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGFontFaceElement::s_info = { "SVGFontFaceElement", &JSSVGElement::s_info, 0, 0 };
+const ClassInfo JSSVGFontFaceElement::s_info = { "SVGFontFaceElement", &JSSVGElement::s_info, &JSSVGFontFaceElementTable, 0 };
 
 JSSVGFontFaceElement::JSSVGFontFaceElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFontFaceElement> impl)
     : JSSVGElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGFontFaceElement::createPrototype(ExecState* exec, JSGlobalObject*
     return new (exec) JSSVGFontFaceElementPrototype(JSSVGFontFaceElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGFontFaceElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFontFaceElement, Base>(exec, &JSSVGFontFaceElementTable, this, propertyName, slot);
+}
+
+bool JSSVGFontFaceElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFontFaceElement, Base>(exec, &JSSVGFontFaceElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGFontFaceElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFontFaceElement* domObject = static_cast<JSSVGFontFaceElement*>(asObject(slotBase));
+    return JSSVGFontFaceElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFontFaceElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFontFaceElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h
index 87d2243ad8..e2046e5280 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h
@@ -35,16 +35,19 @@ class JSSVGFontFaceElement : public JSSVGElement {
 public:
     JSSVGFontFaceElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFontFaceElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFontFaceElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGFontFaceElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.cpp
index 33dc1ebbdc..4c7485425f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceFormatElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGFontFaceFormatElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFontFaceFormatElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFontFaceFormatElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFontFaceFormatElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGFontFaceFormatElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFontFaceFormatElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFontFaceFormatElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFontFaceFormatElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFontFaceFormatElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFontFaceFormatElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFontFaceFormatElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFontFaceFormatElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFontFaceFormatElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFontFaceFormatElementConstructor::s_info = { "SVGFontFaceFormatElementConstructor", 0, &JSSVGFontFaceFormatElementConstructorTable, 0 };
+
+bool JSSVGFontFaceFormatElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFontFaceFormatElementConstructor, DOMObject>(exec, &JSSVGFontFaceFormatElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFontFaceFormatElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFontFaceFormatElementConstructor, DOMObject>(exec, &JSSVGFontFaceFormatElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFontFaceFormatElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGFontFaceFormatElementPrototype::self(ExecState* exec, JSGlobalObj
     return getDOMPrototype<JSSVGFontFaceFormatElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGFontFaceFormatElement::s_info = { "SVGFontFaceFormatElement", &JSSVGElement::s_info, 0, 0 };
+const ClassInfo JSSVGFontFaceFormatElement::s_info = { "SVGFontFaceFormatElement", &JSSVGElement::s_info, &JSSVGFontFaceFormatElementTable, 0 };
 
 JSSVGFontFaceFormatElement::JSSVGFontFaceFormatElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFontFaceFormatElement> impl)
     : JSSVGElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGFontFaceFormatElement::createPrototype(ExecState* exec, JSGlobalO
     return new (exec) JSSVGFontFaceFormatElementPrototype(JSSVGFontFaceFormatElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGFontFaceFormatElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFontFaceFormatElement, Base>(exec, &JSSVGFontFaceFormatElementTable, this, propertyName, slot);
+}
+
+bool JSSVGFontFaceFormatElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFontFaceFormatElement, Base>(exec, &JSSVGFontFaceFormatElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGFontFaceFormatElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFontFaceFormatElement* domObject = static_cast<JSSVGFontFaceFormatElement*>(asObject(slotBase));
+    return JSSVGFontFaceFormatElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFontFaceFormatElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFontFaceFormatElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h
index 9ffb7b41f0..c1e150b889 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h
@@ -35,16 +35,19 @@ class JSSVGFontFaceFormatElement : public JSSVGElement {
 public:
     JSSVGFontFaceFormatElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFontFaceFormatElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFontFaceFormatElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGFontFaceFormatElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.cpp
index b496283f0e..165f0452bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceNameElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGFontFaceNameElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFontFaceNameElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFontFaceNameElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFontFaceNameElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGFontFaceNameElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFontFaceNameElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFontFaceNameElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFontFaceNameElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFontFaceNameElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFontFaceNameElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFontFaceNameElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFontFaceNameElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFontFaceNameElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFontFaceNameElementConstructor::s_info = { "SVGFontFaceNameElementConstructor", 0, &JSSVGFontFaceNameElementConstructorTable, 0 };
+
+bool JSSVGFontFaceNameElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFontFaceNameElementConstructor, DOMObject>(exec, &JSSVGFontFaceNameElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFontFaceNameElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFontFaceNameElementConstructor, DOMObject>(exec, &JSSVGFontFaceNameElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFontFaceNameElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGFontFaceNameElementPrototype::self(ExecState* exec, JSGlobalObjec
     return getDOMPrototype<JSSVGFontFaceNameElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGFontFaceNameElement::s_info = { "SVGFontFaceNameElement", &JSSVGElement::s_info, 0, 0 };
+const ClassInfo JSSVGFontFaceNameElement::s_info = { "SVGFontFaceNameElement", &JSSVGElement::s_info, &JSSVGFontFaceNameElementTable, 0 };
 
 JSSVGFontFaceNameElement::JSSVGFontFaceNameElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFontFaceNameElement> impl)
     : JSSVGElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGFontFaceNameElement::createPrototype(ExecState* exec, JSGlobalObj
     return new (exec) JSSVGFontFaceNameElementPrototype(JSSVGFontFaceNameElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGFontFaceNameElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFontFaceNameElement, Base>(exec, &JSSVGFontFaceNameElementTable, this, propertyName, slot);
+}
+
+bool JSSVGFontFaceNameElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFontFaceNameElement, Base>(exec, &JSSVGFontFaceNameElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGFontFaceNameElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFontFaceNameElement* domObject = static_cast<JSSVGFontFaceNameElement*>(asObject(slotBase));
+    return JSSVGFontFaceNameElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFontFaceNameElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFontFaceNameElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h
index 1abfcbb181..74fa68900c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h
@@ -35,16 +35,19 @@ class JSSVGFontFaceNameElement : public JSSVGElement {
 public:
     JSSVGFontFaceNameElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFontFaceNameElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFontFaceNameElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGFontFaceNameElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.cpp
index b4233942ec..7208ad56c2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceSrcElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGFontFaceSrcElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFontFaceSrcElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFontFaceSrcElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFontFaceSrcElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGFontFaceSrcElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFontFaceSrcElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFontFaceSrcElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFontFaceSrcElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFontFaceSrcElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFontFaceSrcElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFontFaceSrcElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFontFaceSrcElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFontFaceSrcElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFontFaceSrcElementConstructor::s_info = { "SVGFontFaceSrcElementConstructor", 0, &JSSVGFontFaceSrcElementConstructorTable, 0 };
+
+bool JSSVGFontFaceSrcElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFontFaceSrcElementConstructor, DOMObject>(exec, &JSSVGFontFaceSrcElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFontFaceSrcElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFontFaceSrcElementConstructor, DOMObject>(exec, &JSSVGFontFaceSrcElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFontFaceSrcElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGFontFaceSrcElementPrototype::self(ExecState* exec, JSGlobalObject
     return getDOMPrototype<JSSVGFontFaceSrcElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGFontFaceSrcElement::s_info = { "SVGFontFaceSrcElement", &JSSVGElement::s_info, 0, 0 };
+const ClassInfo JSSVGFontFaceSrcElement::s_info = { "SVGFontFaceSrcElement", &JSSVGElement::s_info, &JSSVGFontFaceSrcElementTable, 0 };
 
 JSSVGFontFaceSrcElement::JSSVGFontFaceSrcElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFontFaceSrcElement> impl)
     : JSSVGElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGFontFaceSrcElement::createPrototype(ExecState* exec, JSGlobalObje
     return new (exec) JSSVGFontFaceSrcElementPrototype(JSSVGFontFaceSrcElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGFontFaceSrcElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFontFaceSrcElement, Base>(exec, &JSSVGFontFaceSrcElementTable, this, propertyName, slot);
+}
+
+bool JSSVGFontFaceSrcElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFontFaceSrcElement, Base>(exec, &JSSVGFontFaceSrcElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGFontFaceSrcElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFontFaceSrcElement* domObject = static_cast<JSSVGFontFaceSrcElement*>(asObject(slotBase));
+    return JSSVGFontFaceSrcElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFontFaceSrcElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFontFaceSrcElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h
index 1a154abc3d..11834f1c97 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h
@@ -35,16 +35,19 @@ class JSSVGFontFaceSrcElement : public JSSVGElement {
 public:
     JSSVGFontFaceSrcElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFontFaceSrcElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFontFaceSrcElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGFontFaceSrcElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.cpp
index ded5957f4e..d6a6c4d830 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceUriElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGFontFaceUriElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGFontFaceUriElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFontFaceUriElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFontFaceUriElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGFontFaceUriElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFontFaceUriElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFontFaceUriElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFontFaceUriElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFontFaceUriElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFontFaceUriElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFontFaceUriElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFontFaceUriElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFontFaceUriElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFontFaceUriElementConstructor::s_info = { "SVGFontFaceUriElementConstructor", 0, &JSSVGFontFaceUriElementConstructorTable, 0 };
+
+bool JSSVGFontFaceUriElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFontFaceUriElementConstructor, DOMObject>(exec, &JSSVGFontFaceUriElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFontFaceUriElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFontFaceUriElementConstructor, DOMObject>(exec, &JSSVGFontFaceUriElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFontFaceUriElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGFontFaceUriElementPrototype::self(ExecState* exec, JSGlobalObject
     return getDOMPrototype<JSSVGFontFaceUriElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGFontFaceUriElement::s_info = { "SVGFontFaceUriElement", &JSSVGElement::s_info, 0, 0 };
+const ClassInfo JSSVGFontFaceUriElement::s_info = { "SVGFontFaceUriElement", &JSSVGElement::s_info, &JSSVGFontFaceUriElementTable, 0 };
 
 JSSVGFontFaceUriElement::JSSVGFontFaceUriElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFontFaceUriElement> impl)
     : JSSVGElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGFontFaceUriElement::createPrototype(ExecState* exec, JSGlobalObje
     return new (exec) JSSVGFontFaceUriElementPrototype(JSSVGFontFaceUriElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGFontFaceUriElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFontFaceUriElement, Base>(exec, &JSSVGFontFaceUriElementTable, this, propertyName, slot);
+}
+
+bool JSSVGFontFaceUriElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFontFaceUriElement, Base>(exec, &JSSVGFontFaceUriElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGFontFaceUriElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGFontFaceUriElement* domObject = static_cast<JSSVGFontFaceUriElement*>(asObject(slotBase));
+    return JSSVGFontFaceUriElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFontFaceUriElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFontFaceUriElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h
index eede5c0f16..637c8568ad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h
@@ -35,16 +35,19 @@ class JSSVGFontFaceUriElement : public JSSVGElement {
 public:
     JSSVGFontFaceUriElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFontFaceUriElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGFontFaceUriElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGFontFaceUriElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp
index 4b2dc8d9e1..fe202c0114 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp
@@ -53,23 +53,24 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGForeignObjectElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGForeignObjectElementTableValues[16] =
-{
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGForeignObjectElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGForeignObjectElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGForeignObjectElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGForeignObjectElementHeight, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGForeignObjectElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGForeignObjectElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGForeignObjectElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGForeignObjectElementXmllang, (intptr_t)setJSSVGForeignObjectElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGForeignObjectElementXmlspace, (intptr_t)setJSSVGForeignObjectElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGForeignObjectElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGForeignObjectElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGForeignObjectElementStyle, (intptr_t)0 },
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGForeignObjectElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGForeignObjectElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGForeignObjectElementFarthestViewportElement, (intptr_t)0 },
+static const HashTableValue JSSVGForeignObjectElementTableValues[17] =
+{
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementHeight), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementXmllang), (intptr_t)setJSSVGForeignObjectElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementXmlspace), (intptr_t)setJSSVGForeignObjectElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementStyle), (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementFarthestViewportElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGForeignObjectElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,19 +78,66 @@ static JSC_CONST_HASHTABLE HashTable JSSVGForeignObjectElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 1023, JSSVGForeignObjectElementTableValues, 0 };
 #else
-    { 36, 31, JSSVGForeignObjectElementTableValues, 0 };
+    { 37, 31, JSSVGForeignObjectElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGForeignObjectElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGForeignObjectElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGForeignObjectElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGForeignObjectElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGForeignObjectElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGForeignObjectElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGForeignObjectElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGForeignObjectElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGForeignObjectElementConstructor::s_info = { "SVGForeignObjectElementConstructor", 0, &JSSVGForeignObjectElementConstructorTable, 0 };
+
+bool JSSVGForeignObjectElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGForeignObjectElementConstructor, DOMObject>(exec, &JSSVGForeignObjectElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGForeignObjectElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGForeignObjectElementConstructor, DOMObject>(exec, &JSSVGForeignObjectElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGForeignObjectElementPrototypeTableValues[7] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGForeignObjectElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGForeignObjectElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGForeignObjectElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGForeignObjectElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGForeignObjectElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGForeignObjectElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGForeignObjectElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGForeignObjectElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGForeignObjectElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGForeignObjectElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGForeignObjectElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGForeignObjectElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -139,133 +187,153 @@ bool JSSVGForeignObjectElement::getOwnPropertyDescriptor(ExecState* exec, const
     return getStaticValueDescriptor<JSSVGForeignObjectElement, Base>(exec, &JSSVGForeignObjectElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGForeignObjectElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
+    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGForeignObjectElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
+    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGForeignObjectElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
+    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGForeignObjectElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
+    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGForeignObjectElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
+    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGForeignObjectElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
+    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGForeignObjectElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
+    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGForeignObjectElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
+    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGForeignObjectElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
+    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGForeignObjectElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
+    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGForeignObjectElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
+    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGForeignObjectElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
+    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGForeignObjectElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
+    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGForeignObjectElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
+    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGForeignObjectElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
+    JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
+JSValue jsSVGForeignObjectElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGForeignObjectElement* domObject = static_cast<JSSVGForeignObjectElement*>(asObject(slotBase));
+    return JSSVGForeignObjectElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGForeignObjectElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGForeignObjectElement, Base>(exec, propertyName, value, &JSSVGForeignObjectElementTable, this, slot);
@@ -273,16 +341,23 @@ void JSSVGForeignObjectElement::put(ExecState* exec, const Identifier& propertyN
 
 void setJSSVGForeignObjectElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(thisObject)->impl());
+    JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(thisObject);
+    SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGForeignObjectElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(thisObject)->impl());
+    JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(thisObject);
+    SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGForeignObjectElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGForeignObjectElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -320,7 +395,7 @@ JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetBBox(ExecStat
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -333,7 +408,7 @@ JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetCTM(ExecState
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -346,7 +421,7 @@ JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetScreenCTM(Exe
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -361,7 +436,7 @@ JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetTransformToEl
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
index 6e8121a8d2..1b44b87ac3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGForeignObjectElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,23 +79,24 @@ JSC::JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetScreenCT
 JSC::JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGForeignObjectElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGForeignObjectElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGForeignObjectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGForeignObjectElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGForeignObjectElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGForeignObjectElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGForeignObjectElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGForeignObjectElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGForeignObjectElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGForeignObjectElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGForeignObjectElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGForeignObjectElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGForeignObjectElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGForeignObjectElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGForeignObjectElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGForeignObjectElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGForeignObjectElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGForeignObjectElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGForeignObjectElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGForeignObjectElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGForeignObjectElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGForeignObjectElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGForeignObjectElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGForeignObjectElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGForeignObjectElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGForeignObjectElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGForeignObjectElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGForeignObjectElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGForeignObjectElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGForeignObjectElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp
index 20512fa956..3fc8c63729 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp
@@ -52,19 +52,20 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGGElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGGElementTableValues[12] =
-{
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGGElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGGElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGGElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGGElementXmllang, (intptr_t)setJSSVGGElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGGElementXmlspace, (intptr_t)setJSSVGGElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGGElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGGElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGGElementStyle, (intptr_t)0 },
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGGElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGGElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGGElementFarthestViewportElement, (intptr_t)0 },
+static const HashTableValue JSSVGGElementTableValues[13] =
+{
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGElementXmllang), (intptr_t)setJSSVGGElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGElementXmlspace), (intptr_t)setJSSVGGElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGElementStyle), (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGElementFarthestViewportElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -72,19 +73,66 @@ static JSC_CONST_HASHTABLE HashTable JSSVGGElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 127, JSSVGGElementTableValues, 0 };
 #else
-    { 33, 31, JSSVGGElementTableValues, 0 };
+    { 34, 31, JSSVGGElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGGElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGGElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGGElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGGElementConstructorTableValues, 0 };
 #endif
 
+class JSSVGGElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGGElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGGElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGGElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGGElementConstructor::s_info = { "SVGGElementConstructor", 0, &JSSVGGElementConstructorTable, 0 };
+
+bool JSSVGGElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGGElementConstructor, DOMObject>(exec, &JSSVGGElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGGElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGGElementConstructor, DOMObject>(exec, &JSSVGGElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGGElementPrototypeTableValues[7] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGGElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGGElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGGElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGGElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGGElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGGElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGGElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGGElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGGElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGGElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGGElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGGElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -134,97 +182,113 @@ bool JSSVGGElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSSVGGElement, Base>(exec, &JSSVGGElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGGElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slot.slotBase()));
+    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGGElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slot.slotBase()));
+    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGGElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slot.slotBase()));
+    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGGElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slot.slotBase()));
+    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGGElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slot.slotBase()));
+    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGGElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slot.slotBase()));
+    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGGElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slot.slotBase()));
+    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGGElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slot.slotBase()));
+    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGGElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slot.slotBase()));
+    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGGElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slot.slotBase()));
+    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGGElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slot.slotBase()));
+    JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
+JSValue jsSVGGElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGGElement* domObject = static_cast<JSSVGGElement*>(asObject(slotBase));
+    return JSSVGGElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGGElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGGElement, Base>(exec, propertyName, value, &JSSVGGElementTable, this, slot);
@@ -232,16 +296,23 @@ void JSSVGGElement::put(ExecState* exec, const Identifier& propertyName, JSValue
 
 void setJSSVGGElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(thisObject)->impl());
+    JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(thisObject);
+    SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGGElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(thisObject)->impl());
+    JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(thisObject);
+    SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGGElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGGElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -279,7 +350,7 @@ JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetBBox(ExecState* exec, JSO
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -292,7 +363,7 @@ JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetCTM(ExecState* exec, JSOb
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -305,7 +376,7 @@ JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetScreenCTM(ExecState* exec
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -320,7 +391,7 @@ JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetTransformToElement(ExecSt
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
index 7c6aa85fd2..3d3472e293 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGGElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,19 +79,20 @@ JSC::JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetScreenCTM(JSC::ExecS
 JSC::JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGGElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGGElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGGElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGGElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGGElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.cpp
index 254932cad7..0313cd8da1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGGlyphElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGGlyphElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGlyphElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGGlyphElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGGlyphElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGGlyphElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGGlyphElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGGlyphElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGGlyphElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGGlyphElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGGlyphElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGGlyphElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGGlyphElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGGlyphElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGGlyphElementConstructor::s_info = { "SVGGlyphElementConstructor", 0, &JSSVGGlyphElementConstructorTable, 0 };
+
+bool JSSVGGlyphElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGGlyphElementConstructor, DOMObject>(exec, &JSSVGGlyphElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGGlyphElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGGlyphElementConstructor, DOMObject>(exec, &JSSVGGlyphElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGGlyphElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGGlyphElementPrototype::self(ExecState* exec, JSGlobalObject* glob
     return getDOMPrototype<JSSVGGlyphElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGGlyphElement::s_info = { "SVGGlyphElement", &JSSVGElement::s_info, 0, 0 };
+const ClassInfo JSSVGGlyphElement::s_info = { "SVGGlyphElement", &JSSVGElement::s_info, &JSSVGGlyphElementTable, 0 };
 
 JSSVGGlyphElement::JSSVGGlyphElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGGlyphElement> impl)
     : JSSVGElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGGlyphElement::createPrototype(ExecState* exec, JSGlobalObject* gl
     return new (exec) JSSVGGlyphElementPrototype(JSSVGGlyphElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGGlyphElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGGlyphElement, Base>(exec, &JSSVGGlyphElementTable, this, propertyName, slot);
+}
+
+bool JSSVGGlyphElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGGlyphElement, Base>(exec, &JSSVGGlyphElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGGlyphElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGGlyphElement* domObject = static_cast<JSSVGGlyphElement*>(asObject(slotBase));
+    return JSSVGGlyphElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGGlyphElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGGlyphElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h
index 05f62df802..a5c101807e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h
@@ -35,16 +35,19 @@ class JSSVGGlyphElement : public JSSVGElement {
 public:
     JSSVGGlyphElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGGlyphElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGGlyphElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGGlyphElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
index 428601646a..4773804f59 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
@@ -47,14 +47,14 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGGradientElement);
 
 static const HashTableValue JSSVGGradientElementTableValues[9] =
 {
-    { "gradientUnits", DontDelete|ReadOnly, (intptr_t)jsSVGGradientElementGradientUnits, (intptr_t)0 },
-    { "gradientTransform", DontDelete|ReadOnly, (intptr_t)jsSVGGradientElementGradientTransform, (intptr_t)0 },
-    { "spreadMethod", DontDelete|ReadOnly, (intptr_t)jsSVGGradientElementSpreadMethod, (intptr_t)0 },
-    { "href", DontDelete|ReadOnly, (intptr_t)jsSVGGradientElementHref, (intptr_t)0 },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGGradientElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGGradientElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGGradientElementStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGGradientElementConstructor, (intptr_t)0 },
+    { "gradientUnits", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementGradientUnits), (intptr_t)0 },
+    { "gradientTransform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementGradientTransform), (intptr_t)0 },
+    { "spreadMethod", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementSpreadMethod), (intptr_t)0 },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementHref), (intptr_t)0 },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -69,10 +69,10 @@ static JSC_CONST_HASHTABLE HashTable JSSVGGradientElementTable =
 
 static const HashTableValue JSSVGGradientElementConstructorTableValues[5] =
 {
-    { "SVG_SPREADMETHOD_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN, (intptr_t)0 },
-    { "SVG_SPREADMETHOD_PAD", DontDelete|ReadOnly, (intptr_t)jsSVGGradientElementSVG_SPREADMETHOD_PAD, (intptr_t)0 },
-    { "SVG_SPREADMETHOD_REFLECT", DontDelete|ReadOnly, (intptr_t)jsSVGGradientElementSVG_SPREADMETHOD_REFLECT, (intptr_t)0 },
-    { "SVG_SPREADMETHOD_REPEAT", DontDelete|ReadOnly, (intptr_t)jsSVGGradientElementSVG_SPREADMETHOD_REPEAT, (intptr_t)0 },
+    { "SVG_SPREADMETHOD_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN), (intptr_t)0 },
+    { "SVG_SPREADMETHOD_PAD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementSVG_SPREADMETHOD_PAD), (intptr_t)0 },
+    { "SVG_SPREADMETHOD_REFLECT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementSVG_SPREADMETHOD_REFLECT), (intptr_t)0 },
+    { "SVG_SPREADMETHOD_REPEAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementSVG_SPREADMETHOD_REPEAT), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -97,7 +97,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -120,11 +120,11 @@ bool JSSVGGradientElementConstructor::getOwnPropertyDescriptor(ExecState* exec,
 
 static const HashTableValue JSSVGGradientElementPrototypeTableValues[6] =
 {
-    { "SVG_SPREADMETHOD_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN, (intptr_t)0 },
-    { "SVG_SPREADMETHOD_PAD", DontDelete|ReadOnly, (intptr_t)jsSVGGradientElementSVG_SPREADMETHOD_PAD, (intptr_t)0 },
-    { "SVG_SPREADMETHOD_REFLECT", DontDelete|ReadOnly, (intptr_t)jsSVGGradientElementSVG_SPREADMETHOD_REFLECT, (intptr_t)0 },
-    { "SVG_SPREADMETHOD_REPEAT", DontDelete|ReadOnly, (intptr_t)jsSVGGradientElementSVG_SPREADMETHOD_REPEAT, (intptr_t)0 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGGradientElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "SVG_SPREADMETHOD_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN), (intptr_t)0 },
+    { "SVG_SPREADMETHOD_PAD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementSVG_SPREADMETHOD_PAD), (intptr_t)0 },
+    { "SVG_SPREADMETHOD_REFLECT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementSVG_SPREADMETHOD_REFLECT), (intptr_t)0 },
+    { "SVG_SPREADMETHOD_REPEAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGGradientElementSVG_SPREADMETHOD_REPEAT), (intptr_t)0 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGGradientElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -174,71 +174,78 @@ bool JSSVGGradientElement::getOwnPropertyDescriptor(ExecState* exec, const Ident
     return getStaticValueDescriptor<JSSVGGradientElement, Base>(exec, &JSSVGGradientElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGGradientElementGradientUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementGradientUnits(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGradientElement* castedThis = static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()));
+    JSSVGGradientElement* castedThis = static_cast<JSSVGGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->gradientUnitsAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGGradientElementGradientTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementGradientTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGradientElement* castedThis = static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()));
+    JSSVGGradientElement* castedThis = static_cast<JSSVGGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->gradientTransformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGGradientElementSpreadMethod(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementSpreadMethod(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGradientElement* castedThis = static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()));
+    JSSVGGradientElement* castedThis = static_cast<JSSVGGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->spreadMethodAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGGradientElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGradientElement* castedThis = static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()));
+    JSSVGGradientElement* castedThis = static_cast<JSSVGGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGGradientElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGradientElement* castedThis = static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()));
+    JSSVGGradientElement* castedThis = static_cast<JSSVGGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGGradientElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGradientElement* castedThis = static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()));
+    JSSVGGradientElement* castedThis = static_cast<JSSVGGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGGradientElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGradientElement* castedThis = static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()));
+    JSSVGGradientElement* castedThis = static_cast<JSSVGGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGGradientElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGGradientElement* domObject = static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()));
+    JSSVGGradientElement* domObject = static_cast<JSSVGGradientElement*>(asObject(slotBase));
     return JSSVGGradientElement::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGGradientElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -262,22 +269,22 @@ JSValue JSC_HOST_CALL jsSVGGradientElementPrototypeFunctionGetPresentationAttrib
 
 // Constant getters
 
-JSValue jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGGradientElementSVG_SPREADMETHOD_PAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGGradientElementSVG_SPREADMETHOD_PAD(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGGradientElementSVG_SPREADMETHOD_REFLECT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGGradientElementSVG_SPREADMETHOD_REFLECT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGGradientElementSVG_SPREADMETHOD_REPEAT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGGradientElementSVG_SPREADMETHOD_REPEAT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
index 3207003770..668ad4bf3d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGGradientElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,20 +73,20 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGGradientElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGGradientElementGradientUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGradientElementGradientTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGradientElementSpreadMethod(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGradientElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGradientElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGradientElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGradientElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGradientElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementGradientUnits(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGradientElementGradientTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGradientElementSpreadMethod(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGradientElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGradientElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGradientElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGradientElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGradientElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_PAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_REFLECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_REPEAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_PAD(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_REFLECT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_REPEAT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.cpp
index 41b6732e07..c31206718d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGHKernElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGHKernElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGHKernElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGHKernElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGHKernElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGHKernElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGHKernElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGHKernElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGHKernElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGHKernElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGHKernElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGHKernElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGHKernElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGHKernElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGHKernElementConstructor::s_info = { "SVGHKernElementConstructor", 0, &JSSVGHKernElementConstructorTable, 0 };
+
+bool JSSVGHKernElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGHKernElementConstructor, DOMObject>(exec, &JSSVGHKernElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGHKernElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGHKernElementConstructor, DOMObject>(exec, &JSSVGHKernElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGHKernElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGHKernElementPrototype::self(ExecState* exec, JSGlobalObject* glob
     return getDOMPrototype<JSSVGHKernElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGHKernElement::s_info = { "SVGHKernElement", &JSSVGElement::s_info, 0, 0 };
+const ClassInfo JSSVGHKernElement::s_info = { "SVGHKernElement", &JSSVGElement::s_info, &JSSVGHKernElementTable, 0 };
 
 JSSVGHKernElement::JSSVGHKernElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGHKernElement> impl)
     : JSSVGElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGHKernElement::createPrototype(ExecState* exec, JSGlobalObject* gl
     return new (exec) JSSVGHKernElementPrototype(JSSVGHKernElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGHKernElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGHKernElement, Base>(exec, &JSSVGHKernElementTable, this, propertyName, slot);
+}
+
+bool JSSVGHKernElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGHKernElement, Base>(exec, &JSSVGHKernElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGHKernElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGHKernElement* domObject = static_cast<JSSVGHKernElement*>(asObject(slotBase));
+    return JSSVGHKernElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGHKernElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGHKernElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h
index aeab2d136b..c929dc2b06 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h
@@ -35,16 +35,19 @@ class JSSVGHKernElement : public JSSVGElement {
 public:
     JSSVGHKernElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGHKernElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGHKernElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGHKernElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp
index ce2ba8718d..ca40fe87ae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp
@@ -54,25 +54,26 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGImageElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGImageElementTableValues[18] =
-{
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGImageElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGImageElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGImageElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGImageElementHeight, (intptr_t)0 },
-    { "preserveAspectRatio", DontDelete|ReadOnly, (intptr_t)jsSVGImageElementPreserveAspectRatio, (intptr_t)0 },
-    { "href", DontDelete|ReadOnly, (intptr_t)jsSVGImageElementHref, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGImageElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGImageElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGImageElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGImageElementXmllang, (intptr_t)setJSSVGImageElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGImageElementXmlspace, (intptr_t)setJSSVGImageElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGImageElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGImageElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGImageElementStyle, (intptr_t)0 },
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGImageElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGImageElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGImageElementFarthestViewportElement, (intptr_t)0 },
+static const HashTableValue JSSVGImageElementTableValues[19] =
+{
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementHeight), (intptr_t)0 },
+    { "preserveAspectRatio", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementPreserveAspectRatio), (intptr_t)0 },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementHref), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementXmllang), (intptr_t)setJSSVGImageElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementXmlspace), (intptr_t)setJSSVGImageElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementStyle), (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementFarthestViewportElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGImageElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -83,16 +84,63 @@ static JSC_CONST_HASHTABLE HashTable JSSVGImageElementTable =
     { 68, 63, JSSVGImageElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGImageElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGImageElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGImageElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGImageElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGImageElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGImageElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGImageElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGImageElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGImageElementConstructor::s_info = { "SVGImageElementConstructor", 0, &JSSVGImageElementConstructorTable, 0 };
+
+bool JSSVGImageElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGImageElementConstructor, DOMObject>(exec, &JSSVGImageElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGImageElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGImageElementConstructor, DOMObject>(exec, &JSSVGImageElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGImageElementPrototypeTableValues[7] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGImageElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGImageElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGImageElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGImageElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGImageElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGImageElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGImageElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGImageElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGImageElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGImageElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGImageElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGImageElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -142,151 +190,173 @@ bool JSSVGImageElement::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSSVGImageElement, Base>(exec, &JSSVGImageElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGImageElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGImageElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGImageElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGImageElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementPreserveAspectRatio(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGImageElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGImageElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGImageElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGImageElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGImageElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGImageElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGImageElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGImageElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGImageElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGImageElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGImageElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGImageElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
+    JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
+JSValue jsSVGImageElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGImageElement* domObject = static_cast<JSSVGImageElement*>(asObject(slotBase));
+    return JSSVGImageElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGImageElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGImageElement, Base>(exec, propertyName, value, &JSSVGImageElementTable, this, slot);
@@ -294,16 +364,23 @@ void JSSVGImageElement::put(ExecState* exec, const Identifier& propertyName, JSV
 
 void setJSSVGImageElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(thisObject)->impl());
+    JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(thisObject);
+    SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGImageElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(thisObject)->impl());
+    JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(thisObject);
+    SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGImageElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGImageElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -341,7 +418,7 @@ JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetBBox(ExecState* exec,
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -354,7 +431,7 @@ JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetCTM(ExecState* exec,
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -367,7 +444,7 @@ JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetScreenCTM(ExecState*
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -382,7 +459,7 @@ JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetTransformToElement(Ex
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
index 97bc1e1868..2331f72674 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGImageElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,25 +79,26 @@ JSC::JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetScreenCTM(JSC::E
 JSC::JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGImageElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGImageElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGImageElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGImageElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGImageElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGImageElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGImageElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGImageElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGImageElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGImageElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGImageElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGImageElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGImageElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGImageElementPreserveAspectRatio(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGImageElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGImageElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGImageElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGImageElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGImageElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGImageElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGImageElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGImageElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGImageElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGImageElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGImageElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGImageElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGImageElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGImageElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGImageElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGImageElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGImageElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGImageElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGImageElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGImageElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
index 0bcf836878..86ae6daeff 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
@@ -41,11 +41,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGLength);
 
 static const HashTableValue JSSVGLengthTableValues[6] =
 {
-    { "unitType", DontDelete|ReadOnly, (intptr_t)jsSVGLengthUnitType, (intptr_t)0 },
-    { "value", DontDelete, (intptr_t)jsSVGLengthValue, (intptr_t)setJSSVGLengthValue },
-    { "valueInSpecifiedUnits", DontDelete, (intptr_t)jsSVGLengthValueInSpecifiedUnits, (intptr_t)setJSSVGLengthValueInSpecifiedUnits },
-    { "valueAsString", DontDelete, (intptr_t)jsSVGLengthValueAsString, (intptr_t)setJSSVGLengthValueAsString },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGLengthConstructor, (intptr_t)0 },
+    { "unitType", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthUnitType), (intptr_t)0 },
+    { "value", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthValue), (intptr_t)setJSSVGLengthValue },
+    { "valueInSpecifiedUnits", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthValueInSpecifiedUnits), (intptr_t)setJSSVGLengthValueInSpecifiedUnits },
+    { "valueAsString", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthValueAsString), (intptr_t)setJSSVGLengthValueAsString },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -60,17 +60,17 @@ static JSC_CONST_HASHTABLE HashTable JSSVGLengthTable =
 
 static const HashTableValue JSSVGLengthConstructorTableValues[12] =
 {
-    { "SVG_LENGTHTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_NUMBER", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_NUMBER, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_PERCENTAGE", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_EMS", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_EMS, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_EXS", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_EXS, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_PX", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_PX, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_CM", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_CM, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_MM", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_MM, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_IN", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_IN, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_PT", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_PT, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_PC", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_PC, (intptr_t)0 },
+    { "SVG_LENGTHTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_NUMBER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_NUMBER), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_PERCENTAGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_EMS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_EMS), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_EXS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_EXS), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_PX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_PX), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_CM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_CM), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_MM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_MM), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_IN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_IN), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_PT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_PT), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_PC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_PC), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -95,7 +95,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -118,19 +118,19 @@ bool JSSVGLengthConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ide
 
 static const HashTableValue JSSVGLengthPrototypeTableValues[14] =
 {
-    { "SVG_LENGTHTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_NUMBER", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_NUMBER, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_PERCENTAGE", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_EMS", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_EMS, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_EXS", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_EXS, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_PX", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_PX, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_CM", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_CM, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_MM", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_MM, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_IN", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_IN, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_PT", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_PT, (intptr_t)0 },
-    { "SVG_LENGTHTYPE_PC", DontDelete|ReadOnly, (intptr_t)jsSVGLengthSVG_LENGTHTYPE_PC, (intptr_t)0 },
-    { "newValueSpecifiedUnits", DontDelete|Function, (intptr_t)jsSVGLengthPrototypeFunctionNewValueSpecifiedUnits, (intptr_t)2 },
-    { "convertToSpecifiedUnits", DontDelete|Function, (intptr_t)jsSVGLengthPrototypeFunctionConvertToSpecifiedUnits, (intptr_t)1 },
+    { "SVG_LENGTHTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_NUMBER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_NUMBER), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_PERCENTAGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_EMS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_EMS), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_EXS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_EXS), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_PX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_PX), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_CM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_CM), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_MM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_MM), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_IN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_IN), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_PT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_PT), (intptr_t)0 },
+    { "SVG_LENGTHTYPE_PC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthSVG_LENGTHTYPE_PC), (intptr_t)0 },
+    { "newValueSpecifiedUnits", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGLengthPrototypeFunctionNewValueSpecifiedUnits), (intptr_t)2 },
+    { "convertToSpecifiedUnits", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGLengthPrototypeFunctionConvertToSpecifiedUnits), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -160,16 +160,16 @@ bool JSSVGLengthPrototype::getOwnPropertyDescriptor(ExecState* exec, const Ident
 
 const ClassInfo JSSVGLength::s_info = { "SVGLength", 0, &JSSVGLengthTable, 0 };
 
-JSSVGLength::JSSVGLength(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<SVGLength> > impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGLength::JSSVGLength(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<SVGLength> > impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
 
 JSSVGLength::~JSSVGLength()
 {
-    JSSVGDynamicPODTypeWrapperCache<SVGLength, SVGAnimatedLength>::forgetWrapper(m_impl.get());
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGLength::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -187,40 +187,43 @@ bool JSSVGLength::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
     return getStaticValueDescriptor<JSSVGLength, Base>(exec, &JSSVGLengthTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGLengthUnitType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthUnitType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLength* castedThis = static_cast<JSSVGLength*>(asObject(slot.slotBase()));
+    JSSVGLength* castedThis = static_cast<JSSVGLength*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLength imp(*castedThis->impl());
-    return jsNumber(exec, imp.unitType());
+    JSValue result =  jsNumber(exec, imp.unitType());
+    return result;
 }
 
-JSValue jsSVGLengthValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLength* castedThis = static_cast<JSSVGLength*>(asObject(slot.slotBase()));
+    JSSVGLength* castedThis = static_cast<JSSVGLength*>(asObject(slotBase));
     return castedThis->value(exec);
 }
 
-JSValue jsSVGLengthValueInSpecifiedUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthValueInSpecifiedUnits(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLength* castedThis = static_cast<JSSVGLength*>(asObject(slot.slotBase()));
+    JSSVGLength* castedThis = static_cast<JSSVGLength*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLength imp(*castedThis->impl());
-    return jsNumber(exec, imp.valueInSpecifiedUnits());
+    JSValue result =  jsNumber(exec, imp.valueInSpecifiedUnits());
+    return result;
 }
 
-JSValue jsSVGLengthValueAsString(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthValueAsString(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLength* castedThis = static_cast<JSSVGLength*>(asObject(slot.slotBase()));
+    JSSVGLength* castedThis = static_cast<JSSVGLength*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLength imp(*castedThis->impl());
-    return jsString(exec, imp.valueAsString());
+    JSValue result =  jsString(exec, imp.valueAsString());
+    return result;
 }
 
-JSValue jsSVGLengthConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    UNUSED_PARAM(slot);
-    return JSSVGLength::getConstructor(exec, deprecatedGlobalObjectForPrototype(exec));
+    JSSVGLength* domObject = static_cast<JSSVGLength*>(asObject(slotBase));
+    return JSSVGLength::getConstructor(exec, domObject->globalObject());
 }
 void JSSVGLength::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
@@ -229,23 +232,29 @@ void JSSVGLength::put(ExecState* exec, const Identifier& propertyName, JSValue v
 
 void setJSSVGLengthValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGLength imp(*static_cast<JSSVGLength*>(thisObject)->impl());
-    imp.setValue(value.toFloat(exec));
-        static_cast<JSSVGLength*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGLength*>(thisObject)->context());
+    JSSVGLength* castedThisObj = static_cast<JSSVGLength*>(thisObject);
+    JSSVGPODTypeWrapper<SVGLength> * imp = static_cast<JSSVGPODTypeWrapper<SVGLength> *>(castedThisObj->impl());
+    SVGLength podImp(*imp);
+    podImp.setValue(value.toFloat(exec));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 void setJSSVGLengthValueInSpecifiedUnits(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGLength imp(*static_cast<JSSVGLength*>(thisObject)->impl());
-    imp.setValueInSpecifiedUnits(value.toFloat(exec));
-        static_cast<JSSVGLength*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGLength*>(thisObject)->context());
+    JSSVGLength* castedThisObj = static_cast<JSSVGLength*>(thisObject);
+    JSSVGPODTypeWrapper<SVGLength> * imp = static_cast<JSSVGPODTypeWrapper<SVGLength> *>(castedThisObj->impl());
+    SVGLength podImp(*imp);
+    podImp.setValueInSpecifiedUnits(value.toFloat(exec));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 void setJSSVGLengthValueAsString(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGLength imp(*static_cast<JSSVGLength*>(thisObject)->impl());
-    imp.setValueAsString(valueToStringWithNullCheck(exec, value));
-        static_cast<JSSVGLength*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGLength*>(thisObject)->context());
+    JSSVGLength* castedThisObj = static_cast<JSSVGLength*>(thisObject);
+    JSSVGPODTypeWrapper<SVGLength> * imp = static_cast<JSSVGPODTypeWrapper<SVGLength> *>(castedThisObj->impl());
+    SVGLength podImp(*imp);
+    podImp.setValueAsString(valueToStringWithNullCheck(exec, value));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 JSValue JSSVGLength::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -259,13 +268,13 @@ JSValue JSC_HOST_CALL jsSVGLengthPrototypeFunctionNewValueSpecifiedUnits(ExecSta
     if (!thisValue.inherits(&JSSVGLength::s_info))
         return throwError(exec, TypeError);
     JSSVGLength* castedThisObj = static_cast<JSSVGLength*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<SVGLength>* wrapper = castedThisObj->impl();
-    SVGLength imp(*wrapper);
+    JSSVGPODTypeWrapper<SVGLength> * imp = static_cast<JSSVGPODTypeWrapper<SVGLength> *>(castedThisObj->impl());
+    SVGLength podImp(*imp);
     unsigned short unitType = args.at(0).toInt32(exec);
     float valueInSpecifiedUnits = args.at(1).toFloat(exec);
 
-    imp.newValueSpecifiedUnits(unitType, valueInSpecifiedUnits);
-    wrapper->commitChange(imp, castedThisObj->context());
+    podImp.newValueSpecifiedUnits(unitType, valueInSpecifiedUnits);
+    imp->commitChange(podImp, castedThisObj);
     return jsUndefined();
 }
 
@@ -280,57 +289,57 @@ JSValue JSC_HOST_CALL jsSVGLengthPrototypeFunctionConvertToSpecifiedUnits(ExecSt
 
 // Constant getters
 
-JSValue jsSVGLengthSVG_LENGTHTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGLengthSVG_LENGTHTYPE_NUMBER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_NUMBER(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGLengthSVG_LENGTHTYPE_EMS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_EMS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsSVGLengthSVG_LENGTHTYPE_EXS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_EXS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsSVGLengthSVG_LENGTHTYPE_PX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_PX(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValue jsSVGLengthSVG_LENGTHTYPE_CM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_CM(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValue jsSVGLengthSVG_LENGTHTYPE_MM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_MM(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValue jsSVGLengthSVG_LENGTHTYPE_IN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_IN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValue jsSVGLengthSVG_LENGTHTYPE_PT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_PT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValue jsSVGLengthSVG_LENGTHTYPE_PC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_PC(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
index e6c66f435b..cfc1263c4e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "JSSVGPODTypeWrapper.h"
 #include "SVGElement.h"
@@ -33,10 +32,10 @@
 
 namespace WebCore {
 
-class JSSVGLength : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGLength : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGLength(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<JSSVGPODTypeWrapper<SVGLength> >, SVGElement* context);
+    JSSVGLength(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<JSSVGPODTypeWrapper<SVGLength> >);
     virtual ~JSSVGLength();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -47,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -65,7 +64,7 @@ protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<SVGLength>*, SVGElement* context);
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<SVGLength>*, SVGElement*);
 SVGLength toSVGLength(JSC::JSValue);
 
 class JSSVGLengthPrototype : public JSC::JSObject {
@@ -78,7 +77,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGLengthPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -91,27 +90,27 @@ JSC::JSValue JSC_HOST_CALL jsSVGLengthPrototypeFunctionNewValueSpecifiedUnits(JS
 JSC::JSValue JSC_HOST_CALL jsSVGLengthPrototypeFunctionConvertToSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGLengthUnitType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLengthValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthUnitType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLengthValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGLengthValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGLengthValueInSpecifiedUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthValueInSpecifiedUnits(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGLengthValueInSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGLengthValueAsString(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthValueAsString(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGLengthValueAsString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGLengthConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_NUMBER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_EMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_EXS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_CM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_MM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_NUMBER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_EMS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_EXS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_CM(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_MM(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_IN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PC(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp
index a984bd19ba..d3c77ccc21 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp
@@ -25,6 +25,7 @@
 #include "JSSVGLengthList.h"
 
 #include "JSSVGLength.h"
+#include "JSSVGPODListCustom.h"
 #include "SVGLength.h"
 #include "SVGLengthList.h"
 #include <runtime/Error.h>
@@ -39,30 +40,78 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGLengthList);
 
 /* Hash table */
 
-static const HashTableValue JSSVGLengthListTableValues[2] =
+static const HashTableValue JSSVGLengthListTableValues[3] =
 {
-    { "numberOfItems", DontDelete|ReadOnly, (intptr_t)jsSVGLengthListNumberOfItems, (intptr_t)0 },
+    { "numberOfItems", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthListNumberOfItems), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLengthListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGLengthListTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGLengthListTableValues, 0 };
+    { 3, JSSVGLengthListTableValues, 0 };
 #else
-    { 2, 1, JSSVGLengthListTableValues, 0 };
+    { 4, 3, JSSVGLengthListTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGLengthListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGLengthListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGLengthListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGLengthListConstructorTableValues, 0 };
+#endif
+
+class JSSVGLengthListConstructor : public DOMConstructorObject {
+public:
+    JSSVGLengthListConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGLengthListConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGLengthListPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGLengthListConstructor::s_info = { "SVGLengthListConstructor", 0, &JSSVGLengthListConstructorTable, 0 };
+
+bool JSSVGLengthListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGLengthListConstructor, DOMObject>(exec, &JSSVGLengthListConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGLengthListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGLengthListConstructor, DOMObject>(exec, &JSSVGLengthListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGLengthListPrototypeTableValues[8] =
 {
-    { "clear", DontDelete|Function, (intptr_t)jsSVGLengthListPrototypeFunctionClear, (intptr_t)0 },
-    { "initialize", DontDelete|Function, (intptr_t)jsSVGLengthListPrototypeFunctionInitialize, (intptr_t)1 },
-    { "getItem", DontDelete|Function, (intptr_t)jsSVGLengthListPrototypeFunctionGetItem, (intptr_t)1 },
-    { "insertItemBefore", DontDelete|Function, (intptr_t)jsSVGLengthListPrototypeFunctionInsertItemBefore, (intptr_t)2 },
-    { "replaceItem", DontDelete|Function, (intptr_t)jsSVGLengthListPrototypeFunctionReplaceItem, (intptr_t)2 },
-    { "removeItem", DontDelete|Function, (intptr_t)jsSVGLengthListPrototypeFunctionRemoveItem, (intptr_t)1 },
-    { "appendItem", DontDelete|Function, (intptr_t)jsSVGLengthListPrototypeFunctionAppendItem, (intptr_t)1 },
+    { "clear", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGLengthListPrototypeFunctionClear), (intptr_t)0 },
+    { "initialize", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGLengthListPrototypeFunctionInitialize), (intptr_t)1 },
+    { "getItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGLengthListPrototypeFunctionGetItem), (intptr_t)1 },
+    { "insertItemBefore", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGLengthListPrototypeFunctionInsertItemBefore), (intptr_t)2 },
+    { "replaceItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGLengthListPrototypeFunctionReplaceItem), (intptr_t)2 },
+    { "removeItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGLengthListPrototypeFunctionRemoveItem), (intptr_t)1 },
+    { "appendItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGLengthListPrototypeFunctionAppendItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -92,8 +141,8 @@ bool JSSVGLengthListPrototype::getOwnPropertyDescriptor(ExecState* exec, const I
 
 const ClassInfo JSSVGLengthList::s_info = { "SVGLengthList", 0, &JSSVGLengthListTable, 0 };
 
-JSSVGLengthList::JSSVGLengthList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGLengthList> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGLengthList::JSSVGLengthList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGLengthList> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -101,6 +150,7 @@ JSSVGLengthList::JSSVGLengthList(NonNullPassRefPtr<Structure> structure, JSDOMGl
 JSSVGLengthList::~JSSVGLengthList()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGLengthList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -118,12 +168,23 @@ bool JSSVGLengthList::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSSVGLengthList, Base>(exec, &JSSVGLengthListTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGLengthListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthListNumberOfItems(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLengthList* castedThis = static_cast<JSSVGLengthList*>(asObject(slot.slotBase()));
+    JSSVGLengthList* castedThis = static_cast<JSSVGLengthList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThis->impl());
-    return jsNumber(exec, imp->numberOfItems());
+    JSValue result = jsNumber(exec, imp->numberOfItems());
+    return result;
+}
+
+JSValue jsSVGLengthListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGLengthList* domObject = static_cast<JSSVGLengthList*>(asObject(slotBase));
+    return JSSVGLengthList::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGLengthList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGLengthListConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -132,12 +193,7 @@ JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionClear(ExecState* exec, JSO
     if (!thisValue.inherits(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
-    SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-
-    imp->clear(ec);
-    setDOMException(exec, ec);
-    return jsUndefined();
+    return JSSVGPODListCustom::clear<JSSVGLengthList, SVGLength>(castedThisObj, exec, args, toSVGLength);
 }
 
 JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -146,14 +202,7 @@ JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInitialize(ExecState* exec
     if (!thisValue.inherits(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
-    SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    SVGLength item = toSVGLength(args.at(0));
-
-
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->initialize(item, ec)).get(), castedThisObj->context());
-    setDOMException(exec, ec);
-    return result;
+    return JSSVGPODListCustom::initialize<JSSVGLengthList, SVGLength>(castedThisObj, exec, args, toSVGLength);
 }
 
 JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -162,14 +211,7 @@ JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionGetItem(ExecState* exec, J
     if (!thisValue.inherits(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
-    SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    unsigned index = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->getItem(index, ec)).get(), castedThisObj->context());
-    setDOMException(exec, ec);
-    return result;
+    return JSSVGPODListCustom::getItem<JSSVGLengthList, SVGLength>(castedThisObj, exec, args, toSVGLength);
 }
 
 JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -178,15 +220,7 @@ JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInsertItemBefore(ExecState
     if (!thisValue.inherits(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
-    SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    SVGLength item = toSVGLength(args.at(0));
-    unsigned index = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->insertItemBefore(item, index, ec)).get(), castedThisObj->context());
-    setDOMException(exec, ec);
-    return result;
+    return JSSVGPODListCustom::insertItemBefore<JSSVGLengthList, SVGLength>(castedThisObj, exec, args, toSVGLength);
 }
 
 JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -195,15 +229,7 @@ JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionReplaceItem(ExecState* exe
     if (!thisValue.inherits(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
-    SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    SVGLength item = toSVGLength(args.at(0));
-    unsigned index = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->replaceItem(item, index, ec)).get(), castedThisObj->context());
-    setDOMException(exec, ec);
-    return result;
+    return JSSVGPODListCustom::replaceItem<JSSVGLengthList, SVGLength>(castedThisObj, exec, args, toSVGLength);
 }
 
 JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -212,14 +238,7 @@ JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionRemoveItem(ExecState* exec
     if (!thisValue.inherits(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
-    SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    unsigned index = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->removeItem(index, ec)).get(), castedThisObj->context());
-    setDOMException(exec, ec);
-    return result;
+    return JSSVGPODListCustom::removeItem<JSSVGLengthList, SVGLength>(castedThisObj, exec, args, toSVGLength);
 }
 
 JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -228,14 +247,7 @@ JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionAppendItem(ExecState* exec
     if (!thisValue.inherits(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
-    SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    SVGLength item = toSVGLength(args.at(0));
-
-
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->appendItem(item, ec)).get(), castedThisObj->context());
-    setDOMException(exec, ec);
-    return result;
+    return JSSVGPODListCustom::appendItem<JSSVGLengthList, SVGLength>(castedThisObj, exec, args, toSVGLength);
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGLengthList* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
index bd9adda011..edfb98348b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -33,10 +32,10 @@ namespace WebCore {
 
 class SVGLengthList;
 
-class JSSVGLengthList : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGLengthList : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGLengthList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGLengthList>, SVGElement* context);
+    JSSVGLengthList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGLengthList>);
     virtual ~JSSVGLengthList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -46,9 +45,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGLengthList* impl() const { return m_impl.get(); }
 
 private:
@@ -70,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGLengthListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -88,7 +88,8 @@ JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionRemoveItem(JSC::ExecS
 JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGLengthListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthListNumberOfItems(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLengthListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp
index ff05324429..db068b92d9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp
@@ -53,23 +53,24 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGLineElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGLineElementTableValues[16] =
-{
-    { "x1", DontDelete|ReadOnly, (intptr_t)jsSVGLineElementX1, (intptr_t)0 },
-    { "y1", DontDelete|ReadOnly, (intptr_t)jsSVGLineElementY1, (intptr_t)0 },
-    { "x2", DontDelete|ReadOnly, (intptr_t)jsSVGLineElementX2, (intptr_t)0 },
-    { "y2", DontDelete|ReadOnly, (intptr_t)jsSVGLineElementY2, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGLineElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGLineElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGLineElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGLineElementXmllang, (intptr_t)setJSSVGLineElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGLineElementXmlspace, (intptr_t)setJSSVGLineElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGLineElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGLineElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGLineElementStyle, (intptr_t)0 },
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGLineElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGLineElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGLineElementFarthestViewportElement, (intptr_t)0 },
+static const HashTableValue JSSVGLineElementTableValues[17] =
+{
+    { "x1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementX1), (intptr_t)0 },
+    { "y1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementY1), (intptr_t)0 },
+    { "x2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementX2), (intptr_t)0 },
+    { "y2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementY2), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementXmllang), (intptr_t)setJSSVGLineElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementXmlspace), (intptr_t)setJSSVGLineElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementStyle), (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementFarthestViewportElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLineElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,19 +78,66 @@ static JSC_CONST_HASHTABLE HashTable JSSVGLineElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 1023, JSSVGLineElementTableValues, 0 };
 #else
-    { 35, 31, JSSVGLineElementTableValues, 0 };
+    { 36, 31, JSSVGLineElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGLineElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGLineElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGLineElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGLineElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGLineElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGLineElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGLineElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGLineElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGLineElementConstructor::s_info = { "SVGLineElementConstructor", 0, &JSSVGLineElementConstructorTable, 0 };
+
+bool JSSVGLineElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGLineElementConstructor, DOMObject>(exec, &JSSVGLineElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGLineElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGLineElementConstructor, DOMObject>(exec, &JSSVGLineElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGLineElementPrototypeTableValues[7] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGLineElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGLineElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGLineElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGLineElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGLineElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGLineElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGLineElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGLineElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGLineElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGLineElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGLineElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGLineElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -139,133 +187,153 @@ bool JSSVGLineElement::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSSVGLineElement, Base>(exec, &JSSVGLineElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGLineElementX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementX1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
+    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->x1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGLineElementY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementY1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
+    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->y1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGLineElementX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementX2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
+    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->x2Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGLineElementY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementY2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
+    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->y2Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGLineElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
+    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGLineElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
+    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGLineElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
+    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGLineElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
+    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGLineElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
+    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGLineElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
+    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGLineElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
+    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGLineElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
+    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGLineElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
+    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGLineElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
+    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGLineElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
+    JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
+JSValue jsSVGLineElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGLineElement* domObject = static_cast<JSSVGLineElement*>(asObject(slotBase));
+    return JSSVGLineElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGLineElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGLineElement, Base>(exec, propertyName, value, &JSSVGLineElementTable, this, slot);
@@ -273,16 +341,23 @@ void JSSVGLineElement::put(ExecState* exec, const Identifier& propertyName, JSVa
 
 void setJSSVGLineElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(thisObject)->impl());
+    JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(thisObject);
+    SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGLineElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(thisObject)->impl());
+    JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(thisObject);
+    SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGLineElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGLineElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -320,7 +395,7 @@ JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetBBox(ExecState* exec,
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -333,7 +408,7 @@ JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetCTM(ExecState* exec, J
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -346,7 +421,7 @@ JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetScreenCTM(ExecState* e
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -361,7 +436,7 @@ JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetTransformToElement(Exe
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
index 1089b3797b..f4e0152acc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGLineElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,23 +79,24 @@ JSC::JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetScreenCTM(JSC::Ex
 JSC::JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGLineElementX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLineElementY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLineElementX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLineElementY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLineElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLineElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLineElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLineElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementX1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLineElementY1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLineElementX2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLineElementY2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLineElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLineElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLineElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLineElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGLineElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGLineElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGLineElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGLineElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLineElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLineElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLineElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLineElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLineElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLineElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLineElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLineElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLineElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLineElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLineElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp
index 7246a8eeb0..c269b7bdcd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp
@@ -36,12 +36,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGLinearGradientElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGLinearGradientElementTableValues[5] =
+static const HashTableValue JSSVGLinearGradientElementTableValues[6] =
 {
-    { "x1", DontDelete|ReadOnly, (intptr_t)jsSVGLinearGradientElementX1, (intptr_t)0 },
-    { "y1", DontDelete|ReadOnly, (intptr_t)jsSVGLinearGradientElementY1, (intptr_t)0 },
-    { "x2", DontDelete|ReadOnly, (intptr_t)jsSVGLinearGradientElementX2, (intptr_t)0 },
-    { "y2", DontDelete|ReadOnly, (intptr_t)jsSVGLinearGradientElementY2, (intptr_t)0 },
+    { "x1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLinearGradientElementX1), (intptr_t)0 },
+    { "y1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLinearGradientElementY1), (intptr_t)0 },
+    { "x2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLinearGradientElementX2), (intptr_t)0 },
+    { "y2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLinearGradientElementY2), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGLinearGradientElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -49,9 +50,56 @@ static JSC_CONST_HASHTABLE HashTable JSSVGLinearGradientElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 7, JSSVGLinearGradientElementTableValues, 0 };
 #else
-    { 8, 7, JSSVGLinearGradientElementTableValues, 0 };
+    { 16, 15, JSSVGLinearGradientElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGLinearGradientElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGLinearGradientElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGLinearGradientElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGLinearGradientElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGLinearGradientElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGLinearGradientElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGLinearGradientElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGLinearGradientElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGLinearGradientElementConstructor::s_info = { "SVGLinearGradientElementConstructor", 0, &JSSVGLinearGradientElementConstructorTable, 0 };
+
+bool JSSVGLinearGradientElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGLinearGradientElementConstructor, DOMObject>(exec, &JSSVGLinearGradientElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGLinearGradientElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGLinearGradientElementConstructor, DOMObject>(exec, &JSSVGLinearGradientElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGLinearGradientElementPrototypeTableValues[1] =
@@ -95,40 +143,54 @@ bool JSSVGLinearGradientElement::getOwnPropertyDescriptor(ExecState* exec, const
     return getStaticValueDescriptor<JSSVGLinearGradientElement, Base>(exec, &JSSVGLinearGradientElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGLinearGradientElementX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLinearGradientElementX1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLinearGradientElement* castedThis = static_cast<JSSVGLinearGradientElement*>(asObject(slot.slotBase()));
+    JSSVGLinearGradientElement* castedThis = static_cast<JSSVGLinearGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLinearGradientElement* imp = static_cast<SVGLinearGradientElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->x1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGLinearGradientElementY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLinearGradientElementY1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLinearGradientElement* castedThis = static_cast<JSSVGLinearGradientElement*>(asObject(slot.slotBase()));
+    JSSVGLinearGradientElement* castedThis = static_cast<JSSVGLinearGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLinearGradientElement* imp = static_cast<SVGLinearGradientElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->y1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGLinearGradientElementX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLinearGradientElementX2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLinearGradientElement* castedThis = static_cast<JSSVGLinearGradientElement*>(asObject(slot.slotBase()));
+    JSSVGLinearGradientElement* castedThis = static_cast<JSSVGLinearGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLinearGradientElement* imp = static_cast<SVGLinearGradientElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->x2Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGLinearGradientElementY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLinearGradientElementY2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGLinearGradientElement* castedThis = static_cast<JSSVGLinearGradientElement*>(asObject(slot.slotBase()));
+    JSSVGLinearGradientElement* castedThis = static_cast<JSSVGLinearGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGLinearGradientElement* imp = static_cast<SVGLinearGradientElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->y2Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
+}
+
+JSValue jsSVGLinearGradientElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGLinearGradientElement* domObject = static_cast<JSSVGLinearGradientElement*>(asObject(slotBase));
+    return JSSVGLinearGradientElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGLinearGradientElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGLinearGradientElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
index ea2f85d6c3..c5cdd0cb5e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -58,7 +59,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGLinearGradientElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -67,10 +68,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGLinearGradientElementX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLinearGradientElementY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLinearGradientElementX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGLinearGradientElementY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLinearGradientElementX1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLinearGradientElementY1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLinearGradientElementX2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLinearGradientElementY2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGLinearGradientElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
index add8265ae6..cff88a12c4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
@@ -53,21 +53,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGMarkerElement);
 
 static const HashTableValue JSSVGMarkerElementTableValues[16] =
 {
-    { "refX", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementRefX, (intptr_t)0 },
-    { "refY", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementRefY, (intptr_t)0 },
-    { "markerUnits", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementMarkerUnits, (intptr_t)0 },
-    { "markerWidth", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementMarkerWidth, (intptr_t)0 },
-    { "markerHeight", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementMarkerHeight, (intptr_t)0 },
-    { "orientType", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementOrientType, (intptr_t)0 },
-    { "orientAngle", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementOrientAngle, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGMarkerElementXmllang, (intptr_t)setJSSVGMarkerElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGMarkerElementXmlspace, (intptr_t)setJSSVGMarkerElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementStyle, (intptr_t)0 },
-    { "viewBox", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementViewBox, (intptr_t)0 },
-    { "preserveAspectRatio", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementPreserveAspectRatio, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGMarkerElementConstructor, (intptr_t)0 },
+    { "refX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementRefX), (intptr_t)0 },
+    { "refY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementRefY), (intptr_t)0 },
+    { "markerUnits", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementMarkerUnits), (intptr_t)0 },
+    { "markerWidth", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementMarkerWidth), (intptr_t)0 },
+    { "markerHeight", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementMarkerHeight), (intptr_t)0 },
+    { "orientType", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementOrientType), (intptr_t)0 },
+    { "orientAngle", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementOrientAngle), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementXmllang), (intptr_t)setJSSVGMarkerElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementXmlspace), (intptr_t)setJSSVGMarkerElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementStyle), (intptr_t)0 },
+    { "viewBox", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementViewBox), (intptr_t)0 },
+    { "preserveAspectRatio", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementPreserveAspectRatio), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -82,12 +82,12 @@ static JSC_CONST_HASHTABLE HashTable JSSVGMarkerElementTable =
 
 static const HashTableValue JSSVGMarkerElementConstructorTableValues[7] =
 {
-    { "SVG_MARKERUNITS_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN, (intptr_t)0 },
-    { "SVG_MARKERUNITS_USERSPACEONUSE", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE, (intptr_t)0 },
-    { "SVG_MARKERUNITS_STROKEWIDTH", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH, (intptr_t)0 },
-    { "SVG_MARKER_ORIENT_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN, (intptr_t)0 },
-    { "SVG_MARKER_ORIENT_AUTO", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO, (intptr_t)0 },
-    { "SVG_MARKER_ORIENT_ANGLE", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE, (intptr_t)0 },
+    { "SVG_MARKERUNITS_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN), (intptr_t)0 },
+    { "SVG_MARKERUNITS_USERSPACEONUSE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE), (intptr_t)0 },
+    { "SVG_MARKERUNITS_STROKEWIDTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH), (intptr_t)0 },
+    { "SVG_MARKER_ORIENT_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN), (intptr_t)0 },
+    { "SVG_MARKER_ORIENT_AUTO", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO), (intptr_t)0 },
+    { "SVG_MARKER_ORIENT_ANGLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -112,7 +112,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -135,15 +135,15 @@ bool JSSVGMarkerElementConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 static const HashTableValue JSSVGMarkerElementPrototypeTableValues[10] =
 {
-    { "SVG_MARKERUNITS_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN, (intptr_t)0 },
-    { "SVG_MARKERUNITS_USERSPACEONUSE", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE, (intptr_t)0 },
-    { "SVG_MARKERUNITS_STROKEWIDTH", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH, (intptr_t)0 },
-    { "SVG_MARKER_ORIENT_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN, (intptr_t)0 },
-    { "SVG_MARKER_ORIENT_AUTO", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO, (intptr_t)0 },
-    { "SVG_MARKER_ORIENT_ANGLE", DontDelete|ReadOnly, (intptr_t)jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE, (intptr_t)0 },
-    { "setOrientToAuto", DontDelete|Function, (intptr_t)jsSVGMarkerElementPrototypeFunctionSetOrientToAuto, (intptr_t)0 },
-    { "setOrientToAngle", DontDelete|Function, (intptr_t)jsSVGMarkerElementPrototypeFunctionSetOrientToAngle, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGMarkerElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "SVG_MARKERUNITS_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN), (intptr_t)0 },
+    { "SVG_MARKERUNITS_USERSPACEONUSE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE), (intptr_t)0 },
+    { "SVG_MARKERUNITS_STROKEWIDTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH), (intptr_t)0 },
+    { "SVG_MARKER_ORIENT_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN), (intptr_t)0 },
+    { "SVG_MARKER_ORIENT_AUTO", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO), (intptr_t)0 },
+    { "SVG_MARKER_ORIENT_ANGLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE), (intptr_t)0 },
+    { "setOrientToAuto", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMarkerElementPrototypeFunctionSetOrientToAuto), (intptr_t)0 },
+    { "setOrientToAngle", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMarkerElementPrototypeFunctionSetOrientToAngle), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMarkerElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -193,132 +193,146 @@ bool JSSVGMarkerElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSSVGMarkerElement, Base>(exec, &JSSVGMarkerElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGMarkerElementRefX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementRefX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
+    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->refXAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMarkerElementRefY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementRefY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
+    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->refYAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMarkerElementMarkerUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementMarkerUnits(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
+    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->markerUnitsAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMarkerElementMarkerWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementMarkerWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
+    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->markerWidthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMarkerElementMarkerHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementMarkerHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
+    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->markerHeightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMarkerElementOrientType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementOrientType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
+    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->orientTypeAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMarkerElementOrientAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementOrientAngle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
+    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThis->impl());
     RefPtr<SVGAnimatedAngle> obj = imp->orientAngleAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMarkerElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
+    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGMarkerElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
+    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGMarkerElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
+    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMarkerElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
+    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMarkerElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
+    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGMarkerElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementViewBox(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
+    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThis->impl());
     RefPtr<SVGAnimatedRect> obj = imp->viewBoxAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMarkerElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementPreserveAspectRatio(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
+    JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThis->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMarkerElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMarkerElement* domObject = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
+    JSSVGMarkerElement* domObject = static_cast<JSSVGMarkerElement*>(asObject(slotBase));
     return JSSVGMarkerElement::getConstructor(exec, domObject->globalObject());
 }
 void JSSVGMarkerElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -328,13 +342,15 @@ void JSSVGMarkerElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSSVGMarkerElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(thisObject)->impl());
+    JSSVGMarkerElement* castedThisObj = static_cast<JSSVGMarkerElement*>(thisObject);
+    SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGMarkerElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(thisObject)->impl());
+    JSSVGMarkerElement* castedThisObj = static_cast<JSSVGMarkerElement*>(thisObject);
+    SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
@@ -362,7 +378,7 @@ JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionSetOrientToAngle(ExecSt
         return throwError(exec, TypeError);
     JSSVGMarkerElement* castedThisObj = static_cast<JSSVGMarkerElement*>(asObject(thisValue));
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThisObj->impl());
-    SVGAngle* angle = toSVGAngle(args.at(0));
+    SVGAngle angle = toSVGAngle(args.at(0));
 
     imp->setOrientToAngle(angle);
     return jsUndefined();
@@ -384,32 +400,32 @@ JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionGetPresentationAttribut
 
 // Constant getters
 
-JSValue jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
index ca04951987..7b2527143e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -62,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGMarkerElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -76,31 +76,31 @@ JSC::JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionSetOrientToAngle(J
 JSC::JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGMarkerElementRefX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementRefY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementMarkerUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementMarkerWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementMarkerHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementOrientType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementOrientAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementRefX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementRefY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementMarkerUnits(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementMarkerWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementMarkerHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementOrientType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementOrientAngle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGMarkerElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGMarkerElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGMarkerElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGMarkerElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementViewBox(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementPreserveAspectRatio(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp
index 54c0a68cc8..da25c3a104 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp
@@ -49,22 +49,23 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGMaskElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGMaskElementTableValues[15] =
-{
-    { "maskUnits", DontDelete|ReadOnly, (intptr_t)jsSVGMaskElementMaskUnits, (intptr_t)0 },
-    { "maskContentUnits", DontDelete|ReadOnly, (intptr_t)jsSVGMaskElementMaskContentUnits, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGMaskElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGMaskElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGMaskElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGMaskElementHeight, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGMaskElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGMaskElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGMaskElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGMaskElementXmllang, (intptr_t)setJSSVGMaskElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGMaskElementXmlspace, (intptr_t)setJSSVGMaskElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGMaskElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGMaskElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGMaskElementStyle, (intptr_t)0 },
+static const HashTableValue JSSVGMaskElementTableValues[16] =
+{
+    { "maskUnits", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMaskElementMaskUnits), (intptr_t)0 },
+    { "maskContentUnits", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMaskElementMaskContentUnits), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMaskElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMaskElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMaskElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMaskElementHeight), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMaskElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMaskElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMaskElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMaskElementXmllang), (intptr_t)setJSSVGMaskElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMaskElementXmlspace), (intptr_t)setJSSVGMaskElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMaskElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMaskElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMaskElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMaskElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -72,15 +73,62 @@ static JSC_CONST_HASHTABLE HashTable JSSVGMaskElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 255, JSSVGMaskElementTableValues, 0 };
 #else
-    { 36, 31, JSSVGMaskElementTableValues, 0 };
+    { 37, 31, JSSVGMaskElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGMaskElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGMaskElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGMaskElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGMaskElementConstructorTableValues, 0 };
 #endif
 
+class JSSVGMaskElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGMaskElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGMaskElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGMaskElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGMaskElementConstructor::s_info = { "SVGMaskElementConstructor", 0, &JSSVGMaskElementConstructorTable, 0 };
+
+bool JSSVGMaskElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGMaskElementConstructor, DOMObject>(exec, &JSSVGMaskElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGMaskElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGMaskElementConstructor, DOMObject>(exec, &JSSVGMaskElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGMaskElementPrototypeTableValues[3] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGMaskElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGMaskElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMaskElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMaskElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -130,126 +178,145 @@ bool JSSVGMaskElement::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSSVGMaskElement, Base>(exec, &JSSVGMaskElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGMaskElementMaskUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementMaskUnits(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()));
+    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->maskUnitsAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMaskElementMaskContentUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementMaskContentUnits(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()));
+    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->maskContentUnitsAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMaskElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()));
+    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMaskElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()));
+    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMaskElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()));
+    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMaskElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()));
+    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMaskElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()));
+    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGMaskElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()));
+    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGMaskElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()));
+    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGMaskElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()));
+    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGMaskElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()));
+    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGMaskElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()));
+    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMaskElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()));
+    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGMaskElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()));
+    JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
+JSValue jsSVGMaskElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGMaskElement* domObject = static_cast<JSSVGMaskElement*>(asObject(slotBase));
+    return JSSVGMaskElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGMaskElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGMaskElement, Base>(exec, propertyName, value, &JSSVGMaskElementTable, this, slot);
@@ -257,16 +324,23 @@ void JSSVGMaskElement::put(ExecState* exec, const Identifier& propertyName, JSVa
 
 void setJSSVGMaskElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(thisObject)->impl());
+    JSSVGMaskElement* castedThisObj = static_cast<JSSVGMaskElement*>(thisObject);
+    SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGMaskElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(thisObject)->impl());
+    JSSVGMaskElement* castedThisObj = static_cast<JSSVGMaskElement*>(thisObject);
+    SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGMaskElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGMaskElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGMaskElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
index 042ba89f5f..1ca880c955 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGMaskElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -74,22 +75,23 @@ JSC::JSValue JSC_HOST_CALL jsSVGMaskElementPrototypeFunctionHasExtension(JSC::Ex
 JSC::JSValue JSC_HOST_CALL jsSVGMaskElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGMaskElementMaskUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMaskElementMaskContentUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMaskElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMaskElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMaskElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMaskElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMaskElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMaskElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMaskElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMaskElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementMaskUnits(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMaskElementMaskContentUnits(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMaskElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMaskElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMaskElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMaskElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMaskElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMaskElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMaskElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMaskElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGMaskElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGMaskElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGMaskElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGMaskElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMaskElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGMaskElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMaskElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMaskElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGMaskElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp
index d46ce6f745..5fe82ad478 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp
@@ -37,39 +37,87 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGMatrix);
 
 /* Hash table */
 
-static const HashTableValue JSSVGMatrixTableValues[7] =
-{
-    { "a", DontDelete, (intptr_t)jsSVGMatrixA, (intptr_t)setJSSVGMatrixA },
-    { "b", DontDelete, (intptr_t)jsSVGMatrixB, (intptr_t)setJSSVGMatrixB },
-    { "c", DontDelete, (intptr_t)jsSVGMatrixC, (intptr_t)setJSSVGMatrixC },
-    { "d", DontDelete, (intptr_t)jsSVGMatrixD, (intptr_t)setJSSVGMatrixD },
-    { "e", DontDelete, (intptr_t)jsSVGMatrixE, (intptr_t)setJSSVGMatrixE },
-    { "f", DontDelete, (intptr_t)jsSVGMatrixF, (intptr_t)setJSSVGMatrixF },
+static const HashTableValue JSSVGMatrixTableValues[8] =
+{
+    { "a", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMatrixA), (intptr_t)setJSSVGMatrixA },
+    { "b", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMatrixB), (intptr_t)setJSSVGMatrixB },
+    { "c", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMatrixC), (intptr_t)setJSSVGMatrixC },
+    { "d", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMatrixD), (intptr_t)setJSSVGMatrixD },
+    { "e", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMatrixE), (intptr_t)setJSSVGMatrixE },
+    { "f", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMatrixF), (intptr_t)setJSSVGMatrixF },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMatrixConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGMatrixTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 15, JSSVGMatrixTableValues, 0 };
+    { 127, JSSVGMatrixTableValues, 0 };
 #else
-    { 16, 15, JSSVGMatrixTableValues, 0 };
+    { 17, 15, JSSVGMatrixTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGMatrixConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGMatrixConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGMatrixConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGMatrixConstructorTableValues, 0 };
+#endif
+
+class JSSVGMatrixConstructor : public DOMConstructorObject {
+public:
+    JSSVGMatrixConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGMatrixConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGMatrixPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGMatrixConstructor::s_info = { "SVGMatrixConstructor", 0, &JSSVGMatrixConstructorTable, 0 };
+
+bool JSSVGMatrixConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGMatrixConstructor, DOMObject>(exec, &JSSVGMatrixConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGMatrixConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGMatrixConstructor, DOMObject>(exec, &JSSVGMatrixConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGMatrixPrototypeTableValues[12] =
 {
-    { "multiply", DontDelete|Function, (intptr_t)jsSVGMatrixPrototypeFunctionMultiply, (intptr_t)1 },
-    { "inverse", DontDelete|Function, (intptr_t)jsSVGMatrixPrototypeFunctionInverse, (intptr_t)0 },
-    { "translate", DontDelete|Function, (intptr_t)jsSVGMatrixPrototypeFunctionTranslate, (intptr_t)2 },
-    { "scale", DontDelete|Function, (intptr_t)jsSVGMatrixPrototypeFunctionScale, (intptr_t)1 },
-    { "scaleNonUniform", DontDelete|Function, (intptr_t)jsSVGMatrixPrototypeFunctionScaleNonUniform, (intptr_t)2 },
-    { "rotate", DontDelete|Function, (intptr_t)jsSVGMatrixPrototypeFunctionRotate, (intptr_t)1 },
-    { "rotateFromVector", DontDelete|Function, (intptr_t)jsSVGMatrixPrototypeFunctionRotateFromVector, (intptr_t)2 },
-    { "flipX", DontDelete|Function, (intptr_t)jsSVGMatrixPrototypeFunctionFlipX, (intptr_t)0 },
-    { "flipY", DontDelete|Function, (intptr_t)jsSVGMatrixPrototypeFunctionFlipY, (intptr_t)0 },
-    { "skewX", DontDelete|Function, (intptr_t)jsSVGMatrixPrototypeFunctionSkewX, (intptr_t)1 },
-    { "skewY", DontDelete|Function, (intptr_t)jsSVGMatrixPrototypeFunctionSkewY, (intptr_t)1 },
+    { "multiply", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMatrixPrototypeFunctionMultiply), (intptr_t)1 },
+    { "inverse", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMatrixPrototypeFunctionInverse), (intptr_t)0 },
+    { "translate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMatrixPrototypeFunctionTranslate), (intptr_t)2 },
+    { "scale", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMatrixPrototypeFunctionScale), (intptr_t)1 },
+    { "scaleNonUniform", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMatrixPrototypeFunctionScaleNonUniform), (intptr_t)2 },
+    { "rotate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMatrixPrototypeFunctionRotate), (intptr_t)1 },
+    { "rotateFromVector", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMatrixPrototypeFunctionRotateFromVector), (intptr_t)2 },
+    { "flipX", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMatrixPrototypeFunctionFlipX), (intptr_t)0 },
+    { "flipY", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMatrixPrototypeFunctionFlipY), (intptr_t)0 },
+    { "skewX", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMatrixPrototypeFunctionSkewX), (intptr_t)1 },
+    { "skewY", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGMatrixPrototypeFunctionSkewY), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -99,8 +147,8 @@ bool JSSVGMatrixPrototype::getOwnPropertyDescriptor(ExecState* exec, const Ident
 
 const ClassInfo JSSVGMatrix::s_info = { "SVGMatrix", 0, &JSSVGMatrixTable, 0 };
 
-JSSVGMatrix::JSSVGMatrix(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<TransformationMatrix> > impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGMatrix::JSSVGMatrix(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<AffineTransform> > impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -108,6 +156,7 @@ JSSVGMatrix::JSSVGMatrix(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObje
 JSSVGMatrix::~JSSVGMatrix()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGMatrix::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -125,54 +174,65 @@ bool JSSVGMatrix::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
     return getStaticValueDescriptor<JSSVGMatrix, Base>(exec, &JSSVGMatrixTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGMatrixA(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixA(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMatrix* castedThis = static_cast<JSSVGMatrix*>(asObject(slot.slotBase()));
+    JSSVGMatrix* castedThis = static_cast<JSSVGMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
-    TransformationMatrix imp(*castedThis->impl());
-    return jsNumber(exec, imp.a());
+    AffineTransform imp(*castedThis->impl());
+    JSValue result =  jsNumber(exec, imp.a());
+    return result;
 }
 
-JSValue jsSVGMatrixB(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixB(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMatrix* castedThis = static_cast<JSSVGMatrix*>(asObject(slot.slotBase()));
+    JSSVGMatrix* castedThis = static_cast<JSSVGMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
-    TransformationMatrix imp(*castedThis->impl());
-    return jsNumber(exec, imp.b());
+    AffineTransform imp(*castedThis->impl());
+    JSValue result =  jsNumber(exec, imp.b());
+    return result;
 }
 
-JSValue jsSVGMatrixC(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixC(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMatrix* castedThis = static_cast<JSSVGMatrix*>(asObject(slot.slotBase()));
+    JSSVGMatrix* castedThis = static_cast<JSSVGMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
-    TransformationMatrix imp(*castedThis->impl());
-    return jsNumber(exec, imp.c());
+    AffineTransform imp(*castedThis->impl());
+    JSValue result =  jsNumber(exec, imp.c());
+    return result;
 }
 
-JSValue jsSVGMatrixD(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixD(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMatrix* castedThis = static_cast<JSSVGMatrix*>(asObject(slot.slotBase()));
+    JSSVGMatrix* castedThis = static_cast<JSSVGMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
-    TransformationMatrix imp(*castedThis->impl());
-    return jsNumber(exec, imp.d());
+    AffineTransform imp(*castedThis->impl());
+    JSValue result =  jsNumber(exec, imp.d());
+    return result;
 }
 
-JSValue jsSVGMatrixE(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixE(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMatrix* castedThis = static_cast<JSSVGMatrix*>(asObject(slot.slotBase()));
+    JSSVGMatrix* castedThis = static_cast<JSSVGMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
-    TransformationMatrix imp(*castedThis->impl());
-    return jsNumber(exec, imp.e());
+    AffineTransform imp(*castedThis->impl());
+    JSValue result =  jsNumber(exec, imp.e());
+    return result;
 }
 
-JSValue jsSVGMatrixF(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixF(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGMatrix* castedThis = static_cast<JSSVGMatrix*>(asObject(slot.slotBase()));
+    JSSVGMatrix* castedThis = static_cast<JSSVGMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
-    TransformationMatrix imp(*castedThis->impl());
-    return jsNumber(exec, imp.f());
+    AffineTransform imp(*castedThis->impl());
+    JSValue result =  jsNumber(exec, imp.f());
+    return result;
 }
 
+JSValue jsSVGMatrixConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGMatrix* domObject = static_cast<JSSVGMatrix*>(asObject(slotBase));
+    return JSSVGMatrix::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGMatrix::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGMatrix, Base>(exec, propertyName, value, &JSSVGMatrixTable, this, slot);
@@ -180,44 +240,61 @@ void JSSVGMatrix::put(ExecState* exec, const Identifier& propertyName, JSValue v
 
 void setJSSVGMatrixA(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setA(value.toNumber(exec));
-        static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
+    JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(thisObject);
+    JSSVGPODTypeWrapper<AffineTransform> * imp = static_cast<JSSVGPODTypeWrapper<AffineTransform> *>(castedThisObj->impl());
+    AffineTransform podImp(*imp);
+    podImp.setA(value.toNumber(exec));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 void setJSSVGMatrixB(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setB(value.toNumber(exec));
-        static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
+    JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(thisObject);
+    JSSVGPODTypeWrapper<AffineTransform> * imp = static_cast<JSSVGPODTypeWrapper<AffineTransform> *>(castedThisObj->impl());
+    AffineTransform podImp(*imp);
+    podImp.setB(value.toNumber(exec));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 void setJSSVGMatrixC(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setC(value.toNumber(exec));
-        static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
+    JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(thisObject);
+    JSSVGPODTypeWrapper<AffineTransform> * imp = static_cast<JSSVGPODTypeWrapper<AffineTransform> *>(castedThisObj->impl());
+    AffineTransform podImp(*imp);
+    podImp.setC(value.toNumber(exec));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 void setJSSVGMatrixD(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setD(value.toNumber(exec));
-        static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
+    JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(thisObject);
+    JSSVGPODTypeWrapper<AffineTransform> * imp = static_cast<JSSVGPODTypeWrapper<AffineTransform> *>(castedThisObj->impl());
+    AffineTransform podImp(*imp);
+    podImp.setD(value.toNumber(exec));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 void setJSSVGMatrixE(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setE(value.toNumber(exec));
-        static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
+    JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(thisObject);
+    JSSVGPODTypeWrapper<AffineTransform> * imp = static_cast<JSSVGPODTypeWrapper<AffineTransform> *>(castedThisObj->impl());
+    AffineTransform podImp(*imp);
+    podImp.setE(value.toNumber(exec));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 void setJSSVGMatrixF(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setF(value.toNumber(exec));
-        static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
+    JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(thisObject);
+    JSSVGPODTypeWrapper<AffineTransform> * imp = static_cast<JSSVGPODTypeWrapper<AffineTransform> *>(castedThisObj->impl());
+    AffineTransform podImp(*imp);
+    podImp.setF(value.toNumber(exec));
+    imp->commitChange(podImp, castedThisObj);
+}
+
+JSValue JSSVGMatrix::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGMatrixConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionMultiply(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -226,13 +303,7 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionMultiply(ExecState* exec, JSOb
     if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
-    TransformationMatrix imp(*wrapper);
-    TransformationMatrix secondMatrix = toSVGMatrix(args.at(0));
-
-
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.multiply(secondMatrix)).get(), castedThisObj->context());
-    return result;
+    return castedThisObj->multiply(exec, args);
 }
 
 JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionInverse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -250,13 +321,13 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionTranslate(ExecState* exec, JSO
     if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
-    TransformationMatrix imp(*wrapper);
+    JSSVGPODTypeWrapper<AffineTransform> * imp = static_cast<JSSVGPODTypeWrapper<AffineTransform> *>(castedThisObj->impl());
+    AffineTransform podImp(*imp);
     float x = args.at(0).toFloat(exec);
     float y = args.at(1).toFloat(exec);
 
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.translate(x, y)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(podImp.translate(x, y)).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -266,12 +337,12 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionScale(ExecState* exec, JSObjec
     if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
-    TransformationMatrix imp(*wrapper);
+    JSSVGPODTypeWrapper<AffineTransform> * imp = static_cast<JSSVGPODTypeWrapper<AffineTransform> *>(castedThisObj->impl());
+    AffineTransform podImp(*imp);
     float scaleFactor = args.at(0).toFloat(exec);
 
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.scale(scaleFactor)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(podImp.scale(scaleFactor)).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -281,13 +352,13 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionScaleNonUniform(ExecState* exe
     if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
-    TransformationMatrix imp(*wrapper);
+    JSSVGPODTypeWrapper<AffineTransform> * imp = static_cast<JSSVGPODTypeWrapper<AffineTransform> *>(castedThisObj->impl());
+    AffineTransform podImp(*imp);
     float scaleFactorX = args.at(0).toFloat(exec);
     float scaleFactorY = args.at(1).toFloat(exec);
 
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.scaleNonUniform(scaleFactorX, scaleFactorY)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(podImp.scaleNonUniform(scaleFactorX, scaleFactorY)).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -297,12 +368,12 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionRotate(ExecState* exec, JSObje
     if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
-    TransformationMatrix imp(*wrapper);
+    JSSVGPODTypeWrapper<AffineTransform> * imp = static_cast<JSSVGPODTypeWrapper<AffineTransform> *>(castedThisObj->impl());
+    AffineTransform podImp(*imp);
     float angle = args.at(0).toFloat(exec);
 
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotate(angle)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(podImp.rotate(angle)).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -321,11 +392,11 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionFlipX(ExecState* exec, JSObjec
     if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
-    TransformationMatrix imp(*wrapper);
+    JSSVGPODTypeWrapper<AffineTransform> * imp = static_cast<JSSVGPODTypeWrapper<AffineTransform> *>(castedThisObj->impl());
+    AffineTransform podImp(*imp);
 
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.flipX()).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(podImp.flipX()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -335,11 +406,11 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionFlipY(ExecState* exec, JSObjec
     if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
-    TransformationMatrix imp(*wrapper);
+    JSSVGPODTypeWrapper<AffineTransform> * imp = static_cast<JSSVGPODTypeWrapper<AffineTransform> *>(castedThisObj->impl());
+    AffineTransform podImp(*imp);
 
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.flipY()).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(podImp.flipY()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -349,12 +420,12 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionSkewX(ExecState* exec, JSObjec
     if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
-    TransformationMatrix imp(*wrapper);
+    JSSVGPODTypeWrapper<AffineTransform> * imp = static_cast<JSSVGPODTypeWrapper<AffineTransform> *>(castedThisObj->impl());
+    AffineTransform podImp(*imp);
     float angle = args.at(0).toFloat(exec);
 
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.skewX(angle)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(podImp.skewX(angle)).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -364,22 +435,22 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionSkewY(ExecState* exec, JSObjec
     if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
-    TransformationMatrix imp(*wrapper);
+    JSSVGPODTypeWrapper<AffineTransform> * imp = static_cast<JSSVGPODTypeWrapper<AffineTransform> *>(castedThisObj->impl());
+    AffineTransform podImp(*imp);
     float angle = args.at(0).toFloat(exec);
 
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.skewY(angle)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(podImp.skewY(angle)).get(), 0 /* no context on purpose */);
     return result;
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JSSVGPODTypeWrapper<TransformationMatrix>* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JSSVGPODTypeWrapper<AffineTransform>* object, SVGElement* context)
 {
-    return getDOMObjectWrapper<JSSVGMatrix, JSSVGPODTypeWrapper<TransformationMatrix> >(exec, globalObject, object, context);
+    return getDOMObjectWrapper<JSSVGMatrix, JSSVGPODTypeWrapper<AffineTransform> >(exec, globalObject, object, context);
 }
-TransformationMatrix toSVGMatrix(JSC::JSValue value)
+AffineTransform toSVGMatrix(JSC::JSValue value)
 {
-    return value.inherits(&JSSVGMatrix::s_info) ? (TransformationMatrix) *static_cast<JSSVGMatrix*>(asObject(value))->impl() : TransformationMatrix();
+    return value.inherits(&JSSVGMatrix::s_info) ? (AffineTransform) *static_cast<JSSVGMatrix*>(asObject(value))->impl() : AffineTransform();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
index 6a9d2afc4d..1fa4c67d10 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
@@ -23,20 +23,19 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
+#include "AffineTransform.h"
 #include "JSDOMBinding.h"
 #include "JSSVGPODTypeWrapper.h"
 #include "SVGElement.h"
-#include "TransformationMatrix.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
 namespace WebCore {
 
-class JSSVGMatrix : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGMatrix : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGMatrix(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<JSSVGPODTypeWrapper<TransformationMatrix> >, SVGElement* context);
+    JSSVGMatrix(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<JSSVGPODTypeWrapper<AffineTransform> >);
     virtual ~JSSVGMatrix();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -47,23 +46,25 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom functions
+    JSC::JSValue multiply(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue inverse(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue rotateFromVector(JSC::ExecState*, const JSC::ArgList&);
-    JSSVGPODTypeWrapper<TransformationMatrix> * impl() const { return m_impl.get(); }
+    JSSVGPODTypeWrapper<AffineTransform> * impl() const { return m_impl.get(); }
 
 private:
-    RefPtr<JSSVGPODTypeWrapper<TransformationMatrix> > m_impl;
+    RefPtr<JSSVGPODTypeWrapper<AffineTransform> > m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<TransformationMatrix>*, SVGElement* context);
-TransformationMatrix toSVGMatrix(JSC::JSValue);
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<AffineTransform>*, SVGElement*);
+AffineTransform toSVGMatrix(JSC::JSValue);
 
 class JSSVGMatrixPrototype : public JSC::JSObject {
     typedef JSC::JSObject Base;
@@ -75,7 +76,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGMatrixPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -97,18 +98,19 @@ JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionSkewX(JSC::ExecState*, JS
 JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionSkewY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGMatrixA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMatrixA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGMatrixA(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGMatrixB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMatrixB(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGMatrixB(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGMatrixC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMatrixC(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGMatrixC(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGMatrixD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMatrixD(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGMatrixD(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGMatrixE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMatrixE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGMatrixE(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGMatrixF(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMatrixF(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGMatrixF(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMatrixConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.cpp
index b3f5b253ef..3bd5af07a1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGMetadataElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGMetadataElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMetadataElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGMetadataElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGMetadataElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGMetadataElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGMetadataElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGMetadataElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGMetadataElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGMetadataElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGMetadataElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGMetadataElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGMetadataElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGMetadataElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGMetadataElementConstructor::s_info = { "SVGMetadataElementConstructor", 0, &JSSVGMetadataElementConstructorTable, 0 };
+
+bool JSSVGMetadataElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGMetadataElementConstructor, DOMObject>(exec, &JSSVGMetadataElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGMetadataElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGMetadataElementConstructor, DOMObject>(exec, &JSSVGMetadataElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGMetadataElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGMetadataElementPrototype::self(ExecState* exec, JSGlobalObject* g
     return getDOMPrototype<JSSVGMetadataElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGMetadataElement::s_info = { "SVGMetadataElement", &JSSVGElement::s_info, 0, 0 };
+const ClassInfo JSSVGMetadataElement::s_info = { "SVGMetadataElement", &JSSVGElement::s_info, &JSSVGMetadataElementTable, 0 };
 
 JSSVGMetadataElement::JSSVGMetadataElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGMetadataElement> impl)
     : JSSVGElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGMetadataElement::createPrototype(ExecState* exec, JSGlobalObject*
     return new (exec) JSSVGMetadataElementPrototype(JSSVGMetadataElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGMetadataElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGMetadataElement, Base>(exec, &JSSVGMetadataElementTable, this, propertyName, slot);
+}
+
+bool JSSVGMetadataElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGMetadataElement, Base>(exec, &JSSVGMetadataElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGMetadataElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGMetadataElement* domObject = static_cast<JSSVGMetadataElement*>(asObject(slotBase));
+    return JSSVGMetadataElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGMetadataElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGMetadataElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h
index 462b52d778..93f8f81cda 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h
@@ -35,16 +35,19 @@ class JSSVGMetadataElement : public JSSVGElement {
 public:
     JSSVGMetadataElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGMetadataElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGMetadataElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGMetadataElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.cpp
index eed76cda2b..4b0c08efe1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGMissingGlyphElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGMissingGlyphElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGMissingGlyphElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGMissingGlyphElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGMissingGlyphElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGMissingGlyphElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGMissingGlyphElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGMissingGlyphElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGMissingGlyphElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGMissingGlyphElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGMissingGlyphElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGMissingGlyphElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGMissingGlyphElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGMissingGlyphElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGMissingGlyphElementConstructor::s_info = { "SVGMissingGlyphElementConstructor", 0, &JSSVGMissingGlyphElementConstructorTable, 0 };
+
+bool JSSVGMissingGlyphElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGMissingGlyphElementConstructor, DOMObject>(exec, &JSSVGMissingGlyphElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGMissingGlyphElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGMissingGlyphElementConstructor, DOMObject>(exec, &JSSVGMissingGlyphElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGMissingGlyphElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGMissingGlyphElementPrototype::self(ExecState* exec, JSGlobalObjec
     return getDOMPrototype<JSSVGMissingGlyphElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGMissingGlyphElement::s_info = { "SVGMissingGlyphElement", &JSSVGElement::s_info, 0, 0 };
+const ClassInfo JSSVGMissingGlyphElement::s_info = { "SVGMissingGlyphElement", &JSSVGElement::s_info, &JSSVGMissingGlyphElementTable, 0 };
 
 JSSVGMissingGlyphElement::JSSVGMissingGlyphElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGMissingGlyphElement> impl)
     : JSSVGElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGMissingGlyphElement::createPrototype(ExecState* exec, JSGlobalObj
     return new (exec) JSSVGMissingGlyphElementPrototype(JSSVGMissingGlyphElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGMissingGlyphElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGMissingGlyphElement, Base>(exec, &JSSVGMissingGlyphElementTable, this, propertyName, slot);
+}
+
+bool JSSVGMissingGlyphElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGMissingGlyphElement, Base>(exec, &JSSVGMissingGlyphElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGMissingGlyphElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGMissingGlyphElement* domObject = static_cast<JSSVGMissingGlyphElement*>(asObject(slotBase));
+    return JSSVGMissingGlyphElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGMissingGlyphElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGMissingGlyphElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h
index d3584bd595..06f0cf51b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h
@@ -35,16 +35,19 @@ class JSSVGMissingGlyphElement : public JSSVGElement {
 public:
     JSSVGMissingGlyphElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGMissingGlyphElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGMissingGlyphElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGMissingGlyphElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp
index 8ba2042b6a..9d430c16e1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp
@@ -35,19 +35,67 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGNumber);
 
 /* Hash table */
 
-static const HashTableValue JSSVGNumberTableValues[2] =
+static const HashTableValue JSSVGNumberTableValues[3] =
 {
-    { "value", DontDelete, (intptr_t)jsSVGNumberValue, (intptr_t)setJSSVGNumberValue },
+    { "value", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGNumberValue), (intptr_t)setJSSVGNumberValue },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGNumberConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGNumberTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGNumberTableValues, 0 };
+    { 3, JSSVGNumberTableValues, 0 };
 #else
-    { 2, 1, JSSVGNumberTableValues, 0 };
+    { 4, 3, JSSVGNumberTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGNumberConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGNumberConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGNumberConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGNumberConstructorTableValues, 0 };
+#endif
+
+class JSSVGNumberConstructor : public DOMConstructorObject {
+public:
+    JSSVGNumberConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGNumberConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGNumberPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGNumberConstructor::s_info = { "SVGNumberConstructor", 0, &JSSVGNumberConstructorTable, 0 };
+
+bool JSSVGNumberConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGNumberConstructor, DOMObject>(exec, &JSSVGNumberConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGNumberConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGNumberConstructor, DOMObject>(exec, &JSSVGNumberConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGNumberPrototypeTableValues[1] =
@@ -71,8 +119,8 @@ JSObject* JSSVGNumberPrototype::self(ExecState* exec, JSGlobalObject* globalObje
 
 const ClassInfo JSSVGNumber::s_info = { "SVGNumber", 0, &JSSVGNumberTable, 0 };
 
-JSSVGNumber::JSSVGNumber(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<float> > impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGNumber::JSSVGNumber(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<float> > impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -80,6 +128,7 @@ JSSVGNumber::JSSVGNumber(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObje
 JSSVGNumber::~JSSVGNumber()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGNumber::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -97,14 +146,20 @@ bool JSSVGNumber::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
     return getStaticValueDescriptor<JSSVGNumber, Base>(exec, &JSSVGNumberTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGNumberValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGNumberValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGNumber* castedThis = static_cast<JSSVGNumber*>(asObject(slot.slotBase()));
+    JSSVGNumber* castedThis = static_cast<JSSVGNumber*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     float imp(*castedThis->impl());
-    return jsNumber(exec, imp);
+    JSValue result =  jsNumber(exec, imp);
+    return result;
 }
 
+JSValue jsSVGNumberConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGNumber* domObject = static_cast<JSSVGNumber*>(asObject(slotBase));
+    return JSSVGNumber::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGNumber::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGNumber, Base>(exec, propertyName, value, &JSSVGNumberTable, this, slot);
@@ -112,9 +167,16 @@ void JSSVGNumber::put(ExecState* exec, const Identifier& propertyName, JSValue v
 
 void setJSSVGNumberValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    float imp(*static_cast<JSSVGNumber*>(thisObject)->impl());
-    imp = value.toFloat(exec);
-        static_cast<JSSVGNumber*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGNumber*>(thisObject)->context());
+    JSSVGNumber* castedThisObj = static_cast<JSSVGNumber*>(thisObject);
+    JSSVGPODTypeWrapper<float> * imp = static_cast<JSSVGPODTypeWrapper<float> *>(castedThisObj->impl());
+    float podImp(*imp);
+    podImp = value.toFloat(exec);
+    imp->commitChange(podImp, castedThisObj);
+}
+
+JSValue JSSVGNumber::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGNumberConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JSSVGPODTypeWrapper<float>* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
index cf3bc5c51e..a698c3b81d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "JSSVGPODTypeWrapper.h"
 #include "SVGElement.h"
@@ -32,10 +31,10 @@
 
 namespace WebCore {
 
-class JSSVGNumber : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGNumber : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGNumber(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<JSSVGPODTypeWrapper<float> >, SVGElement* context);
+    JSSVGNumber(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<JSSVGPODTypeWrapper<float> >);
     virtual ~JSSVGNumber();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -46,9 +45,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     JSSVGPODTypeWrapper<float> * impl() const { return m_impl.get(); }
 
 private:
@@ -57,7 +57,7 @@ protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<float>*, SVGElement* context);
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<float>*, SVGElement*);
 float toSVGNumber(JSC::JSValue);
 
 class JSSVGNumberPrototype : public JSC::JSObject {
@@ -68,7 +68,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGNumberPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -77,8 +77,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGNumberValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGNumberValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGNumberValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGNumberConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp
index fa0e3cf6cb..5daff18c1a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp
@@ -25,6 +25,7 @@
 #include "JSSVGNumberList.h"
 
 #include "JSSVGNumber.h"
+#include "JSSVGPODListCustom.h"
 #include "SVGNumberList.h"
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
@@ -38,30 +39,78 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGNumberList);
 
 /* Hash table */
 
-static const HashTableValue JSSVGNumberListTableValues[2] =
+static const HashTableValue JSSVGNumberListTableValues[3] =
 {
-    { "numberOfItems", DontDelete|ReadOnly, (intptr_t)jsSVGNumberListNumberOfItems, (intptr_t)0 },
+    { "numberOfItems", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGNumberListNumberOfItems), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGNumberListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGNumberListTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGNumberListTableValues, 0 };
+    { 3, JSSVGNumberListTableValues, 0 };
 #else
-    { 2, 1, JSSVGNumberListTableValues, 0 };
+    { 4, 3, JSSVGNumberListTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGNumberListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGNumberListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGNumberListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGNumberListConstructorTableValues, 0 };
+#endif
+
+class JSSVGNumberListConstructor : public DOMConstructorObject {
+public:
+    JSSVGNumberListConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGNumberListConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGNumberListPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGNumberListConstructor::s_info = { "SVGNumberListConstructor", 0, &JSSVGNumberListConstructorTable, 0 };
+
+bool JSSVGNumberListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGNumberListConstructor, DOMObject>(exec, &JSSVGNumberListConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGNumberListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGNumberListConstructor, DOMObject>(exec, &JSSVGNumberListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGNumberListPrototypeTableValues[8] =
 {
-    { "clear", DontDelete|Function, (intptr_t)jsSVGNumberListPrototypeFunctionClear, (intptr_t)0 },
-    { "initialize", DontDelete|Function, (intptr_t)jsSVGNumberListPrototypeFunctionInitialize, (intptr_t)1 },
-    { "getItem", DontDelete|Function, (intptr_t)jsSVGNumberListPrototypeFunctionGetItem, (intptr_t)1 },
-    { "insertItemBefore", DontDelete|Function, (intptr_t)jsSVGNumberListPrototypeFunctionInsertItemBefore, (intptr_t)2 },
-    { "replaceItem", DontDelete|Function, (intptr_t)jsSVGNumberListPrototypeFunctionReplaceItem, (intptr_t)2 },
-    { "removeItem", DontDelete|Function, (intptr_t)jsSVGNumberListPrototypeFunctionRemoveItem, (intptr_t)1 },
-    { "appendItem", DontDelete|Function, (intptr_t)jsSVGNumberListPrototypeFunctionAppendItem, (intptr_t)1 },
+    { "clear", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGNumberListPrototypeFunctionClear), (intptr_t)0 },
+    { "initialize", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGNumberListPrototypeFunctionInitialize), (intptr_t)1 },
+    { "getItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGNumberListPrototypeFunctionGetItem), (intptr_t)1 },
+    { "insertItemBefore", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGNumberListPrototypeFunctionInsertItemBefore), (intptr_t)2 },
+    { "replaceItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGNumberListPrototypeFunctionReplaceItem), (intptr_t)2 },
+    { "removeItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGNumberListPrototypeFunctionRemoveItem), (intptr_t)1 },
+    { "appendItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGNumberListPrototypeFunctionAppendItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -91,8 +140,8 @@ bool JSSVGNumberListPrototype::getOwnPropertyDescriptor(ExecState* exec, const I
 
 const ClassInfo JSSVGNumberList::s_info = { "SVGNumberList", 0, &JSSVGNumberListTable, 0 };
 
-JSSVGNumberList::JSSVGNumberList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGNumberList> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGNumberList::JSSVGNumberList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGNumberList> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -100,6 +149,7 @@ JSSVGNumberList::JSSVGNumberList(NonNullPassRefPtr<Structure> structure, JSDOMGl
 JSSVGNumberList::~JSSVGNumberList()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGNumberList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -117,12 +167,23 @@ bool JSSVGNumberList::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSSVGNumberList, Base>(exec, &JSSVGNumberListTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGNumberListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGNumberListNumberOfItems(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGNumberList* castedThis = static_cast<JSSVGNumberList*>(asObject(slot.slotBase()));
+    JSSVGNumberList* castedThis = static_cast<JSSVGNumberList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThis->impl());
-    return jsNumber(exec, imp->numberOfItems());
+    JSValue result = jsNumber(exec, imp->numberOfItems());
+    return result;
+}
+
+JSValue jsSVGNumberListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGNumberList* domObject = static_cast<JSSVGNumberList*>(asObject(slotBase));
+    return JSSVGNumberList::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGNumberList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGNumberListConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -131,12 +192,7 @@ JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionClear(ExecState* exec, JSO
     if (!thisValue.inherits(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
-    SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-
-    imp->clear(ec);
-    setDOMException(exec, ec);
-    return jsUndefined();
+    return JSSVGPODListCustom::clear<JSSVGNumberList, float>(castedThisObj, exec, args, toSVGNumber);
 }
 
 JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -145,14 +201,7 @@ JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInitialize(ExecState* exec
     if (!thisValue.inherits(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
-    SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    float item = args.at(0).toFloat(exec);
-
-
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<float>::create(imp->initialize(item, ec)).get(), castedThisObj->context());
-    setDOMException(exec, ec);
-    return result;
+    return JSSVGPODListCustom::initialize<JSSVGNumberList, float>(castedThisObj, exec, args, toSVGNumber);
 }
 
 JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -161,14 +210,7 @@ JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionGetItem(ExecState* exec, J
     if (!thisValue.inherits(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
-    SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    unsigned index = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<float>::create(imp->getItem(index, ec)).get(), castedThisObj->context());
-    setDOMException(exec, ec);
-    return result;
+    return JSSVGPODListCustom::getItem<JSSVGNumberList, float>(castedThisObj, exec, args, toSVGNumber);
 }
 
 JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -177,15 +219,7 @@ JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInsertItemBefore(ExecState
     if (!thisValue.inherits(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
-    SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    float item = args.at(0).toFloat(exec);
-    unsigned index = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<float>::create(imp->insertItemBefore(item, index, ec)).get(), castedThisObj->context());
-    setDOMException(exec, ec);
-    return result;
+    return JSSVGPODListCustom::insertItemBefore<JSSVGNumberList, float>(castedThisObj, exec, args, toSVGNumber);
 }
 
 JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -194,15 +228,7 @@ JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionReplaceItem(ExecState* exe
     if (!thisValue.inherits(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
-    SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    float item = args.at(0).toFloat(exec);
-    unsigned index = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<float>::create(imp->replaceItem(item, index, ec)).get(), castedThisObj->context());
-    setDOMException(exec, ec);
-    return result;
+    return JSSVGPODListCustom::replaceItem<JSSVGNumberList, float>(castedThisObj, exec, args, toSVGNumber);
 }
 
 JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -211,14 +237,7 @@ JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionRemoveItem(ExecState* exec
     if (!thisValue.inherits(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
-    SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    unsigned index = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<float>::create(imp->removeItem(index, ec)).get(), castedThisObj->context());
-    setDOMException(exec, ec);
-    return result;
+    return JSSVGPODListCustom::removeItem<JSSVGNumberList, float>(castedThisObj, exec, args, toSVGNumber);
 }
 
 JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -227,14 +246,7 @@ JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionAppendItem(ExecState* exec
     if (!thisValue.inherits(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
-    SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    float item = args.at(0).toFloat(exec);
-
-
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<float>::create(imp->appendItem(item, ec)).get(), castedThisObj->context());
-    setDOMException(exec, ec);
-    return result;
+    return JSSVGPODListCustom::appendItem<JSSVGNumberList, float>(castedThisObj, exec, args, toSVGNumber);
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGNumberList* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
index 4a2cbfe24f..7adaeede70 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -33,10 +32,10 @@ namespace WebCore {
 
 class SVGNumberList;
 
-class JSSVGNumberList : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGNumberList : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGNumberList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGNumberList>, SVGElement* context);
+    JSSVGNumberList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGNumberList>);
     virtual ~JSSVGNumberList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -46,9 +45,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGNumberList* impl() const { return m_impl.get(); }
 
 private:
@@ -70,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGNumberListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -88,7 +88,8 @@ JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionRemoveItem(JSC::ExecS
 JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGNumberListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGNumberListNumberOfItems(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGNumberListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
index c523ddda51..b70e0ac45b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
@@ -41,9 +41,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPaint);
 
 static const HashTableValue JSSVGPaintTableValues[4] =
 {
-    { "paintType", DontDelete|ReadOnly, (intptr_t)jsSVGPaintPaintType, (intptr_t)0 },
-    { "uri", DontDelete|ReadOnly, (intptr_t)jsSVGPaintUri, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGPaintConstructor, (intptr_t)0 },
+    { "paintType", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintPaintType), (intptr_t)0 },
+    { "uri", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintUri), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -58,16 +58,16 @@ static JSC_CONST_HASHTABLE HashTable JSSVGPaintTable =
 
 static const HashTableValue JSSVGPaintConstructorTableValues[11] =
 {
-    { "SVG_PAINTTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_PAINTTYPE_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_RGBCOLOR, (intptr_t)0 },
-    { "SVG_PAINTTYPE_RGBCOLOR_ICCCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR, (intptr_t)0 },
-    { "SVG_PAINTTYPE_NONE", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_NONE, (intptr_t)0 },
-    { "SVG_PAINTTYPE_CURRENTCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR, (intptr_t)0 },
-    { "SVG_PAINTTYPE_URI_NONE", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_URI_NONE, (intptr_t)0 },
-    { "SVG_PAINTTYPE_URI_CURRENTCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR, (intptr_t)0 },
-    { "SVG_PAINTTYPE_URI_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR, (intptr_t)0 },
-    { "SVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR, (intptr_t)0 },
-    { "SVG_PAINTTYPE_URI", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_URI, (intptr_t)0 },
+    { "SVG_PAINTTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_PAINTTYPE_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_RGBCOLOR), (intptr_t)0 },
+    { "SVG_PAINTTYPE_RGBCOLOR_ICCCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR), (intptr_t)0 },
+    { "SVG_PAINTTYPE_NONE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_NONE), (intptr_t)0 },
+    { "SVG_PAINTTYPE_CURRENTCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR), (intptr_t)0 },
+    { "SVG_PAINTTYPE_URI_NONE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_URI_NONE), (intptr_t)0 },
+    { "SVG_PAINTTYPE_URI_CURRENTCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR), (intptr_t)0 },
+    { "SVG_PAINTTYPE_URI_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR), (intptr_t)0 },
+    { "SVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR), (intptr_t)0 },
+    { "SVG_PAINTTYPE_URI", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_URI), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -92,7 +92,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -115,18 +115,18 @@ bool JSSVGPaintConstructor::getOwnPropertyDescriptor(ExecState* exec, const Iden
 
 static const HashTableValue JSSVGPaintPrototypeTableValues[13] =
 {
-    { "SVG_PAINTTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_PAINTTYPE_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_RGBCOLOR, (intptr_t)0 },
-    { "SVG_PAINTTYPE_RGBCOLOR_ICCCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR, (intptr_t)0 },
-    { "SVG_PAINTTYPE_NONE", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_NONE, (intptr_t)0 },
-    { "SVG_PAINTTYPE_CURRENTCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR, (intptr_t)0 },
-    { "SVG_PAINTTYPE_URI_NONE", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_URI_NONE, (intptr_t)0 },
-    { "SVG_PAINTTYPE_URI_CURRENTCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR, (intptr_t)0 },
-    { "SVG_PAINTTYPE_URI_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR, (intptr_t)0 },
-    { "SVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR, (intptr_t)0 },
-    { "SVG_PAINTTYPE_URI", DontDelete|ReadOnly, (intptr_t)jsSVGPaintSVG_PAINTTYPE_URI, (intptr_t)0 },
-    { "setUri", DontDelete|Function, (intptr_t)jsSVGPaintPrototypeFunctionSetUri, (intptr_t)1 },
-    { "setPaint", DontDelete|Function, (intptr_t)jsSVGPaintPrototypeFunctionSetPaint, (intptr_t)4 },
+    { "SVG_PAINTTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_PAINTTYPE_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_RGBCOLOR), (intptr_t)0 },
+    { "SVG_PAINTTYPE_RGBCOLOR_ICCCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR), (intptr_t)0 },
+    { "SVG_PAINTTYPE_NONE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_NONE), (intptr_t)0 },
+    { "SVG_PAINTTYPE_CURRENTCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR), (intptr_t)0 },
+    { "SVG_PAINTTYPE_URI_NONE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_URI_NONE), (intptr_t)0 },
+    { "SVG_PAINTTYPE_URI_CURRENTCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR), (intptr_t)0 },
+    { "SVG_PAINTTYPE_URI_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR), (intptr_t)0 },
+    { "SVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR), (intptr_t)0 },
+    { "SVG_PAINTTYPE_URI", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPaintSVG_PAINTTYPE_URI), (intptr_t)0 },
+    { "setUri", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPaintPrototypeFunctionSetUri), (intptr_t)1 },
+    { "setPaint", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPaintPrototypeFunctionSetPaint), (intptr_t)4 },
     { 0, 0, 0, 0 }
 };
 
@@ -176,25 +176,27 @@ bool JSSVGPaint::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     return getStaticValueDescriptor<JSSVGPaint, Base>(exec, &JSSVGPaintTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPaintPaintType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPaintPaintType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPaint* castedThis = static_cast<JSSVGPaint*>(asObject(slot.slotBase()));
+    JSSVGPaint* castedThis = static_cast<JSSVGPaint*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPaint* imp = static_cast<SVGPaint*>(castedThis->impl());
-    return jsNumber(exec, imp->paintType());
+    JSValue result = jsNumber(exec, imp->paintType());
+    return result;
 }
 
-JSValue jsSVGPaintUri(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPaintUri(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPaint* castedThis = static_cast<JSSVGPaint*>(asObject(slot.slotBase()));
+    JSSVGPaint* castedThis = static_cast<JSSVGPaint*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPaint* imp = static_cast<SVGPaint*>(castedThis->impl());
-    return jsString(exec, imp->uri());
+    JSValue result = jsString(exec, imp->uri());
+    return result;
 }
 
-JSValue jsSVGPaintConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPaintConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPaint* domObject = static_cast<JSSVGPaint*>(asObject(slot.slotBase()));
+    JSSVGPaint* domObject = static_cast<JSSVGPaint*>(asObject(slotBase));
     return JSSVGPaint::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGPaint::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -235,52 +237,52 @@ JSValue JSC_HOST_CALL jsSVGPaintPrototypeFunctionSetPaint(ExecState* exec, JSObj
 
 // Constant getters
 
-JSValue jsSVGPaintSVG_PAINTTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGPaintSVG_PAINTTYPE_NONE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_NONE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(101));
 }
 
-JSValue jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(102));
 }
 
-JSValue jsSVGPaintSVG_PAINTTYPE_URI_NONE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_URI_NONE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(103));
 }
 
-JSValue jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(104));
 }
 
-JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(105));
 }
 
-JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(106));
 }
 
-JSValue jsSVGPaintSVG_PAINTTYPE_URI(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_URI(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(107));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
index deaa5405b7..1b4e0f00d1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPaintPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -74,21 +74,21 @@ JSC::JSValue JSC_HOST_CALL jsSVGPaintPrototypeFunctionSetUri(JSC::ExecState*, JS
 JSC::JSValue JSC_HOST_CALL jsSVGPaintPrototypeFunctionSetPaint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGPaintPaintType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPaintUri(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPaintConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintPaintType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPaintUri(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPaintConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGPaintSVG_PAINTTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPaintSVG_PAINTTYPE_NONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_NONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_NONE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_NONE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp
index 8d9f234acf..05ec714145 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp
@@ -86,24 +86,25 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathElementTableValues[17] =
-{
-    { "pathLength", DontDelete|ReadOnly, (intptr_t)jsSVGPathElementPathLength, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGPathElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGPathElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGPathElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGPathElementXmllang, (intptr_t)setJSSVGPathElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGPathElementXmlspace, (intptr_t)setJSSVGPathElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGPathElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGPathElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGPathElementStyle, (intptr_t)0 },
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGPathElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGPathElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGPathElementFarthestViewportElement, (intptr_t)0 },
-    { "pathSegList", DontDelete|ReadOnly, (intptr_t)jsSVGPathElementPathSegList, (intptr_t)0 },
-    { "normalizedPathSegList", DontDelete|ReadOnly, (intptr_t)jsSVGPathElementNormalizedPathSegList, (intptr_t)0 },
-    { "animatedPathSegList", DontDelete|ReadOnly, (intptr_t)jsSVGPathElementAnimatedPathSegList, (intptr_t)0 },
-    { "animatedNormalizedPathSegList", DontDelete|ReadOnly, (intptr_t)jsSVGPathElementAnimatedNormalizedPathSegList, (intptr_t)0 },
+static const HashTableValue JSSVGPathElementTableValues[18] =
+{
+    { "pathLength", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementPathLength), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementXmllang), (intptr_t)setJSSVGPathElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementXmlspace), (intptr_t)setJSSVGPathElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementStyle), (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementFarthestViewportElement), (intptr_t)0 },
+    { "pathSegList", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementPathSegList), (intptr_t)0 },
+    { "normalizedPathSegList", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementNormalizedPathSegList), (intptr_t)0 },
+    { "animatedPathSegList", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementAnimatedPathSegList), (intptr_t)0 },
+    { "animatedNormalizedPathSegList", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementAnimatedNormalizedPathSegList), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -111,41 +112,88 @@ static JSC_CONST_HASHTABLE HashTable JSSVGPathElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 255, JSSVGPathElementTableValues, 0 };
 #else
-    { 36, 31, JSSVGPathElementTableValues, 0 };
+    { 67, 63, JSSVGPathElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathElementConstructor::s_info = { "SVGPathElementConstructor", 0, &JSSVGPathElementConstructorTable, 0 };
+
+bool JSSVGPathElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathElementConstructor, DOMObject>(exec, &JSSVGPathElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathElementConstructor, DOMObject>(exec, &JSSVGPathElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathElementPrototypeTableValues[29] =
 {
-    { "getTotalLength", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionGetTotalLength, (intptr_t)0 },
-    { "getPointAtLength", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionGetPointAtLength, (intptr_t)1 },
-    { "getPathSegAtLength", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionGetPathSegAtLength, (intptr_t)1 },
-    { "createSVGPathSegClosePath", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePath, (intptr_t)0 },
-    { "createSVGPathSegMovetoAbs", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbs, (intptr_t)2 },
-    { "createSVGPathSegMovetoRel", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRel, (intptr_t)2 },
-    { "createSVGPathSegLinetoAbs", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbs, (intptr_t)2 },
-    { "createSVGPathSegLinetoRel", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRel, (intptr_t)2 },
-    { "createSVGPathSegCurvetoCubicAbs", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicAbs, (intptr_t)6 },
-    { "createSVGPathSegCurvetoCubicRel", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicRel, (intptr_t)6 },
-    { "createSVGPathSegCurvetoQuadraticAbs", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticAbs, (intptr_t)4 },
-    { "createSVGPathSegCurvetoQuadraticRel", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticRel, (intptr_t)4 },
-    { "createSVGPathSegArcAbs", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbs, (intptr_t)7 },
-    { "createSVGPathSegArcRel", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRel, (intptr_t)7 },
-    { "createSVGPathSegLinetoHorizontalAbs", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalAbs, (intptr_t)1 },
-    { "createSVGPathSegLinetoHorizontalRel", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalRel, (intptr_t)1 },
-    { "createSVGPathSegLinetoVerticalAbs", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalAbs, (intptr_t)1 },
-    { "createSVGPathSegLinetoVerticalRel", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalRel, (intptr_t)1 },
-    { "createSVGPathSegCurvetoCubicSmoothAbs", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothAbs, (intptr_t)4 },
-    { "createSVGPathSegCurvetoCubicSmoothRel", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothRel, (intptr_t)4 },
-    { "createSVGPathSegCurvetoQuadraticSmoothAbs", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothAbs, (intptr_t)2 },
-    { "createSVGPathSegCurvetoQuadraticSmoothRel", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothRel, (intptr_t)2 },
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGPathElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "getTotalLength", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionGetTotalLength), (intptr_t)0 },
+    { "getPointAtLength", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionGetPointAtLength), (intptr_t)1 },
+    { "getPathSegAtLength", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionGetPathSegAtLength), (intptr_t)1 },
+    { "createSVGPathSegClosePath", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePath), (intptr_t)0 },
+    { "createSVGPathSegMovetoAbs", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbs), (intptr_t)2 },
+    { "createSVGPathSegMovetoRel", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRel), (intptr_t)2 },
+    { "createSVGPathSegLinetoAbs", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbs), (intptr_t)2 },
+    { "createSVGPathSegLinetoRel", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRel), (intptr_t)2 },
+    { "createSVGPathSegCurvetoCubicAbs", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicAbs), (intptr_t)6 },
+    { "createSVGPathSegCurvetoCubicRel", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicRel), (intptr_t)6 },
+    { "createSVGPathSegCurvetoQuadraticAbs", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticAbs), (intptr_t)4 },
+    { "createSVGPathSegCurvetoQuadraticRel", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticRel), (intptr_t)4 },
+    { "createSVGPathSegArcAbs", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbs), (intptr_t)7 },
+    { "createSVGPathSegArcRel", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRel), (intptr_t)7 },
+    { "createSVGPathSegLinetoHorizontalAbs", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalAbs), (intptr_t)1 },
+    { "createSVGPathSegLinetoHorizontalRel", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalRel), (intptr_t)1 },
+    { "createSVGPathSegLinetoVerticalAbs", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalAbs), (intptr_t)1 },
+    { "createSVGPathSegLinetoVerticalRel", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalRel), (intptr_t)1 },
+    { "createSVGPathSegCurvetoCubicSmoothAbs", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothAbs), (intptr_t)4 },
+    { "createSVGPathSegCurvetoCubicSmoothRel", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothRel), (intptr_t)4 },
+    { "createSVGPathSegCurvetoQuadraticSmoothAbs", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothAbs), (intptr_t)2 },
+    { "createSVGPathSegCurvetoQuadraticSmoothRel", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothRel), (intptr_t)2 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -195,138 +243,159 @@ bool JSSVGPathElement::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSSVGPathElement, Base>(exec, &JSSVGPathElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathElementPathLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementPathLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->pathLengthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPathElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGPathElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGPathElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGPathElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGPathElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGPathElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPathElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPathElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGPathElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPathElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGPathElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGPathElementPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementPathSegList(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->pathSegList()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->pathSegList()), imp);
+    return result;
 }
 
-JSValue jsSVGPathElementNormalizedPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementNormalizedPathSegList(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->normalizedPathSegList()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->normalizedPathSegList()), imp);
+    return result;
 }
 
-JSValue jsSVGPathElementAnimatedPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementAnimatedPathSegList(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->animatedPathSegList()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->animatedPathSegList()), imp);
+    return result;
 }
 
-JSValue jsSVGPathElementAnimatedNormalizedPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementAnimatedNormalizedPathSegList(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
+    JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->animatedNormalizedPathSegList()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->animatedNormalizedPathSegList()), imp);
+    return result;
 }
 
+JSValue jsSVGPathElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathElement* domObject = static_cast<JSSVGPathElement*>(asObject(slotBase));
+    return JSSVGPathElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathElement, Base>(exec, propertyName, value, &JSSVGPathElementTable, this, slot);
@@ -334,16 +403,23 @@ void JSSVGPathElement::put(ExecState* exec, const Identifier& propertyName, JSVa
 
 void setJSSVGPathElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(thisObject)->impl());
+    JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(thisObject);
+    SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGPathElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(thisObject)->impl());
+    JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(thisObject);
+    SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGPathElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetTotalLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -367,7 +443,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPointAtLength(ExecStat
     float distance = args.at(0).toFloat(exec);
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getPointAtLength(distance)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getPointAtLength(distance)).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -378,10 +454,12 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPathSegAtLength(ExecSt
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
     float distance = args.at(0).toFloat(exec);
 
 
-    JSC::JSValue result = jsNumber(exec, imp->getPathSegAtLength(distance));
+    JSC::JSValue result = jsNumber(exec, imp->getPathSegAtLength(distance, ec));
+    setDOMException(exec, ec);
     return result;
 }
 
@@ -727,7 +805,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetBBox(ExecState* exec,
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -740,7 +818,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetCTM(ExecState* exec, J
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -753,7 +831,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetScreenCTM(ExecState* e
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -768,7 +846,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetTransformToElement(Exe
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
index b02974b88c..7b0568b663 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -100,24 +101,25 @@ JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetScreenCTM(JSC::Ex
 JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGPathElementPathLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementPathLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathElementPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathElementNormalizedPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathElementAnimatedPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathElementAnimatedNormalizedPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathElementPathSegList(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathElementNormalizedPathSegList(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathElementAnimatedPathSegList(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathElementAnimatedNormalizedPathSegList(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
index 767098b124..9d4c4da24e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
@@ -40,9 +40,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSeg);
 
 static const HashTableValue JSSVGPathSegTableValues[4] =
 {
-    { "pathSegType", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPathSegType, (intptr_t)0 },
-    { "pathSegTypeAsLetter", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPathSegTypeAsLetter, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGPathSegConstructor, (intptr_t)0 },
+    { "pathSegType", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPathSegType), (intptr_t)0 },
+    { "pathSegTypeAsLetter", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPathSegTypeAsLetter), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -57,26 +57,26 @@ static JSC_CONST_HASHTABLE HashTable JSSVGPathSegTable =
 
 static const HashTableValue JSSVGPathSegConstructorTableValues[21] =
 {
-    { "PATHSEG_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_UNKNOWN, (intptr_t)0 },
-    { "PATHSEG_CLOSEPATH", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CLOSEPATH, (intptr_t)0 },
-    { "PATHSEG_MOVETO_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_MOVETO_ABS, (intptr_t)0 },
-    { "PATHSEG_MOVETO_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_MOVETO_REL, (intptr_t)0 },
-    { "PATHSEG_LINETO_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_LINETO_ABS, (intptr_t)0 },
-    { "PATHSEG_LINETO_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_LINETO_REL, (intptr_t)0 },
-    { "PATHSEG_CURVETO_CUBIC_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS, (intptr_t)0 },
-    { "PATHSEG_CURVETO_CUBIC_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL, (intptr_t)0 },
-    { "PATHSEG_CURVETO_QUADRATIC_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS, (intptr_t)0 },
-    { "PATHSEG_CURVETO_QUADRATIC_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL, (intptr_t)0 },
-    { "PATHSEG_ARC_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_ARC_ABS, (intptr_t)0 },
-    { "PATHSEG_ARC_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_ARC_REL, (intptr_t)0 },
-    { "PATHSEG_LINETO_HORIZONTAL_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS, (intptr_t)0 },
-    { "PATHSEG_LINETO_HORIZONTAL_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL, (intptr_t)0 },
-    { "PATHSEG_LINETO_VERTICAL_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS, (intptr_t)0 },
-    { "PATHSEG_LINETO_VERTICAL_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL, (intptr_t)0 },
-    { "PATHSEG_CURVETO_CUBIC_SMOOTH_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS, (intptr_t)0 },
-    { "PATHSEG_CURVETO_CUBIC_SMOOTH_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL, (intptr_t)0 },
-    { "PATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS, (intptr_t)0 },
-    { "PATHSEG_CURVETO_QUADRATIC_SMOOTH_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL, (intptr_t)0 },
+    { "PATHSEG_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_UNKNOWN), (intptr_t)0 },
+    { "PATHSEG_CLOSEPATH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CLOSEPATH), (intptr_t)0 },
+    { "PATHSEG_MOVETO_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_MOVETO_ABS), (intptr_t)0 },
+    { "PATHSEG_MOVETO_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_MOVETO_REL), (intptr_t)0 },
+    { "PATHSEG_LINETO_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_LINETO_ABS), (intptr_t)0 },
+    { "PATHSEG_LINETO_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_LINETO_REL), (intptr_t)0 },
+    { "PATHSEG_CURVETO_CUBIC_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS), (intptr_t)0 },
+    { "PATHSEG_CURVETO_CUBIC_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL), (intptr_t)0 },
+    { "PATHSEG_CURVETO_QUADRATIC_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS), (intptr_t)0 },
+    { "PATHSEG_CURVETO_QUADRATIC_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL), (intptr_t)0 },
+    { "PATHSEG_ARC_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_ARC_ABS), (intptr_t)0 },
+    { "PATHSEG_ARC_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_ARC_REL), (intptr_t)0 },
+    { "PATHSEG_LINETO_HORIZONTAL_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS), (intptr_t)0 },
+    { "PATHSEG_LINETO_HORIZONTAL_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL), (intptr_t)0 },
+    { "PATHSEG_LINETO_VERTICAL_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS), (intptr_t)0 },
+    { "PATHSEG_LINETO_VERTICAL_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL), (intptr_t)0 },
+    { "PATHSEG_CURVETO_CUBIC_SMOOTH_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS), (intptr_t)0 },
+    { "PATHSEG_CURVETO_CUBIC_SMOOTH_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL), (intptr_t)0 },
+    { "PATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS), (intptr_t)0 },
+    { "PATHSEG_CURVETO_QUADRATIC_SMOOTH_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -101,7 +101,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -124,26 +124,26 @@ bool JSSVGPathSegConstructor::getOwnPropertyDescriptor(ExecState* exec, const Id
 
 static const HashTableValue JSSVGPathSegPrototypeTableValues[21] =
 {
-    { "PATHSEG_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_UNKNOWN, (intptr_t)0 },
-    { "PATHSEG_CLOSEPATH", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CLOSEPATH, (intptr_t)0 },
-    { "PATHSEG_MOVETO_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_MOVETO_ABS, (intptr_t)0 },
-    { "PATHSEG_MOVETO_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_MOVETO_REL, (intptr_t)0 },
-    { "PATHSEG_LINETO_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_LINETO_ABS, (intptr_t)0 },
-    { "PATHSEG_LINETO_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_LINETO_REL, (intptr_t)0 },
-    { "PATHSEG_CURVETO_CUBIC_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS, (intptr_t)0 },
-    { "PATHSEG_CURVETO_CUBIC_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL, (intptr_t)0 },
-    { "PATHSEG_CURVETO_QUADRATIC_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS, (intptr_t)0 },
-    { "PATHSEG_CURVETO_QUADRATIC_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL, (intptr_t)0 },
-    { "PATHSEG_ARC_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_ARC_ABS, (intptr_t)0 },
-    { "PATHSEG_ARC_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_ARC_REL, (intptr_t)0 },
-    { "PATHSEG_LINETO_HORIZONTAL_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS, (intptr_t)0 },
-    { "PATHSEG_LINETO_HORIZONTAL_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL, (intptr_t)0 },
-    { "PATHSEG_LINETO_VERTICAL_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS, (intptr_t)0 },
-    { "PATHSEG_LINETO_VERTICAL_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL, (intptr_t)0 },
-    { "PATHSEG_CURVETO_CUBIC_SMOOTH_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS, (intptr_t)0 },
-    { "PATHSEG_CURVETO_CUBIC_SMOOTH_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL, (intptr_t)0 },
-    { "PATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS, (intptr_t)0 },
-    { "PATHSEG_CURVETO_QUADRATIC_SMOOTH_REL", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL, (intptr_t)0 },
+    { "PATHSEG_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_UNKNOWN), (intptr_t)0 },
+    { "PATHSEG_CLOSEPATH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CLOSEPATH), (intptr_t)0 },
+    { "PATHSEG_MOVETO_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_MOVETO_ABS), (intptr_t)0 },
+    { "PATHSEG_MOVETO_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_MOVETO_REL), (intptr_t)0 },
+    { "PATHSEG_LINETO_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_LINETO_ABS), (intptr_t)0 },
+    { "PATHSEG_LINETO_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_LINETO_REL), (intptr_t)0 },
+    { "PATHSEG_CURVETO_CUBIC_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS), (intptr_t)0 },
+    { "PATHSEG_CURVETO_CUBIC_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL), (intptr_t)0 },
+    { "PATHSEG_CURVETO_QUADRATIC_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS), (intptr_t)0 },
+    { "PATHSEG_CURVETO_QUADRATIC_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL), (intptr_t)0 },
+    { "PATHSEG_ARC_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_ARC_ABS), (intptr_t)0 },
+    { "PATHSEG_ARC_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_ARC_REL), (intptr_t)0 },
+    { "PATHSEG_LINETO_HORIZONTAL_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS), (intptr_t)0 },
+    { "PATHSEG_LINETO_HORIZONTAL_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL), (intptr_t)0 },
+    { "PATHSEG_LINETO_VERTICAL_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS), (intptr_t)0 },
+    { "PATHSEG_LINETO_VERTICAL_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL), (intptr_t)0 },
+    { "PATHSEG_CURVETO_CUBIC_SMOOTH_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS), (intptr_t)0 },
+    { "PATHSEG_CURVETO_CUBIC_SMOOTH_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL), (intptr_t)0 },
+    { "PATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS), (intptr_t)0 },
+    { "PATHSEG_CURVETO_QUADRATIC_SMOOTH_REL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -173,8 +173,8 @@ bool JSSVGPathSegPrototype::getOwnPropertyDescriptor(ExecState* exec, const Iden
 
 const ClassInfo JSSVGPathSeg::s_info = { "SVGPathSeg", 0, &JSSVGPathSegTable, 0 };
 
-JSSVGPathSeg::JSSVGPathSeg(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSeg> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGPathSeg::JSSVGPathSeg(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSeg> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -182,6 +182,7 @@ JSSVGPathSeg::JSSVGPathSeg(NonNullPassRefPtr<Structure> structure, JSDOMGlobalOb
 JSSVGPathSeg::~JSSVGPathSeg()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGPathSeg::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -199,26 +200,28 @@ bool JSSVGPathSeg::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<JSSVGPathSeg, Base>(exec, &JSSVGPathSegTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegPathSegType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegPathSegType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSeg* castedThis = static_cast<JSSVGPathSeg*>(asObject(slot.slotBase()));
+    JSSVGPathSeg* castedThis = static_cast<JSSVGPathSeg*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSeg* imp = static_cast<SVGPathSeg*>(castedThis->impl());
-    return jsNumber(exec, imp->pathSegType());
+    JSValue result = jsNumber(exec, imp->pathSegType());
+    return result;
 }
 
-JSValue jsSVGPathSegPathSegTypeAsLetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegPathSegTypeAsLetter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSeg* castedThis = static_cast<JSSVGPathSeg*>(asObject(slot.slotBase()));
+    JSSVGPathSeg* castedThis = static_cast<JSSVGPathSeg*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSeg* imp = static_cast<SVGPathSeg*>(castedThis->impl());
-    return jsString(exec, imp->pathSegTypeAsLetter());
+    JSValue result = jsString(exec, imp->pathSegTypeAsLetter());
+    return result;
 }
 
-JSValue jsSVGPathSegConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    UNUSED_PARAM(slot);
-    return JSSVGPathSeg::getConstructor(exec, deprecatedGlobalObjectForPrototype(exec));
+    JSSVGPathSeg* domObject = static_cast<JSSVGPathSeg*>(asObject(slotBase));
+    return JSSVGPathSeg::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGPathSeg::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 {
@@ -227,102 +230,102 @@ JSValue JSSVGPathSeg::getConstructor(ExecState* exec, JSGlobalObject* globalObje
 
 // Constant getters
 
-JSValue jsSVGPathSegPATHSEG_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGPathSegPATHSEG_CLOSEPATH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CLOSEPATH(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGPathSegPATHSEG_MOVETO_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_MOVETO_ABS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGPathSegPATHSEG_MOVETO_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_MOVETO_REL(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsSVGPathSegPATHSEG_LINETO_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_ABS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsSVGPathSegPATHSEG_LINETO_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_REL(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValue jsSVGPathSegPATHSEG_ARC_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_ARC_ABS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValue jsSVGPathSegPATHSEG_ARC_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_ARC_REL(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
-JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(12));
 }
 
-JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(13));
 }
 
-JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(14));
 }
 
-JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(15));
 }
 
-JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(17));
 }
 
-JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(18));
 }
 
-JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(19));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
index d5da3179c2..9153477e96 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -33,10 +32,10 @@ namespace WebCore {
 
 class SVGPathSeg;
 
-class JSSVGPathSeg : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGPathSeg : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGPathSeg(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSeg>, SVGElement* context);
+    JSSVGPathSeg(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSeg>);
     virtual ~JSSVGPathSeg();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -46,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -71,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,31 +79,31 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegPathSegType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPathSegTypeAsLetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPathSegType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPathSegTypeAsLetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGPathSegPATHSEG_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_CLOSEPATH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_MOVETO_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_MOVETO_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_LINETO_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_LINETO_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_ARC_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_ARC_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_CLOSEPATH(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_MOVETO_ABS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_MOVETO_REL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_ABS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_REL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_ARC_ABS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_ARC_REL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp
index e073f758b6..5e8d932794 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp
@@ -36,25 +36,73 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegArcAbs);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegArcAbsTableValues[8] =
-{
-    { "x", DontDelete, (intptr_t)jsSVGPathSegArcAbsX, (intptr_t)setJSSVGPathSegArcAbsX },
-    { "y", DontDelete, (intptr_t)jsSVGPathSegArcAbsY, (intptr_t)setJSSVGPathSegArcAbsY },
-    { "r1", DontDelete, (intptr_t)jsSVGPathSegArcAbsR1, (intptr_t)setJSSVGPathSegArcAbsR1 },
-    { "r2", DontDelete, (intptr_t)jsSVGPathSegArcAbsR2, (intptr_t)setJSSVGPathSegArcAbsR2 },
-    { "angle", DontDelete, (intptr_t)jsSVGPathSegArcAbsAngle, (intptr_t)setJSSVGPathSegArcAbsAngle },
-    { "largeArcFlag", DontDelete, (intptr_t)jsSVGPathSegArcAbsLargeArcFlag, (intptr_t)setJSSVGPathSegArcAbsLargeArcFlag },
-    { "sweepFlag", DontDelete, (intptr_t)jsSVGPathSegArcAbsSweepFlag, (intptr_t)setJSSVGPathSegArcAbsSweepFlag },
+static const HashTableValue JSSVGPathSegArcAbsTableValues[9] =
+{
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcAbsX), (intptr_t)setJSSVGPathSegArcAbsX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcAbsY), (intptr_t)setJSSVGPathSegArcAbsY },
+    { "r1", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcAbsR1), (intptr_t)setJSSVGPathSegArcAbsR1 },
+    { "r2", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcAbsR2), (intptr_t)setJSSVGPathSegArcAbsR2 },
+    { "angle", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcAbsAngle), (intptr_t)setJSSVGPathSegArcAbsAngle },
+    { "largeArcFlag", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcAbsLargeArcFlag), (intptr_t)setJSSVGPathSegArcAbsLargeArcFlag },
+    { "sweepFlag", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcAbsSweepFlag), (intptr_t)setJSSVGPathSegArcAbsSweepFlag },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcAbsConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegArcAbsTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 15, JSSVGPathSegArcAbsTableValues, 0 };
+    { 31, JSSVGPathSegArcAbsTableValues, 0 };
+#else
+    { 17, 15, JSSVGPathSegArcAbsTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegArcAbsConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegArcAbsConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegArcAbsConstructorTableValues, 0 };
 #else
-    { 16, 15, JSSVGPathSegArcAbsTableValues, 0 };
+    { 1, 0, JSSVGPathSegArcAbsConstructorTableValues, 0 };
 #endif
 
+class JSSVGPathSegArcAbsConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegArcAbsConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegArcAbsConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegArcAbsPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegArcAbsConstructor::s_info = { "SVGPathSegArcAbsConstructor", 0, &JSSVGPathSegArcAbsConstructorTable, 0 };
+
+bool JSSVGPathSegArcAbsConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegArcAbsConstructor, DOMObject>(exec, &JSSVGPathSegArcAbsConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegArcAbsConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegArcAbsConstructor, DOMObject>(exec, &JSSVGPathSegArcAbsConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegArcAbsPrototypeTableValues[1] =
@@ -78,8 +126,8 @@ JSObject* JSSVGPathSegArcAbsPrototype::self(ExecState* exec, JSGlobalObject* glo
 
 const ClassInfo JSSVGPathSegArcAbs::s_info = { "SVGPathSegArcAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegArcAbsTable, 0 };
 
-JSSVGPathSegArcAbs::JSSVGPathSegArcAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegArcAbs> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegArcAbs::JSSVGPathSegArcAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegArcAbs> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -98,62 +146,74 @@ bool JSSVGPathSegArcAbs::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSSVGPathSegArcAbs, Base>(exec, &JSSVGPathSegArcAbsTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegArcAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegArcAbs* castedThis = static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegArcAbs* castedThis = static_cast<JSSVGPathSegArcAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsSVGPathSegArcAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegArcAbs* castedThis = static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegArcAbs* castedThis = static_cast<JSSVGPathSegArcAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
-JSValue jsSVGPathSegArcAbsR1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsR1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegArcAbs* castedThis = static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegArcAbs* castedThis = static_cast<JSSVGPathSegArcAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->r1());
+    JSValue result = jsNumber(exec, imp->r1());
+    return result;
 }
 
-JSValue jsSVGPathSegArcAbsR2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsR2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegArcAbs* castedThis = static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegArcAbs* castedThis = static_cast<JSSVGPathSegArcAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->r2());
+    JSValue result = jsNumber(exec, imp->r2());
+    return result;
 }
 
-JSValue jsSVGPathSegArcAbsAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsAngle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegArcAbs* castedThis = static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegArcAbs* castedThis = static_cast<JSSVGPathSegArcAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->angle());
+    JSValue result = jsNumber(exec, imp->angle());
+    return result;
 }
 
-JSValue jsSVGPathSegArcAbsLargeArcFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsLargeArcFlag(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegArcAbs* castedThis = static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegArcAbs* castedThis = static_cast<JSSVGPathSegArcAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(castedThis->impl());
-    return jsBoolean(imp->largeArcFlag());
+    JSValue result = jsBoolean(imp->largeArcFlag());
+    return result;
 }
 
-JSValue jsSVGPathSegArcAbsSweepFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsSweepFlag(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegArcAbs* castedThis = static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegArcAbs* castedThis = static_cast<JSSVGPathSegArcAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(castedThis->impl());
-    return jsBoolean(imp->sweepFlag());
+    JSValue result = jsBoolean(imp->sweepFlag());
+    return result;
 }
 
+JSValue jsSVGPathSegArcAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegArcAbs* domObject = static_cast<JSSVGPathSegArcAbs*>(asObject(slotBase));
+    return JSSVGPathSegArcAbs::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegArcAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegArcAbs, Base>(exec, propertyName, value, &JSSVGPathSegArcAbsTable, this, slot);
@@ -161,58 +221,63 @@ void JSSVGPathSegArcAbs::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSSVGPathSegArcAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
+    JSSVGPathSegArcAbs* castedThisObj = static_cast<JSSVGPathSegArcAbs*>(thisObject);
+    SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegArcAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
+    JSSVGPathSegArcAbs* castedThisObj = static_cast<JSSVGPathSegArcAbs*>(thisObject);
+    SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegArcAbsR1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
+    JSSVGPathSegArcAbs* castedThisObj = static_cast<JSSVGPathSegArcAbs*>(thisObject);
+    SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(castedThisObj->impl());
     imp->setR1(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegArcAbsR2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
+    JSSVGPathSegArcAbs* castedThisObj = static_cast<JSSVGPathSegArcAbs*>(thisObject);
+    SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(castedThisObj->impl());
     imp->setR2(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegArcAbsAngle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
+    JSSVGPathSegArcAbs* castedThisObj = static_cast<JSSVGPathSegArcAbs*>(thisObject);
+    SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(castedThisObj->impl());
     imp->setAngle(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegArcAbsLargeArcFlag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
+    JSSVGPathSegArcAbs* castedThisObj = static_cast<JSSVGPathSegArcAbs*>(thisObject);
+    SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(castedThisObj->impl());
     imp->setLargeArcFlag(value.toBoolean(exec));
-    if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegArcAbsSweepFlag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
+    JSSVGPathSegArcAbs* castedThisObj = static_cast<JSSVGPathSegArcAbs*>(thisObject);
+    SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(castedThisObj->impl());
     imp->setSweepFlag(value.toBoolean(exec));
-    if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegArcAbs::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegArcAbsConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
index 9b7eeeca7c..5c2eadb579 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
@@ -33,7 +33,7 @@ class SVGPathSegArcAbs;
 class JSSVGPathSegArcAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegArcAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegArcAbs>, SVGElement* context);
+    JSSVGPathSegArcAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegArcAbs>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegArcAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,20 +69,21 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegArcAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegArcAbsX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegArcAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegArcAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegArcAbsY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegArcAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegArcAbsR1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegArcAbsR1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegArcAbsR1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegArcAbsR2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegArcAbsR2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegArcAbsR2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegArcAbsAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegArcAbsAngle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegArcAbsAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegArcAbsLargeArcFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegArcAbsLargeArcFlag(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegArcAbsLargeArcFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegArcAbsSweepFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegArcAbsSweepFlag(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegArcAbsSweepFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp
index c848513e40..5570507d58 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp
@@ -36,25 +36,73 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegArcRel);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegArcRelTableValues[8] =
-{
-    { "x", DontDelete, (intptr_t)jsSVGPathSegArcRelX, (intptr_t)setJSSVGPathSegArcRelX },
-    { "y", DontDelete, (intptr_t)jsSVGPathSegArcRelY, (intptr_t)setJSSVGPathSegArcRelY },
-    { "r1", DontDelete, (intptr_t)jsSVGPathSegArcRelR1, (intptr_t)setJSSVGPathSegArcRelR1 },
-    { "r2", DontDelete, (intptr_t)jsSVGPathSegArcRelR2, (intptr_t)setJSSVGPathSegArcRelR2 },
-    { "angle", DontDelete, (intptr_t)jsSVGPathSegArcRelAngle, (intptr_t)setJSSVGPathSegArcRelAngle },
-    { "largeArcFlag", DontDelete, (intptr_t)jsSVGPathSegArcRelLargeArcFlag, (intptr_t)setJSSVGPathSegArcRelLargeArcFlag },
-    { "sweepFlag", DontDelete, (intptr_t)jsSVGPathSegArcRelSweepFlag, (intptr_t)setJSSVGPathSegArcRelSweepFlag },
+static const HashTableValue JSSVGPathSegArcRelTableValues[9] =
+{
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcRelX), (intptr_t)setJSSVGPathSegArcRelX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcRelY), (intptr_t)setJSSVGPathSegArcRelY },
+    { "r1", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcRelR1), (intptr_t)setJSSVGPathSegArcRelR1 },
+    { "r2", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcRelR2), (intptr_t)setJSSVGPathSegArcRelR2 },
+    { "angle", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcRelAngle), (intptr_t)setJSSVGPathSegArcRelAngle },
+    { "largeArcFlag", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcRelLargeArcFlag), (intptr_t)setJSSVGPathSegArcRelLargeArcFlag },
+    { "sweepFlag", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcRelSweepFlag), (intptr_t)setJSSVGPathSegArcRelSweepFlag },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegArcRelConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegArcRelTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 15, JSSVGPathSegArcRelTableValues, 0 };
+    { 31, JSSVGPathSegArcRelTableValues, 0 };
+#else
+    { 17, 15, JSSVGPathSegArcRelTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegArcRelConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegArcRelConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegArcRelConstructorTableValues, 0 };
 #else
-    { 16, 15, JSSVGPathSegArcRelTableValues, 0 };
+    { 1, 0, JSSVGPathSegArcRelConstructorTableValues, 0 };
 #endif
 
+class JSSVGPathSegArcRelConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegArcRelConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegArcRelConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegArcRelPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegArcRelConstructor::s_info = { "SVGPathSegArcRelConstructor", 0, &JSSVGPathSegArcRelConstructorTable, 0 };
+
+bool JSSVGPathSegArcRelConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegArcRelConstructor, DOMObject>(exec, &JSSVGPathSegArcRelConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegArcRelConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegArcRelConstructor, DOMObject>(exec, &JSSVGPathSegArcRelConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegArcRelPrototypeTableValues[1] =
@@ -78,8 +126,8 @@ JSObject* JSSVGPathSegArcRelPrototype::self(ExecState* exec, JSGlobalObject* glo
 
 const ClassInfo JSSVGPathSegArcRel::s_info = { "SVGPathSegArcRel", &JSSVGPathSeg::s_info, &JSSVGPathSegArcRelTable, 0 };
 
-JSSVGPathSegArcRel::JSSVGPathSegArcRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegArcRel> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegArcRel::JSSVGPathSegArcRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegArcRel> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -98,62 +146,74 @@ bool JSSVGPathSegArcRel::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSSVGPathSegArcRel, Base>(exec, &JSSVGPathSegArcRelTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegArcRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegArcRel* castedThis = static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegArcRel* castedThis = static_cast<JSSVGPathSegArcRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsSVGPathSegArcRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegArcRel* castedThis = static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegArcRel* castedThis = static_cast<JSSVGPathSegArcRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
-JSValue jsSVGPathSegArcRelR1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelR1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegArcRel* castedThis = static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegArcRel* castedThis = static_cast<JSSVGPathSegArcRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(castedThis->impl());
-    return jsNumber(exec, imp->r1());
+    JSValue result = jsNumber(exec, imp->r1());
+    return result;
 }
 
-JSValue jsSVGPathSegArcRelR2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelR2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegArcRel* castedThis = static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegArcRel* castedThis = static_cast<JSSVGPathSegArcRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(castedThis->impl());
-    return jsNumber(exec, imp->r2());
+    JSValue result = jsNumber(exec, imp->r2());
+    return result;
 }
 
-JSValue jsSVGPathSegArcRelAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelAngle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegArcRel* castedThis = static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegArcRel* castedThis = static_cast<JSSVGPathSegArcRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(castedThis->impl());
-    return jsNumber(exec, imp->angle());
+    JSValue result = jsNumber(exec, imp->angle());
+    return result;
 }
 
-JSValue jsSVGPathSegArcRelLargeArcFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelLargeArcFlag(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegArcRel* castedThis = static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegArcRel* castedThis = static_cast<JSSVGPathSegArcRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(castedThis->impl());
-    return jsBoolean(imp->largeArcFlag());
+    JSValue result = jsBoolean(imp->largeArcFlag());
+    return result;
 }
 
-JSValue jsSVGPathSegArcRelSweepFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelSweepFlag(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegArcRel* castedThis = static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegArcRel* castedThis = static_cast<JSSVGPathSegArcRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(castedThis->impl());
-    return jsBoolean(imp->sweepFlag());
+    JSValue result = jsBoolean(imp->sweepFlag());
+    return result;
 }
 
+JSValue jsSVGPathSegArcRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegArcRel* domObject = static_cast<JSSVGPathSegArcRel*>(asObject(slotBase));
+    return JSSVGPathSegArcRel::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegArcRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegArcRel, Base>(exec, propertyName, value, &JSSVGPathSegArcRelTable, this, slot);
@@ -161,58 +221,63 @@ void JSSVGPathSegArcRel::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSSVGPathSegArcRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
+    JSSVGPathSegArcRel* castedThisObj = static_cast<JSSVGPathSegArcRel*>(thisObject);
+    SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegArcRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
+    JSSVGPathSegArcRel* castedThisObj = static_cast<JSSVGPathSegArcRel*>(thisObject);
+    SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegArcRelR1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
+    JSSVGPathSegArcRel* castedThisObj = static_cast<JSSVGPathSegArcRel*>(thisObject);
+    SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(castedThisObj->impl());
     imp->setR1(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegArcRelR2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
+    JSSVGPathSegArcRel* castedThisObj = static_cast<JSSVGPathSegArcRel*>(thisObject);
+    SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(castedThisObj->impl());
     imp->setR2(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegArcRelAngle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
+    JSSVGPathSegArcRel* castedThisObj = static_cast<JSSVGPathSegArcRel*>(thisObject);
+    SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(castedThisObj->impl());
     imp->setAngle(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegArcRelLargeArcFlag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
+    JSSVGPathSegArcRel* castedThisObj = static_cast<JSSVGPathSegArcRel*>(thisObject);
+    SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(castedThisObj->impl());
     imp->setLargeArcFlag(value.toBoolean(exec));
-    if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegArcRelSweepFlag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
+    JSSVGPathSegArcRel* castedThisObj = static_cast<JSSVGPathSegArcRel*>(thisObject);
+    SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(castedThisObj->impl());
     imp->setSweepFlag(value.toBoolean(exec));
-    if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegArcRel::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegArcRelConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
index 819d791503..7b2ffdc543 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
@@ -33,7 +33,7 @@ class SVGPathSegArcRel;
 class JSSVGPathSegArcRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegArcRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegArcRel>, SVGElement* context);
+    JSSVGPathSegArcRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegArcRel>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegArcRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,20 +69,21 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegArcRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegArcRelX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegArcRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegArcRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegArcRelY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegArcRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegArcRelR1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegArcRelR1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegArcRelR1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegArcRelR2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegArcRelR2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegArcRelR2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegArcRelAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegArcRelAngle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegArcRelAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegArcRelLargeArcFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegArcRelLargeArcFlag(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegArcRelLargeArcFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegArcRelSweepFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegArcRelSweepFlag(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegArcRelSweepFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.cpp
index 90c6dd2edc..44b9af20ce 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegClosePath);
 
+/* Hash table */
+
+static const HashTableValue JSSVGPathSegClosePathTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegClosePathConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegClosePathTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegClosePathTableValues, 0 };
+#else
+    { 2, 1, JSSVGPathSegClosePathTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegClosePathConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegClosePathConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegClosePathConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegClosePathConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegClosePathConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegClosePathConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegClosePathConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegClosePathPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegClosePathConstructor::s_info = { "SVGPathSegClosePathConstructor", 0, &JSSVGPathSegClosePathConstructorTable, 0 };
+
+bool JSSVGPathSegClosePathConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegClosePathConstructor, DOMObject>(exec, &JSSVGPathSegClosePathConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegClosePathConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegClosePathConstructor, DOMObject>(exec, &JSSVGPathSegClosePathConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegClosePathPrototypeTableValues[1] =
@@ -54,10 +116,10 @@ JSObject* JSSVGPathSegClosePathPrototype::self(ExecState* exec, JSGlobalObject*
     return getDOMPrototype<JSSVGPathSegClosePath>(exec, globalObject);
 }
 
-const ClassInfo JSSVGPathSegClosePath::s_info = { "SVGPathSegClosePath", &JSSVGPathSeg::s_info, 0, 0 };
+const ClassInfo JSSVGPathSegClosePath::s_info = { "SVGPathSegClosePath", &JSSVGPathSeg::s_info, &JSSVGPathSegClosePathTable, 0 };
 
-JSSVGPathSegClosePath::JSSVGPathSegClosePath(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegClosePath> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegClosePath::JSSVGPathSegClosePath(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegClosePath> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -66,6 +128,26 @@ JSObject* JSSVGPathSegClosePath::createPrototype(ExecState* exec, JSGlobalObject
     return new (exec) JSSVGPathSegClosePathPrototype(JSSVGPathSegClosePathPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGPathSegClosePath::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegClosePath, Base>(exec, &JSSVGPathSegClosePathTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegClosePath::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegClosePath, Base>(exec, &JSSVGPathSegClosePathTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGPathSegClosePathConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegClosePath* domObject = static_cast<JSSVGPathSegClosePath*>(asObject(slotBase));
+    return JSSVGPathSegClosePath::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGPathSegClosePath::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegClosePathConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h
index bccce459b9..9b0bd9f8c3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h
@@ -33,18 +33,21 @@ class SVGPathSegClosePath;
 class JSSVGPathSegClosePath : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegClosePath(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegClosePath>, SVGElement* context);
+    JSSVGPathSegClosePath(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegClosePath>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegClosePathPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGPathSegClosePathConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp
index 78008dd705..aa90e9da4d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp
@@ -36,24 +36,72 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicAbs);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegCurvetoCubicAbsTableValues[7] =
-{
-    { "x", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicAbsX, (intptr_t)setJSSVGPathSegCurvetoCubicAbsX },
-    { "y", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicAbsY, (intptr_t)setJSSVGPathSegCurvetoCubicAbsY },
-    { "x1", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicAbsX1, (intptr_t)setJSSVGPathSegCurvetoCubicAbsX1 },
-    { "y1", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicAbsY1, (intptr_t)setJSSVGPathSegCurvetoCubicAbsY1 },
-    { "x2", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicAbsX2, (intptr_t)setJSSVGPathSegCurvetoCubicAbsX2 },
-    { "y2", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicAbsY2, (intptr_t)setJSSVGPathSegCurvetoCubicAbsY2 },
+static const HashTableValue JSSVGPathSegCurvetoCubicAbsTableValues[8] =
+{
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicAbsX), (intptr_t)setJSSVGPathSegCurvetoCubicAbsX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicAbsY), (intptr_t)setJSSVGPathSegCurvetoCubicAbsY },
+    { "x1", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicAbsX1), (intptr_t)setJSSVGPathSegCurvetoCubicAbsX1 },
+    { "y1", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicAbsY1), (intptr_t)setJSSVGPathSegCurvetoCubicAbsY1 },
+    { "x2", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicAbsX2), (intptr_t)setJSSVGPathSegCurvetoCubicAbsX2 },
+    { "y2", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicAbsY2), (intptr_t)setJSSVGPathSegCurvetoCubicAbsY2 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicAbsConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoCubicAbsTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 7, JSSVGPathSegCurvetoCubicAbsTableValues, 0 };
+    { 15, JSSVGPathSegCurvetoCubicAbsTableValues, 0 };
 #else
     { 16, 15, JSSVGPathSegCurvetoCubicAbsTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegCurvetoCubicAbsConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoCubicAbsConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegCurvetoCubicAbsConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegCurvetoCubicAbsConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegCurvetoCubicAbsConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegCurvetoCubicAbsConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegCurvetoCubicAbsConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegCurvetoCubicAbsPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegCurvetoCubicAbsConstructor::s_info = { "SVGPathSegCurvetoCubicAbsConstructor", 0, &JSSVGPathSegCurvetoCubicAbsConstructorTable, 0 };
+
+bool JSSVGPathSegCurvetoCubicAbsConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegCurvetoCubicAbsConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoCubicAbsConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegCurvetoCubicAbsConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoCubicAbsConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoCubicAbsConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegCurvetoCubicAbsPrototypeTableValues[1] =
@@ -77,8 +125,8 @@ JSObject* JSSVGPathSegCurvetoCubicAbsPrototype::self(ExecState* exec, JSGlobalOb
 
 const ClassInfo JSSVGPathSegCurvetoCubicAbs::s_info = { "SVGPathSegCurvetoCubicAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoCubicAbsTable, 0 };
 
-JSSVGPathSegCurvetoCubicAbs::JSSVGPathSegCurvetoCubicAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoCubicAbs> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegCurvetoCubicAbs::JSSVGPathSegCurvetoCubicAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoCubicAbs> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -97,54 +145,65 @@ bool JSSVGPathSegCurvetoCubicAbs::getOwnPropertyDescriptor(ExecState* exec, cons
     return getStaticValueDescriptor<JSSVGPathSegCurvetoCubicAbs, Base>(exec, &JSSVGPathSegCurvetoCubicAbsTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegCurvetoCubicAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicAbsX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsX1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->x1());
+    JSValue result = jsNumber(exec, imp->x1());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicAbsY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsY1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->y1());
+    JSValue result = jsNumber(exec, imp->y1());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicAbsX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsX2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->x2());
+    JSValue result = jsNumber(exec, imp->x2());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicAbsY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsY2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->y2());
+    JSValue result = jsNumber(exec, imp->y2());
+    return result;
 }
 
+JSValue jsSVGPathSegCurvetoCubicAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegCurvetoCubicAbs* domObject = static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slotBase));
+    return JSSVGPathSegCurvetoCubicAbs::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegCurvetoCubicAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoCubicAbs, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoCubicAbsTable, this, slot);
@@ -152,50 +211,55 @@ void JSSVGPathSegCurvetoCubicAbs::put(ExecState* exec, const Identifier& propert
 
 void setJSSVGPathSegCurvetoCubicAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject);
+    SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject);
+    SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicAbsX1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject);
+    SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(castedThisObj->impl());
     imp->setX1(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicAbsY1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject);
+    SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(castedThisObj->impl());
     imp->setY1(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicAbsX2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject);
+    SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(castedThisObj->impl());
     imp->setX2(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicAbsY2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject);
+    SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(castedThisObj->impl());
     imp->setY2(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegCurvetoCubicAbs::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegCurvetoCubicAbsConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
index b1c676fc1f..de1ece726f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
@@ -33,7 +33,7 @@ class SVGPathSegCurvetoCubicAbs;
 class JSSVGPathSegCurvetoCubicAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegCurvetoCubicAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoCubicAbs>, SVGElement* context);
+    JSSVGPathSegCurvetoCubicAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoCubicAbs>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegCurvetoCubicAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,18 +69,19 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegCurvetoCubicAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicAbsX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsX1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicAbsX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicAbsY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsY1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicAbsY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicAbsX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsX2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicAbsX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicAbsY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsY2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicAbsY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp
index f1e34a7aff..87dff4f911 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp
@@ -36,24 +36,72 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicRel);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegCurvetoCubicRelTableValues[7] =
-{
-    { "x", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicRelX, (intptr_t)setJSSVGPathSegCurvetoCubicRelX },
-    { "y", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicRelY, (intptr_t)setJSSVGPathSegCurvetoCubicRelY },
-    { "x1", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicRelX1, (intptr_t)setJSSVGPathSegCurvetoCubicRelX1 },
-    { "y1", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicRelY1, (intptr_t)setJSSVGPathSegCurvetoCubicRelY1 },
-    { "x2", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicRelX2, (intptr_t)setJSSVGPathSegCurvetoCubicRelX2 },
-    { "y2", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicRelY2, (intptr_t)setJSSVGPathSegCurvetoCubicRelY2 },
+static const HashTableValue JSSVGPathSegCurvetoCubicRelTableValues[8] =
+{
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicRelX), (intptr_t)setJSSVGPathSegCurvetoCubicRelX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicRelY), (intptr_t)setJSSVGPathSegCurvetoCubicRelY },
+    { "x1", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicRelX1), (intptr_t)setJSSVGPathSegCurvetoCubicRelX1 },
+    { "y1", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicRelY1), (intptr_t)setJSSVGPathSegCurvetoCubicRelY1 },
+    { "x2", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicRelX2), (intptr_t)setJSSVGPathSegCurvetoCubicRelX2 },
+    { "y2", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicRelY2), (intptr_t)setJSSVGPathSegCurvetoCubicRelY2 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicRelConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoCubicRelTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 7, JSSVGPathSegCurvetoCubicRelTableValues, 0 };
+    { 15, JSSVGPathSegCurvetoCubicRelTableValues, 0 };
 #else
     { 16, 15, JSSVGPathSegCurvetoCubicRelTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegCurvetoCubicRelConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoCubicRelConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegCurvetoCubicRelConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegCurvetoCubicRelConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegCurvetoCubicRelConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegCurvetoCubicRelConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegCurvetoCubicRelConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegCurvetoCubicRelPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegCurvetoCubicRelConstructor::s_info = { "SVGPathSegCurvetoCubicRelConstructor", 0, &JSSVGPathSegCurvetoCubicRelConstructorTable, 0 };
+
+bool JSSVGPathSegCurvetoCubicRelConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegCurvetoCubicRelConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoCubicRelConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegCurvetoCubicRelConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoCubicRelConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoCubicRelConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegCurvetoCubicRelPrototypeTableValues[1] =
@@ -77,8 +125,8 @@ JSObject* JSSVGPathSegCurvetoCubicRelPrototype::self(ExecState* exec, JSGlobalOb
 
 const ClassInfo JSSVGPathSegCurvetoCubicRel::s_info = { "SVGPathSegCurvetoCubicRel", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoCubicRelTable, 0 };
 
-JSSVGPathSegCurvetoCubicRel::JSSVGPathSegCurvetoCubicRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoCubicRel> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegCurvetoCubicRel::JSSVGPathSegCurvetoCubicRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoCubicRel> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -97,54 +145,65 @@ bool JSSVGPathSegCurvetoCubicRel::getOwnPropertyDescriptor(ExecState* exec, cons
     return getStaticValueDescriptor<JSSVGPathSegCurvetoCubicRel, Base>(exec, &JSSVGPathSegCurvetoCubicRelTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegCurvetoCubicRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicRelX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelX1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(castedThis->impl());
-    return jsNumber(exec, imp->x1());
+    JSValue result = jsNumber(exec, imp->x1());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicRelY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelY1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(castedThis->impl());
-    return jsNumber(exec, imp->y1());
+    JSValue result = jsNumber(exec, imp->y1());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicRelX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelX2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(castedThis->impl());
-    return jsNumber(exec, imp->x2());
+    JSValue result = jsNumber(exec, imp->x2());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicRelY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelY2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(castedThis->impl());
-    return jsNumber(exec, imp->y2());
+    JSValue result = jsNumber(exec, imp->y2());
+    return result;
 }
 
+JSValue jsSVGPathSegCurvetoCubicRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegCurvetoCubicRel* domObject = static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slotBase));
+    return JSSVGPathSegCurvetoCubicRel::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegCurvetoCubicRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoCubicRel, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoCubicRelTable, this, slot);
@@ -152,50 +211,55 @@ void JSSVGPathSegCurvetoCubicRel::put(ExecState* exec, const Identifier& propert
 
 void setJSSVGPathSegCurvetoCubicRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicRel* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject);
+    SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicRel* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject);
+    SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicRelX1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicRel* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject);
+    SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(castedThisObj->impl());
     imp->setX1(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicRelY1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicRel* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject);
+    SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(castedThisObj->impl());
     imp->setY1(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicRelX2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicRel* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject);
+    SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(castedThisObj->impl());
     imp->setX2(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicRelY2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicRel* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject);
+    SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(castedThisObj->impl());
     imp->setY2(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegCurvetoCubicRel::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegCurvetoCubicRelConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
index 0e5cba95c9..9775215f72 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
@@ -33,7 +33,7 @@ class SVGPathSegCurvetoCubicRel;
 class JSSVGPathSegCurvetoCubicRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegCurvetoCubicRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoCubicRel>, SVGElement* context);
+    JSSVGPathSegCurvetoCubicRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoCubicRel>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegCurvetoCubicRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,18 +69,19 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegCurvetoCubicRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicRelX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelX1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicRelX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicRelY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelY1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicRelY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicRelX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelX2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicRelX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicRelY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelY2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicRelY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp
index 3b26bfb2f1..1287d9872a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp
@@ -36,22 +36,70 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicSmoothAbs);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegCurvetoCubicSmoothAbsTableValues[5] =
+static const HashTableValue JSSVGPathSegCurvetoCubicSmoothAbsTableValues[6] =
 {
-    { "x", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicSmoothAbsX, (intptr_t)setJSSVGPathSegCurvetoCubicSmoothAbsX },
-    { "y", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicSmoothAbsY, (intptr_t)setJSSVGPathSegCurvetoCubicSmoothAbsY },
-    { "x2", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicSmoothAbsX2, (intptr_t)setJSSVGPathSegCurvetoCubicSmoothAbsX2 },
-    { "y2", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicSmoothAbsY2, (intptr_t)setJSSVGPathSegCurvetoCubicSmoothAbsY2 },
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicSmoothAbsX), (intptr_t)setJSSVGPathSegCurvetoCubicSmoothAbsX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicSmoothAbsY), (intptr_t)setJSSVGPathSegCurvetoCubicSmoothAbsY },
+    { "x2", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicSmoothAbsX2), (intptr_t)setJSSVGPathSegCurvetoCubicSmoothAbsX2 },
+    { "y2", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicSmoothAbsY2), (intptr_t)setJSSVGPathSegCurvetoCubicSmoothAbsY2 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicSmoothAbsConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoCubicSmoothAbsTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 7, JSSVGPathSegCurvetoCubicSmoothAbsTableValues, 0 };
+    { 15, JSSVGPathSegCurvetoCubicSmoothAbsTableValues, 0 };
 #else
-    { 8, 7, JSSVGPathSegCurvetoCubicSmoothAbsTableValues, 0 };
+    { 16, 15, JSSVGPathSegCurvetoCubicSmoothAbsTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegCurvetoCubicSmoothAbsConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoCubicSmoothAbsConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegCurvetoCubicSmoothAbsConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegCurvetoCubicSmoothAbsConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegCurvetoCubicSmoothAbsConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegCurvetoCubicSmoothAbsConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegCurvetoCubicSmoothAbsConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegCurvetoCubicSmoothAbsPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegCurvetoCubicSmoothAbsConstructor::s_info = { "SVGPathSegCurvetoCubicSmoothAbsConstructor", 0, &JSSVGPathSegCurvetoCubicSmoothAbsConstructorTable, 0 };
+
+bool JSSVGPathSegCurvetoCubicSmoothAbsConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegCurvetoCubicSmoothAbsConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoCubicSmoothAbsConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegCurvetoCubicSmoothAbsConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoCubicSmoothAbsConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoCubicSmoothAbsConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegCurvetoCubicSmoothAbsPrototypeTableValues[1] =
@@ -75,8 +123,8 @@ JSObject* JSSVGPathSegCurvetoCubicSmoothAbsPrototype::self(ExecState* exec, JSGl
 
 const ClassInfo JSSVGPathSegCurvetoCubicSmoothAbs::s_info = { "SVGPathSegCurvetoCubicSmoothAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoCubicSmoothAbsTable, 0 };
 
-JSSVGPathSegCurvetoCubicSmoothAbs::JSSVGPathSegCurvetoCubicSmoothAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoCubicSmoothAbs> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegCurvetoCubicSmoothAbs::JSSVGPathSegCurvetoCubicSmoothAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoCubicSmoothAbs> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -95,38 +143,47 @@ bool JSSVGPathSegCurvetoCubicSmoothAbs::getOwnPropertyDescriptor(ExecState* exec
     return getStaticValueDescriptor<JSSVGPathSegCurvetoCubicSmoothAbs, Base>(exec, &JSSVGPathSegCurvetoCubicSmoothAbsTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegCurvetoCubicSmoothAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothAbsX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicSmoothAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicSmoothAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicSmoothAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothAbsY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicSmoothAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicSmoothAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicSmoothAbsX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothAbsX2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicSmoothAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicSmoothAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->x2());
+    JSValue result = jsNumber(exec, imp->x2());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicSmoothAbsY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothAbsY2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicSmoothAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicSmoothAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->y2());
+    JSValue result = jsNumber(exec, imp->y2());
+    return result;
 }
 
+JSValue jsSVGPathSegCurvetoCubicSmoothAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegCurvetoCubicSmoothAbs* domObject = static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slotBase));
+    return JSSVGPathSegCurvetoCubicSmoothAbs::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegCurvetoCubicSmoothAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoCubicSmoothAbs, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoCubicSmoothAbsTable, this, slot);
@@ -134,34 +191,39 @@ void JSSVGPathSegCurvetoCubicSmoothAbs::put(ExecState* exec, const Identifier& p
 
 void setJSSVGPathSegCurvetoCubicSmoothAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicSmoothAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject);
+    SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicSmoothAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicSmoothAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject);
+    SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicSmoothAbsX2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicSmoothAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject);
+    SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(castedThisObj->impl());
     imp->setX2(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicSmoothAbsY2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicSmoothAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject);
+    SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(castedThisObj->impl());
     imp->setY2(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegCurvetoCubicSmoothAbs::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegCurvetoCubicSmoothAbsConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
index 478a81de9d..b901a3be60 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
@@ -33,7 +33,7 @@ class SVGPathSegCurvetoCubicSmoothAbs;
 class JSSVGPathSegCurvetoCubicSmoothAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegCurvetoCubicSmoothAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoCubicSmoothAbs>, SVGElement* context);
+    JSSVGPathSegCurvetoCubicSmoothAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoCubicSmoothAbs>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegCurvetoCubicSmoothAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,14 +69,15 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicSmoothAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicSmoothAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsX2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicSmoothAbsX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsY2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicSmoothAbsY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp
index a4ed8ad670..e63bdd17e8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp
@@ -36,22 +36,70 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicSmoothRel);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegCurvetoCubicSmoothRelTableValues[5] =
+static const HashTableValue JSSVGPathSegCurvetoCubicSmoothRelTableValues[6] =
 {
-    { "x", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicSmoothRelX, (intptr_t)setJSSVGPathSegCurvetoCubicSmoothRelX },
-    { "y", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicSmoothRelY, (intptr_t)setJSSVGPathSegCurvetoCubicSmoothRelY },
-    { "x2", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicSmoothRelX2, (intptr_t)setJSSVGPathSegCurvetoCubicSmoothRelX2 },
-    { "y2", DontDelete, (intptr_t)jsSVGPathSegCurvetoCubicSmoothRelY2, (intptr_t)setJSSVGPathSegCurvetoCubicSmoothRelY2 },
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicSmoothRelX), (intptr_t)setJSSVGPathSegCurvetoCubicSmoothRelX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicSmoothRelY), (intptr_t)setJSSVGPathSegCurvetoCubicSmoothRelY },
+    { "x2", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicSmoothRelX2), (intptr_t)setJSSVGPathSegCurvetoCubicSmoothRelX2 },
+    { "y2", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicSmoothRelY2), (intptr_t)setJSSVGPathSegCurvetoCubicSmoothRelY2 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoCubicSmoothRelConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoCubicSmoothRelTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 7, JSSVGPathSegCurvetoCubicSmoothRelTableValues, 0 };
+    { 15, JSSVGPathSegCurvetoCubicSmoothRelTableValues, 0 };
 #else
-    { 8, 7, JSSVGPathSegCurvetoCubicSmoothRelTableValues, 0 };
+    { 16, 15, JSSVGPathSegCurvetoCubicSmoothRelTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegCurvetoCubicSmoothRelConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoCubicSmoothRelConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegCurvetoCubicSmoothRelConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegCurvetoCubicSmoothRelConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegCurvetoCubicSmoothRelConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegCurvetoCubicSmoothRelConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegCurvetoCubicSmoothRelConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegCurvetoCubicSmoothRelPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegCurvetoCubicSmoothRelConstructor::s_info = { "SVGPathSegCurvetoCubicSmoothRelConstructor", 0, &JSSVGPathSegCurvetoCubicSmoothRelConstructorTable, 0 };
+
+bool JSSVGPathSegCurvetoCubicSmoothRelConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegCurvetoCubicSmoothRelConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoCubicSmoothRelConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegCurvetoCubicSmoothRelConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoCubicSmoothRelConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoCubicSmoothRelConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegCurvetoCubicSmoothRelPrototypeTableValues[1] =
@@ -75,8 +123,8 @@ JSObject* JSSVGPathSegCurvetoCubicSmoothRelPrototype::self(ExecState* exec, JSGl
 
 const ClassInfo JSSVGPathSegCurvetoCubicSmoothRel::s_info = { "SVGPathSegCurvetoCubicSmoothRel", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoCubicSmoothRelTable, 0 };
 
-JSSVGPathSegCurvetoCubicSmoothRel::JSSVGPathSegCurvetoCubicSmoothRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoCubicSmoothRel> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegCurvetoCubicSmoothRel::JSSVGPathSegCurvetoCubicSmoothRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoCubicSmoothRel> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -95,38 +143,47 @@ bool JSSVGPathSegCurvetoCubicSmoothRel::getOwnPropertyDescriptor(ExecState* exec
     return getStaticValueDescriptor<JSSVGPathSegCurvetoCubicSmoothRel, Base>(exec, &JSSVGPathSegCurvetoCubicSmoothRelTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegCurvetoCubicSmoothRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothRelX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicSmoothRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicSmoothRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicSmoothRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothRelY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicSmoothRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicSmoothRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicSmoothRelX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothRelX2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicSmoothRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicSmoothRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(castedThis->impl());
-    return jsNumber(exec, imp->x2());
+    JSValue result = jsNumber(exec, imp->x2());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoCubicSmoothRelY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothRelY2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoCubicSmoothRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoCubicSmoothRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(castedThis->impl());
-    return jsNumber(exec, imp->y2());
+    JSValue result = jsNumber(exec, imp->y2());
+    return result;
 }
 
+JSValue jsSVGPathSegCurvetoCubicSmoothRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegCurvetoCubicSmoothRel* domObject = static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slotBase));
+    return JSSVGPathSegCurvetoCubicSmoothRel::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegCurvetoCubicSmoothRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoCubicSmoothRel, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoCubicSmoothRelTable, this, slot);
@@ -134,34 +191,39 @@ void JSSVGPathSegCurvetoCubicSmoothRel::put(ExecState* exec, const Identifier& p
 
 void setJSSVGPathSegCurvetoCubicSmoothRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicSmoothRel* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject);
+    SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicSmoothRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicSmoothRel* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject);
+    SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicSmoothRelX2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicSmoothRel* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject);
+    SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(castedThisObj->impl());
     imp->setX2(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoCubicSmoothRelY2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoCubicSmoothRel* castedThisObj = static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject);
+    SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(castedThisObj->impl());
     imp->setY2(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegCurvetoCubicSmoothRel::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegCurvetoCubicSmoothRelConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
index 799df239e2..6494c900e3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
@@ -33,7 +33,7 @@ class SVGPathSegCurvetoCubicSmoothRel;
 class JSSVGPathSegCurvetoCubicSmoothRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegCurvetoCubicSmoothRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoCubicSmoothRel>, SVGElement* context);
+    JSSVGPathSegCurvetoCubicSmoothRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoCubicSmoothRel>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegCurvetoCubicSmoothRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,14 +69,15 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicSmoothRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicSmoothRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelX2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicSmoothRelX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelY2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoCubicSmoothRelY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp
index e1a06d9526..776009e92c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp
@@ -36,22 +36,70 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticAbs);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegCurvetoQuadraticAbsTableValues[5] =
+static const HashTableValue JSSVGPathSegCurvetoQuadraticAbsTableValues[6] =
 {
-    { "x", DontDelete, (intptr_t)jsSVGPathSegCurvetoQuadraticAbsX, (intptr_t)setJSSVGPathSegCurvetoQuadraticAbsX },
-    { "y", DontDelete, (intptr_t)jsSVGPathSegCurvetoQuadraticAbsY, (intptr_t)setJSSVGPathSegCurvetoQuadraticAbsY },
-    { "x1", DontDelete, (intptr_t)jsSVGPathSegCurvetoQuadraticAbsX1, (intptr_t)setJSSVGPathSegCurvetoQuadraticAbsX1 },
-    { "y1", DontDelete, (intptr_t)jsSVGPathSegCurvetoQuadraticAbsY1, (intptr_t)setJSSVGPathSegCurvetoQuadraticAbsY1 },
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticAbsX), (intptr_t)setJSSVGPathSegCurvetoQuadraticAbsX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticAbsY), (intptr_t)setJSSVGPathSegCurvetoQuadraticAbsY },
+    { "x1", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticAbsX1), (intptr_t)setJSSVGPathSegCurvetoQuadraticAbsX1 },
+    { "y1", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticAbsY1), (intptr_t)setJSSVGPathSegCurvetoQuadraticAbsY1 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticAbsConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoQuadraticAbsTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 3, JSSVGPathSegCurvetoQuadraticAbsTableValues, 0 };
+    { 15, JSSVGPathSegCurvetoQuadraticAbsTableValues, 0 };
 #else
-    { 8, 7, JSSVGPathSegCurvetoQuadraticAbsTableValues, 0 };
+    { 16, 15, JSSVGPathSegCurvetoQuadraticAbsTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegCurvetoQuadraticAbsConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoQuadraticAbsConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegCurvetoQuadraticAbsConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegCurvetoQuadraticAbsConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegCurvetoQuadraticAbsConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegCurvetoQuadraticAbsConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegCurvetoQuadraticAbsConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegCurvetoQuadraticAbsPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegCurvetoQuadraticAbsConstructor::s_info = { "SVGPathSegCurvetoQuadraticAbsConstructor", 0, &JSSVGPathSegCurvetoQuadraticAbsConstructorTable, 0 };
+
+bool JSSVGPathSegCurvetoQuadraticAbsConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticAbsConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoQuadraticAbsConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegCurvetoQuadraticAbsConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoQuadraticAbsConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoQuadraticAbsConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegCurvetoQuadraticAbsPrototypeTableValues[1] =
@@ -75,8 +123,8 @@ JSObject* JSSVGPathSegCurvetoQuadraticAbsPrototype::self(ExecState* exec, JSGlob
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticAbs::s_info = { "SVGPathSegCurvetoQuadraticAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoQuadraticAbsTable, 0 };
 
-JSSVGPathSegCurvetoQuadraticAbs::JSSVGPathSegCurvetoQuadraticAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoQuadraticAbs> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegCurvetoQuadraticAbs::JSSVGPathSegCurvetoQuadraticAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoQuadraticAbs> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -95,38 +143,47 @@ bool JSSVGPathSegCurvetoQuadraticAbs::getOwnPropertyDescriptor(ExecState* exec,
     return getStaticValueDescriptor<JSSVGPathSegCurvetoQuadraticAbs, Base>(exec, &JSSVGPathSegCurvetoQuadraticAbsTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegCurvetoQuadraticAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticAbsX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoQuadraticAbs* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoQuadraticAbs* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoQuadraticAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticAbsY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoQuadraticAbs* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoQuadraticAbs* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoQuadraticAbsX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticAbsX1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoQuadraticAbs* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoQuadraticAbs* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->x1());
+    JSValue result = jsNumber(exec, imp->x1());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoQuadraticAbsY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticAbsY1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoQuadraticAbs* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoQuadraticAbs* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->y1());
+    JSValue result = jsNumber(exec, imp->y1());
+    return result;
 }
 
+JSValue jsSVGPathSegCurvetoQuadraticAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegCurvetoQuadraticAbs* domObject = static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slotBase));
+    return JSSVGPathSegCurvetoQuadraticAbs::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegCurvetoQuadraticAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoQuadraticAbs, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoQuadraticAbsTable, this, slot);
@@ -134,34 +191,39 @@ void JSSVGPathSegCurvetoQuadraticAbs::put(ExecState* exec, const Identifier& pro
 
 void setJSSVGPathSegCurvetoQuadraticAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoQuadraticAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject);
+    SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoQuadraticAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoQuadraticAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject);
+    SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoQuadraticAbsX1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoQuadraticAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject);
+    SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(castedThisObj->impl());
     imp->setX1(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoQuadraticAbsY1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoQuadraticAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject);
+    SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(castedThisObj->impl());
     imp->setY1(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegCurvetoQuadraticAbs::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegCurvetoQuadraticAbsConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
index e29bb762ef..fbe93fc03d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
@@ -33,7 +33,7 @@ class SVGPathSegCurvetoQuadraticAbs;
 class JSSVGPathSegCurvetoQuadraticAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegCurvetoQuadraticAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoQuadraticAbs>, SVGElement* context);
+    JSSVGPathSegCurvetoQuadraticAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoQuadraticAbs>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegCurvetoQuadraticAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,14 +69,15 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoQuadraticAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoQuadraticAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsX1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoQuadraticAbsX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsY1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoQuadraticAbsY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp
index 52c3f37b01..365b08fa06 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp
@@ -36,22 +36,70 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticRel);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegCurvetoQuadraticRelTableValues[5] =
+static const HashTableValue JSSVGPathSegCurvetoQuadraticRelTableValues[6] =
 {
-    { "x", DontDelete, (intptr_t)jsSVGPathSegCurvetoQuadraticRelX, (intptr_t)setJSSVGPathSegCurvetoQuadraticRelX },
-    { "y", DontDelete, (intptr_t)jsSVGPathSegCurvetoQuadraticRelY, (intptr_t)setJSSVGPathSegCurvetoQuadraticRelY },
-    { "x1", DontDelete, (intptr_t)jsSVGPathSegCurvetoQuadraticRelX1, (intptr_t)setJSSVGPathSegCurvetoQuadraticRelX1 },
-    { "y1", DontDelete, (intptr_t)jsSVGPathSegCurvetoQuadraticRelY1, (intptr_t)setJSSVGPathSegCurvetoQuadraticRelY1 },
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticRelX), (intptr_t)setJSSVGPathSegCurvetoQuadraticRelX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticRelY), (intptr_t)setJSSVGPathSegCurvetoQuadraticRelY },
+    { "x1", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticRelX1), (intptr_t)setJSSVGPathSegCurvetoQuadraticRelX1 },
+    { "y1", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticRelY1), (intptr_t)setJSSVGPathSegCurvetoQuadraticRelY1 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticRelConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoQuadraticRelTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 3, JSSVGPathSegCurvetoQuadraticRelTableValues, 0 };
+    { 15, JSSVGPathSegCurvetoQuadraticRelTableValues, 0 };
 #else
-    { 8, 7, JSSVGPathSegCurvetoQuadraticRelTableValues, 0 };
+    { 16, 15, JSSVGPathSegCurvetoQuadraticRelTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegCurvetoQuadraticRelConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoQuadraticRelConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegCurvetoQuadraticRelConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegCurvetoQuadraticRelConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegCurvetoQuadraticRelConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegCurvetoQuadraticRelConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegCurvetoQuadraticRelConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegCurvetoQuadraticRelPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegCurvetoQuadraticRelConstructor::s_info = { "SVGPathSegCurvetoQuadraticRelConstructor", 0, &JSSVGPathSegCurvetoQuadraticRelConstructorTable, 0 };
+
+bool JSSVGPathSegCurvetoQuadraticRelConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticRelConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoQuadraticRelConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegCurvetoQuadraticRelConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoQuadraticRelConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoQuadraticRelConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegCurvetoQuadraticRelPrototypeTableValues[1] =
@@ -75,8 +123,8 @@ JSObject* JSSVGPathSegCurvetoQuadraticRelPrototype::self(ExecState* exec, JSGlob
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticRel::s_info = { "SVGPathSegCurvetoQuadraticRel", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoQuadraticRelTable, 0 };
 
-JSSVGPathSegCurvetoQuadraticRel::JSSVGPathSegCurvetoQuadraticRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoQuadraticRel> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegCurvetoQuadraticRel::JSSVGPathSegCurvetoQuadraticRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoQuadraticRel> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -95,38 +143,47 @@ bool JSSVGPathSegCurvetoQuadraticRel::getOwnPropertyDescriptor(ExecState* exec,
     return getStaticValueDescriptor<JSSVGPathSegCurvetoQuadraticRel, Base>(exec, &JSSVGPathSegCurvetoQuadraticRelTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegCurvetoQuadraticRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticRelX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoQuadraticRel* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoQuadraticRel* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoQuadraticRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticRelY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoQuadraticRel* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoQuadraticRel* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoQuadraticRelX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticRelX1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoQuadraticRel* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoQuadraticRel* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(castedThis->impl());
-    return jsNumber(exec, imp->x1());
+    JSValue result = jsNumber(exec, imp->x1());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoQuadraticRelY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticRelY1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoQuadraticRel* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoQuadraticRel* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(castedThis->impl());
-    return jsNumber(exec, imp->y1());
+    JSValue result = jsNumber(exec, imp->y1());
+    return result;
 }
 
+JSValue jsSVGPathSegCurvetoQuadraticRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegCurvetoQuadraticRel* domObject = static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slotBase));
+    return JSSVGPathSegCurvetoQuadraticRel::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegCurvetoQuadraticRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoQuadraticRel, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoQuadraticRelTable, this, slot);
@@ -134,34 +191,39 @@ void JSSVGPathSegCurvetoQuadraticRel::put(ExecState* exec, const Identifier& pro
 
 void setJSSVGPathSegCurvetoQuadraticRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoQuadraticRel* castedThisObj = static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject);
+    SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoQuadraticRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoQuadraticRel* castedThisObj = static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject);
+    SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoQuadraticRelX1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoQuadraticRel* castedThisObj = static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject);
+    SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(castedThisObj->impl());
     imp->setX1(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoQuadraticRelY1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoQuadraticRel* castedThisObj = static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject);
+    SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(castedThisObj->impl());
     imp->setY1(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegCurvetoQuadraticRel::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegCurvetoQuadraticRelConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
index d348b02d76..7b5e566a30 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
@@ -33,7 +33,7 @@ class SVGPathSegCurvetoQuadraticRel;
 class JSSVGPathSegCurvetoQuadraticRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegCurvetoQuadraticRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoQuadraticRel>, SVGElement* context);
+    JSSVGPathSegCurvetoQuadraticRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoQuadraticRel>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegCurvetoQuadraticRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,14 +69,15 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegCurvetoQuadraticRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticRelX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoQuadraticRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoQuadraticRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticRelY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoQuadraticRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoQuadraticRelX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticRelX1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoQuadraticRelX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoQuadraticRelY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticRelY1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoQuadraticRelY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp
index 24c024c7ac..332cbbe3b5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp
@@ -36,20 +36,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticSmoothAbs);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegCurvetoQuadraticSmoothAbsTableValues[3] =
+static const HashTableValue JSSVGPathSegCurvetoQuadraticSmoothAbsTableValues[4] =
 {
-    { "x", DontDelete, (intptr_t)jsSVGPathSegCurvetoQuadraticSmoothAbsX, (intptr_t)setJSSVGPathSegCurvetoQuadraticSmoothAbsX },
-    { "y", DontDelete, (intptr_t)jsSVGPathSegCurvetoQuadraticSmoothAbsY, (intptr_t)setJSSVGPathSegCurvetoQuadraticSmoothAbsY },
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticSmoothAbsX), (intptr_t)setJSSVGPathSegCurvetoQuadraticSmoothAbsX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticSmoothAbsY), (intptr_t)setJSSVGPathSegCurvetoQuadraticSmoothAbsY },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticSmoothAbsConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoQuadraticSmoothAbsTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGPathSegCurvetoQuadraticSmoothAbsTableValues, 0 };
+    { 15, JSSVGPathSegCurvetoQuadraticSmoothAbsTableValues, 0 };
 #else
-    { 4, 3, JSSVGPathSegCurvetoQuadraticSmoothAbsTableValues, 0 };
+    { 9, 7, JSSVGPathSegCurvetoQuadraticSmoothAbsTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegCurvetoQuadraticSmoothAbsConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoQuadraticSmoothAbsConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegCurvetoQuadraticSmoothAbsConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegCurvetoQuadraticSmoothAbsConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegCurvetoQuadraticSmoothAbsConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegCurvetoQuadraticSmoothAbsConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegCurvetoQuadraticSmoothAbsConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegCurvetoQuadraticSmoothAbsConstructor::s_info = { "SVGPathSegCurvetoQuadraticSmoothAbsConstructor", 0, &JSSVGPathSegCurvetoQuadraticSmoothAbsConstructorTable, 0 };
+
+bool JSSVGPathSegCurvetoQuadraticSmoothAbsConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticSmoothAbsConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoQuadraticSmoothAbsConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegCurvetoQuadraticSmoothAbsConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoQuadraticSmoothAbsConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoQuadraticSmoothAbsConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegCurvetoQuadraticSmoothAbsPrototypeTableValues[1] =
@@ -73,8 +121,8 @@ JSObject* JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype::self(ExecState* exec,
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticSmoothAbs::s_info = { "SVGPathSegCurvetoQuadraticSmoothAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoQuadraticSmoothAbsTable, 0 };
 
-JSSVGPathSegCurvetoQuadraticSmoothAbs::JSSVGPathSegCurvetoQuadraticSmoothAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoQuadraticSmoothAbs> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegCurvetoQuadraticSmoothAbs::JSSVGPathSegCurvetoQuadraticSmoothAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoQuadraticSmoothAbs> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -93,22 +141,29 @@ bool JSSVGPathSegCurvetoQuadraticSmoothAbs::getOwnPropertyDescriptor(ExecState*
     return getStaticValueDescriptor<JSSVGPathSegCurvetoQuadraticSmoothAbs, Base>(exec, &JSSVGPathSegCurvetoQuadraticSmoothAbsTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoQuadraticSmoothAbs* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoQuadraticSmoothAbs* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticSmoothAbs* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoQuadraticSmoothAbs* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoQuadraticSmoothAbs* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticSmoothAbs* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
+JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegCurvetoQuadraticSmoothAbs* domObject = static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(asObject(slotBase));
+    return JSSVGPathSegCurvetoQuadraticSmoothAbs::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegCurvetoQuadraticSmoothAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoQuadraticSmoothAbs, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoQuadraticSmoothAbsTable, this, slot);
@@ -116,18 +171,23 @@ void JSSVGPathSegCurvetoQuadraticSmoothAbs::put(ExecState* exec, const Identifie
 
 void setJSSVGPathSegCurvetoQuadraticSmoothAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoQuadraticSmoothAbs* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoQuadraticSmoothAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject);
+    SVGPathSegCurvetoQuadraticSmoothAbs* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothAbs*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoQuadraticSmoothAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoQuadraticSmoothAbs* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->impl());
+    JSSVGPathSegCurvetoQuadraticSmoothAbs* castedThisObj = static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject);
+    SVGPathSegCurvetoQuadraticSmoothAbs* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothAbs*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegCurvetoQuadraticSmoothAbs::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegCurvetoQuadraticSmoothAbsConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
index 9cf156280c..fe4b1a282d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
@@ -33,7 +33,7 @@ class SVGPathSegCurvetoQuadraticSmoothAbs;
 class JSSVGPathSegCurvetoQuadraticSmoothAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegCurvetoQuadraticSmoothAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoQuadraticSmoothAbs>, SVGElement* context);
+    JSSVGPathSegCurvetoQuadraticSmoothAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoQuadraticSmoothAbs>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,10 +69,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoQuadraticSmoothAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoQuadraticSmoothAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp
index 85b570c0a9..06a82149c0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp
@@ -36,20 +36,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticSmoothRel);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegCurvetoQuadraticSmoothRelTableValues[3] =
+static const HashTableValue JSSVGPathSegCurvetoQuadraticSmoothRelTableValues[4] =
 {
-    { "x", DontDelete, (intptr_t)jsSVGPathSegCurvetoQuadraticSmoothRelX, (intptr_t)setJSSVGPathSegCurvetoQuadraticSmoothRelX },
-    { "y", DontDelete, (intptr_t)jsSVGPathSegCurvetoQuadraticSmoothRelY, (intptr_t)setJSSVGPathSegCurvetoQuadraticSmoothRelY },
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticSmoothRelX), (intptr_t)setJSSVGPathSegCurvetoQuadraticSmoothRelX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticSmoothRelY), (intptr_t)setJSSVGPathSegCurvetoQuadraticSmoothRelY },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegCurvetoQuadraticSmoothRelConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoQuadraticSmoothRelTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGPathSegCurvetoQuadraticSmoothRelTableValues, 0 };
+    { 15, JSSVGPathSegCurvetoQuadraticSmoothRelTableValues, 0 };
 #else
-    { 4, 3, JSSVGPathSegCurvetoQuadraticSmoothRelTableValues, 0 };
+    { 9, 7, JSSVGPathSegCurvetoQuadraticSmoothRelTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegCurvetoQuadraticSmoothRelConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegCurvetoQuadraticSmoothRelConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegCurvetoQuadraticSmoothRelConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegCurvetoQuadraticSmoothRelConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegCurvetoQuadraticSmoothRelConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegCurvetoQuadraticSmoothRelConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegCurvetoQuadraticSmoothRelConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegCurvetoQuadraticSmoothRelPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegCurvetoQuadraticSmoothRelConstructor::s_info = { "SVGPathSegCurvetoQuadraticSmoothRelConstructor", 0, &JSSVGPathSegCurvetoQuadraticSmoothRelConstructorTable, 0 };
+
+bool JSSVGPathSegCurvetoQuadraticSmoothRelConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticSmoothRelConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoQuadraticSmoothRelConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegCurvetoQuadraticSmoothRelConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoQuadraticSmoothRelConstructor, DOMObject>(exec, &JSSVGPathSegCurvetoQuadraticSmoothRelConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegCurvetoQuadraticSmoothRelPrototypeTableValues[1] =
@@ -73,8 +121,8 @@ JSObject* JSSVGPathSegCurvetoQuadraticSmoothRelPrototype::self(ExecState* exec,
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticSmoothRel::s_info = { "SVGPathSegCurvetoQuadraticSmoothRel", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoQuadraticSmoothRelTable, 0 };
 
-JSSVGPathSegCurvetoQuadraticSmoothRel::JSSVGPathSegCurvetoQuadraticSmoothRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoQuadraticSmoothRel> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegCurvetoQuadraticSmoothRel::JSSVGPathSegCurvetoQuadraticSmoothRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegCurvetoQuadraticSmoothRel> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -93,22 +141,29 @@ bool JSSVGPathSegCurvetoQuadraticSmoothRel::getOwnPropertyDescriptor(ExecState*
     return getStaticValueDescriptor<JSSVGPathSegCurvetoQuadraticSmoothRel, Base>(exec, &JSSVGPathSegCurvetoQuadraticSmoothRelTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegCurvetoQuadraticSmoothRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticSmoothRelX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoQuadraticSmoothRel* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoQuadraticSmoothRel* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticSmoothRel* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothRel*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsSVGPathSegCurvetoQuadraticSmoothRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticSmoothRelY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegCurvetoQuadraticSmoothRel* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegCurvetoQuadraticSmoothRel* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticSmoothRel* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothRel*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
+JSValue jsSVGPathSegCurvetoQuadraticSmoothRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegCurvetoQuadraticSmoothRel* domObject = static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(asObject(slotBase));
+    return JSSVGPathSegCurvetoQuadraticSmoothRel::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegCurvetoQuadraticSmoothRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoQuadraticSmoothRel, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoQuadraticSmoothRelTable, this, slot);
@@ -116,18 +171,23 @@ void JSSVGPathSegCurvetoQuadraticSmoothRel::put(ExecState* exec, const Identifie
 
 void setJSSVGPathSegCurvetoQuadraticSmoothRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoQuadraticSmoothRel* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothRel*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoQuadraticSmoothRel* castedThisObj = static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject);
+    SVGPathSegCurvetoQuadraticSmoothRel* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothRel*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegCurvetoQuadraticSmoothRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegCurvetoQuadraticSmoothRel* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothRel*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->impl());
+    JSSVGPathSegCurvetoQuadraticSmoothRel* castedThisObj = static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject);
+    SVGPathSegCurvetoQuadraticSmoothRel* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothRel*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegCurvetoQuadraticSmoothRel::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegCurvetoQuadraticSmoothRelConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
index 9b2d888cdd..b1b07a93e0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
@@ -33,7 +33,7 @@ class SVGPathSegCurvetoQuadraticSmoothRel;
 class JSSVGPathSegCurvetoQuadraticSmoothRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegCurvetoQuadraticSmoothRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoQuadraticSmoothRel>, SVGElement* context);
+    JSSVGPathSegCurvetoQuadraticSmoothRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoQuadraticSmoothRel>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegCurvetoQuadraticSmoothRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,10 +69,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothRelX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoQuadraticSmoothRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothRelY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegCurvetoQuadraticSmoothRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp
index c48624b42f..e5960eadc9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp
@@ -36,20 +36,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoAbs);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegLinetoAbsTableValues[3] =
+static const HashTableValue JSSVGPathSegLinetoAbsTableValues[4] =
 {
-    { "x", DontDelete, (intptr_t)jsSVGPathSegLinetoAbsX, (intptr_t)setJSSVGPathSegLinetoAbsX },
-    { "y", DontDelete, (intptr_t)jsSVGPathSegLinetoAbsY, (intptr_t)setJSSVGPathSegLinetoAbsY },
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegLinetoAbsX), (intptr_t)setJSSVGPathSegLinetoAbsX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegLinetoAbsY), (intptr_t)setJSSVGPathSegLinetoAbsY },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegLinetoAbsConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegLinetoAbsTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGPathSegLinetoAbsTableValues, 0 };
+    { 15, JSSVGPathSegLinetoAbsTableValues, 0 };
 #else
-    { 4, 3, JSSVGPathSegLinetoAbsTableValues, 0 };
+    { 9, 7, JSSVGPathSegLinetoAbsTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegLinetoAbsConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegLinetoAbsConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegLinetoAbsConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegLinetoAbsConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegLinetoAbsConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegLinetoAbsConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegLinetoAbsConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegLinetoAbsPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegLinetoAbsConstructor::s_info = { "SVGPathSegLinetoAbsConstructor", 0, &JSSVGPathSegLinetoAbsConstructorTable, 0 };
+
+bool JSSVGPathSegLinetoAbsConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegLinetoAbsConstructor, DOMObject>(exec, &JSSVGPathSegLinetoAbsConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegLinetoAbsConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegLinetoAbsConstructor, DOMObject>(exec, &JSSVGPathSegLinetoAbsConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegLinetoAbsPrototypeTableValues[1] =
@@ -73,8 +121,8 @@ JSObject* JSSVGPathSegLinetoAbsPrototype::self(ExecState* exec, JSGlobalObject*
 
 const ClassInfo JSSVGPathSegLinetoAbs::s_info = { "SVGPathSegLinetoAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoAbsTable, 0 };
 
-JSSVGPathSegLinetoAbs::JSSVGPathSegLinetoAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegLinetoAbs> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegLinetoAbs::JSSVGPathSegLinetoAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegLinetoAbs> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -93,22 +141,29 @@ bool JSSVGPathSegLinetoAbs::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSSVGPathSegLinetoAbs, Base>(exec, &JSSVGPathSegLinetoAbsTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegLinetoAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoAbsX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegLinetoAbs* castedThis = static_cast<JSSVGPathSegLinetoAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegLinetoAbs* castedThis = static_cast<JSSVGPathSegLinetoAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegLinetoAbs* imp = static_cast<SVGPathSegLinetoAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsSVGPathSegLinetoAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoAbsY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegLinetoAbs* castedThis = static_cast<JSSVGPathSegLinetoAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegLinetoAbs* castedThis = static_cast<JSSVGPathSegLinetoAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegLinetoAbs* imp = static_cast<SVGPathSegLinetoAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
+JSValue jsSVGPathSegLinetoAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegLinetoAbs* domObject = static_cast<JSSVGPathSegLinetoAbs*>(asObject(slotBase));
+    return JSSVGPathSegLinetoAbs::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegLinetoAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoAbs, Base>(exec, propertyName, value, &JSSVGPathSegLinetoAbsTable, this, slot);
@@ -116,18 +171,23 @@ void JSSVGPathSegLinetoAbs::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSSVGPathSegLinetoAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegLinetoAbs* imp = static_cast<SVGPathSegLinetoAbs*>(static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->impl());
+    JSSVGPathSegLinetoAbs* castedThisObj = static_cast<JSSVGPathSegLinetoAbs*>(thisObject);
+    SVGPathSegLinetoAbs* imp = static_cast<SVGPathSegLinetoAbs*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegLinetoAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegLinetoAbs* imp = static_cast<SVGPathSegLinetoAbs*>(static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->impl());
+    JSSVGPathSegLinetoAbs* castedThisObj = static_cast<JSSVGPathSegLinetoAbs*>(thisObject);
+    SVGPathSegLinetoAbs* imp = static_cast<SVGPathSegLinetoAbs*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegLinetoAbs::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegLinetoAbsConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
index bcd5ee1e29..a8f531d478 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
@@ -33,7 +33,7 @@ class SVGPathSegLinetoAbs;
 class JSSVGPathSegLinetoAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegLinetoAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoAbs>, SVGElement* context);
+    JSSVGPathSegLinetoAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoAbs>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegLinetoAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,10 +69,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegLinetoAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegLinetoAbsX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegLinetoAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegLinetoAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegLinetoAbsY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegLinetoAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegLinetoAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp
index 5a62d5ef6e..dbbcae5e10 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp
@@ -36,19 +36,67 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoHorizontalAbs);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegLinetoHorizontalAbsTableValues[2] =
+static const HashTableValue JSSVGPathSegLinetoHorizontalAbsTableValues[3] =
 {
-    { "x", DontDelete, (intptr_t)jsSVGPathSegLinetoHorizontalAbsX, (intptr_t)setJSSVGPathSegLinetoHorizontalAbsX },
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegLinetoHorizontalAbsX), (intptr_t)setJSSVGPathSegLinetoHorizontalAbsX },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegLinetoHorizontalAbsConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegLinetoHorizontalAbsTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGPathSegLinetoHorizontalAbsTableValues, 0 };
+    { 15, JSSVGPathSegLinetoHorizontalAbsTableValues, 0 };
 #else
-    { 2, 1, JSSVGPathSegLinetoHorizontalAbsTableValues, 0 };
+    { 5, 3, JSSVGPathSegLinetoHorizontalAbsTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegLinetoHorizontalAbsConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegLinetoHorizontalAbsConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegLinetoHorizontalAbsConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegLinetoHorizontalAbsConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegLinetoHorizontalAbsConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegLinetoHorizontalAbsConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegLinetoHorizontalAbsConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegLinetoHorizontalAbsPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegLinetoHorizontalAbsConstructor::s_info = { "SVGPathSegLinetoHorizontalAbsConstructor", 0, &JSSVGPathSegLinetoHorizontalAbsConstructorTable, 0 };
+
+bool JSSVGPathSegLinetoHorizontalAbsConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegLinetoHorizontalAbsConstructor, DOMObject>(exec, &JSSVGPathSegLinetoHorizontalAbsConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegLinetoHorizontalAbsConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegLinetoHorizontalAbsConstructor, DOMObject>(exec, &JSSVGPathSegLinetoHorizontalAbsConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegLinetoHorizontalAbsPrototypeTableValues[1] =
@@ -72,8 +120,8 @@ JSObject* JSSVGPathSegLinetoHorizontalAbsPrototype::self(ExecState* exec, JSGlob
 
 const ClassInfo JSSVGPathSegLinetoHorizontalAbs::s_info = { "SVGPathSegLinetoHorizontalAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoHorizontalAbsTable, 0 };
 
-JSSVGPathSegLinetoHorizontalAbs::JSSVGPathSegLinetoHorizontalAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegLinetoHorizontalAbs> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegLinetoHorizontalAbs::JSSVGPathSegLinetoHorizontalAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegLinetoHorizontalAbs> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -92,14 +140,20 @@ bool JSSVGPathSegLinetoHorizontalAbs::getOwnPropertyDescriptor(ExecState* exec,
     return getStaticValueDescriptor<JSSVGPathSegLinetoHorizontalAbs, Base>(exec, &JSSVGPathSegLinetoHorizontalAbsTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegLinetoHorizontalAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoHorizontalAbsX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegLinetoHorizontalAbs* castedThis = static_cast<JSSVGPathSegLinetoHorizontalAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegLinetoHorizontalAbs* castedThis = static_cast<JSSVGPathSegLinetoHorizontalAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegLinetoHorizontalAbs* imp = static_cast<SVGPathSegLinetoHorizontalAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
+JSValue jsSVGPathSegLinetoHorizontalAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegLinetoHorizontalAbs* domObject = static_cast<JSSVGPathSegLinetoHorizontalAbs*>(asObject(slotBase));
+    return JSSVGPathSegLinetoHorizontalAbs::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegLinetoHorizontalAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoHorizontalAbs, Base>(exec, propertyName, value, &JSSVGPathSegLinetoHorizontalAbsTable, this, slot);
@@ -107,10 +161,15 @@ void JSSVGPathSegLinetoHorizontalAbs::put(ExecState* exec, const Identifier& pro
 
 void setJSSVGPathSegLinetoHorizontalAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegLinetoHorizontalAbs* imp = static_cast<SVGPathSegLinetoHorizontalAbs*>(static_cast<JSSVGPathSegLinetoHorizontalAbs*>(thisObject)->impl());
+    JSSVGPathSegLinetoHorizontalAbs* castedThisObj = static_cast<JSSVGPathSegLinetoHorizontalAbs*>(thisObject);
+    SVGPathSegLinetoHorizontalAbs* imp = static_cast<SVGPathSegLinetoHorizontalAbs*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegLinetoHorizontalAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegLinetoHorizontalAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoHorizontalAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegLinetoHorizontalAbs::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegLinetoHorizontalAbsConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
index 314570b5f4..cbbdb186e6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
@@ -33,7 +33,7 @@ class SVGPathSegLinetoHorizontalAbs;
 class JSSVGPathSegLinetoHorizontalAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegLinetoHorizontalAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoHorizontalAbs>, SVGElement* context);
+    JSSVGPathSegLinetoHorizontalAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoHorizontalAbs>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegLinetoHorizontalAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,8 +69,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegLinetoHorizontalAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegLinetoHorizontalAbsX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegLinetoHorizontalAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegLinetoHorizontalAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp
index 5fe5dcde9b..b81d039cce 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp
@@ -36,19 +36,67 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoHorizontalRel);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegLinetoHorizontalRelTableValues[2] =
+static const HashTableValue JSSVGPathSegLinetoHorizontalRelTableValues[3] =
 {
-    { "x", DontDelete, (intptr_t)jsSVGPathSegLinetoHorizontalRelX, (intptr_t)setJSSVGPathSegLinetoHorizontalRelX },
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegLinetoHorizontalRelX), (intptr_t)setJSSVGPathSegLinetoHorizontalRelX },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegLinetoHorizontalRelConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegLinetoHorizontalRelTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGPathSegLinetoHorizontalRelTableValues, 0 };
+    { 15, JSSVGPathSegLinetoHorizontalRelTableValues, 0 };
 #else
-    { 2, 1, JSSVGPathSegLinetoHorizontalRelTableValues, 0 };
+    { 5, 3, JSSVGPathSegLinetoHorizontalRelTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegLinetoHorizontalRelConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegLinetoHorizontalRelConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegLinetoHorizontalRelConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegLinetoHorizontalRelConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegLinetoHorizontalRelConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegLinetoHorizontalRelConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegLinetoHorizontalRelConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegLinetoHorizontalRelPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegLinetoHorizontalRelConstructor::s_info = { "SVGPathSegLinetoHorizontalRelConstructor", 0, &JSSVGPathSegLinetoHorizontalRelConstructorTable, 0 };
+
+bool JSSVGPathSegLinetoHorizontalRelConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegLinetoHorizontalRelConstructor, DOMObject>(exec, &JSSVGPathSegLinetoHorizontalRelConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegLinetoHorizontalRelConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegLinetoHorizontalRelConstructor, DOMObject>(exec, &JSSVGPathSegLinetoHorizontalRelConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegLinetoHorizontalRelPrototypeTableValues[1] =
@@ -72,8 +120,8 @@ JSObject* JSSVGPathSegLinetoHorizontalRelPrototype::self(ExecState* exec, JSGlob
 
 const ClassInfo JSSVGPathSegLinetoHorizontalRel::s_info = { "SVGPathSegLinetoHorizontalRel", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoHorizontalRelTable, 0 };
 
-JSSVGPathSegLinetoHorizontalRel::JSSVGPathSegLinetoHorizontalRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegLinetoHorizontalRel> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegLinetoHorizontalRel::JSSVGPathSegLinetoHorizontalRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegLinetoHorizontalRel> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -92,14 +140,20 @@ bool JSSVGPathSegLinetoHorizontalRel::getOwnPropertyDescriptor(ExecState* exec,
     return getStaticValueDescriptor<JSSVGPathSegLinetoHorizontalRel, Base>(exec, &JSSVGPathSegLinetoHorizontalRelTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegLinetoHorizontalRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoHorizontalRelX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegLinetoHorizontalRel* castedThis = static_cast<JSSVGPathSegLinetoHorizontalRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegLinetoHorizontalRel* castedThis = static_cast<JSSVGPathSegLinetoHorizontalRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegLinetoHorizontalRel* imp = static_cast<SVGPathSegLinetoHorizontalRel*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
+JSValue jsSVGPathSegLinetoHorizontalRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegLinetoHorizontalRel* domObject = static_cast<JSSVGPathSegLinetoHorizontalRel*>(asObject(slotBase));
+    return JSSVGPathSegLinetoHorizontalRel::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegLinetoHorizontalRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoHorizontalRel, Base>(exec, propertyName, value, &JSSVGPathSegLinetoHorizontalRelTable, this, slot);
@@ -107,10 +161,15 @@ void JSSVGPathSegLinetoHorizontalRel::put(ExecState* exec, const Identifier& pro
 
 void setJSSVGPathSegLinetoHorizontalRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegLinetoHorizontalRel* imp = static_cast<SVGPathSegLinetoHorizontalRel*>(static_cast<JSSVGPathSegLinetoHorizontalRel*>(thisObject)->impl());
+    JSSVGPathSegLinetoHorizontalRel* castedThisObj = static_cast<JSSVGPathSegLinetoHorizontalRel*>(thisObject);
+    SVGPathSegLinetoHorizontalRel* imp = static_cast<SVGPathSegLinetoHorizontalRel*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegLinetoHorizontalRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegLinetoHorizontalRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoHorizontalRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegLinetoHorizontalRel::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegLinetoHorizontalRelConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
index 8df3aba01f..1212e033b4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
@@ -33,7 +33,7 @@ class SVGPathSegLinetoHorizontalRel;
 class JSSVGPathSegLinetoHorizontalRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegLinetoHorizontalRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoHorizontalRel>, SVGElement* context);
+    JSSVGPathSegLinetoHorizontalRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoHorizontalRel>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegLinetoHorizontalRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,8 +69,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegLinetoHorizontalRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegLinetoHorizontalRelX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegLinetoHorizontalRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegLinetoHorizontalRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp
index 231e62119b..9128df1d02 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp
@@ -36,20 +36,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoRel);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegLinetoRelTableValues[3] =
+static const HashTableValue JSSVGPathSegLinetoRelTableValues[4] =
 {
-    { "x", DontDelete, (intptr_t)jsSVGPathSegLinetoRelX, (intptr_t)setJSSVGPathSegLinetoRelX },
-    { "y", DontDelete, (intptr_t)jsSVGPathSegLinetoRelY, (intptr_t)setJSSVGPathSegLinetoRelY },
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegLinetoRelX), (intptr_t)setJSSVGPathSegLinetoRelX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegLinetoRelY), (intptr_t)setJSSVGPathSegLinetoRelY },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegLinetoRelConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegLinetoRelTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGPathSegLinetoRelTableValues, 0 };
+    { 15, JSSVGPathSegLinetoRelTableValues, 0 };
 #else
-    { 4, 3, JSSVGPathSegLinetoRelTableValues, 0 };
+    { 9, 7, JSSVGPathSegLinetoRelTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegLinetoRelConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegLinetoRelConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegLinetoRelConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegLinetoRelConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegLinetoRelConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegLinetoRelConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegLinetoRelConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegLinetoRelPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegLinetoRelConstructor::s_info = { "SVGPathSegLinetoRelConstructor", 0, &JSSVGPathSegLinetoRelConstructorTable, 0 };
+
+bool JSSVGPathSegLinetoRelConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegLinetoRelConstructor, DOMObject>(exec, &JSSVGPathSegLinetoRelConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegLinetoRelConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegLinetoRelConstructor, DOMObject>(exec, &JSSVGPathSegLinetoRelConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegLinetoRelPrototypeTableValues[1] =
@@ -73,8 +121,8 @@ JSObject* JSSVGPathSegLinetoRelPrototype::self(ExecState* exec, JSGlobalObject*
 
 const ClassInfo JSSVGPathSegLinetoRel::s_info = { "SVGPathSegLinetoRel", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoRelTable, 0 };
 
-JSSVGPathSegLinetoRel::JSSVGPathSegLinetoRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegLinetoRel> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegLinetoRel::JSSVGPathSegLinetoRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegLinetoRel> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -93,22 +141,29 @@ bool JSSVGPathSegLinetoRel::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSSVGPathSegLinetoRel, Base>(exec, &JSSVGPathSegLinetoRelTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegLinetoRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoRelX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegLinetoRel* castedThis = static_cast<JSSVGPathSegLinetoRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegLinetoRel* castedThis = static_cast<JSSVGPathSegLinetoRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegLinetoRel* imp = static_cast<SVGPathSegLinetoRel*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsSVGPathSegLinetoRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoRelY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegLinetoRel* castedThis = static_cast<JSSVGPathSegLinetoRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegLinetoRel* castedThis = static_cast<JSSVGPathSegLinetoRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegLinetoRel* imp = static_cast<SVGPathSegLinetoRel*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
+JSValue jsSVGPathSegLinetoRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegLinetoRel* domObject = static_cast<JSSVGPathSegLinetoRel*>(asObject(slotBase));
+    return JSSVGPathSegLinetoRel::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegLinetoRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoRel, Base>(exec, propertyName, value, &JSSVGPathSegLinetoRelTable, this, slot);
@@ -116,18 +171,23 @@ void JSSVGPathSegLinetoRel::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSSVGPathSegLinetoRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegLinetoRel* imp = static_cast<SVGPathSegLinetoRel*>(static_cast<JSSVGPathSegLinetoRel*>(thisObject)->impl());
+    JSSVGPathSegLinetoRel* castedThisObj = static_cast<JSSVGPathSegLinetoRel*>(thisObject);
+    SVGPathSegLinetoRel* imp = static_cast<SVGPathSegLinetoRel*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegLinetoRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegLinetoRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegLinetoRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegLinetoRel* imp = static_cast<SVGPathSegLinetoRel*>(static_cast<JSSVGPathSegLinetoRel*>(thisObject)->impl());
+    JSSVGPathSegLinetoRel* castedThisObj = static_cast<JSSVGPathSegLinetoRel*>(thisObject);
+    SVGPathSegLinetoRel* imp = static_cast<SVGPathSegLinetoRel*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegLinetoRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegLinetoRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegLinetoRel::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegLinetoRelConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
index f9a1c1eaf3..13859fb050 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
@@ -33,7 +33,7 @@ class SVGPathSegLinetoRel;
 class JSSVGPathSegLinetoRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegLinetoRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoRel>, SVGElement* context);
+    JSSVGPathSegLinetoRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoRel>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegLinetoRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,10 +69,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegLinetoRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegLinetoRelX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegLinetoRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegLinetoRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegLinetoRelY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegLinetoRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegLinetoRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp
index 3cd22da3f9..094059aca6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp
@@ -36,19 +36,67 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoVerticalAbs);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegLinetoVerticalAbsTableValues[2] =
+static const HashTableValue JSSVGPathSegLinetoVerticalAbsTableValues[3] =
 {
-    { "y", DontDelete, (intptr_t)jsSVGPathSegLinetoVerticalAbsY, (intptr_t)setJSSVGPathSegLinetoVerticalAbsY },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegLinetoVerticalAbsY), (intptr_t)setJSSVGPathSegLinetoVerticalAbsY },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegLinetoVerticalAbsConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegLinetoVerticalAbsTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGPathSegLinetoVerticalAbsTableValues, 0 };
+    { 1, JSSVGPathSegLinetoVerticalAbsTableValues, 0 };
 #else
-    { 2, 1, JSSVGPathSegLinetoVerticalAbsTableValues, 0 };
+    { 4, 3, JSSVGPathSegLinetoVerticalAbsTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegLinetoVerticalAbsConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegLinetoVerticalAbsConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegLinetoVerticalAbsConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegLinetoVerticalAbsConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegLinetoVerticalAbsConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegLinetoVerticalAbsConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegLinetoVerticalAbsConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegLinetoVerticalAbsPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegLinetoVerticalAbsConstructor::s_info = { "SVGPathSegLinetoVerticalAbsConstructor", 0, &JSSVGPathSegLinetoVerticalAbsConstructorTable, 0 };
+
+bool JSSVGPathSegLinetoVerticalAbsConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegLinetoVerticalAbsConstructor, DOMObject>(exec, &JSSVGPathSegLinetoVerticalAbsConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegLinetoVerticalAbsConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegLinetoVerticalAbsConstructor, DOMObject>(exec, &JSSVGPathSegLinetoVerticalAbsConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegLinetoVerticalAbsPrototypeTableValues[1] =
@@ -72,8 +120,8 @@ JSObject* JSSVGPathSegLinetoVerticalAbsPrototype::self(ExecState* exec, JSGlobal
 
 const ClassInfo JSSVGPathSegLinetoVerticalAbs::s_info = { "SVGPathSegLinetoVerticalAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoVerticalAbsTable, 0 };
 
-JSSVGPathSegLinetoVerticalAbs::JSSVGPathSegLinetoVerticalAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegLinetoVerticalAbs> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegLinetoVerticalAbs::JSSVGPathSegLinetoVerticalAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegLinetoVerticalAbs> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -92,14 +140,20 @@ bool JSSVGPathSegLinetoVerticalAbs::getOwnPropertyDescriptor(ExecState* exec, co
     return getStaticValueDescriptor<JSSVGPathSegLinetoVerticalAbs, Base>(exec, &JSSVGPathSegLinetoVerticalAbsTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegLinetoVerticalAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoVerticalAbsY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegLinetoVerticalAbs* castedThis = static_cast<JSSVGPathSegLinetoVerticalAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegLinetoVerticalAbs* castedThis = static_cast<JSSVGPathSegLinetoVerticalAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegLinetoVerticalAbs* imp = static_cast<SVGPathSegLinetoVerticalAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
+JSValue jsSVGPathSegLinetoVerticalAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegLinetoVerticalAbs* domObject = static_cast<JSSVGPathSegLinetoVerticalAbs*>(asObject(slotBase));
+    return JSSVGPathSegLinetoVerticalAbs::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegLinetoVerticalAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoVerticalAbs, Base>(exec, propertyName, value, &JSSVGPathSegLinetoVerticalAbsTable, this, slot);
@@ -107,10 +161,15 @@ void JSSVGPathSegLinetoVerticalAbs::put(ExecState* exec, const Identifier& prope
 
 void setJSSVGPathSegLinetoVerticalAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegLinetoVerticalAbs* imp = static_cast<SVGPathSegLinetoVerticalAbs*>(static_cast<JSSVGPathSegLinetoVerticalAbs*>(thisObject)->impl());
+    JSSVGPathSegLinetoVerticalAbs* castedThisObj = static_cast<JSSVGPathSegLinetoVerticalAbs*>(thisObject);
+    SVGPathSegLinetoVerticalAbs* imp = static_cast<SVGPathSegLinetoVerticalAbs*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegLinetoVerticalAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegLinetoVerticalAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoVerticalAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegLinetoVerticalAbs::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegLinetoVerticalAbsConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
index 6258a0c474..bed5b52a70 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
@@ -33,7 +33,7 @@ class SVGPathSegLinetoVerticalAbs;
 class JSSVGPathSegLinetoVerticalAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegLinetoVerticalAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoVerticalAbs>, SVGElement* context);
+    JSSVGPathSegLinetoVerticalAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoVerticalAbs>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegLinetoVerticalAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,8 +69,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegLinetoVerticalAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegLinetoVerticalAbsY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegLinetoVerticalAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegLinetoVerticalAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp
index 15fa8b461b..7ea7cce264 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp
@@ -36,19 +36,67 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoVerticalRel);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegLinetoVerticalRelTableValues[2] =
+static const HashTableValue JSSVGPathSegLinetoVerticalRelTableValues[3] =
 {
-    { "y", DontDelete, (intptr_t)jsSVGPathSegLinetoVerticalRelY, (intptr_t)setJSSVGPathSegLinetoVerticalRelY },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegLinetoVerticalRelY), (intptr_t)setJSSVGPathSegLinetoVerticalRelY },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegLinetoVerticalRelConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegLinetoVerticalRelTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGPathSegLinetoVerticalRelTableValues, 0 };
+    { 1, JSSVGPathSegLinetoVerticalRelTableValues, 0 };
 #else
-    { 2, 1, JSSVGPathSegLinetoVerticalRelTableValues, 0 };
+    { 4, 3, JSSVGPathSegLinetoVerticalRelTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegLinetoVerticalRelConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegLinetoVerticalRelConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegLinetoVerticalRelConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegLinetoVerticalRelConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegLinetoVerticalRelConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegLinetoVerticalRelConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegLinetoVerticalRelConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegLinetoVerticalRelPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegLinetoVerticalRelConstructor::s_info = { "SVGPathSegLinetoVerticalRelConstructor", 0, &JSSVGPathSegLinetoVerticalRelConstructorTable, 0 };
+
+bool JSSVGPathSegLinetoVerticalRelConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegLinetoVerticalRelConstructor, DOMObject>(exec, &JSSVGPathSegLinetoVerticalRelConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegLinetoVerticalRelConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegLinetoVerticalRelConstructor, DOMObject>(exec, &JSSVGPathSegLinetoVerticalRelConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegLinetoVerticalRelPrototypeTableValues[1] =
@@ -72,8 +120,8 @@ JSObject* JSSVGPathSegLinetoVerticalRelPrototype::self(ExecState* exec, JSGlobal
 
 const ClassInfo JSSVGPathSegLinetoVerticalRel::s_info = { "SVGPathSegLinetoVerticalRel", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoVerticalRelTable, 0 };
 
-JSSVGPathSegLinetoVerticalRel::JSSVGPathSegLinetoVerticalRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegLinetoVerticalRel> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegLinetoVerticalRel::JSSVGPathSegLinetoVerticalRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegLinetoVerticalRel> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -92,14 +140,20 @@ bool JSSVGPathSegLinetoVerticalRel::getOwnPropertyDescriptor(ExecState* exec, co
     return getStaticValueDescriptor<JSSVGPathSegLinetoVerticalRel, Base>(exec, &JSSVGPathSegLinetoVerticalRelTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegLinetoVerticalRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoVerticalRelY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegLinetoVerticalRel* castedThis = static_cast<JSSVGPathSegLinetoVerticalRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegLinetoVerticalRel* castedThis = static_cast<JSSVGPathSegLinetoVerticalRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegLinetoVerticalRel* imp = static_cast<SVGPathSegLinetoVerticalRel*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
+JSValue jsSVGPathSegLinetoVerticalRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegLinetoVerticalRel* domObject = static_cast<JSSVGPathSegLinetoVerticalRel*>(asObject(slotBase));
+    return JSSVGPathSegLinetoVerticalRel::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegLinetoVerticalRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoVerticalRel, Base>(exec, propertyName, value, &JSSVGPathSegLinetoVerticalRelTable, this, slot);
@@ -107,10 +161,15 @@ void JSSVGPathSegLinetoVerticalRel::put(ExecState* exec, const Identifier& prope
 
 void setJSSVGPathSegLinetoVerticalRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegLinetoVerticalRel* imp = static_cast<SVGPathSegLinetoVerticalRel*>(static_cast<JSSVGPathSegLinetoVerticalRel*>(thisObject)->impl());
+    JSSVGPathSegLinetoVerticalRel* castedThisObj = static_cast<JSSVGPathSegLinetoVerticalRel*>(thisObject);
+    SVGPathSegLinetoVerticalRel* imp = static_cast<SVGPathSegLinetoVerticalRel*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegLinetoVerticalRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegLinetoVerticalRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoVerticalRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegLinetoVerticalRel::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegLinetoVerticalRelConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
index 7355926a42..dffcf78b3f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
@@ -33,7 +33,7 @@ class SVGPathSegLinetoVerticalRel;
 class JSSVGPathSegLinetoVerticalRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegLinetoVerticalRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoVerticalRel>, SVGElement* context);
+    JSSVGPathSegLinetoVerticalRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoVerticalRel>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegLinetoVerticalRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,8 +69,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegLinetoVerticalRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegLinetoVerticalRelY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegLinetoVerticalRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegLinetoVerticalRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp
index 9a35c1ba1d..2461494425 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp
@@ -38,30 +38,78 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegList);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegListTableValues[2] =
+static const HashTableValue JSSVGPathSegListTableValues[3] =
 {
-    { "numberOfItems", DontDelete|ReadOnly, (intptr_t)jsSVGPathSegListNumberOfItems, (intptr_t)0 },
+    { "numberOfItems", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegListNumberOfItems), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegListTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGPathSegListTableValues, 0 };
+    { 3, JSSVGPathSegListTableValues, 0 };
 #else
-    { 2, 1, JSSVGPathSegListTableValues, 0 };
+    { 4, 3, JSSVGPathSegListTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegListConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegListConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegListConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegListConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegListPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegListConstructor::s_info = { "SVGPathSegListConstructor", 0, &JSSVGPathSegListConstructorTable, 0 };
+
+bool JSSVGPathSegListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegListConstructor, DOMObject>(exec, &JSSVGPathSegListConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegListConstructor, DOMObject>(exec, &JSSVGPathSegListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegListPrototypeTableValues[8] =
 {
-    { "clear", DontDelete|Function, (intptr_t)jsSVGPathSegListPrototypeFunctionClear, (intptr_t)0 },
-    { "initialize", DontDelete|Function, (intptr_t)jsSVGPathSegListPrototypeFunctionInitialize, (intptr_t)1 },
-    { "getItem", DontDelete|Function, (intptr_t)jsSVGPathSegListPrototypeFunctionGetItem, (intptr_t)1 },
-    { "insertItemBefore", DontDelete|Function, (intptr_t)jsSVGPathSegListPrototypeFunctionInsertItemBefore, (intptr_t)2 },
-    { "replaceItem", DontDelete|Function, (intptr_t)jsSVGPathSegListPrototypeFunctionReplaceItem, (intptr_t)2 },
-    { "removeItem", DontDelete|Function, (intptr_t)jsSVGPathSegListPrototypeFunctionRemoveItem, (intptr_t)1 },
-    { "appendItem", DontDelete|Function, (intptr_t)jsSVGPathSegListPrototypeFunctionAppendItem, (intptr_t)1 },
+    { "clear", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathSegListPrototypeFunctionClear), (intptr_t)0 },
+    { "initialize", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathSegListPrototypeFunctionInitialize), (intptr_t)1 },
+    { "getItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathSegListPrototypeFunctionGetItem), (intptr_t)1 },
+    { "insertItemBefore", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathSegListPrototypeFunctionInsertItemBefore), (intptr_t)2 },
+    { "replaceItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathSegListPrototypeFunctionReplaceItem), (intptr_t)2 },
+    { "removeItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathSegListPrototypeFunctionRemoveItem), (intptr_t)1 },
+    { "appendItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPathSegListPrototypeFunctionAppendItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -91,8 +139,8 @@ bool JSSVGPathSegListPrototype::getOwnPropertyDescriptor(ExecState* exec, const
 
 const ClassInfo JSSVGPathSegList::s_info = { "SVGPathSegList", 0, &JSSVGPathSegListTable, 0 };
 
-JSSVGPathSegList::JSSVGPathSegList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegList> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGPathSegList::JSSVGPathSegList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegList> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -100,6 +148,7 @@ JSSVGPathSegList::JSSVGPathSegList(NonNullPassRefPtr<Structure> structure, JSDOM
 JSSVGPathSegList::~JSSVGPathSegList()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGPathSegList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -117,12 +166,23 @@ bool JSSVGPathSegList::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSSVGPathSegList, Base>(exec, &JSSVGPathSegListTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegListNumberOfItems(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegList* castedThis = static_cast<JSSVGPathSegList*>(asObject(slot.slotBase()));
+    JSSVGPathSegList* castedThis = static_cast<JSSVGPathSegList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(castedThis->impl());
-    return jsNumber(exec, imp->numberOfItems());
+    JSValue result = jsNumber(exec, imp->numberOfItems());
+    return result;
+}
+
+JSValue jsSVGPathSegListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegList* domObject = static_cast<JSSVGPathSegList*>(asObject(slotBase));
+    return JSSVGPathSegList::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGPathSegList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegListConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
index 120fc968c5..5a0a039c1f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -33,10 +32,10 @@ namespace WebCore {
 
 class SVGPathSegList;
 
-class JSSVGPathSegList : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGPathSegList : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGPathSegList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegList>, SVGElement* context);
+    JSSVGPathSegList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegList>);
     virtual ~JSSVGPathSegList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -46,9 +45,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom functions
     JSC::JSValue clear(JSC::ExecState*, const JSC::ArgList&);
@@ -79,7 +79,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -97,7 +97,8 @@ JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionRemoveItem(JSC::Exec
 JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGPathSegListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegListNumberOfItems(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPathSegListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp
index 8eb70f0d78..4c36e3c168 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp
@@ -36,20 +36,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegMovetoAbs);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegMovetoAbsTableValues[3] =
+static const HashTableValue JSSVGPathSegMovetoAbsTableValues[4] =
 {
-    { "x", DontDelete, (intptr_t)jsSVGPathSegMovetoAbsX, (intptr_t)setJSSVGPathSegMovetoAbsX },
-    { "y", DontDelete, (intptr_t)jsSVGPathSegMovetoAbsY, (intptr_t)setJSSVGPathSegMovetoAbsY },
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegMovetoAbsX), (intptr_t)setJSSVGPathSegMovetoAbsX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegMovetoAbsY), (intptr_t)setJSSVGPathSegMovetoAbsY },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegMovetoAbsConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegMovetoAbsTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGPathSegMovetoAbsTableValues, 0 };
+    { 15, JSSVGPathSegMovetoAbsTableValues, 0 };
 #else
-    { 4, 3, JSSVGPathSegMovetoAbsTableValues, 0 };
+    { 9, 7, JSSVGPathSegMovetoAbsTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegMovetoAbsConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegMovetoAbsConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegMovetoAbsConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegMovetoAbsConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegMovetoAbsConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegMovetoAbsConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegMovetoAbsConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegMovetoAbsPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegMovetoAbsConstructor::s_info = { "SVGPathSegMovetoAbsConstructor", 0, &JSSVGPathSegMovetoAbsConstructorTable, 0 };
+
+bool JSSVGPathSegMovetoAbsConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegMovetoAbsConstructor, DOMObject>(exec, &JSSVGPathSegMovetoAbsConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegMovetoAbsConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegMovetoAbsConstructor, DOMObject>(exec, &JSSVGPathSegMovetoAbsConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegMovetoAbsPrototypeTableValues[1] =
@@ -73,8 +121,8 @@ JSObject* JSSVGPathSegMovetoAbsPrototype::self(ExecState* exec, JSGlobalObject*
 
 const ClassInfo JSSVGPathSegMovetoAbs::s_info = { "SVGPathSegMovetoAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegMovetoAbsTable, 0 };
 
-JSSVGPathSegMovetoAbs::JSSVGPathSegMovetoAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegMovetoAbs> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegMovetoAbs::JSSVGPathSegMovetoAbs(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegMovetoAbs> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -93,22 +141,29 @@ bool JSSVGPathSegMovetoAbs::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSSVGPathSegMovetoAbs, Base>(exec, &JSSVGPathSegMovetoAbsTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegMovetoAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegMovetoAbsX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegMovetoAbs* castedThis = static_cast<JSSVGPathSegMovetoAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegMovetoAbs* castedThis = static_cast<JSSVGPathSegMovetoAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegMovetoAbs* imp = static_cast<SVGPathSegMovetoAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsSVGPathSegMovetoAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegMovetoAbsY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegMovetoAbs* castedThis = static_cast<JSSVGPathSegMovetoAbs*>(asObject(slot.slotBase()));
+    JSSVGPathSegMovetoAbs* castedThis = static_cast<JSSVGPathSegMovetoAbs*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegMovetoAbs* imp = static_cast<SVGPathSegMovetoAbs*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
+JSValue jsSVGPathSegMovetoAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegMovetoAbs* domObject = static_cast<JSSVGPathSegMovetoAbs*>(asObject(slotBase));
+    return JSSVGPathSegMovetoAbs::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegMovetoAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegMovetoAbs, Base>(exec, propertyName, value, &JSSVGPathSegMovetoAbsTable, this, slot);
@@ -116,18 +171,23 @@ void JSSVGPathSegMovetoAbs::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSSVGPathSegMovetoAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegMovetoAbs* imp = static_cast<SVGPathSegMovetoAbs*>(static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->impl());
+    JSSVGPathSegMovetoAbs* castedThisObj = static_cast<JSSVGPathSegMovetoAbs*>(thisObject);
+    SVGPathSegMovetoAbs* imp = static_cast<SVGPathSegMovetoAbs*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegMovetoAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegMovetoAbs* imp = static_cast<SVGPathSegMovetoAbs*>(static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->impl());
+    JSSVGPathSegMovetoAbs* castedThisObj = static_cast<JSSVGPathSegMovetoAbs*>(thisObject);
+    SVGPathSegMovetoAbs* imp = static_cast<SVGPathSegMovetoAbs*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->context())
-        static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegMovetoAbs::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegMovetoAbsConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
index b81a6444ea..11eb795fff 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
@@ -33,7 +33,7 @@ class SVGPathSegMovetoAbs;
 class JSSVGPathSegMovetoAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegMovetoAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegMovetoAbs>, SVGElement* context);
+    JSSVGPathSegMovetoAbs(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegMovetoAbs>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegMovetoAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,10 +69,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegMovetoAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegMovetoAbsX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegMovetoAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegMovetoAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegMovetoAbsY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegMovetoAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegMovetoAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp
index ff7786f59c..ee59c3ec42 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp
@@ -36,20 +36,68 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegMovetoRel);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPathSegMovetoRelTableValues[3] =
+static const HashTableValue JSSVGPathSegMovetoRelTableValues[4] =
 {
-    { "x", DontDelete, (intptr_t)jsSVGPathSegMovetoRelX, (intptr_t)setJSSVGPathSegMovetoRelX },
-    { "y", DontDelete, (intptr_t)jsSVGPathSegMovetoRelY, (intptr_t)setJSSVGPathSegMovetoRelY },
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegMovetoRelX), (intptr_t)setJSSVGPathSegMovetoRelX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegMovetoRelY), (intptr_t)setJSSVGPathSegMovetoRelY },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPathSegMovetoRelConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPathSegMovetoRelTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGPathSegMovetoRelTableValues, 0 };
+    { 15, JSSVGPathSegMovetoRelTableValues, 0 };
 #else
-    { 4, 3, JSSVGPathSegMovetoRelTableValues, 0 };
+    { 9, 7, JSSVGPathSegMovetoRelTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPathSegMovetoRelConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPathSegMovetoRelConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPathSegMovetoRelConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPathSegMovetoRelConstructorTableValues, 0 };
+#endif
+
+class JSSVGPathSegMovetoRelConstructor : public DOMConstructorObject {
+public:
+    JSSVGPathSegMovetoRelConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPathSegMovetoRelConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegMovetoRelPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPathSegMovetoRelConstructor::s_info = { "SVGPathSegMovetoRelConstructor", 0, &JSSVGPathSegMovetoRelConstructorTable, 0 };
+
+bool JSSVGPathSegMovetoRelConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPathSegMovetoRelConstructor, DOMObject>(exec, &JSSVGPathSegMovetoRelConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPathSegMovetoRelConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegMovetoRelConstructor, DOMObject>(exec, &JSSVGPathSegMovetoRelConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegMovetoRelPrototypeTableValues[1] =
@@ -73,8 +121,8 @@ JSObject* JSSVGPathSegMovetoRelPrototype::self(ExecState* exec, JSGlobalObject*
 
 const ClassInfo JSSVGPathSegMovetoRel::s_info = { "SVGPathSegMovetoRel", &JSSVGPathSeg::s_info, &JSSVGPathSegMovetoRelTable, 0 };
 
-JSSVGPathSegMovetoRel::JSSVGPathSegMovetoRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegMovetoRel> impl, SVGElement* context)
-    : JSSVGPathSeg(structure, globalObject, impl, context)
+JSSVGPathSegMovetoRel::JSSVGPathSegMovetoRel(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegMovetoRel> impl)
+    : JSSVGPathSeg(structure, globalObject, impl)
 {
 }
 
@@ -93,22 +141,29 @@ bool JSSVGPathSegMovetoRel::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSSVGPathSegMovetoRel, Base>(exec, &JSSVGPathSegMovetoRelTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPathSegMovetoRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegMovetoRelX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegMovetoRel* castedThis = static_cast<JSSVGPathSegMovetoRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegMovetoRel* castedThis = static_cast<JSSVGPathSegMovetoRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegMovetoRel* imp = static_cast<SVGPathSegMovetoRel*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsSVGPathSegMovetoRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegMovetoRelY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPathSegMovetoRel* castedThis = static_cast<JSSVGPathSegMovetoRel*>(asObject(slot.slotBase()));
+    JSSVGPathSegMovetoRel* castedThis = static_cast<JSSVGPathSegMovetoRel*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPathSegMovetoRel* imp = static_cast<SVGPathSegMovetoRel*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
+JSValue jsSVGPathSegMovetoRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPathSegMovetoRel* domObject = static_cast<JSSVGPathSegMovetoRel*>(asObject(slotBase));
+    return JSSVGPathSegMovetoRel::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPathSegMovetoRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegMovetoRel, Base>(exec, propertyName, value, &JSSVGPathSegMovetoRelTable, this, slot);
@@ -116,18 +171,23 @@ void JSSVGPathSegMovetoRel::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSSVGPathSegMovetoRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegMovetoRel* imp = static_cast<SVGPathSegMovetoRel*>(static_cast<JSSVGPathSegMovetoRel*>(thisObject)->impl());
+    JSSVGPathSegMovetoRel* castedThisObj = static_cast<JSSVGPathSegMovetoRel*>(thisObject);
+    SVGPathSegMovetoRel* imp = static_cast<SVGPathSegMovetoRel*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegMovetoRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegMovetoRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegMovetoRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
 }
 
 void setJSSVGPathSegMovetoRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPathSegMovetoRel* imp = static_cast<SVGPathSegMovetoRel*>(static_cast<JSSVGPathSegMovetoRel*>(thisObject)->impl());
+    JSSVGPathSegMovetoRel* castedThisObj = static_cast<JSSVGPathSegMovetoRel*>(thisObject);
+    SVGPathSegMovetoRel* imp = static_cast<SVGPathSegMovetoRel*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
-    if (static_cast<JSSVGPathSegMovetoRel*>(thisObject)->context())
-        static_cast<JSSVGPathSegMovetoRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegMovetoRel*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());
+}
+
+JSValue JSSVGPathSegMovetoRel::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPathSegMovetoRelConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
index 57b606bb9a..b63c24d272 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
@@ -33,7 +33,7 @@ class SVGPathSegMovetoRel;
 class JSSVGPathSegMovetoRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
-    JSSVGPathSegMovetoRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegMovetoRel>, SVGElement* context);
+    JSSVGPathSegMovetoRel(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegMovetoRel>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPathSegMovetoRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,10 +69,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPathSegMovetoRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegMovetoRelX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegMovetoRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPathSegMovetoRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegMovetoRelY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPathSegMovetoRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegMovetoRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp
index f746140457..852bdecdae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp
@@ -52,26 +52,27 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPatternElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPatternElementTableValues[19] =
-{
-    { "patternUnits", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementPatternUnits, (intptr_t)0 },
-    { "patternContentUnits", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementPatternContentUnits, (intptr_t)0 },
-    { "patternTransform", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementPatternTransform, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementHeight, (intptr_t)0 },
-    { "href", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementHref, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGPatternElementXmllang, (intptr_t)setJSSVGPatternElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGPatternElementXmlspace, (intptr_t)setJSSVGPatternElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementStyle, (intptr_t)0 },
-    { "viewBox", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementViewBox, (intptr_t)0 },
-    { "preserveAspectRatio", DontDelete|ReadOnly, (intptr_t)jsSVGPatternElementPreserveAspectRatio, (intptr_t)0 },
+static const HashTableValue JSSVGPatternElementTableValues[20] =
+{
+    { "patternUnits", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementPatternUnits), (intptr_t)0 },
+    { "patternContentUnits", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementPatternContentUnits), (intptr_t)0 },
+    { "patternTransform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementPatternTransform), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementHeight), (intptr_t)0 },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementHref), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementXmllang), (intptr_t)setJSSVGPatternElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementXmlspace), (intptr_t)setJSSVGPatternElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementStyle), (intptr_t)0 },
+    { "viewBox", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementViewBox), (intptr_t)0 },
+    { "preserveAspectRatio", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementPreserveAspectRatio), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPatternElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -82,12 +83,59 @@ static JSC_CONST_HASHTABLE HashTable JSSVGPatternElementTable =
     { 68, 63, JSSVGPatternElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPatternElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPatternElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPatternElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPatternElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGPatternElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGPatternElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPatternElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPatternElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPatternElementConstructor::s_info = { "SVGPatternElementConstructor", 0, &JSSVGPatternElementConstructorTable, 0 };
+
+bool JSSVGPatternElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPatternElementConstructor, DOMObject>(exec, &JSSVGPatternElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPatternElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPatternElementConstructor, DOMObject>(exec, &JSSVGPatternElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPatternElementPrototypeTableValues[3] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGPatternElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGPatternElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPatternElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPatternElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -137,162 +185,185 @@ bool JSSVGPatternElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSSVGPatternElement, Base>(exec, &JSSVGPatternElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPatternElementPatternUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementPatternUnits(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->patternUnitsAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPatternElementPatternContentUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementPatternContentUnits(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->patternContentUnitsAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPatternElementPatternTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementPatternTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->patternTransformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPatternElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPatternElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPatternElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPatternElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPatternElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPatternElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGPatternElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGPatternElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGPatternElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGPatternElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGPatternElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPatternElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPatternElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGPatternElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementViewBox(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
     RefPtr<SVGAnimatedRect> obj = imp->viewBoxAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPatternElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementPreserveAspectRatio(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
+    JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThis->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
+JSValue jsSVGPatternElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPatternElement* domObject = static_cast<JSSVGPatternElement*>(asObject(slotBase));
+    return JSSVGPatternElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPatternElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPatternElement, Base>(exec, propertyName, value, &JSSVGPatternElementTable, this, slot);
@@ -300,16 +371,23 @@ void JSSVGPatternElement::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSSVGPatternElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(thisObject)->impl());
+    JSSVGPatternElement* castedThisObj = static_cast<JSSVGPatternElement*>(thisObject);
+    SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGPatternElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(thisObject)->impl());
+    JSSVGPatternElement* castedThisObj = static_cast<JSSVGPatternElement*>(thisObject);
+    SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGPatternElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPatternElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGPatternElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
index 6cd8a731f7..886a278e12 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPatternElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -74,26 +75,27 @@ JSC::JSValue JSC_HOST_CALL jsSVGPatternElementPrototypeFunctionHasExtension(JSC:
 JSC::JSValue JSC_HOST_CALL jsSVGPatternElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGPatternElementPatternUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPatternElementPatternContentUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPatternElementPatternTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPatternElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPatternElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPatternElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPatternElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPatternElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPatternElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPatternElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPatternElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPatternElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementPatternUnits(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementPatternContentUnits(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementPatternTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPatternElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPatternElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPatternElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPatternElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPatternElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPatternElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPatternElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPatternElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementViewBox(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementPreserveAspectRatio(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPatternElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp
index 67c35e22fe..3c293f5b93 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp
@@ -38,25 +38,73 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPoint);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPointTableValues[3] =
+static const HashTableValue JSSVGPointTableValues[4] =
 {
-    { "x", DontDelete, (intptr_t)jsSVGPointX, (intptr_t)setJSSVGPointX },
-    { "y", DontDelete, (intptr_t)jsSVGPointY, (intptr_t)setJSSVGPointY },
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPointX), (intptr_t)setJSSVGPointX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPointY), (intptr_t)setJSSVGPointY },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPointConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPointTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSSVGPointTableValues, 0 };
+    { 15, JSSVGPointTableValues, 0 };
 #else
-    { 4, 3, JSSVGPointTableValues, 0 };
+    { 9, 7, JSSVGPointTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPointConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPointConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPointConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPointConstructorTableValues, 0 };
+#endif
+
+class JSSVGPointConstructor : public DOMConstructorObject {
+public:
+    JSSVGPointConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPointConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPointPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPointConstructor::s_info = { "SVGPointConstructor", 0, &JSSVGPointConstructorTable, 0 };
+
+bool JSSVGPointConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPointConstructor, DOMObject>(exec, &JSSVGPointConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPointConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPointConstructor, DOMObject>(exec, &JSSVGPointConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPointPrototypeTableValues[2] =
 {
-    { "matrixTransform", DontDelete|Function, (intptr_t)jsSVGPointPrototypeFunctionMatrixTransform, (intptr_t)1 },
+    { "matrixTransform", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPointPrototypeFunctionMatrixTransform), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -86,8 +134,8 @@ bool JSSVGPointPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identi
 
 const ClassInfo JSSVGPoint::s_info = { "SVGPoint", 0, &JSSVGPointTable, 0 };
 
-JSSVGPoint::JSSVGPoint(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<FloatPoint> > impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGPoint::JSSVGPoint(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<FloatPoint> > impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -95,6 +143,7 @@ JSSVGPoint::JSSVGPoint(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject
 JSSVGPoint::~JSSVGPoint()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGPoint::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -112,22 +161,29 @@ bool JSSVGPoint::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     return getStaticValueDescriptor<JSSVGPoint, Base>(exec, &JSSVGPointTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPointX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPointX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPoint* castedThis = static_cast<JSSVGPoint*>(asObject(slot.slotBase()));
+    JSSVGPoint* castedThis = static_cast<JSSVGPoint*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     FloatPoint imp(*castedThis->impl());
-    return jsNumber(exec, imp.x());
+    JSValue result =  jsNumber(exec, imp.x());
+    return result;
 }
 
-JSValue jsSVGPointY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPointY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPoint* castedThis = static_cast<JSSVGPoint*>(asObject(slot.slotBase()));
+    JSSVGPoint* castedThis = static_cast<JSSVGPoint*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     FloatPoint imp(*castedThis->impl());
-    return jsNumber(exec, imp.y());
+    JSValue result =  jsNumber(exec, imp.y());
+    return result;
 }
 
+JSValue jsSVGPointConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPoint* domObject = static_cast<JSSVGPoint*>(asObject(slotBase));
+    return JSSVGPoint::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPoint::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPoint, Base>(exec, propertyName, value, &JSSVGPointTable, this, slot);
@@ -135,16 +191,25 @@ void JSSVGPoint::put(ExecState* exec, const Identifier& propertyName, JSValue va
 
 void setJSSVGPointX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    FloatPoint imp(*static_cast<JSSVGPoint*>(thisObject)->impl());
-    imp.setX(value.toFloat(exec));
-        static_cast<JSSVGPoint*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGPoint*>(thisObject)->context());
+    JSSVGPoint* castedThisObj = static_cast<JSSVGPoint*>(thisObject);
+    JSSVGPODTypeWrapper<FloatPoint> * imp = static_cast<JSSVGPODTypeWrapper<FloatPoint> *>(castedThisObj->impl());
+    FloatPoint podImp(*imp);
+    podImp.setX(value.toFloat(exec));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 void setJSSVGPointY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    FloatPoint imp(*static_cast<JSSVGPoint*>(thisObject)->impl());
-    imp.setY(value.toFloat(exec));
-        static_cast<JSSVGPoint*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGPoint*>(thisObject)->context());
+    JSSVGPoint* castedThisObj = static_cast<JSSVGPoint*>(thisObject);
+    JSSVGPODTypeWrapper<FloatPoint> * imp = static_cast<JSSVGPODTypeWrapper<FloatPoint> *>(castedThisObj->impl());
+    FloatPoint podImp(*imp);
+    podImp.setY(value.toFloat(exec));
+    imp->commitChange(podImp, castedThisObj);
+}
+
+JSValue JSSVGPoint::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPointConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGPointPrototypeFunctionMatrixTransform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -153,13 +218,13 @@ JSValue JSC_HOST_CALL jsSVGPointPrototypeFunctionMatrixTransform(ExecState* exec
     if (!thisValue.inherits(&JSSVGPoint::s_info))
         return throwError(exec, TypeError);
     JSSVGPoint* castedThisObj = static_cast<JSSVGPoint*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<FloatPoint>* wrapper = castedThisObj->impl();
-    FloatPoint imp(*wrapper);
-    TransformationMatrix matrix = toSVGMatrix(args.at(0));
+    JSSVGPODTypeWrapper<FloatPoint> * imp = static_cast<JSSVGPODTypeWrapper<FloatPoint> *>(castedThisObj->impl());
+    FloatPoint podImp(*imp);
+    AffineTransform matrix = toSVGMatrix(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp.matrixTransform(matrix)).get(), castedThisObj->context());
-    wrapper->commitChange(imp, castedThisObj->context());
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatPoint>::create(podImp.matrixTransform(matrix)).get(), 0 /* no context on purpose */);
+    imp->commitChange(podImp, castedThisObj);
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
index 97ec466767..e5c87e86c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "FloatPoint.h"
 #include "JSDOMBinding.h"
 #include "JSSVGPODTypeWrapper.h"
@@ -33,10 +32,10 @@
 
 namespace WebCore {
 
-class JSSVGPoint : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGPoint : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGPoint(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<JSSVGPODTypeWrapper<FloatPoint> >, SVGElement* context);
+    JSSVGPoint(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<JSSVGPODTypeWrapper<FloatPoint> >);
     virtual ~JSSVGPoint();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -47,9 +46,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     JSSVGPODTypeWrapper<FloatPoint> * impl() const { return m_impl.get(); }
 
 private:
@@ -58,7 +58,7 @@ protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<FloatPoint>*, SVGElement* context);
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<FloatPoint>*, SVGElement*);
 FloatPoint toSVGPoint(JSC::JSValue);
 
 class JSSVGPointPrototype : public JSC::JSObject {
@@ -71,7 +71,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPointPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -83,10 +83,11 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGPointPrototypeFunctionMatrixTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGPointX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPointX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPointX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPointY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPointY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPointY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPointConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp
index 6968c80cd9..c3549b08ee 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp
@@ -24,6 +24,8 @@
 
 #include "JSSVGPointList.h"
 
+#include "JSSVGPODListCustom.h"
+#include "JSSVGPoint.h"
 #include "SVGPointList.h"
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
@@ -37,30 +39,78 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPointList);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPointListTableValues[2] =
+static const HashTableValue JSSVGPointListTableValues[3] =
 {
-    { "numberOfItems", DontDelete|ReadOnly, (intptr_t)jsSVGPointListNumberOfItems, (intptr_t)0 },
+    { "numberOfItems", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPointListNumberOfItems), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPointListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGPointListTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGPointListTableValues, 0 };
+    { 3, JSSVGPointListTableValues, 0 };
 #else
-    { 2, 1, JSSVGPointListTableValues, 0 };
+    { 4, 3, JSSVGPointListTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPointListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPointListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPointListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPointListConstructorTableValues, 0 };
+#endif
+
+class JSSVGPointListConstructor : public DOMConstructorObject {
+public:
+    JSSVGPointListConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPointListConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPointListPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPointListConstructor::s_info = { "SVGPointListConstructor", 0, &JSSVGPointListConstructorTable, 0 };
+
+bool JSSVGPointListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPointListConstructor, DOMObject>(exec, &JSSVGPointListConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPointListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPointListConstructor, DOMObject>(exec, &JSSVGPointListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPointListPrototypeTableValues[8] =
 {
-    { "clear", DontDelete|Function, (intptr_t)jsSVGPointListPrototypeFunctionClear, (intptr_t)0 },
-    { "initialize", DontDelete|Function, (intptr_t)jsSVGPointListPrototypeFunctionInitialize, (intptr_t)1 },
-    { "getItem", DontDelete|Function, (intptr_t)jsSVGPointListPrototypeFunctionGetItem, (intptr_t)1 },
-    { "insertItemBefore", DontDelete|Function, (intptr_t)jsSVGPointListPrototypeFunctionInsertItemBefore, (intptr_t)2 },
-    { "replaceItem", DontDelete|Function, (intptr_t)jsSVGPointListPrototypeFunctionReplaceItem, (intptr_t)2 },
-    { "removeItem", DontDelete|Function, (intptr_t)jsSVGPointListPrototypeFunctionRemoveItem, (intptr_t)1 },
-    { "appendItem", DontDelete|Function, (intptr_t)jsSVGPointListPrototypeFunctionAppendItem, (intptr_t)1 },
+    { "clear", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPointListPrototypeFunctionClear), (intptr_t)0 },
+    { "initialize", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPointListPrototypeFunctionInitialize), (intptr_t)1 },
+    { "getItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPointListPrototypeFunctionGetItem), (intptr_t)1 },
+    { "insertItemBefore", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPointListPrototypeFunctionInsertItemBefore), (intptr_t)2 },
+    { "replaceItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPointListPrototypeFunctionReplaceItem), (intptr_t)2 },
+    { "removeItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPointListPrototypeFunctionRemoveItem), (intptr_t)1 },
+    { "appendItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPointListPrototypeFunctionAppendItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -90,8 +140,8 @@ bool JSSVGPointListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Id
 
 const ClassInfo JSSVGPointList::s_info = { "SVGPointList", 0, &JSSVGPointListTable, 0 };
 
-JSSVGPointList::JSSVGPointList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPointList> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGPointList::JSSVGPointList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPointList> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -99,6 +149,7 @@ JSSVGPointList::JSSVGPointList(NonNullPassRefPtr<Structure> structure, JSDOMGlob
 JSSVGPointList::~JSSVGPointList()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGPointList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -116,12 +167,23 @@ bool JSSVGPointList::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSSVGPointList, Base>(exec, &JSSVGPointListTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPointListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPointListNumberOfItems(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPointList* castedThis = static_cast<JSSVGPointList*>(asObject(slot.slotBase()));
+    JSSVGPointList* castedThis = static_cast<JSSVGPointList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPointList* imp = static_cast<SVGPointList*>(castedThis->impl());
-    return jsNumber(exec, imp->numberOfItems());
+    JSValue result = jsNumber(exec, imp->numberOfItems());
+    return result;
+}
+
+JSValue jsSVGPointListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPointList* domObject = static_cast<JSSVGPointList*>(asObject(slotBase));
+    return JSSVGPointList::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGPointList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPointListConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -130,7 +192,7 @@ JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionClear(ExecState* exec, JSOb
     if (!thisValue.inherits(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
-    return castedThisObj->clear(exec, args);
+    return JSSVGPODListCustom::clear<JSSVGPointList, FloatPoint>(castedThisObj, exec, args, toSVGPoint);
 }
 
 JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -139,7 +201,7 @@ JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInitialize(ExecState* exec,
     if (!thisValue.inherits(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
-    return castedThisObj->initialize(exec, args);
+    return JSSVGPODListCustom::initialize<JSSVGPointList, FloatPoint>(castedThisObj, exec, args, toSVGPoint);
 }
 
 JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -148,7 +210,7 @@ JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionGetItem(ExecState* exec, JS
     if (!thisValue.inherits(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
-    return castedThisObj->getItem(exec, args);
+    return JSSVGPODListCustom::getItem<JSSVGPointList, FloatPoint>(castedThisObj, exec, args, toSVGPoint);
 }
 
 JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -157,7 +219,7 @@ JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInsertItemBefore(ExecState*
     if (!thisValue.inherits(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
-    return castedThisObj->insertItemBefore(exec, args);
+    return JSSVGPODListCustom::insertItemBefore<JSSVGPointList, FloatPoint>(castedThisObj, exec, args, toSVGPoint);
 }
 
 JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -166,7 +228,7 @@ JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionReplaceItem(ExecState* exec
     if (!thisValue.inherits(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
-    return castedThisObj->replaceItem(exec, args);
+    return JSSVGPODListCustom::replaceItem<JSSVGPointList, FloatPoint>(castedThisObj, exec, args, toSVGPoint);
 }
 
 JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -175,7 +237,7 @@ JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionRemoveItem(ExecState* exec,
     if (!thisValue.inherits(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
-    return castedThisObj->removeItem(exec, args);
+    return JSSVGPODListCustom::removeItem<JSSVGPointList, FloatPoint>(castedThisObj, exec, args, toSVGPoint);
 }
 
 JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -184,7 +246,7 @@ JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionAppendItem(ExecState* exec,
     if (!thisValue.inherits(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
-    return castedThisObj->appendItem(exec, args);
+    return JSSVGPODListCustom::appendItem<JSSVGPointList, FloatPoint>(castedThisObj, exec, args, toSVGPoint);
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGPointList* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
index c029a46280..66ff36b934 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -33,10 +32,10 @@ namespace WebCore {
 
 class SVGPointList;
 
-class JSSVGPointList : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGPointList : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGPointList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPointList>, SVGElement* context);
+    JSSVGPointList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPointList>);
     virtual ~JSSVGPointList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -46,18 +45,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-
-    // Custom functions
-    JSC::JSValue clear(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue initialize(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue getItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue insertItemBefore(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue replaceItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue removeItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue appendItem(JSC::ExecState*, const JSC::ArgList&);
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGPointList* impl() const { return m_impl.get(); }
 
 private:
@@ -79,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPointListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -97,7 +88,8 @@ JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionRemoveItem(JSC::ExecSt
 JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGPointListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPointListNumberOfItems(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPointListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp
index 517cea907c..2996877d69 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp
@@ -54,21 +54,22 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPolygonElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPolygonElementTableValues[14] =
-{
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGPolygonElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGPolygonElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGPolygonElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGPolygonElementXmllang, (intptr_t)setJSSVGPolygonElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGPolygonElementXmlspace, (intptr_t)setJSSVGPolygonElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGPolygonElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGPolygonElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGPolygonElementStyle, (intptr_t)0 },
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGPolygonElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGPolygonElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGPolygonElementFarthestViewportElement, (intptr_t)0 },
-    { "points", DontDelete|ReadOnly, (intptr_t)jsSVGPolygonElementPoints, (intptr_t)0 },
-    { "animatedPoints", DontDelete|ReadOnly, (intptr_t)jsSVGPolygonElementAnimatedPoints, (intptr_t)0 },
+static const HashTableValue JSSVGPolygonElementTableValues[15] =
+{
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolygonElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolygonElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolygonElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolygonElementXmllang), (intptr_t)setJSSVGPolygonElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolygonElementXmlspace), (intptr_t)setJSSVGPolygonElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolygonElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolygonElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolygonElementStyle), (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolygonElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolygonElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolygonElementFarthestViewportElement), (intptr_t)0 },
+    { "points", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolygonElementPoints), (intptr_t)0 },
+    { "animatedPoints", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolygonElementAnimatedPoints), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolygonElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,19 +77,66 @@ static JSC_CONST_HASHTABLE HashTable JSSVGPolygonElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 127, JSSVGPolygonElementTableValues, 0 };
 #else
-    { 33, 31, JSSVGPolygonElementTableValues, 0 };
+    { 34, 31, JSSVGPolygonElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPolygonElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPolygonElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPolygonElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPolygonElementConstructorTableValues, 0 };
 #endif
 
+class JSSVGPolygonElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGPolygonElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPolygonElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPolygonElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPolygonElementConstructor::s_info = { "SVGPolygonElementConstructor", 0, &JSSVGPolygonElementConstructorTable, 0 };
+
+bool JSSVGPolygonElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPolygonElementConstructor, DOMObject>(exec, &JSSVGPolygonElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPolygonElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPolygonElementConstructor, DOMObject>(exec, &JSSVGPolygonElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPolygonElementPrototypeTableValues[7] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGPolygonElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGPolygonElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGPolygonElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGPolygonElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGPolygonElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGPolygonElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPolygonElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPolygonElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPolygonElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPolygonElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPolygonElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPolygonElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -138,113 +186,131 @@ bool JSSVGPolygonElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSSVGPolygonElement, Base>(exec, &JSSVGPolygonElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPolygonElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()));
+    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGPolygonElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()));
+    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGPolygonElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()));
+    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGPolygonElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()));
+    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGPolygonElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()));
+    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGPolygonElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()));
+    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPolygonElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()));
+    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPolygonElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()));
+    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGPolygonElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()));
+    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPolygonElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()));
+    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGPolygonElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()));
+    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGPolygonElementPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementPoints(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()));
+    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->points()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->points()), imp);
+    return result;
 }
 
-JSValue jsSVGPolygonElementAnimatedPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementAnimatedPoints(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()));
+    JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->animatedPoints()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->animatedPoints()), imp);
+    return result;
 }
 
+JSValue jsSVGPolygonElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPolygonElement* domObject = static_cast<JSSVGPolygonElement*>(asObject(slotBase));
+    return JSSVGPolygonElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPolygonElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPolygonElement, Base>(exec, propertyName, value, &JSSVGPolygonElementTable, this, slot);
@@ -252,16 +318,23 @@ void JSSVGPolygonElement::put(ExecState* exec, const Identifier& propertyName, J
 
 void setJSSVGPolygonElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(thisObject)->impl());
+    JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(thisObject);
+    SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGPolygonElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(thisObject)->impl());
+    JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(thisObject);
+    SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGPolygonElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPolygonElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -299,7 +372,7 @@ JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetBBox(ExecState* exe
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -312,7 +385,7 @@ JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetCTM(ExecState* exec
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -325,7 +398,7 @@ JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetScreenCTM(ExecState
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -340,7 +413,7 @@ JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetTransformToElement(
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
index 0eeac84a66..79def3add3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPolygonElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,21 +79,22 @@ JSC::JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetScreenCTM(JSC:
 JSC::JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGPolygonElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolygonElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolygonElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolygonElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolygonElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolygonElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolygonElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPolygonElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPolygonElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPolygonElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPolygonElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolygonElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolygonElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolygonElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolygonElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolygonElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolygonElementPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolygonElementAnimatedPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolygonElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolygonElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolygonElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolygonElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolygonElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolygonElementPoints(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolygonElementAnimatedPoints(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolygonElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp
index 88beac1116..3adf884622 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp
@@ -54,21 +54,22 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPolylineElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGPolylineElementTableValues[14] =
-{
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGPolylineElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGPolylineElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGPolylineElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGPolylineElementXmllang, (intptr_t)setJSSVGPolylineElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGPolylineElementXmlspace, (intptr_t)setJSSVGPolylineElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGPolylineElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGPolylineElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGPolylineElementStyle, (intptr_t)0 },
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGPolylineElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGPolylineElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGPolylineElementFarthestViewportElement, (intptr_t)0 },
-    { "points", DontDelete|ReadOnly, (intptr_t)jsSVGPolylineElementPoints, (intptr_t)0 },
-    { "animatedPoints", DontDelete|ReadOnly, (intptr_t)jsSVGPolylineElementAnimatedPoints, (intptr_t)0 },
+static const HashTableValue JSSVGPolylineElementTableValues[15] =
+{
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolylineElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolylineElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolylineElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolylineElementXmllang), (intptr_t)setJSSVGPolylineElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolylineElementXmlspace), (intptr_t)setJSSVGPolylineElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolylineElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolylineElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolylineElementStyle), (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolylineElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolylineElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolylineElementFarthestViewportElement), (intptr_t)0 },
+    { "points", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolylineElementPoints), (intptr_t)0 },
+    { "animatedPoints", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolylineElementAnimatedPoints), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPolylineElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,19 +77,66 @@ static JSC_CONST_HASHTABLE HashTable JSSVGPolylineElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 127, JSSVGPolylineElementTableValues, 0 };
 #else
-    { 33, 31, JSSVGPolylineElementTableValues, 0 };
+    { 34, 31, JSSVGPolylineElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGPolylineElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGPolylineElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGPolylineElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGPolylineElementConstructorTableValues, 0 };
 #endif
 
+class JSSVGPolylineElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGPolylineElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGPolylineElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGPolylineElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGPolylineElementConstructor::s_info = { "SVGPolylineElementConstructor", 0, &JSSVGPolylineElementConstructorTable, 0 };
+
+bool JSSVGPolylineElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGPolylineElementConstructor, DOMObject>(exec, &JSSVGPolylineElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGPolylineElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPolylineElementConstructor, DOMObject>(exec, &JSSVGPolylineElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPolylineElementPrototypeTableValues[7] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGPolylineElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGPolylineElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGPolylineElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGPolylineElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGPolylineElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGPolylineElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPolylineElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPolylineElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPolylineElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPolylineElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPolylineElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGPolylineElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -138,113 +186,131 @@ bool JSSVGPolylineElement::getOwnPropertyDescriptor(ExecState* exec, const Ident
     return getStaticValueDescriptor<JSSVGPolylineElement, Base>(exec, &JSSVGPolylineElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPolylineElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()));
+    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGPolylineElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()));
+    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGPolylineElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()));
+    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGPolylineElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()));
+    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGPolylineElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()));
+    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGPolylineElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()));
+    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPolylineElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()));
+    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPolylineElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()));
+    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGPolylineElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()));
+    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGPolylineElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()));
+    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGPolylineElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()));
+    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGPolylineElementPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementPoints(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()));
+    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->points()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->points()), imp);
+    return result;
 }
 
-JSValue jsSVGPolylineElementAnimatedPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementAnimatedPoints(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()));
+    JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->animatedPoints()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->animatedPoints()), imp);
+    return result;
 }
 
+JSValue jsSVGPolylineElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGPolylineElement* domObject = static_cast<JSSVGPolylineElement*>(asObject(slotBase));
+    return JSSVGPolylineElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGPolylineElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPolylineElement, Base>(exec, propertyName, value, &JSSVGPolylineElementTable, this, slot);
@@ -252,16 +318,23 @@ void JSSVGPolylineElement::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSSVGPolylineElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(thisObject)->impl());
+    JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(thisObject);
+    SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGPolylineElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(thisObject)->impl());
+    JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(thisObject);
+    SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGPolylineElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGPolylineElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -299,7 +372,7 @@ JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetBBox(ExecState* ex
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -312,7 +385,7 @@ JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetCTM(ExecState* exe
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -325,7 +398,7 @@ JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetScreenCTM(ExecStat
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -340,7 +413,7 @@ JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetTransformToElement
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
index bd58c78a98..fc7f5aa976 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPolylineElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,21 +79,22 @@ JSC::JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetScreenCTM(JSC
 JSC::JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGPolylineElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolylineElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolylineElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolylineElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolylineElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolylineElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolylineElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPolylineElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPolylineElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPolylineElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPolylineElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolylineElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolylineElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolylineElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolylineElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolylineElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolylineElementPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPolylineElementAnimatedPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolylineElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolylineElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolylineElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolylineElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolylineElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolylineElementPoints(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolylineElementAnimatedPoints(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPolylineElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
index 578cd3405f..fd849bd287 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
@@ -38,9 +38,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGPreserveAspectRatio);
 
 static const HashTableValue JSSVGPreserveAspectRatioTableValues[4] =
 {
-    { "align", DontDelete, (intptr_t)jsSVGPreserveAspectRatioAlign, (intptr_t)setJSSVGPreserveAspectRatioAlign },
-    { "meetOrSlice", DontDelete, (intptr_t)jsSVGPreserveAspectRatioMeetOrSlice, (intptr_t)setJSSVGPreserveAspectRatioMeetOrSlice },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioConstructor, (intptr_t)0 },
+    { "align", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioAlign), (intptr_t)setJSSVGPreserveAspectRatioAlign },
+    { "meetOrSlice", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioMeetOrSlice), (intptr_t)setJSSVGPreserveAspectRatioMeetOrSlice },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -55,20 +55,20 @@ static JSC_CONST_HASHTABLE HashTable JSSVGPreserveAspectRatioTable =
 
 static const HashTableValue JSSVGPreserveAspectRatioConstructorTableValues[15] =
 {
-    { "SVG_PRESERVEASPECTRATIO_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_NONE", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMINYMIN", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMIDYMIN", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMAXYMIN", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMINYMID", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMIDYMID", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMAXYMID", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMINYMAX", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMIDYMAX", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMAXYMAX", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX, (intptr_t)0 },
-    { "SVG_MEETORSLICE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN, (intptr_t)0 },
-    { "SVG_MEETORSLICE_MEET", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET, (intptr_t)0 },
-    { "SVG_MEETORSLICE_SLICE", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE, (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_NONE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMINYMIN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMIDYMIN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMAXYMIN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMINYMID", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMIDYMID", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMAXYMID", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMINYMAX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMIDYMAX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMAXYMAX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX), (intptr_t)0 },
+    { "SVG_MEETORSLICE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN), (intptr_t)0 },
+    { "SVG_MEETORSLICE_MEET", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET), (intptr_t)0 },
+    { "SVG_MEETORSLICE_SLICE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -93,7 +93,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -116,20 +116,20 @@ bool JSSVGPreserveAspectRatioConstructor::getOwnPropertyDescriptor(ExecState* ex
 
 static const HashTableValue JSSVGPreserveAspectRatioPrototypeTableValues[15] =
 {
-    { "SVG_PRESERVEASPECTRATIO_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_NONE", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMINYMIN", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMIDYMIN", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMAXYMIN", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMINYMID", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMIDYMID", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMAXYMID", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMINYMAX", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMIDYMAX", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX, (intptr_t)0 },
-    { "SVG_PRESERVEASPECTRATIO_XMAXYMAX", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX, (intptr_t)0 },
-    { "SVG_MEETORSLICE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN, (intptr_t)0 },
-    { "SVG_MEETORSLICE_MEET", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET, (intptr_t)0 },
-    { "SVG_MEETORSLICE_SLICE", DontDelete|ReadOnly, (intptr_t)jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE, (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_NONE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMINYMIN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMIDYMIN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMAXYMIN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMINYMID", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMIDYMID", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMAXYMID", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMINYMAX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMIDYMAX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX), (intptr_t)0 },
+    { "SVG_PRESERVEASPECTRATIO_XMAXYMAX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX), (intptr_t)0 },
+    { "SVG_MEETORSLICE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN), (intptr_t)0 },
+    { "SVG_MEETORSLICE_MEET", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET), (intptr_t)0 },
+    { "SVG_MEETORSLICE_SLICE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -159,8 +159,8 @@ bool JSSVGPreserveAspectRatioPrototype::getOwnPropertyDescriptor(ExecState* exec
 
 const ClassInfo JSSVGPreserveAspectRatio::s_info = { "SVGPreserveAspectRatio", 0, &JSSVGPreserveAspectRatioTable, 0 };
 
-JSSVGPreserveAspectRatio::JSSVGPreserveAspectRatio(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPreserveAspectRatio> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGPreserveAspectRatio::JSSVGPreserveAspectRatio(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<SVGPreserveAspectRatio> > impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -168,6 +168,7 @@ JSSVGPreserveAspectRatio::JSSVGPreserveAspectRatio(NonNullPassRefPtr<Structure>
 JSSVGPreserveAspectRatio::~JSSVGPreserveAspectRatio()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGPreserveAspectRatio::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -185,26 +186,28 @@ bool JSSVGPreserveAspectRatio::getOwnPropertyDescriptor(ExecState* exec, const I
     return getStaticValueDescriptor<JSSVGPreserveAspectRatio, Base>(exec, &JSSVGPreserveAspectRatioTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGPreserveAspectRatioAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPreserveAspectRatioAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPreserveAspectRatio* castedThis = static_cast<JSSVGPreserveAspectRatio*>(asObject(slot.slotBase()));
+    JSSVGPreserveAspectRatio* castedThis = static_cast<JSSVGPreserveAspectRatio*>(asObject(slotBase));
     UNUSED_PARAM(exec);
-    SVGPreserveAspectRatio* imp = static_cast<SVGPreserveAspectRatio*>(castedThis->impl());
-    return jsNumber(exec, imp->align());
+    SVGPreserveAspectRatio imp(*castedThis->impl());
+    JSValue result =  jsNumber(exec, imp.align());
+    return result;
 }
 
-JSValue jsSVGPreserveAspectRatioMeetOrSlice(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPreserveAspectRatioMeetOrSlice(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGPreserveAspectRatio* castedThis = static_cast<JSSVGPreserveAspectRatio*>(asObject(slot.slotBase()));
+    JSSVGPreserveAspectRatio* castedThis = static_cast<JSSVGPreserveAspectRatio*>(asObject(slotBase));
     UNUSED_PARAM(exec);
-    SVGPreserveAspectRatio* imp = static_cast<SVGPreserveAspectRatio*>(castedThis->impl());
-    return jsNumber(exec, imp->meetOrSlice());
+    SVGPreserveAspectRatio imp(*castedThis->impl());
+    JSValue result =  jsNumber(exec, imp.meetOrSlice());
+    return result;
 }
 
-JSValue jsSVGPreserveAspectRatioConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPreserveAspectRatioConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    UNUSED_PARAM(slot);
-    return JSSVGPreserveAspectRatio::getConstructor(exec, deprecatedGlobalObjectForPrototype(exec));
+    JSSVGPreserveAspectRatio* domObject = static_cast<JSSVGPreserveAspectRatio*>(asObject(slotBase));
+    return JSSVGPreserveAspectRatio::getConstructor(exec, domObject->globalObject());
 }
 void JSSVGPreserveAspectRatio::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
@@ -213,18 +216,20 @@ void JSSVGPreserveAspectRatio::put(ExecState* exec, const Identifier& propertyNa
 
 void setJSSVGPreserveAspectRatioAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPreserveAspectRatio* imp = static_cast<SVGPreserveAspectRatio*>(static_cast<JSSVGPreserveAspectRatio*>(thisObject)->impl());
-    imp->setAlign(value.toInt32(exec));
-    if (static_cast<JSSVGPreserveAspectRatio*>(thisObject)->context())
-        static_cast<JSSVGPreserveAspectRatio*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPreserveAspectRatio*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGPreserveAspectRatio* castedThisObj = static_cast<JSSVGPreserveAspectRatio*>(thisObject);
+    JSSVGPODTypeWrapper<SVGPreserveAspectRatio> * imp = static_cast<JSSVGPODTypeWrapper<SVGPreserveAspectRatio> *>(castedThisObj->impl());
+    SVGPreserveAspectRatio podImp(*imp);
+    podImp.setAlign(value.toInt32(exec));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 void setJSSVGPreserveAspectRatioMeetOrSlice(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGPreserveAspectRatio* imp = static_cast<SVGPreserveAspectRatio*>(static_cast<JSSVGPreserveAspectRatio*>(thisObject)->impl());
-    imp->setMeetOrSlice(value.toInt32(exec));
-    if (static_cast<JSSVGPreserveAspectRatio*>(thisObject)->context())
-        static_cast<JSSVGPreserveAspectRatio*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPreserveAspectRatio*>(thisObject)->impl()->associatedAttributeName());
+    JSSVGPreserveAspectRatio* castedThisObj = static_cast<JSSVGPreserveAspectRatio*>(thisObject);
+    JSSVGPODTypeWrapper<SVGPreserveAspectRatio> * imp = static_cast<JSSVGPODTypeWrapper<SVGPreserveAspectRatio> *>(castedThisObj->impl());
+    SVGPreserveAspectRatio podImp(*imp);
+    podImp.setMeetOrSlice(value.toInt32(exec));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 JSValue JSSVGPreserveAspectRatio::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -234,83 +239,83 @@ JSValue JSSVGPreserveAspectRatio::getConstructor(ExecState* exec, JSGlobalObject
 
 // Constant getters
 
-JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGPreserveAspectRatio* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JSSVGPODTypeWrapper<SVGPreserveAspectRatio>* object, SVGElement* context)
 {
-    return getDOMObjectWrapper<JSSVGPreserveAspectRatio>(exec, globalObject, object, context);
+    return getDOMObjectWrapper<JSSVGPreserveAspectRatio, JSSVGPODTypeWrapper<SVGPreserveAspectRatio> >(exec, globalObject, object, context);
 }
-SVGPreserveAspectRatio* toSVGPreserveAspectRatio(JSC::JSValue value)
+SVGPreserveAspectRatio toSVGPreserveAspectRatio(JSC::JSValue value)
 {
-    return value.inherits(&JSSVGPreserveAspectRatio::s_info) ? static_cast<JSSVGPreserveAspectRatio*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGPreserveAspectRatio::s_info) ? (SVGPreserveAspectRatio) *static_cast<JSSVGPreserveAspectRatio*>(asObject(value))->impl() : SVGPreserveAspectRatio();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
index 32f1661ea9..995256e2b0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
@@ -23,20 +23,19 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
+#include "JSSVGPODTypeWrapper.h"
 #include "SVGElement.h"
+#include "SVGPreserveAspectRatio.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
 namespace WebCore {
 
-class SVGPreserveAspectRatio;
-
-class JSSVGPreserveAspectRatio : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGPreserveAspectRatio : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGPreserveAspectRatio(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPreserveAspectRatio>, SVGElement* context);
+    JSSVGPreserveAspectRatio(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<JSSVGPODTypeWrapper<SVGPreserveAspectRatio> >);
     virtual ~JSSVGPreserveAspectRatio();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -47,20 +46,20 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
-    SVGPreserveAspectRatio* impl() const { return m_impl.get(); }
+    JSSVGPODTypeWrapper<SVGPreserveAspectRatio> * impl() const { return m_impl.get(); }
 
 private:
-    RefPtr<SVGPreserveAspectRatio> m_impl;
+    RefPtr<JSSVGPODTypeWrapper<SVGPreserveAspectRatio> > m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGPreserveAspectRatio*, SVGElement* context);
-SVGPreserveAspectRatio* toSVGPreserveAspectRatio(JSC::JSValue);
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<SVGPreserveAspectRatio>*, SVGElement*);
+SVGPreserveAspectRatio toSVGPreserveAspectRatio(JSC::JSValue);
 
 class JSSVGPreserveAspectRatioPrototype : public JSC::JSObject {
     typedef JSC::JSObject Base;
@@ -72,7 +71,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGPreserveAspectRatioPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -81,27 +80,27 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGPreserveAspectRatioAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPreserveAspectRatioAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPreserveAspectRatioMeetOrSlice(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioMeetOrSlice(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGPreserveAspectRatioMeetOrSlice(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGPreserveAspectRatioConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp
index e097aac294..ceda14bebe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp
@@ -36,13 +36,14 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGRadialGradientElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGRadialGradientElementTableValues[6] =
+static const HashTableValue JSSVGRadialGradientElementTableValues[7] =
 {
-    { "cx", DontDelete|ReadOnly, (intptr_t)jsSVGRadialGradientElementCx, (intptr_t)0 },
-    { "cy", DontDelete|ReadOnly, (intptr_t)jsSVGRadialGradientElementCy, (intptr_t)0 },
-    { "r", DontDelete|ReadOnly, (intptr_t)jsSVGRadialGradientElementR, (intptr_t)0 },
-    { "fx", DontDelete|ReadOnly, (intptr_t)jsSVGRadialGradientElementFx, (intptr_t)0 },
-    { "fy", DontDelete|ReadOnly, (intptr_t)jsSVGRadialGradientElementFy, (intptr_t)0 },
+    { "cx", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRadialGradientElementCx), (intptr_t)0 },
+    { "cy", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRadialGradientElementCy), (intptr_t)0 },
+    { "r", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRadialGradientElementR), (intptr_t)0 },
+    { "fx", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRadialGradientElementFx), (intptr_t)0 },
+    { "fy", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRadialGradientElementFy), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRadialGradientElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -53,6 +54,53 @@ static JSC_CONST_HASHTABLE HashTable JSSVGRadialGradientElementTable =
     { 18, 15, JSSVGRadialGradientElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGRadialGradientElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGRadialGradientElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGRadialGradientElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGRadialGradientElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGRadialGradientElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGRadialGradientElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGRadialGradientElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGRadialGradientElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGRadialGradientElementConstructor::s_info = { "SVGRadialGradientElementConstructor", 0, &JSSVGRadialGradientElementConstructorTable, 0 };
+
+bool JSSVGRadialGradientElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGRadialGradientElementConstructor, DOMObject>(exec, &JSSVGRadialGradientElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGRadialGradientElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGRadialGradientElementConstructor, DOMObject>(exec, &JSSVGRadialGradientElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGRadialGradientElementPrototypeTableValues[1] =
@@ -96,49 +144,64 @@ bool JSSVGRadialGradientElement::getOwnPropertyDescriptor(ExecState* exec, const
     return getStaticValueDescriptor<JSSVGRadialGradientElement, Base>(exec, &JSSVGRadialGradientElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGRadialGradientElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRadialGradientElementCx(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRadialGradientElement* castedThis = static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()));
+    JSSVGRadialGradientElement* castedThis = static_cast<JSSVGRadialGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRadialGradientElement* imp = static_cast<SVGRadialGradientElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cxAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGRadialGradientElementCy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRadialGradientElementCy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRadialGradientElement* castedThis = static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()));
+    JSSVGRadialGradientElement* castedThis = static_cast<JSSVGRadialGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRadialGradientElement* imp = static_cast<SVGRadialGradientElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cyAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGRadialGradientElementR(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRadialGradientElementR(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRadialGradientElement* castedThis = static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()));
+    JSSVGRadialGradientElement* castedThis = static_cast<JSSVGRadialGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRadialGradientElement* imp = static_cast<SVGRadialGradientElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->rAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGRadialGradientElementFx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRadialGradientElementFx(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRadialGradientElement* castedThis = static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()));
+    JSSVGRadialGradientElement* castedThis = static_cast<JSSVGRadialGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRadialGradientElement* imp = static_cast<SVGRadialGradientElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->fxAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGRadialGradientElementFy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRadialGradientElementFy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRadialGradientElement* castedThis = static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()));
+    JSSVGRadialGradientElement* castedThis = static_cast<JSSVGRadialGradientElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRadialGradientElement* imp = static_cast<SVGRadialGradientElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->fyAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
+}
+
+JSValue jsSVGRadialGradientElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGRadialGradientElement* domObject = static_cast<JSSVGRadialGradientElement*>(asObject(slotBase));
+    return JSSVGRadialGradientElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGRadialGradientElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGRadialGradientElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
index a4c3b87639..c558b284ea 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -58,7 +59,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGRadialGradientElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -67,11 +68,12 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGRadialGradientElementCx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRadialGradientElementCy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRadialGradientElementR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRadialGradientElementFx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRadialGradientElementFy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRadialGradientElementCx(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRadialGradientElementCy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRadialGradientElementR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRadialGradientElementFx(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRadialGradientElementFy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRadialGradientElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp
index e60a309ef9..3e256eba02 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp
@@ -35,22 +35,70 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGRect);
 
 /* Hash table */
 
-static const HashTableValue JSSVGRectTableValues[5] =
+static const HashTableValue JSSVGRectTableValues[6] =
 {
-    { "x", DontDelete, (intptr_t)jsSVGRectX, (intptr_t)setJSSVGRectX },
-    { "y", DontDelete, (intptr_t)jsSVGRectY, (intptr_t)setJSSVGRectY },
-    { "width", DontDelete, (intptr_t)jsSVGRectWidth, (intptr_t)setJSSVGRectWidth },
-    { "height", DontDelete, (intptr_t)jsSVGRectHeight, (intptr_t)setJSSVGRectHeight },
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectX), (intptr_t)setJSSVGRectX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectY), (intptr_t)setJSSVGRectY },
+    { "width", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectWidth), (intptr_t)setJSSVGRectWidth },
+    { "height", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectHeight), (intptr_t)setJSSVGRectHeight },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGRectTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 15, JSSVGRectTableValues, 0 };
+    { 31, JSSVGRectTableValues, 0 };
 #else
-    { 9, 7, JSSVGRectTableValues, 0 };
+    { 17, 15, JSSVGRectTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGRectConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGRectConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGRectConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGRectConstructorTableValues, 0 };
+#endif
+
+class JSSVGRectConstructor : public DOMConstructorObject {
+public:
+    JSSVGRectConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGRectConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGRectPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGRectConstructor::s_info = { "SVGRectConstructor", 0, &JSSVGRectConstructorTable, 0 };
+
+bool JSSVGRectConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGRectConstructor, DOMObject>(exec, &JSSVGRectConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGRectConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGRectConstructor, DOMObject>(exec, &JSSVGRectConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGRectPrototypeTableValues[1] =
@@ -74,16 +122,16 @@ JSObject* JSSVGRectPrototype::self(ExecState* exec, JSGlobalObject* globalObject
 
 const ClassInfo JSSVGRect::s_info = { "SVGRect", 0, &JSSVGRectTable, 0 };
 
-JSSVGRect::JSSVGRect(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<FloatRect> > impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGRect::JSSVGRect(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<FloatRect> > impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
 
 JSSVGRect::~JSSVGRect()
 {
-    JSSVGDynamicPODTypeWrapperCache<FloatRect, SVGAnimatedRect>::forgetWrapper(m_impl.get());
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -101,38 +149,47 @@ bool JSSVGRect::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return getStaticValueDescriptor<JSSVGRect, Base>(exec, &JSSVGRectTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGRectX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRect* castedThis = static_cast<JSSVGRect*>(asObject(slot.slotBase()));
+    JSSVGRect* castedThis = static_cast<JSSVGRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     FloatRect imp(*castedThis->impl());
-    return jsNumber(exec, imp.x());
+    JSValue result =  jsNumber(exec, imp.x());
+    return result;
 }
 
-JSValue jsSVGRectY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRect* castedThis = static_cast<JSSVGRect*>(asObject(slot.slotBase()));
+    JSSVGRect* castedThis = static_cast<JSSVGRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     FloatRect imp(*castedThis->impl());
-    return jsNumber(exec, imp.y());
+    JSValue result =  jsNumber(exec, imp.y());
+    return result;
 }
 
-JSValue jsSVGRectWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRect* castedThis = static_cast<JSSVGRect*>(asObject(slot.slotBase()));
+    JSSVGRect* castedThis = static_cast<JSSVGRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     FloatRect imp(*castedThis->impl());
-    return jsNumber(exec, imp.width());
+    JSValue result =  jsNumber(exec, imp.width());
+    return result;
 }
 
-JSValue jsSVGRectHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRect* castedThis = static_cast<JSSVGRect*>(asObject(slot.slotBase()));
+    JSSVGRect* castedThis = static_cast<JSSVGRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     FloatRect imp(*castedThis->impl());
-    return jsNumber(exec, imp.height());
+    JSValue result =  jsNumber(exec, imp.height());
+    return result;
 }
 
+JSValue jsSVGRectConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGRect* domObject = static_cast<JSSVGRect*>(asObject(slotBase));
+    return JSSVGRect::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGRect::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGRect, Base>(exec, propertyName, value, &JSSVGRectTable, this, slot);
@@ -140,30 +197,43 @@ void JSSVGRect::put(ExecState* exec, const Identifier& propertyName, JSValue val
 
 void setJSSVGRectX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    FloatRect imp(*static_cast<JSSVGRect*>(thisObject)->impl());
-    imp.setX(value.toFloat(exec));
-        static_cast<JSSVGRect*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGRect*>(thisObject)->context());
+    JSSVGRect* castedThisObj = static_cast<JSSVGRect*>(thisObject);
+    JSSVGPODTypeWrapper<FloatRect> * imp = static_cast<JSSVGPODTypeWrapper<FloatRect> *>(castedThisObj->impl());
+    FloatRect podImp(*imp);
+    podImp.setX(value.toFloat(exec));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 void setJSSVGRectY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    FloatRect imp(*static_cast<JSSVGRect*>(thisObject)->impl());
-    imp.setY(value.toFloat(exec));
-        static_cast<JSSVGRect*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGRect*>(thisObject)->context());
+    JSSVGRect* castedThisObj = static_cast<JSSVGRect*>(thisObject);
+    JSSVGPODTypeWrapper<FloatRect> * imp = static_cast<JSSVGPODTypeWrapper<FloatRect> *>(castedThisObj->impl());
+    FloatRect podImp(*imp);
+    podImp.setY(value.toFloat(exec));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 void setJSSVGRectWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    FloatRect imp(*static_cast<JSSVGRect*>(thisObject)->impl());
-    imp.setWidth(value.toFloat(exec));
-        static_cast<JSSVGRect*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGRect*>(thisObject)->context());
+    JSSVGRect* castedThisObj = static_cast<JSSVGRect*>(thisObject);
+    JSSVGPODTypeWrapper<FloatRect> * imp = static_cast<JSSVGPODTypeWrapper<FloatRect> *>(castedThisObj->impl());
+    FloatRect podImp(*imp);
+    podImp.setWidth(value.toFloat(exec));
+    imp->commitChange(podImp, castedThisObj);
 }
 
 void setJSSVGRectHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    FloatRect imp(*static_cast<JSSVGRect*>(thisObject)->impl());
-    imp.setHeight(value.toFloat(exec));
-        static_cast<JSSVGRect*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGRect*>(thisObject)->context());
+    JSSVGRect* castedThisObj = static_cast<JSSVGRect*>(thisObject);
+    JSSVGPODTypeWrapper<FloatRect> * imp = static_cast<JSSVGPODTypeWrapper<FloatRect> *>(castedThisObj->impl());
+    FloatRect podImp(*imp);
+    podImp.setHeight(value.toFloat(exec));
+    imp->commitChange(podImp, castedThisObj);
+}
+
+JSValue JSSVGRect::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGRectConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JSSVGPODTypeWrapper<FloatRect>* object, SVGElement* context)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
index 209e365339..40952c79a9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "FloatRect.h"
 #include "JSDOMBinding.h"
 #include "JSSVGPODTypeWrapper.h"
@@ -33,10 +32,10 @@
 
 namespace WebCore {
 
-class JSSVGRect : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGRect : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGRect(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<JSSVGPODTypeWrapper<FloatRect> >, SVGElement* context);
+    JSSVGRect(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<JSSVGPODTypeWrapper<FloatRect> >);
     virtual ~JSSVGRect();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -47,9 +46,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     JSSVGPODTypeWrapper<FloatRect> * impl() const { return m_impl.get(); }
 
 private:
@@ -58,7 +58,7 @@ protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<FloatRect>*, SVGElement* context);
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<FloatRect>*, SVGElement*);
 FloatRect toSVGRect(JSC::JSValue);
 
 class JSSVGRectPrototype : public JSC::JSObject {
@@ -69,7 +69,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGRectPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,14 +78,15 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGRectX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGRectX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGRectY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGRectY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGRectWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGRectWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGRectHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGRectHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGRectConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp
index 258049db01..1746617374 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp
@@ -53,25 +53,26 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGRectElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGRectElementTableValues[18] =
-{
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGRectElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGRectElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGRectElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGRectElementHeight, (intptr_t)0 },
-    { "rx", DontDelete|ReadOnly, (intptr_t)jsSVGRectElementRx, (intptr_t)0 },
-    { "ry", DontDelete|ReadOnly, (intptr_t)jsSVGRectElementRy, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGRectElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGRectElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGRectElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGRectElementXmllang, (intptr_t)setJSSVGRectElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGRectElementXmlspace, (intptr_t)setJSSVGRectElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGRectElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGRectElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGRectElementStyle, (intptr_t)0 },
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGRectElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGRectElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGRectElementFarthestViewportElement, (intptr_t)0 },
+static const HashTableValue JSSVGRectElementTableValues[19] =
+{
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementHeight), (intptr_t)0 },
+    { "rx", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementRx), (intptr_t)0 },
+    { "ry", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementRy), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementXmllang), (intptr_t)setJSSVGRectElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementXmlspace), (intptr_t)setJSSVGRectElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementStyle), (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementFarthestViewportElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRectElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -82,16 +83,63 @@ static JSC_CONST_HASHTABLE HashTable JSSVGRectElementTable =
     { 69, 63, JSSVGRectElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGRectElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGRectElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGRectElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGRectElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGRectElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGRectElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGRectElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGRectElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGRectElementConstructor::s_info = { "SVGRectElementConstructor", 0, &JSSVGRectElementConstructorTable, 0 };
+
+bool JSSVGRectElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGRectElementConstructor, DOMObject>(exec, &JSSVGRectElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGRectElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGRectElementConstructor, DOMObject>(exec, &JSSVGRectElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGRectElementPrototypeTableValues[7] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGRectElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGRectElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGRectElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGRectElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGRectElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGRectElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGRectElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGRectElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGRectElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGRectElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGRectElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGRectElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -141,151 +189,173 @@ bool JSSVGRectElement::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSSVGRectElement, Base>(exec, &JSSVGRectElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGRectElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGRectElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGRectElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGRectElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGRectElementRx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementRx(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->rxAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGRectElementRy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementRy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->ryAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGRectElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGRectElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGRectElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGRectElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGRectElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGRectElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGRectElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGRectElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGRectElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGRectElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGRectElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
+    JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
+JSValue jsSVGRectElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGRectElement* domObject = static_cast<JSSVGRectElement*>(asObject(slotBase));
+    return JSSVGRectElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGRectElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGRectElement, Base>(exec, propertyName, value, &JSSVGRectElementTable, this, slot);
@@ -293,16 +363,23 @@ void JSSVGRectElement::put(ExecState* exec, const Identifier& propertyName, JSVa
 
 void setJSSVGRectElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(thisObject)->impl());
+    JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(thisObject);
+    SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGRectElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(thisObject)->impl());
+    JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(thisObject);
+    SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGRectElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGRectElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -340,7 +417,7 @@ JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetBBox(ExecState* exec,
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -353,7 +430,7 @@ JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetCTM(ExecState* exec, J
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -366,7 +443,7 @@ JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetScreenCTM(ExecState* e
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -381,7 +458,7 @@ JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetTransformToElement(Exe
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
index 7572ac1a09..a3c0f61215 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGRectElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,25 +79,26 @@ JSC::JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetScreenCTM(JSC::Ex
 JSC::JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGRectElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRectElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRectElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRectElementRx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRectElementRy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRectElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRectElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRectElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRectElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRectElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRectElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRectElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRectElementRx(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRectElementRy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRectElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRectElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRectElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRectElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGRectElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGRectElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGRectElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGRectElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRectElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRectElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRectElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRectElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRectElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRectElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRectElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRectElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRectElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRectElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRectElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
index 1793c23455..fc2975e327 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
@@ -37,7 +37,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGRenderingIntent);
 
 static const HashTableValue JSSVGRenderingIntentTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGRenderingIntentConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRenderingIntentConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -52,12 +52,12 @@ static JSC_CONST_HASHTABLE HashTable JSSVGRenderingIntentTable =
 
 static const HashTableValue JSSVGRenderingIntentConstructorTableValues[7] =
 {
-    { "RENDERING_INTENT_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN, (intptr_t)0 },
-    { "RENDERING_INTENT_AUTO", DontDelete|ReadOnly, (intptr_t)jsSVGRenderingIntentRENDERING_INTENT_AUTO, (intptr_t)0 },
-    { "RENDERING_INTENT_PERCEPTUAL", DontDelete|ReadOnly, (intptr_t)jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL, (intptr_t)0 },
-    { "RENDERING_INTENT_RELATIVE_COLORIMETRIC", DontDelete|ReadOnly, (intptr_t)jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC, (intptr_t)0 },
-    { "RENDERING_INTENT_SATURATION", DontDelete|ReadOnly, (intptr_t)jsSVGRenderingIntentRENDERING_INTENT_SATURATION, (intptr_t)0 },
-    { "RENDERING_INTENT_ABSOLUTE_COLORIMETRIC", DontDelete|ReadOnly, (intptr_t)jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC, (intptr_t)0 },
+    { "RENDERING_INTENT_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN), (intptr_t)0 },
+    { "RENDERING_INTENT_AUTO", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRenderingIntentRENDERING_INTENT_AUTO), (intptr_t)0 },
+    { "RENDERING_INTENT_PERCEPTUAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL), (intptr_t)0 },
+    { "RENDERING_INTENT_RELATIVE_COLORIMETRIC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC), (intptr_t)0 },
+    { "RENDERING_INTENT_SATURATION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRenderingIntentRENDERING_INTENT_SATURATION), (intptr_t)0 },
+    { "RENDERING_INTENT_ABSOLUTE_COLORIMETRIC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -82,7 +82,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -105,12 +105,12 @@ bool JSSVGRenderingIntentConstructor::getOwnPropertyDescriptor(ExecState* exec,
 
 static const HashTableValue JSSVGRenderingIntentPrototypeTableValues[7] =
 {
-    { "RENDERING_INTENT_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN, (intptr_t)0 },
-    { "RENDERING_INTENT_AUTO", DontDelete|ReadOnly, (intptr_t)jsSVGRenderingIntentRENDERING_INTENT_AUTO, (intptr_t)0 },
-    { "RENDERING_INTENT_PERCEPTUAL", DontDelete|ReadOnly, (intptr_t)jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL, (intptr_t)0 },
-    { "RENDERING_INTENT_RELATIVE_COLORIMETRIC", DontDelete|ReadOnly, (intptr_t)jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC, (intptr_t)0 },
-    { "RENDERING_INTENT_SATURATION", DontDelete|ReadOnly, (intptr_t)jsSVGRenderingIntentRENDERING_INTENT_SATURATION, (intptr_t)0 },
-    { "RENDERING_INTENT_ABSOLUTE_COLORIMETRIC", DontDelete|ReadOnly, (intptr_t)jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC, (intptr_t)0 },
+    { "RENDERING_INTENT_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN), (intptr_t)0 },
+    { "RENDERING_INTENT_AUTO", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRenderingIntentRENDERING_INTENT_AUTO), (intptr_t)0 },
+    { "RENDERING_INTENT_PERCEPTUAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL), (intptr_t)0 },
+    { "RENDERING_INTENT_RELATIVE_COLORIMETRIC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC), (intptr_t)0 },
+    { "RENDERING_INTENT_SATURATION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRenderingIntentRENDERING_INTENT_SATURATION), (intptr_t)0 },
+    { "RENDERING_INTENT_ABSOLUTE_COLORIMETRIC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -140,8 +140,8 @@ bool JSSVGRenderingIntentPrototype::getOwnPropertyDescriptor(ExecState* exec, co
 
 const ClassInfo JSSVGRenderingIntent::s_info = { "SVGRenderingIntent", 0, &JSSVGRenderingIntentTable, 0 };
 
-JSSVGRenderingIntent::JSSVGRenderingIntent(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGRenderingIntent> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGRenderingIntent::JSSVGRenderingIntent(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGRenderingIntent> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -149,6 +149,7 @@ JSSVGRenderingIntent::JSSVGRenderingIntent(NonNullPassRefPtr<Structure> structur
 JSSVGRenderingIntent::~JSSVGRenderingIntent()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGRenderingIntent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -166,10 +167,10 @@ bool JSSVGRenderingIntent::getOwnPropertyDescriptor(ExecState* exec, const Ident
     return getStaticValueDescriptor<JSSVGRenderingIntent, Base>(exec, &JSSVGRenderingIntentTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGRenderingIntentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRenderingIntentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    UNUSED_PARAM(slot);
-    return JSSVGRenderingIntent::getConstructor(exec, deprecatedGlobalObjectForPrototype(exec));
+    JSSVGRenderingIntent* domObject = static_cast<JSSVGRenderingIntent*>(asObject(slotBase));
+    return JSSVGRenderingIntent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGRenderingIntent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 {
@@ -178,32 +179,32 @@ JSValue JSSVGRenderingIntent::getConstructor(ExecState* exec, JSGlobalObject* gl
 
 // Constant getters
 
-JSValue jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGRenderingIntentRENDERING_INTENT_AUTO(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_AUTO(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsSVGRenderingIntentRENDERING_INTENT_SATURATION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_SATURATION(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
index 16fcff28b4..d45ef9d4c2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -33,10 +32,10 @@ namespace WebCore {
 
 class SVGRenderingIntent;
 
-class JSSVGRenderingIntent : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGRenderingIntent : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGRenderingIntent(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGRenderingIntent>, SVGElement* context);
+    JSSVGRenderingIntent(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGRenderingIntent>);
     virtual ~JSSVGRenderingIntent();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -46,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -71,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGRenderingIntentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,15 +79,15 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGRenderingIntentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_AUTO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_SATURATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_AUTO(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_SATURATION(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp
index f8223bbefc..750af49bb1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp
@@ -67,35 +67,36 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGSVGElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGSVGElementTableValues[28] =
-{
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementHeight, (intptr_t)0 },
-    { "contentScriptType", DontDelete, (intptr_t)jsSVGSVGElementContentScriptType, (intptr_t)setJSSVGSVGElementContentScriptType },
-    { "contentStyleType", DontDelete, (intptr_t)jsSVGSVGElementContentStyleType, (intptr_t)setJSSVGSVGElementContentStyleType },
-    { "viewport", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementViewport, (intptr_t)0 },
-    { "pixelUnitToMillimeterX", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementPixelUnitToMillimeterX, (intptr_t)0 },
-    { "pixelUnitToMillimeterY", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementPixelUnitToMillimeterY, (intptr_t)0 },
-    { "screenPixelToMillimeterX", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementScreenPixelToMillimeterX, (intptr_t)0 },
-    { "screenPixelToMillimeterY", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementScreenPixelToMillimeterY, (intptr_t)0 },
-    { "useCurrentView", DontDelete, (intptr_t)jsSVGSVGElementUseCurrentView, (intptr_t)setJSSVGSVGElementUseCurrentView },
-    { "currentScale", DontDelete, (intptr_t)jsSVGSVGElementCurrentScale, (intptr_t)setJSSVGSVGElementCurrentScale },
-    { "currentTranslate", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementCurrentTranslate, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGSVGElementXmllang, (intptr_t)setJSSVGSVGElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGSVGElementXmlspace, (intptr_t)setJSSVGSVGElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementStyle, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementFarthestViewportElement, (intptr_t)0 },
-    { "viewBox", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementViewBox, (intptr_t)0 },
-    { "preserveAspectRatio", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementPreserveAspectRatio, (intptr_t)0 },
-    { "zoomAndPan", DontDelete, (intptr_t)jsSVGSVGElementZoomAndPan, (intptr_t)setJSSVGSVGElementZoomAndPan },
+static const HashTableValue JSSVGSVGElementTableValues[29] =
+{
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementHeight), (intptr_t)0 },
+    { "contentScriptType", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementContentScriptType), (intptr_t)setJSSVGSVGElementContentScriptType },
+    { "contentStyleType", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementContentStyleType), (intptr_t)setJSSVGSVGElementContentStyleType },
+    { "viewport", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementViewport), (intptr_t)0 },
+    { "pixelUnitToMillimeterX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementPixelUnitToMillimeterX), (intptr_t)0 },
+    { "pixelUnitToMillimeterY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementPixelUnitToMillimeterY), (intptr_t)0 },
+    { "screenPixelToMillimeterX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementScreenPixelToMillimeterX), (intptr_t)0 },
+    { "screenPixelToMillimeterY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementScreenPixelToMillimeterY), (intptr_t)0 },
+    { "useCurrentView", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementUseCurrentView), (intptr_t)setJSSVGSVGElementUseCurrentView },
+    { "currentScale", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementCurrentScale), (intptr_t)setJSSVGSVGElementCurrentScale },
+    { "currentTranslate", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementCurrentTranslate), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementXmllang), (intptr_t)setJSSVGSVGElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementXmlspace), (intptr_t)setJSSVGSVGElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementStyle), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementFarthestViewportElement), (intptr_t)0 },
+    { "viewBox", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementViewBox), (intptr_t)0 },
+    { "preserveAspectRatio", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementPreserveAspectRatio), (intptr_t)0 },
+    { "zoomAndPan", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementZoomAndPan), (intptr_t)setJSSVGSVGElementZoomAndPan },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -106,41 +107,91 @@ static JSC_CONST_HASHTABLE HashTable JSSVGSVGElementTable =
     { 70, 63, JSSVGSVGElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGSVGElementConstructorTableValues[4] =
+{
+    { "SVG_ZOOMANDPAN_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWN), (intptr_t)0 },
+    { "SVG_ZOOMANDPAN_DISABLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementSVG_ZOOMANDPAN_DISABLE), (intptr_t)0 },
+    { "SVG_ZOOMANDPAN_MAGNIFY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFY), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGSVGElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 31, JSSVGSVGElementConstructorTableValues, 0 };
+#else
+    { 9, 7, JSSVGSVGElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGSVGElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGSVGElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGSVGElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGSVGElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGSVGElementConstructor::s_info = { "SVGSVGElementConstructor", 0, &JSSVGSVGElementConstructorTable, 0 };
+
+bool JSSVGSVGElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGSVGElementConstructor, DOMObject>(exec, &JSSVGSVGElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGSVGElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGSVGElementConstructor, DOMObject>(exec, &JSSVGSVGElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGSVGElementPrototypeTableValues[32] =
 {
-    { "SVG_ZOOMANDPAN_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWN, (intptr_t)0 },
-    { "SVG_ZOOMANDPAN_DISABLE", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementSVG_ZOOMANDPAN_DISABLE, (intptr_t)0 },
-    { "SVG_ZOOMANDPAN_MAGNIFY", DontDelete|ReadOnly, (intptr_t)jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFY, (intptr_t)0 },
-    { "suspendRedraw", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionSuspendRedraw, (intptr_t)1 },
-    { "unsuspendRedraw", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionUnsuspendRedraw, (intptr_t)1 },
-    { "unsuspendRedrawAll", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionUnsuspendRedrawAll, (intptr_t)0 },
-    { "forceRedraw", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionForceRedraw, (intptr_t)0 },
-    { "pauseAnimations", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionPauseAnimations, (intptr_t)0 },
-    { "unpauseAnimations", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionUnpauseAnimations, (intptr_t)0 },
-    { "animationsPaused", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionAnimationsPaused, (intptr_t)0 },
-    { "getCurrentTime", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionGetCurrentTime, (intptr_t)0 },
-    { "setCurrentTime", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionSetCurrentTime, (intptr_t)1 },
-    { "getIntersectionList", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionGetIntersectionList, (intptr_t)2 },
-    { "getEnclosureList", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionGetEnclosureList, (intptr_t)2 },
-    { "checkIntersection", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionCheckIntersection, (intptr_t)2 },
-    { "checkEnclosure", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionCheckEnclosure, (intptr_t)2 },
-    { "deselectAll", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionDeselectAll, (intptr_t)0 },
-    { "createSVGNumber", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionCreateSVGNumber, (intptr_t)0 },
-    { "createSVGLength", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionCreateSVGLength, (intptr_t)0 },
-    { "createSVGAngle", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionCreateSVGAngle, (intptr_t)0 },
-    { "createSVGPoint", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionCreateSVGPoint, (intptr_t)0 },
-    { "createSVGMatrix", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionCreateSVGMatrix, (intptr_t)0 },
-    { "createSVGRect", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionCreateSVGRect, (intptr_t)0 },
-    { "createSVGTransform", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionCreateSVGTransform, (intptr_t)0 },
-    { "createSVGTransformFromMatrix", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionCreateSVGTransformFromMatrix, (intptr_t)1 },
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGSVGElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "SVG_ZOOMANDPAN_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWN), (intptr_t)0 },
+    { "SVG_ZOOMANDPAN_DISABLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementSVG_ZOOMANDPAN_DISABLE), (intptr_t)0 },
+    { "SVG_ZOOMANDPAN_MAGNIFY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFY), (intptr_t)0 },
+    { "suspendRedraw", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionSuspendRedraw), (intptr_t)1 },
+    { "unsuspendRedraw", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionUnsuspendRedraw), (intptr_t)1 },
+    { "unsuspendRedrawAll", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionUnsuspendRedrawAll), (intptr_t)0 },
+    { "forceRedraw", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionForceRedraw), (intptr_t)0 },
+    { "pauseAnimations", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionPauseAnimations), (intptr_t)0 },
+    { "unpauseAnimations", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionUnpauseAnimations), (intptr_t)0 },
+    { "animationsPaused", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionAnimationsPaused), (intptr_t)0 },
+    { "getCurrentTime", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionGetCurrentTime), (intptr_t)0 },
+    { "setCurrentTime", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionSetCurrentTime), (intptr_t)1 },
+    { "getIntersectionList", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionGetIntersectionList), (intptr_t)2 },
+    { "getEnclosureList", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionGetEnclosureList), (intptr_t)2 },
+    { "checkIntersection", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionCheckIntersection), (intptr_t)2 },
+    { "checkEnclosure", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionCheckEnclosure), (intptr_t)2 },
+    { "deselectAll", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionDeselectAll), (intptr_t)0 },
+    { "createSVGNumber", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionCreateSVGNumber), (intptr_t)0 },
+    { "createSVGLength", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionCreateSVGLength), (intptr_t)0 },
+    { "createSVGAngle", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionCreateSVGAngle), (intptr_t)0 },
+    { "createSVGPoint", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionCreateSVGPoint), (intptr_t)0 },
+    { "createSVGMatrix", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionCreateSVGMatrix), (intptr_t)0 },
+    { "createSVGRect", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionCreateSVGRect), (intptr_t)0 },
+    { "createSVGTransform", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionCreateSVGTransform), (intptr_t)0 },
+    { "createSVGTransformFromMatrix", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionCreateSVGTransformFromMatrix), (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSVGElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -190,230 +241,262 @@ bool JSSVGSVGElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSSVGSVGElement, Base>(exec, &JSSVGSVGElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGSVGElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGSVGElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGSVGElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGSVGElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGSVGElementContentScriptType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementContentScriptType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return jsString(exec, imp->contentScriptType());
+    JSValue result = jsString(exec, imp->contentScriptType());
+    return result;
 }
 
-JSValue jsSVGSVGElementContentStyleType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementContentStyleType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return jsString(exec, imp->contentStyleType());
+    JSValue result = jsString(exec, imp->contentStyleType());
+    return result;
 }
 
-JSValue jsSVGSVGElementViewport(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementViewport(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->viewport()).get(), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->viewport()).get(), 0 /* no context on purpose */);
+    return result;
 }
 
-JSValue jsSVGSVGElementPixelUnitToMillimeterX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementPixelUnitToMillimeterX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return jsNumber(exec, imp->pixelUnitToMillimeterX());
+    JSValue result = jsNumber(exec, imp->pixelUnitToMillimeterX());
+    return result;
 }
 
-JSValue jsSVGSVGElementPixelUnitToMillimeterY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementPixelUnitToMillimeterY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return jsNumber(exec, imp->pixelUnitToMillimeterY());
+    JSValue result = jsNumber(exec, imp->pixelUnitToMillimeterY());
+    return result;
 }
 
-JSValue jsSVGSVGElementScreenPixelToMillimeterX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementScreenPixelToMillimeterX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return jsNumber(exec, imp->screenPixelToMillimeterX());
+    JSValue result = jsNumber(exec, imp->screenPixelToMillimeterX());
+    return result;
 }
 
-JSValue jsSVGSVGElementScreenPixelToMillimeterY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementScreenPixelToMillimeterY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return jsNumber(exec, imp->screenPixelToMillimeterY());
+    JSValue result = jsNumber(exec, imp->screenPixelToMillimeterY());
+    return result;
 }
 
-JSValue jsSVGSVGElementUseCurrentView(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementUseCurrentView(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return jsBoolean(imp->useCurrentView());
+    JSValue result = jsBoolean(imp->useCurrentView());
+    return result;
 }
 
-JSValue jsSVGSVGElementCurrentScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementCurrentScale(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return jsNumber(exec, imp->currentScale());
+    JSValue result = jsNumber(exec, imp->currentScale());
+    return result;
 }
 
-JSValue jsSVGSVGElementCurrentTranslate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementCurrentTranslate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), JSSVGStaticPODTypeWrapperWithParent<FloatPoint, SVGSVGElement>::create(imp, &SVGSVGElement::currentTranslate, &SVGSVGElement::setCurrentTranslate).get(), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), JSSVGStaticPODTypeWrapperWithParent<FloatPoint, SVGSVGElement>::create(imp, &SVGSVGElement::currentTranslate, &SVGSVGElement::setCurrentTranslate).get(), imp);
+    return result;
 }
 
-JSValue jsSVGSVGElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGSVGElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGSVGElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGSVGElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGSVGElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGSVGElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGSVGElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGSVGElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGSVGElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGSVGElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGSVGElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementViewBox(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
     RefPtr<SVGAnimatedRect> obj = imp->viewBoxAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGSVGElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementPreserveAspectRatio(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGSVGElementZoomAndPan(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementZoomAndPan(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
+    JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThis->impl());
-    return jsNumber(exec, imp->zoomAndPan());
+    JSValue result = jsNumber(exec, imp->zoomAndPan());
+    return result;
 }
 
+JSValue jsSVGSVGElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGSVGElement* domObject = static_cast<JSSVGSVGElement*>(asObject(slotBase));
+    return JSSVGSVGElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGSVGElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGSVGElement, Base>(exec, propertyName, value, &JSSVGSVGElementTable, this, slot);
@@ -421,46 +504,58 @@ void JSSVGSVGElement::put(ExecState* exec, const Identifier& propertyName, JSVal
 
 void setJSSVGSVGElementContentScriptType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
+    JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(thisObject);
+    SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
     imp->setContentScriptType(value.toString(exec));
 }
 
 void setJSSVGSVGElementContentStyleType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
+    JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(thisObject);
+    SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
     imp->setContentStyleType(value.toString(exec));
 }
 
 void setJSSVGSVGElementUseCurrentView(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
+    JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(thisObject);
+    SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
     imp->setUseCurrentView(value.toBoolean(exec));
 }
 
 void setJSSVGSVGElementCurrentScale(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
+    JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(thisObject);
+    SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
     imp->setCurrentScale(value.toFloat(exec));
 }
 
 void setJSSVGSVGElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
+    JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(thisObject);
+    SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGSVGElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
+    JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(thisObject);
+    SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
 void setJSSVGSVGElementZoomAndPan(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
+    JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(thisObject);
+    SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
     imp->setZoomAndPan(value.toInt32(exec));
 }
 
+JSValue JSSVGSVGElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGSVGElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionSuspendRedraw(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -656,7 +751,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGNumber(ExecState*
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<float>::create(imp->createSVGNumber()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<float>::create(imp->createSVGNumber()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -669,7 +764,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGLength(ExecState*
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->createSVGLength()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->createSVGLength()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -682,7 +777,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGAngle(ExecState*
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createSVGAngle()), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<SVGAngle>::create(imp->createSVGAngle()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -695,7 +790,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGPoint(ExecState*
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->createSVGPoint()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->createSVGPoint()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -708,7 +803,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGMatrix(ExecState*
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->createSVGMatrix()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->createSVGMatrix()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -721,7 +816,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGRect(ExecState* e
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->createSVGRect()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->createSVGRect()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -734,7 +829,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGTransform(ExecSta
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransform()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransform()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -745,10 +840,10 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGTransformFromMatr
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    TransformationMatrix matrix = toSVGMatrix(args.at(0));
+    AffineTransform matrix = toSVGMatrix(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransformFromMatrix(matrix)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransformFromMatrix(matrix)).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -789,7 +884,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetBBox(ExecState* exec, J
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -802,7 +897,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetCTM(ExecState* exec, JS
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -815,7 +910,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetScreenCTM(ExecState* ex
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -830,24 +925,24 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetTransformToElement(Exec
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
 
 // Constant getters
 
-JSValue jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGSVGElementSVG_ZOOMANDPAN_DISABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGSVGElementSVG_ZOOMANDPAN_DISABLE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFY(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
index 91ec122dc8..a92b385f73 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGSVGElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -100,45 +101,46 @@ JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetScreenCTM(JSC::Exe
 JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGSVGElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementContentScriptType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementContentScriptType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGSVGElementContentScriptType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGSVGElementContentStyleType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementContentStyleType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGSVGElementContentStyleType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGSVGElementViewport(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementPixelUnitToMillimeterX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementPixelUnitToMillimeterY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementScreenPixelToMillimeterX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementScreenPixelToMillimeterY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementUseCurrentView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementViewport(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementPixelUnitToMillimeterX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementPixelUnitToMillimeterY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementScreenPixelToMillimeterX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementScreenPixelToMillimeterY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementUseCurrentView(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGSVGElementUseCurrentView(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGSVGElementCurrentScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementCurrentScale(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGSVGElementCurrentScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGSVGElementCurrentTranslate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementCurrentTranslate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGSVGElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGSVGElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGSVGElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGSVGElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementZoomAndPan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementViewBox(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementPreserveAspectRatio(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementZoomAndPan(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGSVGElementZoomAndPan(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSVGElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementSVG_ZOOMANDPAN_DISABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementSVG_ZOOMANDPAN_DISABLE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp
index a83f58c7c5..69d1d15aee 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp
@@ -39,21 +39,69 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGScriptElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGScriptElementTableValues[4] =
+static const HashTableValue JSSVGScriptElementTableValues[5] =
 {
-    { "type", DontDelete, (intptr_t)jsSVGScriptElementType, (intptr_t)setJSSVGScriptElementType },
-    { "href", DontDelete|ReadOnly, (intptr_t)jsSVGScriptElementHref, (intptr_t)0 },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGScriptElementExternalResourcesRequired, (intptr_t)0 },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGScriptElementType), (intptr_t)setJSSVGScriptElementType },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGScriptElementHref), (intptr_t)0 },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGScriptElementExternalResourcesRequired), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGScriptElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGScriptElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 3, JSSVGScriptElementTableValues, 0 };
+    { 15, JSSVGScriptElementTableValues, 0 };
 #else
-    { 8, 7, JSSVGScriptElementTableValues, 0 };
+    { 9, 7, JSSVGScriptElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGScriptElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGScriptElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGScriptElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGScriptElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGScriptElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGScriptElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGScriptElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGScriptElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGScriptElementConstructor::s_info = { "SVGScriptElementConstructor", 0, &JSSVGScriptElementConstructorTable, 0 };
+
+bool JSSVGScriptElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGScriptElementConstructor, DOMObject>(exec, &JSSVGScriptElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGScriptElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGScriptElementConstructor, DOMObject>(exec, &JSSVGScriptElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGScriptElementPrototypeTableValues[1] =
@@ -97,32 +145,40 @@ bool JSSVGScriptElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSSVGScriptElement, Base>(exec, &JSSVGScriptElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGScriptElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGScriptElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGScriptElement* castedThis = static_cast<JSSVGScriptElement*>(asObject(slot.slotBase()));
+    JSSVGScriptElement* castedThis = static_cast<JSSVGScriptElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGScriptElement* imp = static_cast<SVGScriptElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsSVGScriptElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGScriptElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGScriptElement* castedThis = static_cast<JSSVGScriptElement*>(asObject(slot.slotBase()));
+    JSSVGScriptElement* castedThis = static_cast<JSSVGScriptElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGScriptElement* imp = static_cast<SVGScriptElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGScriptElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGScriptElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGScriptElement* castedThis = static_cast<JSSVGScriptElement*>(asObject(slot.slotBase()));
+    JSSVGScriptElement* castedThis = static_cast<JSSVGScriptElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGScriptElement* imp = static_cast<SVGScriptElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
+JSValue jsSVGScriptElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGScriptElement* domObject = static_cast<JSSVGScriptElement*>(asObject(slotBase));
+    return JSSVGScriptElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGScriptElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGScriptElement, Base>(exec, propertyName, value, &JSSVGScriptElementTable, this, slot);
@@ -130,10 +186,16 @@ void JSSVGScriptElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSSVGScriptElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGScriptElement* imp = static_cast<SVGScriptElement*>(static_cast<JSSVGScriptElement*>(thisObject)->impl());
+    JSSVGScriptElement* castedThisObj = static_cast<JSSVGScriptElement*>(thisObject);
+    SVGScriptElement* imp = static_cast<SVGScriptElement*>(castedThisObj->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
+JSValue JSSVGScriptElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGScriptElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
index bc4a7eb4ef..c9012e7d9f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGScriptElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,10 +69,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGScriptElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGScriptElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGScriptElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGScriptElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGScriptElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGScriptElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGScriptElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGScriptElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.cpp
index 1ff4cee6dd..674d2697f6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGSetElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGSetElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSetElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGSetElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGSetElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGSetElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGSetElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGSetElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGSetElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGSetElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGSetElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGSetElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGSetElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGSetElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGSetElementConstructor::s_info = { "SVGSetElementConstructor", 0, &JSSVGSetElementConstructorTable, 0 };
+
+bool JSSVGSetElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGSetElementConstructor, DOMObject>(exec, &JSSVGSetElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGSetElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGSetElementConstructor, DOMObject>(exec, &JSSVGSetElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGSetElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGSetElementPrototype::self(ExecState* exec, JSGlobalObject* global
     return getDOMPrototype<JSSVGSetElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGSetElement::s_info = { "SVGSetElement", &JSSVGAnimationElement::s_info, 0, 0 };
+const ClassInfo JSSVGSetElement::s_info = { "SVGSetElement", &JSSVGAnimationElement::s_info, &JSSVGSetElementTable, 0 };
 
 JSSVGSetElement::JSSVGSetElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGSetElement> impl)
     : JSSVGAnimationElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGSetElement::createPrototype(ExecState* exec, JSGlobalObject* glob
     return new (exec) JSSVGSetElementPrototype(JSSVGSetElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGSetElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGSetElement, Base>(exec, &JSSVGSetElementTable, this, propertyName, slot);
+}
+
+bool JSSVGSetElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGSetElement, Base>(exec, &JSSVGSetElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGSetElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGSetElement* domObject = static_cast<JSSVGSetElement*>(asObject(slotBase));
+    return JSSVGSetElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGSetElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGSetElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h
index 1dee3f083c..e6b34d80dc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h
@@ -35,16 +35,19 @@ class JSSVGSetElement : public JSSVGAnimationElement {
 public:
     JSSVGSetElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGSetElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGSetElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGSetElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp
index 86d6d30410..d5a93b257e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp
@@ -43,11 +43,12 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGStopElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGStopElementTableValues[4] =
+static const HashTableValue JSSVGStopElementTableValues[5] =
 {
-    { "offset", DontDelete|ReadOnly, (intptr_t)jsSVGStopElementOffset, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGStopElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGStopElementStyle, (intptr_t)0 },
+    { "offset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGStopElementOffset), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGStopElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGStopElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGStopElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -58,11 +59,58 @@ static JSC_CONST_HASHTABLE HashTable JSSVGStopElementTable =
     { 8, 7, JSSVGStopElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGStopElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGStopElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGStopElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGStopElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGStopElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGStopElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGStopElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGStopElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGStopElementConstructor::s_info = { "SVGStopElementConstructor", 0, &JSSVGStopElementConstructorTable, 0 };
+
+bool JSSVGStopElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGStopElementConstructor, DOMObject>(exec, &JSSVGStopElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGStopElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGStopElementConstructor, DOMObject>(exec, &JSSVGStopElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGStopElementPrototypeTableValues[2] =
 {
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGStopElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGStopElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -112,30 +160,43 @@ bool JSSVGStopElement::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSSVGStopElement, Base>(exec, &JSSVGStopElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGStopElementOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStopElementOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGStopElement* castedThis = static_cast<JSSVGStopElement*>(asObject(slot.slotBase()));
+    JSSVGStopElement* castedThis = static_cast<JSSVGStopElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGStopElement* imp = static_cast<SVGStopElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->offsetAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGStopElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStopElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGStopElement* castedThis = static_cast<JSSVGStopElement*>(asObject(slot.slotBase()));
+    JSSVGStopElement* castedThis = static_cast<JSSVGStopElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGStopElement* imp = static_cast<SVGStopElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGStopElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStopElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGStopElement* castedThis = static_cast<JSSVGStopElement*>(asObject(slot.slotBase()));
+    JSSVGStopElement* castedThis = static_cast<JSSVGStopElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGStopElement* imp = static_cast<SVGStopElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
+}
+
+JSValue jsSVGStopElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGStopElement* domObject = static_cast<JSSVGStopElement*>(asObject(slotBase));
+    return JSSVGStopElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGStopElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGStopElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGStopElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
index 9dc52b24e4..005fc11b80 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -60,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGStopElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,9 +73,10 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGStopElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGStopElementOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGStopElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGStopElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGStopElementOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGStopElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGStopElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGStopElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp
index 591ca64c33..e0e7ccb816 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp
@@ -39,30 +39,78 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGStringList);
 
 /* Hash table */
 
-static const HashTableValue JSSVGStringListTableValues[2] =
+static const HashTableValue JSSVGStringListTableValues[3] =
 {
-    { "numberOfItems", DontDelete|ReadOnly, (intptr_t)jsSVGStringListNumberOfItems, (intptr_t)0 },
+    { "numberOfItems", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGStringListNumberOfItems), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGStringListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGStringListTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGStringListTableValues, 0 };
+    { 3, JSSVGStringListTableValues, 0 };
 #else
-    { 2, 1, JSSVGStringListTableValues, 0 };
+    { 4, 3, JSSVGStringListTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGStringListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGStringListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGStringListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGStringListConstructorTableValues, 0 };
+#endif
+
+class JSSVGStringListConstructor : public DOMConstructorObject {
+public:
+    JSSVGStringListConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGStringListConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGStringListPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGStringListConstructor::s_info = { "SVGStringListConstructor", 0, &JSSVGStringListConstructorTable, 0 };
+
+bool JSSVGStringListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGStringListConstructor, DOMObject>(exec, &JSSVGStringListConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGStringListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGStringListConstructor, DOMObject>(exec, &JSSVGStringListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGStringListPrototypeTableValues[8] =
 {
-    { "clear", DontDelete|Function, (intptr_t)jsSVGStringListPrototypeFunctionClear, (intptr_t)0 },
-    { "initialize", DontDelete|Function, (intptr_t)jsSVGStringListPrototypeFunctionInitialize, (intptr_t)1 },
-    { "getItem", DontDelete|Function, (intptr_t)jsSVGStringListPrototypeFunctionGetItem, (intptr_t)1 },
-    { "insertItemBefore", DontDelete|Function, (intptr_t)jsSVGStringListPrototypeFunctionInsertItemBefore, (intptr_t)2 },
-    { "replaceItem", DontDelete|Function, (intptr_t)jsSVGStringListPrototypeFunctionReplaceItem, (intptr_t)2 },
-    { "removeItem", DontDelete|Function, (intptr_t)jsSVGStringListPrototypeFunctionRemoveItem, (intptr_t)1 },
-    { "appendItem", DontDelete|Function, (intptr_t)jsSVGStringListPrototypeFunctionAppendItem, (intptr_t)1 },
+    { "clear", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGStringListPrototypeFunctionClear), (intptr_t)0 },
+    { "initialize", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGStringListPrototypeFunctionInitialize), (intptr_t)1 },
+    { "getItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGStringListPrototypeFunctionGetItem), (intptr_t)1 },
+    { "insertItemBefore", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGStringListPrototypeFunctionInsertItemBefore), (intptr_t)2 },
+    { "replaceItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGStringListPrototypeFunctionReplaceItem), (intptr_t)2 },
+    { "removeItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGStringListPrototypeFunctionRemoveItem), (intptr_t)1 },
+    { "appendItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGStringListPrototypeFunctionAppendItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -92,8 +140,8 @@ bool JSSVGStringListPrototype::getOwnPropertyDescriptor(ExecState* exec, const I
 
 const ClassInfo JSSVGStringList::s_info = { "SVGStringList", 0, &JSSVGStringListTable, 0 };
 
-JSSVGStringList::JSSVGStringList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGStringList> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGStringList::JSSVGStringList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGStringList> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -101,6 +149,7 @@ JSSVGStringList::JSSVGStringList(NonNullPassRefPtr<Structure> structure, JSDOMGl
 JSSVGStringList::~JSSVGStringList()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGStringList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -118,12 +167,23 @@ bool JSSVGStringList::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSSVGStringList, Base>(exec, &JSSVGStringListTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGStringListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStringListNumberOfItems(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGStringList* castedThis = static_cast<JSSVGStringList*>(asObject(slot.slotBase()));
+    JSSVGStringList* castedThis = static_cast<JSSVGStringList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGStringList* imp = static_cast<SVGStringList*>(castedThis->impl());
-    return jsNumber(exec, imp->numberOfItems());
+    JSValue result = jsNumber(exec, imp->numberOfItems());
+    return result;
+}
+
+JSValue jsSVGStringListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGStringList* domObject = static_cast<JSSVGStringList*>(asObject(slotBase));
+    return JSSVGStringList::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGStringList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGStringListConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
index b328bac095..6ccb9940d7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -33,10 +32,10 @@ namespace WebCore {
 
 class SVGStringList;
 
-class JSSVGStringList : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGStringList : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGStringList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGStringList>, SVGElement* context);
+    JSSVGStringList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGStringList>);
     virtual ~JSSVGStringList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -46,9 +45,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGStringList* impl() const { return m_impl.get(); }
 
 private:
@@ -70,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGStringListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -88,7 +88,8 @@ JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionRemoveItem(JSC::ExecS
 JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGStringListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGStringListNumberOfItems(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGStringListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp
index 29dea935c3..19a7d2445c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp
@@ -37,13 +37,14 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGStyleElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGStyleElementTableValues[6] =
-{
-    { "type", DontDelete, (intptr_t)jsSVGStyleElementType, (intptr_t)setJSSVGStyleElementType },
-    { "media", DontDelete, (intptr_t)jsSVGStyleElementMedia, (intptr_t)setJSSVGStyleElementMedia },
-    { "title", DontDelete, (intptr_t)jsSVGStyleElementTitle, (intptr_t)setJSSVGStyleElementTitle },
-    { "xmllang", DontDelete, (intptr_t)jsSVGStyleElementXmllang, (intptr_t)setJSSVGStyleElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGStyleElementXmlspace, (intptr_t)setJSSVGStyleElementXmlspace },
+static const HashTableValue JSSVGStyleElementTableValues[7] =
+{
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGStyleElementType), (intptr_t)setJSSVGStyleElementType },
+    { "media", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGStyleElementMedia), (intptr_t)setJSSVGStyleElementMedia },
+    { "title", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGStyleElementTitle), (intptr_t)setJSSVGStyleElementTitle },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGStyleElementXmllang), (intptr_t)setJSSVGStyleElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGStyleElementXmlspace), (intptr_t)setJSSVGStyleElementXmlspace },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGStyleElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -54,6 +55,53 @@ static JSC_CONST_HASHTABLE HashTable JSSVGStyleElementTable =
     { 17, 15, JSSVGStyleElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGStyleElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGStyleElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGStyleElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGStyleElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGStyleElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGStyleElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGStyleElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGStyleElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGStyleElementConstructor::s_info = { "SVGStyleElementConstructor", 0, &JSSVGStyleElementConstructorTable, 0 };
+
+bool JSSVGStyleElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGStyleElementConstructor, DOMObject>(exec, &JSSVGStyleElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGStyleElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGStyleElementConstructor, DOMObject>(exec, &JSSVGStyleElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGStyleElementPrototypeTableValues[1] =
@@ -97,46 +145,56 @@ bool JSSVGStyleElement::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSSVGStyleElement, Base>(exec, &JSSVGStyleElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGStyleElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStyleElementType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGStyleElement* castedThis = static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()));
+    JSSVGStyleElement* castedThis = static_cast<JSSVGStyleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsSVGStyleElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStyleElementMedia(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGStyleElement* castedThis = static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()));
+    JSSVGStyleElement* castedThis = static_cast<JSSVGStyleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(castedThis->impl());
-    return jsString(exec, imp->media());
+    JSValue result = jsString(exec, imp->media());
+    return result;
 }
 
-JSValue jsSVGStyleElementTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStyleElementTitle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGStyleElement* castedThis = static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()));
+    JSSVGStyleElement* castedThis = static_cast<JSSVGStyleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(castedThis->impl());
-    return jsString(exec, imp->title());
+    JSValue result = jsString(exec, imp->title());
+    return result;
 }
 
-JSValue jsSVGStyleElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStyleElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGStyleElement* castedThis = static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()));
+    JSSVGStyleElement* castedThis = static_cast<JSSVGStyleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGStyleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStyleElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGStyleElement* castedThis = static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()));
+    JSSVGStyleElement* castedThis = static_cast<JSSVGStyleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
+JSValue jsSVGStyleElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGStyleElement* domObject = static_cast<JSSVGStyleElement*>(asObject(slotBase));
+    return JSSVGStyleElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGStyleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGStyleElement, Base>(exec, propertyName, value, &JSSVGStyleElementTable, this, slot);
@@ -144,7 +202,8 @@ void JSSVGStyleElement::put(ExecState* exec, const Identifier& propertyName, JSV
 
 void setJSSVGStyleElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
+    JSSVGStyleElement* castedThisObj = static_cast<JSSVGStyleElement*>(thisObject);
+    SVGStyleElement* imp = static_cast<SVGStyleElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setType(value.toString(exec), ec);
     setDOMException(exec, ec);
@@ -152,7 +211,8 @@ void setJSSVGStyleElementType(ExecState* exec, JSObject* thisObject, JSValue val
 
 void setJSSVGStyleElementMedia(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
+    JSSVGStyleElement* castedThisObj = static_cast<JSSVGStyleElement*>(thisObject);
+    SVGStyleElement* imp = static_cast<SVGStyleElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setMedia(value.toString(exec), ec);
     setDOMException(exec, ec);
@@ -160,7 +220,8 @@ void setJSSVGStyleElementMedia(ExecState* exec, JSObject* thisObject, JSValue va
 
 void setJSSVGStyleElementTitle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
+    JSSVGStyleElement* castedThisObj = static_cast<JSSVGStyleElement*>(thisObject);
+    SVGStyleElement* imp = static_cast<SVGStyleElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setTitle(value.toString(exec), ec);
     setDOMException(exec, ec);
@@ -168,16 +229,23 @@ void setJSSVGStyleElementTitle(ExecState* exec, JSObject* thisObject, JSValue va
 
 void setJSSVGStyleElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
+    JSSVGStyleElement* castedThisObj = static_cast<JSSVGStyleElement*>(thisObject);
+    SVGStyleElement* imp = static_cast<SVGStyleElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGStyleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
+    JSSVGStyleElement* castedThisObj = static_cast<JSSVGStyleElement*>(thisObject);
+    SVGStyleElement* imp = static_cast<SVGStyleElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGStyleElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGStyleElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
index 608c27831e..74716136e2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -59,7 +60,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGStyleElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -68,16 +69,17 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGStyleElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGStyleElementType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGStyleElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGStyleElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGStyleElementMedia(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGStyleElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGStyleElementTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGStyleElementTitle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGStyleElementTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGStyleElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGStyleElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGStyleElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGStyleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGStyleElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGStyleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGStyleElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp
index 887216fd1b..132121cae7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp
@@ -52,19 +52,20 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGSwitchElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGSwitchElementTableValues[12] =
-{
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGSwitchElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGSwitchElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGSwitchElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGSwitchElementXmllang, (intptr_t)setJSSVGSwitchElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGSwitchElementXmlspace, (intptr_t)setJSSVGSwitchElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGSwitchElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGSwitchElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGSwitchElementStyle, (intptr_t)0 },
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGSwitchElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGSwitchElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGSwitchElementFarthestViewportElement, (intptr_t)0 },
+static const HashTableValue JSSVGSwitchElementTableValues[13] =
+{
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSwitchElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSwitchElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSwitchElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSwitchElementXmllang), (intptr_t)setJSSVGSwitchElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSwitchElementXmlspace), (intptr_t)setJSSVGSwitchElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSwitchElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSwitchElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSwitchElementStyle), (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSwitchElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSwitchElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSwitchElementFarthestViewportElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSwitchElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -72,19 +73,66 @@ static JSC_CONST_HASHTABLE HashTable JSSVGSwitchElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 127, JSSVGSwitchElementTableValues, 0 };
 #else
-    { 33, 31, JSSVGSwitchElementTableValues, 0 };
+    { 34, 31, JSSVGSwitchElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGSwitchElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGSwitchElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGSwitchElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGSwitchElementConstructorTableValues, 0 };
 #endif
 
+class JSSVGSwitchElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGSwitchElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGSwitchElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGSwitchElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGSwitchElementConstructor::s_info = { "SVGSwitchElementConstructor", 0, &JSSVGSwitchElementConstructorTable, 0 };
+
+bool JSSVGSwitchElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGSwitchElementConstructor, DOMObject>(exec, &JSSVGSwitchElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGSwitchElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGSwitchElementConstructor, DOMObject>(exec, &JSSVGSwitchElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGSwitchElementPrototypeTableValues[7] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGSwitchElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGSwitchElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGSwitchElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGSwitchElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGSwitchElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGSwitchElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSwitchElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSwitchElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSwitchElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSwitchElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSwitchElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSwitchElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -134,97 +182,113 @@ bool JSSVGSwitchElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSSVGSwitchElement, Base>(exec, &JSSVGSwitchElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGSwitchElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()));
+    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGSwitchElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()));
+    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGSwitchElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()));
+    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGSwitchElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()));
+    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGSwitchElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()));
+    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGSwitchElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()));
+    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGSwitchElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()));
+    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGSwitchElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()));
+    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGSwitchElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()));
+    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGSwitchElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()));
+    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGSwitchElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()));
+    JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
+JSValue jsSVGSwitchElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGSwitchElement* domObject = static_cast<JSSVGSwitchElement*>(asObject(slotBase));
+    return JSSVGSwitchElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGSwitchElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGSwitchElement, Base>(exec, propertyName, value, &JSSVGSwitchElementTable, this, slot);
@@ -232,16 +296,23 @@ void JSSVGSwitchElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSSVGSwitchElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(thisObject)->impl());
+    JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(thisObject);
+    SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGSwitchElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(thisObject)->impl());
+    JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(thisObject);
+    SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGSwitchElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGSwitchElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -279,7 +350,7 @@ JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetBBox(ExecState* exec
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -292,7 +363,7 @@ JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetCTM(ExecState* exec,
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -305,7 +376,7 @@ JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetScreenCTM(ExecState*
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -320,7 +391,7 @@ JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetTransformToElement(E
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
index a91244f2ed..6f462f5400 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGSwitchElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,19 +79,20 @@ JSC::JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetScreenCTM(JSC::
 JSC::JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGSwitchElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSwitchElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSwitchElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSwitchElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSwitchElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSwitchElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSwitchElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGSwitchElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGSwitchElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGSwitchElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGSwitchElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSwitchElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSwitchElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSwitchElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSwitchElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSwitchElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSwitchElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSwitchElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSwitchElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSwitchElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSwitchElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSwitchElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp
index 88de382593..9ec78a18cc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp
@@ -47,15 +47,16 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGSymbolElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGSymbolElementTableValues[8] =
-{
-    { "xmllang", DontDelete, (intptr_t)jsSVGSymbolElementXmllang, (intptr_t)setJSSVGSymbolElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGSymbolElementXmlspace, (intptr_t)setJSSVGSymbolElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGSymbolElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGSymbolElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGSymbolElementStyle, (intptr_t)0 },
-    { "viewBox", DontDelete|ReadOnly, (intptr_t)jsSVGSymbolElementViewBox, (intptr_t)0 },
-    { "preserveAspectRatio", DontDelete|ReadOnly, (intptr_t)jsSVGSymbolElementPreserveAspectRatio, (intptr_t)0 },
+static const HashTableValue JSSVGSymbolElementTableValues[9] =
+{
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSymbolElementXmllang), (intptr_t)setJSSVGSymbolElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSymbolElementXmlspace), (intptr_t)setJSSVGSymbolElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSymbolElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSymbolElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSymbolElementStyle), (intptr_t)0 },
+    { "viewBox", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSymbolElementViewBox), (intptr_t)0 },
+    { "preserveAspectRatio", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSymbolElementPreserveAspectRatio), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGSymbolElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -66,11 +67,58 @@ static JSC_CONST_HASHTABLE HashTable JSSVGSymbolElementTable =
     { 16, 15, JSSVGSymbolElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGSymbolElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGSymbolElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGSymbolElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGSymbolElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGSymbolElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGSymbolElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGSymbolElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGSymbolElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGSymbolElementConstructor::s_info = { "SVGSymbolElementConstructor", 0, &JSSVGSymbolElementConstructorTable, 0 };
+
+bool JSSVGSymbolElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGSymbolElementConstructor, DOMObject>(exec, &JSSVGSymbolElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGSymbolElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGSymbolElementConstructor, DOMObject>(exec, &JSSVGSymbolElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGSymbolElementPrototypeTableValues[2] =
 {
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGSymbolElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGSymbolElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -120,66 +168,78 @@ bool JSSVGSymbolElement::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSSVGSymbolElement, Base>(exec, &JSSVGSymbolElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGSymbolElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSymbolElement* castedThis = static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()));
+    JSSVGSymbolElement* castedThis = static_cast<JSSVGSymbolElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGSymbolElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSymbolElement* castedThis = static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()));
+    JSSVGSymbolElement* castedThis = static_cast<JSSVGSymbolElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGSymbolElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSymbolElement* castedThis = static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()));
+    JSSVGSymbolElement* castedThis = static_cast<JSSVGSymbolElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGSymbolElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSymbolElement* castedThis = static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()));
+    JSSVGSymbolElement* castedThis = static_cast<JSSVGSymbolElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGSymbolElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSymbolElement* castedThis = static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()));
+    JSSVGSymbolElement* castedThis = static_cast<JSSVGSymbolElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGSymbolElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementViewBox(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSymbolElement* castedThis = static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()));
+    JSSVGSymbolElement* castedThis = static_cast<JSSVGSymbolElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(castedThis->impl());
     RefPtr<SVGAnimatedRect> obj = imp->viewBoxAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGSymbolElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementPreserveAspectRatio(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGSymbolElement* castedThis = static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()));
+    JSSVGSymbolElement* castedThis = static_cast<JSSVGSymbolElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(castedThis->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
+JSValue jsSVGSymbolElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGSymbolElement* domObject = static_cast<JSSVGSymbolElement*>(asObject(slotBase));
+    return JSSVGSymbolElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGSymbolElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGSymbolElement, Base>(exec, propertyName, value, &JSSVGSymbolElementTable, this, slot);
@@ -187,16 +247,23 @@ void JSSVGSymbolElement::put(ExecState* exec, const Identifier& propertyName, JS
 
 void setJSSVGSymbolElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(thisObject)->impl());
+    JSSVGSymbolElement* castedThisObj = static_cast<JSSVGSymbolElement*>(thisObject);
+    SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGSymbolElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(thisObject)->impl());
+    JSSVGSymbolElement* castedThisObj = static_cast<JSSVGSymbolElement*>(thisObject);
+    SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGSymbolElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGSymbolElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGSymbolElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
index c430257431..3decf73869 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGSymbolElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,15 +74,16 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGSymbolElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGSymbolElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSymbolElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGSymbolElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGSymbolElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSymbolElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGSymbolElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGSymbolElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSymbolElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSymbolElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSymbolElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGSymbolElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSymbolElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSymbolElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSymbolElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSymbolElementViewBox(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSymbolElementPreserveAspectRatio(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGSymbolElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp
index f23ea2c54f..296f09961f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp
@@ -36,19 +36,67 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGTRefElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGTRefElementTableValues[2] =
+static const HashTableValue JSSVGTRefElementTableValues[3] =
 {
-    { "href", DontDelete|ReadOnly, (intptr_t)jsSVGTRefElementHref, (intptr_t)0 },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTRefElementHref), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTRefElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGTRefElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGTRefElementTableValues, 0 };
+    { 1, JSSVGTRefElementTableValues, 0 };
 #else
-    { 2, 1, JSSVGTRefElementTableValues, 0 };
+    { 4, 3, JSSVGTRefElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGTRefElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGTRefElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGTRefElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGTRefElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGTRefElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGTRefElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGTRefElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGTRefElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGTRefElementConstructor::s_info = { "SVGTRefElementConstructor", 0, &JSSVGTRefElementConstructorTable, 0 };
+
+bool JSSVGTRefElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGTRefElementConstructor, DOMObject>(exec, &JSSVGTRefElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGTRefElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTRefElementConstructor, DOMObject>(exec, &JSSVGTRefElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGTRefElementPrototypeTableValues[1] =
@@ -92,13 +140,24 @@ bool JSSVGTRefElement::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSSVGTRefElement, Base>(exec, &JSSVGTRefElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGTRefElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTRefElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTRefElement* castedThis = static_cast<JSSVGTRefElement*>(asObject(slot.slotBase()));
+    JSSVGTRefElement* castedThis = static_cast<JSSVGTRefElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTRefElement* imp = static_cast<SVGTRefElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
+}
+
+JSValue jsSVGTRefElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGTRefElement* domObject = static_cast<JSSVGTRefElement*>(asObject(slotBase));
+    return JSSVGTRefElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGTRefElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGTRefElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
index 74ab8c40f1..2ccda36770 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -58,7 +59,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGTRefElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -67,7 +68,8 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGTRefElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTRefElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTRefElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.cpp
index 74477df58d..ce6431b16d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.cpp
@@ -33,6 +33,68 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSSVGTSpanElement);
 
+/* Hash table */
+
+static const HashTableValue JSSVGTSpanElementTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTSpanElementConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGTSpanElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGTSpanElementTableValues, 0 };
+#else
+    { 2, 1, JSSVGTSpanElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGTSpanElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGTSpanElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGTSpanElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGTSpanElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGTSpanElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGTSpanElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGTSpanElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGTSpanElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGTSpanElementConstructor::s_info = { "SVGTSpanElementConstructor", 0, &JSSVGTSpanElementConstructorTable, 0 };
+
+bool JSSVGTSpanElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGTSpanElementConstructor, DOMObject>(exec, &JSSVGTSpanElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGTSpanElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTSpanElementConstructor, DOMObject>(exec, &JSSVGTSpanElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGTSpanElementPrototypeTableValues[1] =
@@ -54,7 +116,7 @@ JSObject* JSSVGTSpanElementPrototype::self(ExecState* exec, JSGlobalObject* glob
     return getDOMPrototype<JSSVGTSpanElement>(exec, globalObject);
 }
 
-const ClassInfo JSSVGTSpanElement::s_info = { "SVGTSpanElement", &JSSVGTextPositioningElement::s_info, 0, 0 };
+const ClassInfo JSSVGTSpanElement::s_info = { "SVGTSpanElement", &JSSVGTextPositioningElement::s_info, &JSSVGTSpanElementTable, 0 };
 
 JSSVGTSpanElement::JSSVGTSpanElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGTSpanElement> impl)
     : JSSVGTextPositioningElement(structure, globalObject, impl)
@@ -66,6 +128,26 @@ JSObject* JSSVGTSpanElement::createPrototype(ExecState* exec, JSGlobalObject* gl
     return new (exec) JSSVGTSpanElementPrototype(JSSVGTSpanElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec, globalObject)));
 }
 
+bool JSSVGTSpanElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGTSpanElement, Base>(exec, &JSSVGTSpanElementTable, this, propertyName, slot);
+}
+
+bool JSSVGTSpanElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTSpanElement, Base>(exec, &JSSVGTSpanElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGTSpanElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGTSpanElement* domObject = static_cast<JSSVGTSpanElement*>(asObject(slotBase));
+    return JSSVGTSpanElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGTSpanElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGTSpanElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h
index cb9df9d8a2..5e03ccacc6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h
@@ -35,16 +35,19 @@ class JSSVGTSpanElement : public JSSVGTextPositioningElement {
 public:
     JSSVGTSpanElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGTSpanElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,13 +59,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGTSpanElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
+// Attributes
+
+JSC::JSValue jsSVGTSpanElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
index 31a570f792..92a5ff4a49 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
@@ -56,17 +56,17 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGTextContentElement);
 
 static const HashTableValue JSSVGTextContentElementTableValues[12] =
 {
-    { "textLength", DontDelete|ReadOnly, (intptr_t)jsSVGTextContentElementTextLength, (intptr_t)0 },
-    { "lengthAdjust", DontDelete|ReadOnly, (intptr_t)jsSVGTextContentElementLengthAdjust, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGTextContentElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGTextContentElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGTextContentElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGTextContentElementXmllang, (intptr_t)setJSSVGTextContentElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGTextContentElementXmlspace, (intptr_t)setJSSVGTextContentElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGTextContentElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGTextContentElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGTextContentElementStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGTextContentElementConstructor, (intptr_t)0 },
+    { "textLength", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementTextLength), (intptr_t)0 },
+    { "lengthAdjust", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementLengthAdjust), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementXmllang), (intptr_t)setJSSVGTextContentElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementXmlspace), (intptr_t)setJSSVGTextContentElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,9 +81,9 @@ static JSC_CONST_HASHTABLE HashTable JSSVGTextContentElementTable =
 
 static const HashTableValue JSSVGTextContentElementConstructorTableValues[4] =
 {
-    { "LENGTHADJUST_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGTextContentElementLENGTHADJUST_UNKNOWN, (intptr_t)0 },
-    { "LENGTHADJUST_SPACING", DontDelete|ReadOnly, (intptr_t)jsSVGTextContentElementLENGTHADJUST_SPACING, (intptr_t)0 },
-    { "LENGTHADJUST_SPACINGANDGLYPHS", DontDelete|ReadOnly, (intptr_t)jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS, (intptr_t)0 },
+    { "LENGTHADJUST_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementLENGTHADJUST_UNKNOWN), (intptr_t)0 },
+    { "LENGTHADJUST_SPACING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementLENGTHADJUST_SPACING), (intptr_t)0 },
+    { "LENGTHADJUST_SPACINGANDGLYPHS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -108,7 +108,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -131,20 +131,20 @@ bool JSSVGTextContentElementConstructor::getOwnPropertyDescriptor(ExecState* exe
 
 static const HashTableValue JSSVGTextContentElementPrototypeTableValues[15] =
 {
-    { "LENGTHADJUST_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGTextContentElementLENGTHADJUST_UNKNOWN, (intptr_t)0 },
-    { "LENGTHADJUST_SPACING", DontDelete|ReadOnly, (intptr_t)jsSVGTextContentElementLENGTHADJUST_SPACING, (intptr_t)0 },
-    { "LENGTHADJUST_SPACINGANDGLYPHS", DontDelete|ReadOnly, (intptr_t)jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS, (intptr_t)0 },
-    { "getNumberOfChars", DontDelete|Function, (intptr_t)jsSVGTextContentElementPrototypeFunctionGetNumberOfChars, (intptr_t)0 },
-    { "getComputedTextLength", DontDelete|Function, (intptr_t)jsSVGTextContentElementPrototypeFunctionGetComputedTextLength, (intptr_t)0 },
-    { "getSubStringLength", DontDelete|Function, (intptr_t)jsSVGTextContentElementPrototypeFunctionGetSubStringLength, (intptr_t)2 },
-    { "getStartPositionOfChar", DontDelete|Function, (intptr_t)jsSVGTextContentElementPrototypeFunctionGetStartPositionOfChar, (intptr_t)1 },
-    { "getEndPositionOfChar", DontDelete|Function, (intptr_t)jsSVGTextContentElementPrototypeFunctionGetEndPositionOfChar, (intptr_t)1 },
-    { "getExtentOfChar", DontDelete|Function, (intptr_t)jsSVGTextContentElementPrototypeFunctionGetExtentOfChar, (intptr_t)1 },
-    { "getRotationOfChar", DontDelete|Function, (intptr_t)jsSVGTextContentElementPrototypeFunctionGetRotationOfChar, (intptr_t)1 },
-    { "getCharNumAtPosition", DontDelete|Function, (intptr_t)jsSVGTextContentElementPrototypeFunctionGetCharNumAtPosition, (intptr_t)1 },
-    { "selectSubString", DontDelete|Function, (intptr_t)jsSVGTextContentElementPrototypeFunctionSelectSubString, (intptr_t)2 },
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGTextContentElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGTextContentElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "LENGTHADJUST_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementLENGTHADJUST_UNKNOWN), (intptr_t)0 },
+    { "LENGTHADJUST_SPACING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementLENGTHADJUST_SPACING), (intptr_t)0 },
+    { "LENGTHADJUST_SPACINGANDGLYPHS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS), (intptr_t)0 },
+    { "getNumberOfChars", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTextContentElementPrototypeFunctionGetNumberOfChars), (intptr_t)0 },
+    { "getComputedTextLength", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTextContentElementPrototypeFunctionGetComputedTextLength), (intptr_t)0 },
+    { "getSubStringLength", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTextContentElementPrototypeFunctionGetSubStringLength), (intptr_t)2 },
+    { "getStartPositionOfChar", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTextContentElementPrototypeFunctionGetStartPositionOfChar), (intptr_t)1 },
+    { "getEndPositionOfChar", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTextContentElementPrototypeFunctionGetEndPositionOfChar), (intptr_t)1 },
+    { "getExtentOfChar", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTextContentElementPrototypeFunctionGetExtentOfChar), (intptr_t)1 },
+    { "getRotationOfChar", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTextContentElementPrototypeFunctionGetRotationOfChar), (intptr_t)1 },
+    { "getCharNumAtPosition", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTextContentElementPrototypeFunctionGetCharNumAtPosition), (intptr_t)1 },
+    { "selectSubString", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTextContentElementPrototypeFunctionSelectSubString), (intptr_t)2 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTextContentElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTextContentElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -194,93 +194,103 @@ bool JSSVGTextContentElement::getOwnPropertyDescriptor(ExecState* exec, const Id
     return getStaticValueDescriptor<JSSVGTextContentElement, Base>(exec, &JSSVGTextContentElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGTextContentElementTextLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementTextLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()));
+    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->textLengthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGTextContentElementLengthAdjust(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementLengthAdjust(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()));
+    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->lengthAdjustAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGTextContentElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()));
+    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGTextContentElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()));
+    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGTextContentElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()));
+    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGTextContentElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()));
+    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGTextContentElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()));
+    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGTextContentElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()));
+    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGTextContentElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()));
+    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGTextContentElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()));
+    JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGTextContentElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextContentElement* domObject = static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()));
+    JSSVGTextContentElement* domObject = static_cast<JSSVGTextContentElement*>(asObject(slotBase));
     return JSSVGTextContentElement::getConstructor(exec, domObject->globalObject());
 }
 void JSSVGTextContentElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -290,13 +300,15 @@ void JSSVGTextContentElement::put(ExecState* exec, const Identifier& propertyNam
 
 void setJSSVGTextContentElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(thisObject)->impl());
+    JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(thisObject);
+    SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGTextContentElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(thisObject)->impl());
+    JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(thisObject);
+    SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
@@ -371,7 +383,7 @@ JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetStartPositionOf
     }
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getStartPositionOfChar(offset, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getStartPositionOfChar(offset, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
@@ -391,7 +403,7 @@ JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetEndPositionOfCh
     }
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getEndPositionOfChar(offset, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getEndPositionOfChar(offset, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
@@ -411,7 +423,7 @@ JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetExtentOfChar(Ex
     }
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getExtentOfChar(offset, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getExtentOfChar(offset, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
@@ -504,17 +516,17 @@ JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetPresentationAtt
 
 // Constant getters
 
-JSValue jsSVGTextContentElementLENGTHADJUST_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextContentElementLENGTHADJUST_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGTextContentElementLENGTHADJUST_SPACING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextContentElementLENGTHADJUST_SPACING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
index 5bbe15f3e4..d762ab3ae7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -62,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGTextContentElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -84,24 +84,24 @@ JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionHasExtension(
 JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGTextContentElementTextLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextContentElementLengthAdjust(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextContentElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextContentElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextContentElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextContentElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementTextLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextContentElementLengthAdjust(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextContentElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextContentElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextContentElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextContentElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGTextContentElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGTextContentElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGTextContentElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGTextContentElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextContentElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextContentElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextContentElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextContentElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextContentElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextContentElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGTextContentElementLENGTHADJUST_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextContentElementLENGTHADJUST_SPACING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementLENGTHADJUST_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextContentElementLENGTHADJUST_SPACING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp
index b2be13427e..9934abc58d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp
@@ -41,29 +41,77 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGTextElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGTextElementTableValues[4] =
+static const HashTableValue JSSVGTextElementTableValues[5] =
 {
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGTextElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGTextElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGTextElementFarthestViewportElement, (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextElementFarthestViewportElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGTextElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 7, JSSVGTextElementTableValues, 0 };
+    { 31, JSSVGTextElementTableValues, 0 };
 #else
-    { 8, 7, JSSVGTextElementTableValues, 0 };
+    { 9, 7, JSSVGTextElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGTextElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGTextElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGTextElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGTextElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGTextElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGTextElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGTextElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGTextElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGTextElementConstructor::s_info = { "SVGTextElementConstructor", 0, &JSSVGTextElementConstructorTable, 0 };
+
+bool JSSVGTextElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGTextElementConstructor, DOMObject>(exec, &JSSVGTextElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGTextElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTextElementConstructor, DOMObject>(exec, &JSSVGTextElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGTextElementPrototypeTableValues[5] =
 {
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGTextElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGTextElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGTextElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGTextElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTextElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTextElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTextElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTextElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -113,29 +161,42 @@ bool JSSVGTextElement::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSSVGTextElement, Base>(exec, &JSSVGTextElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGTextElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextElement* castedThis = static_cast<JSSVGTextElement*>(asObject(slot.slotBase()));
+    JSSVGTextElement* castedThis = static_cast<JSSVGTextElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGTextElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextElement* castedThis = static_cast<JSSVGTextElement*>(asObject(slot.slotBase()));
+    JSSVGTextElement* castedThis = static_cast<JSSVGTextElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGTextElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextElement* castedThis = static_cast<JSSVGTextElement*>(asObject(slot.slotBase()));
+    JSSVGTextElement* castedThis = static_cast<JSSVGTextElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
+}
+
+JSValue jsSVGTextElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGTextElement* domObject = static_cast<JSSVGTextElement*>(asObject(slotBase));
+    return JSSVGTextElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGTextElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGTextElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -147,7 +208,7 @@ JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetBBox(ExecState* exec,
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -160,7 +221,7 @@ JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetCTM(ExecState* exec, J
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -173,7 +234,7 @@ JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetScreenCTM(ExecState* e
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -188,7 +249,7 @@ JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetTransformToElement(Exe
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
index d605de3e1f..2f2926653e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -60,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGTextElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,9 +76,10 @@ JSC::JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetScreenCTM(JSC::Ex
 JSC::JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGTextElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
index d9520729f9..f23e89c1ad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
@@ -40,11 +40,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGTextPathElement);
 
 static const HashTableValue JSSVGTextPathElementTableValues[6] =
 {
-    { "startOffset", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementStartOffset, (intptr_t)0 },
-    { "method", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementMethod, (intptr_t)0 },
-    { "spacing", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementSpacing, (intptr_t)0 },
-    { "href", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementHref, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGTextPathElementConstructor, (intptr_t)0 },
+    { "startOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementStartOffset), (intptr_t)0 },
+    { "method", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementMethod), (intptr_t)0 },
+    { "spacing", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementSpacing), (intptr_t)0 },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementHref), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -59,12 +59,12 @@ static JSC_CONST_HASHTABLE HashTable JSSVGTextPathElementTable =
 
 static const HashTableValue JSSVGTextPathElementConstructorTableValues[7] =
 {
-    { "TEXTPATH_METHODTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN, (intptr_t)0 },
-    { "TEXTPATH_METHODTYPE_ALIGN", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN, (intptr_t)0 },
-    { "TEXTPATH_METHODTYPE_STRETCH", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH, (intptr_t)0 },
-    { "TEXTPATH_SPACINGTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN, (intptr_t)0 },
-    { "TEXTPATH_SPACINGTYPE_AUTO", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO, (intptr_t)0 },
-    { "TEXTPATH_SPACINGTYPE_EXACT", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT, (intptr_t)0 },
+    { "TEXTPATH_METHODTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN), (intptr_t)0 },
+    { "TEXTPATH_METHODTYPE_ALIGN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN), (intptr_t)0 },
+    { "TEXTPATH_METHODTYPE_STRETCH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH), (intptr_t)0 },
+    { "TEXTPATH_SPACINGTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN), (intptr_t)0 },
+    { "TEXTPATH_SPACINGTYPE_AUTO", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO), (intptr_t)0 },
+    { "TEXTPATH_SPACINGTYPE_EXACT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -89,7 +89,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -112,12 +112,12 @@ bool JSSVGTextPathElementConstructor::getOwnPropertyDescriptor(ExecState* exec,
 
 static const HashTableValue JSSVGTextPathElementPrototypeTableValues[7] =
 {
-    { "TEXTPATH_METHODTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN, (intptr_t)0 },
-    { "TEXTPATH_METHODTYPE_ALIGN", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN, (intptr_t)0 },
-    { "TEXTPATH_METHODTYPE_STRETCH", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH, (intptr_t)0 },
-    { "TEXTPATH_SPACINGTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN, (intptr_t)0 },
-    { "TEXTPATH_SPACINGTYPE_AUTO", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO, (intptr_t)0 },
-    { "TEXTPATH_SPACINGTYPE_EXACT", DontDelete|ReadOnly, (intptr_t)jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT, (intptr_t)0 },
+    { "TEXTPATH_METHODTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN), (intptr_t)0 },
+    { "TEXTPATH_METHODTYPE_ALIGN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN), (intptr_t)0 },
+    { "TEXTPATH_METHODTYPE_STRETCH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH), (intptr_t)0 },
+    { "TEXTPATH_SPACINGTYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN), (intptr_t)0 },
+    { "TEXTPATH_SPACINGTYPE_AUTO", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO), (intptr_t)0 },
+    { "TEXTPATH_SPACINGTYPE_EXACT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -167,45 +167,49 @@ bool JSSVGTextPathElement::getOwnPropertyDescriptor(ExecState* exec, const Ident
     return getStaticValueDescriptor<JSSVGTextPathElement, Base>(exec, &JSSVGTextPathElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGTextPathElementStartOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPathElementStartOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextPathElement* castedThis = static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()));
+    JSSVGTextPathElement* castedThis = static_cast<JSSVGTextPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextPathElement* imp = static_cast<SVGTextPathElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->startOffsetAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGTextPathElementMethod(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPathElementMethod(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextPathElement* castedThis = static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()));
+    JSSVGTextPathElement* castedThis = static_cast<JSSVGTextPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextPathElement* imp = static_cast<SVGTextPathElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->methodAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGTextPathElementSpacing(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPathElementSpacing(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextPathElement* castedThis = static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()));
+    JSSVGTextPathElement* castedThis = static_cast<JSSVGTextPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextPathElement* imp = static_cast<SVGTextPathElement*>(castedThis->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->spacingAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGTextPathElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPathElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextPathElement* castedThis = static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()));
+    JSSVGTextPathElement* castedThis = static_cast<JSSVGTextPathElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextPathElement* imp = static_cast<SVGTextPathElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGTextPathElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPathElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextPathElement* domObject = static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()));
+    JSSVGTextPathElement* domObject = static_cast<JSSVGTextPathElement*>(asObject(slotBase));
     return JSSVGTextPathElement::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGTextPathElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -215,32 +219,32 @@ JSValue JSSVGTextPathElement::getConstructor(ExecState* exec, JSGlobalObject* gl
 
 // Constant getters
 
-JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
index cf883be256..863331da62 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGTextPathElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -70,19 +70,19 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGTextPathElementStartOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextPathElementMethod(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextPathElementSpacing(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextPathElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextPathElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementStartOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextPathElementMethod(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextPathElementSpacing(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextPathElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextPathElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp
index cefc7d8da1..ccb363dc30 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp
@@ -37,23 +37,71 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGTextPositioningElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGTextPositioningElementTableValues[6] =
+static const HashTableValue JSSVGTextPositioningElementTableValues[7] =
 {
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGTextPositioningElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGTextPositioningElementY, (intptr_t)0 },
-    { "dx", DontDelete|ReadOnly, (intptr_t)jsSVGTextPositioningElementDx, (intptr_t)0 },
-    { "dy", DontDelete|ReadOnly, (intptr_t)jsSVGTextPositioningElementDy, (intptr_t)0 },
-    { "rotate", DontDelete|ReadOnly, (intptr_t)jsSVGTextPositioningElementRotate, (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPositioningElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPositioningElementY), (intptr_t)0 },
+    { "dx", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPositioningElementDx), (intptr_t)0 },
+    { "dy", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPositioningElementDy), (intptr_t)0 },
+    { "rotate", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPositioningElementRotate), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTextPositioningElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGTextPositioningElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 15, JSSVGTextPositioningElementTableValues, 0 };
+    { 31, JSSVGTextPositioningElementTableValues, 0 };
 #else
-    { 16, 15, JSSVGTextPositioningElementTableValues, 0 };
+    { 17, 15, JSSVGTextPositioningElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGTextPositioningElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGTextPositioningElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGTextPositioningElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGTextPositioningElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGTextPositioningElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGTextPositioningElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGTextPositioningElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGTextPositioningElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGTextPositioningElementConstructor::s_info = { "SVGTextPositioningElementConstructor", 0, &JSSVGTextPositioningElementConstructorTable, 0 };
+
+bool JSSVGTextPositioningElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGTextPositioningElementConstructor, DOMObject>(exec, &JSSVGTextPositioningElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGTextPositioningElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTextPositioningElementConstructor, DOMObject>(exec, &JSSVGTextPositioningElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGTextPositioningElementPrototypeTableValues[1] =
@@ -97,49 +145,64 @@ bool JSSVGTextPositioningElement::getOwnPropertyDescriptor(ExecState* exec, cons
     return getStaticValueDescriptor<JSSVGTextPositioningElement, Base>(exec, &JSSVGTextPositioningElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGTextPositioningElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPositioningElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextPositioningElement* castedThis = static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()));
+    JSSVGTextPositioningElement* castedThis = static_cast<JSSVGTextPositioningElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextPositioningElement* imp = static_cast<SVGTextPositioningElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLengthList> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGTextPositioningElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPositioningElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextPositioningElement* castedThis = static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()));
+    JSSVGTextPositioningElement* castedThis = static_cast<JSSVGTextPositioningElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextPositioningElement* imp = static_cast<SVGTextPositioningElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLengthList> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGTextPositioningElementDx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPositioningElementDx(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextPositioningElement* castedThis = static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()));
+    JSSVGTextPositioningElement* castedThis = static_cast<JSSVGTextPositioningElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextPositioningElement* imp = static_cast<SVGTextPositioningElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLengthList> obj = imp->dxAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGTextPositioningElementDy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPositioningElementDy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextPositioningElement* castedThis = static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()));
+    JSSVGTextPositioningElement* castedThis = static_cast<JSSVGTextPositioningElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextPositioningElement* imp = static_cast<SVGTextPositioningElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLengthList> obj = imp->dyAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGTextPositioningElementRotate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPositioningElementRotate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTextPositioningElement* castedThis = static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()));
+    JSSVGTextPositioningElement* castedThis = static_cast<JSSVGTextPositioningElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTextPositioningElement* imp = static_cast<SVGTextPositioningElement*>(castedThis->impl());
     RefPtr<SVGAnimatedNumberList> obj = imp->rotateAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
+}
+
+JSValue jsSVGTextPositioningElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGTextPositioningElement* domObject = static_cast<JSSVGTextPositioningElement*>(asObject(slotBase));
+    return JSSVGTextPositioningElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGTextPositioningElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGTextPositioningElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
index 04d1db3765..ed3f5baf2a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -58,7 +59,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGTextPositioningElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -67,11 +68,12 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGTextPositioningElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextPositioningElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextPositioningElementDx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextPositioningElementDy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTextPositioningElementRotate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPositioningElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextPositioningElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextPositioningElementDx(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextPositioningElementDy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextPositioningElementRotate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTextPositioningElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp
index 59e0e8d9a8..b1401fbbd5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp
@@ -44,12 +44,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGTitleElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGTitleElementTableValues[5] =
+static const HashTableValue JSSVGTitleElementTableValues[6] =
 {
-    { "xmllang", DontDelete, (intptr_t)jsSVGTitleElementXmllang, (intptr_t)setJSSVGTitleElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGTitleElementXmlspace, (intptr_t)setJSSVGTitleElementXmlspace },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGTitleElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGTitleElementStyle, (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTitleElementXmllang), (intptr_t)setJSSVGTitleElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTitleElementXmlspace), (intptr_t)setJSSVGTitleElementXmlspace },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTitleElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTitleElementStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTitleElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -57,14 +58,61 @@ static JSC_CONST_HASHTABLE HashTable JSSVGTitleElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 15, JSSVGTitleElementTableValues, 0 };
 #else
-    { 9, 7, JSSVGTitleElementTableValues, 0 };
+    { 16, 15, JSSVGTitleElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGTitleElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGTitleElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGTitleElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGTitleElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGTitleElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGTitleElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGTitleElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGTitleElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGTitleElementConstructor::s_info = { "SVGTitleElementConstructor", 0, &JSSVGTitleElementConstructorTable, 0 };
+
+bool JSSVGTitleElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGTitleElementConstructor, DOMObject>(exec, &JSSVGTitleElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGTitleElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTitleElementConstructor, DOMObject>(exec, &JSSVGTitleElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGTitleElementPrototypeTableValues[2] =
 {
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGTitleElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTitleElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -114,39 +162,48 @@ bool JSSVGTitleElement::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSSVGTitleElement, Base>(exec, &JSSVGTitleElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGTitleElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTitleElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTitleElement* castedThis = static_cast<JSSVGTitleElement*>(asObject(slot.slotBase()));
+    JSSVGTitleElement* castedThis = static_cast<JSSVGTitleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGTitleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTitleElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTitleElement* castedThis = static_cast<JSSVGTitleElement*>(asObject(slot.slotBase()));
+    JSSVGTitleElement* castedThis = static_cast<JSSVGTitleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGTitleElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTitleElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTitleElement* castedThis = static_cast<JSSVGTitleElement*>(asObject(slot.slotBase()));
+    JSSVGTitleElement* castedThis = static_cast<JSSVGTitleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGTitleElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTitleElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTitleElement* castedThis = static_cast<JSSVGTitleElement*>(asObject(slot.slotBase()));
+    JSSVGTitleElement* castedThis = static_cast<JSSVGTitleElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
+JSValue jsSVGTitleElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGTitleElement* domObject = static_cast<JSSVGTitleElement*>(asObject(slotBase));
+    return JSSVGTitleElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGTitleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGTitleElement, Base>(exec, propertyName, value, &JSSVGTitleElementTable, this, slot);
@@ -154,16 +211,23 @@ void JSSVGTitleElement::put(ExecState* exec, const Identifier& propertyName, JSV
 
 void setJSSVGTitleElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGTitleElement* imp = static_cast<SVGTitleElement*>(static_cast<JSSVGTitleElement*>(thisObject)->impl());
+    JSSVGTitleElement* castedThisObj = static_cast<JSSVGTitleElement*>(thisObject);
+    SVGTitleElement* imp = static_cast<SVGTitleElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGTitleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGTitleElement* imp = static_cast<SVGTitleElement*>(static_cast<JSSVGTitleElement*>(thisObject)->impl());
+    JSSVGTitleElement* castedThisObj = static_cast<JSSVGTitleElement*>(thisObject);
+    SVGTitleElement* imp = static_cast<SVGTitleElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGTitleElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGTitleElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGTitleElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
index 67a353d562..737c2e0342 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGTitleElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,12 +74,13 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsSVGTitleElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGTitleElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTitleElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGTitleElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGTitleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTitleElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGTitleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGTitleElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTitleElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTitleElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTitleElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTitleElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
index 2f51e56086..16a2f4df49 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
@@ -40,10 +40,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGTransform);
 
 static const HashTableValue JSSVGTransformTableValues[5] =
 {
-    { "type", DontDelete|ReadOnly, (intptr_t)jsSVGTransformType, (intptr_t)0 },
-    { "matrix", DontDelete|ReadOnly, (intptr_t)jsSVGTransformMatrix, (intptr_t)0 },
-    { "angle", DontDelete|ReadOnly, (intptr_t)jsSVGTransformAngle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGTransformConstructor, (intptr_t)0 },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformType), (intptr_t)0 },
+    { "matrix", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformMatrix), (intptr_t)0 },
+    { "angle", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformAngle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -58,13 +58,13 @@ static JSC_CONST_HASHTABLE HashTable JSSVGTransformTable =
 
 static const HashTableValue JSSVGTransformConstructorTableValues[8] =
 {
-    { "SVG_TRANSFORM_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGTransformSVG_TRANSFORM_UNKNOWN, (intptr_t)0 },
-    { "SVG_TRANSFORM_MATRIX", DontDelete|ReadOnly, (intptr_t)jsSVGTransformSVG_TRANSFORM_MATRIX, (intptr_t)0 },
-    { "SVG_TRANSFORM_TRANSLATE", DontDelete|ReadOnly, (intptr_t)jsSVGTransformSVG_TRANSFORM_TRANSLATE, (intptr_t)0 },
-    { "SVG_TRANSFORM_SCALE", DontDelete|ReadOnly, (intptr_t)jsSVGTransformSVG_TRANSFORM_SCALE, (intptr_t)0 },
-    { "SVG_TRANSFORM_ROTATE", DontDelete|ReadOnly, (intptr_t)jsSVGTransformSVG_TRANSFORM_ROTATE, (intptr_t)0 },
-    { "SVG_TRANSFORM_SKEWX", DontDelete|ReadOnly, (intptr_t)jsSVGTransformSVG_TRANSFORM_SKEWX, (intptr_t)0 },
-    { "SVG_TRANSFORM_SKEWY", DontDelete|ReadOnly, (intptr_t)jsSVGTransformSVG_TRANSFORM_SKEWY, (intptr_t)0 },
+    { "SVG_TRANSFORM_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformSVG_TRANSFORM_UNKNOWN), (intptr_t)0 },
+    { "SVG_TRANSFORM_MATRIX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformSVG_TRANSFORM_MATRIX), (intptr_t)0 },
+    { "SVG_TRANSFORM_TRANSLATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformSVG_TRANSFORM_TRANSLATE), (intptr_t)0 },
+    { "SVG_TRANSFORM_SCALE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformSVG_TRANSFORM_SCALE), (intptr_t)0 },
+    { "SVG_TRANSFORM_ROTATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformSVG_TRANSFORM_ROTATE), (intptr_t)0 },
+    { "SVG_TRANSFORM_SKEWX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformSVG_TRANSFORM_SKEWX), (intptr_t)0 },
+    { "SVG_TRANSFORM_SKEWY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformSVG_TRANSFORM_SKEWY), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -89,7 +89,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -112,19 +112,19 @@ bool JSSVGTransformConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSSVGTransformPrototypeTableValues[14] =
 {
-    { "SVG_TRANSFORM_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGTransformSVG_TRANSFORM_UNKNOWN, (intptr_t)0 },
-    { "SVG_TRANSFORM_MATRIX", DontDelete|ReadOnly, (intptr_t)jsSVGTransformSVG_TRANSFORM_MATRIX, (intptr_t)0 },
-    { "SVG_TRANSFORM_TRANSLATE", DontDelete|ReadOnly, (intptr_t)jsSVGTransformSVG_TRANSFORM_TRANSLATE, (intptr_t)0 },
-    { "SVG_TRANSFORM_SCALE", DontDelete|ReadOnly, (intptr_t)jsSVGTransformSVG_TRANSFORM_SCALE, (intptr_t)0 },
-    { "SVG_TRANSFORM_ROTATE", DontDelete|ReadOnly, (intptr_t)jsSVGTransformSVG_TRANSFORM_ROTATE, (intptr_t)0 },
-    { "SVG_TRANSFORM_SKEWX", DontDelete|ReadOnly, (intptr_t)jsSVGTransformSVG_TRANSFORM_SKEWX, (intptr_t)0 },
-    { "SVG_TRANSFORM_SKEWY", DontDelete|ReadOnly, (intptr_t)jsSVGTransformSVG_TRANSFORM_SKEWY, (intptr_t)0 },
-    { "setMatrix", DontDelete|Function, (intptr_t)jsSVGTransformPrototypeFunctionSetMatrix, (intptr_t)1 },
-    { "setTranslate", DontDelete|Function, (intptr_t)jsSVGTransformPrototypeFunctionSetTranslate, (intptr_t)2 },
-    { "setScale", DontDelete|Function, (intptr_t)jsSVGTransformPrototypeFunctionSetScale, (intptr_t)2 },
-    { "setRotate", DontDelete|Function, (intptr_t)jsSVGTransformPrototypeFunctionSetRotate, (intptr_t)3 },
-    { "setSkewX", DontDelete|Function, (intptr_t)jsSVGTransformPrototypeFunctionSetSkewX, (intptr_t)1 },
-    { "setSkewY", DontDelete|Function, (intptr_t)jsSVGTransformPrototypeFunctionSetSkewY, (intptr_t)1 },
+    { "SVG_TRANSFORM_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformSVG_TRANSFORM_UNKNOWN), (intptr_t)0 },
+    { "SVG_TRANSFORM_MATRIX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformSVG_TRANSFORM_MATRIX), (intptr_t)0 },
+    { "SVG_TRANSFORM_TRANSLATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformSVG_TRANSFORM_TRANSLATE), (intptr_t)0 },
+    { "SVG_TRANSFORM_SCALE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformSVG_TRANSFORM_SCALE), (intptr_t)0 },
+    { "SVG_TRANSFORM_ROTATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformSVG_TRANSFORM_ROTATE), (intptr_t)0 },
+    { "SVG_TRANSFORM_SKEWX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformSVG_TRANSFORM_SKEWX), (intptr_t)0 },
+    { "SVG_TRANSFORM_SKEWY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformSVG_TRANSFORM_SKEWY), (intptr_t)0 },
+    { "setMatrix", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTransformPrototypeFunctionSetMatrix), (intptr_t)1 },
+    { "setTranslate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTransformPrototypeFunctionSetTranslate), (intptr_t)2 },
+    { "setScale", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTransformPrototypeFunctionSetScale), (intptr_t)2 },
+    { "setRotate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTransformPrototypeFunctionSetRotate), (intptr_t)3 },
+    { "setSkewX", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTransformPrototypeFunctionSetSkewX), (intptr_t)1 },
+    { "setSkewY", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTransformPrototypeFunctionSetSkewY), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -154,8 +154,8 @@ bool JSSVGTransformPrototype::getOwnPropertyDescriptor(ExecState* exec, const Id
 
 const ClassInfo JSSVGTransform::s_info = { "SVGTransform", 0, &JSSVGTransformTable, 0 };
 
-JSSVGTransform::JSSVGTransform(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<SVGTransform> > impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGTransform::JSSVGTransform(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<SVGTransform> > impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -163,6 +163,7 @@ JSSVGTransform::JSSVGTransform(NonNullPassRefPtr<Structure> structure, JSDOMGlob
 JSSVGTransform::~JSSVGTransform()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGTransform::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -180,34 +181,37 @@ bool JSSVGTransform::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSSVGTransform, Base>(exec, &JSSVGTransformTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGTransformType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTransformType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTransform* castedThis = static_cast<JSSVGTransform*>(asObject(slot.slotBase()));
+    JSSVGTransform* castedThis = static_cast<JSSVGTransform*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTransform imp(*castedThis->impl());
-    return jsNumber(exec, imp.type());
+    JSValue result =  jsNumber(exec, imp.type());
+    return result;
 }
 
-JSValue jsSVGTransformMatrix(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTransformMatrix(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTransform* castedThis = static_cast<JSSVGTransform*>(asObject(slot.slotBase()));
+    JSSVGTransform* castedThis = static_cast<JSSVGTransform*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTransform imp(*castedThis->impl());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapperWithPODTypeParent<TransformationMatrix, SVGTransform>::create(imp.matrix(), castedThis->impl()).get(), castedThis->context());
+    JSValue result =  toJS(exec, castedThis->globalObject(), JSSVGStaticPODTypeWrapperWithPODTypeParent<AffineTransform, SVGTransform>::create(imp.matrix(), castedThis->impl()).get(), JSSVGContextCache::svgContextForDOMObject(castedThis));
+    return result;
 }
 
-JSValue jsSVGTransformAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTransformAngle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTransform* castedThis = static_cast<JSSVGTransform*>(asObject(slot.slotBase()));
+    JSSVGTransform* castedThis = static_cast<JSSVGTransform*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTransform imp(*castedThis->impl());
-    return jsNumber(exec, imp.angle());
+    JSValue result =  jsNumber(exec, imp.angle());
+    return result;
 }
 
-JSValue jsSVGTransformConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTransformConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    UNUSED_PARAM(slot);
-    return JSSVGTransform::getConstructor(exec, deprecatedGlobalObjectForPrototype(exec));
+    JSSVGTransform* domObject = static_cast<JSSVGTransform*>(asObject(slotBase));
+    return JSSVGTransform::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGTransform::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 {
@@ -220,12 +224,12 @@ JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetMatrix(ExecState* exec,
     if (!thisValue.inherits(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
-    SVGTransform imp(*wrapper);
-    TransformationMatrix matrix = toSVGMatrix(args.at(0));
+    JSSVGPODTypeWrapper<SVGTransform> * imp = static_cast<JSSVGPODTypeWrapper<SVGTransform> *>(castedThisObj->impl());
+    SVGTransform podImp(*imp);
+    AffineTransform matrix = toSVGMatrix(args.at(0));
 
-    imp.setMatrix(matrix);
-    wrapper->commitChange(imp, castedThisObj->context());
+    podImp.setMatrix(matrix);
+    imp->commitChange(podImp, castedThisObj);
     return jsUndefined();
 }
 
@@ -235,13 +239,13 @@ JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetTranslate(ExecState* exe
     if (!thisValue.inherits(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
-    SVGTransform imp(*wrapper);
+    JSSVGPODTypeWrapper<SVGTransform> * imp = static_cast<JSSVGPODTypeWrapper<SVGTransform> *>(castedThisObj->impl());
+    SVGTransform podImp(*imp);
     float tx = args.at(0).toFloat(exec);
     float ty = args.at(1).toFloat(exec);
 
-    imp.setTranslate(tx, ty);
-    wrapper->commitChange(imp, castedThisObj->context());
+    podImp.setTranslate(tx, ty);
+    imp->commitChange(podImp, castedThisObj);
     return jsUndefined();
 }
 
@@ -251,13 +255,13 @@ JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetScale(ExecState* exec, J
     if (!thisValue.inherits(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
-    SVGTransform imp(*wrapper);
+    JSSVGPODTypeWrapper<SVGTransform> * imp = static_cast<JSSVGPODTypeWrapper<SVGTransform> *>(castedThisObj->impl());
+    SVGTransform podImp(*imp);
     float sx = args.at(0).toFloat(exec);
     float sy = args.at(1).toFloat(exec);
 
-    imp.setScale(sx, sy);
-    wrapper->commitChange(imp, castedThisObj->context());
+    podImp.setScale(sx, sy);
+    imp->commitChange(podImp, castedThisObj);
     return jsUndefined();
 }
 
@@ -267,14 +271,14 @@ JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetRotate(ExecState* exec,
     if (!thisValue.inherits(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
-    SVGTransform imp(*wrapper);
+    JSSVGPODTypeWrapper<SVGTransform> * imp = static_cast<JSSVGPODTypeWrapper<SVGTransform> *>(castedThisObj->impl());
+    SVGTransform podImp(*imp);
     float angle = args.at(0).toFloat(exec);
     float cx = args.at(1).toFloat(exec);
     float cy = args.at(2).toFloat(exec);
 
-    imp.setRotate(angle, cx, cy);
-    wrapper->commitChange(imp, castedThisObj->context());
+    podImp.setRotate(angle, cx, cy);
+    imp->commitChange(podImp, castedThisObj);
     return jsUndefined();
 }
 
@@ -284,12 +288,12 @@ JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetSkewX(ExecState* exec, J
     if (!thisValue.inherits(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
-    SVGTransform imp(*wrapper);
+    JSSVGPODTypeWrapper<SVGTransform> * imp = static_cast<JSSVGPODTypeWrapper<SVGTransform> *>(castedThisObj->impl());
+    SVGTransform podImp(*imp);
     float angle = args.at(0).toFloat(exec);
 
-    imp.setSkewX(angle);
-    wrapper->commitChange(imp, castedThisObj->context());
+    podImp.setSkewX(angle);
+    imp->commitChange(podImp, castedThisObj);
     return jsUndefined();
 }
 
@@ -299,48 +303,48 @@ JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetSkewY(ExecState* exec, J
     if (!thisValue.inherits(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
-    JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
-    SVGTransform imp(*wrapper);
+    JSSVGPODTypeWrapper<SVGTransform> * imp = static_cast<JSSVGPODTypeWrapper<SVGTransform> *>(castedThisObj->impl());
+    SVGTransform podImp(*imp);
     float angle = args.at(0).toFloat(exec);
 
-    imp.setSkewY(angle);
-    wrapper->commitChange(imp, castedThisObj->context());
+    podImp.setSkewY(angle);
+    imp->commitChange(podImp, castedThisObj);
     return jsUndefined();
 }
 
 // Constant getters
 
-JSValue jsSVGTransformSVG_TRANSFORM_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGTransformSVG_TRANSFORM_MATRIX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_MATRIX(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGTransformSVG_TRANSFORM_TRANSLATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_TRANSLATE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsSVGTransformSVG_TRANSFORM_SCALE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_SCALE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsSVGTransformSVG_TRANSFORM_ROTATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_ROTATE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsSVGTransformSVG_TRANSFORM_SKEWX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_SKEWX(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValue jsSVGTransformSVG_TRANSFORM_SKEWY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_SKEWY(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
index 592af87d0c..ebe75a4832 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "JSSVGPODTypeWrapper.h"
 #include "SVGElement.h"
@@ -33,10 +32,10 @@
 
 namespace WebCore {
 
-class JSSVGTransform : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGTransform : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGTransform(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<JSSVGPODTypeWrapper<SVGTransform> >, SVGElement* context);
+    JSSVGTransform(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<JSSVGPODTypeWrapper<SVGTransform> >);
     virtual ~JSSVGTransform();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -46,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +57,7 @@ protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<SVGTransform>*, SVGElement* context);
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<SVGTransform>*, SVGElement*);
 SVGTransform toSVGTransform(JSC::JSValue);
 
 class JSSVGTransformPrototype : public JSC::JSObject {
@@ -71,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGTransformPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -88,19 +87,19 @@ JSC::JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetSkewX(JSC::ExecStat
 JSC::JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetSkewY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGTransformType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTransformMatrix(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTransformAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTransformConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTransformMatrix(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTransformAngle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTransformConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGTransformSVG_TRANSFORM_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTransformSVG_TRANSFORM_MATRIX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTransformSVG_TRANSFORM_TRANSLATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTransformSVG_TRANSFORM_SCALE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTransformSVG_TRANSFORM_ROTATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTransformSVG_TRANSFORM_SKEWX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGTransformSVG_TRANSFORM_SKEWY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_MATRIX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_TRANSLATE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_SCALE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_ROTATE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_SKEWX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_SKEWY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp
index 8ce9342a16..e457b974a3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp
@@ -25,6 +25,7 @@
 #include "JSSVGTransformList.h"
 
 #include "JSSVGMatrix.h"
+#include "JSSVGPODListCustom.h"
 #include "JSSVGTransform.h"
 #include "SVGTransform.h"
 #include "SVGTransformList.h"
@@ -40,32 +41,80 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGTransformList);
 
 /* Hash table */
 
-static const HashTableValue JSSVGTransformListTableValues[2] =
+static const HashTableValue JSSVGTransformListTableValues[3] =
 {
-    { "numberOfItems", DontDelete|ReadOnly, (intptr_t)jsSVGTransformListNumberOfItems, (intptr_t)0 },
+    { "numberOfItems", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformListNumberOfItems), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGTransformListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSSVGTransformListTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGTransformListTableValues, 0 };
+    { 3, JSSVGTransformListTableValues, 0 };
 #else
-    { 2, 1, JSSVGTransformListTableValues, 0 };
+    { 4, 3, JSSVGTransformListTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGTransformListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGTransformListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGTransformListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGTransformListConstructorTableValues, 0 };
+#endif
+
+class JSSVGTransformListConstructor : public DOMConstructorObject {
+public:
+    JSSVGTransformListConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGTransformListConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGTransformListPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGTransformListConstructor::s_info = { "SVGTransformListConstructor", 0, &JSSVGTransformListConstructorTable, 0 };
+
+bool JSSVGTransformListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGTransformListConstructor, DOMObject>(exec, &JSSVGTransformListConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGTransformListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTransformListConstructor, DOMObject>(exec, &JSSVGTransformListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGTransformListPrototypeTableValues[10] =
 {
-    { "clear", DontDelete|Function, (intptr_t)jsSVGTransformListPrototypeFunctionClear, (intptr_t)0 },
-    { "initialize", DontDelete|Function, (intptr_t)jsSVGTransformListPrototypeFunctionInitialize, (intptr_t)1 },
-    { "getItem", DontDelete|Function, (intptr_t)jsSVGTransformListPrototypeFunctionGetItem, (intptr_t)1 },
-    { "insertItemBefore", DontDelete|Function, (intptr_t)jsSVGTransformListPrototypeFunctionInsertItemBefore, (intptr_t)2 },
-    { "replaceItem", DontDelete|Function, (intptr_t)jsSVGTransformListPrototypeFunctionReplaceItem, (intptr_t)2 },
-    { "removeItem", DontDelete|Function, (intptr_t)jsSVGTransformListPrototypeFunctionRemoveItem, (intptr_t)1 },
-    { "appendItem", DontDelete|Function, (intptr_t)jsSVGTransformListPrototypeFunctionAppendItem, (intptr_t)1 },
-    { "createSVGTransformFromMatrix", DontDelete|Function, (intptr_t)jsSVGTransformListPrototypeFunctionCreateSVGTransformFromMatrix, (intptr_t)1 },
-    { "consolidate", DontDelete|Function, (intptr_t)jsSVGTransformListPrototypeFunctionConsolidate, (intptr_t)0 },
+    { "clear", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTransformListPrototypeFunctionClear), (intptr_t)0 },
+    { "initialize", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTransformListPrototypeFunctionInitialize), (intptr_t)1 },
+    { "getItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTransformListPrototypeFunctionGetItem), (intptr_t)1 },
+    { "insertItemBefore", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTransformListPrototypeFunctionInsertItemBefore), (intptr_t)2 },
+    { "replaceItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTransformListPrototypeFunctionReplaceItem), (intptr_t)2 },
+    { "removeItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTransformListPrototypeFunctionRemoveItem), (intptr_t)1 },
+    { "appendItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTransformListPrototypeFunctionAppendItem), (intptr_t)1 },
+    { "createSVGTransformFromMatrix", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTransformListPrototypeFunctionCreateSVGTransformFromMatrix), (intptr_t)1 },
+    { "consolidate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGTransformListPrototypeFunctionConsolidate), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -95,8 +144,8 @@ bool JSSVGTransformListPrototype::getOwnPropertyDescriptor(ExecState* exec, cons
 
 const ClassInfo JSSVGTransformList::s_info = { "SVGTransformList", 0, &JSSVGTransformListTable, 0 };
 
-JSSVGTransformList::JSSVGTransformList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGTransformList> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGTransformList::JSSVGTransformList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGTransformList> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -104,6 +153,7 @@ JSSVGTransformList::JSSVGTransformList(NonNullPassRefPtr<Structure> structure, J
 JSSVGTransformList::~JSSVGTransformList()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGTransformList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -121,12 +171,23 @@ bool JSSVGTransformList::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSSVGTransformList, Base>(exec, &JSSVGTransformListTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGTransformListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTransformListNumberOfItems(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGTransformList* castedThis = static_cast<JSSVGTransformList*>(asObject(slot.slotBase()));
+    JSSVGTransformList* castedThis = static_cast<JSSVGTransformList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGTransformList* imp = static_cast<SVGTransformList*>(castedThis->impl());
-    return jsNumber(exec, imp->numberOfItems());
+    JSValue result = jsNumber(exec, imp->numberOfItems());
+    return result;
+}
+
+JSValue jsSVGTransformListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGTransformList* domObject = static_cast<JSSVGTransformList*>(asObject(slotBase));
+    return JSSVGTransformList::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGTransformList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGTransformListConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -135,7 +196,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionClear(ExecState* exec,
     if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
-    return castedThisObj->clear(exec, args);
+    return JSSVGPODListCustom::clear<JSSVGTransformList, SVGTransform>(castedThisObj, exec, args, toSVGTransform);
 }
 
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -144,7 +205,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInitialize(ExecState* e
     if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
-    return castedThisObj->initialize(exec, args);
+    return JSSVGPODListCustom::initialize<JSSVGTransformList, SVGTransform>(castedThisObj, exec, args, toSVGTransform);
 }
 
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -153,7 +214,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionGetItem(ExecState* exec
     if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
-    return castedThisObj->getItem(exec, args);
+    return JSSVGPODListCustom::getItem<JSSVGTransformList, SVGTransform>(castedThisObj, exec, args, toSVGTransform);
 }
 
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -162,7 +223,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInsertItemBefore(ExecSt
     if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
-    return castedThisObj->insertItemBefore(exec, args);
+    return JSSVGPODListCustom::insertItemBefore<JSSVGTransformList, SVGTransform>(castedThisObj, exec, args, toSVGTransform);
 }
 
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -171,7 +232,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionReplaceItem(ExecState*
     if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
-    return castedThisObj->replaceItem(exec, args);
+    return JSSVGPODListCustom::replaceItem<JSSVGTransformList, SVGTransform>(castedThisObj, exec, args, toSVGTransform);
 }
 
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -180,7 +241,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionRemoveItem(ExecState* e
     if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
-    return castedThisObj->removeItem(exec, args);
+    return JSSVGPODListCustom::removeItem<JSSVGTransformList, SVGTransform>(castedThisObj, exec, args, toSVGTransform);
 }
 
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -189,7 +250,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionAppendItem(ExecState* e
     if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
-    return castedThisObj->appendItem(exec, args);
+    return JSSVGPODListCustom::appendItem<JSSVGTransformList, SVGTransform>(castedThisObj, exec, args, toSVGTransform);
 }
 
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionCreateSVGTransformFromMatrix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -199,10 +260,10 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionCreateSVGTransformFromM
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     SVGTransformList* imp = static_cast<SVGTransformList*>(castedThisObj->impl());
-    TransformationMatrix matrix = toSVGMatrix(args.at(0));
+    AffineTransform matrix = toSVGMatrix(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransformFromMatrix(matrix)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransformFromMatrix(matrix)).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -215,7 +276,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionConsolidate(ExecState*
     SVGTransformList* imp = static_cast<SVGTransformList*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->consolidate()).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->consolidate()).get(), 0 /* no context on purpose */);
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
index a8fe9e4651..813e38d8fd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -33,10 +32,10 @@ namespace WebCore {
 
 class SVGTransformList;
 
-class JSSVGTransformList : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGTransformList : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGTransformList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGTransformList>, SVGElement* context);
+    JSSVGTransformList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGTransformList>);
     virtual ~JSSVGTransformList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -46,18 +45,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-
-    // Custom functions
-    JSC::JSValue clear(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue initialize(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue getItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue insertItemBefore(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue replaceItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue removeItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue appendItem(JSC::ExecState*, const JSC::ArgList&);
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     SVGTransformList* impl() const { return m_impl.get(); }
 
 private:
@@ -79,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGTransformListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -99,7 +90,8 @@ JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionCreateSVGTransform
 JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionConsolidate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGTransformListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformListNumberOfItems(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGTransformListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
index fb3321a7ec..61810f1f1d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
@@ -37,7 +37,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGUnitTypes);
 
 static const HashTableValue JSSVGUnitTypesTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGUnitTypesConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUnitTypesConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -52,9 +52,9 @@ static JSC_CONST_HASHTABLE HashTable JSSVGUnitTypesTable =
 
 static const HashTableValue JSSVGUnitTypesConstructorTableValues[4] =
 {
-    { "SVG_UNIT_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_UNIT_TYPE_USERSPACEONUSE", DontDelete|ReadOnly, (intptr_t)jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE, (intptr_t)0 },
-    { "SVG_UNIT_TYPE_OBJECTBOUNDINGBOX", DontDelete|ReadOnly, (intptr_t)jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX, (intptr_t)0 },
+    { "SVG_UNIT_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_UNIT_TYPE_USERSPACEONUSE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE), (intptr_t)0 },
+    { "SVG_UNIT_TYPE_OBJECTBOUNDINGBOX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -102,9 +102,9 @@ bool JSSVGUnitTypesConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSSVGUnitTypesPrototypeTableValues[4] =
 {
-    { "SVG_UNIT_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN, (intptr_t)0 },
-    { "SVG_UNIT_TYPE_USERSPACEONUSE", DontDelete|ReadOnly, (intptr_t)jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE, (intptr_t)0 },
-    { "SVG_UNIT_TYPE_OBJECTBOUNDINGBOX", DontDelete|ReadOnly, (intptr_t)jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX, (intptr_t)0 },
+    { "SVG_UNIT_TYPE_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN), (intptr_t)0 },
+    { "SVG_UNIT_TYPE_USERSPACEONUSE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE), (intptr_t)0 },
+    { "SVG_UNIT_TYPE_OBJECTBOUNDINGBOX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -134,8 +134,8 @@ bool JSSVGUnitTypesPrototype::getOwnPropertyDescriptor(ExecState* exec, const Id
 
 const ClassInfo JSSVGUnitTypes::s_info = { "SVGUnitTypes", 0, &JSSVGUnitTypesTable, 0 };
 
-JSSVGUnitTypes::JSSVGUnitTypes(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGUnitTypes> impl, SVGElement* context)
-    : DOMObjectWithSVGContext(structure, globalObject, context)
+JSSVGUnitTypes::JSSVGUnitTypes(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGUnitTypes> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
     , m_impl(impl)
 {
 }
@@ -143,6 +143,7 @@ JSSVGUnitTypes::JSSVGUnitTypes(NonNullPassRefPtr<Structure> structure, JSDOMGlob
 JSSVGUnitTypes::~JSSVGUnitTypes()
 {
     forgetDOMObject(this, impl());
+    JSSVGContextCache::forgetWrapper(this);
 }
 
 JSObject* JSSVGUnitTypes::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -160,10 +161,10 @@ bool JSSVGUnitTypes::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSSVGUnitTypes, Base>(exec, &JSSVGUnitTypesTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGUnitTypesConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUnitTypesConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    UNUSED_PARAM(slot);
-    return JSSVGUnitTypes::getConstructor(exec, deprecatedGlobalObjectForPrototype(exec));
+    JSSVGUnitTypes* domObject = static_cast<JSSVGUnitTypes*>(asObject(slotBase));
+    return JSSVGUnitTypes::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSSVGUnitTypes::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 {
@@ -172,17 +173,17 @@ JSValue JSSVGUnitTypes::getConstructor(ExecState* exec, JSGlobalObject* globalOb
 
 // Constant getters
 
-JSValue jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
index 0c20046462..6d803eaa2f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(SVG)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
@@ -33,10 +32,10 @@ namespace WebCore {
 
 class SVGUnitTypes;
 
-class JSSVGUnitTypes : public DOMObjectWithSVGContext {
-    typedef DOMObjectWithSVGContext Base;
+class JSSVGUnitTypes : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSSVGUnitTypes(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGUnitTypes>, SVGElement* context);
+    JSSVGUnitTypes(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGUnitTypes>);
     virtual ~JSSVGUnitTypes();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -46,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -71,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGUnitTypesPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,12 +79,12 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGUnitTypesConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUnitTypesConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp
index 920e208a29..7ffb1b6c47 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp
@@ -55,26 +55,27 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGUseElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGUseElementTableValues[19] =
-{
-    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementY, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementHeight, (intptr_t)0 },
-    { "instanceRoot", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementInstanceRoot, (intptr_t)0 },
-    { "animatedInstanceRoot", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementAnimatedInstanceRoot, (intptr_t)0 },
-    { "href", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementHref, (intptr_t)0 },
-    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementRequiredFeatures, (intptr_t)0 },
-    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementRequiredExtensions, (intptr_t)0 },
-    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementSystemLanguage, (intptr_t)0 },
-    { "xmllang", DontDelete, (intptr_t)jsSVGUseElementXmllang, (intptr_t)setJSSVGUseElementXmllang },
-    { "xmlspace", DontDelete, (intptr_t)jsSVGUseElementXmlspace, (intptr_t)setJSSVGUseElementXmlspace },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementExternalResourcesRequired, (intptr_t)0 },
-    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementClassName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementStyle, (intptr_t)0 },
-    { "transform", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementTransform, (intptr_t)0 },
-    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementNearestViewportElement, (intptr_t)0 },
-    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)jsSVGUseElementFarthestViewportElement, (intptr_t)0 },
+static const HashTableValue JSSVGUseElementTableValues[20] =
+{
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementY), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementHeight), (intptr_t)0 },
+    { "instanceRoot", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementInstanceRoot), (intptr_t)0 },
+    { "animatedInstanceRoot", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementAnimatedInstanceRoot), (intptr_t)0 },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementHref), (intptr_t)0 },
+    { "requiredFeatures", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementRequiredFeatures), (intptr_t)0 },
+    { "requiredExtensions", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementRequiredExtensions), (intptr_t)0 },
+    { "systemLanguage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementSystemLanguage), (intptr_t)0 },
+    { "xmllang", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementXmllang), (intptr_t)setJSSVGUseElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementXmlspace), (intptr_t)setJSSVGUseElementXmlspace },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementExternalResourcesRequired), (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementClassName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementStyle), (intptr_t)0 },
+    { "transform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementTransform), (intptr_t)0 },
+    { "nearestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementNearestViewportElement), (intptr_t)0 },
+    { "farthestViewportElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementFarthestViewportElement), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGUseElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -85,16 +86,63 @@ static JSC_CONST_HASHTABLE HashTable JSSVGUseElementTable =
     { 68, 63, JSSVGUseElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGUseElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGUseElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGUseElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGUseElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGUseElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGUseElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGUseElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGUseElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGUseElementConstructor::s_info = { "SVGUseElementConstructor", 0, &JSSVGUseElementConstructorTable, 0 };
+
+bool JSSVGUseElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGUseElementConstructor, DOMObject>(exec, &JSSVGUseElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGUseElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGUseElementConstructor, DOMObject>(exec, &JSSVGUseElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGUseElementPrototypeTableValues[7] =
 {
-    { "hasExtension", DontDelete|Function, (intptr_t)jsSVGUseElementPrototypeFunctionHasExtension, (intptr_t)1 },
-    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGUseElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
-    { "getBBox", DontDelete|Function, (intptr_t)jsSVGUseElementPrototypeFunctionGetBBox, (intptr_t)0 },
-    { "getCTM", DontDelete|Function, (intptr_t)jsSVGUseElementPrototypeFunctionGetCTM, (intptr_t)0 },
-    { "getScreenCTM", DontDelete|Function, (intptr_t)jsSVGUseElementPrototypeFunctionGetScreenCTM, (intptr_t)0 },
-    { "getTransformToElement", DontDelete|Function, (intptr_t)jsSVGUseElementPrototypeFunctionGetTransformToElement, (intptr_t)1 },
+    { "hasExtension", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGUseElementPrototypeFunctionHasExtension), (intptr_t)1 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGUseElementPrototypeFunctionGetPresentationAttribute), (intptr_t)1 },
+    { "getBBox", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGUseElementPrototypeFunctionGetBBox), (intptr_t)0 },
+    { "getCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGUseElementPrototypeFunctionGetCTM), (intptr_t)0 },
+    { "getScreenCTM", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGUseElementPrototypeFunctionGetScreenCTM), (intptr_t)0 },
+    { "getTransformToElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsSVGUseElementPrototypeFunctionGetTransformToElement), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -144,158 +192,181 @@ bool JSSVGUseElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSSVGUseElement, Base>(exec, &JSSVGUseElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGUseElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGUseElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGUseElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGUseElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGUseElementInstanceRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementInstanceRoot(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->instanceRoot()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->instanceRoot()));
+    return result;
 }
 
-JSValue jsSVGUseElementAnimatedInstanceRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementAnimatedInstanceRoot(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->animatedInstanceRoot()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->animatedInstanceRoot()));
+    return result;
 }
 
-JSValue jsSVGUseElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGUseElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementRequiredFeatures(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredFeatures()), imp);
+    return result;
 }
 
-JSValue jsSVGUseElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementRequiredExtensions(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->requiredExtensions()), imp);
+    return result;
 }
 
-JSValue jsSVGUseElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementSystemLanguage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->systemLanguage()), imp);
+    return result;
 }
 
-JSValue jsSVGUseElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementXmllang(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
-    return jsString(exec, imp->xmllang());
+    JSValue result = jsString(exec, imp->xmllang());
+    return result;
 }
 
-JSValue jsSVGUseElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementXmlspace(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    JSValue result = jsString(exec, imp->xmlspace());
+    return result;
 }
 
-JSValue jsSVGUseElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGUseElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementClassName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGUseElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsSVGUseElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementTransform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGUseElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementNearestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nearestViewportElement()));
+    return result;
 }
 
-JSValue jsSVGUseElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementFarthestViewportElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
+    JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->farthestViewportElement()));
+    return result;
 }
 
+JSValue jsSVGUseElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGUseElement* domObject = static_cast<JSSVGUseElement*>(asObject(slotBase));
+    return JSSVGUseElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGUseElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGUseElement, Base>(exec, propertyName, value, &JSSVGUseElementTable, this, slot);
@@ -303,16 +374,23 @@ void JSSVGUseElement::put(ExecState* exec, const Identifier& propertyName, JSVal
 
 void setJSSVGUseElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(thisObject)->impl());
+    JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(thisObject);
+    SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
     imp->setXmllang(value.toString(exec));
 }
 
 void setJSSVGUseElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(thisObject)->impl());
+    JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(thisObject);
+    SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
     imp->setXmlspace(value.toString(exec));
 }
 
+JSValue JSSVGUseElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGUseElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -350,7 +428,7 @@ JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetBBox(ExecState* exec, J
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -363,7 +441,7 @@ JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetCTM(ExecState* exec, JS
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -376,7 +454,7 @@ JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetScreenCTM(ExecState* ex
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getScreenCTM()).get(), 0 /* no context on purpose */);
     return result;
 }
 
@@ -391,7 +469,7 @@ JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetTransformToElement(Exec
     SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp->getTransformToElement(element, ec)).get(), 0 /* no context on purpose */);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
index c5665c0c03..3f215d3d17 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGUseElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,26 +79,27 @@ JSC::JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetScreenCTM(JSC::Exe
 JSC::JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGUseElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUseElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUseElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUseElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUseElementInstanceRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUseElementAnimatedInstanceRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUseElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUseElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUseElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUseElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUseElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementInstanceRoot(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementAnimatedInstanceRoot(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementRequiredFeatures(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementRequiredExtensions(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementSystemLanguage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementXmllang(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGUseElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGUseElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementXmlspace(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGUseElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsSVGUseElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUseElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUseElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUseElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUseElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGUseElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementClassName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementTransform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementNearestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementFarthestViewportElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGUseElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp
index ad1aa12de5..c98a9c25be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp
@@ -41,13 +41,14 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGViewElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGViewElementTableValues[6] =
+static const HashTableValue JSSVGViewElementTableValues[7] =
 {
-    { "viewTarget", DontDelete|ReadOnly, (intptr_t)jsSVGViewElementViewTarget, (intptr_t)0 },
-    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)jsSVGViewElementExternalResourcesRequired, (intptr_t)0 },
-    { "viewBox", DontDelete|ReadOnly, (intptr_t)jsSVGViewElementViewBox, (intptr_t)0 },
-    { "preserveAspectRatio", DontDelete|ReadOnly, (intptr_t)jsSVGViewElementPreserveAspectRatio, (intptr_t)0 },
-    { "zoomAndPan", DontDelete, (intptr_t)jsSVGViewElementZoomAndPan, (intptr_t)setJSSVGViewElementZoomAndPan },
+    { "viewTarget", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGViewElementViewTarget), (intptr_t)0 },
+    { "externalResourcesRequired", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGViewElementExternalResourcesRequired), (intptr_t)0 },
+    { "viewBox", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGViewElementViewBox), (intptr_t)0 },
+    { "preserveAspectRatio", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGViewElementPreserveAspectRatio), (intptr_t)0 },
+    { "zoomAndPan", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGViewElementZoomAndPan), (intptr_t)setJSSVGViewElementZoomAndPan },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGViewElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -58,13 +59,63 @@ static JSC_CONST_HASHTABLE HashTable JSSVGViewElementTable =
     { 16, 15, JSSVGViewElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGViewElementConstructorTableValues[4] =
+{
+    { "SVG_ZOOMANDPAN_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGViewElementSVG_ZOOMANDPAN_UNKNOWN), (intptr_t)0 },
+    { "SVG_ZOOMANDPAN_DISABLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGViewElementSVG_ZOOMANDPAN_DISABLE), (intptr_t)0 },
+    { "SVG_ZOOMANDPAN_MAGNIFY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGViewElementSVG_ZOOMANDPAN_MAGNIFY), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGViewElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 31, JSSVGViewElementConstructorTableValues, 0 };
+#else
+    { 9, 7, JSSVGViewElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGViewElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGViewElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGViewElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGViewElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGViewElementConstructor::s_info = { "SVGViewElementConstructor", 0, &JSSVGViewElementConstructorTable, 0 };
+
+bool JSSVGViewElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGViewElementConstructor, DOMObject>(exec, &JSSVGViewElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGViewElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGViewElementConstructor, DOMObject>(exec, &JSSVGViewElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGViewElementPrototypeTableValues[4] =
 {
-    { "SVG_ZOOMANDPAN_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGViewElementSVG_ZOOMANDPAN_UNKNOWN, (intptr_t)0 },
-    { "SVG_ZOOMANDPAN_DISABLE", DontDelete|ReadOnly, (intptr_t)jsSVGViewElementSVG_ZOOMANDPAN_DISABLE, (intptr_t)0 },
-    { "SVG_ZOOMANDPAN_MAGNIFY", DontDelete|ReadOnly, (intptr_t)jsSVGViewElementSVG_ZOOMANDPAN_MAGNIFY, (intptr_t)0 },
+    { "SVG_ZOOMANDPAN_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGViewElementSVG_ZOOMANDPAN_UNKNOWN), (intptr_t)0 },
+    { "SVG_ZOOMANDPAN_DISABLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGViewElementSVG_ZOOMANDPAN_DISABLE), (intptr_t)0 },
+    { "SVG_ZOOMANDPAN_MAGNIFY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGViewElementSVG_ZOOMANDPAN_MAGNIFY), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -114,49 +165,59 @@ bool JSSVGViewElement::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSSVGViewElement, Base>(exec, &JSSVGViewElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGViewElementViewTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGViewElementViewTarget(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGViewElement* castedThis = static_cast<JSSVGViewElement*>(asObject(slot.slotBase()));
+    JSSVGViewElement* castedThis = static_cast<JSSVGViewElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGViewElement* imp = static_cast<SVGViewElement*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->viewTarget()), imp);
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->viewTarget()), imp);
+    return result;
 }
 
-JSValue jsSVGViewElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGViewElementExternalResourcesRequired(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGViewElement* castedThis = static_cast<JSSVGViewElement*>(asObject(slot.slotBase()));
+    JSSVGViewElement* castedThis = static_cast<JSSVGViewElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGViewElement* imp = static_cast<SVGViewElement*>(castedThis->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGViewElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGViewElementViewBox(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGViewElement* castedThis = static_cast<JSSVGViewElement*>(asObject(slot.slotBase()));
+    JSSVGViewElement* castedThis = static_cast<JSSVGViewElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGViewElement* imp = static_cast<SVGViewElement*>(castedThis->impl());
     RefPtr<SVGAnimatedRect> obj = imp->viewBoxAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGViewElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGViewElementPreserveAspectRatio(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGViewElement* castedThis = static_cast<JSSVGViewElement*>(asObject(slot.slotBase()));
+    JSSVGViewElement* castedThis = static_cast<JSSVGViewElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGViewElement* imp = static_cast<SVGViewElement*>(castedThis->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);
+    return result;
 }
 
-JSValue jsSVGViewElementZoomAndPan(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGViewElementZoomAndPan(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGViewElement* castedThis = static_cast<JSSVGViewElement*>(asObject(slot.slotBase()));
+    JSSVGViewElement* castedThis = static_cast<JSSVGViewElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGViewElement* imp = static_cast<SVGViewElement*>(castedThis->impl());
-    return jsNumber(exec, imp->zoomAndPan());
+    JSValue result = jsNumber(exec, imp->zoomAndPan());
+    return result;
 }
 
+JSValue jsSVGViewElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGViewElement* domObject = static_cast<JSSVGViewElement*>(asObject(slotBase));
+    return JSSVGViewElement::getConstructor(exec, domObject->globalObject());
+}
 void JSSVGViewElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGViewElement, Base>(exec, propertyName, value, &JSSVGViewElementTable, this, slot);
@@ -164,23 +225,29 @@ void JSSVGViewElement::put(ExecState* exec, const Identifier& propertyName, JSVa
 
 void setJSSVGViewElementZoomAndPan(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    SVGViewElement* imp = static_cast<SVGViewElement*>(static_cast<JSSVGViewElement*>(thisObject)->impl());
+    JSSVGViewElement* castedThisObj = static_cast<JSSVGViewElement*>(thisObject);
+    SVGViewElement* imp = static_cast<SVGViewElement*>(castedThisObj->impl());
     imp->setZoomAndPan(value.toInt32(exec));
 }
 
+JSValue JSSVGViewElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGViewElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
 // Constant getters
 
-JSValue jsSVGViewElementSVG_ZOOMANDPAN_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGViewElementSVG_ZOOMANDPAN_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsSVGViewElementSVG_ZOOMANDPAN_DISABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGViewElementSVG_ZOOMANDPAN_DISABLE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsSVGViewElementSVG_ZOOMANDPAN_MAGNIFY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGViewElementSVG_ZOOMANDPAN_MAGNIFY(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
index db1533f101..815100780b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
@@ -43,9 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -61,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGViewElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -70,17 +71,18 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGViewElementViewTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGViewElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGViewElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGViewElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGViewElementZoomAndPan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementViewTarget(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGViewElementExternalResourcesRequired(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGViewElementViewBox(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGViewElementPreserveAspectRatio(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGViewElementZoomAndPan(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSVGViewElementZoomAndPan(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGViewElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsSVGViewElementSVG_ZOOMANDPAN_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGViewElementSVG_ZOOMANDPAN_DISABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGViewElementSVG_ZOOMANDPAN_MAGNIFY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementSVG_ZOOMANDPAN_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGViewElementSVG_ZOOMANDPAN_DISABLE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGViewElementSVG_ZOOMANDPAN_MAGNIFY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp
index 724ea1cc4b..6a696ac65f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp
@@ -38,13 +38,14 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGZoomEvent);
 
 /* Hash table */
 
-static const HashTableValue JSSVGZoomEventTableValues[6] =
+static const HashTableValue JSSVGZoomEventTableValues[7] =
 {
-    { "zoomRectScreen", DontDelete|ReadOnly, (intptr_t)jsSVGZoomEventZoomRectScreen, (intptr_t)0 },
-    { "previousScale", DontDelete|ReadOnly, (intptr_t)jsSVGZoomEventPreviousScale, (intptr_t)0 },
-    { "previousTranslate", DontDelete|ReadOnly, (intptr_t)jsSVGZoomEventPreviousTranslate, (intptr_t)0 },
-    { "newScale", DontDelete|ReadOnly, (intptr_t)jsSVGZoomEventNewScale, (intptr_t)0 },
-    { "newTranslate", DontDelete|ReadOnly, (intptr_t)jsSVGZoomEventNewTranslate, (intptr_t)0 },
+    { "zoomRectScreen", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGZoomEventZoomRectScreen), (intptr_t)0 },
+    { "previousScale", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGZoomEventPreviousScale), (intptr_t)0 },
+    { "previousTranslate", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGZoomEventPreviousTranslate), (intptr_t)0 },
+    { "newScale", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGZoomEventNewScale), (intptr_t)0 },
+    { "newTranslate", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGZoomEventNewTranslate), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSVGZoomEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -55,6 +56,53 @@ static JSC_CONST_HASHTABLE HashTable JSSVGZoomEventTable =
     { 17, 15, JSSVGZoomEventTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGZoomEventConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGZoomEventConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGZoomEventConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGZoomEventConstructorTableValues, 0 };
+#endif
+
+class JSSVGZoomEventConstructor : public DOMConstructorObject {
+public:
+    JSSVGZoomEventConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGZoomEventConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGZoomEventPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGZoomEventConstructor::s_info = { "SVGZoomEventConstructor", 0, &JSSVGZoomEventConstructorTable, 0 };
+
+bool JSSVGZoomEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGZoomEventConstructor, DOMObject>(exec, &JSSVGZoomEventConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGZoomEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGZoomEventConstructor, DOMObject>(exec, &JSSVGZoomEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGZoomEventPrototypeTableValues[1] =
@@ -98,44 +146,59 @@ bool JSSVGZoomEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSSVGZoomEvent, Base>(exec, &JSSVGZoomEventTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGZoomEventZoomRectScreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGZoomEventZoomRectScreen(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGZoomEvent* castedThis = static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()));
+    JSSVGZoomEvent* castedThis = static_cast<JSSVGZoomEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGZoomEvent* imp = static_cast<SVGZoomEvent*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->zoomRectScreen()).get(), 0);
+    JSValue result = toJS(exec, castedThis->globalObject(), JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->zoomRectScreen()).get(), 0 /* no context on purpose */);
+    return result;
 }
 
-JSValue jsSVGZoomEventPreviousScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGZoomEventPreviousScale(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGZoomEvent* castedThis = static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()));
+    JSSVGZoomEvent* castedThis = static_cast<JSSVGZoomEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGZoomEvent* imp = static_cast<SVGZoomEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->previousScale());
+    JSValue result = jsNumber(exec, imp->previousScale());
+    return result;
 }
 
-JSValue jsSVGZoomEventPreviousTranslate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGZoomEventPreviousTranslate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGZoomEvent* castedThis = static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()));
+    JSSVGZoomEvent* castedThis = static_cast<JSSVGZoomEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGZoomEvent* imp = static_cast<SVGZoomEvent*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->previousTranslate()).get(), 0);
+    JSValue result = toJS(exec, castedThis->globalObject(), JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->previousTranslate()).get(), 0 /* no context on purpose */);
+    return result;
 }
 
-JSValue jsSVGZoomEventNewScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGZoomEventNewScale(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGZoomEvent* castedThis = static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()));
+    JSSVGZoomEvent* castedThis = static_cast<JSSVGZoomEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGZoomEvent* imp = static_cast<SVGZoomEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->newScale());
+    JSValue result = jsNumber(exec, imp->newScale());
+    return result;
 }
 
-JSValue jsSVGZoomEventNewTranslate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGZoomEventNewTranslate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSVGZoomEvent* castedThis = static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()));
+    JSSVGZoomEvent* castedThis = static_cast<JSSVGZoomEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SVGZoomEvent* imp = static_cast<SVGZoomEvent*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->newTranslate()).get(), 0);
+    JSValue result = toJS(exec, castedThis->globalObject(), JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->newTranslate()).get(), 0 /* no context on purpose */);
+    return result;
+}
+
+JSValue jsSVGZoomEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSSVGZoomEvent* domObject = static_cast<JSSVGZoomEvent*>(asObject(slotBase));
+    return JSSVGZoomEvent::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGZoomEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGZoomEventConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
index 19bd2e74e4..837f775749 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
@@ -42,9 +42,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
@@ -58,7 +59,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSVGZoomEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -67,11 +68,12 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSVGZoomEventZoomRectScreen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGZoomEventPreviousScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGZoomEventPreviousTranslate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGZoomEventNewScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGZoomEventNewTranslate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGZoomEventZoomRectScreen(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGZoomEventPreviousScale(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGZoomEventPreviousTranslate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGZoomEventNewScale(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGZoomEventNewTranslate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSVGZoomEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp b/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp
index 7ccffa398f..786a9ae9d7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp
@@ -35,14 +35,14 @@ ASSERT_CLASS_FITS_IN_CELL(JSScreen);
 
 static const HashTableValue JSScreenTableValues[9] =
 {
-    { "height", DontDelete|ReadOnly, (intptr_t)jsScreenHeight, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsScreenWidth, (intptr_t)0 },
-    { "colorDepth", DontDelete|ReadOnly, (intptr_t)jsScreenColorDepth, (intptr_t)0 },
-    { "pixelDepth", DontDelete|ReadOnly, (intptr_t)jsScreenPixelDepth, (intptr_t)0 },
-    { "availLeft", DontDelete|ReadOnly, (intptr_t)jsScreenAvailLeft, (intptr_t)0 },
-    { "availTop", DontDelete|ReadOnly, (intptr_t)jsScreenAvailTop, (intptr_t)0 },
-    { "availHeight", DontDelete|ReadOnly, (intptr_t)jsScreenAvailHeight, (intptr_t)0 },
-    { "availWidth", DontDelete|ReadOnly, (intptr_t)jsScreenAvailWidth, (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsScreenHeight), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsScreenWidth), (intptr_t)0 },
+    { "colorDepth", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsScreenColorDepth), (intptr_t)0 },
+    { "pixelDepth", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsScreenPixelDepth), (intptr_t)0 },
+    { "availLeft", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsScreenAvailLeft), (intptr_t)0 },
+    { "availTop", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsScreenAvailTop), (intptr_t)0 },
+    { "availHeight", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsScreenAvailHeight), (intptr_t)0 },
+    { "availWidth", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsScreenAvailWidth), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -102,68 +102,76 @@ bool JSScreen::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prope
     return getStaticValueDescriptor<JSScreen, Base>(exec, &JSScreenTable, this, propertyName, descriptor);
 }
 
-JSValue jsScreenHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slot.slotBase()));
+    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(castedThis->impl());
-    return jsNumber(exec, imp->height());
+    JSValue result = jsNumber(exec, imp->height());
+    return result;
 }
 
-JSValue jsScreenWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slot.slotBase()));
+    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(castedThis->impl());
-    return jsNumber(exec, imp->width());
+    JSValue result = jsNumber(exec, imp->width());
+    return result;
 }
 
-JSValue jsScreenColorDepth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenColorDepth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slot.slotBase()));
+    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(castedThis->impl());
-    return jsNumber(exec, imp->colorDepth());
+    JSValue result = jsNumber(exec, imp->colorDepth());
+    return result;
 }
 
-JSValue jsScreenPixelDepth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenPixelDepth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slot.slotBase()));
+    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(castedThis->impl());
-    return jsNumber(exec, imp->pixelDepth());
+    JSValue result = jsNumber(exec, imp->pixelDepth());
+    return result;
 }
 
-JSValue jsScreenAvailLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenAvailLeft(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slot.slotBase()));
+    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(castedThis->impl());
-    return jsNumber(exec, imp->availLeft());
+    JSValue result = jsNumber(exec, imp->availLeft());
+    return result;
 }
 
-JSValue jsScreenAvailTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenAvailTop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slot.slotBase()));
+    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(castedThis->impl());
-    return jsNumber(exec, imp->availTop());
+    JSValue result = jsNumber(exec, imp->availTop());
+    return result;
 }
 
-JSValue jsScreenAvailHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenAvailHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slot.slotBase()));
+    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(castedThis->impl());
-    return jsNumber(exec, imp->availHeight());
+    JSValue result = jsNumber(exec, imp->availHeight());
+    return result;
 }
 
-JSValue jsScreenAvailWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenAvailWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slot.slotBase()));
+    JSScreen* castedThis = static_cast<JSScreen*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(castedThis->impl());
-    return jsNumber(exec, imp->availWidth());
+    JSValue result = jsNumber(exec, imp->availWidth());
+    return result;
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Screen* object)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSScreen.h b/src/3rdparty/webkit/WebCore/generated/JSScreen.h
index 01a45453df..55dabdb072 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSScreen.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSScreen.h
@@ -21,7 +21,6 @@
 #ifndef JSScreen_h
 #define JSScreen_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     Screen* impl() const { return m_impl.get(); }
@@ -65,7 +64,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSScreenPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -74,14 +73,14 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsScreenHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsScreenWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsScreenColorDepth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsScreenPixelDepth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsScreenAvailLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsScreenAvailTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsScreenAvailHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsScreenAvailWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsScreenWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsScreenColorDepth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsScreenPixelDepth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsScreenAvailLeft(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsScreenAvailTop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsScreenAvailHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsScreenAvailWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.cpp b/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.cpp
index e2ab45c4a2..581baae280 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.cpp
@@ -39,7 +39,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSSharedWorker);
 
 static const HashTableValue JSSharedWorkerTableValues[2] =
 {
-    { "port", DontDelete|ReadOnly, (intptr_t)jsSharedWorkerPort, (intptr_t)0 },
+    { "port", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSharedWorkerPort), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -93,12 +93,13 @@ bool JSSharedWorker::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSSharedWorker, Base>(exec, &JSSharedWorkerTable, this, propertyName, descriptor);
 }
 
-JSValue jsSharedWorkerPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSharedWorkerPort(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSharedWorker* castedThis = static_cast<JSSharedWorker*>(asObject(slot.slotBase()));
+    JSSharedWorker* castedThis = static_cast<JSSharedWorker*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SharedWorker* imp = static_cast<SharedWorker*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->port()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->port()));
+    return result;
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SharedWorker* object)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.h b/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.h
index 55d5f4faa7..3dbf4c1b87 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -66,7 +66,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSharedWorkerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,7 +75,7 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSharedWorkerPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSharedWorkerPort(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.cpp
index f50e4e9d85..a6fc27ed28 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.cpp
@@ -41,8 +41,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSSharedWorkerContext);
 
 static const HashTableValue JSSharedWorkerContextTableValues[3] =
 {
-    { "name", DontDelete|ReadOnly, (intptr_t)jsSharedWorkerContextName, (intptr_t)0 },
-    { "onconnect", DontDelete, (intptr_t)jsSharedWorkerContextOnconnect, (intptr_t)setJSSharedWorkerContextOnconnect },
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSharedWorkerContextName), (intptr_t)0 },
+    { "onconnect", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsSharedWorkerContextOnconnect), (intptr_t)setJSSharedWorkerContextOnconnect },
     { 0, 0, 0, 0 }
 };
 
@@ -99,22 +99,25 @@ bool JSSharedWorkerContext::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSSharedWorkerContext, Base>(exec, getJSSharedWorkerContextTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsSharedWorkerContextName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSharedWorkerContextName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSharedWorkerContext* castedThis = static_cast<JSSharedWorkerContext*>(asObject(slot.slotBase()));
+    JSSharedWorkerContext* castedThis = static_cast<JSSharedWorkerContext*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SharedWorkerContext* imp = static_cast<SharedWorkerContext*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsSharedWorkerContextOnconnect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSharedWorkerContextOnconnect(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSSharedWorkerContext* castedThis = static_cast<JSSharedWorkerContext*>(asObject(slot.slotBase()));
+    JSSharedWorkerContext* castedThis = static_cast<JSSharedWorkerContext*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     SharedWorkerContext* imp = static_cast<SharedWorkerContext*>(castedThis->impl());
     if (EventListener* listener = imp->onconnect()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
@@ -128,8 +131,7 @@ void setJSSharedWorkerContextOnconnect(ExecState* exec, JSObject* thisObject, JS
 {
     UNUSED_PARAM(exec);
     SharedWorkerContext* imp = static_cast<SharedWorkerContext*>(static_cast<JSSharedWorkerContext*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSSharedWorkerContext*>(thisObject);
-    imp->setOnconnect(globalObject->createJSAttributeEventListener(value));
+    imp->setOnconnect(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 SharedWorkerContext* toSharedWorkerContext(JSC::JSValue value)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.h
index 65cfadab64..57758d0c6b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     SharedWorkerContext* impl() const
@@ -63,7 +63,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSSharedWorkerContextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,8 +72,8 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsSharedWorkerContextName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSharedWorkerContextOnconnect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSharedWorkerContextName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsSharedWorkerContextOnconnect(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSSharedWorkerContextOnconnect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp b/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
index e0ae01b4b4..222e2e338d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
@@ -42,8 +42,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSStorage);
 
 static const HashTableValue JSStorageTableValues[3] =
 {
-    { "length", DontDelete|DontEnum|ReadOnly, (intptr_t)jsStorageLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsStorageConstructor, (intptr_t)0 },
+    { "length", DontDelete|DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStorageLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStorageConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -82,7 +82,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -105,11 +105,11 @@ bool JSStorageConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ident
 
 static const HashTableValue JSStoragePrototypeTableValues[6] =
 {
-    { "key", DontDelete|DontEnum|Function, (intptr_t)jsStoragePrototypeFunctionKey, (intptr_t)1 },
-    { "getItem", DontDelete|DontEnum|Function, (intptr_t)jsStoragePrototypeFunctionGetItem, (intptr_t)1 },
-    { "setItem", DontDelete|DontEnum|Function, (intptr_t)jsStoragePrototypeFunctionSetItem, (intptr_t)2 },
-    { "removeItem", DontDelete|DontEnum|Function, (intptr_t)jsStoragePrototypeFunctionRemoveItem, (intptr_t)1 },
-    { "clear", DontDelete|DontEnum|Function, (intptr_t)jsStoragePrototypeFunctionClear, (intptr_t)0 },
+    { "key", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsStoragePrototypeFunctionKey), (intptr_t)1 },
+    { "getItem", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsStoragePrototypeFunctionGetItem), (intptr_t)1 },
+    { "setItem", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsStoragePrototypeFunctionSetItem), (intptr_t)2 },
+    { "removeItem", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsStoragePrototypeFunctionRemoveItem), (intptr_t)1 },
+    { "clear", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsStoragePrototypeFunctionClear), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -187,17 +187,18 @@ bool JSStorage::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return getStaticValueDescriptor<JSStorage, Base>(exec, &JSStorageTable, this, propertyName, descriptor);
 }
 
-JSValue jsStorageLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStorage* castedThis = static_cast<JSStorage*>(asObject(slot.slotBase()));
+    JSStorage* castedThis = static_cast<JSStorage*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Storage* imp = static_cast<Storage*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsStorageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStorage* domObject = static_cast<JSStorage*>(asObject(slot.slotBase()));
+    JSStorage* domObject = static_cast<JSStorage*>(asObject(slotBase));
     return JSStorage::getConstructor(exec, domObject->globalObject());
 }
 void JSStorage::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorage.h b/src/3rdparty/webkit/WebCore/generated/JSStorage.h
index e2dea63c56..c3e96561ab 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorage.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorage.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -47,11 +46,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     Storage* impl() const { return m_impl.get(); }
 
@@ -61,7 +60,7 @@ protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
     static bool canGetItemsForName(JSC::ExecState*, Storage*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Storage*);
@@ -77,7 +76,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSStoragePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -93,8 +92,8 @@ JSC::JSValue JSC_HOST_CALL jsStoragePrototypeFunctionRemoveItem(JSC::ExecState*,
 JSC::JSValue JSC_HOST_CALL jsStoragePrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsStorageLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsStorageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsStorageConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
index bc8468ca2f..cd392c63c2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
@@ -42,12 +42,12 @@ ASSERT_CLASS_FITS_IN_CELL(JSStorageEvent);
 
 static const HashTableValue JSStorageEventTableValues[7] =
 {
-    { "key", DontDelete|ReadOnly, (intptr_t)jsStorageEventKey, (intptr_t)0 },
-    { "oldValue", DontDelete|ReadOnly, (intptr_t)jsStorageEventOldValue, (intptr_t)0 },
-    { "newValue", DontDelete|ReadOnly, (intptr_t)jsStorageEventNewValue, (intptr_t)0 },
-    { "uri", DontDelete|ReadOnly, (intptr_t)jsStorageEventUri, (intptr_t)0 },
-    { "storageArea", DontDelete|ReadOnly, (intptr_t)jsStorageEventStorageArea, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsStorageEventConstructor, (intptr_t)0 },
+    { "key", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStorageEventKey), (intptr_t)0 },
+    { "oldValue", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStorageEventOldValue), (intptr_t)0 },
+    { "newValue", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStorageEventNewValue), (intptr_t)0 },
+    { "uri", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStorageEventUri), (intptr_t)0 },
+    { "storageArea", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStorageEventStorageArea), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStorageEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -86,7 +86,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -109,7 +109,7 @@ bool JSStorageEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSStorageEventPrototypeTableValues[2] =
 {
-    { "initStorageEvent", DontDelete|Function, (intptr_t)jsStorageEventPrototypeFunctionInitStorageEvent, (intptr_t)8 },
+    { "initStorageEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsStorageEventPrototypeFunctionInitStorageEvent), (intptr_t)8 },
     { 0, 0, 0, 0 }
 };
 
@@ -159,49 +159,54 @@ bool JSStorageEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSStorageEvent, Base>(exec, &JSStorageEventTable, this, propertyName, descriptor);
 }
 
-JSValue jsStorageEventKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStorageEvent* castedThis = static_cast<JSStorageEvent*>(asObject(slot.slotBase()));
+    JSStorageEvent* castedThis = static_cast<JSStorageEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     StorageEvent* imp = static_cast<StorageEvent*>(castedThis->impl());
-    return jsString(exec, imp->key());
+    JSValue result = jsStringOrNull(exec, imp->key());
+    return result;
 }
 
-JSValue jsStorageEventOldValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventOldValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStorageEvent* castedThis = static_cast<JSStorageEvent*>(asObject(slot.slotBase()));
+    JSStorageEvent* castedThis = static_cast<JSStorageEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     StorageEvent* imp = static_cast<StorageEvent*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->oldValue());
+    JSValue result = jsStringOrNull(exec, imp->oldValue());
+    return result;
 }
 
-JSValue jsStorageEventNewValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventNewValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStorageEvent* castedThis = static_cast<JSStorageEvent*>(asObject(slot.slotBase()));
+    JSStorageEvent* castedThis = static_cast<JSStorageEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     StorageEvent* imp = static_cast<StorageEvent*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->newValue());
+    JSValue result = jsStringOrNull(exec, imp->newValue());
+    return result;
 }
 
-JSValue jsStorageEventUri(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventUri(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStorageEvent* castedThis = static_cast<JSStorageEvent*>(asObject(slot.slotBase()));
+    JSStorageEvent* castedThis = static_cast<JSStorageEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     StorageEvent* imp = static_cast<StorageEvent*>(castedThis->impl());
-    return jsString(exec, imp->uri());
+    JSValue result = jsString(exec, imp->uri());
+    return result;
 }
 
-JSValue jsStorageEventStorageArea(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventStorageArea(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStorageEvent* castedThis = static_cast<JSStorageEvent*>(asObject(slot.slotBase()));
+    JSStorageEvent* castedThis = static_cast<JSStorageEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     StorageEvent* imp = static_cast<StorageEvent*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->storageArea()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->storageArea()));
+    return result;
 }
 
-JSValue jsStorageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStorageEvent* domObject = static_cast<JSStorageEvent*>(asObject(slot.slotBase()));
+    JSStorageEvent* domObject = static_cast<JSStorageEvent*>(asObject(slotBase));
     return JSStorageEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSStorageEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
index a9552c1ac8..bb33d787f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -60,7 +60,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSStorageEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,12 +72,12 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsStorageEventPrototypeFunctionInitStorageEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsStorageEventKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsStorageEventOldValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsStorageEventNewValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsStorageEventUri(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsStorageEventStorageArea(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsStorageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageEventKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsStorageEventOldValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsStorageEventNewValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsStorageEventUri(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsStorageEventStorageArea(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsStorageEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
index b84ab6bd4d..0ba672dea0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
@@ -40,14 +40,14 @@ ASSERT_CLASS_FITS_IN_CELL(JSStyleSheet);
 
 static const HashTableValue JSStyleSheetTableValues[9] =
 {
-    { "type", DontDelete|ReadOnly, (intptr_t)jsStyleSheetType, (intptr_t)0 },
-    { "disabled", DontDelete, (intptr_t)jsStyleSheetDisabled, (intptr_t)setJSStyleSheetDisabled },
-    { "ownerNode", DontDelete|ReadOnly, (intptr_t)jsStyleSheetOwnerNode, (intptr_t)0 },
-    { "parentStyleSheet", DontDelete|ReadOnly, (intptr_t)jsStyleSheetParentStyleSheet, (intptr_t)0 },
-    { "href", DontDelete|ReadOnly, (intptr_t)jsStyleSheetHref, (intptr_t)0 },
-    { "title", DontDelete|ReadOnly, (intptr_t)jsStyleSheetTitle, (intptr_t)0 },
-    { "media", DontDelete|ReadOnly, (intptr_t)jsStyleSheetMedia, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsStyleSheetConstructor, (intptr_t)0 },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStyleSheetType), (intptr_t)0 },
+    { "disabled", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStyleSheetDisabled), (intptr_t)setJSStyleSheetDisabled },
+    { "ownerNode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStyleSheetOwnerNode), (intptr_t)0 },
+    { "parentStyleSheet", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStyleSheetParentStyleSheet), (intptr_t)0 },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStyleSheetHref), (intptr_t)0 },
+    { "title", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStyleSheetTitle), (intptr_t)0 },
+    { "media", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStyleSheetMedia), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStyleSheetConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -86,7 +86,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -154,65 +154,72 @@ bool JSStyleSheet::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<JSStyleSheet, Base>(exec, &JSStyleSheetTable, this, propertyName, descriptor);
 }
 
-JSValue jsStyleSheetType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStyleSheet* castedThis = static_cast<JSStyleSheet*>(asObject(slot.slotBase()));
+    JSStyleSheet* castedThis = static_cast<JSStyleSheet*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->type());
+    JSValue result = jsStringOrNull(exec, imp->type());
+    return result;
 }
 
-JSValue jsStyleSheetDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetDisabled(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStyleSheet* castedThis = static_cast<JSStyleSheet*>(asObject(slot.slotBase()));
+    JSStyleSheet* castedThis = static_cast<JSStyleSheet*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(castedThis->impl());
-    return jsBoolean(imp->disabled());
+    JSValue result = jsBoolean(imp->disabled());
+    return result;
 }
 
-JSValue jsStyleSheetOwnerNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetOwnerNode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStyleSheet* castedThis = static_cast<JSStyleSheet*>(asObject(slot.slotBase()));
+    JSStyleSheet* castedThis = static_cast<JSStyleSheet*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->ownerNode()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->ownerNode()));
+    return result;
 }
 
-JSValue jsStyleSheetParentStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetParentStyleSheet(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStyleSheet* castedThis = static_cast<JSStyleSheet*>(asObject(slot.slotBase()));
+    JSStyleSheet* castedThis = static_cast<JSStyleSheet*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentStyleSheet()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentStyleSheet()));
+    return result;
 }
 
-JSValue jsStyleSheetHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStyleSheet* castedThis = static_cast<JSStyleSheet*>(asObject(slot.slotBase()));
+    JSStyleSheet* castedThis = static_cast<JSStyleSheet*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->href());
+    JSValue result = jsStringOrNull(exec, imp->href());
+    return result;
 }
 
-JSValue jsStyleSheetTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetTitle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStyleSheet* castedThis = static_cast<JSStyleSheet*>(asObject(slot.slotBase()));
+    JSStyleSheet* castedThis = static_cast<JSStyleSheet*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->title());
+    JSValue result = jsStringOrNull(exec, imp->title());
+    return result;
 }
 
-JSValue jsStyleSheetMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetMedia(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStyleSheet* castedThis = static_cast<JSStyleSheet*>(asObject(slot.slotBase()));
+    JSStyleSheet* castedThis = static_cast<JSStyleSheet*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    return result;
 }
 
-JSValue jsStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStyleSheet* domObject = static_cast<JSStyleSheet*>(asObject(slot.slotBase()));
+    JSStyleSheet* domObject = static_cast<JSStyleSheet*>(asObject(slotBase));
     return JSStyleSheet::getConstructor(exec, domObject->globalObject());
 }
 void JSStyleSheet::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -222,7 +229,8 @@ void JSStyleSheet::put(ExecState* exec, const Identifier& propertyName, JSValue
 
 void setJSStyleSheetDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(thisObject)->impl());
+    JSStyleSheet* castedThisObj = static_cast<JSStyleSheet*>(thisObject);
+    StyleSheet* imp = static_cast<StyleSheet*>(castedThisObj->impl());
     imp->setDisabled(value.toBoolean(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
index cfdd964912..08d303c603 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
@@ -21,7 +21,6 @@
 #ifndef JSStyleSheet_h
 #define JSStyleSheet_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -69,7 +68,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSStyleSheetPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,15 +77,15 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsStyleSheetType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsStyleSheetDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsStyleSheetDisabled(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSStyleSheetDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsStyleSheetOwnerNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsStyleSheetParentStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsStyleSheetHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsStyleSheetTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsStyleSheetMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetOwnerNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsStyleSheetParentStyleSheet(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsStyleSheetHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsStyleSheetTitle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsStyleSheetMedia(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsStyleSheetConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
index db3d083609..cd05cb786b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
@@ -40,8 +40,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSStyleSheetList);
 
 static const HashTableValue JSStyleSheetListTableValues[3] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsStyleSheetListLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsStyleSheetListConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStyleSheetListLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsStyleSheetListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -103,7 +103,7 @@ bool JSStyleSheetListConstructor::getOwnPropertyDescriptor(ExecState* exec, cons
 
 static const HashTableValue JSStyleSheetListPrototypeTableValues[2] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsStyleSheetListPrototypeFunctionItem, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsStyleSheetListPrototypeFunctionItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -204,24 +204,25 @@ bool JSStyleSheetList::getOwnPropertySlot(ExecState* exec, unsigned propertyName
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsStyleSheetListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetListLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStyleSheetList* castedThis = static_cast<JSStyleSheetList*>(asObject(slot.slotBase()));
+    JSStyleSheetList* castedThis = static_cast<JSStyleSheetList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     StyleSheetList* imp = static_cast<StyleSheetList*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsStyleSheetListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSStyleSheetList* domObject = static_cast<JSStyleSheetList*>(asObject(slot.slotBase()));
+    JSStyleSheetList* domObject = static_cast<JSStyleSheetList*>(asObject(slotBase));
     return JSStyleSheetList::getConstructor(exec, domObject->globalObject());
 }
-void JSStyleSheetList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSStyleSheetList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<StyleSheetList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSStyleSheetList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -244,10 +245,10 @@ JSValue JSC_HOST_CALL jsStyleSheetListPrototypeFunctionItem(ExecState* exec, JSO
 }
 
 
-JSValue JSStyleSheetList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSStyleSheetList::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSStyleSheetList* thisObj = static_cast<JSStyleSheetList*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<StyleSheetList*>(thisObj->impl())->item(slot.index()));
+    JSStyleSheetList* thisObj = static_cast<JSStyleSheetList*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<StyleSheetList*>(thisObj->impl())->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, StyleSheetList* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
index 7b518aaf54..f5bf2f5d2e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
@@ -21,7 +21,6 @@
 #ifndef JSStyleSheetList_h
 #define JSStyleSheetList_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,12 +43,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     StyleSheetList* impl() const { return m_impl.get(); }
 
@@ -57,10 +56,10 @@ private:
     RefPtr<StyleSheetList> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 private:
     static bool canGetItemsForName(JSC::ExecState*, StyleSheetList*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, StyleSheetList*);
@@ -76,7 +75,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSStyleSheetListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -88,8 +87,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsStyleSheetListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsStyleSheetListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsStyleSheetListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetListLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsStyleSheetListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSText.cpp b/src/3rdparty/webkit/WebCore/generated/JSText.cpp
index 62ba04b552..08bdd069c2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSText.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSText.cpp
@@ -39,8 +39,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSText);
 
 static const HashTableValue JSTextTableValues[3] =
 {
-    { "wholeText", DontDelete|ReadOnly, (intptr_t)jsTextWholeText, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsTextConstructor, (intptr_t)0 },
+    { "wholeText", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTextWholeText), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTextConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -102,8 +102,8 @@ bool JSTextConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifi
 
 static const HashTableValue JSTextPrototypeTableValues[3] =
 {
-    { "splitText", DontDelete|Function, (intptr_t)jsTextPrototypeFunctionSplitText, (intptr_t)1 },
-    { "replaceWholeText", DontDelete|Function, (intptr_t)jsTextPrototypeFunctionReplaceWholeText, (intptr_t)1 },
+    { "splitText", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsTextPrototypeFunctionSplitText), (intptr_t)1 },
+    { "replaceWholeText", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsTextPrototypeFunctionReplaceWholeText), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -153,17 +153,18 @@ bool JSText::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propert
     return getStaticValueDescriptor<JSText, Base>(exec, &JSTextTable, this, propertyName, descriptor);
 }
 
-JSValue jsTextWholeText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextWholeText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSText* castedThis = static_cast<JSText*>(asObject(slot.slotBase()));
+    JSText* castedThis = static_cast<JSText*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Text* imp = static_cast<Text*>(castedThis->impl());
-    return jsString(exec, imp->wholeText());
+    JSValue result = jsString(exec, imp->wholeText());
+    return result;
 }
 
-JSValue jsTextConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSText* domObject = static_cast<JSText*>(asObject(slot.slotBase()));
+    JSText* domObject = static_cast<JSText*>(asObject(slotBase));
     return JSText::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSText::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSText.h b/src/3rdparty/webkit/WebCore/generated/JSText.h
index 2c53691201..a608ceb08f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSText.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSText.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -59,7 +59,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSTextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,8 +72,8 @@ JSC::JSValue JSC_HOST_CALL jsTextPrototypeFunctionSplitText(JSC::ExecState*, JSC
 JSC::JSValue JSC_HOST_CALL jsTextPrototypeFunctionReplaceWholeText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsTextWholeText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsTextConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTextWholeText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTextConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
index 3a5c4d9a46..3b3db28e1d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
@@ -38,8 +38,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSTextEvent);
 
 static const HashTableValue JSTextEventTableValues[3] =
 {
-    { "data", DontDelete|ReadOnly, (intptr_t)jsTextEventData, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsTextEventConstructor, (intptr_t)0 },
+    { "data", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTextEventData), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTextEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -78,7 +78,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -101,7 +101,7 @@ bool JSTextEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ide
 
 static const HashTableValue JSTextEventPrototypeTableValues[2] =
 {
-    { "initTextEvent", DontDelete|Function, (intptr_t)jsTextEventPrototypeFunctionInitTextEvent, (intptr_t)5 },
+    { "initTextEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsTextEventPrototypeFunctionInitTextEvent), (intptr_t)5 },
     { 0, 0, 0, 0 }
 };
 
@@ -151,17 +151,18 @@ bool JSTextEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
     return getStaticValueDescriptor<JSTextEvent, Base>(exec, &JSTextEventTable, this, propertyName, descriptor);
 }
 
-JSValue jsTextEventData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextEventData(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSTextEvent* castedThis = static_cast<JSTextEvent*>(asObject(slot.slotBase()));
+    JSTextEvent* castedThis = static_cast<JSTextEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     TextEvent* imp = static_cast<TextEvent*>(castedThis->impl());
-    return jsString(exec, imp->data());
+    JSValue result = jsString(exec, imp->data());
+    return result;
 }
 
-JSValue jsTextEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSTextEvent* domObject = static_cast<JSTextEvent*>(asObject(slot.slotBase()));
+    JSTextEvent* domObject = static_cast<JSTextEvent*>(asObject(slotBase));
     return JSTextEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSTextEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
index 576d55eba1..463edd0805 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSTextEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -70,8 +70,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsTextEventPrototypeFunctionInitTextEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsTextEventData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsTextEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTextEventData(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTextEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
index 940498a887..9eb946676b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
@@ -35,8 +35,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSTextMetrics);
 
 static const HashTableValue JSTextMetricsTableValues[3] =
 {
-    { "width", DontDelete|ReadOnly, (intptr_t)jsTextMetricsWidth, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsTextMetricsConstructor, (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTextMetricsWidth), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTextMetricsConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -75,7 +75,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -143,17 +143,18 @@ bool JSTextMetrics::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSTextMetrics, Base>(exec, &JSTextMetricsTable, this, propertyName, descriptor);
 }
 
-JSValue jsTextMetricsWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextMetricsWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSTextMetrics* castedThis = static_cast<JSTextMetrics*>(asObject(slot.slotBase()));
+    JSTextMetrics* castedThis = static_cast<JSTextMetrics*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     TextMetrics* imp = static_cast<TextMetrics*>(castedThis->impl());
-    return jsNumber(exec, imp->width());
+    JSValue result = jsNumber(exec, imp->width());
+    return result;
 }
 
-JSValue jsTextMetricsConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextMetricsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSTextMetrics* domObject = static_cast<JSTextMetrics*>(asObject(slot.slotBase()));
+    JSTextMetrics* domObject = static_cast<JSTextMetrics*>(asObject(slotBase));
     return JSTextMetrics::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSTextMetrics::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
index 9cf013f856..1a0e993b84 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
@@ -21,7 +21,6 @@
 #ifndef JSTextMetrics_h
 #define JSTextMetrics_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -66,7 +65,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSTextMetricsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,8 +74,8 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsTextMetricsWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsTextMetricsConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTextMetricsWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTextMetricsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp
index 1306ccb887..0b51b1f2b9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp
@@ -39,7 +39,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSTimeRanges);
 
 static const HashTableValue JSTimeRangesTableValues[2] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsTimeRangesLength, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTimeRangesLength), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -54,8 +54,8 @@ static JSC_CONST_HASHTABLE HashTable JSTimeRangesTable =
 
 static const HashTableValue JSTimeRangesPrototypeTableValues[3] =
 {
-    { "start", DontDelete|Function, (intptr_t)jsTimeRangesPrototypeFunctionStart, (intptr_t)1 },
-    { "end", DontDelete|Function, (intptr_t)jsTimeRangesPrototypeFunctionEnd, (intptr_t)1 },
+    { "start", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsTimeRangesPrototypeFunctionStart), (intptr_t)1 },
+    { "end", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsTimeRangesPrototypeFunctionEnd), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -111,12 +111,13 @@ bool JSTimeRanges::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<JSTimeRanges, Base>(exec, &JSTimeRangesTable, this, propertyName, descriptor);
 }
 
-JSValue jsTimeRangesLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTimeRangesLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSTimeRanges* castedThis = static_cast<JSTimeRanges*>(asObject(slot.slotBase()));
+    JSTimeRanges* castedThis = static_cast<JSTimeRanges*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     TimeRanges* imp = static_cast<TimeRanges*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
 JSValue JSC_HOST_CALL jsTimeRangesPrototypeFunctionStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
index 201df069d7..ce87bc953c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(VIDEO)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     TimeRanges* impl() const { return m_impl.get(); }
@@ -69,7 +68,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSTimeRangesPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -82,7 +81,7 @@ JSC::JSValue JSC_HOST_CALL jsTimeRangesPrototypeFunctionStart(JSC::ExecState*, J
 JSC::JSValue JSC_HOST_CALL jsTimeRangesPrototypeFunctionEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsTimeRangesLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTimeRangesLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTouch.cpp b/src/3rdparty/webkit/WebCore/generated/JSTouch.cpp
new file mode 100644
index 0000000000..d87134b10f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSTouch.cpp
@@ -0,0 +1,251 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "JSTouch.h"
+
+#include "EventTarget.h"
+#include "JSEventTarget.h"
+#include "Touch.h"
+#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSTouch);
+
+/* Hash table */
+
+static const HashTableValue JSTouchTableValues[10] =
+{
+    { "clientX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchClientX), (intptr_t)0 },
+    { "clientY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchClientY), (intptr_t)0 },
+    { "screenX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchScreenX), (intptr_t)0 },
+    { "screenY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchScreenY), (intptr_t)0 },
+    { "pageX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchPageX), (intptr_t)0 },
+    { "pageY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchPageY), (intptr_t)0 },
+    { "target", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchTarget), (intptr_t)0 },
+    { "identifier", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchIdentifier), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSTouchTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 31, JSTouchTableValues, 0 };
+#else
+    { 32, 31, JSTouchTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSTouchConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSTouchConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSTouchConstructorTableValues, 0 };
+#else
+    { 1, 0, JSTouchConstructorTableValues, 0 };
+#endif
+
+class JSTouchConstructor : public DOMConstructorObject {
+public:
+    JSTouchConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSTouchConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSTouchPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSTouchConstructor::s_info = { "TouchConstructor", 0, &JSTouchConstructorTable, 0 };
+
+bool JSTouchConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSTouchConstructor, DOMObject>(exec, &JSTouchConstructorTable, this, propertyName, slot);
+}
+
+bool JSTouchConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSTouchConstructor, DOMObject>(exec, &JSTouchConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSTouchPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSTouchPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSTouchPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSTouchPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSTouchPrototype::s_info = { "TouchPrototype", 0, &JSTouchPrototypeTable, 0 };
+
+JSObject* JSTouchPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSTouch>(exec, globalObject);
+}
+
+const ClassInfo JSTouch::s_info = { "Touch", 0, &JSTouchTable, 0 };
+
+JSTouch::JSTouch(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Touch> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSTouch::~JSTouch()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSTouch::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSTouchPrototype(JSTouchPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSTouch::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSTouch, Base>(exec, &JSTouchTable, this, propertyName, slot);
+}
+
+bool JSTouch::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSTouch, Base>(exec, &JSTouchTable, this, propertyName, descriptor);
+}
+
+JSValue jsTouchClientX(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouch* castedThis = static_cast<JSTouch*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Touch* imp = static_cast<Touch*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->clientX());
+    return result;
+}
+
+JSValue jsTouchClientY(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouch* castedThis = static_cast<JSTouch*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Touch* imp = static_cast<Touch*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->clientY());
+    return result;
+}
+
+JSValue jsTouchScreenX(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouch* castedThis = static_cast<JSTouch*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Touch* imp = static_cast<Touch*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->screenX());
+    return result;
+}
+
+JSValue jsTouchScreenY(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouch* castedThis = static_cast<JSTouch*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Touch* imp = static_cast<Touch*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->screenY());
+    return result;
+}
+
+JSValue jsTouchPageX(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouch* castedThis = static_cast<JSTouch*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Touch* imp = static_cast<Touch*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->pageX());
+    return result;
+}
+
+JSValue jsTouchPageY(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouch* castedThis = static_cast<JSTouch*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Touch* imp = static_cast<Touch*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->pageY());
+    return result;
+}
+
+JSValue jsTouchTarget(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouch* castedThis = static_cast<JSTouch*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Touch* imp = static_cast<Touch*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->target()));
+    return result;
+}
+
+JSValue jsTouchIdentifier(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouch* castedThis = static_cast<JSTouch*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Touch* imp = static_cast<Touch*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->identifier());
+    return result;
+}
+
+JSValue jsTouchConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouch* domObject = static_cast<JSTouch*>(asObject(slotBase));
+    return JSTouch::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSTouch::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSTouchConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Touch* object)
+{
+    return getDOMObjectWrapper<JSTouch>(exec, globalObject, object);
+}
+Touch* toTouch(JSC::JSValue value)
+{
+    return value.inherits(&JSTouch::s_info) ? static_cast<JSTouch*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(TOUCH_EVENTS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTouch.h b/src/3rdparty/webkit/WebCore/generated/JSTouch.h
new file mode 100644
index 0000000000..8f03767af2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSTouch.h
@@ -0,0 +1,93 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSTouch_h
+#define JSTouch_h
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class Touch;
+
+class JSTouch : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSTouch(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<Touch>);
+    virtual ~JSTouch();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+    Touch* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<Touch> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Touch*);
+Touch* toTouch(JSC::JSValue);
+
+class JSTouchPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSTouchPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+// Attributes
+
+JSC::JSValue jsTouchClientX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchClientY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchScreenX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchScreenY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchPageX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchPageY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchTarget(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchIdentifier(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif // ENABLE(TOUCH_EVENTS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTouchEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSTouchEvent.cpp
new file mode 100644
index 0000000000..92dac50ffb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSTouchEvent.cpp
@@ -0,0 +1,264 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "JSTouchEvent.h"
+
+#include "JSDOMWindow.h"
+#include "JSTouchList.h"
+#include "TouchEvent.h"
+#include "TouchList.h"
+#include <runtime/Error.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSTouchEvent);
+
+/* Hash table */
+
+static const HashTableValue JSTouchEventTableValues[9] =
+{
+    { "touches", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchEventTouches), (intptr_t)0 },
+    { "targetTouches", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchEventTargetTouches), (intptr_t)0 },
+    { "changedTouches", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchEventChangedTouches), (intptr_t)0 },
+    { "ctrlKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchEventCtrlKey), (intptr_t)0 },
+    { "shiftKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchEventShiftKey), (intptr_t)0 },
+    { "altKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchEventAltKey), (intptr_t)0 },
+    { "metaKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchEventMetaKey), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchEventConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSTouchEventTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 127, JSTouchEventTableValues, 0 };
+#else
+    { 19, 15, JSTouchEventTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSTouchEventConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSTouchEventConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSTouchEventConstructorTableValues, 0 };
+#else
+    { 1, 0, JSTouchEventConstructorTableValues, 0 };
+#endif
+
+class JSTouchEventConstructor : public DOMConstructorObject {
+public:
+    JSTouchEventConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSTouchEventConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSTouchEventPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSTouchEventConstructor::s_info = { "TouchEventConstructor", 0, &JSTouchEventConstructorTable, 0 };
+
+bool JSTouchEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSTouchEventConstructor, DOMObject>(exec, &JSTouchEventConstructorTable, this, propertyName, slot);
+}
+
+bool JSTouchEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSTouchEventConstructor, DOMObject>(exec, &JSTouchEventConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSTouchEventPrototypeTableValues[2] =
+{
+    { "initTouchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsTouchEventPrototypeFunctionInitTouchEvent), (intptr_t)13 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSTouchEventPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSTouchEventPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSTouchEventPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSTouchEventPrototype::s_info = { "TouchEventPrototype", 0, &JSTouchEventPrototypeTable, 0 };
+
+JSObject* JSTouchEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSTouchEvent>(exec, globalObject);
+}
+
+bool JSTouchEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSTouchEventPrototypeTable, this, propertyName, slot);
+}
+
+bool JSTouchEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSTouchEventPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSTouchEvent::s_info = { "TouchEvent", &JSUIEvent::s_info, &JSTouchEventTable, 0 };
+
+JSTouchEvent::JSTouchEvent(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<TouchEvent> impl)
+    : JSUIEvent(structure, globalObject, impl)
+{
+}
+
+JSObject* JSTouchEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSTouchEventPrototype(JSTouchEventPrototype::createStructure(JSUIEventPrototype::self(exec, globalObject)));
+}
+
+bool JSTouchEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSTouchEvent, Base>(exec, &JSTouchEventTable, this, propertyName, slot);
+}
+
+bool JSTouchEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSTouchEvent, Base>(exec, &JSTouchEventTable, this, propertyName, descriptor);
+}
+
+JSValue jsTouchEventTouches(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouchEvent* castedThis = static_cast<JSTouchEvent*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    TouchEvent* imp = static_cast<TouchEvent*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->touches()));
+    return result;
+}
+
+JSValue jsTouchEventTargetTouches(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouchEvent* castedThis = static_cast<JSTouchEvent*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    TouchEvent* imp = static_cast<TouchEvent*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->targetTouches()));
+    return result;
+}
+
+JSValue jsTouchEventChangedTouches(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouchEvent* castedThis = static_cast<JSTouchEvent*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    TouchEvent* imp = static_cast<TouchEvent*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->changedTouches()));
+    return result;
+}
+
+JSValue jsTouchEventCtrlKey(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouchEvent* castedThis = static_cast<JSTouchEvent*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    TouchEvent* imp = static_cast<TouchEvent*>(castedThis->impl());
+    JSValue result = jsBoolean(imp->ctrlKey());
+    return result;
+}
+
+JSValue jsTouchEventShiftKey(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouchEvent* castedThis = static_cast<JSTouchEvent*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    TouchEvent* imp = static_cast<TouchEvent*>(castedThis->impl());
+    JSValue result = jsBoolean(imp->shiftKey());
+    return result;
+}
+
+JSValue jsTouchEventAltKey(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouchEvent* castedThis = static_cast<JSTouchEvent*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    TouchEvent* imp = static_cast<TouchEvent*>(castedThis->impl());
+    JSValue result = jsBoolean(imp->altKey());
+    return result;
+}
+
+JSValue jsTouchEventMetaKey(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouchEvent* castedThis = static_cast<JSTouchEvent*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    TouchEvent* imp = static_cast<TouchEvent*>(castedThis->impl());
+    JSValue result = jsBoolean(imp->metaKey());
+    return result;
+}
+
+JSValue jsTouchEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouchEvent* domObject = static_cast<JSTouchEvent*>(asObject(slotBase));
+    return JSTouchEvent::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSTouchEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSTouchEventConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsTouchEventPrototypeFunctionInitTouchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSTouchEvent::s_info))
+        return throwError(exec, TypeError);
+    JSTouchEvent* castedThisObj = static_cast<JSTouchEvent*>(asObject(thisValue));
+    TouchEvent* imp = static_cast<TouchEvent*>(castedThisObj->impl());
+    TouchList* touches = toTouchList(args.at(0));
+    TouchList* targetTouches = toTouchList(args.at(1));
+    TouchList* changedTouches = toTouchList(args.at(2));
+    const UString& type = args.at(3).toString(exec);
+    DOMWindow* view = toDOMWindow(args.at(4));
+    int screenX = args.at(5).toInt32(exec);
+    int screenY = args.at(6).toInt32(exec);
+    int clientX = args.at(7).toInt32(exec);
+    int clientY = args.at(8).toInt32(exec);
+    bool ctrlKey = args.at(9).toBoolean(exec);
+    bool altKey = args.at(10).toBoolean(exec);
+    bool shiftKey = args.at(11).toBoolean(exec);
+    bool metaKey = args.at(12).toBoolean(exec);
+
+    imp->initTouchEvent(touches, targetTouches, changedTouches, type, view, screenX, screenY, clientX, clientY, ctrlKey, altKey, shiftKey, metaKey);
+    return jsUndefined();
+}
+
+
+}
+
+#endif // ENABLE(TOUCH_EVENTS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTouchEvent.h b/src/3rdparty/webkit/WebCore/generated/JSTouchEvent.h
new file mode 100644
index 0000000000..277b0d254f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSTouchEvent.h
@@ -0,0 +1,88 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSTouchEvent_h
+#define JSTouchEvent_h
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "JSUIEvent.h"
+
+namespace WebCore {
+
+class TouchEvent;
+
+class JSTouchEvent : public JSUIEvent {
+    typedef JSUIEvent Base;
+public:
+    JSTouchEvent(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<TouchEvent>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+
+class JSTouchEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSTouchEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsTouchEventPrototypeFunctionInitTouchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsTouchEventTouches(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchEventTargetTouches(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchEventChangedTouches(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchEventCtrlKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchEventShiftKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchEventAltKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchEventMetaKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif // ENABLE(TOUCH_EVENTS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTouchList.cpp b/src/3rdparty/webkit/WebCore/generated/JSTouchList.cpp
new file mode 100644
index 0000000000..0fe1604aaa
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSTouchList.cpp
@@ -0,0 +1,256 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "JSTouchList.h"
+
+#include "JSTouch.h"
+#include "Touch.h"
+#include "TouchList.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSTouchList);
+
+/* Hash table */
+
+static const HashTableValue JSTouchListTableValues[3] =
+{
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchListLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTouchListConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSTouchListTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 15, JSTouchListTableValues, 0 };
+#else
+    { 5, 3, JSTouchListTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSTouchListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSTouchListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSTouchListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSTouchListConstructorTableValues, 0 };
+#endif
+
+class JSTouchListConstructor : public DOMConstructorObject {
+public:
+    JSTouchListConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSTouchListConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSTouchListPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSTouchListConstructor::s_info = { "TouchListConstructor", 0, &JSTouchListConstructorTable, 0 };
+
+bool JSTouchListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSTouchListConstructor, DOMObject>(exec, &JSTouchListConstructorTable, this, propertyName, slot);
+}
+
+bool JSTouchListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSTouchListConstructor, DOMObject>(exec, &JSTouchListConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSTouchListPrototypeTableValues[2] =
+{
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsTouchListPrototypeFunctionItem), (intptr_t)1 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSTouchListPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSTouchListPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSTouchListPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSTouchListPrototype::s_info = { "TouchListPrototype", 0, &JSTouchListPrototypeTable, 0 };
+
+JSObject* JSTouchListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSTouchList>(exec, globalObject);
+}
+
+bool JSTouchListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSTouchListPrototypeTable, this, propertyName, slot);
+}
+
+bool JSTouchListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSTouchListPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSTouchList::s_info = { "TouchList", 0, &JSTouchListTable, 0 };
+
+JSTouchList::JSTouchList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<TouchList> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSTouchList::~JSTouchList()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSTouchList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSTouchListPrototype(JSTouchListPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSTouchList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    const HashEntry* entry = JSTouchListTable.entry(exec, propertyName);
+    if (entry) {
+        slot.setCustom(this, entry->propertyGetter());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<TouchList*>(impl())->length()) {
+        slot.setCustomIndex(this, index, indexGetter);
+        return true;
+    }
+    return getStaticValueSlot<JSTouchList, Base>(exec, &JSTouchListTable, this, propertyName, slot);
+}
+
+bool JSTouchList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSTouchListTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<TouchList*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    return getStaticValueDescriptor<JSTouchList, Base>(exec, &JSTouchListTable, this, propertyName, descriptor);
+}
+
+bool JSTouchList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<TouchList*>(impl())->length()) {
+        slot.setCustomIndex(this, propertyName, indexGetter);
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+JSValue jsTouchListLength(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouchList* castedThis = static_cast<JSTouchList*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    TouchList* imp = static_cast<TouchList*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
+}
+
+JSValue jsTouchListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTouchList* domObject = static_cast<JSTouchList*>(asObject(slotBase));
+    return JSTouchList::getConstructor(exec, domObject->globalObject());
+}
+void JSTouchList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    for (unsigned i = 0; i < static_cast<TouchList*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+JSValue JSTouchList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSTouchListConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsTouchListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSTouchList::s_info))
+        return throwError(exec, TypeError);
+    JSTouchList* castedThisObj = static_cast<JSTouchList*>(asObject(thisValue));
+    TouchList* imp = static_cast<TouchList*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->item(index)));
+    return result;
+}
+
+
+JSValue JSTouchList::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
+{
+    JSTouchList* thisObj = static_cast<JSTouchList*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<TouchList*>(thisObj->impl())->item(index));
+}
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, TouchList* object)
+{
+    return getDOMObjectWrapper<JSTouchList>(exec, globalObject, object);
+}
+TouchList* toTouchList(JSC::JSValue value)
+{
+    return value.inherits(&JSTouchList::s_info) ? static_cast<JSTouchList*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(TOUCH_EVENTS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTouchList.h b/src/3rdparty/webkit/WebCore/generated/JSTouchList.h
new file mode 100644
index 0000000000..8f08d6b799
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSTouchList.h
@@ -0,0 +1,94 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSTouchList_h
+#define JSTouchList_h
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class TouchList;
+
+class JSTouchList : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSTouchList(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<TouchList>);
+    virtual ~JSTouchList();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+    TouchList* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<TouchList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, TouchList*);
+TouchList* toTouchList(JSC::JSValue);
+
+class JSTouchListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSTouchListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsTouchListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsTouchListLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTouchListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif // ENABLE(TOUCH_EVENTS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
index 10645dbd21..3649109b7e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
@@ -40,12 +40,12 @@ ASSERT_CLASS_FITS_IN_CELL(JSTreeWalker);
 
 static const HashTableValue JSTreeWalkerTableValues[7] =
 {
-    { "root", DontDelete|ReadOnly, (intptr_t)jsTreeWalkerRoot, (intptr_t)0 },
-    { "whatToShow", DontDelete|ReadOnly, (intptr_t)jsTreeWalkerWhatToShow, (intptr_t)0 },
-    { "filter", DontDelete|ReadOnly, (intptr_t)jsTreeWalkerFilter, (intptr_t)0 },
-    { "expandEntityReferences", DontDelete|ReadOnly, (intptr_t)jsTreeWalkerExpandEntityReferences, (intptr_t)0 },
-    { "currentNode", DontDelete, (intptr_t)jsTreeWalkerCurrentNode, (intptr_t)setJSTreeWalkerCurrentNode },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsTreeWalkerConstructor, (intptr_t)0 },
+    { "root", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTreeWalkerRoot), (intptr_t)0 },
+    { "whatToShow", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTreeWalkerWhatToShow), (intptr_t)0 },
+    { "filter", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTreeWalkerFilter), (intptr_t)0 },
+    { "expandEntityReferences", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTreeWalkerExpandEntityReferences), (intptr_t)0 },
+    { "currentNode", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTreeWalkerCurrentNode), (intptr_t)setJSTreeWalkerCurrentNode },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTreeWalkerConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -84,7 +84,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -107,13 +107,13 @@ bool JSTreeWalkerConstructor::getOwnPropertyDescriptor(ExecState* exec, const Id
 
 static const HashTableValue JSTreeWalkerPrototypeTableValues[8] =
 {
-    { "parentNode", DontDelete|Function, (intptr_t)jsTreeWalkerPrototypeFunctionParentNode, (intptr_t)0 },
-    { "firstChild", DontDelete|Function, (intptr_t)jsTreeWalkerPrototypeFunctionFirstChild, (intptr_t)0 },
-    { "lastChild", DontDelete|Function, (intptr_t)jsTreeWalkerPrototypeFunctionLastChild, (intptr_t)0 },
-    { "previousSibling", DontDelete|Function, (intptr_t)jsTreeWalkerPrototypeFunctionPreviousSibling, (intptr_t)0 },
-    { "nextSibling", DontDelete|Function, (intptr_t)jsTreeWalkerPrototypeFunctionNextSibling, (intptr_t)0 },
-    { "previousNode", DontDelete|Function, (intptr_t)jsTreeWalkerPrototypeFunctionPreviousNode, (intptr_t)0 },
-    { "nextNode", DontDelete|Function, (intptr_t)jsTreeWalkerPrototypeFunctionNextNode, (intptr_t)0 },
+    { "parentNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsTreeWalkerPrototypeFunctionParentNode), (intptr_t)0 },
+    { "firstChild", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsTreeWalkerPrototypeFunctionFirstChild), (intptr_t)0 },
+    { "lastChild", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsTreeWalkerPrototypeFunctionLastChild), (intptr_t)0 },
+    { "previousSibling", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsTreeWalkerPrototypeFunctionPreviousSibling), (intptr_t)0 },
+    { "nextSibling", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsTreeWalkerPrototypeFunctionNextSibling), (intptr_t)0 },
+    { "previousNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsTreeWalkerPrototypeFunctionPreviousNode), (intptr_t)0 },
+    { "nextNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsTreeWalkerPrototypeFunctionNextNode), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -169,49 +169,54 @@ bool JSTreeWalker::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<JSTreeWalker, Base>(exec, &JSTreeWalkerTable, this, propertyName, descriptor);
 }
 
-JSValue jsTreeWalkerRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerRoot(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSTreeWalker* castedThis = static_cast<JSTreeWalker*>(asObject(slot.slotBase()));
+    JSTreeWalker* castedThis = static_cast<JSTreeWalker*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     TreeWalker* imp = static_cast<TreeWalker*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->root()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->root()));
+    return result;
 }
 
-JSValue jsTreeWalkerWhatToShow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerWhatToShow(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSTreeWalker* castedThis = static_cast<JSTreeWalker*>(asObject(slot.slotBase()));
+    JSTreeWalker* castedThis = static_cast<JSTreeWalker*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     TreeWalker* imp = static_cast<TreeWalker*>(castedThis->impl());
-    return jsNumber(exec, imp->whatToShow());
+    JSValue result = jsNumber(exec, imp->whatToShow());
+    return result;
 }
 
-JSValue jsTreeWalkerFilter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerFilter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSTreeWalker* castedThis = static_cast<JSTreeWalker*>(asObject(slot.slotBase()));
+    JSTreeWalker* castedThis = static_cast<JSTreeWalker*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     TreeWalker* imp = static_cast<TreeWalker*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->filter()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->filter()));
+    return result;
 }
 
-JSValue jsTreeWalkerExpandEntityReferences(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerExpandEntityReferences(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSTreeWalker* castedThis = static_cast<JSTreeWalker*>(asObject(slot.slotBase()));
+    JSTreeWalker* castedThis = static_cast<JSTreeWalker*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     TreeWalker* imp = static_cast<TreeWalker*>(castedThis->impl());
-    return jsBoolean(imp->expandEntityReferences());
+    JSValue result = jsBoolean(imp->expandEntityReferences());
+    return result;
 }
 
-JSValue jsTreeWalkerCurrentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerCurrentNode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSTreeWalker* castedThis = static_cast<JSTreeWalker*>(asObject(slot.slotBase()));
+    JSTreeWalker* castedThis = static_cast<JSTreeWalker*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     TreeWalker* imp = static_cast<TreeWalker*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->currentNode()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->currentNode()));
+    return result;
 }
 
-JSValue jsTreeWalkerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSTreeWalker* domObject = static_cast<JSTreeWalker*>(asObject(slot.slotBase()));
+    JSTreeWalker* domObject = static_cast<JSTreeWalker*>(asObject(slotBase));
     return JSTreeWalker::getConstructor(exec, domObject->globalObject());
 }
 void JSTreeWalker::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -221,7 +226,8 @@ void JSTreeWalker::put(ExecState* exec, const Identifier& propertyName, JSValue
 
 void setJSTreeWalkerCurrentNode(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    TreeWalker* imp = static_cast<TreeWalker*>(static_cast<JSTreeWalker*>(thisObject)->impl());
+    JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(thisObject);
+    TreeWalker* imp = static_cast<TreeWalker*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setCurrentNode(toNode(value), ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
index 3daf9e8dfc..b6f60a1f6e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
@@ -21,7 +21,6 @@
 #ifndef JSTreeWalker_h
 #define JSTreeWalker_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -80,7 +79,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSTreeWalkerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -98,13 +97,13 @@ JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionPreviousNode(JSC::ExecSt
 JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionNextNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsTreeWalkerRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsTreeWalkerWhatToShow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsTreeWalkerFilter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsTreeWalkerExpandEntityReferences(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsTreeWalkerCurrentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTreeWalkerRoot(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTreeWalkerWhatToShow(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTreeWalkerFilter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTreeWalkerExpandEntityReferences(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTreeWalkerCurrentNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTreeWalkerCurrentNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTreeWalkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTreeWalkerConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
index 1aa2963071..dbe9d3c005 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
@@ -38,16 +38,16 @@ ASSERT_CLASS_FITS_IN_CELL(JSUIEvent);
 
 static const HashTableValue JSUIEventTableValues[11] =
 {
-    { "view", DontDelete|ReadOnly, (intptr_t)jsUIEventView, (intptr_t)0 },
-    { "detail", DontDelete|ReadOnly, (intptr_t)jsUIEventDetail, (intptr_t)0 },
-    { "keyCode", DontDelete|ReadOnly, (intptr_t)jsUIEventKeyCode, (intptr_t)0 },
-    { "charCode", DontDelete|ReadOnly, (intptr_t)jsUIEventCharCode, (intptr_t)0 },
-    { "layerX", DontDelete|ReadOnly, (intptr_t)jsUIEventLayerX, (intptr_t)0 },
-    { "layerY", DontDelete|ReadOnly, (intptr_t)jsUIEventLayerY, (intptr_t)0 },
-    { "pageX", DontDelete|ReadOnly, (intptr_t)jsUIEventPageX, (intptr_t)0 },
-    { "pageY", DontDelete|ReadOnly, (intptr_t)jsUIEventPageY, (intptr_t)0 },
-    { "which", DontDelete|ReadOnly, (intptr_t)jsUIEventWhich, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsUIEventConstructor, (intptr_t)0 },
+    { "view", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsUIEventView), (intptr_t)0 },
+    { "detail", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsUIEventDetail), (intptr_t)0 },
+    { "keyCode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsUIEventKeyCode), (intptr_t)0 },
+    { "charCode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsUIEventCharCode), (intptr_t)0 },
+    { "layerX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsUIEventLayerX), (intptr_t)0 },
+    { "layerY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsUIEventLayerY), (intptr_t)0 },
+    { "pageX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsUIEventPageX), (intptr_t)0 },
+    { "pageY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsUIEventPageY), (intptr_t)0 },
+    { "which", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsUIEventWhich), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsUIEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -86,7 +86,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -109,7 +109,7 @@ bool JSUIEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ident
 
 static const HashTableValue JSUIEventPrototypeTableValues[2] =
 {
-    { "initUIEvent", DontDelete|Function, (intptr_t)jsUIEventPrototypeFunctionInitUIEvent, (intptr_t)5 },
+    { "initUIEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsUIEventPrototypeFunctionInitUIEvent), (intptr_t)5 },
     { 0, 0, 0, 0 }
 };
 
@@ -159,81 +159,90 @@ bool JSUIEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return getStaticValueDescriptor<JSUIEvent, Base>(exec, &JSUIEventTable, this, propertyName, descriptor);
 }
 
-JSValue jsUIEventView(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventView(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slot.slotBase()));
+    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->view()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->view()));
+    return result;
 }
 
-JSValue jsUIEventDetail(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventDetail(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slot.slotBase()));
+    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->detail());
+    JSValue result = jsNumber(exec, imp->detail());
+    return result;
 }
 
-JSValue jsUIEventKeyCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventKeyCode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slot.slotBase()));
+    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->keyCode());
+    JSValue result = jsNumber(exec, imp->keyCode());
+    return result;
 }
 
-JSValue jsUIEventCharCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventCharCode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slot.slotBase()));
+    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->charCode());
+    JSValue result = jsNumber(exec, imp->charCode());
+    return result;
 }
 
-JSValue jsUIEventLayerX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventLayerX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slot.slotBase()));
+    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->layerX());
+    JSValue result = jsNumber(exec, imp->layerX());
+    return result;
 }
 
-JSValue jsUIEventLayerY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventLayerY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slot.slotBase()));
+    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->layerY());
+    JSValue result = jsNumber(exec, imp->layerY());
+    return result;
 }
 
-JSValue jsUIEventPageX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventPageX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slot.slotBase()));
+    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->pageX());
+    JSValue result = jsNumber(exec, imp->pageX());
+    return result;
 }
 
-JSValue jsUIEventPageY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventPageY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slot.slotBase()));
+    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->pageY());
+    JSValue result = jsNumber(exec, imp->pageY());
+    return result;
 }
 
-JSValue jsUIEventWhich(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventWhich(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slot.slotBase()));
+    JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->which());
+    JSValue result = jsNumber(exec, imp->which());
+    return result;
 }
 
-JSValue jsUIEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSUIEvent* domObject = static_cast<JSUIEvent*>(asObject(slot.slotBase()));
+    JSUIEvent* domObject = static_cast<JSUIEvent*>(asObject(slotBase));
     return JSUIEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSUIEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
index 19f8ed280c..4b043872f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSUIEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -70,16 +70,16 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsUIEventPrototypeFunctionInitUIEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsUIEventView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsUIEventDetail(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsUIEventKeyCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsUIEventCharCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsUIEventLayerX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsUIEventLayerY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsUIEventPageX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsUIEventPageY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsUIEventWhich(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsUIEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventView(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsUIEventDetail(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsUIEventKeyCode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsUIEventCharCode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsUIEventLayerX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsUIEventLayerY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsUIEventPageX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsUIEventPageY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsUIEventWhich(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsUIEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSValidityState.cpp b/src/3rdparty/webkit/WebCore/generated/JSValidityState.cpp
index 7616c5805e..23c8dea6eb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSValidityState.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSValidityState.cpp
@@ -34,15 +34,15 @@ ASSERT_CLASS_FITS_IN_CELL(JSValidityState);
 
 static const HashTableValue JSValidityStateTableValues[10] =
 {
-    { "valueMissing", DontDelete|ReadOnly, (intptr_t)jsValidityStateValueMissing, (intptr_t)0 },
-    { "typeMismatch", DontDelete|ReadOnly, (intptr_t)jsValidityStateTypeMismatch, (intptr_t)0 },
-    { "patternMismatch", DontDelete|ReadOnly, (intptr_t)jsValidityStatePatternMismatch, (intptr_t)0 },
-    { "tooLong", DontDelete|ReadOnly, (intptr_t)jsValidityStateTooLong, (intptr_t)0 },
-    { "rangeUnderflow", DontDelete|ReadOnly, (intptr_t)jsValidityStateRangeUnderflow, (intptr_t)0 },
-    { "rangeOverflow", DontDelete|ReadOnly, (intptr_t)jsValidityStateRangeOverflow, (intptr_t)0 },
-    { "stepMismatch", DontDelete|ReadOnly, (intptr_t)jsValidityStateStepMismatch, (intptr_t)0 },
-    { "customError", DontDelete|ReadOnly, (intptr_t)jsValidityStateCustomError, (intptr_t)0 },
-    { "valid", DontDelete|ReadOnly, (intptr_t)jsValidityStateValid, (intptr_t)0 },
+    { "valueMissing", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsValidityStateValueMissing), (intptr_t)0 },
+    { "typeMismatch", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsValidityStateTypeMismatch), (intptr_t)0 },
+    { "patternMismatch", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsValidityStatePatternMismatch), (intptr_t)0 },
+    { "tooLong", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsValidityStateTooLong), (intptr_t)0 },
+    { "rangeUnderflow", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsValidityStateRangeUnderflow), (intptr_t)0 },
+    { "rangeOverflow", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsValidityStateRangeOverflow), (intptr_t)0 },
+    { "stepMismatch", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsValidityStateStepMismatch), (intptr_t)0 },
+    { "customError", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsValidityStateCustomError), (intptr_t)0 },
+    { "valid", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsValidityStateValid), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -102,76 +102,85 @@ bool JSValidityState::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSValidityState, Base>(exec, &JSValidityStateTable, this, propertyName, descriptor);
 }
 
-JSValue jsValidityStateValueMissing(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsValidityStateValueMissing(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slot.slotBase()));
+    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ValidityState* imp = static_cast<ValidityState*>(castedThis->impl());
-    return jsBoolean(imp->valueMissing());
+    JSValue result = jsBoolean(imp->valueMissing());
+    return result;
 }
 
-JSValue jsValidityStateTypeMismatch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsValidityStateTypeMismatch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slot.slotBase()));
+    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ValidityState* imp = static_cast<ValidityState*>(castedThis->impl());
-    return jsBoolean(imp->typeMismatch());
+    JSValue result = jsBoolean(imp->typeMismatch());
+    return result;
 }
 
-JSValue jsValidityStatePatternMismatch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsValidityStatePatternMismatch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slot.slotBase()));
+    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ValidityState* imp = static_cast<ValidityState*>(castedThis->impl());
-    return jsBoolean(imp->patternMismatch());
+    JSValue result = jsBoolean(imp->patternMismatch());
+    return result;
 }
 
-JSValue jsValidityStateTooLong(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsValidityStateTooLong(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slot.slotBase()));
+    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ValidityState* imp = static_cast<ValidityState*>(castedThis->impl());
-    return jsBoolean(imp->tooLong());
+    JSValue result = jsBoolean(imp->tooLong());
+    return result;
 }
 
-JSValue jsValidityStateRangeUnderflow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsValidityStateRangeUnderflow(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slot.slotBase()));
+    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ValidityState* imp = static_cast<ValidityState*>(castedThis->impl());
-    return jsBoolean(imp->rangeUnderflow());
+    JSValue result = jsBoolean(imp->rangeUnderflow());
+    return result;
 }
 
-JSValue jsValidityStateRangeOverflow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsValidityStateRangeOverflow(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slot.slotBase()));
+    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ValidityState* imp = static_cast<ValidityState*>(castedThis->impl());
-    return jsBoolean(imp->rangeOverflow());
+    JSValue result = jsBoolean(imp->rangeOverflow());
+    return result;
 }
 
-JSValue jsValidityStateStepMismatch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsValidityStateStepMismatch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slot.slotBase()));
+    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ValidityState* imp = static_cast<ValidityState*>(castedThis->impl());
-    return jsBoolean(imp->stepMismatch());
+    JSValue result = jsBoolean(imp->stepMismatch());
+    return result;
 }
 
-JSValue jsValidityStateCustomError(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsValidityStateCustomError(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slot.slotBase()));
+    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ValidityState* imp = static_cast<ValidityState*>(castedThis->impl());
-    return jsBoolean(imp->customError());
+    JSValue result = jsBoolean(imp->customError());
+    return result;
 }
 
-JSValue jsValidityStateValid(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsValidityStateValid(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slot.slotBase()));
+    JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ValidityState* imp = static_cast<ValidityState*>(castedThis->impl());
-    return jsBoolean(imp->valid());
+    JSValue result = jsBoolean(imp->valid());
+    return result;
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, ValidityState* object)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSValidityState.h b/src/3rdparty/webkit/WebCore/generated/JSValidityState.h
index ece04591f1..099ace2ecc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSValidityState.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSValidityState.h
@@ -21,7 +21,6 @@
 #ifndef JSValidityState_h
 #define JSValidityState_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     ValidityState* impl() const { return m_impl.get(); }
@@ -65,7 +64,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSValidityStatePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -74,15 +73,15 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsValidityStateValueMissing(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsValidityStateTypeMismatch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsValidityStatePatternMismatch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsValidityStateTooLong(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsValidityStateRangeUnderflow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsValidityStateRangeOverflow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsValidityStateStepMismatch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsValidityStateCustomError(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsValidityStateValid(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsValidityStateValueMissing(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsValidityStateTypeMismatch(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsValidityStatePatternMismatch(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsValidityStateTooLong(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsValidityStateRangeUnderflow(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsValidityStateRangeOverflow(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsValidityStateStepMismatch(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsValidityStateCustomError(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsValidityStateValid(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp
index 94ad1c5052..daa7a196ae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp
@@ -35,7 +35,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSVoidCallback);
 
 static const HashTableValue JSVoidCallbackPrototypeTableValues[2] =
 {
-    { "handleEvent", DontDelete|Function, (intptr_t)jsVoidCallbackPrototypeFunctionHandleEvent, (intptr_t)0 },
+    { "handleEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsVoidCallbackPrototypeFunctionHandleEvent), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
index da043af47f..63c069fd58 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
@@ -21,7 +21,6 @@
 #ifndef JSVoidCallback_h
 #define JSVoidCallback_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -41,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     VoidCallback* impl() const { return m_impl.get(); }
@@ -65,7 +64,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSVoidCallbackPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLActiveInfo.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLActiveInfo.cpp
new file mode 100644
index 0000000000..8b926729f4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLActiveInfo.cpp
@@ -0,0 +1,143 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLActiveInfo.h"
+
+#include "KURL.h"
+#include "WebGLActiveInfo.h"
+#include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLActiveInfo);
+
+/* Hash table */
+
+static const HashTableValue JSWebGLActiveInfoTableValues[4] =
+{
+    { "size", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLActiveInfoSize), (intptr_t)0 },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLActiveInfoType), (intptr_t)0 },
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLActiveInfoName), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLActiveInfoTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 3, JSWebGLActiveInfoTableValues, 0 };
+#else
+    { 8, 7, JSWebGLActiveInfoTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLActiveInfoPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLActiveInfoPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSWebGLActiveInfoPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSWebGLActiveInfoPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLActiveInfoPrototype::s_info = { "WebGLActiveInfoPrototype", 0, &JSWebGLActiveInfoPrototypeTable, 0 };
+
+JSObject* JSWebGLActiveInfoPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLActiveInfo>(exec, globalObject);
+}
+
+const ClassInfo JSWebGLActiveInfo::s_info = { "WebGLActiveInfo", 0, &JSWebGLActiveInfoTable, 0 };
+
+JSWebGLActiveInfo::JSWebGLActiveInfo(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLActiveInfo> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSWebGLActiveInfo::~JSWebGLActiveInfo()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSWebGLActiveInfo::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLActiveInfoPrototype(JSWebGLActiveInfoPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSWebGLActiveInfo::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSWebGLActiveInfo, Base>(exec, &JSWebGLActiveInfoTable, this, propertyName, slot);
+}
+
+bool JSWebGLActiveInfo::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebGLActiveInfo, Base>(exec, &JSWebGLActiveInfoTable, this, propertyName, descriptor);
+}
+
+JSValue jsWebGLActiveInfoSize(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWebGLActiveInfo* castedThis = static_cast<JSWebGLActiveInfo*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    WebGLActiveInfo* imp = static_cast<WebGLActiveInfo*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->size());
+    return result;
+}
+
+JSValue jsWebGLActiveInfoType(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWebGLActiveInfo* castedThis = static_cast<JSWebGLActiveInfo*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    WebGLActiveInfo* imp = static_cast<WebGLActiveInfo*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->type());
+    return result;
+}
+
+JSValue jsWebGLActiveInfoName(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWebGLActiveInfo* castedThis = static_cast<JSWebGLActiveInfo*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    WebGLActiveInfo* imp = static_cast<WebGLActiveInfo*>(castedThis->impl());
+    JSValue result = jsString(exec, imp->name());
+    return result;
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLActiveInfo* object)
+{
+    return getDOMObjectWrapper<JSWebGLActiveInfo>(exec, globalObject, object);
+}
+WebGLActiveInfo* toWebGLActiveInfo(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLActiveInfo::s_info) ? static_cast<JSWebGLActiveInfo*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLActiveInfo.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLActiveInfo.h
new file mode 100644
index 0000000000..235faf8a31
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLActiveInfo.h
@@ -0,0 +1,86 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebGLActiveInfo_h
+#define JSWebGLActiveInfo_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class WebGLActiveInfo;
+
+class JSWebGLActiveInfo : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSWebGLActiveInfo(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLActiveInfo>);
+    virtual ~JSWebGLActiveInfo();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    WebGLActiveInfo* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<WebGLActiveInfo> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLActiveInfo*);
+WebGLActiveInfo* toWebGLActiveInfo(JSC::JSValue);
+
+class JSWebGLActiveInfoPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSWebGLActiveInfoPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+// Attributes
+
+JSC::JSValue jsWebGLActiveInfoSize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLActiveInfoType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLActiveInfoName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLArray.cpp
new file mode 100644
index 0000000000..eeb506f6fc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLArray.cpp
@@ -0,0 +1,170 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArray.h"
+
+#include "JSWebGLArrayBuffer.h"
+#include "WebGLArray.h"
+#include "WebGLArrayBuffer.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLArray);
+
+/* Hash table */
+
+static const HashTableValue JSWebGLArrayTableValues[5] =
+{
+    { "buffer", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLArrayBuffer), (intptr_t)0 },
+    { "byteOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLArrayByteOffset), (intptr_t)0 },
+    { "byteLength", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLArrayByteLength), (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLArrayLength), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLArrayTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 7, JSWebGLArrayTableValues, 0 };
+#else
+    { 8, 7, JSWebGLArrayTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLArrayPrototypeTableValues[2] =
+{
+    { "slice", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLArrayPrototypeFunctionSlice), (intptr_t)2 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSWebGLArrayPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSWebGLArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLArrayPrototype::s_info = { "WebGLArrayPrototype", 0, &JSWebGLArrayPrototypeTable, 0 };
+
+JSObject* JSWebGLArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLArray>(exec, globalObject);
+}
+
+bool JSWebGLArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSWebGLArrayPrototypeTable, this, propertyName, slot);
+}
+
+bool JSWebGLArrayPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSWebGLArrayPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSWebGLArray::s_info = { "WebGLArray", 0, &JSWebGLArrayTable, 0 };
+
+JSWebGLArray::JSWebGLArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLArray> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSWebGLArray::~JSWebGLArray()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSWebGLArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLArrayPrototype(JSWebGLArrayPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSWebGLArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSWebGLArray, Base>(exec, &JSWebGLArrayTable, this, propertyName, slot);
+}
+
+bool JSWebGLArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebGLArray, Base>(exec, &JSWebGLArrayTable, this, propertyName, descriptor);
+}
+
+JSValue jsWebGLArrayBuffer(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWebGLArray* castedThis = static_cast<JSWebGLArray*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    WebGLArray* imp = static_cast<WebGLArray*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->buffer()));
+    return result;
+}
+
+JSValue jsWebGLArrayByteOffset(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWebGLArray* castedThis = static_cast<JSWebGLArray*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    WebGLArray* imp = static_cast<WebGLArray*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->byteOffset());
+    return result;
+}
+
+JSValue jsWebGLArrayByteLength(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWebGLArray* castedThis = static_cast<JSWebGLArray*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    WebGLArray* imp = static_cast<WebGLArray*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->byteLength());
+    return result;
+}
+
+JSValue jsWebGLArrayLength(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWebGLArray* castedThis = static_cast<JSWebGLArray*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    WebGLArray* imp = static_cast<WebGLArray*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLArrayPrototypeFunctionSlice(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLArray::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLArray* castedThisObj = static_cast<JSWebGLArray*>(asObject(thisValue));
+    return castedThisObj->slice(exec, args);
+}
+
+WebGLArray* toWebGLArray(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLArray::s_info) ? static_cast<JSWebGLArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLArray.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLArray.h
new file mode 100644
index 0000000000..59445e63dc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLArray.h
@@ -0,0 +1,95 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebGLArray_h
+#define JSWebGLArray_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class WebGLArray;
+
+class JSWebGLArray : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSWebGLArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLArray>);
+    virtual ~JSWebGLArray();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+
+    // Custom functions
+    JSC::JSValue slice(JSC::ExecState*, const JSC::ArgList&);
+    WebGLArray* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<WebGLArray> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLArray*);
+WebGLArray* toWebGLArray(JSC::JSValue);
+
+class JSWebGLArrayPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSWebGLArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsWebGLArrayPrototypeFunctionSlice(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsWebGLArrayBuffer(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLArrayByteOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLArrayByteLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLArrayLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLArrayBuffer.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLArrayBuffer.cpp
new file mode 100644
index 0000000000..f01dc704e3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLArrayBuffer.cpp
@@ -0,0 +1,121 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayBuffer.h"
+
+#include "WebGLArrayBuffer.h"
+#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLArrayBuffer);
+
+/* Hash table */
+
+static const HashTableValue JSWebGLArrayBufferTableValues[2] =
+{
+    { "byteLength", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLArrayBufferByteLength), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLArrayBufferTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSWebGLArrayBufferTableValues, 0 };
+#else
+    { 2, 1, JSWebGLArrayBufferTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLArrayBufferPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLArrayBufferPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSWebGLArrayBufferPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSWebGLArrayBufferPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLArrayBufferPrototype::s_info = { "WebGLArrayBufferPrototype", 0, &JSWebGLArrayBufferPrototypeTable, 0 };
+
+JSObject* JSWebGLArrayBufferPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLArrayBuffer>(exec, globalObject);
+}
+
+const ClassInfo JSWebGLArrayBuffer::s_info = { "WebGLArrayBuffer", 0, &JSWebGLArrayBufferTable, 0 };
+
+JSWebGLArrayBuffer::JSWebGLArrayBuffer(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLArrayBuffer> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSWebGLArrayBuffer::~JSWebGLArrayBuffer()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSWebGLArrayBuffer::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLArrayBufferPrototype(JSWebGLArrayBufferPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSWebGLArrayBuffer::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSWebGLArrayBuffer, Base>(exec, &JSWebGLArrayBufferTable, this, propertyName, slot);
+}
+
+bool JSWebGLArrayBuffer::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebGLArrayBuffer, Base>(exec, &JSWebGLArrayBufferTable, this, propertyName, descriptor);
+}
+
+JSValue jsWebGLArrayBufferByteLength(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWebGLArrayBuffer* castedThis = static_cast<JSWebGLArrayBuffer*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    WebGLArrayBuffer* imp = static_cast<WebGLArrayBuffer*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->byteLength());
+    return result;
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLArrayBuffer* object)
+{
+    return getDOMObjectWrapper<JSWebGLArrayBuffer>(exec, globalObject, object);
+}
+WebGLArrayBuffer* toWebGLArrayBuffer(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLArrayBuffer::s_info) ? static_cast<JSWebGLArrayBuffer*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLArrayBuffer.h
index eff168f944..82da9747dd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLArrayBuffer.h
@@ -18,25 +18,24 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef JSCanvasArrayBuffer_h
-#define JSCanvasArrayBuffer_h
+#ifndef JSWebGLArrayBuffer_h
+#define JSWebGLArrayBuffer_h
 
 #if ENABLE(3D_CANVAS)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
 namespace WebCore {
 
-class CanvasArrayBuffer;
+class WebGLArrayBuffer;
 
-class JSCanvasArrayBuffer : public DOMObjectWithGlobalPointer {
+class JSWebGLArrayBuffer : public DOMObjectWithGlobalPointer {
     typedef DOMObjectWithGlobalPointer Base;
 public:
-    JSCanvasArrayBuffer(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasArrayBuffer>);
-    virtual ~JSCanvasArrayBuffer();
+    JSWebGLArrayBuffer(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLArrayBuffer>);
+    virtual ~JSWebGLArrayBuffer();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -45,21 +44,21 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    CanvasArrayBuffer* impl() const { return m_impl.get(); }
+    WebGLArrayBuffer* impl() const { return m_impl.get(); }
 
 private:
-    RefPtr<CanvasArrayBuffer> m_impl;
+    RefPtr<WebGLArrayBuffer> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasArrayBuffer*);
-CanvasArrayBuffer* toCanvasArrayBuffer(JSC::JSValue);
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLArrayBuffer*);
+WebGLArrayBuffer* toWebGLArrayBuffer(JSC::JSValue);
 
-class JSCanvasArrayBufferPrototype : public JSC::JSObject {
+class JSWebGLArrayBufferPrototype : public JSC::JSObject {
     typedef JSC::JSObject Base;
 public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -67,16 +66,16 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
-    JSCanvasArrayBufferPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+    JSWebGLArrayBufferPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
     static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
 
-JSC::JSValue jsCanvasArrayBufferByteLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebGLArrayBufferByteLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLBuffer.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLBuffer.cpp
new file mode 100644
index 0000000000..ed15ad505a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLBuffer.cpp
@@ -0,0 +1,86 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLBuffer.h"
+
+#include "WebGLBuffer.h"
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLBuffer);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLBufferPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLBufferPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSWebGLBufferPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSWebGLBufferPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLBufferPrototype::s_info = { "WebGLBufferPrototype", 0, &JSWebGLBufferPrototypeTable, 0 };
+
+JSObject* JSWebGLBufferPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLBuffer>(exec, globalObject);
+}
+
+const ClassInfo JSWebGLBuffer::s_info = { "WebGLBuffer", 0, 0, 0 };
+
+JSWebGLBuffer::JSWebGLBuffer(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLBuffer> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSWebGLBuffer::~JSWebGLBuffer()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSWebGLBuffer::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLBufferPrototype(JSWebGLBufferPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLBuffer* object)
+{
+    return getDOMObjectWrapper<JSWebGLBuffer>(exec, globalObject, object);
+}
+WebGLBuffer* toWebGLBuffer(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLBuffer::s_info) ? static_cast<JSWebGLBuffer*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLBuffer.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLBuffer.h
new file mode 100644
index 0000000000..e1e673482b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLBuffer.h
@@ -0,0 +1,79 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebGLBuffer_h
+#define JSWebGLBuffer_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class WebGLBuffer;
+
+class JSWebGLBuffer : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSWebGLBuffer(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLBuffer>);
+    virtual ~JSWebGLBuffer();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    WebGLBuffer* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<WebGLBuffer> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLBuffer*);
+WebGLBuffer* toWebGLBuffer(JSC::JSValue);
+
+class JSWebGLBufferPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSWebGLBufferPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLByteArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLByteArray.cpp
new file mode 100644
index 0000000000..7522bc31f0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLByteArray.cpp
@@ -0,0 +1,174 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLByteArray.h"
+
+#include "WebGLByteArray.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLByteArray);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLByteArrayPrototypeTableValues[3] =
+{
+    { "get", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLByteArrayPrototypeFunctionGet), (intptr_t)1 },
+    { "set", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLByteArrayPrototypeFunctionSet), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLByteArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 3, JSWebGLByteArrayPrototypeTableValues, 0 };
+#else
+    { 4, 3, JSWebGLByteArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLByteArrayPrototype::s_info = { "WebGLByteArrayPrototype", 0, &JSWebGLByteArrayPrototypeTable, 0 };
+
+JSObject* JSWebGLByteArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLByteArray>(exec, globalObject);
+}
+
+bool JSWebGLByteArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSWebGLByteArrayPrototypeTable, this, propertyName, slot);
+}
+
+bool JSWebGLByteArrayPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSWebGLByteArrayPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSWebGLByteArray::s_info = { "WebGLByteArray", &JSWebGLArray::s_info, 0, 0 };
+
+JSWebGLByteArray::JSWebGLByteArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLByteArray> impl)
+    : JSWebGLArray(structure, globalObject, impl)
+{
+}
+
+JSObject* JSWebGLByteArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLByteArrayPrototype(JSWebGLByteArrayPrototype::createStructure(JSWebGLArrayPrototype::self(exec, globalObject)));
+}
+
+bool JSWebGLByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebGLByteArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, index));
+        return true;
+    }
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+bool JSWebGLByteArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebGLByteArray*>(impl())->length()) {
+        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
+        return true;
+    }
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+bool JSWebGLByteArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<WebGLByteArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, propertyName));
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+void JSWebGLByteArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok) {
+        indexSetter(exec, index, value);
+        return;
+    }
+    Base::put(exec, propertyName, value, slot);
+}
+
+void JSWebGLByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
+{
+    indexSetter(exec, propertyName, value);
+    return;
+}
+
+void JSWebGLByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    for (unsigned i = 0; i < static_cast<WebGLByteArray*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+JSValue JSC_HOST_CALL jsWebGLByteArrayPrototypeFunctionGet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLByteArray::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLByteArray* castedThisObj = static_cast<JSWebGLByteArray*>(asObject(thisValue));
+    WebGLByteArray* imp = static_cast<WebGLByteArray*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->get(index));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLByteArrayPrototypeFunctionSet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLByteArray::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLByteArray* castedThisObj = static_cast<JSWebGLByteArray*>(asObject(thisValue));
+    return castedThisObj->set(exec, args);
+}
+
+
+JSValue JSWebGLByteArray::getByIndex(ExecState* exec, unsigned index)
+{
+    return jsNumber(exec, static_cast<WebGLByteArray*>(impl())->item(index));
+}
+WebGLByteArray* toWebGLByteArray(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLByteArray::s_info) ? static_cast<JSWebGLByteArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLByteArray.h
index f4deadfc5e..324adce870 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLByteArray.h
@@ -18,22 +18,22 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef JSCanvasIntArray_h
-#define JSCanvasIntArray_h
+#ifndef JSWebGLByteArray_h
+#define JSWebGLByteArray_h
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasIntArray.h"
-#include "JSCanvasArray.h"
+#include "JSWebGLArray.h"
+#include "WebGLByteArray.h"
 
 namespace WebCore {
 
-class CanvasIntArray;
+class WebGLByteArray;
 
-class JSCanvasIntArray : public JSCanvasArray {
-    typedef JSCanvasArray Base;
+class JSWebGLByteArray : public JSWebGLArray {
+    typedef JSWebGLArray Base;
 public:
-    JSCanvasIntArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasIntArray>);
+    JSWebGLByteArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLByteArray>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -45,13 +45,16 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    CanvasIntArray* impl() const
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
+
+    // Custom functions
+    JSC::JSValue set(JSC::ExecState*, const JSC::ArgList&);
+    WebGLByteArray* impl() const
     {
-        return static_cast<CanvasIntArray*>(Base::impl());
+        return static_cast<WebGLByteArray*>(Base::impl());
     }
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
@@ -59,24 +62,30 @@ protected:
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasIntArray*);
-CanvasIntArray* toCanvasIntArray(JSC::JSValue);
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLByteArray*);
+WebGLByteArray* toWebGLByteArray(JSC::JSValue);
 
-class JSCanvasIntArrayPrototype : public JSC::JSObject {
+class JSWebGLByteArrayPrototype : public JSC::JSObject {
     typedef JSC::JSObject Base;
 public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
-    JSCanvasIntArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+    JSWebGLByteArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsWebGLByteArrayPrototypeFunctionGet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLByteArrayPrototypeFunctionSet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLContextAttributes.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLContextAttributes.cpp
new file mode 100644
index 0000000000..5d73dc8078
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLContextAttributes.cpp
@@ -0,0 +1,200 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLContextAttributes.h"
+
+#include "WebGLContextAttributes.h"
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLContextAttributes);
+
+/* Hash table */
+
+static const HashTableValue JSWebGLContextAttributesTableValues[6] =
+{
+    { "alpha", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLContextAttributesAlpha), (intptr_t)setJSWebGLContextAttributesAlpha },
+    { "depth", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLContextAttributesDepth), (intptr_t)setJSWebGLContextAttributesDepth },
+    { "stencil", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLContextAttributesStencil), (intptr_t)setJSWebGLContextAttributesStencil },
+    { "antialias", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLContextAttributesAntialias), (intptr_t)setJSWebGLContextAttributesAntialias },
+    { "premultipliedAlpha", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLContextAttributesPremultipliedAlpha), (intptr_t)setJSWebGLContextAttributesPremultipliedAlpha },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLContextAttributesTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 7, JSWebGLContextAttributesTableValues, 0 };
+#else
+    { 16, 15, JSWebGLContextAttributesTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLContextAttributesPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLContextAttributesPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSWebGLContextAttributesPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSWebGLContextAttributesPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLContextAttributesPrototype::s_info = { "WebGLContextAttributesPrototype", 0, &JSWebGLContextAttributesPrototypeTable, 0 };
+
+JSObject* JSWebGLContextAttributesPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLContextAttributes>(exec, globalObject);
+}
+
+const ClassInfo JSWebGLContextAttributes::s_info = { "WebGLContextAttributes", 0, &JSWebGLContextAttributesTable, 0 };
+
+JSWebGLContextAttributes::JSWebGLContextAttributes(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLContextAttributes> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSWebGLContextAttributes::~JSWebGLContextAttributes()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSWebGLContextAttributes::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLContextAttributesPrototype(JSWebGLContextAttributesPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSWebGLContextAttributes::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSWebGLContextAttributes, Base>(exec, &JSWebGLContextAttributesTable, this, propertyName, slot);
+}
+
+bool JSWebGLContextAttributes::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebGLContextAttributes, Base>(exec, &JSWebGLContextAttributesTable, this, propertyName, descriptor);
+}
+
+JSValue jsWebGLContextAttributesAlpha(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWebGLContextAttributes* castedThis = static_cast<JSWebGLContextAttributes*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    WebGLContextAttributes* imp = static_cast<WebGLContextAttributes*>(castedThis->impl());
+    JSValue result = jsBoolean(imp->alpha());
+    return result;
+}
+
+JSValue jsWebGLContextAttributesDepth(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWebGLContextAttributes* castedThis = static_cast<JSWebGLContextAttributes*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    WebGLContextAttributes* imp = static_cast<WebGLContextAttributes*>(castedThis->impl());
+    JSValue result = jsBoolean(imp->depth());
+    return result;
+}
+
+JSValue jsWebGLContextAttributesStencil(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWebGLContextAttributes* castedThis = static_cast<JSWebGLContextAttributes*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    WebGLContextAttributes* imp = static_cast<WebGLContextAttributes*>(castedThis->impl());
+    JSValue result = jsBoolean(imp->stencil());
+    return result;
+}
+
+JSValue jsWebGLContextAttributesAntialias(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWebGLContextAttributes* castedThis = static_cast<JSWebGLContextAttributes*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    WebGLContextAttributes* imp = static_cast<WebGLContextAttributes*>(castedThis->impl());
+    JSValue result = jsBoolean(imp->antialias());
+    return result;
+}
+
+JSValue jsWebGLContextAttributesPremultipliedAlpha(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWebGLContextAttributes* castedThis = static_cast<JSWebGLContextAttributes*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    WebGLContextAttributes* imp = static_cast<WebGLContextAttributes*>(castedThis->impl());
+    JSValue result = jsBoolean(imp->premultipliedAlpha());
+    return result;
+}
+
+void JSWebGLContextAttributes::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSWebGLContextAttributes, Base>(exec, propertyName, value, &JSWebGLContextAttributesTable, this, slot);
+}
+
+void setJSWebGLContextAttributesAlpha(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSWebGLContextAttributes* castedThisObj = static_cast<JSWebGLContextAttributes*>(thisObject);
+    WebGLContextAttributes* imp = static_cast<WebGLContextAttributes*>(castedThisObj->impl());
+    imp->setAlpha(value.toBoolean(exec));
+}
+
+void setJSWebGLContextAttributesDepth(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSWebGLContextAttributes* castedThisObj = static_cast<JSWebGLContextAttributes*>(thisObject);
+    WebGLContextAttributes* imp = static_cast<WebGLContextAttributes*>(castedThisObj->impl());
+    imp->setDepth(value.toBoolean(exec));
+}
+
+void setJSWebGLContextAttributesStencil(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSWebGLContextAttributes* castedThisObj = static_cast<JSWebGLContextAttributes*>(thisObject);
+    WebGLContextAttributes* imp = static_cast<WebGLContextAttributes*>(castedThisObj->impl());
+    imp->setStencil(value.toBoolean(exec));
+}
+
+void setJSWebGLContextAttributesAntialias(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSWebGLContextAttributes* castedThisObj = static_cast<JSWebGLContextAttributes*>(thisObject);
+    WebGLContextAttributes* imp = static_cast<WebGLContextAttributes*>(castedThisObj->impl());
+    imp->setAntialias(value.toBoolean(exec));
+}
+
+void setJSWebGLContextAttributesPremultipliedAlpha(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSWebGLContextAttributes* castedThisObj = static_cast<JSWebGLContextAttributes*>(thisObject);
+    WebGLContextAttributes* imp = static_cast<WebGLContextAttributes*>(castedThisObj->impl());
+    imp->setPremultipliedAlpha(value.toBoolean(exec));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLContextAttributes* object)
+{
+    return getDOMObjectWrapper<JSWebGLContextAttributes>(exec, globalObject, object);
+}
+WebGLContextAttributes* toWebGLContextAttributes(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLContextAttributes::s_info) ? static_cast<JSWebGLContextAttributes*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLContextAttributes.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLContextAttributes.h
new file mode 100644
index 0000000000..8875b5f92d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLContextAttributes.h
@@ -0,0 +1,94 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebGLContextAttributes_h
+#define JSWebGLContextAttributes_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class WebGLContextAttributes;
+
+class JSWebGLContextAttributes : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSWebGLContextAttributes(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLContextAttributes>);
+    virtual ~JSWebGLContextAttributes();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    WebGLContextAttributes* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<WebGLContextAttributes> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLContextAttributes*);
+WebGLContextAttributes* toWebGLContextAttributes(JSC::JSValue);
+
+class JSWebGLContextAttributesPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSWebGLContextAttributesPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+// Attributes
+
+JSC::JSValue jsWebGLContextAttributesAlpha(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSWebGLContextAttributesAlpha(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebGLContextAttributesDepth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSWebGLContextAttributesDepth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebGLContextAttributesStencil(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSWebGLContextAttributesStencil(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebGLContextAttributesAntialias(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSWebGLContextAttributesAntialias(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebGLContextAttributesPremultipliedAlpha(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSWebGLContextAttributesPremultipliedAlpha(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLFloatArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLFloatArray.cpp
new file mode 100644
index 0000000000..4ef8db50d9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLFloatArray.cpp
@@ -0,0 +1,174 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLFloatArray.h"
+
+#include "WebGLFloatArray.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLFloatArray);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLFloatArrayPrototypeTableValues[3] =
+{
+    { "get", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLFloatArrayPrototypeFunctionGet), (intptr_t)1 },
+    { "set", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLFloatArrayPrototypeFunctionSet), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLFloatArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 3, JSWebGLFloatArrayPrototypeTableValues, 0 };
+#else
+    { 4, 3, JSWebGLFloatArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLFloatArrayPrototype::s_info = { "WebGLFloatArrayPrototype", 0, &JSWebGLFloatArrayPrototypeTable, 0 };
+
+JSObject* JSWebGLFloatArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLFloatArray>(exec, globalObject);
+}
+
+bool JSWebGLFloatArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSWebGLFloatArrayPrototypeTable, this, propertyName, slot);
+}
+
+bool JSWebGLFloatArrayPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSWebGLFloatArrayPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSWebGLFloatArray::s_info = { "WebGLFloatArray", &JSWebGLArray::s_info, 0, 0 };
+
+JSWebGLFloatArray::JSWebGLFloatArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLFloatArray> impl)
+    : JSWebGLArray(structure, globalObject, impl)
+{
+}
+
+JSObject* JSWebGLFloatArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLFloatArrayPrototype(JSWebGLFloatArrayPrototype::createStructure(JSWebGLArrayPrototype::self(exec, globalObject)));
+}
+
+bool JSWebGLFloatArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebGLFloatArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, index));
+        return true;
+    }
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+bool JSWebGLFloatArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebGLFloatArray*>(impl())->length()) {
+        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
+        return true;
+    }
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+bool JSWebGLFloatArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<WebGLFloatArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, propertyName));
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+void JSWebGLFloatArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok) {
+        indexSetter(exec, index, value);
+        return;
+    }
+    Base::put(exec, propertyName, value, slot);
+}
+
+void JSWebGLFloatArray::put(ExecState* exec, unsigned propertyName, JSValue value)
+{
+    indexSetter(exec, propertyName, value);
+    return;
+}
+
+void JSWebGLFloatArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    for (unsigned i = 0; i < static_cast<WebGLFloatArray*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+JSValue JSC_HOST_CALL jsWebGLFloatArrayPrototypeFunctionGet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLFloatArray::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLFloatArray* castedThisObj = static_cast<JSWebGLFloatArray*>(asObject(thisValue));
+    WebGLFloatArray* imp = static_cast<WebGLFloatArray*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->get(index));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLFloatArrayPrototypeFunctionSet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLFloatArray::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLFloatArray* castedThisObj = static_cast<JSWebGLFloatArray*>(asObject(thisValue));
+    return castedThisObj->set(exec, args);
+}
+
+
+JSValue JSWebGLFloatArray::getByIndex(ExecState* exec, unsigned index)
+{
+    return jsNumber(exec, static_cast<WebGLFloatArray*>(impl())->item(index));
+}
+WebGLFloatArray* toWebGLFloatArray(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLFloatArray::s_info) ? static_cast<JSWebGLFloatArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLFloatArray.h
index c76c67954b..24eff641ad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLFloatArray.h
@@ -18,22 +18,22 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef JSCanvasByteArray_h
-#define JSCanvasByteArray_h
+#ifndef JSWebGLFloatArray_h
+#define JSWebGLFloatArray_h
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasByteArray.h"
-#include "JSCanvasArray.h"
+#include "JSWebGLArray.h"
+#include "WebGLFloatArray.h"
 
 namespace WebCore {
 
-class CanvasByteArray;
+class WebGLFloatArray;
 
-class JSCanvasByteArray : public JSCanvasArray {
-    typedef JSCanvasArray Base;
+class JSWebGLFloatArray : public JSWebGLArray {
+    typedef JSWebGLArray Base;
 public:
-    JSCanvasByteArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasByteArray>);
+    JSWebGLFloatArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLFloatArray>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -45,13 +45,16 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    CanvasByteArray* impl() const
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
+
+    // Custom functions
+    JSC::JSValue set(JSC::ExecState*, const JSC::ArgList&);
+    WebGLFloatArray* impl() const
     {
-        return static_cast<CanvasByteArray*>(Base::impl());
+        return static_cast<WebGLFloatArray*>(Base::impl());
     }
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
@@ -59,24 +62,30 @@ protected:
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasByteArray*);
-CanvasByteArray* toCanvasByteArray(JSC::JSValue);
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLFloatArray*);
+WebGLFloatArray* toWebGLFloatArray(JSC::JSValue);
 
-class JSCanvasByteArrayPrototype : public JSC::JSObject {
+class JSWebGLFloatArrayPrototype : public JSC::JSObject {
     typedef JSC::JSObject Base;
 public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
-    JSCanvasByteArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+    JSWebGLFloatArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsWebGLFloatArrayPrototypeFunctionGet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLFloatArrayPrototypeFunctionSet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLFramebuffer.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLFramebuffer.cpp
new file mode 100644
index 0000000000..ac1eaa103d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLFramebuffer.cpp
@@ -0,0 +1,86 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLFramebuffer.h"
+
+#include "WebGLFramebuffer.h"
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLFramebuffer);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLFramebufferPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLFramebufferPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSWebGLFramebufferPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSWebGLFramebufferPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLFramebufferPrototype::s_info = { "WebGLFramebufferPrototype", 0, &JSWebGLFramebufferPrototypeTable, 0 };
+
+JSObject* JSWebGLFramebufferPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLFramebuffer>(exec, globalObject);
+}
+
+const ClassInfo JSWebGLFramebuffer::s_info = { "WebGLFramebuffer", 0, 0, 0 };
+
+JSWebGLFramebuffer::JSWebGLFramebuffer(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLFramebuffer> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSWebGLFramebuffer::~JSWebGLFramebuffer()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSWebGLFramebuffer::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLFramebufferPrototype(JSWebGLFramebufferPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLFramebuffer* object)
+{
+    return getDOMObjectWrapper<JSWebGLFramebuffer>(exec, globalObject, object);
+}
+WebGLFramebuffer* toWebGLFramebuffer(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLFramebuffer::s_info) ? static_cast<JSWebGLFramebuffer*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLFramebuffer.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLFramebuffer.h
new file mode 100644
index 0000000000..eee1353017
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLFramebuffer.h
@@ -0,0 +1,79 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebGLFramebuffer_h
+#define JSWebGLFramebuffer_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class WebGLFramebuffer;
+
+class JSWebGLFramebuffer : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSWebGLFramebuffer(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLFramebuffer>);
+    virtual ~JSWebGLFramebuffer();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    WebGLFramebuffer* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<WebGLFramebuffer> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLFramebuffer*);
+WebGLFramebuffer* toWebGLFramebuffer(JSC::JSValue);
+
+class JSWebGLFramebufferPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSWebGLFramebufferPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLIntArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLIntArray.cpp
new file mode 100644
index 0000000000..1705369260
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLIntArray.cpp
@@ -0,0 +1,174 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLIntArray.h"
+
+#include "WebGLIntArray.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLIntArray);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLIntArrayPrototypeTableValues[3] =
+{
+    { "get", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLIntArrayPrototypeFunctionGet), (intptr_t)1 },
+    { "set", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLIntArrayPrototypeFunctionSet), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLIntArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 3, JSWebGLIntArrayPrototypeTableValues, 0 };
+#else
+    { 4, 3, JSWebGLIntArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLIntArrayPrototype::s_info = { "WebGLIntArrayPrototype", 0, &JSWebGLIntArrayPrototypeTable, 0 };
+
+JSObject* JSWebGLIntArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLIntArray>(exec, globalObject);
+}
+
+bool JSWebGLIntArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSWebGLIntArrayPrototypeTable, this, propertyName, slot);
+}
+
+bool JSWebGLIntArrayPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSWebGLIntArrayPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSWebGLIntArray::s_info = { "WebGLIntArray", &JSWebGLArray::s_info, 0, 0 };
+
+JSWebGLIntArray::JSWebGLIntArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLIntArray> impl)
+    : JSWebGLArray(structure, globalObject, impl)
+{
+}
+
+JSObject* JSWebGLIntArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLIntArrayPrototype(JSWebGLIntArrayPrototype::createStructure(JSWebGLArrayPrototype::self(exec, globalObject)));
+}
+
+bool JSWebGLIntArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebGLIntArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, index));
+        return true;
+    }
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+bool JSWebGLIntArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebGLIntArray*>(impl())->length()) {
+        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
+        return true;
+    }
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+bool JSWebGLIntArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<WebGLIntArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, propertyName));
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+void JSWebGLIntArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok) {
+        indexSetter(exec, index, value);
+        return;
+    }
+    Base::put(exec, propertyName, value, slot);
+}
+
+void JSWebGLIntArray::put(ExecState* exec, unsigned propertyName, JSValue value)
+{
+    indexSetter(exec, propertyName, value);
+    return;
+}
+
+void JSWebGLIntArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    for (unsigned i = 0; i < static_cast<WebGLIntArray*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+JSValue JSC_HOST_CALL jsWebGLIntArrayPrototypeFunctionGet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLIntArray::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLIntArray* castedThisObj = static_cast<JSWebGLIntArray*>(asObject(thisValue));
+    WebGLIntArray* imp = static_cast<WebGLIntArray*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->get(index));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLIntArrayPrototypeFunctionSet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLIntArray::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLIntArray* castedThisObj = static_cast<JSWebGLIntArray*>(asObject(thisValue));
+    return castedThisObj->set(exec, args);
+}
+
+
+JSValue JSWebGLIntArray::getByIndex(ExecState* exec, unsigned index)
+{
+    return jsNumber(exec, static_cast<WebGLIntArray*>(impl())->item(index));
+}
+WebGLIntArray* toWebGLIntArray(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLIntArray::s_info) ? static_cast<JSWebGLIntArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLIntArray.h
index c53c7efa54..30a7e0ef20 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLIntArray.h
@@ -18,22 +18,22 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef JSCanvasUnsignedIntArray_h
-#define JSCanvasUnsignedIntArray_h
+#ifndef JSWebGLIntArray_h
+#define JSWebGLIntArray_h
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasUnsignedIntArray.h"
-#include "JSCanvasArray.h"
+#include "JSWebGLArray.h"
+#include "WebGLIntArray.h"
 
 namespace WebCore {
 
-class CanvasUnsignedIntArray;
+class WebGLIntArray;
 
-class JSCanvasUnsignedIntArray : public JSCanvasArray {
-    typedef JSCanvasArray Base;
+class JSWebGLIntArray : public JSWebGLArray {
+    typedef JSWebGLArray Base;
 public:
-    JSCanvasUnsignedIntArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasUnsignedIntArray>);
+    JSWebGLIntArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLIntArray>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -45,13 +45,16 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    CanvasUnsignedIntArray* impl() const
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
+
+    // Custom functions
+    JSC::JSValue set(JSC::ExecState*, const JSC::ArgList&);
+    WebGLIntArray* impl() const
     {
-        return static_cast<CanvasUnsignedIntArray*>(Base::impl());
+        return static_cast<WebGLIntArray*>(Base::impl());
     }
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
@@ -59,24 +62,30 @@ protected:
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasUnsignedIntArray*);
-CanvasUnsignedIntArray* toCanvasUnsignedIntArray(JSC::JSValue);
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLIntArray*);
+WebGLIntArray* toWebGLIntArray(JSC::JSValue);
 
-class JSCanvasUnsignedIntArrayPrototype : public JSC::JSObject {
+class JSWebGLIntArrayPrototype : public JSC::JSObject {
     typedef JSC::JSObject Base;
 public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
-    JSCanvasUnsignedIntArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+    JSWebGLIntArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsWebGLIntArrayPrototypeFunctionGet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLIntArrayPrototypeFunctionSet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLProgram.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLProgram.cpp
new file mode 100644
index 0000000000..c827e18141
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLProgram.cpp
@@ -0,0 +1,86 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLProgram.h"
+
+#include "WebGLProgram.h"
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLProgram);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLProgramPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLProgramPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSWebGLProgramPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSWebGLProgramPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLProgramPrototype::s_info = { "WebGLProgramPrototype", 0, &JSWebGLProgramPrototypeTable, 0 };
+
+JSObject* JSWebGLProgramPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLProgram>(exec, globalObject);
+}
+
+const ClassInfo JSWebGLProgram::s_info = { "WebGLProgram", 0, 0, 0 };
+
+JSWebGLProgram::JSWebGLProgram(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLProgram> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSWebGLProgram::~JSWebGLProgram()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSWebGLProgram::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLProgramPrototype(JSWebGLProgramPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLProgram* object)
+{
+    return getDOMObjectWrapper<JSWebGLProgram>(exec, globalObject, object);
+}
+WebGLProgram* toWebGLProgram(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLProgram::s_info) ? static_cast<JSWebGLProgram*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLProgram.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLProgram.h
new file mode 100644
index 0000000000..80bb41c913
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLProgram.h
@@ -0,0 +1,79 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebGLProgram_h
+#define JSWebGLProgram_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class WebGLProgram;
+
+class JSWebGLProgram : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSWebGLProgram(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLProgram>);
+    virtual ~JSWebGLProgram();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    WebGLProgram* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<WebGLProgram> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLProgram*);
+WebGLProgram* toWebGLProgram(JSC::JSValue);
+
+class JSWebGLProgramPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSWebGLProgramPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLRenderbuffer.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLRenderbuffer.cpp
new file mode 100644
index 0000000000..e7dbd08872
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLRenderbuffer.cpp
@@ -0,0 +1,86 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLRenderbuffer.h"
+
+#include "WebGLRenderbuffer.h"
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLRenderbuffer);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLRenderbufferPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLRenderbufferPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSWebGLRenderbufferPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSWebGLRenderbufferPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLRenderbufferPrototype::s_info = { "WebGLRenderbufferPrototype", 0, &JSWebGLRenderbufferPrototypeTable, 0 };
+
+JSObject* JSWebGLRenderbufferPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLRenderbuffer>(exec, globalObject);
+}
+
+const ClassInfo JSWebGLRenderbuffer::s_info = { "WebGLRenderbuffer", 0, 0, 0 };
+
+JSWebGLRenderbuffer::JSWebGLRenderbuffer(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLRenderbuffer> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSWebGLRenderbuffer::~JSWebGLRenderbuffer()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSWebGLRenderbuffer::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLRenderbufferPrototype(JSWebGLRenderbufferPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLRenderbuffer* object)
+{
+    return getDOMObjectWrapper<JSWebGLRenderbuffer>(exec, globalObject, object);
+}
+WebGLRenderbuffer* toWebGLRenderbuffer(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLRenderbuffer::s_info) ? static_cast<JSWebGLRenderbuffer*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLRenderbuffer.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLRenderbuffer.h
new file mode 100644
index 0000000000..af37739bdd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLRenderbuffer.h
@@ -0,0 +1,79 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebGLRenderbuffer_h
+#define JSWebGLRenderbuffer_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class WebGLRenderbuffer;
+
+class JSWebGLRenderbuffer : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSWebGLRenderbuffer(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLRenderbuffer>);
+    virtual ~JSWebGLRenderbuffer();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    WebGLRenderbuffer* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<WebGLRenderbuffer> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLRenderbuffer*);
+WebGLRenderbuffer* toWebGLRenderbuffer(JSC::JSValue);
+
+class JSWebGLRenderbufferPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSWebGLRenderbufferPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLRenderingContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLRenderingContext.cpp
new file mode 100644
index 0000000000..dd8efdd539
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLRenderingContext.cpp
@@ -0,0 +1,4252 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLRenderingContext.h"
+
+#include "JSWebGLActiveInfo.h"
+#include "JSWebGLArray.h"
+#include "JSWebGLBuffer.h"
+#include "JSWebGLContextAttributes.h"
+#include "JSWebGLFramebuffer.h"
+#include "JSWebGLProgram.h"
+#include "JSWebGLRenderbuffer.h"
+#include "JSWebGLShader.h"
+#include "JSWebGLTexture.h"
+#include "JSWebGLUniformLocation.h"
+#include "KURL.h"
+#include "WebGLActiveInfo.h"
+#include "WebGLArray.h"
+#include "WebGLBuffer.h"
+#include "WebGLContextAttributes.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLRenderingContext.h"
+#include "WebGLShader.h"
+#include "WebGLTexture.h"
+#include "WebGLUniformLocation.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLRenderingContext);
+
+/* Hash table */
+
+static const HashTableValue JSWebGLRenderingContextTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLRenderingContextTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSWebGLRenderingContextTableValues, 0 };
+#else
+    { 2, 1, JSWebGLRenderingContextTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSWebGLRenderingContextConstructorTableValues[303] =
+{
+    { "DEPTH_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_BUFFER_BIT), (intptr_t)0 },
+    { "STENCIL_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BUFFER_BIT), (intptr_t)0 },
+    { "COLOR_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCOLOR_BUFFER_BIT), (intptr_t)0 },
+    { "FALSE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFALSE), (intptr_t)0 },
+    { "TRUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTRUE), (intptr_t)0 },
+    { "POINTS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextPOINTS), (intptr_t)0 },
+    { "LINES", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINES), (intptr_t)0 },
+    { "LINE_LOOP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINE_LOOP), (intptr_t)0 },
+    { "LINE_STRIP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINE_STRIP), (intptr_t)0 },
+    { "TRIANGLES", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTRIANGLES), (intptr_t)0 },
+    { "TRIANGLE_STRIP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTRIANGLE_STRIP), (intptr_t)0 },
+    { "TRIANGLE_FAN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTRIANGLE_FAN), (intptr_t)0 },
+    { "ZERO", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextZERO), (intptr_t)0 },
+    { "ONE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextONE), (intptr_t)0 },
+    { "SRC_COLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSRC_COLOR), (intptr_t)0 },
+    { "ONE_MINUS_SRC_COLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextONE_MINUS_SRC_COLOR), (intptr_t)0 },
+    { "SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSRC_ALPHA), (intptr_t)0 },
+    { "ONE_MINUS_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextONE_MINUS_SRC_ALPHA), (intptr_t)0 },
+    { "DST_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDST_ALPHA), (intptr_t)0 },
+    { "ONE_MINUS_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextONE_MINUS_DST_ALPHA), (intptr_t)0 },
+    { "DST_COLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDST_COLOR), (intptr_t)0 },
+    { "ONE_MINUS_DST_COLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextONE_MINUS_DST_COLOR), (intptr_t)0 },
+    { "SRC_ALPHA_SATURATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSRC_ALPHA_SATURATE), (intptr_t)0 },
+    { "FUNC_ADD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFUNC_ADD), (intptr_t)0 },
+    { "BLEND_EQUATION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_EQUATION), (intptr_t)0 },
+    { "BLEND_EQUATION_RGB", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_EQUATION_RGB), (intptr_t)0 },
+    { "BLEND_EQUATION_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_EQUATION_ALPHA), (intptr_t)0 },
+    { "FUNC_SUBTRACT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFUNC_SUBTRACT), (intptr_t)0 },
+    { "FUNC_REVERSE_SUBTRACT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFUNC_REVERSE_SUBTRACT), (intptr_t)0 },
+    { "BLEND_DST_RGB", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_DST_RGB), (intptr_t)0 },
+    { "BLEND_SRC_RGB", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_SRC_RGB), (intptr_t)0 },
+    { "BLEND_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_DST_ALPHA), (intptr_t)0 },
+    { "BLEND_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_SRC_ALPHA), (intptr_t)0 },
+    { "CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCONSTANT_COLOR), (intptr_t)0 },
+    { "ONE_MINUS_CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextONE_MINUS_CONSTANT_COLOR), (intptr_t)0 },
+    { "CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCONSTANT_ALPHA), (intptr_t)0 },
+    { "ONE_MINUS_CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextONE_MINUS_CONSTANT_ALPHA), (intptr_t)0 },
+    { "BLEND_COLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_COLOR), (intptr_t)0 },
+    { "ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextARRAY_BUFFER), (intptr_t)0 },
+    { "ELEMENT_ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextELEMENT_ARRAY_BUFFER), (intptr_t)0 },
+    { "ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextARRAY_BUFFER_BINDING), (intptr_t)0 },
+    { "ELEMENT_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextELEMENT_ARRAY_BUFFER_BINDING), (intptr_t)0 },
+    { "STREAM_DRAW", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTREAM_DRAW), (intptr_t)0 },
+    { "STATIC_DRAW", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTATIC_DRAW), (intptr_t)0 },
+    { "DYNAMIC_DRAW", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDYNAMIC_DRAW), (intptr_t)0 },
+    { "BUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBUFFER_SIZE), (intptr_t)0 },
+    { "BUFFER_USAGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBUFFER_USAGE), (intptr_t)0 },
+    { "CURRENT_VERTEX_ATTRIB", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCURRENT_VERTEX_ATTRIB), (intptr_t)0 },
+    { "FRONT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRONT), (intptr_t)0 },
+    { "BACK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBACK), (intptr_t)0 },
+    { "FRONT_AND_BACK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRONT_AND_BACK), (intptr_t)0 },
+    { "TEXTURE_2D", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_2D), (intptr_t)0 },
+    { "CULL_FACE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCULL_FACE), (intptr_t)0 },
+    { "BLEND", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND), (intptr_t)0 },
+    { "DITHER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDITHER), (intptr_t)0 },
+    { "STENCIL_TEST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_TEST), (intptr_t)0 },
+    { "DEPTH_TEST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_TEST), (intptr_t)0 },
+    { "SCISSOR_TEST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSCISSOR_TEST), (intptr_t)0 },
+    { "POLYGON_OFFSET_FILL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextPOLYGON_OFFSET_FILL), (intptr_t)0 },
+    { "SAMPLE_ALPHA_TO_COVERAGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLE_ALPHA_TO_COVERAGE), (intptr_t)0 },
+    { "SAMPLE_COVERAGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLE_COVERAGE), (intptr_t)0 },
+    { "NO_ERROR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNO_ERROR), (intptr_t)0 },
+    { "INVALID_ENUM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINVALID_ENUM), (intptr_t)0 },
+    { "INVALID_VALUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINVALID_VALUE), (intptr_t)0 },
+    { "INVALID_OPERATION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINVALID_OPERATION), (intptr_t)0 },
+    { "OUT_OF_MEMORY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextOUT_OF_MEMORY), (intptr_t)0 },
+    { "CW", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCW), (intptr_t)0 },
+    { "CCW", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCCW), (intptr_t)0 },
+    { "LINE_WIDTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINE_WIDTH), (intptr_t)0 },
+    { "ALIASED_POINT_SIZE_RANGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextALIASED_POINT_SIZE_RANGE), (intptr_t)0 },
+    { "ALIASED_LINE_WIDTH_RANGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextALIASED_LINE_WIDTH_RANGE), (intptr_t)0 },
+    { "CULL_FACE_MODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCULL_FACE_MODE), (intptr_t)0 },
+    { "FRONT_FACE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRONT_FACE), (intptr_t)0 },
+    { "DEPTH_RANGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_RANGE), (intptr_t)0 },
+    { "DEPTH_WRITEMASK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_WRITEMASK), (intptr_t)0 },
+    { "DEPTH_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_CLEAR_VALUE), (intptr_t)0 },
+    { "DEPTH_FUNC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_FUNC), (intptr_t)0 },
+    { "STENCIL_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_CLEAR_VALUE), (intptr_t)0 },
+    { "STENCIL_FUNC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_FUNC), (intptr_t)0 },
+    { "STENCIL_FAIL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_FAIL), (intptr_t)0 },
+    { "STENCIL_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_PASS_DEPTH_FAIL), (intptr_t)0 },
+    { "STENCIL_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_PASS_DEPTH_PASS), (intptr_t)0 },
+    { "STENCIL_REF", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_REF), (intptr_t)0 },
+    { "STENCIL_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_VALUE_MASK), (intptr_t)0 },
+    { "STENCIL_WRITEMASK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_WRITEMASK), (intptr_t)0 },
+    { "STENCIL_BACK_FUNC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BACK_FUNC), (intptr_t)0 },
+    { "STENCIL_BACK_FAIL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BACK_FAIL), (intptr_t)0 },
+    { "STENCIL_BACK_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BACK_PASS_DEPTH_FAIL), (intptr_t)0 },
+    { "STENCIL_BACK_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BACK_PASS_DEPTH_PASS), (intptr_t)0 },
+    { "STENCIL_BACK_REF", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BACK_REF), (intptr_t)0 },
+    { "STENCIL_BACK_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BACK_VALUE_MASK), (intptr_t)0 },
+    { "STENCIL_BACK_WRITEMASK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BACK_WRITEMASK), (intptr_t)0 },
+    { "VIEWPORT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVIEWPORT), (intptr_t)0 },
+    { "SCISSOR_BOX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSCISSOR_BOX), (intptr_t)0 },
+    { "COLOR_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCOLOR_CLEAR_VALUE), (intptr_t)0 },
+    { "COLOR_WRITEMASK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCOLOR_WRITEMASK), (intptr_t)0 },
+    { "UNPACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextUNPACK_ALIGNMENT), (intptr_t)0 },
+    { "PACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextPACK_ALIGNMENT), (intptr_t)0 },
+    { "MAX_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_TEXTURE_SIZE), (intptr_t)0 },
+    { "MAX_VIEWPORT_DIMS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_VIEWPORT_DIMS), (intptr_t)0 },
+    { "SUBPIXEL_BITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSUBPIXEL_BITS), (intptr_t)0 },
+    { "RED_BITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRED_BITS), (intptr_t)0 },
+    { "GREEN_BITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextGREEN_BITS), (intptr_t)0 },
+    { "BLUE_BITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLUE_BITS), (intptr_t)0 },
+    { "ALPHA_BITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextALPHA_BITS), (intptr_t)0 },
+    { "DEPTH_BITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_BITS), (intptr_t)0 },
+    { "STENCIL_BITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BITS), (intptr_t)0 },
+    { "POLYGON_OFFSET_UNITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextPOLYGON_OFFSET_UNITS), (intptr_t)0 },
+    { "POLYGON_OFFSET_FACTOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextPOLYGON_OFFSET_FACTOR), (intptr_t)0 },
+    { "TEXTURE_BINDING_2D", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_BINDING_2D), (intptr_t)0 },
+    { "SAMPLE_BUFFERS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLE_BUFFERS), (intptr_t)0 },
+    { "SAMPLES", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLES), (intptr_t)0 },
+    { "SAMPLE_COVERAGE_VALUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLE_COVERAGE_VALUE), (intptr_t)0 },
+    { "SAMPLE_COVERAGE_INVERT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLE_COVERAGE_INVERT), (intptr_t)0 },
+    { "NUM_COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNUM_COMPRESSED_TEXTURE_FORMATS), (intptr_t)0 },
+    { "COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCOMPRESSED_TEXTURE_FORMATS), (intptr_t)0 },
+    { "DONT_CARE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDONT_CARE), (intptr_t)0 },
+    { "FASTEST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFASTEST), (intptr_t)0 },
+    { "NICEST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNICEST), (intptr_t)0 },
+    { "GENERATE_MIPMAP_HINT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextGENERATE_MIPMAP_HINT), (intptr_t)0 },
+    { "BYTE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBYTE), (intptr_t)0 },
+    { "UNSIGNED_BYTE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextUNSIGNED_BYTE), (intptr_t)0 },
+    { "SHORT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSHORT), (intptr_t)0 },
+    { "UNSIGNED_SHORT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextUNSIGNED_SHORT), (intptr_t)0 },
+    { "INT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINT), (intptr_t)0 },
+    { "UNSIGNED_INT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextUNSIGNED_INT), (intptr_t)0 },
+    { "FLOAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFLOAT), (intptr_t)0 },
+    { "FIXED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFIXED), (intptr_t)0 },
+    { "DEPTH_COMPONENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_COMPONENT), (intptr_t)0 },
+    { "ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextALPHA), (intptr_t)0 },
+    { "RGB", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRGB), (intptr_t)0 },
+    { "RGBA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRGBA), (intptr_t)0 },
+    { "LUMINANCE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLUMINANCE), (intptr_t)0 },
+    { "LUMINANCE_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLUMINANCE_ALPHA), (intptr_t)0 },
+    { "UNSIGNED_SHORT_4_4_4_4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextUNSIGNED_SHORT_4_4_4_4), (intptr_t)0 },
+    { "UNSIGNED_SHORT_5_5_5_1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextUNSIGNED_SHORT_5_5_5_1), (intptr_t)0 },
+    { "UNSIGNED_SHORT_5_6_5", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextUNSIGNED_SHORT_5_6_5), (intptr_t)0 },
+    { "FRAGMENT_SHADER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAGMENT_SHADER), (intptr_t)0 },
+    { "VERTEX_SHADER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_SHADER), (intptr_t)0 },
+    { "MAX_VERTEX_ATTRIBS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_VERTEX_ATTRIBS), (intptr_t)0 },
+    { "MAX_VERTEX_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_VERTEX_UNIFORM_VECTORS), (intptr_t)0 },
+    { "MAX_VARYING_VECTORS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_VARYING_VECTORS), (intptr_t)0 },
+    { "MAX_COMBINED_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_COMBINED_TEXTURE_IMAGE_UNITS), (intptr_t)0 },
+    { "MAX_VERTEX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_VERTEX_TEXTURE_IMAGE_UNITS), (intptr_t)0 },
+    { "MAX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_TEXTURE_IMAGE_UNITS), (intptr_t)0 },
+    { "MAX_FRAGMENT_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_FRAGMENT_UNIFORM_VECTORS), (intptr_t)0 },
+    { "SHADER_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSHADER_TYPE), (intptr_t)0 },
+    { "DELETE_STATUS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDELETE_STATUS), (intptr_t)0 },
+    { "LINK_STATUS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINK_STATUS), (intptr_t)0 },
+    { "VALIDATE_STATUS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVALIDATE_STATUS), (intptr_t)0 },
+    { "ATTACHED_SHADERS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextATTACHED_SHADERS), (intptr_t)0 },
+    { "ACTIVE_UNIFORMS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextACTIVE_UNIFORMS), (intptr_t)0 },
+    { "ACTIVE_UNIFORM_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextACTIVE_UNIFORM_MAX_LENGTH), (intptr_t)0 },
+    { "ACTIVE_ATTRIBUTES", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextACTIVE_ATTRIBUTES), (intptr_t)0 },
+    { "ACTIVE_ATTRIBUTE_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextACTIVE_ATTRIBUTE_MAX_LENGTH), (intptr_t)0 },
+    { "SHADING_LANGUAGE_VERSION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSHADING_LANGUAGE_VERSION), (intptr_t)0 },
+    { "CURRENT_PROGRAM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCURRENT_PROGRAM), (intptr_t)0 },
+    { "NEVER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNEVER), (intptr_t)0 },
+    { "LESS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLESS), (intptr_t)0 },
+    { "EQUAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextEQUAL), (intptr_t)0 },
+    { "LEQUAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLEQUAL), (intptr_t)0 },
+    { "GREATER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextGREATER), (intptr_t)0 },
+    { "NOTEQUAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNOTEQUAL), (intptr_t)0 },
+    { "GEQUAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextGEQUAL), (intptr_t)0 },
+    { "ALWAYS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextALWAYS), (intptr_t)0 },
+    { "KEEP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextKEEP), (intptr_t)0 },
+    { "REPLACE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextREPLACE), (intptr_t)0 },
+    { "INCR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINCR), (intptr_t)0 },
+    { "DECR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDECR), (intptr_t)0 },
+    { "INVERT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINVERT), (intptr_t)0 },
+    { "INCR_WRAP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINCR_WRAP), (intptr_t)0 },
+    { "DECR_WRAP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDECR_WRAP), (intptr_t)0 },
+    { "VENDOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVENDOR), (intptr_t)0 },
+    { "RENDERER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERER), (intptr_t)0 },
+    { "VERSION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERSION), (intptr_t)0 },
+    { "EXTENSIONS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextEXTENSIONS), (intptr_t)0 },
+    { "NEAREST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNEAREST), (intptr_t)0 },
+    { "LINEAR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINEAR), (intptr_t)0 },
+    { "NEAREST_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNEAREST_MIPMAP_NEAREST), (intptr_t)0 },
+    { "LINEAR_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINEAR_MIPMAP_NEAREST), (intptr_t)0 },
+    { "NEAREST_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNEAREST_MIPMAP_LINEAR), (intptr_t)0 },
+    { "LINEAR_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINEAR_MIPMAP_LINEAR), (intptr_t)0 },
+    { "TEXTURE_MAG_FILTER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_MAG_FILTER), (intptr_t)0 },
+    { "TEXTURE_MIN_FILTER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_MIN_FILTER), (intptr_t)0 },
+    { "TEXTURE_WRAP_S", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_WRAP_S), (intptr_t)0 },
+    { "TEXTURE_WRAP_T", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_WRAP_T), (intptr_t)0 },
+    { "TEXTURE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE), (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_CUBE_MAP), (intptr_t)0 },
+    { "TEXTURE_BINDING_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_BINDING_CUBE_MAP), (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_POSITIVE_X", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_CUBE_MAP_POSITIVE_X), (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_NEGATIVE_X", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_CUBE_MAP_NEGATIVE_X), (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_POSITIVE_Y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_CUBE_MAP_POSITIVE_Y), (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_NEGATIVE_Y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_CUBE_MAP_NEGATIVE_Y), (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_POSITIVE_Z", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_CUBE_MAP_POSITIVE_Z), (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_NEGATIVE_Z", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_CUBE_MAP_NEGATIVE_Z), (intptr_t)0 },
+    { "MAX_CUBE_MAP_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_CUBE_MAP_TEXTURE_SIZE), (intptr_t)0 },
+    { "TEXTURE0", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE0), (intptr_t)0 },
+    { "TEXTURE1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE1), (intptr_t)0 },
+    { "TEXTURE2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE2), (intptr_t)0 },
+    { "TEXTURE3", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE3), (intptr_t)0 },
+    { "TEXTURE4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE4), (intptr_t)0 },
+    { "TEXTURE5", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE5), (intptr_t)0 },
+    { "TEXTURE6", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE6), (intptr_t)0 },
+    { "TEXTURE7", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE7), (intptr_t)0 },
+    { "TEXTURE8", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE8), (intptr_t)0 },
+    { "TEXTURE9", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE9), (intptr_t)0 },
+    { "TEXTURE10", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE10), (intptr_t)0 },
+    { "TEXTURE11", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE11), (intptr_t)0 },
+    { "TEXTURE12", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE12), (intptr_t)0 },
+    { "TEXTURE13", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE13), (intptr_t)0 },
+    { "TEXTURE14", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE14), (intptr_t)0 },
+    { "TEXTURE15", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE15), (intptr_t)0 },
+    { "TEXTURE16", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE16), (intptr_t)0 },
+    { "TEXTURE17", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE17), (intptr_t)0 },
+    { "TEXTURE18", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE18), (intptr_t)0 },
+    { "TEXTURE19", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE19), (intptr_t)0 },
+    { "TEXTURE20", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE20), (intptr_t)0 },
+    { "TEXTURE21", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE21), (intptr_t)0 },
+    { "TEXTURE22", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE22), (intptr_t)0 },
+    { "TEXTURE23", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE23), (intptr_t)0 },
+    { "TEXTURE24", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE24), (intptr_t)0 },
+    { "TEXTURE25", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE25), (intptr_t)0 },
+    { "TEXTURE26", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE26), (intptr_t)0 },
+    { "TEXTURE27", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE27), (intptr_t)0 },
+    { "TEXTURE28", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE28), (intptr_t)0 },
+    { "TEXTURE29", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE29), (intptr_t)0 },
+    { "TEXTURE30", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE30), (intptr_t)0 },
+    { "TEXTURE31", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE31), (intptr_t)0 },
+    { "ACTIVE_TEXTURE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextACTIVE_TEXTURE), (intptr_t)0 },
+    { "REPEAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextREPEAT), (intptr_t)0 },
+    { "CLAMP_TO_EDGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCLAMP_TO_EDGE), (intptr_t)0 },
+    { "MIRRORED_REPEAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMIRRORED_REPEAT), (intptr_t)0 },
+    { "FLOAT_VEC2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFLOAT_VEC2), (intptr_t)0 },
+    { "FLOAT_VEC3", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFLOAT_VEC3), (intptr_t)0 },
+    { "FLOAT_VEC4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFLOAT_VEC4), (intptr_t)0 },
+    { "INT_VEC2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINT_VEC2), (intptr_t)0 },
+    { "INT_VEC3", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINT_VEC3), (intptr_t)0 },
+    { "INT_VEC4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINT_VEC4), (intptr_t)0 },
+    { "BOOL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBOOL), (intptr_t)0 },
+    { "BOOL_VEC2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBOOL_VEC2), (intptr_t)0 },
+    { "BOOL_VEC3", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBOOL_VEC3), (intptr_t)0 },
+    { "BOOL_VEC4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBOOL_VEC4), (intptr_t)0 },
+    { "FLOAT_MAT2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFLOAT_MAT2), (intptr_t)0 },
+    { "FLOAT_MAT3", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFLOAT_MAT3), (intptr_t)0 },
+    { "FLOAT_MAT4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFLOAT_MAT4), (intptr_t)0 },
+    { "SAMPLER_2D", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLER_2D), (intptr_t)0 },
+    { "SAMPLER_CUBE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLER_CUBE), (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_ENABLED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_ENABLED), (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_SIZE), (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_STRIDE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_STRIDE), (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_TYPE), (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_NORMALIZED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_NORMALIZED), (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_POINTER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_POINTER), (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_BUFFER_BINDING), (intptr_t)0 },
+    { "IMPLEMENTATION_COLOR_READ_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextIMPLEMENTATION_COLOR_READ_TYPE), (intptr_t)0 },
+    { "IMPLEMENTATION_COLOR_READ_FORMAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextIMPLEMENTATION_COLOR_READ_FORMAT), (intptr_t)0 },
+    { "COMPILE_STATUS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCOMPILE_STATUS), (intptr_t)0 },
+    { "INFO_LOG_LENGTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINFO_LOG_LENGTH), (intptr_t)0 },
+    { "SHADER_SOURCE_LENGTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSHADER_SOURCE_LENGTH), (intptr_t)0 },
+    { "SHADER_COMPILER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSHADER_COMPILER), (intptr_t)0 },
+    { "SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSHADER_BINARY_FORMATS), (intptr_t)0 },
+    { "NUM_SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNUM_SHADER_BINARY_FORMATS), (intptr_t)0 },
+    { "LOW_FLOAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLOW_FLOAT), (intptr_t)0 },
+    { "MEDIUM_FLOAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMEDIUM_FLOAT), (intptr_t)0 },
+    { "HIGH_FLOAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextHIGH_FLOAT), (intptr_t)0 },
+    { "LOW_INT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLOW_INT), (intptr_t)0 },
+    { "MEDIUM_INT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMEDIUM_INT), (intptr_t)0 },
+    { "HIGH_INT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextHIGH_INT), (intptr_t)0 },
+    { "FRAMEBUFFER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER), (intptr_t)0 },
+    { "RENDERBUFFER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER), (intptr_t)0 },
+    { "RGBA4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRGBA4), (intptr_t)0 },
+    { "RGB5_A1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRGB5_A1), (intptr_t)0 },
+    { "RGB565", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRGB565), (intptr_t)0 },
+    { "DEPTH_COMPONENT16", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_COMPONENT16), (intptr_t)0 },
+    { "STENCIL_INDEX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_INDEX), (intptr_t)0 },
+    { "STENCIL_INDEX8", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_INDEX8), (intptr_t)0 },
+    { "RENDERBUFFER_WIDTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_WIDTH), (intptr_t)0 },
+    { "RENDERBUFFER_HEIGHT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_HEIGHT), (intptr_t)0 },
+    { "RENDERBUFFER_INTERNAL_FORMAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_INTERNAL_FORMAT), (intptr_t)0 },
+    { "RENDERBUFFER_RED_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_RED_SIZE), (intptr_t)0 },
+    { "RENDERBUFFER_GREEN_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_GREEN_SIZE), (intptr_t)0 },
+    { "RENDERBUFFER_BLUE_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_BLUE_SIZE), (intptr_t)0 },
+    { "RENDERBUFFER_ALPHA_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_ALPHA_SIZE), (intptr_t)0 },
+    { "RENDERBUFFER_DEPTH_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_DEPTH_SIZE), (intptr_t)0 },
+    { "RENDERBUFFER_STENCIL_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_STENCIL_SIZE), (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE), (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_OBJECT_NAME", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_OBJECT_NAME), (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL), (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE), (intptr_t)0 },
+    { "COLOR_ATTACHMENT0", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCOLOR_ATTACHMENT0), (intptr_t)0 },
+    { "DEPTH_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_ATTACHMENT), (intptr_t)0 },
+    { "STENCIL_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_ATTACHMENT), (intptr_t)0 },
+    { "NONE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNONE), (intptr_t)0 },
+    { "FRAMEBUFFER_COMPLETE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_COMPLETE), (intptr_t)0 },
+    { "FRAMEBUFFER_INCOMPLETE_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_INCOMPLETE_ATTACHMENT), (intptr_t)0 },
+    { "FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT), (intptr_t)0 },
+    { "FRAMEBUFFER_INCOMPLETE_DIMENSIONS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_INCOMPLETE_DIMENSIONS), (intptr_t)0 },
+    { "FRAMEBUFFER_UNSUPPORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_UNSUPPORTED), (intptr_t)0 },
+    { "FRAMEBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_BINDING), (intptr_t)0 },
+    { "RENDERBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_BINDING), (intptr_t)0 },
+    { "MAX_RENDERBUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_RENDERBUFFER_SIZE), (intptr_t)0 },
+    { "INVALID_FRAMEBUFFER_OPERATION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINVALID_FRAMEBUFFER_OPERATION), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLRenderingContextConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 32767, JSWebGLRenderingContextConstructorTableValues, 0 };
+#else
+    { 1063, 1023, JSWebGLRenderingContextConstructorTableValues, 0 };
+#endif
+
+class JSWebGLRenderingContextConstructor : public DOMConstructorObject {
+public:
+    JSWebGLRenderingContextConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSWebGLRenderingContextConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSWebGLRenderingContextPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSWebGLRenderingContextConstructor::s_info = { "WebGLRenderingContextConstructor", 0, &JSWebGLRenderingContextConstructorTable, 0 };
+
+bool JSWebGLRenderingContextConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSWebGLRenderingContextConstructor, DOMObject>(exec, &JSWebGLRenderingContextConstructorTable, this, propertyName, slot);
+}
+
+bool JSWebGLRenderingContextConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebGLRenderingContextConstructor, DOMObject>(exec, &JSWebGLRenderingContextConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLRenderingContextPrototypeTableValues[435] =
+{
+    { "DEPTH_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_BUFFER_BIT), (intptr_t)0 },
+    { "STENCIL_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BUFFER_BIT), (intptr_t)0 },
+    { "COLOR_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCOLOR_BUFFER_BIT), (intptr_t)0 },
+    { "FALSE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFALSE), (intptr_t)0 },
+    { "TRUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTRUE), (intptr_t)0 },
+    { "POINTS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextPOINTS), (intptr_t)0 },
+    { "LINES", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINES), (intptr_t)0 },
+    { "LINE_LOOP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINE_LOOP), (intptr_t)0 },
+    { "LINE_STRIP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINE_STRIP), (intptr_t)0 },
+    { "TRIANGLES", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTRIANGLES), (intptr_t)0 },
+    { "TRIANGLE_STRIP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTRIANGLE_STRIP), (intptr_t)0 },
+    { "TRIANGLE_FAN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTRIANGLE_FAN), (intptr_t)0 },
+    { "ZERO", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextZERO), (intptr_t)0 },
+    { "ONE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextONE), (intptr_t)0 },
+    { "SRC_COLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSRC_COLOR), (intptr_t)0 },
+    { "ONE_MINUS_SRC_COLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextONE_MINUS_SRC_COLOR), (intptr_t)0 },
+    { "SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSRC_ALPHA), (intptr_t)0 },
+    { "ONE_MINUS_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextONE_MINUS_SRC_ALPHA), (intptr_t)0 },
+    { "DST_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDST_ALPHA), (intptr_t)0 },
+    { "ONE_MINUS_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextONE_MINUS_DST_ALPHA), (intptr_t)0 },
+    { "DST_COLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDST_COLOR), (intptr_t)0 },
+    { "ONE_MINUS_DST_COLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextONE_MINUS_DST_COLOR), (intptr_t)0 },
+    { "SRC_ALPHA_SATURATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSRC_ALPHA_SATURATE), (intptr_t)0 },
+    { "FUNC_ADD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFUNC_ADD), (intptr_t)0 },
+    { "BLEND_EQUATION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_EQUATION), (intptr_t)0 },
+    { "BLEND_EQUATION_RGB", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_EQUATION_RGB), (intptr_t)0 },
+    { "BLEND_EQUATION_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_EQUATION_ALPHA), (intptr_t)0 },
+    { "FUNC_SUBTRACT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFUNC_SUBTRACT), (intptr_t)0 },
+    { "FUNC_REVERSE_SUBTRACT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFUNC_REVERSE_SUBTRACT), (intptr_t)0 },
+    { "BLEND_DST_RGB", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_DST_RGB), (intptr_t)0 },
+    { "BLEND_SRC_RGB", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_SRC_RGB), (intptr_t)0 },
+    { "BLEND_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_DST_ALPHA), (intptr_t)0 },
+    { "BLEND_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_SRC_ALPHA), (intptr_t)0 },
+    { "CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCONSTANT_COLOR), (intptr_t)0 },
+    { "ONE_MINUS_CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextONE_MINUS_CONSTANT_COLOR), (intptr_t)0 },
+    { "CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCONSTANT_ALPHA), (intptr_t)0 },
+    { "ONE_MINUS_CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextONE_MINUS_CONSTANT_ALPHA), (intptr_t)0 },
+    { "BLEND_COLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND_COLOR), (intptr_t)0 },
+    { "ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextARRAY_BUFFER), (intptr_t)0 },
+    { "ELEMENT_ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextELEMENT_ARRAY_BUFFER), (intptr_t)0 },
+    { "ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextARRAY_BUFFER_BINDING), (intptr_t)0 },
+    { "ELEMENT_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextELEMENT_ARRAY_BUFFER_BINDING), (intptr_t)0 },
+    { "STREAM_DRAW", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTREAM_DRAW), (intptr_t)0 },
+    { "STATIC_DRAW", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTATIC_DRAW), (intptr_t)0 },
+    { "DYNAMIC_DRAW", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDYNAMIC_DRAW), (intptr_t)0 },
+    { "BUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBUFFER_SIZE), (intptr_t)0 },
+    { "BUFFER_USAGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBUFFER_USAGE), (intptr_t)0 },
+    { "CURRENT_VERTEX_ATTRIB", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCURRENT_VERTEX_ATTRIB), (intptr_t)0 },
+    { "FRONT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRONT), (intptr_t)0 },
+    { "BACK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBACK), (intptr_t)0 },
+    { "FRONT_AND_BACK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRONT_AND_BACK), (intptr_t)0 },
+    { "TEXTURE_2D", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_2D), (intptr_t)0 },
+    { "CULL_FACE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCULL_FACE), (intptr_t)0 },
+    { "BLEND", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLEND), (intptr_t)0 },
+    { "DITHER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDITHER), (intptr_t)0 },
+    { "STENCIL_TEST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_TEST), (intptr_t)0 },
+    { "DEPTH_TEST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_TEST), (intptr_t)0 },
+    { "SCISSOR_TEST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSCISSOR_TEST), (intptr_t)0 },
+    { "POLYGON_OFFSET_FILL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextPOLYGON_OFFSET_FILL), (intptr_t)0 },
+    { "SAMPLE_ALPHA_TO_COVERAGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLE_ALPHA_TO_COVERAGE), (intptr_t)0 },
+    { "SAMPLE_COVERAGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLE_COVERAGE), (intptr_t)0 },
+    { "NO_ERROR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNO_ERROR), (intptr_t)0 },
+    { "INVALID_ENUM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINVALID_ENUM), (intptr_t)0 },
+    { "INVALID_VALUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINVALID_VALUE), (intptr_t)0 },
+    { "INVALID_OPERATION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINVALID_OPERATION), (intptr_t)0 },
+    { "OUT_OF_MEMORY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextOUT_OF_MEMORY), (intptr_t)0 },
+    { "CW", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCW), (intptr_t)0 },
+    { "CCW", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCCW), (intptr_t)0 },
+    { "LINE_WIDTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINE_WIDTH), (intptr_t)0 },
+    { "ALIASED_POINT_SIZE_RANGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextALIASED_POINT_SIZE_RANGE), (intptr_t)0 },
+    { "ALIASED_LINE_WIDTH_RANGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextALIASED_LINE_WIDTH_RANGE), (intptr_t)0 },
+    { "CULL_FACE_MODE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCULL_FACE_MODE), (intptr_t)0 },
+    { "FRONT_FACE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRONT_FACE), (intptr_t)0 },
+    { "DEPTH_RANGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_RANGE), (intptr_t)0 },
+    { "DEPTH_WRITEMASK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_WRITEMASK), (intptr_t)0 },
+    { "DEPTH_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_CLEAR_VALUE), (intptr_t)0 },
+    { "DEPTH_FUNC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_FUNC), (intptr_t)0 },
+    { "STENCIL_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_CLEAR_VALUE), (intptr_t)0 },
+    { "STENCIL_FUNC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_FUNC), (intptr_t)0 },
+    { "STENCIL_FAIL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_FAIL), (intptr_t)0 },
+    { "STENCIL_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_PASS_DEPTH_FAIL), (intptr_t)0 },
+    { "STENCIL_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_PASS_DEPTH_PASS), (intptr_t)0 },
+    { "STENCIL_REF", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_REF), (intptr_t)0 },
+    { "STENCIL_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_VALUE_MASK), (intptr_t)0 },
+    { "STENCIL_WRITEMASK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_WRITEMASK), (intptr_t)0 },
+    { "STENCIL_BACK_FUNC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BACK_FUNC), (intptr_t)0 },
+    { "STENCIL_BACK_FAIL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BACK_FAIL), (intptr_t)0 },
+    { "STENCIL_BACK_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BACK_PASS_DEPTH_FAIL), (intptr_t)0 },
+    { "STENCIL_BACK_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BACK_PASS_DEPTH_PASS), (intptr_t)0 },
+    { "STENCIL_BACK_REF", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BACK_REF), (intptr_t)0 },
+    { "STENCIL_BACK_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BACK_VALUE_MASK), (intptr_t)0 },
+    { "STENCIL_BACK_WRITEMASK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BACK_WRITEMASK), (intptr_t)0 },
+    { "VIEWPORT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVIEWPORT), (intptr_t)0 },
+    { "SCISSOR_BOX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSCISSOR_BOX), (intptr_t)0 },
+    { "COLOR_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCOLOR_CLEAR_VALUE), (intptr_t)0 },
+    { "COLOR_WRITEMASK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCOLOR_WRITEMASK), (intptr_t)0 },
+    { "UNPACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextUNPACK_ALIGNMENT), (intptr_t)0 },
+    { "PACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextPACK_ALIGNMENT), (intptr_t)0 },
+    { "MAX_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_TEXTURE_SIZE), (intptr_t)0 },
+    { "MAX_VIEWPORT_DIMS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_VIEWPORT_DIMS), (intptr_t)0 },
+    { "SUBPIXEL_BITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSUBPIXEL_BITS), (intptr_t)0 },
+    { "RED_BITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRED_BITS), (intptr_t)0 },
+    { "GREEN_BITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextGREEN_BITS), (intptr_t)0 },
+    { "BLUE_BITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBLUE_BITS), (intptr_t)0 },
+    { "ALPHA_BITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextALPHA_BITS), (intptr_t)0 },
+    { "DEPTH_BITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_BITS), (intptr_t)0 },
+    { "STENCIL_BITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_BITS), (intptr_t)0 },
+    { "POLYGON_OFFSET_UNITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextPOLYGON_OFFSET_UNITS), (intptr_t)0 },
+    { "POLYGON_OFFSET_FACTOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextPOLYGON_OFFSET_FACTOR), (intptr_t)0 },
+    { "TEXTURE_BINDING_2D", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_BINDING_2D), (intptr_t)0 },
+    { "SAMPLE_BUFFERS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLE_BUFFERS), (intptr_t)0 },
+    { "SAMPLES", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLES), (intptr_t)0 },
+    { "SAMPLE_COVERAGE_VALUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLE_COVERAGE_VALUE), (intptr_t)0 },
+    { "SAMPLE_COVERAGE_INVERT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLE_COVERAGE_INVERT), (intptr_t)0 },
+    { "NUM_COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNUM_COMPRESSED_TEXTURE_FORMATS), (intptr_t)0 },
+    { "COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCOMPRESSED_TEXTURE_FORMATS), (intptr_t)0 },
+    { "DONT_CARE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDONT_CARE), (intptr_t)0 },
+    { "FASTEST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFASTEST), (intptr_t)0 },
+    { "NICEST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNICEST), (intptr_t)0 },
+    { "GENERATE_MIPMAP_HINT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextGENERATE_MIPMAP_HINT), (intptr_t)0 },
+    { "BYTE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBYTE), (intptr_t)0 },
+    { "UNSIGNED_BYTE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextUNSIGNED_BYTE), (intptr_t)0 },
+    { "SHORT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSHORT), (intptr_t)0 },
+    { "UNSIGNED_SHORT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextUNSIGNED_SHORT), (intptr_t)0 },
+    { "INT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINT), (intptr_t)0 },
+    { "UNSIGNED_INT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextUNSIGNED_INT), (intptr_t)0 },
+    { "FLOAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFLOAT), (intptr_t)0 },
+    { "FIXED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFIXED), (intptr_t)0 },
+    { "DEPTH_COMPONENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_COMPONENT), (intptr_t)0 },
+    { "ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextALPHA), (intptr_t)0 },
+    { "RGB", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRGB), (intptr_t)0 },
+    { "RGBA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRGBA), (intptr_t)0 },
+    { "LUMINANCE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLUMINANCE), (intptr_t)0 },
+    { "LUMINANCE_ALPHA", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLUMINANCE_ALPHA), (intptr_t)0 },
+    { "UNSIGNED_SHORT_4_4_4_4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextUNSIGNED_SHORT_4_4_4_4), (intptr_t)0 },
+    { "UNSIGNED_SHORT_5_5_5_1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextUNSIGNED_SHORT_5_5_5_1), (intptr_t)0 },
+    { "UNSIGNED_SHORT_5_6_5", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextUNSIGNED_SHORT_5_6_5), (intptr_t)0 },
+    { "FRAGMENT_SHADER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAGMENT_SHADER), (intptr_t)0 },
+    { "VERTEX_SHADER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_SHADER), (intptr_t)0 },
+    { "MAX_VERTEX_ATTRIBS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_VERTEX_ATTRIBS), (intptr_t)0 },
+    { "MAX_VERTEX_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_VERTEX_UNIFORM_VECTORS), (intptr_t)0 },
+    { "MAX_VARYING_VECTORS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_VARYING_VECTORS), (intptr_t)0 },
+    { "MAX_COMBINED_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_COMBINED_TEXTURE_IMAGE_UNITS), (intptr_t)0 },
+    { "MAX_VERTEX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_VERTEX_TEXTURE_IMAGE_UNITS), (intptr_t)0 },
+    { "MAX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_TEXTURE_IMAGE_UNITS), (intptr_t)0 },
+    { "MAX_FRAGMENT_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_FRAGMENT_UNIFORM_VECTORS), (intptr_t)0 },
+    { "SHADER_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSHADER_TYPE), (intptr_t)0 },
+    { "DELETE_STATUS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDELETE_STATUS), (intptr_t)0 },
+    { "LINK_STATUS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINK_STATUS), (intptr_t)0 },
+    { "VALIDATE_STATUS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVALIDATE_STATUS), (intptr_t)0 },
+    { "ATTACHED_SHADERS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextATTACHED_SHADERS), (intptr_t)0 },
+    { "ACTIVE_UNIFORMS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextACTIVE_UNIFORMS), (intptr_t)0 },
+    { "ACTIVE_UNIFORM_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextACTIVE_UNIFORM_MAX_LENGTH), (intptr_t)0 },
+    { "ACTIVE_ATTRIBUTES", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextACTIVE_ATTRIBUTES), (intptr_t)0 },
+    { "ACTIVE_ATTRIBUTE_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextACTIVE_ATTRIBUTE_MAX_LENGTH), (intptr_t)0 },
+    { "SHADING_LANGUAGE_VERSION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSHADING_LANGUAGE_VERSION), (intptr_t)0 },
+    { "CURRENT_PROGRAM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCURRENT_PROGRAM), (intptr_t)0 },
+    { "NEVER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNEVER), (intptr_t)0 },
+    { "LESS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLESS), (intptr_t)0 },
+    { "EQUAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextEQUAL), (intptr_t)0 },
+    { "LEQUAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLEQUAL), (intptr_t)0 },
+    { "GREATER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextGREATER), (intptr_t)0 },
+    { "NOTEQUAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNOTEQUAL), (intptr_t)0 },
+    { "GEQUAL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextGEQUAL), (intptr_t)0 },
+    { "ALWAYS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextALWAYS), (intptr_t)0 },
+    { "KEEP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextKEEP), (intptr_t)0 },
+    { "REPLACE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextREPLACE), (intptr_t)0 },
+    { "INCR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINCR), (intptr_t)0 },
+    { "DECR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDECR), (intptr_t)0 },
+    { "INVERT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINVERT), (intptr_t)0 },
+    { "INCR_WRAP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINCR_WRAP), (intptr_t)0 },
+    { "DECR_WRAP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDECR_WRAP), (intptr_t)0 },
+    { "VENDOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVENDOR), (intptr_t)0 },
+    { "RENDERER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERER), (intptr_t)0 },
+    { "VERSION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERSION), (intptr_t)0 },
+    { "EXTENSIONS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextEXTENSIONS), (intptr_t)0 },
+    { "NEAREST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNEAREST), (intptr_t)0 },
+    { "LINEAR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINEAR), (intptr_t)0 },
+    { "NEAREST_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNEAREST_MIPMAP_NEAREST), (intptr_t)0 },
+    { "LINEAR_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINEAR_MIPMAP_NEAREST), (intptr_t)0 },
+    { "NEAREST_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNEAREST_MIPMAP_LINEAR), (intptr_t)0 },
+    { "LINEAR_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLINEAR_MIPMAP_LINEAR), (intptr_t)0 },
+    { "TEXTURE_MAG_FILTER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_MAG_FILTER), (intptr_t)0 },
+    { "TEXTURE_MIN_FILTER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_MIN_FILTER), (intptr_t)0 },
+    { "TEXTURE_WRAP_S", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_WRAP_S), (intptr_t)0 },
+    { "TEXTURE_WRAP_T", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_WRAP_T), (intptr_t)0 },
+    { "TEXTURE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE), (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_CUBE_MAP), (intptr_t)0 },
+    { "TEXTURE_BINDING_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_BINDING_CUBE_MAP), (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_POSITIVE_X", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_CUBE_MAP_POSITIVE_X), (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_NEGATIVE_X", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_CUBE_MAP_NEGATIVE_X), (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_POSITIVE_Y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_CUBE_MAP_POSITIVE_Y), (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_NEGATIVE_Y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_CUBE_MAP_NEGATIVE_Y), (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_POSITIVE_Z", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_CUBE_MAP_POSITIVE_Z), (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_NEGATIVE_Z", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE_CUBE_MAP_NEGATIVE_Z), (intptr_t)0 },
+    { "MAX_CUBE_MAP_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_CUBE_MAP_TEXTURE_SIZE), (intptr_t)0 },
+    { "TEXTURE0", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE0), (intptr_t)0 },
+    { "TEXTURE1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE1), (intptr_t)0 },
+    { "TEXTURE2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE2), (intptr_t)0 },
+    { "TEXTURE3", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE3), (intptr_t)0 },
+    { "TEXTURE4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE4), (intptr_t)0 },
+    { "TEXTURE5", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE5), (intptr_t)0 },
+    { "TEXTURE6", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE6), (intptr_t)0 },
+    { "TEXTURE7", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE7), (intptr_t)0 },
+    { "TEXTURE8", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE8), (intptr_t)0 },
+    { "TEXTURE9", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE9), (intptr_t)0 },
+    { "TEXTURE10", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE10), (intptr_t)0 },
+    { "TEXTURE11", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE11), (intptr_t)0 },
+    { "TEXTURE12", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE12), (intptr_t)0 },
+    { "TEXTURE13", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE13), (intptr_t)0 },
+    { "TEXTURE14", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE14), (intptr_t)0 },
+    { "TEXTURE15", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE15), (intptr_t)0 },
+    { "TEXTURE16", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE16), (intptr_t)0 },
+    { "TEXTURE17", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE17), (intptr_t)0 },
+    { "TEXTURE18", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE18), (intptr_t)0 },
+    { "TEXTURE19", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE19), (intptr_t)0 },
+    { "TEXTURE20", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE20), (intptr_t)0 },
+    { "TEXTURE21", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE21), (intptr_t)0 },
+    { "TEXTURE22", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE22), (intptr_t)0 },
+    { "TEXTURE23", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE23), (intptr_t)0 },
+    { "TEXTURE24", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE24), (intptr_t)0 },
+    { "TEXTURE25", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE25), (intptr_t)0 },
+    { "TEXTURE26", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE26), (intptr_t)0 },
+    { "TEXTURE27", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE27), (intptr_t)0 },
+    { "TEXTURE28", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE28), (intptr_t)0 },
+    { "TEXTURE29", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE29), (intptr_t)0 },
+    { "TEXTURE30", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE30), (intptr_t)0 },
+    { "TEXTURE31", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextTEXTURE31), (intptr_t)0 },
+    { "ACTIVE_TEXTURE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextACTIVE_TEXTURE), (intptr_t)0 },
+    { "REPEAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextREPEAT), (intptr_t)0 },
+    { "CLAMP_TO_EDGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCLAMP_TO_EDGE), (intptr_t)0 },
+    { "MIRRORED_REPEAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMIRRORED_REPEAT), (intptr_t)0 },
+    { "FLOAT_VEC2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFLOAT_VEC2), (intptr_t)0 },
+    { "FLOAT_VEC3", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFLOAT_VEC3), (intptr_t)0 },
+    { "FLOAT_VEC4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFLOAT_VEC4), (intptr_t)0 },
+    { "INT_VEC2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINT_VEC2), (intptr_t)0 },
+    { "INT_VEC3", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINT_VEC3), (intptr_t)0 },
+    { "INT_VEC4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINT_VEC4), (intptr_t)0 },
+    { "BOOL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBOOL), (intptr_t)0 },
+    { "BOOL_VEC2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBOOL_VEC2), (intptr_t)0 },
+    { "BOOL_VEC3", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBOOL_VEC3), (intptr_t)0 },
+    { "BOOL_VEC4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextBOOL_VEC4), (intptr_t)0 },
+    { "FLOAT_MAT2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFLOAT_MAT2), (intptr_t)0 },
+    { "FLOAT_MAT3", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFLOAT_MAT3), (intptr_t)0 },
+    { "FLOAT_MAT4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFLOAT_MAT4), (intptr_t)0 },
+    { "SAMPLER_2D", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLER_2D), (intptr_t)0 },
+    { "SAMPLER_CUBE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSAMPLER_CUBE), (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_ENABLED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_ENABLED), (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_SIZE), (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_STRIDE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_STRIDE), (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_TYPE), (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_NORMALIZED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_NORMALIZED), (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_POINTER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_POINTER), (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_BUFFER_BINDING), (intptr_t)0 },
+    { "IMPLEMENTATION_COLOR_READ_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextIMPLEMENTATION_COLOR_READ_TYPE), (intptr_t)0 },
+    { "IMPLEMENTATION_COLOR_READ_FORMAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextIMPLEMENTATION_COLOR_READ_FORMAT), (intptr_t)0 },
+    { "COMPILE_STATUS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCOMPILE_STATUS), (intptr_t)0 },
+    { "INFO_LOG_LENGTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINFO_LOG_LENGTH), (intptr_t)0 },
+    { "SHADER_SOURCE_LENGTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSHADER_SOURCE_LENGTH), (intptr_t)0 },
+    { "SHADER_COMPILER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSHADER_COMPILER), (intptr_t)0 },
+    { "SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSHADER_BINARY_FORMATS), (intptr_t)0 },
+    { "NUM_SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNUM_SHADER_BINARY_FORMATS), (intptr_t)0 },
+    { "LOW_FLOAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLOW_FLOAT), (intptr_t)0 },
+    { "MEDIUM_FLOAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMEDIUM_FLOAT), (intptr_t)0 },
+    { "HIGH_FLOAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextHIGH_FLOAT), (intptr_t)0 },
+    { "LOW_INT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextLOW_INT), (intptr_t)0 },
+    { "MEDIUM_INT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMEDIUM_INT), (intptr_t)0 },
+    { "HIGH_INT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextHIGH_INT), (intptr_t)0 },
+    { "FRAMEBUFFER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER), (intptr_t)0 },
+    { "RENDERBUFFER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER), (intptr_t)0 },
+    { "RGBA4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRGBA4), (intptr_t)0 },
+    { "RGB5_A1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRGB5_A1), (intptr_t)0 },
+    { "RGB565", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRGB565), (intptr_t)0 },
+    { "DEPTH_COMPONENT16", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_COMPONENT16), (intptr_t)0 },
+    { "STENCIL_INDEX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_INDEX), (intptr_t)0 },
+    { "STENCIL_INDEX8", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_INDEX8), (intptr_t)0 },
+    { "RENDERBUFFER_WIDTH", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_WIDTH), (intptr_t)0 },
+    { "RENDERBUFFER_HEIGHT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_HEIGHT), (intptr_t)0 },
+    { "RENDERBUFFER_INTERNAL_FORMAT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_INTERNAL_FORMAT), (intptr_t)0 },
+    { "RENDERBUFFER_RED_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_RED_SIZE), (intptr_t)0 },
+    { "RENDERBUFFER_GREEN_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_GREEN_SIZE), (intptr_t)0 },
+    { "RENDERBUFFER_BLUE_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_BLUE_SIZE), (intptr_t)0 },
+    { "RENDERBUFFER_ALPHA_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_ALPHA_SIZE), (intptr_t)0 },
+    { "RENDERBUFFER_DEPTH_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_DEPTH_SIZE), (intptr_t)0 },
+    { "RENDERBUFFER_STENCIL_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_STENCIL_SIZE), (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE), (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_OBJECT_NAME", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_OBJECT_NAME), (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL), (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE), (intptr_t)0 },
+    { "COLOR_ATTACHMENT0", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextCOLOR_ATTACHMENT0), (intptr_t)0 },
+    { "DEPTH_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextDEPTH_ATTACHMENT), (intptr_t)0 },
+    { "STENCIL_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextSTENCIL_ATTACHMENT), (intptr_t)0 },
+    { "NONE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextNONE), (intptr_t)0 },
+    { "FRAMEBUFFER_COMPLETE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_COMPLETE), (intptr_t)0 },
+    { "FRAMEBUFFER_INCOMPLETE_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_INCOMPLETE_ATTACHMENT), (intptr_t)0 },
+    { "FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT), (intptr_t)0 },
+    { "FRAMEBUFFER_INCOMPLETE_DIMENSIONS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_INCOMPLETE_DIMENSIONS), (intptr_t)0 },
+    { "FRAMEBUFFER_UNSUPPORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_UNSUPPORTED), (intptr_t)0 },
+    { "FRAMEBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextFRAMEBUFFER_BINDING), (intptr_t)0 },
+    { "RENDERBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextRENDERBUFFER_BINDING), (intptr_t)0 },
+    { "MAX_RENDERBUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextMAX_RENDERBUFFER_SIZE), (intptr_t)0 },
+    { "INVALID_FRAMEBUFFER_OPERATION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebGLRenderingContextINVALID_FRAMEBUFFER_OPERATION), (intptr_t)0 },
+    { "sizeInBytes", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionSizeInBytes), (intptr_t)1 },
+    { "activeTexture", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionActiveTexture), (intptr_t)1 },
+    { "attachShader", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionAttachShader), (intptr_t)2 },
+    { "bindAttribLocation", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionBindAttribLocation), (intptr_t)3 },
+    { "bindBuffer", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionBindBuffer), (intptr_t)2 },
+    { "bindFramebuffer", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionBindFramebuffer), (intptr_t)2 },
+    { "bindRenderbuffer", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionBindRenderbuffer), (intptr_t)2 },
+    { "bindTexture", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionBindTexture), (intptr_t)2 },
+    { "blendColor", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionBlendColor), (intptr_t)4 },
+    { "blendEquation", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionBlendEquation), (intptr_t)1 },
+    { "blendEquationSeparate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionBlendEquationSeparate), (intptr_t)2 },
+    { "blendFunc", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionBlendFunc), (intptr_t)2 },
+    { "blendFuncSeparate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionBlendFuncSeparate), (intptr_t)4 },
+    { "bufferData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionBufferData), (intptr_t)0 },
+    { "bufferSubData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionBufferSubData), (intptr_t)0 },
+    { "checkFramebufferStatus", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionCheckFramebufferStatus), (intptr_t)1 },
+    { "clear", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionClear), (intptr_t)1 },
+    { "clearColor", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionClearColor), (intptr_t)4 },
+    { "clearDepth", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionClearDepth), (intptr_t)1 },
+    { "clearStencil", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionClearStencil), (intptr_t)1 },
+    { "colorMask", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionColorMask), (intptr_t)4 },
+    { "compileShader", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionCompileShader), (intptr_t)1 },
+    { "copyTexImage2D", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionCopyTexImage2D), (intptr_t)8 },
+    { "copyTexSubImage2D", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionCopyTexSubImage2D), (intptr_t)8 },
+    { "createBuffer", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionCreateBuffer), (intptr_t)0 },
+    { "createFramebuffer", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionCreateFramebuffer), (intptr_t)0 },
+    { "createProgram", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionCreateProgram), (intptr_t)0 },
+    { "createRenderbuffer", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionCreateRenderbuffer), (intptr_t)0 },
+    { "createShader", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionCreateShader), (intptr_t)1 },
+    { "createTexture", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionCreateTexture), (intptr_t)0 },
+    { "cullFace", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionCullFace), (intptr_t)1 },
+    { "deleteBuffer", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionDeleteBuffer), (intptr_t)1 },
+    { "deleteFramebuffer", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionDeleteFramebuffer), (intptr_t)1 },
+    { "deleteProgram", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionDeleteProgram), (intptr_t)1 },
+    { "deleteRenderbuffer", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionDeleteRenderbuffer), (intptr_t)1 },
+    { "deleteShader", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionDeleteShader), (intptr_t)1 },
+    { "deleteTexture", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionDeleteTexture), (intptr_t)1 },
+    { "depthFunc", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionDepthFunc), (intptr_t)1 },
+    { "depthMask", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionDepthMask), (intptr_t)1 },
+    { "depthRange", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionDepthRange), (intptr_t)2 },
+    { "detachShader", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionDetachShader), (intptr_t)2 },
+    { "disable", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionDisable), (intptr_t)1 },
+    { "disableVertexAttribArray", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionDisableVertexAttribArray), (intptr_t)1 },
+    { "drawArrays", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionDrawArrays), (intptr_t)3 },
+    { "drawElements", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionDrawElements), (intptr_t)4 },
+    { "enable", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionEnable), (intptr_t)1 },
+    { "enableVertexAttribArray", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionEnableVertexAttribArray), (intptr_t)1 },
+    { "finish", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionFinish), (intptr_t)0 },
+    { "flush", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionFlush), (intptr_t)0 },
+    { "framebufferRenderbuffer", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionFramebufferRenderbuffer), (intptr_t)4 },
+    { "framebufferTexture2D", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionFramebufferTexture2D), (intptr_t)5 },
+    { "frontFace", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionFrontFace), (intptr_t)1 },
+    { "generateMipmap", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGenerateMipmap), (intptr_t)1 },
+    { "getActiveAttrib", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetActiveAttrib), (intptr_t)2 },
+    { "getActiveUniform", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetActiveUniform), (intptr_t)2 },
+    { "getAttribLocation", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetAttribLocation), (intptr_t)2 },
+    { "getBufferParameter", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetBufferParameter), (intptr_t)0 },
+    { "getContextAttributes", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetContextAttributes), (intptr_t)0 },
+    { "getError", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetError), (intptr_t)0 },
+    { "getFramebufferAttachmentParameter", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetFramebufferAttachmentParameter), (intptr_t)0 },
+    { "getParameter", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetParameter), (intptr_t)0 },
+    { "getProgramParameter", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetProgramParameter), (intptr_t)0 },
+    { "getProgramInfoLog", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetProgramInfoLog), (intptr_t)1 },
+    { "getRenderbufferParameter", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetRenderbufferParameter), (intptr_t)0 },
+    { "getShaderParameter", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetShaderParameter), (intptr_t)0 },
+    { "getShaderInfoLog", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetShaderInfoLog), (intptr_t)1 },
+    { "getShaderSource", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetShaderSource), (intptr_t)1 },
+    { "getString", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetString), (intptr_t)1 },
+    { "getTexParameter", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetTexParameter), (intptr_t)0 },
+    { "getUniform", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetUniform), (intptr_t)0 },
+    { "getUniformLocation", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetUniformLocation), (intptr_t)2 },
+    { "getVertexAttrib", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetVertexAttrib), (intptr_t)0 },
+    { "getVertexAttribOffset", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionGetVertexAttribOffset), (intptr_t)2 },
+    { "hint", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionHint), (intptr_t)2 },
+    { "isBuffer", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionIsBuffer), (intptr_t)1 },
+    { "isEnabled", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionIsEnabled), (intptr_t)1 },
+    { "isFramebuffer", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionIsFramebuffer), (intptr_t)1 },
+    { "isProgram", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionIsProgram), (intptr_t)1 },
+    { "isRenderbuffer", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionIsRenderbuffer), (intptr_t)1 },
+    { "isShader", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionIsShader), (intptr_t)1 },
+    { "isTexture", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionIsTexture), (intptr_t)1 },
+    { "lineWidth", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionLineWidth), (intptr_t)1 },
+    { "linkProgram", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionLinkProgram), (intptr_t)1 },
+    { "pixelStorei", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionPixelStorei), (intptr_t)2 },
+    { "polygonOffset", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionPolygonOffset), (intptr_t)2 },
+    { "readPixels", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionReadPixels), (intptr_t)6 },
+    { "releaseShaderCompiler", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionReleaseShaderCompiler), (intptr_t)0 },
+    { "renderbufferStorage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionRenderbufferStorage), (intptr_t)4 },
+    { "sampleCoverage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionSampleCoverage), (intptr_t)2 },
+    { "scissor", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionScissor), (intptr_t)4 },
+    { "shaderSource", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionShaderSource), (intptr_t)2 },
+    { "stencilFunc", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionStencilFunc), (intptr_t)3 },
+    { "stencilFuncSeparate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionStencilFuncSeparate), (intptr_t)4 },
+    { "stencilMask", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionStencilMask), (intptr_t)1 },
+    { "stencilMaskSeparate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionStencilMaskSeparate), (intptr_t)2 },
+    { "stencilOp", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionStencilOp), (intptr_t)3 },
+    { "stencilOpSeparate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionStencilOpSeparate), (intptr_t)4 },
+    { "texParameterf", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionTexParameterf), (intptr_t)3 },
+    { "texParameteri", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionTexParameteri), (intptr_t)3 },
+    { "texImage2D", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionTexImage2D), (intptr_t)0 },
+    { "texSubImage2D", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionTexSubImage2D), (intptr_t)0 },
+    { "uniform1f", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform1f), (intptr_t)2 },
+    { "uniform1fv", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform1fv), (intptr_t)2 },
+    { "uniform1i", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform1i), (intptr_t)2 },
+    { "uniform1iv", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform1iv), (intptr_t)2 },
+    { "uniform2f", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform2f), (intptr_t)3 },
+    { "uniform2fv", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform2fv), (intptr_t)2 },
+    { "uniform2i", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform2i), (intptr_t)3 },
+    { "uniform2iv", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform2iv), (intptr_t)2 },
+    { "uniform3f", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform3f), (intptr_t)4 },
+    { "uniform3fv", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform3fv), (intptr_t)2 },
+    { "uniform3i", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform3i), (intptr_t)4 },
+    { "uniform3iv", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform3iv), (intptr_t)2 },
+    { "uniform4f", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform4f), (intptr_t)5 },
+    { "uniform4fv", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform4fv), (intptr_t)2 },
+    { "uniform4i", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform4i), (intptr_t)5 },
+    { "uniform4iv", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniform4iv), (intptr_t)2 },
+    { "uniformMatrix2fv", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniformMatrix2fv), (intptr_t)3 },
+    { "uniformMatrix3fv", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniformMatrix3fv), (intptr_t)3 },
+    { "uniformMatrix4fv", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUniformMatrix4fv), (intptr_t)3 },
+    { "useProgram", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionUseProgram), (intptr_t)1 },
+    { "validateProgram", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionValidateProgram), (intptr_t)1 },
+    { "vertexAttrib1f", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionVertexAttrib1f), (intptr_t)2 },
+    { "vertexAttrib1fv", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionVertexAttrib1fv), (intptr_t)2 },
+    { "vertexAttrib2f", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionVertexAttrib2f), (intptr_t)3 },
+    { "vertexAttrib2fv", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionVertexAttrib2fv), (intptr_t)2 },
+    { "vertexAttrib3f", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionVertexAttrib3f), (intptr_t)4 },
+    { "vertexAttrib3fv", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionVertexAttrib3fv), (intptr_t)2 },
+    { "vertexAttrib4f", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionVertexAttrib4f), (intptr_t)5 },
+    { "vertexAttrib4fv", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionVertexAttrib4fv), (intptr_t)2 },
+    { "vertexAttribPointer", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionVertexAttribPointer), (intptr_t)6 },
+    { "viewport", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLRenderingContextPrototypeFunctionViewport), (intptr_t)4 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLRenderingContextPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 65535, JSWebGLRenderingContextPrototypeTableValues, 0 };
+#else
+    { 1102, 1023, JSWebGLRenderingContextPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLRenderingContextPrototype::s_info = { "WebGLRenderingContextPrototype", 0, &JSWebGLRenderingContextPrototypeTable, 0 };
+
+JSObject* JSWebGLRenderingContextPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLRenderingContext>(exec, globalObject);
+}
+
+bool JSWebGLRenderingContextPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticPropertySlot<JSWebGLRenderingContextPrototype, JSObject>(exec, &JSWebGLRenderingContextPrototypeTable, this, propertyName, slot);
+}
+
+bool JSWebGLRenderingContextPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSWebGLRenderingContextPrototype, JSObject>(exec, &JSWebGLRenderingContextPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSWebGLRenderingContext::s_info = { "WebGLRenderingContext", &JSCanvasRenderingContext::s_info, &JSWebGLRenderingContextTable, 0 };
+
+JSWebGLRenderingContext::JSWebGLRenderingContext(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLRenderingContext> impl)
+    : JSCanvasRenderingContext(structure, globalObject, impl)
+{
+}
+
+JSObject* JSWebGLRenderingContext::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLRenderingContextPrototype(JSWebGLRenderingContextPrototype::createStructure(JSCanvasRenderingContextPrototype::self(exec, globalObject)));
+}
+
+bool JSWebGLRenderingContext::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSWebGLRenderingContext, Base>(exec, &JSWebGLRenderingContextTable, this, propertyName, slot);
+}
+
+bool JSWebGLRenderingContext::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebGLRenderingContext, Base>(exec, &JSWebGLRenderingContextTable, this, propertyName, descriptor);
+}
+
+JSValue jsWebGLRenderingContextConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWebGLRenderingContext* domObject = static_cast<JSWebGLRenderingContext*>(asObject(slotBase));
+    return JSWebGLRenderingContext::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSWebGLRenderingContext::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSWebGLRenderingContextConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionSizeInBytes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    unsigned type = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->sizeInBytes(type, ec));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionActiveTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    unsigned texture = args.at(0).toInt32(exec);
+
+    imp->activeTexture(texture, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionAttachShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    WebGLShader* shader = toWebGLShader(args.at(1));
+
+    imp->attachShader(program, shader, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBindAttribLocation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    unsigned index = args.at(1).toInt32(exec);
+    const UString& name = args.at(2).toString(exec);
+
+    imp->bindAttribLocation(program, index, name, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBindBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    unsigned target = args.at(0).toInt32(exec);
+    WebGLBuffer* buffer = toWebGLBuffer(args.at(1));
+
+    imp->bindBuffer(target, buffer, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBindFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    unsigned target = args.at(0).toInt32(exec);
+    WebGLFramebuffer* framebuffer = toWebGLFramebuffer(args.at(1));
+
+    imp->bindFramebuffer(target, framebuffer, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBindRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    unsigned target = args.at(0).toInt32(exec);
+    WebGLRenderbuffer* renderbuffer = toWebGLRenderbuffer(args.at(1));
+
+    imp->bindRenderbuffer(target, renderbuffer, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBindTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    unsigned target = args.at(0).toInt32(exec);
+    WebGLTexture* texture = toWebGLTexture(args.at(1));
+
+    imp->bindTexture(target, texture, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBlendColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    double red = args.at(0).toNumber(exec);
+    double green = args.at(1).toNumber(exec);
+    double blue = args.at(2).toNumber(exec);
+    double alpha = args.at(3).toNumber(exec);
+
+    imp->blendColor(red, green, blue, alpha);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBlendEquation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned mode = args.at(0).toInt32(exec);
+
+    imp->blendEquation(mode);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBlendEquationSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned modeRGB = args.at(0).toInt32(exec);
+    unsigned modeAlpha = args.at(1).toInt32(exec);
+
+    imp->blendEquationSeparate(modeRGB, modeAlpha);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBlendFunc(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned sfactor = args.at(0).toInt32(exec);
+    unsigned dfactor = args.at(1).toInt32(exec);
+
+    imp->blendFunc(sfactor, dfactor);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBlendFuncSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned srcRGB = args.at(0).toInt32(exec);
+    unsigned dstRGB = args.at(1).toInt32(exec);
+    unsigned srcAlpha = args.at(2).toInt32(exec);
+    unsigned dstAlpha = args.at(3).toInt32(exec);
+
+    imp->blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBufferData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->bufferData(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBufferSubData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->bufferSubData(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCheckFramebufferStatus(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->checkFramebufferStatus(target));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned mask = args.at(0).toInt32(exec);
+
+    imp->clear(mask);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionClearColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    double red = args.at(0).toNumber(exec);
+    double green = args.at(1).toNumber(exec);
+    double blue = args.at(2).toNumber(exec);
+    double alpha = args.at(3).toNumber(exec);
+
+    imp->clearColor(red, green, blue, alpha);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionClearDepth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    double depth = args.at(0).toNumber(exec);
+
+    imp->clearDepth(depth);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionClearStencil(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    int s = args.at(0).toInt32(exec);
+
+    imp->clearStencil(s);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionColorMask(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    bool red = args.at(0).toBoolean(exec);
+    bool green = args.at(1).toBoolean(exec);
+    bool blue = args.at(2).toBoolean(exec);
+    bool alpha = args.at(3).toBoolean(exec);
+
+    imp->colorMask(red, green, blue, alpha);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCompileShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLShader* shader = toWebGLShader(args.at(0));
+
+    imp->compileShader(shader, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCopyTexImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    int level = args.at(1).toInt32(exec);
+    unsigned internalformat = args.at(2).toInt32(exec);
+    int x = args.at(3).toInt32(exec);
+    int y = args.at(4).toInt32(exec);
+    unsigned width = args.at(5).toInt32(exec);
+    unsigned height = args.at(6).toInt32(exec);
+    int border = args.at(7).toInt32(exec);
+
+    imp->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCopyTexSubImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    int level = args.at(1).toInt32(exec);
+    int xoffset = args.at(2).toInt32(exec);
+    int yoffset = args.at(3).toInt32(exec);
+    int x = args.at(4).toInt32(exec);
+    int y = args.at(5).toInt32(exec);
+    unsigned width = args.at(6).toInt32(exec);
+    unsigned height = args.at(7).toInt32(exec);
+
+    imp->copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCreateBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createBuffer()));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCreateFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createFramebuffer()));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCreateProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createProgram()));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCreateRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createRenderbuffer()));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCreateShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    unsigned type = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createShader(type, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCreateTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createTexture()));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCullFace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned mode = args.at(0).toInt32(exec);
+
+    imp->cullFace(mode);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDeleteBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    WebGLBuffer* buffer = toWebGLBuffer(args.at(0));
+
+    imp->deleteBuffer(buffer);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDeleteFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    WebGLFramebuffer* framebuffer = toWebGLFramebuffer(args.at(0));
+
+    imp->deleteFramebuffer(framebuffer);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDeleteProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+
+    imp->deleteProgram(program);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDeleteRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    WebGLRenderbuffer* renderbuffer = toWebGLRenderbuffer(args.at(0));
+
+    imp->deleteRenderbuffer(renderbuffer);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDeleteShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    WebGLShader* shader = toWebGLShader(args.at(0));
+
+    imp->deleteShader(shader);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDeleteTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    WebGLTexture* texture = toWebGLTexture(args.at(0));
+
+    imp->deleteTexture(texture);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDepthFunc(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned func = args.at(0).toInt32(exec);
+
+    imp->depthFunc(func);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDepthMask(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    bool flag = args.at(0).toBoolean(exec);
+
+    imp->depthMask(flag);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDepthRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    double zNear = args.at(0).toNumber(exec);
+    double zFar = args.at(1).toNumber(exec);
+
+    imp->depthRange(zNear, zFar);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDetachShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    WebGLShader* shader = toWebGLShader(args.at(1));
+
+    imp->detachShader(program, shader, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDisable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned cap = args.at(0).toInt32(exec);
+
+    imp->disable(cap);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDisableVertexAttribArray(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    unsigned index = args.at(0).toInt32(exec);
+
+    imp->disableVertexAttribArray(index, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDrawArrays(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    unsigned mode = args.at(0).toInt32(exec);
+    int first = args.at(1).toInt32(exec);
+    unsigned count = args.at(2).toInt32(exec);
+
+    imp->drawArrays(mode, first, count, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDrawElements(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    unsigned mode = args.at(0).toInt32(exec);
+    int count = args.at(1).toInt32(exec);
+    unsigned type = args.at(2).toInt32(exec);
+    unsigned offset = args.at(3).toInt32(exec);
+
+    imp->drawElements(mode, count, type, offset, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionEnable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned cap = args.at(0).toInt32(exec);
+
+    imp->enable(cap);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionEnableVertexAttribArray(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    unsigned index = args.at(0).toInt32(exec);
+
+    imp->enableVertexAttribArray(index, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionFinish(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+
+    imp->finish();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionFlush(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+
+    imp->flush();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionFramebufferRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned attachment = args.at(1).toInt32(exec);
+    unsigned renderbuffertarget = args.at(2).toInt32(exec);
+    WebGLRenderbuffer* renderbuffer = toWebGLRenderbuffer(args.at(3));
+
+    imp->framebufferRenderbuffer(target, attachment, renderbuffertarget, renderbuffer, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionFramebufferTexture2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned attachment = args.at(1).toInt32(exec);
+    unsigned textarget = args.at(2).toInt32(exec);
+    WebGLTexture* texture = toWebGLTexture(args.at(3));
+    int level = args.at(4).toInt32(exec);
+
+    imp->framebufferTexture2D(target, attachment, textarget, texture, level, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionFrontFace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned mode = args.at(0).toInt32(exec);
+
+    imp->frontFace(mode);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGenerateMipmap(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+
+    imp->generateMipmap(target);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetActiveAttrib(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    unsigned index = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getActiveAttrib(program, index, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetActiveUniform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    unsigned index = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getActiveUniform(program, index, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetAttribLocation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    const UString& name = args.at(1).toString(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getAttribLocation(program, name));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetBufferParameter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->getBufferParameter(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetContextAttributes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getContextAttributes()));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetError(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getError());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetFramebufferAttachmentParameter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->getFramebufferAttachmentParameter(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetParameter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->getParameter(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetProgramParameter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->getProgramParameter(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetProgramInfoLog(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+
+
+    JSC::JSValue result = jsString(exec, imp->getProgramInfoLog(program, ec));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetRenderbufferParameter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->getRenderbufferParameter(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetShaderParameter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->getShaderParameter(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetShaderInfoLog(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLShader* shader = toWebGLShader(args.at(0));
+
+
+    JSC::JSValue result = jsString(exec, imp->getShaderInfoLog(shader, ec));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetShaderSource(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLShader* shader = toWebGLShader(args.at(0));
+
+
+    JSC::JSValue result = jsString(exec, imp->getShaderSource(shader, ec));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned name = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsString(exec, imp->getString(name));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetTexParameter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->getTexParameter(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetUniform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->getUniform(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetUniformLocation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    const UString& name = args.at(1).toString(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getUniformLocation(program, name, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetVertexAttrib(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->getVertexAttrib(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetVertexAttribOffset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getVertexAttribOffset(index, pname));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionHint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned mode = args.at(1).toInt32(exec);
+
+    imp->hint(target, mode);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionIsBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    WebGLBuffer* buffer = toWebGLBuffer(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->isBuffer(buffer));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionIsEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned cap = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsBoolean(imp->isEnabled(cap));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionIsFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    WebGLFramebuffer* framebuffer = toWebGLFramebuffer(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->isFramebuffer(framebuffer));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionIsProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->isProgram(program));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionIsRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    WebGLRenderbuffer* renderbuffer = toWebGLRenderbuffer(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->isRenderbuffer(renderbuffer));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionIsShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    WebGLShader* shader = toWebGLShader(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->isShader(shader));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionIsTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    WebGLTexture* texture = toWebGLTexture(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->isTexture(texture));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionLineWidth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    double width = args.at(0).toNumber(exec);
+
+    imp->lineWidth(width);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionLinkProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+
+    imp->linkProgram(program, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionPixelStorei(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned pname = args.at(0).toInt32(exec);
+    int param = args.at(1).toInt32(exec);
+
+    imp->pixelStorei(pname, param);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionPolygonOffset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    double factor = args.at(0).toNumber(exec);
+    double units = args.at(1).toNumber(exec);
+
+    imp->polygonOffset(factor, units);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionReadPixels(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
+    unsigned width = args.at(2).toInt32(exec);
+    unsigned height = args.at(3).toInt32(exec);
+    unsigned format = args.at(4).toInt32(exec);
+    unsigned type = args.at(5).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->readPixels(x, y, width, height, format, type)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionReleaseShaderCompiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+
+    imp->releaseShaderCompiler();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionRenderbufferStorage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned internalformat = args.at(1).toInt32(exec);
+    unsigned width = args.at(2).toInt32(exec);
+    unsigned height = args.at(3).toInt32(exec);
+
+    imp->renderbufferStorage(target, internalformat, width, height);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionSampleCoverage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    double value = args.at(0).toNumber(exec);
+    bool invert = args.at(1).toBoolean(exec);
+
+    imp->sampleCoverage(value, invert);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionScissor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
+    unsigned width = args.at(2).toInt32(exec);
+    unsigned height = args.at(3).toInt32(exec);
+
+    imp->scissor(x, y, width, height);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionShaderSource(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLShader* shader = toWebGLShader(args.at(0));
+    const UString& string = args.at(1).toString(exec);
+
+    imp->shaderSource(shader, string, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionStencilFunc(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned func = args.at(0).toInt32(exec);
+    int ref = args.at(1).toInt32(exec);
+    unsigned mask = args.at(2).toInt32(exec);
+
+    imp->stencilFunc(func, ref, mask);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionStencilFuncSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned face = args.at(0).toInt32(exec);
+    unsigned func = args.at(1).toInt32(exec);
+    int ref = args.at(2).toInt32(exec);
+    unsigned mask = args.at(3).toInt32(exec);
+
+    imp->stencilFuncSeparate(face, func, ref, mask);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionStencilMask(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned mask = args.at(0).toInt32(exec);
+
+    imp->stencilMask(mask);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionStencilMaskSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned face = args.at(0).toInt32(exec);
+    unsigned mask = args.at(1).toInt32(exec);
+
+    imp->stencilMaskSeparate(face, mask);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionStencilOp(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned fail = args.at(0).toInt32(exec);
+    unsigned zfail = args.at(1).toInt32(exec);
+    unsigned zpass = args.at(2).toInt32(exec);
+
+    imp->stencilOp(fail, zfail, zpass);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionStencilOpSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned face = args.at(0).toInt32(exec);
+    unsigned fail = args.at(1).toInt32(exec);
+    unsigned zfail = args.at(2).toInt32(exec);
+    unsigned zpass = args.at(3).toInt32(exec);
+
+    imp->stencilOpSeparate(face, fail, zfail, zpass);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionTexParameterf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+    float param = args.at(2).toFloat(exec);
+
+    imp->texParameterf(target, pname, param);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionTexParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+    int param = args.at(2).toInt32(exec);
+
+    imp->texParameteri(target, pname, param);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionTexImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->texImage2D(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionTexSubImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->texSubImage2D(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform1f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+    float x = args.at(1).toFloat(exec);
+
+    imp->uniform1f(location, x, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform1fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->uniform1fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform1i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+    int x = args.at(1).toInt32(exec);
+
+    imp->uniform1i(location, x, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform1iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->uniform1iv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform2f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+    float x = args.at(1).toFloat(exec);
+    float y = args.at(2).toFloat(exec);
+
+    imp->uniform2f(location, x, y, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform2fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->uniform2fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform2i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+    int x = args.at(1).toInt32(exec);
+    int y = args.at(2).toInt32(exec);
+
+    imp->uniform2i(location, x, y, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform2iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->uniform2iv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform3f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+    float x = args.at(1).toFloat(exec);
+    float y = args.at(2).toFloat(exec);
+    float z = args.at(3).toFloat(exec);
+
+    imp->uniform3f(location, x, y, z, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform3fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->uniform3fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform3i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+    int x = args.at(1).toInt32(exec);
+    int y = args.at(2).toInt32(exec);
+    int z = args.at(3).toInt32(exec);
+
+    imp->uniform3i(location, x, y, z, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform3iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->uniform3iv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform4f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+    float x = args.at(1).toFloat(exec);
+    float y = args.at(2).toFloat(exec);
+    float z = args.at(3).toFloat(exec);
+    float w = args.at(4).toFloat(exec);
+
+    imp->uniform4f(location, x, y, z, w, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform4fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->uniform4fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform4i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+    int x = args.at(1).toInt32(exec);
+    int y = args.at(2).toInt32(exec);
+    int z = args.at(3).toInt32(exec);
+    int w = args.at(4).toInt32(exec);
+
+    imp->uniform4i(location, x, y, z, w, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform4iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->uniform4iv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniformMatrix2fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->uniformMatrix2fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniformMatrix3fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->uniformMatrix3fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniformMatrix4fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->uniformMatrix4fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUseProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+
+    imp->useProgram(program, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionValidateProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+
+    imp->validateProgram(program, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib1f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned indx = args.at(0).toInt32(exec);
+    float x = args.at(1).toFloat(exec);
+
+    imp->vertexAttrib1f(indx, x);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib1fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->vertexAttrib1fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib2f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned indx = args.at(0).toInt32(exec);
+    float x = args.at(1).toFloat(exec);
+    float y = args.at(2).toFloat(exec);
+
+    imp->vertexAttrib2f(indx, x, y);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib2fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->vertexAttrib2fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib3f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned indx = args.at(0).toInt32(exec);
+    float x = args.at(1).toFloat(exec);
+    float y = args.at(2).toFloat(exec);
+    float z = args.at(3).toFloat(exec);
+
+    imp->vertexAttrib3f(indx, x, y, z);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib3fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->vertexAttrib3fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib4f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    unsigned indx = args.at(0).toInt32(exec);
+    float x = args.at(1).toFloat(exec);
+    float y = args.at(2).toFloat(exec);
+    float z = args.at(3).toFloat(exec);
+    float w = args.at(4).toFloat(exec);
+
+    imp->vertexAttrib4f(indx, x, y, z, w);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib4fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    return castedThisObj->vertexAttrib4fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttribPointer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    unsigned indx = args.at(0).toInt32(exec);
+    int size = args.at(1).toInt32(exec);
+    unsigned type = args.at(2).toInt32(exec);
+    bool normalized = args.at(3).toBoolean(exec);
+    int stride = args.at(4).toInt32(exec);
+    unsigned offset = args.at(5).toInt32(exec);
+
+    imp->vertexAttribPointer(indx, size, type, normalized, stride, offset, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionViewport(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLRenderingContext::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLRenderingContext* castedThisObj = static_cast<JSWebGLRenderingContext*>(asObject(thisValue));
+    WebGLRenderingContext* imp = static_cast<WebGLRenderingContext*>(castedThisObj->impl());
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
+    unsigned width = args.at(2).toInt32(exec);
+    unsigned height = args.at(3).toInt32(exec);
+
+    imp->viewport(x, y, width, height);
+    return jsUndefined();
+}
+
+// Constant getters
+
+JSValue jsWebGLRenderingContextDEPTH_BUFFER_BIT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x00000100));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_BUFFER_BIT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x00000400));
+}
+
+JSValue jsWebGLRenderingContextCOLOR_BUFFER_BIT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x00004000));
+}
+
+JSValue jsWebGLRenderingContextFALSE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsWebGLRenderingContextTRUE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(1));
+}
+
+JSValue jsWebGLRenderingContextPOINTS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0000));
+}
+
+JSValue jsWebGLRenderingContextLINES(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0001));
+}
+
+JSValue jsWebGLRenderingContextLINE_LOOP(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0002));
+}
+
+JSValue jsWebGLRenderingContextLINE_STRIP(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0003));
+}
+
+JSValue jsWebGLRenderingContextTRIANGLES(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0004));
+}
+
+JSValue jsWebGLRenderingContextTRIANGLE_STRIP(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0005));
+}
+
+JSValue jsWebGLRenderingContextTRIANGLE_FAN(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0006));
+}
+
+JSValue jsWebGLRenderingContextZERO(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsWebGLRenderingContextONE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(1));
+}
+
+JSValue jsWebGLRenderingContextSRC_COLOR(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0300));
+}
+
+JSValue jsWebGLRenderingContextONE_MINUS_SRC_COLOR(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0301));
+}
+
+JSValue jsWebGLRenderingContextSRC_ALPHA(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0302));
+}
+
+JSValue jsWebGLRenderingContextONE_MINUS_SRC_ALPHA(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0303));
+}
+
+JSValue jsWebGLRenderingContextDST_ALPHA(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0304));
+}
+
+JSValue jsWebGLRenderingContextONE_MINUS_DST_ALPHA(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0305));
+}
+
+JSValue jsWebGLRenderingContextDST_COLOR(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0306));
+}
+
+JSValue jsWebGLRenderingContextONE_MINUS_DST_COLOR(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0307));
+}
+
+JSValue jsWebGLRenderingContextSRC_ALPHA_SATURATE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0308));
+}
+
+JSValue jsWebGLRenderingContextFUNC_ADD(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8006));
+}
+
+JSValue jsWebGLRenderingContextBLEND_EQUATION(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8009));
+}
+
+JSValue jsWebGLRenderingContextBLEND_EQUATION_RGB(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8009));
+}
+
+JSValue jsWebGLRenderingContextBLEND_EQUATION_ALPHA(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x883D));
+}
+
+JSValue jsWebGLRenderingContextFUNC_SUBTRACT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x800A));
+}
+
+JSValue jsWebGLRenderingContextFUNC_REVERSE_SUBTRACT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x800B));
+}
+
+JSValue jsWebGLRenderingContextBLEND_DST_RGB(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x80C8));
+}
+
+JSValue jsWebGLRenderingContextBLEND_SRC_RGB(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x80C9));
+}
+
+JSValue jsWebGLRenderingContextBLEND_DST_ALPHA(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x80CA));
+}
+
+JSValue jsWebGLRenderingContextBLEND_SRC_ALPHA(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x80CB));
+}
+
+JSValue jsWebGLRenderingContextCONSTANT_COLOR(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8001));
+}
+
+JSValue jsWebGLRenderingContextONE_MINUS_CONSTANT_COLOR(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8002));
+}
+
+JSValue jsWebGLRenderingContextCONSTANT_ALPHA(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8003));
+}
+
+JSValue jsWebGLRenderingContextONE_MINUS_CONSTANT_ALPHA(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8004));
+}
+
+JSValue jsWebGLRenderingContextBLEND_COLOR(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8005));
+}
+
+JSValue jsWebGLRenderingContextARRAY_BUFFER(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8892));
+}
+
+JSValue jsWebGLRenderingContextELEMENT_ARRAY_BUFFER(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8893));
+}
+
+JSValue jsWebGLRenderingContextARRAY_BUFFER_BINDING(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8894));
+}
+
+JSValue jsWebGLRenderingContextELEMENT_ARRAY_BUFFER_BINDING(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8895));
+}
+
+JSValue jsWebGLRenderingContextSTREAM_DRAW(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x88E0));
+}
+
+JSValue jsWebGLRenderingContextSTATIC_DRAW(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x88E4));
+}
+
+JSValue jsWebGLRenderingContextDYNAMIC_DRAW(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x88E8));
+}
+
+JSValue jsWebGLRenderingContextBUFFER_SIZE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8764));
+}
+
+JSValue jsWebGLRenderingContextBUFFER_USAGE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8765));
+}
+
+JSValue jsWebGLRenderingContextCURRENT_VERTEX_ATTRIB(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8626));
+}
+
+JSValue jsWebGLRenderingContextFRONT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0404));
+}
+
+JSValue jsWebGLRenderingContextBACK(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0405));
+}
+
+JSValue jsWebGLRenderingContextFRONT_AND_BACK(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0408));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE_2D(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0DE1));
+}
+
+JSValue jsWebGLRenderingContextCULL_FACE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B44));
+}
+
+JSValue jsWebGLRenderingContextBLEND(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0BE2));
+}
+
+JSValue jsWebGLRenderingContextDITHER(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0BD0));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_TEST(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B90));
+}
+
+JSValue jsWebGLRenderingContextDEPTH_TEST(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B71));
+}
+
+JSValue jsWebGLRenderingContextSCISSOR_TEST(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0C11));
+}
+
+JSValue jsWebGLRenderingContextPOLYGON_OFFSET_FILL(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8037));
+}
+
+JSValue jsWebGLRenderingContextSAMPLE_ALPHA_TO_COVERAGE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x809E));
+}
+
+JSValue jsWebGLRenderingContextSAMPLE_COVERAGE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x80A0));
+}
+
+JSValue jsWebGLRenderingContextNO_ERROR(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsWebGLRenderingContextINVALID_ENUM(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0500));
+}
+
+JSValue jsWebGLRenderingContextINVALID_VALUE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0501));
+}
+
+JSValue jsWebGLRenderingContextINVALID_OPERATION(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0502));
+}
+
+JSValue jsWebGLRenderingContextOUT_OF_MEMORY(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0505));
+}
+
+JSValue jsWebGLRenderingContextCW(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0900));
+}
+
+JSValue jsWebGLRenderingContextCCW(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0901));
+}
+
+JSValue jsWebGLRenderingContextLINE_WIDTH(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B21));
+}
+
+JSValue jsWebGLRenderingContextALIASED_POINT_SIZE_RANGE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x846D));
+}
+
+JSValue jsWebGLRenderingContextALIASED_LINE_WIDTH_RANGE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x846E));
+}
+
+JSValue jsWebGLRenderingContextCULL_FACE_MODE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B45));
+}
+
+JSValue jsWebGLRenderingContextFRONT_FACE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B46));
+}
+
+JSValue jsWebGLRenderingContextDEPTH_RANGE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B70));
+}
+
+JSValue jsWebGLRenderingContextDEPTH_WRITEMASK(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B72));
+}
+
+JSValue jsWebGLRenderingContextDEPTH_CLEAR_VALUE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B73));
+}
+
+JSValue jsWebGLRenderingContextDEPTH_FUNC(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B74));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_CLEAR_VALUE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B91));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_FUNC(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B92));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_FAIL(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B94));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_PASS_DEPTH_FAIL(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B95));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_PASS_DEPTH_PASS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B96));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_REF(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B97));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_VALUE_MASK(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B93));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_WRITEMASK(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B98));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_BACK_FUNC(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8800));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_BACK_FAIL(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8801));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_BACK_PASS_DEPTH_FAIL(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8802));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_BACK_PASS_DEPTH_PASS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8803));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_BACK_REF(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CA3));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_BACK_VALUE_MASK(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CA4));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_BACK_WRITEMASK(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CA5));
+}
+
+JSValue jsWebGLRenderingContextVIEWPORT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0BA2));
+}
+
+JSValue jsWebGLRenderingContextSCISSOR_BOX(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0C10));
+}
+
+JSValue jsWebGLRenderingContextCOLOR_CLEAR_VALUE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0C22));
+}
+
+JSValue jsWebGLRenderingContextCOLOR_WRITEMASK(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0C23));
+}
+
+JSValue jsWebGLRenderingContextUNPACK_ALIGNMENT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0CF5));
+}
+
+JSValue jsWebGLRenderingContextPACK_ALIGNMENT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D05));
+}
+
+JSValue jsWebGLRenderingContextMAX_TEXTURE_SIZE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D33));
+}
+
+JSValue jsWebGLRenderingContextMAX_VIEWPORT_DIMS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D3A));
+}
+
+JSValue jsWebGLRenderingContextSUBPIXEL_BITS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D50));
+}
+
+JSValue jsWebGLRenderingContextRED_BITS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D52));
+}
+
+JSValue jsWebGLRenderingContextGREEN_BITS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D53));
+}
+
+JSValue jsWebGLRenderingContextBLUE_BITS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D54));
+}
+
+JSValue jsWebGLRenderingContextALPHA_BITS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D55));
+}
+
+JSValue jsWebGLRenderingContextDEPTH_BITS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D56));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_BITS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D57));
+}
+
+JSValue jsWebGLRenderingContextPOLYGON_OFFSET_UNITS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x2A00));
+}
+
+JSValue jsWebGLRenderingContextPOLYGON_OFFSET_FACTOR(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8038));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE_BINDING_2D(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8069));
+}
+
+JSValue jsWebGLRenderingContextSAMPLE_BUFFERS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x80A8));
+}
+
+JSValue jsWebGLRenderingContextSAMPLES(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x80A9));
+}
+
+JSValue jsWebGLRenderingContextSAMPLE_COVERAGE_VALUE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x80AA));
+}
+
+JSValue jsWebGLRenderingContextSAMPLE_COVERAGE_INVERT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x80AB));
+}
+
+JSValue jsWebGLRenderingContextNUM_COMPRESSED_TEXTURE_FORMATS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x86A2));
+}
+
+JSValue jsWebGLRenderingContextCOMPRESSED_TEXTURE_FORMATS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x86A3));
+}
+
+JSValue jsWebGLRenderingContextDONT_CARE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1100));
+}
+
+JSValue jsWebGLRenderingContextFASTEST(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1101));
+}
+
+JSValue jsWebGLRenderingContextNICEST(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1102));
+}
+
+JSValue jsWebGLRenderingContextGENERATE_MIPMAP_HINT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8192));
+}
+
+JSValue jsWebGLRenderingContextBYTE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1400));
+}
+
+JSValue jsWebGLRenderingContextUNSIGNED_BYTE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1401));
+}
+
+JSValue jsWebGLRenderingContextSHORT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1402));
+}
+
+JSValue jsWebGLRenderingContextUNSIGNED_SHORT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1403));
+}
+
+JSValue jsWebGLRenderingContextINT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1404));
+}
+
+JSValue jsWebGLRenderingContextUNSIGNED_INT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1405));
+}
+
+JSValue jsWebGLRenderingContextFLOAT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1406));
+}
+
+JSValue jsWebGLRenderingContextFIXED(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x140C));
+}
+
+JSValue jsWebGLRenderingContextDEPTH_COMPONENT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1902));
+}
+
+JSValue jsWebGLRenderingContextALPHA(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1906));
+}
+
+JSValue jsWebGLRenderingContextRGB(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1907));
+}
+
+JSValue jsWebGLRenderingContextRGBA(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1908));
+}
+
+JSValue jsWebGLRenderingContextLUMINANCE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1909));
+}
+
+JSValue jsWebGLRenderingContextLUMINANCE_ALPHA(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x190A));
+}
+
+JSValue jsWebGLRenderingContextUNSIGNED_SHORT_4_4_4_4(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8033));
+}
+
+JSValue jsWebGLRenderingContextUNSIGNED_SHORT_5_5_5_1(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8034));
+}
+
+JSValue jsWebGLRenderingContextUNSIGNED_SHORT_5_6_5(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8363));
+}
+
+JSValue jsWebGLRenderingContextFRAGMENT_SHADER(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B30));
+}
+
+JSValue jsWebGLRenderingContextVERTEX_SHADER(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B31));
+}
+
+JSValue jsWebGLRenderingContextMAX_VERTEX_ATTRIBS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8869));
+}
+
+JSValue jsWebGLRenderingContextMAX_VERTEX_UNIFORM_VECTORS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DFB));
+}
+
+JSValue jsWebGLRenderingContextMAX_VARYING_VECTORS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DFC));
+}
+
+JSValue jsWebGLRenderingContextMAX_COMBINED_TEXTURE_IMAGE_UNITS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B4D));
+}
+
+JSValue jsWebGLRenderingContextMAX_VERTEX_TEXTURE_IMAGE_UNITS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B4C));
+}
+
+JSValue jsWebGLRenderingContextMAX_TEXTURE_IMAGE_UNITS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8872));
+}
+
+JSValue jsWebGLRenderingContextMAX_FRAGMENT_UNIFORM_VECTORS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DFD));
+}
+
+JSValue jsWebGLRenderingContextSHADER_TYPE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B4F));
+}
+
+JSValue jsWebGLRenderingContextDELETE_STATUS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B80));
+}
+
+JSValue jsWebGLRenderingContextLINK_STATUS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B82));
+}
+
+JSValue jsWebGLRenderingContextVALIDATE_STATUS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B83));
+}
+
+JSValue jsWebGLRenderingContextATTACHED_SHADERS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B85));
+}
+
+JSValue jsWebGLRenderingContextACTIVE_UNIFORMS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B86));
+}
+
+JSValue jsWebGLRenderingContextACTIVE_UNIFORM_MAX_LENGTH(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B87));
+}
+
+JSValue jsWebGLRenderingContextACTIVE_ATTRIBUTES(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B89));
+}
+
+JSValue jsWebGLRenderingContextACTIVE_ATTRIBUTE_MAX_LENGTH(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B8A));
+}
+
+JSValue jsWebGLRenderingContextSHADING_LANGUAGE_VERSION(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B8C));
+}
+
+JSValue jsWebGLRenderingContextCURRENT_PROGRAM(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B8D));
+}
+
+JSValue jsWebGLRenderingContextNEVER(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0200));
+}
+
+JSValue jsWebGLRenderingContextLESS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0201));
+}
+
+JSValue jsWebGLRenderingContextEQUAL(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0202));
+}
+
+JSValue jsWebGLRenderingContextLEQUAL(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0203));
+}
+
+JSValue jsWebGLRenderingContextGREATER(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0204));
+}
+
+JSValue jsWebGLRenderingContextNOTEQUAL(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0205));
+}
+
+JSValue jsWebGLRenderingContextGEQUAL(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0206));
+}
+
+JSValue jsWebGLRenderingContextALWAYS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0207));
+}
+
+JSValue jsWebGLRenderingContextKEEP(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1E00));
+}
+
+JSValue jsWebGLRenderingContextREPLACE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1E01));
+}
+
+JSValue jsWebGLRenderingContextINCR(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1E02));
+}
+
+JSValue jsWebGLRenderingContextDECR(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1E03));
+}
+
+JSValue jsWebGLRenderingContextINVERT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x150A));
+}
+
+JSValue jsWebGLRenderingContextINCR_WRAP(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8507));
+}
+
+JSValue jsWebGLRenderingContextDECR_WRAP(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8508));
+}
+
+JSValue jsWebGLRenderingContextVENDOR(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1F00));
+}
+
+JSValue jsWebGLRenderingContextRENDERER(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1F01));
+}
+
+JSValue jsWebGLRenderingContextVERSION(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1F02));
+}
+
+JSValue jsWebGLRenderingContextEXTENSIONS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1F03));
+}
+
+JSValue jsWebGLRenderingContextNEAREST(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x2600));
+}
+
+JSValue jsWebGLRenderingContextLINEAR(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x2601));
+}
+
+JSValue jsWebGLRenderingContextNEAREST_MIPMAP_NEAREST(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x2700));
+}
+
+JSValue jsWebGLRenderingContextLINEAR_MIPMAP_NEAREST(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x2701));
+}
+
+JSValue jsWebGLRenderingContextNEAREST_MIPMAP_LINEAR(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x2702));
+}
+
+JSValue jsWebGLRenderingContextLINEAR_MIPMAP_LINEAR(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x2703));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE_MAG_FILTER(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x2800));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE_MIN_FILTER(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x2801));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE_WRAP_S(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x2802));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE_WRAP_T(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x2803));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1702));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE_CUBE_MAP(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8513));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE_BINDING_CUBE_MAP(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8514));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE_CUBE_MAP_POSITIVE_X(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8515));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE_CUBE_MAP_NEGATIVE_X(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8516));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE_CUBE_MAP_POSITIVE_Y(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8517));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE_CUBE_MAP_NEGATIVE_Y(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8518));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE_CUBE_MAP_POSITIVE_Z(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8519));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE_CUBE_MAP_NEGATIVE_Z(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x851A));
+}
+
+JSValue jsWebGLRenderingContextMAX_CUBE_MAP_TEXTURE_SIZE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x851C));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE0(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C0));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE1(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C1));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE2(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C2));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE3(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C3));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE4(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C4));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE5(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C5));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE6(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C6));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE7(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C7));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE8(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C8));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE9(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C9));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE10(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84CA));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE11(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84CB));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE12(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84CC));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE13(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84CD));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE14(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84CE));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE15(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84CF));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE16(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D0));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE17(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D1));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE18(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D2));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE19(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D3));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE20(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D4));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE21(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D5));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE22(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D6));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE23(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D7));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE24(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D8));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE25(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D9));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE26(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84DA));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE27(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84DB));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE28(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84DC));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE29(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84DD));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE30(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84DE));
+}
+
+JSValue jsWebGLRenderingContextTEXTURE31(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84DF));
+}
+
+JSValue jsWebGLRenderingContextACTIVE_TEXTURE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84E0));
+}
+
+JSValue jsWebGLRenderingContextREPEAT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x2901));
+}
+
+JSValue jsWebGLRenderingContextCLAMP_TO_EDGE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x812F));
+}
+
+JSValue jsWebGLRenderingContextMIRRORED_REPEAT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8370));
+}
+
+JSValue jsWebGLRenderingContextFLOAT_VEC2(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B50));
+}
+
+JSValue jsWebGLRenderingContextFLOAT_VEC3(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B51));
+}
+
+JSValue jsWebGLRenderingContextFLOAT_VEC4(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B52));
+}
+
+JSValue jsWebGLRenderingContextINT_VEC2(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B53));
+}
+
+JSValue jsWebGLRenderingContextINT_VEC3(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B54));
+}
+
+JSValue jsWebGLRenderingContextINT_VEC4(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B55));
+}
+
+JSValue jsWebGLRenderingContextBOOL(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B56));
+}
+
+JSValue jsWebGLRenderingContextBOOL_VEC2(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B57));
+}
+
+JSValue jsWebGLRenderingContextBOOL_VEC3(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B58));
+}
+
+JSValue jsWebGLRenderingContextBOOL_VEC4(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B59));
+}
+
+JSValue jsWebGLRenderingContextFLOAT_MAT2(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B5A));
+}
+
+JSValue jsWebGLRenderingContextFLOAT_MAT3(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B5B));
+}
+
+JSValue jsWebGLRenderingContextFLOAT_MAT4(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B5C));
+}
+
+JSValue jsWebGLRenderingContextSAMPLER_2D(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B5E));
+}
+
+JSValue jsWebGLRenderingContextSAMPLER_CUBE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B60));
+}
+
+JSValue jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_ENABLED(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8622));
+}
+
+JSValue jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_SIZE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8623));
+}
+
+JSValue jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_STRIDE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8624));
+}
+
+JSValue jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_TYPE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8625));
+}
+
+JSValue jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_NORMALIZED(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x886A));
+}
+
+JSValue jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_POINTER(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8645));
+}
+
+JSValue jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_BUFFER_BINDING(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x889F));
+}
+
+JSValue jsWebGLRenderingContextIMPLEMENTATION_COLOR_READ_TYPE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B9A));
+}
+
+JSValue jsWebGLRenderingContextIMPLEMENTATION_COLOR_READ_FORMAT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B9B));
+}
+
+JSValue jsWebGLRenderingContextCOMPILE_STATUS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B81));
+}
+
+JSValue jsWebGLRenderingContextINFO_LOG_LENGTH(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B84));
+}
+
+JSValue jsWebGLRenderingContextSHADER_SOURCE_LENGTH(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B88));
+}
+
+JSValue jsWebGLRenderingContextSHADER_COMPILER(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DFA));
+}
+
+JSValue jsWebGLRenderingContextSHADER_BINARY_FORMATS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF8));
+}
+
+JSValue jsWebGLRenderingContextNUM_SHADER_BINARY_FORMATS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF9));
+}
+
+JSValue jsWebGLRenderingContextLOW_FLOAT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF0));
+}
+
+JSValue jsWebGLRenderingContextMEDIUM_FLOAT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF1));
+}
+
+JSValue jsWebGLRenderingContextHIGH_FLOAT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF2));
+}
+
+JSValue jsWebGLRenderingContextLOW_INT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF3));
+}
+
+JSValue jsWebGLRenderingContextMEDIUM_INT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF4));
+}
+
+JSValue jsWebGLRenderingContextHIGH_INT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF5));
+}
+
+JSValue jsWebGLRenderingContextFRAMEBUFFER(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D40));
+}
+
+JSValue jsWebGLRenderingContextRENDERBUFFER(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D41));
+}
+
+JSValue jsWebGLRenderingContextRGBA4(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8056));
+}
+
+JSValue jsWebGLRenderingContextRGB5_A1(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8057));
+}
+
+JSValue jsWebGLRenderingContextRGB565(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D62));
+}
+
+JSValue jsWebGLRenderingContextDEPTH_COMPONENT16(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x81A5));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_INDEX(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x1901));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_INDEX8(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D48));
+}
+
+JSValue jsWebGLRenderingContextRENDERBUFFER_WIDTH(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D42));
+}
+
+JSValue jsWebGLRenderingContextRENDERBUFFER_HEIGHT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D43));
+}
+
+JSValue jsWebGLRenderingContextRENDERBUFFER_INTERNAL_FORMAT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D44));
+}
+
+JSValue jsWebGLRenderingContextRENDERBUFFER_RED_SIZE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D50));
+}
+
+JSValue jsWebGLRenderingContextRENDERBUFFER_GREEN_SIZE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D51));
+}
+
+JSValue jsWebGLRenderingContextRENDERBUFFER_BLUE_SIZE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D52));
+}
+
+JSValue jsWebGLRenderingContextRENDERBUFFER_ALPHA_SIZE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D53));
+}
+
+JSValue jsWebGLRenderingContextRENDERBUFFER_DEPTH_SIZE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D54));
+}
+
+JSValue jsWebGLRenderingContextRENDERBUFFER_STENCIL_SIZE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D55));
+}
+
+JSValue jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD0));
+}
+
+JSValue jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_OBJECT_NAME(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD1));
+}
+
+JSValue jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD2));
+}
+
+JSValue jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD3));
+}
+
+JSValue jsWebGLRenderingContextCOLOR_ATTACHMENT0(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CE0));
+}
+
+JSValue jsWebGLRenderingContextDEPTH_ATTACHMENT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D00));
+}
+
+JSValue jsWebGLRenderingContextSTENCIL_ATTACHMENT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D20));
+}
+
+JSValue jsWebGLRenderingContextNONE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsWebGLRenderingContextFRAMEBUFFER_COMPLETE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD5));
+}
+
+JSValue jsWebGLRenderingContextFRAMEBUFFER_INCOMPLETE_ATTACHMENT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD6));
+}
+
+JSValue jsWebGLRenderingContextFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD7));
+}
+
+JSValue jsWebGLRenderingContextFRAMEBUFFER_INCOMPLETE_DIMENSIONS(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD9));
+}
+
+JSValue jsWebGLRenderingContextFRAMEBUFFER_UNSUPPORTED(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CDD));
+}
+
+JSValue jsWebGLRenderingContextFRAMEBUFFER_BINDING(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CA6));
+}
+
+JSValue jsWebGLRenderingContextRENDERBUFFER_BINDING(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CA7));
+}
+
+JSValue jsWebGLRenderingContextMAX_RENDERBUFFER_SIZE(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x84E8));
+}
+
+JSValue jsWebGLRenderingContextINVALID_FRAMEBUFFER_OPERATION(ExecState* exec, JSValue, const Identifier&)
+{
+    return jsNumber(exec, static_cast<int>(0x0506));
+}
+
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLRenderingContext.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLRenderingContext.h
new file mode 100644
index 0000000000..a2560533f6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLRenderingContext.h
@@ -0,0 +1,546 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebGLRenderingContext_h
+#define JSWebGLRenderingContext_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasRenderingContext.h"
+
+namespace WebCore {
+
+class WebGLRenderingContext;
+
+class JSWebGLRenderingContext : public JSCanvasRenderingContext {
+    typedef JSCanvasRenderingContext Base;
+public:
+    JSWebGLRenderingContext(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLRenderingContext>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+
+    // Custom functions
+    JSC::JSValue bufferData(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue bufferSubData(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getBufferParameter(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getFramebufferAttachmentParameter(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getParameter(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getProgramParameter(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getRenderbufferParameter(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getShaderParameter(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getTexParameter(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getUniform(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getVertexAttrib(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue texImage2D(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue texSubImage2D(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform1fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform1iv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform2fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform2iv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform3fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform3iv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform4fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform4iv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniformMatrix2fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniformMatrix3fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniformMatrix4fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue vertexAttrib1fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue vertexAttrib2fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue vertexAttrib3fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue vertexAttrib4fv(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+
+class JSWebGLRenderingContextPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSWebGLRenderingContextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionSizeInBytes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionActiveTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionAttachShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBindAttribLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBindBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBindFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBindRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBindTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBlendColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBlendEquation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBlendEquationSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBlendFunc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBlendFuncSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBufferData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionBufferSubData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCheckFramebufferStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionClearColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionClearDepth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionClearStencil(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionColorMask(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCompileShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCopyTexImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCopyTexSubImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCreateBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCreateFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCreateProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCreateRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCreateShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCreateTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionCullFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDeleteBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDeleteFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDeleteProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDeleteRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDeleteShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDeleteTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDepthFunc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDepthMask(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDepthRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDetachShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDisable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDisableVertexAttribArray(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDrawArrays(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionDrawElements(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionEnable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionEnableVertexAttribArray(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionFinish(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionFlush(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionFramebufferRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionFramebufferTexture2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionFrontFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGenerateMipmap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetActiveAttrib(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetActiveUniform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetAttribLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetBufferParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetContextAttributes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetError(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetFramebufferAttachmentParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetProgramParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetProgramInfoLog(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetRenderbufferParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetShaderParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetShaderInfoLog(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetShaderSource(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetTexParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetUniform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetUniformLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetVertexAttrib(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionGetVertexAttribOffset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionHint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionIsBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionIsEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionIsFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionIsProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionIsRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionIsShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionIsTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionLineWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionLinkProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionPixelStorei(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionPolygonOffset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionReadPixels(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionReleaseShaderCompiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionRenderbufferStorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionSampleCoverage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionScissor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionShaderSource(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionStencilFunc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionStencilFuncSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionStencilMask(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionStencilMaskSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionStencilOp(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionStencilOpSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionTexParameterf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionTexParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionTexImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionTexSubImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform1f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform1fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform1i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform1iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform2f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform2fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform2i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform2iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform3f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform3fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform3i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform3iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform4f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform4fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform4i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniform4iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniformMatrix2fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniformMatrix3fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUniformMatrix4fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionUseProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionValidateProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib1f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib1fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib2f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib2fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib3f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib3fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib4f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttrib4fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionVertexAttribPointer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLRenderingContextPrototypeFunctionViewport(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsWebGLRenderingContextConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+// Constants
+
+JSC::JSValue jsWebGLRenderingContextDEPTH_BUFFER_BIT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_BUFFER_BIT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextCOLOR_BUFFER_BIT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFALSE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTRUE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextPOINTS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextLINES(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextLINE_LOOP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextLINE_STRIP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTRIANGLES(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTRIANGLE_STRIP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTRIANGLE_FAN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextZERO(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextONE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSRC_COLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextONE_MINUS_SRC_COLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSRC_ALPHA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextONE_MINUS_SRC_ALPHA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDST_ALPHA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextONE_MINUS_DST_ALPHA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDST_COLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextONE_MINUS_DST_COLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSRC_ALPHA_SATURATE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFUNC_ADD(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBLEND_EQUATION(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBLEND_EQUATION_RGB(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBLEND_EQUATION_ALPHA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFUNC_SUBTRACT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFUNC_REVERSE_SUBTRACT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBLEND_DST_RGB(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBLEND_SRC_RGB(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBLEND_DST_ALPHA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBLEND_SRC_ALPHA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextCONSTANT_COLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextONE_MINUS_CONSTANT_COLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextCONSTANT_ALPHA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextONE_MINUS_CONSTANT_ALPHA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBLEND_COLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextARRAY_BUFFER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextELEMENT_ARRAY_BUFFER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextARRAY_BUFFER_BINDING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextELEMENT_ARRAY_BUFFER_BINDING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTREAM_DRAW(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTATIC_DRAW(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDYNAMIC_DRAW(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBUFFER_SIZE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBUFFER_USAGE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextCURRENT_VERTEX_ATTRIB(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFRONT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBACK(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFRONT_AND_BACK(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE_2D(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextCULL_FACE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBLEND(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDITHER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_TEST(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDEPTH_TEST(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSCISSOR_TEST(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextPOLYGON_OFFSET_FILL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSAMPLE_ALPHA_TO_COVERAGE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSAMPLE_COVERAGE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextNO_ERROR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextINVALID_ENUM(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextINVALID_VALUE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextINVALID_OPERATION(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextOUT_OF_MEMORY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextCW(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextCCW(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextLINE_WIDTH(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextALIASED_POINT_SIZE_RANGE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextALIASED_LINE_WIDTH_RANGE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextCULL_FACE_MODE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFRONT_FACE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDEPTH_RANGE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDEPTH_WRITEMASK(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDEPTH_CLEAR_VALUE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDEPTH_FUNC(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_CLEAR_VALUE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_FUNC(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_FAIL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_PASS_DEPTH_FAIL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_PASS_DEPTH_PASS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_REF(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_VALUE_MASK(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_WRITEMASK(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_BACK_FUNC(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_BACK_FAIL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_BACK_PASS_DEPTH_FAIL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_BACK_PASS_DEPTH_PASS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_BACK_REF(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_BACK_VALUE_MASK(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_BACK_WRITEMASK(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextVIEWPORT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSCISSOR_BOX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextCOLOR_CLEAR_VALUE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextCOLOR_WRITEMASK(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextUNPACK_ALIGNMENT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextPACK_ALIGNMENT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextMAX_TEXTURE_SIZE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextMAX_VIEWPORT_DIMS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSUBPIXEL_BITS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRED_BITS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextGREEN_BITS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBLUE_BITS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextALPHA_BITS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDEPTH_BITS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_BITS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextPOLYGON_OFFSET_UNITS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextPOLYGON_OFFSET_FACTOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE_BINDING_2D(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSAMPLE_BUFFERS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSAMPLES(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSAMPLE_COVERAGE_VALUE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSAMPLE_COVERAGE_INVERT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextNUM_COMPRESSED_TEXTURE_FORMATS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextCOMPRESSED_TEXTURE_FORMATS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDONT_CARE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFASTEST(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextNICEST(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextGENERATE_MIPMAP_HINT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBYTE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextUNSIGNED_BYTE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSHORT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextUNSIGNED_SHORT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextINT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextUNSIGNED_INT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFLOAT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFIXED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDEPTH_COMPONENT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextALPHA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRGB(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRGBA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextLUMINANCE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextLUMINANCE_ALPHA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextUNSIGNED_SHORT_4_4_4_4(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextUNSIGNED_SHORT_5_5_5_1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextUNSIGNED_SHORT_5_6_5(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFRAGMENT_SHADER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextVERTEX_SHADER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextMAX_VERTEX_ATTRIBS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextMAX_VERTEX_UNIFORM_VECTORS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextMAX_VARYING_VECTORS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextMAX_COMBINED_TEXTURE_IMAGE_UNITS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextMAX_VERTEX_TEXTURE_IMAGE_UNITS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextMAX_TEXTURE_IMAGE_UNITS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextMAX_FRAGMENT_UNIFORM_VECTORS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSHADER_TYPE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDELETE_STATUS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextLINK_STATUS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextVALIDATE_STATUS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextATTACHED_SHADERS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextACTIVE_UNIFORMS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextACTIVE_UNIFORM_MAX_LENGTH(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextACTIVE_ATTRIBUTES(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextACTIVE_ATTRIBUTE_MAX_LENGTH(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSHADING_LANGUAGE_VERSION(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextCURRENT_PROGRAM(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextNEVER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextLESS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextEQUAL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextLEQUAL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextGREATER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextNOTEQUAL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextGEQUAL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextALWAYS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextKEEP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextREPLACE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextINCR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDECR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextINVERT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextINCR_WRAP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDECR_WRAP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextVENDOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRENDERER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextVERSION(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextEXTENSIONS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextNEAREST(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextLINEAR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextNEAREST_MIPMAP_NEAREST(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextLINEAR_MIPMAP_NEAREST(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextNEAREST_MIPMAP_LINEAR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextLINEAR_MIPMAP_LINEAR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE_MAG_FILTER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE_MIN_FILTER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE_WRAP_S(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE_WRAP_T(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE_CUBE_MAP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE_BINDING_CUBE_MAP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE_CUBE_MAP_POSITIVE_X(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE_CUBE_MAP_NEGATIVE_X(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE_CUBE_MAP_POSITIVE_Y(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE_CUBE_MAP_NEGATIVE_Y(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE_CUBE_MAP_POSITIVE_Z(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE_CUBE_MAP_NEGATIVE_Z(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextMAX_CUBE_MAP_TEXTURE_SIZE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE0(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE3(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE4(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE5(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE6(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE7(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE8(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE9(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE10(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE11(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE12(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE13(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE14(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE15(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE16(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE17(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE18(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE19(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE20(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE21(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE22(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE23(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE24(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE25(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE26(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE27(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE28(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE29(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE30(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextTEXTURE31(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextACTIVE_TEXTURE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextREPEAT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextCLAMP_TO_EDGE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextMIRRORED_REPEAT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFLOAT_VEC2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFLOAT_VEC3(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFLOAT_VEC4(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextINT_VEC2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextINT_VEC3(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextINT_VEC4(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBOOL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBOOL_VEC2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBOOL_VEC3(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextBOOL_VEC4(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFLOAT_MAT2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFLOAT_MAT3(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFLOAT_MAT4(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSAMPLER_2D(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSAMPLER_CUBE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_ENABLED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_SIZE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_STRIDE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_TYPE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_NORMALIZED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_POINTER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextVERTEX_ATTRIB_ARRAY_BUFFER_BINDING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextIMPLEMENTATION_COLOR_READ_TYPE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextIMPLEMENTATION_COLOR_READ_FORMAT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextCOMPILE_STATUS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextINFO_LOG_LENGTH(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSHADER_SOURCE_LENGTH(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSHADER_COMPILER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSHADER_BINARY_FORMATS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextNUM_SHADER_BINARY_FORMATS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextLOW_FLOAT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextMEDIUM_FLOAT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextHIGH_FLOAT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextLOW_INT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextMEDIUM_INT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextHIGH_INT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFRAMEBUFFER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRENDERBUFFER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRGBA4(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRGB5_A1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRGB565(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDEPTH_COMPONENT16(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_INDEX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_INDEX8(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRENDERBUFFER_WIDTH(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRENDERBUFFER_HEIGHT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRENDERBUFFER_INTERNAL_FORMAT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRENDERBUFFER_RED_SIZE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRENDERBUFFER_GREEN_SIZE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRENDERBUFFER_BLUE_SIZE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRENDERBUFFER_ALPHA_SIZE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRENDERBUFFER_DEPTH_SIZE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRENDERBUFFER_STENCIL_SIZE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_OBJECT_NAME(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextCOLOR_ATTACHMENT0(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextDEPTH_ATTACHMENT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextSTENCIL_ATTACHMENT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextNONE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFRAMEBUFFER_COMPLETE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFRAMEBUFFER_INCOMPLETE_ATTACHMENT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFRAMEBUFFER_INCOMPLETE_DIMENSIONS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFRAMEBUFFER_UNSUPPORTED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextFRAMEBUFFER_BINDING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextRENDERBUFFER_BINDING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextMAX_RENDERBUFFER_SIZE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebGLRenderingContextINVALID_FRAMEBUFFER_OPERATION(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLShader.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLShader.cpp
new file mode 100644
index 0000000000..a735a879dc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLShader.cpp
@@ -0,0 +1,86 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLShader.h"
+
+#include "WebGLShader.h"
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLShader);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLShaderPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLShaderPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSWebGLShaderPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSWebGLShaderPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLShaderPrototype::s_info = { "WebGLShaderPrototype", 0, &JSWebGLShaderPrototypeTable, 0 };
+
+JSObject* JSWebGLShaderPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLShader>(exec, globalObject);
+}
+
+const ClassInfo JSWebGLShader::s_info = { "WebGLShader", 0, 0, 0 };
+
+JSWebGLShader::JSWebGLShader(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLShader> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSWebGLShader::~JSWebGLShader()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSWebGLShader::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLShaderPrototype(JSWebGLShaderPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLShader* object)
+{
+    return getDOMObjectWrapper<JSWebGLShader>(exec, globalObject, object);
+}
+WebGLShader* toWebGLShader(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLShader::s_info) ? static_cast<JSWebGLShader*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLShader.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLShader.h
new file mode 100644
index 0000000000..ab165611d9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLShader.h
@@ -0,0 +1,79 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebGLShader_h
+#define JSWebGLShader_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class WebGLShader;
+
+class JSWebGLShader : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSWebGLShader(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLShader>);
+    virtual ~JSWebGLShader();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    WebGLShader* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<WebGLShader> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLShader*);
+WebGLShader* toWebGLShader(JSC::JSValue);
+
+class JSWebGLShaderPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSWebGLShaderPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLShortArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLShortArray.cpp
new file mode 100644
index 0000000000..26dbafe393
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLShortArray.cpp
@@ -0,0 +1,174 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLShortArray.h"
+
+#include "WebGLShortArray.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLShortArray);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLShortArrayPrototypeTableValues[3] =
+{
+    { "get", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLShortArrayPrototypeFunctionGet), (intptr_t)1 },
+    { "set", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLShortArrayPrototypeFunctionSet), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLShortArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 3, JSWebGLShortArrayPrototypeTableValues, 0 };
+#else
+    { 4, 3, JSWebGLShortArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLShortArrayPrototype::s_info = { "WebGLShortArrayPrototype", 0, &JSWebGLShortArrayPrototypeTable, 0 };
+
+JSObject* JSWebGLShortArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLShortArray>(exec, globalObject);
+}
+
+bool JSWebGLShortArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSWebGLShortArrayPrototypeTable, this, propertyName, slot);
+}
+
+bool JSWebGLShortArrayPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSWebGLShortArrayPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSWebGLShortArray::s_info = { "WebGLShortArray", &JSWebGLArray::s_info, 0, 0 };
+
+JSWebGLShortArray::JSWebGLShortArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLShortArray> impl)
+    : JSWebGLArray(structure, globalObject, impl)
+{
+}
+
+JSObject* JSWebGLShortArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLShortArrayPrototype(JSWebGLShortArrayPrototype::createStructure(JSWebGLArrayPrototype::self(exec, globalObject)));
+}
+
+bool JSWebGLShortArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebGLShortArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, index));
+        return true;
+    }
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+bool JSWebGLShortArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebGLShortArray*>(impl())->length()) {
+        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
+        return true;
+    }
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+bool JSWebGLShortArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<WebGLShortArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, propertyName));
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+void JSWebGLShortArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok) {
+        indexSetter(exec, index, value);
+        return;
+    }
+    Base::put(exec, propertyName, value, slot);
+}
+
+void JSWebGLShortArray::put(ExecState* exec, unsigned propertyName, JSValue value)
+{
+    indexSetter(exec, propertyName, value);
+    return;
+}
+
+void JSWebGLShortArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    for (unsigned i = 0; i < static_cast<WebGLShortArray*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+JSValue JSC_HOST_CALL jsWebGLShortArrayPrototypeFunctionGet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLShortArray::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLShortArray* castedThisObj = static_cast<JSWebGLShortArray*>(asObject(thisValue));
+    WebGLShortArray* imp = static_cast<WebGLShortArray*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->get(index));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLShortArrayPrototypeFunctionSet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLShortArray::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLShortArray* castedThisObj = static_cast<JSWebGLShortArray*>(asObject(thisValue));
+    return castedThisObj->set(exec, args);
+}
+
+
+JSValue JSWebGLShortArray::getByIndex(ExecState* exec, unsigned index)
+{
+    return jsNumber(exec, static_cast<WebGLShortArray*>(impl())->item(index));
+}
+WebGLShortArray* toWebGLShortArray(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLShortArray::s_info) ? static_cast<JSWebGLShortArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLShortArray.h
index c96508e70f..26c53df705 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLShortArray.h
@@ -18,22 +18,22 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef JSCanvasFloatArray_h
-#define JSCanvasFloatArray_h
+#ifndef JSWebGLShortArray_h
+#define JSWebGLShortArray_h
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasFloatArray.h"
-#include "JSCanvasArray.h"
+#include "JSWebGLArray.h"
+#include "WebGLShortArray.h"
 
 namespace WebCore {
 
-class CanvasFloatArray;
+class WebGLShortArray;
 
-class JSCanvasFloatArray : public JSCanvasArray {
-    typedef JSCanvasArray Base;
+class JSWebGLShortArray : public JSWebGLArray {
+    typedef JSWebGLArray Base;
 public:
-    JSCanvasFloatArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasFloatArray>);
+    JSWebGLShortArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLShortArray>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -45,13 +45,16 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    CanvasFloatArray* impl() const
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
+
+    // Custom functions
+    JSC::JSValue set(JSC::ExecState*, const JSC::ArgList&);
+    WebGLShortArray* impl() const
     {
-        return static_cast<CanvasFloatArray*>(Base::impl());
+        return static_cast<WebGLShortArray*>(Base::impl());
     }
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
@@ -59,24 +62,30 @@ protected:
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasFloatArray*);
-CanvasFloatArray* toCanvasFloatArray(JSC::JSValue);
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLShortArray*);
+WebGLShortArray* toWebGLShortArray(JSC::JSValue);
 
-class JSCanvasFloatArrayPrototype : public JSC::JSObject {
+class JSWebGLShortArrayPrototype : public JSC::JSObject {
     typedef JSC::JSObject Base;
 public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
-    JSCanvasFloatArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+    JSWebGLShortArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsWebGLShortArrayPrototypeFunctionGet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLShortArrayPrototypeFunctionSet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLTexture.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLTexture.cpp
new file mode 100644
index 0000000000..a15556a42c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLTexture.cpp
@@ -0,0 +1,86 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLTexture.h"
+
+#include "WebGLTexture.h"
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLTexture);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLTexturePrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLTexturePrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSWebGLTexturePrototypeTableValues, 0 };
+#else
+    { 1, 0, JSWebGLTexturePrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLTexturePrototype::s_info = { "WebGLTexturePrototype", 0, &JSWebGLTexturePrototypeTable, 0 };
+
+JSObject* JSWebGLTexturePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLTexture>(exec, globalObject);
+}
+
+const ClassInfo JSWebGLTexture::s_info = { "WebGLTexture", 0, 0, 0 };
+
+JSWebGLTexture::JSWebGLTexture(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLTexture> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSWebGLTexture::~JSWebGLTexture()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSWebGLTexture::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLTexturePrototype(JSWebGLTexturePrototype::createStructure(globalObject->objectPrototype()));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLTexture* object)
+{
+    return getDOMObjectWrapper<JSWebGLTexture>(exec, globalObject, object);
+}
+WebGLTexture* toWebGLTexture(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLTexture::s_info) ? static_cast<JSWebGLTexture*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLTexture.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLTexture.h
new file mode 100644
index 0000000000..05ca40c848
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLTexture.h
@@ -0,0 +1,79 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebGLTexture_h
+#define JSWebGLTexture_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class WebGLTexture;
+
+class JSWebGLTexture : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSWebGLTexture(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLTexture>);
+    virtual ~JSWebGLTexture();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    WebGLTexture* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<WebGLTexture> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLTexture*);
+WebGLTexture* toWebGLTexture(JSC::JSValue);
+
+class JSWebGLTexturePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSWebGLTexturePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLUniformLocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLUniformLocation.cpp
new file mode 100644
index 0000000000..32aa778efb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLUniformLocation.cpp
@@ -0,0 +1,86 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLUniformLocation.h"
+
+#include "WebGLUniformLocation.h"
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLUniformLocation);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLUniformLocationPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLUniformLocationPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSWebGLUniformLocationPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSWebGLUniformLocationPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLUniformLocationPrototype::s_info = { "WebGLUniformLocationPrototype", 0, &JSWebGLUniformLocationPrototypeTable, 0 };
+
+JSObject* JSWebGLUniformLocationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLUniformLocation>(exec, globalObject);
+}
+
+const ClassInfo JSWebGLUniformLocation::s_info = { "WebGLUniformLocation", 0, 0, 0 };
+
+JSWebGLUniformLocation::JSWebGLUniformLocation(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLUniformLocation> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSWebGLUniformLocation::~JSWebGLUniformLocation()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSWebGLUniformLocation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLUniformLocationPrototype(JSWebGLUniformLocationPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUniformLocation* object)
+{
+    return getDOMObjectWrapper<JSWebGLUniformLocation>(exec, globalObject, object);
+}
+WebGLUniformLocation* toWebGLUniformLocation(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLUniformLocation::s_info) ? static_cast<JSWebGLUniformLocation*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLUniformLocation.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLUniformLocation.h
new file mode 100644
index 0000000000..9d6a589905
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLUniformLocation.h
@@ -0,0 +1,79 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebGLUniformLocation_h
+#define JSWebGLUniformLocation_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class WebGLUniformLocation;
+
+class JSWebGLUniformLocation : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSWebGLUniformLocation(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLUniformLocation>);
+    virtual ~JSWebGLUniformLocation();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    WebGLUniformLocation* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<WebGLUniformLocation> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLUniformLocation*);
+WebGLUniformLocation* toWebGLUniformLocation(JSC::JSValue);
+
+class JSWebGLUniformLocationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSWebGLUniformLocationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedByteArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedByteArray.cpp
new file mode 100644
index 0000000000..8d41915ea3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedByteArray.cpp
@@ -0,0 +1,174 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLUnsignedByteArray.h"
+
+#include "WebGLUnsignedByteArray.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLUnsignedByteArray);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLUnsignedByteArrayPrototypeTableValues[3] =
+{
+    { "get", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLUnsignedByteArrayPrototypeFunctionGet), (intptr_t)1 },
+    { "set", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLUnsignedByteArrayPrototypeFunctionSet), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLUnsignedByteArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 3, JSWebGLUnsignedByteArrayPrototypeTableValues, 0 };
+#else
+    { 4, 3, JSWebGLUnsignedByteArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLUnsignedByteArrayPrototype::s_info = { "WebGLUnsignedByteArrayPrototype", 0, &JSWebGLUnsignedByteArrayPrototypeTable, 0 };
+
+JSObject* JSWebGLUnsignedByteArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLUnsignedByteArray>(exec, globalObject);
+}
+
+bool JSWebGLUnsignedByteArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSWebGLUnsignedByteArrayPrototypeTable, this, propertyName, slot);
+}
+
+bool JSWebGLUnsignedByteArrayPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSWebGLUnsignedByteArrayPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSWebGLUnsignedByteArray::s_info = { "WebGLUnsignedByteArray", &JSWebGLArray::s_info, 0, 0 };
+
+JSWebGLUnsignedByteArray::JSWebGLUnsignedByteArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLUnsignedByteArray> impl)
+    : JSWebGLArray(structure, globalObject, impl)
+{
+}
+
+JSObject* JSWebGLUnsignedByteArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLUnsignedByteArrayPrototype(JSWebGLUnsignedByteArrayPrototype::createStructure(JSWebGLArrayPrototype::self(exec, globalObject)));
+}
+
+bool JSWebGLUnsignedByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebGLUnsignedByteArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, index));
+        return true;
+    }
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+bool JSWebGLUnsignedByteArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebGLUnsignedByteArray*>(impl())->length()) {
+        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
+        return true;
+    }
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+bool JSWebGLUnsignedByteArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<WebGLUnsignedByteArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, propertyName));
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+void JSWebGLUnsignedByteArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok) {
+        indexSetter(exec, index, value);
+        return;
+    }
+    Base::put(exec, propertyName, value, slot);
+}
+
+void JSWebGLUnsignedByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
+{
+    indexSetter(exec, propertyName, value);
+    return;
+}
+
+void JSWebGLUnsignedByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    for (unsigned i = 0; i < static_cast<WebGLUnsignedByteArray*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+JSValue JSC_HOST_CALL jsWebGLUnsignedByteArrayPrototypeFunctionGet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLUnsignedByteArray::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLUnsignedByteArray* castedThisObj = static_cast<JSWebGLUnsignedByteArray*>(asObject(thisValue));
+    WebGLUnsignedByteArray* imp = static_cast<WebGLUnsignedByteArray*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->get(index));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLUnsignedByteArrayPrototypeFunctionSet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLUnsignedByteArray::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLUnsignedByteArray* castedThisObj = static_cast<JSWebGLUnsignedByteArray*>(asObject(thisValue));
+    return castedThisObj->set(exec, args);
+}
+
+
+JSValue JSWebGLUnsignedByteArray::getByIndex(ExecState* exec, unsigned index)
+{
+    return jsNumber(exec, static_cast<WebGLUnsignedByteArray*>(impl())->item(index));
+}
+WebGLUnsignedByteArray* toWebGLUnsignedByteArray(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLUnsignedByteArray::s_info) ? static_cast<JSWebGLUnsignedByteArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedByteArray.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedByteArray.h
new file mode 100644
index 0000000000..d36e6e7361
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedByteArray.h
@@ -0,0 +1,94 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebGLUnsignedByteArray_h
+#define JSWebGLUnsignedByteArray_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArray.h"
+#include "WebGLUnsignedByteArray.h"
+
+namespace WebCore {
+
+class WebGLUnsignedByteArray;
+
+class JSWebGLUnsignedByteArray : public JSWebGLArray {
+    typedef JSWebGLArray Base;
+public:
+    JSWebGLUnsignedByteArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLUnsignedByteArray>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
+
+    // Custom functions
+    JSC::JSValue set(JSC::ExecState*, const JSC::ArgList&);
+    WebGLUnsignedByteArray* impl() const
+    {
+        return static_cast<WebGLUnsignedByteArray*>(Base::impl());
+    }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
+    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLUnsignedByteArray*);
+WebGLUnsignedByteArray* toWebGLUnsignedByteArray(JSC::JSValue);
+
+class JSWebGLUnsignedByteArrayPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSWebGLUnsignedByteArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsWebGLUnsignedByteArrayPrototypeFunctionGet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLUnsignedByteArrayPrototypeFunctionSet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedIntArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedIntArray.cpp
new file mode 100644
index 0000000000..6e3a402199
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedIntArray.cpp
@@ -0,0 +1,174 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLUnsignedIntArray.h"
+
+#include "WebGLUnsignedIntArray.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLUnsignedIntArray);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLUnsignedIntArrayPrototypeTableValues[3] =
+{
+    { "get", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLUnsignedIntArrayPrototypeFunctionGet), (intptr_t)1 },
+    { "set", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLUnsignedIntArrayPrototypeFunctionSet), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLUnsignedIntArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 3, JSWebGLUnsignedIntArrayPrototypeTableValues, 0 };
+#else
+    { 4, 3, JSWebGLUnsignedIntArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLUnsignedIntArrayPrototype::s_info = { "WebGLUnsignedIntArrayPrototype", 0, &JSWebGLUnsignedIntArrayPrototypeTable, 0 };
+
+JSObject* JSWebGLUnsignedIntArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLUnsignedIntArray>(exec, globalObject);
+}
+
+bool JSWebGLUnsignedIntArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSWebGLUnsignedIntArrayPrototypeTable, this, propertyName, slot);
+}
+
+bool JSWebGLUnsignedIntArrayPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSWebGLUnsignedIntArrayPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSWebGLUnsignedIntArray::s_info = { "WebGLUnsignedIntArray", &JSWebGLArray::s_info, 0, 0 };
+
+JSWebGLUnsignedIntArray::JSWebGLUnsignedIntArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLUnsignedIntArray> impl)
+    : JSWebGLArray(structure, globalObject, impl)
+{
+}
+
+JSObject* JSWebGLUnsignedIntArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLUnsignedIntArrayPrototype(JSWebGLUnsignedIntArrayPrototype::createStructure(JSWebGLArrayPrototype::self(exec, globalObject)));
+}
+
+bool JSWebGLUnsignedIntArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebGLUnsignedIntArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, index));
+        return true;
+    }
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+bool JSWebGLUnsignedIntArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebGLUnsignedIntArray*>(impl())->length()) {
+        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
+        return true;
+    }
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+bool JSWebGLUnsignedIntArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<WebGLUnsignedIntArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, propertyName));
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+void JSWebGLUnsignedIntArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok) {
+        indexSetter(exec, index, value);
+        return;
+    }
+    Base::put(exec, propertyName, value, slot);
+}
+
+void JSWebGLUnsignedIntArray::put(ExecState* exec, unsigned propertyName, JSValue value)
+{
+    indexSetter(exec, propertyName, value);
+    return;
+}
+
+void JSWebGLUnsignedIntArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    for (unsigned i = 0; i < static_cast<WebGLUnsignedIntArray*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+JSValue JSC_HOST_CALL jsWebGLUnsignedIntArrayPrototypeFunctionGet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLUnsignedIntArray::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLUnsignedIntArray* castedThisObj = static_cast<JSWebGLUnsignedIntArray*>(asObject(thisValue));
+    WebGLUnsignedIntArray* imp = static_cast<WebGLUnsignedIntArray*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->get(index));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLUnsignedIntArrayPrototypeFunctionSet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLUnsignedIntArray::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLUnsignedIntArray* castedThisObj = static_cast<JSWebGLUnsignedIntArray*>(asObject(thisValue));
+    return castedThisObj->set(exec, args);
+}
+
+
+JSValue JSWebGLUnsignedIntArray::getByIndex(ExecState* exec, unsigned index)
+{
+    return jsNumber(exec, static_cast<WebGLUnsignedIntArray*>(impl())->item(index));
+}
+WebGLUnsignedIntArray* toWebGLUnsignedIntArray(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLUnsignedIntArray::s_info) ? static_cast<JSWebGLUnsignedIntArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedIntArray.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedIntArray.h
new file mode 100644
index 0000000000..688931beb8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedIntArray.h
@@ -0,0 +1,94 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebGLUnsignedIntArray_h
+#define JSWebGLUnsignedIntArray_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArray.h"
+#include "WebGLUnsignedIntArray.h"
+
+namespace WebCore {
+
+class WebGLUnsignedIntArray;
+
+class JSWebGLUnsignedIntArray : public JSWebGLArray {
+    typedef JSWebGLArray Base;
+public:
+    JSWebGLUnsignedIntArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLUnsignedIntArray>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
+
+    // Custom functions
+    JSC::JSValue set(JSC::ExecState*, const JSC::ArgList&);
+    WebGLUnsignedIntArray* impl() const
+    {
+        return static_cast<WebGLUnsignedIntArray*>(Base::impl());
+    }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
+    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLUnsignedIntArray*);
+WebGLUnsignedIntArray* toWebGLUnsignedIntArray(JSC::JSValue);
+
+class JSWebGLUnsignedIntArrayPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSWebGLUnsignedIntArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsWebGLUnsignedIntArrayPrototypeFunctionGet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLUnsignedIntArrayPrototypeFunctionSet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedShortArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedShortArray.cpp
new file mode 100644
index 0000000000..ddc5b63521
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedShortArray.cpp
@@ -0,0 +1,174 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLUnsignedShortArray.h"
+
+#include "WebGLUnsignedShortArray.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebGLUnsignedShortArray);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebGLUnsignedShortArrayPrototypeTableValues[3] =
+{
+    { "get", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLUnsignedShortArrayPrototypeFunctionGet), (intptr_t)1 },
+    { "set", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebGLUnsignedShortArrayPrototypeFunctionSet), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebGLUnsignedShortArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 3, JSWebGLUnsignedShortArrayPrototypeTableValues, 0 };
+#else
+    { 4, 3, JSWebGLUnsignedShortArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebGLUnsignedShortArrayPrototype::s_info = { "WebGLUnsignedShortArrayPrototype", 0, &JSWebGLUnsignedShortArrayPrototypeTable, 0 };
+
+JSObject* JSWebGLUnsignedShortArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebGLUnsignedShortArray>(exec, globalObject);
+}
+
+bool JSWebGLUnsignedShortArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSWebGLUnsignedShortArrayPrototypeTable, this, propertyName, slot);
+}
+
+bool JSWebGLUnsignedShortArrayPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSWebGLUnsignedShortArrayPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSWebGLUnsignedShortArray::s_info = { "WebGLUnsignedShortArray", &JSWebGLArray::s_info, 0, 0 };
+
+JSWebGLUnsignedShortArray::JSWebGLUnsignedShortArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebGLUnsignedShortArray> impl)
+    : JSWebGLArray(structure, globalObject, impl)
+{
+}
+
+JSObject* JSWebGLUnsignedShortArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebGLUnsignedShortArrayPrototype(JSWebGLUnsignedShortArrayPrototype::createStructure(JSWebGLArrayPrototype::self(exec, globalObject)));
+}
+
+bool JSWebGLUnsignedShortArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebGLUnsignedShortArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, index));
+        return true;
+    }
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+bool JSWebGLUnsignedShortArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebGLUnsignedShortArray*>(impl())->length()) {
+        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
+        return true;
+    }
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+bool JSWebGLUnsignedShortArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<WebGLUnsignedShortArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, propertyName));
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+void JSWebGLUnsignedShortArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok) {
+        indexSetter(exec, index, value);
+        return;
+    }
+    Base::put(exec, propertyName, value, slot);
+}
+
+void JSWebGLUnsignedShortArray::put(ExecState* exec, unsigned propertyName, JSValue value)
+{
+    indexSetter(exec, propertyName, value);
+    return;
+}
+
+void JSWebGLUnsignedShortArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    for (unsigned i = 0; i < static_cast<WebGLUnsignedShortArray*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+JSValue JSC_HOST_CALL jsWebGLUnsignedShortArrayPrototypeFunctionGet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLUnsignedShortArray::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLUnsignedShortArray* castedThisObj = static_cast<JSWebGLUnsignedShortArray*>(asObject(thisValue));
+    WebGLUnsignedShortArray* imp = static_cast<WebGLUnsignedShortArray*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->get(index));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebGLUnsignedShortArrayPrototypeFunctionSet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebGLUnsignedShortArray::s_info))
+        return throwError(exec, TypeError);
+    JSWebGLUnsignedShortArray* castedThisObj = static_cast<JSWebGLUnsignedShortArray*>(asObject(thisValue));
+    return castedThisObj->set(exec, args);
+}
+
+
+JSValue JSWebGLUnsignedShortArray::getByIndex(ExecState* exec, unsigned index)
+{
+    return jsNumber(exec, static_cast<WebGLUnsignedShortArray*>(impl())->item(index));
+}
+WebGLUnsignedShortArray* toWebGLUnsignedShortArray(JSC::JSValue value)
+{
+    return value.inherits(&JSWebGLUnsignedShortArray::s_info) ? static_cast<JSWebGLUnsignedShortArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h b/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedShortArray.h
index ccfaef6264..533b7ae814 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebGLUnsignedShortArray.h
@@ -18,22 +18,22 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef JSCanvasUnsignedByteArray_h
-#define JSCanvasUnsignedByteArray_h
+#ifndef JSWebGLUnsignedShortArray_h
+#define JSWebGLUnsignedShortArray_h
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasUnsignedByteArray.h"
-#include "JSCanvasArray.h"
+#include "JSWebGLArray.h"
+#include "WebGLUnsignedShortArray.h"
 
 namespace WebCore {
 
-class CanvasUnsignedByteArray;
+class WebGLUnsignedShortArray;
 
-class JSCanvasUnsignedByteArray : public JSCanvasArray {
-    typedef JSCanvasArray Base;
+class JSWebGLUnsignedShortArray : public JSWebGLArray {
+    typedef JSWebGLArray Base;
 public:
-    JSCanvasUnsignedByteArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasUnsignedByteArray>);
+    JSWebGLUnsignedShortArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebGLUnsignedShortArray>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -45,13 +45,16 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    CanvasUnsignedByteArray* impl() const
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
+
+    // Custom functions
+    JSC::JSValue set(JSC::ExecState*, const JSC::ArgList&);
+    WebGLUnsignedShortArray* impl() const
     {
-        return static_cast<CanvasUnsignedByteArray*>(Base::impl());
+        return static_cast<WebGLUnsignedShortArray*>(Base::impl());
     }
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
@@ -59,24 +62,30 @@ protected:
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasUnsignedByteArray*);
-CanvasUnsignedByteArray* toCanvasUnsignedByteArray(JSC::JSValue);
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebGLUnsignedShortArray*);
+WebGLUnsignedShortArray* toWebGLUnsignedShortArray(JSC::JSValue);
 
-class JSCanvasUnsignedByteArrayPrototype : public JSC::JSObject {
+class JSWebGLUnsignedShortArrayPrototype : public JSC::JSObject {
     typedef JSC::JSObject Base;
 public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
-    JSCanvasUnsignedByteArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+    JSWebGLUnsignedShortArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsWebGLUnsignedShortArrayPrototypeFunctionGet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebGLUnsignedShortArrayPrototypeFunctionSet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
index e5a38924d2..0f4e977c19 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
@@ -38,9 +38,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSWebKitAnimationEvent);
 
 static const HashTableValue JSWebKitAnimationEventTableValues[4] =
 {
-    { "animationName", DontDelete|ReadOnly, (intptr_t)jsWebKitAnimationEventAnimationName, (intptr_t)0 },
-    { "elapsedTime", DontDelete|ReadOnly, (intptr_t)jsWebKitAnimationEventElapsedTime, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsWebKitAnimationEventConstructor, (intptr_t)0 },
+    { "animationName", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitAnimationEventAnimationName), (intptr_t)0 },
+    { "elapsedTime", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitAnimationEventElapsedTime), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitAnimationEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -102,7 +102,7 @@ bool JSWebKitAnimationEventConstructor::getOwnPropertyDescriptor(ExecState* exec
 
 static const HashTableValue JSWebKitAnimationEventPrototypeTableValues[2] =
 {
-    { "initWebKitAnimationEvent", DontDelete|Function, (intptr_t)jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEvent, (intptr_t)5 },
+    { "initWebKitAnimationEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEvent), (intptr_t)5 },
     { 0, 0, 0, 0 }
 };
 
@@ -152,25 +152,27 @@ bool JSWebKitAnimationEvent::getOwnPropertyDescriptor(ExecState* exec, const Ide
     return getStaticValueDescriptor<JSWebKitAnimationEvent, Base>(exec, &JSWebKitAnimationEventTable, this, propertyName, descriptor);
 }
 
-JSValue jsWebKitAnimationEventAnimationName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitAnimationEventAnimationName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitAnimationEvent* castedThis = static_cast<JSWebKitAnimationEvent*>(asObject(slot.slotBase()));
+    JSWebKitAnimationEvent* castedThis = static_cast<JSWebKitAnimationEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitAnimationEvent* imp = static_cast<WebKitAnimationEvent*>(castedThis->impl());
-    return jsString(exec, imp->animationName());
+    JSValue result = jsString(exec, imp->animationName());
+    return result;
 }
 
-JSValue jsWebKitAnimationEventElapsedTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitAnimationEventElapsedTime(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitAnimationEvent* castedThis = static_cast<JSWebKitAnimationEvent*>(asObject(slot.slotBase()));
+    JSWebKitAnimationEvent* castedThis = static_cast<JSWebKitAnimationEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitAnimationEvent* imp = static_cast<WebKitAnimationEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->elapsedTime());
+    JSValue result = jsNumber(exec, imp->elapsedTime());
+    return result;
 }
 
-JSValue jsWebKitAnimationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitAnimationEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitAnimationEvent* domObject = static_cast<JSWebKitAnimationEvent*>(asObject(slot.slotBase()));
+    JSWebKitAnimationEvent* domObject = static_cast<JSWebKitAnimationEvent*>(asObject(slotBase));
     return JSWebKitAnimationEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSWebKitAnimationEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
index e4e622a0a6..bd8b91c031 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSWebKitAnimationEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -70,9 +70,9 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsWebKitAnimationEventAnimationName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitAnimationEventElapsedTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitAnimationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitAnimationEventAnimationName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitAnimationEventElapsedTime(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitAnimationEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
index e801d631c4..9ba081dca6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
@@ -39,9 +39,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSKeyframeRule);
 
 static const HashTableValue JSWebKitCSSKeyframeRuleTableValues[4] =
 {
-    { "keyText", DontDelete, (intptr_t)jsWebKitCSSKeyframeRuleKeyText, (intptr_t)setJSWebKitCSSKeyframeRuleKeyText },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSKeyframeRuleStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsWebKitCSSKeyframeRuleConstructor, (intptr_t)0 },
+    { "keyText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSKeyframeRuleKeyText), (intptr_t)setJSWebKitCSSKeyframeRuleKeyText },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSKeyframeRuleStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSKeyframeRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -142,25 +142,27 @@ bool JSWebKitCSSKeyframeRule::getOwnPropertyDescriptor(ExecState* exec, const Id
     return getStaticValueDescriptor<JSWebKitCSSKeyframeRule, Base>(exec, &JSWebKitCSSKeyframeRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsWebKitCSSKeyframeRuleKeyText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframeRuleKeyText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSKeyframeRule* castedThis = static_cast<JSWebKitCSSKeyframeRule*>(asObject(slot.slotBase()));
+    JSWebKitCSSKeyframeRule* castedThis = static_cast<JSWebKitCSSKeyframeRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSKeyframeRule* imp = static_cast<WebKitCSSKeyframeRule*>(castedThis->impl());
-    return jsString(exec, imp->keyText());
+    JSValue result = jsString(exec, imp->keyText());
+    return result;
 }
 
-JSValue jsWebKitCSSKeyframeRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframeRuleStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSKeyframeRule* castedThis = static_cast<JSWebKitCSSKeyframeRule*>(asObject(slot.slotBase()));
+    JSWebKitCSSKeyframeRule* castedThis = static_cast<JSWebKitCSSKeyframeRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSKeyframeRule* imp = static_cast<WebKitCSSKeyframeRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsWebKitCSSKeyframeRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframeRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSKeyframeRule* domObject = static_cast<JSWebKitCSSKeyframeRule*>(asObject(slot.slotBase()));
+    JSWebKitCSSKeyframeRule* domObject = static_cast<JSWebKitCSSKeyframeRule*>(asObject(slotBase));
     return JSWebKitCSSKeyframeRule::getConstructor(exec, domObject->globalObject());
 }
 void JSWebKitCSSKeyframeRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -170,7 +172,8 @@ void JSWebKitCSSKeyframeRule::put(ExecState* exec, const Identifier& propertyNam
 
 void setJSWebKitCSSKeyframeRuleKeyText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSKeyframeRule* imp = static_cast<WebKitCSSKeyframeRule*>(static_cast<JSWebKitCSSKeyframeRule*>(thisObject)->impl());
+    JSWebKitCSSKeyframeRule* castedThisObj = static_cast<JSWebKitCSSKeyframeRule*>(thisObject);
+    WebKitCSSKeyframeRule* imp = static_cast<WebKitCSSKeyframeRule*>(castedThisObj->impl());
     imp->setKeyText(value.toString(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
index 98289d4af6..cb1c4aec02 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSWebKitCSSKeyframeRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,10 +66,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsWebKitCSSKeyframeRuleKeyText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSKeyframeRuleKeyText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSKeyframeRuleKeyText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSKeyframeRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSKeyframeRuleStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
index 6ea3237c44..a83591cd2a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
@@ -41,9 +41,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSKeyframesRule);
 
 static const HashTableValue JSWebKitCSSKeyframesRuleTableValues[4] =
 {
-    { "name", DontDelete, (intptr_t)jsWebKitCSSKeyframesRuleName, (intptr_t)setJSWebKitCSSKeyframesRuleName },
-    { "cssRules", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSKeyframesRuleCssRules, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsWebKitCSSKeyframesRuleConstructor, (intptr_t)0 },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSKeyframesRuleName), (intptr_t)setJSWebKitCSSKeyframesRuleName },
+    { "cssRules", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSKeyframesRuleCssRules), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSKeyframesRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -82,7 +82,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -105,9 +105,9 @@ bool JSWebKitCSSKeyframesRuleConstructor::getOwnPropertyDescriptor(ExecState* ex
 
 static const HashTableValue JSWebKitCSSKeyframesRulePrototypeTableValues[4] =
 {
-    { "insertRule", DontDelete|Function, (intptr_t)jsWebKitCSSKeyframesRulePrototypeFunctionInsertRule, (intptr_t)1 },
-    { "deleteRule", DontDelete|Function, (intptr_t)jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRule, (intptr_t)1 },
-    { "findRule", DontDelete|Function, (intptr_t)jsWebKitCSSKeyframesRulePrototypeFunctionFindRule, (intptr_t)1 },
+    { "insertRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebKitCSSKeyframesRulePrototypeFunctionInsertRule), (intptr_t)1 },
+    { "deleteRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRule), (intptr_t)1 },
+    { "findRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebKitCSSKeyframesRulePrototypeFunctionFindRule), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -192,25 +192,27 @@ bool JSWebKitCSSKeyframesRule::getOwnPropertySlot(ExecState* exec, unsigned prop
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsWebKitCSSKeyframesRuleName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframesRuleName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSKeyframesRule* castedThis = static_cast<JSWebKitCSSKeyframesRule*>(asObject(slot.slotBase()));
+    JSWebKitCSSKeyframesRule* castedThis = static_cast<JSWebKitCSSKeyframesRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->name());
+    JSValue result = jsStringOrNull(exec, imp->name());
+    return result;
 }
 
-JSValue jsWebKitCSSKeyframesRuleCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframesRuleCssRules(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSKeyframesRule* castedThis = static_cast<JSWebKitCSSKeyframesRule*>(asObject(slot.slotBase()));
+    JSWebKitCSSKeyframesRule* castedThis = static_cast<JSWebKitCSSKeyframesRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->cssRules()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->cssRules()));
+    return result;
 }
 
-JSValue jsWebKitCSSKeyframesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframesRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSKeyframesRule* domObject = static_cast<JSWebKitCSSKeyframesRule*>(asObject(slot.slotBase()));
+    JSWebKitCSSKeyframesRule* domObject = static_cast<JSWebKitCSSKeyframesRule*>(asObject(slotBase));
     return JSWebKitCSSKeyframesRule::getConstructor(exec, domObject->globalObject());
 }
 void JSWebKitCSSKeyframesRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -220,15 +222,16 @@ void JSWebKitCSSKeyframesRule::put(ExecState* exec, const Identifier& propertyNa
 
 void setJSWebKitCSSKeyframesRuleName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(static_cast<JSWebKitCSSKeyframesRule*>(thisObject)->impl());
+    JSWebKitCSSKeyframesRule* castedThisObj = static_cast<JSWebKitCSSKeyframesRule*>(thisObject);
+    WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(castedThisObj->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void JSWebKitCSSKeyframesRule::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSWebKitCSSKeyframesRule::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<WebKitCSSKeyframesRule*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSWebKitCSSKeyframesRule::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -277,10 +280,10 @@ JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionFindRule(ExecStat
 }
 
 
-JSValue JSWebKitCSSKeyframesRule::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSWebKitCSSKeyframesRule::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSWebKitCSSKeyframesRule* thisObj = static_cast<JSWebKitCSSKeyframesRule*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<WebKitCSSKeyframesRule*>(thisObj->impl())->item(slot.index()));
+    JSWebKitCSSKeyframesRule* thisObj = static_cast<JSWebKitCSSKeyframesRule*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<WebKitCSSKeyframesRule*>(thisObj->impl())->item(index));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
index e76ba2a4d6..05ef25ec20 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
@@ -41,14 +41,14 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 };
 
 
@@ -62,7 +62,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSWebKitCSSKeyframesRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -76,10 +76,10 @@ JSC::JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRule(J
 JSC::JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionFindRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsWebKitCSSKeyframesRuleName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSKeyframesRuleName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSKeyframesRuleName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSKeyframesRuleCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSKeyframesRuleCssRules(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp
index 0bb22679e3..457eca1796 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp
@@ -39,28 +39,28 @@ ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSMatrix);
 
 static const HashTableValue JSWebKitCSSMatrixTableValues[23] =
 {
-    { "a", DontDelete, (intptr_t)jsWebKitCSSMatrixA, (intptr_t)setJSWebKitCSSMatrixA },
-    { "b", DontDelete, (intptr_t)jsWebKitCSSMatrixB, (intptr_t)setJSWebKitCSSMatrixB },
-    { "c", DontDelete, (intptr_t)jsWebKitCSSMatrixC, (intptr_t)setJSWebKitCSSMatrixC },
-    { "d", DontDelete, (intptr_t)jsWebKitCSSMatrixD, (intptr_t)setJSWebKitCSSMatrixD },
-    { "e", DontDelete, (intptr_t)jsWebKitCSSMatrixE, (intptr_t)setJSWebKitCSSMatrixE },
-    { "f", DontDelete, (intptr_t)jsWebKitCSSMatrixF, (intptr_t)setJSWebKitCSSMatrixF },
-    { "m11", DontDelete, (intptr_t)jsWebKitCSSMatrixM11, (intptr_t)setJSWebKitCSSMatrixM11 },
-    { "m12", DontDelete, (intptr_t)jsWebKitCSSMatrixM12, (intptr_t)setJSWebKitCSSMatrixM12 },
-    { "m13", DontDelete, (intptr_t)jsWebKitCSSMatrixM13, (intptr_t)setJSWebKitCSSMatrixM13 },
-    { "m14", DontDelete, (intptr_t)jsWebKitCSSMatrixM14, (intptr_t)setJSWebKitCSSMatrixM14 },
-    { "m21", DontDelete, (intptr_t)jsWebKitCSSMatrixM21, (intptr_t)setJSWebKitCSSMatrixM21 },
-    { "m22", DontDelete, (intptr_t)jsWebKitCSSMatrixM22, (intptr_t)setJSWebKitCSSMatrixM22 },
-    { "m23", DontDelete, (intptr_t)jsWebKitCSSMatrixM23, (intptr_t)setJSWebKitCSSMatrixM23 },
-    { "m24", DontDelete, (intptr_t)jsWebKitCSSMatrixM24, (intptr_t)setJSWebKitCSSMatrixM24 },
-    { "m31", DontDelete, (intptr_t)jsWebKitCSSMatrixM31, (intptr_t)setJSWebKitCSSMatrixM31 },
-    { "m32", DontDelete, (intptr_t)jsWebKitCSSMatrixM32, (intptr_t)setJSWebKitCSSMatrixM32 },
-    { "m33", DontDelete, (intptr_t)jsWebKitCSSMatrixM33, (intptr_t)setJSWebKitCSSMatrixM33 },
-    { "m34", DontDelete, (intptr_t)jsWebKitCSSMatrixM34, (intptr_t)setJSWebKitCSSMatrixM34 },
-    { "m41", DontDelete, (intptr_t)jsWebKitCSSMatrixM41, (intptr_t)setJSWebKitCSSMatrixM41 },
-    { "m42", DontDelete, (intptr_t)jsWebKitCSSMatrixM42, (intptr_t)setJSWebKitCSSMatrixM42 },
-    { "m43", DontDelete, (intptr_t)jsWebKitCSSMatrixM43, (intptr_t)setJSWebKitCSSMatrixM43 },
-    { "m44", DontDelete, (intptr_t)jsWebKitCSSMatrixM44, (intptr_t)setJSWebKitCSSMatrixM44 },
+    { "a", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixA), (intptr_t)setJSWebKitCSSMatrixA },
+    { "b", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixB), (intptr_t)setJSWebKitCSSMatrixB },
+    { "c", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixC), (intptr_t)setJSWebKitCSSMatrixC },
+    { "d", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixD), (intptr_t)setJSWebKitCSSMatrixD },
+    { "e", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixE), (intptr_t)setJSWebKitCSSMatrixE },
+    { "f", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixF), (intptr_t)setJSWebKitCSSMatrixF },
+    { "m11", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM11), (intptr_t)setJSWebKitCSSMatrixM11 },
+    { "m12", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM12), (intptr_t)setJSWebKitCSSMatrixM12 },
+    { "m13", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM13), (intptr_t)setJSWebKitCSSMatrixM13 },
+    { "m14", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM14), (intptr_t)setJSWebKitCSSMatrixM14 },
+    { "m21", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM21), (intptr_t)setJSWebKitCSSMatrixM21 },
+    { "m22", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM22), (intptr_t)setJSWebKitCSSMatrixM22 },
+    { "m23", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM23), (intptr_t)setJSWebKitCSSMatrixM23 },
+    { "m24", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM24), (intptr_t)setJSWebKitCSSMatrixM24 },
+    { "m31", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM31), (intptr_t)setJSWebKitCSSMatrixM31 },
+    { "m32", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM32), (intptr_t)setJSWebKitCSSMatrixM32 },
+    { "m33", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM33), (intptr_t)setJSWebKitCSSMatrixM33 },
+    { "m34", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM34), (intptr_t)setJSWebKitCSSMatrixM34 },
+    { "m41", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM41), (intptr_t)setJSWebKitCSSMatrixM41 },
+    { "m42", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM42), (intptr_t)setJSWebKitCSSMatrixM42 },
+    { "m43", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM43), (intptr_t)setJSWebKitCSSMatrixM43 },
+    { "m44", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSMatrixM44), (intptr_t)setJSWebKitCSSMatrixM44 },
     { 0, 0, 0, 0 }
 };
 
@@ -75,14 +75,14 @@ static JSC_CONST_HASHTABLE HashTable JSWebKitCSSMatrixTable =
 
 static const HashTableValue JSWebKitCSSMatrixPrototypeTableValues[9] =
 {
-    { "setMatrixValue", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionSetMatrixValue, (intptr_t)1 },
-    { "multiply", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionMultiply, (intptr_t)1 },
-    { "inverse", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionInverse, (intptr_t)0 },
-    { "translate", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionTranslate, (intptr_t)3 },
-    { "scale", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionScale, (intptr_t)3 },
-    { "rotate", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionRotate, (intptr_t)3 },
-    { "rotateAxisAngle", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionRotateAxisAngle, (intptr_t)4 },
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionToString, (intptr_t)0 },
+    { "setMatrixValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebKitCSSMatrixPrototypeFunctionSetMatrixValue), (intptr_t)1 },
+    { "multiply", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebKitCSSMatrixPrototypeFunctionMultiply), (intptr_t)1 },
+    { "inverse", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebKitCSSMatrixPrototypeFunctionInverse), (intptr_t)0 },
+    { "translate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebKitCSSMatrixPrototypeFunctionTranslate), (intptr_t)3 },
+    { "scale", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebKitCSSMatrixPrototypeFunctionScale), (intptr_t)3 },
+    { "rotate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebKitCSSMatrixPrototypeFunctionRotate), (intptr_t)3 },
+    { "rotateAxisAngle", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebKitCSSMatrixPrototypeFunctionRotateAxisAngle), (intptr_t)4 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsWebKitCSSMatrixPrototypeFunctionToString), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -138,180 +138,202 @@ bool JSWebKitCSSMatrix::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSWebKitCSSMatrix, Base>(exec, &JSWebKitCSSMatrixTable, this, propertyName, descriptor);
 }
 
-JSValue jsWebKitCSSMatrixA(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixA(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->a());
+    JSValue result = jsNumber(exec, imp->a());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixB(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixB(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->b());
+    JSValue result = jsNumber(exec, imp->b());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixC(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixC(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->c());
+    JSValue result = jsNumber(exec, imp->c());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixD(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixD(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->d());
+    JSValue result = jsNumber(exec, imp->d());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixE(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixE(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->e());
+    JSValue result = jsNumber(exec, imp->e());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixF(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixF(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->f());
+    JSValue result = jsNumber(exec, imp->f());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM11(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM11(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m11());
+    JSValue result = jsNumber(exec, imp->m11());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM12(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM12(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m12());
+    JSValue result = jsNumber(exec, imp->m12());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM13(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM13(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m13());
+    JSValue result = jsNumber(exec, imp->m13());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM14(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM14(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m14());
+    JSValue result = jsNumber(exec, imp->m14());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM21(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM21(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m21());
+    JSValue result = jsNumber(exec, imp->m21());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM22(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM22(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m22());
+    JSValue result = jsNumber(exec, imp->m22());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM23(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM23(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m23());
+    JSValue result = jsNumber(exec, imp->m23());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM24(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM24(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m24());
+    JSValue result = jsNumber(exec, imp->m24());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM31(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM31(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m31());
+    JSValue result = jsNumber(exec, imp->m31());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM32(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM32(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m32());
+    JSValue result = jsNumber(exec, imp->m32());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM33(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM33(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m33());
+    JSValue result = jsNumber(exec, imp->m33());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM34(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM34(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m34());
+    JSValue result = jsNumber(exec, imp->m34());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM41(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM41(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m41());
+    JSValue result = jsNumber(exec, imp->m41());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM42(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM42(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m42());
+    JSValue result = jsNumber(exec, imp->m42());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM43(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM43(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m43());
+    JSValue result = jsNumber(exec, imp->m43());
+    return result;
 }
 
-JSValue jsWebKitCSSMatrixM44(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSMatrixM44(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
+    JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThis->impl());
-    return jsNumber(exec, imp->m44());
+    JSValue result = jsNumber(exec, imp->m44());
+    return result;
 }
 
 void JSWebKitCSSMatrix::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -321,133 +343,155 @@ void JSWebKitCSSMatrix::put(ExecState* exec, const Identifier& propertyName, JSV
 
 void setJSWebKitCSSMatrixA(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setA(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixB(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setB(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixC(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setC(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixD(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setD(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixE(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setE(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixF(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setF(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM11(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM11(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM12(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM12(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM13(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM13(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM14(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM14(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM21(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM21(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM22(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM22(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM23(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM23(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM24(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM24(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM31(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM31(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM32(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM32(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM33(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM33(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM34(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM34(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM41(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM41(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM42(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM42(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM43(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM43(value.toNumber(exec));
 }
 
 void setJSWebKitCSSMatrixM44(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(thisObject);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
     imp->setM44(value.toNumber(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
index 3823098703..01be800e09 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
@@ -21,7 +21,6 @@
 #ifndef JSWebKitCSSMatrix_h
 #define JSWebKitCSSMatrix_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     WebKitCSSMatrix* impl() const { return m_impl.get(); }
@@ -68,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSWebKitCSSMatrixPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -87,49 +86,49 @@ JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionRotateAxisAngle(JSC
 JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsWebKitCSSMatrixA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixA(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixA(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixB(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixB(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixC(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixC(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixD(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixD(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixE(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixF(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixF(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixF(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM11(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM11(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM11(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM12(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM12(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM12(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM13(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM13(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM13(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM14(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM14(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM14(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM21(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM21(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM21(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM22(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM22(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM22(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM23(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM23(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM23(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM24(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM24(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM24(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM31(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM31(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM31(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM32(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM32(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM32(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM33(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM33(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM33(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM34(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM34(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM34(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM41(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM41(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM41(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM42(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM42(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM42(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM43(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM43(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM43(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitCSSMatrixM44(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSMatrixM44(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitCSSMatrixM44(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
index b62daea4d1..03f4a4499d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
@@ -23,6 +23,7 @@
 
 #include "WebKitCSSTransformValue.h"
 #include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
 #include <wtf/GetPtr.h>
 
 using namespace JSC;
@@ -35,8 +36,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSTransformValue);
 
 static const HashTableValue JSWebKitCSSTransformValueTableValues[3] =
 {
-    { "operationType", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueOperationType, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsWebKitCSSTransformValueConstructor, (intptr_t)0 },
+    { "operationType", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueOperationType), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -51,27 +52,27 @@ static JSC_CONST_HASHTABLE HashTable JSWebKitCSSTransformValueTable =
 
 static const HashTableValue JSWebKitCSSTransformValueConstructorTableValues[22] =
 {
-    { "CSS_TRANSLATE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATE, (intptr_t)0 },
-    { "CSS_TRANSLATEX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATEX, (intptr_t)0 },
-    { "CSS_TRANSLATEY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATEY, (intptr_t)0 },
-    { "CSS_ROTATE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATE, (intptr_t)0 },
-    { "CSS_SCALE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALE, (intptr_t)0 },
-    { "CSS_SCALEX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALEX, (intptr_t)0 },
-    { "CSS_SCALEY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALEY, (intptr_t)0 },
-    { "CSS_SKEW", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SKEW, (intptr_t)0 },
-    { "CSS_SKEWX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SKEWX, (intptr_t)0 },
-    { "CSS_SKEWY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SKEWY, (intptr_t)0 },
-    { "CSS_MATRIX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_MATRIX, (intptr_t)0 },
-    { "CSS_TRANSLATEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATEZ, (intptr_t)0 },
-    { "CSS_TRANSLATE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATE3D, (intptr_t)0 },
-    { "CSS_ROTATEX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEX, (intptr_t)0 },
-    { "CSS_ROTATEY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEY, (intptr_t)0 },
-    { "CSS_ROTATEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEZ, (intptr_t)0 },
-    { "CSS_ROTATE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATE3D, (intptr_t)0 },
-    { "CSS_SCALEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALEZ, (intptr_t)0 },
-    { "CSS_SCALE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALE3D, (intptr_t)0 },
-    { "CSS_PERSPECTIVE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_PERSPECTIVE, (intptr_t)0 },
-    { "CSS_MATRIX3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_MATRIX3D, (intptr_t)0 },
+    { "CSS_TRANSLATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_TRANSLATE), (intptr_t)0 },
+    { "CSS_TRANSLATEX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_TRANSLATEX), (intptr_t)0 },
+    { "CSS_TRANSLATEY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_TRANSLATEY), (intptr_t)0 },
+    { "CSS_ROTATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_ROTATE), (intptr_t)0 },
+    { "CSS_SCALE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SCALE), (intptr_t)0 },
+    { "CSS_SCALEX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SCALEX), (intptr_t)0 },
+    { "CSS_SCALEY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SCALEY), (intptr_t)0 },
+    { "CSS_SKEW", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SKEW), (intptr_t)0 },
+    { "CSS_SKEWX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SKEWX), (intptr_t)0 },
+    { "CSS_SKEWY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SKEWY), (intptr_t)0 },
+    { "CSS_MATRIX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_MATRIX), (intptr_t)0 },
+    { "CSS_TRANSLATEZ", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_TRANSLATEZ), (intptr_t)0 },
+    { "CSS_TRANSLATE3D", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_TRANSLATE3D), (intptr_t)0 },
+    { "CSS_ROTATEX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_ROTATEX), (intptr_t)0 },
+    { "CSS_ROTATEY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_ROTATEY), (intptr_t)0 },
+    { "CSS_ROTATEZ", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_ROTATEZ), (intptr_t)0 },
+    { "CSS_ROTATE3D", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_ROTATE3D), (intptr_t)0 },
+    { "CSS_SCALEZ", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SCALEZ), (intptr_t)0 },
+    { "CSS_SCALE3D", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SCALE3D), (intptr_t)0 },
+    { "CSS_PERSPECTIVE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_PERSPECTIVE), (intptr_t)0 },
+    { "CSS_MATRIX3D", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_MATRIX3D), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -96,7 +97,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -119,27 +120,27 @@ bool JSWebKitCSSTransformValueConstructor::getOwnPropertyDescriptor(ExecState* e
 
 static const HashTableValue JSWebKitCSSTransformValuePrototypeTableValues[22] =
 {
-    { "CSS_TRANSLATE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATE, (intptr_t)0 },
-    { "CSS_TRANSLATEX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATEX, (intptr_t)0 },
-    { "CSS_TRANSLATEY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATEY, (intptr_t)0 },
-    { "CSS_ROTATE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATE, (intptr_t)0 },
-    { "CSS_SCALE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALE, (intptr_t)0 },
-    { "CSS_SCALEX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALEX, (intptr_t)0 },
-    { "CSS_SCALEY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALEY, (intptr_t)0 },
-    { "CSS_SKEW", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SKEW, (intptr_t)0 },
-    { "CSS_SKEWX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SKEWX, (intptr_t)0 },
-    { "CSS_SKEWY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SKEWY, (intptr_t)0 },
-    { "CSS_MATRIX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_MATRIX, (intptr_t)0 },
-    { "CSS_TRANSLATEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATEZ, (intptr_t)0 },
-    { "CSS_TRANSLATE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATE3D, (intptr_t)0 },
-    { "CSS_ROTATEX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEX, (intptr_t)0 },
-    { "CSS_ROTATEY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEY, (intptr_t)0 },
-    { "CSS_ROTATEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEZ, (intptr_t)0 },
-    { "CSS_ROTATE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATE3D, (intptr_t)0 },
-    { "CSS_SCALEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALEZ, (intptr_t)0 },
-    { "CSS_SCALE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALE3D, (intptr_t)0 },
-    { "CSS_PERSPECTIVE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_PERSPECTIVE, (intptr_t)0 },
-    { "CSS_MATRIX3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_MATRIX3D, (intptr_t)0 },
+    { "CSS_TRANSLATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_TRANSLATE), (intptr_t)0 },
+    { "CSS_TRANSLATEX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_TRANSLATEX), (intptr_t)0 },
+    { "CSS_TRANSLATEY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_TRANSLATEY), (intptr_t)0 },
+    { "CSS_ROTATE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_ROTATE), (intptr_t)0 },
+    { "CSS_SCALE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SCALE), (intptr_t)0 },
+    { "CSS_SCALEX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SCALEX), (intptr_t)0 },
+    { "CSS_SCALEY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SCALEY), (intptr_t)0 },
+    { "CSS_SKEW", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SKEW), (intptr_t)0 },
+    { "CSS_SKEWX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SKEWX), (intptr_t)0 },
+    { "CSS_SKEWY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SKEWY), (intptr_t)0 },
+    { "CSS_MATRIX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_MATRIX), (intptr_t)0 },
+    { "CSS_TRANSLATEZ", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_TRANSLATEZ), (intptr_t)0 },
+    { "CSS_TRANSLATE3D", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_TRANSLATE3D), (intptr_t)0 },
+    { "CSS_ROTATEX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_ROTATEX), (intptr_t)0 },
+    { "CSS_ROTATEY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_ROTATEY), (intptr_t)0 },
+    { "CSS_ROTATEZ", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_ROTATEZ), (intptr_t)0 },
+    { "CSS_ROTATE3D", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_ROTATE3D), (intptr_t)0 },
+    { "CSS_SCALEZ", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SCALEZ), (intptr_t)0 },
+    { "CSS_SCALE3D", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_SCALE3D), (intptr_t)0 },
+    { "CSS_PERSPECTIVE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_PERSPECTIVE), (intptr_t)0 },
+    { "CSS_MATRIX3D", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitCSSTransformValueCSS_MATRIX3D), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -181,27 +182,70 @@ JSObject* JSWebKitCSSTransformValue::createPrototype(ExecState* exec, JSGlobalOb
 
 bool JSWebKitCSSTransformValue::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
+    const HashEntry* entry = JSWebKitCSSTransformValueTable.entry(exec, propertyName);
+    if (entry) {
+        slot.setCustom(this, entry->propertyGetter());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebKitCSSTransformValue*>(impl())->length()) {
+        slot.setCustomIndex(this, index, indexGetter);
+        return true;
+    }
     return getStaticValueSlot<JSWebKitCSSTransformValue, Base>(exec, &JSWebKitCSSTransformValueTable, this, propertyName, slot);
 }
 
 bool JSWebKitCSSTransformValue::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
+    const HashEntry* entry = JSWebKitCSSTransformValueTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebKitCSSTransformValue*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
     return getStaticValueDescriptor<JSWebKitCSSTransformValue, Base>(exec, &JSWebKitCSSTransformValueTable, this, propertyName, descriptor);
 }
 
-JSValue jsWebKitCSSTransformValueOperationType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+bool JSWebKitCSSTransformValue::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<WebKitCSSTransformValue*>(impl())->length()) {
+        slot.setCustomIndex(this, propertyName, indexGetter);
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+JSValue jsWebKitCSSTransformValueOperationType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSTransformValue* castedThis = static_cast<JSWebKitCSSTransformValue*>(asObject(slot.slotBase()));
+    JSWebKitCSSTransformValue* castedThis = static_cast<JSWebKitCSSTransformValue*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitCSSTransformValue* imp = static_cast<WebKitCSSTransformValue*>(castedThis->impl());
-    return jsNumber(exec, imp->operationType());
+    JSValue result = jsNumber(exec, imp->operationType());
+    return result;
 }
 
-JSValue jsWebKitCSSTransformValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSTransformValueConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitCSSTransformValue* domObject = static_cast<JSWebKitCSSTransformValue*>(asObject(slot.slotBase()));
+    JSWebKitCSSTransformValue* domObject = static_cast<JSWebKitCSSTransformValue*>(asObject(slotBase));
     return JSWebKitCSSTransformValue::getConstructor(exec, domObject->globalObject());
 }
+void JSWebKitCSSTransformValue::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    for (unsigned i = 0; i < static_cast<WebKitCSSTransformValue*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
 JSValue JSWebKitCSSTransformValue::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 {
     return getDOMConstructor<JSWebKitCSSTransformValueConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
@@ -209,110 +253,116 @@ JSValue JSWebKitCSSTransformValue::getConstructor(ExecState* exec, JSGlobalObjec
 
 // Constant getters
 
-JSValue jsWebKitCSSTransformValueCSS_TRANSLATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_TRANSLATE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_TRANSLATEX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_TRANSLATEX(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_TRANSLATEY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_TRANSLATEY(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_ROTATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_ROTATE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_SCALE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SCALE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_SCALEX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SCALEX(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_SCALEY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SCALEY(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_SKEW(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SKEW(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_SKEWX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SKEWX(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_SKEWY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SKEWY(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_MATRIX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_MATRIX(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_TRANSLATEZ(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_TRANSLATEZ(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(12));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_TRANSLATE3D(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_TRANSLATE3D(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(13));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_ROTATEX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_ROTATEX(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(14));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_ROTATEY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_ROTATEY(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(15));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_ROTATEZ(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_ROTATEZ(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_ROTATE3D(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_ROTATE3D(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(17));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_SCALEZ(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SCALEZ(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(18));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_SCALE3D(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SCALE3D(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(19));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_PERSPECTIVE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_PERSPECTIVE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(20));
 }
 
-JSValue jsWebKitCSSTransformValueCSS_MATRIX3D(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_MATRIX3D(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(21));
 }
 
 
+JSValue JSWebKitCSSTransformValue::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
+{
+    JSWebKitCSSTransformValue* thisObj = static_cast<JSWebKitCSSTransformValue*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<WebKitCSSTransformValue*>(thisObj->impl())->item(index));
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
index bb819bbd58..2b122f512c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
@@ -34,17 +34,20 @@ public:
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
-    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 };
 
 
@@ -58,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSWebKitCSSTransformValuePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -67,31 +70,31 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsWebKitCSSTransformValueOperationType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueOperationType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATEY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_SCALE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_SCALEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_SCALEY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_SKEW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_SKEWX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_SKEWY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_MATRIX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATEZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATE3D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATEY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATEZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATE3D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_SCALEZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_SCALE3D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_PERSPECTIVE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitCSSTransformValueCSS_MATRIX3D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATEX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATEY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SCALE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SCALEX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SCALEY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SKEW(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SKEWX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SKEWY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_MATRIX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATEZ(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATE3D(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATEX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATEY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATEZ(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATE3D(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SCALEZ(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SCALE3D(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_PERSPECTIVE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_MATRIX3D(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp
index ea88682926..8e06b34406 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp
@@ -35,8 +35,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSWebKitPoint);
 
 static const HashTableValue JSWebKitPointTableValues[3] =
 {
-    { "x", DontDelete, (intptr_t)jsWebKitPointX, (intptr_t)setJSWebKitPointX },
-    { "y", DontDelete, (intptr_t)jsWebKitPointY, (intptr_t)setJSWebKitPointY },
+    { "x", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitPointX), (intptr_t)setJSWebKitPointX },
+    { "y", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitPointY), (intptr_t)setJSWebKitPointY },
     { 0, 0, 0, 0 }
 };
 
@@ -96,20 +96,22 @@ bool JSWebKitPoint::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSWebKitPoint, Base>(exec, &JSWebKitPointTable, this, propertyName, descriptor);
 }
 
-JSValue jsWebKitPointX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitPointX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitPoint* castedThis = static_cast<JSWebKitPoint*>(asObject(slot.slotBase()));
+    JSWebKitPoint* castedThis = static_cast<JSWebKitPoint*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitPoint* imp = static_cast<WebKitPoint*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsWebKitPointY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitPointY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitPoint* castedThis = static_cast<JSWebKitPoint*>(asObject(slot.slotBase()));
+    JSWebKitPoint* castedThis = static_cast<JSWebKitPoint*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitPoint* imp = static_cast<WebKitPoint*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
 void JSWebKitPoint::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -119,13 +121,15 @@ void JSWebKitPoint::put(ExecState* exec, const Identifier& propertyName, JSValue
 
 void setJSWebKitPointX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitPoint* imp = static_cast<WebKitPoint*>(static_cast<JSWebKitPoint*>(thisObject)->impl());
+    JSWebKitPoint* castedThisObj = static_cast<JSWebKitPoint*>(thisObject);
+    WebKitPoint* imp = static_cast<WebKitPoint*>(castedThisObj->impl());
     imp->setX(value.toFloat(exec));
 }
 
 void setJSWebKitPointY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WebKitPoint* imp = static_cast<WebKitPoint*>(static_cast<JSWebKitPoint*>(thisObject)->impl());
+    JSWebKitPoint* castedThisObj = static_cast<JSWebKitPoint*>(thisObject);
+    WebKitPoint* imp = static_cast<WebKitPoint*>(castedThisObj->impl());
     imp->setY(value.toFloat(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
index 319980d602..ee2ea238a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
@@ -21,7 +21,6 @@
 #ifndef JSWebKitPoint_h
 #define JSWebKitPoint_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     WebKitPoint* impl() const { return m_impl.get(); }
@@ -66,7 +65,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSWebKitPointPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,9 +74,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsWebKitPointX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitPointX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitPointX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebKitPointY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitPointY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebKitPointY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
index 20066f7927..2699786a0c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
@@ -38,9 +38,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSWebKitTransitionEvent);
 
 static const HashTableValue JSWebKitTransitionEventTableValues[4] =
 {
-    { "propertyName", DontDelete|ReadOnly, (intptr_t)jsWebKitTransitionEventPropertyName, (intptr_t)0 },
-    { "elapsedTime", DontDelete|ReadOnly, (intptr_t)jsWebKitTransitionEventElapsedTime, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsWebKitTransitionEventConstructor, (intptr_t)0 },
+    { "propertyName", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitTransitionEventPropertyName), (intptr_t)0 },
+    { "elapsedTime", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitTransitionEventElapsedTime), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebKitTransitionEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -102,7 +102,7 @@ bool JSWebKitTransitionEventConstructor::getOwnPropertyDescriptor(ExecState* exe
 
 static const HashTableValue JSWebKitTransitionEventPrototypeTableValues[2] =
 {
-    { "initWebKitTransitionEvent", DontDelete|Function, (intptr_t)jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEvent, (intptr_t)5 },
+    { "initWebKitTransitionEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEvent), (intptr_t)5 },
     { 0, 0, 0, 0 }
 };
 
@@ -152,25 +152,27 @@ bool JSWebKitTransitionEvent::getOwnPropertyDescriptor(ExecState* exec, const Id
     return getStaticValueDescriptor<JSWebKitTransitionEvent, Base>(exec, &JSWebKitTransitionEventTable, this, propertyName, descriptor);
 }
 
-JSValue jsWebKitTransitionEventPropertyName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitTransitionEventPropertyName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitTransitionEvent* castedThis = static_cast<JSWebKitTransitionEvent*>(asObject(slot.slotBase()));
+    JSWebKitTransitionEvent* castedThis = static_cast<JSWebKitTransitionEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitTransitionEvent* imp = static_cast<WebKitTransitionEvent*>(castedThis->impl());
-    return jsString(exec, imp->propertyName());
+    JSValue result = jsString(exec, imp->propertyName());
+    return result;
 }
 
-JSValue jsWebKitTransitionEventElapsedTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitTransitionEventElapsedTime(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitTransitionEvent* castedThis = static_cast<JSWebKitTransitionEvent*>(asObject(slot.slotBase()));
+    JSWebKitTransitionEvent* castedThis = static_cast<JSWebKitTransitionEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebKitTransitionEvent* imp = static_cast<WebKitTransitionEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->elapsedTime());
+    JSValue result = jsNumber(exec, imp->elapsedTime());
+    return result;
 }
 
-JSValue jsWebKitTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitTransitionEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebKitTransitionEvent* domObject = static_cast<JSWebKitTransitionEvent*>(asObject(slot.slotBase()));
+    JSWebKitTransitionEvent* domObject = static_cast<JSWebKitTransitionEvent*>(asObject(slotBase));
     return JSWebKitTransitionEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSWebKitTransitionEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
index 015574c92f..8f7ee90268 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSWebKitTransitionEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -70,9 +70,9 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsWebKitTransitionEventPropertyName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitTransitionEventElapsedTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebKitTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitTransitionEventPropertyName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitTransitionEventElapsedTime(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebKitTransitionEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp
index 7e48815d4c..be8cf1ed55 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp
@@ -26,8 +26,6 @@
 
 #include "Event.h"
 #include "EventListener.h"
-#include "Frame.h"
-#include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "KURL.h"
@@ -46,14 +44,15 @@ ASSERT_CLASS_FITS_IN_CELL(JSWebSocket);
 
 /* Hash table */
 
-static const HashTableValue JSWebSocketTableValues[7] =
+static const HashTableValue JSWebSocketTableValues[8] =
 {
-    { "URL", DontDelete|ReadOnly, (intptr_t)jsWebSocketURL, (intptr_t)0 },
-    { "readyState", DontDelete|ReadOnly, (intptr_t)jsWebSocketReadyState, (intptr_t)0 },
-    { "bufferedAmount", DontDelete|ReadOnly, (intptr_t)jsWebSocketBufferedAmount, (intptr_t)0 },
-    { "onopen", DontDelete, (intptr_t)jsWebSocketOnopen, (intptr_t)setJSWebSocketOnopen },
-    { "onmessage", DontDelete, (intptr_t)jsWebSocketOnmessage, (intptr_t)setJSWebSocketOnmessage },
-    { "onclose", DontDelete, (intptr_t)jsWebSocketOnclose, (intptr_t)setJSWebSocketOnclose },
+    { "URL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebSocketURL), (intptr_t)0 },
+    { "readyState", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebSocketReadyState), (intptr_t)0 },
+    { "bufferedAmount", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebSocketBufferedAmount), (intptr_t)0 },
+    { "onopen", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebSocketOnopen), (intptr_t)setJSWebSocketOnopen },
+    { "onmessage", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebSocketOnmessage), (intptr_t)setJSWebSocketOnmessage },
+    { "onerror", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebSocketOnerror), (intptr_t)setJSWebSocketOnerror },
+    { "onclose", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebSocketOnclose), (intptr_t)setJSWebSocketOnclose },
     { 0, 0, 0, 0 }
 };
 
@@ -68,14 +67,14 @@ static JSC_CONST_HASHTABLE HashTable JSWebSocketTable =
 
 static const HashTableValue JSWebSocketPrototypeTableValues[9] =
 {
-    { "CONNECTING", DontDelete|ReadOnly, (intptr_t)jsWebSocketCONNECTING, (intptr_t)0 },
-    { "OPEN", DontDelete|ReadOnly, (intptr_t)jsWebSocketOPEN, (intptr_t)0 },
-    { "CLOSED", DontDelete|ReadOnly, (intptr_t)jsWebSocketCLOSED, (intptr_t)0 },
-    { "send", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionSend, (intptr_t)1 },
-    { "close", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionClose, (intptr_t)0 },
-    { "addEventListener", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { "CONNECTING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebSocketCONNECTING), (intptr_t)0 },
+    { "OPEN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebSocketOPEN), (intptr_t)0 },
+    { "CLOSED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWebSocketCLOSED), (intptr_t)0 },
+    { "send", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebSocketPrototypeFunctionSend), (intptr_t)1 },
+    { "close", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebSocketPrototypeFunctionClose), (intptr_t)0 },
+    { "addEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebSocketPrototypeFunctionAddEventListener), (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebSocketPrototypeFunctionRemoveEventListener), (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWebSocketPrototypeFunctionDispatchEvent), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -121,14 +120,14 @@ JSWebSocket::JSWebSocket(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObje
 
 JSWebSocket::~JSWebSocket()
 {
-    impl()->invalidateEventListeners();
+    impl()->invalidateJSEventListeners(this);
     forgetDOMObject(this, impl());
 }
 
 void JSWebSocket::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
-    impl()->markEventListeners(markStack);
+    impl()->markJSEventListeners(markStack);
 }
 
 JSObject* JSWebSocket::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -146,62 +145,85 @@ bool JSWebSocket::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
     return getStaticValueDescriptor<JSWebSocket, Base>(exec, getJSWebSocketTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsWebSocketURL(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebSocketURL(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slot.slotBase()));
+    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebSocket* imp = static_cast<WebSocket*>(castedThis->impl());
-    return jsString(exec, imp->url());
+    JSValue result = jsString(exec, imp->url());
+    return result;
 }
 
-JSValue jsWebSocketReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebSocketReadyState(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slot.slotBase()));
+    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebSocket* imp = static_cast<WebSocket*>(castedThis->impl());
-    return jsNumber(exec, imp->readyState());
+    JSValue result = jsNumber(exec, imp->readyState());
+    return result;
 }
 
-JSValue jsWebSocketBufferedAmount(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebSocketBufferedAmount(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slot.slotBase()));
+    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebSocket* imp = static_cast<WebSocket*>(castedThis->impl());
-    return jsNumber(exec, imp->bufferedAmount());
+    JSValue result = jsNumber(exec, imp->bufferedAmount());
+    return result;
 }
 
-JSValue jsWebSocketOnopen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebSocketOnopen(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slot.slotBase()));
+    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebSocket* imp = static_cast<WebSocket*>(castedThis->impl());
     if (EventListener* listener = imp->onopen()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsWebSocketOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebSocketOnmessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slot.slotBase()));
+    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebSocket* imp = static_cast<WebSocket*>(castedThis->impl());
     if (EventListener* listener = imp->onmessage()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsWebSocketOnclose(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebSocketOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slot.slotBase()));
+    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    WebSocket* imp = static_cast<WebSocket*>(castedThis->impl());
+    if (EventListener* listener = imp->onerror()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsWebSocketOnclose(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WebSocket* imp = static_cast<WebSocket*>(castedThis->impl());
     if (EventListener* listener = imp->onclose()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
@@ -215,30 +237,28 @@ void setJSWebSocketOnopen(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     WebSocket* imp = static_cast<WebSocket*>(static_cast<JSWebSocket*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnopen(globalObject->createJSAttributeEventListener(value));
+    imp->setOnopen(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSWebSocketOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     WebSocket* imp = static_cast<WebSocket*>(static_cast<JSWebSocket*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmessage(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSWebSocketOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    WebSocket* imp = static_cast<WebSocket*>(static_cast<JSWebSocket*>(thisObject)->impl());
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSWebSocketOnclose(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     WebSocket* imp = static_cast<WebSocket*>(static_cast<JSWebSocket*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnclose(globalObject->createJSAttributeEventListener(value));
+    imp->setOnclose(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionSend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -298,17 +318,17 @@ JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionDispatchEvent(ExecState* exec,
 
 // Constant getters
 
-JSValue jsWebSocketCONNECTING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebSocketCONNECTING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsWebSocketOPEN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebSocketOPEN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsWebSocketCLOSED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebSocketCLOSED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.h b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.h
index 942821269a..48d849cc60 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(WEB_SOCKETS)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -46,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -77,7 +76,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSWebSocketPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -93,20 +92,22 @@ JSC::JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionRemoveEventListener(JSC::
 JSC::JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsWebSocketURL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebSocketReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebSocketBufferedAmount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebSocketOnopen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebSocketURL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebSocketReadyState(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebSocketBufferedAmount(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebSocketOnopen(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebSocketOnopen(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebSocketOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebSocketOnmessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebSocketOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWebSocketOnclose(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebSocketOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSWebSocketOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebSocketOnclose(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWebSocketOnclose(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 // Constants
 
-JSC::JSValue jsWebSocketCONNECTING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebSocketOPEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWebSocketCLOSED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebSocketCONNECTING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebSocketOPEN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWebSocketCLOSED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
index 589f570787..8a8f2337a3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
@@ -21,7 +21,9 @@
 #include "config.h"
 #include "JSWheelEvent.h"
 
+#include "JSDOMWindow.h"
 #include "WheelEvent.h"
+#include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <wtf/GetPtr.h>
 
@@ -35,22 +37,22 @@ ASSERT_CLASS_FITS_IN_CELL(JSWheelEvent);
 
 static const HashTableValue JSWheelEventTableValues[17] =
 {
-    { "screenX", DontDelete|ReadOnly, (intptr_t)jsWheelEventScreenX, (intptr_t)0 },
-    { "screenY", DontDelete|ReadOnly, (intptr_t)jsWheelEventScreenY, (intptr_t)0 },
-    { "clientX", DontDelete|ReadOnly, (intptr_t)jsWheelEventClientX, (intptr_t)0 },
-    { "clientY", DontDelete|ReadOnly, (intptr_t)jsWheelEventClientY, (intptr_t)0 },
-    { "ctrlKey", DontDelete|ReadOnly, (intptr_t)jsWheelEventCtrlKey, (intptr_t)0 },
-    { "shiftKey", DontDelete|ReadOnly, (intptr_t)jsWheelEventShiftKey, (intptr_t)0 },
-    { "altKey", DontDelete|ReadOnly, (intptr_t)jsWheelEventAltKey, (intptr_t)0 },
-    { "metaKey", DontDelete|ReadOnly, (intptr_t)jsWheelEventMetaKey, (intptr_t)0 },
-    { "wheelDelta", DontDelete|ReadOnly, (intptr_t)jsWheelEventWheelDelta, (intptr_t)0 },
-    { "wheelDeltaX", DontDelete|ReadOnly, (intptr_t)jsWheelEventWheelDeltaX, (intptr_t)0 },
-    { "wheelDeltaY", DontDelete|ReadOnly, (intptr_t)jsWheelEventWheelDeltaY, (intptr_t)0 },
-    { "offsetX", DontDelete|ReadOnly, (intptr_t)jsWheelEventOffsetX, (intptr_t)0 },
-    { "offsetY", DontDelete|ReadOnly, (intptr_t)jsWheelEventOffsetY, (intptr_t)0 },
-    { "x", DontDelete|ReadOnly, (intptr_t)jsWheelEventX, (intptr_t)0 },
-    { "y", DontDelete|ReadOnly, (intptr_t)jsWheelEventY, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsWheelEventConstructor, (intptr_t)0 },
+    { "screenX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventScreenX), (intptr_t)0 },
+    { "screenY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventScreenY), (intptr_t)0 },
+    { "clientX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventClientX), (intptr_t)0 },
+    { "clientY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventClientY), (intptr_t)0 },
+    { "ctrlKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventCtrlKey), (intptr_t)0 },
+    { "shiftKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventShiftKey), (intptr_t)0 },
+    { "altKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventAltKey), (intptr_t)0 },
+    { "metaKey", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventMetaKey), (intptr_t)0 },
+    { "wheelDelta", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventWheelDelta), (intptr_t)0 },
+    { "wheelDeltaX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventWheelDeltaX), (intptr_t)0 },
+    { "wheelDeltaY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventWheelDeltaY), (intptr_t)0 },
+    { "offsetX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventOffsetX), (intptr_t)0 },
+    { "offsetY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventOffsetY), (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventX), (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventY), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWheelEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -89,7 +91,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -110,8 +112,9 @@ bool JSWheelEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Id
 
 /* Hash table for prototype */
 
-static const HashTableValue JSWheelEventPrototypeTableValues[1] =
+static const HashTableValue JSWheelEventPrototypeTableValues[2] =
 {
+    { "initWebKitWheelEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWheelEventPrototypeFunctionInitWebKitWheelEvent), (intptr_t)11 },
     { 0, 0, 0, 0 }
 };
 
@@ -119,7 +122,7 @@ static JSC_CONST_HASHTABLE HashTable JSWheelEventPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 0, JSWheelEventPrototypeTableValues, 0 };
 #else
-    { 1, 0, JSWheelEventPrototypeTableValues, 0 };
+    { 2, 1, JSWheelEventPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSWheelEventPrototype::s_info = { "WheelEventPrototype", 0, &JSWheelEventPrototypeTable, 0 };
@@ -129,6 +132,16 @@ JSObject* JSWheelEventPrototype::self(ExecState* exec, JSGlobalObject* globalObj
     return getDOMPrototype<JSWheelEvent>(exec, globalObject);
 }
 
+bool JSWheelEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSWheelEventPrototypeTable, this, propertyName, slot);
+}
+
+bool JSWheelEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSWheelEventPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSWheelEvent::s_info = { "WheelEvent", &JSUIEvent::s_info, &JSWheelEventTable, 0 };
 
 JSWheelEvent::JSWheelEvent(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WheelEvent> impl)
@@ -151,129 +164,144 @@ bool JSWheelEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<JSWheelEvent, Base>(exec, &JSWheelEventTable, this, propertyName, descriptor);
 }
 
-JSValue jsWheelEventScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventScreenX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->screenX());
+    JSValue result = jsNumber(exec, imp->screenX());
+    return result;
 }
 
-JSValue jsWheelEventScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventScreenY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->screenY());
+    JSValue result = jsNumber(exec, imp->screenY());
+    return result;
 }
 
-JSValue jsWheelEventClientX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventClientX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->clientX());
+    JSValue result = jsNumber(exec, imp->clientX());
+    return result;
 }
 
-JSValue jsWheelEventClientY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventClientY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->clientY());
+    JSValue result = jsNumber(exec, imp->clientY());
+    return result;
 }
 
-JSValue jsWheelEventCtrlKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventCtrlKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(castedThis->impl());
-    return jsBoolean(imp->ctrlKey());
+    JSValue result = jsBoolean(imp->ctrlKey());
+    return result;
 }
 
-JSValue jsWheelEventShiftKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventShiftKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(castedThis->impl());
-    return jsBoolean(imp->shiftKey());
+    JSValue result = jsBoolean(imp->shiftKey());
+    return result;
 }
 
-JSValue jsWheelEventAltKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventAltKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(castedThis->impl());
-    return jsBoolean(imp->altKey());
+    JSValue result = jsBoolean(imp->altKey());
+    return result;
 }
 
-JSValue jsWheelEventMetaKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventMetaKey(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(castedThis->impl());
-    return jsBoolean(imp->metaKey());
+    JSValue result = jsBoolean(imp->metaKey());
+    return result;
 }
 
-JSValue jsWheelEventWheelDelta(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventWheelDelta(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->wheelDelta());
+    JSValue result = jsNumber(exec, imp->wheelDelta());
+    return result;
 }
 
-JSValue jsWheelEventWheelDeltaX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventWheelDeltaX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->wheelDeltaX());
+    JSValue result = jsNumber(exec, imp->wheelDeltaX());
+    return result;
 }
 
-JSValue jsWheelEventWheelDeltaY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventWheelDeltaY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->wheelDeltaY());
+    JSValue result = jsNumber(exec, imp->wheelDeltaY());
+    return result;
 }
 
-JSValue jsWheelEventOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventOffsetX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->offsetX());
+    JSValue result = jsNumber(exec, imp->offsetX());
+    return result;
 }
 
-JSValue jsWheelEventOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventOffsetY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->offsetY());
+    JSValue result = jsNumber(exec, imp->offsetY());
+    return result;
 }
 
-JSValue jsWheelEventX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->x());
+    JSValue result = jsNumber(exec, imp->x());
+    return result;
 }
 
-JSValue jsWheelEventY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->y());
+    JSValue result = jsNumber(exec, imp->y());
+    return result;
 }
 
-JSValue jsWheelEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWheelEvent* domObject = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
+    JSWheelEvent* domObject = static_cast<JSWheelEvent*>(asObject(slotBase));
     return JSWheelEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSWheelEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -281,5 +309,28 @@ JSValue JSWheelEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObje
     return getDOMConstructor<JSWheelEventConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
+JSValue JSC_HOST_CALL jsWheelEventPrototypeFunctionInitWebKitWheelEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWheelEvent::s_info))
+        return throwError(exec, TypeError);
+    JSWheelEvent* castedThisObj = static_cast<JSWheelEvent*>(asObject(thisValue));
+    WheelEvent* imp = static_cast<WheelEvent*>(castedThisObj->impl());
+    int wheelDeltaX = args.at(0).toInt32(exec);
+    int wheelDeltaY = args.at(1).toInt32(exec);
+    DOMWindow* view = toDOMWindow(args.at(2));
+    int screenX = args.at(3).toInt32(exec);
+    int screenY = args.at(4).toInt32(exec);
+    int clientX = args.at(5).toInt32(exec);
+    int clientY = args.at(6).toInt32(exec);
+    bool ctrlKey = args.at(7).toBoolean(exec);
+    bool altKey = args.at(8).toBoolean(exec);
+    bool shiftKey = args.at(9).toBoolean(exec);
+    bool metaKey = args.at(10).toBoolean(exec);
+
+    imp->initWebKitWheelEvent(wheelDeltaX, wheelDeltaY, view, screenX, screenY, clientX, clientY, ctrlKey, altKey, shiftKey, metaKey);
+    return jsUndefined();
+}
+
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
index 6901d9379b..8a4d05b6a9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -54,33 +54,38 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSWheelEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsWheelEventPrototypeFunctionInitWebKitWheelEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsWheelEventScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWheelEventScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWheelEventClientX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWheelEventClientY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWheelEventCtrlKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWheelEventShiftKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWheelEventAltKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWheelEventMetaKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWheelEventWheelDelta(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWheelEventWheelDeltaX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWheelEventWheelDeltaY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWheelEventOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWheelEventOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWheelEventX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWheelEventY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWheelEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventScreenX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWheelEventScreenY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWheelEventClientX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWheelEventClientY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWheelEventCtrlKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWheelEventShiftKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWheelEventAltKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWheelEventMetaKey(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWheelEventWheelDelta(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWheelEventWheelDeltaX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWheelEventWheelDeltaY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWheelEventOffsetX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWheelEventOffsetY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWheelEventX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWheelEventY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWheelEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp
index 14153e2139..2789b1958c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp
@@ -25,8 +25,6 @@
 #include "JSWorker.h"
 
 #include "EventListener.h"
-#include "Frame.h"
-#include "JSDOMGlobalObject.h"
 #include "JSEventListener.h"
 #include "Worker.h"
 #include <runtime/Error.h>
@@ -42,7 +40,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSWorker);
 
 static const HashTableValue JSWorkerTableValues[2] =
 {
-    { "onmessage", DontDelete, (intptr_t)jsWorkerOnmessage, (intptr_t)setJSWorkerOnmessage },
+    { "onmessage", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerOnmessage), (intptr_t)setJSWorkerOnmessage },
     { 0, 0, 0, 0 }
 };
 
@@ -57,8 +55,8 @@ static JSC_CONST_HASHTABLE HashTable JSWorkerTable =
 
 static const HashTableValue JSWorkerPrototypeTableValues[3] =
 {
-    { "postMessage", DontDelete|Function, (intptr_t)jsWorkerPrototypeFunctionPostMessage, (intptr_t)2 },
-    { "terminate", DontDelete|Function, (intptr_t)jsWorkerPrototypeFunctionTerminate, (intptr_t)0 },
+    { "postMessage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWorkerPrototypeFunctionPostMessage), (intptr_t)2 },
+    { "terminate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWorkerPrototypeFunctionTerminate), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -108,14 +106,16 @@ bool JSWorker::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prope
     return getStaticValueDescriptor<JSWorker, Base>(exec, &JSWorkerTable, this, propertyName, descriptor);
 }
 
-JSValue jsWorkerOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerOnmessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorker* castedThis = static_cast<JSWorker*>(asObject(slot.slotBase()));
+    JSWorker* castedThis = static_cast<JSWorker*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Worker* imp = static_cast<Worker*>(castedThis->impl());
     if (EventListener* listener = imp->onmessage()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
@@ -129,10 +129,7 @@ void setJSWorkerOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Worker* imp = static_cast<Worker*>(static_cast<JSWorker*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmessage(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorker.h b/src/3rdparty/webkit/WebCore/generated/JSWorker.h
index 28f2e38996..e908a1a78a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorker.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 
@@ -70,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSWorkerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -83,7 +83,7 @@ JSC::JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionPostMessage(JSC::ExecState*,
 JSC::JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionTerminate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsWorkerOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerOnmessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWorkerOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp
index 5b7b1057bb..7195a5c4bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp
@@ -31,6 +31,7 @@
 #include "JSEventSource.h"
 #include "JSMessageChannel.h"
 #include "JSMessageEvent.h"
+#include "JSWebSocket.h"
 #include "JSWorkerContext.h"
 #include "JSWorkerLocation.h"
 #include "JSWorkerNavigator.h"
@@ -50,17 +51,18 @@ ASSERT_CLASS_FITS_IN_CELL(JSWorkerContext);
 
 /* Hash table */
 
-static const HashTableValue JSWorkerContextTableValues[10] =
-{
-    { "self", DontDelete, (intptr_t)jsWorkerContextSelf, (intptr_t)setJSWorkerContextSelf },
-    { "location", DontDelete, (intptr_t)jsWorkerContextLocation, (intptr_t)setJSWorkerContextLocation },
-    { "onerror", DontDelete, (intptr_t)jsWorkerContextOnerror, (intptr_t)setJSWorkerContextOnerror },
-    { "navigator", DontDelete, (intptr_t)jsWorkerContextNavigator, (intptr_t)setJSWorkerContextNavigator },
-    { "MessageEvent", DontDelete, (intptr_t)jsWorkerContextMessageEventConstructor, (intptr_t)setJSWorkerContextMessageEventConstructor },
-    { "WorkerLocation", DontDelete, (intptr_t)jsWorkerContextWorkerLocationConstructor, (intptr_t)setJSWorkerContextWorkerLocationConstructor },
-    { "MessageChannel", DontDelete, (intptr_t)jsWorkerContextMessageChannelConstructor, (intptr_t)setJSWorkerContextMessageChannelConstructor },
-    { "EventSource", DontDelete, (intptr_t)jsWorkerContextEventSourceConstructor, (intptr_t)setJSWorkerContextEventSourceConstructor },
-    { "XMLHttpRequest", DontDelete, (intptr_t)jsWorkerContextXMLHttpRequestConstructor, (intptr_t)setJSWorkerContextXMLHttpRequestConstructor },
+static const HashTableValue JSWorkerContextTableValues[11] =
+{
+    { "self", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerContextSelf), (intptr_t)setJSWorkerContextSelf },
+    { "location", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerContextLocation), (intptr_t)setJSWorkerContextLocation },
+    { "onerror", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerContextOnerror), (intptr_t)setJSWorkerContextOnerror },
+    { "navigator", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerContextNavigator), (intptr_t)setJSWorkerContextNavigator },
+    { "MessageEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerContextMessageEventConstructor), (intptr_t)setJSWorkerContextMessageEventConstructor },
+    { "WorkerLocation", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerContextWorkerLocationConstructor), (intptr_t)setJSWorkerContextWorkerLocationConstructor },
+    { "MessageChannel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerContextMessageChannelConstructor), (intptr_t)setJSWorkerContextMessageChannelConstructor },
+    { "EventSource", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerContextEventSourceConstructor), (intptr_t)setJSWorkerContextEventSourceConstructor },
+    { "XMLHttpRequest", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerContextXMLHttpRequestConstructor), (intptr_t)setJSWorkerContextXMLHttpRequestConstructor },
+    { "WebSocket", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerContextWebSocketConstructor), (intptr_t)setJSWorkerContextWebSocketConstructor },
     { 0, 0, 0, 0 }
 };
 
@@ -75,15 +77,15 @@ static JSC_CONST_HASHTABLE HashTable JSWorkerContextTable =
 
 static const HashTableValue JSWorkerContextPrototypeTableValues[10] =
 {
-    { "close", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionClose, (intptr_t)0 },
-    { "importScripts", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionImportScripts, (intptr_t)0 },
-    { "setTimeout", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionSetTimeout, (intptr_t)2 },
-    { "clearTimeout", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionClearTimeout, (intptr_t)1 },
-    { "setInterval", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionSetInterval, (intptr_t)2 },
-    { "clearInterval", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionClearInterval, (intptr_t)1 },
-    { "addEventListener", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { "close", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWorkerContextPrototypeFunctionClose), (intptr_t)0 },
+    { "importScripts", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWorkerContextPrototypeFunctionImportScripts), (intptr_t)0 },
+    { "setTimeout", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWorkerContextPrototypeFunctionSetTimeout), (intptr_t)2 },
+    { "clearTimeout", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWorkerContextPrototypeFunctionClearTimeout), (intptr_t)1 },
+    { "setInterval", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWorkerContextPrototypeFunctionSetInterval), (intptr_t)2 },
+    { "clearInterval", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWorkerContextPrototypeFunctionClearInterval), (intptr_t)1 },
+    { "addEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWorkerContextPrototypeFunctionAddEventListener), (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWorkerContextPrototypeFunctionRemoveEventListener), (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsWorkerContextPrototypeFunctionDispatchEvent), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -128,7 +130,7 @@ JSWorkerContext::JSWorkerContext(NonNullPassRefPtr<Structure> structure, PassRef
 
 JSWorkerContext::~JSWorkerContext()
 {
-    impl()->invalidateEventListeners();
+    impl()->invalidateJSEventListeners(this);
 }
 
 bool JSWorkerContext::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -145,72 +147,83 @@ bool JSWorkerContext::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSWorkerContext, Base>(exec, getJSWorkerContextTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsWorkerContextSelf(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextSelf(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slot.slotBase()));
+    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerContext* imp = static_cast<WorkerContext*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->self()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->self()));
+    return result;
 }
 
-JSValue jsWorkerContextLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextLocation(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slot.slotBase()));
+    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerContext* imp = static_cast<WorkerContext*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->location()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->location()));
+    return result;
 }
 
-JSValue jsWorkerContextOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slot.slotBase()));
+    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerContext* imp = static_cast<WorkerContext*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsWorkerContextNavigator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextNavigator(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slot.slotBase()));
+    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerContext* imp = static_cast<WorkerContext*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->navigator()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->navigator()));
+    return result;
 }
 
-JSValue jsWorkerContextMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextMessageEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slot.slotBase()));
+    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slotBase));
     return JSMessageEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsWorkerContextWorkerLocationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextWorkerLocationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slot.slotBase()));
+    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slotBase));
     return JSWorkerLocation::getConstructor(exec, castedThis);
 }
 
-JSValue jsWorkerContextMessageChannelConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextMessageChannelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slot.slotBase()));
+    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slotBase));
     return castedThis->messageChannel(exec);
 }
 
-JSValue jsWorkerContextEventSourceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextEventSourceConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slot.slotBase()));
+    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slotBase));
     return castedThis->eventSource(exec);
 }
 
-JSValue jsWorkerContextXMLHttpRequestConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextXMLHttpRequestConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slot.slotBase()));
+    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slotBase));
     return castedThis->xmlHttpRequest(exec);
 }
 
+JSValue jsWorkerContextWebSocketConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slotBase));
+    return castedThis->webSocket(exec);
+}
+
 void JSWorkerContext::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSWorkerContext, Base>(exec, propertyName, value, getJSWorkerContextTable(exec), this, slot);
@@ -232,8 +245,7 @@ void setJSWorkerContextOnerror(ExecState* exec, JSObject* thisObject, JSValue va
 {
     UNUSED_PARAM(exec);
     WorkerContext* imp = static_cast<WorkerContext*>(static_cast<JSWorkerContext*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSWorkerContext*>(thisObject);
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSWorkerContextNavigator(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -272,6 +284,12 @@ void setJSWorkerContextXMLHttpRequestConstructor(ExecState* exec, JSObject* this
     static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "XMLHttpRequest"), value);
 }
 
+void setJSWorkerContextWebSocketConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    // Shadowing a built-in constructor
+    static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "WebSocket"), value);
+}
+
 JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionClose(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
index f44ba01594..1880ef735c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -54,6 +54,7 @@ public:
     JSC::JSValue messageChannel(JSC::ExecState*) const;
     JSC::JSValue eventSource(JSC::ExecState*) const;
     JSC::JSValue xmlHttpRequest(JSC::ExecState*) const;
+    JSC::JSValue webSocket(JSC::ExecState*) const;
 
     // Custom functions
     JSC::JSValue importScripts(JSC::ExecState*, const JSC::ArgList&);
@@ -76,7 +77,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSWorkerContextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -96,24 +97,26 @@ JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionRemoveEventListener(J
 JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsWorkerContextSelf(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerContextSelf(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWorkerContextSelf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWorkerContextLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerContextLocation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWorkerContextLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWorkerContextOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerContextOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWorkerContextOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWorkerContextNavigator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerContextNavigator(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWorkerContextNavigator(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWorkerContextMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerContextMessageEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWorkerContextMessageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWorkerContextWorkerLocationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerContextWorkerLocationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWorkerContextWorkerLocationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWorkerContextMessageChannelConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerContextMessageChannelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWorkerContextMessageChannelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWorkerContextEventSourceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerContextEventSourceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWorkerContextEventSourceConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsWorkerContextXMLHttpRequestConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerContextXMLHttpRequestConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSWorkerContextXMLHttpRequestConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerContextWebSocketConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSWorkerContextWebSocketConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerContextBase.lut.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerContextBase.lut.h
deleted file mode 100644
index e69de29bb2..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerContextBase.lut.h
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
index 6046aa6648..c0876a93f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
@@ -40,15 +40,15 @@ ASSERT_CLASS_FITS_IN_CELL(JSWorkerLocation);
 
 static const HashTableValue JSWorkerLocationTableValues[10] =
 {
-    { "href", DontDelete|ReadOnly, (intptr_t)jsWorkerLocationHref, (intptr_t)0 },
-    { "protocol", DontDelete|ReadOnly, (intptr_t)jsWorkerLocationProtocol, (intptr_t)0 },
-    { "host", DontDelete|ReadOnly, (intptr_t)jsWorkerLocationHost, (intptr_t)0 },
-    { "hostname", DontDelete|ReadOnly, (intptr_t)jsWorkerLocationHostname, (intptr_t)0 },
-    { "port", DontDelete|ReadOnly, (intptr_t)jsWorkerLocationPort, (intptr_t)0 },
-    { "pathname", DontDelete|ReadOnly, (intptr_t)jsWorkerLocationPathname, (intptr_t)0 },
-    { "search", DontDelete|ReadOnly, (intptr_t)jsWorkerLocationSearch, (intptr_t)0 },
-    { "hash", DontDelete|ReadOnly, (intptr_t)jsWorkerLocationHash, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsWorkerLocationConstructor, (intptr_t)0 },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerLocationHref), (intptr_t)0 },
+    { "protocol", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerLocationProtocol), (intptr_t)0 },
+    { "host", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerLocationHost), (intptr_t)0 },
+    { "hostname", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerLocationHostname), (intptr_t)0 },
+    { "port", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerLocationPort), (intptr_t)0 },
+    { "pathname", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerLocationPathname), (intptr_t)0 },
+    { "search", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerLocationSearch), (intptr_t)0 },
+    { "hash", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerLocationHash), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerLocationConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -87,7 +87,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -110,7 +110,7 @@ bool JSWorkerLocationConstructor::getOwnPropertyDescriptor(ExecState* exec, cons
 
 static const HashTableValue JSWorkerLocationPrototypeTableValues[2] =
 {
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsWorkerLocationPrototypeFunctionToString, (intptr_t)0 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsWorkerLocationPrototypeFunctionToString), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -174,73 +174,81 @@ bool JSWorkerLocation::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSWorkerLocation, Base>(exec, getJSWorkerLocationTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsWorkerLocationHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slot.slotBase()));
+    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(castedThis->impl());
-    return jsString(exec, imp->href());
+    JSValue result = jsString(exec, imp->href());
+    return result;
 }
 
-JSValue jsWorkerLocationProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationProtocol(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slot.slotBase()));
+    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(castedThis->impl());
-    return jsString(exec, imp->protocol());
+    JSValue result = jsString(exec, imp->protocol());
+    return result;
 }
 
-JSValue jsWorkerLocationHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationHost(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slot.slotBase()));
+    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(castedThis->impl());
-    return jsString(exec, imp->host());
+    JSValue result = jsString(exec, imp->host());
+    return result;
 }
 
-JSValue jsWorkerLocationHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationHostname(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slot.slotBase()));
+    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(castedThis->impl());
-    return jsString(exec, imp->hostname());
+    JSValue result = jsString(exec, imp->hostname());
+    return result;
 }
 
-JSValue jsWorkerLocationPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationPort(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slot.slotBase()));
+    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(castedThis->impl());
-    return jsString(exec, imp->port());
+    JSValue result = jsString(exec, imp->port());
+    return result;
 }
 
-JSValue jsWorkerLocationPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationPathname(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slot.slotBase()));
+    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(castedThis->impl());
-    return jsString(exec, imp->pathname());
+    JSValue result = jsString(exec, imp->pathname());
+    return result;
 }
 
-JSValue jsWorkerLocationSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationSearch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slot.slotBase()));
+    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(castedThis->impl());
-    return jsString(exec, imp->search());
+    JSValue result = jsString(exec, imp->search());
+    return result;
 }
 
-JSValue jsWorkerLocationHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationHash(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slot.slotBase()));
+    JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(castedThis->impl());
-    return jsString(exec, imp->hash());
+    JSValue result = jsString(exec, imp->hash());
+    return result;
 }
 
-JSValue jsWorkerLocationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerLocation* domObject = static_cast<JSWorkerLocation*>(asObject(slot.slotBase()));
+    JSWorkerLocation* domObject = static_cast<JSWorkerLocation*>(asObject(slotBase));
     return JSWorkerLocation::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSWorkerLocation::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
index e7d8062a94..f6e080f55f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(WORKERS)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -70,7 +69,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSWorkerLocationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -82,15 +81,15 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsWorkerLocationPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsWorkerLocationHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWorkerLocationProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWorkerLocationHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWorkerLocationHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWorkerLocationPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWorkerLocationPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWorkerLocationSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWorkerLocationHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWorkerLocationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWorkerLocationProtocol(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWorkerLocationHost(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWorkerLocationHostname(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWorkerLocationPort(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWorkerLocationPathname(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWorkerLocationSearch(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWorkerLocationHash(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWorkerLocationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp
index 29c2364c99..49c9274ba3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp
@@ -39,11 +39,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSWorkerNavigator);
 
 static const HashTableValue JSWorkerNavigatorTableValues[6] =
 {
-    { "appName", DontDelete|ReadOnly, (intptr_t)jsWorkerNavigatorAppName, (intptr_t)0 },
-    { "appVersion", DontDelete|ReadOnly, (intptr_t)jsWorkerNavigatorAppVersion, (intptr_t)0 },
-    { "platform", DontDelete|ReadOnly, (intptr_t)jsWorkerNavigatorPlatform, (intptr_t)0 },
-    { "userAgent", DontDelete|ReadOnly, (intptr_t)jsWorkerNavigatorUserAgent, (intptr_t)0 },
-    { "onLine", DontDelete|ReadOnly, (intptr_t)jsWorkerNavigatorOnLine, (intptr_t)0 },
+    { "appName", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerNavigatorAppName), (intptr_t)0 },
+    { "appVersion", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerNavigatorAppVersion), (intptr_t)0 },
+    { "platform", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerNavigatorPlatform), (intptr_t)0 },
+    { "userAgent", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerNavigatorUserAgent), (intptr_t)0 },
+    { "onLine", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsWorkerNavigatorOnLine), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -111,44 +111,49 @@ bool JSWorkerNavigator::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSWorkerNavigator, Base>(exec, getJSWorkerNavigatorTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsWorkerNavigatorAppName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerNavigatorAppName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerNavigator* castedThis = static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()));
+    JSWorkerNavigator* castedThis = static_cast<JSWorkerNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerNavigator* imp = static_cast<WorkerNavigator*>(castedThis->impl());
-    return jsString(exec, imp->appName());
+    JSValue result = jsString(exec, imp->appName());
+    return result;
 }
 
-JSValue jsWorkerNavigatorAppVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerNavigatorAppVersion(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerNavigator* castedThis = static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()));
+    JSWorkerNavigator* castedThis = static_cast<JSWorkerNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerNavigator* imp = static_cast<WorkerNavigator*>(castedThis->impl());
-    return jsString(exec, imp->appVersion());
+    JSValue result = jsString(exec, imp->appVersion());
+    return result;
 }
 
-JSValue jsWorkerNavigatorPlatform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerNavigatorPlatform(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerNavigator* castedThis = static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()));
+    JSWorkerNavigator* castedThis = static_cast<JSWorkerNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerNavigator* imp = static_cast<WorkerNavigator*>(castedThis->impl());
-    return jsString(exec, imp->platform());
+    JSValue result = jsString(exec, imp->platform());
+    return result;
 }
 
-JSValue jsWorkerNavigatorUserAgent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerNavigatorUserAgent(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerNavigator* castedThis = static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()));
+    JSWorkerNavigator* castedThis = static_cast<JSWorkerNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerNavigator* imp = static_cast<WorkerNavigator*>(castedThis->impl());
-    return jsString(exec, imp->userAgent());
+    JSValue result = jsString(exec, imp->userAgent());
+    return result;
 }
 
-JSValue jsWorkerNavigatorOnLine(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerNavigatorOnLine(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSWorkerNavigator* castedThis = static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()));
+    JSWorkerNavigator* castedThis = static_cast<JSWorkerNavigator*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     WorkerNavigator* imp = static_cast<WorkerNavigator*>(castedThis->impl());
-    return jsBoolean(imp->onLine());
+    JSValue result = jsBoolean(imp->onLine());
+    return result;
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WorkerNavigator* object)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
index f459679e64..2a8db049ae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(WORKERS)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     WorkerNavigator* impl() const { return m_impl.get(); }
@@ -67,7 +66,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSWorkerNavigatorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -76,11 +75,11 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsWorkerNavigatorAppName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWorkerNavigatorAppVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWorkerNavigatorPlatform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWorkerNavigatorUserAgent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsWorkerNavigatorOnLine(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerNavigatorAppName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWorkerNavigatorAppVersion(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWorkerNavigatorPlatform(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWorkerNavigatorUserAgent(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsWorkerNavigatorOnLine(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp
index d81c689448..878c45f058 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp
@@ -24,8 +24,6 @@
 #include "Document.h"
 #include "Event.h"
 #include "EventListener.h"
-#include "Frame.h"
-#include "JSDOMGlobalObject.h"
 #include "JSDocument.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
@@ -49,19 +47,19 @@ ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequest);
 
 static const HashTableValue JSXMLHttpRequestTableValues[14] =
 {
-    { "onabort", DontDelete, (intptr_t)jsXMLHttpRequestOnabort, (intptr_t)setJSXMLHttpRequestOnabort },
-    { "onerror", DontDelete, (intptr_t)jsXMLHttpRequestOnerror, (intptr_t)setJSXMLHttpRequestOnerror },
-    { "onload", DontDelete, (intptr_t)jsXMLHttpRequestOnload, (intptr_t)setJSXMLHttpRequestOnload },
-    { "onloadstart", DontDelete, (intptr_t)jsXMLHttpRequestOnloadstart, (intptr_t)setJSXMLHttpRequestOnloadstart },
-    { "onprogress", DontDelete, (intptr_t)jsXMLHttpRequestOnprogress, (intptr_t)setJSXMLHttpRequestOnprogress },
-    { "onreadystatechange", DontDelete, (intptr_t)jsXMLHttpRequestOnreadystatechange, (intptr_t)setJSXMLHttpRequestOnreadystatechange },
-    { "readyState", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestReadyState, (intptr_t)0 },
-    { "withCredentials", DontDelete, (intptr_t)jsXMLHttpRequestWithCredentials, (intptr_t)setJSXMLHttpRequestWithCredentials },
-    { "upload", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestUpload, (intptr_t)0 },
-    { "responseText", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestResponseText, (intptr_t)0 },
-    { "responseXML", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestResponseXML, (intptr_t)0 },
-    { "status", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestStatus, (intptr_t)0 },
-    { "statusText", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestStatusText, (intptr_t)0 },
+    { "onabort", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestOnabort), (intptr_t)setJSXMLHttpRequestOnabort },
+    { "onerror", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestOnerror), (intptr_t)setJSXMLHttpRequestOnerror },
+    { "onload", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestOnload), (intptr_t)setJSXMLHttpRequestOnload },
+    { "onloadstart", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestOnloadstart), (intptr_t)setJSXMLHttpRequestOnloadstart },
+    { "onprogress", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestOnprogress), (intptr_t)setJSXMLHttpRequestOnprogress },
+    { "onreadystatechange", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestOnreadystatechange), (intptr_t)setJSXMLHttpRequestOnreadystatechange },
+    { "readyState", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestReadyState), (intptr_t)0 },
+    { "withCredentials", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestWithCredentials), (intptr_t)setJSXMLHttpRequestWithCredentials },
+    { "upload", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestUpload), (intptr_t)0 },
+    { "responseText", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestResponseText), (intptr_t)0 },
+    { "responseXML", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestResponseXML), (intptr_t)0 },
+    { "status", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestStatus), (intptr_t)0 },
+    { "statusText", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestStatusText), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,21 +74,21 @@ static JSC_CONST_HASHTABLE HashTable JSXMLHttpRequestTable =
 
 static const HashTableValue JSXMLHttpRequestPrototypeTableValues[16] =
 {
-    { "UNSENT", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestUNSENT, (intptr_t)0 },
-    { "OPENED", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestOPENED, (intptr_t)0 },
-    { "HEADERS_RECEIVED", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestHEADERS_RECEIVED, (intptr_t)0 },
-    { "LOADING", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestLOADING, (intptr_t)0 },
-    { "DONE", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestDONE, (intptr_t)0 },
-    { "open", DontDelete|Function, (intptr_t)jsXMLHttpRequestPrototypeFunctionOpen, (intptr_t)5 },
-    { "setRequestHeader", DontDelete|Function, (intptr_t)jsXMLHttpRequestPrototypeFunctionSetRequestHeader, (intptr_t)2 },
-    { "send", DontDelete|Function, (intptr_t)jsXMLHttpRequestPrototypeFunctionSend, (intptr_t)1 },
-    { "abort", DontDelete|Function, (intptr_t)jsXMLHttpRequestPrototypeFunctionAbort, (intptr_t)0 },
-    { "getAllResponseHeaders", DontDelete|Function, (intptr_t)jsXMLHttpRequestPrototypeFunctionGetAllResponseHeaders, (intptr_t)0 },
-    { "getResponseHeader", DontDelete|Function, (intptr_t)jsXMLHttpRequestPrototypeFunctionGetResponseHeader, (intptr_t)1 },
-    { "overrideMimeType", DontDelete|Function, (intptr_t)jsXMLHttpRequestPrototypeFunctionOverrideMimeType, (intptr_t)1 },
-    { "addEventListener", DontDelete|Function, (intptr_t)jsXMLHttpRequestPrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsXMLHttpRequestPrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsXMLHttpRequestPrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { "UNSENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestUNSENT), (intptr_t)0 },
+    { "OPENED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestOPENED), (intptr_t)0 },
+    { "HEADERS_RECEIVED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestHEADERS_RECEIVED), (intptr_t)0 },
+    { "LOADING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestLOADING), (intptr_t)0 },
+    { "DONE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestDONE), (intptr_t)0 },
+    { "open", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXMLHttpRequestPrototypeFunctionOpen), (intptr_t)5 },
+    { "setRequestHeader", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXMLHttpRequestPrototypeFunctionSetRequestHeader), (intptr_t)2 },
+    { "send", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXMLHttpRequestPrototypeFunctionSend), (intptr_t)1 },
+    { "abort", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXMLHttpRequestPrototypeFunctionAbort), (intptr_t)0 },
+    { "getAllResponseHeaders", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXMLHttpRequestPrototypeFunctionGetAllResponseHeaders), (intptr_t)0 },
+    { "getResponseHeader", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXMLHttpRequestPrototypeFunctionGetResponseHeader), (intptr_t)1 },
+    { "overrideMimeType", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXMLHttpRequestPrototypeFunctionOverrideMimeType), (intptr_t)1 },
+    { "addEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXMLHttpRequestPrototypeFunctionAddEventListener), (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXMLHttpRequestPrototypeFunctionRemoveEventListener), (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXMLHttpRequestPrototypeFunctionDispatchEvent), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -136,7 +134,7 @@ JSXMLHttpRequest::JSXMLHttpRequest(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSXMLHttpRequest::~JSXMLHttpRequest()
 {
-    impl()->invalidateEventListeners();
+    impl()->invalidateJSEventListeners(this);
     forgetDOMObject(this, impl());
 }
 
@@ -155,119 +153,135 @@ bool JSXMLHttpRequest::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSXMLHttpRequest, Base>(exec, getJSXMLHttpRequestTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsXMLHttpRequestOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnabort(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()));
+    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThis->impl());
     if (EventListener* listener = imp->onabort()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsXMLHttpRequestOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()));
+    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsXMLHttpRequestOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()));
+    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThis->impl());
     if (EventListener* listener = imp->onload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsXMLHttpRequestOnloadstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnloadstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()));
+    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThis->impl());
     if (EventListener* listener = imp->onloadstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsXMLHttpRequestOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnprogress(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()));
+    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThis->impl());
     if (EventListener* listener = imp->onprogress()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsXMLHttpRequestOnreadystatechange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnreadystatechange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()));
+    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThis->impl());
     if (EventListener* listener = imp->onreadystatechange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsXMLHttpRequestReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestReadyState(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()));
+    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThis->impl());
-    return jsNumber(exec, imp->readyState());
+    JSValue result = jsNumber(exec, imp->readyState());
+    return result;
 }
 
-JSValue jsXMLHttpRequestWithCredentials(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestWithCredentials(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()));
+    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThis->impl());
-    return jsBoolean(imp->withCredentials());
+    JSValue result = jsBoolean(imp->withCredentials());
+    return result;
 }
 
-JSValue jsXMLHttpRequestUpload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUpload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()));
+    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->upload()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->upload()));
+    return result;
 }
 
-JSValue jsXMLHttpRequestResponseText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestResponseText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()));
+    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slotBase));
     return castedThis->responseText(exec);
 }
 
-JSValue jsXMLHttpRequestResponseXML(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestResponseXML(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()));
+    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->responseXML()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->responseXML()));
+    return result;
 }
 
-JSValue jsXMLHttpRequestStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestStatus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()));
+    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slotBase));
     ExceptionCode ec = 0;
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThis->impl());
     JSC::JSValue result = jsNumber(exec, imp->status(ec));
@@ -275,9 +289,9 @@ JSValue jsXMLHttpRequestStatus(ExecState* exec, const Identifier&, const Propert
     return result;
 }
 
-JSValue jsXMLHttpRequestStatusText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestStatusText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()));
+    JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slotBase));
     ExceptionCode ec = 0;
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThis->impl());
     JSC::JSValue result = jsString(exec, imp->statusText(ec));
@@ -294,65 +308,48 @@ void setJSXMLHttpRequestOnabort(ExecState* exec, JSObject* thisObject, JSValue v
 {
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
+    imp->setOnabort(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSXMLHttpRequestOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSXMLHttpRequestOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSXMLHttpRequestOnloadstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnloadstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOnloadstart(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSXMLHttpRequestOnprogress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
+    imp->setOnprogress(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSXMLHttpRequestOnreadystatechange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnreadystatechange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnreadystatechange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSXMLHttpRequestWithCredentials(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
+    JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(thisObject);
+    XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setWithCredentials(value.toBoolean(exec), ec);
     setDOMException(exec, ec);
@@ -466,27 +463,27 @@ JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionDispatchEvent(ExecState*
 
 // Constant getters
 
-JSValue jsXMLHttpRequestUNSENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestUNSENT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsXMLHttpRequestOPENED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestOPENED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsXMLHttpRequestHEADERS_RECEIVED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestHEADERS_RECEIVED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsXMLHttpRequestLOADING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestLOADING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsXMLHttpRequestDONE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestDONE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
index 5c05753ef1..7286feb6cb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
@@ -21,7 +21,6 @@
 #ifndef JSXMLHttpRequest_h
 #define JSXMLHttpRequest_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -82,7 +81,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSXMLHttpRequestPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -103,33 +102,33 @@ JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionRemoveEventListener(
 JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsXMLHttpRequestOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestOnabort(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSXMLHttpRequestOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsXMLHttpRequestOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSXMLHttpRequestOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsXMLHttpRequestOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestOnload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSXMLHttpRequestOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsXMLHttpRequestOnloadstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestOnloadstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSXMLHttpRequestOnloadstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsXMLHttpRequestOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestOnprogress(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSXMLHttpRequestOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsXMLHttpRequestOnreadystatechange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestOnreadystatechange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSXMLHttpRequestOnreadystatechange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsXMLHttpRequestReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXMLHttpRequestWithCredentials(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestReadyState(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXMLHttpRequestWithCredentials(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSXMLHttpRequestWithCredentials(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsXMLHttpRequestUpload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXMLHttpRequestResponseText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXMLHttpRequestResponseXML(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXMLHttpRequestStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXMLHttpRequestStatusText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestUpload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXMLHttpRequestResponseText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXMLHttpRequestResponseXML(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXMLHttpRequestStatus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXMLHttpRequestStatusText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsXMLHttpRequestUNSENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXMLHttpRequestOPENED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXMLHttpRequestHEADERS_RECEIVED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXMLHttpRequestLOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXMLHttpRequestDONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestUNSENT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXMLHttpRequestOPENED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXMLHttpRequestHEADERS_RECEIVED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXMLHttpRequestLOADING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXMLHttpRequestDONE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
index 6de17c7ac3..d6717a565d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
@@ -38,10 +38,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestException);
 
 static const HashTableValue JSXMLHttpRequestExceptionTableValues[5] =
 {
-    { "code", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestExceptionCode, (intptr_t)0 },
-    { "name", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestExceptionName, (intptr_t)0 },
-    { "message", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestExceptionMessage, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsXMLHttpRequestExceptionConstructor, (intptr_t)0 },
+    { "code", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestExceptionCode), (intptr_t)0 },
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestExceptionName), (intptr_t)0 },
+    { "message", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestExceptionMessage), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestExceptionConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -56,8 +56,8 @@ static JSC_CONST_HASHTABLE HashTable JSXMLHttpRequestExceptionTable =
 
 static const HashTableValue JSXMLHttpRequestExceptionConstructorTableValues[3] =
 {
-    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestExceptionNETWORK_ERR, (intptr_t)0 },
-    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestExceptionABORT_ERR, (intptr_t)0 },
+    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestExceptionNETWORK_ERR), (intptr_t)0 },
+    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestExceptionABORT_ERR), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -82,7 +82,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -105,9 +105,9 @@ bool JSXMLHttpRequestExceptionConstructor::getOwnPropertyDescriptor(ExecState* e
 
 static const HashTableValue JSXMLHttpRequestExceptionPrototypeTableValues[4] =
 {
-    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestExceptionNETWORK_ERR, (intptr_t)0 },
-    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestExceptionABORT_ERR, (intptr_t)0 },
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsXMLHttpRequestExceptionPrototypeFunctionToString, (intptr_t)0 },
+    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestExceptionNETWORK_ERR), (intptr_t)0 },
+    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestExceptionABORT_ERR), (intptr_t)0 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsXMLHttpRequestExceptionPrototypeFunctionToString), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -171,33 +171,36 @@ bool JSXMLHttpRequestException::getOwnPropertyDescriptor(ExecState* exec, const
     return getStaticValueDescriptor<JSXMLHttpRequestException, Base>(exec, getJSXMLHttpRequestExceptionTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsXMLHttpRequestExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestExceptionCode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequestException* castedThis = static_cast<JSXMLHttpRequestException*>(asObject(slot.slotBase()));
+    JSXMLHttpRequestException* castedThis = static_cast<JSXMLHttpRequestException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequestException* imp = static_cast<XMLHttpRequestException*>(castedThis->impl());
-    return jsNumber(exec, imp->code());
+    JSValue result = jsNumber(exec, imp->code());
+    return result;
 }
 
-JSValue jsXMLHttpRequestExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestExceptionName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequestException* castedThis = static_cast<JSXMLHttpRequestException*>(asObject(slot.slotBase()));
+    JSXMLHttpRequestException* castedThis = static_cast<JSXMLHttpRequestException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequestException* imp = static_cast<XMLHttpRequestException*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsXMLHttpRequestExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestExceptionMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequestException* castedThis = static_cast<JSXMLHttpRequestException*>(asObject(slot.slotBase()));
+    JSXMLHttpRequestException* castedThis = static_cast<JSXMLHttpRequestException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequestException* imp = static_cast<XMLHttpRequestException*>(castedThis->impl());
-    return jsString(exec, imp->message());
+    JSValue result = jsString(exec, imp->message());
+    return result;
 }
 
-JSValue jsXMLHttpRequestExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequestException* domObject = static_cast<JSXMLHttpRequestException*>(asObject(slot.slotBase()));
+    JSXMLHttpRequestException* domObject = static_cast<JSXMLHttpRequestException*>(asObject(slotBase));
     return JSXMLHttpRequestException::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSXMLHttpRequestException::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -220,12 +223,12 @@ JSValue JSC_HOST_CALL jsXMLHttpRequestExceptionPrototypeFunctionToString(ExecSta
 
 // Constant getters
 
-JSValue jsXMLHttpRequestExceptionNETWORK_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestExceptionNETWORK_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(101));
 }
 
-JSValue jsXMLHttpRequestExceptionABORT_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestExceptionABORT_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(102));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
index 54dcfde319..4621d574f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
@@ -21,7 +21,6 @@
 #ifndef JSXMLHttpRequestException_h
 #define JSXMLHttpRequestException_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -68,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSXMLHttpRequestExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,14 +79,14 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsXMLHttpRequestExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXMLHttpRequestExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXMLHttpRequestExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXMLHttpRequestExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestExceptionCode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXMLHttpRequestExceptionName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXMLHttpRequestExceptionMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXMLHttpRequestExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsXMLHttpRequestExceptionNETWORK_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXMLHttpRequestExceptionABORT_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestExceptionNETWORK_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXMLHttpRequestExceptionABORT_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
index 6343a1b7ef..6f19e2c4db 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
@@ -35,9 +35,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestProgressEvent);
 
 static const HashTableValue JSXMLHttpRequestProgressEventTableValues[4] =
 {
-    { "position", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestProgressEventPosition, (intptr_t)0 },
-    { "totalSize", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestProgressEventTotalSize, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsXMLHttpRequestProgressEventConstructor, (intptr_t)0 },
+    { "position", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestProgressEventPosition), (intptr_t)0 },
+    { "totalSize", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestProgressEventTotalSize), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestProgressEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,7 +76,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -146,25 +146,27 @@ bool JSXMLHttpRequestProgressEvent::getOwnPropertyDescriptor(ExecState* exec, co
     return getStaticValueDescriptor<JSXMLHttpRequestProgressEvent, Base>(exec, getJSXMLHttpRequestProgressEventTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsXMLHttpRequestProgressEventPosition(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestProgressEventPosition(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequestProgressEvent* castedThis = static_cast<JSXMLHttpRequestProgressEvent*>(asObject(slot.slotBase()));
+    JSXMLHttpRequestProgressEvent* castedThis = static_cast<JSXMLHttpRequestProgressEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequestProgressEvent* imp = static_cast<XMLHttpRequestProgressEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->position());
+    JSValue result = jsNumber(exec, imp->position());
+    return result;
 }
 
-JSValue jsXMLHttpRequestProgressEventTotalSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestProgressEventTotalSize(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequestProgressEvent* castedThis = static_cast<JSXMLHttpRequestProgressEvent*>(asObject(slot.slotBase()));
+    JSXMLHttpRequestProgressEvent* castedThis = static_cast<JSXMLHttpRequestProgressEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequestProgressEvent* imp = static_cast<XMLHttpRequestProgressEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->totalSize());
+    JSValue result = jsNumber(exec, imp->totalSize());
+    return result;
 }
 
-JSValue jsXMLHttpRequestProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestProgressEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequestProgressEvent* domObject = static_cast<JSXMLHttpRequestProgressEvent*>(asObject(slot.slotBase()));
+    JSXMLHttpRequestProgressEvent* domObject = static_cast<JSXMLHttpRequestProgressEvent*>(asObject(slotBase));
     return JSXMLHttpRequestProgressEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSXMLHttpRequestProgressEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
index 6486dd7591..82df9f4182 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -56,7 +56,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSXMLHttpRequestProgressEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -65,9 +65,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsXMLHttpRequestProgressEventPosition(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXMLHttpRequestProgressEventTotalSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXMLHttpRequestProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestProgressEventPosition(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXMLHttpRequestProgressEventTotalSize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXMLHttpRequestProgressEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
index 9ca797293d..f15100d6d3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
@@ -23,8 +23,6 @@
 
 #include "Event.h"
 #include "EventListener.h"
-#include "Frame.h"
-#include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "RegisteredEventListener.h"
@@ -42,12 +40,12 @@ ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestUpload);
 
 static const HashTableValue JSXMLHttpRequestUploadTableValues[7] =
 {
-    { "onabort", DontDelete, (intptr_t)jsXMLHttpRequestUploadOnabort, (intptr_t)setJSXMLHttpRequestUploadOnabort },
-    { "onerror", DontDelete, (intptr_t)jsXMLHttpRequestUploadOnerror, (intptr_t)setJSXMLHttpRequestUploadOnerror },
-    { "onload", DontDelete, (intptr_t)jsXMLHttpRequestUploadOnload, (intptr_t)setJSXMLHttpRequestUploadOnload },
-    { "onloadstart", DontDelete, (intptr_t)jsXMLHttpRequestUploadOnloadstart, (intptr_t)setJSXMLHttpRequestUploadOnloadstart },
-    { "onprogress", DontDelete, (intptr_t)jsXMLHttpRequestUploadOnprogress, (intptr_t)setJSXMLHttpRequestUploadOnprogress },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsXMLHttpRequestUploadConstructor, (intptr_t)0 },
+    { "onabort", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestUploadOnabort), (intptr_t)setJSXMLHttpRequestUploadOnabort },
+    { "onerror", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestUploadOnerror), (intptr_t)setJSXMLHttpRequestUploadOnerror },
+    { "onload", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestUploadOnload), (intptr_t)setJSXMLHttpRequestUploadOnload },
+    { "onloadstart", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestUploadOnloadstart), (intptr_t)setJSXMLHttpRequestUploadOnloadstart },
+    { "onprogress", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestUploadOnprogress), (intptr_t)setJSXMLHttpRequestUploadOnprogress },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLHttpRequestUploadConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -86,7 +84,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -109,9 +107,9 @@ bool JSXMLHttpRequestUploadConstructor::getOwnPropertyDescriptor(ExecState* exec
 
 static const HashTableValue JSXMLHttpRequestUploadPrototypeTableValues[4] =
 {
-    { "addEventListener", DontDelete|Function, (intptr_t)jsXMLHttpRequestUploadPrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsXMLHttpRequestUploadPrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsXMLHttpRequestUploadPrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { "addEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXMLHttpRequestUploadPrototypeFunctionAddEventListener), (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXMLHttpRequestUploadPrototypeFunctionRemoveEventListener), (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXMLHttpRequestUploadPrototypeFunctionDispatchEvent), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -157,7 +155,7 @@ JSXMLHttpRequestUpload::JSXMLHttpRequestUpload(NonNullPassRefPtr<Structure> stru
 
 JSXMLHttpRequestUpload::~JSXMLHttpRequestUpload()
 {
-    impl()->invalidateEventListeners();
+    impl()->invalidateJSEventListeners(this);
     forgetDOMObject(this, impl());
 }
 
@@ -176,69 +174,79 @@ bool JSXMLHttpRequestUpload::getOwnPropertyDescriptor(ExecState* exec, const Ide
     return getStaticValueDescriptor<JSXMLHttpRequestUpload, Base>(exec, getJSXMLHttpRequestUploadTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsXMLHttpRequestUploadOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadOnabort(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequestUpload* castedThis = static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()));
+    JSXMLHttpRequestUpload* castedThis = static_cast<JSXMLHttpRequestUpload*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(castedThis->impl());
     if (EventListener* listener = imp->onabort()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsXMLHttpRequestUploadOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequestUpload* castedThis = static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()));
+    JSXMLHttpRequestUpload* castedThis = static_cast<JSXMLHttpRequestUpload*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsXMLHttpRequestUploadOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadOnload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequestUpload* castedThis = static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()));
+    JSXMLHttpRequestUpload* castedThis = static_cast<JSXMLHttpRequestUpload*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(castedThis->impl());
     if (EventListener* listener = imp->onload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsXMLHttpRequestUploadOnloadstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadOnloadstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequestUpload* castedThis = static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()));
+    JSXMLHttpRequestUpload* castedThis = static_cast<JSXMLHttpRequestUpload*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(castedThis->impl());
     if (EventListener* listener = imp->onloadstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsXMLHttpRequestUploadOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadOnprogress(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequestUpload* castedThis = static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()));
+    JSXMLHttpRequestUpload* castedThis = static_cast<JSXMLHttpRequestUpload*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(castedThis->impl());
     if (EventListener* listener = imp->onprogress()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsXMLHttpRequestUploadConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLHttpRequestUpload* domObject = static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()));
+    JSXMLHttpRequestUpload* domObject = static_cast<JSXMLHttpRequestUpload*>(asObject(slotBase));
     return JSXMLHttpRequestUpload::getConstructor(exec, domObject->globalObject());
 }
 void JSXMLHttpRequestUpload::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -250,50 +258,35 @@ void setJSXMLHttpRequestUploadOnabort(ExecState* exec, JSObject* thisObject, JSV
 {
     UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
+    imp->setOnabort(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSXMLHttpRequestUploadOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSXMLHttpRequestUploadOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSXMLHttpRequestUploadOnloadstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnloadstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOnloadstart(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSXMLHttpRequestUploadOnprogress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
+    imp->setOnprogress(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSXMLHttpRequestUpload::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
index a613e6d487..a6b15d2698 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
@@ -21,7 +21,6 @@
 #ifndef JSXMLHttpRequestUpload_h
 #define JSXMLHttpRequestUpload_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -75,7 +74,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSXMLHttpRequestUploadPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -89,17 +88,17 @@ JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionRemoveEventLis
 JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsXMLHttpRequestUploadOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestUploadOnabort(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSXMLHttpRequestUploadOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsXMLHttpRequestUploadOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestUploadOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSXMLHttpRequestUploadOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsXMLHttpRequestUploadOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestUploadOnload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSXMLHttpRequestUploadOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsXMLHttpRequestUploadOnloadstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestUploadOnloadstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSXMLHttpRequestUploadOnloadstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsXMLHttpRequestUploadOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestUploadOnprogress(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSXMLHttpRequestUploadOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsXMLHttpRequestUploadConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestUploadConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
index 2fd7e29867..ddf304e832 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
@@ -38,7 +38,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSXMLSerializer);
 
 static const HashTableValue JSXMLSerializerTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsXMLSerializerConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXMLSerializerConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -109,7 +109,7 @@ bool JSXMLSerializerConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSXMLSerializerPrototypeTableValues[2] =
 {
-    { "serializeToString", DontDelete|Function, (intptr_t)jsXMLSerializerPrototypeFunctionSerializeToString, (intptr_t)1 },
+    { "serializeToString", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXMLSerializerPrototypeFunctionSerializeToString), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -165,9 +165,9 @@ bool JSXMLSerializer::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSXMLSerializer, Base>(exec, &JSXMLSerializerTable, this, propertyName, descriptor);
 }
 
-JSValue jsXMLSerializerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLSerializerConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXMLSerializer* domObject = static_cast<JSXMLSerializer*>(asObject(slot.slotBase()));
+    JSXMLSerializer* domObject = static_cast<JSXMLSerializer*>(asObject(slotBase));
     return JSXMLSerializer::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSXMLSerializer::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
index fd50d5d18e..e8efad16d7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
@@ -21,7 +21,6 @@
 #ifndef JSXMLSerializer_h
 #define JSXMLSerializer_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -68,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSXMLSerializerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,7 +79,7 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsXMLSerializerPrototypeFunctionSerializeToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsXMLSerializerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLSerializerConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
index aa8840abef..b006281e1d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
@@ -47,7 +47,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSXPathEvaluator);
 
 static const HashTableValue JSXPathEvaluatorTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsXPathEvaluatorConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathEvaluatorConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -86,7 +86,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -118,9 +118,9 @@ bool JSXPathEvaluatorConstructor::getOwnPropertyDescriptor(ExecState* exec, cons
 
 static const HashTableValue JSXPathEvaluatorPrototypeTableValues[4] =
 {
-    { "createExpression", DontDelete|Function, (intptr_t)jsXPathEvaluatorPrototypeFunctionCreateExpression, (intptr_t)2 },
-    { "createNSResolver", DontDelete|Function, (intptr_t)jsXPathEvaluatorPrototypeFunctionCreateNSResolver, (intptr_t)1 },
-    { "evaluate", DontDelete|Function, (intptr_t)jsXPathEvaluatorPrototypeFunctionEvaluate, (intptr_t)5 },
+    { "createExpression", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXPathEvaluatorPrototypeFunctionCreateExpression), (intptr_t)2 },
+    { "createNSResolver", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXPathEvaluatorPrototypeFunctionCreateNSResolver), (intptr_t)1 },
+    { "evaluate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXPathEvaluatorPrototypeFunctionEvaluate), (intptr_t)5 },
     { 0, 0, 0, 0 }
 };
 
@@ -176,9 +176,9 @@ bool JSXPathEvaluator::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSXPathEvaluator, Base>(exec, &JSXPathEvaluatorTable, this, propertyName, descriptor);
 }
 
-JSValue jsXPathEvaluatorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathEvaluatorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXPathEvaluator* domObject = static_cast<JSXPathEvaluator*>(asObject(slot.slotBase()));
+    JSXPathEvaluator* domObject = static_cast<JSXPathEvaluator*>(asObject(slotBase));
     return JSXPathEvaluator::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSXPathEvaluator::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
index 9b374658c5..914953c094 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(XPATH)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -70,7 +69,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSXPathEvaluatorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -84,7 +83,7 @@ JSC::JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionCreateNSResolver(JSC
 JSC::JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsXPathEvaluatorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathEvaluatorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
index fb6a00a570..50e75d8315 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
@@ -41,10 +41,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSXPathException);
 
 static const HashTableValue JSXPathExceptionTableValues[5] =
 {
-    { "code", DontDelete|ReadOnly, (intptr_t)jsXPathExceptionCode, (intptr_t)0 },
-    { "name", DontDelete|ReadOnly, (intptr_t)jsXPathExceptionName, (intptr_t)0 },
-    { "message", DontDelete|ReadOnly, (intptr_t)jsXPathExceptionMessage, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsXPathExceptionConstructor, (intptr_t)0 },
+    { "code", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathExceptionCode), (intptr_t)0 },
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathExceptionName), (intptr_t)0 },
+    { "message", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathExceptionMessage), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathExceptionConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -59,8 +59,8 @@ static JSC_CONST_HASHTABLE HashTable JSXPathExceptionTable =
 
 static const HashTableValue JSXPathExceptionConstructorTableValues[3] =
 {
-    { "INVALID_EXPRESSION_ERR", DontDelete|ReadOnly, (intptr_t)jsXPathExceptionINVALID_EXPRESSION_ERR, (intptr_t)0 },
-    { "TYPE_ERR", DontDelete|ReadOnly, (intptr_t)jsXPathExceptionTYPE_ERR, (intptr_t)0 },
+    { "INVALID_EXPRESSION_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathExceptionINVALID_EXPRESSION_ERR), (intptr_t)0 },
+    { "TYPE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathExceptionTYPE_ERR), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -85,7 +85,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -108,9 +108,9 @@ bool JSXPathExceptionConstructor::getOwnPropertyDescriptor(ExecState* exec, cons
 
 static const HashTableValue JSXPathExceptionPrototypeTableValues[4] =
 {
-    { "INVALID_EXPRESSION_ERR", DontDelete|ReadOnly, (intptr_t)jsXPathExceptionINVALID_EXPRESSION_ERR, (intptr_t)0 },
-    { "TYPE_ERR", DontDelete|ReadOnly, (intptr_t)jsXPathExceptionTYPE_ERR, (intptr_t)0 },
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsXPathExceptionPrototypeFunctionToString, (intptr_t)0 },
+    { "INVALID_EXPRESSION_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathExceptionINVALID_EXPRESSION_ERR), (intptr_t)0 },
+    { "TYPE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathExceptionTYPE_ERR), (intptr_t)0 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsXPathExceptionPrototypeFunctionToString), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -166,33 +166,36 @@ bool JSXPathException::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSXPathException, Base>(exec, &JSXPathExceptionTable, this, propertyName, descriptor);
 }
 
-JSValue jsXPathExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathExceptionCode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXPathException* castedThis = static_cast<JSXPathException*>(asObject(slot.slotBase()));
+    JSXPathException* castedThis = static_cast<JSXPathException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XPathException* imp = static_cast<XPathException*>(castedThis->impl());
-    return jsNumber(exec, imp->code());
+    JSValue result = jsNumber(exec, imp->code());
+    return result;
 }
 
-JSValue jsXPathExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathExceptionName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXPathException* castedThis = static_cast<JSXPathException*>(asObject(slot.slotBase()));
+    JSXPathException* castedThis = static_cast<JSXPathException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XPathException* imp = static_cast<XPathException*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsXPathExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathExceptionMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXPathException* castedThis = static_cast<JSXPathException*>(asObject(slot.slotBase()));
+    JSXPathException* castedThis = static_cast<JSXPathException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XPathException* imp = static_cast<XPathException*>(castedThis->impl());
-    return jsString(exec, imp->message());
+    JSValue result = jsString(exec, imp->message());
+    return result;
 }
 
-JSValue jsXPathExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXPathException* domObject = static_cast<JSXPathException*>(asObject(slot.slotBase()));
+    JSXPathException* domObject = static_cast<JSXPathException*>(asObject(slotBase));
     return JSXPathException::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSXPathException::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -215,12 +218,12 @@ JSValue JSC_HOST_CALL jsXPathExceptionPrototypeFunctionToString(ExecState* exec,
 
 // Constant getters
 
-JSValue jsXPathExceptionINVALID_EXPRESSION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathExceptionINVALID_EXPRESSION_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(51));
 }
 
-JSValue jsXPathExceptionTYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathExceptionTYPE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(52));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathException.h b/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
index f73ba8853a..3f182d596f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(XPATH)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -70,7 +69,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSXPathExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -82,14 +81,14 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsXPathExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsXPathExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExceptionCode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathExceptionName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathExceptionMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsXPathExceptionINVALID_EXPRESSION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathExceptionTYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExceptionINVALID_EXPRESSION_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathExceptionTYPE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
index af059df662..98c5016bef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
@@ -41,7 +41,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSXPathExpression);
 
 static const HashTableValue JSXPathExpressionTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsXPathExpressionConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathExpressionConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -103,7 +103,7 @@ bool JSXPathExpressionConstructor::getOwnPropertyDescriptor(ExecState* exec, con
 
 static const HashTableValue JSXPathExpressionPrototypeTableValues[2] =
 {
-    { "evaluate", DontDelete|Function, (intptr_t)jsXPathExpressionPrototypeFunctionEvaluate, (intptr_t)3 },
+    { "evaluate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXPathExpressionPrototypeFunctionEvaluate), (intptr_t)3 },
     { 0, 0, 0, 0 }
 };
 
@@ -159,9 +159,9 @@ bool JSXPathExpression::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSXPathExpression, Base>(exec, &JSXPathExpressionTable, this, propertyName, descriptor);
 }
 
-JSValue jsXPathExpressionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathExpressionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXPathExpression* domObject = static_cast<JSXPathExpression*>(asObject(slot.slotBase()));
+    JSXPathExpression* domObject = static_cast<JSXPathExpression*>(asObject(slotBase));
     return JSXPathExpression::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSXPathExpression::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
index f5fd0dcac3..92c61dc8b5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(XPATH)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -70,7 +69,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSXPathExpressionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -82,7 +81,7 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsXPathExpressionPrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsXPathExpressionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExpressionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp
index 7ba29c0d7c..2471697fd7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp
@@ -41,7 +41,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSXPathNSResolver);
 
 static const HashTableValue JSXPathNSResolverPrototypeTableValues[2] =
 {
-    { "lookupNamespaceURI", DontDelete|Function, (intptr_t)jsXPathNSResolverPrototypeFunctionLookupNamespaceURI, (intptr_t)1 },
+    { "lookupNamespaceURI", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXPathNSResolverPrototypeFunctionLookupNamespaceURI), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
index 86ce543a86..e9c08be33e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(XPATH)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     XPathNSResolver* impl() const { return m_impl.get(); }
@@ -67,7 +66,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSXPathNSResolverPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
index d70ad290ae..c234e7f400 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
@@ -43,14 +43,14 @@ ASSERT_CLASS_FITS_IN_CELL(JSXPathResult);
 
 static const HashTableValue JSXPathResultTableValues[9] =
 {
-    { "resultType", DontDelete|ReadOnly, (intptr_t)jsXPathResultResultType, (intptr_t)0 },
-    { "numberValue", DontDelete|ReadOnly, (intptr_t)jsXPathResultNumberValue, (intptr_t)0 },
-    { "stringValue", DontDelete|ReadOnly, (intptr_t)jsXPathResultStringValue, (intptr_t)0 },
-    { "booleanValue", DontDelete|ReadOnly, (intptr_t)jsXPathResultBooleanValue, (intptr_t)0 },
-    { "singleNodeValue", DontDelete|ReadOnly, (intptr_t)jsXPathResultSingleNodeValue, (intptr_t)0 },
-    { "invalidIteratorState", DontDelete|ReadOnly, (intptr_t)jsXPathResultInvalidIteratorState, (intptr_t)0 },
-    { "snapshotLength", DontDelete|ReadOnly, (intptr_t)jsXPathResultSnapshotLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsXPathResultConstructor, (intptr_t)0 },
+    { "resultType", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultResultType), (intptr_t)0 },
+    { "numberValue", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultNumberValue), (intptr_t)0 },
+    { "stringValue", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultStringValue), (intptr_t)0 },
+    { "booleanValue", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultBooleanValue), (intptr_t)0 },
+    { "singleNodeValue", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultSingleNodeValue), (intptr_t)0 },
+    { "invalidIteratorState", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultInvalidIteratorState), (intptr_t)0 },
+    { "snapshotLength", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultSnapshotLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -65,16 +65,16 @@ static JSC_CONST_HASHTABLE HashTable JSXPathResultTable =
 
 static const HashTableValue JSXPathResultConstructorTableValues[11] =
 {
-    { "ANY_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultANY_TYPE, (intptr_t)0 },
-    { "NUMBER_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultNUMBER_TYPE, (intptr_t)0 },
-    { "STRING_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultSTRING_TYPE, (intptr_t)0 },
-    { "BOOLEAN_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultBOOLEAN_TYPE, (intptr_t)0 },
-    { "UNORDERED_NODE_ITERATOR_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultUNORDERED_NODE_ITERATOR_TYPE, (intptr_t)0 },
-    { "ORDERED_NODE_ITERATOR_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultORDERED_NODE_ITERATOR_TYPE, (intptr_t)0 },
-    { "UNORDERED_NODE_SNAPSHOT_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE, (intptr_t)0 },
-    { "ORDERED_NODE_SNAPSHOT_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultORDERED_NODE_SNAPSHOT_TYPE, (intptr_t)0 },
-    { "ANY_UNORDERED_NODE_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultANY_UNORDERED_NODE_TYPE, (intptr_t)0 },
-    { "FIRST_ORDERED_NODE_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultFIRST_ORDERED_NODE_TYPE, (intptr_t)0 },
+    { "ANY_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultANY_TYPE), (intptr_t)0 },
+    { "NUMBER_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultNUMBER_TYPE), (intptr_t)0 },
+    { "STRING_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultSTRING_TYPE), (intptr_t)0 },
+    { "BOOLEAN_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultBOOLEAN_TYPE), (intptr_t)0 },
+    { "UNORDERED_NODE_ITERATOR_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultUNORDERED_NODE_ITERATOR_TYPE), (intptr_t)0 },
+    { "ORDERED_NODE_ITERATOR_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultORDERED_NODE_ITERATOR_TYPE), (intptr_t)0 },
+    { "UNORDERED_NODE_SNAPSHOT_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE), (intptr_t)0 },
+    { "ORDERED_NODE_SNAPSHOT_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultORDERED_NODE_SNAPSHOT_TYPE), (intptr_t)0 },
+    { "ANY_UNORDERED_NODE_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultANY_UNORDERED_NODE_TYPE), (intptr_t)0 },
+    { "FIRST_ORDERED_NODE_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultFIRST_ORDERED_NODE_TYPE), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -99,7 +99,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -122,18 +122,18 @@ bool JSXPathResultConstructor::getOwnPropertyDescriptor(ExecState* exec, const I
 
 static const HashTableValue JSXPathResultPrototypeTableValues[13] =
 {
-    { "ANY_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultANY_TYPE, (intptr_t)0 },
-    { "NUMBER_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultNUMBER_TYPE, (intptr_t)0 },
-    { "STRING_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultSTRING_TYPE, (intptr_t)0 },
-    { "BOOLEAN_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultBOOLEAN_TYPE, (intptr_t)0 },
-    { "UNORDERED_NODE_ITERATOR_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultUNORDERED_NODE_ITERATOR_TYPE, (intptr_t)0 },
-    { "ORDERED_NODE_ITERATOR_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultORDERED_NODE_ITERATOR_TYPE, (intptr_t)0 },
-    { "UNORDERED_NODE_SNAPSHOT_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE, (intptr_t)0 },
-    { "ORDERED_NODE_SNAPSHOT_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultORDERED_NODE_SNAPSHOT_TYPE, (intptr_t)0 },
-    { "ANY_UNORDERED_NODE_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultANY_UNORDERED_NODE_TYPE, (intptr_t)0 },
-    { "FIRST_ORDERED_NODE_TYPE", DontDelete|ReadOnly, (intptr_t)jsXPathResultFIRST_ORDERED_NODE_TYPE, (intptr_t)0 },
-    { "iterateNext", DontDelete|Function, (intptr_t)jsXPathResultPrototypeFunctionIterateNext, (intptr_t)0 },
-    { "snapshotItem", DontDelete|Function, (intptr_t)jsXPathResultPrototypeFunctionSnapshotItem, (intptr_t)1 },
+    { "ANY_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultANY_TYPE), (intptr_t)0 },
+    { "NUMBER_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultNUMBER_TYPE), (intptr_t)0 },
+    { "STRING_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultSTRING_TYPE), (intptr_t)0 },
+    { "BOOLEAN_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultBOOLEAN_TYPE), (intptr_t)0 },
+    { "UNORDERED_NODE_ITERATOR_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultUNORDERED_NODE_ITERATOR_TYPE), (intptr_t)0 },
+    { "ORDERED_NODE_ITERATOR_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultORDERED_NODE_ITERATOR_TYPE), (intptr_t)0 },
+    { "UNORDERED_NODE_SNAPSHOT_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE), (intptr_t)0 },
+    { "ORDERED_NODE_SNAPSHOT_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultORDERED_NODE_SNAPSHOT_TYPE), (intptr_t)0 },
+    { "ANY_UNORDERED_NODE_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultANY_UNORDERED_NODE_TYPE), (intptr_t)0 },
+    { "FIRST_ORDERED_NODE_TYPE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsXPathResultFIRST_ORDERED_NODE_TYPE), (intptr_t)0 },
+    { "iterateNext", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXPathResultPrototypeFunctionIterateNext), (intptr_t)0 },
+    { "snapshotItem", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXPathResultPrototypeFunctionSnapshotItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -189,17 +189,18 @@ bool JSXPathResult::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSXPathResult, Base>(exec, &JSXPathResultTable, this, propertyName, descriptor);
 }
 
-JSValue jsXPathResultResultType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultResultType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXPathResult* castedThis = static_cast<JSXPathResult*>(asObject(slot.slotBase()));
+    JSXPathResult* castedThis = static_cast<JSXPathResult*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XPathResult* imp = static_cast<XPathResult*>(castedThis->impl());
-    return jsNumber(exec, imp->resultType());
+    JSValue result = jsNumber(exec, imp->resultType());
+    return result;
 }
 
-JSValue jsXPathResultNumberValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultNumberValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXPathResult* castedThis = static_cast<JSXPathResult*>(asObject(slot.slotBase()));
+    JSXPathResult* castedThis = static_cast<JSXPathResult*>(asObject(slotBase));
     ExceptionCode ec = 0;
     XPathResult* imp = static_cast<XPathResult*>(castedThis->impl());
     JSC::JSValue result = jsNumber(exec, imp->numberValue(ec));
@@ -207,9 +208,9 @@ JSValue jsXPathResultNumberValue(ExecState* exec, const Identifier&, const Prope
     return result;
 }
 
-JSValue jsXPathResultStringValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultStringValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXPathResult* castedThis = static_cast<JSXPathResult*>(asObject(slot.slotBase()));
+    JSXPathResult* castedThis = static_cast<JSXPathResult*>(asObject(slotBase));
     ExceptionCode ec = 0;
     XPathResult* imp = static_cast<XPathResult*>(castedThis->impl());
     JSC::JSValue result = jsString(exec, imp->stringValue(ec));
@@ -217,9 +218,9 @@ JSValue jsXPathResultStringValue(ExecState* exec, const Identifier&, const Prope
     return result;
 }
 
-JSValue jsXPathResultBooleanValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultBooleanValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXPathResult* castedThis = static_cast<JSXPathResult*>(asObject(slot.slotBase()));
+    JSXPathResult* castedThis = static_cast<JSXPathResult*>(asObject(slotBase));
     ExceptionCode ec = 0;
     XPathResult* imp = static_cast<XPathResult*>(castedThis->impl());
     JSC::JSValue result = jsBoolean(imp->booleanValue(ec));
@@ -227,9 +228,9 @@ JSValue jsXPathResultBooleanValue(ExecState* exec, const Identifier&, const Prop
     return result;
 }
 
-JSValue jsXPathResultSingleNodeValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultSingleNodeValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXPathResult* castedThis = static_cast<JSXPathResult*>(asObject(slot.slotBase()));
+    JSXPathResult* castedThis = static_cast<JSXPathResult*>(asObject(slotBase));
     ExceptionCode ec = 0;
     XPathResult* imp = static_cast<XPathResult*>(castedThis->impl());
     JSC::JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->singleNodeValue(ec)));
@@ -237,17 +238,18 @@ JSValue jsXPathResultSingleNodeValue(ExecState* exec, const Identifier&, const P
     return result;
 }
 
-JSValue jsXPathResultInvalidIteratorState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultInvalidIteratorState(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXPathResult* castedThis = static_cast<JSXPathResult*>(asObject(slot.slotBase()));
+    JSXPathResult* castedThis = static_cast<JSXPathResult*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     XPathResult* imp = static_cast<XPathResult*>(castedThis->impl());
-    return jsBoolean(imp->invalidIteratorState());
+    JSValue result = jsBoolean(imp->invalidIteratorState());
+    return result;
 }
 
-JSValue jsXPathResultSnapshotLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultSnapshotLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXPathResult* castedThis = static_cast<JSXPathResult*>(asObject(slot.slotBase()));
+    JSXPathResult* castedThis = static_cast<JSXPathResult*>(asObject(slotBase));
     ExceptionCode ec = 0;
     XPathResult* imp = static_cast<XPathResult*>(castedThis->impl());
     JSC::JSValue result = jsNumber(exec, imp->snapshotLength(ec));
@@ -255,9 +257,9 @@ JSValue jsXPathResultSnapshotLength(ExecState* exec, const Identifier&, const Pr
     return result;
 }
 
-JSValue jsXPathResultConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSXPathResult* domObject = static_cast<JSXPathResult*>(asObject(slot.slotBase()));
+    JSXPathResult* domObject = static_cast<JSXPathResult*>(asObject(slotBase));
     return JSXPathResult::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSXPathResult::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -298,52 +300,52 @@ JSValue JSC_HOST_CALL jsXPathResultPrototypeFunctionSnapshotItem(ExecState* exec
 
 // Constant getters
 
-JSValue jsXPathResultANY_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultANY_TYPE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsXPathResultNUMBER_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultNUMBER_TYPE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsXPathResultSTRING_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultSTRING_TYPE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsXPathResultBOOLEAN_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultBOOLEAN_TYPE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsXPathResultUNORDERED_NODE_ITERATOR_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultUNORDERED_NODE_ITERATOR_TYPE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsXPathResultORDERED_NODE_ITERATOR_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultORDERED_NODE_ITERATOR_TYPE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValue jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValue jsXPathResultORDERED_NODE_SNAPSHOT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultORDERED_NODE_SNAPSHOT_TYPE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValue jsXPathResultANY_UNORDERED_NODE_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultANY_UNORDERED_NODE_TYPE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValue jsXPathResultFIRST_ORDERED_NODE_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultFIRST_ORDERED_NODE_TYPE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
index a8db49eb7e..b86300ce1d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(XPATH)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -70,7 +69,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSXPathResultPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -83,26 +82,26 @@ JSC::JSValue JSC_HOST_CALL jsXPathResultPrototypeFunctionIterateNext(JSC::ExecSt
 JSC::JSValue JSC_HOST_CALL jsXPathResultPrototypeFunctionSnapshotItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsXPathResultResultType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultNumberValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultStringValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultBooleanValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultSingleNodeValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultInvalidIteratorState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultSnapshotLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultResultType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultNumberValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultStringValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultBooleanValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultSingleNodeValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultInvalidIteratorState(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultSnapshotLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsXPathResultANY_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultNUMBER_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultSTRING_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultBOOLEAN_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultUNORDERED_NODE_ITERATOR_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultORDERED_NODE_ITERATOR_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultORDERED_NODE_SNAPSHOT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultANY_UNORDERED_NODE_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsXPathResultFIRST_ORDERED_NODE_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultANY_TYPE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultNUMBER_TYPE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultSTRING_TYPE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultBOOLEAN_TYPE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultUNORDERED_NODE_ITERATOR_TYPE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultORDERED_NODE_ITERATOR_TYPE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultORDERED_NODE_SNAPSHOT_TYPE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultANY_UNORDERED_NODE_TYPE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsXPathResultFIRST_ORDERED_NODE_TYPE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp
index add8a8497f..bb05b4bcde 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp
@@ -41,14 +41,14 @@ ASSERT_CLASS_FITS_IN_CELL(JSXSLTProcessor);
 
 static const HashTableValue JSXSLTProcessorPrototypeTableValues[9] =
 {
-    { "importStylesheet", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionImportStylesheet, (intptr_t)1 },
-    { "transformToFragment", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionTransformToFragment, (intptr_t)2 },
-    { "transformToDocument", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionTransformToDocument, (intptr_t)1 },
-    { "setParameter", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionSetParameter, (intptr_t)3 },
-    { "getParameter", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionGetParameter, (intptr_t)2 },
-    { "removeParameter", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionRemoveParameter, (intptr_t)2 },
-    { "clearParameters", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionClearParameters, (intptr_t)0 },
-    { "reset", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionReset, (intptr_t)0 },
+    { "importStylesheet", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXSLTProcessorPrototypeFunctionImportStylesheet), (intptr_t)1 },
+    { "transformToFragment", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXSLTProcessorPrototypeFunctionTransformToFragment), (intptr_t)2 },
+    { "transformToDocument", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXSLTProcessorPrototypeFunctionTransformToDocument), (intptr_t)1 },
+    { "setParameter", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXSLTProcessorPrototypeFunctionSetParameter), (intptr_t)3 },
+    { "getParameter", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXSLTProcessorPrototypeFunctionGetParameter), (intptr_t)2 },
+    { "removeParameter", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXSLTProcessorPrototypeFunctionRemoveParameter), (intptr_t)2 },
+    { "clearParameters", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXSLTProcessorPrototypeFunctionClearParameters), (intptr_t)0 },
+    { "reset", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsXSLTProcessorPrototypeFunctionReset), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h
index 821dca796f..253121ad08 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(XSLT)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 
@@ -75,7 +74,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSXSLTProcessorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
diff --git a/src/3rdparty/webkit/WebCore/generated/Lexer.lut.h b/src/3rdparty/webkit/WebCore/generated/Lexer.lut.h
deleted file mode 100644
index 2cf7617dde..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/Lexer.lut.h
+++ /dev/null
@@ -1,49 +0,0 @@
-// Automatically generated from ../../JavaScriptCore/parser/Keywords.table using JavaScriptCore/create_hash_table. DO NOT EDIT!
-
-#include "Lookup.h"
-
-namespace JSC {
-
-static const struct HashTableValue mainTableValues[37] = {
-   { "null", 0, (intptr_t)NULLTOKEN, (intptr_t)0 },
-   { "true", 0, (intptr_t)TRUETOKEN, (intptr_t)0 },
-   { "false", 0, (intptr_t)FALSETOKEN, (intptr_t)0 },
-   { "break", 0, (intptr_t)BREAK, (intptr_t)0 },
-   { "case", 0, (intptr_t)CASE, (intptr_t)0 },
-   { "catch", 0, (intptr_t)CATCH, (intptr_t)0 },
-   { "const", 0, (intptr_t)CONSTTOKEN, (intptr_t)0 },
-   { "default", 0, (intptr_t)DEFAULT, (intptr_t)0 },
-   { "finally", 0, (intptr_t)FINALLY, (intptr_t)0 },
-   { "for", 0, (intptr_t)FOR, (intptr_t)0 },
-   { "instanceof", 0, (intptr_t)INSTANCEOF, (intptr_t)0 },
-   { "new", 0, (intptr_t)NEW, (intptr_t)0 },
-   { "var", 0, (intptr_t)VAR, (intptr_t)0 },
-   { "continue", 0, (intptr_t)CONTINUE, (intptr_t)0 },
-   { "function", 0, (intptr_t)FUNCTION, (intptr_t)0 },
-   { "return", 0, (intptr_t)RETURN, (intptr_t)0 },
-   { "void", 0, (intptr_t)VOIDTOKEN, (intptr_t)0 },
-   { "delete", 0, (intptr_t)DELETETOKEN, (intptr_t)0 },
-   { "if", 0, (intptr_t)IF, (intptr_t)0 },
-   { "this", 0, (intptr_t)THISTOKEN, (intptr_t)0 },
-   { "do", 0, (intptr_t)DO, (intptr_t)0 },
-   { "while", 0, (intptr_t)WHILE, (intptr_t)0 },
-   { "else", 0, (intptr_t)ELSE, (intptr_t)0 },
-   { "in", 0, (intptr_t)INTOKEN, (intptr_t)0 },
-   { "switch", 0, (intptr_t)SWITCH, (intptr_t)0 },
-   { "throw", 0, (intptr_t)THROW, (intptr_t)0 },
-   { "try", 0, (intptr_t)TRY, (intptr_t)0 },
-   { "typeof", 0, (intptr_t)TYPEOF, (intptr_t)0 },
-   { "with", 0, (intptr_t)WITH, (intptr_t)0 },
-   { "debugger", 0, (intptr_t)DEBUGGER, (intptr_t)0 },
-   { "class", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "enum", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "export", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "extends", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "import", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "super", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { 0, 0, 0, 0 }
-};
-
-extern JSC_CONST_HASHTABLE HashTable mainTable =
-    { 133, 127, mainTableValues, 0 };
-} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/MathObject.lut.h b/src/3rdparty/webkit/WebCore/generated/MathObject.lut.h
deleted file mode 100644
index ce76857633..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/MathObject.lut.h
+++ /dev/null
@@ -1,31 +0,0 @@
-// Automatically generated from ../../JavaScriptCore/runtime/MathObject.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
-
-#include "Lookup.h"
-
-namespace JSC {
-
-static const struct HashTableValue mathTableValues[19] = {
-   { "abs", DontEnum|Function, (intptr_t)mathProtoFuncAbs, (intptr_t)1 },
-   { "acos", DontEnum|Function, (intptr_t)mathProtoFuncACos, (intptr_t)1 },
-   { "asin", DontEnum|Function, (intptr_t)mathProtoFuncASin, (intptr_t)1 },
-   { "atan", DontEnum|Function, (intptr_t)mathProtoFuncATan, (intptr_t)1 },
-   { "atan2", DontEnum|Function, (intptr_t)mathProtoFuncATan2, (intptr_t)2 },
-   { "ceil", DontEnum|Function, (intptr_t)mathProtoFuncCeil, (intptr_t)1 },
-   { "cos", DontEnum|Function, (intptr_t)mathProtoFuncCos, (intptr_t)1 },
-   { "exp", DontEnum|Function, (intptr_t)mathProtoFuncExp, (intptr_t)1 },
-   { "floor", DontEnum|Function, (intptr_t)mathProtoFuncFloor, (intptr_t)1 },
-   { "log", DontEnum|Function, (intptr_t)mathProtoFuncLog, (intptr_t)1 },
-   { "max", DontEnum|Function, (intptr_t)mathProtoFuncMax, (intptr_t)2 },
-   { "min", DontEnum|Function, (intptr_t)mathProtoFuncMin, (intptr_t)2 },
-   { "pow", DontEnum|Function, (intptr_t)mathProtoFuncPow, (intptr_t)2 },
-   { "random", DontEnum|Function, (intptr_t)mathProtoFuncRandom, (intptr_t)0 },
-   { "round", DontEnum|Function, (intptr_t)mathProtoFuncRound, (intptr_t)1 },
-   { "sin", DontEnum|Function, (intptr_t)mathProtoFuncSin, (intptr_t)1 },
-   { "sqrt", DontEnum|Function, (intptr_t)mathProtoFuncSqrt, (intptr_t)1 },
-   { "tan", DontEnum|Function, (intptr_t)mathProtoFuncTan, (intptr_t)1 },
-   { 0, 0, 0, 0 }
-};
-
-extern JSC_CONST_HASHTABLE HashTable mathTable =
-    { 67, 63, mathTableValues, 0 };
-} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/NumberConstructor.lut.h b/src/3rdparty/webkit/WebCore/generated/NumberConstructor.lut.h
deleted file mode 100644
index d1155ae96a..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/NumberConstructor.lut.h
+++ /dev/null
@@ -1,18 +0,0 @@
-// Automatically generated from ../../JavaScriptCore/runtime/NumberConstructor.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
-
-#include "Lookup.h"
-
-namespace JSC {
-
-static const struct HashTableValue numberTableValues[6] = {
-   { "NaN", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorNaNValue, (intptr_t)0 },
-   { "NEGATIVE_INFINITY", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorNegInfinity, (intptr_t)0 },
-   { "POSITIVE_INFINITY", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorPosInfinity, (intptr_t)0 },
-   { "MAX_VALUE", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorMaxValue, (intptr_t)0 },
-   { "MIN_VALUE", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorMinValue, (intptr_t)0 },
-   { 0, 0, 0, 0 }
-};
-
-extern JSC_CONST_HASHTABLE HashTable numberTable =
-    { 16, 15, numberTableValues, 0 };
-} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/RegExpConstructor.lut.h b/src/3rdparty/webkit/WebCore/generated/RegExpConstructor.lut.h
deleted file mode 100644
index eea201ccf2..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/RegExpConstructor.lut.h
+++ /dev/null
@@ -1,34 +0,0 @@
-// Automatically generated from ../../JavaScriptCore/runtime/RegExpConstructor.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
-
-#include "Lookup.h"
-
-namespace JSC {
-
-static const struct HashTableValue regExpConstructorTableValues[22] = {
-   { "input", None, (intptr_t)regExpConstructorInput, (intptr_t)setRegExpConstructorInput },
-   { "$_", DontEnum, (intptr_t)regExpConstructorInput, (intptr_t)setRegExpConstructorInput },
-   { "multiline", None, (intptr_t)regExpConstructorMultiline, (intptr_t)setRegExpConstructorMultiline },
-   { "$*", DontEnum, (intptr_t)regExpConstructorMultiline, (intptr_t)setRegExpConstructorMultiline },
-   { "lastMatch", DontDelete|ReadOnly, (intptr_t)regExpConstructorLastMatch, (intptr_t)0 },
-   { "$&", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorLastMatch, (intptr_t)0 },
-   { "lastParen", DontDelete|ReadOnly, (intptr_t)regExpConstructorLastParen, (intptr_t)0 },
-   { "$+", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorLastParen, (intptr_t)0 },
-   { "leftContext", DontDelete|ReadOnly, (intptr_t)regExpConstructorLeftContext, (intptr_t)0 },
-   { "$`", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorLeftContext, (intptr_t)0 },
-   { "rightContext", DontDelete|ReadOnly, (intptr_t)regExpConstructorRightContext, (intptr_t)0 },
-   { "$'", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorRightContext, (intptr_t)0 },
-   { "$1", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar1, (intptr_t)0 },
-   { "$2", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar2, (intptr_t)0 },
-   { "$3", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar3, (intptr_t)0 },
-   { "$4", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar4, (intptr_t)0 },
-   { "$5", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar5, (intptr_t)0 },
-   { "$6", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar6, (intptr_t)0 },
-   { "$7", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar7, (intptr_t)0 },
-   { "$8", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar8, (intptr_t)0 },
-   { "$9", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar9, (intptr_t)0 },
-   { 0, 0, 0, 0 }
-};
-
-extern JSC_CONST_HASHTABLE HashTable regExpConstructorTable =
-    { 65, 63, regExpConstructorTableValues, 0 };
-} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/RegExpObject.lut.h b/src/3rdparty/webkit/WebCore/generated/RegExpObject.lut.h
deleted file mode 100644
index 146aec0a93..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/RegExpObject.lut.h
+++ /dev/null
@@ -1,18 +0,0 @@
-// Automatically generated from ../../JavaScriptCore/runtime/RegExpObject.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
-
-#include "Lookup.h"
-
-namespace JSC {
-
-static const struct HashTableValue regExpTableValues[6] = {
-   { "global", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectGlobal, (intptr_t)0 },
-   { "ignoreCase", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectIgnoreCase, (intptr_t)0 },
-   { "multiline", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectMultiline, (intptr_t)0 },
-   { "source", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectSource, (intptr_t)0 },
-   { "lastIndex", DontDelete|DontEnum, (intptr_t)regExpObjectLastIndex, (intptr_t)setRegExpObjectLastIndex },
-   { 0, 0, 0, 0 }
-};
-
-extern JSC_CONST_HASHTABLE HashTable regExpTable =
-    { 17, 15, regExpTableValues, 0 };
-} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp b/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp
index fb93b9b706..6268bb16ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp
@@ -43,6 +43,30 @@
 #include "SVGDefsElement.h"
 #include "SVGDescElement.h"
 #include "SVGEllipseElement.h"
+#include "SVGFEBlendElement.h"
+#include "SVGFEColorMatrixElement.h"
+#include "SVGFEComponentTransferElement.h"
+#include "SVGFECompositeElement.h"
+#include "SVGFEDiffuseLightingElement.h"
+#include "SVGFEDisplacementMapElement.h"
+#include "SVGFEDistantLightElement.h"
+#include "SVGFEFloodElement.h"
+#include "SVGFEFuncAElement.h"
+#include "SVGFEFuncBElement.h"
+#include "SVGFEFuncGElement.h"
+#include "SVGFEFuncRElement.h"
+#include "SVGFEGaussianBlurElement.h"
+#include "SVGFEImageElement.h"
+#include "SVGFEMergeElement.h"
+#include "SVGFEMergeNodeElement.h"
+#include "SVGFEMorphologyElement.h"
+#include "SVGFEOffsetElement.h"
+#include "SVGFEPointLightElement.h"
+#include "SVGFESpecularLightingElement.h"
+#include "SVGFESpotLightElement.h"
+#include "SVGFETileElement.h"
+#include "SVGFETurbulenceElement.h"
+#include "SVGFilterElement.h"
 #include "SVGFontElement.h"
 #include "SVGFontFaceElement.h"
 #include "SVGFontFaceFormatElement.h"
@@ -158,6 +182,126 @@ static PassRefPtr<SVGElement> ellipseConstructor(const QualifiedName& tagName, D
     return new SVGEllipseElement(tagName, document);
 }
 
+static PassRefPtr<SVGElement> feblendConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEBlendElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fecolormatrixConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEColorMatrixElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fecomponenttransferConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEComponentTransferElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fecompositeConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFECompositeElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fediffuselightingConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEDiffuseLightingElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fedisplacementmapConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEDisplacementMapElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fedistantlightConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEDistantLightElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fefloodConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEFloodElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fefuncaConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEFuncAElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fefuncbConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEFuncBElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fefuncgConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEFuncGElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fefuncrConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEFuncRElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fegaussianblurConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEGaussianBlurElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> feimageConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEImageElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> femergeConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEMergeElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> femergenodeConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEMergeNodeElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> femorphologyConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEMorphologyElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> feoffsetConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEOffsetElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fepointlightConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFEPointLightElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fespecularlightingConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFESpecularLightingElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fespotlightConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFESpotLightElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> fetileConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFETileElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> feturbulenceConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFETurbulenceElement(tagName, document);
+}
+
+static PassRefPtr<SVGElement> filterConstructor(const QualifiedName& tagName, Document* document, bool)
+{
+    return new SVGFilterElement(tagName, document);
+}
+
 static PassRefPtr<SVGElement> fontConstructor(const QualifiedName& tagName, Document* document, bool)
 {
     return new SVGFontElement(tagName, document);
@@ -375,6 +519,30 @@ static void createFunctionMap()
     addTag(defsTag, defsConstructor);
     addTag(descTag, descConstructor);
     addTag(ellipseTag, ellipseConstructor);
+    addTag(feBlendTag, feblendConstructor);
+    addTag(feColorMatrixTag, fecolormatrixConstructor);
+    addTag(feComponentTransferTag, fecomponenttransferConstructor);
+    addTag(feCompositeTag, fecompositeConstructor);
+    addTag(feDiffuseLightingTag, fediffuselightingConstructor);
+    addTag(feDisplacementMapTag, fedisplacementmapConstructor);
+    addTag(feDistantLightTag, fedistantlightConstructor);
+    addTag(feFloodTag, fefloodConstructor);
+    addTag(feFuncATag, fefuncaConstructor);
+    addTag(feFuncBTag, fefuncbConstructor);
+    addTag(feFuncGTag, fefuncgConstructor);
+    addTag(feFuncRTag, fefuncrConstructor);
+    addTag(feGaussianBlurTag, fegaussianblurConstructor);
+    addTag(feImageTag, feimageConstructor);
+    addTag(feMergeTag, femergeConstructor);
+    addTag(feMergeNodeTag, femergenodeConstructor);
+    addTag(feMorphologyTag, femorphologyConstructor);
+    addTag(feOffsetTag, feoffsetConstructor);
+    addTag(fePointLightTag, fepointlightConstructor);
+    addTag(feSpecularLightingTag, fespecularlightingConstructor);
+    addTag(feSpotLightTag, fespotlightConstructor);
+    addTag(feTileTag, fetileConstructor);
+    addTag(feTurbulenceTag, feturbulenceConstructor);
+    addTag(filterTag, filterConstructor);
     addTag(fontTag, fontConstructor);
     addTag(font_faceTag, fontfaceConstructor);
     addTag(font_face_formatTag, fontfaceformatConstructor);
diff --git a/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp b/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp
index f5706be2fa..f4558b3a4e 100644
--- a/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp
@@ -57,6 +57,30 @@ DEFINE_GLOBAL(QualifiedName, cursorTag, nullAtom, "cursor", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, defsTag, nullAtom, "defs", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, descTag, nullAtom, "desc", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, ellipseTag, nullAtom, "ellipse", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feBlendTag, nullAtom, "feBlend", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feColorMatrixTag, nullAtom, "feColorMatrix", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feComponentTransferTag, nullAtom, "feComponentTransfer", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feCompositeTag, nullAtom, "feComposite", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feDiffuseLightingTag, nullAtom, "feDiffuseLighting", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feDisplacementMapTag, nullAtom, "feDisplacementMap", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feDistantLightTag, nullAtom, "feDistantLight", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feFloodTag, nullAtom, "feFlood", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feFuncATag, nullAtom, "feFuncA", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feFuncBTag, nullAtom, "feFuncB", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feFuncGTag, nullAtom, "feFuncG", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feFuncRTag, nullAtom, "feFuncR", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feGaussianBlurTag, nullAtom, "feGaussianBlur", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feImageTag, nullAtom, "feImage", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feMergeTag, nullAtom, "feMerge", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feMergeNodeTag, nullAtom, "feMergeNode", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feMorphologyTag, nullAtom, "feMorphology", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feOffsetTag, nullAtom, "feOffset", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, fePointLightTag, nullAtom, "fePointLight", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feSpecularLightingTag, nullAtom, "feSpecularLighting", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feSpotLightTag, nullAtom, "feSpotLight", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feTileTag, nullAtom, "feTile", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, feTurbulenceTag, nullAtom, "feTurbulence", svgNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, filterTag, nullAtom, "filter", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, fontTag, nullAtom, "font", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, font_faceTag, nullAtom, "font_face", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, font_face_formatTag, nullAtom, "font_face_format", svgNamespaceURI);
@@ -112,6 +136,30 @@ WebCore::QualifiedName** getSVGTags(size_t* size)
         (WebCore::QualifiedName*)&defsTag,
         (WebCore::QualifiedName*)&descTag,
         (WebCore::QualifiedName*)&ellipseTag,
+        (WebCore::QualifiedName*)&feBlendTag,
+        (WebCore::QualifiedName*)&feColorMatrixTag,
+        (WebCore::QualifiedName*)&feComponentTransferTag,
+        (WebCore::QualifiedName*)&feCompositeTag,
+        (WebCore::QualifiedName*)&feDiffuseLightingTag,
+        (WebCore::QualifiedName*)&feDisplacementMapTag,
+        (WebCore::QualifiedName*)&feDistantLightTag,
+        (WebCore::QualifiedName*)&feFloodTag,
+        (WebCore::QualifiedName*)&feFuncATag,
+        (WebCore::QualifiedName*)&feFuncBTag,
+        (WebCore::QualifiedName*)&feFuncGTag,
+        (WebCore::QualifiedName*)&feFuncRTag,
+        (WebCore::QualifiedName*)&feGaussianBlurTag,
+        (WebCore::QualifiedName*)&feImageTag,
+        (WebCore::QualifiedName*)&feMergeTag,
+        (WebCore::QualifiedName*)&feMergeNodeTag,
+        (WebCore::QualifiedName*)&feMorphologyTag,
+        (WebCore::QualifiedName*)&feOffsetTag,
+        (WebCore::QualifiedName*)&fePointLightTag,
+        (WebCore::QualifiedName*)&feSpecularLightingTag,
+        (WebCore::QualifiedName*)&feSpotLightTag,
+        (WebCore::QualifiedName*)&feTileTag,
+        (WebCore::QualifiedName*)&feTurbulenceTag,
+        (WebCore::QualifiedName*)&filterTag,
         (WebCore::QualifiedName*)&fontTag,
         (WebCore::QualifiedName*)&font_faceTag,
         (WebCore::QualifiedName*)&font_face_formatTag,
@@ -151,7 +199,7 @@ WebCore::QualifiedName** getSVGTags(size_t* size)
         (WebCore::QualifiedName*)&useTag,
         (WebCore::QualifiedName*)&viewTag,
     };
-    *size = 50;
+    *size = 74;
     return SVGTags;
 }
 
@@ -660,307 +708,6 @@ WebCore::QualifiedName** getSVGAttrs(size_t* size)
     return SVGAttr;
 }
 
-// Tags as strings
-char aTagString[] = "a";
-char altGlyphTagString[] = "altGlyph";
-char animateTagString[] = "animate";
-char animateColorTagString[] = "animateColor";
-char animateMotionTagString[] = "animateMotion";
-char animateTransformTagString[] = "animateTransform";
-char circleTagString[] = "circle";
-char clipPathTagString[] = "clipPath";
-char cursorTagString[] = "cursor";
-char defsTagString[] = "defs";
-char descTagString[] = "desc";
-char ellipseTagString[] = "ellipse";
-char fontTagString[] = "font";
-char font_faceTagString[] = "font-face";
-char font_face_formatTagString[] = "font-face-format";
-char font_face_nameTagString[] = "font-face-name";
-char font_face_srcTagString[] = "font-face-src";
-char font_face_uriTagString[] = "font-face-uri";
-char foreignObjectTagString[] = "foreignObject";
-char gTagString[] = "g";
-char glyphTagString[] = "glyph";
-char hkernTagString[] = "hkern";
-char imageTagString[] = "image";
-char lineTagString[] = "line";
-char linearGradientTagString[] = "linearGradient";
-char markerTagString[] = "marker";
-char maskTagString[] = "mask";
-char metadataTagString[] = "metadata";
-char missing_glyphTagString[] = "missing-glyph";
-char mpathTagString[] = "mpath";
-char pathTagString[] = "path";
-char patternTagString[] = "pattern";
-char polygonTagString[] = "polygon";
-char polylineTagString[] = "polyline";
-char radialGradientTagString[] = "radialGradient";
-char rectTagString[] = "rect";
-char scriptTagString[] = "script";
-char setTagString[] = "set";
-char stopTagString[] = "stop";
-char styleTagString[] = "style";
-char svgTagString[] = "svg";
-char switchTagString[] = "switch";
-char symbolTagString[] = "symbol";
-char textTagString[] = "text";
-char textPathTagString[] = "textPath";
-char titleTagString[] = "title";
-char trefTagString[] = "tref";
-char tspanTagString[] = "tspan";
-char useTagString[] = "use";
-char viewTagString[] = "view";
-
-// Attributes as strings
-char accent_heightAttrString[] = "accent-height";
-char accumulateAttrString[] = "accumulate";
-char additiveAttrString[] = "additive";
-char alignment_baselineAttrString[] = "alignment-baseline";
-char alphabeticAttrString[] = "alphabetic";
-char amplitudeAttrString[] = "amplitude";
-char animateAttrString[] = "animate";
-char arabic_formAttrString[] = "arabic-form";
-char ascentAttrString[] = "ascent";
-char attributeNameAttrString[] = "attributeName";
-char attributeTypeAttrString[] = "attributeType";
-char azimuthAttrString[] = "azimuth";
-char baseFrequencyAttrString[] = "baseFrequency";
-char baseProfileAttrString[] = "baseProfile";
-char baseline_shiftAttrString[] = "baseline-shift";
-char bboxAttrString[] = "bbox";
-char beginAttrString[] = "begin";
-char biasAttrString[] = "bias";
-char byAttrString[] = "by";
-char calcModeAttrString[] = "calcMode";
-char cap_heightAttrString[] = "cap-height";
-char clipAttrString[] = "clip";
-char clipPathUnitsAttrString[] = "clipPathUnits";
-char clip_pathAttrString[] = "clip-path";
-char clip_ruleAttrString[] = "clip-rule";
-char colorAttrString[] = "color";
-char color_interpolationAttrString[] = "color-interpolation";
-char color_interpolation_filtersAttrString[] = "color-interpolation-filters";
-char color_profileAttrString[] = "color-profile";
-char color_renderingAttrString[] = "color-rendering";
-char contentScriptTypeAttrString[] = "contentScriptType";
-char contentStyleTypeAttrString[] = "contentStyleType";
-char cursorAttrString[] = "cursor";
-char cxAttrString[] = "cx";
-char cyAttrString[] = "cy";
-char dAttrString[] = "d";
-char descentAttrString[] = "descent";
-char diffuseConstantAttrString[] = "diffuseConstant";
-char directionAttrString[] = "direction";
-char displayAttrString[] = "display";
-char divisorAttrString[] = "divisor";
-char dominant_baselineAttrString[] = "dominant-baseline";
-char durAttrString[] = "dur";
-char dxAttrString[] = "dx";
-char dyAttrString[] = "dy";
-char edgeModeAttrString[] = "edgeMode";
-char elevationAttrString[] = "elevation";
-char enable_backgroundAttrString[] = "enable-background";
-char endAttrString[] = "end";
-char exponentAttrString[] = "exponent";
-char externalResourcesRequiredAttrString[] = "externalResourcesRequired";
-char feColorMatrixAttrString[] = "feColorMatrix";
-char feCompositeAttrString[] = "feComposite";
-char feGaussianBlurAttrString[] = "feGaussianBlur";
-char feMorphologyAttrString[] = "feMorphology";
-char feTileAttrString[] = "feTile";
-char fillAttrString[] = "fill";
-char fill_opacityAttrString[] = "fill-opacity";
-char fill_ruleAttrString[] = "fill-rule";
-char filterAttrString[] = "filter";
-char filterResAttrString[] = "filterRes";
-char filterUnitsAttrString[] = "filterUnits";
-char flood_colorAttrString[] = "flood-color";
-char flood_opacityAttrString[] = "flood-opacity";
-char font_familyAttrString[] = "font-family";
-char font_sizeAttrString[] = "font-size";
-char font_size_adjustAttrString[] = "font-size-adjust";
-char font_stretchAttrString[] = "font-stretch";
-char font_styleAttrString[] = "font-style";
-char font_variantAttrString[] = "font-variant";
-char font_weightAttrString[] = "font-weight";
-char formatAttrString[] = "format";
-char fromAttrString[] = "from";
-char fxAttrString[] = "fx";
-char fyAttrString[] = "fy";
-char g1AttrString[] = "g1";
-char g2AttrString[] = "g2";
-char glyphRefAttrString[] = "glyphRef";
-char glyph_nameAttrString[] = "glyph-name";
-char glyph_orientation_horizontalAttrString[] = "glyph-orientation-horizontal";
-char glyph_orientation_verticalAttrString[] = "glyph-orientation-vertical";
-char gradientTransformAttrString[] = "gradientTransform";
-char gradientUnitsAttrString[] = "gradientUnits";
-char hangingAttrString[] = "hanging";
-char heightAttrString[] = "height";
-char horiz_adv_xAttrString[] = "horiz-adv-x";
-char horiz_origin_xAttrString[] = "horiz-origin-x";
-char horiz_origin_yAttrString[] = "horiz-origin-y";
-char ideographicAttrString[] = "ideographic";
-char image_renderingAttrString[] = "image-rendering";
-char inAttrString[] = "in";
-char in2AttrString[] = "in2";
-char interceptAttrString[] = "intercept";
-char kAttrString[] = "k";
-char k1AttrString[] = "k1";
-char k2AttrString[] = "k2";
-char k3AttrString[] = "k3";
-char k4AttrString[] = "k4";
-char kernelMatrixAttrString[] = "kernelMatrix";
-char kernelUnitLengthAttrString[] = "kernelUnitLength";
-char kerningAttrString[] = "kerning";
-char keyPointsAttrString[] = "keyPoints";
-char keySplinesAttrString[] = "keySplines";
-char keyTimesAttrString[] = "keyTimes";
-char langAttrString[] = "lang";
-char lengthAdjustAttrString[] = "lengthAdjust";
-char letter_spacingAttrString[] = "letter-spacing";
-char lighting_colorAttrString[] = "lighting-color";
-char limitingConeAngleAttrString[] = "limitingConeAngle";
-char localAttrString[] = "local";
-char markerHeightAttrString[] = "markerHeight";
-char markerUnitsAttrString[] = "markerUnits";
-char markerWidthAttrString[] = "markerWidth";
-char marker_endAttrString[] = "marker-end";
-char marker_midAttrString[] = "marker-mid";
-char marker_startAttrString[] = "marker-start";
-char maskAttrString[] = "mask";
-char maskContentUnitsAttrString[] = "maskContentUnits";
-char maskUnitsAttrString[] = "maskUnits";
-char mathematicalAttrString[] = "mathematical";
-char maxAttrString[] = "max";
-char mediaAttrString[] = "media";
-char methodAttrString[] = "method";
-char minAttrString[] = "min";
-char modeAttrString[] = "mode";
-char nameAttrString[] = "name";
-char numOctavesAttrString[] = "numOctaves";
-char offsetAttrString[] = "offset";
-char onactivateAttrString[] = "onactivate";
-char onbeginAttrString[] = "onbegin";
-char onendAttrString[] = "onend";
-char onfocusinAttrString[] = "onfocusin";
-char onfocusoutAttrString[] = "onfocusout";
-char onrepeatAttrString[] = "onrepeat";
-char onzoomAttrString[] = "onzoom";
-char opacityAttrString[] = "opacity";
-char operatorAttrString[] = "operator";
-char orderAttrString[] = "order";
-char orientAttrString[] = "orient";
-char orientationAttrString[] = "orientation";
-char originAttrString[] = "origin";
-char overflowAttrString[] = "overflow";
-char overline_positionAttrString[] = "overline-position";
-char overline_thicknessAttrString[] = "overline-thickness";
-char panose_1AttrString[] = "panose-1";
-char pathAttrString[] = "path";
-char pathLengthAttrString[] = "pathLength";
-char patternContentUnitsAttrString[] = "patternContentUnits";
-char patternTransformAttrString[] = "patternTransform";
-char patternUnitsAttrString[] = "patternUnits";
-char pointer_eventsAttrString[] = "pointer-events";
-char pointsAttrString[] = "points";
-char pointsAtXAttrString[] = "pointsAtX";
-char pointsAtYAttrString[] = "pointsAtY";
-char pointsAtZAttrString[] = "pointsAtZ";
-char preserveAlphaAttrString[] = "preserveAlpha";
-char preserveAspectRatioAttrString[] = "preserveAspectRatio";
-char primitiveUnitsAttrString[] = "primitiveUnits";
-char rAttrString[] = "r";
-char radiusAttrString[] = "radius";
-char refXAttrString[] = "refX";
-char refYAttrString[] = "refY";
-char rendering_intentAttrString[] = "rendering-intent";
-char repeatCountAttrString[] = "repeatCount";
-char repeatDurAttrString[] = "repeatDur";
-char requiredExtensionsAttrString[] = "requiredExtensions";
-char requiredFeaturesAttrString[] = "requiredFeatures";
-char restartAttrString[] = "restart";
-char resultAttrString[] = "result";
-char rotateAttrString[] = "rotate";
-char rxAttrString[] = "rx";
-char ryAttrString[] = "ry";
-char scaleAttrString[] = "scale";
-char seedAttrString[] = "seed";
-char shape_renderingAttrString[] = "shape-rendering";
-char slopeAttrString[] = "slope";
-char spacingAttrString[] = "spacing";
-char specularConstantAttrString[] = "specularConstant";
-char specularExponentAttrString[] = "specularExponent";
-char spreadMethodAttrString[] = "spreadMethod";
-char startOffsetAttrString[] = "startOffset";
-char stdDeviationAttrString[] = "stdDeviation";
-char stemhAttrString[] = "stemh";
-char stemvAttrString[] = "stemv";
-char stitchTilesAttrString[] = "stitchTiles";
-char stop_colorAttrString[] = "stop-color";
-char stop_opacityAttrString[] = "stop-opacity";
-char strikethrough_positionAttrString[] = "strikethrough-position";
-char strikethrough_thicknessAttrString[] = "strikethrough-thickness";
-char strokeAttrString[] = "stroke";
-char stroke_dasharrayAttrString[] = "stroke-dasharray";
-char stroke_dashoffsetAttrString[] = "stroke-dashoffset";
-char stroke_linecapAttrString[] = "stroke-linecap";
-char stroke_linejoinAttrString[] = "stroke-linejoin";
-char stroke_miterlimitAttrString[] = "stroke-miterlimit";
-char stroke_opacityAttrString[] = "stroke-opacity";
-char stroke_widthAttrString[] = "stroke-width";
-char styleAttrString[] = "style";
-char surfaceScaleAttrString[] = "surfaceScale";
-char systemLanguageAttrString[] = "systemLanguage";
-char tableValuesAttrString[] = "tableValues";
-char targetAttrString[] = "target";
-char targetXAttrString[] = "targetX";
-char targetYAttrString[] = "targetY";
-char textLengthAttrString[] = "textLength";
-char text_anchorAttrString[] = "text-anchor";
-char text_decorationAttrString[] = "text-decoration";
-char text_renderingAttrString[] = "text-rendering";
-char titleAttrString[] = "title";
-char toAttrString[] = "to";
-char transformAttrString[] = "transform";
-char typeAttrString[] = "type";
-char u1AttrString[] = "u1";
-char u2AttrString[] = "u2";
-char underline_positionAttrString[] = "underline-position";
-char underline_thicknessAttrString[] = "underline-thickness";
-char unicodeAttrString[] = "unicode";
-char unicode_bidiAttrString[] = "unicode-bidi";
-char unicode_rangeAttrString[] = "unicode-range";
-char units_per_emAttrString[] = "units-per-em";
-char v_alphabeticAttrString[] = "v-alphabetic";
-char v_hangingAttrString[] = "v-hanging";
-char v_ideographicAttrString[] = "v-ideographic";
-char v_mathematicalAttrString[] = "v-mathematical";
-char valuesAttrString[] = "values";
-char versionAttrString[] = "version";
-char vert_adv_yAttrString[] = "vert-adv-y";
-char vert_origin_xAttrString[] = "vert-origin-x";
-char vert_origin_yAttrString[] = "vert-origin-y";
-char viewBoxAttrString[] = "viewBox";
-char viewTargetAttrString[] = "viewTarget";
-char visibilityAttrString[] = "visibility";
-char widthAttrString[] = "width";
-char widthsAttrString[] = "widths";
-char word_spacingAttrString[] = "word-spacing";
-char writing_modeAttrString[] = "writing-mode";
-char xAttrString[] = "x";
-char x1AttrString[] = "x1";
-char x2AttrString[] = "x2";
-char xChannelSelectorAttrString[] = "xChannelSelector";
-char x_heightAttrString[] = "x-height";
-char yAttrString[] = "y";
-char y1AttrString[] = "y1";
-char y2AttrString[] = "y2";
-char yChannelSelectorAttrString[] = "yChannelSelector";
-char zAttrString[] = "z";
-char zoomAndPanAttrString[] = "zoomAndPan";
-
 void init()
 {
     static bool initialized = false;
@@ -977,304 +724,328 @@ void init()
     new ((void*)&svgNamespaceURI) AtomicString(svgNS);
 
     // Tags
-    new ((void*)&aTag) QualifiedName(nullAtom, aTagString, svgNS);
-    new ((void*)&altGlyphTag) QualifiedName(nullAtom, altGlyphTagString, svgNS);
-    new ((void*)&animateTag) QualifiedName(nullAtom, animateTagString, svgNS);
-    new ((void*)&animateColorTag) QualifiedName(nullAtom, animateColorTagString, svgNS);
-    new ((void*)&animateMotionTag) QualifiedName(nullAtom, animateMotionTagString, svgNS);
-    new ((void*)&animateTransformTag) QualifiedName(nullAtom, animateTransformTagString, svgNS);
-    new ((void*)&circleTag) QualifiedName(nullAtom, circleTagString, svgNS);
-    new ((void*)&clipPathTag) QualifiedName(nullAtom, clipPathTagString, svgNS);
-    new ((void*)&cursorTag) QualifiedName(nullAtom, cursorTagString, svgNS);
-    new ((void*)&defsTag) QualifiedName(nullAtom, defsTagString, svgNS);
-    new ((void*)&descTag) QualifiedName(nullAtom, descTagString, svgNS);
-    new ((void*)&ellipseTag) QualifiedName(nullAtom, ellipseTagString, svgNS);
-    new ((void*)&fontTag) QualifiedName(nullAtom, fontTagString, svgNS);
-    new ((void*)&font_faceTag) QualifiedName(nullAtom, font_faceTagString, svgNS);
-    new ((void*)&font_face_formatTag) QualifiedName(nullAtom, font_face_formatTagString, svgNS);
-    new ((void*)&font_face_nameTag) QualifiedName(nullAtom, font_face_nameTagString, svgNS);
-    new ((void*)&font_face_srcTag) QualifiedName(nullAtom, font_face_srcTagString, svgNS);
-    new ((void*)&font_face_uriTag) QualifiedName(nullAtom, font_face_uriTagString, svgNS);
-    new ((void*)&foreignObjectTag) QualifiedName(nullAtom, foreignObjectTagString, svgNS);
-    new ((void*)&gTag) QualifiedName(nullAtom, gTagString, svgNS);
-    new ((void*)&glyphTag) QualifiedName(nullAtom, glyphTagString, svgNS);
-    new ((void*)&hkernTag) QualifiedName(nullAtom, hkernTagString, svgNS);
-    new ((void*)&imageTag) QualifiedName(nullAtom, imageTagString, svgNS);
-    new ((void*)&lineTag) QualifiedName(nullAtom, lineTagString, svgNS);
-    new ((void*)&linearGradientTag) QualifiedName(nullAtom, linearGradientTagString, svgNS);
-    new ((void*)&markerTag) QualifiedName(nullAtom, markerTagString, svgNS);
-    new ((void*)&maskTag) QualifiedName(nullAtom, maskTagString, svgNS);
-    new ((void*)&metadataTag) QualifiedName(nullAtom, metadataTagString, svgNS);
-    new ((void*)&missing_glyphTag) QualifiedName(nullAtom, missing_glyphTagString, svgNS);
-    new ((void*)&mpathTag) QualifiedName(nullAtom, mpathTagString, svgNS);
-    new ((void*)&pathTag) QualifiedName(nullAtom, pathTagString, svgNS);
-    new ((void*)&patternTag) QualifiedName(nullAtom, patternTagString, svgNS);
-    new ((void*)&polygonTag) QualifiedName(nullAtom, polygonTagString, svgNS);
-    new ((void*)&polylineTag) QualifiedName(nullAtom, polylineTagString, svgNS);
-    new ((void*)&radialGradientTag) QualifiedName(nullAtom, radialGradientTagString, svgNS);
-    new ((void*)&rectTag) QualifiedName(nullAtom, rectTagString, svgNS);
-    new ((void*)&scriptTag) QualifiedName(nullAtom, scriptTagString, svgNS);
-    new ((void*)&setTag) QualifiedName(nullAtom, setTagString, svgNS);
-    new ((void*)&stopTag) QualifiedName(nullAtom, stopTagString, svgNS);
-    new ((void*)&styleTag) QualifiedName(nullAtom, styleTagString, svgNS);
-    new ((void*)&svgTag) QualifiedName(nullAtom, svgTagString, svgNS);
-    new ((void*)&switchTag) QualifiedName(nullAtom, switchTagString, svgNS);
-    new ((void*)&symbolTag) QualifiedName(nullAtom, symbolTagString, svgNS);
-    new ((void*)&textTag) QualifiedName(nullAtom, textTagString, svgNS);
-    new ((void*)&textPathTag) QualifiedName(nullAtom, textPathTagString, svgNS);
-    new ((void*)&titleTag) QualifiedName(nullAtom, titleTagString, svgNS);
-    new ((void*)&trefTag) QualifiedName(nullAtom, trefTagString, svgNS);
-    new ((void*)&tspanTag) QualifiedName(nullAtom, tspanTagString, svgNS);
-    new ((void*)&useTag) QualifiedName(nullAtom, useTagString, svgNS);
-    new ((void*)&viewTag) QualifiedName(nullAtom, viewTagString, svgNS);
+    new ((void*)&aTag) QualifiedName(nullAtom, "a", svgNS);
+    new ((void*)&altGlyphTag) QualifiedName(nullAtom, "altGlyph", svgNS);
+    new ((void*)&animateTag) QualifiedName(nullAtom, "animate", svgNS);
+    new ((void*)&animateColorTag) QualifiedName(nullAtom, "animateColor", svgNS);
+    new ((void*)&animateMotionTag) QualifiedName(nullAtom, "animateMotion", svgNS);
+    new ((void*)&animateTransformTag) QualifiedName(nullAtom, "animateTransform", svgNS);
+    new ((void*)&circleTag) QualifiedName(nullAtom, "circle", svgNS);
+    new ((void*)&clipPathTag) QualifiedName(nullAtom, "clipPath", svgNS);
+    new ((void*)&cursorTag) QualifiedName(nullAtom, "cursor", svgNS);
+    new ((void*)&defsTag) QualifiedName(nullAtom, "defs", svgNS);
+    new ((void*)&descTag) QualifiedName(nullAtom, "desc", svgNS);
+    new ((void*)&ellipseTag) QualifiedName(nullAtom, "ellipse", svgNS);
+    new ((void*)&feBlendTag) QualifiedName(nullAtom, "feBlend", svgNS);
+    new ((void*)&feColorMatrixTag) QualifiedName(nullAtom, "feColorMatrix", svgNS);
+    new ((void*)&feComponentTransferTag) QualifiedName(nullAtom, "feComponentTransfer", svgNS);
+    new ((void*)&feCompositeTag) QualifiedName(nullAtom, "feComposite", svgNS);
+    new ((void*)&feDiffuseLightingTag) QualifiedName(nullAtom, "feDiffuseLighting", svgNS);
+    new ((void*)&feDisplacementMapTag) QualifiedName(nullAtom, "feDisplacementMap", svgNS);
+    new ((void*)&feDistantLightTag) QualifiedName(nullAtom, "feDistantLight", svgNS);
+    new ((void*)&feFloodTag) QualifiedName(nullAtom, "feFlood", svgNS);
+    new ((void*)&feFuncATag) QualifiedName(nullAtom, "feFuncA", svgNS);
+    new ((void*)&feFuncBTag) QualifiedName(nullAtom, "feFuncB", svgNS);
+    new ((void*)&feFuncGTag) QualifiedName(nullAtom, "feFuncG", svgNS);
+    new ((void*)&feFuncRTag) QualifiedName(nullAtom, "feFuncR", svgNS);
+    new ((void*)&feGaussianBlurTag) QualifiedName(nullAtom, "feGaussianBlur", svgNS);
+    new ((void*)&feImageTag) QualifiedName(nullAtom, "feImage", svgNS);
+    new ((void*)&feMergeTag) QualifiedName(nullAtom, "feMerge", svgNS);
+    new ((void*)&feMergeNodeTag) QualifiedName(nullAtom, "feMergeNode", svgNS);
+    new ((void*)&feMorphologyTag) QualifiedName(nullAtom, "feMorphology", svgNS);
+    new ((void*)&feOffsetTag) QualifiedName(nullAtom, "feOffset", svgNS);
+    new ((void*)&fePointLightTag) QualifiedName(nullAtom, "fePointLight", svgNS);
+    new ((void*)&feSpecularLightingTag) QualifiedName(nullAtom, "feSpecularLighting", svgNS);
+    new ((void*)&feSpotLightTag) QualifiedName(nullAtom, "feSpotLight", svgNS);
+    new ((void*)&feTileTag) QualifiedName(nullAtom, "feTile", svgNS);
+    new ((void*)&feTurbulenceTag) QualifiedName(nullAtom, "feTurbulence", svgNS);
+    new ((void*)&filterTag) QualifiedName(nullAtom, "filter", svgNS);
+    new ((void*)&fontTag) QualifiedName(nullAtom, "font", svgNS);
+    new ((void*)&font_faceTag) QualifiedName(nullAtom, "font-face", svgNS);
+    new ((void*)&font_face_formatTag) QualifiedName(nullAtom, "font-face-format", svgNS);
+    new ((void*)&font_face_nameTag) QualifiedName(nullAtom, "font-face-name", svgNS);
+    new ((void*)&font_face_srcTag) QualifiedName(nullAtom, "font-face-src", svgNS);
+    new ((void*)&font_face_uriTag) QualifiedName(nullAtom, "font-face-uri", svgNS);
+    new ((void*)&foreignObjectTag) QualifiedName(nullAtom, "foreignObject", svgNS);
+    new ((void*)&gTag) QualifiedName(nullAtom, "g", svgNS);
+    new ((void*)&glyphTag) QualifiedName(nullAtom, "glyph", svgNS);
+    new ((void*)&hkernTag) QualifiedName(nullAtom, "hkern", svgNS);
+    new ((void*)&imageTag) QualifiedName(nullAtom, "image", svgNS);
+    new ((void*)&lineTag) QualifiedName(nullAtom, "line", svgNS);
+    new ((void*)&linearGradientTag) QualifiedName(nullAtom, "linearGradient", svgNS);
+    new ((void*)&markerTag) QualifiedName(nullAtom, "marker", svgNS);
+    new ((void*)&maskTag) QualifiedName(nullAtom, "mask", svgNS);
+    new ((void*)&metadataTag) QualifiedName(nullAtom, "metadata", svgNS);
+    new ((void*)&missing_glyphTag) QualifiedName(nullAtom, "missing-glyph", svgNS);
+    new ((void*)&mpathTag) QualifiedName(nullAtom, "mpath", svgNS);
+    new ((void*)&pathTag) QualifiedName(nullAtom, "path", svgNS);
+    new ((void*)&patternTag) QualifiedName(nullAtom, "pattern", svgNS);
+    new ((void*)&polygonTag) QualifiedName(nullAtom, "polygon", svgNS);
+    new ((void*)&polylineTag) QualifiedName(nullAtom, "polyline", svgNS);
+    new ((void*)&radialGradientTag) QualifiedName(nullAtom, "radialGradient", svgNS);
+    new ((void*)&rectTag) QualifiedName(nullAtom, "rect", svgNS);
+    new ((void*)&scriptTag) QualifiedName(nullAtom, "script", svgNS);
+    new ((void*)&setTag) QualifiedName(nullAtom, "set", svgNS);
+    new ((void*)&stopTag) QualifiedName(nullAtom, "stop", svgNS);
+    new ((void*)&styleTag) QualifiedName(nullAtom, "style", svgNS);
+    new ((void*)&svgTag) QualifiedName(nullAtom, "svg", svgNS);
+    new ((void*)&switchTag) QualifiedName(nullAtom, "switch", svgNS);
+    new ((void*)&symbolTag) QualifiedName(nullAtom, "symbol", svgNS);
+    new ((void*)&textTag) QualifiedName(nullAtom, "text", svgNS);
+    new ((void*)&textPathTag) QualifiedName(nullAtom, "textPath", svgNS);
+    new ((void*)&titleTag) QualifiedName(nullAtom, "title", svgNS);
+    new ((void*)&trefTag) QualifiedName(nullAtom, "tref", svgNS);
+    new ((void*)&tspanTag) QualifiedName(nullAtom, "tspan", svgNS);
+    new ((void*)&useTag) QualifiedName(nullAtom, "use", svgNS);
+    new ((void*)&viewTag) QualifiedName(nullAtom, "view", svgNS);
     // Attributes
-    new ((void*)&accent_heightAttr) QualifiedName(nullAtom, accent_heightAttrString, nullAtom);
-    new ((void*)&accumulateAttr) QualifiedName(nullAtom, accumulateAttrString, nullAtom);
-    new ((void*)&additiveAttr) QualifiedName(nullAtom, additiveAttrString, nullAtom);
-    new ((void*)&alignment_baselineAttr) QualifiedName(nullAtom, alignment_baselineAttrString, nullAtom);
-    new ((void*)&alphabeticAttr) QualifiedName(nullAtom, alphabeticAttrString, nullAtom);
-    new ((void*)&amplitudeAttr) QualifiedName(nullAtom, amplitudeAttrString, nullAtom);
-    new ((void*)&animateAttr) QualifiedName(nullAtom, animateAttrString, nullAtom);
-    new ((void*)&arabic_formAttr) QualifiedName(nullAtom, arabic_formAttrString, nullAtom);
-    new ((void*)&ascentAttr) QualifiedName(nullAtom, ascentAttrString, nullAtom);
-    new ((void*)&attributeNameAttr) QualifiedName(nullAtom, attributeNameAttrString, nullAtom);
-    new ((void*)&attributeTypeAttr) QualifiedName(nullAtom, attributeTypeAttrString, nullAtom);
-    new ((void*)&azimuthAttr) QualifiedName(nullAtom, azimuthAttrString, nullAtom);
-    new ((void*)&baseFrequencyAttr) QualifiedName(nullAtom, baseFrequencyAttrString, nullAtom);
-    new ((void*)&baseProfileAttr) QualifiedName(nullAtom, baseProfileAttrString, nullAtom);
-    new ((void*)&baseline_shiftAttr) QualifiedName(nullAtom, baseline_shiftAttrString, nullAtom);
-    new ((void*)&bboxAttr) QualifiedName(nullAtom, bboxAttrString, nullAtom);
-    new ((void*)&beginAttr) QualifiedName(nullAtom, beginAttrString, nullAtom);
-    new ((void*)&biasAttr) QualifiedName(nullAtom, biasAttrString, nullAtom);
-    new ((void*)&byAttr) QualifiedName(nullAtom, byAttrString, nullAtom);
-    new ((void*)&calcModeAttr) QualifiedName(nullAtom, calcModeAttrString, nullAtom);
-    new ((void*)&cap_heightAttr) QualifiedName(nullAtom, cap_heightAttrString, nullAtom);
-    new ((void*)&clipAttr) QualifiedName(nullAtom, clipAttrString, nullAtom);
-    new ((void*)&clipPathUnitsAttr) QualifiedName(nullAtom, clipPathUnitsAttrString, nullAtom);
-    new ((void*)&clip_pathAttr) QualifiedName(nullAtom, clip_pathAttrString, nullAtom);
-    new ((void*)&clip_ruleAttr) QualifiedName(nullAtom, clip_ruleAttrString, nullAtom);
-    new ((void*)&colorAttr) QualifiedName(nullAtom, colorAttrString, nullAtom);
-    new ((void*)&color_interpolationAttr) QualifiedName(nullAtom, color_interpolationAttrString, nullAtom);
-    new ((void*)&color_interpolation_filtersAttr) QualifiedName(nullAtom, color_interpolation_filtersAttrString, nullAtom);
-    new ((void*)&color_profileAttr) QualifiedName(nullAtom, color_profileAttrString, nullAtom);
-    new ((void*)&color_renderingAttr) QualifiedName(nullAtom, color_renderingAttrString, nullAtom);
-    new ((void*)&contentScriptTypeAttr) QualifiedName(nullAtom, contentScriptTypeAttrString, nullAtom);
-    new ((void*)&contentStyleTypeAttr) QualifiedName(nullAtom, contentStyleTypeAttrString, nullAtom);
-    new ((void*)&cursorAttr) QualifiedName(nullAtom, cursorAttrString, nullAtom);
-    new ((void*)&cxAttr) QualifiedName(nullAtom, cxAttrString, nullAtom);
-    new ((void*)&cyAttr) QualifiedName(nullAtom, cyAttrString, nullAtom);
-    new ((void*)&dAttr) QualifiedName(nullAtom, dAttrString, nullAtom);
-    new ((void*)&descentAttr) QualifiedName(nullAtom, descentAttrString, nullAtom);
-    new ((void*)&diffuseConstantAttr) QualifiedName(nullAtom, diffuseConstantAttrString, nullAtom);
-    new ((void*)&directionAttr) QualifiedName(nullAtom, directionAttrString, nullAtom);
-    new ((void*)&displayAttr) QualifiedName(nullAtom, displayAttrString, nullAtom);
-    new ((void*)&divisorAttr) QualifiedName(nullAtom, divisorAttrString, nullAtom);
-    new ((void*)&dominant_baselineAttr) QualifiedName(nullAtom, dominant_baselineAttrString, nullAtom);
-    new ((void*)&durAttr) QualifiedName(nullAtom, durAttrString, nullAtom);
-    new ((void*)&dxAttr) QualifiedName(nullAtom, dxAttrString, nullAtom);
-    new ((void*)&dyAttr) QualifiedName(nullAtom, dyAttrString, nullAtom);
-    new ((void*)&edgeModeAttr) QualifiedName(nullAtom, edgeModeAttrString, nullAtom);
-    new ((void*)&elevationAttr) QualifiedName(nullAtom, elevationAttrString, nullAtom);
-    new ((void*)&enable_backgroundAttr) QualifiedName(nullAtom, enable_backgroundAttrString, nullAtom);
-    new ((void*)&endAttr) QualifiedName(nullAtom, endAttrString, nullAtom);
-    new ((void*)&exponentAttr) QualifiedName(nullAtom, exponentAttrString, nullAtom);
-    new ((void*)&externalResourcesRequiredAttr) QualifiedName(nullAtom, externalResourcesRequiredAttrString, nullAtom);
-    new ((void*)&feColorMatrixAttr) QualifiedName(nullAtom, feColorMatrixAttrString, nullAtom);
-    new ((void*)&feCompositeAttr) QualifiedName(nullAtom, feCompositeAttrString, nullAtom);
-    new ((void*)&feGaussianBlurAttr) QualifiedName(nullAtom, feGaussianBlurAttrString, nullAtom);
-    new ((void*)&feMorphologyAttr) QualifiedName(nullAtom, feMorphologyAttrString, nullAtom);
-    new ((void*)&feTileAttr) QualifiedName(nullAtom, feTileAttrString, nullAtom);
-    new ((void*)&fillAttr) QualifiedName(nullAtom, fillAttrString, nullAtom);
-    new ((void*)&fill_opacityAttr) QualifiedName(nullAtom, fill_opacityAttrString, nullAtom);
-    new ((void*)&fill_ruleAttr) QualifiedName(nullAtom, fill_ruleAttrString, nullAtom);
-    new ((void*)&filterAttr) QualifiedName(nullAtom, filterAttrString, nullAtom);
-    new ((void*)&filterResAttr) QualifiedName(nullAtom, filterResAttrString, nullAtom);
-    new ((void*)&filterUnitsAttr) QualifiedName(nullAtom, filterUnitsAttrString, nullAtom);
-    new ((void*)&flood_colorAttr) QualifiedName(nullAtom, flood_colorAttrString, nullAtom);
-    new ((void*)&flood_opacityAttr) QualifiedName(nullAtom, flood_opacityAttrString, nullAtom);
-    new ((void*)&font_familyAttr) QualifiedName(nullAtom, font_familyAttrString, nullAtom);
-    new ((void*)&font_sizeAttr) QualifiedName(nullAtom, font_sizeAttrString, nullAtom);
-    new ((void*)&font_size_adjustAttr) QualifiedName(nullAtom, font_size_adjustAttrString, nullAtom);
-    new ((void*)&font_stretchAttr) QualifiedName(nullAtom, font_stretchAttrString, nullAtom);
-    new ((void*)&font_styleAttr) QualifiedName(nullAtom, font_styleAttrString, nullAtom);
-    new ((void*)&font_variantAttr) QualifiedName(nullAtom, font_variantAttrString, nullAtom);
-    new ((void*)&font_weightAttr) QualifiedName(nullAtom, font_weightAttrString, nullAtom);
-    new ((void*)&formatAttr) QualifiedName(nullAtom, formatAttrString, nullAtom);
-    new ((void*)&fromAttr) QualifiedName(nullAtom, fromAttrString, nullAtom);
-    new ((void*)&fxAttr) QualifiedName(nullAtom, fxAttrString, nullAtom);
-    new ((void*)&fyAttr) QualifiedName(nullAtom, fyAttrString, nullAtom);
-    new ((void*)&g1Attr) QualifiedName(nullAtom, g1AttrString, nullAtom);
-    new ((void*)&g2Attr) QualifiedName(nullAtom, g2AttrString, nullAtom);
-    new ((void*)&glyphRefAttr) QualifiedName(nullAtom, glyphRefAttrString, nullAtom);
-    new ((void*)&glyph_nameAttr) QualifiedName(nullAtom, glyph_nameAttrString, nullAtom);
-    new ((void*)&glyph_orientation_horizontalAttr) QualifiedName(nullAtom, glyph_orientation_horizontalAttrString, nullAtom);
-    new ((void*)&glyph_orientation_verticalAttr) QualifiedName(nullAtom, glyph_orientation_verticalAttrString, nullAtom);
-    new ((void*)&gradientTransformAttr) QualifiedName(nullAtom, gradientTransformAttrString, nullAtom);
-    new ((void*)&gradientUnitsAttr) QualifiedName(nullAtom, gradientUnitsAttrString, nullAtom);
-    new ((void*)&hangingAttr) QualifiedName(nullAtom, hangingAttrString, nullAtom);
-    new ((void*)&heightAttr) QualifiedName(nullAtom, heightAttrString, nullAtom);
-    new ((void*)&horiz_adv_xAttr) QualifiedName(nullAtom, horiz_adv_xAttrString, nullAtom);
-    new ((void*)&horiz_origin_xAttr) QualifiedName(nullAtom, horiz_origin_xAttrString, nullAtom);
-    new ((void*)&horiz_origin_yAttr) QualifiedName(nullAtom, horiz_origin_yAttrString, nullAtom);
-    new ((void*)&ideographicAttr) QualifiedName(nullAtom, ideographicAttrString, nullAtom);
-    new ((void*)&image_renderingAttr) QualifiedName(nullAtom, image_renderingAttrString, nullAtom);
-    new ((void*)&inAttr) QualifiedName(nullAtom, inAttrString, nullAtom);
-    new ((void*)&in2Attr) QualifiedName(nullAtom, in2AttrString, nullAtom);
-    new ((void*)&interceptAttr) QualifiedName(nullAtom, interceptAttrString, nullAtom);
-    new ((void*)&kAttr) QualifiedName(nullAtom, kAttrString, nullAtom);
-    new ((void*)&k1Attr) QualifiedName(nullAtom, k1AttrString, nullAtom);
-    new ((void*)&k2Attr) QualifiedName(nullAtom, k2AttrString, nullAtom);
-    new ((void*)&k3Attr) QualifiedName(nullAtom, k3AttrString, nullAtom);
-    new ((void*)&k4Attr) QualifiedName(nullAtom, k4AttrString, nullAtom);
-    new ((void*)&kernelMatrixAttr) QualifiedName(nullAtom, kernelMatrixAttrString, nullAtom);
-    new ((void*)&kernelUnitLengthAttr) QualifiedName(nullAtom, kernelUnitLengthAttrString, nullAtom);
-    new ((void*)&kerningAttr) QualifiedName(nullAtom, kerningAttrString, nullAtom);
-    new ((void*)&keyPointsAttr) QualifiedName(nullAtom, keyPointsAttrString, nullAtom);
-    new ((void*)&keySplinesAttr) QualifiedName(nullAtom, keySplinesAttrString, nullAtom);
-    new ((void*)&keyTimesAttr) QualifiedName(nullAtom, keyTimesAttrString, nullAtom);
-    new ((void*)&langAttr) QualifiedName(nullAtom, langAttrString, nullAtom);
-    new ((void*)&lengthAdjustAttr) QualifiedName(nullAtom, lengthAdjustAttrString, nullAtom);
-    new ((void*)&letter_spacingAttr) QualifiedName(nullAtom, letter_spacingAttrString, nullAtom);
-    new ((void*)&lighting_colorAttr) QualifiedName(nullAtom, lighting_colorAttrString, nullAtom);
-    new ((void*)&limitingConeAngleAttr) QualifiedName(nullAtom, limitingConeAngleAttrString, nullAtom);
-    new ((void*)&localAttr) QualifiedName(nullAtom, localAttrString, nullAtom);
-    new ((void*)&markerHeightAttr) QualifiedName(nullAtom, markerHeightAttrString, nullAtom);
-    new ((void*)&markerUnitsAttr) QualifiedName(nullAtom, markerUnitsAttrString, nullAtom);
-    new ((void*)&markerWidthAttr) QualifiedName(nullAtom, markerWidthAttrString, nullAtom);
-    new ((void*)&marker_endAttr) QualifiedName(nullAtom, marker_endAttrString, nullAtom);
-    new ((void*)&marker_midAttr) QualifiedName(nullAtom, marker_midAttrString, nullAtom);
-    new ((void*)&marker_startAttr) QualifiedName(nullAtom, marker_startAttrString, nullAtom);
-    new ((void*)&maskAttr) QualifiedName(nullAtom, maskAttrString, nullAtom);
-    new ((void*)&maskContentUnitsAttr) QualifiedName(nullAtom, maskContentUnitsAttrString, nullAtom);
-    new ((void*)&maskUnitsAttr) QualifiedName(nullAtom, maskUnitsAttrString, nullAtom);
-    new ((void*)&mathematicalAttr) QualifiedName(nullAtom, mathematicalAttrString, nullAtom);
-    new ((void*)&maxAttr) QualifiedName(nullAtom, maxAttrString, nullAtom);
-    new ((void*)&mediaAttr) QualifiedName(nullAtom, mediaAttrString, nullAtom);
-    new ((void*)&methodAttr) QualifiedName(nullAtom, methodAttrString, nullAtom);
-    new ((void*)&minAttr) QualifiedName(nullAtom, minAttrString, nullAtom);
-    new ((void*)&modeAttr) QualifiedName(nullAtom, modeAttrString, nullAtom);
-    new ((void*)&nameAttr) QualifiedName(nullAtom, nameAttrString, nullAtom);
-    new ((void*)&numOctavesAttr) QualifiedName(nullAtom, numOctavesAttrString, nullAtom);
-    new ((void*)&offsetAttr) QualifiedName(nullAtom, offsetAttrString, nullAtom);
-    new ((void*)&onactivateAttr) QualifiedName(nullAtom, onactivateAttrString, nullAtom);
-    new ((void*)&onbeginAttr) QualifiedName(nullAtom, onbeginAttrString, nullAtom);
-    new ((void*)&onendAttr) QualifiedName(nullAtom, onendAttrString, nullAtom);
-    new ((void*)&onfocusinAttr) QualifiedName(nullAtom, onfocusinAttrString, nullAtom);
-    new ((void*)&onfocusoutAttr) QualifiedName(nullAtom, onfocusoutAttrString, nullAtom);
-    new ((void*)&onrepeatAttr) QualifiedName(nullAtom, onrepeatAttrString, nullAtom);
-    new ((void*)&onzoomAttr) QualifiedName(nullAtom, onzoomAttrString, nullAtom);
-    new ((void*)&opacityAttr) QualifiedName(nullAtom, opacityAttrString, nullAtom);
-    new ((void*)&operatorAttr) QualifiedName(nullAtom, operatorAttrString, nullAtom);
-    new ((void*)&orderAttr) QualifiedName(nullAtom, orderAttrString, nullAtom);
-    new ((void*)&orientAttr) QualifiedName(nullAtom, orientAttrString, nullAtom);
-    new ((void*)&orientationAttr) QualifiedName(nullAtom, orientationAttrString, nullAtom);
-    new ((void*)&originAttr) QualifiedName(nullAtom, originAttrString, nullAtom);
-    new ((void*)&overflowAttr) QualifiedName(nullAtom, overflowAttrString, nullAtom);
-    new ((void*)&overline_positionAttr) QualifiedName(nullAtom, overline_positionAttrString, nullAtom);
-    new ((void*)&overline_thicknessAttr) QualifiedName(nullAtom, overline_thicknessAttrString, nullAtom);
-    new ((void*)&panose_1Attr) QualifiedName(nullAtom, panose_1AttrString, nullAtom);
-    new ((void*)&pathAttr) QualifiedName(nullAtom, pathAttrString, nullAtom);
-    new ((void*)&pathLengthAttr) QualifiedName(nullAtom, pathLengthAttrString, nullAtom);
-    new ((void*)&patternContentUnitsAttr) QualifiedName(nullAtom, patternContentUnitsAttrString, nullAtom);
-    new ((void*)&patternTransformAttr) QualifiedName(nullAtom, patternTransformAttrString, nullAtom);
-    new ((void*)&patternUnitsAttr) QualifiedName(nullAtom, patternUnitsAttrString, nullAtom);
-    new ((void*)&pointer_eventsAttr) QualifiedName(nullAtom, pointer_eventsAttrString, nullAtom);
-    new ((void*)&pointsAttr) QualifiedName(nullAtom, pointsAttrString, nullAtom);
-    new ((void*)&pointsAtXAttr) QualifiedName(nullAtom, pointsAtXAttrString, nullAtom);
-    new ((void*)&pointsAtYAttr) QualifiedName(nullAtom, pointsAtYAttrString, nullAtom);
-    new ((void*)&pointsAtZAttr) QualifiedName(nullAtom, pointsAtZAttrString, nullAtom);
-    new ((void*)&preserveAlphaAttr) QualifiedName(nullAtom, preserveAlphaAttrString, nullAtom);
-    new ((void*)&preserveAspectRatioAttr) QualifiedName(nullAtom, preserveAspectRatioAttrString, nullAtom);
-    new ((void*)&primitiveUnitsAttr) QualifiedName(nullAtom, primitiveUnitsAttrString, nullAtom);
-    new ((void*)&rAttr) QualifiedName(nullAtom, rAttrString, nullAtom);
-    new ((void*)&radiusAttr) QualifiedName(nullAtom, radiusAttrString, nullAtom);
-    new ((void*)&refXAttr) QualifiedName(nullAtom, refXAttrString, nullAtom);
-    new ((void*)&refYAttr) QualifiedName(nullAtom, refYAttrString, nullAtom);
-    new ((void*)&rendering_intentAttr) QualifiedName(nullAtom, rendering_intentAttrString, nullAtom);
-    new ((void*)&repeatCountAttr) QualifiedName(nullAtom, repeatCountAttrString, nullAtom);
-    new ((void*)&repeatDurAttr) QualifiedName(nullAtom, repeatDurAttrString, nullAtom);
-    new ((void*)&requiredExtensionsAttr) QualifiedName(nullAtom, requiredExtensionsAttrString, nullAtom);
-    new ((void*)&requiredFeaturesAttr) QualifiedName(nullAtom, requiredFeaturesAttrString, nullAtom);
-    new ((void*)&restartAttr) QualifiedName(nullAtom, restartAttrString, nullAtom);
-    new ((void*)&resultAttr) QualifiedName(nullAtom, resultAttrString, nullAtom);
-    new ((void*)&rotateAttr) QualifiedName(nullAtom, rotateAttrString, nullAtom);
-    new ((void*)&rxAttr) QualifiedName(nullAtom, rxAttrString, nullAtom);
-    new ((void*)&ryAttr) QualifiedName(nullAtom, ryAttrString, nullAtom);
-    new ((void*)&scaleAttr) QualifiedName(nullAtom, scaleAttrString, nullAtom);
-    new ((void*)&seedAttr) QualifiedName(nullAtom, seedAttrString, nullAtom);
-    new ((void*)&shape_renderingAttr) QualifiedName(nullAtom, shape_renderingAttrString, nullAtom);
-    new ((void*)&slopeAttr) QualifiedName(nullAtom, slopeAttrString, nullAtom);
-    new ((void*)&spacingAttr) QualifiedName(nullAtom, spacingAttrString, nullAtom);
-    new ((void*)&specularConstantAttr) QualifiedName(nullAtom, specularConstantAttrString, nullAtom);
-    new ((void*)&specularExponentAttr) QualifiedName(nullAtom, specularExponentAttrString, nullAtom);
-    new ((void*)&spreadMethodAttr) QualifiedName(nullAtom, spreadMethodAttrString, nullAtom);
-    new ((void*)&startOffsetAttr) QualifiedName(nullAtom, startOffsetAttrString, nullAtom);
-    new ((void*)&stdDeviationAttr) QualifiedName(nullAtom, stdDeviationAttrString, nullAtom);
-    new ((void*)&stemhAttr) QualifiedName(nullAtom, stemhAttrString, nullAtom);
-    new ((void*)&stemvAttr) QualifiedName(nullAtom, stemvAttrString, nullAtom);
-    new ((void*)&stitchTilesAttr) QualifiedName(nullAtom, stitchTilesAttrString, nullAtom);
-    new ((void*)&stop_colorAttr) QualifiedName(nullAtom, stop_colorAttrString, nullAtom);
-    new ((void*)&stop_opacityAttr) QualifiedName(nullAtom, stop_opacityAttrString, nullAtom);
-    new ((void*)&strikethrough_positionAttr) QualifiedName(nullAtom, strikethrough_positionAttrString, nullAtom);
-    new ((void*)&strikethrough_thicknessAttr) QualifiedName(nullAtom, strikethrough_thicknessAttrString, nullAtom);
-    new ((void*)&strokeAttr) QualifiedName(nullAtom, strokeAttrString, nullAtom);
-    new ((void*)&stroke_dasharrayAttr) QualifiedName(nullAtom, stroke_dasharrayAttrString, nullAtom);
-    new ((void*)&stroke_dashoffsetAttr) QualifiedName(nullAtom, stroke_dashoffsetAttrString, nullAtom);
-    new ((void*)&stroke_linecapAttr) QualifiedName(nullAtom, stroke_linecapAttrString, nullAtom);
-    new ((void*)&stroke_linejoinAttr) QualifiedName(nullAtom, stroke_linejoinAttrString, nullAtom);
-    new ((void*)&stroke_miterlimitAttr) QualifiedName(nullAtom, stroke_miterlimitAttrString, nullAtom);
-    new ((void*)&stroke_opacityAttr) QualifiedName(nullAtom, stroke_opacityAttrString, nullAtom);
-    new ((void*)&stroke_widthAttr) QualifiedName(nullAtom, stroke_widthAttrString, nullAtom);
-    new ((void*)&styleAttr) QualifiedName(nullAtom, styleAttrString, nullAtom);
-    new ((void*)&surfaceScaleAttr) QualifiedName(nullAtom, surfaceScaleAttrString, nullAtom);
-    new ((void*)&systemLanguageAttr) QualifiedName(nullAtom, systemLanguageAttrString, nullAtom);
-    new ((void*)&tableValuesAttr) QualifiedName(nullAtom, tableValuesAttrString, nullAtom);
-    new ((void*)&targetAttr) QualifiedName(nullAtom, targetAttrString, nullAtom);
-    new ((void*)&targetXAttr) QualifiedName(nullAtom, targetXAttrString, nullAtom);
-    new ((void*)&targetYAttr) QualifiedName(nullAtom, targetYAttrString, nullAtom);
-    new ((void*)&textLengthAttr) QualifiedName(nullAtom, textLengthAttrString, nullAtom);
-    new ((void*)&text_anchorAttr) QualifiedName(nullAtom, text_anchorAttrString, nullAtom);
-    new ((void*)&text_decorationAttr) QualifiedName(nullAtom, text_decorationAttrString, nullAtom);
-    new ((void*)&text_renderingAttr) QualifiedName(nullAtom, text_renderingAttrString, nullAtom);
-    new ((void*)&titleAttr) QualifiedName(nullAtom, titleAttrString, nullAtom);
-    new ((void*)&toAttr) QualifiedName(nullAtom, toAttrString, nullAtom);
-    new ((void*)&transformAttr) QualifiedName(nullAtom, transformAttrString, nullAtom);
-    new ((void*)&typeAttr) QualifiedName(nullAtom, typeAttrString, nullAtom);
-    new ((void*)&u1Attr) QualifiedName(nullAtom, u1AttrString, nullAtom);
-    new ((void*)&u2Attr) QualifiedName(nullAtom, u2AttrString, nullAtom);
-    new ((void*)&underline_positionAttr) QualifiedName(nullAtom, underline_positionAttrString, nullAtom);
-    new ((void*)&underline_thicknessAttr) QualifiedName(nullAtom, underline_thicknessAttrString, nullAtom);
-    new ((void*)&unicodeAttr) QualifiedName(nullAtom, unicodeAttrString, nullAtom);
-    new ((void*)&unicode_bidiAttr) QualifiedName(nullAtom, unicode_bidiAttrString, nullAtom);
-    new ((void*)&unicode_rangeAttr) QualifiedName(nullAtom, unicode_rangeAttrString, nullAtom);
-    new ((void*)&units_per_emAttr) QualifiedName(nullAtom, units_per_emAttrString, nullAtom);
-    new ((void*)&v_alphabeticAttr) QualifiedName(nullAtom, v_alphabeticAttrString, nullAtom);
-    new ((void*)&v_hangingAttr) QualifiedName(nullAtom, v_hangingAttrString, nullAtom);
-    new ((void*)&v_ideographicAttr) QualifiedName(nullAtom, v_ideographicAttrString, nullAtom);
-    new ((void*)&v_mathematicalAttr) QualifiedName(nullAtom, v_mathematicalAttrString, nullAtom);
-    new ((void*)&valuesAttr) QualifiedName(nullAtom, valuesAttrString, nullAtom);
-    new ((void*)&versionAttr) QualifiedName(nullAtom, versionAttrString, nullAtom);
-    new ((void*)&vert_adv_yAttr) QualifiedName(nullAtom, vert_adv_yAttrString, nullAtom);
-    new ((void*)&vert_origin_xAttr) QualifiedName(nullAtom, vert_origin_xAttrString, nullAtom);
-    new ((void*)&vert_origin_yAttr) QualifiedName(nullAtom, vert_origin_yAttrString, nullAtom);
-    new ((void*)&viewBoxAttr) QualifiedName(nullAtom, viewBoxAttrString, nullAtom);
-    new ((void*)&viewTargetAttr) QualifiedName(nullAtom, viewTargetAttrString, nullAtom);
-    new ((void*)&visibilityAttr) QualifiedName(nullAtom, visibilityAttrString, nullAtom);
-    new ((void*)&widthAttr) QualifiedName(nullAtom, widthAttrString, nullAtom);
-    new ((void*)&widthsAttr) QualifiedName(nullAtom, widthsAttrString, nullAtom);
-    new ((void*)&word_spacingAttr) QualifiedName(nullAtom, word_spacingAttrString, nullAtom);
-    new ((void*)&writing_modeAttr) QualifiedName(nullAtom, writing_modeAttrString, nullAtom);
-    new ((void*)&xAttr) QualifiedName(nullAtom, xAttrString, nullAtom);
-    new ((void*)&x1Attr) QualifiedName(nullAtom, x1AttrString, nullAtom);
-    new ((void*)&x2Attr) QualifiedName(nullAtom, x2AttrString, nullAtom);
-    new ((void*)&xChannelSelectorAttr) QualifiedName(nullAtom, xChannelSelectorAttrString, nullAtom);
-    new ((void*)&x_heightAttr) QualifiedName(nullAtom, x_heightAttrString, nullAtom);
-    new ((void*)&yAttr) QualifiedName(nullAtom, yAttrString, nullAtom);
-    new ((void*)&y1Attr) QualifiedName(nullAtom, y1AttrString, nullAtom);
-    new ((void*)&y2Attr) QualifiedName(nullAtom, y2AttrString, nullAtom);
-    new ((void*)&yChannelSelectorAttr) QualifiedName(nullAtom, yChannelSelectorAttrString, nullAtom);
-    new ((void*)&zAttr) QualifiedName(nullAtom, zAttrString, nullAtom);
-    new ((void*)&zoomAndPanAttr) QualifiedName(nullAtom, zoomAndPanAttrString, nullAtom);
+    new ((void*)&accent_heightAttr) QualifiedName(nullAtom, "accent-height", nullAtom);
+    new ((void*)&accumulateAttr) QualifiedName(nullAtom, "accumulate", nullAtom);
+    new ((void*)&additiveAttr) QualifiedName(nullAtom, "additive", nullAtom);
+    new ((void*)&alignment_baselineAttr) QualifiedName(nullAtom, "alignment-baseline", nullAtom);
+    new ((void*)&alphabeticAttr) QualifiedName(nullAtom, "alphabetic", nullAtom);
+    new ((void*)&amplitudeAttr) QualifiedName(nullAtom, "amplitude", nullAtom);
+    new ((void*)&animateAttr) QualifiedName(nullAtom, "animate", nullAtom);
+    new ((void*)&arabic_formAttr) QualifiedName(nullAtom, "arabic-form", nullAtom);
+    new ((void*)&ascentAttr) QualifiedName(nullAtom, "ascent", nullAtom);
+    new ((void*)&attributeNameAttr) QualifiedName(nullAtom, "attributeName", nullAtom);
+    new ((void*)&attributeTypeAttr) QualifiedName(nullAtom, "attributeType", nullAtom);
+    new ((void*)&azimuthAttr) QualifiedName(nullAtom, "azimuth", nullAtom);
+    new ((void*)&baseFrequencyAttr) QualifiedName(nullAtom, "baseFrequency", nullAtom);
+    new ((void*)&baseProfileAttr) QualifiedName(nullAtom, "baseProfile", nullAtom);
+    new ((void*)&baseline_shiftAttr) QualifiedName(nullAtom, "baseline-shift", nullAtom);
+    new ((void*)&bboxAttr) QualifiedName(nullAtom, "bbox", nullAtom);
+    new ((void*)&beginAttr) QualifiedName(nullAtom, "begin", nullAtom);
+    new ((void*)&biasAttr) QualifiedName(nullAtom, "bias", nullAtom);
+    new ((void*)&byAttr) QualifiedName(nullAtom, "by", nullAtom);
+    new ((void*)&calcModeAttr) QualifiedName(nullAtom, "calcMode", nullAtom);
+    new ((void*)&cap_heightAttr) QualifiedName(nullAtom, "cap-height", nullAtom);
+    new ((void*)&clipAttr) QualifiedName(nullAtom, "clip", nullAtom);
+    new ((void*)&clipPathUnitsAttr) QualifiedName(nullAtom, "clipPathUnits", nullAtom);
+    new ((void*)&clip_pathAttr) QualifiedName(nullAtom, "clip-path", nullAtom);
+    new ((void*)&clip_ruleAttr) QualifiedName(nullAtom, "clip-rule", nullAtom);
+    new ((void*)&colorAttr) QualifiedName(nullAtom, "color", nullAtom);
+    new ((void*)&color_interpolationAttr) QualifiedName(nullAtom, "color-interpolation", nullAtom);
+    new ((void*)&color_interpolation_filtersAttr) QualifiedName(nullAtom, "color-interpolation-filters", nullAtom);
+    new ((void*)&color_profileAttr) QualifiedName(nullAtom, "color-profile", nullAtom);
+    new ((void*)&color_renderingAttr) QualifiedName(nullAtom, "color-rendering", nullAtom);
+    new ((void*)&contentScriptTypeAttr) QualifiedName(nullAtom, "contentScriptType", nullAtom);
+    new ((void*)&contentStyleTypeAttr) QualifiedName(nullAtom, "contentStyleType", nullAtom);
+    new ((void*)&cursorAttr) QualifiedName(nullAtom, "cursor", nullAtom);
+    new ((void*)&cxAttr) QualifiedName(nullAtom, "cx", nullAtom);
+    new ((void*)&cyAttr) QualifiedName(nullAtom, "cy", nullAtom);
+    new ((void*)&dAttr) QualifiedName(nullAtom, "d", nullAtom);
+    new ((void*)&descentAttr) QualifiedName(nullAtom, "descent", nullAtom);
+    new ((void*)&diffuseConstantAttr) QualifiedName(nullAtom, "diffuseConstant", nullAtom);
+    new ((void*)&directionAttr) QualifiedName(nullAtom, "direction", nullAtom);
+    new ((void*)&displayAttr) QualifiedName(nullAtom, "display", nullAtom);
+    new ((void*)&divisorAttr) QualifiedName(nullAtom, "divisor", nullAtom);
+    new ((void*)&dominant_baselineAttr) QualifiedName(nullAtom, "dominant-baseline", nullAtom);
+    new ((void*)&durAttr) QualifiedName(nullAtom, "dur", nullAtom);
+    new ((void*)&dxAttr) QualifiedName(nullAtom, "dx", nullAtom);
+    new ((void*)&dyAttr) QualifiedName(nullAtom, "dy", nullAtom);
+    new ((void*)&edgeModeAttr) QualifiedName(nullAtom, "edgeMode", nullAtom);
+    new ((void*)&elevationAttr) QualifiedName(nullAtom, "elevation", nullAtom);
+    new ((void*)&enable_backgroundAttr) QualifiedName(nullAtom, "enable-background", nullAtom);
+    new ((void*)&endAttr) QualifiedName(nullAtom, "end", nullAtom);
+    new ((void*)&exponentAttr) QualifiedName(nullAtom, "exponent", nullAtom);
+    new ((void*)&externalResourcesRequiredAttr) QualifiedName(nullAtom, "externalResourcesRequired", nullAtom);
+    new ((void*)&feColorMatrixAttr) QualifiedName(nullAtom, "feColorMatrix", nullAtom);
+    new ((void*)&feCompositeAttr) QualifiedName(nullAtom, "feComposite", nullAtom);
+    new ((void*)&feGaussianBlurAttr) QualifiedName(nullAtom, "feGaussianBlur", nullAtom);
+    new ((void*)&feMorphologyAttr) QualifiedName(nullAtom, "feMorphology", nullAtom);
+    new ((void*)&feTileAttr) QualifiedName(nullAtom, "feTile", nullAtom);
+    new ((void*)&fillAttr) QualifiedName(nullAtom, "fill", nullAtom);
+    new ((void*)&fill_opacityAttr) QualifiedName(nullAtom, "fill-opacity", nullAtom);
+    new ((void*)&fill_ruleAttr) QualifiedName(nullAtom, "fill-rule", nullAtom);
+    new ((void*)&filterAttr) QualifiedName(nullAtom, "filter", nullAtom);
+    new ((void*)&filterResAttr) QualifiedName(nullAtom, "filterRes", nullAtom);
+    new ((void*)&filterUnitsAttr) QualifiedName(nullAtom, "filterUnits", nullAtom);
+    new ((void*)&flood_colorAttr) QualifiedName(nullAtom, "flood-color", nullAtom);
+    new ((void*)&flood_opacityAttr) QualifiedName(nullAtom, "flood-opacity", nullAtom);
+    new ((void*)&font_familyAttr) QualifiedName(nullAtom, "font-family", nullAtom);
+    new ((void*)&font_sizeAttr) QualifiedName(nullAtom, "font-size", nullAtom);
+    new ((void*)&font_size_adjustAttr) QualifiedName(nullAtom, "font-size-adjust", nullAtom);
+    new ((void*)&font_stretchAttr) QualifiedName(nullAtom, "font-stretch", nullAtom);
+    new ((void*)&font_styleAttr) QualifiedName(nullAtom, "font-style", nullAtom);
+    new ((void*)&font_variantAttr) QualifiedName(nullAtom, "font-variant", nullAtom);
+    new ((void*)&font_weightAttr) QualifiedName(nullAtom, "font-weight", nullAtom);
+    new ((void*)&formatAttr) QualifiedName(nullAtom, "format", nullAtom);
+    new ((void*)&fromAttr) QualifiedName(nullAtom, "from", nullAtom);
+    new ((void*)&fxAttr) QualifiedName(nullAtom, "fx", nullAtom);
+    new ((void*)&fyAttr) QualifiedName(nullAtom, "fy", nullAtom);
+    new ((void*)&g1Attr) QualifiedName(nullAtom, "g1", nullAtom);
+    new ((void*)&g2Attr) QualifiedName(nullAtom, "g2", nullAtom);
+    new ((void*)&glyphRefAttr) QualifiedName(nullAtom, "glyphRef", nullAtom);
+    new ((void*)&glyph_nameAttr) QualifiedName(nullAtom, "glyph-name", nullAtom);
+    new ((void*)&glyph_orientation_horizontalAttr) QualifiedName(nullAtom, "glyph-orientation-horizontal", nullAtom);
+    new ((void*)&glyph_orientation_verticalAttr) QualifiedName(nullAtom, "glyph-orientation-vertical", nullAtom);
+    new ((void*)&gradientTransformAttr) QualifiedName(nullAtom, "gradientTransform", nullAtom);
+    new ((void*)&gradientUnitsAttr) QualifiedName(nullAtom, "gradientUnits", nullAtom);
+    new ((void*)&hangingAttr) QualifiedName(nullAtom, "hanging", nullAtom);
+    new ((void*)&heightAttr) QualifiedName(nullAtom, "height", nullAtom);
+    new ((void*)&horiz_adv_xAttr) QualifiedName(nullAtom, "horiz-adv-x", nullAtom);
+    new ((void*)&horiz_origin_xAttr) QualifiedName(nullAtom, "horiz-origin-x", nullAtom);
+    new ((void*)&horiz_origin_yAttr) QualifiedName(nullAtom, "horiz-origin-y", nullAtom);
+    new ((void*)&ideographicAttr) QualifiedName(nullAtom, "ideographic", nullAtom);
+    new ((void*)&image_renderingAttr) QualifiedName(nullAtom, "image-rendering", nullAtom);
+    new ((void*)&inAttr) QualifiedName(nullAtom, "in", nullAtom);
+    new ((void*)&in2Attr) QualifiedName(nullAtom, "in2", nullAtom);
+    new ((void*)&interceptAttr) QualifiedName(nullAtom, "intercept", nullAtom);
+    new ((void*)&kAttr) QualifiedName(nullAtom, "k", nullAtom);
+    new ((void*)&k1Attr) QualifiedName(nullAtom, "k1", nullAtom);
+    new ((void*)&k2Attr) QualifiedName(nullAtom, "k2", nullAtom);
+    new ((void*)&k3Attr) QualifiedName(nullAtom, "k3", nullAtom);
+    new ((void*)&k4Attr) QualifiedName(nullAtom, "k4", nullAtom);
+    new ((void*)&kernelMatrixAttr) QualifiedName(nullAtom, "kernelMatrix", nullAtom);
+    new ((void*)&kernelUnitLengthAttr) QualifiedName(nullAtom, "kernelUnitLength", nullAtom);
+    new ((void*)&kerningAttr) QualifiedName(nullAtom, "kerning", nullAtom);
+    new ((void*)&keyPointsAttr) QualifiedName(nullAtom, "keyPoints", nullAtom);
+    new ((void*)&keySplinesAttr) QualifiedName(nullAtom, "keySplines", nullAtom);
+    new ((void*)&keyTimesAttr) QualifiedName(nullAtom, "keyTimes", nullAtom);
+    new ((void*)&langAttr) QualifiedName(nullAtom, "lang", nullAtom);
+    new ((void*)&lengthAdjustAttr) QualifiedName(nullAtom, "lengthAdjust", nullAtom);
+    new ((void*)&letter_spacingAttr) QualifiedName(nullAtom, "letter-spacing", nullAtom);
+    new ((void*)&lighting_colorAttr) QualifiedName(nullAtom, "lighting-color", nullAtom);
+    new ((void*)&limitingConeAngleAttr) QualifiedName(nullAtom, "limitingConeAngle", nullAtom);
+    new ((void*)&localAttr) QualifiedName(nullAtom, "local", nullAtom);
+    new ((void*)&markerHeightAttr) QualifiedName(nullAtom, "markerHeight", nullAtom);
+    new ((void*)&markerUnitsAttr) QualifiedName(nullAtom, "markerUnits", nullAtom);
+    new ((void*)&markerWidthAttr) QualifiedName(nullAtom, "markerWidth", nullAtom);
+    new ((void*)&marker_endAttr) QualifiedName(nullAtom, "marker-end", nullAtom);
+    new ((void*)&marker_midAttr) QualifiedName(nullAtom, "marker-mid", nullAtom);
+    new ((void*)&marker_startAttr) QualifiedName(nullAtom, "marker-start", nullAtom);
+    new ((void*)&maskAttr) QualifiedName(nullAtom, "mask", nullAtom);
+    new ((void*)&maskContentUnitsAttr) QualifiedName(nullAtom, "maskContentUnits", nullAtom);
+    new ((void*)&maskUnitsAttr) QualifiedName(nullAtom, "maskUnits", nullAtom);
+    new ((void*)&mathematicalAttr) QualifiedName(nullAtom, "mathematical", nullAtom);
+    new ((void*)&maxAttr) QualifiedName(nullAtom, "max", nullAtom);
+    new ((void*)&mediaAttr) QualifiedName(nullAtom, "media", nullAtom);
+    new ((void*)&methodAttr) QualifiedName(nullAtom, "method", nullAtom);
+    new ((void*)&minAttr) QualifiedName(nullAtom, "min", nullAtom);
+    new ((void*)&modeAttr) QualifiedName(nullAtom, "mode", nullAtom);
+    new ((void*)&nameAttr) QualifiedName(nullAtom, "name", nullAtom);
+    new ((void*)&numOctavesAttr) QualifiedName(nullAtom, "numOctaves", nullAtom);
+    new ((void*)&offsetAttr) QualifiedName(nullAtom, "offset", nullAtom);
+    new ((void*)&onactivateAttr) QualifiedName(nullAtom, "onactivate", nullAtom);
+    new ((void*)&onbeginAttr) QualifiedName(nullAtom, "onbegin", nullAtom);
+    new ((void*)&onendAttr) QualifiedName(nullAtom, "onend", nullAtom);
+    new ((void*)&onfocusinAttr) QualifiedName(nullAtom, "onfocusin", nullAtom);
+    new ((void*)&onfocusoutAttr) QualifiedName(nullAtom, "onfocusout", nullAtom);
+    new ((void*)&onrepeatAttr) QualifiedName(nullAtom, "onrepeat", nullAtom);
+    new ((void*)&onzoomAttr) QualifiedName(nullAtom, "onzoom", nullAtom);
+    new ((void*)&opacityAttr) QualifiedName(nullAtom, "opacity", nullAtom);
+    new ((void*)&operatorAttr) QualifiedName(nullAtom, "operator", nullAtom);
+    new ((void*)&orderAttr) QualifiedName(nullAtom, "order", nullAtom);
+    new ((void*)&orientAttr) QualifiedName(nullAtom, "orient", nullAtom);
+    new ((void*)&orientationAttr) QualifiedName(nullAtom, "orientation", nullAtom);
+    new ((void*)&originAttr) QualifiedName(nullAtom, "origin", nullAtom);
+    new ((void*)&overflowAttr) QualifiedName(nullAtom, "overflow", nullAtom);
+    new ((void*)&overline_positionAttr) QualifiedName(nullAtom, "overline-position", nullAtom);
+    new ((void*)&overline_thicknessAttr) QualifiedName(nullAtom, "overline-thickness", nullAtom);
+    new ((void*)&panose_1Attr) QualifiedName(nullAtom, "panose-1", nullAtom);
+    new ((void*)&pathAttr) QualifiedName(nullAtom, "path", nullAtom);
+    new ((void*)&pathLengthAttr) QualifiedName(nullAtom, "pathLength", nullAtom);
+    new ((void*)&patternContentUnitsAttr) QualifiedName(nullAtom, "patternContentUnits", nullAtom);
+    new ((void*)&patternTransformAttr) QualifiedName(nullAtom, "patternTransform", nullAtom);
+    new ((void*)&patternUnitsAttr) QualifiedName(nullAtom, "patternUnits", nullAtom);
+    new ((void*)&pointer_eventsAttr) QualifiedName(nullAtom, "pointer-events", nullAtom);
+    new ((void*)&pointsAttr) QualifiedName(nullAtom, "points", nullAtom);
+    new ((void*)&pointsAtXAttr) QualifiedName(nullAtom, "pointsAtX", nullAtom);
+    new ((void*)&pointsAtYAttr) QualifiedName(nullAtom, "pointsAtY", nullAtom);
+    new ((void*)&pointsAtZAttr) QualifiedName(nullAtom, "pointsAtZ", nullAtom);
+    new ((void*)&preserveAlphaAttr) QualifiedName(nullAtom, "preserveAlpha", nullAtom);
+    new ((void*)&preserveAspectRatioAttr) QualifiedName(nullAtom, "preserveAspectRatio", nullAtom);
+    new ((void*)&primitiveUnitsAttr) QualifiedName(nullAtom, "primitiveUnits", nullAtom);
+    new ((void*)&rAttr) QualifiedName(nullAtom, "r", nullAtom);
+    new ((void*)&radiusAttr) QualifiedName(nullAtom, "radius", nullAtom);
+    new ((void*)&refXAttr) QualifiedName(nullAtom, "refX", nullAtom);
+    new ((void*)&refYAttr) QualifiedName(nullAtom, "refY", nullAtom);
+    new ((void*)&rendering_intentAttr) QualifiedName(nullAtom, "rendering-intent", nullAtom);
+    new ((void*)&repeatCountAttr) QualifiedName(nullAtom, "repeatCount", nullAtom);
+    new ((void*)&repeatDurAttr) QualifiedName(nullAtom, "repeatDur", nullAtom);
+    new ((void*)&requiredExtensionsAttr) QualifiedName(nullAtom, "requiredExtensions", nullAtom);
+    new ((void*)&requiredFeaturesAttr) QualifiedName(nullAtom, "requiredFeatures", nullAtom);
+    new ((void*)&restartAttr) QualifiedName(nullAtom, "restart", nullAtom);
+    new ((void*)&resultAttr) QualifiedName(nullAtom, "result", nullAtom);
+    new ((void*)&rotateAttr) QualifiedName(nullAtom, "rotate", nullAtom);
+    new ((void*)&rxAttr) QualifiedName(nullAtom, "rx", nullAtom);
+    new ((void*)&ryAttr) QualifiedName(nullAtom, "ry", nullAtom);
+    new ((void*)&scaleAttr) QualifiedName(nullAtom, "scale", nullAtom);
+    new ((void*)&seedAttr) QualifiedName(nullAtom, "seed", nullAtom);
+    new ((void*)&shape_renderingAttr) QualifiedName(nullAtom, "shape-rendering", nullAtom);
+    new ((void*)&slopeAttr) QualifiedName(nullAtom, "slope", nullAtom);
+    new ((void*)&spacingAttr) QualifiedName(nullAtom, "spacing", nullAtom);
+    new ((void*)&specularConstantAttr) QualifiedName(nullAtom, "specularConstant", nullAtom);
+    new ((void*)&specularExponentAttr) QualifiedName(nullAtom, "specularExponent", nullAtom);
+    new ((void*)&spreadMethodAttr) QualifiedName(nullAtom, "spreadMethod", nullAtom);
+    new ((void*)&startOffsetAttr) QualifiedName(nullAtom, "startOffset", nullAtom);
+    new ((void*)&stdDeviationAttr) QualifiedName(nullAtom, "stdDeviation", nullAtom);
+    new ((void*)&stemhAttr) QualifiedName(nullAtom, "stemh", nullAtom);
+    new ((void*)&stemvAttr) QualifiedName(nullAtom, "stemv", nullAtom);
+    new ((void*)&stitchTilesAttr) QualifiedName(nullAtom, "stitchTiles", nullAtom);
+    new ((void*)&stop_colorAttr) QualifiedName(nullAtom, "stop-color", nullAtom);
+    new ((void*)&stop_opacityAttr) QualifiedName(nullAtom, "stop-opacity", nullAtom);
+    new ((void*)&strikethrough_positionAttr) QualifiedName(nullAtom, "strikethrough-position", nullAtom);
+    new ((void*)&strikethrough_thicknessAttr) QualifiedName(nullAtom, "strikethrough-thickness", nullAtom);
+    new ((void*)&strokeAttr) QualifiedName(nullAtom, "stroke", nullAtom);
+    new ((void*)&stroke_dasharrayAttr) QualifiedName(nullAtom, "stroke-dasharray", nullAtom);
+    new ((void*)&stroke_dashoffsetAttr) QualifiedName(nullAtom, "stroke-dashoffset", nullAtom);
+    new ((void*)&stroke_linecapAttr) QualifiedName(nullAtom, "stroke-linecap", nullAtom);
+    new ((void*)&stroke_linejoinAttr) QualifiedName(nullAtom, "stroke-linejoin", nullAtom);
+    new ((void*)&stroke_miterlimitAttr) QualifiedName(nullAtom, "stroke-miterlimit", nullAtom);
+    new ((void*)&stroke_opacityAttr) QualifiedName(nullAtom, "stroke-opacity", nullAtom);
+    new ((void*)&stroke_widthAttr) QualifiedName(nullAtom, "stroke-width", nullAtom);
+    new ((void*)&styleAttr) QualifiedName(nullAtom, "style", nullAtom);
+    new ((void*)&surfaceScaleAttr) QualifiedName(nullAtom, "surfaceScale", nullAtom);
+    new ((void*)&systemLanguageAttr) QualifiedName(nullAtom, "systemLanguage", nullAtom);
+    new ((void*)&tableValuesAttr) QualifiedName(nullAtom, "tableValues", nullAtom);
+    new ((void*)&targetAttr) QualifiedName(nullAtom, "target", nullAtom);
+    new ((void*)&targetXAttr) QualifiedName(nullAtom, "targetX", nullAtom);
+    new ((void*)&targetYAttr) QualifiedName(nullAtom, "targetY", nullAtom);
+    new ((void*)&textLengthAttr) QualifiedName(nullAtom, "textLength", nullAtom);
+    new ((void*)&text_anchorAttr) QualifiedName(nullAtom, "text-anchor", nullAtom);
+    new ((void*)&text_decorationAttr) QualifiedName(nullAtom, "text-decoration", nullAtom);
+    new ((void*)&text_renderingAttr) QualifiedName(nullAtom, "text-rendering", nullAtom);
+    new ((void*)&titleAttr) QualifiedName(nullAtom, "title", nullAtom);
+    new ((void*)&toAttr) QualifiedName(nullAtom, "to", nullAtom);
+    new ((void*)&transformAttr) QualifiedName(nullAtom, "transform", nullAtom);
+    new ((void*)&typeAttr) QualifiedName(nullAtom, "type", nullAtom);
+    new ((void*)&u1Attr) QualifiedName(nullAtom, "u1", nullAtom);
+    new ((void*)&u2Attr) QualifiedName(nullAtom, "u2", nullAtom);
+    new ((void*)&underline_positionAttr) QualifiedName(nullAtom, "underline-position", nullAtom);
+    new ((void*)&underline_thicknessAttr) QualifiedName(nullAtom, "underline-thickness", nullAtom);
+    new ((void*)&unicodeAttr) QualifiedName(nullAtom, "unicode", nullAtom);
+    new ((void*)&unicode_bidiAttr) QualifiedName(nullAtom, "unicode-bidi", nullAtom);
+    new ((void*)&unicode_rangeAttr) QualifiedName(nullAtom, "unicode-range", nullAtom);
+    new ((void*)&units_per_emAttr) QualifiedName(nullAtom, "units-per-em", nullAtom);
+    new ((void*)&v_alphabeticAttr) QualifiedName(nullAtom, "v-alphabetic", nullAtom);
+    new ((void*)&v_hangingAttr) QualifiedName(nullAtom, "v-hanging", nullAtom);
+    new ((void*)&v_ideographicAttr) QualifiedName(nullAtom, "v-ideographic", nullAtom);
+    new ((void*)&v_mathematicalAttr) QualifiedName(nullAtom, "v-mathematical", nullAtom);
+    new ((void*)&valuesAttr) QualifiedName(nullAtom, "values", nullAtom);
+    new ((void*)&versionAttr) QualifiedName(nullAtom, "version", nullAtom);
+    new ((void*)&vert_adv_yAttr) QualifiedName(nullAtom, "vert-adv-y", nullAtom);
+    new ((void*)&vert_origin_xAttr) QualifiedName(nullAtom, "vert-origin-x", nullAtom);
+    new ((void*)&vert_origin_yAttr) QualifiedName(nullAtom, "vert-origin-y", nullAtom);
+    new ((void*)&viewBoxAttr) QualifiedName(nullAtom, "viewBox", nullAtom);
+    new ((void*)&viewTargetAttr) QualifiedName(nullAtom, "viewTarget", nullAtom);
+    new ((void*)&visibilityAttr) QualifiedName(nullAtom, "visibility", nullAtom);
+    new ((void*)&widthAttr) QualifiedName(nullAtom, "width", nullAtom);
+    new ((void*)&widthsAttr) QualifiedName(nullAtom, "widths", nullAtom);
+    new ((void*)&word_spacingAttr) QualifiedName(nullAtom, "word-spacing", nullAtom);
+    new ((void*)&writing_modeAttr) QualifiedName(nullAtom, "writing-mode", nullAtom);
+    new ((void*)&xAttr) QualifiedName(nullAtom, "x", nullAtom);
+    new ((void*)&x1Attr) QualifiedName(nullAtom, "x1", nullAtom);
+    new ((void*)&x2Attr) QualifiedName(nullAtom, "x2", nullAtom);
+    new ((void*)&xChannelSelectorAttr) QualifiedName(nullAtom, "xChannelSelector", nullAtom);
+    new ((void*)&x_heightAttr) QualifiedName(nullAtom, "x-height", nullAtom);
+    new ((void*)&yAttr) QualifiedName(nullAtom, "y", nullAtom);
+    new ((void*)&y1Attr) QualifiedName(nullAtom, "y1", nullAtom);
+    new ((void*)&y2Attr) QualifiedName(nullAtom, "y2", nullAtom);
+    new ((void*)&yChannelSelectorAttr) QualifiedName(nullAtom, "yChannelSelector", nullAtom);
+    new ((void*)&zAttr) QualifiedName(nullAtom, "z", nullAtom);
+    new ((void*)&zoomAndPanAttr) QualifiedName(nullAtom, "zoomAndPan", nullAtom);
 }
 
 } }
diff --git a/src/3rdparty/webkit/WebCore/generated/SVGNames.h b/src/3rdparty/webkit/WebCore/generated/SVGNames.h
index 9fbd740bed..ad8d62b191 100644
--- a/src/3rdparty/webkit/WebCore/generated/SVGNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/SVGNames.h
@@ -42,600 +42,327 @@ extern const WebCore::AtomicString svgNamespaceURI;
 
 // Tags
 extern const WebCore::QualifiedName aTag;
-extern char aTagString[];
 extern const WebCore::QualifiedName altGlyphTag;
-extern char altGlyphTagString[];
 extern const WebCore::QualifiedName animateTag;
-extern char animateTagString[];
 extern const WebCore::QualifiedName animateColorTag;
-extern char animateColorTagString[];
 extern const WebCore::QualifiedName animateMotionTag;
-extern char animateMotionTagString[];
 extern const WebCore::QualifiedName animateTransformTag;
-extern char animateTransformTagString[];
 extern const WebCore::QualifiedName circleTag;
-extern char circleTagString[];
 extern const WebCore::QualifiedName clipPathTag;
-extern char clipPathTagString[];
 extern const WebCore::QualifiedName cursorTag;
-extern char cursorTagString[];
 extern const WebCore::QualifiedName defsTag;
-extern char defsTagString[];
 extern const WebCore::QualifiedName descTag;
-extern char descTagString[];
 extern const WebCore::QualifiedName ellipseTag;
-extern char ellipseTagString[];
+extern const WebCore::QualifiedName feBlendTag;
+extern const WebCore::QualifiedName feColorMatrixTag;
+extern const WebCore::QualifiedName feComponentTransferTag;
+extern const WebCore::QualifiedName feCompositeTag;
+extern const WebCore::QualifiedName feDiffuseLightingTag;
+extern const WebCore::QualifiedName feDisplacementMapTag;
+extern const WebCore::QualifiedName feDistantLightTag;
+extern const WebCore::QualifiedName feFloodTag;
+extern const WebCore::QualifiedName feFuncATag;
+extern const WebCore::QualifiedName feFuncBTag;
+extern const WebCore::QualifiedName feFuncGTag;
+extern const WebCore::QualifiedName feFuncRTag;
+extern const WebCore::QualifiedName feGaussianBlurTag;
+extern const WebCore::QualifiedName feImageTag;
+extern const WebCore::QualifiedName feMergeTag;
+extern const WebCore::QualifiedName feMergeNodeTag;
+extern const WebCore::QualifiedName feMorphologyTag;
+extern const WebCore::QualifiedName feOffsetTag;
+extern const WebCore::QualifiedName fePointLightTag;
+extern const WebCore::QualifiedName feSpecularLightingTag;
+extern const WebCore::QualifiedName feSpotLightTag;
+extern const WebCore::QualifiedName feTileTag;
+extern const WebCore::QualifiedName feTurbulenceTag;
+extern const WebCore::QualifiedName filterTag;
 extern const WebCore::QualifiedName fontTag;
-extern char fontTagString[];
 extern const WebCore::QualifiedName font_faceTag;
-extern char font_faceTagString[];
 extern const WebCore::QualifiedName font_face_formatTag;
-extern char font_face_formatTagString[];
 extern const WebCore::QualifiedName font_face_nameTag;
-extern char font_face_nameTagString[];
 extern const WebCore::QualifiedName font_face_srcTag;
-extern char font_face_srcTagString[];
 extern const WebCore::QualifiedName font_face_uriTag;
-extern char font_face_uriTagString[];
 extern const WebCore::QualifiedName foreignObjectTag;
-extern char foreignObjectTagString[];
 extern const WebCore::QualifiedName gTag;
-extern char gTagString[];
 extern const WebCore::QualifiedName glyphTag;
-extern char glyphTagString[];
 extern const WebCore::QualifiedName hkernTag;
-extern char hkernTagString[];
 extern const WebCore::QualifiedName imageTag;
-extern char imageTagString[];
 extern const WebCore::QualifiedName lineTag;
-extern char lineTagString[];
 extern const WebCore::QualifiedName linearGradientTag;
-extern char linearGradientTagString[];
 extern const WebCore::QualifiedName markerTag;
-extern char markerTagString[];
 extern const WebCore::QualifiedName maskTag;
-extern char maskTagString[];
 extern const WebCore::QualifiedName metadataTag;
-extern char metadataTagString[];
 extern const WebCore::QualifiedName missing_glyphTag;
-extern char missing_glyphTagString[];
 extern const WebCore::QualifiedName mpathTag;
-extern char mpathTagString[];
 extern const WebCore::QualifiedName pathTag;
-extern char pathTagString[];
 extern const WebCore::QualifiedName patternTag;
-extern char patternTagString[];
 extern const WebCore::QualifiedName polygonTag;
-extern char polygonTagString[];
 extern const WebCore::QualifiedName polylineTag;
-extern char polylineTagString[];
 extern const WebCore::QualifiedName radialGradientTag;
-extern char radialGradientTagString[];
 extern const WebCore::QualifiedName rectTag;
-extern char rectTagString[];
 extern const WebCore::QualifiedName scriptTag;
-extern char scriptTagString[];
 extern const WebCore::QualifiedName setTag;
-extern char setTagString[];
 extern const WebCore::QualifiedName stopTag;
-extern char stopTagString[];
 extern const WebCore::QualifiedName styleTag;
-extern char styleTagString[];
 extern const WebCore::QualifiedName svgTag;
-extern char svgTagString[];
 extern const WebCore::QualifiedName switchTag;
-extern char switchTagString[];
 extern const WebCore::QualifiedName symbolTag;
-extern char symbolTagString[];
 extern const WebCore::QualifiedName textTag;
-extern char textTagString[];
 extern const WebCore::QualifiedName textPathTag;
-extern char textPathTagString[];
 extern const WebCore::QualifiedName titleTag;
-extern char titleTagString[];
 extern const WebCore::QualifiedName trefTag;
-extern char trefTagString[];
 extern const WebCore::QualifiedName tspanTag;
-extern char tspanTagString[];
 extern const WebCore::QualifiedName useTag;
-extern char useTagString[];
 extern const WebCore::QualifiedName viewTag;
-extern char viewTagString[];
 // Attributes
 extern const WebCore::QualifiedName accent_heightAttr;
-extern char accent_heightAttrString[];
 extern const WebCore::QualifiedName accumulateAttr;
-extern char accumulateAttrString[];
 extern const WebCore::QualifiedName additiveAttr;
-extern char additiveAttrString[];
 extern const WebCore::QualifiedName alignment_baselineAttr;
-extern char alignment_baselineAttrString[];
 extern const WebCore::QualifiedName alphabeticAttr;
-extern char alphabeticAttrString[];
 extern const WebCore::QualifiedName amplitudeAttr;
-extern char amplitudeAttrString[];
 extern const WebCore::QualifiedName animateAttr;
-extern char animateAttrString[];
 extern const WebCore::QualifiedName arabic_formAttr;
-extern char arabic_formAttrString[];
 extern const WebCore::QualifiedName ascentAttr;
-extern char ascentAttrString[];
 extern const WebCore::QualifiedName attributeNameAttr;
-extern char attributeNameAttrString[];
 extern const WebCore::QualifiedName attributeTypeAttr;
-extern char attributeTypeAttrString[];
 extern const WebCore::QualifiedName azimuthAttr;
-extern char azimuthAttrString[];
 extern const WebCore::QualifiedName baseFrequencyAttr;
-extern char baseFrequencyAttrString[];
 extern const WebCore::QualifiedName baseProfileAttr;
-extern char baseProfileAttrString[];
 extern const WebCore::QualifiedName baseline_shiftAttr;
-extern char baseline_shiftAttrString[];
 extern const WebCore::QualifiedName bboxAttr;
-extern char bboxAttrString[];
 extern const WebCore::QualifiedName beginAttr;
-extern char beginAttrString[];
 extern const WebCore::QualifiedName biasAttr;
-extern char biasAttrString[];
 extern const WebCore::QualifiedName byAttr;
-extern char byAttrString[];
 extern const WebCore::QualifiedName calcModeAttr;
-extern char calcModeAttrString[];
 extern const WebCore::QualifiedName cap_heightAttr;
-extern char cap_heightAttrString[];
 extern const WebCore::QualifiedName clipAttr;
-extern char clipAttrString[];
 extern const WebCore::QualifiedName clipPathUnitsAttr;
-extern char clipPathUnitsAttrString[];
 extern const WebCore::QualifiedName clip_pathAttr;
-extern char clip_pathAttrString[];
 extern const WebCore::QualifiedName clip_ruleAttr;
-extern char clip_ruleAttrString[];
 extern const WebCore::QualifiedName colorAttr;
-extern char colorAttrString[];
 extern const WebCore::QualifiedName color_interpolationAttr;
-extern char color_interpolationAttrString[];
 extern const WebCore::QualifiedName color_interpolation_filtersAttr;
-extern char color_interpolation_filtersAttrString[];
 extern const WebCore::QualifiedName color_profileAttr;
-extern char color_profileAttrString[];
 extern const WebCore::QualifiedName color_renderingAttr;
-extern char color_renderingAttrString[];
 extern const WebCore::QualifiedName contentScriptTypeAttr;
-extern char contentScriptTypeAttrString[];
 extern const WebCore::QualifiedName contentStyleTypeAttr;
-extern char contentStyleTypeAttrString[];
 extern const WebCore::QualifiedName cursorAttr;
-extern char cursorAttrString[];
 extern const WebCore::QualifiedName cxAttr;
-extern char cxAttrString[];
 extern const WebCore::QualifiedName cyAttr;
-extern char cyAttrString[];
 extern const WebCore::QualifiedName dAttr;
-extern char dAttrString[];
 extern const WebCore::QualifiedName descentAttr;
-extern char descentAttrString[];
 extern const WebCore::QualifiedName diffuseConstantAttr;
-extern char diffuseConstantAttrString[];
 extern const WebCore::QualifiedName directionAttr;
-extern char directionAttrString[];
 extern const WebCore::QualifiedName displayAttr;
-extern char displayAttrString[];
 extern const WebCore::QualifiedName divisorAttr;
-extern char divisorAttrString[];
 extern const WebCore::QualifiedName dominant_baselineAttr;
-extern char dominant_baselineAttrString[];
 extern const WebCore::QualifiedName durAttr;
-extern char durAttrString[];
 extern const WebCore::QualifiedName dxAttr;
-extern char dxAttrString[];
 extern const WebCore::QualifiedName dyAttr;
-extern char dyAttrString[];
 extern const WebCore::QualifiedName edgeModeAttr;
-extern char edgeModeAttrString[];
 extern const WebCore::QualifiedName elevationAttr;
-extern char elevationAttrString[];
 extern const WebCore::QualifiedName enable_backgroundAttr;
-extern char enable_backgroundAttrString[];
 extern const WebCore::QualifiedName endAttr;
-extern char endAttrString[];
 extern const WebCore::QualifiedName exponentAttr;
-extern char exponentAttrString[];
 extern const WebCore::QualifiedName externalResourcesRequiredAttr;
-extern char externalResourcesRequiredAttrString[];
 extern const WebCore::QualifiedName feColorMatrixAttr;
-extern char feColorMatrixAttrString[];
 extern const WebCore::QualifiedName feCompositeAttr;
-extern char feCompositeAttrString[];
 extern const WebCore::QualifiedName feGaussianBlurAttr;
-extern char feGaussianBlurAttrString[];
 extern const WebCore::QualifiedName feMorphologyAttr;
-extern char feMorphologyAttrString[];
 extern const WebCore::QualifiedName feTileAttr;
-extern char feTileAttrString[];
 extern const WebCore::QualifiedName fillAttr;
-extern char fillAttrString[];
 extern const WebCore::QualifiedName fill_opacityAttr;
-extern char fill_opacityAttrString[];
 extern const WebCore::QualifiedName fill_ruleAttr;
-extern char fill_ruleAttrString[];
 extern const WebCore::QualifiedName filterAttr;
-extern char filterAttrString[];
 extern const WebCore::QualifiedName filterResAttr;
-extern char filterResAttrString[];
 extern const WebCore::QualifiedName filterUnitsAttr;
-extern char filterUnitsAttrString[];
 extern const WebCore::QualifiedName flood_colorAttr;
-extern char flood_colorAttrString[];
 extern const WebCore::QualifiedName flood_opacityAttr;
-extern char flood_opacityAttrString[];
 extern const WebCore::QualifiedName font_familyAttr;
-extern char font_familyAttrString[];
 extern const WebCore::QualifiedName font_sizeAttr;
-extern char font_sizeAttrString[];
 extern const WebCore::QualifiedName font_size_adjustAttr;
-extern char font_size_adjustAttrString[];
 extern const WebCore::QualifiedName font_stretchAttr;
-extern char font_stretchAttrString[];
 extern const WebCore::QualifiedName font_styleAttr;
-extern char font_styleAttrString[];
 extern const WebCore::QualifiedName font_variantAttr;
-extern char font_variantAttrString[];
 extern const WebCore::QualifiedName font_weightAttr;
-extern char font_weightAttrString[];
 extern const WebCore::QualifiedName formatAttr;
-extern char formatAttrString[];
 extern const WebCore::QualifiedName fromAttr;
-extern char fromAttrString[];
 extern const WebCore::QualifiedName fxAttr;
-extern char fxAttrString[];
 extern const WebCore::QualifiedName fyAttr;
-extern char fyAttrString[];
 extern const WebCore::QualifiedName g1Attr;
-extern char g1AttrString[];
 extern const WebCore::QualifiedName g2Attr;
-extern char g2AttrString[];
 extern const WebCore::QualifiedName glyphRefAttr;
-extern char glyphRefAttrString[];
 extern const WebCore::QualifiedName glyph_nameAttr;
-extern char glyph_nameAttrString[];
 extern const WebCore::QualifiedName glyph_orientation_horizontalAttr;
-extern char glyph_orientation_horizontalAttrString[];
 extern const WebCore::QualifiedName glyph_orientation_verticalAttr;
-extern char glyph_orientation_verticalAttrString[];
 extern const WebCore::QualifiedName gradientTransformAttr;
-extern char gradientTransformAttrString[];
 extern const WebCore::QualifiedName gradientUnitsAttr;
-extern char gradientUnitsAttrString[];
 extern const WebCore::QualifiedName hangingAttr;
-extern char hangingAttrString[];
 extern const WebCore::QualifiedName heightAttr;
-extern char heightAttrString[];
 extern const WebCore::QualifiedName horiz_adv_xAttr;
-extern char horiz_adv_xAttrString[];
 extern const WebCore::QualifiedName horiz_origin_xAttr;
-extern char horiz_origin_xAttrString[];
 extern const WebCore::QualifiedName horiz_origin_yAttr;
-extern char horiz_origin_yAttrString[];
 extern const WebCore::QualifiedName ideographicAttr;
-extern char ideographicAttrString[];
 extern const WebCore::QualifiedName image_renderingAttr;
-extern char image_renderingAttrString[];
 extern const WebCore::QualifiedName inAttr;
-extern char inAttrString[];
 extern const WebCore::QualifiedName in2Attr;
-extern char in2AttrString[];
 extern const WebCore::QualifiedName interceptAttr;
-extern char interceptAttrString[];
 extern const WebCore::QualifiedName kAttr;
-extern char kAttrString[];
 extern const WebCore::QualifiedName k1Attr;
-extern char k1AttrString[];
 extern const WebCore::QualifiedName k2Attr;
-extern char k2AttrString[];
 extern const WebCore::QualifiedName k3Attr;
-extern char k3AttrString[];
 extern const WebCore::QualifiedName k4Attr;
-extern char k4AttrString[];
 extern const WebCore::QualifiedName kernelMatrixAttr;
-extern char kernelMatrixAttrString[];
 extern const WebCore::QualifiedName kernelUnitLengthAttr;
-extern char kernelUnitLengthAttrString[];
 extern const WebCore::QualifiedName kerningAttr;
-extern char kerningAttrString[];
 extern const WebCore::QualifiedName keyPointsAttr;
-extern char keyPointsAttrString[];
 extern const WebCore::QualifiedName keySplinesAttr;
-extern char keySplinesAttrString[];
 extern const WebCore::QualifiedName keyTimesAttr;
-extern char keyTimesAttrString[];
 extern const WebCore::QualifiedName langAttr;
-extern char langAttrString[];
 extern const WebCore::QualifiedName lengthAdjustAttr;
-extern char lengthAdjustAttrString[];
 extern const WebCore::QualifiedName letter_spacingAttr;
-extern char letter_spacingAttrString[];
 extern const WebCore::QualifiedName lighting_colorAttr;
-extern char lighting_colorAttrString[];
 extern const WebCore::QualifiedName limitingConeAngleAttr;
-extern char limitingConeAngleAttrString[];
 extern const WebCore::QualifiedName localAttr;
-extern char localAttrString[];
 extern const WebCore::QualifiedName markerHeightAttr;
-extern char markerHeightAttrString[];
 extern const WebCore::QualifiedName markerUnitsAttr;
-extern char markerUnitsAttrString[];
 extern const WebCore::QualifiedName markerWidthAttr;
-extern char markerWidthAttrString[];
 extern const WebCore::QualifiedName marker_endAttr;
-extern char marker_endAttrString[];
 extern const WebCore::QualifiedName marker_midAttr;
-extern char marker_midAttrString[];
 extern const WebCore::QualifiedName marker_startAttr;
-extern char marker_startAttrString[];
 extern const WebCore::QualifiedName maskAttr;
-extern char maskAttrString[];
 extern const WebCore::QualifiedName maskContentUnitsAttr;
-extern char maskContentUnitsAttrString[];
 extern const WebCore::QualifiedName maskUnitsAttr;
-extern char maskUnitsAttrString[];
 extern const WebCore::QualifiedName mathematicalAttr;
-extern char mathematicalAttrString[];
 extern const WebCore::QualifiedName maxAttr;
-extern char maxAttrString[];
 extern const WebCore::QualifiedName mediaAttr;
-extern char mediaAttrString[];
 extern const WebCore::QualifiedName methodAttr;
-extern char methodAttrString[];
 extern const WebCore::QualifiedName minAttr;
-extern char minAttrString[];
 extern const WebCore::QualifiedName modeAttr;
-extern char modeAttrString[];
 extern const WebCore::QualifiedName nameAttr;
-extern char nameAttrString[];
 extern const WebCore::QualifiedName numOctavesAttr;
-extern char numOctavesAttrString[];
 extern const WebCore::QualifiedName offsetAttr;
-extern char offsetAttrString[];
 extern const WebCore::QualifiedName onactivateAttr;
-extern char onactivateAttrString[];
 extern const WebCore::QualifiedName onbeginAttr;
-extern char onbeginAttrString[];
 extern const WebCore::QualifiedName onendAttr;
-extern char onendAttrString[];
 extern const WebCore::QualifiedName onfocusinAttr;
-extern char onfocusinAttrString[];
 extern const WebCore::QualifiedName onfocusoutAttr;
-extern char onfocusoutAttrString[];
 extern const WebCore::QualifiedName onrepeatAttr;
-extern char onrepeatAttrString[];
 extern const WebCore::QualifiedName onzoomAttr;
-extern char onzoomAttrString[];
 extern const WebCore::QualifiedName opacityAttr;
-extern char opacityAttrString[];
 extern const WebCore::QualifiedName operatorAttr;
-extern char operatorAttrString[];
 extern const WebCore::QualifiedName orderAttr;
-extern char orderAttrString[];
 extern const WebCore::QualifiedName orientAttr;
-extern char orientAttrString[];
 extern const WebCore::QualifiedName orientationAttr;
-extern char orientationAttrString[];
 extern const WebCore::QualifiedName originAttr;
-extern char originAttrString[];
 extern const WebCore::QualifiedName overflowAttr;
-extern char overflowAttrString[];
 extern const WebCore::QualifiedName overline_positionAttr;
-extern char overline_positionAttrString[];
 extern const WebCore::QualifiedName overline_thicknessAttr;
-extern char overline_thicknessAttrString[];
 extern const WebCore::QualifiedName panose_1Attr;
-extern char panose_1AttrString[];
 extern const WebCore::QualifiedName pathAttr;
-extern char pathAttrString[];
 extern const WebCore::QualifiedName pathLengthAttr;
-extern char pathLengthAttrString[];
 extern const WebCore::QualifiedName patternContentUnitsAttr;
-extern char patternContentUnitsAttrString[];
 extern const WebCore::QualifiedName patternTransformAttr;
-extern char patternTransformAttrString[];
 extern const WebCore::QualifiedName patternUnitsAttr;
-extern char patternUnitsAttrString[];
 extern const WebCore::QualifiedName pointer_eventsAttr;
-extern char pointer_eventsAttrString[];
 extern const WebCore::QualifiedName pointsAttr;
-extern char pointsAttrString[];
 extern const WebCore::QualifiedName pointsAtXAttr;
-extern char pointsAtXAttrString[];
 extern const WebCore::QualifiedName pointsAtYAttr;
-extern char pointsAtYAttrString[];
 extern const WebCore::QualifiedName pointsAtZAttr;
-extern char pointsAtZAttrString[];
 extern const WebCore::QualifiedName preserveAlphaAttr;
-extern char preserveAlphaAttrString[];
 extern const WebCore::QualifiedName preserveAspectRatioAttr;
-extern char preserveAspectRatioAttrString[];
 extern const WebCore::QualifiedName primitiveUnitsAttr;
-extern char primitiveUnitsAttrString[];
 extern const WebCore::QualifiedName rAttr;
-extern char rAttrString[];
 extern const WebCore::QualifiedName radiusAttr;
-extern char radiusAttrString[];
 extern const WebCore::QualifiedName refXAttr;
-extern char refXAttrString[];
 extern const WebCore::QualifiedName refYAttr;
-extern char refYAttrString[];
 extern const WebCore::QualifiedName rendering_intentAttr;
-extern char rendering_intentAttrString[];
 extern const WebCore::QualifiedName repeatCountAttr;
-extern char repeatCountAttrString[];
 extern const WebCore::QualifiedName repeatDurAttr;
-extern char repeatDurAttrString[];
 extern const WebCore::QualifiedName requiredExtensionsAttr;
-extern char requiredExtensionsAttrString[];
 extern const WebCore::QualifiedName requiredFeaturesAttr;
-extern char requiredFeaturesAttrString[];
 extern const WebCore::QualifiedName restartAttr;
-extern char restartAttrString[];
 extern const WebCore::QualifiedName resultAttr;
-extern char resultAttrString[];
 extern const WebCore::QualifiedName rotateAttr;
-extern char rotateAttrString[];
 extern const WebCore::QualifiedName rxAttr;
-extern char rxAttrString[];
 extern const WebCore::QualifiedName ryAttr;
-extern char ryAttrString[];
 extern const WebCore::QualifiedName scaleAttr;
-extern char scaleAttrString[];
 extern const WebCore::QualifiedName seedAttr;
-extern char seedAttrString[];
 extern const WebCore::QualifiedName shape_renderingAttr;
-extern char shape_renderingAttrString[];
 extern const WebCore::QualifiedName slopeAttr;
-extern char slopeAttrString[];
 extern const WebCore::QualifiedName spacingAttr;
-extern char spacingAttrString[];
 extern const WebCore::QualifiedName specularConstantAttr;
-extern char specularConstantAttrString[];
 extern const WebCore::QualifiedName specularExponentAttr;
-extern char specularExponentAttrString[];
 extern const WebCore::QualifiedName spreadMethodAttr;
-extern char spreadMethodAttrString[];
 extern const WebCore::QualifiedName startOffsetAttr;
-extern char startOffsetAttrString[];
 extern const WebCore::QualifiedName stdDeviationAttr;
-extern char stdDeviationAttrString[];
 extern const WebCore::QualifiedName stemhAttr;
-extern char stemhAttrString[];
 extern const WebCore::QualifiedName stemvAttr;
-extern char stemvAttrString[];
 extern const WebCore::QualifiedName stitchTilesAttr;
-extern char stitchTilesAttrString[];
 extern const WebCore::QualifiedName stop_colorAttr;
-extern char stop_colorAttrString[];
 extern const WebCore::QualifiedName stop_opacityAttr;
-extern char stop_opacityAttrString[];
 extern const WebCore::QualifiedName strikethrough_positionAttr;
-extern char strikethrough_positionAttrString[];
 extern const WebCore::QualifiedName strikethrough_thicknessAttr;
-extern char strikethrough_thicknessAttrString[];
 extern const WebCore::QualifiedName strokeAttr;
-extern char strokeAttrString[];
 extern const WebCore::QualifiedName stroke_dasharrayAttr;
-extern char stroke_dasharrayAttrString[];
 extern const WebCore::QualifiedName stroke_dashoffsetAttr;
-extern char stroke_dashoffsetAttrString[];
 extern const WebCore::QualifiedName stroke_linecapAttr;
-extern char stroke_linecapAttrString[];
 extern const WebCore::QualifiedName stroke_linejoinAttr;
-extern char stroke_linejoinAttrString[];
 extern const WebCore::QualifiedName stroke_miterlimitAttr;
-extern char stroke_miterlimitAttrString[];
 extern const WebCore::QualifiedName stroke_opacityAttr;
-extern char stroke_opacityAttrString[];
 extern const WebCore::QualifiedName stroke_widthAttr;
-extern char stroke_widthAttrString[];
 extern const WebCore::QualifiedName styleAttr;
-extern char styleAttrString[];
 extern const WebCore::QualifiedName surfaceScaleAttr;
-extern char surfaceScaleAttrString[];
 extern const WebCore::QualifiedName systemLanguageAttr;
-extern char systemLanguageAttrString[];
 extern const WebCore::QualifiedName tableValuesAttr;
-extern char tableValuesAttrString[];
 extern const WebCore::QualifiedName targetAttr;
-extern char targetAttrString[];
 extern const WebCore::QualifiedName targetXAttr;
-extern char targetXAttrString[];
 extern const WebCore::QualifiedName targetYAttr;
-extern char targetYAttrString[];
 extern const WebCore::QualifiedName textLengthAttr;
-extern char textLengthAttrString[];
 extern const WebCore::QualifiedName text_anchorAttr;
-extern char text_anchorAttrString[];
 extern const WebCore::QualifiedName text_decorationAttr;
-extern char text_decorationAttrString[];
 extern const WebCore::QualifiedName text_renderingAttr;
-extern char text_renderingAttrString[];
 extern const WebCore::QualifiedName titleAttr;
-extern char titleAttrString[];
 extern const WebCore::QualifiedName toAttr;
-extern char toAttrString[];
 extern const WebCore::QualifiedName transformAttr;
-extern char transformAttrString[];
 extern const WebCore::QualifiedName typeAttr;
-extern char typeAttrString[];
 extern const WebCore::QualifiedName u1Attr;
-extern char u1AttrString[];
 extern const WebCore::QualifiedName u2Attr;
-extern char u2AttrString[];
 extern const WebCore::QualifiedName underline_positionAttr;
-extern char underline_positionAttrString[];
 extern const WebCore::QualifiedName underline_thicknessAttr;
-extern char underline_thicknessAttrString[];
 extern const WebCore::QualifiedName unicodeAttr;
-extern char unicodeAttrString[];
 extern const WebCore::QualifiedName unicode_bidiAttr;
-extern char unicode_bidiAttrString[];
 extern const WebCore::QualifiedName unicode_rangeAttr;
-extern char unicode_rangeAttrString[];
 extern const WebCore::QualifiedName units_per_emAttr;
-extern char units_per_emAttrString[];
 extern const WebCore::QualifiedName v_alphabeticAttr;
-extern char v_alphabeticAttrString[];
 extern const WebCore::QualifiedName v_hangingAttr;
-extern char v_hangingAttrString[];
 extern const WebCore::QualifiedName v_ideographicAttr;
-extern char v_ideographicAttrString[];
 extern const WebCore::QualifiedName v_mathematicalAttr;
-extern char v_mathematicalAttrString[];
 extern const WebCore::QualifiedName valuesAttr;
-extern char valuesAttrString[];
 extern const WebCore::QualifiedName versionAttr;
-extern char versionAttrString[];
 extern const WebCore::QualifiedName vert_adv_yAttr;
-extern char vert_adv_yAttrString[];
 extern const WebCore::QualifiedName vert_origin_xAttr;
-extern char vert_origin_xAttrString[];
 extern const WebCore::QualifiedName vert_origin_yAttr;
-extern char vert_origin_yAttrString[];
 extern const WebCore::QualifiedName viewBoxAttr;
-extern char viewBoxAttrString[];
 extern const WebCore::QualifiedName viewTargetAttr;
-extern char viewTargetAttrString[];
 extern const WebCore::QualifiedName visibilityAttr;
-extern char visibilityAttrString[];
 extern const WebCore::QualifiedName widthAttr;
-extern char widthAttrString[];
 extern const WebCore::QualifiedName widthsAttr;
-extern char widthsAttrString[];
 extern const WebCore::QualifiedName word_spacingAttr;
-extern char word_spacingAttrString[];
 extern const WebCore::QualifiedName writing_modeAttr;
-extern char writing_modeAttrString[];
 extern const WebCore::QualifiedName xAttr;
-extern char xAttrString[];
 extern const WebCore::QualifiedName x1Attr;
-extern char x1AttrString[];
 extern const WebCore::QualifiedName x2Attr;
-extern char x2AttrString[];
 extern const WebCore::QualifiedName xChannelSelectorAttr;
-extern char xChannelSelectorAttrString[];
 extern const WebCore::QualifiedName x_heightAttr;
-extern char x_heightAttrString[];
 extern const WebCore::QualifiedName yAttr;
-extern char yAttrString[];
 extern const WebCore::QualifiedName y1Attr;
-extern char y1AttrString[];
 extern const WebCore::QualifiedName y2Attr;
-extern char y2AttrString[];
 extern const WebCore::QualifiedName yChannelSelectorAttr;
-extern char yChannelSelectorAttrString[];
 extern const WebCore::QualifiedName zAttr;
-extern char zAttrString[];
 extern const WebCore::QualifiedName zoomAndPanAttr;
-extern char zoomAndPanAttrString[];
 #endif
 
 WebCore::QualifiedName** getSVGTags(size_t* size);
diff --git a/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h b/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h
deleted file mode 100644
index 2d411d2fd6..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h
+++ /dev/null
@@ -1,48 +0,0 @@
-// Automatically generated from ../../JavaScriptCore/runtime/StringPrototype.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
-
-#include "Lookup.h"
-
-namespace JSC {
-
-static const struct HashTableValue stringTableValues[36] = {
-   { "toString", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
-   { "valueOf", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
-   { "charAt", DontEnum|Function, (intptr_t)stringProtoFuncCharAt, (intptr_t)1 },
-   { "charCodeAt", DontEnum|Function, (intptr_t)stringProtoFuncCharCodeAt, (intptr_t)1 },
-   { "concat", DontEnum|Function, (intptr_t)stringProtoFuncConcat, (intptr_t)1 },
-   { "indexOf", DontEnum|Function, (intptr_t)stringProtoFuncIndexOf, (intptr_t)1 },
-   { "lastIndexOf", DontEnum|Function, (intptr_t)stringProtoFuncLastIndexOf, (intptr_t)1 },
-   { "match", DontEnum|Function, (intptr_t)stringProtoFuncMatch, (intptr_t)1 },
-   { "replace", DontEnum|Function, (intptr_t)stringProtoFuncReplace, (intptr_t)2 },
-   { "search", DontEnum|Function, (intptr_t)stringProtoFuncSearch, (intptr_t)1 },
-   { "slice", DontEnum|Function, (intptr_t)stringProtoFuncSlice, (intptr_t)2 },
-   { "split", DontEnum|Function, (intptr_t)stringProtoFuncSplit, (intptr_t)2 },
-   { "substr", DontEnum|Function, (intptr_t)stringProtoFuncSubstr, (intptr_t)2 },
-   { "substring", DontEnum|Function, (intptr_t)stringProtoFuncSubstring, (intptr_t)2 },
-   { "toLowerCase", DontEnum|Function, (intptr_t)stringProtoFuncToLowerCase, (intptr_t)0 },
-   { "toUpperCase", DontEnum|Function, (intptr_t)stringProtoFuncToUpperCase, (intptr_t)0 },
-   { "localeCompare", DontEnum|Function, (intptr_t)stringProtoFuncLocaleCompare, (intptr_t)1 },
-   { "toLocaleLowerCase", DontEnum|Function, (intptr_t)stringProtoFuncToLowerCase, (intptr_t)0 },
-   { "toLocaleUpperCase", DontEnum|Function, (intptr_t)stringProtoFuncToUpperCase, (intptr_t)0 },
-   { "big", DontEnum|Function, (intptr_t)stringProtoFuncBig, (intptr_t)0 },
-   { "small", DontEnum|Function, (intptr_t)stringProtoFuncSmall, (intptr_t)0 },
-   { "blink", DontEnum|Function, (intptr_t)stringProtoFuncBlink, (intptr_t)0 },
-   { "bold", DontEnum|Function, (intptr_t)stringProtoFuncBold, (intptr_t)0 },
-   { "fixed", DontEnum|Function, (intptr_t)stringProtoFuncFixed, (intptr_t)0 },
-   { "italics", DontEnum|Function, (intptr_t)stringProtoFuncItalics, (intptr_t)0 },
-   { "strike", DontEnum|Function, (intptr_t)stringProtoFuncStrike, (intptr_t)0 },
-   { "sub", DontEnum|Function, (intptr_t)stringProtoFuncSub, (intptr_t)0 },
-   { "sup", DontEnum|Function, (intptr_t)stringProtoFuncSup, (intptr_t)0 },
-   { "fontcolor", DontEnum|Function, (intptr_t)stringProtoFuncFontcolor, (intptr_t)1 },
-   { "fontsize", DontEnum|Function, (intptr_t)stringProtoFuncFontsize, (intptr_t)1 },
-   { "anchor", DontEnum|Function, (intptr_t)stringProtoFuncAnchor, (intptr_t)1 },
-   { "link", DontEnum|Function, (intptr_t)stringProtoFuncLink, (intptr_t)1 },
-   { "trim", DontEnum|Function, (intptr_t)stringProtoFuncTrim, (intptr_t)0 },
-   { "trimLeft", DontEnum|Function, (intptr_t)stringProtoFuncTrimLeft, (intptr_t)0 },
-   { "trimRight", DontEnum|Function, (intptr_t)stringProtoFuncTrimRight, (intptr_t)0 },
-   { 0, 0, 0, 0 }
-};
-
-extern JSC_CONST_HASHTABLE HashTable stringTable =
-    { 133, 127, stringTableValues, 0 };
-} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
index d7f1f85386..58403d3cc7 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
@@ -1,9 +1,11 @@
 namespace WebCore {
-extern const char htmlUserAgentStyleSheet[8729];
+extern const char htmlUserAgentStyleSheet[9303];
 extern const char quirksUserAgentStyleSheet[359];
-extern const char svgUserAgentStyleSheet[358];
-extern const char sourceUserAgentStyleSheet[2004];
+extern const char svgUserAgentStyleSheet[350];
+extern const char sourceUserAgentStyleSheet[2016];
 extern const char wmlUserAgentStyleSheet[3039];
-extern const char mediaControlsUserAgentStyleSheet[2582];
-extern const char mediaControlsQtUserAgentStyleSheet[2249];
+extern const char mediaControlsUserAgentStyleSheet[2813];
+extern const char mediaControlsQtUserAgentStyleSheet[2653];
+extern const char themeQtNoListboxesUserAgentStyleSheet[180];
+extern const char themeQtMaemo5UserAgentStyleSheet[1314];
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
index 7a18470677..0220fb7453 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
@@ -1,5 +1,5 @@
 namespace WebCore {
-extern const char htmlUserAgentStyleSheet[8729] = {
+extern const char htmlUserAgentStyleSheet[9303] = {
     110, 97, 109, 101, 115, 112, 97, 99, 101, 32, 34, 104, 116, 116, 112, 58,
     47, 47, 119, 119, 119, 46, 119, 51, 46, 111, 114, 103, 47, 49, 57, 57,
     57, 47, 120, 104, 116, 109, 108, 34, 59, 32, 104, 116, 109, 108, 32, 123,
@@ -21,531 +21,567 @@ extern const char htmlUserAgentStyleSheet[8729] = {
     100, 105, 118, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98,
     108, 111, 99, 107, 32, 125, 32, 108, 97, 121, 101, 114, 32, 123, 32, 100,
     105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 32, 125, 32,
-    110, 97, 118, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98,
-    108, 111, 99, 107, 32, 125, 32, 109, 97, 114, 113, 117, 101, 101, 32, 123,
-    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101,
-    45, 98, 108, 111, 99, 107, 59, 32, 111, 118, 101, 114, 102, 108, 111, 119,
-    58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 109, 97, 114, 113, 117, 101,
-    101, 32, 125, 32, 97, 100, 100, 114, 101, 115, 115, 32, 123, 32, 100, 105,
-    115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 32, 125, 32, 98,
-    108, 111, 99, 107, 113, 117, 111, 116, 101, 32, 123, 32, 100, 105, 115, 112,
-    108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 109, 97, 114, 103,
-    105, 110, 58, 32, 49, 95, 95, 113, 101, 109, 32, 52, 48, 112, 120, 32,
-    49, 101, 109, 32, 52, 48, 112, 120, 32, 125, 32, 113, 32, 123, 32, 100,
-    105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101, 32, 125,
-    32, 113, 58, 98, 101, 102, 111, 114, 101, 32, 123, 32, 99, 111, 110, 116,
-    101, 110, 116, 58, 32, 39, 34, 39, 32, 125, 32, 113, 58, 97, 102, 116,
-    101, 114, 32, 123, 32, 99, 111, 110, 116, 101, 110, 116, 58, 32, 39, 34,
-    39, 32, 125, 32, 99, 101, 110, 116, 101, 114, 32, 123, 32, 100, 105, 115,
-    112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 116, 101, 120,
-    116, 45, 97, 108, 105, 103, 110, 58, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 99, 101, 110, 116, 101, 114, 32, 125, 32, 104, 114, 32, 123, 32, 100,
-    105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 109,
-    97, 114, 103, 105, 110, 58, 32, 48, 46, 53, 101, 109, 32, 97, 117, 116,
-    111, 59, 32, 98, 111, 114, 100, 101, 114, 45, 115, 116, 121, 108, 101, 58,
-    32, 105, 110, 115, 101, 116, 59, 32, 98, 111, 114, 100, 101, 114, 45, 119,
-    105, 100, 116, 104, 58, 32, 49, 112, 120, 32, 125, 32, 109, 97, 112, 32,
+    97, 114, 116, 105, 99, 108, 101, 44, 32, 97, 115, 105, 100, 101, 44, 32,
+    102, 111, 111, 116, 101, 114, 44, 32, 104, 101, 97, 100, 101, 114, 44, 32,
+    104, 103, 114, 111, 117, 112, 44, 32, 110, 97, 118, 44, 32, 115, 101, 99,
+    116, 105, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    98, 108, 111, 99, 107, 32, 125, 32, 109, 97, 114, 113, 117, 101, 101, 32,
     123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110,
-    101, 32, 125, 32, 104, 49, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
-    58, 32, 98, 108, 111, 99, 107, 59, 32, 102, 111, 110, 116, 45, 115, 105,
-    122, 101, 58, 32, 50, 101, 109, 59, 32, 109, 97, 114, 103, 105, 110, 58,
-    32, 46, 54, 55, 95, 95, 113, 101, 109, 32, 48, 32, 46, 54, 55, 101,
-    109, 32, 48, 59, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116,
-    58, 32, 98, 111, 108, 100, 32, 125, 32, 104, 50, 32, 123, 32, 100, 105,
-    115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 102, 111,
-    110, 116, 45, 115, 105, 122, 101, 58, 32, 49, 46, 53, 101, 109, 59, 32,
-    109, 97, 114, 103, 105, 110, 58, 32, 46, 56, 51, 95, 95, 113, 101, 109,
-    32, 48, 32, 46, 56, 51, 101, 109, 32, 48, 59, 32, 102, 111, 110, 116,
-    45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 32, 125, 32,
-    104, 51, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108,
-    111, 99, 107, 59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32,
-    49, 46, 49, 55, 101, 109, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32,
-    49, 95, 95, 113, 101, 109, 32, 48, 32, 49, 101, 109, 32, 48, 59, 32,
-    102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108,
-    100, 32, 125, 32, 104, 52, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
-    58, 32, 98, 108, 111, 99, 107, 59, 32, 109, 97, 114, 103, 105, 110, 58,
-    32, 49, 46, 51, 51, 95, 95, 113, 101, 109, 32, 48, 32, 49, 46, 51,
-    51, 101, 109, 32, 48, 59, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103,
-    104, 116, 58, 32, 98, 111, 108, 100, 32, 125, 32, 104, 53, 32, 123, 32,
+    101, 45, 98, 108, 111, 99, 107, 59, 32, 111, 118, 101, 114, 102, 108, 111,
+    119, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 109, 97, 114, 113, 117,
+    101, 101, 32, 125, 32, 97, 100, 100, 114, 101, 115, 115, 32, 123, 32, 100,
+    105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 32, 125, 32,
+    98, 108, 111, 99, 107, 113, 117, 111, 116, 101, 32, 123, 32, 100, 105, 115,
+    112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 109, 97, 114,
+    103, 105, 110, 58, 32, 49, 95, 95, 113, 101, 109, 32, 52, 48, 112, 120,
+    32, 49, 101, 109, 32, 52, 48, 112, 120, 32, 125, 32, 113, 32, 123, 32,
+    100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101, 32,
+    125, 32, 113, 58, 98, 101, 102, 111, 114, 101, 32, 123, 32, 99, 111, 110,
+    116, 101, 110, 116, 58, 32, 39, 34, 39, 32, 125, 32, 113, 58, 97, 102,
+    116, 101, 114, 32, 123, 32, 99, 111, 110, 116, 101, 110, 116, 58, 32, 39,
+    34, 39, 32, 125, 32, 99, 101, 110, 116, 101, 114, 32, 123, 32, 100, 105,
+    115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 116, 101,
+    120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 99, 101, 110, 116, 101, 114, 32, 125, 32, 104, 114, 32, 123, 32,
     100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32,
-    102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 46, 56, 51, 101, 109,
-    59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 49, 46, 54, 55, 95, 95,
-    113, 101, 109, 32, 48, 32, 49, 46, 54, 55, 101, 109, 32, 48, 59, 32,
-    102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108,
-    100, 32, 125, 32, 104, 54, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
-    58, 32, 98, 108, 111, 99, 107, 59, 32, 102, 111, 110, 116, 45, 115, 105,
-    122, 101, 58, 32, 46, 54, 55, 101, 109, 59, 32, 109, 97, 114, 103, 105,
-    110, 58, 32, 50, 46, 51, 51, 95, 95, 113, 101, 109, 32, 48, 32, 50,
-    46, 51, 51, 101, 109, 32, 48, 59, 32, 102, 111, 110, 116, 45, 119, 101,
-    105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 32, 125, 32, 116, 97, 98,
-    108, 101, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 116, 97,
-    98, 108, 101, 59, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108, 108,
-    97, 112, 115, 101, 58, 32, 115, 101, 112, 97, 114, 97, 116, 101, 59, 32,
-    98, 111, 114, 100, 101, 114, 45, 115, 112, 97, 99, 105, 110, 103, 58, 32,
-    50, 112, 120, 59, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108, 111,
-    114, 58, 32, 103, 114, 97, 121, 32, 125, 32, 116, 104, 101, 97, 100, 32,
-    123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 116, 97, 98, 108, 101,
-    45, 104, 101, 97, 100, 101, 114, 45, 103, 114, 111, 117, 112, 59, 32, 118,
-    101, 114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 109,
-    105, 100, 100, 108, 101, 59, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111,
-    108, 111, 114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32, 116,
-    98, 111, 100, 121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
-    116, 97, 98, 108, 101, 45, 114, 111, 119, 45, 103, 114, 111, 117, 112, 59,
-    32, 118, 101, 114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58,
-    32, 109, 105, 100, 100, 108, 101, 59, 32, 98, 111, 114, 100, 101, 114, 45,
-    99, 111, 108, 111, 114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125,
-    32, 116, 102, 111, 111, 116, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
-    58, 32, 116, 97, 98, 108, 101, 45, 102, 111, 111, 116, 101, 114, 45, 103,
-    114, 111, 117, 112, 59, 32, 118, 101, 114, 116, 105, 99, 97, 108, 45, 97,
-    108, 105, 103, 110, 58, 32, 109, 105, 100, 100, 108, 101, 59, 32, 98, 111,
-    114, 100, 101, 114, 45, 99, 111, 108, 111, 114, 58, 32, 105, 110, 104, 101,
-    114, 105, 116, 32, 125, 32, 116, 97, 98, 108, 101, 32, 62, 32, 116, 114,
-    32, 123, 32, 118, 101, 114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103,
-    110, 58, 32, 109, 105, 100, 100, 108, 101, 59, 32, 125, 32, 99, 111, 108,
+    109, 97, 114, 103, 105, 110, 58, 32, 48, 46, 53, 101, 109, 32, 97, 117,
+    116, 111, 59, 32, 98, 111, 114, 100, 101, 114, 45, 115, 116, 121, 108, 101,
+    58, 32, 105, 110, 115, 101, 116, 59, 32, 98, 111, 114, 100, 101, 114, 45,
+    119, 105, 100, 116, 104, 58, 32, 49, 112, 120, 32, 125, 32, 109, 97, 112,
+    32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105,
+    110, 101, 32, 125, 32, 104, 49, 32, 123, 32, 100, 105, 115, 112, 108, 97,
+    121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 102, 111, 110, 116, 45, 115,
+    105, 122, 101, 58, 32, 50, 101, 109, 59, 32, 109, 97, 114, 103, 105, 110,
+    58, 32, 46, 54, 55, 95, 95, 113, 101, 109, 32, 48, 32, 46, 54, 55,
+    101, 109, 32, 48, 59, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104,
+    116, 58, 32, 98, 111, 108, 100, 32, 125, 32, 104, 50, 32, 123, 32, 100,
+    105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 102,
+    111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 49, 46, 53, 101, 109, 59,
+    32, 109, 97, 114, 103, 105, 110, 58, 32, 46, 56, 51, 95, 95, 113, 101,
+    109, 32, 48, 32, 46, 56, 51, 101, 109, 32, 48, 59, 32, 102, 111, 110,
+    116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 32, 125,
+    32, 104, 51, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98,
+    108, 111, 99, 107, 59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58,
+    32, 49, 46, 49, 55, 101, 109, 59, 32, 109, 97, 114, 103, 105, 110, 58,
+    32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 49, 101, 109, 32, 48, 59,
+    32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111,
+    108, 100, 32, 125, 32, 104, 52, 32, 123, 32, 100, 105, 115, 112, 108, 97,
+    121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 109, 97, 114, 103, 105, 110,
+    58, 32, 49, 46, 51, 51, 95, 95, 113, 101, 109, 32, 48, 32, 49, 46,
+    51, 51, 101, 109, 32, 48, 59, 32, 102, 111, 110, 116, 45, 119, 101, 105,
+    103, 104, 116, 58, 32, 98, 111, 108, 100, 32, 125, 32, 104, 53, 32, 123,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59,
+    32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 46, 56, 51, 101,
+    109, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 49, 46, 54, 55, 95,
+    95, 113, 101, 109, 32, 48, 32, 49, 46, 54, 55, 101, 109, 32, 48, 59,
+    32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111,
+    108, 100, 32, 125, 32, 104, 54, 32, 123, 32, 100, 105, 115, 112, 108, 97,
+    121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 102, 111, 110, 116, 45, 115,
+    105, 122, 101, 58, 32, 46, 54, 55, 101, 109, 59, 32, 109, 97, 114, 103,
+    105, 110, 58, 32, 50, 46, 51, 51, 95, 95, 113, 101, 109, 32, 48, 32,
+    50, 46, 51, 51, 101, 109, 32, 48, 59, 32, 102, 111, 110, 116, 45, 119,
+    101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 32, 125, 32, 116, 97,
+    98, 108, 101, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 116,
+    97, 98, 108, 101, 59, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108,
+    108, 97, 112, 115, 101, 58, 32, 115, 101, 112, 97, 114, 97, 116, 101, 59,
+    32, 98, 111, 114, 100, 101, 114, 45, 115, 112, 97, 99, 105, 110, 103, 58,
+    32, 50, 112, 120, 59, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108,
+    111, 114, 58, 32, 103, 114, 97, 121, 32, 125, 32, 116, 104, 101, 97, 100,
     32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 116, 97, 98, 108,
-    101, 45, 99, 111, 108, 117, 109, 110, 32, 125, 32, 99, 111, 108, 103, 114,
-    111, 117, 112, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 116,
-    97, 98, 108, 101, 45, 99, 111, 108, 117, 109, 110, 45, 103, 114, 111, 117,
-    112, 32, 125, 32, 116, 114, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
-    58, 32, 116, 97, 98, 108, 101, 45, 114, 111, 119, 59, 32, 118, 101, 114,
+    101, 45, 104, 101, 97, 100, 101, 114, 45, 103, 114, 111, 117, 112, 59, 32,
+    118, 101, 114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32,
+    109, 105, 100, 100, 108, 101, 59, 32, 98, 111, 114, 100, 101, 114, 45, 99,
+    111, 108, 111, 114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32,
+    116, 98, 111, 100, 121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58,
+    32, 116, 97, 98, 108, 101, 45, 114, 111, 119, 45, 103, 114, 111, 117, 112,
+    59, 32, 118, 101, 114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110,
+    58, 32, 109, 105, 100, 100, 108, 101, 59, 32, 98, 111, 114, 100, 101, 114,
+    45, 99, 111, 108, 111, 114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32,
+    125, 32, 116, 102, 111, 111, 116, 32, 123, 32, 100, 105, 115, 112, 108, 97,
+    121, 58, 32, 116, 97, 98, 108, 101, 45, 102, 111, 111, 116, 101, 114, 45,
+    103, 114, 111, 117, 112, 59, 32, 118, 101, 114, 116, 105, 99, 97, 108, 45,
+    97, 108, 105, 103, 110, 58, 32, 109, 105, 100, 100, 108, 101, 59, 32, 98,
+    111, 114, 100, 101, 114, 45, 99, 111, 108, 111, 114, 58, 32, 105, 110, 104,
+    101, 114, 105, 116, 32, 125, 32, 116, 97, 98, 108, 101, 32, 62, 32, 116,
+    114, 32, 123, 32, 118, 101, 114, 116, 105, 99, 97, 108, 45, 97, 108, 105,
+    103, 110, 58, 32, 109, 105, 100, 100, 108, 101, 59, 32, 125, 32, 99, 111,
+    108, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 116, 97, 98,
+    108, 101, 45, 99, 111, 108, 117, 109, 110, 32, 125, 32, 99, 111, 108, 103,
+    114, 111, 117, 112, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    116, 97, 98, 108, 101, 45, 99, 111, 108, 117, 109, 110, 45, 103, 114, 111,
+    117, 112, 32, 125, 32, 116, 114, 32, 123, 32, 100, 105, 115, 112, 108, 97,
+    121, 58, 32, 116, 97, 98, 108, 101, 45, 114, 111, 119, 59, 32, 118, 101,
+    114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 105, 110,
+    104, 101, 114, 105, 116, 59, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111,
+    108, 111, 114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32, 116,
+    100, 44, 32, 116, 104, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58,
+    32, 116, 97, 98, 108, 101, 45, 99, 101, 108, 108, 59, 32, 118, 101, 114,
     116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 105, 110, 104,
-    101, 114, 105, 116, 59, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108,
-    111, 114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32, 116, 100,
-    44, 32, 116, 104, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
-    116, 97, 98, 108, 101, 45, 99, 101, 108, 108, 59, 32, 118, 101, 114, 116,
-    105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 105, 110, 104, 101,
-    114, 105, 116, 32, 125, 32, 116, 104, 32, 123, 32, 102, 111, 110, 116, 45,
-    119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 32, 125, 32, 99,
-    97, 112, 116, 105, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
-    58, 32, 116, 97, 98, 108, 101, 45, 99, 97, 112, 116, 105, 111, 110, 59,
-    32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 99, 101, 110, 116, 101, 114, 32, 125, 32, 117, 108,
-    44, 32, 109, 101, 110, 117, 44, 32, 100, 105, 114, 32, 123, 32, 100, 105,
-    115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 108, 105,
-    115, 116, 45, 115, 116, 121, 108, 101, 45, 116, 121, 112, 101, 58, 32, 100,
-    105, 115, 99, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 49, 95, 95,
-    113, 101, 109, 32, 48, 32, 49, 101, 109, 32, 48, 59, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 112, 97, 100, 100, 105, 110, 103, 45, 115, 116, 97,
-    114, 116, 58, 32, 52, 48, 112, 120, 32, 125, 32, 111, 108, 32, 123, 32,
-    100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32,
-    108, 105, 115, 116, 45, 115, 116, 121, 108, 101, 45, 116, 121, 112, 101, 58,
-    32, 100, 101, 99, 105, 109, 97, 108, 59, 32, 109, 97, 114, 103, 105, 110,
-    58, 32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 49, 101, 109, 32, 48,
-    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 112, 97, 100, 100, 105, 110,
-    103, 45, 115, 116, 97, 114, 116, 58, 32, 52, 48, 112, 120, 32, 125, 32,
-    108, 105, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 108, 105,
-    115, 116, 45, 105, 116, 101, 109, 32, 125, 32, 117, 108, 32, 117, 108, 44,
-    32, 111, 108, 32, 117, 108, 32, 123, 32, 108, 105, 115, 116, 45, 115, 116,
-    121, 108, 101, 45, 116, 121, 112, 101, 58, 32, 99, 105, 114, 99, 108, 101,
-    32, 125, 32, 111, 108, 32, 111, 108, 32, 117, 108, 44, 32, 111, 108, 32,
-    117, 108, 32, 117, 108, 44, 32, 117, 108, 32, 111, 108, 32, 117, 108, 44,
-    32, 117, 108, 32, 117, 108, 32, 117, 108, 32, 123, 32, 108, 105, 115, 116,
-    45, 115, 116, 121, 108, 101, 45, 116, 121, 112, 101, 58, 32, 115, 113, 117,
-    97, 114, 101, 32, 125, 32, 100, 100, 32, 123, 32, 100, 105, 115, 112, 108,
-    97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 109, 97, 114, 103, 105, 110, 45, 115, 116, 97, 114, 116, 58,
-    32, 52, 48, 112, 120, 32, 125, 32, 100, 108, 32, 123, 32, 100, 105, 115,
+    101, 114, 105, 116, 32, 125, 32, 116, 104, 32, 123, 32, 102, 111, 110, 116,
+    45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 32, 125, 32,
+    99, 97, 112, 116, 105, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97,
+    121, 58, 32, 116, 97, 98, 108, 101, 45, 99, 97, 112, 116, 105, 111, 110,
+    59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 45, 119,
+    101, 98, 107, 105, 116, 45, 99, 101, 110, 116, 101, 114, 32, 125, 32, 117,
+    108, 44, 32, 109, 101, 110, 117, 44, 32, 100, 105, 114, 32, 123, 32, 100,
+    105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 108,
+    105, 115, 116, 45, 115, 116, 121, 108, 101, 45, 116, 121, 112, 101, 58, 32,
+    100, 105, 115, 99, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 49, 95,
+    95, 113, 101, 109, 32, 48, 32, 49, 101, 109, 32, 48, 59, 32, 45, 119,
+    101, 98, 107, 105, 116, 45, 112, 97, 100, 100, 105, 110, 103, 45, 115, 116,
+    97, 114, 116, 58, 32, 52, 48, 112, 120, 32, 125, 32, 111, 108, 32, 123,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59,
+    32, 108, 105, 115, 116, 45, 115, 116, 121, 108, 101, 45, 116, 121, 112, 101,
+    58, 32, 100, 101, 99, 105, 109, 97, 108, 59, 32, 109, 97, 114, 103, 105,
+    110, 58, 32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 49, 101, 109, 32,
+    48, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 112, 97, 100, 100, 105,
+    110, 103, 45, 115, 116, 97, 114, 116, 58, 32, 52, 48, 112, 120, 32, 125,
+    32, 108, 105, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 108,
+    105, 115, 116, 45, 105, 116, 101, 109, 32, 125, 32, 117, 108, 32, 117, 108,
+    44, 32, 111, 108, 32, 117, 108, 32, 123, 32, 108, 105, 115, 116, 45, 115,
+    116, 121, 108, 101, 45, 116, 121, 112, 101, 58, 32, 99, 105, 114, 99, 108,
+    101, 32, 125, 32, 111, 108, 32, 111, 108, 32, 117, 108, 44, 32, 111, 108,
+    32, 117, 108, 32, 117, 108, 44, 32, 117, 108, 32, 111, 108, 32, 117, 108,
+    44, 32, 117, 108, 32, 117, 108, 32, 117, 108, 32, 123, 32, 108, 105, 115,
+    116, 45, 115, 116, 121, 108, 101, 45, 116, 121, 112, 101, 58, 32, 115, 113,
+    117, 97, 114, 101, 32, 125, 32, 100, 100, 32, 123, 32, 100, 105, 115, 112,
+    108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 109, 97, 114, 103, 105, 110, 45, 115, 116, 97, 114, 116,
+    58, 32, 52, 48, 112, 120, 32, 125, 32, 100, 108, 32, 123, 32, 100, 105,
+    115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 109, 97,
+    114, 103, 105, 110, 58, 32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 49,
+    101, 109, 32, 48, 32, 125, 32, 100, 116, 32, 123, 32, 100, 105, 115, 112,
+    108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 32, 125, 32, 111, 108, 32,
+    117, 108, 44, 32, 117, 108, 32, 111, 108, 44, 32, 117, 108, 32, 117, 108,
+    44, 32, 111, 108, 32, 111, 108, 32, 123, 32, 109, 97, 114, 103, 105, 110,
+    45, 116, 111, 112, 58, 32, 48, 59, 32, 109, 97, 114, 103, 105, 110, 45,
+    98, 111, 116, 116, 111, 109, 58, 32, 48, 32, 125, 32, 102, 111, 114, 109,
+    32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99,
+    107, 59, 32, 109, 97, 114, 103, 105, 110, 45, 116, 111, 112, 58, 32, 48,
+    95, 95, 113, 101, 109, 32, 125, 32, 108, 97, 98, 101, 108, 32, 123, 32,
+    99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97, 117, 108, 116, 59,
+    32, 125, 32, 108, 101, 103, 101, 110, 100, 32, 123, 32, 100, 105, 115, 112,
+    108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 112, 97, 100, 100,
+    105, 110, 103, 45, 108, 101, 102, 116, 58, 32, 50, 112, 120, 59, 32, 112,
+    97, 100, 100, 105, 110, 103, 45, 114, 105, 103, 104, 116, 58, 32, 50, 112,
+    120, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 110, 111, 110, 101, 32,
+    125, 32, 102, 105, 101, 108, 100, 115, 101, 116, 32, 123, 32, 100, 105, 115,
     112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 109, 97, 114,
-    103, 105, 110, 58, 32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 49, 101,
-    109, 32, 48, 32, 125, 32, 100, 116, 32, 123, 32, 100, 105, 115, 112, 108,
-    97, 121, 58, 32, 98, 108, 111, 99, 107, 32, 125, 32, 111, 108, 32, 117,
-    108, 44, 32, 117, 108, 32, 111, 108, 44, 32, 117, 108, 32, 117, 108, 44,
-    32, 111, 108, 32, 111, 108, 32, 123, 32, 109, 97, 114, 103, 105, 110, 45,
-    116, 111, 112, 58, 32, 48, 59, 32, 109, 97, 114, 103, 105, 110, 45, 98,
-    111, 116, 116, 111, 109, 58, 32, 48, 32, 125, 32, 102, 111, 114, 109, 32,
-    123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107,
-    59, 32, 109, 97, 114, 103, 105, 110, 45, 116, 111, 112, 58, 32, 48, 95,
-    95, 113, 101, 109, 32, 125, 32, 108, 97, 98, 101, 108, 32, 123, 32, 99,
-    117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97, 117, 108, 116, 59, 32,
-    125, 32, 108, 101, 103, 101, 110, 100, 32, 123, 32, 100, 105, 115, 112, 108,
-    97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 112, 97, 100, 100, 105,
-    110, 103, 45, 108, 101, 102, 116, 58, 32, 50, 112, 120, 59, 32, 112, 97,
-    100, 100, 105, 110, 103, 45, 114, 105, 103, 104, 116, 58, 32, 50, 112, 120,
-    59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 110, 111, 110, 101, 32, 125,
-    32, 102, 105, 101, 108, 100, 115, 101, 116, 32, 123, 32, 100, 105, 115, 112,
-    108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 109, 97, 114, 103,
-    105, 110, 45, 108, 101, 102, 116, 58, 32, 50, 112, 120, 59, 32, 109, 97,
-    114, 103, 105, 110, 45, 114, 105, 103, 104, 116, 58, 32, 50, 112, 120, 59,
-    32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 48, 46, 51, 53, 101, 109,
-    32, 48, 46, 55, 53, 101, 109, 32, 48, 46, 54, 50, 53, 101, 109, 59,
-    32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 103, 114, 111,
-    111, 118, 101, 32, 84, 104, 114, 101, 101, 68, 70, 97, 99, 101, 32, 125,
-    32, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 98, 117,
-    116, 116, 111, 110, 59, 32, 125, 32, 105, 110, 112, 117, 116, 44, 32, 116,
-    101, 120, 116, 97, 114, 101, 97, 44, 32, 107, 101, 121, 103, 101, 110, 44,
-    32, 115, 101, 108, 101, 99, 116, 44, 32, 98, 117, 116, 116, 111, 110, 44,
-    32, 105, 115, 105, 110, 100, 101, 120, 44, 32, 100, 97, 116, 97, 103, 114,
-    105, 100, 32, 123, 32, 109, 97, 114, 103, 105, 110, 58, 32, 48, 95, 95,
-    113, 101, 109, 59, 32, 102, 111, 110, 116, 58, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 115, 109, 97, 108, 108, 45, 99, 111, 110, 116, 114, 111, 108,
-    59, 32, 99, 111, 108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108,
-    59, 32, 108, 101, 116, 116, 101, 114, 45, 115, 112, 97, 99, 105, 110, 103,
-    58, 32, 110, 111, 114, 109, 97, 108, 59, 32, 119, 111, 114, 100, 45, 115,
-    112, 97, 99, 105, 110, 103, 58, 32, 110, 111, 114, 109, 97, 108, 59, 32,
-    108, 105, 110, 101, 45, 104, 101, 105, 103, 104, 116, 58, 32, 110, 111, 114,
-    109, 97, 108, 59, 32, 116, 101, 120, 116, 45, 116, 114, 97, 110, 115, 102,
-    111, 114, 109, 58, 32, 110, 111, 110, 101, 59, 32, 116, 101, 120, 116, 45,
-    105, 110, 100, 101, 110, 116, 58, 32, 48, 59, 32, 116, 101, 120, 116, 45,
-    115, 104, 97, 100, 111, 119, 58, 32, 110, 111, 110, 101, 59, 32, 100, 105,
-    115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101, 45, 98, 108,
-    111, 99, 107, 59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58,
-    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 117, 116, 111, 59, 32, 125,
-    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100,
-    100, 101, 110, 34, 93, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58,
-    32, 110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 44, 32, 105,
-    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 112, 97, 115, 115, 119,
-    111, 114, 100, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 44, 32, 105, 115, 105,
-    110, 100, 101, 120, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
-    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 116, 101, 120, 116, 102,
-    105, 101, 108, 100, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 49,
-    112, 120, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99,
-    111, 108, 111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32, 98, 111, 114,
-    100, 101, 114, 58, 32, 50, 112, 120, 32, 105, 110, 115, 101, 116, 59, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101,
-    114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 45,
-    119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108, 101,
-    99, 116, 58, 32, 116, 101, 120, 116, 59, 32, 99, 117, 114, 115, 111, 114,
-    58, 32, 97, 117, 116, 111, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 32, 123,
-    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
-    110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102, 105, 101, 108, 100,
-    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105,
-    122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120,
-    59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    115, 101, 97, 114, 99, 104, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105,
-    116, 45, 115, 101, 97, 114, 99, 104, 45, 99, 97, 110, 99, 101, 108, 45,
-    98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 101, 97,
-    114, 99, 104, 102, 105, 101, 108, 100, 45, 99, 97, 110, 99, 101, 108, 45,
-    98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58,
-    32, 105, 110, 108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125,
-    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97,
-    114, 99, 104, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115,
-    101, 97, 114, 99, 104, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110,
-    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97,
-    114, 97, 110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102, 105, 101,
-    108, 100, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 59, 32, 100,
+    103, 105, 110, 45, 108, 101, 102, 116, 58, 32, 50, 112, 120, 59, 32, 109,
+    97, 114, 103, 105, 110, 45, 114, 105, 103, 104, 116, 58, 32, 50, 112, 120,
+    59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 48, 46, 51, 53, 101,
+    109, 32, 48, 46, 55, 53, 101, 109, 32, 48, 46, 54, 50, 53, 101, 109,
+    59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 103, 114,
+    111, 111, 118, 101, 32, 84, 104, 114, 101, 101, 68, 70, 97, 99, 101, 32,
+    125, 32, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 98,
+    117, 116, 116, 111, 110, 59, 32, 125, 32, 105, 110, 112, 117, 116, 44, 32,
+    116, 101, 120, 116, 97, 114, 101, 97, 44, 32, 107, 101, 121, 103, 101, 110,
+    44, 32, 115, 101, 108, 101, 99, 116, 44, 32, 98, 117, 116, 116, 111, 110,
+    44, 32, 105, 115, 105, 110, 100, 101, 120, 44, 32, 100, 97, 116, 97, 103,
+    114, 105, 100, 32, 123, 32, 109, 97, 114, 103, 105, 110, 58, 32, 48, 95,
+    95, 113, 101, 109, 59, 32, 102, 111, 110, 116, 58, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 115, 109, 97, 108, 108, 45, 99, 111, 110, 116, 114, 111,
+    108, 59, 32, 99, 111, 108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97,
+    108, 59, 32, 108, 101, 116, 116, 101, 114, 45, 115, 112, 97, 99, 105, 110,
+    103, 58, 32, 110, 111, 114, 109, 97, 108, 59, 32, 119, 111, 114, 100, 45,
+    115, 112, 97, 99, 105, 110, 103, 58, 32, 110, 111, 114, 109, 97, 108, 59,
+    32, 108, 105, 110, 101, 45, 104, 101, 105, 103, 104, 116, 58, 32, 110, 111,
+    114, 109, 97, 108, 59, 32, 116, 101, 120, 116, 45, 116, 114, 97, 110, 115,
+    102, 111, 114, 109, 58, 32, 110, 111, 110, 101, 59, 32, 116, 101, 120, 116,
+    45, 105, 110, 100, 101, 110, 116, 58, 32, 48, 59, 32, 116, 101, 120, 116,
+    45, 115, 104, 97, 100, 111, 119, 58, 32, 110, 111, 110, 101, 59, 32, 100,
     105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101, 45, 98,
-    108, 111, 99, 107, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121,
-    112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 58, 58, 45, 119,
-    101, 98, 107, 105, 116, 45, 115, 101, 97, 114, 99, 104, 45, 114, 101, 115,
-    117, 108, 116, 115, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 32,
+    108, 111, 99, 107, 59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110,
+    58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 117, 116, 111, 59, 32,
+    125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105,
+    100, 100, 101, 110, 34, 93, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 44, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 112, 97, 115, 115,
+    119, 111, 114, 100, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 44, 32, 105, 115,
+    105, 110, 100, 101, 120, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45,
+    97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 116, 101, 120, 116,
+    102, 105, 101, 108, 100, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32,
+    49, 112, 120, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45,
+    99, 111, 108, 111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32, 98, 111,
+    114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 105, 110, 115, 101, 116, 59,
+    32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114, 100,
+    101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59, 32,
+    45, 119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108,
+    101, 99, 116, 58, 32, 116, 101, 120, 116, 59, 32, 99, 117, 114, 115, 111,
+    114, 58, 32, 97, 117, 116, 111, 59, 32, 125, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 32,
     123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114,
     97, 110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102, 105, 101, 108,
-    100, 45, 114, 101, 115, 117, 108, 116, 115, 45, 100, 101, 99, 111, 114, 97,
-    116, 105, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105,
+    100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115,
+    105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111,
+    120, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
+    34, 115, 101, 97, 114, 99, 104, 34, 93, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 115, 101, 97, 114, 99, 104, 45, 99, 97, 110, 99, 101, 108,
+    45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 101,
+    97, 114, 99, 104, 102, 105, 101, 108, 100, 45, 99, 97, 110, 99, 101, 108,
+    45, 98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 105, 110, 108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32,
+    125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101,
+    97, 114, 99, 104, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
+    115, 101, 97, 114, 99, 104, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111,
+    110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102, 105,
+    101, 108, 100, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 59, 32,
+    100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101, 45,
+    98, 108, 111, 99, 107, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116,
+    121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 58, 58, 45,
+    119, 101, 98, 107, 105, 116, 45, 115, 101, 97, 114, 99, 104, 45, 114, 101,
+    115, 117, 108, 116, 115, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110,
+    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97,
+    114, 97, 110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102, 105, 101,
+    108, 100, 45, 114, 101, 115, 117, 108, 116, 115, 45, 100, 101, 99, 111, 114,
+    97, 116, 105, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    105, 110, 108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114,
+    99, 104, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115, 101,
+    97, 114, 99, 104, 45, 114, 101, 115, 117, 108, 116, 115, 45, 98, 117, 116,
+    116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112,
+    112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104,
+    102, 105, 101, 108, 100, 45, 114, 101, 115, 117, 108, 116, 115, 45, 98, 117,
+    116, 116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105,
     110, 108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 105,
-    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99,
-    104, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115, 101, 97,
-    114, 99, 104, 45, 114, 101, 115, 117, 108, 116, 115, 45, 98, 117, 116, 116,
-    111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112,
-    101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102,
-    105, 101, 108, 100, 45, 114, 101, 115, 117, 108, 116, 115, 45, 98, 117, 116,
-    116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110,
-    108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 105, 110,
-    112, 117, 116, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 105, 110, 112,
-    117, 116, 45, 108, 105, 115, 116, 45, 98, 117, 116, 116, 111, 110, 32, 123,
-    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
-    110, 99, 101, 58, 32, 108, 105, 115, 116, 45, 98, 117, 116, 116, 111, 110,
-    59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110,
-    101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 116, 101, 120, 116, 97,
-    114, 101, 97, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112,
-    112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 116, 101, 120, 116, 97, 114,
-    101, 97, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99,
-    111, 108, 111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32, 98, 111, 114,
-    100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101,
-    114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 45,
-    119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108, 101,
-    99, 116, 58, 32, 116, 101, 120, 116, 59, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 98, 111, 120, 45, 111, 114, 105, 101, 110, 116, 58, 32, 118, 101,
-    114, 116, 105, 99, 97, 108, 59, 32, 114, 101, 115, 105, 122, 101, 58, 32,
-    97, 117, 116, 111, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117,
-    116, 111, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 50, 112, 120,
-    59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112,
-    114, 101, 45, 119, 114, 97, 112, 59, 32, 119, 111, 114, 100, 45, 119, 114,
-    97, 112, 58, 32, 98, 114, 101, 97, 107, 45, 119, 111, 114, 100, 59, 32,
-    125, 32, 105, 110, 112, 117, 116, 58, 58, 45, 119, 101, 98, 107, 105, 116,
-    45, 105, 110, 112, 117, 116, 45, 112, 108, 97, 99, 101, 104, 111, 108, 100,
-    101, 114, 44, 32, 105, 115, 105, 110, 100, 101, 120, 58, 58, 45, 119, 101,
-    98, 107, 105, 116, 45, 105, 110, 112, 117, 116, 45, 112, 108, 97, 99, 101,
-    104, 111, 108, 100, 101, 114, 44, 32, 116, 101, 120, 116, 97, 114, 101, 97,
+    110, 112, 117, 116, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 105, 110,
+    112, 117, 116, 45, 108, 105, 115, 116, 45, 98, 117, 116, 116, 111, 110, 32,
+    123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114,
+    97, 110, 99, 101, 58, 32, 108, 105, 115, 116, 45, 98, 117, 116, 116, 111,
+    110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105,
+    110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 105, 110, 112, 117,
+    116, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 105, 110, 110, 101, 114,
+    45, 115, 112, 105, 110, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99,
+    101, 58, 32, 105, 110, 110, 101, 114, 45, 115, 112, 105, 110, 45, 98, 117,
+    116, 116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105,
+    110, 108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 105,
+    110, 112, 117, 116, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 111, 117,
+    116, 101, 114, 45, 115, 112, 105, 110, 45, 98, 117, 116, 116, 111, 110, 32,
+    123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114,
+    97, 110, 99, 101, 58, 32, 111, 117, 116, 101, 114, 45, 115, 112, 105, 110,
+    45, 98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 105, 110, 108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32,
+    109, 97, 114, 103, 105, 110, 45, 108, 101, 102, 116, 58, 32, 50, 112, 120,
+    59, 32, 125, 32, 116, 101, 120, 116, 97, 114, 101, 97, 32, 123, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99,
+    101, 58, 32, 116, 101, 120, 116, 97, 114, 101, 97, 59, 32, 98, 97, 99,
+    107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 119,
+    104, 105, 116, 101, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112,
+    120, 32, 115, 111, 108, 105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 114, 116, 108, 45, 111, 114, 100, 101, 114, 105, 110, 103, 58, 32, 108,
+    111, 103, 105, 99, 97, 108, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45,
+    117, 115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32, 116, 101, 120,
+    116, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 111,
+    114, 105, 101, 110, 116, 58, 32, 118, 101, 114, 116, 105, 99, 97, 108, 59,
+    32, 114, 101, 115, 105, 122, 101, 58, 32, 97, 117, 116, 111, 59, 32, 99,
+    117, 114, 115, 111, 114, 58, 32, 97, 117, 116, 111, 59, 32, 112, 97, 100,
+    100, 105, 110, 103, 58, 32, 50, 112, 120, 59, 32, 119, 104, 105, 116, 101,
+    45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101, 45, 119, 114, 97, 112,
+    59, 32, 119, 111, 114, 100, 45, 119, 114, 97, 112, 58, 32, 98, 114, 101,
+    97, 107, 45, 119, 111, 114, 100, 59, 32, 125, 32, 105, 110, 112, 117, 116,
     58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 105, 110, 112, 117, 116, 45,
-    112, 108, 97, 99, 101, 104, 111, 108, 100, 101, 114, 32, 123, 32, 99, 111,
-    108, 111, 114, 58, 32, 100, 97, 114, 107, 71, 114, 97, 121, 59, 32, 125,
-    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 112, 97, 115,
-    115, 119, 111, 114, 100, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 116, 101, 120, 116, 45, 115, 101, 99, 117, 114, 105, 116, 121, 58,
-    32, 100, 105, 115, 99, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116,
-    59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    104, 105, 100, 100, 101, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93, 44, 32, 105,
-    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34,
-    93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
-    97, 114, 97, 110, 99, 101, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59,
-    32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116, 105, 97,
-    108, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111,
-    108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 111,
-    114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 125,
-    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108,
-    101, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
-    120, 45, 97, 108, 105, 103, 110, 58, 32, 98, 97, 115, 101, 108, 105, 110,
-    101, 59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 115,
-    116, 97, 114, 116, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59,
-    32, 125, 32, 105, 110, 112, 117, 116, 58, 45, 119, 101, 98, 107, 105, 116,
-    45, 97, 117, 116, 111, 102, 105, 108, 108, 32, 123, 32, 98, 97, 99, 107,
-    103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 98, 97,
-    99, 107, 103, 114, 111, 117, 110, 100, 45, 105, 109, 97, 103, 101, 58, 110,
-    111, 110, 101, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32,
-    125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97,
-    100, 105, 111, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 32, 123, 32,
-    109, 97, 114, 103, 105, 110, 58, 32, 51, 112, 120, 32, 48, 46, 53, 101,
-    120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116,
-    105, 97, 108, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45,
-    99, 111, 108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32,
-    98, 111, 114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59,
-    32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98,
-    117, 116, 116, 111, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 44, 32, 105,
-    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116,
-    34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    102, 105, 108, 101, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
-    102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116,
-    111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112,
-    101, 97, 114, 97, 110, 99, 101, 58, 32, 112, 117, 115, 104, 45, 98, 117,
-    116, 116, 111, 110, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99,
-    101, 58, 32, 112, 114, 101, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 44, 32, 105,
-    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105,
-    116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
-    34, 114, 101, 115, 101, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 58, 45, 119,
-    101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97,
-    100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110,
-    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97,
-    108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 116, 101,
-    120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114,
-    59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97, 117, 108,
-    116, 59, 32, 99, 111, 108, 111, 114, 58, 32, 66, 117, 116, 116, 111, 110,
-    84, 101, 120, 116, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 50,
-    112, 120, 32, 54, 112, 120, 32, 51, 112, 120, 32, 54, 112, 120, 59, 32,
-    98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 111, 117, 116, 115,
-    101, 116, 32, 66, 117, 116, 116, 111, 110, 70, 97, 99, 101, 59, 32, 98,
-    97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58,
-    32, 66, 117, 116, 116, 111, 110, 70, 97, 99, 101, 59, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58,
-    32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 32, 125, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 110, 103, 101, 34,
-    93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
-    97, 114, 97, 110, 99, 101, 58, 32, 115, 108, 105, 100, 101, 114, 45, 104,
-    111, 114, 105, 122, 111, 110, 116, 97, 108, 59, 32, 112, 97, 100, 100, 105,
-    110, 103, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 111, 114,
-    100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 109, 97,
-    114, 103, 105, 110, 58, 32, 50, 112, 120, 59, 32, 125, 32, 105, 110, 112,
-    117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 110, 103, 101, 34, 93,
-    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115, 108, 105, 100, 101, 114,
-    45, 116, 104, 117, 109, 98, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 108, 105,
-    100, 101, 114, 116, 104, 117, 109, 98, 45, 104, 111, 114, 105, 122, 111, 110,
-    116, 97, 108, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 100, 105, 115, 97,
-    98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 100, 105, 115, 97, 98,
-    108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
-    34, 114, 101, 115, 101, 116, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101,
-    100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102,
-    105, 108, 101, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 58, 58,
-    45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108,
-    111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116,
-    111, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 115, 101, 108,
-    101, 99, 116, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 107, 101,
-    121, 103, 101, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 111,
-    112, 116, 103, 114, 111, 117, 112, 58, 100, 105, 115, 97, 98, 108, 101, 100,
-    44, 32, 111, 112, 116, 105, 111, 110, 58, 100, 105, 115, 97, 98, 108, 101,
-    100, 44, 32, 100, 97, 116, 97, 103, 114, 105, 100, 58, 100, 105, 115, 97,
-    98, 108, 101, 100, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 71, 114,
-    97, 121, 84, 101, 120, 116, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 97, 99,
-    116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 97, 99, 116, 105, 118,
-    101, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114,
-    101, 115, 101, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32, 105,
-    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34,
-    93, 58, 97, 99, 116, 105, 118, 101, 58, 58, 45, 119, 101, 98, 107, 105,
-    116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117,
-    116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58, 97, 99, 116,
-    105, 118, 101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 115, 116, 121,
-    108, 101, 58, 32, 105, 110, 115, 101, 116, 32, 125, 32, 105, 110, 112, 117,
+    112, 108, 97, 99, 101, 104, 111, 108, 100, 101, 114, 44, 32, 105, 115, 105,
+    110, 100, 101, 120, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 105, 110,
+    112, 117, 116, 45, 112, 108, 97, 99, 101, 104, 111, 108, 100, 101, 114, 44,
+    32, 116, 101, 120, 116, 97, 114, 101, 97, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 105, 110, 112, 117, 116, 45, 112, 108, 97, 99, 101, 104, 111,
+    108, 100, 101, 114, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 100, 97,
+    114, 107, 71, 114, 97, 121, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 112, 97, 115, 115, 119, 111, 114, 100, 34, 93,
+    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 116, 101, 120, 116, 45,
+    115, 101, 99, 117, 114, 105, 116, 121, 58, 32, 100, 105, 115, 99, 32, 33,
+    105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32, 125, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100, 100, 101, 110, 34,
+    93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 105,
+    109, 97, 103, 101, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 32, 123, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58,
+    32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 112, 97, 100, 100, 105, 110,
+    103, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 97, 99, 107,
+    103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 105, 110,
+    105, 116, 105, 97, 108, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 105,
+    110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 32, 123, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110,
+    58, 32, 98, 97, 115, 101, 108, 105, 110, 101, 59, 32, 116, 101, 120, 116,
+    45, 97, 108, 105, 103, 110, 58, 32, 115, 116, 97, 114, 116, 32, 33, 105,
+    109, 112, 111, 114, 116, 97, 110, 116, 59, 32, 125, 32, 105, 110, 112, 117,
+    116, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 117, 116, 111, 102, 105,
+    108, 108, 32, 123, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45,
+    99, 111, 108, 111, 114, 58, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110,
+    100, 45, 105, 109, 97, 103, 101, 58, 110, 111, 110, 101, 32, 33, 105, 109,
+    112, 111, 114, 116, 97, 110, 116, 59, 32, 125, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 114, 97, 100, 105, 111, 34, 93, 44, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 99, 104, 101, 99,
+    107, 98, 111, 120, 34, 93, 32, 123, 32, 109, 97, 114, 103, 105, 110, 58,
+    32, 51, 112, 120, 32, 48, 46, 53, 101, 120, 59, 32, 112, 97, 100, 100,
+    105, 110, 103, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 97,
+    99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32,
+    105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 111, 114, 100, 101, 114, 58,
+    32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 105, 110, 112, 117,
     116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93,
-    58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100,
     44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117,
-    98, 109, 105, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105,
-    115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
-    112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 58, 97, 99, 116, 105,
-    118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112,
+    98, 109, 105, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 44, 32, 105, 110, 112,
     117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58,
-    97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 58,
     58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112,
-    108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116,
-    116, 111, 110, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98,
-    108, 101, 100, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 115, 116, 121,
-    108, 101, 58, 32, 111, 117, 116, 115, 101, 116, 32, 125, 32, 97, 114, 101,
-    97, 44, 32, 112, 97, 114, 97, 109, 32, 123, 32, 100, 105, 115, 112, 108,
-    97, 121, 58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116,
-    91, 116, 121, 112, 101, 61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34,
-    93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
-    97, 114, 97, 110, 99, 101, 58, 32, 99, 104, 101, 99, 107, 98, 111, 120,
-    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105,
-    122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120,
-    59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    114, 97, 100, 105, 111, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 114, 97,
-    100, 105, 111, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120,
-    45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45,
-    98, 111, 120, 59, 32, 125, 32, 107, 101, 121, 103, 101, 110, 44, 32, 115,
-    101, 108, 101, 99, 116, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45,
-    97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 110, 117,
-    108, 105, 115, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
+    108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119,
+    101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101,
+    58, 32, 112, 117, 115, 104, 45, 98, 117, 116, 116, 111, 110, 59, 32, 119,
+    104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101, 32,
+    125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117,
+    116, 116, 111, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 44, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34,
+    93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102,
+    105, 108, 101, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102,
+    105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111,
+    110, 44, 32, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 99,
+    101, 110, 116, 101, 114, 59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103,
+    110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 99, 117, 114, 115, 111,
+    114, 58, 32, 100, 101, 102, 97, 117, 108, 116, 59, 32, 99, 111, 108, 111,
+    114, 58, 32, 66, 117, 116, 116, 111, 110, 84, 101, 120, 116, 59, 32, 112,
+    97, 100, 100, 105, 110, 103, 58, 32, 50, 112, 120, 32, 54, 112, 120, 32,
+    51, 112, 120, 32, 54, 112, 120, 59, 32, 98, 111, 114, 100, 101, 114, 58,
+    32, 50, 112, 120, 32, 111, 117, 116, 115, 101, 116, 32, 66, 117, 116, 116,
+    111, 110, 70, 97, 99, 101, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117,
+    110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 66, 117, 116, 116, 111, 110,
+    70, 97, 99, 101, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
     120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114,
-    45, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
-    120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59,
-    32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108,
-    105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 114, 100,
-    101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 53, 112, 120, 59, 32,
-    119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101,
-    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114,
-    100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59,
-    32, 99, 111, 108, 111, 114, 58, 32, 98, 108, 97, 99, 107, 59, 32, 98,
-    97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58,
-    32, 119, 104, 105, 116, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32,
-    100, 101, 102, 97, 117, 108, 116, 59, 32, 125, 32, 115, 101, 108, 101, 99,
-    116, 91, 115, 105, 122, 101, 93, 44, 32, 115, 101, 108, 101, 99, 116, 91,
-    109, 117, 108, 116, 105, 112, 108, 101, 93, 44, 32, 115, 101, 108, 101, 99,
-    116, 91, 115, 105, 122, 101, 93, 91, 109, 117, 108, 116, 105, 112, 108, 101,
-    93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
-    97, 114, 97, 110, 99, 101, 58, 32, 108, 105, 115, 116, 98, 111, 120, 59,
-    32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105,
-    103, 110, 58, 32, 115, 116, 97, 114, 116, 59, 32, 98, 111, 114, 100, 101,
-    114, 58, 32, 49, 112, 120, 32, 105, 110, 115, 101, 116, 32, 103, 114, 97,
-    121, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 114, 100, 101,
-    114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 105, 110, 105, 116, 105, 97,
-    108, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32,
-    105, 110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 115, 101, 108, 101, 99,
-    116, 91, 115, 105, 122, 101, 61, 34, 48, 34, 93, 44, 32, 115, 101, 108,
-    101, 99, 116, 91, 115, 105, 122, 101, 61, 34, 49, 34, 93, 32, 123, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110,
-    99, 101, 58, 32, 109, 101, 110, 117, 108, 105, 115, 116, 59, 32, 45, 119,
-    101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58,
-    32, 99, 101, 110, 116, 101, 114, 59, 32, 98, 111, 114, 100, 101, 114, 58,
-    32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32, 45, 119, 101, 98,
+    45, 98, 111, 120, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 114, 97, 110, 103, 101, 34, 93, 32, 123, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58,
+    32, 115, 108, 105, 100, 101, 114, 45, 104, 111, 114, 105, 122, 111, 110, 116,
+    97, 108, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105,
+    116, 105, 97, 108, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 105, 110,
+    105, 116, 105, 97, 108, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 50,
+    112, 120, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
+    61, 34, 114, 97, 110, 103, 101, 34, 93, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 115, 108, 105, 100, 101, 114, 45, 116, 104, 117, 109, 98, 32,
+    123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114,
+    97, 110, 99, 101, 58, 32, 115, 108, 105, 100, 101, 114, 116, 104, 117, 109,
+    98, 45, 104, 111, 114, 105, 122, 111, 110, 116, 97, 108, 59, 32, 125, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116,
+    111, 110, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105,
+    116, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34,
+    93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117,
+    116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 100,
+    105, 115, 97, 98, 108, 101, 100, 58, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116,
+    116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58, 100, 105, 115, 97,
+    98, 108, 101, 100, 44, 32, 115, 101, 108, 101, 99, 116, 58, 100, 105, 115,
+    97, 98, 108, 101, 100, 44, 32, 107, 101, 121, 103, 101, 110, 58, 100, 105,
+    115, 97, 98, 108, 101, 100, 44, 32, 111, 112, 116, 103, 114, 111, 117, 112,
+    58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 111, 112, 116, 105, 111,
+    110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 100, 97, 116, 97,
+    103, 114, 105, 100, 58, 100, 105, 115, 97, 98, 108, 101, 100, 32, 123, 32,
+    99, 111, 108, 111, 114, 58, 32, 71, 114, 97, 121, 84, 101, 120, 116, 32,
+    125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117,
+    116, 116, 111, 110, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105,
+    116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32, 105, 110, 112, 117,
+    116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 58,
+    97, 99, 116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 97, 99, 116, 105, 118,
+    101, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45,
+    117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98,
+    117, 116, 116, 111, 110, 58, 97, 99, 116, 105, 118, 101, 32, 123, 32, 98,
+    111, 114, 100, 101, 114, 45, 115, 116, 121, 108, 101, 58, 32, 105, 110, 115,
+    101, 116, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
+    34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 97, 99, 116, 105, 118, 101,
+    58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58,
+    97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115,
+    101, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97,
+    98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
+    61, 34, 102, 105, 108, 101, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58,
+    100, 105, 115, 97, 98, 108, 101, 100, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117,
+    116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58, 97, 99, 116,
+    105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 32, 123, 32, 98,
+    111, 114, 100, 101, 114, 45, 115, 116, 121, 108, 101, 58, 32, 111, 117, 116,
+    115, 101, 116, 32, 125, 32, 97, 114, 101, 97, 44, 32, 112, 97, 114, 97,
+    109, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110,
+    101, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 32, 123, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58,
+    32, 99, 104, 101, 99, 107, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98,
+    111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 125, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 100, 105, 111, 34, 93,
+    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97,
+    114, 97, 110, 99, 101, 58, 32, 114, 97, 100, 105, 111, 59, 32, 45, 119,
+    101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103,
+    58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 125, 32,
+    107, 101, 121, 103, 101, 110, 44, 32, 115, 101, 108, 101, 99, 116, 32, 123,
+    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
+    110, 99, 101, 58, 32, 109, 101, 110, 117, 108, 105, 115, 116, 59, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110,
+    103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110,
+    58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 98, 111, 114, 100, 101, 114,
+    58, 32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97, 100, 105,
+    117, 115, 58, 32, 53, 112, 120, 59, 32, 119, 104, 105, 116, 101, 45, 115,
+    112, 97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101, 114, 105, 110, 103, 58,
+    32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 99, 111, 108, 111, 114, 58,
+    32, 98, 108, 97, 99, 107, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117,
+    110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 119, 104, 105, 116, 101, 59,
+    32, 99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97, 117, 108, 116,
+    59, 32, 125, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101, 93,
+    44, 32, 115, 101, 108, 101, 99, 116, 91, 109, 117, 108, 116, 105, 112, 108,
+    101, 93, 44, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101, 93,
+    91, 109, 117, 108, 116, 105, 112, 108, 101, 93, 32, 123, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58,
+    32, 108, 105, 115, 116, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 115, 116, 97,
+    114, 116, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32,
+    105, 110, 115, 101, 116, 32, 103, 114, 97, 121, 59, 32, 45, 119, 101, 98,
     107, 105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97, 100, 105, 117,
-    115, 58, 32, 53, 112, 120, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112,
-    97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 125, 32, 100, 97, 116, 97,
-    108, 105, 115, 116, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
-    110, 111, 110, 101, 59, 32, 125, 32, 111, 112, 116, 103, 114, 111, 117, 112,
-    32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32,
-    98, 111, 108, 100, 101, 114, 59, 32, 125, 32, 111, 112, 116, 105, 111, 110,
-    32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32,
-    110, 111, 114, 109, 97, 108, 59, 32, 125, 32, 100, 97, 116, 97, 103, 114,
-    105, 100, 32, 123, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 53, 48,
-    112, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
-    97, 114, 97, 110, 99, 101, 58, 32, 100, 97, 116, 97, 103, 114, 105, 100,
-    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105,
-    122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120,
-    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114,
-    100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59,
-    32, 99, 111, 108, 111, 114, 58, 32, 98, 108, 97, 99, 107, 59, 32, 98,
-    97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58,
-    32, 119, 104, 105, 116, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32,
-    100, 101, 102, 97, 117, 108, 116, 59, 32, 98, 111, 114, 100, 101, 114, 58,
-    32, 49, 112, 120, 32, 105, 110, 115, 101, 116, 32, 103, 114, 97, 121, 59,
-    32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 105, 110,
-    105, 116, 105, 97, 108, 59, 32, 125, 32, 117, 44, 32, 105, 110, 115, 32,
+    115, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 119, 104, 105, 116,
+    101, 45, 115, 112, 97, 99, 101, 58, 32, 105, 110, 105, 116, 105, 97, 108,
+    59, 32, 125, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101, 61,
+    34, 48, 34, 93, 44, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122,
+    101, 61, 34, 49, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 110,
+    117, 108, 105, 115, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98,
+    111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114,
+    59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111,
+    108, 105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 114,
+    100, 101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 53, 112, 120, 59,
+    32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112, 114,
+    101, 59, 32, 125, 32, 100, 97, 116, 97, 108, 105, 115, 116, 32, 123, 32,
+    100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32, 125,
+    32, 111, 112, 116, 103, 114, 111, 117, 112, 32, 123, 32, 102, 111, 110, 116,
+    45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 101, 114, 59,
+    32, 125, 32, 111, 112, 116, 105, 111, 110, 32, 123, 32, 102, 111, 110, 116,
+    45, 119, 101, 105, 103, 104, 116, 58, 32, 110, 111, 114, 109, 97, 108, 59,
+    32, 125, 32, 112, 114, 111, 103, 114, 101, 115, 115, 32, 123, 32, 45, 119,
+    101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101,
+    58, 32, 112, 114, 111, 103, 114, 101, 115, 115, 45, 98, 97, 114, 59, 32,
+    112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116, 105, 97, 108,
+    59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97,
+    108, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 50, 112, 120, 59, 32,
+    125, 32, 112, 114, 111, 103, 114, 101, 115, 115, 58, 58, 45, 119, 101, 98,
+    107, 105, 116, 45, 112, 114, 111, 103, 114, 101, 115, 115, 45, 98, 97, 114,
+    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97,
+    114, 97, 110, 99, 101, 58, 32, 112, 114, 111, 103, 114, 101, 115, 115, 45,
+    98, 97, 114, 59, 32, 125, 32, 100, 97, 116, 97, 103, 114, 105, 100, 32,
+    123, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 53, 48, 112, 120, 59,
+    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
+    110, 99, 101, 58, 32, 100, 97, 116, 97, 103, 114, 105, 100, 59, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110,
+    103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101, 114,
+    105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 99, 111,
+    108, 111, 114, 58, 32, 98, 108, 97, 99, 107, 59, 32, 98, 97, 99, 107,
+    103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 119, 104,
+    105, 116, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102,
+    97, 117, 108, 116, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112,
+    120, 32, 105, 110, 115, 101, 116, 32, 103, 114, 97, 121, 59, 32, 119, 104,
+    105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 105, 110, 105, 116, 105,
+    97, 108, 59, 32, 125, 32, 117, 44, 32, 105, 110, 115, 32, 123, 32, 116,
+    101, 120, 116, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 58, 32,
+    117, 110, 100, 101, 114, 108, 105, 110, 101, 32, 125, 32, 115, 116, 114, 111,
+    110, 103, 44, 32, 98, 32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105,
+    103, 104, 116, 58, 32, 98, 111, 108, 100, 101, 114, 32, 125, 32, 105, 44,
+    32, 99, 105, 116, 101, 44, 32, 101, 109, 44, 32, 118, 97, 114, 44, 32,
+    97, 100, 100, 114, 101, 115, 115, 32, 123, 32, 102, 111, 110, 116, 45, 115,
+    116, 121, 108, 101, 58, 32, 105, 116, 97, 108, 105, 99, 32, 125, 32, 116,
+    116, 44, 32, 99, 111, 100, 101, 44, 32, 107, 98, 100, 44, 32, 115, 97,
+    109, 112, 32, 123, 32, 102, 111, 110, 116, 45, 102, 97, 109, 105, 108, 121,
+    58, 32, 109, 111, 110, 111, 115, 112, 97, 99, 101, 32, 125, 32, 112, 114,
+    101, 44, 32, 120, 109, 112, 44, 32, 112, 108, 97, 105, 110, 116, 101, 120,
+    116, 44, 32, 108, 105, 115, 116, 105, 110, 103, 32, 123, 32, 100, 105, 115,
+    112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 102, 111, 110,
+    116, 45, 102, 97, 109, 105, 108, 121, 58, 32, 109, 111, 110, 111, 115, 112,
+    97, 99, 101, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101,
+    58, 32, 112, 114, 101, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 49,
+    95, 95, 113, 101, 109, 32, 48, 32, 125, 32, 98, 105, 103, 32, 123, 32,
+    102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 108, 97, 114, 103, 101,
+    114, 32, 125, 32, 115, 109, 97, 108, 108, 32, 123, 32, 102, 111, 110, 116,
+    45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108, 101, 114, 32, 125,
+    32, 115, 44, 32, 115, 116, 114, 105, 107, 101, 44, 32, 100, 101, 108, 32,
     123, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111,
-    110, 58, 32, 117, 110, 100, 101, 114, 108, 105, 110, 101, 32, 125, 32, 115,
-    116, 114, 111, 110, 103, 44, 32, 98, 32, 123, 32, 102, 111, 110, 116, 45,
-    119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 101, 114, 32, 125,
-    32, 105, 44, 32, 99, 105, 116, 101, 44, 32, 101, 109, 44, 32, 118, 97,
-    114, 44, 32, 97, 100, 100, 114, 101, 115, 115, 32, 123, 32, 102, 111, 110,
-    116, 45, 115, 116, 121, 108, 101, 58, 32, 105, 116, 97, 108, 105, 99, 32,
-    125, 32, 116, 116, 44, 32, 99, 111, 100, 101, 44, 32, 107, 98, 100, 44,
-    32, 115, 97, 109, 112, 32, 123, 32, 102, 111, 110, 116, 45, 102, 97, 109,
-    105, 108, 121, 58, 32, 109, 111, 110, 111, 115, 112, 97, 99, 101, 32, 125,
-    32, 112, 114, 101, 44, 32, 120, 109, 112, 44, 32, 112, 108, 97, 105, 110,
-    116, 101, 120, 116, 44, 32, 108, 105, 115, 116, 105, 110, 103, 32, 123, 32,
-    100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32,
-    102, 111, 110, 116, 45, 102, 97, 109, 105, 108, 121, 58, 32, 109, 111, 110,
-    111, 115, 112, 97, 99, 101, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112,
-    97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 109, 97, 114, 103, 105, 110,
-    58, 32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 125, 32, 98, 105, 103,
-    32, 123, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 108, 97,
-    114, 103, 101, 114, 32, 125, 32, 115, 109, 97, 108, 108, 32, 123, 32, 102,
+    110, 58, 32, 108, 105, 110, 101, 45, 116, 104, 114, 111, 117, 103, 104, 32,
+    125, 32, 115, 117, 98, 32, 123, 32, 118, 101, 114, 116, 105, 99, 97, 108,
+    45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 98, 59, 32, 102, 111, 110,
+    116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108, 101, 114, 32,
+    125, 32, 115, 117, 112, 32, 123, 32, 118, 101, 114, 116, 105, 99, 97, 108,
+    45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 112, 101, 114, 59, 32, 102,
     111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108, 101,
-    114, 32, 125, 32, 115, 44, 32, 115, 116, 114, 105, 107, 101, 44, 32, 100,
-    101, 108, 32, 123, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97,
-    116, 105, 111, 110, 58, 32, 108, 105, 110, 101, 45, 116, 104, 114, 111, 117,
-    103, 104, 32, 125, 32, 115, 117, 98, 32, 123, 32, 118, 101, 114, 116, 105,
-    99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 98, 59, 32,
-    102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108,
-    101, 114, 32, 125, 32, 115, 117, 112, 32, 123, 32, 118, 101, 114, 116, 105,
-    99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 112, 101, 114,
-    59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97,
-    108, 108, 101, 114, 32, 125, 32, 110, 111, 98, 114, 32, 123, 32, 119, 104,
-    105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 110, 111, 119, 114, 97,
-    112, 32, 125, 32, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116,
-    108, 105, 110, 101, 58, 32, 97, 117, 116, 111, 32, 53, 112, 120, 32, 45,
-    119, 101, 98, 107, 105, 116, 45, 102, 111, 99, 117, 115, 45, 114, 105, 110,
-    103, 45, 99, 111, 108, 111, 114, 32, 125, 32, 104, 116, 109, 108, 58, 102,
-    111, 99, 117, 115, 44, 32, 98, 111, 100, 121, 58, 102, 111, 99, 117, 115,
-    44, 32, 105, 110, 112, 117, 116, 91, 114, 101, 97, 100, 111, 110, 108, 121,
-    93, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110,
-    101, 58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 58,
-    102, 111, 99, 117, 115, 44, 32, 116, 101, 120, 116, 97, 114, 101, 97, 58,
-    102, 111, 99, 117, 115, 44, 32, 105, 115, 105, 110, 100, 101, 120, 58, 102,
-    111, 99, 117, 115, 44, 32, 107, 101, 121, 103, 101, 110, 58, 102, 111, 99,
-    117, 115, 44, 32, 115, 101, 108, 101, 99, 116, 58, 102, 111, 99, 117, 115,
-    32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 45, 111, 102, 102, 115, 101,
-    116, 58, 32, 45, 50, 112, 120, 32, 125, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 102,
-    111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 58, 102, 111, 99,
-    117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    102, 105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100, 100, 101, 110,
-    34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93, 58, 102, 111,
-    99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
-    34, 114, 97, 100, 105, 111, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101,
-    116, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116,
-    91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 58,
+    114, 32, 125, 32, 110, 111, 98, 114, 32, 123, 32, 119, 104, 105, 116, 101,
+    45, 115, 112, 97, 99, 101, 58, 32, 110, 111, 119, 114, 97, 112, 32, 125,
+    32, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110,
+    101, 58, 32, 97, 117, 116, 111, 32, 53, 112, 120, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 102, 111, 99, 117, 115, 45, 114, 105, 110, 103, 45, 99,
+    111, 108, 111, 114, 32, 125, 32, 104, 116, 109, 108, 58, 102, 111, 99, 117,
+    115, 44, 32, 98, 111, 100, 121, 58, 102, 111, 99, 117, 115, 44, 32, 105,
+    110, 112, 117, 116, 91, 114, 101, 97, 100, 111, 110, 108, 121, 93, 58, 102,
+    111, 99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 58, 32,
+    110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 58, 102, 111, 99,
+    117, 115, 44, 32, 116, 101, 120, 116, 97, 114, 101, 97, 58, 102, 111, 99,
+    117, 115, 44, 32, 105, 115, 105, 110, 100, 101, 120, 58, 102, 111, 99, 117,
+    115, 44, 32, 107, 101, 121, 103, 101, 110, 58, 102, 111, 99, 117, 115, 44,
+    32, 115, 101, 108, 101, 99, 116, 58, 102, 111, 99, 117, 115, 32, 123, 32,
+    111, 117, 116, 108, 105, 110, 101, 45, 111, 102, 102, 115, 101, 116, 58, 32,
+    45, 50, 112, 120, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 102, 111, 99, 117,
+    115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 99,
+    104, 101, 99, 107, 98, 111, 120, 34, 93, 58, 102, 111, 99, 117, 115, 44,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108,
+    101, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 104, 105, 100, 100, 101, 110, 34, 93, 58,
     102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 102, 111, 99, 117,
-    115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102,
-    105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 58, 58, 45, 119, 101,
-    98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100,
-    45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 111, 117, 116, 108, 105, 110,
-    101, 45, 111, 102, 102, 115, 101, 116, 58, 32, 48, 32, 125, 32, 97, 58,
-    45, 119, 101, 98, 107, 105, 116, 45, 97, 110, 121, 45, 108, 105, 110, 107,
-    32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 108, 105, 110, 107, 59, 32, 116, 101, 120, 116, 45, 100, 101, 99,
-    111, 114, 97, 116, 105, 111, 110, 58, 32, 117, 110, 100, 101, 114, 108, 105,
-    110, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117, 116, 111,
-    59, 32, 125, 32, 97, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 110,
-    121, 45, 108, 105, 110, 107, 58, 97, 99, 116, 105, 118, 101, 32, 123, 32,
-    99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
-    99, 116, 105, 118, 101, 108, 105, 110, 107, 32, 125, 32, 110, 111, 102, 114,
-    97, 109, 101, 115, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
-    110, 111, 110, 101, 32, 125, 32, 102, 114, 97, 109, 101, 115, 101, 116, 44,
-    32, 102, 114, 97, 109, 101, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
-    58, 32, 98, 108, 111, 99, 107, 32, 125, 32, 102, 114, 97, 109, 101, 115,
-    101, 116, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108, 111,
-    114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32, 105, 102, 114,
-    97, 109, 101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112,
-    120, 32, 105, 110, 115, 101, 116, 32, 125
+    101, 61, 34, 105, 109, 97, 103, 101, 34, 93, 58, 102, 111, 99, 117, 115,
+    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97,
+    100, 105, 111, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93,
+    58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 58, 102, 111, 99,
+    117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    115, 117, 98, 109, 105, 116, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101,
+    34, 93, 58, 102, 111, 99, 117, 115, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117,
+    116, 116, 111, 110, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 45, 111,
+    102, 102, 115, 101, 116, 58, 32, 48, 32, 125, 32, 97, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 97, 110, 121, 45, 108, 105, 110, 107, 32, 123, 32,
+    99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 108,
+    105, 110, 107, 59, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97,
+    116, 105, 111, 110, 58, 32, 117, 110, 100, 101, 114, 108, 105, 110, 101, 59,
+    32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117, 116, 111, 59, 32, 125,
+    32, 97, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 110, 121, 45, 108,
+    105, 110, 107, 58, 97, 99, 116, 105, 118, 101, 32, 123, 32, 99, 111, 108,
+    111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 99, 116, 105,
+    118, 101, 108, 105, 110, 107, 32, 125, 32, 114, 117, 98, 121, 44, 32, 114,
+    116, 32, 123, 32, 116, 101, 120, 116, 45, 105, 110, 100, 101, 110, 116, 58,
+    32, 48, 59, 32, 108, 105, 110, 101, 45, 104, 101, 105, 103, 104, 116, 58,
+    32, 110, 111, 114, 109, 97, 108, 59, 32, 125, 32, 114, 117, 98, 121, 32,
+    62, 32, 114, 116, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    98, 108, 111, 99, 107, 59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101,
+    58, 32, 54, 48, 37, 59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103,
+    110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 125, 32, 114, 117, 98,
+    121, 32, 62, 32, 114, 112, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 110, 111, 102, 114, 97, 109,
+    101, 115, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111,
+    110, 101, 32, 125, 32, 102, 114, 97, 109, 101, 115, 101, 116, 44, 32, 102,
+    114, 97, 109, 101, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    98, 108, 111, 99, 107, 32, 125, 32, 102, 114, 97, 109, 101, 115, 101, 116,
+    32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108, 111, 114, 58,
+    32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32, 105, 102, 114, 97, 109,
+    101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120, 32,
+    105, 110, 115, 101, 116, 32, 125
 };
 extern const char quirksUserAgentStyleSheet[359] = {
     105, 109, 103, 91, 97, 108, 105, 103, 110, 61, 34, 108, 101, 102, 116, 34,
@@ -572,32 +608,31 @@ extern const char quirksUserAgentStyleSheet[359] = {
     32, 123, 32, 109, 97, 114, 103, 105, 110, 45, 98, 111, 116, 116, 111, 109,
     58, 32, 49, 101, 109, 32, 125
 };
-extern const char svgUserAgentStyleSheet[358] = {
+extern const char svgUserAgentStyleSheet[350] = {
     110, 97, 109, 101, 115, 112, 97, 99, 101, 32, 34, 104, 116, 116, 112, 58,
     47, 47, 119, 119, 119, 46, 119, 51, 46, 111, 114, 103, 47, 50, 48, 48,
-    48, 47, 115, 118, 103, 34, 59, 32, 115, 118, 103, 58, 114, 111, 111, 116,
-    32, 123, 32, 111, 118, 101, 114, 102, 108, 111, 119, 58, 32, 104, 105, 100,
-    100, 101, 110, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 32, 125,
-    32, 115, 118, 103, 32, 123, 32, 119, 105, 100, 116, 104, 58, 32, 49, 48,
-    48, 37, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 48, 48, 37,
-    59, 32, 125, 32, 115, 118, 103, 44, 32, 115, 121, 109, 98, 111, 108, 44,
-    32, 109, 97, 114, 107, 101, 114, 44, 32, 112, 97, 116, 116, 101, 114, 110,
-    32, 123, 32, 111, 118, 101, 114, 102, 108, 111, 119, 58, 32, 104, 105, 100,
-    100, 101, 110, 32, 125, 32, 116, 101, 120, 116, 44, 32, 102, 111, 114, 101,
-    105, 103, 110, 79, 98, 106, 101, 99, 116, 32, 123, 32, 100, 105, 115, 112,
-    108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 32, 125, 32, 116, 101, 120,
-    116, 44, 32, 116, 115, 112, 97, 110, 44, 32, 116, 101, 120, 116, 80, 97,
-    116, 104, 32, 123, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101,
-    58, 32, 110, 111, 119, 114, 97, 112, 32, 125, 32, 116, 101, 120, 116, 44,
-    32, 116, 115, 112, 97, 110, 44, 32, 116, 114, 101, 102, 32, 123, 32, 45,
-    119, 101, 98, 107, 105, 116, 45, 116, 101, 120, 116, 45, 115, 105, 122, 101,
-    45, 97, 100, 106, 117, 115, 116, 58, 32, 110, 111, 110, 101, 59, 32, 125,
-    32, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110,
-    101, 58, 32, 97, 117, 116, 111, 32, 53, 112, 120, 32, 45, 119, 101, 98,
-    107, 105, 116, 45, 102, 111, 99, 117, 115, 45, 114, 105, 110, 103, 45, 99,
-    111, 108, 111, 114, 32, 125
+    48, 47, 115, 118, 103, 34, 59, 32, 115, 118, 103, 58, 110, 111, 116, 40,
+    58, 114, 111, 111, 116, 41, 44, 32, 115, 121, 109, 98, 111, 108, 44, 32,
+    105, 109, 97, 103, 101, 44, 32, 109, 97, 114, 107, 101, 114, 44, 32, 112,
+    97, 116, 116, 101, 114, 110, 44, 32, 102, 111, 114, 101, 105, 103, 110, 79,
+    98, 106, 101, 99, 116, 32, 123, 32, 111, 118, 101, 114, 102, 108, 111, 119,
+    58, 32, 104, 105, 100, 100, 101, 110, 32, 125, 32, 115, 118, 103, 32, 123,
+    32, 119, 105, 100, 116, 104, 58, 32, 49, 48, 48, 37, 59, 32, 104, 101,
+    105, 103, 104, 116, 58, 32, 49, 48, 48, 37, 59, 32, 125, 32, 116, 101,
+    120, 116, 44, 32, 102, 111, 114, 101, 105, 103, 110, 79, 98, 106, 101, 99,
+    116, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111,
+    99, 107, 32, 125, 32, 116, 101, 120, 116, 44, 32, 116, 115, 112, 97, 110,
+    44, 32, 116, 101, 120, 116, 80, 97, 116, 104, 32, 123, 32, 119, 104, 105,
+    116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 110, 111, 119, 114, 97, 112,
+    32, 125, 32, 116, 101, 120, 116, 44, 32, 116, 115, 112, 97, 110, 44, 32,
+    116, 114, 101, 102, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 116,
+    101, 120, 116, 45, 115, 105, 122, 101, 45, 97, 100, 106, 117, 115, 116, 58,
+    32, 110, 111, 110, 101, 59, 32, 125, 32, 58, 102, 111, 99, 117, 115, 32,
+    123, 32, 111, 117, 116, 108, 105, 110, 101, 58, 32, 97, 117, 116, 111, 32,
+    53, 112, 120, 32, 45, 119, 101, 98, 107, 105, 116, 45, 102, 111, 99, 117,
+    115, 45, 114, 105, 110, 103, 45, 99, 111, 108, 111, 114, 32, 125
 };
-extern const char sourceUserAgentStyleSheet[2004] = {
+extern const char sourceUserAgentStyleSheet[2016] = {
     98, 111, 100, 121, 32, 123, 32, 109, 97, 114, 103, 105, 110, 58, 32, 48,
     32, 125, 32, 116, 97, 98, 108, 101, 32, 123, 32, 119, 105, 100, 116, 104,
     58, 32, 49, 48, 48, 37, 59, 32, 98, 111, 114, 100, 101, 114, 45, 115,
@@ -696,34 +731,34 @@ extern const char sourceUserAgentStyleSheet[2004] = {
     105, 110, 45, 104, 101, 105, 103, 104, 116, 58, 32, 49, 51, 112, 120, 59,
     32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 57, 112, 120, 59,
     32, 102, 111, 110, 116, 45, 102, 97, 109, 105, 108, 121, 58, 32, 76, 117,
-    99, 105, 100, 97, 32, 71, 114, 97, 110, 100, 101, 59, 32, 102, 111, 110,
-    116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 59, 32,
-    109, 97, 114, 103, 105, 110, 58, 32, 54, 112, 120, 32, 50, 53, 112, 120,
-    59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 48, 32, 55, 112, 120,
-    32, 49, 112, 120, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45,
-    104, 116, 109, 108, 45, 119, 97, 114, 110, 105, 110, 103, 45, 109, 101, 115,
-    115, 97, 103, 101, 32, 123, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110,
-    100, 45, 99, 111, 108, 111, 114, 58, 32, 114, 103, 98, 40, 49, 48, 48,
-    37, 44, 32, 54, 50, 37, 44, 32, 52, 50, 37, 41, 59, 32, 98, 111,
-    114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 115, 111, 108, 105, 100, 32,
-    114, 103, 98, 40, 49, 48, 48, 37, 44, 32, 53, 50, 37, 44, 32, 50,
-    49, 37, 41, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 104,
-    116, 109, 108, 45, 101, 114, 114, 111, 114, 45, 109, 101, 115, 115, 97, 103,
-    101, 32, 123, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99,
-    111, 108, 111, 114, 58, 32, 114, 103, 98, 40, 49, 48, 48, 37, 44, 32,
-    52, 50, 37, 44, 32, 52, 50, 37, 41, 59, 32, 98, 111, 114, 100, 101,
-    114, 58, 32, 50, 112, 120, 32, 115, 111, 108, 105, 100, 32, 114, 103, 98,
-    40, 49, 48, 48, 37, 44, 32, 51, 49, 37, 44, 32, 51, 49, 37, 41,
+    99, 105, 100, 97, 32, 71, 114, 97, 110, 100, 101, 44, 32, 115, 97, 110,
+    115, 45, 115, 101, 114, 105, 102, 59, 32, 102, 111, 110, 116, 45, 119, 101,
+    105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 59, 32, 109, 97, 114, 103,
+    105, 110, 58, 32, 54, 112, 120, 32, 50, 53, 112, 120, 59, 32, 112, 97,
+    100, 100, 105, 110, 103, 58, 32, 48, 32, 55, 112, 120, 32, 49, 112, 120,
     59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 104, 116, 109, 108,
-    45, 109, 101, 115, 115, 97, 103, 101, 45, 108, 105, 110, 101, 32, 123, 32,
-    112, 97, 100, 100, 105, 110, 103, 45, 108, 101, 102, 116, 58, 32, 50, 51,
-    112, 120, 59, 32, 116, 101, 120, 116, 45, 105, 110, 100, 101, 110, 116, 58,
-    32, 45, 50, 48, 112, 120, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105,
-    116, 45, 104, 116, 109, 108, 45, 109, 101, 115, 115, 97, 103, 101, 45, 105,
-    99, 111, 110, 32, 123, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32,
-    114, 101, 108, 97, 116, 105, 118, 101, 59, 32, 116, 111, 112, 58, 32, 50,
-    112, 120, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 48, 32, 52, 112,
-    120, 59, 32, 125
+    45, 119, 97, 114, 110, 105, 110, 103, 45, 109, 101, 115, 115, 97, 103, 101,
+    32, 123, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111,
+    108, 111, 114, 58, 32, 114, 103, 98, 40, 49, 48, 48, 37, 44, 32, 54,
+    50, 37, 44, 32, 52, 50, 37, 41, 59, 32, 98, 111, 114, 100, 101, 114,
+    58, 32, 50, 112, 120, 32, 115, 111, 108, 105, 100, 32, 114, 103, 98, 40,
+    49, 48, 48, 37, 44, 32, 53, 50, 37, 44, 32, 50, 49, 37, 41, 59,
+    32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 104, 116, 109, 108, 45,
+    101, 114, 114, 111, 114, 45, 109, 101, 115, 115, 97, 103, 101, 32, 123, 32,
+    98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114,
+    58, 32, 114, 103, 98, 40, 49, 48, 48, 37, 44, 32, 52, 50, 37, 44,
+    32, 52, 50, 37, 41, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50,
+    112, 120, 32, 115, 111, 108, 105, 100, 32, 114, 103, 98, 40, 49, 48, 48,
+    37, 44, 32, 51, 49, 37, 44, 32, 51, 49, 37, 41, 59, 32, 125, 32,
+    46, 119, 101, 98, 107, 105, 116, 45, 104, 116, 109, 108, 45, 109, 101, 115,
+    115, 97, 103, 101, 45, 108, 105, 110, 101, 32, 123, 32, 112, 97, 100, 100,
+    105, 110, 103, 45, 108, 101, 102, 116, 58, 32, 50, 51, 112, 120, 59, 32,
+    116, 101, 120, 116, 45, 105, 110, 100, 101, 110, 116, 58, 32, 45, 50, 48,
+    112, 120, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 104, 116,
+    109, 108, 45, 109, 101, 115, 115, 97, 103, 101, 45, 105, 99, 111, 110, 32,
+    123, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 114, 101, 108, 97,
+    116, 105, 118, 101, 59, 32, 116, 111, 112, 58, 32, 50, 112, 120, 59, 32,
+    109, 97, 114, 103, 105, 110, 58, 32, 48, 32, 52, 112, 120, 59, 32, 125
 };
 extern const char wmlUserAgentStyleSheet[3039] = {
     110, 97, 109, 101, 115, 112, 97, 99, 101, 32, 34, 104, 116, 116, 112, 58,
@@ -917,7 +952,7 @@ extern const char wmlUserAgentStyleSheet[3039] = {
     101, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107,
     105, 116, 45, 97, 99, 116, 105, 118, 101, 108, 105, 110, 107, 32, 125
 };
-extern const char mediaControlsUserAgentStyleSheet[2582] = {
+extern const char mediaControlsUserAgentStyleSheet[2813] = {
     97, 117, 100, 105, 111, 32, 123, 32, 119, 105, 100, 116, 104, 58, 32, 50,
     48, 48, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54,
     112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
@@ -1079,9 +1114,23 @@ extern const char mediaControlsUserAgentStyleSheet[2582] = {
     45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 114, 101, 116, 117, 114, 110,
     45, 116, 111, 45, 114, 101, 97, 108, 116, 105, 109, 101, 45, 98, 117, 116,
     116, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110,
-    111, 110, 101, 59, 32, 125
+    111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119,
+    101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116,
+    114, 111, 108, 115, 45, 116, 111, 103, 103, 108, 101, 45, 99, 108, 111, 115,
+    101, 100, 45, 99, 97, 112, 116, 105, 111, 110, 115, 45, 98, 117, 116, 116,
+    111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108,
+    115, 45, 116, 111, 103, 103, 108, 101, 45, 99, 108, 111, 115, 101, 100, 45,
+    99, 97, 112, 116, 105, 111, 110, 115, 45, 98, 117, 116, 116, 111, 110, 32,
+    123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114,
+    97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 116, 111, 103, 103,
+    108, 101, 45, 99, 108, 111, 115, 101, 100, 45, 99, 97, 112, 116, 105, 111,
+    110, 115, 45, 98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115, 112, 108,
+    97, 121, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 59,
+    32, 119, 105, 100, 116, 104, 58, 32, 49, 54, 112, 120, 59, 32, 104, 101,
+    105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125
 };
-extern const char mediaControlsQtUserAgentStyleSheet[2249] = {
+extern const char mediaControlsQtUserAgentStyleSheet[2653] = {
     97, 117, 100, 105, 111, 32, 123, 32, 104, 101, 105, 103, 104, 116, 58, 32,
     51, 52, 112, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 52, 48, 48,
     112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
@@ -1112,116 +1161,240 @@ extern const char mediaControlsQtUserAgentStyleSheet[2249] = {
     111, 108, 115, 45, 109, 117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 44,
     32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
     109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 109,
-    117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 108, 101, 102,
-    116, 58, 32, 97, 117, 116, 111, 59, 32, 114, 105, 103, 104, 116, 58, 32,
-    53, 112, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 50, 112, 120,
-    59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 50, 112, 120, 59, 32,
-    112, 97, 100, 100, 105, 110, 103, 58, 32, 54, 112, 120, 59, 32, 109, 97,
-    114, 103, 105, 110, 58, 32, 53, 112, 120, 32, 53, 112, 120, 32, 53, 112,
-    120, 32, 51, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58,
-    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
-    110, 116, 114, 111, 108, 115, 45, 112, 108, 97, 121, 45, 98, 117, 116, 116,
-    111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107,
-    105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108,
-    115, 45, 112, 108, 97, 121, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32,
-    108, 101, 102, 116, 58, 32, 53, 112, 120, 59, 32, 119, 105, 100, 116, 104,
-    58, 32, 57, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49,
-    50, 112, 120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 54, 112,
-    120, 32, 49, 50, 112, 120, 32, 54, 112, 120, 32, 49, 49, 112, 120, 59,
-    32, 109, 97, 114, 103, 105, 110, 58, 32, 53, 112, 120, 32, 51, 112, 120,
-    32, 53, 112, 120, 32, 53, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105,
-    111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
-    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105,
-    110, 101, 45, 99, 111, 110, 116, 97, 105, 110, 101, 114, 44, 32, 118, 105,
-    100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
-    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101,
-    108, 105, 110, 101, 45, 99, 111, 110, 116, 97, 105, 110, 101, 114, 32, 123,
-    32, 104, 101, 105, 103, 104, 116, 58, 32, 51, 52, 112, 120, 59, 32, 125,
+    117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 119, 105, 100,
+    116, 104, 58, 32, 49, 50, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116,
+    58, 32, 49, 50, 112, 120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58,
+    32, 54, 112, 120, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 53, 112,
+    120, 32, 53, 112, 120, 32, 53, 112, 120, 32, 51, 112, 120, 59, 32, 125,
     32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
-    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 99,
-    117, 114, 114, 101, 110, 116, 45, 116, 105, 109, 101, 45, 100, 105, 115, 112,
-    108, 97, 121, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98,
-    107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111,
-    108, 115, 45, 99, 117, 114, 114, 101, 110, 116, 45, 116, 105, 109, 101, 45,
-    100, 105, 115, 112, 108, 97, 121, 32, 123, 32, 100, 105, 115, 112, 108, 97,
-    121, 58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111,
-    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
-    99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 45, 114, 101,
-    109, 97, 105, 110, 105, 110, 103, 45, 100, 105, 115, 112, 108, 97, 121, 44,
-    32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
-    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116,
-    105, 109, 101, 45, 114, 101, 109, 97, 105, 110, 105, 110, 103, 45, 100, 105,
-    115, 112, 108, 97, 121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58,
-    32, 110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58,
+    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112,
+    108, 97, 121, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101,
+    111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
+    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 108, 97, 121, 45, 98,
+    117, 116, 116, 111, 110, 32, 123, 32, 119, 105, 100, 116, 104, 58, 32, 57,
+    112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 50, 112, 120,
+    59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 54, 112, 120, 32, 49,
+    50, 112, 120, 32, 54, 112, 120, 32, 49, 49, 112, 120, 59, 32, 109, 97,
+    114, 103, 105, 110, 58, 32, 53, 112, 120, 32, 51, 112, 120, 32, 53, 112,
+    120, 32, 53, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58,
     45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
-    110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105, 110, 101, 44,
-    32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
-    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116,
-    105, 109, 101, 108, 105, 110, 101, 32, 123, 32, 108, 101, 102, 116, 58, 32,
-    52, 50, 112, 120, 59, 32, 114, 105, 103, 104, 116, 58, 32, 51, 52, 112,
-    120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 50, 112, 120, 59,
-    32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 54, 112, 120, 32, 56, 112,
-    120, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 53, 112, 120, 32, 48,
-    112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
-    98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
-    111, 108, 115, 45, 118, 111, 108, 117, 109, 101, 45, 115, 108, 105, 100, 101,
-    114, 45, 99, 111, 110, 116, 97, 105, 110, 101, 114, 44, 32, 118, 105, 100,
+    110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105, 110, 101, 45,
+    99, 111, 110, 116, 97, 105, 110, 101, 114, 44, 32, 118, 105, 100, 101, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105, 110,
+    101, 45, 99, 111, 110, 116, 97, 105, 110, 101, 114, 32, 123, 32, 104, 101,
+    105, 103, 104, 116, 58, 32, 51, 52, 112, 120, 59, 32, 125, 32, 97, 117,
+    100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
+    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 99, 117, 114, 114,
+    101, 110, 116, 45, 116, 105, 109, 101, 45, 100, 105, 115, 112, 108, 97, 121,
+    44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
+    99, 117, 114, 114, 101, 110, 116, 45, 116, 105, 109, 101, 45, 100, 105, 115,
+    112, 108, 97, 121, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
+    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97,
+    45, 99, 117, 114, 114, 101, 110, 116, 45, 116, 105, 109, 101, 45, 100, 105,
+    115, 112, 108, 97, 121, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 117,
+    115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32, 110, 111, 110, 101,
+    59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110,
+    101, 45, 98, 108, 111, 99, 107, 59, 32, 104, 101, 105, 103, 104, 116, 58,
+    32, 49, 50, 112, 120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32,
+    54, 112, 120, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 53, 112, 120,
+    32, 51, 112, 120, 59, 32, 111, 118, 101, 114, 102, 108, 111, 119, 58, 32,
+    104, 105, 100, 100, 101, 110, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32,
+    100, 101, 102, 97, 117, 108, 116, 59, 32, 116, 101, 120, 116, 45, 97, 108,
+    105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 102, 111, 110,
+    116, 45, 115, 105, 122, 101, 58, 32, 49, 48, 112, 120, 59, 32, 102, 111,
+    110, 116, 45, 102, 97, 109, 105, 108, 121, 58, 32, 86, 101, 114, 100, 97,
+    110, 97, 59, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58,
+    32, 98, 111, 108, 100, 59, 32, 99, 111, 108, 111, 114, 58, 32, 119, 104,
+    105, 116, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119,
+    101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116,
+    114, 111, 108, 115, 45, 116, 105, 109, 101, 45, 114, 101, 109, 97, 105, 110,
+    105, 110, 103, 45, 100, 105, 115, 112, 108, 97, 121, 44, 32, 118, 105, 100,
+    101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105,
+    97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 45,
+    114, 101, 109, 97, 105, 110, 105, 110, 103, 45, 100, 105, 115, 112, 108, 97,
+    121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110,
+    101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98,
+    107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111,
+    108, 115, 45, 116, 105, 109, 101, 108, 105, 110, 101, 44, 32, 118, 105, 100,
     101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105,
+    97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108,
+    105, 110, 101, 32, 123, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 50,
+    112, 120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 54, 112, 120,
+    32, 56, 112, 120, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 53, 112,
+    120, 32, 51, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
+    110, 116, 114, 111, 108, 115, 45, 118, 111, 108, 117, 109, 101, 45, 115, 108,
+    105, 100, 101, 114, 45, 99, 111, 110, 116, 97, 105, 110, 101, 114, 44, 32,
+    118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
+    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 118, 111,
+    108, 117, 109, 101, 45, 115, 108, 105, 100, 101, 114, 45, 99, 111, 110, 116,
+    97, 105, 110, 101, 114, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45,
+    97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105,
+    97, 45, 118, 111, 108, 117, 109, 101, 45, 115, 108, 105, 100, 101, 114, 45,
+    99, 111, 110, 116, 97, 105, 110, 101, 114, 59, 32, 112, 111, 115, 105, 116,
+    105, 111, 110, 58, 32, 97, 98, 115, 111, 108, 117, 116, 101, 59, 32, 104,
+    101, 105, 103, 104, 116, 58, 32, 49, 48, 51, 112, 120, 59, 32, 119, 105,
+    100, 116, 104, 58, 32, 50, 52, 112, 120, 59, 32, 125, 32, 97, 117, 100,
+    105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105,
     97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 118, 111, 108, 117, 109,
-    101, 45, 115, 108, 105, 100, 101, 114, 45, 99, 111, 110, 116, 97, 105, 110,
-    101, 114, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111,
+    101, 45, 115, 108, 105, 100, 101, 114, 44, 32, 118, 105, 100, 101, 111, 58,
+    58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99,
+    111, 110, 116, 114, 111, 108, 115, 45, 118, 111, 108, 117, 109, 101, 45, 115,
+    108, 105, 100, 101, 114, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45,
+    97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105,
+    97, 45, 118, 111, 108, 117, 109, 101, 45, 115, 108, 105, 100, 101, 114, 59,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101,
+    59, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111,
+    108, 117, 116, 101, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 50, 112,
+    120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 54, 112, 120, 59,
+    32, 104, 101, 105, 103, 104, 116, 58, 32, 56, 56, 112, 120, 59, 32, 109,
+    97, 114, 103, 105, 110, 58, 32, 48, 32, 48, 32, 51, 112, 120, 32, 48,
+    59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108,
+    115, 45, 115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116,
+    111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108,
+    115, 45, 115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116,
+    111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111,
     110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
     98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
-    111, 108, 115, 45, 118, 111, 108, 117, 109, 101, 45, 115, 108, 105, 100, 101,
-    114, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105,
-    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
-    45, 118, 111, 108, 117, 109, 101, 45, 115, 108, 105, 100, 101, 114, 32, 123,
+    111, 108, 115, 45, 115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100,
+    45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
+    110, 116, 114, 111, 108, 115, 45, 115, 101, 101, 107, 45, 102, 111, 114, 119,
+    97, 114, 100, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 100, 105, 115,
+    112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 97, 117,
+    100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
+    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 102, 117, 108, 108,
+    115, 99, 114, 101, 101, 110, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118,
+    105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 102, 117, 108,
+    108, 115, 99, 114, 101, 101, 110, 45, 98, 117, 116, 116, 111, 110, 32, 123,
     32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32,
     125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
     45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
-    115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110,
-    44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
-    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
-    115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110,
-    32, 123, 32, 108, 101, 102, 116, 58, 32, 48, 112, 120, 59, 32, 116, 111,
-    112, 58, 32, 48, 112, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 48,
-    112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 48, 112, 120, 59,
+    114, 101, 119, 105, 110, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118,
+    105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 114, 101, 119,
+    105, 110, 100, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 100, 105, 115,
+    112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 97, 117,
+    100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
+    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 114, 101, 116, 117,
+    114, 110, 45, 116, 111, 45, 114, 101, 97, 108, 116, 105, 109, 101, 45, 98,
+    117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119,
+    101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116,
+    114, 111, 108, 115, 45, 114, 101, 116, 117, 114, 110, 45, 116, 111, 45, 114,
+    101, 97, 108, 116, 105, 109, 101, 45, 98, 117, 116, 116, 111, 110, 32, 123,
     32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32,
     125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
     45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
-    115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116,
-    116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98,
-    107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111,
-    108, 115, 45, 115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45,
-    98, 117, 116, 116, 111, 110, 32, 123, 32, 108, 101, 102, 116, 58, 32, 48,
-    112, 120, 59, 32, 116, 111, 112, 58, 32, 48, 112, 120, 59, 32, 119, 105,
-    100, 116, 104, 58, 32, 48, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116,
-    58, 32, 48, 112, 120, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
-    110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110,
-    116, 114, 111, 108, 115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101, 110,
-    45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58,
-    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
-    110, 116, 114, 111, 108, 115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101,
-    110, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 108, 101, 102, 116, 58,
-    32, 48, 112, 120, 59, 32, 116, 111, 112, 58, 32, 48, 112, 120, 59, 32,
-    119, 105, 100, 116, 104, 58, 32, 48, 112, 120, 59, 32, 104, 101, 105, 103,
-    104, 116, 58, 32, 48, 112, 120, 59, 32, 100, 105, 115, 112, 108, 97, 121,
-    58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58,
-    58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99,
-    111, 110, 116, 114, 111, 108, 115, 45, 114, 101, 119, 105, 110, 100, 45, 98,
-    117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119,
-    101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116,
-    114, 111, 108, 115, 45, 114, 101, 119, 105, 110, 100, 45, 98, 117, 116, 116,
-    111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111,
-    110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
-    98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
-    111, 108, 115, 45, 114, 101, 116, 117, 114, 110, 45, 116, 111, 45, 114, 101,
-    97, 108, 116, 105, 109, 101, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118,
+    116, 111, 103, 103, 108, 101, 45, 99, 108, 111, 115, 101, 100, 45, 99, 97,
+    112, 116, 105, 111, 110, 115, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118,
     105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
-    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 114, 101, 116,
-    117, 114, 110, 45, 116, 111, 45, 114, 101, 97, 108, 116, 105, 109, 101, 45,
-    98, 117, 116, 116, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
-    58, 32, 110, 111, 110, 101, 59, 32, 125
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 111, 103,
+    103, 108, 101, 45, 99, 108, 111, 115, 101, 100, 45, 99, 97, 112, 116, 105,
+    111, 110, 115, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 100, 105, 115,
+    112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32, 125
+};
+extern const char themeQtNoListboxesUserAgentStyleSheet[180] = {
+    115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101, 93, 44, 32, 115, 101,
+    108, 101, 99, 116, 91, 109, 117, 108, 116, 105, 112, 108, 101, 93, 44, 32,
+    115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101, 93, 91, 109, 117, 108,
+    116, 105, 112, 108, 101, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 110,
+    117, 108, 105, 115, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98,
+    111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114,
+    59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111,
+    108, 105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 114,
+    100, 101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 53, 112, 120, 59,
+    32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112, 114,
+    101, 59, 32, 125
+};
+extern const char themeQtMaemo5UserAgentStyleSheet[1314] = {
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116,
+    111, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
+    61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 44, 32, 105, 110, 112, 117,
+    116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 44,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108,
+    101, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108,
+    101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44,
+    32, 98, 117, 116, 116, 111, 110, 44, 32, 115, 101, 108, 101, 99, 116, 32,
+    123, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 50, 112, 120, 32, 49,
+    56, 112, 120, 32, 51, 112, 120, 32, 49, 56, 112, 120, 59, 32, 98, 111,
+    114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 32,
+    98, 108, 97, 99, 107, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98,
+    111, 114, 100, 101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 53, 112, 120,
+    59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108,
+    111, 114, 58, 32, 66, 117, 116, 116, 111, 110, 70, 97, 99, 101, 59, 32,
+    125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117,
+    116, 116, 111, 110, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98,
+    109, 105, 116, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101,
+    116, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93,
+    58, 100, 105, 115, 97, 98, 108, 101, 100, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98,
+    117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58, 100, 105,
+    115, 97, 98, 108, 101, 100, 44, 32, 115, 101, 108, 101, 99, 116, 58, 100,
+    105, 115, 97, 98, 108, 101, 100, 32, 123, 32, 98, 111, 114, 100, 101, 114,
+    58, 32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 32, 103, 114, 97, 121,
+    59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    98, 117, 116, 116, 111, 110, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98,
+    109, 105, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34,
+    93, 58, 97, 99, 116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 97, 99, 116,
+    105, 118, 101, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108,
+    101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44,
+    32, 98, 117, 116, 116, 111, 110, 58, 97, 99, 116, 105, 118, 101, 44, 32,
+    115, 101, 108, 101, 99, 116, 58, 97, 99, 116, 105, 118, 101, 123, 32, 98,
+    97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58,
+    32, 66, 117, 116, 116, 111, 110, 83, 104, 97, 100, 111, 119, 59, 32, 125,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116,
+    116, 111, 110, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115,
+    97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 97, 99, 116, 105,
+    118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93,
+    58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100,
+    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105,
+    108, 101, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97,
+    98, 108, 101, 100, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105,
+    108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110,
+    44, 32, 98, 117, 116, 116, 111, 110, 58, 97, 99, 116, 105, 118, 101, 58,
+    100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 115, 101, 108, 101, 99, 116,
+    58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100,
+    32, 123, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115,
+    111, 108, 105, 100, 32, 103, 114, 97, 121, 59, 32, 125, 32, 105, 110, 112,
+    117, 116, 58, 110, 111, 116, 40, 91, 116, 121, 112, 101, 93, 41, 44, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 116, 101, 120, 116,
+    34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    112, 97, 115, 115, 119, 111, 114, 100, 34, 93, 44, 32, 116, 101, 120, 116,
+    97, 114, 101, 97, 32, 123, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49,
+    112, 120, 32, 115, 111, 108, 105, 100, 32, 98, 108, 97, 99, 107, 59, 32,
+    125, 32, 105, 110, 112, 117, 116, 58, 110, 111, 116, 40, 91, 116, 121, 112,
+    101, 93, 41, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 116, 101, 120, 116, 34, 93,
+    58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 112, 97, 115, 115, 119, 111, 114, 100, 34,
+    93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 116, 101, 120, 116,
+    97, 114, 101, 97, 58, 100, 105, 115, 97, 98, 108, 101, 100, 32, 123, 32,
+    98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105,
+    100, 32, 103, 114, 101, 121, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117,
+    110, 100, 45, 99, 111, 108, 111, 114, 58, 66, 117, 116, 116, 111, 110, 72,
+    105, 103, 104, 108, 105, 103, 104, 116, 59, 32, 125, 32, 105, 110, 112, 117,
+    116, 58, 110, 111, 116, 40, 91, 116, 121, 112, 101, 93, 41, 58, 97, 99,
+    116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
+    61, 34, 116, 101, 120, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 112, 97, 115,
+    115, 119, 111, 114, 100, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32,
+    116, 101, 120, 116, 97, 114, 101, 97, 58, 97, 99, 116, 105, 118, 101, 32,
+    123, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108,
+    111, 114, 58, 66, 117, 116, 116, 111, 110, 83, 104, 97, 100, 111, 119, 59,
+    32, 125
 };
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h b/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h
index 568670b26e..e991ed7bee 100644
--- a/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h
+++ b/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h
@@ -30,7 +30,7 @@
 #ifndef WebKitVersion_h
 #define WebKitVersion_h
 
-#define WEBKIT_MAJOR_VERSION 532
-#define WEBKIT_MINOR_VERSION 4
+#define WEBKIT_MAJOR_VERSION 533
+#define WEBKIT_MINOR_VERSION 3
 
 #endif //WebKitVersion_h
diff --git a/src/3rdparty/webkit/WebCore/generated/XLinkNames.cpp b/src/3rdparty/webkit/WebCore/generated/XLinkNames.cpp
index 732c553088..2dc90399fa 100644
--- a/src/3rdparty/webkit/WebCore/generated/XLinkNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/XLinkNames.cpp
@@ -70,15 +70,6 @@ WebCore::QualifiedName** getXLinkAttrs(size_t* size)
     return XLinkAttr;
 }
 
-// Attributes as strings
-char actuateAttrString[] = "actuate";
-char arcroleAttrString[] = "arcrole";
-char hrefAttrString[] = "href";
-char roleAttrString[] = "role";
-char showAttrString[] = "show";
-char titleAttrString[] = "title";
-char typeAttrString[] = "type";
-
 void init()
 {
     static bool initialized = false;
@@ -95,13 +86,13 @@ void init()
     new ((void*)&xlinkNamespaceURI) AtomicString(xlinkNS);
 
     // Attributes
-    new ((void*)&actuateAttr) QualifiedName(nullAtom, actuateAttrString, xlinkNS);
-    new ((void*)&arcroleAttr) QualifiedName(nullAtom, arcroleAttrString, xlinkNS);
-    new ((void*)&hrefAttr) QualifiedName(nullAtom, hrefAttrString, xlinkNS);
-    new ((void*)&roleAttr) QualifiedName(nullAtom, roleAttrString, xlinkNS);
-    new ((void*)&showAttr) QualifiedName(nullAtom, showAttrString, xlinkNS);
-    new ((void*)&titleAttr) QualifiedName(nullAtom, titleAttrString, xlinkNS);
-    new ((void*)&typeAttr) QualifiedName(nullAtom, typeAttrString, xlinkNS);
+    new ((void*)&actuateAttr) QualifiedName(nullAtom, "actuate", xlinkNS);
+    new ((void*)&arcroleAttr) QualifiedName(nullAtom, "arcrole", xlinkNS);
+    new ((void*)&hrefAttr) QualifiedName(nullAtom, "href", xlinkNS);
+    new ((void*)&roleAttr) QualifiedName(nullAtom, "role", xlinkNS);
+    new ((void*)&showAttr) QualifiedName(nullAtom, "show", xlinkNS);
+    new ((void*)&titleAttr) QualifiedName(nullAtom, "title", xlinkNS);
+    new ((void*)&typeAttr) QualifiedName(nullAtom, "type", xlinkNS);
 }
 
 } }
diff --git a/src/3rdparty/webkit/WebCore/generated/XLinkNames.h b/src/3rdparty/webkit/WebCore/generated/XLinkNames.h
index a07e1637c7..e9087a70ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/XLinkNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/XLinkNames.h
@@ -42,19 +42,12 @@ extern const WebCore::AtomicString xlinkNamespaceURI;
 
 // Attributes
 extern const WebCore::QualifiedName actuateAttr;
-extern char actuateAttrString[];
 extern const WebCore::QualifiedName arcroleAttr;
-extern char arcroleAttrString[];
 extern const WebCore::QualifiedName hrefAttr;
-extern char hrefAttrString[];
 extern const WebCore::QualifiedName roleAttr;
-extern char roleAttrString[];
 extern const WebCore::QualifiedName showAttr;
-extern char showAttrString[];
 extern const WebCore::QualifiedName titleAttr;
-extern char titleAttrString[];
 extern const WebCore::QualifiedName typeAttr;
-extern char typeAttrString[];
 #endif
 
 WebCore::QualifiedName** getXLinkAttrs(size_t* size);
diff --git a/src/3rdparty/webkit/WebCore/platform/android/DragDataAndroid.cpp b/src/3rdparty/webkit/WebCore/generated/XMLNSNames.cpp
index 39b296342f..78da2fd58e 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/DragDataAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/XMLNSNames.cpp
@@ -1,6 +1,9 @@
 /*
- * Copyright 2009, The Android Open Source Project
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ *
+ * This file was generated by the dom/make_names.pl script.
+ *
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -21,76 +24,58 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
-#include "DragData.h"
+#ifdef SKIP_STATIC_CONSTRUCTORS_ON_GCC
+#define DOM_XMLNSNAMES_HIDE_GLOBALS 1
+#else
+#define QNAME_DEFAULT_CONSTRUCTOR 1
+#endif
 
-#include "Clipboard.h"
-#include "Document.h"
-#include "DocumentFragment.h"
+#include "XMLNSNames.h"
 
+#include "StaticConstructors.h"
 namespace WebCore {
 
-bool DragData::canSmartReplace() const
-{
-    return false;
-}
-    
-bool DragData::containsColor() const
-{
-    return false;
-}
+ namespace XMLNSNames {
 
-bool DragData::containsPlainText() const
-{
-    return false;
-}
+using namespace WebCore;
 
-String DragData::asPlainText() const
-{
-    return String();
-}
-    
-Color DragData::asColor() const
-{
-    return Color();
-}
-    
-PassRefPtr<Clipboard> DragData::createClipboard(ClipboardAccessPolicy) const
-{
-    return 0;
-}
-    
-bool DragData::containsCompatibleContent() const
-{
-    return false;
-}
-    
-bool DragData::containsURL() const
+DEFINE_GLOBAL(AtomicString, xmlnsNamespaceURI, "http://www.w3.org/2000/xmlns/")
+
+// Attributes
+DEFINE_GLOBAL(QualifiedName, xmlnsAttr, nullAtom, "xmlns", xmlnsNamespaceURI);
+
+
+WebCore::QualifiedName** getXMLNSAttrs(size_t* size)
 {
-    return false;
+    static WebCore::QualifiedName* XMLNSAttr[] = {
+        (WebCore::QualifiedName*)&xmlnsAttr,
+    };
+    *size = 1;
+    return XMLNSAttr;
 }
-    
-String DragData::asURL(String*) const
+
+void init()
 {
-    return String();
-}
+    static bool initialized = false;
+    if (initialized)
+        return;
+    initialized = true;
     
+    // Use placement new to initialize the globals.
     
-PassRefPtr<DocumentFragment> DragData::asFragment(Document*) const
-{
-    return 0;
-}
+    AtomicString::init();
+    AtomicString xmlnsNS("http://www.w3.org/2000/xmlns/");
 
-void DragData::asFilenames(Vector<String>&) const
-{
-}
+    // Namespace
+    new ((void*)&xmlnsNamespaceURI) AtomicString(xmlnsNS);
 
-bool DragData::containsFiles() const
-{
-    return false;
+    // Attributes
+    new ((void*)&xmlnsAttr) QualifiedName(nullAtom, "xmlns", xmlnsNS);
 }
 
-} // namespace WebCore
+} }
+
diff --git a/src/3rdparty/webkit/WebCore/generated/XMLNSNames.h b/src/3rdparty/webkit/WebCore/generated/XMLNSNames.h
new file mode 100644
index 0000000000..4f41dff0f7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/XMLNSNames.h
@@ -0,0 +1,54 @@
+/*
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ *
+ * This file was generated by the dom/make_names.pl script.
+ *
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DOM_XMLNSNAMES_H
+#define DOM_XMLNSNAMES_H
+
+#include "QualifiedName.h"
+
+namespace WebCore {
+
+ namespace XMLNSNames {
+
+#ifndef DOM_XMLNSNAMES_HIDE_GLOBALS
+// Namespace
+extern const WebCore::AtomicString xmlnsNamespaceURI;
+
+// Attributes
+extern const WebCore::QualifiedName xmlnsAttr;
+#endif
+
+WebCore::QualifiedName** getXMLNSAttrs(size_t* size);
+
+void init();
+
+} }
+
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/generated/XMLNames.cpp b/src/3rdparty/webkit/WebCore/generated/XMLNames.cpp
index cd8e1233c0..1eae32ecb5 100644
--- a/src/3rdparty/webkit/WebCore/generated/XMLNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/XMLNames.cpp
@@ -62,8 +62,6 @@ WebCore::QualifiedName** getXMLAttrs(size_t* size)
     return XMLAttr;
 }
 
-// Attributes as strings
-
 void init()
 {
     static bool initialized = false;
@@ -80,12 +78,9 @@ void init()
     new ((void*)&xmlNamespaceURI) AtomicString(xmlNS);
 
     // Attributes
-    const char *baseAttrString = "base";
-    const char *langAttrString = "lang";
-    const char *spaceAttrString = "space";
-    new ((void*)&baseAttr) QualifiedName(nullAtom, baseAttrString, xmlNS);
-    new ((void*)&langAttr) QualifiedName(nullAtom, langAttrString, xmlNS);
-    new ((void*)&spaceAttr) QualifiedName(nullAtom, spaceAttrString, xmlNS);
+    new ((void*)&baseAttr) QualifiedName(nullAtom, "base", xmlNS);
+    new ((void*)&langAttr) QualifiedName(nullAtom, "lang", xmlNS);
+    new ((void*)&spaceAttr) QualifiedName(nullAtom, "space", xmlNS);
 }
 
 } }
diff --git a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp
index 5f34852a13..7a54748567 100644
--- a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp
@@ -76,7 +76,7 @@
 /* Copy the first part of user declarations.  */
 
 /* Line 189 of yacc.c  */
-#line 28 "../xml/XPathGrammar.y"
+#line 28 "xml\\XPathGrammar.y"
 
 
 #include "config.h"
@@ -107,7 +107,7 @@ using namespace XPath;
 
 
 /* Line 189 of yacc.c  */
-#line 111 "WebCore/tmp/../generated/XPathGrammar.tab.c"
+#line 111 "C:/dev/webkit-2.0/WebCore/generated/XPathGrammar.tab.c"
 
 /* Enabling traces.  */
 #ifndef YYDEBUG
@@ -162,7 +162,7 @@ typedef union YYSTYPE
 {
 
 /* Line 214 of yacc.c  */
-#line 60 "../xml/XPathGrammar.y"
+#line 60 "xml\\XPathGrammar.y"
 
     Step::Axis axis;
     Step::NodeTest* nodeTest;
@@ -178,7 +178,7 @@ typedef union YYSTYPE
 
 
 /* Line 214 of yacc.c  */
-#line 182 "WebCore/tmp/../generated/XPathGrammar.tab.c"
+#line 182 "C:/dev/webkit-2.0/WebCore/generated/XPathGrammar.tab.c"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
@@ -189,7 +189,7 @@ typedef union YYSTYPE
 /* Copy the second part of user declarations.  */
 
 /* Line 264 of yacc.c  */
-#line 73 "../xml/XPathGrammar.y"
+#line 73 "xml\\XPathGrammar.y"
 
 
 static int xpathyylex(YYSTYPE* yylval) { return Parser::current()->lex(yylval); }
@@ -198,7 +198,7 @@ static void xpathyyerror(const char*) { }
 
 
 /* Line 264 of yacc.c  */
-#line 202 "WebCore/tmp/../generated/XPathGrammar.tab.c"
+#line 202 "C:/dev/webkit-2.0/WebCore/generated/XPathGrammar.tab.c"
 
 #ifdef short
 # undef short
@@ -1483,7 +1483,7 @@ yyreduce:
         case 2:
 
 /* Line 1455 of yacc.c  */
-#line 122 "../xml/XPathGrammar.y"
+#line 122 "xml\\XPathGrammar.y"
     {
         PARSER->m_topExpr = (yyvsp[(1) - (1)].expr);
     ;}
@@ -1492,7 +1492,7 @@ yyreduce:
   case 3:
 
 /* Line 1455 of yacc.c  */
-#line 129 "../xml/XPathGrammar.y"
+#line 129 "xml\\XPathGrammar.y"
     {
         (yyval.locationPath)->setAbsolute(false);
     ;}
@@ -1501,7 +1501,7 @@ yyreduce:
   case 4:
 
 /* Line 1455 of yacc.c  */
-#line 134 "../xml/XPathGrammar.y"
+#line 134 "xml\\XPathGrammar.y"
     {
         (yyval.locationPath)->setAbsolute(true);
     ;}
@@ -1510,7 +1510,7 @@ yyreduce:
   case 5:
 
 /* Line 1455 of yacc.c  */
-#line 141 "../xml/XPathGrammar.y"
+#line 141 "xml\\XPathGrammar.y"
     {
         (yyval.locationPath) = new LocationPath;
         PARSER->registerParseNode((yyval.locationPath));
@@ -1520,7 +1520,7 @@ yyreduce:
   case 6:
 
 /* Line 1455 of yacc.c  */
-#line 147 "../xml/XPathGrammar.y"
+#line 147 "xml\\XPathGrammar.y"
     {
         (yyval.locationPath) = (yyvsp[(2) - (2)].locationPath);
     ;}
@@ -1529,7 +1529,7 @@ yyreduce:
   case 7:
 
 /* Line 1455 of yacc.c  */
-#line 152 "../xml/XPathGrammar.y"
+#line 152 "xml\\XPathGrammar.y"
     {
         (yyval.locationPath) = (yyvsp[(2) - (2)].locationPath);
         (yyval.locationPath)->insertFirstStep((yyvsp[(1) - (2)].step));
@@ -1540,7 +1540,7 @@ yyreduce:
   case 8:
 
 /* Line 1455 of yacc.c  */
-#line 161 "../xml/XPathGrammar.y"
+#line 161 "xml\\XPathGrammar.y"
     {
         (yyval.locationPath) = new LocationPath;
         (yyval.locationPath)->appendStep((yyvsp[(1) - (1)].step));
@@ -1552,7 +1552,7 @@ yyreduce:
   case 9:
 
 /* Line 1455 of yacc.c  */
-#line 169 "../xml/XPathGrammar.y"
+#line 169 "xml\\XPathGrammar.y"
     {
         (yyval.locationPath)->appendStep((yyvsp[(3) - (3)].step));
         PARSER->unregisterParseNode((yyvsp[(3) - (3)].step));
@@ -1562,7 +1562,7 @@ yyreduce:
   case 10:
 
 /* Line 1455 of yacc.c  */
-#line 175 "../xml/XPathGrammar.y"
+#line 175 "xml\\XPathGrammar.y"
     {
         (yyval.locationPath)->appendStep((yyvsp[(2) - (3)].step));
         (yyval.locationPath)->appendStep((yyvsp[(3) - (3)].step));
@@ -1574,7 +1574,7 @@ yyreduce:
   case 11:
 
 /* Line 1455 of yacc.c  */
-#line 185 "../xml/XPathGrammar.y"
+#line 185 "xml\\XPathGrammar.y"
     {
         if ((yyvsp[(2) - (2)].predList)) {
             (yyval.step) = new Step(Step::ChildAxis, *(yyvsp[(1) - (2)].nodeTest), *(yyvsp[(2) - (2)].predList));
@@ -1589,7 +1589,7 @@ yyreduce:
   case 12:
 
 /* Line 1455 of yacc.c  */
-#line 196 "../xml/XPathGrammar.y"
+#line 196 "xml\\XPathGrammar.y"
     {
         String localName;
         String namespaceURI;
@@ -1611,7 +1611,7 @@ yyreduce:
   case 13:
 
 /* Line 1455 of yacc.c  */
-#line 214 "../xml/XPathGrammar.y"
+#line 214 "xml\\XPathGrammar.y"
     {
         if ((yyvsp[(3) - (3)].predList)) {
             (yyval.step) = new Step((yyvsp[(1) - (3)].axis), *(yyvsp[(2) - (3)].nodeTest), *(yyvsp[(3) - (3)].predList));
@@ -1626,7 +1626,7 @@ yyreduce:
   case 14:
 
 /* Line 1455 of yacc.c  */
-#line 225 "../xml/XPathGrammar.y"
+#line 225 "xml\\XPathGrammar.y"
     {
         String localName;
         String namespaceURI;
@@ -1648,7 +1648,7 @@ yyreduce:
   case 17:
 
 /* Line 1455 of yacc.c  */
-#line 249 "../xml/XPathGrammar.y"
+#line 249 "xml\\XPathGrammar.y"
     {
         (yyval.axis) = Step::AttributeAxis;
     ;}
@@ -1657,7 +1657,7 @@ yyreduce:
   case 18:
 
 /* Line 1455 of yacc.c  */
-#line 256 "../xml/XPathGrammar.y"
+#line 256 "xml\\XPathGrammar.y"
     {
         if (*(yyvsp[(1) - (3)].str) == "node")
             (yyval.nodeTest) = new Step::NodeTest(Step::NodeTest::AnyNodeTest);
@@ -1674,7 +1674,7 @@ yyreduce:
   case 19:
 
 /* Line 1455 of yacc.c  */
-#line 269 "../xml/XPathGrammar.y"
+#line 269 "xml\\XPathGrammar.y"
     {
         (yyval.nodeTest) = new Step::NodeTest(Step::NodeTest::ProcessingInstructionNodeTest);
         PARSER->deleteString((yyvsp[(1) - (3)].str));        
@@ -1685,7 +1685,7 @@ yyreduce:
   case 20:
 
 /* Line 1455 of yacc.c  */
-#line 276 "../xml/XPathGrammar.y"
+#line 276 "xml\\XPathGrammar.y"
     {
         (yyval.nodeTest) = new Step::NodeTest(Step::NodeTest::ProcessingInstructionNodeTest, (yyvsp[(3) - (4)].str)->stripWhiteSpace());
         PARSER->deleteString((yyvsp[(1) - (4)].str));        
@@ -1697,7 +1697,7 @@ yyreduce:
   case 21:
 
 /* Line 1455 of yacc.c  */
-#line 286 "../xml/XPathGrammar.y"
+#line 286 "xml\\XPathGrammar.y"
     {
         (yyval.predList) = 0;
     ;}
@@ -1706,7 +1706,7 @@ yyreduce:
   case 23:
 
 /* Line 1455 of yacc.c  */
-#line 295 "../xml/XPathGrammar.y"
+#line 295 "xml\\XPathGrammar.y"
     {
         (yyval.predList) = new Vector<Predicate*>;
         (yyval.predList)->append(new Predicate((yyvsp[(1) - (1)].expr)));
@@ -1718,7 +1718,7 @@ yyreduce:
   case 24:
 
 /* Line 1455 of yacc.c  */
-#line 303 "../xml/XPathGrammar.y"
+#line 303 "xml\\XPathGrammar.y"
     {
         (yyval.predList)->append(new Predicate((yyvsp[(2) - (2)].expr)));
         PARSER->unregisterParseNode((yyvsp[(2) - (2)].expr));
@@ -1728,7 +1728,7 @@ yyreduce:
   case 25:
 
 /* Line 1455 of yacc.c  */
-#line 311 "../xml/XPathGrammar.y"
+#line 311 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = (yyvsp[(2) - (3)].expr);
     ;}
@@ -1737,7 +1737,7 @@ yyreduce:
   case 26:
 
 /* Line 1455 of yacc.c  */
-#line 318 "../xml/XPathGrammar.y"
+#line 318 "xml\\XPathGrammar.y"
     {
         (yyval.step) = new Step(Step::DescendantOrSelfAxis, Step::NodeTest(Step::NodeTest::AnyNodeTest));
         PARSER->registerParseNode((yyval.step));
@@ -1747,7 +1747,7 @@ yyreduce:
   case 27:
 
 /* Line 1455 of yacc.c  */
-#line 326 "../xml/XPathGrammar.y"
+#line 326 "xml\\XPathGrammar.y"
     {
         (yyval.step) = new Step(Step::SelfAxis, Step::NodeTest(Step::NodeTest::AnyNodeTest));
         PARSER->registerParseNode((yyval.step));
@@ -1757,7 +1757,7 @@ yyreduce:
   case 28:
 
 /* Line 1455 of yacc.c  */
-#line 332 "../xml/XPathGrammar.y"
+#line 332 "xml\\XPathGrammar.y"
     {
         (yyval.step) = new Step(Step::ParentAxis, Step::NodeTest(Step::NodeTest::AnyNodeTest));
         PARSER->registerParseNode((yyval.step));
@@ -1767,7 +1767,7 @@ yyreduce:
   case 29:
 
 /* Line 1455 of yacc.c  */
-#line 340 "../xml/XPathGrammar.y"
+#line 340 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = new VariableReference(*(yyvsp[(1) - (1)].str));
         PARSER->deleteString((yyvsp[(1) - (1)].str));
@@ -1778,7 +1778,7 @@ yyreduce:
   case 30:
 
 /* Line 1455 of yacc.c  */
-#line 347 "../xml/XPathGrammar.y"
+#line 347 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = (yyvsp[(2) - (3)].expr);
     ;}
@@ -1787,7 +1787,7 @@ yyreduce:
   case 31:
 
 /* Line 1455 of yacc.c  */
-#line 352 "../xml/XPathGrammar.y"
+#line 352 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = new StringExpression(*(yyvsp[(1) - (1)].str));
         PARSER->deleteString((yyvsp[(1) - (1)].str));
@@ -1798,7 +1798,7 @@ yyreduce:
   case 32:
 
 /* Line 1455 of yacc.c  */
-#line 359 "../xml/XPathGrammar.y"
+#line 359 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = new Number((yyvsp[(1) - (1)].str)->toDouble());
         PARSER->deleteString((yyvsp[(1) - (1)].str));
@@ -1809,7 +1809,7 @@ yyreduce:
   case 34:
 
 /* Line 1455 of yacc.c  */
-#line 370 "../xml/XPathGrammar.y"
+#line 370 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = createFunction(*(yyvsp[(1) - (3)].str));
         if (!(yyval.expr))
@@ -1822,7 +1822,7 @@ yyreduce:
   case 35:
 
 /* Line 1455 of yacc.c  */
-#line 379 "../xml/XPathGrammar.y"
+#line 379 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = createFunction(*(yyvsp[(1) - (4)].str), *(yyvsp[(3) - (4)].argList));
         if (!(yyval.expr))
@@ -1836,7 +1836,7 @@ yyreduce:
   case 36:
 
 /* Line 1455 of yacc.c  */
-#line 391 "../xml/XPathGrammar.y"
+#line 391 "xml\\XPathGrammar.y"
     {
         (yyval.argList) = new Vector<Expression*>;
         (yyval.argList)->append((yyvsp[(1) - (1)].expr));
@@ -1848,7 +1848,7 @@ yyreduce:
   case 37:
 
 /* Line 1455 of yacc.c  */
-#line 399 "../xml/XPathGrammar.y"
+#line 399 "xml\\XPathGrammar.y"
     {
         (yyval.argList)->append((yyvsp[(3) - (3)].expr));
         PARSER->unregisterParseNode((yyvsp[(3) - (3)].expr));
@@ -1858,7 +1858,7 @@ yyreduce:
   case 40:
 
 /* Line 1455 of yacc.c  */
-#line 413 "../xml/XPathGrammar.y"
+#line 413 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = new Union;
         (yyval.expr)->addSubExpression((yyvsp[(1) - (3)].expr));
@@ -1872,7 +1872,7 @@ yyreduce:
   case 41:
 
 /* Line 1455 of yacc.c  */
-#line 425 "../xml/XPathGrammar.y"
+#line 425 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = (yyvsp[(1) - (1)].locationPath);
     ;}
@@ -1881,7 +1881,7 @@ yyreduce:
   case 43:
 
 /* Line 1455 of yacc.c  */
-#line 432 "../xml/XPathGrammar.y"
+#line 432 "xml\\XPathGrammar.y"
     {
         (yyvsp[(3) - (3)].locationPath)->setAbsolute(true);
         (yyval.expr) = new Path(static_cast<Filter*>((yyvsp[(1) - (3)].expr)), (yyvsp[(3) - (3)].locationPath));
@@ -1894,7 +1894,7 @@ yyreduce:
   case 44:
 
 /* Line 1455 of yacc.c  */
-#line 441 "../xml/XPathGrammar.y"
+#line 441 "xml\\XPathGrammar.y"
     {
         (yyvsp[(3) - (3)].locationPath)->insertFirstStep((yyvsp[(2) - (3)].step));
         (yyvsp[(3) - (3)].locationPath)->setAbsolute(true);
@@ -1909,7 +1909,7 @@ yyreduce:
   case 46:
 
 /* Line 1455 of yacc.c  */
-#line 456 "../xml/XPathGrammar.y"
+#line 456 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = new Filter((yyvsp[(1) - (2)].expr), *(yyvsp[(2) - (2)].predList));
         PARSER->unregisterParseNode((yyvsp[(1) - (2)].expr));
@@ -1921,7 +1921,7 @@ yyreduce:
   case 48:
 
 /* Line 1455 of yacc.c  */
-#line 468 "../xml/XPathGrammar.y"
+#line 468 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = new LogicalOp(LogicalOp::OP_Or, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
         PARSER->unregisterParseNode((yyvsp[(1) - (3)].expr));
@@ -1933,7 +1933,7 @@ yyreduce:
   case 50:
 
 /* Line 1455 of yacc.c  */
-#line 480 "../xml/XPathGrammar.y"
+#line 480 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = new LogicalOp(LogicalOp::OP_And, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
         PARSER->unregisterParseNode((yyvsp[(1) - (3)].expr));
@@ -1945,7 +1945,7 @@ yyreduce:
   case 52:
 
 /* Line 1455 of yacc.c  */
-#line 492 "../xml/XPathGrammar.y"
+#line 492 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = new EqTestOp((yyvsp[(2) - (3)].eqop), (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
         PARSER->unregisterParseNode((yyvsp[(1) - (3)].expr));
@@ -1957,7 +1957,7 @@ yyreduce:
   case 54:
 
 /* Line 1455 of yacc.c  */
-#line 504 "../xml/XPathGrammar.y"
+#line 504 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = new EqTestOp((yyvsp[(2) - (3)].eqop), (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
         PARSER->unregisterParseNode((yyvsp[(1) - (3)].expr));
@@ -1969,7 +1969,7 @@ yyreduce:
   case 56:
 
 /* Line 1455 of yacc.c  */
-#line 516 "../xml/XPathGrammar.y"
+#line 516 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = new NumericOp(NumericOp::OP_Add, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
         PARSER->unregisterParseNode((yyvsp[(1) - (3)].expr));
@@ -1981,7 +1981,7 @@ yyreduce:
   case 57:
 
 /* Line 1455 of yacc.c  */
-#line 524 "../xml/XPathGrammar.y"
+#line 524 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = new NumericOp(NumericOp::OP_Sub, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
         PARSER->unregisterParseNode((yyvsp[(1) - (3)].expr));
@@ -1993,7 +1993,7 @@ yyreduce:
   case 59:
 
 /* Line 1455 of yacc.c  */
-#line 536 "../xml/XPathGrammar.y"
+#line 536 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = new NumericOp((yyvsp[(2) - (3)].numop), (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
         PARSER->unregisterParseNode((yyvsp[(1) - (3)].expr));
@@ -2005,7 +2005,7 @@ yyreduce:
   case 61:
 
 /* Line 1455 of yacc.c  */
-#line 548 "../xml/XPathGrammar.y"
+#line 548 "xml\\XPathGrammar.y"
     {
         (yyval.expr) = new Negative;
         (yyval.expr)->addSubExpression((yyvsp[(2) - (2)].expr));
@@ -2017,7 +2017,7 @@ yyreduce:
 
 
 /* Line 1455 of yacc.c  */
-#line 2021 "WebCore/tmp/../generated/XPathGrammar.tab.c"
+#line 2021 "C:/dev/webkit-2.0/WebCore/generated/XPathGrammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -2229,7 +2229,7 @@ yyreturn:
 
 
 /* Line 1675 of yacc.c  */
-#line 556 "../xml/XPathGrammar.y"
+#line 556 "xml\\XPathGrammar.y"
 
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h
index cdf2b32539..c3dbd2ba12 100644
--- a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h
+++ b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h
@@ -67,7 +67,7 @@ typedef union YYSTYPE
 {
 
 /* Line 1676 of yacc.c  */
-#line 60 "../xml/XPathGrammar.y"
+#line 60 "xml\\XPathGrammar.y"
 
     Step::Axis axis;
     Step::NodeTest* nodeTest;
@@ -83,7 +83,7 @@ typedef union YYSTYPE
 
 
 /* Line 1676 of yacc.c  */
-#line 87 "WebCore/tmp/../generated/XPathGrammar.tab.h"
+#line 87 "C:/dev/webkit-2.0/WebCore/generated/XPathGrammar.tab.h"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
diff --git a/src/3rdparty/webkit/WebCore/generated/chartables.c b/src/3rdparty/webkit/WebCore/generated/chartables.c
deleted file mode 100644
index 5c99db0b98..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/chartables.c
+++ /dev/null
@@ -1,96 +0,0 @@
-/*************************************************
-*      Perl-Compatible Regular Expressions       *
-*************************************************/
-
-/* This file is automatically written by the dftables auxiliary 
-program. If you edit it by hand, you might like to edit the Makefile to 
-prevent its ever being regenerated.
-
-This file contains the default tables for characters with codes less than
-128 (ASCII characters). These tables are used when no external tables are
-passed to PCRE. */
-
-const unsigned char jsc_pcre_default_tables[480] = {
-
-/* This table is a lower casing table. */
-
-  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 
-  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 
-  0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 
-  0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 
-  0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 
-  0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 
-  0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 
-  0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 
-  0x40, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 
-  0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 
-  0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 
-  0x78, 0x79, 0x7A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 
-  0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 
-  0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 
-  0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 
-  0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F,
-
-/* This table is a case flipping table. */
-
-  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 
-  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 
-  0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 
-  0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 
-  0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 
-  0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 
-  0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 
-  0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 
-  0x40, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 
-  0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 
-  0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 
-  0x78, 0x79, 0x7A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 
-  0x60, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 
-  0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 
-  0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 
-  0x58, 0x59, 0x5A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F,
-
-/* This table contains bit maps for various character classes.
-Each map is 32 bytes long and the bits run from the least
-significant end of each byte. The classes are: space, digit, word. */
-
-  0x00, 0x3E, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 
-  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
-  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
-  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
-
-  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0x03, 
-  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
-  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
-  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
-
-  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0x03, 
-  0xFE, 0xFF, 0xFF, 0x87, 0xFE, 0xFF, 0xFF, 0x07, 
-  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
-  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-
-/* This table identifies various classes of character by individual bits:
-  0x01   white space character
-  0x08   hexadecimal digit
-  0x10   alphanumeric or '_'
-*/
-
-  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  /*   0-  7 */
-  0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x00,  /*   8- 15 */
-  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  /*  16- 23 */
-  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  /*  24- 31 */
-  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  /*    - '  */
-  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  /*  ( - /  */
-  0x18, 0x18, 0x18, 0x18, 0x18, 0x18, 0x18, 0x18,  /*  0 - 7  */
-  0x18, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  /*  8 - ?  */
-  0x00, 0x18, 0x18, 0x18, 0x18, 0x18, 0x18, 0x10,  /*  @ - G  */
-  0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10,  /*  H - O  */
-  0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10,  /*  P - W  */
-  0x10, 0x10, 0x10, 0x00, 0x00, 0x00, 0x00, 0x10,  /*  X - _  */
-  0x00, 0x18, 0x18, 0x18, 0x18, 0x18, 0x18, 0x10,  /*  ` - g  */
-  0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10,  /*  h - o  */
-  0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10,  /*  p - w  */
-  0x10, 0x10, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00}; /*  x -127 */
-
-
-/* End of chartables.c */
diff --git a/src/3rdparty/webkit/WebCore/generated/tokenizer.cpp b/src/3rdparty/webkit/WebCore/generated/tokenizer.cpp
index a0f10b5df8..d9a94f559d 100644
--- a/src/3rdparty/webkit/WebCore/generated/tokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/tokenizer.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  *
  *
@@ -67,70 +65,64 @@ typedef unsigned int flex_uint32_t;
 #endif /* ! C99 */
 #define YY_NUM_RULES 69
 #define YY_END_OF_BUFFER 70
-/* This struct is not used in this scanner,
-   but its presence is necessary. */
-struct yy_trans_info
-	{
-	flex_int32_t yy_verify;
-	flex_int32_t yy_nxt;
-	};
-static yyconst flex_int16_t yy_accept[481] =
+static yyconst short int yy_accept[482] =
     {   0,
         0,    0,    0,    0,    0,    0,   70,   68,    2,    2,
-       68,   68,   68,   68,   68,   68,   68,   68,   68,   57,
-       68,   68,   15,   15,   15,   68,   68,   68,   68,   67,
-       15,   15,   15,   66,   15,    2,    0,    0,    0,   14,
-        0,    0,    0,   18,   18,    0,    8,    0,    0,    9,
-        0,    0,   15,   15,   15,    0,   58,    0,   56,    0,
-        0,   57,   55,   55,   55,   55,   55,   55,   55,   55,
-       55,   16,   55,   55,   52,   55,    0,   55,    0,    0,
-       35,   35,   35,   35,   35,   35,   35,    0,   63,   15,
-        0,    0,   15,   15,    0,   15,   15,   15,    7,    6,
-
-        5,   15,   15,   15,   15,    0,    0,    0,   14,    0,
-        0,    0,   18,   18,    0,   18,   18,    0,    0,   14,
-        0,    0,    4,   16,   15,    0,    0,   55,    0,   42,
-       55,   37,   40,   55,   53,   44,   55,   43,   51,   55,
-       46,   45,   41,   55,   55,   55,   55,   55,   55,    0,
-       35,   35,    0,   35,   35,   35,   35,   35,   35,   35,
-       35,   15,   15,   16,   15,   15,   64,   64,   15,   15,
-       12,   10,   15,   13,    0,    0,    0,   17,   17,   18,
-       18,   18,    0,    0,   15,    0,    1,   55,   55,   47,
-       55,   54,   16,   48,   38,   55,   55,   55,    3,   35,
-
-       35,   35,   35,   35,   35,   35,   35,   35,   35,   15,
-       59,    0,   64,   64,   64,   63,   15,   11,    0,    0,
-        0,   18,   18,   18,    0,   15,    0,    0,   55,   49,
-       50,   55,   55,   35,   35,   35,   35,   35,   35,   35,
-       20,   35,   15,   65,   64,   64,   64,   64,    0,    0,
-        0,    0,   61,    0,   15,    0,    0,    0,   18,   18,
-       18,    0,   15,   55,   55,   39,   35,   35,   35,   35,
-       35,   21,   35,   35,   15,   65,   64,   64,   64,   64,
-       64,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-       61,    0,    0,   15,    0,    0,   17,   17,   18,   18,
-
-        0,   15,   55,   55,   35,   35,   35,   35,   19,   35,
-       35,   15,   65,   64,   64,   64,   64,   64,   64,    0,
-       60,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,   15,    0,    0,   18,   18,    0,   15,   55,
-       55,   35,   35,   23,   35,   35,   35,   15,   65,   64,
-       64,   64,   64,   64,   64,   64,    0,   60,    0,    0,
-        0,   60,    0,    0,    0,    0,   18,   15,   55,   35,
-       35,   35,   35,   65,    0,    0,    0,   36,   15,   35,
-       35,   35,   35,   35,   35,   22,   24,   65,    0,    0,
-        0,   15,   35,   35,   35,   35,   35,   35,    0,    0,
-
-        0,   63,   35,   35,   35,   35,   35,   35,   35,   35,
-        0,    0,    0,    0,    0,    0,   35,   35,   35,   35,
-       25,   35,   35,   35,    0,   62,    0,    0,    0,    0,
-       26,   35,   35,   35,   35,   27,   35,    0,    0,    0,
-        0,   31,   35,   35,   35,   35,    0,    0,    0,   35,
-       35,   35,   35,    0,    0,   35,   35,   29,   35,    0,
-        0,   35,   33,   35,   30,    0,    0,   35,   28,   35,
-        0,   35,   35,   35,   35,   34,   35,   35,   32,    0
+       68,   68,   68,   68,   68,   68,   68,   68,   68,   68,
+       57,   68,   68,   68,   68,   15,   15,   15,   68,   68,
+       67,   15,   15,   15,   66,   15,    2,    0,    0,    0,
+       14,    0,    0,    0,    0,   18,   18,    8,    0,    0,
+        9,    0,   16,    0,    0,   15,   15,   15,   58,    0,
+       56,    0,    0,   57,    0,   55,   55,   55,   55,   55,
+       55,   55,   55,   55,   55,   16,   55,   55,   52,   55,
+        0,    0,    0,   35,   35,   35,   35,   35,   35,   35,
+       15,   15,    7,   63,   15,    0,    0,   15,   15,    0,
+
+       15,    6,    5,   15,   15,   15,   15,    0,    0,    0,
+       14,    0,    0,    0,   18,   18,   18,    0,   18,    0,
+        0,   14,    0,    0,    4,   15,    0,    0,   55,   55,
+       55,    0,   55,   42,   55,   37,   40,   55,   53,   44,
+       55,   43,   51,   55,   46,   45,   41,   55,   55,   55,
+        0,   35,   35,   35,   35,    0,   35,   35,   35,   35,
+       35,   35,   15,   15,   15,   16,   15,   15,   64,   64,
+       15,   12,   10,   15,   13,    0,    0,    0,   17,   18,
+       18,   18,   17,    0,    0,   15,    0,    1,   55,   55,
+       55,   55,   47,   55,   54,   16,   48,   38,   55,    3,
+
+       35,   35,   35,   35,   35,   35,   35,   35,   35,   35,
+       15,   15,   59,    0,   64,   64,   64,   63,   11,    0,
+        0,    0,   18,   18,   18,    0,   15,    0,    0,   55,
+       55,   55,   49,   50,   35,   35,   35,   35,   35,   35,
+       35,   35,   20,   15,   15,   65,   64,   64,   64,   64,
+        0,    0,    0,    0,   61,    0,    0,    0,    0,   18,
+       18,   18,    0,   15,   55,   55,   39,   35,   35,   35,
+       35,   35,   35,   21,   35,   15,   15,   65,   64,   64,
+       64,   64,   64,    0,    0,    0,    0,    0,    0,    0,
+        0,    0,   61,    0,    0,    0,    0,   17,   18,   18,
+
+       17,    0,   15,   55,   55,   35,   35,   35,   35,   35,
+       19,   35,   15,   15,   65,   64,   64,   64,   64,   64,
+       64,    0,   60,    0,    0,    0,    0,    0,    0,    0,
+        0,    0,    0,    0,    0,    0,   18,   18,    0,   15,
+       55,   55,   35,   35,   35,   23,   35,   35,   15,   65,
+       64,   64,   64,   64,   64,   64,   64,    0,   60,    0,
+        0,    0,   60,    0,    0,    0,    0,   18,   15,   55,
+       35,   35,   35,   35,   65,    0,    0,    0,   36,   15,
+       35,   35,   35,   35,   35,   35,   22,   24,   65,    0,
+        0,    0,   15,   35,   35,   35,   35,   35,   35,    0,
+
+        0,    0,   63,   35,   35,   35,   35,   35,   35,   35,
+       35,    0,    0,    0,    0,    0,    0,   35,   35,   35,
+       35,   25,   35,   35,   35,    0,    0,    0,   62,    0,
+        0,   26,   35,   35,   35,   35,   27,   35,    0,    0,
+        0,    0,   31,   35,   35,   35,   35,    0,    0,    0,
+       35,   35,   35,   35,    0,    0,   35,   35,   29,   35,
+        0,    0,   35,   33,   35,   30,    0,    0,   35,   28,
+       35,    0,   35,   35,   35,   35,   34,   35,   35,   32,
+        0
     } ;
 
-static yyconst flex_int32_t yy_ec[256] =
+static yyconst int yy_ec[256] =
     {   0,
         1,    1,    1,    1,    1,    1,    1,    1,    2,    3,
         1,    4,    5,    1,    1,    1,    1,    1,    1,    1,
@@ -138,911 +130,438 @@ static yyconst flex_int32_t yy_ec[256] =
         1,    6,    7,    8,    9,   10,   11,   12,   13,   14,
        15,   16,   17,   12,   18,   19,   20,   21,   21,   21,
        21,   21,   21,   21,   21,   21,   21,   12,   22,   23,
-       24,   25,   26,   27,   28,   29,   30,   31,   32,   33,
-       34,   35,   36,   37,   38,   39,   40,   41,   42,   43,
-       44,   45,   46,   47,   48,   49,   50,   51,   52,   53,
-       12,   54,   12,   55,   56,   12,   57,   58,   59,   60,
-
-       61,   62,   63,   64,   65,   37,   66,   67,   68,   69,
-       70,   71,   72,   73,   74,   75,   76,   77,   78,   79,
-       80,   81,   82,   83,   12,   84,    1,   85,   85,   85,
-       85,   85,   85,   85,   85,   85,   85,   85,   85,   85,
-       85,   85,   85,   85,   85,   85,   85,   85,   85,   85,
-       85,   85,   85,   85,   85,   85,   85,   85,   85,   85,
-       85,   85,   85,   85,   85,   85,   85,   85,   85,   85,
-       85,   85,   85,   85,   85,   85,   85,   85,   85,   85,
-       85,   85,   85,   85,   85,   85,   85,   85,   85,   85,
-       85,   85,   85,   85,   85,   85,   85,   85,   85,   85,
-
-       85,   85,   85,   85,   85,   85,   85,   85,   85,   85,
-       85,   85,   85,   85,   85,   85,   85,   85,   85,   85,
-       85,   85,   85,   85,   85,   85,   85,   85,   85,   85,
-       85,   85,   85,   85,   85,   85,   85,   85,   85,   85,
-       85,   85,   85,   85,   85,   85,   85,   85,   85,   85,
-       85,   85,   85,   85,   85
+       24,   25,   26,   27,   31,   32,   33,   34,   35,   36,
+       37,   38,   39,   40,   41,   42,   43,   44,   45,   46,
+       47,   48,   49,   50,   51,   52,   53,   54,   55,   56,
+       12,   28,   12,   29,   30,   12,   31,   32,   33,   34,
+
+       35,   36,   37,   38,   39,   40,   41,   42,   43,   44,
+       45,   46,   47,   48,   49,   50,   51,   52,   53,   54,
+       55,   56,   57,   58,   12,   59,    1,   60,   60,   60,
+       60,   60,   60,   60,   60,   60,   60,   60,   60,   60,
+       60,   60,   60,   60,   60,   60,   60,   60,   60,   60,
+       60,   60,   60,   60,   60,   60,   60,   60,   60,   60,
+       60,   60,   60,   60,   60,   60,   60,   60,   60,   60,
+       60,   60,   60,   60,   60,   60,   60,   60,   60,   60,
+       60,   60,   60,   60,   60,   60,   60,   60,   60,   60,
+       60,   60,   60,   60,   60,   60,   60,   60,   60,   60,
+
+       60,   60,   60,   60,   60,   60,   60,   60,   60,   60,
+       60,   60,   60,   60,   60,   60,   60,   60,   60,   60,
+       60,   60,   60,   60,   60,   60,   60,   60,   60,   60,
+       60,   60,   60,   60,   60,   60,   60,   60,   60,   60,
+       60,   60,   60,   60,   60,   60,   60,   60,   60,   60,
+       60,   60,   60,   60,   60
     } ;
 
-static yyconst flex_int32_t yy_meta[86] =
+static yyconst int yy_meta[61] =
     {   0,
-        1,    2,    3,    4,    4,    5,    6,    7,    6,    6,
-        6,    6,    7,    8,    9,    6,    6,   10,    6,    6,
-       11,    6,    6,    6,    6,   12,    6,   13,   13,   13,
-       13,   13,   13,   14,   14,   14,   14,   14,   14,   14,
-       14,   14,   14,   14,   14,   14,   14,   14,   14,   14,
-       14,   14,   14,   14,    6,   14,   13,   13,   13,   13,
-       13,   13,   14,   14,   14,   14,   14,   14,   14,   14,
-       14,   14,   14,   14,   14,   14,   14,   14,   14,   14,
-       14,    6,    6,    6,   14
+        1,    2,    3,    3,    3,    4,    5,    5,    5,    5,
+        5,    5,    5,    6,    7,    5,    5,    8,    5,    5,
+        9,    5,    5,    5,    5,   10,    5,   11,    5,   11,
+       12,   12,   12,   12,   12,   12,   11,   11,   11,   11,
+       11,   11,   11,   11,   11,   11,   11,   11,   11,   11,
+       11,   11,   11,   11,   11,   11,    5,    5,    5,   11
     } ;
 
-static yyconst flex_int16_t yy_base[552] =
+static yyconst short int yy_base[520] =
     {   0,
-        0,    0,   64,   66,   54,   56, 1515, 6578,   93,   98,
-      107,   83,  155, 1489,   77, 1480,   99, 1477, 1470,  207,
-     1477,  275,  100,  108,  125,  326, 1442, 1441, 1438, 6578,
-      141,  110,  151, 6578,  105,  197,  295,   89,  107, 6578,
-      387,  120,    0,  429, 1371,  471, 6578,  117,  532, 6578,
-     1380,  269,  137,  176,  281,  574,  283, 1383, 1367, 1297,
-     1329,    0, 1294,  249,  135,  282,  276,  153,   91,  169,
-      299,  308,  318,  342, 1293,  328,  616,  102, 1326,  273,
-     1288,  346,  127,  326,  369,  370,  374,  658, 6578,  208,
-      700, 1320,  357,  418, 1314,  399,  314,  761, 6578, 6578,
-
-     6578,  420,  421,  400,  398,  336,  461,  355,  367,  822,
-      883,    0, 1284,  925,  967, 1283, 1028,  351,  423,  460,
-     1089, 1150, 6578,  214,  465, 1320,  409, 1281, 1192, 1250,
-      278, 1240, 1225,  427, 1222, 1221,  444, 1218, 1217,  416,
-     1208, 1188, 1176,  451,  470,  467, 1173, 1253,  441, 1200,
-      485, 1140, 1295,  490,  500,  505,  489,  502,  517, 1115,
-     1356,  462, 1417, 1147,  554,  512,  193, 1133,  513, 1459,
-      543,  544,  558,  559,  436,  501, 1520,    0, 1562, 1062,
-     1623, 1684,  571, 1745,  563, 1092, 6578, 1053, 1806, 1000,
-      568,  996,  529,  989,  988,  546, 1848,  589, 6578,  597,
-
-      955, 1909,  566,  534,  588,  587,  608,  631, 1951, 2012,
-     6578,    0,  203,  963,  947,  691, 2054,  564,  551, 2115,
-        0, 2157, 2218, 2279, 2340,  646,  935,  637, 2401,  896,
-      884, 2443,  616,  660, 2504,  681,  388,  668,  626,  694,
-      878, 2546, 2607,    0,  288,  884,  876,  869,  793,  854,
-      611,  614, 6578, 2668, 2710,  634, 2771,    0, 2813, 2874,
-     2935, 2996, 3057, 3131, 3173, 3234,  669, 3295,  692,  716,
-      696,  823,  729, 3337, 3398,    0,  641,  842,  781,  753,
-      730,  829,  653,  834, 3459,  658, 3520,  894,  915,  920,
-      957, 3581, 3642, 3684,  557, 3745, 6578,  684, 3806, 3867,
-
-     3928, 3989, 4050, 4111,  727, 4172,  730,  682,  654,  697,
-     4214, 4275,    0,  646,  590,  556,  553,  526,  496,  962,
-     6578,  693,  734,  999, 4336, 4397,  690,  926, 1060, 4458,
-     4519, 4580,  988,  711, 1013, 4622, 4664, 1042,  768, 4706,
-     4767,  648, 4828,  454,  755,  757, 1074, 1033,    0,  489,
-     6578, 6578, 6578, 6578, 6578, 6578, 1121,  838,  898, 4870,
-     1182,  968, 1102, 4912, 4973,  729,  868,  785, 1066, 5005,
-     1135,  873, 1020,    0, 5062, 5104, 5146, 6578,  830, 1050,
-     1052, 1103, 1055, 1112,  836,  402,  386, 6578, 5188, 5230,
-     5272,  755, 1137,  809,  916, 1091, 1123, 1161, 5314, 5356,
-
-     1263, 1242, 1162, 1047,  874, 1138, 1144, 1209, 1185, 1178,
-     1285, 1295, 1316, 1327, 1388, 5398,  966, 1223, 1088,  921,
-      379, 1172, 1241, 1252, 1361, 6578, 1428, 5440, 1449, 5501,
-      368, 1314, 1315,  969, 1118,  173, 1342, 1454, 5562, 1491,
-     5604,  170, 1343, 1325,  824, 1341, 1531, 5646, 5688, 1374,
-     1375, 1427, 1407, 5730, 5772, 1453, 1456,  154, 1328, 5814,
-     5856, 1457,  112, 1080,  811, 5898, 1552, 1350,  109, 1413,
-     1557, 1370, 1409, 1451, 1455,   90, 1373, 1522,   39, 6578,
-     5959, 5964, 5977, 5982, 5987, 5994, 6004, 6017,  283, 6022,
-     6032, 6045, 6059,  306, 6064, 6074, 6079, 6089, 6099, 6103,
-
-      296, 6112, 6125, 6138, 6152, 6166, 6176, 6186, 6191, 6203,
-      799, 6217,  920, 6222, 6234, 6247,  997, 6261, 1086, 6266,
-     6278, 6291, 6304, 6317, 6330, 1087, 6335, 6348, 1206, 6353,
-     6365, 6378, 6391, 6404, 6417, 6430, 6435, 6448, 1224, 6453,
-     6465, 6478, 6491, 6504, 6517, 1227, 1292, 6530, 6543, 6553,
-     6563
+        0,    0,   39,   41, 1591, 1590, 1625, 2401,   62,   71,
+       76,   61,   69, 1588,   78, 1587,   50,   89, 1583, 1580,
+      132, 1579,   91,  123, 1561,   85,   94,  104, 1560, 1559,
+     2401,  117,  176,  175, 2401,  177,  193,  204, 1539,  108,
+     2401,  242,  120,  180,  196, 1553,  205, 2401,  101,  277,
+     2401,  102,   75, 1555,  221,  112,  206,  234,  181, 1561,
+     1565, 1547, 1553,    0,  268,  119, 1545,  221,   60,  240,
+      223,  230,  244,  257,  278,  279,  286,  256, 1533,  264,
+     1542,  298,  297, 1523,  296,  190,  292,  231,   97,  294,
+      309,  350, 2401, 2401,  329,  327, 1524,  351,  352,  372,
+
+      359, 2401, 2401,  360,  361,  381,  362, 1496,  339,  341,
+      342,  422,  457,  400, 1513,  492, 1512,  448,  483,  409,
+      364,  386,  527,  562, 2401,  435, 1523,  245, 1498,  597,
+     1497,  518,  368, 1483,  363, 1481, 1479,  310, 1478, 1477,
+      289, 1474, 1463,  239, 1440, 1432, 1428,  385,  401,  369,
+     1436,  311, 1425,  632, 1422,  553,  410,  420,  424,  411,
+      423,  440,  588,  458,  667, 1420,  626,  459,  481, 1403,
+      492,  494,  507,  627,  528, 1382,  412,  658,  674,  683,
+     1398,  718,  709,  544,  725,  563, 1368, 2401,  734, 1348,
+      769,  474, 1324,  477, 1314,  482, 1313, 1305,  548, 2401,
+
+      414,  760, 1289,  804,  578,  484,  582,  508,  509,  510,
+      795,  811, 2401,  820,  552, 1290, 1272,  855,  554, 1197,
+      841,  857,  863,  879,  885,  901,  647, 1228,  455,  907,
+      923,  614, 1191, 1123,  611,  929,  945,  628,  551,  630,
+      515,  631, 1115,  951,  967,  973,  555, 1109, 1101, 1093,
+     1008, 1022,  668,  684, 2401, 1049, 1061, 1008, 1040, 1057,
+     1065, 1073, 1081,  634, 1089, 1097, 1067,  577, 1105, 1113,
+      579,  615,  683, 1041,  685, 1121, 1129, 1137,  708, 1041,
+      991,  965,  947,  774,  719,  782, 1172,  735, 1207, 1186,
+     1219, 1246, 1260, 1287, 1322,  876, 1246, 2401, 1278, 1313,
+
+      854, 1330,  805, 1338, 1346,  770, 1354, 1362,  771,  580,
+      822,  584, 1397, 1383, 1399,  710,  792,  712,  711,  661,
+      659,  809, 2401,  877,  754, 1434, 1461, 1496, 1019,  821,
+     1442, 1531, 1566, 1440,  639, 1487,  921, 1522, 1557,  851,
+      965, 1574,  707, 1301, 1582,  618,  616,  617, 1617, 1603,
+      562, 2401, 2401, 2401, 2401, 2401, 2401, 1475,  858,  859,
+     1619, 1654,  917,  918, 1640, 1656,  521, 1482,  961, 1510,
+     1652, 1544,  646,  836, 1675, 1681, 1697, 1703, 2401, 1017,
+      873,  874,  962,  853, 1021,  701,  513,  473, 2401, 1719,
+     1725, 1741, 1005, 1150,  419,  919,  992, 1018, 1139, 1747,
+
+     1763, 1769, 1804, 1154, 1020, 1030, 1040, 1131, 1167,  901,
+     1187, 1792, 1808, 1831, 1403, 1829, 1851,  820, 1059,  967,
+      920,  472,  789, 1201, 1185, 1865, 1892, 1281, 2401, 1871,
+     1869,  448, 1202, 1225,  736,  946,  390,  585, 1906, 1908,
+     1943, 1970,  388, 1190, 1218, 1227, 1156, 1929, 1951, 1949,
+     1266, 1303,  990, 1304, 1976, 1992, 1394, 1169,  340, 1248,
+     1998, 2014, 1312,  316, 1203, 1242, 2020, 2036, 1340,  265,
+     1151, 2042, 1229, 1423, 1424, 1395,   92, 1382, 1364,   34,
+     2401, 2077, 2082, 2093, 2098, 2103, 2112, 2119, 2130, 2139,
+     2144, 2155, 2167, 2169, 2178, 2183, 2192, 2197, 2206, 2215,
+
+     2227, 2236, 2245, 2250, 2262, 2267, 2278, 2283, 2294, 2305,
+     2316, 2321, 2332, 2343, 2348, 2359, 2368, 2379, 2388
     } ;
 
-static yyconst flex_int16_t yy_def[552] =
+static yyconst short int yy_def[520] =
     {   0,
-      480,    1,    1,    1,    1,    1,  480,  480,  480,  480,
-      480,  481,  482,  480,  483,  480,  484,  480,  480,  480,
-      480,  485,  486,  486,  486,  487,  480,  480,  480,  480,
-      486,  486,  486,  480,  486,  480,  480,  480,  481,  480,
-      488,  482,  489,  490,  490,  491,  480,  483,  492,  480,
-      480,  480,  486,  486,  486,  487,   20,  493,  480,  494,
-      480,   20,  495,  495,  495,  495,  495,  495,  495,  495,
-      495,  495,  495,  495,  495,  495,  496,  495,  480,  485,
-      497,  497,  497,  497,  497,  497,  497,  498,  480,  486,
-      499,  480,  486,  486,  500,  486,  486,  486,  480,  480,
-
-      480,  486,  486,  486,  486,  480,  481,  481,  481,  481,
-      488,  501,  490,  490,  502,  490,  114,  503,  503,  503,
-      503,  504,  480,  480,  486,  505,  506,  495,  507,  495,
-      495,  495,  495,  495,  495,  495,  495,  495,  495,  495,
-      495,  495,  495,  495,  495,  495,  495,  495,  495,  480,
-      497,  497,  508,  497,  497,  497,  497,  497,  497,  497,
-      497,  486,   98,  480,  486,  486,  509,  480,  486,   98,
-      486,  486,  486,  486,  480,  510,  510,  511,  114,  490,
-      114,  114,  503,  503,  486,  512,  480,  495,  148,  495,
-      495,  495,  495,  495,  495,  495,  148,  495,  480,  497,
-
-      497,  161,  497,  497,  497,  497,  497,  497,  161,   98,
-      480,  513,  514,  480,  480,  515,   98,  486,  480,  516,
-      517,  114,  114,  114,  503,  486,  512,  518,  148,  495,
-      495,  148,  495,  497,  161,  497,  497,  497,  497,  497,
-      497,  161,   98,  519,  520,  480,  480,  480,  521,  521,
-      522,  523,  480,  524,   98,  480,  525,  526,  527,  527,
-      260,  528,   98,  148,  148,  148,  497,  161,  497,  497,
-      497,  497,  497,  161,   98,  529,  530,  480,  480,  480,
-      480,  480,  522,  480,  531,  532,  533,  534,  534,  534,
-      534,  534,  535,   98,  480,  536,  480,  537,  537,  299,
-
-      538,   98,  148,  303,  497,  161,  497,  497,  497,  497,
-      161,   98,  539,  540,  480,  480,  480,  480,  480,  480,
-      480,  541,  541,  541,  541,  542,  543,  543,  543,  543,
-      544,  545,  302,  480,  536,  299,  300,  538,  302,  303,
-      303,  497,  161,  497,  497,  497,  497,  302,  546,  480,
-      480,  480,  480,  480,  480,  480,  541,  541,  541,  325,
-      543,  543,  543,  330,  545,  480,  337,  302,  341,  497,
-      497,  497,  497,  547,  325,  330,  365,  480,  302,  497,
-      497,  497,  497,  497,  497,  497,  497,  480,  325,  330,
-      365,  302,  497,  497,  497,  497,  497,  497,  325,  330,
-
-      545,  548,  497,  497,  497,  497,  497,  497,  497,  497,
-      541,  543,  548,  548,  549,  550,  497,  497,  497,  497,
-      497,  497,  497,  497,  480,  480,  549,  551,  549,  549,
-      497,  497,  497,  497,  497,  497,  497,  549,  430,  549,
-      430,  497,  497,  497,  497,  497,  549,  439,  430,  497,
-      497,  497,  497,  439,  430,  497,  497,  497,  497,  439,
-      430,  497,  497,  497,  497,  439,  549,  497,  497,  497,
-      549,  497,  497,  497,  497,  497,  497,  497,  497,    0,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480
+      481,    1,    1,    1,    1,    1,  481,  481,  481,  481,
+      481,  482,  483,  481,  484,  481,  481,  485,  481,  481,
+      481,  481,  486,  487,  481,  488,  488,  488,  481,  481,
+      481,  488,  488,  488,  481,  488,  481,  481,  481,  482,
+      481,  489,  483,  481,  490,  491,  491,  481,  484,  492,
+      481,  481,  481,  481,  487,  488,  488,  488,   21,  493,
+      481,  494,  481,   21,  495,  496,  496,  496,  496,  496,
+      496,  496,  496,  496,  496,  496,  496,  496,  496,  496,
+      481,  486,  497,  498,  498,  498,  498,  498,  498,  498,
+      488,  488,  481,  481,  488,  499,  481,  488,  488,  481,
+
+      488,  481,  481,  488,  488,  488,  488,  481,  482,  482,
+      482,  482,  489,  481,  491,   47,  491,  500,   47,  484,
+      484,  484,  484,  492,  481,  488,  493,  501,  496,  496,
+      496,  502,  496,  496,  496,  496,  496,  496,  496,  496,
+      496,  496,  496,  496,  496,  496,  496,  496,  496,  496,
+      481,  498,  498,  498,  498,  503,  498,  498,  498,  498,
+      498,  498,   92,  488,   92,  481,  488,  488,  504,  481,
+      488,  488,  488,  488,  488,  481,  482,  112,  481,  116,
+      491,  116,   47,  484,  123,  488,  505,  481,  130,  496,
+      130,  496,  496,  496,  496,  496,  496,  496,  496,  481,
+
+      498,  154,  498,  154,  498,  498,  498,  498,  498,  498,
+       92,  165,  481,  481,  506,  481,  481,  507,  488,  481,
+      112,  481,  116,  182,   47,  123,  488,  505,  501,  130,
+      191,  496,  496,  496,  498,  154,  204,  498,  498,  498,
+      498,  498,  498,   92,  165,  481,  508,  481,  481,  481,
+      507,  507,  509,  510,  481,  511,  481,  112,  481,  116,
+      182,   47,  123,  488,  130,  191,  496,  498,  154,  204,
+      498,  498,  498,  498,  498,   92,  165,  481,  512,  481,
+      481,  481,  481,  481,  509,  481,  513,  510,  514,  507,
+      507,  507,  507,  507,  511,  481,  112,  481,  116,  182,
+
+      491,  123,  488,  130,  191,  498,  154,  204,  498,  498,
+      498,  498,  488,  165,  481,  515,  481,  481,  481,  481,
+      481,  481,  481,  509,  509,  509,  509,  513,  510,  510,
+      510,  510,  514,  294,  481,  112,  491,  182,  123,  488,
+      496,  191,  498,  498,  204,  498,  498,  498,  488,  481,
+      481,  481,  481,  481,  481,  481,  481,  509,  509,  509,
+      327,  510,  510,  510,  332,  294,  481,  491,  488,  496,
+      498,  498,  498,  498,  481,  327,  332,  294,  481,  488,
+      498,  498,  498,  498,  498,  498,  498,  498,  481,  327,
+      332,  294,  488,  498,  498,  498,  498,  498,  498,  327,
+
+      332,  294,  516,  498,  498,  498,  498,  498,  498,  498,
+      498,  327,  332,  516,  414,  517,  518,  498,  498,  498,
+      498,  498,  498,  498,  498,  518,  518,  481,  481,  518,
+      519,  498,  498,  498,  498,  498,  498,  498,  518,  427,
+      518,  427,  498,  498,  498,  498,  498,  427,  518,  442,
+      498,  498,  498,  498,  427,  442,  498,  498,  498,  498,
+      427,  442,  498,  498,  498,  498,  427,  442,  498,  498,
+      498,  442,  498,  498,  498,  498,  498,  498,  498,  498,
+        0,  481,  481,  481,  481,  481,  481,  481,  481,  481,
+      481,  481,  481,  481,  481,  481,  481,  481,  481,  481,
+
+      481,  481,  481,  481,  481,  481,  481,  481,  481,  481,
+      481,  481,  481,  481,  481,  481,  481,  481,  481
     } ;
 
-static yyconst flex_int16_t yy_nxt[6664] =
+static yyconst short int yy_nxt[2462] =
     {   0,
         8,    9,   10,    9,    9,    9,   11,   12,   13,   14,
-        8,    8,   15,    8,    8,   16,    8,   17,   18,   19,
-       20,    8,   21,    8,    8,    8,   22,   23,   23,   23,
-       23,   23,   23,   23,   23,   23,   23,   23,   23,   23,
-       24,   23,   23,   23,   23,   23,   23,   25,   23,   23,
-       23,   23,   23,   26,   27,   23,   23,   23,   23,   23,
-       23,   23,   23,   23,   23,   23,   23,   23,   24,   23,
-       23,   23,   23,   23,   23,   25,   23,   23,   23,   23,
-       23,    8,   28,   29,   23,   30,   35,   30,   35,   40,
-       40,   31,  153,   31,   36,   36,   36,   36,   36,   36,
-
-       36,   36,   36,   36,   32,   33,   32,   33,   37,   37,
-       37,   37,   37,   89,   40,   35,   51,   35,   89,   52,
-       31,   89,   31,   89,   92,   93,   92,   93,  106,   40,
-       49,  136,   32,   33,   32,   33,   41,  480,   89,   54,
-      480,   95,   38,  153,  129,   34,  105,   34,   55,   94,
-       89,  103,   56,   91,   89,  129,  106,  149,   91,  136,
-       41,   91,  153,   91,   89,  153,  131,   54,  155,   96,
-       49,   38,   42,   46,  105,   43,   55,   94,   91,  103,
-      153,  102,   44,   44,   44,   44,   44,   44,  129,   89,
-       91,  104,   92,   93,   91,  131,  155,   96,   36,   36,
-
-       36,   36,   36,  137,   91,  135,  129,  153,   46,  102,
-      212,   44,   44,   44,   44,   44,   44,   59,  214,  104,
-      212,   89,  129,  153,   60,   61,  153,   62,  246,   91,
-       92,   92,  137,  135,   63,   63,   64,   65,   66,   63,
-       67,   68,   69,   63,   70,   63,   71,   72,   63,   73,
-       63,   74,   75,   76,   63,   63,   63,   63,   63,   63,
-       77,   91,   78,   63,   63,   64,   65,   66,   63,   67,
-       68,   69,   70,   63,   71,   72,   63,   73,   63,   74,
-       75,   76,   63,   63,   63,   63,   63,   63,  130,   52,
-      480,   63,   80,  112,   89,  112,   37,   37,   37,   37,
-
-       37,  480,  129,   57,   82,  212,  178,   83,  178,  124,
-       84,  190,  125,  278,   85,   86,  130,   87,   63,   63,
-      134,  132,  151,   63,   92,  140,   88,   89,   88,  129,
-       38,  129,  133,   82,   91,  129,   83,  124,  138,   84,
-      190,  125,   85,   86,  139,   87,   98,  141,  134,  132,
-      151,   63,  129,   98,   98,   98,   98,   98,   98,   38,
-      133,  129,   40,   40,  142,  156,  138,   91,  143,  144,
-       89,  129,  139,  145,   40,  146,  141,  165,  175,  153,
-      154,  129,   98,   98,   98,   98,   98,   98,   39,   39,
-       39,  107,  142,  156,  109,  129,  143,  158,  144,  153,
-
-      157,  159,  145,  146,   49,  270,  175,  110,   41,  154,
-       91,   89,   89,   89,  110,  110,  110,  110,  110,  110,
-       41,  153,  153,  153,  127,  480,  158,  153,  187,  157,
-      159,   89,  153,   89,   89,   40,  193,  169,  173,  153,
-      111,  153,  174,  110,  110,  110,  110,  110,  110,  114,
-      171,   91,   91,   91,  191,  153,  114,  114,  114,  114,
-      114,  114,  480,   39,  166,  169,  173,  172,   40,  129,
-      174,   91,   40,   91,   91,   89,   49,  219,   89,  171,
-      129,  194,  115,  191,  198,  114,  114,  114,  114,  114,
-      114,  117,  166,  185,  129,  172,  192,  129,  117,  117,
-
-      117,  117,  117,  117,  129,  219,  212,  153,   40,  195,
-      194,  196,  198,   49,   41,   91,  200,  203,   91,  206,
-      129,  356,  185,  129,  192,  211,  216,  117,  117,  117,
-      117,  117,  117,   48,   48,   48,  118,  195,  153,  196,
-      204,  207,  153,  153,  120,  200,  203,  205,  206,  193,
-      208,  355,  121,  153,   41,  153,   89,  211,  153,  121,
-      121,  121,  121,  121,  121,   91,   91,   89,  204,  207,
-      153,   89,   89,  480,  165,  205,   89,   89,  354,  208,
-      237,  353,  129,   40,  334,  122,  231,  153,  121,  121,
-      121,  121,  121,  121,   98,  256,   91,   91,  230,  129,
-
-      226,   98,   98,   98,   98,   98,   98,   91,  237,  218,
-      236,   91,   91,  334,  231,  352,   91,   91,  284,  153,
-      233,  129,  239,  256,   49,  234,  284,  230,  226,  238,
-       98,   98,   98,   98,   98,   98,  148,  218,  236,  240,
-      153,  153,  129,  148,  148,  148,  148,  148,  148,  233,
-      153,  239,  228,  272,  234,  266,  187,  238,  212,   89,
-      284,  153,  241,  212,  285,  370,  315,  287,  240,  129,
-      284,  351,  148,  148,  148,  148,  148,  148,  161,  153,
-      295,  263,  272,  266,  153,  161,  161,  161,  161,  161,
-      161,  241,  249,  249,  249,  249,  249,  267,  251,   91,
-
-      284,  153,  284,  252,  305,  253,  285,  153,  295,  345,
-      263,  287,  271,  153,  161,  161,  161,  161,  161,  161,
-      163,  153,  153,  307,  346,  267,  269,  163,  163,  163,
-      163,  163,  163,  305,  153,  153,  480,  115,  345,  273,
-      271,  284,  309,  287,  254,  153,  285,  153,  308,  153,
-      153,  366,  307,  346,  269,  319,  163,  163,  163,  163,
-      163,  163,   97,   97,   97,   97,   97,  273,  402,  153,
-      309,  310,   90,  342,   89,  378,  344,  308,  318,  366,
-      153,  170,  153,  153,  372,   90,  373,  285,  170,  170,
-      170,  170,  170,  170,  249,  249,  249,  249,  249,  310,
-
-      251,  342,   90,  378,  344,  252,  317,  253,  153,  221,
-      153,  221,  379,  372,   91,  373,  368,  170,  170,  170,
-      170,  170,  170,  108,  176,  176,  176,  108,  470,   40,
-      282,  282,  282,  282,  282,  320,  320,  320,  320,  320,
-      480,  379,  177,  253,  368,  284,  254,   90,  321,  177,
-      177,  177,  177,  177,  177,  282,  282,  282,  282,  282,
-      405,  480,  153,  398,  153,  452,  480,  316,  253,  180,
-      180,  180,  180,  180,  392,   41,  153,  153,  177,  177,
-      177,  177,  177,  177,   39,   39,   39,  107,  405,  153,
-      109,  285,  398,  452,  281,  282,  282,  282,  282,  282,
-
-      480,  280,  392,  110,  386,  284,  419,  254,  253,  279,
-      110,  110,  110,  110,  110,  110,  282,  282,  282,  282,
-      282,  282,  282,  282,  282,  282,  153,  153,  480,  253,
-      244,  153,  244,  386,  253,  419,  111,  129,  284,  110,
-      110,  110,  110,  110,  110,  179,  406,  254,  434,  129,
-      228,  285,  179,  179,  179,  179,  179,  179,  282,  282,
-      282,  282,  282,  320,  320,  320,  320,  320,  254,  153,
-      480,  253,  248,  254,  153,  406,  321,  434,  115,  287,
-      284,  179,  179,  179,  179,  179,  179,  181,  247,   97,
-       97,   97,   97,   97,  181,  181,  181,  181,  181,  181,
-
-      357,  320,  320,  320,  357,   90,  284,  258,  153,  258,
-      254,  431,  444,  358,  108,  176,  176,  176,  108,  153,
-       40,  287,  153,  181,  181,  181,  181,  181,  181,  116,
-      116,  116,  116,  116,  162,  162,  162,  162,  162,  431,
-      444,  129,  129,  119,  183,  183,  183,  119,  182,  129,
-       90,  387,  285,  129,   40,  182,  182,  182,  182,  182,
-      182,  361,  320,  320,  320,  361,   41,  188,  188,  188,
-      188,  188,  284,  153,  362,  160,  160,  160,  160,  160,
-      387,  393,  418,  394,  182,  182,  182,  182,  182,  182,
-      119,  183,  183,  183,  119,   49,  276,  297,  276,  297,
-
-      153,   40,  396,  153,  480,  153,  129,  228,  153,  184,
-      393,  418,  394,  287,  284,  115,  184,  184,  184,  184,
-      184,  184,  357,  320,  320,  320,  357,  153,  284,  407,
-      396,  469,  433,  153,  395,  358,  201,  201,  201,  201,
-      201,  153,   49,  397,  153,  184,  184,  184,  184,  184,
-      184,   48,   48,   48,  118,  287,  153,  407,  215,  469,
-      433,  408,  120,  395,  445,  153,  403,  164,  153,  404,
-      121,  153,  397,  420,  285,  421,  153,  121,  121,  121,
-      121,  121,  121,  361,  320,  320,  320,  361,  153,  408,
-      153,  153,  445,  153,  284,  403,  362,  153,  404,  409,
-
-      417,  435,  420,  122,  421,  410,  121,  121,  121,  121,
-      121,  121,  189,  424,  153,  153,  313,  199,  313,  189,
-      189,  189,  189,  189,  189,  153,  129,  409,  417,  129,
-      435,  153,  423,  410,  349,  287,  349,  374,  153,  374,
-      422,  129,  424,  413,  413,  413,  413,  413,  189,  189,
-      189,  189,  189,  189,  147,  147,  147,  147,  147,  414,
-      423,  129,  153,  432,  288,  288,  288,  288,  288,  422,
-      129,  129,  436,  197,  129,  129,  153,  253,  129,  437,
-      197,  197,  197,  197,  197,  197,  323,  359,  359,  359,
-      323,  432,  284,  129,  153,  416,  328,  363,  363,  363,
-
-      328,  436,  388,  129,  388,  153,  129,  284,  437,  197,
-      197,  197,  197,  197,  197,  202,  254,  413,  413,  413,
-      413,  413,  202,  202,  202,  202,  202,  202,  480,  480,
-      480,  480,  480,  414,  129,  127,  115,  115,  285,  168,
-      164,  153,  443,  150,  480,  442,  129,  129,  287,   57,
-       77,  202,  202,  202,  202,  202,  202,  160,  160,  160,
-      160,  160,  425,  425,  425,  425,  425,  153,  153,  416,
-      446,  443,  451,  465,  442,  426,  209,   59,  153,  453,
-      416,  153,  450,  209,  209,  209,  209,  209,  209,  425,
-      425,  425,  425,  425,  153,  153,  153,  472,  127,  446,
-
-      451,  465,  426,  153,  123,  456,  457,  453,  474,  153,
-      450,  478,  209,  209,  209,  209,  209,  209,  162,  162,
-      162,  162,  162,  153,  115,  472,  153,  153,  153,  425,
-      425,  425,  425,  425,  456,  457,  474,  210,  459,  478,
-      475,  428,  426,  473,  210,  210,  210,  210,  210,  210,
-      425,  425,  425,  425,  425,  425,  425,  425,  425,  425,
-      153,  101,  153,  426,  100,   99,  153,  459,  426,  475,
-      462,  458,  473,  210,  210,  210,  210,  210,  210,  217,
-      153,  428,  476,   79,  477,   58,  217,  217,  217,  217,
-      217,  217,  425,  425,  425,  425,  425,   57,  463,  458,
-
-      464,  468,  428,   50,  153,  426,  153,  428,  153,  153,
-      153,  476,   47,  477,  480,  217,  217,  217,  217,  217,
-      217,  108,  176,  176,  176,  108,  463,   40,  464,  468,
-      480,  480,  425,  425,  425,  425,  425,  480,  480,  480,
-      220,  480,  480,  480,  428,  426,  480,  220,  220,  220,
-      220,  220,  220,  440,  440,  440,  440,  440,  447,  447,
-      447,  447,  447,  480,  480,  480,  426,  479,  480,  480,
-      480,  426,  480,   41,  480,  153,  220,  220,  220,  220,
-      220,  220,  222,  480,  428,  480,  480,  480,  480,  222,
-      222,  222,  222,  222,  222,  479,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  428,  480,  480,  480,  480,
-      428,  480,  480,  480,  480,  480,  480,  480,  222,  222,
-      222,  222,  222,  222,  180,  180,  180,  180,  180,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  223,  480,  480,  480,  480,  480,  480,
-      223,  223,  223,  223,  223,  223,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  223,
-      223,  223,  223,  223,  223,  116,  116,  116,  116,  116,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  224,  480,  480,  480,  480,  480,
-      480,  224,  224,  224,  224,  224,  224,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      224,  224,  224,  224,  224,  224,  119,  183,  183,  183,
-      119,  480,  480,  480,  480,  480,  480,   40,  480,  480,
-      480,  480,  480,  480,  480,  225,  480,  480,  480,  480,
-      480,  480,  225,  225,  225,  225,  225,  225,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,   49,  480,
-
-      480,  225,  225,  225,  225,  225,  225,  188,  188,  188,
-      188,  188,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  229,  480,  480,  480,
-      480,  480,  480,  229,  229,  229,  229,  229,  229,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  229,  229,  229,  229,  229,  229,  232,  480,
-      480,  480,  480,  480,  480,  232,  232,  232,  232,  232,
-      232,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  232,  232,  232,  232,  232,  232,
-      201,  201,  201,  201,  201,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  235,
-      480,  480,  480,  480,  480,  480,  235,  235,  235,  235,
-      235,  235,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  235,  235,  235,  235,  235,
-      235,  242,  480,  480,  480,  480,  480,  480,  242,  242,
-      242,  242,  242,  242,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  480,  480,  242,  242,  242,
-      242,  242,  242,  162,  162,  162,  162,  162,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  243,  480,  480,  480,  480,  480,  480,  243,
-      243,  243,  243,  243,  243,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  243,  243,
-      243,  243,  243,  243,  255,  480,  480,  480,  480,  480,
-      480,  255,  255,  255,  255,  255,  255,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      255,  255,  255,  255,  255,  255,  108,  176,  176,  176,
-      108,  480,   40,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  257,  480,  480,  480,  480,
-      480,  480,  257,  257,  257,  257,  257,  257,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,   41,  480,
-      480,  257,  257,  257,  257,  257,  257,  259,  480,  480,
-      480,  480,  480,  480,  259,  259,  259,  259,  259,  259,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  259,  259,  259,  259,  259,  259,  180,
-      180,  180,  180,  180,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  260,  480,
-      480,  480,  480,  480,  480,  260,  260,  260,  260,  260,
-      260,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  260,  260,  260,  260,  260,  260,
-      116,  116,  116,  116,  116,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  261,
-
-      480,  480,  480,  480,  480,  480,  261,  261,  261,  261,
-      261,  261,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  261,  261,  261,  261,  261,
-      261,  119,  183,  183,  183,  119,  480,  480,  480,  480,
-      480,  480,   40,  480,  480,  480,  480,  480,  480,  480,
-      262,  480,  480,  480,  480,  480,  480,  262,  262,  262,
-      262,  262,  262,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,   49,  480,  480,  262,  262,  262,  262,
-
-      262,  262,  188,  188,  188,  188,  188,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  264,  480,  480,  480,  480,  480,  480,  264,  264,
-      264,  264,  264,  264,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  264,  264,  264,
-      264,  264,  264,  265,  480,  480,  480,  480,  480,  480,
-      265,  265,  265,  265,  265,  265,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  265,
-
-      265,  265,  265,  265,  265,  201,  201,  201,  201,  201,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  268,  480,  480,  480,  480,  480,
-      480,  268,  268,  268,  268,  268,  268,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      268,  268,  268,  268,  268,  268,  274,  480,  480,  480,
-      480,  480,  480,  274,  274,  274,  274,  274,  274,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  274,  274,  274,  274,  274,  274,  162,  162,
-      162,  162,  162,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  275,  480,  480,
-      480,  480,  480,  480,  275,  275,  275,  275,  275,  275,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  275,  275,  275,  275,  275,  275,  282,
-      282,  282,  282,  288,  480,  290,  480,  480,  480,  480,
-      290,  290,  291,  480,  480,  480,  480,  480,  292,  480,
-      480,  480,  480,  480,  480,  292,  292,  292,  292,  292,
-
-      292,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  293,  480,  480,  292,  292,  292,  292,  292,  292,
-      294,  480,  480,  480,  480,  480,  480,  294,  294,  294,
-      294,  294,  294,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  294,  294,  294,  294,
-      294,  294,  108,  176,  176,  176,  108,  480,   40,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  296,  480,  480,  480,  480,  480,  480,  296,  296,
-
-      296,  296,  296,  296,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,   41,  480,  480,  296,  296,  296,
-      296,  296,  296,  298,  480,  480,  480,  480,  480,  480,
-      298,  298,  298,  298,  298,  298,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  115,  480,  480,  298,
-      298,  298,  298,  298,  298,  180,  180,  180,  180,  180,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  299,  480,  480,  480,  480,  480,
-
-      480,  299,  299,  299,  299,  299,  299,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  115,  480,  480,
-      299,  299,  299,  299,  299,  299,  116,  116,  116,  116,
-      116,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  300,  480,  480,  480,  480,
-      480,  480,  300,  300,  300,  300,  300,  300,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  300,  300,  300,  300,  300,  300,  119,  183,  183,
-
-      183,  119,  480,  480,  480,  480,  480,  480,   40,  480,
-      480,  480,  480,  480,  480,  480,  301,  480,  480,  480,
-      480,  480,  480,  301,  301,  301,  301,  301,  301,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,   49,
-      480,  480,  301,  301,  301,  301,  301,  301,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,   90,  480,  480,
-      480,  480,  480,  480,   90,   90,   90,   90,   90,   90,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  302,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,   90,   90,   90,   90,   90,   90,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  302,  188,  188,  188,  188,  188,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  303,  480,  480,  480,  480,  480,  480,  303,  303,
-      303,  303,  303,  303,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  303,  303,  303,
-      303,  303,  303,  304,  480,  480,  480,  480,  480,  480,
-
-      304,  304,  304,  304,  304,  304,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  304,
-      304,  304,  304,  304,  304,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  128,  480,  480,  480,  480,  480,
-      480,  128,  128,  128,  128,  128,  128,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      128,  128,  128,  128,  128,  128,  201,  201,  201,  201,
-
-      201,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  306,  480,  480,  480,  480,
-      480,  480,  306,  306,  306,  306,  306,  306,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  306,  306,  306,  306,  306,  306,  311,  480,  480,
-      480,  480,  480,  480,  311,  311,  311,  311,  311,  311,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  311,  311,  311,  311,  311,  311,  162,
-
-      162,  162,  162,  162,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  312,  480,
-      480,  480,  480,  480,  480,  312,  312,  312,  312,  312,
-      312,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  312,  312,  312,  312,  312,  312,
-      283,  283,  283,  322,  480,  480,  324,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  325,
-      480,  480,  480,  480,  480,  480,  325,  325,  325,  325,
-      325,  325,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  326,  480,  480,  325,  325,  325,  325,  325,
-      325,  286,  286,  286,  327,  480,  480,  480,  480,  480,
-      480,  480,  329,  480,  480,  480,  480,  480,  480,  480,
-      330,  480,  480,  480,  480,  480,  480,  330,  330,  330,
-      330,  330,  330,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  331,  480,  480,  330,  330,  330,  330,
-      330,  330,  288,  288,  288,  288,  288,  480,  480,  480,
-      480,  480,  480,  480,  480,  253,  480,  480,  480,  480,
-
-      480,  332,  480,  480,  480,  480,  480,  480,  332,  332,
-      332,  332,  332,  332,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  254,  480,  480,  332,  332,  332,
-      332,  332,  332,  282,  282,  282,  282,  288,  480,  290,
-      480,  480,  480,  480,  290,  290,  291,  480,  480,  480,
-      480,  480,  292,  480,  480,  480,  480,  480,  480,  292,
-      292,  292,  292,  292,  292,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  293,  480,  480,  292,  292,
-
-      292,  292,  292,  292,  333,  480,  480,  480,  480,  480,
-      480,  333,  333,  333,  333,  333,  333,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      333,  333,  333,  333,  333,  333,  108,  176,  176,  176,
-      108,  480,   40,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  335,  480,  480,  480,  480,
-      480,  480,  335,  335,  335,  335,  335,  335,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,   41,  480,
-
-      480,  335,  335,  335,  335,  335,  335,  180,  180,  180,
-      180,  180,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  336,  480,  480,  480,
-      480,  480,  480,  336,  336,  336,  336,  336,  336,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  115,
-      480,  480,  336,  336,  336,  336,  336,  336,  116,  116,
-      116,  116,  116,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  337,  480,  480,
-      480,  480,  480,  480,  337,  337,  337,  337,  337,  337,
-
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  337,  337,  337,  337,  337,  337,  119,
-      183,  183,  183,  119,  480,  480,  480,  480,  480,  480,
-       40,  480,  480,  480,  480,  480,  480,  480,  338,  480,
-      480,  480,  480,  480,  480,  338,  338,  338,  338,  338,
-      338,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,   49,  480,  480,  338,  338,  338,  338,  338,  338,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  480,  339,  480,  480,   90,
-      480,  480,  480,  480,  480,  480,   90,   90,   90,   90,
-       90,   90,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,   90,   90,   90,   90,   90,
-       90,  188,  188,  188,  188,  188,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      340,  480,  480,  480,  480,  480,  480,  340,  340,  340,
-      340,  340,  340,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  480,  340,  340,  340,  340,
-      340,  340,  147,  147,  147,  147,  147,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  341,  480,  480,  480,  480,  480,  480,  341,  341,
-      341,  341,  341,  341,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  341,  341,  341,
-      341,  341,  341,  201,  201,  201,  201,  201,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  343,  480,  480,  480,  480,  480,  480,  343,
-
-      343,  343,  343,  343,  343,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  343,  343,
-      343,  343,  343,  343,  347,  480,  480,  480,  480,  480,
-      480,  347,  347,  347,  347,  347,  347,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      347,  347,  347,  347,  347,  347,  162,  162,  162,  162,
-      162,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  348,  480,  480,  480,  480,
-
-      480,  480,  348,  348,  348,  348,  348,  348,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  348,  348,  348,  348,  348,  348,  323,  359,  359,
-      359,  323,  480,  284,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  360,  480,  480,  480,
-      480,  480,  480,  360,  360,  360,  360,  360,  360,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  285,
-      480,  480,  360,  360,  360,  360,  360,  360,  283,  283,
-
-      283,  322,  480,  480,  324,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  325,  480,  480,
-      480,  480,  480,  480,  325,  325,  325,  325,  325,  325,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      326,  480,  480,  325,  325,  325,  325,  325,  325,  328,
-      363,  363,  363,  328,  480,  480,  480,  480,  480,  480,
-      284,  480,  480,  480,  480,  480,  480,  480,  364,  480,
-      480,  480,  480,  480,  480,  364,  364,  364,  364,  364,
-      364,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  287,  480,  480,  364,  364,  364,  364,  364,  364,
-      286,  286,  286,  327,  480,  480,  480,  480,  480,  480,
-      480,  329,  480,  480,  480,  480,  480,  480,  480,  330,
-      480,  480,  480,  480,  480,  480,  330,  330,  330,  330,
-      330,  330,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  331,  480,  480,  330,  330,  330,  330,  330,
-      330,  288,  288,  288,  288,  288,  480,  480,  480,  480,
-      480,  480,  480,  480,  253,  480,  480,  480,  480,  480,
-
-      365,  480,  480,  480,  480,  480,  480,  365,  365,  365,
-      365,  365,  365,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  254,  480,  480,  365,  365,  365,  365,
-      365,  365,  367,  480,  480,  480,  480,  480,  480,  367,
-      367,  367,  367,  367,  367,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  367,  367,
-      367,  367,  367,  367,  113,  480,  480,  480,  480,  480,
-      480,  113,  113,  113,  113,  113,  113,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      113,  113,  113,  113,  113,  113,  369,  480,  480,  480,
-      480,  480,  480,  369,  369,  369,  369,  369,  369,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  369,  369,  369,  369,  369,  369,  147,  147,
-      147,  147,  147,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  128,  480,  480,
-      480,  480,  480,  480,  128,  128,  128,  128,  128,  128,
-
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  128,  128,  128,  128,  128,  128,  201,
-      201,  201,  201,  201,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  371,  480,
-      480,  480,  480,  480,  480,  371,  371,  371,  371,  371,
-      371,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  371,  371,  371,  371,  371,  371,
-      375,  480,  480,  480,  480,  480,  480,  375,  375,  375,
-
-      375,  375,  375,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  375,  375,  375,  375,
-      375,  375,  376,  480,  480,  480,  480,  480,  480,  376,
-      376,  376,  376,  376,  376,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  376,  376,
-      376,  376,  376,  376,  288,  288,  288,  288,  288,  480,
-      480,  480,  480,  480,  480,  480,  480,  253,  480,  480,
-      480,  480,  480,  377,  480,  480,  480,  480,  480,  480,
-
-      377,  377,  377,  377,  377,  377,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  254,  480,  480,  377,
-      377,  377,  377,  377,  377,  380,  480,  480,  480,  480,
-      480,  480,  381,  480,  382,  480,  480,  480,  480,  383,
-      384,  480,  480,  385,  480,  480,  480,  480,  153,  480,
-      480,  480,  480,  480,  380,  480,  480,  480,  480,  480,
-      381,  480,  382,  480,  480,  480,  480,  383,  384,  480,
-      480,  385,  389,  480,  480,  480,  480,  480,  480,  389,
-      389,  389,  389,  389,  389,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  389,  389,
-      389,  389,  389,  389,  390,  480,  480,  480,  480,  480,
-      480,  390,  390,  390,  390,  390,  390,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      390,  390,  390,  390,  390,  390,  391,  480,  480,  480,
-      480,  480,  480,  391,  391,  391,  391,  391,  391,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  391,  391,  391,  391,  391,  391,  399,  480,
-      480,  480,  480,  480,  480,  399,  399,  399,  399,  399,
-      399,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  399,  399,  399,  399,  399,  399,
-      400,  480,  480,  480,  480,  480,  480,  400,  400,  400,
-      400,  400,  400,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  400,  400,  400,  400,
-      400,  400,  401,  480,  480,  480,  480,  480,  480,  401,
-
-      401,  401,  401,  401,  401,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  401,  401,
-      401,  401,  401,  401,  411,  480,  480,  480,  480,  480,
-      480,  411,  411,  411,  411,  411,  411,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      411,  411,  411,  411,  411,  411,  412,  480,  480,  480,
-      480,  480,  480,  412,  412,  412,  412,  412,  412,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  412,  412,  412,  412,  412,  412,  430,  480,
-      480,  480,  480,  480,  480,  430,  430,  430,  430,  430,
-      430,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  430,  430,  430,  430,  430,  430,
-      439,  480,  480,  480,  480,  480,  480,  439,  439,  439,
-      439,  439,  439,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  439,  439,  439,  439,
-
-      439,  439,  440,  440,  440,  440,  440,  480,  480,  480,
-      480,  480,  480,  480,  480,  426,  480,  480,  480,  480,
-      480,  441,  480,  480,  480,  480,  480,  480,  441,  441,
-      441,  441,  441,  441,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  428,  480,  480,  441,  441,  441,
-      441,  441,  441,  447,  447,  447,  447,  447,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  448,  480,  480,  480,  480,  480,  480,  448,
-      448,  448,  448,  448,  448,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  448,  448,
-      448,  448,  448,  448,  449,  480,  480,  480,  480,  480,
-      480,  449,  449,  449,  449,  449,  449,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      449,  449,  449,  449,  449,  449,  454,  480,  480,  480,
-      480,  480,  480,  454,  454,  454,  454,  454,  454,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  454,  454,  454,  454,  454,  454,  455,  480,
-      480,  480,  480,  480,  480,  455,  455,  455,  455,  455,
-      455,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  455,  455,  455,  455,  455,  455,
-      460,  480,  480,  480,  480,  480,  480,  460,  460,  460,
-      460,  460,  460,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  460,  460,  460,  460,
-      460,  460,  461,  480,  480,  480,  480,  480,  480,  461,
-
-      461,  461,  461,  461,  461,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  461,  461,
-      461,  461,  461,  461,  466,  480,  480,  480,  480,  480,
-      480,  466,  466,  466,  466,  466,  466,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      466,  466,  466,  466,  466,  466,  467,  480,  480,  480,
-      480,  480,  480,  467,  467,  467,  467,  467,  467,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  467,  467,  467,  467,  467,  467,  471,  480,
-      480,  480,  480,  480,  480,  471,  471,  471,  471,  471,
-      471,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  471,  471,  471,  471,  471,  471,
-       39,  480,  480,   39,   39,   39,   39,   39,   39,   39,
-       39,   39,   39,   45,   45,  480,   45,   45,   48,  480,
-      480,   48,   48,   48,   48,   48,   48,   48,   48,   48,
-       48,   53,   53,  480,   53,   53,   81,  480,  480,   81,
-
-       81,   90,  480,   90,   90,  480,   90,   90,   97,   97,
-       97,   97,   97,   97,   97,   97,   97,   97,  108,  108,
-      108,  108,  108,  108,  108,  108,  108,  108,  108,  108,
-      108,  113,  113,  480,  113,  113,  116,  116,  116,  116,
-      116,  116,  116,  116,  116,  116,  119,  119,  119,  119,
-      119,  119,  119,  119,  119,  119,  119,  119,  119,  126,
-      126,  126,  126,  126,  126,  126,  126,  126,  126,  126,
-      126,  126,  126,  128,  128,  480,  128,  128,  147,  147,
-      147,  147,  147,  147,  147,  147,  147,  147,  152,  152,
-      480,  152,  152,  160,  160,  160,  160,  160,  160,  160,
-
-      160,  160,  160,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  167,  167,  167,  180,  180,  180,  180,
-      180,  180,  180,  180,  180,  180,   48,   48,  480,   48,
-       48,   48,   48,   48,   48,   48,   48,   48,   48,  119,
-      119,  119,  119,  119,  119,  119,  119,  119,  119,  119,
-      119,  119,  126,  126,  126,  126,  126,  126,  126,  126,
-      126,  126,  126,  126,  126,  126,  186,  186,  186,  186,
-      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
-      188,  188,  188,  188,  188,  188,  188,  188,  188,  188,
-      201,  201,  201,  201,  201,  201,  201,  201,  201,  201,
-
-      213,  213,  213,  213,   39,  480,  480,   39,   39,   39,
-       39,   39,   39,   39,   39,   39,   39,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  245,  245,  245,  245,  250,  250,  250,  250,  250,
-      250,  480,  250,  250,  250,  250,  250,  250,   39,   39,
-       39,   39,   39,   39,   39,   39,   39,   39,   39,   39,
-       39,  186,  186,  186,  186,  186,  186,  186,  186,  186,
-      186,  186,  186,  186,  186,  277,  277,  277,  277,  250,
-      250,  250,  250,  250,  250,  480,  250,  250,  250,  250,
-      250,  250,  283,  480,  480,  283,  283,  283,  283,  283,
-
-      283,  283,  283,  283,  283,  286,  480,  480,  286,  286,
-      286,  286,  286,  286,  286,  286,  286,  286,  289,  289,
-      289,  289,  289,  289,  289,  289,  289,  289,  289,  289,
-      289,   39,   39,   39,   39,   39,   39,   39,   39,   39,
-       39,   39,   39,   39,  113,  113,  480,  113,  113,   48,
-       48,   48,   48,   48,   48,   48,   48,   48,   48,   48,
-       48,   48,  314,  314,  314,  314,  323,  323,  323,  323,
-      323,  323,  323,  323,  323,  323,  323,  323,  323,  286,
-      480,  480,  286,  286,  286,  286,  286,  286,  286,  286,
-      286,  286,  328,  328,  328,  328,  328,  328,  328,  328,
-
-      328,  328,  328,  328,  328,  250,  250,  250,  250,  250,
-      480,  480,  250,  250,  250,  250,  250,  250,  289,  289,
-      289,  289,  289,  289,  289,  289,  289,  289,  289,  289,
-      289,   39,   39,   39,   39,   39,   39,   39,   39,   39,
-       39,   39,   39,   39,  113,  113,  480,  113,  113,   48,
-       48,   48,   48,   48,   48,   48,   48,   48,   48,   48,
-       48,   48,  350,  350,  350,  350,  283,  283,  480,  283,
-      283,  283,  283,  283,  283,  283,  283,  283,  283,  323,
-      323,  323,  323,  323,  323,  323,  323,  323,  323,  323,
-      323,  323,  286,  286,  480,  286,  286,  286,  286,  286,
-
-      286,  286,  286,  286,  286,  328,  328,  328,  328,  328,
-      328,  328,  328,  328,  328,  328,  328,  328,  250,  250,
-      250,  250,  250,  480,  480,  250,  250,  250,  250,  250,
-      250,  415,  415,  415,  415,  480,  480,  480,  480,  415,
-      480,  480,  415,  415,  427,  427,  427,  427,  480,  480,
-      480,  427,  427,  427,  480,  427,  427,  429,  429,  429,
-      429,  429,  429,  429,  429,  429,  429,  438,  438,  438,
-      438,  438,  438,  438,  438,  438,  438,    7,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480
+        8,    8,   15,    8,    8,   16,   17,   18,   19,   20,
+       21,    8,   22,    8,    8,    8,   23,   24,   25,   26,
+       26,   26,   26,   26,   26,   26,   26,   26,   26,   26,
+       26,   26,   26,   27,   26,   26,   26,   26,   26,   26,
+       28,   26,   26,   26,   26,   26,    8,   29,   30,   26,
+       31,  156,   31,   37,   37,   37,   37,   37,   41,   32,
+       52,   32,   37,   37,   37,   37,   37,   38,   38,   38,
+       38,   38,   33,   34,   33,   34,   43,  132,   42,   44,
+       41,   97,   97,   53,  135,   35,   45,   35,   94,   47,
+
+       47,   47,   47,   47,   47,   50,   54,   94,   82,   52,
+       97,   98,   96,   41,   39,   41,   55,   94,   83,  156,
+      100,   96,   52,   85,  156,   94,   86,  161,   50,   87,
+       94,   96,   57,   88,   89,   42,   90,  481,   99,   96,
+      481,   58,   61,   92,   96,   53,  132,   45,  133,   62,
+       63,  101,   64,   92,   92,   92,   92,   92,   92,   65,
+      104,   66,   67,   67,   68,   69,   70,   67,   71,   72,
+       73,   67,   74,   67,   75,   76,   67,   77,   67,   78,
+       79,   80,   67,   67,   67,   67,   67,   67,   94,   94,
+       94,   67,   97,   98,   37,   37,   37,   37,   37,  481,
+
+      114,   59,   96,   96,   96,   38,   38,   38,   38,   38,
+      114,  114,  114,  114,  114,  114,  116,  156,  106,   94,
+      105,  107,   97,   98,   67,  119,  116,  116,  116,  116,
+      116,  116,  118,   96,  158,  119,  119,  119,  119,  119,
+      119,   92,   39,   40,   40,   40,  109,   94,  132,  111,
+      132,   92,   92,   92,   92,   92,   92,  132,  156,  196,
+      128,   96,  112,  134,  188,  160,  132,  132,  126,  113,
+      138,  132,  112,  112,  112,  112,  112,  112,   49,   49,
+       49,  120,  136,  132,  132,  139,  148,  140,  130,  122,
+      149,  132,  156,  137,  141,   97,  144,  123,  130,  130,
+
+      130,  130,  130,  130,  124,  132,  132,  123,  123,  123,
+      123,  123,  123,  132,  150,  481,  132,  154,  145,  156,
+      142,  156,   94,  156,  162,   83,  143,  154,  154,  154,
+      154,  154,  154,  157,  159,  146,   96,  132,  156,  147,
+      194,   40,   94,  156,  195,  201,   41,  165,   41,   41,
+      152,   91,   91,   91,   91,   91,   96,  165,  165,  165,
+      165,  165,  165,   94,   94,   94,   42,  156,   42,   42,
+      163,  167,   94,   94,   94,   94,   41,   96,   96,   96,
+      163,  163,  163,  163,  163,  163,   96,   96,   96,   96,
+      132,   50,  169,  172,   94,  132,  132,  170,   41,  193,
+
+      171,  168,  169,  169,  169,  169,  169,  169,   96,  175,
+      173,   49,  132,   50,  192,  156,  199,  156,  197,   41,
+      179,   41,  174,  110,  177,  177,  177,  110,  132,   41,
+      179,  179,  179,  179,  179,  179,   50,  156,  156,   42,
+      205,  156,  178,  198,  208,  235,  156,  156,   94,   42,
+      156,  156,  178,  178,  178,  178,  178,  178,   40,   40,
+       40,  109,   96,  206,  111,  209,  186,  156,  182,  207,
+      229,   94,  213,  406,  188,  156,  210,  112,  182,  182,
+      182,  182,  182,  182,  113,   96,   96,  112,  112,  112,
+      112,  112,  112,  115,  115,  115,  115,  115,  214,  156,
+
+      156,  132,  196,  183,  132,  218,  216,   94,  232,  132,
+      233,  156,  180,  183,  183,  183,  183,  183,  183,   96,
+      213,   96,  180,  180,  180,  180,  180,  180,  121,  184,
+      184,  184,  121,  239,   96,  156,  156,  156,  191,   41,
+      156,   94,  156,  242,  243,  274,  241,  185,  191,  191,
+      191,  191,  191,  191,   50,   96,   41,  185,  185,  185,
+      185,  185,  185,   49,   49,   49,  120,   94,  272,  214,
+      379,   50,  214,  204,  122,  132,   94,  248,  156,  214,
+      280,   96,  123,  204,  204,  204,  204,  204,  204,  124,
+       96,  234,  123,  123,  123,  123,  123,  123,  129,  129,
+
+      129,  129,  129,  227,  156,  156,  156,  156,  211,  156,
+      347,  156,  156,  309,  348,  306,  447,  189,  211,  211,
+      211,  211,  211,  211,  132,  238,  240,  189,  189,  189,
+      189,  189,  189,  153,  153,  153,  153,  153,  156,   94,
+       94,  132,  156,  156,  156,  156,  167,   94,  373,  374,
+      310,  268,  202,   96,   96,  156,  267,  156,  156,  156,
+       94,   96,  202,  202,  202,  202,  202,  202,  164,  164,
+      164,  164,  164,  156,   96,  286,  271,  273,  221,  275,
+      387,  219,  367,  303,  357,  264,  356,  212,  221,  221,
+      221,  221,  221,  221,  222,  287,  286,  212,  212,  212,
+
+      212,  212,  212,  223,  222,  222,  222,  222,  222,  222,
+      156,  289,  156,  223,  223,  223,  223,  223,  223,  181,
+      181,  181,  181,  181,  371,  214,  286,  214,  156,  225,
+      312,  399,  311,  317,  156,  352,  355,  354,  224,  225,
+      225,  225,  225,  225,  225,  226,  287,  286,  224,  224,
+      224,  224,  224,  224,  230,  226,  226,  226,  226,  226,
+      226,  286,  289,  156,  230,  230,  230,  230,  230,  230,
+      190,  190,  190,  190,  190,  284,  284,  284,  284,  284,
+      236,  287,  445,  322,  322,  322,  322,  322,  255,  231,
+      236,  236,  236,  236,  236,  236,  323,  156,  156,  231,
+
+      231,  231,  231,  231,  231,  203,  203,  203,  203,  203,
+      322,  322,  322,  322,  322,  244,  156,  353,   94,  343,
+      346,  436,  340,  323,  237,  244,  244,  244,  244,  244,
+      244,  245,   96,  286,  237,  237,  237,  237,  237,  237,
+      246,  245,  245,  245,  245,  245,  245,  156,  289,  156,
+      246,  246,  246,  246,  246,  246,  251,  251,  251,  251,
+      251,  258,  253,  156,   94,  286,  286,  254,  432,  255,
+      388,  258,  258,  258,  258,  258,  258,  259,   96,  285,
+      156,  118,  256,  260,  286,  287,  287,  259,  259,  259,
+      259,  259,  259,  260,  260,  260,  260,  260,  260,  261,
+
+      156,  156,  369,  397,  287,  262,  335,  394,  395,  261,
+      261,  261,  261,  261,  261,  262,  262,  262,  262,  262,
+      262,  263,  115,  115,  115,  115,  115,  265,  156,  286,
+      286,  263,  263,  263,  263,  263,  263,  265,  265,  265,
+      265,  265,  265,  266,  289,  289,  156,  156,  118,  269,
+      435,  424,  407,  266,  266,  266,  266,  266,  266,  269,
+      269,  269,  269,  269,  269,  270,  129,  129,  129,  129,
+      129,  276,  321,  156,   94,  270,  270,  270,  270,  270,
+      270,  276,  276,  276,  276,  276,  276,  277,   96,  156,
+      320,  380,  132,  278,  156,  446,  396,  277,  277,  277,
+
+      277,  277,  277,  278,  278,  278,  278,  278,  278,  251,
+      251,  251,  251,  251,  434,  253,  319,  156,  403,  156,
+      254,  288,  255,  284,  284,  284,  284,  284,  297,  481,
+       94,  286,   96,  408,  481,  256,  255,  459,  297,  297,
+      297,  297,  297,  297,   96,  156,  289,  156,  156,  256,
+      284,  284,  284,  284,  290,  398,  292,  156,  419,  409,
+      298,  292,  292,  293,  393,  420,  318,  156,  156,  294,
+      298,  298,  298,  298,  298,  298,  295,  299,  421,  294,
+      294,  294,  294,  294,  294,  300,  156,  299,  299,  299,
+      299,  299,  299,  301,  132,  300,  300,  300,  300,  300,
+
+      300,  302,  433,  301,  301,  301,  301,  301,  301,  304,
+      296,  302,  302,  302,  302,  302,  302,  305,  283,  304,
+      304,  304,  304,  304,  304,  307,  282,  305,  305,  305,
+      305,  305,  305,  308,  281,  307,  307,  307,  307,  307,
+      307,  313,  156,  308,  308,  308,  308,  308,  308,  314,
+      132,  313,  313,  313,  313,  313,  313,  315,  156,  314,
+      314,  314,  314,  314,  314,  422,  156,  315,  315,  315,
+      315,  315,  315,  285,  285,  285,  324,  156,  156,  326,
+      410,  156,  404,  156,  474,  405,  411,  284,  284,  284,
+      284,  284,  327,  481,  156,  418,  156,  454,  481,  328,
+
+      255,  423,  327,  327,  327,  327,  327,  327,  288,  288,
+      288,  329,  156,  256,  156,  438,  465,  156,  132,  331,
+      284,  284,  284,  284,  284,  425,  481,  332,  156,  156,
+      156,  481,  451,  255,  333,  437,  443,  332,  332,  332,
+      332,  332,  332,  229,  257,  156,  256,  284,  284,  284,
+      284,  284,  156,  481,  156,  444,  156,  470,  481,  471,
+      255,  284,  284,  284,  284,  284,  336,  481,  452,  156,
+      475,  453,  481,  256,  255,  156,  336,  336,  336,  336,
+      336,  336,  428,  428,  428,  428,  428,  256,  290,  290,
+      290,  290,  290,  156,  481,  429,  466,  250,  337,  481,
+
+      457,  255,  153,  153,  153,  153,  153,  334,  337,  337,
+      337,  337,  337,  337,  256,  249,  156,  334,  334,  334,
+      334,  334,  334,  284,  284,  284,  284,  290,  156,  292,
+      156,  156,  132,  338,  292,  292,  293,  458,  460,  156,
+      132,  132,  294,  338,  338,  338,  338,  338,  338,  295,
+      339,  132,  294,  294,  294,  294,  294,  294,  341,  469,
+      339,  339,  339,  339,  339,  339,  342,  156,  341,  341,
+      341,  341,  341,  341,  344,  132,  342,  342,  342,  342,
+      342,  342,  345,  229,  344,  344,  344,  344,  344,  344,
+      473,  156,  345,  345,  345,  345,  345,  345,   91,   91,
+
+       91,   91,   91,  349,  481,  481,  481,  481,  481,  156,
+       94,  463,  480,  349,  349,  349,  349,  349,  349,  350,
+      481,  156,  156,  479,   96,  118,  220,  478,  217,  350,
+      350,  350,  350,  350,  350,  358,  322,  322,  322,  358,
+      166,  286,  464,  362,  322,  322,  322,  362,  359,  156,
+      156,  156,  156,  200,  286,  132,  363,  476,  477,  132,
+      366,  287,  325,  360,  360,  360,  325,  132,  286,  289,
+      366,  366,  366,  366,  366,  366,  358,  322,  322,  322,
+      358,  361,  286,  181,  181,  181,  181,  181,  287,  359,
+      132,  361,  361,  361,  361,  361,  361,  285,  285,  285,
+
+      324,  132,  287,  326,  132,  132,  132,   40,  132,  118,
+      132,  190,  190,  190,  190,  190,  327,   40,   40,   40,
+       40,   40,   40,  328,  132,  132,  327,  327,  327,  327,
+      327,  327,  330,  364,  364,  364,  330,  132,  128,  118,
+      118,  176,  368,  286,  166,  203,  203,  203,  203,  203,
+      156,  365,  368,  368,  368,  368,  368,  368,  289,  151,
+      132,  365,  365,  365,  365,  365,  365,  288,  288,  288,
+      329,  156,  132,   59,   65,   61,  128,   49,  331,  125,
+      118,  108,  103,  102,   93,   81,  332,   49,   49,   49,
+       49,   49,   49,  333,  370,   60,  332,  332,  332,  332,
+
+      332,  332,  372,   59,  370,  370,  370,  370,  370,  370,
+       51,   48,  372,  372,  372,  372,  372,  372,  164,  164,
+      164,  164,  164,  375,  481,   36,   36,  481,  481,  481,
+       94,  481,  481,  375,  375,  375,  375,  375,  375,  376,
+      481,  481,  481,  481,   96,  481,  481,  481,  481,  376,
+      376,  376,  376,  376,  376,  362,  322,  322,  322,  362,
+      377,  481,  481,  481,  481,  481,  286,  481,  363,  481,
+      377,  377,  377,  377,  377,  377,  378,  481,  481,  156,
+      481,  289,  481,  481,  481,  381,  378,  378,  378,  378,
+      378,  378,  382,  481,  383,  389,  481,  481,  481,  384,
+
+      385,  390,  481,  386,  481,  389,  389,  389,  389,  389,
+      389,  390,  390,  390,  390,  390,  390,  391,  481,  481,
+      481,  481,  481,  392,  481,  481,  481,  391,  391,  391,
+      391,  391,  391,  392,  392,  392,  392,  392,  392,  400,
+      481,  481,  481,  481,  481,  401,  481,  481,  481,  400,
+      400,  400,  400,  400,  400,  401,  401,  401,  401,  401,
+      401,  402,  481,  481,  481,  481,  481,  412,  481,  481,
+      481,  402,  402,  402,  402,  402,  402,  412,  412,  412,
+      412,  412,  412,  413,  481,  481,  481,  481,  481,  252,
+      481,  481,  481,  413,  413,  413,  413,  413,  413,  252,
+
+      252,  252,  252,  252,  252,  414,  414,  414,  414,  414,
+      481,  481,  285,  481,  481,  481,  481,  481,  481,  481,
+      481,  415,  285,  285,  285,  285,  285,  285,  288,  481,
+      481,  416,  414,  414,  414,  414,  414,  481,  288,  288,
+      288,  288,  288,  288,  481,  481,  481,  481,  415,  427,
+      481,  481,  428,  428,  428,  428,  428,  481,  416,  427,
+      427,  427,  427,  427,  427,  429,  428,  428,  428,  428,
+      428,  481,  428,  428,  428,  428,  428,  481,  431,  429,
+      481,  481,  481,  481,  481,  429,  481,  481,  481,  442,
+      481,  481,  431,  439,  439,  439,  439,  439,  431,  442,
+
+      442,  442,  442,  442,  442,  481,  429,  428,  428,  428,
+      428,  428,  440,  481,  481,  481,  481,  481,  481,  431,
+      429,  481,  440,  440,  440,  440,  440,  440,  448,  481,
+      481,  481,  481,  431,  481,  481,  481,  481,  448,  448,
+      448,  448,  448,  448,  428,  428,  428,  428,  428,  455,
+      481,  481,  428,  428,  428,  428,  428,  429,  481,  455,
+      455,  455,  455,  455,  455,  429,  481,  481,  481,  456,
+      431,  449,  449,  449,  449,  449,  481,  481,  431,  456,
+      456,  456,  456,  456,  456,  481,  481,  481,  481,  481,
+      450,  481,  481,  481,  481,  481,  461,  481,  481,  481,
+
+      450,  450,  450,  450,  450,  450,  461,  461,  461,  461,
+      461,  461,  462,  481,  481,  481,  481,  481,  467,  481,
+      481,  481,  462,  462,  462,  462,  462,  462,  467,  467,
+      467,  467,  467,  467,  468,  481,  481,  481,  481,  481,
+      430,  481,  481,  481,  468,  468,  468,  468,  468,  468,
+      430,  430,  430,  430,  430,  430,  472,  481,  481,  481,
+      481,  481,  430,  481,  481,  481,  472,  472,  472,  472,
+      472,  472,  430,  430,  430,  430,  430,  430,   40,  481,
+       40,   40,   40,   40,   40,   40,   40,   40,   40,   46,
+       46,  481,   46,   46,   49,  481,   49,   49,   49,   49,
+
+       49,   49,   49,   49,   49,   56,   56,  481,   56,   56,
+       84,  481,  481,   84,   84,   91,   91,   91,   91,   91,
+       91,   91,   91,   91,   95,  481,   95,   95,  481,   95,
+       95,  110,  110,  110,  110,  110,  110,  110,  110,  110,
+      110,  110,  115,  115,  115,  115,  115,  115,  115,  115,
+      115,  117,  117,  481,  117,  117,  121,  121,  121,  121,
+      121,  121,  121,  121,  121,  121,  121,  127,  127,  127,
+      127,  127,  127,  127,  127,  127,  127,  127,  127,   67,
+       67,  129,  129,  129,  129,  129,  129,  129,  129,  129,
+      131,  131,  481,  131,  131,  153,  153,  153,  153,  153,
+
+      153,  153,  153,  153,  155,  155,  481,  155,  155,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  181,  181,
+      181,  181,  181,  181,  181,  181,  181,  187,  187,  187,
+      187,  187,  187,  187,  187,  187,  187,  187,  187,  190,
+      190,  190,  190,  190,  190,  190,  190,  190,  203,  203,
+      203,  203,  203,  203,  203,  203,  203,  215,  215,  215,
+      481,  215,  228,  228,  228,  228,  228,  228,  228,  228,
+      228,  228,  228,  228,  247,  247,  247,  481,  247,  252,
+      252,  252,  252,  481,  252,  252,  252,  252,  252,  252,
+      279,  279,  279,  481,  279,  285,  481,  285,  285,  285,
+
+      285,  285,  285,  285,  285,  285,  288,  481,  288,  288,
+      288,  288,  288,  288,  288,  288,  288,  291,  291,  291,
+      291,  291,  291,  291,  291,  291,  291,  291,  316,  316,
+      316,  481,  316,  325,  325,  325,  325,  325,  325,  325,
+      325,  325,  325,  325,  330,  330,  330,  330,  330,  330,
+      330,  330,  330,  330,  330,  351,  351,  351,  481,  351,
+      417,  417,  417,  481,  481,  481,  417,  481,  481,  417,
+      417,  426,  426,  426,  426,  426,  426,  426,  426,  426,
+      430,  430,  430,  481,  481,  430,  430,  430,  481,  430,
+      430,  441,  441,  441,  441,  441,  441,  441,  441,  441,
+
+        7,  481,  481,  481,  481,  481,  481,  481,  481,  481,
+      481,  481,  481,  481,  481,  481,  481,  481,  481,  481,
+      481,  481,  481,  481,  481,  481,  481,  481,  481,  481,
+      481,  481,  481,  481,  481,  481,  481,  481,  481,  481,
+      481,  481,  481,  481,  481,  481,  481,  481,  481,  481,
+      481,  481,  481,  481,  481,  481,  481,  481,  481,  481,
+      481
     } ;
 
-static yyconst flex_int16_t yy_chk[6664] =
+static yyconst short int yy_chk[2462] =
     {   0,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
@@ -1050,805 +569,346 @@ static yyconst flex_int16_t yy_chk[6664] =
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
-        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
-        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
-        1,    1,    1,    1,    1,    3,    5,    4,    6,   15,
-       12,    3,  479,    4,    9,    9,    9,    9,    9,   10,
-
-       10,   10,   10,   10,    3,    3,    4,    4,   11,   11,
-       11,   11,   11,   23,   39,    5,   17,    6,   35,   17,
-        3,   24,    4,   32,   24,   24,   32,   32,   38,   48,
-       15,   69,    3,    3,    4,    4,   12,   42,   25,   17,
-       42,   25,   11,  476,   69,    3,   35,    4,   17,   24,
-       53,   32,   17,   23,   31,   78,   38,   78,   35,   69,
-       39,   24,  469,   32,   33,  463,   65,   17,   83,   25,
-       48,   11,   13,   42,   35,   13,   17,   24,   25,   32,
-       83,   31,   13,   13,   13,   13,   13,   13,   65,   54,
-       53,   33,   54,   54,   31,   65,   83,   25,   36,   36,
-
-       36,   36,   36,   70,   33,   68,   68,  458,   13,   31,
-      167,   13,   13,   13,   13,   13,   13,   20,  167,   33,
-      213,   90,   70,  442,   20,   20,  436,   20,  213,   54,
-      124,  124,   70,   68,   20,   20,   20,   20,   20,   20,
-       20,   20,   20,   20,   20,   20,   20,   20,   20,   20,
-       20,   20,   20,   20,   20,   20,   20,   20,   20,   20,
-       20,   90,   20,   20,   20,   20,   20,   20,   20,   20,
-       20,   20,   20,   20,   20,   20,   20,   20,   20,   20,
-       20,   20,   20,   20,   20,   20,   20,   20,   64,   52,
-       80,   20,   22,  489,   55,  489,   37,   37,   37,   37,
-
-       37,   57,   64,   57,   22,  245,  501,   22,  501,   52,
-       22,  131,   55,  245,   22,   22,   64,   22,  494,  494,
-       67,   66,   80,   57,   72,   72,   80,   97,   22,   67,
-       37,  131,   66,   22,   55,   66,   22,   52,   71,   22,
-      131,   55,   22,   22,   71,   22,   26,   73,   67,   66,
-       80,   57,   71,   26,   26,   26,   26,   26,   26,   37,
-       66,   72,  108,  118,   73,   84,   71,   97,   73,   74,
-       93,   73,   71,   74,  109,   76,   73,   93,  106,   84,
-       82,   76,   26,   26,   26,   26,   26,   26,   41,   41,
-       41,   41,   73,   84,   41,   74,   73,   86,   74,   82,
-
-       85,   87,   74,   76,  118,  237,  106,   41,  108,   82,
-       93,  105,   96,  104,   41,   41,   41,   41,   41,   41,
-      109,  431,   85,   86,  127,  119,   86,   87,  127,   85,
-       87,   94,  421,  102,  103,  119,  140,   96,  104,  387,
-       41,  237,  105,   41,   41,   41,   41,   41,   41,   44,
-      102,  105,   96,  104,  134,  386,   44,   44,   44,   44,
-       44,   44,  120,  107,   94,   96,  104,  103,  107,  140,
-      105,   94,  120,  102,  103,  162,  119,  175,  125,  102,
-      134,  144,   44,  134,  149,   44,   44,   44,   44,   44,
-       44,   46,   94,  125,  149,  103,  137,  137,   46,   46,
-
-       46,   46,   46,   46,  144,  175,  350,  344,  176,  145,
-      144,  146,  149,  120,  107,  162,  151,  154,  125,  157,
-      146,  319,  125,  145,  137,  166,  169,   46,   46,   46,
-       46,   46,   46,   49,   49,   49,   49,  145,  151,  146,
-      155,  158,  157,  154,   49,  151,  154,  156,  157,  193,
-      159,  318,   49,  155,  176,  158,  171,  172,  156,   49,
-       49,   49,   49,   49,   49,  166,  169,  165,  155,  158,
-      159,  173,  174,  183,  165,  156,  185,  218,  317,  159,
-      204,  316,  193,  183,  295,   49,  196,  204,   49,   49,
-       49,   49,   49,   49,   56,  219,  171,  172,  191,  196,
-
-      185,   56,   56,   56,   56,   56,   56,  165,  204,  173,
-      203,  173,  174,  295,  196,  315,  185,  218,  251,  203,
-      198,  191,  206,  219,  183,  200,  252,  191,  185,  205,
-       56,   56,   56,   56,   56,   56,   77,  173,  203,  207,
-      206,  205,  198,   77,   77,   77,   77,   77,   77,  198,
-      200,  206,  228,  239,  200,  233,  228,  205,  277,  226,
-      283,  207,  208,  314,  251,  342,  277,  252,  207,  233,
-      286,  314,   77,   77,   77,   77,   77,   77,   88,  239,
-      256,  226,  239,  233,  208,   88,   88,   88,   88,   88,
-       88,  208,  216,  216,  216,  216,  216,  234,  216,  226,
-
-      322,  342,  327,  216,  267,  216,  283,  309,  256,  308,
-      226,  286,  238,  234,   88,   88,   88,   88,   88,   88,
-       91,  238,  267,  269,  310,  234,  236,   91,   91,   91,
-       91,   91,   91,  267,  236,  308,  323,  298,  308,  240,
-      238,  323,  271,  327,  216,  269,  322,  240,  270,  271,
-      310,  334,  269,  310,  236,  281,   91,   91,   91,   91,
-       91,   91,   98,   98,   98,   98,   98,  240,  392,  270,
-      271,  273,  392,  305,   98,  366,  307,  270,  280,  334,
-      305,   98,  273,  307,  345,  339,  346,  323,   98,   98,
-       98,   98,   98,   98,  249,  249,  249,  249,  249,  273,
-
-      249,  305,  368,  366,  307,  249,  279,  249,  345,  511,
-      346,  511,  368,  345,   98,  346,  339,   98,   98,   98,
-       98,   98,   98,  110,  110,  110,  110,  110,  465,  110,
-      282,  282,  282,  282,  282,  284,  284,  284,  284,  284,
-      358,  368,  110,  282,  339,  358,  249,  379,  284,  110,
-      110,  110,  110,  110,  110,  250,  250,  250,  250,  250,
-      394,  250,  394,  385,  465,  445,  250,  278,  250,  367,
-      367,  367,  367,  367,  379,  110,  272,  445,  110,  110,
-      110,  110,  110,  110,  111,  111,  111,  111,  394,  385,
-      111,  358,  385,  445,  248,  288,  288,  288,  288,  288,
-
-      359,  247,  379,  111,  372,  359,  405,  250,  288,  246,
-      111,  111,  111,  111,  111,  111,  289,  289,  289,  289,
-      289,  290,  290,  290,  290,  290,  372,  405,  328,  289,
-      513,  241,  513,  372,  290,  405,  111,  231,  328,  111,
-      111,  111,  111,  111,  111,  114,  395,  288,  420,  230,
-      227,  359,  114,  114,  114,  114,  114,  114,  291,  291,
-      291,  291,  291,  320,  320,  320,  320,  320,  289,  395,
-      362,  291,  215,  290,  420,  395,  320,  420,  114,  328,
-      362,  114,  114,  114,  114,  114,  114,  115,  214,  333,
-      333,  333,  333,  333,  115,  115,  115,  115,  115,  115,
-
-      324,  324,  324,  324,  324,  333,  324,  517,  201,  517,
-      291,  417,  434,  324,  335,  335,  335,  335,  335,  417,
-      335,  362,  434,  115,  115,  115,  115,  115,  115,  117,
-      117,  117,  117,  117,  348,  348,  348,  348,  348,  417,
-      434,  195,  194,  338,  338,  338,  338,  338,  117,  192,
-      348,  373,  324,  190,  338,  117,  117,  117,  117,  117,
-      117,  329,  329,  329,  329,  329,  335,  369,  369,  369,
-      369,  369,  329,  373,  329,  347,  347,  347,  347,  347,
-      373,  380,  404,  381,  117,  117,  117,  117,  117,  117,
-      121,  121,  121,  121,  121,  338,  519,  526,  519,  526,
-
-      404,  121,  383,  380,  363,  381,  188,  186,  383,  121,
-      380,  404,  381,  329,  363,  180,  121,  121,  121,  121,
-      121,  121,  357,  357,  357,  357,  357,  347,  357,  396,
-      383,  464,  419,  464,  382,  357,  371,  371,  371,  371,
-      371,  419,  121,  384,  396,  121,  121,  121,  121,  121,
-      121,  122,  122,  122,  122,  363,  382,  396,  168,  464,
-      419,  397,  122,  382,  435,  384,  393,  164,  160,  393,
-      122,  435,  384,  406,  357,  407,  397,  122,  122,  122,
-      122,  122,  122,  361,  361,  361,  361,  361,  371,  397,
-      393,  406,  435,  152,  361,  393,  361,  407,  393,  398,
-
-      403,  422,  406,  122,  407,  398,  122,  122,  122,  122,
-      122,  122,  129,  410,  398,  403,  529,  150,  529,  129,
-      129,  129,  129,  129,  129,  422,  147,  398,  403,  143,
-      422,  410,  409,  398,  539,  361,  539,  546,  409,  546,
-      408,  142,  410,  402,  402,  402,  402,  402,  129,  129,
-      129,  129,  129,  129,  148,  148,  148,  148,  148,  402,
-      409,  141,  408,  418,  401,  401,  401,  401,  401,  408,
-      139,  138,  423,  148,  136,  135,  418,  401,  133,  424,
-      148,  148,  148,  148,  148,  148,  411,  411,  411,  411,
-      411,  418,  411,  132,  423,  402,  412,  412,  412,  412,
-
-      412,  423,  547,  130,  547,  424,  148,  412,  424,  148,
-      148,  148,  148,  148,  148,  153,  401,  413,  413,  413,
-      413,  413,  153,  153,  153,  153,  153,  153,  414,  414,
-      414,  414,  414,  413,  128,  126,  116,  113,  411,   95,
-       92,   81,  433,   79,  414,  432,   75,   63,  412,   61,
-       60,  153,  153,  153,  153,  153,  153,  161,  161,  161,
-      161,  161,  425,  425,  425,  425,  425,  432,  433,  413,
-      437,  433,  444,  459,  432,  425,  161,   59,  444,  446,
-      414,  459,  443,  161,  161,  161,  161,  161,  161,  415,
-      415,  415,  415,  415,  446,  437,  443,  468,   58,  437,
-
-      444,  459,  415,  468,   51,  450,  451,  446,  472,  161,
-      443,  477,  161,  161,  161,  161,  161,  161,  163,  163,
-      163,  163,  163,  472,   45,  468,  477,  450,  451,  427,
-      427,  427,  427,  427,  450,  451,  472,  163,  453,  477,
-      473,  415,  427,  470,  163,  163,  163,  163,  163,  163,
-      429,  429,  429,  429,  429,  438,  438,  438,  438,  438,
-      453,   29,  473,  429,   28,   27,  470,  453,  438,  473,
-      456,  452,  470,  163,  163,  163,  163,  163,  163,  170,
-      452,  427,  474,   21,  475,   19,  170,  170,  170,  170,
-      170,  170,  440,  440,  440,  440,  440,   18,  456,  452,
-
-      457,  462,  429,   16,  474,  440,  456,  438,  475,  457,
-      462,  474,   14,  475,    7,  170,  170,  170,  170,  170,
-      170,  177,  177,  177,  177,  177,  456,  177,  457,  462,
-        0,    0,  447,  447,  447,  447,  447,    0,    0,    0,
-      177,    0,    0,    0,  440,  447,    0,  177,  177,  177,
-      177,  177,  177,  467,  467,  467,  467,  467,  471,  471,
-      471,  471,  471,    0,    0,    0,  467,  478,    0,    0,
-        0,  471,    0,  177,    0,  478,  177,  177,  177,  177,
-      177,  177,  179,    0,  447,    0,    0,    0,    0,  179,
-      179,  179,  179,  179,  179,  478,    0,    0,    0,    0,
-
-        0,    0,    0,    0,    0,  467,    0,    0,    0,    0,
-      471,    0,    0,    0,    0,    0,    0,    0,  179,  179,
-      179,  179,  179,  179,  181,  181,  181,  181,  181,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,  181,    0,    0,    0,    0,    0,    0,
-      181,  181,  181,  181,  181,  181,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,  181,
-      181,  181,  181,  181,  181,  182,  182,  182,  182,  182,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-
-        0,    0,    0,    0,  182,    0,    0,    0,    0,    0,
-        0,  182,  182,  182,  182,  182,  182,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-      182,  182,  182,  182,  182,  182,  184,  184,  184,  184,
-      184,    0,    0,    0,    0,    0,    0,  184,    0,    0,
-        0,    0,    0,    0,    0,  184,    0,    0,    0,    0,
-        0,    0,  184,  184,  184,  184,  184,  184,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,  184,    0,
-
-        0,  184,  184,  184,  184,  184,  184,  189,  189,  189,
-      189,  189,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,  189,    0,    0,    0,
-        0,    0,    0,  189,  189,  189,  189,  189,  189,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,  189,  189,  189,  189,  189,  189,  197,    0,
-        0,    0,    0,    0,    0,  197,  197,  197,  197,  197,
-      197,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-
-        0,    0,    0,    0,  197,  197,  197,  197,  197,  197,
-      202,  202,  202,  202,  202,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,  202,
-        0,    0,    0,    0,    0,    0,  202,  202,  202,  202,
-      202,  202,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,  202,  202,  202,  202,  202,
-      202,  209,    0,    0,    0,    0,    0,    0,  209,  209,
-      209,  209,  209,  209,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-
-        0,    0,    0,    0,    0,    0,    0,  209,  209,  209,
-      209,  209,  209,  210,  210,  210,  210,  210,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,  210,    0,    0,    0,    0,    0,    0,  210,
-      210,  210,  210,  210,  210,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,  210,  210,
-      210,  210,  210,  210,  217,    0,    0,    0,    0,    0,
-        0,  217,  217,  217,  217,  217,  217,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-      217,  217,  217,  217,  217,  217,  220,  220,  220,  220,
-      220,    0,  220,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,  220,    0,    0,    0,    0,
-        0,    0,  220,  220,  220,  220,  220,  220,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,  220,    0,
-        0,  220,  220,  220,  220,  220,  220,  222,    0,    0,
-        0,    0,    0,    0,  222,  222,  222,  222,  222,  222,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,  222,  222,  222,  222,  222,  222,  223,
-      223,  223,  223,  223,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,  223,    0,
-        0,    0,    0,    0,    0,  223,  223,  223,  223,  223,
-      223,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,  223,  223,  223,  223,  223,  223,
-      224,  224,  224,  224,  224,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,  224,
-
-        0,    0,    0,    0,    0,    0,  224,  224,  224,  224,
-      224,  224,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,  224,  224,  224,  224,  224,
-      224,  225,  225,  225,  225,  225,    0,    0,    0,    0,
-        0,    0,  225,    0,    0,    0,    0,    0,    0,    0,
-      225,    0,    0,    0,    0,    0,    0,  225,  225,  225,
-      225,  225,  225,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,  225,    0,    0,  225,  225,  225,  225,
-
-      225,  225,  229,  229,  229,  229,  229,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,  229,    0,    0,    0,    0,    0,    0,  229,  229,
-      229,  229,  229,  229,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,  229,  229,  229,
-      229,  229,  229,  232,    0,    0,    0,    0,    0,    0,
-      232,  232,  232,  232,  232,  232,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,  232,
-
-      232,  232,  232,  232,  232,  235,  235,  235,  235,  235,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,  235,    0,    0,    0,    0,    0,
-        0,  235,  235,  235,  235,  235,  235,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-      235,  235,  235,  235,  235,  235,  242,    0,    0,    0,
-        0,    0,    0,  242,  242,  242,  242,  242,  242,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-
-        0,    0,  242,  242,  242,  242,  242,  242,  243,  243,
-      243,  243,  243,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,  243,    0,    0,
-        0,    0,    0,    0,  243,  243,  243,  243,  243,  243,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,  243,  243,  243,  243,  243,  243,  254,
-      254,  254,  254,  254,    0,  254,    0,    0,    0,    0,
-      254,  254,  254,    0,    0,    0,    0,    0,  254,    0,
-        0,    0,    0,    0,    0,  254,  254,  254,  254,  254,
-
-      254,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,  254,    0,    0,  254,  254,  254,  254,  254,  254,
-      255,    0,    0,    0,    0,    0,    0,  255,  255,  255,
-      255,  255,  255,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,  255,  255,  255,  255,
-      255,  255,  257,  257,  257,  257,  257,    0,  257,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,  257,    0,    0,    0,    0,    0,    0,  257,  257,
-
-      257,  257,  257,  257,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,  257,    0,    0,  257,  257,  257,
-      257,  257,  257,  259,    0,    0,    0,    0,    0,    0,
-      259,  259,  259,  259,  259,  259,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,  259,    0,    0,  259,
-      259,  259,  259,  259,  259,  260,  260,  260,  260,  260,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,  260,    0,    0,    0,    0,    0,
-
-        0,  260,  260,  260,  260,  260,  260,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,  260,    0,    0,
-      260,  260,  260,  260,  260,  260,  261,  261,  261,  261,
-      261,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,  261,    0,    0,    0,    0,
-        0,    0,  261,  261,  261,  261,  261,  261,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,  261,  261,  261,  261,  261,  261,  262,  262,  262,
-
-      262,  262,    0,    0,    0,    0,    0,    0,  262,    0,
-        0,    0,    0,    0,    0,    0,  262,    0,    0,    0,
-        0,    0,    0,  262,  262,  262,  262,  262,  262,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,  262,
-        0,    0,  262,  262,  262,  262,  262,  262,  263,  263,
-      263,  263,  263,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,  263,    0,    0,
-        0,    0,    0,    0,  263,  263,  263,  263,  263,  263,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-
-        0,    0,    0,  263,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,  263,  263,  263,  263,  263,  263,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,  263,  264,  264,  264,  264,  264,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,  264,    0,    0,    0,    0,    0,    0,  264,  264,
-      264,  264,  264,  264,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,  264,  264,  264,
-      264,  264,  264,  265,    0,    0,    0,    0,    0,    0,
-
-      265,  265,  265,  265,  265,  265,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,  265,
-      265,  265,  265,  265,  265,  266,  266,  266,  266,  266,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,  266,    0,    0,    0,    0,    0,
-        0,  266,  266,  266,  266,  266,  266,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-      266,  266,  266,  266,  266,  266,  268,  268,  268,  268,
-
-      268,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,  268,    0,    0,    0,    0,
-        0,    0,  268,  268,  268,  268,  268,  268,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,  268,  268,  268,  268,  268,  268,  274,    0,    0,
-        0,    0,    0,    0,  274,  274,  274,  274,  274,  274,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,  274,  274,  274,  274,  274,  274,  275,
-
-      275,  275,  275,  275,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,  275,    0,
-        0,    0,    0,    0,    0,  275,  275,  275,  275,  275,
-      275,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,  275,  275,  275,  275,  275,  275,
-      285,  285,  285,  285,    0,    0,  285,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,  285,
-        0,    0,    0,    0,    0,    0,  285,  285,  285,  285,
-      285,  285,    0,    0,    0,    0,    0,    0,    0,    0,
-
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,  285,    0,    0,  285,  285,  285,  285,  285,
-      285,  287,  287,  287,  287,    0,    0,    0,    0,    0,
-        0,    0,  287,    0,    0,    0,    0,    0,    0,    0,
-      287,    0,    0,    0,    0,    0,    0,  287,  287,  287,
-      287,  287,  287,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,  287,    0,    0,  287,  287,  287,  287,
-      287,  287,  292,  292,  292,  292,  292,    0,    0,    0,
-        0,    0,    0,    0,    0,  292,    0,    0,    0,    0,
-
-        0,  292,    0,    0,    0,    0,    0,    0,  292,  292,
-      292,  292,  292,  292,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,  292,    0,    0,  292,  292,  292,
-      292,  292,  292,  293,  293,  293,  293,  293,    0,  293,
-        0,    0,    0,    0,  293,  293,  293,    0,    0,    0,
-        0,    0,  293,    0,    0,    0,    0,    0,    0,  293,
-      293,  293,  293,  293,  293,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,  293,    0,    0,  293,  293,
-
-      293,  293,  293,  293,  294,    0,    0,    0,    0,    0,
-        0,  294,  294,  294,  294,  294,  294,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-      294,  294,  294,  294,  294,  294,  296,  296,  296,  296,
-      296,    0,  296,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,  296,    0,    0,    0,    0,
-        0,    0,  296,  296,  296,  296,  296,  296,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,  296,    0,
-
-        0,  296,  296,  296,  296,  296,  296,  299,  299,  299,
-      299,  299,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,  299,    0,    0,    0,
-        0,    0,    0,  299,  299,  299,  299,  299,  299,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,  299,
-        0,    0,  299,  299,  299,  299,  299,  299,  300,  300,
-      300,  300,  300,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,  300,    0,    0,
-        0,    0,    0,    0,  300,  300,  300,  300,  300,  300,
-
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,  300,  300,  300,  300,  300,  300,  301,
-      301,  301,  301,  301,    0,    0,    0,    0,    0,    0,
-      301,    0,    0,    0,    0,    0,    0,    0,  301,    0,
-        0,    0,    0,    0,    0,  301,  301,  301,  301,  301,
-      301,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,  301,    0,    0,  301,  301,  301,  301,  301,  301,
-      302,  302,  302,  302,  302,    0,    0,    0,    0,    0,
-
-        0,    0,    0,    0,    0,    0,  302,    0,    0,  302,
-        0,    0,    0,    0,    0,    0,  302,  302,  302,  302,
-      302,  302,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,  302,  302,  302,  302,  302,
-      302,  303,  303,  303,  303,  303,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-      303,    0,    0,    0,    0,    0,    0,  303,  303,  303,
-      303,  303,  303,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-
-        0,    0,    0,    0,    0,    0,  303,  303,  303,  303,
-      303,  303,  304,  304,  304,  304,  304,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,  304,    0,    0,    0,    0,    0,    0,  304,  304,
-      304,  304,  304,  304,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,  304,  304,  304,
-      304,  304,  304,  306,  306,  306,  306,  306,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,  306,    0,    0,    0,    0,    0,    0,  306,
-
-      306,  306,  306,  306,  306,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,  306,  306,
-      306,  306,  306,  306,  311,    0,    0,    0,    0,    0,
-        0,  311,  311,  311,  311,  311,  311,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-      311,  311,  311,  311,  311,  311,  312,  312,  312,  312,
-      312,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,  312,    0,    0,    0,    0,
-
-        0,    0,  312,  312,  312,  312,  312,  312,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,  312,  312,  312,  312,  312,  312,  325,  325,  325,
-      325,  325,    0,  325,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,  325,    0,    0,    0,
-        0,    0,    0,  325,  325,  325,  325,  325,  325,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,  325,
-        0,    0,  325,  325,  325,  325,  325,  325,  326,  326,
-
-      326,  326,    0,    0,  326,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,  326,    0,    0,
-        0,    0,    0,    0,  326,  326,  326,  326,  326,  326,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-      326,    0,    0,  326,  326,  326,  326,  326,  326,  330,
-      330,  330,  330,  330,    0,    0,    0,    0,    0,    0,
-      330,    0,    0,    0,    0,    0,    0,    0,  330,    0,
-        0,    0,    0,    0,    0,  330,  330,  330,  330,  330,
-      330,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,  330,    0,    0,  330,  330,  330,  330,  330,  330,
-      331,  331,  331,  331,    0,    0,    0,    0,    0,    0,
-        0,  331,    0,    0,    0,    0,    0,    0,    0,  331,
-        0,    0,    0,    0,    0,    0,  331,  331,  331,  331,
-      331,  331,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,  331,    0,    0,  331,  331,  331,  331,  331,
-      331,  332,  332,  332,  332,  332,    0,    0,    0,    0,
-        0,    0,    0,    0,  332,    0,    0,    0,    0,    0,
-
-      332,    0,    0,    0,    0,    0,    0,  332,  332,  332,
-      332,  332,  332,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,  332,    0,    0,  332,  332,  332,  332,
-      332,  332,  336,    0,    0,    0,    0,    0,    0,  336,
-      336,  336,  336,  336,  336,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,  336,  336,
-      336,  336,  336,  336,  337,    0,    0,    0,    0,    0,
-        0,  337,  337,  337,  337,  337,  337,    0,    0,    0,
-
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-      337,  337,  337,  337,  337,  337,  340,    0,    0,    0,
-        0,    0,    0,  340,  340,  340,  340,  340,  340,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,  340,  340,  340,  340,  340,  340,  341,  341,
-      341,  341,  341,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,  341,    0,    0,
-        0,    0,    0,    0,  341,  341,  341,  341,  341,  341,
-
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,  341,  341,  341,  341,  341,  341,  343,
-      343,  343,  343,  343,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,  343,    0,
-        0,    0,    0,    0,    0,  343,  343,  343,  343,  343,
-      343,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,  343,  343,  343,  343,  343,  343,
-      360,    0,    0,    0,    0,    0,    0,  360,  360,  360,
-
-      360,  360,  360,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,  360,  360,  360,  360,
-      360,  360,  364,    0,    0,    0,    0,    0,    0,  364,
-      364,  364,  364,  364,  364,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,  364,  364,
-      364,  364,  364,  364,  365,  365,  365,  365,  365,    0,
-        0,    0,    0,    0,    0,    0,    0,  365,    0,    0,
-        0,    0,    0,  365,    0,    0,    0,    0,    0,    0,
-
-      365,  365,  365,  365,  365,  365,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,  365,    0,    0,  365,
-      365,  365,  365,  365,  365,  370,    0,    0,    0,    0,
-        0,    0,  370,    0,  370,    0,    0,    0,    0,  370,
-      370,    0,    0,  370,    0,    0,    0,    0,  370,    0,
-        0,    0,    0,    0,  370,    0,    0,    0,    0,    0,
-      370,    0,  370,    0,    0,    0,    0,  370,  370,    0,
-        0,  370,  375,    0,    0,    0,    0,    0,    0,  375,
-      375,  375,  375,  375,  375,    0,    0,    0,    0,    0,
-
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,  375,  375,
-      375,  375,  375,  375,  376,    0,    0,    0,    0,    0,
-        0,  376,  376,  376,  376,  376,  376,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-      376,  376,  376,  376,  376,  376,  377,    0,    0,    0,
-        0,    0,    0,  377,  377,  377,  377,  377,  377,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-
-        0,    0,  377,  377,  377,  377,  377,  377,  389,    0,
-        0,    0,    0,    0,    0,  389,  389,  389,  389,  389,
-      389,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,  389,  389,  389,  389,  389,  389,
-      390,    0,    0,    0,    0,    0,    0,  390,  390,  390,
-      390,  390,  390,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,  390,  390,  390,  390,
-      390,  390,  391,    0,    0,    0,    0,    0,    0,  391,
-
-      391,  391,  391,  391,  391,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,  391,  391,
-      391,  391,  391,  391,  399,    0,    0,    0,    0,    0,
-        0,  399,  399,  399,  399,  399,  399,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-      399,  399,  399,  399,  399,  399,  400,    0,    0,    0,
-        0,    0,    0,  400,  400,  400,  400,  400,  400,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,  400,  400,  400,  400,  400,  400,  416,    0,
-        0,    0,    0,    0,    0,  416,  416,  416,  416,  416,
-      416,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,  416,  416,  416,  416,  416,  416,
-      428,    0,    0,    0,    0,    0,    0,  428,  428,  428,
-      428,  428,  428,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,  428,  428,  428,  428,
-
-      428,  428,  430,  430,  430,  430,  430,    0,    0,    0,
-        0,    0,    0,    0,    0,  430,    0,    0,    0,    0,
-        0,  430,    0,    0,    0,    0,    0,    0,  430,  430,
-      430,  430,  430,  430,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,  430,    0,    0,  430,  430,  430,
-      430,  430,  430,  439,  439,  439,  439,  439,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,  439,    0,    0,    0,    0,    0,    0,  439,
-      439,  439,  439,  439,  439,    0,    0,    0,    0,    0,
-
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,  439,  439,
-      439,  439,  439,  439,  441,    0,    0,    0,    0,    0,
-        0,  441,  441,  441,  441,  441,  441,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-      441,  441,  441,  441,  441,  441,  448,    0,    0,    0,
-        0,    0,    0,  448,  448,  448,  448,  448,  448,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-
-        0,    0,  448,  448,  448,  448,  448,  448,  449,    0,
-        0,    0,    0,    0,    0,  449,  449,  449,  449,  449,
-      449,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,  449,  449,  449,  449,  449,  449,
-      454,    0,    0,    0,    0,    0,    0,  454,  454,  454,
-      454,  454,  454,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,  454,  454,  454,  454,
-      454,  454,  455,    0,    0,    0,    0,    0,    0,  455,
-
-      455,  455,  455,  455,  455,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,  455,  455,
-      455,  455,  455,  455,  460,    0,    0,    0,    0,    0,
-        0,  460,  460,  460,  460,  460,  460,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-      460,  460,  460,  460,  460,  460,  461,    0,    0,    0,
-        0,    0,    0,  461,  461,  461,  461,  461,  461,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,  461,  461,  461,  461,  461,  461,  466,    0,
-        0,    0,    0,    0,    0,  466,  466,  466,  466,  466,
-      466,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-        0,    0,    0,    0,  466,  466,  466,  466,  466,  466,
-      481,    0,    0,  481,  481,  481,  481,  481,  481,  481,
-      481,  481,  481,  482,  482,    0,  482,  482,  483,    0,
-        0,  483,  483,  483,  483,  483,  483,  483,  483,  483,
-      483,  484,  484,    0,  484,  484,  485,    0,    0,  485,
-
-      485,  486,    0,  486,  486,    0,  486,  486,  487,  487,
-      487,  487,  487,  487,  487,  487,  487,  487,  488,  488,
-      488,  488,  488,  488,  488,  488,  488,  488,  488,  488,
-      488,  490,  490,    0,  490,  490,  491,  491,  491,  491,
-      491,  491,  491,  491,  491,  491,  492,  492,  492,  492,
-      492,  492,  492,  492,  492,  492,  492,  492,  492,  493,
-      493,  493,  493,  493,  493,  493,  493,  493,  493,  493,
-      493,  493,  493,  495,  495,    0,  495,  495,  496,  496,
-      496,  496,  496,  496,  496,  496,  496,  496,  497,  497,
-        0,  497,  497,  498,  498,  498,  498,  498,  498,  498,
-
-      498,  498,  498,  499,  499,  499,  499,  499,  499,  499,
-      499,  499,  499,  500,  500,  500,  502,  502,  502,  502,
-      502,  502,  502,  502,  502,  502,  503,  503,    0,  503,
-      503,  503,  503,  503,  503,  503,  503,  503,  503,  504,
-      504,  504,  504,  504,  504,  504,  504,  504,  504,  504,
-      504,  504,  505,  505,  505,  505,  505,  505,  505,  505,
-      505,  505,  505,  505,  505,  505,  506,  506,  506,  506,
-      506,  506,  506,  506,  506,  506,  506,  506,  506,  506,
-      507,  507,  507,  507,  507,  507,  507,  507,  507,  507,
-      508,  508,  508,  508,  508,  508,  508,  508,  508,  508,
-
-      509,  509,  509,  509,  510,    0,    0,  510,  510,  510,
-      510,  510,  510,  510,  510,  510,  510,  512,  512,  512,
-      512,  512,  512,  512,  512,  512,  512,  512,  512,  512,
-      512,  514,  514,  514,  514,  515,  515,  515,  515,  515,
-      515,    0,  515,  515,  515,  515,  515,  515,  516,  516,
-      516,  516,  516,  516,  516,  516,  516,  516,  516,  516,
-      516,  518,  518,  518,  518,  518,  518,  518,  518,  518,
-      518,  518,  518,  518,  518,  520,  520,  520,  520,  521,
-      521,  521,  521,  521,  521,    0,  521,  521,  521,  521,
-      521,  521,  522,    0,    0,  522,  522,  522,  522,  522,
-
-      522,  522,  522,  522,  522,  523,    0,    0,  523,  523,
-      523,  523,  523,  523,  523,  523,  523,  523,  524,  524,
-      524,  524,  524,  524,  524,  524,  524,  524,  524,  524,
-      524,  525,  525,  525,  525,  525,  525,  525,  525,  525,
-      525,  525,  525,  525,  527,  527,    0,  527,  527,  528,
-      528,  528,  528,  528,  528,  528,  528,  528,  528,  528,
-      528,  528,  530,  530,  530,  530,  531,  531,  531,  531,
-      531,  531,  531,  531,  531,  531,  531,  531,  531,  532,
-        0,    0,  532,  532,  532,  532,  532,  532,  532,  532,
-      532,  532,  533,  533,  533,  533,  533,  533,  533,  533,
-
-      533,  533,  533,  533,  533,  534,  534,  534,  534,  534,
-        0,    0,  534,  534,  534,  534,  534,  534,  535,  535,
-      535,  535,  535,  535,  535,  535,  535,  535,  535,  535,
-      535,  536,  536,  536,  536,  536,  536,  536,  536,  536,
-      536,  536,  536,  536,  537,  537,    0,  537,  537,  538,
-      538,  538,  538,  538,  538,  538,  538,  538,  538,  538,
-      538,  538,  540,  540,  540,  540,  541,  541,    0,  541,
-      541,  541,  541,  541,  541,  541,  541,  541,  541,  542,
-      542,  542,  542,  542,  542,  542,  542,  542,  542,  542,
-      542,  542,  543,  543,    0,  543,  543,  543,  543,  543,
-
-      543,  543,  543,  543,  543,  544,  544,  544,  544,  544,
-      544,  544,  544,  544,  544,  544,  544,  544,  545,  545,
-      545,  545,  545,    0,    0,  545,  545,  545,  545,  545,
-      545,  548,  548,  548,  548,    0,    0,    0,    0,  548,
-        0,    0,  548,  548,  549,  549,  549,  549,    0,    0,
-        0,  549,  549,  549,    0,  549,  549,  550,  550,  550,
-      550,  550,  550,  550,  550,  550,  550,  551,  551,  551,
-      551,  551,  551,  551,  551,  551,  551,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480,  480,  480,  480,  480,  480,  480,  480,
-      480,  480,  480
+        3,  480,    4,    9,    9,    9,    9,    9,   12,    3,
+       17,    4,   10,   10,   10,   10,   10,   11,   11,   11,
+       11,   11,    3,    3,    4,    4,   13,   69,   12,   13,
+       15,   53,   53,   17,   69,    3,   13,    4,   26,   13,
+
+       13,   13,   13,   13,   13,   15,   18,   27,   23,   18,
+       27,   27,   26,   49,   11,   40,   18,   28,   23,  477,
+       28,   27,   52,   23,   89,   56,   23,   89,   49,   23,
+       32,   28,   18,   23,   23,   40,   23,   43,   27,   56,
+       43,   18,   21,   24,   32,   52,   66,   43,   66,   21,
+       21,   28,   21,   24,   24,   24,   24,   24,   24,   21,
+       32,   21,   21,   21,   21,   21,   21,   21,   21,   21,
+       21,   21,   21,   21,   21,   21,   21,   21,   21,   21,
+       21,   21,   21,   21,   21,   21,   21,   21,   34,   33,
+       36,   21,   33,   33,   37,   37,   37,   37,   37,   59,
+
+       44,   59,   34,   33,   36,   38,   38,   38,   38,   38,
+       44,   44,   44,   44,   44,   44,   45,   86,   34,   57,
+       33,   36,   57,   57,   59,   47,   45,   45,   45,   45,
+       45,   45,   47,   57,   86,   47,   47,   47,   47,   47,
+       47,   55,   38,   42,   42,   42,   42,   58,   68,   42,
+       71,   55,   55,   55,   55,   55,   55,   72,   88,  144,
+      128,   58,   42,   68,  128,   88,  144,   70,   58,   42,
+       71,   73,   42,   42,   42,   42,   42,   42,   50,   50,
+       50,   50,   70,   78,   74,   72,   78,   73,   65,   50,
+       78,   80,  470,   70,   74,   76,   76,   50,   65,   65,
+
+       65,   65,   65,   65,   50,   75,   76,   50,   50,   50,
+       50,   50,   50,   77,   80,   82,  141,   83,   77,   87,
+       75,   90,   91,   85,   90,   82,   75,   83,   83,   83,
+       83,   83,   83,   85,   87,   77,   91,  138,  152,   77,
+      138,  109,   95,  464,  141,  152,  109,   96,  110,  111,
+       82,   92,   92,   92,   92,   92,   95,   96,   96,   96,
+       96,   96,   96,   92,   98,   99,  109,  459,  110,  111,
+       92,   98,  101,  104,  105,  107,  121,   92,   98,   99,
+       92,   92,   92,   92,   92,   92,  101,  104,  105,  107,
+      135,  121,  100,  104,  106,  133,  150,  100,  122,  135,
+
+      101,   99,  100,  100,  100,  100,  100,  100,  106,  107,
+      105,  120,  148,  122,  133,  443,  150,  437,  148,  177,
+      114,  120,  106,  112,  112,  112,  112,  112,  149,  112,
+      114,  114,  114,  114,  114,  114,  120,  157,  160,  177,
+      157,  201,  112,  149,  160,  201,  395,  158,  126,  112,
+      161,  159,  112,  112,  112,  112,  112,  112,  113,  113,
+      113,  113,  126,  158,  113,  161,  126,  162,  118,  159,
+      229,  164,  168,  395,  229,  432,  162,  113,  118,  118,
+      118,  118,  118,  118,  113,  164,  168,  113,  113,  113,
+      113,  113,  113,  116,  116,  116,  116,  116,  169,  422,
+
+      388,  192,  196,  119,  194,  171,  169,  172,  192,  196,
+      194,  206,  116,  119,  119,  119,  119,  119,  119,  171,
+      173,  172,  116,  116,  116,  116,  116,  116,  123,  123,
+      123,  123,  123,  206,  173,  208,  209,  210,  132,  123,
+      387,  175,  241,  209,  210,  241,  208,  123,  132,  132,
+      132,  132,  132,  132,  123,  175,  184,  123,  123,  123,
+      123,  123,  123,  124,  124,  124,  124,  219,  239,  215,
+      367,  184,  247,  156,  124,  199,  186,  215,  239,  351,
+      247,  219,  124,  156,  156,  156,  156,  156,  156,  124,
+      186,  199,  124,  124,  124,  124,  124,  124,  130,  130,
+
+      130,  130,  130,  186,  268,  205,  271,  310,  163,  207,
+      310,  312,  438,  271,  312,  268,  438,  130,  163,  163,
+      163,  163,  163,  163,  130,  205,  207,  130,  130,  130,
+      130,  130,  130,  154,  154,  154,  154,  154,  235,  167,
+      174,  232,  272,  347,  348,  346,  167,  264,  347,  348,
+      272,  235,  154,  167,  174,  238,  232,  240,  242,  154,
+      227,  264,  154,  154,  154,  154,  154,  154,  165,  165,
+      165,  165,  165,  373,  227,  253,  238,  240,  178,  242,
+      373,  174,  335,  264,  321,  227,  320,  165,  178,  178,
+      178,  178,  178,  178,  179,  253,  254,  165,  165,  165,
+
+      165,  165,  165,  180,  179,  179,  179,  179,  179,  179,
+      273,  254,  275,  180,  180,  180,  180,  180,  180,  182,
+      182,  182,  182,  182,  343,  279,  285,  316,  386,  183,
+      275,  386,  273,  279,  343,  316,  319,  318,  182,  183,
+      183,  183,  183,  183,  183,  185,  285,  288,  182,  182,
+      182,  182,  182,  182,  189,  185,  185,  185,  185,  185,
+      185,  325,  288,  435,  189,  189,  189,  189,  189,  189,
+      191,  191,  191,  191,  191,  284,  284,  284,  284,  284,
+      202,  325,  435,  286,  286,  286,  286,  286,  284,  191,
+      202,  202,  202,  202,  202,  202,  286,  306,  309,  191,
+
+      191,  191,  191,  191,  191,  204,  204,  204,  204,  204,
+      322,  322,  322,  322,  322,  211,  423,  317,  303,  306,
+      309,  423,  303,  322,  204,  211,  211,  211,  211,  211,
+      211,  212,  303,  330,  204,  204,  204,  204,  204,  204,
+      214,  212,  212,  212,  212,  212,  212,  418,  330,  311,
+      214,  214,  214,  214,  214,  214,  218,  218,  218,  218,
+      218,  221,  218,  374,  340,  359,  360,  218,  418,  218,
+      374,  221,  221,  221,  221,  221,  221,  222,  340,  324,
+      384,  301,  218,  223,  324,  359,  360,  222,  222,  222,
+      222,  222,  222,  223,  223,  223,  223,  223,  223,  224,
+
+      381,  382,  340,  384,  324,  225,  296,  381,  382,  224,
+      224,  224,  224,  224,  224,  225,  225,  225,  225,  225,
+      225,  226,  337,  337,  337,  337,  337,  230,  410,  363,
+      364,  226,  226,  226,  226,  226,  226,  230,  230,  230,
+      230,  230,  230,  231,  363,  364,  396,  421,  337,  236,
+      421,  410,  396,  231,  231,  231,  231,  231,  231,  236,
+      236,  236,  236,  236,  236,  237,  341,  341,  341,  341,
+      341,  244,  283,  436,  369,  237,  237,  237,  237,  237,
+      237,  244,  244,  244,  244,  244,  244,  245,  369,  383,
+      282,  369,  341,  246,  420,  436,  383,  245,  245,  245,
+
+      245,  245,  245,  246,  246,  246,  246,  246,  246,  251,
+      251,  251,  251,  251,  420,  251,  281,  453,  393,  397,
+      251,  329,  251,  252,  252,  252,  252,  252,  258,  252,
+      380,  329,  393,  397,  252,  251,  252,  453,  258,  258,
+      258,  258,  258,  258,  380,  398,  329,  405,  385,  252,
+      256,  256,  256,  256,  256,  385,  256,  406,  405,  398,
+      259,  256,  256,  256,  380,  406,  280,  407,  274,  256,
+      259,  259,  259,  259,  259,  259,  256,  260,  407,  256,
+      256,  256,  256,  256,  256,  261,  419,  260,  260,  260,
+      260,  260,  260,  262,  267,  261,  261,  261,  261,  261,
+
+      261,  263,  419,  262,  262,  262,  262,  262,  262,  265,
+      257,  263,  263,  263,  263,  263,  263,  266,  250,  265,
+      265,  265,  265,  265,  265,  269,  249,  266,  266,  266,
+      266,  266,  266,  270,  248,  269,  269,  269,  269,  269,
+      269,  276,  243,  270,  270,  270,  270,  270,  270,  277,
+      234,  276,  276,  276,  276,  276,  276,  278,  408,  277,
+      277,  277,  277,  277,  277,  408,  399,  278,  278,  278,
+      278,  278,  278,  287,  287,  287,  287,  394,  471,  287,
+      399,  404,  394,  447,  471,  394,  399,  290,  290,  290,
+      290,  290,  287,  290,  409,  404,  458,  447,  290,  287,
+
+      290,  409,  287,  287,  287,  287,  287,  287,  289,  289,
+      289,  289,  425,  290,  411,  425,  458,  444,  233,  289,
+      291,  291,  291,  291,  291,  411,  291,  289,  424,  433,
+      465,  291,  444,  291,  289,  424,  433,  289,  289,  289,
+      289,  289,  289,  228,  220,  445,  291,  292,  292,  292,
+      292,  292,  434,  292,  446,  434,  473,  465,  292,  466,
+      292,  293,  293,  293,  293,  293,  297,  293,  445,  466,
+      473,  446,  293,  292,  293,  460,  297,  297,  297,  297,
+      297,  297,  428,  428,  428,  428,  428,  293,  294,  294,
+      294,  294,  294,  451,  294,  428,  460,  217,  299,  294,
+
+      451,  294,  344,  344,  344,  344,  344,  294,  299,  299,
+      299,  299,  299,  299,  294,  216,  203,  294,  294,  294,
+      294,  294,  294,  295,  295,  295,  295,  295,  344,  295,
+      452,  454,  198,  300,  295,  295,  295,  452,  454,  463,
+      197,  195,  295,  300,  300,  300,  300,  300,  300,  295,
+      302,  193,  295,  295,  295,  295,  295,  295,  304,  463,
+      302,  302,  302,  302,  302,  302,  305,  469,  304,  304,
+      304,  304,  304,  304,  307,  190,  305,  305,  305,  305,
+      305,  305,  308,  187,  307,  307,  307,  307,  307,  307,
+      469,  479,  308,  308,  308,  308,  308,  308,  313,  313,
+
+      313,  313,  313,  314,  415,  415,  415,  415,  415,  478,
+      313,  457,  479,  314,  314,  314,  314,  314,  314,  315,
+      415,  457,  476,  478,  313,  181,  176,  476,  170,  315,
+      315,  315,  315,  315,  315,  326,  326,  326,  326,  326,
+      166,  326,  457,  331,  331,  331,  331,  331,  326,  155,
+      474,  475,  153,  151,  331,  147,  331,  474,  475,  146,
+      334,  326,  327,  327,  327,  327,  327,  145,  327,  331,
+      334,  334,  334,  334,  334,  334,  358,  358,  358,  358,
+      358,  327,  358,  368,  368,  368,  368,  368,  327,  358,
+      143,  327,  327,  327,  327,  327,  327,  328,  328,  328,
+
+      328,  142,  358,  328,  140,  139,  137,  336,  136,  368,
+      134,  370,  370,  370,  370,  370,  328,  336,  336,  336,
+      336,  336,  336,  328,  131,  129,  328,  328,  328,  328,
+      328,  328,  332,  332,  332,  332,  332,  370,  127,  117,
+      115,  108,  338,  332,   97,  372,  372,  372,  372,  372,
+       84,  332,  338,  338,  338,  338,  338,  338,  332,   81,
+       79,  332,  332,  332,  332,  332,  332,  333,  333,  333,
+      333,  372,   67,   63,   62,   61,   60,  339,  333,   54,
+       46,   39,   30,   29,   25,   22,  333,  339,  339,  339,
+      339,  339,  339,  333,  342,   20,  333,  333,  333,  333,
+
+      333,  333,  345,   19,  342,  342,  342,  342,  342,  342,
+       16,   14,  345,  345,  345,  345,  345,  345,  349,  349,
+      349,  349,  349,  350,    7,    6,    5,    0,    0,    0,
+      349,    0,    0,  350,  350,  350,  350,  350,  350,  361,
+        0,    0,    0,    0,  349,    0,    0,    0,    0,  361,
+      361,  361,  361,  361,  361,  362,  362,  362,  362,  362,
+      365,    0,    0,    0,    0,    0,  362,    0,  362,    0,
+      365,  365,  365,  365,  365,  365,  366,    0,    0,  371,
+        0,  362,    0,    0,    0,  371,  366,  366,  366,  366,
+      366,  366,  371,    0,  371,  375,    0,    0,    0,  371,
+
+      371,  376,    0,  371,    0,  375,  375,  375,  375,  375,
+      375,  376,  376,  376,  376,  376,  376,  377,    0,    0,
+        0,    0,    0,  378,    0,    0,    0,  377,  377,  377,
+      377,  377,  377,  378,  378,  378,  378,  378,  378,  390,
+        0,    0,    0,    0,    0,  391,    0,    0,    0,  390,
+      390,  390,  390,  390,  390,  391,  391,  391,  391,  391,
+      391,  392,    0,    0,    0,    0,    0,  400,    0,    0,
+        0,  392,  392,  392,  392,  392,  392,  400,  400,  400,
+      400,  400,  400,  401,    0,    0,    0,    0,    0,  402,
+        0,    0,    0,  401,  401,  401,  401,  401,  401,  402,
+
+      402,  402,  402,  402,  402,  403,  403,  403,  403,  403,
+        0,    0,  412,    0,    0,    0,    0,    0,    0,    0,
+        0,  403,  412,  412,  412,  412,  412,  412,  413,    0,
+        0,  403,  414,  414,  414,  414,  414,    0,  413,  413,
+      413,  413,  413,  413,    0,    0,    0,    0,  414,  416,
+        0,    0,  417,  417,  417,  417,  417,    0,  414,  416,
+      416,  416,  416,  416,  416,  417,  426,  426,  426,  426,
+      426,    0,  430,  430,  430,  430,  430,    0,  417,  426,
+        0,    0,    0,    0,    0,  430,    0,    0,    0,  431,
+        0,    0,  426,  427,  427,  427,  427,  427,  430,  431,
+
+      431,  431,  431,  431,  431,    0,  427,  439,  439,  439,
+      439,  439,  427,    0,    0,    0,    0,    0,    0,  427,
+      439,    0,  427,  427,  427,  427,  427,  427,  440,    0,
+        0,    0,    0,  439,    0,    0,    0,    0,  440,  440,
+      440,  440,  440,  440,  441,  441,  441,  441,  441,  448,
+        0,    0,  449,  449,  449,  449,  449,  441,    0,  448,
+      448,  448,  448,  448,  448,  449,    0,    0,    0,  450,
+      441,  442,  442,  442,  442,  442,    0,    0,  449,  450,
+      450,  450,  450,  450,  450,    0,    0,    0,    0,    0,
+      442,    0,    0,    0,    0,    0,  455,    0,    0,    0,
+
+      442,  442,  442,  442,  442,  442,  455,  455,  455,  455,
+      455,  455,  456,    0,    0,    0,    0,    0,  461,    0,
+        0,    0,  456,  456,  456,  456,  456,  456,  461,  461,
+      461,  461,  461,  461,  462,    0,    0,    0,    0,    0,
+      467,    0,    0,    0,  462,  462,  462,  462,  462,  462,
+      467,  467,  467,  467,  467,  467,  468,    0,    0,    0,
+        0,    0,  472,    0,    0,    0,  468,  468,  468,  468,
+      468,  468,  472,  472,  472,  472,  472,  472,  482,    0,
+      482,  482,  482,  482,  482,  482,  482,  482,  482,  483,
+      483,    0,  483,  483,  484,    0,  484,  484,  484,  484,
+
+      484,  484,  484,  484,  484,  485,  485,    0,  485,  485,
+      486,    0,    0,  486,  486,  487,  487,  487,  487,  487,
+      487,  487,  487,  487,  488,    0,  488,  488,    0,  488,
+      488,  489,  489,  489,  489,  489,  489,  489,  489,  489,
+      489,  489,  490,  490,  490,  490,  490,  490,  490,  490,
+      490,  491,  491,    0,  491,  491,  492,  492,  492,  492,
+      492,  492,  492,  492,  492,  492,  492,  493,  493,  493,
+      493,  493,  493,  493,  493,  493,  493,  493,  493,  494,
+      494,  495,  495,  495,  495,  495,  495,  495,  495,  495,
+      496,  496,    0,  496,  496,  497,  497,  497,  497,  497,
+
+      497,  497,  497,  497,  498,  498,    0,  498,  498,  499,
+      499,  499,  499,  499,  499,  499,  499,  499,  500,  500,
+      500,  500,  500,  500,  500,  500,  500,  501,  501,  501,
+      501,  501,  501,  501,  501,  501,  501,  501,  501,  502,
+      502,  502,  502,  502,  502,  502,  502,  502,  503,  503,
+      503,  503,  503,  503,  503,  503,  503,  504,  504,  504,
+        0,  504,  505,  505,  505,  505,  505,  505,  505,  505,
+      505,  505,  505,  505,  506,  506,  506,    0,  506,  507,
+      507,  507,  507,    0,  507,  507,  507,  507,  507,  507,
+      508,  508,  508,    0,  508,  509,    0,  509,  509,  509,
+
+      509,  509,  509,  509,  509,  509,  510,    0,  510,  510,
+      510,  510,  510,  510,  510,  510,  510,  511,  511,  511,
+      511,  511,  511,  511,  511,  511,  511,  511,  512,  512,
+      512,    0,  512,  513,  513,  513,  513,  513,  513,  513,
+      513,  513,  513,  513,  514,  514,  514,  514,  514,  514,
+      514,  514,  514,  514,  514,  515,  515,  515,    0,  515,
+      516,  516,  516,    0,    0,    0,  516,    0,    0,  516,
+      516,  517,  517,  517,  517,  517,  517,  517,  517,  517,
+      518,  518,  518,    0,    0,  518,  518,  518,    0,  518,
+      518,  519,  519,  519,  519,  519,  519,  519,  519,  519,
+
+      481,  481,  481,  481,  481,  481,  481,  481,  481,  481,
+      481,  481,  481,  481,  481,  481,  481,  481,  481,  481,
+      481,  481,  481,  481,  481,  481,  481,  481,  481,  481,
+      481,  481,  481,  481,  481,  481,  481,  481,  481,  481,
+      481,  481,  481,  481,  481,  481,  481,  481,  481,  481,
+      481,  481,  481,  481,  481,  481,  481,  481,  481,  481,
+      481
     } ;
 
 #line 1 "<stdin>"
+#define INITIAL 0
+#define YY_STACK_USED 1
+#define mediaquery 1
 YY_DECL
-{
+	{
 	register yy_state_type yy_current_state;
 	register UChar *yy_cp, *yy_bp;
 	register int yy_act;
 	while ( 1 )		/* loops until end-of-file is reached */
 		{
-		yy_cp = (yy_c_buf_p);
+		yy_cp = yy_c_buf_p;
 
 		/* Support of yytext. */
-		*yy_cp = (yy_hold_char);
+		*yy_cp = yy_hold_char;
 
 		/* yy_bp points to the position in yy_ch_buf of the start of
 		 * the current run.
 		 */
 		yy_bp = yy_cp;
 
-		yy_current_state = (yy_start);
+		yy_current_state = yy_start;
 		do
 			{
 			register YY_CHAR yy_c = yy_ec[YY_SC_TO_UI(*yy_cp)];
 			if ( yy_accept[yy_current_state] )
 				{
-				(yy_last_accepting_state) = yy_current_state;
-				(yy_last_accepting_cpos) = yy_cp;
+				yy_last_accepting_state = yy_current_state;
+				yy_last_accepting_cpos = yy_cp;
 				}
 			while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 				{
 				yy_current_state = (int) yy_def[yy_current_state];
-				if ( yy_current_state >= 481 )
+				if ( yy_current_state >= 482 )
 					yy_c = yy_meta[(unsigned int) yy_c];
 				}
 			yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
 			++yy_cp;
 			}
-		while ( yy_base[yy_current_state] != 6578 );
+		while ( yy_base[yy_current_state] != 2401 );
 
 yy_find_action:
 		yy_act = yy_accept[yy_current_state];
 		if ( yy_act == 0 )
 			{ /* have to back up */
-			yy_cp = (yy_last_accepting_cpos);
-			yy_current_state = (yy_last_accepting_state);
+			yy_cp = yy_last_accepting_cpos;
+			yy_current_state = yy_last_accepting_state;
 			yy_act = yy_accept[yy_current_state];
 			}
 
 		YY_DO_BEFORE_ACTION;
 
 
+
+
 		switch ( yy_act )
 	{ /* beginning of action switch */
 			case 0: /* must back up */
 			/* undo the effects of YY_DO_BEFORE_ACTION */
-			*yy_cp = (yy_hold_char);
-			yy_cp = (yy_last_accepting_cpos);
-			yy_current_state = (yy_last_accepting_state);
+			*yy_cp = yy_hold_char;
+			yy_cp = yy_last_accepting_cpos;
+			yy_current_state = yy_last_accepting_state;
 			goto yy_find_action;
 
 case 1:
-/* rule 1 can match eol */
 YY_RULE_SETUP
 #line 31 "<stdin>"
-/* ignore comments */
+{countLines(); /* ignore comments */ }
 	YY_BREAK
 case 2:
-/* rule 2 can match eol */
 YY_RULE_SETUP
 #line 33 "<stdin>"
-{yyTok = WHITESPACE; return yyTok;}
+{countLines(); yyTok = WHITESPACE; return yyTok;}
 	YY_BREAK
 case 3:
 YY_RULE_SETUP
@@ -1906,13 +966,11 @@ YY_RULE_SETUP
 {BEGIN(mediaquery); yyTok = VARIABLES_FOR; return yyTok; }
 	YY_BREAK
 case 14:
-/* rule 14 can match eol */
 YY_RULE_SETUP
 #line 47 "<stdin>"
 {yyTok = STRING; return yyTok;}
 	YY_BREAK
 case 15:
-/* rule 15 can match eol */
 YY_RULE_SETUP
 #line 48 "<stdin>"
 {yyTok = IDENT; return yyTok;}
@@ -1928,7 +986,6 @@ YY_RULE_SETUP
 {yyTok = HEX; return yyTok;}
 	YY_BREAK
 case 18:
-/* rule 18 can match eol */
 YY_RULE_SETUP
 #line 52 "<stdin>"
 {yyTok = IDSEL; return yyTok;}
@@ -2014,13 +1071,11 @@ YY_RULE_SETUP
 {yyTok = WEBKIT_KEYFRAME_RULE_SYM; return yyTok; }
 	YY_BREAK
 case 35:
-/* rule 35 can match eol */
 YY_RULE_SETUP
 #line 71 "<stdin>"
 {yyTok = ATKEYWORD; return yyTok; }
 	YY_BREAK
 case 36:
-/* rule 36 can match eol */
 YY_RULE_SETUP
 #line 73 "<stdin>"
 {yyTok = IMPORTANT_SYM; return yyTok;}
@@ -2116,7 +1171,6 @@ YY_RULE_SETUP
 {yyTok = KHERZ; return yyTok;}
 	YY_BREAK
 case 55:
-/* rule 55 can match eol */
 YY_RULE_SETUP
 #line 93 "<stdin>"
 {yyTok = DIMEN; return yyTok;}
@@ -2142,25 +1196,21 @@ YY_RULE_SETUP
 {yyTok = NOTFUNCTION; return yyTok;}
 	YY_BREAK
 case 60:
-/* rule 60 can match eol */
 YY_RULE_SETUP
 #line 99 "<stdin>"
 {yyTok = URI; return yyTok;}
 	YY_BREAK
 case 61:
-/* rule 61 can match eol */
 YY_RULE_SETUP
 #line 100 "<stdin>"
 {yyTok = URI; return yyTok;}
 	YY_BREAK
 case 62:
-/* rule 62 can match eol */
 YY_RULE_SETUP
 #line 101 "<stdin>"
 { yyTok = VARCALL; return yyTok; }
 	YY_BREAK
 case 63:
-/* rule 63 can match eol */
 YY_RULE_SETUP
 #line 102 "<stdin>"
 {yyTok = FUNCTION; return yyTok;}
@@ -2192,7 +1242,6 @@ YY_RULE_SETUP
 #line 111 "<stdin>"
 ECHO;
 	YY_BREAK
-#line 2745 "<stdout>"
 case YY_END_OF_BUFFER:
 	yy_c_buf_p = yy_cp - 1;
 	yy_cp = yy_c_buf_p;
@@ -2206,4 +1255,4 @@ case YY_STATE_EOF(forkeyword):
 			"fatal flex scanner internal error--no action found" );
 	} /* end of action switch */
 		} /* end of scanning one token */
-} /* end of yylex */
+	} /* end of yylex */
diff --git a/src/3rdparty/webkit/WebCore/history/BackForwardList.cpp b/src/3rdparty/webkit/WebCore/history/BackForwardList.cpp
index d10e61cc9b..721d949b7a 100644
--- a/src/3rdparty/webkit/WebCore/history/BackForwardList.cpp
+++ b/src/3rdparty/webkit/WebCore/history/BackForwardList.cpp
@@ -27,9 +27,14 @@
 #include "config.h"
 #include "BackForwardList.h"
 
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "FrameLoaderClient.h"
 #include "HistoryItem.h"
 #include "Logging.h"
+#include "Page.h"
 #include "PageCache.h"
+#include "SerializedScriptValue.h"
 
 using namespace std;
 
@@ -77,25 +82,31 @@ void BackForwardList::addItem(PassRefPtr<HistoryItem> prpItem)
         m_entryHash.remove(item);
         pageCache()->remove(item.get());
         m_current--;
+        m_page->mainFrame()->loader()->client()->dispatchDidRemoveBackForwardItem(item.get());
     }
     
-    m_entries.append(prpItem);
-    m_entryHash.add(m_entries.last());
+    m_entryHash.add(prpItem.get());
+    m_entries.insert(m_current + 1, prpItem);
     m_current++;
+    m_page->mainFrame()->loader()->client()->dispatchDidAddBackForwardItem(currentItem());
 }
 
 void BackForwardList::goBack()
 {
     ASSERT(m_current > 0);
-    if (m_current > 0)
+    if (m_current > 0) {
         m_current--;
+        m_page->mainFrame()->loader()->client()->dispatchDidChangeBackForwardIndex();
+    }
 }
 
 void BackForwardList::goForward()
 {
     ASSERT(m_current < m_entries.size() - 1);
-    if (m_current < m_entries.size() - 1)
+    if (m_current < m_entries.size() - 1) {
         m_current++;
+        m_page->mainFrame()->loader()->client()->dispatchDidChangeBackForwardIndex();
+    }
 }
 
 void BackForwardList::goToItem(HistoryItem* item)
@@ -107,8 +118,10 @@ void BackForwardList::goToItem(HistoryItem* item)
     for (; index < m_entries.size(); ++index)
         if (m_entries[index] == item)
             break;
-    if (index < m_entries.size())
+    if (index < m_entries.size()) {
         m_current = index;
+        m_page->mainFrame()->loader()->client()->dispatchDidChangeBackForwardIndex();
+    }
 }
 
 HistoryItem* BackForwardList::backItem()
@@ -174,9 +187,10 @@ void BackForwardList::setCapacity(int size)
 
     if (!size)
         m_current = NoCurrentItemIndex;
-    else if (m_current > m_entries.size() - 1)
+    else if (m_current > m_entries.size() - 1) {
         m_current = m_entries.size() - 1;
-        
+        m_page->mainFrame()->loader()->client()->dispatchDidChangeBackForwardIndex();
+    }
     m_capacity = size;
 }
 
@@ -222,6 +236,20 @@ HistoryItemVector& BackForwardList::entries()
     return m_entries;
 }
 
+void BackForwardList::pushStateItem(PassRefPtr<HistoryItem> newItem)
+{
+    ASSERT(newItem);
+    ASSERT(newItem->stateObject());
+    
+    RefPtr<HistoryItem> current = currentItem();
+    ASSERT(current);
+
+    addItem(newItem);
+    
+    if (!current->stateObject())
+        current->setStateObject(SerializedScriptValue::create());
+}
+
 void BackForwardList::close()
 {
     int size = m_entries.size();
@@ -254,7 +282,7 @@ void BackForwardList::removeItem(HistoryItem* item)
             else {
                 size_t count = m_entries.size();
                 if (m_current >= count)
-                    m_current = count ? count-1 : NoCurrentItemIndex;
+                    m_current = count ? count - 1 : NoCurrentItemIndex;
             }
             break;
         }
diff --git a/src/3rdparty/webkit/WebCore/history/BackForwardList.h b/src/3rdparty/webkit/WebCore/history/BackForwardList.h
index fdc3360f2b..eb4921ae9a 100644
--- a/src/3rdparty/webkit/WebCore/history/BackForwardList.h
+++ b/src/3rdparty/webkit/WebCore/history/BackForwardList.h
@@ -35,8 +35,11 @@
 
 namespace WebCore {
 
+class Document;
 class HistoryItem;
 class Page;
+class SerializedScriptValue;
+class String;
 
 typedef Vector<RefPtr<HistoryItem> > HistoryItemVector;
 typedef HashSet<RefPtr<HistoryItem> > HistoryItemHashSet;
@@ -96,13 +99,15 @@ public:
     void removeItem(HistoryItem*);
     HistoryItemVector& entries();
     
+    void pushStateItem(PassRefPtr<HistoryItem>);
+
 #if ENABLE(WML)
     void clearWMLPageHistory();
 #endif
 
 private:
     BackForwardList(Page*);
-
+    
     Page* m_page;
 #if PLATFORM(CHROMIUM) 
     BackForwardListClient* m_client;
diff --git a/src/3rdparty/webkit/WebCore/history/BackForwardListChromium.cpp b/src/3rdparty/webkit/WebCore/history/BackForwardListChromium.cpp
index 34f294ca84..a780b7d0ba 100644
--- a/src/3rdparty/webkit/WebCore/history/BackForwardListChromium.cpp
+++ b/src/3rdparty/webkit/WebCore/history/BackForwardListChromium.cpp
@@ -121,6 +121,16 @@ HistoryItem* BackForwardList::itemAtIndex(int index)
     return m_client->itemAtIndex(index);
 }
 
+void BackForwardList::pushStateItem(PassRefPtr<HistoryItem> newItem)
+{
+    RefPtr<HistoryItem> current = m_client->currentItem();
+
+    addItem(newItem);
+
+    if (!current->stateObject())
+        current->setStateObject(SerializedScriptValue::create());
+}
+
 HistoryItemVector& BackForwardList::entries()
 {
     static HistoryItemVector noEntries;
diff --git a/src/3rdparty/webkit/WebCore/history/CachedFrame.cpp b/src/3rdparty/webkit/WebCore/history/CachedFrame.cpp
index 16c7087fc5..ce4e284ee9 100644
--- a/src/3rdparty/webkit/WebCore/history/CachedFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/history/CachedFrame.cpp
@@ -42,6 +42,12 @@
 #include "SVGDocumentExtensions.h"
 #endif
 
+#if ENABLE(TOUCH_EVENTS)
+#include "Chrome.h"
+#include "ChromeClient.h"
+#include "Page.h"
+#endif
+
 namespace WebCore {
 
 #ifndef NDEBUG
@@ -99,7 +105,11 @@ void CachedFrameBase::restore()
     for (unsigned i = 0; i < m_childFrames.size(); ++i)
         m_childFrames[i]->open();
 
-    m_document->dispatchWindowEvent(PageTransitionEvent::create(EventNames().pageshowEvent, true), m_document);
+    m_document->enqueuePageshowEvent(PageshowEventPersisted);
+#if ENABLE(TOUCH_EVENTS)
+    if (m_document->hasListenerType(Document::TOUCH_LISTENER))
+        m_document->page()->chrome()->client()->needTouchEvents(true);
+#endif
 }
 
 CachedFrame::CachedFrame(Frame* frame)
@@ -136,18 +146,29 @@ CachedFrame::CachedFrame(Frame* frame)
     for (unsigned i = 0; i < m_childFrames.size(); ++i)
         frame->tree()->removeChild(m_childFrames[i]->view()->frame());
 
+    if (!m_isMainFrame)
+        frame->page()->decrementFrameCount();
+
 #ifndef NDEBUG
     if (m_isMainFrame)
         LOG(PageCache, "Finished creating CachedFrame for main frame url '%s' and DocumentLoader %p\n", m_url.string().utf8().data(), m_documentLoader.get());
     else
         LOG(PageCache, "Finished creating CachedFrame for child frame with url '%s' and DocumentLoader %p\n", m_url.string().utf8().data(), m_documentLoader.get());
 #endif
+
+#if ENABLE(TOUCH_EVENTS)
+    if (m_document->hasListenerType(Document::TOUCH_LISTENER))
+        m_document->page()->chrome()->client()->needTouchEvents(false);
+#endif
 }
 
 void CachedFrame::open()
 {
     ASSERT(m_view);
     m_view->frame()->loader()->open(*this);
+
+    if (!m_isMainFrame)
+        m_view->frame()->page()->incrementFrameCount();
 }
 
 void CachedFrame::clear()
diff --git a/src/3rdparty/webkit/WebCore/history/CachedFrame.h b/src/3rdparty/webkit/WebCore/history/CachedFrame.h
index 883c12aecd..ca772a445d 100644
--- a/src/3rdparty/webkit/WebCore/history/CachedFrame.h
+++ b/src/3rdparty/webkit/WebCore/history/CachedFrame.h
@@ -31,15 +31,13 @@
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
-    
-    class CachedFrame;
-    class CachedFramePlatformData;
-    class DOMWindow;
-    class Document;
-    class DocumentLoader;
-    class Frame;
-    class FrameView;
-    class Node;
+
+class CachedFrame;
+class CachedFramePlatformData;
+class Document;
+class DocumentLoader;
+class FrameView;
+class Node;
 
 typedef Vector<RefPtr<CachedFrame> > CachedFrameVector;
 
diff --git a/src/3rdparty/webkit/WebCore/history/CachedPage.cpp b/src/3rdparty/webkit/WebCore/history/CachedPage.cpp
index 20c5fd734d..acbfd31e44 100644
--- a/src/3rdparty/webkit/WebCore/history/CachedPage.cpp
+++ b/src/3rdparty/webkit/WebCore/history/CachedPage.cpp
@@ -69,6 +69,7 @@ void CachedPage::restore(Page* page)
 {
     ASSERT(m_cachedMainFrame);
     ASSERT(page && page->mainFrame() && page->mainFrame() == m_cachedMainFrame->view()->frame());
+    ASSERT(!page->frameCount());
 
     m_cachedMainFrame->open();
     
diff --git a/src/3rdparty/webkit/WebCore/history/CachedPage.h b/src/3rdparty/webkit/WebCore/history/CachedPage.h
index c68c753080..4741c799af 100644
--- a/src/3rdparty/webkit/WebCore/history/CachedPage.h
+++ b/src/3rdparty/webkit/WebCore/history/CachedPage.h
@@ -30,14 +30,9 @@
 
 namespace WebCore {
     
-    class CachedFramePlatformData;
-    class DOMWindow;
-    class Document;
-    class DocumentLoader;
-    class FrameView;
-    class KURL;
-    class Node;
-    class Page;
+class Document;
+class DocumentLoader;
+class Page;
 
 class CachedPage : public RefCounted<CachedPage> {
 public:
diff --git a/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp b/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp
index 4352936a1d..d641d4e1da 100644
--- a/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp
+++ b/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp
@@ -33,14 +33,23 @@
 #include "PageCache.h"
 #include "ResourceRequest.h"
 #include <stdio.h>
+#include <wtf/CurrentTime.h>
 
 namespace WebCore {
 
-static void defaultNotifyHistoryItemChanged()
+static long long generateDocumentSequenceNumber()
 {
+    // Initialize to the current time to reduce the likelihood of generating
+    // identifiers that overlap with those from past/future browser sessions.
+    static long long next = static_cast<long long>(currentTime() * 1000000.0);
+    return ++next;
 }
 
-void (*notifyHistoryItemChanged)() = defaultNotifyHistoryItemChanged;
+static void defaultNotifyHistoryItemChanged(HistoryItem*)
+{
+}
+
+void (*notifyHistoryItemChanged)(HistoryItem*) = defaultNotifyHistoryItemChanged;
 
 HistoryItem::HistoryItem()
     : m_lastVisitedTime(0)
@@ -48,6 +57,7 @@ HistoryItem::HistoryItem()
     , m_lastVisitWasFailure(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
+    , m_documentSequenceNumber(generateDocumentSequenceNumber())
 {
 }
 
@@ -60,6 +70,7 @@ HistoryItem::HistoryItem(const String& urlString, const String& title, double ti
     , m_lastVisitWasFailure(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
+    , m_documentSequenceNumber(generateDocumentSequenceNumber())
 {    
     iconDatabase()->retainIconForPageURL(m_urlString);
 }
@@ -74,6 +85,7 @@ HistoryItem::HistoryItem(const String& urlString, const String& title, const Str
     , m_lastVisitWasFailure(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
+    , m_documentSequenceNumber(generateDocumentSequenceNumber())
 {
     iconDatabase()->retainIconForPageURL(m_urlString);
 }
@@ -89,6 +101,7 @@ HistoryItem::HistoryItem(const KURL& url, const String& target, const String& pa
     , m_lastVisitWasFailure(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
+    , m_documentSequenceNumber(generateDocumentSequenceNumber())
 {    
     iconDatabase()->retainIconForPageURL(m_urlString);
 }
@@ -97,6 +110,10 @@ HistoryItem::~HistoryItem()
 {
     ASSERT(!m_cachedPage);
     iconDatabase()->releaseIconForPageURL(m_urlString);
+#if PLATFORM(ANDROID)
+    if (m_bridge)
+        m_bridge->detachHistoryItem();
+#endif
 }
 
 inline HistoryItem::HistoryItem(const HistoryItem& item)
@@ -116,10 +133,9 @@ inline HistoryItem::HistoryItem(const HistoryItem& item)
     , m_visitCount(item.m_visitCount)
     , m_dailyVisitCounts(item.m_dailyVisitCounts)
     , m_weeklyVisitCounts(item.m_weeklyVisitCounts)
+    , m_documentSequenceNumber(generateDocumentSequenceNumber())
     , m_formContentType(item.m_formContentType)
 {
-    ASSERT(!item.m_cachedPage);
-
     if (item.m_formData)
         m_formData = item.m_formData->copy();
         
@@ -198,7 +214,7 @@ const String& HistoryItem::parent() const
 void HistoryItem::setAlternateTitle(const String& alternateTitle)
 {
     m_displayTitle = alternateTitle;
-    notifyHistoryItemChanged();
+    notifyHistoryItemChanged(this);
 }
 
 void HistoryItem::setURLString(const String& urlString)
@@ -209,7 +225,7 @@ void HistoryItem::setURLString(const String& urlString)
         iconDatabase()->retainIconForPageURL(m_urlString);
     }
     
-    notifyHistoryItemChanged();
+    notifyHistoryItemChanged(this);
 }
 
 void HistoryItem::setURL(const KURL& url)
@@ -222,25 +238,25 @@ void HistoryItem::setURL(const KURL& url)
 void HistoryItem::setOriginalURLString(const String& urlString)
 {
     m_originalURLString = urlString;
-    notifyHistoryItemChanged();
+    notifyHistoryItemChanged(this);
 }
 
 void HistoryItem::setReferrer(const String& referrer)
 {
     m_referrer = referrer;
-    notifyHistoryItemChanged();
+    notifyHistoryItemChanged(this);
 }
 
 void HistoryItem::setTitle(const String& title)
 {
     m_title = title;
-    notifyHistoryItemChanged();
+    notifyHistoryItemChanged(this);
 }
 
 void HistoryItem::setTarget(const String& target)
 {
     m_target = target;
-    notifyHistoryItemChanged();
+    notifyHistoryItemChanged(this);
 }
 
 void HistoryItem::setParent(const String& parent)
@@ -356,6 +372,9 @@ void HistoryItem::clearScrollPoint()
 void HistoryItem::setDocumentState(const Vector<String>& state)
 {
     m_documentState = state;
+#if PLATFORM(ANDROID)
+    notifyHistoryItemChanged(this);
+#endif
 }
 
 const Vector<String>& HistoryItem::documentState() const
@@ -366,6 +385,9 @@ const Vector<String>& HistoryItem::documentState() const
 void HistoryItem::clearDocumentState()
 {
     m_documentState.clear();
+#if PLATFORM(ANDROID)
+    notifyHistoryItemChanged(this);
+#endif
 }
 
 bool HistoryItem::isTargetItem() const
@@ -376,12 +398,23 @@ bool HistoryItem::isTargetItem() const
 void HistoryItem::setIsTargetItem(bool flag)
 {
     m_isTargetItem = flag;
+#if PLATFORM(ANDROID)
+    notifyHistoryItemChanged(this);
+#endif
+}
+
+void HistoryItem::setStateObject(PassRefPtr<SerializedScriptValue> object)
+{
+    m_stateObject = object;
 }
 
 void HistoryItem::addChildItem(PassRefPtr<HistoryItem> child)
 {
     ASSERT(!childItemWithTarget(child->target()));
     m_children.append(child);
+#if PLATFORM(ANDROID)
+    notifyHistoryItemChanged(this);
+#endif
 }
 
 void HistoryItem::setChildItem(PassRefPtr<HistoryItem> child)
@@ -460,6 +493,9 @@ void HistoryItem::setFormInfoFromRequest(const ResourceRequest& request)
         m_formData = 0;
         m_formContentType = String();
     }
+#if PLATFORM(ANDROID)
+    notifyHistoryItemChanged(this);
+#endif
 }
 
 void HistoryItem::setFormData(PassRefPtr<FormData> formData)
diff --git a/src/3rdparty/webkit/WebCore/history/HistoryItem.h b/src/3rdparty/webkit/WebCore/history/HistoryItem.h
index c12122fa16..ee8c0c86e6 100644
--- a/src/3rdparty/webkit/WebCore/history/HistoryItem.h
+++ b/src/3rdparty/webkit/WebCore/history/HistoryItem.h
@@ -28,6 +28,7 @@
 
 #include "IntPoint.h"
 #include "PlatformString.h"
+#include "SerializedScriptValue.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
@@ -42,6 +43,10 @@ typedef struct objc_object* id;
 #include <QDataStream>
 #endif
 
+#if PLATFORM(ANDROID)
+#include "AndroidWebHistoryBridge.h"
+#endif
+
 namespace WebCore {
 
 class CachedPage;
@@ -50,11 +55,11 @@ class FormData;
 class HistoryItem;
 class Image;
 class KURL;
-struct ResourceRequest;
+class ResourceRequest;
 
 typedef Vector<RefPtr<HistoryItem> > HistoryItemVector;
 
-extern void (*notifyHistoryItemChanged)();
+extern void (*notifyHistoryItemChanged)(HistoryItem*);
 
 enum VisitCountBehavior {
     IncreaseVisitCount,
@@ -128,6 +133,12 @@ public:
     void setTitle(const String&);
     void setIsTargetItem(bool);
     
+    void setStateObject(PassRefPtr<SerializedScriptValue> object);
+    SerializedScriptValue* stateObject() const { return m_stateObject.get(); }
+
+    void setDocumentSequenceNumber(long long number) { m_documentSequenceNumber = number; }
+    long long documentSequenceNumber() const { return m_documentSequenceNumber; }
+    
     void setFormInfoFromRequest(const ResourceRequest&);
     void setFormData(PassRefPtr<FormData>);
     void setFormContentType(const String&);
@@ -175,6 +186,11 @@ public:
     QDataStream& saveState(QDataStream& out, int version) const;
 #endif
 
+#if PLATFORM(ANDROID)
+    void setBridge(AndroidWebHistoryBridge* bridge);
+    AndroidWebHistoryBridge* bridge() const;
+#endif
+
 #ifndef NDEBUG
     int showTree() const;
     int showTreeWithIndent(unsigned indentLevel) const;
@@ -226,6 +242,10 @@ private:
 
     OwnPtr<Vector<String> > m_redirectURLs;
 
+    // Support for HTML5 History
+    RefPtr<SerializedScriptValue> m_stateObject;
+    long long m_documentSequenceNumber;
+    
     // info used to repost form data
     RefPtr<FormData> m_formData;
     String m_formContentType;
@@ -243,6 +263,11 @@ private:
 #if PLATFORM(QT)
     QVariant m_userData;
 #endif
+
+#if PLATFORM(ANDROID)
+    RefPtr<AndroidWebHistoryBridge> m_bridge;
+#endif
+
 }; //class HistoryItem
 
 } //namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/history/cf/HistoryPropertyList.cpp b/src/3rdparty/webkit/WebCore/history/cf/HistoryPropertyList.cpp
deleted file mode 100644
index fd28237bde..0000000000
--- a/src/3rdparty/webkit/WebCore/history/cf/HistoryPropertyList.cpp
+++ /dev/null
@@ -1,156 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "HistoryPropertyList.h"
-
-#include "HistoryItem.h"
-#include <wtf/StringExtras.h>
-
-namespace WebCore {
-
-static const int currentFileVersion = 1;
-
-HistoryPropertyListWriter::HistoryPropertyListWriter()
-    : m_dailyVisitCountsKey("D")
-    , m_displayTitleKey("displayTitle")
-    , m_lastVisitWasFailureKey("lastVisitWasFailure")
-    , m_lastVisitWasHTTPNonGetKey("lastVisitWasHTTPNonGet")
-    , m_lastVisitedDateKey("lastVisitedDate")
-    , m_redirectURLsKey("redirectURLs")
-    , m_titleKey("title")
-    , m_urlKey("")
-    , m_visitCountKey("visitCount")
-    , m_weeklyVisitCountsKey("W")
-    , m_buffer(0)
-{
-}
-
-UInt8* HistoryPropertyListWriter::buffer(size_t size)
-{
-    ASSERT(!m_buffer);
-    m_buffer = static_cast<UInt8*>(CFAllocatorAllocate(0, size, 0));
-    m_bufferSize = size;
-    return m_buffer;
-}
-
-RetainPtr<CFDataRef> HistoryPropertyListWriter::releaseData()
-{
-    UInt8* buffer = m_buffer;
-    if (!buffer)
-        return 0;
-    m_buffer = 0;
-    RetainPtr<CFDataRef> data(AdoptCF, CFDataCreateWithBytesNoCopy(0, buffer, m_bufferSize, 0));
-    if (!data) {
-        CFAllocatorDeallocate(0, buffer);
-        return 0;
-    }
-    return data;
-}
-
-void HistoryPropertyListWriter::writeObjects(BinaryPropertyListObjectStream& stream)
-{
-    size_t outerDictionaryStart = stream.writeDictionaryStart();
-
-    stream.writeString("WebHistoryFileVersion");
-    stream.writeString("WebHistoryDates");
-
-    stream.writeInteger(currentFileVersion);
-    size_t outerDateArrayStart = stream.writeArrayStart();
-    writeHistoryItems(stream);
-    stream.writeArrayEnd(outerDateArrayStart);
-
-    stream.writeDictionaryEnd(outerDictionaryStart);
-}
-
-void HistoryPropertyListWriter::writeHistoryItem(BinaryPropertyListObjectStream& stream, HistoryItem* item)
-{
-    size_t itemDictionaryStart = stream.writeDictionaryStart();
-
-    const String& title = item->title();
-    const String& displayTitle = item->alternateTitle();
-    double lastVisitedDate = item->lastVisitedTime();
-    int visitCount = item->visitCount();
-    Vector<String>* redirectURLs = item->redirectURLs();
-    const Vector<int>& dailyVisitCounts = item->dailyVisitCounts();
-    const Vector<int>& weeklyVisitCounts = item->weeklyVisitCounts();
-
-    // keys
-    stream.writeString(m_urlKey);
-    if (!title.isEmpty())
-        stream.writeString(m_titleKey);
-    if (!displayTitle.isEmpty())
-        stream.writeString(m_displayTitleKey);
-    if (lastVisitedDate)
-        stream.writeString(m_lastVisitedDateKey);
-    if (visitCount)
-        stream.writeString(m_visitCountKey);
-    if (item->lastVisitWasFailure())
-        stream.writeString(m_lastVisitWasFailureKey);
-    if (item->lastVisitWasHTTPNonGet())
-        stream.writeString(m_lastVisitWasHTTPNonGetKey);
-    if (redirectURLs)
-        stream.writeString(m_redirectURLsKey);
-    if (!dailyVisitCounts.isEmpty())
-        stream.writeString(m_dailyVisitCountsKey);
-    if (!weeklyVisitCounts.isEmpty())
-        stream.writeString(m_weeklyVisitCountsKey);
-
-    // values
-    stream.writeUniqueString(item->urlString());
-    if (!title.isEmpty())
-        stream.writeString(title);
-    if (!displayTitle.isEmpty())
-        stream.writeString(displayTitle);
-    if (lastVisitedDate) {
-        char buffer[32];
-        snprintf(buffer, sizeof(buffer), "%.1lf", lastVisitedDate);
-        stream.writeUniqueString(buffer);
-    }
-    if (visitCount)
-        stream.writeInteger(visitCount);
-    if (item->lastVisitWasFailure())
-        stream.writeBooleanTrue();
-    if (item->lastVisitWasHTTPNonGet()) {
-        ASSERT(item->urlString().startsWith("http:", false) || item->urlString().startsWith("https:", false));
-        stream.writeBooleanTrue();
-    }
-    if (redirectURLs) {
-        size_t redirectArrayStart = stream.writeArrayStart();
-        size_t size = redirectURLs->size();
-        ASSERT(size);
-        for (size_t i = 0; i < size; ++i)
-            stream.writeUniqueString(redirectURLs->at(i));
-        stream.writeArrayEnd(redirectArrayStart);
-    }
-    if (size_t size = dailyVisitCounts.size())
-        stream.writeIntegerArray(dailyVisitCounts.data(), size);
-    if (size_t size = weeklyVisitCounts.size())
-        stream.writeIntegerArray(weeklyVisitCounts.data(), size);
-
-    stream.writeDictionaryEnd(itemDictionaryStart);
-}
-
-}
diff --git a/src/3rdparty/webkit/WebCore/html/Blob.cpp b/src/3rdparty/webkit/WebCore/html/Blob.cpp
new file mode 100644
index 0000000000..83bbdc0c52
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/Blob.cpp
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Blob.h"
+
+#include "FileSystem.h"
+
+namespace WebCore {
+
+#if ENABLE(BLOB_SLICE)
+const int Blob::toEndOfFile = -1;
+const double Blob::doNotCheckFileChange = 0;
+#endif
+
+Blob::Blob(const String& path)
+    : m_path(path)
+#if ENABLE(BLOB_SLICE)
+    , m_start(0)
+    , m_length(toEndOfFile)
+    , m_snapshotCaptured(false)
+    , m_snapshotSize(0)
+    , m_snapshotModificationTime(doNotCheckFileChange)
+#endif
+{
+}
+
+#if ENABLE(BLOB_SLICE)
+Blob::Blob(const String& path, long long start, long long length, long long snapshotSize, double snapshotModificationTime)
+    : m_path(path)
+    , m_start(start)
+    , m_length(length)
+    , m_snapshotCaptured(true)
+    , m_snapshotSize(snapshotSize)
+    , m_snapshotModificationTime(snapshotModificationTime)
+{
+    ASSERT(start >= 0 && length >= 0 && start + length <= snapshotSize && snapshotModificationTime);
+}
+#endif
+
+unsigned long long Blob::size() const
+{
+    // FIXME: JavaScript cannot represent sizes as large as unsigned long long, we need to
+    // come up with an exception to throw if file size is not represetable.
+#if ENABLE(BLOB_SLICE)
+    if (m_snapshotCaptured)
+        return m_length;
+#endif
+    long long size;
+    if (!getFileSize(m_path, size))
+        return 0;
+    return static_cast<unsigned long long>(size);
+}
+
+#if ENABLE(BLOB_SLICE)
+PassRefPtr<Blob> Blob::slice(long long start, long long length) const
+{
+    // When we slice a file for the first time, we obtain a snapshot of the file by capturing its current size and modification time.
+    // The modification time will be used to verify if the file has been changed or not, when the underlying data are accessed.
+    long long snapshotSize;
+    double snapshotModificationTime;
+    if (m_snapshotCaptured) {
+        snapshotSize = m_snapshotSize;
+        snapshotModificationTime = m_snapshotModificationTime;
+    } else {
+        // If we fail to retrieve the size or modification time, probably due to that the file has been deleted, an empty blob will be returned.
+        time_t modificationTime;
+        if (!getFileSize(m_path, snapshotSize) || !getFileModificationTime(m_path, modificationTime)) {
+            snapshotSize = 0;
+            snapshotModificationTime = 0;
+        } else
+            snapshotModificationTime = modificationTime;
+    }
+
+    // Clamp the range if it exceeds the size limit.
+    if (start < 0)
+        start = 0;
+    if (length < 0)
+        length = 0;
+
+    if (start > snapshotSize) {
+        start = 0;
+        length = 0;
+    } else if (start + length > snapshotSize)
+        length = snapshotSize - start;
+
+    return adoptRef(new Blob(m_path, m_start + start, length, snapshotSize, snapshotModificationTime));
+}
+#endif
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/Blob.h b/src/3rdparty/webkit/WebCore/html/Blob.h
new file mode 100644
index 0000000000..610842e6c2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/Blob.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Blob_h
+#define Blob_h
+
+#include "ExceptionCode.h"
+#include "PlatformString.h"
+#include <time.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class Blob : public RefCounted<Blob> {
+public:
+#if ENABLE(BLOB_SLICE)
+    static const int toEndOfFile;
+    static const double doNotCheckFileChange;
+#endif
+
+    static PassRefPtr<Blob> create(const String& path)
+    {
+        return adoptRef(new Blob(path));
+    }
+
+    virtual ~Blob() { }
+
+#if ENABLE(BLOB_SLICE)
+    PassRefPtr<Blob> slice(long long start, long long length) const;
+#endif
+
+    const String& path() const { return m_path; }
+    unsigned long long size() const;
+#if ENABLE(BLOB_SLICE)
+    long long start() const { return m_start; }
+    long long length() const { return m_length; }
+    double modificationTime() const { return m_snapshotModificationTime; }
+#endif
+
+protected:
+    Blob(const String& path);
+
+private:
+#if ENABLE(BLOB_SLICE)
+    Blob(const String& path, long long start, long long length, long long snapshotSize, double snapshotModificationTime);
+#endif
+
+    // The underlying path of the file-based blob. 
+    String m_path;
+
+#if ENABLE(BLOB_SLICE)
+    // The starting position of the file-based blob.
+    long long m_start;
+
+    // The length of the file-based blob. The value of -1 means to the end of the file.
+    long long m_length;
+
+    // A flag to tell if a snapshot has been captured.
+    bool m_snapshotCaptured;
+
+    // The size of the file when a snapshot is captured. It can be 0 if the file is empty.
+    long long m_snapshotSize;
+
+    // The last modification time of the file when a snapshot is captured. The value of 0 also means that the snapshot is not captured.
+    double m_snapshotModificationTime;
+#endif
+};
+
+} // namespace WebCore
+
+#endif // Blob_h
diff --git a/src/3rdparty/webkit/WebKit/mac/Workers/WebWorkersPrivate.h b/src/3rdparty/webkit/WebCore/html/Blob.idl
index 0ff60d5ded..8db6064a87 100644
--- a/src/3rdparty/webkit/WebKit/mac/Workers/WebWorkersPrivate.h
+++ b/src/3rdparty/webkit/WebCore/html/Blob.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,10 +28,14 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-@interface WebWorkersPrivate : NSObject {
-}
+module html {
 
-// Returns the total number of currently executing worker threads (shared + dedicated).
-+ (unsigned) workerThreadCount;
+    interface Blob {
+        readonly attribute unsigned long long size;
+        
+#if defined(ENABLE_BLOB_SLICE) && ENABLE_BLOB_SLICE
+        Blob slice(in long long start, in long long length);
+#endif
+    };
 
-@end
+}
diff --git a/src/3rdparty/webkit/WebCore/html/CollectionCache.cpp b/src/3rdparty/webkit/WebCore/html/CollectionCache.cpp
index feecd9611a..745cf6e9d1 100644
--- a/src/3rdparty/webkit/WebCore/html/CollectionCache.cpp
+++ b/src/3rdparty/webkit/WebCore/html/CollectionCache.cpp
@@ -85,4 +85,12 @@ void CollectionCache::reset()
     hasNameCache = false;
 }
 
+#if !ASSERT_DISABLED
+void CollectionCache::checkConsistency()
+{
+    idCache.checkConsistency();
+    nameCache.checkConsistency();
+}
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/CollectionCache.h b/src/3rdparty/webkit/WebCore/html/CollectionCache.h
index 7cdcdd541b..70a5af7caa 100644
--- a/src/3rdparty/webkit/WebCore/html/CollectionCache.h
+++ b/src/3rdparty/webkit/WebCore/html/CollectionCache.h
@@ -29,7 +29,7 @@ namespace WebCore {
 class AtomicStringImpl;
 class Element;
 
-struct CollectionCache {
+struct CollectionCache : FastAllocBase {
     CollectionCache();
     CollectionCache(const CollectionCache&);
     CollectionCache& operator=(const CollectionCache& other)
@@ -43,6 +43,8 @@ struct CollectionCache {
     void reset();
     void swap(CollectionCache&);
 
+    void checkConsistency();
+
     typedef HashMap<AtomicStringImpl*, Vector<Element*>*> NodeCacheMap;
 
     unsigned version;
@@ -59,6 +61,10 @@ private:
     static void copyCacheMap(NodeCacheMap&, const NodeCacheMap&);
 };
 
+#if ASSERT_DISABLED
+    inline void CollectionCache::checkConsistency() { }
+#endif
+
 } // namespace
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/DOMFormData.cpp b/src/3rdparty/webkit/WebCore/html/DOMFormData.cpp
new file mode 100644
index 0000000000..1441e8bb61
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DOMFormData.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMFormData.h"
+
+#include "Blob.h"
+#include "PlatformString.h"
+#include "TextEncoding.h"
+
+namespace WebCore {
+
+DOMFormData::DOMFormData(const TextEncoding& encoding)
+    : FormDataList(encoding)
+{
+}
+
+void DOMFormData::append(const String& name, const String& value)
+{
+    if (!name.isEmpty())
+        appendData(name, value);
+}
+
+void DOMFormData::append(const String& name, Blob* blob)
+{
+    // FIXME: Need to support sliced file when Blob.slice support is landed.
+    if (!name.isEmpty() && !blob->path().isEmpty()) {
+        RefPtr<File> file = static_cast<File*>(blob);
+        appendFile(name, file.release());
+    }
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/DOMFormData.h b/src/3rdparty/webkit/WebCore/html/DOMFormData.h
new file mode 100644
index 0000000000..f071d4a282
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DOMFormData.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DOMFormData_h
+#define DOMFormData_h
+
+#include "FormDataList.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class Blob;
+class String;
+class TextEncoding;
+
+class DOMFormData : public FormDataList, public RefCounted<DOMFormData> {
+public:
+    static PassRefPtr<DOMFormData> create() { return adoptRef(new DOMFormData(UTF8Encoding())); }
+    static PassRefPtr<DOMFormData> create(const TextEncoding& encoding) { return adoptRef(new DOMFormData(encoding)); }
+
+    void append(const String& name, const String& value);
+    void append(const String& name, Blob*);
+
+private:
+    DOMFormData(const TextEncoding&);
+};
+
+} // namespace WebCore
+
+#endif // DOMFormData_h
diff --git a/src/3rdparty/webkit/WebKit/mac/Workers/WebWorkersPrivate.mm b/src/3rdparty/webkit/WebCore/html/DOMFormData.idl
index 2c14ad1b64..c3393815a6 100644
--- a/src/3rdparty/webkit/WebKit/mac/Workers/WebWorkersPrivate.mm
+++ b/src/3rdparty/webkit/WebCore/html/DOMFormData.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,19 +28,15 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#import "WebWorkersPrivate.h"
+module html {
 
-#import <WebCore/WorkerThread.h>
+    interface [
+        CanBeConstructed,
+        GenerateNativeConverter,
+        GenerateToJS
+    ] DOMFormData {
+        // void append(DOMString name, Blob value);
+        [Custom] void append(in DOMString name, in DOMString value);
+    };
 
-@implementation WebWorkersPrivate
-
-+ (unsigned) workerThreadCount
-{
-#if ENABLE_WORKERS
-    return WebCore::WorkerThread::workerThreadCount();
-#else
-    return 0;
-#endif
 }
-
-@end
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumn.idl b/src/3rdparty/webkit/WebCore/html/DataGridColumn.idl
index f566325e41..921480038c 100644
--- a/src/3rdparty/webkit/WebCore/html/DataGridColumn.idl
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumn.idl
@@ -26,7 +26,6 @@
 module html {
 
     interface [
-        GenerateConstructor,
         Conditional=DATAGRID
     ] DataGridColumn {
         attribute DOMString id; // The identifier for the column.
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumnList.idl b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.idl
index 1a59f433f9..9a8ea5ca18 100644
--- a/src/3rdparty/webkit/WebCore/html/DataGridColumnList.idl
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.idl
@@ -26,7 +26,6 @@
 module html {
 
     interface [
-        GenerateConstructor,
         HasIndexGetter,
         HasNameGetter,
         Conditional=DATAGRID
diff --git a/src/3rdparty/webkit/WebCore/html/DateComponents.cpp b/src/3rdparty/webkit/WebCore/html/DateComponents.cpp
new file mode 100644
index 0000000000..39dd733c71
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DateComponents.cpp
@@ -0,0 +1,681 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DateComponents.h"
+
+#include "PlatformString.h"
+#include <limits.h>
+#include <wtf/ASCIICType.h>
+#include <wtf/DateMath.h>
+#include <wtf/MathExtras.h>
+
+using namespace std;
+
+namespace WebCore {
+
+// The oldest day of Gregorian Calendar is 1582-10-15. We don't support dates older than it.
+static const int gregorianStartYear = 1582;
+static const int gregorianStartMonth = 9; // This is October, since months are 0 based.
+static const int gregorianStartDay = 15;
+
+static const int daysInMonth[12] = {31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31};
+
+static bool isLeapYear(int year)
+{
+    if (year % 4)
+        return false;
+    if (!(year % 400))
+        return true;
+    if (!(year % 100))
+        return false;
+    return true;
+}
+
+// 'month' is 0-based.
+static int maxDayOfMonth(int year, int month)
+{
+    if (month != 1) // February?
+        return daysInMonth[month];
+    return isLeapYear(year) ? 29 : 28;
+}
+
+// 'month' is 0-based.
+static int dayOfWeek(int year, int month, int day)
+{
+    int shiftedMonth = month + 2;
+    // 2:January, 3:Feburuary, 4:March, ...
+
+    // Zeller's congruence
+    if (shiftedMonth <= 3) {
+        shiftedMonth += 12;
+        year--;
+    }
+    // 4:March, ..., 14:January, 15:February
+
+    int highYear = year / 100;
+    int lowYear = year % 100;
+    // We add 6 to make the result Sunday-origin.
+    int result = (day + 13 * shiftedMonth / 5 + lowYear + lowYear / 4 + highYear / 4 + 5 * highYear + 6) % 7;
+    return result;
+}
+
+int DateComponents::maxWeekNumberInYear() const
+{
+    int day = dayOfWeek(m_year, 0, 1); // January 1.
+    return day == Thursday || (day == Wednesday && isLeapYear(m_year)) ? 53 : 52;
+}
+
+static unsigned countDigits(const UChar* src, unsigned length, unsigned start)
+{
+    unsigned index = start;
+    for (; index < length; ++index) {
+        if (!isASCIIDigit(src[index]))
+            break;
+    }
+    return index - start;
+}
+
+// Very strict integer parser. Do not allow leading or trailing whitespace unlike charactersToIntStrict().
+static bool toInt(const UChar* src, unsigned length, unsigned parseStart, unsigned parseLength, int& out)
+{
+    if (parseStart + parseLength > length || parseLength <= 0)
+        return false;
+    int value = 0;
+    const UChar* current = src + parseStart;
+    const UChar* end = current + parseLength;
+
+    // We don't need to handle negative numbers for ISO 8601.
+    for (; current < end; ++current) {
+        if (!isASCIIDigit(*current))
+            return false;
+        int digit = *current - '0';
+        if (value > (INT_MAX - digit) / 10) // Check for overflow.
+            return false;
+        value = value * 10 + digit;
+    }
+    out = value;
+    return true;
+}
+
+bool DateComponents::parseYear(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    unsigned digitsLength = countDigits(src, length, start);
+    // Needs at least 4 digits according to the standard.
+    if (digitsLength < 4)
+        return false;
+    int year;
+    if (!toInt(src, length, start, digitsLength, year))
+        return false;
+    // No support for years before Gregorian calendar.
+    if (year < gregorianStartYear)
+        return false;
+    m_year = year;
+    end = start + digitsLength;
+    return true;
+}
+
+static bool beforeGregorianStartDate(int year, int month, int monthDay)
+{
+    return year < gregorianStartYear
+        || (year == gregorianStartYear && month < gregorianStartMonth)
+        || (year == gregorianStartYear && month == gregorianStartMonth && monthDay < gregorianStartDay);
+}
+
+bool DateComponents::addDay(int dayDiff)
+{
+    ASSERT(m_monthDay);
+
+    int day = m_monthDay + dayDiff;
+    if (day > maxDayOfMonth(m_year, m_month)) {
+        day = m_monthDay;
+        int year = m_year;
+        int month = m_month;
+        int maxDay = maxDayOfMonth(year, month);
+        for (; dayDiff > 0; --dayDiff) {
+            ++day;
+            if (day > maxDay) {
+                day = 1;
+                ++month;
+                if (month >= 12) { // month is 0-origin.
+                    month = 0;
+                    ++year;
+                    if (year < 0) // Check for overflow.
+                        return false;
+                }
+                maxDay = maxDayOfMonth(year, month);
+            }
+        }
+        m_year = year;
+        m_month = month;
+    } else if (day < 1) {
+        int month = m_month;
+        int year = m_year;
+        day = m_monthDay;
+        for (; dayDiff < 0; ++dayDiff) {
+            --day;
+            if (day < 1) {
+                --month;
+                if (month < 0) {
+                    month = 11;
+                    --year;
+                }
+                day = maxDayOfMonth(year, month);
+            }
+            if (beforeGregorianStartDate(year, month, day))
+                return false;
+        }
+        m_year = year;
+        m_month = month;
+    }
+    m_monthDay = day;
+    return true;
+}
+
+bool DateComponents::addMinute(int minute)
+{
+    int carry;
+    // min can be negative or greater than 59.
+    minute += m_minute;
+    if (minute > 59) {
+        carry = minute / 60;
+        minute = minute % 60;
+    } else if (m_minute < 0) {
+        carry = (59 - m_minute) / 60;
+        minute += carry * 60;
+        carry = -carry;
+        ASSERT(minute >= 0 && minute <= 59);
+    } else {
+        m_minute = minute;
+        return true;
+    }
+
+    int hour = m_hour + carry;
+    if (hour > 23) {
+        carry = hour / 24;
+        hour = hour % 24;
+    } else if (hour < 0) {
+        carry = (23 - hour) / 24;
+        hour += carry * 24;
+        carry = -carry;
+        ASSERT(hour >= 0 && hour <= 23);
+    } else {
+        m_minute = minute;
+        m_hour = hour;
+        return true;
+    }
+    if (!addDay(carry))
+        return false;
+    m_minute = minute;
+    m_hour = hour;
+    return true;
+}
+
+// Parses a timezone part, and adjust year, month, monthDay, hour, minute, second, millisecond.
+bool DateComponents::parseTimeZone(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    if (start >= length)
+        return false;
+    unsigned index = start;
+    if (src[index] == 'Z') {
+        end = index + 1;
+        return true;
+    }
+
+    bool minus;
+    if (src[index] == '+')
+        minus = false;
+    else if (src[index] == '-')
+        minus = true;
+    else
+        return false;
+    ++index;
+
+    int hour;
+    int minute;
+    if (!toInt(src, length, index, 2, hour) || hour < 0 || hour > 23)
+        return false;
+    index += 2;
+
+    if (index >= length || src[index] != ':')
+        return false;
+    ++index;
+
+    if (!toInt(src, length, index, 2, minute) || minute < 0 || minute > 59)
+        return false;
+    index += 2;
+
+    if (minus) {
+        hour = -hour;
+        minute = -minute;
+    }
+
+    // Subtract the timezone offset.
+    if (!addMinute(-(hour * 60 + minute)))
+        return false;
+    end = index;
+    return true;
+}
+
+bool DateComponents::parseMonth(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    unsigned index;
+    if (!parseYear(src, length, start, index))
+        return false;
+    if (index >= length || src[index] != '-')
+        return false;
+    ++index;
+
+    int month;
+    if (!toInt(src, length, index, 2, month) || month < 1 || month > 12)
+        return false;
+    --month;
+    // No support for months before Gregorian calendar.
+    if (beforeGregorianStartDate(m_year, month, gregorianStartDay))
+        return false;
+    m_month = month;
+    end = index + 2;
+    m_type = Month;
+    return true;
+}
+
+bool DateComponents::parseDate(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    unsigned index;
+    if (!parseMonth(src, length, start, index))
+        return false;
+    // '-' and 2-digits are needed.
+    if (index + 2 >= length)
+        return false;
+    if (src[index] != '-')
+        return false;
+    ++index;
+
+    int day;
+    if (!toInt(src, length, index, 2, day) || day < 1 || day > maxDayOfMonth(m_year, m_month))
+        return false;
+    // No support for dates before Gregorian calendar.
+    if (m_year == gregorianStartYear && m_month == gregorianStartMonth && day < gregorianStartDay)
+        return false;
+    m_monthDay = day;
+    end = index + 2;
+    m_type = Date;
+    return true;
+}
+
+bool DateComponents::parseWeek(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    unsigned index;
+    if (!parseYear(src, length, start, index))
+        return false;
+
+    // 4 characters ('-' 'W' digit digit) are needed.
+    if (index + 3 >= length)
+        return false;
+    if (src[index] != '-')
+        return false;
+    ++index;
+    if (src[index] != 'W')
+        return false;
+    ++index;
+
+    int week;
+    if (!toInt(src, length, index, 2, week) || week < 1 || week > maxWeekNumberInYear())
+        return false;
+    // No support for years older than or equals to Gregorian calendar start year.
+    if (m_year <= gregorianStartYear)
+        return false;
+    m_week = week;
+    end = index + 2;
+    m_type = Week;
+    return true;
+}
+
+bool DateComponents::parseTime(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    int hour;
+    if (!toInt(src, length, start, 2, hour) || hour < 0 || hour > 23)
+        return false;
+    unsigned index = start + 2;
+    if (index >= length)
+        return false;
+    if (src[index] != ':')
+        return false;
+    ++index;
+
+    int minute;
+    if (!toInt(src, length, index, 2, minute) || minute < 0 || minute > 59)
+        return false;
+    index += 2;
+
+    int second = 0;
+    int millisecond = 0;
+    // Optional second part.
+    // Do not return with false because the part is optional.
+    if (index + 2 < length && src[index] == ':') {
+        if (toInt(src, length, index + 1, 2, second) && second >= 0 && second <= 59) {
+            index += 3;
+
+            // Optional fractional second part.
+            if (index < length && src[index] == '.') {
+                unsigned digitsLength = countDigits(src, length, index + 1);
+                if (digitsLength >  0) {
+                    ++index;
+                    bool ok;
+                    if (digitsLength == 1) {
+                        ok = toInt(src, length, index, 1, millisecond);
+                        millisecond *= 100;
+                    } else if (digitsLength == 2) {
+                        ok = toInt(src, length, index, 2, millisecond);
+                        millisecond *= 10;
+                    } else // digitsLength >= 3
+                        ok = toInt(src, length, index, 3, millisecond);
+                    ASSERT(ok);
+                    index += digitsLength;
+                }
+            }
+        }
+    }
+    m_hour = hour;
+    m_minute = minute;
+    m_second = second;
+    m_millisecond = millisecond;
+    end = index;
+    m_type = Time;
+    return true;
+}
+
+bool DateComponents::parseDateTimeLocal(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    unsigned index;
+    if (!parseDate(src, length, start, index))
+        return false;
+    if (index >= length)
+        return false;
+    if (src[index] != 'T')
+        return false;
+    ++index;
+    if (!parseTime(src, length, index, end))
+        return false;
+    m_type = DateTimeLocal;
+    return true;
+}
+
+bool DateComponents::parseDateTime(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    unsigned index;
+    if (!parseDate(src, length, start, index))
+        return false;
+    if (index >= length)
+        return false;
+    if (src[index] != 'T')
+        return false;
+    ++index;
+    if (!parseTime(src, length, index, index))
+        return false;
+    if (!parseTimeZone(src, length, index, end))
+        return false;
+    m_type = DateTime;
+    return true;
+}
+
+static inline double positiveFmod(double value, double divider)
+{
+    double remainder = fmod(value, divider);
+    return remainder < 0 ? remainder + divider : remainder;
+}
+
+void DateComponents::setMillisecondsSinceMidnightInternal(double msInDay)
+{
+    ASSERT(msInDay >= 0 && msInDay < msPerDay);
+    m_millisecond = static_cast<int>(fmod(msInDay, msPerSecond));
+    double value = floor(msInDay / msPerSecond);
+    m_second = static_cast<int>(fmod(value, secondsPerMinute));
+    value = floor(value / secondsPerMinute);
+    m_minute = static_cast<int>(fmod(value, minutesPerHour));
+    m_hour = static_cast<int>(value / minutesPerHour);
+}
+
+bool DateComponents::setMillisecondsSinceEpochForDateInternal(double ms)
+{
+    m_year = msToYear(ms);
+    int yearDay = dayInYear(ms, m_year);
+    m_month = monthFromDayInYear(yearDay, isLeapYear(m_year));
+    m_monthDay = dayInMonthFromDayInYear(yearDay, isLeapYear(m_year));
+    return true;
+}
+
+bool DateComponents::setMillisecondsSinceEpochForDate(double ms)
+{
+    m_type = Invalid;
+    if (!isfinite(ms))
+        return false;
+    if (!setMillisecondsSinceEpochForDateInternal(round(ms)))
+        return false;
+    if (beforeGregorianStartDate(m_year, m_month, m_monthDay))
+        return false;
+    m_type = Date;
+    return true;
+}
+
+bool DateComponents::setMillisecondsSinceEpochForDateTime(double ms)
+{
+    m_type = Invalid;
+    if (!isfinite(ms))
+        return false;
+    ms = round(ms);
+    setMillisecondsSinceMidnightInternal(positiveFmod(ms, msPerDay));
+    if (!setMillisecondsSinceEpochForDateInternal(ms))
+        return false;
+    if (beforeGregorianStartDate(m_year, m_month, m_monthDay))
+        return false;
+    m_type = DateTime;
+    return true;
+}
+
+bool DateComponents::setMillisecondsSinceEpochForDateTimeLocal(double ms)
+{
+    // Internal representation of DateTimeLocal is the same as DateTime except m_type.
+    if (!setMillisecondsSinceEpochForDateTime(ms))
+        return false;
+    m_type = DateTimeLocal;
+    return true;
+}
+
+bool DateComponents::setMillisecondsSinceEpochForMonth(double ms)
+{
+    m_type = Invalid;
+    if (!isfinite(ms))
+        return false;
+    if (!setMillisecondsSinceEpochForDateInternal(round(ms)))
+        return false;
+    // Ignore m_monthDay updated by setMillisecondsSinceEpochForDateInternal().
+    if (beforeGregorianStartDate(m_year, m_month, gregorianStartDay))
+        return false;
+    m_type = Month;
+    return true;
+}
+
+bool DateComponents::setMillisecondsSinceMidnight(double ms)
+{
+    m_type = Invalid;
+    if (!isfinite(ms))
+        return false;
+    setMillisecondsSinceMidnightInternal(positiveFmod(round(ms), msPerDay));
+    m_type = Time;
+    return true;
+}
+
+bool DateComponents::setMonthsSinceEpoch(double months)
+{
+    if (!isfinite(months))
+        return false;
+    months = round(months);
+    double doubleMonth = positiveFmod(months, 12);
+    double doubleYear = 1970 + (months - doubleMonth) / 12;
+    if (doubleYear < gregorianStartYear || numeric_limits<int>::max() < doubleYear)
+        return false;
+    int year = static_cast<int>(doubleYear);
+    int month = static_cast<int>(doubleMonth);
+    if (beforeGregorianStartDate(year, month, gregorianStartDay))
+        return false;
+    m_year = year;
+    m_month = month;
+    m_type = Month;
+    return true;
+}
+
+// Offset from January 1st to Monday of the ISO 8601's first week.
+//   ex. If January 1st is Friday, such Monday is 3 days later. Returns 3.
+static int offsetTo1stWeekStart(int year)
+{
+    int offsetTo1stWeekStart = 1 - dayOfWeek(year, 0, 1);
+    if (offsetTo1stWeekStart <= -4)
+        offsetTo1stWeekStart += 7;
+    return offsetTo1stWeekStart;
+}
+
+bool DateComponents::setMillisecondsSinceEpochForWeek(double ms)
+{
+    m_type = Invalid;
+    if (!isfinite(ms))
+        return false;
+    ms = round(ms);
+
+    m_year = msToYear(ms);
+    // We don't support gregorianStartYear. Week numbers are undefined in that year.
+    if (m_year <= gregorianStartYear)
+        return false;
+
+    int yearDay = dayInYear(ms, m_year);
+    int offset = offsetTo1stWeekStart(m_year);
+    if (yearDay < offset) {
+        // The day belongs to the last week of the previous year.
+        m_year--;
+        if (m_year <= gregorianStartYear)
+            return false;
+        m_week = maxWeekNumberInYear();
+    } else {
+        m_week = ((yearDay - offset) / 7) + 1;
+        if (m_week > maxWeekNumberInYear()) {
+            m_year++;
+            m_week = 1;
+        }
+    }
+    m_type = Week;
+    return true;
+}
+
+double DateComponents::millisecondsSinceEpochForTime() const
+{
+    ASSERT(m_type == Time || m_type == DateTime || m_type == DateTimeLocal);
+    return ((m_hour * minutesPerHour + m_minute) * secondsPerMinute + m_second) * msPerSecond + m_millisecond;
+}
+
+double DateComponents::millisecondsSinceEpoch() const
+{
+    switch (m_type) {
+    case Date:
+        return dateToDaysFrom1970(m_year, m_month, m_monthDay) * msPerDay;
+    case DateTime:
+    case DateTimeLocal:
+        return dateToDaysFrom1970(m_year, m_month, m_monthDay) * msPerDay + millisecondsSinceEpochForTime();
+    case Month:
+        return dateToDaysFrom1970(m_year, m_month, 1) * msPerDay;
+    case Time:
+        return millisecondsSinceEpochForTime();
+    case Week:
+        return (dateToDaysFrom1970(m_year, 0, 1) + offsetTo1stWeekStart(m_year) + (m_week - 1) * 7) * msPerDay;
+    case Invalid:
+        break;
+    }
+    ASSERT_NOT_REACHED();
+    return invalidMilliseconds();
+}
+
+double DateComponents::monthsSinceEpoch() const
+{
+    ASSERT(m_type == Month);
+    return (m_year - 1970) * 12 + m_month;
+}
+
+String DateComponents::toStringForTime(SecondFormat format) const
+{
+    ASSERT(m_type == DateTime || m_type == DateTimeLocal || m_type == Time);
+    SecondFormat effectiveFormat = format;
+    if (m_millisecond)
+        effectiveFormat = Millisecond;
+    else if (format == None && m_second)
+        effectiveFormat = Second;
+
+    switch (effectiveFormat) {
+    default:
+        ASSERT_NOT_REACHED();
+        // Fallback to None.
+    case None:
+        return String::format("%02d:%02d", m_hour, m_minute);
+    case Second:
+        return String::format("%02d:%02d:%02d", m_hour, m_minute, m_second);
+    case Millisecond:
+        return String::format("%02d:%02d:%02d.%03d", m_hour, m_minute, m_second, m_millisecond);
+    }
+}
+
+String DateComponents::toString(SecondFormat format) const
+{
+    switch (m_type) {
+    case Date:
+        return String::format("%04d-%02d-%02d", m_year, m_month + 1, m_monthDay);
+    case DateTime:
+        return String::format("%04d-%02d-%02dT", m_year, m_month + 1, m_monthDay)
+            + toStringForTime(format) + String("Z");
+    case DateTimeLocal:
+        return String::format("%04d-%02d-%02dT", m_year, m_month + 1, m_monthDay)
+            + toStringForTime(format);
+    case Month:
+        return String::format("%04d-%02d", m_year, m_month + 1);
+    case Time:
+        return toStringForTime(format);
+    case Week:
+        return String::format("%04d-W%02d", m_year, m_week);
+    case Invalid:
+        break;
+    }
+    ASSERT_NOT_REACHED();
+    return String("(Invalid DateComponents)");
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/DateComponents.h b/src/3rdparty/webkit/WebCore/html/DateComponents.h
new file mode 100644
index 0000000000..aff8855c57
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DateComponents.h
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DateComponents_h
+#define DateComponents_h
+
+#include <limits>
+#include <wtf/unicode/Unicode.h>
+
+namespace WebCore {
+
+class String;
+
+// A DateComponents instance represents one of the following date and time combinations:
+// * Month type: year-month
+// * Date type: year-month-day
+// * Week type: year-week
+// * Time type: hour-minute-second-millisecond
+// * DateTime or DateTimeLocal type: year-month-day hour-minute-second-millisecond
+class DateComponents {
+public:
+    DateComponents()
+        : m_millisecond(0)
+        , m_second(0)
+        , m_minute(0)
+        , m_hour(0)
+        , m_monthDay(0)
+        , m_month(0)
+        , m_year(0)
+        , m_week(0)
+        , m_type(Invalid)
+    {
+    }
+
+    int millisecond() const { return m_millisecond; }
+    int second() const { return m_second; }
+    int minute() const { return m_minute; }
+    int hour() const { return m_hour; }
+    int monthDay() const { return m_monthDay; }
+    int month() const { return m_month; }
+    int fullYear() const { return m_year; }
+    int week() const { return m_week; }
+
+    enum SecondFormat {
+        None, // Suppress the second part and the millisecond part if they are 0.
+        Second, // Always show the second part, and suppress the millisecond part if it is 0.
+        Millisecond // Always show the second part and the millisecond part.
+    };
+
+    // Returns an ISO 8601 representation for this instance.
+    // The format argument is valid for DateTime, DateTimeLocal, and Time types.
+    String toString(SecondFormat format = None) const;
+
+    // parse*() and setMillisecondsSince*() functions are initializers for an
+    // DateComponents instance. If these functions return false, the instance
+    // might be invalid.
+
+    // The following six functions parse the input 'src' whose length is
+    // 'length', and updates some fields of this instance. The parsing starts at
+    // src[start] and examines characters before src[length].
+    // 'src' must be non-null. The 'src' string doesn't need to be
+    // null-terminated.
+    // The functions return true if the parsing succeeds, and set 'end' to the
+    // next index after the last consumed. Extra leading characters cause parse
+    // failures, and the trailing extra characters don't cause parse failures.
+
+    // Sets year and month.
+    bool parseMonth(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Sets year, month and monthDay.
+    bool parseDate(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Sets year and week.
+    bool parseWeek(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Sets hour, minute, second and millisecond.
+    bool parseTime(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Sets year, month, monthDay, hour, minute, second and millisecond.
+    bool parseDateTimeLocal(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Sets year, month, monthDay, hour, minute, second and millisecond, and adjusts timezone.
+    bool parseDateTime(const UChar* src, unsigned length, unsigned start, unsigned& end);
+
+    // The following setMillisecondsSinceEpochFor*() functions take
+    // the number of milliseconds since 1970-01-01 00:00:00.000 UTC as
+    // the argument, and update all fields for the corresponding
+    // DateComponents type. The functions return true if it succeeds, and
+    // false if they fail.
+
+    // For Date type. Updates m_year, m_month and m_monthDay.
+    bool setMillisecondsSinceEpochForDate(double ms);
+    // For DateTime type. Updates m_year, m_month, m_monthDay, m_hour, m_minute, m_second and m_millisecond.
+    bool setMillisecondsSinceEpochForDateTime(double ms);
+    // For DateTimeLocal type. Updates m_year, m_month, m_monthDay, m_hour, m_minute, m_second and m_millisecond.
+    bool setMillisecondsSinceEpochForDateTimeLocal(double ms);
+    // For Month type. Updates m_year and m_month.
+    bool setMillisecondsSinceEpochForMonth(double ms);
+    // For Week type. Updates m_year and m_week.
+    bool setMillisecondsSinceEpochForWeek(double ms);
+
+    // For Time type. Updates m_hour, m_minute, m_second and m_millisecond.
+    bool setMillisecondsSinceMidnight(double ms);
+
+    // Another initializer for Month type. Updates m_year and m_month.
+    bool setMonthsSinceEpoch(double months);
+
+    // Returns the number of milliseconds from 1970-01-01 00:00:00 UTC.
+    // For a DateComponents initialized with parseDateTimeLocal(),
+    // millisecondsSinceEpoch() returns a value for UTC timezone.
+    double millisecondsSinceEpoch() const;
+    // Returns the number of months from 1970-01.
+    // Do not call this for types other than Month.
+    double monthsSinceEpoch() const;
+    static inline double invalidMilliseconds() { return std::numeric_limits<double>::quiet_NaN(); }
+
+private:
+    // Returns the maximum week number in this DateComponents's year.
+    // The result is either of 52 and 53.
+    int maxWeekNumberInYear() const;
+    bool parseYear(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    bool addDay(int);
+    bool addMinute(int);
+    bool parseTimeZone(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Helper for millisecondsSinceEpoch().
+    double millisecondsSinceEpochForTime() const;
+    // Helpers for setMillisecondsSinceEpochFor*().
+    bool setMillisecondsSinceEpochForDateInternal(double ms);
+    void setMillisecondsSinceMidnightInternal(double ms);
+    // Helper for toString().
+    String toStringForTime(SecondFormat) const;
+
+    // m_weekDay values
+    enum {
+        Sunday = 0,
+        Monday,
+        Tuesday,
+        Wednesday,
+        Thursday,
+        Friday,
+        Saturday,
+    };
+
+    int m_millisecond; // 0 - 999
+    int m_second;
+    int m_minute;
+    int m_hour;
+    int m_monthDay; // 1 - 31
+    int m_month; // 0:January - 11:December
+    int m_year; //  1582 -
+    int m_week; // 1 - 53
+
+    enum Type {
+        Invalid,
+        Date,
+        DateTime,
+        DateTimeLocal,
+        Month,
+        Time,
+        Week,
+    };
+    Type m_type;
+};
+
+
+} // namespace WebCore
+
+#endif // DateComponents_h
diff --git a/src/3rdparty/webkit/WebCore/html/File.cpp b/src/3rdparty/webkit/WebCore/html/File.cpp
index dbbbfa692c..97fdc4578d 100644
--- a/src/3rdparty/webkit/WebCore/html/File.cpp
+++ b/src/3rdparty/webkit/WebCore/html/File.cpp
@@ -27,25 +27,18 @@
 #include "File.h"
 
 #include "FileSystem.h"
-#include "PlatformString.h"
+#include "MIMETypeRegistry.h"
 
 namespace WebCore {
 
 File::File(const String& path)
-    : m_path(path)
-    , m_fileName(pathGetFileName(path))
+    : Blob(path)
+    , m_name(pathGetFileName(path))
 {
-}
-
-unsigned long long File::fileSize()
-{
-    // FIXME: Should we cache this?
-    // FIXME: JavaScript cannot represent sizes as large as unsigned long long, we need to
-    // come up with an exception to throw if file size is not represetable.
-    long long size;
-    if (!getFileSize(m_path, size))
-        return 0;
-    return size;
+    // We don't use MIMETypeRegistry::getMIMETypeForPath() because it returns "application/octet-stream" upon failure.
+    int index = m_name.reverseFind('.');
+    if (index != -1)
+        m_type = MIMETypeRegistry::getMIMETypeForExtension(m_name.substring(index + 1));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/File.h b/src/3rdparty/webkit/WebCore/html/File.h
index 7d79aa5361..dda482ac5e 100644
--- a/src/3rdparty/webkit/WebCore/html/File.h
+++ b/src/3rdparty/webkit/WebCore/html/File.h
@@ -26,30 +26,32 @@
 #ifndef File_h
 #define File_h
 
-#include "PlatformString.h"
+#include "Blob.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
 
-    class File : public RefCounted<File> {
-    public:
-        static PassRefPtr<File> create(const String& path)
-        {
-            return adoptRef(new File(path));
-        }
+class File : public Blob {
+public:
+    static PassRefPtr<File> create(const String& path)
+    {
+        return adoptRef(new File(path));
+    }
 
-        const String& fileName() const { return m_fileName; }
-        unsigned long long fileSize();
+    const String& name() const { return m_name; }
+    const String& type() const { return m_type; }
 
-        const String& path() const { return m_path; }
+    // FIXME: obsolete attributes. To be removed.
+    const String& fileName() const { return m_name; }
+    unsigned long long fileSize() const { return size(); }
 
-    private:
-        File(const String& path);
+private:
+    File(const String& path);
 
-        String m_path;
-        String m_fileName;
-    };
+    String m_name;
+    String m_type;
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/html/File.idl b/src/3rdparty/webkit/WebCore/html/File.idl
index ada9f0c925..94287ff386 100644
--- a/src/3rdparty/webkit/WebCore/html/File.idl
+++ b/src/3rdparty/webkit/WebCore/html/File.idl
@@ -26,8 +26,13 @@
 module html {
 
     interface [
-        GenerateConstructor
-    ] File {
+        GenerateNativeConverter,
+        GenerateToJS
+    ] File : Blob {
+        readonly attribute DOMString name;
+        readonly attribute DOMString type;
+
+        // FIXME: obsolete attributes. To be removed.
         readonly attribute DOMString fileName;
         readonly attribute unsigned long long fileSize;
     };
diff --git a/src/3rdparty/webkit/WebCore/html/FileList.idl b/src/3rdparty/webkit/WebCore/html/FileList.idl
index 01c286e27a..6baf3e1857 100644
--- a/src/3rdparty/webkit/WebCore/html/FileList.idl
+++ b/src/3rdparty/webkit/WebCore/html/FileList.idl
@@ -26,7 +26,6 @@
 module html {
 
     interface [
-        GenerateConstructor,
         HasIndexGetter
     ] FileList {
         readonly attribute unsigned long length;
diff --git a/src/3rdparty/webkit/WebCore/html/FormDataList.h b/src/3rdparty/webkit/WebCore/html/FormDataList.h
index aec1a52988..8398dbcdaa 100644
--- a/src/3rdparty/webkit/WebCore/html/FormDataList.h
+++ b/src/3rdparty/webkit/WebCore/html/FormDataList.h
@@ -55,6 +55,7 @@ public:
     };
 
     const Vector<Item>& list() const { return m_list; }
+    const TextEncoding& encoding() const { return m_encoding; }
 
 private:
     void appendString(const CString&);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAllCollection.idl b/src/3rdparty/webkit/WebCore/html/HTMLAllCollection.idl
index d36f41e375..3b65a0a176 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAllCollection.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAllCollection.idl
@@ -26,7 +26,6 @@
 module html {
 
     interface [
-        GenerateConstructor,
         HasIndexGetter,
         HasNameGetter,
         CustomCall,
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
index 968f144848..f636020536 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
@@ -24,7 +24,6 @@
 #include "config.h"
 #include "HTMLAnchorElement.h"
 
-#include "DNS.h"
 #include "EventNames.h"
 #include "Frame.h"
 #include "FrameLoaderTypes.h"
@@ -35,6 +34,7 @@
 #include "MouseEvent.h"
 #include "Page.h"
 #include "RenderImage.h"
+#include "ResourceHandle.h"
 #include "Settings.h"
 
 namespace WebCore {
@@ -58,6 +58,15 @@ PassRefPtr<HTMLAnchorElement> HTMLAnchorElement::create(const QualifiedName& tag
     return adoptRef(new HTMLAnchorElement(tagName, document));
 }
 
+// This function does not allow leading spaces before the port number.
+static unsigned parsePortFromStringPosition(const String& value, unsigned portStart, unsigned& portEnd)
+{
+    portEnd = portStart;
+    while (isASCIIDigit(value[portEnd]))
+        ++portEnd;
+    return value.substring(portStart, portEnd - portStart).toUInt();
+}
+
 bool HTMLAnchorElement::supportsFocus() const
 {
     if (isContentEditable())
@@ -69,10 +78,12 @@ bool HTMLAnchorElement::supportsFocus() const
 bool HTMLAnchorElement::isMouseFocusable() const
 {
     // Anchor elements should be mouse focusable, https://bugs.webkit.org/show_bug.cgi?id=26856
-#if PLATFORM(MAC)
+#if !PLATFORM(GTK) && !PLATFORM(QT)
     if (isLink())
-        return false;
+        // Only allow links with tabIndex or contentEditable to be mouse focusable.
+        return HTMLElement::supportsFocus();
 #endif
+
     // Allow tab index etc to control focus.
     return HTMLElement::isMouseFocusable();
 }
@@ -268,7 +279,7 @@ void HTMLAnchorElement::parseMappedAttribute(MappedAttribute *attr)
             String parsedURL = deprecatedParseURL(attr->value());
             if (document()->isDNSPrefetchEnabled()) {
                 if (protocolIs(parsedURL, "http") || protocolIs(parsedURL, "https") || parsedURL.startsWith("//"))
-                    prefetchDNS(document()->completeURL(parsedURL).host());
+                    ResourceHandle::prepareForURL(document()->completeURL(parsedURL));
             }
             if (document()->page() && !document()->page()->javaScriptURLsAreAllowed() && protocolIsJavaScript(parsedURL)) {
                 setIsLink(false);
@@ -316,7 +327,7 @@ bool HTMLAnchorElement::draggable() const
 
 KURL HTMLAnchorElement::href() const
 {
-    return document()->completeURL(getAttribute(hrefAttr));
+    return document()->completeURL(deprecatedParseURL(getAttribute(hrefAttr)));
 }
 
 void HTMLAnchorElement::setHref(const AtomicString& value)
@@ -332,7 +343,7 @@ bool HTMLAnchorElement::hasRel(uint32_t relation) const
 void HTMLAnchorElement::setRel(const String& value)
 {
     m_linkRelations = 0;
-    ClassNames newLinkRelations(value, true);
+    SpaceSplitString newLinkRelations(value, true);
     // FIXME: Add link relations as they are implemented
     if (newLinkRelations.contains("noreferrer"))
         m_linkRelations |= RelationNoReferrer;
@@ -360,42 +371,153 @@ String HTMLAnchorElement::hash() const
     return fragmentIdentifier.isEmpty() ? "" : "#" + fragmentIdentifier;
 }
 
+void HTMLAnchorElement::setHash(const String& value)
+{
+    KURL url = href();
+    if (value[0] == '#')
+        url.setFragmentIdentifier(value.substring(1));
+    else
+        url.setFragmentIdentifier(value);
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::host() const
 {
     const KURL& url = href();
     if (url.hostEnd() == url.pathStart())
         return url.host();
-    if (SecurityOrigin::isDefaultPortForProtocol(url.port(), url.protocol()))
+    if (isDefaultPortForProtocol(url.port(), url.protocol()))
         return url.host();
     return url.host() + ":" + String::number(url.port());
 }
 
+void HTMLAnchorElement::setHost(const String& value)
+{
+    if (value.isEmpty())
+        return;
+    KURL url = href();
+    if (!url.canSetHostOrPort())
+        return;
+
+    int separator = value.find(':');
+    if (!separator)
+        return;
+
+    if (separator == -1)
+        url.setHostAndPort(value);
+    else {
+        unsigned portEnd;
+        unsigned port = parsePortFromStringPosition(value, separator + 1, portEnd);
+        if (!port) {
+            // http://dev.w3.org/html5/spec/infrastructure.html#url-decomposition-idl-attributes
+            // specifically goes against RFC 3986 (p3.2) and
+            // requires setting the port to "0" if it is set to empty string.
+            url.setHostAndPort(value.substring(0, separator + 1) + "0");
+        } else {
+            if (isDefaultPortForProtocol(port, url.protocol()))
+                url.setHostAndPort(value.substring(0, separator));
+            else
+                url.setHostAndPort(value.substring(0, portEnd));
+        }
+    }
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::hostname() const
 {
     return href().host();
 }
 
+void HTMLAnchorElement::setHostname(const String& value)
+{
+    // Before setting new value:
+    // Remove all leading U+002F SOLIDUS ("/") characters.
+    unsigned i = 0;
+    unsigned hostLength = value.length();
+    while (value[i] == '/')
+        i++;
+
+    if (i == hostLength)
+        return;
+
+    KURL url = href();
+    if (!url.canSetHostOrPort())
+        return;
+
+    url.setHost(value.substring(i));
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::pathname() const
 {
     return href().path();
 }
 
+void HTMLAnchorElement::setPathname(const String& value)
+{
+    KURL url = href();
+    if (!url.canSetPathname())
+        return;
+
+    if (value[0] == '/')
+        url.setPath(value);
+    else
+        url.setPath("/" + value);
+
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::port() const
 {
     return String::number(href().port());
 }
 
+void HTMLAnchorElement::setPort(const String& value)
+{
+    KURL url = href();
+    if (!url.canSetHostOrPort())
+        return;
+
+    // http://dev.w3.org/html5/spec/infrastructure.html#url-decomposition-idl-attributes
+    // specifically goes against RFC 3986 (p3.2) and
+    // requires setting the port to "0" if it is set to empty string.
+    unsigned port = value.toUInt();
+    if (isDefaultPortForProtocol(port, url.protocol()))
+        url.removePort();
+    else
+        url.setPort(port);
+
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::protocol() const
 {
     return href().protocol() + ":";
 }
 
+void HTMLAnchorElement::setProtocol(const String& value)
+{
+    KURL url = href();
+    url.setProtocol(value);
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::search() const
 {
     String query = href().query();
     return query.isEmpty() ? "" : "?" + query;
 }
 
+void HTMLAnchorElement::setSearch(const String& value)
+{
+    KURL url = href();
+    String newSearch = (value[0] == '?') ? value.substring(1) : value;
+    // Make sure that '#' in the query does not leak to the hash.
+    url.setQuery(newSearch.replace('#', "%23"));
+
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::text() const
 {
     return innerText();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h
index e47ea99cb1..03d3529857 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h
@@ -62,12 +62,26 @@ public:
     const AtomicString& name() const;
 
     String hash() const;
+    void setHash(const String&);
+
     String host() const;
+    void setHost(const String&);
+
     String hostname() const;
+    void setHostname(const String&);
+
     String pathname() const;
+    void setPathname(const String&);
+
     String port() const;
+    void setPort(const String&);
+
     String protocol() const;
+    void setProtocol(const String&);
+
     String search() const;
+    void setSearch(const String&);
+
     String text() const;
 
     String toString() const;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.idl
index 057358efef..03b398622b 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.idl
@@ -20,11 +20,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=0c74cef8-b1f7-4b44-83a9-8deeb376a257,
-        ImplementationUUID=30f797d5-d145-498e-a126-d8e9ddeedea3
-    ] HTMLAnchorElement : HTMLElement {
+    interface HTMLAnchorElement : HTMLElement {
         attribute [ConvertNullToNullString, Reflect=accesskey] DOMString accessKey;
         attribute [ConvertNullToNullString, Reflect] DOMString charset;
         attribute [ConvertNullToNullString, Reflect] DOMString coords;
@@ -37,7 +33,7 @@ module html {
         attribute [ConvertNullToNullString, Reflect] DOMString target;
         attribute [ConvertNullToNullString, Reflect] DOMString type;
 
-        // IE Extensions
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute DOMString hash;
         readonly attribute DOMString host;
         readonly attribute DOMString hostname;
@@ -45,6 +41,16 @@ module html {
         readonly attribute DOMString port;
         readonly attribute DOMString protocol;
         readonly attribute DOMString search;
+#else
+        attribute [ConvertNullToNullString] DOMString hash;
+        attribute [ConvertNullToNullString] DOMString host;
+        attribute [ConvertNullToNullString] DOMString hostname;
+        attribute [ConvertNullToNullString] DOMString pathname;
+        attribute [ConvertNullToNullString] DOMString port;
+        attribute [ConvertNullToNullString] DOMString protocol;
+        attribute [ConvertNullToNullString] DOMString search;
+#endif
+
         readonly attribute DOMString text;
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp
index 46045d6f00..fb23b5c62e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp
@@ -28,6 +28,7 @@
 #include "HTMLNames.h"
 #include "MappedAttribute.h"
 #include "RenderApplet.h"
+#include "SecurityOrigin.h"
 #include "Settings.h"
 
 namespace WebCore {
@@ -62,7 +63,7 @@ void HTMLAppletElement::parseMappedAttribute(MappedAttribute* attr)
             document->addNamedItem(newName);
         }
         m_name = newName;
-    } else if (attr->name() == idAttr) {
+    } else if (attr->name() == idAttributeName()) {
         const AtomicString& newId = attr->value();
         if (inDocument() && document()->isHTMLDocument()) {
             HTMLDocument* document = static_cast<HTMLDocument*>(this->document());
@@ -108,9 +109,7 @@ bool HTMLAppletElement::rendererIsNeeded(RenderStyle* style)
 
 RenderObject* HTMLAppletElement::createRenderer(RenderArena*, RenderStyle* style)
 {
-    Settings* settings = document()->settings();
-
-    if (settings && settings->isJavaEnabled()) {
+    if (canEmbedJava()) {
         HashMap<String, String> args;
 
         args.set("code", getAttribute(codeAttr));
@@ -119,7 +118,7 @@ RenderObject* HTMLAppletElement::createRenderer(RenderArena*, RenderStyle* style
         if (!codeBase.isNull())
             args.set("codeBase", codeBase);
 
-        const AtomicString& name = getAttribute(document()->isHTMLDocument() ? nameAttr : idAttr);
+        const AtomicString& name = getAttribute(document()->isHTMLDocument() ? nameAttr : idAttributeName());
         if (!name.isNull())
             args.set("name", name);
         const AtomicString& archive = getAttribute(archiveAttr);
@@ -142,8 +141,7 @@ RenderObject* HTMLAppletElement::createRenderer(RenderArena*, RenderStyle* style
 
 RenderWidget* HTMLAppletElement::renderWidgetForJSBindings() const
 {
-    Settings* settings = document()->settings();
-    if (!settings || !settings->isJavaEnabled())
+    if (!canEmbedJava())
         return 0;
 
     RenderApplet* applet = toRenderApplet(renderer());
@@ -153,6 +151,15 @@ RenderWidget* HTMLAppletElement::renderWidgetForJSBindings() const
     return applet;
 }
 
+bool HTMLAppletElement::canEmbedJava() const
+{
+    if (document()->securityOrigin()->isSandboxed(SandboxPlugins))
+        return false;
+
+    Settings* settings = document()->settings();
+    return settings && settings->isJavaEnabled();
+}
+
 void HTMLAppletElement::finishParsingChildren()
 {
     // The parser just reached </applet>, so all the params are available now.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.h b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.h
index baaab38e72..a53bd5cd81 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.h
@@ -51,6 +51,7 @@ private:
     virtual RenderWidget* renderWidgetForJSBindings() const;
 
     void setupApplet() const;
+    bool canEmbedJava() const;
 
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.idl
index cc923caa1e..f5984f0a05 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.idl
@@ -21,13 +21,9 @@
 module html {
 
     interface [
-        GenerateConstructor,
         DelegatingPutFunction,
         DelegatingGetOwnPropertySlot,
-        CustomCall,
-        HasOverridingNameGetter,
-        InterfaceUUID=9b5cb4a8-c156-4b55-afdb-c60938a4d1b1,
-        ImplementationUUID=56544372-675e-40dd-ba39-fa708a4c7678
+        CustomCall
     ] HTMLAppletElement : HTMLElement {
                  attribute [ConvertNullToNullString, Reflect] DOMString align;
                  attribute [ConvertNullToNullString, Reflect] DOMString alt;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp
index b202caea46..b862f69432 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp
@@ -22,6 +22,8 @@
 #include "config.h"
 #include "HTMLAreaElement.h"
 
+#include "HTMLImageElement.h"
+#include "HTMLMapElement.h"
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "MappedAttribute.h"
@@ -82,13 +84,27 @@ bool HTMLAreaElement::mapMouseEvent(int x, int y, const IntSize& size, HitTestRe
     return true;
 }
 
-IntRect HTMLAreaElement::getRect(RenderObject* obj) const
+Path HTMLAreaElement::getPath(RenderObject* obj) const
 {
+    if (!obj)
+        return Path();
+    
     // FIXME: This doesn't work correctly with transforms.
     FloatPoint absPos = obj->localToAbsolute();
-    Path p = getRegion(m_lastSize);
+
+    // Default should default to the size of the containing object.
+    IntSize size = m_lastSize;
+    if (m_shape == Default)
+        size = obj->absoluteOutlineBounds().size();
+    
+    Path p = getRegion(size);
     p.translate(absPos - FloatPoint());
-    return enclosingIntRect(p.boundingRect());
+    return p;
+}
+    
+IntRect HTMLAreaElement::getRect(RenderObject* obj) const
+{
+    return enclosingIntRect(getPath(obj).boundingRect());
 }
 
 Path HTMLAreaElement::getRegion(const IntSize& size) const
@@ -161,11 +177,58 @@ void HTMLAreaElement::setNoHref(bool noHref)
 {
     setAttribute(nohrefAttr, noHref ? "" : 0);
 }
+    
+HTMLImageElement* HTMLAreaElement::imageElement() const
+{
+    Node* mapElement = parent();
+    if (!mapElement->hasTagName(mapTag))
+        return 0;
+    
+    return static_cast<HTMLMapElement*>(mapElement)->imageElement();
+}
 
+bool HTMLAreaElement::isKeyboardFocusable(KeyboardEvent*) const
+{
+    return supportsFocus();
+}
+
+bool HTMLAreaElement::isFocusable() const
+{
+    return supportsFocus();
+}
+    
+void HTMLAreaElement::dispatchBlurEvent()
+{
+    HTMLAnchorElement::dispatchBlurEvent();
+    
+    // On a blur, we might need to remove our focus rings by repainting.
+    updateFocusAppearance(false);
+}
+    
+void HTMLAreaElement::updateFocusAppearance(bool restorePreviousSelection)
+{
+    Node* parent = parentNode();
+    if (!parent || !parent->hasTagName(mapTag))
+        return;
+    
+    HTMLImageElement* imageElement = static_cast<HTMLMapElement*>(parent)->imageElement();
+    if (!imageElement)
+        return;
+    
+    // This will handle scrolling to the image if necessary.
+    imageElement->updateFocusAppearance(restorePreviousSelection);
+    
+    RenderObject* imageRenderer = imageElement->renderer();
+    if (imageRenderer)
+        imageRenderer->setNeedsLayout(true);
+}
+    
 bool HTMLAreaElement::supportsFocus() const
 {
-    // Skip HTMLAnchorElements isLink() check.
-    return HTMLElement::supportsFocus();
+    // If the AREA element was a link, it should support focus.
+    // The inherited method is not used because it assumes that a render object must exist 
+    // for the element to support focus. AREA elements do not have render objects.
+    return isLink();
 }
 
 String HTMLAreaElement::target() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h
index 7b2497c3d5..f8e25649cc 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h
@@ -30,6 +30,7 @@
 namespace WebCore {
 
 class HitTestResult;
+class HTMLImageElement;
 class Path;
 
 class HTMLAreaElement : public HTMLAnchorElement {
@@ -41,7 +42,11 @@ public:
     bool mapMouseEvent(int x, int y, const IntSize&, HitTestResult&);
 
     IntRect getRect(RenderObject*) const;
-
+    Path getPath(RenderObject*) const;
+    
+    // Convenience method to get the parent map's image.
+    HTMLImageElement* imageElement() const;
+    
     KURL href() const;
 
     bool noHref() const;
@@ -55,7 +60,11 @@ private:
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual bool supportsFocus() const;
     virtual String target() const;
-
+    virtual bool isKeyboardFocusable(KeyboardEvent*) const;
+    virtual bool isFocusable() const;
+    virtual void updateFocusAppearance(bool /*restorePreviousSelection*/);
+    virtual void dispatchBlurEvent();
+    
     enum Shape { Default, Poly, Rect, Circle, Unknown };
     Path getRegion(const IntSize&) const;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.idl
index 53239c65fd..210d6e5da8 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.idl
@@ -20,11 +20,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=aac98729-47d3-4623-8c5b-004783af5bd6,
-        ImplementationUUID=f0631a41-5f55-40e5-a879-c09e663c26ba
-    ] HTMLAreaElement : HTMLElement {
+    interface HTMLAreaElement : HTMLElement {
         attribute [ConvertNullToNullString, Reflect=accesskey] DOMString accessKey;
         attribute [ConvertNullToNullString, Reflect] DOMString alt;
         attribute [ConvertNullToNullString, Reflect] DOMString coords;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
index 340779e126..7a353b2e84 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
@@ -13,22 +13,35 @@ alink
 alt
 archive
 aria-activedescendant
+aria-atomic
+aria-busy
 aria-checked
+aria-controls
 aria-describedby
 aria-disabled
+aria-dropeffect
+aria-expanded
+aria-flowto
+aria-grabbed
+aria-haspopup
 aria-hidden
 aria-label
 aria-labeledby
 aria-labelledby
 aria-level
+aria-live
+aria-multiselectable
+aria-orientation
+aria-owns
 aria-pressed
 aria-readonly
+aria-relevant
 aria-required
+aria-selected
 aria-valuemax
 aria-valuemin
 aria-valuenow
 aria-valuetext
-autobuffer
 autocomplete
 autofocus
 autoplay
@@ -49,7 +62,7 @@ charset
 checked
 cellborder
 cite
-class exportString
+class
 classid
 clear
 code
@@ -74,6 +87,7 @@ disabled
 draggable
 enctype
 end
+event
 expanded
 face
 focused
@@ -149,6 +163,8 @@ onemptied
 onended
 onerror
 onfocus
+onfocusin
+onfocusout
 onhashchange
 oninput
 oninvalid
@@ -174,6 +190,7 @@ onpaste
 onpause
 onplay
 onplaying
+onpopstate
 onprogress
 onratechange
 onreset
@@ -189,18 +206,25 @@ onstorage
 onsuspend
 onsubmit
 ontimeupdate
+ontouchstart
+ontouchmove
+ontouchend
+ontouchcancel
 onunload
 onvolumechange
 onwaiting
 onwebkitanimationstart
 onwebkitanimationiteration
 onwebkitanimationend
+onwebkitbeginfullscreen
+onwebkitendfullscreen
 onwebkittransitionend
 pattern
 placeholder
 pluginurl
 poster
 precision
+preload
 primary
 profile
 progress
@@ -214,6 +238,7 @@ role
 rows
 rowspan
 rules
+sandbox
 scheme
 scope
 scrollamount
@@ -229,6 +254,7 @@ spellcheck
 src
 standby
 start
+step
 style
 summary
 tabindex
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAudioElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAudioElement.cpp
index 6adf9ea8da..6018b52353 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAudioElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAudioElement.cpp
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,7 +21,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -34,11 +35,22 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLAudioElement::HTMLAudioElement(const QualifiedName& tagName, Document* doc)
-    : HTMLMediaElement(tagName, doc)
+HTMLAudioElement::HTMLAudioElement(const QualifiedName& tagName, Document* document)
+    : HTMLMediaElement(tagName, document)
 {
     ASSERT(hasTagName(audioTag));
 }
 
+PassRefPtr<HTMLAudioElement> HTMLAudioElement::createForJSConstructor(Document* document, const String& src)
+{
+    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(audioTag, document);
+    audio->setPreload("auto");
+    if (!src.isNull()) {
+        audio->setSrc(src);
+        audio->scheduleLoad();
+    }
+    return audio.release();
+}
+
 }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAudioElement.h b/src/3rdparty/webkit/WebCore/html/HTMLAudioElement.h
index 1dbe44fca9..2f06f1a5de 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAudioElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAudioElement.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,7 +21,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef HTMLAudioElement_h
@@ -28,14 +29,17 @@
 
 #if ENABLE(VIDEO)
 
+#include "Document.h"
 #include "HTMLMediaElement.h"
 
 namespace WebCore {
 
 class HTMLAudioElement : public HTMLMediaElement {
 public:
+    static PassRefPtr<HTMLAudioElement> createForJSConstructor(Document*, const String& src);
     HTMLAudioElement(const QualifiedName&, Document*);
-    
+private:
+    virtual bool isVideo() const { return false; }
     virtual int tagPriority() const { return 5; }
 };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAudioElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLAudioElement.idl
index f335d865c1..107b8b18ed 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAudioElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAudioElement.idl
@@ -24,7 +24,7 @@
  */
 
 module html {
-    interface [GenerateConstructor, Conditional=VIDEO] HTMLAudioElement : HTMLMediaElement {
+    interface [Conditional=VIDEO] HTMLAudioElement : HTMLMediaElement {
     
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBRElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLBRElement.idl
index 6d626ff565..4048911dda 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBRElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBRElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=e84b14bc-b0aa-431f-83c4-fcc297e354b0,
-        ImplementationUUID=c10d45a4-b042-45d0-b170-6ac7173ee823
-    ] HTMLBRElement : HTMLElement {
+    interface HTMLBRElement : HTMLElement {
         attribute [ConvertNullToNullString, Reflect] DOMString clear;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.idl
index b7385ecf53..087faca020 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=e4112bea-13de-40f6-93d0-41e285ae1491,
-        ImplementationUUID=23cec074-660f-490a-996d-167d66c164d5
-    ] HTMLBaseElement : HTMLElement {
+    interface HTMLBaseElement : HTMLElement {
         attribute [ConvertNullToNullString, Reflect] DOMString href;
         attribute [ConvertNullToNullString, Reflect] DOMString target;
     };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.idl
index 665f124606..d55654e98d 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=434b1be5-408e-45b5-be83-c70e11e9bb37,
-        ImplementationUUID=1dc8508e-53c4-4e7e-93c0-16772372b2dc
-    ] HTMLBaseFontElement : HTMLElement {
+    interface HTMLBaseFontElement : HTMLElement {
         attribute [ConvertNullToNullString, Reflect] DOMString color;
         attribute [ConvertNullToNullString, Reflect] DOMString face;
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBlockquoteElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLBlockquoteElement.idl
index f6463ddfe7..b819236cc7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBlockquoteElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBlockquoteElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=902d9011-c6d6-4363-b6fe-bd2d28ef553b,
-        ImplementationUUID=345db946-ba9c-44b9-87fd-06083aa472e4
-    ] HTMLBlockquoteElement : HTMLElement {
+    interface HTMLBlockquoteElement : HTMLElement {
         attribute [ConvertNullToNullString, Reflect] DOMString cite;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp
index a356bf347f..35133c08e3 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp
@@ -139,6 +139,8 @@ void HTMLBodyElement::parseMappedAttribute(MappedAttribute *attr)
         document()->setWindowAttributeEventListener(eventNames().pagehideEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onpageshowAttr)
         document()->setWindowAttributeEventListener(eventNames().pageshowEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onpopstateAttr)
+        document()->setWindowAttributeEventListener(eventNames().popstateEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onblurAttr)
         document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onfocusAttr)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h
index e898c88495..76b49a1846 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h
@@ -52,13 +52,15 @@ public:
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(load);
 
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(beforeunload);
-    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(message);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(hashchange);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(message);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(offline);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(online);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(popstate);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(resize);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(storage);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(unload);
+
 #if ENABLE(ORIENTATION_EVENTS)
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(orientationchange);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl
index 2e93e2e1b9..95140c7abe 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl
@@ -20,11 +20,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=4789afc6-2d9e-4f3b-8c27-12abc9d4a014,
-        ImplementationUUID=d2e16911-2f7e-4d58-a92c-94700d445b38
-    ] HTMLBodyElement : HTMLElement {
+    interface HTMLBodyElement : HTMLElement {
         attribute [ConvertNullToNullString, Reflect=alink] DOMString aLink;
         attribute [ConvertNullToNullString, Reflect] DOMString background;
         attribute [ConvertNullToNullString, Reflect=bgcolor] DOMString bgColor;
@@ -33,13 +29,13 @@ module html {
         attribute [ConvertNullToNullString, Reflect=vlink] DOMString vLink;
 
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Event handler attributes
         attribute [DontEnum] EventListener onbeforeunload;
         attribute [DontEnum] EventListener onhashchange;
         attribute [DontEnum] EventListener onmessage;
         attribute [DontEnum] EventListener onoffline;
         attribute [DontEnum] EventListener ononline;
+        attribute [DontEnum] EventListener onpopstate;
         attribute [DontEnum] EventListener onresize;
         attribute [DontEnum] EventListener onstorage;
         attribute [DontEnum] EventListener onunload;
@@ -57,11 +53,9 @@ module html {
         // Not implemented yet.
         // attribute [DontEnum] EventListener onafterprint;
         // attribute [DontEnum] EventListener onbeforeprint;
-        // attribute [DontEnum] EventListener onpopstate;
         // attribute [DontEnum] EventListener onredo;
         // attribute [DontEnum] EventListener onundo;
 #endif
-#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.cpp
index 3987859d02..b3d358d671 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.cpp
@@ -90,10 +90,6 @@ void HTMLButtonElement::parseMappedAttribute(MappedAttribute* attr)
     } else if (attr->name() == alignAttr) {
         // Don't map 'align' attribute.  This matches what Firefox and IE do, but not Opera.
         // See http://bugs.webkit.org/show_bug.cgi?id=12071
-    } else if (attr->name() == onfocusAttr) {
-        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onblurAttr) {
-        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else
         HTMLFormControlElement::parseMappedAttribute(attr);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.h b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.h
index f5b9b628f7..f4df571f74 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.h
@@ -57,11 +57,10 @@ public:
     String value() const;
     void setValue(const String&);
 
-    virtual bool willValidate() const { return false; }
-    
 private:
     enum Type { SUBMIT, RESET, BUTTON };
     virtual bool isOptionalFormControl() const { return true; }
+    virtual bool recalcWillValidate() const { return false; }
 
     Type m_type;
     bool m_activeSubmit;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.idl
index 55803dffda..73098fe953 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.idl
@@ -20,16 +20,10 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=b9715643-5591-442d-ab65-e05309607271,
-        ImplementationUUID=1be13b5f-40df-4550-b70e-8c805e546cad
-    ] HTMLButtonElement : HTMLElement {
+    interface HTMLButtonElement : HTMLElement {
         readonly attribute  HTMLFormElement      form;
                  attribute  boolean              formNoValidate;
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute  ValidityState        validity;
-#endif
                  attribute  [ConvertNullToNullString] DOMString            accessKey;
                  attribute  boolean              disabled;
                  attribute  boolean              autofocus;
@@ -37,6 +31,7 @@ module html {
         readonly attribute  DOMString            type;
                  attribute  [ConvertNullToNullString] DOMString            value;
         readonly attribute boolean               willValidate;
+        readonly attribute DOMString             validationMessage;
         boolean  checkValidity();
         void setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
         void click();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
index 7bae6e3fa3..30a620cd04 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
@@ -27,11 +27,13 @@
 #include "config.h"
 #include "HTMLCanvasElement.h"
 
+#include "CanvasContextAttributes.h"
 #include "CanvasGradient.h"
 #include "CanvasPattern.h"
 #include "CanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)    
-#include "CanvasRenderingContext3D.h"
+#include "WebGLContextAttributes.h"
+#include "WebGLRenderingContext.h"
 #endif
 #include "CanvasStyle.h"
 #include "Chrome.h"
@@ -111,8 +113,8 @@ void HTMLCanvasElement::parseMappedAttribute(MappedAttribute* attr)
 
 RenderObject* HTMLCanvasElement::createRenderer(RenderArena* arena, RenderStyle* style)
 {
-    Settings* settings = document()->settings();
-    if (settings && settings->isJavaScriptEnabled()) {
+    Frame* frame = document()->frame();
+    if (frame && frame->script()->canExecuteScripts(NotAboutToExecuteScript)) {
         m_rendererIsCanvas = true;
         return new (arena) RenderHTMLCanvas(this);
     }
@@ -147,11 +149,11 @@ String HTMLCanvasElement::toDataURL(const String& mimeType, ExceptionCode& ec)
     return buffer()->toDataURL(mimeType);
 }
 
-CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type)
+CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type, CanvasContextAttributes* attrs)
 {
-    // A Canvas can either be "2D" or "3D" never both. If you request a 2D canvas and the existing
-    // context is already 2D, just return that. If the existing context is 3D, then destroy it
-    // before creating a new 2D context. Vice versa when requesting a 3D canvas. Requesting a
+    // A Canvas can either be "2D" or "webgl" but never both. If you request a 2D canvas and the existing
+    // context is already 2D, just return that. If the existing context is WebGL, then destroy it
+    // before creating a new 2D context. Vice versa when requesting a WebGL canvas. Requesting a
     // context with any other type string will destroy any existing context.
     
     // FIXME - The code depends on the context not going away once created, to prevent JS from
@@ -166,13 +168,15 @@ CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type)
     }
 #if ENABLE(3D_CANVAS)    
     Settings* settings = document()->settings();
-    if (settings && settings->webGLEnabled()) {
+    if (settings && settings->webGLEnabled() && settings->acceleratedCompositingEnabled()) {
+        // Accept the legacy "webkit-3d" name as well as the provisional "experimental-webgl" name.
+        // Once ratified, we will also accept "webgl" as the context name.
         if ((type == "webkit-3d") ||
-            (type == "GL")) {
+            (type == "experimental-webgl")) {
             if (m_context && !m_context->is3d())
                 return 0;
             if (!m_context) {
-                m_context = CanvasRenderingContext3D::create(this);
+                m_context = WebGLRenderingContext::create(this, static_cast<WebGLContextAttributes*>(attrs));
                 if (m_context) {
                     // Need to make sure a RenderLayer and compositing layer get created for the Canvas
                     setNeedsStyleRecalc(SyntheticStyleChange);
@@ -181,6 +185,8 @@ CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type)
             return m_context.get();
         }
     }
+#else
+    UNUSED_PARAM(attrs);
 #endif
     return 0;
 }
@@ -221,6 +227,11 @@ void HTMLCanvasElement::reset()
     IntSize oldSize = m_size;
     m_size = IntSize(w, h);
 
+#if ENABLE(3D_CANVAS)
+    if (m_context && m_context->is3d())
+        static_cast<WebGLRenderingContext*>(m_context.get())->reshape(width(), height());
+#endif
+
     bool hadImageBuffer = m_createdImageBuffer;
     m_createdImageBuffer = false;
     m_imageBuffer.clear();
@@ -249,9 +260,9 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const IntRect& r)
         return;
     
 #if ENABLE(3D_CANVAS)
-    CanvasRenderingContext3D* context3D = NULL;
+    WebGLRenderingContext* context3D = 0;
     if (m_context && m_context->is3d()) {
-        context3D = static_cast<CanvasRenderingContext3D*>(m_context.get());
+        context3D = static_cast<WebGLRenderingContext*>(m_context.get());
         context3D->beginPaint();
     }
 #endif
@@ -259,14 +270,12 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const IntRect& r)
     if (m_imageBuffer) {
         Image* image = m_imageBuffer->image();
         if (image)
-            context->drawImage(image, r);
+            context->drawImage(image, DeviceColorSpace, r);
     }
 
 #if ENABLE(3D_CANVAS)
-    if (context3D != NULL) {
-        context3D->reshape(r.width(), r.height());
+    if (context3D)
         context3D->endPaint();
-    }
 #endif
 }
 
@@ -328,12 +337,12 @@ ImageBuffer* HTMLCanvasElement::buffer() const
     return m_imageBuffer.get();
 }
     
-TransformationMatrix HTMLCanvasElement::baseTransform() const
+AffineTransform HTMLCanvasElement::baseTransform() const
 {
     ASSERT(m_createdImageBuffer);
     FloatSize unscaledSize(width(), height());
     IntSize size = convertLogicalToDevice(unscaledSize);
-    TransformationMatrix transform;
+    AffineTransform transform;
     if (size.width() && size.height())
         transform.scaleNonUniform(size.width() / unscaledSize.width(), size.height() / unscaledSize.height());
     transform.multiply(m_imageBuffer->baseTransform());
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h
index edae9e5577..a29c1b8523 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h
@@ -27,7 +27,8 @@
 #ifndef HTMLCanvasElement_h
 #define HTMLCanvasElement_h
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
+#include "CanvasSurface.h"
 #include "FloatRect.h"
 #include "HTMLElement.h"
 #if ENABLE(3D_CANVAS)    
@@ -37,6 +38,7 @@
 
 namespace WebCore {
 
+class CanvasContextAttributes;
 class CanvasRenderingContext;
 class FloatPoint;
 class FloatRect;
@@ -56,7 +58,7 @@ public:
     virtual void canvasDestroyed(HTMLCanvasElement*) = 0;
 };
 
-class HTMLCanvasElement : public HTMLElement {
+class HTMLCanvasElement : public HTMLElement, public CanvasSurface {
 public:
     HTMLCanvasElement(const QualifiedName&, Document*);
     virtual ~HTMLCanvasElement();
@@ -68,7 +70,7 @@ public:
 
     String toDataURL(const String& mimeType, ExceptionCode&);
 
-    CanvasRenderingContext* getContext(const String&);
+    CanvasRenderingContext* getContext(const String&, CanvasContextAttributes* attributes = 0);
 
     const IntSize& size() const { return m_size; }
     void setSize(const IntSize& size)
@@ -99,7 +101,7 @@ public:
 
     void setObserver(CanvasObserver* observer) { m_observer = observer; }
 
-    TransformationMatrix baseTransform() const;
+    AffineTransform baseTransform() const;
 
     CanvasRenderingContext* renderingContext() const { return m_context.get(); }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl
index 4b1b057f3b..ea7f9826e5 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl
@@ -26,10 +26,7 @@
 module html {
 
     interface [
-        CustomMarkFunction,
-        GenerateConstructor,
-        InterfaceUUID=a14d88c8-c6af-4e34-ad17-659700c77a10,
-        ImplementationUUID=7ae731bc-c264-4ee3-a4b4-5d4540af26c3
+        CustomMarkFunction
     ] HTMLCanvasElement : HTMLElement {
 
         attribute long width;
@@ -39,7 +36,8 @@ module html {
             raises(DOMException);
 
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
-        [V8Custom] DOMObject getContext(in DOMString contextId);
+        // The custom binding is needed to handle context creation attributes.
+        [Custom] DOMObject getContext(in DOMString contextId);
 #endif
 
     };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp b/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp
index 44e11040c9..0c65121847 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp
@@ -266,7 +266,7 @@ bool HTMLCollection::checkForNameMatch(Element* element, bool checkName, const A
     
     HTMLElement* e = static_cast<HTMLElement*>(element);
     if (!checkName)
-        return e->getAttribute(idAttr) == name;
+        return e->getAttribute(e->idAttributeName()) == name;
 
     // document.all returns only images, forms, applets, objects and embeds
     // by name (though everything by id)
@@ -277,7 +277,7 @@ bool HTMLCollection::checkForNameMatch(Element* element, bool checkName, const A
           e->hasLocalName(selectTag)))
         return false;
 
-    return e->getAttribute(nameAttr) == name && e->getAttribute(idAttr) != name;
+    return e->getAttribute(nameAttr) == name && e->getAttribute(e->idAttributeName()) != name;
 }
 
 Node* HTMLCollection::namedItem(const AtomicString& name) const
@@ -319,7 +319,7 @@ void HTMLCollection::updateNameCache() const
         if (!element->isHTMLElement())
             continue;
         HTMLElement* e = static_cast<HTMLElement*>(element);
-        const AtomicString& idAttrVal = e->getAttribute(idAttr);
+        const AtomicString& idAttrVal = e->getAttribute(e->idAttributeName());
         const AtomicString& nameAttrVal = e->getAttribute(nameAttr);
         if (!idAttrVal.isEmpty()) {
             // add to id cache
@@ -358,7 +358,8 @@ void HTMLCollection::namedItems(const AtomicString& name, Vector<RefPtr<Node> >&
 
     resetCollectionInfo();
     updateNameCache();
-    
+    m_info->checkConsistency();
+
     Vector<Element*>* idResults = m_info->idCache.get(name.impl());
     Vector<Element*>* nameResults = m_info->nameCache.get(name.impl());
     
@@ -373,6 +374,7 @@ void HTMLCollection::namedItems(const AtomicString& name, Vector<RefPtr<Node> >&
 Node* HTMLCollection::nextNamedItem(const AtomicString& name) const
 {
     resetCollectionInfo();
+    m_info->checkConsistency();
 
     for (Element* e = itemAfter(m_info->current); e; e = itemAfter(e)) {
         if (checkForNameMatch(e, m_idsDone, name)) {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl b/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl
index 45d1127a2e..a3e4332609 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl
@@ -21,14 +21,11 @@
 module html {
 
     interface [
-        GenerateConstructor,
         HasIndexGetter,
         HasNameGetter,
         CustomCall,
         CustomToJS,
-        Polymorphic,
-        InterfaceUUID=b0d215ff-6f9c-4d1f-86c3-f200a65a5134,
-        ImplementationUUID=8e81b17f-7f74-4121-8f2f-a339a7e66447
+        Polymorphic
     ] HTMLCollection {
         readonly attribute unsigned long length;
         [Custom] Node item(in unsigned long index);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDListElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDListElement.idl
index 1578dfd349..57c5c57967 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDListElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDListElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=5665c589-aea9-4322-844f-d3395fd5839e,
-        ImplementationUUID=99ac26a3-224b-4bc6-b287-89946a6de9a7
-    ] HTMLDListElement : HTMLElement {
+    interface HTMLDListElement : HTMLElement {
         attribute boolean compact;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.idl
index c7c51bcc7d..1064cf738a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.idl
@@ -26,7 +26,6 @@
 module html {
 
     interface [
-        GenerateConstructor,
         Conditional=DATAGRID
     ] HTMLDataGridCellElement : HTMLElement {
         attribute DOMString label; // The text to display in the column, assuming the type supports text.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.cpp
index 8398545e63..935375ec10 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.cpp
@@ -55,7 +55,7 @@ void HTMLDataGridColElement::ensureColumn()
 {
     if (m_column)
         return;
-    m_column = DataGridColumn::create(getAttribute(idAttr), label(), type(), primary(), sortable());
+    m_column = DataGridColumn::create(getAttribute(idAttributeName()), label(), type(), primary(), sortable());
 }
 
 void HTMLDataGridColElement::insertedIntoTree(bool deep)
@@ -162,8 +162,8 @@ void HTMLDataGridColElement::parseMappedAttribute(MappedAttribute* attr)
         column()->setSortable(sortable());
     else if (attr->name() == sortdirectionAttr)
         column()->setSortDirection(sortDirection());
-    else if (attr->name() == idAttr)
-        column()->setId(getAttribute(idAttr));
+    else if (attr->name() == idAttributeName())
+        column()->setId(getAttribute(idAttributeName()));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.idl
index 5861039982..7a67c7e0a3 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.idl
@@ -26,7 +26,6 @@
 module html {
 
     interface [
-        GenerateConstructor,
         Conditional=DATAGRID
     ] HTMLDataGridColElement : HTMLElement {
         attribute DOMString label; // The text to display in the column.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.idl
index c9e6d9d6f4..e9a800b376 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.idl
@@ -26,7 +26,6 @@
 module html {
 
     interface [
-        GenerateConstructor,
         Conditional=DATAGRID
     ] HTMLDataGridElement : HTMLElement {
         attribute [Custom] DataGridDataSource dataSource;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.idl
index f6954afcec..7b3e68ff6b 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.idl
@@ -26,7 +26,6 @@
 module html {
 
     interface [
-        GenerateConstructor,
         Conditional=DATAGRID
     ] HTMLDataGridRowElement : HTMLElement {
         attribute boolean selected; // Whether or not the row is currently selected.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataListElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataListElement.idl
index 916c0a1cd0..a971fa75ba 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataListElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataListElement.idl
@@ -30,7 +30,6 @@
 
 module html {
     interface [
-        GenerateConstructor,
         Conditional=DATALIST
     ] HTMLDataListElement : HTMLElement {
         readonly attribute HTMLCollection options;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDirectoryElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDirectoryElement.idl
index 308e30d991..c88e2e051c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDirectoryElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDirectoryElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=49292c6b-2b2e-49cb-98b6-20d4cd806bd2,
-        ImplementationUUID=45749798-4afe-4884-a42a-a2c8b3d98795
-    ] HTMLDirectoryElement : HTMLElement {
+    interface HTMLDirectoryElement : HTMLElement {
         attribute boolean compact;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDivElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDivElement.idl
index 41cc327942..9f0b581858 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDivElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDivElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=46fb9095-b485-4925-b6fd-2622935fd8bf,
-        ImplementationUUID=5f8661b7-96ad-4a8b-864a-85d544319fd2
-    ] HTMLDivElement : HTMLElement {
+    interface HTMLDivElement : HTMLElement {
         attribute [ConvertNullToNullString] DOMString align;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
index 0d1cb19bac..9f3ddf86d1 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
@@ -80,7 +80,7 @@ namespace WebCore {
 using namespace HTMLNames;
 
 HTMLDocument::HTMLDocument(Frame* frame)
-    : Document(frame, false)
+    : Document(frame, false, true)
 {
     clearXMLVersion();
     setParseMode(Compat);
@@ -398,8 +398,11 @@ void HTMLDocument::determineParseMode()
         }
     }
     
-    if (inCompatMode() != wasInCompatMode)
+    if (inCompatMode() != wasInCompatMode) {
+        clearPageUserSheet();
+        clearPageGroupUserSheets();
         updateStyleSelector();
+    }
 }
 
 void HTMLDocument::clear()
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDocument.h b/src/3rdparty/webkit/WebCore/html/HTMLDocument.h
index 4b14d0c9e2..6d89abbbeb 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDocument.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDocument.h
@@ -87,7 +87,6 @@ private:
 
     virtual PassRefPtr<Element> createElement(const AtomicString& tagName, ExceptionCode&);
 
-    virtual bool isHTMLDocument() const { return true; }
     virtual bool isFrameSet() const;
     virtual Tokenizer* createTokenizer();
     virtual void determineParseMode();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl b/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl
index d2507415df..a79b9135dd 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl
@@ -21,10 +21,7 @@
 module html {
 
     interface [
-        GenerateConstructor,
-        HasOverridingNameGetter,
-        InterfaceUUID=a183339c-8d74-412a-933d-6f6a4ad6266e,
-        ImplementationUUID=d0f7d966-033c-4cbf-847c-1461dacc2f6a
+        HasOverridingNameGetter
     ] HTMLDocument : Document {
         [Custom] void open();
         void close();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
index df3cb7db14..816bb60ec4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
@@ -82,19 +82,49 @@ HTMLTagStatus HTMLElement::endTagRequirement() const
     return TagStatusRequired;
 }
 
-int HTMLElement::tagPriority() const
+struct Empty1IntHashTraits : HashTraits<int> {
+    static const bool emptyValueIsZero = false;
+    static int emptyValue() { return 1; }
+};
+typedef HashMap<AtomicStringImpl*, int, DefaultHash<AtomicStringImpl*>::Hash, HashTraits<AtomicStringImpl*>, Empty1IntHashTraits> TagPriorityMap;
+
+static const TagPriorityMap* createTagPriorityMap()
 {
-    if (hasLocalName(wbrTag))
-        return 0;
-    if (hasLocalName(addressTag) || hasLocalName(ddTag) || hasLocalName(dtTag) || hasLocalName(noscriptTag) || hasLocalName(rpTag) || hasLocalName(rtTag))
-        return 3;
-    if (hasLocalName(centerTag) || hasLocalName(nobrTag) || hasLocalName(rubyTag) || hasLocalName(navTag))
-        return 5;
-    if (hasLocalName(noembedTag) || hasLocalName(noframesTag))
-        return 10;
+    TagPriorityMap* map = new TagPriorityMap;
 
-    // Same values as <span>.  This way custom tag name elements will behave like inline spans.
-    return 1;
+    map->add(wbrTag.localName().impl(), 0);
+
+    map->add(addressTag.localName().impl(), 3);
+    map->add(ddTag.localName().impl(), 3);
+    map->add(dtTag.localName().impl(), 3);
+    map->add(noscriptTag.localName().impl(), 3);
+    map->add(rpTag.localName().impl(), 3);
+    map->add(rtTag.localName().impl(), 3);
+
+    // 5 is same as <div>'s priority.
+    map->add(articleTag.localName().impl(), 5);
+    map->add(asideTag.localName().impl(), 5);
+    map->add(centerTag.localName().impl(), 5);
+    map->add(footerTag.localName().impl(), 5);
+    map->add(headerTag.localName().impl(), 5);
+    map->add(hgroupTag.localName().impl(), 5);
+    map->add(nobrTag.localName().impl(), 5);
+    map->add(rubyTag.localName().impl(), 5);
+    map->add(navTag.localName().impl(), 5);
+    map->add(sectionTag.localName().impl(), 5);
+
+    map->add(noembedTag.localName().impl(), 10);
+    map->add(noframesTag.localName().impl(), 10);
+
+    // TagPriorityMap returns 1 for unregistered tags. It's same as <span>.
+    // This way custom tag name elements will behave like inline spans.
+    return map;
+}
+
+int HTMLElement::tagPriority() const
+{
+    static const TagPriorityMap* tagPriorityMap = createTagPriorityMap();
+    return tagPriorityMap->get(localName().impl());
 }
 
 bool HTMLElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
@@ -114,7 +144,7 @@ bool HTMLElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry
     
 void HTMLElement::parseMappedAttribute(MappedAttribute *attr)
 {
-    if (attr->name() == idAttr || attr->name() == classAttr || attr->name() == styleAttr)
+    if (attr->name() == idAttributeName() || attr->name() == classAttr || attr->name() == styleAttr)
         return StyledElement::parseMappedAttribute(attr);
 
     String indexstring;
@@ -168,6 +198,10 @@ void HTMLElement::parseMappedAttribute(MappedAttribute *attr)
         setAttributeEventListener(eventNames().mousewheelEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onfocusAttr) {
         setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
+    } else if (attr->name() == onfocusinAttr) {
+        setAttributeEventListener(eventNames().focusinEvent, createAttributeEventListener(this, attr));
+    } else if (attr->name() == onfocusoutAttr) {
+        setAttributeEventListener(eventNames().focusoutEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onblurAttr) {
         setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onkeydownAttr) {
@@ -222,6 +256,14 @@ void HTMLElement::parseMappedAttribute(MappedAttribute *attr)
         setAttributeEventListener(eventNames().inputEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == oninvalidAttr) {
         setAttributeEventListener(eventNames().invalidEvent, createAttributeEventListener(this, attr));
+    } else if (attr->name() == ontouchstartAttr) {
+        setAttributeEventListener(eventNames().touchstartEvent, createAttributeEventListener(this, attr));
+    } else if (attr->name() == ontouchmoveAttr) {
+        setAttributeEventListener(eventNames().touchmoveEvent, createAttributeEventListener(this, attr));
+    } else if (attr->name() == ontouchendAttr) {
+        setAttributeEventListener(eventNames().touchendEvent, createAttributeEventListener(this, attr));
+    } else if (attr->name() == ontouchcancelAttr) {
+        setAttributeEventListener(eventNames().touchcancelEvent, createAttributeEventListener(this, attr));
     }
 }
 
@@ -235,9 +277,9 @@ String HTMLElement::outerHTML() const
     return createMarkup(this);
 }
 
-PassRefPtr<DocumentFragment> HTMLElement::createContextualFragment(const String &html)
+PassRefPtr<DocumentFragment> HTMLElement::createContextualFragment(const String& markup, FragmentScriptingPermission scriptingPermission)
 {
-    // the following is in accordance with the definition as used by IE
+    // The following is in accordance with the definition as used by IE.
     if (endTagRequirement() == TagStatusForbidden)
         return 0;
 
@@ -245,47 +287,7 @@ PassRefPtr<DocumentFragment> HTMLElement::createContextualFragment(const String
         hasLocalName(headTag) || hasLocalName(styleTag) || hasLocalName(titleTag))
         return 0;
 
-    RefPtr<DocumentFragment> fragment = DocumentFragment::create(document());
-    
-    if (document()->isHTMLDocument())
-         parseHTMLDocumentFragment(html, fragment.get());
-    else {
-        if (!parseXMLDocumentFragment(html, fragment.get(), this))
-            // FIXME: We should propagate a syntax error exception out here.
-            return 0;
-    }
-
-    // Exceptions are ignored because none ought to happen here.
-    int ignoredExceptionCode;
-
-    // we need to pop <html> and <body> elements and remove <head> to
-    // accommodate folks passing complete HTML documents to make the
-    // child of an element.
-
-    RefPtr<Node> nextNode;
-    for (RefPtr<Node> node = fragment->firstChild(); node; node = nextNode) {
-        nextNode = node->nextSibling();
-        if (node->hasTagName(htmlTag) || node->hasTagName(bodyTag)) {
-            Node *firstChild = node->firstChild();
-            if (firstChild)
-                nextNode = firstChild;
-            RefPtr<Node> nextChild;
-            for (RefPtr<Node> child = firstChild; child; child = nextChild) {
-                nextChild = child->nextSibling();
-                node->removeChild(child.get(), ignoredExceptionCode);
-                ASSERT(!ignoredExceptionCode);
-                fragment->insertBefore(child, node.get(), ignoredExceptionCode);
-                ASSERT(!ignoredExceptionCode);
-            }
-            fragment->removeChild(node.get(), ignoredExceptionCode);
-            ASSERT(!ignoredExceptionCode);
-        } else if (node->hasTagName(headTag)) {
-            fragment->removeChild(node.get(), ignoredExceptionCode);
-            ASSERT(!ignoredExceptionCode);
-        }
-    }
-
-    return fragment.release();
+    return Element::createContextualFragment(markup, scriptingPermission);
 }
 
 static inline bool hasOneChild(ContainerNode* node)
@@ -340,6 +342,13 @@ static void replaceChildrenWithText(HTMLElement* element, const String& text, Ex
 
 void HTMLElement::setInnerHTML(const String& html, ExceptionCode& ec)
 {
+    if (hasLocalName(scriptTag) || hasLocalName(styleTag)) {
+        // Script and CSS source shouldn't be parsed as HTML.
+        removeChildren();
+        appendChild(document()->createTextNode(html), ec);
+        return;
+    }
+
     RefPtr<DocumentFragment> fragment = createContextualFragment(html);
     if (!fragment) {
         ec = NO_MODIFICATION_ALLOWED_ERR;
@@ -371,7 +380,7 @@ void HTMLElement::setOuterHTML(const String& html, ExceptionCode& ec)
 
 void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
 {
-    // follow the IE specs about when this is allowed
+    // Follow the IE specs about when this is allowed.
     if (endTagRequirement() == TagStatusForbidden) {
         ec = NO_MODIFICATION_ALLOWED_ERR;
         return;
@@ -441,7 +450,7 @@ void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
 
 void HTMLElement::setOuterText(const String &text, ExceptionCode& ec)
 {
-    // follow the IE specs about when this is allowed
+    // Follow the IE specs about when this is allowed.
     if (endTagRequirement() == TagStatusForbidden) {
         ec = NO_MODIFICATION_ALLOWED_ERR;
         return;
@@ -469,7 +478,7 @@ void HTMLElement::setOuterText(const String &text, ExceptionCode& ec)
     if (ec)
         return;
 
-    // is previous node a text node? if so, merge into it
+    // Is previous node a text node? If so, merge into it.
     Node* prev = t->previousSibling();
     if (prev && prev->isTextNode()) {
         Text* textPrev = static_cast<Text*>(prev);
@@ -482,7 +491,7 @@ void HTMLElement::setOuterText(const String &text, ExceptionCode& ec)
         t = textPrev;
     }
 
-    // is next node a text node? if so, merge it in
+    // Is next node a text node? If so, merge it in.
     Node* next = t->nextSibling();
     if (next && next->isTextNode()) {
         Text* textNext = static_cast<Text*>(next);
@@ -522,7 +531,7 @@ Node* HTMLElement::insertAdjacent(const String& where, Node* newChild, Exception
         return 0;
     }
     
-    // IE throws COM Exception E_INVALIDARG; this is the best DOM exception alternative
+    // IE throws COM Exception E_INVALIDARG; this is the best DOM exception alternative.
     ec = NOT_SUPPORTED_ERR;
     return 0;
 }
@@ -530,7 +539,7 @@ Node* HTMLElement::insertAdjacent(const String& where, Node* newChild, Exception
 Element* HTMLElement::insertAdjacentElement(const String& where, Element* newChild, ExceptionCode& ec)
 {
     if (!newChild) {
-        // IE throws COM Exception E_INVALIDARG; this is the best DOM exception alternative
+        // IE throws COM Exception E_INVALIDARG; this is the best DOM exception alternative.
         ec = TYPE_MISMATCH_ERR;
         return 0;
     }
@@ -567,8 +576,8 @@ void HTMLElement::addHTMLAlignment(MappedAttribute* attr)
 
 void HTMLElement::addHTMLAlignmentToStyledElement(StyledElement* element, MappedAttribute* attr)
 {
-    // vertical alignment with respect to the current baseline of the text
-    // right or left means floating images
+    // Vertical alignment with respect to the current baseline of the text
+    // right or left means floating images.
     int floatValue = CSSValueInvalid;
     int verticalAlignValue = CSSValueInvalid;
 
@@ -849,6 +858,9 @@ static HashSet<AtomicStringImpl*>* inlineTagList()
         tagList.add(rpTag.localName().impl());
         tagList.add(rtTag.localName().impl());
         tagList.add(rubyTag.localName().impl());
+#if ENABLE(PROGRESS_TAG)
+        tagList.add(progressTag.localName().impl());
+#endif
     }
     return &tagList;
 }
@@ -858,6 +870,8 @@ static HashSet<AtomicStringImpl*>* blockTagList()
     DEFINE_STATIC_LOCAL(HashSet<AtomicStringImpl*>, tagList, ());
     if (tagList.isEmpty()) {
         tagList.add(addressTag.localName().impl());
+        tagList.add(articleTag.localName().impl());
+        tagList.add(asideTag.localName().impl());
         tagList.add(blockquoteTag.localName().impl());
         tagList.add(centerTag.localName().impl());
         tagList.add(ddTag.localName().impl());
@@ -866,6 +880,7 @@ static HashSet<AtomicStringImpl*>* blockTagList()
         tagList.add(dlTag.localName().impl());
         tagList.add(dtTag.localName().impl());
         tagList.add(fieldsetTag.localName().impl());
+        tagList.add(footerTag.localName().impl());
         tagList.add(formTag.localName().impl());
         tagList.add(h1Tag.localName().impl());
         tagList.add(h2Tag.localName().impl());
@@ -873,6 +888,8 @@ static HashSet<AtomicStringImpl*>* blockTagList()
         tagList.add(h4Tag.localName().impl());
         tagList.add(h5Tag.localName().impl());
         tagList.add(h6Tag.localName().impl());
+        tagList.add(headerTag.localName().impl());
+        tagList.add(hgroupTag.localName().impl());
         tagList.add(hrTag.localName().impl());
         tagList.add(isindexTag.localName().impl());
         tagList.add(layerTag.localName().impl());
@@ -889,6 +906,7 @@ static HashSet<AtomicStringImpl*>* blockTagList()
         tagList.add(pTag.localName().impl());
         tagList.add(plaintextTag.localName().impl());
         tagList.add(preTag.localName().impl());
+        tagList.add(sectionTag.localName().impl());
         tagList.add(tableTag.localName().impl());
         tagList.add(ulTag.localName().impl());
         tagList.add(xmpTag.localName().impl());
@@ -962,8 +980,8 @@ bool HTMLElement::rendererIsNeeded(RenderStyle *style)
 {
 #if !ENABLE(XHTMLMP)
     if (hasLocalName(noscriptTag)) {
-        Settings* settings = document()->settings();
-        if (settings && settings->isJavaScriptEnabled())
+        Frame* frame = document()->frame();
+        if (frame && frame->script()->canExecuteScripts(NotAboutToExecuteScript))
             return false;
     }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElement.h b/src/3rdparty/webkit/WebCore/html/HTMLElement.h
index c6a384b6fa..ccc9aa3de6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElement.h
@@ -46,7 +46,7 @@ public:
 
     String innerHTML() const;
     String outerHTML() const;
-    PassRefPtr<DocumentFragment> createContextualFragment(const String&);
+    PassRefPtr<DocumentFragment> createContextualFragment(const String&, FragmentScriptingPermission = FragmentScriptingAllowed);
     void setInnerHTML(const String&, ExceptionCode&);
     void setOuterHTML(const String&, ExceptionCode&);
     void setInnerText(const String&, ExceptionCode&);
@@ -116,6 +116,7 @@ private:
 inline HTMLElement::HTMLElement(const QualifiedName& tagName, Document* document, ConstructionType type)
     : StyledElement(tagName, document, type)
 {
+    ASSERT(tagName.localName().impl());
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLElement.idl
index 6b9e1d0f0d..627dda233e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElement.idl
@@ -21,11 +21,8 @@
 module html {
 
     interface [
-        GenerateConstructor,
         GenerateNativeConverter,
-        CustomPushEventHandlerScope,
-        InterfaceUUID=b2f172f1-d209-446f-8143-5f21de678f95,
-        ImplementationUUID=c81b0e16-a2b9-448b-ad0a-81c9346d6f8a
+        CustomPushEventHandlerScope
     ] HTMLElement : Element {
                  // iht.com relies on id returning the empty string when no id is present. 
                  // Other browsers do this as well. So we don't convert null to JS null.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElementsAllInOne.cpp b/src/3rdparty/webkit/WebCore/html/HTMLElementsAllInOne.cpp
index f9c970a519..4cee9278d6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLElementsAllInOne.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElementsAllInOne.cpp
@@ -87,6 +87,7 @@
 #include "HTMLPlugInElement.cpp"
 #include "HTMLPlugInImageElement.cpp"
 #include "HTMLPreElement.cpp"
+#include "HTMLProgressElement.cpp"
 #include "HTMLQuoteElement.cpp"
 #include "HTMLScriptElement.cpp"
 #include "HTMLSelectElement.cpp"
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp
index 81b88a4f4d..eba980cfd6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp
@@ -32,8 +32,8 @@
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
 #include "MappedAttribute.h"
+#include "RenderEmbeddedObject.h"
 #include "RenderImage.h"
-#include "RenderPartObject.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
 #include "Settings.h"
@@ -69,12 +69,8 @@ static inline RenderWidget* findWidgetRenderer(const Node* n)
 
 RenderWidget* HTMLEmbedElement::renderWidgetForJSBindings() const
 {
-    RenderWidget* renderWidget = findWidgetRenderer(this);
-    if (renderWidget && !renderWidget->widget()) {
-        document()->updateLayoutIgnorePendingStylesheets();
-        renderWidget = findWidgetRenderer(this);
-    }
-    return renderWidget;
+    document()->updateLayoutIgnorePendingStylesheets();
+    return findWidgetRenderer(this);
 }
 
 bool HTMLEmbedElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
@@ -155,7 +151,7 @@ RenderObject* HTMLEmbedElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     if (isImageType())
         return new (arena) RenderImage(this);
-    return new (arena) RenderPartObject(this);
+    return new (arena) RenderEmbeddedObject(this);
 }
 
 void HTMLEmbedElement::attach()
@@ -183,7 +179,7 @@ void HTMLEmbedElement::updateWidget()
 {
     document()->updateStyleIfNeeded();
     if (m_needWidgetUpdate && renderer() && !isImageType())
-        toRenderPartObject(renderer())->updateWidget(true);
+        toRenderEmbeddedObject(renderer())->updateWidget(true);
 }
 
 void HTMLEmbedElement::insertedIntoDocument()
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl
index 05c10dbabd..576bca921e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl
@@ -21,13 +21,9 @@
 module html {
 
     interface [
-        GenerateConstructor,
         DelegatingPutFunction,
         DelegatingGetOwnPropertySlot,
-        CustomCall,
-        HasOverridingNameGetter,
-        InterfaceUUID=18f9bd58-6bb3-4b5c-aa30-6da13adfc91e,
-        ImplementationUUID=93e0407a-8380-4ff0-978d-f773f2dee6a3
+        CustomCall
     ] HTMLEmbedElement : HTMLElement {
                  attribute [ConvertNullToNullString, Reflect] DOMString align;
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
@@ -44,14 +40,12 @@ module html {
                  attribute [ConvertFromString] long width;
 #endif
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
 #if defined(ENABLE_SVG) && ENABLE_SVG
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
         [SVGCheckSecurityDocument] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
-#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h
index 09003170f3..457fe93e71 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h
@@ -47,8 +47,8 @@ public:
     virtual bool supportsFocus() const;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual const AtomicString& formControlType() const;
-
-    virtual bool willValidate() const { return false; }
+private:
+    virtual bool recalcWillValidate() const { return false; }
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.idl
index ca8563b295..8cffe3db04 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.idl
@@ -19,16 +19,11 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=cf9e4c4c-a1c9-4740-ad6c-6e5ea94a51a5,
-        ImplementationUUID=93573758-96db-415d-9bdc-ee7238604094
-    ] HTMLFieldSetElement : HTMLElement {
+    interface HTMLFieldSetElement : HTMLElement {
         readonly attribute HTMLFormElement form;
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute ValidityState   validity;
-#endif
         readonly attribute boolean         willValidate;
+        readonly attribute DOMString       validationMessage;
         boolean  checkValidity();
         void     setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
     };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFontElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLFontElement.idl
index cb9cbbee89..fa7d9083ee 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFontElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFontElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=f6a11dbe-7f40-49dc-a304-7997b25b2cb9,
-        ImplementationUUID=a37453b9-f7ba-4896-8e91-37d1ecc5b7ce
-    ] HTMLFontElement : HTMLElement {
+    interface HTMLFontElement : HTMLElement {
         attribute [ConvertNullToNullString] DOMString color;
         attribute [ConvertNullToNullString] DOMString face;
         attribute [ConvertNullToNullString] DOMString size;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.cpp
index 812d98a428..65c48fe3ce 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.cpp
@@ -110,7 +110,8 @@ Element* HTMLFormCollection::getNamedFormItem(const QualifiedName& attrName, con
     bool foundInputElements = false;
     for (unsigned i = 0; i < form->formElements.size(); ++i) {
         HTMLFormControlElement* e = form->formElements[i];
-        if (e->isEnumeratable() && e->getAttribute(attrName) == name) {
+        const QualifiedName& attributeName = (attrName == idAttr) ? e->idAttributeName() : attrName;
+        if (e->isEnumeratable() && e->getAttribute(attributeName) == name) {
             foundInputElements = true;
             if (!duplicateNumber)
                 return e;
@@ -121,7 +122,8 @@ Element* HTMLFormCollection::getNamedFormItem(const QualifiedName& attrName, con
     if (!foundInputElements) {
         for (unsigned i = 0; i < form->imgElements.size(); ++i) {
             HTMLImageElement* e = form->imgElements[i];
-            if (e->getAttribute(attrName) == name) {
+            const QualifiedName& attributeName = (attrName == idAttr) ? e->idAttributeName() : attrName;
+            if (e->getAttribute(attributeName) == name) {
                 if (!duplicateNumber)
                     return e;
                 --duplicateNumber;
@@ -171,10 +173,10 @@ Node* HTMLFormCollection::nextNamedItem(const AtomicString& name) const
     // The nextNamedItemInternal function can return the same item twice if it has
     // both an id and name that are equal to the name parameter. So this function
     // checks if we are on the nameAttr half of the iteration and skips over any
-    // that also have the same idAttr.
+    // that also have the same idAttributeName.
     Element* impl = nextNamedItemInternal(name);
     if (m_idsDone)
-        while (impl && impl->getAttribute(idAttr) == name)
+        while (impl && impl->getAttribute(impl->idAttributeName()) == name)
             impl = nextNamedItemInternal(name);
     return impl;
 }
@@ -191,7 +193,7 @@ void HTMLFormCollection::updateNameCache() const
     for (unsigned i = 0; i < f->formElements.size(); ++i) {
         HTMLFormControlElement* e = f->formElements[i];
         if (e->isEnumeratable()) {
-            const AtomicString& idAttrVal = e->getAttribute(idAttr);
+            const AtomicString& idAttrVal = e->getAttribute(e->idAttributeName());
             const AtomicString& nameAttrVal = e->getAttribute(nameAttr);
             if (!idAttrVal.isEmpty()) {
                 // add to id cache
@@ -218,7 +220,7 @@ void HTMLFormCollection::updateNameCache() const
 
     for (unsigned i = 0; i < f->imgElements.size(); ++i) {
         HTMLImageElement* e = f->imgElements[i];
-        const AtomicString& idAttrVal = e->getAttribute(idAttr);
+        const AtomicString& idAttrVal = e->getAttribute(e->idAttributeName());
         const AtomicString& nameAttrVal = e->getAttribute(nameAttr);
         if (!idAttrVal.isEmpty() && !foundInputElements.contains(idAttrVal.impl())) {
             // add to id cache
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
index ea46980cb6..82c1ad92ed 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
@@ -25,6 +25,7 @@
 #include "config.h"
 #include "HTMLFormControlElement.h"
 
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "Document.h"
 #include "Event.h"
@@ -48,13 +49,16 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLFormControlElement::HTMLFormControlElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
-    : HTMLElement(tagName, doc)
+HTMLFormControlElement::HTMLFormControlElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f, ConstructionType constructionType)
+    : HTMLElement(tagName, doc, constructionType)
     , m_form(f)
+    , m_hasName(false)
     , m_disabled(false)
     , m_readOnly(false)
     , m_required(false)
     , m_valueMatchesRenderer(false)
+    , m_willValidate(false)
+    , m_isValid(true)
 {
     if (!m_form)
         m_form = findFormAncestor();
@@ -89,7 +93,7 @@ ValidityState* HTMLFormControlElement::validity()
 void HTMLFormControlElement::parseMappedAttribute(MappedAttribute *attr)
 {
     if (attr->name() == nameAttr)
-        setNeedsStyleRecalc();
+        m_hasName = !attr->isEmpty();
     else if (attr->name() == disabledAttr) {
         bool oldDisabled = m_disabled;
         m_disabled = !attr->isNull();
@@ -109,10 +113,13 @@ void HTMLFormControlElement::parseMappedAttribute(MappedAttribute *attr)
     } else if (attr->name() == requiredAttr) {
         bool oldRequired = m_required;
         m_required = !attr->isNull();
-        if (oldRequired != m_required)
-            setNeedsStyleRecalc();
+        if (oldRequired != m_required) {
+            setNeedsValidityCheck();
+            setNeedsStyleRecalc(); // Updates for :required :optional classes.
+        }
     } else
         HTMLElement::parseMappedAttribute(attr);
+    setNeedsWillValidateCheck();
 }
 
 void HTMLFormControlElement::attach()
@@ -148,9 +155,10 @@ void HTMLFormControlElement::insertedIntoTree(bool deep)
         // setting a form, we will already have a non-null value for m_form, 
         // and so we don't need to do anything.
         m_form = findFormAncestor();
-        if (m_form)
+        if (m_form) {
             m_form->registerFormElement(this);
-        else
+            setNeedsWillValidateCheck();
+        } else
             document()->checkedRadioButtons().addButton(this);
     }
 
@@ -177,11 +185,19 @@ void HTMLFormControlElement::removedFromTree(bool deep)
     if (m_form && !(parser && parser->isHandlingResidualStyleAcrossBlocks()) && findRoot(this) != findRoot(m_form)) {
         m_form->removeFormElement(this);
         m_form = 0;
+        setNeedsWillValidateCheck();
     }
 
     HTMLElement::removedFromTree(deep);
 }
 
+void HTMLFormControlElement::formDestroyed()
+{
+    if (m_form)
+        setNeedsWillValidateCheck();
+    m_form = 0;
+}
+
 const AtomicString& HTMLFormControlElement::formControlName() const
 {
     const AtomicString& n = getAttribute(nameAttr);
@@ -198,11 +214,6 @@ void HTMLFormControlElement::dispatchFormControlChangeEvent()
     dispatchEvent(Event::create(eventNames().changeEvent, true, false));
 }
 
-bool HTMLFormControlElement::disabled() const
-{
-    return m_disabled;
-}
-
 void HTMLFormControlElement::setDisabled(bool b)
 {
     setAttribute(disabledAttr, b ? "" : 0);
@@ -233,12 +244,23 @@ void HTMLFormControlElement::setRequired(bool b)
     setAttribute(requiredAttr, b ? "required" : 0);
 }
 
+static void updateFromElementCallback(Node* node)
+{
+    ASSERT_ARG(node, node->isElementNode());
+    ASSERT_ARG(node, static_cast<Element*>(node)->isFormControlElement());
+    ASSERT(node->renderer());
+    if (RenderObject* renderer = node->renderer())
+        renderer->updateFromElement();
+}
+
 void HTMLFormControlElement::recalcStyle(StyleChange change)
 {
     HTMLElement::recalcStyle(change);
 
+    // updateFromElement() can cause the selection to change, and in turn
+    // trigger synchronous layout, so it must not be called during style recalc.
     if (renderer())
-        renderer()->updateFromElement();
+        queuePostAttachCallback(updateFromElementCallback, this);
 }
 
 bool HTMLFormControlElement::supportsFocus() const
@@ -279,31 +301,63 @@ short HTMLFormControlElement::tabIndex() const
     return Element::tabIndex();
 }
 
+bool HTMLFormControlElement::recalcWillValidate() const
+{
+    // FIXME: Check if the control does not have a datalist element as an ancestor.
+    return m_form && m_hasName && !m_disabled && !m_readOnly;
+}
+
 bool HTMLFormControlElement::willValidate() const
 {
-    // FIXME: Implementation shall be completed with these checks:
-    //      The control does not have a repetition template as an ancestor.
-    //      The control does not have a datalist element as an ancestor.
-    //      The control is not an output element.
-    return form() && !name().isEmpty() && !disabled() && !isReadOnlyFormControl();
+    // If the following assertion fails, setNeedsWillValidateCheck() is not
+    // called correctly when something which changes recalcWillValidate() result
+    // is updated.
+    ASSERT(m_willValidate == recalcWillValidate());
+    return m_willValidate;
+}
+
+void HTMLFormControlElement::setNeedsWillValidateCheck()
+{
+    bool newWillValidate = recalcWillValidate();
+    if (m_willValidate == newWillValidate)
+        return;
+    m_willValidate = newWillValidate;
+    setNeedsStyleRecalc();
+    // FIXME: Show/hide a validation message.
+}
+
+String HTMLFormControlElement::validationMessage()
+{
+    return validity()->validationMessage();
 }
 
 bool HTMLFormControlElement::checkValidity()
 {
     if (willValidate() && !isValidFormControlElement()) {
-        dispatchEvent(Event::create(EventNames().invalidEvent, false, true));
+        dispatchEvent(Event::create(eventNames().invalidEvent, false, true));
         return false;
     }
 
     return true;
 }
 
-void HTMLFormControlElement::updateValidity()
+bool HTMLFormControlElement::isValidFormControlElement()
+{
+    // If the following assertion fails, setNeedsValidityCheck() is not called
+    // correctly when something which changes validity is updated.
+    ASSERT(m_isValid == validity()->valid());
+    return m_isValid;
+}
+
+void HTMLFormControlElement::setNeedsValidityCheck()
 {
-    if (willValidate()) {
+    bool newIsValid = validity()->valid();
+    if (willValidate() && newIsValid != m_isValid) {
         // Update style for pseudo classes such as :valid :invalid.
         setNeedsStyleRecalc();
     }
+    m_isValid = newIsValid;
+    // FIXME: show/hide a validation message.
 }
 
 void HTMLFormControlElement::setCustomValidity(const String& error)
@@ -337,11 +391,6 @@ bool HTMLFormControlElement::isDefaultButtonForForm() const
     return isSuccessfulSubmitButton() && m_form && m_form->defaultButton() == this;
 }
 
-bool HTMLFormControlElement::isValidFormControlElement()
-{
-    return validity()->valid();
-}
-
 void HTMLFormControlElement::removeFromForm()
 {
     if (!m_form)
@@ -488,10 +537,6 @@ void HTMLTextFormControlElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == placeholderAttr)
         updatePlaceholderVisibility(true);
-    else if (attr->name() == onfocusAttr)
-        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onblurAttr)
-        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onselectAttr)
         setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onchangeAttr)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
index b5dc7ceda6..9b6c943027 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
@@ -36,14 +36,14 @@ class VisibleSelection;
 
 class HTMLFormControlElement : public HTMLElement {
 public:
-    HTMLFormControlElement(const QualifiedName& tagName, Document*, HTMLFormElement*);
+    HTMLFormControlElement(const QualifiedName& tagName, Document*, HTMLFormElement*, ConstructionType = CreateElementZeroRefCount);
     virtual ~HTMLFormControlElement();
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
     virtual int tagPriority() const { return 1; }
 
     HTMLFormElement* form() const { return m_form; }
-    virtual ValidityState* validity();
+    ValidityState* validity();
 
     bool formNoValidate() const;
     void setFormNoValidate(bool);
@@ -63,7 +63,7 @@ public:
 
     virtual void dispatchFormControlChangeEvent();
 
-    bool disabled() const;
+    bool disabled() const { return m_disabled; }
     void setDisabled(bool);
 
     virtual bool supportsFocus() const;
@@ -106,21 +106,26 @@ public:
 
     virtual short tabIndex() const;
 
-    virtual bool willValidate() const;
+    bool willValidate() const;
+    String validationMessage();
     bool checkValidity();
-    void updateValidity();
+    // This must be called when a validation constraint or control value is changed.
+    void setNeedsValidityCheck();
     void setCustomValidity(const String&);
     virtual bool valueMissing() const { return false; }
     virtual bool patternMismatch() const { return false; }
     virtual bool tooLong() const { return false; }
 
-    void formDestroyed() { m_form = 0; }
+    void formDestroyed();
 
     virtual void dispatchFocusEvent();
     virtual void dispatchBlurEvent();
 
 protected:
     void removeFromForm();
+    // This must be called any time the result of willValidate() has changed.
+    void setNeedsWillValidateCheck();
+    virtual bool recalcWillValidate() const;
 
 private:
     virtual HTMLFormElement* virtualForm() const;
@@ -128,11 +133,16 @@ private:
     virtual bool isValidFormControlElement();
 
     HTMLFormElement* m_form;
-    RefPtr<ValidityState> m_validityState;
+    OwnPtr<ValidityState> m_validityState;
+    bool m_hasName : 1;
     bool m_disabled : 1;
     bool m_readOnly : 1;
     bool m_required : 1;
     bool m_valueMatchesRenderer : 1;
+    bool m_willValidate : 1;
+    // Cache of validity()->valid().
+    // "candidate for constraint validation" doesn't affect to m_isValid.
+    bool m_isValid : 1;
 };
 
 class HTMLFormControlElementWithState : public HTMLFormControlElement {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
index a74ff83882..bdac28af1c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
@@ -26,7 +26,7 @@
 #include "HTMLFormElement.h"
 
 #include "CSSHelper.h"
-#include "ChromeClient.h"
+#include "DOMFormData.h"
 #include "Document.h"
 #include "Event.h"
 #include "EventNames.h"
@@ -45,7 +45,6 @@
 #include "ScriptEventListener.h"
 #include "MIMETypeRegistry.h"
 #include "MappedAttribute.h"
-#include "Page.h"
 #include "RenderTextControl.h"
 #include "ValidityState.h"
 #include <limits>
@@ -200,83 +199,16 @@ TextEncoding HTMLFormElement::dataEncoding() const
     return m_formDataBuilder.dataEncoding(document());
 }
 
-PassRefPtr<FormData> HTMLFormElement::createFormData(const CString& boundary)
+PassRefPtr<FormData> HTMLFormElement::createFormData()
 {
-    Vector<char> encodedData;
-    TextEncoding encoding = dataEncoding().encodingForFormSubmission();
-
-    RefPtr<FormData> result = FormData::create();
-
+    RefPtr<DOMFormData> domFormData = DOMFormData::create(dataEncoding().encodingForFormSubmission());
     for (unsigned i = 0; i < formElements.size(); ++i) {
         HTMLFormControlElement* control = formElements[i];
-        FormDataList list(encoding);
-
-        if (!control->disabled() && control->appendFormData(list, m_formDataBuilder.isMultiPartForm())) {
-            size_t formDataListSize = list.list().size();
-            ASSERT(formDataListSize % 2 == 0);
-            for (size_t j = 0; j < formDataListSize; j += 2) {
-                const FormDataList::Item& key = list.list()[j];
-                const FormDataList::Item& value = list.list()[j + 1];
-                if (!m_formDataBuilder.isMultiPartForm()) {
-                    // Omit the name "isindex" if it's the first form data element.
-                    // FIXME: Why is this a good rule? Is this obsolete now?
-                    if (encodedData.isEmpty() && key.data() == "isindex")
-                        FormDataBuilder::encodeStringAsFormData(encodedData, value.data());
-                    else
-                        m_formDataBuilder.addKeyValuePairAsFormData(encodedData, key.data(), value.data());
-                } else {
-                    Vector<char> header;
-                    m_formDataBuilder.beginMultiPartHeader(header, boundary, key.data());
-
-                    bool shouldGenerateFile = false;
-                    // if the current type is FILE, then we also need to include the filename
-                    if (value.file()) {
-                        const String& path = value.file()->path();
-                        String fileName = value.file()->fileName();
-
-                        // Let the application specify a filename if it's going to generate a replacement file for the upload.
-                        if (!path.isEmpty()) {
-                            if (Page* page = document()->page()) {
-                                String generatedFileName;
-                                shouldGenerateFile = page->chrome()->client()->shouldReplaceWithGeneratedFileForUpload(path, generatedFileName);
-                                if (shouldGenerateFile)
-                                    fileName = generatedFileName;
-                            }
-                        }
-
-                        // We have to include the filename=".." part in the header, even if the filename is empty
-                        m_formDataBuilder.addFilenameToMultiPartHeader(header, encoding, fileName);
-
-                        if (!fileName.isEmpty()) {
-                            // FIXME: The MIMETypeRegistry function's name makes it sound like it takes a path,
-                            // not just a basename. But filename is not the path. But note that it's not safe to
-                            // just use path instead since in the generated-file case it will not reflect the
-                            // MIME type of the generated file.
-                            String mimeType = MIMETypeRegistry::getMIMETypeForPath(fileName);
-                            if (!mimeType.isEmpty())
-                                m_formDataBuilder.addContentTypeToMultiPartHeader(header, mimeType.latin1());
-                        }
-                    }
-
-                    m_formDataBuilder.finishMultiPartHeader(header);
-
-                    // Append body
-                    result->appendData(header.data(), header.size());
-                    if (size_t dataSize = value.data().length())
-                        result->appendData(value.data().data(), dataSize);
-                    else if (value.file() && !value.file()->path().isEmpty())
-                        result->appendFile(value.file()->path(), shouldGenerateFile);
-
-                    result->appendData("\r\n", 2);
-                }
-            }
-        }
+        if (!control->disabled())
+            control->appendFormData(*domFormData, m_formDataBuilder.isMultiPartForm());
     }
 
-    if (m_formDataBuilder.isMultiPartForm())
-        m_formDataBuilder.addBoundaryToMultiPartHeader(encodedData, boundary, true);
-
-    result->appendData(encodedData.data(), encodedData.size());
+    RefPtr<FormData> result = (m_formDataBuilder.isMultiPartForm()) ? FormData::createMultiPart(*domFormData, document()) : FormData::create(*domFormData);
 
     result->setIdentifier(generateFormDataIdentifier());
     return result;
@@ -302,7 +234,7 @@ bool HTMLFormElement::prepareSubmit(Event* event)
     m_insubmit = false;
 
     if (m_doingsubmit)
-        submit(event, true);
+        submit(event, true, false, NotSubmittedByJavaScript);
 
     return m_doingsubmit;
 }
@@ -329,7 +261,15 @@ static void transferMailtoPostFormDataToURL(RefPtr<FormData>& data, KURL& url, c
     url.setQuery(query);
 }
 
-void HTMLFormElement::submit(Event* event, bool activateSubmitButton, bool lockHistory)
+void HTMLFormElement::submit(Frame* javaScriptActiveFrame)
+{
+    if (javaScriptActiveFrame)
+        submit(0, false, !javaScriptActiveFrame->script()->anyPageIsProcessingUserGesture(), SubmittedByJavaScript);
+    else
+        submit(0, false, false, NotSubmittedByJavaScript);
+}
+
+void HTMLFormElement::submit(Event* event, bool activateSubmitButton, bool lockHistory, FormSubmissionTrigger formSubmissionTrigger)
 {
     FrameView* view = document()->view();
     Frame* frame = document()->frame();
@@ -366,7 +306,7 @@ void HTMLFormElement::submit(Event* event, bool activateSubmitButton, bool lockH
         }
     }
 
-    RefPtr<FormState> formState = FormState::create(this, formValues, frame);
+    RefPtr<FormState> formState = FormState::create(this, formValues, frame, formSubmissionTrigger);
 
     if (needButtonActivation && firstSuccessfulSubmitButton)
         firstSuccessfulSubmitButton->setActivatedSubmit(true);
@@ -380,8 +320,8 @@ void HTMLFormElement::submit(Event* event, bool activateSubmitButton, bool lockH
             ASSERT(!m_formDataBuilder.isMultiPartForm());
         }
 
+        RefPtr<FormData> data = createFormData();
         if (!m_formDataBuilder.isMultiPartForm()) {
-            RefPtr<FormData> data = createFormData(CString());
 
             if (isMailtoForm()) {
                 // Convert the form data into a string that we put into the URL.
@@ -391,13 +331,11 @@ void HTMLFormElement::submit(Event* event, bool activateSubmitButton, bool lockH
             }
 
             frame->loader()->submitForm("POST", m_url, data.release(), m_target, m_formDataBuilder.encodingType(), String(), lockHistory, event, formState.release());
-        } else {
-            Vector<char> boundary = m_formDataBuilder.generateUniqueBoundaryString();
-            frame->loader()->submitForm("POST", m_url, createFormData(boundary.data()), m_target, m_formDataBuilder.encodingType(), boundary.data(), lockHistory, event, formState.release());
-        }
+        } else
+            frame->loader()->submitForm("POST", m_url, data.get(), m_target, m_formDataBuilder.encodingType(), data->boundary().data(), lockHistory, event, formState.release());
     } else {
         m_formDataBuilder.setIsMultiPartForm(false);
-        frame->loader()->submitForm("GET", m_url, createFormData(CString()), m_target, String(), String(), lockHistory, event, formState.release());
+        frame->loader()->submitForm("GET", m_url, createFormData(), m_target, String(), String(), lockHistory, event, formState.release());
     }
 
     if (needButtonActivation && firstSuccessfulSubmitButton)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h
index a2e9585554..44bf628ea7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h
@@ -26,6 +26,7 @@
 
 #include "CheckedRadioButtons.h"
 #include "FormDataBuilder.h"
+#include "FormState.h"
 #include "HTMLElement.h"
 #include <wtf/OwnPtr.h>
 
@@ -78,7 +79,7 @@ public:
     void removeImgElement(HTMLImageElement*);
 
     bool prepareSubmit(Event*);
-    void submit(Event* = 0, bool activateSubmitButton = false, bool lockHistory = false);
+    void submit(Frame* javaScriptActiveFrame = 0);
     void reset();
 
     // Used to indicate a malformed state to keep from applying the bottom margin of the form.
@@ -130,9 +131,11 @@ protected:
     virtual void didMoveToNewOwnerDocument();
 
 private:
+    void submit(Event*, bool activateSubmitButton, bool lockHistory, FormSubmissionTrigger);
+
     bool isMailtoForm() const;
     TextEncoding dataEncoding() const;
-    PassRefPtr<FormData> createFormData(const CString& boundary);
+    PassRefPtr<FormData> createFormData();
     unsigned formElementIndex(HTMLFormControlElement*);
 
     friend class HTMLFormCollection;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl
index 3e846d6752..d639c341d6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl
@@ -22,10 +22,7 @@ module html {
 
     interface [
         HasIndexGetter,
-        HasOverridingNameGetter,
-        GenerateConstructor,
-        InterfaceUUID=c7e79252-3b6d-4636-9efb-0667192ca5c3,
-        ImplementationUUID=3561288f-5f67-4c45-9290-de4191d4c9c9
+        HasOverridingNameGetter
     ] HTMLFormElement : HTMLElement {
         readonly attribute HTMLCollection  elements;
         readonly attribute long            length;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl
index d0076eb03b..453de0a317 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl
@@ -20,11 +20,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=0795de43-e0cb-429e-ae0b-d38dbb641fd7,
-        ImplementationUUID=38c9e3c8-3384-40b6-a484-cb845c48b67d
-    ] HTMLFrameElement : HTMLElement {
+    interface HTMLFrameElement : HTMLElement {
 
                  attribute [ConvertNullToNullString, Reflect=frameborder] DOMString       frameBorder;
                  attribute [ConvertNullToNullString, Reflect=longdesc] DOMString       longDesc;
@@ -38,7 +34,6 @@ module html {
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Extensions
         readonly attribute DOMWindow contentWindow;
 
@@ -48,7 +43,6 @@ module html {
             raises(DOMException);
 #endif
 #endif
-#endif
 
                  attribute [ConvertNullToNullString, CustomSetter] DOMString       location;
         readonly attribute long            width;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
index 80df8294b6..76f3ed4512 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
@@ -50,8 +50,10 @@ HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Documen
     , m_scrolling(ScrollbarAuto)
     , m_marginWidth(-1)
     , m_marginHeight(-1)
+    , m_checkAttachedTimer(this, &HTMLFrameElementBase::checkAttachedTimerFired)
     , m_viewSource(false)
     , m_shouldOpenURLAfterAttach(false)
+    , m_remainsAliveOnRemovalFromTree(false)
 {
 }
 
@@ -88,7 +90,7 @@ bool HTMLFrameElementBase::isURLAllowed() const
     return true;
 }
 
-void HTMLFrameElementBase::openURL()
+void HTMLFrameElementBase::openURL(bool lockHistory, bool lockBackForwardList)
 {
     ASSERT(!m_frameName.isEmpty());
 
@@ -102,7 +104,7 @@ void HTMLFrameElementBase::openURL()
     if (!parentFrame)
         return;
 
-    parentFrame->loader()->requestFrame(this, m_URL, m_frameName);
+    parentFrame->loader()->requestFrame(this, m_URL, m_frameName, lockHistory, lockBackForwardList);
     if (contentFrame())
         contentFrame()->setInViewSourceMode(viewSourceMode());
 }
@@ -111,7 +113,7 @@ void HTMLFrameElementBase::parseMappedAttribute(MappedAttribute *attr)
 {
     if (attr->name() == srcAttr)
         setLocation(deprecatedParseURL(attr->value()));
-    else if (attr->name() == idAttr) {
+    else if (attr->name() == idAttributeName()) {
         // Important to call through to base for the id attribute so the hasID bit gets set.
         HTMLFrameOwnerElement::parseMappedAttribute(attr);
         m_frameName = attr->value();
@@ -148,15 +150,19 @@ void HTMLFrameElementBase::parseMappedAttribute(MappedAttribute *attr)
         HTMLFrameOwnerElement::parseMappedAttribute(attr);
 }
 
-void HTMLFrameElementBase::setNameAndOpenURL()
+void HTMLFrameElementBase::setName()
 {
     m_frameName = getAttribute(nameAttr);
     if (m_frameName.isNull())
-        m_frameName = getAttribute(idAttr);
+        m_frameName = getAttribute(idAttributeName());
     
     if (Frame* parentFrame = document()->frame())
         m_frameName = parentFrame->tree()->uniqueChildName(m_frameName);
-    
+}
+
+void HTMLFrameElementBase::setNameAndOpenURL()
+{
+    setName();
     openURL();
 }
 
@@ -165,6 +171,14 @@ void HTMLFrameElementBase::setNameAndOpenURLCallback(Node* n)
     static_cast<HTMLFrameElementBase*>(n)->setNameAndOpenURL();
 }
 
+void HTMLFrameElementBase::updateOnReparenting()
+{
+    ASSERT(m_remainsAliveOnRemovalFromTree);
+
+    if (Frame* frame = contentFrame())
+        frame->transferChildFrameToNewDocument();
+}
+
 void HTMLFrameElementBase::insertedIntoDocument()
 {
     HTMLFrameOwnerElement::insertedIntoDocument();
@@ -173,6 +187,9 @@ void HTMLFrameElementBase::insertedIntoDocument()
     // Othewise, a synchronous load that executed JavaScript would see incorrect 
     // (0) values for the frame's renderer-dependent properties, like width.
     m_shouldOpenURLAfterAttach = true;
+
+    if (m_remainsAliveOnRemovalFromTree)
+        updateOnReparenting();
 }
 
 void HTMLFrameElementBase::removedFromDocument()
@@ -186,9 +203,12 @@ void HTMLFrameElementBase::attach()
 {
     if (m_shouldOpenURLAfterAttach) {
         m_shouldOpenURLAfterAttach = false;
-        queuePostAttachCallback(&HTMLFrameElementBase::setNameAndOpenURLCallback, this);
+        if (!m_remainsAliveOnRemovalFromTree)
+            queuePostAttachCallback(&HTMLFrameElementBase::setNameAndOpenURLCallback, this);
     }
 
+    setRemainsAliveOnRemovalFromTree(false);
+
     HTMLFrameOwnerElement::attach();
     
     if (RenderPart* renderPart = toRenderPart(renderer())) {
@@ -211,7 +231,7 @@ void HTMLFrameElementBase::setLocation(const String& str)
     m_URL = AtomicString(str);
 
     if (inDocument())
-        openURL();
+        openURL(false, false);
 }
 
 bool HTMLFrameElementBase::supportsFocus() const
@@ -249,4 +269,33 @@ int HTMLFrameElementBase::height() const
     return toRenderBox(renderer())->height();
 }
 
+void HTMLFrameElementBase::setRemainsAliveOnRemovalFromTree(bool value)
+{
+    m_remainsAliveOnRemovalFromTree = value;
+
+    // There is a possibility that JS will do document.adoptNode() on this element but will not insert it into the tree.
+    // Start the async timer that is normally stopped by attach(). If it's not stopped and fires, it'll unload the frame.
+    if (value)
+        m_checkAttachedTimer.startOneShot(0);
+    else
+        m_checkAttachedTimer.stop();
+}
+
+void HTMLFrameElementBase::checkAttachedTimerFired(Timer<HTMLFrameElementBase>*)
+{
+    ASSERT(!attached());
+    ASSERT(m_remainsAliveOnRemovalFromTree);
+
+    m_remainsAliveOnRemovalFromTree = false;
+    willRemove();
+}
+
+void HTMLFrameElementBase::willRemove()
+{
+    if (m_remainsAliveOnRemovalFromTree)
+        return;
+
+    HTMLFrameOwnerElement::willRemove();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h
index c211ba7620..6424ba79f6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h
@@ -42,6 +42,8 @@ public:
     int width() const;
     int height() const;
 
+    void setRemainsAliveOnRemovalFromTree(bool);
+
 protected:
     HTMLFrameElementBase(const QualifiedName&, Document*);
 
@@ -62,10 +64,16 @@ private:
     
     virtual bool isURLAttribute(Attribute*) const;
 
+    virtual void setName();
+
+    virtual void willRemove();
+    void checkAttachedTimerFired(Timer<HTMLFrameElementBase>*);
+    void updateOnReparenting();
+
     bool viewSourceMode() const { return m_viewSource; }
 
     void setNameAndOpenURL();
-    void openURL();
+    void openURL(bool lockHistory = true, bool lockBackForwardList = true);
 
     static void setNameAndOpenURLCallback(Node*);
 
@@ -77,9 +85,13 @@ private:
     int m_marginWidth;
     int m_marginHeight;
 
+    Timer<HTMLFrameElementBase> m_checkAttachedTimer;
+
     bool m_viewSource;
 
     bool m_shouldOpenURLAfterAttach;
+
+    bool m_remainsAliveOnRemovalFromTree;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp
index 84958c2cd8..c3ae785926 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp
@@ -35,6 +35,7 @@ namespace WebCore {
 HTMLFrameOwnerElement::HTMLFrameOwnerElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document, CreateElement)
     , m_contentFrame(0)
+    , m_sandboxFlags(SandboxNone)
 {
 }
 
@@ -64,6 +65,17 @@ DOMWindow* HTMLFrameOwnerElement::contentWindow() const
     return m_contentFrame ? m_contentFrame->domWindow() : 0;
 }
 
+void HTMLFrameOwnerElement::setSandboxFlags(SandboxFlags flags)
+{
+    if (m_sandboxFlags == flags)
+        return;
+
+    m_sandboxFlags = flags;
+
+    if (Frame* frame = contentFrame())
+        frame->loader()->ownerElementSandboxFlagsChanged();
+}
+
 #if ENABLE(SVG)
 SVGDocument* HTMLFrameOwnerElement::getSVGDocument(ExceptionCode& ec) const
 {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h
index 1437e2c96b..804ab22649 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h
@@ -21,6 +21,7 @@
 #ifndef HTMLFrameOwnerElement_h
 #define HTMLFrameOwnerElement_h
 
+#include "FrameLoaderTypes.h"
 #include "HTMLElement.h"
 
 namespace WebCore {
@@ -46,18 +47,24 @@ public:
 
     virtual ScrollbarMode scrollingMode() const { return ScrollbarAuto; }
 
+    SandboxFlags sandboxFlags() const { return m_sandboxFlags; }
+
 protected:
     HTMLFrameOwnerElement(const QualifiedName& tagName, Document*);
 
+    void setSandboxFlags(SandboxFlags);
+
+    virtual void willRemove();
+
 private:
     friend class Frame;
 
+    virtual void setName() { }
     virtual bool isFrameOwnerElement() const { return true; }
     virtual bool isKeyboardFocusable(KeyboardEvent*) const { return m_contentFrame; }
-    
-    virtual void willRemove();
 
     Frame* m_contentFrame;
+    SandboxFlags m_sandboxFlags;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp
index cbeba87566..e090394131 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp
@@ -135,6 +135,10 @@ void HTMLFrameSetElement::parseMappedAttribute(MappedAttribute *attr)
         document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onfocusAttr)
         document()->setWindowAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onfocusinAttr)
+        document()->setWindowAttributeEventListener(eventNames().focusinEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onfocusoutAttr)
+        document()->setWindowAttributeEventListener(eventNames().focusoutEvent, createAttributeEventListener(document()->frame(), attr));
 #if ENABLE(ORIENTATION_EVENTS)
     else if (attr->name() == onorientationchangeAttr)
         document()->setWindowAttributeEventListener(eventNames().orientationchangeEvent, createAttributeEventListener(document()->frame(), attr));
@@ -151,6 +155,8 @@ void HTMLFrameSetElement::parseMappedAttribute(MappedAttribute *attr)
         document()->setWindowAttributeEventListener(eventNames().onlineEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onofflineAttr)
         document()->setWindowAttributeEventListener(eventNames().offlineEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onpopstateAttr)
+        document()->setWindowAttributeEventListener(eventNames().popstateEvent, createAttributeEventListener(document()->frame(), attr));
     else
         HTMLElement::parseMappedAttribute(attr);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.h
index 2b2d7eacd2..0c75efe1a2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.h
@@ -79,6 +79,7 @@ public:
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(message);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(offline);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(online);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(popstate);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(resize);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(storage);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(unload);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.idl
index b44a071e07..3a761ae9ba 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.idl
@@ -21,22 +21,19 @@
 module html {
 
     interface [
-        GenerateConstructor,
-        HasOverridingNameGetter,
-        InterfaceUUID=5038a73d-c0db-4847-acb4-4c6d31f48790,
-        ImplementationUUID=450f7bf6-fdc0-4a0f-b7e1-baea7f7e5732
+        HasOverridingNameGetter
     ] HTMLFrameSetElement : HTMLElement {
         attribute [ConvertNullToNullString] DOMString cols;
         attribute [ConvertNullToNullString] DOMString rows;
 
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Event handler attributes
         attribute [DontEnum] EventListener onbeforeunload;
         attribute [DontEnum] EventListener onhashchange;
         attribute [DontEnum] EventListener onmessage;
         attribute [DontEnum] EventListener onoffline;
         attribute [DontEnum] EventListener ononline;
+        attribute [DontEnum] EventListener onpopstate;
         attribute [DontEnum] EventListener onresize;
         attribute [DontEnum] EventListener onstorage;
         attribute [DontEnum] EventListener onunload;
@@ -54,11 +51,9 @@ module html {
         // Not implemented yet.
         // attribute [DontEnum] EventListener onafterprint;
         // attribute [DontEnum] EventListener onbeforeprint;
-        // attribute [DontEnum] EventListener onpopstate;
         // attribute [DontEnum] EventListener onredo;
         // attribute [DontEnum] EventListener onundo;
 #endif
-#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLHRElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLHRElement.idl
index e49932a02a..bb1fdcfe01 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLHRElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLHRElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=20477b34-ab22-47e3-b9aa-80c388d32975,
-        ImplementationUUID=6cfc8977-172d-48f6-8f08-c7671f02354c
-    ] HTMLHRElement : HTMLElement {
+    interface HTMLHRElement : HTMLElement {
         attribute [ConvertNullToNullString] DOMString align;
         attribute boolean noShade;
         attribute [ConvertNullToNullString] DOMString size;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLHeadElement.h b/src/3rdparty/webkit/WebCore/html/HTMLHeadElement.h
index 21d8a2f4bc..14a4409a13 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLHeadElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLHeadElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLHeadElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLHeadElement.idl
index 82ff796936..8559dd3c93 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLHeadElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLHeadElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=47e0c1a2-39ca-4be8-a4ef-38af06462d2e,
-        ImplementationUUID=f56408fe-6987-4ece-b925-599f517bde50
-    ] HTMLHeadElement : HTMLElement {
+    interface HTMLHeadElement : HTMLElement {
         attribute  [ConvertNullToNullString] DOMString            profile;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLHeadingElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLHeadingElement.cpp
index 452f7c36c3..95c82d14b3 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLHeadingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLHeadingElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003 Apple Computer, Inc.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLHeadingElement.h b/src/3rdparty/webkit/WebCore/html/HTMLHeadingElement.h
index dac1107c70..765bede7e8 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLHeadingElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLHeadingElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLHeadingElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLHeadingElement.idl
index 717325293f..486a5bd695 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLHeadingElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLHeadingElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=91c029bb-aa3a-4877-8ab5-59f304525fd5,
-        ImplementationUUID=ab39e189-5d0c-465d-b518-f57bc920038b
-    ] HTMLHeadingElement : HTMLElement {
+    interface HTMLHeadingElement : HTMLElement {
         attribute [ConvertNullToNullString] DOMString align;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.h b/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.h
index 86603b507e..de80ba860a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.idl
index e9709bf317..9cee000d04 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=162828a5-d4d9-4973-b5ca-00ccbb26ded9,
-        ImplementationUUID=362f4f5f-99c5-4bbf-91ba-9ae7f9a7b297
-    ] HTMLHtmlElement : HTMLElement {
+    interface HTMLHtmlElement : HTMLElement {
 
         attribute [ConvertNullToNullString] DOMString version;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp
index cae9b8d30f..117d26c9e7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp
@@ -4,6 +4,7 @@
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Ericsson AB. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -66,6 +67,42 @@ bool HTMLIFrameElement::mapToEntry(const QualifiedName& attrName, MappedAttribut
     return HTMLFrameElementBase::mapToEntry(attrName, result);
 }
 
+#if ENABLE(SANDBOX)
+static SandboxFlags parseSandboxAttribute(MappedAttribute* attribute)
+{
+    if (attribute->isNull())
+        return SandboxNone;
+
+    // Parse the unordered set of unique space-separated tokens.
+    SandboxFlags flags = SandboxAll;
+    const UChar* characters = attribute->value().characters();
+    unsigned length = attribute->value().length();
+    unsigned start = 0;
+    while (true) {
+        while (start < length && isASCIISpace(characters[start]))
+            ++start;
+        if (start >= length)
+            break;
+        unsigned end = start + 1;
+        while (end < length && !isASCIISpace(characters[end]))
+            ++end;
+
+        // Turn off the corresponding sandbox flag if it's set as "allowed".
+        String sandboxToken = String(characters + start, end - start);
+        if (equalIgnoringCase(sandboxToken, "allow-same-origin"))
+            flags &= ~SandboxOrigin;
+        else if (equalIgnoringCase(sandboxToken, "allow-forms"))
+            flags &= ~SandboxForms;
+        else if (equalIgnoringCase(sandboxToken, "allow-scripts"))
+            flags &= ~SandboxScripts;
+
+        start = end + 1;
+    }
+    
+    return flags;
+}
+#endif
+
 void HTMLIFrameElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == widthAttr)
@@ -88,7 +125,12 @@ void HTMLIFrameElement::parseMappedAttribute(MappedAttribute* attr)
         if (!attr->isNull() && !attr->value().toInt())
             // Add a rule that nulls out our border width.
             addCSSLength(attr, CSSPropertyBorderWidth, "0");
-    } else
+    }
+#if ENABLE(SANDBOX)
+    else if (attr->name() == sandboxAttr)
+        setSandboxFlags(parseSandboxAttribute(attr));
+#endif
+    else
         HTMLFrameElementBase::parseMappedAttribute(attr);
 }
 
@@ -118,14 +160,6 @@ void HTMLIFrameElement::removedFromDocument()
     HTMLFrameElementBase::removedFromDocument();
 }
 
-void HTMLIFrameElement::attach()
-{
-    HTMLFrameElementBase::attach();
-
-    if (RenderPartObject* renderPartObject = toRenderPartObject(renderer()))
-        renderPartObject->updateWidget(false);
-}
-
 bool HTMLIFrameElement::isURLAttribute(Attribute* attr) const
 {
     return attr->name() == srcAttr;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h
index f1c6a35f45..c708456daf 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h
@@ -44,8 +44,6 @@ private:
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
     
-    virtual void attach();
-
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl
index e288b547f0..e1aed03876 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl
@@ -20,11 +20,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=32265f2e-79b1-4e4e-b0d1-86b050298883,
-        ImplementationUUID=370c6318-f804-49f9-bc8a-46b99cd87399
-    ] HTMLIFrameElement : HTMLElement {
+    interface HTMLIFrameElement : HTMLElement {
 
                  attribute [ConvertNullToNullString, Reflect] DOMString       align;
                  attribute [ConvertNullToNullString, Reflect=frameborder] DOMString       frameBorder;
@@ -33,6 +29,7 @@ module html {
                  attribute [ConvertNullToNullString, Reflect=marginheight] DOMString       marginHeight;
                  attribute [ConvertNullToNullString, Reflect=marginwidth] DOMString       marginWidth;
                  attribute [ConvertNullToNullString, Reflect] DOMString       name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       sandbox;
                  attribute [ConvertNullToNullString, Reflect] DOMString       scrolling;
                  attribute [ConvertNullToNullString, CustomSetter, Reflect] DOMString       src;
                  attribute [ConvertNullToNullString, Reflect] DOMString       width;
@@ -40,7 +37,6 @@ module html {
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Extensions
         readonly attribute DOMWindow contentWindow;
 
@@ -50,7 +46,6 @@ module html {
             raises(DOMException);
 #endif
 #endif
-#endif
 
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
index 3db68117cb..d3cea921b8 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
@@ -1,7 +1,8 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -58,6 +59,16 @@ HTMLImageElement::~HTMLImageElement()
         m_form->removeImgElement(this);
 }
 
+PassRefPtr<HTMLImageElement> HTMLImageElement::createForJSConstructor(Document* document, const int* optionalWidth, const int* optionalHeight)
+{
+    RefPtr<HTMLImageElement> image = new HTMLImageElement(imgTag, document);
+    if (optionalWidth)
+        image->setWidth(*optionalWidth);
+    if (optionalHeight > 0)
+        image->setHeight(*optionalHeight);
+    return image.release();
+}
+
 bool HTMLImageElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
 {
     if (attrName == widthAttr ||
@@ -68,7 +79,7 @@ bool HTMLImageElement::mapToEntry(const QualifiedName& attrName, MappedAttribute
         result = eUniversal;
         return false;
     }
-    
+
     if (attrName == borderAttr || attrName == alignAttr) {
         result = eReplaced; // Shared with embed and iframe elements.
         return false;
@@ -131,7 +142,7 @@ void HTMLImageElement::parseMappedAttribute(MappedAttribute* attr)
             document->addNamedItem(newName);
         }
         m_name = newName;
-    } else if (attr->name() == idAttr) {
+    } else if (attr->name() == idAttributeName()) {
         const AtomicString& newId = attr->value();
         if (inDocument() && document()->isHTMLDocument()) {
             HTMLDocument* document = static_cast<HTMLDocument*>(this->document());
@@ -161,7 +172,7 @@ RenderObject* HTMLImageElement::createRenderer(RenderArena* arena, RenderStyle*
 {
      if (style->contentData())
         return RenderObject::createObject(this, style);
-     
+
      return new (arena) RenderImage(this);
 }
 
@@ -174,7 +185,7 @@ void HTMLImageElement::attach()
         if (imageObj->hasImage())
             return;
         imageObj->setCachedImage(m_imageLoader.image());
-        
+
         // If we have no image at all because we have no src attribute, set
         // image height and width for the alt text instead.
         if (!m_imageLoader.image() && !imageObj->cachedImage())
@@ -241,7 +252,7 @@ int HTMLImageElement::width(bool ignorePendingStylesheets) const
         int width = getAttribute(widthAttr).toInt(&ok);
         if (ok)
             return width;
-        
+
         // if the image is available, use its width
         if (m_imageLoader.image()) {
             float zoomFactor = document()->frame() ? document()->frame()->pageZoomFactor() : 1.0f;
@@ -265,7 +276,7 @@ int HTMLImageElement::height(bool ignorePendingStylesheets) const
         int height = getAttribute(heightAttr).toInt(&ok);
         if (ok)
             return height;
-        
+
         // if the image is available, use its height
         if (m_imageLoader.image()) {
             float zoomFactor = document()->frame() ? document()->frame()->pageZoomFactor() : 1.0f;
@@ -293,10 +304,10 @@ int HTMLImageElement::naturalHeight() const
 {
     if (!m_imageLoader.image())
         return 0;
-    
+
     return m_imageLoader.image()->imageSize(1.0f).height();
 }
-    
+
 bool HTMLImageElement::isURLAttribute(Attribute* attr) const
 {
     return attr->name() == srcAttr
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h
index 14e5fa37e2..d7df1dc4c1 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h
@@ -1,7 +1,8 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2008, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -34,6 +35,8 @@ class HTMLFormElement;
 class HTMLImageElement : public HTMLElement {
     friend class HTMLFormElement;
 public:
+    static PassRefPtr<HTMLImageElement> createForJSConstructor(Document*, const int* optionalWidth, const int* optionalHeight);
+
     HTMLImageElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
     ~HTMLImageElement();
 
@@ -53,7 +56,7 @@ public:
 
     int naturalWidth() const;
     int naturalHeight() const;
-    
+
     bool isServerMap() const { return ismap && usemap.isEmpty(); }
 
     String altText() const;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.idl
index a90ae25122..3862539509 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.idl
@@ -20,11 +20,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=b21b8125-d00b-4bdf-b0e8-659678db3923,
-        ImplementationUUID=2121ca21-8118-4f1b-b9fe-4788a9050281
-    ] HTMLImageElement : HTMLElement {
+    interface HTMLImageElement : HTMLElement {
                  attribute [ConvertNullToNullString, Reflect] DOMString name;
                  attribute [ConvertNullToNullString, Reflect] DOMString align;
                  attribute [ConvertNullToNullString, Reflect] DOMString alt;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageLoader.h b/src/3rdparty/webkit/WebCore/html/HTMLImageLoader.h
index 9e9564bb4d..d3b606871f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageLoader.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageLoader.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004 Apple Computer, Inc.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
index 652bc40157..6a214ab132 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  *
@@ -29,6 +29,7 @@
 #include "AXObjectCache.h"
 #include "CSSPropertyNames.h"
 #include "ChromeClient.h"
+#include "DateComponents.h"
 #include "Document.h"
 #include "Editor.h"
 #include "Event.h"
@@ -59,9 +60,13 @@
 #include "RenderText.h"
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
+#include "StepRange.h"
+#include "StringHash.h"
 #include "TextEvent.h"
+#include <wtf/HashMap.h>
 #include <wtf/MathExtras.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/dtoa.h>
 
 using namespace std;
 
@@ -71,6 +76,45 @@ using namespace HTMLNames;
 
 const int maxSavedResults = 256;
 
+// Constant values for getAllowedValueStep().
+static const double dateDefaultStep = 1.0;
+static const double dateStepScaleFactor = 86400000.0;
+static const double dateTimeDefaultStep = 60.0;
+static const double dateTimeStepScaleFactor = 1000.0;
+static const double monthDefaultStep = 1.0;
+static const double monthStepScaleFactor = 1.0;
+static const double numberDefaultStep = 1.0;
+static const double numberStepScaleFactor = 1.0;
+static const double timeDefaultStep = 60.0;
+static const double timeStepScaleFactor = 1000.0;
+static const double weekDefaultStep = 1.0;
+static const double weekStepScaleFactor = 604800000.0;
+
+// Constant values for minimum().
+static const double dateDefaultMinimum = -12219292800000.0; // This means 1582-10-15T00:00Z.
+static const double dateTimeDefaultMinimum = -12219292800000.0; // ditto.
+static const double monthDefaultMinimum = (1582.0 - 1970) * 12 + 10 - 1; // 1582-10
+static const double numberDefaultMinimum = -DBL_MAX;
+static const double rangeDefaultMinimum = 0.0;
+static const double timeDefaultMinimum = 0.0; // 00:00:00.000
+static const double weekDefaultMinimum = -12212380800000.0; // 1583-01-03, the first Monday of 1583.
+
+// Constant values for maximum().
+static const double dateDefaultMaximum = DBL_MAX;
+static const double dateTimeDefaultMaximum = DBL_MAX;
+// DateComponents::m_year can't represent a year greater than INT_MAX.
+static const double monthDefaultMaximum = (INT_MAX - 1970) * 12.0 + 12 - 1;
+static const double numberDefaultMaximum = DBL_MAX;
+static const double rangeDefaultMaximum = 100.0;
+static const double timeDefaultMaximum = 86399999.0; // 23:59:59.999
+static const double weekDefaultMaximum = DBL_MAX;
+
+static const double defaultStepBase = 0.0;
+static const double weekDefaultStepBase = -259200000.0; // The first day of 1970-W01.
+
+static const double msecPerMinute = 60 * 1000;
+static const double msecPerSecond = 1000;
+
 HTMLInputElement::HTMLInputElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
     : HTMLTextFormControlElement(tagName, doc, f)
     , m_xPos(0)
@@ -120,34 +164,47 @@ bool HTMLInputElement::autoComplete() const
     return true;
 }
 
+static inline CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement* element)
+{
+    if (HTMLFormElement* form = element->form())
+        return form->checkedRadioButtons();
+    return element->document()->checkedRadioButtons();
+}
+
 bool HTMLInputElement::valueMissing() const
 {
     if (!isRequiredFormControl() || readOnly() || disabled())
         return false;
 
     switch (inputType()) {
-        case TEXT:
-        case SEARCH:
-        case URL:
-        case TELEPHONE:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
-        case PASSWORD:
-        case NUMBER:
         case FILE:
+        case MONTH:
+        case NUMBER:
+        case PASSWORD:
+        case SEARCH:
+        case TELEPHONE:
+        case TEXT:
+        case TIME:
+        case URL:
+        case WEEK:
             return value().isEmpty();
         case CHECKBOX:
             return !checked();
         case RADIO:
-            return !document()->checkedRadioButtons().checkedButtonForGroup(name());
+            return !checkedRadioButtons(this).checkedButtonForGroup(name());
         case COLOR:
             return false;
+        case BUTTON:
         case HIDDEN:
-        case RANGE:
-        case SUBMIT:
         case IMAGE:
-        case RESET:
-        case BUTTON:
         case ISINDEX:
+        case RANGE:
+        case RESET:
+        case SUBMIT:
             break;
     }
 
@@ -158,25 +215,31 @@ bool HTMLInputElement::valueMissing() const
 bool HTMLInputElement::patternMismatch() const
 {
     switch (inputType()) {
-        case ISINDEX:
+        case BUTTON:
         case CHECKBOX:
-        case RADIO:
-        case SUBMIT:
-        case RESET:
+        case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case FILE:
         case HIDDEN:
         case IMAGE:
-        case BUTTON:
-        case RANGE:
+        case ISINDEX:
+        case MONTH:
         case NUMBER:
-        case COLOR:
+        case RADIO:
+        case RANGE:
+        case RESET:
+        case SUBMIT:
+        case TIME:
+        case WEEK:
             return false;
-        case TEXT:
-        case SEARCH:
-        case URL:
-        case TELEPHONE:
         case EMAIL:
         case PASSWORD:
+        case SEARCH:
+        case TELEPHONE:
+        case TEXT:
+        case URL:
             const AtomicString& pattern = getAttribute(patternAttr);
             String value = this->value();
 
@@ -212,20 +275,26 @@ bool HTMLInputElement::tooLong() const
         bool userEdited = !m_data.value().isNull();
         if (!userEdited)
             return false;
-        return value().length() > static_cast<unsigned>(max);
+        return value().numGraphemeClusters() > static_cast<unsigned>(max);
     }
     case BUTTON:
     case CHECKBOX:
     case COLOR:
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
     case FILE:
     case HIDDEN:
     case IMAGE:
     case ISINDEX:
+    case MONTH:
     case NUMBER:
     case RADIO:
     case RANGE:
     case RESET:
     case SUBMIT:
+    case TIME:
+    case WEEK:
         return false;
     }
     ASSERT_NOT_REACHED();
@@ -234,66 +303,390 @@ bool HTMLInputElement::tooLong() const
 
 bool HTMLInputElement::rangeUnderflow() const
 {
-    if (inputType() == NUMBER) {
-        double min = 0.0;
-        double doubleValue = 0.0;
-        if (formStringToDouble(getAttribute(minAttr), &min) && formStringToDouble(value(), &doubleValue))
-            return doubleValue < min;
-    } else if (inputType() == RANGE) {
-        double doubleValue;
-        if (formStringToDouble(value(), &doubleValue))
-            return doubleValue < rangeMinimum();
+    const double nan = numeric_limits<double>::quiet_NaN();
+    switch (inputType()) {
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
+    case MONTH:
+    case NUMBER:
+    case TIME:
+    case WEEK: {
+        double doubleValue = parseToDouble(value(), nan);
+        return isfinite(doubleValue) && doubleValue < minimum();
+    }
+    case RANGE: // Guaranteed by sanitization.
+        ASSERT(parseToDouble(value(), nan) >= minimum());
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        break;
     }
     return false;
 }
 
 bool HTMLInputElement::rangeOverflow() const
 {
-    if (inputType() == NUMBER) {
-        double max = 0.0;
-        double doubleValue = 0.0;
-        if (formStringToDouble(getAttribute(maxAttr), &max) && formStringToDouble(value(), &doubleValue))
-            return doubleValue > max;
-    } else if (inputType() == RANGE) {
+    const double nan = numeric_limits<double>::quiet_NaN();
+    switch (inputType()) {
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
+    case MONTH:
+    case NUMBER:
+    case TIME:
+    case WEEK: {
+        double doubleValue = parseToDouble(value(), nan);
+        return isfinite(doubleValue) && doubleValue > maximum();
+    }
+    case RANGE: // Guaranteed by sanitization.
+        ASSERT(parseToDouble(value(), nan) <= maximum());
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        break;
+    }
+    return false;
+}
+
+double HTMLInputElement::minimum() const
+{
+    switch (inputType()) {
+    case DATE:
+        return parseToDouble(getAttribute(minAttr), dateDefaultMinimum);
+    case DATETIME:
+    case DATETIMELOCAL:
+        return parseToDouble(getAttribute(minAttr), dateTimeDefaultMinimum);
+    case MONTH:
+        return parseToDouble(getAttribute(minAttr), monthDefaultMinimum);
+    case NUMBER:
+        return parseToDouble(getAttribute(minAttr), numberDefaultMinimum);
+    case RANGE:
+        return parseToDouble(getAttribute(minAttr), rangeDefaultMinimum);
+    case TIME:
+        return parseToDouble(getAttribute(minAttr), timeDefaultMinimum);
+    case WEEK:
+        return parseToDouble(getAttribute(minAttr), weekDefaultMinimum);
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        break;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+double HTMLInputElement::maximum() const
+{
+    switch (inputType()) {
+    case DATE:
+        return parseToDouble(getAttribute(maxAttr), dateDefaultMaximum);
+    case DATETIME:
+    case DATETIMELOCAL:
+        return parseToDouble(getAttribute(maxAttr), dateTimeDefaultMaximum);
+    case MONTH:
+        return parseToDouble(getAttribute(maxAttr), monthDefaultMaximum);
+    case NUMBER:
+        return parseToDouble(getAttribute(maxAttr), numberDefaultMaximum);
+    case RANGE: {
+        double max = parseToDouble(getAttribute(maxAttr), rangeDefaultMaximum);
+        // A remedy for the inconsistent min/max values for RANGE.
+        // Sets the maximum to the default or the minimum value.
+        double min = minimum();
+        if (max < min)
+            max = std::max(min, rangeDefaultMaximum);
+        return max;
+    }
+    case TIME:
+        return parseToDouble(getAttribute(maxAttr), timeDefaultMaximum);
+    case WEEK:
+        return parseToDouble(getAttribute(maxAttr), weekDefaultMaximum);
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        break;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+double HTMLInputElement::stepBase() const
+{
+    switch (inputType()) {
+    case RANGE:
+        return minimum();
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
+    case MONTH:
+    case NUMBER:
+    case TIME:
+        return parseToDouble(getAttribute(minAttr), defaultStepBase);
+    case WEEK:
+        return parseToDouble(getAttribute(minAttr), weekDefaultStepBase);
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        break;
+    }
+    ASSERT_NOT_REACHED();
+    return 0.0;
+}
+
+bool HTMLInputElement::stepMismatch() const
+{
+    double step;
+    if (!getAllowedValueStep(&step))
+        return false;
+    switch (inputType()) {
+    case RANGE:
+        // stepMismatch doesn't occur for RANGE. RenderSlider guarantees the
+        // value matches to step on user input, and sanitation takes care
+        // of the general case.
+        return false;
+    case NUMBER: {
         double doubleValue;
-        if (formStringToDouble(value(), &doubleValue))
-            return doubleValue > rangeMaximum();
+        if (!parseToDoubleForNumberType(value(), &doubleValue))
+            return false;
+        doubleValue = fabs(doubleValue - stepBase());
+        if (isinf(doubleValue))
+            return false;
+        // double's fractional part size is DBL_MAN_DIG-bit.  If the current
+        // value is greater than step*2^DBL_MANT_DIG, the following fmod() makes
+        // no sense.
+        if (doubleValue / pow(2.0, DBL_MANT_DIG) > step)
+            return false;
+        double remainder = fmod(doubleValue, step);
+        // Accepts errors in lower 7-bit.
+        double acceptableError = step / pow(2.0, DBL_MANT_DIG - 7);
+        return acceptableError < remainder && remainder < (step - acceptableError);
+    }
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
+    case MONTH:
+    case TIME:
+    case WEEK: {
+        const double nan = numeric_limits<double>::quiet_NaN();
+        double doubleValue = parseToDouble(value(), nan);
+        doubleValue = fabs(doubleValue - stepBase());
+        if (!isfinite(doubleValue))
+            return false;
+        ASSERT(round(doubleValue) == doubleValue);
+        ASSERT(round(step) == step);
+        return fmod(doubleValue, step);
     }
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        break;
+    }
+    // Non-supported types should be rejected by getAllowedValueStep().
+    ASSERT_NOT_REACHED();
     return false;
 }
 
-double HTMLInputElement::rangeMinimum() const
+bool HTMLInputElement::getStepParameters(double* defaultStep, double* stepScaleFactor) const
 {
-    ASSERT(inputType() == RANGE);
-    // The range type's "default minimum" is 0.
-    double min = 0.0;
-    formStringToDouble(getAttribute(minAttr), &min);
-    return min;
+    ASSERT(defaultStep);
+    ASSERT(stepScaleFactor);
+    switch (inputType()) {
+    case NUMBER:
+    case RANGE:
+        *defaultStep = numberDefaultStep;
+        *stepScaleFactor = numberStepScaleFactor;
+        return true;
+    case DATE:
+        *defaultStep = dateDefaultStep;
+        *stepScaleFactor = dateStepScaleFactor;
+        return true;
+    case DATETIME:
+    case DATETIMELOCAL:
+        *defaultStep = dateTimeDefaultStep;
+        *stepScaleFactor = dateTimeStepScaleFactor;
+        return true;
+    case MONTH:
+        *defaultStep = monthDefaultStep;
+        *stepScaleFactor = monthStepScaleFactor;
+        return true;
+    case TIME:
+        *defaultStep = timeDefaultStep;
+        *stepScaleFactor = timeStepScaleFactor;
+        return true;
+    case WEEK:
+        *defaultStep = weekDefaultStep;
+        *stepScaleFactor = weekStepScaleFactor;
+        return true;
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        return false;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
 }
 
-double HTMLInputElement::rangeMaximum() const
+bool HTMLInputElement::getAllowedValueStep(double* step) const
 {
-    ASSERT(inputType() == RANGE);
-    // The range type's "default maximum" is 100.
-    static const double defaultMaximum = 100.0;
-    double max = defaultMaximum;
-    formStringToDouble(getAttribute(maxAttr), &max);
-    const double min = rangeMinimum();
+    ASSERT(step);
+    double defaultStep;
+    double stepScaleFactor;
+    if (!getStepParameters(&defaultStep, &stepScaleFactor))
+        return false;
+    const AtomicString& stepString = getAttribute(stepAttr);
+    if (stepString.isEmpty()) {
+        *step = defaultStep * stepScaleFactor;
+        return true;
+    }
+    if (equalIgnoringCase(stepString, "any"))
+        return false;
+    double parsed;
+    if (!parseToDoubleForNumberType(stepString, &parsed) || parsed <= 0.0) {
+        *step = defaultStep * stepScaleFactor;
+        return true;
+    }
+    // For DATE, MONTH, WEEK, the parsed value should be an integer.
+    if (inputType() == DATE || inputType() == MONTH || inputType() == WEEK)
+        parsed = max(round(parsed), 1.0);
+    double result = parsed * stepScaleFactor;
+    // For DATETIME, DATETIMELOCAL, TIME, the result should be an integer.
+    if (inputType() == DATETIME || inputType() == DATETIMELOCAL || inputType() == TIME)
+        result = max(round(result), 1.0);
+    ASSERT(result > 0);
+    *step = result;
+    return true;
+}
 
-    if (max < min) {
-        // A remedy for the inconsistent min/max values.
-        // Sets the maxmimum to the default (100.0) or the minimum value.
-        max = min < defaultMaximum ? defaultMaximum : min;
+void HTMLInputElement::applyStep(double count, ExceptionCode& ec)
+{
+    double step;
+    if (!getAllowedValueStep(&step)) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    const double nan = numeric_limits<double>::quiet_NaN();
+    double current = parseToDouble(value(), nan);
+    if (!isfinite(current)) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    double newValue = current + step * count;
+    if (isinf(newValue)) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    if (newValue < minimum()) {
+        ec = INVALID_STATE_ERR;
+        return;
     }
-    return max;
+    double base = stepBase();
+    newValue = base + round((newValue - base) / step) * step;
+    if (newValue > maximum()) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    setValueAsNumber(newValue, ec);
 }
 
-static inline CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement *element)
+void HTMLInputElement::stepUp(int n, ExceptionCode& ec)
 {
-    if (HTMLFormElement* form = element->form())
-        return form->checkedRadioButtons();
-    
-    return element->document()->checkedRadioButtons();
+    applyStep(n, ec);
+}
+
+void HTMLInputElement::stepDown(int n, ExceptionCode& ec)
+{
+    applyStep(-n, ec);
 }
 
 bool HTMLInputElement::isKeyboardFocusable(KeyboardEvent* event) const
@@ -372,46 +765,41 @@ void HTMLInputElement::setType(const String& t)
         setAttribute(typeAttr, t);
 }
 
+typedef HashMap<String, HTMLInputElement::InputType, CaseFoldingHash> InputTypeMap;
+static const InputTypeMap* createTypeMap()
+{
+    InputTypeMap* map = new InputTypeMap;
+    map->add("button", HTMLInputElement::BUTTON);
+    map->add("checkbox", HTMLInputElement::CHECKBOX);
+    map->add("color", HTMLInputElement::COLOR);
+    map->add("date", HTMLInputElement::DATE);
+    map->add("datetime", HTMLInputElement::DATETIME);
+    map->add("datetime-local", HTMLInputElement::DATETIMELOCAL);
+    map->add("email", HTMLInputElement::EMAIL);
+    map->add("file", HTMLInputElement::FILE);
+    map->add("hidden", HTMLInputElement::HIDDEN);
+    map->add("image", HTMLInputElement::IMAGE);
+    map->add("khtml_isindex", HTMLInputElement::ISINDEX);
+    map->add("month", HTMLInputElement::MONTH);
+    map->add("number", HTMLInputElement::NUMBER);
+    map->add("password", HTMLInputElement::PASSWORD);
+    map->add("radio", HTMLInputElement::RADIO);
+    map->add("range", HTMLInputElement::RANGE);
+    map->add("reset", HTMLInputElement::RESET);
+    map->add("search", HTMLInputElement::SEARCH);
+    map->add("submit", HTMLInputElement::SUBMIT);
+    map->add("tel", HTMLInputElement::TELEPHONE);
+    map->add("time", HTMLInputElement::TIME);
+    map->add("url", HTMLInputElement::URL);
+    map->add("week", HTMLInputElement::WEEK);
+    // No need to register "text" because it is the default type.
+    return map;
+}
+
 void HTMLInputElement::setInputType(const String& t)
 {
-    InputType newType;
-    
-    if (equalIgnoringCase(t, "password"))
-        newType = PASSWORD;
-    else if (equalIgnoringCase(t, "checkbox"))
-        newType = CHECKBOX;
-    else if (equalIgnoringCase(t, "radio"))
-        newType = RADIO;
-    else if (equalIgnoringCase(t, "submit"))
-        newType = SUBMIT;
-    else if (equalIgnoringCase(t, "reset"))
-        newType = RESET;
-    else if (equalIgnoringCase(t, "file"))
-        newType = FILE;
-    else if (equalIgnoringCase(t, "hidden"))
-        newType = HIDDEN;
-    else if (equalIgnoringCase(t, "image"))
-        newType = IMAGE;
-    else if (equalIgnoringCase(t, "button"))
-        newType = BUTTON;
-    else if (equalIgnoringCase(t, "khtml_isindex"))
-        newType = ISINDEX;
-    else if (equalIgnoringCase(t, "search"))
-        newType = SEARCH;
-    else if (equalIgnoringCase(t, "range"))
-        newType = RANGE;
-    else if (equalIgnoringCase(t, "email"))
-        newType = EMAIL;
-    else if (equalIgnoringCase(t, "number"))
-        newType = NUMBER;
-    else if (equalIgnoringCase(t, "tel"))
-        newType = TELEPHONE;
-    else if (equalIgnoringCase(t, "url"))
-        newType = URL;
-    else if (equalIgnoringCase(t, "color"))
-        newType = COLOR;
-    else
-        newType = TEXT;
+    static const InputTypeMap* typeMap = createTypeMap();
+    InputType newType = t.isNull() ? TEXT : typeMap->get(t);
 
     // IMPORTANT: Don't allow the type to be changed to FILE after the first
     // type change, otherwise a JavaScript programmer would be able to set a text
@@ -473,8 +861,9 @@ void HTMLInputElement::setInputType(const String& t)
             checkedRadioButtons(this).addButton(this);
         }
 
+        setNeedsWillValidateCheck();
+        setNeedsValidityCheck();
         InputElement::notifyFormStateChanged(this);
-        updateValidity();
     }
     m_haveType = true;
 
@@ -482,82 +871,42 @@ void HTMLInputElement::setInputType(const String& t)
         m_imageLoader.clear();
 }
 
+static const AtomicString* createFormControlTypes()
+{
+    AtomicString* types = new AtomicString[HTMLInputElement::numberOfTypes];
+    // The values must be lowercased because they will be the return values of
+    //  input.type and it must be lowercase according to DOM Level 2.
+    types[HTMLInputElement::BUTTON] = "button";
+    types[HTMLInputElement::CHECKBOX] = "checkbox";
+    types[HTMLInputElement::COLOR] = "color";
+    types[HTMLInputElement::DATE] = "date";
+    types[HTMLInputElement::DATETIME] = "datetime";
+    types[HTMLInputElement::DATETIMELOCAL] = "datetime-local";
+    types[HTMLInputElement::EMAIL] = "email";
+    types[HTMLInputElement::FILE] = "file";
+    types[HTMLInputElement::HIDDEN] = "hidden";
+    types[HTMLInputElement::IMAGE] = "image";
+    types[HTMLInputElement::ISINDEX] = emptyAtom;
+    types[HTMLInputElement::MONTH] = "month";
+    types[HTMLInputElement::NUMBER] = "number";
+    types[HTMLInputElement::PASSWORD] = "password";
+    types[HTMLInputElement::RADIO] = "radio";
+    types[HTMLInputElement::RANGE] = "range";
+    types[HTMLInputElement::RESET] = "reset";
+    types[HTMLInputElement::SEARCH] = "search";
+    types[HTMLInputElement::SUBMIT] = "submit";
+    types[HTMLInputElement::TELEPHONE] = "tel";
+    types[HTMLInputElement::TEXT] = "text";
+    types[HTMLInputElement::TIME] = "time";
+    types[HTMLInputElement::URL] = "url";
+    types[HTMLInputElement::WEEK] = "week";
+    return types;
+}
+
 const AtomicString& HTMLInputElement::formControlType() const
 {
-    // needs to be lowercase according to DOM spec
-    switch (inputType()) {
-        case BUTTON: {
-            DEFINE_STATIC_LOCAL(const AtomicString, button, ("button"));
-            return button;
-        }
-        case CHECKBOX: {
-            DEFINE_STATIC_LOCAL(const AtomicString, checkbox, ("checkbox"));
-            return checkbox;
-        }
-        case COLOR: {
-            DEFINE_STATIC_LOCAL(const AtomicString, color, ("color"));
-            return color;
-        }
-        case EMAIL: {
-            DEFINE_STATIC_LOCAL(const AtomicString, email, ("email"));
-            return email;
-        }
-        case FILE: {
-            DEFINE_STATIC_LOCAL(const AtomicString, file, ("file"));
-            return file;
-        }
-        case HIDDEN: {
-            DEFINE_STATIC_LOCAL(const AtomicString, hidden, ("hidden"));
-            return hidden;
-        }
-        case IMAGE: {
-            DEFINE_STATIC_LOCAL(const AtomicString, image, ("image"));
-            return image;
-        }
-        case ISINDEX:
-            return emptyAtom;
-        case NUMBER: {
-            DEFINE_STATIC_LOCAL(const AtomicString, number, ("number"));
-            return number;
-        }
-        case PASSWORD: {
-            DEFINE_STATIC_LOCAL(const AtomicString, password, ("password"));
-            return password;
-        }
-        case RADIO: {
-            DEFINE_STATIC_LOCAL(const AtomicString, radio, ("radio"));
-            return radio;
-        }
-        case RANGE: {
-            DEFINE_STATIC_LOCAL(const AtomicString, range, ("range"));
-            return range;
-        }
-        case RESET: {
-            DEFINE_STATIC_LOCAL(const AtomicString, reset, ("reset"));
-            return reset;
-        }
-        case SEARCH: {
-            DEFINE_STATIC_LOCAL(const AtomicString, search, ("search"));
-            return search;
-        }
-        case SUBMIT: {
-            DEFINE_STATIC_LOCAL(const AtomicString, submit, ("submit"));
-            return submit;
-        }
-        case TELEPHONE: {
-            DEFINE_STATIC_LOCAL(const AtomicString, telephone, ("tel"));
-            return telephone;
-        }
-        case TEXT: {
-            DEFINE_STATIC_LOCAL(const AtomicString, text, ("text"));
-            return text;
-        }
-        case URL: {
-            DEFINE_STATIC_LOCAL(const AtomicString, url, ("url"));
-            return url;
-        }
-    }
-    return emptyAtom;
+    static const AtomicString* formControlTypes = createFormControlTypes();
+    return formControlTypes[inputType()];
 }
 
 bool HTMLInputElement::saveFormControlState(String& result) const
@@ -568,11 +917,15 @@ bool HTMLInputElement::saveFormControlState(String& result) const
     switch (inputType()) {
         case BUTTON:
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case FILE:
         case HIDDEN:
         case IMAGE:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case RANGE:
         case RESET:
@@ -580,7 +933,9 @@ bool HTMLInputElement::saveFormControlState(String& result) const
         case SUBMIT:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             result = value();
             return true;
         case CHECKBOX:
@@ -600,11 +955,15 @@ void HTMLInputElement::restoreFormControlState(const String& state)
     switch (inputType()) {
         case BUTTON:
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case FILE:
         case HIDDEN:
         case IMAGE:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case RANGE:
         case RESET:
@@ -612,7 +971,9 @@ void HTMLInputElement::restoreFormControlState(const String& state)
         case SUBMIT:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             setValue(state);
             break;
         case CHECKBOX:
@@ -655,14 +1016,20 @@ void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
             // a no-op for this type
             break;
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case PASSWORD:
         case SEARCH:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             // should never restore previous selection here
             focus(false);
             break;
@@ -718,17 +1085,18 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         if (m_data.value().isNull())
             setNeedsStyleRecalc();
         setFormControlValueMatchesRenderer(false);
-        updateValidity();
+        setNeedsValidityCheck();
     } else if (attr->name() == checkedAttr) {
         m_defaultChecked = !attr->isNull();
         if (m_useDefaultChecked) {
             setChecked(m_defaultChecked);
             m_useDefaultChecked = true;
         }
-        updateValidity();
-    } else if (attr->name() == maxlengthAttr)
+        setNeedsValidityCheck();
+    } else if (attr->name() == maxlengthAttr) {
         InputElement::parseMaxLengthAttribute(m_data, this, this, attr);
-    else if (attr->name() == sizeAttr)
+        setNeedsValidityCheck();
+    } else if (attr->name() == sizeAttr)
         InputElement::parseSizeAttribute(m_data, this, attr);
     else if (attr->name() == altAttr) {
         if (renderer() && inputType() == IMAGE)
@@ -772,15 +1140,22 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
             attach();
         }
         setNeedsStyleRecalc();
-    } else if (attr->name() == autosaveAttr ||
-             attr->name() == incrementalAttr ||
-             attr->name() == minAttr ||
-             attr->name() == maxAttr ||
-             attr->name() == multipleAttr ||
-             attr->name() == precisionAttr)
+    } else if (attr->name() == autosaveAttr
+               || attr->name() == incrementalAttr)
         setNeedsStyleRecalc();
-    else if (attr->name() == patternAttr)
-        updateValidity();
+    else if (attr->name() == minAttr
+             || attr->name() == maxAttr) {
+        if (inputType() == RANGE) {
+            // Sanitize the value.
+            setValue(value());
+            setNeedsStyleRecalc();
+        }
+        setNeedsValidityCheck();
+    } else if (attr->name() == multipleAttr
+             || attr->name() == patternAttr
+             || attr->name() == precisionAttr
+             || attr->name() == stepAttr)
+        setNeedsValidityCheck();
 #if ENABLE(DATALIST)
     else if (attr->name() == listAttr)
         m_hasNonEmptyList = !attr->isEmpty();
@@ -792,30 +1167,9 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
 
 bool HTMLInputElement::rendererIsNeeded(RenderStyle *style)
 {
-    switch (inputType()) {
-        case BUTTON:
-        case CHECKBOX:
-        case COLOR:
-        case EMAIL:
-        case FILE:
-        case IMAGE:
-        case ISINDEX:
-        case NUMBER:
-        case PASSWORD:
-        case RADIO:
-        case RANGE:
-        case RESET:
-        case SEARCH:
-        case SUBMIT:
-        case TELEPHONE:
-        case TEXT:
-        case URL:
-            return HTMLFormControlElementWithState::rendererIsNeeded(style);
-        case HIDDEN:
-            return false;
-    }
-    ASSERT(false);
-    return false;
+    if (inputType() == HIDDEN)
+        return false;
+    return HTMLFormControlElementWithState::rendererIsNeeded(style);
 }
 
 RenderObject *HTMLInputElement::createRenderer(RenderArena *arena, RenderStyle *style)
@@ -837,14 +1191,20 @@ RenderObject *HTMLInputElement::createRenderer(RenderArena *arena, RenderStyle *
         case RANGE:
             return new (arena) RenderSlider(this);
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case PASSWORD:
         case SEARCH:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             return new (arena) RenderTextControlSingleLine(this, placeholderShouldBeVisible());
     }
     ASSERT(false);
@@ -875,6 +1235,9 @@ void HTMLInputElement::attach()
                 imageObj->setImageSizeForAltText();
         }
     }
+
+    if (document()->focusedNode() == this)
+        document()->updateFocusAppearanceSoon(true /* restore selection */);
 }
 
 void HTMLInputElement::detach()
@@ -924,16 +1287,22 @@ bool HTMLInputElement::appendFormData(FormDataList& encoding, bool multipart)
 
     switch (inputType()) {
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case HIDDEN:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case PASSWORD:
         case RANGE:
         case SEARCH:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             // always successful
             encoding.appendData(name(), value());
             return true;
@@ -1011,6 +1380,40 @@ void HTMLInputElement::reset()
     m_useDefaultChecked = true;
 }
 
+bool HTMLInputElement::isTextField() const
+{
+    switch (inputType()) {
+    case COLOR:
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
+    case EMAIL:
+    case ISINDEX:
+    case MONTH:
+    case NUMBER:
+    case PASSWORD:
+    case SEARCH:
+    case TELEPHONE:
+    case TEXT:
+    case TIME:
+    case URL:
+    case WEEK:
+        return true;
+    case BUTTON:
+    case CHECKBOX:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case RADIO:
+    case RANGE:
+    case RESET:
+    case SUBMIT:
+        return false;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
 void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
 {
     if (checked() == nowChecked)
@@ -1044,8 +1447,8 @@ void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
 
 void HTMLInputElement::setIndeterminate(bool _indeterminate)
 {
-    // Only checkboxes honor indeterminate.
-    if (inputType() != CHECKBOX || indeterminate() == _indeterminate)
+    // Only checkboxes and radio buttons honor indeterminate.
+    if (!allowsIndeterminate() || indeterminate() == _indeterminate)
         return;
 
     m_indeterminate = _indeterminate;
@@ -1066,7 +1469,9 @@ void HTMLInputElement::copyNonAttributeProperties(const Element* source)
     const HTMLInputElement* sourceElement = static_cast<const HTMLInputElement*>(source);
 
     m_data.setValue(sourceElement->m_data.value());
-    m_checked = sourceElement->m_checked;
+    setChecked(sourceElement->m_checked);
+    m_defaultChecked = sourceElement->m_defaultChecked;
+    m_useDefaultChecked = sourceElement->m_useDefaultChecked;
     m_indeterminate = sourceElement->m_indeterminate;
 
     HTMLFormControlElementWithState::copyNonAttributeProperties(source);
@@ -1085,10 +1490,16 @@ String HTMLInputElement::value() const
     String value = m_data.value();
     if (value.isNull()) {
         value = sanitizeValue(getAttribute(valueAttr));
-
-        // If no attribute exists, then just use "on" or "" based off the checked() state of the control.
-        if (value.isNull() && (inputType() == CHECKBOX || inputType() == RADIO))
-            return checked() ? "on" : "";
+        
+        // If no attribute exists, extra handling may be necessary.
+        // For Checkbox Types just use "on" or "" based off the checked() state of the control.
+        // For a Range Input use the calculated default value.
+        if (value.isNull()) {
+            if (inputType() == CHECKBOX || inputType() == RADIO)
+                return checked() ? "on" : "";
+            else if (inputType() == RANGE)
+                return serializeForNumberType(StepRange(this).defaultValue());
+        }
     }
 
     return value;
@@ -1102,11 +1513,15 @@ String HTMLInputElement::valueWithDefault() const
             case BUTTON:
             case CHECKBOX:
             case COLOR:
+            case DATE:
+            case DATETIME:
+            case DATETIMELOCAL:
             case EMAIL:
             case FILE:
             case HIDDEN:
             case IMAGE:
             case ISINDEX:
+            case MONTH:
             case NUMBER:
             case PASSWORD:
             case RADIO:
@@ -1114,7 +1529,9 @@ String HTMLInputElement::valueWithDefault() const
             case SEARCH:
             case TELEPHONE:
             case TEXT:
+            case TIME:
             case URL:
+            case WEEK:
                 break;
             case RESET:
                 v = resetButtonDefaultLabel();
@@ -1127,7 +1544,30 @@ String HTMLInputElement::valueWithDefault() const
     return v;
 }
 
-void HTMLInputElement::setValue(const String& value)
+void HTMLInputElement::setValueForUser(const String& value)
+{
+    // Call setValue and make it send a change event.
+    setValue(value, true);
+}
+
+const String& HTMLInputElement::suggestedValue() const
+{
+    return m_data.suggestedValue();
+}
+
+void HTMLInputElement::setSuggestedValue(const String& value)
+{
+    if (inputType() != TEXT)
+        return;
+    setFormControlValueMatchesRenderer(false);
+    m_data.setSuggestedValue(sanitizeValue(value));
+    updatePlaceholderVisibility(false);
+    if (renderer())
+        renderer()->updateFromElement();
+    setNeedsStyleRecalc();
+}
+
+void HTMLInputElement::setValue(const String& value, bool sendChangeEvent)
 {
     // For security reasons, we don't allow setting the filename, but we do allow clearing it.
     // The HTML5 spec (as of the 10/24/08 working draft) says that the value attribute isn't applicable to the file upload control
@@ -1137,10 +1577,14 @@ void HTMLInputElement::setValue(const String& value)
 
     setFormControlValueMatchesRenderer(false);
     if (storesValueSeparateFromAttribute()) {
-        if (inputType() == FILE)
+        if (inputType() == FILE) {
             m_fileList->clear();
-        else {
+            setNeedsValidityCheck();
+        } else {
             m_data.setValue(sanitizeValue(value));
+            // setNeedsValidityCheck() needs to be called after updating the value,
+            // before style recalc.
+            setNeedsValidityCheck();
             if (isTextField()) {
                 updatePlaceholderVisibility(false);
                 if (inDocument())
@@ -1150,18 +1594,336 @@ void HTMLInputElement::setValue(const String& value)
         if (renderer())
             renderer()->updateFromElement();
         setNeedsStyleRecalc();
-    } else
+    } else {
         setAttribute(valueAttr, sanitizeValue(value));
-    
+        setNeedsValidityCheck();
+    }
+
     if (isTextField()) {
         unsigned max = m_data.value().length();
         if (document()->focusedNode() == this)
             InputElement::updateSelectionRange(this, this, max, max);
         else
             cacheSelection(max, max);
+        m_data.setSuggestedValue(String());
     }
+
+    // Don't dispatch the change event when focused, it will be dispatched
+    // when the control loses focus.
+    if (sendChangeEvent && document()->focusedNode() != this)
+        dispatchFormControlChangeEvent();
+
     InputElement::notifyFormStateChanged(this);
-    updateValidity();
+}
+
+double HTMLInputElement::parseToDouble(const String& src, double defaultValue) const
+{
+    switch (inputType()) {
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
+    case TIME:
+    case WEEK: {
+        DateComponents date;
+        if (!parseToDateComponents(inputType(), src, &date))
+            return defaultValue;
+        double msec = date.millisecondsSinceEpoch();
+        ASSERT(isfinite(msec));
+        return msec;
+    }
+    case MONTH: {
+        DateComponents date;
+        if (!parseToDateComponents(inputType(), src, &date))
+            return defaultValue;
+        double months = date.monthsSinceEpoch();
+        ASSERT(isfinite(months));
+        return months;
+    }
+    case NUMBER:
+    case RANGE: {
+        double numberValue;
+        if (!parseToDoubleForNumberType(src, &numberValue))
+            return defaultValue;
+        ASSERT(isfinite(numberValue));
+        return numberValue;
+    }
+
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        return defaultValue;
+    }
+    ASSERT_NOT_REACHED();
+    return defaultValue;
+}
+
+double HTMLInputElement::valueAsDate() const
+{
+    switch (inputType()) {
+    case DATE:
+    case DATETIME:
+    case TIME:
+    case WEEK:
+        return parseToDouble(value(), DateComponents::invalidMilliseconds());
+    case MONTH: {
+        DateComponents date;
+        if (!parseToDateComponents(inputType(), value(), &date))
+            return DateComponents::invalidMilliseconds();
+        double msec = date.millisecondsSinceEpoch();
+        ASSERT(isfinite(msec));
+        return msec;
+    }
+
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case DATETIMELOCAL: // valueAsDate doesn't work for the DATETIMELOCAL type according to the standard.
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case NUMBER:
+    case PASSWORD:
+    case RADIO:
+    case RANGE:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        return DateComponents::invalidMilliseconds();
+    }
+    ASSERT_NOT_REACHED();
+    return DateComponents::invalidMilliseconds();
+}
+
+void HTMLInputElement::setValueAsDate(double value, ExceptionCode& ec)
+{
+    switch (inputType()) {
+    case DATE:
+    case DATETIME:
+    case TIME:
+    case WEEK:
+        setValue(serializeForDateTimeTypes(value));
+        return;
+    case MONTH: {
+        DateComponents date;
+        if (!date.setMillisecondsSinceEpochForMonth(value)) {
+            setValue(String());
+            return;
+        }
+        setValue(date.toString());
+        return;
+    }
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case DATETIMELOCAL: // valueAsDate doesn't work for the DATETIMELOCAL type according to the standard.
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case NUMBER:
+    case PASSWORD:
+    case RADIO:
+    case RANGE:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+double HTMLInputElement::valueAsNumber() const
+{
+    const double nan = numeric_limits<double>::quiet_NaN();
+    switch (inputType()) {
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
+    case MONTH:
+    case NUMBER:
+    case RANGE:
+    case TIME:
+    case WEEK:
+        return parseToDouble(value(), nan);
+
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        return nan;
+    }
+    ASSERT_NOT_REACHED();
+    return nan;
+}
+
+void HTMLInputElement::setValueAsNumber(double newValue, ExceptionCode& ec)
+{
+    if (!isfinite(newValue)) {
+        ec = NOT_SUPPORTED_ERR;
+        return;
+    }
+    switch (inputType()) {
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
+    case MONTH:
+    case NUMBER:
+    case RANGE:
+    case TIME:
+    case WEEK:
+        setValue(serialize(newValue));
+        return;
+
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+String HTMLInputElement::serializeForDateTimeTypes(double value) const
+{
+    bool success = false;
+    DateComponents date;
+    switch (inputType()) {
+    case DATE:
+        success = date.setMillisecondsSinceEpochForDate(value);
+        break;
+    case DATETIME:
+        success = date.setMillisecondsSinceEpochForDateTime(value);
+        break;
+    case DATETIMELOCAL:
+        success = date.setMillisecondsSinceEpochForDateTimeLocal(value);
+        break;
+    case MONTH:
+        success = date.setMonthsSinceEpoch(value);
+        break;
+    case TIME:
+        success = date.setMillisecondsSinceMidnight(value);
+        break;
+    case WEEK:
+        success = date.setMillisecondsSinceEpochForWeek(value);
+        break;
+    case NUMBER:
+    case RANGE:
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        ASSERT_NOT_REACHED();
+        return String();
+    }
+    if (!success)
+        return String();
+
+    double step;
+    if (!getAllowedValueStep(&step))
+        return date.toString();
+    if (!fmod(step, msecPerMinute))
+        return date.toString(DateComponents::None);
+    if (!fmod(step, msecPerSecond))
+        return date.toString(DateComponents::Second);
+    return date.toString(DateComponents::Millisecond);
+}
+
+String HTMLInputElement::serialize(double value) const
+{
+    if (!isfinite(value))
+        return String();
+    switch (inputType()) {
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
+    case MONTH:
+    case TIME:
+    case WEEK:
+        return serializeForDateTimeTypes(value);
+    case NUMBER:
+    case RANGE:
+        return serializeForNumberType(value);
+
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        break;
+    }
+    ASSERT_NOT_REACHED();
+    return String();
 }
 
 String HTMLInputElement::placeholder() const
@@ -1183,9 +1945,10 @@ void HTMLInputElement::setValueFromRenderer(const String& value)
 {
     // File upload controls will always use setFileListFromRenderer.
     ASSERT(inputType() != FILE);
+    m_data.setSuggestedValue(String());
     updatePlaceholderVisibility(false);
     InputElement::setValueFromRenderer(m_data, this, this, value);
-    updateValidity();
+    setNeedsValidityCheck();
 }
 
 void HTMLInputElement::setFileListFromRenderer(const Vector<String>& paths)
@@ -1197,7 +1960,7 @@ void HTMLInputElement::setFileListFromRenderer(const Vector<String>& paths)
 
     setFormControlValueMatchesRenderer(true);
     InputElement::notifyFormStateChanged(this);
-    updateValidity();
+    setNeedsValidityCheck();
 }
 
 bool HTMLInputElement::storesValueSeparateFromAttribute() const
@@ -1212,21 +1975,37 @@ bool HTMLInputElement::storesValueSeparateFromAttribute() const
         case SUBMIT:
             return false;
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case FILE:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case PASSWORD:
         case RANGE:
         case SEARCH:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             return true;
     }
     return false;
 }
 
+struct EventHandlingState {
+    RefPtr<HTMLInputElement> m_currRadio;
+    bool m_indeterminate;
+    bool m_checked;
+    
+    EventHandlingState(bool indeterminate, bool checked)
+        : m_indeterminate(indeterminate)
+        , m_checked(checked) { }
+};
+
 void* HTMLInputElement::preDispatchEventHandler(Event *evt)
 {
     // preventDefault or "return false" are used to reverse the automatic checking/selection we do here.
@@ -1234,17 +2013,14 @@ void* HTMLInputElement::preDispatchEventHandler(Event *evt)
     void* result = 0; 
     if ((inputType() == CHECKBOX || inputType() == RADIO) && evt->isMouseEvent()
             && evt->type() == eventNames().clickEvent && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
+        
+        EventHandlingState* state = new EventHandlingState(indeterminate(), checked());
+
         if (inputType() == CHECKBOX) {
-            // As a way to store the state, we return 0 if we were unchecked, 1 if we were checked, and 2 for
-            // indeterminate.
-            if (indeterminate()) {
-                result = (void*)0x2;
+            if (indeterminate())
                 setIndeterminate(false);
-            } else {
-                if (checked())
-                    result = (void*)0x1;
+            else
                 setChecked(!checked(), true);
-            }
         } else {
             // For radio buttons, store the current selected radio object.
             // We really want radio groups to end up in sane states, i.e., to have something checked.
@@ -1254,11 +2030,13 @@ void* HTMLInputElement::preDispatchEventHandler(Event *evt)
             if (currRadio) {
                 // We have a radio button selected that is not us.  Cache it in our result field and ref it so
                 // that it can't be destroyed.
-                currRadio->ref();
-                result = currRadio;
+                state->m_currRadio = currRadio;
             }
+            if (indeterminate())
+                setIndeterminate(false);
             setChecked(true, true);
         }
+        result = state;
     }
     return result;
 }
@@ -1267,28 +2045,30 @@ void HTMLInputElement::postDispatchEventHandler(Event *evt, void* data)
 {
     if ((inputType() == CHECKBOX || inputType() == RADIO) && evt->isMouseEvent()
             && evt->type() == eventNames().clickEvent && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
-        if (inputType() == CHECKBOX) {
-            // Reverse the checking we did in preDispatch.
-            if (evt->defaultPrevented() || evt->defaultHandled()) {
-                if (data == (void*)0x2)
-                    setIndeterminate(true);
-                else
-                    setChecked(data);
-            }
-        } else if (data) {
-            HTMLInputElement* input = static_cast<HTMLInputElement*>(data);
-            if (evt->defaultPrevented() || evt->defaultHandled()) {
-                // Restore the original selected radio button if possible.
-                // Make sure it is still a radio button and only do the restoration if it still
-                // belongs to our group.
-
-                if (input->form() == form() && input->inputType() == RADIO && input->name() == name()) {
-                    // Ok, the old radio button is still in our form and in our group and is still a 
-                    // radio button, so it's safe to restore selection to it.
-                    input->setChecked(true);
+        
+        if (EventHandlingState* state = reinterpret_cast<EventHandlingState*>(data)) {
+            if (inputType() == CHECKBOX) {
+                // Reverse the checking we did in preDispatch.
+                if (evt->defaultPrevented() || evt->defaultHandled()) {
+                    setIndeterminate(state->m_indeterminate);
+                    setChecked(state->m_checked);
+                }
+            } else {
+                HTMLInputElement* input = state->m_currRadio.get();
+                if (evt->defaultPrevented() || evt->defaultHandled()) {
+                    // Restore the original selected radio button if possible.
+                    // Make sure it is still a radio button and only do the restoration if it still
+                    // belongs to our group.
+
+                    if (input && input->form() == form() && input->inputType() == RADIO && input->name() == name()) {
+                        // Ok, the old radio button is still in our form and in our group and is still a 
+                        // radio button, so it's safe to restore selection to it.
+                        input->setChecked(true);
+                    }
+                    setIndeterminate(state->m_indeterminate);
                 }
             }
-            input->deref();
+            delete state;
         }
 
         // Left clicks on radio buttons and check boxes already performed default actions in preDispatchEventHandler(). 
@@ -1388,16 +2168,22 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
             switch (inputType()) {
                 case CHECKBOX:
                 case COLOR:
+                case DATE:
+                case DATETIME:
+                case DATETIMELOCAL:
                 case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
+                case MONTH:
                 case NUMBER:
                 case PASSWORD:
                 case RANGE:
                 case SEARCH:
                 case TELEPHONE:
                 case TEXT:
+                case TIME:
                 case URL:
+                case WEEK:
                     // Simulate mouse click on the default form button for enter for these types of elements.
                     clickDefaultFormButton = true;
                     break;
@@ -1516,16 +2302,22 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
                         clickElement = true;
                     break;
                 case COLOR:
+                case DATE:
+                case DATETIME:
+                case DATETIMELOCAL:
                 case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
+                case MONTH:
                 case NUMBER:
                 case PASSWORD:
                 case RANGE:
                 case SEARCH:
                 case TELEPHONE:
                 case TEXT:
+                case TIME:
                 case URL:
+                case WEEK:
                     break;
             }
         }
@@ -1545,12 +2337,12 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         }
         // Fire onChange for text fields.
         RenderObject* r = renderer();
-        if (r && r->isTextField() && toRenderTextControl(r)->isEdited()) {
+        if (r && r->isTextField() && toRenderTextControl(r)->wasChangedSinceLastChangeEvent()) {
             dispatchFormControlChangeEvent();
             // Refetch the renderer since arbitrary JS code run during onchange can do anything, including destroying it.
             r = renderer();
             if (r && r->isTextField())
-                toRenderTextControl(r)->setEdited(false);
+                toRenderTextControl(r)->setChangedSinceLastChangeEvent(false);
         }
 
         RefPtr<HTMLFormElement> formForSubmission = form();
@@ -1730,6 +2522,13 @@ String HTMLInputElement::sanitizeValue(const String& proposedValue) const
 {
     if (isTextField())
         return InputElement::sanitizeValue(this, proposedValue);
+
+    // If the proposedValue is null than this is a reset scenario and we
+    // want the range input's value attribute to take priority over the
+    // calculated default (middle) value.
+    if (inputType() == RANGE && !proposedValue.isNull())
+        return serializeForNumberType(StepRange(this).clampValue(proposedValue));
+
     return proposedValue;
 }
 
@@ -1756,25 +2555,31 @@ bool HTMLInputElement::isRequiredFormControl() const
         return false;
 
     switch (inputType()) {
-        case TEXT:
-        case SEARCH:
-        case URL:
-        case TELEPHONE:
+        case CHECKBOX:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
-        case PASSWORD:
+        case FILE:
+        case MONTH:
         case NUMBER:
-        case CHECKBOX:
+        case PASSWORD:
         case RADIO:
-        case FILE:
+        case SEARCH:
+        case TELEPHONE:
+        case TEXT:
+        case TIME:
+        case URL:
+        case WEEK:
             return true;
-        case HIDDEN:
-        case RANGE:
-        case SUBMIT:
-        case IMAGE:
-        case RESET:
         case BUTTON:
         case COLOR:
+        case HIDDEN:
+        case IMAGE:
         case ISINDEX:
+        case RANGE:
+        case RESET:
+        case SUBMIT:
             return false;
     }
 
@@ -1834,14 +2639,23 @@ void HTMLInputElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) cons
     addSubresourceURL(urls, src());
 }
 
-bool HTMLInputElement::willValidate() const
+bool HTMLInputElement::recalcWillValidate() const
 {
-    // FIXME: This shall check for new WF2 input types too
-    return HTMLFormControlElementWithState::willValidate() && inputType() != HIDDEN &&
-           inputType() != BUTTON && inputType() != RESET;
+    return HTMLFormControlElementWithState::recalcWillValidate()
+        && inputType() != HIDDEN && inputType() != BUTTON && inputType() != RESET;
 }
 
-bool HTMLInputElement::formStringToDouble(const String& src, double* out)
+String HTMLInputElement::serializeForNumberType(double number)
+{
+    // According to HTML5, "the best representation of the number n as a floating
+    // point number" is a string produced by applying ToString() to n.
+    DtoaBuffer buffer;
+    unsigned length;
+    doubleToStringInJavaScriptFormat(number, buffer, &length);
+    return String(buffer, length);
+}
+
+bool HTMLInputElement::parseToDoubleForNumberType(const String& src, double* out)
 {
     // See HTML5 2.4.4.3 `Real numbers.'
 
@@ -1857,13 +2671,46 @@ bool HTMLInputElement::formStringToDouble(const String& src, double* out)
     if (!valid)
         return false;
     // NaN and Infinity are not valid numbers according to the standard.
-    if (isnan(value) || isinf(value))
+    if (!isfinite(value))
         return false;
+    // -0 -> 0
+    if (!value)
+        value = 0;
     if (out)
         *out = value;
     return true;
 }
 
+bool HTMLInputElement::parseToDateComponents(InputType type, const String& formString, DateComponents* out)
+{
+    if (formString.isEmpty())
+        return false;
+    DateComponents ignoredResult;
+    if (!out)
+        out = &ignoredResult;
+    const UChar* characters = formString.characters();
+    unsigned length = formString.length();
+    unsigned end;
+
+    switch (type) {
+    case DATE:
+        return out->parseDate(characters, length, 0, end) && end == length;
+    case DATETIME:
+        return out->parseDateTime(characters, length, 0, end) && end == length;
+    case DATETIMELOCAL:
+        return out->parseDateTimeLocal(characters, length, 0, end) && end == length;
+    case MONTH:
+        return out->parseMonth(characters, length, 0, end) && end == length;
+    case WEEK:
+        return out->parseWeek(characters, length, 0, end) && end == length;
+    case TIME:
+        return out->parseTime(characters, length, 0, end) && end == length;
+    default:
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+}
+
 #if ENABLE(DATALIST)
 HTMLElement* HTMLInputElement::list() const
 {
@@ -1876,29 +2723,35 @@ HTMLDataListElement* HTMLInputElement::dataList() const
         return 0;
 
     switch (inputType()) {
-    case TEXT:
-    case SEARCH:
-    case URL:
-    case TELEPHONE:
+    case COLOR:
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
     case EMAIL:
+    case MONTH:
     case NUMBER:
     case RANGE:
-    case COLOR: {
+    case SEARCH:
+    case TELEPHONE:
+    case TEXT:
+    case TIME:
+    case URL:
+    case WEEK: {
         Element* element = document()->getElementById(getAttribute(listAttr));
         if (element && element->hasTagName(datalistTag))
             return static_cast<HTMLDataListElement*>(element);
         break;
     }
-    case HIDDEN:
-    case PASSWORD:
+    case BUTTON:
     case CHECKBOX:
-    case RADIO:
     case FILE:
-    case SUBMIT:
+    case HIDDEN:
     case IMAGE:
-    case RESET:
-    case BUTTON:
     case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SUBMIT:
         break;
     }
     return 0;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
index 0e2da32949..c3b0a734fc 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
@@ -30,6 +30,7 @@
 
 namespace WebCore {
 
+class DateComponents;
 class FileList;
 class HTMLDataListElement;
 class HTMLImageLoader;
@@ -40,7 +41,7 @@ class VisibleSelection;
 class HTMLInputElement : public HTMLTextFormControlElement, public InputElement {
 public:
     enum InputType {
-        TEXT,
+        TEXT = 0, // TEXT must be 0.
         PASSWORD,
         ISINDEX,
         CHECKBOX,
@@ -57,9 +58,17 @@ public:
         NUMBER,
         TELEPHONE,
         URL,
-        COLOR
+        COLOR,
+        DATE,
+        DATETIME,
+        DATETIMELOCAL,
+        MONTH,
+        TIME,
+        WEEK,
+        // If you add new types or change the order of enum values, update numberOfTypes below.
     };
-    
+    static const int numberOfTypes = WEEK + 1;
+
     enum AutoCompleteSetting {
         Uninitialized,
         On,
@@ -97,29 +106,53 @@ public:
     // For ValidityState
     bool rangeUnderflow() const;
     bool rangeOverflow() const;
-    // Returns the minimum value for type=range.  Don't call this for other types.
-    double rangeMinimum() const;
-    // Returns the maximum value for type=range.  Don't call this for other types.
-    // This always returns a value which is <= rangeMinimum().
-    double rangeMaximum() const;
+    // Returns the minimum value for type=date, number, or range.  Don't call this for other types.
+    double minimum() const;
+    // Returns the maximum value for type=date, number, or range.  Don't call this for other types.
+    // This always returns a value which is >= minimum().
+    double maximum() const;
+    // Sets the "allowed value step" defined in the HTML spec to the specified double pointer.
+    // Returns false if there is no "allowed value step."
+    bool getAllowedValueStep(double*) const;
+    // For ValidityState.
+    bool stepMismatch() const;
+    // Implementations of HTMLInputElement::stepUp() and stepDown().
+    void stepUp(int, ExceptionCode&);
+    void stepDown(int, ExceptionCode&);
+    void stepUp(ExceptionCode& ec) { stepUp(1, ec); }
+    void stepDown(ExceptionCode& ec) { stepDown(1, ec); }
 
     bool isTextButton() const { return m_type == SUBMIT || m_type == RESET || m_type == BUTTON; }
     virtual bool isRadioButton() const { return m_type == RADIO; }
-    virtual bool isTextField() const { return m_type == TEXT || m_type == PASSWORD || m_type == SEARCH || m_type == ISINDEX || m_type == EMAIL || m_type == NUMBER || m_type == TELEPHONE || m_type == URL || m_type == COLOR; }
+    virtual bool isTextField() const;
     virtual bool isSearchField() const { return m_type == SEARCH; }
     virtual bool isInputTypeHidden() const { return m_type == HIDDEN; }
     virtual bool isPasswordField() const { return m_type == PASSWORD; }
 
     bool checked() const { return m_checked; }
     void setChecked(bool, bool sendChangeEvent = false);
+
+    // 'indeterminate' is a state independent of the checked state that causes the control to draw in a way that hides the actual state.
+    bool allowsIndeterminate() const { return inputType() == CHECKBOX || inputType() == RADIO; }
     bool indeterminate() const { return m_indeterminate; }
     void setIndeterminate(bool);
+
     virtual int size() const;
     virtual const AtomicString& formControlType() const;
     void setType(const String&);
 
+    virtual const String& suggestedValue() const;
+    void setSuggestedValue(const String&);
+
     virtual String value() const;
-    virtual void setValue(const String&);
+    virtual void setValue(const String&, bool sendChangeEvent = false);
+    virtual void setValueForUser(const String&);
+
+    double valueAsDate() const;
+    void setValueAsDate(double, ExceptionCode&);
+
+    double valueAsNumber() const;
+    void setValueAsNumber(double, ExceptionCode&);
 
     virtual String placeholder() const;
     virtual void setPlaceholder(const String&);
@@ -228,12 +261,17 @@ public:
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
     
-    virtual bool willValidate() const;
-
     // Converts the specified string to a floating number.
     // If the conversion fails, the return value is false. Take care that leading or trailing unnecessary characters make failures.  This returns false for an empty string input.
     // The double* parameter may be 0.
-    static bool formStringToDouble(const String&, double*);
+    static bool parseToDoubleForNumberType(const String&, double*);
+    // Converts the specified number to a string. This is an implementation of
+    // HTML5's "algorithm to convert a number to a string" for NUMBER/RANGE types.
+    static String serializeForNumberType(double);
+    // Parses the specified string as the InputType, and returns true if it is successfully parsed.
+    // An instance pointed by the DateComponents* parameter will have parsed values and be
+    // modified even if the parsing fails.  The DateComponents* parameter may be 0.
+    static bool parseToDateComponents(InputType, const String&, DateComponents*);
     
 protected:
     virtual void willMoveToNewOwnerDocument();
@@ -255,8 +293,29 @@ private:
 
     virtual bool isOptionalFormControl() const { return !isRequiredFormControl(); }
     virtual bool isRequiredFormControl() const;
+    virtual bool recalcWillValidate() const;
 
     PassRefPtr<HTMLFormElement> createTemporaryFormForIsIndex();
+    // Helper for getAllowedValueStep();
+    bool getStepParameters(double* defaultStep, double* stepScaleFactor) const;
+    // Helper for stepUp()/stepDown().  Adds step value * count to the current value.
+    void applyStep(double count, ExceptionCode&);
+    // Helper for applyStepForNumberOrRange().
+    double stepBase() const;
+
+    // Parses the specified string for the current type, and return
+    // the double value for the parsing result if the parsing
+    // succeeds; Returns defaultValue otherwise. This function can
+    // return NaN or Infinity only if defaultValue is NaN or Infinity.
+    double parseToDouble(const String&, double defaultValue) const;
+    // Create a string representation of the specified double value for the
+    // current input type. If NaN or Infinity is specified, this returns an
+    // emtpy string. This should not be called for types without valueAsNumber.
+    String serialize(double) const;
+    // Create a string representation of the specified double value for the
+    // current input type. The type must be one of DATE, DATETIME,
+    // DATETIMELOCAL, MONTH, TIME, and WEEK.
+    String serializeForDateTimeTypes(double) const;
 
 #if ENABLE(DATALIST)
     HTMLDataListElement* dataList() const;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
index 59248f4459..4563120d9e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
@@ -20,18 +20,12 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=8f388ea3-1c31-4cca-8edd-449d14e222e1,
-        ImplementationUUID=aeb56b87-a90e-4d9d-a4d5-7eec3687c338
-    ] HTMLInputElement : HTMLElement {
+    interface HTMLInputElement : HTMLElement {
                  attribute [ConvertNullToNullString] DOMString defaultValue;
                  attribute boolean         defaultChecked;
         readonly attribute HTMLFormElement form;
                  attribute boolean         formNoValidate;
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute ValidityState   validity;
-#endif
                  attribute [ConvertNullToNullString] DOMString accept;
                  attribute [ConvertNullToNullString] DOMString accessKey;
                  attribute [ConvertNullToNullString] DOMString align;
@@ -42,17 +36,13 @@ module html {
 #if defined(ENABLE_DATALIST) && ENABLE_DATALIST
         readonly attribute HTMLElement     list;
 #endif
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
-                 attribute [Reflect] DOMString max;
-#endif
+                 attribute [ConvertNullToNullString, Reflect] DOMString max;
                  attribute long            maxLength
                      setter raises(DOMException);
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
-                 attribute [Reflect] DOMString min;
-#endif
+                 attribute [ConvertNullToNullString, Reflect] DOMString min;
                  attribute boolean         multiple;
                  attribute [ConvertNullToNullString] DOMString name;
-                 attribute [Reflect] DOMString       pattern;
+                 attribute [ConvertNullToNullString, Reflect] DOMString pattern;
                  attribute DOMString       placeholder;
                  attribute boolean         readOnly;
                  attribute boolean         required;
@@ -63,18 +53,32 @@ module html {
                  attribute unsigned long   size; // Changed string -> long as part of DOM level 2
 #endif
                  attribute [ConvertNullToNullString] DOMString src;
+                 attribute [ConvertNullToNullString, Reflect] DOMString step;
                  attribute [ConvertNullToNullString, JSCCustomGetter] DOMString type; // readonly dropped as part of DOM level 2
                  attribute [ConvertNullToNullString] DOMString useMap;
                  attribute [ConvertNullToNullString] DOMString value;
+                 attribute Date            valueAsDate setter raises(DOMException);
+                 attribute double          valueAsNumber setter raises(DOMException);
 #if defined(ENABLE_DATALIST) && ENABLE_DATALIST
         readonly attribute HTMLOptionElement selectedOption;
 #endif
+
+        void               stepUp(in [Optional] long n)
+            raises(DOMException);
+        void               stepDown(in [Optional] long n)
+            raises(DOMException);
+
         readonly attribute boolean         willValidate;
+        readonly attribute DOMString       validationMessage;
         boolean            checkValidity();
         void               setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
         void               select();
         void               click();
-        
+
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
+        void               setValueForUser(in [ConvertNullToNullString] DOMString value);
+#endif
+
         // WinIE extension:
                  attribute boolean         indeterminate;
 
@@ -90,9 +94,7 @@ module html {
         readonly attribute URL             absoluteImageURL;
 #endif
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute FileList files;
-#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.idl
index 1e978b2918..d968fa71ac 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=94fc4e39-4d81-44e3-a37d-364553b23a37,
-        ImplementationUUID=b31d409b-8f68-495d-a0c2-b81520716974
-    ] HTMLIsIndexElement : HTMLInputElement {
+    interface HTMLIsIndexElement : HTMLInputElement {
         readonly attribute HTMLFormElement form;
         attribute [ConvertNullToNullString] DOMString prompt;
     };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLIElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLLIElement.idl
index 015454e5ac..946ec18519 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLIElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLIElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=83a4a75c-4427-4f53-b974-8107fedb4c2b,
-        ImplementationUUID=5747808d-8cbd-49c9-b89b-3fdc315c55fe
-    ] HTMLLIElement : HTMLElement {
+    interface HTMLLIElement : HTMLElement {
         attribute [ConvertNullToNullString] DOMString type;
         attribute long value;    
     };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.cpp
index 06b3b2fd2e..645017d1f4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.cpp
@@ -139,6 +139,8 @@ void HTMLLabelElement::accessKeyAction(bool sendToAnyElement)
 {
     if (HTMLElement* element = correspondingControl())
         element->accessKeyAction(sendToAnyElement);
+    else
+        HTMLElement::accessKeyAction(sendToAnyElement);
 }
 
 String HTMLLabelElement::accessKey() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.idl
index 85b7ef3313..3b25fa94d8 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.idl
@@ -20,11 +20,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=9978d8e6-1d27-4390-bd2f-56f0e72f16e3,
-        ImplementationUUID=165b7633-0377-4853-a647-2b9005f5aaec
-    ] HTMLLabelElement : HTMLElement {
+    interface HTMLLabelElement : HTMLElement {
         readonly attribute HTMLFormElement form;
         attribute [ConvertNullToNullString] DOMString accessKey;
         attribute [ConvertNullToNullString] DOMString htmlFor;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.idl
index da00cc12b3..ee21e4c403 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.idl
@@ -20,11 +20,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=a6eb4254-6066-465a-a1c0-b4732281c255,
-        ImplementationUUID=323e883c-edf8-4b13-a165-8604f4f06ae2
-    ] HTMLLegendElement : HTMLElement {
+    interface HTMLLegendElement : HTMLElement {
         readonly attribute HTMLFormElement form;
         attribute [ConvertNullToNullString] DOMString accessKey;
         attribute [ConvertNullToNullString] DOMString align;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
index 6b7422121e..e73a360757 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
@@ -26,7 +26,6 @@
 
 #include "CSSHelper.h"
 #include "CachedCSSStyleSheet.h"
-#include "DNS.h"
 #include "DocLoader.h"
 #include "Document.h"
 #include "Frame.h"
@@ -38,8 +37,10 @@
 #include "MediaList.h"
 #include "MediaQueryEvaluator.h"
 #include "Page.h"
+#include "ResourceHandle.h"
 #include "ScriptEventListener.h"
 #include "Settings.h"
+#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
@@ -182,13 +183,13 @@ void HTMLLinkElement::process()
         document()->setIconURL(m_url.string(), type);
 
     if (m_isDNSPrefetch && m_url.isValid() && !m_url.isEmpty())
-        prefetchDNS(m_url.host());
+        ResourceHandle::prepareForURL(m_url);
 
     bool acceptIfTypeContainsTextCSS = document()->page() && document()->page()->settings() && document()->page()->settings()->treatsAnyTextCSSLinkAsStylesheet();
 
     // Stylesheet
     // This was buggy and would incorrectly match <link rel="alternate">, which has a different specified meaning. -dwh
-    if (m_disabledState != 2 && (m_isStyleSheet || acceptIfTypeContainsTextCSS && type.contains("text/css")) && document()->frame() && m_url.isValid()) {
+    if (m_disabledState != 2 && (m_isStyleSheet || (acceptIfTypeContainsTextCSS && type.contains("text/css"))) && document()->frame() && m_url.isValid()) {
         // also, don't load style sheets for standalone documents
         
         String charset = getAttribute(charsetAttr);
@@ -253,28 +254,50 @@ void HTMLLinkElement::finishParsingChildren()
     HTMLElement::finishParsingChildren();
 }
 
-void HTMLLinkElement::setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet* sheet)
+void HTMLLinkElement::setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CachedCSSStyleSheet* sheet)
 {
-    m_sheet = CSSStyleSheet::create(this, url, charset);
+    m_sheet = CSSStyleSheet::create(this, href, baseURL, charset);
 
     bool strictParsing = !document()->inCompatMode();
     bool enforceMIMEType = strictParsing;
+    bool crossOriginCSS = false;
+    bool validMIMEType = false;
+    bool needsSiteSpecificQuirks = document()->page() && document()->page()->settings()->needsSiteSpecificQuirks();
 
     // Check to see if we should enforce the MIME type of the CSS resource in strict mode.
     // Running in iWeb 2 is one example of where we don't want to - <rdar://problem/6099748>
     if (enforceMIMEType && document()->page() && !document()->page()->settings()->enforceCSSMIMETypeInStrictMode())
         enforceMIMEType = false;
 
-    String sheetText = sheet->sheetText(enforceMIMEType);
+#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD)
+    if (enforceMIMEType && needsSiteSpecificQuirks) {
+        // Covers both http and https, with or without "www."
+        if (baseURL.string().contains("mcafee.com/japan/", false))
+            enforceMIMEType = false;
+    }
+#endif
+
+    String sheetText = sheet->sheetText(enforceMIMEType, &validMIMEType);
     m_sheet->parseString(sheetText, strictParsing);
 
-    if (strictParsing && document()->settings() && document()->settings()->needsSiteSpecificQuirks()) {
+    // If we're loading a stylesheet cross-origin, and the MIME type is not
+    // standard, require the CSS to at least start with a syntactically
+    // valid CSS rule.
+    // This prevents an attacker playing games by injecting CSS strings into
+    // HTML, XML, JSON, etc. etc.
+    if (!document()->securityOrigin()->canRequest(baseURL))
+        crossOriginCSS = true;
+
+    if (crossOriginCSS && !validMIMEType && !m_sheet->hasSyntacticallyValidCSSHeader())
+        m_sheet = CSSStyleSheet::create(this, href, baseURL, charset);
+
+    if (strictParsing && needsSiteSpecificQuirks) {
         // Work around <https://bugs.webkit.org/show_bug.cgi?id=28350>.
         DEFINE_STATIC_LOCAL(const String, slashKHTMLFixesDotCss, ("/KHTMLFixes.css"));
         DEFINE_STATIC_LOCAL(const String, mediaWikiKHTMLFixesStyleSheet, ("/* KHTML fix stylesheet */\n/* work around the horizontal scrollbars */\n#column-content { margin-left: 0; }\n\n"));
         // There are two variants of KHTMLFixes.css. One is equal to mediaWikiKHTMLFixesStyleSheet,
         // while the other lacks the second trailing newline.
-        if (url.endsWith(slashKHTMLFixesDotCss) && !sheetText.isNull() && mediaWikiKHTMLFixesStyleSheet.startsWith(sheetText)
+        if (baseURL.string().endsWith(slashKHTMLFixesDotCss) && !sheetText.isNull() && mediaWikiKHTMLFixesStyleSheet.startsWith(sheetText)
                 && sheetText.length() >= mediaWikiKHTMLFixesStyleSheet.length() - 1) {
             ASSERT(m_sheet->length() == 1);
             ExceptionCode ec;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.h b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.h
index aacac92996..5d4e2dc0dd 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.h
@@ -79,7 +79,7 @@ public:
     virtual void removedFromDocument();
 
     // from CachedResourceClient
-    virtual void setCSSStyleSheet(const String &url, const String& charset, const CachedCSSStyleSheet* sheet);
+    virtual void setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CachedCSSStyleSheet* sheet);
     bool isLoading() const;
     virtual bool sheetLoaded();
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.idl
index 98de809e6f..dc700dff2b 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.idl
@@ -20,11 +20,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=a9e9ef29-f20b-429d-848e-e5dadd32694a,
-        ImplementationUUID=2d9b944e-88e3-451a-8640-06c593c339a8
-    ] HTMLLinkElement : HTMLElement {
+    interface HTMLLinkElement : HTMLElement {
         attribute  boolean              disabled;
         attribute  [ConvertNullToNullString] DOMString            charset;
         attribute  [ConvertNullToNullString] DOMString            href;
@@ -35,10 +31,8 @@ module html {
         attribute  [ConvertNullToNullString] DOMString            target;
         attribute  [ConvertNullToNullString] DOMString            type;
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // DOM Level 2 Style
         readonly attribute StyleSheet   sheet;
-#endif
 
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMapElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMapElement.cpp
index 90204e0477..10a05d6c7b 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMapElement.cpp
@@ -25,10 +25,12 @@
 #include "Document.h"
 #include "HTMLAreaElement.h"
 #include "HTMLCollection.h"
+#include "HTMLImageElement.h"
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "IntSize.h"
 #include "MappedAttribute.h"
+#include "RenderObject.h"
 
 using namespace std;
 
@@ -75,12 +77,30 @@ bool HTMLMapElement::mapMouseEvent(int x, int y, const IntSize& size, HitTestRes
     return defaultArea;
 }
 
+HTMLImageElement* HTMLMapElement::imageElement() const
+{
+    RefPtr<HTMLCollection> coll = document()->images();
+    for (Node* curr = coll->firstItem(); curr; curr = coll->nextItem()) {
+        if (!curr->hasTagName(imgTag))
+            continue;
+        
+        // The HTMLImageElement's useMap() value includes the '#' symbol at the beginning,
+        // which has to be stripped off.
+        HTMLImageElement* imageElement = static_cast<HTMLImageElement*>(curr);
+        String useMapName = imageElement->getAttribute(usemapAttr).string().substring(1);
+        if (equalIgnoringCase(useMapName, m_name))
+            return imageElement;
+    }
+    
+    return 0;    
+}
+    
 void HTMLMapElement::parseMappedAttribute(MappedAttribute* attr)
 {
     const QualifiedName& attrName = attr->name();
-    if (attrName == idAttr || attrName == nameAttr) {
+    if (attrName == idAttributeName() || attrName == nameAttr) {
         Document* doc = document();
-        if (attrName == idAttr) {
+        if (attrName == idAttributeName()) {
             // Call base class so that hasID bit gets set.
             HTMLElement::parseMappedAttribute(attr);
             if (doc->isHTMLDocument())
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMapElement.h b/src/3rdparty/webkit/WebCore/html/HTMLMapElement.h
index 2a6eb8daec..f40e78ec18 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMapElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMapElement.h
@@ -29,7 +29,8 @@ namespace WebCore {
 
 class IntSize;
 class HitTestResult;
-
+class HTMLImageElement;
+    
 class HTMLMapElement : public HTMLElement {
 public:
     HTMLMapElement(const QualifiedName&, Document*);
@@ -44,7 +45,8 @@ public:
     virtual void parseMappedAttribute(MappedAttribute*);
 
     bool mapMouseEvent(int x, int y, const IntSize&, HitTestResult&);
-
+    
+    HTMLImageElement* imageElement() const;
     PassRefPtr<HTMLCollection> areas();
 
     String name() const;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMapElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLMapElement.idl
index 9d5db47c78..1a760d1131 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMapElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMapElement.idl
@@ -20,11 +20,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=8a660b48-4beb-4f9e-855b-e04131eb2519,
-        ImplementationUUID=7ad57e02-91e5-4761-a1ca-e967188e5e0d
-    ] HTMLMapElement : HTMLElement {
+    interface HTMLMapElement : HTMLElement {
         readonly attribute HTMLCollection areas;
         attribute [ConvertNullToNullString] DOMString name;
     };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.cpp
index 0cb6501452..7c16f160d6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.cpp
@@ -112,14 +112,14 @@ void HTMLMarqueeElement::parseMappedAttribute(MappedAttribute *attr)
 
 void HTMLMarqueeElement::start()
 {
-    if (renderer() && renderer()->hasLayer() && renderBox()->layer()->marquee())
-        renderBox()->layer()->marquee()->start();
+    if (RenderMarquee* marqueeRenderer = renderMarquee())
+        marqueeRenderer->start();
 }
 
 void HTMLMarqueeElement::stop()
 {
-    if (renderer() && renderer()->hasLayer() && renderBox()->layer()->marquee())
-        renderBox()->layer()->marquee()->stop();
+    if (RenderMarquee* marqueeRenderer = renderMarquee())
+        marqueeRenderer->stop();
 }
 
 bool HTMLMarqueeElement::canSuspend() const
@@ -129,14 +129,21 @@ bool HTMLMarqueeElement::canSuspend() const
 
 void HTMLMarqueeElement::suspend()
 {
-    if (renderer() && renderer()->hasLayer() && renderBox()->layer()->marquee())
-        renderBox()->layer()->marquee()->suspend();
+    if (RenderMarquee* marqueeRenderer = renderMarquee())
+        marqueeRenderer->suspend();
 }
-    
+
 void HTMLMarqueeElement::resume()
 {
-    if (renderer() && renderer()->hasLayer() && renderBox()->layer()->marquee())
-        renderBox()->layer()->marquee()->updateMarqueePosition();
+    if (RenderMarquee* marqueeRenderer = renderMarquee())
+        marqueeRenderer->updateMarqueePosition();
+}
+
+RenderMarquee* HTMLMarqueeElement::renderMarquee() const
+{
+    if (renderer() && renderer()->hasLayer())
+        return renderBoxModelObject()->layer()->marquee();
+    return 0;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.h b/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.h
index 2423fc60b3..9100e8ff99 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.h
@@ -28,6 +28,8 @@
 
 namespace WebCore {
 
+class RenderMarquee;
+
 class HTMLMarqueeElement : public HTMLElement, private ActiveDOMObject {
 public:
     HTMLMarqueeElement(const QualifiedName&, Document*);
@@ -51,6 +53,8 @@ private:
     virtual void suspend();
     virtual void resume();
 
+    RenderMarquee* renderMarquee() const;
+
     int m_minimumDelay;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.idl
index eca53dbdbe..3659f81dc3 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=100ca673-eb1e-40b6-8cba-a15abc4cd590,
-        ImplementationUUID=b9427505-1f10-4299-8b85-4e2891428988
-    ] HTMLMarqueeElement : HTMLElement {
+    interface HTMLMarqueeElement : HTMLElement {
         void start();
         void stop();
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
index 729aceb209..4170a0be2a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,9 +28,10 @@
 #if ENABLE(VIDEO)
 #include "HTMLMediaElement.h"
 
+#include "Chrome.h"
+#include "ChromeClient.h"
 #include "ClientRect.h"
 #include "ClientRectList.h"
-#include "ChromeClient.h"
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
@@ -55,7 +56,6 @@
 #include "MediaPlayer.h"
 #include "MediaQueryEvaluator.h"
 #include "Page.h"
-#include "ProgressEvent.h"
 #include "RenderVideo.h"
 #include "RenderView.h"
 #include "ScriptEventListener.h"
@@ -70,7 +70,7 @@
 #endif
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-#include "RenderPartObject.h"
+#include "RenderEmbeddedObject.h"
 #include "Widget.h"
 #endif
 
@@ -102,8 +102,10 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* doc)
     , m_currentSourceNode(0)
     , m_player(0)
     , m_restrictions(NoRestrictions)
+    , m_preload(MediaPlayer::Auto)
     , m_playing(false)
     , m_processingMediaPlayerCallback(0)
+    , m_isWaitingUntilMediaCanStart(false)
     , m_processingLoad(false)
     , m_delayingTheLoadEvent(false)
     , m_haveFiredLoadedData(false)
@@ -117,6 +119,7 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* doc)
     , m_pausedInternal(false)
     , m_sendProgressEvents(true)
     , m_isFullscreen(false)
+    , m_closedCaptionsVisible(false)
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     , m_needWidgetUpdate(false)
 #endif
@@ -127,10 +130,30 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* doc)
 
 HTMLMediaElement::~HTMLMediaElement()
 {
+    if (m_isWaitingUntilMediaCanStart) {
+        if (Page* page = document()->page())
+            page->removeMediaCanStartListener(this);
+    }
+
+    document()->unregisterForDocumentActivationCallbacks(this);
+    document()->unregisterForMediaVolumeCallbacks(this);
+}
+
+void HTMLMediaElement::willMoveToNewOwnerDocument()
+{
     document()->unregisterForDocumentActivationCallbacks(this);
     document()->unregisterForMediaVolumeCallbacks(this);
+    HTMLElement::willMoveToNewOwnerDocument();
 }
 
+void HTMLMediaElement::didMoveToNewOwnerDocument()
+{
+    document()->registerForDocumentActivationCallbacks(this);
+    document()->registerForMediaVolumeCallbacks(this);
+    HTMLElement::didMoveToNewOwnerDocument();
+}
+
+
 bool HTMLMediaElement::checkDTD(const Node* newChild)
 {
     return newChild->hasTagName(sourceTag) || HTMLElement::checkDTD(newChild);
@@ -162,9 +185,23 @@ void HTMLMediaElement::parseMappedAttribute(MappedAttribute* attr)
 {
     const QualifiedName& attrName = attr->name();
 
-    if (attrName == autobufferAttr) {
-        if (m_player)
-            m_player->setAutobuffer(!attr->isNull());
+    if (attrName == preloadAttr) {
+        String value = attr->value();
+
+        if (equalIgnoringCase(value, "none"))
+            m_preload = MediaPlayer::None;
+        else if (equalIgnoringCase(value, "metadata"))
+            m_preload = MediaPlayer::MetaData;
+        else {
+            // The spec does not define an "invalid value default" but "auto" is suggested as the
+            // "missing value default", so use it for everything except "none" and "metadata"
+            m_preload = MediaPlayer::Auto;
+        }
+
+        // The attribute must be ignored if the autoplay attribute is present
+        if (!autoplay() && m_player)
+            m_player->setPreload(m_preload);
+
     } else if (attrName == onabortAttr)
         setAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(this, attr));
     else if (attrName == onbeforeloadAttr)
@@ -213,6 +250,10 @@ void HTMLMediaElement::parseMappedAttribute(MappedAttribute* attr)
         setAttributeEventListener(eventNames().volumechangeEvent, createAttributeEventListener(this, attr));
     else if (attrName == onwaitingAttr)
         setAttributeEventListener(eventNames().waitingEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onwebkitbeginfullscreenAttr)
+        setAttributeEventListener(eventNames().webkitbeginfullscreenEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onwebkitendfullscreenAttr)
+        setAttributeEventListener(eventNames().webkitendfullscreenEvent, createAttributeEventListener(this, attr));
     else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -234,7 +275,7 @@ bool HTMLMediaElement::rendererIsNeeded(RenderStyle* style)
 RenderObject* HTMLMediaElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-    return new (arena) RenderPartObject(this);
+    return new (arena) RenderEmbeddedObject(this);
 #else
     return new (arena) RenderMedia(this);
 #endif
@@ -250,7 +291,7 @@ void HTMLMediaElement::insertedIntoDocument()
 void HTMLMediaElement::removedFromDocument()
 {
     if (m_networkState > NETWORK_EMPTY)
-        pause();
+        pause(processingUserGesture());
     if (m_isFullscreen)
         exitFullscreen();
     HTMLElement::removedFromDocument();
@@ -292,32 +333,9 @@ void HTMLMediaElement::scheduleNextSourceChild()
     m_loadTimer.startOneShot(0);
 }
 
-void HTMLMediaElement::scheduleProgressEvent(const AtomicString& eventName)
-{
-    if (!m_sendProgressEvents)
-        return;
-
-    // FIXME: don't schedule timeupdate or progress events unless there are registered listeners
-
-    bool totalKnown = m_player && m_player->totalBytesKnown();
-    unsigned loaded = m_player ? m_player->bytesLoaded() : 0;
-    unsigned total = m_player ? m_player->totalBytes() : 0;
-
-    RefPtr<ProgressEvent> evt = ProgressEvent::create(eventName, totalKnown, loaded, total);
-    enqueueEvent(evt);
-
-    if (renderer())
-        renderer()->updateFromElement();
-}
-
 void HTMLMediaElement::scheduleEvent(const AtomicString& eventName)
 {
-    enqueueEvent(Event::create(eventName, false, true));
-}
-
-void HTMLMediaElement::enqueueEvent(RefPtr<Event> event)
-{
-    m_pendingEvents.append(event);
+    m_pendingEvents.append(Event::create(eventName, false, true));
     if (!m_asyncEventTimer.isActive())
         m_asyncEventTimer.startOneShot(0);
 }
@@ -424,9 +442,9 @@ String HTMLMediaElement::canPlayType(const String& mimeType) const
     return canPlay;
 }
 
-void HTMLMediaElement::load(ExceptionCode& ec)
+void HTMLMediaElement::load(bool isUserGesture, ExceptionCode& ec)
 {
-    if (m_restrictions & RequireUserGestureForLoadRestriction && !processingUserGesture())
+    if (m_restrictions & RequireUserGestureForLoadRestriction && !isUserGesture)
         ec = INVALID_STATE_ERR;
     else {
         prepareForLoad();
@@ -452,37 +470,29 @@ void HTMLMediaElement::prepareForLoad()
 
 void HTMLMediaElement::loadInternal()
 {
-    // 1 - If the load() method for this element is already being invoked, then abort these steps.
+    // If we can't start a load right away, start it later.
+    Page* page = document()->page();
+    if (page && !page->canStartMedia()) {
+        if (m_isWaitingUntilMediaCanStart)
+            return;
+        page->addMediaCanStartListener(this);
+        m_isWaitingUntilMediaCanStart = true;
+        return;
+    }
+
+    // If the load() method for this element is already being invoked, then abort these steps.
     if (m_processingLoad)
         return;
     m_processingLoad = true;
     
-    // Steps 2 and 3 were done in prepareForLoad()
-    
-    // 4 - If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, set
-    // the error attribute to a new MediaError object whose code attribute is set to
-    // MEDIA_ERR_ABORTED, fire a progress event called abort at the media element, in the
-    // context of the fetching process that is in progress for the element.
-    if (m_networkState == NETWORK_LOADING || m_networkState == NETWORK_IDLE) {
-        m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
-
-        // fire synchronous 'abort'
-        bool totalKnown = m_player && m_player->totalBytesKnown();
-        unsigned loaded = m_player ? m_player->bytesLoaded() : 0;
-        unsigned total = m_player ? m_player->totalBytes() : 0;
-        dispatchEvent(ProgressEvent::create(eventNames().abortEvent, totalKnown, loaded, total));
-    }
+    // Steps 1 and 2 were done in prepareForLoad()
 
-    // 5
-    m_error = 0;
-    m_autoplaying = true;
-    m_playedTimeRanges = TimeRanges::create();
-    m_lastSeekTime = 0;
-
-    // 6
-    setPlaybackRate(defaultPlaybackRate());
+    // 3 - If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, queue
+    // a task to fire a simple event named abort at the media element.
+    if (m_networkState == NETWORK_LOADING || m_networkState == NETWORK_IDLE)
+        scheduleEvent(eventNames().abortEvent);
 
-    // 7
+    // 4
     if (m_networkState != NETWORK_EMPTY) {
         m_networkState = NETWORK_EMPTY;
         m_readyState = HAVE_NOTHING;
@@ -493,9 +503,21 @@ void HTMLMediaElement::loadInternal()
             m_playing = false;
             m_player->seek(0);
         }
-        dispatchEvent(Event::create(eventNames().emptiedEvent, false, true));
+        scheduleEvent(eventNames().emptiedEvent);
     }
 
+    // 5 - Set the playbackRate attribute to the value of the defaultPlaybackRate attribute.
+    setPlaybackRate(defaultPlaybackRate());
+
+    // 6 - Set the error attribute to null and the autoplaying flag to true.
+    m_error = 0;
+    m_autoplaying = true;
+
+    m_playedTimeRanges = TimeRanges::create();
+    m_lastSeekTime = 0;
+    m_closedCaptionsVisible = false;
+
+    // 7 - Invoke the media element's resource selection algorithm.
     selectMediaResource();
     m_processingLoad = false;
 }
@@ -507,15 +529,24 @@ void HTMLMediaElement::selectMediaResource()
 
     // 2 - Asynchronously await a stable state.
 
-    // 3 - If the media element has neither a src attribute nor any source element children, run these substeps
+    // 3 - ... the media element has neither a src attribute ...
     String mediaSrc = getAttribute(srcAttr);
-    if (!mediaSrc && !havePotentialSourceChild()) {
-        m_loadState = WaitingForSource;
+    if (!mediaSrc) {
+        // ... nor a source element child: ...
+        Node* node;
+        for (node = firstChild(); node; node = node->nextSibling()) {
+            if (node->hasTagName(sourceTag))
+                break;
+        }
 
-        // 1 - Set the networkState to NETWORK_EMPTY and abort these steps
-        m_networkState = NETWORK_EMPTY;
-        ASSERT(!m_delayingTheLoadEvent);
-        return;
+        if (!node) {
+            m_loadState = WaitingForSource;
+
+            // ... set the networkState to NETWORK_EMPTY, and abort these steps
+            m_networkState = NETWORK_EMPTY;
+            ASSERT(!m_delayingTheLoadEvent);
+            return;
+        }
     }
 
     // 4
@@ -523,7 +554,7 @@ void HTMLMediaElement::selectMediaResource()
     m_networkState = NETWORK_LOADING;
 
     // 5
-    scheduleProgressEvent(eventNames().loadstartEvent);
+    scheduleEvent(eventNames().loadstartEvent);
 
     // 6 - If the media element has a src attribute, then run these substeps
     ContentType contentType("");
@@ -548,9 +579,7 @@ void HTMLMediaElement::loadNextSourceChild()
     ContentType contentType("");
     KURL mediaURL = selectNextSourceChild(&contentType, Complain);
     if (!mediaURL.isValid()) {
-        // It seems wrong to fail silently when we give up because no suitable <source>
-        // element can be found and set the error attribute if the element's 'src' attribute
-        // fails, but that is what the spec says.
+        waitForSourceChange();
         return;
     }
 
@@ -582,13 +611,14 @@ void HTMLMediaElement::loadResource(const KURL& initialURL, ContentType& content
         startProgressEventTimer();
 
 #if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-    m_player.clear();
-    m_player.set(new MediaPlayer(this));
+    m_player = MediaPlayer::create(this);
 #else
     if (!m_player)
-        m_player.set(new MediaPlayer(this));
+        m_player = MediaPlayer::create(this);
 #endif
 
+    if (!autoplay())
+        m_player->setPreload(m_preload);
     m_player->setPreservesPitch(m_webkitPreservesPitch);
     updateVolume();
 
@@ -630,6 +660,18 @@ void HTMLMediaElement::startProgressEventTimer()
     m_progressEventTimer.startRepeating(0.350);
 }
 
+void HTMLMediaElement::waitForSourceChange()
+{
+    stopPeriodicTimers();
+    m_loadState = WaitingForSource;
+
+    // 6.17 - Waiting: Set the element's networkState attribute to the NETWORK_NO_SOURCE value
+    m_networkState = NETWORK_NO_SOURCE;
+
+    // 6.18 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    m_delayingTheLoadEvent = false;
+}
+
 void HTMLMediaElement::noneSupported()
 {
     stopPeriodicTimers();
@@ -647,15 +689,15 @@ void HTMLMediaElement::noneSupported()
     // 7 - Queue a task to fire a progress event called error at the media element, in
     // the context of the fetching process that was used to try to obtain the media
     // resource in the resource fetch algorithm.
-    scheduleProgressEvent(eventNames().errorEvent);
+    scheduleEvent(eventNames().errorEvent);
 
     // 8 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
     m_delayingTheLoadEvent = false;
 
     // 9 -Abort these steps. Until the load() method is invoked, the element won't attempt to load another resource.
 
-    if (isVideo())
-        static_cast<HTMLVideoElement*>(this)->updatePosterImage();
+    updatePosterImage();
+
     if (renderer())
         renderer()->updateFromElement();
 }
@@ -672,7 +714,7 @@ void HTMLMediaElement::mediaEngineError(PassRefPtr<MediaError> err)
 
     // 3 - Queue a task to fire a progress event called error at the media element, in
     // the context of the fetching process started by this instance of this algorithm.
-    scheduleProgressEvent(eventNames().errorEvent);
+    scheduleEvent(eventNames().errorEvent);
 
     // 4 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a
     // task to fire a simple event called emptied at the element.
@@ -696,6 +738,16 @@ void HTMLMediaElement::cancelPendingEventsAndCallbacks()
     }
 }
 
+Document* HTMLMediaElement::mediaPlayerOwningDocument()
+{
+    Document* d = document();
+    
+    if (!d)
+        d = ownerDocument();
+    
+    return d;
+}
+
 void HTMLMediaElement::mediaPlayerNetworkStateChanged(MediaPlayer*)
 {
     beginProcessingMediaPlayerCallback();
@@ -720,6 +772,9 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
             m_currentSourceNode->scheduleErrorEvent();
             if (havePotentialSourceChild())
                 scheduleNextSourceChild();
+            else
+                waitForSourceChange();
+
             return;
         }
 
@@ -730,16 +785,14 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
         else if (state == MediaPlayer::FormatError && m_loadState == LoadingFromSrcAttr)
             noneSupported();
 
-        if (isVideo())
-            static_cast<HTMLVideoElement*>(this)->updatePosterImage();
-
+        updatePosterImage();
         return;
     }
 
     if (state == MediaPlayer::Idle) {
         if (m_networkState > NETWORK_IDLE) {
             stopPeriodicTimers();
-            scheduleProgressEvent(eventNames().suspendEvent);
+            scheduleEvent(eventNames().suspendEvent);
         }
         m_networkState = NETWORK_IDLE;
     }
@@ -759,7 +812,7 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
 
             // Schedule one last progress event so we guarantee that at least one is fired
             // for files that load very quickly.
-            scheduleProgressEvent(eventNames().progressEvent);
+            scheduleEvent(eventNames().progressEvent);
 
             // Check to see if readyState changes need to be dealt with before sending the 
             // 'load' event so we report 'canplaythrough' first. This is necessary because a
@@ -768,7 +821,7 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
             if (static_cast<ReadyState>(currentState) != m_readyState)
                 setReadyState(currentState);
 
-            scheduleProgressEvent(eventNames().loadEvent);
+            scheduleEvent(eventNames().loadEvent);
         }
     }
 }
@@ -831,6 +884,8 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
         m_player->seek(0);
     }
 
+    bool shouldUpdatePosterImage = false;
+
     // 4.8.10.7 says loadeddata is sent only when the new state *is* HAVE_CURRENT_DATA: "If the
     // previous ready state was HAVE_METADATA and the new ready state is HAVE_CURRENT_DATA", 
     // but the event table at the end of the spec says it is sent when: "readyState newly 
@@ -838,6 +893,7 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
     // We go with the later because it seems useful to count on getting this event
     if (m_readyState >= HAVE_CURRENT_DATA && oldState < HAVE_CURRENT_DATA && !m_haveFiredLoadedData) {
         m_haveFiredLoadedData = true;
+        shouldUpdatePosterImage = true;
         scheduleEvent(eventNames().loadeddataEvent);
     }
 
@@ -846,9 +902,7 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
         scheduleEvent(eventNames().canplayEvent);
         if (isPotentiallyPlaying)
             scheduleEvent(eventNames().playingEvent);
-
-        if (isVideo())
-            static_cast<HTMLVideoElement*>(this)->updatePosterImage();
+        shouldUpdatePosterImage = true;
     }
 
     if (m_readyState == HAVE_ENOUGH_DATA && oldState < HAVE_ENOUGH_DATA) {
@@ -866,10 +920,12 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
             scheduleEvent(eventNames().playingEvent);
         }
 
-        if (isVideo())
-            static_cast<HTMLVideoElement*>(this)->updatePosterImage();
+        shouldUpdatePosterImage = true;
     }
 
+    if (shouldUpdatePosterImage)
+        updatePosterImage();
+
     updatePlayState();
 }
 
@@ -885,14 +941,16 @@ void HTMLMediaElement::progressEventTimerFired(Timer<HTMLMediaElement>*)
 
     if (progress == m_previousProgress) {
         if (timedelta > 3.0 && !m_sentStalledEvent) {
-            scheduleProgressEvent(eventNames().stalledEvent);
+            scheduleEvent(eventNames().stalledEvent);
             m_sentStalledEvent = true;
         }
     } else {
-        scheduleProgressEvent(eventNames().progressEvent);
+        scheduleEvent(eventNames().progressEvent);
         m_previousProgress = progress;
         m_previousProgressTime = time;
         m_sentStalledEvent = false;
+        if (renderer())
+            renderer()->updateFromElement();
     }
 }
 
@@ -1020,7 +1078,7 @@ float HTMLMediaElement::startTime() const
 
 float HTMLMediaElement::duration() const
 {
-    if (m_readyState >= HAVE_METADATA)
+    if (m_player && m_readyState >= HAVE_METADATA)
         return m_player->duration();
 
     return numeric_limits<float>::quiet_NaN();
@@ -1076,7 +1134,10 @@ void HTMLMediaElement::setWebkitPreservesPitch(bool preservesPitch)
 
 bool HTMLMediaElement::ended() const
 {
-    return endedPlayback();
+    // 4.8.10.8 Playing the media resource
+    // The ended attribute must return true if the media element has ended 
+    // playback and the direction of playback is forwards, and false otherwise.
+    return endedPlayback() && m_playbackRate > 0;
 }
 
 bool HTMLMediaElement::autoplay() const
@@ -1089,19 +1150,32 @@ void HTMLMediaElement::setAutoplay(bool b)
     setBooleanAttribute(autoplayAttr, b);
 }
 
-bool HTMLMediaElement::autobuffer() const
+String HTMLMediaElement::preload() const
 {
-    return hasAttribute(autobufferAttr);
+    switch (m_preload) {
+    case MediaPlayer::None:
+        return "none";
+        break;
+    case MediaPlayer::MetaData:
+        return "metadata";
+        break;
+    case MediaPlayer::Auto:
+        return "auto";
+        break;
+    }
+
+    ASSERT_NOT_REACHED();
+    return String();
 }
 
-void HTMLMediaElement::setAutobuffer(bool b)
+void HTMLMediaElement::setPreload(const String& preload)
 {
-    setBooleanAttribute(autobufferAttr, b);
+    setAttribute(preloadAttr, preload);
 }
 
-void HTMLMediaElement::play()
+void HTMLMediaElement::play(bool isUserGesture)
 {
-    if (m_restrictions & RequireUserGestureForRateChangeRestriction && !processingUserGesture())
+    if (m_restrictions & RequireUserGestureForRateChangeRestriction && !isUserGesture)
         return;
 
     playInternal();
@@ -1134,9 +1208,9 @@ void HTMLMediaElement::playInternal()
     updatePlayState();
 }
 
-void HTMLMediaElement::pause()
+void HTMLMediaElement::pause(bool isUserGesture)
 {
-    if (m_restrictions & RequireUserGestureForRateChangeRestriction && !processingUserGesture())
+    if (m_restrictions & RequireUserGestureForRateChangeRestriction && !isUserGesture)
         return;
 
     pauseInternal();
@@ -1175,7 +1249,7 @@ bool HTMLMediaElement::controls() const
     Frame* frame = document()->frame();
 
     // always show controls when scripting is disabled
-    if (frame && !frame->script()->isEnabled())
+    if (frame && !frame->script()->canExecuteScripts(NotAboutToExecuteScript))
         return true;
 
     return hasAttribute(controlsAttr);
@@ -1214,7 +1288,15 @@ void HTMLMediaElement::setMuted(bool muted)
 {
     if (m_muted != muted) {
         m_muted = muted;
-        updateVolume();
+        // Avoid recursion when the player reports volume changes.
+        if (!processingMediaPlayerCallback()) {
+            if (m_player) {
+                m_player->setMuted(m_muted);
+                if (renderer())
+                    renderer()->updateFromElement();
+            } else
+                updateVolume();
+        }
         scheduleEvent(eventNames().volumechangeEvent);
     }
 }
@@ -1236,7 +1318,7 @@ void HTMLMediaElement::beginScrubbing()
             // Because a media element stays in non-paused state when it reaches end, playback resumes 
             // when the slider is dragged from the end to another position unless we pause first. Do 
             // a "hard pause" so an event is generated, since we want to stay paused after scrubbing finishes.
-            pause();
+            pause(processingUserGesture());
         } else {
             // Not at the end but we still want to pause playback so the media engine doesn't try to
             // continue playing during scrubbing. Pause without generating an event as we will 
@@ -1390,10 +1472,14 @@ void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
 {
     beginProcessingMediaPlayerCallback();
 
+    // Always call scheduleTimeupdateEvent when the media engine reports a time discontinuity, 
+    // it will only queue a 'timeupdate' event if we haven't already posted one at the current
+    // movie time.
+    scheduleTimeupdateEvent(false);
+
     // 4.8.10.10 step 12 & 13.  Needed if no ReadyState change is associated with the seek.
-    if (m_readyState >= HAVE_CURRENT_DATA && m_seeking) {
+    if (m_readyState >= HAVE_CURRENT_DATA && m_seeking)
         finishSeek();
-    }
     
     float now = currentTime();
     float dur = duration();
@@ -1405,7 +1491,6 @@ void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
         } else {
             if (!m_sentEndEvent) {
                 m_sentEndEvent = true;
-                scheduleTimeupdateEvent(false);
                 scheduleEvent(eventNames().endedEvent);
             }
         }
@@ -1420,10 +1505,20 @@ void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
 void HTMLMediaElement::mediaPlayerVolumeChanged(MediaPlayer*)
 {
     beginProcessingMediaPlayerCallback();
+    if (m_player)
+        m_volume = m_player->volume();
     updateVolume();
     endProcessingMediaPlayerCallback();
 }
 
+void HTMLMediaElement::mediaPlayerMuteChanged(MediaPlayer*)
+{
+    beginProcessingMediaPlayerCallback();
+    if (m_player)
+        setMuted(m_player->muted());
+    endProcessingMediaPlayerCallback();
+}
+
 void HTMLMediaElement::mediaPlayerDurationChanged(MediaPlayer*)
 {
     beginProcessingMediaPlayerCallback();
@@ -1464,6 +1559,8 @@ void HTMLMediaElement::mediaPlayerRepaint(MediaPlayer*)
     beginProcessingMediaPlayerCallback();
     if (renderer())
         renderer()->repaint();
+
+    updatePosterImage();
     endProcessingMediaPlayerCallback();
 }
 
@@ -1487,11 +1584,10 @@ bool HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated(MediaPlayer*)
     return false;
 }
 
-GraphicsLayer* HTMLMediaElement::mediaPlayerGraphicsLayer(MediaPlayer*)
+void HTMLMediaElement::mediaPlayerRenderingModeChanged(MediaPlayer*)
 {
-    if (renderer() && renderer()->isVideo())
-        return toRenderVideo(renderer())->videoGraphicsLayer();
-    return 0;
+    // Kick off a fake recalcStyle that will update the compositing tree.
+    setNeedsStyleRecalc(SyntheticStyleChange);
 }
 #endif
 
@@ -1536,11 +1632,29 @@ bool HTMLMediaElement::couldPlayIfEnoughData() const
 
 bool HTMLMediaElement::endedPlayback() const
 {
-    if (!m_player || m_readyState < HAVE_METADATA)
+    float dur = duration();
+    if (!m_player || isnan(dur))
+        return false;
+
+    // 4.8.10.8 Playing the media resource
+
+    // A media element is said to have ended playback when the element's 
+    // readyState attribute is HAVE_METADATA or greater, 
+    if (m_readyState < HAVE_METADATA)
         return false;
     
-    float dur = duration();
-    return !isnan(dur) && currentTime() >= dur && !loop();
+    // and the current playback position is the end of the media resource and the direction 
+    // of playback is forwards and the media element does not have a loop attribute specified,
+    float now = currentTime();
+    if (m_playbackRate > 0)
+        return now >= dur && !loop();
+    
+    // or the current playback position is the earliest possible position and the direction 
+    // of playback is backwards
+    if (m_playbackRate < 0)
+        return now <= 0;
+
+    return false;
 }
 
 bool HTMLMediaElement::stoppedDueToErrors() const
@@ -1580,7 +1694,8 @@ void HTMLMediaElement::updateVolume()
         Page* page = document()->page();
         float volumeMultiplier = page ? page->mediaVolume() : 1;
     
-        m_player->setVolume(m_muted ? 0 : m_volume * volumeMultiplier);
+        m_player->setMuted(m_muted);
+        m_player->setVolume(m_volume * volumeMultiplier);
     }
     
     if (renderer())
@@ -1652,7 +1767,7 @@ void HTMLMediaElement::userCancelledLoad()
 
     // 3 - Queue a task to fire a progress event called abort at the media element, in the context
     // of the fetching process started by this instance of this algorithm.
-    scheduleProgressEvent(eventNames().abortEvent);
+    scheduleEvent(eventNames().abortEvent);
 
     // 5 - If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the
     // element's networkState attribute to the NETWORK_EMPTY value and queue a task to fire a
@@ -1670,6 +1785,9 @@ void HTMLMediaElement::userCancelledLoad()
 
     // 7 - Abort the overall resource selection algorithm.
     m_currentSourceNode = 0;
+
+    // Reset m_readyState since m_player is gone.
+    m_readyState = HAVE_NOTHING;
 }
 
 void HTMLMediaElement::documentWillBecomeInactive()
@@ -1701,7 +1819,7 @@ void HTMLMediaElement::documentDidBecomeActive()
         //  MEDIA_ERR_ABORTED while the abortEvent is being sent, but cleared immediately afterwards).
         // This behavior is not specified but it seems like a sensible thing to do.
         ExceptionCode ec;
-        load(ec);
+        load(processingUserGesture(), ec);
     }
 
     if (renderer())
@@ -1713,12 +1831,11 @@ void HTMLMediaElement::mediaVolumeDidChange()
     updateVolume();
 }
 
-const IntRect HTMLMediaElement::screenRect()
+IntRect HTMLMediaElement::screenRect()
 {
-    IntRect elementRect;
-    if (renderer())
-        elementRect = renderer()->view()->frameView()->contentsToScreen(renderer()->absoluteBoundingBoxRect());
-    return elementRect;
+    if (!renderer())
+        return IntRect();
+    return renderer()->view()->frameView()->contentsToScreen(renderer()->absoluteBoundingBoxRect());
 }
     
 void HTMLMediaElement::defaultEventHandler(Event* event)
@@ -1784,11 +1901,11 @@ void HTMLMediaElement::finishParsingChildren()
 {
     HTMLElement::finishParsingChildren();
     if (!m_player)
-        m_player.set(new MediaPlayer(this));
+        m_player = MediaPlayer::create(this);
     
     document()->updateStyleIfNeeded();
     if (m_needWidgetUpdate && renderer())
-        toRenderPartObject(renderer())->updateWidget(true);
+        toRenderEmbeddedObject(renderer())->updateWidget(true);
 }
 
 #endif
@@ -1796,25 +1913,79 @@ void HTMLMediaElement::finishParsingChildren()
 void HTMLMediaElement::enterFullscreen()
 {
     ASSERT(!m_isFullscreen);
-    if (!renderer())
-        return;
-    if (document() && document()->page())
+    if (document() && document()->page()) {
         document()->page()->chrome()->client()->enterFullscreenForNode(this);
-    m_isFullscreen = true;
+        scheduleEvent(eventNames().webkitbeginfullscreenEvent);
+        m_isFullscreen = true;
+    }
 }
 
 void HTMLMediaElement::exitFullscreen()
 {
     ASSERT(m_isFullscreen);
-    if (document() && document()->page())
+    if (document() && document()->page()) {
         document()->page()->chrome()->client()->exitFullscreenForNode(this);
+        scheduleEvent(eventNames().webkitendfullscreenEvent);
+    }
     m_isFullscreen = false;
 }
 
 PlatformMedia HTMLMediaElement::platformMedia() const
 {
     return m_player ? m_player->platformMedia() : NoPlatformMedia;
-}        
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+PlatformLayer* HTMLMediaElement::platformLayer() const
+{
+    return m_player ? m_player->platformLayer() : 0;
+}
+#endif
+
+bool HTMLMediaElement::hasClosedCaptions() const
+{
+    return m_player && m_player->hasClosedCaptions();
+}
+
+bool HTMLMediaElement::closedCaptionsVisible() const
+{
+    return m_closedCaptionsVisible;
+}
+
+void HTMLMediaElement::setClosedCaptionsVisible(bool closedCaptionVisible)
+{
+    if (!m_player ||!hasClosedCaptions())
+        return;
+
+    m_closedCaptionsVisible = closedCaptionVisible;
+    m_player->setClosedCaptionsVisible(closedCaptionVisible);
+    if (renderer())
+        renderer()->updateFromElement();
+}
+
+void HTMLMediaElement::setWebkitClosedCaptionsVisible(bool visible)
+{
+    setClosedCaptionsVisible(visible);
+}
+
+bool HTMLMediaElement::webkitClosedCaptionsVisible() const
+{
+    return closedCaptionsVisible();
+}
+
+
+bool HTMLMediaElement::webkitHasClosedCaptions() const
+{
+    return hasClosedCaptions();
+}
+
+void HTMLMediaElement::mediaCanStart()
+{
+    ASSERT(m_isWaitingUntilMediaCanStart);
+    m_isWaitingUntilMediaCanStart = false;
+    loadInternal();
+}
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
index 405f013350..0326b66828 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,12 +29,8 @@
 #if ENABLE(VIDEO)
 
 #include "HTMLElement.h"
+#include "MediaCanStartListener.h"
 #include "MediaPlayer.h"
-#include "Timer.h"
-
-#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-#include "MediaPlayerProxy.h"
-#endif
 
 namespace WebCore {
 
@@ -44,26 +40,15 @@ class MediaError;
 class KURL;
 class TimeRanges;
 
-class HTMLMediaElement : public HTMLElement, public MediaPlayerClient {
-public:
-    HTMLMediaElement(const QualifiedName&, Document*);
-    virtual ~HTMLMediaElement();
-
-    bool checkDTD(const Node* newChild);
-    
-    void attributeChanged(Attribute*, bool preserveDecls);
-    void parseMappedAttribute(MappedAttribute *);
+// FIXME: The inheritance from MediaPlayerClient here should be private inheritance.
+// But it can't be until the Chromium WebMediaPlayerClientImpl class is fixed so it
+// no longer depends on typecasting a MediaPlayerClient to an HTMLMediaElement.
 
-    virtual bool rendererIsNeeded(RenderStyle*);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual void insertedIntoDocument();
-    virtual void removedFromDocument();
-    virtual void attach();
-    virtual void recalcStyle(StyleChange);
-    
+class HTMLMediaElement : public HTMLElement, public MediaPlayerClient, private MediaCanStartListener {
+public:
     MediaPlayer* player() const { return m_player.get(); }
     
-    virtual bool isVideo() const { return false; }
+    virtual bool isVideo() const = 0;
     virtual bool hasVideo() const { return false; }
     virtual bool hasAudio() const;
 
@@ -75,14 +60,12 @@ public:
     virtual bool supportsSave() const;
     
     PlatformMedia platformMedia() const;
+#if USE(ACCELERATED_COMPOSITING)
+    PlatformLayer* platformLayer() const;
+#endif
 
     void scheduleLoad();
     
-    virtual void defaultEventHandler(Event*);
-    
-    // Pauses playback without changing any states or generating events
-    void setPausedInternal(bool);
-    
     MediaPlayer::MovieLoadType movieLoadType() const;
     
     bool inActiveDocument() const { return m_inActiveDocument; }
@@ -98,11 +81,12 @@ public:
 
     enum NetworkState { NETWORK_EMPTY, NETWORK_IDLE, NETWORK_LOADING, NETWORK_LOADED, NETWORK_NO_SOURCE };
     NetworkState networkState() const;
-    bool autobuffer() const;    
-    void setAutobuffer(bool);
+    
+    String preload() const;    
+    void setPreload(const String&);
 
     PassRefPtr<TimeRanges> buffered() const;
-    void load(ExceptionCode&);
+    void load(bool isUserGesture, ExceptionCode&);
     String canPlayType(const String& mimeType) const;
 
 // ready state
@@ -129,9 +113,14 @@ public:
     void setAutoplay(bool b);
     bool loop() const;    
     void setLoop(bool b);
-    void play();
-    void pause();
-    
+    void play(bool isUserGesture);
+    void pause(bool isUserGesture);
+
+// captions
+    bool webkitHasClosedCaptions() const;
+    bool webkitClosedCaptionsVisible() const;
+    void setWebkitClosedCaptionsVisible(bool);
+
 // controls
     bool controls() const;
     void setControls(bool);
@@ -143,7 +132,7 @@ public:
     void beginScrubbing();
     void endScrubbing();
 
-    const IntRect screenRect();
+    IntRect screenRect();
 
     bool canPlay() const;
 
@@ -151,33 +140,62 @@ public:
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     void setNeedWidgetUpdate(bool needWidgetUpdate) { m_needWidgetUpdate = needWidgetUpdate; }
-    void deliverNotification(MediaPlayerProxyNotificationType notification);
-    void setMediaPlayerProxy(WebMediaPlayerProxy* proxy);
+    void deliverNotification(MediaPlayerProxyNotificationType);
+    void setMediaPlayerProxy(WebMediaPlayerProxy*);
     String initialURL();
     virtual void finishParsingChildren();
 #endif
 
     bool hasSingleSecurityOrigin() const { return !m_player || m_player->hasSingleSecurityOrigin(); }
     
+    bool isFullscreen() const { return m_isFullscreen; }
     void enterFullscreen();
     void exitFullscreen();
 
+    bool hasClosedCaptions() const;
+    bool closedCaptionsVisible() const;
+    void setClosedCaptionsVisible(bool);
+
+    bool processingUserGesture() const;
+
 protected:
+    HTMLMediaElement(const QualifiedName&, Document*);
+    virtual ~HTMLMediaElement();
+
+    virtual void parseMappedAttribute(MappedAttribute *);
+    virtual void attach();
+
+private:
+    virtual bool checkDTD(const Node* newChild);    
+    virtual void attributeChanged(Attribute*, bool preserveDecls);
+    virtual bool rendererIsNeeded(RenderStyle*);
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual void insertedIntoDocument();
+    virtual void removedFromDocument();
+    virtual void recalcStyle(StyleChange);
+    
+    virtual void defaultEventHandler(Event*);
+    
     float getTimeOffsetAttribute(const QualifiedName&, float valueOnError) const;
     void setTimeOffsetAttribute(const QualifiedName&, float value);
     
     virtual void documentWillBecomeInactive();
     virtual void documentDidBecomeActive();
     virtual void mediaVolumeDidChange();
+    virtual void updatePosterImage() { }
     
     void setReadyState(MediaPlayer::ReadyState);
     void setNetworkState(MediaPlayer::NetworkState);
-    
-private: // MediaPlayerClient
+
+    virtual void willMoveToNewOwnerDocument();
+    virtual void didMoveToNewOwnerDocument();
+
+    virtual Document* mediaPlayerOwningDocument();
     virtual void mediaPlayerNetworkStateChanged(MediaPlayer*);
     virtual void mediaPlayerReadyStateChanged(MediaPlayer*);
     virtual void mediaPlayerTimeChanged(MediaPlayer*);
     virtual void mediaPlayerVolumeChanged(MediaPlayer*);
+    virtual void mediaPlayerMuteChanged(MediaPlayer*);
     virtual void mediaPlayerDurationChanged(MediaPlayer*);
     virtual void mediaPlayerRateChanged(MediaPlayer*);
     virtual void mediaPlayerSawUnsupportedTracks(MediaPlayer*);
@@ -185,10 +203,9 @@ private: // MediaPlayerClient
     virtual void mediaPlayerSizeChanged(MediaPlayer*);
 #if USE(ACCELERATED_COMPOSITING)
     virtual bool mediaPlayerRenderingCanBeAccelerated(MediaPlayer*);
-    virtual GraphicsLayer* mediaPlayerGraphicsLayer(MediaPlayer*);
+    virtual void mediaPlayerRenderingModeChanged(MediaPlayer*);
 #endif
 
-private:
     void loadTimerFired(Timer<HTMLMediaElement>*);
     void asyncEventTimerFired(Timer<HTMLMediaElement>*);
     void progressEventTimerFired(Timer<HTMLMediaElement>*);
@@ -203,9 +220,7 @@ private:
     void addPlayedRange(float start, float end);
     
     void scheduleTimeupdateEvent(bool periodicEvent);
-    void scheduleProgressEvent(const AtomicString& eventName);
     void scheduleEvent(const AtomicString& eventName);
-    void enqueueEvent(RefPtr<Event> event);
     
     // loading
     void selectMediaResource();
@@ -217,6 +232,7 @@ private:
     void noneSupported();
     void mediaEngineError(PassRefPtr<MediaError> err);
     void cancelPendingEventsAndCallbacks();
+    void waitForSourceChange();
 
     enum InvalidSourceAction { DoNothing, Complain };
     bool isSafeToLoadURL(const KURL&, InvalidSourceAction);
@@ -229,7 +245,6 @@ private:
 
     void prepareForLoad();
     
-    bool processingUserGesture() const;
     bool processingMediaPlayerCallback() const { return m_processingMediaPlayerCallback > 0; }
     void beginProcessingMediaPlayerCallback() { ++m_processingMediaPlayerCallback; }
     void endProcessingMediaPlayerCallback() { ASSERT(m_processingMediaPlayerCallback); --m_processingMediaPlayerCallback; }
@@ -245,15 +260,19 @@ private:
     float minTimeSeekable() const;
     float maxTimeSeekable() const;
 
-    // Restrictions to change default behaviors. This is a effectively a compile time choice at the moment
-    //  because there are no accessor methods.
+    // Pauses playback without changing any states or generating events
+    void setPausedInternal(bool);
+
+    virtual void mediaCanStart();
+
+    // Restrictions to change default behaviors. This is effectively a compile time choice at the moment
+    // because there are no accessor functions.
     enum BehaviorRestrictions {
         NoRestrictions = 0,
         RequireUserGestureForLoadRestriction = 1 << 0,
         RequireUserGestureForRateChangeRestriction = 1 << 1,
     };
 
-protected:
     Timer<HTMLMediaElement> m_loadTimer;
     Timer<HTMLMediaElement> m_asyncEventTimer;
     Timer<HTMLMediaElement> m_progressEventTimer;
@@ -285,18 +304,22 @@ protected:
     // loading state
     enum LoadState { WaitingForSource, LoadingFromSrcAttr, LoadingFromSourceElement };
     LoadState m_loadState;
-    HTMLSourceElement *m_currentSourceNode;
+    HTMLSourceElement* m_currentSourceNode;
     
     OwnPtr<MediaPlayer> m_player;
 
     BehaviorRestrictions m_restrictions;
+    
+    MediaPlayer::Preload m_preload;
 
     bool m_playing;
 
-    // counter incremented while processing a callback from the media player, so we can avoid
-    //  calling the media engine recursively
+    // Counter incremented while processing a callback from the media player, so we can avoid
+    // calling the media engine recursively.
     int m_processingMediaPlayerCallback;
 
+    bool m_isWaitingUntilMediaCanStart;
+
     bool m_processingLoad : 1;
     bool m_delayingTheLoadEvent : 1;
     bool m_haveFiredLoadedData : 1;
@@ -319,6 +342,7 @@ protected:
     bool m_sendProgressEvents : 1;
 
     bool m_isFullscreen : 1;
+    bool m_closedCaptionsVisible : 1;
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     bool m_needWidgetUpdate : 1;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.idl
index 7278fa6eac..5cd32930f8 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.idl
@@ -24,7 +24,7 @@
  */
 
 module html {
-interface [GenerateConstructor, Conditional=VIDEO] HTMLMediaElement : HTMLElement {
+interface [Conditional=VIDEO] HTMLMediaElement : HTMLElement {
 
     // error state
     readonly attribute MediaError error;
@@ -39,10 +39,10 @@ interface [GenerateConstructor, Conditional=VIDEO] HTMLMediaElement : HTMLElemen
     const unsigned short NETWORK_LOADED = 3;
     const unsigned short NETWORK_NO_SOURCE = 4;
     readonly attribute unsigned short networkState;
-    attribute boolean autobuffer;
+    attribute DOMString preload;
 
     readonly attribute TimeRanges buffered;
-    void load() 
+    [NeedsUserGestureCheck] void load() 
         raises (DOMException);
     DOMString canPlayType(in DOMString type);
 
@@ -68,8 +68,8 @@ interface [GenerateConstructor, Conditional=VIDEO] HTMLMediaElement : HTMLElemen
     readonly attribute boolean ended;
     attribute boolean autoplay;
     attribute boolean loop;
-    void play();
-    void pause();
+    [NeedsUserGestureCheck] void play();
+    [NeedsUserGestureCheck] void pause();
 
     // controls
     attribute boolean controls;
@@ -77,7 +77,10 @@ interface [GenerateConstructor, Conditional=VIDEO] HTMLMediaElement : HTMLElemen
         setter raises (DOMException);
     attribute boolean muted;
     
-    // WebKit extension
+    // WebKit extensions
     attribute boolean webkitPreservesPitch;
+
+    readonly attribute boolean webkitHasClosedCaptions;
+    attribute boolean webkitClosedCaptionsVisible;
 };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMenuElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLMenuElement.idl
index 4c2701aaf6..238263a248 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMenuElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMenuElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=fb353af6-4927-4512-ad43-4ad8191b5615,
-        ImplementationUUID=ec26257c-a2a4-43dc-b234-cf644d22b1fb
-    ] HTMLMenuElement : HTMLElement {
+    interface HTMLMenuElement : HTMLElement {
         attribute boolean compact;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.h
index d86df2e370..19e8ecd2a1 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003 Apple Computer, Inc.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.idl
index 2c350c994c..ef7e4ab584 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=65e3374d-4789-4c81-983b-1b5a29d2c075,
-        ImplementationUUID=a9ac9c73-055d-4c00-bd02-1fa215ae32f1
-    ] HTMLMetaElement : HTMLElement {
+    interface HTMLMetaElement : HTMLElement {
         attribute  [ConvertNullToNullString] DOMString    content;
         attribute  [ConvertNullToNullString] DOMString    httpEquiv;
         attribute  [ConvertNullToNullString] DOMString    name;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLModElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLModElement.cpp
index b48182aa44..19b340386b 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLModElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLModElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLModElement.h b/src/3rdparty/webkit/WebCore/html/HTMLModElement.h
index 83697f95c2..9d9e6c1315 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLModElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLModElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLModElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLModElement.idl
index a22b7b44dc..a6e3a02ee0 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLModElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLModElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=78c2bf89-c6e7-4d81-97df-429d07b91ff8,
-        ImplementationUUID=39e7c659-40be-4620-949b-15ec6a25bb90
-    ] HTMLModElement : HTMLElement {
+    interface HTMLModElement : HTMLElement {
         attribute [ConvertNullToNullString] DOMString cite;
         attribute [ConvertNullToNullString] DOMString dateTime;
     };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.cpp b/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.cpp
index d5657dab6e..eb88c02f90 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.cpp
@@ -63,7 +63,7 @@ Element* HTMLNameCollection::itemAfter(Element* previous) const
                     e->hasTagName(objectTag))
                     if (e->getAttribute(nameAttr) == m_name)
                         return e;
-                if (e->getAttribute(idAttr) == m_name)
+                if (e->getAttribute(e->idAttributeName()) == m_name)
                     return e;
                 break;
             case DocumentNamedItems:
@@ -74,14 +74,14 @@ Element* HTMLNameCollection::itemAfter(Element* previous) const
                     if (e->getAttribute(nameAttr) == m_name)
                         return e;
                 } else if (e->hasTagName(appletTag)) {
-                    if (e->getAttribute(nameAttr) == m_name || e->getAttribute(idAttr) == m_name)
+                    if (e->getAttribute(nameAttr) == m_name || e->getAttribute(e->idAttributeName()) == m_name)
                         return e;
                 } else if (e->hasTagName(objectTag)) {
-                    if ((e->getAttribute(nameAttr) == m_name || e->getAttribute(idAttr) == m_name)
+                    if ((e->getAttribute(nameAttr) == m_name || e->getAttribute(e->idAttributeName()) == m_name)
                             && static_cast<HTMLObjectElement*>(e)->isDocNamedItem())
                         return e;
                 } else if (e->hasTagName(imgTag)) {
-                    if (e->getAttribute(nameAttr) == m_name || (e->getAttribute(idAttr) == m_name && e->hasAttribute(nameAttr)))
+                    if (e->getAttribute(nameAttr) == m_name || (e->getAttribute(e->idAttributeName()) == m_name && e->hasAttribute(nameAttr)))
                         return e;
                 }
                 break;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOListElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLOListElement.idl
index d787ee70c6..32d81f2a55 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOListElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOListElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=64165a4c-8889-4725-a149-abd13d5b4b61,
-        ImplementationUUID=a20e9b6a-e3a5-4276-aa43-0097e57df8d8
-    ] HTMLOListElement : HTMLElement {
+    interface HTMLOListElement : HTMLElement {
         attribute boolean compact;
         attribute long start;
         attribute [ConvertNullToNullString] DOMString type;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
index d3ccfa4b8a..74fbf21d7b 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
@@ -35,8 +35,8 @@
 #include "ScriptEventListener.h"
 #include "MIMETypeRegistry.h"
 #include "MappedAttribute.h"
+#include "RenderEmbeddedObject.h"
 #include "RenderImage.h"
-#include "RenderPartObject.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
 #include "Text.h"
@@ -61,12 +61,10 @@ PassRefPtr<HTMLObjectElement> HTMLObjectElement::create(const QualifiedName& tag
 
 RenderWidget* HTMLObjectElement::renderWidgetForJSBindings() const
 {
-    RenderWidget* renderWidget = (renderer() && renderer()->isWidget()) ? toRenderWidget(renderer()) : 0;
-    if (renderWidget && !renderWidget->widget()) {
-        document()->updateLayoutIgnorePendingStylesheets();
-        renderWidget = (renderer() && renderer()->isWidget()) ? toRenderWidget(renderer()) : 0;
-    }
-    return renderWidget;
+    document()->updateLayoutIgnorePendingStylesheets();
+    if (!renderer() || !renderer()->isWidget())
+        return 0;
+    return toRenderWidget(renderer());
 }
 
 void HTMLObjectElement::parseMappedAttribute(MappedAttribute *attr)
@@ -107,7 +105,7 @@ void HTMLObjectElement::parseMappedAttribute(MappedAttribute *attr)
             document->addNamedItem(newName);
         }
         m_name = newName;
-    } else if (attr->name() == idAttr) {
+    } else if (attr->name() == idAttributeName()) {
         const AtomicString& newId = attr->value();
         if (isDocNamedItem() && inDocument() && document()->isHTMLDocument()) {
             HTMLDocument* document = static_cast<HTMLDocument*>(this->document());
@@ -140,7 +138,7 @@ RenderObject *HTMLObjectElement::createRenderer(RenderArena* arena, RenderStyle*
         return RenderObject::createObject(this, style);
     if (isImageType())
         return new (arena) RenderImage(this);
-    return new (arena) RenderPartObject(this);
+    return new (arena) RenderEmbeddedObject(this);
 }
 
 void HTMLObjectElement::attach()
@@ -169,7 +167,7 @@ void HTMLObjectElement::updateWidget()
 {
     document()->updateStyleIfNeeded();
     if (m_needWidgetUpdate && renderer() && !m_useFallbackContent && !isImageType())
-        toRenderPartObject(renderer())->updateWidget(true);
+        toRenderEmbeddedObject(renderer())->updateWidget(true);
 }
 
 void HTMLObjectElement::finishParsingChildren()
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl
index b51c568215..be91dc4454 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl
@@ -21,13 +21,9 @@
 module html {
 
     interface [
-        GenerateConstructor,
         DelegatingPutFunction,
         DelegatingGetOwnPropertySlot,
-        CustomCall,
-        HasOverridingNameGetter,
-        InterfaceUUID=9d04a3b8-9016-4b64-913a-3b00d548aca7,
-        ImplementationUUID=2dd24554-6784-4ef9-9713-179f3d37b2f9
+        CustomCall
     ] HTMLObjectElement : HTMLElement {
         readonly attribute HTMLFormElement form;
                  attribute [ConvertNullToNullString, Reflect] DOMString       code;
@@ -51,14 +47,12 @@ module html {
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
 #if defined(ENABLE_SVG) && ENABLE_SVG
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
         [SVGCheckSecurityDocument] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
-#endif
 
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.idl
index 9f07c38a76..691bd1365f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=18b0ea8c-d3ea-4b14-abd8-8e1d4269fffc,
-        ImplementationUUID=e26d8c4b-5181-4858-8231-f68ccbf819df
-    ] HTMLOptGroupElement : HTMLElement {
+    interface HTMLOptGroupElement : HTMLElement {
         attribute  boolean              disabled;
         attribute  [ConvertNullToNullString] DOMString            label;
     };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp
index 316b192485..b33f628ce1 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp
@@ -2,8 +2,9 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
+ * Copyright (C) 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -41,13 +42,33 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLOptionElement::HTMLOptionElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
-    : HTMLFormControlElement(tagName, doc, f)
+HTMLOptionElement::HTMLOptionElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
+    : HTMLFormControlElement(tagName, document, form)
     , m_style(0)
 {
     ASSERT(hasTagName(optionTag));
 }
 
+PassRefPtr<HTMLOptionElement> HTMLOptionElement::createForJSConstructor(Document* document, const String& data, const String& value,
+        bool defaultSelected, bool selected, ExceptionCode& ec)
+{
+    RefPtr<HTMLOptionElement> element = new HTMLOptionElement(optionTag, document);
+
+    RefPtr<Text> text = Text::create(document, data.isNull() ? "" : data);
+
+    ec = 0;
+    element->appendChild(text.release(), ec);
+    if (ec)
+        return 0;
+
+    if (!value.isNull())
+        element->setValue(value);
+    element->setDefaultSelected(defaultSelected);
+    element->setSelected(selected);
+
+    return element.release();
+}
+
 bool HTMLOptionElement::checkDTD(const Node* newChild)
 {
     return newChild->isTextNode() || newChild->hasTagName(scriptTag);
@@ -137,6 +158,8 @@ void HTMLOptionElement::setValue(const String& value)
 
 bool HTMLOptionElement::selected() const
 {
+    if (HTMLSelectElement* select = ownerSelectElement())
+        select->recalcListItemsIfNeeded();
     return m_data.selected();
 }
 
@@ -172,7 +195,7 @@ HTMLSelectElement* HTMLOptionElement::ownerSelectElement() const
 
     if (!select)
         return 0;
-    
+
     return static_cast<HTMLSelectElement*>(select);
 }
 
@@ -201,9 +224,9 @@ void HTMLOptionElement::setRenderStyle(PassRefPtr<RenderStyle> newStyle)
     m_style = newStyle;
 }
 
-RenderStyle* HTMLOptionElement::nonRendererRenderStyle() const 
-{ 
-    return m_style.get(); 
+RenderStyle* HTMLOptionElement::nonRendererRenderStyle() const
+{
+    return m_style.get();
 }
 
 String HTMLOptionElement::textIndentedToRespectGroupLabel() const
@@ -212,19 +235,20 @@ String HTMLOptionElement::textIndentedToRespectGroupLabel() const
 }
 
 bool HTMLOptionElement::disabled() const
-{ 
-    return HTMLFormControlElement::disabled() || (parentNode() && static_cast<HTMLFormControlElement*>(parentNode())->disabled()); 
+{
+    return ownElementDisabled() || (parentNode() && static_cast<HTMLFormControlElement*>(parentNode())->disabled());
 }
 
 void HTMLOptionElement::insertedIntoTree(bool deep)
 {
     if (HTMLSelectElement* select = ownerSelectElement()) {
         select->setRecalcListItems();
-        if (selected())
+        // Avoid our selected() getter since it will recalculate list items incorrectly for us.
+        if (m_data.selected())
             select->setSelectedIndex(index(), false);
         select->scrollToSelection();
     }
-    
+
     HTMLFormControlElement::insertedIntoTree(deep);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h
index 843608feac..4255f25b54 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h
@@ -3,6 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -39,6 +40,9 @@ class HTMLOptionElement : public HTMLFormControlElement, public OptionElement {
 public:
     HTMLOptionElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
+    static PassRefPtr<HTMLOptionElement> createForJSConstructor(Document*, const String& data, const String& value,
+       bool defaultSelected, bool selected, ExceptionCode&);
+
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusOptional; }
     virtual int tagPriority() const { return 2; }
     virtual bool checkDTD(const Node* newChild);
@@ -48,7 +52,7 @@ public:
     virtual void attach();
     virtual void detach();
     virtual void setRenderStyle(PassRefPtr<RenderStyle>);
-    
+
     virtual const AtomicString& formControlType() const;
 
     virtual String text() const;
@@ -76,11 +80,12 @@ public:
 
     virtual String textIndentedToRespectGroupLabel() const;
 
+    bool ownElementDisabled() const { return HTMLFormControlElement::disabled(); }
     virtual bool disabled() const;
-    
+
     virtual void insertedIntoTree(bool);
     virtual void accessKeyAction(bool);
-    
+
 private:
     virtual RenderStyle* nonRendererRenderStyle() const;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.idl
index 612d4599a2..c43132e1e1 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.idl
@@ -21,10 +21,7 @@
 module html {
 
     interface [
-        GenerateConstructor,
-        GenerateNativeConverter,
-        InterfaceUUID=74a7b64a-cf18-4da9-b3aa-e1f4d245d607,
-        ImplementationUUID=166915d5-2c93-404b-b076-af3fa5ccbd83
+        GenerateNativeConverter
     ] HTMLOptionElement : HTMLElement {
         readonly attribute  HTMLFormElement      form;
                  attribute  boolean              defaultSelected;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.cpp b/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.cpp
index 0b88183c6a..db9a457ace 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl b/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl
index a7e191a42a..d9bfd45328 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl
@@ -23,9 +23,7 @@ module html {
     // FIXME: The W3C spec says that HTMLOptionsCollection should not have a parent class.
     interface [
         GenerateNativeConverter,
-        HasCustomIndexSetter,
-        InterfaceUUID=a03aaeac-e47d-4bb3-acb4-f1897ae74237,
-        ImplementationUUID=99c11fde-6f9f-44a4-a041-49a894c52e70
+        HasCustomIndexSetter
     ] HTMLOptionsCollection : HTMLCollection {
                  attribute long selectedIndex;
                  attribute [Custom] unsigned long length
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParagraphElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLParagraphElement.idl
index b974ec2b6a..cd3b940afa 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParagraphElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParagraphElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=dffe0809-f3f8-499d-8d5c-7d9893f23337,
-        ImplementationUUID=21d60b62-4ecb-4849-8729-0a40c64d12aa
-    ] HTMLParagraphElement : HTMLElement {
+    interface HTMLParagraphElement : HTMLElement {
         attribute [ConvertNullToNullString] DOMString align;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParamElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLParamElement.cpp
index d5fc6e70f3..2b0637ac56 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParamElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParamElement.cpp
@@ -43,7 +43,7 @@ HTMLParamElement::~HTMLParamElement()
 
 void HTMLParamElement::parseMappedAttribute(MappedAttribute* attr)
 {
-    if (attr->name() == idAttr) {
+    if (attr->name() == idAttributeName()) {
         // Must call base class so that hasID bit gets set.
         HTMLElement::parseMappedAttribute(attr);
         if (document()->isHTMLDocument())
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParamElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLParamElement.idl
index 805d170943..2473381993 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParamElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParamElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=76e05eee-c30d-4d52-a356-271f17b31dbf,
-        ImplementationUUID=418d8a82-0a99-4c6f-a630-1e6071a74350
-    ] HTMLParamElement : HTMLElement {
+    interface HTMLParamElement : HTMLElement {
         attribute [ConvertNullToNullString] DOMString name;
         attribute [ConvertNullToNullString] DOMString type;
         attribute [ConvertNullToNullString] DOMString value;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp b/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
index 99c66defb1..c5839a8450 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
@@ -28,6 +28,7 @@
 #include "CharacterNames.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "Comment.h"
 #include "Console.h"
@@ -64,6 +65,8 @@ using namespace HTMLNames;
 
 static const unsigned cMaxRedundantTagDepth = 20;
 static const unsigned cResidualStyleMaxDepth = 200;
+static const unsigned cResidualStyleIterationLimit = 5;
+
 
 static const int minBlockLevelTagPriority = 3;
 
@@ -137,11 +140,12 @@ HTMLParser::HTMLParser(HTMLDocument* doc, bool reportErrors)
     , m_reportErrors(reportErrors)
     , m_handlingResidualStyleAcrossBlocks(false)
     , m_inStrayTableContent(0)
+    , m_scriptingPermission(FragmentScriptingAllowed)
     , m_parserQuirks(m_document->page() ? m_document->page()->chrome()->client()->createHTMLParserQuirks() : 0)
 {
 }
 
-HTMLParser::HTMLParser(DocumentFragment* frag)
+HTMLParser::HTMLParser(DocumentFragment* frag, FragmentScriptingPermission scriptingPermission)
     : m_document(frag->document())
     , m_current(frag)
     , m_didRefCurrent(true)
@@ -155,6 +159,7 @@ HTMLParser::HTMLParser(DocumentFragment* frag)
     , m_reportErrors(false)
     , m_handlingResidualStyleAcrossBlocks(false)
     , m_inStrayTableContent(0)
+    , m_scriptingPermission(scriptingPermission)
     , m_parserQuirks(m_document->page() ? m_document->page()->chrome()->client()->createHTMLParserQuirks() : 0)
 {
     if (frag)
@@ -203,6 +208,25 @@ void HTMLParser::setCurrent(Node* newCurrent)
     m_didRefCurrent = didRefNewCurrent;
 }
 
+inline static int tagPriorityOfNode(Node* n)
+{
+    return n->isHTMLElement() ? static_cast<HTMLElement*>(n)->tagPriority() : 0;
+}
+
+inline void HTMLParser::limitBlockDepth(int tagPriority)
+{
+    if (tagPriority >= minBlockLevelTagPriority) {
+        while (m_blocksInStack >= cMaxBlockDepth)
+            popBlock(m_blockStack->tagName);
+    }
+}
+
+inline bool HTMLParser::insertNodeAfterLimitBlockDepth(Node* n, bool flat)
+{
+    limitBlockDepth(tagPriorityOfNode(n));
+    return insertNode(n, flat);
+}
+
 PassRefPtr<Node> HTMLParser::parseToken(Token* t)
 {
     if (!m_skipModeTag.isNull()) {
@@ -241,7 +265,7 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
         while (charsLeft) {
             // split large blocks of text to nodes of manageable size
             n = Text::createWithLengthLimit(m_document, text, charsLeft);
-            if (!insertNode(n.get(), t->selfClosingTag))
+            if (!insertNodeAfterLimitBlockDepth(n.get(), t->selfClosingTag))
                 return 0;
         }
         return n;
@@ -255,7 +279,8 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
     // set attributes
     if (n->isHTMLElement()) {
         HTMLElement* e = static_cast<HTMLElement*>(n.get());
-        e->setAttributeMap(t->attrs.get());
+        if (m_scriptingPermission == FragmentScriptingAllowed || t->tagName != scriptTag)
+            e->setAttributeMap(t->attrs.get(), m_scriptingPermission);
 
         // take care of optional close tags
         if (e->endTagRequirement() == TagStatusOptional)
@@ -271,7 +296,7 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
         }
     }
 
-    if (!insertNode(n.get(), t->selfClosingTag)) {
+    if (!insertNodeAfterLimitBlockDepth(n.get(), t->selfClosingTag)) {
         // we couldn't insert the node
 
         if (n->isElementNode()) {
@@ -329,21 +354,17 @@ bool HTMLParser::insertNode(Node* n, bool flat)
     RefPtr<Node> protectNode(n);
 
     const AtomicString& localName = n->localName();
-    int tagPriority = n->isHTMLElement() ? static_cast<HTMLElement*>(n)->tagPriority() : 0;
     
     // <table> is never allowed inside stray table content.  Always pop out of the stray table content
     // and close up the first table, and then start the second table as a sibling.
     if (m_inStrayTableContent && localName == tableTag)
         popBlock(tableTag);
 
-    if (tagPriority >= minBlockLevelTagPriority) {
-        while (m_blocksInStack >= cMaxBlockDepth)
-            popBlock(m_blockStack->tagName);
-    }
-
     if (m_parserQuirks && !m_parserQuirks->shouldInsertNode(m_current, n))
         return false;
 
+    int tagPriority = tagPriorityOfNode(n);
+
     // let's be stupid and just try to insert it.
     // this should work if the document is well-formed
     Node* newNode = m_current->addChild(n);
@@ -379,7 +400,7 @@ bool HTMLParser::insertNode(Node* n, bool flat)
         n->finishParsingChildren();
     }
 
-    if (localName == htmlTag && m_document->frame())
+    if (localName == htmlTag && m_document->frame() && !m_isParsingFragment)
         m_document->frame()->loader()->dispatchDocumentElementAvailable();
 
     return true;
@@ -425,7 +446,7 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
             }
         } else if (h->hasLocalName(htmlTag)) {
             if (!m_current->isDocumentNode() ) {
-                if (m_document->documentElement() && m_document->documentElement()->hasTagName(htmlTag)) {
+                if (m_document->documentElement() && m_document->documentElement()->hasTagName(htmlTag) && !m_isParsingFragment) {
                     reportError(RedundantHTMLBodyError, &localName);
                     // we have another <HTML> element.... apply attributes to existing one
                     // make sure we don't overwrite already existing attributes
@@ -468,7 +489,7 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                 return false;
             }
         } else if (h->hasLocalName(bodyTag)) {
-            if (m_inBody && m_document->body()) {
+            if (m_inBody && m_document->body() && !m_isParsingFragment) {
                 // we have another <BODY> element.... apply attributes to existing one
                 // make sure we don't overwrite already existing attributes
                 // some sites use <body bgcolor=rightcolor>...<body bgcolor=wrongcolor>
@@ -482,8 +503,7 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                         existingBody->setAttribute(it->name(), it->value());
                 }
                 return false;
-            }
-            else if (!m_current->isDocumentNode())
+            } else if (!m_current->isDocumentNode())
                 return false;
         } else if (h->hasLocalName(areaTag)) {
             if (m_currentMapElement) {
@@ -530,7 +550,7 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                 if (!m_haveFrameSet) {
                     // Ensure that head exists.
                     // But not for older versions of Mail, where the implicit <head> isn't expected - <rdar://problem/6863795>
-                    if (shouldCreateImplicitHead(m_document))
+                    if (!m_isParsingFragment && shouldCreateImplicitHead(m_document))
                         createHead();
 
                     popBlock(headTag);
@@ -637,7 +657,7 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
             reportError(MisplacedContentRetryError, &localName, &currentTagName);
             popBlock(objectTag);
             handled = true;
-        } else if (h->hasLocalName(pTag) || isHeaderTag(currentTagName)) {
+        } else if (h->hasLocalName(pTag) || isHeadingTag(currentTagName)) {
             if (!isInline(n)) {
                 popBlock(currentTagName);
                 handled = true;
@@ -737,7 +757,7 @@ bool HTMLParser::framesetCreateErrorCheck(Token*, RefPtr<Node>&)
         // we can't implement that behaviour now because it could cause too many
         // regressions and the headaches are not worth the work as long as there is
         // no site actually relying on that detail (Dirk)
-        if (m_document->body())
+        if (m_document->body() && !m_isParsingFragment)
             m_document->body()->setAttribute(styleAttr, "display:none");
         m_inBody = false;
     }
@@ -855,8 +875,8 @@ bool HTMLParser::noframesCreateErrorCheck(Token*, RefPtr<Node>&)
 bool HTMLParser::noscriptCreateErrorCheck(Token*, RefPtr<Node>&)
 {
     if (!m_isParsingFragment) {
-        Settings* settings = m_document->settings();
-        if (settings && settings->isJavaScriptEnabled())
+        Frame* frame = m_document->frame();
+        if (frame && frame->script()->canExecuteScripts(NotAboutToExecuteScript))
             setSkipMode(noscriptTag);
     }
     return true;
@@ -892,6 +912,8 @@ PassRefPtr<Node> HTMLParser::getNode(Token* t)
     if (gFunctionMap.isEmpty()) {
         gFunctionMap.set(aTag.localName().impl(), &HTMLParser::nestedCreateErrorCheck);
         gFunctionMap.set(addressTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
+        gFunctionMap.set(articleTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
+        gFunctionMap.set(asideTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(bTag.localName().impl(), &HTMLParser::nestedStyleCreateErrorCheck);
         gFunctionMap.set(bigTag.localName().impl(), &HTMLParser::nestedStyleCreateErrorCheck);
         gFunctionMap.set(blockquoteTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
@@ -906,6 +928,7 @@ PassRefPtr<Node> HTMLParser::getNode(Token* t)
         gFunctionMap.set(dtTag.localName().impl(), &HTMLParser::dtCreateErrorCheck);
         gFunctionMap.set(formTag.localName().impl(), &HTMLParser::formCreateErrorCheck);
         gFunctionMap.set(fieldsetTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
+        gFunctionMap.set(footerTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(framesetTag.localName().impl(), &HTMLParser::framesetCreateErrorCheck);
         gFunctionMap.set(h1Tag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(h2Tag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
@@ -914,6 +937,8 @@ PassRefPtr<Node> HTMLParser::getNode(Token* t)
         gFunctionMap.set(h5Tag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(h6Tag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(headTag.localName().impl(), &HTMLParser::headCreateErrorCheck);
+        gFunctionMap.set(headerTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
+        gFunctionMap.set(hgroupTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(hrTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(iTag.localName().impl(), &HTMLParser::nestedStyleCreateErrorCheck);
         gFunctionMap.set(isindexTag.localName().impl(), &HTMLParser::isindexCreateErrorCheck);
@@ -925,9 +950,7 @@ PassRefPtr<Node> HTMLParser::getNode(Token* t)
         gFunctionMap.set(nobrTag.localName().impl(), &HTMLParser::nestedCreateErrorCheck);
         gFunctionMap.set(noembedTag.localName().impl(), &HTMLParser::noembedCreateErrorCheck);
         gFunctionMap.set(noframesTag.localName().impl(), &HTMLParser::noframesCreateErrorCheck);
-#if !ENABLE(XHTMLMP)
         gFunctionMap.set(noscriptTag.localName().impl(), &HTMLParser::noscriptCreateErrorCheck);
-#endif
         gFunctionMap.set(olTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(pTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(plaintextTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
@@ -935,6 +958,7 @@ PassRefPtr<Node> HTMLParser::getNode(Token* t)
         gFunctionMap.set(rpTag.localName().impl(), &HTMLParser::rpCreateErrorCheck);
         gFunctionMap.set(rtTag.localName().impl(), &HTMLParser::rtCreateErrorCheck);
         gFunctionMap.set(sTag.localName().impl(), &HTMLParser::nestedStyleCreateErrorCheck);
+        gFunctionMap.set(sectionTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(selectTag.localName().impl(), &HTMLParser::selectCreateErrorCheck);
         gFunctionMap.set(smallTag.localName().impl(), &HTMLParser::nestedStyleCreateErrorCheck);
         gFunctionMap.set(strikeTag.localName().impl(), &HTMLParser::nestedStyleCreateErrorCheck);
@@ -1002,19 +1026,19 @@ void HTMLParser::processCloseTag(Token* t)
     }
 }
 
-bool HTMLParser::isHeaderTag(const AtomicString& tagName)
+bool HTMLParser::isHeadingTag(const AtomicString& tagName)
 {
-    DEFINE_STATIC_LOCAL(HashSet<AtomicStringImpl*>, headerTags, ());
-    if (headerTags.isEmpty()) {
-        headerTags.add(h1Tag.localName().impl());
-        headerTags.add(h2Tag.localName().impl());
-        headerTags.add(h3Tag.localName().impl());
-        headerTags.add(h4Tag.localName().impl());
-        headerTags.add(h5Tag.localName().impl());
-        headerTags.add(h6Tag.localName().impl());
+    DEFINE_STATIC_LOCAL(HashSet<AtomicStringImpl*>, headingTags, ());
+    if (headingTags.isEmpty()) {
+        headingTags.add(h1Tag.localName().impl());
+        headingTags.add(h2Tag.localName().impl());
+        headingTags.add(h3Tag.localName().impl());
+        headingTags.add(h4Tag.localName().impl());
+        headingTags.add(h5Tag.localName().impl());
+        headingTags.add(h6Tag.localName().impl());
     }
     
-    return headerTags.contains(tagName.impl());
+    return headingTags.contains(tagName.impl());
 }
 
 bool HTMLParser::isInline(Node* node) const
@@ -1037,8 +1061,8 @@ bool HTMLParser::isInline(Node* node) const
             return true;
 #if !ENABLE(XHTMLMP)
         if (e->hasLocalName(noscriptTag) && !m_isParsingFragment) {
-            Settings* settings = m_document->settings();
-            if (settings && settings->isJavaScriptEnabled())
+            Frame* frame = m_document->frame();
+            if (frame && frame->script()->canExecuteScripts(NotAboutToExecuteScript))
                 return true;
         }
 #endif
@@ -1106,8 +1130,10 @@ void HTMLParser::handleResidualStyleCloseTagAcrossBlocks(HTMLStackElem* elem)
     bool finished = false;
     bool strayTableContent = elem->strayTableContent;
 
+    unsigned iterationCount = 0;
+
     m_handlingResidualStyleAcrossBlocks = true;
-    while (!finished) {
+    while (!finished && (iterationCount++ < cResidualStyleIterationLimit)) {
         // Find the outermost element that crosses over to a higher level. If there exists another higher-level
         // element, we will do another pass, until we have corrected the innermost one.
         ExceptionCode ec = 0;
@@ -1564,12 +1590,16 @@ void HTMLParser::createHead()
     if (m_head)
         return;
 
-    if (!m_document->documentElement()) {
+    if (!m_document->documentElement() && !m_isParsingFragment) {
         insertNode(new HTMLHtmlElement(htmlTag, m_document));
-        ASSERT(m_document->documentElement());
+        ASSERT(m_document->documentElement() || m_isParsingFragment);
     }
 
     m_head = new HTMLHeadElement(headTag, m_document);
+
+    if (m_isParsingFragment)
+        return;
+
     HTMLElement* body = m_document->body();
     ExceptionCode ec = 0;
     m_document->documentElement()->insertBefore(m_head.get(), body, ec);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParser.h b/src/3rdparty/webkit/WebCore/html/HTMLParser.h
index 094582635e..acb6a6fa4d 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParser.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParser.h
@@ -29,6 +29,7 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 #include "HTMLParserErrorCodes.h"
+#include "MappedAttributeEntry.h"
 
 namespace WebCore {
 
@@ -52,7 +53,7 @@ struct Token;
 class HTMLParser : public Noncopyable {
 public:
     HTMLParser(HTMLDocument*, bool reportErrors);
-    HTMLParser(DocumentFragment*);
+    HTMLParser(DocumentFragment*, FragmentScriptingPermission = FragmentScriptingAllowed);
     virtual ~HTMLParser();
 
     /**
@@ -111,6 +112,9 @@ private:
 
     void processCloseTag(Token*);
 
+    void limitBlockDepth(int tagPriority);
+
+    bool insertNodeAfterLimitBlockDepth(Node*, bool flat = false);
     bool insertNode(Node*, bool flat = false);
     bool handleError(Node*, bool flat, const AtomicString& localName, int tagPriority);
     
@@ -133,8 +137,7 @@ private:
 
     bool allowNestedRedundantTag(const AtomicString& tagName);
     
-    static bool isHeaderTag(const AtomicString& tagName);
-    void popNestedHeaderTag();
+    static bool isHeadingTag(const AtomicString& tagName);
 
     bool isInline(Node*) const;
     
@@ -186,6 +189,7 @@ private:
     bool m_reportErrors;
     bool m_handlingResidualStyleAcrossBlocks;
     int m_inStrayTableContent;
+    FragmentScriptingPermission m_scriptingPermission;
 
     OwnPtr<HTMLParserQuirks> m_parserQuirks;
 };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp
index 2f429b42c1..a5edc35fe6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
@@ -47,7 +45,6 @@ namespace WebCore {
 using namespace HTMLNames;
 
 HTMLPlugInElement::HTMLPlugInElement(const QualifiedName& tagName, Document* doc)
-    // FIXME: Always passing false as createdByParser is odd (see bug22851).
     : HTMLFrameOwnerElement(tagName, doc)
 #if ENABLE(NETSCAPE_PLUGIN_API)
     , m_NPObject(0)
@@ -154,6 +151,12 @@ bool HTMLPlugInElement::checkDTD(const Node* newChild)
 
 void HTMLPlugInElement::defaultEventHandler(Event* event)
 {
+    // Firefox seems to use a fake event listener to dispatch events to plug-in (tested with mouse events only).
+    // This is observable via different order of events - in Firefox, event listeners specified in HTML attributes fires first, then an event
+    // gets dispatched to plug-in, and only then other event listeners fire. Hopefully, this difference does not matter in practice.
+
+    // FIXME: Mouse down and scroll events are passed down to plug-in via custom code in EventHandler; these code paths should be united.
+
     RenderObject* r = renderer();
     if (!r || !r->isWidget())
         return;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLPreElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLPreElement.cpp
index f340ae39a0..030660fdb1 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLPreElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLPreElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003 Apple Computer, Inc.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLPreElement.h b/src/3rdparty/webkit/WebCore/html/HTMLPreElement.h
index 691daf8f42..e84f4b3558 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLPreElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLPreElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLPreElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLPreElement.idl
index 5597d95582..5dc0e9eae5 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLPreElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLPreElement.idl
@@ -20,11 +20,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=84050abc-45e6-4fd8-bdc3-29c7b4efb5cb,
-        ImplementationUUID=e6de0d19-883e-4e87-9569-fd068e5ee17d
-    ] HTMLPreElement : HTMLElement {
+    interface HTMLPreElement : HTMLElement {
         // FIXME: DOM spec says that width should be of type DOMString
         // see http://bugs.webkit.org/show_bug.cgi?id=8992
         attribute long width;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLProgressElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLProgressElement.cpp
new file mode 100644
index 0000000000..132fcde59f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLProgressElement.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#if ENABLE(PROGRESS_TAG)
+#include "HTMLProgressElement.h"
+
+#include "EventNames.h"
+#include "FormDataList.h"
+#include "HTMLFormElement.h"
+#include "HTMLNames.h"
+#include "MappedAttribute.h"
+#include "RenderProgress.h"
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+HTMLProgressElement::HTMLProgressElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
+    : HTMLFormControlElement(tagName, document, form, CreateElement)
+{
+    ASSERT(hasTagName(progressTag));
+}
+
+PassRefPtr<HTMLProgressElement> HTMLProgressElement::create(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
+{
+    return adoptRef(new HTMLProgressElement(tagName, document, form));
+}
+
+RenderObject* HTMLProgressElement::createRenderer(RenderArena* arena, RenderStyle* style)
+{
+    return new (arena) RenderProgress(this);
+}
+
+const AtomicString& HTMLProgressElement::formControlType() const
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, progress, ("progress"));
+    return progress;
+}
+
+void HTMLProgressElement::parseMappedAttribute(MappedAttribute* attribute)
+{
+    if (attribute->name() == valueAttr) {
+        if (renderer())
+            renderer()->updateFromElement();
+    } else if (attribute->name() == maxAttr) {
+        if (renderer())
+            renderer()->updateFromElement();
+    } else
+        HTMLFormControlElement::parseMappedAttribute(attribute);
+}
+
+double HTMLProgressElement::value() const
+{
+    const AtomicString& valueString = getAttribute(valueAttr);
+    bool ok;
+    double value = valueString.toDouble(&ok);
+    if (!ok || value < 0)
+        return valueString.isNull() ? 1 : 0;
+    return (value > max()) ? max() : value;
+}
+
+void HTMLProgressElement::setValue(double value)
+{
+    setAttribute(valueAttr, String::number(value >= 0 ? value : 0));
+}
+
+double HTMLProgressElement::max() const
+{
+    bool ok;
+    double max = getAttribute(maxAttr).toDouble(&ok);
+    if (!ok || max <= 0)
+        return 1;
+    return max;
+}
+
+void HTMLProgressElement::setMax(double max)
+{
+    setAttribute(maxAttr, String::number(max > 0 ? max : 1));
+}
+
+double HTMLProgressElement::position() const
+{
+    if (!hasAttribute(valueAttr))
+        return -1;
+    return value() / max();
+}
+
+} // namespace
+#endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLProgressElement.h b/src/3rdparty/webkit/WebCore/html/HTMLProgressElement.h
new file mode 100644
index 0000000000..a925fc50a2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLProgressElement.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef HTMLProgressElement_h
+#define HTMLProgressElement_h
+
+#if ENABLE(PROGRESS_TAG)
+#include "HTMLFormControlElement.h"
+
+namespace WebCore {
+
+class HTMLProgressElement : public HTMLFormControlElement {
+public:
+    static PassRefPtr<HTMLProgressElement> create(const QualifiedName&, Document*, HTMLFormElement* = 0);
+
+    double value() const;
+    void setValue(double);
+
+    double max() const;
+    void setMax(double);
+
+    double position() const;
+
+private:
+    HTMLProgressElement(const QualifiedName&, Document*, HTMLFormElement*);
+
+    virtual bool isOptionalFormControl() const { return true; }
+
+    virtual const AtomicString& formControlType() const;
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+
+    virtual void parseMappedAttribute(MappedAttribute*);
+};
+
+} // namespace
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLProgressElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLProgressElement.idl
new file mode 100644
index 0000000000..8da62aa539
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLProgressElement.idl
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module html {
+    interface [
+        Conditional=PROGRESS_TAG
+    ] HTMLProgressElement : HTMLElement {
+                 attribute  double                value;
+                 attribute  double                max;
+        readonly attribute  double                position;
+        readonly attribute  HTMLFormElement       form;
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.idl
index 99047c4e8d..f95dc208e8 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=a011e1a3-19ec-4999-a225-79ebdc64abdd,
-        ImplementationUUID=85c885ee-cc47-4d98-852c-fb907d573024
-    ] HTMLQuoteElement : HTMLElement {
+    interface HTMLQuoteElement : HTMLElement {
         attribute [ConvertNullToNullString] DOMString cite;
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp
index 636c579d27..58c3b03f24 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp
@@ -220,6 +220,11 @@ String HTMLScriptElement::forAttributeValue() const
     return getAttribute(forAttr).string();
 }
 
+String HTMLScriptElement::eventAttributeValue() const
+{
+    return getAttribute(eventAttr).string();
+}
+
 void HTMLScriptElement::dispatchLoadEvent()
 {
     ASSERT(!m_data.haveFiredLoadEvent());
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.h b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.h
index 4d18beb467..b6d683f051 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.h
@@ -83,6 +83,7 @@ protected:
     virtual String typeAttributeValue() const;
     virtual String languageAttributeValue() const;
     virtual String forAttributeValue() const;
+    virtual String eventAttributeValue() const;
 
     virtual void dispatchLoadEvent();
     virtual void dispatchErrorEvent();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.idl
index 4a19b8c73b..8985512b21 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=57ddf4da-1c9b-4005-87d7-eb9b2ed78e95,
-        ImplementationUUID=2edb1093-08f1-4e76-9728-df5dedb879fe
-    ] HTMLScriptElement : HTMLElement {
+    interface HTMLScriptElement : HTMLElement {
         attribute [ConvertNullToNullString] DOMString text;
         attribute [ConvertNullToNullString] DOMString htmlFor;
         attribute [ConvertNullToNullString] DOMString event;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp
index 2409f31731..29c5b37839 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp
@@ -1,9 +1,11 @@
 /*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -59,7 +61,6 @@ bool HTMLSelectElement::checkDTD(const Node* newChild)
 
 void HTMLSelectElement::recalcStyle(StyleChange change)
 {
-    SelectElement::recalcStyle(m_data, this);
     HTMLFormControlElementWithState::recalcStyle(change);
 }
 
@@ -87,9 +88,27 @@ void HTMLSelectElement::setSelectedIndex(int optionIndex, bool deselect)
 
 void HTMLSelectElement::setSelectedIndexByUser(int optionIndex, bool deselect, bool fireOnChangeNow)
 {
+    // Bail out if this index is already the selected one, to avoid running unnecessary JavaScript that can mess up
+    // autofill, when there is no actual change (see https://bugs.webkit.org/show_bug.cgi?id=35256 and rdar://7467917 ).
+    // Perhaps this logic could be moved into SelectElement, but some callers of SelectElement::setSelectedIndex()
+    // seem to expect it to fire its change event even when the index was already selected.
+    if (optionIndex == selectedIndex())
+        return;
+    
     SelectElement::setSelectedIndex(m_data, this, optionIndex, deselect, fireOnChangeNow, true);
 }
 
+void HTMLSelectElement::listBoxSelectItem(int listIndex, bool allowMultiplySelections, bool shift, bool fireOnChangeNow)
+{
+    if (!multiple())
+        setSelectedIndexByUser(listIndex, true, fireOnChangeNow);
+    else {
+        updateSelectedState(m_data, this, listIndex, allowMultiplySelections, shift);
+        if (fireOnChangeNow)
+            listBoxOnChange();
+    }
+}
+
 int HTMLSelectElement::activeSelectionStartListIndex() const
 {
     if (m_data.activeSelectionAnchorIndex() >= 0)
@@ -195,10 +214,6 @@ void HTMLSelectElement::parseMappedAttribute(MappedAttribute* attr)
     } else if (attr->name() == alignAttr) {
         // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=12072
-    } else if (attr->name() == onfocusAttr) {
-        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onblurAttr) {
-        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onchangeAttr) {
         setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     } else
@@ -261,6 +276,12 @@ void HTMLSelectElement::recalcListItems(bool updateSelectedStates) const
     SelectElement::recalcListItems(const_cast<SelectElementData&>(m_data), this, updateSelectedStates);
 }
 
+void HTMLSelectElement::recalcListItemsIfNeeded()
+{
+    if (m_data.shouldRecalcListItems())
+        recalcListItems();
+}
+
 void HTMLSelectElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     setRecalcListItems();
@@ -405,11 +426,21 @@ void HTMLSelectElement::setLength(unsigned newLen, ExceptionCode& ec)
     } else {
         const Vector<Element*>& items = listItems();
 
+        // Removing children fires mutation events, which might mutate the DOM further, so we first copy out a list
+        // of elements that we intend to remove then attempt to remove them one at a time.
+        Vector<RefPtr<Element> > itemsToRemove;
         size_t optionIndex = 0;
-        for (size_t listIndex = 0; listIndex < items.size(); listIndex++) {
-            if (items[listIndex]->hasLocalName(optionTag) && optionIndex++ >= newLen) {
-                Element *item = items[listIndex];
+        for (size_t i = 0; i < items.size(); ++i) {
+            Element* item = items[i];
+            if (item->hasLocalName(optionTag) && optionIndex++ >= newLen) {
                 ASSERT(item->parentNode());
+                itemsToRemove.append(item);
+            }
+        }
+
+        for (size_t i = 0; i < itemsToRemove.size(); ++i) {
+            Element* item = itemsToRemove[i].get();
+            if (item->parentNode()) {
                 item->parentNode()->removeChild(item, ec);
             }
         }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h
index 8f575d237a..8a31efc5eb 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h
@@ -1,8 +1,10 @@
 /*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -58,6 +60,7 @@ public:
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     void setRecalcListItems();
+    void recalcListItemsIfNeeded();
 
     virtual const Vector<Element*>& listItems() const { return m_data.listItems(this); }
 
@@ -74,10 +77,12 @@ public:
     Node* namedItem(const AtomicString& name);
     Node* item(unsigned index);
 
-    CollectionCache* collectionInfo() { return &m_collectionInfo; }
+    CollectionCache* collectionInfo() { m_collectionInfo.checkConsistency(); return &m_collectionInfo; }
 
     void scrollToSelection();
 
+    void listBoxSelectItem(int listIndex, bool allowMultiplySelections, bool shift, bool fireOnChangeNow = true);
+
 private:
     virtual int tagPriority() const { return 6; }
     virtual bool checkDTD(const Node* newChild);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl
index 53fe8488c8..d260fad1f0 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl
@@ -22,10 +22,7 @@ module html {
 
     interface [
         HasIndexGetter,
-        HasCustomIndexSetter,
-        GenerateConstructor,
-        InterfaceUUID=99013cd3-d644-4bb5-86a3-2e743821383b,
-        ImplementationUUID=afe20462-588d-469a-9b4c-8879c4a461d5
+        HasCustomIndexSetter
     ] HTMLSelectElement : HTMLElement {
 
         readonly attribute DOMString       type;
@@ -41,10 +38,9 @@ module html {
 #endif
 
         readonly attribute HTMLFormElement form;
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute ValidityState   validity;
-#endif
         readonly attribute boolean         willValidate;
+        readonly attribute DOMString       validationMessage;
         boolean            checkValidity();
         void               setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.idl
index 5a25c23974..863e180c0f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.idl
@@ -24,7 +24,7 @@
  */
 
 module html {
-interface [GenerateConstructor, Conditional=VIDEO] HTMLSourceElement : HTMLElement {
+interface [Conditional=VIDEO] HTMLSourceElement : HTMLElement {
     attribute DOMString src;
     attribute DOMString type;
     attribute DOMString media;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.idl
index a1b86f8edf..562d01bca2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.idl
@@ -20,19 +20,13 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=3aaa334c-9660-48cf-b8e2-6d2b4ac0a1da,
-        ImplementationUUID=73024a55-b8a1-461b-ad85-befa4089f80d
-    ] HTMLStyleElement : HTMLElement {
+    interface HTMLStyleElement : HTMLElement {
         attribute  boolean              disabled;
         attribute  [ConvertNullToNullString] DOMString            media;
         attribute  [ConvertNullToNullString] DOMString            type;
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // DOM Level 2 Style
         readonly attribute StyleSheet sheet;
-#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableCaptionElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLTableCaptionElement.idl
index 9424cd51ef..86a197ff54 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableCaptionElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableCaptionElement.idl
@@ -21,10 +21,7 @@
 module html {
 
     interface [
-        GenerateNativeConverter,
-        GenerateConstructor,
-        InterfaceUUID=cd92752d-2f0e-44af-b68e-12c178e1f087,
-        ImplementationUUID=7c0e3749-0f81-4063-9760-8cec314a5b72
+        GenerateNativeConverter
     ] HTMLTableCaptionElement : HTMLElement {
 
         attribute [ConvertNullToNullString] DOMString       align;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp
index 3c58703cf8..593968590f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.h b/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.h
index fc74cae2d2..9cb7cf5f2c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.idl
index c0d22cae73..a89149faff 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.idl
@@ -20,11 +20,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=3ad21d30-ce64-4a6f-9296-c07a16170783,
-        ImplementationUUID=36fe6075-c9c1-4f22-bbc2-dd440f21f7cf
-    ] HTMLTableCellElement : HTMLElement {
+    interface HTMLTableCellElement : HTMLElement {
 
         readonly attribute long            cellIndex;
                  attribute [ConvertNullToNullString] DOMString       abbr;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp
index e1008d1fbf..27ff6f760f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.h b/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.h
index 83a26aa859..af785f39d6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.idl
index 083e4a68c8..453ff3fd8f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.idl
@@ -20,11 +20,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=4e886641-910e-424a-995c-e525c09dcfd3,
-        ImplementationUUID=5f4cdf17-44f1-4b1d-9c68-206737085892
-    ] HTMLTableColElement : HTMLElement {
+    interface HTMLTableColElement : HTMLElement {
 
         attribute [ConvertNullToNullString] DOMString       align;
         attribute [ConvertNullToNullString] DOMString       ch;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLTableElement.idl
index 7092be06da..9cd72b05e0 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableElement.idl
@@ -20,11 +20,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=3f9c6e17-ee0c-43de-94b0-2a21b19b612c,
-        ImplementationUUID=159bb8fe-ffee-4ff9-b507-76741118143f
-    ] HTMLTableElement : HTMLElement {
+    interface HTMLTableElement : HTMLElement {
 
         // could raise excepetions on setting.
                  attribute HTMLTableCaptionElement caption
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.cpp
index 0f9a3e8935..f060dce120 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.h b/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.h
index adbd63bc2e..1fd5218b1c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableRowElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLTableRowElement.idl
index 3a76ca37e1..052b516cf3 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableRowElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableRowElement.idl
@@ -20,11 +20,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=f14ea3d9-8643-4cfd-a692-cefe6d5c65ea,
-        ImplementationUUID=0ce090da-33bb-4163-bb35-3ca8a2f6be47
-    ] HTMLTableRowElement : HTMLElement {
+    interface HTMLTableRowElement : HTMLElement {
 
         readonly attribute long            rowIndex;
         readonly attribute long            sectionRowIndex;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableSectionElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLTableSectionElement.idl
index 7078e33144..57e4293618 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableSectionElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableSectionElement.idl
@@ -21,10 +21,7 @@
 module html {
 
     interface [
-        GenerateNativeConverter,
-        GenerateConstructor,
-        InterfaceUUID=e0cf6b6a-9ba1-400f-b523-dbb22819dfb6,
-        ImplementationUUID=85329cf4-1eae-4245-a971-1bddb212a9c5
+        GenerateNativeConverter
     ] HTMLTableSectionElement : HTMLElement {
 
                  attribute [ConvertNullToNullString] DOMString       align;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in b/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in
index 8842b23b0a..9f4900c76f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in
@@ -8,6 +8,8 @@ acronym interfaceName=HTMLElement
 address interfaceName=HTMLElement
 applet
 area
+article interfaceName=HTMLElement
+aside interfaceName=HTMLElement
 audio wrapperOnlyIfMediaIsAvailable, conditional=VIDEO, createWithNew
 b interfaceName=HTMLElement
 base createWithNew
@@ -41,6 +43,7 @@ em interfaceName=HTMLElement
 embed
 fieldset interfaceName=HTMLFieldSetElement, constructorNeedsFormElement, createWithNew
 font createWithNew
+footer interfaceName=HTMLElement
 form createWithNew
 frame
 frameset interfaceName=HTMLFrameSetElement, createWithNew
@@ -51,6 +54,8 @@ h4 interfaceName=HTMLHeadingElement, createWithNew
 h5 interfaceName=HTMLHeadingElement, createWithNew
 h6 interfaceName=HTMLHeadingElement, createWithNew
 head createWithNew
+header interfaceName=HTMLElement
+hgroup interfaceName=HTMLElement
 hr interfaceName=HTMLHRElement, createWithNew
 html createWithNew
 i interfaceName=HTMLElement
@@ -85,13 +90,15 @@ p interfaceName=HTMLParagraphElement, createWithNew
 param createWithNew
 plaintext interfaceName=HTMLElement
 pre createWithNew
+progress interfaceName=HTMLProgressElement, conditional=PROGRESS_TAG
 q interfaceName=HTMLQuoteElement, createWithNew
-rp interfaceName=HTMLElement
-rt interfaceName=HTMLElement
-ruby interfaceName=HTMLElement
+rp interfaceName=HTMLElement, conditional=RUBY
+rt interfaceName=HTMLElement, conditional=RUBY
+ruby interfaceName=HTMLElement, conditional=RUBY
 s interfaceName=HTMLElement
 samp interfaceName=HTMLElement
 script constructorNeedsCreatedByParser, createWithNew
+section interfaceName=HTMLElement
 select constructorNeedsFormElement, createWithNew
 small interfaceName=HTMLElement
 source wrapperOnlyIfMediaIsAvailable, conditional=VIDEO, createWithNew
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
index 3030018609..ec5f22dcd2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
@@ -27,6 +27,7 @@
 #include "HTMLTextAreaElement.h"
 
 #include "BeforeTextInsertedEvent.h"
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "CSSValueKeywords.h"
 #include "Document.h"
@@ -91,12 +92,12 @@ bool HTMLTextAreaElement::saveFormControlState(String& result) const
 
 void HTMLTextAreaElement::restoreFormControlState(const String& state)
 {
-    setDefaultValue(state);
+    setValue(state);
 }
 
 void HTMLTextAreaElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    setValue(defaultValue());
+    setNonDirtyValue(defaultValue());
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
     
@@ -149,7 +150,9 @@ void HTMLTextAreaElement::parseMappedAttribute(MappedAttribute* attr)
     } else if (attr->name() == alignAttr) {
         // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=7075
-    } else
+    } else if (attr->name() == maxlengthAttr)
+        setNeedsValidityCheck();
+    else
         HTMLTextFormControlElement::parseMappedAttribute(attr);
 }
 
@@ -173,8 +176,7 @@ bool HTMLTextAreaElement::appendFormData(FormDataList& encoding, bool)
 
 void HTMLTextAreaElement::reset()
 {
-    setValue(defaultValue());
-    m_isDirty = false;
+    setNonDirtyValue(defaultValue());
 }
 
 bool HTMLTextAreaElement::isKeyboardFocusable(KeyboardEvent*) const
@@ -271,6 +273,12 @@ String HTMLTextAreaElement::value() const
 
 void HTMLTextAreaElement::setValue(const String& value)
 {
+    setNonDirtyValue(value);
+    m_isDirty = true;
+}
+
+void HTMLTextAreaElement::setNonDirtyValue(const String& value)
+{
     // Code elsewhere normalizes line endings added by the user via the keyboard or pasting.
     // We normalize line endings coming from JavaScript here.
     String normalizedValue = value.isNull() ? "" : value;
@@ -283,6 +291,8 @@ void HTMLTextAreaElement::setValue(const String& value)
         return;
 
     m_value = normalizedValue;
+    setNeedsValidityCheck();
+    m_isDirty = false;
     setFormControlValueMatchesRenderer(true);
     updatePlaceholderVisibility(false);
     if (inDocument())
@@ -296,9 +306,7 @@ void HTMLTextAreaElement::setValue(const String& value)
         setSelectionRange(endOfString, endOfString);
     }
 
-    setNeedsStyleRecalc();
     notifyFormStateChanged(this);
-    updateValidity();
 }
 
 String HTMLTextAreaElement::defaultValue() const
@@ -345,7 +353,7 @@ void HTMLTextAreaElement::setDefaultValue(const String& defaultValue)
 
     insertBefore(document()->createTextNode(value), firstChild(), ec);
 
-    setValue(value);
+    setNonDirtyValue(value);
 }
 
 int HTMLTextAreaElement::maxLength() const
@@ -372,7 +380,7 @@ bool HTMLTextAreaElement::tooLong() const
     int max = maxLength();
     if (max < 0)
         return false;
-    return value().length() > static_cast<unsigned>(max);
+    return value().numGraphemeClusters() > static_cast<unsigned>(max);
 }
 
 void HTMLTextAreaElement::accessKeyAction(bool)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
index 23f61d3ef6..8d92a48692 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
@@ -94,6 +94,7 @@ private:
     void handleBeforeTextInsertedEvent(BeforeTextInsertedEvent*) const;
     static String sanitizeUserInputValue(const String&, unsigned maxLength);
     void updateValue() const;
+    void setNonDirtyValue(const String&);
 
     virtual bool supportsPlaceholder() const { return true; }
     virtual bool isEmptyValue() const { return value().isEmpty(); }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.idl
index db5154e2b7..2d82eed98c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.idl
@@ -20,16 +20,10 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=8b16bba6-efa9-4887-b863-308b4f9b9202,
-        ImplementationUUID=2414be6e-bae0-472d-b124-beed5ca82d3b
-    ] HTMLTextAreaElement : HTMLElement {
+    interface HTMLTextAreaElement : HTMLElement {
                  attribute  [ConvertNullToNullString] DOMString            defaultValue;
         readonly attribute  HTMLFormElement      form;
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute  ValidityState        validity;
-#endif
                  attribute  [ConvertNullToNullString] DOMString            accessKey;
                  attribute  long                 cols;
                  attribute  boolean              disabled;
@@ -48,6 +42,7 @@ module html {
         void     select();
 
         readonly attribute boolean         willValidate;
+        readonly attribute DOMString       validationMessage;
         boolean  checkValidity();
         void     setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTitleElement.h b/src/3rdparty/webkit/WebCore/html/HTMLTitleElement.h
index 5335d8d4f2..677bffda50 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTitleElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTitleElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003 Apple Computer, Inc.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTitleElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLTitleElement.idl
index d0f27e75ff..de857e8ee4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTitleElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTitleElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=036211fb-c1e9-4265-aac5-c5874e4a499c,
-        ImplementationUUID=ff577152-4ea3-404f-912d-ed1d0b64e60e
-    ] HTMLTitleElement : HTMLElement {
+    interface HTMLTitleElement : HTMLElement {
         attribute  [ConvertNullToNullString] DOMString            text;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
index 9d8136bac4..d0f396598e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
@@ -167,10 +167,12 @@ HTMLTokenizer::HTMLTokenizer(HTMLDocument* doc, bool reportErrors)
     , m_requestingScript(false)
     , m_hasScriptsWaitingForStylesheets(false)
     , m_timer(this, &HTMLTokenizer::timerFired)
+    , m_externalScriptsTimer(this, &HTMLTokenizer::executeExternalScriptsTimerFired)
     , m_doc(doc)
     , m_parser(new HTMLParser(doc, reportErrors))
     , m_inWrite(false)
     , m_fragment(false)
+    , m_scriptingPermission(FragmentScriptingAllowed)
 {
     begin();
 }
@@ -186,15 +188,17 @@ HTMLTokenizer::HTMLTokenizer(HTMLViewSourceDocument* doc)
     , m_requestingScript(false)
     , m_hasScriptsWaitingForStylesheets(false)
     , m_timer(this, &HTMLTokenizer::timerFired)
+    , m_externalScriptsTimer(this, &HTMLTokenizer::executeExternalScriptsTimerFired)
     , m_doc(doc)
     , m_parser(0)
     , m_inWrite(false)
     , m_fragment(false)
+    , m_scriptingPermission(FragmentScriptingAllowed)
 {
     begin();
 }
 
-HTMLTokenizer::HTMLTokenizer(DocumentFragment* frag)
+HTMLTokenizer::HTMLTokenizer(DocumentFragment* frag, FragmentScriptingPermission scriptingPermission)
     : m_buffer(0)
     , m_scriptCode(0)
     , m_scriptCodeSize(0)
@@ -204,10 +208,12 @@ HTMLTokenizer::HTMLTokenizer(DocumentFragment* frag)
     , m_requestingScript(false)
     , m_hasScriptsWaitingForStylesheets(false)
     , m_timer(this, &HTMLTokenizer::timerFired)
+    , m_externalScriptsTimer(this, &HTMLTokenizer::executeExternalScriptsTimerFired)
     , m_doc(frag->document())
-    , m_parser(new HTMLParser(frag))
+    , m_parser(new HTMLParser(frag, scriptingPermission))
     , m_inWrite(false)
     , m_fragment(true)
+    , m_scriptingPermission(scriptingPermission)
 {
     begin();
 }
@@ -232,6 +238,8 @@ void HTMLTokenizer::reset()
     m_scriptCodeSize = m_scriptCodeCapacity = m_scriptCodeResync = 0;
 
     m_timer.stop();
+    m_externalScriptsTimer.stop();
+
     m_state.setAllowYield(false);
     m_state.setForceSynchronous(false);
 
@@ -463,6 +471,13 @@ HTMLTokenizer::State HTMLTokenizer::scriptHandler(State state)
 
     state = processListing(SegmentedString(m_scriptCode, m_scriptCodeSize), state);
     RefPtr<Node> node = processToken();
+    
+    if (node && m_scriptingPermission == FragmentScriptingNotAllowed) {
+        ExceptionCode ec;
+        node->remove(ec);
+        node = 0;
+    }
+    
     String scriptString = node ? node->textContent() : "";
     m_currentToken.tagName = scriptTag.localName();
     m_currentToken.beginTag = false;
@@ -552,12 +567,6 @@ HTMLTokenizer::State HTMLTokenizer::scriptExecution(const ScriptSourceCode& sour
         return state;
     m_executingScript++;
     
-#if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent();
-    if (timelineAgent)
-        timelineAgent->willEvaluateScriptTag(sourceCode.url().isNull() ? String() : sourceCode.url().string(), sourceCode.startLine());
-#endif
-    
     SegmentedString* savedPrependingSrc = m_currentPrependingSrc;
     SegmentedString prependingSrc;
     m_currentPrependingSrc = &prependingSrc;
@@ -615,11 +624,6 @@ HTMLTokenizer::State HTMLTokenizer::scriptExecution(const ScriptSourceCode& sour
 
     m_currentPrependingSrc = savedPrependingSrc;
     
-#if ENABLE(INSPECTOR)
-    if (timelineAgent)
-        timelineAgent->didEvaluateScriptTag();
-#endif
-    
     return state;
 }
 
@@ -1507,7 +1511,7 @@ HTMLTokenizer::State HTMLTokenizer::parseTag(SegmentedString& src, State state)
                 m_scriptTagSrcAttrValue = String();
                 m_scriptTagCharsetAttrValue = String();
                 if (m_currentToken.attrs && !m_fragment) {
-                    if (m_doc->frame() && m_doc->frame()->script()->isEnabled()) {
+                    if (m_doc->frame() && m_doc->frame()->script()->canExecuteScripts(NotAboutToExecuteScript)) {
                         if ((a = m_currentToken.attrs->getAttributeItem(srcAttr)))
                             m_scriptTagSrcAttrValue = m_doc->completeURL(deprecatedParseURL(a->value())).string();
                     }
@@ -1615,8 +1619,7 @@ inline bool HTMLTokenizer::continueProcessing(int& processedCount, double startT
             m_timer.startOneShot(0);
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
             if (currentTime() - startTime > m_tokenizerTimeDelay)
-                printf("Deferring processing of data because %dms elapsed away from event loop.\n",
-                        int(m_tokenizerTimeDelay * 1000));
+                printf("Deferring processing of data because 500ms elapsed away from event loop.\n");
 #endif
             return false;
         }
@@ -1678,9 +1681,8 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
     double startTime = currentTime();
 
 #if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent();
-    if (timelineAgent)
-        timelineAgent->willWriteHTML();
+    if (InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent())
+        timelineAgent->willWriteHTML(source.length(), m_lineNumber);
 #endif
   
     Frame* frame = m_doc->frame();
@@ -1805,8 +1807,8 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 #endif
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
-        timelineAgent->didWriteHTML();
+    if (InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent())
+        timelineAgent->didWriteHTML(m_lineNumber);
 #endif
 
     m_inWrite = wasInWrite;
@@ -1816,8 +1818,8 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
     if (m_noMoreData && !m_inWrite && !state.loadingExtScript() && !m_executingScript && !m_timer.isActive())
         end(); // this actually causes us to be deleted
     
-    // After parsing, go ahead and dispatch image beforeload/load events.
-    ImageLoader::dispatchPendingEvents();
+    // After parsing, go ahead and dispatch image beforeload events.
+    ImageLoader::dispatchPendingBeforeLoadEvents();
 }
 
 void HTMLTokenizer::stopParsing()
@@ -1919,7 +1921,7 @@ void HTMLTokenizer::finish()
 PassRefPtr<Node> HTMLTokenizer::processToken()
 {
     ScriptController* scriptController = (!m_fragment && m_doc->frame()) ? m_doc->frame()->script() : 0;
-    if (scriptController && scriptController->isEnabled())
+    if (scriptController && scriptController->canExecuteScripts(NotAboutToExecuteScript))
         // FIXME: Why isn't this m_currentScriptTagStartLineNumber?  I suspect this is wrong.
         scriptController->setEventHandlerLineNumber(m_currentTagStartLineNumber + 1); // Script line numbers are 1 based.
     if (m_dest > m_buffer) {
@@ -2020,6 +2022,11 @@ void HTMLTokenizer::executeScriptsWaitingForStylesheets()
 
 void HTMLTokenizer::notifyFinished(CachedResource*)
 {
+    executeExternalScriptsIfReady();
+}
+
+void HTMLTokenizer::executeExternalScriptsIfReady()
+{
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
     if (!m_doc->ownerElement())
         printf("script loaded at %d\n", m_doc->elapsedTime());
@@ -2034,7 +2041,12 @@ void HTMLTokenizer::notifyFinished(CachedResource*)
         return;
 
     bool finished = false;
+    
+    double startTime = currentTime();
     while (!finished && m_pendingScripts.first()->isLoaded()) {
+        if (!continueExecutingExternalScripts(startTime))
+            break;
+
         CachedScript* cs = m_pendingScripts.first().get();
         m_pendingScripts.removeFirst();
         ASSERT(cache()->disabled() || cs->accessCount() > 0);
@@ -2094,6 +2106,31 @@ void HTMLTokenizer::notifyFinished(CachedResource*)
     }
 }
 
+void HTMLTokenizer::executeExternalScriptsTimerFired(Timer<HTMLTokenizer>*)
+{
+    if (m_doc->view() && m_doc->view()->layoutPending() && !m_doc->minimumLayoutDelay()) {
+        // Restart the timer and do layout first.
+        m_externalScriptsTimer.startOneShot(0);
+        return;
+    }
+
+    // Continue executing external scripts.
+    executeExternalScriptsIfReady();
+}
+
+bool HTMLTokenizer::continueExecutingExternalScripts(double startTime)
+{
+    if (m_externalScriptsTimer.isActive())
+        return false;
+
+    if (currentTime() - startTime > m_tokenizerTimeDelay) {
+        // Schedule the timer to keep processing as soon as possible.
+        m_externalScriptsTimer.startOneShot(0);
+        return false;
+    }
+    return true;
+}
+
 bool HTMLTokenizer::isWaitingForScripts() const
 {
     return m_state.loadingExtScript();
@@ -2104,9 +2141,9 @@ void HTMLTokenizer::setSrc(const SegmentedString& source)
     m_src = source;
 }
 
-void parseHTMLDocumentFragment(const String& source, DocumentFragment* fragment)
+void parseHTMLDocumentFragment(const String& source, DocumentFragment* fragment, FragmentScriptingPermission scriptingPermission)
 {
-    HTMLTokenizer tok(fragment);
+    HTMLTokenizer tok(fragment, scriptingPermission);
     tok.setForceSynchronous(true);
     tok.write(source, true);
     tok.finish();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.h b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.h
index d731b2d76a..ef7cbfca8f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.h
@@ -27,6 +27,7 @@
 #include "CachedResourceClient.h"
 #include "CachedResourceHandle.h"
 #include "NamedMappedAttrMap.h"
+#include "MappedAttributeEntry.h"
 #include "SegmentedString.h"
 #include "Timer.h"
 #include "Tokenizer.h"
@@ -135,7 +136,7 @@ class HTMLTokenizer : public Tokenizer, public CachedResourceClient {
 public:
     HTMLTokenizer(HTMLDocument*, bool reportErrors);
     HTMLTokenizer(HTMLViewSourceDocument*);
-    HTMLTokenizer(DocumentFragment*);
+    HTMLTokenizer(DocumentFragment*, FragmentScriptingPermission = FragmentScriptingAllowed);
     virtual ~HTMLTokenizer();
 
     virtual void write(const SegmentedString&, bool appendData);
@@ -205,6 +206,10 @@ private:
     // from CachedResourceClient
     void notifyFinished(CachedResource*);
 
+    void executeExternalScriptsIfReady();
+    void executeExternalScriptsTimerFired(Timer<HTMLTokenizer>*);
+    bool continueExecutingExternalScripts(double startTime);
+
     // Internal buffers
     ///////////////////
     UChar* m_buffer;
@@ -401,6 +406,9 @@ private:
     // The timer for continued processing.
     Timer<HTMLTokenizer> m_timer;
 
+    // The timer for continued executing external scripts.
+    Timer<HTMLTokenizer> m_externalScriptsTimer;
+
 // This buffer can hold arbitrarily long user-defined attribute names, such as in EMBED tags.
 // So any fixed number might be too small, but rather than rewriting all usage of this buffer
 // we'll just make it large enough to handle all imaginable cases.
@@ -413,11 +421,12 @@ private:
     OwnPtr<HTMLParser> m_parser;
     bool m_inWrite;
     bool m_fragment;
+    FragmentScriptingPermission m_scriptingPermission;
 
     OwnPtr<PreloadScanner> m_preloadScanner;
 };
 
-void parseHTMLDocumentFragment(const String&, DocumentFragment*);
+void parseHTMLDocumentFragment(const String&, DocumentFragment*, FragmentScriptingPermission = FragmentScriptingAllowed);
 
 UChar decodeNamedEntity(const char*);
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLUListElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLUListElement.idl
index c49b058a4f..38434f148b 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLUListElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLUListElement.idl
@@ -19,11 +19,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=6877dee4-be67-4fb0-af8c-5023b108a1b0,
-        ImplementationUUID=23e9c21a-618e-42ac-a053-df85918118df
-    ] HTMLUListElement : HTMLElement {
+    interface HTMLUListElement : HTMLElement {
         attribute boolean compact;
         attribute [ConvertNullToNullString] DOMString type;
     };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp
index 5bbc16747e..77c11d06e5 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,13 +28,16 @@
 #if ENABLE(VIDEO)
 #include "HTMLVideoElement.h"
 
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "Document.h"
+#include "ExceptionCode.h"
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
 #include "MappedAttribute.h"
+#include "Page.h"
 #include "RenderImage.h"
 #include "RenderVideo.h"
 
@@ -44,11 +47,11 @@ using namespace HTMLNames;
 
 HTMLVideoElement::HTMLVideoElement(const QualifiedName& tagName, Document* doc)
     : HTMLMediaElement(tagName, doc)
-    , m_shouldShowPosterImage(false)
+    , m_shouldDisplayPosterImage(false)
 {
     ASSERT(hasTagName(videoTag));
 }
-    
+
 bool HTMLVideoElement::rendererIsNeeded(RenderStyle* style) 
 {
     return HTMLElement::rendererIsNeeded(style); 
@@ -57,8 +60,6 @@ bool HTMLVideoElement::rendererIsNeeded(RenderStyle* style)
 #if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
 RenderObject* HTMLVideoElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    if (m_shouldShowPosterImage)
-        return new (arena) RenderImage(this);
     return new (arena) RenderVideo(this);
 }
 #endif
@@ -68,11 +69,12 @@ void HTMLVideoElement::attach()
     HTMLMediaElement::attach();
 
 #if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-    if (m_shouldShowPosterImage) {
+    updatePosterImage();
+    if (m_shouldDisplayPosterImage) {
         if (!m_imageLoader)
             m_imageLoader.set(new HTMLImageLoader(this));
         m_imageLoader->updateFromElement();
-        if (renderer() && renderer()->isImage()) {
+        if (renderer()) {
             RenderImage* imageRenderer = toRenderImage(renderer());
             imageRenderer->setCachedImage(m_imageLoader->image()); 
         }
@@ -84,7 +86,7 @@ void HTMLVideoElement::detach()
 {
     HTMLMediaElement::detach();
     
-    if (!m_shouldShowPosterImage)
+    if (!m_shouldDisplayPosterImage)
         if (m_imageLoader)
             m_imageLoader.clear();
 }
@@ -94,15 +96,16 @@ void HTMLVideoElement::parseMappedAttribute(MappedAttribute* attr)
     const QualifiedName& attrName = attr->name();
 
     if (attrName == posterAttr) {
+        m_posterURL = document()->completeURL(attr->value());
         updatePosterImage();
-        if (m_shouldShowPosterImage) {
+        if (m_shouldDisplayPosterImage) {
 #if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
             if (!m_imageLoader)
                 m_imageLoader.set(new HTMLImageLoader(this));
             m_imageLoader->updateFromElementIgnoringPreviousError();
 #else
-            if (m_player)
-                m_player->setPoster(poster());
+            if (player())
+                player()->setPoster(poster());
 #endif
         }
     } else if (attrName == widthAttr)
@@ -119,24 +122,25 @@ bool HTMLVideoElement::supportsFullscreen() const
     if (!page) 
         return false;
 
-    if (!m_player || !m_player->supportsFullscreen())
+    if (!player() || !player()->supportsFullscreen() || !player()->hasVideo())
         return false;
-    
+
+    // Check with the platform client.
     return page->chrome()->client()->supportsFullscreenForNode(this);
 }
 
 unsigned HTMLVideoElement::videoWidth() const
 {
-    if (!m_player)
+    if (!player())
         return 0;
-    return m_player->naturalSize().width();
+    return player()->naturalSize().width();
 }
 
 unsigned HTMLVideoElement::videoHeight() const
 {
-    if (!m_player)
+    if (!player())
         return 0;
-    return m_player->naturalSize().height();
+    return player()->naturalSize().height();
 }
 
 unsigned HTMLVideoElement::width() const
@@ -163,11 +167,6 @@ void HTMLVideoElement::setHeight(unsigned value)
     setAttribute(heightAttr, String::number(value));
 }
 
-KURL HTMLVideoElement::poster() const
-{
-    return document()->completeURL(getAttribute(posterAttr));
-}
-
 void HTMLVideoElement::setPoster(const String& value)
 {
     setAttribute(posterAttr, value);
@@ -186,42 +185,66 @@ const QualifiedName& HTMLVideoElement::imageSourceAttributeName() const
 void HTMLVideoElement::updatePosterImage()
 {
 #if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-    bool oldShouldShowPosterImage = m_shouldShowPosterImage;
+    bool oldShouldShowPosterImage = m_shouldDisplayPosterImage;
 #endif
 
-    m_shouldShowPosterImage = !poster().isEmpty() && readyState() < HAVE_CURRENT_DATA;
+    m_shouldDisplayPosterImage = !poster().isEmpty() && !hasAvailableVideoFrame();
 
 #if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-    if (attached() && oldShouldShowPosterImage != m_shouldShowPosterImage) {
-        detach();
-        attach();
-    }
+    if (renderer() && oldShouldShowPosterImage != m_shouldDisplayPosterImage)
+        renderer()->updateFromElement();
 #endif
 }
 
-void HTMLVideoElement::paint(GraphicsContext* context, const IntRect& destRect)
+void HTMLVideoElement::paintCurrentFrameInContext(GraphicsContext* context, const IntRect& destRect)
 {
-    // FIXME: We should also be able to paint the poster image.
-
     MediaPlayer* player = HTMLMediaElement::player();
     if (!player)
         return;
-
+    
     player->setVisible(true); // Make player visible or it won't draw.
-    player->paint(context, destRect);
+    player->paintCurrentFrameInContext(context, destRect);
 }
 
-void HTMLVideoElement::paintCurrentFrameInContext(GraphicsContext* context, const IntRect& destRect)
+bool HTMLVideoElement::hasAvailableVideoFrame() const
 {
-    // FIXME: We should also be able to paint the poster image.
+    if (!player())
+        return false;
     
-    MediaPlayer* player = HTMLMediaElement::player();
-    if (!player)
+    return player()->hasAvailableVideoFrame();
+}
+
+void HTMLVideoElement::webkitEnterFullscreen(bool isUserGesture, ExceptionCode& ec)
+{
+    if (isFullscreen())
         return;
-    
-    player->setVisible(true); // Make player visible or it won't draw.
-    player->paintCurrentFrameInContext(context, destRect);
+
+    // Generate an exception if this isn't called in response to a user gesture, or if the 
+    // element does not support fullscreen.
+    if (!isUserGesture || !supportsFullscreen()) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
+    enterFullscreen();
+}
+
+void HTMLVideoElement::webkitExitFullscreen()
+{
+    if (isFullscreen())
+        exitFullscreen();
+}
+
+bool HTMLVideoElement::webkitSupportsFullscreen()
+{
+    return supportsFullscreen();
 }
 
+bool HTMLVideoElement::webkitDisplayingFullscreen()
+{
+    return isFullscreen();
+}
+
+
 }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
index 096eb539ad..2775118a85 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,7 +29,6 @@
 #if ENABLE(VIDEO)
 
 #include "HTMLMediaElement.h"
-#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
@@ -38,20 +37,6 @@ class HTMLImageLoader;
 class HTMLVideoElement : public HTMLMediaElement {
 public:
     HTMLVideoElement(const QualifiedName&, Document*);
-    
-    virtual int tagPriority() const { return 5; }
-    virtual bool rendererIsNeeded(RenderStyle*);
-#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-#endif
-    virtual void attach();
-    virtual void detach();
-    virtual void parseMappedAttribute(MappedAttribute* attr);
-    virtual bool isVideo() const { return true; }
-    virtual bool hasVideo() const { return player() && player()->hasVideo(); }
-    virtual bool supportsFullscreen() const;
-    virtual bool isURLAttribute(Attribute*) const;
-    virtual const QualifiedName& imageSourceAttributeName() const;
 
     unsigned width() const;
     void setWidth(unsigned);
@@ -61,18 +46,46 @@ public:
     unsigned videoWidth() const;
     unsigned videoHeight() const;
     
-    KURL poster() const;
+    const KURL& poster() const { return m_posterURL; }
     void setPoster(const String&);
 
-    void updatePosterImage();
+    // Fullscreen
+    void webkitEnterFullscreen(bool isUserGesture, ExceptionCode&);
+    void webkitExitFullscreen();
+    bool webkitSupportsFullscreen();
+    bool webkitDisplayingFullscreen();
+
+    // FIXME: Maintain "FullScreen" capitalization scheme for backwards compatibility.
+    // https://bugs.webkit.org/show_bug.cgi?id=36081
+    void webkitEnterFullScreen(bool isUserGesture, ExceptionCode& ec) { webkitEnterFullscreen(isUserGesture, ec); }
+    void webkitExitFullScreen() { webkitExitFullscreen(); }
+
+    bool shouldDisplayPosterImage() const { return m_shouldDisplayPosterImage; }
 
-    void paint(GraphicsContext*, const IntRect&);
     // Used by canvas to gain raw pixel access
     void paintCurrentFrameInContext(GraphicsContext*, const IntRect&);
 
 private:
+    virtual int tagPriority() const { return 5; }
+    virtual bool rendererIsNeeded(RenderStyle*);
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+#endif
+    virtual void attach();
+    virtual void detach();
+    virtual void parseMappedAttribute(MappedAttribute*);
+    virtual bool isVideo() const { return true; }
+    virtual bool hasVideo() const { return player() && player()->hasVideo(); }
+    virtual bool supportsFullscreen() const;
+    virtual bool isURLAttribute(Attribute*) const;
+    virtual const QualifiedName& imageSourceAttributeName() const;
+
+    virtual bool hasAvailableVideoFrame() const;
+    virtual void updatePosterImage();
+
     OwnPtr<HTMLImageLoader> m_imageLoader;
-    bool m_shouldShowPosterImage;
+    KURL m_posterURL;
+    bool m_shouldDisplayPosterImage;
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.idl
index c78594f007..1b21c54f54 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.idl
@@ -24,11 +24,23 @@
  */
 
 module html {
-    interface [GenerateConstructor, Conditional=VIDEO] HTMLVideoElement : HTMLMediaElement {
+    interface [Conditional=VIDEO] HTMLVideoElement : HTMLMediaElement {
         attribute unsigned long width;
         attribute unsigned long height;
         readonly attribute unsigned long videoWidth;
         readonly attribute unsigned long videoHeight;
                  attribute [ConvertNullToNullString] DOMString poster;
+
+        readonly attribute boolean webkitSupportsFullscreen;
+        readonly attribute boolean webkitDisplayingFullscreen;
+
+        [NeedsUserGestureCheck] void webkitEnterFullscreen()
+            raises (DOMException);
+        void webkitExitFullscreen();
+    
+        [NeedsUserGestureCheck] void webkitEnterFullScreen()
+            raises (DOMException);
+        void webkitExitFullScreen();
+
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
index ba718d1649..2d800b4bfb 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
@@ -54,7 +54,7 @@ HTMLViewSourceDocument::HTMLViewSourceDocument(Frame* frame, const String& mimeT
 Tokenizer* HTMLViewSourceDocument::createTokenizer()
 {
     // Use HTMLTokenizer if applicable, otherwise use TextTokenizer.
-    if (m_type == "text/html" || m_type == "application/xhtml+xml" || m_type == "image/svg+xml" || implementation()->isXMLMIMEType(m_type)
+    if (m_type == "text/html" || m_type == "application/xhtml+xml" || m_type == "image/svg+xml" || DOMImplementation::isXMLMIMEType(m_type)
 #if ENABLE(XHTMLMP)
         || m_type == "application/vnd.wap.xhtml+xml"
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/ImageData.idl b/src/3rdparty/webkit/WebCore/html/ImageData.idl
index 8025de1df1..a5e2467127 100644
--- a/src/3rdparty/webkit/WebCore/html/ImageData.idl
+++ b/src/3rdparty/webkit/WebCore/html/ImageData.idl
@@ -29,8 +29,7 @@
 module html {
 
     interface [
-        CustomToJS,
-        GenerateConstructor,
+        CustomToJS
     ] ImageData {
         readonly attribute long width;
         readonly attribute long height;
diff --git a/src/3rdparty/webkit/WebCore/html/MediaError.idl b/src/3rdparty/webkit/WebCore/html/MediaError.idl
index 4dcea7d020..9d6f3bdc02 100644
--- a/src/3rdparty/webkit/WebCore/html/MediaError.idl
+++ b/src/3rdparty/webkit/WebCore/html/MediaError.idl
@@ -24,7 +24,7 @@
  */
 
 module html {
-    interface [GenerateConstructor, Conditional=VIDEO] MediaError {
+    interface [Conditional=VIDEO] MediaError {
           const unsigned short MEDIA_ERR_ABORTED = 1;
           const unsigned short MEDIA_ERR_NETWORK = 2;
           const unsigned short MEDIA_ERR_DECODE = 3;
diff --git a/src/3rdparty/webkit/WebCore/html/StepRange.cpp b/src/3rdparty/webkit/WebCore/html/StepRange.cpp
new file mode 100644
index 0000000000..7c270f275f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/StepRange.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "StepRange.h"
+
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "PlatformString.h"
+#include <wtf/MathExtras.h>
+
+using namespace std;
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+StepRange::StepRange(const HTMLInputElement* element)
+{
+    if (element->hasAttribute(precisionAttr)) {
+        step = 1.0;
+        hasStep = !equalIgnoringCase(element->getAttribute(precisionAttr), "float");
+    } else
+        hasStep = element->getAllowedValueStep(&step);
+
+    maximum = element->maximum();
+    minimum = element->minimum();
+}
+
+double StepRange::clampValue(double value)
+{
+    double clampedValue = max(minimum, min(value, maximum));
+    if (!hasStep)
+        return clampedValue;
+    // Rounds clampedValue to minimum + N * step.
+    clampedValue = minimum + round((clampedValue - minimum) / step) * step;
+    if (clampedValue > maximum)
+       clampedValue -= step;
+    ASSERT(clampedValue >= minimum);
+    ASSERT(clampedValue <= maximum);
+    return clampedValue;
+}
+
+double StepRange::clampValue(const String& stringValue)
+{
+    double value;
+    bool parseSuccess = HTMLInputElement::parseToDoubleForNumberType(stringValue, &value);
+    if (!parseSuccess)
+        value = (minimum + maximum) / 2;
+    return clampValue(value);
+}
+
+double StepRange::valueFromElement(HTMLInputElement* element, bool* wasClamped)
+{
+    double oldValue;
+    bool parseSuccess = HTMLInputElement::parseToDoubleForNumberType(element->value(), &oldValue);
+    if (!parseSuccess)
+        oldValue = (minimum + maximum) / 2;
+    double newValue = clampValue(oldValue);
+
+    if (wasClamped)
+        *wasClamped = !parseSuccess || newValue != oldValue;
+
+    return newValue;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/StepRange.h b/src/3rdparty/webkit/WebCore/html/StepRange.h
new file mode 100644
index 0000000000..2f5013a350
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/StepRange.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef StepRange_h
+#define StepRange_h
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class HTMLInputElement;
+class String;
+
+class StepRange : public Noncopyable {
+public:
+    bool hasStep;
+    double step;
+    double minimum;
+    double maximum; // maximum must be >= minimum.
+
+    explicit StepRange(const HTMLInputElement*);
+    double clampValue(double value);
+    double clampValue(const String& stringValue);
+
+    // Clamp the middle value according to the step
+    double defaultValue()
+    {
+        return clampValue((minimum + maximum) / 2);
+    }
+
+    // Map value into 0-1 range
+    double proportionFromValue(double value)
+    {
+        if (minimum == maximum)
+            return 0;
+
+        return (value - minimum) / (maximum - minimum);
+    }
+
+    // Map from 0-1 range to value
+    double valueFromProportion(double proportion)
+    {
+        return minimum + proportion * (maximum - minimum);
+    }
+
+    double valueFromElement(HTMLInputElement*, bool* wasClamped = 0);
+};
+
+}
+
+#endif // StepRange_h
diff --git a/src/3rdparty/webkit/WebCore/html/TextMetrics.idl b/src/3rdparty/webkit/WebCore/html/TextMetrics.idl
index dc8871611b..1a315bac21 100644
--- a/src/3rdparty/webkit/WebCore/html/TextMetrics.idl
+++ b/src/3rdparty/webkit/WebCore/html/TextMetrics.idl
@@ -25,9 +25,7 @@
 
 module html {
 
-    interface [
-        GenerateConstructor
-    ] TextMetrics {
+    interface TextMetrics {
         readonly attribute float width;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/TimeRanges.idl b/src/3rdparty/webkit/WebCore/html/TimeRanges.idl
index d8686be5f3..992b12a365 100644
--- a/src/3rdparty/webkit/WebCore/html/TimeRanges.idl
+++ b/src/3rdparty/webkit/WebCore/html/TimeRanges.idl
@@ -25,7 +25,7 @@
 
 module html {
 
-interface [Conditional=VIDEO] TimeRanges {
+interface [Conditional=VIDEO, OmitConstructor] TimeRanges {
     readonly attribute unsigned long length;
     float start(in unsigned long index)
         raises (DOMException);
diff --git a/src/3rdparty/webkit/WebCore/html/ValidityState.cpp b/src/3rdparty/webkit/WebCore/html/ValidityState.cpp
index 6b0a0b4a08..c6c58a52ff 100644
--- a/src/3rdparty/webkit/WebCore/html/ValidityState.cpp
+++ b/src/3rdparty/webkit/WebCore/html/ValidityState.cpp
@@ -2,6 +2,7 @@
  * This file is part of the WebKit project.
  *
  * Copyright (C) 2009 Michelangelo De Simone <micdesim@gmail.com>
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,29 +27,50 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "KURL.h"
+#include "LocalizedStrings.h"
 #include "RegularExpression.h"
 #include <wtf/StdLibExtras.h>
 
-#define EMAIL_LOCALPART "[a-z0-9!#$%&'*+/=?^_`{|}~.-]+"
-#define EMAIL_DOMAINPART "[a-z0-9-]+(\\.[a-z0-9-]+)+"
-#define EMAIL_PATTERN EMAIL_LOCALPART "@" EMAIL_DOMAINPART
-
 namespace WebCore {
 
 using namespace HTMLNames;
 
-ValidityState::ValidityState(HTMLFormControlElement* parent)
-    : m_control(parent)
+static const char emailPattern[] =
+    "[a-z0-9!#$%&'*+/=?^_`{|}~.-]+" // local part
+    "@"
+    "[a-z0-9-]+(\\.[a-z0-9-]+)+"; // domain part
+
+String ValidityState::validationMessage() const
 {
-    ASSERT(parent);
+    if (!m_control->willValidate())
+        return String();
+
+    if (customError())
+        return m_customErrorMessage;
+    if (valueMissing())
+        return validationMessageValueMissingText();
+    if (typeMismatch())
+        return validationMessageTypeMismatchText();
+    if (patternMismatch())
+        return validationMessagePatternMismatchText();
+    if (tooLong())
+        return validationMessageTooLongText();
+    if (rangeUnderflow())
+        return validationMessageRangeUnderflowText();
+    if (rangeOverflow())
+        return validationMessageRangeOverflowText();
+    if (stepMismatch())
+        return validationMessageStepMismatchText();
+
+    return String();
 }
 
-bool ValidityState::typeMismatch()
+bool ValidityState::typeMismatch() const
 {
-    if (!control()->hasTagName(inputTag))
+    if (!m_control->hasTagName(inputTag))
         return false;
 
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(control());
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(m_control);
     String value = input->value();
 
     if (value.isEmpty())
@@ -58,46 +80,73 @@ bool ValidityState::typeMismatch()
     case HTMLInputElement::COLOR:
         return !isValidColorString(value);
     case HTMLInputElement::NUMBER:
-        return !HTMLInputElement::formStringToDouble(value, 0);
+        return !HTMLInputElement::parseToDoubleForNumberType(value, 0);
     case HTMLInputElement::URL:
         return !KURL(KURL(), value).isValid();
-    case HTMLInputElement::EMAIL:
-    {
+    case HTMLInputElement::EMAIL: {
         if (!input->multiple())
             return !isValidEmailAddress(value);
-            
-        Vector<String> email_list;
-        value.split(',', email_list);
-        for (unsigned i = 0; i < email_list.size(); ++i)
-            if (!isValidEmailAddress(email_list[i]))
+        Vector<String> addresses;
+        value.split(',', addresses);
+        for (unsigned i = 0; i < addresses.size(); ++i) {
+            if (!isValidEmailAddress(addresses[i]))
                 return true;
-
+        }
         return false;
     }
-    default:
+    case HTMLInputElement::DATE:
+    case HTMLInputElement::DATETIME:
+    case HTMLInputElement::DATETIMELOCAL:
+    case HTMLInputElement::MONTH:
+    case HTMLInputElement::TIME:
+    case HTMLInputElement::WEEK:
+        return !HTMLInputElement::parseToDateComponents(input->inputType(), value, 0);
+    case HTMLInputElement::BUTTON:
+    case HTMLInputElement::CHECKBOX:
+    case HTMLInputElement::FILE:
+    case HTMLInputElement::HIDDEN:
+    case HTMLInputElement::IMAGE:
+    case HTMLInputElement::ISINDEX:
+    case HTMLInputElement::PASSWORD:
+    case HTMLInputElement::RADIO:
+    case HTMLInputElement::RANGE:
+    case HTMLInputElement::RESET:
+    case HTMLInputElement::SEARCH:
+    case HTMLInputElement::SUBMIT:
+    case HTMLInputElement::TELEPHONE: // FIXME: Is there validation for <input type=telephone>?
+    case HTMLInputElement::TEXT:
         return false;
     }
+
+    ASSERT_NOT_REACHED();
+    return false;
 }
 
-bool ValidityState::rangeUnderflow()
+bool ValidityState::rangeUnderflow() const
 {
-    if (!control()->hasTagName(inputTag))
+    if (!m_control->hasTagName(inputTag))
         return false;
-    return static_cast<HTMLInputElement*>(control())->rangeUnderflow();
+    return static_cast<HTMLInputElement*>(m_control)->rangeUnderflow();
 }
 
-bool ValidityState::rangeOverflow()
+bool ValidityState::rangeOverflow() const
 {
-    if (!control()->hasTagName(inputTag))
+    if (!m_control->hasTagName(inputTag))
         return false;
-    return static_cast<HTMLInputElement*>(control())->rangeOverflow();
+    return static_cast<HTMLInputElement*>(m_control)->rangeOverflow();
 }
 
-bool ValidityState::valid()
+bool ValidityState::stepMismatch() const
 {
-    bool someError = typeMismatch() || stepMismatch() || rangeUnderflow() || rangeOverflow() ||
-                       tooLong() || patternMismatch() || valueMissing() || customError();
+    if (!m_control->hasTagName(inputTag))
+        return false;
+    return static_cast<HTMLInputElement*>(m_control)->stepMismatch();
+}
 
+bool ValidityState::valid() const
+{
+    bool someError = typeMismatch() || stepMismatch() || rangeUnderflow() || rangeOverflow()
+        || tooLong() || patternMismatch() || valueMissing() || customError();
     return !someError;
 }
 
@@ -114,19 +163,18 @@ bool ValidityState::isValidColorString(const String& value)
     return color.isValid() && !color.hasAlpha();
 }
 
-bool ValidityState::isValidEmailAddress(const String& email)
+bool ValidityState::isValidEmailAddress(const String& address)
 {
-    if (email.isEmpty())
+    int addressLength = address.length();
+    if (!addressLength)
         return false;
 
-    DEFINE_STATIC_LOCAL(AtomicString, emailPattern, (EMAIL_PATTERN));
-    DEFINE_STATIC_LOCAL(RegularExpression, regExp, (emailPattern, TextCaseInsensitive));
+    DEFINE_STATIC_LOCAL(const RegularExpression, regExp, (emailPattern, TextCaseInsensitive));
 
-    int matchLength = 0;
-    int emailLength = email.length();
-    int matchOffset = regExp.match(email, 0, &matchLength);
+    int matchLength;
+    int matchOffset = regExp.match(address, 0, &matchLength);
 
-    return matchOffset == 0 && matchLength == emailLength;
+    return matchOffset == 0 && matchLength == addressLength;
 }
 
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/html/ValidityState.h b/src/3rdparty/webkit/WebCore/html/ValidityState.h
index 1dee306070..78238f1638 100644
--- a/src/3rdparty/webkit/WebCore/html/ValidityState.h
+++ b/src/3rdparty/webkit/WebCore/html/ValidityState.h
@@ -2,6 +2,7 @@
  * This file is part of the WebKit project.
  *
  * Copyright (C) 2009 Michelangelo De Simone <micdesim@gmail.com>
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,40 +25,43 @@
 #define ValidityState_h
 
 #include "HTMLFormControlElement.h"
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-    class ValidityState : public RefCounted<ValidityState> {
-    public:
-        static PassRefPtr<ValidityState> create(HTMLFormControlElement* owner)
-        {
-            return adoptRef(new ValidityState(owner));
-        }
+class ValidityState : public Noncopyable {
+public:
+    static PassOwnPtr<ValidityState> create(HTMLFormControlElement* control)
+    {
+        return new ValidityState(control);
+    }
 
-        HTMLFormControlElement* control() const { return m_control; }
+    void ref() { m_control->ref(); }
+    void deref() { m_control->deref(); }
 
-        void setCustomErrorMessage(const String& message) { m_customErrorMessage = message; }
+    String validationMessage() const;
 
-        bool valueMissing() { return control()->valueMissing(); }
-        bool typeMismatch();
-        bool patternMismatch() { return control()->patternMismatch(); }
-        bool tooLong() { return control()->tooLong(); }
-        bool rangeUnderflow();
-        bool rangeOverflow();
-        bool stepMismatch() { return false; }
-        bool customError() { return !m_customErrorMessage.isEmpty(); }
-        bool valid();
+    void setCustomErrorMessage(const String& message) { m_customErrorMessage = message; }
 
-    private:
-        ValidityState(HTMLFormControlElement*);
-        HTMLFormControlElement* m_control;
-        String m_customErrorMessage;
+    bool valueMissing() const { return m_control->valueMissing(); }
+    bool typeMismatch() const;
+    bool patternMismatch() const { return m_control->patternMismatch(); }
+    bool tooLong() const { return m_control->tooLong(); }
+    bool rangeUnderflow() const;
+    bool rangeOverflow() const;
+    bool stepMismatch() const;
+    bool customError() const { return !m_customErrorMessage.isEmpty(); }
+    bool valid() const;
 
-        static bool isValidColorString(const String&);
-        bool isValidEmailAddress(const String&);
-    };
+private:
+    ValidityState(HTMLFormControlElement* control) : m_control(control) { }
+
+    static bool isValidColorString(const String&);
+    static bool isValidEmailAddress(const String&);
+
+    HTMLFormControlElement* m_control;
+    String m_customErrorMessage;
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/html/ValidityState.idl b/src/3rdparty/webkit/WebCore/html/ValidityState.idl
index b926852997..576fab4db1 100644
--- a/src/3rdparty/webkit/WebCore/html/ValidityState.idl
+++ b/src/3rdparty/webkit/WebCore/html/ValidityState.idl
@@ -22,7 +22,7 @@
 
 module html {
 
-    interface ValidityState {
+    interface [OmitConstructor] ValidityState {
         readonly attribute boolean         valueMissing;
         readonly attribute boolean         typeMismatch;
         readonly attribute boolean         patternMismatch;
diff --git a/src/3rdparty/webkit/WebCore/html/VoidCallback.idl b/src/3rdparty/webkit/WebCore/html/VoidCallback.idl
index 3682cf7578..8a7cf19bf0 100644
--- a/src/3rdparty/webkit/WebCore/html/VoidCallback.idl
+++ b/src/3rdparty/webkit/WebCore/html/VoidCallback.idl
@@ -24,7 +24,7 @@
  */
 
 module html {
-    interface [CustomNativeConverter] VoidCallback {
+    interface [CustomNativeConverter, OmitConstructor] VoidCallback {
         void handleEvent();
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.h
deleted file mode 100644
index 8cedbbea21..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.h
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasArray_h
-#define CanvasArray_h
-
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/RefPtr.h>
-#include "CanvasArrayBuffer.h"
-
-namespace WebCore {
-    class CanvasArray : public RefCounted<CanvasArray> {
-    public:
-        virtual bool isByteArray() const { return false; }
-        virtual bool isUnsignedByteArray() const { return false; }
-        virtual bool isShortArray() const { return false; }
-        virtual bool isUnsignedShortArray() const { return false; }
-        virtual bool isIntArray() const { return false; }
-        virtual bool isUnsignedIntArray() const { return false; }
-        virtual bool isFloatArray() const { return false; }
-        
-        PassRefPtr<CanvasArrayBuffer> buffer() {
-            return m_buffer;
-        }
-
-        void* baseAddress() {
-            return m_baseAddress;
-        }
-
-        unsigned offset() const {
-            return m_offset;
-        }
-
-        virtual unsigned length() const = 0;
-        virtual unsigned sizeInBytes() const = 0;
-        virtual unsigned alignedSizeInBytes() const;
-        virtual ~CanvasArray();
-
-    protected:
-        CanvasArray(PassRefPtr<CanvasArrayBuffer> buffer, unsigned offset);
-
-        // This is the address of the CanvasArrayBuffer's storage, plus the offset.
-        void* m_baseAddress;
-        unsigned m_offset;
-        
-    private:
-        RefPtr<CanvasArrayBuffer> m_buffer;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArrayBuffer.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArrayBuffer.cpp
deleted file mode 100644
index c8a139783a..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArrayBuffer.cpp
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasArrayBuffer> CanvasArrayBuffer::create(unsigned sizeInBytes)
-    {
-        return adoptRef(new CanvasArrayBuffer(sizeInBytes));
-    }
-    
-    CanvasArrayBuffer::CanvasArrayBuffer(unsigned sizeInBytes) {
-        m_sizeInBytes = sizeInBytes;
-        m_data = WTF::fastZeroedMalloc(sizeInBytes);
-    }
-    
-    void* CanvasArrayBuffer::data() {
-        return m_data;
-    }
-
-    unsigned CanvasArrayBuffer::byteLength() const {
-        return m_sizeInBytes;
-    }
-
-    CanvasArrayBuffer::~CanvasArrayBuffer() {
-        WTF::fastFree(m_data);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasBuffer.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasBuffer.cpp
deleted file mode 100644
index 009f8ade83..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasBuffer.cpp
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasBuffer.h"
-#include "CanvasRenderingContext3D.h"
-
-namespace WebCore {
-    
-PassRefPtr<CanvasBuffer> CanvasBuffer::create(CanvasRenderingContext3D* ctx)
-{
-    return adoptRef(new CanvasBuffer(ctx));
-}
-
-CanvasBuffer::CanvasBuffer(CanvasRenderingContext3D* ctx)
-    : CanvasObject(ctx)
-{
-    setObject(context()->graphicsContext3D()->createBuffer());
-}
-
-void CanvasBuffer::_deleteObject(Platform3DObject object)
-{
-    context()->graphicsContext3D()->deleteBuffer(object);
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.h
deleted file mode 100644
index 69cadf77f5..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.h
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasByteArray_h
-#define CanvasByteArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasArrayBuffer;
-
-    class CanvasByteArray : public CanvasArray {
-    public:
-        virtual bool isByteArray() const { return true; }
-
-        static PassRefPtr<CanvasByteArray> create(unsigned length);
-        static PassRefPtr<CanvasByteArray> create(signed char* array, unsigned length);
-        static PassRefPtr<CanvasByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        char* data() { return static_cast<char*>(baseAddress()); }
-
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<signed char>::min())
-                value = std::numeric_limits<signed char>::min();
-            else if (value > std::numeric_limits<signed char>::max())
-                value = std::numeric_limits<signed char>::max();
-            signed char* storage = static_cast<signed char*>(m_baseAddress);
-            storage[index] = static_cast<signed char>(value);
-        }
-        
-        bool get(unsigned index, signed char& result) const
-        {
-            if (index >= m_size)
-                return false;
-            signed char* storage = static_cast<signed char*>(m_baseAddress);
-            result = storage[index];
-            return true;
-        }
-
-        signed char item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            signed char* storage = static_cast<signed char*>(m_baseAddress);
-            return storage[index];
-        }
-    private:
-        CanvasByteArray(PassRefPtr<CanvasArrayBuffer> buffer,
-                        int offset,
-                        unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasByteArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasContextAttributes.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasContextAttributes.cpp
new file mode 100644
index 0000000000..d3d0398afd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasContextAttributes.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "CanvasContextAttributes.h"
+
+namespace WebCore {
+
+CanvasContextAttributes::CanvasContextAttributes()
+{
+}
+
+CanvasContextAttributes::~CanvasContextAttributes()
+{
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasContextAttributes.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasContextAttributes.h
new file mode 100644
index 0000000000..97483b366b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasContextAttributes.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CanvasContextAttributes_h
+#define CanvasContextAttributes_h
+
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+// A base class for any attributes that are needed which would affect
+// the creation of the Canvas's rendering context. Currently only the
+// WebGLRenderingContext uses this mechanism.
+
+class CanvasContextAttributes : public RefCounted<CanvasContextAttributes> {
+  public:
+    virtual ~CanvasContextAttributes();
+
+  protected:
+    CanvasContextAttributes();
+};
+
+} // namespace WebCore
+
+#endif // CanvasContextAttributes_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.cpp
deleted file mode 100644
index 09561cb6f5..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.cpp
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasFloatArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(float));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(float* array, unsigned length)
-    {
-        RefPtr<CanvasFloatArray> a = CanvasFloatArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-    {
-        // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(float)) != 0)
-            return NULL;
-
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(float))) > buffer->byteLength())
-                return NULL;
-        }
-        return adoptRef(new CanvasFloatArray(buffer, offset, length));
-    }
-    
-    CanvasFloatArray::CanvasFloatArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasFloatArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasFloatArray::sizeInBytes() const {
-        return length() * sizeof(float);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.h
deleted file mode 100644
index d2dc4ffbf4..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasFloatArray_h
-#define CanvasFloatArray_h
-
-#include "CanvasArray.h"
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasFloatArray : public CanvasArray {
-    public:
-        virtual bool isFloatArray() const { return true; }
-
-        static PassRefPtr<CanvasFloatArray> create(unsigned length);
-        static PassRefPtr<CanvasFloatArray> create(float* array, unsigned length);
-        static PassRefPtr<CanvasFloatArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        float* data() { return static_cast<float*>(baseAddress()); }
-
-        virtual unsigned length() const;
-        
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            float* storage = static_cast<float*>(m_baseAddress);
-            storage[index] = static_cast<float>(value);
-        }
-        
-        bool get(unsigned index, float& result) const
-        {
-            if (index >= m_size)
-                return false;
-            result = item(index);
-            return true;
-        }
-        
-        float item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            float* storage = static_cast<float*>(m_baseAddress);
-            float result = storage[index];
-            if (isnan(result)) {
-                // Clamp NaN to 0
-                result = 0;
-            }
-            return result;
-        }
-    private:
-        CanvasFloatArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasFloatArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasGradient.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasGradient.idl
index a925a262a1..32813bcb12 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasGradient.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasGradient.idl
@@ -27,7 +27,8 @@ module html {
 
     interface [
         InterfaceUUID=bb1108ea-6b8c-4a08-894a-218628630cdb,
-        ImplementationUUID=a2942ae6-2731-4286-98cc-9d5e79e20de1
+        ImplementationUUID=a2942ae6-2731-4286-98cc-9d5e79e20de1,
+        OmitConstructor
     ] CanvasGradient {
 
         void addColorStop(in float offset, in DOMString color)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.cpp
deleted file mode 100644
index 4716d7bc4d..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.cpp
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-#include "CanvasIntArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasIntArray> CanvasIntArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(int));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasIntArray> CanvasIntArray::create(int* array, unsigned length)
-    {
-        RefPtr<CanvasIntArray> a = CanvasIntArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasIntArray> CanvasIntArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
-                                                      int offset,
-                                                      unsigned length)
-    {
-        // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(int)) != 0)
-            return NULL;
-
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(int))) > buffer->byteLength())
-                return NULL;
-        }
-        
-        return adoptRef(new CanvasIntArray(buffer, offset, length));
-    }
-    
-    CanvasIntArray::CanvasIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasIntArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasIntArray::sizeInBytes() const {
-        return length() * sizeof(int);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.h
deleted file mode 100644
index 4977034c81..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasIntArray_h
-#define CanvasIntArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasIntArray : public CanvasArray {
-    public:
-        virtual bool isIntArray() const { return true; }
-
-        static PassRefPtr<CanvasIntArray> create(unsigned length);
-        static PassRefPtr<CanvasIntArray> create(int* array, unsigned length);
-        static PassRefPtr<CanvasIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        int* data() { return static_cast<int*>(baseAddress()); }
-
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<int>::min())
-                value = std::numeric_limits<int>::min();
-            else if (value > std::numeric_limits<int>::max())
-                value = std::numeric_limits<int>::max();
-            int* storage = static_cast<int*>(m_baseAddress);
-            storage[index] = static_cast<int>(value);
-        }
-        
-        bool get(unsigned index, int& result) const
-        {
-            if (index >= m_size)
-                return false;
-            result = item(index);
-            return true;
-        }
-        
-        int item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            int* storage = static_cast<int*>(m_baseAddress);
-            return storage[index];
-        }
-
-    private:
-        CanvasIntArray(PassRefPtr<CanvasArrayBuffer> buffer,
-                       int offset,
-                       unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasIntArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasNumberArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasNumberArray.idl
index 56e807e6c8..036d4eeec8 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasNumberArray.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasNumberArray.idl
@@ -26,7 +26,6 @@
 module html {
     interface [
         Conditional=3D_CANVAS,
-        GenerateConstructor,
         HasCustomIndexGetter
     ] CanvasNumberArray {
         readonly attribute unsigned long length;
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.cpp
index 8a71a45b48..6c7667b540 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.cpp
@@ -28,12 +28,13 @@
 #if ENABLE(3D_CANVAS)
 
 #include "CanvasObject.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-CanvasObject::CanvasObject(CanvasRenderingContext3D* context)
+CanvasObject::CanvasObject(WebGLRenderingContext* context)
     : m_object(0)
+    , m_shouldDeleteObject(true)
     , m_context(context)
 {
 }
@@ -44,24 +45,27 @@ CanvasObject::~CanvasObject()
         m_context->removeObject(this);
 }
 
-void CanvasObject::setObject(Platform3DObject object)
+void CanvasObject::setObject(Platform3DObject object, bool shouldDeleteObject)
 {
     if (object == m_object)
         return;
         
     deleteObject();
     m_object = object;
+    m_shouldDeleteObject = shouldDeleteObject;
 }
 
 void CanvasObject::deleteObject()
 {
     if (m_object) {
-        if (m_context) {
-            m_context->graphicsContext3D()->makeContextCurrent();
-            _deleteObject(m_object);
-        }
+        if (m_shouldDeleteObject)
+            if (m_context) {
+                m_context->graphicsContext3D()->makeContextCurrent();
+                _deleteObject(m_object);
+            }
         m_object = 0;
     }
+    m_shouldDeleteObject = true;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.h
index 748278d789..b7b016a2ab 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.h
@@ -33,14 +33,14 @@
 
 namespace WebCore {
 
-    class CanvasRenderingContext3D;
+    class WebGLRenderingContext;
     
     class CanvasObject : public RefCounted<CanvasObject> {
     public:
         virtual ~CanvasObject();
         
         Platform3DObject object() const { return m_object; }
-        void setObject(Platform3DObject);
+        void setObject(Platform3DObject, bool shouldDeleteObject = true);
         void deleteObject();
         
         void detachContext()
@@ -49,15 +49,22 @@ namespace WebCore {
             m_context = 0;
         }
 
-        CanvasRenderingContext3D* context() const { return m_context; }
+        WebGLRenderingContext* context() const { return m_context; }
 
     protected:
-        CanvasObject(CanvasRenderingContext3D*);
+        CanvasObject(WebGLRenderingContext*);
         virtual void _deleteObject(Platform3DObject) = 0;
     
     private:
         Platform3DObject m_object;
-        CanvasRenderingContext3D* m_context;
+        // The shouldDeleteObject flag indicates whether this wrapper
+        // owns the underlying resource and should delete it when the
+        // wrapper is unreferenced for the last time and deleted. It
+        // is only set to false for certain objects returned from get
+        // queries. FIXME: should consider canonicalizing all of these
+        // objects in the future.
+        bool m_shouldDeleteObject;
+        WebGLRenderingContext* m_context;
     };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasPattern.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPattern.idl
index 1cac8f8804..492c93f4cf 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasPattern.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPattern.idl
@@ -27,7 +27,8 @@ module html {
 
     interface [
         InterfaceUUID=c2131348-6d8c-47b5-86cc-d41aff34ce15,
-        ImplementationUUID=82f5d713-3d17-44dd-aa4a-7766fe345940
+        ImplementationUUID=82f5d713-3d17-44dd-aa4a-7766fe345940,
+        OmitConstructor
     ] CanvasPattern {
 
     };
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasPixelArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPixelArray.h
index 8ac516333c..25eb92a8ea 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasPixelArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPixelArray.h
@@ -42,6 +42,7 @@ namespace WebCore {
         static PassRefPtr<CanvasPixelArray> create(unsigned length);
         
         WTF::ByteArray* data() { return m_data.get(); }
+        const WTF::ByteArray* data() const { return m_data.get(); }
         unsigned length() const { return m_data->length(); }
         
         void set(unsigned index, double value)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasPixelArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPixelArray.idl
index 2295af6f5d..60726cd23f 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasPixelArray.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPixelArray.idl
@@ -29,6 +29,7 @@
 module html {
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT || defined(V8_BINDING) && V8_BINDING
     interface [
+        OmitConstructor,
         CustomHeader,
         HasNumericIndexGetter,
         HasCustomIndexSetter
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.idl
index 8701c8026f..a11aa7596e 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.idl
@@ -26,7 +26,6 @@
 module html {
 
     interface [
-        GenerateConstructor,
         CustomToJS,
         InterfaceUUID=98fb48ae-7216-489c-862b-8e1217fc4443,
         ImplementationUUID=ab4f0781-152f-450e-9546-5b3987491a54
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 848771b00e..8add19cc94 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -30,7 +30,7 @@
 #include "config.h"
 #include "CanvasRenderingContext2D.h"
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "CSSParser.h"
 #include "CachedImage.h"
 #include "CanvasGradient.h"
@@ -354,7 +354,10 @@ void CanvasRenderingContext2D::scale(float sx, float sy)
     if (!state().m_invertibleCTM)
         return;
 
-    TransformationMatrix newTransform = state().m_transform;
+    if (!isfinite(sx) | !isfinite(sy))
+        return;
+
+    AffineTransform newTransform = state().m_transform;
     newTransform.scaleNonUniform(sx, sy);
     if (!newTransform.isInvertible()) {
         state().m_invertibleCTM = false;
@@ -363,7 +366,7 @@ void CanvasRenderingContext2D::scale(float sx, float sy)
 
     state().m_transform = newTransform;
     c->scale(FloatSize(sx, sy));
-    m_path.transform(TransformationMatrix().scaleNonUniform(1.0/sx, 1.0/sy));
+    m_path.transform(AffineTransform().scaleNonUniform(1.0 / sx, 1.0 / sy));
 }
 
 void CanvasRenderingContext2D::rotate(float angleInRadians)
@@ -374,7 +377,10 @@ void CanvasRenderingContext2D::rotate(float angleInRadians)
     if (!state().m_invertibleCTM)
         return;
 
-    TransformationMatrix newTransform = state().m_transform;
+    if (!isfinite(angleInRadians))
+        return;
+
+    AffineTransform newTransform = state().m_transform;
     newTransform.rotate(angleInRadians / piDouble * 180.0);
     if (!newTransform.isInvertible()) {
         state().m_invertibleCTM = false;
@@ -383,7 +389,7 @@ void CanvasRenderingContext2D::rotate(float angleInRadians)
 
     state().m_transform = newTransform;
     c->rotate(angleInRadians);
-    m_path.transform(TransformationMatrix().rotate(-angleInRadians / piDouble * 180.0));
+    m_path.transform(AffineTransform().rotate(-angleInRadians / piDouble * 180.0));
 }
 
 void CanvasRenderingContext2D::translate(float tx, float ty)
@@ -394,7 +400,10 @@ void CanvasRenderingContext2D::translate(float tx, float ty)
     if (!state().m_invertibleCTM)
         return;
 
-    TransformationMatrix newTransform = state().m_transform;
+    if (!isfinite(tx) | !isfinite(ty))
+        return;
+
+    AffineTransform newTransform = state().m_transform;
     newTransform.translate(tx, ty);
     if (!newTransform.isInvertible()) {
         state().m_invertibleCTM = false;
@@ -403,7 +412,7 @@ void CanvasRenderingContext2D::translate(float tx, float ty)
 
     state().m_transform = newTransform;
     c->translate(tx, ty);
-    m_path.transform(TransformationMatrix().translate(-tx, -ty));
+    m_path.transform(AffineTransform().translate(-tx, -ty));
 }
 
 void CanvasRenderingContext2D::transform(float m11, float m12, float m21, float m22, float dx, float dy)
@@ -413,14 +422,13 @@ void CanvasRenderingContext2D::transform(float m11, float m12, float m21, float
         return;
     if (!state().m_invertibleCTM)
         return;
-    
-    // HTML5 3.14.11.1 -- ignore any calls that pass non-finite numbers
+
     if (!isfinite(m11) | !isfinite(m21) | !isfinite(dx) | 
         !isfinite(m12) | !isfinite(m22) | !isfinite(dy))
         return;
 
-    TransformationMatrix transform(m11, m12, m21, m22, dx, dy);
-    TransformationMatrix newTransform = transform * state().m_transform;
+    AffineTransform transform(m11, m12, m21, m22, dx, dy);
+    AffineTransform newTransform = transform * state().m_transform;
     if (!newTransform.isInvertible()) {
         state().m_invertibleCTM = false;
         return;
@@ -437,12 +445,11 @@ void CanvasRenderingContext2D::setTransform(float m11, float m12, float m21, flo
     if (!c)
         return;
     
-    // HTML5 3.14.11.1 -- ignore any calls that pass non-finite numbers
     if (!isfinite(m11) | !isfinite(m21) | !isfinite(dx) | 
         !isfinite(m12) | !isfinite(m22) | !isfinite(dy))
         return;
 
-    TransformationMatrix ctm = state().m_transform;
+    AffineTransform ctm = state().m_transform;
     if (!ctm.isInvertible())
         return;
     c->concatCTM(c->getCTM().inverse());
@@ -701,7 +708,7 @@ bool CanvasRenderingContext2D::isPointInPath(const float x, const float y)
         return false;
 
     FloatPoint point(x, y);
-    TransformationMatrix ctm = state().m_transform;
+    AffineTransform ctm = state().m_transform;
     FloatPoint transformedPoint = ctm.inverse().mapPoint(point);
     return m_path.contains(transformedPoint);
 }
@@ -816,7 +823,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
         return;
 
     RGBA32 rgba = makeRGBA32FromFloats(grayLevel, grayLevel, grayLevel, 1.0f);
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba));
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba), DeviceColorSpace);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, const String& color, float alpha)
@@ -832,7 +839,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     RGBA32 rgba = 0; // default is transparent black
     if (!state().m_shadowColor.isEmpty())
         CSSParser::parseColor(rgba, state().m_shadowColor);
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(colorWithOverrideAlpha(rgba, alpha)));
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(colorWithOverrideAlpha(rgba, alpha)), DeviceColorSpace);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float grayLevel, float alpha)
@@ -846,7 +853,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
         return;
 
     RGBA32 rgba = makeRGBA32FromFloats(grayLevel, grayLevel, grayLevel, alpha);
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba));
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba), DeviceColorSpace);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float r, float g, float b, float a)
@@ -862,7 +869,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     RGBA32 rgba = makeRGBA32FromFloats(r, g, b, a); // default is transparent black
     if (!state().m_shadowColor.isEmpty())
         CSSParser::parseColor(rgba, state().m_shadowColor);
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba));
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba), DeviceColorSpace);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float c, float m, float y, float k, float a)
@@ -882,7 +889,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     CGContextSetShadowWithColor(dc->platformContext(), adjustedShadowSize(width, -height), blur, shadowColor);
     CGColorRelease(shadowColor);
 #else
-    dc->setShadow(IntSize(width, -height), blur, Color(c, m, y, k, a));
+    dc->setShadow(IntSize(width, -height), blur, Color(c, m, y, k, a), DeviceColorSpace);
 #endif
 }
 
@@ -905,7 +912,7 @@ void CanvasRenderingContext2D::applyShadow()
         CSSParser::parseColor(rgba, state().m_shadowColor);
     float width = state().m_shadowOffset.width();
     float height = state().m_shadowOffset.height();
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba));
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba), DeviceColorSpace);
 }
 
 static IntSize size(HTMLImageElement* image)
@@ -994,7 +1001,7 @@ void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, const FloatRec
     FloatRect sourceRect = c->roundToDevicePixels(srcRect);
     FloatRect destRect = c->roundToDevicePixels(dstRect);
     willDraw(destRect);
-    c->drawImage(cachedImage->image(), destRect, sourceRect, state().m_globalComposite);
+    c->drawImage(cachedImage->image(), DeviceColorSpace, destRect, sourceRect, state().m_globalComposite);
 }
 
 void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* canvas, float x, float y)
@@ -1044,7 +1051,7 @@ void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* sourceCanvas, const
     if (!sourceCanvas->originClean())
         canvas()->setOriginTainted();
 
-    c->drawImage(buffer->image(), destRect, sourceRect, state().m_globalComposite);
+    c->drawImage(buffer->image(), DeviceColorSpace, destRect, sourceRect, state().m_globalComposite);
     willDraw(destRect); // This call comes after drawImage, since the buffer we draw into may be our own, and we need to make sure it is dirty.
                         // FIXME: Arguably willDraw should become didDraw and occur after drawing calls and not before them to avoid problems like this.
 }
@@ -1138,7 +1145,7 @@ void CanvasRenderingContext2D::drawImageFromRect(HTMLImageElement* image,
 
     FloatRect destRect = FloatRect(dx, dy, dw, dh);
     willDraw(destRect);
-    c->drawImage(cachedImage->image(), destRect, FloatRect(sx, sy, sw, sh), op);
+    c->drawImage(cachedImage->image(), DeviceColorSpace, destRect, FloatRect(sx, sy, sw, sh), op);
 }
 
 void CanvasRenderingContext2D::setAlpha(float alpha)
@@ -1234,7 +1241,7 @@ void CanvasRenderingContext2D::willDraw(const FloatRect& r, unsigned options)
 
     FloatRect dirtyRect = r;
     if (options & CanvasWillDrawApplyTransform) {
-        TransformationMatrix ctm = state().m_transform;
+        AffineTransform ctm = state().m_transform;
         dirtyRect = ctm.mapRect(r);
     }
     
@@ -1525,9 +1532,9 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
         GraphicsContext* maskImageContext = maskImage->context();
 
         if (fill)
-            maskImageContext->setFillColor(Color::black);
+            maskImageContext->setFillColor(Color::black, DeviceColorSpace);
         else {
-            maskImageContext->setStrokeColor(Color::black);
+            maskImageContext->setStrokeColor(Color::black, DeviceColorSpace);
             maskImageContext->setStrokeThickness(c->strokeThickness());
         }
 
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.h
index 283f92c333..553ffd293b 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.h
@@ -26,8 +26,8 @@
 #ifndef CanvasRenderingContext2D_h
 #define CanvasRenderingContext2D_h
 
+#include "AffineTransform.h"
 #include "CanvasRenderingContext.h"
-#include "TransformationMatrix.h"
 #include "FloatSize.h"
 #include "Font.h"
 #include "GraphicsTypes.h"
@@ -218,7 +218,7 @@ namespace WebCore {
             String m_shadowColor;
             float m_globalAlpha;
             CompositeOperator m_globalComposite;
-            TransformationMatrix m_transform;
+            AffineTransform m_transform;
             bool m_invertibleCTM;
             
             // Text state.
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.idl
index ef66d1a65a..f93a7525a9 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.idl
@@ -26,7 +26,6 @@
 module html {
 
     interface [
-        GenerateConstructor,
         InterfaceUUID=98fb48ae-7216-489c-862b-8e1217fc4443,
         ImplementationUUID=ab4f0781-152f-450e-9546-5b3987491a54
     ] CanvasRenderingContext2D : CanvasRenderingContext {
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp
deleted file mode 100644
index 612b4c3429..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp
+++ /dev/null
@@ -1,1441 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasRenderingContext3D.h"
-
-#include "CanvasActiveInfo.h"
-#include "CanvasBuffer.h"
-#include "CanvasFramebuffer.h"
-#include "CanvasProgram.h"
-#include "CanvasRenderbuffer.h"
-#include "CanvasTexture.h"
-#include "CanvasShader.h"
-#include "HTMLCanvasElement.h"
-#include "RenderBox.h"
-#include "RenderLayer.h"
-
-namespace WebCore {
-
-PassOwnPtr<CanvasRenderingContext3D> CanvasRenderingContext3D::create(HTMLCanvasElement* canvas)
-{
-    OwnPtr<GraphicsContext3D> context(GraphicsContext3D::create());
-    if (!context)
-        return 0;
-        
-    return new CanvasRenderingContext3D(canvas, context.release());
-}
-
-CanvasRenderingContext3D::CanvasRenderingContext3D(HTMLCanvasElement* passedCanvas, PassOwnPtr<GraphicsContext3D> context)
-    : CanvasRenderingContext(passedCanvas)
-    , m_context(context)
-    , m_needsUpdate(true)
-    , m_markedCanvasDirty(false)
-{
-    ASSERT(m_context);
-    m_context->reshape(canvas()->width(), canvas()->height());
-}
-
-CanvasRenderingContext3D::~CanvasRenderingContext3D()
-{
-    detachAndRemoveAllObjects();
-}
-
-void CanvasRenderingContext3D::markContextChanged()
-{
-#if USE(ACCELERATED_COMPOSITING)
-    if (canvas()->renderBox() && canvas()->renderBox()->hasLayer()) {
-        canvas()->renderBox()->layer()->rendererContentChanged();
-    } else {
-#endif
-        if (!m_markedCanvasDirty) {
-            // Make sure the canvas's image buffer is allocated.
-            canvas()->buffer();
-            canvas()->willDraw(FloatRect(0, 0, canvas()->width(), canvas()->height()));
-            m_markedCanvasDirty = true;
-        }
-#if USE(ACCELERATED_COMPOSITING)
-    }
-#endif
-}
-
-void CanvasRenderingContext3D::beginPaint()
-{
-    if (m_markedCanvasDirty) {
-        m_context->beginPaint(this);
-    }
-}
-
-void CanvasRenderingContext3D::endPaint()
-{
-    if (m_markedCanvasDirty) {
-        m_markedCanvasDirty = false;
-        m_context->endPaint();
-    }
-}
-
-void CanvasRenderingContext3D::reshape(int width, int height)
-{
-    if (m_needsUpdate) {
-#if USE(ACCELERATED_COMPOSITING)
-        if (canvas()->renderBox() && canvas()->renderBox()->hasLayer())
-            canvas()->renderBox()->layer()->rendererContentChanged();
-#endif
-        m_needsUpdate = false;
-    }
-    
-    m_context->reshape(width, height);
-}
-
-int CanvasRenderingContext3D::sizeInBytes(int type, ExceptionCode& ec)
-{
-    int result = m_context->sizeInBytes(type);
-    if (result <= 0) {
-        ec = SYNTAX_ERR;
-    }
-    return result;
-}
-
-void CanvasRenderingContext3D::activeTexture(unsigned long texture)
-{
-    m_context->activeTexture(texture);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::attachShader(CanvasProgram* program, CanvasShader* shader)
-{
-    if (!program || !shader)
-        return;
-    m_context->attachShader(program, shader);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bindAttribLocation(CanvasProgram* program, unsigned long index, const String& name)
-{
-    if (!program)
-        return;
-    m_context->bindAttribLocation(program, index, name);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bindBuffer(unsigned long target, CanvasBuffer* buffer)
-{
-    m_context->bindBuffer(target, buffer);
-    cleanupAfterGraphicsCall(false);
-}
-
-
-void CanvasRenderingContext3D::bindFramebuffer(unsigned long target, CanvasFramebuffer* buffer)
-{
-    m_context->bindFramebuffer(target, buffer);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bindRenderbuffer(unsigned long target, CanvasRenderbuffer* renderbuffer)
-{
-    m_context->bindRenderbuffer(target, renderbuffer);
-    cleanupAfterGraphicsCall(false);
-}
-
-
-void CanvasRenderingContext3D::bindTexture(unsigned long target, CanvasTexture* texture)
-{
-    m_context->bindTexture(target, texture);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::blendColor(double red, double green, double blue, double alpha)
-{
-    m_context->blendColor(red, green, blue, alpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::blendEquation( unsigned long mode )
-{
-    m_context->blendEquation(mode);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha)
-{
-    m_context->blendEquationSeparate(modeRGB, modeAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-
-void CanvasRenderingContext3D::blendFunc(unsigned long sfactor, unsigned long dfactor)
-{
-    m_context->blendFunc(sfactor, dfactor);
-    cleanupAfterGraphicsCall(false);
-}       
-
-void CanvasRenderingContext3D::blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha)
-{
-    m_context->blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bufferData(unsigned long target, int size, unsigned long usage)
-{
-    m_context->bufferData(target, size, usage);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bufferData(unsigned long target, CanvasArray* data, unsigned long usage)
-{
-    m_context->bufferData(target, data, usage);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bufferSubData(unsigned long target, long offset, CanvasArray* data)
-{
-    m_context->bufferSubData(target, offset, data);
-    cleanupAfterGraphicsCall(false);
-}
-
-unsigned long CanvasRenderingContext3D::checkFramebufferStatus(unsigned long target)
-{
-    return m_context->checkFramebufferStatus(target);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::clear(unsigned long mask)
-{
-    m_context->clear(mask);
-    cleanupAfterGraphicsCall(true);
-}
-
-void CanvasRenderingContext3D::clearColor(double r, double g, double b, double a)
-{
-    if (isnan(r))
-        r = 0;
-    if (isnan(g))
-        g = 0;
-    if (isnan(b))
-        b = 0;
-    if (isnan(a))
-        a = 1;
-    m_context->clearColor(r, g, b, a);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::clearDepth(double depth)
-{
-    m_context->clearDepth(depth);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::clearStencil(long s)
-{
-    m_context->clearStencil(s);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::colorMask(bool red, bool green, bool blue, bool alpha)
-{
-    m_context->colorMask(red, green, blue, alpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::compileShader(CanvasShader* shader)
-{
-    m_context->compileShader(shader);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border)
-{
-    m_context->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height)
-{
-    m_context->copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
-    cleanupAfterGraphicsCall(false);
-}
-
-PassRefPtr<CanvasBuffer> CanvasRenderingContext3D::createBuffer()
-{
-    RefPtr<CanvasBuffer> o = CanvasBuffer::create(this);
-    addObject(o.get());
-    return o;
-}
-        
-PassRefPtr<CanvasFramebuffer> CanvasRenderingContext3D::createFramebuffer()
-{
-    RefPtr<CanvasFramebuffer> o = CanvasFramebuffer::create(this);
-    addObject(o.get());
-    return o;
-}
-
-PassRefPtr<CanvasTexture> CanvasRenderingContext3D::createTexture()
-{
-    RefPtr<CanvasTexture> o = CanvasTexture::create(this);
-    addObject(o.get());
-    return o;
-}
-
-PassRefPtr<CanvasProgram> CanvasRenderingContext3D::createProgram()
-{
-    RefPtr<CanvasProgram> o = CanvasProgram::create(this);
-    addObject(o.get());
-    return o;
-}
-
-PassRefPtr<CanvasRenderbuffer> CanvasRenderingContext3D::createRenderbuffer()
-{
-    RefPtr<CanvasRenderbuffer> o = CanvasRenderbuffer::create(this);
-    addObject(o.get());
-    return o;
-}
-
-PassRefPtr<CanvasShader> CanvasRenderingContext3D::createShader(unsigned long type)
-{
-    // FIXME: Need to include GL_ constants for internal use
-    // FIXME: Need to do param checking and throw exception if an illegal value is passed in
-    GraphicsContext3D::ShaderType shaderType = GraphicsContext3D::VERTEX_SHADER;
-    if (type == 0x8B30) // GL_FRAGMENT_SHADER
-        shaderType = GraphicsContext3D::FRAGMENT_SHADER;
-        
-    RefPtr<CanvasShader> o = CanvasShader::create(this, shaderType);
-    addObject(o.get());
-    return o;
-}
-
-void CanvasRenderingContext3D::cullFace(unsigned long mode)
-{
-    m_context->cullFace(mode);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::deleteBuffer(CanvasBuffer* buffer)
-{
-    if (!buffer)
-        return;
-    
-    buffer->deleteObject();
-}
-
-void CanvasRenderingContext3D::deleteFramebuffer(CanvasFramebuffer* framebuffer)
-{
-    if (!framebuffer)
-        return;
-    
-    framebuffer->deleteObject();
-}
-
-void CanvasRenderingContext3D::deleteProgram(CanvasProgram* program)
-{
-    if (!program)
-        return;
-    
-    program->deleteObject();
-}
-
-void CanvasRenderingContext3D::deleteRenderbuffer(CanvasRenderbuffer* renderbuffer)
-{
-    if (!renderbuffer)
-        return;
-    
-    renderbuffer->deleteObject();
-}
-
-void CanvasRenderingContext3D::deleteShader(CanvasShader* shader)
-{
-    if (!shader)
-        return;
-    
-    shader->deleteObject();
-}
-
-void CanvasRenderingContext3D::deleteTexture(CanvasTexture* texture)
-{
-    if (!texture)
-        return;
-    
-    texture->deleteObject();
-}
-
-void CanvasRenderingContext3D::depthFunc(unsigned long func)
-{
-    m_context->depthFunc(func);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::depthMask(bool flag)
-{
-    m_context->depthMask(flag);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::depthRange(double zNear, double zFar)
-{
-    m_context->depthRange(zNear, zFar);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::detachShader(CanvasProgram* program, CanvasShader* shader)
-{
-    if (!program || !shader)
-        return;
-
-    m_context->detachShader(program, shader);
-    cleanupAfterGraphicsCall(false);
-}
-
-
-void CanvasRenderingContext3D::disable(unsigned long cap)
-{
-    m_context->disable(cap);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::disableVertexAttribArray(unsigned long index)
-{
-    m_context->disableVertexAttribArray(index);
-    cleanupAfterGraphicsCall(false);
-}
-
-
-void CanvasRenderingContext3D::drawArrays(unsigned long mode, long first, long count)
-{
-    m_context->drawArrays(mode, first, count);
-    cleanupAfterGraphicsCall(true);
-}
-
-void CanvasRenderingContext3D::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset)
-{
-    m_context->drawElements(mode, count, type, offset);
-    cleanupAfterGraphicsCall(true);
-}
-
-void CanvasRenderingContext3D::enable(unsigned long cap)
-{
-    m_context->enable(cap);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::enableVertexAttribArray(unsigned long index)
-{
-    m_context->enableVertexAttribArray(index);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::finish()
-{
-    m_context->finish();
-    cleanupAfterGraphicsCall(true);
-}
-
-
-void CanvasRenderingContext3D::flush()
-{
-    m_context->flush();
-    cleanupAfterGraphicsCall(true);
-}
-
-void CanvasRenderingContext3D::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer* buffer)
-{
-    if (!buffer)
-        return;
-        
-    m_context->framebufferRenderbuffer(target, attachment, renderbuffertarget, buffer);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture* texture, long level)
-{
-    if (!texture)
-        return;
-        
-    m_context->framebufferTexture2D(target, attachment, textarget, texture, level);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::frontFace(unsigned long mode)
-{
-    m_context->frontFace(mode);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::generateMipmap(unsigned long target)
-{
-    m_context->generateMipmap(target);
-    cleanupAfterGraphicsCall(false);
-}
-
-PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveAttrib(CanvasProgram* program, unsigned long index, ExceptionCode& ec)
-{
-    ActiveInfo info;
-    if (!program || program->context() != this || !m_context->getActiveAttrib(program, index, info)) {
-        ec = INDEX_SIZE_ERR;
-        return 0;
-    }
-    return CanvasActiveInfo::create(info.name, info.type, info.size);
-}
-
-PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveUniform(CanvasProgram* program, unsigned long index, ExceptionCode& ec)
-{
-    ActiveInfo info;
-    if (!program || program->context() != this || !m_context->getActiveUniform(program, index, info)) {
-        ec = INDEX_SIZE_ERR;
-        return 0;
-    }
-    return CanvasActiveInfo::create(info.name, info.type, info.size);
-}
-
-int CanvasRenderingContext3D::getAttribLocation(CanvasProgram* program, const String& name)
-{
-    return m_context->getAttribLocation(program, name);
-}
-
-bool CanvasRenderingContext3D::getBoolean(unsigned long pname)
-{
-    bool result = m_context->getBoolean(pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasUnsignedByteArray> CanvasRenderingContext3D::getBooleanv(unsigned long pname)
-{
-    RefPtr<CanvasUnsignedByteArray> array = m_context->getBooleanv(pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getBufferParameteri(unsigned long target, unsigned long pname)
-{
-    int result = m_context->getBufferParameteri(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getBufferParameteriv(unsigned long target, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getBufferParameteriv(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-unsigned long CanvasRenderingContext3D::getError()
-{
-    return m_context->getError();
-}
-
-float CanvasRenderingContext3D::getFloat(unsigned long pname)
-{
-    float result = m_context->getFloat(pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getFloatv(unsigned long pname)
-{
-    RefPtr<CanvasFloatArray> array = m_context->getFloatv(pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname)
-{
-    int result = m_context->getFramebufferAttachmentParameteri(target, attachment, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getFramebufferAttachmentParameteriv(target, attachment, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getInteger(unsigned long pname)
-{
-    float result = m_context->getInteger(pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getIntegerv(unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getIntegerv(pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getProgrami(CanvasProgram* program, unsigned long pname)
-{
-    int result = m_context->getProgrami(program, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getProgramiv(CanvasProgram* program, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getProgramiv(program, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-String CanvasRenderingContext3D::getProgramInfoLog(CanvasProgram* program)
-{
-    String s = m_context->getProgramInfoLog(program);
-    cleanupAfterGraphicsCall(false);
-    return s;
-}
-
-int CanvasRenderingContext3D::getRenderbufferParameteri(unsigned long target, unsigned long pname)
-{
-    int result = m_context->getRenderbufferParameteri(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getRenderbufferParameteriv(unsigned long target, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getRenderbufferParameteriv(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getShaderi(CanvasShader* shader, unsigned long pname)
-{
-    int result = m_context->getShaderi(shader, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getShaderiv(CanvasShader* shader, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getShaderiv(shader, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-String CanvasRenderingContext3D::getShaderInfoLog(CanvasShader* shader)
-{
-    String s = m_context->getShaderInfoLog(shader);
-    cleanupAfterGraphicsCall(false);
-    return s;
-}
-
-String CanvasRenderingContext3D::getShaderSource(CanvasShader* shader)
-{
-    String s = m_context->getShaderSource(shader);
-    cleanupAfterGraphicsCall(false);
-    return s;
-}
-
-String CanvasRenderingContext3D::getString(unsigned long name)
-{
-    return m_context->getString(name);
-}
-
-float CanvasRenderingContext3D::getTexParameterf(unsigned long target, unsigned long pname)
-{
-    float result = m_context->getTexParameterf(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getTexParameterfv(unsigned long target, unsigned long pname)
-{
-    RefPtr<CanvasFloatArray> array = m_context->getTexParameterfv(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getTexParameteri(unsigned long target, unsigned long pname)
-{
-    int result = m_context->getTexParameteri(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getTexParameteriv(unsigned long target, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getTexParameteriv(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-float CanvasRenderingContext3D::getUniformf(CanvasProgram* program, long location)
-{
-    float result = m_context->getUniformf(program, location);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getUniformfv(CanvasProgram* program, long location)
-{
-    RefPtr<CanvasFloatArray> array = m_context->getUniformfv(program, location);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-long CanvasRenderingContext3D::getUniformi(CanvasProgram* program, long location)
-{
-    long result = m_context->getUniformi(program, location);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getUniformiv(CanvasProgram* program, long location)
-{
-    RefPtr<CanvasIntArray> array = m_context->getUniformiv(program, location);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-long CanvasRenderingContext3D::getUniformLocation(CanvasProgram* program, const String& name)
-{
-    return m_context->getUniformLocation(program, name);
-}
-
-float CanvasRenderingContext3D::getVertexAttribf(unsigned long index, unsigned long pname)
-{
-    float result = m_context->getVertexAttribf(index, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getVertexAttribfv(unsigned long index, unsigned long pname)
-{
-    RefPtr<CanvasFloatArray> array = m_context->getVertexAttribfv(index, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-long CanvasRenderingContext3D::getVertexAttribi(unsigned long index, unsigned long pname)
-{
-    long result = m_context->getVertexAttribi(index, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getVertexAttribiv(unsigned long index, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getVertexAttribiv(index, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-long CanvasRenderingContext3D::getVertexAttribOffset(unsigned long index, unsigned long pname)
-{
-    long result = m_context->getVertexAttribOffset(index, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-void CanvasRenderingContext3D::hint(unsigned long target, unsigned long mode)
-{
-    m_context->hint(target, mode);
-    cleanupAfterGraphicsCall(false);
-}
-
-bool CanvasRenderingContext3D::isBuffer(CanvasBuffer* buffer)
-{
-    if (!buffer)
-        return false;
-        
-    return m_context->isBuffer(buffer);
-}
-
-bool CanvasRenderingContext3D::isEnabled(unsigned long cap)
-{
-    return m_context->isEnabled(cap);
-}
-
-bool CanvasRenderingContext3D::isFramebuffer(CanvasFramebuffer* framebuffer)
-{
-    return m_context->isFramebuffer(framebuffer);
-}
-
-bool CanvasRenderingContext3D::isProgram(CanvasProgram* program)
-{
-    return m_context->isProgram(program);
-}
-
-bool CanvasRenderingContext3D::isRenderbuffer(CanvasRenderbuffer* renderbuffer)
-{
-    return m_context->isRenderbuffer(renderbuffer);
-}
-
-bool CanvasRenderingContext3D::isShader(CanvasShader* shader)
-{
-    return m_context->isShader(shader);
-}
-
-bool CanvasRenderingContext3D::isTexture(CanvasTexture* texture)
-{
-    return m_context->isTexture(texture);
-}
-
-void CanvasRenderingContext3D::lineWidth(double width)
-{
-    m_context->lineWidth((float) width);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::linkProgram(CanvasProgram* program)
-{
-    if (!program)
-        return;
-        
-    m_context->linkProgram(program);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::pixelStorei(unsigned long pname, long param)
-{
-    m_context->pixelStorei(pname, param);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::polygonOffset(double factor, double units)
-{
-    m_context->polygonOffset((float) factor, (float) units);
-    cleanupAfterGraphicsCall(false);
-}
-
-PassRefPtr<CanvasArray> CanvasRenderingContext3D::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
-{
-    RefPtr<CanvasArray> array = m_context->readPixels(x, y, width, height, format, type);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-void CanvasRenderingContext3D::releaseShaderCompiler()
-{
-    m_context->releaseShaderCompiler();
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height)
-{
-    m_context->renderbufferStorage(target, internalformat, width, height);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::sampleCoverage(double value, bool invert)
-{
-    m_context->sampleCoverage((float) value, invert);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::scissor(long x, long y, unsigned long width, unsigned long height)
-{
-    m_context->scissor(x, y, width, height);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::shaderSource(CanvasShader* shader, const String& string)
-{
-    m_context->shaderSource(shader, string);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilFunc(unsigned long func, long ref, unsigned long mask)
-{
-    m_context->stencilFunc(func, ref, mask);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask)
-{
-    m_context->stencilFuncSeparate(face, func, ref, mask);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilMask(unsigned long mask)
-{
-    m_context->stencilMask(mask);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilMaskSeparate(unsigned long face, unsigned long mask)
-{
-    m_context->stencilMaskSeparate(face, mask);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass)
-{
-    m_context->stencilOp(fail, zfail, zpass);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass)
-{
-    m_context->stencilOpSeparate(face, fail, zfail, zpass);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat,
-                                          unsigned width, unsigned height, unsigned border,
-                                          unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texImage2D(target, level, internalformat, width, height,
-                         border, format, type, pixels);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat,
-                                          unsigned width, unsigned height, unsigned border,
-                                          unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texImage2D(target, level, internalformat, width, height,
-                         border, format, type, pixels);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
-                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texImage2D(target, level, image, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
-                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texImage2D(target, level, canvas, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
-                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texImage2D(target, level, video, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texParameterf(unsigned target, unsigned pname, float param)
-{
-    m_context->texParameterf(target, pname, param);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texParameteri(unsigned target, unsigned pname, int param)
-{
-    m_context->texParameteri(target, pname, param);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                                             unsigned width, unsigned height,
-                                             unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                                             unsigned width, unsigned height,
-                                             unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                                             unsigned width, unsigned height, HTMLImageElement* image,
-                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, image, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                                             unsigned width, unsigned height, HTMLCanvasElement* canvas,
-                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, canvas, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                                             unsigned width, unsigned height, HTMLVideoElement* video,
-                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, video, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1f(long location, float x)
-{
-    m_context->uniform1f(location, x);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1fv(long location, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    m_context->uniform1fv(location, v->data(), v->length());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1fv(long location, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    m_context->uniform1fv(location, v, size);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1i(long location, int x)
-{
-    m_context->uniform1i(location, x);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1iv(long location, CanvasIntArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    m_context->uniform1iv(location, v->data(), v->length());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1iv(long location, int* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    m_context->uniform1iv(location, v, size);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2f(long location, float x, float y)
-{
-    m_context->uniform2f(location, x, y);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2fv(long location, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 2
-    m_context->uniform2fv(location, v->data(), v->length() / 2);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2fv(long location, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 2
-    m_context->uniform2fv(location, v, size / 2);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2i(long location, int x, int y)
-{
-    m_context->uniform2i(location, x, y);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2iv(long location, CanvasIntArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 2
-    m_context->uniform2iv(location, v->data(), v->length() / 2);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2iv(long location, int* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 2
-    m_context->uniform2iv(location, v, size / 2);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3f(long location, float x, float y, float z)
-{
-    m_context->uniform3f(location, x, y, z);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3fv(long location, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 3
-    m_context->uniform3fv(location, v->data(), v->length() / 3);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3fv(long location, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 3
-    m_context->uniform3fv(location, v, size / 3);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3i(long location, int x, int y, int z)
-{
-    m_context->uniform3i(location, x, y, z);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3iv(long location, CanvasIntArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 3
-    m_context->uniform3iv(location, v->data(), v->length() / 3);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3iv(long location, int* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 3
-    m_context->uniform3iv(location, v, size / 3);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4f(long location, float x, float y, float z, float w)
-{
-    m_context->uniform4f(location, x, y, z, w);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4fv(long location, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniform4fv(location, v->data(), v->length() / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4fv(long location, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniform4fv(location, v, size / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4i(long location, int x, int y, int z, int w)
-{
-    m_context->uniform4i(location, x, y, z, w);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4iv(long location, CanvasIntArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniform4iv(location, v->data(), v->length() / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4iv(long location, int* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniform4iv(location, v, size / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniformMatrix2fv(location, transpose, v->data(), v->length() / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniformMatrix2fv(location, transpose, v, size / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 9
-    m_context->uniformMatrix3fv(location, transpose, v->data(), v->length() / 9);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 9
-    m_context->uniformMatrix3fv(location, transpose, v, size / 9);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 16
-    m_context->uniformMatrix4fv(location, transpose, v->data(), v->length() / 16);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 16
-    m_context->uniformMatrix4fv(location, transpose, v, size / 16);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::useProgram(CanvasProgram* program)
-{
-    m_context->useProgram(program);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::validateProgram(CanvasProgram* program)
-{
-    m_context->validateProgram(program);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib1f(unsigned long indx, float v0)
-{
-    m_context->vertexAttrib1f(indx, v0);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, CanvasFloatArray* v)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib1fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, float* v, int size)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib1fv(indx, v);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib2f(unsigned long indx, float v0, float v1)
-{
-    m_context->vertexAttrib2f(indx, v0, v1);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, CanvasFloatArray* v)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib2fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, float* v, int size)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib2fv(indx, v);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib3f(unsigned long indx, float v0, float v1, float v2)
-{
-    m_context->vertexAttrib3f(indx, v0, v1, v2);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, CanvasFloatArray* v)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib3fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, float* v, int size)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib3fv(indx, v);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib4f(unsigned long indx, float v0, float v1, float v2, float v3)
-{
-    m_context->vertexAttrib4f(indx, v0, v1, v2, v3);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, CanvasFloatArray* v)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib4fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, float* v, int size)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib4fv(indx, v);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized, unsigned long stride, unsigned long offset)
-{
-    m_context->vertexAttribPointer(indx, size, type, normalized, stride, offset);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::viewport(long x, long y, unsigned long width, unsigned long height)
-{
-    if (isnan(x))
-        x = 0;
-    if (isnan(y))
-        y = 0;
-    if (isnan(width))
-        width = 100;
-    if (isnan(height))
-        height = 100;
-    m_context->viewport(x, y, width, height);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::removeObject(CanvasObject* object)
-{
-    m_canvasObjects.remove(object);
-}
-
-void CanvasRenderingContext3D::addObject(CanvasObject* object)
-{
-    removeObject(object);
-    m_canvasObjects.add(object);
-}
-
-void CanvasRenderingContext3D::detachAndRemoveAllObjects()
-{
-    HashSet<CanvasObject*>::iterator pend = m_canvasObjects.end();
-    for (HashSet<CanvasObject*>::iterator it = m_canvasObjects.begin(); it != pend; ++it)
-        (*it)->detachContext();
-        
-    m_canvasObjects.clear();
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
-
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h
deleted file mode 100644
index 70d9b95b12..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h
+++ /dev/null
@@ -1,327 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasRenderingContext3D_h
-#define CanvasRenderingContext3D_h
-
-#include "CanvasRenderingContext.h"
-#include "ExceptionCode.h"
-#include "CanvasFloatArray.h"
-#include "CanvasIntArray.h"
-#include "CanvasUnsignedByteArray.h"
-#include "GraphicsContext3D.h"
-#include "PlatformString.h"
-
-namespace WebCore {
-
-class CanvasActiveInfo;
-class CanvasBuffer;
-class CanvasFramebuffer;
-class CanvasObject;
-class CanvasProgram;
-class CanvasRenderbuffer;
-class CanvasShader;
-class CanvasTexture;
-class HTMLImageElement;
-class HTMLVideoElement;
-class ImageData;
-class WebKitCSSMatrix;
-
-    class CanvasRenderingContext3D : public CanvasRenderingContext {
-    public:
-        static PassOwnPtr<CanvasRenderingContext3D> create(HTMLCanvasElement*);
-        virtual ~CanvasRenderingContext3D();
-
-        virtual bool is3d() const { return true; }
-
-        // Helper to return the size in bytes of OpenGL data types
-        // like GL_FLOAT, GL_INT, etc.
-        int sizeInBytes(int type, ExceptionCode& ec);
-
-        void activeTexture(unsigned long texture);
-        void attachShader(CanvasProgram*, CanvasShader*);
-        void bindAttribLocation(CanvasProgram*, unsigned long index, const String& name);
-        void bindBuffer(unsigned long target, CanvasBuffer*);
-        void bindFramebuffer(unsigned long target, CanvasFramebuffer*);
-        void bindRenderbuffer(unsigned long target, CanvasRenderbuffer*);
-        void bindTexture(unsigned long target, CanvasTexture*);
-        void blendColor(double red, double green, double blue, double alpha);
-        void blendEquation(unsigned long mode);
-        void blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha);
-        void blendFunc(unsigned long sfactor, unsigned long dfactor);
-        void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
-
-        void bufferData(unsigned long target, int size, unsigned long usage);
-        void bufferData(unsigned long target, CanvasArray* data, unsigned long usage);
-        void bufferSubData(unsigned long target, long offset, CanvasArray* data);
-
-        unsigned long checkFramebufferStatus(unsigned long target);
-        void clear(unsigned long mask);
-        void clearColor(double red, double green, double blue, double alpha);
-        void clearDepth(double);
-        void clearStencil(long);
-        void colorMask(bool red, bool green, bool blue, bool alpha);
-        void compileShader(CanvasShader*);
-        
-        //void compressedTexImage2D(unsigned long target, long level, unsigned long internalformat, unsigned long width, unsigned long height, long border, unsigned long imageSize, const void* data);
-        //void compressedTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, unsigned long width, unsigned long height, unsigned long format, unsigned long imageSize, const void* data);
-        
-        void copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border);
-        void copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height);
-
-        PassRefPtr<CanvasBuffer> createBuffer();
-        PassRefPtr<CanvasFramebuffer> createFramebuffer();
-        PassRefPtr<CanvasProgram> createProgram();
-        PassRefPtr<CanvasRenderbuffer> createRenderbuffer();
-        PassRefPtr<CanvasShader> createShader(unsigned long type);
-        PassRefPtr<CanvasTexture> createTexture();
-
-        void cullFace(unsigned long mode);
-
-        void deleteBuffer(CanvasBuffer*);
-        void deleteFramebuffer(CanvasFramebuffer*);
-        void deleteProgram(CanvasProgram*);
-        void deleteRenderbuffer(CanvasRenderbuffer*);
-        void deleteShader(CanvasShader*);
-        void deleteTexture(CanvasTexture*);
-        
-        void depthFunc(unsigned long);
-        void depthMask(bool);
-        void depthRange(double zNear, double zFar);
-        void detachShader(CanvasProgram*, CanvasShader*);
-        void disable(unsigned long cap);
-        void disableVertexAttribArray(unsigned long index);
-        void drawArrays(unsigned long mode, long first, long count);
-        void drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset);
-
-        void enable(unsigned long cap);
-        void enableVertexAttribArray(unsigned long index);
-        void finish();
-        void flush();
-        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer*);
-        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture*, long level);
-        void frontFace(unsigned long mode);
-        void generateMipmap(unsigned long target);
-
-        PassRefPtr<CanvasActiveInfo> getActiveAttrib(CanvasProgram*, unsigned long index, ExceptionCode&);
-        PassRefPtr<CanvasActiveInfo> getActiveUniform(CanvasProgram*, unsigned long index, ExceptionCode&);
-
-        int  getAttribLocation(CanvasProgram*, const String& name);
-
-        bool getBoolean(unsigned long pname);
-        PassRefPtr<CanvasUnsignedByteArray> getBooleanv(unsigned long pname);
-        int getBufferParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getBufferParameteriv(unsigned long target, unsigned long pname);
-
-        unsigned long getError();
-
-        float getFloat(unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getFloatv(unsigned long pname);
-        int getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname);
-        int getInteger(unsigned long pname);
-        PassRefPtr<CanvasIntArray> getIntegerv(unsigned long pname);
-        int getProgrami(CanvasProgram*, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getProgramiv(CanvasProgram*, unsigned long pname);
-        String getProgramInfoLog(CanvasProgram*);
-        int getRenderbufferParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getRenderbufferParameteriv(unsigned long target, unsigned long pname);
-        int getShaderi(CanvasShader*, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getShaderiv(CanvasShader*, unsigned long pname);
-
-        String getShaderInfoLog(CanvasShader*);
-
-        // TBD
-        // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
-
-        String getShaderSource(CanvasShader*);
-        String getString(unsigned long name);
-
-        float getTexParameterf(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getTexParameterfv(unsigned long target, unsigned long pname);
-        int getTexParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getTexParameteriv(unsigned long target, unsigned long pname);
-
-        float getUniformf(CanvasProgram* program, long location);
-        PassRefPtr<CanvasFloatArray> getUniformfv(CanvasProgram* program, long location);
-        long getUniformi(CanvasProgram* program, long location);
-        PassRefPtr<CanvasIntArray> getUniformiv(CanvasProgram* program, long location);
-
-        long getUniformLocation(CanvasProgram*, const String& name);
-
-        float getVertexAttribf(unsigned long index, unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getVertexAttribfv(unsigned long index, unsigned long pname);
-        long getVertexAttribi(unsigned long index, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getVertexAttribiv(unsigned long index, unsigned long pname);
-
-        long getVertexAttribOffset(unsigned long index, unsigned long pname);
-
-        void hint(unsigned long target, unsigned long mode);
-        bool isBuffer(CanvasBuffer*);
-        bool isEnabled(unsigned long cap);
-        bool isFramebuffer(CanvasFramebuffer*);
-        bool isProgram(CanvasProgram*);
-        bool isRenderbuffer(CanvasRenderbuffer*);
-        bool isShader(CanvasShader*);
-        bool isTexture(CanvasTexture*);
-        void lineWidth(double);
-        void linkProgram(CanvasProgram*);
-        void pixelStorei(unsigned long pname, long param);
-        void polygonOffset(double factor, double units);
-        
-        PassRefPtr<CanvasArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
-        
-        void releaseShaderCompiler();
-        void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
-        void sampleCoverage(double value, bool invert);
-        void scissor(long x, long y, unsigned long width, unsigned long height);
-        void shaderSource(CanvasShader*, const String&);
-        void stencilFunc(unsigned long func, long ref, unsigned long mask);
-        void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
-        void stencilMask(unsigned long);
-        void stencilMaskSeparate(unsigned long face, unsigned long mask);
-        void stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass);
-        void stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass);
-
-        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
-                        unsigned width, unsigned height, unsigned border,
-                        unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode&);
-        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
-                        unsigned width, unsigned height, unsigned border,
-                        unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
-        void texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
-                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
-        void texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
-                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
-        void texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
-                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
-
-        void texParameterf(unsigned target, unsigned pname, float param);
-        void texParameteri(unsigned target, unsigned pname, int param);
-
-        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                           unsigned width, unsigned height,
-                           unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode&);
-        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                           unsigned width, unsigned height,
-                           unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
-        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                           unsigned width, unsigned height, HTMLImageElement* image,
-                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
-        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                           unsigned width, unsigned height, HTMLCanvasElement* canvas,
-                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
-        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                           unsigned width, unsigned height, HTMLVideoElement* video,
-                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
-
-        void uniform1f(long location, float x);
-        void uniform1fv(long location, CanvasFloatArray* v);
-        void uniform1fv(long location, float* v, int size);
-        void uniform1i(long location, int x);
-        void uniform1iv(long location, CanvasIntArray* v);
-        void uniform1iv(long location, int* v, int size);
-        void uniform2f(long location, float x, float y);
-        void uniform2fv(long location, CanvasFloatArray* v);
-        void uniform2fv(long location, float* v, int size);
-        void uniform2i(long location, int x, int y);
-        void uniform2iv(long location, CanvasIntArray* v);
-        void uniform2iv(long location, int* v, int size);
-        void uniform3f(long location, float x, float y, float z);
-        void uniform3fv(long location, CanvasFloatArray* v);
-        void uniform3fv(long location, float* v, int size);
-        void uniform3i(long location, int x, int y, int z);
-        void uniform3iv(long location, CanvasIntArray* v);
-        void uniform3iv(long location, int* v, int size);
-        void uniform4f(long location, float x, float y, float z, float w);
-        void uniform4fv(long location, CanvasFloatArray* v);
-        void uniform4fv(long location, float* v, int size);
-        void uniform4i(long location, int x, int y, int z, int w);
-        void uniform4iv(long location, CanvasIntArray* v);
-        void uniform4iv(long location, int* v, int size);
-        void uniformMatrix2fv(long location, bool transpose, CanvasFloatArray* value);
-        void uniformMatrix2fv(long location, bool transpose, float* value, int size);
-        void uniformMatrix3fv(long location, bool transpose, CanvasFloatArray* value);
-        void uniformMatrix3fv(long location, bool transpose, float* value, int size);
-        void uniformMatrix4fv(long location, bool transpose, CanvasFloatArray* value);
-        void uniformMatrix4fv(long location, bool transpose, float* value, int size);
-
-        void useProgram(CanvasProgram*);
-        void validateProgram(CanvasProgram*);
-
-        void vertexAttrib1f(unsigned long indx, float x);
-        void vertexAttrib1fv(unsigned long indx, CanvasFloatArray* values);
-        void vertexAttrib1fv(unsigned long indx, float* values, int size);
-        void vertexAttrib2f(unsigned long indx, float x, float y);
-        void vertexAttrib2fv(unsigned long indx, CanvasFloatArray* values);
-        void vertexAttrib2fv(unsigned long indx, float* values, int size);
-        void vertexAttrib3f(unsigned long indx, float x, float y, float z);
-        void vertexAttrib3fv(unsigned long indx, CanvasFloatArray* values);
-        void vertexAttrib3fv(unsigned long indx, float* values, int size);
-        void vertexAttrib4f(unsigned long indx, float x, float y, float z, float w);
-        void vertexAttrib4fv(unsigned long indx, CanvasFloatArray* values);
-        void vertexAttrib4fv(unsigned long indx, float* values, int size);
-        void vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized,
-                                 unsigned long stride, unsigned long offset);
-
-        void viewport(long x, long y, unsigned long width, unsigned long height);
-
-        GraphicsContext3D* graphicsContext3D() const { return m_context.get(); }
-    
-        void reshape(int width, int height);
-
-        // Helpers for notification about paint events.
-        void beginPaint();
-        void endPaint();
-        
-        void removeObject(CanvasObject*);
-        
-    private:
-        friend class CanvasObject;
-
-        CanvasRenderingContext3D(HTMLCanvasElement*, PassOwnPtr<GraphicsContext3D>);
-
-        void addObject(CanvasObject*);
-        void detachAndRemoveAllObjects();
-
-        void markContextChanged();
-        void cleanupAfterGraphicsCall(bool changed)
-        {
-            m_context->checkError();
-            if (changed)
-                markContextChanged();
-        }
-        
-        OwnPtr<GraphicsContext3D> m_context;
-        bool m_needsUpdate;
-        bool m_markedCanvasDirty;
-        // FIXME: I think this is broken -- it does not increment any
-        // reference counts, so may refer to destroyed objects.
-        HashSet<CanvasObject*> m_canvasObjects;
-    };
-
-} // namespace WebCore
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.idl
deleted file mode 100644
index 7474c3a755..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.idl
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-module html {
-    interface [Conditional=3D_CANVAS] CanvasShader {
-    };
-}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.cpp
deleted file mode 100644
index d0cf135e2b..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.cpp
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-#include "CanvasShortArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasShortArray> CanvasShortArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(short));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasShortArray> CanvasShortArray::create(short* array, unsigned length)
-    {
-        RefPtr<CanvasShortArray> a = CanvasShortArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasShortArray> CanvasShortArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
-                                                          int offset,
-                                                          unsigned length)
-    {
-        // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(short)) != 0)
-            return NULL;
-
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(short))) > buffer->byteLength())
-                return NULL;
-        }
-
-        return adoptRef(new CanvasShortArray(buffer, offset, length));
-    }
-    
-    CanvasShortArray::CanvasShortArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasShortArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasShortArray::sizeInBytes() const {
-        return length() * sizeof(short);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.h
deleted file mode 100644
index 1eeef0c39a..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasShortArray_h
-#define CanvasShortArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasShortArray : public CanvasArray {
-    public:
-        virtual bool isShortArray() const { return true; }
-
-        static PassRefPtr<CanvasShortArray> create(unsigned length);
-        static PassRefPtr<CanvasShortArray> create(short* array, unsigned length);
-        static PassRefPtr<CanvasShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        short* data() { return static_cast<short*>(baseAddress()); }
-
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<short>::min())
-                value = std::numeric_limits<short>::min();
-            else if (value > std::numeric_limits<short>::max())
-                value = std::numeric_limits<short>::max();
-            short* storage = static_cast<short*>(m_baseAddress);
-            storage[index] = static_cast<short>(value);
-        }
-        
-        bool get(unsigned index, short& result) const
-        {
-            if (index >= m_size)
-                return false;
-            result = item(index);
-            return true;
-        }
-        
-        short item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            short* storage = static_cast<short*>(m_baseAddress);
-            return storage[index];
-        }
-
-    private:
-        CanvasShortArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasShortArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasStyle.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasStyle.cpp
index 946cac7544..3515e03da8 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasStyle.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasStyle.cpp
@@ -114,33 +114,33 @@ void CanvasStyle::applyStrokeColor(GraphicsContext* context)
         case ColorString: {
             Color c = Color(m_color);
             if (c.isValid()) {
-                context->setStrokeColor(c.rgb());
+                context->setStrokeColor(c.rgb(), DeviceColorSpace);
                 break;
             }
             RGBA32 color = 0; // default is transparent black
             if (CSSParser::parseColor(color, m_color))
-                context->setStrokeColor(color);
+                context->setStrokeColor(color, DeviceColorSpace);
             break;
         }
         case ColorStringWithAlpha: {
             Color c = Color(m_color);
             if (c.isValid()) {
-                context->setStrokeColor(colorWithOverrideAlpha(c.rgb(), m_alpha));
+                context->setStrokeColor(colorWithOverrideAlpha(c.rgb(), m_alpha), DeviceColorSpace);
                 break;
             }
             RGBA32 color = 0; // default is transparent black
             if (CSSParser::parseColor(color, m_color))
-                context->setStrokeColor(colorWithOverrideAlpha(color, m_alpha));
+                context->setStrokeColor(colorWithOverrideAlpha(color, m_alpha), DeviceColorSpace);
             break;
         }
         case GrayLevel:
             // We're only supporting 255 levels of gray here.  Since this isn't
             // even part of HTML5, I don't expect anyone will care.  If they do
             // we'll make a fancier Color abstraction.
-            context->setStrokeColor(Color(m_grayLevel, m_grayLevel, m_grayLevel, m_alpha));
+            context->setStrokeColor(Color(m_grayLevel, m_grayLevel, m_grayLevel, m_alpha), DeviceColorSpace);
             break;
         case RGBA:
-            context->setStrokeColor(Color(m_red, m_green, m_blue, m_alpha));
+            context->setStrokeColor(Color(m_red, m_green, m_blue, m_alpha), DeviceColorSpace);
             break;
         case CMYKA: {
             // FIXME: Do this through platform-independent GraphicsContext API.
@@ -154,7 +154,7 @@ void CanvasStyle::applyStrokeColor(GraphicsContext* context)
             currentPen.setColor(clr);
             context->platformContext()->setPen(currentPen);
 #else
-            context->setStrokeColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha));
+            context->setStrokeColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha), DeviceColorSpace);
 #endif
             break;
         }
@@ -173,35 +173,25 @@ void CanvasStyle::applyFillColor(GraphicsContext* context)
         return;
     switch (m_type) {
         case ColorString: {
-            Color c = Color(m_color);
-            if (c.isValid()) {
-                context->setFillColor(c.rgb());
-                break;
-            }
             RGBA32 rgba = 0; // default is transparent black
             if (CSSParser::parseColor(rgba, m_color))
-                context->setFillColor(rgba);
+                context->setFillColor(rgba, DeviceColorSpace);
             break;
         }
         case ColorStringWithAlpha: {
-            Color c = Color(m_color);
-            if (c.isValid()) {
-                context->setFillColor(colorWithOverrideAlpha(c.rgb(), m_alpha));
-                break;
-            }
             RGBA32 color = 0; // default is transparent black
             if (CSSParser::parseColor(color, m_color))
-                context->setFillColor(colorWithOverrideAlpha(color, m_alpha));
+                context->setFillColor(colorWithOverrideAlpha(color, m_alpha), DeviceColorSpace);
             break;
         }
         case GrayLevel:
             // We're only supporting 255 levels of gray here.  Since this isn't
             // even part of HTML5, I don't expect anyone will care.  If they do
             // we'll make a fancier Color abstraction.
-            context->setFillColor(Color(m_grayLevel, m_grayLevel, m_grayLevel, m_alpha));
+            context->setFillColor(Color(m_grayLevel, m_grayLevel, m_grayLevel, m_alpha), DeviceColorSpace);
             break;
         case RGBA:
-            context->setFillColor(Color(m_red, m_green, m_blue, m_alpha));
+            context->setFillColor(Color(m_red, m_green, m_blue, m_alpha), DeviceColorSpace);
             break;
         case CMYKA: {
             // FIXME: Do this through platform-independent GraphicsContext API.
@@ -215,7 +205,7 @@ void CanvasStyle::applyFillColor(GraphicsContext* context)
             currentBrush.setColor(clr);
             context->platformContext()->setBrush(currentBrush);
 #else
-            context->setFillColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha));
+            context->setFillColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha), DeviceColorSpace);
 #endif
             break;
         }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.idl
deleted file mode 100644
index 77eedd777a..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.idl
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-module html {
-    interface [Conditional=3D_CANVAS] CanvasTexture {
-    };
-}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
deleted file mode 100644
index a75066c6c2..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-#include "CanvasUnsignedByteArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned char));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(unsigned char* array, unsigned length)
-    {
-        RefPtr<CanvasUnsignedByteArray> a = CanvasUnsignedByteArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
-                                                                        int offset,
-                                                                        unsigned length)
-    {
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(unsigned char))) > buffer->byteLength())
-                return NULL;
-        }
-
-        return adoptRef(new CanvasUnsignedByteArray(buffer, offset, length));
-    }
-    
-    CanvasUnsignedByteArray::CanvasUnsignedByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasUnsignedByteArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasUnsignedByteArray::sizeInBytes() const {
-        return length() * sizeof(unsigned char);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.h
deleted file mode 100644
index d8864e04bd..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasUnsignedByteArray_h
-#define CanvasUnsignedByteArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasUnsignedByteArray : public CanvasArray {
-    public:
-        virtual bool isUnsignedByteArray() const { return true; }
-
-        static PassRefPtr<CanvasUnsignedByteArray> create(unsigned length);
-        static PassRefPtr<CanvasUnsignedByteArray> create(unsigned char* array, unsigned length);
-        static PassRefPtr<CanvasUnsignedByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        unsigned char* data() { return static_cast<unsigned char*>(baseAddress()); }
-        
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<unsigned char>::min())
-                value = std::numeric_limits<unsigned char>::min();
-            else if (value > std::numeric_limits<unsigned char>::max())
-                value = std::numeric_limits<unsigned char>::max();
-            unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
-            storage[index] = static_cast<unsigned char>(value);
-        }
-        
-        bool get(unsigned index, unsigned char& result) const
-        {
-            if (index >= m_size)
-                return false;
-            result = item(index);
-            return true;
-        }
-        
-        unsigned char item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
-            return storage[index];
-        }
-
-    private:
-        CanvasUnsignedByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasUnsignedByteArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
deleted file mode 100644
index bd26343f33..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-#include "CanvasUnsignedIntArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned int));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(unsigned int* array, unsigned length)
-    {
-        RefPtr<CanvasUnsignedIntArray> a = CanvasUnsignedIntArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
-                                                                      int offset,
-                                                                      unsigned length)
-    {
-        // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(unsigned int)) != 0) {
-            return NULL;
-        }
-
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(unsigned int))) > buffer->byteLength())
-                return NULL;
-        }
-
-        return adoptRef(new CanvasUnsignedIntArray(buffer, offset, length));
-    }
-    
-    CanvasUnsignedIntArray::CanvasUnsignedIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasUnsignedIntArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasUnsignedIntArray::sizeInBytes() const {
-        return length() * sizeof(unsigned int);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.h
deleted file mode 100644
index 10b8edf154..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasUnsignedIntArray_h
-#define CanvasUnsignedIntArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasUnsignedIntArray : public CanvasArray {
-    public:
-        virtual bool isUnsignedIntArray() const { return true; }
-
-        static PassRefPtr<CanvasUnsignedIntArray> create(unsigned length);
-        static PassRefPtr<CanvasUnsignedIntArray> create(unsigned int* array, unsigned length);
-        static PassRefPtr<CanvasUnsignedIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        unsigned int* data() { return static_cast<unsigned int*>(baseAddress()); }
-        
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<unsigned int>::min())
-                value = std::numeric_limits<unsigned int>::min();
-            else if (value > std::numeric_limits<unsigned int>::max())
-                value = std::numeric_limits<unsigned int>::max();
-            unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
-            storage[index] = static_cast<unsigned int>(value);
-        }
-        
-        bool get(unsigned index, unsigned int& result) const
-        {
-            if (index >= m_size)
-                return false;
-            result = item(index);
-            return true;
-        }
-        
-        unsigned int item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
-            return storage[index];
-        }
-
-    private:
-        CanvasUnsignedIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasUnsignedIntArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
deleted file mode 100644
index 45d827b78c..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-#include "CanvasUnsignedShortArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned short));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(unsigned short* array, unsigned length)
-    {
-        RefPtr<CanvasUnsignedShortArray> a = CanvasUnsignedShortArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
-                                                                          int offset,
-                                                                          unsigned length)
-    {
-        // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(unsigned short)) != 0) {
-            return NULL;
-        }
-
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(unsigned short))) > buffer->byteLength()) 
-                return NULL;
-        }
-
-        return adoptRef(new CanvasUnsignedShortArray(buffer, offset, length));
-    }
-    
-    CanvasUnsignedShortArray::CanvasUnsignedShortArray(PassRefPtr<CanvasArrayBuffer> buffer,
-                                         int offset,
-                                         unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasUnsignedShortArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasUnsignedShortArray::sizeInBytes() const {
-        return length() * sizeof(unsigned short);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.h
deleted file mode 100644
index 9e27566bb5..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.h
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasUnsignedShortArray_h
-#define CanvasUnsignedShortArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasUnsignedShortArray : public CanvasArray {
-    public:
-        virtual bool isUnsignedShortArray() const { return true; }
-
-        static PassRefPtr<CanvasUnsignedShortArray> create(unsigned length);
-        static PassRefPtr<CanvasUnsignedShortArray> create(unsigned short* array, unsigned length);
-        static PassRefPtr<CanvasUnsignedShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        unsigned short* data() { return static_cast<unsigned short*>(baseAddress()); }
-        
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<unsigned short>::min())
-                value = std::numeric_limits<unsigned short>::min();
-            else if (value > std::numeric_limits<unsigned short>::max())
-                value = std::numeric_limits<unsigned short>::max();
-            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
-            storage[index] = static_cast<unsigned short>(value);
-        }
-        
-        bool get(unsigned index, unsigned short& result) const
-        {
-            if (index >= m_size)
-                return false;
-            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
-            result = storage[index];
-            return true;
-        }
-        
-        unsigned short item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
-            return storage[index];
-        }
-
-    private:
-        CanvasUnsignedShortArray(PassRefPtr<CanvasArrayBuffer> buffer,int offset,unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasUnsignedShortArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.idl
deleted file mode 100644
index 99fc6a2de6..0000000000
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.idl
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-module html {
-    interface [
-        Conditional=3D_CANVAS,
-        HasNumericIndexGetter,
-        HasCustomIndexSetter,
-        GenerateNativeConverter,
-        GenerateCustomConstructor,
-        CustomToJS
-    ] CanvasUnsignedShortArray : CanvasArray {
-    };
-}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLActiveInfo.h
index b04b0d0ca3..4650ea1fe9 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLActiveInfo.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasActiveInfo_h
-#define CanvasActiveInfo_h
+#ifndef WebGLActiveInfo_h
+#define WebGLActiveInfo_h
 
 #include "PlatformString.h"
 #include <wtf/PassRefPtr.h>
@@ -32,18 +32,18 @@
 
 namespace WebCore {
 
-class CanvasActiveInfo : public RefCounted<CanvasActiveInfo> {
+class WebGLActiveInfo : public RefCounted<WebGLActiveInfo> {
 public:
-    static PassRefPtr<CanvasActiveInfo> create(const String& name, unsigned type, int size)
+    static PassRefPtr<WebGLActiveInfo> create(const String& name, unsigned type, int size)
     {
-        return adoptRef(new CanvasActiveInfo(name, type, size));
+        return adoptRef(new WebGLActiveInfo(name, type, size));
     }
     String name() const { return m_name; }
     unsigned type() const { return m_type; }
     int size() const { return m_size; }
 
 private:
-    CanvasActiveInfo(const String& name, unsigned type, int size)
+    WebGLActiveInfo(const String& name, unsigned type, int size)
         : m_name(name)
         , m_type(type)
         , m_size(size)
@@ -59,4 +59,4 @@ private:
 
 }
 
-#endif // CanvasActiveInfo_h
+#endif // WebGLActiveInfo_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLActiveInfo.idl
index 6ceae29111..17bb4d694b 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLActiveInfo.idl
@@ -27,7 +27,8 @@ module html {
 
     interface [
         Conditional=3D_CANVAS,
-    ] CanvasActiveInfo {
+        OmitConstructor
+    ] WebGLActiveInfo {
         readonly attribute int size;
         readonly attribute unsigned int type;
         readonly attribute DOMString name;
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLArray.cpp
index 6b5688ab27..6f48467f1f 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLArray.cpp
@@ -27,26 +27,54 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArray.h"
-#include "CanvasArrayBuffer.h"
+#include "WebGLArray.h"
+#include "WebGLArrayBuffer.h"
 
 namespace WebCore {
-    CanvasArray::CanvasArray(PassRefPtr<CanvasArrayBuffer> buffer,
-                             unsigned offset)
-        : m_offset(offset)
+
+WebGLArray::WebGLArray(PassRefPtr<WebGLArrayBuffer> buffer,
+                       unsigned byteOffset)
+        : m_byteOffset(byteOffset)
         , m_buffer(buffer)
-    {
-        m_baseAddress = m_buffer ? (static_cast<char*>(m_buffer->data()) + m_offset) : 0;
-    }
+{
+    m_baseAddress = m_buffer ? (static_cast<char*>(m_buffer->data()) + m_byteOffset) : 0;
+}
 
-    CanvasArray::~CanvasArray()
-    {
-    }
+WebGLArray::~WebGLArray()
+{
+}
 
-    unsigned CanvasArray::alignedSizeInBytes() const {
-        // Assume we only need to round up to 4-byte boundaries for alignment.
-        return ((sizeInBytes() + 3) / 4) * 4;
+void WebGLArray::setImpl(WebGLArray* array, unsigned byteOffset, ExceptionCode& ec)
+{
+    if (byteOffset > byteLength() ||
+        byteOffset + array->byteLength() > byteLength() ||
+        byteOffset + array->byteLength() < byteOffset) {
+        // Out of range offset or overflow
+        ec = INDEX_SIZE_ERR;
+        return;
     }
+
+    char* base = static_cast<char*>(baseAddress());
+    memcpy(base + byteOffset, array->baseAddress(), array->byteLength());
+}
+
+void WebGLArray::calculateOffsetAndLength(int start, int end, unsigned arraySize,
+                                          unsigned* offset, unsigned* length)
+{
+    if (start < 0)
+        start += arraySize;
+    if (start < 0)
+        start = 0;
+    if (end < 0)
+        end += arraySize;
+    if (end < 0)
+        end = 0;
+    if (end < start)
+        end = start;
+    *offset = static_cast<unsigned>(start);
+    *length = static_cast<unsigned>(end - start);
+}
+
 }
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLArray.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLArray.h
new file mode 100644
index 0000000000..d3becf696a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLArray.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLArray_h
+#define WebGLArray_h
+
+#include <algorithm>
+#include "ExceptionCode.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include "WebGLArrayBuffer.h"
+
+namespace WebCore {
+
+class WebGLArray : public RefCounted<WebGLArray> {
+  public:
+    virtual bool isByteArray() const { return false; }
+    virtual bool isUnsignedByteArray() const { return false; }
+    virtual bool isShortArray() const { return false; }
+    virtual bool isUnsignedShortArray() const { return false; }
+    virtual bool isIntArray() const { return false; }
+    virtual bool isUnsignedIntArray() const { return false; }
+    virtual bool isFloatArray() const { return false; }
+
+    PassRefPtr<WebGLArrayBuffer> buffer() {
+        return m_buffer;
+    }
+
+    void* baseAddress() {
+        return m_baseAddress;
+    }
+
+    unsigned byteOffset() const {
+        return m_byteOffset;
+    }
+
+    virtual unsigned length() const = 0;
+    virtual unsigned byteLength() const = 0;
+    virtual PassRefPtr<WebGLArray> slice(int start, int end) = 0;
+
+    virtual ~WebGLArray();
+
+  protected:
+    WebGLArray(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset);
+
+    void setImpl(WebGLArray* array, unsigned byteOffset, ExceptionCode& ec);
+
+    void calculateOffsetAndLength(int start, int end, unsigned arraySize,
+                                  unsigned* offset, unsigned* length);
+
+    // Helper to verify that a given sub-range of an ArrayBuffer is
+    // within range.
+    template <typename T>
+    static bool verifySubRange(PassRefPtr<WebGLArrayBuffer> buffer,
+                               unsigned byteOffset,
+                               unsigned numElements)
+    {
+        if (!buffer)
+            return false;
+        if (sizeof(T) > 1 && byteOffset % sizeof(T))
+            return false;
+        if (byteOffset > buffer->byteLength())
+            return false;
+        unsigned remainingElements = (buffer->byteLength() - byteOffset) / sizeof(T);
+        if (numElements > remainingElements)
+            return false;
+        return true;
+    }
+
+    template <typename T>
+    static void clampOffsetAndNumElements(PassRefPtr<WebGLArrayBuffer> buffer,
+                                          unsigned *byteOffset,
+                                          unsigned *numElements)
+    {
+        *byteOffset = std::min(buffer->byteLength(), *byteOffset);
+        unsigned remainingElements = (buffer->byteLength() - *byteOffset) / sizeof(T);
+        *numElements = std::min(remainingElements, *numElements);
+    }
+
+    // This is the address of the WebGLArrayBuffer's storage, plus the byte offset.
+    void* m_baseAddress;
+
+    unsigned m_byteOffset;
+
+  private:
+    RefPtr<WebGLArrayBuffer> m_buffer;
+};
+
+} // namespace WebCore
+
+#endif // WebGLArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLArray.idl
index ccf49ad33b..2cc00d0917 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLArray.idl
@@ -24,13 +24,12 @@
  */
 
 module html {
-    interface [
-        Conditional=3D_CANVAS,
-        HasNumericIndexGetter,
-        HasCustomIndexSetter,
-        GenerateNativeConverter,
-        GenerateCustomConstructor,
-        CustomToJS
-    ] CanvasByteArray : CanvasArray {
+    interface [Conditional=3D_CANVAS, CustomToJS, OmitConstructor] WebGLArray {
+        readonly attribute WebGLArrayBuffer buffer;
+        readonly attribute unsigned long byteOffset;
+        readonly attribute unsigned long byteLength;
+        readonly attribute unsigned long length;
+
+        [Custom] WebGLArray slice(in long start, in long end);
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLArrayBuffer.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLArrayBuffer.cpp
new file mode 100644
index 0000000000..7d3cd33f16
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLArrayBuffer.cpp
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+PassRefPtr<WebGLArrayBuffer> WebGLArrayBuffer::create(unsigned numElements, unsigned elementByteSize)
+{
+    void* data = tryAllocate(numElements, elementByteSize);
+    if (!data)
+        return 0;
+    return adoptRef(new WebGLArrayBuffer(data, numElements * elementByteSize));
+}
+
+PassRefPtr<WebGLArrayBuffer> WebGLArrayBuffer::create(WebGLArrayBuffer* other)
+{
+    void* data = tryAllocate(other->byteLength(), 1);
+    if (!data)
+        return 0;
+    RefPtr<WebGLArrayBuffer> buffer = adoptRef(new WebGLArrayBuffer(data, other->byteLength()));
+    memcpy(buffer->data(), other->data(), other->byteLength());
+    return buffer.release();
+}
+
+WebGLArrayBuffer::WebGLArrayBuffer(void* data, unsigned sizeInBytes)
+    : m_sizeInBytes(sizeInBytes)
+    , m_data(data) {
+}
+
+void* WebGLArrayBuffer::data() {
+    return m_data;
+}
+
+const void* WebGLArrayBuffer::data() const {
+    return m_data;
+}
+
+unsigned WebGLArrayBuffer::byteLength() const {
+    return m_sizeInBytes;
+}
+
+WebGLArrayBuffer::~WebGLArrayBuffer() {
+    WTF::fastFree(m_data);
+}
+
+void* WebGLArrayBuffer::tryAllocate(unsigned numElements, unsigned elementByteSize) {
+    void* result;
+    // Do not allow 32-bit overflow of the total size
+    if (numElements) {
+        unsigned totalSize = numElements * elementByteSize;
+        if (totalSize / numElements != elementByteSize)
+            return 0;
+    }
+    if (WTF::tryFastCalloc(numElements, elementByteSize).getValue(result))
+        return result;
+    return 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLArrayBuffer.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLArrayBuffer.h
new file mode 100644
index 0000000000..59e0ddd6b6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLArrayBuffer.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLArrayBuffer_h
+#define WebGLArrayBuffer_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLArrayBuffer : public RefCounted<WebGLArrayBuffer> {
+  public:
+    static PassRefPtr<WebGLArrayBuffer> create(unsigned numElements, unsigned elementByteSize);
+    static PassRefPtr<WebGLArrayBuffer> create(WebGLArrayBuffer*);
+
+    void* data();
+    const void* data() const;
+    unsigned byteLength() const;
+
+    ~WebGLArrayBuffer();
+
+  private:
+    WebGLArrayBuffer(void* data, unsigned sizeInBytes);
+    WebGLArrayBuffer(unsigned numElements, unsigned elementByteSize);
+    static void* tryAllocate(unsigned numElements, unsigned elementByteSize);
+    unsigned m_sizeInBytes;
+    void* m_data;
+};
+
+} // namespace WebCore
+
+#endif // WebGLArrayBuffer_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArrayBuffer.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLArrayBuffer.idl
index 5dc0f7f63a..33252102f3 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArrayBuffer.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLArrayBuffer.idl
@@ -24,7 +24,7 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasArrayBuffer {
+    interface [Conditional=3D_CANVAS, CustomConstructor] WebGLArrayBuffer {
         readonly attribute int byteLength;
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLBuffer.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLBuffer.cpp
new file mode 100644
index 0000000000..958bedc96d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLBuffer.cpp
@@ -0,0 +1,166 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLBuffer.h"
+#include "WebGLRenderingContext.h"
+
+namespace WebCore {
+    
+PassRefPtr<WebGLBuffer> WebGLBuffer::create(WebGLRenderingContext* ctx)
+{
+    return adoptRef(new WebGLBuffer(ctx));
+}
+
+PassRefPtr<WebGLBuffer> WebGLBuffer::create(WebGLRenderingContext* ctx, Platform3DObject obj)
+{
+    return adoptRef(new WebGLBuffer(ctx, obj));
+}
+
+WebGLBuffer::WebGLBuffer(WebGLRenderingContext* ctx)
+    : CanvasObject(ctx)
+    , m_elementArrayBufferByteLength(0)
+    , m_arrayBufferByteLength(0)
+    , m_nextAvailableCacheEntry(0)
+{
+    setObject(context()->graphicsContext3D()->createBuffer());
+    clearCachedMaxIndices();
+}
+
+WebGLBuffer::WebGLBuffer(WebGLRenderingContext* ctx, Platform3DObject obj)
+    : CanvasObject(ctx)
+    , m_nextAvailableCacheEntry(0)
+{
+    setObject(obj, false);
+    clearCachedMaxIndices();
+}
+
+void WebGLBuffer::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteBuffer(object);
+}
+
+bool WebGLBuffer::associateBufferData(unsigned long target, int size)
+{
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+        m_elementArrayBufferByteLength = size;
+        return true;
+    }
+    
+    if (target == GraphicsContext3D::ARRAY_BUFFER) {
+        m_arrayBufferByteLength = size;
+        return true;
+    }
+
+    return false;
+}
+
+bool WebGLBuffer::associateBufferData(unsigned long target, WebGLArray* array)
+{
+    if (!array)
+        return false;
+        
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+        clearCachedMaxIndices();
+        m_elementArrayBufferByteLength = array->byteLength();
+        // We must always clone the incoming data because client-side
+        // modifications without calling bufferData or bufferSubData
+        // must never be able to change the validation results.
+        m_elementArrayBuffer = WebGLArrayBuffer::create(array->buffer().get());
+        return true;
+    }
+    
+    if (target == GraphicsContext3D::ARRAY_BUFFER) {
+        m_arrayBufferByteLength = array->byteLength();
+        return true;
+    }
+    
+    return false;
+}
+
+bool WebGLBuffer::associateBufferSubData(unsigned long target, long offset, WebGLArray* array)
+{
+    if (!array)
+        return false;
+        
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+        clearCachedMaxIndices();
+
+        // We need to protect against integer overflow with these tests
+        if (offset < 0)
+            return false;
+            
+        unsigned long uoffset = static_cast<unsigned long>(offset);
+        if (uoffset > m_elementArrayBufferByteLength || array->byteLength() > m_elementArrayBufferByteLength - uoffset)
+            return false;
+            
+        memcpy(static_cast<unsigned char*>(m_elementArrayBuffer->data()) + offset, array->baseAddress(), array->byteLength());
+        return true;
+    }
+    
+    if (target == GraphicsContext3D::ARRAY_BUFFER)
+        return array->byteLength() + offset <= m_arrayBufferByteLength;
+
+    return false;
+}
+
+unsigned WebGLBuffer::byteLength(unsigned long target) const
+{
+    return (target == GraphicsContext3D::ARRAY_BUFFER) ? m_arrayBufferByteLength : m_elementArrayBufferByteLength;
+}
+
+long WebGLBuffer::getCachedMaxIndex(unsigned long type)
+{
+    size_t numEntries = sizeof(m_maxIndexCache) / sizeof(MaxIndexCacheEntry);
+    for (size_t i = 0; i < numEntries; i++)
+        if (m_maxIndexCache[i].type == type)
+            return m_maxIndexCache[i].maxIndex;
+    return -1;
+}
+
+void WebGLBuffer::setCachedMaxIndex(unsigned long type, long value)
+{
+    int numEntries = sizeof(m_maxIndexCache) / sizeof(MaxIndexCacheEntry);
+    for (int i = 0; i < numEntries; i++)
+        if (m_maxIndexCache[i].type == type) {
+            m_maxIndexCache[i].maxIndex = value;
+            return;
+        }
+    m_maxIndexCache[m_nextAvailableCacheEntry].type = type;
+    m_maxIndexCache[m_nextAvailableCacheEntry].maxIndex = value;
+    m_nextAvailableCacheEntry = (m_nextAvailableCacheEntry + 1) % numEntries;
+}
+
+void WebGLBuffer::clearCachedMaxIndices()
+{
+    memset(m_maxIndexCache, 0, sizeof(m_maxIndexCache));
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLBuffer.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLBuffer.h
new file mode 100644
index 0000000000..bdb7052b0a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLBuffer.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLBuffer_h
+#define WebGLBuffer_h
+
+#include "CanvasObject.h"
+#include "WebGLArrayBuffer.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class WebGLBuffer : public CanvasObject {
+    public:
+        virtual ~WebGLBuffer() { deleteObject(); }
+        
+        static PassRefPtr<WebGLBuffer> create(WebGLRenderingContext*);
+        
+        // For querying previously created objects via e.g. getFramebufferAttachmentParameter
+        // FIXME: should consider canonicalizing these objects
+        static PassRefPtr<WebGLBuffer> create(WebGLRenderingContext*, Platform3DObject);
+
+        bool associateBufferData(unsigned long target, int size);
+        bool associateBufferData(unsigned long target, WebGLArray* array);
+        bool associateBufferSubData(unsigned long target, long offset, WebGLArray* array);
+        
+        unsigned byteLength(unsigned long target) const;
+        const WebGLArrayBuffer* elementArrayBuffer() const { return m_elementArrayBuffer.get(); }
+                        
+        // Gets the cached max index for the given type. Returns -1 if
+        // none has been set.
+        long getCachedMaxIndex(unsigned long type);
+        // Sets the cached max index for the given type.
+        void setCachedMaxIndex(unsigned long type, long value);
+
+    protected:
+        WebGLBuffer(WebGLRenderingContext*);
+        WebGLBuffer(WebGLRenderingContext*, Platform3DObject obj);
+        
+        virtual void _deleteObject(Platform3DObject o);
+    
+    private:
+        RefPtr<WebGLArrayBuffer> m_elementArrayBuffer;
+        unsigned m_elementArrayBufferByteLength;
+        unsigned m_arrayBufferByteLength;
+
+        // Optimization for index validation. For each type of index
+        // (i.e., UNSIGNED_SHORT), cache the maximum index in the
+        // entire buffer.
+        // 
+        // This is sufficient to eliminate a lot of work upon each
+        // draw call as long as all bound array buffers are at least
+        // that size.
+        struct MaxIndexCacheEntry {
+            unsigned long type;
+            long maxIndex;
+        };
+        // OpenGL ES 2.0 only has two valid index types (UNSIGNED_BYTE
+        // and UNSIGNED_SHORT), but might as well leave open the
+        // possibility of adding others.
+        MaxIndexCacheEntry m_maxIndexCache[4];
+        unsigned m_nextAvailableCacheEntry;
+
+        // Clears all of the cached max indices.
+        void clearCachedMaxIndices();
+    };
+    
+} // namespace WebCore
+
+#endif // WebGLBuffer_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasBuffer.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLBuffer.idl
index 9bca42b5a1..9dd97c0374 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasBuffer.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLBuffer.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasBuffer {
+    interface [Conditional=3D_CANVAS, OmitConstructor] WebGLBuffer {
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLByteArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLByteArray.cpp
new file mode 100644
index 0000000000..810be97740
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLByteArray.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLByteArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLByteArray> WebGLByteArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length, sizeof(signed char));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLByteArray> WebGLByteArray::create(signed char* array, unsigned length)
+{
+    RefPtr<WebGLByteArray> a = WebGLByteArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLByteArray> WebGLByteArray::create(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buf(buffer);
+    if (!verifySubRange<signed char>(buf, byteOffset, length))
+        return 0;
+
+    return adoptRef(new WebGLByteArray(buf, byteOffset, length));
+}
+
+WebGLByteArray::WebGLByteArray(PassRefPtr<WebGLArrayBuffer> buffer, unsigned offset, unsigned length)
+    : WebGLArray(buffer, offset)
+    , m_size(length)
+{
+}
+
+unsigned WebGLByteArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLByteArray::byteLength() const {
+    return m_size * sizeof(signed char);
+}
+
+PassRefPtr<WebGLArray> WebGLByteArray::slice(int start, int end)
+{
+    unsigned offset, length;
+    calculateOffsetAndLength(start, end, m_size, &offset, &length);
+    unsigned fullOffset = m_byteOffset + offset * sizeof(signed char);
+    clampOffsetAndNumElements<signed char>(buffer().get(), &fullOffset, &length);
+    return create(buffer(), fullOffset, length);
+}
+
+void WebGLByteArray::set(WebGLByteArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(signed char), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLByteArray.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLByteArray.h
new file mode 100644
index 0000000000..60d301c461
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLByteArray.h
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLByteArray_h
+#define WebGLByteArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLArrayBuffer;
+
+class WebGLByteArray : public WebGLArray {
+  public:
+    virtual bool isByteArray() const { return true; }
+
+    static PassRefPtr<WebGLByteArray> create(unsigned length);
+    static PassRefPtr<WebGLByteArray> create(signed char* array, unsigned length);
+    static PassRefPtr<WebGLByteArray> create(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length);
+
+    char* data() { return static_cast<char*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(int start, int end);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<signed char>::min())
+            value = std::numeric_limits<signed char>::min();
+        else if (value > std::numeric_limits<signed char>::max())
+            value = std::numeric_limits<signed char>::max();
+        signed char* storage = static_cast<signed char*>(m_baseAddress);
+        storage[index] = static_cast<signed char>(value);
+    }
+
+    bool get(unsigned index, signed char& result) const
+    {
+        if (index >= m_size)
+            return false;
+        signed char* storage = static_cast<signed char*>(m_baseAddress);
+        result = storage[index];
+        return true;
+    }
+
+    signed char get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    signed char item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        signed char* storage = static_cast<signed char*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLByteArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLByteArray(PassRefPtr<WebGLArrayBuffer> buffer,
+                   unsigned offset,
+                   unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLByteArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLByteArray.idl
index 2c81b87a6e..dbb3bb2ab1 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLByteArray.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,8 +30,13 @@ module html {
         HasNumericIndexGetter,
         HasCustomIndexSetter,
         GenerateNativeConverter,
-        GenerateCustomConstructor,
+        CustomConstructor,
         CustomToJS
-    ] CanvasIntArray : CanvasArray {
+    ] WebGLByteArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLByteArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLContextAttributes.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLContextAttributes.cpp
new file mode 100644
index 0000000000..a0725ca353
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLContextAttributes.cpp
@@ -0,0 +1,117 @@
+/*
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLContextAttributes.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLContextAttributes> WebGLContextAttributes::create()
+{
+    return adoptRef(new WebGLContextAttributes());
+}
+
+PassRefPtr<WebGLContextAttributes> WebGLContextAttributes::create(GraphicsContext3D::Attributes attributes)
+{
+    return adoptRef(new WebGLContextAttributes(attributes));
+}
+
+WebGLContextAttributes::WebGLContextAttributes()
+    : CanvasContextAttributes()
+{
+}
+
+WebGLContextAttributes::WebGLContextAttributes(GraphicsContext3D::Attributes attributes)
+    : CanvasContextAttributes()
+    , m_attrs(attributes)
+{
+}
+
+WebGLContextAttributes::~WebGLContextAttributes()
+{
+}
+
+bool WebGLContextAttributes::alpha() const
+{
+    return m_attrs.alpha;
+}
+
+void WebGLContextAttributes::setAlpha(bool alpha)
+{
+    m_attrs.alpha = alpha;
+}
+
+bool WebGLContextAttributes::depth() const
+{
+    return m_attrs.depth;
+}
+
+void WebGLContextAttributes::setDepth(bool depth)
+{
+    m_attrs.depth = depth;
+}
+
+bool WebGLContextAttributes::stencil() const
+{
+    return m_attrs.stencil;
+}
+
+void WebGLContextAttributes::setStencil(bool stencil)
+{
+    m_attrs.stencil = stencil;
+}
+
+bool WebGLContextAttributes::antialias() const
+{
+    return m_attrs.antialias;
+}
+
+void WebGLContextAttributes::setAntialias(bool antialias)
+{
+    m_attrs.antialias = antialias;
+}
+
+bool WebGLContextAttributes::premultipliedAlpha() const
+{
+    return m_attrs.premultipliedAlpha;
+}
+
+void WebGLContextAttributes::setPremultipliedAlpha(bool premultipliedAlpha)
+{
+    m_attrs.premultipliedAlpha = premultipliedAlpha;
+}
+
+GraphicsContext3D::Attributes WebGLContextAttributes::attributes() const
+{
+    return m_attrs;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLContextAttributes.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLContextAttributes.h
new file mode 100644
index 0000000000..a1086052d3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLContextAttributes.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebGLContextAttributes_h
+#define WebGLContextAttributes_h
+
+#include "CanvasContextAttributes.h"
+#include "GraphicsContext3D.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class WebGLContextAttributes : public CanvasContextAttributes {
+  public:
+    virtual ~WebGLContextAttributes();
+
+    // Create a new attributes object
+    static PassRefPtr<WebGLContextAttributes> create();
+
+    // Create a new attributes object initialized with preexisting attributes
+    static PassRefPtr<WebGLContextAttributes> create(GraphicsContext3D::Attributes attributes);
+
+    // Whether or not the drawing buffer has an alpha channel; default=true
+    bool alpha() const;
+    void setAlpha(bool alpha);
+
+    // Whether or not the drawing buffer has a depth buffer; default=true
+    bool depth() const;
+    void setDepth(bool depth);
+
+    // Whether or not the drawing buffer has a stencil buffer; default=true
+    bool stencil() const;
+    void setStencil(bool stencil);
+
+    // Whether or not the drawing buffer is antialiased; default=true
+    bool antialias() const;
+    void setAntialias(bool antialias);
+
+    // Whether or not to treat the values in the drawing buffer as
+    // though their alpha channel has already been multiplied into the
+    // color channels; default=true
+    bool premultipliedAlpha() const;
+    void setPremultipliedAlpha(bool premultipliedAlpha);
+
+    // Fetches a copy of the attributes stored in this object in a
+    // form that can be used to initialize a GraphicsContext3D.
+    GraphicsContext3D::Attributes attributes() const;
+
+  protected:
+    WebGLContextAttributes();
+    WebGLContextAttributes(GraphicsContext3D::Attributes attributes);
+
+  private:
+    GraphicsContext3D::Attributes m_attrs;
+};
+
+} // namespace WebCore
+
+#endif // WebGLContextAttributes_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLContextAttributes.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLContextAttributes.idl
new file mode 100644
index 0000000000..be2b20c495
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLContextAttributes.idl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        OmitConstructor
+    ] WebGLContextAttributes {
+        attribute boolean alpha;
+        attribute boolean depth;
+        attribute boolean stencil;
+        attribute boolean antialias;
+        attribute boolean premultipliedAlpha;
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLFloatArray.cpp
index 0f72ccf537..7d4219f98f 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLFloatArray.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,49 +28,58 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasByteArray.h"
+#include "WebGLFloatArray.h"
 
 namespace WebCore {
-    
-PassRefPtr<CanvasByteArray> CanvasByteArray::create(unsigned length)
+
+PassRefPtr<WebGLFloatArray> WebGLFloatArray::create(unsigned length)
 {
-    RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(signed char));
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length, sizeof(float));
     return create(buffer, 0, length);
 }
 
-PassRefPtr<CanvasByteArray> CanvasByteArray::create(signed char* array, unsigned length)
+PassRefPtr<WebGLFloatArray> WebGLFloatArray::create(float* array, unsigned length)
 {
-    RefPtr<CanvasByteArray> a = CanvasByteArray::create(length);
+    RefPtr<WebGLFloatArray> a = WebGLFloatArray::create(length);
     for (unsigned i = 0; i < length; ++i)
         a->set(i, array[i]);
     return a;
 }
 
-PassRefPtr<CanvasByteArray> CanvasByteArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+PassRefPtr<WebGLFloatArray> WebGLFloatArray::create(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length)
 {
-    if (buffer) {
-        // Check to make sure we are talking about a valid region of
-        // the given CanvasArrayBuffer's storage.
-        if ((offset + (length * sizeof(signed char))) > buffer->byteLength())
-            return NULL;
-    }
-    
-    return adoptRef(new CanvasByteArray(buffer, offset, length));
+    RefPtr<WebGLArrayBuffer> buf(buffer);
+    if (!verifySubRange<float>(buf, byteOffset, length))
+        return 0;
+
+    return adoptRef(new WebGLFloatArray(buf, byteOffset, length));
 }
 
-CanvasByteArray::CanvasByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-    : CanvasArray(buffer, offset)
-    , m_size(length)
+WebGLFloatArray::WebGLFloatArray(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
 {
 }
 
-unsigned CanvasByteArray::length() const {
+unsigned WebGLFloatArray::length() const {
     return m_size;
 }
-    
-unsigned CanvasByteArray::sizeInBytes() const {
-    return length() * sizeof(signed char);
+
+unsigned WebGLFloatArray::byteLength() const {
+    return m_size * sizeof(float);
+}
+
+PassRefPtr<WebGLArray> WebGLFloatArray::slice(int start, int end)
+{
+    unsigned offset, length;
+    calculateOffsetAndLength(start, end, m_size, &offset, &length);
+    unsigned fullOffset = m_byteOffset + offset * sizeof(float);
+    clampOffsetAndNumElements<float>(buffer(), &fullOffset, &length);
+    return create(buffer(), fullOffset, length);
+}
+
+void WebGLFloatArray::set(WebGLFloatArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(float), ec);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLFloatArray.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLFloatArray.h
new file mode 100644
index 0000000000..5b4e6c9981
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLFloatArray.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLFloatArray_h
+#define WebGLFloatArray_h
+
+#include "WebGLArray.h"
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLFloatArray : public WebGLArray {
+  public:
+    virtual bool isFloatArray() const { return true; }
+
+    static PassRefPtr<WebGLFloatArray> create(unsigned length);
+    static PassRefPtr<WebGLFloatArray> create(float* array, unsigned length);
+    static PassRefPtr<WebGLFloatArray> create(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length);
+
+    float* data() { return static_cast<float*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(int start, int end);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        float* storage = static_cast<float*>(m_baseAddress);
+        storage[index] = static_cast<float>(value);
+    }
+
+    bool get(unsigned index, float& result) const
+    {
+        if (index >= m_size)
+            return false;
+        result = item(index);
+        return true;
+    }
+
+    float get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    float item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        float* storage = static_cast<float*>(m_baseAddress);
+        float result = storage[index];
+        if (isnan(result)) {
+            // Clamp NaN to 0
+            result = 0;
+        }
+        return result;
+    }
+
+    void set(WebGLFloatArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLFloatArray(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLFloatArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLFloatArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLFloatArray.idl
new file mode 100644
index 0000000000..e0a80f2cad
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLFloatArray.idl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        CustomConstructor,
+        CustomToJS
+    ] WebGLFloatArray : WebGLArray {
+        float get(in unsigned long index);
+        // void set(in unsigned long index, in float value);
+        // void set(in WebGLFloatArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFramebuffer.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLFramebuffer.cpp
index 970035433c..7ade990bde 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFramebuffer.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLFramebuffer.cpp
@@ -27,23 +27,23 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasFramebuffer.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-PassRefPtr<CanvasFramebuffer> CanvasFramebuffer::create(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLFramebuffer> WebGLFramebuffer::create(WebGLRenderingContext* ctx)
 {
-    return adoptRef(new CanvasFramebuffer(ctx));
+    return adoptRef(new WebGLFramebuffer(ctx));
 }
 
-CanvasFramebuffer::CanvasFramebuffer(CanvasRenderingContext3D* ctx)
+WebGLFramebuffer::WebGLFramebuffer(WebGLRenderingContext* ctx)
     : CanvasObject(ctx)
 {
     setObject(context()->graphicsContext3D()->createFramebuffer());
 }
 
-void CanvasFramebuffer::_deleteObject(Platform3DObject object)
+void WebGLFramebuffer::_deleteObject(Platform3DObject object)
 {
     context()->graphicsContext3D()->deleteFramebuffer(object);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFramebuffer.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLFramebuffer.h
index ec3cb97f85..10b6772af0 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFramebuffer.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLFramebuffer.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasFramebuffer_h
-#define CanvasFramebuffer_h
+#ifndef WebGLFramebuffer_h
+#define WebGLFramebuffer_h
 
 #include "CanvasObject.h"
 
@@ -33,18 +33,18 @@
 
 namespace WebCore {
     
-    class CanvasFramebuffer : public CanvasObject {
+    class WebGLFramebuffer : public CanvasObject {
     public:
-        virtual ~CanvasFramebuffer() { deleteObject(); }
+        virtual ~WebGLFramebuffer() { deleteObject(); }
         
-        static PassRefPtr<CanvasFramebuffer> create(CanvasRenderingContext3D*);
+        static PassRefPtr<WebGLFramebuffer> create(WebGLRenderingContext*);
         
     protected:
-        CanvasFramebuffer(CanvasRenderingContext3D*);
+        WebGLFramebuffer(WebGLRenderingContext*);
         
         virtual void _deleteObject(Platform3DObject);
     };
     
 } // namespace WebCore
 
-#endif // CanvasFramebuffer_h
+#endif // WebGLFramebuffer_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLFramebuffer.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLFramebuffer.idl
new file mode 100644
index 0000000000..f4333527e2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLFramebuffer.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS, OmitConstructor] WebGLFramebuffer {
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLGetInfo.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLGetInfo.cpp
new file mode 100644
index 0000000000..96218e519e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLGetInfo.cpp
@@ -0,0 +1,215 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLGetInfo.h"
+#include "WebGLBuffer.h"
+#include "WebGLFloatArray.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLIntArray.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLTexture.h"
+#include "WebGLUnsignedByteArray.h"
+
+namespace WebCore {
+
+WebGLGetInfo::WebGLGetInfo(bool value)
+    : m_type(kTypeBool)
+    , m_bool(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(float value)
+    : m_type(kTypeFloat)
+    , m_float(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(long value)
+    : m_type(kTypeLong)
+    , m_long(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo()
+    : m_type(kTypeNull)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(const String& value)
+    : m_type(kTypeString)
+    , m_string(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(unsigned long value)
+    : m_type(kTypeUnsignedLong)
+    , m_unsignedLong(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLBuffer> value)
+    : m_type(kTypeWebGLBuffer)
+    , m_webglBuffer(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLFloatArray> value)
+    : m_type(kTypeWebGLFloatArray)
+    , m_webglFloatArray(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLFramebuffer> value)
+    : m_type(kTypeWebGLFramebuffer)
+    , m_webglFramebuffer(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLIntArray> value)
+    : m_type(kTypeWebGLIntArray)
+    , m_webglIntArray(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLProgram> value)
+    : m_type(kTypeWebGLProgram)
+    , m_webglProgram(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLRenderbuffer> value)
+    : m_type(kTypeWebGLRenderbuffer)
+    , m_webglRenderbuffer(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLTexture> value)
+    : m_type(kTypeWebGLTexture)
+    , m_webglTexture(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLUnsignedByteArray> value)
+    : m_type(kTypeWebGLUnsignedByteArray)
+    , m_webglUnsignedByteArray(value)
+{
+}
+
+WebGLGetInfo::~WebGLGetInfo()
+{
+}
+
+WebGLGetInfo::Type WebGLGetInfo::getType() const
+{
+    return m_type;
+}
+
+bool WebGLGetInfo::getBool() const
+{
+    ASSERT(getType() == kTypeBool);
+    return m_bool;
+}
+
+float WebGLGetInfo::getFloat() const
+{
+    ASSERT(getType() == kTypeFloat);
+    return m_float;
+}
+
+long WebGLGetInfo::getLong() const
+{
+    ASSERT(getType() == kTypeLong);
+    return m_long;
+}
+
+const String& WebGLGetInfo::getString() const
+{
+    ASSERT(getType() == kTypeString);
+    return m_string;
+}
+
+unsigned long WebGLGetInfo::getUnsignedLong() const
+{
+    ASSERT(getType() == kTypeUnsignedLong);
+    return m_unsignedLong;
+}
+
+PassRefPtr<WebGLBuffer> WebGLGetInfo::getWebGLBuffer() const
+{
+    ASSERT(getType() == kTypeWebGLBuffer);
+    return m_webglBuffer;
+}
+
+PassRefPtr<WebGLFloatArray> WebGLGetInfo::getWebGLFloatArray() const
+{
+    ASSERT(getType() == kTypeWebGLFloatArray);
+    return m_webglFloatArray;
+}
+
+PassRefPtr<WebGLFramebuffer> WebGLGetInfo::getWebGLFramebuffer() const
+{
+    ASSERT(getType() == kTypeWebGLFramebuffer);
+    return m_webglFramebuffer;
+}
+
+PassRefPtr<WebGLIntArray> WebGLGetInfo::getWebGLIntArray() const
+{
+    ASSERT(getType() == kTypeWebGLIntArray);
+    return m_webglIntArray;
+}
+
+PassRefPtr<WebGLProgram> WebGLGetInfo::getWebGLProgram() const
+{
+    ASSERT(getType() == kTypeWebGLProgram);
+    return m_webglProgram;
+}
+
+PassRefPtr<WebGLRenderbuffer> WebGLGetInfo::getWebGLRenderbuffer() const
+{
+    ASSERT(getType() == kTypeWebGLRenderbuffer);
+    return m_webglRenderbuffer;
+}
+
+PassRefPtr<WebGLTexture> WebGLGetInfo::getWebGLTexture() const
+{
+    ASSERT(getType() == kTypeWebGLTexture);
+    return m_webglTexture;
+}
+
+PassRefPtr<WebGLUnsignedByteArray> WebGLGetInfo::getWebGLUnsignedByteArray() const
+{
+    ASSERT(getType() == kTypeWebGLUnsignedByteArray);
+    return m_webglUnsignedByteArray;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLGetInfo.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLGetInfo.h
new file mode 100644
index 0000000000..8ac42c45db
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLGetInfo.h
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebGLGetInfo_h
+#define WebGLGetInfo_h
+
+#include "wtf/PassRefPtr.h"
+#include "wtf/RefPtr.h"
+#include "PlatformString.h"
+
+#include "WebGLBuffer.h"
+#include "WebGLFloatArray.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLIntArray.h"
+// FIXME: implement WebGLObjectArray
+//#include "WebGLObjectArray.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLTexture.h"
+#include "WebGLUnsignedByteArray.h"
+
+namespace WebCore {
+
+// A tagged union representing the result of get queries like
+// getParameter (encompassing getBooleanv, getIntegerv, getFloatv) and
+// similar variants. For reference counted types, increments and
+// decrements the reference count of the target object.
+
+class WebGLGetInfo {
+public:
+    enum Type {
+        kTypeBool,
+        kTypeFloat,
+        kTypeLong,
+        kTypeNull,
+        kTypeString,
+        kTypeUnsignedLong,
+        kTypeWebGLBuffer,
+        kTypeWebGLFloatArray,
+        kTypeWebGLFramebuffer,
+        kTypeWebGLIntArray,
+        kTypeWebGLObjectArray,
+        kTypeWebGLProgram,
+        kTypeWebGLRenderbuffer,
+        kTypeWebGLTexture,
+        kTypeWebGLUnsignedByteArray
+    };
+
+    WebGLGetInfo(bool value);
+    WebGLGetInfo(float value);
+    WebGLGetInfo(long value);
+    // Represents the NULL value and type
+    WebGLGetInfo();
+    WebGLGetInfo(const String& value);
+    WebGLGetInfo(unsigned long value);
+    WebGLGetInfo(PassRefPtr<WebGLBuffer> value);
+    WebGLGetInfo(PassRefPtr<WebGLFloatArray> value);
+    WebGLGetInfo(PassRefPtr<WebGLFramebuffer> value);
+    WebGLGetInfo(PassRefPtr<WebGLIntArray> value);
+    // FIXME: implement WebGLObjectArray
+    // WebGLGetInfo(PassRefPtr<WebGLObjectArray> value);
+    WebGLGetInfo(PassRefPtr<WebGLProgram> value);
+    WebGLGetInfo(PassRefPtr<WebGLRenderbuffer> value);
+    WebGLGetInfo(PassRefPtr<WebGLTexture> value);
+    WebGLGetInfo(PassRefPtr<WebGLUnsignedByteArray> value);
+
+    virtual ~WebGLGetInfo();
+
+    Type getType() const;
+
+    bool getBool() const;
+    float getFloat() const;
+    long getLong() const;
+    const String& getString() const;
+    unsigned long getUnsignedLong() const;
+    PassRefPtr<WebGLBuffer> getWebGLBuffer() const;
+    PassRefPtr<WebGLFloatArray> getWebGLFloatArray() const;
+    PassRefPtr<WebGLFramebuffer> getWebGLFramebuffer() const;
+    PassRefPtr<WebGLIntArray> getWebGLIntArray() const;
+    // FIXME: implement WebGLObjectArray
+    // PassRefPtr<WebGLObjectArray> getWebGLObjectArray() const;
+    PassRefPtr<WebGLProgram> getWebGLProgram() const;
+    PassRefPtr<WebGLRenderbuffer> getWebGLRenderbuffer() const;
+    PassRefPtr<WebGLTexture> getWebGLTexture() const;
+    PassRefPtr<WebGLUnsignedByteArray> getWebGLUnsignedByteArray() const;
+
+private:
+    Type m_type;
+    bool m_bool;
+    float m_float;
+    long m_long;
+    String m_string;
+    unsigned long m_unsignedLong;
+    RefPtr<WebGLBuffer> m_webglBuffer;
+    RefPtr<WebGLFloatArray> m_webglFloatArray;
+    RefPtr<WebGLFramebuffer> m_webglFramebuffer;
+    RefPtr<WebGLIntArray> m_webglIntArray;
+    // FIXME: implement WebGLObjectArray
+    // RefPtr<WebGLObjectArray> m_webglObjectArray;
+    RefPtr<WebGLProgram> m_webglProgram;
+    RefPtr<WebGLRenderbuffer> m_webglRenderbuffer;
+    RefPtr<WebGLTexture> m_webglTexture;
+    RefPtr<WebGLUnsignedByteArray> m_webglUnsignedByteArray;
+};
+
+} // namespace WebCore
+
+#endif  // WebGLGetInfo_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLIntArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLIntArray.cpp
new file mode 100644
index 0000000000..792ad2d969
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLIntArray.cpp
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLIntArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLIntArray> WebGLIntArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length, sizeof(int));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLIntArray> WebGLIntArray::create(int* array, unsigned length)
+{
+    RefPtr<WebGLIntArray> a = WebGLIntArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLIntArray> WebGLIntArray::create(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                unsigned byteOffset,
+                                                unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buf(buffer);
+    if (!verifySubRange<int>(buf, byteOffset, length))
+        return 0;
+
+    return adoptRef(new WebGLIntArray(buf, byteOffset, length));
+}
+
+WebGLIntArray::WebGLIntArray(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLIntArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLIntArray::byteLength() const {
+    return m_size * sizeof(int);
+}
+
+PassRefPtr<WebGLArray> WebGLIntArray::slice(int start, int end)
+{
+    unsigned offset, length;
+    calculateOffsetAndLength(start, end, m_size, &offset, &length);
+    unsigned fullOffset = m_byteOffset + offset * sizeof(int);
+    clampOffsetAndNumElements<int>(buffer(), &fullOffset, &length);
+    return create(buffer(), fullOffset, length);
+}
+
+void WebGLIntArray::set(WebGLIntArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(int), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLIntArray.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLIntArray.h
new file mode 100644
index 0000000000..5929e751b7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLIntArray.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLIntArray_h
+#define WebGLIntArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLIntArray : public WebGLArray {
+  public:
+    virtual bool isIntArray() const { return true; }
+
+    static PassRefPtr<WebGLIntArray> create(unsigned length);
+    static PassRefPtr<WebGLIntArray> create(int* array, unsigned length);
+    static PassRefPtr<WebGLIntArray> create(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length);
+
+    int* data() { return static_cast<int*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(int start, int end);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<int>::min())
+            value = std::numeric_limits<int>::min();
+        else if (value > std::numeric_limits<int>::max())
+            value = std::numeric_limits<int>::max();
+        int* storage = static_cast<int*>(m_baseAddress);
+        storage[index] = static_cast<int>(value);
+    }
+
+    bool get(unsigned index, int& result) const
+    {
+        if (index >= m_size)
+            return false;
+        result = item(index);
+        return true;
+    }
+
+    int get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    int item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        int* storage = static_cast<int*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLIntArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLIntArray(PassRefPtr<WebGLArrayBuffer> buffer,
+                  unsigned byteOffset,
+                  unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLIntArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLIntArray.idl
index d46f708a42..ef0d92f258 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLIntArray.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,8 +30,13 @@ module html {
         HasNumericIndexGetter,
         HasCustomIndexSetter,
         GenerateNativeConverter,
-        GenerateCustomConstructor,
+        CustomConstructor,
         CustomToJS
-    ] CanvasUnsignedByteArray : CanvasArray {
+    ] WebGLIntArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLIntArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasProgram.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLProgram.cpp
index 83da270381..c2606c1f3a 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasProgram.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLProgram.cpp
@@ -27,23 +27,23 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasProgram.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-PassRefPtr<CanvasProgram> CanvasProgram::create(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLProgram> WebGLProgram::create(WebGLRenderingContext* ctx)
 {
-    return adoptRef(new CanvasProgram(ctx));
+    return adoptRef(new WebGLProgram(ctx));
 }
 
-CanvasProgram::CanvasProgram(CanvasRenderingContext3D* ctx)
+WebGLProgram::WebGLProgram(WebGLRenderingContext* ctx)
     : CanvasObject(ctx)
 {
     setObject(context()->graphicsContext3D()->createProgram());
 }
 
-void CanvasProgram::_deleteObject(Platform3DObject object)
+void WebGLProgram::_deleteObject(Platform3DObject object)
 {
     context()->graphicsContext3D()->deleteProgram(object);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasProgram.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLProgram.h
index af817c8054..8804d394db 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasProgram.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLProgram.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasProgram_h
-#define CanvasProgram_h
+#ifndef WebGLProgram_h
+#define WebGLProgram_h
 
 #include "CanvasObject.h"
 
@@ -33,18 +33,18 @@
 
 namespace WebCore {
     
-    class CanvasProgram : public CanvasObject {
+    class WebGLProgram : public CanvasObject {
     public:
-        virtual ~CanvasProgram() { deleteObject(); }
+        virtual ~WebGLProgram() { deleteObject(); }
         
-        static PassRefPtr<CanvasProgram> create(CanvasRenderingContext3D*);
+        static PassRefPtr<WebGLProgram> create(WebGLRenderingContext*);
         
     protected:
-        CanvasProgram(CanvasRenderingContext3D*);
+        WebGLProgram(WebGLRenderingContext*);
         
         virtual void _deleteObject(Platform3DObject);
     };
     
 } // namespace WebCore
 
-#endif // CanvasProgram_h
+#endif // WebGLProgram_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderbuffer.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLProgram.idl
index 5e47cc3e0d..47e5cda1cb 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderbuffer.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLProgram.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasRenderbuffer {
+    interface [Conditional=3D_CANVAS, OmitConstructor] WebGLProgram {
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderbuffer.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLRenderbuffer.cpp
index 51054cd8ad..286ad2e8e6 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderbuffer.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLRenderbuffer.cpp
@@ -27,23 +27,34 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasRenderbuffer.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-PassRefPtr<CanvasRenderbuffer> CanvasRenderbuffer::create(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLRenderbuffer> WebGLRenderbuffer::create(WebGLRenderingContext* ctx)
 {
-    return adoptRef(new CanvasRenderbuffer(ctx));
+    return adoptRef(new WebGLRenderbuffer(ctx));
 }
 
-CanvasRenderbuffer::CanvasRenderbuffer(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLRenderbuffer> WebGLRenderbuffer::create(WebGLRenderingContext* ctx, Platform3DObject obj)
+{
+    return adoptRef(new WebGLRenderbuffer(ctx, obj));
+}
+
+WebGLRenderbuffer::WebGLRenderbuffer(WebGLRenderingContext* ctx)
     : CanvasObject(ctx)
 {
     setObject(context()->graphicsContext3D()->createRenderbuffer());
 }
 
-void CanvasRenderbuffer::_deleteObject(Platform3DObject object)
+WebGLRenderbuffer::WebGLRenderbuffer(WebGLRenderingContext* ctx, Platform3DObject obj)
+    : CanvasObject(ctx)
+{
+    setObject(obj, false);
+}
+
+void WebGLRenderbuffer::_deleteObject(Platform3DObject object)
 {
     context()->graphicsContext3D()->deleteRenderbuffer(object);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderbuffer.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLRenderbuffer.h
index 3fb99e9efe..790fdcd90b 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderbuffer.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLRenderbuffer.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasRenderbuffer_h
-#define CanvasRenderbuffer_h
+#ifndef WebGLRenderbuffer_h
+#define WebGLRenderbuffer_h
 
 #include "CanvasObject.h"
 
@@ -33,18 +33,23 @@
 
 namespace WebCore {
     
-    class CanvasRenderbuffer : public CanvasObject {
+    class WebGLRenderbuffer : public CanvasObject {
     public:
-        virtual ~CanvasRenderbuffer() { deleteObject(); }
+        virtual ~WebGLRenderbuffer() { deleteObject(); }
         
-        static PassRefPtr<CanvasRenderbuffer> create(CanvasRenderingContext3D*);
+        static PassRefPtr<WebGLRenderbuffer> create(WebGLRenderingContext*);
         
+        // For querying previously created objects via e.g. getFramebufferAttachmentParameter
+        // FIXME: should consider canonicalizing these objects
+        static PassRefPtr<WebGLRenderbuffer> create(WebGLRenderingContext*, Platform3DObject renderbuffer);
+
     protected:
-        CanvasRenderbuffer(CanvasRenderingContext3D*);
+        WebGLRenderbuffer(WebGLRenderingContext*);
+        WebGLRenderbuffer(WebGLRenderingContext*, Platform3DObject);
         
         virtual void _deleteObject(Platform3DObject);
     };
     
 } // namespace WebCore
 
-#endif // CanvasRenderbuffer_h
+#endif // WebGLRenderbuffer_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLRenderbuffer.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLRenderbuffer.idl
new file mode 100644
index 0000000000..6a4fc35e59
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLRenderbuffer.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS, OmitConstructor] WebGLRenderbuffer {
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLRenderingContext.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLRenderingContext.cpp
new file mode 100644
index 0000000000..4059d7fd3b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -0,0 +1,2532 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLRenderingContext.h"
+
+#include "CanvasPixelArray.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "ImageBuffer.h"
+#include "ImageData.h"
+#include "NotImplemented.h"
+#include "RenderBox.h"
+#include "RenderLayer.h"
+#include "WebGLActiveInfo.h"
+#include "WebGLBuffer.h"
+#include "WebGLContextAttributes.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLTexture.h"
+#include "WebGLShader.h"
+#include "WebGLUniformLocation.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "ImageBuffer.h"
+#include "NotImplemented.h"
+#include "RenderBox.h"
+#include "RenderLayer.h"
+
+#include <wtf/ByteArray.h>
+
+namespace WebCore {
+
+class WebGLStateRestorer {
+public:
+    WebGLStateRestorer(WebGLRenderingContext* context,
+                       bool changed)
+        : m_context(context)
+        , m_changed(changed)
+    {
+    }
+
+    ~WebGLStateRestorer()
+    {
+        m_context->cleanupAfterGraphicsCall(m_changed);
+    }
+
+private:
+    WebGLRenderingContext* m_context;
+    bool m_changed;
+};
+
+PassOwnPtr<WebGLRenderingContext> WebGLRenderingContext::create(HTMLCanvasElement* canvas, WebGLContextAttributes* attrs)
+{
+    OwnPtr<GraphicsContext3D> context(GraphicsContext3D::create(attrs->attributes()));
+    if (!context)
+        return 0;
+        
+    return new WebGLRenderingContext(canvas, context.release());
+}
+
+WebGLRenderingContext::WebGLRenderingContext(HTMLCanvasElement* passedCanvas, PassOwnPtr<GraphicsContext3D> context)
+    : CanvasRenderingContext(passedCanvas)
+    , m_context(context)
+    , m_needsUpdate(true)
+    , m_markedCanvasDirty(false)
+    , m_activeTextureUnit(0)
+{
+    ASSERT(m_context);
+    int numVertexAttribs = 0;
+    m_context->getIntegerv(GraphicsContext3D::MAX_VERTEX_ATTRIBS, &numVertexAttribs);
+    m_maxVertexAttribs = numVertexAttribs;
+    m_context->reshape(canvas()->width(), canvas()->height());
+    m_context->viewport(0, 0, canvas()->width(), canvas()->height());
+}
+
+WebGLRenderingContext::~WebGLRenderingContext()
+{
+    detachAndRemoveAllObjects();
+}
+
+void WebGLRenderingContext::markContextChanged()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (canvas()->renderBox() && canvas()->renderBox()->hasLayer() && canvas()->renderBox()->layer()->hasAcceleratedCompositing()) {
+        canvas()->renderBox()->layer()->rendererContentChanged();
+    } else {
+#endif
+        if (!m_markedCanvasDirty) {
+            // Make sure the canvas's image buffer is allocated.
+            canvas()->buffer();
+            canvas()->willDraw(FloatRect(0, 0, canvas()->width(), canvas()->height()));
+            m_markedCanvasDirty = true;
+        }
+#if USE(ACCELERATED_COMPOSITING)
+    }
+#endif
+}
+
+void WebGLRenderingContext::beginPaint()
+{
+    if (m_markedCanvasDirty) {
+        m_context->beginPaint(this);
+    }
+}
+
+void WebGLRenderingContext::endPaint()
+{
+    if (m_markedCanvasDirty) {
+        m_markedCanvasDirty = false;
+        m_context->endPaint();
+    }
+}
+
+void WebGLRenderingContext::reshape(int width, int height)
+{
+    if (m_needsUpdate) {
+#if USE(ACCELERATED_COMPOSITING)
+        if (canvas()->renderBox() && canvas()->renderBox()->hasLayer())
+            canvas()->renderBox()->layer()->rendererContentChanged();
+#endif
+        m_needsUpdate = false;
+    }
+    
+    m_context->reshape(width, height);
+}
+
+int WebGLRenderingContext::sizeInBytes(int type, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    int result = m_context->sizeInBytes(type);
+    if (result <= 0)
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+
+    return result;
+}
+
+void WebGLRenderingContext::activeTexture(unsigned long texture, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if ((texture - GraphicsContext3D::TEXTURE0) > sizeof(m_textureUnits) / sizeof(TextureUnitState)) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+    m_activeTextureUnit = texture - GraphicsContext3D::TEXTURE0;
+    m_context->activeTexture(texture);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::attachShader(WebGLProgram* program, WebGLShader* shader, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this || !shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    m_context->attachShader(program, shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bindAttribLocation(WebGLProgram* program, unsigned long index, const String& name, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->bindAttribLocation(program, index, name);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bindBuffer(unsigned long target, WebGLBuffer* buffer, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (buffer && buffer->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (target == GraphicsContext3D::ARRAY_BUFFER)
+        m_boundArrayBuffer = buffer;
+    else if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER)
+        m_boundElementArrayBuffer = buffer;
+    else {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+
+    m_context->bindBuffer(target, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void WebGLRenderingContext::bindFramebuffer(unsigned long target, WebGLFramebuffer* buffer, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (buffer && buffer->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    if (target != GraphicsContext3D::FRAMEBUFFER) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+    m_framebufferBinding = buffer;
+    m_context->bindFramebuffer(target, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bindRenderbuffer(unsigned long target, WebGLRenderbuffer* renderBuffer, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (renderBuffer && renderBuffer->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    if (target != GraphicsContext3D::RENDERBUFFER) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+    m_renderbufferBinding = renderBuffer;
+    m_context->bindRenderbuffer(target, renderBuffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void WebGLRenderingContext::bindTexture(unsigned long target, WebGLTexture* texture, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (texture && texture->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    if (target == GraphicsContext3D::TEXTURE_2D)
+        m_textureUnits[m_activeTextureUnit].m_texture2DBinding = texture;
+    else if (target == GraphicsContext3D::TEXTURE_CUBE_MAP)
+        m_textureUnits[m_activeTextureUnit].m_textureCubeMapBinding = texture;
+    else {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+    m_context->bindTexture(target, texture);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::blendColor(double red, double green, double blue, double alpha)
+{
+    m_context->blendColor(red, green, blue, alpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::blendEquation( unsigned long mode )
+{
+    m_context->blendEquation(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha)
+{
+    m_context->blendEquationSeparate(modeRGB, modeAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void WebGLRenderingContext::blendFunc(unsigned long sfactor, unsigned long dfactor)
+{
+    m_context->blendFunc(sfactor, dfactor);
+    cleanupAfterGraphicsCall(false);
+}       
+
+void WebGLRenderingContext::blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha)
+{
+    m_context->blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bufferData(unsigned long target, int size, unsigned long usage, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER && m_boundElementArrayBuffer) {
+        if (!m_boundElementArrayBuffer->associateBufferData(target, size)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else if (target == GraphicsContext3D::ARRAY_BUFFER && m_boundArrayBuffer) {
+        if (!m_boundArrayBuffer->associateBufferData(target, size)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+
+    m_context->bufferData(target, size, usage);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bufferData(unsigned long target, WebGLArray* data, unsigned long usage, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER && m_boundElementArrayBuffer) {
+        if (!m_boundElementArrayBuffer->associateBufferData(target, data)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else if (target == GraphicsContext3D::ARRAY_BUFFER && m_boundArrayBuffer) {
+        if (!m_boundArrayBuffer->associateBufferData(target, data)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+
+    m_context->bufferData(target, data, usage);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bufferSubData(unsigned long target, long offset, WebGLArray* data, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER && m_boundElementArrayBuffer) {
+        if (!m_boundElementArrayBuffer->associateBufferSubData(target, offset, data)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else if (target == GraphicsContext3D::ARRAY_BUFFER && m_boundArrayBuffer) {
+        if (!m_boundArrayBuffer->associateBufferSubData(target, offset, data)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+
+    m_context->bufferSubData(target, offset, data);
+    cleanupAfterGraphicsCall(false);
+}
+
+unsigned long WebGLRenderingContext::checkFramebufferStatus(unsigned long target)
+{
+    return m_context->checkFramebufferStatus(target);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::clear(unsigned long mask)
+{
+    m_context->clear(mask);
+    cleanupAfterGraphicsCall(true);
+}
+
+void WebGLRenderingContext::clearColor(double r, double g, double b, double a)
+{
+    if (isnan(r))
+        r = 0;
+    if (isnan(g))
+        g = 0;
+    if (isnan(b))
+        b = 0;
+    if (isnan(a))
+        a = 1;
+    m_context->clearColor(r, g, b, a);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::clearDepth(double depth)
+{
+    m_context->clearDepth(depth);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::clearStencil(long s)
+{
+    m_context->clearStencil(s);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::colorMask(bool red, bool green, bool blue, bool alpha)
+{
+    m_context->colorMask(red, green, blue, alpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::compileShader(WebGLShader* shader, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->compileShader(shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border)
+{
+    m_context->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height)
+{
+    m_context->copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+PassRefPtr<WebGLBuffer> WebGLRenderingContext::createBuffer()
+{
+    RefPtr<WebGLBuffer> o = WebGLBuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+        
+PassRefPtr<WebGLFramebuffer> WebGLRenderingContext::createFramebuffer()
+{
+    RefPtr<WebGLFramebuffer> o = WebGLFramebuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<WebGLTexture> WebGLRenderingContext::createTexture()
+{
+    RefPtr<WebGLTexture> o = WebGLTexture::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<WebGLProgram> WebGLRenderingContext::createProgram()
+{
+    RefPtr<WebGLProgram> o = WebGLProgram::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<WebGLRenderbuffer> WebGLRenderingContext::createRenderbuffer()
+{
+    RefPtr<WebGLRenderbuffer> o = WebGLRenderbuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<WebGLShader> WebGLRenderingContext::createShader(unsigned long type, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (type != GraphicsContext3D::VERTEX_SHADER && type != GraphicsContext3D::FRAGMENT_SHADER) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return 0;
+    }
+    
+    RefPtr<WebGLShader> o = WebGLShader::create(this, static_cast<GraphicsContext3D::WebGLEnumType>(type));
+    addObject(o.get());
+    return o;
+}
+
+void WebGLRenderingContext::cullFace(unsigned long mode)
+{
+    m_context->cullFace(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::deleteBuffer(WebGLBuffer* buffer)
+{
+    if (!buffer)
+        return;
+    
+    buffer->deleteObject();
+}
+
+void WebGLRenderingContext::deleteFramebuffer(WebGLFramebuffer* framebuffer)
+{
+    if (!framebuffer)
+        return;
+    
+    framebuffer->deleteObject();
+}
+
+void WebGLRenderingContext::deleteProgram(WebGLProgram* program)
+{
+    if (!program)
+        return;
+    
+    program->deleteObject();
+}
+
+void WebGLRenderingContext::deleteRenderbuffer(WebGLRenderbuffer* renderbuffer)
+{
+    if (!renderbuffer)
+        return;
+    
+    renderbuffer->deleteObject();
+}
+
+void WebGLRenderingContext::deleteShader(WebGLShader* shader)
+{
+    if (!shader)
+        return;
+    
+    shader->deleteObject();
+}
+
+void WebGLRenderingContext::deleteTexture(WebGLTexture* texture)
+{
+    if (!texture)
+        return;
+    
+    texture->deleteObject();
+}
+
+void WebGLRenderingContext::depthFunc(unsigned long func)
+{
+    m_context->depthFunc(func);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::depthMask(bool flag)
+{
+    m_context->depthMask(flag);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::depthRange(double zNear, double zFar)
+{
+    m_context->depthRange(zNear, zFar);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::detachShader(WebGLProgram* program, WebGLShader* shader, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this || !shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->detachShader(program, shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void WebGLRenderingContext::disable(unsigned long cap)
+{
+    m_context->disable(cap);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::disableVertexAttribArray(unsigned long index, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (index >= m_maxVertexAttribs) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    if (index < m_vertexAttribState.size())
+        m_vertexAttribState[index].enabled = false;
+    
+    m_context->disableVertexAttribArray(index);
+    cleanupAfterGraphicsCall(false);
+}
+
+bool WebGLRenderingContext::validateElementArraySize(unsigned long count, unsigned long type, long offset)
+{
+    if (!m_boundElementArrayBuffer)
+        return false;
+
+    if (offset < 0)
+        return false;
+
+    unsigned long uoffset = static_cast<unsigned long>(offset);
+
+    if (type == GraphicsContext3D::UNSIGNED_SHORT) {
+        // For an unsigned short array, offset must be divisible by 2 for alignment reasons.
+        if (uoffset & 1)
+            return false;
+
+        // Make uoffset an element offset.
+        uoffset /= 2;
+
+        unsigned long n = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER) / 2;
+        if (uoffset > n || count > n - uoffset)
+            return false;
+    } else if (type == GraphicsContext3D::UNSIGNED_BYTE) {
+        unsigned long n = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER);
+        if (uoffset > n || count > n - uoffset)
+            return false;
+    }
+    return true;
+}
+
+bool WebGLRenderingContext::validateIndexArrayConservative(unsigned long type, long& numElementsRequired)
+{
+    // Performs conservative validation by caching a maximum index of
+    // the given type per element array buffer. If all of the bound
+    // array buffers have enough elements to satisfy that maximum
+    // index, skips the expensive per-draw-call iteration in
+    // validateIndexArrayPrecise.
+
+    long maxIndex = m_boundElementArrayBuffer->getCachedMaxIndex(type);
+    if (maxIndex < 0) {
+        // Compute the maximum index in the entire buffer for the given type of index.
+        switch (type) {
+        case GraphicsContext3D::UNSIGNED_BYTE: {
+            unsigned numElements = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER);
+            const unsigned char* p = static_cast<const unsigned char*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
+            for (unsigned i = 0; i < numElements; i++)
+                maxIndex = max(maxIndex, static_cast<long>(p[i]));
+            break;
+        }
+        case GraphicsContext3D::UNSIGNED_SHORT: {
+            unsigned numElements = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER) / sizeof(unsigned short);
+            const unsigned short* p = static_cast<const unsigned short*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
+            for (unsigned i = 0; i < numElements; i++)
+                maxIndex = max(maxIndex, static_cast<long>(p[i]));
+            break;
+        }
+        default:
+            return false;
+        }
+        m_boundElementArrayBuffer->setCachedMaxIndex(type, maxIndex);
+    }
+
+    if (maxIndex >= 0) {
+        // The number of required elements is one more than the maximum
+        // index that will be accessed.
+        numElementsRequired = maxIndex + 1;
+        return true;
+    }
+
+    return false;
+}
+
+bool WebGLRenderingContext::validateIndexArrayPrecise(unsigned long count, unsigned long type, long offset, long& numElementsRequired)
+{
+    long lastIndex = -1;
+
+    if (!m_boundElementArrayBuffer)
+        return false;
+
+    unsigned long uoffset = static_cast<unsigned long>(offset);
+    unsigned long n = count;
+
+    if (type == GraphicsContext3D::UNSIGNED_SHORT) {
+        // Make uoffset an element offset.
+        uoffset /= 2;
+        const unsigned short* p = static_cast<const unsigned short*>(m_boundElementArrayBuffer->elementArrayBuffer()->data()) + uoffset;
+        while (n-- > 0) {
+            if (*p > lastIndex)
+                lastIndex = *p;
+            ++p;
+        }
+    } else if (type == GraphicsContext3D::UNSIGNED_BYTE) {
+        const unsigned char* p = static_cast<const unsigned char*>(m_boundElementArrayBuffer->elementArrayBuffer()->data()) + uoffset;
+        while (n-- > 0) {
+            if (*p > lastIndex)
+                lastIndex = *p;
+            ++p;
+        }
+    }    
+        
+    // Then set the last index in the index array and make sure it is valid.
+    numElementsRequired = lastIndex + 1;
+    return numElementsRequired > 0;
+}
+
+bool WebGLRenderingContext::validateRenderingState(long numElementsRequired)
+{
+    // Look in each enabled vertex attrib and find the smallest buffer size
+    long smallestNumElements = LONG_MAX;
+    for (unsigned i = 0; i < m_vertexAttribState.size(); ++i) {
+        const VertexAttribState& state = m_vertexAttribState[i];
+        if (state.enabled && state.numElements < smallestNumElements)
+            smallestNumElements = state.numElements;
+    }
+    
+    if (smallestNumElements == LONG_MAX)
+        smallestNumElements = 0;
+    
+    return numElementsRequired <= smallestNumElements;
+}
+
+void WebGLRenderingContext::drawArrays(unsigned long mode, long first, long count, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    // Ensure we have a valid rendering state
+    if (first < 0 || count < 0 || !validateRenderingState(first + count)) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    
+    m_context->drawArrays(mode, first, count);
+    cleanupAfterGraphicsCall(true);
+}
+
+void WebGLRenderingContext::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    // Ensure we have a valid rendering state
+    long numElements;
+    
+    if (offset < 0 || !validateElementArraySize(count, type, offset)) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!validateIndexArrayConservative(type, numElements) || !validateRenderingState(numElements))
+        if (!validateIndexArrayPrecise(count, type, offset, numElements) || !validateRenderingState(numElements)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+            return;
+        }
+    
+    m_context->drawElements(mode, count, type, offset);
+    cleanupAfterGraphicsCall(true);
+}
+
+void WebGLRenderingContext::enable(unsigned long cap)
+{
+    m_context->enable(cap);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::enableVertexAttribArray(unsigned long index, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (index >= m_maxVertexAttribs) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    if (index >= m_vertexAttribState.size())
+        m_vertexAttribState.resize(index + 1);
+        
+    m_vertexAttribState[index].enabled = true;
+    
+    m_context->enableVertexAttribArray(index);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::finish()
+{
+    m_context->finish();
+    cleanupAfterGraphicsCall(true);
+}
+
+
+void WebGLRenderingContext::flush()
+{
+    m_context->flush();
+    cleanupAfterGraphicsCall(true);
+}
+
+void WebGLRenderingContext::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, WebGLRenderbuffer* buffer, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (buffer && buffer->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }       
+    // Don't allow the default framebuffer to be mutated; all current
+    // implementations use an FBO internally in place of the default
+    // FBO.
+    if (!m_framebufferBinding || !m_framebufferBinding->object()) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->framebufferRenderbuffer(target, attachment, renderbuffertarget, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, WebGLTexture* texture, long level, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (texture && texture->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    // Don't allow the default framebuffer to be mutated; all current
+    // implementations use an FBO internally in place of the default
+    // FBO.
+    if (!m_framebufferBinding || !m_framebufferBinding->object()) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->framebufferTexture2D(target, attachment, textarget, texture, level);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::frontFace(unsigned long mode)
+{
+    m_context->frontFace(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::generateMipmap(unsigned long target)
+{
+    m_context->generateMipmap(target);
+    cleanupAfterGraphicsCall(false);
+}
+
+PassRefPtr<WebGLActiveInfo> WebGLRenderingContext::getActiveAttrib(WebGLProgram* program, unsigned long index, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    ActiveInfo info;
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return 0;
+    }
+    if (!m_context->getActiveAttrib(program, index, info)) {
+        return 0;
+    }
+    return WebGLActiveInfo::create(info.name, info.type, info.size);
+}
+
+PassRefPtr<WebGLActiveInfo> WebGLRenderingContext::getActiveUniform(WebGLProgram* program, unsigned long index, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    ActiveInfo info;
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return 0;
+    }
+    if (!m_context->getActiveUniform(program, index, info)) {
+        return 0;
+    }
+    return WebGLActiveInfo::create(info.name, info.type, info.size);
+}
+
+int WebGLRenderingContext::getAttribLocation(WebGLProgram* program, const String& name)
+{
+    return m_context->getAttribLocation(program, name);
+}
+
+WebGLGetInfo WebGLRenderingContext::getBufferParameter(unsigned long target, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target != GraphicsContext3D::ARRAY_BUFFER && target != GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+
+    if (pname != GraphicsContext3D::BUFFER_SIZE && pname != GraphicsContext3D::BUFFER_USAGE) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+
+    WebGLStateRestorer(this, false);
+    int value;
+    m_context->getBufferParameteriv(target, pname, &value);
+    if (pname == GraphicsContext3D::BUFFER_SIZE)
+        return WebGLGetInfo(static_cast<long>(value));
+    else
+        return WebGLGetInfo(static_cast<unsigned long>(value));
+}
+
+PassRefPtr<WebGLContextAttributes> WebGLRenderingContext::getContextAttributes()
+{
+    // We always need to return a new WebGLContextAttributes object to
+    // prevent the user from mutating any cached version.
+    return WebGLContextAttributes::create(m_context->getContextAttributes());
+}
+
+unsigned long WebGLRenderingContext::getError()
+{
+    return m_context->getError();
+}
+
+WebGLGetInfo WebGLRenderingContext::getFramebufferAttachmentParameter(unsigned long target, unsigned long attachment, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target != GraphicsContext3D::FRAMEBUFFER
+        || (attachment != GraphicsContext3D::COLOR_ATTACHMENT0
+            && attachment != GraphicsContext3D::DEPTH_ATTACHMENT
+            && attachment != GraphicsContext3D::STENCIL_ATTACHMENT)
+        || (pname != GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE
+            && pname != GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_NAME
+            && pname != GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL
+            && pname != GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE)) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+
+    if (pname != GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_NAME) {
+        WebGLStateRestorer(this, false);
+        int value;
+        m_context->getFramebufferAttachmentParameteriv(target, attachment, pname, &value);
+        if (pname == GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE)
+            return WebGLGetInfo(static_cast<unsigned long>(value));
+        else
+            return WebGLGetInfo(static_cast<long>(value));
+    } else {
+        WebGLStateRestorer(this, false);
+        int type = 0;
+        m_context->getFramebufferAttachmentParameteriv(target, attachment, GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE, &type);
+        int value = 0;
+        m_context->getFramebufferAttachmentParameteriv(target, attachment, GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_NAME, &value);
+        // FIXME: should consider canonicalizing these objects
+        switch (type) {
+        case GraphicsContext3D::RENDERBUFFER: {
+            RefPtr<WebGLRenderbuffer> tmp = WebGLRenderbuffer::create(this, value);
+            addObject(tmp.get());
+            return WebGLGetInfo(PassRefPtr<WebGLRenderbuffer>(tmp));
+        }
+        case GraphicsContext3D::TEXTURE: {
+            RefPtr<WebGLTexture> tmp = WebGLTexture::create(this, value);
+            addObject(tmp.get());
+            return WebGLGetInfo(PassRefPtr<WebGLTexture>(tmp));
+        }
+        default:
+            // FIXME: raise exception?
+            return WebGLGetInfo();
+        }
+    }
+}
+
+WebGLGetInfo WebGLRenderingContext::getParameter(unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    WebGLStateRestorer(this, false);
+    switch (pname) {
+    case GraphicsContext3D::ACTIVE_TEXTURE:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::ALIASED_LINE_WIDTH_RANGE:
+        return getWebGLFloatArrayParameter(pname);
+    case GraphicsContext3D::ALIASED_POINT_SIZE_RANGE:
+        return getWebGLFloatArrayParameter(pname);
+    case GraphicsContext3D::ALPHA_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::ARRAY_BUFFER_BINDING:
+        return WebGLGetInfo(PassRefPtr<WebGLBuffer>(m_boundArrayBuffer));
+    case GraphicsContext3D::BLEND:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::BLEND_COLOR:
+        return getWebGLFloatArrayParameter(pname);
+    case GraphicsContext3D::BLEND_DST_ALPHA:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLEND_DST_RGB:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLEND_EQUATION_ALPHA:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLEND_EQUATION_RGB:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLEND_SRC_ALPHA:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLEND_SRC_RGB:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLUE_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::COLOR_CLEAR_VALUE:
+        return getWebGLFloatArrayParameter(pname);
+    case GraphicsContext3D::COLOR_WRITEMASK:
+        return getWebGLUnsignedByteArrayParameter(pname);
+    case GraphicsContext3D::COMPRESSED_TEXTURE_FORMATS:
+        // Defined as null in the spec
+        return WebGLGetInfo();
+    case GraphicsContext3D::CULL_FACE:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::CULL_FACE_MODE:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::CURRENT_PROGRAM:
+        return WebGLGetInfo(PassRefPtr<WebGLProgram>(m_currentProgram));
+    case GraphicsContext3D::DEPTH_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::DEPTH_CLEAR_VALUE:
+        return getFloatParameter(pname);
+    case GraphicsContext3D::DEPTH_FUNC:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::DEPTH_RANGE:
+        return getWebGLFloatArrayParameter(pname);
+    case GraphicsContext3D::DEPTH_TEST:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::DEPTH_WRITEMASK:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::DITHER:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::ELEMENT_ARRAY_BUFFER_BINDING:
+        return WebGLGetInfo(PassRefPtr<WebGLBuffer>(m_boundElementArrayBuffer));
+    case GraphicsContext3D::FRAMEBUFFER_BINDING:
+        return WebGLGetInfo(PassRefPtr<WebGLFramebuffer>(m_framebufferBinding));
+    case GraphicsContext3D::FRONT_FACE:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::GENERATE_MIPMAP_HINT:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::GREEN_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::LINE_WIDTH:
+        return getFloatParameter(pname);
+    case GraphicsContext3D::MAX_COMBINED_TEXTURE_IMAGE_UNITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_CUBE_MAP_TEXTURE_SIZE:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_FRAGMENT_UNIFORM_VECTORS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_RENDERBUFFER_SIZE:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_TEXTURE_IMAGE_UNITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_TEXTURE_SIZE:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_VARYING_VECTORS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_VERTEX_ATTRIBS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_VERTEX_TEXTURE_IMAGE_UNITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_VERTEX_UNIFORM_VECTORS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_VIEWPORT_DIMS:
+        return getWebGLIntArrayParameter(pname);
+    case GraphicsContext3D::NUM_COMPRESSED_TEXTURE_FORMATS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::NUM_SHADER_BINARY_FORMATS:
+        // FIXME: should we always return 0 for this?
+        return getLongParameter(pname);
+    case GraphicsContext3D::PACK_ALIGNMENT:
+        return getLongParameter(pname);
+    case GraphicsContext3D::POLYGON_OFFSET_FACTOR:
+        return getFloatParameter(pname);
+    case GraphicsContext3D::POLYGON_OFFSET_FILL:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::POLYGON_OFFSET_UNITS:
+        return getFloatParameter(pname);
+    case GraphicsContext3D::RED_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::RENDERBUFFER_BINDING:
+        return WebGLGetInfo(PassRefPtr<WebGLRenderbuffer>(m_renderbufferBinding));
+    case GraphicsContext3D::SAMPLE_BUFFERS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::SAMPLE_COVERAGE_INVERT:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::SAMPLE_COVERAGE_VALUE:
+        return getFloatParameter(pname);
+    case GraphicsContext3D::SAMPLES:
+        return getLongParameter(pname);
+    case GraphicsContext3D::SCISSOR_BOX:
+        return getWebGLIntArrayParameter(pname);
+    case GraphicsContext3D::SCISSOR_TEST:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_FAIL:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_FUNC:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_PASS_DEPTH_FAIL:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_PASS_DEPTH_PASS:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_REF:
+        return getLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_VALUE_MASK:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_WRITEMASK:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::STENCIL_CLEAR_VALUE:
+        return getLongParameter(pname);
+    case GraphicsContext3D::STENCIL_FAIL:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_FUNC:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_PASS_DEPTH_FAIL:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_PASS_DEPTH_PASS:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_REF:
+        return getLongParameter(pname);
+    case GraphicsContext3D::STENCIL_TEST:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::STENCIL_VALUE_MASK:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_WRITEMASK:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::SUBPIXEL_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::TEXTURE_BINDING_2D:
+        return WebGLGetInfo(PassRefPtr<WebGLTexture>(m_textureUnits[m_activeTextureUnit].m_texture2DBinding));
+    case GraphicsContext3D::TEXTURE_BINDING_CUBE_MAP:
+        return WebGLGetInfo(PassRefPtr<WebGLTexture>(m_textureUnits[m_activeTextureUnit].m_textureCubeMapBinding));
+    case GraphicsContext3D::UNPACK_ALIGNMENT:
+        // FIXME: should this be "long" in the spec?
+        return getIntParameter(pname);
+    case GraphicsContext3D::VIEWPORT:
+        return getWebGLIntArrayParameter(pname);
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+}
+
+WebGLGetInfo WebGLRenderingContext::getProgramParameter(WebGLProgram* program, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return WebGLGetInfo();
+    }
+
+    WebGLStateRestorer(this, false);
+    int value = 0;
+    switch (pname) {
+    case GraphicsContext3D::DELETE_STATUS:
+    case GraphicsContext3D::LINK_STATUS:
+    case GraphicsContext3D::VALIDATE_STATUS:
+        m_context->getProgramiv(program, pname, &value);
+        return WebGLGetInfo(static_cast<bool>(value));
+    case GraphicsContext3D::INFO_LOG_LENGTH:
+    case GraphicsContext3D::ATTACHED_SHADERS:
+    case GraphicsContext3D::ACTIVE_ATTRIBUTES:
+    case GraphicsContext3D::ACTIVE_ATTRIBUTE_MAX_LENGTH:
+    case GraphicsContext3D::ACTIVE_UNIFORMS:
+    case GraphicsContext3D::ACTIVE_UNIFORM_MAX_LENGTH:
+        m_context->getProgramiv(program, pname, &value);
+        return WebGLGetInfo(static_cast<long>(value));
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+}
+
+String WebGLRenderingContext::getProgramInfoLog(WebGLProgram* program, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return "";
+    }
+    WebGLStateRestorer(this, false);
+    return m_context->getProgramInfoLog(program);
+}
+
+WebGLGetInfo WebGLRenderingContext::getRenderbufferParameter(unsigned long target, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target != GraphicsContext3D::RENDERBUFFER) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+
+    WebGLStateRestorer(this, false);
+    int value = 0;
+    switch (pname) {
+    case GraphicsContext3D::RENDERBUFFER_WIDTH:
+    case GraphicsContext3D::RENDERBUFFER_HEIGHT:
+    case GraphicsContext3D::RENDERBUFFER_RED_SIZE:
+    case GraphicsContext3D::RENDERBUFFER_GREEN_SIZE:
+    case GraphicsContext3D::RENDERBUFFER_BLUE_SIZE:
+    case GraphicsContext3D::RENDERBUFFER_ALPHA_SIZE:
+    case GraphicsContext3D::RENDERBUFFER_DEPTH_SIZE:
+    case GraphicsContext3D::RENDERBUFFER_STENCIL_SIZE:
+        m_context->getRenderbufferParameteriv(target, pname, &value);
+        return WebGLGetInfo(static_cast<long>(value));
+    case GraphicsContext3D::RENDERBUFFER_INTERNAL_FORMAT:
+        m_context->getRenderbufferParameteriv(target, pname, &value);
+        return WebGLGetInfo(static_cast<unsigned long>(value));
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+}
+
+WebGLGetInfo WebGLRenderingContext::getShaderParameter(WebGLShader* shader, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return WebGLGetInfo();
+    }
+    WebGLStateRestorer(this, false);
+    int value = 0;
+    switch (pname) {
+    case GraphicsContext3D::DELETE_STATUS:
+    case GraphicsContext3D::COMPILE_STATUS:
+        m_context->getShaderiv(shader, pname, &value);
+        return WebGLGetInfo(static_cast<bool>(value));
+    case GraphicsContext3D::SHADER_TYPE:
+        m_context->getShaderiv(shader, pname, &value);
+        return WebGLGetInfo(static_cast<unsigned long>(value));
+    case GraphicsContext3D::INFO_LOG_LENGTH:
+    case GraphicsContext3D::SHADER_SOURCE_LENGTH:
+        m_context->getShaderiv(shader, pname, &value);
+        return WebGLGetInfo(static_cast<long>(value));
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+}
+
+String WebGLRenderingContext::getShaderInfoLog(WebGLShader* shader, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return "";
+    }
+    WebGLStateRestorer(this, false);
+    return m_context->getShaderInfoLog(shader);
+}
+
+String WebGLRenderingContext::getShaderSource(WebGLShader* shader, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return "";
+    }
+    WebGLStateRestorer(this, false);
+    return m_context->getShaderSource(shader);
+}
+
+String WebGLRenderingContext::getString(unsigned long name)
+{
+    WebGLStateRestorer(this, false);
+    return m_context->getString(name);
+}
+
+WebGLGetInfo WebGLRenderingContext::getTexParameter(unsigned long target, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target != GraphicsContext3D::TEXTURE_2D
+        && target != GraphicsContext3D::TEXTURE_CUBE_MAP) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+    WebGLStateRestorer(this, false);
+    int value = 0;
+    switch (pname) {
+    case GraphicsContext3D::TEXTURE_MAG_FILTER:
+    case GraphicsContext3D::TEXTURE_MIN_FILTER:
+    case GraphicsContext3D::TEXTURE_WRAP_S:
+    case GraphicsContext3D::TEXTURE_WRAP_T:
+        m_context->getTexParameteriv(target, pname, &value);
+        return WebGLGetInfo(static_cast<unsigned long>(value));
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+}
+
+WebGLGetInfo WebGLRenderingContext::getUniform(WebGLProgram* program, const WebGLUniformLocation* uniformLocation, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || uniformLocation->program() != program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return WebGLGetInfo();
+    }
+    long location = uniformLocation->location();
+    
+    WebGLStateRestorer(this, false);
+    // FIXME: make this more efficient using WebGLUniformLocation and caching types in it
+    int activeUniforms = 0;
+    m_context->getProgramiv(program, GraphicsContext3D::ACTIVE_UNIFORMS, &activeUniforms);
+    for (int i = 0; i < activeUniforms; i++) {
+        ActiveInfo info;
+        if (!m_context->getActiveUniform(program, i, info))
+            return WebGLGetInfo();
+        // Now need to look this up by name again to find its location
+        long loc = m_context->getUniformLocation(program, info.name);
+        if (loc == location) {
+            // Found it. Use the type in the ActiveInfo to determine the return type.
+            GraphicsContext3D::WebGLEnumType baseType;
+            unsigned length;
+            switch (info.type) {
+                case GraphicsContext3D::BOOL:
+                    baseType = GraphicsContext3D::BOOL;
+                    length = 1;
+                    break;
+                case GraphicsContext3D::BOOL_VEC2:
+                    baseType = GraphicsContext3D::BOOL;
+                    length = 2;
+                    break;
+                case GraphicsContext3D::BOOL_VEC3:
+                    baseType = GraphicsContext3D::BOOL;
+                    length = 3;
+                    break;
+                case GraphicsContext3D::BOOL_VEC4:
+                    baseType = GraphicsContext3D::BOOL;
+                    length = 4;
+                    break;
+                case GraphicsContext3D::INT:
+                    baseType = GraphicsContext3D::INT;
+                    length = 1;
+                    break;
+                case GraphicsContext3D::INT_VEC2:
+                    baseType = GraphicsContext3D::INT;
+                    length = 2;
+                    break;
+                case GraphicsContext3D::INT_VEC3:
+                    baseType = GraphicsContext3D::INT;
+                    length = 3;
+                    break;
+                case GraphicsContext3D::INT_VEC4:
+                    baseType = GraphicsContext3D::INT;
+                    length = 4;
+                    break;
+                case GraphicsContext3D::FLOAT:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 1;
+                    break;
+                case GraphicsContext3D::FLOAT_VEC2:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 2;
+                    break;
+                case GraphicsContext3D::FLOAT_VEC3:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 3;
+                    break;
+                case GraphicsContext3D::FLOAT_VEC4:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 4;
+                    break;
+                case GraphicsContext3D::FLOAT_MAT2:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 4;
+                    break;
+                case GraphicsContext3D::FLOAT_MAT3:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 9;
+                    break;
+                case GraphicsContext3D::FLOAT_MAT4:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 16;
+                    break;
+                default:
+                    // Can't handle this type
+                    // FIXME: what to do about samplers?
+                    m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+                    return WebGLGetInfo();
+            }
+            switch (baseType) {
+            case GraphicsContext3D::FLOAT: {
+                float value[16] = {0};
+                m_context->getUniformfv(program, location, value);
+                if (length == 1)
+                    return WebGLGetInfo(value[0]);
+                else
+                    return WebGLGetInfo(WebGLFloatArray::create(value, length));
+            }
+            case GraphicsContext3D::INT: {
+                int value[16] = {0};
+                m_context->getUniformiv(program, location, value);
+                if (length == 1)
+                    return WebGLGetInfo(static_cast<long>(value[0]));
+                else
+                    return WebGLGetInfo(WebGLIntArray::create(value, length));
+            }
+            case GraphicsContext3D::BOOL: {
+                int value[16] = {0};
+                m_context->getUniformiv(program, location, value);
+                if (length == 1)
+                    return WebGLGetInfo(static_cast<bool>(value[0]));
+                else {
+                    unsigned char boolValue[16] = {0};
+                    for (unsigned j = 0; j < length; j++)
+                        boolValue[j] = static_cast<bool>(value[j]);
+                    return WebGLGetInfo(WebGLUnsignedByteArray::create(boolValue, length));
+                }
+            }
+            default:
+                notImplemented();
+            }
+        }
+    }
+    // If we get here, something went wrong in our unfortunately complex logic above
+    m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+    return WebGLGetInfo();
+}
+
+PassRefPtr<WebGLUniformLocation> WebGLRenderingContext::getUniformLocation(WebGLProgram* program, const String& name, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return 0;
+    }
+    WebGLStateRestorer(this, false);
+    long uniformLocation = m_context->getUniformLocation(program, name);
+    if (uniformLocation == -1)
+        return 0;
+    return WebGLUniformLocation::create(program, uniformLocation);
+}
+
+WebGLGetInfo WebGLRenderingContext::getVertexAttrib(unsigned long index, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    WebGLStateRestorer(this, false);
+    switch (pname) {
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_BUFFER_BINDING: {
+        int name = 0;
+        m_context->getVertexAttribiv(index, pname, &name);
+        if (name == 0)
+            return WebGLGetInfo();
+        RefPtr<WebGLBuffer> tmp = WebGLBuffer::create(this, name);
+        addObject(tmp.get());
+        return WebGLGetInfo(PassRefPtr<WebGLBuffer>(tmp));
+    }
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_ENABLED:
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_NORMALIZED: {
+        int value = 0;
+        m_context->getVertexAttribiv(index, pname, &value);
+        return WebGLGetInfo(static_cast<bool>(value));
+    }
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_SIZE:
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_STRIDE: {
+        int value = 0;
+        m_context->getVertexAttribiv(index, pname, &value);
+        return WebGLGetInfo(static_cast<long>(value));
+    }
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_TYPE: {
+        int value = 0;
+        m_context->getVertexAttribiv(index, pname, &value);
+        return WebGLGetInfo(static_cast<unsigned long>(value));
+    }
+    case GraphicsContext3D::CURRENT_VERTEX_ATTRIB: {
+        float value[4] = {0};
+        m_context->getVertexAttribfv(index, pname, value);
+        return WebGLGetInfo(WebGLFloatArray::create(value, 4));
+    }
+    default: {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+    }
+}
+
+long WebGLRenderingContext::getVertexAttribOffset(unsigned long index, unsigned long pname)
+{
+    long result = m_context->getVertexAttribOffset(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+void WebGLRenderingContext::hint(unsigned long target, unsigned long mode)
+{
+    m_context->hint(target, mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+bool WebGLRenderingContext::isBuffer(WebGLBuffer* buffer)
+{
+    if (!buffer)
+        return false;
+
+    return m_context->isBuffer(buffer);
+}
+
+bool WebGLRenderingContext::isEnabled(unsigned long cap)
+{
+    return m_context->isEnabled(cap);
+}
+
+bool WebGLRenderingContext::isFramebuffer(WebGLFramebuffer* framebuffer)
+{
+    if (!framebuffer)
+        return false;
+
+    return m_context->isFramebuffer(framebuffer);
+}
+
+bool WebGLRenderingContext::isProgram(WebGLProgram* program)
+{
+    if (!program)
+        return false;
+
+    return m_context->isProgram(program);
+}
+
+bool WebGLRenderingContext::isRenderbuffer(WebGLRenderbuffer* renderbuffer)
+{
+    if (!renderbuffer)
+        return false;
+
+    return m_context->isRenderbuffer(renderbuffer);
+}
+
+bool WebGLRenderingContext::isShader(WebGLShader* shader)
+{
+    if (!shader)
+        return false;
+
+    return m_context->isShader(shader);
+}
+
+bool WebGLRenderingContext::isTexture(WebGLTexture* texture)
+{
+    if (!texture)
+        return false;
+
+    return m_context->isTexture(texture);
+}
+
+void WebGLRenderingContext::lineWidth(double width)
+{
+    m_context->lineWidth((float) width);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::linkProgram(WebGLProgram* program, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+        
+    m_context->linkProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::pixelStorei(unsigned long pname, long param)
+{
+    m_context->pixelStorei(pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::polygonOffset(double factor, double units)
+{
+    m_context->polygonOffset((float) factor, (float) units);
+    cleanupAfterGraphicsCall(false);
+}
+
+PassRefPtr<WebGLArray> WebGLRenderingContext::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
+{
+    RefPtr<WebGLArray> array = m_context->readPixels(x, y, width, height, format, type);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+void WebGLRenderingContext::releaseShaderCompiler()
+{
+    m_context->releaseShaderCompiler();
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height)
+{
+    m_context->renderbufferStorage(target, internalformat, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::sampleCoverage(double value, bool invert)
+{
+    m_context->sampleCoverage((float) value, invert);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::scissor(long x, long y, unsigned long width, unsigned long height)
+{
+    m_context->scissor(x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::shaderSource(WebGLShader* shader, const String& string, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->shaderSource(shader, string);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilFunc(unsigned long func, long ref, unsigned long mask)
+{
+    m_context->stencilFunc(func, ref, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask)
+{
+    m_context->stencilFuncSeparate(face, func, ref, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilMask(unsigned long mask)
+{
+    m_context->stencilMask(mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilMaskSeparate(unsigned long face, unsigned long mask)
+{
+    m_context->stencilMaskSeparate(face, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    m_context->stencilOp(fail, zfail, zpass);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    m_context->stencilOpSeparate(face, fail, zfail, zpass);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                                          unsigned width, unsigned height, unsigned border,
+                                          unsigned format, unsigned type, WebGLArray* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    // FIXME: Need to make sure passed buffer has enough bytes to define the texture
+    ec = 0;
+    m_context->texImage2D(target, level, internalformat, width, height,
+                          border, format, type, pixels ? pixels->baseAddress() : 0);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, ImageData* pixels,
+                                       bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    Vector<uint8_t> data;
+    m_context->extractImageData(pixels, flipY, premultiplyAlpha, data);
+    m_context->texImage2D(target, level, GraphicsContext3D::RGBA, pixels->width(), pixels->height(), 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, data.data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
+                                       bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    ec = 0;
+    if (!image) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+
+    CachedImage* cachedImage = image->cachedImage();
+    if (!cachedImage) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+
+    // FIXME: For now we ignore any errors returned
+    m_context->texImage2D(target, level, cachedImage->image(), flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    ec = 0;
+    if (!canvas) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+
+    ImageBuffer* buffer = canvas->buffer();
+    if (!buffer) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+
+    // FIXME: For now we ignore any errors returned
+    m_context->texImage2D(target, level, buffer->image(), flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: Need implement this call
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(video);
+    UNUSED_PARAM(flipY);
+    UNUSED_PARAM(premultiplyAlpha);
+    
+    ec = 0;
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texParameterf(unsigned target, unsigned pname, float param)
+{
+    m_context->texParameterf(target, pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texParameteri(unsigned target, unsigned pname, int param)
+{
+    m_context->texParameteri(target, pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height,
+                                             unsigned format, unsigned type, WebGLArray* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    // FIXME: Need to make sure passed buffer has enough bytes to define the texture
+    ec = 0;
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels ? pixels->baseAddress() : 0);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                          ImageData* pixels, bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    Vector<uint8_t> data;
+    m_context->extractImageData(pixels, flipY, premultiplyAlpha, data);
+    m_context->texSubImage2D(target, level, xoffset, yoffset, pixels->width(), pixels->height(), GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, data.data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                          HTMLImageElement* image, bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    if (!image) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    CachedImage* cachedImage = image->cachedImage();
+    if (!cachedImage) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+
+    m_context->texSubImage2D(target, level, xoffset, yoffset, cachedImage->image(), flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                          HTMLCanvasElement* canvas, bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    ec = 0;
+    if (!canvas) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    ImageBuffer* buffer = canvas->buffer();
+    if (!buffer) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    // FIXME: For now we ignore any errors returned
+    m_context->texSubImage2D(target, level, xoffset, yoffset, buffer->image(), flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                          HTMLVideoElement* video, bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: Need to implement this call
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(xoffset);
+    UNUSED_PARAM(yoffset);
+    UNUSED_PARAM(video);
+    UNUSED_PARAM(flipY);
+    UNUSED_PARAM(premultiplyAlpha);
+    ec = 0;
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1f(const WebGLUniformLocation* location, float x, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform1f(location->location(), x);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    m_context->uniform1fv(location->location(), v->data(), v->length());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    m_context->uniform1fv(location->location(), v, size);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1i(const WebGLUniformLocation* location, int x, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform1i(location->location(), x);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    m_context->uniform1iv(location->location(), v->data(), v->length());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    m_context->uniform1iv(location->location(), v, size);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2f(const WebGLUniformLocation* location, float x, float y, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform2f(location->location(), x, y);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 2
+    m_context->uniform2fv(location->location(), v->data(), v->length() / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 2
+    m_context->uniform2fv(location->location(), v, size / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2i(const WebGLUniformLocation* location, int x, int y, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform2i(location->location(), x, y);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 2
+    m_context->uniform2iv(location->location(), v->data(), v->length() / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 2
+    m_context->uniform2iv(location->location(), v, size / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3f(const WebGLUniformLocation* location, float x, float y, float z, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform3f(location->location(), x, y, z);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 3
+    m_context->uniform3fv(location->location(), v->data(), v->length() / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 3
+    m_context->uniform3fv(location->location(), v, size / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3i(const WebGLUniformLocation* location, int x, int y, int z, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform3i(location->location(), x, y, z);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 3
+    m_context->uniform3iv(location->location(), v->data(), v->length() / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 3
+    m_context->uniform3iv(location->location(), v, size / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4f(const WebGLUniformLocation* location, float x, float y, float z, float w, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform4f(location->location(), x, y, z, w);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniform4fv(location->location(), v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniform4fv(location->location(), v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4i(const WebGLUniformLocation* location, int x, int y, int z, int w, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform4i(location->location(), x, y, z, w);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniform4iv(location->location(), v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniform4iv(location->location(), v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniformMatrix2fv(location->location(), transpose, v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniformMatrix2fv(location->location(), transpose, v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 9
+    m_context->uniformMatrix3fv(location->location(), transpose, v->data(), v->length() / 9);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 9
+    m_context->uniformMatrix3fv(location->location(), transpose, v, size / 9);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 16
+    m_context->uniformMatrix4fv(location->location(), transpose, v->data(), v->length() / 16);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 16
+    m_context->uniformMatrix4fv(location->location(), transpose, v, size / 16);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::useProgram(WebGLProgram* program, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+        
+    m_currentProgram = program;
+    m_context->useProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::validateProgram(WebGLProgram* program, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+        
+    m_context->validateProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib1f(unsigned long indx, float v0)
+{
+    m_context->vertexAttrib1f(indx, v0);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib1fv(unsigned long indx, WebGLFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context->vertexAttrib1fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib1fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context->vertexAttrib1fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib2f(unsigned long indx, float v0, float v1)
+{
+    m_context->vertexAttrib2f(indx, v0, v1);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib2fv(unsigned long indx, WebGLFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context->vertexAttrib2fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib2fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context->vertexAttrib2fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib3f(unsigned long indx, float v0, float v1, float v2)
+{
+    m_context->vertexAttrib3f(indx, v0, v1, v2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib3fv(unsigned long indx, WebGLFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context->vertexAttrib3fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib3fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context->vertexAttrib3fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib4f(unsigned long indx, float v0, float v1, float v2, float v3)
+{
+    m_context->vertexAttrib4f(indx, v0, v1, v2, v3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib4fv(unsigned long indx, WebGLFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context->vertexAttrib4fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib4fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context->vertexAttrib4fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized, unsigned long stride, unsigned long offset, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!m_boundArrayBuffer || indx >= m_maxVertexAttribs) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    if (indx >= m_vertexAttribState.size())
+        m_vertexAttribState.resize(indx + 1);
+
+    // Determine the number of elements the bound buffer can hold, given the offset, size, type and stride
+    long bytesPerElement = size * sizeInBytes(type, ec);
+    if (bytesPerElement <= 0)
+        return;
+    long validatedStride = bytesPerElement;
+    if (stride != 0) {
+        if ((long) stride < bytesPerElement) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+        
+        validatedStride = stride;
+    }
+        
+    // Avoid off-by-one errors in numElements computation.
+    // For the last element, we will only touch the data for the
+    // element and nothing beyond it.
+    long bytesRemaining = m_boundArrayBuffer->byteLength(GraphicsContext3D::ARRAY_BUFFER) - offset;
+    if (bytesRemaining < bytesPerElement)
+        m_vertexAttribState[indx].numElements = 0;
+    else
+        m_vertexAttribState[indx].numElements = 1 + (bytesRemaining - bytesPerElement) / validatedStride;
+
+    m_context->vertexAttribPointer(indx, size, type, normalized, stride, offset);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::viewport(long x, long y, unsigned long width, unsigned long height)
+{
+    if (isnan(x))
+        x = 0;
+    if (isnan(y))
+        y = 0;
+    if (isnan(width))
+        width = 100;
+    if (isnan(height))
+        height = 100;
+    m_context->viewport(x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::removeObject(CanvasObject* object)
+{
+    m_canvasObjects.remove(object);
+}
+
+void WebGLRenderingContext::addObject(CanvasObject* object)
+{
+    removeObject(object);
+    m_canvasObjects.add(object);
+}
+
+void WebGLRenderingContext::detachAndRemoveAllObjects()
+{
+    HashSet<RefPtr<CanvasObject> >::iterator pend = m_canvasObjects.end();
+    for (HashSet<RefPtr<CanvasObject> >::iterator it = m_canvasObjects.begin(); it != pend; ++it)
+        (*it)->detachContext();
+        
+    m_canvasObjects.clear();
+}
+
+WebGLGetInfo WebGLRenderingContext::getBooleanParameter(unsigned long pname)
+{
+    unsigned char value;
+    m_context->getBooleanv(pname, &value);
+    return WebGLGetInfo(static_cast<bool>(value));
+}
+
+WebGLGetInfo WebGLRenderingContext::getFloatParameter(unsigned long pname)
+{
+    float value;
+    m_context->getFloatv(pname, &value);
+    return WebGLGetInfo(static_cast<float>(value));
+}
+
+WebGLGetInfo WebGLRenderingContext::getIntParameter(unsigned long pname)
+{
+    return getLongParameter(pname);
+}
+
+WebGLGetInfo WebGLRenderingContext::getLongParameter(unsigned long pname)
+{
+    int value;
+    m_context->getIntegerv(pname, &value);
+    return WebGLGetInfo(static_cast<long>(value));
+}
+
+WebGLGetInfo WebGLRenderingContext::getUnsignedLongParameter(unsigned long pname)
+{
+    int value;
+    m_context->getIntegerv(pname, &value);
+    return WebGLGetInfo(static_cast<unsigned long>(value));
+}
+
+WebGLGetInfo WebGLRenderingContext::getWebGLFloatArrayParameter(unsigned long pname)
+{
+    float value[4] = {0};
+    m_context->getFloatv(pname, value);
+    unsigned length = 0;
+    switch (pname) {
+    case GraphicsContext3D::ALIASED_POINT_SIZE_RANGE:
+    case GraphicsContext3D::ALIASED_LINE_WIDTH_RANGE:
+    case GraphicsContext3D::DEPTH_RANGE:
+        length = 2;
+        break;
+    case GraphicsContext3D::BLEND_COLOR:
+    case GraphicsContext3D::COLOR_CLEAR_VALUE:
+        length = 4;
+        break;
+    default:
+        notImplemented();
+    }
+    return WebGLGetInfo(WebGLFloatArray::create(value, length));
+}
+
+WebGLGetInfo WebGLRenderingContext::getWebGLIntArrayParameter(unsigned long pname)
+{
+    int value[4] = {0};
+    m_context->getIntegerv(pname, value);
+    unsigned length = 0;
+    switch (pname) {
+    case GraphicsContext3D::MAX_VIEWPORT_DIMS:
+        length = 2;
+        break;
+    case GraphicsContext3D::SCISSOR_BOX:
+    case GraphicsContext3D::VIEWPORT:
+        length = 4;
+        break;
+    default:
+        notImplemented();
+    }
+    return WebGLGetInfo(WebGLIntArray::create(value, length));
+}
+
+WebGLGetInfo WebGLRenderingContext::getWebGLUnsignedByteArrayParameter(unsigned long pname)
+{
+    unsigned char value[4] = {0};
+    m_context->getBooleanv(pname, value);
+    unsigned length = 0;
+    switch (pname) {
+    case GraphicsContext3D::COLOR_WRITEMASK:
+        length = 4;
+        break;
+    default:
+        notImplemented();
+    }
+    return WebGLGetInfo(WebGLUnsignedByteArray::create(value, length));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLRenderingContext.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLRenderingContext.h
new file mode 100644
index 0000000000..90d4fab3b9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLRenderingContext.h
@@ -0,0 +1,360 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLRenderingContext_h
+#define WebGLRenderingContext_h
+
+#include "CanvasRenderingContext.h"
+#include "ExceptionCode.h"
+#include "WebGLFloatArray.h"
+#include "WebGLGetInfo.h"
+#include "WebGLIntArray.h"
+#include "WebGLUnsignedByteArray.h"
+#include "GraphicsContext3D.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+class WebGLActiveInfo;
+class WebGLBuffer;
+class WebGLContextAttributes;
+class WebGLFramebuffer;
+class CanvasObject;
+class WebGLProgram;
+class WebGLRenderbuffer;
+class WebGLShader;
+class WebGLTexture;
+class WebGLUniformLocation;
+class HTMLImageElement;
+class HTMLVideoElement;
+class ImageData;
+class WebKitCSSMatrix;
+
+    class WebGLRenderingContext : public CanvasRenderingContext {
+    public:
+        static PassOwnPtr<WebGLRenderingContext> create(HTMLCanvasElement*, WebGLContextAttributes*);
+        virtual ~WebGLRenderingContext();
+
+        virtual bool is3d() const { return true; }
+
+        // Helper to return the size in bytes of OpenGL data types
+        // like GL_FLOAT, GL_INT, etc.
+        int sizeInBytes(int type, ExceptionCode& ec);
+
+        void activeTexture(unsigned long texture, ExceptionCode& ec);
+        void attachShader(WebGLProgram*, WebGLShader*, ExceptionCode& ec);
+        void bindAttribLocation(WebGLProgram*, unsigned long index, const String& name, ExceptionCode& ec);
+        void bindBuffer(unsigned long target, WebGLBuffer*, ExceptionCode& ec);
+        void bindFramebuffer(unsigned long target, WebGLFramebuffer*, ExceptionCode& ec);
+        void bindRenderbuffer(unsigned long target, WebGLRenderbuffer*, ExceptionCode& ec);
+        void bindTexture(unsigned long target, WebGLTexture*, ExceptionCode& ec);
+        void blendColor(double red, double green, double blue, double alpha);
+        void blendEquation(unsigned long mode);
+        void blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha);
+        void blendFunc(unsigned long sfactor, unsigned long dfactor);
+        void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
+
+        void bufferData(unsigned long target, int size, unsigned long usage, ExceptionCode&);
+        void bufferData(unsigned long target, WebGLArray* data, unsigned long usage, ExceptionCode&);
+        void bufferSubData(unsigned long target, long offset, WebGLArray* data, ExceptionCode&);
+
+        unsigned long checkFramebufferStatus(unsigned long target);
+        void clear(unsigned long mask);
+        void clearColor(double red, double green, double blue, double alpha);
+        void clearDepth(double);
+        void clearStencil(long);
+        void colorMask(bool red, bool green, bool blue, bool alpha);
+        void compileShader(WebGLShader*, ExceptionCode& ec);
+        
+        //void compressedTexImage2D(unsigned long target, long level, unsigned long internalformat, unsigned long width, unsigned long height, long border, unsigned long imageSize, const void* data);
+        //void compressedTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, unsigned long width, unsigned long height, unsigned long format, unsigned long imageSize, const void* data);
+        
+        void copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border);
+        void copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height);
+
+        PassRefPtr<WebGLBuffer> createBuffer();
+        PassRefPtr<WebGLFramebuffer> createFramebuffer();
+        PassRefPtr<WebGLProgram> createProgram();
+        PassRefPtr<WebGLRenderbuffer> createRenderbuffer();
+        PassRefPtr<WebGLShader> createShader(unsigned long type, ExceptionCode&);
+        PassRefPtr<WebGLTexture> createTexture();
+
+        void cullFace(unsigned long mode);
+
+        void deleteBuffer(WebGLBuffer*);
+        void deleteFramebuffer(WebGLFramebuffer*);
+        void deleteProgram(WebGLProgram*);
+        void deleteRenderbuffer(WebGLRenderbuffer*);
+        void deleteShader(WebGLShader*);
+        void deleteTexture(WebGLTexture*);
+        
+        void depthFunc(unsigned long);
+        void depthMask(bool);
+        void depthRange(double zNear, double zFar);
+        void detachShader(WebGLProgram*, WebGLShader*, ExceptionCode&);
+        void disable(unsigned long cap);
+        void disableVertexAttribArray(unsigned long index, ExceptionCode&);
+        void drawArrays(unsigned long mode, long first, long count, ExceptionCode&);
+        void drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset, ExceptionCode&);
+
+        void enable(unsigned long cap);
+        void enableVertexAttribArray(unsigned long index, ExceptionCode&);
+        void finish();
+        void flush();
+        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, WebGLRenderbuffer*, ExceptionCode& ec);
+        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, WebGLTexture*, long level, ExceptionCode& ec);
+        void frontFace(unsigned long mode);
+        void generateMipmap(unsigned long target);
+
+        PassRefPtr<WebGLActiveInfo> getActiveAttrib(WebGLProgram*, unsigned long index, ExceptionCode&);
+        PassRefPtr<WebGLActiveInfo> getActiveUniform(WebGLProgram*, unsigned long index, ExceptionCode&);
+
+        int  getAttribLocation(WebGLProgram*, const String& name);
+
+        WebGLGetInfo getBufferParameter(unsigned long target, unsigned long pname, ExceptionCode&);
+
+        PassRefPtr<WebGLContextAttributes> getContextAttributes();
+
+        unsigned long getError();
+
+        WebGLGetInfo getFramebufferAttachmentParameter(unsigned long target, unsigned long attachment, unsigned long pname, ExceptionCode&);
+
+        WebGLGetInfo getParameter(unsigned long pname, ExceptionCode&);
+
+        WebGLGetInfo getProgramParameter(WebGLProgram*, unsigned long pname, ExceptionCode&);
+
+        String getProgramInfoLog(WebGLProgram*, ExceptionCode& ec);
+
+        WebGLGetInfo getRenderbufferParameter(unsigned long target, unsigned long pname, ExceptionCode&);
+
+        WebGLGetInfo getShaderParameter(WebGLShader*, unsigned long pname, ExceptionCode& ec);
+
+        String getShaderInfoLog(WebGLShader*, ExceptionCode& ec);
+
+        // TBD
+        // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
+
+        String getShaderSource(WebGLShader*, ExceptionCode&);
+        String getString(unsigned long name);
+
+        WebGLGetInfo getTexParameter(unsigned long target, unsigned long pname, ExceptionCode&);
+
+        WebGLGetInfo getUniform(WebGLProgram*, const WebGLUniformLocation*, ExceptionCode&);
+
+        PassRefPtr<WebGLUniformLocation> getUniformLocation(WebGLProgram*, const String&, ExceptionCode&);
+
+        WebGLGetInfo getVertexAttrib(unsigned long index, unsigned long pname, ExceptionCode&);
+
+        long getVertexAttribOffset(unsigned long index, unsigned long pname);
+
+        void hint(unsigned long target, unsigned long mode);
+        bool isBuffer(WebGLBuffer*);
+        bool isEnabled(unsigned long cap);
+        bool isFramebuffer(WebGLFramebuffer*);
+        bool isProgram(WebGLProgram*);
+        bool isRenderbuffer(WebGLRenderbuffer*);
+        bool isShader(WebGLShader*);
+        bool isTexture(WebGLTexture*);
+        void lineWidth(double);
+        void linkProgram(WebGLProgram*, ExceptionCode&);
+        void pixelStorei(unsigned long pname, long param);
+        void polygonOffset(double factor, double units);
+        
+        PassRefPtr<WebGLArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
+        
+        void releaseShaderCompiler();
+        void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
+        void sampleCoverage(double value, bool invert);
+        void scissor(long x, long y, unsigned long width, unsigned long height);
+        void shaderSource(WebGLShader*, const String&, ExceptionCode&);
+        void stencilFunc(unsigned long func, long ref, unsigned long mask);
+        void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
+        void stencilMask(unsigned long);
+        void stencilMaskSeparate(unsigned long face, unsigned long mask);
+        void stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass);
+        void stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass);
+
+        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                        unsigned width, unsigned height, unsigned border,
+                        unsigned format, unsigned type, WebGLArray* pixels, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, ImageData* pixels,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+
+        void texParameterf(unsigned target, unsigned pname, float param);
+        void texParameteri(unsigned target, unsigned pname, int param);
+
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height,
+                           unsigned format, unsigned type, WebGLArray* pixels, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           ImageData* pixels, bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           HTMLImageElement* image, bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           HTMLCanvasElement* canvas, bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           HTMLVideoElement* video, bool flipY, bool premultiplyAlpha, ExceptionCode&);
+
+        void uniform1f(const WebGLUniformLocation* location, float x, ExceptionCode&);
+        void uniform1fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode&);
+        void uniform1fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode&);
+        void uniform1i(const WebGLUniformLocation* location, int x, ExceptionCode&);
+        void uniform1iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode&);
+        void uniform1iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode&);
+        void uniform2f(const WebGLUniformLocation* location, float x, float y, ExceptionCode&);
+        void uniform2fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode&);
+        void uniform2fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode&);
+        void uniform2i(const WebGLUniformLocation* location, int x, int y, ExceptionCode&);
+        void uniform2iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode&);
+        void uniform2iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode&);
+        void uniform3f(const WebGLUniformLocation* location, float x, float y, float z, ExceptionCode&);
+        void uniform3fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode&);
+        void uniform3fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode&);
+        void uniform3i(const WebGLUniformLocation* location, int x, int y, int z, ExceptionCode&);
+        void uniform3iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode&);
+        void uniform3iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode&);
+        void uniform4f(const WebGLUniformLocation* location, float x, float y, float z, float w, ExceptionCode&);
+        void uniform4fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode&);
+        void uniform4fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode&);
+        void uniform4i(const WebGLUniformLocation* location, int x, int y, int z, int w, ExceptionCode&);
+        void uniform4iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode&);
+        void uniform4iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode&);
+        void uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* value, ExceptionCode&);
+        void uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, float* value, int size, ExceptionCode&);
+        void uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* value, ExceptionCode&);
+        void uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, float* value, int size, ExceptionCode&);
+        void uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* value, ExceptionCode&);
+        void uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, float* value, int size, ExceptionCode&);
+
+        void useProgram(WebGLProgram*, ExceptionCode&);
+        void validateProgram(WebGLProgram*, ExceptionCode&);
+
+        void vertexAttrib1f(unsigned long indx, float x);
+        void vertexAttrib1fv(unsigned long indx, WebGLFloatArray* values);
+        void vertexAttrib1fv(unsigned long indx, float* values, int size);
+        void vertexAttrib2f(unsigned long indx, float x, float y);
+        void vertexAttrib2fv(unsigned long indx, WebGLFloatArray* values);
+        void vertexAttrib2fv(unsigned long indx, float* values, int size);
+        void vertexAttrib3f(unsigned long indx, float x, float y, float z);
+        void vertexAttrib3fv(unsigned long indx, WebGLFloatArray* values);
+        void vertexAttrib3fv(unsigned long indx, float* values, int size);
+        void vertexAttrib4f(unsigned long indx, float x, float y, float z, float w);
+        void vertexAttrib4fv(unsigned long indx, WebGLFloatArray* values);
+        void vertexAttrib4fv(unsigned long indx, float* values, int size);
+        void vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized,
+                                 unsigned long stride, unsigned long offset, ExceptionCode&);
+
+        void viewport(long x, long y, unsigned long width, unsigned long height);
+
+        GraphicsContext3D* graphicsContext3D() const { return m_context.get(); }
+    
+        void reshape(int width, int height);
+
+        // Helpers for notification about paint events.
+        void beginPaint();
+        void endPaint();
+        
+        void removeObject(CanvasObject*);
+        
+    private:
+        friend class CanvasObject;
+
+        WebGLRenderingContext(HTMLCanvasElement*, PassOwnPtr<GraphicsContext3D>);
+
+        void addObject(CanvasObject*);
+        void detachAndRemoveAllObjects();
+
+        void markContextChanged();
+        void cleanupAfterGraphicsCall(bool changed)
+        {
+            if (changed)
+                markContextChanged();
+        }
+        
+        // Basic validation of count and offset against number of elements in element array buffer
+        bool validateElementArraySize(unsigned long count, unsigned long type, long offset);
+
+        // Conservative but quick index validation
+        bool validateIndexArrayConservative(unsigned long type, long& numElementsRequired);
+
+        // Precise but slow index validation -- only done if conservative checks fail
+        bool validateIndexArrayPrecise(unsigned long count, unsigned long type, long offset, long& numElementsRequired);
+        bool validateRenderingState(long numElements);
+
+        OwnPtr<GraphicsContext3D> m_context;
+        bool m_needsUpdate;
+        bool m_markedCanvasDirty;
+        // FIXME: I think this is broken -- it does not increment any
+        // reference counts, so may refer to destroyed objects.
+        HashSet<RefPtr<CanvasObject> > m_canvasObjects;
+        
+        // List of bound VBO's. Used to maintain info about sizes for ARRAY_BUFFER and stored values for ELEMENT_ARRAY_BUFFER
+        RefPtr<WebGLBuffer> m_boundArrayBuffer;
+        RefPtr<WebGLBuffer> m_boundElementArrayBuffer;
+    
+        // Cached values for vertex attrib range checks
+        class VertexAttribState {
+        public:
+            VertexAttribState() : enabled(false), numElements(0) { }
+            bool enabled;
+            long numElements;
+        };
+        
+        Vector<VertexAttribState> m_vertexAttribState;
+        unsigned m_maxVertexAttribs;
+
+        RefPtr<WebGLProgram> m_currentProgram;
+        RefPtr<WebGLFramebuffer> m_framebufferBinding;
+        RefPtr<WebGLRenderbuffer> m_renderbufferBinding;
+        class TextureUnitState {
+        public:
+            RefPtr<WebGLTexture> m_texture2DBinding;
+            RefPtr<WebGLTexture> m_textureCubeMapBinding;
+        };
+        TextureUnitState m_textureUnits[32];
+        unsigned long m_activeTextureUnit;
+
+        // Helpers for getParameter and others
+        WebGLGetInfo getBooleanParameter(unsigned long pname);
+        WebGLGetInfo getFloatParameter(unsigned long pname);
+        WebGLGetInfo getIntParameter(unsigned long pname);
+        WebGLGetInfo getLongParameter(unsigned long pname);
+        WebGLGetInfo getUnsignedLongParameter(unsigned long pname);
+        WebGLGetInfo getWebGLFloatArrayParameter(unsigned long pname);
+        WebGLGetInfo getWebGLIntArrayParameter(unsigned long pname);
+        WebGLGetInfo getWebGLUnsignedByteArrayParameter(unsigned long pname);
+
+        friend class WebGLStateRestorer;
+    };
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLRenderingContext.idl
index db0fff34b9..ce01f43c90 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLRenderingContext.idl
@@ -27,10 +27,9 @@ module html {
 
     interface [
         Conditional=3D_CANVAS,
-        GenerateConstructor,
         InterfaceUUID=98fb48ae-7216-489c-862b-8e1217fc4443,
         ImplementationUUID=ab4f0781-152f-450e-9546-5b3987491a54
-    ] CanvasRenderingContext3D : CanvasRenderingContext {
+    ] WebGLRenderingContext : CanvasRenderingContext {
 
         /* ClearBufferMask */
         const unsigned int DEPTH_BUFFER_BIT               = 0x00000100;
@@ -460,25 +459,26 @@ module html {
 
         long sizeInBytes(in unsigned long type) raises(DOMException);
 
-        void         activeTexture(in unsigned long texture);
-        void         attachShader(in CanvasProgram program, in CanvasShader shader);
-        void         bindAttribLocation(in CanvasProgram program, in unsigned long index, in DOMString name);
-        void         bindBuffer(in unsigned long target, in CanvasBuffer buffer);
-        void         bindFramebuffer(in unsigned long target, in CanvasFramebuffer framebuffer);
-        void         bindRenderbuffer(in unsigned long target, in CanvasRenderbuffer renderbuffer);
-        void         bindTexture(in unsigned long target, in CanvasTexture texture);
+        void         activeTexture(in unsigned long texture) raises(DOMException);
+        void         attachShader(in WebGLProgram program, in WebGLShader shader) raises(DOMException);
+        void         bindAttribLocation(in WebGLProgram program, in unsigned long index, in DOMString name) raises(DOMException);
+        void         bindBuffer(in unsigned long target, in WebGLBuffer buffer) raises(DOMException);
+        void         bindFramebuffer(in unsigned long target, in WebGLFramebuffer framebuffer) raises(DOMException);
+        void         bindRenderbuffer(in unsigned long target, in WebGLRenderbuffer renderbuffer) raises(DOMException);
+        void         bindTexture(in unsigned long target, in WebGLTexture texture) raises(DOMException);
         void         blendColor(in double red, in double green, in double blue, in double alpha);
         void         blendEquation( in unsigned long mode );
         void         blendEquationSeparate(in unsigned long modeRGB, in unsigned long modeAlpha);
         void         blendFunc(in unsigned long sfactor, in unsigned long dfactor);
         void         blendFuncSeparate(in unsigned long srcRGB, in unsigned long dstRGB, in unsigned long srcAlpha, in unsigned long dstAlpha);
+
         // Supported forms:
         //   void bufferData (in GLenum target, in GLsizei size, in GLenum usage);
-        //   void bufferData (in GLenum target, in CanvasArray data, in GLenum usage);
-        [Custom] void bufferData();
+        //   void bufferData (in GLenum target, in WebGLArray data, in GLenum usage);
+        [Custom] void bufferData() raises(DOMException);
         // Supported forms:
-        //   void bufferSubData (in GLenum target, in GLsizeiptr offset, in CanvasArray data);
-        [Custom] void bufferSubData();
+        //   void bufferSubData (in GLenum target, in GLsizeiptr offset, in WebGLArray data);
+        [Custom] void bufferSubData() raises(DOMException);
 
         unsigned long checkFramebufferStatus(in unsigned long target);
         void         clear(in unsigned long mask);
@@ -486,7 +486,7 @@ module html {
         void         clearDepth(in double depth);
         void         clearStencil(in long s);
         void         colorMask(in boolean red, in boolean green, in boolean blue, in boolean alpha);
-        void         compileShader(in CanvasShader shader);
+        void         compileShader(in WebGLShader shader) raises(DOMException);
         
         //void         compressedTexImage2D(in unsigned long target, in long level, in unsigned long internalformat, in unsigned long width, in unsigned long height, in long border, in unsigned long imageSize, const void* data);
         //void         compressedTexSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long imageSize, const void* data);
@@ -494,119 +494,110 @@ module html {
         void         copyTexImage2D(in unsigned long target, in long level, in unsigned long internalformat, in long x, in long y, in unsigned long width, in unsigned long height, in long border);
         void         copyTexSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset, in long x, in long y, in unsigned long width, in unsigned long height);
 
-        CanvasBuffer createBuffer();
-        CanvasFramebuffer createFramebuffer();
-        CanvasProgram createProgram();
-        CanvasRenderbuffer createRenderbuffer();
-        CanvasShader createShader(in unsigned long type);
-        CanvasTexture createTexture();
+        WebGLBuffer createBuffer();
+        WebGLFramebuffer createFramebuffer();
+        WebGLProgram createProgram();
+        WebGLRenderbuffer createRenderbuffer();
+        WebGLShader createShader(in unsigned long type) raises(DOMException);
+        WebGLTexture createTexture();
 
         void         cullFace(in unsigned long mode);
 
-        void         deleteBuffer(in CanvasBuffer buffer);
-        void         deleteFramebuffer(in CanvasFramebuffer framebuffer);
-        void         deleteProgram(in CanvasProgram program);
-        void         deleteRenderbuffer(in CanvasRenderbuffer renderbuffer);
-        void         deleteShader(in CanvasShader shader);
-        void         deleteTexture(in CanvasTexture texture);
+        void         deleteBuffer(in WebGLBuffer buffer);
+        void         deleteFramebuffer(in WebGLFramebuffer framebuffer);
+        void         deleteProgram(in WebGLProgram program);
+        void         deleteRenderbuffer(in WebGLRenderbuffer renderbuffer);
+        void         deleteShader(in WebGLShader shader);
+        void         deleteTexture(in WebGLTexture texture);
 
         void         depthFunc(in unsigned long func);
         void         depthMask(in boolean flag);
         // FIXME: this differs from the current WebGL spec (depthRangef)
         void         depthRange(in double zNear, in double zFar);
-        void         detachShader(in CanvasProgram program, in CanvasShader shader);
+        void         detachShader(in WebGLProgram program, in WebGLShader shader) raises(DOMException);
         void         disable(in unsigned long cap);
-        void         disableVertexAttribArray(in unsigned long index);
-        void         drawArrays(in unsigned long mode, in long first, in unsigned long count);
-        void         drawElements (in unsigned long mode, in long count, in unsigned long type, in unsigned long offset);
+        void         disableVertexAttribArray(in unsigned long index) raises(DOMException);
+        void         drawArrays(in unsigned long mode, in long first, in unsigned long count) raises(DOMException);
+        void         drawElements (in unsigned long mode, in long count, in unsigned long type, in unsigned long offset) raises(DOMException);
 
         void         enable(in unsigned long cap);
-        void         enableVertexAttribArray(in unsigned long index);
+        void         enableVertexAttribArray(in unsigned long index) raises(DOMException);
         void         finish();
         void         flush();
-        void         framebufferRenderbuffer(in unsigned long target, in unsigned long attachment, in unsigned long renderbuffertarget, in CanvasRenderbuffer renderbuffer);
-        void         framebufferTexture2D(in unsigned long target, in unsigned long attachment, in unsigned long textarget, in CanvasTexture texture, in long level);
+        void         framebufferRenderbuffer(in unsigned long target, in unsigned long attachment, in unsigned long renderbuffertarget, in WebGLRenderbuffer renderbuffer) raises(DOMException);
+        void         framebufferTexture2D(in unsigned long target, in unsigned long attachment, in unsigned long textarget, in WebGLTexture texture, in long level) raises(DOMException);
         void         frontFace(in unsigned long mode);
         void         generateMipmap(in unsigned long target);
         
-        // FIXME: these need to be added per the WebGL spec
-        CanvasActiveInfo getActiveAttrib(in CanvasProgram program, in unsigned long index)
+        WebGLActiveInfo getActiveAttrib(in WebGLProgram program, in unsigned long index)
             raises (DOMException);
-        CanvasActiveInfo getActiveUniform(in CanvasProgram program, in unsigned long index)
+        WebGLActiveInfo getActiveUniform(in WebGLProgram program, in unsigned long index)
             raises (DOMException);
 
-        // CanvasShaderArray glGetAttachedShaders(GLuint program);
+        // WebGLShaderArray glGetAttachedShaders(GLuint program);
+
+        int          getAttribLocation(in WebGLProgram program, in DOMString name);
 
-        int          getAttribLocation(in CanvasProgram program, in DOMString name);
+        // any getBufferParameter(in unsigned long target, in unsigned long pname) raises(DOMException);
+        [Custom] void getBufferParameter();
 
-        boolean getBoolean(in unsigned long pname);
-        CanvasUnsignedByteArray getBooleanv(in unsigned long pname);
-        long getBufferParameteri(in unsigned long target, in unsigned long pname);
-        CanvasIntArray getBufferParameteriv(in unsigned long target, in unsigned long pname);
+        WebGLContextAttributes getContextAttributes();
 
         unsigned long getError();
 
-        float getFloat(in unsigned long pname);
-        CanvasFloatArray getFloatv(in unsigned long pname);
-        long getFramebufferAttachmentParameteri(in unsigned long target, in unsigned long attachment, in unsigned long pname);
-        CanvasIntArray getFramebufferAttachmentParameteriv(in unsigned long target, in unsigned long attachment, in unsigned long pname);
-        long getInteger(in unsigned long pname);
-        CanvasIntArray getIntegerv(in unsigned long pname);
-        long getProgrami(in CanvasProgram program, in unsigned long pname);
-        CanvasIntArray getProgramiv(in CanvasProgram program, in unsigned long pname);
-        DOMString getProgramInfoLog(in CanvasProgram program);
-        long getRenderbufferParameteri(in unsigned long target, in unsigned long pname);
-        CanvasIntArray getRenderbufferParameteriv(in unsigned long target, in unsigned long pname);
-        long getShaderi(in CanvasShader shader, in unsigned long pname);
-        CanvasIntArray getShaderiv(in CanvasShader shader, in unsigned long pname);
-
-        DOMString    getShaderInfoLog(in CanvasShader shader);
+        // any getFramebufferAttachmentParameter(in unsigned long target, in unsigned long attachment, in unsigned long pname) raises(DOMException);
+        [Custom] void getFramebufferAttachmentParameter();
+        // any getParameter(in unsigned long pname) raises(DOMException);
+        [Custom] void getParameter();
+        // any getProgramParameter(in WebGLProgram program, in unsigned long pname) raises(DOMException);
+        [Custom] void getProgramParameter();
+        DOMString getProgramInfoLog(in WebGLProgram program) raises(DOMException);
+        // any getRenderbufferParameter(in unsigned long target, in unsigned long pname) raises(DOMException);
+        [Custom] void getRenderbufferParameter();
+        // any getShaderParameter(in WebGLShader shader, in unsigned long pname) raises(DOMException);
+        [Custom] void getShaderParameter() raises(DOMException);
+
+        DOMString    getShaderInfoLog(in WebGLShader shader) raises(DOMException);
 
         // TBD
         // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
 
-        DOMString    getShaderSource(in CanvasShader shader);
+        DOMString    getShaderSource(in WebGLShader shader) raises(DOMException);
         DOMString    getString(in unsigned long name);
 
-        float getTexParameterf(in unsigned long target, in unsigned long pname);
-        CanvasFloatArray getTexParameterfv(in unsigned long target, in unsigned long pname);
-        long getTexParameteri(in unsigned long target, in unsigned long pname);
-        CanvasIntArray getTexParameteriv(in unsigned long target, in unsigned long pname);
+        // any getTexParameter(in unsigned long target, in unsigned long pname) raises(DOMException);
+        [Custom] void getTexParameter();
 
-        float getUniformf(in CanvasProgram program, in long location);
-        CanvasFloatArray getUniformfv(in CanvasProgram program, in long location);
-        long getUniformi(in CanvasProgram program, in long location);
-        CanvasIntArray getUniformiv(in CanvasProgram program, in long location);
-        
-        long getUniformLocation(in CanvasProgram program, in DOMString name);
+        // any getUniform(in WebGLProgram program, in WebGLUniformLocation location) raises(DOMException);
+        [Custom] void getUniform();
+
+        WebGLUniformLocation getUniformLocation(in WebGLProgram program, in DOMString name) raises(DOMException);
 
-        float getVertexAttribf(in unsigned long index, in unsigned long pname);
-        CanvasFloatArray getVertexAttribfv(in unsigned long index, in unsigned long pname);
-        long getVertexAttribi(in unsigned long index, in unsigned long pname);
-        CanvasIntArray getVertexAttribiv(in unsigned long index, in unsigned long pname);
+        // any getVertexAttrib(in unsigned long index, in unsigned long pname) raises(DOMException);
+        [Custom] void getVertexAttrib();
 
         long getVertexAttribOffset(in unsigned long index, in unsigned long pname);
 
         void         hint(in unsigned long target, in unsigned long mode);
-        boolean      isBuffer(in CanvasBuffer buffer);
+        boolean      isBuffer(in WebGLBuffer buffer);
         boolean      isEnabled(in unsigned long cap);
-        boolean      isFramebuffer(in CanvasFramebuffer framebuffer);
-        boolean      isProgram(in CanvasProgram program);
-        boolean      isRenderbuffer(in CanvasRenderbuffer renderbuffer);
-        boolean      isShader(in CanvasShader shader);
-        boolean      isTexture(in CanvasTexture texture);
+        boolean      isFramebuffer(in WebGLFramebuffer framebuffer);
+        boolean      isProgram(in WebGLProgram program);
+        boolean      isRenderbuffer(in WebGLRenderbuffer renderbuffer);
+        boolean      isShader(in WebGLShader shader);
+        boolean      isTexture(in WebGLTexture texture);
         void         lineWidth(in double width);
-        void         linkProgram(in CanvasProgram program);
+        void         linkProgram(in WebGLProgram program) raises(DOMException);
         void         pixelStorei(in unsigned long pname, in long param);
         void         polygonOffset(in double factor, in double units);
-        
-        CanvasArray readPixels(in long x, in long y, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long type);
+
+        WebGLArray readPixels(in long x, in long y, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long type);
         
         void         releaseShaderCompiler();
         void         renderbufferStorage(in unsigned long target, in unsigned long internalformat, in unsigned long width, in unsigned long height);
         void         sampleCoverage(in double value, in boolean invert);
         void         scissor(in long x, in long y, in unsigned long width, in unsigned long height);
-        void         shaderSource(in CanvasShader shader, in DOMString string);
+        void         shaderSource(in WebGLShader shader, in DOMString string) raises(DOMException);
         void         stencilFunc(in unsigned long func, in long ref, in unsigned long mask);
         void         stencilFuncSeparate(in unsigned long face, in unsigned long func, in long ref, in unsigned long mask);
         void         stencilMask(in unsigned long mask);
@@ -619,9 +610,9 @@ module html {
 
         // Supported forms:
         //   void texImage2D(in GLenum target, in GLint level, in GLenum internalformat, in GLsizei width, in GLsizei height, 
-        //                   in GLint border, in GLenum format, in GLenum type, in CanvasArray pixels);
-        //   void texImage2D(in GLenum target, in GLint level, in GLenum internalformat, in GLsizei width, in GLsizei height, 
-        //                   in GLint border, in GLenum format, in GLenum type, in ImageData pixels);
+        //                   in GLint border, in GLenum format, in GLenum type, in WebGLArray pixels);
+        //   void texImage2D(in GLenum target, in GLint level, in ImageData pixels,
+        //                   [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
         //   void texImage2D(in GLenum target, in GLint level, in HTMLImageElement image,
         //                   [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
         //   void texImage2D(in GLenum target, in GLint level, in HTMLCanvasElement canvas,
@@ -633,55 +624,51 @@ module html {
         // Supported forms:
         //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
         //                      in GLsizei width, in GLsizei height, 
-        //                      in GLenum format, in GLenum type, in CanvasArray pixels);
-        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
-        //                      in GLsizei width, in GLsizei height, 
-        //                      in GLenum format, in GLenum type, in ImageData pixels);
+        //                      in GLenum format, in GLenum type, in WebGLArray pixels);
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset,
+        //                      in ImageData pixels, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
         //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
-        //                      in GLsizei width, in GLsizei height, in HTMLImageElement image,
-        //                      [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+        //                      in HTMLImageElement image, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
         //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
-        //                      in GLsizei width, in GLsizei height, in HTMLCanvasElement canvas,
-        //                      [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+        //                      in HTMLCanvasElement canvas, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
         //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
-        //                      in GLsizei width, in GLsizei height, in HTMLVideoElement video,
-        //                      [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+        //                      in HTMLVideoElement video, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
         [Custom] void texSubImage2D();
 
-        void uniform1f(in long location, in float x);
-        [Custom] void uniform1fv(in long location, in CanvasFloatArray v);
-        void uniform1i(in long location, in long x);
-        [Custom] void uniform1iv(in long location, in CanvasIntArray v);
-        void uniform2f(in long location, in float x, in float y);
-        [Custom] void uniform2fv(in long location, in CanvasFloatArray v);
-        void uniform2i(in long location, in long x, in long y);
-        [Custom] void uniform2iv(in long location, in CanvasIntArray v);
-        void uniform3f(in long location, in float x, in float y, in float z);
-        [Custom] void uniform3fv(in long location, in CanvasFloatArray v);
-        void uniform3i(in long location, in long x, in long y, in long z);
-        [Custom] void uniform3iv(in long location, in CanvasIntArray v);
-        void uniform4f(in long location, in float x, in float y, in float z, in float w);
-        [Custom] void uniform4fv(in long location, in CanvasFloatArray v);
-        void uniform4i(in long location, in long x, in long y, in long z, in long w);
-        [Custom] void uniform4iv(in long location, in CanvasIntArray v);
-
-        [Custom] void uniformMatrix2fv(in long location, in boolean transpose, in CanvasFloatArray array);
-        [Custom] void uniformMatrix3fv(in long location, in boolean transpose, in CanvasFloatArray array);
-        [Custom] void uniformMatrix4fv(in long location, in boolean transpose, in CanvasFloatArray array);
-
-        void         useProgram(in CanvasProgram program);
-        void         validateProgram(in CanvasProgram program);
+        void uniform1f(in WebGLUniformLocation location, in float x) raises(DOMException);
+        [Custom] void uniform1fv(in WebGLUniformLocation location, in WebGLFloatArray v) raises(DOMException);
+        void uniform1i(in WebGLUniformLocation location, in long x) raises(DOMException);
+        [Custom] void uniform1iv(in WebGLUniformLocation location, in WebGLIntArray v) raises(DOMException);
+        void uniform2f(in WebGLUniformLocation location, in float x, in float y) raises(DOMException);
+        [Custom] void uniform2fv(in WebGLUniformLocation location, in WebGLFloatArray v) raises(DOMException);
+        void uniform2i(in WebGLUniformLocation location, in long x, in long y) raises(DOMException);
+        [Custom] void uniform2iv(in WebGLUniformLocation location, in WebGLIntArray v) raises(DOMException);
+        void uniform3f(in WebGLUniformLocation location, in float x, in float y, in float z) raises(DOMException);
+        [Custom] void uniform3fv(in WebGLUniformLocation location, in WebGLFloatArray v) raises(DOMException);
+        void uniform3i(in WebGLUniformLocation location, in long x, in long y, in long z) raises(DOMException);
+        [Custom] void uniform3iv(in WebGLUniformLocation location, in WebGLIntArray v) raises(DOMException);
+        void uniform4f(in WebGLUniformLocation location, in float x, in float y, in float z, in float w) raises(DOMException);
+        [Custom] void uniform4fv(in WebGLUniformLocation location, in WebGLFloatArray v) raises(DOMException);
+        void uniform4i(in WebGLUniformLocation location, in long x, in long y, in long z, in long w) raises(DOMException);
+        [Custom] void uniform4iv(in WebGLUniformLocation location, in WebGLIntArray v) raises(DOMException);
+
+        [Custom] void uniformMatrix2fv(in WebGLUniformLocation location, in boolean transpose, in WebGLFloatArray array) raises(DOMException);
+        [Custom] void uniformMatrix3fv(in WebGLUniformLocation location, in boolean transpose, in WebGLFloatArray array) raises(DOMException);
+        [Custom] void uniformMatrix4fv(in WebGLUniformLocation location, in boolean transpose, in WebGLFloatArray array) raises(DOMException);
+
+        void         useProgram(in WebGLProgram program) raises(DOMException);
+        void         validateProgram(in WebGLProgram program) raises(DOMException);
 
         void         vertexAttrib1f(in unsigned long indx, in float x);
-        [Custom] void         vertexAttrib1fv(in unsigned long indx, in CanvasFloatArray values);
+        [Custom] void         vertexAttrib1fv(in unsigned long indx, in WebGLFloatArray values);
         void         vertexAttrib2f(in unsigned long indx, in float x, in float y);
-        [Custom] void         vertexAttrib2fv(in unsigned long indx, in CanvasFloatArray values);
+        [Custom] void         vertexAttrib2fv(in unsigned long indx, in WebGLFloatArray values);
         void         vertexAttrib3f(in unsigned long indx, in float x, in float y, in float z);
-        [Custom] void         vertexAttrib3fv(in unsigned long indx, in CanvasFloatArray values);
+        [Custom] void         vertexAttrib3fv(in unsigned long indx, in WebGLFloatArray values);
         void         vertexAttrib4f(in unsigned long indx, in float x, in float y, in float z, in float w);
-        [Custom] void         vertexAttrib4fv(in unsigned long indx, in CanvasFloatArray values);
+        [Custom] void         vertexAttrib4fv(in unsigned long indx, in WebGLFloatArray values);
         void         vertexAttribPointer(in unsigned long indx, in long size, in unsigned long type, in boolean normalized, 
-                                         in long stride, in unsigned long offset);
+                                         in long stride, in unsigned long offset) raises(DOMException);
 
         void         viewport(in long x, in long y, in unsigned long width, in unsigned long height);
     };
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLShader.cpp
index 7f134fa537..a353b1594b 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLShader.cpp
@@ -27,23 +27,23 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasShader.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLShader.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-PassRefPtr<CanvasShader> CanvasShader::create(CanvasRenderingContext3D* ctx, GraphicsContext3D::ShaderType type)
+PassRefPtr<WebGLShader> WebGLShader::create(WebGLRenderingContext* ctx, GraphicsContext3D::WebGLEnumType type)
 {
-    return adoptRef(new CanvasShader(ctx, type));
+    return adoptRef(new WebGLShader(ctx, type));
 }
 
-CanvasShader::CanvasShader(CanvasRenderingContext3D* ctx, GraphicsContext3D::ShaderType type)
+WebGLShader::WebGLShader(WebGLRenderingContext* ctx, GraphicsContext3D::WebGLEnumType type)
     : CanvasObject(ctx)
 {
     setObject(context()->graphicsContext3D()->createShader(type));
 }
 
-void CanvasShader::_deleteObject(Platform3DObject object)
+void WebGLShader::_deleteObject(Platform3DObject object)
 {
     context()->graphicsContext3D()->deleteShader(object);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLShader.h
index bb7980e05e..1ef912cb75 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLShader.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasShader_h
-#define CanvasShader_h
+#ifndef WebGLShader_h
+#define WebGLShader_h
 
 #include "CanvasObject.h"
 
@@ -33,18 +33,18 @@
 
 namespace WebCore {
     
-    class CanvasShader : public CanvasObject {
+    class WebGLShader : public CanvasObject {
     public:
-        virtual ~CanvasShader() { deleteObject(); }
+        virtual ~WebGLShader() { deleteObject(); }
         
-        static PassRefPtr<CanvasShader> create(CanvasRenderingContext3D*, GraphicsContext3D::ShaderType);
+        static PassRefPtr<WebGLShader> create(WebGLRenderingContext*, GraphicsContext3D::WebGLEnumType);
         
     private:
-        CanvasShader(CanvasRenderingContext3D*, GraphicsContext3D::ShaderType);
+        WebGLShader(WebGLRenderingContext*, GraphicsContext3D::WebGLEnumType);
 
         virtual void _deleteObject(Platform3DObject);
     };
     
 } // namespace WebCore
 
-#endif // CanvasShader_h
+#endif // WebGLShader_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFramebuffer.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLShader.idl
index 0a9b6683ad..2d79e49e6f 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFramebuffer.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLShader.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasFramebuffer {
+    interface [Conditional=3D_CANVAS, OmitConstructor] WebGLShader {
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLShortArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLShortArray.cpp
new file mode 100644
index 0000000000..bb7aa9556d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLShortArray.cpp
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLShortArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLShortArray> WebGLShortArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length, sizeof(short));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLShortArray> WebGLShortArray::create(short* array, unsigned length)
+{
+    RefPtr<WebGLShortArray> a = WebGLShortArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLShortArray> WebGLShortArray::create(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                    unsigned byteOffset,
+                                                    unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buf(buffer);
+    if (!verifySubRange<short>(buf, byteOffset, length))
+        return 0;
+
+    return adoptRef(new WebGLShortArray(buf, byteOffset, length));
+}
+
+WebGLShortArray::WebGLShortArray(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLShortArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLShortArray::byteLength() const {
+    return m_size * sizeof(short);
+}
+
+PassRefPtr<WebGLArray> WebGLShortArray::slice(int start, int end)
+{
+    unsigned offset, length;
+    calculateOffsetAndLength(start, end, m_size, &offset, &length);
+    unsigned fullOffset = m_byteOffset + offset * sizeof(short);
+    clampOffsetAndNumElements<short>(buffer(), &fullOffset, &length);
+    return create(buffer(), fullOffset, length);
+}
+
+void WebGLShortArray::set(WebGLShortArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(short), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLShortArray.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLShortArray.h
new file mode 100644
index 0000000000..af4befbccf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLShortArray.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLShortArray_h
+#define WebGLShortArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLShortArray : public WebGLArray {
+  public:
+    virtual bool isShortArray() const { return true; }
+
+    static PassRefPtr<WebGLShortArray> create(unsigned length);
+    static PassRefPtr<WebGLShortArray> create(short* array, unsigned length);
+    static PassRefPtr<WebGLShortArray> create(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length);
+
+    short* data() { return static_cast<short*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(int start, int end);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<short>::min())
+            value = std::numeric_limits<short>::min();
+        else if (value > std::numeric_limits<short>::max())
+            value = std::numeric_limits<short>::max();
+        short* storage = static_cast<short*>(m_baseAddress);
+        storage[index] = static_cast<short>(value);
+    }
+
+    bool get(unsigned index, short& result) const
+    {
+        if (index >= m_size)
+            return false;
+        result = item(index);
+        return true;
+    }
+
+    short get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    short item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        short* storage = static_cast<short*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLShortArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLShortArray(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLShortArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLShortArray.idl
index 6d64e1cfe9..59dce7653e 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLShortArray.idl
@@ -29,8 +29,13 @@ module html {
         HasNumericIndexGetter,
         HasCustomIndexSetter,
         GenerateNativeConverter,
-        GenerateCustomConstructor,
+        CustomConstructor,
         CustomToJS
-    ] CanvasShortArray : CanvasArray {
+    ] WebGLShortArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLShortArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLTexture.cpp
index 624c275739..ae09b481dd 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLTexture.cpp
@@ -27,24 +27,36 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasTexture.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLTexture.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-PassRefPtr<CanvasTexture> CanvasTexture::create(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLTexture> WebGLTexture::create(WebGLRenderingContext* ctx)
 {
-    return adoptRef(new CanvasTexture(ctx));
+    return adoptRef(new WebGLTexture(ctx));
 }
 
-CanvasTexture::CanvasTexture(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLTexture> WebGLTexture::create(WebGLRenderingContext* ctx, Platform3DObject obj)
+{
+    return adoptRef(new WebGLTexture(ctx, obj));
+}
+
+WebGLTexture::WebGLTexture(WebGLRenderingContext* ctx)
     : CanvasObject(ctx)
     , cubeMapRWrapModeInitialized(false)
 {
     setObject(context()->graphicsContext3D()->createTexture());
 }
 
-void CanvasTexture::_deleteObject(Platform3DObject object)
+WebGLTexture::WebGLTexture(WebGLRenderingContext* ctx, Platform3DObject obj)
+    : CanvasObject(ctx)
+    , cubeMapRWrapModeInitialized(false)
+{
+    setObject(obj, false);
+}
+
+void WebGLTexture::_deleteObject(Platform3DObject object)
 {
     context()->graphicsContext3D()->deleteTexture(object);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLTexture.h
index 32a669a96f..c64dd41488 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLTexture.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasTexture_h
-#define CanvasTexture_h
+#ifndef WebGLTexture_h
+#define WebGLTexture_h
 
 #include "CanvasObject.h"
 
@@ -33,12 +33,16 @@
 
 namespace WebCore {
     
-    class CanvasTexture : public CanvasObject {
+    class WebGLTexture : public CanvasObject {
     public:
-        virtual ~CanvasTexture() { deleteObject(); }
+        virtual ~WebGLTexture() { deleteObject(); }
         
-        static PassRefPtr<CanvasTexture> create(CanvasRenderingContext3D*);
+        static PassRefPtr<WebGLTexture> create(WebGLRenderingContext*);
     
+        // For querying previously created objects via e.g. getFramebufferAttachmentParameter
+        // FIXME: should consider canonicalizing these objects
+        static PassRefPtr<WebGLTexture> create(WebGLRenderingContext*, Platform3DObject);
+
         bool isCubeMapRWrapModeInitialized() {
             return cubeMapRWrapModeInitialized;
         }
@@ -48,7 +52,8 @@ namespace WebCore {
         }
 
     protected:
-        CanvasTexture(CanvasRenderingContext3D*);
+        WebGLTexture(WebGLRenderingContext*);
+        WebGLTexture(WebGLRenderingContext*, Platform3DObject);
 
         virtual void _deleteObject(Platform3DObject);
 
@@ -58,4 +63,4 @@ namespace WebCore {
     
 } // namespace WebCore
 
-#endif // CanvasTexture_h
+#endif // WebGLTexture_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasProgram.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLTexture.idl
index 46daaf2247..0200e7e02d 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasProgram.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLTexture.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasProgram {
+    interface [Conditional=3D_CANVAS, OmitConstructor] WebGLTexture {
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUniformLocation.cpp
index 8442b87690..2157470592 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUniformLocation.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,24 +28,21 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasIntArray.h"
-
-#include "CanvasIntArray.h"
-
-using namespace JSC;
+#include "WebGLUniformLocation.h"
 
 namespace WebCore {
-
-void JSCanvasIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+    
+PassRefPtr<WebGLUniformLocation> WebGLUniformLocation::create(WebGLProgram* program, long location)
 {
-    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
+    return adoptRef(new WebGLUniformLocation(program, location));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasIntArray* object)
+WebGLUniformLocation::WebGLUniformLocation(WebGLProgram* program, long location)
+    : m_program(program)
+    , m_location(location)
 {
-    return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, object);
 }
 
-} // namespace WebCore
+}
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasBuffer.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUniformLocation.h
index 8fdab822d0..f9f7a11cc3 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasBuffer.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUniformLocation.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,28 +24,35 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasBuffer_h
-#define CanvasBuffer_h
+#ifndef WebGLUniformLocation_h
+#define WebGLUniformLocation_h
 
 #include "CanvasObject.h"
+#include "WebGLProgram.h"
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
-    
-    class CanvasBuffer : public CanvasObject {
-    public:
-        virtual ~CanvasBuffer() { deleteObject(); }
-        
-        static PassRefPtr<CanvasBuffer> create(CanvasRenderingContext3D*);
-        
-    protected:
-        CanvasBuffer(CanvasRenderingContext3D*);
-        
-        virtual void _deleteObject(Platform3DObject o);
-    };
-    
+
+class WebGLUniformLocation : public RefCounted<WebGLUniformLocation> {
+public:
+    virtual ~WebGLUniformLocation() { }
+
+    static PassRefPtr<WebGLUniformLocation> create(WebGLProgram* program, long location);
+
+    WebGLProgram* program() const { return m_program.get(); }
+
+    long location() const { return m_location; }
+
+protected:
+    WebGLUniformLocation(WebGLProgram* program, long location);
+
+private:
+    RefPtr<WebGLProgram> m_program;
+    long m_location;
+};
+
 } // namespace WebCore
 
-#endif // CanvasBuffer_h
+#endif // WebGLUniformLocation_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLUniformLocation.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUniformLocation.idl
new file mode 100644
index 0000000000..f25e83428f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUniformLocation.idl
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS, OmitConstructor] WebGLUniformLocation {
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedByteArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedByteArray.cpp
new file mode 100644
index 0000000000..032581a079
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedByteArray.cpp
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLUnsignedByteArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLUnsignedByteArray> WebGLUnsignedByteArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length, sizeof(unsigned char));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLUnsignedByteArray> WebGLUnsignedByteArray::create(unsigned char* array, unsigned length)
+{
+    RefPtr<WebGLUnsignedByteArray> a = WebGLUnsignedByteArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLUnsignedByteArray> WebGLUnsignedByteArray::create(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                                  unsigned byteOffset,
+                                                                  unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buf(buffer);
+    if (!verifySubRange<unsigned char>(buf, byteOffset, length))
+        return 0;
+
+    return adoptRef(new WebGLUnsignedByteArray(buf, byteOffset, length));
+}
+
+WebGLUnsignedByteArray::WebGLUnsignedByteArray(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLUnsignedByteArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLUnsignedByteArray::byteLength() const {
+    return m_size * sizeof(unsigned char);
+}
+
+PassRefPtr<WebGLArray> WebGLUnsignedByteArray::slice(int start, int end)
+{
+    unsigned offset, length;
+    calculateOffsetAndLength(start, end, m_size, &offset, &length);
+    unsigned fullOffset = m_byteOffset + offset * sizeof(unsigned char);
+    clampOffsetAndNumElements<unsigned char>(buffer(), &fullOffset, &length);
+    return create(buffer(), fullOffset, length);
+}
+
+void WebGLUnsignedByteArray::set(WebGLUnsignedByteArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(unsigned char), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedByteArray.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedByteArray.h
new file mode 100644
index 0000000000..505b2fd455
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedByteArray.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLUnsignedByteArray_h
+#define WebGLUnsignedByteArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLUnsignedByteArray : public WebGLArray {
+  public:
+    virtual bool isUnsignedByteArray() const { return true; }
+
+    static PassRefPtr<WebGLUnsignedByteArray> create(unsigned length);
+    static PassRefPtr<WebGLUnsignedByteArray> create(unsigned char* array, unsigned length);
+    static PassRefPtr<WebGLUnsignedByteArray> create(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length);
+
+    unsigned char* data() { return static_cast<unsigned char*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(int start, int end);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<unsigned char>::min())
+            value = std::numeric_limits<unsigned char>::min();
+        else if (value > std::numeric_limits<unsigned char>::max())
+            value = std::numeric_limits<unsigned char>::max();
+        unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
+        storage[index] = static_cast<unsigned char>(value);
+    }
+
+    bool get(unsigned index, unsigned char& result) const
+    {
+        if (index >= m_size)
+            return false;
+        result = item(index);
+        return true;
+    }
+
+    unsigned char get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    unsigned char item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLUnsignedByteArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLUnsignedByteArray(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLUnsignedByteArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedByteArray.idl
index 3ab60d6028..4de8b426c5 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedByteArray.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,8 +30,13 @@ module html {
         HasNumericIndexGetter,
         HasCustomIndexSetter,
         GenerateNativeConverter,
-        GenerateCustomConstructor,
+        CustomConstructor,
         CustomToJS
-    ] CanvasUnsignedIntArray : CanvasArray {
+    ] WebGLUnsignedByteArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLUnsignedByteArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedIntArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedIntArray.cpp
new file mode 100644
index 0000000000..51a31368a2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedIntArray.cpp
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLUnsignedIntArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLUnsignedIntArray> WebGLUnsignedIntArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length, sizeof(unsigned int));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLUnsignedIntArray> WebGLUnsignedIntArray::create(unsigned int* array, unsigned length)
+{
+    RefPtr<WebGLUnsignedIntArray> a = WebGLUnsignedIntArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLUnsignedIntArray> WebGLUnsignedIntArray::create(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                                unsigned byteOffset,
+                                                                unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buf(buffer);
+    if (!verifySubRange<unsigned int>(buf, byteOffset, length))
+        return 0;
+
+    return adoptRef(new WebGLUnsignedIntArray(buf, byteOffset, length));
+}
+
+WebGLUnsignedIntArray::WebGLUnsignedIntArray(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLUnsignedIntArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLUnsignedIntArray::byteLength() const {
+    return m_size * sizeof(unsigned int);
+}
+
+PassRefPtr<WebGLArray> WebGLUnsignedIntArray::slice(int start, int end)
+{
+    unsigned offset, length;
+    calculateOffsetAndLength(start, end, m_size, &offset, &length);
+    unsigned fullOffset = m_byteOffset + offset * sizeof(unsigned int);
+    clampOffsetAndNumElements<unsigned int>(buffer(), &fullOffset, &length);
+    return create(buffer(), fullOffset, length);
+}
+
+void WebGLUnsignedIntArray::set(WebGLUnsignedIntArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(unsigned int), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedIntArray.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedIntArray.h
new file mode 100644
index 0000000000..6e9b22013c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedIntArray.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLUnsignedIntArray_h
+#define WebGLUnsignedIntArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLUnsignedIntArray : public WebGLArray {
+  public:
+    virtual bool isUnsignedIntArray() const { return true; }
+
+    static PassRefPtr<WebGLUnsignedIntArray> create(unsigned length);
+    static PassRefPtr<WebGLUnsignedIntArray> create(unsigned int* array, unsigned length);
+    static PassRefPtr<WebGLUnsignedIntArray> create(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length);
+
+    unsigned int* data() { return static_cast<unsigned int*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(int start, int end);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<unsigned int>::min())
+            value = std::numeric_limits<unsigned int>::min();
+        else if (value > std::numeric_limits<unsigned int>::max())
+            value = std::numeric_limits<unsigned int>::max();
+        unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
+        storage[index] = static_cast<unsigned int>(value);
+    }
+
+    bool get(unsigned index, unsigned int& result) const
+    {
+        if (index >= m_size)
+            return false;
+        result = item(index);
+        return true;
+    }
+
+    unsigned int get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    unsigned int item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLUnsignedIntArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLUnsignedIntArray(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLUnsignedIntArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedIntArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedIntArray.idl
new file mode 100644
index 0000000000..75ff59800b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedIntArray.idl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        CustomConstructor,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        CustomToJS
+    ] WebGLUnsignedIntArray : WebGLArray {
+        unsigned long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLUnsignedIntArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedShortArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedShortArray.cpp
new file mode 100644
index 0000000000..e8392591a0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedShortArray.cpp
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLUnsignedShortArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLUnsignedShortArray> WebGLUnsignedShortArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length, sizeof(unsigned short));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLUnsignedShortArray> WebGLUnsignedShortArray::create(unsigned short* array, unsigned length)
+{
+    RefPtr<WebGLUnsignedShortArray> a = WebGLUnsignedShortArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLUnsignedShortArray> WebGLUnsignedShortArray::create(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                                    unsigned byteOffset,
+                                                                    unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buf(buffer);
+    if (!verifySubRange<unsigned short>(buf, byteOffset, length))
+        return 0;
+
+    return adoptRef(new WebGLUnsignedShortArray(buf, byteOffset, length));
+}
+
+WebGLUnsignedShortArray::WebGLUnsignedShortArray(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                 unsigned byteOffset,
+                                                 unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLUnsignedShortArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLUnsignedShortArray::byteLength() const {
+    return m_size * sizeof(unsigned short);
+}
+
+PassRefPtr<WebGLArray> WebGLUnsignedShortArray::slice(int start, int end)
+{
+    unsigned offset, length;
+    calculateOffsetAndLength(start, end, m_size, &offset, &length);
+    unsigned fullOffset = m_byteOffset + offset * sizeof(unsigned short);
+    clampOffsetAndNumElements<unsigned short>(buffer(), &fullOffset, &length);
+    return create(buffer(), fullOffset, length);
+}
+
+void WebGLUnsignedShortArray::set(WebGLUnsignedShortArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(unsigned short), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedShortArray.h b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedShortArray.h
new file mode 100644
index 0000000000..94b428a955
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedShortArray.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLUnsignedShortArray_h
+#define WebGLUnsignedShortArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLUnsignedShortArray : public WebGLArray {
+  public:
+    virtual bool isUnsignedShortArray() const { return true; }
+
+    static PassRefPtr<WebGLUnsignedShortArray> create(unsigned length);
+    static PassRefPtr<WebGLUnsignedShortArray> create(unsigned short* array, unsigned length);
+    static PassRefPtr<WebGLUnsignedShortArray> create(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length);
+
+    unsigned short* data() { return static_cast<unsigned short*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(int start, int end);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<unsigned short>::min())
+            value = std::numeric_limits<unsigned short>::min();
+        else if (value > std::numeric_limits<unsigned short>::max())
+            value = std::numeric_limits<unsigned short>::max();
+        unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+        storage[index] = static_cast<unsigned short>(value);
+    }
+
+    bool get(unsigned index, unsigned short& result) const
+    {
+        if (index >= m_size)
+            return false;
+        unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+        result = storage[index];
+        return true;
+    }
+
+    unsigned short get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    unsigned short item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLUnsignedShortArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLUnsignedShortArray(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset,unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLUnsignedShortArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedShortArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedShortArray.idl
new file mode 100644
index 0000000000..fc53929c6e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/WebGLUnsignedShortArray.idl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        CustomConstructor,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        CustomToJS
+    ] WebGLUnsignedShortArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLUnsignedShortArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp
index eb8d49aca9..4054996866 100644
--- a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp
@@ -31,10 +31,12 @@
 #include "config.h"
 #include "ConsoleMessage.h"
 
+#include "InjectedScript.h"
+#include "InjectedScriptHost.h"
 #include "InspectorFrontend.h"
 #include "ScriptCallStack.h"
 #include "ScriptObject.h"
-#include "ScriptObjectQuarantine.h"
+#include "SerializedScriptValue.h"
 
 namespace WebCore {
 
@@ -55,7 +57,8 @@ ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, S
     , m_type(t)
     , m_level(l)
 #if ENABLE(INSPECTOR)
-    , m_wrappedArguments(callStack->at(0).argumentCount())
+    , m_arguments(callStack->at(0).argumentCount())
+    , m_scriptState(callStack->globalState())
 #endif
     , m_frames(storeTrace ? callStack->size() : 0)
     , m_groupLevel(g)
@@ -75,12 +78,12 @@ ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, S
 
 #if ENABLE(INSPECTOR)
     for (unsigned i = 0; i < lastCaller.argumentCount(); ++i)
-        m_wrappedArguments[i] = quarantineValue(callStack->state(), lastCaller.argumentAt(i));
+        m_arguments[i] = lastCaller.argumentAt(i);
 #endif
 }
 
 #if ENABLE(INSPECTOR)
-void ConsoleMessage::addToConsole(InspectorFrontend* frontend)
+void ConsoleMessage::addToFrontend(InspectorFrontend* frontend, InjectedScriptHost* injectedScriptHost)
 {
     ScriptObject jsonObj = frontend->newScriptObject();
     jsonObj.set("source", static_cast<int>(m_source));
@@ -90,7 +93,15 @@ void ConsoleMessage::addToConsole(InspectorFrontend* frontend)
     jsonObj.set("url", m_url);
     jsonObj.set("groupLevel", static_cast<int>(m_groupLevel));
     jsonObj.set("repeatCount", static_cast<int>(m_repeatCount));
-    frontend->addConsoleMessage(jsonObj, m_frames, m_wrappedArguments,  m_message);
+    Vector<RefPtr<SerializedScriptValue> > arguments;
+    if (!m_arguments.isEmpty()) {
+        InjectedScript injectedScript = injectedScriptHost->injectedScriptFor(m_scriptState);
+        for (unsigned i = 0; i < m_arguments.size(); ++i) {
+            RefPtr<SerializedScriptValue> serializedValue = injectedScript.wrapForConsole(m_arguments[i]);
+            arguments.append(serializedValue);
+        }
+    }   
+    frontend->addConsoleMessage(jsonObj, m_frames, arguments,  m_message);
 }
 
 void ConsoleMessage::updateRepeatCountInConsole(InspectorFrontend* frontend)
@@ -102,15 +113,15 @@ void ConsoleMessage::updateRepeatCountInConsole(InspectorFrontend* frontend)
 bool ConsoleMessage::isEqual(ScriptState* state, ConsoleMessage* msg) const
 {
 #if ENABLE(INSPECTOR)
-    if (msg->m_wrappedArguments.size() != m_wrappedArguments.size())
+    if (msg->m_arguments.size() != m_arguments.size())
         return false;
-    if (!state && msg->m_wrappedArguments.size())
+    if (!state && msg->m_arguments.size())
         return false;
 
-    ASSERT_ARG(state, state || msg->m_wrappedArguments.isEmpty());
+    ASSERT_ARG(state, state || msg->m_arguments.isEmpty());
 
-    for (size_t i = 0; i < msg->m_wrappedArguments.size(); ++i) {
-        if (!m_wrappedArguments[i].isEqual(state, msg->m_wrappedArguments[i]))
+    for (size_t i = 0; i < msg->m_arguments.size(); ++i) {
+        if (!m_arguments[i].isEqual(state, msg->m_arguments[i]))
             return false;
     }
 #else
diff --git a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h
index 8ed6660e17..53f4255066 100644
--- a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h
+++ b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h
@@ -38,39 +38,41 @@
 #include <wtf/Vector.h>
 
 namespace WebCore {
-    class InspectorFrontend;
-    class ScriptCallStack;
-    class ScriptString;
+class InjectedScriptHost;
+class InspectorFrontend;
+class ScriptCallStack;
+class ScriptString;
 
-    class ConsoleMessage {
-    public:
-        ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& m, unsigned li, const String& u, unsigned g);        
-        ConsoleMessage(MessageSource, MessageType, MessageLevel, ScriptCallStack*, unsigned g, bool storeTrace = false);
+class ConsoleMessage : public Noncopyable {
+public:
+    ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& m, unsigned li, const String& u, unsigned g);        
+    ConsoleMessage(MessageSource, MessageType, MessageLevel, ScriptCallStack*, unsigned g, bool storeTrace = false);
 
 #if ENABLE(INSPECTOR)
-        void addToConsole(InspectorFrontend* frontend);
-        void updateRepeatCountInConsole(InspectorFrontend* frontend);
+    void addToFrontend(InspectorFrontend*, InjectedScriptHost*);
+    void updateRepeatCountInConsole(InspectorFrontend* frontend);
 #endif
-        void incrementCount() { ++m_repeatCount; };
-        bool isEqual(ScriptState*, ConsoleMessage* msg) const;
+    void incrementCount() { ++m_repeatCount; }
+    bool isEqual(ScriptState*, ConsoleMessage* msg) const;
 
-        MessageSource source() const { return m_source; }
-        const String& message() const { return m_message; }
+    MessageSource source() const { return m_source; }
+    const String& message() const { return m_message; }
 
-    private:
-        MessageSource m_source;
-        MessageType m_type;
-        MessageLevel m_level;
-        String m_message;
+private:
+    MessageSource m_source;
+    MessageType m_type;
+    MessageLevel m_level;
+    String m_message;
 #if ENABLE(INSPECTOR)
-        Vector<ScriptValue> m_wrappedArguments;
+    Vector<ScriptValue> m_arguments;
+    ScriptState* m_scriptState;
 #endif
-        Vector<ScriptString> m_frames;
-        unsigned m_line;
-        String m_url;
-        unsigned m_groupLevel;
-        unsigned m_repeatCount;
-    };
+    Vector<ScriptString> m_frames;
+    unsigned m_line;
+    String m_url;
+    unsigned m_groupLevel;
+    unsigned m_repeatCount;
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/InjectedScript.cpp b/src/3rdparty/webkit/WebCore/inspector/InjectedScript.cpp
new file mode 100644
index 0000000000..42a2856b36
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InjectedScript.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScript.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "PlatformString.h"
+#include "SerializedScriptValue.h"
+#include "ScriptFunctionCall.h"
+
+namespace WebCore {
+
+InjectedScript::InjectedScript(ScriptObject injectedScriptObject)
+    : m_injectedScriptObject(injectedScriptObject)
+{
+}
+
+void InjectedScript::dispatch(long callId, const String& methodName, const String& arguments, bool async, RefPtr<SerializedScriptValue>* result, bool* hadException) 
+{
+    ASSERT(!hasNoValue());
+    ScriptFunctionCall function(m_injectedScriptObject, "dispatch");
+    function.appendArgument(methodName);
+    function.appendArgument(arguments);
+    if (async)
+        function.appendArgument(callId);
+    *hadException = false;
+    ScriptValue resultValue = function.call(*hadException);
+    if (!*hadException)
+        *result = resultValue.serialize(m_injectedScriptObject.scriptState());
+}
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+PassRefPtr<SerializedScriptValue> InjectedScript::callFrames()
+{
+    ASSERT(!hasNoValue());
+    ScriptFunctionCall function(m_injectedScriptObject, "callFrames");
+    ScriptValue callFramesValue = function.call();
+    return callFramesValue.serialize(m_injectedScriptObject.scriptState());
+}
+#endif
+
+PassRefPtr<SerializedScriptValue> InjectedScript::wrapForConsole(ScriptValue value)
+{
+    ASSERT(!hasNoValue());
+    ScriptFunctionCall wrapFunction(m_injectedScriptObject, "wrapObject");
+    wrapFunction.appendArgument(value);
+    wrapFunction.appendArgument("console");
+    ScriptValue r = wrapFunction.call();
+    return r.serialize(m_injectedScriptObject.scriptState());
+}
+
+void InjectedScript::releaseWrapperObjectGroup(const String& objectGroup)
+{
+    ASSERT(!hasNoValue());
+    ScriptFunctionCall releaseFunction(m_injectedScriptObject, "releaseWrapperObjectGroup");
+    releaseFunction.appendArgument(objectGroup);
+    releaseFunction.call();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InjectedScript.h b/src/3rdparty/webkit/WebCore/inspector/InjectedScript.h
new file mode 100644
index 0000000000..db40f802e1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InjectedScript.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InjectedScript_h
+#define InjectedScript_h
+
+#include "InjectedScriptHost.h"
+#include "ScriptObject.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class SerializedScriptValue;
+class String;
+
+class InjectedScript {
+public:
+    InjectedScript() { }
+    ~InjectedScript() { }
+
+    bool hasNoValue() const { return m_injectedScriptObject.hasNoValue(); }
+
+    void dispatch(long callId, const String& methodName, const String& arguments, bool async, RefPtr<SerializedScriptValue>* result, bool* hadException);
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    PassRefPtr<SerializedScriptValue> callFrames();
+#endif
+    PassRefPtr<SerializedScriptValue> wrapForConsole(ScriptValue);
+    void releaseWrapperObjectGroup(const String&);
+
+private:
+    friend InjectedScript InjectedScriptHost::injectedScriptFor(ScriptState*);
+    explicit InjectedScript(ScriptObject);
+    ScriptObject m_injectedScriptObject;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/inspector/InjectedScriptHost.cpp b/src/3rdparty/webkit/WebCore/inspector/InjectedScriptHost.cpp
new file mode 100644
index 0000000000..c58073d261
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InjectedScriptHost.cpp
@@ -0,0 +1,225 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScriptHost.h"
+
+#if ENABLE(INSPECTOR)
+
+
+#include "Element.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "HTMLFrameOwnerElement.h"
+#include "InjectedScript.h"
+#include "InspectorClient.h"
+#include "InspectorController.h"
+#include "InspectorDOMAgent.h"
+#include "InspectorFrontend.h"
+#include "InspectorResource.h"
+#include "Pasteboard.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include "ScriptDebugServer.h"
+#endif
+
+#if ENABLE(DATABASE)
+#include "Database.h"
+#endif
+
+#if ENABLE(DOM_STORAGE)
+#include "Storage.h"
+#endif
+
+#include "markup.h"
+
+#include <wtf/RefPtr.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace std;
+
+namespace WebCore {
+
+InjectedScriptHost::InjectedScriptHost(InspectorController* inspectorController)
+    : m_inspectorController(inspectorController)
+    , m_nextInjectedScriptId(1)
+    , m_lastWorkerId(1 << 31) // Distinguish ids of fake workers from real ones, to minimize the chances they overlap.
+{
+}
+
+InjectedScriptHost::~InjectedScriptHost()
+{
+}
+
+void InjectedScriptHost::clearConsoleMessages()
+{
+    if (m_inspectorController)
+        m_inspectorController->clearConsoleMessages();
+}
+
+void InjectedScriptHost::copyText(const String& text)
+{
+    Pasteboard::generalPasteboard()->writePlainText(text);
+}
+
+Node* InjectedScriptHost::nodeForId(long nodeId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        return domAgent->nodeForId(nodeId);
+    return 0;
+}
+
+long InjectedScriptHost::pushNodePathToFrontend(Node* node, bool withChildren, bool selectInUI)
+{
+    InspectorFrontend* frontend = inspectorFrontend();
+    InspectorDOMAgent* domAgent = inspectorDOMAgent();
+    if (!domAgent || !frontend)
+        return 0;
+    long id = domAgent->pushNodePathToFrontend(node);
+    if (withChildren)
+        domAgent->pushChildNodesToFrontend(id);
+    if (selectInUI)
+        frontend->updateFocusedNode(id);
+    return id;
+}
+
+void InjectedScriptHost::addNodesToSearchResult(const String& nodeIds)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->addNodesToSearchResult(nodeIds);
+}
+
+long InjectedScriptHost::pushNodeByPathToFrontend(const String& path)
+{
+    InspectorDOMAgent* domAgent = inspectorDOMAgent();
+    if (!domAgent)
+        return 0;
+
+    Node* node = domAgent->nodeForPath(path);
+    if (!node)
+        return 0;
+
+    return domAgent->pushNodePathToFrontend(node);
+}
+
+#if ENABLE(DATABASE)
+Database* InjectedScriptHost::databaseForId(long databaseId)
+{
+    if (m_inspectorController)
+        return m_inspectorController->databaseForId(databaseId);
+    return 0;
+}
+
+void InjectedScriptHost::selectDatabase(Database* database)
+{
+    if (m_inspectorController)
+        m_inspectorController->selectDatabase(database);
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+void InjectedScriptHost::selectDOMStorage(Storage* storage)
+{
+    if (m_inspectorController)
+        m_inspectorController->selectDOMStorage(storage);
+}
+#endif
+
+void InjectedScriptHost::reportDidDispatchOnInjectedScript(long callId, SerializedScriptValue* result, bool isException)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->didDispatchOnInjectedScript(callId, result, isException);
+}
+
+InjectedScript InjectedScriptHost::injectedScriptForId(long id)
+{
+    return m_idToInjectedScript.get(id);
+}
+
+void InjectedScriptHost::discardInjectedScripts()
+{
+    m_idToInjectedScript.clear();
+}
+
+void InjectedScriptHost::releaseWrapperObjectGroup(long injectedScriptId, const String& objectGroup)
+{
+    if (injectedScriptId) {
+         InjectedScript injectedScript = m_idToInjectedScript.get(injectedScriptId);
+         if (!injectedScript.hasNoValue())
+             injectedScript.releaseWrapperObjectGroup(objectGroup);
+    } else {
+         // Iterate over all injected scripts if injectedScriptId is not specified.
+         for (IdToInjectedScriptMap::iterator it = m_idToInjectedScript.begin(); it != m_idToInjectedScript.end(); ++it)
+              it->second.releaseWrapperObjectGroup(objectGroup);
+    }
+}
+
+InspectorDOMAgent* InjectedScriptHost::inspectorDOMAgent()
+{
+    if (!m_inspectorController)
+        return 0;
+    return m_inspectorController->domAgent();
+}
+
+InspectorFrontend* InjectedScriptHost::inspectorFrontend()
+{
+    if (!m_inspectorController)
+        return 0;
+    return m_inspectorController->m_frontend.get();
+}
+
+pair<long, ScriptObject> InjectedScriptHost::injectScript(const String& source, ScriptState* scriptState)
+{
+    long id = m_nextInjectedScriptId++;
+    return std::make_pair(id, createInjectedScript(source, scriptState, id));
+}
+
+#if ENABLE(WORKERS)
+long InjectedScriptHost::nextWorkerId()
+{
+    return ++m_lastWorkerId;
+}
+
+void InjectedScriptHost::didCreateWorker(long id, const String& url, bool isSharedWorker)
+{
+    if (m_inspectorController)
+        m_inspectorController->didCreateWorker(id, url, isSharedWorker);
+}
+
+void InjectedScriptHost::didDestroyWorker(long id)
+{
+    if (m_inspectorController)
+        m_inspectorController->didDestroyWorker(id);
+}
+#endif // ENABLE(WORKERS)
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InjectedScriptHost.h b/src/3rdparty/webkit/WebCore/inspector/InjectedScriptHost.h
new file mode 100644
index 0000000000..837f6ff48b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InjectedScriptHost.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InjectedScriptHost_h
+#define InjectedScriptHost_h
+
+#include "Console.h"
+#include "InspectorController.h"
+#include "PlatformString.h"
+#include "ScriptState.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class Database;
+class InjectedScript;
+class InspectorDOMAgent;
+class InspectorFrontend;
+class JavaScriptCallFrame;
+class Node;
+class SerializedScriptValue;
+class Storage;
+
+class InjectedScriptHost : public RefCounted<InjectedScriptHost>
+{
+public:
+    static PassRefPtr<InjectedScriptHost> create(InspectorController* inspectorController)
+    {
+        return adoptRef(new InjectedScriptHost(inspectorController));
+    }
+
+    ~InjectedScriptHost();
+
+    void setInjectedScriptSource(const String& source) { m_injectedScriptSource = source; }
+
+    InspectorController* inspectorController() { return m_inspectorController; }
+    void disconnectController() { m_inspectorController = 0; }
+
+    void clearConsoleMessages();
+
+    void copyText(const String& text);
+    Node* nodeForId(long nodeId);
+    long pushNodePathToFrontend(Node* node, bool withChildren, bool selectInUI);
+
+    void addNodesToSearchResult(const String& nodeIds);
+    long pushNodeByPathToFrontend(const String& path);
+
+#if ENABLE(DATABASE)
+    Database* databaseForId(long databaseId);
+    void selectDatabase(Database* database);
+#endif
+#if ENABLE(DOM_STORAGE)
+    void selectDOMStorage(Storage* storage);
+#endif
+#if ENABLE(WORKERS)
+    long nextWorkerId();
+    void didCreateWorker(long id, const String& url, bool isSharedWorker);
+    void didDestroyWorker(long id);
+#endif
+    void reportDidDispatchOnInjectedScript(long callId, SerializedScriptValue* result, bool isException);
+
+    pair<long, ScriptObject> injectScript(const String& source, ScriptState*);
+    InjectedScript injectedScriptFor(ScriptState*);
+    InjectedScript injectedScriptForId(long);
+    void discardInjectedScripts();
+    void releaseWrapperObjectGroup(long injectedScriptId, const String& objectGroup);
+
+private:
+    InjectedScriptHost(InspectorController* inspectorController);
+    InspectorDOMAgent* inspectorDOMAgent();
+    InspectorFrontend* inspectorFrontend();
+    ScriptObject createInjectedScript(const String& source, ScriptState* scriptState, long id);
+
+    InspectorController* m_inspectorController;
+    String m_injectedScriptSource;
+    long m_nextInjectedScriptId;
+    long m_lastWorkerId;
+    typedef HashMap<long, InjectedScript> IdToInjectedScriptMap;
+    IdToInjectedScriptMap m_idToInjectedScript;
+};
+
+} // namespace WebCore
+
+#endif // !defined(InjectedScriptHost_h)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InjectedScriptHost.idl b/src/3rdparty/webkit/WebCore/inspector/InjectedScriptHost.idl
new file mode 100644
index 0000000000..e3cd976483
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InjectedScriptHost.idl
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [Conditional=INSPECTOR] InjectedScriptHost {
+        void clearConsoleMessages();
+
+        void copyText(in DOMString text);
+        [Custom] DOMObject nodeForId(in long nodeId);
+        [Custom] int pushNodePathToFrontend(in DOMObject node, in boolean withChildren, in boolean selectInUI);
+
+        void addNodesToSearchResult(in DOMString nodeIds);
+        long pushNodeByPathToFrontend(in DOMString path);
+
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
+        [Custom] DOMObject currentCallFrame();
+        [Custom] boolean isActivation(in DOMObject object);
+#endif
+
+#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
+        [Custom] DOMObject databaseForId(in long databaseId);
+        [Custom] void selectDatabase(in DOMObject database);
+#endif
+
+#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
+        [Custom] void selectDOMStorage(in DOMObject storage);
+#endif
+
+#if defined(ENABLE_WORKERS) && ENABLE_WORKERS
+        void didCreateWorker(in long id, in DOMString url, in boolean isFakeWorker);
+        void didDestroyWorker(in long id);
+        long nextWorkerId();
+#endif
+        [Custom] void reportDidDispatchOnInjectedScript(in long callId, in DOMObject result, in boolean isException);
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp
index 67c08b9051..0630ee1a3f 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -40,23 +40,25 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLFrameOwnerElement.h"
+#include "InjectedScript.h"
+#include "InjectedScriptHost.h"
 #include "InspectorClient.h"
 #include "InspectorController.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorFrontend.h"
 #include "InspectorResource.h"
+#include "Page.h"
 #include "Pasteboard.h"
 #include "ScriptArray.h"
-#include "ScriptFunctionCall.h"
+#include "ScriptBreakpoint.h"
+#include "SerializedScriptValue.h"
 
 #if ENABLE(DOM_STORAGE)
 #include "Storage.h"
 #endif
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-#include "JavaScriptCallFrame.h"
-#include "JavaScriptDebugServer.h"
-using namespace JSC;
+#include "ScriptDebugServer.h"
 #endif
 
 #include "markup.h"
@@ -68,9 +70,8 @@ using namespace std;
 
 namespace WebCore {
 
-InspectorBackend::InspectorBackend(InspectorController* inspectorController, InspectorClient* client)
+InspectorBackend::InspectorBackend(InspectorController* inspectorController)
     : m_inspectorController(inspectorController)
-    , m_client(client)
 {
 }
 
@@ -78,111 +79,10 @@ InspectorBackend::~InspectorBackend()
 {
 }
 
-void InspectorBackend::hideDOMNodeHighlight()
-{
-    if (m_inspectorController)
-        m_inspectorController->hideHighlight();
-}
-
-String InspectorBackend::localizedStringsURL()
-{
-    return m_client->localizedStringsURL();
-}
-
-String InspectorBackend::hiddenPanels()
-{
-    return m_client->hiddenPanels();
-}
-
-void InspectorBackend::windowUnloading()
-{
-    if (m_inspectorController)
-        m_inspectorController->close();
-}
-
-bool InspectorBackend::isWindowVisible()
+void InspectorBackend::saveFrontendSettings(const String& settings)
 {
     if (m_inspectorController)
-        return m_inspectorController->windowVisible();
-    return false;
-}
-
-void InspectorBackend::addResourceSourceToFrame(long identifier, Node* frame)
-{
-    if (!m_inspectorController)
-        return;
-    RefPtr<InspectorResource> resource = m_inspectorController->resources().get(identifier);
-    if (resource) {
-        String sourceString = resource->sourceString();
-        if (!sourceString.isEmpty())
-            addSourceToFrame(resource->mimeType(), sourceString, frame);
-    }
-}
-
-bool InspectorBackend::addSourceToFrame(const String& mimeType, const String& source, Node* frameNode)
-{
-    ASSERT_ARG(frameNode, frameNode);
-
-    if (!frameNode)
-        return false;
-
-    if (!frameNode->attached()) {
-        ASSERT_NOT_REACHED();
-        return false;
-    }
-
-    ASSERT(frameNode->isElementNode());
-    if (!frameNode->isElementNode())
-        return false;
-
-    Element* element = static_cast<Element*>(frameNode);
-    ASSERT(element->isFrameOwnerElement());
-    if (!element->isFrameOwnerElement())
-        return false;
-
-    HTMLFrameOwnerElement* frameOwner = static_cast<HTMLFrameOwnerElement*>(element);
-    ASSERT(frameOwner->contentFrame());
-    if (!frameOwner->contentFrame())
-        return false;
-
-    FrameLoader* loader = frameOwner->contentFrame()->loader();
-
-    loader->setResponseMIMEType(mimeType);
-    loader->begin();
-    loader->write(source);
-    loader->end();
-
-    return true;
-}
-
-void InspectorBackend::clearMessages(bool clearUI)
-{
-    if (m_inspectorController)
-        m_inspectorController->clearConsoleMessages(clearUI);
-}
-
-void InspectorBackend::toggleNodeSearch()
-{
-    if (m_inspectorController)
-        m_inspectorController->toggleSearchForNodeInPage();
-}
-
-void InspectorBackend::attach()
-{
-    if (m_inspectorController)
-        m_inspectorController->attachWindow();
-}
-
-void InspectorBackend::detach()
-{
-    if (m_inspectorController)
-        m_inspectorController->detachWindow();
-}
-
-void InspectorBackend::setAttachedWindowHeight(unsigned height)
-{
-    if (m_inspectorController)
-        m_inspectorController->setAttachedWindowHeight(height);
+        m_inspectorController->setSetting(InspectorController::frontendSettingsSettingName(), settings);
 }
 
 void InspectorBackend::storeLastActivePanel(const String& panelName)
@@ -191,17 +91,16 @@ void InspectorBackend::storeLastActivePanel(const String& panelName)
         m_inspectorController->storeLastActivePanel(panelName);
 }
 
-bool InspectorBackend::searchingForNode()
+void InspectorBackend::enableSearchingForNode()
 {
     if (m_inspectorController)
-        return m_inspectorController->searchingForNodeInPage();
-    return false;
+        m_inspectorController->setSearchingForNode(true);
 }
 
-void InspectorBackend::loaded()
+void InspectorBackend::disableSearchingForNode()
 {
     if (m_inspectorController)
-        m_inspectorController->scriptObjectReady();
+        m_inspectorController->setSearchingForNode(false);
 }
 
 void InspectorBackend::enableResourceTracking(bool always)
@@ -216,56 +115,23 @@ void InspectorBackend::disableResourceTracking(bool always)
         m_inspectorController->disableResourceTracking(always);
 }
 
-bool InspectorBackend::resourceTrackingEnabled() const
+void InspectorBackend::getResourceContent(long callId, unsigned long identifier)
 {
-    if (m_inspectorController)
-        return m_inspectorController->resourceTrackingEnabled();
-    return false;
-}
+    InspectorFrontend* frontend = inspectorFrontend();
+    if (!frontend)
+        return;
 
-void InspectorBackend::moveWindowBy(float x, float y) const
-{
-    if (m_inspectorController)
-        m_inspectorController->moveWindowBy(x, y);
+    RefPtr<InspectorResource> resource = m_inspectorController->resources().get(identifier);
+    if (resource)
+        frontend->didGetResourceContent(callId, resource->sourceString());
+    else
+        frontend->didGetResourceContent(callId, "");
 }
 
-void InspectorBackend::closeWindow()
+void InspectorBackend::reloadPage()
 {
     if (m_inspectorController)
-        m_inspectorController->closeWindow();
-}
-
-const String& InspectorBackend::platform() const
-{
-#if PLATFORM(MAC)
-#ifdef BUILDING_ON_TIGER
-    DEFINE_STATIC_LOCAL(const String, platform, ("mac-tiger"));
-#else
-    DEFINE_STATIC_LOCAL(const String, platform, ("mac-leopard"));
-#endif
-#elif PLATFORM(WIN_OS)
-    DEFINE_STATIC_LOCAL(const String, platform, ("windows"));
-#else
-    DEFINE_STATIC_LOCAL(const String, platform, ("unknown"));
-#endif
-
-    return platform;
-}
-
-
-const String& InspectorBackend::port() const
-{
-#if PLATFORM(QT)
-    DEFINE_STATIC_LOCAL(const String, port, ("qt"));
-#elif PLATFORM(GTK)
-    DEFINE_STATIC_LOCAL(const String, port, ("gtk"));
-#elif PLATFORM(WX)
-    DEFINE_STATIC_LOCAL(const String, port, ("wx"));
-#else
-    DEFINE_STATIC_LOCAL(const String, port, ("unknown"));
-#endif
-
-    return port;
+        m_inspectorController->m_inspectedPage->mainFrame()->redirectScheduler()->scheduleRefresh(true);
 }
 
 void InspectorBackend::startTimelineProfiler()
@@ -280,156 +146,146 @@ void InspectorBackend::stopTimelineProfiler()
         m_inspectorController->stopTimelineProfiler();
 }
 
-bool InspectorBackend::timelineProfilerEnabled() const
-{
-    if (m_inspectorController)
-        return m_inspectorController->timelineProfilerEnabled();
-    return false;
-}
-
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-void InspectorBackend::startProfiling()
-{
-    if (m_inspectorController)
-        m_inspectorController->startUserInitiatedProfiling();
-}
 
-void InspectorBackend::stopProfiling()
+void InspectorBackend::enableDebugger(bool always)
 {
     if (m_inspectorController)
-        m_inspectorController->stopUserInitiatedProfiling();
+        m_inspectorController->enableDebuggerFromFrontend(always);
 }
 
-void InspectorBackend::enableProfiler(bool always)
+void InspectorBackend::disableDebugger(bool always)
 {
     if (m_inspectorController)
-        m_inspectorController->enableProfiler(always);
+        m_inspectorController->disableDebugger(always);
 }
 
-void InspectorBackend::disableProfiler(bool always)
+void InspectorBackend::setBreakpoint(const String& sourceID, unsigned lineNumber, bool enabled, const String& condition)
 {
     if (m_inspectorController)
-        m_inspectorController->disableProfiler(always);
+        m_inspectorController->setBreakpoint(sourceID, lineNumber, enabled, condition);
 }
 
-bool InspectorBackend::profilerEnabled()
+void InspectorBackend::removeBreakpoint(const String& sourceID, unsigned lineNumber)
 {
     if (m_inspectorController)
-        return m_inspectorController->profilerEnabled();
-    return false;
+        m_inspectorController->removeBreakpoint(sourceID, lineNumber);
 }
 
-void InspectorBackend::getProfileHeaders(long callId)
+void InspectorBackend::activateBreakpoints()
 {
-    if (m_inspectorController)
-        m_inspectorController->getProfileHeaders(callId);
+    ScriptDebugServer::shared().setBreakpointsActivated(true);
 }
 
-void InspectorBackend::getProfile(long callId, unsigned uid)
+void InspectorBackend::deactivateBreakpoints()
 {
-    if (m_inspectorController)
-        m_inspectorController->getProfile(callId, uid);
+    ScriptDebugServer::shared().setBreakpointsActivated(false);
 }
 
-void InspectorBackend::enableDebugger(bool always)
+void InspectorBackend::pauseInDebugger()
 {
-    if (m_inspectorController)
-        m_inspectorController->enableDebuggerFromFrontend(always);
+    ScriptDebugServer::shared().pauseProgram();
 }
 
-void InspectorBackend::disableDebugger(bool always)
+void InspectorBackend::resumeDebugger()
 {
     if (m_inspectorController)
-        m_inspectorController->disableDebugger(always);
+        m_inspectorController->resumeDebugger();
 }
 
-bool InspectorBackend::debuggerEnabled() const
+void InspectorBackend::stepOverStatementInDebugger()
 {
-    if (m_inspectorController)
-        return m_inspectorController->debuggerEnabled();
-    return false;
+    ScriptDebugServer::shared().stepOverStatement();
 }
 
-JavaScriptCallFrame* InspectorBackend::currentCallFrame() const
+void InspectorBackend::stepIntoStatementInDebugger()
 {
-    return JavaScriptDebugServer::shared().currentCallFrame();
+    ScriptDebugServer::shared().stepIntoStatement();
 }
 
-void InspectorBackend::addBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
+void InspectorBackend::stepOutOfFunctionInDebugger()
 {
-    intptr_t sourceIDValue = sourceID.toIntPtr();
-    JavaScriptDebugServer::shared().addBreakpoint(sourceIDValue, lineNumber, condition);
+    ScriptDebugServer::shared().stepOutOfFunction();
 }
 
-void InspectorBackend::updateBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
+void InspectorBackend::setPauseOnExceptionsState(long pauseState)
 {
-    intptr_t sourceIDValue = sourceID.toIntPtr();
-    JavaScriptDebugServer::shared().updateBreakpoint(sourceIDValue, lineNumber, condition);
+    ScriptDebugServer::shared().setPauseOnExceptionsState(static_cast<ScriptDebugServer::PauseOnExceptionsState>(pauseState));
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->updatePauseOnExceptionsState(ScriptDebugServer::shared().pauseOnExceptionsState());
 }
 
-void InspectorBackend::removeBreakpoint(const String& sourceID, unsigned lineNumber)
-{
-    intptr_t sourceIDValue = sourceID.toIntPtr();
-    JavaScriptDebugServer::shared().removeBreakpoint(sourceIDValue, lineNumber);
-}
+#endif
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
 
-bool InspectorBackend::pauseOnExceptions()
+void InspectorBackend::enableProfiler(bool always)
 {
-    return JavaScriptDebugServer::shared().pauseOnExceptions();
+    if (m_inspectorController)
+        m_inspectorController->enableProfiler(always);
 }
 
-void InspectorBackend::setPauseOnExceptions(bool pause)
+void InspectorBackend::disableProfiler(bool always)
 {
-    JavaScriptDebugServer::shared().setPauseOnExceptions(pause);
+    if (m_inspectorController)
+        m_inspectorController->disableProfiler(always);
 }
 
-void InspectorBackend::pauseInDebugger()
+void InspectorBackend::startProfiling()
 {
-    JavaScriptDebugServer::shared().pauseProgram();
+    if (m_inspectorController)
+        m_inspectorController->startUserInitiatedProfiling();
 }
 
-void InspectorBackend::resumeDebugger()
+void InspectorBackend::stopProfiling()
 {
     if (m_inspectorController)
-        m_inspectorController->resumeDebugger();
+        m_inspectorController->stopUserInitiatedProfiling();
 }
 
-void InspectorBackend::stepOverStatementInDebugger()
+void InspectorBackend::getProfileHeaders(long callId)
 {
-    JavaScriptDebugServer::shared().stepOverStatement();
+    if (m_inspectorController)
+        m_inspectorController->getProfileHeaders(callId);
 }
 
-void InspectorBackend::stepIntoStatementInDebugger()
+void InspectorBackend::getProfile(long callId, unsigned uid)
 {
-    JavaScriptDebugServer::shared().stepIntoStatement();
+    if (m_inspectorController)
+        m_inspectorController->getProfile(callId, uid);
 }
+#endif
 
-void InspectorBackend::stepOutOfFunctionInDebugger()
+void InspectorBackend::setInjectedScriptSource(const String& source)
 {
-    JavaScriptDebugServer::shared().stepOutOfFunction();
+    if (m_inspectorController)
+        m_inspectorController->injectedScriptHost()->setInjectedScriptSource(source);
 }
 
-#endif
-
-void InspectorBackend::dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments, bool async)
+void InspectorBackend::dispatchOnInjectedScript(long callId, long injectedScriptId, const String& methodName, const String& arguments, bool async)
 {
     InspectorFrontend* frontend = inspectorFrontend();
     if (!frontend)
         return;
 
-    ScriptFunctionCall function(m_inspectorController->m_scriptState, m_inspectorController->m_injectedScriptObj, "dispatch");
-    function.appendArgument(methodName);
-    function.appendArgument(arguments);
-    if (async)
-        function.appendArgument(static_cast<int>(callId));
+    // FIXME: explicitly pass injectedScriptId along with node id to the frontend.
+    bool injectedScriptIdIsNodeId = injectedScriptId <= 0;
+
+    InjectedScript injectedScript;
+    if (injectedScriptIdIsNodeId)
+        injectedScript = m_inspectorController->injectedScriptForNodeId(-injectedScriptId);
+    else
+        injectedScript = m_inspectorController->injectedScriptHost()->injectedScriptForId(injectedScriptId);
+
+    if (injectedScript.hasNoValue())
+        return;
+
+    RefPtr<SerializedScriptValue> result;
     bool hadException = false;
-    ScriptValue result = function.call(hadException);
+    injectedScript.dispatch(callId, methodName, arguments, async, &result, &hadException);
     if (async)
         return;  // InjectedScript will return result asynchronously by means of ::reportDidDispatchOnInjectedScript.
-    if (hadException)
-        frontend->didDispatchOnInjectedScript(callId, "", true);
-    else
-        frontend->didDispatchOnInjectedScript(callId, result.toString(m_inspectorController->m_scriptState), false);
+    frontend->didDispatchOnInjectedScript(callId, result.get(), hadException);
 }
 
 void InspectorBackend::getChildNodes(long callId, long nodeId)
@@ -500,85 +356,106 @@ void InspectorBackend::removeNode(long callId, long nodeId)
     frontend->didRemoveNode(callId, nodeId);
 }
 
-void InspectorBackend::getCookies(long callId, const String& domain)
+void InspectorBackend::getStyles(long callId, long nodeId, bool authorOnly)
 {
-    if (!m_inspectorController)
-        return;
-    m_inspectorController->getCookies(callId, domain);
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->getStyles(callId, nodeId, authorOnly);
 }
 
-void InspectorBackend::deleteCookie(const String& cookieName, const String& domain)
+void InspectorBackend::getAllStyles(long callId)
 {
-    if (!m_inspectorController)
-        return;
-    m_inspectorController->deleteCookie(cookieName, domain);
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->getAllStyles(callId);
 }
 
-void InspectorBackend::highlight(long nodeId)
+void InspectorBackend::getInlineStyle(long callId, long nodeId)
 {
-    if (Node* node = nodeForId(nodeId))
-        m_inspectorController->highlight(node);
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->getInlineStyle(callId, nodeId);
 }
 
-Node* InspectorBackend::nodeForId(long nodeId)
+void InspectorBackend::getComputedStyle(long callId, long nodeId)
 {
     if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
-        return domAgent->nodeForId(nodeId);
-    return 0;
+        domAgent->getComputedStyle(callId, nodeId);
 }
 
-ScriptValue InspectorBackend::wrapObject(const ScriptValue& object, const String& objectGroup)
+void InspectorBackend::applyStyleText(long callId, long styleId, const String& styleText, const String& propertyName)
 {
-    if (m_inspectorController)
-        return m_inspectorController->wrapObject(object, objectGroup);
-    return ScriptValue();
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->applyStyleText(callId, styleId, styleText, propertyName);
 }
 
-ScriptValue InspectorBackend::unwrapObject(const String& objectId)
+void InspectorBackend::setStyleText(long callId, long styleId, const String& cssText)
 {
-    if (m_inspectorController)
-        return m_inspectorController->unwrapObject(objectId);
-    return ScriptValue();
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->setStyleText(callId, styleId, cssText);
 }
 
-void InspectorBackend::releaseWrapperObjectGroup(const String& objectGroup)
+void InspectorBackend::setStyleProperty(long callId, long styleId, const String& name, const String& value)
 {
-    if (m_inspectorController)
-        m_inspectorController->releaseWrapperObjectGroup(objectGroup);
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->setStyleProperty(callId, styleId, name, value);
 }
 
-long InspectorBackend::pushNodePathToFrontend(Node* node, bool selectInUI)
+void InspectorBackend::toggleStyleEnabled(long callId, long styleId, const String& propertyName, bool disabled)
 {
-    InspectorFrontend* frontend = inspectorFrontend();
-    InspectorDOMAgent* domAgent = inspectorDOMAgent();
-    if (!domAgent || !frontend)
-        return 0;
-    long id = domAgent->pushNodePathToFrontend(node);
-    if (selectInUI)
-        frontend->updateFocusedNode(id);
-    return id;
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->toggleStyleEnabled(callId, styleId, propertyName, disabled);
 }
 
-void InspectorBackend::addNodesToSearchResult(const String& nodeIds)
+void InspectorBackend::setRuleSelector(long callId, long ruleId, const String& selector, long selectedNodeId)
 {
-    if (InspectorFrontend* frontend = inspectorFrontend())
-        frontend->addNodesToSearchResult(nodeIds);
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->setRuleSelector(callId, ruleId, selector, selectedNodeId);
 }
 
-#if ENABLE(DATABASE)
-Database* InspectorBackend::databaseForId(long databaseId)
+void InspectorBackend::addRule(long callId, const String& selector, long selectedNodeId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->addRule(callId, selector, selectedNodeId);
+}
+
+void InspectorBackend::highlightDOMNode(long nodeId)
+{
+    if (Node* node = nodeForId(nodeId))
+        m_inspectorController->highlight(node);
+}
+
+void InspectorBackend::hideDOMNodeHighlight()
 {
     if (m_inspectorController)
-        return m_inspectorController->databaseForId(databaseId);
-    return 0;
+        m_inspectorController->hideHighlight();
+}
+
+void InspectorBackend::getCookies(long callId)
+{
+    if (!m_inspectorController)
+        return;
+    m_inspectorController->getCookies(callId);
+}
+
+void InspectorBackend::deleteCookie(const String& cookieName, const String& domain)
+{
+    if (!m_inspectorController)
+        return;
+    m_inspectorController->deleteCookie(cookieName, domain);
 }
 
-void InspectorBackend::selectDatabase(Database* database)
+void InspectorBackend::releaseWrapperObjectGroup(long injectedScriptId, const String& objectGroup)
+{
+    if (!m_inspectorController)
+        return;
+    m_inspectorController->injectedScriptHost()->releaseWrapperObjectGroup(injectedScriptId, objectGroup);
+}
+
+void InspectorBackend::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
 {
     if (m_inspectorController)
-        m_inspectorController->selectDatabase(database);
+        m_inspectorController->didEvaluateForTestInFrontend(callId, jsonResult);
 }
 
+#if ENABLE(DATABASE)
 void InspectorBackend::getDatabaseTableNames(long callId, long databaseId)
 {
     if (InspectorFrontend* frontend = inspectorFrontend()) {
@@ -596,12 +473,6 @@ void InspectorBackend::getDatabaseTableNames(long callId, long databaseId)
 #endif
 
 #if ENABLE(DOM_STORAGE)
-void InspectorBackend::selectDOMStorage(Storage* storage)
-{
-    if (m_inspectorController)
-        m_inspectorController->selectDOMStorage(storage);
-}
-
 void InspectorBackend::getDOMStorageEntries(long callId, long storageId)
 {
     if (m_inspectorController)
@@ -621,18 +492,6 @@ void InspectorBackend::removeDOMStorageItem(long callId, long storageId, const S
 }
 #endif
 
-void InspectorBackend::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
-{
-    if (m_inspectorController)
-        m_inspectorController->didEvaluateForTestInFrontend(callId, jsonResult);
-}
-
-void InspectorBackend::reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException)
-{
-    if (InspectorFrontend* frontend = inspectorFrontend())
-        frontend->didDispatchOnInjectedScript(callId, result, isException);
-}
-
 InspectorDOMAgent* InspectorBackend::inspectorDOMAgent()
 {
     if (!m_inspectorController)
@@ -647,6 +506,25 @@ InspectorFrontend* InspectorBackend::inspectorFrontend()
     return m_inspectorController->m_frontend.get();
 }
 
+Node* InspectorBackend::nodeForId(long nodeId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        return domAgent->nodeForId(nodeId);
+    return 0;
+}
+
+void InspectorBackend::addScriptToEvaluateOnLoad(const String& source)
+{
+    if (m_inspectorController)
+        m_inspectorController->addScriptToEvaluateOnLoad(source);
+}
+
+void InspectorBackend::removeAllScriptsToEvaluateOnLoad()
+{
+    if (m_inspectorController)
+        m_inspectorController->removeAllScriptsToEvaluateOnLoad();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h
index 08bb5e5f10..3cc2545264 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h
@@ -39,100 +39,72 @@ namespace WebCore {
 
 class CachedResource;
 class Database;
-class InspectorClient;
 class InspectorDOMAgent;
-class JavaScriptCallFrame;
+class InspectorFrontend;
 class Node;
 class Storage;
 
 class InspectorBackend : public RefCounted<InspectorBackend>
 {
 public:
-    static PassRefPtr<InspectorBackend> create(InspectorController* inspectorController, InspectorClient* client)
+    static PassRefPtr<InspectorBackend> create(InspectorController* inspectorController)
     {
-        return adoptRef(new InspectorBackend(inspectorController, client));
+        return adoptRef(new InspectorBackend(inspectorController));
     }
 
     ~InspectorBackend();
 
     InspectorController* inspectorController() { return m_inspectorController; }
-    
     void disconnectController() { m_inspectorController = 0; }
 
-    void hideDOMNodeHighlight();
-
-    String localizedStringsURL();
-    String hiddenPanels();
-
-    void windowUnloading();
-
-    bool isWindowVisible();
-
-    void addResourceSourceToFrame(long identifier, Node* frame);
-    bool addSourceToFrame(const String& mimeType, const String& source, Node* frame);
-
-    void clearMessages(bool clearUI);
-
-    void toggleNodeSearch();
-
-    void attach();
-    void detach();
-
-    void setAttachedWindowHeight(unsigned height);
+    void saveFrontendSettings(const String&);
 
     void storeLastActivePanel(const String& panelName);
 
-    bool searchingForNode();
-
-    void loaded();
+    void enableSearchingForNode();
+    void disableSearchingForNode();
 
     void enableResourceTracking(bool always);
     void disableResourceTracking(bool always);
-    bool resourceTrackingEnabled() const;
-
-    void moveWindowBy(float x, float y) const;
-    void closeWindow();
-
-    const String& platform() const;
-    const String& port() const;
+    void getResourceContent(long callId, unsigned long identifier);
+    void reloadPage();
 
     void startTimelineProfiler();
     void stopTimelineProfiler();
-    bool timelineProfilerEnabled() const;
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    void startProfiling();
-    void stopProfiling();
-
-    void enableProfiler(bool always);
-    void disableProfiler(bool always);
-    bool profilerEnabled();
-
-    void getProfileHeaders(long callId);
-    void getProfile(long callId, unsigned uid);
-
     void enableDebugger(bool always);
     void disableDebugger(bool always);
-    bool debuggerEnabled() const;
 
-    JavaScriptCallFrame* currentCallFrame() const;
-
-    void addBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition);
-    void updateBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition);
+    void setBreakpoint(const String& sourceID, unsigned lineNumber, bool enabled, const String& condition);
     void removeBreakpoint(const String& sourceID, unsigned lineNumber);
-
-    bool pauseOnExceptions();
-    void setPauseOnExceptions(bool pause);
+    void activateBreakpoints();
+    void deactivateBreakpoints();
 
     void pauseInDebugger();
     void resumeDebugger();
 
+    void setPauseOnExceptionsState(long pauseState);
+
     void stepOverStatementInDebugger();
     void stepIntoStatementInDebugger();
     void stepOutOfFunctionInDebugger();
+
+    void enableProfiler(bool always);
+    void disableProfiler(bool always);
+
+    void startProfiling();
+    void stopProfiling();
+
+    void getProfileHeaders(long callId);
+    void getProfile(long callId, unsigned uid);
 #endif
 
-    void dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments, bool async);
+    void setInjectedScriptSource(const String& source);
+    void dispatchOnInjectedScript(long callId, long injectedScriptId, const String& methodName, const String& arguments, bool async);
+    void addScriptToEvaluateOnLoad(const String& source);
+    void removeAllScriptsToEvaluateOnLoad();
+
     void getChildNodes(long callId, long nodeId);
     void setAttribute(long callId, long elementId, const String& name, const String& value);
     void removeAttribute(long callId, long elementId, const String& name);
@@ -141,38 +113,44 @@ public:
     void copyNode(long nodeId);
     void removeNode(long callId, long nodeId);
 
-    void getCookies(long callId, const String& domain);
+    void getStyles(long callId, long nodeId, bool authOnly);
+    void getAllStyles(long callId);
+    void getInlineStyle(long callId, long nodeId);
+    void getComputedStyle(long callId, long nodeId);
+    void applyStyleText(long callId, long styleId, const String& styleText, const String& propertyName);
+    void setStyleText(long callId, long styleId, const String& cssText);
+    void setStyleProperty(long callId, long styleId, const String& name, const String& value);
+    void toggleStyleEnabled(long callId, long styleId, const String& propertyName, bool disabled);
+    void setRuleSelector(long callId, long ruleId, const String& selector, long selectedNodeId);
+    void addRule(long callId, const String& selector, long selectedNodeId);
+
+    void highlightDOMNode(long nodeId);
+    void hideDOMNodeHighlight();
+
+    void getCookies(long callId);
     void deleteCookie(const String& cookieName, const String& domain);
 
     // Generic code called from custom implementations.
-    void highlight(long nodeId);
-    Node* nodeForId(long nodeId);
-    ScriptValue wrapObject(const ScriptValue& object, const String& objectGroup);
-    ScriptValue unwrapObject(const String& objectId);
-    void releaseWrapperObjectGroup(const String& objectGroup);
-    long pushNodePathToFrontend(Node* node, bool selectInUI);
-    void addNodesToSearchResult(const String& nodeIds);
+    void releaseWrapperObjectGroup(long injectedScriptId, const String& objectGroup);
+    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
+
 #if ENABLE(DATABASE)
-    Database* databaseForId(long databaseId);
-    void selectDatabase(Database* database);
     void getDatabaseTableNames(long callId, long databaseId);
 #endif
+
 #if ENABLE(DOM_STORAGE)
-    void selectDOMStorage(Storage* storage);
     void getDOMStorageEntries(long callId, long storageId);
     void setDOMStorageItem(long callId, long storageId, const String& key, const String& value);
     void removeDOMStorageItem(long callId, long storageId, const String& key);
 #endif
-    void reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException);
-    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
 
 private:
-    InspectorBackend(InspectorController* inspectorController, InspectorClient* client);
+    InspectorBackend(InspectorController* inspectorController);
     InspectorDOMAgent* inspectorDOMAgent();
     InspectorFrontend* inspectorFrontend();
+    Node* nodeForId(long nodeId);
 
     InspectorController* m_inspectorController;
-    InspectorClient* m_client;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl
index fd5dd79a02..2b3cb6f046 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl
@@ -31,56 +31,30 @@
  */
 
 module core {
-    interface [
-        GenerateConstructor
-    ] InspectorBackend {
-        void hideDOMNodeHighlight();
-        [Custom] void highlightDOMNode(in long nodeId);
-        void loaded();
-        void windowUnloading();
-        void attach();
-        void detach();
-
-        void closeWindow();
-        void clearMessages(in boolean clearUI);
-        void toggleNodeSearch();
-
-        boolean isWindowVisible();
-        boolean searchingForNode();
-
-        void addResourceSourceToFrame(in long identifier, in Node frame);
-        boolean addSourceToFrame(in DOMString mimeType, in DOMString sourceValue, in Node frame);
-        [Custom] void search(in Node node, in DOMString query);
-#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
-        void getDatabaseTableNames(in long callId, in long databaseId);
-#endif
+    interface [Conditional=INSPECTOR] InspectorBackend {
+        void storeLastActivePanel(in DOMString panelName);
+
+        void saveFrontendSettings(in DOMString settings);
+
+        void enableSearchingForNode();
+        void disableSearchingForNode();
 
-        [Custom] DOMObject setting(in DOMString key);
-        [Custom] void setSetting(in DOMString key, in DOMObject  value);
-        [Custom] DOMWindow inspectedWindow();
-        DOMString localizedStringsURL();
-        DOMString hiddenPanels();
-        DOMString platform();
-        DOMString port();
-        void startTimelineProfiler();
-        void stopTimelineProfiler();
-        boolean timelineProfilerEnabled();
-        [ImplementationFunction=moveWindowBy] void moveByUnrestricted(in float x, in float y);
-        void setAttachedWindowHeight(in unsigned long height);
-        [Custom] DOMObject wrapCallback(in DOMObject callback);
-        boolean resourceTrackingEnabled();
         void enableResourceTracking(in boolean always);
         void disableResourceTracking(in boolean always);
-        void storeLastActivePanel(in DOMString panelName);
+        void getResourceContent(in long callId, in unsigned long identifier);
+        void reloadPage();
+
+        void startTimelineProfiler();
+        void stopTimelineProfiler();
 
 #if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
-        boolean debuggerEnabled();
         void enableDebugger(in boolean always);
         void disableDebugger(in boolean always);
 
-        void addBreakpoint(in DOMString sourceID, in unsigned long lineNumber, in DOMString condition);
-        void updateBreakpoint(in DOMString sourceID, in unsigned long lineNumber, in DOMString condition);
+        void setBreakpoint(in DOMString sourceID, in unsigned long lineNumber, in boolean enabled, in DOMString condition);
         void removeBreakpoint(in DOMString sourceID, in unsigned long lineNumber);
+        void activateBreakpoints();
+        void deactivateBreakpoints();
 
         void pauseInDebugger();
         void resumeDebugger();
@@ -89,12 +63,8 @@ module core {
         void stepIntoStatementInDebugger();
         void stepOutOfFunctionInDebugger();
 
-        [Custom] DOMObject currentCallFrame();
-
-        boolean pauseOnExceptions();
-        void setPauseOnExceptions(in boolean pauseOnExceptions);
+        void setPauseOnExceptionsState(in long pauseOnExceptionsState);
 
-        boolean profilerEnabled();
         void enableProfiler(in boolean always);
         void disableProfiler(in boolean always);
 
@@ -104,7 +74,12 @@ module core {
         void getProfileHeaders(in long callId);
         void getProfile(in long callId, in unsigned long uid);
 #endif
-        void dispatchOnInjectedScript(in long callId, in DOMString methodName, in DOMString arguments, in boolean async);
+        void setInjectedScriptSource(in DOMString scriptSource);
+        void dispatchOnInjectedScript(in long callId, in long injectedScriptId, in DOMString methodName, in DOMString arguments, in boolean async);
+
+        void addScriptToEvaluateOnLoad(in DOMString scriptSource);
+        void removeAllScriptsToEvaluateOnLoad();
+
         void getChildNodes(in long callId, in long nodeId);
         void setAttribute(in long callId, in long elementId, in DOMString name, in DOMString value);
         void removeAttribute(in long callId, in long elementId, in DOMString name);
@@ -112,29 +87,34 @@ module core {
         void getEventListenersForNode(in long callId, in long nodeId);
         void copyNode(in long nodeId);
         void removeNode(in long callId, in long nodeId);
+        void highlightDOMNode(in long nodeId);
+        void hideDOMNodeHighlight();
 
-        void getCookies(in long callId, in DOMString domain);
+        void getStyles(in long callId, in long nodeId, in boolean authOnly);
+        void getAllStyles(in long callId);
+        void getInlineStyle(in long callId, in long nodeId);
+        void getComputedStyle(in long callId, in long nodeId);
+        void applyStyleText(in long callId, in long styleId, in DOMString styleText, in DOMString propertyName);
+        void setStyleText(in long callId, in long styleId, in DOMString styleText);
+        void setStyleProperty(in long callId, in long styleId, in DOMString name, in DOMString value);
+        void toggleStyleEnabled(in long callId, in long styleId, in DOMString propertyName, in boolean disabled);
+        void setRuleSelector(in long callId, in long ruleId, in DOMString selector, in long selectedNodeId);
+        void addRule(in long callId, in DOMString selector, in long selectedNodeId);
+
+        void getCookies(in long callId);
         void deleteCookie(in DOMString cookieName, in DOMString domain);
 
-        // Called from InjectedScript.
-        // TODO: extract into a separate IDL.
-        [Custom] DOMObject nodeForId(in long nodeId);
-        [Custom] long wrapObject(in DOMObject object, in DOMString objectGroup);
-        [Custom] DOMObject unwrapObject(in long objectId);
-        void releaseWrapperObjectGroup(in DOMString objectGroup);
-        [Custom] int pushNodePathToFrontend(in DOMObject node, in boolean selectInUI);
-        void addNodesToSearchResult(in DOMString nodeIds);
+        void releaseWrapperObjectGroup(in long injectedScriptId, in DOMString objectGroup);
+        void didEvaluateForTestInFrontend(in long callId, in DOMString jsonResult);
+
 #if defined(ENABLE_DATABASE) && ENABLE_DATABASE
-        [Custom] void selectDatabase(in DOMObject database);
-        [Custom] DOMObject databaseForId(in long databaseId);
+        void getDatabaseTableNames(in long callId, in long databaseId);
 #endif
+
 #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
-        [Custom] void selectDOMStorage(in DOMObject storage);
         void getDOMStorageEntries(in long callId, in long storageId);
         void setDOMStorageItem(in long callId, in long storageId, in DOMString key, in DOMString value);
         void removeDOMStorageItem(in long callId, in long storageId, in DOMString key);
 #endif
-        void reportDidDispatchOnInjectedScript(in long callId, in DOMString result, in boolean isException);
-        void didEvaluateForTestInFrontend(in long callId, in DOMString jsonResult);
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h b/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h
index f96662a7f7..841c15eb0e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h
@@ -30,6 +30,7 @@
 
 namespace WebCore {
 
+class InspectorController;
 class Node;
 class Page;
 class String;
@@ -40,30 +41,13 @@ public:
 
     virtual void inspectorDestroyed() = 0;
 
-    virtual Page* createPage() = 0;
-
-    virtual String localizedStringsURL() = 0;
-
-    virtual String hiddenPanels() = 0;
-
-    virtual void showWindow() = 0;
-    virtual void closeWindow() = 0;
-
-    virtual void attachWindow() = 0;
-    virtual void detachWindow() = 0;
-
-    virtual void setAttachedWindowHeight(unsigned height) = 0;
+    virtual void openInspectorFrontend(InspectorController*) = 0;
 
     virtual void highlight(Node*) = 0;
     virtual void hideHighlight() = 0;
 
-    virtual void inspectedURLChanged(const String& newURL) = 0;
-
-    virtual void populateSetting(const String& key, InspectorController::Setting&) = 0;
-    virtual void storeSetting(const String& key, const InspectorController::Setting&) = 0;
-    virtual void removeSetting(const String& key) = 0;
-
-    virtual void inspectorWindowObjectCleared() = 0;
+    virtual void populateSetting(const String& key, String* value) = 0;
+    virtual void storeSetting(const String& key, const String& value) = 0;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
index a6628cd9f0..1a6ef5959c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -24,7 +24,7 @@
  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
 #include "config.h"
@@ -34,13 +34,14 @@
 
 #include "CString.h"
 #include "CachedResource.h"
+#include "Chrome.h"
 #include "Console.h"
 #include "ConsoleMessage.h"
 #include "Cookie.h"
 #include "CookieJar.h"
+#include "DOMWindow.h"
 #include "Document.h"
 #include "DocumentLoader.h"
-#include "DOMWindow.h"
 #include "Element.h"
 #include "FloatConversion.h"
 #include "FloatQuad.h"
@@ -52,24 +53,31 @@
 #include "GraphicsContext.h"
 #include "HTMLFrameOwnerElement.h"
 #include "HitTestResult.h"
+#include "InjectedScript.h"
+#include "InjectedScriptHost.h"
 #include "InspectorBackend.h"
 #include "InspectorClient.h"
-#include "InspectorFrontend.h"
-#include "InspectorDatabaseResource.h"
+#include "InspectorFrontendClient.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorDOMStorageResource.h"
-#include "InspectorTimelineAgent.h"
+#include "InspectorDatabaseResource.h"
+#include "InspectorFrontend.h"
 #include "InspectorResource.h"
-#include "JavaScriptProfile.h"
+#include "InspectorWorkerResource.h"
+#include "InspectorTimelineAgent.h"
 #include "Page.h"
+#include "ProgressTracker.h"
 #include "Range.h"
 #include "RenderInline.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
+#include "ScriptBreakpoint.h"
 #include "ScriptCallStack.h"
 #include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
-#include "ScriptObjectQuarantine.h"
+#include "ScriptProfile.h"
+#include "ScriptProfiler.h"
+#include "ScriptSourceCode.h"
 #include "ScriptString.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
@@ -91,17 +99,16 @@
 #endif
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-#include "JavaScriptCallFrame.h"
-#include "JavaScriptDebugServer.h"
-#include "JSJavaScriptCallFrame.h"
+#include "ScriptDebugServer.h"
+#endif
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC)
+#include "JavaScriptProfile.h"
 
-#include <profiler/Profile.h>
-#include <profiler/Profiler.h>
 #include <runtime/JSLock.h>
 #include <runtime/UString.h>
-
-using namespace JSC;
 #endif
+
 using namespace std;
 
 namespace WebCore {
@@ -114,32 +121,45 @@ static const char* const profilerEnabledSettingName = "profilerEnabled";
 static const char* const inspectorAttachedHeightName = "inspectorAttachedHeight";
 static const char* const lastActivePanelSettingName = "lastActivePanel";
 
+const String& InspectorController::frontendSettingsSettingName()
+{
+    DEFINE_STATIC_LOCAL(String, settingName, ("frontendSettings"));
+    return settingName;
+}
+
+const String& InspectorController::inspectorStartsAttachedSettingName()
+{
+    DEFINE_STATIC_LOCAL(String, settingName, ("inspectorStartsAttached"));
+    return settingName;
+}
+
 static const unsigned defaultAttachedHeight = 300;
 static const float minimumAttachedHeight = 250.0f;
 static const float maximumAttachedHeightRatio = 0.75f;
+static const unsigned maximumConsoleMessages = 1000;
+static const unsigned expireConsoleMessagesStep = 100;
 
 static unsigned s_inspectorControllerCount;
-static HashMap<String, InspectorController::Setting*>* s_settingCache;
 
 InspectorController::InspectorController(Page* page, InspectorClient* client)
     : m_inspectedPage(page)
     , m_client(client)
-    , m_page(0)
-    , m_scriptState(0)
-    , m_windowVisible(false)
+    , m_openingFrontend(false)
+    , m_expiredConsoleMessageCount(0)
     , m_showAfterVisible(CurrentPanel)
-    , m_nextIdentifier(-2)
     , m_groupLevel(0)
     , m_searchingForNode(false)
     , m_previousMessage(0)
     , m_resourceTrackingEnabled(false)
     , m_resourceTrackingSettingsLoaded(false)
-    , m_inspectorBackend(InspectorBackend::create(this, client))
-    , m_lastBoundObjectId(1)
+    , m_inspectorBackend(InspectorBackend::create(this))
+    , m_injectedScriptHost(InjectedScriptHost::create(this))
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     , m_debuggerEnabled(false)
     , m_attachDebuggerWhenShown(false)
-    , m_profilerEnabled(false)
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    , m_profilerEnabled(!WTF_USE_JSC)
     , m_recordingUserInitiatedProfile(false)
     , m_currentUserInitiatedProfileNumber(-1)
     , m_nextUserInitiatedProfileNumber(1)
@@ -155,9 +175,7 @@ InspectorController::~InspectorController()
 {
     // These should have been cleared in inspectedPageDestroyed().
     ASSERT(!m_client);
-    ASSERT(!m_scriptState);
     ASSERT(!m_inspectedPage);
-    ASSERT(!m_page || (m_page && !m_page->parentInspectorController()));
 
     deleteAllValues(m_frameResources);
     deleteAllValues(m_consoleMessages);
@@ -165,23 +183,16 @@ InspectorController::~InspectorController()
     ASSERT(s_inspectorControllerCount);
     --s_inspectorControllerCount;
 
-    if (!s_inspectorControllerCount && s_settingCache) {
-        deleteAllValues(*s_settingCache);
-        delete s_settingCache;
-        s_settingCache = 0;
-    }
-    
     releaseDOMAgent();
 
     m_inspectorBackend->disconnectController();
+    m_injectedScriptHost->disconnectController();
 }
 
 void InspectorController::inspectedPageDestroyed()
 {
-    close();
-
-    if (m_scriptState)
-        ScriptGlobalObject::remove(m_scriptState, "InspectorController");
+    if (m_frontend)
+        m_frontend->inspectedPageDestroyed();
 
     ASSERT(m_inspectedPage);
     m_inspectedPage = 0;
@@ -197,46 +208,22 @@ bool InspectorController::enabled() const
     return m_inspectedPage->settings()->developerExtrasEnabled();
 }
 
-const InspectorController::Setting& InspectorController::setting(const String& key) const
+String InspectorController::setting(const String& key) const
 {
-    if (!s_settingCache)
-        s_settingCache = new HashMap<String, Setting*>;
-
-    if (Setting* cachedSetting = s_settingCache->get(key))
-        return *cachedSetting;
-
-    Setting* newSetting = new Setting;
-    s_settingCache->set(key, newSetting);
-
-    m_client->populateSetting(key, *newSetting);
+    Settings::iterator it = m_settings.find(key);
+    if (it != m_settings.end())
+        return it->second;
 
-    return *newSetting;
+    String value;
+    m_client->populateSetting(key, &value);
+    m_settings.set(key, value);
+    return value;
 }
 
-void InspectorController::setSetting(const String& key, const Setting& setting)
+void InspectorController::setSetting(const String& key, const String& value)
 {
-    if (setting.type() == Setting::NoType) {
-        if (s_settingCache) {
-            Setting* cachedSetting = s_settingCache->get(key);
-            if (cachedSetting) {
-                s_settingCache->remove(key);
-                delete cachedSetting;
-            }
-        }
-
-        m_client->removeSetting(key);
-        return;
-    }
-
-    if (!s_settingCache)
-        s_settingCache = new HashMap<String, Setting*>;
-
-    if (Setting* cachedSetting = s_settingCache->get(key))
-        *cachedSetting = setting;
-    else
-        s_settingCache->set(key, new Setting(setting));
-
-    m_client->storeSetting(key, setting);
+    m_settings.set(key, value);
+    m_client->storeSetting(key, value);
 }
 
 // Trying to inspect something in a frame with JavaScript disabled would later lead to
@@ -247,7 +234,7 @@ static bool canPassNodeToJavaScript(Node* node)
     if (!node)
         return false;
     Frame* frame = node->document()->frame();
-    return frame && frame->script()->isEnabled();
+    return frame && frame->script()->canExecuteScripts(NotAboutToExecuteScript);
 }
 
 void InspectorController::inspect(Node* node)
@@ -301,53 +288,7 @@ void InspectorController::hideHighlight()
 
 bool InspectorController::windowVisible()
 {
-    return m_windowVisible;
-}
-
-void InspectorController::setWindowVisible(bool visible, bool attached)
-{
-    if (visible == m_windowVisible || !m_frontend)
-        return;
-
-    m_windowVisible = visible;
-
-    if (m_windowVisible) {
-        setAttachedWindow(attached);
-        populateScriptObjects();
-
-        // Console panel is implemented as a 'fast view', so there should be
-        // real panel opened along with it.
-        bool showConsole = m_showAfterVisible == ConsolePanel;
-        if (m_showAfterVisible == CurrentPanel || showConsole) {
-          Setting lastActivePanelSetting = setting(lastActivePanelSettingName);
-          if (lastActivePanelSetting.type() == Setting::StringType)
-              m_showAfterVisible = specialPanelForJSName(lastActivePanelSetting.string());
-          else
-              m_showAfterVisible = ElementsPanel;
-        }
-
-        if (m_nodeToFocus)
-            focusNode();
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-        if (m_attachDebuggerWhenShown)
-            enableDebugger();
-#endif
-        showPanel(m_showAfterVisible);
-        if (showConsole)
-            showPanel(ConsolePanel);
-    } else {
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-        // If the window is being closed with the debugger enabled,
-        // remember this state to re-enable debugger on the next window
-        // opening.
-        bool debuggerWasEnabled = m_debuggerEnabled;
-        disableDebugger();
-        if (debuggerWasEnabled)
-            m_attachDebuggerWhenShown = true;
-#endif
-        resetScriptObjects();
-    }
-    m_showAfterVisible = CurrentPanel;
+    return m_frontend;
 }
 
 void InspectorController::addMessageToConsole(MessageSource source, MessageType type, MessageLevel level, ScriptCallStack* callStack)
@@ -374,26 +315,34 @@ void InspectorController::addConsoleMessage(ScriptState* scriptState, ConsoleMes
     if (m_previousMessage && m_previousMessage->isEqual(scriptState, consoleMessage)) {
         m_previousMessage->incrementCount();
         delete consoleMessage;
-        if (windowVisible())
+        if (m_frontend)
             m_previousMessage->updateRepeatCountInConsole(m_frontend.get());
     } else {
         m_previousMessage = consoleMessage;
         m_consoleMessages.append(consoleMessage);
-        if (windowVisible())
-            m_previousMessage->addToConsole(m_frontend.get());
+        if (m_frontend)
+            m_previousMessage->addToFrontend(m_frontend.get(), m_injectedScriptHost.get());
+    }
+
+    if (!m_frontend && m_consoleMessages.size() >= maximumConsoleMessages) {
+        m_expiredConsoleMessageCount += expireConsoleMessagesStep;
+        for (size_t i = 0; i < expireConsoleMessagesStep; ++i)
+            delete m_consoleMessages[i];
+        m_consoleMessages.remove(0, expireConsoleMessagesStep);
     }
 }
 
-void InspectorController::clearConsoleMessages(bool clearUI)
+void InspectorController::clearConsoleMessages()
 {
     deleteAllValues(m_consoleMessages);
     m_consoleMessages.clear();
+    m_expiredConsoleMessageCount = 0;
     m_previousMessage = 0;
     m_groupLevel = 0;
-    releaseWrapperObjectGroup("console");
+    m_injectedScriptHost->releaseWrapperObjectGroup(0 /* release the group in all scripts */, "console");
     if (m_domAgent)
         m_domAgent->releaseDanglingNodes();
-    if (clearUI && m_frontend)
+    if (m_frontend)
         m_frontend->clearConsoleMessages();
 }
 
@@ -406,7 +355,7 @@ void InspectorController::startGroup(MessageSource source, ScriptCallStack* call
 
 void InspectorController::endGroup(MessageSource source, unsigned lineNumber, const String& sourceURL)
 {
-    if (m_groupLevel == 0)
+    if (!m_groupLevel)
         return;
 
     --m_groupLevel;
@@ -414,69 +363,15 @@ void InspectorController::endGroup(MessageSource source, unsigned lineNumber, co
     addConsoleMessage(0, new ConsoleMessage(source, EndGroupMessageType, LogMessageLevel, String(), lineNumber, sourceURL, m_groupLevel));
 }
 
-static unsigned constrainedAttachedWindowHeight(unsigned preferredHeight, unsigned totalWindowHeight)
-{
-    return roundf(max(minimumAttachedHeight, min<float>(preferredHeight, totalWindowHeight * maximumAttachedHeightRatio)));
-}
-
-void InspectorController::attachWindow()
-{
-    if (!enabled())
-        return;
-
-    unsigned inspectedPageHeight = m_inspectedPage->mainFrame()->view()->visibleHeight();
-
-    m_client->attachWindow();
-
-    Setting attachedHeight = setting(inspectorAttachedHeightName);
-    unsigned preferredHeight = attachedHeight.type() == Setting::IntegerType ? attachedHeight.integerValue() : defaultAttachedHeight;
-
-    // We need to constrain the window height here in case the user has resized the inspected page's window so that
-    // the user's preferred height would be too big to display.
-    m_client->setAttachedWindowHeight(constrainedAttachedWindowHeight(preferredHeight, inspectedPageHeight));
-}
-
-void InspectorController::detachWindow()
-{
-    if (!enabled())
-        return;
-    m_client->detachWindow();
-}
-
-void InspectorController::setAttachedWindow(bool attached)
-{
-    if (!enabled() || !m_frontend)
-        return;
-
-    m_frontend->setAttachedWindow(attached);
-}
-
-void InspectorController::setAttachedWindowHeight(unsigned height)
+void InspectorController::markTimeline(const String& message)
 {
-    if (!enabled())
-        return;
-    
-    unsigned totalHeight = m_page->mainFrame()->view()->visibleHeight() + m_inspectedPage->mainFrame()->view()->visibleHeight();
-    unsigned attachedHeight = constrainedAttachedWindowHeight(height, totalHeight);
-    
-    setSetting(inspectorAttachedHeightName, Setting(attachedHeight));
-    
-    m_client->setAttachedWindowHeight(attachedHeight);
+    if (timelineAgent())
+        timelineAgent()->didMarkTimeline(message);
 }
 
 void InspectorController::storeLastActivePanel(const String& panelName)
 {
-    setSetting(lastActivePanelSettingName, Setting(panelName));
-}
-
-void InspectorController::toggleSearchForNodeInPage()
-{
-    if (!enabled())
-        return;
-
-    m_searchingForNode = !m_searchingForNode;
-    if (!m_searchingForNode)
-        hideHighlight();
+    setSetting(lastActivePanelSettingName, panelName);
 }
 
 void InspectorController::mouseDidMoveOverElement(const HitTestResult& result, unsigned)
@@ -485,6 +380,8 @@ void InspectorController::mouseDidMoveOverElement(const HitTestResult& result, u
         return;
 
     Node* node = result.innerNode();
+    while (node && node->nodeType() == Node::TEXT_NODE)
+        node = node->parentNode();
     if (node)
         highlight(node);
 }
@@ -499,87 +396,91 @@ void InspectorController::handleMousePressOnNode(Node* node)
     if (!node)
         return;
 
-    // inspect() will implicitly call ElementsPanel's focusedNodeChanged() and the hover feedback will be stopped there.
+    setSearchingForNode(false);
     inspect(node);
 }
 
-void InspectorController::inspectedWindowScriptObjectCleared(Frame* frame)
+void InspectorController::setInspectorFrontendClient(PassOwnPtr<InspectorFrontendClient> client)
 {
-    if (!enabled() || !m_frontend || frame != m_inspectedPage->mainFrame())
-        return;
-    resetInjectedScript();
+    ASSERT(!m_inspectorFrontendClient);
+    m_inspectorFrontendClient = client;
 }
 
-void InspectorController::windowScriptObjectAvailable()
+void InspectorController::inspectedWindowScriptObjectCleared(Frame* frame)
 {
-    if (!m_page || !enabled())
-        return;
+    // If the page is supposed to serve as InspectorFrontend notify inspetor frontend
+    // client that it's cleared so that the client can expose inspector bindings.
+    if (m_inspectorFrontendClient && frame == m_inspectedPage->mainFrame())
+        m_inspectorFrontendClient->windowObjectCleared();
 
-    // Grant the inspector the ability to script the inspected page.
-    m_page->mainFrame()->document()->securityOrigin()->grantUniversalAccess();
-    m_scriptState = scriptStateFromPage(m_page);
-    ScriptGlobalObject::set(m_scriptState, "InspectorController", m_inspectorBackend.get());
+    if (!enabled() || !m_frontend || frame != m_inspectedPage->mainFrame())
+        return;
+    m_injectedScriptHost->discardInjectedScripts();
 }
 
-void InspectorController::scriptObjectReady()
+void InspectorController::setSearchingForNode(bool enabled)
 {
-    ASSERT(m_scriptState);
-    if (!m_scriptState)
-        return;
-
-    ScriptObject webInspectorObj;
-    if (!ScriptGlobalObject::get(m_scriptState, "WebInspector", webInspectorObj))
-        return;
-    ScriptObject injectedScriptObj;
-    if (!ScriptGlobalObject::get(m_scriptState, "InjectedScript", injectedScriptObj))
+    if (m_searchingForNode == enabled)
         return;
-    setFrontendProxyObject(m_scriptState, webInspectorObj, injectedScriptObj);
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    Setting debuggerEnabled = setting(debuggerEnabledSettingName);
-    if (debuggerEnabled.type() == Setting::BooleanType && debuggerEnabled.booleanValue())
-        enableDebugger();
-    Setting profilerEnabled = setting(profilerEnabledSettingName);
-    if (profilerEnabled.type() == Setting::BooleanType && profilerEnabled.booleanValue())
-        enableProfiler();
-#endif
-
-    // Make sure our window is visible now that the page loaded
-    showWindow();
-
-    m_client->inspectorWindowObjectCleared();
+    m_searchingForNode = enabled;
+    if (!m_searchingForNode)
+        hideHighlight();
+    if (m_frontend) {
+        if (enabled)
+            m_frontend->searchingForNodeWasEnabled();
+        else
+            m_frontend->searchingForNodeWasDisabled();
+    }
 }
 
-void InspectorController::setFrontendProxyObject(ScriptState* scriptState, ScriptObject webInspectorObj, ScriptObject injectedScriptObj)
+void InspectorController::setFrontend(PassOwnPtr<InspectorFrontend> frontend)
 {
-    m_scriptState = scriptState;
-    m_injectedScriptObj = injectedScriptObj;
-    m_frontend.set(new InspectorFrontend(this, scriptState, webInspectorObj));
+    ASSERT(frontend);
+    m_openingFrontend = false;
+    m_frontend = frontend;
     releaseDOMAgent();
     m_domAgent = InspectorDOMAgent::create(m_frontend.get());
     if (m_timelineAgent)
         m_timelineAgent->resetFrontendProxyObject(m_frontend.get());
+#if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC)
+    String debuggerEnabled = setting(debuggerEnabledSettingName);
+    if (debuggerEnabled == "true")
+        enableDebugger();
+    String profilerEnabled = setting(profilerEnabledSettingName);
+    if (profilerEnabled == "true")
+        enableProfiler();
+#endif
+
+    populateScriptObjects();
+    
+    if (m_showAfterVisible == CurrentPanel) {
+        String lastActivePanelSetting = setting(lastActivePanelSettingName);
+        m_showAfterVisible = specialPanelForJSName(lastActivePanelSetting);
+    }
+    
+    if (m_nodeToFocus)
+        focusNode();
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (m_attachDebuggerWhenShown)
+        enableDebugger();
+#endif
+    showPanel(m_showAfterVisible);
 }
 
 void InspectorController::show()
 {
     if (!enabled())
         return;
-    
-    if (!m_page) {
-        if (m_frontend)
-            return;  // We are using custom frontend - no need to create page.
-
-        m_page = m_client->createPage();
-        if (!m_page)
-            return;
-        m_page->setParentInspectorController(this);
 
-        // showWindow() will be called after the page loads in scriptObjectReady()
+    if (m_openingFrontend)
         return;
+    
+    if (m_frontend)
+        m_frontend->bringToFront();
+    else {
+        m_openingFrontend = true;
+        m_client->openInspectorFrontend(this);
     }
-
-    showWindow();
 }
 
 void InspectorController::showPanel(SpecialPanels panel)
@@ -602,45 +503,40 @@ void InspectorController::showPanel(SpecialPanels panel)
 
 void InspectorController::close()
 {
-    if (!enabled())
+    if (!m_frontend)
         return;
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    stopUserInitiatedProfiling();
-    disableDebugger();
-#endif
-    closeWindow();
-
-    m_frontend.set(0);
-    m_injectedScriptObj = ScriptObject();
-    releaseDOMAgent();
-    m_timelineAgent = 0;
-    m_scriptState = 0;
-    if (m_page)
-        m_page->setParentInspectorController(0);
-    m_page = 0;
+    m_frontend->close();
 }
 
-void InspectorController::showWindow()
+void InspectorController::disconnectFrontend()
 {
-    ASSERT(enabled());
+    if (!m_frontend)
+        return;
+    m_frontend.clear();
 
-    unsigned inspectedPageHeight = m_inspectedPage->mainFrame()->view()->visibleHeight();
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    // If the window is being closed with the debugger enabled,
+    // remember this state to re-enable debugger on the next window
+    // opening.
+    bool debuggerWasEnabled = m_debuggerEnabled;
+    disableDebugger();
+    if (debuggerWasEnabled)
+        m_attachDebuggerWhenShown = true;
+#endif
+    setSearchingForNode(false);
+    unbindAllResources();
+    stopTimelineProfiler();
 
-    m_client->showWindow();
+    m_showAfterVisible = CurrentPanel;
 
-    Setting attachedHeight = setting(inspectorAttachedHeightName);
-    unsigned preferredHeight = attachedHeight.type() == Setting::IntegerType ? attachedHeight.integerValue() : defaultAttachedHeight;
+    hideHighlight();
 
-    // This call might not go through (if the window starts out detached), but if the window is initially created attached,
-    // InspectorController::attachWindow is never called, so we need to make sure to set the attachedWindowHeight.
-    // FIXME: Clean up code so we only have to call setAttachedWindowHeight in InspectorController::attachWindow
-    m_client->setAttachedWindowHeight(constrainedAttachedWindowHeight(preferredHeight, inspectedPageHeight));
-}
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    stopUserInitiatedProfiling();
+#endif
 
-void InspectorController::closeWindow()
-{
-    m_client->closeWindow();
+    releaseDOMAgent();
+    m_timelineAgent.clear();
 }
 
 void InspectorController::releaseDOMAgent()
@@ -648,8 +544,8 @@ void InspectorController::releaseDOMAgent()
     // m_domAgent is RefPtr. Remove DOM listeners first to ensure that there are
     // no references to the DOM agent from the DOM tree.
     if (m_domAgent)
-        m_domAgent->setDocument(0);
-    m_domAgent = 0;
+        m_domAgent->reset();
+    m_domAgent.clear();
 }
 
 void InspectorController::populateScriptObjects()
@@ -658,20 +554,37 @@ void InspectorController::populateScriptObjects()
     if (!m_frontend)
         return;
 
-    m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
+    m_frontend->populateFrontendSettings(setting(frontendSettingsSettingName()));
+
+    if (m_resourceTrackingEnabled)
+        m_frontend->resourceTrackingWasEnabled();
+
+    if (m_searchingForNode)
+        m_frontend->searchingForNodeWasEnabled();
+    else
+        m_frontend->searchingForNodeWasDisabled();
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (m_profilerEnabled)
+        m_frontend->profilerWasEnabled();
+#endif
 
     ResourcesMap::iterator resourcesEnd = m_resources.end();
-    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
-        it->second->createScriptObject(m_frontend.get());
-        KURL resourceURL = it->second->frame()->document()->url();
-        if (resourceURL.protocolInHTTPFamily() || resourceURL.protocolIs("file"))
-            m_frontend->addCookieDomain(resourceURL.host());
-    }
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
+        it->second->updateScriptObject(m_frontend.get());
+
+    m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
 
+    if (m_expiredConsoleMessageCount)
+        m_frontend->updateConsoleMessageExpiredCount(m_expiredConsoleMessageCount);
     unsigned messageCount = m_consoleMessages.size();
     for (unsigned i = 0; i < messageCount; ++i)
-        m_consoleMessages[i]->addToConsole(m_frontend.get());
+        m_consoleMessages[i]->addToFrontend(m_frontend.get(), m_injectedScriptHost.get());
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (m_debuggerEnabled)
+        m_frontend->updatePauseOnExceptionsState(ScriptDebugServer::shared().pauseOnExceptionsState());
+#endif
 #if ENABLE(DATABASE)
     DatabaseResourcesMap::iterator databasesEnd = m_databaseResources.end();
     for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
@@ -682,6 +595,11 @@ void InspectorController::populateScriptObjects()
     for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
         it->second->bind(m_frontend.get());
 #endif
+#if ENABLE(WORKERS)
+    WorkersMap::iterator workersEnd = m_workers.end();
+    for (WorkersMap::iterator it = m_workers.begin(); it != workersEnd; ++it)
+        m_frontend->didCreateWorker(*it->second);
+#endif
 
     m_frontend->populateInterface();
 
@@ -691,15 +609,12 @@ void InspectorController::populateScriptObjects()
     m_pendingEvaluateTestCommands.clear();
 }
 
-void InspectorController::resetScriptObjects()
+void InspectorController::unbindAllResources()
 {
-    if (!m_frontend)
-        return;
-
-    ResourcesMap::iterator resourcesEnd = m_resources.end();
-    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
-        it->second->releaseScriptObject(m_frontend.get(), false);
-
+    ResourcesMap::iterator resourcesEnd = m_resources.end(); 
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) 
+        it->second->releaseScriptObject(0); 
+    
 #if ENABLE(DATABASE)
     DatabaseResourcesMap::iterator databasesEnd = m_databaseResources.end();
     for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
@@ -710,14 +625,8 @@ void InspectorController::resetScriptObjects()
     for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
         it->second->unbind();
 #endif
-
     if (m_timelineAgent)
         m_timelineAgent->reset();
-
-    m_frontend->reset();
-    m_domAgent->setDocument(0);
-    m_objectGroups.clear();
-    m_idToWrappedObject.clear();
 }
 
 void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoader* loaderToKeep)
@@ -733,8 +642,8 @@ void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoad
 
         if (!loaderToKeep || !resource->isSameLoader(loaderToKeep)) {
             removeResource(resource);
-            if (windowVisible())
-                resource->releaseScriptObject(m_frontend.get(), true);
+            if (m_frontend)
+                resource->releaseScriptObject(m_frontend.get());
         }
     }
 }
@@ -747,20 +656,31 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
     ASSERT(m_inspectedPage);
 
     if (loader->frame() == m_inspectedPage->mainFrame()) {
-        m_client->inspectedURLChanged(loader->url().string());
+        if (m_frontend)
+            m_frontend->inspectedURLChanged(loader->url().string());
 
-        clearConsoleMessages(false);
+        m_injectedScriptHost->discardInjectedScripts();
+        clearConsoleMessages();
 
         m_times.clear();
         m_counts.clear();
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+        m_sourceIDToURL.clear();
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC)
         m_profiles.clear();
         m_currentUserInitiatedProfileNumber = 1;
         m_nextUserInitiatedProfileNumber = 1;
 #endif
         // resetScriptObjects should be called before database and DOM storage
         // resources are cleared so that it has a chance to unbind them.
-        resetScriptObjects();
+        if (m_frontend) {
+            m_frontend->reset();
+            m_domAgent->reset();
+        }
+#if ENABLE(WORKERS)
+        m_workers.clear();
+#endif
 #if ENABLE(DATABASE)
         m_databaseResources.clear();
 #endif
@@ -774,8 +694,7 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
                 // We don't add the main resource until its load is committed. This is
                 // needed to keep the load for a user-entered URL from showing up in the
                 // list of resources for the page they are navigating away from.
-                if (windowVisible())
-                    m_mainResource->createScriptObject(m_frontend.get());
+                m_mainResource->updateScriptObject(m_frontend.get());
             } else {
                 // Pages loaded from the page cache are committed before
                 // m_mainResource is the right resource for this load, so we
@@ -783,16 +702,22 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
                 // identifierForInitialRequest.
                 m_mainResource = 0;
             }
-            if (windowVisible()) {
-                m_frontend->didCommitLoad();
-                m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
-            }
+            m_frontend->didCommitLoad();
+            m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
         }
     }
 
     for (Frame* frame = loader->frame(); frame; frame = frame->tree()->traverseNext(loader->frame()))
         if (ResourcesMap* resourceMap = m_frameResources.get(frame))
             pruneResources(resourceMap, loader);
+
+    if (m_scriptsToEvaluateOnLoad.size()) {
+        ScriptState* scriptState = mainWorldScriptState(loader->frame());
+        for (Vector<String>::iterator it = m_scriptsToEvaluateOnLoad.begin();
+             it != m_scriptsToEvaluateOnLoad.end(); ++it) {
+            m_injectedScriptHost->injectScript(*it, scriptState);
+        }
+    }
 }
 
 void InspectorController::frameDetachedFromParent(Frame* frame)
@@ -840,7 +765,7 @@ void InspectorController::removeResource(InspectorResource* resource)
     }
 }
 
-InspectorResource* InspectorController::getTrackedResource(long long identifier)
+InspectorResource* InspectorController::getTrackedResource(unsigned long identifier)
 {
     if (!enabled())
         return 0;
@@ -870,7 +795,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
     if (!isMainResource && !m_resourceTrackingEnabled)
         return;
 
-    RefPtr<InspectorResource> resource = InspectorResource::createCached(m_nextIdentifier--, loader, cachedResource);
+    RefPtr<InspectorResource> resource = InspectorResource::createCached(m_inspectedPage->progress()->createUniqueIdentifier(), loader, cachedResource);
 
     if (isMainResource) {
         m_mainResource = resource;
@@ -879,8 +804,8 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
 
     addResource(resource.get());
 
-    if (windowVisible())
-        resource->createScriptObject(m_frontend.get());
+    if (m_frontend)
+        resource->updateScriptObject(m_frontend.get());
 }
 
 void InspectorController::identifierForInitialRequest(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
@@ -894,9 +819,7 @@ void InspectorController::identifierForInitialRequest(unsigned long identifier,
     if (!isMainResource && !m_resourceTrackingEnabled)
         return;
 
-    RefPtr<InspectorResource> resource = InspectorResource::create(identifier, loader);
-
-    resource->updateRequest(request);
+    RefPtr<InspectorResource> resource = InspectorResource::create(identifier, loader, request.url());
 
     if (isMainResource) {
         m_mainResource = resource;
@@ -905,8 +828,8 @@ void InspectorController::identifierForInitialRequest(unsigned long identifier,
 
     addResource(resource.get());
 
-    if (windowVisible() && loader->frameLoader()->isLoadingFromCachedPage() && resource == m_mainResource)
-        resource->createScriptObject(m_frontend.get());
+    if (m_frontend && loader->frameLoader()->isLoadingFromCachedPage() && resource == m_mainResource)
+        resource->updateScriptObject(m_frontend.get());
 }
 
 void InspectorController::mainResourceFiredDOMContentEvent(DocumentLoader* loader, const KURL& url)
@@ -916,7 +839,7 @@ void InspectorController::mainResourceFiredDOMContentEvent(DocumentLoader* loade
 
     if (m_mainResource) {
         m_mainResource->markDOMContentEventTime();
-        if (windowVisible())
+        if (m_frontend)
             m_mainResource->updateScriptObject(m_frontend.get());
     }
 }
@@ -928,7 +851,7 @@ void InspectorController::mainResourceFiredLoadEvent(DocumentLoader* loader, con
 
     if (m_mainResource) {
         m_mainResource->markLoadEventTime();
-        if (windowVisible())
+        if (m_frontend)
             m_mainResource->updateScriptObject(m_frontend.get());
     }
 }
@@ -938,24 +861,41 @@ bool InspectorController::isMainResourceLoader(DocumentLoader* loader, const KUR
     return loader->frame() == m_inspectedPage->mainFrame() && requestUrl == loader->requestURL();
 }
 
-void InspectorController::willSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+void InspectorController::willSendRequest(unsigned long identifier, const ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
+    bool isMainResource = (m_mainResource && m_mainResource->identifier() == identifier);
+    if (m_timelineAgent)
+        m_timelineAgent->willSendResourceRequest(identifier, isMainResource, request);
+
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
 
-    resource->startTiming();
-
     if (!redirectResponse.isNull()) {
-        resource->updateRequest(request);
+        resource->markResponseReceivedTime();
+        resource->endTiming();
         resource->updateResponse(redirectResponse);
+
+        // We always store last redirect by the original id key. Rest of the redirects are stored within the last one.
+        unsigned long id = m_inspectedPage->progress()->createUniqueIdentifier();
+        RefPtr<InspectorResource> withRedirect = resource->appendRedirect(id, request.url());
+        removeResource(resource.get());
+        addResource(withRedirect.get());
+        if (isMainResource) {
+            m_mainResource = withRedirect;
+            withRedirect->markMainResource();
+        }
+        resource = withRedirect;
     }
 
-    if (resource != m_mainResource && windowVisible())
-        resource->createScriptObject(m_frontend.get());
+    resource->startTiming();
+    resource->updateRequest(request);
+
+    if (resource != m_mainResource && m_frontend)
+        resource->updateScriptObject(m_frontend.get());
 }
 
-void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse& response)
+void InspectorController::didReceiveResponse(unsigned long identifier, const ResourceResponse& response)
 {
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
@@ -964,11 +904,11 @@ void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long iden
     resource->updateResponse(response);
     resource->markResponseReceivedTime();
 
-    if (windowVisible())
+    if (resource != m_mainResource && m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
-void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived)
+void InspectorController::didReceiveContentLength(unsigned long identifier, int lengthReceived)
 {
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
@@ -976,44 +916,40 @@ void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long
 
     resource->addLength(lengthReceived);
 
-    if (windowVisible())
+    if (resource != m_mainResource && m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
-void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identifier)
+void InspectorController::didFinishLoading(unsigned long identifier)
 {
+    if (m_timelineAgent)
+        m_timelineAgent->didFinishLoadingResource(identifier, false);
+
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
 
-    removeResource(resource.get());
-
     resource->endTiming();
 
-    addResource(resource.get());
-
-    if (windowVisible()) {
+    // No need to mute this event for main resource since it happens after did commit load.
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
-        KURL resourceURL = resource->frame()->document()->url();
-        if (resourceURL.protocolInHTTPFamily() || resourceURL.protocolIs("file"))
-            m_frontend->addCookieDomain(resourceURL.host());
-    }
 }
 
-void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError& /*error*/)
+void InspectorController::didFailLoading(unsigned long identifier, const ResourceError& /*error*/)
 {
+    if (m_timelineAgent)
+        m_timelineAgent->didFinishLoadingResource(identifier, true);
+
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
 
-    removeResource(resource.get());
-
     resource->markFailed();
     resource->endTiming();
 
-    addResource(resource.get());
-
-    if (windowVisible())
+    // No need to mute this event for main resource since it happens after did commit load.
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -1028,7 +964,7 @@ void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identi
 
     resource->setXMLHttpResponseText(sourceString);
 
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -1044,8 +980,8 @@ void InspectorController::scriptImported(unsigned long identifier, const String&
     // FIXME: imported script and XHR response are currently viewed as the same
     // thing by the Inspector. They should be made into distinct types.
     resource->setXMLHttpResponseText(ScriptString(sourceString));
-    
-    if (windowVisible())
+
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -1055,7 +991,7 @@ void InspectorController::enableResourceTracking(bool always, bool reload)
         return;
 
     if (always)
-        setSetting(resourceTrackingEnabledSettingName, Setting(true));
+        setSetting(resourceTrackingEnabledSettingName, "true");
 
     if (m_resourceTrackingEnabled)
         return;
@@ -1066,7 +1002,7 @@ void InspectorController::enableResourceTracking(bool always, bool reload)
         m_frontend->resourceTrackingWasEnabled();
 
     if (reload)
-        m_inspectedPage->mainFrame()->loader()->reload();
+        m_inspectedPage->mainFrame()->redirectScheduler()->scheduleRefresh(true);
 }
 
 void InspectorController::disableResourceTracking(bool always)
@@ -1075,7 +1011,7 @@ void InspectorController::disableResourceTracking(bool always)
         return;
 
     if (always)
-        setSetting(resourceTrackingEnabledSettingName, Setting(false));
+        setSetting(resourceTrackingEnabledSettingName, "false");
 
     ASSERT(m_inspectedPage);
     m_resourceTrackingEnabled = false;
@@ -1089,8 +1025,8 @@ void InspectorController::ensureResourceTrackingSettingsLoaded()
         return;
     m_resourceTrackingSettingsLoaded = true;
 
-    Setting resourceTracking = setting(resourceTrackingEnabledSettingName);
-    if (resourceTracking.type() == Setting::BooleanType && resourceTracking.booleanValue())
+    String resourceTracking = setting(resourceTrackingEnabledSettingName);
+    if (resourceTracking == "true")
         m_resourceTrackingEnabled = true;
 }
 
@@ -1120,13 +1056,70 @@ void InspectorController::stopTimelineProfiler()
         m_frontend->timelineProfilerWasStopped();
 }
 
-bool InspectorController::timelineProfilerEnabled() const
+#if ENABLE(WORKERS)
+class PostWorkerNotificationToFrontendTask : public ScriptExecutionContext::Task {
+public:
+    static PassOwnPtr<PostWorkerNotificationToFrontendTask> create(PassRefPtr<InspectorWorkerResource> worker, InspectorController::WorkerAction action)
+    {
+        return new PostWorkerNotificationToFrontendTask(worker, action);
+    }
+
+private:
+    PostWorkerNotificationToFrontendTask(PassRefPtr<InspectorWorkerResource> worker, InspectorController::WorkerAction action)
+        : m_worker(worker)
+        , m_action(action)
+    {
+    }
+
+    virtual void performTask(ScriptExecutionContext* scriptContext)
+    {
+        if (InspectorController* inspector = scriptContext->inspectorController())
+            inspector->postWorkerNotificationToFrontend(*m_worker, m_action);
+    }
+
+private:
+    RefPtr<InspectorWorkerResource> m_worker;
+    InspectorController::WorkerAction m_action;
+};
+
+void InspectorController::postWorkerNotificationToFrontend(const InspectorWorkerResource& worker, InspectorController::WorkerAction action)
+{
+    if (!m_frontend)
+        return;
+    switch (action) {
+    case InspectorController::WorkerCreated:
+        m_frontend->didCreateWorker(worker);
+        break;
+    case InspectorController::WorkerDestroyed:
+        m_frontend->didDestroyWorker(worker);
+        break;
+    }
+}
+
+void InspectorController::didCreateWorker(intptr_t id, const String& url, bool isSharedWorker)
 {
     if (!enabled())
-        return false;
+        return;
+
+    RefPtr<InspectorWorkerResource> workerResource(InspectorWorkerResource::create(id, url, isSharedWorker));
+    m_workers.set(id, workerResource);
+    if (m_inspectedPage && m_frontend)
+        m_inspectedPage->mainFrame()->document()->postTask(PostWorkerNotificationToFrontendTask::create(workerResource, InspectorController::WorkerCreated));
+}
+
+void InspectorController::didDestroyWorker(intptr_t id)
+{
+    if (!enabled())
+        return;
 
-    return m_timelineAgent;
+    WorkersMap::iterator workerResource = m_workers.find(id);
+    if (workerResource == m_workers.end())
+        return;
+    if (m_inspectedPage && m_frontend)
+        m_inspectedPage->mainFrame()->document()->postTask(PostWorkerNotificationToFrontendTask::create(workerResource->second, InspectorController::WorkerDestroyed));
+    m_workers.remove(workerResource);
 }
+#endif // ENABLE(WORKERS)
 
 #if ENABLE(DATABASE)
 void InspectorController::selectDatabase(Database* database)
@@ -1160,47 +1153,49 @@ void InspectorController::didOpenDatabase(Database* database, const String& doma
     m_databaseResources.set(resource->id(), resource);
 
     // Resources are only bound while visible.
-    if (windowVisible())
+    if (m_frontend)
         resource->bind(m_frontend.get());
 }
 #endif
 
-void InspectorController::getCookies(long callId, const String& host)
+void InspectorController::getCookies(long callId)
 {
     if (!m_frontend)
         return;
-    
+
     // If we can get raw cookies.
     ListHashSet<Cookie> rawCookiesList;
-    
+
     // If we can't get raw cookies - fall back to String representation
     String stringCookiesList;
-    
+
     // Return value to getRawCookies should be the same for every call because
     // the return value is platform/network backend specific, and the call will
     // always return the same true/false value.
     bool rawCookiesImplemented = false;
-    
+
     ResourcesMap::iterator resourcesEnd = m_resources.end();
     for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
         Document* document = it->second->frame()->document();
-        if (document->url().host() == host) {
-            Vector<Cookie> docCookiesList;
-            rawCookiesImplemented = getRawCookies(document, document->cookieURL(), docCookiesList);
-            
-            if (!rawCookiesImplemented)
-                // FIXME: We need duplication checking for the String representation of cookies.
-                stringCookiesList += document->cookie();
-            else {
-                int cookiesSize = docCookiesList.size();
-                for (int i = 0; i < cookiesSize; i++) {
-                    if (!rawCookiesList.contains(docCookiesList[i]))
-                        rawCookiesList.add(docCookiesList[i]);
-                }
+        Vector<Cookie> docCookiesList;
+        rawCookiesImplemented = getRawCookies(document, it->second->requestURL(), docCookiesList);
+
+        if (!rawCookiesImplemented) {
+            // FIXME: We need duplication checking for the String representation of cookies.
+            ExceptionCode ec = 0;
+            stringCookiesList += document->cookie(ec);
+            // Exceptions are thrown by cookie() in sandboxed frames. That won't happen here
+            // because "document" is the document of the main frame of the page.
+            ASSERT(!ec);
+        } else {
+            int cookiesSize = docCookiesList.size();
+            for (int i = 0; i < cookiesSize; i++) {
+                if (!rawCookiesList.contains(docCookiesList[i]))
+                    rawCookiesList.add(docCookiesList[i]);
             }
         }
     }
-    
+
     if (!rawCookiesImplemented)
         m_frontend->didGetCookies(callId, m_frontend->newScriptArray(), stringCookiesList);
     else
@@ -1251,7 +1246,7 @@ void InspectorController::didUseDOMStorage(StorageArea* storageArea, bool isLoca
     m_domStorageResources.set(resource->id(), resource);
 
     // Resources are only bound while visible.
-    if (windowVisible())
+    if (m_frontend)
         resource->bind(m_frontend.get());
 }
 
@@ -1262,7 +1257,8 @@ void InspectorController::selectDOMStorage(Storage* storage)
         return;
 
     Frame* frame = storage->frame();
-    bool isLocalStorage = (frame->domWindow()->localStorage() == storage);
+    ExceptionCode ec = 0;
+    bool isLocalStorage = (frame->domWindow()->localStorage(ec) == storage && !ec);
     int storageResourceId = 0;
     DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
     for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it) {
@@ -1307,7 +1303,7 @@ void InspectorController::setDOMStorageItem(long callId, long storageId, const S
     if (storageResource) {
         ExceptionCode exception = 0;
         storageResource->domStorage()->setItem(key, value, exception);
-        success = (exception == 0);
+        success = !exception;
     }
     m_frontend->didSetDOMStorageItem(callId, success);
 }
@@ -1335,54 +1331,36 @@ InspectorDOMStorageResource* InspectorController::getDOMStorageResourceForId(int
 }
 #endif
 
-void InspectorController::moveWindowBy(float x, float y) const
-{
-    if (!m_page || !enabled())
-        return;
-
-    FloatRect frameRect = m_page->chrome()->windowRect();
-    frameRect.move(x, y);
-    m_page->chrome()->setWindowRect(frameRect);
-}
-
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-void InspectorController::addProfile(PassRefPtr<Profile> prpProfile, unsigned lineNumber, const UString& sourceURL)
+void InspectorController::addProfile(PassRefPtr<ScriptProfile> prpProfile, unsigned lineNumber, const String& sourceURL)
 {
     if (!enabled())
         return;
 
-    RefPtr<Profile> profile = prpProfile;
+    RefPtr<ScriptProfile> profile = prpProfile;
     m_profiles.add(profile->uid(), profile);
 
     if (m_frontend) {
-        JSLock lock(SilenceAssertionsOnly);
+#if USE(JSC)
+        JSC::JSLock lock(JSC::SilenceAssertionsOnly);
+#endif
         m_frontend->addProfileHeader(createProfileHeader(*profile));
     }
 
     addProfileFinishedMessageToConsole(profile, lineNumber, sourceURL);
 }
 
-void InspectorController::addProfileFinishedMessageToConsole(PassRefPtr<Profile> prpProfile, unsigned lineNumber, const UString& sourceURL)
+void InspectorController::addProfileFinishedMessageToConsole(PassRefPtr<ScriptProfile> prpProfile, unsigned lineNumber, const String& sourceURL)
 {
-    RefPtr<Profile> profile = prpProfile;
+    RefPtr<ScriptProfile> profile = prpProfile;
 
-    UString message = "Profile \"webkit-profile://";
-    message += encodeWithURLEscapeSequences(CPUProfileType);
-    message += "/";
-    message += encodeWithURLEscapeSequences(profile->title());
-    message += "#";
-    message += UString::from(profile->uid());
-    message += "\" finished.";
+    String message = String::format("Profile \"webkit-profile://%s/%s#%d\" finished.", CPUProfileType, encodeWithURLEscapeSequences(profile->title()).utf8().data(), profile->uid());
     addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
 }
 
-void InspectorController::addStartProfilingMessageToConsole(const UString& title, unsigned lineNumber, const UString& sourceURL)
+void InspectorController::addStartProfilingMessageToConsole(const String& title, unsigned lineNumber, const String& sourceURL)
 {
-    UString message = "Profile \"webkit-profile://";
-    message += encodeWithURLEscapeSequences(CPUProfileType);
-    message += "/";
-    message += encodeWithURLEscapeSequences(title);
-    message += "#0\" started.";
+    String message = String::format("Profile \"webkit-profile://%s/%s#0\" started.", CPUProfileType, encodeWithURLEscapeSequences(title).utf8().data());
     addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
 }
 
@@ -1403,28 +1381,27 @@ void InspectorController::getProfile(long callId, unsigned uid)
     if (!m_frontend)
         return;
     ProfilesMap::iterator it = m_profiles.find(uid);
+#if USE(JSC)
     if (it != m_profiles.end())
-        m_frontend->didGetProfile(callId, toJS(m_scriptState, it->second.get()));
+        m_frontend->didGetProfile(callId, toJS(m_frontend->scriptState(), it->second.get()));
+#endif
 }
 
-ScriptObject InspectorController::createProfileHeader(const JSC::Profile& profile)
+ScriptObject InspectorController::createProfileHeader(const ScriptProfile& profile)
 {
     ScriptObject header = m_frontend->newScriptObject();
     header.set("title", profile.title());
     header.set("uid", profile.uid());
+    header.set("typeId", String(CPUProfileType));
     return header;
 }
 
-UString InspectorController::getCurrentUserInitiatedProfileName(bool incrementProfileNumber = false)
+String InspectorController::getCurrentUserInitiatedProfileName(bool incrementProfileNumber = false)
 {
     if (incrementProfileNumber)
         m_currentUserInitiatedProfileNumber = m_nextUserInitiatedProfileNumber++;        
 
-    UString title = UserInitiatedProfileName;
-    title += ".";
-    title += UString::from(m_currentUserInitiatedProfileNumber);
-    
-    return title;
+    return String::format("%s.%d", UserInitiatedProfileName, m_currentUserInitiatedProfileNumber);
 }
 
 void InspectorController::startUserInitiatedProfilingSoon()
@@ -1439,17 +1416,21 @@ void InspectorController::startUserInitiatedProfiling(Timer<InspectorController>
 
     if (!profilerEnabled()) {
         enableProfiler(false, true);
-        JavaScriptDebugServer::shared().recompileAllJSFunctions();
+        ScriptDebugServer::shared().recompileAllJSFunctions();
     }
 
     m_recordingUserInitiatedProfile = true;
 
-    UString title = getCurrentUserInitiatedProfileName(true);
+    String title = getCurrentUserInitiatedProfileName(true);
 
-    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame(), debuggerWorld())->globalExec();
-    Profiler::profiler()->startProfiling(scriptState, title);
+#if USE(JSC)
+    JSC::ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame(), debuggerWorld())->globalExec();
+#else
+    ScriptState* scriptState = 0;
+#endif
+    ScriptProfiler::start(scriptState, title);
 
-    addStartProfilingMessageToConsole(title, 0, UString());
+    addStartProfilingMessageToConsole(title, 0, String());
 
     toggleRecordButton(true);
 }
@@ -1461,12 +1442,16 @@ void InspectorController::stopUserInitiatedProfiling()
 
     m_recordingUserInitiatedProfile = false;
 
-    UString title = getCurrentUserInitiatedProfileName();
+    String title = getCurrentUserInitiatedProfileName();
 
-    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame(), debuggerWorld())->globalExec();
-    RefPtr<Profile> profile = Profiler::profiler()->stopProfiling(scriptState, title);
+#if USE(JSC)
+    JSC::ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame(), debuggerWorld())->globalExec();
+#else
+    ScriptState* scriptState = 0;
+#endif
+    RefPtr<ScriptProfile> profile = ScriptProfiler::stop(scriptState, title);
     if (profile)
-        addProfile(profile, 0, UString());
+        addProfile(profile, 0, String());
 
     toggleRecordButton(false);
 }
@@ -1481,7 +1466,7 @@ void InspectorController::toggleRecordButton(bool isProfiling)
 void InspectorController::enableProfiler(bool always, bool skipRecompile)
 {
     if (always)
-        setSetting(profilerEnabledSettingName, Setting(true));
+        setSetting(profilerEnabledSettingName, "true");
 
     if (m_profilerEnabled)
         return;
@@ -1489,7 +1474,7 @@ void InspectorController::enableProfiler(bool always, bool skipRecompile)
     m_profilerEnabled = true;
 
     if (!skipRecompile)
-        JavaScriptDebugServer::shared().recompileAllJSFunctionsSoon();
+        ScriptDebugServer::shared().recompileAllJSFunctionsSoon();
 
     if (m_frontend)
         m_frontend->profilerWasEnabled();
@@ -1498,28 +1483,30 @@ void InspectorController::enableProfiler(bool always, bool skipRecompile)
 void InspectorController::disableProfiler(bool always)
 {
     if (always)
-        setSetting(profilerEnabledSettingName, Setting(false));
+        setSetting(profilerEnabledSettingName, "false");
 
     if (!m_profilerEnabled)
         return;
 
     m_profilerEnabled = false;
 
-    JavaScriptDebugServer::shared().recompileAllJSFunctionsSoon();
+    ScriptDebugServer::shared().recompileAllJSFunctionsSoon();
 
     if (m_frontend)
         m_frontend->profilerWasDisabled();
 }
+#endif
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
 void InspectorController::enableDebuggerFromFrontend(bool always)
 {
     if (always)
-        setSetting(debuggerEnabledSettingName, Setting(true));
+        setSetting(debuggerEnabledSettingName, "true");
 
     ASSERT(m_inspectedPage);
 
-    JavaScriptDebugServer::shared().addListener(this, m_inspectedPage);
-    JavaScriptDebugServer::shared().clearBreakpoints();
+    ScriptDebugServer::shared().addListener(this, m_inspectedPage);
+    ScriptDebugServer::shared().clearBreakpoints();
 
     m_debuggerEnabled = true;
     m_frontend->debuggerWasEnabled();
@@ -1533,9 +1520,9 @@ void InspectorController::enableDebugger()
     if (m_debuggerEnabled)
         return;
 
-    if (!m_scriptState || !m_frontend) {
+    if (!m_frontend)
         m_attachDebuggerWhenShown = true;
-    } else {
+    else {
         m_frontend->attachDebuggerWhenShown();
         m_attachDebuggerWhenShown = false;
     }
@@ -1547,11 +1534,11 @@ void InspectorController::disableDebugger(bool always)
         return;
 
     if (always)
-        setSetting(debuggerEnabledSettingName, Setting(false));
+        setSetting(debuggerEnabledSettingName, "false");
 
     ASSERT(m_inspectedPage);
 
-    JavaScriptDebugServer::shared().removeListener(this, m_inspectedPage);
+    ScriptDebugServer::shared().removeListener(this, m_inspectedPage);
 
     m_debuggerEnabled = false;
     m_attachDebuggerWhenShown = false;
@@ -1564,26 +1551,70 @@ void InspectorController::resumeDebugger()
 {
     if (!m_debuggerEnabled)
         return;
-    JavaScriptDebugServer::shared().continueProgram();
+    ScriptDebugServer::shared().continueProgram();
+}
+
+void InspectorController::setBreakpoint(const String& sourceID, unsigned lineNumber, bool enabled, const String& condition)
+{
+    ScriptBreakpoint breakpoint(enabled, condition);
+    ScriptDebugServer::shared().setBreakpoint(sourceID, lineNumber, breakpoint);
+    String url = m_sourceIDToURL.get(sourceID);
+    if (url.isEmpty())
+        return;
+
+    HashMap<String, SourceBreakpoints>::iterator it = m_stickyBreakpoints.find(url);
+    if (it == m_stickyBreakpoints.end())
+        it = m_stickyBreakpoints.set(url, SourceBreakpoints()).first;
+    it->second.set(lineNumber, breakpoint);
+}
+
+void InspectorController::removeBreakpoint(const String& sourceID, unsigned lineNumber)
+{
+    ScriptDebugServer::shared().removeBreakpoint(sourceID, lineNumber);
+ 
+    String url = m_sourceIDToURL.get(sourceID);
+    if (url.isEmpty())
+        return;
+
+    HashMap<String, SourceBreakpoints>::iterator it = m_stickyBreakpoints.find(url);
+    if (it != m_stickyBreakpoints.end())
+        it->second.remove(lineNumber);
 }
 
 // JavaScriptDebugListener functions
 
-void InspectorController::didParseSource(ExecState*, const SourceCode& source)
+void InspectorController::didParseSource(const String& sourceID, const String& url, const String& data, int firstLine)
 {
-    m_frontend->parsedScriptSource(source);
+    m_frontend->parsedScriptSource(sourceID, url, data, firstLine);
+
+    if (url.isEmpty())
+        return;
+
+    HashMap<String, SourceBreakpoints>::iterator it = m_stickyBreakpoints.find(url);
+    if (it != m_stickyBreakpoints.end()) {
+        for (SourceBreakpoints::iterator breakpointIt = it->second.begin(); breakpointIt != it->second.end(); ++breakpointIt) {
+            if (firstLine <= breakpointIt->first) {
+                ScriptDebugServer::shared().setBreakpoint(sourceID, breakpointIt->first, breakpointIt->second);
+                m_frontend->restoredBreakpoint(sourceID, url, breakpointIt->first, breakpointIt->second.enabled, breakpointIt->second.condition);
+            }
+        }
+    }
+
+    m_sourceIDToURL.set(sourceID, url);
 }
 
-void InspectorController::failedToParseSource(ExecState*, const SourceCode& source, int errorLine, const UString& errorMessage)
+void InspectorController::failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage)
 {
-    m_frontend->failedToParseScriptSource(source, errorLine, errorMessage);
+    m_frontend->failedToParseScriptSource(url, data, firstLine, errorLine, errorMessage);
 }
 
 void InspectorController::didPause()
 {
-    ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "getCallFrames");
-    ScriptValue callFrames = function.call();
-    m_frontend->pausedScript(callFrames);
+    ScriptState* scriptState = ScriptDebugServer::shared().currentCallFrameState();
+    ASSERT(scriptState);
+    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptFor(scriptState);
+    RefPtr<SerializedScriptValue> callFrames = injectedScript.callFrames();
+    m_frontend->pausedScript(callFrames.get());
 }
 
 void InspectorController::didContinue()
@@ -1603,11 +1634,11 @@ void InspectorController::evaluateForTestInFrontend(long callId, const String& s
 
 void InspectorController::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
 {
-    ScriptState* scriptState = scriptStateFromPage(m_inspectedPage);
+    ScriptState* scriptState = scriptStateFromPage(debuggerWorld(), m_inspectedPage);
     ScriptObject window;
     ScriptGlobalObject::get(scriptState, "window", window);
-    ScriptFunctionCall function(scriptState, window, "didEvaluateForTestInFrontend");
-    function.appendArgument(static_cast<int>(callId));
+    ScriptFunctionCall function(window, "didEvaluateForTestInFrontend");
+    function.appendArgument(callId);
     function.appendArgument(jsonResult);
     function.call();
 }
@@ -1639,7 +1670,7 @@ static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, co
 
         context.addPath(quadPath);
         context.setStrokeThickness(outlineThickness);
-        context.setStrokeColor(outlineColor);
+        context.setStrokeColor(outlineColor, DeviceColorSpace);
         context.strokePath();
 
         context.restore();
@@ -1647,7 +1678,7 @@ static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, co
     
     // Now do the fill
     context.addPath(quadPath);
-    context.setFillColor(fillColor);
+    context.setFillColor(fillColor, DeviceColorSpace);
     context.fillPath();
 }
 
@@ -1794,72 +1825,64 @@ InspectorController::SpecialPanels InspectorController::specialPanelForJSName(co
 {
     if (panelName == "elements")
         return ElementsPanel;
-    else if (panelName == "resources")
+    if (panelName == "resources")
         return ResourcesPanel;
-    else if (panelName == "scripts")
+    if (panelName == "scripts")
         return ScriptsPanel;
-    else if (panelName == "profiles")
+    if (panelName == "timeline")
+        return TimelinePanel;
+    if (panelName == "profiles")
         return ProfilesPanel;
-    else if (panelName == "storage" || panelName == "databases")
+    if (panelName == "storage" || panelName == "databases")
         return StoragePanel;
-    else
-        return ElementsPanel;
+    if (panelName == "audits")
+        return AuditsPanel;
+    if (panelName == "console")
+        return ConsolePanel;
+    return ElementsPanel;
 }
 
-ScriptValue InspectorController::wrapObject(const ScriptValue& quarantinedObject, const String& objectGroup)
+void InspectorController::deleteCookie(const String& cookieName, const String& domain)
 {
-    ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "createProxyObject");
-    function.appendArgument(quarantinedObject);
-    if (quarantinedObject.isObject()) {
-        long id = m_lastBoundObjectId++;
-        String objectId = String::format("object#%ld", id);
-        m_idToWrappedObject.set(objectId, quarantinedObject);
-        ObjectGroupsMap::iterator it = m_objectGroups.find(objectGroup);
-        if (it == m_objectGroups.end())
-            it = m_objectGroups.set(objectGroup, Vector<String>()).first;
-        it->second.append(objectId);
-        function.appendArgument(objectId);
+    ResourcesMap::iterator resourcesEnd = m_resources.end();
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
+        Document* document = it->second->frame()->document();
+        if (document->url().host() == domain)
+            WebCore::deleteCookie(document, it->second->requestURL(), cookieName);
     }
-    ScriptValue wrapper = function.call();
-    return wrapper;
 }
 
-ScriptValue InspectorController::unwrapObject(const String& objectId)
+InjectedScript InspectorController::injectedScriptForNodeId(long id)
 {
-    HashMap<String, ScriptValue>::iterator it = m_idToWrappedObject.find(objectId);
-    if (it != m_idToWrappedObject.end())
-        return it->second;
-    return ScriptValue();
-}
 
-void InspectorController::releaseWrapperObjectGroup(const String& objectGroup)
-{
-    ObjectGroupsMap::iterator groupIt = m_objectGroups.find(objectGroup);
-    if (groupIt == m_objectGroups.end())
-        return;
+    Frame* frame = 0;
+    if (id) {
+        ASSERT(m_domAgent);
+        Node* node = m_domAgent->nodeForId(id);
+        if (node) {
+            Document* document = node->ownerDocument();
+            if (document)
+                frame = document->frame();
+        }
+    } else
+        frame = m_inspectedPage->mainFrame();
 
-    Vector<String>& groupIds = groupIt->second;
-    for (Vector<String>::iterator it = groupIds.begin(); it != groupIds.end(); ++it)
-        m_idToWrappedObject.remove(*it);
-    m_objectGroups.remove(groupIt);
+    if (frame)
+        return m_injectedScriptHost->injectedScriptFor(mainWorldScriptState(frame));
+
+    return InjectedScript();
 }
 
-void InspectorController::resetInjectedScript()
+void InspectorController::addScriptToEvaluateOnLoad(const String& source)
 {
-    ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "reset");
-    function.call();
+    m_scriptsToEvaluateOnLoad.append(source);
 }
 
-void InspectorController::deleteCookie(const String& cookieName, const String& domain)
+void InspectorController::removeAllScriptsToEvaluateOnLoad()
 {
-    ResourcesMap::iterator resourcesEnd = m_resources.end();
-    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
-        Document* document = it->second->frame()->document();
-        if (document->url().host() == domain)
-            WebCore::deleteCookie(document, document->cookieURL(), cookieName);
-    }
+    m_scriptsToEvaluateOnLoad.clear();
 }
 
 } // namespace WebCore
-
+    
 #endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
index 382d887c62..b3d881244a 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,9 +31,12 @@
 
 #include "Console.h"
 #include "Cookie.h"
+#include "InspectorDOMAgent.h"
 #include "PlatformString.h"
 #include "ScriptArray.h"
+#include "ScriptBreakpoint.h"
 #include "ScriptObject.h"
+#include "ScriptProfile.h"
 #include "ScriptState.h"
 #include "ScriptValue.h"
 #include "StringHash.h"
@@ -46,12 +49,7 @@
 #include <wtf/Vector.h>
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-#include "JavaScriptDebugListener.h"
-
-namespace JSC {
-    class Profile;
-    class UString;
-}
+#include "ScriptDebugListener.h"
 #endif
 
 namespace WebCore {
@@ -60,18 +58,21 @@ class CachedResource;
 class Database;
 class Document;
 class DocumentLoader;
+class Element;
 class GraphicsContext;
 class HitTestResult;
+class InjectedScript;
+class InjectedScriptHost;
 class InspectorBackend;
 class InspectorClient;
-class InspectorDOMAgent;
 class InspectorFrontend;
+class InspectorFrontendClient;
 class InspectorTimelineAgent;
 class JavaScriptCallFrame;
 class KURL;
 class Node;
 class Page;
-struct ResourceRequest;
+class ResourceRequest;
 class ResourceResponse;
 class ResourceError;
 class ScriptCallStack;
@@ -84,97 +85,47 @@ class ConsoleMessage;
 class InspectorDatabaseResource;
 class InspectorDOMStorageResource;
 class InspectorResource;
+class InspectorWorkerResource;
 
 class InspectorController
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-                          : JavaScriptDebugListener
+                          : ScriptDebugListener, public Noncopyable
+#else
+                          : public Noncopyable
 #endif
                                                     {
 public:
-    typedef HashMap<long long, RefPtr<InspectorResource> > ResourcesMap;
+    typedef HashMap<unsigned long, RefPtr<InspectorResource> > ResourcesMap;
     typedef HashMap<RefPtr<Frame>, ResourcesMap*> FrameResourcesMap;
     typedef HashMap<int, RefPtr<InspectorDatabaseResource> > DatabaseResourcesMap;
     typedef HashMap<int, RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesMap;
-    typedef HashMap<String, Vector<String> > ObjectGroupsMap;
 
     typedef enum {
+        AuditsPanel,
         CurrentPanel,
         ConsolePanel,
         ElementsPanel,
-        ProfilesPanel,
         ResourcesPanel,
         ScriptsPanel,
+        TimelinePanel,
+        ProfilesPanel,
         StoragePanel
     } SpecialPanels;
 
-    struct Setting {
-        enum Type {
-            NoType, StringType, StringVectorType, DoubleType, IntegerType, BooleanType
-        };
-
-        Setting()
-            : m_type(NoType)
-        {
-        }
-
-        explicit Setting(bool value)
-            : m_type(BooleanType)
-        {
-            m_simpleContent.m_boolean = value;
-        }
-
-        explicit Setting(unsigned value)
-            : m_type(IntegerType)
-        {
-            m_simpleContent.m_integer = value;
-        }
-
-        explicit Setting(const String& value)
-            : m_type(StringType)
-        {
-            m_string = value;
-        }
-
-        Type type() const { return m_type; }
-
-        String string() const { ASSERT(m_type == StringType); return m_string; }
-        const Vector<String>& stringVector() const { ASSERT(m_type == StringVectorType); return m_stringVector; }
-        double doubleValue() const { ASSERT(m_type == DoubleType); return m_simpleContent.m_double; }
-        long integerValue() const { ASSERT(m_type == IntegerType); return m_simpleContent.m_integer; }
-        bool booleanValue() const { ASSERT(m_type == BooleanType); return m_simpleContent.m_boolean; }
-
-        void set(const String& value) { m_type = StringType; m_string = value; }
-        void set(const Vector<String>& value) { m_type = StringVectorType; m_stringVector = value; }
-        void set(double value) { m_type = DoubleType; m_simpleContent.m_double = value; }
-        void set(long value) { m_type = IntegerType; m_simpleContent.m_integer = value; }
-        void set(bool value) { m_type = BooleanType; m_simpleContent.m_boolean = value; }
-
-    private:
-        Type m_type;
-
-        String m_string;
-        Vector<String> m_stringVector;
-
-        union {
-            double m_double;
-            long m_integer;
-            bool m_boolean;
-        } m_simpleContent;
-    };
     InspectorController(Page*, InspectorClient*);
     ~InspectorController();
 
     InspectorBackend* inspectorBackend() { return m_inspectorBackend.get(); }
+    InjectedScriptHost* injectedScriptHost() { return m_injectedScriptHost.get(); }
 
     void inspectedPageDestroyed();
-    void pageDestroyed() { m_page = 0; }
 
     bool enabled() const;
 
     Page* inspectedPage() const { return m_inspectedPage; }
 
-    const Setting& setting(const String& key) const;
-    void setSetting(const String& key, const Setting&);
+    String setting(const String& key) const;
+    void setSetting(const String& key, const String& value);
 
     void inspect(Node*);
     void highlight(Node*);
@@ -183,31 +134,24 @@ public:
     void show();
     void showPanel(SpecialPanels);
     void close();
-
-    bool windowVisible();
-    void setWindowVisible(bool visible = true, bool attached = false);
+    void disconnectFrontend();
 
     void addMessageToConsole(MessageSource, MessageType, MessageLevel, ScriptCallStack*);
     void addMessageToConsole(MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceID);
-    void clearConsoleMessages(bool clearUI);
+    void clearConsoleMessages();
     const Vector<ConsoleMessage*>& consoleMessages() const { return m_consoleMessages; }
 
-    void attachWindow();
-    void detachWindow();
-
-    void toggleSearchForNodeInPage();
-    bool searchingForNodeInPage() { return m_searchingForNode; };
+    bool searchingForNodeInPage() const { return m_searchingForNode; }
     void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
     void handleMousePressOnNode(Node*);
 
+    void setInspectorFrontendClient(PassOwnPtr<InspectorFrontendClient> client);
+    bool hasInspectorFrontendClient() const { return m_inspectorFrontendClient; }
+                                                        
     void inspectedWindowScriptObjectCleared(Frame*);
-    void windowScriptObjectAvailable();
 
-    void setFrontendProxyObject(ScriptState* state, ScriptObject webInspectorObj, ScriptObject injectedScriptObj = ScriptObject());
-    ScriptState* frontendScriptState() const { return m_scriptState; }
-
-    void populateScriptObjects();
-    void resetScriptObjects();
+    bool windowVisible();
+    void setFrontend(PassOwnPtr<InspectorFrontend>);
 
     void didCommitLoad(DocumentLoader*);
     void frameDetachedFromParent(Frame*);
@@ -215,11 +159,11 @@ public:
     void didLoadResourceFromMemoryCache(DocumentLoader*, const CachedResource*);
 
     void identifierForInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
-    void willSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
-    void didReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse&);
-    void didReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived);
-    void didFinishLoading(DocumentLoader*, unsigned long identifier);
-    void didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError&);
+    void willSendRequest(unsigned long identifier, const ResourceRequest&, const ResourceResponse& redirectResponse);
+    void didReceiveResponse(unsigned long identifier, const ResourceResponse&);
+    void didReceiveContentLength(unsigned long identifier, int lengthReceived);
+    void didFinishLoading(unsigned long identifier);
+    void didFailLoading(unsigned long identifier, const ResourceError&);
     void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
     void scriptImported(unsigned long identifier, const String& sourceString);
 
@@ -230,13 +174,22 @@ public:
 
     void startTimelineProfiler();
     void stopTimelineProfiler();
-    bool timelineProfilerEnabled() const;
     InspectorTimelineAgent* timelineAgent() { return m_timelineAgent.get(); }
 
     void mainResourceFiredLoadEvent(DocumentLoader*, const KURL&);
     void mainResourceFiredDOMContentEvent(DocumentLoader*, const KURL&);
-                                                        
-    void getCookies(long callId, const String& url);
+
+    void didInsertDOMNode(Node*);
+    void didRemoveDOMNode(Node*);
+    void didModifyDOMAttr(Element*);
+#if ENABLE(WORKERS)
+    enum WorkerAction { WorkerCreated, WorkerDestroyed };
+
+    void postWorkerNotificationToFrontend(const InspectorWorkerResource&, WorkerAction);
+    void didCreateWorker(intptr_t, const String& url, bool isSharedWorker);
+    void didDestroyWorker(intptr_t);
+#endif
+    void getCookies(long callId);
 
 #if ENABLE(DATABASE)
     void didOpenDatabase(Database*, const String& domain, const String& name, const String& version);
@@ -261,68 +214,76 @@ public:
     void startGroup(MessageSource source, ScriptCallStack* callFrame);
     void endGroup(MessageSource source, unsigned lineNumber, const String& sourceURL);
 
+    void markTimeline(const String& message); 
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    void addProfile(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
-    void addProfileFinishedMessageToConsole(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
-    void addStartProfilingMessageToConsole(const JSC::UString& title, unsigned lineNumber, const JSC::UString& sourceURL);
+    void addProfile(PassRefPtr<ScriptProfile>, unsigned lineNumber, const String& sourceURL);
+    void addProfileFinishedMessageToConsole(PassRefPtr<ScriptProfile>, unsigned lineNumber, const String& sourceURL);
+    void addStartProfilingMessageToConsole(const String& title, unsigned lineNumber, const String& sourceURL);
 
     bool isRecordingUserInitiatedProfile() const { return m_recordingUserInitiatedProfile; }
 
-    JSC::UString getCurrentUserInitiatedProfileName(bool incrementProfileNumber);
+    String getCurrentUserInitiatedProfileName(bool incrementProfileNumber);
     void startUserInitiatedProfiling(Timer<InspectorController>* = 0);
     void stopUserInitiatedProfiling();
 
     void enableProfiler(bool always = false, bool skipRecompile = false);
     void disableProfiler(bool always = false);
     bool profilerEnabled() const { return enabled() && m_profilerEnabled; }
+#endif
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
     void enableDebugger();
     void disableDebugger(bool always = false);
     bool debuggerEnabled() const { return m_debuggerEnabled; }
 
     void resumeDebugger();
 
-    virtual void didParseSource(JSC::ExecState*, const JSC::SourceCode&);
-    virtual void failedToParseSource(JSC::ExecState*, const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
+    virtual void didParseSource(const String& sourceID, const String& url, const String& data, int firstLine);
+    virtual void failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage);
     virtual void didPause();
     virtual void didContinue();
 #endif
 
     void evaluateForTestInFrontend(long callId, const String& script);
 
+    InjectedScript injectedScriptForNodeId(long id);
+    void addScriptToEvaluateOnLoad(const String& source);
+    void removeAllScriptsToEvaluateOnLoad();
+
+    static const String& inspectorStartsAttachedSettingName();
+
 private:
+    static const String& frontendSettingsSettingName();
+
     friend class InspectorBackend;
+    friend class InjectedScriptHost;
+                                                        
+    void populateScriptObjects();
+    void unbindAllResources();
+                                                        
+    // Following are used from InspectorBackend and internally.
+    void setSearchingForNode(bool enabled);
+
     // Following are used from InspectorBackend and internally.
-    void scriptObjectReady();
-    void moveWindowBy(float x, float y) const;
-    void setAttachedWindow(bool);
-    void setAttachedWindowHeight(unsigned height);
     void storeLastActivePanel(const String& panelName);
-    void closeWindow();
     InspectorDOMAgent* domAgent() { return m_domAgent.get(); }
     void releaseDOMAgent();
 
-    friend class InspectorFrontend;
-    // Following are used from InspectorFrontend only. We don't want to expose them to the
-    // rest of the InspectorController clients.
-    // TODO: extract these into a separate interface.
-    ScriptValue wrapObject(const ScriptValue& object, const String& objectGroup);
-    ScriptValue unwrapObject(const String& objectId);
-    void releaseWrapperObjectGroup(const String& objectGroup);
-    
-    void resetInjectedScript();
-
     void deleteCookie(const String& cookieName, const String& domain);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    typedef HashMap<unsigned int, RefPtr<JSC::Profile> > ProfilesMap;
+    void setBreakpoint(const String& sourceID, unsigned lineNumber, bool enabled, const String& condition);
+    void removeBreakpoint(const String& sourceID, unsigned lineNumber);
+
+    typedef HashMap<unsigned int, RefPtr<ScriptProfile> > ProfilesMap;
 
     void startUserInitiatedProfilingSoon();
     void toggleRecordButton(bool);
     void enableDebuggerFromFrontend(bool always);
     void getProfileHeaders(long callId);
     void getProfile(long callId, unsigned uid);
-    ScriptObject createProfileHeader(const JSC::Profile& profile);
+    ScriptObject createProfileHeader(const ScriptProfile& profile);
 #endif
 #if ENABLE(DATABASE)
     void selectDatabase(Database* database);
@@ -341,13 +302,11 @@ private:
 
     void addResource(InspectorResource*);
     void removeResource(InspectorResource*);
-    InspectorResource* getTrackedResource(long long identifier);
+    InspectorResource* getTrackedResource(unsigned long identifier);
 
     void pruneResources(ResourcesMap*, DocumentLoader* loaderToKeep = 0);
     void removeAllResources(ResourcesMap* map) { pruneResources(map); }
 
-    void showWindow();
-
     bool isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl);
 
     SpecialPanels specialPanelForJSName(const String& panelName);
@@ -356,17 +315,18 @@ private:
 
     Page* m_inspectedPage;
     InspectorClient* m_client;
+    OwnPtr<InspectorFrontendClient> m_inspectorFrontendClient;
+    bool m_openingFrontend;
     OwnPtr<InspectorFrontend> m_frontend;
     RefPtr<InspectorDOMAgent> m_domAgent;
     OwnPtr<InspectorTimelineAgent> m_timelineAgent;
-    ScriptObject m_injectedScriptObj;
-    Page* m_page;
     RefPtr<Node> m_nodeToFocus;
     RefPtr<InspectorResource> m_mainResource;
     ResourcesMap m_resources;
     HashSet<String> m_knownResources;
     FrameResourcesMap m_frameResources;
     Vector<ConsoleMessage*> m_consoleMessages;
+    unsigned m_expiredConsoleMessageCount;
     HashMap<String, double> m_times;
     HashMap<String, unsigned> m_counts;
 #if ENABLE(DATABASE)
@@ -375,10 +335,7 @@ private:
 #if ENABLE(DOM_STORAGE)
     DOMStorageResourcesMap m_domStorageResources;
 #endif
-    ScriptState* m_scriptState;
-    bool m_windowVisible;
     SpecialPanels m_showAfterVisible;
-    long long m_nextIdentifier;
     RefPtr<Node> m_highlightedNode;
     unsigned m_groupLevel;
     bool m_searchingForNode;
@@ -386,14 +343,19 @@ private:
     bool m_resourceTrackingEnabled;
     bool m_resourceTrackingSettingsLoaded;
     RefPtr<InspectorBackend> m_inspectorBackend;
-    HashMap<String, ScriptValue> m_idToWrappedObject;
-    ObjectGroupsMap m_objectGroups;
+    RefPtr<InjectedScriptHost> m_injectedScriptHost;
+
+    typedef HashMap<String, String> Settings;
+    mutable Settings m_settings;
 
-    long m_lastBoundObjectId;
     Vector<pair<long, String> > m_pendingEvaluateTestCommands;
+    Vector<String> m_scriptsToEvaluateOnLoad;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     bool m_debuggerEnabled;
     bool m_attachDebuggerWhenShown;
+    HashMap<String, String> m_sourceIDToURL;
+    HashMap<String, SourceBreakpoints> m_stickyBreakpoints;
+
     bool m_profilerEnabled;
     bool m_recordingUserInitiatedProfile;
     int m_currentUserInitiatedProfileNumber;
@@ -401,8 +363,31 @@ private:
     Timer<InspectorController> m_startProfiling;
     ProfilesMap m_profiles;
 #endif
+#if ENABLE(WORKERS)
+    typedef HashMap<intptr_t, RefPtr<InspectorWorkerResource> > WorkersMap;
+
+    WorkersMap m_workers;
+#endif
 };
 
+inline void InspectorController::didInsertDOMNode(Node* node)
+{
+    if (m_domAgent)
+        m_domAgent->didInsertDOMNode(node);
+}
+
+inline void InspectorController::didRemoveDOMNode(Node* node)
+{
+    if (m_domAgent)
+        m_domAgent->didRemoveDOMNode(node);
+}
+
+inline void InspectorController::didModifyDOMAttr(Element* element)
+{
+    if (m_domAgent)
+        m_domAgent->didModifyDOMAttr(element);
+}
+
 } // namespace WebCore
 
 #endif // !defined(InspectorController_h)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp
index f6c2d468c4..59629ddc18 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp
@@ -34,16 +34,25 @@
 #if ENABLE(INSPECTOR)
 
 #include "AtomicString.h"
+#include "CSSMutableStyleDeclaration.h"
+#include "CSSRule.h"
+#include "CSSRuleList.h"
+#include "CSSStyleDeclaration.h"
+#include "CSSStyleRule.h"
+#include "CSSStyleSheet.h"
 #include "ContainerNode.h"
 #include "Cookie.h"
 #include "CookieJar.h"
+#include "CString.h"
 #include "DOMWindow.h"
 #include "Document.h"
+#include "DocumentType.h"
 #include "Event.h"
 #include "EventListener.h"
 #include "EventNames.h"
 #include "EventTarget.h"
 #include "HTMLFrameOwnerElement.h"
+#include "HTMLHeadElement.h"
 #include "InspectorFrontend.h"
 #include "markup.h"
 #include "MutationEvent.h"
@@ -52,8 +61,10 @@
 #include "PlatformString.h"
 #include "ScriptEventListener.h"
 #include "ScriptObject.h"
+#include "StyleSheetList.h"
 #include "Text.h"
 
+#include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/Vector.h>
 
@@ -63,18 +74,18 @@ InspectorDOMAgent::InspectorDOMAgent(InspectorFrontend* frontend)
     : EventListener(InspectorDOMAgentType)
     , m_frontend(frontend)
     , m_lastNodeId(1)
+    , m_lastStyleId(1)
+    , m_lastRuleId(1)
 {
 }
 
 InspectorDOMAgent::~InspectorDOMAgent()
 {
-    setDocument(0);
+    reset();
 }
 
-void InspectorDOMAgent::setDocument(Document* doc)
+void InspectorDOMAgent::reset()
 {
-    if (doc == mainFrameDocument())
-        return;
     discardBindings();
 
     ListHashSet<RefPtr<Document> > copy = m_documents;
@@ -82,13 +93,21 @@ void InspectorDOMAgent::setDocument(Document* doc)
         stopListening((*it).get());
 
     ASSERT(!m_documents.size());
+}
+
+void InspectorDOMAgent::setDocument(Document* doc)
+{
+    if (doc == mainFrameDocument())
+        return;
+
+    reset();
 
     if (doc) {
         startListening(doc);
-        if (doc->documentElement()) {
+        if (doc->documentElement())
             pushDocumentToFrontend();
-        }
-    }
+    } else
+        m_frontend->setDocument(ScriptObject());
 }
 
 void InspectorDOMAgent::releaseDanglingNodes()
@@ -103,9 +122,6 @@ void InspectorDOMAgent::startListening(Document* doc)
         return;
 
     doc->addEventListener(eventNames().DOMContentLoadedEvent, this, false);
-    doc->addEventListener(eventNames().DOMNodeInsertedEvent, this, false);
-    doc->addEventListener(eventNames().DOMNodeRemovedEvent, this, false);
-    doc->addEventListener(eventNames().DOMAttrModifiedEvent, this, false);
     doc->addEventListener(eventNames().loadEvent, this, true);
     m_documents.add(doc);
 }
@@ -116,9 +132,6 @@ void InspectorDOMAgent::stopListening(Document* doc)
         return;
 
     doc->removeEventListener(eventNames().DOMContentLoadedEvent, this, false);
-    doc->removeEventListener(eventNames().DOMNodeInsertedEvent, this, false);
-    doc->removeEventListener(eventNames().DOMNodeRemovedEvent, this, false);
-    doc->removeEventListener(eventNames().DOMAttrModifiedEvent, this, false);
     doc->removeEventListener(eventNames().loadEvent, this, true);
     m_documents.remove(doc);
 }
@@ -128,56 +141,7 @@ void InspectorDOMAgent::handleEvent(ScriptExecutionContext*, Event* event)
     AtomicString type = event->type();
     Node* node = event->target()->toNode();
 
-    if (type == eventNames().DOMAttrModifiedEvent) {
-        long id = m_documentNodeToIdMap.get(node);
-        // If node is not mapped yet -> ignore the event.
-        if (!id)
-            return;
-
-        Element* element = static_cast<Element*>(node);
-        m_frontend->attributesUpdated(id, buildArrayForElementAttributes(element));
-    } else if (type == eventNames().DOMNodeInsertedEvent) {
-        if (isWhitespace(node))
-            return;
-
-        // We could be attaching existing subtree. Forget the bindings.
-        unbind(node, &m_documentNodeToIdMap);
-
-        Node* parent = static_cast<MutationEvent*>(event)->relatedNode();
-        long parentId = m_documentNodeToIdMap.get(parent);
-        // Return if parent is not mapped yet.
-        if (!parentId)
-            return;
-
-        if (!m_childrenRequested.contains(parentId)) {
-            // No children are mapped yet -> only notify on changes of hasChildren.
-            m_frontend->childNodeCountUpdated(parentId, innerChildNodeCount(parent));
-        } else {
-            // Children have been requested -> return value of a new child.
-            Node* prevSibling = innerPreviousSibling(node);
-            long prevId = prevSibling ? m_documentNodeToIdMap.get(prevSibling) : 0;
-            ScriptObject value = buildObjectForNode(node, 0, &m_documentNodeToIdMap);
-            m_frontend->childNodeInserted(parentId, prevId, value);
-        }
-    } else if (type == eventNames().DOMNodeRemovedEvent) {
-        if (isWhitespace(node))
-            return;
-
-        Node* parent = static_cast<MutationEvent*>(event)->relatedNode();
-        long parentId = m_documentNodeToIdMap.get(parent);
-        // If parent is not mapped yet -> ignore the event.
-        if (!parentId)
-            return;
-
-        if (!m_childrenRequested.contains(parentId)) {
-            // No children are mapped yet -> only notify on changes of hasChildren.
-            if (innerChildNodeCount(parent) == 1)
-                m_frontend->childNodeCountUpdated(parentId, 0);
-        } else {
-            m_frontend->childNodeRemoved(parentId, m_documentNodeToIdMap.get(node));
-        }
-        unbind(node, &m_documentNodeToIdMap);
-    } else if (type == eventNames().DOMContentLoadedEvent) {
+    if (type == eventNames().DOMContentLoadedEvent) {
         // Re-push document once it is loaded.
         discardBindings();
         pushDocumentToFrontend();
@@ -193,8 +157,9 @@ void InspectorDOMAgent::handleEvent(ScriptExecutionContext*, Event* event)
             // Re-add frame owner element together with its new children.
             long parentId = m_documentNodeToIdMap.get(innerParentNode(node));
             m_frontend->childNodeRemoved(parentId, frameOwnerId);
-            long prevId = m_documentNodeToIdMap.get(innerPreviousSibling(node));
             ScriptObject value = buildObjectForNode(node, 0, &m_documentNodeToIdMap);
+            Node* previousSibling = innerPreviousSibling(node);
+            long prevId = previousSibling ? m_documentNodeToIdMap.get(previousSibling) : 0;
             m_frontend->childNodeInserted(parentId, prevId, value);
             // Invalidate children requested flag for the element.
             m_childrenRequested.remove(m_childrenRequested.find(frameOwnerId));
@@ -238,17 +203,20 @@ void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
     }
 }
 
-void InspectorDOMAgent::pushDocumentToFrontend()
+bool InspectorDOMAgent::pushDocumentToFrontend()
 {
     Document* document = mainFrameDocument();
+    if (!document)
+        return false;
     if (!m_documentNodeToIdMap.contains(document))
         m_frontend->setDocument(buildObjectForNode(document, 2, &m_documentNodeToIdMap));
+    return true;
 }
 
 void InspectorDOMAgent::pushChildNodesToFrontend(long nodeId)
 {
     Node* node = nodeForId(nodeId);
-    if (!node || (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE))
+    if (!node || (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE && node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE))
         return;
     if (m_childrenRequested.contains(nodeId))
         return;
@@ -278,6 +246,35 @@ Node* InspectorDOMAgent::nodeForId(long id)
     return 0;
 }
 
+Node* InspectorDOMAgent::nodeForPath(const String& path)
+{
+    // The path is of form "1,HTML,2,BODY,1,DIV"
+    Node* node = mainFrameDocument();
+    if (!node)
+        return 0;
+
+    Vector<String> pathTokens;
+    path.split(",", false, pathTokens);
+    for (size_t i = 0; i < pathTokens.size() - 1; i += 2) {
+        bool success = true;
+        unsigned childNumber = pathTokens[i].toUInt(&success);
+        if (!success)
+            return 0;
+        if (childNumber >= innerChildNodeCount(node))
+            return 0;
+
+        Node* child = innerFirstChild(node);
+        String childName = pathTokens[i + 1];
+        for (size_t j = 0; child && j < childNumber; ++j)
+            child = innerNextSibling(child);
+
+        if (!child || child->nodeName() != childName)
+            return 0;
+        node = child;
+    }
+    return node;
+}
+
 void InspectorDOMAgent::getChildNodes(long callId, long nodeId)
 {
     pushChildNodesToFrontend(nodeId);
@@ -289,7 +286,8 @@ long InspectorDOMAgent::pushNodePathToFrontend(Node* nodeToPush)
     ASSERT(nodeToPush);  // Invalid input
 
     // If we are sending information to the client that is currently being created. Send root node first.
-    pushDocumentToFrontend();
+    if (!pushDocumentToFrontend())
+        return 0;
 
     // Return id in case the node is known.
     long result = m_documentNodeToIdMap.get(nodeToPush);
@@ -380,8 +378,8 @@ void InspectorDOMAgent::getEventListenersForNode(long callId, long nodeId)
     // Get the list of event types this Node is concerned with
     Vector<AtomicString> eventTypes;
     const EventListenerMap& listenerMap = d->eventListenerMap;
-    HashMap<AtomicString, EventListenerVector>::const_iterator end = listenerMap.end();
-    for (HashMap<AtomicString, EventListenerVector>::const_iterator iter = listenerMap.begin(); iter != end; ++iter)
+    EventListenerMap::const_iterator end = listenerMap.end();
+    for (EventListenerMap::const_iterator iter = listenerMap.begin(); iter != end; ++iter)
         eventTypes.append(iter->first);
 
     // Quick break if no useful listeners
@@ -438,6 +436,13 @@ void InspectorDOMAgent::getEventListenersForNode(long callId, long nodeId)
     m_frontend->didGetEventListenersForNode(callId, nodeId, listenersArray);
 }
 
+String InspectorDOMAgent::documentURLString(Document* document) const
+{
+    if (!document || document->url().isNull())
+        return "";
+    return document->url().string();
+}
+
 ScriptObject InspectorDOMAgent::buildObjectForNode(Node* node, int depth, NodeToIdMap* nodesMap)
 {
     ScriptObject value = m_frontend->newScriptObject();
@@ -465,22 +470,35 @@ ScriptObject InspectorDOMAgent::buildObjectForNode(Node* node, int depth, NodeTo
             break;
     }
 
-    value.set("id", static_cast<int>(id));
+    value.set("id", id);
     value.set("nodeType", node->nodeType());
     value.set("nodeName", nodeName);
     value.set("localName", localName);
     value.set("nodeValue", nodeValue);
 
-    if (node->nodeType() == Node::ELEMENT_NODE) {
-        Element* element = static_cast<Element*>(node);
-        value.set("attributes", buildArrayForElementAttributes(element));
-    }
-    if (node->nodeType() == Node::ELEMENT_NODE || node->nodeType() == Node::DOCUMENT_NODE) {
+    if (node->nodeType() == Node::ELEMENT_NODE || node->nodeType() == Node::DOCUMENT_NODE || node->nodeType() == Node::DOCUMENT_FRAGMENT_NODE) {
         int nodeCount = innerChildNodeCount(node);
         value.set("childNodeCount", nodeCount);
         ScriptArray children = buildArrayForContainerChildren(node, depth, nodesMap);
         if (children.length() > 0)
             value.set("children", children);
+
+        if (node->nodeType() == Node::ELEMENT_NODE) {
+            Element* element = static_cast<Element*>(node);
+            value.set("attributes", buildArrayForElementAttributes(element));
+            if (node->isFrameOwnerElement()) {
+                HTMLFrameOwnerElement* frameOwner = static_cast<HTMLFrameOwnerElement*>(node);
+                value.set("documentURL", documentURLString(frameOwner->contentDocument()));
+            }
+        } else if (node->nodeType() == Node::DOCUMENT_NODE) {
+            Document* document = static_cast<Document*>(node);
+            value.set("documentURL", documentURLString(document));
+        }
+    } else if (node->nodeType() == Node::DOCUMENT_TYPE_NODE) {
+        DocumentType* docType = static_cast<DocumentType*>(node);
+        value.set("publicId", docType->publicId());
+        value.set("systemId", docType->systemId());
+        value.set("internalSubset", docType->internalSubset());
     }
     return value;
 }
@@ -532,7 +550,7 @@ ScriptObject InspectorDOMAgent::buildObjectForEventListener(const RegisteredEven
     value.set("type", eventType);
     value.set("useCapture", registeredEventListener.useCapture);
     value.set("isAttribute", eventListener->isAttribute());
-    value.set("nodeId", static_cast<long long>(pushNodePathToFrontend(node)));
+    value.set("nodeId", pushNodePathToFrontend(node));
     value.set("listener", getEventListenerHandlerBody(node->document(), m_frontend->scriptState(), eventListener.get()));
     return value;
 }
@@ -569,9 +587,9 @@ Node* InspectorDOMAgent::innerPreviousSibling(Node* node)
     return node;
 }
 
-int InspectorDOMAgent::innerChildNodeCount(Node* node)
+unsigned InspectorDOMAgent::innerChildNodeCount(Node* node)
 {
-    int count = 0;
+    unsigned count = 0;
     Node* child = innerFirstChild(node);
     while (child) {
         count++;
@@ -609,6 +627,579 @@ bool InspectorDOMAgent::operator==(const EventListener& listener)
     return false;
 }
 
+void InspectorDOMAgent::didInsertDOMNode(Node* node)
+{
+    if (isWhitespace(node))
+        return;
+
+    // We could be attaching existing subtree. Forget the bindings.
+    unbind(node, &m_documentNodeToIdMap);
+
+    Node* parent = node->parentNode();
+    long parentId = m_documentNodeToIdMap.get(parent);
+    // Return if parent is not mapped yet.
+    if (!parentId)
+        return;
+
+    if (!m_childrenRequested.contains(parentId)) {
+        // No children are mapped yet -> only notify on changes of hasChildren.
+        m_frontend->childNodeCountUpdated(parentId, innerChildNodeCount(parent));
+    } else {
+        // Children have been requested -> return value of a new child.
+        Node* prevSibling = innerPreviousSibling(node);
+        long prevId = prevSibling ? m_documentNodeToIdMap.get(prevSibling) : 0;
+        ScriptObject value = buildObjectForNode(node, 0, &m_documentNodeToIdMap);
+        m_frontend->childNodeInserted(parentId, prevId, value);
+    }
+}
+
+void InspectorDOMAgent::didRemoveDOMNode(Node* node)
+{
+    if (isWhitespace(node))
+        return;
+
+    Node* parent = node->parentNode();
+    long parentId = m_documentNodeToIdMap.get(parent);
+    // If parent is not mapped yet -> ignore the event.
+    if (!parentId)
+        return;
+
+    if (!m_childrenRequested.contains(parentId)) {
+        // No children are mapped yet -> only notify on changes of hasChildren.
+        if (innerChildNodeCount(parent) == 1)
+            m_frontend->childNodeCountUpdated(parentId, 0);
+    } else
+        m_frontend->childNodeRemoved(parentId, m_documentNodeToIdMap.get(node));
+    unbind(node, &m_documentNodeToIdMap);    
+}
+
+void InspectorDOMAgent::didModifyDOMAttr(Element* element)
+{
+    long id = m_documentNodeToIdMap.get(element);
+    // If node is not mapped yet -> ignore the event.
+    if (!id)
+        return;
+
+    m_frontend->attributesUpdated(id, buildArrayForElementAttributes(element));
+}
+
+void InspectorDOMAgent::getStyles(long callId, long nodeId, bool authorOnly)    
+{
+    Node* node = nodeForId(nodeId);
+    if (!node || node->nodeType() != Node::ELEMENT_NODE) {
+        m_frontend->didGetStyles(callId, ScriptValue::undefined());
+        return;
+    }
+    
+    DOMWindow* defaultView = node->ownerDocument()->defaultView();
+    if (!defaultView) {
+        m_frontend->didGetStyles(callId, ScriptValue::undefined());
+        return;
+    }
+
+    Element* element = static_cast<Element*>(node);
+    RefPtr<CSSStyleDeclaration> computedStyle = defaultView->getComputedStyle(element, "");
+
+    ScriptObject result = m_frontend->newScriptObject();
+    if (element->style())
+        result.set("inlineStyle", buildObjectForStyle(element->style(), true));
+    result.set("computedStyle", buildObjectForStyle(computedStyle.get(), false));
+    result.set("matchedCSSRules", getMatchedCSSRules(element, authorOnly));
+    result.set("styleAttributes", getAttributeStyles(element));
+    ScriptObject currentStyle = result;
+    Element* parentElement = element->parentElement();
+    while (parentElement) {
+        ScriptObject parentStyle = m_frontend->newScriptObject();
+        currentStyle.set("parent", parentStyle);
+        if (parentElement->style() && parentElement->style()->length())
+            parentStyle.set("inlineStyle", buildObjectForStyle(parentElement->style(), true));
+        parentStyle.set("matchedCSSRules", getMatchedCSSRules(parentElement, authorOnly));
+        parentElement = parentElement->parentElement();
+        currentStyle = parentStyle;
+    }
+    m_frontend->didGetStyles(callId, result);
+}
+
+void InspectorDOMAgent::getAllStyles(long callId)
+{
+    ScriptArray result = m_frontend->newScriptArray();
+    unsigned counter = 0;
+    for (ListHashSet<RefPtr<Document> >::iterator it = m_documents.begin(); it != m_documents.end(); ++it) {
+        StyleSheetList* list = (*it)->styleSheets();
+        for (unsigned i = 0; i < list->length(); ++i) {
+            StyleSheet* styleSheet = list->item(i);
+            if (styleSheet->isCSSStyleSheet())
+                result.set(counter++, buildObjectForStyleSheet(static_cast<CSSStyleSheet*>(styleSheet)));
+        }
+    }
+    m_frontend->didGetAllStyles(callId, result);
+}
+
+void InspectorDOMAgent::getInlineStyle(long callId, long nodeId)
+{
+    Node* node = nodeForId(nodeId);
+    if (!node || node->nodeType() != Node::ELEMENT_NODE) {
+        m_frontend->didGetInlineStyle(callId, ScriptValue::undefined());
+        return;
+    }
+    Element* element = static_cast<Element*>(node);
+    m_frontend->didGetInlineStyle(callId, buildObjectForStyle(element->style(), true));
+}
+
+void InspectorDOMAgent::getComputedStyle(long callId, long nodeId)
+{
+    Node* node = nodeForId(nodeId);
+    if (!node || node->nodeType() != Node::ELEMENT_NODE) {
+        m_frontend->didGetComputedStyle(callId, ScriptValue::undefined());
+        return;
+    }
+
+    DOMWindow* defaultView = node->ownerDocument()->defaultView();
+    if (!defaultView) {
+        m_frontend->didGetComputedStyle(callId, ScriptValue::undefined());
+        return;
+    }
+
+    Element* element = static_cast<Element*>(node);
+    RefPtr<CSSStyleDeclaration> computedStyle = defaultView->getComputedStyle(element, "");
+    m_frontend->didGetComputedStyle(callId, buildObjectForStyle(computedStyle.get(), false));
+}
+
+ScriptArray InspectorDOMAgent::getMatchedCSSRules(Element* element, bool authorOnly)
+{
+    DOMWindow* defaultView = element->ownerDocument()->defaultView();
+    if (!defaultView)
+        return m_frontend->newScriptArray();
+
+    RefPtr<CSSRuleList> matchedRules = defaultView->getMatchedCSSRules(element, "", authorOnly);
+    ScriptArray matchedCSSRules = m_frontend->newScriptArray();
+    unsigned counter = 0;
+    for (unsigned i = 0; matchedRules.get() && i < matchedRules->length(); ++i) {
+        CSSRule* rule = matchedRules->item(i);
+        if (rule->type() == CSSRule::STYLE_RULE)
+            matchedCSSRules.set(counter++, buildObjectForRule(static_cast<CSSStyleRule*>(rule)));
+    }
+    return matchedCSSRules;
+}
+
+ScriptObject InspectorDOMAgent::getAttributeStyles(Element* element)
+{
+    ScriptObject styleAttributes = m_frontend->newScriptObject();
+    NamedNodeMap* attributes = element->attributes();
+    for (unsigned i = 0; attributes && i < attributes->length(); ++i) {
+        Attribute* attribute = attributes->attributeItem(i);
+        if (attribute->style()) {
+            String attributeName = attribute->localName();
+            styleAttributes.set(attributeName.utf8().data(), buildObjectForStyle(attribute->style(), true));
+        }
+    }
+    return styleAttributes;
+}
+
+void InspectorDOMAgent::applyStyleText(long callId, long styleId, const String& styleText, const String& propertyName)
+{
+    IdToStyleMap::iterator it = m_idToStyle.find(styleId);
+    if (it == m_idToStyle.end()) {
+        m_frontend->didApplyStyleText(callId, false, ScriptValue::undefined(), m_frontend->newScriptArray());
+        return;
+    }
+
+    CSSStyleDeclaration* style = it->second.get();
+    int styleTextLength = styleText.length();
+
+    RefPtr<CSSMutableStyleDeclaration> tempMutableStyle = CSSMutableStyleDeclaration::create();
+    tempMutableStyle->parseDeclaration(styleText);
+    CSSStyleDeclaration* tempStyle = static_cast<CSSStyleDeclaration*>(tempMutableStyle.get());
+
+    if (tempStyle->length() || !styleTextLength) {
+        ExceptionCode ec = 0;
+        // The input was parsable or the user deleted everything, so remove the
+        // original property from the real style declaration. If this represents
+        // a shorthand remove all the longhand properties.
+        if (style->getPropertyShorthand(propertyName).isEmpty()) {
+            Vector<String> longhandProps = longhandProperties(style, propertyName);
+            for (unsigned i = 0; !ec && i < longhandProps.size(); ++i)
+                style->removeProperty(longhandProps[i], ec);
+        } else
+            style->removeProperty(propertyName, ec);
+        if (ec) {
+            m_frontend->didApplyStyleText(callId, false, ScriptValue::undefined(), m_frontend->newScriptArray());
+            return;
+        }
+    }
+
+    // Notify caller that the property was successfully deleted.
+    if (!styleTextLength) {
+        ScriptArray changedProperties = m_frontend->newScriptArray();
+        changedProperties.set(0, propertyName);
+        m_frontend->didApplyStyleText(callId, true, ScriptValue::undefined(), changedProperties);
+        return;
+    }
+
+    if (!tempStyle->length()) {
+        m_frontend->didApplyStyleText(callId, false, ScriptValue::undefined(), m_frontend->newScriptArray());
+        return;
+    }
+
+    // Iterate of the properties on the test element's style declaration and
+    // add them to the real style declaration. We take care to move shorthands.
+    HashSet<String> foundShorthands;
+    Vector<String> changedProperties;
+
+    for (unsigned i = 0; i < tempStyle->length(); ++i) {
+        String name = tempStyle->item(i);
+        String shorthand = tempStyle->getPropertyShorthand(name);
+
+        if (!shorthand.isEmpty() && foundShorthands.contains(shorthand))
+            continue;
+
+        String value;
+        String priority;
+        if (!shorthand.isEmpty()) {
+            value = shorthandValue(tempStyle, shorthand);
+            priority = shorthandPriority(tempStyle, shorthand);
+            foundShorthands.add(shorthand);
+            name = shorthand;
+        } else {
+            value = tempStyle->getPropertyValue(name);
+            priority = tempStyle->getPropertyPriority(name);
+        }
+
+        // Set the property on the real style declaration.
+        ExceptionCode ec = 0;
+        style->setProperty(name, value, priority, ec);
+        changedProperties.append(name);
+    }
+    m_frontend->didApplyStyleText(callId, true, buildObjectForStyle(style, true), toArray(changedProperties));
+}
+
+void InspectorDOMAgent::setStyleText(long callId, long styleId, const String& cssText)
+{
+    IdToStyleMap::iterator it = m_idToStyle.find(styleId);
+    if (it == m_idToStyle.end()) {
+        m_frontend->didSetStyleText(callId, false);
+        return;
+    }
+    CSSStyleDeclaration* style = it->second.get();
+    ExceptionCode ec = 0;
+    style->setCssText(cssText, ec);
+    m_frontend->didSetStyleText(callId, !ec);
+}
+
+void InspectorDOMAgent::setStyleProperty(long callId, long styleId, const String& name, const String& value)
+{
+    IdToStyleMap::iterator it = m_idToStyle.find(styleId);
+    if (it == m_idToStyle.end()) {
+        m_frontend->didSetStyleProperty(callId, false);
+        return;
+    }
+
+    CSSStyleDeclaration* style = it->second.get();
+    ExceptionCode ec = 0;
+    style->setProperty(name, value, ec);
+    m_frontend->didSetStyleProperty(callId, !ec);
+}
+
+void InspectorDOMAgent::toggleStyleEnabled(long callId, long styleId, const String& propertyName, bool disabled)
+{
+    IdToStyleMap::iterator it = m_idToStyle.find(styleId);
+    if (it == m_idToStyle.end()) {
+        m_frontend->didToggleStyleEnabled(callId, ScriptValue::undefined());
+        return;
+    }
+    CSSStyleDeclaration* style = it->second.get();
+
+    IdToStyleMap::iterator disabledIt = m_idToDisabledStyle.find(styleId);
+    if (disabledIt == m_idToDisabledStyle.end())
+        disabledIt = m_idToDisabledStyle.set(styleId, CSSMutableStyleDeclaration::create()).first;
+    CSSStyleDeclaration* disabledStyle = disabledIt->second.get();
+
+    // TODO: make sure this works with shorthands right.
+    ExceptionCode ec = 0;
+    if (disabled) {
+        disabledStyle->setProperty(propertyName, style->getPropertyValue(propertyName), style->getPropertyPriority(propertyName), ec);
+        if (!ec)
+            style->removeProperty(propertyName, ec);
+    } else {
+        style->setProperty(propertyName, disabledStyle->getPropertyValue(propertyName), disabledStyle->getPropertyPriority(propertyName), ec);
+        if (!ec)
+            disabledStyle->removeProperty(propertyName, ec);
+    }
+    if (ec) {
+        m_frontend->didToggleStyleEnabled(callId, ScriptValue::undefined());
+        return;
+    }
+    m_frontend->didToggleStyleEnabled(callId, buildObjectForStyle(style, true));
+}
+
+void InspectorDOMAgent::setRuleSelector(long callId, long ruleId, const String& selector, long selectedNodeId)
+{
+    IdToRuleMap::iterator it = m_idToRule.find(ruleId);
+    if (it == m_idToRule.end()) {
+        m_frontend->didSetRuleSelector(callId, ScriptValue::undefined(), false);
+        return;
+    }
+
+    CSSStyleRule* rule = it->second.get();
+    Node* node = nodeForId(selectedNodeId);
+
+    CSSStyleSheet* styleSheet = rule->parentStyleSheet();
+    ExceptionCode ec = 0;
+    styleSheet->addRule(selector, rule->style()->cssText(), ec);
+    if (ec) {
+        m_frontend->didSetRuleSelector(callId, ScriptValue::undefined(), false);
+        return;
+    }
+
+    CSSStyleRule* newRule = static_cast<CSSStyleRule*>(styleSheet->item(styleSheet->length() - 1));
+    for (unsigned i = 0; i < styleSheet->length(); ++i) {
+        if (styleSheet->item(i) == rule) {
+            styleSheet->deleteRule(i, ec);
+            break;
+        }
+    }
+
+    if (ec) {
+        m_frontend->didSetRuleSelector(callId, ScriptValue::undefined(), false);
+        return;
+    }
+
+    m_frontend->didSetRuleSelector(callId, buildObjectForRule(newRule), ruleAffectsNode(newRule, node));
+}
+
+void InspectorDOMAgent::addRule(long callId, const String& selector, long selectedNodeId)
+{
+    Node* node = nodeForId(selectedNodeId);
+    if (!node) {
+        m_frontend->didAddRule(callId, ScriptValue::undefined(), false);
+        return;
+    }
+
+    if (!m_inspectorStyleSheet.get()) {
+        Document* ownerDocument = node->ownerDocument();
+        ExceptionCode ec = 0;
+        RefPtr<Element> styleElement = ownerDocument->createElement("style", ec);
+        if (!ec)
+            styleElement->setAttribute("type", "text/css", ec);
+        if (!ec)
+            ownerDocument->head()->appendChild(styleElement, ec);
+        if (ec) {
+            m_frontend->didAddRule(callId, ScriptValue::undefined(), false);
+            return;
+        }
+        StyleSheetList* styleSheets = ownerDocument->styleSheets();
+        StyleSheet* styleSheet = styleSheets->item(styleSheets->length() - 1);
+        if (!styleSheet->isCSSStyleSheet()) {
+            m_frontend->didAddRule(callId, ScriptValue::undefined(), false);
+            return;
+        }
+        m_inspectorStyleSheet = static_cast<CSSStyleSheet*>(styleSheet);
+    }
+
+    ExceptionCode ec = 0;
+    m_inspectorStyleSheet->addRule(selector, "", ec);
+    if (ec) {
+        m_frontend->didAddRule(callId, ScriptValue::undefined(), false);
+        return;
+    }
+
+    CSSStyleRule* newRule = static_cast<CSSStyleRule*>(m_inspectorStyleSheet->item(m_inspectorStyleSheet->length() - 1));
+    m_frontend->didAddRule(callId, buildObjectForRule(newRule), ruleAffectsNode(newRule, node));
+}
+
+long InspectorDOMAgent::bindStyle(CSSStyleDeclaration* style)
+{
+    long id = m_styleToId.get(style);
+    if (!id) {
+        id = m_lastStyleId++;
+        m_idToStyle.set(id, style);
+        m_styleToId.set(style, id);
+    }
+    return id;
+}
+
+long InspectorDOMAgent::bindRule(CSSStyleRule* rule)
+{
+    long id = m_ruleToId.get(rule);
+    if (!id) {
+        id = m_lastRuleId++;
+        m_idToRule.set(id, rule);
+        m_ruleToId.set(rule, id);
+    }
+    return id;
+}
+
+ScriptObject InspectorDOMAgent::buildObjectForStyle(CSSStyleDeclaration* style, bool bind)
+{
+    ScriptObject result = m_frontend->newScriptObject();
+    if (bind) {
+        long styleId = bindStyle(style);
+        result.set("id", styleId);
+
+        IdToStyleMap::iterator disabledIt = m_idToDisabledStyle.find(styleId);
+        if (disabledIt != m_idToDisabledStyle.end()) {
+            ScriptObject disabledStyle = m_frontend->newScriptObject();
+            populateObjectWithStyleProperties(disabledIt->second.get(), disabledStyle);
+            result.set("disabled", disabledStyle);
+        }
+    }
+    result.set("width", style->getPropertyValue("width"));
+    result.set("height", style->getPropertyValue("height"));
+    populateObjectWithStyleProperties(style, result);
+    return result;
+}
+
+void InspectorDOMAgent::populateObjectWithStyleProperties(CSSStyleDeclaration* style, ScriptObject& result)
+{
+    ScriptArray properties = m_frontend->newScriptArray();
+    ScriptObject shorthandValues = m_frontend->newScriptObject();
+    result.set("properties", properties);
+    result.set("shorthandValues", shorthandValues);
+
+    HashSet<String> foundShorthands;
+    for (unsigned i = 0; i < style->length(); ++i) {
+        ScriptObject property = m_frontend->newScriptObject();
+        String name = style->item(i);
+        property.set("name", name);
+        property.set("priority", style->getPropertyPriority(name));
+        property.set("implicit", style->isPropertyImplicit(name));
+        String shorthand =  style->getPropertyShorthand(name);
+        property.set("shorthand", shorthand);
+        if (!shorthand.isEmpty() && !foundShorthands.contains(shorthand)) {
+            foundShorthands.add(shorthand);
+            shorthandValues.set(shorthand, shorthandValue(style, shorthand));
+        }
+        property.set("value", style->getPropertyValue(name));
+        properties.set(i, property);
+    }
+}
+
+ScriptObject InspectorDOMAgent::buildObjectForStyleSheet(CSSStyleSheet* styleSheet)
+{
+    ScriptObject result = m_frontend->newScriptObject();
+    result.set("disabled", styleSheet->disabled());
+    result.set("href", styleSheet->href());
+    result.set("title", styleSheet->title());
+    result.set("documentElementId", m_documentNodeToIdMap.get(styleSheet->doc()));
+    ScriptArray cssRules = m_frontend->newScriptArray();
+    result.set("cssRules", cssRules);
+    PassRefPtr<CSSRuleList> cssRuleList = CSSRuleList::create(styleSheet, true);
+    if (!cssRuleList)
+        return result;
+    unsigned counter = 0;
+    for (unsigned i = 0; i < cssRuleList->length(); ++i) {
+        CSSRule* rule = cssRuleList->item(i);
+        if (rule->isStyleRule())
+            cssRules.set(counter++, buildObjectForRule(static_cast<CSSStyleRule*>(rule)));
+    }
+    return result;
+}
+
+ScriptObject InspectorDOMAgent::buildObjectForRule(CSSStyleRule* rule)
+{
+    CSSStyleSheet* parentStyleSheet = rule->parentStyleSheet();
+
+    ScriptObject result = m_frontend->newScriptObject();
+    result.set("selectorText", rule->selectorText());
+    result.set("cssText", rule->cssText());
+    result.set("sourceLine", rule->sourceLine());
+    if (parentStyleSheet) {
+        ScriptObject parentStyleSheetValue = m_frontend->newScriptObject();
+        result.set("parentStyleSheet", parentStyleSheetValue);
+        parentStyleSheetValue.set("href", parentStyleSheet->href());
+    }
+    bool isUserAgent = parentStyleSheet && !parentStyleSheet->ownerNode() && parentStyleSheet->href().isEmpty();
+    bool isUser = parentStyleSheet && parentStyleSheet->ownerNode() && parentStyleSheet->ownerNode()->nodeName() == "#document";
+    result.set("isUserAgent", isUserAgent);
+    result.set("isUser", isUser);
+    result.set("isViaInspector", rule->parentStyleSheet() == m_inspectorStyleSheet.get());
+
+    // Bind editable scripts only.
+    bool bind = !isUserAgent && !isUser;
+    result.set("style", buildObjectForStyle(rule->style(), bind));
+
+    if (bind)
+        result.set("id", bindRule(rule));
+    return result;
+}
+
+Vector<String> InspectorDOMAgent::longhandProperties(CSSStyleDeclaration* style, const String& shorthandProperty)
+{
+    Vector<String> properties;
+    HashSet<String> foundProperties;
+
+    for (unsigned i = 0; i < style->length(); ++i) {
+        String individualProperty = style->item(i);
+        if (foundProperties.contains(individualProperty) || style->getPropertyShorthand(individualProperty) != shorthandProperty)
+            continue;
+        foundProperties.add(individualProperty);
+        properties.append(individualProperty);
+    }
+
+    return properties;
+}
+
+String InspectorDOMAgent::shorthandValue(CSSStyleDeclaration* style, const String& shorthandProperty)
+{
+    String value = style->getPropertyValue(shorthandProperty);
+    if (value.isEmpty()) {
+        // Some shorthands (like border) return a null value, so compute a shorthand value.
+        // FIXME: remove this when http://bugs.webkit.org/show_bug.cgi?id=15823 is fixed.
+        for (unsigned i = 0; i < style->length(); ++i) {
+            String individualProperty = style->item(i);
+            if (style->getPropertyShorthand(individualProperty) != shorthandProperty)
+                continue;
+            if (style->isPropertyImplicit(individualProperty))
+                continue;
+            String individualValue = style->getPropertyValue(individualProperty);
+            if (individualValue == "initial")
+                continue;
+            if (value.length())
+                value.append(" ");
+            value.append(individualValue);
+        }
+    }
+    return value;
+}
+
+String InspectorDOMAgent::shorthandPriority(CSSStyleDeclaration* style, const String& shorthandProperty)
+{
+    String priority = style->getPropertyPriority(shorthandProperty);
+    if (priority.isEmpty()) {
+        for (unsigned i = 0; i < style->length(); ++i) {
+            String individualProperty = style->item(i);
+            if (style->getPropertyShorthand(individualProperty) != shorthandProperty)
+                continue;
+            priority = style->getPropertyPriority(individualProperty);
+            break;
+        }
+    }
+    return priority;
+}
+
+bool InspectorDOMAgent::ruleAffectsNode(CSSStyleRule* rule, Node* node)
+{
+    if (!node)
+        return false;
+    ExceptionCode ec = 0;
+    RefPtr<NodeList> nodes = node->ownerDocument()->querySelectorAll(rule->selectorText(), ec);
+    if (ec)
+        return false;
+    for (unsigned i = 0; i < nodes->length(); ++i) {
+        if (nodes->item(i) == node)
+            return true;
+    }
+    return false;
+}
+
+ScriptArray InspectorDOMAgent::toArray(const Vector<String>& data)
+{
+    ScriptArray result = m_frontend->newScriptArray();
+    for (unsigned i = 0; i < data.size(); ++i)
+        result.set(i, data[i]);
+    return result;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
index 3f736f7005..d0d983edc2 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
@@ -45,6 +45,10 @@
 
 namespace WebCore {
     class ContainerNode;
+    class CSSRule;
+    class CSSStyleDeclaration;
+    class CSSStyleRule;
+    class CSSStyleSheet;
     class Element;
     class Event;
     class Document;
@@ -83,21 +87,41 @@ namespace WebCore {
         InspectorDOMAgent(InspectorFrontend* frontend);
         ~InspectorDOMAgent();
 
+        void reset();
+
         virtual bool operator==(const EventListener& other);
 
-        // Methods called from the frontend.
+        // Methods called from the frontend for DOM nodes inspection.
         void getChildNodes(long callId, long nodeId);
         void setAttribute(long callId, long elementId, const String& name, const String& value);
         void removeAttribute(long callId, long elementId, const String& name);
         void setTextNodeValue(long callId, long nodeId, const String& value);
         void getEventListenersForNode(long callId, long nodeId);
 
+        // Methods called from the frontend for CSS styles inspection.
+        void getStyles(long callId, long nodeId, bool authorOnly);
+        void getAllStyles(long callId);
+        void getInlineStyle(long callId, long nodeId);
+        void getComputedStyle(long callId, long nodeId);
+        void applyStyleText(long callId, long styleId, const String& styleText, const String& propertyName);
+        void setStyleText(long callId, long styleId, const String& cssText);
+        void setStyleProperty(long callId, long styleId, const String& name, const String& value);
+        void toggleStyleEnabled(long callId, long styleId, const String& propertyName, bool disabled);
+        void setRuleSelector(long callId, long ruleId, const String& selector, long selectedNodeId);
+        void addRule(long callId, const String& selector, long selectedNodeId);
+
         // Methods called from the InspectorController.
         void setDocument(Document* document);
         void releaseDanglingNodes();
 
+        void didInsertDOMNode(Node*);
+        void didRemoveDOMNode(Node*);
+        void didModifyDOMAttr(Element*);
+
         Node* nodeForId(long nodeId);
+        Node* nodeForPath(const String& path);
         long pushNodePathToFrontend(Node* node);
+        void pushChildNodesToFrontend(long nodeId);
 
    private:
         void startListening(Document* document);
@@ -105,17 +129,18 @@ namespace WebCore {
 
         virtual void handleEvent(ScriptExecutionContext*, Event* event);
 
+        // Node-related methods.
         typedef HashMap<RefPtr<Node>, long> NodeToIdMap;
         long bind(Node* node, NodeToIdMap* nodesMap);
         void unbind(Node* node, NodeToIdMap* nodesMap);
 
-        void pushDocumentToFrontend();
-        void pushChildNodesToFrontend(long nodeId);
+        bool pushDocumentToFrontend();
 
+        ScriptArray getMatchedCSSRules(Element* element, bool authorOnly);
+        ScriptObject getAttributeStyles(Element* element);
         ScriptObject buildObjectForNode(Node* node, int depth, NodeToIdMap* nodesMap);
         ScriptArray buildArrayForElementAttributes(Element* element);
         ScriptArray buildArrayForContainerChildren(Node* container, int depth, NodeToIdMap* nodesMap);
-
         ScriptObject buildObjectForEventListener(const RegisteredEventListener& registeredEventListener, const AtomicString& eventType, Node* node);
 
         // We represent embedded doms as a part of the same hierarchy. Hence we treat children of frame owners differently.
@@ -123,11 +148,25 @@ namespace WebCore {
         Node* innerFirstChild(Node* node);
         Node* innerNextSibling(Node* node);
         Node* innerPreviousSibling(Node* node);
-        int innerChildNodeCount(Node* node);
+        unsigned innerChildNodeCount(Node* node);
         Node* innerParentNode(Node* node);
         bool isWhitespace(Node* node);
 
         Document* mainFrameDocument() const;
+        String documentURLString(Document* document) const;
+
+        long bindStyle(CSSStyleDeclaration*);
+        long bindRule(CSSStyleRule*);
+        ScriptObject buildObjectForStyle(CSSStyleDeclaration*, bool bind);
+        void populateObjectWithStyleProperties(CSSStyleDeclaration*, ScriptObject& result);
+        ScriptObject buildObjectForRule(CSSStyleRule*);
+        ScriptObject buildObjectForStyleSheet(CSSStyleSheet*);
+        Vector<String> longhandProperties(CSSStyleDeclaration*, const String& shorthandProperty);
+        String shorthandValue(CSSStyleDeclaration*, const String& shorthandProperty);
+        String shorthandPriority(CSSStyleDeclaration*, const String& shorthandProperty);
+        bool ruleAffectsNode(CSSStyleRule*, Node*);
+        ScriptArray toArray(const Vector<String>& data);
+
         void discardBindings();
 
         InspectorFrontend* m_frontend;
@@ -138,6 +177,20 @@ namespace WebCore {
         HashMap<long, NodeToIdMap*> m_idToNodesMap;
         HashSet<long> m_childrenRequested;
         long m_lastNodeId;
+
+        typedef HashMap<CSSStyleDeclaration*, long> StyleToIdMap;
+        typedef HashMap<long, RefPtr<CSSStyleDeclaration> > IdToStyleMap;
+        StyleToIdMap m_styleToId;
+        IdToStyleMap m_idToStyle;
+        typedef HashMap<CSSStyleRule*, long> RuleToIdMap;
+        typedef HashMap<long, RefPtr<CSSStyleRule> > IdToRuleMap;
+        RuleToIdMap m_ruleToId;
+        IdToRuleMap m_idToRule;
+        IdToStyleMap m_idToDisabledStyle;
+        RefPtr<CSSStyleSheet> m_inspectorStyleSheet;
+
+        long m_lastStyleId;
+        long m_lastRuleId;
         ListHashSet<RefPtr<Document> > m_documents;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
index c93e987d40..af0530a226 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
@@ -104,7 +104,8 @@ void InspectorDOMStorageResource::handleEvent(ScriptExecutionContext*, Event* ev
     ASSERT(eventNames().storageEvent == event->type());
     StorageEvent* storageEvent = static_cast<StorageEvent*>(event);
     Storage* storage = storageEvent->storageArea();
-    bool isLocalStorage = storage->frame()->domWindow()->localStorage() == storage;
+    ExceptionCode ec = 0;
+    bool isLocalStorage = (storage->frame()->domWindow()->localStorage(ec) == storage && !ec);
     if (isSameHostAndType(storage->frame(), isLocalStorage))
         m_frontend->updateDOMStorage(m_id);
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
index c2dc5c615e..cec0e280ac 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
@@ -37,7 +37,6 @@
 #include "Frame.h"
 #include "InspectorFrontend.h"
 #include "ScriptObject.h"
-#include "ScriptObjectQuarantine.h"
 
 namespace WebCore {
 
@@ -59,9 +58,6 @@ void InspectorDatabaseResource::bind(InspectorFrontend* frontend)
         return;
 
     ScriptObject jsonObject = frontend->newScriptObject();
-    ScriptObject database;
-    if (!getQuarantinedScriptObject(m_database.get(), database))
-        return;
     jsonObject.set("id", m_id);
     jsonObject.set("domain", m_domain);
     jsonObject.set("name", m_name);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
index 2c422aceb2..9c8e86082a 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
@@ -34,27 +34,23 @@
 
 #include "ConsoleMessage.h"
 #include "Frame.h"
+#include "InjectedScript.h"
+#include "InjectedScriptHost.h"
 #include "InspectorController.h"
+#include "InspectorWorkerResource.h"
 #include "Node.h"
 #include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
-#include "ScriptObjectQuarantine.h"
 #include "ScriptState.h"
 #include "ScriptString.h"
+#include "ScriptValue.h"
+#include "SerializedScriptValue.h"
 #include <wtf/OwnPtr.h>
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-#include <parser/SourceCode.h>
-#include <runtime/JSValue.h>
-#include <runtime/UString.h>
-#endif
-
 namespace WebCore {
 
-InspectorFrontend::InspectorFrontend(InspectorController* inspectorController, ScriptState* scriptState, ScriptObject webInspector)
-    : m_inspectorController(inspectorController)
-    , m_scriptState(scriptState)
-    , m_webInspector(webInspector)
+InspectorFrontend::InspectorFrontend(ScriptObject webInspector)
+    : m_webInspector(webInspector)
 {
 }
 
@@ -63,14 +59,26 @@ InspectorFrontend::~InspectorFrontend()
     m_webInspector = ScriptObject();
 }
 
+void InspectorFrontend::close()
+{
+    ScriptFunctionCall function(m_webInspector, "close");
+    function.call();
+}
+
+void InspectorFrontend::inspectedPageDestroyed()
+{
+    ScriptFunctionCall function(m_webInspector, "inspectedPageDestroyed");
+    function.call();
+}
+
 ScriptArray InspectorFrontend::newScriptArray()
 {
-    return ScriptArray::createNew(m_scriptState);
+    return ScriptArray::createNew(scriptState());
 }
 
 ScriptObject InspectorFrontend::newScriptObject()
 {
-    return ScriptObject::createNew(m_scriptState);
+    return ScriptObject::createNew(scriptState());
 }
 
 void InspectorFrontend::didCommitLoad()
@@ -78,26 +86,51 @@ void InspectorFrontend::didCommitLoad()
     callSimpleFunction("didCommitLoad");
 }
 
-void InspectorFrontend::addConsoleMessage(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message)
+void InspectorFrontend::populateFrontendSettings(const String& settings)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addConsoleMessage"));
-    function->appendArgument(messageObj);
+    ScriptFunctionCall function(m_webInspector, "dispatch");
+    function.appendArgument("populateFrontendSettings");
+    function.appendArgument(settings);
+    function.call();
+}
+
+void InspectorFrontend::updateConsoleMessageExpiredCount(unsigned count)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("updateConsoleMessageExpiredCount");
+    function.appendArgument(count);
+    function.call();
+}
+
+void InspectorFrontend::addConsoleMessage(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<RefPtr<SerializedScriptValue> >& arguments, const String& message)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("addConsoleMessage");
+    function.appendArgument(messageObj);
     if (!frames.isEmpty()) {
         for (unsigned i = 0; i < frames.size(); ++i)
-            function->appendArgument(frames[i]);
-    } else if (!wrappedArguments.isEmpty()) {
-        for (unsigned i = 0; i < wrappedArguments.size(); ++i)
-            function->appendArgument(m_inspectorController->wrapObject(wrappedArguments[i], "console"));
-    } else
-        function->appendArgument(message);
-    function->call();
+            function.appendArgument(frames[i]);
+    } else if (!arguments.isEmpty()) {
+        for (unsigned i = 0; i < arguments.size(); ++i) {
+            ScriptValue scriptValue = ScriptValue::deserialize(scriptState(), arguments[i].get());
+            if (scriptValue.hasNoValue()) {
+                ASSERT_NOT_REACHED();
+                return;
+            }
+            function.appendArgument(scriptValue);
+        }
+    } else {
+        function.appendArgument(message);
+    }
+    function.call();
 }
 
-void InspectorFrontend::updateConsoleMessageRepeatCount(const int count)
+void InspectorFrontend::updateConsoleMessageRepeatCount(unsigned count)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateConsoleMessageRepeatCount"));
-    function->appendArgument(count);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("updateConsoleMessageRepeatCount");
+    function.appendArgument(count);
+    function.call();
 }
 
 void InspectorFrontend::clearConsoleMessages()
@@ -105,70 +138,72 @@ void InspectorFrontend::clearConsoleMessages()
     callSimpleFunction("clearConsoleMessages");
 }
 
-bool InspectorFrontend::addResource(long long identifier, const ScriptObject& resourceObj)
-{
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addResource"));
-    function->appendArgument(identifier);
-    function->appendArgument(resourceObj);
-    bool hadException = false;
-    function->call(hadException);
-    return !hadException;
-}
-
-bool InspectorFrontend::updateResource(long long identifier, const ScriptObject& resourceObj)
+bool InspectorFrontend::updateResource(unsigned long identifier, const ScriptObject& resourceObj)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateResource"));
-    function->appendArgument(identifier);
-    function->appendArgument(resourceObj);
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("updateResource");
+    function.appendArgument(identifier);
+    function.appendArgument(resourceObj);
     bool hadException = false;
-    function->call(hadException);
+    function.call(hadException);
     return !hadException;
 }
 
-void InspectorFrontend::removeResource(long long identifier)
+void InspectorFrontend::removeResource(unsigned long identifier)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("removeResource"));
-    function->appendArgument(identifier);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("removeResource");
+    function.appendArgument(identifier);
+    function.call();
 }
 
-void InspectorFrontend::addCookieDomain(String domain)
+void InspectorFrontend::didGetResourceContent(int callId, const String& content)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addCookieDomain"));
-    function->appendArgument(domain);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch");
+    function.appendArgument("didGetResourceContent");
+    function.appendArgument(callId);
+    function.appendArgument(content);
+    function.call();
 }
 
-void InspectorFrontend::updateFocusedNode(long long nodeId)
+void InspectorFrontend::updateFocusedNode(long nodeId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateFocusedNode"));
-    function->appendArgument(nodeId);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("updateFocusedNode");
+    function.appendArgument(nodeId);
+    function.call();
 }
 
 void InspectorFrontend::setAttachedWindow(bool attached)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setAttachedWindow"));
-    function->appendArgument(attached);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("setAttachedWindow");
+    function.appendArgument(attached);
+    function.call();
 }
 
 void InspectorFrontend::showPanel(int panel)
 {
     const char* showFunctionName;
     switch (panel) {
+        case InspectorController::AuditsPanel:
+            showFunctionName = "showAuditsPanel";
+            break;
         case InspectorController::ConsolePanel:
-            showFunctionName = "showConsole";
+            showFunctionName = "showConsolePanel";
             break;
         case InspectorController::ElementsPanel:
             showFunctionName = "showElementsPanel";
             break;
-        case InspectorController::ProfilesPanel:
-            showFunctionName = "showProfilesPanel";
-            break;
         case InspectorController::ResourcesPanel:
             showFunctionName = "showResourcesPanel";
             break;
+        case InspectorController::TimelinePanel:
+            showFunctionName = "showTimelinePanel";
+            break;
+        case InspectorController::ProfilesPanel:
+            showFunctionName = "showProfilesPanel";
+            break;
         case InspectorController::ScriptsPanel:
             showFunctionName = "showScriptsPanel";
             break;
@@ -194,6 +229,19 @@ void InspectorFrontend::reset()
     callSimpleFunction("reset");
 }
 
+void InspectorFrontend::bringToFront()
+{
+    callSimpleFunction("bringToFront");
+}
+
+void InspectorFrontend::inspectedURLChanged(const String& url)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch");
+    function.appendArgument("inspectedURLChanged");
+    function.appendArgument(url);
+    function.call();
+}
+
 void InspectorFrontend::resourceTrackingWasEnabled()
 {
     callSimpleFunction("resourceTrackingWasEnabled");
@@ -204,6 +252,25 @@ void InspectorFrontend::resourceTrackingWasDisabled()
     callSimpleFunction("resourceTrackingWasDisabled");
 }
 
+
+void InspectorFrontend::searchingForNodeWasEnabled()
+{
+    callSimpleFunction("searchingForNodeWasEnabled");
+}
+
+void InspectorFrontend::searchingForNodeWasDisabled()
+{
+    callSimpleFunction("searchingForNodeWasDisabled");
+}
+
+void InspectorFrontend::updatePauseOnExceptionsState(long state)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("updatePauseOnExceptionsState");
+    function.appendArgument(state);
+    function.call();
+}
+
 void InspectorFrontend::timelineProfilerWasStarted()
 {
     callSimpleFunction("timelineProfilerWasStarted");
@@ -216,9 +283,10 @@ void InspectorFrontend::timelineProfilerWasStopped()
 
 void InspectorFrontend::addRecordToTimeline(const ScriptObject& record)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addRecordToTimeline"));
-    function->appendArgument(record);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("addRecordToTimeline");
+    function.appendArgument(record);
+    function.call();
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -237,284 +305,453 @@ void InspectorFrontend::debuggerWasDisabled()
     callSimpleFunction("debuggerWasDisabled");
 }
 
-void InspectorFrontend::profilerWasEnabled()
+void InspectorFrontend::parsedScriptSource(const String& sourceID, const String& url, const String& data, int firstLine)
 {
-    callSimpleFunction("profilerWasEnabled");
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("parsedScriptSource");
+    function.appendArgument(sourceID);
+    function.appendArgument(url);
+    function.appendArgument(data);
+    function.appendArgument(firstLine);
+    function.call();
 }
 
-void InspectorFrontend::profilerWasDisabled()
+void InspectorFrontend::restoredBreakpoint(const String& sourceID, const String& url, int line, bool enabled, const String& condition)
 {
-    callSimpleFunction("profilerWasDisabled");
+    ScriptFunctionCall function(m_webInspector, "dispatch");
+    function.appendArgument("restoredBreakpoint");
+    function.appendArgument(sourceID);
+    function.appendArgument(url);
+    function.appendArgument(line);
+    function.appendArgument(enabled);
+    function.appendArgument(condition);
+    function.call();
 }
 
-void InspectorFrontend::parsedScriptSource(const JSC::SourceCode& source)
+void InspectorFrontend::failedToParseScriptSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("parsedScriptSource"));
-    function->appendArgument(JSC::UString(JSC::UString::from(source.provider()->asID())));
-    function->appendArgument(source.provider()->url());
-    function->appendArgument(JSC::UString(source.data(), source.length()));
-    function->appendArgument(source.firstLine());
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("failedToParseScriptSource");
+    function.appendArgument(url);
+    function.appendArgument(data);
+    function.appendArgument(firstLine);
+    function.appendArgument(errorLine);
+    function.appendArgument(errorMessage);
+    function.call();
 }
 
-void InspectorFrontend::failedToParseScriptSource(const JSC::SourceCode& source, int errorLine, const JSC::UString& errorMessage)
+void InspectorFrontend::pausedScript(SerializedScriptValue* callFrames)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("failedToParseScriptSource"));
-    function->appendArgument(source.provider()->url());
-    function->appendArgument(JSC::UString(source.data(), source.length()));
-    function->appendArgument(source.firstLine());
-    function->appendArgument(errorLine);
-    function->appendArgument(errorMessage);
-    function->call();
+    ScriptValue callFramesValue = ScriptValue::deserialize(scriptState(), callFrames);
+    ScriptFunctionCall function(m_webInspector, "dispatch");
+    function.appendArgument("pausedScript");
+    function.appendArgument(callFramesValue);
+    function.call();
 }
 
-void InspectorFrontend::addProfileHeader(const ScriptValue& profile)
+void InspectorFrontend::resumedScript()
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addProfileHeader"));
-    function->appendArgument(profile);
-    function->call();
+    callSimpleFunction("resumedScript");
 }
 
-void InspectorFrontend::setRecordingProfile(bool isProfiling)
+void InspectorFrontend::profilerWasEnabled()
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setRecordingProfile"));
-    function->appendArgument(isProfiling);
-    function->call();
+    callSimpleFunction("profilerWasEnabled");
 }
 
-void InspectorFrontend::didGetProfileHeaders(int callId, const ScriptArray& headers)
+void InspectorFrontend::profilerWasDisabled()
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetProfileHeaders"));
-    function->appendArgument(callId);
-    function->appendArgument(headers);
-    function->call();
+    callSimpleFunction("profilerWasDisabled");
 }
 
-void InspectorFrontend::didGetProfile(int callId, const ScriptValue& profile)
+void InspectorFrontend::addProfileHeader(const ScriptValue& profile)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetProfile"));
-    function->appendArgument(callId);
-    function->appendArgument(profile);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("addProfileHeader");
+    function.appendArgument(profile);
+    function.call();
 }
 
-void InspectorFrontend::pausedScript(const ScriptValue& callFrames)
+void InspectorFrontend::setRecordingProfile(bool isProfiling)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("pausedScript"));
-    function->appendArgument(callFrames);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("setRecordingProfile");
+    function.appendArgument(isProfiling);
+    function.call();
 }
 
-void InspectorFrontend::resumedScript()
+void InspectorFrontend::didGetProfileHeaders(int callId, const ScriptArray& headers)
 {
-    callSimpleFunction("resumedScript");
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didGetProfileHeaders");
+    function.appendArgument(callId);
+    function.appendArgument(headers);
+    function.call();
+}
+
+void InspectorFrontend::didGetProfile(int callId, const ScriptValue& profile)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didGetProfile");
+    function.appendArgument(callId);
+    function.appendArgument(profile);
+    function.call();
 }
 #endif
 
 void InspectorFrontend::setDocument(const ScriptObject& root)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setDocument"));
-    function->appendArgument(root);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("setDocument");
+    function.appendArgument(root);
+    function.call();
 }
 
 void InspectorFrontend::setDetachedRoot(const ScriptObject& root)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setDetachedRoot"));
-    function->appendArgument(root);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("setDetachedRoot");
+    function.appendArgument(root);
+    function.call();
 }
 
 void InspectorFrontend::setChildNodes(int parentId, const ScriptArray& nodes)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setChildNodes"));
-    function->appendArgument(parentId);
-    function->appendArgument(nodes);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("setChildNodes");
+    function.appendArgument(parentId);
+    function.appendArgument(nodes);
+    function.call();
 }
 
 void InspectorFrontend::childNodeCountUpdated(int id, int newValue)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("childNodeCountUpdated"));
-    function->appendArgument(id);
-    function->appendArgument(newValue);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("childNodeCountUpdated");
+    function.appendArgument(id);
+    function.appendArgument(newValue);
+    function.call();
 }
 
 void InspectorFrontend::childNodeInserted(int parentId, int prevId, const ScriptObject& node)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("childNodeInserted"));
-    function->appendArgument(parentId);
-    function->appendArgument(prevId);
-    function->appendArgument(node);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("childNodeInserted");
+    function.appendArgument(parentId);
+    function.appendArgument(prevId);
+    function.appendArgument(node);
+    function.call();
 }
 
 void InspectorFrontend::childNodeRemoved(int parentId, int id)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("childNodeRemoved"));
-    function->appendArgument(parentId);
-    function->appendArgument(id);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("childNodeRemoved");
+    function.appendArgument(parentId);
+    function.appendArgument(id);
+    function.call();
 }
 
 void InspectorFrontend::attributesUpdated(int id, const ScriptArray& attributes)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("attributesUpdated"));
-    function->appendArgument(id);
-    function->appendArgument(attributes);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("attributesUpdated");
+    function.appendArgument(id);
+    function.appendArgument(attributes);
+    function.call();
 }
 
 void InspectorFrontend::didRemoveNode(int callId, int nodeId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didRemoveNode"));
-    function->appendArgument(callId);
-    function->appendArgument(nodeId);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didRemoveNode");
+    function.appendArgument(callId);
+    function.appendArgument(nodeId);
+    function.call();
 }
 
 void InspectorFrontend::didGetChildNodes(int callId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetChildNodes"));
-    function->appendArgument(callId);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didGetChildNodes");
+    function.appendArgument(callId);
+    function.call();
 }
 
 void InspectorFrontend::didApplyDomChange(int callId, bool success)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didApplyDomChange"));
-    function->appendArgument(callId);
-    function->appendArgument(success);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didApplyDomChange");
+    function.appendArgument(callId);
+    function.appendArgument(success);
+    function.call();
+}
+
+void InspectorFrontend::didGetEventListenersForNode(int callId, int nodeId, const ScriptArray& listenersArray)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didGetEventListenersForNode");
+    function.appendArgument(callId);
+    function.appendArgument(nodeId);
+    function.appendArgument(listenersArray);
+    function.call();
+}
+
+void InspectorFrontend::didGetStyles(long callId, const ScriptValue& styles)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didGetStyles");
+    function.appendArgument(callId);
+    function.appendArgument(styles);
+    function.call();
 }
 
-void InspectorFrontend::didGetEventListenersForNode(int callId, int nodeId, ScriptArray& listenersArray)
+void InspectorFrontend::didGetAllStyles(long callId, const ScriptArray& styles)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetEventListenersForNode"));
-    function->appendArgument(callId);
-    function->appendArgument(nodeId);
-    function->appendArgument(listenersArray);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch");
+    function.appendArgument("didGetAllStyles");
+    function.appendArgument(callId);
+    function.appendArgument(styles);
+    function.call();
 }
 
+void InspectorFrontend::didGetComputedStyle(long callId, const ScriptValue& style)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didGetComputedStyle");
+    function.appendArgument(callId);
+    function.appendArgument(style);
+    function.call();
+}
+
+void InspectorFrontend::didGetInlineStyle(long callId, const ScriptValue& style)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didGetInlineStyle");
+    function.appendArgument(callId);
+    function.appendArgument(style);
+    function.call();
+}
+
+void InspectorFrontend::didApplyStyleText(int callId, bool success, const ScriptValue& style, const ScriptArray& changedProperties)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didApplyStyleText");
+    function.appendArgument(callId);
+    function.appendArgument(success);
+    function.appendArgument(style);
+    function.appendArgument(changedProperties);
+    function.call();
+}
+
+void InspectorFrontend::didSetStyleText(int callId, bool success)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didSetStyleText");
+    function.appendArgument(callId);
+    function.appendArgument(success);
+    function.call();
+}
+
+void InspectorFrontend::didSetStyleProperty(int callId, bool success)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didSetStyleProperty");
+    function.appendArgument(callId);
+    function.appendArgument(success);
+    function.call();
+}
+
+void InspectorFrontend::didToggleStyleEnabled(int callId, const ScriptValue& style)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didToggleStyleEnabled");
+    function.appendArgument(callId);
+    function.appendArgument(style);
+    function.call();
+}
+
+void InspectorFrontend::didSetRuleSelector(int callId, const ScriptValue& rule, bool selectorAffectsNode)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didSetRuleSelector");
+    function.appendArgument(callId);
+    function.appendArgument(rule);
+    function.appendArgument(selectorAffectsNode);
+    function.call();
+}
+
+void InspectorFrontend::didAddRule(int callId, const ScriptValue& rule, bool selectorAffectsNode)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didAddRule");
+    function.appendArgument(callId);
+    function.appendArgument(rule);
+    function.appendArgument(selectorAffectsNode);
+    function.call();
+}
+
+#if ENABLE(WORKERS)
+void InspectorFrontend::didCreateWorker(const InspectorWorkerResource& worker)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch");
+    function.appendArgument("didCreateWorker");
+    function.appendArgument(worker.id());
+    function.appendArgument(worker.url());
+    function.appendArgument(worker.isSharedWorker());
+    function.call();
+}
+
+void InspectorFrontend::didDestroyWorker(const InspectorWorkerResource& worker)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didDestroyWorker");
+    function.appendArgument(worker.id());
+    function.call();
+}
+#endif // ENABLE(WORKERS)
+
 void InspectorFrontend::didGetCookies(int callId, const ScriptArray& cookies, const String& cookiesString)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetCookies"));
-    function->appendArgument(callId);
-    function->appendArgument(cookies);
-    function->appendArgument(cookiesString);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didGetCookies");
+    function.appendArgument(callId);
+    function.appendArgument(cookies);
+    function.appendArgument(cookiesString);
+    function.call();
 }
 
-void InspectorFrontend::didDispatchOnInjectedScript(int callId, const String& result, bool isException)
+void InspectorFrontend::didDispatchOnInjectedScript(int callId, SerializedScriptValue* result, bool isException)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didDispatchOnInjectedScript"));
-    function->appendArgument(callId);
-    function->appendArgument(result);
-    function->appendArgument(isException);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didDispatchOnInjectedScript");
+    function.appendArgument(callId);
+    if (isException)
+        function.appendArgument("");
+    else {
+        ScriptValue resultValue = ScriptValue::deserialize(scriptState(), result);
+        function.appendArgument(resultValue);
+    }
+    function.appendArgument(isException);
+    function.call();
 }
 
 #if ENABLE(DATABASE)
 bool InspectorFrontend::addDatabase(const ScriptObject& dbObject)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDatabase"));
-    function->appendArgument(dbObject);
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("addDatabase");
+    function.appendArgument(dbObject);
     bool hadException = false;
-    function->call(hadException);
+    function.call(hadException);
     return !hadException;
 }
 
 void InspectorFrontend::selectDatabase(int databaseId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDatabase"));
-    function->appendArgument(databaseId);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("selectDatabase");
+    function.appendArgument(databaseId);
+    function.call();
 }
 void InspectorFrontend::didGetDatabaseTableNames(int callId, const ScriptArray& tableNames)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetDatabaseTableNames"));
-    function->appendArgument(callId);
-    function->appendArgument(tableNames);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didGetDatabaseTableNames");
+    function.appendArgument(callId);
+    function.appendArgument(tableNames);
+    function.call();
 }
 #endif
 
 #if ENABLE(DOM_STORAGE)
 bool InspectorFrontend::addDOMStorage(const ScriptObject& domStorageObj)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDOMStorage"));
-    function->appendArgument(domStorageObj);
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("addDOMStorage");
+    function.appendArgument(domStorageObj);
     bool hadException = false;
-    function->call(hadException);
+    function.call(hadException);
     return !hadException;
 }
 
 void InspectorFrontend::selectDOMStorage(int storageId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDOMStorage"));
-    function->appendArgument(storageId);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("selectDOMStorage");
+    function.appendArgument(storageId);
+    function.call();
 }
 
 void InspectorFrontend::didGetDOMStorageEntries(int callId, const ScriptArray& entries)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetDOMStorageEntries"));
-    function->appendArgument(callId);
-    function->appendArgument(entries);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didGetDOMStorageEntries");
+    function.appendArgument(callId);
+    function.appendArgument(entries);
+    function.call();
 }
 
 void InspectorFrontend::didSetDOMStorageItem(int callId, bool success)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didSetDOMStorageItem"));
-    function->appendArgument(callId);
-    function->appendArgument(success);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didSetDOMStorageItem");
+    function.appendArgument(callId);
+    function.appendArgument(success);
+    function.call();
 }
 
 void InspectorFrontend::didRemoveDOMStorageItem(int callId, bool success)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didRemoveDOMStorageItem"));
-    function->appendArgument(callId);
-    function->appendArgument(success);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("didRemoveDOMStorageItem");
+    function.appendArgument(callId);
+    function.appendArgument(success);
+    function.call();
 }
 
 void InspectorFrontend::updateDOMStorage(int storageId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateDOMStorage"));
-    function->appendArgument(storageId);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("updateDOMStorage");
+    function.appendArgument(storageId);
+    function.call();
 }
 #endif
 
 void InspectorFrontend::addNodesToSearchResult(const String& nodeIds)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addNodesToSearchResult"));
-    function->appendArgument(nodeIds);
-    function->call();
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("addNodesToSearchResult");
+    function.appendArgument(nodeIds);
+    function.call();
 }
 
-void InspectorFrontend::evaluateForTestInFrontend(int callId, const String& script)
+void InspectorFrontend::contextMenuItemSelected(int itemId)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch");
+    function.appendArgument("contextMenuItemSelected");
+    function.appendArgument(itemId);
+    function.call();
+}
+
+void InspectorFrontend::contextMenuCleared()
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("evaluateForTestInFrontend"));
-    function->appendArgument(callId);
-    function->appendArgument(script);
-    function->call();
+    callSimpleFunction("contextMenuCleared");
 }
 
-PassOwnPtr<ScriptFunctionCall> InspectorFrontend::newFunctionCall(const String& functionName)
+void InspectorFrontend::evaluateForTestInFrontend(int callId, const String& script)
 {
-    ScriptFunctionCall* function = new ScriptFunctionCall(m_scriptState, m_webInspector, "dispatch");
-    function->appendArgument(functionName);
-    return function;
+    ScriptFunctionCall function(m_webInspector, "dispatch"); 
+    function.appendArgument("evaluateForTestInFrontend");
+    function.appendArgument(callId);
+    function.appendArgument(script);
+    function.call();
 }
 
 void InspectorFrontend::callSimpleFunction(const String& functionName)
 {
-    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch");
+    ScriptFunctionCall function(m_webInspector, "dispatch");
     function.appendArgument(functionName);
     function.call();
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
index 3cb9b8c79c..18e4dc82de 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
@@ -35,67 +35,75 @@
 #include "ScriptState.h"
 #include <wtf/PassOwnPtr.h>
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-namespace JSC {
-    class JSValue;
-    class SourceCode;
-    class UString;
-}
-#endif
-
 namespace WebCore {
     class ConsoleMessage;
     class Database;
     class Frame;
-    class InspectorController;
     class InspectorResource;
     class Node;
-    class ScriptFunctionCall;
     class ScriptString;
+    class SerializedScriptValue;
     class Storage;
+    class InspectorWorkerResource;
 
-    class InspectorFrontend {
+    class InspectorFrontend : public Noncopyable {
     public:
-        InspectorFrontend(InspectorController* inspectorController, ScriptState*, ScriptObject webInspector);
+        InspectorFrontend(ScriptObject webInspector);
         ~InspectorFrontend();
+        
+        void close();
+        void inspectedPageDestroyed();
 
         ScriptArray newScriptArray();
         ScriptObject newScriptObject();
 
         void didCommitLoad();
-        void addConsoleMessage(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message);
-        void updateConsoleMessageRepeatCount(const int count);
-        void clearConsoleMessages();
 
-        bool addResource(long long identifier, const ScriptObject& resourceObj);
-        bool updateResource(long long identifier, const ScriptObject& resourceObj);
-        void removeResource(long long identifier);
+        void populateFrontendSettings(const String& settings);
 
-        void addCookieDomain(String);
+        void updateConsoleMessageExpiredCount(unsigned count);
+        void addConsoleMessage(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<RefPtr<SerializedScriptValue> >& arguments, const String& message);
+        void updateConsoleMessageRepeatCount(unsigned count);
+        void clearConsoleMessages();
+
+        bool updateResource(unsigned long identifier, const ScriptObject& resourceObj);
+        void removeResource(unsigned long identifier);
+        void didGetResourceContent(int callId, const String& content);
 
-        void updateFocusedNode(long long nodeId);
+        void updateFocusedNode(long nodeId);
         void setAttachedWindow(bool attached);
         void showPanel(int panel);
         void populateInterface();
         void reset();
+        
+        void bringToFront();
+        void inspectedURLChanged(const String&);
 
         void resourceTrackingWasEnabled();
         void resourceTrackingWasDisabled();
 
+        void searchingForNodeWasEnabled();
+        void searchingForNodeWasDisabled();
+
+        void updatePauseOnExceptionsState(long state);
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
         void attachDebuggerWhenShown();
         void debuggerWasEnabled();
         void debuggerWasDisabled();
+
+        void parsedScriptSource(const String& sourceID, const String& url, const String& data, int firstLine);
+        void restoredBreakpoint(const String& sourceID, const String& url, int line, bool enabled, const String& condition);
+        void failedToParseScriptSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage);
+        void pausedScript(SerializedScriptValue* callFrames);
+        void resumedScript();
+
         void profilerWasEnabled();
         void profilerWasDisabled();
-        void parsedScriptSource(const JSC::SourceCode&);
-        void failedToParseScriptSource(const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
         void addProfileHeader(const ScriptValue& profile);
         void setRecordingProfile(bool isProfiling);
         void didGetProfileHeaders(int callId, const ScriptArray& headers);
         void didGetProfile(int callId, const ScriptValue& profile);
-        void pausedScript(const ScriptValue& callFrames);
-        void resumedScript();
 #endif
 
 #if ENABLE(DATABASE)
@@ -122,26 +130,42 @@ namespace WebCore {
         void attributesUpdated(int id, const ScriptArray& attributes);
         void didGetChildNodes(int callId);
         void didApplyDomChange(int callId, bool success);
-        void didGetEventListenersForNode(int callId, int nodeId, ScriptArray& listenersArray);
+        void didGetEventListenersForNode(int callId, int nodeId, const ScriptArray& listenersArray);
         void didRemoveNode(int callId, int nodeId);
 
+        void didGetStyles(long callId, const ScriptValue& styles);
+        void didGetAllStyles(long callId, const ScriptArray& styles);
+        void didGetInlineStyle(long callId, const ScriptValue& style);
+        void didGetComputedStyle(long callId, const ScriptValue& style);
+        void didApplyStyleText(int callId, bool success, const ScriptValue& style, const ScriptArray& changedProperties);
+        void didSetStyleText(int callId, bool success);
+        void didSetStyleProperty(int callId, bool success);
+        void didToggleStyleEnabled(int callId, const ScriptValue& style);
+        void didSetRuleSelector(int callId, const ScriptValue& rule, bool selectorAffectsNode);
+        void didAddRule(int callId, const ScriptValue& rule, bool selectorAffectsNode);
+
         void timelineProfilerWasStarted();
         void timelineProfilerWasStopped();
         void addRecordToTimeline(const ScriptObject&);
 
+#if ENABLE(WORKERS)
+        void didCreateWorker(const InspectorWorkerResource&);
+        void didDestroyWorker(const InspectorWorkerResource&);
+#endif // ENABLE(WORKER)
+
         void didGetCookies(int callId, const ScriptArray& cookies, const String& cookiesString);
-        void didDispatchOnInjectedScript(int callId, const String& result, bool isException);
+        void didDispatchOnInjectedScript(int callId, SerializedScriptValue* result, bool isException);
 
         void addNodesToSearchResult(const String& nodeIds);
 
-        ScriptState* scriptState() const { return m_scriptState; }
+        void contextMenuItemSelected(int itemId);
+        void contextMenuCleared();
+
+        ScriptState* scriptState() const { return m_webInspector.scriptState(); }
 
         void evaluateForTestInFrontend(int callId, const String& script);
     private:
-        PassOwnPtr<ScriptFunctionCall> newFunctionCall(const String& functionName);
         void callSimpleFunction(const String& functionName);
-        InspectorController* m_inspectorController;
-        ScriptState* m_scriptState;
         ScriptObject m_webInspector;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendClient.h b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendClient.h
new file mode 100644
index 0000000000..058346b2b1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendClient.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorFrontendClient_h
+#define InspectorFrontendClient_h
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class ContextMenuItem;
+class Event;
+class String;
+
+class InspectorFrontendClient {
+public:
+    virtual ~InspectorFrontendClient() { }
+
+    virtual void windowObjectCleared() = 0;
+    virtual void frontendLoaded() = 0;
+
+    virtual void moveWindowBy(float x, float y) = 0;
+
+    virtual String localizedStringsURL() = 0;
+    virtual String hiddenPanels() = 0;
+
+    virtual void bringToFront() = 0;
+    virtual void closeWindow() = 0;
+
+    virtual bool canAttachWindow() = 0;
+    virtual void attachWindow() = 0;
+    virtual void detachWindow() = 0;
+    virtual void changeAttachedWindowHeight(unsigned) = 0;
+    
+    virtual void inspectedURLChanged(const String&) = 0;
+
+    virtual void showContextMenu(Event*, const Vector<ContextMenuItem*>&) = 0;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendClientLocal.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendClientLocal.cpp
new file mode 100644
index 0000000000..1888fbd078
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendClientLocal.cpp
@@ -0,0 +1,235 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorFrontendClientLocal.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "Chrome.h"
+#include "ContextMenu.h"
+#include "ContextMenuController.h"
+#include "ContextMenuItem.h"
+#include "ContextMenuProvider.h"
+#include "FloatRect.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "InspectorController.h"
+#include "InspectorFrontend.h"
+#include "InspectorFrontendHost.h"
+#include "Page.h"
+#include "PlatformString.h"
+#include "ScriptFunctionCall.h"
+#include "ScriptObject.h"
+
+namespace WebCore {
+
+class FrontendMenuProvider : public ContextMenuProvider {
+public:
+    static PassRefPtr<FrontendMenuProvider> create(InspectorFrontendClientLocal* frontendClient, ScriptObject webInspector, const Vector<ContextMenuItem*>& items)
+    {
+        return adoptRef(new FrontendMenuProvider(frontendClient, webInspector, items));
+    }
+    
+    void disconnect()
+    {
+        m_webInspector = ScriptObject();
+        m_frontendClient = 0;
+    }
+    
+private:
+    FrontendMenuProvider(InspectorFrontendClientLocal* frontendClient, ScriptObject webInspector,  const Vector<ContextMenuItem*>& items)
+        : m_frontendClient(frontendClient)
+        , m_webInspector(webInspector)
+        , m_items(items)
+    {
+    }
+
+    virtual ~FrontendMenuProvider()
+    {
+        contextMenuCleared();
+    }
+    
+    virtual void populateContextMenu(ContextMenu* menu)
+    {
+        for (size_t i = 0; i < m_items.size(); ++i)
+            menu->appendItem(*m_items[i]);
+    }
+    
+    virtual void contextMenuItemSelected(ContextMenuItem* item)
+    {
+        int itemNumber = item->action() - ContextMenuItemBaseCustomTag;
+
+        ScriptFunctionCall function(m_webInspector, "dispatch");
+        function.appendArgument("contextMenuItemSelected");
+        function.appendArgument(itemNumber);
+        function.call();
+    }
+    
+    virtual void contextMenuCleared()
+    {
+
+        if (m_frontendClient) {
+            ScriptFunctionCall function(m_webInspector, "dispatch");
+            function.appendArgument("contextMenuCleared");
+            function.call();
+
+            m_frontendClient->m_menuProvider = 0;
+        }
+        deleteAllValues(m_items);
+        m_items.clear();
+    }
+
+    InspectorFrontendClientLocal* m_frontendClient;
+    ScriptObject m_webInspector;
+    Vector<ContextMenuItem*> m_items;
+};
+
+static const char* const inspectorAttachedHeightName = "inspectorAttachedHeight";
+static const unsigned defaultAttachedHeight = 300;
+static const float minimumAttachedHeight = 250.0f;
+static const float maximumAttachedHeightRatio = 0.75f;
+
+InspectorFrontendClientLocal::InspectorFrontendClientLocal(InspectorController* inspectorController, Page* frontendPage)
+    : m_inspectorController(inspectorController)
+    , m_frontendPage(frontendPage)
+    , m_frontendScriptState(0)
+    , m_menuProvider(0)
+{
+}
+
+InspectorFrontendClientLocal::~InspectorFrontendClientLocal()
+{
+    if (m_frontendHost)
+        m_frontendHost->disconnectClient();
+    if (m_menuProvider)
+        m_menuProvider->disconnect();
+    m_frontendScriptState = 0;
+    m_frontendPage = 0;
+    m_inspectorController = 0;
+}
+    
+void InspectorFrontendClientLocal::windowObjectCleared()
+{
+    // Grant the inspector the ability to script the inspected page.
+    m_frontendPage->mainFrame()->document()->securityOrigin()->grantUniversalAccess();
+    // FIXME: don't keep reference to the script state
+    m_frontendScriptState = scriptStateFromPage(debuggerWorld(), m_frontendPage);
+    ScriptGlobalObject::set(m_frontendScriptState, "InspectorBackend", m_inspectorController->inspectorBackend());
+    m_frontendHost = InspectorFrontendHost::create(this);
+    ScriptGlobalObject::set(m_frontendScriptState, "InspectorFrontendHost", m_frontendHost.get());
+}
+
+void InspectorFrontendClientLocal::frontendLoaded()
+{
+    bringToFront();
+    // Create InspectorFrontend and set it to InspectorController.
+    ASSERT(m_frontendScriptState);
+    ScriptObject webInspectorObj;
+    if (!ScriptGlobalObject::get(m_frontendScriptState, "WebInspector", webInspectorObj)) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    m_inspectorController->setFrontend(new InspectorFrontend(webInspectorObj));
+}
+
+bool InspectorFrontendClientLocal::canAttachWindow()
+{
+    unsigned inspectedPageHeight = m_inspectorController->inspectedPage()->mainFrame()->view()->visibleHeight();
+
+    // Don't allow the attach if the window would be too small to accommodate the minimum inspector height.
+    return minimumAttachedHeight <= inspectedPageHeight * maximumAttachedHeightRatio;
+}
+
+void InspectorFrontendClientLocal::changeAttachedWindowHeight(unsigned height)
+{
+    unsigned totalHeight = m_frontendPage->mainFrame()->view()->visibleHeight() + m_inspectorController->inspectedPage()->mainFrame()->view()->visibleHeight();
+    unsigned attachedHeight = constrainedAttachedWindowHeight(height, totalHeight);
+    m_inspectorController->setSetting(inspectorAttachedHeightName, String::number(attachedHeight));
+    setAttachedWindowHeight(attachedHeight);
+}
+
+void InspectorFrontendClientLocal::moveWindowBy(float x, float y)
+{
+    FloatRect frameRect = m_frontendPage->chrome()->windowRect();
+    frameRect.move(x, y);
+    m_frontendPage->chrome()->setWindowRect(frameRect);
+}
+
+void InspectorFrontendClientLocal::showContextMenu(Event* event, const Vector<ContextMenuItem*>& items)
+{
+    ScriptObject webInspectorObj;
+    if (!ScriptGlobalObject::get(m_frontendScriptState, "WebInspector", webInspectorObj)) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    
+    RefPtr<FrontendMenuProvider> menuProvider = FrontendMenuProvider::create(this, webInspectorObj, items);
+    ContextMenuController* menuController = m_frontendPage->contextMenuController();
+    menuController->showContextMenu(event, menuProvider);
+    m_menuProvider = menuProvider.get();
+}
+
+void InspectorFrontendClientLocal::setAttachedWindow(bool attached)
+{
+    ScriptObject webInspectorObj;
+    if (!ScriptGlobalObject::get(m_frontendScriptState, "WebInspector", webInspectorObj)) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    ScriptFunctionCall function(webInspectorObj, "dispatch"); 
+    function.appendArgument("setAttachedWindow");
+    function.appendArgument(attached);
+    function.call();
+}
+
+void InspectorFrontendClientLocal::restoreAttachedWindowHeight()
+{
+    unsigned inspectedPageHeight = m_inspectorController->inspectedPage()->mainFrame()->view()->visibleHeight();
+    String attachedHeight = m_inspectorController->setting(inspectorAttachedHeightName);
+    bool success = true;
+    int height = attachedHeight.toInt(&success);
+    unsigned preferredHeight = success ? height : defaultAttachedHeight;
+    
+    // This call might not go through (if the window starts out detached), but if the window is initially created attached,
+    // InspectorController::attachWindow is never called, so we need to make sure to set the attachedWindowHeight.
+    // FIXME: Clean up code so we only have to call setAttachedWindowHeight in InspectorController::attachWindow
+    setAttachedWindowHeight(constrainedAttachedWindowHeight(preferredHeight, inspectedPageHeight));
+}
+
+unsigned InspectorFrontendClientLocal::constrainedAttachedWindowHeight(unsigned preferredHeight, unsigned totalWindowHeight)
+{
+    using namespace std;
+    return roundf(max(minimumAttachedHeight, min<float>(preferredHeight, totalWindowHeight * maximumAttachedHeightRatio)));
+}
+    
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendClientLocal.h b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendClientLocal.h
new file mode 100644
index 0000000000..918c47901e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendClientLocal.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorFrontendClientLocal_h
+#define InspectorFrontendClientLocal_h
+
+#include "InspectorFrontendClient.h"
+#include "ScriptState.h"
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class FrontendMenuProvider;
+class InspectorController;
+class InspectorFrontendHost;
+class Page;
+
+class InspectorFrontendClientLocal : public InspectorFrontendClient, public Noncopyable {
+public:
+    InspectorFrontendClientLocal(InspectorController*, Page*);
+    virtual ~InspectorFrontendClientLocal();
+    
+    virtual void windowObjectCleared();
+    virtual void frontendLoaded();
+
+    virtual void moveWindowBy(float x, float y);
+
+    virtual bool canAttachWindow();
+    virtual void changeAttachedWindowHeight(unsigned);
+
+    virtual void showContextMenu(Event*, const Vector<ContextMenuItem*>&);
+    
+protected:
+    virtual void setAttachedWindowHeight(unsigned) = 0;
+
+    void setAttachedWindow(bool);
+    void restoreAttachedWindowHeight();
+
+private:
+    static unsigned constrainedAttachedWindowHeight(unsigned preferredHeight, unsigned totalWindowHeight);
+
+    friend class FrontendMenuProvider;
+    InspectorController* m_inspectorController;
+    Page* m_frontendPage;
+    ScriptState* m_frontendScriptState;
+    // TODO(yurys): this ref shouldn't be needed.
+    RefPtr<InspectorFrontendHost> m_frontendHost;
+    FrontendMenuProvider* m_menuProvider;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendHost.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendHost.cpp
new file mode 100644
index 0000000000..23be44c2c1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendHost.cpp
@@ -0,0 +1,178 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorFrontendHost.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "ContextMenu.h"
+#include "ContextMenuItem.h"
+#include "ContextMenuController.h"
+#include "ContextMenuProvider.h"
+#include "Element.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "HitTestResult.h"
+#include "HTMLFrameOwnerElement.h"
+#include "InspectorFrontendClient.h"
+#include "InspectorResource.h"
+#include "Page.h"
+#include "Pasteboard.h"
+
+#include <wtf/RefPtr.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace std;
+
+namespace WebCore {
+
+InspectorFrontendHost::InspectorFrontendHost(InspectorFrontendClient* client)
+    : m_client(client)
+{
+}
+
+InspectorFrontendHost::~InspectorFrontendHost()
+{
+    ASSERT(!m_client);
+}
+
+void InspectorFrontendHost::disconnectClient()
+{
+    m_client = 0;
+}
+
+void InspectorFrontendHost::loaded()
+{
+    if (m_client)
+        m_client->frontendLoaded();
+}
+
+void InspectorFrontendHost::attach()
+{
+    if (m_client)
+        m_client->attachWindow();
+}
+
+void InspectorFrontendHost::detach()
+{
+    if (m_client)
+        m_client->detachWindow();
+}
+
+void InspectorFrontendHost::closeWindow()
+{
+    if (m_client) {
+        m_client->closeWindow();
+        disconnectClient(); // Disconnect from client.
+    }
+}
+
+void InspectorFrontendHost::bringToFront()
+{
+    if (m_client)
+        m_client->bringToFront();
+}
+
+void InspectorFrontendHost::inspectedURLChanged(const String& newURL)
+{
+    if (m_client)
+        m_client->inspectedURLChanged(newURL);
+}
+
+bool InspectorFrontendHost::canAttachWindow() const
+{
+    return m_client && m_client->canAttachWindow();
+}
+
+void InspectorFrontendHost::setAttachedWindowHeight(unsigned height)
+{
+    if (m_client)
+        m_client->changeAttachedWindowHeight(height);
+}
+
+void InspectorFrontendHost::moveWindowBy(float x, float y) const
+{
+    if (m_client)
+        m_client->moveWindowBy(x, y);
+}
+
+String InspectorFrontendHost::localizedStringsURL()
+{
+    return m_client->localizedStringsURL();
+}
+
+String InspectorFrontendHost::hiddenPanels()
+{
+    return m_client->hiddenPanels();
+}
+
+const String& InspectorFrontendHost::platform() const
+{
+#if PLATFORM(MAC)
+    DEFINE_STATIC_LOCAL(const String, platform, ("mac"));
+#elif OS(WINDOWS)
+    DEFINE_STATIC_LOCAL(const String, platform, ("windows"));
+#elif OS(LINUX)
+    DEFINE_STATIC_LOCAL(const String, platform, ("linux"));
+#else
+    DEFINE_STATIC_LOCAL(const String, platform, ("unknown"));
+#endif
+    return platform;
+}
+
+const String& InspectorFrontendHost::port() const
+{
+#if PLATFORM(QT)
+    DEFINE_STATIC_LOCAL(const String, port, ("qt"));
+#elif PLATFORM(GTK)
+    DEFINE_STATIC_LOCAL(const String, port, ("gtk"));
+#elif PLATFORM(WX)
+    DEFINE_STATIC_LOCAL(const String, port, ("wx"));
+#else
+    DEFINE_STATIC_LOCAL(const String, port, ("unknown"));
+#endif
+
+    return port;
+}
+
+void InspectorFrontendHost::copyText(const String& text)
+{
+    Pasteboard::generalPasteboard()->writePlainText(text);
+}
+
+void InspectorFrontendHost::showContextMenu(Event* event, const Vector<ContextMenuItem*>& items)
+{
+    if (m_client)
+        m_client->showContextMenu(event, items);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendHost.h b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendHost.h
new file mode 100644
index 0000000000..f5ba9d7f7d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendHost.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorFrontendHost_h
+#define InspectorFrontendHost_h
+
+#include "Console.h"
+#include "ContextMenu.h"
+#include "ContextMenuProvider.h"
+#include "InspectorController.h"
+#include "PlatformString.h"
+
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class ContextMenuItem;
+class Event;
+class InspectorClient;
+class InspectorFrontendClient;
+class Node;
+
+class InspectorFrontendHost : public RefCounted<InspectorFrontendHost>
+{
+public:
+    static PassRefPtr<InspectorFrontendHost> create(InspectorFrontendClient* client)
+    {
+        return adoptRef(new InspectorFrontendHost(client));
+    }
+
+    ~InspectorFrontendHost();
+    void disconnectClient();
+
+    void loaded();
+    void attach();
+    void detach();
+    void closeWindow();
+    void bringToFront();
+    void inspectedURLChanged(const String&);
+
+    bool canAttachWindow() const;
+    void setAttachedWindowHeight(unsigned height);
+    void moveWindowBy(float x, float y) const;
+
+    String localizedStringsURL();
+    String hiddenPanels();
+    const String& platform() const;
+    const String& port() const;
+
+    void copyText(const String& text);
+
+    // Called from [Custom] implementations.
+    void showContextMenu(Event*, const Vector<ContextMenuItem*>& items);
+
+private:
+    InspectorFrontendHost(InspectorFrontendClient* client);
+
+    InspectorFrontendClient* m_client;
+};
+
+} // namespace WebCore
+
+#endif // !defined(InspectorFrontendHost_h)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendHost.idl b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendHost.idl
new file mode 100644
index 0000000000..0aef5c43c5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontendHost.idl
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [Conditional=INSPECTOR] InspectorFrontendHost {
+        void loaded();
+        void attach();
+        void detach();
+        void closeWindow();
+        void bringToFront();
+        void inspectedURLChanged(in DOMString newURL);
+
+        boolean canAttachWindow();
+        void setAttachedWindowHeight(in unsigned long height);
+        void moveWindowBy(in float x, in float y);
+
+        DOMString localizedStringsURL();
+        DOMString hiddenPanels();
+        DOMString platform();
+        DOMString port();
+
+        void copyText(in DOMString text);
+
+        [Custom] void showContextMenu(in MouseEvent event, in DOMObject items);
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
index b8bb22b8d6..85839ea46f 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
@@ -46,11 +46,11 @@
 
 namespace WebCore {
 
-InspectorResource::InspectorResource(long long identifier, DocumentLoader* loader)
+InspectorResource::InspectorResource(unsigned long identifier, DocumentLoader* loader, const KURL& requestURL)
     : m_identifier(identifier)
     , m_loader(loader)
     , m_frame(loader->frame())
-    , m_scriptObjectCreated(false)
+    , m_requestURL(requestURL)
     , m_expectedContentLength(0)
     , m_cached(false)
     , m_finished(false)
@@ -70,13 +70,27 @@ InspectorResource::~InspectorResource()
 {
 }
 
-PassRefPtr<InspectorResource> InspectorResource::createCached(long long identifier, DocumentLoader* loader, const CachedResource* cachedResource)
+PassRefPtr<InspectorResource> InspectorResource::appendRedirect(unsigned long identifier, const KURL& redirectURL)
 {
-    PassRefPtr<InspectorResource> resource = create(identifier, loader);
+    // Last redirect is always a container of all previous ones. Pass this container here.
+    RefPtr<InspectorResource> redirect = InspectorResource::create(m_identifier, m_loader.get(), redirectURL);
+    redirect->m_redirects = m_redirects;
+    redirect->m_redirects.append(this);
+    redirect->m_changes.set(RedirectsChange);
+
+    m_identifier = identifier;
+    // Re-send request info with new id.
+    m_changes.set(RequestChange);
+    m_redirects.clear();
+    return redirect;
+}
+
+PassRefPtr<InspectorResource> InspectorResource::createCached(unsigned long identifier, DocumentLoader* loader, const CachedResource* cachedResource)
+{
+    PassRefPtr<InspectorResource> resource = create(identifier, loader, KURL(ParsedURLString, cachedResource->url()));
 
     resource->m_finished = true;
 
-    resource->m_requestURL = KURL(ParsedURLString, cachedResource->url());
     resource->updateResponse(cachedResource->response());
 
     resource->m_length = cachedResource->encodedSize();
@@ -93,7 +107,6 @@ PassRefPtr<InspectorResource> InspectorResource::createCached(long long identifi
 void InspectorResource::updateRequest(const ResourceRequest& request)
 {
     m_requestHeaderFields = request.httpHeaderFields();
-    m_requestURL = request.url();
     m_requestMethod = request.httpMethod();
     if (request.httpBody() && !request.httpBody()->isEmpty())
         m_requestFormData = request.httpBody()->flattenToString();
@@ -105,6 +118,11 @@ void InspectorResource::updateResponse(const ResourceResponse& response)
 {
     m_expectedContentLength = response.expectedContentLength();
     m_mimeType = response.mimeType();
+    if (m_mimeType.isEmpty() && response.httpStatusCode() == 304) {
+        CachedResource* cachedResource = cache()->resourceForURL(response.url().string());
+        if (cachedResource)
+            m_mimeType = cachedResource->response().mimeType();
+    }
     m_responseHeaderFields = response.httpHeaderFields();
     m_responseStatusCode = response.httpStatusCode();
     m_suggestedFilename = response.suggestedFilename();
@@ -121,42 +139,17 @@ static void populateHeadersObject(ScriptObject* object, const HTTPHeaderMap& hea
     }
 }
 
-void InspectorResource::createScriptObject(InspectorFrontend* frontend)
-{
-    if (!m_scriptObjectCreated) {
-        ScriptObject jsonObject = frontend->newScriptObject();
-        ScriptObject requestHeaders = frontend->newScriptObject();
-        populateHeadersObject(&requestHeaders, m_requestHeaderFields);
-        jsonObject.set("requestHeaders", requestHeaders);
-        jsonObject.set("requestURL", requestURL());
-        jsonObject.set("host", m_requestURL.host());
-        jsonObject.set("path", m_requestURL.path());
-        jsonObject.set("lastPathComponent", m_requestURL.lastPathComponent());
-        jsonObject.set("isMainResource", m_isMainResource);
-        jsonObject.set("cached", m_cached);
-        jsonObject.set("requestMethod", m_requestMethod);
-        jsonObject.set("requestFormData", m_requestFormData);
-        if (!frontend->addResource(m_identifier, jsonObject))
-            return;
-
-        m_scriptObjectCreated = true;
-        m_changes.clear(RequestChange);
-    }
-    updateScriptObject(frontend);
-}
 
 void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
 {
-    if (!m_scriptObjectCreated)
-        return;
-
     if (m_changes.hasChange(NoChange))
         return;
 
     ScriptObject jsonObject = frontend->newScriptObject();
     if (m_changes.hasChange(RequestChange)) {
-        jsonObject.set("url", requestURL());
-        jsonObject.set("domain", m_requestURL.host());
+        jsonObject.set("url", m_requestURL.string());
+        jsonObject.set("documentURL", m_frame->document()->url().string());
+        jsonObject.set("host", m_requestURL.host());
         jsonObject.set("path", m_requestURL.path());
         jsonObject.set("lastPathComponent", m_requestURL.lastPathComponent());
         ScriptObject requestHeaders = frontend->newScriptObject();
@@ -166,6 +159,7 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
         jsonObject.set("requestMethod", m_requestMethod);
         jsonObject.set("requestFormData", m_requestFormData);
         jsonObject.set("didRequestChange", true);
+        jsonObject.set("cached", m_cached);
     }
 
     if (m_changes.hasChange(ResponseChange)) {
@@ -184,9 +178,9 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
         jsonObject.set("type", static_cast<int>(type()));
         jsonObject.set("didTypeChange", true);
     }
-    
+
     if (m_changes.hasChange(LengthChange)) {
-        jsonObject.set("contentLength", m_length);
+        jsonObject.set("resourceSize", m_length);
         jsonObject.set("didLengthChange", true);
     }
 
@@ -209,23 +203,25 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
             jsonObject.set("domContentEventTime", m_domContentEventTime);
         jsonObject.set("didTimingChange", true);
     }
-    if (!frontend->updateResource(m_identifier, jsonObject))
-        return;
-    m_changes.clearAll();
+
+    if (m_changes.hasChange(RedirectsChange)) {
+        for (size_t i = 0; i < m_redirects.size(); ++i)
+            m_redirects[i]->updateScriptObject(frontend);
+    }
+
+    if (frontend->updateResource(m_identifier, jsonObject))
+        m_changes.clearAll();
 }
 
-void InspectorResource::releaseScriptObject(InspectorFrontend* frontend, bool callRemoveResource)
+void InspectorResource::releaseScriptObject(InspectorFrontend* frontend)
 {
-    if (!m_scriptObjectCreated)
-        return;
-
-    m_scriptObjectCreated = false;
     m_changes.setAll();
 
-    if (!callRemoveResource)
-        return;
+    for (size_t i = 0; i < m_redirects.size(); ++i)
+        m_redirects[i]->releaseScriptObject(frontend);
 
-    frontend->removeResource(m_identifier);
+    if (frontend)
+        frontend->removeResource(m_identifier);
 }
 
 CachedResource* InspectorResource::cachedResource() const
@@ -233,25 +229,17 @@ CachedResource* InspectorResource::cachedResource() const
     // Try hard to find a corresponding CachedResource. During preloading, DocLoader may not have the resource in document resources set yet,
     // but Inspector will already try to fetch data that is only available via CachedResource (and it won't update once the resource is added,
     // because m_changes will not have the appropriate bits set).
-    const String& url = requestURL();
+    const String& url = m_requestURL.string();
     CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(url);
     if (!cachedResource)
         cachedResource = cache()->resourceForURL(url);
     return cachedResource;
 }
 
-InspectorResource::Type InspectorResource::type() const
+InspectorResource::Type InspectorResource::cachedResourceType() const
 {
-    if (!m_xmlHttpResponseText.isNull())
-        return XHR;
-
-    if (m_requestURL == m_loader->requestURL())
-        return Doc;
-
-    if (m_loader->frameLoader() && m_requestURL == m_loader->frameLoader()->iconURL())
-        return Image;
-
     CachedResource* cachedResource = this->cachedResource();
+
     if (!cachedResource)
         return Other;
 
@@ -272,6 +260,25 @@ InspectorResource::Type InspectorResource::type() const
     }
 }
 
+InspectorResource::Type InspectorResource::type() const
+{
+    if (!m_xmlHttpResponseText.isNull())
+        return XHR;
+
+    if (m_requestURL == m_loader->requestURL()) {
+        InspectorResource::Type resourceType = cachedResourceType();
+        if (resourceType == Other)
+            return Doc;
+
+        return resourceType;
+    }
+
+    if (m_loader->frameLoader() && m_requestURL == m_loader->frameLoader()->iconURL())
+        return Image;
+
+    return cachedResourceType();
+}
+
 void InspectorResource::setXMLHttpResponseText(const ScriptString& data)
 {
     m_xmlHttpResponseText = data;
@@ -362,6 +369,12 @@ void InspectorResource::addLength(int lengthReceived)
 {
     m_length += lengthReceived;
     m_changes.set(LengthChange);
+
+    // Update load time, otherwise the resource will
+    // have start time == end time and  0 load duration
+    // until its loading is completed.
+    m_endTime = currentTime();
+    m_changes.set(TimingChange);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
index 0335586ad9..9746e1fbde 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
@@ -51,7 +51,7 @@ namespace WebCore {
     class Frame;
     class ResourceResponse;
 
-    struct ResourceRequest;
+    class ResourceRequest;
 
     class InspectorResource : public RefCounted<InspectorResource> {
     public:
@@ -68,18 +68,18 @@ namespace WebCore {
             Other
         };
 
-        static PassRefPtr<InspectorResource> create(long long identifier, DocumentLoader* loader)
+        static PassRefPtr<InspectorResource> create(unsigned long identifier, DocumentLoader* loader, const KURL& requestURL)
         {
-            return adoptRef(new InspectorResource(identifier, loader));
+            return adoptRef(new InspectorResource(identifier, loader, requestURL));
         }
 
-        static PassRefPtr<InspectorResource> createCached(long long identifier, DocumentLoader*, const CachedResource*);
+        static PassRefPtr<InspectorResource> createCached(unsigned long identifier, DocumentLoader*, const CachedResource*);
 
         ~InspectorResource();
 
-        void createScriptObject(InspectorFrontend* frontend);
+        PassRefPtr<InspectorResource> appendRedirect(unsigned long identifier, const KURL& redirectURL);
         void updateScriptObject(InspectorFrontend* frontend);
-        void releaseScriptObject(InspectorFrontend* frontend, bool callRemoveResource);
+        void releaseScriptObject(InspectorFrontend* frontend);
 
         void updateRequest(const ResourceRequest&);
         void updateResponse(const ResourceResponse&);
@@ -91,8 +91,8 @@ namespace WebCore {
 
         bool isSameLoader(DocumentLoader* loader) const { return loader == m_loader; }
         void markMainResource() { m_isMainResource = true; }
-        long long identifier() const { return m_identifier; }
-        String requestURL() const { return m_requestURL.string(); }
+        unsigned long identifier() const { return m_identifier; }
+        KURL requestURL() const { return m_requestURL; }
         Frame* frame() const { return m_frame.get(); }
         const String& mimeType() const { return m_mimeType; }
         const HTTPHeaderMap& requestHeaderFields() const { return m_requestHeaderFields; }
@@ -118,36 +118,41 @@ namespace WebCore {
             TypeChange = 4,
             LengthChange = 8,
             CompletionChange = 16,
-            TimingChange = 32
+            TimingChange = 32,
+            RedirectsChange = 64
         };
 
         class Changes {
         public:
             Changes() : m_change(NoChange) {}
 
-            inline bool hasChange(ChangeType change) { return (m_change & change) || !(m_change + change); }
+            inline bool hasChange(ChangeType change)
+            {
+                return m_change & change || (m_change == NoChange && change == NoChange);
+            }
             inline void set(ChangeType change)
             {
-                m_change = static_cast<ChangeType>(static_cast<unsigned>(m_change) | static_cast<unsigned>(change));            
+                m_change = static_cast<ChangeType>(static_cast<unsigned>(m_change) | static_cast<unsigned>(change));
             }
             inline void clear(ChangeType change)
             {
                 m_change = static_cast<ChangeType>(static_cast<unsigned>(m_change) & ~static_cast<unsigned>(change));
             }
 
-            inline void setAll() { m_change = static_cast<ChangeType>(63); }
+            inline void setAll() { m_change = static_cast<ChangeType>(127); }
             inline void clearAll() { m_change = NoChange; }
 
         private:
             ChangeType m_change;
         };
 
-        InspectorResource(long long identifier, DocumentLoader*);
+        InspectorResource(unsigned long identifier, DocumentLoader*, const KURL& requestURL);
         Type type() const;
 
+        Type cachedResourceType() const;
         CachedResource* cachedResource() const;
 
-        long long m_identifier;
+        unsigned long m_identifier;
         RefPtr<DocumentLoader> m_loader;
         RefPtr<Frame> m_frame;
         KURL m_requestURL;
@@ -155,7 +160,6 @@ namespace WebCore {
         HTTPHeaderMap m_responseHeaderFields;
         String m_mimeType;
         String m_suggestedFilename;
-        bool m_scriptObjectCreated;
         long long m_expectedContentLength;
         bool m_cached;
         bool m_finished;
@@ -172,6 +176,7 @@ namespace WebCore {
         bool m_isMainResource;
         String m_requestMethod;
         String m_requestFormData;
+        Vector<RefPtr<InspectorResource> > m_redirects;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.cpp
index 4f7b736d67..2bf66eeed0 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -35,35 +35,54 @@
 
 #include "Event.h"
 #include "InspectorFrontend.h"
+#include "IntRect.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
 #include "TimelineRecordFactory.h"
 
 #include <wtf/CurrentTime.h>
 
 namespace WebCore {
 
+int InspectorTimelineAgent::s_instanceCount = 0;
+
 InspectorTimelineAgent::InspectorTimelineAgent(InspectorFrontend* frontend)
     : m_frontend(frontend)
 {
+    ++s_instanceCount;
     ASSERT(m_frontend);
 }
 
 InspectorTimelineAgent::~InspectorTimelineAgent()
 {
+    ASSERT(s_instanceCount);
+    --s_instanceCount;
+}
+
+void InspectorTimelineAgent::willCallFunction(const String& scriptName, int scriptLine)
+{
+    pushCurrentRecord(TimelineRecordFactory::createFunctionCallData(m_frontend, scriptName, scriptLine), FunctionCallTimelineRecordType);
 }
 
-void InspectorTimelineAgent::willDispatchDOMEvent(const Event& event)
+void InspectorTimelineAgent::didCallFunction()
 {
-    pushCurrentRecord(TimelineRecordFactory::createDOMDispatchRecord(m_frontend, currentTimeInMilliseconds(), event), DOMDispatchTimelineRecordType);
+    didCompleteCurrentRecord(FunctionCallTimelineRecordType);
 }
 
-void InspectorTimelineAgent::didDispatchDOMEvent()
+void InspectorTimelineAgent::willDispatchEvent(const Event& event)
 {
-    didCompleteCurrentRecord(DOMDispatchTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createEventDispatchData(m_frontend, event),
+        EventDispatchTimelineRecordType);
+}
+
+void InspectorTimelineAgent::didDispatchEvent()
+{
+    didCompleteCurrentRecord(EventDispatchTimelineRecordType);
 }
 
 void InspectorTimelineAgent::willLayout()
 {
-    pushCurrentRecord(TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds()), LayoutTimelineRecordType);
+    pushCurrentRecord(m_frontend->newScriptObject(), LayoutTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didLayout()
@@ -73,7 +92,7 @@ void InspectorTimelineAgent::didLayout()
 
 void InspectorTimelineAgent::willRecalculateStyle()
 {
-    pushCurrentRecord(TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds()), RecalculateStylesTimelineRecordType);
+    pushCurrentRecord(m_frontend->newScriptObject(), RecalculateStylesTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didRecalculateStyle()
@@ -81,9 +100,9 @@ void InspectorTimelineAgent::didRecalculateStyle()
     didCompleteCurrentRecord(RecalculateStylesTimelineRecordType);
 }
 
-void InspectorTimelineAgent::willPaint()
+void InspectorTimelineAgent::willPaint(const IntRect& rect)
 {
-    pushCurrentRecord(TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds()), PaintTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createPaintData(m_frontend, rect), PaintTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didPaint()
@@ -91,32 +110,37 @@ void InspectorTimelineAgent::didPaint()
     didCompleteCurrentRecord(PaintTimelineRecordType);
 }
 
-void InspectorTimelineAgent::willWriteHTML()
+void InspectorTimelineAgent::willWriteHTML(unsigned int length, unsigned int startLine)
 {
-    pushCurrentRecord(TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds()), ParseHTMLTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createParseHTMLData(m_frontend, length, startLine), ParseHTMLTimelineRecordType);
 }
 
-void InspectorTimelineAgent::didWriteHTML()
+void InspectorTimelineAgent::didWriteHTML(unsigned int endLine)
 {
-    didCompleteCurrentRecord(ParseHTMLTimelineRecordType);
+    if (!m_recordStack.isEmpty()) {
+        TimelineRecordEntry entry = m_recordStack.last();
+        entry.data.set("endLine", endLine);
+        didCompleteCurrentRecord(ParseHTMLTimelineRecordType);
+    }
 }
-   
+
 void InspectorTimelineAgent::didInstallTimer(int timerId, int timeout, bool singleShot)
 {
-    addRecordToTimeline(TimelineRecordFactory::createTimerInstallRecord(m_frontend, currentTimeInMilliseconds(), timerId,
-        timeout, singleShot), TimerInstallTimelineRecordType);
+    ScriptObject record = TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds());
+    record.set("data", TimelineRecordFactory::createTimerInstallData(m_frontend, timerId, timeout, singleShot));
+    addRecordToTimeline(record, TimerInstallTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didRemoveTimer(int timerId)
 {
-    addRecordToTimeline(TimelineRecordFactory::createGenericTimerRecord(m_frontend, currentTimeInMilliseconds(), timerId),
-        TimerRemoveTimelineRecordType);
+    ScriptObject record = TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds());
+    record.set("data", TimelineRecordFactory::createGenericTimerData(m_frontend, timerId));
+    addRecordToTimeline(record, TimerRemoveTimelineRecordType);
 }
 
 void InspectorTimelineAgent::willFireTimer(int timerId)
 {
-    pushCurrentRecord(TimelineRecordFactory::createGenericTimerRecord(m_frontend, currentTimeInMilliseconds(), timerId),
-        TimerFireTimelineRecordType); 
+    pushCurrentRecord(TimelineRecordFactory::createGenericTimerData(m_frontend, timerId), TimerFireTimelineRecordType); 
 }
 
 void InspectorTimelineAgent::didFireTimer()
@@ -126,8 +150,7 @@ void InspectorTimelineAgent::didFireTimer()
 
 void InspectorTimelineAgent::willChangeXHRReadyState(const String& url, int readyState)
 {
-    pushCurrentRecord(TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord(m_frontend, currentTimeInMilliseconds(), url, readyState),
-        XHRReadyStateChangeRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createXHRReadyStateChangeData(m_frontend, url, readyState), XHRReadyStateChangeRecordType);
 }
 
 void InspectorTimelineAgent::didChangeXHRReadyState()
@@ -137,7 +160,7 @@ void InspectorTimelineAgent::didChangeXHRReadyState()
 
 void InspectorTimelineAgent::willLoadXHR(const String& url) 
 {
-    pushCurrentRecord(TimelineRecordFactory::createXHRLoadTimelineRecord(m_frontend, currentTimeInMilliseconds(), url), XHRLoadRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createXHRLoadData(m_frontend, url), XHRLoadRecordType);
 }
 
 void InspectorTimelineAgent::didLoadXHR()
@@ -145,14 +168,58 @@ void InspectorTimelineAgent::didLoadXHR()
     didCompleteCurrentRecord(XHRLoadRecordType);
 }
 
-void InspectorTimelineAgent::willEvaluateScriptTag(const String& url, int lineNumber)
+void InspectorTimelineAgent::willEvaluateScript(const String& url, int lineNumber)
+{
+    pushCurrentRecord(TimelineRecordFactory::createEvaluateScriptData(m_frontend, url, lineNumber), EvaluateScriptTimelineRecordType);
+}
+    
+void InspectorTimelineAgent::didEvaluateScript()
+{
+    didCompleteCurrentRecord(EvaluateScriptTimelineRecordType);
+}
+
+void InspectorTimelineAgent::willSendResourceRequest(unsigned long identifier, bool isMainResource,
+    const ResourceRequest& request)
+{
+    ScriptObject record = TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds());
+    record.set("data", TimelineRecordFactory::createResourceSendRequestData(m_frontend, identifier, isMainResource, request));
+    record.set("type", ResourceSendRequestTimelineRecordType);
+    m_frontend->addRecordToTimeline(record);
+}
+
+void InspectorTimelineAgent::willReceiveResourceData(unsigned long identifier)
+{
+    pushCurrentRecord(TimelineRecordFactory::createReceiveResourceData(m_frontend, identifier), ReceiveResourceDataTimelineRecordType);
+}
+
+void InspectorTimelineAgent::didReceiveResourceData()
 {
-    pushCurrentRecord(TimelineRecordFactory::createEvaluateScriptTagTimelineRecord(m_frontend, currentTimeInMilliseconds(), url, lineNumber), EvaluateScriptTagTimelineRecordType);
+    didCompleteCurrentRecord(ReceiveResourceDataTimelineRecordType);
 }
     
-void InspectorTimelineAgent::didEvaluateScriptTag()
+void InspectorTimelineAgent::willReceiveResourceResponse(unsigned long identifier, const ResourceResponse& response)
+{
+    pushCurrentRecord(TimelineRecordFactory::createResourceReceiveResponseData(m_frontend, identifier, response), ResourceReceiveResponseTimelineRecordType);
+}
+
+void InspectorTimelineAgent::didReceiveResourceResponse()
 {
-    didCompleteCurrentRecord(EvaluateScriptTagTimelineRecordType);
+    didCompleteCurrentRecord(ResourceReceiveResponseTimelineRecordType);
+}
+
+void InspectorTimelineAgent::didFinishLoadingResource(unsigned long identifier, bool didFail)
+{
+    ScriptObject record = TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds());
+    record.set("data", TimelineRecordFactory::createResourceFinishData(m_frontend, identifier, didFail));
+    record.set("type", ResourceFinishTimelineRecordType);
+    m_frontend->addRecordToTimeline(record);
+}
+
+void InspectorTimelineAgent::didMarkTimeline(const String& message)
+{
+    ScriptObject record = TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds());
+    record.set("data", TimelineRecordFactory::createMarkTimelineData(m_frontend, message));
+    addRecordToTimeline(record, MarkTimelineRecordType);
 }
 
 void InspectorTimelineAgent::reset()
@@ -180,13 +247,17 @@ void InspectorTimelineAgent::addRecordToTimeline(ScriptObject record, TimelineRe
 
 void InspectorTimelineAgent::didCompleteCurrentRecord(TimelineRecordType type)
 {
-    ASSERT(!m_recordStack.isEmpty());
-    TimelineRecordEntry entry = m_recordStack.last();
-    m_recordStack.removeLast();
-    ASSERT(entry.type == type);
-    entry.record.set("children", entry.children);
-    entry.record.set("endTime", currentTimeInMilliseconds());
-    addRecordToTimeline(entry.record, type);
+    // An empty stack could merely mean that the timeline agent was turned on in the middle of
+    // an event.  Don't treat as an error.
+    if (!m_recordStack.isEmpty()) {
+        TimelineRecordEntry entry = m_recordStack.last();
+        m_recordStack.removeLast();
+        ASSERT(entry.type == type);
+        entry.record.set("data", entry.data);
+        entry.record.set("children", entry.children);
+        entry.record.set("endTime", currentTimeInMilliseconds());
+        addRecordToTimeline(entry.record, type);
+    }
 }
 
 double InspectorTimelineAgent::currentTimeInMilliseconds()
@@ -194,11 +265,11 @@ double InspectorTimelineAgent::currentTimeInMilliseconds()
     return currentTime() * 1000.0;
 }
 
-void InspectorTimelineAgent::pushCurrentRecord(ScriptObject record, TimelineRecordType type)
+void InspectorTimelineAgent::pushCurrentRecord(ScriptObject data, TimelineRecordType type)
 {
-    m_recordStack.append(TimelineRecordEntry(record, m_frontend->newScriptArray(), type));
+    ScriptObject record = TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds());
+    m_recordStack.append(TimelineRecordEntry(record, data, m_frontend->newScriptArray(), type));
 }
-
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.h b/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.h
index 0401977b8d..56c918cd49 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.h
@@ -31,6 +31,8 @@
 #ifndef InspectorTimelineAgent_h
 #define InspectorTimelineAgent_h
 
+#if ENABLE(INSPECTOR)
+
 #include "Document.h"
 #include "ScriptExecutionContext.h"
 #include "ScriptObject.h"
@@ -40,10 +42,13 @@
 namespace WebCore {
     class Event;
     class InspectorFrontend;
+    class IntRect;
+    class ResourceRequest;
+    class ResourceResponse;
 
     // Must be kept in sync with TimelineAgent.js
     enum TimelineRecordType {
-        DOMDispatchTimelineRecordType = 0,
+        EventDispatchTimelineRecordType = 0,
         LayoutTimelineRecordType = 1,
         RecalculateStylesTimelineRecordType = 2,
         PaintTimelineRecordType = 3,
@@ -53,10 +58,16 @@ namespace WebCore {
         TimerFireTimelineRecordType = 7,
         XHRReadyStateChangeRecordType = 8,
         XHRLoadRecordType = 9,
-        EvaluateScriptTagTimelineRecordType = 10,
+        EvaluateScriptTimelineRecordType = 10,
+        MarkTimelineRecordType = 11,
+        ResourceSendRequestTimelineRecordType = 12,
+        ResourceReceiveResponseTimelineRecordType = 13,
+        ResourceFinishTimelineRecordType = 14,
+        FunctionCallTimelineRecordType = 15,
+        ReceiveResourceDataTimelineRecordType = 16,
     };
 
-    class InspectorTimelineAgent {
+    class InspectorTimelineAgent : public Noncopyable {
     public:
         InspectorTimelineAgent(InspectorFrontend* frontend);
         ~InspectorTimelineAgent();
@@ -65,8 +76,11 @@ namespace WebCore {
         void resetFrontendProxyObject(InspectorFrontend*);
 
         // Methods called from WebCore.
-        void willDispatchDOMEvent(const Event&);
-        void didDispatchDOMEvent();
+        void willCallFunction(const String& scriptName, int scriptLine);
+        void didCallFunction();
+
+        void willDispatchEvent(const Event&);
+        void didDispatchEvent();
 
         void willLayout();
         void didLayout();
@@ -74,11 +88,11 @@ namespace WebCore {
         void willRecalculateStyle();
         void didRecalculateStyle();
 
-        void willPaint();
+        void willPaint(const IntRect&);
         void didPaint();
 
-        void willWriteHTML();
-        void didWriteHTML();
+        void willWriteHTML(unsigned int length, unsigned int startLine);
+        void didWriteHTML(unsigned int endLine);
         
         void didInstallTimer(int timerId, int timeout, bool singleShot);
         void didRemoveTimer(int timerId);
@@ -90,14 +104,26 @@ namespace WebCore {
         void willLoadXHR(const String&);
         void didLoadXHR();
 
-        void willEvaluateScriptTag(const String&, int);
-        void didEvaluateScriptTag();
+        void willEvaluateScript(const String&, int);
+        void didEvaluateScript();
+
+        void didMarkTimeline(const String&);
 
+        void willSendResourceRequest(unsigned long, bool isMainResource, const ResourceRequest&);
+        void willReceiveResourceResponse(unsigned long, const ResourceResponse&);
+        void didReceiveResourceResponse();
+        void didFinishLoadingResource(unsigned long, bool didFail);
+        void willReceiveResourceData(unsigned long identifier);
+        void didReceiveResourceData();
+        
+        static int instanceCount() { return s_instanceCount; }
         static InspectorTimelineAgent* retrieve(ScriptExecutionContext*);
+
     private:
         struct TimelineRecordEntry {
-            TimelineRecordEntry(ScriptObject record, ScriptArray children, TimelineRecordType type) : record(record), children(children), type(type) { }
+            TimelineRecordEntry(ScriptObject record, ScriptObject data, ScriptArray children, TimelineRecordType type) : record(record), data(data), children(children), type(type) { }
             ScriptObject record;
+            ScriptObject data;
             ScriptArray children;
             TimelineRecordType type;
         };
@@ -107,21 +133,23 @@ namespace WebCore {
         static double currentTimeInMilliseconds();
 
         void didCompleteCurrentRecord(TimelineRecordType);
-        
+
         void addRecordToTimeline(ScriptObject, TimelineRecordType);
 
         InspectorFrontend* m_frontend;
-        
+
         Vector< TimelineRecordEntry > m_recordStack;
+        static int s_instanceCount;
     };
 
 inline InspectorTimelineAgent* InspectorTimelineAgent::retrieve(ScriptExecutionContext* context)
 {
-    if (context->isDocument())
+    if (context && context->isDocument())
         return static_cast<Document*>(context)->inspectorTimelineAgent();
     return 0;
 }
 
 } // namespace WebCore
 
+#endif // !ENABLE(INSPECTOR)
 #endif // !defined(InspectorTimelineAgent_h)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorWorkerResource.h b/src/3rdparty/webkit/WebCore/inspector/InspectorWorkerResource.h
new file mode 100644
index 0000000000..ef1b8c92fa
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorWorkerResource.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorWorkerResource_h
+#define InspectorWorkerResource_h
+
+#if ENABLE(WORKERS) && ENABLE(INSPECTOR)
+
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class InspectorWorkerResource : public RefCounted<InspectorWorkerResource> {
+public:
+    static PassRefPtr<InspectorWorkerResource> create(intptr_t id, const String& url, bool isSharedWorker)
+    {
+        return adoptRef(new InspectorWorkerResource(id, url, isSharedWorker));
+    }
+
+    intptr_t id() const { return m_id; }
+    const String& url() const { return m_url; }
+    bool isSharedWorker() const { return m_isSharedWorker; }
+private:
+    InspectorWorkerResource(intptr_t id, const String& url, bool isSharedWorker)
+        : m_id(id)
+        , m_url(url)
+        , m_isSharedWorker(isSharedWorker)
+    {
+    }
+
+    intptr_t m_id;
+    String m_url;
+    bool m_isSharedWorker;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS) && ENABLE(INSPECTOR)
+
+#endif // InspectorWorkerResource_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp
index 1559d8297b..e6f75b8d0b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp
@@ -27,7 +27,7 @@
 #include "JavaScriptCallFrame.h"
 #include "JSDOMBinding.h"
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
+#if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC)
 
 #include "PlatformString.h"
 #include <debugger/DebuggerCallFrame.h>
@@ -106,7 +106,7 @@ JSValue JavaScriptCallFrame::evaluate(const UString& script, JSValue& exception)
         return jsNull();
 
     JSLock lock(SilenceAssertionsOnly);
-    return DebuggerCallFrame_evaluateInWorld(m_debuggerCallFrame, script, exception);
+    return m_debuggerCallFrame.evaluate(script, exception);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h
index 47cdac2452..bf61c4b1eb 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h
@@ -26,7 +26,7 @@
 #ifndef JavaScriptCallFrame_h
 #define JavaScriptCallFrame_h
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
+#if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC)
 
 #include <interpreter/CallFrame.h>
 #include <wtf/PassRefPtr.h>
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.idl b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.idl
index 2f247f01b1..639ecc919e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.idl
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.idl
@@ -25,7 +25,7 @@
 
 module inspector {
 
-    interface [Conditional=JAVASCRIPT_DEBUGGER] JavaScriptCallFrame {
+    interface [Conditional=JAVASCRIPT_DEBUGGER, OmitConstructor] JavaScriptCallFrame {
         [Custom] void evaluate(in DOMString script);
 
         readonly attribute JavaScriptCallFrame caller;
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.h b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.h
deleted file mode 100644
index 33c6e3d2ce..0000000000
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.h
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef JavaScriptDebugServer_h
-#define JavaScriptDebugServer_h
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-
-#include "Timer.h"
-#include <debugger/Debugger.h>
-#include <runtime/UString.h>
-#include <wtf/HashMap.h>
-#include <wtf/HashSet.h>
-#include <wtf/RefPtr.h>
-
-namespace JSC {
-    class DebuggerCallFrame;
-    class JSGlobalObject;
-}
-
-namespace WebCore {
-
-    class Frame;
-    class FrameView;
-    class Page;
-    class PageGroup;
-    class JavaScriptCallFrame;
-    class JavaScriptDebugListener;
-
-    class JavaScriptDebugServer : JSC::Debugger {
-    public:
-        static JavaScriptDebugServer& shared();
-
-        void addListener(JavaScriptDebugListener*);
-        void removeListener(JavaScriptDebugListener*);
-
-        void addListener(JavaScriptDebugListener*, Page*);
-        void removeListener(JavaScriptDebugListener*, Page*);
-
-        void addBreakpoint(intptr_t sourceID, unsigned lineNumber, const JSC::UString& condition);
-        void updateBreakpoint(intptr_t sourceID, unsigned lineNumber, const JSC::UString& condition);
-        void removeBreakpoint(intptr_t sourceID, unsigned lineNumber);
-        bool hasBreakpoint(intptr_t sourceID, unsigned lineNumber) const;
-        void clearBreakpoints();
-
-        bool pauseOnExceptions() const { return m_pauseOnExceptions; }
-        void setPauseOnExceptions(bool);
-
-        void pauseProgram();
-        void continueProgram();
-        void stepIntoStatement();
-        void stepOverStatement();
-        void stepOutOfFunction();
-
-        void recompileAllJSFunctionsSoon();
-        void recompileAllJSFunctions(Timer<JavaScriptDebugServer>* = 0);
-
-        JavaScriptCallFrame* currentCallFrame();
-
-        void pageCreated(Page*);
-
-        typedef HashSet<JavaScriptDebugListener*> ListenerSet;
-        typedef void (JavaScriptDebugListener::*JavaScriptExecutionCallback)();
-
-    private:
-        class BreakpointInfo {
-        public:
-            BreakpointInfo(const JSC::UString& condition) : m_condition(condition) {}
-            const JSC::UString& condition() const;
-            void setCondition(const JSC::UString& condition);
-        private:
-            JSC::UString m_condition;
-        };
-
-        JavaScriptDebugServer();
-        ~JavaScriptDebugServer();
-
-        bool hasListeners() const { return !m_listeners.isEmpty() || !m_pageListenersMap.isEmpty(); }
-        bool hasGlobalListeners() const { return !m_listeners.isEmpty(); }
-        bool hasListenersInterestedInPage(Page*);
-
-        void setJavaScriptPaused(const PageGroup&, bool paused);
-        void setJavaScriptPaused(Page*, bool paused);
-        void setJavaScriptPaused(Frame*, bool paused);
-        void setJavaScriptPaused(FrameView*, bool paused);
-
-        void dispatchFunctionToListeners(JavaScriptExecutionCallback, Page*);
-        void pauseIfNeeded(Page*);
-        BreakpointInfo* breakpointInfo(intptr_t sourceID, unsigned lineNumber) const;
-        void updateBreakpointInfo(BreakpointInfo* info, const JSC::UString& condition);
-
-        virtual void detach(JSC::JSGlobalObject*);
-
-        virtual void sourceParsed(JSC::ExecState*, const JSC::SourceCode&, int errorLine, const JSC::UString& errorMsg);
-        virtual void callEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
-        virtual void atStatement(const JSC::DebuggerCallFrame&, intptr_t sourceID, int firstLine);
-        virtual void returnEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
-        virtual void exception(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
-        virtual void willExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
-        virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
-        virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
-
-        void didAddListener(Page*);
-        void didRemoveListener(Page*);
-        void didRemoveLastListener();
-
-        typedef HashMap<Page*, ListenerSet*> PageListenersMap;
-        typedef HashMap<unsigned, BreakpointInfo*> LineToBreakpointInfoMap;
-        typedef HashMap<intptr_t, LineToBreakpointInfoMap*> BreakpointsMap;
-
-        PageListenersMap m_pageListenersMap;
-        ListenerSet m_listeners;
-        bool m_callingListeners;
-        bool m_pauseOnExceptions;
-        bool m_pauseOnNextStatement;
-        bool m_paused;
-        bool m_doneProcessingDebuggerEvents;
-        JavaScriptCallFrame* m_pauseOnCallFrame;
-        RefPtr<JavaScriptCallFrame> m_currentCallFrame;
-        BreakpointsMap m_breakpoints;
-        Timer<JavaScriptDebugServer> m_recompileTimer;
-    };
-
-} // namespace WebCore
-
-#endif // ENABLE(JAVASCRIPT_DEBUGGER)
-
-#endif // JavaScriptDebugServer_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/ScriptBreakpoint.h b/src/3rdparty/webkit/WebCore/inspector/ScriptBreakpoint.h
new file mode 100644
index 0000000000..8775901230
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/ScriptBreakpoint.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptBreakpoint_h
+#define ScriptBreakpoint_h
+
+#include "PlatformString.h"
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+struct ScriptBreakpoint {
+    ScriptBreakpoint(bool enabled, const String& condition)
+        : enabled(enabled)
+        , condition(condition)
+    {
+    }
+
+    ScriptBreakpoint()
+    {
+    }
+
+    bool enabled;
+    String condition;
+};
+
+typedef HashMap<int, ScriptBreakpoint> SourceBreakpoints;
+
+} // namespace WebCore
+
+#endif // !defined(ScriptBreakpoint_h)
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugListener.h b/src/3rdparty/webkit/WebCore/inspector/ScriptDebugListener.h
index 912a7516a1..5a85da1c28 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugListener.h
+++ b/src/3rdparty/webkit/WebCore/inspector/ScriptDebugListener.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,34 +27,27 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef JavaScriptDebugListener_h
-#define JavaScriptDebugListener_h
+#ifndef ScriptDebugListener_h
+#define ScriptDebugListener_h
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
-namespace JSC {
-    class ExecState;
-    class SourceCode;
-    class UString;
-}
-
 namespace WebCore {
 
-    class Frame;
-    class Page;
+class String;
 
-    class JavaScriptDebugListener {
-    public:
-        virtual ~JavaScriptDebugListener() { }
+class ScriptDebugListener {
+public:
+    virtual ~ScriptDebugListener() { }
 
-        virtual void didParseSource(JSC::ExecState*, const JSC::SourceCode& source) = 0;
-        virtual void failedToParseSource(JSC::ExecState*, const JSC::SourceCode& source, int errorLine, const JSC::UString& errorMessage) = 0;
-        virtual void didPause() = 0;
-        virtual void didContinue() = 0;
-    };
+    virtual void didParseSource(const String&  sourceID, const String& url, const String& data, int firstLine) = 0;
+    virtual void failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage) = 0;
+    virtual void didPause() = 0;
+    virtual void didContinue() = 0;
+};
 
 } // namespace WebCore
 
 #endif // ENABLE(JAVASCRIPT_DEBUGGER)
 
-#endif // JavaScriptDebugListener_h
+#endif // ScriptDebugListener_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/TimelineRecordFactory.cpp b/src/3rdparty/webkit/WebCore/inspector/TimelineRecordFactory.cpp
index 085bcd9ab6..2ad089dd7e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/TimelineRecordFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/TimelineRecordFactory.cpp
@@ -35,80 +35,142 @@
 
 #include "Event.h"
 #include "InspectorFrontend.h"
+#include "IntRect.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
 #include "ScriptArray.h"
+#include "ScriptCallStack.h"
 #include "ScriptObject.h"
+
 namespace WebCore {
 
-// static
 ScriptObject TimelineRecordFactory::createGenericRecord(InspectorFrontend* frontend, double startTime)
 {
     ScriptObject record = frontend->newScriptObject();
     record.set("startTime", startTime);
+
+    String sourceName;
+    int sourceLineNumber;
+    if (ScriptCallStack::callLocation(&sourceName, &sourceLineNumber) && sourceName != "undefined") {
+        record.set("callerScriptName", sourceName);
+        record.set("callerScriptLine", sourceLineNumber);
+    }
     return record;
 }
 
-// static
-ScriptObject TimelineRecordFactory::createDOMDispatchRecord(InspectorFrontend* frontend, double startTime, const Event& event)
+ScriptObject TimelineRecordFactory::createFunctionCallData(InspectorFrontend* frontend, const String& scriptName, int scriptLine)
+{
+    ScriptObject data = frontend->newScriptObject();
+    data.set("scriptName", scriptName);
+    data.set("scriptLine", scriptLine);
+    return data;
+}
+
+ScriptObject TimelineRecordFactory::createEventDispatchData(InspectorFrontend* frontend, const Event& event)
 {
-    ScriptObject record = createGenericRecord(frontend, startTime);
     ScriptObject data = frontend->newScriptObject();
     data.set("type", event.type().string());
-    record.set("data", data);
-    return record;
+    return data;
 }
 
-// static
-ScriptObject TimelineRecordFactory::createGenericTimerRecord(InspectorFrontend* frontend, double startTime, int timerId)
+ScriptObject TimelineRecordFactory::createGenericTimerData(InspectorFrontend* frontend, int timerId)
 {
-    ScriptObject record = createGenericRecord(frontend, startTime);
     ScriptObject data = frontend->newScriptObject();
     data.set("timerId", timerId);
-    record.set("data", data);
-    return record;
+    return data;
 }
 
-// static
-ScriptObject TimelineRecordFactory::createTimerInstallRecord(InspectorFrontend* frontend, double startTime, int timerId, int timeout, bool singleShot)
+ScriptObject TimelineRecordFactory::createTimerInstallData(InspectorFrontend* frontend, int timerId, int timeout, bool singleShot)
 {
-    ScriptObject record = createGenericRecord(frontend, startTime);
     ScriptObject data = frontend->newScriptObject();
     data.set("timerId", timerId);
     data.set("timeout", timeout);
     data.set("singleShot", singleShot);
-    record.set("data", data);
-    return record;
+    return data;
 }
 
-// static
-ScriptObject TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord(InspectorFrontend* frontend, double startTime, const String& url, int readyState)
+ScriptObject TimelineRecordFactory::createXHRReadyStateChangeData(InspectorFrontend* frontend, const String& url, int readyState)
 {
-    ScriptObject record = createGenericRecord(frontend, startTime);
     ScriptObject data = frontend->newScriptObject();
     data.set("url", url);
     data.set("readyState", readyState);
-    record.set("data", data);
-    return record;
+    return data;
 }
 
-// static
-ScriptObject TimelineRecordFactory::createXHRLoadTimelineRecord(InspectorFrontend* frontend, double startTime, const String& url)
+ScriptObject TimelineRecordFactory::createXHRLoadData(InspectorFrontend* frontend, const String& url)
 {
-    ScriptObject record = createGenericRecord(frontend, startTime);
     ScriptObject data = frontend->newScriptObject();
     data.set("url", url);
-    record.set("data", data);
-    return record;
+    return data;
 }
 
-// static
-ScriptObject TimelineRecordFactory::createEvaluateScriptTagTimelineRecord(InspectorFrontend* frontend, double startTime, const String& url, double lineNumber) 
+ScriptObject TimelineRecordFactory::createEvaluateScriptData(InspectorFrontend* frontend, const String& url, double lineNumber) 
 {
-    ScriptObject item = createGenericRecord(frontend, startTime);
     ScriptObject data = frontend->newScriptObject();
     data.set("url", url);
     data.set("lineNumber", lineNumber);
-    item.set("data", data);
-    return item;
+    return data;
+}
+
+ScriptObject TimelineRecordFactory::createMarkTimelineData(InspectorFrontend* frontend, const String& message) 
+{
+    ScriptObject data = frontend->newScriptObject();
+    data.set("message", message);
+    return data;
+}
+
+
+ScriptObject TimelineRecordFactory::createResourceSendRequestData(InspectorFrontend* frontend, unsigned long identifier, bool isMainResource, const ResourceRequest& request)
+{
+    ScriptObject data = frontend->newScriptObject();
+    data.set("identifier", identifier);
+    data.set("url", request.url().string());
+    data.set("requestMethod", request.httpMethod());
+    data.set("isMainResource", isMainResource);
+    return data;
+}
+
+ScriptObject TimelineRecordFactory::createResourceReceiveResponseData(InspectorFrontend* frontend, unsigned long identifier, const ResourceResponse& response)
+{
+    ScriptObject data = frontend->newScriptObject();
+    data.set("identifier", identifier);
+    data.set("statusCode", response.httpStatusCode());
+    data.set("mimeType", response.mimeType());
+    data.set("expectedContentLength", response.expectedContentLength());
+    return data;
+}
+
+ScriptObject TimelineRecordFactory::createResourceFinishData(InspectorFrontend* frontend, unsigned long identifier, bool didFail)
+{
+    ScriptObject data = frontend->newScriptObject();
+    data.set("identifier", identifier);
+    data.set("didFail", didFail);
+    return data;
+}
+
+ScriptObject TimelineRecordFactory::createReceiveResourceData(InspectorFrontend* frontend, unsigned long identifier)
+{
+    ScriptObject data = frontend->newScriptObject();
+    data.set("identifier", identifier);
+    return data;
+}
+    
+ScriptObject TimelineRecordFactory::createPaintData(InspectorFrontend* frontend, const IntRect& rect)
+{
+    ScriptObject data = frontend->newScriptObject();
+    data.set("x", rect.x());
+    data.set("y", rect.y());
+    data.set("width", rect.width());
+    data.set("height", rect.height());
+    return data;
+}
+
+ScriptObject TimelineRecordFactory::createParseHTMLData(InspectorFrontend* frontend, unsigned int length, unsigned int startLine)
+{
+    ScriptObject data = frontend->newScriptObject();
+    data.set("length", length);
+    data.set("startLine", startLine);
+    return data;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/TimelineRecordFactory.h b/src/3rdparty/webkit/WebCore/inspector/TimelineRecordFactory.h
index 3d36649f2d..8daf915e9f 100644
--- a/src/3rdparty/webkit/WebCore/inspector/TimelineRecordFactory.h
+++ b/src/3rdparty/webkit/WebCore/inspector/TimelineRecordFactory.h
@@ -37,22 +37,43 @@ namespace WebCore {
 
     class Event;
     class InspectorFrontend;
+    class IntRect;
+    class ResourceRequest;
+    class ResourceResponse;
     class ScriptObject;
 
     class TimelineRecordFactory {
     public:
         static ScriptObject createGenericRecord(InspectorFrontend*, double startTime);
 
-        static ScriptObject createDOMDispatchRecord(InspectorFrontend*, double startTime, const Event&);
+        static ScriptObject createFunctionCallData(InspectorFrontend*, const String& scriptName, int scriptLine);
 
-        static ScriptObject createGenericTimerRecord(InspectorFrontend*, double startTime, int timerId);
+        static ScriptObject createEventDispatchData(InspectorFrontend*, const Event&);
 
-        static ScriptObject createTimerInstallRecord(InspectorFrontend*, double startTime, int timerId, int timeout, bool singleShot);
+        static ScriptObject createGenericTimerData(InspectorFrontend*, int timerId);
 
-        static ScriptObject createXHRReadyStateChangeTimelineRecord(InspectorFrontend*, double startTime, const String& url, int readyState);
-        static ScriptObject createXHRLoadTimelineRecord(InspectorFrontend*, double startTime, const String& url);
+        static ScriptObject createTimerInstallData(InspectorFrontend*, int timerId, int timeout, bool singleShot);
+
+        static ScriptObject createXHRReadyStateChangeData(InspectorFrontend*, const String& url, int readyState);
+
+        static ScriptObject createXHRLoadData(InspectorFrontend*, const String& url);
+        
+        static ScriptObject createEvaluateScriptData(InspectorFrontend*, const String&, double lineNumber);
         
-        static ScriptObject createEvaluateScriptTagTimelineRecord(InspectorFrontend*, double startTime, const String&, double lineNumber);
+        static ScriptObject createMarkTimelineData(InspectorFrontend*, const String&);
+
+        static ScriptObject createResourceSendRequestData(InspectorFrontend*, unsigned long identifier,
+            bool isMainResource, const ResourceRequest&);
+
+        static ScriptObject createResourceReceiveResponseData(InspectorFrontend*, unsigned long identifier, const ResourceResponse&);
+
+        static ScriptObject createReceiveResourceData(InspectorFrontend*, unsigned long identifier);
+        
+        static ScriptObject createResourceFinishData(InspectorFrontend*, unsigned long identifier, bool didFail);
+
+        static ScriptObject createPaintData(InspectorFrontend*, const IntRect&);
+
+        static ScriptObject createParseHTMLData(InspectorFrontend*, unsigned int length, unsigned int startLine);
 
     private:
         TimelineRecordFactory() { }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/AbstractTimelinePanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/AbstractTimelinePanel.js
index 75e4062898..cfec9dafab 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/AbstractTimelinePanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/AbstractTimelinePanel.js
@@ -57,10 +57,13 @@ WebInspector.AbstractTimelinePanel.prototype = {
         // Should be implemented by the concrete subclasses.
     },
 
-    createInterface: function()
+    get items()
     {
-        this._createFilterPanel();
+        return this._items;
+    },
 
+    createInterface: function()
+    {
         this.containerElement = document.createElement("div");
         this.containerElement.id = "resources-container";
         this.containerElement.addEventListener("scroll", this._updateDividersLabelBarPosition.bind(this), false);
@@ -70,10 +73,20 @@ WebInspector.AbstractTimelinePanel.prototype = {
         this.sidebarElement.id = "resources-sidebar";
         this.populateSidebar();
 
-        this._createGraph();
+        this._containerContentElement = document.createElement("div");
+        this._containerContentElement.id = "resources-container-content";
+        this.containerElement.appendChild(this._containerContentElement);
+
+        this.summaryBar = new WebInspector.SummaryBar(this.categories);
+        this.summaryBar.element.id = "resources-summary";
+        this._containerContentElement.appendChild(this.summaryBar.element);
+
+        this._timelineGrid = new WebInspector.TimelineGrid();
+        this._containerContentElement.appendChild(this._timelineGrid.element);
+        this.itemsGraphsElement = this._timelineGrid.itemsGraphsElement;
     },
 
-    _createFilterPanel: function()
+    createFilterPanel: function()
     {
         this.filterBarElement = document.createElement("div");
         this.filterBarElement.id = "resources-filter";
@@ -108,14 +121,14 @@ WebInspector.AbstractTimelinePanel.prototype = {
             createFilterElement.call(this, category);
     },
 
-    _showCategory: function(category)
+    showCategory: function(category)
     {
         var filterClass = "filter-" + category.toLowerCase();
         this.itemsGraphsElement.addStyleClass(filterClass);
         this.itemsTreeElement.childrenListElement.addStyleClass(filterClass);
     },
 
-    _hideCategory: function(category)
+    hideCategory: function(category)
     {
         var filterClass = "filter-" + category.toLowerCase();
         this.itemsGraphsElement.removeStyleClass(filterClass);
@@ -132,7 +145,7 @@ WebInspector.AbstractTimelinePanel.prototype = {
                     continue;
 
                 child.removeStyleClass("selected");
-                this._hideCategory(child.category);
+                this.hideCategory(child.category);
             }
         }
 
@@ -148,7 +161,7 @@ WebInspector.AbstractTimelinePanel.prototype = {
             // Something other than All is being selected, so we want to unselect All.
             if (this.filterAllElement.hasStyleClass("selected")) {
                 this.filterAllElement.removeStyleClass("selected");
-                this._hideCategory("all");
+                this.hideCategory("all");
             }
         }
 
@@ -158,7 +171,7 @@ WebInspector.AbstractTimelinePanel.prototype = {
             unselectAll.call(this);
 
             target.addStyleClass("selected");
-            this._showCategory(target.category);
+            this.showCategory(target.category);
             return;
         }
 
@@ -166,18 +179,18 @@ WebInspector.AbstractTimelinePanel.prototype = {
             // If selectMultiple is turned on, and we were selected, we just
             // want to unselect ourselves.
             target.removeStyleClass("selected");
-            this._hideCategory(target.category);
+            this.hideCategory(target.category);
         } else {
             // If selectMultiple is turned on, and we weren't selected, we just
             // want to select ourselves.
             target.addStyleClass("selected");
-            this._showCategory(target.category);
+            this.showCategory(target.category);
         }
     },
 
     _updateFilter: function(e)
     {
-        var isMac = InspectorController.platform().indexOf("mac-") === 0;
+        var isMac = WebInspector.isMac();
         var selectMultiple = false;
         if (isMac && e.metaKey && !e.ctrlKey && !e.altKey && !e.shiftKey)
             selectMultiple = true;
@@ -191,83 +204,21 @@ WebInspector.AbstractTimelinePanel.prototype = {
         this.containerElement.scrollTop = 0;
     },
 
-    _createGraph: function()
-    {
-        this._containerContentElement = document.createElement("div");
-        this._containerContentElement.id = "resources-container-content";
-        this.containerElement.appendChild(this._containerContentElement);
-
-        this.summaryBar = new WebInspector.SummaryBar(this.categories);
-        this.summaryBar.element.id = "resources-summary";
-        this._containerContentElement.appendChild(this.summaryBar.element);
-
-        this.itemsGraphsElement = document.createElement("div");
-        this.itemsGraphsElement.id = "resources-graphs";
-        this._containerContentElement.appendChild(this.itemsGraphsElement);
-
-        this.dividersElement = document.createElement("div");
-        this.dividersElement.id = "resources-dividers";
-        this._containerContentElement.appendChild(this.dividersElement);
-
-        this.eventDividersElement = document.createElement("div");
-        this.eventDividersElement.id = "resources-event-dividers";
-        this._containerContentElement.appendChild(this.eventDividersElement);
-
-        this.dividersLabelBarElement = document.createElement("div");
-        this.dividersLabelBarElement.id = "resources-dividers-label-bar";
-        this._containerContentElement.appendChild(this.dividersLabelBarElement);
-    },
-
     updateGraphDividersIfNeeded: function(force)
     {
         if (!this.visible) {
             this.needsRefresh = true;
             return false;
         }
-
-        if (document.body.offsetWidth <= 0) {
-            // The stylesheet hasn't loaded yet or the window is closed,
-            // so we can't calculate what is need. Return early.
-            return false;
-        }
-
-        var dividerCount = Math.round(this.dividersElement.offsetWidth / 64);
-        var slice = this.calculator.boundarySpan / dividerCount;
-        if (!force && this._currentDividerSlice === slice)
-            return false;
-
-        this._currentDividerSlice = slice;
-
-        this.dividersElement.removeChildren();
-        this.eventDividersElement.removeChildren();
-        this.dividersLabelBarElement.removeChildren();
-
-        for (var i = 1; i <= dividerCount; ++i) {
-            var divider = document.createElement("div");
-            divider.className = "resources-divider";
-            if (i === dividerCount)
-                divider.addStyleClass("last");
-            divider.style.left = ((i / dividerCount) * 100) + "%";
-
-            this.dividersElement.appendChild(divider.cloneNode());
-
-            var label = document.createElement("div");
-            label.className = "resources-divider-label";
-            if (!isNaN(slice))
-                label.textContent = this.calculator.formatValue(slice * i);
-            divider.appendChild(label);
-
-            this.dividersLabelBarElement.appendChild(divider);
-        }
+        return this._timelineGrid.updateDividers(force, this.calculator);
     },
 
     _updateDividersLabelBarPosition: function()
     {
-        var scrollTop = this.containerElement.scrollTop;
-        var dividersTop = (scrollTop < this.summaryBar.element.offsetHeight ? this.summaryBar.element.offsetHeight : scrollTop);
-        this.dividersElement.style.top = scrollTop + "px";
-        this.eventDividersElement.style.top = scrollTop + "px";
-        this.dividersLabelBarElement.style.top = dividersTop + "px";
+        const scrollTop = this.containerElement.scrollTop;
+        const offsetHeight = this.summaryBar.element.offsetHeight;
+        const dividersTop = (scrollTop < offsetHeight ? offsetHeight : scrollTop);
+        this._timelineGrid.setScrollAndDividerTop(scrollTop, dividersTop);
     },
 
     get needsRefresh()
@@ -309,13 +260,20 @@ WebInspector.AbstractTimelinePanel.prototype = {
 
     resize: function()
     {
+        WebInspector.Panel.prototype.resize.call(this);
+
         this.updateGraphDividersIfNeeded();
     },
 
     updateMainViewWidth: function(width)
     {
         this._containerContentElement.style.left = width + "px";
-        this.updateGraphDividersIfNeeded();
+        this.resize();
+    },
+
+    invalidateAllItems: function()
+    {
+        this._staleItems = this._items.slice();
     },
 
     refresh: function()
@@ -323,21 +281,22 @@ WebInspector.AbstractTimelinePanel.prototype = {
         this.needsRefresh = false;
 
         var staleItemsLength = this._staleItems.length;
+
         var boundariesChanged = false;
 
         for (var i = 0; i < staleItemsLength; ++i) {
             var item = this._staleItems[i];
-            if (!item._itemTreeElement) {
+            if (!item._itemsTreeElement) {
                 // Create the timeline tree element and graph.
-                item._itemTreeElement = this.createItemTreeElement(item);
-                item._itemTreeElement._itemGraph = this.createItemGraph(item);
+                item._itemsTreeElement = this.createItemTreeElement(item);
+                item._itemsTreeElement._itemGraph = this.createItemGraph(item);
 
-                this.itemsTreeElement.appendChild(item._itemTreeElement);
-                this.itemsGraphsElement.appendChild(item._itemTreeElement._itemGraph.graphElement);
+                this.itemsTreeElement.appendChild(item._itemsTreeElement);
+                this.itemsGraphsElement.appendChild(item._itemsTreeElement._itemGraph.graphElement);
             }
 
-            if (item._itemTreeElement.refresh)
-                item._itemTreeElement.refresh();
+            if (item._itemsTreeElement.refresh)
+                item._itemsTreeElement.refresh();
 
             if (this.calculator.updateBoundaries(item))
                 boundariesChanged = true;
@@ -345,12 +304,14 @@ WebInspector.AbstractTimelinePanel.prototype = {
 
         if (boundariesChanged) {
             // The boundaries changed, so all item graphs are stale.
-            this._staleItems = this._items;
+            this._staleItems = this._items.slice();
             staleItemsLength = this._staleItems.length;
         }
 
+
+        const isBarOpaqueAtLeft = this.sidebarTree.selectedTreeElement && this.sidebarTree.selectedTreeElement.isBarOpaqueAtLeft;
         for (var i = 0; i < staleItemsLength; ++i)
-            this._staleItems[i]._itemTreeElement._itemGraph.refresh(this.calculator);
+            this._staleItems[i]._itemsTreeElement._itemGraph.refresh(this.calculator, isBarOpaqueAtLeft);
 
         this._staleItems = [];
 
@@ -394,7 +355,7 @@ WebInspector.AbstractTimelinePanel.prototype = {
         this._calculator = x;
         this._calculator.reset();
 
-        this._staleItems = this._items;
+        this._staleItems = this._items.slice();
         this.refresh();
     },
 
@@ -408,12 +369,12 @@ WebInspector.AbstractTimelinePanel.prototype = {
     {
         this._items.remove(item, true);
 
-        if (item._itemTreeElement) {
-            this.itemsTreeElement.removeChild(resource._itemTreeElement);
-            this.itemsGraphsElement.removeChild(resource._itemTreeElement._itemGraph.graphElement);
+        if (item._itemsTreeElement) {
+            this.itemsTreeElement.removeChild(item._itemsTreeElement);
+            this.itemsGraphsElement.removeChild(item._itemsTreeElement._itemGraph.graphElement);
         }
 
-        delete item._itemTreeElement;
+        delete item._itemsTreeElement;
         this.adjustScrollPosition();
     },
 
@@ -458,6 +419,11 @@ WebInspector.AbstractTimelinePanel.prototype = {
         // Prevent the container from being scrolled off the end.
         if ((this.containerElement.scrollTop + this.containerElement.offsetHeight) > this.sidebarElement.offsetHeight)
             this.containerElement.scrollTop = (this.sidebarElement.offsetHeight - this.containerElement.offsetHeight);
+    },
+
+    addEventDivider: function(divider)
+    {
+        this._timelineGrid.addEventDivider(divider);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/AuditCategories.js b/src/3rdparty/webkit/WebCore/inspector/front-end/AuditCategories.js
new file mode 100644
index 0000000000..01b5ff9964
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/AuditCategories.js
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.AuditCategories.PagePerformance = function() {
+    WebInspector.AuditCategory.call(this, WebInspector.AuditCategories.PagePerformance.AuditCategoryName);
+}
+
+WebInspector.AuditCategories.PagePerformance.AuditCategoryName = "Web Page Performance";
+
+WebInspector.AuditCategories.PagePerformance.prototype = {
+    initialize: function()
+    {
+        this.addRule(new WebInspector.AuditRules.UnusedCssRule(), WebInspector.AuditRule.Severity.Warning);
+        this.addRule(new WebInspector.AuditRules.CssInHeadRule(), WebInspector.AuditRule.Severity.Severe);
+        this.addRule(new WebInspector.AuditRules.StylesScriptsOrderRule(), WebInspector.AuditRule.Severity.Severe);
+    }
+}
+
+WebInspector.AuditCategories.PagePerformance.prototype.__proto__ = WebInspector.AuditCategory.prototype;
+
+WebInspector.AuditCategories.NetworkUtilization = function() {
+    WebInspector.AuditCategory.call(this, WebInspector.AuditCategories.NetworkUtilization.AuditCategoryName);
+}
+
+WebInspector.AuditCategories.NetworkUtilization.AuditCategoryName = "Network Utilization";
+
+WebInspector.AuditCategories.NetworkUtilization.prototype = {
+    initialize: function()
+    {
+        this.addRule(new WebInspector.AuditRules.GzipRule(), WebInspector.AuditRule.Severity.Severe);
+        this.addRule(new WebInspector.AuditRules.ImageDimensionsRule(), WebInspector.AuditRule.Severity.Warning);
+        this.addRule(new WebInspector.AuditRules.CookieSizeRule(400), WebInspector.AuditRule.Severity.Warning);
+        this.addRule(new WebInspector.AuditRules.StaticCookielessRule(5), WebInspector.AuditRule.Severity.Warning);
+        this.addRule(new WebInspector.AuditRules.CombineJsResourcesRule(2), WebInspector.AuditRule.Severity.Severe);
+        this.addRule(new WebInspector.AuditRules.CombineCssResourcesRule(2), WebInspector.AuditRule.Severity.Severe);
+        this.addRule(new WebInspector.AuditRules.MinimizeDnsLookupsRule(4), WebInspector.AuditRule.Severity.Warning);
+        this.addRule(new WebInspector.AuditRules.ParallelizeDownloadRule(4, 10, 0.5), WebInspector.AuditRule.Severity.Warning);
+        this.addRule(new WebInspector.AuditRules.BrowserCacheControlRule(), WebInspector.AuditRule.Severity.Severe);
+        this.addRule(new WebInspector.AuditRules.ProxyCacheControlRule(), WebInspector.AuditRule.Severity.Warning);
+    }
+}
+
+WebInspector.AuditCategories.NetworkUtilization.prototype.__proto__ = WebInspector.AuditCategory.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/AuditLauncherView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/AuditLauncherView.js
new file mode 100644
index 0000000000..b8af0b7f42
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/AuditLauncherView.js
@@ -0,0 +1,281 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.AuditLauncherView = function(categoriesById, runnerCallback)
+{
+    WebInspector.View.call(this);
+    this._categoriesById = categoriesById;
+    this._runnerCallback = runnerCallback;
+    this._categoryIdPrefix = "audit-category-item-";
+    this._auditRunning = false;
+
+    this.element.addStyleClass("audit-launcher-view");
+
+    this._contentElement = document.createElement("div");
+    this._contentElement.className = "audit-launcher-view-content";
+    this.element.appendChild(this._contentElement);
+
+    this._resetResourceCount();
+
+    function categorySortFunction(a, b)
+    {
+        var aTitle = a.displayName || "";
+        var bTitle = b.displayName || "";
+        return aTitle.localeCompare(bTitle);
+    }
+    var sortedCategories = [];
+    for (var id in this._categoriesById)
+        sortedCategories.push(this._categoriesById[id]);
+    sortedCategories.sort(categorySortFunction);
+
+    if (!sortedCategories.length) {
+        this._headerElement = document.createElement("h1");
+        this._headerElement.className = "no-audits";
+        this._headerElement.textContent = WebInspector.UIString("No audits to run");
+        this._contentElement.appendChild(this._headerElement);
+    } else
+        this._createLauncherUI(sortedCategories);
+}
+
+WebInspector.AuditLauncherView.prototype = {
+    updateResourceTrackingState: function(isTracking)
+    {
+        if (!this._auditPresentStateLabelElement)
+            return;
+
+        this._resetResourceCount();
+
+        if (isTracking) {
+            this._auditPresentStateLabelElement.nodeValue = WebInspector.UIString("Audit Present State");
+            this._auditPresentStateElement.disabled = false;
+            this._auditPresentStateElement.parentElement.removeStyleClass("disabled");
+        } else {
+            this._auditPresentStateLabelElement.nodeValue = WebInspector.UIString("Audit Present State (Resource Tracking must be enabled)");
+            this._auditPresentStateElement.disabled = true;
+            this._auditPresentStateElement.parentElement.addStyleClass("disabled");
+            this.auditReloadedStateElement.checked = true;
+        }
+    },
+
+    get totalResources()
+    {
+        return this._totalResources;
+    },
+
+    set totalResources(x)
+    {
+        if (this._totalResources === x)
+            return;
+        this._totalResources = x;
+        this._updateResourceProgress();
+    },
+
+    get loadedResources()
+    {
+        return this._loadedResources;
+    },
+
+    set loadedResources(x)
+    {
+        if (this._loadedResources === x)
+            return;
+        this._loadedResources = x;
+        this._updateResourceProgress();
+    },
+
+    _resetResourceCount: function()
+    {
+        this.loadedResources = 0;
+
+        // We never receive a resourceStarted notification for the main resource
+        // (see InspectorController.willSendRequest())
+        this.totalResources = 1;
+    },
+
+    resourceStarted: function(resource)
+    {
+        ++this.totalResources;
+    },
+
+    resourceFinished: function(resource)
+    {
+        ++this.loadedResources;
+    },
+
+    reset: function()
+    {
+        this._resetResourceCount();
+    },
+
+    _setAuditRunning: function(auditRunning)
+    {
+        if (this._auditRunning === auditRunning)
+            return;
+        this._auditRunning = auditRunning;
+        this._updateButton();
+        this._updateResourceProgress();
+    },
+
+    _launchButtonClicked: function(event)
+    {
+        var catIds = [];
+        var childNodes = this._categoriesElement.childNodes;
+        for (var id in this._categoriesById) {
+            if (this._categoriesById[id]._checkboxElement.checked)
+                catIds.push(id);
+        }
+        this._setAuditRunning(true);
+        this._runnerCallback(catIds, this._auditPresentStateElement.checked, this._setAuditRunning.bind(this, false));
+    },
+
+    _selectAllClicked: function(checkCategories)
+    {
+        var childNodes = this._categoriesElement.childNodes;
+        for (var i = 0, length = childNodes.length; i < length; ++i)
+            childNodes[i].firstChild.checked = checkCategories;
+        this._currentCategoriesCount = checkCategories ? this._totalCategoriesCount : 0;
+        this._updateButton();
+    },
+
+    _categoryClicked: function(event)
+    {
+        this._currentCategoriesCount += event.target.checked ? 1 : -1;
+        this._selectAllCheckboxElement.checked = this._currentCategoriesCount === this._totalCategoriesCount;
+        this._updateButton();
+    },
+
+    _createCategoryElement: function(title, id)
+    {
+        var labelElement = document.createElement("label");
+        labelElement.id = this._categoryIdPrefix + id;
+
+        var element = document.createElement("input");
+        element.type = "checkbox";
+        labelElement.appendChild(element);
+        labelElement.appendChild(document.createTextNode(title));
+
+        return labelElement;
+    },
+
+    _createLauncherUI: function(sortedCategories)
+    {
+        this._headerElement = document.createElement("h1");
+        this._headerElement.textContent = WebInspector.UIString("Select audits to run");
+        this._contentElement.appendChild(this._headerElement);
+
+        function handleSelectAllClick(event)
+        {
+            this._selectAllClicked(event.target.checked);
+        }
+        var categoryElement = this._createCategoryElement(WebInspector.UIString("Select All"), "");
+        categoryElement.id = "audit-launcher-selectall";
+        this._selectAllCheckboxElement = categoryElement.firstChild;
+        this._selectAllCheckboxElement.checked = true;
+        this._selectAllCheckboxElement.addEventListener("click", handleSelectAllClick.bind(this), false);
+        this._contentElement.appendChild(categoryElement);
+
+        this._categoriesElement = document.createElement("div");
+        this._categoriesElement.className = "audit-categories-container";
+        this._contentElement.appendChild(this._categoriesElement);
+
+        var boundCategoryClickListener = this._categoryClicked.bind(this);
+
+        for (var i = 0; i < sortedCategories.length; ++i) {
+            categoryElement = this._createCategoryElement(sortedCategories[i].displayName, sortedCategories[i].id);
+            categoryElement.firstChild.addEventListener("click", boundCategoryClickListener, false);
+            sortedCategories[i]._checkboxElement = categoryElement.firstChild;
+            this._categoriesElement.appendChild(categoryElement);
+        }
+
+        this._totalCategoriesCount = this._categoriesElement.childNodes.length;
+        this._currentCategoriesCount = 0;
+
+        this._buttonContainerElement = document.createElement("div");
+        this._buttonContainerElement.className = "button-container";
+
+        var labelElement = document.createElement("label");
+        this._auditPresentStateElement = document.createElement("input");
+        this._auditPresentStateElement.name = "audit-mode";
+        this._auditPresentStateElement.type = "radio";
+        this._auditPresentStateElement.checked = true;
+        this._auditPresentStateLabelElement = document.createTextNode("");
+        labelElement.appendChild(this._auditPresentStateElement);
+        labelElement.appendChild(this._auditPresentStateLabelElement);
+        this._buttonContainerElement.appendChild(labelElement);
+
+        labelElement = document.createElement("label");
+        this.auditReloadedStateElement = document.createElement("input");
+        this.auditReloadedStateElement.name = "audit-mode";
+        this.auditReloadedStateElement.type = "radio";
+        labelElement.appendChild(this.auditReloadedStateElement);
+        labelElement.appendChild(document.createTextNode("Reload Page and Audit on Load"));
+        this._buttonContainerElement.appendChild(labelElement);
+
+        this._launchButton = document.createElement("button");
+        this._launchButton.type = "button";
+        this._launchButton.textContent = WebInspector.UIString("Run");
+        this._launchButton.addEventListener("click", this._launchButtonClicked.bind(this), false);
+        this._buttonContainerElement.appendChild(this._launchButton);
+
+        this._resourceProgressContainer = document.createElement("span");
+        this._resourceProgressContainer.className = "resource-progress";
+        var resourceProgressImage = document.createElement("img");
+        this._resourceProgressContainer.appendChild(resourceProgressImage);
+        this._resourceProgressTextElement = document.createElement("span");
+        this._resourceProgressContainer.appendChild(this._resourceProgressTextElement);
+        this._buttonContainerElement.appendChild(this._resourceProgressContainer);
+
+        this._contentElement.appendChild(this._buttonContainerElement);
+
+        this._selectAllClicked(this._selectAllCheckboxElement.checked);
+        this.updateResourceTrackingState();
+        this._updateButton();
+    },
+
+    _updateResourceProgress: function()
+    {
+        if (!this._resourceProgressContainer)
+            return;
+
+        if (!this._auditRunning)
+            this._resourceProgressContainer.addStyleClass("hidden");
+        else {
+            this._resourceProgressContainer.removeStyleClass("hidden");
+            this._resourceProgressTextElement.textContent = WebInspector.UIString("Loading (%d of %d)", this.loadedResources, this.totalResources);
+        }
+    },
+
+    _updateButton: function()
+    {
+        this._launchButton.disabled = !this._currentCategoriesCount || this._auditRunning;
+    }
+}
+
+WebInspector.AuditLauncherView.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/AuditResultView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/AuditResultView.js
new file mode 100644
index 0000000000..0f43d24e24
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/AuditResultView.js
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.AuditResultView = function(categoryResults)
+{
+    WebInspector.View.call(this);
+    this.element.className = "audit-result-view";
+
+    for (var i = 0; i < categoryResults.length; ++i)
+        this.element.appendChild(new WebInspector.AuditCategoryResultPane(categoryResults[i]).element);
+}
+
+WebInspector.AuditResultView.prototype.__proto__ = WebInspector.View.prototype;
+
+
+WebInspector.AuditCategoryResultPane = function(categoryResult)
+{
+    WebInspector.SidebarPane.call(this, categoryResult.title);
+    var treeOutlineElement = document.createElement("ol");
+    this.bodyElement.addStyleClass("audit-result-tree");
+    this.bodyElement.appendChild(treeOutlineElement);
+
+    this._treeOutline = new TreeOutline(treeOutlineElement);
+    this._treeOutline.expandTreeElementsWhenArrowing = true;
+    for (var i = 0; i < categoryResult.ruleResults.length; ++i) {
+        var ruleResult = categoryResult.ruleResults[i];
+        var treeElement = this._appendResult(this._treeOutline, ruleResult);
+        treeElement.listItemElement.addStyleClass("audit-result");
+
+        if (ruleResult.severity) {
+            var severityElement = document.createElement("img");
+            severityElement.className = "severity-" + ruleResult.severity;
+            treeElement.listItemElement.appendChild(severityElement);
+        }
+    }
+    this.expand();
+}
+
+WebInspector.AuditCategoryResultPane.prototype = {
+    _appendResult: function(parentTreeElement, result)
+    {
+        var title = result.value;
+        if (result.violationCount)
+            title = String.sprintf("%s (%d)", title, result.violationCount);
+
+        var treeElement = new TreeElement(title, null, !!result.children);
+        parentTreeElement.appendChild(treeElement);
+
+        if (result.className)
+            treeElement.listItemElement.addStyleClass(result.className);
+        if (result.children) {
+            for (var i = 0; i < result.children.length; ++i)
+                this._appendResult(treeElement, result.children[i]);
+        }
+        if (result.expanded) {
+            treeElement.listItemElement.removeStyleClass("parent");
+            treeElement.listItemElement.addStyleClass("parent-expanded");
+            treeElement.expand();
+        }
+        return treeElement;
+    }
+}
+
+WebInspector.AuditCategoryResultPane.prototype.__proto__ = WebInspector.SidebarPane.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/AuditRules.js b/src/3rdparty/webkit/WebCore/inspector/front-end/AuditRules.js
new file mode 100644
index 0000000000..c61f2c113d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/AuditRules.js
@@ -0,0 +1,1023 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.AuditRules.IPAddressRegexp = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+
+WebInspector.AuditRules.CacheableResponseCodes =
+{
+    200: true,
+    203: true,
+    206: true,
+    300: true,
+    301: true,
+    410: true,
+
+    304: true // Underlying resource is cacheable
+}
+
+WebInspector.AuditRules.getDomainToResourcesMap = function(resources, types, regexp, needFullResources)
+{
+    var domainToResourcesMap = {};
+    for (var i = 0, size = resources.length; i < size; ++i) {
+        var resource = resources[i];
+        if (types && types.indexOf(resource.type) === -1)
+            continue;
+        var match = resource.url.match(regexp);
+        if (!match)
+            continue;
+        var domain = match[2];
+        var domainResources = domainToResourcesMap[domain];
+        if (domainResources === undefined) {
+          domainResources = [];
+          domainToResourcesMap[domain] = domainResources;
+        }
+        domainResources.push(needFullResources ? resource : resource.url);
+    }
+    return domainToResourcesMap;
+}
+
+WebInspector.AuditRules.evaluateInTargetWindow = function(func, args, callback)
+{
+    InjectedScriptAccess.getDefault().evaluateOnSelf(func.toString(), args, callback);
+}
+
+
+WebInspector.AuditRules.GzipRule = function()
+{
+    WebInspector.AuditRule.call(this, "network-gzip", "Enable gzip compression");
+}
+
+WebInspector.AuditRules.GzipRule.prototype = {
+    doRun: function(resources, result, callback)
+    {
+        var totalSavings = 0;
+        var compressedSize = 0;
+        var candidateSize = 0;
+        var summary = result.addChild("", true);
+        for (var i = 0, length = resources.length; i < length; ++i) {
+            var resource = resources[i];
+            if (this._shouldCompress(resource)) {
+                var size = resource.resourceSize;
+                candidateSize += size;
+                if (this._isCompressed(resource)) {
+                    compressedSize += size;
+                    continue;
+                }
+                var savings = 2 * size / 3;
+                totalSavings += savings;
+                summary.addChild(String.sprintf("%s could save ~%s", WebInspector.linkifyURL(resource.url), Number.bytesToString(savings)));
+                result.violationCount++;
+            }
+        }
+        if (!totalSavings)
+            return callback(null);
+        summary.value = String.sprintf("Compressing the following resources with gzip could reduce their transfer size by about two thirds (~%s):", Number.bytesToString(totalSavings));
+        callback(result);
+    },
+
+    _isCompressed: function(resource)
+    {
+        var encoding = resource.responseHeaders["Content-Encoding"];
+        return encoding === "gzip" || encoding === "deflate";
+    },
+
+    _shouldCompress: function(resource)
+    {
+        return WebInspector.Resource.Type.isTextType(resource.type) && resource.domain && resource.resourceSize !== undefined && resource.resourceSize > 150;
+    }
+}
+
+WebInspector.AuditRules.GzipRule.prototype.__proto__ = WebInspector.AuditRule.prototype;
+
+
+WebInspector.AuditRules.CombineExternalResourcesRule = function(id, name, type, resourceTypeName, allowedPerDomain)
+{
+    WebInspector.AuditRule.call(this, id, name);
+    this._type = type;
+    this._resourceTypeName = resourceTypeName;
+    this._allowedPerDomain = allowedPerDomain;
+}
+
+WebInspector.AuditRules.CombineExternalResourcesRule.prototype = {
+    doRun: function(resources, result, callback)
+    {
+        var domainToResourcesMap = WebInspector.AuditRules.getDomainToResourcesMap(resources, [this._type], WebInspector.URLRegExp);
+        var penalizedResourceCount = 0;
+        // TODO: refactor according to the chosen i18n approach
+        var summary = result.addChild("", true);
+        for (var domain in domainToResourcesMap) {
+            var domainResources = domainToResourcesMap[domain];
+            var extraResourceCount = domainResources.length - this._allowedPerDomain;
+            if (extraResourceCount <= 0)
+                continue;
+            penalizedResourceCount += extraResourceCount - 1;
+            summary.addChild(String.sprintf("%d %s resources served from %s.", domainResources.length, this._resourceTypeName, domain));
+            result.violationCount += domainResources.length;
+        }
+        if (!penalizedResourceCount)
+            return callback(null);
+
+        summary.value = "There are multiple resources served from same domain. Consider combining them into as few files as possible.";
+        callback(result);
+    }
+}
+
+WebInspector.AuditRules.CombineExternalResourcesRule.prototype.__proto__ = WebInspector.AuditRule.prototype;
+
+
+WebInspector.AuditRules.CombineJsResourcesRule = function(allowedPerDomain) {
+    WebInspector.AuditRules.CombineExternalResourcesRule.call(this, "page-externaljs", "Combine external JavaScript", WebInspector.Resource.Type.Script, "JavaScript", allowedPerDomain);
+}
+
+WebInspector.AuditRules.CombineJsResourcesRule.prototype.__proto__ = WebInspector.AuditRules.CombineExternalResourcesRule.prototype;
+
+
+WebInspector.AuditRules.CombineCssResourcesRule = function(allowedPerDomain) {
+    WebInspector.AuditRules.CombineExternalResourcesRule.call(this, "page-externalcss", "Combine external CSS", WebInspector.Resource.Type.Stylesheet, "CSS", allowedPerDomain);
+}
+
+WebInspector.AuditRules.CombineCssResourcesRule.prototype.__proto__ = WebInspector.AuditRules.CombineExternalResourcesRule.prototype;
+
+
+WebInspector.AuditRules.MinimizeDnsLookupsRule = function(hostCountThreshold) {
+    WebInspector.AuditRule.call(this, "network-minimizelookups", "Minimize DNS lookups");
+    this._hostCountThreshold = hostCountThreshold;
+}
+
+WebInspector.AuditRules.MinimizeDnsLookupsRule.prototype = {
+    doRun: function(resources, result, callback)
+    {
+        var summary = result.addChild("");
+        var domainToResourcesMap = WebInspector.AuditRules.getDomainToResourcesMap(resources, undefined, WebInspector.URLRegExp);
+        for (var domain in domainToResourcesMap) {
+            if (domainToResourcesMap[domain].length > 1)
+                continue;
+            var match = domain.match(WebInspector.URLRegExp);
+            if (!match)
+                continue;
+            if (!match[2].search(WebInspector.AuditRules.IPAddressRegexp))
+                continue; // an IP address
+            summary.addSnippet(match[2]);
+            result.violationCount++;
+        }
+        if (!summary.children || summary.children.length <= this._hostCountThreshold)
+            return callback(null);
+
+        summary.value = "The following domains only serve one resource each. If possible, avoid the extra DNS lookups by serving these resources from existing domains.";
+        callback(result);
+    }
+}
+
+WebInspector.AuditRules.MinimizeDnsLookupsRule.prototype.__proto__ = WebInspector.AuditRule.prototype;
+
+
+WebInspector.AuditRules.ParallelizeDownloadRule = function(optimalHostnameCount, minRequestThreshold, minBalanceThreshold)
+{
+    WebInspector.AuditRule.call(this, "network-parallelizehosts", "Parallelize downloads across hostnames");
+    this._optimalHostnameCount = optimalHostnameCount;
+    this._minRequestThreshold = minRequestThreshold;
+    this._minBalanceThreshold = minBalanceThreshold;
+}
+
+
+WebInspector.AuditRules.ParallelizeDownloadRule.prototype = {
+    doRun: function(resources, result, callback)
+    {
+        function hostSorter(a, b)
+        {
+            var aCount = domainToResourcesMap[a].length;
+            var bCount = domainToResourcesMap[b].length;
+            return (aCount < bCount) ? 1 : (aCount == bCount) ? 0 : -1;
+        }
+
+        var domainToResourcesMap = WebInspector.AuditRules.getDomainToResourcesMap(
+            resources,
+            [WebInspector.Resource.Type.Stylesheet, WebInspector.Resource.Type.Image],
+            WebInspector.URLRegExp,
+            true);
+
+        var hosts = [];
+        for (var url in domainToResourcesMap)
+            hosts.push(url);
+
+        if (!hosts.length)
+            return callback(null); // no hosts (local file or something)
+
+        hosts.sort(hostSorter);
+
+        var optimalHostnameCount = this._optimalHostnameCount;
+        if (hosts.length > optimalHostnameCount)
+            hosts.splice(optimalHostnameCount);
+
+        var busiestHostResourceCount = domainToResourcesMap[hosts[0]].length;
+        var resourceCountAboveThreshold = busiestHostResourceCount - this._minRequestThreshold;
+        if (resourceCountAboveThreshold <= 0)
+            return callback(null);
+
+        var avgResourcesPerHost = 0;
+        for (var i = 0, size = hosts.length; i < size; ++i)
+            avgResourcesPerHost += domainToResourcesMap[hosts[i]].length;
+
+        // Assume optimal parallelization.
+        avgResourcesPerHost /= optimalHostnameCount;
+        avgResourcesPerHost = Math.max(avgResourcesPerHost, 1);
+
+        var pctAboveAvg = (resourceCountAboveThreshold / avgResourcesPerHost) - 1.0;
+        var minBalanceThreshold = this._minBalanceThreshold;
+        if (pctAboveAvg < minBalanceThreshold)
+            return callback(null);
+
+        var resourcesOnBusiestHost = domainToResourcesMap[hosts[0]];
+        var entry = result.addChild(String.sprintf("This page makes %d parallelizable requests to %s. Increase download parallelization by distributing the following requests across multiple hostnames.", busiestHostResourceCount, hosts[0]), true);
+        for (var i = 0; i < resourcesOnBusiestHost.length; ++i)
+            entry.addURL(resourcesOnBusiestHost[i].url);
+
+        result.violationCount = resourcesOnBusiestHost.length;
+        callback(result);
+    }
+}
+
+WebInspector.AuditRules.ParallelizeDownloadRule.prototype.__proto__ = WebInspector.AuditRule.prototype;
+
+
+// The reported CSS rule size is incorrect (parsed != original in WebKit),
+// so use percentages instead, which gives a better approximation.
+WebInspector.AuditRules.UnusedCssRule = function()
+{
+    WebInspector.AuditRule.call(this, "page-unusedcss", "Remove unused CSS rules");
+}
+
+WebInspector.AuditRules.UnusedCssRule.prototype = {
+    doRun: function(resources, result, callback)
+    {
+        var self = this;
+        function evalCallback(styleSheets) {
+            if (!styleSheets.length)
+                return callback(null);
+
+            var pseudoSelectorRegexp = /:hover|:link|:active|:visited|:focus|:before|:after/;
+            var selectors = [];
+            var testedSelectors = {};
+            for (var i = 0; i < styleSheets.length; ++i) {
+                var styleSheet = styleSheets[i];
+                for (var curRule = 0; curRule < styleSheet.cssRules.length; ++curRule) {
+                    var rule = styleSheet.cssRules[curRule];
+                    if (rule.selectorText.match(pseudoSelectorRegexp))
+                        continue;
+                    selectors.push(rule.selectorText);
+                    testedSelectors[rule.selectorText] = 1;
+                }
+            }
+
+            function selectorsCallback(callback, styleSheets, testedSelectors, foundSelectors)
+            {
+                var inlineBlockOrdinal = 0;
+                var totalStylesheetSize = 0;
+                var totalUnusedStylesheetSize = 0;
+                var summary;
+
+                for (var i = 0; i < styleSheets.length; ++i) {
+                    var styleSheet = styleSheets[i];
+                    var stylesheetSize = 0;
+                    var unusedStylesheetSize = 0;
+                    var unusedRules = [];
+                    for (var curRule = 0; curRule < styleSheet.cssRules.length; ++curRule) {
+                        var rule = styleSheet.cssRules[curRule];
+                        var textLength = rule.cssText ? rule.cssText.length : 0;
+                        stylesheetSize += textLength;
+                        if (!testedSelectors[rule.selectorText] || foundSelectors[rule.selectorText])
+                            continue;
+                        unusedStylesheetSize += textLength;
+                        unusedRules.push(rule.selectorText);
+                    }
+                    totalStylesheetSize += stylesheetSize;
+                    totalUnusedStylesheetSize += unusedStylesheetSize;
+
+                    if (!unusedRules.length)
+                        continue;
+
+                    var url = styleSheet.href ? WebInspector.linkifyURL(styleSheet.href) : String.sprintf("Inline block #%d", ++inlineBlockOrdinal);
+                    var pctUnused = Math.round(100 * unusedStylesheetSize / stylesheetSize);
+                    if (!summary)
+                        summary = result.addChild("", true);
+                    var entry = summary.addChild(String.sprintf("%s: %d%% (estimated) is not used by the current page.", url, pctUnused));
+
+                    for (var j = 0; j < unusedRules.length; ++j)
+                        entry.addSnippet(unusedRules[j]);
+
+                    result.violationCount += unusedRules.length;
+                }
+
+                if (!totalUnusedStylesheetSize)
+                    return callback(null);
+
+                var totalUnusedPercent = Math.round(100 * totalUnusedStylesheetSize / totalStylesheetSize);
+                summary.value = String.sprintf("%d%% of CSS (estimated) is not used by the current page.", totalUnusedPercent);
+
+                callback(result);
+            }
+
+            function routine(selectorArray)
+            {
+                var result = {};
+                for (var i = 0; i < selectorArray.length; ++i) {
+                    var nodes = document.querySelectorAll(selectorArray[i]);
+                    if (nodes && nodes.length)
+                        result[selectorArray[i]] = true;
+                }
+                return result;
+            }
+
+            WebInspector.AuditRules.evaluateInTargetWindow(routine, [selectors], selectorsCallback.bind(null, callback, styleSheets, testedSelectors));
+        }
+
+        function routine()
+        {
+            var styleSheets = document.styleSheets;
+            if (!styleSheets)
+                return false;
+
+            return routineResult;
+        }
+
+        InspectorBackend.getAllStyles(WebInspector.Callback.wrap(evalCallback));
+    }
+}
+
+WebInspector.AuditRules.UnusedCssRule.prototype.__proto__ = WebInspector.AuditRule.prototype;
+
+
+WebInspector.AuditRules.CacheControlRule = function(id, name)
+{
+    WebInspector.AuditRule.call(this, id, name);
+}
+
+WebInspector.AuditRules.CacheControlRule.MillisPerMonth = 1000 * 60 * 60 * 24 * 30;
+
+WebInspector.AuditRules.CacheControlRule.prototype = {
+
+    doRun: function(resources, result, callback)
+    {
+        var cacheableAndNonCacheableResources = this._cacheableAndNonCacheableResources(resources);
+        if (cacheableAndNonCacheableResources[0].length)
+            this.runChecks(cacheableAndNonCacheableResources[0], result);
+        this.handleNonCacheableResources(cacheableAndNonCacheableResources[1], result);
+
+        callback(result);
+    },
+
+    handleNonCacheableResources: function()
+    {
+    },
+
+    _cacheableAndNonCacheableResources: function(resources)
+    {
+        var processedResources = [[], []];
+        for (var i = 0; i < resources.length; ++i) {
+            var resource = resources[i];
+            if (!this.isCacheableResource(resource))
+                continue;
+            if (this._isExplicitlyNonCacheable(resource))
+                processedResources[1].push(resource);
+            else
+                processedResources[0].push(resource);
+        }
+        return processedResources;
+    },
+
+    execCheck: function(messageText, resourceCheckFunction, resources, result)
+    {
+        var resourceCount = resources.length;
+        var urls = [];
+        for (var i = 0; i < resourceCount; ++i) {
+            if (resourceCheckFunction.call(this, resources[i]))
+                urls.push(resources[i].url);
+        }
+        if (urls.length) {
+            var entry = result.addChild(messageText, true);
+            entry.addURLs(urls);
+            result.violationCount += urls.length;
+        }
+    },
+
+    freshnessLifetimeGreaterThan: function(resource, timeMs)
+    {
+        var dateHeader = this.responseHeader(resource, "Date");
+        if (!dateHeader)
+            return false;
+
+        var dateHeaderMs = Date.parse(dateHeader);
+        if (isNaN(dateHeaderMs))
+            return false;
+
+        var freshnessLifetimeMs;
+        var maxAgeMatch = this.responseHeaderMatch(resource, "Cache-Control", "max-age=(\\d+)");
+
+        if (maxAgeMatch)
+            freshnessLifetimeMs = (maxAgeMatch[1]) ? 1000 * maxAgeMatch[1] : 0;
+        else {
+            var expiresHeader = this.responseHeader(resource, "Expires");
+            if (expiresHeader) {
+                var expDate = Date.parse(expiresHeader);
+                if (!isNaN(expDate))
+                    freshnessLifetimeMs = expDate - dateHeaderMs;
+            }
+        }
+
+        return (isNaN(freshnessLifetimeMs)) ? false : freshnessLifetimeMs > timeMs;
+    },
+
+    responseHeader: function(resource, header)
+    {
+        return resource.responseHeaders[header];
+    },
+
+    hasResponseHeader: function(resource, header)
+    {
+        return resource.responseHeaders[header] !== undefined;
+    },
+
+    isCompressible: function(resource)
+    {
+        return WebInspector.Resource.Type.isTextType(resource.type);
+    },
+
+    isPubliclyCacheable: function(resource)
+    {
+        if (this._isExplicitlyNonCacheable(resource))
+            return false;
+
+        if (this.responseHeaderMatch(resource, "Cache-Control", "public"))
+            return true;
+
+        return resource.url.indexOf("?") == -1 && !this.responseHeaderMatch(resource, "Cache-Control", "private");
+    },
+
+    responseHeaderMatch: function(resource, header, regexp)
+    {
+        return resource.responseHeaders[header]
+            ? resource.responseHeaders[header].match(new RegExp(regexp, "im"))
+            : undefined;
+    },
+
+    hasExplicitExpiration: function(resource)
+    {
+        return this.hasResponseHeader(resource, "Date") &&
+            (this.hasResponseHeader(resource, "Expires") || this.responseHeaderMatch(resource, "Cache-Control", "max-age"));
+    },
+
+    _isExplicitlyNonCacheable: function(resource)
+    {
+        var hasExplicitExp = this.hasExplicitExpiration(resource);
+        return this.responseHeaderMatch(resource, "Cache-Control", "(no-cache|no-store|must-revalidate)") ||
+            this.responseHeaderMatch(resource, "Pragma", "no-cache") ||
+            (hasExplicitExp && !this.freshnessLifetimeGreaterThan(resource, 0)) ||
+            (!hasExplicitExp && resource.url && resource.url.indexOf("?") >= 0) ||
+            (!hasExplicitExp && !this.isCacheableResource(resource));
+    },
+
+    isCacheableResource: function(resource)
+    {
+        return resource.statusCode !== undefined && WebInspector.AuditRules.CacheableResponseCodes[resource.statusCode];
+    }
+}
+
+WebInspector.AuditRules.CacheControlRule.prototype.__proto__ = WebInspector.AuditRule.prototype;
+
+
+WebInspector.AuditRules.BrowserCacheControlRule = function()
+{
+    WebInspector.AuditRules.CacheControlRule.call(this, "http-browsercache", "Leverage browser caching");
+}
+
+WebInspector.AuditRules.BrowserCacheControlRule.prototype = {
+    handleNonCacheableResources: function(resources, result)
+    {
+        if (resources.length) {
+            var entry = result.addChild("The following resources are explicitly non-cacheable. Consider making them cacheable if possible:", true);
+            result.violationCount += resources.length;
+            for (var i = 0; i < resources.length; ++i)
+                entry.addURL(resources[i].url);
+        }
+    },
+
+    runChecks: function(resources, result, callback)
+    {
+        this.execCheck("The following resources are missing a cache expiration. Resources that do not specify an expiration may not be cached by browsers:",
+            this._missingExpirationCheck, resources, result);
+        this.execCheck("The following resources specify a \"Vary\" header that disables caching in most versions of Internet Explorer:",
+            this._varyCheck, resources, result);
+        this.execCheck("The following cacheable resources have a short freshness lifetime:",
+            this._oneMonthExpirationCheck, resources, result);
+
+        // Unable to implement the favicon check due to the WebKit limitations.
+        this.execCheck("To further improve cache hit rate, specify an expiration one year in the future for the following cacheable resources:",
+            this._oneYearExpirationCheck, resources, result);
+    },
+
+    _missingExpirationCheck: function(resource)
+    {
+        return this.isCacheableResource(resource) && !this.hasResponseHeader(resource, "Set-Cookie") && !this.hasExplicitExpiration(resource);
+    },
+
+    _varyCheck: function(resource)
+    {
+        var varyHeader = this.responseHeader(resource, "Vary");
+        if (varyHeader) {
+            varyHeader = varyHeader.replace(/User-Agent/gi, "");
+            varyHeader = varyHeader.replace(/Accept-Encoding/gi, "");
+            varyHeader = varyHeader.replace(/[, ]*/g, "");
+        }
+        return varyHeader && varyHeader.length && this.isCacheableResource(resource) && this.freshnessLifetimeGreaterThan(resource, 0);
+    },
+
+    _oneMonthExpirationCheck: function(resource)
+    {
+        return this.isCacheableResource(resource) &&
+            !this.hasResponseHeader(resource, "Set-Cookie") &&
+            !this.freshnessLifetimeGreaterThan(resource, WebInspector.AuditRules.CacheControlRule.MillisPerMonth) &&
+            this.freshnessLifetimeGreaterThan(resource, 0);
+    },
+
+    _oneYearExpirationCheck: function(resource)
+    {
+        return this.isCacheableResource(resource) &&
+            !this.hasResponseHeader(resource, "Set-Cookie") &&
+            !this.freshnessLifetimeGreaterThan(resource, 11 * WebInspector.AuditRules.CacheControlRule.MillisPerMonth) &&
+            this.freshnessLifetimeGreaterThan(resource, WebInspector.AuditRules.CacheControlRule.MillisPerMonth);
+    }
+}
+
+WebInspector.AuditRules.BrowserCacheControlRule.prototype.__proto__ = WebInspector.AuditRules.CacheControlRule.prototype;
+
+
+WebInspector.AuditRules.ProxyCacheControlRule = function() {
+    WebInspector.AuditRules.CacheControlRule.call(this, "http-proxycache", "Leverage proxy caching");
+}
+
+WebInspector.AuditRules.ProxyCacheControlRule.prototype = {
+    runChecks: function(resources, result, callback)
+    {
+        this.execCheck("Resources with a \"?\" in the URL are not cached by most proxy caching servers:",
+            this._questionMarkCheck, resources, result);
+        this.execCheck("Consider adding a \"Cache-Control: public\" header to the following resources:",
+            this._publicCachingCheck, resources, result);
+        this.execCheck("The following publicly cacheable resources contain a Set-Cookie header. This security vulnerability can cause cookies to be shared by multiple users.",
+            this._setCookieCacheableCheck, resources, result);
+    },
+
+    _questionMarkCheck: function(resource)
+    {
+        return resource.url.indexOf("?") >= 0 && !this.hasResponseHeader(resource, "Set-Cookie") && this.isPubliclyCacheable(resource);
+    },
+
+    _publicCachingCheck: function(resource)
+    {
+        return this.isCacheableResource(resource) &&
+            !this.isCompressible(resource) &&
+            !this.responseHeaderMatch(resource, "Cache-Control", "public") &&
+            !this.hasResponseHeader(resource, "Set-Cookie");
+    },
+
+    _setCookieCacheableCheck: function(resource)
+    {
+        return this.hasResponseHeader(resource, "Set-Cookie") && this.isPubliclyCacheable(resource);
+    }
+}
+
+WebInspector.AuditRules.ProxyCacheControlRule.prototype.__proto__ = WebInspector.AuditRules.CacheControlRule.prototype;
+
+
+WebInspector.AuditRules.ImageDimensionsRule = function()
+{
+    WebInspector.AuditRule.call(this, "page-imagedims", "Specify image dimensions");
+}
+
+WebInspector.AuditRules.ImageDimensionsRule.prototype = {
+    doRun: function(resources, result, callback)
+    {
+        function doneCallback(context)
+        {
+            var map = context.urlToNoDimensionCount;
+            for (var url in map) {
+                var entry = entry || result.addChild("A width and height should be specified for all images in order to speed up page display. The following image(s) are missing a width and/or height:", true);
+                var value = WebInspector.linkifyURL(url);
+                if (map[url] > 1)
+                    value += String.sprintf(" (%d uses)", map[url]);
+                entry.addChild(value);
+                result.violationCount++;
+            }
+            callback(entry ? result : null);
+        }
+
+        function imageStylesReady(imageId, context, styles)
+        {
+            --context.imagesLeft;
+
+            const node = WebInspector.domAgent.nodeForId(imageId);
+            var src = node.getAttribute("src");
+            for (var frameOwnerCandidate = node; frameOwnerCandidate; frameOwnerCandidate = frameOwnerCandidate.parentNode) {
+                if (frameOwnerCandidate.documentURL) {
+                    var completeSrc = WebInspector.completeURL(frameOwnerCandidate.documentURL, src);
+                    break;
+                }
+            }
+            if (completeSrc)
+                src = completeSrc;
+
+            const computedStyle = new WebInspector.CSSStyleDeclaration(styles.computedStyle);
+            if (computedStyle.getPropertyValue("position") === "absolute") {
+                if (!context.imagesLeft)
+                    doneCallback(context);
+                return;
+            }
+
+            var widthFound = "width" in styles.styleAttributes;
+            var heightFound = "height" in styles.styleAttributes;
+
+            for (var i = styles.matchedCSSRules.length - 1; i >= 0 && !(widthFound && heightFound); --i) {
+                var style = WebInspector.CSSStyleDeclaration.parseRule(styles.matchedCSSRules[i]).style;
+                if (style.getPropertyValue("width") !== "")
+                    widthFound = true;
+                if (style.getPropertyValue("height") !== "")
+                    heightFound = true;
+            }
+            
+            if (!widthFound || !heightFound) {
+                if (src in context.urlToNoDimensionCount)
+                    ++context.urlToNoDimensionCount[src];
+                else
+                    context.urlToNoDimensionCount[src] = 1;
+            }
+
+            if (!context.imagesLeft)
+                doneCallback(context);
+        }
+
+        function receivedImages(imageIds)
+        {
+            if (!imageIds || !imageIds.length)
+                return callback(null);
+            var context = {imagesLeft: imageIds.length, urlToNoDimensionCount: {}};
+            for (var i = imageIds.length - 1; i >= 0; --i)
+                InspectorBackend.getStyles(WebInspector.Callback.wrap(imageStylesReady.bind(this, imageIds[i], context)), imageIds[i], true);
+        }
+
+        function pushImageNodes()
+        {
+            const nodeIds = [];
+            var nodes = document.getElementsByTagName("img");
+            for (var i = 0; i < nodes.length; ++i) {
+                if (!nodes[i].src)
+                    continue;
+                var nodeId = this.getNodeId(nodes[i]);
+                nodeIds.push(nodeId);
+            }
+            return nodeIds;
+        }
+
+        WebInspector.AuditRules.evaluateInTargetWindow(pushImageNodes, null, receivedImages);
+    }
+}
+
+WebInspector.AuditRules.ImageDimensionsRule.prototype.__proto__ = WebInspector.AuditRule.prototype;
+
+
+WebInspector.AuditRules.CssInHeadRule = function()
+{
+    WebInspector.AuditRule.call(this, "page-cssinhead", "Put CSS in the document head");
+}
+
+WebInspector.AuditRules.CssInHeadRule.prototype = {
+    doRun: function(resources, result, callback)
+    {
+        function evalCallback(evalResult, isException)
+        {
+            if (isException || !evalResult)
+                return callback(null);
+
+            var summary = result.addChild("");
+
+            var outputMessages = [];
+            for (var url in evalResult) {
+                var urlViolations = evalResult[url];
+                if (urlViolations[0])
+                    result.addChild(String.sprintf("%s style block(s) in the %s body should be moved to the document head.", urlViolations[0], WebInspector.linkifyURL(url)));
+                for (var i = 0; i < urlViolations[1].length; ++i)
+                    result.addChild(String.sprintf("Link node %s should be moved to the document head in %s", WebInspector.linkifyURL(urlViolations[1])), WebInspector.linkifyURL(url));
+                result.violationCount += urlViolations.length;
+            }
+            summary.value = String.sprintf("CSS in the document body adversely impacts rendering performance.");
+            callback(result);
+        }
+
+        function routine()
+        {
+            function allViews() {
+                var views = [document.defaultView];
+                var curView = 0;
+                while (curView < views.length) {
+                    var view = views[curView];
+                    var frames = view.frames;
+                    for (var i = 0; i < frames.length; ++i) {
+                        if (frames[i] !== view)
+                            views.push(frames[i]);
+                    }
+                    ++curView;
+                }
+                return views;
+            }
+
+            var views = allViews();
+            var urlToViolationsArray = {};
+            var found = false;
+            for (var i = 0; i < views.length; ++i) {
+                var view = views[i];
+                if (!view.document)
+                    continue;
+
+                var inlineStyles = view.document.querySelectorAll("body style");
+                var inlineStylesheets = view.document.querySelectorAll("body link[rel~='stylesheet'][href]");
+                if (!inlineStyles.length && !inlineStylesheets.length)
+                    continue;
+
+                found = true;
+                var inlineStylesheetHrefs = [];
+                for (var j = 0; j < inlineStylesheets.length; ++j)
+                    inlineStylesheetHrefs.push(inlineStylesheets[j].href);
+                urlToViolationsArray[view.location.href] = [inlineStyles.length, inlineStylesheetHrefs];
+            }
+            return found ? urlToViolationsArray : null;
+        }
+
+        WebInspector.AuditRules.evaluateInTargetWindow(routine, null, evalCallback);
+    }
+}
+
+WebInspector.AuditRules.CssInHeadRule.prototype.__proto__ = WebInspector.AuditRule.prototype;
+
+
+WebInspector.AuditRules.StylesScriptsOrderRule = function()
+{
+    WebInspector.AuditRule.call(this, "page-stylescriptorder", "Optimize the order of styles and scripts");
+}
+
+WebInspector.AuditRules.StylesScriptsOrderRule.prototype = {
+    doRun: function(resources, result, callback)
+    {
+        function evalCallback(resultValue, isException)
+        {
+            if (isException || !resultValue)
+                return callback(null);
+
+            var lateCssUrls = resultValue[0];
+            var cssBeforeInlineCount = resultValue[1];
+
+            var entry = result.addChild("The following external CSS files were included after an external JavaScript file in the document head. To ensure CSS files are downloaded in parallel, always include external CSS before external JavaScript.", true);
+            entry.addURLs(lateCssUrls);
+            result.violationCount += lateCssUrls.length;
+
+            if (cssBeforeInlineCount) {
+                result.addChild(String.sprintf(" %d inline script block%s found in the head between an external CSS file and another resource. To allow parallel downloading, move the inline script before the external CSS file, or after the next resource.", cssBeforeInlineCount, cssBeforeInlineCount > 1 ? "s were" : " was"));
+                result.violationCount += cssBeforeInlineCount;
+            }
+            callback(result);
+        }
+
+        function routine()
+        {
+            var lateStyles = document.querySelectorAll("head script[src] ~ link[rel~='stylesheet'][href]");
+            var cssBeforeInlineCount = document.querySelectorAll("head link[rel~='stylesheet'][href] ~ script:not([src])").length;
+            if (!lateStyles.length && !cssBeforeInlineCount)
+                return null;
+
+            var lateStyleUrls = [];
+            for (var i = 0; i < lateStyles.length; ++i)
+                lateStyleUrls.push(lateStyles[i].href);
+            return [ lateStyleUrls, cssBeforeInlineCount ];
+        }
+
+        WebInspector.AuditRules.evaluateInTargetWindow(routine, null, evalCallback.bind(this));
+    }
+}
+
+WebInspector.AuditRules.StylesScriptsOrderRule.prototype.__proto__ = WebInspector.AuditRule.prototype;
+
+
+WebInspector.AuditRules.CookieRuleBase = function(id, name)
+{
+    WebInspector.AuditRule.call(this, id, name);
+}
+
+WebInspector.AuditRules.CookieRuleBase.prototype = {
+    doRun: function(resources, result, callback)
+    {
+        var self = this;
+        function resultCallback(receivedCookies, isAdvanced) {
+            self.processCookies(isAdvanced ? receivedCookies : [], resources, result);
+            callback(result);
+        }
+        WebInspector.Cookies.getCookiesAsync(resultCallback);
+    },
+
+    mapResourceCookies: function(resourcesByDomain, allCookies, callback)
+    {
+        for (var i = 0; i < allCookies.length; ++i) {
+            for (var resourceDomain in resourcesByDomain) {
+                if (WebInspector.Cookies.cookieDomainMatchesResourceDomain(allCookies[i].domain, resourceDomain))
+                    this._callbackForResourceCookiePairs(resourcesByDomain[resourceDomain], allCookies[i], callback);
+            }
+        }
+    },
+
+    _callbackForResourceCookiePairs: function(resources, cookie, callback)
+    {
+        if (!resources)
+            return;
+        for (var i = 0; i < resources.length; ++i) {
+            if (WebInspector.Cookies.cookieMatchesResourceURL(cookie, resources[i].url))
+                callback(resources[i], cookie);
+        }
+    }
+}
+
+WebInspector.AuditRules.CookieRuleBase.prototype.__proto__ = WebInspector.AuditRule.prototype;
+
+
+WebInspector.AuditRules.CookieSizeRule = function(avgBytesThreshold)
+{
+    WebInspector.AuditRules.CookieRuleBase.call(this, "http-cookiesize", "Minimize cookie size");
+    this._avgBytesThreshold = avgBytesThreshold;
+    this._maxBytesThreshold = 1000;
+}
+
+WebInspector.AuditRules.CookieSizeRule.prototype = {
+    _average: function(cookieArray)
+    {
+        var total = 0;
+        for (var i = 0; i < cookieArray.length; ++i)
+            total += cookieArray[i].size;
+        return cookieArray.length ? Math.round(total / cookieArray.length) : 0;
+    },
+
+    _max: function(cookieArray)
+    {
+        var result = 0;
+        for (var i = 0; i < cookieArray.length; ++i)
+            result = Math.max(cookieArray[i].size, result);
+        return result;
+    },
+
+    processCookies: function(allCookies, resources, result)
+    {
+        function maxSizeSorter(a, b)
+        {
+            return b.maxCookieSize - a.maxCookieSize;
+        }
+
+        function avgSizeSorter(a, b)
+        {
+            return b.avgCookieSize - a.avgCookieSize;
+        }
+
+        var cookiesPerResourceDomain = {};
+
+        function collectorCallback(resource, cookie)
+        {
+            var cookies = cookiesPerResourceDomain[resource.domain];
+            if (!cookies) {
+                cookies = [];
+                cookiesPerResourceDomain[resource.domain] = cookies;
+            }
+            cookies.push(cookie);
+        }
+
+        if (!allCookies.length)
+            return;
+
+        var sortedCookieSizes = [];
+
+        var domainToResourcesMap = WebInspector.AuditRules.getDomainToResourcesMap(resources,
+                null,
+                WebInspector.URLRegExp,
+                true);
+        var matchingResourceData = {};
+        this.mapResourceCookies(domainToResourcesMap, allCookies, collectorCallback.bind(this));
+
+        for (var resourceDomain in cookiesPerResourceDomain) {
+            var cookies = cookiesPerResourceDomain[resourceDomain];
+            sortedCookieSizes.push({
+                domain: resourceDomain,
+                avgCookieSize: this._average(cookies),
+                maxCookieSize: this._max(cookies)
+            });
+        }
+        var avgAllCookiesSize = this._average(allCookies);
+
+        var hugeCookieDomains = [];
+        sortedCookieSizes.sort(maxSizeSorter);
+
+        for (var i = 0, len = sortedCookieSizes.length; i < len; ++i) {
+            var maxCookieSize = sortedCookieSizes[i].maxCookieSize;
+            if (maxCookieSize > this._maxBytesThreshold)
+                hugeCookieDomains.push(sortedCookieSizes[i].domain + ": " + Number.bytesToString(maxCookieSize));
+        }
+
+        var bigAvgCookieDomains = [];
+        sortedCookieSizes.sort(avgSizeSorter);
+        for (var i = 0, len = sortedCookieSizes.length; i < len; ++i) {
+            var domain = sortedCookieSizes[i].domain;
+            var avgCookieSize = sortedCookieSizes[i].avgCookieSize;
+            if (avgCookieSize > this._avgBytesThreshold && avgCookieSize < this._maxBytesThreshold)
+                bigAvgCookieDomains.push(domain + ": " + Number.bytesToString(avgCookieSize));
+        }
+        result.addChild(String.sprintf("The average cookie size for all requests on this page is %s", Number.bytesToString(avgAllCookiesSize)));
+
+        var message;
+        if (hugeCookieDomains.length) {
+            var entry = result.addChild("The following domains have a cookie size in excess of 1KB. This is harmful because requests with cookies larger than 1KB typically cannot fit into a single network packet.", true);
+            entry.addURLs(hugeCookieDomains);
+            result.violationCount += hugeCookieDomains.length;
+        }
+
+        if (bigAvgCookieDomains.length) {
+            var entry = result.addChild(String.sprintf("The following domains have an average cookie size in excess of %d bytes. Reducing the size of cookies for these domains can reduce the time it takes to send requests.", this._avgBytesThreshold), true);
+            entry.addURLs(bigAvgCookieDomains.length);
+            result.violationCount += bigAvgCookieDomains.length;
+        }
+    }
+}
+
+WebInspector.AuditRules.CookieSizeRule.prototype.__proto__ = WebInspector.AuditRules.CookieRuleBase.prototype;
+
+
+WebInspector.AuditRules.StaticCookielessRule = function(minResources)
+{
+    WebInspector.AuditRules.CookieRuleBase.call(this, "http-staticcookieless", "Serve static content from a cookieless domain");
+    this._minResources = minResources;
+}
+
+WebInspector.AuditRules.StaticCookielessRule.prototype = {
+    processCookies: function(allCookies, resources, result)
+    {
+        var domainToResourcesMap = WebInspector.AuditRules.getDomainToResourcesMap(resources,
+                [WebInspector.Resource.Type.Stylesheet,
+                 WebInspector.Resource.Type.Image],
+                WebInspector.URLRegExp,
+                true);
+        var totalStaticResources = 0;
+        for (var domain in domainToResourcesMap)
+            totalStaticResources += domainToResourcesMap[domain].length;
+        if (totalStaticResources < this._minResources)
+            return;
+        var matchingResourceData = {};
+        this.mapResourceCookies(domainToResourcesMap, allCookies, this._collectorCallback.bind(this, matchingResourceData));
+
+        var badUrls = [];
+        var cookieBytes = 0;
+        for (var url in matchingResourceData) {
+            badUrls.push(url);
+            cookieBytes += matchingResourceData[url]
+        }
+        if (badUrls.length < this._minResources)
+            return;
+
+        var entry = result.addChild(String.sprintf("%s of cookies were sent with the following static resources. Serve these static resources from a domain that does not set cookies:", Number.bytesToString(cookieBytes)), true);
+        entry.addURLs(badUrls);
+        result.violationCount = badUrls.length;
+    },
+
+    _collectorCallback: function(matchingResourceData, resource, cookie)
+    {
+        matchingResourceData[resource.url] = (matchingResourceData[resource.url] || 0) + cookie.size;
+    }
+}
+
+WebInspector.AuditRules.StaticCookielessRule.prototype.__proto__ = WebInspector.AuditRules.CookieRuleBase.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/AuditsPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/AuditsPanel.js
new file mode 100644
index 0000000000..8d3c396bba
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/AuditsPanel.js
@@ -0,0 +1,483 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.AuditsPanel = function()
+{
+    WebInspector.Panel.call(this);
+
+    this._constructCategories();
+
+    this.createSidebar();
+    this.auditsTreeElement = new WebInspector.SidebarSectionTreeElement("", {}, true);
+    this.sidebarTree.appendChild(this.auditsTreeElement);
+    this.auditsTreeElement.listItemElement.addStyleClass("hidden");
+    this.auditsTreeElement.expand();
+
+    this.auditsItemTreeElement = new WebInspector.AuditsSidebarTreeElement();
+    this.auditsTreeElement.appendChild(this.auditsItemTreeElement);
+
+    this.auditResultsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RESULTS"), {}, true);
+    this.sidebarTree.appendChild(this.auditResultsTreeElement);
+    this.auditResultsTreeElement.expand();
+
+    this.element.addStyleClass("audits");
+
+    this.clearResultsButton = new WebInspector.StatusBarButton(WebInspector.UIString("Clear audit results."), "clear-audit-results-status-bar-item");
+    this.clearResultsButton.addEventListener("click", this._clearButtonClicked.bind(this), false);
+
+    this.viewsContainerElement = document.createElement("div");
+    this.viewsContainerElement.id = "audit-views";
+    this.element.appendChild(this.viewsContainerElement);
+
+    this._launcherView = new WebInspector.AuditLauncherView(this.categoriesById, this.initiateAudit.bind(this));
+}
+
+WebInspector.AuditsPanel.prototype = {
+    toolbarItemClass: "audits",
+
+    get toolbarItemLabel()
+    {
+        return WebInspector.UIString("Audits");
+    },
+
+    get statusBarItems()
+    {
+        return [this.clearResultsButton.element];
+    },
+
+    get mainResourceLoadTime()
+    {
+        return this._mainResourceLoadTime;
+    },
+
+    set mainResourceLoadTime(x)
+    {
+        this._mainResourceLoadTime = x;
+        this._didMainResourceLoad();
+    },
+
+    get mainResourceDOMContentTime()
+    {
+        return this._mainResourceDOMContentTime;
+    },
+
+    set mainResourceDOMContentTime(x)
+    {
+        this._mainResourceDOMContentTime = x;
+    },
+
+    get categoriesById()
+    {
+        return this._auditCategoriesById;
+    },
+
+    resourceStarted: function(resource)
+    {
+        this._launcherView.resourceStarted(resource);
+    },
+
+    resourceFinished: function(resource)
+    {
+        this._launcherView.resourceFinished(resource);
+    },
+
+    _constructCategories: function()
+    {
+        this._auditCategoriesById = {};
+        for (var categoryCtorID in WebInspector.AuditCategories) {
+            var auditCategory = new WebInspector.AuditCategories[categoryCtorID]();
+            auditCategory._id = categoryCtorID;
+            this.categoriesById[categoryCtorID] = auditCategory;
+        }
+    },
+
+    _executeAudit: function(categories, resultCallback)
+    {
+        var resources = [];
+        for (var id in WebInspector.resources)
+            resources.push(WebInspector.resources[id]);
+
+        var rulesRemaining = 0;
+        for (var i = 0; i < categories.length; ++i)
+            rulesRemaining += categories[i].ruleCount;
+
+        var results = [];
+        var mainResourceURL = WebInspector.mainResource.url;
+
+        function ruleResultReadyCallback(categoryResult, ruleResult)
+        {
+            if (ruleResult && ruleResult.children)
+                categoryResult.addRuleResult(ruleResult);
+
+            --rulesRemaining;
+
+            if (!rulesRemaining && resultCallback)
+                resultCallback(mainResourceURL, results);
+        }
+
+        if (!rulesRemaining) {
+            resultCallback(mainResourceURL, results);
+            return;
+        }
+
+        for (var i = 0; i < categories.length; ++i) {
+            var category = categories[i];
+            var result = new WebInspector.AuditCategoryResult(category);
+            results.push(result);
+            category.runRules(resources, ruleResultReadyCallback.bind(null, result));
+        }
+    },
+
+    _auditFinishedCallback: function(launcherCallback, mainResourceURL, results)
+    {
+        var children = this.auditResultsTreeElement.children;
+        var ordinal = 1;
+        for (var i = 0; i < children.length; ++i) {
+            if (children[i].mainResourceURL === mainResourceURL)
+                ordinal++;
+        }
+
+        var resultTreeElement = new WebInspector.AuditResultSidebarTreeElement(results, mainResourceURL, ordinal);
+        this.auditResultsTreeElement.appendChild(resultTreeElement);
+        resultTreeElement.reveal();
+        resultTreeElement.select();
+        if (launcherCallback)
+            launcherCallback();
+    },
+
+    initiateAudit: function(categoryIds, runImmediately, launcherCallback)
+    {
+        if (!categoryIds || !categoryIds.length)
+            return;
+
+        var categories = [];
+        for (var i = 0; i < categoryIds.length; ++i)
+            categories.push(this.categoriesById[categoryIds[i]]);
+
+        function initiateAuditCallback(categories, launcherCallback)
+        {
+            this._executeAudit(categories, this._auditFinishedCallback.bind(this, launcherCallback));
+        }
+
+        if (runImmediately)
+            initiateAuditCallback.call(this, categories, launcherCallback);
+        else
+            this._reloadResources(initiateAuditCallback.bind(this, categories, launcherCallback));
+    },
+
+    _reloadResources: function(callback)
+    {
+        this._resourceTrackingCallback = callback;
+
+        if (!WebInspector.panels.resources.resourceTrackingEnabled) {
+            InspectorBackend.enableResourceTracking(false);
+            this._updateLauncherViewControls(true);
+        } else
+            InspectorBackend.reloadPage();
+    },
+
+    _didMainResourceLoad: function()
+    {
+        if (this._resourceTrackingCallback) {
+            var callback = this._resourceTrackingCallback;
+            delete this._resourceTrackingCallback;
+            callback();
+        }
+    },
+
+    showResults: function(categoryResults)
+    {
+        if (!categoryResults._resultView)
+            categoryResults._resultView = new WebInspector.AuditResultView(categoryResults);
+
+        this.visibleView = categoryResults._resultView;
+    },
+
+    showLauncherView: function()
+    {
+        this.visibleView = this._launcherView;
+    },
+    
+    get visibleView()
+    {
+        return this._visibleView;
+    },
+
+    set visibleView(x)
+    {
+        if (this._visibleView === x)
+            return;
+
+        if (this._visibleView)
+            this._visibleView.hide();
+
+        this._visibleView = x;
+
+        if (x)
+            x.show(this.viewsContainerElement);
+    },
+
+    show: function()
+    {
+        WebInspector.Panel.prototype.show.call(this);
+        this._updateLauncherViewControls(WebInspector.panels.resources.resourceTrackingEnabled);
+    },
+
+    reset: function()
+    {
+        this._launcherView.reset();
+    },
+
+    attach: function()
+    {
+        WebInspector.Panel.prototype.attach.call(this);
+
+        this.auditsItemTreeElement.select();
+    },
+
+    updateMainViewWidth: function(width)
+    {
+        this.viewsContainerElement.style.left = width + "px";
+    },
+
+    _updateLauncherViewControls: function(isTracking)
+    {
+        if (this._launcherView)
+            this._launcherView.updateResourceTrackingState(isTracking);
+    },
+
+    _clearButtonClicked: function()
+    {
+        this.auditsItemTreeElement.reveal();
+        this.auditsItemTreeElement.select();
+        this.auditResultsTreeElement.removeChildren();
+    }
+}
+
+WebInspector.AuditsPanel.prototype.__proto__ = WebInspector.Panel.prototype;
+
+
+
+WebInspector.AuditCategory = function(displayName)
+{
+    this._displayName = displayName;
+    this._rules = [];
+}
+
+WebInspector.AuditCategory.prototype = {
+    get id()
+    {
+        // this._id value is injected at construction time.
+        return this._id;
+    },
+
+    get displayName()
+    {
+        return this._displayName;
+    },
+
+    get ruleCount()
+    {
+        this._ensureInitialized();
+        return this._rules.length;
+    },
+
+    addRule: function(rule, severity)
+    {
+        rule.severity = severity;
+        this._rules.push(rule);
+    },
+
+    runRules: function(resources, callback)
+    {
+        this._ensureInitialized();
+        for (var i = 0; i < this._rules.length; ++i)
+            this._rules[i].run(resources, callback);
+    },
+
+    _ensureInitialized: function()
+    {
+        if (!this._initialized) {
+            if ("initialize" in this)
+                this.initialize();
+            this._initialized = true;
+        }
+    }
+}
+
+
+WebInspector.AuditRule = function(id, displayName)
+{
+    this._id = id;
+    this._displayName = displayName;
+}
+
+WebInspector.AuditRule.Severity = {
+    Info: "info",
+    Warning: "warning",
+    Severe: "severe"
+}
+
+WebInspector.AuditRule.prototype = {
+    get id()
+    {
+        return this._id;
+    },
+
+    get displayName()
+    {
+        return this._displayName;
+    },
+
+    set severity(severity)
+    {
+        this._severity = severity;
+    },
+
+    run: function(resources, callback)
+    {
+        var result = new WebInspector.AuditRuleResult(this.displayName);
+        result.severity = this._severity;
+        this.doRun(resources, result, callback);
+    },
+
+    doRun: function(resources, result, callback)
+    {
+        throw new Error("doRun() not implemented");
+    }
+}
+
+WebInspector.AuditCategoryResult = function(category)
+{
+    this.title = category.displayName;
+    this.ruleResults = [];
+}
+
+WebInspector.AuditCategoryResult.prototype = {
+    addRuleResult: function(ruleResult)
+    {
+        this.ruleResults.push(ruleResult);
+    }
+}
+
+WebInspector.AuditRuleResult = function(value, expanded, className)
+{
+    this.value = value;
+    this.className = className;
+    this.expanded = expanded;
+    this.violationCount = 0;
+}
+
+WebInspector.AuditRuleResult.prototype = {
+    addChild: function(value, expanded, className)
+    {
+        if (!this.children)
+            this.children = [];
+        var entry = new WebInspector.AuditRuleResult(value, expanded, className);
+        this.children.push(entry);
+        return entry;
+    },
+
+    addURL: function(url)
+    {
+        return this.addChild(WebInspector.linkifyURL(url));
+    },
+
+    addURLs: function(urls)
+    {
+        for (var i = 0; i < urls.length; ++i)
+            this.addURL(urls[i]);
+    },
+
+    addSnippet: function(snippet)
+    {
+        return this.addChild(snippet, false, "source-code");
+    }
+}
+
+WebInspector.AuditsSidebarTreeElement = function()
+{
+    this.small = false;
+
+    WebInspector.SidebarTreeElement.call(this, "audits-sidebar-tree-item", WebInspector.UIString("Audits"), "", null, false);
+}
+
+WebInspector.AuditsSidebarTreeElement.prototype = {
+    onattach: function()
+    {
+        WebInspector.SidebarTreeElement.prototype.onattach.call(this);
+    },
+
+    onselect: function()
+    {
+        WebInspector.panels.audits.showLauncherView();
+    },
+
+    get selectable()
+    {
+        return true;
+    },
+
+    refresh: function()
+    {
+        this.refreshTitles();
+    }
+}
+
+WebInspector.AuditsSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
+
+
+WebInspector.AuditResultSidebarTreeElement = function(results, mainResourceURL, ordinal)
+{
+    this.results = results;
+    this.mainResourceURL = mainResourceURL;
+
+    WebInspector.SidebarTreeElement.call(this, "audit-result-sidebar-tree-item", String.sprintf("%s (%d)", mainResourceURL, ordinal), "", {}, false);
+}
+
+WebInspector.AuditResultSidebarTreeElement.prototype = {
+    onselect: function()
+    {
+        WebInspector.panels.audits.showResults(this.results);
+    },
+
+    get selectable()
+    {
+        return true;
+    }
+}
+
+WebInspector.AuditResultSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
+
+// Contributed audit rules should go into this namespace.
+WebInspector.AuditRules = {};
+
+// Contributed audit categories should go into this namespace.
+WebInspector.AuditCategories = {};
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js b/src/3rdparty/webkit/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
index 41a8a3aaee..5aaae0cde7 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
@@ -31,11 +31,7 @@
 
 WebInspector.BottomUpProfileDataGridNode = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode, /*BottomUpProfileDataGridTree*/ owningTree)
 {
-    // In bottom up mode, our parents are our children since we display an inverted tree.
-    // However, we don't want to show the very top parent since it is redundant.
-    var hasChildren = !!(profileNode.parent && profileNode.parent.parent);
-
-    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, hasChildren);
+    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, this._willHaveChildren(profileNode));
 
     this._remainingNodeInfos = [];
 }
@@ -78,6 +74,14 @@ WebInspector.BottomUpProfileDataGridNode.prototype = {
             this._merge(child, true);
     },
 
+    _restore: function()
+    {
+        WebInspector.ProfileDataGridNode.prototype._restore();
+
+        if (!this.children.length)
+            this.hasChildren = this._willHaveChildren();
+    },
+
     _merge: function(/*ProfileDataGridNode*/ child, /*Boolean*/ shouldAbsorb)
     {
         this.selfTime -= child.selfTime;
@@ -128,6 +132,14 @@ WebInspector.BottomUpProfileDataGridNode.prototype = {
         }
 
         delete this._remainingNodeInfos;
+    },
+
+    _willHaveChildren: function(profileNode)
+    {
+        profileNode = profileNode || this.profileNode;
+        // In bottom up mode, our parents are our children since we display an inverted tree.
+        // However, we don't want to show the very top parent since it is redundant.
+        return !!(profileNode.parent && profileNode.parent.parent);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Breakpoint.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Breakpoint.js
index 292975a9e7..7f3ef17b71 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Breakpoint.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Breakpoint.js
@@ -89,7 +89,7 @@ WebInspector.Breakpoint.prototype = {
         this.dispatchEventToListeners("condition-changed");
 
         if (this.enabled)
-            InspectorController.updateBreakpoint(this.sourceID, this.line, c);
+            InspectorBackend.setBreakpoint(this.sourceID, this.line, this.enabled, this.condition);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/BreakpointsSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/BreakpointsSidebarPane.js
index e6edeceb97..fcfd2abb84 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/BreakpointsSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/BreakpointsSidebarPane.js
@@ -40,6 +40,16 @@ WebInspector.BreakpointsSidebarPane = function()
 }
 
 WebInspector.BreakpointsSidebarPane.prototype = {
+    reset: function()
+    {
+        this.breakpoints = {};
+        this.listElement.removeChildren();
+        if (this.listElement.parentElement) {
+            this.bodyElement.removeChild(this.listElement);
+            this.bodyElement.appendChild(this.emptyElement);
+        }
+    },
+
     addBreakpoint: function(breakpoint)
     {
         if (this.breakpoints[breakpoint.id])
@@ -58,30 +68,28 @@ WebInspector.BreakpointsSidebarPane.prototype = {
             this.bodyElement.appendChild(this.listElement);
         }
 
-        if (!InspectorController.debuggerEnabled() || !breakpoint.sourceID)
-            return;
-
-        if (breakpoint.enabled)
-            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
+        InspectorBackend.setBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.enabled, breakpoint.condition);
     },
 
     _appendBreakpointElement: function(breakpoint)
     {
-        function checkboxClicked()
+        function checkboxClicked(event)
         {
             breakpoint.enabled = !breakpoint.enabled;
+
+            // without this, we'd switch to the source of the clicked breakpoint
+            event.stopPropagation();
         }
 
-        function labelClicked()
+        function breakpointClicked()
         {
-            var script = WebInspector.panels.scripts.scriptOrResourceForID(breakpoint.sourceID);
-            if (script)
-                WebInspector.panels.scripts.showScript(script, breakpoint.line);
+            WebInspector.panels.scripts.showSourceLine(breakpoint.url, breakpoint.line);
         }
 
         var breakpointElement = document.createElement("li");
         breakpoint._breakpointListElement = breakpointElement;
         breakpointElement._breakpointObject = breakpoint;
+        breakpointElement.addEventListener("click", breakpointClicked, false);
 
         var checkboxElement = document.createElement("input");
         checkboxElement.className = "checkbox-elem";
@@ -90,14 +98,12 @@ WebInspector.BreakpointsSidebarPane.prototype = {
         checkboxElement.addEventListener("click", checkboxClicked, false);
         breakpointElement.appendChild(checkboxElement);
 
-        var labelElement = document.createElement("a");
-        labelElement.textContent = breakpoint.label;
-        labelElement.addEventListener("click", labelClicked, false);
+        var labelElement = document.createTextNode(breakpoint.label);
         breakpointElement.appendChild(labelElement);
 
         var sourceTextElement = document.createElement("div");
         sourceTextElement.textContent = breakpoint.sourceText;
-        sourceTextElement.className = "source-text";
+        sourceTextElement.className = "source-text monospace";
         breakpointElement.appendChild(sourceTextElement);
 
         var currentElement = this.listElement.firstChild;
@@ -133,10 +139,7 @@ WebInspector.BreakpointsSidebarPane.prototype = {
             this.bodyElement.appendChild(this.emptyElement);
         }
 
-        if (!InspectorController.debuggerEnabled() || !breakpoint.sourceID)
-            return;
-
-        InspectorController.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
+        InspectorBackend.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
     },
 
     _breakpointEnableChanged: function(event)
@@ -145,14 +148,7 @@ WebInspector.BreakpointsSidebarPane.prototype = {
 
         var checkbox = breakpoint._breakpointListElement.firstChild;
         checkbox.checked = breakpoint.enabled;
-
-        if (!InspectorController.debuggerEnabled() || !breakpoint.sourceID)
-            return;
-
-        if (breakpoint.enabled)
-            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
-        else
-            InspectorController.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
+        InspectorBackend.setBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.enabled, breakpoint.condition);
     },
 
     _breakpointTextChanged: function(event)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/CallStackSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/CallStackSidebarPane.js
index 2fe4315c15..ddca80b460 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/CallStackSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/CallStackSidebarPane.js
@@ -109,13 +109,12 @@ WebInspector.CallStackSidebarPane.prototype = {
         this.dispatchEventToListeners("call frame selected");
     },
 
-    handleKeyEvent: function(event)
+    handleShortcut: function(event)
     {
         var shortcut = WebInspector.KeyboardShortcut.makeKeyFromEvent(event);
         var handler = this._shortcuts[shortcut];
         if (handler) {
             handler(event);
-            event.preventDefault();
             event.handled = true;
         }
     },
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Checkbox.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Checkbox.js
new file mode 100644
index 0000000000..b30da70f0c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Checkbox.js
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.Checkbox = function(label, callback, checked, className, tooltip)
+{
+    this.element = document.createElement('label');
+    this._inputElement = document.createElement('input');
+
+    function callbackWrapper(event)
+    {
+        if (callback)
+            callback(event);
+        event.stopPropagation();
+        return true;
+    }
+    this._inputElement.type = "checkbox";
+    this._inputElement.checked = checked;
+    this._inputElement.addEventListener("click", callbackWrapper, false);
+
+    this.element.className = className;
+    this.element.appendChild(this._inputElement);
+    this.element.appendChild(document.createTextNode(label));
+    if (tooltip)
+        this.element.title = tooltip;
+    this.element.addEventListener("click", callbackWrapper, false);
+}
+
+WebInspector.Checkbox.prototype = {
+    checked: function()
+    {
+        return this._inputElement.checked;
+    }
+}
+
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ConsolePanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ConsolePanel.js
new file mode 100644
index 0000000000..6dbc5586c0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ConsolePanel.js
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.ConsolePanel = function()
+{
+    WebInspector.Panel.call(this);
+}
+
+WebInspector.ConsolePanel.prototype = {
+    toolbarItemClass: "console",
+
+    get toolbarItemLabel()
+    {
+        return WebInspector.UIString("Console");
+    },
+
+    show: function()
+    {
+        WebInspector.Panel.prototype.show.call(this);
+
+        this._previousConsoleState = WebInspector.drawer.state;
+        WebInspector.drawer.enterPanelMode();
+        WebInspector.showConsole();
+        
+        // Move the scope bar to the top of the messages, like the resources filter.
+        var scopeBar = document.getElementById("console-filter");
+        var consoleMessages = document.getElementById("console-messages");
+
+        scopeBar.parentNode.removeChild(scopeBar);
+        document.getElementById("console-view").insertBefore(scopeBar, consoleMessages);
+        
+        // Update styles, and give console-messages a top margin so it doesn't overwrite the scope bar.
+        scopeBar.addStyleClass("console-filter-top");
+        scopeBar.removeStyleClass("status-bar-item");
+
+        consoleMessages.addStyleClass("console-filter-top");
+    },
+
+    hide: function()
+    {
+        WebInspector.Panel.prototype.hide.call(this);
+
+        if (this._previousConsoleState === WebInspector.Drawer.State.Hidden)
+            WebInspector.drawer.immediatelyExitPanelMode();
+        else
+            WebInspector.drawer.exitPanelMode();
+        delete this._previousConsoleState;
+        
+        // Move the scope bar back to the bottom bar, next to Clear Console.
+        var scopeBar = document.getElementById("console-filter");
+
+        scopeBar.parentNode.removeChild(scopeBar);
+        document.getElementById("other-drawer-status-bar-items").appendChild(scopeBar);
+        
+        // Update styles, and remove the top margin on console-messages.
+        scopeBar.removeStyleClass("console-filter-top");
+        scopeBar.addStyleClass("status-bar-item");
+
+        document.getElementById("console-messages").removeStyleClass("console-filter-top");
+    }
+}
+
+WebInspector.ConsolePanel.prototype.__proto__ = WebInspector.Panel.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
index 9317824d24..610dc8d1d2 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
@@ -45,8 +45,10 @@ WebInspector.ConsoleView = function(drawer)
     this.messagesElement.addEventListener("click", this._messagesClicked.bind(this), true);
 
     this.promptElement = document.getElementById("console-prompt");
-    this.promptElement.handleKeyEvent = this._promptKeyDown.bind(this);
+    this.promptElement.className = "source-code";
+    this.promptElement.addEventListener("keydown", this._promptKeyDown.bind(this), true);
     this.prompt = new WebInspector.TextPrompt(this.promptElement, this.completions.bind(this), ExpressionStopCharacters + ".");
+    WebInspector.settings.addEventListener("loaded", this._settingsLoaded, this);
 
     this.topGroup = new WebInspector.ConsoleGroup(null, 0);
     this.messagesElement.insertBefore(this.topGroup.element, this.promptElement);
@@ -57,51 +59,71 @@ WebInspector.ConsoleView = function(drawer)
     this.toggleConsoleButton.title = WebInspector.UIString("Show console.");
     this.toggleConsoleButton.addEventListener("click", this._toggleConsoleButtonClicked.bind(this), false);
 
-    var anchoredStatusBar = document.getElementById("anchored-status-bar-items");
-    anchoredStatusBar.appendChild(this.toggleConsoleButton);
-    
     // Will hold the list of filter elements
     this.filterBarElement = document.getElementById("console-filter");
-    
+
     function createDividerElement() {
         var dividerElement = document.createElement("div");
-        
         dividerElement.addStyleClass("divider");
-        
         this.filterBarElement.appendChild(dividerElement);
     }
-    
+
+    var updateFilterHandler = this._updateFilter.bind(this);
     function createFilterElement(category) {
         var categoryElement = document.createElement("li");
         categoryElement.category = category;
-     
-        categoryElement.addStyleClass(categoryElement.category);
-            
+        categoryElement.addStyleClass(categoryElement.category);            
+        categoryElement.addEventListener("click", updateFilterHandler, false);
+
         var label = category.toString();
         categoryElement.appendChild(document.createTextNode(label));
-     
-        categoryElement.addEventListener("click", this._updateFilter.bind(this), false);
-     
+
         this.filterBarElement.appendChild(categoryElement);
         return categoryElement;
     }
     
     this.allElement = createFilterElement.call(this, "All");
-    
     createDividerElement.call(this);
-    
     this.errorElement = createFilterElement.call(this, "Errors");
     this.warningElement = createFilterElement.call(this, "Warnings");
     this.logElement = createFilterElement.call(this, "Logs");
 
     this.filter(this.allElement, false);
+
+    this._shortcuts = {};
+
+    var shortcut;
+    var clearConsoleHandler = this.requestClearMessages.bind(this);
+
+    shortcut = WebInspector.KeyboardShortcut.makeKey("k", WebInspector.KeyboardShortcut.Modifiers.Meta);
+    this._shortcuts[shortcut] = clearConsoleHandler;
+    this._shortcuts[shortcut].isMacOnly = true;
+    shortcut = WebInspector.KeyboardShortcut.makeKey("l", WebInspector.KeyboardShortcut.Modifiers.Ctrl);
+    this._shortcuts[shortcut] = clearConsoleHandler;
+
+    // Since the Context Menu for the Console View will always be the same, we can create it in
+    // the constructor.
+    this._contextMenu = new WebInspector.ContextMenu();
+    this._contextMenu.appendItem(WebInspector.UIString("Clear Console"), clearConsoleHandler);
+    this.messagesElement.addEventListener("contextmenu", this._handleContextMenuEvent.bind(this), true);
+    
+    this._customFormatters = {
+        "object": this._formatobject,
+        "array":  this._formatarray,
+        "node":   this._formatnode,
+        "string": this._formatstring
+    };
 }
 
 WebInspector.ConsoleView.prototype = {
+    _settingsLoaded: function()
+    {
+        this.prompt.history = WebInspector.settings.consoleHistory;
+    },
     
     _updateFilter: function(e)
     {
-        var isMac = InspectorController.platform().indexOf("mac-") === 0;
+        var isMac = WebInspector.isMac();
         var selectMultiple = false;
         if (isMac && e.metaKey && !e.ctrlKey && !e.altKey && !e.shiftKey)
             selectMultiple = true;
@@ -198,6 +220,19 @@ WebInspector.ConsoleView.prototype = {
         this.toggleConsoleButton.title = WebInspector.UIString("Show console.");
     },
 
+    _scheduleScrollIntoView: function()
+    {
+        if (this._scrollIntoViewTimer)
+            return;
+
+        function scrollIntoView()
+        {
+            this.promptElement.scrollIntoView(false);
+            delete this._scrollIntoViewTimer;
+        }
+        this._scrollIntoViewTimer = setTimeout(scrollIntoView.bind(this), 20);
+    },
+
     addMessage: function(msg)
     {
         if (msg instanceof WebInspector.ConsoleMessage && !(msg instanceof WebInspector.ConsoleCommandResult)) {
@@ -239,10 +274,11 @@ WebInspector.ConsoleView.prototype = {
             this.currentGroup.addMessage(msg);
         }
 
-        this.promptElement.scrollIntoView(false);
+        this._scheduleScrollIntoView();
     },
 
-    updateMessageRepeatCount: function(count) {
+    updateMessageRepeatCount: function(count)
+    {
         var msg = this.previousMessage;
         var prevRepeatCount = msg.totalRepeatCount;
         
@@ -260,7 +296,8 @@ WebInspector.ConsoleView.prototype = {
         }
     },
 
-    _incrementErrorWarningCount: function(msg) {
+    _incrementErrorWarningCount: function(msg)
+    {
         switch (msg.level) {
             case WebInspector.ConsoleMessage.MessageLevel.Warning:
                 WebInspector.warnings += msg.repeatDelta;
@@ -271,10 +308,13 @@ WebInspector.ConsoleView.prototype = {
         }
     },
 
-    clearMessages: function(clearInspectorController)
+    requestClearMessages: function()
+    {
+        InjectedScriptAccess.getDefault().clearConsoleMessages(function() {});
+    },
+
+    clearMessages: function()
     {
-        if (clearInspectorController)
-            InspectorController.clearMessages(false);
         if (WebInspector.panels.resources)
             WebInspector.panels.resources.clearMessages();
 
@@ -312,9 +352,14 @@ WebInspector.ConsoleView.prototype = {
         // Collect comma separated object properties for the completion.
 
         var includeInspectorCommandLineAPI = (!dotNotation && !bracketNotation);
-        if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused)
-            var callFrameId = WebInspector.panels.scripts.selectedCallFrameId();
-        InjectedScriptAccess.getCompletions(expressionString, includeInspectorCommandLineAPI, callFrameId, reportCompletions);
+        var callFrameId = WebInspector.panels.scripts.selectedCallFrameId();
+        var injectedScriptAccess;
+        if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused) {
+            var selectedCallFrame = WebInspector.panels.scripts.sidebarPanes.callstack.selectedCallFrame;
+            injectedScriptAccess = InjectedScriptAccess.get(selectedCallFrame.injectedScriptId);
+        } else
+            injectedScriptAccess = InjectedScriptAccess.getDefault();
+        injectedScriptAccess.getCompletions(expressionString, includeInspectorCommandLineAPI, callFrameId, reportCompletions);
     },
 
     _reportCompletions: function(bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix, result, isException) {
@@ -357,7 +402,18 @@ WebInspector.ConsoleView.prototype = {
 
     _clearButtonClicked: function()
     {
-        this.clearMessages(true);
+        this.requestClearMessages();
+    },
+
+    _handleContextMenuEvent: function(event)
+    {
+        if (!window.getSelection().isCollapsed) {
+            // If there is a selection, we want to show our normal context menu
+            // (with Copy, etc.), and not Clear Console.
+            return;
+        }
+
+        this._contextMenu.show(event);
     },
 
     _messagesSelectStart: function(event)
@@ -396,7 +452,15 @@ WebInspector.ConsoleView.prototype = {
             return;
         }
 
-        this.prompt.handleKeyEvent(event);
+        var shortcut = WebInspector.KeyboardShortcut.makeKeyFromEvent(event);
+        var handler = this._shortcuts[shortcut];
+        if (handler) {
+            if (!this._shortcuts[shortcut].isMacOnly || WebInspector.isMac()) {
+                handler();
+                event.preventDefault();
+                return;
+            }
+        }
     },
 
     evalInInspectedWindow: function(expression, objectGroup, callback)
@@ -419,7 +483,7 @@ WebInspector.ConsoleView.prototype = {
         {
             callback(result.value, result.isException);
         };
-        InjectedScriptAccess.evaluate(expression, objectGroup, evalCallback);
+        InjectedScriptAccess.getDefault().evaluate(expression, objectGroup, evalCallback);
     },
 
     _enterKeyPressed: function(event)
@@ -445,6 +509,9 @@ WebInspector.ConsoleView.prototype = {
             self.prompt.history.push(str);
             self.prompt.historyOffset = 0;
             self.prompt.text = "";
+
+            WebInspector.settings.consoleHistory = self.prompt.history.slice(-30);
+
             self.addMessage(new WebInspector.ConsoleCommandResult(result, exception, commandMessage));
         }
         this.evalInInspectedWindow(str, "console", printResult);
@@ -453,44 +520,17 @@ WebInspector.ConsoleView.prototype = {
     _format: function(output, forceObjectFormat)
     {
         var isProxy = (output != null && typeof output === "object");
+        var type = (forceObjectFormat ? "object" : Object.proxyType(output));
 
-        if (forceObjectFormat)
-            var type = "object";
-        else
-            var type = Object.proxyType(output);
-
-        if (isProxy && type !== "object" && type !== "function" && type !== "array" && type !== "node") {
-            // Unwrap primitive value, skip decoration.
+        var formatter = this._customFormatters[type];
+        if (!formatter || !isProxy) {
+            formatter = this._formatvalue;
             output = output.description;
-            type = "undecorated"
-        }
-
-        // We don't perform any special formatting on these types, so we just
-        // pass them through the simple _formatvalue function.
-        var undecoratedTypes = {
-            "undefined": 1,
-            "null": 1,
-            "boolean": 1,
-            "number": 1,
-            "undecorated": 1
-        };
-
-        var formatter;
-        if (forceObjectFormat)
-            formatter = "_formatobject";
-        else if (type in undecoratedTypes)
-            formatter = "_formatvalue";
-        else {
-            formatter = "_format" + type;
-            if (!(formatter in this)) {
-                formatter = "_formatobject";
-                type = "object";
-            }
         }
 
         var span = document.createElement("span");
-        span.addStyleClass("console-formatted-" + type);
-        this[formatter](output, span);
+        span.className = "console-formatted-" + type + " source-code";
+        formatter.call(this, output, span);
         return span;
     },
 
@@ -499,36 +539,52 @@ WebInspector.ConsoleView.prototype = {
         elem.appendChild(document.createTextNode(val));
     },
 
-    _formatfunction: function(func, elem)
+    _formatobject: function(obj, elem)
     {
-        elem.appendChild(document.createTextNode(func.description));
+        elem.appendChild(new WebInspector.ObjectPropertiesSection(obj, obj.description, null, true).element);
     },
 
-    _formatdate: function(date, elem)
+    _formatnode: function(object, elem)
     {
-        elem.appendChild(document.createTextNode(date));
-    },
+        function printNode(nodeId)
+        {
+            if (!nodeId)
+                return;
+            var treeOutline = new WebInspector.ElementsTreeOutline();
+            treeOutline.showInElementsPanelEnabled = true;
+            treeOutline.rootDOMNode = WebInspector.domAgent.nodeForId(nodeId);
+            treeOutline.element.addStyleClass("outline-disclosure");
+            if (!treeOutline.children[0].hasChildren)
+                treeOutline.element.addStyleClass("single-node");
+            elem.appendChild(treeOutline.element);
+        }
 
-    _formatstring: function(str, elem)
-    {
-        elem.appendChild(document.createTextNode("\"" + str + "\""));
+        InjectedScriptAccess.get(object.injectedScriptId).pushNodeToFrontend(object, printNode);
     },
 
-    _formatregexp: function(re, elem)
+    _formatarray: function(arr, elem)
     {
-        var formatted = String(re.description).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
-        elem.appendChild(document.createTextNode(formatted));
+        InjectedScriptAccess.get(arr.injectedScriptId).getProperties(arr, false, false, this._printArray.bind(this, elem));
     },
 
-    _formatarray: function(arr, elem)
+    _formatstring: function(output, elem)
     {
-        InjectedScriptAccess.getProperties(arr, false, this._printArray.bind(this, elem));
+        var span = document.createElement("span");
+        span.className = "console-formatted-string source-code";
+        span.appendChild(WebInspector.linkifyStringAsFragment(output.description));
+
+        // Make black quotes.
+        elem.removeStyleClass("console-formatted-string");
+        elem.appendChild(document.createTextNode("\""));
+        elem.appendChild(span);
+        elem.appendChild(document.createTextNode("\""));
     },
 
     _printArray: function(elem, properties)
     {
         if (!properties)
             return;
+
         var elements = [];
         for (var i = 0; i < properties.length; ++i) {
             var name = properties[i].name;
@@ -547,53 +603,6 @@ WebInspector.ConsoleView.prototype = {
                 elem.appendChild(document.createTextNode(", "));
         }
         elem.appendChild(document.createTextNode("]"));
-    },
-
-    _formatnode: function(object, elem)
-    {
-        function printNode(nodeId)
-        {
-            if (!nodeId)
-                return;
-            var treeOutline = new WebInspector.ElementsTreeOutline();
-            treeOutline.showInElementsPanelEnabled = true;
-            treeOutline.rootDOMNode = WebInspector.domAgent.nodeForId(nodeId);
-            treeOutline.element.addStyleClass("outline-disclosure");
-            if (!treeOutline.children[0].hasChildren)
-                treeOutline.element.addStyleClass("single-node");
-            elem.appendChild(treeOutline.element);
-        }
-        InjectedScriptAccess.pushNodeToFrontend(object, printNode);
-    },
-
-    _formatobject: function(obj, elem)
-    {
-        elem.appendChild(new WebInspector.ObjectPropertiesSection(obj, obj.description, null, true).element);
-    },
-
-    _formaterror: function(obj, elem)
-    {
-        var messageElement = document.createElement("span");
-        messageElement.className = "error-message";
-        messageElement.textContent = obj.name + ": " + obj.message;
-        elem.appendChild(messageElement);
-
-        if (obj.sourceURL) {
-            var urlElement = document.createElement("a");
-            urlElement.className = "webkit-html-resource-link";
-            urlElement.href = obj.sourceURL;
-            urlElement.lineNumber = obj.line;
-            urlElement.preferredPanel = "scripts";
-
-            if (obj.line > 0)
-                urlElement.textContent = WebInspector.displayNameForURL(obj.sourceURL) + ":" + obj.line;
-            else
-                urlElement.textContent = WebInspector.displayNameForURL(obj.sourceURL);
-
-            elem.appendChild(document.createTextNode(" ("));
-            elem.appendChild(urlElement);
-            elem.appendChild(document.createTextNode(")"));
-        }
     }
 }
 
@@ -621,7 +630,7 @@ WebInspector.ConsoleMessage.prototype = {
         switch (this.type) {
             case WebInspector.ConsoleMessage.MessageType.Trace:
                 var span = document.createElement("span");
-                span.addStyleClass("console-formatted-trace");
+                span.className = "console-formatted-trace source-code";
                 var stack = Array.prototype.slice.call(args);
                 var funcNames = stack.map(function(f) {
                     return f || WebInspector.UIString("(anonymous function)");
@@ -648,69 +657,75 @@ WebInspector.ConsoleMessage.prototype = {
 
     _format: function(parameters)
     {
+        // This node is used like a Builder. Values are continually appended onto it.
         var formattedResult = document.createElement("span");
-
         if (!parameters.length)
             return formattedResult;
 
         // Formatting code below assumes that parameters are all wrappers whereas frontend console
-        // API allows passing arbitrary values as messages (strings, numberts, etc.). Wrap them here.
-        for (var i = 0; i < parameters.length; ++i) {
+        // API allows passing arbitrary values as messages (strings, numbers, etc.). Wrap them here.
+        for (var i = 0; i < parameters.length; ++i)
             if (typeof parameters[i] !== "object" && typeof parameters[i] !== "function")
                 parameters[i] = WebInspector.ObjectProxy.wrapPrimitiveValue(parameters[i]);
-        }
-
-        function formatForConsole(obj)
-        {
-            return WebInspector.console._format(obj);
-        }
-
-        function formatAsObjectForConsole(obj)
-        {
-            return WebInspector.console._format(obj, true);
-        }
 
-        if (Object.proxyType(parameters[0]) === "string") {
-            var formatters = {}
-            for (var i in String.standardFormatters)
-                formatters[i] = String.standardFormatters[i];
-
-            // Firebug uses %o for formatting objects.
-            formatters.o = formatForConsole;
-            // Firebug allows both %i and %d for formatting integers.
-            formatters.i = formatters.d;
-            // Support %O to force object formating, instead of the type-based %o formatting.
-            formatters.O = formatAsObjectForConsole;
-
-            function append(a, b)
-            {
-                if (!(b instanceof Node))
-                    a.appendChild(WebInspector.linkifyStringAsFragment(b.toString()));
-                else
-                    a.appendChild(b);
-                return a;
-            }
+        // There can be string log and string eval result. We distinguish between them based on message type.
+        var shouldFormatMessage = Object.proxyType(parameters[0]) === "string" && this.type !== WebInspector.ConsoleMessage.MessageType.Result;
 
-            var result = String.format(parameters[0].description, parameters.slice(1), formatters, formattedResult, append);
-            formattedResult = result.formattedResult;
+        // Multiple parameters with the first being a format string. Save unused substitutions.
+        if (shouldFormatMessage) {
+            // Multiple parameters with the first being a format string. Save unused substitutions.
+            var result = this._formatWithSubstitutionString(parameters, formattedResult);
             parameters = result.unusedSubstitutions;
             if (parameters.length)
                 formattedResult.appendChild(document.createTextNode(" "));
         }
 
+        // Single parameter, or unused substitutions from above.
         for (var i = 0; i < parameters.length; ++i) {
-            if (Object.proxyType(parameters[i]) === "string")
-                formattedResult.appendChild(WebInspector.linkifyStringAsFragment(parameters[i].description));
+            // Inline strings when formatting.
+            if (shouldFormatMessage && parameters[i].type === "string")
+                formattedResult.appendChild(document.createTextNode(parameters[i].description));
             else
-                formattedResult.appendChild(formatForConsole(parameters[i]));
-
+                formattedResult.appendChild(WebInspector.console._format(parameters[i]));
             if (i < parameters.length - 1)
                 formattedResult.appendChild(document.createTextNode(" "));
         }
-
         return formattedResult;
     },
 
+    _formatWithSubstitutionString: function(parameters, formattedResult)
+    {
+        var formatters = {}
+        for (var i in String.standardFormatters)
+            formatters[i] = String.standardFormatters[i];
+
+        function consoleFormatWrapper(force)
+        {
+            return function(obj) {
+                return WebInspector.console._format(obj, force);
+            };
+        }
+
+        // Firebug uses %o for formatting objects.
+        formatters.o = consoleFormatWrapper();
+        // Firebug allows both %i and %d for formatting integers.
+        formatters.i = formatters.d;
+        // Support %O to force object formatting, instead of the type-based %o formatting.
+        formatters.O = consoleFormatWrapper(true);
+
+        function append(a, b)
+        {
+            if (!(b instanceof Node))
+                a.appendChild(WebInspector.linkifyStringAsFragment(b.toString()));
+            else
+                a.appendChild(b);
+            return a;
+        }
+
+        // String.format does treat formattedResult like a Builder, result is an object.
+        return String.format(parameters[0].description, parameters.slice(1), formatters, formattedResult, append);
+    },
+
     toMessageElement: function()
     {
         if (this._element)
@@ -788,7 +803,7 @@ WebInspector.ConsoleMessage.prototype = {
         }
 
         var messageTextElement = document.createElement("span");
-        messageTextElement.className = "console-message-text";
+        messageTextElement.className = "console-message-text source-code";
         if (this.type === WebInspector.ConsoleMessage.MessageType.Assert)
             messageTextElement.appendChild(document.createTextNode(WebInspector.UIString("Assertion failed: ")));
         messageTextElement.appendChild(this.formattedMessage);
@@ -855,6 +870,9 @@ WebInspector.ConsoleMessage.prototype = {
             case WebInspector.ConsoleMessage.MessageType.Assert:
                 typeString = "Assert";
                 break;
+            case WebInspector.ConsoleMessage.MessageType.Result:
+                typeString = "Result";
+                break;
         }
         
         var levelString;
@@ -911,7 +929,8 @@ WebInspector.ConsoleMessage.MessageType = {
     Trace: 2,
     StartGroup: 3,
     EndGroup: 4,
-    Assert: 5
+    Assert: 5,
+    Result: 6
 }
 
 WebInspector.ConsoleMessage.MessageLevel = {
@@ -935,7 +954,7 @@ WebInspector.ConsoleCommand.prototype = {
         element.className = "console-user-command";
 
         var commandTextElement = document.createElement("span");
-        commandTextElement.className = "console-message-text";
+        commandTextElement.className = "console-message-text source-code";
         commandTextElement.textContent = this.command;
         element.appendChild(commandTextElement);
 
@@ -955,12 +974,17 @@ WebInspector.ConsoleCommandResult = function(result, exception, originatingComma
 {
     var level = (exception ? WebInspector.ConsoleMessage.MessageLevel.Error : WebInspector.ConsoleMessage.MessageLevel.Log);
     var message = result;
+    if (exception) {
+        // Distinguish between strings and errors (no need to quote latter).
+        message = WebInspector.ObjectProxy.wrapPrimitiveValue(result);
+        message.type = "error";
+    }
     var line = (exception ? result.line : -1);
     var url = (exception ? result.sourceURL : null);
 
-    WebInspector.ConsoleMessage.call(this, WebInspector.ConsoleMessage.MessageSource.JS, WebInspector.ConsoleMessage.MessageType.Log, level, line, url, null, 1, message);
-
     this.originatingCommand = originatingCommand;
+
+    WebInspector.ConsoleMessage.call(this, WebInspector.ConsoleMessage.MessageSource.JS, WebInspector.ConsoleMessage.MessageType.Result, level, line, url, null, 1, message);
 }
 
 WebInspector.ConsoleCommandResult.prototype = {
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ContextMenu.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ContextMenu.js
new file mode 100644
index 0000000000..3cdb15233c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ContextMenu.js
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.ContextMenu = function() {
+    this._items = [];
+    this._handlers = {};
+}
+
+WebInspector.ContextMenu.prototype = {
+    show: function(event)
+    {
+        // Remove trailing separator.
+        while (this._items.length > 0 && !("id" in this._items[this._items.length - 1]))
+            this._items.splice(this._items.length - 1, 1);
+
+        if (this._items.length) {
+            WebInspector._contextMenu = this;
+            InspectorFrontendHost.showContextMenu(event, this._items);
+        }
+    },
+
+    appendItem: function(label, handler)
+    {
+        var id = this._items.length;
+        this._items.push({id: id, label: label});
+        this._handlers[id] = handler;
+    },
+
+    appendSeparator: function()
+    {
+        // No separator dupes allowed.
+        if (this._items.length === 0)
+            return;
+        if (!("id" in this._items[this._items.length - 1]))
+            return;
+        this._items.push({});
+    },
+
+    _itemSelected: function(id)
+    {
+        if (this._handlers[id])
+            this._handlers[id].call(this);
+    }
+}
+
+WebInspector.contextMenuItemSelected = function(id)
+{
+    if (WebInspector._contextMenu)
+        WebInspector._contextMenu._itemSelected(id);
+}
+
+WebInspector.contextMenuCleared = function()
+{
+    // FIXME: Unfortunately, contextMenuCleared is invoked between show and item selected
+    // so we can't delete last menu object from WebInspector. Fix the contract.
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/CookieItemsView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/CookieItemsView.js
index 9f9845c6e4..b5674b814c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/CookieItemsView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/CookieItemsView.js
@@ -27,7 +27,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.CookieItemsView = function(cookieDomain)
+WebInspector.CookieItemsView = function(treeElement, cookieDomain)
 {
     WebInspector.View.call(this);
 
@@ -41,7 +41,13 @@ WebInspector.CookieItemsView = function(cookieDomain)
     this.refreshButton = new WebInspector.StatusBarButton(WebInspector.UIString("Refresh"), "refresh-storage-status-bar-item");
     this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
     
+    this._treeElement = treeElement;
     this._cookieDomain = cookieDomain;
+
+    this._emptyMsgElement = document.createElement("div");
+    this._emptyMsgElement.className = "storage-table-empty";
+    this._emptyMsgElement.textContent = WebInspector.UIString("This site has no cookies.");
+    this.element.appendChild(this._emptyMsgElement);
 }
 
 WebInspector.CookieItemsView.prototype = {
@@ -53,7 +59,7 @@ WebInspector.CookieItemsView.prototype = {
     show: function(parentElement)
     {
         WebInspector.View.prototype.show.call(this, parentElement);
-        this.update();
+        this._update();
     },
 
     hide: function()
@@ -62,194 +68,211 @@ WebInspector.CookieItemsView.prototype = {
         this.deleteButton.visible = false;
     },
 
-    update: function()
+    _update: function()
+    {
+        WebInspector.Cookies.getCookiesAsync(this._updateWithCookies.bind(this));
+    },
+
+    _updateWithCookies: function(allCookies, isAdvanced)
     {
-        this.element.removeChildren();
-
-        var self = this;
-        function callback(cookies, isAdvanced) {
-            var dataGrid = (isAdvanced ? self.dataGridForCookies(cookies) : self.simpleDataGridForCookies(cookies));
-            if (dataGrid) {
-                self._dataGrid = dataGrid;
-                self.element.appendChild(dataGrid.element);
-                self._dataGrid.updateWidths();
-                if (isAdvanced)
-                    self.deleteButton.visible = true;
+        if (isAdvanced)
+            this._filterCookiesForDomain(allCookies);
+        else
+            this._cookies = allCookies;
+
+        if (!this._cookies.length) {
+            // Nothing to show.
+            this._emptyMsgElement.removeStyleClass("hidden");
+            this.deleteButton.visible = false;
+            if (this._dataGrid)
+                this._dataGrid.element.addStyleClass("hidden");
+            return;
+        }
+
+        if (!this._dataGrid) {
+            if (isAdvanced) {
+                this._createDataGrid();
+                this._populateDataGrid();
+                this._dataGrid.autoSizeColumns(6, 33);
+                this._treeElement.subtitle = String.sprintf(WebInspector.UIString("%d cookies (%s)"), this._cookies.length,
+                    Number.bytesToString(this._totalSize, WebInspector.UIString));
             } else {
-                var emptyMsgElement = document.createElement("div");
-                emptyMsgElement.className = "storage-table-empty";
-                emptyMsgElement.textContent = WebInspector.UIString("This site has no cookies.");
-                self.element.appendChild(emptyMsgElement);
-                self._dataGrid = null;
-                self.deleteButton.visible = false;
+                this._createSimpleDataGrid();
+                this._populateSimpleDataGrid();
+                this._dataGrid.autoSizeColumns(20, 80);
             }
+        } else {
+            if (isAdvanced)
+                this._populateDataGrid();
+            else
+                this._populateSimpleDataGrid();
         }
 
-        WebInspector.Cookies.getCookiesAsync(callback, this._cookieDomain);
+        this._dataGrid.element.removeStyleClass("hidden");
+        this._emptyMsgElement.addStyleClass("hidden");
+        if (isAdvanced)
+            this.deleteButton.visible = true;
     },
 
-    dataGridForCookies: function(cookies)
+    _filterCookiesForDomain: function(allCookies)
     {
-        if (!cookies.length)
-            return null;
+        this._cookies = [];
+        var resourceURLsForDocumentURL = [];
+        this._totalSize = 0;
+
+        for (var id in WebInspector.resources) {
+            var resource = WebInspector.resources[id];
+            var match = resource.documentURL.match(WebInspector.URLRegExp);
+            if (match && match[2] === this._cookieDomain)
+                resourceURLsForDocumentURL.push(resource.url);
+        }
 
-        for (var i = 0; i < cookies.length; ++i)
-            cookies[i].expires = new Date(cookies[i].expires);
+        for (var i = 0; i < allCookies.length; ++i) {
+            var pushed = false;
+            var size = allCookies[i].size;
+            for (var j = 0; j < resourceURLsForDocumentURL.length; ++j) {
+                var resourceURL = resourceURLsForDocumentURL[j];
+                if (WebInspector.Cookies.cookieMatchesResourceURL(allCookies[i], resourceURL)) {
+                    this._totalSize += size;
+                    if (!pushed) {
+                        pushed = true;
+                        this._cookies.push(allCookies[i]);
+                    }
+                }
+            }
+        }
+    },
 
+    _createDataGrid: function()
+    {
         var columns = { 0: {}, 1: {}, 2: {}, 3: {}, 4: {}, 5: {}, 6: {}, 7: {} };
         columns[0].title = WebInspector.UIString("Name");
-        columns[0].width = columns[0].title.length;
+        columns[0].sortable = true;
         columns[1].title = WebInspector.UIString("Value");
-        columns[1].width = columns[1].title.length;
+        columns[1].sortable = true;
         columns[2].title = WebInspector.UIString("Domain");
-        columns[2].width = columns[2].title.length;
+        columns[2].sortable = true;
         columns[3].title = WebInspector.UIString("Path");
-        columns[3].width = columns[3].title.length;
+        columns[3].sortable = true;
         columns[4].title = WebInspector.UIString("Expires");
-        columns[4].width = columns[4].title.length;
+        columns[4].sortable = true;
         columns[5].title = WebInspector.UIString("Size");
-        columns[5].width = columns[5].title.length;
         columns[5].aligned = "right";
+        columns[5].sortable = true;
         columns[6].title = WebInspector.UIString("HTTP");
-        columns[6].width = columns[6].title.length;
         columns[6].aligned = "centered";
+        columns[6].sortable = true;
         columns[7].title = WebInspector.UIString("Secure");
-        columns[7].width = columns[7].title.length;
         columns[7].aligned = "centered";
+        columns[7].sortable = true;
 
-        function updateDataAndColumn(index, value) {
-            data[index] = value;
-            if (value.length > columns[index].width)
-                columns[index].width = value.length;
-        }
+        this._dataGrid = new WebInspector.DataGrid(columns, null, this._deleteCookieCallback.bind(this));
+        this._dataGrid.addEventListener("sorting changed", this._populateDataGrid, this);
+        this.element.appendChild(this._dataGrid.element);
+        this._dataGrid.updateWidths();
+    },
 
-        var data;
-        var nodes = [];
-        for (var i = 0; i < cookies.length; ++i) {
-            var cookie = cookies[i];
-            data = {};
-
-            updateDataAndColumn(0, cookie.name);
-            updateDataAndColumn(1, cookie.value);
-            updateDataAndColumn(2, cookie.domain);
-            updateDataAndColumn(3, cookie.path);
-            updateDataAndColumn(4, (cookie.session ? WebInspector.UIString("Session") : cookie.expires.toGMTString()));
-            updateDataAndColumn(5, Number.bytesToString(cookie.size, WebInspector.UIString));
-            updateDataAndColumn(6, (cookie.httpOnly ? "\u2713" : "")); // Checkmark
-            updateDataAndColumn(7, (cookie.secure ? "\u2713" : "")); // Checkmark
+    _populateDataGrid: function()
+    {
+        var selectedCookie = this._dataGrid.selectedNode ? this._dataGrid.selectedNode.cookie : null;
+        var sortDirection = this._dataGrid.sortOrder === "ascending" ? 1 : -1;
 
-            var node = new WebInspector.DataGridNode(data, false);
-            node.cookie = cookie;
-            node.selectable = true;
-            nodes.push(node);
+        function localeCompare(field, cookie1, cookie2)
+        {
+            return sortDirection * (cookie1[field] + "").localeCompare(cookie2[field] + "")
         }
 
-        var totalColumnWidths = 0;
-        for (var columnIdentifier in columns)
-            totalColumnWidths += columns[columnIdentifier].width;
-
-        // Enforce the Value column (the 2nd column) to be a max of 33%
-        // tweaking the raw total width because may massively outshadow the others
-        var valueColumnWidth = columns[1].width;
-        if (valueColumnWidth / totalColumnWidths > 0.33) {
-            totalColumnWidths -= valueColumnWidth;
-            totalColumnWidths *= 1.33;
-            columns[1].width = totalColumnWidths * 0.33;
+        function numberCompare(field, cookie1, cookie2)
+        {
+            return sortDirection * (cookie1[field] - cookie2[field]);
         }
 
-        // Calculate the percentage width for the columns.
-        const minimumPrecent = 6;
-        var recoupPercent = 0;
-        for (var columnIdentifier in columns) {
-            var width = columns[columnIdentifier].width;
-            width = Math.round((width / totalColumnWidths) * 100);
-            if (width < minimumPrecent) {
-                recoupPercent += (minimumPrecent - width);
-                width = minimumPrecent;
-            }
-            columns[columnIdentifier].width = width;
-        }
+        function expiresCompare(cookie1, cookie2)
+        {
+            if (cookie1.session !== cookie2.session)
+                return sortDirection * (cookie1.session ? 1 : -1);
 
-        // Enforce the minimum percentage width. (need to narrow total percentage due to earlier additions)
-        while (recoupPercent > 0) {
-            for (var columnIdentifier in columns) {
-                if (columns[columnIdentifier].width > minimumPrecent) {
-                    --columns[columnIdentifier].width;
-                    --recoupPercent;
-                    if (!recoupPercent)
-                        break;
-                }
-            }
+            if (cookie1.session)
+                return 0;
+
+            return sortDirection * (cookie1.expires - cookie2.expires);
         }
 
-        for (var columnIdentifier in columns)
-            columns[columnIdentifier].width += "%";
+        var comparator;
+        switch (parseInt(this._dataGrid.sortColumnIdentifier)) {
+            case 0: comparator = localeCompare.bind(this, "name"); break;
+            case 1: comparator = localeCompare.bind(this, "value"); break;
+            case 2: comparator = localeCompare.bind(this, "domain"); break;
+            case 3: comparator = localeCompare.bind(this, "path"); break;
+            case 4: comparator = expiresCompare; break;
+            case 5: comparator = numberCompare.bind(this, "size"); break;
+            case 6: comparator = localeCompare.bind(this, "httpOnly"); break;
+            case 7: comparator = localeCompare.bind(this, "secure"); break;
+            default: localeCompare.bind(this, "name");
+        }
 
-        var dataGrid = new WebInspector.DataGrid(columns);
-        var length = nodes.length;
-        for (var i = 0; i < length; ++i)
-            dataGrid.appendChild(nodes[i]);
-        if (length > 0)
-            nodes[0].selected = true;
+        this._cookies.sort(comparator);
 
-        return dataGrid;
+        this._dataGrid.removeChildren();
+        var nodeToSelect;
+        for (var i = 0; i < this._cookies.length; ++i) {
+            var data = {};
+            var cookie = this._cookies[i];
+            data[0] = cookie.name;
+            data[1] = cookie.value;
+            data[2] = cookie.domain;
+            data[3] = cookie.path;
+            data[4] = (cookie.session ? WebInspector.UIString("Session") : new Date(cookie.expires).toGMTString());
+            data[5] = Number.bytesToString(cookie.size, WebInspector.UIString);
+            data[6] = (cookie.httpOnly ? "\u2713" : ""); // Checkmark
+            data[7] = (cookie.secure ? "\u2713" : ""); // Checkmark
+
+            var node = new WebInspector.DataGridNode(data);
+            node.cookie = cookie;
+            node.selectable = true;
+            this._dataGrid.appendChild(node);
+            if (cookie === selectedCookie)
+                nodeToSelect = node;
+        }
+        if (nodeToSelect)
+            nodeToSelect.selected = true;
+        else
+            this._dataGrid.children[0].selected = true;
     },
 
-    simpleDataGridForCookies: function(cookies)
+    _createSimpleDataGrid: function()
     {
-        if (!cookies.length)
-            return null;
-
         var columns = {};
         columns[0] = {};
         columns[1] = {};
         columns[0].title = WebInspector.UIString("Name");
-        columns[0].width = columns[0].title.length;
         columns[1].title = WebInspector.UIString("Value");
-        columns[1].width = columns[1].title.length;
 
-        var nodes = [];
+        this._dataGrid = new WebInspector.DataGrid(columns);
+        this.element.appendChild(this._dataGrid.element);
+        this._dataGrid.updateWidths();
+    },
+
+    _populateSimpleDataGrid: function()
+    {
+        var cookies = this._cookies;
+        this._dataGrid.removeChildren();
+        var addedCookies = {};
         for (var i = 0; i < cookies.length; ++i) {
-            var cookie = cookies[i];
+            if (addedCookies[cookies[i].name])
+                continue;
+            addedCookies[cookies[i].name] = true;
             var data = {};
-
-            var name = cookie.name;
-            data[0] = name;
-            if (name.length > columns[0].width)
-                columns[0].width = name.length;
-
-            var value = cookie.value;
-            data[1] = value;
-            if (value.length > columns[1].width)
-                columns[1].width = value.length;
+            data[0] = cookies[i].name;
+            data[1] = cookies[i].value;
 
             var node = new WebInspector.DataGridNode(data, false);
             node.selectable = true;
-            nodes.push(node);
+            this._dataGrid.appendChild(node);
         }
-
-        var totalColumnWidths = columns[0].width + columns[1].width;
-        var width = Math.round((columns[0].width * 100) / totalColumnWidths);
-        const minimumPrecent = 20;
-        if (width < minimumPrecent)
-            width = minimumPrecent;
-        if (width > 100 - minimumPrecent)
-            width = 100 - minimumPrecent;
-        columns[0].width = width;
-        columns[1].width = 100 - width;
-        columns[0].width += "%";
-        columns[1].width += "%";
-
-        var dataGrid = new WebInspector.DataGrid(columns);
-        var length = nodes.length;
-        for (var i = 0; i < length; ++i)
-            dataGrid.appendChild(nodes[i]);
-        if (length > 0)
-            nodes[0].selected = true;
-
-        return dataGrid;
+        this._dataGrid.children[0].selected = true;
     },
-    
+
     resize: function()
     {
         if (this._dataGrid)
@@ -258,17 +281,22 @@ WebInspector.CookieItemsView.prototype = {
 
     _deleteButtonClicked: function(event)
     {
-        if (!this._dataGrid)
+        if (!this._dataGrid || !this._dataGrid.selectedNode)
             return;
 
-        var cookie = this._dataGrid.selectedNode.cookie;
-        InspectorController.deleteCookie(cookie.name, this._cookieDomain);
-        this.update();
+        this._deleteCookieCallback(this._dataGrid.selectedNode);
+    },
+
+    _deleteCookieCallback: function(node)
+    {
+        var cookie = node.cookie;
+        InspectorBackend.deleteCookie(cookie.name, this._cookieDomain);
+        this._update();
     },
 
     _refreshButtonClicked: function(event)
     {
-        this.update();
+        this._update();
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMAgent.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMAgent.js
index 25ffafaec5..1515fe6563 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMAgent.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMAgent.js
@@ -33,6 +33,10 @@ WebInspector.DOMNode = function(doc, payload) {
     this.ownerDocument = doc;
 
     this.id = payload.id;
+    // injectedScriptId is a node is for DOM nodes which should be converted
+    // to corresponding InjectedScript by the inspector backend. We indicate
+    // this by making injectedScriptId negative.
+    this.injectedScriptId = -payload.id;
     this.nodeType = payload.nodeType;
     this.nodeName = payload.nodeName;
     this.localName = payload.localName;
@@ -60,12 +64,20 @@ WebInspector.DOMNode = function(doc, payload) {
     this.style = null;
     this._matchedCSSRules = [];
 
-    if (this.nodeType == Node.ELEMENT_NODE) {
-        if (this.nodeName == "HTML")
+    if (this.nodeType === Node.ELEMENT_NODE) {
+        // HTML and BODY from internal iframes should not overwrite top-level ones.
+        if (!this.ownerDocument.documentElement && this.nodeName === "HTML")
             this.ownerDocument.documentElement = this;
-        if (this.nodeName == "BODY")
+        if (!this.ownerDocument.body && this.nodeName === "BODY")
             this.ownerDocument.body = this;
-    }
+        if (payload.documentURL)
+            this.documentURL = payload.documentURL;
+    } else if (this.nodeType === Node.DOCUMENT_TYPE_NODE) {
+        this.publicId = payload.publicId;
+        this.systemId = payload.systemId;
+        this.internalSubset = payload.internalSubset;
+    } else if (this.nodeType === Node.DOCUMENT_NODE)
+        this.documentURL = payload.documentURL;
 }
 
 WebInspector.DOMNode.prototype = {
@@ -132,6 +144,8 @@ WebInspector.DOMNode.prototype = {
 
     _setAttributesPayload: function(attrs)
     {
+        this.attributes = [];
+        this._attributesMap = {};
         for (var i = 0; i < attrs.length; i += 2)
             this._addAttribute(attrs[i], attrs[i + 1]);
     },
@@ -139,10 +153,13 @@ WebInspector.DOMNode.prototype = {
     _insertChild: function(prev, payload)
     {
         var node = new WebInspector.DOMNode(this.ownerDocument, payload);
-        if (!prev)
-            // First node
-            this.children = [ node ];
-        else
+        if (!prev) {
+            if (!this.children) {
+                // First node
+                this.children = [ node ];
+            } else
+                this.children.unshift(node);
+        } else
             this.children.splice(this.children.indexOf(prev) + 1, 0, node);
         this._renumber();
         return node;
@@ -178,6 +195,7 @@ WebInspector.DOMNode.prototype = {
         this.lastChild = this.children[this._childNodeCount - 1];
         for (var i = 0; i < this._childNodeCount; ++i) {
             var child = this.children[i];
+            child.index = i;
             child.nextSibling = i + 1 < this._childNodeCount ? this.children[i + 1] : null;
             child.prevSibling = i - 1 >= 0 ? this.children[i - 1] : null;
             child.parentNode = this;
@@ -193,30 +211,6 @@ WebInspector.DOMNode.prototype = {
         };
         this._attributesMap[name] = attr;
         this.attributes.push(attr);
-    },
-
-    _setStyles: function(computedStyle, inlineStyle, styleAttributes, matchedCSSRules)
-    {
-        this._computedStyle = new WebInspector.CSSStyleDeclaration(computedStyle);
-        this.style = new WebInspector.CSSStyleDeclaration(inlineStyle);
-
-        for (var name in styleAttributes) {
-            if (this._attributesMap[name])
-                this._attributesMap[name].style = new WebInspector.CSSStyleDeclaration(styleAttributes[name]);
-        }
-
-        this._matchedCSSRules = [];
-        for (var i = 0; i < matchedCSSRules.length; i++)
-            this._matchedCSSRules.push(WebInspector.CSSStyleDeclaration.parseRule(matchedCSSRules[i]));
-    },
-
-    _clearStyles: function()
-    {
-        this.computedStyle = null;
-        this.style = null;
-        for (var name in this._attributesMap)
-            this._attributesMap[name].style = null;
-        this._matchedCSSRules = null;
     }
 }
 
@@ -290,16 +284,6 @@ WebInspector.DOMWindow.prototype = {
 
     Object: function()
     {
-    },
-
-    getComputedStyle: function(node)
-    {
-        return node._computedStyle;
-    },
-
-    getMatchedCSSRules: function(node, pseudoElement, authorOnly)
-    {
-        return node._matchedCSSRules;
     }
 }
 
@@ -326,25 +310,25 @@ WebInspector.DOMAgent.prototype = {
             callback(parent.children);
         }
         var callId = WebInspector.Callback.wrap(mycallback);
-        InspectorController.getChildNodes(callId, parent.id);
+        InspectorBackend.getChildNodes(callId, parent.id);
     },
 
     setAttributeAsync: function(node, name, value, callback)
     {
         var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        InspectorController.setAttribute(WebInspector.Callback.wrap(mycallback), node.id, name, value);
+        InspectorBackend.setAttribute(WebInspector.Callback.wrap(mycallback), node.id, name, value);
     },
 
     removeAttributeAsync: function(node, name, callback)
     {
         var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        InspectorController.removeAttribute(WebInspector.Callback.wrap(mycallback), node.id, name);
+        InspectorBackend.removeAttribute(WebInspector.Callback.wrap(mycallback), node.id, name);
     },
 
     setTextNodeValueAsync: function(node, text, callback)
     {
         var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        InspectorController.setTextNodeValue(WebInspector.Callback.wrap(mycallback), node.id, text);
+        InspectorBackend.setTextNodeValue(WebInspector.Callback.wrap(mycallback), node.id, text);
     },
 
     _didApplyDomChange: function(node, callback, success)
@@ -354,15 +338,16 @@ WebInspector.DOMAgent.prototype = {
         callback();
         // TODO(pfeldman): Fix this hack.
         var elem = WebInspector.panels.elements.treeOutline.findTreeElement(node);
-        if (elem) {
-            elem._updateTitle();
-        }
+        if (elem)
+            elem.updateTitle();
     },
 
     _attributesUpdated: function(nodeId, attrsArray)
     {
         var node = this._idToDOMNode[nodeId];
         node._setAttributesPayload(attrsArray);
+        var event = {target: node};
+        this.document._fireDomEvent("DOMAttrModified", event);
     },
 
     nodeForId: function(nodeId) {
@@ -372,13 +357,13 @@ WebInspector.DOMAgent.prototype = {
     _setDocument: function(payload)
     {
         this._idToDOMNode = {};
-        if (payload) {
+        if (payload && "id" in payload) {
             this.document = new WebInspector.DOMDocument(this, this._window, payload);
             this._idToDOMNode[payload.id] = this.document;
             this._bindNodes(this.document.children);
         } else
             this.document = null;
-        WebInspector.panels.elements.reset();
+        WebInspector.panels.elements.setDocument(this.document);
     },
 
     _setDetachedRoot: function(payload)
@@ -437,7 +422,7 @@ WebInspector.DOMAgent.prototype = {
 
 WebInspector.Cookies = {}
 
-WebInspector.Cookies.getCookiesAsync = function(callback, cookieDomain)
+WebInspector.Cookies.getCookiesAsync = function(callback)
 {
     function mycallback(cookies, cookiesString) {
         if (cookiesString)
@@ -446,7 +431,7 @@ WebInspector.Cookies.getCookiesAsync = function(callback, cookieDomain)
             callback(cookies, true);
     }
     var callId = WebInspector.Callback.wrap(mycallback);
-    InspectorController.getCookies(callId, cookieDomain);
+    InspectorBackend.getCookies(callId);
 }
 
 WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
@@ -468,6 +453,28 @@ WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
     return cookies;
 }
 
+WebInspector.Cookies.cookieMatchesResourceURL = function(cookie, resourceURL)
+{
+    var match = resourceURL.match(WebInspector.URLRegExp);
+    if (!match)
+        return false;
+    // See WebInspector.URLRegExp for definitions of the group index constants.
+    if (!this.cookieDomainMatchesResourceDomain(cookie.domain, match[2]))
+        return false;
+    var resourcePort = match[3] ? match[3] : undefined;
+    var resourcePath = match[4] ? match[4] : '/';
+    return (resourcePath.indexOf(cookie.path) === 0
+        && (!cookie.port || resourcePort == cookie.port)
+        && (!cookie.secure || match[1].toLowerCase() === 'https'));
+}
+
+WebInspector.Cookies.cookieDomainMatchesResourceDomain = function(cookieDomain, resourceDomain)
+{
+    if (cookieDomain.charAt(0) !== '.')
+        return resourceDomain === cookieDomain;
+    return !!resourceDomain.match(new RegExp("^([^\\.]+\\.)?" + cookieDomain.substring(1).escapeForRegExp() + "$"), "i");
+}
+
 WebInspector.EventListeners = {}
 
 WebInspector.EventListeners.getEventListenersForNodeAsync = function(node, callback)
@@ -476,7 +483,7 @@ WebInspector.EventListeners.getEventListenersForNodeAsync = function(node, callb
         return;
 
     var callId = WebInspector.Callback.wrap(callback);
-    InspectorController.getEventListenersForNode(callId, node.id);
+    InspectorBackend.getEventListenersForNode(callId, node.id);
 }
 
 WebInspector.CSSStyleDeclaration = function(payload)
@@ -484,10 +491,27 @@ WebInspector.CSSStyleDeclaration = function(payload)
     this.id = payload.id;
     this.width = payload.width;
     this.height = payload.height;
-    this.__disabledProperties = payload.__disabledProperties;
-    this.__disabledPropertyValues = payload.__disabledPropertyValues;
-    this.__disabledPropertyPriorities = payload.__disabledPropertyPriorities;
-    this.uniqueStyleProperties = payload.uniqueStyleProperties;
+    this.__disabledProperties = {};
+    this.__disabledPropertyValues = {};
+    this.__disabledPropertyPriorities = {};
+    if (payload.disabled) {
+        var disabledProperties = payload.disabled.properties;
+        var shorthandValues = payload.disabled.shorthandValues;
+        for (var name in shorthandValues) {
+            this.__disabledProperties[name] = true;
+            this.__disabledPropertyValues[name] = shorthandValues[name];
+        }
+        for (var i = 0; i < disabledProperties.length; ++i) {
+            var disabledProperty = disabledProperties[i];
+            if (disabledProperty.shorthand)
+                continue;
+            var name = disabledProperty.name;
+            this.__disabledProperties[name] = true;
+            this.__disabledPropertyValues[name] = disabledProperty.value;
+            this.__disabledPropertyPriorities[name] = disabledProperty.priority;
+        }
+    }
+    
     this._shorthandValues = payload.shorthandValues;
     this._propertyMap = {};
     this._longhandProperties = {};
@@ -498,12 +522,8 @@ WebInspector.CSSStyleDeclaration = function(payload)
         var name = property.name;
         this[i] = name;
         this._propertyMap[name] = property;
-    }
 
-    // Index longhand properties.
-    for (var i = 0; i < this.uniqueStyleProperties.length; ++i) {
-        var name = this.uniqueStyleProperties[i];
-        var property = this._propertyMap[name];
+        // Index longhand properties.
         if (property.shorthand) {
             var longhands = this._longhandProperties[property.shorthand];
             if (!longhands) {
@@ -530,6 +550,7 @@ WebInspector.CSSStyleDeclaration.parseRule = function(payload)
     rule.isUserAgent = payload.isUserAgent;
     rule.isUser = payload.isUser;
     rule.isViaInspector = payload.isViaInspector;
+    rule.sourceLine = payload.sourceLine;
     if (payload.parentStyleSheet)
         rule.parentStyleSheet = { href: payload.parentStyleSheet.href };
 
@@ -654,4 +675,16 @@ WebInspector.didPerformSearch = WebInspector.Callback.processCallback;
 WebInspector.didApplyDomChange = WebInspector.Callback.processCallback;
 WebInspector.didRemoveAttribute = WebInspector.Callback.processCallback;
 WebInspector.didSetTextNodeValue = WebInspector.Callback.processCallback;
+WebInspector.didRemoveNode = WebInspector.Callback.processCallback;
 WebInspector.didGetEventListenersForNode = WebInspector.Callback.processCallback;
+
+WebInspector.didGetStyles = WebInspector.Callback.processCallback;
+WebInspector.didGetAllStyles = WebInspector.Callback.processCallback;
+WebInspector.didGetInlineStyle = WebInspector.Callback.processCallback;
+WebInspector.didGetComputedStyle = WebInspector.Callback.processCallback;
+WebInspector.didApplyStyleText = WebInspector.Callback.processCallback;
+WebInspector.didSetStyleText = WebInspector.Callback.processCallback;
+WebInspector.didSetStyleProperty = WebInspector.Callback.processCallback;
+WebInspector.didToggleStyleEnabled = WebInspector.Callback.processCallback;
+WebInspector.didSetRuleSelector = WebInspector.Callback.processCallback;
+WebInspector.didAddRule = WebInspector.Callback.processCallback;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorage.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorage.js
index 03a10bf0cd..c5f658d39d 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorage.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorage.js
@@ -57,19 +57,19 @@ WebInspector.DOMStorage.prototype = {
     getEntries: function(callback)
     {
         var callId = WebInspector.Callback.wrap(callback);
-        InspectorController.getDOMStorageEntries(callId, this._id);
+        InspectorBackend.getDOMStorageEntries(callId, this._id);
     },
     
     setItem: function(key, value, callback)
     {
         var callId = WebInspector.Callback.wrap(callback);
-        InspectorController.setDOMStorageItem(callId, this._id, key, value);
+        InspectorBackend.setDOMStorageItem(callId, this._id, key, value);
     },
     
     removeItem: function(key, callback)
     {
         var callId = WebInspector.Callback.wrap(callback);
-        InspectorController.removeDOMStorageItem(callId, this._id, key);
+        InspectorBackend.removeDOMStorageItem(callId, this._id, key);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageDataGrid.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageDataGrid.js
deleted file mode 100644
index 45a9ba13a5..0000000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageDataGrid.js
+++ /dev/null
@@ -1,161 +0,0 @@
-/*
- * Copyright (C) 2009 Nokia Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *        notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *        notice, this list of conditions and the following disclaimer in the
- *        documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.         IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-WebInspector.DOMStorageDataGrid = function(columns, domStorage, keys)
-{
-    WebInspector.DataGrid.call(this, columns);
-    this.dataTableBody.addEventListener("dblclick", this._ondblclick.bind(this), false);
-    this._domStorage = domStorage;
-    this._keys = keys;
-}
-
-WebInspector.DOMStorageDataGrid.prototype = {
-    _ondblclick: function(event)
-    {
-        if (this._editing)
-            return;
-        if (this._editingNode)
-            return;
-        this._startEditing(event);
-    },
-
-    _startEditingColumnOfDataGridNode: function(node, column)
-    {
-        this._editing = true;
-        this._editingNode = node;
-        this._editingNode.select();
-
-        var element = this._editingNode._element.children[column];
-        WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
-        window.getSelection().setBaseAndExtent(element, 0, element, 1);
-    },
-
-    _startEditing: function(event)
-    {
-        var element = event.target.enclosingNodeOrSelfWithNodeName("td");
-        if (!element)
-            return;
-
-        this._editingNode = this.dataGridNodeFromEvent(event);
-        if (!this._editingNode) {
-            if (!this.creationNode)
-                return;
-            this._editingNode = this.creationNode;
-        }
-
-        // Force editing the "Key" column when editing the creation node
-        if (this._editingNode.isCreationNode)
-            return this._startEditingColumnOfDataGridNode(this._editingNode, 0);
-
-        this._editing = true;
-        WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
-        window.getSelection().setBaseAndExtent(element, 0, element, 1);
-    },
-
-    _editingCommitted: function(element, newText, oldText, context, moveDirection)
-    {
-        var columnIdentifier = (element.hasStyleClass("0-column") ? 0 : 1);
-        var textBeforeEditing = this._editingNode.data[columnIdentifier];
-        var currentEditingNode = this._editingNode;
-
-        function moveToNextIfNeeded(wasChange) {
-            if (!moveDirection)
-                return;
-
-            if (moveDirection === "forward") {
-                if (currentEditingNode.isCreationNode && columnIdentifier === 0 && !wasChange)
-                    return;
-
-                if (columnIdentifier === 0)
-                    return this._startEditingColumnOfDataGridNode(currentEditingNode, 1);
-
-                var nextDataGridNode = currentEditingNode.traverseNextNode(true, null, true);
-                if (nextDataGridNode)
-                    return this._startEditingColumnOfDataGridNode(nextDataGridNode, 0);
-                if (currentEditingNode.isCreationNode && wasChange) {
-                    addCreationNode(false);
-                    return this._startEditingColumnOfDataGridNode(this.creationNode, 0);
-                }
-                return;
-            }
-
-            if (moveDirection === "backward") {
-                if (columnIdentifier === 1)
-                    return this._startEditingColumnOfDataGridNode(currentEditingNode, 0);
-                    var nextDataGridNode = currentEditingNode.traversePreviousNode(true, null, true);
-
-                if (nextDataGridNode)
-                    return this._startEditingColumnOfDataGridNode(nextDataGridNode, 1);
-                return;
-            }
-        }
-
-        if (textBeforeEditing == newText) {
-            this._editingCancelled(element);
-            moveToNextIfNeeded.call(this, false);
-            return;
-        }
-
-        var domStorage = this._domStorage;
-        if (columnIdentifier === 0) {
-            if (this._keys.indexOf(newText) !== -1) {
-                element.textContent = this._editingNode.data[0];
-                this._editingCancelled(element);
-                moveToNextIfNeeded.call(this, false);
-                return;
-            }
-            domStorage.removeItem(this._editingNode.data[0]);
-            domStorage.setItem(newText, this._editingNode.data[1]);
-            this._editingNode.data[0] = newText;
-        } else {
-            domStorage.setItem(this._editingNode.data[0], newText);
-            this._editingNode.data[1] = newText;
-        }
-
-        if (this._editingNode.isCreationNode)
-            this.addCreationNode(false);
-
-        this._editingCancelled(element);
-        moveToNextIfNeeded.call(this, true);
-    },
-
-    _editingCancelled: function(element, context)
-    {
-        delete this._editing;
-        this._editingNode = null;
-    },
-
-    deleteSelectedRow: function()
-    {
-        var node = this.selectedNode;
-        if (!node || node.isCreationNode)
-            return;
-
-        if (this._domStorage)
-            this._domStorage.removeItem(node.data[0]);
-    }
-}
-
-WebInspector.DOMStorageDataGrid.prototype.__proto__ = WebInspector.DataGrid.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageItemsView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageItemsView.js
index a7da370caa..dbd736bf69 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageItemsView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageItemsView.js
@@ -65,22 +65,12 @@ WebInspector.DOMStorageItemsView.prototype = {
         this.domStorage.getEntries(callback);
     },
 
-    _showDOMStorageEntries: function(entries) 
+    _showDOMStorageEntries: function(entries)
     {
-        if (entries.length > 0) {
-            this._dataGrid = this._dataGridForDOMStorageEntries(entries);
-            this.element.appendChild(this._dataGrid.element);
-            this._dataGrid.updateWidths();
-            this.deleteButton.visible = true;
-        } else {
-            var emptyMsgElement = document.createElement("div");
-            emptyMsgElement.className = "storage-table-empty";
-            if (this.domStorage)
-                emptyMsgElement.textContent = WebInspector.UIString("This storage is empty.");
-            this.element.appendChild(emptyMsgElement);
-            this._dataGrid = null;
-            this.deleteButton.visible = false;
-        }
+        this._dataGrid = this._dataGridForDOMStorageEntries(entries);
+        this.element.appendChild(this._dataGrid.element);
+        this._dataGrid.autoSizeColumns(10);
+        this.deleteButton.visible = true;
     },
 
     resize: function()
@@ -95,9 +85,7 @@ WebInspector.DOMStorageItemsView.prototype = {
         columns[0] = {};
         columns[1] = {};
         columns[0].title = WebInspector.UIString("Key");
-        columns[0].width = columns[0].title.length;
         columns[1].title = WebInspector.UIString("Value");
-        columns[1].width = columns[1].title.length;
 
         var nodes = [];
 
@@ -108,32 +96,15 @@ WebInspector.DOMStorageItemsView.prototype = {
 
             var key = entries[i][0];
             data[0] = key;
-            if (key.length > columns[0].width)
-                columns[0].width = key.length;
-
             var value = entries[i][1];
             data[1] = value;
-            if (value.length > columns[1].width)
-                columns[1].width = value.length;
             var node = new WebInspector.DataGridNode(data, false);
             node.selectable = true;
             nodes.push(node);
             keys.push(key);
         }
 
-        var totalColumnWidths = columns[0].width + columns[1].width;
-        var width = Math.round((columns[0].width * 100) / totalColumnWidths);
-        const minimumPrecent = 10;
-        if (width < minimumPrecent)
-            width = minimumPrecent;
-        if (width > 100 - minimumPrecent)
-            width = 100 - minimumPrecent;
-        columns[0].width = width;
-        columns[1].width = 100 - width;
-        columns[0].width += "%";
-        columns[1].width += "%";
-
-        var dataGrid = new WebInspector.DOMStorageDataGrid(columns, this.domStorage, keys);
+        var dataGrid = new WebInspector.DataGrid(columns, this._editingCallback.bind(this), this._deleteCallback.bind(this));
         var length = nodes.length;
         for (var i = 0; i < length; ++i)
             dataGrid.appendChild(nodes[i]);
@@ -145,16 +116,41 @@ WebInspector.DOMStorageItemsView.prototype = {
 
     _deleteButtonClicked: function(event)
     {
-        if (this._dataGrid) {
-            this._dataGrid.deleteSelectedRow();
-            
-            this.show();
-        }
+        if (!this._dataGrid || !this._dataGrid.selectedNode)
+            return;
+
+        this._deleteCallback(this._dataGrid.selectedNode);
     },
 
     _refreshButtonClicked: function(event)
     {
         this.update();
+    },
+    
+    _editingCallback: function(editingNode, columnIdentifier, oldText, newText)
+    {
+        var domStorage = this.domStorage;
+        if (columnIdentifier === 0) {
+            if (oldText)
+                domStorage.removeItem(oldText);
+
+            domStorage.setItem(newText, editingNode.data[1]);
+        } else {
+            domStorage.setItem(editingNode.data[0], newText);
+        }
+        
+        this.update();
+    },
+    
+    _deleteCallback: function(node)
+    {
+        if (!node || node.isCreationNode)
+            return;
+
+        if (this.domStorage)
+            this.domStorage.removeItem(node.data[0]);
+            
+        this.update();
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMSyntaxHighlighter.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMSyntaxHighlighter.js
new file mode 100644
index 0000000000..07233d3807
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMSyntaxHighlighter.js
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.DOMSyntaxHighlighter = function(mimeType)
+{
+    this._tokenizer = WebInspector.SourceTokenizer.Registry.getInstance().getTokenizer(mimeType);
+}
+
+WebInspector.DOMSyntaxHighlighter.prototype = {
+    createSpan: function(content, className)
+    {
+        var span = document.createElement("span");
+        span.className = "webkit-" + className;
+        span.appendChild(document.createTextNode(content));
+        return span;
+    },
+
+    syntaxHighlightNode: function(node)
+    {
+        this._tokenizer.condition = this._tokenizer.initialCondition;
+        var lines = node.textContent.split("\n");
+        node.removeChildren();
+
+        for (var i = lines[0].length ? 0 : 1; i < lines.length; ++i) {
+            var line = lines[i];
+            var plainTextStart = 0;
+            this._tokenizer.line = line;
+            var column = 0;
+            do {
+                var newColumn = this._tokenizer.nextToken(column);
+                var tokenType = this._tokenizer.tokenType;
+                if (tokenType) {
+                    if (column > plainTextStart) {
+                        var plainText = line.substring(plainTextStart, column);
+                        node.appendChild(document.createTextNode(plainText));
+                    }
+                    var token = line.substring(column, newColumn);
+                    node.appendChild(this.createSpan(token, tokenType));
+                    plainTextStart = newColumn;
+                }
+                column = newColumn;
+           } while (column < line.length)
+
+           if (plainTextStart < line.length) {
+               var plainText = line.substring(plainTextStart, line.length);
+               node.appendChild(document.createTextNode(plainText));
+           }
+           if (i < lines.length - 1)
+               node.appendChild(document.createElement("br"));
+        }
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js
index ce615483b0..1ecc4f20a1 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js
@@ -23,7 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.DataGrid = function(columns)
+WebInspector.DataGrid = function(columns, editCallback, deleteCallback)
 {
     this.element = document.createElement("div");
     this.element.className = "data-grid";
@@ -38,7 +38,18 @@ WebInspector.DataGrid = function(columns)
 
     this._dataTable.addEventListener("mousedown", this._mouseDownInDataTable.bind(this), true);
     this._dataTable.addEventListener("click", this._clickInDataTable.bind(this), true);
-
+    
+    this._dataTable.addEventListener("contextmenu", this._contextMenuInDataTable.bind(this), true);
+    
+    // FIXME: Add a createCallback which is different from editCallback and has different
+    // behavior when creating a new node.
+    if (editCallback) {
+        this._dataTable.addEventListener("dblclick", this._ondblclick.bind(this), false);
+        this._editCallback = editCallback;
+    }
+    if (deleteCallback)
+        this._deleteCallback = deleteCallback;
+    
     this.aligned = {};
 
     var scrollContainer = document.createElement("div");
@@ -50,7 +61,7 @@ WebInspector.DataGrid = function(columns)
 
     var headerRow = document.createElement("tr");
     var columnGroup = document.createElement("colgroup");
-    var columnCount = 0;
+    this._columnCount = 0;
 
     for (var columnIdentifier in columns) {
         var column = columns[columnIdentifier];
@@ -60,6 +71,7 @@ WebInspector.DataGrid = function(columns)
         var col = document.createElement("col");
         if (column.width)
             col.style.width = column.width;
+        column.element = col;
         columnGroup.appendChild(col);
 
         var cell = document.createElement("th");
@@ -87,10 +99,10 @@ WebInspector.DataGrid = function(columns)
 
         headerRow.appendChild(cell);
 
-        ++columnCount;
+        ++this._columnCount;
     }
 
-    columnGroup.span = columnCount;
+    columnGroup.span = this._columnCount;
 
     var cell = document.createElement("th");
     cell.className = "corner";
@@ -103,7 +115,7 @@ WebInspector.DataGrid = function(columns)
     var fillerRow = document.createElement("tr");
     fillerRow.className = "filler";
 
-    for (var i = 0; i < columnCount; ++i) {
+    for (var i = 0; i < this._columnCount; ++i) {
         var cell = document.createElement("td");
         fillerRow.appendChild(cell);
     }
@@ -128,6 +140,116 @@ WebInspector.DataGrid = function(columns)
 }
 
 WebInspector.DataGrid.prototype = {
+    _ondblclick: function(event)
+    {
+        if (this._editing || this._editingNode)
+            return;
+
+        this._startEditing(event.target);
+    },
+
+    _startEditingColumnOfDataGridNode: function(node, column)
+    {
+        this._editing = true;
+        this._editingNode = node;
+        this._editingNode.select();
+
+        var element = this._editingNode._element.children[column];
+        WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
+        window.getSelection().setBaseAndExtent(element, 0, element, 1);
+    },
+
+    _startEditing: function(target)
+    {
+        var element = target.enclosingNodeOrSelfWithNodeName("td");
+        if (!element)
+            return;
+
+        this._editingNode = this.dataGridNodeFromNode(target);
+        if (!this._editingNode) {
+            if (!this.creationNode)
+                return;
+            this._editingNode = this.creationNode;
+        }
+
+        // Force editing the 1st column when editing the creation node
+        if (this._editingNode.isCreationNode)
+            return this._startEditingColumnOfDataGridNode(this._editingNode, 0);
+
+        this._editing = true;
+        WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
+        window.getSelection().setBaseAndExtent(element, 0, element, 1);
+    },
+
+    _editingCommitted: function(element, newText, oldText, context, moveDirection)
+    {
+        // FIXME: We need more column identifiers here throughout this function.
+        // Not needed yet since only editable DataGrid is DOM Storage, which is Key - Value.
+        
+        // FIXME: Better way to do this than regular expressions?
+        var columnIdentifier = parseInt(element.className.match(/\b(\d+)-column\b/)[1]);
+
+        var textBeforeEditing = this._editingNode.data[columnIdentifier];
+        var currentEditingNode = this._editingNode;
+
+        function moveToNextIfNeeded(wasChange) {
+            if (!moveDirection)
+                return;
+
+            if (moveDirection === "forward") {
+                if (currentEditingNode.isCreationNode && columnIdentifier === 0 && !wasChange)
+                    return;
+
+                if (columnIdentifier === 0)
+                    return this._startEditingColumnOfDataGridNode(currentEditingNode, 1);
+
+                var nextDataGridNode = currentEditingNode.traverseNextNode(true, null, true);
+                if (nextDataGridNode)
+                    return this._startEditingColumnOfDataGridNode(nextDataGridNode, 0);
+                if (currentEditingNode.isCreationNode && wasChange) {
+                    addCreationNode(false);
+                    return this._startEditingColumnOfDataGridNode(this.creationNode, 0);
+                }
+                return;
+            }
+
+            if (moveDirection === "backward") {
+                if (columnIdentifier === 1)
+                    return this._startEditingColumnOfDataGridNode(currentEditingNode, 0);
+                    var nextDataGridNode = currentEditingNode.traversePreviousNode(true, null, true);
+
+                if (nextDataGridNode)
+                    return this._startEditingColumnOfDataGridNode(nextDataGridNode, 1);
+                return;
+            }
+        }
+
+        if (textBeforeEditing == newText) {
+            this._editingCancelled(element);
+            moveToNextIfNeeded.call(this, false);
+            return;
+        }
+
+        // Update the text in the datagrid that we typed
+        this._editingNode.data[columnIdentifier] = newText;
+        
+        // Make the callback - expects an editing node (table row), the column number that is being edited,
+        // the text that used to be there, and the new text.
+        this._editCallback(this._editingNode, columnIdentifier, textBeforeEditing, newText);
+
+        if (this._editingNode.isCreationNode)
+            this.addCreationNode(false);
+
+        this._editingCancelled(element);
+        moveToNextIfNeeded.call(this, true);
+    },
+
+    _editingCancelled: function(element, context)
+    {
+        delete this._editing;
+        this._editingNode = null;
+    },
+    
     get sortColumnIdentifier()
     {
         if (!this._sortColumnCell)
@@ -171,7 +293,70 @@ WebInspector.DataGrid.prototype = {
 
         return this._dataTableBody;
     },
- 
+
+    autoSizeColumns: function(minPercent, maxPercent)
+    {
+        if (minPercent)
+            minPercent = Math.min(minPercent, Math.floor(100 / this._columnCount));
+        var widths = {};
+        var columns = this.columns;
+        for (var columnIdentifier in columns)
+            widths[columnIdentifier] = (columns[columnIdentifier].title || "").length;
+
+        for (var i = 0; i < this.children.length; ++i) {
+            var node = this.children[i];
+            for (var columnIdentifier in columns) {
+                var text = node.data[columnIdentifier] || "";
+                if (text.length > widths[columnIdentifier])
+                    widths[columnIdentifier] = text.length;
+            }
+        }
+
+        var totalColumnWidths = 0;
+        for (var columnIdentifier in columns)
+            totalColumnWidths += widths[columnIdentifier];
+
+        var recoupPercent = 0;
+        for (var columnIdentifier in columns) {
+            var width = Math.round(100 * widths[columnIdentifier] / totalColumnWidths);
+            if (minPercent && width < minPercent) {
+                recoupPercent += (minPercent - width);
+                width = minPercent;
+            } else if (maxPercent && width > maxPercent) {
+                recoupPercent -= (width - maxPercent);
+                width = maxPercent;
+            }
+            widths[columnIdentifier] = width;
+        }
+
+        while (minPercent && recoupPercent > 0) {
+            for (var columnIdentifier in columns) {
+                if (widths[columnIdentifier] > minPercent) {
+                    --widths[columnIdentifier];
+                    --recoupPercent;
+                    if (!recoupPercent)
+                        break;
+                }
+            }
+        }
+
+        while (maxPercent && recoupPercent < 0) {
+            for (var columnIdentifier in columns) {
+                if (widths[columnIdentifier] < maxPercent) {
+                    ++widths[columnIdentifier];
+                    ++recoupPercent;
+                    if (!recoupPercent)
+                        break;
+                }
+            }
+        }
+
+        for (var columnIdentifier in columns)
+            columns[columnIdentifier].element.style.width = widths[columnIdentifier] + "%";
+        this.columnWidthsInitialized = false;
+        this.updateWidths();
+    },
+
     // Updates the widths of the table, including the positions of the column
     // resizers.
     //
@@ -266,6 +451,7 @@ WebInspector.DataGrid.prototype = {
         delete child._depth;
         delete child._revealed;
         delete child._attached;
+        child._shouldRefreshChildren = true;
 
         var current = child.children[0];
         while (current) {
@@ -273,6 +459,7 @@ WebInspector.DataGrid.prototype = {
             delete current._depth;
             delete current._revealed;
             delete current._attached;
+            current._shouldRefreshChildren = true;
             current = current.traverseNextNode(false, child, true);
         }
 
@@ -348,10 +535,11 @@ WebInspector.DataGrid.prototype = {
         this.children = [];
     },
 
-    handleKeyEvent: function(event)
+
+    _keyDown: function(event)
     {
-        if (!this.selectedNode || event.shiftKey || event.metaKey || event.ctrlKey)
-            return false;
+        if (!this.selectedNode || event.shiftKey || event.metaKey || event.ctrlKey || this._editing)
+            return;
 
         var handled = false;
         var nextSelectedNode;
@@ -396,6 +584,18 @@ WebInspector.DataGrid.prototype = {
                         this.selectedNode.expand();
                 }
             }
+        } else if (event.keyCode === 8 || event.keyCode === 46) {
+            if (this._deleteCallback) {
+                handled = true;
+                this._deleteCallback(this.selectedNode);
+            }
+        } else if (isEnterKey(event)) {
+            if (this._editCallback) {
+                handled = true;
+                // The first child of the selected element is the <td class="0-column">,
+                // and that's what we want to edit.
+                this._startEditing(this.selectedNode._element.children[0]);
+            }
         }
 
         if (nextSelectedNode) {
@@ -407,8 +607,6 @@ WebInspector.DataGrid.prototype = {
             event.preventDefault();
             event.stopPropagation();
         }
-
-        return handled;
     },
 
     expand: function()
@@ -426,9 +624,9 @@ WebInspector.DataGrid.prototype = {
         // This is the root, do nothing.
     },
 
-    dataGridNodeFromEvent: function(event)
+    dataGridNodeFromNode: function(target)
     {
-        var rowElement = event.target.enclosingNodeOrSelfWithNodeName("tr");
+        var rowElement = target.enclosingNodeOrSelfWithNodeName("tr");
         return rowElement._dataGridNode;
     },
 
@@ -439,11 +637,6 @@ WebInspector.DataGrid.prototype = {
         return rowElement._dataGridNode;
     },
 
-    _keyDown: function(event)
-    {
-        this.handleKeyEvent(event);
-    },
-
     _clickInHeaderCell: function(event)
     {
         var cell = event.target.enclosingNodeOrSelfWithNodeName("th");
@@ -473,7 +666,7 @@ WebInspector.DataGrid.prototype = {
 
     _mouseDownInDataTable: function(event)
     {
-        var gridNode = this.dataGridNodeFromEvent(event);
+        var gridNode = this.dataGridNodeFromNode(event.target);
         if (!gridNode || !gridNode.selectable)
             return;
 
@@ -488,10 +681,34 @@ WebInspector.DataGrid.prototype = {
         } else
             gridNode.select();
     },
+    
+    _contextMenuInDataTable: function(event)
+    {
+        var gridNode = this.dataGridNodeFromNode(event.target);
+        if (!gridNode || !gridNode.selectable)
+            return;
+        
+        if (gridNode.isEventWithinDisclosureTriangle(event))
+            return;
+      
+        var contextMenu = new WebInspector.ContextMenu();
+        
+        // FIXME: Use the column names for Editing, instead of just "Edit".
+        if (this.dataGrid._editCallback) {
+            if (gridNode === this.creationNode)
+                contextMenu.appendItem(WebInspector.UIString("Add New"), this._startEditing.bind(this, event.target));
+            else
+                contextMenu.appendItem(WebInspector.UIString("Edit"), this._startEditing.bind(this, event.target));
+        }
+        if (this.dataGrid._deleteCallback && gridNode !== this.creationNode)
+            contextMenu.appendItem(WebInspector.UIString("Delete"), this._deleteCallback.bind(this, gridNode));
+        
+        contextMenu.show(event);
+    },
 
     _clickInDataTable: function(event)
     {
-        var gridNode = this.dataGridNodeFromEvent(event);
+        var gridNode = this.dataGridNodeFromNode(event.target);
         if (!gridNode || !gridNode.hasChildren)
             return;
 
@@ -1019,6 +1236,30 @@ WebInspector.DataGridNode.prototype = {
 
         for (var i = 0; i < this.children.length; ++i)
             this.children[i]._detach();
+    },
+
+    savePosition: function()
+    {
+        if (this._savedPosition)
+            return;
+
+        if (!this.parent)
+            throw("savePosition: Node must have a parent.");
+        this._savedPosition = {
+            parent: this.parent,
+            index: this.parent.children.indexOf(this)
+        };
+    },
+
+    restorePosition: function()
+    {
+        if (!this._savedPosition)
+            return;
+
+        if (this.parent !== this._savedPosition.parent)
+            this._savedPosition.parent.insertChild(this, this._savedPosition.index);
+
+        delete this._savedPosition;
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js
index 1a348fc3f2..a0dc9cad60 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js
@@ -82,7 +82,7 @@ WebInspector.Database.prototype = {
             callback(names.sort());
         }
         var callId = WebInspector.Callback.wrap(sortingCallback);
-        InspectorController.getDatabaseTableNames(callId, this._id);
+        InspectorBackend.getDatabaseTableNames(callId, this._id);
     },
     
     executeSql: function(query, onSuccess, onError)
@@ -95,7 +95,8 @@ WebInspector.Database.prototype = {
             }
             onSuccess(result);
         }
-        InjectedScriptAccess.executeSql(this._id, query, callback);
+        // FIXME: execute the query in the frame the DB comes from.
+        InjectedScriptAccess.getDefault().executeSql(this._id, query, callback);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
index e85af662ce..cc902e793e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
@@ -31,6 +31,7 @@ WebInspector.DatabaseQueryView = function(database)
 
     this.element.addStyleClass("storage-view");
     this.element.addStyleClass("query");
+    this.element.addStyleClass("monospace");
     this.element.tabIndex = 0;
 
     this.element.addEventListener("selectstart", this._selectStart.bind(this), false);
@@ -38,7 +39,7 @@ WebInspector.DatabaseQueryView = function(database)
     this.promptElement = document.createElement("div");
     this.promptElement.className = "database-query-prompt";
     this.promptElement.appendChild(document.createElement("br"));
-    this.promptElement.handleKeyEvent = this._promptKeyDown.bind(this);
+    this.promptElement.addEventListener("keydown", this._promptKeyDown.bind(this), true);
     this.element.appendChild(this.promptElement);
 
     this.prompt = new WebInspector.TextPrompt(this.promptElement, this.completions.bind(this), " ");
@@ -98,8 +99,6 @@ WebInspector.DatabaseQueryView.prototype = {
             this._enterKeyPressed(event);
             return;
         }
-
-        this.prompt.handleKeyEvent(event);
     },
 
     _selectStart: function(event)
@@ -145,6 +144,7 @@ WebInspector.DatabaseQueryView.prototype = {
             return;
         dataGrid.element.addStyleClass("inline");
         this._appendQueryResult(query, dataGrid.element);
+        dataGrid.autoSizeColumns(5);
 
         if (query.match(/^create /i) || query.match(/^drop table /i))
             WebInspector.panels.storage.updateDatabaseTables(this.database);
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js
index aa76794f73..cd66ab7312 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js
@@ -68,6 +68,7 @@ WebInspector.DatabaseTableView.prototype = {
         }
 
         this.element.appendChild(dataGrid.element);
+        dataGrid.autoSizeColumns(5);
     },
 
     _queryError: function(error)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Drawer.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Drawer.js
index 1b50f91bb5..8bf707e971 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Drawer.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Drawer.js
@@ -7,13 +7,13 @@
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
+ *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
+ *     documentation and/or other materials provided with the distribution.
  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
+ *     from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -31,6 +31,12 @@ WebInspector.Drawer = function()
 {
     WebInspector.View.call(this, document.getElementById("drawer"));
 
+    this._savedHeight = 200; // Default.
+    this.state = WebInspector.Drawer.State.Hidden;
+    this.fullPanel = false;
+
+    this.mainElement = document.getElementById("main");
+    this.toolbarElement = document.getElementById("toolbar");
     this.mainStatusBar = document.getElementById("main-status-bar");
     this.mainStatusBar.addEventListener("mousedown", this._startStatusBarDragging.bind(this), true);
     this.viewStatusBar = document.getElementById("other-drawer-status-bar-items");
@@ -45,6 +51,8 @@ WebInspector.Drawer.prototype = {
     set visibleView(x)
     {
         if (this._visibleView === x) {
+            if (this.visible && this.fullPanel)
+                return;
             this.visible = !this.visible;
             return;
         }
@@ -64,6 +72,12 @@ WebInspector.Drawer.prototype = {
         }
     },
 
+    get savedHeight()
+    {
+        var height = this._savedHeight || this.element.offsetHeight;
+        return Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - this.mainElement.totalOffsetTop - Preferences.minConsoleHeight);
+    },
+
     showView: function(view)
     {
         if (!this.visible || this.visibleView !== view)
@@ -85,15 +99,16 @@ WebInspector.Drawer.prototype = {
         document.body.addStyleClass("drawer-visible");
 
         var anchoredItems = document.getElementById("anchored-status-bar-items");
-
+        var height = (this.fullPanel ? window.innerHeight - this.toolbarElement.offsetHeight : this.savedHeight);
         var animations = [
-            {element: document.getElementById("main"), end: {bottom: this.element.offsetHeight}},
+            {element: this.element, end: {height: height}},
+            {element: document.getElementById("main"), end: {bottom: height}},
             {element: document.getElementById("main-status-bar"), start: {"padding-left": anchoredItems.offsetWidth - 1}, end: {"padding-left": 0}},
             {element: document.getElementById("other-drawer-status-bar-items"), start: {opacity: 0}, end: {opacity: 1}}
         ];
 
-        var consoleStatusBar = document.getElementById("drawer-status-bar");
-        consoleStatusBar.insertBefore(anchoredItems, consoleStatusBar.firstChild);
+        var drawerStatusBar = document.getElementById("drawer-status-bar");
+        drawerStatusBar.insertBefore(anchoredItems, drawerStatusBar.firstChild);
 
         function animationFinished()
         {
@@ -102,9 +117,11 @@ WebInspector.Drawer.prototype = {
             if (this.visibleView.afterShow)
                 this.visibleView.afterShow();
             delete this._animating;
+            delete this._currentAnimationInterval;
+            this.state = (this.fullPanel ? WebInspector.Drawer.State.Full : WebInspector.Drawer.State.Variable);
         }
 
-        WebInspector.animateStyle(animations, window.event && window.event.shiftKey ? 2000 : 250, animationFinished.bind(this));
+        this._currentAnimationInterval = WebInspector.animateStyle(animations, this._animationDuration(), animationFinished.bind(this));
     },
 
     hide: function()
@@ -113,20 +130,23 @@ WebInspector.Drawer.prototype = {
             return;
 
         WebInspector.View.prototype.hide.call(this);
-        
+
         if (this.visibleView)
             this.visibleView.hide();
 
         this._animating = true;
 
+        if (!this.fullPanel)
+            this._savedHeight = this.element.offsetHeight;
+
         if (this.element === WebInspector.currentFocusElement || this.element.isAncestor(WebInspector.currentFocusElement))
             WebInspector.currentFocusElement = WebInspector.previousFocusElement;
 
         var anchoredItems = document.getElementById("anchored-status-bar-items");
 
-        // Temporally set properties and classes to mimic the post-animation values so panels
+        // Temporarily set properties and classes to mimic the post-animation values so panels
         // like Elements in their updateStatusBarItems call will size things to fit the final location.
-        document.getElementById("main-status-bar").style.setProperty("padding-left", (anchoredItems.offsetWidth - 1) + "px");
+        this.mainStatusBar.style.setProperty("padding-left", (anchoredItems.offsetWidth - 1) + "px");
         document.body.removeStyleClass("drawer-visible");
         if ("updateStatusBarItems" in WebInspector.currentPanel)
             WebInspector.currentPanel.updateStatusBarItems();
@@ -140,14 +160,102 @@ WebInspector.Drawer.prototype = {
 
         function animationFinished()
         {
+            WebInspector.currentPanel.resize();
             var mainStatusBar = document.getElementById("main-status-bar");
             mainStatusBar.insertBefore(anchoredItems, mainStatusBar.firstChild);
             mainStatusBar.style.removeProperty("padding-left");
             document.body.removeStyleClass("drawer-visible");
             delete this._animating;
+            delete this._currentAnimationInterval;
+            this.state = WebInspector.Drawer.State.Hidden;
+        }
+
+        this._currentAnimationInterval = WebInspector.animateStyle(animations, this._animationDuration(), animationFinished.bind(this));
+    },
+
+    resize: function()
+    {
+        if (this.state === WebInspector.Drawer.State.Hidden)
+            return;
+
+        var height;
+        var mainElement = document.getElementById("main");
+        if (this.state === WebInspector.Drawer.State.Variable) {
+            height = parseInt(this.element.style.height);
+            height = Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - mainElement.totalOffsetTop - Preferences.minConsoleHeight);
+        } else
+            height = window.innerHeight - this.toolbarElement.offsetHeight;
+
+        mainElement.style.bottom = height + "px";
+        this.element.style.height = height + "px";
+    },
+
+    enterPanelMode: function()
+    {
+        this._cancelAnimationIfNeeded();
+        this.fullPanel = true;
+        
+        if (this.visible) {
+            this._savedHeight = this.element.offsetHeight;
+            var height = window.innerHeight - this.toolbarElement.offsetHeight;
+            this._animateDrawerHeight(height, WebInspector.Drawer.State.Full);
+        }
+    },
+
+    exitPanelMode: function()
+    {
+        this._cancelAnimationIfNeeded();
+        this.fullPanel = false;
+
+        if (this.visible) {
+            // If this animation gets cancelled, we want the state of the drawer to be Variable,
+            // so that the new animation can't do an immediate transition between Hidden/Full states.
+            this.state = WebInspector.Drawer.State.Variable;
+            var height = this.savedHeight;
+            this._animateDrawerHeight(height, WebInspector.Drawer.State.Variable);
+        }
+    },
+
+    immediatelyExitPanelMode: function()
+    {
+        this.visible = false;
+        this.fullPanel = false;
+    },
+
+    _cancelAnimationIfNeeded: function()
+    {
+        if (this._animating) {
+            clearInterval(this._currentAnimationInterval);
+            delete this._animating;
+            delete this._currentAnimationInterval;
+        }
+    },
+
+    _animateDrawerHeight: function(height, finalState)
+    {
+        this._animating = true;
+        var animations = [
+            {element: this.element, end: {height: height}},
+            {element: document.getElementById("main"), end: {bottom: height}}
+        ];
+
+        function animationFinished()
+        {
+            delete this._animating;
+            delete this._currentAnimationInterval;
+            this.state = finalState;
         }
 
-        WebInspector.animateStyle(animations, window.event && window.event.shiftKey ? 2000 : 250, animationFinished.bind(this));
+        this._currentAnimationInterval = WebInspector.animateStyle(animations, this._animationDuration(), animationFinished.bind(this));
+    },
+
+    _animationDuration: function()
+    {
+        // Immediate if going between Hidden and Full in full panel mode
+        if (this.fullPanel && (this.state === WebInspector.Drawer.State.Hidden || this.state === WebInspector.Drawer.State.Full))
+            return 0;
+
+        return (window.event && window.event.shiftKey ? 2000 : 250);
     },
 
     _safelyRemoveChildren: function()
@@ -165,10 +273,10 @@ WebInspector.Drawer.prototype = {
 
     _startStatusBarDragging: function(event)
     {
-        if (!this.visible || event.target !== document.getElementById("main-status-bar"))
+        if (!this.visible || event.target !== this.mainStatusBar)
             return;
 
-        WebInspector.elementDragStart(document.getElementById("main-status-bar"), this._statusBarDragging.bind(this), this._endStatusBarDragging.bind(this), event, "row-resize");
+        WebInspector.elementDragStart(this.mainStatusBar, this._statusBarDragging.bind(this), this._endStatusBarDragging.bind(this), event, "row-resize");
 
         this._statusBarDragOffset = event.pageY - this.element.totalOffsetTop;
 
@@ -178,7 +286,6 @@ WebInspector.Drawer.prototype = {
     _statusBarDragging: function(event)
     {
         var mainElement = document.getElementById("main");
-
         var height = window.innerHeight - event.pageY + this._statusBarDragOffset;
         height = Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - mainElement.totalOffsetTop - Preferences.minConsoleHeight);
 
@@ -193,6 +300,7 @@ WebInspector.Drawer.prototype = {
     {
         WebInspector.elementDragEnd(event);
 
+        this._savedHeight = this.element.offsetHeight;
         delete this._statusBarDragOffset;
 
         event.stopPropagation();
@@ -200,3 +308,9 @@ WebInspector.Drawer.prototype = {
 }
 
 WebInspector.Drawer.prototype.__proto__ = WebInspector.View.prototype;
+
+WebInspector.Drawer.State = {
+    Hidden: 0,
+    Variable: 1,
+    Full: 2
+};
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
index aa6319ca91..75e8d0880f 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
@@ -36,7 +36,7 @@ WebInspector.ElementsPanel = function()
 
     this.contentElement = document.createElement("div");
     this.contentElement.id = "elements-content";
-    this.contentElement.className = "outline-disclosure";
+    this.contentElement.className = "outline-disclosure source-code";
 
     this.treeOutline = new WebInspector.ElementsTreeOutline();
     this.treeOutline.panel = this;
@@ -46,7 +46,7 @@ WebInspector.ElementsPanel = function()
     this.treeOutline.focusedNodeChanged = function(forceUpdate)
     {
         if (this.panel.visible && WebInspector.currentFocusElement !== document.getElementById("search"))
-            WebInspector.currentFocusElement = document.getElementById("main-panels");
+            WebInspector.currentFocusElement = this.element;
 
         this.panel.updateBreadcrumb(forceUpdate);
 
@@ -58,12 +58,8 @@ WebInspector.ElementsPanel = function()
         this.panel.updateProperties();
         this.panel.updateEventListeners();
 
-        if (InspectorController.searchingForNode()) {
-            InspectorController.toggleNodeSearch();
-            this.panel.nodeSearchButton.toggled = false;
-        }
         if (this._focusedDOMNode)
-            InjectedScriptAccess.addInspectedNode(this._focusedDOMNode.id, function() {});
+            InjectedScriptAccess.get(this._focusedDOMNode.injectedScriptId).addInspectedNode(this._focusedDOMNode.id, function() {});
     };
 
     this.contentElement.appendChild(this.treeOutline.element);
@@ -102,10 +98,8 @@ WebInspector.ElementsPanel = function()
     this.sidebarResizeElement.className = "sidebar-resizer-vertical";
     this.sidebarResizeElement.addEventListener("mousedown", this.rightSidebarResizerDragStart.bind(this), false);
 
-    this.nodeSearchButton = new WebInspector.StatusBarButton(WebInspector.UIString("Select an element in the page to inspect it."), "node-search-status-bar-item");
-    this.nodeSearchButton.addEventListener("click", this._nodeSearchButtonClicked.bind(this), false);
-
-    this.searchingForNode = false;
+    this._nodeSearchButton = new WebInspector.StatusBarButton(WebInspector.UIString("Select an element in the page to inspect it."), "node-search-status-bar-item");
+    this._nodeSearchButton.addEventListener("click", this._nodeSearchButtonClicked.bind(this), false);
 
     this.element.appendChild(this.contentElement);
     this.element.appendChild(this.sidebarElement);
@@ -126,7 +120,12 @@ WebInspector.ElementsPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.nodeSearchButton.element, this.crumbsElement];
+        return [this._nodeSearchButton.element, this.crumbsElement];
+    },
+
+    get defaultFocusedElement()
+    {
+        return this.treeOutline.element;
     },
 
     updateStatusBarItems: function()
@@ -141,7 +140,7 @@ WebInspector.ElementsPanel.prototype = {
         this.updateBreadcrumb();
         this.treeOutline.updateSelection();
         if (this.recentlyModifiedNodes.length)
-            this._updateModifiedNodes();
+            this.updateModifiedNodes();
     },
 
     hide: function()
@@ -149,11 +148,7 @@ WebInspector.ElementsPanel.prototype = {
         WebInspector.Panel.prototype.hide.call(this);
 
         WebInspector.hoveredDOMNode = null;
-
-        if (InspectorController.searchingForNode()) {
-            InspectorController.toggleNodeSearch();
-            this.nodeSearchButton.toggled = false;
-        }
+        InspectorBackend.disableSearchingForNode();
     },
 
     resize: function()
@@ -164,62 +159,85 @@ WebInspector.ElementsPanel.prototype = {
 
     reset: function()
     {
+        if (this.focusedDOMNode) {
+            this._selectedPathOnReset = [];
+            var node = this.focusedDOMNode;
+            while ("index" in node) {
+                this._selectedPathOnReset.push(node.nodeName);
+                this._selectedPathOnReset.push(node.index);
+                node = node.parentNode;
+            }
+            this._selectedPathOnReset.reverse();
+        }
+
         this.rootDOMNode = null;
         this.focusedDOMNode = null;
 
         WebInspector.hoveredDOMNode = null;
 
-        if (InspectorController.searchingForNode()) {
-            InspectorController.toggleNodeSearch();
-            this.nodeSearchButton.toggled = false;
-        }
-
         this.recentlyModifiedNodes = [];
 
         delete this.currentQuery;
         this.searchCanceled();
+    },
 
-        var domWindow = WebInspector.domAgent.domWindow;
-        if (!domWindow || !domWindow.document || !domWindow.document.firstChild)
-            return;
+    setDocument: function(inspectedRootDocument)
+    {
+        this.reset();
 
-        // If the window isn't visible, return early so the DOM tree isn't built
-        // and mutation event listeners are not added.
-        if (!InspectorController.isWindowVisible())
+        if (!inspectedRootDocument)
             return;
 
-        var inspectedRootDocument = domWindow.document;
         inspectedRootDocument.addEventListener("DOMNodeInserted", this._nodeInserted.bind(this));
         inspectedRootDocument.addEventListener("DOMNodeRemoved", this._nodeRemoved.bind(this));
+        inspectedRootDocument.addEventListener("DOMAttrModified", this._attributesUpdated.bind(this));
 
+        this.treeOutline.suppressSelectHighlight = true;
         this.rootDOMNode = inspectedRootDocument;
+        this.treeOutline.suppressSelectHighlight = false;
 
-        var canidateFocusNode = inspectedRootDocument.body || inspectedRootDocument.documentElement;
-        if (canidateFocusNode) {
-            this.treeOutline.suppressSelectHighlight = true;
-            this.focusedDOMNode = canidateFocusNode;
-            this.treeOutline.suppressSelectHighlight = false;
+        function selectNode(candidateFocusNode)
+        {
+            if (!candidateFocusNode)
+                candidateFocusNode = inspectedRootDocument.body || inspectedRootDocument.documentElement;
 
+            if (!candidateFocusNode)
+                return;
+
+            this.treeOutline.suppressSelectHighlight = true;
+            this.focusedDOMNode = candidateFocusNode;
             if (this.treeOutline.selectedTreeElement)
                 this.treeOutline.selectedTreeElement.expand();
+            this.treeOutline.suppressSelectHighlight = false;
         }
+
+        function selectLastSelectedNode(nodeId)
+        {
+            if (this.focusedDOMNode) {
+                // Focused node has been explicitly set while reaching out for the last selected node.
+                return;
+            }
+            var node = nodeId ? WebInspector.domAgent.nodeForId(nodeId) : 0;
+            selectNode.call(this, node);
+        }
+
+        if (this._selectedPathOnReset)
+            InjectedScriptAccess.getDefault().nodeByPath(this._selectedPathOnReset, selectLastSelectedNode.bind(this));
+        else
+            selectNode.call(this);
+        delete this._selectedPathOnReset;
     },
 
     searchCanceled: function()
     {
-        if (this._searchResults) {
-            for (var i = 0; i < this._searchResults.length; ++i) {
-                var treeElement = this.treeOutline.findTreeElement(this._searchResults[i]);
-                if (treeElement)
-                    treeElement.highlighted = false;
-            }
-        }
+        delete this._searchQuery;
+        this._hideSearchHighlights();
 
         WebInspector.updateSearchMatchesCount(0, this);
 
         this._currentSearchResultIndex = 0;
         this._searchResults = [];
-        InjectedScriptAccess.searchCanceled(function() {});
+        InjectedScriptAccess.getDefault().searchCanceled(function() {});
     },
 
     performSearch: function(query)
@@ -227,14 +245,25 @@ WebInspector.ElementsPanel.prototype = {
         // Call searchCanceled since it will reset everything we need before doing a new search.
         this.searchCanceled();
 
-        const whitespaceTrimmedQuery = query.trimWhitespace();
+        const whitespaceTrimmedQuery = query.trim();
         if (!whitespaceTrimmedQuery.length)
             return;
 
         this._updatedMatchCountOnce = false;
         this._matchesCountUpdateTimeout = null;
+        this._searchQuery = query;
 
-        InjectedScriptAccess.performSearch(whitespaceTrimmedQuery, function() {});
+        InjectedScriptAccess.getDefault().performSearch(whitespaceTrimmedQuery, false, function() {});
+    },
+
+    searchingForNodeWasEnabled: function()
+    {
+        this._nodeSearchButton.toggled = true;
+    },
+
+    searchingForNodeWasDisabled: function()
+    {
+        this._nodeSearchButton.toggled = false;
     },
 
     _updateMatchesCount: function()
@@ -266,25 +295,10 @@ WebInspector.ElementsPanel.prototype = {
             if (!node)
                 continue;
 
-            if (!this._searchResults.length) {
-                this._currentSearchResultIndex = 0;
-
-                // Only change the focusedDOMNode if the search was manually performed, because
-                // the search may have been performed programmatically and we wouldn't want to
-                // change the current focusedDOMNode.
-                if (WebInspector.currentFocusElement === document.getElementById("search"))
-                    this.focusedDOMNode = node;
-            }
-
+            this._currentSearchResultIndex = 0;
             this._searchResults.push(node);
-
-            // Highlight the tree element to show it matched the search.
-            // FIXME: highlight the substrings in text nodes and attributes.
-            var treeElement = this.treeOutline.findTreeElement(node);
-            if (treeElement)
-                treeElement.highlighted = true;
         }
-
+        this._highlightCurrentSearchResult();
         this._updateMatchesCountSoon();
     },
 
@@ -292,18 +306,41 @@ WebInspector.ElementsPanel.prototype = {
     {
         if (!this._searchResults || !this._searchResults.length)
             return;
+
         if (++this._currentSearchResultIndex >= this._searchResults.length)
             this._currentSearchResultIndex = 0;
-        this.focusedDOMNode = this._searchResults[this._currentSearchResultIndex];
+        this._highlightCurrentSearchResult();
     },
 
     jumpToPreviousSearchResult: function()
     {
         if (!this._searchResults || !this._searchResults.length)
             return;
+
         if (--this._currentSearchResultIndex < 0)
             this._currentSearchResultIndex = (this._searchResults.length - 1);
-        this.focusedDOMNode = this._searchResults[this._currentSearchResultIndex];
+        this._highlightCurrentSearchResult();
+    },
+
+    _highlightCurrentSearchResult: function()
+    {
+        this._hideSearchHighlights();
+        var node = this._searchResults[this._currentSearchResultIndex];
+        var treeElement = this.treeOutline.findTreeElement(node);
+        if (treeElement) {
+            treeElement.highlightSearchResults(this._searchQuery);
+            treeElement.reveal();
+        }
+    },
+
+    _hideSearchHighlights: function(node)
+    {
+        for (var i = 0; this._searchResults && i < this._searchResults.length; ++i) {
+            var node = this._searchResults[i];
+            var treeElement = this.treeOutline.findTreeElement(node);
+            if (treeElement)
+                treeElement.highlightSearchResults(null);
+        }
     },
 
     renameSelector: function(oldIdentifier, newIdentifier, oldSelector, newSelector)
@@ -440,6 +477,13 @@ WebInspector.ElementsPanel.prototype = {
         this.treeOutline.focusedDOMNode = x;
     },
 
+    _attributesUpdated: function(event)
+    {
+        this.recentlyModifiedNodes.push({node: event.target, updated: true});
+        if (this.visible)
+            this._updateModifiedNodesSoon();
+    },
+
     _nodeInserted: function(event)
     {
         this.recentlyModifiedNodes.push({node: event.target, parent: event.relatedNode, inserted: true});
@@ -458,10 +502,10 @@ WebInspector.ElementsPanel.prototype = {
     {
         if ("_updateModifiedNodesTimeout" in this)
             return;
-        this._updateModifiedNodesTimeout = setTimeout(this._updateModifiedNodes.bind(this), 0);
+        this._updateModifiedNodesTimeout = setTimeout(this.updateModifiedNodes.bind(this), 0);
     },
 
-    _updateModifiedNodes: function()
+    updateModifiedNodes: function()
     {
         if ("_updateModifiedNodesTimeout" in this) {
             clearTimeout(this._updateModifiedNodesTimeout);
@@ -474,6 +518,15 @@ WebInspector.ElementsPanel.prototype = {
         for (var i = 0; i < this.recentlyModifiedNodes.length; ++i) {
             var replaced = this.recentlyModifiedNodes[i].replaced;
             var parent = this.recentlyModifiedNodes[i].parent;
+            var node = this.recentlyModifiedNodes[i].node;
+
+            if (this.recentlyModifiedNodes[i].updated) {
+                var nodeItem = this.treeOutline.findTreeElement(node);
+                if (nodeItem)
+                    nodeItem.updateTitle();
+                continue;
+            }
+            
             if (!parent)
                 continue;
 
@@ -525,7 +578,7 @@ WebInspector.ElementsPanel.prototype = {
     _mouseMovedOutOfCrumbs: function(event)
     {
         var nodeUnderMouse = document.elementFromPoint(event.pageX, event.pageY);
-        if (nodeUnderMouse.isDescendant(this.crumbsElement))
+        if (nodeUnderMouse && nodeUnderMouse.isDescendant(this.crumbsElement))
             return;
 
         WebInspector.hoveredDOMNode = null;
@@ -620,47 +673,7 @@ WebInspector.ElementsPanel.prototype = {
             var crumbTitle;
             switch (current.nodeType) {
                 case Node.ELEMENT_NODE:
-                    crumbTitle = current.nodeName.toLowerCase();
-
-                    var nameElement = document.createElement("span");
-                    nameElement.textContent = crumbTitle;
-                    crumb.appendChild(nameElement);
-
-                    var idAttribute = current.getAttribute("id");
-                    if (idAttribute) {
-                        var idElement = document.createElement("span");
-                        crumb.appendChild(idElement);
-
-                        var part = "#" + idAttribute;
-                        crumbTitle += part;
-                        idElement.appendChild(document.createTextNode(part));
-
-                        // Mark the name as extra, since the ID is more important.
-                        nameElement.className = "extra";
-                    }
-
-                    var classAttribute = current.getAttribute("class");
-                    if (classAttribute) {
-                        var classes = classAttribute.split(/\s+/);
-                        var foundClasses = {};
-
-                        if (classes.length) {
-                            var classesElement = document.createElement("span");
-                            classesElement.className = "extra";
-                            crumb.appendChild(classesElement);
-
-                            for (var i = 0; i < classes.length; ++i) {
-                                var className = classes[i];
-                                if (className && !(className in foundClasses)) {
-                                    var part = "." + className;
-                                    crumbTitle += part;
-                                    classesElement.appendChild(document.createTextNode(part));
-                                    foundClasses[className] = true;
-                                }
-                            }
-                        }
-                    }
-
+                    this.decorateNodeLabel(current, crumb);
                     break;
 
                 case Node.TEXT_NODE:
@@ -686,10 +699,9 @@ WebInspector.ElementsPanel.prototype = {
                 var nameElement = document.createElement("span");
                 nameElement.textContent = crumbTitle;
                 crumb.appendChild(nameElement);
+                crumb.title = crumbTitle;
             }
 
-            crumb.title = crumbTitle;
-
             if (foundRoot)
                 crumb.addStyleClass("dimmed");
             if (current === this.focusedDOMNode)
@@ -706,6 +718,51 @@ WebInspector.ElementsPanel.prototype = {
         this.updateBreadcrumbSizes();
     },
 
+    decorateNodeLabel: function(node, parentElement)
+    {
+        var title = node.nodeName.toLowerCase();
+
+        var nameElement = document.createElement("span");
+        nameElement.textContent = title;
+        parentElement.appendChild(nameElement);
+
+        var idAttribute = node.getAttribute("id");
+        if (idAttribute) {
+            var idElement = document.createElement("span");
+            parentElement.appendChild(idElement);
+
+            var part = "#" + idAttribute;
+            title += part;
+            idElement.appendChild(document.createTextNode(part));
+
+            // Mark the name as extra, since the ID is more important.
+            nameElement.className = "extra";
+        }
+
+        var classAttribute = node.getAttribute("class");
+        if (classAttribute) {
+            var classes = classAttribute.split(/\s+/);
+            var foundClasses = {};
+
+            if (classes.length) {
+                var classesElement = document.createElement("span");
+                classesElement.className = "extra";
+                parentElement.appendChild(classesElement);
+
+                for (var i = 0; i < classes.length; ++i) {
+                    var className = classes[i];
+                    if (className && !(className in foundClasses)) {
+                        var part = "." + className;
+                        title += part;
+                        classesElement.appendChild(document.createTextNode(part));
+                        foundClasses[className] = true;
+                    }
+                }
+            }
+        }
+        parentElement.title = title;
+    },
+
     updateBreadcrumbSizes: function(focusedCrumb)
     {
         if (!this.visible)
@@ -996,9 +1053,22 @@ WebInspector.ElementsPanel.prototype = {
         eventListenersSidebarPane.needsUpdate = false;
     },
 
-    handleKeyEvent: function(event)
+    handleShortcut: function(event)
     {
-        this.treeOutline.handleKeyEvent(event);
+        // Cmd/Control + Shift + C should be a shortcut to clicking the Node Search Button.
+        // This shortcut matches Firebug.
+        if (event.keyIdentifier === "U+0043") {     // C key
+            if (WebInspector.isMac())
+                var isNodeSearchKey = event.metaKey && !event.ctrlKey && !event.altKey && event.shiftKey;
+            else
+                var isNodeSearchKey = event.ctrlKey && !event.metaKey && !event.altKey && event.shiftKey;
+
+            if (isNodeSearchKey) {
+                this._nodeSearchButtonClicked(event);
+                event.handled = true;
+                return;
+            }
+        }
     },
 
     handleCopyEvent: function(event)
@@ -1008,7 +1078,7 @@ WebInspector.ElementsPanel.prototype = {
             return;
         event.clipboardData.clearData();
         event.preventDefault();
-        InspectorController.copyNode(this.focusedDOMNode.id);
+        InspectorBackend.copyNode(this.focusedDOMNode.id);
     },
 
     rightSidebarResizerDragStart: function(event)
@@ -1037,9 +1107,10 @@ WebInspector.ElementsPanel.prototype = {
 
     _nodeSearchButtonClicked: function(event)
     {
-        InspectorController.toggleNodeSearch();
-
-        this.nodeSearchButton.toggled = InspectorController.searchingForNode();
+        if (!this._nodeSearchButton.toggled)
+            InspectorBackend.enableSearchingForNode();
+        else
+            InspectorBackend.disableSearchingForNode();
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
index be01647961..8ca0b57524 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -41,6 +41,9 @@ WebInspector.ElementsTreeOutline = function() {
     this.showInElementsPanelEnabled = false;
     this.rootDOMNode = null;
     this.focusedDOMNode = null;
+
+    this.element.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), true);
+    this.element.addEventListener("keydown", this._keyDown.bind(this), true);
 }
 
 WebInspector.ElementsTreeOutline.prototype = {
@@ -56,9 +59,16 @@ WebInspector.ElementsTreeOutline.prototype = {
 
         this._rootDOMNode = x;
 
+        this._isXMLMimeType = !!(WebInspector.mainResource && WebInspector.mainResource.mimeType && WebInspector.mainResource.mimeType.match(/x(?:ht)?ml/i));
+
         this.update();
     },
 
+    get isXMLMimeType()
+    {
+        return this._isXMLMimeType;
+    },
+
     get focusedDOMNode()
     {
         return this._focusedDOMNode;
@@ -83,7 +93,7 @@ WebInspector.ElementsTreeOutline.prototype = {
             this.focusedNodeChanged();
 
             if (x && !this.suppressSelectHighlight) {
-                InspectorController.highlightDOMNode(x.id);
+                InspectorBackend.highlightDOMNode(x.id);
 
                 if ("_restorePreviousHighlightNodeTimeout" in this)
                     clearTimeout(this._restorePreviousHighlightNodeTimeout);
@@ -92,9 +102,9 @@ WebInspector.ElementsTreeOutline.prototype = {
                 {
                     var hoveredNode = WebInspector.hoveredDOMNode;
                     if (hoveredNode)
-                        InspectorController.highlightDOMNode(hoveredNode.id);
+                        InspectorBackend.highlightDOMNode(hoveredNode.id);
                     else
-                        InspectorController.hideDOMNodeHighlight();
+                        InspectorBackend.hideDOMNodeHighlight();
                 }
 
                 this._restorePreviousHighlightNodeTimeout = setTimeout(restoreHighlightToHoveredNode, 2000);
@@ -104,6 +114,8 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     update: function()
     {
+        var selectedNode = this.selectedTreeElement ? this.selectedTreeElement.representedObject : null;
+
         this.removeChildren();
 
         if (!this.rootDOMNode)
@@ -125,7 +137,8 @@ WebInspector.ElementsTreeOutline.prototype = {
             }
         }
 
-        this.updateSelection();
+        if (selectedNode)
+            this.revealAndSelectNode(selectedNode);
     },
 
     updateSelection: function()
@@ -149,12 +162,27 @@ WebInspector.ElementsTreeOutline.prototype = {
         return treeElement;
     },
 
+    createTreeElementFor: function(node)
+    {
+        var treeElement = this.findTreeElement(node);
+        if (treeElement)
+            return treeElement;
+        if (!node.parentNode)
+            return null;
+
+        var treeElement = this.createTreeElementFor(node.parentNode);
+        if (treeElement && treeElement.showChild(node.index))
+            return treeElement.children[node.index];
+
+        return null;
+    },
+
     revealAndSelectNode: function(node)
     {
         if (!node)
             return;
 
-        var treeElement = this.findTreeElement(node);
+        var treeElement = this.createTreeElementFor(node);
         if (!treeElement)
             return;
 
@@ -186,21 +214,26 @@ WebInspector.ElementsTreeOutline.prototype = {
         return element;
     },
     
-    handleKeyEvent: function(event)
+    _keyDown: function(event)
     {
+        if (event.target !== this.treeOutline.element)
+            return;
+
         var selectedElement = this.selectedTreeElement;
         if (!selectedElement)
             return;
 
-        // Delete or backspace pressed, delete the node.
-        if (event.keyCode === 8 || event.keyCode === 46) {
+        if (event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Backspace ||
+                event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Delete) {
             selectedElement.remove();
+            event.preventDefault();
+            event.stopPropagation();
             return;
         }
 
         // On Enter or Return start editing the first attribute
         // or create a new attribute on the selected element.
-        if (event.keyIdentifier === "Enter") {
+        if (isEnterKey(event)) {
             if (this._editing)
                 return;
 
@@ -208,10 +241,9 @@ WebInspector.ElementsTreeOutline.prototype = {
 
             // prevent a newline from being immediately inserted
             event.preventDefault();
+            event.stopPropagation();
             return;
         }
-
-        TreeOutline.prototype.handleKeyEvent.call(this, event);
     },
 
     _onmousedown: function(event)
@@ -255,6 +287,23 @@ WebInspector.ElementsTreeOutline.prototype = {
         }
 
         WebInspector.hoveredDOMNode = null;
+    },
+
+    _contextMenuEventFired: function(event)
+    {
+        var listItem = event.target.enclosingNodeOrSelfWithNodeName("LI");
+        if (!listItem || !listItem.treeElement)
+            return;
+
+        var contextMenu = new WebInspector.ContextMenu();
+
+        var tag = event.target.enclosingNodeOrSelfWithClass("webkit-html-tag");
+        var textNode = event.target.enclosingNodeOrSelfWithClass("webkit-html-text-node");
+        if (tag && listItem.treeElement._populateTagContextMenu)
+            listItem.treeElement._populateTagContextMenu(contextMenu, event);
+        else if (textNode && listItem.treeElement._populateTextContextMenu)
+            listItem.treeElement._populateTextContextMenu(contextMenu, textNode);
+        contextMenu.show(event);
     }
 }
 
@@ -269,27 +318,28 @@ WebInspector.ElementsTreeElement = function(node)
 
     if (this.representedObject.nodeType == Node.ELEMENT_NODE)
         this._canAddAttributes = true;
+    this._searchQuery = null;
+    this._expandedChildrenLimit = WebInspector.ElementsTreeElement.InitialChildrenLimit;
 }
 
-WebInspector.ElementsTreeElement.prototype = {
-    get highlighted()
-    {
-        return this._highlighted;
-    },
+WebInspector.ElementsTreeElement.InitialChildrenLimit = 500;
+
+// A union of HTML4 and HTML5-Draft elements that explicitly
+// or implicitly (for HTML5) forbid the closing tag.
+// FIXME: Revise once HTML5 Final is published.
+WebInspector.ElementsTreeElement.ForbiddenClosingTagElements = [
+    "area", "base", "basefont", "br", "canvas", "col", "command", "embed", "frame",
+    "hr", "img", "input", "isindex", "keygen", "link", "meta", "param", "source"
+].keySet();
 
-    set highlighted(x)
+WebInspector.ElementsTreeElement.prototype = {
+    highlightSearchResults: function(searchQuery)
     {
-        if (this._highlighted === x)
+        if (this._searchQuery === searchQuery)
             return;
 
-        this._highlighted = x;
-
-        if (this.listItemElement) {
-            if (x)
-                this.listItemElement.addStyleClass("highlighted");
-            else
-                this.listItemElement.removeStyleClass("highlighted");
-        }
+        this._searchQuery = searchQuery;
+        this.updateTitle();
     },
 
     get hovered()
@@ -308,41 +358,66 @@ WebInspector.ElementsTreeElement.prototype = {
             if (x) {
                 this.updateSelection();
                 this.listItemElement.addStyleClass("hovered");
-                if (this._canAddAttributes)
-                    this._pendingToggleNewAttribute = setTimeout(this.toggleNewAttributeButton.bind(this, true), 500);
             } else {
                 this.listItemElement.removeStyleClass("hovered");
-                if (this._pendingToggleNewAttribute) {
-                    clearTimeout(this._pendingToggleNewAttribute);
-                    delete this._pendingToggleNewAttribute;
-                }
-                this.toggleNewAttributeButton(false);
             }
         }
     },
 
-    toggleNewAttributeButton: function(visible)
+    get expandedChildrenLimit()
     {
-        function removeAddAttributeSpan()
-        {
-            if (this._addAttributeElement && this._addAttributeElement.parentNode)
-                this._addAttributeElement.parentNode.removeChild(this._addAttributeElement);
-            delete this._addAttributeElement;
+        return this._expandedChildrenLimit;
+    },
 
-            this.updateSelection();
+    set expandedChildrenLimit(x)
+    {
+        if (this._expandedChildrenLimit === x)
+            return;
+
+        this._expandedChildrenLimit = x;
+        if (this.treeOutline && !this._updateChildrenInProgress)
+            this._updateChildren(true);
+    },
+
+    get expandedChildCount()
+    {
+        var count = this.children.length;
+        if (count && this.children[count - 1].elementCloseTag)
+            count--;
+        if (count && this.children[count - 1].expandAllButton)
+            count--;
+        return count;
+    },
+
+    showChild: function(index)
+    {
+        if (index >= this.expandedChildrenLimit) {
+            this._expandedChildrenLimit = index + 1;
+            this._updateChildren(true);
         }
 
-        if (!this._addAttributeElement && visible && !this._editing) {
-            var span = document.createElement("span");
-            span.className = "add-attribute webkit-html-attribute-name";
-            span.textContent = " ?=\"\"";
-            span.addEventListener("dblclick", removeAddAttributeSpan.bind(this), false);
-            this._addAttributeElement = span;
+        // Whether index-th child is visible in the children tree
+        return this.expandedChildCount > index;
+    },
+
+    createTooltipForImageNode: function(node, callback)
+    {
+        function createTooltipThenCallback(properties)
+        {
+            if (!properties) {
+                callback();
+                return;
+            }
 
-            var tag = this.listItemElement.getElementsByClassName("webkit-html-tag")[0];
-            this._insertInLastAttributePosition(tag, span);
-        } else if (!visible && this._addAttributeElement)
-            removeAddAttributeSpan.call(this);
+            var tooltipText = null;
+            if (properties.offsetHeight === properties.naturalHeight && properties.offsetWidth === properties.naturalWidth)
+                tooltipText = WebInspector.UIString("%d × %d pixels", properties.offsetWidth, properties.offsetHeight);
+            else
+                tooltipText = WebInspector.UIString("%d × %d pixels (Natural: %d × %d pixels)", properties.offsetWidth, properties.offsetHeight, properties.naturalWidth, properties.naturalHeight);
+            callback(tooltipText);
+        }
+        var objectProxy = new WebInspector.ObjectProxy(node.injectedScriptId, node.id);
+        WebInspector.ObjectProxy.getPropertiesAsync(objectProxy, ["naturalHeight", "naturalWidth", "offsetHeight", "offsetWidth"], createTooltipThenCallback);
     },
 
     updateSelection: function()
@@ -370,15 +445,12 @@ WebInspector.ElementsTreeElement.prototype = {
     {
         this.listItemElement.addEventListener("mousedown", this.onmousedown.bind(this), false);
 
-        if (this._highlighted)
-            this.listItemElement.addStyleClass("highlighted");
-
         if (this._hovered) {
             this.updateSelection();
             this.listItemElement.addStyleClass("hovered");
         }
 
-        this._updateTitle();
+        this.updateTitle();
 
         this._preventFollowingLinksOnDoubleClick();
     },
@@ -406,9 +478,34 @@ WebInspector.ElementsTreeElement.prototype = {
         WebInspector.domAgent.getChildNodesAsync(this.representedObject, this._updateChildren.bind(this, fullRefresh));
     },
 
+    insertChildElement: function(child, index)
+    {
+        var newElement = new WebInspector.ElementsTreeElement(child);
+        newElement.selectable = this.treeOutline.selectEnabled;
+        this.insertChild(newElement, index);
+        return newElement;
+    },
+
+    moveChild: function(child, targetIndex)
+    {
+        var wasSelected = child.selected;
+        treeElement.removeChild(child);
+        treeElement.insertChild(child, targetIndex);
+        if (wasSelected)
+            existingTreeElement.select();
+    },
+
     _updateChildren: function(fullRefresh)
     {
+        if (this._updateChildrenInProgress)
+            return;
+
+        this._updateChildrenInProgress = true;
+        var focusedNode = this.treeOutline.focusedDOMNode;
+        var originalScrollTop;
         if (fullRefresh) {
+            var treeOutlineContainerElement = this.treeOutline.element.parentNode;
+            originalScrollTop = treeOutlineContainerElement.scrollTop;
             var selectedTreeElement = this.treeOutline.selectedTreeElement;
             if (selectedTreeElement && selectedTreeElement.hasAncestor(this))
                 this.select();
@@ -417,6 +514,7 @@ WebInspector.ElementsTreeElement.prototype = {
 
         var treeElement = this;
         var treeChildIndex = 0;
+        var elementToSelect;
 
         function updateChildrenOfNode(node)
         {
@@ -427,7 +525,7 @@ WebInspector.ElementsTreeElement.prototype = {
                 if (!currentTreeElement || currentTreeElement.representedObject !== child) {
                     // Find any existing element that is later in the children list.
                     var existingTreeElement = null;
-                    for (var i = (treeChildIndex + 1); i < treeElement.children.length; ++i) {
+                    for (var i = (treeChildIndex + 1), size = treeElement.expandedChildCount; i < size; ++i) {
                         if (treeElement.children[i].representedObject === child) {
                             existingTreeElement = treeElement.children[i];
                             break;
@@ -436,16 +534,16 @@ WebInspector.ElementsTreeElement.prototype = {
 
                     if (existingTreeElement && existingTreeElement.parent === treeElement) {
                         // If an existing element was found and it has the same parent, just move it.
-                        var wasSelected = existingTreeElement.selected;
-                        treeElement.removeChild(existingTreeElement);
-                        treeElement.insertChild(existingTreeElement, treeChildIndex);
-                        if (wasSelected)
-                            existingTreeElement.select();
+                        treeElement.moveChild(existingTreeElement, treeChildIndex);
                     } else {
                         // No existing element found, insert a new element.
-                        var newElement = new WebInspector.ElementsTreeElement(child);
-                        newElement.selectable = treeOutline.selectEnabled;
-                        treeElement.insertChild(newElement, treeChildIndex);
+                        if (treeChildIndex < treeElement.expandedChildrenLimit) {
+                            var newElement = treeElement.insertChildElement(child, treeChildIndex);
+                            if (child === focusedNode)
+                                elementToSelect = newElement;
+                            if (treeElement.expandedChildCount > treeElement.expandedChildrenLimit)
+                                treeElement.expandedChildrenLimit++;
+                        }
                     }
                 }
 
@@ -474,6 +572,7 @@ WebInspector.ElementsTreeElement.prototype = {
         }
 
         updateChildrenOfNode(this.representedObject);
+        this.adjustCollapsedRange(false);
 
         var lastChild = this.children[this.children.length - 1];
         if (this.representedObject.nodeType == Node.ELEMENT_NODE && (!lastChild || !lastChild.elementCloseTag)) {
@@ -483,15 +582,66 @@ WebInspector.ElementsTreeElement.prototype = {
             item.elementCloseTag = true;
             this.appendChild(item);
         }
+
+        // We want to restore the original selection and tree scroll position after a full refresh, if possible.
+        if (fullRefresh && elementToSelect) {
+            elementToSelect.select();
+            if (treeOutlineContainerElement && originalScrollTop <= treeOutlineContainerElement.scrollHeight)
+                treeOutlineContainerElement.scrollTop = originalScrollTop;
+        }
+
+        delete this._updateChildrenInProgress;
+    },
+
+    adjustCollapsedRange: function()
+    {
+        // Ensure precondition: only the tree elements for node children are found in the tree
+        // (not the Expand All button or the closing tag).
+        if (this.expandAllButtonElement && this.expandAllButtonElement.__treeElement.parent)
+            this.removeChild(this.expandAllButtonElement.__treeElement);
+
+        const node = this.representedObject;
+        if (!node.children)
+            return;
+        const childNodeCount = node.children.length;
+
+        // In case some nodes from the expanded range were removed, pull some nodes from the collapsed range into the expanded range at the bottom.
+        for (var i = this.expandedChildCount, limit = Math.min(this.expandedChildrenLimit, childNodeCount); i < limit; ++i)
+            this.insertChildElement(node.children[i], i);
+
+        const expandedChildCount = this.expandedChildCount;
+        if (childNodeCount > this.expandedChildCount) {
+            var targetButtonIndex = expandedChildCount;
+            if (!this.expandAllButtonElement) {
+                var title = "<button class=\"show-all-nodes\" value=\"\" />";
+                var item = new TreeElement(title, null, false);
+                item.selectable = false;
+                item.expandAllButton = true;
+                this.insertChild(item, targetButtonIndex);
+                this.expandAllButtonElement = item.listItemElement.firstChild;
+                this.expandAllButtonElement.__treeElement = item;
+                this.expandAllButtonElement.addEventListener("click", this.handleLoadAllChildren.bind(this), false);
+            } else if (!this.expandAllButtonElement.__treeElement.parent)
+                this.insertChild(this.expandAllButtonElement.__treeElement, targetButtonIndex);
+            this.expandAllButtonElement.textContent = WebInspector.UIString("Show All Nodes (%d More)", childNodeCount - expandedChildCount);
+        } else if (this.expandAllButtonElement)
+            delete this.expandAllButtonElement;
+    },
+
+    handleLoadAllChildren: function()
+    {
+        this.expandedChildrenLimit = Math.max(this.representedObject._childNodeCount, this.expandedChildrenLimit + WebInspector.ElementsTreeElement.InitialChildrenLimit);
     },
 
     onexpand: function()
     {
+        this.updateTitle();
         this.treeOutline.updateSelection();
     },
 
     oncollapse: function()
     {
+        this.updateTitle();
         this.treeOutline.updateSelection();
     },
 
@@ -525,12 +675,12 @@ WebInspector.ElementsTreeElement.prototype = {
             event.preventDefault();
     },
 
-    ondblclick: function(treeElement, event)
+    ondblclick: function(event)
     {
         if (this._editing)
             return;
 
-        if (this._startEditingFromEvent(event, treeElement))
+        if (this._startEditingFromEvent(event))
             return;
 
         if (this.hasChildren && !this.expanded)
@@ -552,7 +702,7 @@ WebInspector.ElementsTreeElement.prototype = {
         this.updateSelection();
     },
 
-    _startEditingFromEvent: function(event, treeElement)
+    _startEditingFromEvent: function(event)
     {
         if (this.treeOutline.focusedDOMNode != this.representedObject)
             return;
@@ -570,11 +720,33 @@ WebInspector.ElementsTreeElement.prototype = {
 
         var newAttribute = event.target.enclosingNodeOrSelfWithClass("add-attribute");
         if (newAttribute)
-            return this._addNewAttribute(treeElement.listItemElement);
+            return this._addNewAttribute();
 
         return false;
     },
 
+    _populateTagContextMenu: function(contextMenu, event)
+    {
+        var attribute = event.target.enclosingNodeOrSelfWithClass("webkit-html-attribute");
+        var newAttribute = event.target.enclosingNodeOrSelfWithClass("add-attribute");
+
+        // Add attribute-related actions.
+        contextMenu.appendItem(WebInspector.UIString("Add Attribute"), this._addNewAttribute.bind(this));
+        if (attribute && !newAttribute)
+            contextMenu.appendItem(WebInspector.UIString("Edit Attribute"), this._startEditingAttribute.bind(this, attribute, event.target));
+        contextMenu.appendSeparator();
+
+        // Add node-related actions.
+        contextMenu.appendItem(WebInspector.UIString("Edit as HTML"), this._editAsHTML.bind(this));
+        contextMenu.appendItem(WebInspector.UIString("Copy as HTML"), this._copyHTML.bind(this));
+        contextMenu.appendItem(WebInspector.UIString("Delete Node"), this.remove.bind(this));
+    },
+
+    _populateTextContextMenu: function(contextMenu, textNode)
+    {
+        contextMenu.appendItem(WebInspector.UIString("Edit Text"), this._startEditingTextNode.bind(this, textNode));
+    },
+
     _startEditing: function()
     {
         if (this.treeOutline.focusedDOMNode !== this.representedObject)
@@ -583,12 +755,11 @@ WebInspector.ElementsTreeElement.prototype = {
         var listItem = this._listItemNode;
 
         if (this._canAddAttributes) {
-            this.toggleNewAttributeButton(false);
             var attribute = listItem.getElementsByClassName("webkit-html-attribute")[0];
             if (attribute)
                 return this._startEditingAttribute(attribute, attribute.getElementsByClassName("webkit-html-attribute-value")[0]);
 
-            return this._addNewAttribute(listItem);
+            return this._addNewAttribute();
         }
 
         if (this.representedObject.nodeType === Node.TEXT_NODE) {
@@ -599,7 +770,7 @@ WebInspector.ElementsTreeElement.prototype = {
         }
     },
 
-    _addNewAttribute: function(listItemElement)
+    _addNewAttribute: function()
     {
         var attr = document.createElement("span");
         attr.className = "webkit-html-attribute";
@@ -613,7 +784,7 @@ WebInspector.ElementsTreeElement.prototype = {
         attr.appendChild(name);
         attr.appendChild(value);
 
-        var tag = listItemElement.getElementsByClassName("webkit-html-tag")[0];
+        var tag = this.listItemElement.getElementsByClassName("webkit-html-tag")[0];
         this._insertInLastAttributePosition(tag, attr);
         return this._startEditingAttribute(attr, attr);
     },
@@ -683,6 +854,60 @@ WebInspector.ElementsTreeElement.prototype = {
         return true;
     },
 
+    _startEditingAsHTML: function(commitCallback, initialValue)
+    {
+        if (this._htmlEditElement && WebInspector.isBeingEdited(this._htmlEditElement))
+            return true;
+
+        this._editing = true;
+
+        this._htmlEditElement = document.createElement("div");
+        this._htmlEditElement.className = "source-code elements-tree-editor";
+        this._htmlEditElement.textContent = initialValue;
+
+        // Hide header items.
+        var child = this.listItemElement.firstChild;
+        while (child) {
+            child.style.display = "none";
+            child = child.nextSibling;
+        }
+        // Hide children item.
+        if (this._childrenListNode)
+            this._childrenListNode.style.display = "none";
+        // Append editor.
+        this.listItemElement.appendChild(this._htmlEditElement);
+
+        this.updateSelection();
+
+        function commit()
+        {
+            commitCallback(this._htmlEditElement.textContent);
+            dispose.call(this);
+        }
+
+        function dispose()
+        {
+            delete this._editing;
+
+            // Remove editor.
+            this.listItemElement.removeChild(this._htmlEditElement);
+            delete this._htmlEditElement;
+            // Unhide children item.
+            if (this._childrenListNode)
+                this._childrenListNode.style.removeProperty("display");
+            // Unhide header items.
+            var child = this.listItemElement.firstChild;
+            while (child) {
+                child.style.removeProperty("display");
+                child = child.nextSibling;
+            }
+
+            this.updateSelection();
+        }
+
+        WebInspector.startEditing(this._htmlEditElement, commit.bind(this), dispose.bind(this), null, true);
+    },
+
     _attributeEditingCommitted: function(element, newText, oldText, attributeName, moveDirection)
     {
         delete this._editing;
@@ -731,7 +956,6 @@ WebInspector.ElementsTreeElement.prototype = {
 
         if (!parseElement.hasAttributes()) {
             this.representedObject.removeAttribute(attributeName);
-            this._updateTitle();
             moveToNextAttributeIfNeeded.call(this);
             return;
         }
@@ -748,8 +972,6 @@ WebInspector.ElementsTreeElement.prototype = {
         if (!foundOriginalAttribute)
             this.representedObject.removeAttribute(attributeName);
 
-        this._updateTitle();
-
         this.treeOutline.focusedNodeChanged(true);
 
         moveToNextAttributeIfNeeded.call(this);
@@ -768,36 +990,84 @@ WebInspector.ElementsTreeElement.prototype = {
             textNode = this.representedObject;
 
         textNode.nodeValue = newText;
-        this._updateTitle();
+
+        // Need to restore attributes / node structure.
+        this.updateTitle();
     },
 
     _editingCancelled: function(element, context)
     {
         delete this._editing;
 
-        this._updateTitle();
+        // Need to restore attributes structure.
+        this.updateTitle();
     },
 
-    _updateTitle: function()
+    updateTitle: function()
     {
-        var title = this._nodeTitleInfo(this.representedObject, this.hasChildren, WebInspector.linkifyURL).title;
-        this.title = "<span class=\"highlight\">" + title + "</span>";
-        delete this.selectionElement;
-        this.updateSelection();
-        this._preventFollowingLinksOnDoubleClick();
+        // If we are editing, return early to prevent canceling the edit.
+        // After editing is committed updateTitle will be called.
+        if (this._editing)
+            return;
+
+        var self = this;
+        function callback(tooltipText)
+        {
+            var title = self._nodeTitleInfo(WebInspector.linkifyURL, tooltipText).title;
+            self.title = "<span class=\"highlight\">" + title + "</span>";
+            delete self.selectionElement;
+            self.updateSelection();
+            self._preventFollowingLinksOnDoubleClick();
+            self._highlightSearchResults();
+        };
+
+        // TODO: Replace with InjectedScriptAccess.getBasicProperties(obj, [names]).
+        if (this.representedObject.nodeName.toLowerCase() !== "img")
+            callback();
+        else
+            this.createTooltipForImageNode(this.representedObject, callback);
+    },
+
+    _rewriteAttrHref: function(node, hrefValue)
+    {
+        if (!hrefValue || hrefValue.indexOf("://") > 0)
+            return hrefValue;
+
+        for (var frameOwnerCandidate = node; frameOwnerCandidate; frameOwnerCandidate = frameOwnerCandidate.parentNode) {
+            if (frameOwnerCandidate.documentURL) {
+                var result = WebInspector.completeURL(frameOwnerCandidate.documentURL, hrefValue);
+                if (result)
+                    return result;
+                break;
+            }
+        }
+
+        // documentURL not found or has bad value
+        for (var url in WebInspector.resourceURLMap) {
+            var match = url.match(WebInspector.URLRegExp);
+            if (match && match[4] === hrefValue)
+                return url;
+        }
+        return hrefValue;
     },
 
-    _nodeTitleInfo: function(node, hasChildren, linkify)
+    _nodeTitleInfo: function(linkify, tooltipText)
     {
-        var info = {title: "", hasChildren: hasChildren};
+        var node = this.representedObject;
+        var info = {title: "", hasChildren: this.hasChildren};
         
         switch (node.nodeType) {
             case Node.DOCUMENT_NODE:
                 info.title = "Document";
                 break;
                 
+            case Node.DOCUMENT_FRAGMENT_NODE:
+                info.title = "Document Fragment";
+                break;
+
             case Node.ELEMENT_NODE:
-                info.title = "<span class=\"webkit-html-tag\">&lt;" + node.nodeName.toLowerCase().escapeHTML();
+                var tagName = node.nodeName.toLowerCase().escapeHTML();
+                info.title = "<span class=\"webkit-html-tag\">&lt;" + tagName;
                 
                 if (node.hasAttributes()) {
                     for (var i = 0; i < node.attributes.length; ++i) {
@@ -807,7 +1077,7 @@ WebInspector.ElementsTreeElement.prototype = {
                         var value = attr.value;
                         if (linkify && (attr.name === "src" || attr.name === "href")) {
                             var value = value.replace(/([\/;:\)\]\}])/g, "$1\u200B");
-                            info.title += linkify(attr.value, value, "webkit-html-attribute-value", node.nodeName.toLowerCase() == "a");
+                            info.title += linkify(this._rewriteAttrHref(node, attr.value), value, "webkit-html-attribute-value", node.nodeName.toLowerCase() == "a", tooltipText);
                         } else {
                             var value = value.escapeHTML();
                             value = value.replace(/([\/;:\)\]\}])/g, "$1&#8203;");
@@ -818,15 +1088,21 @@ WebInspector.ElementsTreeElement.prototype = {
                 }
                 info.title += "&gt;</span>&#8203;";
                 
+                const closingTagHTML = "<span class=\"webkit-html-tag\">&lt;/" + tagName + "&gt;</span>&#8203;";
+                var textChild = onlyTextChild.call(node);
+                var showInlineText = textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength;
+
+                if (!this.expanded && (!showInlineText && (this.treeOutline.isXMLMimeType || !WebInspector.ElementsTreeElement.ForbiddenClosingTagElements[tagName]))) {
+                    if (this.hasChildren)
+                        info.title += "<span class=\"webkit-html-text-node\">&#8230;</span>&#8203;";
+                    info.title += closingTagHTML;
+                }
+
                 // If this element only has a single child that is a text node,
                 // just show that text and the closing tag inline rather than
                 // create a subtree for them
-                
-                var textChild = onlyTextChild.call(node);
-                var showInlineText = textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength;
-                
                 if (showInlineText) {
-                    info.title += "<span class=\"webkit-html-text-node\">" + textChild.nodeValue.escapeHTML() + "</span>&#8203;<span class=\"webkit-html-tag\">&lt;/" + node.nodeName.toLowerCase().escapeHTML() + "&gt;</span>";
+                    info.title += "<span class=\"webkit-html-text-node\">" + textChild.nodeValue.escapeHTML() + "</span>&#8203;" + closingTagHTML;
                     info.hasChildren = false;
                 }
                 break;
@@ -839,7 +1115,7 @@ WebInspector.ElementsTreeElement.prototype = {
                         var newNode = document.createElement("span");
                         newNode.textContent = node.textContent;
 
-                        var javascriptSyntaxHighlighter = new WebInspector.JavaScriptSourceSyntaxHighlighter(null, null);
+                        var javascriptSyntaxHighlighter = new WebInspector.DOMSyntaxHighlighter("text/javascript");
                         javascriptSyntaxHighlighter.syntaxHighlightNode(newNode);
                         
                         info.title = "<span class=\"webkit-html-text-node webkit-html-js-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
@@ -847,8 +1123,8 @@ WebInspector.ElementsTreeElement.prototype = {
                         var newNode = document.createElement("span");
                         newNode.textContent = node.textContent;
                         
-                        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighligher(null, null);
-                        cssSyntaxHighlighter.syntaxHighlightLine(newNode, null);
+                        var cssSyntaxHighlighter = new WebInspector.DOMSyntaxHighlighter("text/css");
+                        cssSyntaxHighlighter.syntaxHighlightNode(newNode);
                         
                         info.title = "<span class=\"webkit-html-text-node webkit-html-css-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
                     } else {
@@ -905,13 +1181,64 @@ WebInspector.ElementsTreeElement.prototype = {
                 return;
 
             parentElement.removeChild(self);
+            parentElement.adjustCollapsedRange(true);
         }
 
         var callId = WebInspector.Callback.wrap(removeNodeCallback);
-        InspectorController.removeNode(callId, this.representedObject.id);
+        InspectorBackend.removeNode(callId, this.representedObject.id);
+    },
+
+    _editAsHTML: function()
+    {
+        var treeOutline = this.treeOutline;
+        var node = this.representedObject;
+        var wasExpanded = this.expanded;
+
+        function selectNode(nodeId)
+        {
+            if (!nodeId)
+                return;
+
+            // Select it and expand if necessary. We force tree update so that it processes dom events and is up to date.
+            WebInspector.panels.elements.updateModifiedNodes();
+
+            WebInspector.updateFocusedNode(nodeId);
+            if (wasExpanded) {
+                var newTreeItem = treeOutline.findTreeElement(WebInspector.domAgent.nodeForId(nodeId));
+                if (newTreeItem)
+                    newTreeItem.expand();
+            }
+        }
+
+        function commitChange(value)
+        {
+            InjectedScriptAccess.get(node.injectedScriptId).setOuterHTML(node.id, value, wasExpanded, selectNode.bind(this));
+        }
+
+        InjectedScriptAccess.get(node.injectedScriptId).getNodePropertyValue(node.id, "outerHTML", this._startEditingAsHTML.bind(this, commitChange));
+    },
+
+    _copyHTML: function()
+    {
+        InspectorBackend.copyNode(this.representedObject.id);
+    },
+
+    _highlightSearchResults: function()
+    {
+        if (!this._searchQuery)
+            return;
+        var text = this.listItemElement.textContent;
+        var regexObject = createSearchRegex(this._searchQuery);
+
+        var offset = 0;
+        var match = regexObject.exec(text);
+        while (match) {
+            highlightSearchResult(this.listItemElement, offset + match.index, match[0].length);
+            offset += match.index + 1;
+            text = text.substring(match.index + 1);
+            match = regexObject.exec(text);
+        }
     }
 }
 
 WebInspector.ElementsTreeElement.prototype.__proto__ = TreeElement.prototype;
-
-WebInspector.didRemoveNode = WebInspector.Callback.processCallback;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/EventListenersSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/EventListenersSidebarPane.js
index 29381961ec..e454256900 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/EventListenersSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/EventListenersSidebarPane.js
@@ -38,18 +38,15 @@ WebInspector.EventListenersSidebarPane = function()
 
     var option = document.createElement("option");
     option.value = "all";
-    if (Preferences.eventListenersFilter === "all")
-        option.selected = true;
     option.label = WebInspector.UIString("All Nodes");
     this.settingsSelectElement.appendChild(option);
 
     option = document.createElement("option");
     option.value = "selected";
-    if (Preferences.eventListenersFilter === "selected")
-        option.selected = true;
     option.label = WebInspector.UIString("Selected Node Only");
     this.settingsSelectElement.appendChild(option);
 
+    WebInspector.settings.addEventListener("loaded", this._settingsLoaded, this);
     this.settingsSelectElement.addEventListener("click", function(event) { event.stopPropagation() }, false);
     this.settingsSelectElement.addEventListener("change", this._changeSetting.bind(this), false);
 
@@ -57,6 +54,15 @@ WebInspector.EventListenersSidebarPane = function()
 }
 
 WebInspector.EventListenersSidebarPane.prototype = {
+    _settingsLoaded: function()
+    {
+        var filter = WebInspector.settings.eventListenersFilter;
+        if (filter === "all")
+            this.settingsSelectElement[0].selected = true;
+        if (filter === "selected")
+            this.settingsSelectElement[1].selected = true;
+    },
+
     update: function(node)
     {
         var body = this.bodyElement;
@@ -106,9 +112,7 @@ WebInspector.EventListenersSidebarPane.prototype = {
     _changeSetting: function(event)
     {
         var selectedOption = this.settingsSelectElement[this.settingsSelectElement.selectedIndex];
-        Preferences.eventListenersFilter = selectedOption.value;
-
-        InspectorController.setSetting("event-listeners-filter", Preferences.eventListenersFilter);
+        WebInspector.settings.eventListenersFilter = selectedOption.value;
 
         for (var i = 0; i < this.sections.length; ++i)
             this.sections[i].update();
@@ -138,7 +142,7 @@ WebInspector.EventListenersSection.prototype = {
     {
         // A Filtered Array simplifies when to create connectors
         var filteredEventListeners = this.eventListeners;
-        if (Preferences.eventListenersFilter === "selected") {
+        if (WebInspector.settings.eventListenersFilter === "selected") {
             filteredEventListeners = [];
             for (var i = 0; i < this.eventListeners.length; ++i) {
                 var eventListener = this.eventListeners[i];
@@ -187,7 +191,7 @@ WebInspector.EventListenerBar.prototype = {
             // Just build properties in place - no need to reach out for injected script.
             var value = this.eventListener[propertyName];
             if (value instanceof WebInspector.DOMNode)
-                value = new WebInspector.ObjectProxy(value.id, [], 0, appropriateSelectorForNode(value), true);
+                value = new WebInspector.ObjectProxy(value.injectedScriptId, value.id, [], appropriateSelectorForNode(value), true);
             else
                 value = WebInspector.ObjectProxy.wrapPrimitiveValue(value);
             properties.push(new WebInspector.ObjectPropertyProxy(propertyName, value));
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/FontView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/FontView.js
index 4e1c931db2..8468cc96b3 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/FontView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/FontView.js
@@ -36,7 +36,7 @@ WebInspector.FontView = function(resource)
 
     this.fontStyleElement = document.createElement("style");
     this.fontStyleElement.textContent = "@font-face { font-family: \"" + uniqueFontName + "\"; src: url(" + this.resource.url + "); }";
-    document.getElementsByTagName("head").item(0).appendChild(this.fontStyleElement);
+    document.head.appendChild(this.fontStyleElement);
 
     this.fontPreviewElement = document.createElement("div");
     this.fontPreviewElement.className = "preview";
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ImageView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ImageView.js
index 96e1a6e331..1020cb76a9 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ImageView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ImageView.js
@@ -56,7 +56,7 @@ WebInspector.ImageView = function(resource)
 
     var imageProperties = [
         { name: WebInspector.UIString("Dimensions"), value: WebInspector.UIString("%d × %d", this.imagePreviewElement.naturalWidth, this.imagePreviewElement.height) },
-        { name: WebInspector.UIString("File size"), value: Number.bytesToString(this.resource.contentLength, WebInspector.UIString.bind(WebInspector)) },
+        { name: WebInspector.UIString("File size"), value: Number.bytesToString(this.resource.resourceSize, WebInspector.UIString.bind(WebInspector)) },
         { name: WebInspector.UIString("MIME type"), value: this.resource.mimeType }
     ];
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/auditsIcon.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/auditsIcon.png
new file mode 100644
index 0000000000..8d1f752cfd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/auditsIcon.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointBorder.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointBorder.png
new file mode 100644
index 0000000000..0b1b5500ce
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointBorder.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointConditionalBorder.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointConditionalBorder.png
new file mode 100644
index 0000000000..430e37e045
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointConditionalBorder.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointConditionalCounterBorder.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointConditionalCounterBorder.png
new file mode 100644
index 0000000000..b4a50308ce
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointConditionalCounterBorder.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointCounterBorder.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointCounterBorder.png
new file mode 100644
index 0000000000..8b77b61ce1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointCounterBorder.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointsActivateButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointsActivateButtonGlyph.png
new file mode 100644
index 0000000000..ce49aacf5b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointsActivateButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png
new file mode 100644
index 0000000000..5c5fcf6354
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/consoleIcon.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/consoleIcon.png
new file mode 100644
index 0000000000..94ffa95ef3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/consoleIcon.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/gearButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/gearButtonGlyph.png
new file mode 100644
index 0000000000..19659c9831
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/gearButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/popoverArrows.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/popoverArrows.png
new file mode 100644
index 0000000000..ccefa16125
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/popoverArrows.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/popoverBackground.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/popoverBackground.png
new file mode 100644
index 0000000000..f20c98879f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/popoverBackground.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/programCounterBorder.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/programCounterBorder.png
new file mode 100644
index 0000000000..fed2f3e980
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/programCounterBorder.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/spinner.gif b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/spinner.gif
new file mode 100644
index 0000000000..5f68c02f14
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/spinner.gif
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbActiveHoriz.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbActiveHoriz.png
new file mode 100644
index 0000000000..a6ee561938
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbActiveHoriz.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbActiveVert.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbActiveVert.png
new file mode 100644
index 0000000000..a3eabe860f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbActiveVert.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbHoriz.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbHoriz.png
new file mode 100644
index 0000000000..c16559a076
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbHoriz.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbHoverHoriz.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbHoverHoriz.png
new file mode 100644
index 0000000000..0fe8d6a98c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbHoverHoriz.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbHoverVert.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbHoverVert.png
new file mode 100644
index 0000000000..30e315a09f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbHoverVert.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbVert.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbVert.png
new file mode 100644
index 0000000000..61fbc06064
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/thumbVert.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/tipBalloon.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/tipBalloon.png
deleted file mode 100644
index 4cdf738938..0000000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/tipBalloon.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/tipBalloonBottom.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/tipBalloonBottom.png
deleted file mode 100644
index 3317a5a532..0000000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/tipBalloonBottom.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/tipIcon.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/tipIcon.png
deleted file mode 100644
index 8ca6124fc8..0000000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/tipIcon.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/tipIconPressed.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/tipIconPressed.png
deleted file mode 100644
index 443e4106f4..0000000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/tipIconPressed.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/trackHoriz.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/trackHoriz.png
new file mode 100644
index 0000000000..517d3067b9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/trackHoriz.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/trackVert.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/trackVert.png
new file mode 100644
index 0000000000..d49620dacd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/trackVert.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedFakeWorker.js b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedFakeWorker.js
new file mode 100644
index 0000000000..4560dbd118
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedFakeWorker.js
@@ -0,0 +1,299 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+var InjectedFakeWorker = function(InjectedScriptHost, inspectedWindow, injectedScriptId)
+{
+
+Worker = function(url)
+{
+    var impl = new FakeWorker(this, url);
+    if (impl === null)
+        return null;
+
+    this.isFake = true;
+    this.postMessage = bind(impl.postMessage, impl);
+    this.terminate = bind(impl.terminate, impl);
+    this.onmessage = noop;
+}
+
+function FakeWorker(worker, url)
+{
+    var scriptURL = this._expandURLAndCheckOrigin(document.baseURI, location.href, url);
+
+    this._worker = worker;
+    this._buildWorker(scriptURL);
+    this._id = InjectedScriptHost.nextWorkerId();
+
+    InjectedScriptHost.didCreateWorker(this._id, scriptURL.url, false);
+}
+
+FakeWorker.prototype = {
+    postMessage: function(msg)
+    {
+        if (this._frame != null)
+            this._dispatchMessage(this._frame, bind(this._onmessageWrapper, this), msg);
+        else if (this._pendingMessages)
+            this._pendingMessages.push(msg)
+        else
+            this._pendingMessages = [ msg ];
+    },
+
+    terminate: function()
+    {
+        InjectedScriptHost.didDestroyWorker(this._id);
+
+        if (this._frame != null) {
+            this._frame.onmessage = this._worker.onmessage = noop;
+            this._frame.frameElement.parentNode.removeChild(this._frame.frameElement);
+        }
+        this._frame = null;
+        this._worker = null; // Break reference loop.
+    },
+
+    _onmessageWrapper: function(msg)
+    {
+        // Shortcut -- if no exception handlers installed, avoid try/catch so as not to obscure line number.
+        if (!this._frame.onerror && !this._worker.onerror) {
+            this._frame.onmessage(msg);
+            return;
+        }
+
+        try {
+            this._frame.onmessage(msg);
+        } catch (e) {
+            this._handleException(e, this._frame.onerror, this._worker.onerror);
+        }
+    },
+
+    _dispatchMessage: function(targetWindow, handler, msg)
+    {
+        var event = this._document.createEvent("MessageEvent");
+        event.initMessageEvent("MessageEvent", false, false, msg);
+        targetWindow.setTimeout(handler, 0, event);
+    },
+
+    _handleException: function(e)
+    {
+        // NB: it should be an ErrorEvent, but creating it from script is not
+        // currently supported, so emulate it on top of plain vanilla Event.
+        var errorEvent = this._document.createEvent("Event");
+        errorEvent.initEvent("Event", false, false);
+        errorEvent.message = "Uncaught exception";
+
+        for (var i = 1; i < arguments.length; ++i) {
+            if (arguments[i] && arguments[i](errorEvent))
+                return;
+        }
+
+        throw e;
+    },
+
+    _buildWorker: function(url)
+    {
+        var code = this._loadScript(url.url);
+        var iframeElement = document.createElement("iframe");
+        iframeElement.style.display = "none";
+
+        this._document = document;
+        iframeElement.onload = bind(this._onWorkerFrameLoaded, this, iframeElement, url, code);
+
+        if (document.body)
+            this._attachWorkerFrameToDocument(iframeElement, url, code);
+        else
+            window.addEventListener("load", bind(this._attachWorkerFrameToDocument, this, iframeElement), false);
+    },
+
+    _attachWorkerFrameToDocument: function(iframeElement)
+    {
+        document.body.appendChild(iframeElement);
+    },
+
+    _onWorkerFrameLoaded: function(iframeElement, url, code)
+    {
+        var frame = iframeElement.contentWindow;
+        this._frame = frame;
+        this._setupWorkerContext(frame, url);
+
+        var frameContents = '(function(location, window) { ' + code + '})(__devtools.location, undefined);\n' + '//@ sourceURL=' + url.url;
+
+        frame.eval(frameContents);
+        if (this._pendingMessages) {
+            for (var msg in this._pendingMessages)
+                this.postMessage(this._pendingMessages[msg]);
+            delete this._pendingMessages;
+        }
+    },
+
+    _setupWorkerContext: function(workerFrame, url)
+    {
+        workerFrame.__devtools = {
+            handleException: bind(this._handleException, this),
+            location: url.mockLocation()
+        };
+        var worker = this._worker;
+
+        function handler(event) // Late binding to onmessage desired, so no bind() here.
+        {
+            worker.onmessage(event);
+        }
+
+        workerFrame.onmessage = noop;
+        workerFrame.postMessage = bind(this._dispatchMessage, this, window, handler);
+        workerFrame.importScripts = bind(this._importScripts, this, workerFrame);
+        workerFrame.close = bind(this.terminate, this);
+    },
+
+    _importScripts: function(targetFrame)
+    {
+        for (var i = 1; i < arguments.length; ++i) {
+            var workerOrigin = targetFrame.__devtools.location.href;
+            var url = this._expandURLAndCheckOrigin(workerOrigin, workerOrigin, arguments[i]);
+            targetFrame.eval(this._loadScript(url.url) + "\n//@ sourceURL= " + url.url);
+        }
+    },
+
+    _loadScript: function(url)
+    {
+        var xhr = new XMLHttpRequest();
+        xhr.open("GET", url, false);
+        xhr.send(null);
+
+        var text = xhr.responseText;
+        if (xhr.status != 0 && xhr.status/100 !== 2) { // We're getting status === 0 when using file://.
+            console.error("Failed to load worker: " + url + "[" + xhr.status + "]");
+            text = ""; // We've got error message, not worker code.
+        }
+        return text;
+    },
+
+    _expandURLAndCheckOrigin: function(baseURL, origin, url)
+    {
+        var scriptURL = new URL(baseURL).completeWith(url);
+
+        if (!scriptURL.sameOrigin(origin))
+            throw new DOMCoreException("SECURITY_ERR",18);
+        return scriptURL;
+    }
+};
+
+function URL(url)
+{
+    this.url = url;
+    this.split();
+}
+
+URL.prototype = {
+    urlRegEx: (/^(http[s]?|file):\/\/([^\/:]*)(:[\d]+)?(?:(\/[^#?]*)(\?[^#]*)?(?:#(.*))?)?$/i),
+
+    split: function()
+    {
+        function emptyIfNull(str)
+        {
+            return str == null ? "" : str;
+        }
+        var parts = this.urlRegEx.exec(this.url);
+
+        this.schema = parts[1];
+        this.host = parts[2];
+        this.port = emptyIfNull(parts[3]);
+        this.path = emptyIfNull(parts[4]);
+        this.query = emptyIfNull(parts[5]);
+        this.fragment = emptyIfNull(parts[6]);
+    },
+
+    mockLocation: function()
+    {
+        var host = this.host.replace(/^[^@]*@/, "");
+
+        return {
+            href:     this.url,
+            protocol: this.schema + ":",
+            host:     host,
+            hostname: host,
+            port:     this.port,
+            pathname: this.path,
+            search:   this.query,
+            hash:     this.fragment
+        };
+    },
+
+    completeWith: function(url)
+    {
+        if (url === "" || /^[^/]*:/.exec(url)) // If given absolute url, return as is now.
+            return new URL(url);
+
+        var relParts = /^([^#?]*)(.*)$/.exec(url); // => [ url, path, query-andor-fragment ]
+
+        var path = (relParts[1].slice(0, 1) === "/" ? "" : this.path.replace(/[^/]*$/, "")) + relParts[1];
+        path = path.replace(/(\/\.)+(\/|$)/g, "/").replace(/[^/]*\/\.\.(\/|$)/g, "");
+
+        return new URL(this.schema + "://" + this.host + this.port + path + relParts[2]);
+    },
+
+    sameOrigin: function(url)
+    {
+        function normalizePort(schema, port)
+        {
+            var portNo = port.slice(1);
+            return (schema === "https" && portNo == 443 || schema === "http" && portNo == 80) ? "" : port;
+        }
+
+        var other = new URL(url);
+
+        return this.schema === other.schema &&
+            this.host === other.host &&
+            normalizePort(this.schema, this.port) === normalizePort(other.schema, other.port);
+    }
+};
+
+function DOMCoreException(name, code)
+{
+    function formatError()
+    {
+        return "Error: " + this.message;
+    }
+
+    this.name = name;
+    this.message = name + ": DOM Exception " + code;
+    this.code = code;
+    this.toString = bind(formatError, this);
+}
+
+function bind(func, thisObject)
+{
+    var args = Array.prototype.slice.call(arguments, 2);
+    return function() { return func.apply(thisObject, args.concat(Array.prototype.slice.call(arguments, 0))); };
+}
+
+function noop()
+{
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
index 3bed8dabcf..aa999f76a4 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
@@ -26,15 +26,48 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+var injectedScriptConstructor = (function (InjectedScriptHost, inspectedWindow, injectedScriptId) {
+
 var InjectedScript = {};
 
+InjectedScript.lastBoundObjectId = 1;
+InjectedScript.idToWrappedObject = {};
+InjectedScript.objectGroups = {};
+InjectedScript.wrapObject = function(object, objectGroupName)
+{
+    var objectId;
+    if (typeof object === "object" || typeof object === "function" ||
+        (typeof object === "undefined" && object instanceof inspectedWindow.HTMLAllCollection)) { // FIXME(33716)
+        var id = InjectedScript.lastBoundObjectId++;
+        objectId = "object#" + id;
+        InjectedScript.idToWrappedObject[objectId] = object;
+
+        var group = InjectedScript.objectGroups[objectGroupName];
+        if (!group) {
+            group = [];
+            InjectedScript.objectGroups[objectGroupName] = group;
+        }
+        group.push(objectId);
+    }
+    return InjectedScript.createProxyObject(object, objectId);
+};
+
+InjectedScript.unwrapObject = function(objectId) {
+    return InjectedScript.idToWrappedObject[objectId];
+};
+
+InjectedScript.releaseWrapperObjectGroup = function(objectGroupName) {
+    var group = InjectedScript.objectGroups[objectGroupName];
+    if (!group)
+        return;
+    for (var i = 0; i < group.length; i++)
+        delete InjectedScript.idToWrappedObject[group[i]];
+    delete InjectedScript.objectGroups[objectGroupName];
+};
+
 // Called from within InspectorController on the 'inspected page' side.
 InjectedScript.reset = function()
 {
-    InjectedScript._styles = {};
-    InjectedScript._styleRules = {};
-    InjectedScript._lastStyleId = 0;
-    InjectedScript._lastStyleRuleId = 0;
     InjectedScript._searchResults = [];
     InjectedScript._includedInSearchResultsPropertyName = "__includedInInspectorSearchResults";
 }
@@ -43,7 +76,7 @@ InjectedScript.reset();
 
 InjectedScript.dispatch = function(methodName, args, callId)
 {
-    var argsArray = JSON.parse(args);
+    var argsArray = eval("(" + args + ")");
     if (callId)
         argsArray.splice(0, 0, callId);  // Methods that run asynchronously have a call back id parameter.
     var result = InjectedScript[methodName].apply(InjectedScript, argsArray);
@@ -51,376 +84,9 @@ InjectedScript.dispatch = function(methodName, args, callId)
         InjectedScript._window().console.error("Web Inspector error: InjectedScript.%s returns undefined", methodName);
         result = null;
     }
-    return JSON.stringify(result);
-}
-
-InjectedScript.getStyles = function(nodeId, authorOnly)
-{
-    var node = InjectedScript._nodeForId(nodeId);
-    if (!node)
-        return false;
-    var matchedRules = InjectedScript._window().getMatchedCSSRules(node, "", authorOnly);
-    var matchedCSSRules = [];
-    for (var i = 0; matchedRules && i < matchedRules.length; ++i)
-        matchedCSSRules.push(InjectedScript._serializeRule(matchedRules[i]));
-
-    var styleAttributes = {};
-    var attributes = node.attributes;
-    for (var i = 0; attributes && i < attributes.length; ++i) {
-        if (attributes[i].style)
-            styleAttributes[attributes[i].name] = InjectedScript._serializeStyle(attributes[i].style, true);
-    }
-    var result = {};
-    result.inlineStyle = InjectedScript._serializeStyle(node.style, true);
-    result.computedStyle = InjectedScript._serializeStyle(InjectedScript._window().getComputedStyle(node));
-    result.matchedCSSRules = matchedCSSRules;
-    result.styleAttributes = styleAttributes;
-    return result;
-}
-
-InjectedScript.getComputedStyle = function(nodeId)
-{
-    var node = InjectedScript._nodeForId(nodeId);
-    if (!node)
-        return false;
-    return InjectedScript._serializeStyle(InjectedScript._window().getComputedStyle(node));
-}
-
-InjectedScript.getInlineStyle = function(nodeId)
-{
-    var node = InjectedScript._nodeForId(nodeId);
-    if (!node)
-        return false;
-    return InjectedScript._serializeStyle(node.style, true);
-}
-
-InjectedScript.applyStyleText = function(styleId, styleText, propertyName)
-{
-    var style = InjectedScript._styles[styleId];
-    if (!style)
-        return false;
-
-    var styleTextLength = styleText.length;
-
-    // Create a new element to parse the user input CSS.
-    var parseElement = document.createElement("span");
-    parseElement.setAttribute("style", styleText);
-
-    var tempStyle = parseElement.style;
-    if (tempStyle.length || !styleTextLength) {
-        // The input was parsable or the user deleted everything, so remove the
-        // original property from the real style declaration. If this represents
-        // a shorthand remove all the longhand properties.
-        if (style.getPropertyShorthand(propertyName)) {
-            var longhandProperties = InjectedScript._getLonghandProperties(style, propertyName);
-            for (var i = 0; i < longhandProperties.length; ++i)
-                style.removeProperty(longhandProperties[i]);
-        } else
-            style.removeProperty(propertyName);
-    }
-
-    // Notify caller that the property was successfully deleted.
-    if (!styleTextLength)
-        return [null, [propertyName]];
-
-    if (!tempStyle.length)
-        return false;
-
-    // Iterate of the properties on the test element's style declaration and
-    // add them to the real style declaration. We take care to move shorthands.
-    var foundShorthands = {};
-    var changedProperties = [];
-    var uniqueProperties = InjectedScript._getUniqueStyleProperties(tempStyle);
-    for (var i = 0; i < uniqueProperties.length; ++i) {
-        var name = uniqueProperties[i];
-        var shorthand = tempStyle.getPropertyShorthand(name);
-
-        if (shorthand && shorthand in foundShorthands)
-            continue;
-
-        if (shorthand) {
-            var value = InjectedScript._getShorthandValue(tempStyle, shorthand);
-            var priority = InjectedScript._getShorthandPriority(tempStyle, shorthand);
-            foundShorthands[shorthand] = true;
-        } else {
-            var value = tempStyle.getPropertyValue(name);
-            var priority = tempStyle.getPropertyPriority(name);
-        }
-
-        // Set the property on the real style declaration.
-        style.setProperty((shorthand || name), value, priority);
-        changedProperties.push(shorthand || name);
-    }
-    return [InjectedScript._serializeStyle(style, true), changedProperties];
-}
-
-InjectedScript.setStyleText = function(style, cssText)
-{
-    style.cssText = cssText;
-    return true;
-}
-
-InjectedScript.toggleStyleEnabled = function(styleId, propertyName, disabled)
-{
-    var style = InjectedScript._styles[styleId];
-    if (!style)
-        return false;
-
-    if (disabled) {
-        if (!style.__disabledPropertyValues || !style.__disabledPropertyPriorities) {
-            var inspectedWindow = InjectedScript._window();
-            style.__disabledProperties = new inspectedWindow.Object;
-            style.__disabledPropertyValues = new inspectedWindow.Object;
-            style.__disabledPropertyPriorities = new inspectedWindow.Object;
-        }
-
-        style.__disabledPropertyValues[propertyName] = style.getPropertyValue(propertyName);
-        style.__disabledPropertyPriorities[propertyName] = style.getPropertyPriority(propertyName);
-
-        if (style.getPropertyShorthand(propertyName)) {
-            var longhandProperties = InjectedScript._getLonghandProperties(style, propertyName);
-            for (var i = 0; i < longhandProperties.length; ++i) {
-                style.__disabledProperties[longhandProperties[i]] = true;
-                style.removeProperty(longhandProperties[i]);
-            }
-        } else {
-            style.__disabledProperties[propertyName] = true;
-            style.removeProperty(propertyName);
-        }
-    } else if (style.__disabledProperties && style.__disabledProperties[propertyName]) {
-        var value = style.__disabledPropertyValues[propertyName];
-        var priority = style.__disabledPropertyPriorities[propertyName];
-
-        style.setProperty(propertyName, value, priority);
-        delete style.__disabledProperties[propertyName];
-        delete style.__disabledPropertyValues[propertyName];
-        delete style.__disabledPropertyPriorities[propertyName];
-    }
-    return InjectedScript._serializeStyle(style, true);
-}
-
-InjectedScript.applyStyleRuleText = function(ruleId, newContent, selectedNodeId)
-{
-    var rule = InjectedScript._styleRules[ruleId];
-    if (!rule)
-        return false;
-
-    var selectedNode = InjectedScript._nodeForId(selectedNodeId);
-
-    try {
-        var stylesheet = rule.parentStyleSheet;
-        stylesheet.addRule(newContent);
-        var newRule = stylesheet.cssRules[stylesheet.cssRules.length - 1];
-        newRule.style.cssText = rule.style.cssText;
-
-        var parentRules = stylesheet.cssRules;
-        for (var i = 0; i < parentRules.length; ++i) {
-            if (parentRules[i] === rule) {
-                rule.parentStyleSheet.removeRule(i);
-                break;
-            }
-        }
-
-        return [InjectedScript._serializeRule(newRule), InjectedScript._doesSelectorAffectNode(newContent, selectedNode)];
-    } catch(e) {
-        // Report invalid syntax.
-        return false;
-    }
-}
-
-InjectedScript.addStyleSelector = function(newContent, selectedNodeId)
-{
-    var stylesheet = InjectedScript.stylesheet;
-    if (!stylesheet) {
-        var inspectedDocument = InjectedScript._window().document;
-        var head = inspectedDocument.getElementsByTagName("head")[0];
-        var styleElement = inspectedDocument.createElement("style");
-        styleElement.type = "text/css";
-        head.appendChild(styleElement);
-        stylesheet = inspectedDocument.styleSheets[inspectedDocument.styleSheets.length - 1];
-        InjectedScript.stylesheet = stylesheet;
-    }
-
-    try {
-        stylesheet.addRule(newContent);
-    } catch (e) {
-        // Invalid Syntax for a Selector
-        return false;
-    }
-
-    var selectedNode = InjectedScript._nodeForId(selectedNodeId);
-    var rule = stylesheet.cssRules[stylesheet.cssRules.length - 1];
-    rule.__isViaInspector = true;
-
-    return [ InjectedScript._serializeRule(rule), InjectedScript._doesSelectorAffectNode(newContent, selectedNode) ];
-}
-
-InjectedScript._doesSelectorAffectNode = function(selectorText, node)
-{
-    if (!node)
-        return false;
-    var nodes = node.ownerDocument.querySelectorAll(selectorText);
-    for (var i = 0; i < nodes.length; ++i) {
-        if (nodes[i] === node) {
-            return true;
-        }
-    }
-    return false;
-}
-
-InjectedScript.setStyleProperty = function(styleId, name, value)
-{
-    var style = InjectedScript._styles[styleId];
-    if (!style)
-        return false;
-
-    style.setProperty(name, value, "");
-    return true;
-}
-
-InjectedScript._serializeRule = function(rule)
-{
-    var parentStyleSheet = rule.parentStyleSheet;
-
-    var ruleValue = {};
-    ruleValue.selectorText = rule.selectorText;
-    if (parentStyleSheet) {
-        ruleValue.parentStyleSheet = {};
-        ruleValue.parentStyleSheet.href = parentStyleSheet.href;
-    }
-    ruleValue.isUserAgent = parentStyleSheet && !parentStyleSheet.ownerNode && !parentStyleSheet.href;
-    ruleValue.isUser = parentStyleSheet && parentStyleSheet.ownerNode && parentStyleSheet.ownerNode.nodeName == "#document";
-    ruleValue.isViaInspector = !!rule.__isViaInspector;
-
-    // Bind editable scripts only.
-    var doBind = !ruleValue.isUserAgent && !ruleValue.isUser;
-    ruleValue.style = InjectedScript._serializeStyle(rule.style, doBind);
-
-    if (doBind) {
-        if (!rule.id) {
-            rule.id = InjectedScript._lastStyleRuleId++;
-            InjectedScript._styleRules[rule.id] = rule;
-        }
-        ruleValue.id = rule.id;
-    }
-    return ruleValue;
-}
-
-InjectedScript._serializeStyle = function(style, doBind)
-{
-    var result = {};
-    result.width = style.width;
-    result.height = style.height;
-    result.__disabledProperties = style.__disabledProperties;
-    result.__disabledPropertyValues = style.__disabledPropertyValues;
-    result.__disabledPropertyPriorities = style.__disabledPropertyPriorities;
-    result.properties = [];
-    result.shorthandValues = {};
-    var foundShorthands = {};
-    for (var i = 0; i < style.length; ++i) {
-        var property = {};
-        var name = style[i];
-        property.name = name;
-        property.priority = style.getPropertyPriority(name);
-        property.implicit = style.isPropertyImplicit(name);
-        var shorthand =  style.getPropertyShorthand(name);
-        property.shorthand = shorthand;
-        if (shorthand && !(shorthand in foundShorthands)) {
-            foundShorthands[shorthand] = true;
-            result.shorthandValues[shorthand] = InjectedScript._getShorthandValue(style, shorthand);
-        }
-        property.value = style.getPropertyValue(name);
-        result.properties.push(property);
-    }
-    result.uniqueStyleProperties = InjectedScript._getUniqueStyleProperties(style);
-
-    if (doBind) {
-        if (!style.id) {
-            style.id = InjectedScript._lastStyleId++;
-            InjectedScript._styles[style.id] = style;
-        }
-        result.id = style.id;
-    }
     return result;
 }
 
-InjectedScript._getUniqueStyleProperties = function(style)
-{
-    var properties = [];
-    var foundProperties = {};
-
-    for (var i = 0; i < style.length; ++i) {
-        var property = style[i];
-        if (property in foundProperties)
-            continue;
-        foundProperties[property] = true;
-        properties.push(property);
-    }
-
-    return properties;
-}
-
-
-InjectedScript._getLonghandProperties = function(style, shorthandProperty)
-{
-    var properties = [];
-    var foundProperties = {};
-
-    for (var i = 0; i < style.length; ++i) {
-        var individualProperty = style[i];
-        if (individualProperty in foundProperties || style.getPropertyShorthand(individualProperty) !== shorthandProperty)
-            continue;
-        foundProperties[individualProperty] = true;
-        properties.push(individualProperty);
-    }
-
-    return properties;
-}
-
-InjectedScript._getShorthandValue = function(style, shorthandProperty)
-{
-    var value = style.getPropertyValue(shorthandProperty);
-    if (!value) {
-        // Some shorthands (like border) return a null value, so compute a shorthand value.
-        // FIXME: remove this when http://bugs.webkit.org/show_bug.cgi?id=15823 is fixed.
-
-        var foundProperties = {};
-        for (var i = 0; i < style.length; ++i) {
-            var individualProperty = style[i];
-            if (individualProperty in foundProperties || style.getPropertyShorthand(individualProperty) !== shorthandProperty)
-                continue;
-
-            var individualValue = style.getPropertyValue(individualProperty);
-            if (style.isPropertyImplicit(individualProperty) || individualValue === "initial")
-                continue;
-
-            foundProperties[individualProperty] = true;
-
-            if (!value)
-                value = "";
-            else if (value.length)
-                value += " ";
-            value += individualValue;
-        }
-    }
-    return value;
-}
-
-InjectedScript._getShorthandPriority = function(style, shorthandProperty)
-{
-    var priority = style.getPropertyPriority(shorthandProperty);
-    if (!priority) {
-        for (var i = 0; i < style.length; ++i) {
-            var individualProperty = style[i];
-            if (style.getPropertyShorthand(individualProperty) !== shorthandProperty)
-                continue;
-            priority = style.getPropertyPriority(individualProperty);
-            break;
-        }
-    }
-    return priority;
-}
-
 InjectedScript.getPrototypes = function(nodeId)
 {
     var node = InjectedScript._nodeForId(nodeId);
@@ -429,7 +95,7 @@ InjectedScript.getPrototypes = function(nodeId)
 
     var result = [];
     for (var prototype = node; prototype; prototype = prototype.__proto__) {
-        var title = Object.describe(prototype, true);
+        var title = InjectedScript._describe(prototype, true);
         if (title.match(/Prototype$/)) {
             title = title.replace(/Prototype$/, "");
         }
@@ -438,30 +104,35 @@ InjectedScript.getPrototypes = function(nodeId)
     return result;
 }
 
-InjectedScript.getProperties = function(objectProxy, ignoreHasOwnProperty)
+InjectedScript.getProperties = function(objectProxy, ignoreHasOwnProperty, abbreviate)
 {
     var object = InjectedScript._resolveObject(objectProxy);
-    if (!object)
+    if (!InjectedScript._isDefined(object))
         return false;
-
     var properties = [];
+    var propertyNames = ignoreHasOwnProperty ? InjectedScript._getPropertyNames(object) : Object.getOwnPropertyNames(object);
+    if (!ignoreHasOwnProperty && object.__proto__)
+        propertyNames.push("__proto__");
 
     // Go over properties, prepare results.
-    for (var propertyName in object) {
-        if (!ignoreHasOwnProperty && "hasOwnProperty" in object && !object.hasOwnProperty(propertyName))
-            continue;
+    for (var i = 0; i < propertyNames.length; ++i) {
+        var propertyName = propertyNames[i];
 
         var property = {};
-        property.name = propertyName;
+        property.name = propertyName + "";
         property.parentObjectProxy = objectProxy;
         var isGetter = object["__lookupGetter__"] && object.__lookupGetter__(propertyName);
         if (!property.isGetter) {
-            var childObject = object[propertyName];
-            var childObjectProxy = new InjectedScript.createProxyObject(childObject, objectProxy.objectId, true);
-            childObjectProxy.path = objectProxy.path ? objectProxy.path.slice() : [];
-            childObjectProxy.path.push(propertyName);
-            childObjectProxy.protoDepth = objectProxy.protoDepth || 0;
-            property.value = childObjectProxy;
+            try {
+                var childObject = object[propertyName];
+                var childObjectProxy = new InjectedScript.createProxyObject(childObject, objectProxy.objectId, abbreviate);
+                childObjectProxy.path = objectProxy.path ? objectProxy.path.slice() : [];
+                childObjectProxy.path.push(propertyName);
+                property.value = childObjectProxy;
+            } catch(e) {
+                property.value = { description: e.toString() };
+                property.isError = true;
+            }
         } else {
             // FIXME: this should show something like "getter" (bug 16734).
             property.value = { description: "\u2014" }; // em dash
@@ -475,7 +146,7 @@ InjectedScript.getProperties = function(objectProxy, ignoreHasOwnProperty)
 InjectedScript.setPropertyValue = function(objectProxy, propertyName, expression)
 {
     var object = InjectedScript._resolveObject(objectProxy);
-    if (!object)
+    if (!InjectedScript._isDefined(object))
         return false;
 
     var expressionLength = expression.length;
@@ -497,7 +168,7 @@ InjectedScript.setPropertyValue = function(objectProxy, propertyName, expression
         return true;
     } catch(e) {
         try {
-            var result = InjectedScript._window().eval("\"" + expression.escapeCharacters("\"") + "\"");
+            var result = InjectedScript._window().eval("\"" + InjectedScript._escapeCharacters(expression, "\"") + "\"");
             object[propertyName] = result;
             return true;
         } catch(e) {
@@ -506,6 +177,47 @@ InjectedScript.setPropertyValue = function(objectProxy, propertyName, expression
     }
 }
 
+InjectedScript.getNodePropertyValue = function(nodeId, propertyName)
+{
+    var node = InjectedScript._nodeForId(nodeId);
+    if (!node)
+        return false;
+    var result = node[propertyName];
+    return result !== undefined ? result : false;
+}
+
+InjectedScript.setOuterHTML = function(nodeId, value, expanded)
+{
+    var node = InjectedScript._nodeForId(nodeId);
+    if (!node)
+        return false;
+
+    var parent = node.parentNode;
+    var prevSibling = node.previousSibling;
+    node.outerHTML = value;
+    var newNode = prevSibling ? prevSibling.nextSibling : parent.firstChild;
+
+    return InjectedScriptHost.pushNodePathToFrontend(newNode, expanded, false);
+}
+
+InjectedScript._populatePropertyNames = function(object, resultSet)
+{
+    for (var o = object; o; o = o.__proto__) {
+        try {
+            var names = Object.getOwnPropertyNames(o);
+            for (var i = 0; i < names.length; ++i)
+                resultSet[names[i] + ""] = true;
+        } catch (e) {
+        }
+    }
+}
+
+InjectedScript._getPropertyNames = function(object, resultSet)
+{
+    var propertyNameSet = {};
+    InjectedScript._populatePropertyNames(object, propertyNameSet);
+    return Object.keys(propertyNameSet);
+}
 
 InjectedScript.getCompletions = function(expression, includeInspectorCommandLineAPI, callFrameId)
 {
@@ -522,23 +234,16 @@ InjectedScript.getCompletions = function(expression, includeInspectorCommandLine
             else {
                 // Evaluate into properties in scope of the selected call frame.
                 var scopeChain = callFrame.scopeChain;
-                for (var i = 0; i < scopeChain.length; ++i) {
-                    var scopeObject = scopeChain[i];
-                    try {
-                        for (var propertyName in scopeObject)
-                            props[propertyName] = true;
-                    } catch (e) {
-                    }
-                }
+                for (var i = 0; i < scopeChain.length; ++i)
+                    InjectedScript._populatePropertyNames(scopeChain[i], props);
             }
         } else {
             if (!expression)
                 expression = "this";
             expressionResult = InjectedScript._evaluateOn(InjectedScript._window().eval, InjectedScript._window(), expression);
         }
-        if (expressionResult)
-            for (var prop in expressionResult)
-                props[prop] = true;
+        if (typeof expressionResult == "object")
+            InjectedScript._populatePropertyNames(expressionResult, props);
         if (includeInspectorCommandLineAPI)
             for (var prop in InjectedScript._window().console._inspectorCommandLineAPI)
                 if (prop.charAt(0) !== '_')
@@ -557,7 +262,8 @@ InjectedScript._evaluateAndWrap = function(evalFunction, object, expression, obj
 {
     var result = {};
     try {
-        result.value = InspectorController.wrapObject(InjectedScript._evaluateOn(evalFunction, object, expression), objectGroup);
+        result.value = InjectedScript.wrapObject(InjectedScript._evaluateOn(evalFunction, object, expression), objectGroup);
+
         // Handle error that might have happened while describing result.
         if (result.value.errorText) {
             result.value = result.value.errorText;
@@ -575,11 +281,11 @@ InjectedScript._evaluateOn = function(evalFunction, object, expression)
     InjectedScript._ensureCommandLineAPIInstalled(evalFunction, object);
     // Surround the expression in with statements to inject our command line API so that
     // the window object properties still take more precedent than our API functions.
-    expression = "with (window.console._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
+    expression = "with (window.console._inspectorCommandLineAPI) { with (window) {\n" + expression + "\n} }";
     var value = evalFunction.call(object, expression);
 
     // When evaluating on call frame error is not thrown, but returned as a value.
-    if (Object.type(value) === "error")
+    if (InjectedScript._type(value) === "error")
         throw value.toString();
 
     return value;
@@ -599,8 +305,19 @@ InjectedScript.addInspectedNode = function(nodeId)
     return true;
 }
 
-InjectedScript.performSearch = function(whitespaceTrimmedQuery)
+InjectedScript.getNodeId = function(node)
+{
+    return InjectedScriptHost.pushNodePathToFrontend(node, false, false);
+}
+
+InjectedScript.performSearch = function(whitespaceTrimmedQuery, runSynchronously)
 {
+    // FIXME: Few things are missing here:
+    // 1) Search works with node granularity - number of matches within node is not calculated.
+    // 2) Search does not work outside main documents' domain - we need to use specific InjectedScript instances
+    //    for other domains.
+    // 3) There is no need to push all search results to the front-end at a time, pushing next / previous result
+    //    is sufficient.
     var tagNameQuery = whitespaceTrimmedQuery;
     var attributeNameQuery = whitespaceTrimmedQuery;
     var startTagFound = (tagNameQuery.indexOf("<") === 0);
@@ -619,9 +336,9 @@ InjectedScript.performSearch = function(whitespaceTrimmedQuery)
     if (!/^[a-zA-Z0-9\-_:]+$/.test(attributeNameQuery))
         attributeNameQuery = null;
 
-    const escapedQuery = whitespaceTrimmedQuery.escapeCharacters("'");
-    const escapedTagNameQuery = (tagNameQuery ? tagNameQuery.escapeCharacters("'") : null);
-    const escapedWhitespaceTrimmedQuery = whitespaceTrimmedQuery.escapeCharacters("'");
+    const escapedQuery = InjectedScript._escapeCharacters(whitespaceTrimmedQuery, "'");
+    const escapedTagNameQuery = (tagNameQuery ?  InjectedScript._escapeCharacters(tagNameQuery, "'") : null);
+    const escapedWhitespaceTrimmedQuery = InjectedScript._escapeCharacters(whitespaceTrimmedQuery, "'");
     const searchResultsProperty = InjectedScript._includedInSearchResultsPropertyName;
 
     function addNodesToResults(nodes, length, getItem)
@@ -642,10 +359,10 @@ InjectedScript.performSearch = function(whitespaceTrimmedQuery)
 
             node[searchResultsProperty] = true;
             InjectedScript._searchResults.push(node);
-            var nodeId = InspectorController.pushNodePathToFrontend(node, false);
+            var nodeId = InjectedScriptHost.pushNodePathToFrontend(node, false, false);
             nodeIds.push(nodeId);
         }
-        InspectorController.addNodesToSearchResult(nodeIds.join(","));
+        InjectedScriptHost.addNodesToSearchResult(nodeIds.join(","));
     }
 
     function matchExactItems(doc)
@@ -761,8 +478,7 @@ InjectedScript.performSearch = function(whitespaceTrimmedQuery)
         searchFunctions = [matchExactItems, matchStyleSelector, matchPartialTagNamesAndAttributeValues, matchPlainText, matchXPathQuery];
 
     // Find all frames, iframes and object elements to search their documents.
-    const querySelectorAllFunction = InjectedScript._window().Document.prototype.querySelectorAll;
-    const subdocumentResult = querySelectorAllFunction.call(mainFrameDocument, "iframe, frame, object");
+    const subdocumentResult = mainFrameDocument.querySelectorAll("iframe, frame, object");
 
     for (var i = 0; i < subdocumentResult.length; ++i) {
         var element = subdocumentResult.item(i);
@@ -791,26 +507,27 @@ InjectedScript.performSearch = function(whitespaceTrimmedQuery)
                     delete panel._currentSearchChunkIntervalIdentifier;
                 clearInterval(chunkIntervalIdentifier);
                 finishedSearching.call(panel);
-                return;
+                return false;
             }
 
             searchDocument = searchDocuments[documentIndex];
         }
 
-        if (!searchDocument || !searchFunction)
-            return;
-
         try {
             searchFunction.call(panel, searchDocument);
         } catch(err) {
             // ignore any exceptions. the query might be malformed, but we allow that.
         }
+        return true;
     }
 
-    processChunk();
-
-    chunkIntervalIdentifier = setInterval(processChunk, 25);
-    InjectedScript._currentSearchChunkIntervalIdentifier = chunkIntervalIdentifier;
+    if (runSynchronously)
+        while (processChunk()) {}
+    else {
+        processChunk();
+        chunkIntervalIdentifier = setInterval(processChunk, 25);
+        InjectedScript._currentSearchChunkIntervalIdentifier = chunkIntervalIdentifier;
+    }
     return true;
 }
 
@@ -842,9 +559,9 @@ InjectedScript.openInInspectedWindow = function(url)
     return true;
 }
 
-InjectedScript.getCallFrames = function()
+InjectedScript.callFrames = function()
 {
-    var callFrame = InspectorController.currentCallFrame();
+    var callFrame = InjectedScriptHost.currentCallFrame();
     if (!callFrame)
         return false;
 
@@ -867,15 +584,16 @@ InjectedScript.evaluateInCallFrame = function(callFrameId, code, objectGroup)
 
 InjectedScript._callFrameForId = function(id)
 {
-    var callFrame = InspectorController.currentCallFrame();
+    var callFrame = InjectedScriptHost.currentCallFrame();
     while (--id >= 0 && callFrame)
         callFrame = callFrame.caller;
     return callFrame;
 }
 
-InjectedScript._clearConsoleMessages = function()
+InjectedScript.clearConsoleMessages = function()
 {
-    InspectorController.clearMessages(true);
+    InjectedScriptHost.clearConsoleMessages();
+    return true;
 }
 
 InjectedScript._inspectObject = function(o)
@@ -883,93 +601,107 @@ InjectedScript._inspectObject = function(o)
     if (arguments.length === 0)
         return;
 
-    var inspectedWindow = InjectedScript._window();
     inspectedWindow.console.log(o);
-    if (Object.type(o) === "node") {
-        InspectorController.pushNodePathToFrontend(o, true);
+    if (InjectedScript._type(o) === "node") {
+        InjectedScriptHost.pushNodePathToFrontend(o, false, true);
     } else {
-        switch (Object.describe(o)) {
+        switch (InjectedScript._describe(o)) {
             case "Database":
-                InspectorController.selectDatabase(o);
+                InjectedScriptHost.selectDatabase(o);
                 break;
             case "Storage":
-                InspectorController.selectDOMStorage(o);
+                InjectedScriptHost.selectDOMStorage(o);
                 break;
         }
     }
 }
 
+InjectedScript._copy = function(o)
+{
+    if (InjectedScript._type(o) === "node") {
+        var nodeId = InjectedScriptHost.pushNodePathToFrontend(o, false, false);
+        InjectedScriptHost.copyNode(nodeId);
+    } else {
+        InjectedScriptHost.copyText(o);
+    }
+}
+
 InjectedScript._ensureCommandLineAPIInstalled = function(evalFunction, evalObject)
 {
     if (evalFunction.call(evalObject, "window.console._inspectorCommandLineAPI"))
         return;
-    var inspectorCommandLineAPI = evalFunction.call(evalObject, "window.console._inspectorCommandLineAPI = { \
-        $: function() { return document.getElementById.apply(document, arguments) }, \
-        $$: function() { return document.querySelectorAll.apply(document, arguments) }, \
-        $x: function(xpath, context) { \
-            var nodes = []; \
-            try { \
-                var doc = context || document; \
-                var results = doc.evaluate(xpath, doc, null, XPathResult.ANY_TYPE, null); \
-                var node; \
-                while (node = results.iterateNext()) nodes.push(node); \
-            } catch (e) {} \
-            return nodes; \
-        }, \
-        dir: function() { return console.dir.apply(console, arguments) }, \
-        dirxml: function() { return console.dirxml.apply(console, arguments) }, \
-        keys: function(o) { var a = []; for (var k in o) a.push(k); return a; }, \
-        values: function(o) { var a = []; for (var k in o) a.push(o[k]); return a; }, \
-        profile: function() { return console.profile.apply(console, arguments) }, \
-        profileEnd: function() { return console.profileEnd.apply(console, arguments) }, \
-        _logEvent: function _inspectorCommandLineAPI_logEvent(e) { console.log(e.type, e); }, \
-        _allEventTypes: [\"mouse\", \"key\", \"load\", \"unload\", \"abort\", \"error\", \
-            \"select\", \"change\", \"submit\", \"reset\", \"focus\", \"blur\", \
-            \"resize\", \"scroll\"], \
-        _normalizeEventTypes: function(t) { \
-            if (typeof t === \"undefined\") \
-                t = _inspectorCommandLineAPI._allEventTypes; \
-            else if (typeof t === \"string\") \
-                t = [t]; \
-            var i, te = []; \
-            for (i = 0; i < t.length; i++) { \
-                if (t[i] === \"mouse\") \
-                    te.splice(0, 0, \"mousedown\", \"mouseup\", \"click\", \"dblclick\", \
-                        \"mousemove\", \"mouseover\", \"mouseout\"); \
-                else if (t[i] === \"key\") \
-                    te.splice(0, 0, \"keydown\", \"keyup\", \"keypress\"); \
-                else \
-                    te.push(t[i]); \
-            } \
-            return te; \
-        }, \
-        monitorEvent: function(o, t) { \
-            if (!o || !o.addEventListener || !o.removeEventListener) \
-                return; \
-            t = _inspectorCommandLineAPI._normalizeEventTypes(t); \
-            for (i = 0; i < t.length; i++) { \
-                o.removeEventListener(t[i], _inspectorCommandLineAPI._logEvent, false); \
-                o.addEventListener(t[i], _inspectorCommandLineAPI._logEvent, false); \
-            } \
-        }, \
-        unmonitorEvent: function(o, t) { \
-            if (!o || !o.removeEventListener) \
-                return; \
-            t = _inspectorCommandLineAPI._normalizeEventTypes(t); \
-            for (i = 0; i < t.length; i++) { \
-                o.removeEventListener(t[i], _inspectorCommandLineAPI._logEvent, false); \
-            } \
-        }, \
-        _inspectedNodes: [], \
-        get $0() { return console._inspectorCommandLineAPI._inspectedNodes[0] }, \
-        get $1() { return console._inspectorCommandLineAPI._inspectedNodes[1] }, \
-        get $2() { return console._inspectorCommandLineAPI._inspectedNodes[2] }, \
-        get $3() { return console._inspectorCommandLineAPI._inspectedNodes[3] }, \
-        get $4() { return console._inspectorCommandLineAPI._inspectedNodes[4] } \
+    var inspectorCommandLineAPI = evalFunction.call(evalObject, "window.console._inspectorCommandLineAPI = { \n\
+        $: function() { return document.getElementById.apply(document, arguments) }, \n\
+        $$: function() { return document.querySelectorAll.apply(document, arguments) }, \n\
+        $x: function(xpath, context) \n\
+        { \n\
+            var nodes = []; \n\
+            try { \n\
+                var doc = context || document; \n\
+                var results = doc.evaluate(xpath, doc, null, XPathResult.ANY_TYPE, null); \n\
+                var node; \n\
+                while (node = results.iterateNext()) nodes.push(node); \n\
+            } catch (e) {} \n\
+            return nodes; \n\
+        }, \n\
+        dir: function() { return console.dir.apply(console, arguments) }, \n\
+        dirxml: function() { return console.dirxml.apply(console, arguments) }, \n\
+        keys: function(o) { var a = []; for (var k in o) a.push(k); return a; }, \n\
+        values: function(o) { var a = []; for (var k in o) a.push(o[k]); return a; }, \n\
+        profile: function() { return console.profile.apply(console, arguments) }, \n\
+        profileEnd: function() { return console.profileEnd.apply(console, arguments) }, \n\
+        _logEvent: function _inspectorCommandLineAPI_logEvent(e) { console.log(e.type, e); }, \n\
+        _allEventTypes: [\"mouse\", \"key\", \"load\", \"unload\", \"abort\", \"error\", \n\
+            \"select\", \"change\", \"submit\", \"reset\", \"focus\", \"blur\", \n\
+            \"resize\", \"scroll\"], \n\
+        _normalizeEventTypes: function(t) \n\
+        { \n\
+            if (typeof t === \"undefined\") \n\
+                t = console._inspectorCommandLineAPI._allEventTypes; \n\
+            else if (typeof t === \"string\") \n\
+                t = [t]; \n\
+            var i, te = []; \n\
+            for (i = 0; i < t.length; i++) { \n\
+                if (t[i] === \"mouse\") \n\
+                    te.splice(0, 0, \"mousedown\", \"mouseup\", \"click\", \"dblclick\", \n\
+                        \"mousemove\", \"mouseover\", \"mouseout\"); \n\
+                else if (t[i] === \"key\") \n\
+                    te.splice(0, 0, \"keydown\", \"keyup\", \"keypress\"); \n\
+                else \n\
+                    te.push(t[i]); \n\
+            } \n\
+            return te; \n\
+        }, \n\
+        monitorEvents: function(o, t) \n\
+        { \n\
+            if (!o || !o.addEventListener || !o.removeEventListener) \n\
+                return; \n\
+            t = console._inspectorCommandLineAPI._normalizeEventTypes(t); \n\
+            for (i = 0; i < t.length; i++) { \n\
+                o.removeEventListener(t[i], console._inspectorCommandLineAPI._logEvent, false); \n\
+                o.addEventListener(t[i], console._inspectorCommandLineAPI._logEvent, false); \n\
+            } \n\
+        }, \n\
+        unmonitorEvents: function(o, t) \n\
+        { \n\
+            if (!o || !o.removeEventListener) \n\
+                return; \n\
+            t = console._inspectorCommandLineAPI._normalizeEventTypes(t); \n\
+            for (i = 0; i < t.length; i++) { \n\
+                o.removeEventListener(t[i], console._inspectorCommandLineAPI._logEvent, false); \n\
+            } \n\
+        }, \n\
+        _inspectedNodes: [], \n\
+        get $0() { return console._inspectorCommandLineAPI._inspectedNodes[0] }, \n\
+        get $1() { return console._inspectorCommandLineAPI._inspectedNodes[1] }, \n\
+        get $2() { return console._inspectorCommandLineAPI._inspectedNodes[2] }, \n\
+        get $3() { return console._inspectorCommandLineAPI._inspectedNodes[3] }, \n\
+        get $4() { return console._inspectorCommandLineAPI._inspectedNodes[4] }, \n\
     };");
 
-    inspectorCommandLineAPI.clear = InspectorController.wrapCallback(InjectedScript._clearConsoleMessages);
-    inspectorCommandLineAPI.inspect = InspectorController.wrapCallback(InjectedScript._inspectObject);
+    inspectorCommandLineAPI.clear = InjectedScript.clearConsoleMessages;
+    inspectorCommandLineAPI.inspect = InjectedScript._inspectObject;
+    inspectorCommandLineAPI.copy = InjectedScript._copy;
 }
 
 InjectedScript._resolveObject = function(objectProxy)
@@ -979,13 +711,9 @@ InjectedScript._resolveObject = function(objectProxy)
     var protoDepth = objectProxy.protoDepth;
 
     // Follow the property path.
-    for (var i = 0; object && path && i < path.length; ++i)
+    for (var i = 0; InjectedScript._isDefined(object) && path && i < path.length; ++i)
         object = object[path[i]];
 
-    // Get to the necessary proto layer.
-    for (var i = 0; object && protoDepth && i < protoDepth; ++i)
-        object = object.__proto__;
-
     return object;
 }
 
@@ -993,14 +721,14 @@ InjectedScript._window = function()
 {
     // TODO: replace with 'return window;' once this script is injected into
     // the page's context.
-    return InspectorController.inspectedWindow();
+    return inspectedWindow;
 }
 
 InjectedScript._nodeForId = function(nodeId)
 {
     if (!nodeId)
         return null;
-    return InspectorController.nodeForId(nodeId);
+    return InjectedScriptHost.nodeForId(nodeId);
 }
 
 InjectedScript._objectForId = function(objectId)
@@ -1012,7 +740,7 @@ InjectedScript._objectForId = function(objectId)
     if (typeof objectId === "number") {
         return InjectedScript._nodeForId(objectId);
     } else if (typeof objectId === "string") {
-        return InspectorController.unwrapObject(objectId);
+        return InjectedScript.unwrapObject(objectId);
     } else if (typeof objectId === "object") {
         var callFrame = InjectedScript._callFrameForId(objectId.callFrame);
         if (objectId.thisObject)
@@ -1026,33 +754,45 @@ InjectedScript._objectForId = function(objectId)
 InjectedScript.pushNodeToFrontend = function(objectProxy)
 {
     var object = InjectedScript._resolveObject(objectProxy);
-    if (!object || Object.type(object) !== "node")
+    if (!object || InjectedScript._type(object) !== "node")
         return false;
-    return InspectorController.pushNodePathToFrontend(object, false);
+    return InjectedScriptHost.pushNodePathToFrontend(object, false, false);
+}
+
+InjectedScript.nodeByPath = function(path)
+{
+    // We make this call through the injected script only to get a nice
+    // callback for it.
+    return InjectedScriptHost.pushNodeByPathToFrontend(path.join(","));
 }
 
 // Called from within InspectorController on the 'inspected page' side.
 InjectedScript.createProxyObject = function(object, objectId, abbreviate)
 {
     var result = {};
+    result.injectedScriptId = injectedScriptId;
     result.objectId = objectId;
-    result.type = Object.type(object);
+    result.type = InjectedScript._type(object);
+    if (result.type === "array")
+        result.propertyLength = object.length;
 
     var type = typeof object;
-    if ((type === "object" && object !== null) || type === "function") {
-        for (var subPropertyName in object) {
-            result.hasChildren = true;
-            break;
-        }
-    }
+    
+    result.hasChildren = (type === "object" && object !== null && (Object.getOwnPropertyNames(object).length || object.__proto__)) || type === "function";
     try {
-        result.description = Object.describe(object, abbreviate);
+        result.description = InjectedScript._describe(object, abbreviate);
     } catch (e) {
         result.errorText = e.toString();
     }
     return result;
 }
 
+InjectedScript.evaluateOnSelf = function(funcBody, args)
+{
+    var func = window.eval("(" + funcBody + ")");
+    return func.apply(this, args || []);
+}
+
 InjectedScript.CallFrameProxy = function(id, callFrame)
 {
     this.id = id;
@@ -1073,7 +813,7 @@ InjectedScript.CallFrameProxy.prototype = {
             var scopeObject = scopeChain[i];
             var scopeObjectProxy = InjectedScript.createProxyObject(scopeObject, { callFrame: this.id, chainIndex: i }, true);
 
-            if (Object.prototype.toString.call(scopeObject) === "[object JSActivation]") {
+            if (InjectedScriptHost.isActivation(scopeObject)) {
                 if (!foundLocalScope)
                     scopeObjectProxy.thisObject = InjectedScript.createProxyObject(callFrame.thisObject, { callFrame: this.id, thisObject: true }, true);
                 else
@@ -1111,31 +851,40 @@ InjectedScript.executeSql = function(callId, databaseId, query)
                 data[columnIdentifier] = String(text);
             }
         }
-        InspectorController.reportDidDispatchOnInjectedScript(callId, JSON.stringify(result), false);
+        InjectedScriptHost.reportDidDispatchOnInjectedScript(callId, result, false);
     }
 
     function errorCallback(tx, error)
     {
-        InspectorController.reportDidDispatchOnInjectedScript(callId, JSON.stringify(error), false);
+        InjectedScriptHost.reportDidDispatchOnInjectedScript(callId, error, false);
     }
 
     function queryTransaction(tx)
     {
-        tx.executeSql(query, null, InspectorController.wrapCallback(successCallback), InspectorController.wrapCallback(errorCallback));
+        tx.executeSql(query, null, successCallback, errorCallback);
     }
 
-    var database = InspectorController.databaseForId(databaseId);
+    var database = InjectedScriptHost.databaseForId(databaseId);
     if (!database)
         errorCallback(null, { code : 2 });  // Return as unexpected version.
-    database.transaction(InspectorController.wrapCallback(queryTransaction), InspectorController.wrapCallback(errorCallback));
+    database.transaction(queryTransaction, errorCallback);
     return true;
 }
 
-Object.type = function(obj)
+InjectedScript._isDefined = function(object)
+{
+    return object || object instanceof inspectedWindow.HTMLAllCollection;
+}
+
+InjectedScript._type = function(obj)
 {
     if (obj === null)
         return "null";
 
+    // FIXME(33716): typeof document.all is always 'undefined'.
+    if (obj instanceof inspectedWindow.HTMLAllCollection)
+        return "array";
+
     var type = typeof obj;
     if (type !== "object" && type !== "function")
         return type;
@@ -1165,19 +914,10 @@ Object.type = function(obj)
     return type;
 }
 
-Object.hasProperties = function(obj)
+InjectedScript._describe = function(obj, abbreviated)
 {
-    if (typeof obj === "undefined" || typeof obj === "null")
-        return false;
-    for (var name in obj)
-        return true;
-    return false;
-}
-
-Object.describe = function(obj, abbreviated)
-{
-    var type1 = Object.type(obj);
-    var type2 = Object.className(obj);
+    var type1 = InjectedScript._type(obj);
+    var type2 = InjectedScript._className(obj);
 
     switch (type1) {
     case "object":
@@ -1197,47 +937,38 @@ Object.describe = function(obj, abbreviated)
         else if (abbreviated)
             objectText = /.*/.exec(obj)[0].replace(/ +$/g, "");
         return objectText;
-    case "regexp":
-        return String(obj).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
     default:
         return String(obj);
     }
 }
 
-Object.className = function(obj)
+InjectedScript._className = function(obj)
 {
     return Object.prototype.toString.call(obj).replace(/^\[object (.*)\]$/i, "$1")
 }
 
-// Although Function.prototype.bind and String.prototype.escapeCharacters are defined in utilities.js they will soon become
-// unavailable in the InjectedScript context. So we define them here for the local use.
-// TODO: remove this comment once InjectedScript runs in a separate context.
-Function.prototype.bind = function(thisObject)
-{
-    var func = this;
-    var args = Array.prototype.slice.call(arguments, 1);
-    return function() { return func.apply(thisObject, args.concat(Array.prototype.slice.call(arguments, 0))) };
-}
-
-String.prototype.escapeCharacters = function(chars)
+InjectedScript._escapeCharacters = function(str, chars)
 {
     var foundChar = false;
     for (var i = 0; i < chars.length; ++i) {
-        if (this.indexOf(chars.charAt(i)) !== -1) {
+        if (str.indexOf(chars.charAt(i)) !== -1) {
             foundChar = true;
             break;
         }
     }
 
     if (!foundChar)
-        return this;
+        return str;
 
     var result = "";
-    for (var i = 0; i < this.length; ++i) {
-        if (chars.indexOf(this.charAt(i)) !== -1)
+    for (var i = 0; i < str.length; ++i) {
+        if (chars.indexOf(str.charAt(i)) !== -1)
             result += "\\";
-        result += this.charAt(i);
+        result += str.charAt(i);
     }
 
     return result;
 }
+
+return InjectedScript;
+});
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js
index c6d4b65b35..2558267179 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js
@@ -29,11 +29,25 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-var InjectedScriptAccess = {};
+function InjectedScriptAccess(injectedScriptId) {
+    this._injectedScriptId = injectedScriptId;
+}
+
+InjectedScriptAccess.get = function(injectedScriptId)
+{
+    return new InjectedScriptAccess(injectedScriptId);
+}
+
+InjectedScriptAccess.getDefault = function()
+{
+    return InjectedScriptAccess.get(0);
+}
+
+InjectedScriptAccess.prototype = {};
 
 InjectedScriptAccess._installHandler = function(methodName, async)
 {
-    InjectedScriptAccess[methodName] = function()
+    InjectedScriptAccess.prototype[methodName] = function()
     {
         var allArgs = Array.prototype.slice.call(arguments);
         var callback = allArgs[allArgs.length - 1];
@@ -42,16 +56,17 @@ InjectedScriptAccess._installHandler = function(methodName, async)
         function myCallback(result, isException)
         {
             if (!isException)
-                callback(JSON.parse(result));
+                callback(result);
             else
                 WebInspector.console.addMessage(new WebInspector.ConsoleTextMessage("Error dispatching: " + methodName));
         }
         var callId = WebInspector.Callback.wrap(myCallback);
-        InspectorController.dispatchOnInjectedScript(callId, methodName, argsString, !!async);
+
+        InspectorBackend.dispatchOnInjectedScript(callId, this._injectedScriptId, methodName, argsString, !!async);
     };
 }
 
-// InjectedScriptAccess message forwarding puts some constraints on the way methods are imlpemented and called:
+// InjectedScriptAccess message forwarding puts some constraints on the way methods are implemented and called:
 // - Make sure corresponding methods in InjectedScript return non-null and non-undefined values,
 // - Make sure last parameter of all the InjectedSriptAccess.* calls is a callback function.
 // We keep these sorted.
@@ -59,22 +74,27 @@ InjectedScriptAccess._installHandler("addInspectedNode");
 InjectedScriptAccess._installHandler("addStyleSelector");
 InjectedScriptAccess._installHandler("applyStyleRuleText");
 InjectedScriptAccess._installHandler("applyStyleText");
+InjectedScriptAccess._installHandler("clearConsoleMessages");
 InjectedScriptAccess._installHandler("evaluate");
 InjectedScriptAccess._installHandler("evaluateInCallFrame");
 InjectedScriptAccess._installHandler("getCompletions");
 InjectedScriptAccess._installHandler("getComputedStyle");
 InjectedScriptAccess._installHandler("getInlineStyle");
+InjectedScriptAccess._installHandler("getNodePropertyValue");
 InjectedScriptAccess._installHandler("getProperties");
 InjectedScriptAccess._installHandler("getPrototypes");
 InjectedScriptAccess._installHandler("getStyles");
 InjectedScriptAccess._installHandler("openInInspectedWindow");
 InjectedScriptAccess._installHandler("performSearch");
 InjectedScriptAccess._installHandler("pushNodeToFrontend");
+InjectedScriptAccess._installHandler("nodeByPath");
 InjectedScriptAccess._installHandler("searchCanceled");
+InjectedScriptAccess._installHandler("setOuterHTML");
 InjectedScriptAccess._installHandler("setPropertyValue");
 InjectedScriptAccess._installHandler("setStyleProperty");
 InjectedScriptAccess._installHandler("setStyleText");
 InjectedScriptAccess._installHandler("toggleStyleEnabled");
+InjectedScriptAccess._installHandler("evaluateOnSelf");
 
 // Some methods can't run synchronously even on the injected script side (such as DB transactions).
 // Mark them as asynchronous here.
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/InspectorControllerStub.js b/src/3rdparty/webkit/WebCore/inspector/front-end/InspectorBackendStub.js
index f78c9bdae3..cef998ceed 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/InspectorControllerStub.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/InspectorBackendStub.js
@@ -28,42 +28,21 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-if (!window.InspectorController) {
+if (!window.InspectorBackend) {
 
-WebInspector.InspectorControllerStub = function()
+WebInspector.InspectorBackendStub = function()
 {
     this._searchingForNode = false;
-    this._windowVisible = true;
     this._attachedWindowHeight = 0;
-    this._debuggerEnabled = true;
-    this._profilerEnabled = true;
-    this._resourceTrackingEnabled = false;
     this._timelineEnabled = false;
-    this._settings = {};
 }
 
-WebInspector.InspectorControllerStub.prototype = {
+WebInspector.InspectorBackendStub.prototype = {
     wrapCallback: function(func)
     {
         return func;
     },
 
-    isWindowVisible: function()
-    {
-        return this._windowVisible;
-    },
-
-    platform: function()
-    {
-        return "mac-leopard";
-    },
-
-    port: function()
-    {
-        return "unknown";
-    },
-
-
     closeWindow: function()
     {
         this._windowVisible = false;
@@ -107,19 +86,9 @@ WebInspector.InspectorControllerStub.prototype = {
     {
     },
 
-
-    addResourceSourceToFrame: function(identifier, element)
-    {
-    },
-
-    addSourceToFrame: function(mimeType, source, element)
-    {
-        return false;
-    },
-
-    getResourceDocumentNode: function(identifier)
+    getResourceContent: function(callId, identifier)
     {
-        return undefined;
+        WebInspector.didGetResourceContent(callId, "");
     },
 
     highlightDOMNode: function(node)
@@ -154,39 +123,42 @@ WebInspector.InspectorControllerStub.prototype = {
         return "";
     },
 
-    debuggerEnabled: function()
-    {
-        return this._debuggerEnabled;
-    },
-
     enableResourceTracking: function()
     {
-        this._resourceTrackingEnabled = true;
         WebInspector.resourceTrackingWasEnabled();
     },
 
     disableResourceTracking: function()
     {
-        this._resourceTrackingEnabled = false;
         WebInspector.resourceTrackingWasDisabled();
     },
 
-    resourceTrackingEnabled: function()
+
+    enableSearchingForNode: function()
+    {
+        WebInspector.searchingForNodeWasEnabled();
+    },
+
+    disableSearchingForNode: function()
+    {
+        WebInspector.searchingForNodeWasDisabled();
+    },
+
+    reloadPage: function()
     {
-        return this._resourceTrackingEnabled;
     },
 
     enableDebugger: function()
     {
-        this._debuggerEnabled = true;
+        WebInspector.debuggerWasEnabled();
     },
 
     disableDebugger: function()
     {
-        this._debuggerEnabled = false;
+        WebInspector.debuggerWasDisabled();
     },
 
-    addBreakpoint: function(sourceID, line, condition)
+    setBreakpoint: function(sourceID, line, enabled, condition)
     {
     },
 
@@ -194,40 +166,37 @@ WebInspector.InspectorControllerStub.prototype = {
     {
     },
 
-    updateBreakpoint: function(sourceID, line, condition)
+    activateBreakpoints: function()
     {
+        this._breakpointsActivated = true;
     },
 
-    pauseInDebugger: function()
+    deactivateBreakpoints: function()
     {
+        this._breakpointsActivated = false;
     },
 
-    pauseOnExceptions: function()
+    pauseInDebugger: function()
     {
-        return false;
     },
 
-    setPauseOnExceptions: function(value)
+    setPauseOnExceptionsState: function(value)
     {
+        WebInspector.updatePauseOnExceptionsState(value);
     },
 
     resumeDebugger: function()
     {
     },
 
-    profilerEnabled: function()
-    {
-        return true;
-    },
-
     enableProfiler: function()
     {
-        this._profilerEnabled = true;
+        WebInspector.profilerWasEnabled();
     },
 
     disableProfiler: function()
     {
-        this._profilerEnabled = false;
+        WebInspector.profilerWasDisabled();
     },
 
     startProfiling: function()
@@ -272,9 +241,8 @@ WebInspector.InspectorControllerStub.prototype = {
     {
     },
 
-    setSetting: function(setting, value)
+    saveFrontendSettings: function()
     {
-        this._settings[setting] = value;
     },
 
     dispatchOnInjectedScript: function()
@@ -285,12 +253,19 @@ WebInspector.InspectorControllerStub.prototype = {
     {
     },
 
-    setting: function(setting)
+    setInjectedScriptSource: function()
+    {
+    },
+    
+    addScriptToEvaluateOnLoad: function()
+    {
+    },
+
+    removeAllScriptsToEvaluateOnLoad: function()
     {
-        return this._settings[setting];
     }
 }
 
-window.InspectorController = new WebInspector.InspectorControllerStub();
+InspectorBackend = new WebInspector.InspectorBackendStub();
 
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/InspectorFrontendHostStub.js b/src/3rdparty/webkit/WebCore/inspector/front-end/InspectorFrontendHostStub.js
new file mode 100644
index 0000000000..545606928c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/InspectorFrontendHostStub.js
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+if (!window.InspectorFrontendHost) {
+
+WebInspector.InspectorFrontendHostStub = function()
+{
+    this._attachedWindowHeight = 0;
+}
+
+WebInspector._platformFlavor = WebInspector.PlatformFlavor.MacLeopard;
+
+WebInspector.InspectorFrontendHostStub.prototype = {
+    platform: function()
+    {
+        return "mac";
+    },
+
+    port: function()
+    {
+        return "unknown";
+    },
+
+    bringToFront: function()
+    {
+        this._windowVisible = true;
+    },
+
+    closeWindow: function()
+    {
+        this._windowVisible = false;
+    },
+
+    attach: function()
+    {
+    },
+
+    detach: function()
+    {
+    },
+
+    search: function(sourceRow, query)
+    {
+    },
+
+    setAttachedWindowHeight: function(height)
+    {
+    },
+
+    moveWindowBy: function(x, y)
+    {
+    },
+
+    loaded: function()
+    {
+    },
+
+    localizedStringsURL: function()
+    {
+        return undefined;
+    },
+
+    hiddenPanels: function()
+    {
+        return "";
+    },
+
+    inspectedURLChanged: function(url)
+    {
+    },
+
+    copyText: function()
+    {
+    },
+
+    canAttachWindow: function()
+    {
+        return false;
+    }
+}
+
+InspectorFrontendHost = new WebInspector.InspectorFrontendHostStub();
+
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/KeyboardShortcut.js b/src/3rdparty/webkit/WebCore/inspector/front-end/KeyboardShortcut.js
index ed28a48422..b4dda8be83 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/KeyboardShortcut.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/KeyboardShortcut.js
@@ -44,6 +44,8 @@ WebInspector.KeyboardShortcut.Modifiers = {
 };
 
 WebInspector.KeyboardShortcut.KeyCodes = {
+    Backspace: 8,
+    Tab: 9,
     Esc: 27,
     Space: 32,
     PageUp: 33,      // also NUM_NORTH_EAST
@@ -54,6 +56,8 @@ WebInspector.KeyboardShortcut.KeyCodes = {
     Up: 38,          // also NUM_NORTH
     Right: 39,       // also NUM_EAST
     Down: 40,        // also NUM_SOUTH
+    Delete: 46,
+    Zero: 48,
     F1: 112,
     F2: 113,
     F3: 114,
@@ -67,21 +71,25 @@ WebInspector.KeyboardShortcut.KeyCodes = {
     F11: 122,
     F12: 123,
     Semicolon: 186,    // ;
+    Plus: 187,         // +
     Comma: 188,        // ,
+    Minus: 189,        // -
     Period: 190,       // .
     Slash: 191,        // /
     Apostrophe: 192,   // `
-    SingleQuote: 222,  // '
+    SingleQuote: 222   // '
 };
 
 /**
  * Creates a number encoding keyCode in the lower 8 bits and modifiers mask in the higher 8 bits.
- * It is usefull for matching pressed keys.
- * @param {number} keyCode Code of the key.
- * @param {number} optModifiers Optional list of modifiers passed as additional paramerters.
+ * It is useful for matching pressed keys.
+ * keyCode is the Code of the key, or a character "a-z" which is converted to a keyCode value.
+ * optModifiers is an Optional list of modifiers passed as additional paramerters.
  */
 WebInspector.KeyboardShortcut.makeKey = function(keyCode, optModifiers)
 {
+    if (typeof keyCode === "string")
+        keyCode = keyCode.charCodeAt(0) - 32;
     var modifiers = WebInspector.KeyboardShortcut.Modifiers.None;
     for (var i = 1; i < arguments.length; i++)
         modifiers |= arguments[i];
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/MetricsSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/MetricsSidebarPane.js
index a33653b611..ed5a7ec5ed 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/MetricsSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/MetricsSidebarPane.js
@@ -35,39 +35,34 @@ WebInspector.MetricsSidebarPane = function()
 WebInspector.MetricsSidebarPane.prototype = {
     update: function(node)
     {
-        var body = this.bodyElement;
-
-        body.removeChildren();
-
         if (node)
             this.node = node;
         else
             node = this.node;
 
-        if (!node || !node.ownerDocument.defaultView)
-            return;
-
-        if (node.nodeType !== Node.ELEMENT_NODE)
+        if (!node || !node.ownerDocument.defaultView || node.nodeType !== Node.ELEMENT_NODE) {
+            this.bodyElement.removeChildren();
             return;
+        }
 
         var self = this;
         var callback = function(stylePayload) {
             if (!stylePayload)
                 return;
             var style = WebInspector.CSSStyleDeclaration.parseStyle(stylePayload);
-            self._update(node, body, style);
+            self._update(style);
         };
-        InjectedScriptAccess.getComputedStyle(node.id, callback);
+        InspectorBackend.getComputedStyle(WebInspector.Callback.wrap(callback), node.id);
 
         var inlineStyleCallback = function(stylePayload) {
             if (!stylePayload)
                 return;
             self._inlineStyleId = stylePayload.id;
         };
-        InjectedScriptAccess.getInlineStyle(node.id, inlineStyleCallback);
+        InspectorBackend.getInlineStyle(WebInspector.Callback.wrap(inlineStyleCallback), node.id);
     },
 
-    _update: function(node, body, style)
+    _update: function(style)
     {
         var metricsElement = document.createElement("div");
         metricsElement.className = "metrics";
@@ -169,7 +164,8 @@ WebInspector.MetricsSidebarPane.prototype = {
         }
 
         metricsElement.appendChild(previousBox);
-        body.appendChild(metricsElement);
+        this.bodyElement.removeChildren();
+        this.bodyElement.appendChild(metricsElement);
     },
 
     startEditing: function(targetElement, box, styleProperty)
@@ -189,6 +185,11 @@ WebInspector.MetricsSidebarPane.prototype = {
 
     editingCommitted: function(element, userInput, previousContent, context)
     {
+        if (!this._inlineStyleId) {
+            // Element has no renderer.
+            return this.editingCancelled(element, context); // nothing changed, so cancel
+        }
+
         if (userInput === previousContent)
             return this.editingCancelled(element, context); // nothing changed, so cancel
 
@@ -208,7 +209,8 @@ WebInspector.MetricsSidebarPane.prototype = {
             self.dispatchEventToListeners("metrics edited");
             self.update();
         };
-        InjectedScriptAccess.setStyleProperty(this._inlineStyleId, context.styleProperty, userInput, callback);
+
+        InspectorBackend.setStyleProperty(WebInspector.Callback.wrap(callback), this._inlineStyleId, context.styleProperty, userInput);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectPropertiesSection.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectPropertiesSection.js
index 8bb4e35d12..a32e7997fd 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -50,7 +50,7 @@ WebInspector.ObjectPropertiesSection.prototype = {
                 return;
             self.updateProperties(properties);
         };
-        InjectedScriptAccess.getProperties(this.object, this.ignoreHasOwnProperty, callback);
+        InjectedScriptAccess.get(this.object.injectedScriptId).getProperties(this.object, this.ignoreHasOwnProperty, true, callback);
     },
 
     updateProperties: function(properties, rootTreeElementConstructor, rootPropertyComparer)
@@ -77,6 +77,7 @@ WebInspector.ObjectPropertiesSection.prototype = {
             var infoElement = new TreeElement(title, null, false);
             this.propertiesTreeOutline.appendChild(infoElement);
         }
+        this.propertiesForTest = properties;
     }
 }
 
@@ -86,6 +87,10 @@ WebInspector.ObjectPropertiesSection.CompareProperties = function(propertyA, pro
 {
     var a = propertyA.name;
     var b = propertyB.name;
+    if (a === "__proto__")
+        return 1;
+    if (b === "__proto__")
+        return -1;
 
     // if used elsewhere make sure to
     //  - convert a and b to strings (not needed here, properties are all strings)
@@ -147,10 +152,10 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
                 this.appendChild(new this.treeOutline.section.treeElementConstructor(properties[i]));
             }
         };
-        InjectedScriptAccess.getProperties(this.property.value, false, callback.bind(this));
+        InjectedScriptAccess.get(this.property.value.injectedScriptId).getProperties(this.property.value, false, true, callback.bind(this));
     },
 
-    ondblclick: function(element, event)
+    ondblclick: function(event)
     {
         this.startEditing();
     },
@@ -173,8 +178,12 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
         this.valueElement = document.createElement("span");
         this.valueElement.className = "value";
         this.valueElement.textContent = this.property.value.description;
+        if (typeof this.property.value.propertyLength !== "undefined")
+            this.valueElement.textContent += " (" + this.property.value.propertyLength + ")";
         if (this.property.isGetter)
-           this.valueElement.addStyleClass("dimmed");
+            this.valueElement.addStyleClass("dimmed");
+        if (this.property.isError)
+            this.valueElement.addStyleClass("error");
 
         this.listItemElement.removeChildren();
 
@@ -233,7 +242,7 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
 
     applyExpression: function(expression, updateInterface)
     {
-        expression = expression.trimWhitespace();
+        expression = expression.trim();
         var expressionLength = expression.length;
         var self = this;
         var callback = function(success) {
@@ -251,7 +260,7 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
                 self.updateSiblings();
             }
         };
-        InjectedScriptAccess.setPropertyValue(this.property.parentObjectProxy, this.property.name, expression.trimWhitespace(), callback);
+        InjectedScriptAccess.get(this.property.parentObjectProxy.injectedScriptId).setPropertyValue(this.property.parentObjectProxy, this.property.name, expression.trim(), callback);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectProxy.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectProxy.js
index bb4afa5918..ef139c6a72 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectProxy.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectProxy.js
@@ -28,11 +28,11 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.ObjectProxy = function(objectId, path, protoDepth, description, hasChildren)
+WebInspector.ObjectProxy = function(injectedScriptId, objectId, path, description, hasChildren)
 {
     this.objectId = objectId;
+    this.injectedScriptId = injectedScriptId;
     this.path = path || [];
-    this.protoDepth = protoDepth || 0;
     this.description = description;
     this.hasChildren = hasChildren;
 }
@@ -45,6 +45,24 @@ WebInspector.ObjectProxy.wrapPrimitiveValue = function(value)
     return proxy;
 }
 
+WebInspector.ObjectProxy.getPropertiesAsync = function(objectProxy, propertiesToQueryFor, callback)
+{
+    function createPropertiesMapThenCallback(propertiesPayload)
+    {
+        if (!propertiesPayload) {
+            callback();
+            return;
+        }
+
+        var result = [];
+        for (var i = 0; i < propertiesPayload.length; ++i)
+            if (propertiesToQueryFor.indexOf(propertiesPayload[i].name) !== -1)
+                result[propertiesPayload[i].name] = propertiesPayload[i].value.description;
+        callback(result);
+    };
+    InjectedScriptAccess.get(objectProxy.injectedScriptId).getProperties(objectProxy, true, false, createPropertiesMapThenCallback);
+}
+
 WebInspector.ObjectPropertyProxy = function(name, value)
 {
     this.name = name;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Panel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Panel.js
index 6cd200b4ff..b916708f82 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Panel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Panel.js
@@ -81,7 +81,7 @@ WebInspector.Panel.prototype = {
         if ("_toolbarItem" in this)
             this._toolbarItem.addStyleClass("toggled-on");
 
-        WebInspector.currentFocusElement = document.getElementById("main-panels");
+        WebInspector.currentFocusElement = this.defaultFocusedElement;
 
         this.updateSidebarWidth();
     },
@@ -97,6 +97,11 @@ WebInspector.Panel.prototype = {
             this._toolbarItem.removeStyleClass("toggled-on");
     },
 
+    get defaultFocusedElement()
+    {
+        return this.sidebarTreeElement || this.element;
+    },
+
     attach: function()
     {
         if (!this.element.parentNode)
@@ -225,14 +230,18 @@ WebInspector.Panel.prototype = {
         var currentView = this._searchResults[this._currentSearchResultIndex];
 
         if (currentView.showingLastSearchResult()) {
-            if (++this._currentSearchResultIndex >= this._searchResults.length)
-                this._currentSearchResultIndex = 0;
-            currentView = this._searchResults[this._currentSearchResultIndex];
+            if (this.searchIteratesOverViews()) {
+                if (++this._currentSearchResultIndex >= this._searchResults.length)
+                    this._currentSearchResultIndex = 0;
+                currentView = this._searchResults[this._currentSearchResultIndex];
+            }
             showFirstResult = true;
         }
 
-        if (currentView !== this.visibleView)
+        if (currentView !== this.visibleView) {
             this.showView(currentView);
+            WebInspector.focusSearchField();
+        }
 
         if (showFirstResult)
             currentView.jumpToFirstSearchResult();
@@ -256,14 +265,18 @@ WebInspector.Panel.prototype = {
         var currentView = this._searchResults[this._currentSearchResultIndex];
 
         if (currentView.showingFirstSearchResult()) {
-            if (--this._currentSearchResultIndex < 0)
-                this._currentSearchResultIndex = (this._searchResults.length - 1);
-            currentView = this._searchResults[this._currentSearchResultIndex];
+            if (this.searchIteratesOverViews()) {
+                if (--this._currentSearchResultIndex < 0)
+                    this._currentSearchResultIndex = (this._searchResults.length - 1);
+                currentView = this._searchResults[this._currentSearchResultIndex];
+            }
             showLastResult = true;
         }
 
-        if (currentView !== this.visibleView)
+        if (currentView !== this.visibleView) {
             this.showView(currentView);
+            WebInspector.focusSearchField();
+        }
 
         if (showLastResult)
             currentView.jumpToLastSearchResult();
@@ -271,17 +284,6 @@ WebInspector.Panel.prototype = {
             currentView.jumpToPreviousSearchResult();
     },
 
-    handleKeyEvent: function(event)
-    {
-        this.handleSidebarKeyEvent(event);
-    },
-
-    handleSidebarKeyEvent: function(event)
-    {
-        if (this.hasSidebar && this.sidebarTree)
-            this.sidebarTree.handleKeyEvent(event);
-    },
-
     createSidebar: function(parentElement, resizerParentElement)
     {
         if (this.hasSidebar)
@@ -351,10 +353,6 @@ WebInspector.Panel.prototype = {
         this.setSidebarWidth(width);
 
         this.updateMainViewWidth(width);
-
-        var visibleView = this.visibleView;
-        if (visibleView && "resize" in visibleView)
-            visibleView.resize();
     },
 
     setSidebarWidth: function(width)
@@ -366,6 +364,28 @@ WebInspector.Panel.prototype = {
     updateMainViewWidth: function(width)
     {
         // Should be implemented by ancestors.
+    },
+
+    resize: function()
+    {
+        var visibleView = this.visibleView;
+        if (visibleView && "resize" in visibleView)
+            visibleView.resize();
+    },
+
+    canShowSourceLine: function(url, line)
+    {
+        return false;
+    },
+
+    showSourceLine: function(url, line)
+    {
+        return false;
+    },
+
+    searchIteratesOverViews: function()
+    {
+        return false;
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/PanelEnablerView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/PanelEnablerView.js
index fab6d769a3..5c2660438d 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/PanelEnablerView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/PanelEnablerView.js
@@ -71,8 +71,6 @@ WebInspector.PanelEnablerView = function(identifier, headingText, disclaimerText
     this.enableButton.textContent = buttonTitle;
     this.enableButton.addEventListener("click", this._enableButtonCicked.bind(this), false);
     this.choicesForm.appendChild(this.enableButton);
-
-    window.addEventListener("resize", this._windowResized.bind(this), true);
 }
 
 WebInspector.PanelEnablerView.prototype = {
@@ -81,7 +79,14 @@ WebInspector.PanelEnablerView.prototype = {
         this.dispatchEventToListeners("enable clicked");
     },
 
-    _windowResized: function()
+    show: function(parentElement)
+    {
+        WebInspector.View.prototype.show.call(this, parentElement);
+
+        setTimeout(this.resize.bind(this), 0);
+    },
+
+    resize: function()
     {
         this.imageElement.removeStyleClass("hidden");
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Popover.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Popover.js
new file mode 100644
index 0000000000..464416dd7f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Popover.js
@@ -0,0 +1,238 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.Popover = function(contentElement)
+{
+    this.element = document.createElement("div");
+    this.element.className = "popover";
+
+    this._popupArrowElement = document.createElement("div");
+    this._popupArrowElement.className = "arrow";
+    this.element.appendChild(this._popupArrowElement);
+
+    this.contentElement = contentElement;
+    this._contentDiv = document.createElement("div");
+    this._contentDiv.className = "content";
+}
+
+WebInspector.Popover.prototype = {
+    show: function(anchor, preferredWidth, preferredHeight)
+    {
+        // This should not happen, but we hide previous popup to be on the safe side.
+        if (WebInspector.Popover._popoverElement)
+            document.body.removeChild(WebInspector.Popover._popoverElement);
+        WebInspector.Popover._popoverElement = this.element;
+
+        // Temporarily attach in order to measure preferred dimensions.
+        this.contentElement.positionAt(0, 0);
+        document.body.appendChild(this.contentElement);
+        var preferredWidth = preferredWidth || this.contentElement.offsetWidth;
+        var preferredHeight = preferredHeight || this.contentElement.offsetHeight;
+
+        this._contentDiv.appendChild(this.contentElement);
+        this.element.appendChild(this._contentDiv);
+        document.body.appendChild(this.element);
+        this._positionElement(anchor, preferredWidth, preferredHeight);
+    },
+
+    hide: function()
+    {
+        if (WebInspector.Popover._popoverElement) {
+            delete WebInspector.Popover._popoverElement;
+            document.body.removeChild(this.element);
+        }
+    },
+
+    _positionElement: function(anchorElement, preferredWidth, preferredHeight)
+    {
+        const borderWidth = 25;
+        const scrollerWidth = 11;
+        const arrowHeight = 15;
+        const arrowOffset = 10;
+        const borderRadius = 10;
+
+        // Skinny tooltips are not pretty, their arrow location is not nice.
+        preferredWidth = Math.max(preferredWidth, 50);
+        const totalWidth = window.innerWidth;
+        const totalHeight = window.innerHeight;
+
+        var anchorBox = {x: anchorElement.totalOffsetLeft, y: anchorElement.totalOffsetTop, width: anchorElement.offsetWidth, height: anchorElement.offsetHeight};
+        while (anchorElement !== document.body) {
+            if (anchorElement.scrollLeft)
+                anchorBox.x -= anchorElement.scrollLeft;
+            if (anchorElement.scrollTop)
+                anchorBox.y -= anchorElement.scrollTop;
+            anchorElement = anchorElement.parentElement;
+        }
+
+        var newElementPosition = { x: 0, y: 0, width: preferredWidth + scrollerWidth, height: preferredHeight };
+
+        var verticalAlignment;
+        var roomAbove = anchorBox.y;
+        var roomBelow = totalHeight - anchorBox.y - anchorBox.height;
+
+        if (roomAbove > roomBelow) {
+            // Positioning above the anchor.
+            if (anchorBox.y > newElementPosition.height + arrowHeight + borderRadius)
+                newElementPosition.y = anchorBox.y - newElementPosition.height - arrowHeight;
+            else {
+                newElementPosition.y = borderRadius * 2;
+                newElementPosition.height = anchorBox.y - borderRadius * 2 - arrowHeight;
+            }
+            verticalAlignment = "bottom";
+        } else {
+            // Positioning below the anchor.
+            newElementPosition.y = anchorBox.y + anchorBox.height + arrowHeight;
+            if (newElementPosition.y + newElementPosition.height + arrowHeight - borderWidth >= totalHeight)
+                newElementPosition.height = totalHeight - anchorBox.y - anchorBox.height - borderRadius * 2 - arrowHeight;
+            // Align arrow.
+            verticalAlignment = "top";
+        }
+
+        var horizontalAlignment;
+        if (anchorBox.x + newElementPosition.width < totalWidth) {
+            newElementPosition.x = Math.max(borderRadius, anchorBox.x - borderRadius - arrowOffset);
+            horizontalAlignment = "left";
+        } else if (newElementPosition.width + borderRadius * 2 < totalWidth) {
+            newElementPosition.x = totalWidth - newElementPosition.width - borderRadius;
+            horizontalAlignment = "right";
+            // Position arrow accurately.
+            var arrowRightPosition = Math.max(0, totalWidth - anchorBox.x - anchorBox.width - borderRadius - arrowOffset);
+            arrowRightPosition += anchorBox.width / 2;
+            this._popupArrowElement.style.right = arrowRightPosition + "px";
+        } else {
+            newElementPosition.x = borderRadius;
+            newElementPosition.width = totalWidth - borderRadius * 2;
+            newElementPosition.height += scrollerWidth;
+            horizontalAlignment = "left";
+            if (verticalAlignment === "bottom")
+                newElementPosition.y -= scrollerWidth;
+            // Position arrow accurately.
+            this._popupArrowElement.style.left = Math.max(0, anchorBox.x - borderRadius * 2 - arrowOffset) + "px";
+            this._popupArrowElement.style.left += anchorBox.width / 2;
+        }
+
+        this.element.className = "popover " + verticalAlignment + "-" + horizontalAlignment + "-arrow";
+        this.element.positionAt(newElementPosition.x - borderWidth, newElementPosition.y - borderWidth);
+        this.element.style.width = newElementPosition.width + borderWidth * 2 + "px";
+        this.element.style.height = newElementPosition.height + borderWidth * 2 + "px";
+    }
+}
+
+WebInspector.PopoverHelper = function(panelElement, getAnchor, showPopup, showOnClick, onHide)
+{
+    this._panelElement = panelElement;
+    this._getAnchor = getAnchor;
+    this._showPopup = showPopup;
+    this._showOnClick = showOnClick;
+    this._onHide = onHide;
+    panelElement.addEventListener("mousedown", this._mouseDown.bind(this), false);
+    panelElement.addEventListener("mousemove", this._mouseMove.bind(this), false);
+}
+
+WebInspector.PopoverHelper.prototype = {
+    _mouseDown: function(event)
+    {
+        this._killHidePopupTimer();
+        this._handleMouseAction(event, true);
+    },
+
+    _mouseMove: function(event)
+    {
+        // Pretend that nothing has happened.
+        if (this._hoverElement === event.target || (this._hoverElement && this._hoverElement.isAncestor(event.target)))
+            return;
+
+        // User has 500ms to reach the popup.
+        if (this._popup && !this._hidePopupTimer) {
+            var self = this;
+            function doHide()
+            {
+                self.hidePopup();
+                delete self._hidePopupTimer;
+            }
+            this._hidePopupTimer = setTimeout(doHide, 500);
+        }
+
+        this._handleMouseAction(event);
+    },
+
+    _handleMouseAction: function(event, isMouseDown)
+    {
+        this._resetHoverTimer();
+
+        this._hoverElement = this._getAnchor(event.target);
+        if (!this._hoverElement)
+            return;
+
+        const toolTipDelay = isMouseDown ? 0 : (this._popup ? 600 : 1000);
+        this._hoverTimer = setTimeout(this._mouseHover.bind(this, this._hoverElement), toolTipDelay);
+    },
+
+    _resetHoverTimer: function()
+    {
+        if (this._hoverTimer) {
+            clearTimeout(this._hoverTimer);
+            delete this._hoverTimer;
+        }
+    },
+
+    hidePopup: function()
+    {
+        if (!this._popup)
+            return;
+
+        if (this._onHide)
+            this._onHide();
+
+        this._popup.hide();
+        delete this._popup;
+    },
+
+    _mouseHover: function(element)
+    {
+        delete this._hoverTimer;
+
+        this._popup = this._showPopup(element);
+        this._popup.contentElement.addEventListener("mousemove", this._killHidePopupTimer.bind(this), true);
+    },
+
+    _killHidePopupTimer: function()
+    {
+        if (this._hidePopupTimer) {
+            clearTimeout(this._hidePopupTimer);
+            delete this._hidePopupTimer;
+
+            // We know that we reached the popup, but we might have moved over other elements.
+            // Discard pending command.
+            this._resetHoverTimer();
+        }
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Popup.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Popup.js
deleted file mode 100644
index 9c8ef24581..0000000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Popup.js
+++ /dev/null
@@ -1,168 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * This class provides a popup that can be shown relative to an anchor element
- * or at an arbitrary absolute position.
- * Points are Objects: {x: xValue, y: yValue}.
- * Rectangles are Objects: {x: xValue, y: yValue, width: widthValue, height: heightValue}.
- *
- * element is an optional unparented visible element (style.display != "none" AND style.visibility != "hidden").
- * If the element is absent/undefined, it must have been set with the element(x) setter before the show() method invocation.
- */
-WebInspector.Popup = function(element)
-{
-    if (element)
-        this.element = element;
-    this._keyHandler = this._keyEventHandler.bind(this);
-    this._mouseDownHandler = this._mouseDownEventHandler.bind(this);
-    this._visible = false;
-    this._autoHide = true;
-}
-
-WebInspector.Popup.prototype = {
-    show: function()
-    {
-        if (this.visible)
-            return;
-        var ownerDocument = this._contentElement.ownerDocument;
-        if (!ownerDocument)
-            return;
-
-        this._glasspaneElement = ownerDocument.createElement("div");
-        this._glasspaneElement.className = "popup-glasspane";
-        ownerDocument.body.appendChild(this._glasspaneElement);
-
-        this._contentElement.positionAt(0, 0);
-        this._contentElement.removeStyleClass("hidden");
-        ownerDocument.body.appendChild(this._contentElement);
-
-        this.positionElement();
-        this._visible = true;
-        ownerDocument.addEventListener("keydown", this._keyHandler, false);
-        ownerDocument.addEventListener("mousedown", this._mouseDownHandler, false);
-    },
-
-    hide: function()
-    {
-        if (this.visible) {
-            this._visible = false;
-            this._contentElement.ownerDocument.removeEventListener("keydown", this._keyHandler, false);
-            this._contentElement.ownerDocument.removeEventListener("mousedown", this._mouseDownHandler, false);
-            this._glasspaneElement.parentElement.removeChild(this._glasspaneElement);
-            this._contentElement.parentElement.removeChild(this._contentElement);
-        }
-    },
-
-    get visible()
-    {
-        return this._visible;
-    },
-
-    set element(x)
-    {
-        this._checkNotVisible();
-        this._contentElement = x;
-        this._contentElement.addStyleClass("hidden");
-    },
-
-    get element()
-    {
-        return this._contentElement;
-    },
-
-    positionElement: function()
-    {
-        var element = this._contentElement;
-        var anchorElement = this._anchorElement;
-
-        var targetDocument = element.ownerDocument;
-        var targetDocumentBody = targetDocument.body;
-        var targetDocumentElement = targetDocument.documentElement;
-        var clippingBox = {x: 0, y: 0, width: targetDocumentElement.clientWidth, height: targetDocumentElement.clientHeight};
-        var parentElement = element.offsetParent || element.parentElement;
-
-        var anchorPosition = {x: anchorElement.totalOffsetLeft, y: anchorElement.totalOffsetTop};
-
-        // FIXME(apavlov@chromium.org): Translate anchorPosition to the element.ownerDocument frame when https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed.
-        var anchorBox = {x: anchorPosition.x, y: anchorPosition.y, width: anchorElement.offsetWidth, height: anchorElement.offsetHeight};
-        var elementBox = {x: element.totalOffsetLeft, y: element.totalOffsetTop, width: element.offsetWidth, height: element.offsetHeight};
-        var newElementPosition = {x: 0, y: 0};
-
-        if (anchorBox.y - elementBox.height >= clippingBox.y)
-            newElementPosition.y = anchorBox.y - elementBox.height;
-        else
-            newElementPosition.y = Math.min(anchorBox.y + anchorBox.height, Math.max(clippingBox.y, clippingBox.y + clippingBox.height - elementBox.height));
-
-        if (anchorBox.x + elementBox.height <= clippingBox.x + clippingBox.height)
-            newElementPosition.x = anchorBox.x;
-        else
-            newElementPosition.x = Math.max(clippingBox.x, clippingBox.x + clippingBox.height - elementBox.height);
-        element.positionAt(newElementPosition.x, newElementPosition.y);
-    },
-
-    set anchor(x)
-    {
-        this._checkNotVisible();
-        this._anchorElement = x;
-    },
-
-    get anchor()
-    {
-        return this._anchorElement;
-    },
-
-    set autoHide(x)
-    {
-        this._autoHide = x;
-    },
-
-    _checkNotVisible: function()
-    {
-        if (this.visible)
-            throw new Error("The popup must not be visible.");
-    },
-
-    _keyEventHandler: function(event)
-    {
-        // Escape hides the popup.
-        if (event.keyIdentifier == "U+001B") {
-            this.hide();
-            event.preventDefault();
-            event.handled = true;
-        }
-    },
-
-    _mouseDownEventHandler: function(event)
-    {
-        if (this._autoHide && event.originalTarget === this._glasspaneElement)
-            this.hide();
-    }
-}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
index 9a7c7412a4..db156bfbaf 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
@@ -102,6 +102,7 @@ WebInspector.ProfileDataGridNode.prototype = {
             urlElement.className = "profile-node-file webkit-html-resource-link";
             urlElement.href = this.profileNode.url;
             urlElement.lineNumber = this.profileNode.lineNumber;
+            urlElement.preferredPanel = "scripts";
 
             if (this.profileNode.lineNumber > 0)
                 urlElement.textContent = fileName + ":" + this.profileNode.lineNumber;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
index afced41f82..1efa0dce18 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
@@ -83,7 +83,7 @@ WebInspector.CPUProfileView = function(profile)
     var self = this;
     function profileCallback(profile)
     {
-        self.profile.representedObject = profile;
+        self.profile = profile;
         self._assignParentsInProfile();
       
         self.profileDataGridTree = self.bottomUpProfileDataGridTree;
@@ -95,7 +95,7 @@ WebInspector.CPUProfileView = function(profile)
     }
 
     var callId = WebInspector.Callback.wrap(profileCallback);
-    InspectorController.getProfile(callId, this.profile.uid);
+    InspectorBackend.getProfile(callId, this.profile.uid);
 }
 
 WebInspector.CPUProfileView.prototype = {
@@ -233,7 +233,7 @@ WebInspector.CPUProfileView.prototype = {
         // Call searchCanceled since it will reset everything we need before doing a new search.
         this.searchCanceled();
 
-        query = query.trimWhitespace();
+        query = query.trim();
 
         if (!query.length)
             return;
@@ -505,7 +505,7 @@ WebInspector.CPUProfileView.prototype = {
 
     _sortData: function(event)
     {
-        this._sortProfile(this.profile.representedObject);
+        this._sortProfile(this.profile);
     },
 
     _sortProfile: function()
@@ -594,9 +594,14 @@ WebInspector.CPUProfileType.prototype = {
         this._recording = !this._recording;
 
         if (this._recording)
-            InspectorController.startProfiling();
+            InspectorBackend.startProfiling();
         else
-            InspectorController.stopProfiling();
+            InspectorBackend.stopProfiling();
+    },
+
+    get welcomeMessage()
+    {
+        return WebInspector.UIString("Start CPU profiling by pressing<br>the %s button on the status bar.");
     },
 
     setRecordingProfile: function(isProfiling)
@@ -616,26 +621,3 @@ WebInspector.CPUProfileType.prototype = {
 }
 
 WebInspector.CPUProfileType.prototype.__proto__ = WebInspector.ProfileType.prototype;
-
-WebInspector.CPUProfile = function(profile)
-{
-    this.representedObject = profile;
-    this.typeId = WebInspector.CPUProfileType.TypeId;
-}
-
-WebInspector.CPUProfile.prototype = {
-    get title()
-    {
-        return this.representedObject.title;
-    },
-
-    get uid()
-    {
-        return this.representedObject.uid;
-    },
-
-    get head()
-    {
-        return this.representedObject.head;
-    }
-}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
index 74c2bb6fa8..ca0b8d93ef 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
@@ -70,6 +70,11 @@ WebInspector.ProfileType.prototype = {
         return profile._profileView;
     },
 
+    get welcomeMessage()
+    {
+        return "";
+    },
+
     // Must be implemented by subclasses.
     createView: function(profile)
     {
@@ -111,7 +116,11 @@ WebInspector.ProfilesPanel = function()
     this.profileViewStatusBarItemsContainer = document.createElement("div");
     this.profileViewStatusBarItemsContainer.id = "profile-view-status-bar-items";
 
+    this.welcomeView = new WebInspector.WelcomeView("profiles", WebInspector.UIString("Welcome to the Profiles panel"));
+    this.element.appendChild(this.welcomeView.element);
+
     this._profiles = [];
+    this._profilerEnabled = Preferences.profilerAlwaysEnabled;
     this.reset();
 }
 
@@ -163,12 +172,20 @@ WebInspector.ProfilesPanel.prototype = {
 
     profilerWasEnabled: function()
     {
+        if (this._profilerEnabled)
+            return;
+
+        this._profilerEnabled = true;
         this.reset();
         this.populateInterface();
     },
 
     profilerWasDisabled: function()
     {
+        if (!this._profilerEnabled)
+            return;
+
+        this._profilerEnabled = false;
         this.reset();
     },
 
@@ -176,6 +193,7 @@ WebInspector.ProfilesPanel.prototype = {
     {
         for (var i = 0; i < this._profiles.length; ++i)
             delete this._profiles[i]._profileView;
+        delete this.visibleView;
 
         delete this.currentQuery;
         this.searchCanceled();
@@ -195,6 +213,7 @@ WebInspector.ProfilesPanel.prototype = {
         this.profileViewStatusBarItemsContainer.removeChildren();
 
         this._updateInterface();
+        this.welcomeView.show();
     },
 
     registerProfileType: function(profileType)
@@ -203,6 +222,32 @@ WebInspector.ProfilesPanel.prototype = {
         profileType.treeElement = new WebInspector.SidebarSectionTreeElement(profileType.name, null, true);
         this.sidebarTree.appendChild(profileType.treeElement);
         profileType.treeElement.expand();
+        this._addWelcomeMessage(profileType);
+    },
+
+    _addWelcomeMessage: function(profileType)
+    {
+        var message = profileType.welcomeMessage;
+        // Message text is supposed to have a '%s' substring as a placeholder
+        // for a status bar button. If it is there, we split the message in two
+        // parts, and insert the button between them.
+        var buttonPos = message.indexOf("%s");
+        if (buttonPos > -1) {
+            var container = document.createDocumentFragment();
+            var part1 = document.createElement("span");
+            part1.innerHTML = message.substr(0, buttonPos);
+            container.appendChild(part1);
+     
+            var button = new WebInspector.StatusBarButton(profileType.buttonTooltip, profileType.buttonStyle, profileType.buttonCaption);
+            button.element.addEventListener("click", profileType.buttonClicked.bind(profileType), false);
+            container.appendChild(button.element);
+       
+            var part2 = document.createElement("span");
+            part2.innerHTML = message.substr(buttonPos + 2);
+            container.appendChild(part2);
+            this.welcomeView.addMessage(container);
+        } else
+            this.welcomeView.addMessage(message);
     },
 
     _makeKey: function(text, profileTypeId)
@@ -210,8 +255,9 @@ WebInspector.ProfilesPanel.prototype = {
         return escape(text) + '/' + escape(profileTypeId);
     },
 
-    addProfileHeader: function(typeId, profile)
+    addProfileHeader: function(profile)
     {
+        var typeId = profile.typeId;
         var profileType = this.getProfileType(typeId);
         var sidebarParent = profileType.treeElement;
         var small = false;
@@ -266,6 +312,7 @@ WebInspector.ProfilesPanel.prototype = {
         profile._profilesTreeElement = profileTreeElement;
 
         sidebarParent.appendChild(profileTreeElement);
+        this.welcomeView.hide();
         if (!this.visibleView)
             this.showProfile(profile);
     },
@@ -275,8 +322,7 @@ WebInspector.ProfilesPanel.prototype = {
         if (!profile)
             return;
 
-        if (this.visibleView)
-            this.visibleView.hide();
+        this.closeVisibleView();
 
         var view = profile.__profilesPanelProfileType.viewForProfile(profile);
 
@@ -361,7 +407,8 @@ WebInspector.ProfilesPanel.prototype = {
 
         var profilesLength = this._profiles.length;
         for (var i = 0; i < profilesLength; ++i) {
-            var view = this._profiles[i].viewForProfile();
+            var profile = this._profiles[i];
+            var view = profile.__profilesPanelProfileType.viewForProfile(profile);
             if (!view.performSearch || view === visibleView)
                 continue;
             views.push(view);
@@ -388,17 +435,10 @@ WebInspector.ProfilesPanel.prototype = {
         }
     },
 
-    resize: function()
-    {
-        var visibleView = this.visibleView;
-        if (visibleView && "resize" in visibleView)
-            visibleView.resize();
-    },
-
     _updateInterface: function()
     {
         // FIXME: Replace ProfileType-specific button visibility changes by a single ProfileType-agnostic "combo-button" visibility change.
-        if (InspectorController.profilerEnabled()) {
+        if (this._profilerEnabled) {
             this.enableToggleButton.title = WebInspector.UIString("Profiling enabled. Click to disable.");
             this.enableToggleButton.toggled = true;
             for (var typeId in this._profileTypeButtonsByIdMap)
@@ -417,26 +457,27 @@ WebInspector.ProfilesPanel.prototype = {
 
     _enableProfiling: function()
     {
-        if (InspectorController.profilerEnabled())
+        if (this._profilerEnabled)
             return;
         this._toggleProfiling(this.panelEnablerView.alwaysEnabled);
     },
 
     _toggleProfiling: function(optionalAlways)
     {
-        if (InspectorController.profilerEnabled())
-            InspectorController.disableProfiler(true);
+        if (this._profilerEnabled)
+            InspectorBackend.disableProfiler(true);
         else
-            InspectorController.enableProfiler(!!optionalAlways);
+            InspectorBackend.enableProfiler(!!optionalAlways);
     },
 
     _populateProfiles: function()
     {
-        // FIXME: This code needs to be adjusted when more profiling types are added.
-        // Currently defaults to CPU profiles.
-        var cpuProfiles = this.getProfileType(WebInspector.CPUProfileType.TypeId).treeElement;
-        if (cpuProfiles.children.length)
-            return;
+        var sidebarTreeChildrenCount = this.sidebarTree.children.length;
+        for (var i = 0; i < sidebarTreeChildrenCount; ++i) {
+            var treeElement = this.sidebarTree.children[i];
+            if (treeElement.children.length)
+                return;
+        }
 
         function populateCallback(profileHeaders) {
             profileHeaders.sort(function(a, b) { return a.uid - b.uid; });
@@ -446,15 +487,17 @@ WebInspector.ProfilesPanel.prototype = {
         }
 
         var callId = WebInspector.Callback.wrap(populateCallback);
-        InspectorController.getProfileHeaders(callId);
+        InspectorBackend.getProfileHeaders(callId);
 
         delete this._shouldPopulateProfiles;
     },
 
     updateMainViewWidth: function(width)
     {
+        this.welcomeView.element.style.left = width + "px";
         this.profileViews.style.left = width + "px";
         this.profileViewStatusBarItemsContainer.style.left = width + "px";
+        this.resize();
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/PropertiesSection.js b/src/3rdparty/webkit/WebCore/inspector/front-end/PropertiesSection.js
index a4b2fba734..5ced9ef2c1 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/PropertiesSection.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/PropertiesSection.js
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,118 +29,15 @@
 
 WebInspector.PropertiesSection = function(title, subtitle)
 {
-    this.element = document.createElement("div");
-    this.element.className = "section";
-
-    this.headerElement = document.createElement("div");
-    this.headerElement.className = "header";
-
-    this.titleElement = document.createElement("div");
-    this.titleElement.className = "title";
-
-    this.subtitleElement = document.createElement("div");
-    this.subtitleElement.className = "subtitle";
-
-    this.headerElement.appendChild(this.subtitleElement);
-    this.headerElement.appendChild(this.titleElement);
-
-    this.headerElement.addEventListener("click", this.toggleExpanded.bind(this), false);
+    WebInspector.Section.call(this, title, subtitle);
 
     this.propertiesElement = document.createElement("ol");
-    this.propertiesElement.className = "properties";
+    this.propertiesElement.className = "properties source-code";
+    this.propertiesElement.tabIndex = 0;
     this.propertiesTreeOutline = new TreeOutline(this.propertiesElement);
     this.propertiesTreeOutline.section = this;
 
-    this.element.appendChild(this.headerElement);
     this.element.appendChild(this.propertiesElement);
-
-    this.title = title;
-    this.subtitle = subtitle;
-    this._expanded = false;
 }
 
-WebInspector.PropertiesSection.prototype = {
-    get title()
-    {
-        return this._title;
-    },
-
-    set title(x)
-    {
-        if (this._title === x)
-            return;
-        this._title = x;
-
-        if (x instanceof Node) {
-            this.titleElement.removeChildren();
-            this.titleElement.appendChild(x);
-        } else
-          this.titleElement.textContent = x;
-    },
-
-    get subtitle()
-    {
-        return this._subtitle;
-    },
-
-    set subtitle(x)
-    {
-        if (this._subtitle === x)
-            return;
-        this._subtitle = x;
-        this.subtitleElement.innerHTML = x;
-    },
-
-    get expanded()
-    {
-        return this._expanded;
-    },
-
-    set expanded(x)
-    {
-        if (x)
-            this.expand();
-        else
-            this.collapse();
-    },
-
-    get populated()
-    {
-        return this._populated;
-    },
-
-    set populated(x)
-    {
-        this._populated = x;
-        if (!x && this.onpopulate && this._expanded) {
-            this.onpopulate(this);
-            this._populated = true;
-        }
-    },
-
-    expand: function()
-    {
-        if (this._expanded)
-            return;
-        this._expanded = true;
-        this.element.addStyleClass("expanded");
-
-        if (!this._populated && this.onpopulate) {
-            this.onpopulate(this);
-            this._populated = true;
-        }
-    },
-
-    collapse: function()
-    {
-        if (!this._expanded)
-            return;
-        this._expanded = false;
-        this.element.removeStyleClass("expanded");
-    },
-
-    toggleExpanded: function()
-    {
-        this.expanded = !this.expanded;
-    }
-}
+WebInspector.PropertiesSection.prototype.__proto__ = WebInspector.Section.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/PropertiesSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/PropertiesSidebarPane.js
index ec08210bd5..9df6448b9d 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/PropertiesSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/PropertiesSidebarPane.js
@@ -36,12 +36,11 @@ WebInspector.PropertiesSidebarPane.prototype = {
     {
         var body = this.bodyElement;
 
-        body.removeChildren();
-
-        this.sections = [];
-
-        if (!node)
+        if (!node) {
+            body.removeChildren();
+            this.sections = [];
             return;
+        }
 
         var self = this;
         var callback = function(prototypes) {
@@ -49,15 +48,17 @@ WebInspector.PropertiesSidebarPane.prototype = {
             body.removeChildren();
             self.sections = [];
 
+            var path = [];
             // Get array of prototype user-friendly names.
             for (var i = 0; i < prototypes.length; ++i) {
-                var prototype = new WebInspector.ObjectProxy(node.id, [], i);
+                var prototype = new WebInspector.ObjectProxy(node.injectedScriptId, node.id, path.slice());
                 var section = new WebInspector.ObjectPropertiesSection(prototype, prototypes[i], WebInspector.UIString("Prototype"));
                 self.sections.push(section);
                 body.appendChild(section.element);
+                path.push("__proto__");
             }
         };
-        InjectedScriptAccess.getPrototypes(node.id, callback);
+        InjectedScriptAccess.get(node.injectedScriptId).getPrototypes(node.id, callback);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Resource.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Resource.js
index 56696e3ade..4ee5f286b2 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Resource.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Resource.js
@@ -26,26 +26,17 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Resource = function(requestHeaders, url, domain, path, lastPathComponent, identifier, mainResource, cached, requestMethod, requestFormData)
+WebInspector.Resource = function(identifier, url)
 {
     this.identifier = identifier;
-
-    this.startTime = -1;
-    this.endTime = -1;
-    this.mainResource = mainResource;
-    this.requestHeaders = requestHeaders;
-    this.url = url;
-    this.domain = domain;
-    this.path = path;
-    this.lastPathComponent = lastPathComponent;
-    this.cached = cached;
-    this.requestMethod = requestMethod || "";
-    this.requestFormData = requestFormData || "";
-
-    this.category = WebInspector.resourceCategories.other;
+    this._url = url;
+    this._startTime = -1;
+    this._endTime = -1;
+    this._requestMethod = "";
+    this._requestFormData = "";
+    this._category = WebInspector.resourceCategories.other;
 }
 
-
 WebInspector.Resource.StatusText = {
     100: "Continue",
     101: "Switching Protocols",
@@ -111,7 +102,8 @@ WebInspector.Resource.Type = {
     Font:       3,
     Script:     4,
     XHR:        5,
-    Other:      6,
+    Media:      6,
+    Other:      7,
 
     isTextType: function(type)
     {
@@ -161,6 +153,18 @@ WebInspector.Resource.prototype = {
         this.dispatchEventToListeners("url changed");
     },
 
+    get documentURL()
+    {
+        return this._documentURL;
+    },
+
+    set documentURL(x)
+    {
+        if (this._documentURL === x)
+            return;
+        this._documentURL = x;
+    },
+
     get domain()
     {
         return this._domain;
@@ -268,22 +272,28 @@ WebInspector.Resource.prototype = {
         return this._responseReceivedTime - this._startTime;
     },
 
-    get contentLength()
+    get resourceSize()
     {
-        return this._contentLength || 0;
+        return this._resourceSize || 0;
     },
 
-    set contentLength(x)
+    set resourceSize(x)
     {
-        if (this._contentLength === x)
+        if (this._resourceSize === x)
             return;
 
-        this._contentLength = x;
+        this._resourceSize = x;
 
         if (WebInspector.panels.resources)
             WebInspector.panels.resources.refreshResource(this);
     },
 
+    get transferSize()
+    {
+        // FIXME: this is wrong for chunked-encoding resources.
+        return this.cached ? 0 : Number(this.responseHeaders["Content-Length"] || this.resourceSize || 0);
+    },
+
     get expectedContentLength()
     {
         return this._expectedContentLength || 0;
@@ -309,7 +319,6 @@ WebInspector.Resource.prototype = {
         this._finished = x;
 
         if (x) {
-            this._checkTips();
             this._checkWarnings();
             this.dispatchEventToListeners("finished");
         }
@@ -525,58 +534,6 @@ WebInspector.Resource.prototype = {
         this._warnings = x;
     },
 
-    get tips()
-    {
-        if (!("_tips" in this))
-            this._tips = {};
-        return this._tips;
-    },
-
-    _addTip: function(tip)
-    {
-        if (tip.id in this.tips)
-            return;
-
-        this.tips[tip.id] = tip;
-
-        // FIXME: Re-enable this code once we have a scope bar in the Console.
-        // Otherwise, we flood the Console with too many tips.
-        /*
-        var msg = new WebInspector.ConsoleMessage(WebInspector.ConsoleMessage.MessageSource.Other,
-            WebInspector.ConsoleMessage.MessageType.Log, WebInspector.ConsoleMessage.MessageLevel.Tip, 
-            -1, this.url, null, 1, tip.message);
-        WebInspector.console.addMessage(msg);
-        */
-    },
-
-    _checkTips: function()
-    {
-        for (var tip in WebInspector.Tips)
-            this._checkTip(WebInspector.Tips[tip]);
-    },
-
-    _checkTip: function(tip)
-    {
-        var addTip = false;
-        switch (tip.id) {
-            case WebInspector.Tips.ResourceNotCompressed.id:
-                addTip = this._shouldCompress();
-                break;
-        }
-
-        if (addTip)
-            this._addTip(tip);
-    },
-
-    _shouldCompress: function()
-    {
-        return WebInspector.Resource.Type.isTextType(this.type)
-            && this.domain
-            && !("Content-Encoding" in this.responseHeaders)
-            && this.contentLength !== undefined
-            && this.contentLength >= 512;
-    },
-
     _mimeTypeIsConsistentWithType: function()
     {
         if (typeof this.type === "undefined"
@@ -587,7 +544,7 @@ WebInspector.Resource.prototype = {
         if (this.mimeType in WebInspector.MIMETypes)
             return this.type in WebInspector.MIMETypes[this.mimeType];
 
-        return true;
+        return false;
     },
 
     _checkWarnings: function()
@@ -619,66 +576,48 @@ WebInspector.Resource.prototype.__proto__ = WebInspector.Object.prototype;
 
 WebInspector.Resource.CompareByStartTime = function(a, b)
 {
-    if (a.startTime < b.startTime)
-        return -1;
-    if (a.startTime > b.startTime)
-        return 1;
-    return 0;
+    return a.startTime - b.startTime;
 }
 
 WebInspector.Resource.CompareByResponseReceivedTime = function(a, b)
 {
-    if (a.responseReceivedTime === -1 && b.responseReceivedTime !== -1)
-        return 1;
-    if (a.responseReceivedTime !== -1 && b.responseReceivedTime === -1)
-        return -1;
-    if (a.responseReceivedTime < b.responseReceivedTime)
-        return -1;
-    if (a.responseReceivedTime > b.responseReceivedTime)
-        return 1;
-    return 0;
+    var aVal = a.responseReceivedTime;
+    var bVal = b.responseReceivedTime;
+    if (aVal === -1 ^ bVal === -1)
+        return bVal - aVal;
+    return aVal - bVal;
 }
 
 WebInspector.Resource.CompareByEndTime = function(a, b)
 {
-    if (a.endTime === -1 && b.endTime !== -1)
-        return 1;
-    if (a.endTime !== -1 && b.endTime === -1)
-        return -1;
-    if (a.endTime < b.endTime)
-        return -1;
-    if (a.endTime > b.endTime)
-        return 1;
-    return 0;
+    var aVal = a.endTime;
+    var bVal = b.endTime;
+    if (aVal === -1 ^ bVal === -1)
+        return bVal - aVal;
+    return aVal - bVal;
 }
 
 WebInspector.Resource.CompareByDuration = function(a, b)
 {
-    if (a.duration < b.duration)
-        return -1;
-    if (a.duration > b.duration)
-        return 1;
-    return 0;
+    return a.duration - b.duration;
 }
 
 WebInspector.Resource.CompareByLatency = function(a, b)
 {
-    if (a.latency < b.latency)
-        return -1;
-    if (a.latency > b.latency)
-        return 1;
-    return 0;
+    return a.latency - b.latency;
 }
 
 WebInspector.Resource.CompareBySize = function(a, b)
 {
-    if (a.contentLength < b.contentLength)
-        return -1;
-    if (a.contentLength > b.contentLength)
-        return 1;
-    return 0;
+    return a.resourceSize - b.resourceSize;
 }
 
+WebInspector.Resource.CompareByTransferSize = function(a, b)
+{
+    return a.transferSize - b.transferSize;
+}
+
+
 WebInspector.Resource.StatusTextForCode = function(code)
 {
     return code ? code + " " + WebInspector.Resource.StatusText[code] : "";
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
index 2ea7fdb440..54cbb02f3b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
@@ -35,6 +35,20 @@ WebInspector.ResourceView = function(resource)
 
     this.resource = resource;
 
+    this.tabsElement = document.createElement("div");
+    this.tabsElement.className = "scope-bar";
+    this.element.appendChild(this.tabsElement);
+
+    this.headersTabElement = document.createElement("li");
+    this.headersTabElement.textContent = WebInspector.UIString("Headers");
+    this.contentTabElement = document.createElement("li");
+    this.contentTabElement.textContent = WebInspector.UIString("Content");
+    this.tabsElement.appendChild(this.headersTabElement);
+    this.tabsElement.appendChild(this.contentTabElement);
+
+    this.headersTabElement.addEventListener("click", this._selectHeadersTab.bind(this), false);
+    this.contentTabElement.addEventListener("click", this.selectContentTab.bind(this), false);
+
     this.headersElement = document.createElement("div");
     this.headersElement.className = "resource-view-headers";
     this.element.appendChild(this.headersElement);
@@ -54,13 +68,16 @@ WebInspector.ResourceView = function(resource)
     this.urlTreeElement.selectable = false;
     this.headersTreeOutline.appendChild(this.urlTreeElement);
 
-    this.httpInformationTreeElement = new TreeElement("", null, true);
-    this.httpInformationTreeElement.expanded = false;
-    this.httpInformationTreeElement.selectable = false;
-    this.headersTreeOutline.appendChild(this.httpInformationTreeElement);
+    this.requestMethodTreeElement = new TreeElement("", null, false);
+    this.requestMethodTreeElement.selectable = false;
+    this.headersTreeOutline.appendChild(this.requestMethodTreeElement);
+
+    this.statusCodeTreeElement = new TreeElement("", null, false);
+    this.statusCodeTreeElement.selectable = false;
+    this.headersTreeOutline.appendChild(this.statusCodeTreeElement);
      
     this.requestHeadersTreeElement = new TreeElement("", null, true);
-    this.requestHeadersTreeElement.expanded = false;
+    this.requestHeadersTreeElement.expanded = true;
     this.requestHeadersTreeElement.selectable = false;
     this.headersTreeOutline.appendChild(this.requestHeadersTreeElement);
 
@@ -68,25 +85,25 @@ WebInspector.ResourceView = function(resource)
     this._decodeRequestParameters = true;
 
     this.queryStringTreeElement = new TreeElement("", null, true);
-    this.queryStringTreeElement.expanded = false;
+    this.queryStringTreeElement.expanded = true;
     this.queryStringTreeElement.selectable = false;
     this.queryStringTreeElement.hidden = true;
     this.headersTreeOutline.appendChild(this.queryStringTreeElement);
 
     this.formDataTreeElement = new TreeElement("", null, true);
-    this.formDataTreeElement.expanded = false;
+    this.formDataTreeElement.expanded = true;
     this.formDataTreeElement.selectable = false;
     this.formDataTreeElement.hidden = true;
     this.headersTreeOutline.appendChild(this.formDataTreeElement);
 
     this.requestPayloadTreeElement = new TreeElement(WebInspector.UIString("Request Payload"), null, true);
-    this.requestPayloadTreeElement.expanded = false;
+    this.requestPayloadTreeElement.expanded = true;
     this.requestPayloadTreeElement.selectable = false;
     this.requestPayloadTreeElement.hidden = true;
     this.headersTreeOutline.appendChild(this.requestPayloadTreeElement);
 
     this.responseHeadersTreeElement = new TreeElement("", null, true);
-    this.responseHeadersTreeElement.expanded = false;
+    this.responseHeadersTreeElement.expanded = true;
     this.responseHeadersTreeElement.selectable = false;
     this.headersTreeOutline.appendChild(this.responseHeadersTreeElement);
 
@@ -101,55 +118,79 @@ WebInspector.ResourceView = function(resource)
     this._refreshRequestHeaders();
     this._refreshResponseHeaders();
     this._refreshHTTPInformation();
+    this._selectTab();
 }
 
 WebInspector.ResourceView.prototype = {
-    get headersVisible()
+    attach: function()
     {
-        return this._headersVisible;
+        if (!this.element.parentNode) {
+            var parentElement = (document.getElementById("resource-views") || document.getElementById("script-resource-views"));
+            if (parentElement)
+                parentElement.appendChild(this.element);
+        }
+    },
+
+    show: function(parentElement)
+    {
+        WebInspector.View.prototype.show.call(this, parentElement);
+        this._selectTab();
     },
 
     set headersVisible(x)
     {
         if (x === this._headersVisible)
             return;
-
         this._headersVisible = x;
-
         if (x)
-            this.element.addStyleClass("headers-visible");
+            this.element.addStyleClass("headers-visible"); 
         else
-            this.element.removeStyleClass("headers-visible");
+            this.element.removeStyleClass("headers-visible"); 
+        this._selectTab();
     },
 
-    attach: function()
+    _selectTab: function()
     {
-        if (!this.element.parentNode) {
-            var parentElement = (document.getElementById("resource-views") || document.getElementById("script-resource-views"));
-            if (parentElement)
-                parentElement.appendChild(this.element);
-        }
+        if (this._headersVisible) {
+            if (WebInspector.settings.resourceViewTab === "headers")
+                this._selectHeadersTab();
+            else
+                this.selectContentTab();
+        } else
+            this._innerSelectContentTab();
     },
 
-    _refreshURL: function()
+    _selectHeadersTab: function()
     {
-        var url = this.resource.url;
-        var statusCodeImage = "";
-        if (this.resource.statusCode) {
-            var statusImageSource = "";
-            
-            if (this.resource.statusCode < 300)
-                statusImageSource = "Images/successGreenDot.png";
-            else if (this.resource.statusCode < 400)
-                statusImageSource = "Images/warningOrangeDot.png";
-            else
-                statusImageSource = "Images/errorRedDot.png";
-        
-            statusCodeImage = "<img class=\"resource-status-image\" src=\"" + statusImageSource + "\" title=\"" + WebInspector.Resource.StatusTextForCode(this.resource.statusCode) + "\">";
-        }
+        WebInspector.settings.resourceViewTab = "headers";
+        this.headersTabElement.addStyleClass("selected");
+        this.contentTabElement.removeStyleClass("selected");
+        this.headersElement.removeStyleClass("hidden");
+        this.contentElement.addStyleClass("hidden");
+    },
 
-        this.urlTreeElement.title = statusCodeImage + "<span class=\"resource-url\">" + url.escapeHTML() + "</span>";
-        this._refreshQueryString();
+    selectContentTab: function()
+    {
+        WebInspector.settings.resourceViewTab = "content";
+        this._innerSelectContentTab();
+    },
+
+    _innerSelectContentTab: function()
+    {
+        this.contentTabElement.addStyleClass("selected");
+        this.headersTabElement.removeStyleClass("selected");
+        this.contentElement.removeStyleClass("hidden");
+        this.headersElement.addStyleClass("hidden");
+        if ("resize" in this)
+            this.resize();
+        if ("contentTabSelected" in this)
+            this.contentTabSelected();
+    },
+
+    _refreshURL: function()
+    {
+        this.urlTreeElement.title = "<div class=\"header-name\">" + WebInspector.UIString("Request URL") + ":</div>" +
+            "<div class=\"header-value source-code\">" + this.resource.url.escapeHTML() + "</div>";
     },
 
     _refreshQueryString: function()
@@ -195,7 +236,7 @@ WebInspector.ResourceView.prototype = {
         this.requestPayloadTreeElement.removeChildren();
 
         var title = "<div class=\"header-name\">&nbsp;</div>";
-        title += "<div class=\"raw-form-data header-value\">" + formData.escapeHTML() + "</div>";
+        title += "<div class=\"raw-form-data header-value source-code\">" + formData.escapeHTML() + "</div>";
         var parmTreeElement = new TreeElement(title, null, false);
         parmTreeElement.selectable = false;
         this.requestPayloadTreeElement.appendChild(parmTreeElement);
@@ -238,7 +279,7 @@ WebInspector.ResourceView.prototype = {
                 valueEscaped += " <span class=\"error-message\">" + WebInspector.UIString("(unable to decode value)").escapeHTML() + "</span>";
 
             var title = "<div class=\"header-name\">" + key.escapeHTML() + ":</div>";
-            title += "<div class=\"header-value\">" + valueEscaped + "</div>";
+            title += "<div class=\"header-value source-code\">" + valueEscaped + "</div>";
 
             var parmTreeElement = new TreeElement(title, null, false);
             parmTreeElement.selectable = false;
@@ -248,7 +289,7 @@ WebInspector.ResourceView.prototype = {
         }
     },
 
-    _toggleURLdecoding: function(treeElement, event)
+    _toggleURLdecoding: function(event)
     {
         this._decodeRequestParameters = !this._decodeRequestParameters;
         this._refreshQueryString();
@@ -277,28 +318,27 @@ WebInspector.ResourceView.prototype = {
 
     _refreshHTTPInformation: function()
     {
-        const listElements = 2;
-
-        var headerElement = this.httpInformationTreeElement;
-        headerElement.removeChildren();
-        headerElement.hidden = !this.resource.statusCode;
+        var requestMethodElement = this.requestMethodTreeElement;
+        requestMethodElement.hidden = !this.resource.statusCode;
+        var statusCodeElement = this.statusCodeTreeElement;
+        statusCodeElement.hidden = !this.resource.statusCode;
+        var statusCodeImage = "";
 
         if (this.resource.statusCode) {
-            headerElement.title = WebInspector.UIString("HTTP Information") +  "<span class=\"header-count\">" + WebInspector.UIString(" (%d)", listElements) + "</span>";
-        
-            var title = "<div class=\"header-name\">" + WebInspector.UIString("Request Method") + ":</div>";
-            title += "<div class=\"header-value\">" + this.resource.requestMethod + "</div>"
-            
-            var headerTreeElement = new TreeElement(title, null, false);
-            headerTreeElement.selectable = false;
-            headerElement.appendChild(headerTreeElement);
-            
-            title = "<div class=\"header-name\">" + WebInspector.UIString("Status Code") + ":</div>";
-            title += "<div class=\"header-value\">" + WebInspector.Resource.StatusTextForCode(this.resource.statusCode) + "</div>"
-            
-            headerTreeElement = new TreeElement(title, null, false);
-            headerTreeElement.selectable = false;
-            headerElement.appendChild(headerTreeElement);
+            var statusImageSource = "";
+            if (this.resource.statusCode < 300)
+                statusImageSource = "Images/successGreenDot.png";
+            else if (this.resource.statusCode < 400)
+                statusImageSource = "Images/warningOrangeDot.png";
+            else
+                statusImageSource = "Images/errorRedDot.png";
+            statusCodeImage = "<img class=\"resource-status-image\" src=\"" + statusImageSource + "\" title=\"" + WebInspector.Resource.StatusTextForCode(this.resource.statusCode) + "\">";
+    
+            requestMethodElement.title = "<div class=\"header-name\">" + WebInspector.UIString("Request Method") + ":</div>" +
+                "<div class=\"header-value source-code\">" + this.resource.requestMethod + "</div>";
+
+            statusCodeElement.title = "<div class=\"header-name\">" + WebInspector.UIString("Status Code") + ":</div>" +
+                statusCodeImage + "<div class=\"header-value source-code\">" + WebInspector.Resource.StatusTextForCode(this.resource.statusCode) + "</div>";
         }
     },
     
@@ -313,7 +353,7 @@ WebInspector.ResourceView.prototype = {
         var length = headers.length;
         for (var i = 0; i < length; ++i) {
             var title = "<div class=\"header-name\">" + headers[i].header.escapeHTML() + ":</div>";
-            title += "<div class=\"header-value\">" + headers[i].value.escapeHTML() + "</div>"
+            title += "<div class=\"header-value source-code\">" + headers[i].value.escapeHTML() + "</div>"
 
             var headerTreeElement = new TreeElement(title, null, false);
             headerTreeElement.selectable = false;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
index 940570fccc..3ffc6ff6a0 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
@@ -39,6 +39,7 @@ WebInspector.ResourcesPanel = function()
     this.viewsContainerElement.id = "resource-views";
     this.element.appendChild(this.viewsContainerElement);
 
+    this.createFilterPanel();
     this.createInterface();
 
     this._createStatusbarButtons();
@@ -46,6 +47,7 @@ WebInspector.ResourcesPanel = function()
     this.reset();
     this.filter(this.filterAllElement, false);
     this.graphsTreeElement.children[0].select();
+    this._resourceTrackingEnabled = false;
 }
 
 WebInspector.ResourcesPanel.prototype = {
@@ -97,6 +99,7 @@ WebInspector.ResourcesPanel.prototype = {
             { name: WebInspector.UIString("Sort by Latency"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByDescendingLatency, calculator: transferDurationCalculator },
         ];
 
+        timeGraphItem.isBarOpaqueAtLeft = false;
         timeGraphItem.selectedSortingOptionIndex = 1;
 
         var sizeGraphItem = new WebInspector.SidebarTreeElement("resources-size-graph-sidebar-item", WebInspector.UIString("Size"));
@@ -104,9 +107,11 @@ WebInspector.ResourcesPanel.prototype = {
 
         var transferSizeCalculator = new WebInspector.ResourceTransferSizeCalculator();
         sizeGraphItem.sortingOptions = [
+            { name: WebInspector.UIString("Sort by Transfer Size"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByDescendingTransferSize, calculator: transferSizeCalculator },
             { name: WebInspector.UIString("Sort by Size"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByDescendingSize, calculator: transferSizeCalculator },
         ];
 
+        sizeGraphItem.isBarOpaqueAtLeft = true;
         sizeGraphItem.selectedSortingOptionIndex = 0;
 
         this.graphsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("GRAPHS"), {}, true);
@@ -122,6 +127,11 @@ WebInspector.ResourcesPanel.prototype = {
         this.itemsTreeElement.expand();
     },
 
+    get resourceTrackingEnabled()
+    {
+        return this._resourceTrackingEnabled;
+    },
+
     _createPanelEnabler: function()
     {
         var panelEnablerHeading = WebInspector.UIString("You need to enable resource tracking to use this panel.");
@@ -140,18 +150,21 @@ WebInspector.ResourcesPanel.prototype = {
     _createStatusbarButtons: function()
     {
         this.largerResourcesButton = new WebInspector.StatusBarButton(WebInspector.UIString("Use small resource rows."), "resources-larger-resources-status-bar-item");
-        this.largerResourcesButton.toggled = Preferences.resourcesLargeRows;
-        this.largerResourcesButton.addEventListener("click", this._toggleLargerResources.bind(this), false);
-        if (!Preferences.resourcesLargeRows) {
-            Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
-            this._toggleLargerResources(); // this will toggle the preference back to the original
-        }
 
+        WebInspector.settings.addEventListener("loaded", this._settingsLoaded, this);
+        this.largerResourcesButton.addEventListener("click", this._toggleLargerResources.bind(this), false);
         this.sortingSelectElement = document.createElement("select");
         this.sortingSelectElement.className = "status-bar-item";
         this.sortingSelectElement.addEventListener("change", this._changeSortingFunction.bind(this), false);
     },
 
+    _settingsLoaded: function()
+    {
+        this.largerResourcesButton.toggled = WebInspector.settings.resourcesLargeRows;
+        if (!WebInspector.settings.resourcesLargeRows)
+            this._setLargerResources(WebInspector.settings.resourcesLargeRows);
+    },
+
     get mainResourceLoadTime()
     {
         return this._mainResourceLoadTime || -1;
@@ -188,10 +201,11 @@ WebInspector.ResourcesPanel.prototype = {
         WebInspector.AbstractTimelinePanel.prototype.show.call(this);
 
         var visibleView = this.visibleView;
-        if (visibleView) {
-            visibleView.headersVisible = true;
-            visibleView.show(this.viewsContainerElement);
-        }
+        if (this.visibleResource) {
+            this.visibleView.headersVisible = true;
+            this.visibleView.show(this.viewsContainerElement);
+        } else if (visibleView)
+            visibleView.show();
 
         // Hide any views that are visible that are not this panel's current visible view.
         // This can happen when a ResourceView is visible in the Scripts panel then switched
@@ -206,15 +220,6 @@ WebInspector.ResourcesPanel.prototype = {
         }
     },
 
-    resize: function()
-    {
-        WebInspector.AbstractTimelinePanel.prototype.resize.call(this);
-
-        var visibleView = this.visibleView;
-        if (visibleView && "resize" in visibleView)
-            visibleView.resize();
-    },
-
     get searchableViews()
     {
         var views = [];
@@ -283,7 +288,7 @@ WebInspector.ResourcesPanel.prototype = {
     {
         if (this.visibleResource)
             return this.visibleResource._resourcesView;
-        return null;
+        return this._resourceTrackingEnabled ? null : this.panelEnablerView;
     },
 
     get sortingFunction()
@@ -312,11 +317,13 @@ WebInspector.ResourcesPanel.prototype = {
 
     resourceTrackingWasEnabled: function()
     {
+        this._resourceTrackingEnabled = true;
         this.reset();
     },
 
     resourceTrackingWasDisabled: function()
     {
+        this._resourceTrackingEnabled = false;
         this.reset();
     },
 
@@ -348,7 +355,7 @@ WebInspector.ResourcesPanel.prototype = {
 
         this.summaryBar.reset();
 
-        if (InspectorController.resourceTrackingEnabled()) {
+        if (this._resourceTrackingEnabled) {
             this.enableToggleButton.title = WebInspector.UIString("Resource tracking enabled. Click to disable.");
             this.enableToggleButton.toggled = true;
             this.largerResourcesButton.visible = true;
@@ -433,7 +440,7 @@ WebInspector.ResourcesPanel.prototype = {
             return;
 
         var newView = this._createResourceView(resource);
-        if (newView.prototype === resource._resourcesView.prototype)
+        if (newView.__proto__ === resource._resourcesView.__proto__)
             return;
 
         resource.warnings = 0;
@@ -443,6 +450,7 @@ WebInspector.ResourcesPanel.prototype = {
             resource._itemsTreeElement.updateErrorsAndWarnings();
 
         var oldView = resource._resourcesView;
+        var oldViewParentNode = oldView.visible ? oldView.element.parentNode : null;
 
         resource._resourcesView.detach();
         delete resource._resourcesView;
@@ -451,8 +459,20 @@ WebInspector.ResourcesPanel.prototype = {
 
         newView.headersVisible = oldView.headersVisible;
 
-        if (oldView.visible && oldView.element.parentNode)
-            newView.show(oldView.element.parentNode);
+        if (oldViewParentNode)
+            newView.show(oldViewParentNode);
+
+        WebInspector.panels.scripts.viewRecreated(oldView, newView);
+    },
+
+    canShowSourceLine: function(url, line)
+    {
+        return this._resourceTrackingEnabled && !!WebInspector.resourceForURL(url);
+    },
+
+    showSourceLine: function(url, line)
+    {
+        this.showResource(WebInspector.resourceForURL(url), line);
     },
 
     showResource: function(resource, line)
@@ -470,6 +490,7 @@ WebInspector.ResourcesPanel.prototype = {
         view.show(this.viewsContainerElement);
 
         if (line) {
+            view.selectContentTab();
             if (view.revealLine)
                 view.revealLine(line);
             if (view.highlightLine)
@@ -564,8 +585,8 @@ WebInspector.ResourcesPanel.prototype = {
             loadDividerPadding.style.left = percent + "%";
             loadDividerPadding.title = WebInspector.UIString("Load event fired");
             loadDividerPadding.appendChild(loadDivider);
-            
-            this.eventDividersElement.appendChild(loadDividerPadding);
+
+            this.addEventDivider(loadDividerPadding);
         }
         
         if (this.mainResourceDOMContentTime !== -1) {
@@ -579,8 +600,8 @@ WebInspector.ResourcesPanel.prototype = {
             domContentDividerPadding.style.left = percent + "%";
             domContentDividerPadding.title = WebInspector.UIString("DOMContent event fired");
             domContentDividerPadding.appendChild(domContentDivider);
-            
-            this.eventDividersElement.appendChild(domContentDividerPadding);
+
+            this.addEventDivider(domContentDividerPadding);
         }
     },
 
@@ -613,19 +634,21 @@ WebInspector.ResourcesPanel.prototype = {
         if (!this.itemsTreeElement._childrenListNode)
             return;
 
-        this.itemsTreeElement.smallChildren = !this.itemsTreeElement.smallChildren;
-        Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
-        InspectorController.setSetting("resources-large-rows", Preferences.resourcesLargeRows);
+        WebInspector.settings.resourcesLargeRows = !WebInspector.settings.resourcesLargeRows;
+        this._setLargerResources(this.itemsTreeElement.smallChildren);
+    },
 
-        if (this.itemsTreeElement.smallChildren) {
+    _setLargerResources: function(enabled)
+    {
+        this.largerResourcesButton.toggled = enabled;
+        this.itemsTreeElement.smallChildren = !enabled;
+        if (!enabled) {
             this.itemsGraphsElement.addStyleClass("small");
             this.largerResourcesButton.title = WebInspector.UIString("Use large resource rows.");
-            this.largerResourcesButton.toggled = false;
             this.adjustScrollPosition();
         } else {
             this.itemsGraphsElement.removeStyleClass("small");
             this.largerResourcesButton.title = WebInspector.UIString("Use small resource rows.");
-            this.largerResourcesButton.toggled = true;
         }
     },
 
@@ -668,38 +691,54 @@ WebInspector.ResourcesPanel.prototype = {
 
     updateMainViewWidth: function(width)
     {
-        WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth.call(this, width);
         this.viewsContainerElement.style.left = width + "px";
+
+        WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth.call(this, width);
+        this.resize();
     },
 
     _enableResourceTracking: function()
     {
-        if (InspectorController.resourceTrackingEnabled())
+        if (this._resourceTrackingEnabled)
             return;
         this._toggleResourceTracking(this.panelEnablerView.alwaysEnabled);
     },
 
     _toggleResourceTracking: function(optionalAlways)
     {
-        if (InspectorController.resourceTrackingEnabled()) {
+        if (this._resourceTrackingEnabled) {
             this.largerResourcesButton.visible = false;
             this.sortingSelectElement.visible = false;
-            InspectorController.disableResourceTracking(true);
+            WebInspector.resources = {};
+            WebInspector.resourceURLMap = {};
+            InspectorBackend.disableResourceTracking(true);
         } else {
             this.largerResourcesButton.visible = true;
             this.sortingSelectElement.visible = true;
-            InspectorController.enableResourceTracking(!!optionalAlways);
+            InspectorBackend.enableResourceTracking(!!optionalAlways);
         }
     },
 
     get _resources()
     {
-        return this._items;
+        return this.items;
+    },
+
+    searchIteratesOverViews: function()
+    {
+        return true;
     }
 }
 
 WebInspector.ResourcesPanel.prototype.__proto__ = WebInspector.AbstractTimelinePanel.prototype;
 
+WebInspector.getResourceContent = function(identifier, callback)
+{
+    InspectorBackend.getResourceContent(WebInspector.Callback.wrap(callback), identifier);
+}
+
+WebInspector.didGetResourceContent = WebInspector.Callback.processCallback;
+
 WebInspector.ResourceTimeCalculator = function(startAtZero)
 {
     WebInspector.AbstractTimelineCalculator.call(this);
@@ -801,18 +840,20 @@ WebInspector.ResourceTimeCalculator.prototype = {
 
     computeBarGraphLabels: function(resource)
     {
-        var leftLabel = "";
-        if (resource.latency > 0)
-            leftLabel = this.formatValue(resource.latency);
-
         var rightLabel = "";
         if (resource.responseReceivedTime !== -1 && resource.endTime !== -1)
             rightLabel = this.formatValue(resource.endTime - resource.responseReceivedTime);
 
-        if (leftLabel && rightLabel) {
+        var hasLatency = resource.latency > 0;
+        if (hasLatency)
+            var leftLabel = this.formatValue(resource.latency);
+        else
+            var leftLabel = rightLabel;
+
+        if (hasLatency && rightLabel) {
             var total = this.formatValue(resource.duration);
             var tooltip = WebInspector.UIString("%s latency, %s download (%s total)", leftLabel, rightLabel, total);
-        } else if (leftLabel)
+        } else if (hasLatency)
             var tooltip = WebInspector.UIString("%s latency", leftLabel);
         else if (rightLabel)
             var tooltip = WebInspector.UIString("%s download", rightLabel);
@@ -916,16 +957,39 @@ WebInspector.ResourceTransferSizeCalculator = function()
 WebInspector.ResourceTransferSizeCalculator.prototype = {
     computeBarGraphLabels: function(resource)
     {
-        const label = this.formatValue(this._value(resource));
-        var tooltip = label;
+        var networkBytes = this._networkBytes(resource);
+        var resourceBytes = this._value(resource);
+        if (networkBytes && networkBytes !== resourceBytes) {
+            // Transferred size is not the same as reported resource length.
+            var networkBytesString = this.formatValue(networkBytes);
+            var left = networkBytesString;
+            var right = this.formatValue(resourceBytes);
+            var tooltip = right ? WebInspector.UIString("%s (%s transferred)", right, networkBytesString) : right;
+        } else {
+            var left = this.formatValue(resourceBytes);
+            var right = left;
+            var tooltip = left;
+        }
         if (resource.cached)
             tooltip = WebInspector.UIString("%s (from cache)", tooltip);
-        return {left: label, right: label, tooltip: tooltip};
+        return {left: left, right: right, tooltip: tooltip};
+    },
+
+    computeBarGraphPercentages: function(item)
+    {
+        const resourceBytesAsPercent = (this._value(item) / this.boundarySpan) * 100;
+        const networkBytesAsPercent = this._networkBytes(item) ? (this._networkBytes(item) / this.boundarySpan) * 100 : resourceBytesAsPercent;
+        return {start: 0, middle: networkBytesAsPercent, end: resourceBytesAsPercent};
     },
 
     _value: function(resource)
     {
-        return resource.contentLength;
+        return resource.resourceSize;
+    },
+
+    _networkBytes: function(resource)
+    {
+        return resource.transferSize;
     },
 
     formatValue: function(value)
@@ -958,6 +1022,7 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
         // FIXME: should actually add handler to parent, to be resolved via
         // https://bugs.webkit.org/show_bug.cgi?id=30227
         this._listItemNode.addEventListener("dragstart", this.ondragstart.bind(this), false);
+        this.updateErrorsAndWarnings();
     },
 
     onselect: function()
@@ -965,9 +1030,9 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
         WebInspector.panels.resources.showResource(this.resource);
     },
     
-    ondblclick: function(treeElement, event)
+    ondblclick: function(event)
     {
-        InjectedScriptAccess.openInInspectedWindow(this.resource.url, function() {});
+        InjectedScriptAccess.getDefault().openInInspectedWindow(this.resource.url, function() {});
     },
 
     ondragstart: function(event) {
@@ -1041,6 +1106,8 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
 
             this.createIconElement();
         }
+
+        this.tooltip = this.resource.url;
     },
 
     resetBubble: function()
@@ -1113,6 +1180,11 @@ WebInspector.ResourceSidebarTreeElement.CompareByDescendingSize = function(a, b)
     return -1 * WebInspector.Resource.CompareBySize(a.resource, b.resource);
 }
 
+WebInspector.ResourceSidebarTreeElement.CompareByDescendingTransferSize = function(a, b)
+{
+    return -1 * WebInspector.Resource.CompareByTransferSize(a.resource, b.resource);
+}
+
 WebInspector.ResourceSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
 
 WebInspector.ResourceGraph = function(resource)
@@ -1168,14 +1240,40 @@ WebInspector.ResourceGraph.prototype = {
         this._labelRightElement.removeStyleClass("hidden");
 
         const labelPadding = 10;
-        const rightBarWidth = (this._barRightElement.offsetWidth - labelPadding);
-        const leftBarWidth = ((this._barLeftElement.offsetWidth - this._barRightElement.offsetWidth) - labelPadding);
+        const barRightElementOffsetWidth = this._barRightElement.offsetWidth;
+        const barLeftElementOffsetWidth = this._barLeftElement.offsetWidth;
+
+        if (this._isBarOpaqueAtLeft) {
+            var leftBarWidth = barLeftElementOffsetWidth - labelPadding;
+            var rightBarWidth = (barRightElementOffsetWidth - barLeftElementOffsetWidth) - labelPadding;
+        } else {
+            var leftBarWidth = (barLeftElementOffsetWidth - barRightElementOffsetWidth) - labelPadding;
+            var rightBarWidth = barRightElementOffsetWidth - labelPadding;
+        }
+
+        const labelLeftElementOffsetWidth = this._labelLeftElement.offsetWidth;
+        const labelRightElementOffsetWidth = this._labelRightElement.offsetWidth;
 
-        var labelBefore = (this._labelLeftElement.offsetWidth > leftBarWidth);
-        var labelAfter = (this._labelRightElement.offsetWidth > rightBarWidth);
+        const labelBefore = (labelLeftElementOffsetWidth > leftBarWidth);
+        const labelAfter = (labelRightElementOffsetWidth > rightBarWidth);
+        const graphElementOffsetWidth = this._graphElement.offsetWidth;
+
+        if (labelBefore && (graphElementOffsetWidth * (this._percentages.start / 100)) < (labelLeftElementOffsetWidth + 10))
+            var leftHidden = true;
+
+        if (labelAfter && (graphElementOffsetWidth * ((100 - this._percentages.end) / 100)) < (labelRightElementOffsetWidth + 10))
+            var rightHidden = true;
+
+        if (barLeftElementOffsetWidth == barRightElementOffsetWidth) {
+            // The left/right label data are the same, so a before/after label can be replaced by an on-bar label.
+            if (labelBefore && !labelAfter)
+                leftHidden = true;
+            else if (labelAfter && !labelBefore)
+                rightHidden = true;
+        }
 
         if (labelBefore) {
-            if ((this._graphElement.offsetWidth * (this._percentages.start / 100)) < (this._labelLeftElement.offsetWidth + 10))
+            if (leftHidden)
                 this._labelLeftElement.addStyleClass("hidden");
             this._labelLeftElement.style.setProperty("right", (100 - this._percentages.start) + "%");
             this._labelLeftElement.addStyleClass("before");
@@ -1185,7 +1283,7 @@ WebInspector.ResourceGraph.prototype = {
         }
 
         if (labelAfter) {
-            if ((this._graphElement.offsetWidth * ((100 - this._percentages.end) / 100)) < (this._labelRightElement.offsetWidth + 10))
+            if (rightHidden)
                 this._labelRightElement.addStyleClass("hidden");
             this._labelRightElement.style.setProperty("left", this._percentages.end + "%");
             this._labelRightElement.addStyleClass("after");
@@ -1195,7 +1293,7 @@ WebInspector.ResourceGraph.prototype = {
         }
     },
 
-    refresh: function(calculator)
+    refresh: function(calculator, isBarOpaqueAtLeft)
     {
         var percentages = calculator.computeBarGraphPercentages(this.resource);
         var labels = calculator.computeBarGraphLabels(this.resource);
@@ -1210,11 +1308,32 @@ WebInspector.ResourceGraph.prototype = {
         }
 
         this._barLeftElement.style.setProperty("left", percentages.start + "%");
-        this._barLeftElement.style.setProperty("right", (100 - percentages.end) + "%");
-
-        this._barRightElement.style.setProperty("left", percentages.middle + "%");
         this._barRightElement.style.setProperty("right", (100 - percentages.end) + "%");
 
+        if (!isBarOpaqueAtLeft) {
+            this._barLeftElement.style.setProperty("right", (100 - percentages.end) + "%");
+            this._barRightElement.style.setProperty("left", percentages.middle + "%");
+
+            if (this._isBarOpaqueAtLeft != isBarOpaqueAtLeft) {
+                this._barLeftElement.addStyleClass("waiting");
+                this._barRightElement.removeStyleClass("waiting-right");
+                this._labelLeftElement.addStyleClass("waiting");
+                this._labelRightElement.removeStyleClass("waiting-right");
+            }
+        } else {
+            this._barLeftElement.style.setProperty("right", (100 - percentages.middle) + "%");
+            this._barRightElement.style.setProperty("left", percentages.start + "%");
+
+            if (this._isBarOpaqueAtLeft != isBarOpaqueAtLeft) {
+                this._barLeftElement.removeStyleClass("waiting");
+                this._barRightElement.addStyleClass("waiting-right");
+                this._labelLeftElement.removeStyleClass("waiting");
+                this._labelRightElement.addStyleClass("waiting-right");
+            }
+        }
+
+        this._isBarOpaqueAtLeft = isBarOpaqueAtLeft;
+
         this._labelLeftElement.textContent = labels.left;
         this._labelRightElement.textContent = labels.right;
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js
index e6413a9d7c..79004f3442 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js
@@ -42,9 +42,20 @@ WebInspector.Script = function(sourceID, sourceURL, source, startingLine, errorL
         var match = pattern.exec(source);
 
         if (match)
-            this.sourceURL = WebInspector.UIString("(program): %s", match[1]);
+            this.sourceURL = match[1];
     }
 }
 
 WebInspector.Script.prototype = {
+    get linesCount()
+    {
+        if (!this.source)
+            return 0;
+        this._linesCount = 0;
+        var lastIndex = this.source.indexOf("\n");
+        while (lastIndex !== -1) {
+            lastIndex = this.source.indexOf("\n", lastIndex + 1)
+            this._linesCount++;
+        }
+    }
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptView.js
index 124190c634..eeceaea6e9 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptView.js
@@ -33,10 +33,7 @@ WebInspector.ScriptView = function(script)
 
     this._frameNeedsSetup = true;
     this._sourceFrameSetup = false;
-
-    this.sourceFrame = new WebInspector.SourceFrame(null, this._addBreakpoint.bind(this));
-
-    this.element.appendChild(this.sourceFrame.element);
+    this.sourceFrame = new WebInspector.SourceFrame(this.element, this._addBreakpoint.bind(this), this._removeBreakpoint.bind(this));
 }
 
 WebInspector.ScriptView.prototype = {
@@ -44,12 +41,8 @@ WebInspector.ScriptView.prototype = {
     {
         WebInspector.View.prototype.show.call(this, parentElement);
         this.setupSourceFrameIfNeeded();
-    },
-
-    hide: function()
-    {
-        WebInspector.View.prototype.hide.call(this);
-        this._currentSearchResultIndex = -1;
+        this.sourceFrame.visible = true;
+        this.resize();
     },
 
     setupSourceFrameIfNeeded: function()
@@ -59,13 +52,13 @@ WebInspector.ScriptView.prototype = {
 
         this.attach();
 
-        if (!InspectorController.addSourceToFrame("text/javascript", this.script.source, this.sourceFrame.element))
-            return;
+        var prefix = "";
+        for (var i = 0; i < this.script.startingLine - 1; ++i)
+            prefix += "\n";
 
+        this.sourceFrame.setContent("text/javascript", prefix + this.script.source);
+        this._sourceFrameSetup = true;
         delete this._frameNeedsSetup;
-
-        this.sourceFrame.addEventListener("syntax highlighting complete", this._syntaxHighlightingComplete, this);
-        this.sourceFrame.syntaxHighlightJavascript();
     },
 
     attach: function()
@@ -83,6 +76,7 @@ WebInspector.ScriptView.prototype = {
     // The follow methods are pulled from SourceView, since they are
     // generic and work with ScriptView just fine.
 
+    hide: WebInspector.SourceView.prototype.hide,
     revealLine: WebInspector.SourceView.prototype.revealLine,
     highlightLine: WebInspector.SourceView.prototype.highlightLine,
     addMessage: WebInspector.SourceView.prototype.addMessage,
@@ -97,7 +91,8 @@ WebInspector.ScriptView.prototype = {
     showingLastSearchResult: WebInspector.SourceView.prototype.showingLastSearchResult,
     _jumpToSearchResult: WebInspector.SourceView.prototype._jumpToSearchResult,
     _sourceFrameSetupFinished: WebInspector.SourceView.prototype._sourceFrameSetupFinished,
-    _syntaxHighlightingComplete: WebInspector.SourceView.prototype._syntaxHighlightingComplete
+    _removeBreakpoint: WebInspector.SourceView.prototype._removeBreakpoint,
+    resize: WebInspector.SourceView.prototype.resize
 }
 
 WebInspector.ScriptView.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
index 4aa0ab2305..316f32efcc 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
@@ -56,7 +56,6 @@ WebInspector.ScriptsPanel = function()
     this.filesSelectElement.className = "status-bar-item";
     this.filesSelectElement.id = "scripts-files";
     this.filesSelectElement.addEventListener("change", this._changeVisibleFile.bind(this), false);
-    this.filesSelectElement.handleKeyEvent = this.handleKeyEvent.bind(this);
     this.topStatusBar.appendChild(this.filesSelectElement);
 
     this.functionsSelectElement = document.createElement("select");
@@ -106,6 +105,12 @@ WebInspector.ScriptsPanel = function()
     this.stepOutButton.appendChild(document.createElement("img"));
     this.sidebarButtonsElement.appendChild(this.stepOutButton);
 
+    this.toggleBreakpointsButton = new WebInspector.StatusBarButton("", "toggle-breakpoints");
+    this.toggleBreakpointsButton.addEventListener("click", this._toggleBreakpointsClicked.bind(this), false);
+    this.sidebarButtonsElement.appendChild(this.toggleBreakpointsButton.element);
+    // Breakpoints should be activated by default, so emulate a click to toggle on.
+    this._toggleBreakpointsClicked();
+
     this.debuggerStatusElement = document.createElement("div");
     this.debuggerStatusElement.id = "scripts-debugger-status";
     this.sidebarButtonsElement.appendChild(this.debuggerStatusElement);
@@ -130,6 +135,7 @@ WebInspector.ScriptsPanel = function()
     this.sidebarPanes.callstack = new WebInspector.CallStackSidebarPane();
     this.sidebarPanes.scopechain = new WebInspector.ScopeChainSidebarPane();
     this.sidebarPanes.breakpoints = new WebInspector.BreakpointsSidebarPane();
+    this.sidebarPanes.workers = new WebInspector.WorkersSidebarPane();
 
     for (var pane in this.sidebarPanes)
         this.sidebarElement.appendChild(this.sidebarPanes[pane].element);
@@ -155,47 +161,53 @@ WebInspector.ScriptsPanel = function()
     this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
     this.enableToggleButton.addEventListener("click", this._toggleDebugging.bind(this), false);
 
-    this.pauseOnExceptionButton = new WebInspector.StatusBarButton("", "scripts-pause-on-exceptions-status-bar-item");
-    this.pauseOnExceptionButton.addEventListener("click", this._togglePauseOnExceptions.bind(this), false);
-
-    this._breakpointsURLMap = {};
+    this._pauseOnExceptionButton = new WebInspector.StatusBarButton("", "scripts-pause-on-exceptions-status-bar-item", 3);
+    this._pauseOnExceptionButton.addEventListener("click", this._togglePauseOnExceptions.bind(this), false);
+    this._pauseOnExceptionButton.state = WebInspector.ScriptsPanel.PauseOnExceptionsState.DontPauseOnExceptions;
 
     this._shortcuts = {};
-
-    var isMac = InspectorController.platform().indexOf("mac-") === 0;
-    var platformSpecificModifier = isMac ? WebInspector.KeyboardShortcut.Modifiers.Meta : WebInspector.KeyboardShortcut.Modifiers.Ctrl;
+    var handler, shortcut;
+    var platformSpecificModifier = WebInspector.isMac() ? WebInspector.KeyboardShortcut.Modifiers.Meta : WebInspector.KeyboardShortcut.Modifiers.Ctrl;
 
     // Continue.
-    var handler = this.pauseButton.click.bind(this.pauseButton);
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F8);
+    handler = this.pauseButton.click.bind(this.pauseButton);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F8);
     this._shortcuts[shortcut] = handler;
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Slash, platformSpecificModifier);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Slash, platformSpecificModifier);
     this._shortcuts[shortcut] = handler;
 
     // Step over.
-    var handler = this.stepOverButton.click.bind(this.stepOverButton);
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F10);
+    handler = this.stepOverButton.click.bind(this.stepOverButton);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F10);
     this._shortcuts[shortcut] = handler;
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.SingleQuote, platformSpecificModifier);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.SingleQuote, platformSpecificModifier);
     this._shortcuts[shortcut] = handler;
 
     // Step into.
-    var handler = this.stepIntoButton.click.bind(this.stepIntoButton);
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F11);
+    handler = this.stepIntoButton.click.bind(this.stepIntoButton);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F11);
     this._shortcuts[shortcut] = handler;
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Semicolon, platformSpecificModifier);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Semicolon, platformSpecificModifier);
     this._shortcuts[shortcut] = handler;
 
     // Step out.
-    var handler = this.stepOutButton.click.bind(this.stepOutButton);
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F11, WebInspector.KeyboardShortcut.Modifiers.Shift);
+    handler = this.stepOutButton.click.bind(this.stepOutButton);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F11, WebInspector.KeyboardShortcut.Modifiers.Shift);
     this._shortcuts[shortcut] = handler;
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Semicolon, WebInspector.KeyboardShortcut.Modifiers.Shift, platformSpecificModifier);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Semicolon, WebInspector.KeyboardShortcut.Modifiers.Shift, platformSpecificModifier);
     this._shortcuts[shortcut] = handler;
 
+    this._debuggerEnabled = Preferences.debuggerAlwaysEnabled;
     this.reset();
 }
 
+// Keep these in sync with WebCore::ScriptDebugServer
+WebInspector.ScriptsPanel.PauseOnExceptionsState = {
+    DontPauseOnExceptions : 0,
+    PauseOnAllExceptions : 1,
+    PauseOnUncaughtExceptions: 2
+};
+
 WebInspector.ScriptsPanel.prototype = {
     toolbarItemClass: "scripts",
 
@@ -206,7 +218,12 @@ WebInspector.ScriptsPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.enableToggleButton.element, this.pauseOnExceptionButton.element];
+        return [this.enableToggleButton.element, this._pauseOnExceptionButton.element];
+    },
+
+    get defaultFocusedElement()
+    {
+        return this.filesSelectElement;
     },
 
     get paused()
@@ -224,96 +241,83 @@ WebInspector.ScriptsPanel.prototype = {
                 this.visibleView.headersVisible = false;
             this.visibleView.show(this.viewsContainerElement);
         }
-
-        // Hide any views that are visible that are not this panel's current visible view.
-        // This can happen when a ResourceView is visible in the Resources panel then switched
-        // to the this panel.
-        for (var sourceID in this._sourceIDMap) {
-            var scriptOrResource = this._sourceIDMap[sourceID];
-            var view = this._sourceViewForScriptOrResource(scriptOrResource);
-            if (!view || view === this.visibleView)
-                continue;
-            view.visible = false;
-        }
         if (this._attachDebuggerWhenShown) {
-            InspectorController.enableDebugger(false);
+            InspectorBackend.enableDebugger(false);
             delete this._attachDebuggerWhenShown;
         }
     },
 
     get searchableViews()
     {
-        var views = [];
-
-        const visibleView = this.visibleView;
-        if (visibleView && visibleView.performSearch) {
-            visibleView.alreadySearching = true;
-            views.push(visibleView);
-        }
-
-        for (var sourceID in this._sourceIDMap) {
-            var scriptOrResource = this._sourceIDMap[sourceID];
-            var view = this._sourceViewForScriptOrResource(scriptOrResource);
-            if (!view || !view.performSearch || view.alreadySearching)
-                continue;
-
-            view.alreadySearching = true;
-            views.push(view);
-        }
-
-        for (var i = 0; i < views.length; ++i)
-            delete views[i].alreadySearching;
+        return [ this.visibleView ];
+    },
 
-        return views;
+    get breakpointsActivated()
+    {
+        return this.toggleBreakpointsButton.toggled;
     },
 
     addScript: function(sourceID, sourceURL, source, startingLine, errorLine, errorMessage)
     {
         var script = new WebInspector.Script(sourceID, sourceURL, source, startingLine, errorLine, errorMessage);
-
-        if (sourceURL in WebInspector.resourceURLMap) {
-            var resource = WebInspector.resourceURLMap[sourceURL];
-            resource.addScript(script);
-        }
-
-        if (sourceURL in this._breakpointsURLMap && sourceID) {
-            var breakpoints = this._breakpointsURLMap[sourceURL];
-            var breakpointsLength = breakpoints.length;
-            for (var i = 0; i < breakpointsLength; ++i) {
-                var breakpoint = breakpoints[i];
-                if (startingLine <= breakpoint.line) {
-                    breakpoint.sourceID = sourceID;
-                    if (breakpoint.enabled)
-                        InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
+        this._sourceIDMap[sourceID] = script;
+
+        var resource = WebInspector.resourceURLMap[sourceURL];
+        if (resource) {
+            if (resource.finished) {
+                // Resource is finished, bind the script right away.
+                resource.addScript(script);
+                this._sourceIDMap[sourceID] = resource;
+            } else {
+                // Resource is not finished, bind the script later.
+                if (!resource._scriptsPendingResourceLoad) {
+                    resource._scriptsPendingResourceLoad = [];
+                    resource.addEventListener("finished", this._resourceLoadingFinished, this);
                 }
+                resource._scriptsPendingResourceLoad.push(script);
             }
         }
-
-        if (sourceID)
-            this._sourceIDMap[sourceID] = (resource || script);
-
         this._addScriptToFilesMenu(script);
     },
 
-    scriptOrResourceForID: function(id)
+    _resourceLoadingFinished: function(e)
     {
-        return this._sourceIDMap[id];
+        var resource = e.target;
+        for (var i = 0; i < resource._scriptsPendingResourceLoad.length; ++i) {
+            // Bind script to resource.
+            var script = resource._scriptsPendingResourceLoad[i];
+            resource.addScript(script);
+            this._sourceIDMap[script.sourceID] = resource;
+
+            // Remove script from the files list.
+            script.filesSelectOption.parentElement.removeChild(script.filesSelectOption);
+            
+            // Move breakpoints to the resource's frame.
+            if (script._scriptView) {
+                var sourceFrame = script._scriptView.sourceFrame;
+                for (var j = 0; j < sourceFrame.breakpoints; ++j) {
+                    var resourceFrame = this._sourceFrameForScriptOrResource(resource);
+                    resourceFrame.addBreakpoint(sourceFrame.breakpoints[j]);
+                }
+            }
+        }
+        // Adding first script will add resource.
+        this._addScriptToFilesMenu(resource._scriptsPendingResourceLoad[0]);
+        delete resource._scriptsPendingResourceLoad;
     },
 
     addBreakpoint: function(breakpoint)
     {
+        if (!this.breakpointsActivated)
+            this._toggleBreakpointsClicked();
+
         this.sidebarPanes.breakpoints.addBreakpoint(breakpoint);
 
         var sourceFrame;
         if (breakpoint.url) {
-            if (!(breakpoint.url in this._breakpointsURLMap))
-                this._breakpointsURLMap[breakpoint.url] = [];
-            this._breakpointsURLMap[breakpoint.url].unshift(breakpoint);
-
-            if (breakpoint.url in WebInspector.resourceURLMap) {
-                var resource = WebInspector.resourceURLMap[breakpoint.url];
+            var resource = WebInspector.resourceURLMap[breakpoint.url];
+            if (resource && resource.finished)
                 sourceFrame = this._sourceFrameForScriptOrResource(resource);
-            }
         }
 
         if (breakpoint.sourceID && !sourceFrame) {
@@ -330,16 +334,10 @@ WebInspector.ScriptsPanel.prototype = {
         this.sidebarPanes.breakpoints.removeBreakpoint(breakpoint);
 
         var sourceFrame;
-        if (breakpoint.url && breakpoint.url in this._breakpointsURLMap) {
-            var breakpoints = this._breakpointsURLMap[breakpoint.url];
-            breakpoints.remove(breakpoint);
-            if (!breakpoints.length)
-                delete this._breakpointsURLMap[breakpoint.url];
-
-            if (breakpoint.url in WebInspector.resourceURLMap) {
-                var resource = WebInspector.resourceURLMap[breakpoint.url];
+        if (breakpoint.url) {
+            var resource = WebInspector.resourceURLMap[breakpoint.url];
+            if (resource && resource.finished)
                 sourceFrame = this._sourceFrameForScriptOrResource(resource);
-            }
         }
 
         if (breakpoint.sourceID && !sourceFrame) {
@@ -385,7 +383,7 @@ WebInspector.ScriptsPanel.prototype = {
             if (result)
                 callback(result.value, result.isException);
         }
-        InjectedScriptAccess.evaluateInCallFrame(callFrame.id, code, objectGroup, evalCallback);
+        InjectedScriptAccess.get(callFrame.injectedScriptId).evaluateInCallFrame(callFrame.id, code, objectGroup, evalCallback);
     },
 
     debuggerPaused: function(callFrames)
@@ -415,7 +413,7 @@ WebInspector.ScriptsPanel.prototype = {
     attachDebuggerWhenShown: function()
     {
         if (this.element.parentElement) {
-            InspectorController.enableDebugger(false);
+            InspectorBackend.enableDebugger(false);
         } else {
             this._attachDebuggerWhenShown = true;
         }
@@ -423,22 +421,30 @@ WebInspector.ScriptsPanel.prototype = {
 
     debuggerWasEnabled: function()
     {
-        this.reset();
+        if (this._debuggerEnabled)
+            return;
+
+        this._debuggerEnabled = true;
+        this.reset(true);
     },
 
     debuggerWasDisabled: function()
     {
-        this.reset();
+        if (!this._debuggerEnabled)
+            return;
+
+        this._debuggerEnabled = false;
+        this.reset(true);
     },
 
-    reset: function()
+    reset: function(preserveWorkers)
     {
         this.visibleView = null;
 
         delete this.currentQuery;
         this.searchCanceled();
 
-        if (!InspectorController.debuggerEnabled()) {
+        if (!this._debuggerEnabled) {
             this._paused = false;
             this._waitingToPause = false;
             this._stepping = false;
@@ -450,7 +456,7 @@ WebInspector.ScriptsPanel.prototype = {
         this._currentBackForwardIndex = -1;
         this._updateBackAndForwardButtons();
 
-        this._scriptsForURLsInFilesSelect = {};
+        this._resourceForURLInFilesSelect = {};
         this.filesSelectElement.removeChildren();
         this.functionsSelectElement.removeChildren();
         this.viewsContainerElement.removeChildren();
@@ -466,6 +472,9 @@ WebInspector.ScriptsPanel.prototype = {
         this._sourceIDMap = {};
         
         this.sidebarPanes.watchExpressions.refreshExpressions();
+        this.sidebarPanes.breakpoints.reset();
+        if (!preserveWorkers)
+            this.sidebarPanes.workers.reset();
     },
 
     get visibleView()
@@ -487,39 +496,61 @@ WebInspector.ScriptsPanel.prototype = {
             x.show(this.viewsContainerElement);
     },
 
-    canShowResource: function(resource)
+    viewRecreated: function(oldView, newView)
     {
-        return resource && resource.scripts.length && InspectorController.debuggerEnabled();
+        if (this._visibleView === oldView)
+            this._visibleView = newView;
     },
 
-    showScript: function(script, line)
+    canShowSourceLine: function(url, line)
     {
-        this._showScriptOrResource(script, line, true);
+        if (!this._debuggerEnabled)
+            return false;
+        return !!this._scriptOrResourceForURLAndLine(url, line);
     },
 
-    showResource: function(resource, line)
+    showSourceLine: function(url, line)
     {
-        this._showScriptOrResource(resource, line, true);
+        var scriptOrResource = this._scriptOrResourceForURLAndLine(url, line);
+        this._showScriptOrResource(scriptOrResource, {line: line, shouldHighlightLine: true});
+    },
+
+    _scriptOrResourceForURLAndLine: function(url, line) 
+    {
+        var scriptWithMatchingUrl = null;
+        for (var sourceID in this._sourceIDMap) {
+            var scriptOrResource = this._sourceIDMap[sourceID];
+            if (scriptOrResource instanceof WebInspector.Script) {
+                if (scriptOrResource.sourceURL !== url)
+                    continue;
+                scriptWithMatchingUrl = scriptOrResource;
+                if (scriptWithMatchingUrl.startingLine <= line && scriptWithMatchingUrl.startingLine + scriptWithMatchingUrl.linesCount > line)
+                    return scriptWithMatchingUrl;
+            } else {
+                var resource = scriptOrResource;
+                if (resource.url === url)
+                    return resource;
+            }
+        }
+        return scriptWithMatchingUrl;
     },
 
     showView: function(view)
     {
         if (!view)
             return;
-        this._showScriptOrResource((view.resource || view.script));
+        this._showScriptOrResource(view.resource || view.script);
     },
 
-    handleKeyEvent: function(event)
+    handleShortcut: function(event)
     {
         var shortcut = WebInspector.KeyboardShortcut.makeKeyFromEvent(event);
         var handler = this._shortcuts[shortcut];
         if (handler) {
             handler(event);
-            event.preventDefault();
             event.handled = true;
-        } else {
-            this.sidebarPanes.callstack.handleKeyEvent(event);
-        }
+        } else
+            this.sidebarPanes.callstack.handleShortcut(event);
     },
 
     scriptViewForScript: function(script)
@@ -558,17 +589,18 @@ WebInspector.ScriptsPanel.prototype = {
 
     _sourceFrameForScriptOrResource: function(scriptOrResource)
     {
-        if (scriptOrResource instanceof WebInspector.Resource) {
-            if (!WebInspector.panels.resources)
-                return null;
+        if (scriptOrResource instanceof WebInspector.Resource)
             return WebInspector.panels.resources.sourceFrameForResource(scriptOrResource);
-        }
         if (scriptOrResource instanceof WebInspector.Script)
             return this.sourceFrameForScript(scriptOrResource);
     },
 
-    _showScriptOrResource: function(scriptOrResource, line, shouldHighlightLine, fromBackForwardAction)
+    _showScriptOrResource: function(scriptOrResource, options)
     {
+        // options = {line:, shouldHighlightLine:, fromBackForwardAction:, initialLoad:}
+        if (!options) 
+            options = {};
+
         if (!scriptOrResource)
             return;
 
@@ -578,14 +610,12 @@ WebInspector.ScriptsPanel.prototype = {
                 return null;
             view = WebInspector.panels.resources.resourceViewForResource(scriptOrResource);
             view.headersVisible = false;
-
-            if (scriptOrResource.url in this._breakpointsURLMap) {
-                var sourceFrame = this._sourceFrameForScriptOrResource(scriptOrResource);
-                if (sourceFrame && !sourceFrame.breakpoints.length) {
-                    var breakpoints = this._breakpointsURLMap[scriptOrResource.url];
-                    var breakpointsLength = breakpoints.length;
-                    for (var i = 0; i < breakpointsLength; ++i)
-                        sourceFrame.addBreakpoint(breakpoints[i]);
+            var breakpoints = this.sidebarPanes.breakpoints.breakpoints;
+            for (var breakpointId in breakpoints) {
+                var breakpoint = breakpoints[breakpointId];
+                if (breakpoint.url === scriptOrResource.url) {
+                    var sourceFrame = this._sourceFrameForScriptOrResource(scriptOrResource);
+                    sourceFrame.addBreakpoint(breakpoint);
                 }
             }
         } else if (scriptOrResource instanceof WebInspector.Script)
@@ -594,7 +624,11 @@ WebInspector.ScriptsPanel.prototype = {
         if (!view)
             return;
 
-        if (!fromBackForwardAction) {
+        var url = scriptOrResource.url || scriptOrResource.sourceURL;
+        if (url && !options.initialLoad)
+            WebInspector.settings.lastViewedScriptFile = url;
+
+        if (!options.fromBackForwardAction) {
             var oldIndex = this._currentBackForwardIndex;
             if (oldIndex >= 0)
                 this._backForwardList.splice(oldIndex + 1, this._backForwardList.length - oldIndex);
@@ -615,57 +649,64 @@ WebInspector.ScriptsPanel.prototype = {
 
         this.visibleView = view;
 
-        if (line) {
+        if (options.line) {
             if (view.revealLine)
-                view.revealLine(line);
-            if (view.highlightLine && shouldHighlightLine)
-                view.highlightLine(line);
+                view.revealLine(options.line);
+            if (view.highlightLine && options.shouldHighlightLine)
+                view.highlightLine(options.line);
         }
 
         var option;
         if (scriptOrResource instanceof WebInspector.Script) {
             option = scriptOrResource.filesSelectOption;
+
+            // hasn't been added yet - happens for stepping in evals,
+            // so use the force option to force the script into the menu.
+            if (!option) {
+                this._addScriptToFilesMenu(scriptOrResource, true);
+                option = scriptOrResource.filesSelectOption;
+            }
+
             console.assert(option);
-        } else {
-            var url = scriptOrResource.url;
-            var script = this._scriptsForURLsInFilesSelect[url];
-            if (script)
-               option = script.filesSelectOption;
-        }
+        } else
+            option = scriptOrResource.filesSelectOption;
 
         if (option)
             this.filesSelectElement.selectedIndex = option.index;
     },
 
-    _addScriptToFilesMenu: function(script)
+    _addScriptToFilesMenu: function(script, force)
     {
-        if (script.resource && this._scriptsForURLsInFilesSelect[script.sourceURL])
+        if (!script.sourceURL && !force)
             return;
 
-        this._scriptsForURLsInFilesSelect[script.sourceURL] = script;
+        if (script.resource) {
+            if (this._resourceForURLInFilesSelect[script.resource.url])
+                return;
+            this._resourceForURLInFilesSelect[script.resource.url] = script.resource;
+        }
+ 
+        var displayName = script.sourceURL ? WebInspector.displayNameForURL(script.sourceURL) : WebInspector.UIString("(program)");
 
         var select = this.filesSelectElement;
-
         var option = document.createElement("option");
-        option.representedObject = (script.resource || script);
-        option.text = (script.sourceURL ? WebInspector.displayNameForURL(script.sourceURL) : WebInspector.UIString("(program)"));
+        option.representedObject = script.resource || script;
+        option.url = displayName;
+        option.startingLine = script.startingLine;
+        option.text = script.resource || script.startingLine === 1 ? displayName : String.sprintf("%s:%d", displayName, script.startingLine);
 
         function optionCompare(a, b)
         {
-            var aTitle = a.text.toLowerCase();
-            var bTitle = b.text.toLowerCase();
-            if (aTitle < bTitle)
+            if (a.url < b.url)
                 return -1;
-            else if (aTitle > bTitle)
+            else if (a.url > b.url)
                 return 1;
 
-            var aSourceID = a.representedObject.sourceID;
-            var bSourceID = b.representedObject.sourceID;
-            if (aSourceID < bSourceID)
+            if (typeof a.startingLine !== "number")
                 return -1;
-            else if (aSourceID > bSourceID)
-                return 1;
-            return 0;
+            if (typeof b.startingLine !== "number")
+                return -1;
+            return a.startingLine - b.startingLine;
         }
 
         var insertionIndex = insertionIndexForObjectInListSortedByFunction(option, select.childNodes, optionCompare);
@@ -674,12 +715,22 @@ WebInspector.ScriptsPanel.prototype = {
         else
             select.insertBefore(option, select.childNodes.item(insertionIndex));
 
-        script.filesSelectOption = option;
+        if (script.resource)
+            script.resource.filesSelectOption = option;
+        else
+            script.filesSelectOption = option;
 
         // Call _showScriptOrResource if the option we just appended ended up being selected.
         // This will happen for the first item added to the menu.
         if (select.options[select.selectedIndex] === option)
-            this._showScriptOrResource(option.representedObject);
+            this._showScriptOrResource(option.representedObject, {initialLoad: true});
+        else {
+            // if not first item, check to see if this was the last viewed
+            var url = option.representedObject.url || option.representedObject.sourceURL;
+            var lastURL = WebInspector.settings.lastViewedScriptFile;
+            if (url && url === lastURL)
+                this._showScriptOrResource(option.representedObject, {initialLoad: true});
+        }
     },
 
     _clearCurrentExecutionLine: function()
@@ -702,7 +753,7 @@ WebInspector.ScriptsPanel.prototype = {
         this.sidebarPanes.watchExpressions.refreshExpressions();
 
         var scriptOrResource = this._sourceIDMap[currentFrame.sourceID];
-        this._showScriptOrResource(scriptOrResource, currentFrame.line);
+        this._showScriptOrResource(scriptOrResource, {line: currentFrame.line});
 
         this._executionSourceFrame = this._sourceFrameForScriptOrResource(scriptOrResource);
         if (this._executionSourceFrame)
@@ -743,36 +794,36 @@ WebInspector.ScriptsPanel.prototype = {
         this.sidebarResizeWidgetElement.style.right = newWidth + "px";
         this.sidebarResizeElement.style.right = (newWidth - 3) + "px";
 
+        this.resize();
         event.preventDefault();
     },
-
-    _updatePauseOnExceptionsButton: function()
+    
+    updatePauseOnExceptionsState: function(pauseOnExceptionsState)
     {
-        if (InspectorController.pauseOnExceptions()) {
-            this.pauseOnExceptionButton.title = WebInspector.UIString("Don't pause on exceptions.");
-            this.pauseOnExceptionButton.toggled = true;
-        } else {
-            this.pauseOnExceptionButton.title = WebInspector.UIString("Pause on exceptions.");
-            this.pauseOnExceptionButton.toggled = false;
-        }
+        if (pauseOnExceptionsState == WebInspector.ScriptsPanel.PauseOnExceptionsState.DontPauseOnExceptions)
+            this._pauseOnExceptionButton.title = WebInspector.UIString("Don't pause on exceptions.\nClick to Pause on all exceptions.");
+        else if (pauseOnExceptionsState == WebInspector.ScriptsPanel.PauseOnExceptionsState.PauseOnAllExceptions)
+            this._pauseOnExceptionButton.title = WebInspector.UIString("Pause on all exceptions.\nClick to Pause on uncaught exceptions.");
+        else if (pauseOnExceptionsState == WebInspector.ScriptsPanel.PauseOnExceptionsState.PauseOnUncaughtExceptions)
+            this._pauseOnExceptionButton.title = WebInspector.UIString("Pause on uncaught exceptions.\nClick to Not pause on exceptions.");
+
+        this._pauseOnExceptionButton.state = pauseOnExceptionsState;
     },
 
     _updateDebuggerButtons: function()
     {
-        if (InspectorController.debuggerEnabled()) {
+        if (this._debuggerEnabled) {
             this.enableToggleButton.title = WebInspector.UIString("Debugging enabled. Click to disable.");
             this.enableToggleButton.toggled = true;
-            this.pauseOnExceptionButton.visible = true;
+            this._pauseOnExceptionButton.visible = true;
             this.panelEnablerView.visible = false;
         } else {
             this.enableToggleButton.title = WebInspector.UIString("Debugging disabled. Click to enable.");
             this.enableToggleButton.toggled = false;
-            this.pauseOnExceptionButton.visible = false;
+            this._pauseOnExceptionButton.visible = false;
             this.panelEnablerView.visible = true;
         }
 
-        this._updatePauseOnExceptionsButton();
-
         if (this._paused) {
             this.pauseButton.addStyleClass("paused");
 
@@ -821,7 +872,7 @@ WebInspector.ScriptsPanel.prototype = {
             return;
         }
 
-        this._showScriptOrResource(this._backForwardList[--this._currentBackForwardIndex], null, false, true);
+        this._showScriptOrResource(this._backForwardList[--this._currentBackForwardIndex], {fromBackForwardAction: true});
         this._updateBackAndForwardButtons();
     },
 
@@ -832,13 +883,13 @@ WebInspector.ScriptsPanel.prototype = {
             return;
         }
 
-        this._showScriptOrResource(this._backForwardList[++this._currentBackForwardIndex], null, false, true);
+        this._showScriptOrResource(this._backForwardList[++this._currentBackForwardIndex], {fromBackForwardAction: true});
         this._updateBackAndForwardButtons();
     },
 
     _enableDebugging: function()
     {
-        if (InspectorController.debuggerEnabled())
+        if (this._debuggerEnabled)
             return;
         this._toggleDebugging(this.panelEnablerView.alwaysEnabled);
     },
@@ -849,16 +900,15 @@ WebInspector.ScriptsPanel.prototype = {
         this._waitingToPause = false;
         this._stepping = false;
 
-        if (InspectorController.debuggerEnabled())
-            InspectorController.disableDebugger(true);
+        if (this._debuggerEnabled)
+            InspectorBackend.disableDebugger(true);
         else
-            InspectorController.enableDebugger(!!optionalAlways);
+            InspectorBackend.enableDebugger(!!optionalAlways);
     },
 
     _togglePauseOnExceptions: function()
     {
-        InspectorController.setPauseOnExceptions(!InspectorController.pauseOnExceptions());
-        this._updatePauseOnExceptionsButton();
+        InspectorBackend.setPauseOnExceptionsState((this._pauseOnExceptionButton.state + 1) % this._pauseOnExceptionButton.states);
     },
 
     _togglePause: function()
@@ -866,11 +916,11 @@ WebInspector.ScriptsPanel.prototype = {
         if (this._paused) {
             this._paused = false;
             this._waitingToPause = false;
-            InspectorController.resumeDebugger();
+            InspectorBackend.resumeDebugger();
         } else {
             this._stepping = false;
             this._waitingToPause = true;
-            InspectorController.pauseInDebugger();
+            InspectorBackend.pauseInDebugger();
         }
 
         this._clearInterface();
@@ -883,7 +933,7 @@ WebInspector.ScriptsPanel.prototype = {
 
         this._clearInterface();
 
-        InspectorController.stepOverStatementInDebugger();
+        InspectorBackend.stepOverStatementInDebugger();
     },
 
     _stepIntoClicked: function()
@@ -893,7 +943,7 @@ WebInspector.ScriptsPanel.prototype = {
 
         this._clearInterface();
 
-        InspectorController.stepIntoStatementInDebugger();
+        InspectorBackend.stepIntoStatementInDebugger();
     },
 
     _stepOutClicked: function()
@@ -903,7 +953,21 @@ WebInspector.ScriptsPanel.prototype = {
 
         this._clearInterface();
 
-        InspectorController.stepOutOfFunctionInDebugger();
+        InspectorBackend.stepOutOfFunctionInDebugger();
+    },
+
+    _toggleBreakpointsClicked: function()
+    {
+        this.toggleBreakpointsButton.toggled = !this.toggleBreakpointsButton.toggled;
+        if (this.toggleBreakpointsButton.toggled) {
+            InspectorBackend.activateBreakpoints();
+            this.toggleBreakpointsButton.title = WebInspector.UIString("Deactivate all breakpoints.");
+            document.getElementById("main-panels").removeStyleClass("breakpoints-deactivated");
+        } else {
+            InspectorBackend.deactivateBreakpoints();
+            this.toggleBreakpointsButton.title = WebInspector.UIString("Activate all breakpoints.");
+            document.getElementById("main-panels").addStyleClass("breakpoints-deactivated");
+        }
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Section.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Section.js
new file mode 100644
index 0000000000..77101928c4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Section.js
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.Section = function(title, subtitle)
+{
+    this.element = document.createElement("div");
+    this.element.className = "section";
+    this.element.sectionForTest = this;
+
+    this.headerElement = document.createElement("div");
+    this.headerElement.className = "header";
+
+    this.titleElement = document.createElement("div");
+    this.titleElement.className = "title";
+
+    this.subtitleElement = document.createElement("div");
+    this.subtitleElement.className = "subtitle";
+
+    this.headerElement.appendChild(this.subtitleElement);
+    this.headerElement.appendChild(this.titleElement);
+
+    this.headerElement.addEventListener("click", this.toggleExpanded.bind(this), false);
+    this.element.appendChild(this.headerElement);
+
+    this.title = title;
+    this.subtitle = subtitle;
+    this._expanded = false;
+}
+
+WebInspector.Section.prototype = {
+    get title()
+    {
+        return this._title;
+    },
+
+    set title(x)
+    {
+        if (this._title === x)
+            return;
+        this._title = x;
+
+        if (x instanceof Node) {
+            this.titleElement.removeChildren();
+            this.titleElement.appendChild(x);
+        } else
+          this.titleElement.textContent = x;
+    },
+
+    get subtitle()
+    {
+        return this._subtitle;
+    },
+
+    set subtitle(x)
+    {
+        if (this._subtitle === x)
+            return;
+        this._subtitle = x;
+        this.subtitleElement.innerHTML = x;
+    },
+
+    get expanded()
+    {
+        return this._expanded;
+    },
+
+    set expanded(x)
+    {
+        if (x)
+            this.expand();
+        else
+            this.collapse();
+    },
+
+    get populated()
+    {
+        return this._populated;
+    },
+
+    set populated(x)
+    {
+        this._populated = x;
+        if (!x && this.onpopulate && this._expanded) {
+            this.onpopulate(this);
+            this._populated = true;
+        }
+    },
+
+    expand: function()
+    {
+        if (this._expanded)
+            return;
+        this._expanded = true;
+        this.element.addStyleClass("expanded");
+
+        if (!this._populated && this.onpopulate) {
+            this.onpopulate(this);
+            this._populated = true;
+        }
+    },
+
+    collapse: function()
+    {
+        if (!this._expanded)
+            return;
+        this._expanded = false;
+        this.element.removeStyleClass("expanded");
+    },
+
+    toggleExpanded: function()
+    {
+        this.expanded = !this.expanded;
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Settings.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Settings.js
new file mode 100644
index 0000000000..b9b5f75714
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Settings.js
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+var Preferences = {
+    maxInlineTextChildLength: 80,
+    minConsoleHeight: 75,
+    minSidebarWidth: 100,
+    minElementsSidebarWidth: 200,
+    minScriptsSidebarWidth: 200,
+    styleRulesExpandedState: {},
+    showMissingLocalizedStrings: false,
+    samplingCPUProfiler: false,
+    showColorNicknames: true,
+    debuggerAlwaysEnabled: false,
+    profilerAlwaysEnabled: false,
+    auditsPanelEnabled: true
+}
+
+WebInspector.populateFrontendSettings = function(settingsString)
+{
+    WebInspector.settings._load(settingsString);
+}
+
+WebInspector.Settings = function()
+{
+}
+
+WebInspector.Settings.prototype = {
+    _load: function(settingsString)
+    {
+        try {
+            this._store = JSON.parse(settingsString);
+        } catch (e) {
+            // May fail;
+            this._store = {};
+        }
+
+        this._installSetting("eventListenersFilter", "event-listeners-filter", "all");
+        this._installSetting("colorFormat", "color-format", "hex");
+        this._installSetting("resourcesLargeRows", "resources-large-rows", true);
+        this._installSetting("watchExpressions", "watch-expressions", []);
+        this._installSetting("lastViewedScriptFile", "last-viewed-script-file");
+        this._installSetting("showInheritedComputedStyleProperties", "show-inherited-computed-style-properties", false);
+        this._installSetting("showUserAgentStyles", "show-user-agent-styles", true);
+        this._installSetting("resourceViewTab", "resource-view-tab", "content");
+        this._installSetting("consoleHistory", "console-history", []);
+        this.dispatchEventToListeners("loaded");
+    },
+
+    _installSetting: function(name, propertyName, defaultValue)
+    {
+        this.__defineGetter__(name, this._get.bind(this, propertyName));
+        this.__defineSetter__(name, this._set.bind(this, propertyName));
+        if (!(propertyName in this._store)) {
+            this._store[propertyName] = defaultValue;
+        }
+    },
+
+    _get: function(propertyName)
+    {
+        return this._store[propertyName];
+    },
+
+    _set: function(propertyName, newValue)
+    {
+        this._store[propertyName] = newValue;
+        try {
+            InspectorBackend.saveFrontendSettings(JSON.stringify(this._store));
+        } catch (e) {
+            // May fail;
+        }
+    }
+}
+
+WebInspector.Settings.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SidebarPane.js
index af9e5f90b8..855894c64d 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/SidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SidebarPane.js
@@ -33,7 +33,9 @@ WebInspector.SidebarPane = function(title)
 
     this.titleElement = document.createElement("div");
     this.titleElement.className = "title";
+    this.titleElement.tabIndex = 0;
     this.titleElement.addEventListener("click", this.toggleExpanded.bind(this), false);
+    this.titleElement.addEventListener("keydown", this._onTitleKeyDown.bind(this), false);
 
     this.bodyElement = document.createElement("div");
     this.bodyElement.className = "body";
@@ -119,6 +121,12 @@ WebInspector.SidebarPane.prototype = {
     toggleExpanded: function()
     {
         this.expanded = !this.expanded;
+    },
+
+    _onTitleKeyDown: function(event)
+    {
+        if (isEnterKey(event) || event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Space)
+            this.toggleExpanded();
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceCSSTokenizer.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceCSSTokenizer.js
new file mode 100644
index 0000000000..f7d7d51764
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceCSSTokenizer.js
@@ -0,0 +1,1473 @@
+/* Generated by re2c 0.13.5 on Thu Feb 25 21:44:55 2010 */
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Generate js file as follows:
+//
+// re2c -isc WebCore/inspector/front-end/SourceCSSTokenizer.re2js \
+// | sed 's|^yy\([^:]*\)*\:|case \1:|' \
+// | sed 's|[*]cursor[+][+]|this._charAt(cursor++)|' \
+// | sed 's|[[*][+][+]cursor|this._charAt(++cursor)|' \
+// | sed 's|[*]cursor|this._charAt(cursor)|' \
+// | sed 's|yych = \*\([^;]*\)|yych = this._charAt\1|' \
+// | sed 's|{ gotoCase = \([^; continue; };]*\)|{ gotoCase = \1; continue; }|' \
+// | sed 's|unsigned\ int|var|' \
+// | sed 's|var\ yych|case 1: case 1: var yych|'
+
+WebInspector.SourceCSSTokenizer = function()
+{
+    WebInspector.SourceTokenizer.call(this);
+
+    this._propertyKeywords = [
+        "background", "background-attachment", "background-clip", "background-color", "background-image",
+        "background-origin", "background-position", "background-position-x", "background-position-y",
+        "background-repeat", "background-repeat-x", "background-repeat-y", "background-size", "border",
+        "border-bottom", "border-bottom-color", "border-bottom-left-radius", "border-bottom-right-radius",
+        "border-bottom-style", "border-bottom-width", "border-collapse", "border-color", "border-left",
+        "border-left-color", "border-left-style", "border-left-width", "border-radius", "border-right",
+        "border-right-color", "border-right-style", "border-right-width", "border-spacing", "border-style",
+        "border-top", "border-top-color", "border-top-left-radius", "border-top-right-radius", "border-top-style",
+        "border-top-width", "border-width", "bottom", "caption-side", "clear", "clip", "color", "content",
+        "counter-increment", "counter-reset", "cursor", "direction", "display", "empty-cells", "float",
+        "font", "font-family", "font-size", "font-stretch", "font-style", "font-variant", "font-weight",
+        "height", "left", "letter-spacing", "line-height", "list-style", "list-style-image", "list-style-position",
+        "list-style-type", "margin", "margin-bottom", "margin-left", "margin-right", "margin-top", "max-height",
+        "max-width", "min-height", "min-width", "opacity", "orphans", "outline", "outline-color", "outline-offset",
+        "outline-style", "outline-width", "overflow", "overflow-x", "overflow-y", "padding", "padding-bottom",
+        "padding-left", "padding-right", "padding-top", "page", "page-break-after", "page-break-before",
+        "page-break-inside", "pointer-events", "position", "quotes", "resize", "right", "size", "src",
+        "table-layout", "text-align", "text-decoration", "text-indent", "text-line-through", "text-line-through-color",
+        "text-line-through-mode", "text-line-through-style", "text-line-through-width", "text-overflow", "text-overline",
+        "text-overline-color", "text-overline-mode", "text-overline-style", "text-overline-width", "text-rendering",
+        "text-shadow", "text-transform", "text-underline", "text-underline-color", "text-underline-mode",
+        "text-underline-style", "text-underline-width", "top", "unicode-bidi", "unicode-range", "vertical-align",
+        "visibility", "white-space", "widows", "width", "word-break", "word-spacing", "word-wrap", "z-index", "zoom",
+        "-webkit-animation", "-webkit-animation-delay", "-webkit-animation-direction", "-webkit-animation-duration",
+        "-webkit-animation-iteration-count", "-webkit-animation-name", "-webkit-animation-play-state",
+        "-webkit-animation-timing-function", "-webkit-appearance", "-webkit-backface-visibility",
+        "-webkit-background-clip", "-webkit-background-composite", "-webkit-background-origin", "-webkit-background-size",
+        "-webkit-binding", "-webkit-border-fit", "-webkit-border-horizontal-spacing", "-webkit-border-image",
+        "-webkit-border-radius", "-webkit-border-vertical-spacing", "-webkit-box-align", "-webkit-box-direction",
+        "-webkit-box-flex", "-webkit-box-flex-group", "-webkit-box-lines", "-webkit-box-ordinal-group",
+        "-webkit-box-orient", "-webkit-box-pack", "-webkit-box-reflect", "-webkit-box-shadow", "-webkit-box-sizing",
+        "-webkit-column-break-after", "-webkit-column-break-before", "-webkit-column-break-inside", "-webkit-column-count",
+        "-webkit-column-gap", "-webkit-column-rule", "-webkit-column-rule-color", "-webkit-column-rule-style",
+        "-webkit-column-rule-width", "-webkit-column-width", "-webkit-columns", "-webkit-font-size-delta",
+        "-webkit-font-smoothing", "-webkit-highlight", "-webkit-line-break", "-webkit-line-clamp",
+        "-webkit-margin-bottom-collapse", "-webkit-margin-collapse", "-webkit-margin-start", "-webkit-margin-top-collapse",
+        "-webkit-marquee", "-webkit-marquee-direction", "-webkit-marquee-increment", "-webkit-marquee-repetition",
+        "-webkit-marquee-speed", "-webkit-marquee-style", "-webkit-mask", "-webkit-mask-attachment",
+        "-webkit-mask-box-image", "-webkit-mask-clip", "-webkit-mask-composite", "-webkit-mask-image",
+        "-webkit-mask-origin", "-webkit-mask-position", "-webkit-mask-position-x", "-webkit-mask-position-y",
+        "-webkit-mask-repeat", "-webkit-mask-repeat-x", "-webkit-mask-repeat-y", "-webkit-mask-size",
+        "-webkit-match-nearest-mail-blockquote-color", "-webkit-nbsp-mode", "-webkit-padding-start",
+        "-webkit-perspective", "-webkit-perspective-origin", "-webkit-perspective-origin-x", "-webkit-perspective-origin-y",
+        "-webkit-rtl-ordering", "-webkit-text-decorations-in-effect", "-webkit-text-fill-color", "-webkit-text-security",
+        "-webkit-text-size-adjust", "-webkit-text-stroke", "-webkit-text-stroke-color", "-webkit-text-stroke-width",
+        "-webkit-transform", "-webkit-transform-origin", "-webkit-transform-origin-x", "-webkit-transform-origin-y",
+        "-webkit-transform-origin-z", "-webkit-transform-style", "-webkit-transition", "-webkit-transition-delay",
+        "-webkit-transition-duration", "-webkit-transition-property", "-webkit-transition-timing-function",
+        "-webkit-user-drag", "-webkit-user-modify", "-webkit-user-select", "-webkit-variable-declaration-block"
+    ].keySet();
+    
+    this._valueKeywords = [
+        "above", "absolute", "activeborder", "activecaption", "afar", "after-white-space", "ahead", "alias", "all", "all-scroll",
+        "alternate", "always","amharic", "amharic-abegede", "antialiased", "appworkspace", "aqua", "arabic-indic", "armenian",
+        "auto", "avoid", "background", "backwards", "baseline", "below", "bidi-override", "binary", "bengali", "black", "blink",
+        "block", "block-axis", "blue", "bold", "bolder", "border", "border-box", "both", "bottom", "break-all", "break-word", "button",
+        "button-bevel", "buttonface", "buttonhighlight", "buttonshadow", "buttontext", "cambodian", "capitalize", "caps-lock-indicator",
+        "caption", "captiontext", "caret", "cell", "center", "checkbox", "circle", "cjk-earthly-branch", "cjk-heavenly-stem", "cjk-ideographic",
+        "clear", "clip", "close-quote", "col-resize", "collapse", "compact", "condensed", "contain", "content", "content-box", "context-menu",
+        "continuous", "copy", "cover", "crop", "cross", "crosshair", "currentcolor", "cursive", "dashed", "decimal", "decimal-leading-zero", "default",
+        "default-button", "destination-atop", "destination-in", "destination-out", "destination-over", "devanagari", "disc", "discard", "document",
+        "dot-dash", "dot-dot-dash", "dotted", "double", "down", "e-resize", "ease", "ease-in", "ease-in-out", "ease-out", "element",
+        "ellipsis", "embed", "end", "ethiopic", "ethiopic-abegede", "ethiopic-abegede-am-et", "ethiopic-abegede-gez",
+        "ethiopic-abegede-ti-er", "ethiopic-abegede-ti-et", "ethiopic-halehame-aa-er", "ethiopic-halehame-aa-et",
+        "ethiopic-halehame-am-et", "ethiopic-halehame-gez", "ethiopic-halehame-om-et", "ethiopic-halehame-sid-et",
+        "ethiopic-halehame-so-et", "ethiopic-halehame-ti-er", "ethiopic-halehame-ti-et", "ethiopic-halehame-tig", "ew-resize", "expanded",
+        "extra-condensed", "extra-expanded", "fantasy", "fast", "fill", "fixed", "flat", "forwards", "from", "fuchsia", "geometricPrecision",
+        "georgian", "gray", "graytext", "green", "grey", "groove", "gujarati", "gurmukhi", "hand", "hangul", "hangul-consonant", "hebrew", "help",
+        "hidden", "hide", "higher", "highlight", "highlighttext", "hiragana", "hiragana-iroha", "horizontal", "hsl", "hsla", "icon", "ignore",
+        "inactiveborder", "inactivecaption", "inactivecaptiontext", "infinite", "infobackground", "infotext", "inherit", "initial", "inline",
+        "inline-axis", "inline-block", "inline-table", "inset", "inside", "intrinsic", "invert", "italic", "justify", "kannada", "katakana",
+        "katakana-iroha", "khmer", "landscape", "lao", "large", "larger", "left", "level", "lighter", "lime", "line-through", "linear", "lines",
+        "list-button", "list-item", "listbox", "listitem", "local", "logical", "loud", "lower", "lower-alpha", "lower-greek", "lower-hexadecimal", "lower-latin",
+        "lower-norwegian", "lower-roman", "lowercase", "ltr", "malayalam", "maroon", "match", "media-controls-background", "media-current-time-display",
+        "media-fullscreen-button", "media-mute-button", "media-play-button", "media-return-to-realtime-button", "media-rewind-button",
+        "media-seek-back-button", "media-seek-forward-button", "media-slider", "media-sliderthumb", "media-time-remaining-display",
+        "media-volume-slider", "media-volume-slider-container", "media-volume-sliderthumb", "medium", "menu", "menulist", "menulist-button",
+        "menulist-text", "menulist-textfield", "menutext", "message-box", "middle", "min-intrinsic", "mix", "mongolian", "monospace", "move", "multiple",
+        "myanmar", "n-resize", "narrower", "navy", "ne-resize", "nesw-resize", "no-close-quote", "no-drop", "no-open-quote", "no-repeat", "none",
+        "normal", "not-allowed", "nowrap", "ns-resize", "nw-resize", "nwse-resize", "oblique", "octal", "olive", "open-quote", "optimizeLegibility",
+        "optimizeSpeed", "orange", "oriya", "oromo", "outset", "outside", "overlay", "overline", "padding", "padding-box", "painted", "paused",
+        "persian", "plus-darker", "plus-lighter", "pointer", "portrait", "pre", "pre-line", "pre-wrap", "preserve-3d", "progress", "purple",
+        "push-button", "radio", "read-only", "read-write", "read-write-plaintext-only", "red", "relative", "repeat", "repeat-x",
+        "repeat-y", "reset", "reverse", "rgb", "rgba", "ridge", "right", "round", "row-resize", "rtl", "run-in", "running", "s-resize", "sans-serif",
+        "scroll", "scrollbar", "se-resize", "searchfield", "searchfield-cancel-button", "searchfield-decoration", "searchfield-results-button",
+        "searchfield-results-decoration", "semi-condensed", "semi-expanded", "separate", "serif", "show", "sidama", "silver", "single",
+        "skip-white-space", "slide", "slider-horizontal", "slider-vertical", "sliderthumb-horizontal", "sliderthumb-vertical", "slow",
+        "small", "small-caps", "small-caption", "smaller", "solid", "somali", "source-atop", "source-in", "source-out", "source-over",
+        "space", "square", "square-button", "start", "static", "status-bar", "stretch", "stroke", "sub", "subpixel-antialiased", "super",
+        "sw-resize", "table", "table-caption", "table-cell", "table-column", "table-column-group", "table-footer-group", "table-header-group",
+        "table-row", "table-row-group", "teal", "telugu", "text", "text-bottom", "text-top", "textarea", "textfield", "thai", "thick", "thin",
+        "threeddarkshadow", "threedface", "threedhighlight", "threedlightshadow", "threedshadow", "tibetan", "tigre", "tigrinya-er", "tigrinya-er-abegede",
+        "tigrinya-et", "tigrinya-et-abegede", "to", "top", "transparent", "ultra-condensed", "ultra-expanded", "underline", "up", "upper-alpha", "upper-greek",
+        "upper-hexadecimal", "upper-latin", "upper-norwegian", "upper-roman", "uppercase", "urdu", "url", "vertical", "vertical-text", "visible",
+        "visibleFill", "visiblePainted", "visibleStroke", "visual", "w-resize", "wait", "wave", "white", "wider", "window", "windowframe", "windowtext",
+        "x-large", "x-small", "xor", "xx-large", "xx-small", "yellow", "-wap-marquee", "-webkit-activelink", "-webkit-auto", "-webkit-baseline-middle",
+        "-webkit-body", "-webkit-box", "-webkit-center", "-webkit-control", "-webkit-focus-ring-color", "-webkit-grab", "-webkit-grabbing",
+        "-webkit-gradient", "-webkit-inline-box", "-webkit-left", "-webkit-link", "-webkit-marquee", "-webkit-mini-control", "-webkit-nowrap", "-webkit-right",
+        "-webkit-small-control", "-webkit-text", "-webkit-xxx-large", "-webkit-zoom-in", "-webkit-zoom-out",
+    ].keySet();
+
+    this._mediaTypes = ["all", "aural", "braille", "embossed", "handheld", "import", "print", "projection", "screen", "tty", "tv"].keySet();
+
+    this._lexConditions = {
+        INITIAL: 0,
+        COMMENT: 1,
+        DSTRING: 2,
+        SSTRING: 3
+    };
+
+    this._parseConditions = {
+        INITIAL: 0,
+        PROPERTY: 1,
+        PROPERTY_VALUE: 2,
+        AT_RULE: 3
+    };
+
+    this.case_INITIAL = 1000;
+    this.case_COMMENT = 1002;
+    this.case_DSTRING = 1003;
+    this.case_SSTRING = 1004;
+
+    this.initialCondition = { lexCondition: this._lexConditions.INITIAL, parseCondition: this._parseConditions.INITIAL }
+}
+
+WebInspector.SourceCSSTokenizer.prototype = {
+    _stringToken: function(cursor, stringEnds)
+    {
+        if (this._isPropertyValue())
+            this.tokenType = "css-string";
+        else
+            this.tokenType = null;
+        return cursor;
+    },
+
+    _isPropertyValue: function()
+    {
+        return this._condition.parseCondition === this._parseConditions.PROPERTY_VALUE || this._condition.parseCondition === this._parseConditions.AT_RULE;
+    },
+
+    nextToken: function(cursor)
+    {
+        var cursorOnEnter = cursor;
+        var gotoCase = 1;
+        while (1) {
+            switch (gotoCase)
+            // Following comment is replaced with generated state machine.
+            
+        {
+            case 1: var yych;
+            var yyaccept = 0;
+            if (this.getLexCondition() < 2) {
+                if (this.getLexCondition() < 1) {
+                    { gotoCase = this.case_INITIAL; continue; };
+                } else {
+                    { gotoCase = this.case_COMMENT; continue; };
+                }
+            } else {
+                if (this.getLexCondition() < 3) {
+                    { gotoCase = this.case_DSTRING; continue; };
+                } else {
+                    { gotoCase = this.case_SSTRING; continue; };
+                }
+            }
+/* *********************************** */
+case this.case_COMMENT:
+
+            yych = this._charAt(cursor);
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 4; continue; };
+                { gotoCase = 3; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 4; continue; };
+                if (yych == '*') { gotoCase = 6; continue; };
+                { gotoCase = 3; continue; };
+            }
+case 2:
+            { this.tokenType = "css-comment"; return cursor; }
+case 3:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            { gotoCase = 12; continue; };
+case 4:
+            ++cursor;
+            { this.tokenType = null; return cursor; }
+case 6:
+            yyaccept = 1;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych == '*') { gotoCase = 9; continue; };
+            if (yych != '/') { gotoCase = 11; continue; };
+case 7:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.INITIAL);
+            { this.tokenType = "css-comment"; return cursor; }
+case 9:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '*') { gotoCase = 9; continue; };
+            if (yych == '/') { gotoCase = 7; continue; };
+case 11:
+            yyaccept = 0;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+case 12:
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 2; continue; };
+                { gotoCase = 11; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 2; continue; };
+                if (yych == '*') { gotoCase = 9; continue; };
+                { gotoCase = 11; continue; };
+            }
+/* *********************************** */
+case this.case_DSTRING:
+            yych = this._charAt(cursor);
+            if (yych <= '\r') {
+                if (yych == '\n') { gotoCase = 17; continue; };
+                if (yych <= '\f') { gotoCase = 16; continue; };
+                { gotoCase = 17; continue; };
+            } else {
+                if (yych <= '"') {
+                    if (yych <= '!') { gotoCase = 16; continue; };
+                    { gotoCase = 19; continue; };
+                } else {
+                    if (yych == '\\') { gotoCase = 21; continue; };
+                    { gotoCase = 16; continue; };
+                }
+            }
+case 15:
+            { return this._stringToken(cursor); }
+case 16:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            { gotoCase = 23; continue; };
+case 17:
+            ++cursor;
+case 18:
+            { this.tokenType = null; return cursor; }
+case 19:
+            ++cursor;
+case 20:
+            this.setLexCondition(this._lexConditions.INITIAL);
+            { return this._stringToken(cursor, true); }
+case 21:
+            yych = this._charAt(++cursor);
+            if (yych <= 'e') {
+                if (yych <= '\'') {
+                    if (yych == '"') { gotoCase = 22; continue; };
+                    if (yych <= '&') { gotoCase = 18; continue; };
+                } else {
+                    if (yych <= '\\') {
+                        if (yych <= '[') { gotoCase = 18; continue; };
+                    } else {
+                        if (yych != 'b') { gotoCase = 18; continue; };
+                    }
+                }
+            } else {
+                if (yych <= 'r') {
+                    if (yych <= 'm') {
+                        if (yych >= 'g') { gotoCase = 18; continue; };
+                    } else {
+                        if (yych <= 'n') { gotoCase = 22; continue; };
+                        if (yych <= 'q') { gotoCase = 18; continue; };
+                    }
+                } else {
+                    if (yych <= 't') {
+                        if (yych <= 's') { gotoCase = 18; continue; };
+                    } else {
+                        if (yych != 'v') { gotoCase = 18; continue; };
+                    }
+                }
+            }
+case 22:
+            yyaccept = 0;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+case 23:
+            if (yych <= '\r') {
+                if (yych == '\n') { gotoCase = 15; continue; };
+                if (yych <= '\f') { gotoCase = 22; continue; };
+                { gotoCase = 15; continue; };
+            } else {
+                if (yych <= '"') {
+                    if (yych <= '!') { gotoCase = 22; continue; };
+                    { gotoCase = 26; continue; };
+                } else {
+                    if (yych != '\\') { gotoCase = 22; continue; };
+                }
+            }
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'e') {
+                if (yych <= '\'') {
+                    if (yych == '"') { gotoCase = 22; continue; };
+                    if (yych >= '\'') { gotoCase = 22; continue; };
+                } else {
+                    if (yych <= '\\') {
+                        if (yych >= '\\') { gotoCase = 22; continue; };
+                    } else {
+                        if (yych == 'b') { gotoCase = 22; continue; };
+                    }
+                }
+            } else {
+                if (yych <= 'r') {
+                    if (yych <= 'm') {
+                        if (yych <= 'f') { gotoCase = 22; continue; };
+                    } else {
+                        if (yych <= 'n') { gotoCase = 22; continue; };
+                        if (yych >= 'r') { gotoCase = 22; continue; };
+                    }
+                } else {
+                    if (yych <= 't') {
+                        if (yych >= 't') { gotoCase = 22; continue; };
+                    } else {
+                        if (yych == 'v') { gotoCase = 22; continue; };
+                    }
+                }
+            }
+            cursor = YYMARKER;
+            { gotoCase = 15; continue; };
+case 26:
+            ++cursor;
+            yych = this._charAt(cursor);
+            { gotoCase = 20; continue; };
+/* *********************************** */
+case this.case_INITIAL:
+            yych = this._charAt(cursor);
+            if (yych <= ';') {
+                if (yych <= '\'') {
+                    if (yych <= '"') {
+                        if (yych <= ' ') { gotoCase = 29; continue; };
+                        if (yych <= '!') { gotoCase = 31; continue; };
+                        { gotoCase = 33; continue; };
+                    } else {
+                        if (yych == '$') { gotoCase = 31; continue; };
+                        if (yych >= '\'') { gotoCase = 34; continue; };
+                    }
+                } else {
+                    if (yych <= '.') {
+                        if (yych <= ',') { gotoCase = 29; continue; };
+                        if (yych <= '-') { gotoCase = 35; continue; };
+                        { gotoCase = 36; continue; };
+                    } else {
+                        if (yych <= '/') { gotoCase = 37; continue; };
+                        if (yych <= '9') { gotoCase = 38; continue; };
+                        if (yych <= ':') { gotoCase = 40; continue; };
+                        { gotoCase = 42; continue; };
+                    }
+                }
+            } else {
+                if (yych <= '^') {
+                    if (yych <= '?') {
+                        if (yych == '=') { gotoCase = 31; continue; };
+                    } else {
+                        if (yych == '\\') { gotoCase = 29; continue; };
+                        if (yych <= ']') { gotoCase = 31; continue; };
+                    }
+                } else {
+                    if (yych <= 'z') {
+                        if (yych != '`') { gotoCase = 31; continue; };
+                    } else {
+                        if (yych <= '{') { gotoCase = 44; continue; };
+                        if (yych == '}') { gotoCase = 46; continue; };
+                    }
+                }
+            }
+case 29:
+            ++cursor;
+case 30:
+            { this.tokenType = null; return cursor; }
+case 31:
+            ++cursor;
+            yych = this._charAt(cursor);
+            { gotoCase = 49; continue; };
+case 32:
+            {
+                    var token = this._line.substring(cursorOnEnter, cursor);
+                    if (this._condition.parseCondition === this._parseConditions.INITIAL) {
+                        if (token === "@import" || token === "@media") {
+                            this.tokenType = "css-at-rule";
+                            this._condition.parseCondition = this._parseConditions.AT_RULE;
+                        } else if (token.indexOf("@") === 0)
+                            this.tokenType = "css-at-rule";
+                        else
+                            this.tokenType = "css-selector";
+                    }
+                    else if (this._condition.parseCondition === this._parseConditions.AT_RULE && token in this._mediaTypes)
+                        this.tokenType = "css-keyword";
+                    else if (this._condition.parseCondition === this._parseConditions.PROPERTY && token in this._propertyKeywords)
+                        this.tokenType = "css-property";
+                    else if (this._isPropertyValue() && token in this._valueKeywords)
+                        this.tokenType = "css-keyword";
+                    else if (token === "!important")
+                        this.tokenType = "css-important";
+                    else
+                        this.tokenType = null;
+                    return cursor;
+                }
+case 33:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych <= '-') {
+                if (yych <= '!') {
+                    if (yych <= '\f') {
+                        if (yych == '\n') { gotoCase = 32; continue; };
+                        { gotoCase = 124; continue; };
+                    } else {
+                        if (yych <= '\r') { gotoCase = 32; continue; };
+                        if (yych <= ' ') { gotoCase = 124; continue; };
+                        { gotoCase = 122; continue; };
+                    }
+                } else {
+                    if (yych <= '$') {
+                        if (yych <= '"') { gotoCase = 114; continue; };
+                        if (yych <= '#') { gotoCase = 124; continue; };
+                        { gotoCase = 122; continue; };
+                    } else {
+                        if (yych == '\'') { gotoCase = 122; continue; };
+                        if (yych <= ',') { gotoCase = 124; continue; };
+                        { gotoCase = 122; continue; };
+                    }
+                }
+            } else {
+                if (yych <= '[') {
+                    if (yych <= '<') {
+                        if (yych <= '.') { gotoCase = 124; continue; };
+                        if (yych <= '9') { gotoCase = 122; continue; };
+                        { gotoCase = 124; continue; };
+                    } else {
+                        if (yych <= '=') { gotoCase = 122; continue; };
+                        if (yych <= '?') { gotoCase = 124; continue; };
+                        { gotoCase = 122; continue; };
+                    }
+                } else {
+                    if (yych <= '^') {
+                        if (yych <= '\\') { gotoCase = 126; continue; };
+                        if (yych <= ']') { gotoCase = 122; continue; };
+                        { gotoCase = 124; continue; };
+                    } else {
+                        if (yych == '`') { gotoCase = 124; continue; };
+                        if (yych <= 'z') { gotoCase = 122; continue; };
+                        { gotoCase = 124; continue; };
+                    }
+                }
+            }
+case 34:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych <= '-') {
+                if (yych <= '"') {
+                    if (yych <= '\f') {
+                        if (yych == '\n') { gotoCase = 32; continue; };
+                        { gotoCase = 116; continue; };
+                    } else {
+                        if (yych <= '\r') { gotoCase = 32; continue; };
+                        if (yych <= ' ') { gotoCase = 116; continue; };
+                        { gotoCase = 112; continue; };
+                    }
+                } else {
+                    if (yych <= '&') {
+                        if (yych == '$') { gotoCase = 112; continue; };
+                        { gotoCase = 116; continue; };
+                    } else {
+                        if (yych <= '\'') { gotoCase = 114; continue; };
+                        if (yych <= ',') { gotoCase = 116; continue; };
+                        { gotoCase = 112; continue; };
+                    }
+                }
+            } else {
+                if (yych <= '[') {
+                    if (yych <= '<') {
+                        if (yych <= '.') { gotoCase = 116; continue; };
+                        if (yych <= '9') { gotoCase = 112; continue; };
+                        { gotoCase = 116; continue; };
+                    } else {
+                        if (yych <= '=') { gotoCase = 112; continue; };
+                        if (yych <= '?') { gotoCase = 116; continue; };
+                        { gotoCase = 112; continue; };
+                    }
+                } else {
+                    if (yych <= '^') {
+                        if (yych <= '\\') { gotoCase = 118; continue; };
+                        if (yych <= ']') { gotoCase = 112; continue; };
+                        { gotoCase = 116; continue; };
+                    } else {
+                        if (yych == '`') { gotoCase = 116; continue; };
+                        if (yych <= 'z') { gotoCase = 112; continue; };
+                        { gotoCase = 116; continue; };
+                    }
+                }
+            }
+case 35:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych == '.') { gotoCase = 65; continue; };
+            if (yych <= '/') { gotoCase = 49; continue; };
+            if (yych <= '9') { gotoCase = 50; continue; };
+            { gotoCase = 49; continue; };
+case 36:
+            yych = this._charAt(++cursor);
+            if (yych <= '/') { gotoCase = 30; continue; };
+            if (yych <= '9') { gotoCase = 68; continue; };
+            { gotoCase = 30; continue; };
+case 37:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych == '*') { gotoCase = 104; continue; };
+            { gotoCase = 49; continue; };
+case 38:
+            yyaccept = 1;
+            yych = this._charAt(YYMARKER = ++cursor);
+            switch (yych) {
+            case '!':
+            case '"':
+            case '$':
+            case '\'':
+            case '-':
+            case '/':
+            case '=':
+            case '@':
+            case 'A':
+            case 'B':
+            case 'C':
+            case 'D':
+            case 'E':
+            case 'F':
+            case 'G':
+            case 'I':
+            case 'J':
+            case 'K':
+            case 'L':
+            case 'M':
+            case 'N':
+            case 'O':
+            case 'P':
+            case 'Q':
+            case 'R':
+            case 'S':
+            case 'T':
+            case 'U':
+            case 'V':
+            case 'W':
+            case 'X':
+            case 'Y':
+            case 'Z':
+            case '[':
+            case ']':
+            case 'a':
+            case 'b':
+            case 'f':
+            case 'h':
+            case 'j':
+            case 'l':
+            case 'n':
+            case 'o':
+            case 'q':
+            case 'u':
+            case 'v':
+            case 'w':
+            case 'x':
+            case 'y':
+            case 'z':    { gotoCase = 48; continue; };
+            case '%':    { gotoCase = 67; continue; };
+            case '.':    { gotoCase = 65; continue; };
+            case '0':
+            case '1':
+            case '2':
+            case '3':
+            case '4':
+            case '5':
+            case '6':
+            case '7':
+            case '8':
+            case '9':    { gotoCase = 50; continue; };
+            case 'H':    { gotoCase = 52; continue; };
+            case '_':    { gotoCase = 53; continue; };
+            case 'c':    { gotoCase = 54; continue; };
+            case 'd':    { gotoCase = 55; continue; };
+            case 'e':    { gotoCase = 56; continue; };
+            case 'g':    { gotoCase = 57; continue; };
+            case 'i':    { gotoCase = 58; continue; };
+            case 'k':    { gotoCase = 59; continue; };
+            case 'm':    { gotoCase = 60; continue; };
+            case 'p':    { gotoCase = 61; continue; };
+            case 'r':    { gotoCase = 62; continue; };
+            case 's':    { gotoCase = 63; continue; };
+            case 't':    { gotoCase = 64; continue; };
+            default:    { gotoCase = 39; continue; };
+            }
+case 39:
+            {
+                    if (this._isPropertyValue())
+                        this.tokenType = "css-number";
+                    else
+                        this.tokenType = null;
+                    return cursor;
+                }
+case 40:
+            ++cursor;
+            {
+                    this.tokenType = null;
+                    if (this._condition.parseCondition === this._parseConditions.PROPERTY)
+                        this._condition.parseCondition = this._parseConditions.PROPERTY_VALUE;
+                    return cursor;
+                }
+case 42:
+            ++cursor;
+            {
+                    this.tokenType = null;
+                    if (this._condition.parseCondition === this._parseConditions.AT_RULE)
+                        this._condition.parseCondition = this._parseConditions.INITIAL;
+                    else
+                        this._condition.parseCondition = this._parseConditions.PROPERTY;
+                    return cursor;
+                }
+case 44:
+            ++cursor;
+            {
+                    this.tokenType = null;
+                    if (this._condition.parseCondition === this._parseConditions.AT_RULE)
+                        this._condition.parseCondition = this._parseConditions.INITIAL;
+                    else
+                        this._condition.parseCondition = this._parseConditions.PROPERTY;
+                    return cursor;
+                }
+case 46:
+            ++cursor;
+            {
+                    this.tokenType = null;
+                    this._condition.parseCondition = this._parseConditions.INITIAL;
+                    return cursor;
+                }
+case 48:
+            ++cursor;
+            yych = this._charAt(cursor);
+case 49:
+            if (yych <= '9') {
+                if (yych <= '&') {
+                    if (yych <= '"') {
+                        if (yych <= ' ') { gotoCase = 32; continue; };
+                        { gotoCase = 48; continue; };
+                    } else {
+                        if (yych == '$') { gotoCase = 48; continue; };
+                        { gotoCase = 32; continue; };
+                    }
+                } else {
+                    if (yych <= ',') {
+                        if (yych <= '\'') { gotoCase = 48; continue; };
+                        { gotoCase = 32; continue; };
+                    } else {
+                        if (yych == '.') { gotoCase = 32; continue; };
+                        { gotoCase = 48; continue; };
+                    }
+                }
+            } else {
+                if (yych <= '\\') {
+                    if (yych <= '=') {
+                        if (yych <= '<') { gotoCase = 32; continue; };
+                        { gotoCase = 48; continue; };
+                    } else {
+                        if (yych <= '?') { gotoCase = 32; continue; };
+                        if (yych <= '[') { gotoCase = 48; continue; };
+                        { gotoCase = 32; continue; };
+                    }
+                } else {
+                    if (yych <= '_') {
+                        if (yych == '^') { gotoCase = 32; continue; };
+                        { gotoCase = 48; continue; };
+                    } else {
+                        if (yych <= '`') { gotoCase = 32; continue; };
+                        if (yych <= 'z') { gotoCase = 48; continue; };
+                        { gotoCase = 32; continue; };
+                    }
+                }
+            }
+case 50:
+            yyaccept = 1;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+            switch (yych) {
+            case '!':
+            case '"':
+            case '$':
+            case '\'':
+            case '-':
+            case '/':
+            case '=':
+            case '@':
+            case 'A':
+            case 'B':
+            case 'C':
+            case 'D':
+            case 'E':
+            case 'F':
+            case 'G':
+            case 'I':
+            case 'J':
+            case 'K':
+            case 'L':
+            case 'M':
+            case 'N':
+            case 'O':
+            case 'P':
+            case 'Q':
+            case 'R':
+            case 'S':
+            case 'T':
+            case 'U':
+            case 'V':
+            case 'W':
+            case 'X':
+            case 'Y':
+            case 'Z':
+            case '[':
+            case ']':
+            case 'a':
+            case 'b':
+            case 'f':
+            case 'h':
+            case 'j':
+            case 'l':
+            case 'n':
+            case 'o':
+            case 'q':
+            case 'u':
+            case 'v':
+            case 'w':
+            case 'x':
+            case 'y':
+            case 'z':    { gotoCase = 48; continue; };
+            case '%':    { gotoCase = 67; continue; };
+            case '.':    { gotoCase = 65; continue; };
+            case '0':
+            case '1':
+            case '2':
+            case '3':
+            case '4':
+            case '5':
+            case '6':
+            case '7':
+            case '8':
+            case '9':    { gotoCase = 50; continue; };
+            case 'H':    { gotoCase = 52; continue; };
+            case '_':    { gotoCase = 53; continue; };
+            case 'c':    { gotoCase = 54; continue; };
+            case 'd':    { gotoCase = 55; continue; };
+            case 'e':    { gotoCase = 56; continue; };
+            case 'g':    { gotoCase = 57; continue; };
+            case 'i':    { gotoCase = 58; continue; };
+            case 'k':    { gotoCase = 59; continue; };
+            case 'm':    { gotoCase = 60; continue; };
+            case 'p':    { gotoCase = 61; continue; };
+            case 'r':    { gotoCase = 62; continue; };
+            case 's':    { gotoCase = 63; continue; };
+            case 't':    { gotoCase = 64; continue; };
+            default:    { gotoCase = 39; continue; };
+            }
+case 52:
+            yych = this._charAt(++cursor);
+            if (yych == 'z') { gotoCase = 63; continue; };
+            { gotoCase = 49; continue; };
+case 53:
+            yych = this._charAt(++cursor);
+            if (yych == '_') { gotoCase = 101; continue; };
+            { gotoCase = 49; continue; };
+case 54:
+            yych = this._charAt(++cursor);
+            if (yych == 'm') { gotoCase = 63; continue; };
+            { gotoCase = 49; continue; };
+case 55:
+            yych = this._charAt(++cursor);
+            if (yych == 'e') { gotoCase = 100; continue; };
+            { gotoCase = 49; continue; };
+case 56:
+            yych = this._charAt(++cursor);
+            if (yych == 'm') { gotoCase = 63; continue; };
+            if (yych == 'x') { gotoCase = 63; continue; };
+            { gotoCase = 49; continue; };
+case 57:
+            yych = this._charAt(++cursor);
+            if (yych == 'r') { gotoCase = 98; continue; };
+            { gotoCase = 49; continue; };
+case 58:
+            yych = this._charAt(++cursor);
+            if (yych == 'n') { gotoCase = 63; continue; };
+            { gotoCase = 49; continue; };
+case 59:
+            yych = this._charAt(++cursor);
+            if (yych == 'H') { gotoCase = 97; continue; };
+            { gotoCase = 49; continue; };
+case 60:
+            yych = this._charAt(++cursor);
+            if (yych == 'm') { gotoCase = 63; continue; };
+            if (yych == 's') { gotoCase = 63; continue; };
+            { gotoCase = 49; continue; };
+case 61:
+            yych = this._charAt(++cursor);
+            if (yych <= 's') {
+                if (yych == 'c') { gotoCase = 63; continue; };
+                { gotoCase = 49; continue; };
+            } else {
+                if (yych <= 't') { gotoCase = 63; continue; };
+                if (yych == 'x') { gotoCase = 63; continue; };
+                { gotoCase = 49; continue; };
+            }
+case 62:
+            yych = this._charAt(++cursor);
+            if (yych == 'a') { gotoCase = 95; continue; };
+            if (yych == 'e') { gotoCase = 96; continue; };
+            { gotoCase = 49; continue; };
+case 63:
+            yych = this._charAt(++cursor);
+            if (yych <= '9') {
+                if (yych <= '&') {
+                    if (yych <= '"') {
+                        if (yych <= ' ') { gotoCase = 39; continue; };
+                        { gotoCase = 48; continue; };
+                    } else {
+                        if (yych == '$') { gotoCase = 48; continue; };
+                        { gotoCase = 39; continue; };
+                    }
+                } else {
+                    if (yych <= ',') {
+                        if (yych <= '\'') { gotoCase = 48; continue; };
+                        { gotoCase = 39; continue; };
+                    } else {
+                        if (yych == '.') { gotoCase = 39; continue; };
+                        { gotoCase = 48; continue; };
+                    }
+                }
+            } else {
+                if (yych <= '\\') {
+                    if (yych <= '=') {
+                        if (yych <= '<') { gotoCase = 39; continue; };
+                        { gotoCase = 48; continue; };
+                    } else {
+                        if (yych <= '?') { gotoCase = 39; continue; };
+                        if (yych <= '[') { gotoCase = 48; continue; };
+                        { gotoCase = 39; continue; };
+                    }
+                } else {
+                    if (yych <= '_') {
+                        if (yych == '^') { gotoCase = 39; continue; };
+                        { gotoCase = 48; continue; };
+                    } else {
+                        if (yych <= '`') { gotoCase = 39; continue; };
+                        if (yych <= 'z') { gotoCase = 48; continue; };
+                        { gotoCase = 39; continue; };
+                    }
+                }
+            }
+case 64:
+            yych = this._charAt(++cursor);
+            if (yych == 'u') { gotoCase = 93; continue; };
+            { gotoCase = 49; continue; };
+case 65:
+            yych = this._charAt(++cursor);
+            if (yych <= '/') { gotoCase = 66; continue; };
+            if (yych <= '9') { gotoCase = 68; continue; };
+case 66:
+            cursor = YYMARKER;
+            if (yyaccept <= 0) {
+                { gotoCase = 32; continue; };
+            } else {
+                { gotoCase = 39; continue; };
+            }
+case 67:
+            yych = this._charAt(++cursor);
+            { gotoCase = 39; continue; };
+case 68:
+            yyaccept = 1;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'f') {
+                if (yych <= 'H') {
+                    if (yych <= '/') {
+                        if (yych == '%') { gotoCase = 67; continue; };
+                        { gotoCase = 39; continue; };
+                    } else {
+                        if (yych <= '9') { gotoCase = 68; continue; };
+                        if (yych <= 'G') { gotoCase = 39; continue; };
+                        { gotoCase = 80; continue; };
+                    }
+                } else {
+                    if (yych <= 'b') {
+                        if (yych == '_') { gotoCase = 72; continue; };
+                        { gotoCase = 39; continue; };
+                    } else {
+                        if (yych <= 'c') { gotoCase = 74; continue; };
+                        if (yych <= 'd') { gotoCase = 77; continue; };
+                        if (yych >= 'f') { gotoCase = 39; continue; };
+                    }
+                }
+            } else {
+                if (yych <= 'm') {
+                    if (yych <= 'i') {
+                        if (yych <= 'g') { gotoCase = 78; continue; };
+                        if (yych <= 'h') { gotoCase = 39; continue; };
+                        { gotoCase = 76; continue; };
+                    } else {
+                        if (yych == 'k') { gotoCase = 81; continue; };
+                        if (yych <= 'l') { gotoCase = 39; continue; };
+                        { gotoCase = 75; continue; };
+                    }
+                } else {
+                    if (yych <= 'q') {
+                        if (yych == 'p') { gotoCase = 73; continue; };
+                        { gotoCase = 39; continue; };
+                    } else {
+                        if (yych <= 'r') { gotoCase = 71; continue; };
+                        if (yych <= 's') { gotoCase = 67; continue; };
+                        if (yych <= 't') { gotoCase = 79; continue; };
+                        { gotoCase = 39; continue; };
+                    }
+                }
+            }
+            yych = this._charAt(++cursor);
+            if (yych == 'm') { gotoCase = 67; continue; };
+            if (yych == 'x') { gotoCase = 67; continue; };
+            { gotoCase = 66; continue; };
+case 71:
+            yych = this._charAt(++cursor);
+            if (yych == 'a') { gotoCase = 91; continue; };
+            if (yych == 'e') { gotoCase = 92; continue; };
+            { gotoCase = 66; continue; };
+case 72:
+            yych = this._charAt(++cursor);
+            if (yych == '_') { gotoCase = 88; continue; };
+            { gotoCase = 66; continue; };
+case 73:
+            yych = this._charAt(++cursor);
+            if (yych <= 's') {
+                if (yych == 'c') { gotoCase = 67; continue; };
+                { gotoCase = 66; continue; };
+            } else {
+                if (yych <= 't') { gotoCase = 67; continue; };
+                if (yych == 'x') { gotoCase = 67; continue; };
+                { gotoCase = 66; continue; };
+            }
+case 74:
+            yych = this._charAt(++cursor);
+            if (yych == 'm') { gotoCase = 67; continue; };
+            { gotoCase = 66; continue; };
+case 75:
+            yych = this._charAt(++cursor);
+            if (yych == 'm') { gotoCase = 67; continue; };
+            if (yych == 's') { gotoCase = 67; continue; };
+            { gotoCase = 66; continue; };
+case 76:
+            yych = this._charAt(++cursor);
+            if (yych == 'n') { gotoCase = 67; continue; };
+            { gotoCase = 66; continue; };
+case 77:
+            yych = this._charAt(++cursor);
+            if (yych == 'e') { gotoCase = 87; continue; };
+            { gotoCase = 66; continue; };
+case 78:
+            yych = this._charAt(++cursor);
+            if (yych == 'r') { gotoCase = 85; continue; };
+            { gotoCase = 66; continue; };
+case 79:
+            yych = this._charAt(++cursor);
+            if (yych == 'u') { gotoCase = 83; continue; };
+            { gotoCase = 66; continue; };
+case 80:
+            yych = this._charAt(++cursor);
+            if (yych == 'z') { gotoCase = 67; continue; };
+            { gotoCase = 66; continue; };
+case 81:
+            yych = this._charAt(++cursor);
+            if (yych != 'H') { gotoCase = 66; continue; };
+            yych = this._charAt(++cursor);
+            if (yych == 'z') { gotoCase = 67; continue; };
+            { gotoCase = 66; continue; };
+case 83:
+            yych = this._charAt(++cursor);
+            if (yych != 'r') { gotoCase = 66; continue; };
+            yych = this._charAt(++cursor);
+            if (yych == 'n') { gotoCase = 67; continue; };
+            { gotoCase = 66; continue; };
+case 85:
+            yych = this._charAt(++cursor);
+            if (yych != 'a') { gotoCase = 66; continue; };
+            yych = this._charAt(++cursor);
+            if (yych == 'd') { gotoCase = 67; continue; };
+            { gotoCase = 66; continue; };
+case 87:
+            yych = this._charAt(++cursor);
+            if (yych == 'g') { gotoCase = 67; continue; };
+            { gotoCase = 66; continue; };
+case 88:
+            yych = this._charAt(++cursor);
+            if (yych != 'q') { gotoCase = 66; continue; };
+            yych = this._charAt(++cursor);
+            if (yych != 'e') { gotoCase = 66; continue; };
+            yych = this._charAt(++cursor);
+            if (yych == 'm') { gotoCase = 67; continue; };
+            { gotoCase = 66; continue; };
+case 91:
+            yych = this._charAt(++cursor);
+            if (yych == 'd') { gotoCase = 67; continue; };
+            { gotoCase = 66; continue; };
+case 92:
+            yych = this._charAt(++cursor);
+            if (yych == 'm') { gotoCase = 67; continue; };
+            { gotoCase = 66; continue; };
+case 93:
+            yych = this._charAt(++cursor);
+            if (yych != 'r') { gotoCase = 49; continue; };
+            yych = this._charAt(++cursor);
+            if (yych == 'n') { gotoCase = 63; continue; };
+            { gotoCase = 49; continue; };
+case 95:
+            yych = this._charAt(++cursor);
+            if (yych == 'd') { gotoCase = 63; continue; };
+            { gotoCase = 49; continue; };
+case 96:
+            yych = this._charAt(++cursor);
+            if (yych == 'm') { gotoCase = 63; continue; };
+            { gotoCase = 49; continue; };
+case 97:
+            yych = this._charAt(++cursor);
+            if (yych == 'z') { gotoCase = 63; continue; };
+            { gotoCase = 49; continue; };
+case 98:
+            yych = this._charAt(++cursor);
+            if (yych != 'a') { gotoCase = 49; continue; };
+            yych = this._charAt(++cursor);
+            if (yych == 'd') { gotoCase = 63; continue; };
+            { gotoCase = 49; continue; };
+case 100:
+            yych = this._charAt(++cursor);
+            if (yych == 'g') { gotoCase = 63; continue; };
+            { gotoCase = 49; continue; };
+case 101:
+            yych = this._charAt(++cursor);
+            if (yych != 'q') { gotoCase = 49; continue; };
+            yych = this._charAt(++cursor);
+            if (yych != 'e') { gotoCase = 49; continue; };
+            yych = this._charAt(++cursor);
+            if (yych == 'm') { gotoCase = 63; continue; };
+            { gotoCase = 49; continue; };
+case 104:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 108; continue; };
+                { gotoCase = 104; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 108; continue; };
+                if (yych != '*') { gotoCase = 104; continue; };
+            }
+case 106:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '*') { gotoCase = 106; continue; };
+            if (yych == '/') { gotoCase = 110; continue; };
+            { gotoCase = 104; continue; };
+case 108:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.COMMENT);
+            { this.tokenType = "css-comment"; return cursor; }
+case 110:
+            ++cursor;
+            { this.tokenType = "css-comment"; return cursor; }
+case 112:
+            yyaccept = 0;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '-') {
+                if (yych <= '"') {
+                    if (yych <= '\f') {
+                        if (yych == '\n') { gotoCase = 32; continue; };
+                        { gotoCase = 116; continue; };
+                    } else {
+                        if (yych <= '\r') { gotoCase = 32; continue; };
+                        if (yych <= ' ') { gotoCase = 116; continue; };
+                        { gotoCase = 112; continue; };
+                    }
+                } else {
+                    if (yych <= '&') {
+                        if (yych == '$') { gotoCase = 112; continue; };
+                        { gotoCase = 116; continue; };
+                    } else {
+                        if (yych <= '\'') { gotoCase = 114; continue; };
+                        if (yych <= ',') { gotoCase = 116; continue; };
+                        { gotoCase = 112; continue; };
+                    }
+                }
+            } else {
+                if (yych <= '[') {
+                    if (yych <= '<') {
+                        if (yych <= '.') { gotoCase = 116; continue; };
+                        if (yych <= '9') { gotoCase = 112; continue; };
+                        { gotoCase = 116; continue; };
+                    } else {
+                        if (yych <= '=') { gotoCase = 112; continue; };
+                        if (yych <= '?') { gotoCase = 116; continue; };
+                        { gotoCase = 112; continue; };
+                    }
+                } else {
+                    if (yych <= '^') {
+                        if (yych <= '\\') { gotoCase = 118; continue; };
+                        if (yych <= ']') { gotoCase = 112; continue; };
+                        { gotoCase = 116; continue; };
+                    } else {
+                        if (yych == '`') { gotoCase = 116; continue; };
+                        if (yych <= 'z') { gotoCase = 112; continue; };
+                        { gotoCase = 116; continue; };
+                    }
+                }
+            }
+case 114:
+            ++cursor;
+            if ((yych = this._charAt(cursor)) <= '9') {
+                if (yych <= '&') {
+                    if (yych <= '"') {
+                        if (yych >= '!') { gotoCase = 48; continue; };
+                    } else {
+                        if (yych == '$') { gotoCase = 48; continue; };
+                    }
+                } else {
+                    if (yych <= ',') {
+                        if (yych <= '\'') { gotoCase = 48; continue; };
+                    } else {
+                        if (yych != '.') { gotoCase = 48; continue; };
+                    }
+                }
+            } else {
+                if (yych <= '\\') {
+                    if (yych <= '=') {
+                        if (yych >= '=') { gotoCase = 48; continue; };
+                    } else {
+                        if (yych <= '?') { gotoCase = 115; continue; };
+                        if (yych <= '[') { gotoCase = 48; continue; };
+                    }
+                } else {
+                    if (yych <= '_') {
+                        if (yych != '^') { gotoCase = 48; continue; };
+                    } else {
+                        if (yych <= '`') { gotoCase = 115; continue; };
+                        if (yych <= 'z') { gotoCase = 48; continue; };
+                    }
+                }
+            }
+case 115:
+            { return this._stringToken(cursor, true); }
+case 116:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '\r') {
+                if (yych == '\n') { gotoCase = 66; continue; };
+                if (yych <= '\f') { gotoCase = 116; continue; };
+                { gotoCase = 66; continue; };
+            } else {
+                if (yych <= '\'') {
+                    if (yych <= '&') { gotoCase = 116; continue; };
+                    { gotoCase = 121; continue; };
+                } else {
+                    if (yych != '\\') { gotoCase = 116; continue; };
+                }
+            }
+case 118:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'a') {
+                if (yych <= '!') {
+                    if (yych <= '\n') {
+                        if (yych <= '\t') { gotoCase = 66; continue; };
+                    } else {
+                        if (yych != '\r') { gotoCase = 66; continue; };
+                    }
+                } else {
+                    if (yych <= '\'') {
+                        if (yych <= '"') { gotoCase = 116; continue; };
+                        if (yych <= '&') { gotoCase = 66; continue; };
+                        { gotoCase = 116; continue; };
+                    } else {
+                        if (yych == '\\') { gotoCase = 116; continue; };
+                        { gotoCase = 66; continue; };
+                    }
+                }
+            } else {
+                if (yych <= 'q') {
+                    if (yych <= 'f') {
+                        if (yych <= 'b') { gotoCase = 116; continue; };
+                        if (yych <= 'e') { gotoCase = 66; continue; };
+                        { gotoCase = 116; continue; };
+                    } else {
+                        if (yych == 'n') { gotoCase = 116; continue; };
+                        { gotoCase = 66; continue; };
+                    }
+                } else {
+                    if (yych <= 't') {
+                        if (yych == 's') { gotoCase = 66; continue; };
+                        { gotoCase = 116; continue; };
+                    } else {
+                        if (yych == 'v') { gotoCase = 116; continue; };
+                        { gotoCase = 66; continue; };
+                    }
+                }
+            }
+            ++cursor;
+            this.setLexCondition(this._lexConditions.SSTRING);
+            { return this._stringToken(cursor); }
+case 121:
+            yych = this._charAt(++cursor);
+            { gotoCase = 115; continue; };
+case 122:
+            yyaccept = 0;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '-') {
+                if (yych <= '!') {
+                    if (yych <= '\f') {
+                        if (yych == '\n') { gotoCase = 32; continue; };
+                    } else {
+                        if (yych <= '\r') { gotoCase = 32; continue; };
+                        if (yych >= '!') { gotoCase = 122; continue; };
+                    }
+                } else {
+                    if (yych <= '$') {
+                        if (yych <= '"') { gotoCase = 114; continue; };
+                        if (yych >= '$') { gotoCase = 122; continue; };
+                    } else {
+                        if (yych == '\'') { gotoCase = 122; continue; };
+                        if (yych >= '-') { gotoCase = 122; continue; };
+                    }
+                }
+            } else {
+                if (yych <= '[') {
+                    if (yych <= '<') {
+                        if (yych <= '.') { gotoCase = 124; continue; };
+                        if (yych <= '9') { gotoCase = 122; continue; };
+                    } else {
+                        if (yych <= '=') { gotoCase = 122; continue; };
+                        if (yych >= '@') { gotoCase = 122; continue; };
+                    }
+                } else {
+                    if (yych <= '^') {
+                        if (yych <= '\\') { gotoCase = 126; continue; };
+                        if (yych <= ']') { gotoCase = 122; continue; };
+                    } else {
+                        if (yych == '`') { gotoCase = 124; continue; };
+                        if (yych <= 'z') { gotoCase = 122; continue; };
+                    }
+                }
+            }
+case 124:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '\r') {
+                if (yych == '\n') { gotoCase = 66; continue; };
+                if (yych <= '\f') { gotoCase = 124; continue; };
+                { gotoCase = 66; continue; };
+            } else {
+                if (yych <= '"') {
+                    if (yych <= '!') { gotoCase = 124; continue; };
+                    { gotoCase = 121; continue; };
+                } else {
+                    if (yych != '\\') { gotoCase = 124; continue; };
+                }
+            }
+case 126:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'a') {
+                if (yych <= '!') {
+                    if (yych <= '\n') {
+                        if (yych <= '\t') { gotoCase = 66; continue; };
+                    } else {
+                        if (yych != '\r') { gotoCase = 66; continue; };
+                    }
+                } else {
+                    if (yych <= '\'') {
+                        if (yych <= '"') { gotoCase = 124; continue; };
+                        if (yych <= '&') { gotoCase = 66; continue; };
+                        { gotoCase = 124; continue; };
+                    } else {
+                        if (yych == '\\') { gotoCase = 124; continue; };
+                        { gotoCase = 66; continue; };
+                    }
+                }
+            } else {
+                if (yych <= 'q') {
+                    if (yych <= 'f') {
+                        if (yych <= 'b') { gotoCase = 124; continue; };
+                        if (yych <= 'e') { gotoCase = 66; continue; };
+                        { gotoCase = 124; continue; };
+                    } else {
+                        if (yych == 'n') { gotoCase = 124; continue; };
+                        { gotoCase = 66; continue; };
+                    }
+                } else {
+                    if (yych <= 't') {
+                        if (yych == 's') { gotoCase = 66; continue; };
+                        { gotoCase = 124; continue; };
+                    } else {
+                        if (yych == 'v') { gotoCase = 124; continue; };
+                        { gotoCase = 66; continue; };
+                    }
+                }
+            }
+            ++cursor;
+            this.setLexCondition(this._lexConditions.DSTRING);
+            { return this._stringToken(cursor); }
+/* *********************************** */
+case this.case_SSTRING:
+            yych = this._charAt(cursor);
+            if (yych <= '\r') {
+                if (yych == '\n') { gotoCase = 133; continue; };
+                if (yych <= '\f') { gotoCase = 132; continue; };
+                { gotoCase = 133; continue; };
+            } else {
+                if (yych <= '\'') {
+                    if (yych <= '&') { gotoCase = 132; continue; };
+                    { gotoCase = 135; continue; };
+                } else {
+                    if (yych == '\\') { gotoCase = 137; continue; };
+                    { gotoCase = 132; continue; };
+                }
+            }
+case 131:
+            { return this._stringToken(cursor); }
+case 132:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            { gotoCase = 139; continue; };
+case 133:
+            ++cursor;
+case 134:
+            { this.tokenType = null; return cursor; }
+case 135:
+            ++cursor;
+case 136:
+            this.setLexCondition(this._lexConditions.INITIAL);
+            { return this._stringToken(cursor, true); }
+case 137:
+            yych = this._charAt(++cursor);
+            if (yych <= 'e') {
+                if (yych <= '\'') {
+                    if (yych == '"') { gotoCase = 138; continue; };
+                    if (yych <= '&') { gotoCase = 134; continue; };
+                } else {
+                    if (yych <= '\\') {
+                        if (yych <= '[') { gotoCase = 134; continue; };
+                    } else {
+                        if (yych != 'b') { gotoCase = 134; continue; };
+                    }
+                }
+            } else {
+                if (yych <= 'r') {
+                    if (yych <= 'm') {
+                        if (yych >= 'g') { gotoCase = 134; continue; };
+                    } else {
+                        if (yych <= 'n') { gotoCase = 138; continue; };
+                        if (yych <= 'q') { gotoCase = 134; continue; };
+                    }
+                } else {
+                    if (yych <= 't') {
+                        if (yych <= 's') { gotoCase = 134; continue; };
+                    } else {
+                        if (yych != 'v') { gotoCase = 134; continue; };
+                    }
+                }
+            }
+case 138:
+            yyaccept = 0;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+case 139:
+            if (yych <= '\r') {
+                if (yych == '\n') { gotoCase = 131; continue; };
+                if (yych <= '\f') { gotoCase = 138; continue; };
+                { gotoCase = 131; continue; };
+            } else {
+                if (yych <= '\'') {
+                    if (yych <= '&') { gotoCase = 138; continue; };
+                    { gotoCase = 142; continue; };
+                } else {
+                    if (yych != '\\') { gotoCase = 138; continue; };
+                }
+            }
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'e') {
+                if (yych <= '\'') {
+                    if (yych == '"') { gotoCase = 138; continue; };
+                    if (yych >= '\'') { gotoCase = 138; continue; };
+                } else {
+                    if (yych <= '\\') {
+                        if (yych >= '\\') { gotoCase = 138; continue; };
+                    } else {
+                        if (yych == 'b') { gotoCase = 138; continue; };
+                    }
+                }
+            } else {
+                if (yych <= 'r') {
+                    if (yych <= 'm') {
+                        if (yych <= 'f') { gotoCase = 138; continue; };
+                    } else {
+                        if (yych <= 'n') { gotoCase = 138; continue; };
+                        if (yych >= 'r') { gotoCase = 138; continue; };
+                    }
+                } else {
+                    if (yych <= 't') {
+                        if (yych >= 't') { gotoCase = 138; continue; };
+                    } else {
+                        if (yych == 'v') { gotoCase = 138; continue; };
+                    }
+                }
+            }
+            cursor = YYMARKER;
+            { gotoCase = 131; continue; };
+case 142:
+            ++cursor;
+            yych = this._charAt(cursor);
+            { gotoCase = 136; continue; };
+        }
+
+        }
+    }
+}
+
+WebInspector.SourceCSSTokenizer.prototype.__proto__ = WebInspector.SourceTokenizer.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceCSSTokenizer.re2js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceCSSTokenizer.re2js
new file mode 100644
index 0000000000..6ba9f60004
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceCSSTokenizer.re2js
@@ -0,0 +1,318 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Generate js file as follows:
+//
+// re2c -isc WebCore/inspector/front-end/SourceCSSTokenizer.re2js \
+// | sed 's|^yy\([^:]*\)*\:|case \1:|' \
+// | sed 's|[*]cursor[+][+]|this._charAt(cursor++)|' \
+// | sed 's|[[*][+][+]cursor|this._charAt(++cursor)|' \
+// | sed 's|[*]cursor|this._charAt(cursor)|' \
+// | sed 's|yych = \*\([^;]*\)|yych = this._charAt\1|' \
+// | sed 's|goto case \([^;]*\)|{ gotoCase = \1; continue; }|' \
+// | sed 's|unsigned\ int|var|' \
+// | sed 's|var\ yych|case 1: var yych|'
+
+WebInspector.SourceCSSTokenizer = function()
+{
+    WebInspector.SourceTokenizer.call(this);
+
+    this._propertyKeywords = [
+        "background", "background-attachment", "background-clip", "background-color", "background-image",
+        "background-origin", "background-position", "background-position-x", "background-position-y",
+        "background-repeat", "background-repeat-x", "background-repeat-y", "background-size", "border",
+        "border-bottom", "border-bottom-color", "border-bottom-left-radius", "border-bottom-right-radius",
+        "border-bottom-style", "border-bottom-width", "border-collapse", "border-color", "border-left",
+        "border-left-color", "border-left-style", "border-left-width", "border-radius", "border-right",
+        "border-right-color", "border-right-style", "border-right-width", "border-spacing", "border-style",
+        "border-top", "border-top-color", "border-top-left-radius", "border-top-right-radius", "border-top-style",
+        "border-top-width", "border-width", "bottom", "caption-side", "clear", "clip", "color", "content",
+        "counter-increment", "counter-reset", "cursor", "direction", "display", "empty-cells", "float",
+        "font", "font-family", "font-size", "font-stretch", "font-style", "font-variant", "font-weight",
+        "height", "left", "letter-spacing", "line-height", "list-style", "list-style-image", "list-style-position",
+        "list-style-type", "margin", "margin-bottom", "margin-left", "margin-right", "margin-top", "max-height",
+        "max-width", "min-height", "min-width", "opacity", "orphans", "outline", "outline-color", "outline-offset",
+        "outline-style", "outline-width", "overflow", "overflow-x", "overflow-y", "padding", "padding-bottom",
+        "padding-left", "padding-right", "padding-top", "page", "page-break-after", "page-break-before",
+        "page-break-inside", "pointer-events", "position", "quotes", "resize", "right", "size", "src",
+        "table-layout", "text-align", "text-decoration", "text-indent", "text-line-through", "text-line-through-color",
+        "text-line-through-mode", "text-line-through-style", "text-line-through-width", "text-overflow", "text-overline",
+        "text-overline-color", "text-overline-mode", "text-overline-style", "text-overline-width", "text-rendering",
+        "text-shadow", "text-transform", "text-underline", "text-underline-color", "text-underline-mode",
+        "text-underline-style", "text-underline-width", "top", "unicode-bidi", "unicode-range", "vertical-align",
+        "visibility", "white-space", "widows", "width", "word-break", "word-spacing", "word-wrap", "z-index", "zoom",
+        "-webkit-animation", "-webkit-animation-delay", "-webkit-animation-direction", "-webkit-animation-duration",
+        "-webkit-animation-iteration-count", "-webkit-animation-name", "-webkit-animation-play-state",
+        "-webkit-animation-timing-function", "-webkit-appearance", "-webkit-backface-visibility",
+        "-webkit-background-clip", "-webkit-background-composite", "-webkit-background-origin", "-webkit-background-size",
+        "-webkit-binding", "-webkit-border-fit", "-webkit-border-horizontal-spacing", "-webkit-border-image",
+        "-webkit-border-radius", "-webkit-border-vertical-spacing", "-webkit-box-align", "-webkit-box-direction",
+        "-webkit-box-flex", "-webkit-box-flex-group", "-webkit-box-lines", "-webkit-box-ordinal-group",
+        "-webkit-box-orient", "-webkit-box-pack", "-webkit-box-reflect", "-webkit-box-shadow", "-webkit-box-sizing",
+        "-webkit-column-break-after", "-webkit-column-break-before", "-webkit-column-break-inside", "-webkit-column-count",
+        "-webkit-column-gap", "-webkit-column-rule", "-webkit-column-rule-color", "-webkit-column-rule-style",
+        "-webkit-column-rule-width", "-webkit-column-width", "-webkit-columns", "-webkit-font-size-delta",
+        "-webkit-font-smoothing", "-webkit-highlight", "-webkit-line-break", "-webkit-line-clamp",
+        "-webkit-margin-bottom-collapse", "-webkit-margin-collapse", "-webkit-margin-start", "-webkit-margin-top-collapse",
+        "-webkit-marquee", "-webkit-marquee-direction", "-webkit-marquee-increment", "-webkit-marquee-repetition",
+        "-webkit-marquee-speed", "-webkit-marquee-style", "-webkit-mask", "-webkit-mask-attachment",
+        "-webkit-mask-box-image", "-webkit-mask-clip", "-webkit-mask-composite", "-webkit-mask-image",
+        "-webkit-mask-origin", "-webkit-mask-position", "-webkit-mask-position-x", "-webkit-mask-position-y",
+        "-webkit-mask-repeat", "-webkit-mask-repeat-x", "-webkit-mask-repeat-y", "-webkit-mask-size",
+        "-webkit-match-nearest-mail-blockquote-color", "-webkit-nbsp-mode", "-webkit-padding-start",
+        "-webkit-perspective", "-webkit-perspective-origin", "-webkit-perspective-origin-x", "-webkit-perspective-origin-y",
+        "-webkit-rtl-ordering", "-webkit-text-decorations-in-effect", "-webkit-text-fill-color", "-webkit-text-security",
+        "-webkit-text-size-adjust", "-webkit-text-stroke", "-webkit-text-stroke-color", "-webkit-text-stroke-width",
+        "-webkit-transform", "-webkit-transform-origin", "-webkit-transform-origin-x", "-webkit-transform-origin-y",
+        "-webkit-transform-origin-z", "-webkit-transform-style", "-webkit-transition", "-webkit-transition-delay",
+        "-webkit-transition-duration", "-webkit-transition-property", "-webkit-transition-timing-function",
+        "-webkit-user-drag", "-webkit-user-modify", "-webkit-user-select", "-webkit-variable-declaration-block"
+    ].keySet();
+    
+    this._valueKeywords = [
+        "above", "absolute", "activeborder", "activecaption", "afar", "after-white-space", "ahead", "alias", "all", "all-scroll",
+        "alternate", "always","amharic", "amharic-abegede", "antialiased", "appworkspace", "aqua", "arabic-indic", "armenian",
+        "auto", "avoid", "background", "backwards", "baseline", "below", "bidi-override", "binary", "bengali", "black", "blink",
+        "block", "block-axis", "blue", "bold", "bolder", "border", "border-box", "both", "bottom", "break-all", "break-word", "button",
+        "button-bevel", "buttonface", "buttonhighlight", "buttonshadow", "buttontext", "cambodian", "capitalize", "caps-lock-indicator",
+        "caption", "captiontext", "caret", "cell", "center", "checkbox", "circle", "cjk-earthly-branch", "cjk-heavenly-stem", "cjk-ideographic",
+        "clear", "clip", "close-quote", "col-resize", "collapse", "compact", "condensed", "contain", "content", "content-box", "context-menu",
+        "continuous", "copy", "cover", "crop", "cross", "crosshair", "currentcolor", "cursive", "dashed", "decimal", "decimal-leading-zero", "default",
+        "default-button", "destination-atop", "destination-in", "destination-out", "destination-over", "devanagari", "disc", "discard", "document",
+        "dot-dash", "dot-dot-dash", "dotted", "double", "down", "e-resize", "ease", "ease-in", "ease-in-out", "ease-out", "element",
+        "ellipsis", "embed", "end", "ethiopic", "ethiopic-abegede", "ethiopic-abegede-am-et", "ethiopic-abegede-gez",
+        "ethiopic-abegede-ti-er", "ethiopic-abegede-ti-et", "ethiopic-halehame-aa-er", "ethiopic-halehame-aa-et",
+        "ethiopic-halehame-am-et", "ethiopic-halehame-gez", "ethiopic-halehame-om-et", "ethiopic-halehame-sid-et",
+        "ethiopic-halehame-so-et", "ethiopic-halehame-ti-er", "ethiopic-halehame-ti-et", "ethiopic-halehame-tig", "ew-resize", "expanded",
+        "extra-condensed", "extra-expanded", "fantasy", "fast", "fill", "fixed", "flat", "forwards", "from", "fuchsia", "geometricPrecision",
+        "georgian", "gray", "graytext", "green", "grey", "groove", "gujarati", "gurmukhi", "hand", "hangul", "hangul-consonant", "hebrew", "help",
+        "hidden", "hide", "higher", "highlight", "highlighttext", "hiragana", "hiragana-iroha", "horizontal", "hsl", "hsla", "icon", "ignore",
+        "inactiveborder", "inactivecaption", "inactivecaptiontext", "infinite", "infobackground", "infotext", "inherit", "initial", "inline",
+        "inline-axis", "inline-block", "inline-table", "inset", "inside", "intrinsic", "invert", "italic", "justify", "kannada", "katakana",
+        "katakana-iroha", "khmer", "landscape", "lao", "large", "larger", "left", "level", "lighter", "lime", "line-through", "linear", "lines",
+        "list-button", "list-item", "listbox", "listitem", "local", "logical", "loud", "lower", "lower-alpha", "lower-greek", "lower-hexadecimal", "lower-latin",
+        "lower-norwegian", "lower-roman", "lowercase", "ltr", "malayalam", "maroon", "match", "media-controls-background", "media-current-time-display",
+        "media-fullscreen-button", "media-mute-button", "media-play-button", "media-return-to-realtime-button", "media-rewind-button",
+        "media-seek-back-button", "media-seek-forward-button", "media-slider", "media-sliderthumb", "media-time-remaining-display",
+        "media-volume-slider", "media-volume-slider-container", "media-volume-sliderthumb", "medium", "menu", "menulist", "menulist-button",
+        "menulist-text", "menulist-textfield", "menutext", "message-box", "middle", "min-intrinsic", "mix", "mongolian", "monospace", "move", "multiple",
+        "myanmar", "n-resize", "narrower", "navy", "ne-resize", "nesw-resize", "no-close-quote", "no-drop", "no-open-quote", "no-repeat", "none",
+        "normal", "not-allowed", "nowrap", "ns-resize", "nw-resize", "nwse-resize", "oblique", "octal", "olive", "open-quote", "optimizeLegibility",
+        "optimizeSpeed", "orange", "oriya", "oromo", "outset", "outside", "overlay", "overline", "padding", "padding-box", "painted", "paused",
+        "persian", "plus-darker", "plus-lighter", "pointer", "portrait", "pre", "pre-line", "pre-wrap", "preserve-3d", "progress", "purple",
+        "push-button", "radio", "read-only", "read-write", "read-write-plaintext-only", "red", "relative", "repeat", "repeat-x",
+        "repeat-y", "reset", "reverse", "rgb", "rgba", "ridge", "right", "round", "row-resize", "rtl", "run-in", "running", "s-resize", "sans-serif",
+        "scroll", "scrollbar", "se-resize", "searchfield", "searchfield-cancel-button", "searchfield-decoration", "searchfield-results-button",
+        "searchfield-results-decoration", "semi-condensed", "semi-expanded", "separate", "serif", "show", "sidama", "silver", "single",
+        "skip-white-space", "slide", "slider-horizontal", "slider-vertical", "sliderthumb-horizontal", "sliderthumb-vertical", "slow",
+        "small", "small-caps", "small-caption", "smaller", "solid", "somali", "source-atop", "source-in", "source-out", "source-over",
+        "space", "square", "square-button", "start", "static", "status-bar", "stretch", "stroke", "sub", "subpixel-antialiased", "super",
+        "sw-resize", "table", "table-caption", "table-cell", "table-column", "table-column-group", "table-footer-group", "table-header-group",
+        "table-row", "table-row-group", "teal", "telugu", "text", "text-bottom", "text-top", "textarea", "textfield", "thai", "thick", "thin",
+        "threeddarkshadow", "threedface", "threedhighlight", "threedlightshadow", "threedshadow", "tibetan", "tigre", "tigrinya-er", "tigrinya-er-abegede",
+        "tigrinya-et", "tigrinya-et-abegede", "to", "top", "transparent", "ultra-condensed", "ultra-expanded", "underline", "up", "upper-alpha", "upper-greek",
+        "upper-hexadecimal", "upper-latin", "upper-norwegian", "upper-roman", "uppercase", "urdu", "url", "vertical", "vertical-text", "visible",
+        "visibleFill", "visiblePainted", "visibleStroke", "visual", "w-resize", "wait", "wave", "white", "wider", "window", "windowframe", "windowtext",
+        "x-large", "x-small", "xor", "xx-large", "xx-small", "yellow", "-wap-marquee", "-webkit-activelink", "-webkit-auto", "-webkit-baseline-middle",
+        "-webkit-body", "-webkit-box", "-webkit-center", "-webkit-control", "-webkit-focus-ring-color", "-webkit-grab", "-webkit-grabbing",
+        "-webkit-gradient", "-webkit-inline-box", "-webkit-left", "-webkit-link", "-webkit-marquee", "-webkit-mini-control", "-webkit-nowrap", "-webkit-right",
+        "-webkit-small-control", "-webkit-text", "-webkit-xxx-large", "-webkit-zoom-in", "-webkit-zoom-out",
+    ].keySet();
+
+    this._mediaTypes = ["all", "aural", "braille", "embossed", "handheld", "import", "print", "projection", "screen", "tty", "tv"].keySet();
+
+    this._lexConditions = {
+        INITIAL: 0,
+        COMMENT: 1,
+        DSTRING: 2,
+        SSTRING: 3
+    };
+
+    this._parseConditions = {
+        INITIAL: 0,
+        PROPERTY: 1,
+        PROPERTY_VALUE: 2,
+        AT_RULE: 3
+    };
+
+    this.case_INITIAL = 1000;
+    this.case_COMMENT = 1002;
+    this.case_DSTRING = 1003;
+    this.case_SSTRING = 1004;
+
+    this.initialCondition = { lexCondition: this._lexConditions.INITIAL, parseCondition: this._parseConditions.INITIAL }
+}
+
+WebInspector.SourceCSSTokenizer.prototype = {
+    _stringToken: function(cursor, stringEnds)
+    {
+        if (this._isPropertyValue())
+            this.tokenType = "css-string";
+        else
+            this.tokenType = null;
+        return cursor;
+    },
+
+    _isPropertyValue: function()
+    {
+        return this._condition.parseCondition === this._parseConditions.PROPERTY_VALUE || this._condition.parseCondition === this._parseConditions.AT_RULE;
+    },
+
+    nextToken: function(cursor)
+    {
+        var cursorOnEnter = cursor;
+        var gotoCase = 1;
+        while (1) {
+            switch (gotoCase)
+            // Following comment is replaced with generated state machine.
+            /*!re2c
+                re2c:define:YYCTYPE  = "var";
+                re2c:define:YYCURSOR = cursor;
+                re2c:define:YYGETCONDITION = "this.getLexCondition";
+                re2c:define:YYSETCONDITION = "this.setLexCondition";
+                re2c:condprefix = "case this.case_";
+                re2c:condenumprefix = "this._lexConditions.";
+                re2c:yyfill:enable = 0;
+                re2c:labelprefix = "case ";
+                re2c:indent:top = 2;
+                re2c:indent:string = "    ";
+
+                CommentContent = ([^*\r\n] | ("*"+[^/*]))*;
+                Comment = "/*" CommentContent "*"+ "/";
+                CommentStart = "/*" CommentContent [\r\n];
+                CommentEnd = CommentContent "*"+ "/";
+
+                OpenCurlyBracket = "{";
+                CloseCurlyBracket = "}";
+
+                Colon = ":";
+                Semicolon = ";";
+
+                NumericLiteral = "-"? ([0-9]+ | [0-9]* "." [0-9]+)  ("em" | "rem" | "__qem" | "ex" | "px" | "cm" | 
+                    "mm" | "in" | "pt" | "pc" | "deg" | "rad" | "grad" | "turn" | "ms" | "s" | "Hz" | "kHz" | "%")?;
+
+                Identifier = [@!_\-$0-9a-zA-Z\[\]='"/]+;
+
+                DoubleStringContent = ([^\r\n\"\\] | "\\" ['"\\bfnrtv])*;
+                SingleStringContent = ([^\r\n\'\\] | "\\" ['"\\bfnrtv])*;
+                StringLiteral = "\"" DoubleStringContent "\"" | "'" SingleStringContent "'";
+                DoubleStringStart = "\"" DoubleStringContent "\\" [\r\n];
+                DoubleStringEnd = DoubleStringContent "\"";
+                SingleStringStart = "'" SingleStringContent "\\" [\r\n];
+                SingleStringEnd = SingleStringContent "'";
+
+                <INITIAL> Comment { this.tokenType = "css-comment"; return cursor; }
+                <INITIAL> CommentStart => COMMENT { this.tokenType = "css-comment"; return cursor; }
+                <COMMENT> CommentContent => COMMENT { this.tokenType = "css-comment"; return cursor; }
+                <COMMENT> CommentEnd => INITIAL { this.tokenType = "css-comment"; return cursor; }
+
+                <INITIAL> StringLiteral { return this._stringToken(cursor, true); }
+                <INITIAL> DoubleStringStart => DSTRING { return this._stringToken(cursor); }
+                <DSTRING> DoubleStringContent => DSTRING { return this._stringToken(cursor); }
+                <DSTRING> DoubleStringEnd => INITIAL { return this._stringToken(cursor, true); }
+                <INITIAL> SingleStringStart => SSTRING { return this._stringToken(cursor); }
+                <SSTRING> SingleStringContent => SSTRING { return this._stringToken(cursor); }
+                <SSTRING> SingleStringEnd => INITIAL { return this._stringToken(cursor, true); }
+
+                <INITIAL> OpenCurlyBracket
+                {
+                    this.tokenType = null;
+                    if (this._condition.parseCondition === this._parseConditions.AT_RULE)
+                        this._condition.parseCondition = this._parseConditions.INITIAL;
+                    else
+                        this._condition.parseCondition = this._parseConditions.PROPERTY;
+                    return cursor;
+                }
+
+                <INITIAL> CloseCurlyBracket
+                {
+                    this.tokenType = null;
+                    this._condition.parseCondition = this._parseConditions.INITIAL;
+                    return cursor;
+                }
+
+                <INITIAL> Colon
+                {
+                    this.tokenType = null;
+                    if (this._condition.parseCondition === this._parseConditions.PROPERTY)
+                        this._condition.parseCondition = this._parseConditions.PROPERTY_VALUE;
+                    return cursor;
+                }
+
+                <INITIAL> Semicolon
+                {
+                    this.tokenType = null;
+                    if (this._condition.parseCondition === this._parseConditions.AT_RULE)
+                        this._condition.parseCondition = this._parseConditions.INITIAL;
+                    else
+                        this._condition.parseCondition = this._parseConditions.PROPERTY;
+                    return cursor;
+                }
+
+                <INITIAL> NumericLiteral
+                {
+                    if (this._isPropertyValue())
+                        this.tokenType = "css-number";
+                    else
+                        this.tokenType = null;
+                    return cursor;
+                }
+
+                <INITIAL> Identifier
+                {
+                    var token = this._line.substring(cursorOnEnter, cursor);
+                    if (this._condition.parseCondition === this._parseConditions.INITIAL) {
+                        if (token === "@import" || token === "@media") {
+                            this.tokenType = "css-at-rule";
+                            this._condition.parseCondition = this._parseConditions.AT_RULE;
+                        } else if (token.indexOf("@") === 0)
+                            this.tokenType = "css-at-rule";
+                        else
+                            this.tokenType = "css-selector";
+                    }
+                    else if (this._condition.parseCondition === this._parseConditions.AT_RULE && token in this._mediaTypes)
+                        this.tokenType = "css-keyword";
+                    else if (this._condition.parseCondition === this._parseConditions.PROPERTY && token in this._propertyKeywords)
+                        this.tokenType = "css-property";
+                    else if (this._isPropertyValue() && token in this._valueKeywords)
+                        this.tokenType = "css-keyword";
+                    else if (token === "!important")
+                        this.tokenType = "css-important";
+                    else
+                        this.tokenType = null;
+                    return cursor;
+                }
+                <*> [^] { this.tokenType = null; return cursor; }
+            */
+        }
+    }
+}
+
+WebInspector.SourceCSSTokenizer.prototype.__proto__ = WebInspector.SourceTokenizer.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
index 1c11f76b22..4873cc3688 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
@@ -1,45 +1,64 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- * Copyright (C) 2009 Joseph Pecoraro
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
+ * modification, are permitted provided that the following conditions are
+ * met:
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.SourceFrame = function(element, addBreakpointDelegate)
+WebInspector.SourceFrame = function(parentElement, addBreakpointDelegate, removeBreakpointDelegate)
 {
-    this.messages = [];
+    this._parentElement = parentElement;
+
+    this._textModel = new WebInspector.TextEditorModel();
+    this._textModel.replaceTabsWithSpaces = true;
+
+    this._messages = [];
+    this._rowMessages = {};
+    this._messageBubbles = {};
     this.breakpoints = [];
     this._shortcuts = {};
 
-    this.addBreakpointDelegate = addBreakpointDelegate;
+    this._loaded = false;
 
-    this.element = element || document.createElement("iframe");
-    this.element.addStyleClass("source-view-frame");
-    this.element.setAttribute("viewsource", "true");
-
-    this.element.addEventListener("load", this._loaded.bind(this), false);
+    this._addBreakpointDelegate = addBreakpointDelegate;
+    this._removeBreakpointDelegate = removeBreakpointDelegate;
+    this._popoverObjectGroup = "popover";
 }
 
 WebInspector.SourceFrame.prototype = {
+
+    set visible(visible)
+    {
+        this._visible = visible;
+        this._createViewerIfNeeded();
+        if (!visible && this._textViewer)
+            this._textViewer.freeCachedElements();
+            
+    },
+
     get executionLine()
     {
         return this._executionLine;
@@ -53,81 +72,26 @@ WebInspector.SourceFrame.prototype = {
         var previousLine = this._executionLine;
         this._executionLine = x;
 
-        this._updateExecutionLine(previousLine);
-    },
-
-    get autoSizesToFitContentHeight()
-    {
-        return this._autoSizesToFitContentHeight;
-    },
-
-    set autoSizesToFitContentHeight(x)
-    {
-        if (this._autoSizesToFitContentHeight === x)
-            return;
-
-        this._autoSizesToFitContentHeight = x;
-
-        if (this._autoSizesToFitContentHeight) {
-            this._windowResizeListener = this._windowResized.bind(this);
-            window.addEventListener("resize", this._windowResizeListener, false);
-            this.sizeToFitContentHeight();
-        } else {
-            this.element.style.removeProperty("height");
-            if (this.element.contentDocument)
-                this.element.contentDocument.body.removeStyleClass("webkit-height-sized-to-fit");
-            window.removeEventListener("resize", this._windowResizeListener, false);
-            delete this._windowResizeListener;
-        }
-    },
-
-    sourceRow: function(lineNumber)
-    {
-        if (!lineNumber || !this.element.contentDocument)
-            return;
-
-        var table = this.element.contentDocument.getElementsByTagName("table")[0];
-        if (!table)
-            return;
-
-        var rows = table.rows;
-
-        // Line numbers are a 1-based index, but the rows collection is 0-based.
-        --lineNumber;
-
-        return rows[lineNumber];
-    },
-
-    lineNumberForSourceRow: function(sourceRow)
-    {
-        // Line numbers are a 1-based index, but the rows collection is 0-based.
-        var lineNumber = 0;
-        while (sourceRow) {
-            ++lineNumber;
-            sourceRow = sourceRow.previousSibling;
-        }
-
-        return lineNumber;
+        if (this._textViewer)
+            this._updateExecutionLine(previousLine);
     },
 
     revealLine: function(lineNumber)
     {
-        if (!this._isContentLoaded()) {
+        if (this._textViewer)
+            this._textViewer.revealLine(lineNumber - 1, 0);
+        else
             this._lineNumberToReveal = lineNumber;
-            return;
-        }
-
-        var row = this.sourceRow(lineNumber);
-        if (row)
-            row.scrollIntoViewIfNeeded(true);
     },
 
     addBreakpoint: function(breakpoint)
     {
         this.breakpoints.push(breakpoint);
-        breakpoint.addEventListener("enabled", this._breakpointEnableChanged, this);
-        breakpoint.addEventListener("disabled", this._breakpointEnableChanged, this);
-        this._addBreakpointToSource(breakpoint);
+        breakpoint.addEventListener("enabled", this._breakpointChanged, this);
+        breakpoint.addEventListener("disabled", this._breakpointChanged, this);
+        breakpoint.addEventListener("condition-changed", this._breakpointChanged, this);
+        if (this._textViewer)
+            this._addBreakpointToSource(breakpoint);
     },
 
     removeBreakpoint: function(breakpoint)
@@ -135,7 +99,9 @@ WebInspector.SourceFrame.prototype = {
         this.breakpoints.remove(breakpoint);
         breakpoint.removeEventListener("enabled", null, this);
         breakpoint.removeEventListener("disabled", null, this);
-        this._removeBreakpointFromSource(breakpoint);
+        breakpoint.removeEventListener("condition-changed", null, this);
+        if (this._textViewer)
+            this._removeBreakpointFromSource(breakpoint);
     },
 
     addMessage: function(msg)
@@ -143,418 +109,223 @@ WebInspector.SourceFrame.prototype = {
         // Don't add the message if there is no message or valid line or if the msg isn't an error or warning.
         if (!msg.message || msg.line <= 0 || !msg.isErrorOrWarning())
             return;
-        this.messages.push(msg);
-        this._addMessageToSource(msg);
+        this._messages.push(msg)
+        if (this._textViewer)
+            this._addMessageToSource(msg);
     },
 
     clearMessages: function()
     {
-        this.messages = [];
-
-        if (!this.element.contentDocument)
-            return;
-
-        var bubbles = this.element.contentDocument.querySelectorAll(".webkit-html-message-bubble");
-        if (!bubbles)
-            return;
-
-        for (var i = 0; i < bubbles.length; ++i) {
-            var bubble = bubbles[i];
+        for (var line in this._messageBubbles) {
+            var bubble = this._messageBubbles[line];
             bubble.parentNode.removeChild(bubble);
         }
+
+        this._messages = [];
+        this._rowMessages = {};
+        this._messageBubbles = {};
+        if (this._textViewer)
+            this._textViewer.resize();
     },
 
     sizeToFitContentHeight: function()
     {
-        if (this.element.contentDocument) {
-            this.element.style.setProperty("height", this.element.contentDocument.body.offsetHeight + "px");
-            this.element.contentDocument.body.addStyleClass("webkit-height-sized-to-fit");
-        }
+        if (this._textViewer)
+            this._textViewer.revalidateDecorationsAndPaint();
     },
 
-    _highlightLineEnds: function(event)
+    setContent: function(mimeType, content, url)
     {
-        event.target.parentNode.removeStyleClass("webkit-highlighted-line");
+        this._loaded = true;
+        this._textModel.setText(null, content);
+        this._mimeType = mimeType;
+        this._url = url;
+        this._createViewerIfNeeded();
     },
 
-    highlightLine: function(lineNumber)
+    highlightLine: function(line)
     {
-        if (!this._isContentLoaded()) {
-            this._lineNumberToHighlight = lineNumber;
-            return;
-        }
-
-        var sourceRow = this.sourceRow(lineNumber);
-        if (!sourceRow)
-            return;
-        var line = sourceRow.getElementsByClassName('webkit-line-content')[0];
-        // Trick to reset the animation if the user clicks on the same link
-        // Using a timeout to avoid coalesced style updates
-        line.style.setProperty("-webkit-animation-name", "none");
-        setTimeout(function () {
-            line.style.removeProperty("-webkit-animation-name");
-            sourceRow.addStyleClass("webkit-highlighted-line");
-        }, 0);
+        if (this._textViewer)
+            this._textViewer.highlightLine(line - 1);
+        else
+            this._lineToHighlight = line;
     },
 
-    _loaded: function()
+    _createViewerIfNeeded: function()
     {
-        WebInspector.addMainEventListeners(this.element.contentDocument);
-        this.element.contentDocument.addEventListener("contextmenu", this._documentContextMenu.bind(this), true);
-        this.element.contentDocument.addEventListener("mousedown", this._documentMouseDown.bind(this), true);
-        this.element.contentDocument.addEventListener("keydown", this._documentKeyDown.bind(this), true);
-        this.element.contentDocument.addEventListener("keyup", WebInspector.documentKeyUp.bind(WebInspector), true);
-        this.element.contentDocument.addEventListener("webkitAnimationEnd", this._highlightLineEnds.bind(this), false);
-
-        // Register 'eval' shortcut.
-        var isMac = InspectorController.platform().indexOf("mac-") === 0;
-        var platformSpecificModifier = isMac ? WebInspector.KeyboardShortcut.Modifiers.Meta : WebInspector.KeyboardShortcut.Modifiers.Ctrl;
-        var shortcut = WebInspector.KeyboardShortcut.makeKey(69 /* 'E' */, platformSpecificModifier | WebInspector.KeyboardShortcut.Modifiers.Shift);
-        this._shortcuts[shortcut] = this._evalSelectionInCallFrame.bind(this);
-
-        var headElement = this.element.contentDocument.getElementsByTagName("head")[0];
-        if (!headElement) {
-            headElement = this.element.contentDocument.createElement("head");
-            this.element.contentDocument.documentElement.insertBefore(headElement, this.element.contentDocument.documentElement.firstChild);
-        }
-        
-        var linkElement = this.element.contentDocument.createElement("link");
-        linkElement.type = "text/css";
-        linkElement.rel = "stylesheet";
-        linkElement.href = "inspectorSyntaxHighlight.css";
-        headElement.appendChild(linkElement);
-
-        var styleElement = this.element.contentDocument.createElement("style");
-        headElement.appendChild(styleElement);
-
-        // Add these style rules here since they are specific to the Inspector. They also behave oddly and not
-        // all properties apply if added to view-source.css (because it is a user agent sheet.)
-        var styleText = ".webkit-line-number { background-repeat: no-repeat; background-position: right 1px; }\n";
-        styleText += ".webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(program-counter); }\n";
-
-        styleText += ".webkit-breakpoint .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint); }\n";
-        styleText += ".webkit-breakpoint-disabled .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint-disabled); }\n";
-        styleText += ".webkit-breakpoint.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-program-counter); }\n";
-        styleText += ".webkit-breakpoint-disabled.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-disabled-program-counter); }\n";
-
-        styleText += ".webkit-breakpoint.webkit-breakpoint-conditional .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint-conditional); }\n";
-        styleText += ".webkit-breakpoint-disabled.webkit-breakpoint-conditional .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint-disabled-conditional); }\n";
-        styleText += ".webkit-breakpoint.webkit-breakpoint-conditional.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-conditional-program-counter); }\n";
-        styleText += ".webkit-breakpoint-disabled.webkit-breakpoint-conditional.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-disabled-conditional-program-counter); }\n";
-
-        styleText += ".webkit-execution-line .webkit-line-content { background-color: rgb(171, 191, 254); outline: 1px solid rgb(64, 115, 244); }\n";
-        styleText += ".webkit-height-sized-to-fit { overflow-y: hidden }\n";
-        styleText += ".webkit-line-content { background-color: white; }\n";
-        styleText += "@-webkit-keyframes fadeout {from {background-color: rgb(255, 255, 120);} to { background-color: white;}}\n";
-        styleText += ".webkit-highlighted-line .webkit-line-content { background-color: rgb(255, 255, 120); -webkit-animation: 'fadeout' 2s 500ms}\n";
-
-        // TODO: Move these styles into inspector.css once https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed and popup moved into the top frame.
-        styleText += ".popup-content { position: absolute; z-index: 10000; padding: 4px; background-color: rgb(203, 226, 255); -webkit-border-radius: 7px; border: 2px solid rgb(169, 172, 203); }";
-        styleText += ".popup-glasspane { position: absolute; top: 0; left: 0; height: 100%; width: 100%; opacity: 0; z-index: 9900; }";
-        styleText += ".popup-message { background-color: transparent; font-family: Lucida Grande, sans-serif; font-weight: normal; font-size: 11px; text-align: left; text-shadow: none; color: rgb(85, 85, 85); cursor: default; margin: 0 0 2px 0; }";
-        styleText += ".popup-content.breakpoint-condition { width: 90%; }";
-        styleText += ".popup-content input#bp-condition { font-family: monospace; margin: 0; border: 1px inset rgb(190, 190, 190) !important; width: 100%; box-shadow: none !important; outline: none !important; -webkit-user-modify: read-write; }";
-        // This class is already in inspector.css
-        styleText += ".hidden { display: none !important; }";
-
-        styleElement.textContent = styleText;
+        if (!this._visible || !this._loaded || this._textViewer)
+            return;
+
+        this._textViewer = new WebInspector.TextViewer(this._textModel, WebInspector.platform, this._url);
+        var element = this._textViewer.element;
+        element.addEventListener("keydown", this._keyDown.bind(this), true);
+        element.addEventListener("contextmenu", this._contextMenu.bind(this), true);
+        element.addEventListener("mousedown", this._mouseDown.bind(this), true);
+        element.addEventListener("mousemove", this._mouseMove.bind(this), true);
+        element.addEventListener("scroll", this._scroll.bind(this), true);
+        this._parentElement.appendChild(element);
 
         this._needsProgramCounterImage = true;
         this._needsBreakpointImages = true;
 
-        this.element.contentWindow.Element.prototype.addStyleClass = Element.prototype.addStyleClass;
-        this.element.contentWindow.Element.prototype.removeStyleClass = Element.prototype.removeStyleClass;
-        this.element.contentWindow.Element.prototype.positionAt = Element.prototype.positionAt;
-        this.element.contentWindow.Element.prototype.removeMatchingStyleClasses = Element.prototype.removeMatchingStyleClasses;
-        this.element.contentWindow.Element.prototype.hasStyleClass = Element.prototype.hasStyleClass;
-        this.element.contentWindow.Element.prototype.pageOffsetRelativeToWindow = Element.prototype.pageOffsetRelativeToWindow;
-        this.element.contentWindow.Element.prototype.__defineGetter__("totalOffsetLeft", Element.prototype.__lookupGetter__("totalOffsetLeft"));
-        this.element.contentWindow.Element.prototype.__defineGetter__("totalOffsetTop", Element.prototype.__lookupGetter__("totalOffsetTop"));
-        this.element.contentWindow.Node.prototype.enclosingNodeOrSelfWithNodeName = Node.prototype.enclosingNodeOrSelfWithNodeName;
-        this.element.contentWindow.Node.prototype.enclosingNodeOrSelfWithNodeNameInArray = Node.prototype.enclosingNodeOrSelfWithNodeNameInArray;
+        this._textViewer.beginUpdates();
 
+        this._textViewer.mimeType = this._mimeType;
         this._addExistingMessagesToSource();
         this._addExistingBreakpointsToSource();
         this._updateExecutionLine();
-        if (this._executionLine)
-            this.revealLine(this._executionLine);
-
-        if (this.autoSizesToFitContentHeight)
-            this.sizeToFitContentHeight();
+        this._textViewer.resize();
 
         if (this._lineNumberToReveal) {
             this.revealLine(this._lineNumberToReveal);
             delete this._lineNumberToReveal;
         }
 
-        if (this._lineNumberToHighlight) {
-            this.highlightLine(this._lineNumberToHighlight);
-            delete this._lineNumberToHighlight;
+        if (this._pendingMarkRange) {
+            var range = this._pendingMarkRange;
+            this.markAndRevealRange(range);
+            delete this._pendingMarkRange;
         }
 
-        this.dispatchEventToListeners("content loaded");
-    },
-
-    _isContentLoaded: function() {
-        var doc = this.element.contentDocument;
-        return doc && doc.getElementsByTagName("table")[0];
-    },
-
-    _windowResized: function(event)
-    {
-        if (!this._autoSizesToFitContentHeight)
-            return;
-        this.sizeToFitContentHeight();
-    },
-
-    _documentContextMenu: function(event)
-    {
-        if (!event.target.hasStyleClass("webkit-line-number"))
-            return;
-        var sourceRow = event.target.enclosingNodeOrSelfWithNodeName("tr");
-        if (!sourceRow._breakpointObject && this.addBreakpointDelegate)
-            this.addBreakpointDelegate(this.lineNumberForSourceRow(sourceRow));
-
-        var breakpoint = sourceRow._breakpointObject;
-        if (!breakpoint)
-            return;
-
-        this._editBreakpointCondition(event.target, sourceRow, breakpoint);
-        event.preventDefault();
-    },
-
-    _documentMouseDown: function(event)
-    {
-        if (!event.target.hasStyleClass("webkit-line-number"))
-            return;
-        if (event.button != 0 || event.altKey || event.ctrlKey || event.metaKey || event.shiftKey)
-            return;
-        var sourceRow = event.target.enclosingNodeOrSelfWithNodeName("tr");
-        if (sourceRow._breakpointObject && sourceRow._breakpointObject.enabled)
-            sourceRow._breakpointObject.enabled = false;
-        else if (sourceRow._breakpointObject)
-            WebInspector.panels.scripts.removeBreakpoint(sourceRow._breakpointObject);
-        else if (this.addBreakpointDelegate)
-            this.addBreakpointDelegate(this.lineNumberForSourceRow(sourceRow));
+        if (this._lineToHighlight) {
+            this.highlightLine(this._lineToHighlight);
+            delete this._lineToHighlight;
+        }
+        this._textViewer.endUpdates();
     },
 
-    _editBreakpointCondition: function(eventTarget, sourceRow, breakpoint)
+    findSearchMatches: function(query)
     {
-        // TODO: Migrate the popup to the top-level document and remove the blur listener from conditionElement once https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed.
-        var popupDocument = this.element.contentDocument;
-        this._showBreakpointConditionPopup(eventTarget, breakpoint.line, popupDocument);
+        var ranges = [];
 
-        function committed(element, newText)
-        {
-            breakpoint.condition = newText;
-            if (breakpoint.condition)
-                sourceRow.addStyleClass("webkit-breakpoint-conditional");
-            else
-                sourceRow.removeStyleClass("webkit-breakpoint-conditional");
-            dismissed.call(this);
-        }
+        // First do case-insensitive search.
+        var regexObject = createSearchRegex(query);
+        this._collectRegexMatches(regexObject, ranges);
 
-        function dismissed()
-        {
-            this._popup.hide();
-            delete this._conditionEditorElement;
+        // Then try regex search if user knows the / / hint.
+        try {
+            if (/^\/.*\/$/.test(query))
+                this._collectRegexMatches(new RegExp(query.substring(1, query.length - 1)), ranges);
+        } catch (e) {
+            // Silent catch.
         }
-
-        var dismissedHandler = dismissed.bind(this);
-        this._conditionEditorElement.addEventListener("blur", dismissedHandler, false);
-
-        WebInspector.startEditing(this._conditionEditorElement, committed.bind(this), dismissedHandler);
-        this._conditionEditorElement.value = breakpoint.condition;
-        this._conditionEditorElement.select();
+        return ranges;
     },
 
-    _showBreakpointConditionPopup: function(clickedElement, lineNumber, popupDocument)
+    _collectRegexMatches: function(regexObject, ranges)
     {
-        var popupContentElement = this._createPopupElement(lineNumber, popupDocument);
-        var lineElement = clickedElement.enclosingNodeOrSelfWithNodeName("td").nextSibling;
-        if (this._popup) {
-            this._popup.hide();
-            this._popup.element = popupContentElement;
-        } else {
-            this._popup = new WebInspector.Popup(popupContentElement);
-            this._popup.autoHide = true;
+        for (var i = 0; i < this._textModel.linesCount; ++i) {
+            var line = this._textModel.line(i);
+            var offset = 0;
+            do {
+                var match = regexObject.exec(line);
+                if (match) {
+                    ranges.push(new WebInspector.TextRange(i, offset + match.index, i, offset + match.index + match[0].length));
+                    offset += match.index + 1;
+                    line = line.substring(match.index + 1);
+                }
+            } while (match)
         }
-        this._popup.anchor = lineElement;
-        this._popup.show();
+        return ranges;
     },
 
-    _createPopupElement: function(lineNumber, popupDocument)
+    markAndRevealRange: function(range)
     {
-        var popupContentElement = popupDocument.createElement("div");
-        popupContentElement.className = "popup-content breakpoint-condition";
-
-        var labelElement = document.createElement("label");
-        labelElement.className = "popup-message";
-        labelElement.htmlFor = "bp-condition";
-        labelElement.appendChild(document.createTextNode(WebInspector.UIString("The breakpoint on line %d will stop only if this expression is true:", lineNumber)));
-        popupContentElement.appendChild(labelElement);
-
-        var editorElement = document.createElement("input");
-        editorElement.id = "bp-condition";
-        editorElement.type = "text"
-        popupContentElement.appendChild(editorElement);
-        this._conditionEditorElement = editorElement;
-
-        return popupContentElement;
+        if (this._textViewer)
+            this._textViewer.markAndRevealRange(range);
+        else
+            this._pendingMarkRange = range;
     },
 
-    _documentKeyDown: function(event)
+    clearMarkedRange: function()
     {
-        var shortcut = WebInspector.KeyboardShortcut.makeKeyFromEvent(event);
-        var handler = this._shortcuts[shortcut];
-        if (handler) {
-            handler(event);
-            event.preventDefault();
-        } else {
-            WebInspector.documentKeyDown(event);
-        }
+        if (this._textViewer) {
+            this._textViewer.markAndRevealRange(null);
+        } else
+            delete this._pendingMarkRange;
     },
 
-    _evalSelectionInCallFrame: function(event)
+    _incrementMessageRepeatCount: function(msg, repeatDelta)
     {
-        if (!WebInspector.panels.scripts || !WebInspector.panels.scripts.paused)
+        if (!msg._resourceMessageLineElement)
             return;
 
-        var selection = this.element.contentWindow.getSelection();
-        if (!selection.rangeCount)
-            return;
+        if (!msg._resourceMessageRepeatCountElement) {
+            var repeatedElement = document.createElement("span");
+            msg._resourceMessageLineElement.appendChild(repeatedElement);
+            msg._resourceMessageRepeatCountElement = repeatedElement;
+        }
 
-        var expression = selection.getRangeAt(0).toString().trimWhitespace();
-        WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, "console", function(result, exception) {
-            WebInspector.showConsole();
-            var commandMessage = new WebInspector.ConsoleCommand(expression);
-            WebInspector.console.addMessage(commandMessage);
-            WebInspector.console.addMessage(new WebInspector.ConsoleCommandResult(result, exception, commandMessage));
-        });
+        msg.repeatCount += repeatDelta;
+        msg._resourceMessageRepeatCountElement.textContent = WebInspector.UIString(" (repeated %d times)", msg.repeatCount);
     },
 
-    _breakpointEnableChanged: function(event)
+    _breakpointChanged: function(event)
     {
         var breakpoint = event.target;
-        var sourceRow = this.sourceRow(breakpoint.line);
-        if (!sourceRow)
+        var lineNumber = breakpoint.line - 1;
+        if (lineNumber >= this._textModel.linesCount)
             return;
 
-        sourceRow.addStyleClass("webkit-breakpoint");
-
         if (breakpoint.enabled)
-            sourceRow.removeStyleClass("webkit-breakpoint-disabled");
+            this._textViewer.removeDecoration(lineNumber, "webkit-breakpoint-disabled");
+        else
+            this._textViewer.addDecoration(lineNumber, "webkit-breakpoint-disabled");
+
+        if (breakpoint.condition)
+            this._textViewer.addDecoration(lineNumber, "webkit-breakpoint-conditional");
         else
-            sourceRow.addStyleClass("webkit-breakpoint-disabled");
+            this._textViewer.removeDecoration(lineNumber, "webkit-breakpoint-conditional");
     },
 
     _updateExecutionLine: function(previousLine)
     {
         if (previousLine) {
-            var sourceRow = this.sourceRow(previousLine);
-            if (sourceRow)
-                sourceRow.removeStyleClass("webkit-execution-line");
+            if (previousLine - 1 < this._textModel.linesCount)
+                this._textViewer.removeDecoration(previousLine - 1, "webkit-execution-line");
         }
 
         if (!this._executionLine)
             return;
 
-        this._drawProgramCounterImageIfNeeded();
-
-        var sourceRow = this.sourceRow(this._executionLine);
-        if (sourceRow)
-            sourceRow.addStyleClass("webkit-execution-line");
-    },
-
-    _addExistingBreakpointsToSource: function()
-    {
-        var length = this.breakpoints.length;
-        for (var i = 0; i < length; ++i)
-            this._addBreakpointToSource(this.breakpoints[i]);
-    },
-
-    _addBreakpointToSource: function(breakpoint)
-    {
-        var sourceRow = this.sourceRow(breakpoint.line);
-        if (!sourceRow)
-            return;
-
-        breakpoint.sourceText = sourceRow.getElementsByClassName('webkit-line-content')[0].textContent;
-
-        this._drawBreakpointImagesIfNeeded();
-
-        sourceRow._breakpointObject = breakpoint;
-
-        sourceRow.addStyleClass("webkit-breakpoint");
-        if (!breakpoint.enabled)
-            sourceRow.addStyleClass("webkit-breakpoint-disabled");
-        if (breakpoint.condition)
-            sourceRow.addStyleClass("webkit-breakpoint-conditional");
-    },
-
-    _removeBreakpointFromSource: function(breakpoint)
-    {
-        var sourceRow = this.sourceRow(breakpoint.line);
-        if (!sourceRow)
-            return;
-
-        delete sourceRow._breakpointObject;
-
-        sourceRow.removeStyleClass("webkit-breakpoint");
-        sourceRow.removeStyleClass("webkit-breakpoint-disabled");
-        sourceRow.removeStyleClass("webkit-breakpoint-conditional");
-    },
-
-    _incrementMessageRepeatCount: function(msg, repeatDelta)
-    {
-        if (!msg._resourceMessageLineElement)
-            return;
-
-        if (!msg._resourceMessageRepeatCountElement) {
-            var repeatedElement = document.createElement("span");
-            msg._resourceMessageLineElement.appendChild(repeatedElement);
-            msg._resourceMessageRepeatCountElement = repeatedElement;
-        }
-
-        msg.repeatCount += repeatDelta;
-        msg._resourceMessageRepeatCountElement.textContent = WebInspector.UIString(" (repeated %d times)", msg.repeatCount);
+        if (this._executionLine < this._textModel.linesCount)
+            this._textViewer.addDecoration(this._executionLine - 1, "webkit-execution-line");
     },
 
     _addExistingMessagesToSource: function()
     {
-        var length = this.messages.length;
+        var length = this._messages.length;
         for (var i = 0; i < length; ++i)
-            this._addMessageToSource(this.messages[i]);
+            this._addMessageToSource(this._messages[i]);
     },
 
     _addMessageToSource: function(msg)
     {
-        var row = this.sourceRow(msg.line);
-        if (!row)
-            return;
-
-        var cell = row.cells[1];
-        if (!cell)
+        if (msg.line >= this._textModel.linesCount)
             return;
 
-        var messageBubbleElement = cell.lastChild;
+        var messageBubbleElement = this._messageBubbles[msg.line];
         if (!messageBubbleElement || messageBubbleElement.nodeType !== Node.ELEMENT_NODE || !messageBubbleElement.hasStyleClass("webkit-html-message-bubble")) {
-            messageBubbleElement = this.element.contentDocument.createElement("div");
+            messageBubbleElement = document.createElement("div");
             messageBubbleElement.className = "webkit-html-message-bubble";
-            cell.appendChild(messageBubbleElement);
+            this._messageBubbles[msg.line] = messageBubbleElement;
+            this._textViewer.addDecoration(msg.line - 1, messageBubbleElement);
         }
 
-        if (!row.messages)
-            row.messages = [];
+        var rowMessages = this._rowMessages[msg.line];
+        if (!rowMessages) {
+            rowMessages = [];
+            this._rowMessages[msg.line] = rowMessages;
+        }
 
-        for (var i = 0; i < row.messages.length; ++i) {
-            if (row.messages[i].isEqual(msg, true)) {
-                this._incrementMessageRepeatCount(row.messages[i], msg.repeatDelta);
+        for (var i = 0; i < rowMessages.length; ++i) {
+            if (rowMessages[i].isEqual(msg, true)) {
+                this._incrementMessageRepeatCount(rowMessages[i], msg.repeatDelta);
                 return;
             }
         }
 
-        row.messages.push(msg);
+        rowMessages.push(msg);
 
         var imageURL;
         switch (msg.level) {
@@ -568,7 +339,7 @@ WebInspector.SourceFrame.prototype = {
                 break;
         }
 
-        var messageLineElement = this.element.contentDocument.createElement("div");
+        var messageLineElement = document.createElement("div");
         messageLineElement.className = "webkit-html-message-line";
         messageBubbleElement.appendChild(messageLineElement);
 
@@ -576,782 +347,355 @@ WebInspector.SourceFrame.prototype = {
         var image = document.createElement("img");
         image.src = imageURL;
         image.className = "webkit-html-message-icon";
-
-        // Adopt the image element since it wasn't created in element's contentDocument.
-        image = this.element.contentDocument.adoptNode(image);
         messageLineElement.appendChild(image);
-        messageLineElement.appendChild(this.element.contentDocument.createTextNode(msg.message));
+        messageLineElement.appendChild(document.createTextNode(msg.message));
 
         msg._resourceMessageLineElement = messageLineElement;
     },
 
-    _drawProgramCounterInContext: function(ctx, glow)
+    _addExistingBreakpointsToSource: function()
     {
-        if (glow)
-            ctx.save();
-
-        ctx.beginPath();
-        ctx.moveTo(17, 2);
-        ctx.lineTo(19, 2);
-        ctx.lineTo(19, 0);
-        ctx.lineTo(21, 0);
-        ctx.lineTo(26, 5.5);
-        ctx.lineTo(21, 11);
-        ctx.lineTo(19, 11);
-        ctx.lineTo(19, 9);
-        ctx.lineTo(17, 9);
-        ctx.closePath();
-        ctx.fillStyle = "rgb(142, 5, 4)";
-
-        if (glow) {
-            ctx.shadowBlur = 4;
-            ctx.shadowColor = "rgb(255, 255, 255)";
-            ctx.shadowOffsetX = -1;
-            ctx.shadowOffsetY = 0;
-        }
-
-        ctx.fill();
-        ctx.fill(); // Fill twice to get a good shadow and darker anti-aliased pixels.
-
-        if (glow)
-            ctx.restore();
+        for (var i = 0; i < this.breakpoints.length; ++i)
+            this._addBreakpointToSource(this.breakpoints[i]);
     },
 
-    _drawProgramCounterImageIfNeeded: function()
+    _addBreakpointToSource: function(breakpoint)
     {
-        if (!this._needsProgramCounterImage || !this.element.contentDocument)
+        var lineNumber = breakpoint.line - 1;
+        if (lineNumber >= this._textModel.linesCount)
             return;
 
-        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "program-counter", 26, 11);
-        ctx.clearRect(0, 0, 26, 11);
-        this._drawProgramCounterInContext(ctx, true);
+        this._textModel.setAttribute(lineNumber, "breakpoint", breakpoint);
+        breakpoint.sourceText = this._textModel.line(breakpoint.line - 1);
 
-        delete this._needsProgramCounterImage;
+        this._textViewer.beginUpdates();
+        this._textViewer.addDecoration(lineNumber, "webkit-breakpoint");
+        if (!breakpoint.enabled)
+            this._textViewer.addDecoration(lineNumber, "webkit-breakpoint-disabled");
+        if (breakpoint.condition)
+            this._textViewer.addDecoration(lineNumber, "webkit-breakpoint-conditional");
+        this._textViewer.endUpdates();
     },
 
-    _drawBreakpointImagesIfNeeded: function(conditional)
+    _removeBreakpointFromSource: function(breakpoint)
     {
-        if (!this._needsBreakpointImages || !this.element.contentDocument)
-            return;
+        var lineNumber = breakpoint.line - 1;
+        this._textViewer.beginUpdates();
+        this._textModel.removeAttribute(lineNumber, "breakpoint");
+        this._textViewer.removeDecoration(lineNumber, "webkit-breakpoint");
+        this._textViewer.removeDecoration(lineNumber, "webkit-breakpoint-disabled");
+        this._textViewer.removeDecoration(lineNumber, "webkit-breakpoint-conditional");
+        this._textViewer.endUpdates();
+    },
 
-        function drawBreakpoint(ctx, disabled, conditional)
-        {
-            ctx.beginPath();
-            ctx.moveTo(0, 2);
-            ctx.lineTo(2, 0);
-            ctx.lineTo(21, 0);
-            ctx.lineTo(26, 5.5);
-            ctx.lineTo(21, 11);
-            ctx.lineTo(2, 11);
-            ctx.lineTo(0, 9);
-            ctx.closePath();
-            ctx.fillStyle = conditional ? "rgb(217, 142, 1)" : "rgb(1, 142, 217)";
-            ctx.strokeStyle = conditional ? "rgb(205, 103, 0)" : "rgb(0, 103, 205)";
-            ctx.lineWidth = 3;
-            ctx.fill();
-            ctx.save();
-            ctx.clip();
-            ctx.stroke();
-            ctx.restore();
-
-            if (!disabled)
-                return;
+    _contextMenu: function(event)
+    {
+        var target = event.target.enclosingNodeOrSelfWithClass("webkit-line-number");
+        if (!target)
+            return;
+        var row = target.parentElement;
+
+        var lineNumber = row.lineNumber;
+        var contextMenu = new WebInspector.ContextMenu();
+
+        var breakpoint = this._textModel.getAttribute(lineNumber, "breakpoint");
+        if (!breakpoint) {
+            // This row doesn't have a breakpoint: We want to show Add Breakpoint and Add and Edit Breakpoint.
+            contextMenu.appendItem(WebInspector.UIString("Add Breakpoint"), this._addBreakpointDelegate.bind(this, lineNumber + 1));
+
+            function addConditionalBreakpoint() 
+            {
+                this._addBreakpointDelegate(lineNumber + 1);
+                var breakpoint = this._textModel.getAttribute(lineNumber, "breakpoint");
+                if (breakpoint)
+                    this._editBreakpointCondition(breakpoint);
+            }
 
-            ctx.save();
-            ctx.globalCompositeOperation = "destination-out";
-            ctx.fillStyle = "rgba(0, 0, 0, 0.5)";
-            ctx.fillRect(0, 0, 26, 11);
-            ctx.restore();
+            contextMenu.appendItem(WebInspector.UIString("Add Conditional Breakpoint..."), addConditionalBreakpoint.bind(this));
+        } else {
+            // This row has a breakpoint, we want to show edit and remove breakpoint, and either disable or enable.
+            contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), WebInspector.panels.scripts.removeBreakpoint.bind(WebInspector.panels.scripts, breakpoint));
+            contextMenu.appendItem(WebInspector.UIString("Edit Breakpoint..."), this._editBreakpointCondition.bind(this, breakpoint));
+            if (breakpoint.enabled)
+                contextMenu.appendItem(WebInspector.UIString("Disable Breakpoint"), function() { breakpoint.enabled = false; });
+            else
+                contextMenu.appendItem(WebInspector.UIString("Enable Breakpoint"), function() { breakpoint.enabled = true; });
         }
+        contextMenu.show(event);
+    },
 
-
-        // Unconditional breakpoints.
-
-        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint", 26, 11);
-        ctx.clearRect(0, 0, 26, 11);
-        drawBreakpoint(ctx);
-
-        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-program-counter", 26, 11);
-        ctx.clearRect(0, 0, 26, 11);
-        drawBreakpoint(ctx);
-        ctx.clearRect(20, 0, 6, 11);
-        this._drawProgramCounterInContext(ctx, true);
-
-        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-disabled", 26, 11);
-        ctx.clearRect(0, 0, 26, 11);
-        drawBreakpoint(ctx, true);
-
-        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-disabled-program-counter", 26, 11);
-        ctx.clearRect(0, 0, 26, 11);
-        drawBreakpoint(ctx, true);
-        ctx.clearRect(20, 0, 6, 11);
-        this._drawProgramCounterInContext(ctx, true);
-
-
-        // Conditional breakpoints.
-
-        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-conditional", 26, 11);
-        ctx.clearRect(0, 0, 26, 11);
-        drawBreakpoint(ctx, false, true);
-
-        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-conditional-program-counter", 26, 11);
-        ctx.clearRect(0, 0, 26, 11);
-        drawBreakpoint(ctx, false, true);
-        ctx.clearRect(20, 0, 6, 11);
-        this._drawProgramCounterInContext(ctx, true);
-
-        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-disabled-conditional", 26, 11);
-        ctx.clearRect(0, 0, 26, 11);
-        drawBreakpoint(ctx, true, true);
-
-        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-disabled-conditional-program-counter", 26, 11);
-        ctx.clearRect(0, 0, 26, 11);
-        drawBreakpoint(ctx, true, true);
-        ctx.clearRect(20, 0, 6, 11);
-        this._drawProgramCounterInContext(ctx, true);
-
-        delete this._needsBreakpointImages;
+    _scroll: function(event)
+    {
+        this._hidePopup();
     },
 
-    syntaxHighlightJavascript: function()
+    _mouseDown: function(event)
     {
-        var table = this.element.contentDocument.getElementsByTagName("table")[0];
-        if (!table)
+        this._resetHoverTimer();
+        this._hidePopup();
+        if (event.button != 0 || event.altKey || event.ctrlKey || event.metaKey)
+            return;
+        var target = event.target.enclosingNodeOrSelfWithClass("webkit-line-number");
+        if (!target)
             return;
+        var row = target.parentElement;
 
-        var jsSyntaxHighlighter = new WebInspector.JavaScriptSourceSyntaxHighlighter(table, this);
-        jsSyntaxHighlighter.process();
+        var lineNumber = row.lineNumber;
+
+        var breakpoint = this._textModel.getAttribute(lineNumber, "breakpoint");
+        if (breakpoint) {
+            if (event.shiftKey)
+                breakpoint.enabled = !breakpoint.enabled;
+            else
+                this._removeBreakpointDelegate(breakpoint);
+        } else
+            this._addBreakpointDelegate(lineNumber + 1);
+        event.preventDefault();
     },
 
-    syntaxHighlightCSS: function()
+    _mouseMove: function(event)
     {
-        var table = this.element.contentDocument.getElementsByTagName("table")[0];
-        if (!table)
+        // Pretend that nothing has happened.
+        if (this._hoverElement === event.target || event.target.hasStyleClass("source-frame-eval-expression"))
             return;
 
-        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighligher(table, this);
-        cssSyntaxHighlighter.process();
-    }
-}
+        this._resetHoverTimer();
+        // User has 500ms to reach the popup.
+        if (this._popup) {
+            var self = this;
+            function doHide()
+            {
+                self._hidePopup();
+                delete self._hidePopupTimer;
+            }
+            this._hidePopupTimer = setTimeout(doHide, 500);
+        }
 
-WebInspector.SourceFrame.prototype.__proto__ = WebInspector.Object.prototype;
+        this._hoverElement = event.target;
 
-WebInspector.SourceSyntaxHighligher = function(table, sourceFrame)
-{
-    this.table = table;
-    this.sourceFrame = sourceFrame;
-}
+        // Now that cleanup routines are set up above, leave this in case we are not on a break.
+        if (!WebInspector.panels.scripts || !WebInspector.panels.scripts.paused)
+            return;
 
-WebInspector.SourceSyntaxHighligher.prototype = {
-    createSpan: function(content, className)
-    {
-        var span = document.createElement("span");
-        span.className = className;
-        span.appendChild(document.createTextNode(content));
-        return span;
+        // We are interested in identifiers and "this" keyword.
+        if (this._hoverElement.hasStyleClass("webkit-javascript-keyword")) {
+            if (this._hoverElement.textContent !== "this")
+                return;
+        } else if (!this._hoverElement.hasStyleClass("webkit-javascript-ident"))
+            return;
+
+        const toolTipDelay = this._popup ? 600 : 1000;
+        this._hoverTimer = setTimeout(this._mouseHover.bind(this, this._hoverElement), toolTipDelay);
     },
 
-    generateFinder: function(regex, matchNumber, className)
+    _resetHoverTimer: function()
     {
-        return function(str) {
-            var match = regex.exec(str);
-            if (!match)
-                return null;
-            this.previousMatchLength = match[matchNumber].length;
-            return this.createSpan(match[matchNumber], className);
-        };
+        if (this._hoverTimer) {
+            clearTimeout(this._hoverTimer);
+            delete this._hoverTimer;
+        }
     },
 
-    process: function()
+    _hidePopup: function()
     {
-        // Split up the work into chunks so we don't block the
-        // UI thread while processing.
-
-        var i = 0;
-        var rows = this.table.rows;
-        var rowsLength = rows.length;
-        var previousCell = null;
-        const linesPerChunk = 10;
-
-        function processChunk()
-        {
-            for (var end = Math.min(i + linesPerChunk, rowsLength); i < end; ++i) {
-                var row = rows[i];
-                if (!row)
-                    continue;
-                var cell = row.cells[1];
-                if (!cell)
-                    continue;
-                this.syntaxHighlightLine(cell, previousCell);
-                if (i < (end - 1))
-                    this.deleteContinueFlags(previousCell);
-                previousCell = cell;
-            }
-
-            if (i >= rowsLength && processChunkInterval) {
-                this.deleteContinueFlags(previousCell);
-                delete this.previousMatchLength;
-                clearInterval(processChunkInterval);
+        if (!this._popup)
+            return;
 
-                this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
-            }
+        // Replace higlight element with its contents inplace.
+        var parentElement = this._popup.highlightElement.parentElement;
+        var child = this._popup.highlightElement.firstChild;
+        while (child) {
+            var nextSibling = child.nextSibling;
+            parentElement.insertBefore(child, this._popup.highlightElement);
+            child = nextSibling;
         }
+        parentElement.removeChild(this._popup.highlightElement);
 
-        var boundProcessChunk = processChunk.bind(this);
-        var processChunkInterval = setInterval(boundProcessChunk, 25);
-        boundProcessChunk();
-    }
-}
-
-WebInspector.CSSSourceSyntaxHighligher = function(table, sourceFrame) {
-    WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
-
-    this.findNumber = this.generateFinder(/^((-?(\d+|\d*\.\d+))|^(#[a-fA-F0-9]{3,6}))(?:\D|$)/, 1, "webkit-css-number");
-    this.findUnits = this.generateFinder(/^(px|em|pt|in|cm|mm|pc|ex)(?:\W|$)/, 1, "webkit-css-unit");
-    this.findKeyword = this.generateFinder(/^(rgba?|hsla?|var)(?:\W|$)/, 1, "webkit-css-keyword");
-    this.findSingleLineString = this.generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-css-string"); // " this quote keeps Xcode happy
-    this.findSingleLineComment = this.generateFinder(/^\/\*.*?\*\//, 0, "webkit-css-comment");
-    this.findMultilineCommentStart = this.generateFinder(/^\/\*.*$/, 0, "webkit-css-comment");
-    this.findMultilineCommentEnd = this.generateFinder(/^.*?\*\//, 0, "webkit-css-comment");
-    this.findSelector = this.generateFinder(/^([#\.]?[_a-zA-Z].*?)(?:\W|$)/, 1, "webkit-css-selector");
-    this.findProperty = this.generateFinder(/^(-?[_a-z0-9][_a-z0-9-]*\s*)(?:\:)/, 1, "webkit-css-property");
-    this.findGenericIdent = this.generateFinder(/^([@-]?[_a-z0-9][_a-z0-9-]*)(?:\W|$)/, 1, "webkit-css-string");
-}
+        this._popup.hide();
+        delete this._popup;
+        InspectorBackend.releaseWrapperObjectGroup(0, this._popoverObjectGroup);
+    },
 
-WebInspector.CSSSourceSyntaxHighligher.prototype = {
-    deleteContinueFlags: function(cell)
+    _mouseHover: function(element)
     {
-        if (!cell)
+        delete this._hoverTimer;
+
+        if (!WebInspector.panels.scripts || !WebInspector.panels.scripts.paused)
             return;
-        delete cell._commentContinues;
-        delete cell._inSelector;
-    },
 
-    findPseudoClass: function(str)
-    {
-        var match = /^(::?)([_a-z0-9][_a-z0-9-]*)/.exec(str);
-        if (!match)
-            return null;
-        this.previousMatchLength = match[0].length;
-        var span = document.createElement("span");
-        span.appendChild(document.createTextNode(match[1]));
-        span.appendChild(this.createSpan(match[2], "webkit-css-pseudo-class"));
-        return span;
-    },
+        var lineRow = element.enclosingNodeOrSelfWithNodeName("tr");
+        if (!lineRow)
+            return;
 
-    findURL: function(str)
-    {
-        var match = /^(?:local|url)\(([^\)]*?)\)/.exec(str);
-        if (!match)
-            return null;
-        this.previousMatchLength = match[0].length;
-        var innerUrlSpan = this.createSpan(match[1], "webkit-css-url");
-        var outerSpan = document.createElement("span");
-        outerSpan.appendChild(this.createSpan("url", "webkit-css-keyword"));
-        outerSpan.appendChild(document.createTextNode("("));
-        outerSpan.appendChild(innerUrlSpan);
-        outerSpan.appendChild(document.createTextNode(")"));
-        return outerSpan;
-    },
+        // Collect tokens belonging to evaluated exression.
+        var tokens = [ element ];
+        var token = element.previousSibling;
+        while (token && (token.className === "webkit-javascript-ident" || token.className === "webkit-javascript-keyword" || token.textContent.trim() === ".")) {
+            tokens.push(token);
+            token = token.previousSibling;
+        }
+        tokens.reverse();
 
-    findAtRule: function(str)
-    {
-        var match = /^@[_a-z0-9][_a-z0-9-]*(?:\W|$)/.exec(str);
-        if (!match)
-            return null;
-        this.previousMatchLength = match[0].length;
-        return this.createSpan(match[0], "webkit-css-at-rule");
+        // Wrap them with highlight element.
+        var parentElement = element.parentElement;
+        var nextElement = element.nextSibling;
+        var container = document.createElement("span");
+        for (var i = 0; i < tokens.length; ++i)
+            container.appendChild(tokens[i]);
+        parentElement.insertBefore(container, nextElement);
+        this._showPopup(container);
     },
 
-    syntaxHighlightLine: function(line, prevLine)
+    _showPopup: function(element)
     {
-        var code = line.textContent;
-        while (line.firstChild)
-            line.removeChild(line.firstChild);
-
-        var token;
-        var tmp = 0;
-        var i = 0;
-        this.previousMatchLength = 0;
-
-        if (prevLine) {
-            if (prevLine._commentContinues) {
-                if (!(token = this.findMultilineCommentEnd(code))) {
-                    token = this.createSpan(code, "webkit-javascript-comment");
-                    line._commentContinues = true;
-                }
-            }
-            if (token) {
-                i += this.previousMatchLength ? this.previousMatchLength : code.length;
-                tmp = i;
-                line.appendChild(token);
+        function killHidePopupTimer()
+        {
+            if (this._hidePopupTimer) {
+                clearTimeout(this._hidePopupTimer);
+                delete this._hidePopupTimer;
+
+                // We know that we reached the popup, but we might have moved over other elements.
+                // Discard pending command.
+                this._resetHoverTimer();
             }
         }
 
-        var inSelector = (prevLine && prevLine._inSelector); // inside a selector, we can now parse properties and values
-        var inAtRuleBlock = (prevLine && prevLine._inAtRuleBlock); // inside an @rule block, but not necessarily inside a selector yet
-        var atRuleStarted = (prevLine && prevLine._atRuleStarted); // we received an @rule, we may stop the @rule at a semicolon or open a block and become inAtRuleBlock
-        var atRuleIsSelector = (prevLine && prevLine._atRuleIsSelector); // when this @rule opens a block it immediately goes into parsing properties and values instead of selectors
-
-        for ( ; i < code.length; ++i) {
-            var codeFragment = code.substr(i);
-            var prevChar = code[i - 1];
-            var currChar = codeFragment[0];
-            token = this.findSingleLineComment(codeFragment);
-            if (!token) {
-                if ((token = this.findMultilineCommentStart(codeFragment)))
-                    line._commentContinues = true;
-                else if (currChar === ";" && !inAtRuleBlock)
-                    atRuleStarted = false;
-                else if (currChar === "}") {
-                    if (inSelector && inAtRuleBlock && atRuleIsSelector) {
-                        inSelector = false;
-                        inAtRuleBlock = false;
-                        atRuleStarted = false;
-                    } else if (inSelector) {
-                        inSelector = false;
-                    } else if (inAtRuleBlock) {
-                        inAtRuleBlock = false;
-                        atRuleStarted = false;
-                    }
-                } else if (currChar === "{") {
-                    if (!atRuleStarted || inAtRuleBlock) {
-                        inSelector = true;
-                    } else if (!inAtRuleBlock && atRuleIsSelector) {
-                        inAtRuleBlock = true;
-                        inSelector = true;
-                    } else if (!inAtRuleBlock) {
-                        inAtRuleBlock = true;
-                        inSelector = false;
-                    }
-                } else if (inSelector) {
-                    if (!prevChar || /^\d/.test(prevChar)) {
-                        token = this.findUnits(codeFragment);
-                    } else if (!prevChar || /^\W/.test(prevChar)) {
-                        token = this.findNumber(codeFragment) ||
-                                this.findKeyword(codeFragment) ||
-                                this.findURL(codeFragment) ||
-                                this.findProperty(codeFragment) ||
-                                this.findAtRule(codeFragment) ||
-                                this.findGenericIdent(codeFragment) ||
-                                this.findSingleLineString(codeFragment);
-                    }
-                } else if (!inSelector) {
-                    if (atRuleStarted && !inAtRuleBlock)
-                        token = this.findURL(codeFragment); // for @import
-                    if (!token) {
-                        token = this.findSelector(codeFragment) ||
-                                this.findPseudoClass(codeFragment) ||
-                                this.findAtRule(codeFragment);
-                    }
-                }
+        function showObjectPopup(result)
+        {
+            if (!WebInspector.panels.scripts.paused)
+                return;
+
+            var popupContentElement = null;
+            if (result.type !== "object" && result.type !== "node" && result.type !== "array") {
+                popupContentElement = document.createElement("span");
+                popupContentElement.className = "monospace";
+                popupContentElement.style.whiteSpace = "pre";
+                popupContentElement.textContent = result.description;
+                this._popup = new WebInspector.Popover(popupContentElement);
+                this._popup.show(element);
+            } else {
+                var popupContentElement = document.createElement("div");
+
+                var titleElement = document.createElement("div");
+                titleElement.className = "source-frame-popover-title monospace";
+                titleElement.textContent = result.description;
+                popupContentElement.appendChild(titleElement);
+
+                var section = new WebInspector.ObjectPropertiesSection(result, "", null, false);
+                section.expanded = true;
+                section.element.addStyleClass("source-frame-popover-tree");
+                section.headerElement.addStyleClass("hidden");
+                popupContentElement.appendChild(section.element);
+
+                this._popup = new WebInspector.Popover(popupContentElement);
+                const popupWidth = 300;
+                const popupHeight = 250;
+                this._popup.show(element, popupWidth, popupHeight);
             }
+            this._popup.highlightElement = element;
+            this._popup.highlightElement.addStyleClass("source-frame-eval-expression");
+            popupContentElement.addEventListener("mousemove", killHidePopupTimer.bind(this), true);
+        }
 
-            if (token) {
-                if (currChar === "@") {
-                    atRuleStarted = true;
+        function evaluateCallback(result, exception)
+        {
+            if (exception)
+                return;
+            if (!WebInspector.panels.scripts.paused)
+                return;
+            showObjectPopup.call(this, result);
+        }
+        WebInspector.panels.scripts.evaluateInSelectedCallFrame(element.textContent, false, this._popoverObjectGroup, evaluateCallback.bind(this));
+    },
 
-                    // The @font-face, @page, and @variables at-rules do not contain selectors like other at-rules
-                    // instead it acts as a selector and contains properties and values.
-                    var text = token.textContent;
-                    atRuleIsSelector = /font-face/.test(text) || /page/.test(text) || /variables/.test(text);
-                }
+    _editBreakpointCondition: function(breakpoint)
+    {
+        this._showBreakpointConditionPopup(breakpoint.line);
 
-                if (tmp !== i)
-                    line.appendChild(document.createTextNode(code.substring(tmp, i)));
-                line.appendChild(token);
-                i += this.previousMatchLength - 1;
-                tmp = i + 1;
-            }
+        function committed(element, newText)
+        {
+            breakpoint.condition = newText;
+            dismissed.call(this);
         }
 
-        line._inSelector = inSelector;
-        line._inAtRuleBlock = inAtRuleBlock;
-        line._atRuleStarted = atRuleStarted;
-        line._atRuleIsSelector = atRuleIsSelector;
+        function dismissed()
+        {
+            if (this._conditionElement)
+                this._textViewer.removeDecoration(breakpoint.line - 1, this._conditionElement);
+            delete this._conditionEditorElement;
+            delete this._conditionElement;
+        }
 
-        if (tmp < code.length)
-            line.appendChild(document.createTextNode(code.substring(tmp, i)));
-    }
-}
+        var dismissedHandler = dismissed.bind(this);
+        this._conditionEditorElement.addEventListener("blur", dismissedHandler, false);
 
-WebInspector.CSSSourceSyntaxHighligher.prototype.__proto__ = WebInspector.SourceSyntaxHighligher.prototype;
-
-WebInspector.JavaScriptSourceSyntaxHighlighter = function(table, sourceFrame) {
-    WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
-
-    this.LexState = {
-        Initial: 1,
-        DivisionAllowed: 2,
-    };
-    this.ContinueState = {
-        None: 0,
-        Comment: 1,
-        SingleQuoteString: 2,
-        DoubleQuoteString: 3,
-        RegExp: 4
-    };
-    
-    this.nonToken = "";
-    this.cursor = 0;
-    this.lineIndex = -1;
-    this.lineCode = "";
-    this.lineFragment = null;
-    this.lexState = this.LexState.Initial;
-    this.continueState = this.ContinueState.None;
-    
-    this.rules = [{
-            pattern: /^(?:\/\/.*)/,
-            action: singleLineCommentAction
-        }, {
-            pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*\*+\/)/,
-            action: multiLineSingleLineCommentAction
-        }, {
-            pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*)/,
-            action: multiLineCommentStartAction
-        }, {
-            pattern: /^(?:(?:[^\*]|\*[^\/])*\*+\/)/,
-            action: multiLineCommentEndAction,
-            continueStateCondition: this.ContinueState.Comment
-        }, {
-            pattern: /^.*/,
-            action: multiLineCommentMiddleAction,
-            continueStateCondition: this.ContinueState.Comment
-        }, {
-            pattern: /^(?:(?:0|[1-9]\d*)\.\d+?(?:[eE](?:\d+|\+\d+|-\d+))?|\.\d+(?:[eE](?:\d+|\+\d+|-\d+))?|(?:0|[1-9]\d*)(?:[eE](?:\d+|\+\d+|-\d+))?|0x[0-9a-fA-F]+|0X[0-9a-fA-F]+)/,
-            action: numericLiteralAction
-        }, {
-            pattern: /^(?:"(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*"|'(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*')/,
-            action: stringLiteralAction
-        }, {
-            pattern: /^(?:'(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
-            action: singleQuoteStringStartAction
-        }, {
-            pattern: /^(?:(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*')/,
-            action: singleQuoteStringEndAction,
-            continueStateCondition: this.ContinueState.SingleQuoteString
-        }, {
-            pattern: /^(?:(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
-            action: singleQuoteStringMiddleAction,
-            continueStateCondition: this.ContinueState.SingleQuoteString
-        }, {
-            pattern: /^(?:"(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
-            action: doubleQuoteStringStartAction
-        }, {
-            pattern: /^(?:(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*")/,
-            action: doubleQuoteStringEndAction,
-            continueStateCondition: this.ContinueState.DoubleQuoteString
-        }, {
-            pattern: /^(?:(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
-            action: doubleQuoteStringMiddleAction,
-            continueStateCondition: this.ContinueState.DoubleQuoteString
-        }, {
-            pattern: /^(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
-            action: identOrKeywordAction,
-            dontAppendNonToken: true
-        }, {
-            pattern: /^\)/,
-            action: rightParenAction,
-            dontAppendNonToken: true
-        }, {
-            pattern: /^(?:<=|>=|===|==|!=|!==|\+\+|\-\-|<<|>>|>>>|&&|\|\||\+=|\-=|\*=|%=|<<=|>>=|>>>=|&=|\|=|^=|[{}\(\[\]\.;,<>\+\-\*%&\|\^!~\?:=])/,
-            action: punctuatorAction,
-            dontAppendNonToken: true
-        }, {
-            pattern: /^(?:\/=?)/,
-            action: divPunctuatorAction,
-            stateCondition: this.LexState.DivisionAllowed,
-            dontAppendNonToken: true
-        }, {
-            pattern: /^(?:\/(?:(?:\\.)|[^\\*\/])(?:(?:\\.)|[^\\/])*\/(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
-            action: regExpLiteralAction
-        }, {
-            pattern: /^(?:\/(?:(?:\\.)|[^\\*\/])(?:(?:\\.)|[^\\/])*)\\$/,
-            action: regExpStartAction
-        }, {
-            pattern: /^(?:(?:(?:\\.)|[^\\/])*\/(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
-            action: regExpEndAction,
-            continueStateCondition: this.ContinueState.RegExp
-        }, {
-            pattern: /^(?:(?:(?:\\.)|[^\\/])*)\\$/,
-            action: regExpMiddleAction,
-            continueStateCondition: this.ContinueState.RegExp
-        }];
-    
-    function singleLineCommentAction(token)
-    {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
-    }
-    
-    function multiLineSingleLineCommentAction(token)
-    {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
-    }
-    
-    function multiLineCommentStartAction(token)
-    {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
-        this.continueState = this.ContinueState.Comment;
-    }
-    
-    function multiLineCommentEndAction(token)
-    {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
-        this.continueState = this.ContinueState.None;
-    }
-    
-    function multiLineCommentMiddleAction(token)
-    {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
-    }
-    
-    function numericLiteralAction(token)
-    {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-number"));
-        this.lexState = this.LexState.DivisionAllowed;
-    }
-    
-    function stringLiteralAction(token)
-    {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
-        this.lexState = this.LexState.Initial;
-    }
-    
-    function singleQuoteStringStartAction(token)
-    {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
-        this.continueState = this.ContinueState.SingleQuoteString;
-    }
-    
-    function singleQuoteStringEndAction(token)
-    {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
-        this.continueState = this.ContinueState.None;
-    }
-    
-    function singleQuoteStringMiddleAction(token)
-    {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
-    }
-    
-    function doubleQuoteStringStartAction(token)
-    {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
-        this.continueState = this.ContinueState.DoubleQuoteString;
-    }
-    
-    function doubleQuoteStringEndAction(token)
-    {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
-        this.continueState = this.ContinueState.None;
-    }
-    
-    function doubleQuoteStringMiddleAction(token)
-    {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
-    }
-    
-    function regExpLiteralAction(token)
-    {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
-        this.lexState = this.LexState.Initial;
-    }
+        WebInspector.startEditing(this._conditionEditorElement, committed.bind(this), dismissedHandler);
+        this._conditionEditorElement.value = breakpoint.condition;
+        this._conditionEditorElement.select();
+    },
 
-    function regExpStartAction(token)
+    _showBreakpointConditionPopup: function(lineNumber)
     {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
-        this.continueState = this.ContinueState.RegExp;
-    }
+        this._conditionElement = this._createConditionElement(lineNumber);
+        this._textViewer.addDecoration(lineNumber - 1, this._conditionElement);
+    },
 
-    function regExpEndAction(token)
+    _createConditionElement: function(lineNumber)
     {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
-        this.continueState = this.ContinueState.None;
-    }
+        var conditionElement = document.createElement("div");
+        conditionElement.className = "source-frame-breakpoint-condition";
 
-    function regExpMiddleAction(token)
-    {
-        this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
-    }
-    
-    function identOrKeywordAction(token)
-    {
-        const keywords = ["null", "true", "false", "break", "case", "catch", "const", "default", "finally", "for", "instanceof", "new", "var", "continue", "function", "return", "void", "delete", "if", "this", "do", "while", "else", "in", "switch", "throw", "try", "typeof", "with", "debugger", "class", "enum", "export", "extends", "import", "super", "get", "set"];
-        this.cursor += token.length;
-        if (keywords.indexOf(token) === -1) {
-            this.nonToken += token;
-            this.lexState = this.LexState.DivisionAllowed;
-        } else {
-            this.appendNonToken();
-            this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-keyword"));
-            this.lexState = this.LexState.Initial;
-        }
-    }
-    
-    function divPunctuatorAction(token)
-    {
-        this.cursor += token.length;
-        this.nonToken += token;
-        this.lexState = this.LexState.Initial;
-    }
-    
-    function rightParenAction(token)
-    {
-        this.cursor += token.length;
-        this.nonToken += token;
-        this.lexState = this.LexState.DivisionAllowed;
-    }
-    
-    function punctuatorAction(token)
-    {
-        this.cursor += token.length;
-        this.nonToken += token;
-        this.lexState = this.LexState.Initial;
-    }
-}
+        var labelElement = document.createElement("label");
+        labelElement.className = "source-frame-breakpoint-message";
+        labelElement.htmlFor = "source-frame-breakpoint-condition";
+        labelElement.appendChild(document.createTextNode(WebInspector.UIString("The breakpoint on line %d will stop only if this expression is true:", lineNumber)));
+        conditionElement.appendChild(labelElement);
 
-WebInspector.JavaScriptSourceSyntaxHighlighter.prototype = {
-    process: function()
-    {
-        // Split up the work into chunks so we don't block the
-        // UI thread while processing.
-
-        var rows = this.table.rows;
-        var rowsLength = rows.length;
-        const tokensPerChunk = 100;
-        const lineLengthLimit = 20000;
-        
-        var boundProcessChunk = processChunk.bind(this);
-        var processChunkInterval = setInterval(boundProcessChunk, 25);
-        boundProcessChunk();
-        
-        function processChunk()
-        {
-            for (var i = 0; i < tokensPerChunk; i++) {
-                if (this.cursor >= this.lineCode.length)
-                    moveToNextLine.call(this);
-                if (this.lineIndex >= rowsLength) {
-                    this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
-                    return;
-                }
-                if (this.cursor > lineLengthLimit) {
-                    var codeFragment = this.lineCode.substring(this.cursor);
-                    this.nonToken += codeFragment;
-                    this.cursor += codeFragment.length;
-                }
+        var editorElement = document.createElement("input");
+        editorElement.id = "source-frame-breakpoint-condition";
+        editorElement.className = "monospace";
+        editorElement.type = "text"
+        conditionElement.appendChild(editorElement);
+        this._conditionEditorElement = editorElement;
 
-                this.lex();
-            }
-        }
-        
-        function moveToNextLine()
-        {
-            this.appendNonToken();
-            
-            var row = rows[this.lineIndex];
-            var line = row ? row.cells[1] : null;
-            if (line && this.lineFragment) {
-                var messageBubble = null;
-                if (line.lastChild && line.lastChild.nodeType === Node.ELEMENT_NODE && line.lastChild.hasStyleClass("webkit-html-message-bubble")) {
-                    messageBubble = line.lastChild;
-                    line.removeChild(messageBubble);
-                }
-                
-                Element.prototype.removeChildren.call(line);
-                
-                line.appendChild(this.lineFragment);
-                if (messageBubble)
-                    line.appendChild(messageBubble);
-                this.lineFragment = null;
-            }
-            this.lineIndex++;
-            if (this.lineIndex >= rowsLength && processChunkInterval) {
-                clearInterval(processChunkInterval);
-                this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
-                return;
-            }
-            row = rows[this.lineIndex];
-            line = row ? row.cells[1] : null;
-            this.lineCode = line.textContent;
-            this.lineFragment = document.createDocumentFragment();
-            this.cursor = 0;
-            if (!line)
-                moveToNextLine();
-        }
+        return conditionElement;
     },
-    
-    lex: function()
+
+    _keyDown: function(event)
     {
-        var token = null;
-        var codeFragment = this.lineCode.substring(this.cursor);
-        
-        for (var i = 0; i < this.rules.length; i++) {
-            var rule = this.rules[i];
-            var ruleContinueStateCondition = typeof rule.continueStateCondition === "undefined" ? this.ContinueState.None : rule.continueStateCondition;
-            if (this.continueState === ruleContinueStateCondition) {
-                if (typeof rule.stateCondition !== "undefined" && this.lexState !== rule.stateCondition)
-                    continue;
-                var match = rule.pattern.exec(codeFragment);
-                if (match) {
-                    token = match[0];
-                    if (token) {
-                        if (!rule.dontAppendNonToken)
-                            this.appendNonToken();
-                        return rule.action.call(this, token);
-                    }
-                }
-            }
-        }
-        this.nonToken += codeFragment[0];
-        this.cursor++;
+        var shortcut = WebInspector.KeyboardShortcut.makeKeyFromEvent(event);
+        var handler = this._shortcuts[shortcut];
+        if (handler) {
+            handler(event);
+            event.preventDefault();
+        } else
+            WebInspector.documentKeyDown(event);
     },
-    
-    appendNonToken: function ()
+
+    _evalSelectionInCallFrame: function(event)
     {
-        if (this.nonToken.length > 0) {
-            this.lineFragment.appendChild(document.createTextNode(this.nonToken));
-            this.nonToken = "";
-        }
+        if (!WebInspector.panels.scripts || !WebInspector.panels.scripts.paused)
+            return;
+
+        var selection = this.element.contentWindow.getSelection();
+        if (!selection.rangeCount)
+            return;
+
+        var expression = selection.getRangeAt(0).toString().trimWhitespace();
+        WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, "console", function(result, exception) {
+            WebInspector.showConsole();
+            var commandMessage = new WebInspector.ConsoleCommand(expression);
+            WebInspector.console.addMessage(commandMessage);
+            WebInspector.console.addMessage(new WebInspector.ConsoleCommandResult(result, exception, commandMessage));
+        });
     },
-    
-    syntaxHighlightNode: function(node)
-    {
-        this.lineCode = node.textContent;
-        this.lineFragment = document.createDocumentFragment();
-        this.cursor = 0;
-        while (true) {
-            if (this.cursor >= this.lineCode.length) {
-                var codeFragment = this.lineCode.substring(this.cursor);
-                this.nonToken += codeFragment;
-                this.cursor += codeFragment.length;
-                this.appendNonToken();
-                while (node.firstChild)
-                    node.removeChild(node.firstChild);
-                node.appendChild(this.lineFragment);
-                this.lineFragment =null;
-                return;
-            }
 
-            this.lex();
-        }
+    resize: function()
+    {
+        if (this._textViewer)
+            this._textViewer.resize();
     }
 }
 
-WebInspector.JavaScriptSourceSyntaxHighlighter.prototype.__proto__ = WebInspector.SourceSyntaxHighligher.prototype;
+
+WebInspector.SourceFrame.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceHTMLTokenizer.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceHTMLTokenizer.js
new file mode 100644
index 0000000000..cfbc44fb69
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceHTMLTokenizer.js
@@ -0,0 +1,687 @@
+/* Generated by re2c 0.13.5 on Thu Feb 25 21:44:55 2010 */
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Generate js file as follows:
+//
+// re2c -isc WebCore/inspector/front-end/SourceHTMLTokenizer.re2js \
+// | sed 's|^yy\([^:]*\)*\:|case \1:|' \
+// | sed 's|[*]cursor[+][+]|this._charAt(cursor++)|' \
+// | sed 's|[[*][+][+]cursor|this._charAt(++cursor)|' \
+// | sed 's|[*]cursor|this._charAt(cursor)|' \
+// | sed 's|yych = \*\([^;]*\)|yych = this._charAt\1|' \
+// | sed 's|{ gotoCase = \([^; continue; };]*\)|{ gotoCase = \1; continue; }|' \
+// | sed 's|unsigned\ int|var|' \
+// | sed 's|var\ yych|case 1: case 1: var yych|'
+
+WebInspector.SourceHTMLTokenizer = function()
+{
+    WebInspector.SourceTokenizer.call(this);
+
+    // The order is determined by the generated code.
+    this._lexConditions = {
+        INITIAL: 0,
+        COMMENT: 1,
+        DOCTYPE: 2,
+        TAG: 3,
+        DSTRING: 4,
+        SSTRING: 5
+    };
+    this.case_INITIAL = 1000;
+    this.case_COMMENT = 1001;
+    this.case_DOCTYPE = 1002;
+    this.case_TAG = 1003;
+    this.case_DSTRING = 1004;
+    this.case_SSTRING = 1005;
+
+    this._parseConditions = {
+        INITIAL: 0,
+        ATTRIBUTE: 1,
+        ATTRIBUTE_VALUE: 2,
+        LINKIFY: 4,
+        A_NODE: 8,
+        SCRIPT: 16
+    };
+
+    this.initialCondition = { lexCondition: this._lexConditions.INITIAL, parseCondition: this._parseConditions.INITIAL };
+    this.condition = this.initialCondition;
+}
+
+WebInspector.SourceHTMLTokenizer.prototype = {
+    set line(line) {
+        if (this._internalJavaScriptTokenizer) {
+            var match = /<\/script/i.exec(line);
+            if (match) {
+                this._internalJavaScriptTokenizer.line = line.substring(0, match.index);
+            } else
+                this._internalJavaScriptTokenizer.line = line;
+        }
+        this._line = line;
+    },
+
+    _isExpectingAttribute: function()
+    {
+        return this._condition.parseCondition & this._parseConditions.ATTRIBUTE;
+    },
+
+    _isExpectingAttributeValue: function()
+    {
+        return this._condition.parseCondition & this._parseConditions.ATTRIBUTE_VALUE;
+    },
+
+    _setExpectingAttribute: function()
+    {
+        if (this._isExpectingAttributeValue())
+            this._condition.parseCondition ^= this._parseConditions.ATTRIBUTE_VALUE;
+        this._condition.parseCondition |= this._parseConditions.ATTRIBUTE;
+    },
+
+    _setExpectingAttributeValue: function()
+    {
+        if (this._isExpectingAttribute())
+            this._condition.parseCondition ^= this._parseConditions.ATTRIBUTE;
+        this._condition.parseCondition |= this._parseConditions.ATTRIBUTE_VALUE;
+    },
+
+    _stringToken: function(cursor, stringEnds)
+    {
+        if (!this._isExpectingAttributeValue()) {
+            this.tokenType = null;
+            return cursor;
+        }
+        this.tokenType = this._attrValueTokenType();
+        if (stringEnds)
+            this._setExpectingAttribute();
+        return cursor;
+    },
+
+    _attrValueTokenType: function()
+    {
+        if (this._condition.parseCondition & this._parseConditions.LINKIFY) {
+            if (this._condition.parseCondition & this._parseConditions.A_NODE)
+                return "html-external-link";
+            return "html-resource-link";
+        }
+        return "html-attribute-value";
+    },
+
+    nextToken: function(cursor)
+    {
+        if (this._internalJavaScriptTokenizer) {
+            // Re-set line to force </script> detection first.
+            this.line = this._line;
+            if (cursor !== this._internalJavaScriptTokenizer._line.length) {
+                // Tokenizer is stateless, so restore its condition before tokenizing and save it after.
+                this._internalJavaScriptTokenizer.condition = this._condition.internalJavaScriptTokenizerCondition;
+                var result = this._internalJavaScriptTokenizer.nextToken(cursor);
+                this.tokenType = this._internalJavaScriptTokenizer.tokenType;
+                this._condition.internalJavaScriptTokenizerCondition = this._internalJavaScriptTokenizer.condition;
+                return result;
+            } else if (cursor !== this._line.length)
+                delete this._internalJavaScriptTokenizer;
+        }
+
+        var cursorOnEnter = cursor;
+        var gotoCase = 1;
+        while (1) {
+            switch (gotoCase)
+            // Following comment is replaced with generated state machine.
+            
+        {
+            case 1: var yych;
+            var yyaccept = 0;
+            if (this.getLexCondition() < 3) {
+                if (this.getLexCondition() < 1) {
+                    { gotoCase = this.case_INITIAL; continue; };
+                } else {
+                    if (this.getLexCondition() < 2) {
+                        { gotoCase = this.case_COMMENT; continue; };
+                    } else {
+                        { gotoCase = this.case_DOCTYPE; continue; };
+                    }
+                }
+            } else {
+                if (this.getLexCondition() < 4) {
+                    { gotoCase = this.case_TAG; continue; };
+                } else {
+                    if (this.getLexCondition() < 5) {
+                        { gotoCase = this.case_DSTRING; continue; };
+                    } else {
+                        { gotoCase = this.case_SSTRING; continue; };
+                    }
+                }
+            }
+/* *********************************** */
+case this.case_COMMENT:
+
+            yych = this._charAt(cursor);
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 4; continue; };
+                { gotoCase = 3; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 4; continue; };
+                if (yych == '-') { gotoCase = 6; continue; };
+                { gotoCase = 3; continue; };
+            }
+case 2:
+            { this.tokenType = "html-comment"; return cursor; }
+case 3:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            { gotoCase = 9; continue; };
+case 4:
+            ++cursor;
+case 5:
+            { this.tokenType = null; return cursor; }
+case 6:
+            yyaccept = 1;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych != '-') { gotoCase = 5; continue; };
+case 7:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '>') { gotoCase = 10; continue; };
+case 8:
+            yyaccept = 0;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+case 9:
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 2; continue; };
+                { gotoCase = 8; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 2; continue; };
+                if (yych == '-') { gotoCase = 12; continue; };
+                { gotoCase = 8; continue; };
+            }
+case 10:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.INITIAL);
+            { this.tokenType = "html-comment"; return cursor; }
+case 12:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '-') { gotoCase = 7; continue; };
+            cursor = YYMARKER;
+            if (yyaccept <= 0) {
+                { gotoCase = 2; continue; };
+            } else {
+                { gotoCase = 5; continue; };
+            }
+/* *********************************** */
+case this.case_DOCTYPE:
+            yych = this._charAt(cursor);
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 18; continue; };
+                { gotoCase = 17; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 18; continue; };
+                if (yych == '>') { gotoCase = 20; continue; };
+                { gotoCase = 17; continue; };
+            }
+case 16:
+            { this.tokenType = "html-doctype"; return cursor; }
+case 17:
+            yych = this._charAt(++cursor);
+            { gotoCase = 23; continue; };
+case 18:
+            ++cursor;
+            { this.tokenType = null; return cursor; }
+case 20:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.INITIAL);
+            { this.tokenType = "html-doctype"; return cursor; }
+case 22:
+            ++cursor;
+            yych = this._charAt(cursor);
+case 23:
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 16; continue; };
+                { gotoCase = 22; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 16; continue; };
+                if (yych == '>') { gotoCase = 16; continue; };
+                { gotoCase = 22; continue; };
+            }
+/* *********************************** */
+case this.case_DSTRING:
+            yych = this._charAt(cursor);
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 28; continue; };
+                { gotoCase = 27; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 28; continue; };
+                if (yych == '"') { gotoCase = 30; continue; };
+                { gotoCase = 27; continue; };
+            }
+case 26:
+            { return this._stringToken(cursor); }
+case 27:
+            yych = this._charAt(++cursor);
+            { gotoCase = 34; continue; };
+case 28:
+            ++cursor;
+            { this.tokenType = null; return cursor; }
+case 30:
+            ++cursor;
+case 31:
+            this.setLexCondition(this._lexConditions.TAG);
+            { return this._stringToken(cursor, true); }
+case 32:
+            yych = this._charAt(++cursor);
+            { gotoCase = 31; continue; };
+case 33:
+            ++cursor;
+            yych = this._charAt(cursor);
+case 34:
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 26; continue; };
+                { gotoCase = 33; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 26; continue; };
+                if (yych == '"') { gotoCase = 32; continue; };
+                { gotoCase = 33; continue; };
+            }
+/* *********************************** */
+case this.case_INITIAL:
+            yych = this._charAt(cursor);
+            if (yych == '<') { gotoCase = 39; continue; };
+            ++cursor;
+            { this.tokenType = null; return cursor; }
+case 39:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych <= '/') {
+                if (yych == '!') { gotoCase = 44; continue; };
+                if (yych >= '/') { gotoCase = 41; continue; };
+            } else {
+                if (yych <= 'S') {
+                    if (yych >= 'S') { gotoCase = 42; continue; };
+                } else {
+                    if (yych == 's') { gotoCase = 42; continue; };
+                }
+            }
+case 40:
+            this.setLexCondition(this._lexConditions.TAG);
+            {
+                    if (this._condition.parseCondition & this._parseConditions.SCRIPT) {
+                        // Do not tokenize script tag contents, keep lexer state although processing "<".
+                        this.setLexCondition(this._lexConditions.INITIAL);
+                        this.tokenType = null;
+                        return cursor;
+                    }
+
+                    this._condition.parseCondition = this._parseConditions.INITIAL;
+                    this.tokenType = "html-tag";
+                    return cursor;
+                }
+case 41:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych == 'S') { gotoCase = 68; continue; };
+            if (yych == 's') { gotoCase = 68; continue; };
+            { gotoCase = 40; continue; };
+case 42:
+            yych = this._charAt(++cursor);
+            if (yych == 'C') { gotoCase = 62; continue; };
+            if (yych == 'c') { gotoCase = 62; continue; };
+case 43:
+            cursor = YYMARKER;
+            { gotoCase = 40; continue; };
+case 44:
+            yych = this._charAt(++cursor);
+            if (yych <= 'C') {
+                if (yych != '-') { gotoCase = 43; continue; };
+            } else {
+                if (yych <= 'D') { gotoCase = 46; continue; };
+                if (yych == 'd') { gotoCase = 46; continue; };
+                { gotoCase = 43; continue; };
+            }
+            yych = this._charAt(++cursor);
+            if (yych == '-') { gotoCase = 54; continue; };
+            { gotoCase = 43; continue; };
+case 46:
+            yych = this._charAt(++cursor);
+            if (yych == 'O') { gotoCase = 47; continue; };
+            if (yych != 'o') { gotoCase = 43; continue; };
+case 47:
+            yych = this._charAt(++cursor);
+            if (yych == 'C') { gotoCase = 48; continue; };
+            if (yych != 'c') { gotoCase = 43; continue; };
+case 48:
+            yych = this._charAt(++cursor);
+            if (yych == 'T') { gotoCase = 49; continue; };
+            if (yych != 't') { gotoCase = 43; continue; };
+case 49:
+            yych = this._charAt(++cursor);
+            if (yych == 'Y') { gotoCase = 50; continue; };
+            if (yych != 'y') { gotoCase = 43; continue; };
+case 50:
+            yych = this._charAt(++cursor);
+            if (yych == 'P') { gotoCase = 51; continue; };
+            if (yych != 'p') { gotoCase = 43; continue; };
+case 51:
+            yych = this._charAt(++cursor);
+            if (yych == 'E') { gotoCase = 52; continue; };
+            if (yych != 'e') { gotoCase = 43; continue; };
+case 52:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.DOCTYPE);
+            { this.tokenType = "html-doctype"; return cursor; }
+case 54:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 57; continue; };
+                { gotoCase = 54; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 57; continue; };
+                if (yych != '-') { gotoCase = 54; continue; };
+            }
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '-') { gotoCase = 59; continue; };
+            { gotoCase = 43; continue; };
+case 57:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.COMMENT);
+            { this.tokenType = "html-comment"; return cursor; }
+case 59:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych != '>') { gotoCase = 54; continue; };
+            ++cursor;
+            { this.tokenType = "html-comment"; return cursor; }
+case 62:
+            yych = this._charAt(++cursor);
+            if (yych == 'R') { gotoCase = 63; continue; };
+            if (yych != 'r') { gotoCase = 43; continue; };
+case 63:
+            yych = this._charAt(++cursor);
+            if (yych == 'I') { gotoCase = 64; continue; };
+            if (yych != 'i') { gotoCase = 43; continue; };
+case 64:
+            yych = this._charAt(++cursor);
+            if (yych == 'P') { gotoCase = 65; continue; };
+            if (yych != 'p') { gotoCase = 43; continue; };
+case 65:
+            yych = this._charAt(++cursor);
+            if (yych == 'T') { gotoCase = 66; continue; };
+            if (yych != 't') { gotoCase = 43; continue; };
+case 66:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.TAG);
+            {
+                    if (this._condition.parseCondition & this._parseConditions.SCRIPT) {
+                        // Do not tokenize script tag contents, keep lexer state although processing "<".
+                        this.setLexCondition(this._lexConditions.INITIAL);
+                        this.tokenType = null;
+                        return cursor;
+                    }
+                    this.tokenType = "html-tag";
+                    this._condition.parseCondition = this._parseConditions.SCRIPT;
+                    this._setExpectingAttribute();
+                    return cursor;
+                }
+case 68:
+            yych = this._charAt(++cursor);
+            if (yych == 'C') { gotoCase = 69; continue; };
+            if (yych != 'c') { gotoCase = 43; continue; };
+case 69:
+            yych = this._charAt(++cursor);
+            if (yych == 'R') { gotoCase = 70; continue; };
+            if (yych != 'r') { gotoCase = 43; continue; };
+case 70:
+            yych = this._charAt(++cursor);
+            if (yych == 'I') { gotoCase = 71; continue; };
+            if (yych != 'i') { gotoCase = 43; continue; };
+case 71:
+            yych = this._charAt(++cursor);
+            if (yych == 'P') { gotoCase = 72; continue; };
+            if (yych != 'p') { gotoCase = 43; continue; };
+case 72:
+            yych = this._charAt(++cursor);
+            if (yych == 'T') { gotoCase = 73; continue; };
+            if (yych != 't') { gotoCase = 43; continue; };
+case 73:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.TAG);
+            {
+                    this.tokenType = "html-tag";
+                    this._condition.parseCondition = this._parseConditions.INITIAL;
+                    return cursor;
+                }
+/* *********************************** */
+case this.case_SSTRING:
+            yych = this._charAt(cursor);
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 79; continue; };
+                { gotoCase = 78; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 79; continue; };
+                if (yych == '\'') { gotoCase = 81; continue; };
+                { gotoCase = 78; continue; };
+            }
+case 77:
+            { return this._stringToken(cursor); }
+case 78:
+            yych = this._charAt(++cursor);
+            { gotoCase = 85; continue; };
+case 79:
+            ++cursor;
+            { this.tokenType = null; return cursor; }
+case 81:
+            ++cursor;
+case 82:
+            this.setLexCondition(this._lexConditions.TAG);
+            { return this._stringToken(cursor, true); }
+case 83:
+            yych = this._charAt(++cursor);
+            { gotoCase = 82; continue; };
+case 84:
+            ++cursor;
+            yych = this._charAt(cursor);
+case 85:
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 77; continue; };
+                { gotoCase = 84; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 77; continue; };
+                if (yych == '\'') { gotoCase = 83; continue; };
+                { gotoCase = 84; continue; };
+            }
+/* *********************************** */
+case this.case_TAG:
+            yych = this._charAt(cursor);
+            if (yych <= '&') {
+                if (yych <= '\r') {
+                    if (yych == '\n') { gotoCase = 90; continue; };
+                    if (yych >= '\r') { gotoCase = 90; continue; };
+                } else {
+                    if (yych <= ' ') {
+                        if (yych >= ' ') { gotoCase = 90; continue; };
+                    } else {
+                        if (yych == '"') { gotoCase = 92; continue; };
+                    }
+                }
+            } else {
+                if (yych <= '>') {
+                    if (yych <= ';') {
+                        if (yych <= '\'') { gotoCase = 93; continue; };
+                    } else {
+                        if (yych <= '<') { gotoCase = 90; continue; };
+                        if (yych <= '=') { gotoCase = 94; continue; };
+                        { gotoCase = 96; continue; };
+                    }
+                } else {
+                    if (yych <= '[') {
+                        if (yych >= '[') { gotoCase = 90; continue; };
+                    } else {
+                        if (yych == ']') { gotoCase = 90; continue; };
+                    }
+                }
+            }
+            ++cursor;
+            yych = this._charAt(cursor);
+            { gotoCase = 109; continue; };
+case 89:
+            {
+                    if (this._condition.parseCondition === this._parseConditions.SCRIPT) {
+                        // Fall through if expecting attributes.
+                        this.tokenType = null;
+                        return cursor;
+                    }
+
+                    if (this._condition.parseCondition === this._parseConditions.INITIAL) {
+                        this.tokenType = "html-tag";
+                        this._setExpectingAttribute();
+                        var token = this._line.substring(cursorOnEnter, cursor);
+                        if (token === "a")
+                            this._condition.parseCondition |= this._parseConditions.A_NODE;
+                        else if (this._condition.parseCondition & this._parseConditions.A_NODE)
+                            this._condition.parseCondition ^= this._parseConditions.A_NODE;
+                    } else if (this._isExpectingAttribute()) {
+                        var token = this._line.substring(cursorOnEnter, cursor);
+                        if (token === "href" || token === "src")
+                            this._condition.parseCondition |= this._parseConditions.LINKIFY;
+                        else if (this._condition.parseCondition |= this._parseConditions.LINKIFY)
+                            this._condition.parseCondition ^= this._parseConditions.LINKIFY;
+                        this.tokenType = "html-attribute-name";
+                    } else if (this._isExpectingAttributeValue())
+                        this.tokenType = this._attrValueTokenType();
+                    else
+                        this.tokenType = null;
+                    return cursor;
+                }
+case 90:
+            ++cursor;
+            { this.tokenType = null; return cursor; }
+case 92:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            { gotoCase = 105; continue; };
+case 93:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            { gotoCase = 99; continue; };
+case 94:
+            ++cursor;
+            {
+                    if (this._isExpectingAttribute())
+                        this._setExpectingAttributeValue();
+                    this.tokenType = null;
+                    return cursor;
+                }
+case 96:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.INITIAL);
+            {
+                    this.tokenType = "html-tag";
+                    if (this._condition.parseCondition & this._parseConditions.SCRIPT) {
+                        if (!this._internalJavaScriptTokenizer) {
+                            this._internalJavaScriptTokenizer = WebInspector.SourceTokenizer.Registry.getInstance().getTokenizer("text/javascript");
+                            this._condition.internalJavaScriptTokenizerCondition = this._internalJavaScriptTokenizer.initialCondition;
+                        }
+                        // Do not tokenize script tag contents.
+                        return cursor;
+                    }
+
+                    this._condition.parseCondition = this._parseConditions.INITIAL;
+                    return cursor;
+                }
+case 98:
+            ++cursor;
+            yych = this._charAt(cursor);
+case 99:
+            if (yych <= '\f') {
+                if (yych != '\n') { gotoCase = 98; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 100; continue; };
+                if (yych == '\'') { gotoCase = 102; continue; };
+                { gotoCase = 98; continue; };
+            }
+case 100:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.SSTRING);
+            { return this._stringToken(cursor); }
+case 102:
+            ++cursor;
+            { return this._stringToken(cursor, true); }
+case 104:
+            ++cursor;
+            yych = this._charAt(cursor);
+case 105:
+            if (yych <= '\f') {
+                if (yych != '\n') { gotoCase = 104; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 106; continue; };
+                if (yych == '"') { gotoCase = 102; continue; };
+                { gotoCase = 104; continue; };
+            }
+case 106:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.DSTRING);
+            { return this._stringToken(cursor); }
+case 108:
+            ++cursor;
+            yych = this._charAt(cursor);
+case 109:
+            if (yych <= '"') {
+                if (yych <= '\r') {
+                    if (yych == '\n') { gotoCase = 89; continue; };
+                    if (yych <= '\f') { gotoCase = 108; continue; };
+                    { gotoCase = 89; continue; };
+                } else {
+                    if (yych == ' ') { gotoCase = 89; continue; };
+                    if (yych <= '!') { gotoCase = 108; continue; };
+                    { gotoCase = 89; continue; };
+                }
+            } else {
+                if (yych <= '>') {
+                    if (yych == '\'') { gotoCase = 89; continue; };
+                    if (yych <= ';') { gotoCase = 108; continue; };
+                    { gotoCase = 89; continue; };
+                } else {
+                    if (yych <= '[') {
+                        if (yych <= 'Z') { gotoCase = 108; continue; };
+                        { gotoCase = 89; continue; };
+                    } else {
+                        if (yych == ']') { gotoCase = 89; continue; };
+                        { gotoCase = 108; continue; };
+                    }
+                }
+            }
+        }
+
+        }
+    }
+}
+
+WebInspector.SourceHTMLTokenizer.prototype.__proto__ = WebInspector.SourceTokenizer.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceHTMLTokenizer.re2js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceHTMLTokenizer.re2js
new file mode 100644
index 0000000000..44c62b33d0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceHTMLTokenizer.re2js
@@ -0,0 +1,303 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Generate js file as follows:
+//
+// re2c -isc WebCore/inspector/front-end/SourceHTMLTokenizer.re2js \
+// | sed 's|^yy\([^:]*\)*\:|case \1:|' \
+// | sed 's|[*]cursor[+][+]|this._charAt(cursor++)|' \
+// | sed 's|[[*][+][+]cursor|this._charAt(++cursor)|' \
+// | sed 's|[*]cursor|this._charAt(cursor)|' \
+// | sed 's|yych = \*\([^;]*\)|yych = this._charAt\1|' \
+// | sed 's|goto case \([^;]*\)|{ gotoCase = \1; continue; }|' \
+// | sed 's|unsigned\ int|var|' \
+// | sed 's|var\ yych|case 1: var yych|'
+
+WebInspector.SourceHTMLTokenizer = function()
+{
+    WebInspector.SourceTokenizer.call(this);
+
+    // The order is determined by the generated code.
+    this._lexConditions = {
+        INITIAL: 0,
+        COMMENT: 1,
+        DOCTYPE: 2,
+        TAG: 3,
+        DSTRING: 4,
+        SSTRING: 5
+    };
+    this.case_INITIAL = 1000;
+    this.case_COMMENT = 1001;
+    this.case_DOCTYPE = 1002;
+    this.case_TAG = 1003;
+    this.case_DSTRING = 1004;
+    this.case_SSTRING = 1005;
+
+    this._parseConditions = {
+        INITIAL: 0,
+        ATTRIBUTE: 1,
+        ATTRIBUTE_VALUE: 2,
+        LINKIFY: 4,
+        A_NODE: 8,
+        SCRIPT: 16
+    };
+
+    this.initialCondition = { lexCondition: this._lexConditions.INITIAL, parseCondition: this._parseConditions.INITIAL };
+    this.condition = this.initialCondition;
+}
+
+WebInspector.SourceHTMLTokenizer.prototype = {
+    set line(line) {
+        if (this._internalJavaScriptTokenizer) {
+            var match = /<\/script/i.exec(line);
+            if (match) {
+                this._internalJavaScriptTokenizer.line = line.substring(0, match.index);
+            } else
+                this._internalJavaScriptTokenizer.line = line;
+        }
+        this._line = line;
+    },
+
+    _isExpectingAttribute: function()
+    {
+        return this._condition.parseCondition & this._parseConditions.ATTRIBUTE;
+    },
+
+    _isExpectingAttributeValue: function()
+    {
+        return this._condition.parseCondition & this._parseConditions.ATTRIBUTE_VALUE;
+    },
+
+    _setExpectingAttribute: function()
+    {
+        if (this._isExpectingAttributeValue())
+            this._condition.parseCondition ^= this._parseConditions.ATTRIBUTE_VALUE;
+        this._condition.parseCondition |= this._parseConditions.ATTRIBUTE;
+    },
+
+    _setExpectingAttributeValue: function()
+    {
+        if (this._isExpectingAttribute())
+            this._condition.parseCondition ^= this._parseConditions.ATTRIBUTE;
+        this._condition.parseCondition |= this._parseConditions.ATTRIBUTE_VALUE;
+    },
+
+    _stringToken: function(cursor, stringEnds)
+    {
+        if (!this._isExpectingAttributeValue()) {
+            this.tokenType = null;
+            return cursor;
+        }
+        this.tokenType = this._attrValueTokenType();
+        if (stringEnds)
+            this._setExpectingAttribute();
+        return cursor;
+    },
+
+    _attrValueTokenType: function()
+    {
+        if (this._condition.parseCondition & this._parseConditions.LINKIFY) {
+            if (this._condition.parseCondition & this._parseConditions.A_NODE)
+                return "html-external-link";
+            return "html-resource-link";
+        }
+        return "html-attribute-value";
+    },
+
+    nextToken: function(cursor)
+    {
+        if (this._internalJavaScriptTokenizer) {
+            // Re-set line to force </script> detection first.
+            this.line = this._line;
+            if (cursor !== this._internalJavaScriptTokenizer._line.length) {
+                // Tokenizer is stateless, so restore its condition before tokenizing and save it after.
+                this._internalJavaScriptTokenizer.condition = this._condition.internalJavaScriptTokenizerCondition;
+                var result = this._internalJavaScriptTokenizer.nextToken(cursor);
+                this.tokenType = this._internalJavaScriptTokenizer.tokenType;
+                this._condition.internalJavaScriptTokenizerCondition = this._internalJavaScriptTokenizer.condition;
+                return result;
+            } else if (cursor !== this._line.length)
+                delete this._internalJavaScriptTokenizer;
+        }
+
+        var cursorOnEnter = cursor;
+        var gotoCase = 1;
+        while (1) {
+            switch (gotoCase)
+            // Following comment is replaced with generated state machine.
+            /*!re2c
+                re2c:define:YYCTYPE  = "var";
+                re2c:define:YYCURSOR = cursor;
+                re2c:define:YYGETCONDITION = "this.getLexCondition";
+                re2c:define:YYSETCONDITION = "this.setLexCondition";
+                re2c:condprefix = "case this.case_";
+                re2c:condenumprefix = "this._lexConditions.";
+                re2c:yyfill:enable = 0;
+                re2c:labelprefix = "case ";
+                re2c:indent:top = 2;
+                re2c:indent:string = "    ";
+
+                CommentContent = ([^-\r\n] | ("--" [^>]))*;
+                Comment = "<!--" CommentContent "-->";
+                CommentStart = "<!--" CommentContent [\r\n];
+                CommentEnd = CommentContent "-->";
+
+                DocTypeStart = "<!" [Dd] [Oo] [Cc] [Tt] [Yy] [Pp] [Ee];
+                DocTypeContent = [^\r\n>]*;
+
+                ScriptStart = "<" [Ss] [Cc] [Rr] [Ii] [Pp] [Tt];
+                ScriptEnd = "</" [Ss] [Cc] [Rr] [Ii] [Pp] [Tt];
+
+                LT = "<" | "</";
+                GT = ">";
+                EqualSign = "=";
+
+                DoubleStringContent = [^\r\n\"]*;
+                SingleStringContent = [^\r\n\']*;
+                StringLiteral = "\"" DoubleStringContent "\"" | "'" SingleStringContent "'";
+                DoubleStringStart = "\"" DoubleStringContent [\r\n];
+                DoubleStringEnd = DoubleStringContent "\"";
+                SingleStringStart = "'" SingleStringContent [\r\n];
+                SingleStringEnd = SingleStringContent "'";
+
+                Identifier = [^ \r\n"'<>\[\]=]+;
+
+                <INITIAL> Comment { this.tokenType = "html-comment"; return cursor; }
+                <INITIAL> CommentStart => COMMENT { this.tokenType = "html-comment"; return cursor; }
+                <COMMENT> CommentContent => COMMENT { this.tokenType = "html-comment"; return cursor; }
+                <COMMENT> CommentEnd => INITIAL { this.tokenType = "html-comment"; return cursor; }
+
+                <INITIAL> DocTypeStart => DOCTYPE { this.tokenType = "html-doctype"; return cursor; }
+                <DOCTYPE> DocTypeContent => DOCTYPE { this.tokenType = "html-doctype"; return cursor; }
+                <DOCTYPE> GT => INITIAL { this.tokenType = "html-doctype"; return cursor; }
+
+                <INITIAL> ScriptStart => TAG
+                {
+                    if (this._condition.parseCondition & this._parseConditions.SCRIPT) {
+                        // Do not tokenize script tag contents, keep lexer state although processing "<".
+                        this.setLexCondition(this._lexConditions.INITIAL);
+                        this.tokenType = null;
+                        return cursor;
+                    }
+                    this.tokenType = "html-tag";
+                    this._condition.parseCondition = this._parseConditions.SCRIPT;
+                    this._setExpectingAttribute();
+                    return cursor;
+                }
+
+                <INITIAL> ScriptEnd => TAG
+                {
+                    this.tokenType = "html-tag";
+                    this._condition.parseCondition = this._parseConditions.INITIAL;
+                    return cursor;
+                }
+
+                <INITIAL> LT => TAG
+                {
+                    if (this._condition.parseCondition & this._parseConditions.SCRIPT) {
+                        // Do not tokenize script tag contents, keep lexer state although processing "<".
+                        this.setLexCondition(this._lexConditions.INITIAL);
+                        this.tokenType = null;
+                        return cursor;
+                    }
+
+                    this._condition.parseCondition = this._parseConditions.INITIAL;
+                    this.tokenType = "html-tag";
+                    return cursor;
+                }
+  
+                <TAG> GT => INITIAL
+                {
+                    this.tokenType = "html-tag";
+                    if (this._condition.parseCondition & this._parseConditions.SCRIPT) {
+                        if (!this._internalJavaScriptTokenizer) {
+                            this._internalJavaScriptTokenizer = WebInspector.SourceTokenizer.Registry.getInstance().getTokenizer("text/javascript");
+                            this._condition.internalJavaScriptTokenizerCondition = this._internalJavaScriptTokenizer.initialCondition;
+                        }
+                        // Do not tokenize script tag contents.
+                        return cursor;
+                    }
+
+                    this._condition.parseCondition = this._parseConditions.INITIAL;
+                    return cursor;
+                }
+
+                <TAG> StringLiteral { return this._stringToken(cursor, true); }
+                <TAG> DoubleStringStart => DSTRING { return this._stringToken(cursor); }
+                <DSTRING> DoubleStringContent => DSTRING { return this._stringToken(cursor); }
+                <DSTRING> DoubleStringEnd => TAG { return this._stringToken(cursor, true); }
+                <TAG> SingleStringStart => SSTRING { return this._stringToken(cursor); }
+                <SSTRING> SingleStringContent => SSTRING { return this._stringToken(cursor); }
+                <SSTRING> SingleStringEnd => TAG { return this._stringToken(cursor, true); }
+
+                <TAG> EqualSign => TAG
+                {
+                    if (this._isExpectingAttribute())
+                        this._setExpectingAttributeValue();
+                    this.tokenType = null;
+                    return cursor;
+                }
+
+                <TAG> Identifier
+                {
+                    if (this._condition.parseCondition === this._parseConditions.SCRIPT) {
+                        // Fall through if expecting attributes.
+                        this.tokenType = null;
+                        return cursor;
+                    }
+
+                    if (this._condition.parseCondition === this._parseConditions.INITIAL) {
+                        this.tokenType = "html-tag";
+                        this._setExpectingAttribute();
+                        var token = this._line.substring(cursorOnEnter, cursor);
+                        if (token === "a")
+                            this._condition.parseCondition |= this._parseConditions.A_NODE;
+                        else if (this._condition.parseCondition & this._parseConditions.A_NODE)
+                            this._condition.parseCondition ^= this._parseConditions.A_NODE;
+                    } else if (this._isExpectingAttribute()) {
+                        var token = this._line.substring(cursorOnEnter, cursor);
+                        if (token === "href" || token === "src")
+                            this._condition.parseCondition |= this._parseConditions.LINKIFY;
+                        else if (this._condition.parseCondition |= this._parseConditions.LINKIFY)
+                            this._condition.parseCondition ^= this._parseConditions.LINKIFY;
+                        this.tokenType = "html-attribute-name";
+                    } else if (this._isExpectingAttributeValue())
+                        this.tokenType = this._attrValueTokenType();
+                    else
+                        this.tokenType = null;
+                    return cursor;
+                }
+                <*> [^] { this.tokenType = null; return cursor; }
+            */
+        }
+    }
+}
+
+WebInspector.SourceHTMLTokenizer.prototype.__proto__ = WebInspector.SourceTokenizer.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js
new file mode 100644
index 0000000000..fbd44d7897
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js
@@ -0,0 +1,2417 @@
+/* Generated by re2c 0.13.5 on Thu Feb 25 21:44:55 2010 */
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Generate js file as follows:
+//
+// re2c -isc WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js \
+// | sed 's|^yy\([^:]*\)*\:|case \1:|' \
+// | sed 's|[*]cursor[+][+]|this._charAt(cursor++)|' \
+// | sed 's|[[*][+][+]cursor|this._charAt(++cursor)|' \
+// | sed 's|[*]cursor|this._charAt(cursor)|' \
+// | sed 's|yych = \*\([^;]*\)|yych = this._charAt\1|' \
+// | sed 's|{ gotoCase = \([^; continue; };]*\)|{ gotoCase = \1; continue; }|' \
+// | sed 's|unsigned\ int|var|' \
+// | sed 's|var\ yych|case 1: case 1: var yych|'
+
+WebInspector.SourceJavaScriptTokenizer = function()
+{
+    WebInspector.SourceTokenizer.call(this);
+
+    this._keywords = [
+        "null", "true", "false", "break", "case", "catch", "const", "default", "finally", "for",
+        "instanceof", "new", "var", "continue", "function", "return", "void", "delete", "if",
+        "this", "do", "while", "else", "in", "switch", "throw", "try", "typeof", "debugger",
+        "class", "enum", "export", "extends", "import", "super", "get", "set", "with"
+    ].keySet();
+
+    this._lexConditions = {
+        DIV: 0,
+        NODIV: 1,
+        COMMENT: 2,
+        DSTRING: 3,
+        SSTRING: 4,
+        REGEX: 5
+    };
+
+    this.case_DIV = 1000;
+    this.case_NODIV = 1001;
+    this.case_COMMENT = 1002;
+    this.case_DSTRING = 1003;
+    this.case_SSTRING = 1004;
+    this.case_REGEX = 1005;
+
+    this.initialCondition = { lexCondition: this._lexConditions.NODIV }
+    this.condition = this.initialCondition;
+}
+
+WebInspector.SourceJavaScriptTokenizer.prototype = {
+    nextToken: function(cursor)
+    {
+        var cursorOnEnter = cursor;
+        var gotoCase = 1;
+        while (1) {
+            switch (gotoCase)
+            // Following comment is replaced with generated state machine.
+            
+        {
+            case 1: var yych;
+            var yyaccept = 0;
+            if (this.getLexCondition() < 3) {
+                if (this.getLexCondition() < 1) {
+                    { gotoCase = this.case_DIV; continue; };
+                } else {
+                    if (this.getLexCondition() < 2) {
+                        { gotoCase = this.case_NODIV; continue; };
+                    } else {
+                        { gotoCase = this.case_COMMENT; continue; };
+                    }
+                }
+            } else {
+                if (this.getLexCondition() < 4) {
+                    { gotoCase = this.case_DSTRING; continue; };
+                } else {
+                    if (this.getLexCondition() < 5) {
+                        { gotoCase = this.case_SSTRING; continue; };
+                    } else {
+                        { gotoCase = this.case_REGEX; continue; };
+                    }
+                }
+            }
+/* *********************************** */
+case this.case_COMMENT:
+
+            yych = this._charAt(cursor);
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 4; continue; };
+                { gotoCase = 3; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 4; continue; };
+                if (yych == '*') { gotoCase = 6; continue; };
+                { gotoCase = 3; continue; };
+            }
+case 2:
+            { this.tokenType = "javascript-comment"; return cursor; }
+case 3:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            { gotoCase = 12; continue; };
+case 4:
+            ++cursor;
+            { this.tokenType = null; return cursor; }
+case 6:
+            yyaccept = 1;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych == '*') { gotoCase = 9; continue; };
+            if (yych != '/') { gotoCase = 11; continue; };
+case 7:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.NODIV);
+            { this.tokenType = "javascript-comment"; return cursor; }
+case 9:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '*') { gotoCase = 9; continue; };
+            if (yych == '/') { gotoCase = 7; continue; };
+case 11:
+            yyaccept = 0;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+case 12:
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 2; continue; };
+                { gotoCase = 11; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 2; continue; };
+                if (yych == '*') { gotoCase = 9; continue; };
+                { gotoCase = 11; continue; };
+            }
+/* *********************************** */
+case this.case_DIV:
+            yych = this._charAt(cursor);
+            if (yych <= '9') {
+                if (yych <= '(') {
+                    if (yych <= '#') {
+                        if (yych <= ' ') { gotoCase = 15; continue; };
+                        if (yych <= '!') { gotoCase = 17; continue; };
+                        if (yych <= '"') { gotoCase = 19; continue; };
+                    } else {
+                        if (yych <= '%') {
+                            if (yych <= '$') { gotoCase = 20; continue; };
+                            { gotoCase = 22; continue; };
+                        } else {
+                            if (yych <= '&') { gotoCase = 23; continue; };
+                            if (yych <= '\'') { gotoCase = 24; continue; };
+                            { gotoCase = 25; continue; };
+                        }
+                    }
+                } else {
+                    if (yych <= ',') {
+                        if (yych <= ')') { gotoCase = 26; continue; };
+                        if (yych <= '*') { gotoCase = 28; continue; };
+                        if (yych <= '+') { gotoCase = 29; continue; };
+                        { gotoCase = 25; continue; };
+                    } else {
+                        if (yych <= '.') {
+                            if (yych <= '-') { gotoCase = 30; continue; };
+                            { gotoCase = 31; continue; };
+                        } else {
+                            if (yych <= '/') { gotoCase = 32; continue; };
+                            if (yych <= '0') { gotoCase = 34; continue; };
+                            { gotoCase = 36; continue; };
+                        }
+                    }
+                }
+            } else {
+                if (yych <= '\\') {
+                    if (yych <= '>') {
+                        if (yych <= ';') { gotoCase = 25; continue; };
+                        if (yych <= '<') { gotoCase = 37; continue; };
+                        if (yych <= '=') { gotoCase = 38; continue; };
+                        { gotoCase = 39; continue; };
+                    } else {
+                        if (yych <= '@') {
+                            if (yych <= '?') { gotoCase = 25; continue; };
+                        } else {
+                            if (yych <= 'Z') { gotoCase = 20; continue; };
+                            if (yych <= '[') { gotoCase = 25; continue; };
+                            { gotoCase = 40; continue; };
+                        }
+                    }
+                } else {
+                    if (yych <= 'z') {
+                        if (yych <= '^') {
+                            if (yych <= ']') { gotoCase = 25; continue; };
+                            { gotoCase = 41; continue; };
+                        } else {
+                            if (yych != '`') { gotoCase = 20; continue; };
+                        }
+                    } else {
+                        if (yych <= '|') {
+                            if (yych <= '{') { gotoCase = 25; continue; };
+                            { gotoCase = 42; continue; };
+                        } else {
+                            if (yych <= '~') { gotoCase = 25; continue; };
+                            if (yych >= 0x80) { gotoCase = 20; continue; };
+                        }
+                    }
+                }
+            }
+case 15:
+            ++cursor;
+case 16:
+            { this.tokenType = null; return cursor; }
+case 17:
+            ++cursor;
+            if ((yych = this._charAt(cursor)) == '=') { gotoCase = 115; continue; };
+case 18:
+            this.setLexCondition(this._lexConditions.NODIV);
+            { this.tokenType = null; return cursor; }
+case 19:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych == '\n') { gotoCase = 16; continue; };
+            if (yych == '\r') { gotoCase = 16; continue; };
+            { gotoCase = 107; continue; };
+case 20:
+            yyaccept = 1;
+            yych = this._charAt(YYMARKER = ++cursor);
+            { gotoCase = 50; continue; };
+case 21:
+            {
+                    var token = this._line.substring(cursorOnEnter, cursor);
+                    if (token in this._keywords)
+                        this.tokenType = "javascript-keyword";
+                    else
+                        this.tokenType = "javascript-ident";
+                    return cursor;
+                }
+case 22:
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 43; continue; };
+            { gotoCase = 18; continue; };
+case 23:
+            yych = this._charAt(++cursor);
+            if (yych == '&') { gotoCase = 43; continue; };
+            if (yych == '=') { gotoCase = 43; continue; };
+            { gotoCase = 18; continue; };
+case 24:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych == '\n') { gotoCase = 16; continue; };
+            if (yych == '\r') { gotoCase = 16; continue; };
+            { gotoCase = 96; continue; };
+case 25:
+            yych = this._charAt(++cursor);
+            { gotoCase = 18; continue; };
+case 26:
+            ++cursor;
+            { this.tokenType = null; return cursor; }
+case 28:
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 43; continue; };
+            { gotoCase = 18; continue; };
+case 29:
+            yych = this._charAt(++cursor);
+            if (yych == '+') { gotoCase = 43; continue; };
+            if (yych == '=') { gotoCase = 43; continue; };
+            { gotoCase = 18; continue; };
+case 30:
+            yych = this._charAt(++cursor);
+            if (yych == '-') { gotoCase = 43; continue; };
+            if (yych == '=') { gotoCase = 43; continue; };
+            { gotoCase = 18; continue; };
+case 31:
+            yych = this._charAt(++cursor);
+            if (yych <= '/') { gotoCase = 18; continue; };
+            if (yych <= '9') { gotoCase = 89; continue; };
+            { gotoCase = 18; continue; };
+case 32:
+            yyaccept = 2;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych <= '.') {
+                if (yych == '*') { gotoCase = 78; continue; };
+            } else {
+                if (yych <= '/') { gotoCase = 80; continue; };
+                if (yych == '=') { gotoCase = 77; continue; };
+            }
+case 33:
+            this.setLexCondition(this._lexConditions.NODIV);
+            { this.tokenType = null; return cursor; }
+case 34:
+            yyaccept = 3;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych <= 'E') {
+                if (yych <= '/') {
+                    if (yych == '.') { gotoCase = 63; continue; };
+                } else {
+                    if (yych <= '7') { gotoCase = 72; continue; };
+                    if (yych >= 'E') { gotoCase = 62; continue; };
+                }
+            } else {
+                if (yych <= 'd') {
+                    if (yych == 'X') { gotoCase = 74; continue; };
+                } else {
+                    if (yych <= 'e') { gotoCase = 62; continue; };
+                    if (yych == 'x') { gotoCase = 74; continue; };
+                }
+            }
+case 35:
+            { this.tokenType = "javascript-number"; return cursor; }
+case 36:
+            yyaccept = 3;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych <= '9') {
+                if (yych == '.') { gotoCase = 63; continue; };
+                if (yych <= '/') { gotoCase = 35; continue; };
+                { gotoCase = 60; continue; };
+            } else {
+                if (yych <= 'E') {
+                    if (yych <= 'D') { gotoCase = 35; continue; };
+                    { gotoCase = 62; continue; };
+                } else {
+                    if (yych == 'e') { gotoCase = 62; continue; };
+                    { gotoCase = 35; continue; };
+                }
+            }
+case 37:
+            yych = this._charAt(++cursor);
+            if (yych <= ';') { gotoCase = 18; continue; };
+            if (yych <= '<') { gotoCase = 59; continue; };
+            if (yych <= '=') { gotoCase = 43; continue; };
+            { gotoCase = 18; continue; };
+case 38:
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 58; continue; };
+            { gotoCase = 18; continue; };
+case 39:
+            yych = this._charAt(++cursor);
+            if (yych <= '<') { gotoCase = 18; continue; };
+            if (yych <= '=') { gotoCase = 43; continue; };
+            if (yych <= '>') { gotoCase = 56; continue; };
+            { gotoCase = 18; continue; };
+case 40:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych == 'u') { gotoCase = 44; continue; };
+            { gotoCase = 16; continue; };
+case 41:
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 43; continue; };
+            { gotoCase = 18; continue; };
+case 42:
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 43; continue; };
+            if (yych != '|') { gotoCase = 18; continue; };
+case 43:
+            yych = this._charAt(++cursor);
+            { gotoCase = 18; continue; };
+case 44:
+            yych = this._charAt(++cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych <= '9') { gotoCase = 46; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 46; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych <= 'f') { gotoCase = 46; continue; };
+            }
+case 45:
+            cursor = YYMARKER;
+            if (yyaccept <= 1) {
+                if (yyaccept <= 0) {
+                    { gotoCase = 16; continue; };
+                } else {
+                    { gotoCase = 21; continue; };
+                }
+            } else {
+                if (yyaccept <= 2) {
+                    { gotoCase = 33; continue; };
+                } else {
+                    { gotoCase = 35; continue; };
+                }
+            }
+case 46:
+            yych = this._charAt(++cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych >= ':') { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 47; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych >= 'g') { gotoCase = 45; continue; };
+            }
+case 47:
+            yych = this._charAt(++cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych >= ':') { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 48; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych >= 'g') { gotoCase = 45; continue; };
+            }
+case 48:
+            yych = this._charAt(++cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych >= ':') { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 49; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych >= 'g') { gotoCase = 45; continue; };
+            }
+case 49:
+            yyaccept = 1;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+case 50:
+            if (yych <= '[') {
+                if (yych <= '/') {
+                    if (yych == '$') { gotoCase = 49; continue; };
+                    { gotoCase = 21; continue; };
+                } else {
+                    if (yych <= '9') { gotoCase = 49; continue; };
+                    if (yych <= '@') { gotoCase = 21; continue; };
+                    if (yych <= 'Z') { gotoCase = 49; continue; };
+                    { gotoCase = 21; continue; };
+                }
+            } else {
+                if (yych <= '_') {
+                    if (yych <= '\\') { gotoCase = 51; continue; };
+                    if (yych <= '^') { gotoCase = 21; continue; };
+                    { gotoCase = 49; continue; };
+                } else {
+                    if (yych <= '`') { gotoCase = 21; continue; };
+                    if (yych <= 'z') { gotoCase = 49; continue; };
+                    if (yych <= 0x7F) { gotoCase = 21; continue; };
+                    { gotoCase = 49; continue; };
+                }
+            }
+case 51:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych != 'u') { gotoCase = 45; continue; };
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych >= ':') { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 53; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych >= 'g') { gotoCase = 45; continue; };
+            }
+case 53:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych >= ':') { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 54; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych >= 'g') { gotoCase = 45; continue; };
+            }
+case 54:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych >= ':') { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 55; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych >= 'g') { gotoCase = 45; continue; };
+            }
+case 55:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych <= '9') { gotoCase = 49; continue; };
+                { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 49; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych <= 'f') { gotoCase = 49; continue; };
+                { gotoCase = 45; continue; };
+            }
+case 56:
+            yych = this._charAt(++cursor);
+            if (yych <= '<') { gotoCase = 18; continue; };
+            if (yych <= '=') { gotoCase = 43; continue; };
+            if (yych >= '?') { gotoCase = 18; continue; };
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 43; continue; };
+            { gotoCase = 18; continue; };
+case 58:
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 43; continue; };
+            { gotoCase = 18; continue; };
+case 59:
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 43; continue; };
+            { gotoCase = 18; continue; };
+case 60:
+            yyaccept = 3;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '9') {
+                if (yych == '.') { gotoCase = 63; continue; };
+                if (yych <= '/') { gotoCase = 35; continue; };
+                { gotoCase = 60; continue; };
+            } else {
+                if (yych <= 'E') {
+                    if (yych <= 'D') { gotoCase = 35; continue; };
+                } else {
+                    if (yych != 'e') { gotoCase = 35; continue; };
+                }
+            }
+case 62:
+            yych = this._charAt(++cursor);
+            if (yych <= ',') {
+                if (yych == '+') { gotoCase = 69; continue; };
+                { gotoCase = 45; continue; };
+            } else {
+                if (yych <= '-') { gotoCase = 69; continue; };
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych <= '9') { gotoCase = 70; continue; };
+                { gotoCase = 45; continue; };
+            }
+case 63:
+            yyaccept = 3;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'D') {
+                if (yych <= '/') { gotoCase = 35; continue; };
+                if (yych <= '9') { gotoCase = 63; continue; };
+                { gotoCase = 35; continue; };
+            } else {
+                if (yych <= 'E') { gotoCase = 65; continue; };
+                if (yych != 'e') { gotoCase = 35; continue; };
+            }
+case 65:
+            yych = this._charAt(++cursor);
+            if (yych <= ',') {
+                if (yych != '+') { gotoCase = 45; continue; };
+            } else {
+                if (yych <= '-') { gotoCase = 66; continue; };
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych <= '9') { gotoCase = 67; continue; };
+                { gotoCase = 45; continue; };
+            }
+case 66:
+            yych = this._charAt(++cursor);
+            if (yych <= '/') { gotoCase = 45; continue; };
+            if (yych >= ':') { gotoCase = 45; continue; };
+case 67:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '/') { gotoCase = 35; continue; };
+            if (yych <= '9') { gotoCase = 67; continue; };
+            { gotoCase = 35; continue; };
+case 69:
+            yych = this._charAt(++cursor);
+            if (yych <= '/') { gotoCase = 45; continue; };
+            if (yych >= ':') { gotoCase = 45; continue; };
+case 70:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '/') { gotoCase = 35; continue; };
+            if (yych <= '9') { gotoCase = 70; continue; };
+            { gotoCase = 35; continue; };
+case 72:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '/') { gotoCase = 35; continue; };
+            if (yych <= '7') { gotoCase = 72; continue; };
+            { gotoCase = 35; continue; };
+case 74:
+            yych = this._charAt(++cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych >= ':') { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 75; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych >= 'g') { gotoCase = 45; continue; };
+            }
+case 75:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 35; continue; };
+                if (yych <= '9') { gotoCase = 75; continue; };
+                { gotoCase = 35; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 75; continue; };
+                if (yych <= '`') { gotoCase = 35; continue; };
+                if (yych <= 'f') { gotoCase = 75; continue; };
+                { gotoCase = 35; continue; };
+            }
+case 77:
+            yych = this._charAt(++cursor);
+            { gotoCase = 33; continue; };
+case 78:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 85; continue; };
+                { gotoCase = 78; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 85; continue; };
+                if (yych == '*') { gotoCase = 83; continue; };
+                { gotoCase = 78; continue; };
+            }
+case 80:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '\n') { gotoCase = 82; continue; };
+            if (yych != '\r') { gotoCase = 80; continue; };
+case 82:
+            { this.tokenType = "javascript-comment"; return cursor; }
+case 83:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '*') { gotoCase = 83; continue; };
+            if (yych == '/') { gotoCase = 87; continue; };
+            { gotoCase = 78; continue; };
+case 85:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.COMMENT);
+            { this.tokenType = "javascript-comment"; return cursor; }
+case 87:
+            ++cursor;
+            { this.tokenType = "javascript-comment"; return cursor; }
+case 89:
+            yyaccept = 3;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'D') {
+                if (yych <= '/') { gotoCase = 35; continue; };
+                if (yych <= '9') { gotoCase = 89; continue; };
+                { gotoCase = 35; continue; };
+            } else {
+                if (yych <= 'E') { gotoCase = 91; continue; };
+                if (yych != 'e') { gotoCase = 35; continue; };
+            }
+case 91:
+            yych = this._charAt(++cursor);
+            if (yych <= ',') {
+                if (yych != '+') { gotoCase = 45; continue; };
+            } else {
+                if (yych <= '-') { gotoCase = 92; continue; };
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych <= '9') { gotoCase = 93; continue; };
+                { gotoCase = 45; continue; };
+            }
+case 92:
+            yych = this._charAt(++cursor);
+            if (yych <= '/') { gotoCase = 45; continue; };
+            if (yych >= ':') { gotoCase = 45; continue; };
+case 93:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '/') { gotoCase = 35; continue; };
+            if (yych <= '9') { gotoCase = 93; continue; };
+            { gotoCase = 35; continue; };
+case 95:
+            ++cursor;
+            yych = this._charAt(cursor);
+case 96:
+            if (yych <= '\r') {
+                if (yych == '\n') { gotoCase = 45; continue; };
+                if (yych <= '\f') { gotoCase = 95; continue; };
+                { gotoCase = 45; continue; };
+            } else {
+                if (yych <= '\'') {
+                    if (yych <= '&') { gotoCase = 95; continue; };
+                    { gotoCase = 98; continue; };
+                } else {
+                    if (yych != '\\') { gotoCase = 95; continue; };
+                }
+            }
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'a') {
+                if (yych <= '!') {
+                    if (yych <= '\n') {
+                        if (yych <= '\t') { gotoCase = 45; continue; };
+                        { gotoCase = 101; continue; };
+                    } else {
+                        if (yych == '\r') { gotoCase = 101; continue; };
+                        { gotoCase = 45; continue; };
+                    }
+                } else {
+                    if (yych <= '\'') {
+                        if (yych <= '"') { gotoCase = 95; continue; };
+                        if (yych <= '&') { gotoCase = 45; continue; };
+                        { gotoCase = 95; continue; };
+                    } else {
+                        if (yych == '\\') { gotoCase = 95; continue; };
+                        { gotoCase = 45; continue; };
+                    }
+                }
+            } else {
+                if (yych <= 'q') {
+                    if (yych <= 'f') {
+                        if (yych <= 'b') { gotoCase = 95; continue; };
+                        if (yych <= 'e') { gotoCase = 45; continue; };
+                        { gotoCase = 95; continue; };
+                    } else {
+                        if (yych == 'n') { gotoCase = 95; continue; };
+                        { gotoCase = 45; continue; };
+                    }
+                } else {
+                    if (yych <= 't') {
+                        if (yych == 's') { gotoCase = 45; continue; };
+                        { gotoCase = 95; continue; };
+                    } else {
+                        if (yych <= 'u') { gotoCase = 100; continue; };
+                        if (yych <= 'v') { gotoCase = 95; continue; };
+                        { gotoCase = 45; continue; };
+                    }
+                }
+            }
+case 98:
+            ++cursor;
+            { this.tokenType = "javascript-string"; return cursor; }
+case 100:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych <= '9') { gotoCase = 103; continue; };
+                { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 103; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych <= 'f') { gotoCase = 103; continue; };
+                { gotoCase = 45; continue; };
+            }
+case 101:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.SSTRING);
+            { this.tokenType = "javascript-string"; return cursor; }
+case 103:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych >= ':') { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 104; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych >= 'g') { gotoCase = 45; continue; };
+            }
+case 104:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych >= ':') { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 105; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych >= 'g') { gotoCase = 45; continue; };
+            }
+case 105:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych <= '9') { gotoCase = 95; continue; };
+                { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 95; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych <= 'f') { gotoCase = 95; continue; };
+                { gotoCase = 45; continue; };
+            }
+case 106:
+            ++cursor;
+            yych = this._charAt(cursor);
+case 107:
+            if (yych <= '\r') {
+                if (yych == '\n') { gotoCase = 45; continue; };
+                if (yych <= '\f') { gotoCase = 106; continue; };
+                { gotoCase = 45; continue; };
+            } else {
+                if (yych <= '"') {
+                    if (yych <= '!') { gotoCase = 106; continue; };
+                    { gotoCase = 98; continue; };
+                } else {
+                    if (yych != '\\') { gotoCase = 106; continue; };
+                }
+            }
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'a') {
+                if (yych <= '!') {
+                    if (yych <= '\n') {
+                        if (yych <= '\t') { gotoCase = 45; continue; };
+                        { gotoCase = 110; continue; };
+                    } else {
+                        if (yych == '\r') { gotoCase = 110; continue; };
+                        { gotoCase = 45; continue; };
+                    }
+                } else {
+                    if (yych <= '\'') {
+                        if (yych <= '"') { gotoCase = 106; continue; };
+                        if (yych <= '&') { gotoCase = 45; continue; };
+                        { gotoCase = 106; continue; };
+                    } else {
+                        if (yych == '\\') { gotoCase = 106; continue; };
+                        { gotoCase = 45; continue; };
+                    }
+                }
+            } else {
+                if (yych <= 'q') {
+                    if (yych <= 'f') {
+                        if (yych <= 'b') { gotoCase = 106; continue; };
+                        if (yych <= 'e') { gotoCase = 45; continue; };
+                        { gotoCase = 106; continue; };
+                    } else {
+                        if (yych == 'n') { gotoCase = 106; continue; };
+                        { gotoCase = 45; continue; };
+                    }
+                } else {
+                    if (yych <= 't') {
+                        if (yych == 's') { gotoCase = 45; continue; };
+                        { gotoCase = 106; continue; };
+                    } else {
+                        if (yych <= 'u') { gotoCase = 109; continue; };
+                        if (yych <= 'v') { gotoCase = 106; continue; };
+                        { gotoCase = 45; continue; };
+                    }
+                }
+            }
+case 109:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych <= '9') { gotoCase = 112; continue; };
+                { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 112; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych <= 'f') { gotoCase = 112; continue; };
+                { gotoCase = 45; continue; };
+            }
+case 110:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.DSTRING);
+            { this.tokenType = "javascript-string"; return cursor; }
+case 112:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych >= ':') { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 113; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych >= 'g') { gotoCase = 45; continue; };
+            }
+case 113:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych >= ':') { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 114; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych >= 'g') { gotoCase = 45; continue; };
+            }
+case 114:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 45; continue; };
+                if (yych <= '9') { gotoCase = 106; continue; };
+                { gotoCase = 45; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 106; continue; };
+                if (yych <= '`') { gotoCase = 45; continue; };
+                if (yych <= 'f') { gotoCase = 106; continue; };
+                { gotoCase = 45; continue; };
+            }
+case 115:
+            ++cursor;
+            if ((yych = this._charAt(cursor)) == '=') { gotoCase = 43; continue; };
+            { gotoCase = 18; continue; };
+/* *********************************** */
+case this.case_DSTRING:
+            yych = this._charAt(cursor);
+            if (yych <= '\r') {
+                if (yych == '\n') { gotoCase = 120; continue; };
+                if (yych <= '\f') { gotoCase = 119; continue; };
+                { gotoCase = 120; continue; };
+            } else {
+                if (yych <= '"') {
+                    if (yych <= '!') { gotoCase = 119; continue; };
+                    { gotoCase = 122; continue; };
+                } else {
+                    if (yych == '\\') { gotoCase = 124; continue; };
+                    { gotoCase = 119; continue; };
+                }
+            }
+case 118:
+            { this.tokenType = "javascript-string"; return cursor; }
+case 119:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            { gotoCase = 126; continue; };
+case 120:
+            ++cursor;
+case 121:
+            { this.tokenType = null; return cursor; }
+case 122:
+            ++cursor;
+case 123:
+            this.setLexCondition(this._lexConditions.NODIV);
+            { this.tokenType = "javascript-string"; return cursor; }
+case 124:
+            yyaccept = 1;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych <= 'e') {
+                if (yych <= '\'') {
+                    if (yych == '"') { gotoCase = 125; continue; };
+                    if (yych <= '&') { gotoCase = 121; continue; };
+                } else {
+                    if (yych <= '\\') {
+                        if (yych <= '[') { gotoCase = 121; continue; };
+                    } else {
+                        if (yych != 'b') { gotoCase = 121; continue; };
+                    }
+                }
+            } else {
+                if (yych <= 'r') {
+                    if (yych <= 'm') {
+                        if (yych >= 'g') { gotoCase = 121; continue; };
+                    } else {
+                        if (yych <= 'n') { gotoCase = 125; continue; };
+                        if (yych <= 'q') { gotoCase = 121; continue; };
+                    }
+                } else {
+                    if (yych <= 't') {
+                        if (yych <= 's') { gotoCase = 121; continue; };
+                    } else {
+                        if (yych <= 'u') { gotoCase = 127; continue; };
+                        if (yych >= 'w') { gotoCase = 121; continue; };
+                    }
+                }
+            }
+case 125:
+            yyaccept = 0;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+case 126:
+            if (yych <= '\r') {
+                if (yych == '\n') { gotoCase = 118; continue; };
+                if (yych <= '\f') { gotoCase = 125; continue; };
+                { gotoCase = 118; continue; };
+            } else {
+                if (yych <= '"') {
+                    if (yych <= '!') { gotoCase = 125; continue; };
+                    { gotoCase = 133; continue; };
+                } else {
+                    if (yych == '\\') { gotoCase = 132; continue; };
+                    { gotoCase = 125; continue; };
+                }
+            }
+case 127:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 128; continue; };
+                if (yych <= '9') { gotoCase = 129; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 129; continue; };
+                if (yych <= '`') { gotoCase = 128; continue; };
+                if (yych <= 'f') { gotoCase = 129; continue; };
+            }
+case 128:
+            cursor = YYMARKER;
+            if (yyaccept <= 0) {
+                { gotoCase = 118; continue; };
+            } else {
+                { gotoCase = 121; continue; };
+            }
+case 129:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 128; continue; };
+                if (yych >= ':') { gotoCase = 128; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 130; continue; };
+                if (yych <= '`') { gotoCase = 128; continue; };
+                if (yych >= 'g') { gotoCase = 128; continue; };
+            }
+case 130:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 128; continue; };
+                if (yych >= ':') { gotoCase = 128; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 131; continue; };
+                if (yych <= '`') { gotoCase = 128; continue; };
+                if (yych >= 'g') { gotoCase = 128; continue; };
+            }
+case 131:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 128; continue; };
+                if (yych <= '9') { gotoCase = 125; continue; };
+                { gotoCase = 128; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 125; continue; };
+                if (yych <= '`') { gotoCase = 128; continue; };
+                if (yych <= 'f') { gotoCase = 125; continue; };
+                { gotoCase = 128; continue; };
+            }
+case 132:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'e') {
+                if (yych <= '\'') {
+                    if (yych == '"') { gotoCase = 125; continue; };
+                    if (yych <= '&') { gotoCase = 128; continue; };
+                    { gotoCase = 125; continue; };
+                } else {
+                    if (yych <= '\\') {
+                        if (yych <= '[') { gotoCase = 128; continue; };
+                        { gotoCase = 125; continue; };
+                    } else {
+                        if (yych == 'b') { gotoCase = 125; continue; };
+                        { gotoCase = 128; continue; };
+                    }
+                }
+            } else {
+                if (yych <= 'r') {
+                    if (yych <= 'm') {
+                        if (yych <= 'f') { gotoCase = 125; continue; };
+                        { gotoCase = 128; continue; };
+                    } else {
+                        if (yych <= 'n') { gotoCase = 125; continue; };
+                        if (yych <= 'q') { gotoCase = 128; continue; };
+                        { gotoCase = 125; continue; };
+                    }
+                } else {
+                    if (yych <= 't') {
+                        if (yych <= 's') { gotoCase = 128; continue; };
+                        { gotoCase = 125; continue; };
+                    } else {
+                        if (yych <= 'u') { gotoCase = 127; continue; };
+                        if (yych <= 'v') { gotoCase = 125; continue; };
+                        { gotoCase = 128; continue; };
+                    }
+                }
+            }
+case 133:
+            ++cursor;
+            yych = this._charAt(cursor);
+            { gotoCase = 123; continue; };
+/* *********************************** */
+case this.case_NODIV:
+            yych = this._charAt(cursor);
+            if (yych <= '9') {
+                if (yych <= '(') {
+                    if (yych <= '#') {
+                        if (yych <= ' ') { gotoCase = 136; continue; };
+                        if (yych <= '!') { gotoCase = 138; continue; };
+                        if (yych <= '"') { gotoCase = 140; continue; };
+                    } else {
+                        if (yych <= '%') {
+                            if (yych <= '$') { gotoCase = 141; continue; };
+                            { gotoCase = 143; continue; };
+                        } else {
+                            if (yych <= '&') { gotoCase = 144; continue; };
+                            if (yych <= '\'') { gotoCase = 145; continue; };
+                            { gotoCase = 146; continue; };
+                        }
+                    }
+                } else {
+                    if (yych <= ',') {
+                        if (yych <= ')') { gotoCase = 147; continue; };
+                        if (yych <= '*') { gotoCase = 149; continue; };
+                        if (yych <= '+') { gotoCase = 150; continue; };
+                        { gotoCase = 146; continue; };
+                    } else {
+                        if (yych <= '.') {
+                            if (yych <= '-') { gotoCase = 151; continue; };
+                            { gotoCase = 152; continue; };
+                        } else {
+                            if (yych <= '/') { gotoCase = 153; continue; };
+                            if (yych <= '0') { gotoCase = 154; continue; };
+                            { gotoCase = 156; continue; };
+                        }
+                    }
+                }
+            } else {
+                if (yych <= '\\') {
+                    if (yych <= '>') {
+                        if (yych <= ';') { gotoCase = 146; continue; };
+                        if (yych <= '<') { gotoCase = 157; continue; };
+                        if (yych <= '=') { gotoCase = 158; continue; };
+                        { gotoCase = 159; continue; };
+                    } else {
+                        if (yych <= '@') {
+                            if (yych <= '?') { gotoCase = 146; continue; };
+                        } else {
+                            if (yych <= 'Z') { gotoCase = 141; continue; };
+                            if (yych <= '[') { gotoCase = 146; continue; };
+                            { gotoCase = 160; continue; };
+                        }
+                    }
+                } else {
+                    if (yych <= 'z') {
+                        if (yych <= '^') {
+                            if (yych <= ']') { gotoCase = 146; continue; };
+                            { gotoCase = 161; continue; };
+                        } else {
+                            if (yych != '`') { gotoCase = 141; continue; };
+                        }
+                    } else {
+                        if (yych <= '|') {
+                            if (yych <= '{') { gotoCase = 146; continue; };
+                            { gotoCase = 162; continue; };
+                        } else {
+                            if (yych <= '~') { gotoCase = 146; continue; };
+                            if (yych >= 0x80) { gotoCase = 141; continue; };
+                        }
+                    }
+                }
+            }
+case 136:
+            ++cursor;
+case 137:
+            { this.tokenType = null; return cursor; }
+case 138:
+            ++cursor;
+            if ((yych = this._charAt(cursor)) == '=') { gotoCase = 260; continue; };
+case 139:
+            { this.tokenType = null; return cursor; }
+case 140:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych == '\n') { gotoCase = 137; continue; };
+            if (yych == '\r') { gotoCase = 137; continue; };
+            { gotoCase = 252; continue; };
+case 141:
+            yyaccept = 1;
+            yych = this._charAt(YYMARKER = ++cursor);
+            { gotoCase = 170; continue; };
+case 142:
+            this.setLexCondition(this._lexConditions.DIV);
+            {
+                    var token = this._line.substring(cursorOnEnter, cursor);
+                    if (token in this._keywords)
+                        this.tokenType = "javascript-keyword";
+                    else
+                        this.tokenType = "javascript-ident";
+                    return cursor;
+                }
+case 143:
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 163; continue; };
+            { gotoCase = 139; continue; };
+case 144:
+            yych = this._charAt(++cursor);
+            if (yych == '&') { gotoCase = 163; continue; };
+            if (yych == '=') { gotoCase = 163; continue; };
+            { gotoCase = 139; continue; };
+case 145:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych == '\n') { gotoCase = 137; continue; };
+            if (yych == '\r') { gotoCase = 137; continue; };
+            { gotoCase = 241; continue; };
+case 146:
+            yych = this._charAt(++cursor);
+            { gotoCase = 139; continue; };
+case 147:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.DIV);
+            { this.tokenType = null; return cursor; }
+case 149:
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 163; continue; };
+            { gotoCase = 139; continue; };
+case 150:
+            yych = this._charAt(++cursor);
+            if (yych == '+') { gotoCase = 163; continue; };
+            if (yych == '=') { gotoCase = 163; continue; };
+            { gotoCase = 139; continue; };
+case 151:
+            yych = this._charAt(++cursor);
+            if (yych == '-') { gotoCase = 163; continue; };
+            if (yych == '=') { gotoCase = 163; continue; };
+            { gotoCase = 139; continue; };
+case 152:
+            yych = this._charAt(++cursor);
+            if (yych <= '/') { gotoCase = 139; continue; };
+            if (yych <= '9') { gotoCase = 234; continue; };
+            { gotoCase = 139; continue; };
+case 153:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych <= '*') {
+                if (yych <= '\f') {
+                    if (yych == '\n') { gotoCase = 137; continue; };
+                    { gotoCase = 197; continue; };
+                } else {
+                    if (yych <= '\r') { gotoCase = 137; continue; };
+                    if (yych <= ')') { gotoCase = 197; continue; };
+                    { gotoCase = 202; continue; };
+                }
+            } else {
+                if (yych <= 'Z') {
+                    if (yych == '/') { gotoCase = 204; continue; };
+                    { gotoCase = 197; continue; };
+                } else {
+                    if (yych <= '[') { gotoCase = 200; continue; };
+                    if (yych <= '\\') { gotoCase = 199; continue; };
+                    if (yych <= ']') { gotoCase = 137; continue; };
+                    { gotoCase = 197; continue; };
+                }
+            }
+case 154:
+            yyaccept = 2;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych <= 'E') {
+                if (yych <= '/') {
+                    if (yych == '.') { gotoCase = 183; continue; };
+                } else {
+                    if (yych <= '7') { gotoCase = 192; continue; };
+                    if (yych >= 'E') { gotoCase = 182; continue; };
+                }
+            } else {
+                if (yych <= 'd') {
+                    if (yych == 'X') { gotoCase = 194; continue; };
+                } else {
+                    if (yych <= 'e') { gotoCase = 182; continue; };
+                    if (yych == 'x') { gotoCase = 194; continue; };
+                }
+            }
+case 155:
+            this.setLexCondition(this._lexConditions.DIV);
+            { this.tokenType = "javascript-number"; return cursor; }
+case 156:
+            yyaccept = 2;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych <= '9') {
+                if (yych == '.') { gotoCase = 183; continue; };
+                if (yych <= '/') { gotoCase = 155; continue; };
+                { gotoCase = 180; continue; };
+            } else {
+                if (yych <= 'E') {
+                    if (yych <= 'D') { gotoCase = 155; continue; };
+                    { gotoCase = 182; continue; };
+                } else {
+                    if (yych == 'e') { gotoCase = 182; continue; };
+                    { gotoCase = 155; continue; };
+                }
+            }
+case 157:
+            yych = this._charAt(++cursor);
+            if (yych <= ';') { gotoCase = 139; continue; };
+            if (yych <= '<') { gotoCase = 179; continue; };
+            if (yych <= '=') { gotoCase = 163; continue; };
+            { gotoCase = 139; continue; };
+case 158:
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 178; continue; };
+            { gotoCase = 139; continue; };
+case 159:
+            yych = this._charAt(++cursor);
+            if (yych <= '<') { gotoCase = 139; continue; };
+            if (yych <= '=') { gotoCase = 163; continue; };
+            if (yych <= '>') { gotoCase = 176; continue; };
+            { gotoCase = 139; continue; };
+case 160:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych == 'u') { gotoCase = 164; continue; };
+            { gotoCase = 137; continue; };
+case 161:
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 163; continue; };
+            { gotoCase = 139; continue; };
+case 162:
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 163; continue; };
+            if (yych != '|') { gotoCase = 139; continue; };
+case 163:
+            yych = this._charAt(++cursor);
+            { gotoCase = 139; continue; };
+case 164:
+            yych = this._charAt(++cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych <= '9') { gotoCase = 166; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 166; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych <= 'f') { gotoCase = 166; continue; };
+            }
+case 165:
+            cursor = YYMARKER;
+            if (yyaccept <= 1) {
+                if (yyaccept <= 0) {
+                    { gotoCase = 137; continue; };
+                } else {
+                    { gotoCase = 142; continue; };
+                }
+            } else {
+                if (yyaccept <= 2) {
+                    { gotoCase = 155; continue; };
+                } else {
+                    { gotoCase = 217; continue; };
+                }
+            }
+case 166:
+            yych = this._charAt(++cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych >= ':') { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 167; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych >= 'g') { gotoCase = 165; continue; };
+            }
+case 167:
+            yych = this._charAt(++cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych >= ':') { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 168; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych >= 'g') { gotoCase = 165; continue; };
+            }
+case 168:
+            yych = this._charAt(++cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych >= ':') { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 169; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych >= 'g') { gotoCase = 165; continue; };
+            }
+case 169:
+            yyaccept = 1;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+case 170:
+            if (yych <= '[') {
+                if (yych <= '/') {
+                    if (yych == '$') { gotoCase = 169; continue; };
+                    { gotoCase = 142; continue; };
+                } else {
+                    if (yych <= '9') { gotoCase = 169; continue; };
+                    if (yych <= '@') { gotoCase = 142; continue; };
+                    if (yych <= 'Z') { gotoCase = 169; continue; };
+                    { gotoCase = 142; continue; };
+                }
+            } else {
+                if (yych <= '_') {
+                    if (yych <= '\\') { gotoCase = 171; continue; };
+                    if (yych <= '^') { gotoCase = 142; continue; };
+                    { gotoCase = 169; continue; };
+                } else {
+                    if (yych <= '`') { gotoCase = 142; continue; };
+                    if (yych <= 'z') { gotoCase = 169; continue; };
+                    if (yych <= 0x7F) { gotoCase = 142; continue; };
+                    { gotoCase = 169; continue; };
+                }
+            }
+case 171:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych != 'u') { gotoCase = 165; continue; };
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych >= ':') { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 173; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych >= 'g') { gotoCase = 165; continue; };
+            }
+case 173:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych >= ':') { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 174; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych >= 'g') { gotoCase = 165; continue; };
+            }
+case 174:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych >= ':') { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 175; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych >= 'g') { gotoCase = 165; continue; };
+            }
+case 175:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych <= '9') { gotoCase = 169; continue; };
+                { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 169; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych <= 'f') { gotoCase = 169; continue; };
+                { gotoCase = 165; continue; };
+            }
+case 176:
+            yych = this._charAt(++cursor);
+            if (yych <= '<') { gotoCase = 139; continue; };
+            if (yych <= '=') { gotoCase = 163; continue; };
+            if (yych >= '?') { gotoCase = 139; continue; };
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 163; continue; };
+            { gotoCase = 139; continue; };
+case 178:
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 163; continue; };
+            { gotoCase = 139; continue; };
+case 179:
+            yych = this._charAt(++cursor);
+            if (yych == '=') { gotoCase = 163; continue; };
+            { gotoCase = 139; continue; };
+case 180:
+            yyaccept = 2;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '9') {
+                if (yych == '.') { gotoCase = 183; continue; };
+                if (yych <= '/') { gotoCase = 155; continue; };
+                { gotoCase = 180; continue; };
+            } else {
+                if (yych <= 'E') {
+                    if (yych <= 'D') { gotoCase = 155; continue; };
+                } else {
+                    if (yych != 'e') { gotoCase = 155; continue; };
+                }
+            }
+case 182:
+            yych = this._charAt(++cursor);
+            if (yych <= ',') {
+                if (yych == '+') { gotoCase = 189; continue; };
+                { gotoCase = 165; continue; };
+            } else {
+                if (yych <= '-') { gotoCase = 189; continue; };
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych <= '9') { gotoCase = 190; continue; };
+                { gotoCase = 165; continue; };
+            }
+case 183:
+            yyaccept = 2;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'D') {
+                if (yych <= '/') { gotoCase = 155; continue; };
+                if (yych <= '9') { gotoCase = 183; continue; };
+                { gotoCase = 155; continue; };
+            } else {
+                if (yych <= 'E') { gotoCase = 185; continue; };
+                if (yych != 'e') { gotoCase = 155; continue; };
+            }
+case 185:
+            yych = this._charAt(++cursor);
+            if (yych <= ',') {
+                if (yych != '+') { gotoCase = 165; continue; };
+            } else {
+                if (yych <= '-') { gotoCase = 186; continue; };
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych <= '9') { gotoCase = 187; continue; };
+                { gotoCase = 165; continue; };
+            }
+case 186:
+            yych = this._charAt(++cursor);
+            if (yych <= '/') { gotoCase = 165; continue; };
+            if (yych >= ':') { gotoCase = 165; continue; };
+case 187:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '/') { gotoCase = 155; continue; };
+            if (yych <= '9') { gotoCase = 187; continue; };
+            { gotoCase = 155; continue; };
+case 189:
+            yych = this._charAt(++cursor);
+            if (yych <= '/') { gotoCase = 165; continue; };
+            if (yych >= ':') { gotoCase = 165; continue; };
+case 190:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '/') { gotoCase = 155; continue; };
+            if (yych <= '9') { gotoCase = 190; continue; };
+            { gotoCase = 155; continue; };
+case 192:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '/') { gotoCase = 155; continue; };
+            if (yych <= '7') { gotoCase = 192; continue; };
+            { gotoCase = 155; continue; };
+case 194:
+            yych = this._charAt(++cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych >= ':') { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 195; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych >= 'g') { gotoCase = 165; continue; };
+            }
+case 195:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 155; continue; };
+                if (yych <= '9') { gotoCase = 195; continue; };
+                { gotoCase = 155; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 195; continue; };
+                if (yych <= '`') { gotoCase = 155; continue; };
+                if (yych <= 'f') { gotoCase = 195; continue; };
+                { gotoCase = 155; continue; };
+            }
+case 197:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '.') {
+                if (yych <= '\n') {
+                    if (yych <= '\t') { gotoCase = 197; continue; };
+                    { gotoCase = 165; continue; };
+                } else {
+                    if (yych == '\r') { gotoCase = 165; continue; };
+                    { gotoCase = 197; continue; };
+                }
+            } else {
+                if (yych <= '[') {
+                    if (yych <= '/') { gotoCase = 220; continue; };
+                    if (yych <= 'Z') { gotoCase = 197; continue; };
+                    { gotoCase = 228; continue; };
+                } else {
+                    if (yych <= '\\') { gotoCase = 227; continue; };
+                    if (yych <= ']') { gotoCase = 165; continue; };
+                    { gotoCase = 197; continue; };
+                }
+            }
+case 199:
+            yych = this._charAt(++cursor);
+            if (yych == '\n') { gotoCase = 165; continue; };
+            if (yych == '\r') { gotoCase = 165; continue; };
+            { gotoCase = 197; continue; };
+case 200:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '*') {
+                if (yych <= '\f') {
+                    if (yych == '\n') { gotoCase = 165; continue; };
+                    { gotoCase = 200; continue; };
+                } else {
+                    if (yych <= '\r') { gotoCase = 165; continue; };
+                    if (yych <= ')') { gotoCase = 200; continue; };
+                    { gotoCase = 165; continue; };
+                }
+            } else {
+                if (yych <= '[') {
+                    if (yych == '/') { gotoCase = 165; continue; };
+                    { gotoCase = 200; continue; };
+                } else {
+                    if (yych <= '\\') { gotoCase = 215; continue; };
+                    if (yych <= ']') { gotoCase = 213; continue; };
+                    { gotoCase = 200; continue; };
+                }
+            }
+case 202:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '\f') {
+                if (yych == '\n') { gotoCase = 209; continue; };
+                { gotoCase = 202; continue; };
+            } else {
+                if (yych <= '\r') { gotoCase = 209; continue; };
+                if (yych == '*') { gotoCase = 207; continue; };
+                { gotoCase = 202; continue; };
+            }
+case 204:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '\n') { gotoCase = 206; continue; };
+            if (yych != '\r') { gotoCase = 204; continue; };
+case 206:
+            { this.tokenType = "javascript-comment"; return cursor; }
+case 207:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '*') { gotoCase = 207; continue; };
+            if (yych == '/') { gotoCase = 211; continue; };
+            { gotoCase = 202; continue; };
+case 209:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.COMMENT);
+            { this.tokenType = "javascript-comment"; return cursor; }
+case 211:
+            ++cursor;
+            { this.tokenType = "javascript-comment"; return cursor; }
+case 213:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '*') {
+                if (yych <= '\f') {
+                    if (yych == '\n') { gotoCase = 165; continue; };
+                    { gotoCase = 213; continue; };
+                } else {
+                    if (yych <= '\r') { gotoCase = 165; continue; };
+                    if (yych <= ')') { gotoCase = 213; continue; };
+                    { gotoCase = 197; continue; };
+                }
+            } else {
+                if (yych <= 'Z') {
+                    if (yych == '/') { gotoCase = 220; continue; };
+                    { gotoCase = 213; continue; };
+                } else {
+                    if (yych <= '[') { gotoCase = 218; continue; };
+                    if (yych <= '\\') { gotoCase = 216; continue; };
+                    { gotoCase = 213; continue; };
+                }
+            }
+case 215:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '\n') { gotoCase = 165; continue; };
+            if (yych == '\r') { gotoCase = 165; continue; };
+            { gotoCase = 200; continue; };
+case 216:
+            yyaccept = 3;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '\n') { gotoCase = 217; continue; };
+            if (yych != '\r') { gotoCase = 213; continue; };
+case 217:
+            this.setLexCondition(this._lexConditions.REGEX);
+            { this.tokenType = "javascript-regexp"; return cursor; }
+case 218:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '*') {
+                if (yych <= '\f') {
+                    if (yych == '\n') { gotoCase = 165; continue; };
+                    { gotoCase = 218; continue; };
+                } else {
+                    if (yych <= '\r') { gotoCase = 165; continue; };
+                    if (yych <= ')') { gotoCase = 218; continue; };
+                    { gotoCase = 165; continue; };
+                }
+            } else {
+                if (yych <= '[') {
+                    if (yych == '/') { gotoCase = 165; continue; };
+                    { gotoCase = 218; continue; };
+                } else {
+                    if (yych <= '\\') { gotoCase = 225; continue; };
+                    if (yych <= ']') { gotoCase = 223; continue; };
+                    { gotoCase = 218; continue; };
+                }
+            }
+case 220:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'h') {
+                if (yych == 'g') { gotoCase = 220; continue; };
+            } else {
+                if (yych <= 'i') { gotoCase = 220; continue; };
+                if (yych == 'm') { gotoCase = 220; continue; };
+            }
+            { this.tokenType = "javascript-regexp"; return cursor; }
+case 223:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '*') {
+                if (yych <= '\f') {
+                    if (yych == '\n') { gotoCase = 165; continue; };
+                    { gotoCase = 223; continue; };
+                } else {
+                    if (yych <= '\r') { gotoCase = 165; continue; };
+                    if (yych <= ')') { gotoCase = 223; continue; };
+                    { gotoCase = 197; continue; };
+                }
+            } else {
+                if (yych <= 'Z') {
+                    if (yych == '/') { gotoCase = 220; continue; };
+                    { gotoCase = 223; continue; };
+                } else {
+                    if (yych <= '[') { gotoCase = 218; continue; };
+                    if (yych <= '\\') { gotoCase = 226; continue; };
+                    { gotoCase = 223; continue; };
+                }
+            }
+case 225:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '\n') { gotoCase = 165; continue; };
+            if (yych == '\r') { gotoCase = 165; continue; };
+            { gotoCase = 218; continue; };
+case 226:
+            yyaccept = 3;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '\n') { gotoCase = 217; continue; };
+            if (yych == '\r') { gotoCase = 217; continue; };
+            { gotoCase = 223; continue; };
+case 227:
+            yyaccept = 3;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '\n') { gotoCase = 217; continue; };
+            if (yych == '\r') { gotoCase = 217; continue; };
+            { gotoCase = 197; continue; };
+case 228:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '*') {
+                if (yych <= '\f') {
+                    if (yych == '\n') { gotoCase = 165; continue; };
+                    { gotoCase = 228; continue; };
+                } else {
+                    if (yych <= '\r') { gotoCase = 165; continue; };
+                    if (yych <= ')') { gotoCase = 228; continue; };
+                    { gotoCase = 165; continue; };
+                }
+            } else {
+                if (yych <= '[') {
+                    if (yych == '/') { gotoCase = 165; continue; };
+                    { gotoCase = 228; continue; };
+                } else {
+                    if (yych <= '\\') { gotoCase = 232; continue; };
+                    if (yych >= '^') { gotoCase = 228; continue; };
+                }
+            }
+case 230:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '*') {
+                if (yych <= '\f') {
+                    if (yych == '\n') { gotoCase = 165; continue; };
+                    { gotoCase = 230; continue; };
+                } else {
+                    if (yych <= '\r') { gotoCase = 165; continue; };
+                    if (yych <= ')') { gotoCase = 230; continue; };
+                    { gotoCase = 197; continue; };
+                }
+            } else {
+                if (yych <= 'Z') {
+                    if (yych == '/') { gotoCase = 220; continue; };
+                    { gotoCase = 230; continue; };
+                } else {
+                    if (yych <= '[') { gotoCase = 228; continue; };
+                    if (yych <= '\\') { gotoCase = 233; continue; };
+                    { gotoCase = 230; continue; };
+                }
+            }
+case 232:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '\n') { gotoCase = 165; continue; };
+            if (yych == '\r') { gotoCase = 165; continue; };
+            { gotoCase = 228; continue; };
+case 233:
+            yyaccept = 3;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '\n') { gotoCase = 217; continue; };
+            if (yych == '\r') { gotoCase = 217; continue; };
+            { gotoCase = 230; continue; };
+case 234:
+            yyaccept = 2;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'D') {
+                if (yych <= '/') { gotoCase = 155; continue; };
+                if (yych <= '9') { gotoCase = 234; continue; };
+                { gotoCase = 155; continue; };
+            } else {
+                if (yych <= 'E') { gotoCase = 236; continue; };
+                if (yych != 'e') { gotoCase = 155; continue; };
+            }
+case 236:
+            yych = this._charAt(++cursor);
+            if (yych <= ',') {
+                if (yych != '+') { gotoCase = 165; continue; };
+            } else {
+                if (yych <= '-') { gotoCase = 237; continue; };
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych <= '9') { gotoCase = 238; continue; };
+                { gotoCase = 165; continue; };
+            }
+case 237:
+            yych = this._charAt(++cursor);
+            if (yych <= '/') { gotoCase = 165; continue; };
+            if (yych >= ':') { gotoCase = 165; continue; };
+case 238:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '/') { gotoCase = 155; continue; };
+            if (yych <= '9') { gotoCase = 238; continue; };
+            { gotoCase = 155; continue; };
+case 240:
+            ++cursor;
+            yych = this._charAt(cursor);
+case 241:
+            if (yych <= '\r') {
+                if (yych == '\n') { gotoCase = 165; continue; };
+                if (yych <= '\f') { gotoCase = 240; continue; };
+                { gotoCase = 165; continue; };
+            } else {
+                if (yych <= '\'') {
+                    if (yych <= '&') { gotoCase = 240; continue; };
+                    { gotoCase = 243; continue; };
+                } else {
+                    if (yych != '\\') { gotoCase = 240; continue; };
+                }
+            }
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'a') {
+                if (yych <= '!') {
+                    if (yych <= '\n') {
+                        if (yych <= '\t') { gotoCase = 165; continue; };
+                        { gotoCase = 246; continue; };
+                    } else {
+                        if (yych == '\r') { gotoCase = 246; continue; };
+                        { gotoCase = 165; continue; };
+                    }
+                } else {
+                    if (yych <= '\'') {
+                        if (yych <= '"') { gotoCase = 240; continue; };
+                        if (yych <= '&') { gotoCase = 165; continue; };
+                        { gotoCase = 240; continue; };
+                    } else {
+                        if (yych == '\\') { gotoCase = 240; continue; };
+                        { gotoCase = 165; continue; };
+                    }
+                }
+            } else {
+                if (yych <= 'q') {
+                    if (yych <= 'f') {
+                        if (yych <= 'b') { gotoCase = 240; continue; };
+                        if (yych <= 'e') { gotoCase = 165; continue; };
+                        { gotoCase = 240; continue; };
+                    } else {
+                        if (yych == 'n') { gotoCase = 240; continue; };
+                        { gotoCase = 165; continue; };
+                    }
+                } else {
+                    if (yych <= 't') {
+                        if (yych == 's') { gotoCase = 165; continue; };
+                        { gotoCase = 240; continue; };
+                    } else {
+                        if (yych <= 'u') { gotoCase = 245; continue; };
+                        if (yych <= 'v') { gotoCase = 240; continue; };
+                        { gotoCase = 165; continue; };
+                    }
+                }
+            }
+case 243:
+            ++cursor;
+            { this.tokenType = "javascript-string"; return cursor; }
+case 245:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych <= '9') { gotoCase = 248; continue; };
+                { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 248; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych <= 'f') { gotoCase = 248; continue; };
+                { gotoCase = 165; continue; };
+            }
+case 246:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.SSTRING);
+            { this.tokenType = "javascript-string"; return cursor; }
+case 248:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych >= ':') { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 249; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych >= 'g') { gotoCase = 165; continue; };
+            }
+case 249:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych >= ':') { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 250; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych >= 'g') { gotoCase = 165; continue; };
+            }
+case 250:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych <= '9') { gotoCase = 240; continue; };
+                { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 240; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych <= 'f') { gotoCase = 240; continue; };
+                { gotoCase = 165; continue; };
+            }
+case 251:
+            ++cursor;
+            yych = this._charAt(cursor);
+case 252:
+            if (yych <= '\r') {
+                if (yych == '\n') { gotoCase = 165; continue; };
+                if (yych <= '\f') { gotoCase = 251; continue; };
+                { gotoCase = 165; continue; };
+            } else {
+                if (yych <= '"') {
+                    if (yych <= '!') { gotoCase = 251; continue; };
+                    { gotoCase = 243; continue; };
+                } else {
+                    if (yych != '\\') { gotoCase = 251; continue; };
+                }
+            }
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'a') {
+                if (yych <= '!') {
+                    if (yych <= '\n') {
+                        if (yych <= '\t') { gotoCase = 165; continue; };
+                        { gotoCase = 255; continue; };
+                    } else {
+                        if (yych == '\r') { gotoCase = 255; continue; };
+                        { gotoCase = 165; continue; };
+                    }
+                } else {
+                    if (yych <= '\'') {
+                        if (yych <= '"') { gotoCase = 251; continue; };
+                        if (yych <= '&') { gotoCase = 165; continue; };
+                        { gotoCase = 251; continue; };
+                    } else {
+                        if (yych == '\\') { gotoCase = 251; continue; };
+                        { gotoCase = 165; continue; };
+                    }
+                }
+            } else {
+                if (yych <= 'q') {
+                    if (yych <= 'f') {
+                        if (yych <= 'b') { gotoCase = 251; continue; };
+                        if (yych <= 'e') { gotoCase = 165; continue; };
+                        { gotoCase = 251; continue; };
+                    } else {
+                        if (yych == 'n') { gotoCase = 251; continue; };
+                        { gotoCase = 165; continue; };
+                    }
+                } else {
+                    if (yych <= 't') {
+                        if (yych == 's') { gotoCase = 165; continue; };
+                        { gotoCase = 251; continue; };
+                    } else {
+                        if (yych <= 'u') { gotoCase = 254; continue; };
+                        if (yych <= 'v') { gotoCase = 251; continue; };
+                        { gotoCase = 165; continue; };
+                    }
+                }
+            }
+case 254:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych <= '9') { gotoCase = 257; continue; };
+                { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 257; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych <= 'f') { gotoCase = 257; continue; };
+                { gotoCase = 165; continue; };
+            }
+case 255:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.DSTRING);
+            { this.tokenType = "javascript-string"; return cursor; }
+case 257:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych >= ':') { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 258; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych >= 'g') { gotoCase = 165; continue; };
+            }
+case 258:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych >= ':') { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 259; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych >= 'g') { gotoCase = 165; continue; };
+            }
+case 259:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 165; continue; };
+                if (yych <= '9') { gotoCase = 251; continue; };
+                { gotoCase = 165; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 251; continue; };
+                if (yych <= '`') { gotoCase = 165; continue; };
+                if (yych <= 'f') { gotoCase = 251; continue; };
+                { gotoCase = 165; continue; };
+            }
+case 260:
+            ++cursor;
+            if ((yych = this._charAt(cursor)) == '=') { gotoCase = 163; continue; };
+            { gotoCase = 139; continue; };
+/* *********************************** */
+case this.case_REGEX:
+            yych = this._charAt(cursor);
+            if (yych <= '.') {
+                if (yych <= '\n') {
+                    if (yych <= '\t') { gotoCase = 264; continue; };
+                    { gotoCase = 265; continue; };
+                } else {
+                    if (yych == '\r') { gotoCase = 265; continue; };
+                    { gotoCase = 264; continue; };
+                }
+            } else {
+                if (yych <= '[') {
+                    if (yych <= '/') { gotoCase = 267; continue; };
+                    if (yych <= 'Z') { gotoCase = 264; continue; };
+                    { gotoCase = 269; continue; };
+                } else {
+                    if (yych <= '\\') { gotoCase = 270; continue; };
+                    if (yych <= ']') { gotoCase = 265; continue; };
+                    { gotoCase = 264; continue; };
+                }
+            }
+case 263:
+            { this.tokenType = "javascript-regexp"; return cursor; }
+case 264:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            { gotoCase = 272; continue; };
+case 265:
+            ++cursor;
+case 266:
+            { this.tokenType = null; return cursor; }
+case 267:
+            ++cursor;
+            yych = this._charAt(cursor);
+            { gotoCase = 278; continue; };
+case 268:
+            this.setLexCondition(this._lexConditions.NODIV);
+            { this.tokenType = "javascript-regexp"; return cursor; }
+case 269:
+            yyaccept = 1;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych <= '\r') {
+                if (yych == '\n') { gotoCase = 266; continue; };
+                if (yych <= '\f') { gotoCase = 276; continue; };
+                { gotoCase = 266; continue; };
+            } else {
+                if (yych <= '*') {
+                    if (yych <= ')') { gotoCase = 276; continue; };
+                    { gotoCase = 266; continue; };
+                } else {
+                    if (yych == '/') { gotoCase = 266; continue; };
+                    { gotoCase = 276; continue; };
+                }
+            }
+case 270:
+            yych = this._charAt(++cursor);
+            if (yych == '\n') { gotoCase = 266; continue; };
+            if (yych == '\r') { gotoCase = 266; continue; };
+case 271:
+            yyaccept = 0;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+case 272:
+            if (yych <= '.') {
+                if (yych <= '\n') {
+                    if (yych <= '\t') { gotoCase = 271; continue; };
+                    { gotoCase = 263; continue; };
+                } else {
+                    if (yych == '\r') { gotoCase = 263; continue; };
+                    { gotoCase = 271; continue; };
+                }
+            } else {
+                if (yych <= '[') {
+                    if (yych <= '/') { gotoCase = 277; continue; };
+                    if (yych <= 'Z') { gotoCase = 271; continue; };
+                    { gotoCase = 275; continue; };
+                } else {
+                    if (yych <= '\\') { gotoCase = 273; continue; };
+                    if (yych <= ']') { gotoCase = 263; continue; };
+                    { gotoCase = 271; continue; };
+                }
+            }
+case 273:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '\n') { gotoCase = 274; continue; };
+            if (yych != '\r') { gotoCase = 271; continue; };
+case 274:
+            cursor = YYMARKER;
+            if (yyaccept <= 0) {
+                { gotoCase = 263; continue; };
+            } else {
+                { gotoCase = 266; continue; };
+            }
+case 275:
+            ++cursor;
+            yych = this._charAt(cursor);
+case 276:
+            if (yych <= '*') {
+                if (yych <= '\f') {
+                    if (yych == '\n') { gotoCase = 274; continue; };
+                    { gotoCase = 275; continue; };
+                } else {
+                    if (yych <= '\r') { gotoCase = 274; continue; };
+                    if (yych <= ')') { gotoCase = 275; continue; };
+                    { gotoCase = 274; continue; };
+                }
+            } else {
+                if (yych <= '[') {
+                    if (yych == '/') { gotoCase = 274; continue; };
+                    { gotoCase = 275; continue; };
+                } else {
+                    if (yych <= '\\') { gotoCase = 281; continue; };
+                    if (yych <= ']') { gotoCase = 279; continue; };
+                    { gotoCase = 275; continue; };
+                }
+            }
+case 277:
+            ++cursor;
+            yych = this._charAt(cursor);
+case 278:
+            if (yych <= 'h') {
+                if (yych == 'g') { gotoCase = 277; continue; };
+                { gotoCase = 268; continue; };
+            } else {
+                if (yych <= 'i') { gotoCase = 277; continue; };
+                if (yych == 'm') { gotoCase = 277; continue; };
+                { gotoCase = 268; continue; };
+            }
+case 279:
+            yyaccept = 0;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '*') {
+                if (yych <= '\f') {
+                    if (yych == '\n') { gotoCase = 263; continue; };
+                    { gotoCase = 279; continue; };
+                } else {
+                    if (yych <= '\r') { gotoCase = 263; continue; };
+                    if (yych <= ')') { gotoCase = 279; continue; };
+                    { gotoCase = 271; continue; };
+                }
+            } else {
+                if (yych <= 'Z') {
+                    if (yych == '/') { gotoCase = 277; continue; };
+                    { gotoCase = 279; continue; };
+                } else {
+                    if (yych <= '[') { gotoCase = 275; continue; };
+                    if (yych <= '\\') { gotoCase = 282; continue; };
+                    { gotoCase = 279; continue; };
+                }
+            }
+case 281:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '\n') { gotoCase = 274; continue; };
+            if (yych == '\r') { gotoCase = 274; continue; };
+            { gotoCase = 275; continue; };
+case 282:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych == '\n') { gotoCase = 274; continue; };
+            if (yych == '\r') { gotoCase = 274; continue; };
+            { gotoCase = 279; continue; };
+/* *********************************** */
+case this.case_SSTRING:
+            yych = this._charAt(cursor);
+            if (yych <= '\r') {
+                if (yych == '\n') { gotoCase = 287; continue; };
+                if (yych <= '\f') { gotoCase = 286; continue; };
+                { gotoCase = 287; continue; };
+            } else {
+                if (yych <= '\'') {
+                    if (yych <= '&') { gotoCase = 286; continue; };
+                    { gotoCase = 289; continue; };
+                } else {
+                    if (yych == '\\') { gotoCase = 291; continue; };
+                    { gotoCase = 286; continue; };
+                }
+            }
+case 285:
+            { this.tokenType = "javascript-string"; return cursor; }
+case 286:
+            yyaccept = 0;
+            yych = this._charAt(YYMARKER = ++cursor);
+            { gotoCase = 293; continue; };
+case 287:
+            ++cursor;
+case 288:
+            { this.tokenType = null; return cursor; }
+case 289:
+            ++cursor;
+case 290:
+            this.setLexCondition(this._lexConditions.NODIV);
+            { this.tokenType = "javascript-string"; return cursor; }
+case 291:
+            yyaccept = 1;
+            yych = this._charAt(YYMARKER = ++cursor);
+            if (yych <= 'e') {
+                if (yych <= '\'') {
+                    if (yych == '"') { gotoCase = 292; continue; };
+                    if (yych <= '&') { gotoCase = 288; continue; };
+                } else {
+                    if (yych <= '\\') {
+                        if (yych <= '[') { gotoCase = 288; continue; };
+                    } else {
+                        if (yych != 'b') { gotoCase = 288; continue; };
+                    }
+                }
+            } else {
+                if (yych <= 'r') {
+                    if (yych <= 'm') {
+                        if (yych >= 'g') { gotoCase = 288; continue; };
+                    } else {
+                        if (yych <= 'n') { gotoCase = 292; continue; };
+                        if (yych <= 'q') { gotoCase = 288; continue; };
+                    }
+                } else {
+                    if (yych <= 't') {
+                        if (yych <= 's') { gotoCase = 288; continue; };
+                    } else {
+                        if (yych <= 'u') { gotoCase = 294; continue; };
+                        if (yych >= 'w') { gotoCase = 288; continue; };
+                    }
+                }
+            }
+case 292:
+            yyaccept = 0;
+            YYMARKER = ++cursor;
+            yych = this._charAt(cursor);
+case 293:
+            if (yych <= '\r') {
+                if (yych == '\n') { gotoCase = 285; continue; };
+                if (yych <= '\f') { gotoCase = 292; continue; };
+                { gotoCase = 285; continue; };
+            } else {
+                if (yych <= '\'') {
+                    if (yych <= '&') { gotoCase = 292; continue; };
+                    { gotoCase = 300; continue; };
+                } else {
+                    if (yych == '\\') { gotoCase = 299; continue; };
+                    { gotoCase = 292; continue; };
+                }
+            }
+case 294:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 295; continue; };
+                if (yych <= '9') { gotoCase = 296; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 296; continue; };
+                if (yych <= '`') { gotoCase = 295; continue; };
+                if (yych <= 'f') { gotoCase = 296; continue; };
+            }
+case 295:
+            cursor = YYMARKER;
+            if (yyaccept <= 0) {
+                { gotoCase = 285; continue; };
+            } else {
+                { gotoCase = 288; continue; };
+            }
+case 296:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 295; continue; };
+                if (yych >= ':') { gotoCase = 295; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 297; continue; };
+                if (yych <= '`') { gotoCase = 295; continue; };
+                if (yych >= 'g') { gotoCase = 295; continue; };
+            }
+case 297:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 295; continue; };
+                if (yych >= ':') { gotoCase = 295; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 298; continue; };
+                if (yych <= '`') { gotoCase = 295; continue; };
+                if (yych >= 'g') { gotoCase = 295; continue; };
+            }
+case 298:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= '@') {
+                if (yych <= '/') { gotoCase = 295; continue; };
+                if (yych <= '9') { gotoCase = 292; continue; };
+                { gotoCase = 295; continue; };
+            } else {
+                if (yych <= 'F') { gotoCase = 292; continue; };
+                if (yych <= '`') { gotoCase = 295; continue; };
+                if (yych <= 'f') { gotoCase = 292; continue; };
+                { gotoCase = 295; continue; };
+            }
+case 299:
+            ++cursor;
+            yych = this._charAt(cursor);
+            if (yych <= 'e') {
+                if (yych <= '\'') {
+                    if (yych == '"') { gotoCase = 292; continue; };
+                    if (yych <= '&') { gotoCase = 295; continue; };
+                    { gotoCase = 292; continue; };
+                } else {
+                    if (yych <= '\\') {
+                        if (yych <= '[') { gotoCase = 295; continue; };
+                        { gotoCase = 292; continue; };
+                    } else {
+                        if (yych == 'b') { gotoCase = 292; continue; };
+                        { gotoCase = 295; continue; };
+                    }
+                }
+            } else {
+                if (yych <= 'r') {
+                    if (yych <= 'm') {
+                        if (yych <= 'f') { gotoCase = 292; continue; };
+                        { gotoCase = 295; continue; };
+                    } else {
+                        if (yych <= 'n') { gotoCase = 292; continue; };
+                        if (yych <= 'q') { gotoCase = 295; continue; };
+                        { gotoCase = 292; continue; };
+                    }
+                } else {
+                    if (yych <= 't') {
+                        if (yych <= 's') { gotoCase = 295; continue; };
+                        { gotoCase = 292; continue; };
+                    } else {
+                        if (yych <= 'u') { gotoCase = 294; continue; };
+                        if (yych <= 'v') { gotoCase = 292; continue; };
+                        { gotoCase = 295; continue; };
+                    }
+                }
+            }
+case 300:
+            ++cursor;
+            yych = this._charAt(cursor);
+            { gotoCase = 290; continue; };
+        }
+
+        }
+    }
+}
+
+WebInspector.SourceJavaScriptTokenizer.prototype.__proto__ = WebInspector.SourceTokenizer.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js
new file mode 100644
index 0000000000..ae71efe953
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js
@@ -0,0 +1,178 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Generate js file as follows:
+//
+// re2c -isc WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js \
+// | sed 's|^yy\([^:]*\)*\:|case \1:|' \
+// | sed 's|[*]cursor[+][+]|this._charAt(cursor++)|' \
+// | sed 's|[[*][+][+]cursor|this._charAt(++cursor)|' \
+// | sed 's|[*]cursor|this._charAt(cursor)|' \
+// | sed 's|yych = \*\([^;]*\)|yych = this._charAt\1|' \
+// | sed 's|goto case \([^;]*\)|{ gotoCase = \1; continue; }|' \
+// | sed 's|unsigned\ int|var|' \
+// | sed 's|var\ yych|case 1: var yych|'
+
+WebInspector.SourceJavaScriptTokenizer = function()
+{
+    WebInspector.SourceTokenizer.call(this);
+
+    this._keywords = [
+        "null", "true", "false", "break", "case", "catch", "const", "default", "finally", "for",
+        "instanceof", "new", "var", "continue", "function", "return", "void", "delete", "if",
+        "this", "do", "while", "else", "in", "switch", "throw", "try", "typeof", "debugger",
+        "class", "enum", "export", "extends", "import", "super", "get", "set", "with"
+    ].keySet();
+
+    this._lexConditions = {
+        DIV: 0,
+        NODIV: 1,
+        COMMENT: 2,
+        DSTRING: 3,
+        SSTRING: 4,
+        REGEX: 5
+    };
+
+    this.case_DIV = 1000;
+    this.case_NODIV = 1001;
+    this.case_COMMENT = 1002;
+    this.case_DSTRING = 1003;
+    this.case_SSTRING = 1004;
+    this.case_REGEX = 1005;
+
+    this.initialCondition = { lexCondition: this._lexConditions.NODIV }
+    this.condition = this.initialCondition;
+}
+
+WebInspector.SourceJavaScriptTokenizer.prototype = {
+    nextToken: function(cursor)
+    {
+        var cursorOnEnter = cursor;
+        var gotoCase = 1;
+        while (1) {
+            switch (gotoCase)
+            // Following comment is replaced with generated state machine.
+            /*!re2c
+                re2c:define:YYCTYPE  = "var";
+                re2c:define:YYCURSOR = cursor;
+                re2c:define:YYGETCONDITION = "this.getLexCondition";
+                re2c:define:YYSETCONDITION = "this.setLexCondition";
+                re2c:condprefix = "case this.case_";
+                re2c:condenumprefix = "this._lexConditions.";
+                re2c:yyfill:enable = 0;
+                re2c:labelprefix = "case ";
+                re2c:indent:top = 2;
+                re2c:indent:string = "    ";
+
+                LineComment = "//" [^\r\n]*;
+                CommentContent = ([^*\r\n] | ("*"+[^/*]))*;
+                Comment = "/*" CommentContent "*"+ "/";
+                CommentStart = "/*" CommentContent [\r\n];
+                CommentEnd = CommentContent "*"+ "/";
+
+                DecimalDigit = [0-9];
+                NonZeroDigit = [1-9];
+                OctalDigit = [0-7];
+                HexDigit = [0-9a-fA-F];
+                SignedInteger = ("+"|"-")? DecimalDigit+;
+                ExponentPart = ("e" | "E") SignedInteger;
+                DecimalIntegerLiteral = "0" | NonZeroDigit DecimalDigit*;
+                DecimalLiteral = DecimalIntegerLiteral "." DecimalDigit* ExponentPart? | "." DecimalDigit+ ExponentPart? | DecimalIntegerLiteral ExponentPart?;
+                HexIntegerLiteral = "0" ("x"|"X") HexDigit+;
+                OctalIntegerLiteral = "0" OctalDigit+;
+                NumericLiteral = DecimalLiteral | HexIntegerLiteral | OctalIntegerLiteral;
+
+                Punctuation = [\!\%\&\(\*\+\,\-\.\:\;\<\=\>\?\[\]\^\{\|\}\~] | "!=" | "!==" | "%=" | "&&" | "&=" | "*=" | "++" | "+=" | "--" | "-=" | "<<" | "<<="  | "<=" | "==" | "===" | ">=" | ">>" | ">>=" | ">>>" | ">>>=" | "^=" | "|=" | "||";
+                Division = "/" | "/=";
+                RightParen = ")";
+
+                Letter = [a-zA-Z\x80-\xFF];
+                UnicodeEscapeSequence = "\\u" HexDigit HexDigit HexDigit HexDigit;
+
+                IdentifierStart = Letter | "_" | "$" | UnicodeEscapeSequence;
+                IdentifierPart = IdentifierStart | DecimalDigit;
+                Identifier = IdentifierStart IdentifierPart *;
+
+                DoubleStringContent = ([^\r\n\"\\] | UnicodeEscapeSequence | "\\" ['"\\bfnrtv])*;
+                SingleStringContent = ([^\r\n\'\\] | UnicodeEscapeSequence | "\\" ['"\\bfnrtv])*;
+                StringLiteral = "\"" DoubleStringContent "\"" | "'" SingleStringContent "'";
+                DoubleStringStart = "\"" DoubleStringContent "\\" [\r\n];
+                DoubleStringEnd = DoubleStringContent "\"";
+                SingleStringStart = "'" SingleStringContent "\\" [\r\n];
+                SingleStringEnd = SingleStringContent "'";
+
+                BackslashSequence = "\\" [^\r\n];
+                RegexSet = "[" ([^\r\n*\\/] | BackslashSequence)* "]";
+                RegexFirstChar = [^\r\n*\\/\[\]] | BackslashSequence | RegexSet;
+                RegexChar = [^\r\n\\/\[\]] | BackslashSequence | RegexSet;
+                RegexContent = RegexChar*;
+                Regex = "/" RegexFirstChar RegexContent "/" [igm]*;
+                RegexStart = "/" RegexFirstChar RegexContent "\\";
+                RegexEnd = RegexContent "/" [igm]*;
+
+                <DIV,NODIV> LineComment { this.tokenType = "javascript-comment"; return cursor; }
+                <DIV,NODIV> Comment { this.tokenType = "javascript-comment"; return cursor; }
+                <DIV,NODIV> CommentStart => COMMENT { this.tokenType = "javascript-comment"; return cursor; }
+                <COMMENT> CommentContent => COMMENT { this.tokenType = "javascript-comment"; return cursor; }
+                <COMMENT> CommentEnd => NODIV { this.tokenType = "javascript-comment"; return cursor; }
+
+                <DIV,NODIV> StringLiteral { this.tokenType = "javascript-string"; return cursor; }
+                <DIV,NODIV> DoubleStringStart => DSTRING { this.tokenType = "javascript-string"; return cursor; }
+                <DSTRING> DoubleStringContent => DSTRING { this.tokenType = "javascript-string"; return cursor; }
+                <DSTRING> DoubleStringEnd => NODIV { this.tokenType = "javascript-string"; return cursor; }
+                <DIV,NODIV> SingleStringStart => SSTRING { this.tokenType = "javascript-string"; return cursor; }
+                <SSTRING> SingleStringContent => SSTRING { this.tokenType = "javascript-string"; return cursor; }
+                <SSTRING> SingleStringEnd => NODIV { this.tokenType = "javascript-string"; return cursor; }
+
+                <NODIV> Regex { this.tokenType = "javascript-regexp"; return cursor; }
+                <NODIV> RegexStart => REGEX { this.tokenType = "javascript-regexp"; return cursor; }
+                <REGEX> RegexContent => REGEX { this.tokenType = "javascript-regexp"; return cursor; }
+                <REGEX> RegexEnd => NODIV { this.tokenType = "javascript-regexp"; return cursor; }
+
+                <DIV,NODIV> NumericLiteral => DIV { this.tokenType = "javascript-number"; return cursor; }
+                <DIV,NODIV> Identifier => DIV
+                {
+                    var token = this._line.substring(cursorOnEnter, cursor);
+                    if (token in this._keywords)
+                        this.tokenType = "javascript-keyword";
+                    else
+                        this.tokenType = "javascript-ident";
+                    return cursor;
+                }
+                <DIV,NODIV> RightParen => DIV { this.tokenType = null; return cursor; }
+                <DIV,NODIV> Punctuation => NODIV { this.tokenType = null; return cursor; }
+                <DIV> Division => NODIV { this.tokenType = null; return cursor; }
+                <*> [^] { this.tokenType = null; return cursor; }
+            */
+        }
+    }
+}
+
+WebInspector.SourceJavaScriptTokenizer.prototype.__proto__ = WebInspector.SourceTokenizer.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceTokenizer.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceTokenizer.js
new file mode 100644
index 0000000000..1832d427b0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceTokenizer.js
@@ -0,0 +1,104 @@
+/* Generated by re2c 0.13.5 on Tue Jan 26 01:16:33 2010 */
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.SourceTokenizer = function()
+{
+}
+
+WebInspector.SourceTokenizer.prototype = {
+    set line(line) {
+        this._line = line;
+    },
+
+    set condition(condition)
+    {
+        this._condition = condition;
+    },
+
+    get condition()
+    {
+        return this._condition;
+    },
+
+    get subTokenizer()
+    {
+        return this._condition.subTokenizer;
+    },
+
+    getLexCondition: function()
+    {
+        return this.condition.lexCondition;
+    },
+
+    setLexCondition: function(lexCondition)
+    {
+        this.condition.lexCondition = lexCondition;
+    },
+
+    _charAt: function(cursor)
+    {
+        return cursor < this._line.length ? this._line.charAt(cursor) : "\n";
+    }
+}
+
+
+WebInspector.SourceTokenizer.Registry = function() {
+    this._tokenizers = {};
+    this._tokenizerConstructors = {
+        "text/css": "SourceCSSTokenizer",
+        "text/html": "SourceHTMLTokenizer",
+        "text/javascript": "SourceJavaScriptTokenizer",
+        "application/javascript": "SourceJavaScriptTokenizer",
+        "application/x-javascript": "SourceJavaScriptTokenizer"
+    };
+}
+
+WebInspector.SourceTokenizer.Registry.getInstance = function()
+{
+    if (!WebInspector.SourceTokenizer.Registry._instance)
+        WebInspector.SourceTokenizer.Registry._instance = new WebInspector.SourceTokenizer.Registry();
+    return WebInspector.SourceTokenizer.Registry._instance;
+}
+
+WebInspector.SourceTokenizer.Registry.prototype = {
+    getTokenizer: function(mimeType)
+    {
+        if (!this._tokenizerConstructors[mimeType])
+            return null;
+        var tokenizerClass = this._tokenizerConstructors[mimeType];
+        var tokenizer = this._tokenizers[tokenizerClass];
+        if (!tokenizer) {
+            tokenizer = new WebInspector[tokenizerClass]();
+            this._tokenizers[mimeType] = tokenizer;
+        }
+        return tokenizer;
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js
index c1b1bbf4a1..b401c12d78 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js
@@ -28,64 +28,34 @@
 
 WebInspector.SourceView = function(resource)
 {
-    // Set the sourceFrame first since WebInspector.ResourceView will set headersVisible
-    // and our override of headersVisible needs the sourceFrame.
-    this.sourceFrame = new WebInspector.SourceFrame(null, this._addBreakpoint.bind(this));
-
     WebInspector.ResourceView.call(this, resource);
 
-    resource.addEventListener("finished", this._resourceLoadingFinished, this);
-
     this.element.addStyleClass("source");
 
+    this.sourceFrame = new WebInspector.SourceFrame(this.contentElement, this._addBreakpoint.bind(this), this._removeBreakpoint.bind(this));
+    resource.addEventListener("finished", this._resourceLoadingFinished, this);
     this._frameNeedsSetup = true;
-
-    this.contentElement.appendChild(this.sourceFrame.element);
-
-    var gutterElement = document.createElement("div");
-    gutterElement.className = "webkit-line-gutter-backdrop";
-    this.element.appendChild(gutterElement);
 }
 
 WebInspector.SourceView.prototype = {
-    set headersVisible(x)
-    {
-        if (x === this._headersVisible)
-            return;
-
-        var superSetter = WebInspector.ResourceView.prototype.__lookupSetter__("headersVisible");
-        if (superSetter)
-            superSetter.call(this, x);
-
-        this.sourceFrame.autoSizesToFitContentHeight = x;
-    },
-
     show: function(parentElement)
     {
         WebInspector.ResourceView.prototype.show.call(this, parentElement);
-        this.setupSourceFrameIfNeeded();
+        this.sourceFrame.visible = true;
+        this.resize();
     },
 
     hide: function()
     {
         WebInspector.View.prototype.hide.call(this);
+        this.sourceFrame.visible = false;
         this._currentSearchResultIndex = -1;
     },
 
     resize: function()
     {
-        if (this.sourceFrame.autoSizesToFitContentHeight)
-            this.sourceFrame.sizeToFitContentHeight();
-    },
-
-    detach: function()
-    {
-        WebInspector.ResourceView.prototype.detach.call(this);
-
-        // FIXME: We need to mark the frame for setup on detach because the frame DOM is cleared
-        // when it is removed from the document. Is this a bug?
-        this._frameNeedsSetup = true;
-        this._sourceFrameSetup = false;
+        if (this.sourceFrame)
+            this.sourceFrame.resize();
     },
 
     setupSourceFrameIfNeeded: function()
@@ -96,28 +66,18 @@ WebInspector.SourceView.prototype = {
         this.attach();
 
         delete this._frameNeedsSetup;
-        this.sourceFrame.addEventListener("content loaded", this._contentLoaded, this);
-        InspectorController.addResourceSourceToFrame(this.resource.identifier, this.sourceFrame.element);
+        WebInspector.getResourceContent(this.resource.identifier, this._contentLoaded.bind(this));
     },
-    
-    _contentLoaded: function()
+
+    contentTabSelected: function()
     {
-        delete this._frameNeedsSetup;
-        this.sourceFrame.removeEventListener("content loaded", this._contentLoaded, this);
-        
-        if (this.resource.type === WebInspector.Resource.Type.Script
-            || this.resource.mimeType === "application/json"
-            || this.resource.mimeType === "application/javascript"
-            || /\.js(on)?$/.test(this.resource.lastPathComponent) ) {
-            this.sourceFrame.addEventListener("syntax highlighting complete", this._syntaxHighlightingComplete, this);
-            this.sourceFrame.syntaxHighlightJavascript();
-        } else if (this.resource.type === WebInspector.Resource.Type.Stylesheet
-            || this.resource.mimeType === "text/css"
-            || /\.css$/.test(this.resource.lastPathComponent) ) {
-            this.sourceFrame.addEventListener("syntax highlighting complete", this._syntaxHighlightingComplete, this);
-            this.sourceFrame.syntaxHighlightCSS();
-        } else
-            this._sourceFrameSetupFinished();
+        this.setupSourceFrameIfNeeded();
+    },
+
+    _contentLoaded: function(content)
+    {
+        this.sourceFrame.setContent(this.resource.mimeType, content, this.resource.url);
+        this._sourceFrameSetupFinished();
     },
 
     _resourceLoadingFinished: function(event)
@@ -148,6 +108,12 @@ WebInspector.SourceView.prototype = {
         }
     },
 
+    _removeBreakpoint: function(breakpoint)
+    {
+        if (WebInspector.panels.scripts)
+            WebInspector.panels.scripts.removeBreakpoint(breakpoint);
+    },
+
     // The rest of the methods in this prototype need to be generic enough to work with a ScriptView.
     // The ScriptView prototype pulls these methods into it's prototype to avoid duplicate code.
 
@@ -155,6 +121,7 @@ WebInspector.SourceView.prototype = {
     {
         this._currentSearchResultIndex = -1;
         this._searchResults = [];
+        this.sourceFrame.clearMarkedRange();
         delete this._delayedFindSearchMatches;
     },
 
@@ -163,44 +130,11 @@ WebInspector.SourceView.prototype = {
         // Call searchCanceled since it will reset everything we need before doing a new search.
         this.searchCanceled();
 
-        var lineQueryRegex = /(^|\s)(?:#|line:\s*)(\d+)(\s|$)/i;
-        var lineQueryMatch = query.match(lineQueryRegex);
-        if (lineQueryMatch) {
-            var lineToSearch = parseInt(lineQueryMatch[2]);
-
-            // If there was a space before and after the line query part, replace with a space.
-            // Otherwise replace with an empty string to eat the prefix or postfix space.
-            var lineQueryReplacement = (lineQueryMatch[1] && lineQueryMatch[3] ? " " : "");
-            var filterlessQuery = query.replace(lineQueryRegex, lineQueryReplacement);
-        }
-
         this._searchFinishedCallback = finishedCallback;
 
         function findSearchMatches(query, finishedCallback)
         {
-            if (isNaN(lineToSearch)) {
-                // Search the whole document since there was no line to search.
-                this._searchResults = (InspectorController.search(this.sourceFrame.element.contentDocument, query) || []);
-            } else {
-                var sourceRow = this.sourceFrame.sourceRow(lineToSearch);
-                if (sourceRow) {
-                    if (filterlessQuery) {
-                        // There is still a query string, so search for that string in the line.
-                        this._searchResults = (InspectorController.search(sourceRow, filterlessQuery) || []);
-                    } else {
-                        // Match the whole line, since there was no remaining query string to match.
-                        var rowRange = this.sourceFrame.element.contentDocument.createRange();
-                        rowRange.selectNodeContents(sourceRow);
-                        this._searchResults = [rowRange];
-                    }
-                }
-
-                // Attempt to search for the whole query, just incase it matches a color like "#333".
-                var wholeQueryMatches = InspectorController.search(this.sourceFrame.element.contentDocument, query);
-                if (wholeQueryMatches)
-                    this._searchResults = this._searchResults.concat(wholeQueryMatches);
-            }
-
+            this._searchResults = this.sourceFrame.findSearchMatches(query);
             if (this._searchResults)
                 finishedCallback(this, this._searchResults.length);
         }
@@ -287,29 +221,17 @@ WebInspector.SourceView.prototype = {
         if (!foundRange)
             return;
 
-        var selection = this.sourceFrame.element.contentWindow.getSelection();
-        selection.removeAllRanges();
-        selection.addRange(foundRange);
-
-        if (foundRange.startContainer.scrollIntoViewIfNeeded)
-            foundRange.startContainer.scrollIntoViewIfNeeded(true);
-        else if (foundRange.startContainer.parentNode)
-            foundRange.startContainer.parentNode.scrollIntoViewIfNeeded(true);
+        this.sourceFrame.markAndRevealRange(foundRange);
     },
 
     _sourceFrameSetupFinished: function()
     {
         this._sourceFrameSetup = true;
+        this.resize();
         if (this._delayedFindSearchMatches) {
             this._delayedFindSearchMatches();
             delete this._delayedFindSearchMatches;
         }
-    },
-
-    _syntaxHighlightingComplete: function(event)
-    {
-        this._sourceFrameSetupFinished();
-        this.sourceFrame.removeEventListener("syntax highlighting complete", null, this);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/StatusBarButton.js b/src/3rdparty/webkit/WebCore/inspector/front-end/StatusBarButton.js
index 5c69ed5aa0..e29b487dce 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/StatusBarButton.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/StatusBarButton.js
@@ -28,7 +28,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.StatusBarButton = function(title, className)
+WebInspector.StatusBarButton = function(title, className, states)
 {
     this.element = document.createElement("button");
     this.element.className = className + " status-bar-item";
@@ -41,10 +41,18 @@ WebInspector.StatusBarButton = function(title, className)
     this.glyphShadow = document.createElement("div");
     this.glyphShadow.className = "glyph shadow";
     this.element.appendChild(this.glyphShadow);
-
+    
+    this.states = states;
+    if (!states)
+        this.states = 2;
+
+    if (states == 2)
+        this._state = false;
+    else
+        this._state = 0;
+    
     this.title = title;
     this.disabled = false;
-    this._toggled = false;
     this._visible = true;
 }
 
@@ -79,22 +87,44 @@ WebInspector.StatusBarButton.prototype = {
         this._title = x;
         this.element.title = x;
     },
+    
+    get state()
+    {
+        return this._state;
+    },
+    
+    set state(x)
+    {
+        if (this._state === x)
+            return;
+        
+        if (this.states === 2) {
+            if (x)
+                this.element.addStyleClass("toggled-on");
+            else
+                this.element.removeStyleClass("toggled-on");
+        } else {
+            if (x !== 0) {
+                this.element.removeStyleClass("toggled-" + this._state);
+                this.element.addStyleClass("toggled-" + x);
+            } else 
+                this.element.removeStyleClass("toggled-" + this._state);
+        }
+        this._state = x;
+    },
 
     get toggled()
     {
-        return this._toggled;
+        if (this.states !== 2)
+            throw("Only used toggled when there are 2 states, otherwise, use state");
+        return this.state;
     },
 
     set toggled(x)
     {
-        if (this._toggled === x)
-            return;
-
-        if (x)
-            this.element.addStyleClass("toggled-on");
-        else
-            this.element.removeStyleClass("toggled-on");
-        this._toggled = x;
+        if (this.states !== 2)
+            throw("Only used toggled when there are 2 states, otherwise, use state");
+        this.state = x;
     },
 
     get visible()
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js
index 1aa11ee55e..ca1b276873 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js
@@ -97,7 +97,6 @@ WebInspector.StoragePanel.prototype = {
 
         this._domStorage = [];
 
-        this._cookieDomains = {};
         this._cookieViews = {};
 
         this.databasesListTreeElement.removeChildren();
@@ -124,13 +123,8 @@ WebInspector.StoragePanel.prototype = {
     
     addCookieDomain: function(domain)
     {
-        // Eliminate duplicate domains from the list.
-        if (typeof this._cookieDomains[domain] !== "undefined")
-            return;
-
         var cookieDomainTreeElement = new WebInspector.CookieSidebarTreeElement(domain);
         this.cookieListTreeElement.appendChild(cookieDomainTreeElement);
-        this._cookieDomains[domain] = true;
     },
 
     addDOMStorage: function(domStorage)
@@ -226,14 +220,14 @@ WebInspector.StoragePanel.prototype = {
             this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
     },
 
-    showCookies: function(cookieDomain)
+    showCookies: function(treeElement, cookieDomain)
     {
         if (this.visibleView)
             this.visibleView.hide();
 
         var view = this._cookieViews[cookieDomain];
         if (!view) {
-            view = new WebInspector.CookieItemsView(cookieDomain);
+            view = new WebInspector.CookieItemsView(treeElement, cookieDomain);
             this._cookieViews[cookieDomain] = view;
         }
 
@@ -306,52 +300,14 @@ WebInspector.StoragePanel.prototype = {
             var data = {};
 
             var row = rows[i];
-            for (var columnIdentifier in row) {
-                var text = row[columnIdentifier];
-                data[columnIdentifier] = text;
-                if (text.length > columns[columnIdentifier].width)
-                    columns[columnIdentifier].width = text.length;
-            }
+            for (var columnIdentifier in row)
+                data[columnIdentifier] = row[columnIdentifier];
 
             var node = new WebInspector.DataGridNode(data, false);
             node.selectable = false;
             nodes.push(node);
         }
 
-        var totalColumnWidths = 0;
-        for (var columnIdentifier in columns)
-            totalColumnWidths += columns[columnIdentifier].width;
-
-        // Calculate the percentage width for the columns.
-        const minimumPrecent = Math.min(5, Math.floor(100/numColumns));
-        var recoupPercent = 0;
-        for (var columnIdentifier in columns) {
-            var width = columns[columnIdentifier].width;
-            width = Math.round((width / totalColumnWidths) * 100);
-            if (width < minimumPrecent) {
-                recoupPercent += (minimumPrecent - width);
-                width = minimumPrecent;
-            }
-
-            columns[columnIdentifier].width = width;
-        }
-
-        // Enforce the minimum percentage width.
-        while (recoupPercent > 0) {
-            for (var columnIdentifier in columns) {
-                if (columns[columnIdentifier].width > minimumPrecent) {
-                    --columns[columnIdentifier].width;
-                    --recoupPercent;
-                    if (!recoupPercent)
-                        break;
-                }
-            }
-        }
-
-        // Change the width property to a string suitable for a style width.
-        for (var columnIdentifier in columns)
-            columns[columnIdentifier].width += "%";
-
         var dataGrid = new WebInspector.DataGrid(columns);
         var length = nodes.length;
         for (var i = 0; i < length; ++i)
@@ -360,13 +316,6 @@ WebInspector.StoragePanel.prototype = {
         return dataGrid;
     },
 
-    resize: function()
-    {
-        var visibleView = this.visibleView;
-        if (visibleView && "resize" in visibleView)
-            visibleView.resize();
-    },
-
     updateDOMStorage: function(storageId)
     {
         var domStorage = this._domStorageForId(storageId);
@@ -395,6 +344,7 @@ WebInspector.StoragePanel.prototype = {
     {
         this.storageViews.style.left = width + "px";
         this.storageViewStatusBarItemsContainer.style.left = width + "px";
+        this.resize();
     }
 }
 
@@ -519,6 +469,7 @@ WebInspector.CookieSidebarTreeElement = function(cookieDomain)
 {
     WebInspector.SidebarTreeElement.call(this, "cookie-sidebar-tree-item", cookieDomain, "", null, false);
     this._cookieDomain = cookieDomain;
+    this._subtitle = "";
 
     this.refreshTitles();
 }
@@ -526,9 +477,9 @@ WebInspector.CookieSidebarTreeElement = function(cookieDomain)
 WebInspector.CookieSidebarTreeElement.prototype = {
     onselect: function()
     {
-        WebInspector.panels.storage.showCookies(this._cookieDomain);
+        WebInspector.panels.storage.showCookies(this, this._cookieDomain);
     },
-    
+
     get mainTitle()
     {
         return this._cookieDomain ? this._cookieDomain : WebInspector.UIString("Local Files");
@@ -541,12 +492,13 @@ WebInspector.CookieSidebarTreeElement.prototype = {
 
     get subtitle()
     {
-        return "";
+        return this._subtitle;
     },
 
     set subtitle(x)
     {
-        // Do nothing.
+        this._subtitle = x;
+        this.refreshTitles();
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js
index a95dae35be..37e497011d 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -36,24 +36,18 @@ WebInspector.StylesSidebarPane = function()
     var option = document.createElement("option");
     option.value = "hex";
     option.action = this._changeColorFormat.bind(this);
-    if (Preferences.colorFormat === "hex")
-        option.selected = true;
     option.label = WebInspector.UIString("Hex Colors");
     this.settingsSelectElement.appendChild(option);
 
     option = document.createElement("option");
     option.value = "rgb";
     option.action = this._changeColorFormat.bind(this);
-    if (Preferences.colorFormat === "rgb")
-        option.selected = true;
     option.label = WebInspector.UIString("RGB Colors");
     this.settingsSelectElement.appendChild(option);
 
     option = document.createElement("option");
     option.value = "hsl";
     option.action = this._changeColorFormat.bind(this);
-    if (Preferences.colorFormat === "hsl")
-        option.selected = true;
     option.label = WebInspector.UIString("HSL Colors");
     this.settingsSelectElement.appendChild(option);
 
@@ -66,11 +60,32 @@ WebInspector.StylesSidebarPane = function()
 
     this.settingsSelectElement.addEventListener("click", function(event) { event.stopPropagation() }, false);
     this.settingsSelectElement.addEventListener("change", this._changeSetting.bind(this), false);
+    WebInspector.settings.addEventListener("loaded", this._settingsLoaded, this);
 
     this.titleElement.appendChild(this.settingsSelectElement);
 }
 
+// Taken from http://www.w3.org/TR/CSS21/propidx.html.
+WebInspector.StylesSidebarPane.InheritedProperties = [
+    "azimuth", "border-collapse", "border-spacing", "caption-side", "color", "cursor", "direction", "elevation",
+    "empty-cells", "font-family", "font-size", "font-style", "font-variant", "font-weight", "font", "letter-spacing",
+    "line-height", "list-style-image", "list-style-position", "list-style-type", "list-style", "orphans", "pitch-range",
+    "pitch", "quotes", "richness", "speak-header", "speak-numeral", "speak-punctuation", "speak", "speech-rate", "stress",
+    "text-align", "text-indent", "text-transform", "visibility", "voice-family", "volume", "white-space", "widows", "word-spacing"
+].keySet();
+
 WebInspector.StylesSidebarPane.prototype = {
+    _settingsLoaded: function()
+    {
+        var format = WebInspector.settings.colorFormat;
+        if (format === "hex")
+            this.settingsSelectElement[0].selected = true;
+        if (format === "rgb")
+            this.settingsSelectElement[1].selected = true;
+        if (format === "hsl")
+            this.settingsSelectElement[2].selected = true;
+    },
+
     update: function(node, editedSection, forceUpdate)
     {
         var refresh = false;
@@ -93,30 +108,30 @@ WebInspector.StylesSidebarPane.prototype = {
             node = this.node;
 
         var body = this.bodyElement;
-        if (!refresh || !node) {
+
+        if (!node) {
             body.removeChildren();
             this.sections = [];
-        }
-
-        if (!node)
             return;
+        }
 
         var self = this;
         function callback(styles)
         {
             if (!styles)
                 return;
-            node._setStyles(styles.computedStyle, styles.inlineStyle, styles.styleAttributes, styles.matchedCSSRules);
-            self._update(refresh, body, node, editedSection, forceUpdate);
+            self._update(refresh, node, styles, editedSection, forceUpdate);
         }
 
-        InjectedScriptAccess.getStyles(node.id, !Preferences.showUserAgentStyles, callback);
+        InspectorBackend.getStyles(WebInspector.Callback.wrap(callback), node.id, !WebInspector.settings.showUserAgentStyles);
     },
 
-    _update: function(refresh, body, node, editedSection, forceUpdate)
+    _update: function(refresh, node, styles, editedSection, forceUpdate)
     {
+        var nodeComputedStyle = new WebInspector.CSSStyleDeclaration(styles.computedStyle);
+
         if (!refresh) {
-            body.removeChildren();
+            this.bodyElement.removeChildren();
             this.sections = [];
         }
 
@@ -125,45 +140,87 @@ WebInspector.StylesSidebarPane.prototype = {
         if (refresh) {
             for (var i = 0; i < this.sections.length; ++i) {
                 var section = this.sections[i];
-                if (section instanceof WebInspector.BlankStylePropertiesSection)
-                    continue;
                 if (section.computedStyle)
-                    section.styleRule.style = node.ownerDocument.defaultView.getComputedStyle(node);
+                    section.styleRule.style = nodeComputedStyle;
                 var styleRule = { section: section, style: section.styleRule.style, computedStyle: section.computedStyle, rule: section.rule };
                 styleRules.push(styleRule);
             }
         } else {
-            var computedStyle = node.ownerDocument.defaultView.getComputedStyle(node);
-            styleRules.push({ computedStyle: true, selectorText: WebInspector.UIString("Computed Style"), style: computedStyle, editable: false });
-
-            var nodeName = node.nodeName.toLowerCase();
-            for (var i = 0; i < node.attributes.length; ++i) {
-                var attr = node.attributes[i];
-                if (attr.style) {
-                    var attrStyle = { style: attr.style, editable: false };
-                    attrStyle.subtitle = WebInspector.UIString("element’s “%s” attribute", attr.name);
-                    attrStyle.selectorText = nodeName + "[" + attr.name;
-                    if (attr.value.length)
-                        attrStyle.selectorText += "=" + attr.value;
-                    attrStyle.selectorText += "]";
-                    styleRules.push(attrStyle);
-                }
+            styleRules.push({ computedStyle: true, selectorText: WebInspector.UIString("Computed Style"), style: nodeComputedStyle, editable: false });
+
+            var styleAttributes = {};
+            for (var name in styles.styleAttributes) {
+                var attrStyle = { style: new WebInspector.CSSStyleDeclaration(styles.styleAttributes[name]), editable: false };
+                attrStyle.subtitle = WebInspector.UIString("element’s “%s” attribute", name);
+                attrStyle.selectorText = node.nodeName + "[" + name;
+                if (node.getAttribute(name))
+                    attrStyle.selectorText += "=" + node.getAttribute(name);
+                attrStyle.selectorText += "]";
+                styleRules.push(attrStyle);
             }
 
-            // Always Show element's Style Attributes
-            if (node.nodeType === Node.ELEMENT_NODE) {
-                var inlineStyle = { selectorText: WebInspector.UIString("Style Attribute"), style: node.style, isAttribute: true };
+            // Show element's Style Attributes
+            if (styles.inlineStyle && node.nodeType === Node.ELEMENT_NODE) {
+                var inlineStyle = { selectorText: WebInspector.UIString("Style Attribute"), style: new WebInspector.CSSStyleDeclaration(styles.inlineStyle), isAttribute: true };
                 inlineStyle.subtitle = WebInspector.UIString("element’s “%s” attribute", "style");
                 styleRules.push(inlineStyle);
             }
 
-            var matchedStyleRules = node.ownerDocument.defaultView.getMatchedCSSRules(node, "", !Preferences.showUserAgentStyles);
-            if (matchedStyleRules) {
-                // Add rules in reverse order to match the cascade order.
-                for (var i = (matchedStyleRules.length - 1); i >= 0; --i) {
-                    var rule = matchedStyleRules[i];
-                    styleRules.push({ style: rule.style, selectorText: rule.selectorText, parentStyleSheet: rule.parentStyleSheet, rule: rule });
+            // Add rules in reverse order to match the cascade order.
+            for (var i = styles.matchedCSSRules.length - 1; i >= 0; --i) {
+                var rule = WebInspector.CSSStyleDeclaration.parseRule(styles.matchedCSSRules[i]);
+                styleRules.push({ style: rule.style, selectorText: rule.selectorText, parentStyleSheet: rule.parentStyleSheet, rule: rule });
+            }
+
+            // Collect used properties first in order to identify inherited ones.
+            var userPropertyNames = {};
+            for (var i = 0; i < styleRules.length; ++i) {
+                var styleRule = styleRules[i];
+                if (styleRule.computedStyle)
+                    continue;
+                var style = styleRule.style;
+                for (var j = 0; j < style.length; ++j)
+                    userPropertyNames[style[j]] = true;
+            }
+
+            // Walk the node structure and identify styles with inherited properties.
+            var parentStyles = styles.parent;
+            var parentNode = node.parentNode;
+            function insertInheritedNodeSeparator(node)
+            {
+                var entry = {};
+                entry.isInheritedNodeSeparator = true;
+                entry.node = node;
+                styleRules.push(entry);
+            }
+
+            while (parentStyles) {
+                var separatorInserted = false;
+                if (parentStyles.inlineStyle) {
+                    if (this._containsInherited(parentStyles.inlineStyle)) {
+                        var inlineStyle = { selectorText: WebInspector.UIString("Style Attribute"), style: new WebInspector.CSSStyleDeclaration(parentStyles.inlineStyle), isAttribute: true, isInherited: true };
+                        inlineStyle.subtitle = WebInspector.UIString("element’s “%s” attribute", "style");
+                        if (!separatorInserted) {
+                            insertInheritedNodeSeparator(parentNode);
+                            separatorInserted = true;
+                        }
+                        styleRules.push(inlineStyle);
+                    }
+                }
+
+                for (var i = parentStyles.matchedCSSRules.length - 1; i >= 0; --i) {
+                    var rulePayload = parentStyles.matchedCSSRules[i];
+                    if (!this._containsInherited(rulePayload.style))
+                        continue;
+                    var rule = WebInspector.CSSStyleDeclaration.parseRule(rulePayload);
+                    if (!separatorInserted) {
+                        insertInheritedNodeSeparator(parentNode);
+                        separatorInserted = true;
+                    }
+                    styleRules.push({ style: rule.style, selectorText: rule.selectorText, parentStyleSheet: rule.parentStyleSheet, rule: rule, isInherited: true });
                 }
+                parentStyles = parentStyles.parent;
+                parentNode = parentNode.parentNode;
             }
         }
 
@@ -186,7 +243,7 @@ WebInspector.StylesSidebarPane.prototype = {
         // Walk the style rules and make a list of all used and overloaded properties.
         for (var i = 0; i < styleRules.length; ++i) {
             var styleRule = styleRules[i];
-            if (styleRule.computedStyle)
+            if (styleRule.computedStyle || styleRule.isInheritedNodeSeparator)
                 continue;
             if (styleRule.section && styleRule.section.noAffect)
                 continue;
@@ -240,13 +297,12 @@ WebInspector.StylesSidebarPane.prototype = {
 
             // Walk in reverse to match the order !important overrides.
             for (var i = (styleRules.length - 1); i >= 0; --i) {
-                if (styleRules[i].computedStyle)
+                if (styleRules[i].computedStyle || styleRules[i].isInheritedNodeSeparator)
                     continue;
 
                 var style = styleRules[i].style;
-                var uniqueProperties = style.uniqueStyleProperties;
-                for (var j = 0; j < uniqueProperties.length; ++j) {
-                    var name = uniqueProperties[j];
+                for (var j = 0; j < style.length; ++j) {
+                    var name = style[j];
                     if (style.getPropertyPriority(name).length) {
                         if (!(name in foundPriorityProperties))
                             styleRules[i].usedProperties[name] = true;
@@ -273,26 +329,26 @@ WebInspector.StylesSidebarPane.prototype = {
             // Make a property section for each style rule.
             for (var i = 0; i < styleRules.length; ++i) {
                 var styleRule = styleRules[i];
-                var subtitle = styleRule.subtitle;
-                delete styleRule.subtitle;
-
+                if (styleRule.isInheritedNodeSeparator) {
+                    var separatorElement = document.createElement("div");
+                    separatorElement.className = "styles-sidebar-separator";
+                    var link = document.createElement("a");
+                    link.href = "";
+                    link.addEventListener("mousedown", this._selectNode.bind(this, styleRule.node.id), false);
+                    WebInspector.panels.elements.decorateNodeLabel(styleRule.node, link);
+                    separatorElement.appendChild(document.createTextNode(WebInspector.UIString("Inherited from") + " "));
+                    separatorElement.appendChild(link);
+                    this.bodyElement.appendChild(separatorElement);
+                    continue;
+                }
                 var computedStyle = styleRule.computedStyle;
-                delete styleRule.computedStyle;
-
-                var ruleUsedProperties = styleRule.usedProperties;
-                delete styleRule.usedProperties;
-
-                var editable = styleRule.editable;
-                delete styleRule.editable;
-
-                var isAttribute = styleRule.isAttribute;
-                delete styleRule.isAttribute;
 
                 // Default editable to true if it was omitted.
+                var editable = styleRule.editable;
                 if (typeof editable === "undefined")
                     editable = true;
 
-                var section = new WebInspector.StylePropertiesSection(styleRule, subtitle, computedStyle, (ruleUsedProperties || usedProperties), editable);
+                var section = new WebInspector.StylePropertiesSection(styleRule, styleRule.subtitle, styleRule.computedStyle, (styleRule.usedProperties || usedProperties), editable, styleRule.isInherited);
                 if (computedStyle)
                     section.disabledComputedProperties = disabledComputedProperties;
                 section.pane = this;
@@ -301,17 +357,39 @@ WebInspector.StylesSidebarPane.prototype = {
                     section.expanded = Preferences.styleRulesExpandedState[section.identifier];
                 else if (computedStyle)
                     section.collapse(true);
-                else if (isAttribute && styleRule.style.length === 0)
+                else if (styleRule.isAttribute && styleRule.style.length === 0)
+                    section.collapse(true);
+                else if (styleRule.isInherited)
                     section.collapse(true);
                 else
                     section.expand(true);
 
-                body.appendChild(section.element);
+                this.bodyElement.appendChild(section.element);
                 this.sections.push(section);
             }
         }
     },
 
+    _selectNode: function(nodeId, e)
+    {
+        WebInspector.updateFocusedNode(nodeId);
+        e.preventDefault();
+    },
+
+    _containsInherited: function(payload)
+    {
+        var properties = [];
+        for (var i = 0; i < payload.properties.length; ++i) {
+            var property = payload.properties[i];
+            // Does this style contain non-overriden inherited property?
+            if (property.name in WebInspector.StylesSidebarPane.InheritedProperties)
+                return true;
+        }
+        if (payload.disabled && this._containsInherited(payload.disabled))
+            return true;
+        return false;
+    },
+
     _changeSetting: function(event)
     {
         var options = this.settingsSelectElement.options;
@@ -321,7 +399,7 @@ WebInspector.StylesSidebarPane.prototype = {
         // Select the correct color format setting again, since it needs to be selected.
         var selectedIndex = 0;
         for (var i = 0; i < options.length; ++i) {
-            if (options[i].value === Preferences.colorFormat) {
+            if (options[i].value === WebInspector.settings.colorFormat) {
                 selectedIndex = i;
                 break;
             }
@@ -333,9 +411,7 @@ WebInspector.StylesSidebarPane.prototype = {
     _changeColorFormat: function(event)
     {
         var selectedOption = this.settingsSelectElement[this.settingsSelectElement.selectedIndex];
-        Preferences.colorFormat = selectedOption.value;
-
-        InspectorController.setSetting("color-format", Preferences.colorFormat);
+        WebInspector.settings.colorFormat = selectedOption.value;
 
         for (var i = 0; i < this.sections.length; ++i)
             this.sections[i].update(true);
@@ -351,11 +427,9 @@ WebInspector.StylesSidebarPane.prototype = {
         var blankSection = new WebInspector.BlankStylePropertiesSection(appropriateSelectorForNode(this.node, true));
         blankSection.pane = this;
 
-        var elementStyleSection = this.sections[1];        
+        var elementStyleSection = this.sections[1];
         this.bodyElement.insertBefore(blankSection.element, elementStyleSection.element.nextSibling);
 
-        this.sections.splice(2, 0, blankSection);
-
         return blankSection;
     },
 
@@ -372,11 +446,10 @@ WebInspector.StylesSidebarPane.prototype = {
 
 WebInspector.StylesSidebarPane.prototype.__proto__ = WebInspector.SidebarPane.prototype;
 
-WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyle, usedProperties, editable)
+WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyle, usedProperties, editable, isInherited)
 {
     WebInspector.PropertiesSection.call(this, styleRule.selectorText);
 
-    this.titleElement.addEventListener("click", this._clickSelector.bind(this), false);
     this.titleElement.addEventListener("dblclick", this._dblclickSelector.bind(this), false);
     this.element.addEventListener("dblclick", this._dblclickEmptySpace.bind(this), false);
 
@@ -384,6 +457,7 @@ WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyl
     this.rule = this.styleRule.rule;
     this.computedStyle = computedStyle;
     this.editable = (editable && !computedStyle);
+    this.isInherited = isInherited;
 
     // Prevent editing the user agent and user rules.
     var isUserAgent = this.rule && this.rule.isUserAgent;
@@ -398,35 +472,28 @@ WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyl
     if (computedStyle) {
         this.element.addStyleClass("computed-style");
 
-        if (Preferences.showInheritedComputedStyleProperties)
+        if (WebInspector.settings.showInheritedComputedStyleProperties)
             this.element.addStyleClass("show-inherited");
 
-        var showInheritedLabel = document.createElement("label");
-        var showInheritedInput = document.createElement("input");
-        showInheritedInput.type = "checkbox";
-        showInheritedInput.checked = Preferences.showInheritedComputedStyleProperties;
-
         var computedStyleSection = this;
         var showInheritedToggleFunction = function(event) {
-            Preferences.showInheritedComputedStyleProperties = showInheritedInput.checked;
-            if (Preferences.showInheritedComputedStyleProperties)
+            WebInspector.settings.showInheritedComputedStyleProperties = computedStyleSection._showInheritedCheckbox.checked();
+            if (WebInspector.settings.showInheritedComputedStyleProperties)
                 computedStyleSection.element.addStyleClass("show-inherited");
             else
                 computedStyleSection.element.removeStyleClass("show-inherited");
-            event.stopPropagation();
         };
 
-        showInheritedLabel.addEventListener("click", showInheritedToggleFunction, false);
+        this._showInheritedCheckbox = new WebInspector.Checkbox(WebInspector.UIString("Show inherited"),
+                                                                showInheritedToggleFunction,
+                                                                WebInspector.settings.showInheritedComputedStyleProperties);
 
-        showInheritedLabel.appendChild(showInheritedInput);
-        showInheritedLabel.appendChild(document.createTextNode(WebInspector.UIString("Show inherited")));
-        this.subtitleElement.appendChild(showInheritedLabel);
+        this.subtitleElement.appendChild(this._showInheritedCheckbox.element);
     } else {
         if (!subtitle) {
             if (this.styleRule.parentStyleSheet && this.styleRule.parentStyleSheet.href) {
                 var url = this.styleRule.parentStyleSheet.href;
-                subtitle = WebInspector.linkifyURL(url, WebInspector.displayNameForURL(url));
-                this.subtitleElement.addStyleClass("file");
+                this.subtitleElement.appendChild(WebInspector.linkifyResourceAsNode(url, "resources", this.rule.sourceLine + 1));
             } else if (isUserAgent)
                 subtitle = WebInspector.UIString("user agent stylesheet");
             else if (isUser)
@@ -436,13 +503,15 @@ WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyl
             else
                 subtitle = WebInspector.UIString("inline stylesheet");
         }
-
-        this.subtitle = subtitle;
+        if (isInherited)
+            this.element.addStyleClass("show-inherited");
+        if (subtitle)
+            this.subtitle = subtitle;
     }
 
     this.identifier = styleRule.selectorText;
     if (this.subtitle)
-        this.identifier += ":" + this.subtitleElement.textContent;    
+        this.identifier += ":" + this.subtitleElement.textContent;
 }
 
 WebInspector.StylePropertiesSection.prototype = {
@@ -481,6 +550,12 @@ WebInspector.StylePropertiesSection.prototype = {
 
     isPropertyInherited: function(property)
     {
+        if (this.isInherited) {
+            // While rendering inherited stylesheet, reverse meaning of this property.
+            // Render truly inherited properties with black, i.e. return them as non-inherited.
+            return !(property in WebInspector.StylesSidebarPane.InheritedProperties);
+        }
+
         if (!this.computedStyle || !this._usedProperties || this.noAffect)
             return false;
         // These properties should always show for Computed Style.
@@ -527,6 +602,11 @@ WebInspector.StylePropertiesSection.prototype = {
             }
         }
 
+        this.afterUpdate();
+    },
+
+    afterUpdate: function()
+    {
         if (this._afterUpdate) {
             this._afterUpdate(this);
             delete this._afterUpdate;
@@ -538,9 +618,12 @@ WebInspector.StylePropertiesSection.prototype = {
         var style = this.styleRule.style;
 
         var foundShorthands = {};
-        var uniqueProperties = style.uniqueStyleProperties;
         var disabledProperties = style.__disabledPropertyValues || {};
 
+        var uniqueProperties = [];
+        for (var i = 0; i < style.length; ++i)
+            uniqueProperties.push(style[i]);
+
         for (var name in disabledProperties)
             uniqueProperties.push(name);
 
@@ -591,19 +674,6 @@ WebInspector.StylePropertiesSection.prototype = {
         return item;
     },
 
-    _clickSelector: function(event)
-    {
-        event.stopPropagation();
-
-        // Don't search "Computed Styles", "Style Attribute", or Mapped Attributes.
-        if (this.computedStyle || !this.rule || this.rule.isUser)
-            return;
-
-        var searchElement = document.getElementById("search");
-        searchElement.value = this.styleRule.selectorText;
-        WebInspector.performSearch({ target: searchElement });
-    },
-
     _dblclickEmptySpace: function(event)
     {
         this.expand();
@@ -657,16 +727,14 @@ WebInspector.StylePropertiesSection.prototype = {
             return moveToNextIfNeeded.call(this);
 
         var self = this;
-        function callback(result)
+        function callback(newRulePayload, doesAffectSelectedNode)
         {
-            if (!result) {
+            if (!newRulePayload) {
                 // Invalid Syntax for a Selector
                 moveToNextIfNeeded.call(self);
                 return;
             }
 
-            var newRulePayload = result[0];
-            var doesAffectSelectedNode = result[1];
             if (!doesAffectSelectedNode) {
                 self.noAffect = true;
                 self.element.addStyleClass("no-affect");
@@ -689,7 +757,7 @@ WebInspector.StylePropertiesSection.prototype = {
             moveToNextIfNeeded.call(self);
         }
 
-        InjectedScriptAccess.applyStyleRuleText(this.rule.id, newContent, this.pane.node.id, callback);
+        InspectorBackend.setRuleSelector(WebInspector.Callback.wrap(callback), this.rule.id, newContent, this.pane.node.id);
     },
 
     editingSelectorCancelled: function()
@@ -716,17 +784,14 @@ WebInspector.BlankStylePropertiesSection.prototype = {
     editingSelectorCommitted: function(element, newContent, oldContent, context)
     {
         var self = this;
-        function callback(result)
+        function callback(rule, doesSelectorAffectSelectedNode)
         {
-            if (!result) {
+            if (!rule) {
                 // Invalid Syntax for a Selector
                 self.editingSelectorCancelled();
                 return;
             }
 
-            var rule = result[0];
-            var doesSelectorAffectSelectedNode = result[1];
-
             var styleRule = WebInspector.CSSStyleDeclaration.parseRule(rule);
             styleRule.rule = rule;
 
@@ -743,7 +808,7 @@ WebInspector.BlankStylePropertiesSection.prototype = {
             self.addNewBlankProperty().startEditing();
         }
 
-        InjectedScriptAccess.addStyleSelector(newContent, this.pane.node.id, callback);
+        InspectorBackend.addRule(WebInspector.Callback.wrap(callback), newContent, this.pane.node.id);
     },
 
     editingSelectorCancelled: function()
@@ -917,9 +982,9 @@ WebInspector.StylePropertyTreeElement.prototype = {
                 var format;
                 if (Preferences.showColorNicknames && color.nickname)
                     format = "nickname";
-                else if (Preferences.colorFormat === "rgb")
+                else if (WebInspector.settings.colorFormat === "rgb")
                     format = (color.simple ? "rgb" : "rgba");
-                else if (Preferences.colorFormat === "hsl")
+                else if (WebInspector.settings.colorFormat === "hsl")
                     format = (color.simple ? "hsl" : "hsla");
                 else if (color.simple)
                     format = (color.hasShortHex() ? "shorthex" : "hex");
@@ -986,7 +1051,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
                 return container;
             }
 
-            var colorRegex = /((?:rgb|hsl)a?\([^)]+\)|#[0-9a-fA-F]{6}|#[0-9a-fA-F]{3}|\b\w+\b)/g;
+            var colorRegex = /((?:rgb|hsl)a?\([^)]+\)|#[0-9a-fA-F]{6}|#[0-9a-fA-F]{3}|\b\w+\b(?!-))/g;
             var colorProcessor = processValue.bind(window, colorRegex, processColor, null);
 
             valueElement.appendChild(processValue(/url\(([^)]+)\)/g, linkifyURL, colorProcessor, value));
@@ -1050,7 +1115,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
             self.updateAll(true);
         }
 
-        InjectedScriptAccess.toggleStyleEnabled(this.style.id, this.name, disabled, callback);
+        InspectorBackend.toggleStyleEnabled(WebInspector.Callback.wrap(callback), this.style.id, this.name, disabled);
     },
 
     updateState: function()
@@ -1099,7 +1164,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         }
     },
 
-    ondblclick: function(element, event)
+    ondblclick: function(event)
     {
         this.startEditing(event.target);
         event.stopPropagation();
@@ -1203,7 +1268,6 @@ WebInspector.StylePropertyTreeElement.prototype = {
         selection.removeAllRanges();
         selection.addRange(finalSelectionRange);
 
-        event.preventDefault();
         event.handled = true;
 
         if (!this.originalCSSText) {
@@ -1213,7 +1277,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         } else {
             // Restore the original CSS text before applying user changes. This is needed to prevent
             // new properties from sticking around if the user adds one, then removes it.
-            InjectedScriptAccess.setStyleText(this.style.id, this.originalCSSText);
+            InspectorBackend.setStyleText(WebInspector.Callback.wrap(null), this.style.id, this.originalCSSText);
         }
 
         this.applyStyleText(this.listItemElement.textContent);
@@ -1233,7 +1297,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         if (this._newProperty)
             this.treeOutline.removeChild(this);
         else if (this.originalCSSText) {
-            InjectedScriptAccess.setStyleText(this.style.id, this.originalCSSText);
+            InspectorBackend.setStyleText(WebInspector.Callback.wrap(null), this.style.id, this.originalCSSText);
 
             if (this.treeOutline.section && this.treeOutline.section.pane)
                 this.treeOutline.section.pane.dispatchEventToListeners("style edited");
@@ -1293,8 +1357,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
                 if (alreadyNew && !valueChanged)
                     return;
 
-                var item = section.addNewBlankProperty();
-                item.startEditing();
+                section.addNewBlankProperty().startEditing();
                 return;
             }
 
@@ -1307,11 +1370,13 @@ WebInspector.StylePropertyTreeElement.prototype = {
     {
         var section = this.treeOutline.section;
         var elementsPanel = WebInspector.panels.elements;
-        var styleTextLength = styleText.trimWhitespace().length;
+        styleText = styleText.replace(/\s/g, " ").trim(); // replace &nbsp; with whitespace.
+        var styleTextLength = styleText.length;
         if (!styleTextLength && updateInterface) {
             if (this._newProperty) {
                 // The user deleted everything, so remove the tree element and update.
                 this.parent.removeChild(this);
+                section.afterUpdate();
                 return;
             } else {
                 delete section._afterUpdate;
@@ -1319,9 +1384,9 @@ WebInspector.StylePropertyTreeElement.prototype = {
         }
 
         var self = this;
-        function callback(result)
+        function callback(success, newPayload, changedProperties)
         {
-            if (!result) {
+            if (!success) {
                 // The user typed something, but it didn't parse. Just abort and restore
                 // the original title for this property.  If this was a new attribute and
                 // we couldn't parse, then just remove it.
@@ -1334,8 +1399,6 @@ WebInspector.StylePropertyTreeElement.prototype = {
                 return;
             }
 
-            var newPayload = result[0];
-            var changedProperties = result[1];
             elementsPanel.removeStyleChange(section.identifier, self.style, self.name);
 
             if (!styleTextLength) {
@@ -1353,12 +1416,8 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
             if (updateInterface)
                 self.updateAll(true);
-
-            if (!self.rule)
-                WebInspector.panels.elements.treeOutline.update();
         }
-
-        InjectedScriptAccess.applyStyleText(this.style.id, styleText.trimWhitespace(), this.name, callback);
+        InspectorBackend.applyStyleText(WebInspector.Callback.wrap(callback), this.style.id, styleText, this.name);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TestController.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TestController.js
index 12e1ac7ecd..b2630ae49b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TestController.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TestController.js
@@ -42,8 +42,8 @@ WebInspector.TestController.prototype = {
 
     notifyDone: function(result)
     {
-        var message = typeof result === "undefined" ? "<undefined>" : JSON.stringify(result);
-        InspectorController.didEvaluateForTestInFrontend(this._callId, message);
+        var message = typeof result === "undefined" ? "\"<undefined>\"" : JSON.stringify(result);
+        InspectorBackend.didEvaluateForTestInFrontend(this._callId, message);
     },
 
     runAfterPendingDispatches: function(callback)
@@ -52,7 +52,6 @@ WebInspector.TestController.prototype = {
             callback();
             return;
         }
-
         setTimeout(this.runAfterPendingDispatches.bind(this), 0, callback);
     }
 }
@@ -60,16 +59,20 @@ WebInspector.TestController.prototype = {
 WebInspector.evaluateForTestInFrontend = function(callId, script)
 {
     var controller = new WebInspector.TestController(callId);
-    try {
-        var result;
-        if (window[script] && typeof window[script] === "function")
-            result = window[script].call(this, controller);
-        else
-            result = window.eval(script);
+    function invokeMethod()
+    {
+        try {
+            var result;
+            if (window[script] && typeof window[script] === "function")
+                result = window[script].call(WebInspector, controller);
+            else
+                result = window.eval(script);
 
-        if (!controller._waitUntilDone)
-            controller.notifyDone(result);
-    } catch (e) {
-        controller.notifyDone(e.toString());
+            if (!controller._waitUntilDone)
+                controller.notifyDone(result);
+        } catch (e) {
+            controller.notifyDone(e.toString());
+        }
     }
+    controller.runAfterPendingDispatches(invokeMethod);
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TextEditorHighlighter.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TextEditorHighlighter.js
new file mode 100644
index 0000000000..3fea7a5dd2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TextEditorHighlighter.js
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TextEditorHighlighter = function(textModel, damageCallback)
+{
+    this._textModel = textModel;
+    this._tokenizer = WebInspector.SourceTokenizer.Registry.getInstance().getTokenizer("text/html");
+    this._damageCallback = damageCallback;
+    this._lastHighlightedLine = 0;
+    this._lastHighlightedColumn = 0;
+}
+
+WebInspector.TextEditorHighlighter.prototype = {
+    set mimeType(mimeType)
+    {
+        var tokenizer = WebInspector.SourceTokenizer.Registry.getInstance().getTokenizer(mimeType);
+        if (tokenizer) {
+            this._tokenizer = tokenizer;
+            this._tokenizerCondition = this._tokenizer.initialCondition;
+        }
+    },
+
+    highlight: function(endLine)
+    {
+        // First check if we have work to do.
+        if (endLine <= this._lastHighlightedLine)
+            return;
+
+        this._requestedEndLine = endLine;
+
+        if (this._highlightTimer) {
+            // There is a timer scheduled, it will catch the new job based on the new endLine set.
+            return;
+        }
+
+        // Do small highlight synchronously. This will provide instant highlight on PageUp / PageDown, gentle scrolling.
+        this._highlightInChunks(endLine);
+
+        // Schedule tail highlight if necessary.
+        if (this._lastHighlightedLine < endLine)
+            this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, endLine), 100);
+    },
+
+    _highlightInChunks: function(endLine)
+    {
+        delete this._highlightTimer;
+
+        // First we always check if we have work to do. Could be that user scrolled back and we can quit.
+        if (this._requestedEndLine <= this._lastHighlightedLine)
+            return;
+
+        if (this._requestedEndLine !== endLine) {
+            // User keeps updating the job in between of our timer ticks. Just reschedule self, don't eat CPU (they must be scrolling).
+            this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, this._requestedEndLine), 100);
+            return;
+        }
+
+        this._highlightLines(this._requestedEndLine);
+
+        // Schedule tail highlight if necessary.
+        if (this._lastHighlightedLine < this._requestedEndLine)
+            this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, this._requestedEndLine), 10);
+    },
+
+    _highlightLines: function(endLine)
+    {
+        // Tokenizer is stateless and reused accross viewers, restore its condition before highlight and save it after.
+        this._tokenizer.condition = this._tokenizerCondition;
+        var tokensCount = 0;
+        for (var lineNumber = this._lastHighlightedLine; lineNumber < endLine; ++lineNumber) {
+            var line = this._textModel.line(lineNumber);
+            this._tokenizer.line = line;
+            var attributes = this._textModel.getAttribute(lineNumber, "highlight") || {};
+
+            // Highlight line.
+            do {
+                var newColumn = this._tokenizer.nextToken(this._lastHighlightedColumn);
+                var tokenType = this._tokenizer.tokenType;
+                if (tokenType)
+                    attributes[this._lastHighlightedColumn] = { length: newColumn - this._lastHighlightedColumn, tokenType: tokenType, subTokenizer: this._tokenizer.subTokenizer };
+                this._lastHighlightedColumn = newColumn;
+                if (++tokensCount > 1000)
+                    break;
+            } while (this._lastHighlightedColumn < line.length)
+
+            this._textModel.setAttribute(lineNumber, "highlight", attributes);
+            if (this._lastHighlightedColumn < line.length) {
+                // Too much work for single chunk - exit.
+                break;
+            } else
+                this._lastHighlightedColumn = 0;
+        }
+
+        this._damageCallback(this._lastHighlightedLine, lineNumber);
+        this._tokenizerCondition = this._tokenizer.condition;
+        this._lastHighlightedLine = lineNumber;
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TextEditorModel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TextEditorModel.js
new file mode 100644
index 0000000000..e56c269cee
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TextEditorModel.js
@@ -0,0 +1,309 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TextRange = function(startLine, startColumn, endLine, endColumn)
+{
+    this.startLine = startLine;
+    this.startColumn = startColumn;
+    this.endLine = endLine;
+    this.endColumn = endColumn;
+}
+
+WebInspector.TextRange.prototype = {
+    isEmpty: function()
+    {
+        return this.startLine === this.endLine && this.startColumn === this.endColumn;
+    },
+
+    get linesCount()
+    {
+        return this.endLine - this.startLine;
+    },
+
+    clone: function()
+    {
+        return new WebInspector.TextRange(this.startLine, this.startColumn, this.endLine, this.endColumn); 
+    }
+}
+
+WebInspector.TextEditorModel = function()
+{
+    this._lines = [""];
+    this._attributes = [];
+    this._undoStack = [];
+    this._noPunctuationRegex = /[^ !%&()*+,-.:;<=>?\[\]\^{|}~]+/;
+}
+
+WebInspector.TextEditorModel.prototype = {
+    set changeListener(changeListener)
+    {
+        this._changeListener = changeListener;
+    },
+
+    get linesCount()
+    {
+        return this._lines.length;
+    },
+
+    line: function(lineNumber)
+    {
+        if (lineNumber >= this._lines.length)
+            throw "Out of bounds:" + lineNumber;
+        return this._lines[lineNumber];
+    },
+
+    lineLength: function(lineNumber)
+    {
+        return this._lines[lineNumber].length;
+    },
+
+    setText: function(range, text)
+    {
+        if (!range)
+            range = new WebInspector.TextRange(0, 0, this._lines.length - 1, this._lines[this._lines.length - 1].length);
+        var command = this._pushUndoableCommand(range, text);
+        var newRange = this._innerSetText(range, text);
+        command.range = newRange.clone();
+
+        if (this._changeListener)
+            this._changeListener(range, newRange, command.text, text);
+        return newRange;
+    },
+
+    set replaceTabsWithSpaces(replaceTabsWithSpaces)
+    {
+        this._replaceTabsWithSpaces = replaceTabsWithSpaces;
+    },
+
+    _innerSetText: function(range, text)
+    {
+        this._eraseRange(range);
+        if (text === "")
+            return new WebInspector.TextRange(range.startLine, range.startColumn, range.startLine, range.startColumn);
+
+        var newLines = text.split("\n");
+        this._replaceTabsIfNeeded(newLines);
+
+        var prefix = this._lines[range.startLine].substring(0, range.startColumn);
+        var prefixArguments = this._arguments
+        var suffix = this._lines[range.startLine].substring(range.startColumn);
+
+        var postCaret = prefix.length;
+        // Insert text.
+        if (newLines.length === 1) {
+            this._setLine(range.startLine, prefix + newLines[0] + suffix);
+            postCaret += newLines[0].length;
+        } else {
+            this._setLine(range.startLine, prefix + newLines[0]);
+            for (var i = 1; i < newLines.length; ++i)
+                this._insertLine(range.startLine + i, newLines[i]);
+            this._setLine(range.startLine + newLines.length - 1, newLines[newLines.length - 1] + suffix);
+            postCaret = newLines[newLines.length - 1].length;
+        }
+        return new WebInspector.TextRange(range.startLine, range.startColumn,
+                                          range.startLine + newLines.length - 1, postCaret);
+    },
+
+    _replaceTabsIfNeeded: function(lines)
+    {
+        if (!this._replaceTabsWithSpaces)
+            return;
+        var spaces = [ "    ", "   ", "  ", " "];
+        for (var i = 0; i < lines.length; ++i) {
+            var line = lines[i];
+            var index = line.indexOf("\t");
+            while (index !== -1) {
+                line = line.substring(0, index) + spaces[index % 4] + line.substring(index + 1);
+                index = line.indexOf("\t", index + 1);
+            }
+            lines[i] = line;
+        }
+    },
+
+    _eraseRange: function(range)
+    {
+        if (range.isEmpty())
+            return;
+
+        var prefix = this._lines[range.startLine].substring(0, range.startColumn);
+        var suffix = this._lines[range.endLine].substring(range.endColumn);
+
+        if (range.endLine > range.startLine)
+            this._removeLines(range.startLine + 1, range.endLine - range.startLine);
+        this._setLine(range.startLine, prefix + suffix);
+    },
+
+    _setLine: function(lineNumber, text)
+    {
+        this._lines[lineNumber] = text;
+    },
+
+    _removeLines: function(fromLine, count)
+    {
+        this._lines.splice(fromLine, count);
+        this._attributes.splice(fromLine, count);
+    },
+
+    _insertLine: function(lineNumber, text)
+    {
+        this._lines.splice(lineNumber, 0, text);
+        this._attributes.splice(lineNumber, 0, {});
+    },
+
+    wordRange: function(lineNumber, column)
+    {
+        return new WebInspector.TextRange(lineNumber, this.wordStart(lineNumber, column, true), lineNumber, this.wordEnd(lineNumber, column, true));
+    },
+
+    wordStart: function(lineNumber, column, gapless)
+    {
+        var line = this._lines[lineNumber];
+        var prefix = line.substring(0, column).split("").reverse().join("");
+        var prefixMatch = this._noPunctuationRegex.exec(prefix);
+        return prefixMatch && (!gapless || prefixMatch.index === 0) ? column - prefixMatch.index - prefixMatch[0].length : column;
+    },
+
+    wordEnd: function(lineNumber, column, gapless)
+    {
+        var line = this._lines[lineNumber];
+        var suffix = line.substring(column);
+        var suffixMatch = this._noPunctuationRegex.exec(suffix);
+        return suffixMatch && (!gapless || suffixMatch.index === 0) ? column + suffixMatch.index + suffixMatch[0].length : column;
+    },
+
+    copyRange: function(range)
+    {
+        var clip = [];
+        if (range.startLine === range.endLine) {
+            clip.push(this._lines[range.startLine].substring(range.startColumn, range.endColumn));
+            return clip.join("\n");
+        }
+        clip.push(this._lines[range.startLine].substring(range.startColumn));
+        for (var i = range.startLine + 1; i < range.endLine; ++i)
+            clip.push(this._lines[i]);
+        clip.push(this._lines[range.endLine].substring(0, range.endColumn));
+        return clip.join("\n");
+    },
+
+    setAttribute: function(line, name, value)
+    {
+        var attrs = this._attributes[line];
+        if (!attrs) {
+            attrs = {};
+            this._attributes[line] = attrs;
+        }
+        attrs[name] = value;
+    },
+
+    getAttribute: function(line, name)
+    {
+        var attrs = this._attributes[line];
+        return attrs ? attrs[name] : null;
+    },
+
+    removeAttribute: function(line, name)
+    {
+        var attrs = this._attributes[line];
+        if (attrs)
+            delete attrs[name];
+    },
+
+    _pushUndoableCommand: function(range, text)
+    {
+        var command = {
+            text: this.copyRange(range),
+            startLine: range.startLine,
+            startColumn: range.startColumn,
+            endLine: range.startLine,
+            endColumn: range.startColumn
+        };
+        if (this._inUndo)
+            this._redoStack.push(command);
+        else {
+            if (!this._inRedo)
+                this._redoStack = [];
+            this._undoStack.push(command);
+        }
+        return command;
+    },
+
+    undo: function()
+    {
+        this._markRedoableState();
+
+        this._inUndo = true;
+        var range = this._doUndo(this._undoStack);
+        delete this._inUndo;
+
+        return range;
+    },
+
+    redo: function()
+    {
+        this.markUndoableState();
+
+        this._inRedo = true;
+        var range = this._doUndo(this._redoStack);
+        delete this._inRedo;
+
+        return range;
+    },
+
+    _doUndo: function(stack)
+    {
+        var range = null;
+        for (var i = stack.length - 1; i >= 0; --i) {
+            var command = stack[i];
+            stack.length = i;
+
+            range = this.setText(command.range, command.text);
+            if (i > 0 && stack[i - 1].explicit)
+                return range;
+        }
+        return range;
+    },
+
+    markUndoableState: function()
+    {
+        if (this._undoStack.length)
+            this._undoStack[this._undoStack.length - 1].explicit = true;
+    },
+
+    _markRedoableState: function()
+    {
+        if (this._redoStack.length)
+            this._redoStack[this._redoStack.length - 1].explicit = true;
+    },
+
+    resetUndoStack: function()
+    {
+        this._undoStack = [];
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
index f73ab0d512..8de365a4da 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
@@ -33,6 +33,7 @@ WebInspector.TextPrompt = function(element, completions, stopCharacters)
     this.completionStopCharacters = stopCharacters;
     this.history = [];
     this.historyOffset = 0;
+    this.element.addEventListener("keydown", this._onKeyDown.bind(this), true);
 }
 
 WebInspector.TextPrompt.prototype = {
@@ -53,8 +54,15 @@ WebInspector.TextPrompt.prototype = {
         this.moveCaretToEndOfPrompt();
     },
 
-    handleKeyEvent: function(event)
+    _onKeyDown: function(event)
     {
+        function defaultAction()
+        {
+            this.clearAutoComplete();
+            this.autoCompleteSoon();
+        }
+
+        var handled = false;
         switch (event.keyIdentifier) {
             case "Up":
                 this._upKeyPressed(event);
@@ -70,11 +78,36 @@ WebInspector.TextPrompt.prototype = {
                 if (!this.acceptAutoComplete())
                     this.autoCompleteSoon();
                 break;
+            case "Alt":
+            case "Meta":
+            case "Shift":
+            case "Control":
+                break;
+            case "U+0050": // Ctrl+P = Previous
+                if (WebInspector.isMac() && event.ctrlKey && !event.metaKey && !event.altKey && !event.shiftKey) {
+                    handled = true;
+                    this._moveBackInHistory();
+                    break;
+                }
+                defaultAction.call(this);
+                break;
+            case "U+004E": // Ctrl+N = Next
+                if (WebInspector.isMac() && event.ctrlKey && !event.metaKey && !event.altKey && !event.shiftKey) {
+                    handled = true;
+                    this._moveForwardInHistory();
+                    break;
+                }
+                defaultAction.call(this);
+                break;
             default:
-                this.clearAutoComplete();
-                this.autoCompleteSoon();
+                defaultAction.call(this);
                 break;
         }
+
+        if (handled) {
+            event.preventDefault();
+            event.stopPropagation();
+        }
     },
 
     acceptAutoComplete: function()
@@ -116,9 +149,10 @@ WebInspector.TextPrompt.prototype = {
             return;
 
         this._userEnteredRange.deleteContents();
+        this.element.pruneEmptyTextNodes();
 
         var userTextNode = document.createTextNode(this._userEnteredText);
-        this._userEnteredRange.insertNode(userTextNode);           
+        this._userEnteredRange.insertNode(userTextNode);
 
         var selectionRange = document.createRange();
         selectionRange.setStart(userTextNode, this._userEnteredText.length);
@@ -174,10 +208,9 @@ WebInspector.TextPrompt.prototype = {
             var currentText = fullWordRange.toString();
 
             var foundIndex = null;
-            for (var i = 0; i < completions.length; ++i) {
+            for (var i = 0; i < completions.length; ++i)
                 if (completions[i] === currentText)
                     foundIndex = i;
-            }
 
             if (foundIndex === null || (foundIndex + 1) >= completions.length)
                 var completionText = completions[0];
@@ -191,6 +224,7 @@ WebInspector.TextPrompt.prototype = {
         this._userEnteredText = fullWordRange.toString();
 
         fullWordRange.deleteContents();
+        this.element.pruneEmptyTextNodes();
 
         var finalSelectionRange = document.createRange();
 
@@ -199,7 +233,7 @@ WebInspector.TextPrompt.prototype = {
             var suffixText = completionText.substring(wordPrefixLength);
 
             var prefixTextNode = document.createTextNode(prefixText);
-            fullWordRange.insertNode(prefixTextNode);           
+            fullWordRange.insertNode(prefixTextNode);
 
             this.autoCompleteElement = document.createElement("span");
             this.autoCompleteElement.className = "auto-complete-text";
@@ -211,7 +245,7 @@ WebInspector.TextPrompt.prototype = {
             finalSelectionRange.setEnd(prefixTextNode, wordPrefixLength);
         } else {
             var completionTextNode = document.createTextNode(completionText);
-            fullWordRange.insertNode(completionTextNode);           
+            fullWordRange.insertNode(completionTextNode);
 
             if (completions.length > 1)
                 finalSelectionRange.setStart(completionTextNode, wordPrefixLength);
@@ -258,6 +292,50 @@ WebInspector.TextPrompt.prototype = {
         return true;
     },
 
+    isCaretOnFirstLine: function()
+    {
+        var selection = window.getSelection();
+        var focusNode = selection.focusNode;
+        if (!focusNode || focusNode.nodeType !== Node.TEXT_NODE || focusNode.parentNode !== this.element)
+            return true;
+
+        if (focusNode.textContent.substring(0, selection.focusOffset).indexOf("\n") !== -1)
+            return false;
+        focusNode = focusNode.previousSibling;
+
+        while (focusNode) {
+            if (focusNode.nodeType !== Node.TEXT_NODE)
+                return true;
+            if (focusNode.textContent.indexOf("\n") !== -1)
+                return false;
+            focusNode = focusNode.previousSibling;
+        }
+
+        return true;
+    },
+
+    isCaretOnLastLine: function()
+    {
+        var selection = window.getSelection();
+        var focusNode = selection.focusNode;
+        if (!focusNode || focusNode.nodeType !== Node.TEXT_NODE || focusNode.parentNode !== this.element)
+            return true;
+
+        if (focusNode.textContent.substring(selection.focusOffset).indexOf("\n") !== -1)
+            return false;
+        focusNode = focusNode.nextSibling;
+
+        while (focusNode) {
+            if (focusNode.nodeType !== Node.TEXT_NODE)
+                return true;
+            if (focusNode.textContent.indexOf("\n") !== -1)
+                return false;
+            focusNode = focusNode.nextSibling;
+        }
+
+        return true;
+    },
+
     moveCaretToEndOfPrompt: function()
     {
         var selection = window.getSelection();
@@ -281,39 +359,71 @@ WebInspector.TextPrompt.prototype = {
 
     _upKeyPressed: function(event)
     {
+        if (!this.isCaretOnFirstLine())
+            return;
+
+        event.preventDefault();
+        event.stopPropagation();
+
+        this._moveBackInHistory();
+    },
+
+    _downKeyPressed: function(event)
+    {
+        if (!this.isCaretOnLastLine())
+            return;
+
         event.preventDefault();
         event.stopPropagation();
 
+        this._moveForwardInHistory();
+    },
+
+    _moveBackInHistory: function()
+    {
         if (this.historyOffset == this.history.length)
             return;
 
         this.clearAutoComplete(true);
 
-        if (this.historyOffset == 0)
+        if (this.historyOffset === 0)
             this.tempSavedCommand = this.text;
 
         ++this.historyOffset;
         this.text = this.history[this.history.length - this.historyOffset];
+
+        this.element.scrollIntoViewIfNeeded();
+        var firstNewlineIndex = this.text.indexOf("\n");
+        if (firstNewlineIndex === -1)
+            this.moveCaretToEndOfPrompt();
+        else {
+            var selection = window.getSelection();
+            var selectionRange = document.createRange();
+
+            selectionRange.setStart(this.element.firstChild, firstNewlineIndex);
+            selectionRange.setEnd(this.element.firstChild, firstNewlineIndex);
+
+            selection.removeAllRanges();
+            selection.addRange(selectionRange);
+        }
     },
 
-    _downKeyPressed: function(event)
+    _moveForwardInHistory: function()
     {
-        event.preventDefault();
-        event.stopPropagation();
-
-        if (this.historyOffset == 0)
+        if (this.historyOffset === 0)
             return;
 
         this.clearAutoComplete(true);
 
         --this.historyOffset;
 
-        if (this.historyOffset == 0) {
+        if (this.historyOffset === 0) {
             this.text = this.tempSavedCommand;
             delete this.tempSavedCommand;
             return;
         }
 
         this.text = this.history[this.history.length - this.historyOffset];
+        this.element.scrollIntoViewIfNeeded();
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TextViewer.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TextViewer.js
new file mode 100644
index 0000000000..5072c245d9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TextViewer.js
@@ -0,0 +1,732 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TextViewer = function(textModel, platform, url)
+{
+    this._textModel = textModel;
+    this._textModel.changeListener = this._buildChunks.bind(this);
+    this._highlighter = new WebInspector.TextEditorHighlighter(this._textModel, this._highlightDataReady.bind(this));
+
+    this.element = document.createElement("div");
+    this.element.className = "text-editor monospace";
+    this.element.tabIndex = 0;
+
+    this.element.addEventListener("scroll", this._scroll.bind(this), false);
+    this.element.addEventListener("keydown", this._handleKeyDown.bind(this), false);
+
+    this._url = url;
+
+    this._linesContainerElement = document.createElement("table");
+    this._linesContainerElement.className = "text-editor-lines";
+    this._linesContainerElement.setAttribute("cellspacing", 0);
+    this._linesContainerElement.setAttribute("cellpadding", 0);
+    this.element.appendChild(this._linesContainerElement);
+
+    this._defaultChunkSize = 50;
+    this._paintCoalescingLevel = 0;
+
+    this.freeCachedElements();
+    this._buildChunks();
+}
+
+WebInspector.TextViewer.prototype = {
+    set mimeType(mimeType)
+    {
+        this._highlighter.mimeType = mimeType;
+    },
+
+    get textModel()
+    {
+        return this._textModel;
+    },
+
+    revealLine: function(lineNumber)
+    {
+        if (lineNumber >= this._textModel.linesCount)
+            return;
+
+        var chunk = this._makeLineAChunk(lineNumber);
+        chunk.element.scrollIntoViewIfNeeded();
+    },
+
+    addDecoration: function(lineNumber, decoration)
+    {
+        var chunk = this._makeLineAChunk(lineNumber);
+        chunk.addDecoration(decoration);
+    },
+
+    removeDecoration: function(lineNumber, decoration)
+    {
+        var chunk = this._makeLineAChunk(lineNumber);
+        chunk.removeDecoration(decoration);
+    },
+
+    markAndRevealRange: function(range)
+    {
+        if (this._rangeToMark) {
+            var markedLine = this._rangeToMark.startLine;
+            this._rangeToMark = null;
+            this._paintLines(markedLine, markedLine + 1);
+        }
+
+        if (range) {
+            this._rangeToMark = range;
+            this.revealLine(range.startLine);
+            this._paintLines(range.startLine, range.startLine + 1);
+            if (this._markedRangeElement)
+                this._markedRangeElement.scrollIntoViewIfNeeded();
+        }
+        delete this._markedRangeElement;
+    },
+
+    highlightLine: function(lineNumber)
+    {
+        if (typeof this._highlightedLine === "number") {
+            var chunk = this._makeLineAChunk(this._highlightedLine);
+            chunk.removeDecoration("webkit-highlighted-line");
+        }
+        this._highlightedLine = lineNumber;
+        this.revealLine(lineNumber);
+        var chunk = this._makeLineAChunk(lineNumber);
+        chunk.addDecoration("webkit-highlighted-line");
+    },
+
+    freeCachedElements: function()
+    {
+        this._cachedSpans = [];
+        this._cachedTextNodes = [];
+        this._cachedRows = [];
+    },
+
+    _buildChunks: function()
+    {
+        this._linesContainerElement.removeChildren();
+
+        this._textChunks = [];
+        for (var i = 0; i < this._textModel.linesCount; i += this._defaultChunkSize) {
+            var chunk = new WebInspector.TextChunk(this, i, i + this._defaultChunkSize);
+            this._textChunks.push(chunk);
+            this._linesContainerElement.appendChild(chunk.element);
+        }
+        this._indexChunks();
+        this._repaintAll();
+    },
+
+    _makeLineAChunk: function(lineNumber)
+    {
+        if (!this._textChunks)
+            this._buildChunks();
+
+        var chunkNumber = this._chunkNumberForLine(lineNumber);
+        var oldChunk = this._textChunks[chunkNumber];
+        if (oldChunk.linesCount === 1)
+            return oldChunk;
+
+        var wasExpanded = oldChunk.expanded;
+        oldChunk.expanded = false;
+
+        var insertIndex = oldChunk.chunkNumber + 1;
+
+        // Prefix chunk.
+        if (lineNumber > oldChunk.startLine) {
+            var prefixChunk = new WebInspector.TextChunk(this, oldChunk.startLine, lineNumber);
+            this._textChunks.splice(insertIndex++, 0, prefixChunk);
+            this._linesContainerElement.insertBefore(prefixChunk.element, oldChunk.element);
+        }
+
+        // Line chunk.
+        var lineChunk = new WebInspector.TextChunk(this, lineNumber, lineNumber + 1);
+        this._textChunks.splice(insertIndex++, 0, lineChunk);
+        this._linesContainerElement.insertBefore(lineChunk.element, oldChunk.element);
+
+        // Suffix chunk.
+        if (oldChunk.startLine + oldChunk.linesCount > lineNumber + 1) {
+            var suffixChunk = new WebInspector.TextChunk(this, lineNumber + 1, oldChunk.startLine + oldChunk.linesCount);
+            this._textChunks.splice(insertIndex, 0, suffixChunk);
+            this._linesContainerElement.insertBefore(suffixChunk.element, oldChunk.element);
+        }
+
+        // Remove enclosing chunk.
+        this._textChunks.splice(oldChunk.chunkNumber, 1);
+        this._linesContainerElement.removeChild(oldChunk.element);
+        this._indexChunks();
+
+        if (wasExpanded) {
+            if (prefixChunk)
+                prefixChunk.expanded = true;
+            lineChunk.expanded = true;
+            if (suffixChunk)
+                suffixChunk.expanded = true;
+        }
+
+        return lineChunk;
+    },
+
+    _indexChunks: function()
+    {
+        for (var i = 0; i < this._textChunks.length; ++i)
+            this._textChunks[i].chunkNumber = i;
+    },
+
+    _scroll: function()
+    {
+        var scrollTop = this.element.scrollTop;
+        setTimeout(function() {
+            if (scrollTop === this.element.scrollTop)
+                this._repaintAll();
+        }.bind(this), 50);
+    },
+    
+    _handleKeyDown: function()
+    {
+        if (event.metaKey || event.shiftKey || event.ctrlKey || event.altKey)
+            return;
+        
+        var scrollValue = 0;
+        if (event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Up)
+            scrollValue = -1;
+        else if (event.keyCode == WebInspector.KeyboardShortcut.KeyCodes.Down)
+            scrollValue = 1;
+        
+        if (scrollValue) {
+            event.preventDefault();
+            event.stopPropagation();
+            this.element.scrollByLines(scrollValue);
+            return;
+        }
+        
+        scrollValue = 0;
+        if (event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Left)
+            scrollValue = -40;
+        else if (event.keyCode == WebInspector.KeyboardShortcut.KeyCodes.Right)
+            scrollValue = 40;
+        
+        if (scrollValue) {
+            event.preventDefault();
+            event.stopPropagation();
+            this.element.scrollLeft += scrollValue;
+        }
+    },
+
+    beginUpdates: function(enabled)
+    {
+        this._paintCoalescingLevel++;
+    },
+
+    endUpdates: function(enabled)
+    {
+        this._paintCoalescingLevel--;
+        if (!this._paintCoalescingLevel)
+            this._repaintAll();
+    },
+
+    _chunkForOffset: function(offset)
+    {
+        var currentOffset = 0;
+        var row = this._linesContainerElement.firstChild;
+        while (row) {
+            var rowHeight = row.offsetHeight;
+            if (offset >= currentOffset && offset < currentOffset + rowHeight)
+                return row.chunkNumber;
+            row = row.nextSibling;
+            currentOffset += rowHeight;
+        }
+        return this._textChunks.length - 1;
+    },
+
+    _chunkNumberForLine: function(lineNumber)
+    {
+        for (var i = 0; i < this._textChunks.length; ++i) {
+            var line = this._textChunks[i].startLine;
+            if (lineNumber >= this._textChunks[i].startLine && lineNumber < this._textChunks[i].startLine + this._textChunks[i].linesCount)
+                return i;
+        }
+        return this._textChunks.length - 1;
+    },
+
+    _chunkForLine: function(lineNumber)
+    {
+        return this._textChunks[this._chunkNumberForLine(lineNumber)];
+    },
+
+    _chunkStartLine: function(chunkNumber)
+    {
+        var lineNumber = 0;
+        for (var i = 0; i < chunkNumber && i < this._textChunks.length; ++i)
+            lineNumber += this._textChunks[i].linesCount;
+        return lineNumber;
+    },
+
+    _repaintAll: function()
+    {
+        if (this._paintCoalescingLevel)
+            return;
+
+        if (!this._textChunks)
+            this._buildChunks();
+
+        var visibleFrom = this.element.scrollTop;
+        var visibleTo = this.element.scrollTop + this.element.clientHeight;
+
+        var offset = 0;
+        var firstVisibleLine = -1;
+        var lastVisibleLine = 0;
+        var toExpand = [];
+        var toCollapse = [];
+        for (var i = 0; i < this._textChunks.length; ++i) {
+            var chunk = this._textChunks[i];
+            var chunkHeight = chunk.height;
+            if (offset + chunkHeight > visibleFrom && offset < visibleTo) {
+                toExpand.push(chunk);
+                if (firstVisibleLine === -1)
+                    firstVisibleLine = chunk.startLine;
+                lastVisibleLine = chunk.startLine + chunk.linesCount;
+            } else {
+                toCollapse.push(chunk);
+                if (offset >= visibleTo)
+                    break;
+            }
+            offset += chunkHeight;
+        }
+
+        for (var j = i; j < this._textChunks.length; ++j)
+            toCollapse.push(this._textChunks[i]);
+
+        var selection = this._getSelection();
+
+        this._muteHighlightListener = true;
+        this._highlighter.highlight(lastVisibleLine);
+        delete this._muteHighlightListener;
+
+        for (var i = 0; i < toCollapse.length; ++i)
+            toCollapse[i].expanded = false;
+        for (var i = 0; i < toExpand.length; ++i)
+            toExpand[i].expanded = true;
+
+        this._restoreSelection(selection);
+    },
+
+    _highlightDataReady: function(fromLine, toLine)
+    {
+        if (this._muteHighlightListener)
+            return;
+
+        var selection;
+        for (var i = fromLine; i < toLine; ++i) {
+            var lineRow = this._textModel.getAttribute(i, "line-row");
+            if (!lineRow || lineRow.highlighted)
+                continue;
+            if (!selection)
+                selection = this._getSelection();
+            this._paintLine(lineRow, i);
+        }
+        this._restoreSelection(selection);
+    },
+
+    _paintLines: function(fromLine, toLine)
+    {
+        for (var i = fromLine; i < toLine; ++i) {
+            var lineRow = this._textModel.getAttribute(i, "line-row");
+            if (lineRow)
+                this._paintLine(lineRow, i);
+        }
+    },
+
+    _paintLine: function(lineRow, lineNumber)
+    {
+        var element = lineRow.lastChild;
+        var highlight = this._textModel.getAttribute(lineNumber, "highlight");
+        if (!highlight) {
+            if (this._rangeToMark && this._rangeToMark.startLine === lineNumber)
+                this._markedRangeElement = highlightSearchResult(element, this._rangeToMark.startColumn, this._rangeToMark.endColumn - this._rangeToMark.startColumn);
+            return;
+        }
+
+        element.removeChildren();
+        var line = this._textModel.line(lineNumber);
+
+        var plainTextStart = -1;
+        for (var j = 0; j < line.length;) {
+            if (j > 1000) {
+                // This line is too long - do not waste cycles on minified js highlighting.
+                if (plainTextStart === -1)
+                    plainTextStart = j;
+                break;
+            }
+            var attribute = highlight[j];
+            if (!attribute || !attribute.tokenType) {
+                if (plainTextStart === -1)
+                    plainTextStart = j;
+                j++;
+            } else {
+                if (plainTextStart !== -1) {
+                    this._appendTextNode(element, line.substring(plainTextStart, j));
+                    plainTextStart = -1;
+                }
+                this._appendSpan(element, line.substring(j, j + attribute.length), attribute.tokenType);
+                j += attribute.length;
+            }
+        }
+        if (plainTextStart !== -1)
+            this._appendTextNode(element, line.substring(plainTextStart, line.length));
+        if (this._rangeToMark && this._rangeToMark.startLine === lineNumber)
+            this._markedRangeElement = highlightSearchResult(element, this._rangeToMark.startColumn, this._rangeToMark.endColumn - this._rangeToMark.startColumn);
+        if (lineRow.decorationsElement)
+            element.appendChild(lineRow.decorationsElement);
+    },
+
+    _releaseLinesHighlight: function(fromLine, toLine)
+    {
+        for (var i = fromLine; i < toLine; ++i) {
+            var lineRow = this._textModel.getAttribute(i, "line-row");
+            if (!lineRow)
+                continue;
+            var element = lineRow.lastChild;
+            if ("spans" in element) {
+                var spans = element.spans;
+                for (var j = 0; j < spans.length; ++j)
+                    this._cachedSpans.push(spans[j]);
+                delete element.spans;
+            }
+            if ("textNodes" in element) {
+                var textNodes = element.textNodes;
+                for (var j = 0; j < textNodes.length; ++j)
+                    this._cachedTextNodes.push(textNodes[j]);
+                delete element.textNodes;
+            }
+        }
+    },
+
+    _getSelection: function()
+    {
+        var selection = window.getSelection();
+        if (selection.isCollapsed)
+            return null;
+        var selectionRange = selection.getRangeAt(0);
+        var start = this._selectionToPosition(selectionRange.startContainer, selectionRange.startOffset);
+        var end = this._selectionToPosition(selectionRange.endContainer, selectionRange.endOffset);
+        return new WebInspector.TextRange(start.line, start.column, end.line, end.column);
+    },
+
+    _restoreSelection: function(range)
+    {
+        if (!range)
+            return;
+        var startRow = this._textModel.getAttribute(range.startLine, "line-row");
+        if (startRow)
+            var start = startRow.lastChild.rangeBoundaryForOffset(range.startColumn);
+        else {
+            var offset = range.startColumn;
+            var chunkNumber = this._chunkNumberForLine(range.startLine);
+            for (var i = this._chunkStartLine(chunkNumber); i < range.startLine; ++i)
+                offset += this._textModel.line(i).length + 1; // \n
+            var lineCell = this._textChunks[chunkNumber].element.lastChild;
+            if (lineCell.firstChild)
+                var start = { container: lineCell.firstChild, offset: offset };
+            else
+                var start = { container: lineCell, offset: 0 };
+        }
+
+        var endRow = this._textModel.getAttribute(range.endLine, "line-row");
+        if (endRow)
+            var end = endRow.lastChild.rangeBoundaryForOffset(range.endColumn);
+        else {
+            var offset = range.endColumn;
+            var chunkNumber = this._chunkNumberForLine(range.endLine);
+            for (var i = this._chunkStartLine(chunkNumber); i < range.endLine; ++i)
+                offset += this._textModel.line(i).length + 1; // \n
+            var lineCell = this._textChunks[chunkNumber].element.lastChild;
+            if (lineCell.firstChild)
+                var end = { container: lineCell.firstChild, offset: offset };
+            else
+                var end = { container: lineCell, offset: 0 };
+        }
+
+        var selectionRange = document.createRange();
+        selectionRange.setStart(start.container, start.offset);
+        selectionRange.setEnd(end.container, end.offset);
+
+        var selection = window.getSelection();
+        selection.removeAllRanges();
+        selection.addRange(selectionRange);
+    },
+
+    _selectionToPosition: function(container, offset)
+    {
+        if (container === this.element && offset === 0)
+            return { line: 0, column: 0 };
+        if (container === this.element && offset === 1)
+            return { line: this._textModel.linesCount - 1, column: this._textModel.lineLength(this._textModel.linesCount - 1) };
+
+        var lineRow = container.enclosingNodeOrSelfWithNodeName("tr");
+        var lineNumber = lineRow.lineNumber;
+        if (container.nodeName === "TD" && offset === 0)
+            return { line: lineNumber, column: 0 };
+        if (container.nodeName === "TD" && offset === 1)
+            return { line: lineNumber, column: this._textModel.lineLength(lineNumber) };
+
+        var column = 0;
+        if (lineRow.chunk) {
+            // This is chunk.
+            var text = lineRow.lastChild.textContent;
+            for (var i = 0; i < offset; ++i) {
+                if (text.charAt(i) === "\n") {
+                    lineNumber++;
+                    column = 0;
+                } else
+                    column++; 
+            }
+            return { line: lineNumber, column: column };
+        }
+
+        // This is individul line.
+        var column = 0;
+        var node = lineRow.lastChild.traverseNextTextNode(lineRow.lastChild);
+        while (node && node !== container) {
+            column += node.textContent.length;
+            node = node.traverseNextTextNode(lineRow.lastChild);
+        }
+        column += offset;
+        return { line: lineRow.lineNumber, column: column };
+    },
+
+    _appendSpan: function(element, content, className)
+    {
+        if (className === "html-resource-link" || className === "html-external-link") {
+            element.appendChild(this._createLink(content, className === "html-external-link"));
+            return;
+        }
+
+        var span = this._cachedSpans.pop() || document.createElement("span");
+        span.className = "webkit-" + className;
+        span.textContent = content;
+        element.appendChild(span);
+        if (!("spans" in element))
+            element.spans = [];
+        element.spans.push(span);
+    },
+
+    _appendTextNode: function(element, text)
+    {
+        var textNode = this._cachedTextNodes.pop();
+        if (textNode) {
+            textNode.nodeValue = text;
+        } else
+            textNode = document.createTextNode(text);
+        element.appendChild(textNode);
+        if (!("textNodes" in element))
+            element.textNodes = [];
+        element.textNodes.push(textNode);
+    },
+
+    _createLink: function(content, isExternal)
+    {
+        var quote = content.charAt(0);
+        if (content.length > 1 && (quote === "\"" ||   quote === "'"))
+            content = content.substring(1, content.length - 1);
+        else
+            quote = null;
+
+        var a = WebInspector.linkifyURLAsNode(this._rewriteHref(content), content, null, isExternal);
+        var span = document.createElement("span");
+        span.className = "webkit-html-attribute-value";
+        if (quote)
+            span.appendChild(document.createTextNode(quote));
+        span.appendChild(a);
+        if (quote)
+            span.appendChild(document.createTextNode(quote));
+        return span;
+    },
+
+    _rewriteHref: function(hrefValue, isExternal)
+    {
+        if (!this._url || !hrefValue || hrefValue.indexOf("://") > 0)
+            return hrefValue;
+        return WebInspector.completeURL(this._url, hrefValue);
+    },
+
+    resize: function()
+    {
+        this._repaintAll();
+    }
+}
+
+var cachedSpans = [];
+
+WebInspector.TextChunk = function(textViewer, startLine, endLine)
+{
+    this._textViewer = textViewer;
+    this.element = document.createElement("tr");
+    this._textModel = textViewer._textModel;
+    this.element.chunk = this;
+    this.element.lineNumber = startLine;
+
+    this.startLine = startLine;
+    endLine = Math.min(this._textModel.linesCount, endLine);
+    this.linesCount = endLine - startLine;
+
+    this._lineNumberElement = document.createElement("td");
+    this._lineNumberElement.className = "webkit-line-number";
+    this.element.appendChild(this._lineNumberElement);
+
+    this._lineContentElement = document.createElement("td");
+    this._lineContentElement.className = "webkit-line-content";
+    this.element.appendChild(this._lineContentElement);
+
+    this._expanded = false;
+
+    var lineNumbers = [];
+    var lines = [];
+    for (var i = startLine; i < endLine; ++i) {
+        lineNumbers.push(i + 1);
+        lines.push(this._textModel.line(i));
+    }
+    if (this.linesCount === 1) {
+        // Single line chunks are typically created for decorations. Host line number in
+        // the sub-element in order to allow flexible border / margin management.
+        var innerSpan = document.createElement("span");
+        innerSpan.className = "webkit-line-number-inner";
+        innerSpan.textContent = startLine + 1;
+        var outerSpan = document.createElement("div");
+        outerSpan.className = "webkit-line-number-outer";
+        outerSpan.appendChild(innerSpan);
+        this._lineNumberElement.appendChild(outerSpan);
+    } else
+        this._lineNumberElement.textContent = lineNumbers.join("\n");
+    this._lineContentElement.textContent = lines.join("\n");
+}
+
+WebInspector.TextChunk.prototype = {
+    addDecoration: function(decoration)
+    {
+        if (typeof decoration === "string") {
+            this.element.addStyleClass(decoration);
+            return;
+        }
+        if (!this.element.decorationsElement) {
+            this.element.decorationsElement = document.createElement("div");
+            this._lineContentElement.appendChild(this.element.decorationsElement);
+        }
+        this.element.decorationsElement.appendChild(decoration);
+    },
+
+    removeDecoration: function(decoration)
+    {
+        if (typeof decoration === "string") {
+            this.element.removeStyleClass(decoration);
+            return;
+        }
+        if (!this.element.decorationsElement)
+            return;
+        this.element.decorationsElement.removeChild(decoration);
+    },
+
+    get expanded()
+    {
+        return this._expanded;
+    },
+
+    set expanded(expanded)
+    {
+        if (this._expanded === expanded)
+            return;
+
+        this._expanded = expanded;
+
+        if (this.linesCount === 1) {
+            this._textModel.setAttribute(this.startLine, "line-row", this.element);
+            if (expanded)
+                this._textViewer._paintLines(this.startLine, this.startLine + 1);
+            return;
+        }
+
+        if (expanded) {
+            var parentElement = this.element.parentElement;
+            for (var i = this.startLine; i < this.startLine + this.linesCount; ++i) {
+                var lineRow = this._createRow(i);
+                this._textModel.setAttribute(i, "line-row", lineRow);
+                parentElement.insertBefore(lineRow, this.element);
+            }
+            parentElement.removeChild(this.element);
+
+            this._textViewer._paintLines(this.startLine, this.startLine + this.linesCount);
+        } else {
+            var firstLine = this._textModel.getAttribute(this.startLine, "line-row");
+            var parentElement = firstLine.parentElement;
+            this._textViewer._releaseLinesHighlight(this.startLine, this.startLine + this.linesCount);
+
+            parentElement.insertBefore(this.element, firstLine);
+            for (var i = this.startLine; i < this.startLine + this.linesCount; ++i) {
+                var lineRow = this._textModel.getAttribute(i, "line-row");
+                this._textModel.removeAttribute(i, "line-row");
+                this._textViewer._cachedRows.push(lineRow);
+                parentElement.removeChild(lineRow);
+            }
+        }
+    },
+
+    get height()
+    {
+        if (!this._expanded)
+            return this.element.offsetHeight;
+        var result = 0;
+        for (var i = this.startLine; i < this.startLine + this.linesCount; ++i) {
+            var lineRow = this._textModel.getAttribute(i, "line-row");
+            result += lineRow.offsetHeight;
+        }
+        return result;
+    },
+
+    _createRow: function(lineNumber)
+    {
+        var cachedRows = this._textViewer._cachedRows;
+        if (cachedRows.length) {
+            var lineRow = cachedRows[cachedRows.length - 1];
+            cachedRows.length--;
+            var lineNumberElement = lineRow.firstChild;
+            var lineContentElement = lineRow.lastChild;
+        } else {
+            var lineRow = document.createElement("tr");
+
+            var lineNumberElement = document.createElement("td");
+            lineNumberElement.className = "webkit-line-number";
+            lineRow.appendChild(lineNumberElement);
+
+            var lineContentElement = document.createElement("td");
+            lineContentElement.className = "webkit-line-content";
+            lineRow.appendChild(lineContentElement);        
+        }
+        lineRow.lineNumber = lineNumber;
+        lineNumberElement.textContent = lineNumber + 1;
+        lineContentElement.textContent = this._textModel.line(lineNumber);
+        return lineRow;
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js
index cbbb7369a9..13f937f0b4 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js
@@ -34,17 +34,23 @@ WebInspector.TimelineAgent = function() {
 
 // Must be kept in sync with TimelineItem.h
 WebInspector.TimelineAgent.RecordType = {
-    DOMDispatch         : 0,
-    Layout              : 1,
-    RecalculateStyles   : 2,
-    Paint               : 3,
-    ParseHTML           : 4,
-    TimerInstall        : 5,
-    TimerRemove         : 6,
-    TimerFire           : 7,
+    EventDispatch : 0,
+    Layout : 1,
+    RecalculateStyles : 2,
+    Paint : 3,
+    ParseHTML : 4,
+    TimerInstall : 5,
+    TimerRemove : 6,
+    TimerFire : 7,
     XHRReadyStateChange : 8,
-    XHRLoad             : 9,
-    EvaluateScriptTag   : 10
+    XHRLoad : 9,
+    EvaluateScript : 10,
+    MarkTimeline : 11,
+    ResourceSendRequest : 12,
+    ResourceReceiveResponse : 13,
+    ResourceFinish : 14,
+    FunctionCall : 15,
+    ResourceReceiveData: 16
 };
 
 WebInspector.addRecordToTimeline = function(record) {
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineGrid.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineGrid.js
new file mode 100644
index 0000000000..12b889a9d8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineGrid.js
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Anthony Ricaud <rik@webkit.org>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TimelineGrid = function()
+{
+    this.element = document.createElement("div");
+
+    this._itemsGraphsElement = document.createElement("div");
+    this._itemsGraphsElement.id = "resources-graphs";
+    this.element.appendChild(this._itemsGraphsElement);
+
+    this._dividersElement = document.createElement("div");
+    this._dividersElement.id = "resources-dividers";
+    this.element.appendChild(this._dividersElement);
+
+    this._eventDividersElement = document.createElement("div");
+    this._eventDividersElement.id = "resources-event-dividers";
+    this.element.appendChild(this._eventDividersElement);
+
+    this._dividersLabelBarElement = document.createElement("div");
+    this._dividersLabelBarElement.id = "resources-dividers-label-bar";
+    this.element.appendChild(this._dividersLabelBarElement);
+}
+
+WebInspector.TimelineGrid.prototype = {
+    get itemsGraphsElement()
+    {
+        return this._itemsGraphsElement;
+    },
+
+    updateDividers: function(force, calculator, paddingLeft)
+    {
+        var dividerCount = Math.round(this._dividersElement.offsetWidth / 64);
+        var slice = calculator.boundarySpan / dividerCount;
+        if (!force && this._currentDividerSlice === slice)
+            return false;
+
+        if (typeof paddingLeft !== "number")
+            paddingLeft = 0;
+        this._currentDividerSlice = slice;
+
+        this._eventDividersElement.removeChildren();
+        // Reuse divider elements and labels.
+        var divider = this._dividersElement.firstChild;
+        var dividerLabelBar = this._dividersLabelBarElement.firstChild;
+
+        var dividersLabelBarElementClientWidth = this._dividersLabelBarElement.clientWidth;
+        var clientWidth = dividersLabelBarElementClientWidth - paddingLeft;
+        for (var i = paddingLeft ? 0 : 1; i <= dividerCount; ++i) {
+            if (!divider) {
+                divider = document.createElement("div");
+                divider.className = "resources-divider";
+                this._dividersElement.appendChild(divider);
+
+                dividerLabelBar = document.createElement("div");
+                dividerLabelBar.className = "resources-divider";
+                var label = document.createElement("div");
+                label.className = "resources-divider-label";
+                dividerLabelBar._labelElement = label;
+                dividerLabelBar.appendChild(label);
+                this._dividersLabelBarElement.appendChild(dividerLabelBar);
+                dividersLabelBarElementClientWidth = this._dividersLabelBarElement.clientWidth;
+            }
+
+            if (i === dividerCount)
+                divider.addStyleClass("last");
+            else
+                divider.removeStyleClass("last");
+
+            var left = paddingLeft + clientWidth * (i / dividerCount);
+            var percentLeft = 100 * left / dividersLabelBarElementClientWidth;
+            this._setDividerAndBarLeft(divider, dividerLabelBar, percentLeft);
+
+            if (!isNaN(slice))
+                dividerLabelBar._labelElement.textContent = calculator.formatValue(slice * i);
+            else
+                dividerLabelBar._labelElement.textContent = "";
+
+            divider = divider.nextSibling;
+            dividerLabelBar = dividerLabelBar.nextSibling;
+        }
+
+        // Remove extras.
+        while (divider) {
+            var nextDivider = divider.nextSibling;
+            this._dividersElement.removeChild(divider);
+            divider = nextDivider;
+        }
+        while (dividerLabelBar) {
+            var nextDivider = dividerLabelBar.nextSibling;
+            this._dividersLabelBarElement.removeChild(dividerLabelBar);
+            dividerLabelBar = nextDivider;
+        }
+        return true;
+    },
+
+    _setDividerAndBarLeft: function(divider, dividerLabelBar, percentLeft)
+    {
+        var percentStyleLeft = parseFloat(divider.style.left);
+        if (!isNaN(percentStyleLeft) && Math.abs(percentStyleLeft - percentLeft) < 0.1)
+            return;
+        divider.style.left = percentLeft + "%";
+        dividerLabelBar.style.left = percentLeft + "%";
+    },
+
+    addEventDivider: function(divider)
+    {
+        this._eventDividersElement.appendChild(divider);
+    },
+
+    setScrollAndDividerTop: function(scrollTop, dividersTop)
+    {
+        this._dividersElement.style.top = scrollTop + "px";
+        this._eventDividersElement.style.top = scrollTop + "px";
+        this._dividersLabelBarElement.style.top = dividersTop + "px";
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineOverviewPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineOverviewPane.js
new file mode 100644
index 0000000000..d2fe613584
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineOverviewPane.js
@@ -0,0 +1,391 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TimelineOverviewPane = function(categories)
+{
+    this.element = document.createElement("div");
+    this.element.id = "timeline-overview-panel";
+
+    this._categories = categories;
+    this._overviewSidebarElement = document.createElement("div");
+    this._overviewSidebarElement.id = "timeline-overview-sidebar";
+    this.element.appendChild(this._overviewSidebarElement);
+
+    var overviewTreeElement = document.createElement("ol");
+    overviewTreeElement.className = "sidebar-tree";
+    this._overviewSidebarElement.appendChild(overviewTreeElement);
+    var sidebarTree = new TreeOutline(overviewTreeElement);
+
+    var categoriesTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("TIMELINES"), {}, true);
+    categoriesTreeElement.expanded = true;
+    sidebarTree.appendChild(categoriesTreeElement);
+    for (var categoryName in this._categories) {
+        var category = this._categories[categoryName];
+        categoriesTreeElement.appendChild(new WebInspector.TimelineCategoryTreeElement(category, this._onCheckboxClicked.bind(this, category)));
+    }
+
+    this._overviewGrid = new WebInspector.TimelineGrid();
+    this._overviewGrid.element.id = "timeline-overview-grid";
+    this._overviewGrid.itemsGraphsElement.id = "timeline-overview-graphs";
+    this.element.appendChild(this._overviewGrid.element);
+
+    this._categoryGraphs = {};
+    var i = 0;
+    for (var category in this._categories) {
+        var categoryGraph = new WebInspector.TimelineCategoryGraph(this._categories[category], i++ % 2);
+        this._categoryGraphs[category] = categoryGraph;
+        this._overviewGrid.itemsGraphsElement.appendChild(categoryGraph.graphElement);
+    }
+    this._overviewGrid.setScrollAndDividerTop(0, 0);
+
+    this._overviewWindowElement = document.createElement("div");
+    this._overviewWindowElement.id = "timeline-overview-window";
+    this._overviewWindowElement.addEventListener("mousedown", this._dragWindow.bind(this), false);
+    this._overviewGrid.element.appendChild(this._overviewWindowElement);
+
+    this._leftResizeElement = document.createElement("div");
+    this._leftResizeElement.className = "timeline-window-resizer";
+    this._leftResizeElement.style.left = 0;
+    this._overviewGrid.element.appendChild(this._leftResizeElement);
+    this._leftResizeElement.addEventListener("mousedown", this._resizeWindow.bind(this, this._leftResizeElement), false);
+
+    this._rightResizeElement = document.createElement("div");
+    this._rightResizeElement.className = "timeline-window-resizer timeline-window-resizer-right";
+    this._rightResizeElement.style.right = 0;
+    this._overviewGrid.element.appendChild(this._rightResizeElement);
+    this._rightResizeElement.addEventListener("mousedown", this._resizeWindow.bind(this, this._rightResizeElement), false);
+
+    this._overviewCalculator = new WebInspector.TimelineOverviewCalculator();
+
+    var separatorElement = document.createElement("div");
+    separatorElement.id = "timeline-overview-separator";
+    this.element.appendChild(separatorElement);
+
+    this.windowLeft = 0.0;
+    this.windowRight = 1.0;
+}
+
+
+WebInspector.TimelineOverviewPane.prototype = {
+    _onCheckboxClicked: function (category, event) {
+        if (event.target.checked)
+            category.hidden = false;
+        else
+            category.hidden = true;
+        this._categoryGraphs[category.name].dimmed = !event.target.checked;
+        this.dispatchEventToListeners("filter changed");
+    },
+
+    update: function(records)
+    {
+        // Clear summary bars.
+        var timelines = {};
+        for (var category in this._categories) {
+            timelines[category] = [];
+            this._categoryGraphs[category].clearChunks();
+        }
+
+        function forAllRecords(recordsArray, callback)
+        {
+            if (!recordsArray)
+                return;
+            for (var i = 0; i < recordsArray.length; ++i) {
+                callback(recordsArray[i]);
+                forAllRecords(recordsArray[i].children, callback);
+            }
+        }
+
+        // Create sparse arrays with 101 cells each to fill with chunks for a given category.
+        this._overviewCalculator.reset();
+        forAllRecords(records, this._overviewCalculator.updateBoundaries.bind(this._overviewCalculator));
+
+        function markTimeline(record)
+        {
+            var percentages = this._overviewCalculator.computeBarGraphPercentages(record);
+
+            var end = Math.round(percentages.end);
+            var categoryName = record.category.name;
+            for (var j = Math.round(percentages.start); j <= end; ++j)
+                timelines[categoryName][j] = true;
+        }
+        forAllRecords(records, markTimeline.bind(this));
+
+        // Convert sparse arrays to continuous segments, render graphs for each.
+        for (var category in this._categories) {
+            var timeline = timelines[category];
+            window.timelineSaved = timeline;
+            var chunkStart = -1;
+            for (var j = 0; j < 101; ++j) {
+                if (timeline[j]) {
+                    if (chunkStart === -1)
+                        chunkStart = j;
+                } else {
+                    if (chunkStart !== -1) {
+                        this._categoryGraphs[category].addChunk(chunkStart, j);
+                        chunkStart = -1;
+                    }
+                }
+            }
+            if (chunkStart !== -1) {
+                this._categoryGraphs[category].addChunk(chunkStart, 100);
+                chunkStart = -1;
+            }
+        }
+        this._overviewGrid.updateDividers(true, this._overviewCalculator);
+    },
+
+    setSidebarWidth: function(width)
+    {
+        this._overviewSidebarElement.style.width = width + "px";
+    },
+
+    updateMainViewWidth: function(width)
+    {
+        this._overviewGrid.element.style.left = width + "px";
+    },
+
+    reset: function()
+    {
+        this.windowLeft = 0.0;
+        this.windowRight = 1.0;
+        this._overviewWindowElement.style.left = "0%";
+        this._overviewWindowElement.style.width = "100%";
+        this._leftResizeElement.style.left = "0%";
+        this._rightResizeElement.style.left = "100%";
+        this._overviewCalculator.reset();
+        this._overviewGrid.updateDividers(true, this._overviewCalculator);
+    },
+
+    _resizeWindow: function(resizeElement, event)
+    {
+        WebInspector.elementDragStart(resizeElement, this._windowResizeDragging.bind(this, resizeElement), this._endWindowDragging.bind(this), event, "col-resize");
+    },
+
+    _windowResizeDragging: function(resizeElement, event)
+    {
+        if (resizeElement === this._leftResizeElement)
+            this._resizeWindowLeft(event.pageX - this._overviewGrid.element.offsetLeft);
+        else
+            this._resizeWindowRight(event.pageX - this._overviewGrid.element.offsetLeft);
+        event.preventDefault();
+    },
+
+    _dragWindow: function(event)
+    {
+        WebInspector.elementDragStart(this._overviewWindowElement, this._windowDragging.bind(this, event.pageX,
+            this._leftResizeElement.offsetLeft, this._rightResizeElement.offsetLeft), this._endWindowDragging.bind(this), event, "ew-resize");
+    },
+
+    _windowDragging: function(startX, windowLeft, windowRight, event)
+    {
+        var delta = event.pageX - startX;
+        var start = windowLeft + delta;
+        var end = windowRight + delta;
+        var windowSize = windowRight - windowLeft;
+
+        if (start < 0) {
+            start = 0;
+            end = windowSize;
+        }
+
+        if (end > this._overviewGrid.element.clientWidth) {
+            end = this._overviewGrid.element.clientWidth;
+            start = end - windowSize;
+        }
+        this._setWindowPosition(start, end);
+
+        event.preventDefault();
+    },
+
+    _resizeWindowLeft: function(start)
+    {
+        // Glue to edge.
+        if (start < 10)
+            start = 0;
+        this._setWindowPosition(start, null);
+    },
+
+    _resizeWindowRight: function(end)
+    {
+        // Glue to edge.
+        if (end > this._overviewGrid.element.clientWidth - 10)
+            end = this._overviewGrid.element.clientWidth;
+        this._setWindowPosition(null, end);
+    },
+
+    _setWindowPosition: function(start, end)
+    {
+        if (typeof start === "number") {
+            if (start > this._rightResizeElement.offsetLeft - 4)
+                start = this._rightResizeElement.offsetLeft - 4;
+
+            this.windowLeft = start / this._overviewGrid.element.clientWidth;
+            this._leftResizeElement.style.left = this.windowLeft * 100 + "%";
+            this._overviewWindowElement.style.left = this.windowLeft * 100 + "%";
+        }
+        if (typeof end === "number") {
+            if (end < this._leftResizeElement.offsetLeft + 12)
+                end = this._leftResizeElement.offsetLeft + 12;
+
+            this.windowRight = end / this._overviewGrid.element.clientWidth;
+            this._rightResizeElement.style.left = this.windowRight * 100 + "%";
+        }
+        this._overviewWindowElement.style.width = (this.windowRight - this.windowLeft) * 100 + "%";
+        this.dispatchEventToListeners("window changed");
+    },
+
+    _endWindowDragging: function(event)
+    {
+        WebInspector.elementDragEnd(event);
+    }
+}
+
+WebInspector.TimelineOverviewPane.prototype.__proto__ = WebInspector.Object.prototype;
+
+
+WebInspector.TimelineOverviewCalculator = function()
+{
+    this._uiString = WebInspector.UIString.bind(WebInspector);
+}
+
+WebInspector.TimelineOverviewCalculator.prototype = {
+    computeBarGraphPercentages: function(record)
+    {
+        var start = (record.startTime - this.minimumBoundary) / this.boundarySpan * 100;
+        var end = (record.endTime - this.minimumBoundary) / this.boundarySpan * 100;
+        return {start: start, end: end};
+    },
+
+    reset: function()
+    {
+        delete this.minimumBoundary;
+        delete this.maximumBoundary;
+    },
+
+    updateBoundaries: function(record)
+    {
+        if (typeof this.minimumBoundary === "undefined" || record.startTime < this.minimumBoundary) {
+            this.minimumBoundary = record.startTime;
+            return true;
+        }
+        if (typeof this.maximumBoundary === "undefined" || record.endTime > this.maximumBoundary) {
+            this.maximumBoundary = record.endTime;
+            return true;
+        }
+        return false;
+    },
+
+    get boundarySpan()
+    {
+        return this.maximumBoundary - this.minimumBoundary;
+    },
+
+    formatValue: function(value)
+    {
+        return Number.secondsToString(value, this._uiString);
+    }
+}
+
+
+WebInspector.TimelineCategoryTreeElement = function(category, onCheckboxClicked)
+{
+    this._category = category;
+    this._onCheckboxClicked = onCheckboxClicked;
+    // Pass an empty title, the title gets made later in onattach.
+    TreeElement.call(this, "", null, false);
+}
+
+WebInspector.TimelineCategoryTreeElement.prototype = {
+    onattach: function()
+    {
+        this.listItemElement.removeChildren();
+        this.listItemElement.addStyleClass("timeline-category-tree-item");
+        this.listItemElement.addStyleClass("timeline-category-" + this._category.name);
+
+        var label = document.createElement("label");
+
+        var checkElement = document.createElement("input");
+        checkElement.type = "checkbox";
+        checkElement.className = "timeline-category-checkbox";
+        checkElement.checked = true;
+        checkElement.addEventListener("click", this._onCheckboxClicked);
+        label.appendChild(checkElement);
+
+        var typeElement = document.createElement("span");
+        typeElement.className = "type";
+        typeElement.textContent = this._category.title;
+        label.appendChild(typeElement);
+
+        this.listItemElement.appendChild(label);
+    }
+}
+
+WebInspector.TimelineCategoryTreeElement.prototype.__proto__ = TreeElement.prototype;
+
+WebInspector.TimelineCategoryGraph = function(category, isEven)
+{
+    this._category = category;
+
+    this._graphElement = document.createElement("div");
+    this._graphElement.className = "timeline-graph-side timeline-overview-graph-side" + (isEven ? " even" : "");
+
+    this._barAreaElement = document.createElement("div");
+    this._barAreaElement.className = "timeline-graph-bar-area timeline-category-" + category.name;
+    this._graphElement.appendChild(this._barAreaElement);
+}
+
+WebInspector.TimelineCategoryGraph.prototype = {
+    get graphElement()
+    {
+        return this._graphElement;
+    },
+
+    addChunk: function(start, end)
+    {
+        var chunk = document.createElement("div");
+        chunk.className = "timeline-graph-bar";
+        this._barAreaElement.appendChild(chunk);
+        chunk.style.setProperty("left", start + "%");
+        chunk.style.setProperty("width", (end - start) + "%");
+    },
+
+    clearChunks: function()
+    {
+        this._barAreaElement.removeChildren();
+    },
+
+    set dimmed(dimmed)
+    {
+        if (dimmed)
+            this._barAreaElement.removeStyleClass("timeline-category-" + this._category.name);
+        else
+            this._barAreaElement.addStyleClass("timeline-category-" + this._category.name);
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TimelinePanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelinePanel.js
index df63a0b8b6..2c1928de8b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TimelinePanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelinePanel.js
@@ -30,19 +30,63 @@
 
 WebInspector.TimelinePanel = function()
 {
-    WebInspector.AbstractTimelinePanel.call(this);
-
+    WebInspector.Panel.call(this);
     this.element.addStyleClass("timeline");
 
-    this.createInterface();
-    this.summaryBar.element.id = "timeline-summary";
-    this.itemsGraphsElement.id = "timeline-graphs";
+    this._overviewPane = new WebInspector.TimelineOverviewPane(this.categories);
+    this._overviewPane.addEventListener("window changed", this._windowChanged, this);
+    this._overviewPane.addEventListener("filter changed", this._refresh, this);
+    this.element.appendChild(this._overviewPane.element);
+    this.element.tabIndex = 0;
+
+    this._sidebarBackgroundElement = document.createElement("div");
+    this._sidebarBackgroundElement.className = "sidebar timeline-sidebar-background";
+    this.element.appendChild(this._sidebarBackgroundElement);
+
+    this._containerElement = document.createElement("div");
+    this._containerElement.id = "timeline-container";
+    this._containerElement.addEventListener("scroll", this._onScroll.bind(this), false);
+    this.element.appendChild(this._containerElement);
+
+    this.createSidebar(this._containerElement, this._containerElement);
+    var itemsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RECORDS"), {}, true);
+    itemsTreeElement.expanded = true;
+    this.sidebarTree.appendChild(itemsTreeElement);
+
+    this._sidebarListElement = document.createElement("div");
+    this.sidebarElement.appendChild(this._sidebarListElement);
+
+    this._containerContentElement = document.createElement("div");
+    this._containerContentElement.id = "resources-container-content";
+    this._containerElement.appendChild(this._containerContentElement);
+
+    this._timelineGrid = new WebInspector.TimelineGrid();
+    this._itemsGraphsElement = this._timelineGrid.itemsGraphsElement;
+    this._itemsGraphsElement.id = "timeline-graphs";
+    this._containerContentElement.appendChild(this._timelineGrid.element);
+
+    this._topGapElement = document.createElement("div");
+    this._topGapElement.className = "timeline-gap";
+    this._itemsGraphsElement.appendChild(this._topGapElement);
+
+    this._graphRowsElement = document.createElement("div");
+    this._itemsGraphsElement.appendChild(this._graphRowsElement);
+
+    this._bottomGapElement = document.createElement("div");
+    this._bottomGapElement.className = "timeline-gap";
+    this._itemsGraphsElement.appendChild(this._bottomGapElement);
 
     this._createStatusbarButtons();
 
-    this.calculator = new WebInspector.TimelineCalculator();
+    this._rootRecord = this._createRootRecord();
+    this._sendRequestRecords = {};
+    this._timerRecords = {};
+
+    this._calculator = new WebInspector.TimelineCalculator();
+    this._boundariesAreValid = true;
+    this._scrollTop = 0;
 
-    this.filter(this.filterAllElement, false);
+    this._popoverHelper = new WebInspector.PopoverHelper(this._containerElement, this._getPopoverAnchor.bind(this), this._showPopover.bind(this), true);
 }
 
 WebInspector.TimelinePanel.prototype = {
@@ -64,18 +108,42 @@ WebInspector.TimelinePanel.prototype = {
             this._categories = {
                 loading: new WebInspector.TimelineCategory("loading", WebInspector.UIString("Loading"), "rgb(47,102,236)"),
                 scripting: new WebInspector.TimelineCategory("scripting", WebInspector.UIString("Scripting"), "rgb(157,231,119)"),
-                rendering: new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)"),
-                other: new WebInspector.TimelineCategory("other", WebInspector.UIString("Other"), "rgb(186,186,186)")
+                rendering: new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)")
             };
         }
         return this._categories;
     },
 
-    populateSidebar: function()
+    get defaultFocusedElement()
     {
-        this.itemsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RECORDS"), {}, true);
-        this.itemsTreeElement.expanded = true;
-        this.sidebarTree.appendChild(this.itemsTreeElement);
+        return this.element;
+    },
+
+    get _recordStyles()
+    {
+        if (!this._recordStylesArray) {
+            var recordTypes = WebInspector.TimelineAgent.RecordType;
+            var recordStyles = {};
+            recordStyles[recordTypes.EventDispatch] = { title: WebInspector.UIString("Event"), category: this.categories.scripting };
+            recordStyles[recordTypes.Layout] = { title: WebInspector.UIString("Layout"), category: this.categories.rendering };
+            recordStyles[recordTypes.RecalculateStyles] = { title: WebInspector.UIString("Recalculate Style"), category: this.categories.rendering };
+            recordStyles[recordTypes.Paint] = { title: WebInspector.UIString("Paint"), category: this.categories.rendering };
+            recordStyles[recordTypes.ParseHTML] = { title: WebInspector.UIString("Parse"), category: this.categories.loading };
+            recordStyles[recordTypes.TimerInstall] = { title: WebInspector.UIString("Install Timer"), category: this.categories.scripting };
+            recordStyles[recordTypes.TimerRemove] = { title: WebInspector.UIString("Remove Timer"), category: this.categories.scripting };
+            recordStyles[recordTypes.TimerFire] = { title: WebInspector.UIString("Timer Fired"), category: this.categories.scripting };
+            recordStyles[recordTypes.XHRReadyStateChange] = { title: WebInspector.UIString("XHR Ready State Change"), category: this.categories.scripting };
+            recordStyles[recordTypes.XHRLoad] = { title: WebInspector.UIString("XHR Load"), category: this.categories.scripting };
+            recordStyles[recordTypes.EvaluateScript] = { title: WebInspector.UIString("Evaluate Script"), category: this.categories.scripting };
+            recordStyles[recordTypes.MarkTimeline] = { title: WebInspector.UIString("Mark"), category: this.categories.scripting };
+            recordStyles[recordTypes.ResourceSendRequest] = { title: WebInspector.UIString("Send Request"), category: this.categories.loading };
+            recordStyles[recordTypes.ResourceReceiveResponse] = { title: WebInspector.UIString("Receive Response"), category: this.categories.loading };
+            recordStyles[recordTypes.ResourceFinish] = { title: WebInspector.UIString("Finish Loading"), category: this.categories.loading };
+            recordStyles[recordTypes.FunctionCall] = { title: WebInspector.UIString("Function Call"), category: this.categories.scripting };
+            recordStyles[recordTypes.ResourceReceiveData] = { title: WebInspector.UIString("Receive Data"), category: this.categories.loading };
+            this._recordStylesArray = recordStyles;
+        }
+        return this._recordStylesArray;
     },
 
     _createStatusbarButtons: function()
@@ -84,7 +152,17 @@ WebInspector.TimelinePanel.prototype = {
         this.toggleTimelineButton.addEventListener("click", this._toggleTimelineButtonClicked.bind(this), false);
 
         this.clearButton = new WebInspector.StatusBarButton("", "timeline-clear-status-bar-item");
-        this.clearButton.addEventListener("click", this.reset.bind(this), false);
+        this.clearButton.addEventListener("click", this._clearPanel.bind(this), false);
+    },
+
+    _toggleTimelineButtonClicked: function()
+    {
+        if (this.toggleTimelineButton.toggled)
+            InspectorBackend.stopTimelineProfiler();
+        else {
+            this._clearPanel();
+            InspectorBackend.startTimelineProfiler();
+        }
     },
 
     timelineWasStarted: function()
@@ -99,264 +177,683 @@ WebInspector.TimelinePanel.prototype = {
 
     addRecordToTimeline: function(record)
     {
-        var formattedRecord = this._formatRecord(record);
+        if (record.type == WebInspector.TimelineAgent.RecordType.ResourceSendRequest && record.data.isMainResource) {
+            if (this._mainResourceIdentifier != record.data.identifier) {
+                // We are loading new main resource -> clear the panel. Check above is necessary since
+                // there may be several resource loads with main resource marker upon redirects, redirects are reported with
+                // the original identifier.
+                this._mainResourceIdentifier = record.data.identifier;
+                this._clearPanel();
+            }
+        }
+        this._innerAddRecordToTimeline(record, this._rootRecord);
+        this._scheduleRefresh();
+    },
+
+    _findParentRecord: function(record)
+    {
+        var recordTypes = WebInspector.TimelineAgent.RecordType;
+        var parentRecord;
+        if (record.type === recordTypes.ResourceReceiveResponse ||
+            record.type === recordTypes.ResourceFinish ||
+            record.type === recordTypes.ResourceReceiveData)
+            parentRecord = this._sendRequestRecords[record.data.identifier];
+        else if (record.type === recordTypes.TimerFire)
+            parentRecord = this._timerRecords[record.data.timerId];
+        return parentRecord;
+    },
+
+    _innerAddRecordToTimeline: function(record, parentRecord)
+    {
+        var connectedToOldRecord = false;
+        if (parentRecord === this._rootRecord) {
+            var newParentRecord = this._findParentRecord(record);
+            if (newParentRecord) {
+                parentRecord = newParentRecord;
+                connectedToOldRecord = true;
+            }
+        }
+
+        var formattedRecord = new WebInspector.TimelinePanel.FormattedRecord(record, parentRecord, this._recordStyles, this._sendRequestRecords, this._timerRecords);
+        if (parentRecord === this._rootRecord)
+            formattedRecord.collapsed = true;
+
         // Glue subsequent records with same category and title together if they are closer than 100ms to each other.
-        if (this._lastRecord && (!record.children || !record.children.length) &&
-                this._lastRecord.category == formattedRecord.category &&
-                this._lastRecord.title == formattedRecord.title &&
-                this._lastRecord.details == formattedRecord.details &&
-                formattedRecord.startTime - this._lastRecord.endTime < 0.1) {
-            this._lastRecord.endTime = formattedRecord.endTime;
-            this._lastRecord.count++;
-            this.refreshItem(this._lastRecord);
+        var lastRecord = parentRecord._lastRecord;
+        if (lastRecord && (!record.children || !record.children.length) &&
+                lastRecord.category == formattedRecord.category &&
+                lastRecord.title == formattedRecord.title &&
+                lastRecord.details == formattedRecord.details &&
+                lastRecord.callerScriptName == formattedRecord.callerScriptName &&
+                lastRecord.callerScriptLine == formattedRecord.callerScriptLine &&
+                formattedRecord.startTime - lastRecord.endTime < 0.1) {
+            lastRecord.endTime = formattedRecord.endTime;
+            lastRecord.count++;
         } else {
-            this.addItem(formattedRecord);
-
             for (var i = 0; record.children && i < record.children.length; ++i)
-                this.addRecordToTimeline(record.children[i]);
-            this._lastRecord = record.children && record.children.length ? null : formattedRecord;
+                this._innerAddRecordToTimeline(record.children[i], formattedRecord);
+            parentRecord._lastRecord = record.children && record.children.length ? null : formattedRecord;
+        }
+
+        if (connectedToOldRecord) {
+            var record = formattedRecord;
+            while (record.parent && record.parent._lastChildEndTime < record._lastChildEndTime) {
+                record.parent._lastChildEndTime = record._lastChildEndTime;
+                record = record.parent;
+            }
         }
     },
 
-    createItemTreeElement: function(item)
+    setSidebarWidth: function(width)
     {
-        return new WebInspector.TimelineRecordTreeElement(item);
+        WebInspector.Panel.prototype.setSidebarWidth.call(this, width);
+        this._sidebarBackgroundElement.style.width = width + "px";
+        this._overviewPane.setSidebarWidth(width);
     },
 
-    createItemGraph: function(item)
+    updateMainViewWidth: function(width)
     {
-        return new WebInspector.TimelineGraph(item);
+        this._containerContentElement.style.left = width + "px";
+        this._scheduleRefresh();
+        this._overviewPane.updateMainViewWidth(width);
     },
 
-    _toggleTimelineButtonClicked: function()
+    resize: function()
     {
-        if (InspectorController.timelineProfilerEnabled())
-            InspectorController.stopTimelineProfiler();
-        else
-            InspectorController.startTimelineProfiler();
+        this._closeRecordDetails();
+        this._scheduleRefresh();
     },
 
-    _formatRecord: function(record)
+    _createRootRecord: function()
     {
-        if (!this._recordStyles) {
-            this._recordStyles = {};
-            var recordTypes = WebInspector.TimelineAgent.RecordType;
-            this._recordStyles[recordTypes.DOMDispatch] = { title: WebInspector.UIString("DOM Event"), category: this.categories.scripting };
-            this._recordStyles[recordTypes.Layout] = { title: WebInspector.UIString("Layout"), category: this.categories.rendering };
-            this._recordStyles[recordTypes.RecalculateStyles] = { title: WebInspector.UIString("Recalculate Style"), category: this.categories.rendering };
-            this._recordStyles[recordTypes.Paint] = { title: WebInspector.UIString("Paint"), category: this.categories.rendering };
-            this._recordStyles[recordTypes.ParseHTML] = { title: WebInspector.UIString("Parse"), category: this.categories.loading };
-            this._recordStyles[recordTypes.TimerInstall] = { title: WebInspector.UIString("Install Timer"), category: this.categories.scripting };
-            this._recordStyles[recordTypes.TimerRemove] = { title: WebInspector.UIString("Remove Timer"), category: this.categories.scripting };
-            this._recordStyles[recordTypes.TimerFire] = { title: WebInspector.UIString("Timer Fired"), category: this.categories.scripting };
-            this._recordStyles[recordTypes.XHRReadyStateChange] = { title: WebInspector.UIString("XHR Ready State Change"), category: this.categories.scripting };
-            this._recordStyles[recordTypes.XHRLoad] = { title: WebInspector.UIString("XHR Load"), category: this.categories.scripting };
-            this._recordStyles[recordTypes.EvaluateScriptTag] = { title: WebInspector.UIString("Evaluate Script"), category: this.categories.scripting };
-            this._recordStyles["Other"] = { title: WebInspector.UIString("Other"), icon: 0, category: this.categories.other };
-        }
+        var rootRecord = {};
+        rootRecord.children = [];
+        rootRecord._lastRecord = null;
+        return rootRecord;
+    },
 
-        var style = this._recordStyles[record.type];
-        if (!style)
-            style = this._recordStyles["Other"];
+    _clearPanel: function()
+    {
+        this._sendRequestRecords = {};
+        this._timerRecords = {};
+        this._rootRecord = this._createRootRecord();
+        this._boundariesAreValid = false;
+        this._overviewPane.reset();
+        this._adjustScrollPosition(0);
+        this._refresh();
+        this._closeRecordDetails();
+    },
 
-        var formattedRecord = {};
-        formattedRecord.category = style.category;
-        formattedRecord.title = style.title;
-        formattedRecord.startTime = record.startTime / 1000;
-        formattedRecord.data = record.data;
-        formattedRecord.count = 1;
-        formattedRecord.type = record.type;
-        formattedRecord.details = this._getRecordDetails(record);
-        formattedRecord.endTime = (typeof record.endTime !== "undefined") ? record.endTime / 1000 : formattedRecord.startTime;
-        return formattedRecord;
+    show: function()
+    {
+        WebInspector.Panel.prototype.show.call(this);
+        if (typeof this._scrollTop === "number")
+            this._containerElement.scrollTop = this._scrollTop;
+        else if (this._needsRefresh)
+            this._refresh();
     },
-    
-    _getRecordDetails: function(record)
+
+    hide: function()
     {
-        switch (record.type) {
-        case WebInspector.TimelineAgent.RecordType.DOMDispatch:
-            return record.data.type;
-        case WebInspector.TimelineAgent.RecordType.TimerInstall:
-        case WebInspector.TimelineAgent.RecordType.TimerRemove:
-        case WebInspector.TimelineAgent.RecordType.TimerFire:
-            return record.data.timerId;
-        case WebInspector.TimelineAgent.RecordType.XHRReadyStateChange:
-        case WebInspector.TimelineAgent.RecordType.XHRLoad:
-        case WebInspector.TimelineAgent.RecordType.EvaluateScriptTag:
-            return record.data.url;
-        default:
-            return "";
+        WebInspector.Panel.prototype.hide.call(this);
+        this._closeRecordDetails();
+    },
+
+    _onScroll: function(event)
+    {
+        this._closeRecordDetails();
+        var scrollTop = this._containerElement.scrollTop;
+        var dividersTop = Math.max(0, scrollTop);
+        this._timelineGrid.setScrollAndDividerTop(scrollTop, dividersTop);
+        this._scheduleRefresh(true);
+    },
+
+    _windowChanged: function()
+    {
+        this._closeRecordDetails();
+        this._scheduleRefresh();
+    },
+
+    _scheduleRefresh: function(preserveBoundaries)
+    {
+        if (preserveBoundaries)
+            this._closeRecordDetails();
+        this._boundariesAreValid &= preserveBoundaries;
+        if (this._needsRefresh)
+            return;
+        this._needsRefresh = true;
+
+        if (this.visible && !("_refreshTimeout" in this)) {
+            if (preserveBoundaries)
+                this._refresh();
+            else
+                this._refreshTimeout = setTimeout(this._refresh.bind(this), 100);
         }
     },
 
-    reset: function()
+    _refresh: function()
     {
-        WebInspector.AbstractTimelinePanel.prototype.reset.call(this);
-        this._lastRecord = null;
-    }
-}
+        this._needsRefresh = false;
+        if ("_refreshTimeout" in this) {
+            clearTimeout(this._refreshTimeout);
+            delete this._refreshTimeout;
+        }
 
-WebInspector.TimelinePanel.prototype.__proto__ = WebInspector.AbstractTimelinePanel.prototype;
+        if (!this._boundariesAreValid)
+            this._overviewPane.update(this._rootRecord.children);
+        this._refreshRecords(!this._boundariesAreValid);
+        this._boundariesAreValid = true;
+    },
 
+    _refreshRecords: function(updateBoundaries)
+    {
+        if (updateBoundaries) {
+            this._calculator.reset();
+            this._calculator.windowLeft = this._overviewPane.windowLeft;
+            this._calculator.windowRight = this._overviewPane.windowRight;
 
-WebInspector.TimelineCategory = function(name, title, color)
-{
-    WebInspector.AbstractTimelineCategory.call(this, name, title, color);
-}
+            for (var i = 0; i < this._rootRecord.children.length; ++i)
+                this._calculator.updateBoundaries(this._rootRecord.children[i]);
 
-WebInspector.TimelineCategory.prototype = {
-}
+            this._calculator.calculateWindow();
+        }
 
-WebInspector.TimelineCategory.prototype.__proto__ = WebInspector.AbstractTimelineCategory.prototype;
+        var recordsInWindow = [];
+        for (var i = 0; i < this._rootRecord.children.length; ++i) {
+            var record = this._rootRecord.children[i];
+            var percentages = this._calculator.computeBarGraphPercentages(record);
+            if (percentages.start < 100 && percentages.endWithChildren >= 0 && !record.category.hidden)
+                this._addToRecordsWindow(record, recordsInWindow);
+        }
 
+        // Calculate the visible area.
+        this._scrollTop = this._containerElement.scrollTop;
+        var visibleTop = this._scrollTop;
+        var visibleBottom = visibleTop + this._containerElement.clientHeight;
+
+        // Define row height, should be in sync with styles for timeline graphs.
+        const rowHeight = 18;
+        const expandOffset = 15;
+
+        // Convert visible area to visible indexes. Always include top-level record for a visible nested record.
+        var startIndex = Math.max(0, Math.min(Math.floor(visibleTop / rowHeight) - 1, recordsInWindow.length - 1));
+        while (startIndex > 0 && recordsInWindow[startIndex].parent)
+            startIndex--;
+        var endIndex = Math.min(recordsInWindow.length, Math.ceil(visibleBottom / rowHeight));
+        while (endIndex < recordsInWindow.length - 1 && recordsInWindow[endIndex].parent)
+            endIndex++;
+
+        // Resize gaps first.
+        const top = (startIndex * rowHeight) + "px";
+        this._topGapElement.style.height = top;
+        this.sidebarElement.style.top = top;
+        this.sidebarResizeElement.style.top = top;
+        this._bottomGapElement.style.height = (recordsInWindow.length - endIndex) * rowHeight + "px";
+
+        // Update visible rows.
+        var listRowElement = this._sidebarListElement.firstChild;
+        var width = this._graphRowsElement.offsetWidth;
+        this._itemsGraphsElement.removeChild(this._graphRowsElement);
+        var graphRowElement = this._graphRowsElement.firstChild;
+        var scheduleRefreshCallback = this._scheduleRefresh.bind(this, true);
+
+        for (var i = startIndex; i < endIndex; ++i) {
+            var record = recordsInWindow[i];
+            var isEven = !(i % 2);
+
+            if (!listRowElement) {
+                listRowElement = new WebInspector.TimelineRecordListRow().element;
+                this._sidebarListElement.appendChild(listRowElement);
+            }
+            if (!graphRowElement) {
+                graphRowElement = new WebInspector.TimelineRecordGraphRow(this._itemsGraphsElement, scheduleRefreshCallback, rowHeight).element;
+                this._graphRowsElement.appendChild(graphRowElement);
+            }
+
+            listRowElement.row.update(record, isEven, this._calculator, visibleTop);
+            graphRowElement.row.update(record, isEven, this._calculator, width, expandOffset, i);
+
+            listRowElement = listRowElement.nextSibling;
+            graphRowElement = graphRowElement.nextSibling;
+        }
 
-WebInspector.TimelineRecordTreeElement = function(record)
-{
-    this._record = record;
+        // Remove extra rows.
+        while (listRowElement) {
+            var nextElement = listRowElement.nextSibling;
+            listRowElement.row.dispose();
+            listRowElement = nextElement;
+        }
+        while (graphRowElement) {
+            var nextElement = graphRowElement.nextSibling;
+            graphRowElement.row.dispose();
+            graphRowElement = nextElement;
+        }
 
-    // Pass an empty title, the title gets made later in onattach.
-    TreeElement.call(this, "", null, false);
-}
+        this._itemsGraphsElement.insertBefore(this._graphRowsElement, this._bottomGapElement);
+        this.sidebarResizeElement.style.height = this.sidebarElement.clientHeight + "px";
+        // Reserve some room for expand / collapse controls to the left for records that start at 0ms.
+        var timelinePaddingLeft = this._calculator.windowLeft === 0 ? expandOffset : 0;
+        if (updateBoundaries)
+            this._timelineGrid.updateDividers(true, this._calculator, timelinePaddingLeft);
+        this._adjustScrollPosition((recordsInWindow.length + 1) * rowHeight);
+    },
 
-WebInspector.TimelineRecordTreeElement.prototype = {
-    onattach: function()
-    {
-        this.listItemElement.removeChildren();
-        this.listItemElement.addStyleClass("timeline-tree-item");
-        this.listItemElement.addStyleClass("timeline-category-" + this._record.category.name);
-
-        var iconElement = document.createElement("span");
-        iconElement.className = "timeline-tree-icon";
-        this.listItemElement.appendChild(iconElement);
-
-        this.typeElement = document.createElement("span");
-        this.typeElement.className = "type";
-        this.typeElement.textContent = this._record.title;
-        this.listItemElement.appendChild(this.typeElement);
-
-        if (this._record.details) {
-            var separatorElement = document.createElement("span");
-            separatorElement.className = "separator";
-            separatorElement.textContent = " ";
-
-            var dataElement = document.createElement("span");
-            dataElement.className = "data";
-            dataElement.textContent = "(" + this._record.details + ")";
-            dataElement.addStyleClass("dimmed");
-            this.listItemElement.appendChild(separatorElement);
-            this.listItemElement.appendChild(dataElement);
+    _addToRecordsWindow: function(record, recordsWindow)
+    {
+        recordsWindow.push(record);
+        if (!record.collapsed) {
+            var index = recordsWindow.length;
+            for (var i = 0; i < record.children.length; ++i)
+                this._addToRecordsWindow(record.children[i], recordsWindow);
+            record.visibleChildrenCount = recordsWindow.length - index;
         }
     },
 
-    refresh: function()
+    _adjustScrollPosition: function(totalHeight)
+    {
+        // Prevent the container from being scrolled off the end.
+        if ((this._containerElement.scrollTop + this._containerElement.offsetHeight) > totalHeight + 1)
+            this._containerElement.scrollTop = (totalHeight - this._containerElement.offsetHeight);
+    },
+
+    _getPopoverAnchor: function(element)
+    {
+        return element.enclosingNodeOrSelfWithClass("timeline-graph-bar") || element.enclosingNodeOrSelfWithClass("timeline-tree-item");
+    },
+
+    _showPopover: function(anchor)
+    {
+        var record = anchor.row._record;
+        var popover = new WebInspector.Popover(record._generatePopupContent(this._calculator));
+        popover.show(anchor);
+        return popover;
+    },
+
+    _closeRecordDetails: function()
     {
-        if (this._record.count > 1)
-            this.typeElement.textContent = this._record.title + " x " + this._record.count;
+        this._popoverHelper.hidePopup();
     }
 }
 
-WebInspector.TimelineRecordTreeElement.prototype.__proto__ = TreeElement.prototype;
+WebInspector.TimelinePanel.prototype.__proto__ = WebInspector.Panel.prototype;
 
+WebInspector.TimelineCategory = function(name, title, color)
+{
+    this.name = name;
+    this.title = title;
+    this.color = color;
+}
 
 WebInspector.TimelineCalculator = function()
 {
-    WebInspector.AbstractTimelineCalculator.call(this);
+    this.reset();
+    this.windowLeft = 0.0;
+    this.windowRight = 1.0;
+    this._uiString = WebInspector.UIString.bind(WebInspector);
 }
 
 WebInspector.TimelineCalculator.prototype = {
     computeBarGraphPercentages: function(record)
     {
-        var start = ((record.startTime - this.minimumBoundary) / this.boundarySpan) * 100;
-        var end = ((record.endTime - this.minimumBoundary) / this.boundarySpan) * 100;
-        return {start: start, end: end};
+        var start = (record.startTime - this.minimumBoundary) / this.boundarySpan * 100;
+        var end = (record.endTime - this.minimumBoundary) / this.boundarySpan * 100;
+        var endWithChildren = (record._lastChildEndTime - this.minimumBoundary) / this.boundarySpan * 100;
+        return {start: start, end: end, endWithChildren: endWithChildren};
     },
 
-    computePercentageFromEventTime: function(eventTime)
+    computeBarGraphWindowPosition: function(record, clientWidth, expandOffset)
     {
-        return ((eventTime - this.minimumBoundary) / this.boundarySpan) * 100;
+        const minWidth = 5;
+        const borderWidth = 4;
+        var workingArea = clientWidth - expandOffset - minWidth - borderWidth;
+        var percentages = this.computeBarGraphPercentages(record);
+        var left = percentages.start / 100 * workingArea;
+        var width = (percentages.end - percentages.start) / 100 * workingArea + minWidth;
+        var widthWithChildren =  (percentages.endWithChildren - percentages.start) / 100 * workingArea;
+        if (percentages.endWithChildren > percentages.end)
+            widthWithChildren += borderWidth + minWidth;
+        return {left: left, width: width, widthWithChildren: widthWithChildren};
     },
 
-    computeBarGraphLabels: function(record)
+    calculateWindow: function()
     {
-        return {tooltip: record.title};
+        this.minimumBoundary = this._absoluteMinimumBoundary + this.windowLeft * (this._absoluteMaximumBoundary - this._absoluteMinimumBoundary);
+        this.maximumBoundary = this._absoluteMinimumBoundary + this.windowRight * (this._absoluteMaximumBoundary - this._absoluteMinimumBoundary);
+        this.boundarySpan = this.maximumBoundary - this.minimumBoundary;
     },
 
-    updateBoundaries: function(record)
+    reset: function()
     {
-        var didChange = false;
+        this._absoluteMinimumBoundary = -1;
+        this._absoluteMaximumBoundary = -1;
+    },
 
+    updateBoundaries: function(record)
+    {
         var lowerBound = record.startTime;
+        if (this._absoluteMinimumBoundary === -1 || lowerBound < this._absoluteMinimumBoundary)
+            this._absoluteMinimumBoundary = lowerBound;
 
-        if (typeof this.minimumBoundary === "undefined" || lowerBound < this.minimumBoundary) {
-            this.minimumBoundary = lowerBound;
-            didChange = true;
-        }
-
-        var upperBound = record.endTime;
-        if (typeof this.maximumBoundary === "undefined" || upperBound > this.maximumBoundary) {
-            this.maximumBoundary = upperBound;
-            didChange = true;
-        }
-
-        return didChange;
+        var upperBound = record._lastChildEndTime;
+        if (this._absoluteMaximumBoundary === -1 || upperBound > this._absoluteMaximumBoundary)
+            this._absoluteMaximumBoundary = upperBound;
     },
 
     formatValue: function(value)
     {
-        return Number.secondsToString(value, WebInspector.UIString.bind(WebInspector));
-    },
+        return Number.secondsToString(value + this.minimumBoundary - this._absoluteMinimumBoundary, this._uiString);
+    }
+}
+
 
+WebInspector.TimelineRecordListRow = function()
+{
+    this.element = document.createElement("div");
+    this.element.row = this;
+    this.element.style.cursor = "pointer";
+    var iconElement = document.createElement("span");
+    iconElement.className = "timeline-tree-icon";
+    this.element.appendChild(iconElement);
+
+    this._typeElement = document.createElement("span");
+    this._typeElement.className = "type";
+    this.element.appendChild(this._typeElement);
+
+    var separatorElement = document.createElement("span");
+    separatorElement.className = "separator";
+    separatorElement.textContent = " ";
+
+    this._dataElement = document.createElement("span");
+    this._dataElement.className = "data dimmed";
+
+    this._repeatCountElement = document.createElement("span");
+    this._repeatCountElement.className = "count";
+
+    this.element.appendChild(separatorElement);
+    this.element.appendChild(this._dataElement);
+    this.element.appendChild(this._repeatCountElement);
 }
 
-WebInspector.TimelineCalculator.prototype.__proto__ = WebInspector.AbstractTimelineCalculator.prototype;
+WebInspector.TimelineRecordListRow.prototype = {
+    update: function(record, isEven, calculator, offset)
+    {
+        this._record = record;
+        this._calculator = calculator;
+        this._offset = offset;
 
+        this.element.className = "timeline-tree-item timeline-category-" + record.category.name + (isEven ? " even" : "");
+        this._typeElement.textContent = record.title;
 
-WebInspector.TimelineGraph = function(record)
-{
-    this.record = record;
+        if (record.details)
+            this._dataElement.textContent = "(" + record.details + ")";
+        else
+            this._dataElement.textContent = "";
+
+        if (record.count > 1)
+            this._repeatCountElement.textContent = "\u2009\u00d7\u2009" + record.count;
+        else
+            this._repeatCountElement.textContent = "";
+    },
+
+    dispose: function()
+    {
+        this.element.parentElement.removeChild(this.element);
+    }
+}
 
-    this._graphElement = document.createElement("div");
-    this._graphElement.className = "timeline-graph-side";
+WebInspector.TimelineRecordGraphRow = function(graphContainer, scheduleRefresh, rowHeight)
+{
+    this.element = document.createElement("div");
+    this.element.row = this;
 
     this._barAreaElement = document.createElement("div");
-    this._barAreaElement.className = "timeline-graph-bar-area hidden";
-    this._graphElement.appendChild(this._barAreaElement);
+    this._barAreaElement.className = "timeline-graph-bar-area";
+    this.element.appendChild(this._barAreaElement);
+
+    this._barWithChildrenElement = document.createElement("div");
+    this._barWithChildrenElement.className = "timeline-graph-bar with-children";
+    this._barWithChildrenElement.row = this;
+    this._barAreaElement.appendChild(this._barWithChildrenElement);
 
     this._barElement = document.createElement("div");
     this._barElement.className = "timeline-graph-bar";
+    this._barElement.row = this;
     this._barAreaElement.appendChild(this._barElement);
 
-    this._graphElement.addStyleClass("timeline-category-" + record.category.name);
+    this._expandElement = document.createElement("div");
+    this._expandElement.className = "timeline-expandable";
+    graphContainer.appendChild(this._expandElement);
+
+    var leftBorder = document.createElement("div");
+    leftBorder.className = "timeline-expandable-left";
+    this._expandElement.appendChild(leftBorder);
+
+    this._expandElement.addEventListener("click", this._onClick.bind(this));
+    this._rowHeight = rowHeight;
+
+    this._scheduleRefresh = scheduleRefresh;
 }
 
-WebInspector.TimelineGraph.prototype = {
-    get graphElement()
+WebInspector.TimelineRecordGraphRow.prototype = {
+    update: function(record, isEven, calculator, clientWidth, expandOffset, index)
     {
-        return this._graphElement;
+        this._record = record;
+        this.element.className = "timeline-graph-side timeline-category-" + record.category.name + (isEven ? " even" : "");
+        var barPosition = calculator.computeBarGraphWindowPosition(record, clientWidth, expandOffset);
+        this._barWithChildrenElement.style.left = barPosition.left + expandOffset + "px";
+        this._barWithChildrenElement.style.width = barPosition.widthWithChildren + "px";
+        this._barElement.style.left = barPosition.left + expandOffset + "px";
+        this._barElement.style.width =  barPosition.width + "px";
+
+        if (record.children.length) {
+            this._expandElement.style.top = index * this._rowHeight + "px";
+            this._expandElement.style.left = barPosition.left + "px";
+            this._expandElement.style.width = Math.max(12, barPosition.width + 25) + "px";
+            if (!record.collapsed) {
+                this._expandElement.style.height = (record.visibleChildrenCount + 1) * this._rowHeight + "px";
+                this._expandElement.addStyleClass("timeline-expandable-expanded");
+                this._expandElement.removeStyleClass("timeline-expandable-collapsed");
+            } else {
+                this._expandElement.style.height = this._rowHeight + "px";
+                this._expandElement.addStyleClass("timeline-expandable-collapsed");
+                this._expandElement.removeStyleClass("timeline-expandable-expanded");
+            }
+            this._expandElement.removeStyleClass("hidden");
+        } else {
+            this._expandElement.addStyleClass("hidden");
+        }
     },
 
-    refreshLabelPositions: function()
+    _onClick: function(event)
     {
+        this._record.collapsed = !this._record.collapsed;
+        this._scheduleRefresh();
     },
 
-    refresh: function(calculator)
+    dispose: function()
     {
-        var percentages = calculator.computeBarGraphPercentages(this.record);
-        var labels = calculator.computeBarGraphLabels(this.record);
+        this.element.parentElement.removeChild(this.element);
+        this._expandElement.parentElement.removeChild(this._expandElement);
+    }
+}
 
-        this._percentages = percentages;
+WebInspector.TimelinePanel.FormattedRecord = function(record, parentRecord, recordStyles, sendRequestRecords, timerRecords)
+{
+    var recordTypes = WebInspector.TimelineAgent.RecordType;
+    var style = recordStyles[record.type];
+
+    this.parent = parentRecord;
+    parentRecord.children.push(this);
+    this.category = style.category;
+    this.title = style.title;
+    this.startTime = record.startTime / 1000;
+    this.data = record.data;
+    this.count = 1;
+    this.type = record.type;
+    this.endTime = (typeof record.endTime !== "undefined") ? record.endTime / 1000 : this.startTime;
+    this._lastChildEndTime = this.endTime;
+    this.originalRecordForTests = record;
+    this.callerScriptName = record.callerScriptName;
+    this.callerScriptLine = record.callerScriptLine;
+
+    // Make resource receive record last since request was sent; make finish record last since response received.
+    if (record.type === recordTypes.ResourceSendRequest) {
+        sendRequestRecords[record.data.identifier] = this;
+    } else if (record.type === recordTypes.ResourceReceiveResponse) {
+        var sendRequestRecord = sendRequestRecords[record.data.identifier];
+        if (sendRequestRecord) { // False if we started instrumentation in the middle of request.
+            record.data.url = sendRequestRecord.data.url;
+            // Now that we have resource in the collection, recalculate details in order to display short url.
+            sendRequestRecord.details = this._getRecordDetails(sendRequestRecord, sendRequestRecords);
+        }
+    } else if (record.type === recordTypes.ResourceReceiveData) {
+        var sendRequestRecord = sendRequestRecords[record.data.identifier];
+        if (sendRequestRecord) // False for main resource.
+            record.data.url = sendRequestRecord.data.url;
+    } else if (record.type === recordTypes.ResourceFinish) {
+        var sendRequestRecord = sendRequestRecords[record.data.identifier];
+        if (sendRequestRecord) // False for main resource.
+            record.data.url = sendRequestRecord.data.url;
+    } else if (record.type === recordTypes.TimerInstall) {
+        this.timeout = record.data.timeout;
+        this.singleShot = record.data.singleShot;
+        timerRecords[record.data.timerId] = this;
+    } else if (record.type === recordTypes.TimerFire) {
+        var timerInstalledRecord = timerRecords[record.data.timerId];
+        if (timerInstalledRecord) {
+            this.callSiteScriptName = timerInstalledRecord.callerScriptName;
+            this.callSiteScriptLine = timerInstalledRecord.callerScriptLine;
+            this.timeout = timerInstalledRecord.timeout;
+            this.singleShot = timerInstalledRecord.singleShot;
+        }
+    }
+    this.details = this._getRecordDetails(record, sendRequestRecords);
+}
 
-        this._barAreaElement.removeStyleClass("hidden");
+WebInspector.TimelinePanel.FormattedRecord.prototype = {
+    _createCell: function(content, styleName)
+    {
+        var text = document.createElement("label");
+        text.appendChild(document.createTextNode(content));
+        var cell = document.createElement("td");
+        cell.className = "timeline-details";
+        if (styleName)
+            cell.className += " " + styleName;
+        cell.textContent = content;
+        return cell;
+    },
 
-        if (!this._graphElement.hasStyleClass("timeline-category-" + this.record.category.name)) {
-            this._graphElement.removeMatchingStyleClasses("timeline-category-\\w+");
-            this._graphElement.addStyleClass("timeline-category-" + this.record.category.name);
+    get children()
+    {
+        if (!this._children)
+            this._children = [];
+        return this._children;
+    },
+
+    _createRow: function(title, content)
+    {
+        var row = document.createElement("tr");
+        row.appendChild(this._createCell(title, "timeline-details-row-title"));
+        row.appendChild(this._createCell(content, "timeline-details-row-data"));
+        return row;
+    },
+
+    _createLinkRow: function(title, content)
+    {
+        var row = document.createElement("tr");
+        row.appendChild(this._createCell(title, "timeline-details-row-title"));
+        var cell = document.createElement("td");
+        cell.appendChild(content);
+        row.appendChild(cell);
+        return row;
+    },
+
+    _generatePopupContent: function(calculator)
+    {
+        var recordContentTable = document.createElement("table");
+        var titleCell = this._createCell(WebInspector.UIString("%s - Details", this.title), "timeline-details-title");
+        titleCell.colSpan = 2;
+        var titleRow = document.createElement("tr");
+        titleRow.appendChild(titleCell);
+        recordContentTable.appendChild(titleRow);
+        var text = Number.secondsToString(this.endTime - this.startTime) + " (@" +
+        calculator.formatValue(this.startTime - calculator.minimumBoundary) + ")";
+        recordContentTable.appendChild(this._createRow(WebInspector.UIString("Duration"), text));
+
+        const recordTypes = WebInspector.TimelineAgent.RecordType;
+        if (this.details) {
+            if (this.type === recordTypes.TimerInstall ||
+                this.type === recordTypes.TimerFire ||
+                this.type === recordTypes.TimerRemove) {
+                recordContentTable.appendChild(this._createRow(WebInspector.UIString("Timer Id"), this.data.timerId));
+                if (typeof this.timeout === "number") {
+                    recordContentTable.appendChild(this._createRow(WebInspector.UIString("Timeout"), this.timeout));
+                    recordContentTable.appendChild(this._createRow(WebInspector.UIString("Repeats"), !this.singleShot));
+                }
+                if (typeof this.callSiteScriptLine === "number") {
+                    var link = WebInspector.linkifyResourceAsNode(this.callSiteScriptName, "scripts", this.callSiteScriptLine, "timeline-details");
+                    recordContentTable.appendChild(this._createLinkRow(WebInspector.UIString("Call Site"), link));
+                }
+            } else if (this.type === recordTypes.FunctionCall) {
+                var link = WebInspector.linkifyResourceAsNode(this.data.scriptName, "scripts", this.data.scriptLine, "timeline-details");
+                recordContentTable.appendChild(this._createLinkRow(WebInspector.UIString("Location"), link));
+            } else if (this.type === recordTypes.ResourceSendRequest ||
+                       this.type === recordTypes.ResourceReceiveResponse ||
+                       this.type === recordTypes.ResourceReceiveData ||
+                       this.type === recordTypes.ResourceFinish) {
+                var link = WebInspector.linkifyResourceAsNode(this.data.url, "resources", null, "timeline-details");
+                recordContentTable.appendChild(this._createLinkRow(WebInspector.UIString("Resource"), link));
+                if (this.data.requestMethod)
+                    recordContentTable.appendChild(this._createRow(WebInspector.UIString("Request Method"), this.data.requestMethod));
+                if (typeof this.data.statusCode === "number")
+                    recordContentTable.appendChild(this._createRow(WebInspector.UIString("Status Code"), this.data.statusCode));
+                if (this.data.mimeType)
+                    recordContentTable.appendChild(this._createRow(WebInspector.UIString("Mime Type"), this.data.mimeType));
+                if (typeof this.data.expectedContentLength === "number" && this.data.expectedContentLength !== -1)
+                    recordContentTable.appendChild(this._createRow(WebInspector.UIString("Expected Content Length"), this.data.expectedContentLength));
+            } else if (this.type === recordTypes.EvaluateScript) {
+                var link = WebInspector.linkifyResourceAsNode(this.data.url, "scripts", null, "timeline-details");
+                recordContentTable.appendChild(this._createLinkRow(WebInspector.UIString("Script"), link));
+            } else if (this.type === recordTypes.Paint) {
+                recordContentTable.appendChild(this._createRow(WebInspector.UIString("Location"), this.data.x + "\u2009\u00d7\u2009" + this.data.y));
+                recordContentTable.appendChild(this._createRow(WebInspector.UIString("Dimensions"), this.data.width + "\u2009\u00d7\u2009" + this.data.height));
+            } else
+                recordContentTable.appendChild(this._createRow(WebInspector.UIString("Details"), this.details));
         }
 
-        this._barElement.style.setProperty("left", percentages.start + "%");
-        this._barElement.style.setProperty("right", (100 - percentages.end) + "%");
+        if (this.callerScriptName) {
+            var link = WebInspector.linkifyResourceAsNode(this.callerScriptName, "scripts", this.callerScriptLine);
+            recordContentTable.appendChild(this._createLinkRow(WebInspector.UIString("Caller"), link));
+        }
+        return recordContentTable;
+    },
 
-        var tooltip = (labels.tooltip || "");
-        this._barElement.title = tooltip;
+    _getRecordDetails: function(record, sendRequestRecords)
+    {
+        switch (record.type) {
+            case WebInspector.TimelineAgent.RecordType.FunctionCall:
+                return WebInspector.displayNameForURL(record.data.scriptName) + ":" + record.data.scriptLine;
+            case WebInspector.TimelineAgent.RecordType.EventDispatch:
+                return record.data ? record.data.type : "";
+            case WebInspector.TimelineAgent.RecordType.Paint:
+                return record.data.width + "\u2009\u00d7\u2009" + record.data.height;
+            case WebInspector.TimelineAgent.RecordType.TimerInstall:
+            case WebInspector.TimelineAgent.RecordType.TimerRemove:
+            case WebInspector.TimelineAgent.RecordType.TimerFire:
+                return record.data.timerId;
+            case WebInspector.TimelineAgent.RecordType.XHRReadyStateChange:
+            case WebInspector.TimelineAgent.RecordType.XHRLoad:
+            case WebInspector.TimelineAgent.RecordType.EvaluateScript:
+            case WebInspector.TimelineAgent.RecordType.ResourceSendRequest:
+            case WebInspector.TimelineAgent.RecordType.ResourceReceiveData:
+            case WebInspector.TimelineAgent.RecordType.ResourceReceiveResponse:
+            case WebInspector.TimelineAgent.RecordType.ResourceFinish:
+                return WebInspector.displayNameForURL(record.data.url);
+            case WebInspector.TimelineAgent.RecordType.MarkTimeline:
+                return record.data.message;
+            default:
+                return "";
+        }
     }
 }
+
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TopDownProfileDataGridTree.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
index 1b07883c03..bfcc25eeeb 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
@@ -82,6 +82,7 @@ WebInspector.TopDownProfileDataGridTree.prototype = {
             return;
 
         this._save();
+        profileDataGrideNode.savePosition();
 
         this.children = [profileDataGrideNode];
         this.totalTime = profileDataGrideNode.totalTime;
@@ -102,6 +103,16 @@ WebInspector.TopDownProfileDataGridTree.prototype = {
             this.sort(this.lastComparator, true);
     },
 
+    restore: function()
+    {
+        if (!this._savedChildren)
+            return;
+
+        this.children[0].restorePosition();
+
+        WebInspector.ProfileDataGridTree.prototype.restore.call(this);
+    },
+
     _merge: WebInspector.TopDownProfileDataGridNode.prototype._merge,
 
     _sharedPopulate: WebInspector.TopDownProfileDataGridNode.prototype._sharedPopulate
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index 96a20ab7bf..3655d684d6 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -31,35 +31,41 @@
 WebInspector.WatchExpressionsSidebarPane = function()
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Watch Expressions"));
+    WebInspector.settings.addEventListener("loaded", this._settingsLoaded, this);
+}
 
-    this.section = new WebInspector.WatchExpressionsSection();
+WebInspector.WatchExpressionsSidebarPane.prototype = {
+    _settingsLoaded: function()
+    {
+        this.bodyElement.removeChildren();
 
-    this.bodyElement.appendChild(this.section.element);
+        this.expanded = WebInspector.settings.watchExpressions.length > 0;
+        this.section = new WebInspector.WatchExpressionsSection();
+        this.bodyElement.appendChild(this.section.element);
 
-    var addElement = document.createElement("button");
-    addElement.setAttribute("type", "button");
-    addElement.textContent = WebInspector.UIString("Add");
-    addElement.addEventListener("click", this.section.addExpression.bind(this.section), false);
+        var addElement = document.createElement("button");
+        addElement.setAttribute("type", "button");
+        addElement.textContent = WebInspector.UIString("Add");
+        addElement.addEventListener("click", this.section.addExpression.bind(this.section), false);
 
-    var refreshElement = document.createElement("button");
-    refreshElement.setAttribute("type", "button");
-    refreshElement.textContent = WebInspector.UIString("Refresh");
-    refreshElement.addEventListener("click", this.section.update.bind(this.section), false);
+        var refreshElement = document.createElement("button");
+        refreshElement.setAttribute("type", "button");
+        refreshElement.textContent = WebInspector.UIString("Refresh");
+        refreshElement.addEventListener("click", this.section.update.bind(this.section), false);
 
-    var centerElement = document.createElement("div");
-    centerElement.addStyleClass("watch-expressions-buttons-container");
-    centerElement.appendChild(addElement);
-    centerElement.appendChild(refreshElement);
-    this.bodyElement.appendChild(centerElement);
+        var centerElement = document.createElement("div");
+        centerElement.addStyleClass("watch-expressions-buttons-container");
+        centerElement.appendChild(addElement);
+        centerElement.appendChild(refreshElement);
+        this.bodyElement.appendChild(centerElement);
 
-    this.expanded = this.section.loadSavedExpressions().length > 0;
-    this.onexpand = this.refreshExpressions.bind(this);
-}
+        this.onexpand = this.refreshExpressions.bind(this);
+    },
 
-WebInspector.WatchExpressionsSidebarPane.prototype = {
     refreshExpressions: function()
     {
-        this.section.update();
+        if (this.section)
+            this.section.update();
     }
 }
 
@@ -67,16 +73,16 @@ WebInspector.WatchExpressionsSidebarPane.prototype.__proto__ = WebInspector.Side
 
 WebInspector.WatchExpressionsSection = function()
 {
+    this._watchObjectGroupId = "watch-group";
+
     WebInspector.ObjectPropertiesSection.call(this);
 
-    this.watchExpressions = this.loadSavedExpressions();
+    this.watchExpressions = WebInspector.settings.watchExpressions;
 
     this.headerElement.className = "hidden";
     this.editable = true;
     this.expanded = true;
     this.propertiesElement.addStyleClass("watch-expressions");
-
-    this._watchObjectGroupId = "watch-group";
 }
 
 WebInspector.WatchExpressionsSection.NewWatchExpression = "\xA0";
@@ -112,11 +118,23 @@ WebInspector.WatchExpressionsSection.prototype = {
             // method to get all the properties refreshed at once.
             properties.push(property);
             
-            if (properties.length == propertyCount)
+            if (properties.length == propertyCount) {
                 this.updateProperties(properties, WebInspector.WatchExpressionTreeElement, WebInspector.WatchExpressionsSection.CompareProperties);
+
+                // check to see if we just added a new watch expression,
+                // which will always be the last property
+                if (this._newExpressionAdded) {
+                    delete this._newExpressionAdded;
+
+                    treeElement = this.findAddedTreeElement();
+                    if (treeElement)
+                        treeElement.startEditing();
+                }
+            }
         }
 
-        InspectorController.releaseWrapperObjectGroup(this._watchObjectGroupId)
+        // TODO: pass exact injected script id.
+        InspectorBackend.releaseWrapperObjectGroup(0, this._watchObjectGroupId)
         var properties = [];
 
         // Count the properties, so we known when to call this.updateProperties()
@@ -150,14 +168,9 @@ WebInspector.WatchExpressionsSection.prototype = {
 
     addExpression: function()
     {
+        this._newExpressionAdded = true;
         this.watchExpressions.push(WebInspector.WatchExpressionsSection.NewWatchExpression);
         this.update();
-
-        // After update(), the new empty expression to be edited
-        // will be in the tree, but we have to find it.
-        treeElement = this.findAddedTreeElement();
-        if (treeElement)
-            treeElement.startEditing();
     },
 
     updateExpression: function(element, value)
@@ -175,21 +188,6 @@ WebInspector.WatchExpressionsSection.prototype = {
                 return children[i];
     },
 
-    loadSavedExpressions: function()
-    {
-        var json = InspectorController.setting("watchExpressions");
-        if (!json)
-            return [];
-
-        try {
-            json = JSON.parse(json);
-        } catch(e) {
-            return [];
-        }
-
-        return json.expressions || [];
-    },
-
     saveExpressions: function()
     {
         var toSave = [];
@@ -197,9 +195,7 @@ WebInspector.WatchExpressionsSection.prototype = {
             if (this.watchExpressions[i])
                 toSave.push(this.watchExpressions[i]);
 
-        var json = JSON.stringify({expressions: toSave});
-        InspectorController.setSetting("watchExpressions", json);
-
+        WebInspector.settings.watchExpressions = toSave;
         return toSave.length;
     }
 }
@@ -249,7 +245,7 @@ WebInspector.WatchExpressionTreeElement.prototype = {
         if (WebInspector.isBeingEdited(this.nameElement) || !this.treeOutline.section.editable)
             return;
 
-        this.nameElement.textContent = this.property.name.trimWhitespace();
+        this.nameElement.textContent = this.property.name.trim();
 
         var context = { expanded: this.expanded };
 
@@ -272,7 +268,7 @@ WebInspector.WatchExpressionTreeElement.prototype = {
 
     applyExpression: function(expression, updateInterface)
     {
-        expression = expression.trimWhitespace();
+        expression = expression.trim();
 
         if (!expression)
             expression = null;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
index 0347952a2a..47a2e90dec 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
@@ -2,14 +2,22 @@
 <qresource prefix="/webkit/inspector">
     <file>inspector.html</file>
     <file>AbstractTimelinePanel.js</file>
+    <file>AuditCategories.js</file>
+    <file>AuditLauncherView.js</file>
+    <file>AuditResultView.js</file>
+    <file>AuditRules.js</file>
+    <file>AuditsPanel.js</file>
     <file>BottomUpProfileDataGridTree.js</file>
     <file>Breakpoint.js</file>
     <file>BreakpointsSidebarPane.js</file>
     <file>Callback.js</file>
     <file>CallStackSidebarPane.js</file>
     <file>ChangesView.js</file>
+    <file>Checkbox.js</file>
     <file>Color.js</file>
+    <file>ConsolePanel.js</file>
     <file>ConsoleView.js</file>
+    <file>ContextMenu.js</file>
     <file>CookieItemsView.js</file>
     <file>Database.js</file>
     <file>DatabaseQueryView.js</file>
@@ -17,18 +25,20 @@
     <file>DataGrid.js</file>
     <file>DOMAgent.js</file>
     <file>DOMStorage.js</file>
-    <file>DOMStorageDataGrid.js</file>
     <file>DOMStorageItemsView.js</file>
+    <file>DOMSyntaxHighlighter.js</file>
     <file>Drawer.js</file>
     <file>ElementsPanel.js</file>
     <file>ElementsTreeOutline.js</file>
     <file>EventListenersSidebarPane.js</file>
     <file>FontView.js</file>
     <file>ImageView.js</file>
+    <file>InjectedFakeWorker.js</file>
     <file>InjectedScript.js</file>
     <file>InjectedScriptAccess.js</file>
     <file>inspector.js</file>
-    <file>InspectorControllerStub.js</file>
+    <file>InspectorBackendStub.js</file>
+    <file>InspectorFrontendHostStub.js</file>
     <file>KeyboardShortcut.js</file>
     <file>MetricsSidebarPane.js</file>
     <file>Object.js</file>
@@ -37,7 +47,7 @@
     <file>Panel.js</file>
     <file>PanelEnablerView.js</file>
     <file>Placard.js</file>
-    <file>Popup.js</file>
+    <file>Popover.js</file>
     <file>ProfileDataGridTree.js</file>
     <file>ProfilesPanel.js</file>
     <file>ProfileView.js</file>
@@ -51,31 +61,55 @@
     <file>Script.js</file>
     <file>ScriptsPanel.js</file>
     <file>ScriptView.js</file>
+    <file>Section.js</file>
+    <file>Settings.js</file>
     <file>SidebarPane.js</file>
     <file>SidebarTreeElement.js</file>
+    <file>SourceCSSTokenizer.js</file>
     <file>SourceFrame.js</file>
+    <file>SourceHTMLTokenizer.js</file>
+    <file>SourceJavaScriptTokenizer.js</file>
+    <file>SourceTokenizer.js</file>
     <file>SourceView.js</file>
     <file>StatusBarButton.js</file>
     <file>StoragePanel.js</file>
     <file>StylesSidebarPane.js</file>
     <file>SummaryBar.js</file>
     <file>TestController.js</file>
+    <file>TextEditorHighlighter.js</file>
+    <file>TextEditorModel.js</file>
     <file>TextPrompt.js</file>
+    <file>TextViewer.js</file>
     <file>TimelineAgent.js</file>
+    <file>TimelineGrid.js</file>
+    <file>TimelineOverviewPane.js</file>
     <file>TimelinePanel.js</file>
     <file>TopDownProfileDataGridTree.js</file>
     <file>treeoutline.js</file>
     <file>utilities.js</file>
     <file>View.js</file>
     <file>WatchExpressionsSidebarPane.js</file>
+    <file>WelcomeView.js</file>
+    <file>WorkersSidebarPane.js</file>
+    <file>audits.css</file>
     <file>inspector.css</file>
     <file>inspectorSyntaxHighlight.css</file>
+    <file>popover.css</file>
+    <file>textViewer.css</file>
+    <file>Images/auditsIcon.png</file>
     <file>Images/back.png</file>
+    <file>Images/breakpointBorder.png</file>
+    <file>Images/breakpointConditionalBorder.png</file>
+    <file>Images/breakpointConditionalCounterBorder.png</file>
+    <file>Images/breakpointCounterBorder.png</file>
+    <file>Images/breakpointsActivateButtonGlyph.png</file>
+    <file>Images/breakpointsDeactivateButtonGlyph.png</file>
     <file>Images/checker.png</file>
     <file>Images/clearConsoleButtonGlyph.png</file>
     <file>Images/closeButtons.png</file>
     <file>Images/consoleButtonGlyph.png</file>
     <file>Images/cookie.png</file>
+    <file>Images/consoleIcon.png</file>
     <file>Images/database.png</file>
     <file>Images/databaseTable.png</file>
     <file>Images/debuggerContinue.png</file>
@@ -102,6 +136,7 @@
     <file>Images/excludeButtonGlyph.png</file>
     <file>Images/focusButtonGlyph.png</file>
     <file>Images/forward.png</file>
+    <file>Images/gearButtonGlyph.png</file>
     <file>Images/glossyHeader.png</file>
     <file>Images/glossyHeaderPressed.png</file>
     <file>Images/glossyHeaderSelected.png</file>
@@ -119,11 +154,14 @@
     <file>Images/paneSettingsButtons.png</file>
     <file>Images/pauseOnExceptionButtonGlyph.png</file>
     <file>Images/percentButtonGlyph.png</file>
+    <file>Images/popoverArrows.png</file>
+    <file>Images/popoverBackground.png</file>
     <file>Images/profileGroupIcon.png</file>
     <file>Images/profileIcon.png</file>
     <file>Images/profilesIcon.png</file>
     <file>Images/profileSmallIcon.png</file>
     <file>Images/profilesSilhouette.png</file>
+    <file>Images/programCounterBorder.png</file>
     <file>Images/radioDot.png</file>
     <file>Images/recordButtonGlyph.png</file>
     <file>Images/recordToggledButtonGlyph.png</file>
@@ -151,6 +189,7 @@
     <file>Images/segmentSelected.png</file>
     <file>Images/segmentSelectedEnd.png</file>
     <file>Images/sessionStorage.png</file>
+    <file>Images/spinner.gif</file>
     <file>Images/splitviewDimple.png</file>
     <file>Images/splitviewDividerBackground.png</file>
     <file>Images/statusbarBackground.png</file>
@@ -162,6 +201,12 @@
     <file>Images/statusbarResizerVertical.png</file>
     <file>Images/storageIcon.png</file>
     <file>Images/successGreenDot.png</file>
+    <file>Images/thumbActiveHoriz.png</file>
+    <file>Images/thumbActiveVert.png</file>
+    <file>Images/thumbHoriz.png</file>
+    <file>Images/thumbVert.png</file>
+    <file>Images/thumbHoverHoriz.png</file>
+    <file>Images/thumbHoverVert.png</file>
     <file>Images/timelineBarBlue.png</file>
     <file>Images/timelineBarGray.png</file>
     <file>Images/timelineBarGreen.png</file>
@@ -186,11 +231,9 @@
     <file>Images/timelinePillPurple.png</file>
     <file>Images/timelinePillRed.png</file>
     <file>Images/timelinePillYellow.png</file>
-    <file>Images/tipBalloon.png</file>
-    <file>Images/tipBalloonBottom.png</file>
-    <file>Images/tipIcon.png</file>
-    <file>Images/tipIconPressed.png</file>
     <file>Images/toolbarItemSelected.png</file>
+    <file>Images/trackHoriz.png</file>
+    <file>Images/trackVert.png</file>
     <file>Images/treeDownTriangleBlack.png</file>
     <file>Images/treeDownTriangleWhite.png</file>
     <file>Images/treeRightTriangleBlack.png</file>
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/WelcomeView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/WelcomeView.js
new file mode 100644
index 0000000000..0feee12f5b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/WelcomeView.js
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.WelcomeView = function(identifier, headingText, instructionsText)
+{
+    WebInspector.View.call(this);
+
+    this.element.addStyleClass("panel-enabler-view");
+    this.element.addStyleClass(identifier);
+    this.element.addStyleClass("welcome");
+
+    this.contentElement = document.createElement("div");
+    this.contentElement.className = "panel-enabler-view-content";
+    this.element.appendChild(this.contentElement);
+
+    this.alignerElement = document.createElement("div");
+    this.alignerElement.className = "welcome-instructions-aligner";
+    this.contentElement.appendChild(this.alignerElement);
+
+    this.instructionsElement = document.createElement("div");
+    this.instructionsElement.className = "instructions";
+    this.contentElement.appendChild(this.instructionsElement);
+
+    this.headerElement = document.createElement("h1");
+    this.headerElement.textContent = headingText;
+    this.instructionsElement.appendChild(this.headerElement);
+
+    if (instructionsText)
+        this.addMessage(instructionsText);
+}
+
+WebInspector.WelcomeView.prototype = {
+    addMessage: function(message)
+    {
+        var messageElement = document.createElement("div");
+        messageElement.className = "message";
+        if (typeof message == "string")
+            // Message text can contain <br> tags for better text balancing, so we
+            // put it into elements using 'innerHTML', not 'textContent'.
+            messageElement.innerHTML = message;
+        else
+            messageElement.appendChild(message);
+        this.instructionsElement.appendChild(messageElement);
+    }
+}
+
+WebInspector.WelcomeView.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/WorkersSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/WorkersSidebarPane.js
new file mode 100644
index 0000000000..ed2b1c40b8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/WorkersSidebarPane.js
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.WorkersSidebarPane = function()
+{
+    WebInspector.SidebarPane.call(this, WebInspector.UIString("Workers"));
+    
+    this._workers = {};
+
+    this._enableWorkersCheckbox = new WebInspector.Checkbox(
+        WebInspector.UIString("Debug"),
+        this._onTriggerInstrument.bind(this),
+        false,
+        "sidebar-pane-subtitle",
+        WebInspector.UIString("Allow debugging workers. Enabling this option will replace native workers with the iframe-based JavaScript implementation"));
+
+    this.titleElement.insertBefore(this._enableWorkersCheckbox.element, this.titleElement.firstChild);
+
+    this._listElement = document.createElement("ol");
+    this._listElement.className = "workers-list";
+
+    this.bodyElement.appendChild(this._listElement);
+    this._treeOutline = new TreeOutline(this._listElement);
+}
+
+WebInspector.WorkersSidebarPane.prototype = {
+    addWorker: function(id, url, isShared)
+    {
+        if (id in this._workers) 
+            return;
+        var worker = new WebInspector.Worker(id, url, isShared);
+        this._workers[id] = worker;
+
+        var title = WebInspector.linkifyURL(url, WebInspector.displayNameForURL(url), "worker-item", true, url);
+        var treeElement = new TreeElement(title, worker, false);
+        this._treeOutline.appendChild(treeElement);
+    },
+
+    removeWorker: function(id)
+    {
+        if (id in this._workers) {
+            this._treeOutline.removeChild(this._treeOutline.findTreeElement(this._workers[id]));
+            delete this._workers[id];
+        }
+    },
+
+    setInstrumentation: function(enabled)
+    {
+        InspectorBackend.removeAllScriptsToEvaluateOnLoad();
+        if (enabled)
+            InspectorBackend.addScriptToEvaluateOnLoad("(" + InjectedFakeWorker + ")");
+    },
+
+    reset: function()
+    {
+        InspectorBackend.removeAllScriptsToEvaluateOnLoad();
+        this.setInstrumentation(this._enableWorkersCheckbox.checked());
+        this._treeOutline.removeChildren();
+        this._workers = {};
+    },
+
+    _onTriggerInstrument: function(event)
+    {
+        this.setInstrumentation(this._enableWorkersCheckbox.checked());
+    }
+};
+
+WebInspector.WorkersSidebarPane.prototype.__proto__ = WebInspector.SidebarPane.prototype;
+
+WebInspector.Worker = function(id, url, shared)
+{
+    this.id = id;
+    this.url = url;
+    this.shared = shared;
+}
+
+WebInspector.didCreateWorker = function()
+{
+    var workersPane = WebInspector.panels.scripts.sidebarPanes.workers;
+    workersPane.addWorker.apply(workersPane, arguments);
+}
+
+WebInspector.didDestroyWorker = function()
+{
+    var workersPane = WebInspector.panels.scripts.sidebarPanes.workers;
+    workersPane.removeWorker.apply(workersPane, arguments);
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/audits.css b/src/3rdparty/webkit/WebCore/inspector/front-end/audits.css
new file mode 100644
index 0000000000..be12fc0c88
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/audits.css
@@ -0,0 +1,279 @@
+/*
+ * Copyright (C) 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+.audits-sidebar-tree-item .icon {
+    content: url(Images/resourcesTimeGraphIcon.png);
+}
+
+.audit-result-sidebar-tree-item .icon {
+    content: url(Images/resourceDocumentIcon.png);
+}
+
+#audit-views {
+    position: absolute;
+    top: 0;
+    right: 0;
+    left: 200px;
+    bottom: 0;
+    overflow: auto;
+}
+
+button.clear-audit-results-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/clearConsoleButtonGlyph.png);
+}
+
+.audit-launcher-view {
+    z-index: 1000;
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    background-color: white;
+    font-size: 13px;
+    overflow-x: hidden;
+    overflow-y: overlay;
+    display: none;
+}
+
+.audit-launcher-view.visible {
+    display: block;
+}
+
+.audit-launcher-view .audit-launcher-view-content {
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    padding: 0 0 0 16px;
+    white-space: nowrap;
+}
+
+.audit-launcher-view h1 {
+    color: rgb(110, 116, 128);
+    font-size: 16px;
+    line-height: 20px;
+    font-weight: normal;
+    padding-top: 15px;
+}
+
+.audit-launcher-view h1.no-audits {
+    text-align: center;
+    font-style: italic;
+    position: relative;
+    left: -8px;
+}
+
+.audit-launcher-view div.button-container {
+    position: absolute;
+    width: 100%;
+    bottom: 16px;
+    padding-top: 16px;
+}
+
+.audit-launcher-view div.audit-categories-container {
+    position: relative;
+    top: 11px;
+    left: 0;
+    width: 100%;
+    overflow-y: auto;
+}
+
+.audit-launcher-view button {
+    color: rgb(6, 6, 6);
+    background-color: transparent;
+    border: 1px solid rgb(165, 165, 165);
+    background-color: rgb(237, 237, 237);
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(252, 252, 252)), to(rgb(223, 223, 223)));
+    -webkit-border-radius: 12px;
+    -webkit-appearance: none;
+}
+
+.audit-launcher-view button {
+    font-size: 13px;
+    padding: 3px 20px;
+    height: 24px;
+    margin: 0 5px 0 0;
+}
+
+.audit-launcher-view button:active {
+    background-color: rgb(215, 215, 215);
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(194, 194, 194)), to(rgb(239, 239, 239)));
+}
+
+body.inactive .audit-launcher-view button, .audit-launcher-view button:disabled {
+    color: rgb(130, 130, 130);
+    border-color: rgb(212, 212, 212);
+    background-color: rgb(239, 239, 239);
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(250, 250, 250)), to(rgb(235, 235, 235)));
+}
+
+.audit-launcher-view label {
+    position: relative;
+    display: block;
+    text-align: left;
+    word-break: break-word;
+    padding: 0 0 5px 0;
+}
+
+.audit-launcher-view label.disabled {
+    color: rgb(130, 130, 130);
+}
+
+.audit-launcher-view input[type="checkbox"] {
+    margin-left: 0;
+}
+
+.audit-launcher-view input[type="radio"] {
+    height: 17px;
+    width: 17px;
+    border: 1px solid rgb(165, 165, 165);
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(252, 252, 252)), to(rgb(223, 223, 223)));
+    -webkit-border-radius: 8px;
+    -webkit-appearance: none;
+    vertical-align: middle;
+    margin: 0 5px 5px 0;
+}
+
+.audit-launcher-view input[type="radio"]:active:not(:disabled) {
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(194, 194, 194)), to(rgb(239, 239, 239)));
+}
+
+.audit-launcher-view input[type="radio"]:checked:not(:disabled), .audit-launcher-view input[type="radio"]:checked:disabled {
+    background: url(Images/radioDot.png) center no-repeat,
+                -webkit-gradient(linear, left top, left bottom, from(rgb(252, 252, 252)), to(rgb(223, 223, 223)));
+}
+
+.audit-launcher-view .resource-progress > img {
+    content: url(Images/spinner.gif);
+    vertical-align: text-top;
+    margin: 0 4px 0 8px;
+}
+
+.audit-result-view {
+    overflow: auto;
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    display: none;
+}
+
+.audit-result-view.visible {
+    display: block;
+}
+
+.audit-result-view .severity-severe {
+    content: url(Images/errorRedDot.png);
+}
+
+.audit-result-view .severity-warning {
+    content: url(Images/warningOrangeDot.png);
+}
+
+.audit-result-view .severity-info {
+    content: url(Images/successGreenDot.png);
+}
+
+.audit-result-tree li.parent::before {
+    content: url(Images/treeRightTriangleBlack.png);
+    float: left;
+    width: 8px;
+    height: 8px;
+    margin-top: 1px;
+    padding-right: 2px;
+}
+
+.audit-result-tree {
+    font-size: 11px;
+    line-height: 14px;
+}
+
+.audit-result-tree > ol {
+    position: relative;
+    padding: 2px 6px !important;
+    margin: 0;
+    color: rgb(84, 84, 84);
+    cursor: default;
+    min-width: 100%;
+}
+
+.audit-result-tree, .audit-result-tree ol {
+    list-style-type: none;
+    -webkit-padding-start: 12px;
+    margin: 0;
+}
+
+.audit-result-tree li {
+    padding: 0 0 0 14px;
+    margin-top: 1px;
+    margin-bottom: 1px;
+    word-wrap: break-word;
+    text-indent: -2px;
+}
+
+.audit-result-tree li.parent {
+    text-indent: -12px
+}
+
+.audit-result-tree li.parent::before {
+    content: url(Images/treeRightTriangleBlack.png);
+    float: left;
+    width: 8px;
+    height: 8px;
+    margin-top: 0;
+    padding-right: 2px;
+}
+
+.audit-result-tree li.parent.expanded::before {
+    content: url(Images/treeDownTriangleBlack.png);
+}
+
+.audit-result-tree ol.children {
+    display: none;
+}
+
+.audit-result-tree ol.children.expanded {
+    display: block;
+}
+
+.audit-result {
+    font-weight: bold;
+    color: black;
+}
+
+.audit-result img {
+    float: left;
+    margin-left: -40px;
+    margin-top: -1px;
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
index a83d38be1f..c730f6c6a6 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
@@ -29,8 +29,11 @@
 
 body {
     cursor: default;
-    height: 100%;
-    width: 100%;
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 0;
+    right: 0;
     overflow: hidden;
     font-family: Lucida Grande, sans-serif;
     font-size: 10px;
@@ -83,7 +86,8 @@ body.inactive #toolbar {
     border-bottom: 1px solid rgb(64%, 64%, 64%);
 }
 
-body.detached.platform-mac-leopard #toolbar {
+body.detached.platform-mac-leopard #toolbar,
+body.detached.platform-mac-snowleopard #toolbar {
     background: transparent !important;
 }
 
@@ -215,6 +219,14 @@ body.attached #search-results-matches {
     background-image: url(Images/profilesIcon.png);
 }
 
+.toolbar-item.audits .toolbar-icon {
+    background-image: url(Images/auditsIcon.png);
+}
+
+.toolbar-item.console .toolbar-icon {
+    background-image: url(Images/consoleIcon.png);
+}
+
 #close-button-left, #close-button-right {
     width: 14px;
     height: 14px;
@@ -241,11 +253,11 @@ body.attached.port-qt .toolbar-item.close-left, body.attached.port-qt .toolbar-i
     display: none;
 }
 
-body.platform-mac-tiger .toolbar-item.close-right, body.platform-mac-leopard .toolbar-item.close-right { 
+body.platform-mac .toolbar-item.close-right {
     display: none;
 }
 
-body:not(.platform-mac-tiger):not(.platform-mac-leopard) .toolbar-item.close-left { 
+body:not(.platform-mac) .toolbar-item.close-left {
     display: none;
 }
 
@@ -362,6 +374,14 @@ button.status-bar-item.toggled-on .glyph {
     background-color: rgb(66, 129, 235);
 }
 
+button.status-bar-item.toggled-1 .glyph {
+    background-color: rgb(66, 129, 235);
+}
+
+button.status-bar-item.toggled-2 .glyph {
+    background-color: purple;   
+}
+
 button.status-bar-item:disabled {
     opacity: 0.5;
     background-position: 0 0 !important;
@@ -483,6 +503,32 @@ body.drawer-visible #drawer {
     background: none;
 }
 
+.monospace {
+    font-size: 10px;
+    font-family: monospace;
+}
+
+body.platform-mac .monospace, body.platform-mac .source-code {
+    font-family: Monaco, monospace;
+}
+
+/* Keep .platform-mac to make the rule more specific than the general one above. */
+body.platform-mac.platform-mac-snowleopard .monospace,
+body.platform-mac.platform-mac-snowleopard .source-code {
+    font-size: 11px;
+    font-family: Menlo, monospace;
+}
+
+body.platform-windows .monospace, body.platform-windows .source-code {
+    font-size: 12px;
+    font-family: Consolas, Lucida Console, monospace;
+}
+
+body.platform-linux .monospace, body.platform-linux .source-code {
+    font-size: 11px;
+    font-family: dejavu sans mono, monospace;
+}
+
 #console-messages {
     position: absolute;
     z-index: 0;
@@ -490,10 +536,9 @@ body.drawer-visible #drawer {
     left: 0;
     right: 0;
     bottom: 23px;
-    font-size: initial;
-    font-family: monospace;
     padding: 2px 0;
     overflow-y: overlay;
+    word-wrap: break-word;
     -webkit-user-select: text;
     -webkit-text-size-adjust: auto;
 }
@@ -552,6 +597,7 @@ body.drawer-visible #drawer {
     margin-right: 4px;
     text-align: left;
     font-size: 11px;
+    line-height: normal;
     font-family: Helvetica, Arial, sans-serif;
     font-weight: bold;
     text-shadow: none;
@@ -686,7 +732,7 @@ body.drawer-visible #drawer {
 
 .console-group-messages .outline-disclosure, .console-group-messages .outline-disclosure ol {
     font-size: inherit;
-    line-height: 1em;
+    line-height: 12px;
 }
 
 .console-group-messages .outline-disclosure.single-node li {
@@ -716,6 +762,18 @@ body.drawer-visible #drawer {
     padding-left: 0 !important;
 }
 
+.console-formatted-number {
+    color: rgb(28, 0, 207);
+}
+
+.console-formatted-string, .console-formatted-regexp {
+    color: rgb(196, 26, 22);
+}
+
+.console-formatted-null, .console-formatted-undefined {
+    color: rgb(128, 128, 128);
+}
+
 .error-message {
     color: red;
 }
@@ -742,30 +800,50 @@ body.drawer-visible #drawer {
 
 .resource-view {
     display: none;
-    overflow: hidden;
     position: absolute;
     top: 0;
     left: 0;
     right: 0;
     bottom: 0;
-    overflow: hidden;
 }
 
 .resource-view.visible {
     display: block;
 }
 
-.resource-view.headers-visible {
-    overflow-y: auto;
-    overflow-x: hidden;
+.resource-view .scope-bar {
+    display: none;
+    position: absolute;
+    height: 20px;
+    top: 0;
+    left: 0;
+    right: 0;
+    background: -webkit-gradient(linear, 0% 0%, 0% 100%, from(rgb(236, 236, 236)), to(rgb(217, 217, 217)));
+    border-bottom: 1px solid rgb(163, 163, 163);
+}
+
+.resource-view.headers-visible .scope-bar {
+    display: block;
+}
+
+.resource-view .scope-bar li {
+    border-bottom-left-radius: 0;
+    border-bottom-right-radius: 0;
 }
 
 .resource-view-headers {
-    display: none;
     padding: 6px;
-    border-bottom: 1px solid rgb(64%, 64%, 64%);
-    background-color: white;
-    -webkit-user-select: text;
+    -webkit-user-select: text;    
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    overflow: auto;
+}
+
+.resource-view.headers-visible .resource-view-headers {
+    top: 20px;
 }
 
 .resource-view-headers .outline-disclosure .parent {
@@ -773,10 +851,6 @@ body.drawer-visible #drawer {
     font-weight: bold;
 }
 
-.resource-view.headers-visible .resource-view-headers {
-    display: block;
-}
-
 .resource-view-headers .outline-disclosure .children li {
     white-space: nowrap;
 }
@@ -788,21 +862,18 @@ body.drawer-visible #drawer {
 .resource-view-headers .outline-disclosure .header-name {
     color: rgb(33%, 33%, 33%);
     display: inline-block;
-    width: 105px;
-    text-align: right;
     margin-right: 0.5em;
     font-weight: bold;
     vertical-align: top;
-    overflow: hidden;
-    text-overflow: ellipsis;
+    white-space: pre-wrap;
 }
 
 .resource-view-headers .outline-disclosure .header-value {
-    display: inline-block;
-    white-space: normal;
-    word-break: break-word;
-    vertical-align: top;
+    display: inline;
     margin-right: 100px;
+    white-space: pre-wrap;
+    word-break: break-all;
+    margin-top: 1px;
 }
 
 .resource-view-headers .outline-disclosure .raw-form-data {
@@ -815,19 +886,11 @@ body.drawer-visible #drawer {
     right: 0;
     left: 0;
     bottom: 0;
+    overflow: auto;
 }
 
 .resource-view.headers-visible .resource-view-content {
-    position: relative;
-    top: auto;
-    right: auto;
-    left: auto;
-    bottom: auto;
-}
-
-.resource-view.headers-visible .source-view-frame {
-    height: auto;
-    vertical-align: top;
+    top: 20px;
 }
 
 .webkit-line-gutter-backdrop {
@@ -875,6 +938,7 @@ body.drawer-visible #drawer {
 }
 
 .resource-status-image {
+    margin-top: -3px;
     vertical-align: middle;
 }
 
@@ -1043,10 +1107,14 @@ body.drawer-visible #drawer {
     background-color: rgb(212, 212, 212);
 }
 
-:focus .outline-disclosure li.selected .selection {
+.outline-disclosure ol:focus li.selected .selection {
     background-color: rgb(56, 121, 217);
 }
 
+.outline-disclosure {
+    font-size: 11px;
+}
+
 .outline-disclosure > ol {
     position: relative;
     padding: 2px 6px !important;
@@ -1058,24 +1126,33 @@ body.drawer-visible #drawer {
 
 .outline-disclosure, .outline-disclosure ol {
     list-style-type: none;
-    font-size: 11px;
     -webkit-padding-start: 12px;
     margin: 0;
 }
 
+.source-code {
+    font-family: monospace;
+    font-size: 10px;
+    white-space: pre-wrap;
+}
+
 .outline-disclosure li {
-    padding: 0 0 2px 14px;
+    padding: 0 0 0 14px;
     margin-top: 1px;
     margin-bottom: 1px;
     word-wrap: break-word;
-    text-indent: -2px
+    text-indent: -2px;
 }
 
-:focus .outline-disclosure li.selected {
+.resources .outline-disclosure li {
+    text-indent: -1px;
+}
+
+.outline-disclosure ol:focus li.selected {
     color: white;
 }
 
-:focus .outline-disclosure li.selected * {
+.outline-disclosure ol:focus li.selected * {
     color: inherit;
 }
 
@@ -1100,7 +1177,7 @@ body.drawer-visible #drawer {
     content: url(Images/treeRightTriangleBlack.png);
 }
 
-:focus .outline-disclosure li.parent.selected::before {
+.outline-disclosure ol:focus li.parent.selected::before {
     content: url(Images/treeRightTriangleWhite.png);
 }
 
@@ -1108,7 +1185,7 @@ body.drawer-visible #drawer {
     content: url(Images/treeDownTriangleBlack.png);
 }
 
-:focus .outline-disclosure li.parent.expanded.selected::before {
+.outline-disclosure ol:focus li.parent.expanded.selected::before {
     content: url(Images/treeDownTriangleWhite.png);
 }
 
@@ -1120,46 +1197,6 @@ body.drawer-visible #drawer {
     display: block;
 }
 
-.webkit-html-comment {
-    /* Keep this in sync with view-source.css (.webkit-html-comment) */
-    color: rgb(35, 110, 37);
-}
-
-.webkit-html-tag {
-    /* Keep this in sync with view-source.css (.webkit-html-tag) */
-    color: rgb(136, 18, 128);
-}
-
-.webkit-html-doctype {
-    /* Keep this in sync with view-source.css (.webkit-html-doctype) */
-    color: rgb(192, 192, 192);
-}
-
-.webkit-html-attribute-name {
-    /* Keep this in sync with view-source.css (.webkit-html-attribute-name) */
-    color: rgb(153, 69, 0);
-}
-
-.webkit-html-attribute-value {
-    /* Keep this in sync with view-source.css (.webkit-html-attribute-value) */
-    color: rgb(26, 26, 166);
-}
-
-.webkit-html-external-link, .webkit-html-resource-link {
-    /* Keep this in sync with view-source.css (.webkit-html-external-link, .webkit-html-resource-link) */
-    color: #00e;
-}
-
-.webkit-html-external-link {
-    /* Keep this in sync with view-source.css (.webkit-html-external-link) */
-    text-decoration: none;
-}
-
-.webkit-html-external-link:hover {
-    /* Keep this in sync with view-source.css (.webkit-html-external-link:hover) */
-    text-decoration: underline;
-}
-
 .add-attribute {
     margin-left: 1px;
     margin-right: 1px;
@@ -1296,15 +1333,6 @@ body.inactive .placard.selected {
     display: inline;
 }
 
-.section .header input[type=checkbox] {
-    height: 10px;
-    width: 10px;
-    margin-left: 0;
-    margin-top: 0;
-    margin-bottom: 0;
-    vertical-align: 2px;
-}
-
 .section .header .subtitle, .event-bar .header .subtitle {
     float: right;
     font-size: 10px;
@@ -1324,7 +1352,6 @@ body.inactive .placard.selected {
     margin: 0;
     padding: 2px 6px 3px;
     list-style: none;
-    background-color: white;
     min-height: 18px;
 }
 
@@ -1432,7 +1459,7 @@ body.inactive .placard.selected {
 }
 
 .event-bars .event-bar .header .subtitle {
-    color: rgba(90, 90, 90, 0.742188);
+    color: rgba(90, 90, 90, 0.75);
 }
 
 .event-bars .event-bar .header::before {
@@ -1470,6 +1497,11 @@ body.inactive .placard.selected {
     text-decoration: none !important;
 }
 
+.elements-tree-editor {
+    -webkit-user-select: text;
+    -webkit-user-modify: read-write-plaintext-only;
+}
+
 .section .properties li.editing {
     margin-left: 10px;
     text-overflow: clip;
@@ -1540,6 +1572,10 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
     display: block;
 }
 
+.section .properties li.disabled .enabled-button {
+    display: block;
+}
+
 .section .properties .name, .event-properties .name {
     color: rgb(136, 19, 145);
 }
@@ -1548,6 +1584,10 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
     color: rgb(100, 100, 100);
 }
 
+.section .properties .value.error {
+    color: red;
+}
+
 .section .properties .number, .event-properties .number {
     color: blue;
 }
@@ -1618,7 +1658,6 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
 }
 
 .pane > .title > select {
-    display: none;
     float: right;
     width: 23px;
     height: 17px;
@@ -1633,10 +1672,6 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
     -webkit-appearance: none;
 }
 
-.pane.expanded:hover > .title > select {
-    display: inline-block;
-}
-
 .pane > .title > select:hover {
     background-position: -23px 0px;
 }
@@ -1681,6 +1716,21 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
     height: 5px;
 }
 
+.sidebar-pane-subtitle {
+    float: right;
+    overflow: hidden;
+}
+
+.sidebar-pane-subtitle input, .section .header input[type=checkbox] {
+    font-size: inherit;
+    hight: 1em;
+    width: 1em;
+    margin-left: 0;
+    margin-top: 0;
+    margin-bottom: 0.25em;
+    vertical-align: bottom;
+}
+
 .metrics {
     padding: 8px;
     font-size: 10px;
@@ -1777,8 +1827,8 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
 .sidebar {
     position: absolute;
     top: 0;
-    left: 0;
     bottom: 0;
+    left: 0;
     width: 200px;
     overflow-y: auto;
     overflow-x: hidden;
@@ -1957,6 +2007,7 @@ body.inactive .sidebar {
 .data-grid td {
     vertical-align: top;
     height: 12px;
+    line-height: 12px;
     padding: 2px 4px;
     white-space: nowrap;
     border-right: 1px solid #aaa;
@@ -2069,8 +2120,6 @@ body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-des
 }
 
 .storage-view.query {
-    font-size: initial;
-    font-family: monospace;
     padding: 2px 0;
     overflow-y: overlay;
     overflow-x: hidden;
@@ -2184,7 +2233,7 @@ body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-des
     display: none;
 }
 
-.panel-enabler-view img {
+.panel-enabler-view img, div.welcome-instructions-aligner {
     height: 100%;
     min-height: 200px;
     max-width: 100%;
@@ -2217,7 +2266,7 @@ body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-des
     margin: 0 0 5px 20px;
 }
 
-.panel-enabler-view button, .pane button {
+.panel-enabler-view button:not(.status-bar-item), .pane button, button.show-all-nodes {
     color: rgb(6, 6, 6);
     background-color: transparent;
     border: 1px solid rgb(165, 165, 165);
@@ -2227,24 +2276,57 @@ body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-des
     -webkit-appearance: none;
 }
 
-.panel-enabler-view button {
+.panel-enabler-view button:not(.status-bar-item) {
     font-size: 13px;
     margin: 6px 0 0 0;
     padding: 3px 20px;
     height: 24px;
 }
 
+button.show-all-nodes {
+    font-size: 13px;
+    margin: 0;
+    padding: 0 20px;
+    height: 20px;
+}
+
+.panel-enabler-view.welcome {
+    z-index: auto;
+}
+
+.panel-enabler-view.welcome div.welcome-instructions-aligner {
+    display: inline-block;
+    width: 0;
+}
+
+.panel-enabler-view.welcome .instructions {
+    display: inline-block;
+    vertical-align: middle;
+    width: 330px;
+    margin: 0;
+    white-space: normal;
+    line-height: 175%;
+}
+
+.panel-enabler-view.welcome .message {
+    margin-bottom: 2ex;
+}
+
+.panel-enabler-view.welcome button.status-bar-item {
+    vertical-align: middle;
+}
+
 .pane button {
     margin: 6px 0 6px 3px;
     padding: 2px 9px;
 }
 
-.panel-enabler-view button:active, .pane button:active {
+.panel-enabler-view button:active:not(.status-bar-item), .pane button:active, button.show-all-nodes:active {
     background-color: rgb(215, 215, 215);
     background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(194, 194, 194)), to(rgb(239, 239, 239)));
 }
 
-body.inactive .panel-enabler-view button, .panel-enabler-view button:disabled, body.inactive .pane button, .pane button:disabled {
+body.inactive .panel-enabler-view button:not(.status-bar-item), .panel-enabler-view button:disabled:not(.status-bar-item), body.inactive .pane button, .pane button:disabled, body.inactive button.show-all-nodes {
     color: rgb(130, 130, 130);
     border-color: rgb(212, 212, 212);
     background-color: rgb(239, 239, 239);
@@ -2343,6 +2425,15 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     content: url(Images/debuggerStepOut.png);
 }
 
+.toggle-breakpoints .glyph {
+    -webkit-mask-image: url(Images/breakpointsActivateButtonGlyph.png);
+    background-color: rgb(96, 96, 96) !important;
+}
+
+.toggle-breakpoints.toggled-on .glyph {
+    -webkit-mask-image: url(Images/breakpointsDeactivateButtonGlyph.png);
+}
+
 #scripts-debugger-status {
     position: absolute;
     line-height: 24px;
@@ -2374,7 +2465,6 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
 
 #script-resource-views {
     display: block;
-    overflow: auto;
     padding: 0;
     position: absolute;
     top: 23px;
@@ -2413,9 +2503,14 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     -webkit-mask-image: url(Images/largerResourcesButtonGlyph.png);
 }
 
-#resources-filter {
+#resources-filter, #console-filter.console-filter-top {
     background: -webkit-gradient(linear, left top, left bottom, from(rgb(236, 236, 236)), to(rgb(217, 217, 217)));
     border-bottom: 1px solid rgb(64%, 64%, 64%);
+    width: 100%;
+}
+
+#console-messages.console-filter-top {
+    margin-top: 23px;
 }
 
 #console-filter {
@@ -2589,7 +2684,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
 
 #resources-dividers-label-bar {
     position: absolute;
-    top: 93px;
+    top: 0;
     left: 0px;
     right: 0;
     background-color: rgba(255, 255, 255, 0.8);
@@ -2676,6 +2771,10 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     margin-right: 5px;
 }
 
+.resources-graph-label.waiting-right {
+    margin-left: 5px;
+}
+
 .resources-graph-label.before {
     color: rgba(0, 0, 0, 0.7);
     text-shadow: none;
@@ -2740,7 +2839,11 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     display: block;
 }
 
-.resources-graph-bar.waiting {
+.console-user-command-result {
+    display: block;
+}
+
+.resources-graph-bar.waiting, .resources-graph-bar.waiting-right {
     opacity: 0.35;
 }
 
@@ -2796,51 +2899,6 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     -webkit-border-image: url(Images/timelineHollowPillYellow.png) 6 7 6 7;
 }
 
-.tip-button {
-    background-image: url(Images/tipIcon.png);
-    border: none;
-    width: 16px;
-    height: 16px;
-    float: right;
-    background-color: transparent;
-    margin-top: 1px;
-}
-
-.tip-button:active {
-    background-image: url(Images/tipIconPressed.png);
-}
-
-.tip-balloon {
-    position: absolute;
-    left: 145px;
-    top: -5px;
-    z-index: 1000;
-    border-width: 51px 15px 18px 37px;
-    -webkit-border-image: url(Images/tipBalloon.png) 51 15 18 37;
-    width: 265px;
-}
-
-.tip-balloon.bottom {
-    position: absolute;
-    left: 145px;
-    top: auto;
-    bottom: -7px;
-    z-index: 1000;
-    border-width: 18px 15px 51px 37px;
-    -webkit-border-image: url(Images/tipBalloonBottom.png) 18 15 51 37;
-}
-
-.tip-balloon-content {
-    margin-top: -40px;
-    margin-bottom: -2px;
-    margin-left: 2px;
-}
-
-.tip-balloon.bottom .tip-balloon-content {
-    margin-top: -10px;
-    margin-bottom: -35px;
-}
-
 #resource-views {
     position: absolute;
     top: 23px;
@@ -3011,6 +3069,7 @@ body.inactive .sidebar-tree-item .disclosure-button:active {
     padding: 1px 4px;
     text-align: center;
     font-size: 11px;
+    line-height: normal;
     font-family: Helvetica, Arial, sans-serif;
     font-weight: bold;
     text-shadow: none;
@@ -3266,20 +3325,154 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
 
 /* Timeline Style */
 
-#timeline-summary {
+#timeline-overview-panel {
     position: absolute;
     top: 0;
     left: 0;
-    width: 0;
-    height: 0;
+    right: 0;
+    height: 80px;
+}
+
+#timeline-overview-panel .timeline-graph-bar {
+    pointer-events: none;
+}
+
+.timeline-sidebar-background {
+    top: 90px;
+    bottom: 0;
+}
+
+.timeline .sidebar {
+    overflow-y: hidden;
+    z-index: 100;
+    min-height: 100%;
+    bottom: auto;
+}
+
+#timeline-overview-separator {
+    position: absolute;
+    top: 80px;
+    left: 0;
+    right: 0;
+    background: -webkit-gradient(linear, 0% 0%, 0% 100%, from(rgb(253, 253, 253)), to(rgb(213, 213, 213)));
+    border-top: 1px solid rgb(140, 140, 140);
+    border-bottom: 1px solid rgb(115, 115, 115);
+    height: 10px;
+}
+
+#timeline-overview-sidebar {
+    position: absolute;
+    width: 200px;
+    top: 0px;
+    bottom: 0px;
+    left: 0px;
+    padding-top: 1px;
+    background: -webkit-gradient(linear, 0% 0%, 0% 100%, from(rgb(242, 242, 242)), to(rgb(209, 209, 209)));
+    border-right: 1px solid rgb(163, 163, 163);
+}
+
+#timeline-overview-grid {
+    position: absolute;
+    top: 0px;
+    bottom: 0px;
+    left: 200px;
+    right: 0px;
+    background-color: rgb(224, 224, 224);
+}
+
+#timeline-overview-window {
+    background-color: white;
+    position: absolute;
+    left: 0;
+    right: 0;
+    top: 0;
+    bottom: 0;
+    z-index: 150;
+}
+
+.timeline-window-resizer {
+    position: absolute;
+    top: 35px;
+    bottom: 15px;
+    width: 5px;
+    margin-left: -3px;
+    margin-right: -2px;
+    background-color: rgb(153, 153, 153);
+    z-index: 500;
+    cursor: col-resize;
+    -webkit-border-radius: 2px;
+    -webkit-box-shadow: white 1px 0 0, white -1px 0 0, white 0 1px 0, white 0 -1px 0;
+}
+
+#timeline-overview-grid #resources-graphs {
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    height: 80px;
+}
+
+#timeline-container {
+    position: absolute;
+    top: 90px;
+    left: 0;
+    bottom: 0;
+    right: 0;
+    border-right: 0 none transparent;
+    overflow-y: auto;
+    overflow-x: hidden;
 }
 
 .timeline-clear-status-bar-item .glyph {
     -webkit-mask-image: url(Images/clearConsoleButtonGlyph.png);
 }
 
+.timeline-category-tree-item {
+    height: 20px;
+    line-height: 20px;
+    padding-left: 6px;
+    white-space: nowrap;
+    text-overflow: ellipsis;
+    overflow: hidden;
+    font-weight: bold;
+}
+
+.timeline-category-tree-item .timeline-category-checkbox {
+    width: 10px;
+    height: 11px;
+    margin: 0 3px 0 5px;
+    padding: 0;
+    background-image: url(Images/timelineCheckmarks.png);
+    background-repeat: no-repeat;
+    background-position: 0 -66px;
+    vertical-align: -1px;
+    -webkit-appearance: none;
+}
+
+.timeline-category-tree-item .timeline-category-checkbox:checked {
+    background-position-x: -10px;
+}
+
+.timeline-category-tree-item.timeline-category-loading .timeline-category-checkbox {
+    background-position-y: 0;
+}
+
+.timeline-category-tree-item.timeline-category-scripting .timeline-category-checkbox {
+    background-position-y: -33px;
+}
+
+.timeline-category-tree-item.timeline-category-rendering .timeline-category-checkbox {
+    background-position-y: -11px;
+}
+
+.timeline-category-tree-item:nth-of-type(2n) {
+    background-color: rgba(0, 0, 0, 0.05);
+}
+
 .timeline-tree-item {
     height: 18px;
+    line-height: 15px;
+    padding-right: 5px;
     padding-left: 10px;
     padding-top: 2px;
     white-space: nowrap;
@@ -3287,10 +3480,44 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     overflow: hidden;
 }
 
+.timeline-expandable {
+    position: absolute;
+    border-left: 1px solid rgb(163, 163, 163);
+}
+
+.timeline-expandable-left {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 0;
+    width: 3px;
+    border-top: 1px solid rgb(163, 163, 163);
+    border-bottom: 1px solid rgb(163, 163, 163);
+}
+
+.timeline-expandable-collapsed {
+    background-image: url(Images/disclosureTriangleSmallRightBlack.png);
+    background-position-x: 1px;
+    background-position-y: 2px;
+    background-repeat: no-repeat;
+}
+
+.timeline-expandable-expanded {
+    background-image: url(Images/disclosureTriangleSmallDownBlack.png);
+    background-position-x: 1px;
+    background-position-y: 3px;
+    background-repeat: no-repeat;
+}
+
 .timeline-tree-item .type {
     padding-left: 14px;
 }
 
+.timeline-tree-item .count {
+    font-family: Helvetica, Arial, sans-serif;
+    font-weight: bold;
+}
+
 .timeline-tree-item .timeline-tree-icon {
     background-image: url(Images/timelineDots.png);
     margin-top: 2px;
@@ -3299,7 +3526,7 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     position: absolute;
 }
 
-.timeline-tree-item:nth-of-type(2n) {
+.timeline-tree-item.even {
     background-color: rgba(0, 0, 0, 0.05);
 }
 
@@ -3307,14 +3534,12 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     color: rgba(0, 0, 0, 0.7);
 }
 
-.timeline-category-loading, .timeline-category-scripting, .timeline-category-rendering {
-    display: none;
-}
-
-.filter-all .timeline-category-loading, .filter-loading .timeline-category-loading,
-.filter-all .timeline-category-scripting, .filter-scripting .timeline-category-scripting,
-.filter-all .timeline-category-rendering, .filter-rendering .timeline-category-rendering {
-    display: list-item;
+#timeline-overview-graphs {
+    position: absolute;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    top: 20px;
 }
 
 #timeline-graphs {
@@ -3333,29 +3558,47 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     margin-top: 0px;
     border-top: 1px solid transparent;
     overflow: hidden;
+    pointer-events: none;
+}
+
+.timeline-overview-graph-side {
+    height: 20px;
+    z-index: 170;
+    pointer-events: none;
+}
+
+.timeline-overview-graph-side .timeline-graph-bar {
+    height: 13px;
 }
 
 .timeline-graph-bar-area {
     position: absolute;
     top: 0;
     bottom: 0;
-    right: 8px;
-    left: 9px;
+    right: 0;
+    left: 3px;
+    pointer-events: none;
 }
 
 .timeline-graph-bar {
     position: absolute;
     top: 0;
     bottom: 0;
-    margin: auto -5px;
+    margin: auto -2px;
     border-width: 4px 4px 5px;
     height: 9px;
-    min-width: 7px;
+    min-width: 5px;
     opacity: 0.8;
     -webkit-border-image: url(Images/timelineBarGray.png) 4 4 5 4;
+    z-index: 180;
+    pointer-events: visibleFill;
+}
+
+.timeline-graph-bar.with-children {
+    opacity: 0.3;
 }
 
-.timeline-graph-side:nth-of-type(2n) {
+.timeline-graph-side.even {
     background-color: rgba(0, 0, 0, 0.05);
 }
 
@@ -3552,6 +3795,12 @@ ol.breakpoint-list {
     text-overflow: ellipsis;
     overflow: hidden;
     margin: 4px 0;
+    color: rgb(33%, 33%, 33%);
+    cursor: pointer;
+}
+
+.breakpoint-list li:hover {
+    color: rgb(15%, 15%, 15%);
 }
 
 .breakpoint-list .checkbox-elem {
@@ -3563,22 +3812,119 @@ ol.breakpoint-list {
 }
 
 .breakpoint-list .source-text {
-    font-family: monospace;
     white-space: nowrap;
     text-overflow: ellipsis;
     overflow: hidden;
     margin: 2px 0 0px 20px;
 }
 
-.breakpoint-list a {
+.webkit-html-js-node, .webkit-html-css-node {
+    white-space: pre;
+}
+
+.source-frame-breakpoint-condition {
+    z-index: 30;
+    padding: 4px;
+    background-color: rgb(203, 226, 255);
+    -webkit-border-radius: 7px;
+    border: 2px solid rgb(169, 172, 203); 
+    width: 90%; 
+}
+
+.source-frame-breakpoint-message {
+    background-color: transparent;
+    font-family: Lucida Grande, sans-serif; 
+    font-weight: normal;
+    font-size: 11px;
+    text-align: left;
+    text-shadow: none;
+    color: rgb(85, 85, 85);
+    cursor: default;
+    margin: 0 0 2px 0; 
+}
+
+#source-frame-breakpoint-condition {
+    margin: 0;
+    border: 1px inset rgb(190, 190, 190) !important;
+    width: 100%;
+    box-shadow: none !important;
+    outline: none !important;
+    -webkit-user-modify: read-write;
+}
+
+.source-frame-popover-title {
+    text-overflow: ellipsis;
+    overflow: hidden;
+    white-space: nowrap;
+    font-weight: bold;
+    padding-left: 18px;
+}
+
+.source-frame-popover-tree {
+    border-top: 1px solid rgb(194, 194, 147);
+    overflow: auto;
+    position: absolute;
+    top: 15px;
+    bottom: 0;
+    left: 0;
+    right: 0;
+}
+
+.source-frame-eval-expression {
+    border: 1px solid rgb(163, 41, 34);
+    margin: -1px;
+    background-color: rgb(255, 255, 194);
+}
+
+.styles-sidebar-separator {
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(243, 243, 243)), color-stop(0.05, rgb(243, 243, 243)), color-stop(0.05, rgb(230, 230, 230)), to(rgb(209, 209, 209)));
+    padding: 0 5px;
+    border-top: 1px solid rgb(189, 189, 189);
+    border-bottom: 1px solid rgb(189, 189, 189);
+    color: rgb(110, 110, 110);
+    text-shadow: white 0 1px 0;
+}
+
+.timeline-details {
+    -webkit-user-select: text;
+}
+
+.timeline-details-row-title {
+    font-weight: bold;
+    text-align: right;
+    white-space: nowrap;
+}
+
+.timeline-details-row-data {
+    white-space: nowrap;
+}
+
+.timeline-details-title {
+    font-weight: bold;
+    white-space: nowrap;
+}
+
+.workers-list {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+}
+ 
+.workers-list > li {
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    margin-left: 1em;
+    font-size: 12px;
+}
+
+a.worker-item {
     color: rgb(33%, 33%, 33%);
     cursor: pointer;
+    text-decoration: none;
 }
 
-.breakpoint-list a:hover {
+a.worker-item:hover {
     color: rgb(15%, 15%, 15%);
 }
 
-.webkit-html-js-node, .webkit-html-css-node {
-    white-space: pre;
-}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
index 04ab07a2f6..4fa8ddca6a 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
@@ -29,16 +29,23 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 <html>
 <head>
     <meta http-equiv="content-type" content="text/html; charset=utf-8">
+    <link rel="stylesheet" type="text/css" href="audits.css">
     <link rel="stylesheet" type="text/css" href="inspector.css">
     <link rel="stylesheet" type="text/css" href="inspectorSyntaxHighlight.css">
+    <link rel="stylesheet" type="text/css" href="popover.css">
+    <link rel="stylesheet" type="text/css" href="textViewer.css">
     <script type="text/javascript" src="utilities.js"></script>
     <script type="text/javascript" src="treeoutline.js"></script>
     <script type="text/javascript" src="inspector.js"></script>
-    <script type="text/javascript" src="InspectorControllerStub.js"></script>
+    <script type="text/javascript" src="InspectorBackendStub.js"></script>
+    <script type="text/javascript" src="InspectorFrontendHostStub.js"></script>
     <script type="text/javascript" src="Object.js"></script>
+    <script type="text/javascript" src="Settings.js"></script>
+    <script type="text/javascript" src="Checkbox.js"></script>
+    <script type="text/javascript" src="ContextMenu.js"></script>
     <script type="text/javascript" src="KeyboardShortcut.js"></script>
     <script type="text/javascript" src="TextPrompt.js"></script>
-    <script type="text/javascript" src="Popup.js"></script>
+    <script type="text/javascript" src="Popover.js"></script>
     <script type="text/javascript" src="Placard.js"></script>
     <script type="text/javascript" src="View.js"></script>
     <script type="text/javascript" src="Callback.js"></script>
@@ -46,6 +53,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ChangesView.js"></script>
     <script type="text/javascript" src="ConsoleView.js"></script>
     <script type="text/javascript" src="Panel.js"></script>
+    <script type="text/javascript" src="TimelineGrid.js"></script>    
     <script type="text/javascript" src="AbstractTimelinePanel.js"></script>
     <script type="text/javascript" src="Resource.js"></script>
     <script type="text/javascript" src="ResourceCategory.js"></script>
@@ -53,13 +61,13 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="DOMStorage.js"></script>
     <script type="text/javascript" src="DOMStorageItemsView.js"></script>
     <script type="text/javascript" src="DataGrid.js"></script>
-    <script type="text/javascript" src="DOMStorageDataGrid.js"></script>
     <script type="text/javascript" src="CookieItemsView.js"></script>
     <script type="text/javascript" src="Script.js"></script>
     <script type="text/javascript" src="Breakpoint.js"></script>
     <script type="text/javascript" src="SidebarPane.js"></script>
     <script type="text/javascript" src="ElementsTreeOutline.js"></script>
     <script type="text/javascript" src="SidebarTreeElement.js"></script>
+    <script type="text/javascript" src="Section.js"></script>
     <script type="text/javascript" src="PropertiesSection.js"></script>
     <script type="text/javascript" src="ObjectProxy.js"></script>
     <script type="text/javascript" src="ObjectPropertiesSection.js"></script>
@@ -67,21 +75,38 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="CallStackSidebarPane.js"></script>
     <script type="text/javascript" src="ScopeChainSidebarPane.js"></script>
     <script type="text/javascript" src="WatchExpressionsSidebarPane.js"></script>
+    <script type="text/javascript" src="WorkersSidebarPane.js"></script>
     <script type="text/javascript" src="MetricsSidebarPane.js"></script>
     <script type="text/javascript" src="PropertiesSidebarPane.js"></script>
     <script type="text/javascript" src="EventListenersSidebarPane.js"></script>
     <script type="text/javascript" src="Color.js"></script>
     <script type="text/javascript" src="StylesSidebarPane.js"></script>
     <script type="text/javascript" src="PanelEnablerView.js"></script>
+    <script type="text/javascript" src="WelcomeView.js"></script>
     <script type="text/javascript" src="StatusBarButton.js"></script>
     <script type="text/javascript" src="SummaryBar.js"></script>
     <script type="text/javascript" src="ElementsPanel.js"></script>
     <script type="text/javascript" src="ResourcesPanel.js"></script>
+    <script type="text/javascript" src="InjectedFakeWorker.js"></script>
     <script type="text/javascript" src="ScriptsPanel.js"></script>
     <script type="text/javascript" src="StoragePanel.js"></script>
     <script type="text/javascript" src="ProfilesPanel.js"></script>
+    <script type="text/javascript" src="ConsolePanel.js"></script>
+    <script type="text/javascript" src="AuditsPanel.js"></script>
+    <script type="text/javascript" src="AuditResultView.js"></script>
+    <script type="text/javascript" src="AuditLauncherView.js"></script>
+    <script type="text/javascript" src="AuditRules.js"></script>
+    <script type="text/javascript" src="AuditCategories.js"></script>
     <script type="text/javascript" src="ResourceView.js"></script>
     <script type="text/javascript" src="SourceFrame.js"></script>
+    <script type="text/javascript" src="DOMSyntaxHighlighter.js"></script>
+    <script type="text/javascript" src="TextEditorModel.js"></script>
+    <script type="text/javascript" src="TextEditorHighlighter.js"></script>
+    <script type="text/javascript" src="TextViewer.js"></script>
+    <script type="text/javascript" src="SourceTokenizer.js"></script>
+    <script type="text/javascript" src="SourceCSSTokenizer.js"></script>
+    <script type="text/javascript" src="SourceHTMLTokenizer.js"></script>
+    <script type="text/javascript" src="SourceJavaScriptTokenizer.js"></script>
     <script type="text/javascript" src="SourceView.js"></script>
     <script type="text/javascript" src="FontView.js"></script>
     <script type="text/javascript" src="ImageView.js"></script>
@@ -97,6 +122,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="InjectedScriptAccess.js"></script>
     <script type="text/javascript" src="TimelineAgent.js"></script>
     <script type="text/javascript" src="TimelinePanel.js"></script>
+    <script type="text/javascript" src="TimelineOverviewPane.js"></script>
     <script type="text/javascript" src="TestController.js"></script>
 </head>
 <body class="detached">
@@ -108,11 +134,11 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
         <div class="toolbar-item close-right"><button id="close-button-right"></button></div>
     </div>
     <div id="main">
-        <div id="main-panels" tabindex="0" spellcheck="false"></div>
-        <div id="main-status-bar" class="status-bar"><div id="anchored-status-bar-items"><button id="dock-status-bar-item" class="status-bar-item toggled"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="changes-status-bar-item" class="status-bar-item hidden"></button><div id="count-items"><div id="changes-count" class="hidden"></div><div id="error-warning-count" class="hidden"></div></div></div></div>
+        <div id="main-panels" spellcheck="false"></div>
+        <div id="main-status-bar" class="status-bar"><div id="anchored-status-bar-items"><button id="dock-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="changes-status-bar-item" class="status-bar-item hidden"></button><div id="count-items"><div id="changes-count" class="hidden"></div><div id="error-warning-count" class="hidden"></div></div></div></div>
     </div>
     <div id="drawer">
-        <div id="console-view"><div id="console-messages"><div id="console-prompt" spellcheck="false"><br></div></div></div>
+        <div id="console-view"><div id="console-messages" class="monospace"><div id="console-prompt" spellcheck="false"><br></div></div></div>
         <div id="drawer-status-bar" class="status-bar"><div id="other-drawer-status-bar-items"><button id="clear-console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><div id="console-filter" class="scope-bar status-bar-item"></div></div></div>
     </div>
 </body>
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
index 083a0af75b..de6f442991 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
@@ -28,28 +28,93 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-var Preferences = {
-    showUserAgentStyles: true,
-    maxInlineTextChildLength: 80,
-    minConsoleHeight: 75,
-    minSidebarWidth: 100,
-    minElementsSidebarWidth: 200,
-    minScriptsSidebarWidth: 200,
-    showInheritedComputedStyleProperties: false,
-    styleRulesExpandedState: {},
-    showMissingLocalizedStrings: false,
-    heapProfilerPresent: false,
-    samplingCPUProfiler: false,
-    showColorNicknames: true,
-    colorFormat: "hex",
-    eventListenersFilter: "all",
-    resourcesLargeRows: true
-}
+function preloadImages()
+{
+    (new Image()).src = "Images/clearConsoleButtonGlyph.png";
+    (new Image()).src = "Images/consoleButtonGlyph.png";
+    (new Image()).src = "Images/dockButtonGlyph.png";
+    (new Image()).src = "Images/enableOutlineButtonGlyph.png";
+    (new Image()).src = "Images/enableSolidButtonGlyph.png";
+    (new Image()).src = "Images/excludeButtonGlyph.png";
+    (new Image()).src = "Images/focusButtonGlyph.png";
+    (new Image()).src = "Images/largerResourcesButtonGlyph.png";
+    (new Image()).src = "Images/nodeSearchButtonGlyph.png";
+    (new Image()).src = "Images/pauseOnExceptionButtonGlyph.png";
+    (new Image()).src = "Images/percentButtonGlyph.png";
+    (new Image()).src = "Images/recordButtonGlyph.png";
+    (new Image()).src = "Images/recordToggledButtonGlyph.png";
+    (new Image()).src = "Images/reloadButtonGlyph.png";
+    (new Image()).src = "Images/undockButtonGlyph.png";
+}
+
+preloadImages();
 
 var WebInspector = {
     resources: {},
     resourceURLMap: {},
+    cookieDomains: {},
     missingLocalizedStrings: {},
+    pendingDispatches: 0,
+
+    // RegExp groups:
+    // 1 - scheme
+    // 2 - hostname
+    // 3 - ?port
+    // 4 - ?path
+    // 5 - ?fragment
+    URLRegExp: /^(http[s]?|file):\/\/([^\/:]*)(?::([\d]+))?(?:(\/[^#]*)(?:#(.*))?)?$/i,
+    GenericURLRegExp: /^([^:]+):\/\/([^\/:]*)(?::([\d]+))?(?:(\/[^#]*)(?:#(.*))?)?$/i,
+
+    get platform()
+    {
+        if (!("_platform" in this))
+            this._platform = InspectorFrontendHost.platform();
+
+        return this._platform;
+    },
+
+    get platformFlavor()
+    {
+        if (!("_platformFlavor" in this))
+            this._platformFlavor = this._detectPlatformFlavor();
+
+        return this._platformFlavor;
+    },
+
+    _detectPlatformFlavor: function()
+    {
+        const userAgent = navigator.userAgent;
+
+        if (this.platform === "windows") {
+            var match = userAgent.match(/Windows NT (\d+)\.(?:\d+)/);
+            if (match && match[1] >= 6)
+                return WebInspector.PlatformFlavor.WindowsVista;
+            return null;
+        } else if (this.platform === "mac") {
+            var match = userAgent.match(/Mac OS X\s*(?:(\d+)_(\d+))?/);
+            if (!match || match[1] != 10)
+                return WebInspector.PlatformFlavor.MacSnowLeopard;
+            switch (Number(match[2])) {
+                case 4:
+                    return WebInspector.PlatformFlavor.MacTiger;
+                case 5:
+                    return WebInspector.PlatformFlavor.MacLeopard;
+                case 6:
+                default:
+                    return WebInspector.PlatformFlavor.MacSnowLeopard;
+            }
+        }
+
+        return null;
+    },
+
+    get port()
+    {
+        if (!("_port" in this))
+            this._port = InspectorFrontendHost.port();
+
+        return this._port;
+    },
 
     get previousFocusElement()
     {
@@ -126,43 +191,31 @@ var WebInspector = {
 
         for (var panelName in WebInspector.panels) {
             if (WebInspector.panels[panelName] == x)
-                InspectorController.storeLastActivePanel(panelName);
+                InspectorBackend.storeLastActivePanel(panelName);
         }
     },
 
     _createPanels: function()
     {
-        var hiddenPanels = (InspectorController.hiddenPanels() || "").split(',');
+        var hiddenPanels = (InspectorFrontendHost.hiddenPanels() || "").split(',');
         if (hiddenPanels.indexOf("elements") === -1)
             this.panels.elements = new WebInspector.ElementsPanel();
         if (hiddenPanels.indexOf("resources") === -1)
             this.panels.resources = new WebInspector.ResourcesPanel();
         if (hiddenPanels.indexOf("scripts") === -1)
             this.panels.scripts = new WebInspector.ScriptsPanel();
+        if (hiddenPanels.indexOf("timeline") === -1)
+            this.panels.timeline = new WebInspector.TimelinePanel();
         if (hiddenPanels.indexOf("profiles") === -1) {
             this.panels.profiles = new WebInspector.ProfilesPanel();
             this.panels.profiles.registerProfileType(new WebInspector.CPUProfileType());
         }
-        if (hiddenPanels.indexOf("timeline") === -1 && hiddenPanels.indexOf("timeline") === -1)
-            this.panels.timeline = new WebInspector.TimelinePanel();
-
         if (hiddenPanels.indexOf("storage") === -1 && hiddenPanels.indexOf("databases") === -1)
             this.panels.storage = new WebInspector.StoragePanel();
-    },
-
-    _loadPreferences: function()
-    {
-        var colorFormat = InspectorController.setting("color-format");
-        if (colorFormat)
-            Preferences.colorFormat = colorFormat;
-
-        var eventListenersFilter = InspectorController.setting("event-listeners-filter");
-        if (eventListenersFilter)
-            Preferences.eventListenersFilter = eventListenersFilter;
-
-        var resourcesLargeRows = InspectorController.setting("resources-large-rows");
-        if (typeof resourcesLargeRows !== "undefined")
-            Preferences.resourcesLargeRows = resourcesLargeRows;
+        if (Preferences.auditsPanelEnabled && hiddenPanels.indexOf("audits") === -1)
+            this.panels.audits = new WebInspector.AuditsPanel();
+        if (hiddenPanels.indexOf("console") === -1)
+            this.panels.console = new WebInspector.ConsolePanel();
     },
 
     get attached()
@@ -183,12 +236,12 @@ var WebInspector = {
         var body = document.body;
 
         if (x) {
-            InspectorController.attach();
+            InspectorFrontendHost.attach();
             body.removeStyleClass("detached");
             body.addStyleClass("attached");
             dockToggleButton.title = WebInspector.UIString("Undock into separate window.");
         } else {
-            InspectorController.detach();
+            InspectorFrontendHost.detach();
             body.removeStyleClass("attached");
             body.addStyleClass("detached");
             dockToggleButton.title = WebInspector.UIString("Dock to main window.");
@@ -357,24 +410,35 @@ var WebInspector = {
         }
 
         if (this._hoveredDOMNode) {
-            InspectorController.highlightDOMNode(this._hoveredDOMNode.id);
+            InspectorBackend.highlightDOMNode(this._hoveredDOMNode.id);
             this.showingDOMNodeHighlight = true;
         } else {
-            InspectorController.hideDOMNodeHighlight();
+            InspectorBackend.hideDOMNodeHighlight();
             this.showingDOMNodeHighlight = false;
         }
     }
 }
 
+WebInspector.PlatformFlavor = {
+    WindowsVista: "windows-vista",
+    MacTiger: "mac-tiger",
+    MacLeopard: "mac-leopard",
+    MacSnowLeopard: "mac-snowleopard"
+}
+
 WebInspector.loaded = function()
 {
-    var platform = InspectorController.platform();
+    InspectorBackend.setInjectedScriptSource("(" + injectedScriptConstructor + ");");
+
+    var platform = WebInspector.platform;
     document.body.addStyleClass("platform-" + platform);
-    var port = InspectorController.port();
+    var flavor = WebInspector.platformFlavor;
+    if (flavor)
+        document.body.addStyleClass("platform-" + flavor);
+    var port = WebInspector.port;
     document.body.addStyleClass("port-" + port);
 
-    this._loadPreferences();
-    this.pendingDispatches = 0;
+    this.settings = new WebInspector.Settings();
 
     this.drawer = new WebInspector.Drawer();
     this.console = new WebInspector.ConsoleView(this.drawer);
@@ -401,17 +465,8 @@ WebInspector.loaded = function()
     var previousToolbarItem = toolbarElement.children[0];
 
     this.panelOrder = [];
-    for (var panelName in this.panels) {
-        var panel = this.panels[panelName];
-        var panelToolbarItem = panel.toolbarItem;
-        this.panelOrder.push(panel);
-        panelToolbarItem.addEventListener("click", this._toolbarItemClicked.bind(this));
-        if (previousToolbarItem)
-            toolbarElement.insertBefore(panelToolbarItem, previousToolbarItem.nextSibling);
-        else
-            toolbarElement.insertBefore(panelToolbarItem, toolbarElement.firstChild);
-        previousToolbarItem = panelToolbarItem;
-    }
+    for (var panelName in this.panels)
+        previousToolbarItem = WebInspector.addPanelToolbarIcon(toolbarElement, this.panels[panelName], previousToolbarItem);
 
     this.Tips = {
         ResourceNotCompressed: {id: 0, message: WebInspector.UIString("You could save bandwidth by having your web server compress this transfer with gzip or zlib.")}
@@ -423,25 +478,13 @@ WebInspector.loaded = function()
 
     this.addMainEventListeners(document);
 
-    window.addEventListener("unload", this.windowUnload.bind(this), true);
     window.addEventListener("resize", this.windowResize.bind(this), true);
 
     document.addEventListener("focus", this.focusChanged.bind(this), true);
-    document.addEventListener("keydown", this.documentKeyDown.bind(this), true);
-    document.addEventListener("keyup", this.documentKeyUp.bind(this), true);
+    document.addEventListener("keydown", this.documentKeyDown.bind(this), false);
     document.addEventListener("beforecopy", this.documentCanCopy.bind(this), true);
     document.addEventListener("copy", this.documentCopy.bind(this), true);
-    document.addEventListener("contextmenu", this.contextMenu.bind(this), true);
-
-    var mainPanelsElement = document.getElementById("main-panels");
-    mainPanelsElement.handleKeyEvent = this.mainKeyDown.bind(this);
-    mainPanelsElement.handleKeyUpEvent = this.mainKeyUp.bind(this);
-    mainPanelsElement.handleCopyEvent = this.mainCopy.bind(this);
-
-    // Focus the mainPanelsElement in a timeout so it happens after the initial focus,
-    // so it doesn't get reset to the first toolbar button. This initial focus happens
-    // on Mac when the window is made key and the WebHTMLView becomes the first responder.
-    setTimeout(function() { WebInspector.currentFocusElement = mainPanelsElement }, 0);
+    document.addEventListener("contextmenu", this.contextMenuEventFired.bind(this), true);
 
     var dockToggleButton = document.getElementById("dock-status-bar-item");
     dockToggleButton.addEventListener("click", this.toggleAttach.bind(this), false);
@@ -463,23 +506,37 @@ WebInspector.loaded = function()
 
     var searchField = document.getElementById("search");
     searchField.addEventListener("search", this.performSearch.bind(this), false); // when the search is emptied
+    searchField.addEventListener("mousedown", this._searchFieldManualFocus.bind(this), false); // when the search field is manually selected
+    searchField.addEventListener("keydown", this._searchKeyDown.bind(this), true);
 
     toolbarElement.addEventListener("mousedown", this.toolbarDragStart, true);
     document.getElementById("close-button-left").addEventListener("click", this.close, true);
     document.getElementById("close-button-right").addEventListener("click", this.close, true);
 
-    InspectorController.loaded();
+    InspectorFrontendHost.loaded();
+}
+
+WebInspector.addPanelToolbarIcon = function(toolbarElement, panel, previousToolbarItem)
+{
+    var panelToolbarItem = panel.toolbarItem;
+    this.panelOrder.push(panel);
+    panelToolbarItem.addEventListener("click", this._toolbarItemClicked.bind(this));
+    if (previousToolbarItem)
+        toolbarElement.insertBefore(panelToolbarItem, previousToolbarItem.nextSibling);
+    else
+        toolbarElement.insertBefore(panelToolbarItem, toolbarElement.firstChild);
+    return panelToolbarItem;
 }
 
 var windowLoaded = function()
 {
-    var localizedStringsURL = InspectorController.localizedStringsURL();
+    var localizedStringsURL = InspectorFrontendHost.localizedStringsURL();
     if (localizedStringsURL) {
         var localizedStringsScriptElement = document.createElement("script");
         localizedStringsScriptElement.addEventListener("load", WebInspector.loaded.bind(WebInspector), false);
         localizedStringsScriptElement.type = "text/javascript";
         localizedStringsScriptElement.src = localizedStringsURL;
-        document.getElementsByTagName("head").item(0).appendChild(localizedStringsScriptElement);
+        document.head.appendChild(localizedStringsScriptElement);
     } else
         WebInspector.loaded();
 
@@ -504,15 +561,11 @@ WebInspector.dispatch = function() {
     setTimeout(delayDispatch, 0);
 }
 
-WebInspector.windowUnload = function(event)
-{
-    InspectorController.windowUnloading();
-}
-
 WebInspector.windowResize = function(event)
 {
-    if (this.currentPanel && this.currentPanel.resize)
+    if (this.currentPanel)
         this.currentPanel.resize();
+    this.drawer.resize();
 }
 
 WebInspector.windowFocused = function(event)
@@ -545,7 +598,36 @@ WebInspector.setAttachedWindow = function(attached)
 
 WebInspector.close = function(event)
 {
-    InspectorController.closeWindow();
+    if (this._isClosing)
+        return;
+    this._isClosing = true;
+    InspectorFrontendHost.closeWindow();
+}
+
+WebInspector.inspectedPageDestroyed = function()
+{
+    WebInspector.close();
+}
+
+WebInspector.documentMouseOver = function(event)
+{
+    if (event.target.tagName !== "A")
+        return;
+
+    const anchor = event.target;
+    if (!anchor.hasStyleClass("webkit-html-resource-link"))
+        return;
+    if (anchor.href && anchor.href.indexOf("/data:") != -1)
+        return;
+    if (WebInspector.canShowSourceLine(anchor.href, anchor.lineNumber, anchor.preferredPanel) || WebInspector.ProfileType.URLRegExp.exec(anchor.href)) {
+        if (event.target.originalTitle)
+            event.target.title = event.target.originalTitle;
+        return;
+    }
+
+    if (!event.target.originalTitle)
+        event.target.originalTitle = event.target.title;
+    event.target.title = WebInspector.UIString("Cannot open this link. Make sure that resource tracking is enabled in the Resources panel.");
 }
 
 WebInspector.documentClick = function(event)
@@ -556,21 +638,35 @@ WebInspector.documentClick = function(event)
 
     // Prevent the link from navigating, since we don't do any navigation by following links normally.
     event.preventDefault();
+    event.stopPropagation();
 
     function followLink()
     {
         // FIXME: support webkit-html-external-link links here.
-        if (anchor.href in WebInspector.resourceURLMap) {
+        if (WebInspector.canShowSourceLine(anchor.href, anchor.lineNumber, anchor.preferredPanel)) {
             if (anchor.hasStyleClass("webkit-html-external-link")) {
                 anchor.removeStyleClass("webkit-html-external-link");
                 anchor.addStyleClass("webkit-html-resource-link");
             }
 
-            WebInspector.showResourceForURL(anchor.href, anchor.lineNumber, anchor.preferredPanel);
-        } else {
-            var profileString = WebInspector.ProfileType.URLRegExp.exec(anchor.href);
-            if (profileString)
-                WebInspector.showProfileForURL(anchor.href);
+            WebInspector.showSourceLine(anchor.href, anchor.lineNumber, anchor.preferredPanel);
+            return;
+        }
+
+        const profileMatch = WebInspector.ProfileType.URLRegExp.exec(anchor.href);
+        if (profileMatch) {
+            WebInspector.showProfileForURL(anchor.href);
+            return;
+        }
+
+        const urlMatch = WebInspector.GenericURLRegExp.exec(anchor.href);
+        if (urlMatch && urlMatch[1] === "webkit-link-action") {
+            if (urlMatch[2] === "show-panel") {
+                const panel = urlMatch[4].substring(1);
+                if (WebInspector.panels[panel])
+                    WebInspector.currentPanel = WebInspector.panels[panel];
+            }
+            return;
         }
     }
 
@@ -590,166 +686,157 @@ WebInspector.documentClick = function(event)
 
 WebInspector.documentKeyDown = function(event)
 {
-    if (!this.currentFocusElement)
-        return;
-    if (this.currentFocusElement.handleKeyEvent)
+    if (this.currentFocusElement && this.currentFocusElement.handleKeyEvent) {
         this.currentFocusElement.handleKeyEvent(event);
-    else if (this.currentFocusElement.id && this.currentFocusElement.id.length && WebInspector[this.currentFocusElement.id + "KeyDown"])
-        WebInspector[this.currentFocusElement.id + "KeyDown"](event);
+        if (event.handled) {
+            event.preventDefault();
+            return;
+        }
+    }
 
-    if (!event.handled) {
-        var isMac = InspectorController.platform().indexOf("mac-") === 0;
+    if (this.currentPanel && this.currentPanel.handleShortcut) {
+        this.currentPanel.handleShortcut(event);
+        if (event.handled) {
+            event.preventDefault();
+            return;
+        }
+    }
 
-        switch (event.keyIdentifier) {
-            case "U+001B": // Escape key
-                this.drawer.visible = !this.drawer.visible;
-                event.preventDefault();
-                break;
+    var isMac = WebInspector.isMac();
 
-            case "U+0046": // F key
-                if (isMac)
-                    var isFindKey = event.metaKey && !event.ctrlKey && !event.altKey && !event.shiftKey;
-                else
-                    var isFindKey = event.ctrlKey && !event.metaKey && !event.altKey && !event.shiftKey;
+    switch (event.keyIdentifier) {
+        case "U+001B": // Escape key
+            event.preventDefault();
+            if (this.drawer.fullPanel)
+                return;
 
-                if (isFindKey) {
-                    var searchField = document.getElementById("search");
-                    searchField.focus();
-                    searchField.select();
-                    event.preventDefault();
-                }
+            this.drawer.visible = !this.drawer.visible;
+            break;
 
-                break;
+        case "U+0046": // F key
+            if (isMac)
+                var isFindKey = event.metaKey && !event.ctrlKey && !event.altKey && !event.shiftKey;
+            else
+                var isFindKey = event.ctrlKey && !event.metaKey && !event.altKey && !event.shiftKey;
 
-            case "U+0047": // G key
-                if (isMac)
-                    var isFindAgainKey = event.metaKey && !event.ctrlKey && !event.altKey;
-                else
-                    var isFindAgainKey = event.ctrlKey && !event.metaKey && !event.altKey;
-
-                if (isFindAgainKey) {
-                    if (event.shiftKey) {
-                        if (this.currentPanel.jumpToPreviousSearchResult)
-                            this.currentPanel.jumpToPreviousSearchResult();
-                    } else if (this.currentPanel.jumpToNextSearchResult)
-                        this.currentPanel.jumpToNextSearchResult();
-                    event.preventDefault();
-                }
+            if (isFindKey) {
+                WebInspector.focusSearchField();
+                event.preventDefault();
+            }
+            break;
 
-                break;
+        case "F3":
+            if (!isMac) {
+                WebInspector.focusSearchField();
+                event.preventDefault();
+            }
+            break;
 
-            // Windows and Mac have two different definitions of [, so accept both.
-            case "U+005B":
-            case "U+00DB": // [ key
-                if (isMac)
-                    var isRotateLeft = event.metaKey && !event.shiftKey && !event.ctrlKey && !event.altKey;
-                else
-                    var isRotateLeft = event.ctrlKey && !event.shiftKey && !event.metaKey && !event.altKey;
+        case "U+0047": // G key
+            if (isMac)
+                var isFindAgainKey = event.metaKey && !event.ctrlKey && !event.altKey;
+            else
+                var isFindAgainKey = event.ctrlKey && !event.metaKey && !event.altKey;
+
+            if (isFindAgainKey) {
+                if (event.shiftKey) {
+                    if (this.currentPanel.jumpToPreviousSearchResult)
+                        this.currentPanel.jumpToPreviousSearchResult();
+                } else if (this.currentPanel.jumpToNextSearchResult)
+                    this.currentPanel.jumpToNextSearchResult();
+                event.preventDefault();
+            }
 
-                if (isRotateLeft) {
-                    var index = this.panelOrder.indexOf(this.currentPanel);
-                    index = (index === 0) ? this.panelOrder.length - 1 : index - 1;
-                    this.panelOrder[index].toolbarItem.click();
-                    event.preventDefault();
-                }
+            break;
 
-                break;
+        // Windows and Mac have two different definitions of [, so accept both.
+        case "U+005B":
+        case "U+00DB": // [ key
+            if (isMac)
+                var isRotateLeft = event.metaKey && !event.shiftKey && !event.ctrlKey && !event.altKey;
+            else
+                var isRotateLeft = event.ctrlKey && !event.shiftKey && !event.metaKey && !event.altKey;
 
-            // Windows and Mac have two different definitions of ], so accept both.
-            case "U+005D":
-            case "U+00DD":  // ] key
-                if (isMac)
-                    var isRotateRight = event.metaKey && !event.shiftKey && !event.ctrlKey && !event.altKey;
-                else
-                    var isRotateRight = event.ctrlKey && !event.shiftKey && !event.metaKey && !event.altKey;
+            if (isRotateLeft) {
+                var index = this.panelOrder.indexOf(this.currentPanel);
+                index = (index === 0) ? this.panelOrder.length - 1 : index - 1;
+                this.panelOrder[index].toolbarItem.click();
+                event.preventDefault();
+            }
 
-                if (isRotateRight) {
-                    var index = this.panelOrder.indexOf(this.currentPanel);
-                    index = (index + 1) % this.panelOrder.length;
-                    this.panelOrder[index].toolbarItem.click();
-                    event.preventDefault();
-                }
+            break;
 
-                break;
-        }
-    }
-}
+        // Windows and Mac have two different definitions of ], so accept both.
+        case "U+005D":
+        case "U+00DD":  // ] key
+            if (isMac)
+                var isRotateRight = event.metaKey && !event.shiftKey && !event.ctrlKey && !event.altKey;
+            else
+                var isRotateRight = event.ctrlKey && !event.shiftKey && !event.metaKey && !event.altKey;
 
-WebInspector.documentKeyUp = function(event)
-{
-    if (!this.currentFocusElement || !this.currentFocusElement.handleKeyUpEvent)
-        return;
-    this.currentFocusElement.handleKeyUpEvent(event);
+            if (isRotateRight) {
+                var index = this.panelOrder.indexOf(this.currentPanel);
+                index = (index + 1) % this.panelOrder.length;
+                this.panelOrder[index].toolbarItem.click();
+                event.preventDefault();
+            }
+
+            break;
+
+        case "U+0052": // R key
+            if ((event.metaKey && isMac) || (event.ctrlKey && !isMac))
+                InspectorBackend.reloadPage();
+            break;
+        case "F5":
+            if (!isMac)
+                InspectorBackend.reloadPage();
+            break;
+    }
 }
 
 WebInspector.documentCanCopy = function(event)
 {
-    if (!this.currentFocusElement)
-        return;
-    // Calling preventDefault() will say "we support copying, so enable the Copy menu".
-    if (this.currentFocusElement.handleCopyEvent)
-        event.preventDefault();
-    else if (this.currentFocusElement.id && this.currentFocusElement.id.length && WebInspector[this.currentFocusElement.id + "Copy"])
+    if (this.currentPanel && this.currentPanel.handleCopyEvent)
         event.preventDefault();
 }
 
 WebInspector.documentCopy = function(event)
 {
-    if (!this.currentFocusElement)
-        return;
-    if (this.currentFocusElement.handleCopyEvent)
-        this.currentFocusElement.handleCopyEvent(event);
-    else if (this.currentFocusElement.id && this.currentFocusElement.id.length && WebInspector[this.currentFocusElement.id + "Copy"])
-        WebInspector[this.currentFocusElement.id + "Copy"](event);
+    if (this.currentPanel && this.currentPanel.handleCopyEvent)
+        this.currentPanel.handleCopyEvent(event);
 }
 
-WebInspector.contextMenu = function(event)
+WebInspector.contextMenuEventFired = function(event)
 {
     if (event.handled || event.target.hasStyleClass("popup-glasspane"))
         event.preventDefault();
 }
 
-WebInspector.mainKeyDown = function(event)
+WebInspector.animateStyle = function(animations, duration, callback)
 {
-    if (this.currentPanel && this.currentPanel.handleKeyEvent)
-        this.currentPanel.handleKeyEvent(event);
-}
+    var interval;
+    var complete = 0;
 
-WebInspector.mainKeyUp = function(event)
-{
-    if (this.currentPanel && this.currentPanel.handleKeyUpEvent)
-        this.currentPanel.handleKeyUpEvent(event);
-}
+    const intervalDuration = (1000 / 30); // 30 frames per second.
+    const animationsLength = animations.length;
+    const propertyUnit = {opacity: ""};
+    const defaultUnit = "px";
 
-WebInspector.mainCopy = function(event)
-{
-    if (this.currentPanel && this.currentPanel.handleCopyEvent)
-        this.currentPanel.handleCopyEvent(event);
-}
-
-WebInspector.animateStyle = function(animations, duration, callback, complete)
-{
-    if (complete === undefined)
-        complete = 0;
-    var slice = (1000 / 30); // 30 frames per second
-
-    var defaultUnit = "px";
-    var propertyUnit = {opacity: ""};
+    function cubicInOut(t, b, c, d)
+    {
+        if ((t/=d/2) < 1) return c/2*t*t*t + b;
+        return c/2*((t-=2)*t*t + 2) + b;
+    }
 
-    for (var i = 0; i < animations.length; ++i) {
+    // Pre-process animations.
+    for (var i = 0; i < animationsLength; ++i) {
         var animation = animations[i];
-        var element = null;
-        var start = null;
-        var current = null;
-        var end = null;
-        var key = null;
+        var element = null, start = null, end = null, key = null;
         for (key in animation) {
             if (key === "element")
                 element = animation[key];
             else if (key === "start")
                 start = animation[key];
-            else if (key === "current")
-                current = animation[key];
             else if (key === "end")
                 end = animation[key];
         }
@@ -757,49 +844,54 @@ WebInspector.animateStyle = function(animations, duration, callback, complete)
         if (!element || !end)
             continue;
 
-        var computedStyle = element.ownerDocument.defaultView.getComputedStyle(element);
         if (!start) {
+            var computedStyle = element.ownerDocument.defaultView.getComputedStyle(element);
             start = {};
             for (key in end)
                 start[key] = parseInt(computedStyle.getPropertyValue(key));
             animation.start = start;
-        } else if (complete == 0)
+        } else
             for (key in start)
                 element.style.setProperty(key, start[key] + (key in propertyUnit ? propertyUnit[key] : defaultUnit));
+    }
 
-        if (!current) {
-            current = {};
-            for (key in start)
-                current[key] = start[key];
-            animation.current = current;
-        }
-
-        function cubicInOut(t, b, c, d)
-        {
-            if ((t/=d/2) < 1) return c/2*t*t*t + b;
-            return c/2*((t-=2)*t*t + 2) + b;
+    function animateLoop()
+    {
+        // Advance forward.
+        complete += intervalDuration;
+        var next = complete + intervalDuration;
+
+        // Make style changes.
+        for (var i = 0; i < animationsLength; ++i) {
+            var animation = animations[i];
+            var element = animation.element;
+            var start = animation.start;
+            var end = animation.end;
+            if (!element || !end)
+                continue;
+
+            var style = element.style;
+            for (key in end) {
+                var endValue = end[key];
+                if (next < duration) {
+                    var startValue = start[key];
+                    var newValue = cubicInOut(complete, startValue, endValue - startValue, duration);
+                    style.setProperty(key, newValue + (key in propertyUnit ? propertyUnit[key] : defaultUnit));
+                } else
+                    style.setProperty(key, endValue + (key in propertyUnit ? propertyUnit[key] : defaultUnit));
+            }
         }
 
-        var style = element.style;
-        for (key in end) {
-            var startValue = start[key];
-            var currentValue = current[key];
-            var endValue = end[key];
-            if ((complete + slice) < duration) {
-                var delta = (endValue - startValue) / (duration / slice);
-                var newValue = cubicInOut(complete, startValue, endValue - startValue, duration);
-                style.setProperty(key, newValue + (key in propertyUnit ? propertyUnit[key] : defaultUnit));
-                current[key] = newValue;
-            } else {
-                style.setProperty(key, endValue + (key in propertyUnit ? propertyUnit[key] : defaultUnit));
-            }
+        // End condition.
+        if (complete >= duration) {
+            clearInterval(interval);
+            if (callback)
+                callback();
         }
     }
 
-    if (complete < duration)
-        setTimeout(WebInspector.animateStyle, slice, animations, duration, callback, complete + slice);
-    else if (callback)
-        callback();
+    interval = setInterval(animateLoop, intervalDuration);
+    return interval;
 }
 
 WebInspector.updateSearchLabel = function()
@@ -816,14 +908,25 @@ WebInspector.updateSearchLabel = function()
     }
 }
 
+WebInspector.focusSearchField = function()
+{
+    var searchField = document.getElementById("search");
+    searchField.focus();
+    searchField.select();
+}
+
 WebInspector.toggleAttach = function()
 {
+    if (!this.attached && !InspectorFrontendHost.canAttachWindow())
+        return;
+
     this.attached = !this.attached;
+    this.drawer.resize();
 }
 
 WebInspector.toolbarDragStart = function(event)
 {
-    if ((!WebInspector.attached && InspectorController.platform() !== "mac-leopard") || InspectorController.port() == "qt")
+    if ((!WebInspector.attached && WebInspector.platformFlavor !== WebInspector.PlatformFlavor.MacLeopard && WebInspector.platformFlavor !== WebInspector.PlatformFlavor.MacSnowLeopard) || WebInspector.port == "qt")
         return;
 
     var target = event.target;
@@ -857,14 +960,14 @@ WebInspector.toolbarDrag = function(event)
     if (WebInspector.attached) {
         var height = window.innerHeight - (event.screenY - toolbar.lastScreenY);
 
-        InspectorController.setAttachedWindowHeight(height);
+        InspectorFrontendHost.setAttachedWindowHeight(height);
     } else {
         var x = event.screenX - toolbar.lastScreenX;
         var y = event.screenY - toolbar.lastScreenY;
 
         // We cannot call window.moveBy here because it restricts the movement
         // of the window at the edges.
-        InspectorController.moveByUnrestricted(x, y);
+        InspectorFrontendHost.moveWindowBy(x, y);
     }
 
     toolbar.lastScreenX = event.screenX;
@@ -927,6 +1030,11 @@ WebInspector.showScriptsPanel = function()
     this.currentPanel = this.panels.scripts;
 }
 
+WebInspector.showTimelinePanel = function()
+{
+    this.currentPanel = this.panels.timeline;
+}
+
 WebInspector.showProfilesPanel = function()
 {
     this.currentPanel = this.panels.profiles;
@@ -937,32 +1045,19 @@ WebInspector.showStoragePanel = function()
     this.currentPanel = this.panels.storage;
 }
 
-WebInspector.addResource = function(identifier, payload)
+WebInspector.showConsolePanel = function()
 {
-    var resource = new WebInspector.Resource(
-        payload.requestHeaders,
-        payload.requestURL,
-        payload.host,
-        payload.path,
-        payload.lastPathComponent,
-        identifier,
-        payload.isMainResource,
-        payload.cached,
-        payload.requestMethod,
-        payload.requestFormData);
-    this.resources[identifier] = resource;
-    this.resourceURLMap[resource.url] = resource;
-
-    if (resource.mainResource)
-        this.mainResource = resource;
+    this.currentPanel = this.panels.console;
+}
 
-    if (this.panels.resources)
-        this.panels.resources.addResource(resource);
+WebInspector.showAuditsPanel = function()
+{
+    this.currentPanel = this.panels.audits;
 }
 
 WebInspector.clearConsoleMessages = function()
 {
-    WebInspector.console.clearMessages(false);
+    WebInspector.console.clearMessages();
 }
 
 WebInspector.selectDatabase = function(o)
@@ -980,18 +1075,36 @@ WebInspector.selectDOMStorage = function(o)
 WebInspector.updateResource = function(identifier, payload)
 {
     var resource = this.resources[identifier];
-    if (!resource)
-        return;
+    if (!resource) {
+        resource = new WebInspector.Resource(identifier, payload.url);
+        this.resources[identifier] = resource;
+        this.resourceURLMap[resource.url] = resource;
+        if (this.panels.resources)
+            this.panels.resources.addResource(resource);
+        if (this.panels.audits)
+            this.panels.audits.resourceStarted(resource);
+    }
 
     if (payload.didRequestChange) {
-        resource.url = payload.url;
-        resource.domain = payload.domain;
+        resource.domain = payload.host;
         resource.path = payload.path;
         resource.lastPathComponent = payload.lastPathComponent;
         resource.requestHeaders = payload.requestHeaders;
         resource.mainResource = payload.mainResource;
         resource.requestMethod = payload.requestMethod;
         resource.requestFormData = payload.requestFormData;
+        resource.cached = payload.cached;
+        resource.documentURL = payload.documentURL;
+
+        if (resource.mainResource)
+            this.mainResource = resource;
+
+        var match = payload.documentURL.match(WebInspector.URLRegExp);
+        if (match) {
+            var protocol = match[1].toLowerCase();
+            if (protocol.indexOf("http") === 0 || protocol === "file")
+                this._addCookieDomain(protocol === "file" ? "" : match[2]);
+        }
     }
 
     if (payload.didResponseChange) {
@@ -1008,12 +1121,14 @@ WebInspector.updateResource = function(identifier, payload)
     }
 
     if (payload.didLengthChange) {
-        resource.contentLength = payload.contentLength;
+        resource.resourceSize = payload.resourceSize;
     }
 
     if (payload.didCompletionChange) {
         resource.failed = payload.failed;
         resource.finished = payload.finished;
+        if (this.panels.audits)
+            this.panels.audits.resourceFinished(resource);
     }
 
     if (payload.didTimingChange) {
@@ -1023,20 +1138,24 @@ WebInspector.updateResource = function(identifier, payload)
             resource.responseReceivedTime = payload.responseReceivedTime;
         if (payload.endTime)
             resource.endTime = payload.endTime;
-        
+
         if (payload.loadEventTime) {
             // This loadEventTime is for the main resource, and we want to show it
             // for all resources on this page. This means we want to set it as a member
             // of the resources panel instead of the individual resource.
             if (this.panels.resources)
                 this.panels.resources.mainResourceLoadTime = payload.loadEventTime;
+            if (this.panels.audits)
+                this.panels.audits.mainResourceLoadTime = payload.loadEventTime;
         }
-        
+
         if (payload.domContentEventTime) {
             // This domContentEventTime is for the main resource, so it should go in
             // the resources panel for the same reasons as above.
             if (this.panels.resources)
                 this.panels.resources.mainResourceDOMContentTime = payload.domContentEventTime;
+            if (this.panels.audits)
+                this.panels.audits.mainResourceDOMContentTime = payload.domContentEventTime;
         }
     }
 }
@@ -1057,6 +1176,8 @@ WebInspector.removeResource = function(identifier)
 
 WebInspector.addDatabase = function(payload)
 {
+    if (!this.panels.storage)
+        return;
     var database = new WebInspector.Database(
         payload.id,
         payload.domain,
@@ -1065,14 +1186,22 @@ WebInspector.addDatabase = function(payload)
     this.panels.storage.addDatabase(database);
 }
 
-WebInspector.addCookieDomain = function(domain)
+WebInspector._addCookieDomain = function(domain)
 {
-    if (this.panels.storage)
-        this.panels.storage.addCookieDomain(domain);
+    // Eliminate duplicate domains from the list.
+    if (domain in this.cookieDomains)
+        return;
+    this.cookieDomains[domain] = true;
+
+    if (!this.panels.storage)
+        return;
+    this.panels.storage.addCookieDomain(domain);
 }
 
 WebInspector.addDOMStorage = function(payload)
 {
+    if (!this.panels.storage)
+        return;
     var domStorage = new WebInspector.DOMStorage(
         payload.id,
         payload.host,
@@ -1082,6 +1211,8 @@ WebInspector.addDOMStorage = function(payload)
 
 WebInspector.updateDOMStorage = function(storageId)
 {
+    if (!this.panels.storage)
+        return;
     this.panels.storage.updateDOMStorage(storageId);
 }
 
@@ -1095,6 +1226,17 @@ WebInspector.resourceTrackingWasDisabled = function()
     this.panels.resources.resourceTrackingWasDisabled();
 }
 
+
+WebInspector.searchingForNodeWasEnabled = function()
+{
+    this.panels.elements.searchingForNodeWasEnabled();
+}
+
+WebInspector.searchingForNodeWasDisabled = function()
+{
+    this.panels.elements.searchingForNodeWasDisabled();
+}
+
 WebInspector.attachDebuggerWhenShown = function()
 {
     this.panels.scripts.attachDebuggerWhenShown();
@@ -1105,6 +1247,11 @@ WebInspector.debuggerWasEnabled = function()
     this.panels.scripts.debuggerWasEnabled();
 }
 
+WebInspector.updatePauseOnExceptionsState = function(pauseOnExceptionsState)
+{
+    this.panels.scripts.updatePauseOnExceptionsState(pauseOnExceptionsState);
+}
+
 WebInspector.debuggerWasDisabled = function()
 {
     this.panels.scripts.debuggerWasDisabled();
@@ -1125,6 +1272,13 @@ WebInspector.parsedScriptSource = function(sourceID, sourceURL, source, starting
     this.panels.scripts.addScript(sourceID, sourceURL, source, startingLine);
 }
 
+WebInspector.restoredBreakpoint = function(sourceID, sourceURL, line, enabled, condition)
+{
+    var breakpoint = new WebInspector.Breakpoint(sourceURL, line, sourceID, condition);
+    breakpoint.enabled = enabled;
+    this.panels.scripts.addBreakpoint(breakpoint);
+}
+
 WebInspector.failedToParseScriptSource = function(sourceURL, source, startingLine, errorLine, errorMessage)
 {
     this.panels.scripts.addScript(null, sourceURL, source, startingLine, errorLine, errorMessage);
@@ -1162,6 +1316,7 @@ WebInspector.reset = function()
 
     this.resources = {};
     this.resourceURLMap = {};
+    this.cookieDomains = {};
     this.hoveredDOMNode = null;
 
     delete this.mainResource;
@@ -1169,6 +1324,16 @@ WebInspector.reset = function()
     this.console.clearMessages();
 }
 
+WebInspector.bringToFront = function()
+{
+    InspectorFrontendHost.bringToFront();
+}
+
+WebInspector.inspectedURLChanged = function(url)
+{
+    InspectorFrontendHost.inspectedURLChanged(url);
+}
+
 WebInspector.resourceURLChanged = function(resource, oldURL)
 {
     delete this.resourceURLMap[oldURL];
@@ -1181,7 +1346,13 @@ WebInspector.didCommitLoad = function()
     WebInspector.setDocument(null);
 }
 
-WebInspector.addConsoleMessage = function(payload)
+WebInspector.updateConsoleMessageExpiredCount = function(count)
+{
+    var message = String.sprintf(WebInspector.UIString("%d console messages are not shown."), count);
+    WebInspector.console.addMessage(new WebInspector.ConsoleTextMessage(message, WebInspector.ConsoleMessage.MessageLevel.Warning));
+}
+
+WebInspector.addConsoleMessage = function(payload, opt_args)
 {
     var consoleMessage = new WebInspector.ConsoleMessage(
         payload.source,
@@ -1204,23 +1375,23 @@ WebInspector.log = function(message)
 {
     // remember 'this' for setInterval() callback
     var self = this;
-    
+
     // return indication if we can actually log a message
     function isLogAvailable()
     {
         return WebInspector.ConsoleMessage && WebInspector.ObjectProxy && self.console;
     }
-    
+
     // flush the queue of pending messages
     function flushQueue()
     {
         var queued = WebInspector.log.queued;
-        if (!queued) 
+        if (!queued)
             return;
-            
+
         for (var i = 0; i < queued.length; ++i)
             logMessage(queued[i]);
-        
+
         delete WebInspector.log.queued;
     }
 
@@ -1230,26 +1401,26 @@ WebInspector.log = function(message)
     {
         if (!isLogAvailable())
             return;
-            
+
         clearInterval(WebInspector.log.interval);
         delete WebInspector.log.interval;
-        
+
         flushQueue();
     }
-    
+
     // actually log the message
     function logMessage(message)
     {
         var repeatCount = 1;
         if (message == WebInspector.log.lastMessage)
             repeatCount = WebInspector.log.repeatCount + 1;
-    
+
         WebInspector.log.lastMessage = message;
         WebInspector.log.repeatCount = repeatCount;
-        
+
         // ConsoleMessage expects a proxy object
-        message = new WebInspector.ObjectProxy(null, [], 0, message, false);
-        
+        message = new WebInspector.ObjectProxy(null, null, [], message, false);
+
         // post the message
         var msg = new WebInspector.ConsoleMessage(
             WebInspector.ConsoleMessage.MessageSource.Other,
@@ -1260,20 +1431,20 @@ WebInspector.log = function(message)
             null,
             repeatCount,
             message);
-    
+
         self.console.addMessage(msg);
     }
-    
+
     // if we can't log the message, queue it
     if (!isLogAvailable()) {
         if (!WebInspector.log.queued)
             WebInspector.log.queued = [];
-            
+
         WebInspector.log.queued.push(message);
-        
+
         if (!WebInspector.log.interval)
             WebInspector.log.interval = setInterval(flushQueueIfAvailable, 1000);
-        
+
         return;
     }
 
@@ -1286,7 +1457,7 @@ WebInspector.log = function(message)
 
 WebInspector.addProfileHeader = function(profile)
 {
-    this.panels.profiles.addProfileHeader(WebInspector.CPUProfileType.TypeId, new WebInspector.CPUProfile(profile));
+    this.panels.profiles.addProfileHeader(profile);
 }
 
 WebInspector.setRecordingProfile = function(isProfiling)
@@ -1361,31 +1532,34 @@ WebInspector.resourceForURL = function(url)
     return null;
 }
 
-WebInspector.showResourceForURL = function(url, line, preferredPanel)
+WebInspector._choosePanelToShowSourceLine = function(url, line, preferredPanel)
 {
-    var resource = this.resourceForURL(url);
-    if (!resource)
-        return false;
+    preferredPanel = preferredPanel || "resources";
+    var panel = this.panels[preferredPanel];
+    if (panel && panel.canShowSourceLine(url, line))
+        return panel;
+    panel = this.panels.resources;
+    return panel.canShowSourceLine(url, line) ? panel : null;
+}
 
-    if (preferredPanel && preferredPanel in WebInspector.panels) {
-        var panel = this.panels[preferredPanel];
-        if (!("showResource" in panel))
-            panel = null;
-        else if ("canShowResource" in panel && !panel.canShowResource(resource))
-            panel = null;
-    }
+WebInspector.canShowSourceLine = function(url, line, preferredPanel)
+{
+    return !!this._choosePanelToShowSourceLine(url, line, preferredPanel);
+}
 
-    this.currentPanel = panel || this.panels.resources;
+WebInspector.showSourceLine = function(url, line, preferredPanel)
+{
+    this.currentPanel = this._choosePanelToShowSourceLine(url, line, preferredPanel);
     if (!this.currentPanel)
         return false;
-    this.currentPanel.showResource(resource, line);
+    this.currentPanel.showSourceLine(url, line);
     return true;
 }
 
 WebInspector.linkifyStringAsFragment = function(string)
 {
     var container = document.createDocumentFragment();
-    var linkStringRegEx = new RegExp("(?:[a-zA-Z][a-zA-Z0-9+.-]{2,}://|www\\.)[\\w$\\-_+*'=\\|/\\\\(){}[\\]%@&#~,:;.!?]{2,}[\\w$\\-_+*=\\|/\\\\({%@&#~]");
+    var linkStringRegEx = /(?:[a-zA-Z][a-zA-Z0-9+.-]{2,}:\/\/|www\.)[\w$\-_+*'=\|\/\\(){}[\]%@&#~,:;.!?]{2,}[\w$\-_+*=\|\/\\({%@&#~]/;
 
     while (string) {
         var linkString = linkStringRegEx.exec(string);
@@ -1413,12 +1587,13 @@ WebInspector.linkifyStringAsFragment = function(string)
     return container;
 }
 
-WebInspector.showProfileForURL = function(url) {
+WebInspector.showProfileForURL = function(url)
+{
     WebInspector.showProfilesPanel();
     WebInspector.panels.profiles.showProfileForURL(url);
 }
 
-WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal)
+WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal, tooltipText)
 {
     if (!linkText)
         linkText = url;
@@ -1428,18 +1603,43 @@ WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal)
     var a = document.createElement("a");
     a.href = url;
     a.className = classes;
-    a.title = url;
+    a.title = tooltipText || url;
     a.target = "_blank";
     a.textContent = linkText;
 
     return a;
 }
 
-WebInspector.linkifyURL = function(url, linkText, classes, isExternal)
+WebInspector.linkifyURL = function(url, linkText, classes, isExternal, tooltipText)
 {
     // Use the DOM version of this function so as to avoid needing to escape attributes.
     // FIXME:  Get rid of linkifyURL entirely.
-    return WebInspector.linkifyURLAsNode(url, linkText, classes, isExternal).outerHTML;
+    return WebInspector.linkifyURLAsNode(url, linkText, classes, isExternal, tooltipText).outerHTML;
+}
+
+WebInspector.linkifyResourceAsNode = function(url, preferredPanel, lineNumber, classes, tooltipText)
+{
+    var linkText = WebInspector.displayNameForURL(url);
+    if (lineNumber)
+        linkText += ":" + lineNumber;
+    var node = WebInspector.linkifyURLAsNode(url, linkText, classes, false, tooltipText);
+    node.lineNumber = lineNumber;
+    node.preferredPanel = preferredPanel;
+    return node;
+}
+
+WebInspector.completeURL = function(baseURL, href)
+{
+    var match = baseURL.match(WebInspector.URLRegExp);
+    if (match) {
+        var path = href;
+        if (path.charAt(0) !== "/") {
+            var basePath = match[4] || "/";
+            path = basePath.substring(0, basePath.lastIndexOf("/")) + "/" + path;
+        }
+        return match[1] + "://" + match[2] + (match[3] ? (":" + match[3]) : "") + path;
+    }
+    return null;
 }
 
 WebInspector.addMainEventListeners = function(doc)
@@ -1447,10 +1647,35 @@ WebInspector.addMainEventListeners = function(doc)
     doc.defaultView.addEventListener("focus", this.windowFocused.bind(this), false);
     doc.defaultView.addEventListener("blur", this.windowBlurred.bind(this), false);
     doc.addEventListener("click", this.documentClick.bind(this), true);
+    doc.addEventListener("mouseover", this.documentMouseOver.bind(this), true);
 }
 
-WebInspector.searchKeyDown = function(event)
+WebInspector._searchFieldManualFocus = function(event)
 {
+    this.currentFocusElement = event.target;
+    this._previousFocusElement = event.target;
+}
+
+WebInspector._searchKeyDown = function(event)
+{
+    // Escape Key will clear the field and clear the search results
+    if (event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Esc) {
+        // If focus belongs here and text is empty - nothing to do, return unhandled.
+        if (event.target.value === "" && this.currentFocusElement === this.previousFocusElement)
+            return;
+        event.preventDefault();
+        event.stopPropagation();
+        // When search was selected manually and is currently blank, we'd like Esc stay unhandled
+        // and hit console drawer handler.
+        event.target.value = "";
+
+        this.performSearch(event);
+        this.currentFocusElement = this.previousFocusElement;
+        if (this.currentFocusElement === event.target)
+            this.currentFocusElement.select();
+        return false;
+    }
+
     if (!isEnterKey(event))
         return false;
 
@@ -1560,7 +1785,7 @@ WebInspector.UIString = function(string)
         string = window.localizedStrings[string];
     else {
         if (!(string in this.missingLocalizedStrings)) {
-            if (!WebInspector.InspectorControllerStub)
+            if (!WebInspector.InspectorBackendStub)
                 console.error("Localized string \"" + string + "\" not found.");
             this.missingLocalizedStrings[string] = true;
         }
@@ -1572,19 +1797,26 @@ WebInspector.UIString = function(string)
     return String.vsprintf(string, Array.prototype.slice.call(arguments, 1));
 }
 
+WebInspector.isMac = function()
+{
+    if (!("_isMac" in this))
+        this._isMac = WebInspector.platform === "mac";
+
+    return this._isMac;
+}
+
 WebInspector.isBeingEdited = function(element)
 {
     return element.__editing;
 }
 
-WebInspector.startEditing = function(element, committedCallback, cancelledCallback, context)
+WebInspector.startEditing = function(element, committedCallback, cancelledCallback, context, multiline)
 {
     if (element.__editing)
         return;
     element.__editing = true;
 
     var oldText = getContent(element);
-    var oldHandleKeyEvent = element.handleKeyEvent;
     var moveDirection = "";
 
     element.addStyleClass("editing");
@@ -1612,8 +1844,8 @@ WebInspector.startEditing = function(element, committedCallback, cancelledCallba
         this.scrollTop = 0;
         this.scrollLeft = 0;
 
-        this.handleKeyEvent = oldHandleKeyEvent;
         element.removeEventListener("blur", blurEventListener, false);
+        element.removeEventListener("keydown", keyDownEventListener, true);
 
         if (element === WebInspector.currentFocusElement || element.isAncestor(WebInspector.currentFocusElement))
             WebInspector.currentFocusElement = WebInspector.previousFocusElement;
@@ -1638,24 +1870,24 @@ WebInspector.startEditing = function(element, committedCallback, cancelledCallba
             committedCallback(this, getContent(this), oldText, context, moveDirection);
     }
 
-    element.handleKeyEvent = function(event) {
-        if (oldHandleKeyEvent)
-            oldHandleKeyEvent(event);
-        if (event.handled)
-            return;
-
-        if (isEnterKey(event)) {
+    function keyDownEventListener(event) {
+        var isMetaOrCtrl = WebInspector.isMac() ?
+            event.metaKey && !event.shiftKey && !event.ctrlKey && !event.altKey :
+            event.ctrlKey && !event.shiftKey && !event.metaKey && !event.altKey;
+        if (isEnterKey(event) && (!multiline || isMetaOrCtrl)) {
             editingCommitted.call(element);
             event.preventDefault();
-        } else if (event.keyCode === 27) { // Escape key
+            event.stopPropagation();
+        } else if (event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Esc) {
             editingCancelled.call(element);
             event.preventDefault();
-            event.handled = true;
+            event.stopPropagation();
         } else if (event.keyIdentifier === "U+0009") // Tab key
             moveDirection = (event.shiftKey ? "backward" : "forward");
     }
 
     element.addEventListener("blur", blurEventListener, false);
+    element.addEventListener("keydown", keyDownEventListener, true);
 
     WebInspector.currentFocusElement = element;
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspectorSyntaxHighlight.css b/src/3rdparty/webkit/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
index 2cbb3c54a7..0965a5c0f8 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
@@ -30,9 +30,9 @@
     color: rgb(0, 116, 0);
 }
 
-.webkit-css-string, .webkit-css-keyword, .webkit-css-unit {
+.webkit-css-url, .webkit-css-color, .webkit-css-string, .webkit-css-keyword {
     color: rgb(7, 144, 154);
-}
+ }
 
 .webkit-css-number {
     color: rgb(50, 0, 255);
@@ -42,16 +42,12 @@
     color: rgb(200, 0, 0);
 }
 
-.webkit-css-url {
-    color: rgb(0, 0, 0);
-}
-
 .webkit-css-selector {
-    color: rgb(0, 0, 0);
+    color: black;
 }
 
-.webkit-css-pseudo-class {
-    color: rgb(128, 128, 128);
+.webkit-css-important {
+    color: rgb(200, 0, 180);
 }
 
 .webkit-javascript-comment {
@@ -69,3 +65,47 @@
 .webkit-javascript-string, .webkit-javascript-regexp {
     color: rgb(196, 26, 22);
 }
+
+.webkit-javascript-ident {
+    color: black;
+}
+
+.webkit-html-comment {
+    /* Keep this in sync with view-source.css (.webkit-html-comment) */
+    color: rgb(35, 110, 37);
+}
+
+.webkit-html-tag {
+    /* Keep this in sync with view-source.css (.webkit-html-tag) */
+    color: rgb(136, 18, 128);
+}
+
+.webkit-html-doctype {
+    /* Keep this in sync with view-source.css (.webkit-html-doctype) */
+    color: rgb(192, 192, 192);
+}
+
+.webkit-html-attribute-name {
+    /* Keep this in sync with view-source.css (.webkit-html-attribute-name) */
+    color: rgb(153, 69, 0);
+}
+
+.webkit-html-attribute-value {
+    /* Keep this in sync with view-source.css (.webkit-html-attribute-value) */
+    color: rgb(26, 26, 166);
+}
+
+.webkit-html-external-link, .webkit-html-resource-link {
+    /* Keep this in sync with view-source.css (.webkit-html-external-link, .webkit-html-resource-link) */
+    color: #00e;
+}
+
+.webkit-html-external-link {
+    /* Keep this in sync with view-source.css (.webkit-html-external-link) */
+    text-decoration: none;
+}
+
+.webkit-html-external-link:hover {
+    /* Keep this in sync with view-source.css (.webkit-html-external-link:hover) */
+    text-decoration: underline;
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/popover.css b/src/3rdparty/webkit/WebCore/inspector/front-end/popover.css
new file mode 100644
index 0000000000..ae6f610d18
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/popover.css
@@ -0,0 +1,200 @@
+.popover {
+    position: absolute;
+    -webkit-border-image: url(Images/popoverBackground.png) 25 25 25 25;
+    border-width: 25px;
+    z-index: 100;
+    pointer-events: none;
+}
+
+.popover .content {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 0;
+    right: 0;
+    pointer-events: auto;
+    overflow: auto;
+}
+
+.popover .arrow {
+    position: absolute;
+    background-image: url(Images/popoverArrows.png);
+    width: 19px;
+    height: 19px;
+    margin-left: 15px;
+    margin-top: -25px;
+    top: 0;
+    left: 0;
+}
+
+.popover.top-left-arrow .arrow {
+    /* The default is top-left, no styles needed. */
+}
+
+.popover.top-right-arrow .arrow {
+    right: 25px;
+    left: auto;
+}
+
+.popover.bottom-left-arrow .arrow {
+    top: auto;
+    bottom: 0;
+    margin-top: 0;
+    margin-bottom: -25px;
+    background-position: 0 -19px;
+}
+
+.popover.bottom-right-arrow .arrow {
+    right: 15px;
+    left: auto;
+    top: auto;
+    bottom: 0;
+    margin-top: 0;
+    margin-bottom: -25px;
+    background-position: 0 -19px;
+}
+
+.popover.left-top-arrow .arrow {
+    top: 0;
+    margin-top: 15px;
+    margin-left: -25px;
+    background-position: 0 -38px;
+}
+
+.popover.left-bottom-arrow .arrow {
+    top: auto;
+    bottom: 0;
+    margin-bottom: 15px;
+    margin-left: -25px;
+    background-position: 0 -38px;
+}
+
+.popover.right-top-arrow .arrow {
+    right: 0;
+    left: auto;
+    top: 0;
+    margin-top: 15px;
+    margin-right: -25px;
+    background-position: 0 -57px;
+}
+
+.popover.right-bottom-arrow .arrow {
+    right: 0;
+    left: auto;
+    top: auto;
+    bottom: 0;
+    margin-bottom: 15px;
+    margin-right: -25px;
+    background-position: 0 -57px;
+}
+
+.popover ::-webkit-scrollbar {
+    width: 11px;
+    height: 11px;
+}
+
+.popover ::-webkit-scrollbar-corner {
+    display: none;
+}
+
+.popover ::-webkit-resizer {
+    display: none;
+}
+
+/* Horizontal Scrollbar Styles */
+
+.popover ::-webkit-scrollbar:horizontal:corner-present {
+    border-right-width: 0;
+}
+
+.popover ::-webkit-scrollbar-thumb:horizontal {
+    -webkit-border-image: url(Images/thumbHoriz.png) 0 11 0 11;
+    border-color: transparent;
+    border-width: 0 11px;
+    min-width: 20px;
+}
+
+.popover ::-webkit-scrollbar-thumb:horizontal:hover {
+    -webkit-border-image: url(Images/thumbHoverHoriz.png) 0 11 0 11;
+}
+
+.popover ::-webkit-scrollbar-thumb:horizontal:active {
+    -webkit-border-image: url(Images/thumbActiveHoriz.png) 0 11 0 11;
+}
+
+.popover ::-webkit-scrollbar-track-piece:horizontal:start {
+    margin-left: 5px;
+}
+
+.popover ::-webkit-scrollbar-track-piece:horizontal:end {
+    margin-right: 5px;
+}
+
+.popover ::-webkit-scrollbar-track-piece:horizontal:end:corner-present {
+    margin-right: 4px;
+}
+
+.popover ::-webkit-scrollbar-track-piece:horizontal:decrement {
+    -webkit-border-image: url(Images/trackHoriz.png) 0 11 0 11;
+    border-color: transparent;
+    border-width: 0 0 0 11px;
+}
+
+.popover ::-webkit-scrollbar-track-piece:horizontal:increment {
+    -webkit-border-image: url(Images/trackHoriz.png) 0 11 0 11;
+    border-color: transparent;
+    border-width: 0 11px 0 0;
+}
+
+/* Vertical Scrollbar Styles */
+
+
+.popover ::-webkit-scrollbar:vertical:corner-present {
+    border-bottom-width: 0;
+}
+
+.popover ::-webkit-scrollbar-thumb:vertical {
+    -webkit-border-image: url(Images/thumbVert.png) 11 0 11 0;
+    border-color: transparent;
+    border-width: 11px 0;
+    min-height: 20px;
+}
+
+.popover ::-webkit-scrollbar-thumb:vertical:hover {
+    -webkit-border-image: url(Images/thumbHoverVert.png) 11 0 11 0;
+}
+
+.popover ::-webkit-scrollbar-thumb:vertical:active {
+    -webkit-border-image: url(Images/thumbActiveVert.png) 11 0 11 0;
+}
+
+
+.popover ::-webkit-scrollbar-track-piece:vertical:start {
+    margin-top: 5px;
+}
+
+.popover ::-webkit-scrollbar-track-piece:vertical:end {
+    margin-bottom: 5px;
+}
+
+.popover ::-webkit-scrollbar-track-piece:vertical:end:corner-present {
+    margin-bottom: 4px;
+}
+
+.popover ::-webkit-scrollbar-track-piece:vertical:decrement {
+    -webkit-border-image: url(Images/trackVert.png) 11 0 11 0;
+    border-color: transparent;
+    border-width: 11px 0 0 0;
+}
+
+.popover ::-webkit-scrollbar-track-piece:vertical:increment {
+    -webkit-border-image: url(Images/trackVert.png) 11 0 11 0;
+    border-color: transparent;
+    border-width: 0 0 11px 0;
+}
+
+/* Forced Scrollbar Mode Styles */
+
+.popover ::-webkit-scrollbar-button {
+    display: none;
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/textViewer.css b/src/3rdparty/webkit/WebCore/inspector/front-end/textViewer.css
new file mode 100644
index 0000000000..b69545f956
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/textViewer.css
@@ -0,0 +1,162 @@
+.text-editor {
+    position: absolute;
+    top:0;
+    left:0;
+    right:0;
+    bottom:0;
+    white-space: pre;
+    overflow: auto;
+}
+
+.text-editor-lines {
+    border: 0;
+    -webkit-border-horizontal-spacing: 0;
+    -webkit-border-vertical-spacing: 0;
+    -webkit-user-select: text;
+}
+
+.webkit-html-message-bubble {
+    -webkit-box-shadow: black 0px 2px 5px;
+    -webkit-border-radius: 9px;
+    -webkit-border-fit: lines;
+    font-size: 10px;
+    font-family: Lucida Grande, sans-serif;
+    font-weight: bold;
+    margin: 6px 25px;
+    padding: 0 7px 1px;
+    z-index:20;
+    max-width: 80%;
+    
+}
+
+.webkit-html-warning-message {
+    background-color: rgb(100%, 62%, 42%);
+    border: 2px solid rgb(100%, 52%, 21%);
+}
+
+.webkit-html-error-message {
+    background-color: rgb(100%, 42%, 42%);
+    border: 2px solid rgb(100%, 31%, 31%);
+}
+
+.webkit-html-message-line {
+    padding-left: 23px;
+    text-indent: -20px;
+}
+
+.webkit-html-message-line-hover {
+    padding-left: 23px;
+    text-indent: -20px;
+    white-space: auto;
+    text-overflow: auto;
+    overflow: auto;
+}
+
+.webkit-html-message-icon {
+    position: relative;
+    top: 2px;
+    margin: 0 4px;
+}
+
+.webkit-line-number {
+    color: rgb(128, 128, 128);
+    background-color: rgb(240, 240, 240);
+    border-right: 1px solid rgb(187, 187, 187);
+    text-align: right;
+    word-break: normal;
+    -webkit-user-select: none;
+	padding-right: 4px;
+	padding-left: 6px;
+}
+
+.webkit-line-number-outer {
+    margin-right: -4px;
+    margin-left: -4px;
+    border-color: transparent;
+    border-style: solid;
+    border-width: 0 0 0px 2px;
+    vertical-align: top;
+}
+
+.webkit-line-number-inner {
+    margin-right: 4px;
+}
+
+.webkit-breakpoint .webkit-line-number-inner, .webkit-breakpoint-conditional .webkit-line-number-inner, .webkit-execution-line .webkit-line-number-inner {
+    margin-right: -10px;
+}
+
+.webkit-line-content {
+    width: 100%;
+    padding-left: 2px;
+    vertical-align: top;
+}
+
+.webkit-breakpoint .webkit-line-number-outer {
+    color: white;
+    border-width: 0 14px 0px 2px;
+    -webkit-border-image: url(Images/breakpointBorder.png) 0 14 0 2;
+}
+
+.webkit-breakpoint-conditional .webkit-line-number-outer {
+    color: white;
+    border-width: 0 14px 0px 2px;
+    -webkit-border-image: url(Images/breakpointConditionalBorder.png) 0 14 0 2;
+}
+
+.webkit-execution-line .webkit-line-number-outer {
+    color: transparent;
+    border-width: 0 14px 0px 2px;
+    -webkit-border-image: url(Images/programCounterBorder.png) 0 14 0 2;
+}
+
+.webkit-breakpoint.webkit-execution-line .webkit-line-number-outer {
+    color: white;
+    -webkit-border-image: url(Images/breakpointCounterBorder.png) 0 14 0 2;
+}
+
+.webkit-breakpoint.webkit-execution-line .webkit-line-number-outer {
+    color: transparent;
+    -webkit-border-image: url(Images/breakpointCounterBorder.png) 0 14 0 2;
+}
+
+.webkit-breakpoint-conditional.webkit-execution-line .webkit-line-number-outer {
+    color: transparent;
+    -webkit-border-image: url(Images/breakpointConditionalCounterBorder.png) 0 14 0 2;
+}
+
+.webkit-breakpoint-disabled .webkit-line-number-outer {
+    opacity: 0.5;
+}
+
+.breakpoints-deactivated .webkit-breakpoint .webkit-line-number-outer {
+    opacity: 0.5;
+}
+
+.breakpoints-deactivated .webkit-breakpoint-disabled .webkit-line-number-outer {
+    opacity: 0.3;
+}
+
+.webkit-execution-line .webkit-line-content {
+    background-color: rgb(171, 191, 254);
+    outline: 1px solid rgb(64, 115, 244);
+}
+
+.webkit-search-result {
+    -webkit-border-radius: 4px;
+    padding: 2px 2px 2px 3px;
+    margin: -2px -2px -2px -3px;
+    opacity: 0.8;
+    -webkit-box-shadow: rgba(0, 0, 0, .5) 3px 3px 4px;
+    background-color: rgb(241, 234, 0);
+    color: black;
+}
+
+.webkit-highlighted-line .webkit-line-content {
+    -webkit-animation: "fadeout" 2s 0s;
+}
+
+@-webkit-keyframes fadeout {
+    from {background-color: rgb(255, 255, 120); }
+    to { background-color: white; }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/treeoutline.js b/src/3rdparty/webkit/WebCore/inspector/front-end/treeoutline.js
index ecc322b972..b6e35bbb85 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/treeoutline.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/treeoutline.js
@@ -40,6 +40,9 @@ function TreeOutline(listNode)
     this.expanded = true;
     this.selected = false;
     this.treeOutline = this;
+
+    this._childrenListNode.tabIndex = 0;
+    this._childrenListNode.addEventListener("keydown", this._treeKeyDown.bind(this), true);
 }
 
 TreeOutline._knownTreeElementNextIdentifier = 1;
@@ -141,7 +144,15 @@ TreeOutline._removeChildAtIndex = function(childIndex)
     var child = this.children[childIndex];
     this.children.splice(childIndex, 1);
 
-    child.deselect();
+    var parent = child.parent;
+    if (child.deselect()) {
+        if (child.previousSibling)
+            child.previousSibling.select();
+        else if (child.nextSibling)
+            child.nextSibling.select();
+        else
+            parent.select();
+    }
 
     if (child.previousSibling)
         child.previousSibling.nextSibling = child.nextSibling;
@@ -327,10 +338,13 @@ TreeOutline.prototype.treeElementFromPoint = function(x, y)
     return null;
 }
 
-TreeOutline.prototype.handleKeyEvent = function(event)
+TreeOutline.prototype._treeKeyDown = function(event)
 {
+    if (event.target !== this._childrenListNode)
+        return;
+
     if (!this.selectedTreeElement || event.shiftKey || event.metaKey || event.ctrlKey)
-        return false;
+        return;
 
     var handled = false;
     var nextSelectedElement;
@@ -386,8 +400,6 @@ TreeOutline.prototype.handleKeyEvent = function(event)
         event.preventDefault();
         event.stopPropagation();
     }
-
-    return handled;
 }
 
 TreeOutline.prototype.expand = function()
@@ -624,7 +636,7 @@ TreeElement.treeElementDoubleClicked = function(event)
         return;
 
     if (element.treeElement.ondblclick)
-        element.treeElement.ondblclick(element.treeElement, event);
+        element.treeElement.ondblclick.call(element.treeElement, event);
     else if (element.treeElement.hasChildren && !element.treeElement.expanded)
         element.treeElement.expand();
 }
@@ -764,6 +776,7 @@ TreeElement.prototype.select = function(supressOnSelect)
         this.treeOutline.selectedTreeElement.deselect();
 
     this.selected = true;
+    this.treeOutline._childrenListNode.focus();
     this.treeOutline.selectedTreeElement = this;
     if (this._listItemNode)
         this._listItemNode.addStyleClass("selected");
@@ -775,7 +788,7 @@ TreeElement.prototype.select = function(supressOnSelect)
 TreeElement.prototype.deselect = function(supressOnDeselect)
 {
     if (!this.treeOutline || this.treeOutline.selectedTreeElement !== this || !this.selected)
-        return;
+        return false;
 
     this.selected = false;
     this.treeOutline.selectedTreeElement = null;
@@ -784,6 +797,7 @@ TreeElement.prototype.deselect = function(supressOnDeselect)
 
     if (this.ondeselect && !supressOnDeselect)
         this.ondeselect(this);
+    return true;
 }
 
 TreeElement.prototype.traverseNextTreeElement = function(skipHidden, stayWithin, dontPopulate, info)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js b/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
index e9d185f9a7..9f7daaaad0 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
@@ -145,15 +145,44 @@ Node.prototype.rangeOfWord = function(offset, stopCharacters, stayWithinNode, di
     return result;
 }
 
+Node.prototype.traverseNextTextNode = function(stayWithin)
+{
+    var node = this.traverseNextNode(stayWithin);
+    if (!node)
+        return;
+
+    while (node && node.nodeType !== Node.TEXT_NODE)
+        node = node.traverseNextNode(stayWithin);
+
+    return node;
+}
+
+Node.prototype.rangeBoundaryForOffset = function(offset)
+{
+    var node = this.traverseNextTextNode(this);
+    while (node && offset > node.nodeValue.length) {
+        offset -= node.nodeValue.length;
+        node = node.traverseNextTextNode(this);
+    }
+    if (!node)
+        return { container: this, offset: 0 };
+    return { container: node, offset: offset };
+}
+
 Element.prototype.removeStyleClass = function(className) 
 {
-    // Test for the simple case before using a RegExp.
+    // Test for the simple case first.
     if (this.className === className) {
         this.className = "";
         return;
     }
 
-    this.removeMatchingStyleClasses(className.escapeForRegExp());
+    var index = this.className.indexOf(className);
+    if (index === -1)
+        return;
+
+    var newClassName = " " + this.className + " ";
+    this.className = newClassName.replace(" " + className + " ", " ");
 }
 
 Element.prototype.removeMatchingStyleClasses = function(classNameRegex)
@@ -173,11 +202,15 @@ Element.prototype.hasStyleClass = function(className)
 {
     if (!className)
         return false;
-    // Test for the simple case before using a RegExp.
+    // Test for the simple case
     if (this.className === className)
         return true;
-    var regex = new RegExp("(^|\\s)" + className.escapeForRegExp() + "($|\\s)");
-    return regex.test(this.className);
+
+    var index = this.className.indexOf(className);
+    if (index === -1)
+        return false;
+    var toTest = " " + this.className + " ";
+    return toTest.indexOf(" " + className + " ", index) !== -1;
 }
 
 Element.prototype.positionAt = function(x, y)
@@ -186,6 +219,17 @@ Element.prototype.positionAt = function(x, y)
     this.style.top = y + "px";
 }
 
+Element.prototype.pruneEmptyTextNodes = function()
+{
+    var sibling = this.firstChild;
+    while (sibling) {
+        var nextSibling = sibling.nextSibling;
+        if (sibling.nodeType === this.TEXT_NODE && sibling.nodeValue === "")
+            this.removeChild(sibling);
+        sibling = nextSibling;
+    }
+}
+
 Node.prototype.enclosingNodeOrSelfWithNodeNameInArray = function(nameArray)
 {
     for (var node = this; node && node !== this.ownerDocument; node = node.parentNode)
@@ -222,8 +266,7 @@ Element.prototype.query = function(query)
 
 Element.prototype.removeChildren = function()
 {
-    while (this.firstChild) 
-        this.removeChild(this.firstChild);        
+    this.innerHTML = "";
 }
 
 Element.prototype.isInsertionCaretInside = function()
@@ -239,7 +282,7 @@ Element.prototype.__defineGetter__("totalOffsetLeft", function()
 {
     var total = 0;
     for (var element = this; element; element = element.offsetParent)
-        total += element.offsetLeft;
+        total += element.offsetLeft + (this !== element ? element.clientLeft : 0);
     return total;
 });
 
@@ -247,7 +290,7 @@ Element.prototype.__defineGetter__("totalOffsetTop", function()
 {
     var total = 0;
     for (var element = this; element; element = element.offsetParent)
-        total += element.offsetTop;
+        total += element.offsetTop + (this !== element ? element.clientTop : 0);
     return total;
 });
 
@@ -325,24 +368,9 @@ String.prototype.collapseWhitespace = function()
     return this.replace(/[\s\xA0]+/g, " ");
 }
 
-String.prototype.trimLeadingWhitespace = function()
-{
-    return this.replace(/^[\s\xA0]+/g, "");
-}
-
-String.prototype.trimTrailingWhitespace = function()
-{
-    return this.replace(/[\s\xA0]+$/g, "");
-}
-
-String.prototype.trimWhitespace = function()
-{
-    return this.replace(/^[\s\xA0]+|[\s\xA0]+$/g, "");
-}
-
 String.prototype.trimURL = function(baseURLDomain)
 {
-    var result = this.replace(new RegExp("^http[s]?:\/\/", "i"), "");
+    var result = this.replace(/^https?:\/\//i, "");
     if (baseURLDomain)
         result = result.replace(new RegExp("^" + baseURLDomain.escapeForRegExp(), "i"), "");
     return result;
@@ -542,6 +570,9 @@ Number.secondsToString = function(seconds, formatterFunction, higherResolution)
     if (!formatterFunction)
         formatterFunction = String.sprintf;
 
+    if (seconds === 0)
+        return "0";
+
     var ms = seconds * 1000;
     if (higherResolution && ms < 1000)
         return formatterFunction("%.3fms", ms);
@@ -617,6 +648,14 @@ Array.prototype.remove = function(value, onlyFirst)
     }
 }
 
+Array.prototype.keySet = function()
+{
+    var keys = {};
+    for (var i = 0; i < this.length; ++i)
+        keys[this[i]] = true;
+    return keys;
+}
+
 function insertionIndexForObjectInListSortedByFunction(anObject, aList, aFunction)
 {
     // indexOf returns (-lowerBound - 1). Taking (-result - 1) works out to lowerBound.
@@ -822,3 +861,60 @@ function isEnterKey(event) {
     // Check if in IME.
     return event.keyCode !== 229 && event.keyIdentifier === "Enter";
 }
+
+
+function highlightSearchResult(element, offset, length)
+{
+    var lineText = element.textContent;
+    var endOffset = offset + length;
+    var highlightNode = document.createElement("span");
+    highlightNode.className = "webkit-search-result";
+    highlightNode.textContent = lineText.substring(offset, endOffset);
+
+    var boundary = element.rangeBoundaryForOffset(offset);
+    var textNode = boundary.container;
+    var text = textNode.textContent;
+
+    if (boundary.offset + length < text.length) {
+        // Selection belong to a single split mode.
+        textNode.textContent = text.substring(boundary.offset + length);
+        textNode.parentElement.insertBefore(highlightNode, textNode);
+        var prefixNode = document.createTextNode(text.substring(0, boundary.offset));
+        textNode.parentElement.insertBefore(prefixNode, highlightNode);
+        return highlightNode;
+    }
+
+    var parentElement = textNode.parentElement;
+    var anchorElement = textNode.nextSibling;
+
+    length -= text.length - boundary.offset;
+    textNode.textContent = text.substring(0, boundary.offset);
+    textNode = textNode.traverseNextTextNode(element);
+
+    while (textNode) {
+        var text = textNode.textContent;
+        if (length < text.length) {
+            textNode.textContent = text.substring(length);
+            break;
+        }
+
+        length -= text.length;
+        textNode.textContent = "";
+        textNode = textNode.traverseNextTextNode(element);
+    }
+
+    parentElement.insertBefore(highlightNode, anchorElement);
+    return highlightNode;
+}
+
+function createSearchRegex(query)
+{
+    var regex = "";
+    for (var i = 0; i < query.length; ++i) {
+        var char = query.charAt(i);
+        if (char === "]")
+            char = "\\]";
+        regex += "[" + char + "]";
+    }
+    return new RegExp(regex, "i");
+}
diff --git a/src/3rdparty/webkit/WebCore/loader/Cache.cpp b/src/3rdparty/webkit/WebCore/loader/Cache.cpp
index 46fb068c89..fdd9b254d7 100644
--- a/src/3rdparty/webkit/WebCore/loader/Cache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/Cache.cpp
@@ -31,6 +31,7 @@
 #include "DocLoader.h"
 #include "Document.h"
 #include "FrameLoader.h"
+#include "FrameLoaderTypes.h"
 #include "FrameView.h"
 #include "Image.h"
 #include "ResourceHandle.h"
@@ -123,19 +124,21 @@ CachedResource* Cache::requestResource(DocLoader* docLoader, CachedResource::Typ
         
         resource->load(docLoader);
         
+        if (resource->errorOccurred()) {
+            // We don't support immediate loads, but we do support immediate failure.
+            // In that case we should to delete the resource now and return 0 because otherwise
+            // it would leak if no ref/deref was ever done on it.
+            resource->setInCache(false);
+            delete resource;
+            return 0;
+        }
+
         if (!disabled())
             m_resources.set(url.string(), resource);  // The size will be added in later once the resource is loaded and calls back to us with the new size.
         else {
             // Kick the resource out of the cache, because the cache is disabled.
             resource->setInCache(false);
             resource->setDocLoader(docLoader);
-            if (resource->errorOccurred()) {
-                // We don't support immediate loads, but we do support immediate failure.
-                // In that case we should to delete the resource now and return 0 because otherwise
-                // it would leak if no ref/deref was ever done on it.
-                delete resource;
-                return 0;
-            }
         }
     }
 
@@ -164,7 +167,7 @@ CachedCSSStyleSheet* Cache::requestUserCSSStyleSheet(DocLoader* docLoader, const
         // FIXME: CachedResource should just use normal refcounting instead.
         userSheet->setInCache(true);
         // Don't load incrementally, skip load checks, don't send resource load callbacks.
-        userSheet->load(docLoader, false, true, false);
+        userSheet->load(docLoader, false, SkipSecurityCheck, false);
         if (!disabled())
             m_resources.set(url, userSheet);
         else
@@ -292,7 +295,7 @@ void Cache::pruneLiveResources()
                 return;
 
             // Destroy our decoded data. This will remove us from 
-            // m_liveDecodedResources, and possibly move us to a differnt LRU 
+            // m_liveDecodedResources, and possibly move us to a different LRU 
             // list in m_allResources.
             current->destroyDecodedData();
 
@@ -344,7 +347,7 @@ void Cache::pruneDeadResources()
             CachedResource* prev = current->m_prevInAllResourcesList;
             if (!current->hasClients() && !current->isPreloaded() && current->isLoaded()) {
                 // Destroy our decoded data. This will remove us from 
-                // m_liveDecodedResources, and possibly move us to a differnt 
+                // m_liveDecodedResources, and possibly move us to a different 
                 // LRU list in m_allResources.
                 current->destroyDecodedData();
                 
@@ -465,13 +468,13 @@ void Cache::removeFromLRUList(CachedResource* resource)
     if (resource->accessCount() == 0)
         return;
 
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
     unsigned oldListIndex = resource->m_lruIndex;
 #endif
 
     LRUList* list = lruListFor(resource);
 
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
     // Verify that the list we got is the list we want.
     ASSERT(resource->m_lruIndex == oldListIndex);
 
diff --git a/src/3rdparty/webkit/WebCore/loader/Cache.h b/src/3rdparty/webkit/WebCore/loader/Cache.h
index a0023dad3c..1ccd86d82c 100644
--- a/src/3rdparty/webkit/WebCore/loader/Cache.h
+++ b/src/3rdparty/webkit/WebCore/loader/Cache.h
@@ -190,7 +190,7 @@ private:
     unsigned m_deadSize; // The number of bytes currently consumed by "dead" resources in the cache.
 
     // Size-adjusted and popularity-aware LRU list collection for cache objects.  This collection can hold
-    // more resources than the cached resource map, since it can also hold "stale" muiltiple versions of objects that are
+    // more resources than the cached resource map, since it can also hold "stale" multiple versions of objects that are
     // waiting to die when the clients referencing them go away.
     Vector<LRUList, 32> m_allResources;
     
diff --git a/src/3rdparty/webkit/WebCore/loader/CachePolicy.h b/src/3rdparty/webkit/WebCore/loader/CachePolicy.h
index 93f92b102c..2639caa8f8 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachePolicy.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachePolicy.h
@@ -32,7 +32,8 @@ namespace WebCore {
         CachePolicyCache,
         CachePolicyVerify,
         CachePolicyRevalidate,
-        CachePolicyReload
+        CachePolicyReload,
+        CachePolicyAllowStale
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp
index 4c466faa1b..3adf82ad9b 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp
@@ -31,6 +31,7 @@
 #include "CachedResourceClientWalker.h"
 #include "HTTPParsers.h"
 #include "TextResourceDecoder.h"
+#include "SharedBuffer.h"
 #include "loader.h"
 #include <wtf/Vector.h>
 
@@ -52,9 +53,9 @@ CachedCSSStyleSheet::~CachedCSSStyleSheet()
 void CachedCSSStyleSheet::didAddClient(CachedResourceClient *c)
 {
     if (!m_loading)
-        c->setCSSStyleSheet(m_url, m_decoder->encoding().name(), this);
+        c->setCSSStyleSheet(m_url, m_response.url(), m_decoder->encoding().name(), this);
 }
-    
+
 void CachedCSSStyleSheet::allClientsRemoved()
 {
     if (isSafeToMakePurgeable())
@@ -71,11 +72,11 @@ String CachedCSSStyleSheet::encoding() const
     return m_decoder->encoding().name();
 }
     
-const String CachedCSSStyleSheet::sheetText(bool enforceMIMEType) const 
+const String CachedCSSStyleSheet::sheetText(bool enforceMIMEType, bool* hasValidMIMEType) const 
 { 
     ASSERT(!isPurgeable());
 
-    if (!m_data || m_data->isEmpty() || !canUseSheet(enforceMIMEType))
+    if (!m_data || m_data->isEmpty() || !canUseSheet(enforceMIMEType, hasValidMIMEType))
         return String();
     
     if (!m_decodedSheetText.isNull())
@@ -112,7 +113,7 @@ void CachedCSSStyleSheet::checkNotify()
 
     CachedResourceClientWalker w(m_clients);
     while (CachedResourceClient *c = w.next())
-        c->setCSSStyleSheet(m_response.url().string(), m_decoder->encoding().name(), this);
+        c->setCSSStyleSheet(m_url, m_response.url(), m_decoder->encoding().name(), this);
 }
 
 void CachedCSSStyleSheet::error()
@@ -122,12 +123,12 @@ void CachedCSSStyleSheet::error()
     checkNotify();
 }
 
-bool CachedCSSStyleSheet::canUseSheet(bool enforceMIMEType) const
+bool CachedCSSStyleSheet::canUseSheet(bool enforceMIMEType, bool* hasValidMIMEType) const
 {
     if (errorOccurred())
         return false;
         
-    if (!enforceMIMEType)
+    if (!enforceMIMEType && !hasValidMIMEType)
         return true;
 
     // This check exactly matches Firefox.  Note that we grab the Content-Type
@@ -138,7 +139,12 @@ bool CachedCSSStyleSheet::canUseSheet(bool enforceMIMEType) const
     // This code defaults to allowing the stylesheet for non-HTTP protocols so
     // folks can use standards mode for local HTML documents.
     String mimeType = extractMIMETypeFromMediaType(response().httpHeaderField("Content-Type"));
-    return mimeType.isEmpty() || equalIgnoringCase(mimeType, "text/css") || equalIgnoringCase(mimeType, "application/x-unknown-content-type");
+    bool typeOK = mimeType.isEmpty() || equalIgnoringCase(mimeType, "text/css") || equalIgnoringCase(mimeType, "application/x-unknown-content-type");
+    if (hasValidMIMEType)
+        *hasValidMIMEType = typeOK;
+    if (!enforceMIMEType)
+        return true;
+    return typeOK;
 }
  
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h b/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h
index e782f2ee9f..908c4c0e74 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h
@@ -40,7 +40,7 @@ namespace WebCore {
         CachedCSSStyleSheet(const String& URL, const String& charset);
         virtual ~CachedCSSStyleSheet();
 
-        const String sheetText(bool enforceMIMEType = true) const;
+        const String sheetText(bool enforceMIMEType = true, bool* hasValidMIMEType = 0) const;
 
         virtual void didAddClient(CachedResourceClient*);
         
@@ -56,7 +56,7 @@ namespace WebCore {
         void checkNotify();
     
     private:
-        bool canUseSheet(bool enforceMIMEType) const;
+        bool canUseSheet(bool enforceMIMEType, bool* hasValidMIMEType) const;
 
     protected:
         RefPtr<TextResourceDecoder> m_decoder;
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp b/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp
index 9cf152d041..6c294e9b7f 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp
@@ -27,22 +27,23 @@
 #include "config.h"
 #include "CachedFont.h"
 
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (PLATFORM(WIN_OS) || PLATFORM(LINUX))) || PLATFORM(HAIKU) || PLATFORM(WINCE)
+#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (OS(WINDOWS) || OS(LINUX))) || PLATFORM(HAIKU) || OS(WINCE)
 #define STORE_FONT_CUSTOM_PLATFORM_DATA
 #endif
 
 #include "Cache.h"
 #include "CachedResourceClient.h"
 #include "CachedResourceClientWalker.h"
-#include "DOMImplementation.h"
 #include "FontPlatformData.h"
-#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
-#include "FontCustomPlatformData.h"
-#endif
+#include "SharedBuffer.h"
 #include "TextResourceDecoder.h"
 #include "loader.h"
 #include <wtf/Vector.h>
 
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
+#include "FontCustomPlatformData.h"
+#endif
+
 #if ENABLE(SVG_FONTS)
 #include "HTMLNames.h"
 #include "NodeList.h"
@@ -165,7 +166,7 @@ SVGFontElement* CachedFont::getSVGFontById(const String& fontName) const
         Node* node = list->item(i);
         ASSERT(node);
 
-        if (static_cast<Element*>(node)->getAttribute(HTMLNames::idAttr) != fontName)
+        if (static_cast<Element*>(node)->getAttribute(static_cast<Element*>(node)->idAttributeName()) != fontName)
             continue;
 
         ASSERT(node->hasTagName(SVGNames::fontTag));
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp b/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp
index e610ad18b6..e1e5b1e3fb 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp
@@ -30,9 +30,11 @@
 #include "CachedResourceClientWalker.h"
 #include "DocLoader.h"
 #include "Frame.h"
+#include "FrameLoaderTypes.h"
 #include "FrameView.h"
 #include "Request.h"
 #include "Settings.h"
+#include "SharedBuffer.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
@@ -81,7 +83,7 @@ void CachedImage::decodedDataDeletionTimerFired(Timer<CachedImage>*)
 void CachedImage::load(DocLoader* docLoader)
 {
     if (!docLoader || docLoader->autoLoadImages())
-        CachedResource::load(docLoader, true, false, true);
+        CachedResource::load(docLoader, true, DoSecurityCheck, true);
     else
         m_loading = false;
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedImage.h b/src/3rdparty/webkit/WebCore/loader/CachedImage.h
index 2aa35ace76..cda03a2f21 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedImage.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedImage.h
@@ -25,7 +25,6 @@
 
 #include "CachedResource.h"
 #include "ImageObserver.h"
-#include "Image.h"
 #include "IntRect.h"
 #include "Timer.h"
 #include <wtf/Vector.h>
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp b/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
index f2f52b0acd..c69791d4b8 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
@@ -32,6 +32,7 @@
 #include "KURL.h"
 #include "PurgeableBuffer.h"
 #include "Request.h"
+#include "SharedBuffer.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
 #include <wtf/RefCountedLeakCounter.h>
@@ -103,10 +104,10 @@ CachedResource::~CachedResource()
         m_docLoader->removeCachedResource(this);
 }
     
-void CachedResource::load(DocLoader* docLoader, bool incremental, bool skipCanLoadCheck, bool sendResourceLoadCallbacks)
+void CachedResource::load(DocLoader* docLoader, bool incremental, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks)
 {
     m_sendResourceLoadCallbacks = sendResourceLoadCallbacks;
-    cache()->loader()->load(docLoader, this, incremental, skipCanLoadCheck, sendResourceLoadCallbacks);
+    cache()->loader()->load(docLoader, this, incremental, securityCheck, sendResourceLoadCallbacks);
     m_loading = true;
 }
 
@@ -431,7 +432,7 @@ bool CachedResource::makePurgeable(bool purgeable)
         if (!m_data)
             return false;
         
-        // Should not make buffer purgeable if it has refs othen than this since we don't want two copies.
+        // Should not make buffer purgeable if it has refs other than this since we don't want two copies.
         if (!m_data->hasOneRef())
             return false;
         
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResource.h b/src/3rdparty/webkit/WebCore/loader/CachedResource.h
index 05d24fcec5..71f18c8673 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResource.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResource.h
@@ -24,9 +24,9 @@
 #define CachedResource_h
 
 #include "CachePolicy.h"
+#include "FrameLoaderTypes.h"
 #include "PlatformString.h"
 #include "ResourceResponse.h"
-#include "SharedBuffer.h"
 #include <wtf/HashCountedSet.h>
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
@@ -46,7 +46,7 @@ class PurgeableBuffer;
 // A resource that is held in the cache. Classes who want to use this object should derive
 // from CachedResourceClient, to get the function calls in case the requested data has arrived.
 // This class also does the actual communication with the loader to obtain the resource from the network.
-class CachedResource {
+class CachedResource : public Noncopyable {
     friend class Cache;
     friend class InspectorResource;
     
@@ -75,8 +75,8 @@ public:
     CachedResource(const String& url, Type);
     virtual ~CachedResource();
     
-    virtual void load(DocLoader* docLoader)  { load(docLoader, false, false, true); }
-    void load(DocLoader*, bool incremental, bool skipCanLoadCheck, bool sendResourceLoadCallbacks);
+    virtual void load(DocLoader* docLoader)  { load(docLoader, false, DoSecurityCheck, true); }
+    void load(DocLoader*, bool incremental, SecurityCheckPolicy, bool sendResourceLoadCallbacks);
 
     virtual void setEncoding(const String&) { }
     virtual String encoding() const { return String(); }
@@ -148,7 +148,7 @@ public:
 
     virtual bool schedule() const { return false; }
 
-    // List of acceptable MIME types seperated by ",".
+    // List of acceptable MIME types separated by ",".
     // A MIME type may contain a wildcard, e.g. "text/*".
     String accept() const { return m_accept; }
     void setAccept(const String& accept) { m_accept = accept; }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResourceClient.h b/src/3rdparty/webkit/WebCore/loader/CachedResourceClient.h
index dd9bb94bc1..be3f87e369 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResourceClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResourceClient.h
@@ -42,6 +42,7 @@ namespace WebCore {
     class String;
     class Image;
     class IntRect;
+    class KURL;
 
     /**
      * @internal
@@ -65,8 +66,8 @@ namespace WebCore {
         // e.g., in the b/f cache or in a background tab).
         virtual bool willRenderImage(CachedImage*) { return false; }
 
-        virtual void setCSSStyleSheet(const String& /*URL*/, const String& /*charset*/, const CachedCSSStyleSheet*) { }
-        virtual void setXSLStyleSheet(const String& /*URL*/, const String& /*sheet*/) { }
+        virtual void setCSSStyleSheet(const String& /* href */, const KURL& /* baseURL */, const String& /* charset */, const CachedCSSStyleSheet*) { }
+        virtual void setXSLStyleSheet(const String& /* href */, const KURL& /* baseURL */, const String& /* sheet */) { }
 
         virtual void fontLoaded(CachedFont*) {};
 
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResourceHandle.h b/src/3rdparty/webkit/WebCore/loader/CachedResourceHandle.h
index 0956e0c03b..7d485bf3b9 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResourceHandle.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResourceHandle.h
@@ -72,7 +72,7 @@ namespace WebCore {
         bool operator!=(const CachedResourceHandleBase& o) const { return get() != o.get(); }
     };
 
-    // Don't inline for winscw compiler to prevent the compiler agressively resolving
+    // Don't inline for winscw compiler to prevent the compiler aggressively resolving
     // the base class of R* when CachedResourceHandler<T>(R*) is inlined.  The bug is
     // reported at: https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
     template <class R>
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp b/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp
index 31483d63d9..28e6137f19 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp
@@ -29,6 +29,7 @@
 
 #include "CachedResourceClient.h"
 #include "CachedResourceClientWalker.h"
+#include "SharedBuffer.h"
 #include "TextResourceDecoder.h"
 #include <wtf/Vector.h>
 
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.cpp b/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.cpp
index 5da0abfa78..430ad460f0 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.cpp
@@ -29,6 +29,7 @@
 
 #include "CachedResourceClient.h"
 #include "CachedResourceClientWalker.h"
+#include "SharedBuffer.h"
 #include "TextResourceDecoder.h"
 #include <wtf/Vector.h>
 
@@ -48,7 +49,7 @@ CachedXSLStyleSheet::CachedXSLStyleSheet(const String &url)
 void CachedXSLStyleSheet::didAddClient(CachedResourceClient* c)
 {  
     if (!m_loading)
-        c->setXSLStyleSheet(m_url, m_sheet);
+        c->setXSLStyleSheet(m_url, m_response.url(), m_sheet);
 }
 
 void CachedXSLStyleSheet::setEncoding(const String& chs)
@@ -83,10 +84,9 @@ void CachedXSLStyleSheet::checkNotify()
     
     CachedResourceClientWalker w(m_clients);
     while (CachedResourceClient *c = w.next())
-        c->setXSLStyleSheet(m_url, m_sheet);
+        c->setXSLStyleSheet(m_url, m_response.url(), m_sheet);
 }
 
-
 void CachedXSLStyleSheet::error()
 {
     m_loading = false;
diff --git a/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.cpp b/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.cpp
index f0f8b6afc8..01596e2af9 100644
--- a/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.cpp
@@ -100,6 +100,9 @@ bool passesAccessControlCheck(const ResourceResponse& response, bool includeCred
     if (accessControlOriginString == "*" && !includeCredentials)
         return true;
 
+    if (securityOrigin->isUnique())
+        return false;
+
     RefPtr<SecurityOrigin> accessControlOrigin = SecurityOrigin::createFromString(accessControlOriginString);
     if (!accessControlOrigin->isSameSchemeHostPort(securityOrigin))
         return false;
diff --git a/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.h b/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.h
index 97b526a1e3..f8a7c55c23 100644
--- a/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.h
+++ b/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.h
@@ -24,8 +24,13 @@
  *
  */
 
+#ifndef CrossOriginPreflightResultCacheItem_h
+#define CrossOriginPreflightResultCacheItem_h
+
 #include "KURLHash.h"
 #include "StringHash.h"
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
 
 namespace WebCore {
 
@@ -75,3 +80,5 @@ namespace WebCore {
     };
 
 } // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp
index 5eb7acf9ae..0053e7bf67 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp
@@ -40,6 +40,7 @@
 #include "HTMLElement.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderClient.h"
 #include "loader.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
@@ -111,8 +112,8 @@ void DocLoader::checkForReload(const KURL& fullURL)
     case CachePolicyRevalidate:
         cache()->revalidateResource(existing, this);
         break;
-    default:
-        ASSERT_NOT_REACHED();
+    case CachePolicyAllowStale:
+        return;
     }
 
     m_reloadedURLs.add(fullURL.string());
@@ -120,6 +121,11 @@ void DocLoader::checkForReload(const KURL& fullURL)
 
 CachedImage* DocLoader::requestImage(const String& url)
 {
+    if (Frame* f = frame()) {
+        Settings* settings = f->settings();
+        if (!f->loader()->client()->allowImages(!settings || settings->areImagesEnabled()))
+            return 0;
+    }
     CachedImage* resource = static_cast<CachedImage*>(requestResource(CachedResource::ImageResource, url, String()));
     if (autoLoadImages() && resource && resource->stillNeedsLoad()) {
         resource->setLoading(true);
diff --git a/src/3rdparty/webkit/WebCore/loader/DocLoader.h b/src/3rdparty/webkit/WebCore/loader/DocLoader.h
index 13a57bdf33..8ec73e1248 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/DocLoader.h
@@ -47,7 +47,7 @@ class ImageLoader;
 class KURL;
 
 // The DocLoader manages the loading of scripts/images/stylesheets for a single document.
-class DocLoader
+class DocLoader : public Noncopyable
 {
 friend class Cache;
 friend class ImageLoader;
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp
index 820cb36fc0..37a2de2a9d 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp
@@ -46,7 +46,6 @@
 #include "PlatformString.h"
 #include "Settings.h"
 #include "SharedBuffer.h"
-#include "StringBuffer.h"
 #include "XMLTokenizer.h"
 
 #include <wtf/Assertions.h>
@@ -54,67 +53,6 @@
 
 namespace WebCore {
 
-/*
- * Performs four operations:
- *  1. Convert backslashes to currency symbols
- *  2. Convert control characters to spaces
- *  3. Trim leading and trailing spaces
- *  4. Collapse internal whitespace.
- */
-static inline String canonicalizedTitle(const String& title, Frame* frame)
-{
-    ASSERT(!title.isEmpty());
-
-    const UChar* characters = title.characters();
-    unsigned length = title.length();
-    unsigned i;
-
-    StringBuffer buffer(length);
-    unsigned builderIndex = 0;
-
-    // Skip leading spaces and leading characters that would convert to spaces
-    for (i = 0; i < length; ++i) {
-        UChar c = characters[i];
-        if (!(c <= 0x20 || c == 0x7F))
-            break;
-    }
-
-    if (i == length)
-        return "";
-
-    // Replace control characters with spaces, and backslashes with currency symbols, and collapse whitespace.
-    bool previousCharWasWS = false;
-    for (; i < length; ++i) {
-        UChar c = characters[i];
-        if (c <= 0x20 || c == 0x7F || (WTF::Unicode::category(c) & (WTF::Unicode::Separator_Line | WTF::Unicode::Separator_Paragraph))) {
-            if (previousCharWasWS)
-                continue;
-            buffer[builderIndex++] = ' ';
-            previousCharWasWS = true;
-        } else {
-            buffer[builderIndex++] = c;
-            previousCharWasWS = false;
-        }
-    }
-
-    // Strip trailing spaces
-    while (builderIndex > 0) {
-        --builderIndex;
-        if (buffer[builderIndex] != ' ')
-            break;
-    }
-
-    if (!builderIndex && buffer[builderIndex] == ' ')
-        return "";
-
-    buffer.shrink(builderIndex + 1);
-    
-    // Replace the backslashes with currency symbols if the encoding requires it.
-    frame->document()->displayBufferModifiedByEncoding(buffer.characters(), buffer.length());
-
-    return String::adopt(buffer);
-}
-
 static void cancelAll(const ResourceLoaderSet& loaders)
 {
     const ResourceLoaderSet copy = loaders;
@@ -199,7 +137,7 @@ const KURL& DocumentLoader::url() const
     return request().url();
 }
 
-void DocumentLoader::replaceRequestURLForAnchorScroll(const KURL& url)
+void DocumentLoader::replaceRequestURLForSameDocumentNavigation(const KURL& url)
 {
     m_originalRequestCopy.setURL(url);
     m_request.setURL(url);
@@ -662,10 +600,9 @@ void DocumentLoader::setTitle(const String& title)
     if (title.isEmpty())
         return;
 
-    String trimmed = canonicalizedTitle(title, m_frame);
-    if (!trimmed.isEmpty() && m_pageTitle != trimmed) {
+    if (m_pageTitle != title) {
         frameLoader()->willChangeTitle(this);
-        m_pageTitle = trimmed;
+        m_pageTitle = title;
         frameLoader()->didChangeTitle(this);
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h
index 70d5afdc43..99d82bd1c7 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h
@@ -88,7 +88,7 @@ namespace WebCore {
         const KURL& responseURL() const;
         const String& responseMIMEType() const;
         
-        void replaceRequestURLForAnchorScroll(const KURL&);
+        void replaceRequestURLForSameDocumentNavigation(const KURL&);
         bool isStopping() const { return m_isStopping; }
         void stopLoading(DatabasePolicy = DatabasePolicyStop);
         void setCommitted(bool committed) { m_committed = committed; }
@@ -154,7 +154,7 @@ namespace WebCore {
         KURL urlForHistory() const;
         bool urlForHistoryReflectsFailure() const;
 
-        // These accessors accomodate WebCore's somewhat fickle custom of creating history
+        // These accessors accommodate WebCore's somewhat fickle custom of creating history
         // items for redirects, but only sometimes. For "source" and "destination",
         // these accessors return the URL that would have been used if a history
         // item were created. This allows WebKit to link history items reflecting
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
index 8a223fd33d..de0a0b0f70 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
@@ -70,8 +70,7 @@ DocumentThreadableLoader::DocumentThreadableLoader(Document* document, Threadabl
     ASSERT(client);
 
     if (m_sameOriginRequest || m_options.crossOriginRequestPolicy == AllowCrossOriginRequests) {
-        bool skipCanLoadCheck = false;
-        loadRequest(request, skipCanLoadCheck);
+        loadRequest(request, DoSecurityCheck);
         return;
     }
 
@@ -111,8 +110,7 @@ void DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest(const Resource
     crossOriginRequest.setAllowCookies(m_options.allowCredentials);
     crossOriginRequest.setHTTPOrigin(m_document->securityOrigin()->toString());
 
-    bool skipCanLoadCheck = false;
-    loadRequest(crossOriginRequest, skipCanLoadCheck);
+    loadRequest(crossOriginRequest, DoSecurityCheck);
 }
 
 void DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight(const ResourceRequest& request)
@@ -142,8 +140,7 @@ void DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight(const R
         preflightRequest.setHTTPHeaderField("Access-Control-Request-Headers", String::adopt(headerBuffer));
     }
 
-    bool skipCanLoadCheck = false;
-    loadRequest(preflightRequest, skipCanLoadCheck);
+    loadRequest(preflightRequest, DoSecurityCheck);
 }
 
 DocumentThreadableLoader::~DocumentThreadableLoader()
@@ -284,8 +281,8 @@ void DocumentThreadableLoader::preflightSuccess()
     OwnPtr<ResourceRequest> actualRequest;
     actualRequest.swap(m_actualRequest);
 
-    bool skipCanLoadCheck = true;  // ok to skip load check since we already asked about the preflight request
-    loadRequest(*actualRequest, skipCanLoadCheck);
+    // It should be ok to skip the security check since we already asked about the preflight request.
+    loadRequest(*actualRequest, SkipSecurityCheck);
 }
 
 void DocumentThreadableLoader::preflightFailure()
@@ -293,7 +290,7 @@ void DocumentThreadableLoader::preflightFailure()
     m_client->didFail(ResourceError());
 }
 
-void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, bool skipCanLoadCheck)
+void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, SecurityCheckPolicy securityCheck)
 {
     if (m_async) {
         // Don't sniff content or send load callbacks for the preflight request.
@@ -302,7 +299,7 @@ void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, bool
 
         // Clear the loader so that any callbacks from SubresourceLoader::create will not have the old loader.
         m_loader = 0;
-        m_loader = SubresourceLoader::create(m_document->frame(), this, request, skipCanLoadCheck, sendLoadCallbacks, sniffContent);
+        m_loader = SubresourceLoader::create(m_document->frame(), this, request, securityCheck, sendLoadCallbacks, sniffContent);
         return;
     }
     
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h
index 64b1a22f69..48d1551a25 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h
@@ -31,6 +31,7 @@
 #ifndef DocumentThreadableLoader_h
 #define DocumentThreadableLoader_h
 
+#include "FrameLoaderTypes.h"
 #include "SubresourceLoaderClient.h"
 #include "ThreadableLoader.h"
 #include <wtf/OwnPtr.h>
@@ -41,7 +42,7 @@
 namespace WebCore {
     class Document;
     class KURL;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ThreadableLoaderClient;
 
     class DocumentThreadableLoader : public RefCounted<DocumentThreadableLoader>, public ThreadableLoader, private SubresourceLoaderClient  {
@@ -85,7 +86,7 @@ namespace WebCore {
         void preflightSuccess();
         void preflightFailure();
 
-        void loadRequest(const ResourceRequest&, bool skipCanLoadCheck);
+        void loadRequest(const ResourceRequest&, SecurityCheckPolicy);
         bool isAllowedRedirect(const KURL&);
 
         RefPtr<SubresourceLoader> m_loader;
diff --git a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
index 91c70302e7..ca1c9c2ea5 100644
--- a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
+++ b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
@@ -36,12 +36,10 @@
 #include "EditorClient.h"
 #include "FloatRect.h"
 #include "FocusDirection.h"
-#include "FormState.h"
 #include "FrameLoaderClient.h"
 #include "InspectorClient.h"
 #include "PluginHalterClient.h"
 #include "ResourceError.h"
-#include "SharedBuffer.h"
 
 /*
  This file holds empty Client stubs for use by WebCore.
@@ -76,6 +74,8 @@ public:
     virtual bool canTakeFocus(FocusDirection) { return false; }
     virtual void takeFocus(FocusDirection) { }
 
+    virtual void focusedNodeChanged(Node*) { }
+
     virtual Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&) { return 0; }
     virtual void show() { }
 
@@ -113,12 +113,12 @@ public:
     virtual bool tabsToLinks() const { return false; }
 
     virtual IntRect windowResizerRect() const { return IntRect(); }
-    virtual void addToDirtyRegion(const IntRect&) { }
-    virtual void scrollBackingStore(int, int, const IntRect&, const IntRect&) { }
-    virtual void updateBackingStore() { }
 
-    virtual void repaint(const IntRect&, bool, bool, bool) { }
+    virtual void invalidateWindow(const IntRect&, bool) { }
+    virtual void invalidateContentsAndWindow(const IntRect&, bool) { }
+    virtual void invalidateContentsForSlowScroll(const IntRect&, bool) {};
     virtual void scroll(const IntSize&, const IntRect&, const IntRect&) { }
+
     virtual IntPoint screenToWindow(const IntPoint& p) const { return p; }
     virtual IntRect windowToScreen(const IntRect& r) const { return r; }
     virtual PlatformPageClient platformPageClient() const { return 0; }
@@ -144,6 +144,7 @@ public:
 #endif
 
     virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>) { }
+    virtual void chooseIconForFiles(const Vector<String>&, PassRefPtr<FileChooser>) { }
 
     virtual void formStateDidChange(const Node*) { }
 
@@ -157,15 +158,20 @@ public:
     virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const {}
 
     virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*) {}
+    virtual void cancelGeolocationPermissionRequestForFrame(Frame*) {}
 
 #if USE(ACCELERATED_COMPOSITING)
     virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*) {};
     virtual void setNeedsOneShotDrawingSynchronization() {};
     virtual void scheduleCompositingLayerSync() {};
 #endif
+
+#if ENABLE(TOUCH_EVENTS)
+    virtual void needTouchEvents(bool) { }
+#endif
 };
 
-class EmptyFrameLoaderClient : public FrameLoaderClient {
+class EmptyFrameLoaderClient : public FrameLoaderClient, public Noncopyable {
 public:
     virtual ~EmptyFrameLoaderClient() {  }
     virtual void frameLoaderDestroyed() { }
@@ -200,6 +206,9 @@ public:
     virtual void dispatchDidCancelClientRedirect() { }
     virtual void dispatchWillPerformClientRedirect(const KURL&, double, double) { }
     virtual void dispatchDidChangeLocationWithinPage() { }
+    virtual void dispatchDidPushStateWithinPage() { }
+    virtual void dispatchDidReplaceStateWithinPage() { }
+    virtual void dispatchDidPopStateWithinPage() { }
     virtual void dispatchWillClose() { }
     virtual void dispatchDidReceiveIcon() { }
     virtual void dispatchDidStartProvisionalLoad() { }
@@ -279,11 +288,15 @@ public:
     virtual void updateGlobalHistory() { }
     virtual void updateGlobalHistoryRedirectLinks() { }
     virtual bool shouldGoToHistoryItem(HistoryItem*) const { return false; }
+    virtual void dispatchDidAddBackForwardItem(HistoryItem*) const { }
+    virtual void dispatchDidRemoveBackForwardItem(HistoryItem*) const { };
+    virtual void dispatchDidChangeBackForwardIndex() const { }
     virtual void saveViewStateToItem(HistoryItem*) { }
     virtual bool canCachePage() const { return false; }
     virtual void didDisplayInsecureContent() { }
     virtual void didRunInsecureContent(SecurityOrigin*) { }
     virtual PassRefPtr<Frame> createFrame(const KURL&, const String&, HTMLFrameOwnerElement*, const String&, bool, int, int) { return 0; }
+    virtual void didTransferChildFrameToNewDocument() { }
     virtual PassRefPtr<Widget> createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool) { return 0; }
     virtual PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL&, const Vector<String>&, const Vector<String>&) { return 0; }
 
@@ -291,7 +304,7 @@ public:
     virtual String overrideMediaType() const { return String(); }
 
     virtual void redirectDataToPlugin(Widget*) { }
-    virtual void windowObjectCleared() { }
+    virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*) { }
     virtual void documentElementAvailable() { }
     virtual void didPerformFirstNavigation() const { }
 
@@ -312,7 +325,7 @@ public:
 
 };
 
-class EmptyEditorClient : public EditorClient {
+class EmptyEditorClient : public EditorClient, public Noncopyable {
 public:
     virtual ~EmptyEditorClient() { }
     virtual void pageDestroyed() { }
@@ -417,7 +430,7 @@ public:
 };
 
 #if ENABLE(CONTEXT_MENUS)
-class EmptyContextMenuClient : public ContextMenuClient {
+class EmptyContextMenuClient : public ContextMenuClient, public Noncopyable {
 public:
     virtual ~EmptyContextMenuClient() {  }
     virtual void contextMenuDestroyed() { }
@@ -440,7 +453,7 @@ public:
 #endif // ENABLE(CONTEXT_MENUS)
 
 #if ENABLE(DRAG_SUPPORT)
-class EmptyDragClient : public DragClient {
+class EmptyDragClient : public DragClient, public Noncopyable {
 public:
     virtual ~EmptyDragClient() {}
     virtual void willPerformDragDestinationAction(DragDestinationAction, DragData*) { }
@@ -453,42 +466,19 @@ public:
 };
 #endif // ENABLE(DRAG_SUPPORT)
 
-class EmptyInspectorClient : public InspectorClient {
+class EmptyInspectorClient : public InspectorClient, public Noncopyable {
 public:
     virtual ~EmptyInspectorClient() { }
 
     virtual void inspectorDestroyed() { }
-
-    virtual Page* createPage() { return 0; };
-
-    virtual String localizedStringsURL() { return String(); }
-
-    virtual String hiddenPanels() { return String(); }
-
-    virtual void showWindow() { }
-    virtual void closeWindow() { }
-
-    virtual void attachWindow() { }
-    virtual void detachWindow() { }
-
-    virtual void setAttachedWindowHeight(unsigned) { }
+    
+    virtual void openInspectorFrontend(InspectorController*) { }
 
     virtual void highlight(Node*) { }
     virtual void hideHighlight() { }
-    virtual void inspectedURLChanged(const String&) { }
-
-    virtual void populateSetting(const String&, InspectorController::Setting&) { }
-    virtual void storeSetting(const String&, const InspectorController::Setting&) { }
-    virtual void removeSetting(const String&) { }
 
-    virtual void inspectorWindowObjectCleared() { }
-};
-
-class EmptyPluginHalterClient : public PluginHalterClient
-{
-public:
-    virtual bool shouldHaltPlugin(Node*) const { return false; }
-    virtual bool enabled() const { return false; }
+    virtual void populateSetting(const String&, String*) { }
+    virtual void storeSetting(const String&, const String&) { }
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp
index ee0f4ca389..62173f562b 100644
--- a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp
@@ -38,14 +38,9 @@
 #include "Settings.h"
 #include "SharedBuffer.h"
 #include "Text.h"
-#include <wtf/StdLibExtras.h>
 
-#if PLATFORM(QT)
-#include <QDateTime>
-// On Windows, use the threadsafe *_r functions provided by pthread.
-#elif PLATFORM(WIN_OS) && (USE(PTHREADS) || HAVE(PTHREAD_H))
-#include <pthread.h>
-#endif
+#include <wtf/CurrentTime.h>
+#include <wtf/StdLibExtras.h>
 
 using namespace std;
 
@@ -200,48 +195,6 @@ static bool wasLastDayOfMonth(int year, int month, int day)
     return lastDays[month] == day;
 }
 
-#if PLATFORM(QT)
-
-/*!
- Replacement for localtime_r() which is not available on MinGW.
-
- We use this on all of Qt's platforms for portability.
- */
-struct tm gmtimeQt(const QDateTime &input)
-{
-    tm result;
-
-    const QDate date(input.date());
-    result.tm_year = date.year() - 1900;
-    result.tm_mon = date.month();
-    result.tm_mday = date.day();
-    result.tm_wday = date.dayOfWeek();
-    result.tm_yday = date.dayOfYear();
-
-    const QTime time(input.time());
-    result.tm_sec = time.second();
-    result.tm_min = time.minute();
-    result.tm_hour = time.hour();
-
-    return result;
-}
-
-static struct tm *localTimeQt(const time_t *const timep, struct tm *result)
-{
-    const QDateTime dt(QDateTime::fromTime_t(*timep));
-    *result = WebCore::gmtimeQt(dt.toLocalTime());
-    return result;
-}
-
-#define localtime_r(x, y) localTimeQt(x, y)
-#elif PLATFORM(WIN_OS) && !defined(localtime_r)
-#if defined(_MSC_VER) && (_MSC_VER >= 1400) 
-#define localtime_r(x, y) localtime_s((y), (x))
-#else /* !_MSC_VER */ 
-#define localtime_r(x,y) (localtime(x)?(*(y)=*localtime(x),(y)):0)
-#endif
-#endif
-
 static String processFileDateString(const FTPTime& fileTime)
 {
     // FIXME: Need to localize this string?
@@ -267,7 +220,7 @@ static String processFileDateString(const FTPTime& fileTime)
     // If it was today or yesterday, lets just do that - but we have to compare to the current time
     struct tm now;
     time_t now_t = time(NULL);
-    localtime_r(&now_t, &now);
+    getLocalTime(&now_t, &now);
     
     // localtime does "year = current year - 1900", compensate for that for readability and comparison purposes
     now.tm_year += 1900;
diff --git a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp
index 40bd714c0e..142f2a33cf 100644
--- a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp
@@ -27,7 +27,7 @@
 #if PLATFORM(QT)
 #include <QDateTime>
 // On Windows, use the threadsafe *_r functions provided by pthread.
-#elif PLATFORM(WIN_OS) && (USE(PTHREADS) || HAVE(PTHREAD_H))
+#elif OS(WINDOWS) && (USE(PTHREADS) || HAVE(PTHREAD_H))
 #include <pthread.h>
 #endif
 
@@ -38,8 +38,27 @@ using namespace WTF;
 
 namespace WebCore {
 #if PLATFORM(QT) && defined(Q_WS_WIN32)
-// Defined in FTPDirectoryDocument.cpp.
-struct tm gmtimeQt(const QDateTime &input);
+
+// Replacement for gmtime_r() which is not available on MinGW.
+// We use this on Win32 Qt platform for portability.
+struct tm gmtimeQt(const QDateTime& input)
+{
+    tm result;
+
+    QDate date(input.date());
+    result.tm_year = date.year() - 1900;
+    result.tm_mon = date.month();
+    result.tm_mday = date.day();
+    result.tm_wday = date.dayOfWeek();
+    result.tm_yday = date.dayOfYear();
+
+    QTime time(input.time());
+    result.tm_sec = time.second();
+    result.tm_min = time.minute();
+    result.tm_hour = time.hour();
+
+    return result;
+}
 
 static struct tm *gmtimeQt(const time_t *const timep, struct tm *result)
 {
@@ -49,7 +68,7 @@ static struct tm *gmtimeQt(const time_t *const timep, struct tm *result)
 }
 
 #define gmtime_r(x, y) gmtimeQt(x, y)
-#elif PLATFORM(WIN_OS) && !defined(gmtime_r)
+#elif OS(WINDOWS) && !defined(gmtime_r)
 #if defined(_MSC_VER) && (_MSC_VER >= 1400) 
 #define gmtime_r(x, y) gmtime_s((y), (x))
 #else /* !_MSC_VER */ 
@@ -1185,7 +1204,7 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
        
         } /* time/year */
         
-        // there is exacly 1 space between filename and previous token in all
+        // there is exactly 1 space between filename and previous token in all
         // outputs except old Hellsoft
         if (!isOldHellsoft)
           result.filename = tokens[tokmarker+3] + toklen[tokmarker+3] + 1;
diff --git a/src/3rdparty/webkit/WebCore/loader/FormState.cpp b/src/3rdparty/webkit/WebCore/loader/FormState.cpp
index bd37086879..552789aa8b 100644
--- a/src/3rdparty/webkit/WebCore/loader/FormState.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FormState.cpp
@@ -34,16 +34,17 @@
 
 namespace WebCore {
 
-inline FormState::FormState(PassRefPtr<HTMLFormElement> form, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame> sourceFrame)
+inline FormState::FormState(PassRefPtr<HTMLFormElement> form, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame> sourceFrame, FormSubmissionTrigger formSubmissionTrigger)
     : m_form(form)
     , m_sourceFrame(sourceFrame)
+    , m_formSubmissionTrigger(formSubmissionTrigger)
 {
     m_textFieldValues.swap(textFieldValuesToAdopt);
 }
 
-PassRefPtr<FormState> FormState::create(PassRefPtr<HTMLFormElement> form, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame> sourceFrame)
+PassRefPtr<FormState> FormState::create(PassRefPtr<HTMLFormElement> form, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame> sourceFrame, FormSubmissionTrigger formSubmissionTrigger)
 {
-    return adoptRef(new FormState(form, textFieldValuesToAdopt, sourceFrame));
+    return adoptRef(new FormState(form, textFieldValuesToAdopt, sourceFrame, formSubmissionTrigger));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/FormState.h b/src/3rdparty/webkit/WebCore/loader/FormState.h
index 03317b1118..8f7166ee16 100644
--- a/src/3rdparty/webkit/WebCore/loader/FormState.h
+++ b/src/3rdparty/webkit/WebCore/loader/FormState.h
@@ -36,22 +36,29 @@ namespace WebCore {
     class Frame;
     class HTMLFormElement;
 
+    enum FormSubmissionTrigger {
+        SubmittedByJavaScript,
+        NotSubmittedByJavaScript
+    };
+    
     typedef Vector<std::pair<String, String> > StringPairVector;
 
     class FormState : public RefCounted<FormState> {
     public:
-        static PassRefPtr<FormState> create(PassRefPtr<HTMLFormElement>, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame>);
+        static PassRefPtr<FormState> create(PassRefPtr<HTMLFormElement>, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame>, FormSubmissionTrigger);
 
         HTMLFormElement* form() const { return m_form.get(); }
         const StringPairVector& textFieldValues() const { return m_textFieldValues; }
         Frame* sourceFrame() const { return m_sourceFrame.get(); }
+        FormSubmissionTrigger formSubmissionTrigger() const { return m_formSubmissionTrigger; }
 
     private:
-        FormState(PassRefPtr<HTMLFormElement>, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame>);
+        FormState(PassRefPtr<HTMLFormElement>, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame>, FormSubmissionTrigger);
 
         RefPtr<HTMLFormElement> m_form;
         StringPairVector m_textFieldValues;
         RefPtr<Frame> m_sourceFrame;
+        FormSubmissionTrigger m_formSubmissionTrigger;
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
index 7d857d4a6a..0323e9707a 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
@@ -36,6 +36,7 @@
 #include "ApplicationCacheHost.h"
 #include "Archive.h"
 #include "ArchiveFactory.h"
+#include "BackForwardList.h"
 #include "CString.h"
 #include "Cache.h"
 #include "CachedPage.h"
@@ -80,9 +81,8 @@
 #include "PluginDatabase.h"
 #include "PluginDocument.h"
 #include "ProgressTracker.h"
-#include "RenderPart.h"
+#include "RenderEmbeddedObject.h"
 #include "RenderView.h"
-#include "RenderWidget.h"
 #include "ResourceHandle.h"
 #include "ResourceRequest.h"
 #include "ScriptController.h"
@@ -196,6 +196,7 @@ FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     , m_didPerformFirstNavigation(false)
     , m_loadingFromCachedPage(false)
     , m_suppressOpenerInNewFrame(false)
+    , m_sandboxFlags(SandboxAll)
 #ifndef NDEBUG
     , m_didDispatchDidCommitLoad(false)
 #endif
@@ -228,6 +229,9 @@ void FrameLoader::init()
     m_frame->document()->cancelParsing();
     m_creatingInitialEmptyDocument = false;
     m_didCallImplicitClose = true;
+
+    // Propagate sandbox attributes to this Frameloader and its descendants.
+    updateSandboxFlags();
 }
 
 void FrameLoader::setDefersLoading(bool defers)
@@ -347,7 +351,7 @@ void FrameLoader::urlSelected(const ResourceRequest& request, const String& pass
     m_suppressOpenerInNewFrame = false;
 }
 
-bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String& urlString, const AtomicString& frameName)
+bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String& urlString, const AtomicString& frameName, bool lockHistory, bool lockBackForwardList)
 {
     // Support for <frame src="javascript:string">
     KURL scriptURL;
@@ -360,7 +364,7 @@ bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String
 
     Frame* frame = ownerElement->contentFrame();
     if (frame)
-        frame->redirectScheduler()->scheduleLocationChange(url.string(), m_outgoingReferrer, true, true, isProcessingUserGesture());
+        frame->redirectScheduler()->scheduleLocationChange(url.string(), m_outgoingReferrer, lockHistory, lockBackForwardList, isProcessingUserGesture());
     else
         frame = loadSubframe(ownerElement, url, frameName, m_outgoingReferrer);
     
@@ -398,6 +402,12 @@ Frame* FrameLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL
         return 0;
     }
     
+    // All new frames will have m_isComplete set to true at this point due to synchronously loading
+    // an empty document in FrameLoader::init(). But many frames will now be starting an
+    // asynchronous load of url, so we set m_isComplete to false and then check if the load is
+    // actually completed below. (Note that we set m_isComplete to false even for synchronous
+    // loads, so that checkCompleted() below won't bail early.)
+    // FIXME: Can we remove this entirely? m_isComplete normally gets set to false when a load is committed.
     frame->loader()->m_isComplete = false;
    
     RenderObject* renderer = ownerElement->renderer();
@@ -407,16 +417,17 @@ Frame* FrameLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL
     
     checkCallImplicitClose();
     
+    // Some loads are performed synchronously (e.g., about:blank and loads
+    // cancelled by returning a null ResourceRequest from requestFromDelegate).
     // In these cases, the synchronous load would have finished
     // before we could connect the signals, so make sure to send the 
-    // completed() signal for the child by hand
+    // completed() signal for the child by hand and mark the load as being
+    // complete.
     // FIXME: In this case the Frame will have finished loading before 
     // it's being added to the child list. It would be a good idea to
     // create the child first, then invoke the loader separately.
-    if (url.isEmpty() || url == blankURL()) {
-        frame->loader()->completed();
+    if (frame->loader()->state() == FrameStateComplete)
         frame->loader()->checkCompleted();
-    }
 
     return frame.get();
 }
@@ -438,6 +449,9 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
     if (u.isEmpty())
         return;
 
+    if (isDocumentSandboxed(SandboxForms))
+        return;
+
     if (protocolIsJavaScript(u)) {
         m_isExecutingJavaScriptFormAction = true;
         m_frame->script()->executeIfJavaScriptURL(u, false, false);
@@ -448,7 +462,9 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
     FrameLoadRequest frameRequest;
 
     String targetOrBaseTarget = target.isEmpty() ? m_frame->document()->baseTarget() : target;
-    Frame* targetFrame = findFrameForNavigation(targetOrBaseTarget);
+    Frame* targetFrame = m_frame->tree()->find(targetOrBaseTarget);
+    if (!shouldAllowNavigation(targetFrame))
+        return;
     if (!targetFrame) {
         targetFrame = m_frame;
         frameRequest.setFrameName(targetOrBaseTarget);
@@ -512,7 +528,7 @@ void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolic
                 m_unloadEventBeingDispatched = true;
                 if (m_frame->domWindow()) {
                     if (unloadEventPolicy == UnloadEventPolicyUnloadAndPageHide)
-                        m_frame->domWindow()->dispatchEvent(PageTransitionEvent::create(EventNames().pagehideEvent, m_frame->document()->inPageCache()), m_frame->document());
+                        m_frame->domWindow()->dispatchEvent(PageTransitionEvent::create(eventNames().pagehideEvent, m_frame->document()->inPageCache()), m_frame->document());
                     if (!m_frame->document()->inPageCache())
                         m_frame->domWindow()->dispatchEvent(Event::create(eventNames().unloadEvent, false, false), m_frame->domWindow()->document());
                 }
@@ -551,7 +567,9 @@ void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolic
 
 #if ENABLE(DATABASE)
         if (databasePolicy == DatabasePolicyStop)
-            doc->stopDatabases();
+            doc->stopDatabases(0);
+#else
+    UNUSED_PARAM(databasePolicy);
 #endif
     }
 
@@ -603,10 +621,11 @@ KURL FrameLoader::iconURL()
         return KURL();
 
     KURL url;
-    url.setProtocol(m_URL.protocol());
+    bool couldSetProtocol = url.setProtocol(m_URL.protocol());
+    ASSERT_UNUSED(couldSetProtocol, couldSetProtocol);
     url.setHost(m_URL.host());
-    if (int port = m_URL.port())
-        url.setPort(port);
+    if (m_URL.hasPort())
+        url.setPort(m_URL.port());
     url.setPath("/favicon.ico");
     return url;
 }
@@ -653,7 +672,7 @@ void FrameLoader::didExplicitOpen()
     
     // Prevent window.open(url) -- eg window.open("about:blank") -- from blowing away results
     // from a subsequent window.document.open / window.document.write call. 
-    // Cancelling redirection here works for all cases because document.open 
+    // Canceling redirection here works for all cases because document.open 
     // implicitly precedes document.write.
     m_frame->redirectScheduler()->cancel(); 
     if (m_frame->document()->url() != blankURL())
@@ -710,8 +729,6 @@ void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects, boo
     if (clearFrameView && m_frame->view())
         m_frame->view()->clear();
 
-    m_frame->setSelectionGranularity(CharacterGranularity);
-
     // Do not drop the document before the ScriptController and view are cleared
     // as some destructors might still try to access the document.
     m_frame->setDocument(0);
@@ -740,7 +757,7 @@ void FrameLoader::receivedFirstData()
     begin(m_workingURL, false);
 
     dispatchDidCommitLoad();
-    dispatchWindowObjectAvailable();
+    dispatchDidClearWindowObjectsInAllWorlds();
     
     if (m_documentLoader) {
         String ptitle = m_documentLoader->title();
@@ -820,6 +837,11 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     document->setURL(m_URL);
     m_frame->setDocument(document);
 
+    if (m_pendingStateObject) {
+        document->statePopped(m_pendingStateObject.get());
+        m_pendingStateObject.clear();
+    }
+    
     if (m_decoder)
         document->setDecoder(m_decoder.get());
     if (forcedSecurityOrigin)
@@ -829,7 +851,7 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     m_frame->domWindow()->setSecurityOrigin(document->securityOrigin());
 
     if (dispatch)
-        dispatchWindowObjectAvailable();
+        dispatchDidClearWindowObjectsInAllWorlds();
     
     updateFirstPartyForCookies();
 
@@ -1234,7 +1256,7 @@ String FrameLoader::encoding() const
     return settings ? settings->defaultTextEncodingName() : String();
 }
 
-bool FrameLoader::requestObject(RenderPart* renderer, const String& url, const AtomicString& frameName,
+bool FrameLoader::requestObject(RenderEmbeddedObject* renderer, const String& url, const AtomicString& frameName,
     const String& mimeType, const Vector<String>& paramNames, const Vector<String>& paramValues)
 {
     if (url.isEmpty() && mimeType.isEmpty())
@@ -1252,8 +1274,10 @@ bool FrameLoader::requestObject(RenderPart* renderer, const String& url, const A
     bool useFallback;
     if (shouldUsePlugin(completedURL, mimeType, renderer->hasFallbackContent(), useFallback)) {
         Settings* settings = m_frame->settings();
-        if (!settings || !settings->arePluginsEnabled() || 
-            (!settings->isJavaEnabled() && MIMETypeRegistry::isJavaAppletMIMEType(mimeType)))
+        if (!allowPlugins(AboutToInstantiatePlugin)
+            || (!settings->isJavaEnabled() && MIMETypeRegistry::isJavaAppletMIMEType(mimeType)))
+            return false;
+        if (isDocumentSandboxed(SandboxPlugins))
             return false;
         return loadPlugin(renderer, completedURL, mimeType, paramNames, paramValues, useFallback);
     }
@@ -1331,7 +1355,7 @@ static HTMLPlugInElement* toPlugInElement(Node* node)
     return static_cast<HTMLPlugInElement*>(node);
 }
     
-bool FrameLoader::loadPlugin(RenderPart* renderer, const KURL& url, const String& mimeType, 
+bool FrameLoader::loadPlugin(RenderEmbeddedObject* renderer, const KURL& url, const String& mimeType, 
     const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback)
 {
     RefPtr<Widget> widget;
@@ -1352,7 +1376,8 @@ bool FrameLoader::loadPlugin(RenderPart* renderer, const KURL& url, const String
         if (widget) {
             renderer->setWidget(widget);
             m_containsPlugIns = true;
-        }
+        } else
+            renderer->setShowsMissingPluginIndicator(true);
     }
 
     return widget != 0;
@@ -1373,7 +1398,7 @@ bool FrameLoader::isMixedContent(SecurityOrigin* context, const KURL& url)
     if (context->protocol() != "https")
         return false;  // We only care about HTTPS security origins.
 
-    if (url.protocolIs("https") || url.protocolIs("about") || url.protocolIs("data"))
+    if (!url.isValid() || SecurityOrigin::shouldTreatURLSchemeAsSecure(url.protocol()))
         return false;  // Loading these protocols is secure.
 
     return true;
@@ -1440,9 +1465,9 @@ void FrameLoader::provisionalLoadStarted()
 bool FrameLoader::isProcessingUserGesture()
 {
     Frame* frame = m_frame->tree()->top();
-    if (!frame->script()->isEnabled())
+    if (!frame->script()->canExecuteScripts(NotAboutToExecuteScript))
         return true; // If JavaScript is disabled, a user gesture must have initiated the navigation.
-    return frame->script()->processingUserGesture(); // FIXME: Use pageIsProcessingUserGesture.
+    return frame->script()->processingUserGesture(mainThreadNormalWorld()); // FIXME: Use pageIsProcessingUserGesture.
 }
 
 void FrameLoader::resetMultipleFormSubmissionProtection()
@@ -1694,52 +1719,75 @@ void FrameLoader::setFirstPartyForCookies(const KURL& url)
         child->loader()->setFirstPartyForCookies(url);
 }
 
-class HashChangeEventTask : public ScriptExecutionContext::Task {
-public:
-    static PassRefPtr<HashChangeEventTask> create(PassRefPtr<Document> document)
-    {
-        return adoptRef(new HashChangeEventTask(document));
-    }
-    
-    virtual void performTask(ScriptExecutionContext* context)
-    {
-        ASSERT_UNUSED(context, context->isDocument());
-        m_document->dispatchWindowEvent(Event::create(eventNames().hashchangeEvent, false, false));
-    }
-    
-private:
-    HashChangeEventTask(PassRefPtr<Document> document)
-        : m_document(document)
-    {
-        ASSERT(m_document);
-    }
-    
-    RefPtr<Document> m_document;
-};
-
 // This does the same kind of work that didOpenURL does, except it relies on the fact
 // that a higher level already checked that the URLs match and the scrolling is the right thing to do.
-void FrameLoader::scrollToAnchor(const KURL& url)
-{
-    ASSERT(equalIgnoringFragmentIdentifier(url, m_URL));
-    if (equalIgnoringFragmentIdentifier(url, m_URL) && !equalIgnoringNullity(url.fragmentIdentifier(), m_URL.fragmentIdentifier())) {
-        Document* currentDocument = frame()->document();
-        currentDocument->postTask(HashChangeEventTask::create(currentDocument));
+void FrameLoader::loadInSameDocument(const KURL& url, SerializedScriptValue* stateObject, bool isNewNavigation)
+{
+    // If we have a state object, we cannot also be a new navigation.
+    ASSERT(!stateObject || (stateObject && !isNewNavigation));
+
+    // Update the data source's request with the new URL to fake the URL change
+    m_frame->document()->setURL(url);
+    documentLoader()->replaceRequestURLForSameDocumentNavigation(url);
+    if (isNewNavigation && !shouldTreatURLAsSameAsCurrent(url) && !stateObject) {
+        // NB: must happen after replaceRequestURLForSameDocumentNavigation(), since we add 
+        // based on the current request. Must also happen before we openURL and displace the 
+        // scroll position, since adding the BF item will save away scroll state.
+        
+        // NB2:  If we were loading a long, slow doc, and the user anchor nav'ed before
+        // it was done, currItem is now set the that slow doc, and prevItem is whatever was
+        // before it.  Adding the b/f item will bump the slow doc down to prevItem, even
+        // though its load is not yet done.  I think this all works out OK, for one because
+        // we have already saved away the scroll and doc state for the long slow load,
+        // but it's not an obvious case.
+
+        history()->updateBackForwardListForFragmentScroll();
     }
     
+    String oldURL;
+    bool hashChange = equalIgnoringFragmentIdentifier(url, m_URL) && url.fragmentIdentifier() != m_URL.fragmentIdentifier();
+    oldURL = m_URL;
+    
     m_URL = url;
-    history()->updateForAnchorScroll();
+    history()->updateForSameDocumentNavigation();
 
     // If we were in the autoscroll/panScroll mode we want to stop it before following the link to the anchor
-    m_frame->eventHandler()->stopAutoscrollTimer();
+    if (hashChange)
+        m_frame->eventHandler()->stopAutoscrollTimer();
+    
+    // It's important to model this as a load that starts and immediately finishes.
+    // Otherwise, the parent frame may think we never finished loading.
     started();
+
+    // We need to scroll to the fragment whether or not a hash change occurred, since
+    // the user might have scrolled since the previous navigation.
     if (FrameView* view = m_frame->view())
         view->scrollToFragment(m_URL);
-
-    // It's important to model this as a load that starts and immediately finishes.
-    // Otherwise, the parent frame may think we never finished loading.
+    
     m_isComplete = false;
     checkCompleted();
+
+    if (isNewNavigation) {
+        // This will clear previousItem from the rest of the frame tree that didn't
+        // doing any loading. We need to make a pass on this now, since for anchor nav
+        // we'll not go through a real load and reach Completed state.
+        checkLoadComplete();
+    }
+
+    m_client->dispatchDidNavigateWithinPage();
+
+    if (stateObject) {
+        m_frame->document()->statePopped(stateObject);
+        m_client->dispatchDidPopStateWithinPage();
+    }
+    
+    if (hashChange) {
+        m_frame->document()->enqueueHashchangeEvent(oldURL, m_URL);
+        m_client->dispatchDidChangeLocationWithinPage();
+    }
+    
+    // FrameLoaderClient::didFinishLoad() tells the internal load delegate the load finished with no error
+    m_client->didFinishLoad();
 }
 
 bool FrameLoader::isComplete() const
@@ -1767,6 +1815,15 @@ void FrameLoader::started()
         frame->loader()->m_isComplete = false;
 }
 
+bool FrameLoader::allowPlugins(ReasonForCallingAllowPlugins reason)
+{
+    Settings* settings = m_frame->settings();
+    bool allowed = m_client->allowPlugins(settings && settings->arePluginsEnabled());
+    if (!allowed && reason == AboutToInstantiatePlugin)
+        m_frame->loader()->client()->didNotAllowPlugins();
+    return allowed;
+}
+
 bool FrameLoader::containsPlugins() const 
 { 
     return m_containsPlugIns;
@@ -2197,6 +2254,10 @@ bool FrameLoader::shouldAllowNavigation(Frame* targetFrame) const
     if (m_frame == targetFrame)
         return true;
 
+    // A sandboxed frame can only navigate itself and its descendants.
+    if (isDocumentSandboxed(SandboxNavigation) && !targetFrame->tree()->isDescendantOf(m_frame))
+        return false;
+
     // Let a frame navigate the top-level window that contains it.  This is
     // important to allow because it lets a site "frame-bust" (escape from a
     // frame created by another web site).
@@ -2264,6 +2325,8 @@ void FrameLoader::stopAllLoaders(DatabasePolicy databasePolicy)
     if (m_documentLoader)
         m_documentLoader->clearArchiveResources();
 
+    m_checkTimer.stop();
+
     m_inStopAllLoaders = false;    
 }
 
@@ -2487,10 +2550,13 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
         case FrameLoadTypeBack:
         case FrameLoadTypeBackWMLDeckNotAccessible:
         case FrameLoadTypeIndexedBackForward:
-            if (Page* page = m_frame->page())
+            if (Page* page = m_frame->page()) {
                 if (page->backForwardList()) {
                     history()->updateForBackForwardNavigation();
 
+                    if (history()->currentItem())
+                        m_pendingStateObject = history()->currentItem()->stateObject();
+                        
                     // Create a document view for this document, or used the cached view.
                     if (cachedPage) {
                         DocumentLoader* cachedDocumentLoader = cachedPage->documentLoader();
@@ -2501,6 +2567,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
                     } else
                         m_client->transitionToCommittedForNewPage();
                 }
+            }
             break;
 
         case FrameLoadTypeReload:
@@ -2625,7 +2692,7 @@ void FrameLoader::open(CachedPage& cachedPage)
     closeURL();
     
     // Delete old status bar messages (if it _was_ activated on last URL).
-    if (m_frame->script()->isEnabled()) {
+    if (m_frame->script()->canExecuteScripts(NotAboutToExecuteScript)) {
         m_frame->setJSStatusBarText(String());
         m_frame->setJSDefaultStatusBarText(String());
     }
@@ -2849,6 +2916,9 @@ CachePolicy FrameLoader::subresourceCachePolicy() const
     if (m_loadType == FrameLoadTypeReload)
         return CachePolicyRevalidate;
 
+    if (request.cachePolicy() == ReturnCacheDataElseLoad)
+        return CachePolicyAllowStale;
+
     return CachePolicyVerify;
 }
 
@@ -2888,6 +2958,10 @@ void FrameLoader::checkLoadCompleteForThisFrame()
                 stopLoadingSubframes();
                 pdl->stopLoading();
 
+                // If we're in the middle of loading multipart data, we need to restore the document loader.
+                if (isReplacing() && !m_documentLoader.get())
+                    setDocumentLoader(m_provisionalDocumentLoader.get());
+
                 // Finish resetting the load state, but only if another load hasn't been started by the
                 // delegate callback.
                 if (pdl == m_provisionalDocumentLoader)
@@ -3087,6 +3161,10 @@ void FrameLoader::tokenizerProcessedData()
 void FrameLoader::handledOnloadEvents()
 {
     m_client->dispatchDidHandleOnloadEvents();
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    if (documentLoader())
+        documentLoader()->applicationCacheHost()->stopDeferringEvents();
+#endif
 }
 
 void FrameLoader::frameDetached()
@@ -3162,7 +3240,8 @@ void FrameLoader::addExtraFieldsToRequest(ResourceRequest& request, FrameLoadTyp
         request.setCachePolicy(ReloadIgnoringCacheData);
         request.setHTTPHeaderField("Cache-Control", "no-cache");
         request.setHTTPHeaderField("Pragma", "no-cache");
-    }
+    } else if (isBackForwardLoadType(loadType) && !request.url().protocolIs("https"))
+        request.setCachePolicy(ReturnCacheDataElseLoad);
     
     if (mainResource)
         request.setHTTPAccept(defaultAcceptHeader);
@@ -3259,10 +3338,16 @@ unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& requ
     ResourceRequest initialRequest = request;
     initialRequest.setTimeoutInterval(10);
     
+    // Use the original request's cache policy for two reasons:
+    // 1. For POST requests, we mutate the cache policy for the main resource,
+    //    but we do not want this to apply to subresources
+    // 2. Delegates that modify the cache policy using willSendRequest: should
+    //    not affect any other resources. Such changes need to be done
+    //    per request.
     if (initialRequest.isConditional())
         initialRequest.setCachePolicy(ReloadIgnoringCacheData);
     else
-        initialRequest.setCachePolicy(documentLoader()->request().cachePolicy());
+        initialRequest.setCachePolicy(originalRequest().cachePolicy());
     
     if (!referrer.isEmpty())
         initialRequest.setHTTPReferrer(referrer);
@@ -3343,40 +3428,13 @@ void FrameLoader::callContinueFragmentScrollAfterNavigationPolicy(void* argument
 
 void FrameLoader::continueFragmentScrollAfterNavigationPolicy(const ResourceRequest& request, bool shouldContinue)
 {
-    bool isRedirect = m_quickRedirectComing || policyChecker()->loadType() == FrameLoadTypeRedirectWithLockedBackForwardList;
     m_quickRedirectComing = false;
 
     if (!shouldContinue)
         return;
 
-    KURL url = request.url();
-    
-    m_documentLoader->replaceRequestURLForAnchorScroll(url);
-    if (!isRedirect && !shouldTreatURLAsSameAsCurrent(url)) {
-        // NB: must happen after _setURL, since we add based on the current request.
-        // Must also happen before we openURL and displace the scroll position, since
-        // adding the BF item will save away scroll state.
-        
-        // NB2:  If we were loading a long, slow doc, and the user anchor nav'ed before
-        // it was done, currItem is now set the that slow doc, and prevItem is whatever was
-        // before it.  Adding the b/f item will bump the slow doc down to prevItem, even
-        // though its load is not yet done.  I think this all works out OK, for one because
-        // we have already saved away the scroll and doc state for the long slow load,
-        // but it's not an obvious case.
-
-        history()->updateBackForwardListForFragmentScroll();
-    }
-    
-    scrollToAnchor(url);
-    
-    if (!isRedirect)
-        // This will clear previousItem from the rest of the frame tree that didn't
-        // doing any loading. We need to make a pass on this now, since for anchor nav
-        // we'll not go through a real load and reach Completed state.
-        checkLoadComplete();
- 
-    m_client->dispatchDidChangeLocationWithinPage();
-    m_client->didFinishLoad();
+    bool isRedirect = m_quickRedirectComing || policyChecker()->loadType() == FrameLoadTypeRedirectWithLockedBackForwardList;    
+    loadInSameDocument(request.url(), 0, !isRedirect);
 }
 
 bool FrameLoader::shouldScrollToAnchor(bool isFormSubmission, FrameLoadType loadType, const KURL& url)
@@ -3453,7 +3511,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
     if (!m_frame->page())
         return;
 
-#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR) && USE(JSC)
     if (Page* page = m_frame->page()) {
         if (page->mainFrame() == m_frame)
             page->inspectorController()->resumeDebugger();
@@ -3616,7 +3674,7 @@ void FrameLoader::pageHidden()
 {
     m_unloadEventBeingDispatched = true;
     if (m_frame->domWindow())
-        m_frame->domWindow()->dispatchEvent(PageTransitionEvent::create(EventNames().pagehideEvent, true), m_frame->document());
+        m_frame->domWindow()->dispatchEvent(PageTransitionEvent::create(eventNames().pagehideEvent, true), m_frame->document());
     m_unloadEventBeingDispatched = false;
 
     // Send pagehide event for subframes as well
@@ -3651,14 +3709,48 @@ Frame* FrameLoader::findFrameForNavigation(const AtomicString& name)
     return frame;
 }
 
-// Loads content into this frame, as specified by history item
+void FrameLoader::navigateWithinDocument(HistoryItem* item)
+{
+    ASSERT(item->documentSequenceNumber() == history()->currentItem()->documentSequenceNumber());
+
+    // Save user view state to the current history item here since we don't do a normal load.
+    // FIXME: Does form state need to be saved here too?
+    history()->saveScrollPositionAndViewStateToItem(history()->currentItem());
+    if (FrameView* view = m_frame->view())
+        view->setWasScrolledByUser(false);
+
+    history()->setCurrentItem(item);
+        
+    // loadInSameDocument() actually changes the URL and notifies load delegates of a "fake" load
+    loadInSameDocument(item->url(), item->stateObject(), false);
+
+    // Restore user view state from the current history item here since we don't do a normal load.
+    history()->restoreScrollPositionAndViewState();
+}
+
 // FIXME: This function should really be split into a couple pieces, some of
 // which should be methods of HistoryController and some of which should be
 // methods of FrameLoader.
-void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
-{
-    if (!m_frame->page())
-        return;
+void FrameLoader::navigateToDifferentDocument(HistoryItem* item, FrameLoadType loadType)
+{
+    // Remember this item so we can traverse any child items as child frames load
+    history()->setProvisionalItem(item);
+    
+    // Check if we'll be using the page cache.  We only use the page cache
+    // if one exists and it is less than _backForwardCacheExpirationInterval
+    // seconds old.  If the cache is expired it gets flushed here.
+    if (RefPtr<CachedPage> cachedPage = pageCache()->get(item)) {
+        // FIXME: 1800 should not be hardcoded, it should come from
+        // WebKitBackForwardCacheExpirationIntervalKey in WebKit.
+        // Or we should remove WebKitBackForwardCacheExpirationIntervalKey.
+        if (currentTime() - cachedPage->timeStamp() <= 1800) {
+            loadWithDocumentLoader(cachedPage->documentLoader(), loadType, 0);   
+            return;
+        }
+        
+        LOG(PageCache, "Not restoring page for %s from back/forward cache because cache entry has expired", history()->provisionalItem()->url().string().ascii().data());
+        pageCache()->remove(item);
+    }
 
     KURL itemURL = item->url();
     KURL itemOriginalURL = item->originalURL();
@@ -3667,138 +3759,100 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
         currentURL = documentLoader()->url();
     RefPtr<FormData> formData = item->formData();
 
-    // Are we navigating to an anchor within the page?
-    // Note if we have child frames we do a real reload, since the child frames might not
-    // match our current frame structure, or they might not have the right content.  We could
-    // check for all that as an additional optimization.
-    // We also do not do anchor-style navigation if we're posting a form or navigating from
-    // a page that was resulted from a form post.
-    bool shouldScroll = !formData && !(history()->currentItem() && history()->currentItem()->formData()) && history()->urlsMatchItem(item);
-
-#if ENABLE(WML)
-    // All WML decks should go through the real load mechanism, not the scroll-to-anchor code
-    if (frameContainsWMLContent(m_frame))
-        shouldScroll = false;
-#endif
-
-    if (shouldScroll) {
-        // Must do this maintenance here, since we don't go through a real page reload
-        history()->saveScrollPositionAndViewStateToItem(history()->currentItem());
-
-        if (FrameView* view = m_frame->view())
-            view->setWasScrolledByUser(false);
+    bool addedExtraFields = false;
+    ResourceRequest request(itemURL);
 
-        history()->setCurrentItem(item);
+    if (!item->referrer().isNull())
+        request.setHTTPReferrer(item->referrer());
+    
+    // If this was a repost that failed the page cache, we might try to repost the form.
+    NavigationAction action;
+    if (formData) {
+        formData->generateFiles(m_frame->page()->chrome()->client());
 
-        // FIXME: Form state might need to be saved here too.
+        request.setHTTPMethod("POST");
+        request.setHTTPBody(formData);
+        request.setHTTPContentType(item->formContentType());
+        RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::createFromString(item->referrer());
+        addHTTPOriginIfNeeded(request, securityOrigin->toString());
 
-        // We always call scrollToAnchor here, even if the URL doesn't have an
-        // anchor fragment. This is so we'll keep the WebCore Frame's URL up-to-date.
-        scrollToAnchor(item->url());
-    
-        // must do this maintenance here, since we don't go through a real page reload
-        history()->restoreScrollPositionAndViewState();
+        // Make sure to add extra fields to the request after the Origin header is added for the FormData case.
+        // See https://bugs.webkit.org/show_bug.cgi?id=22194 for more discussion.
+        addExtraFieldsToRequest(request, m_loadType, true, formData);
+        addedExtraFields = true;
         
-        // Fake the URL change by updating the data source's request.  This will no longer
-        // be necessary if we do the better fix described above.
-        documentLoader()->replaceRequestURLForAnchorScroll(itemURL);
-
-        m_client->dispatchDidChangeLocationWithinPage();
+        // FIXME: Slight hack to test if the NSURL cache contains the page we're going to.
+        // We want to know this before talking to the policy delegate, since it affects whether 
+        // we show the DoYouReallyWantToRepost nag.
+        //
+        // This trick has a small bug (3123893) where we might find a cache hit, but then
+        // have the item vanish when we try to use it in the ensuing nav.  This should be
+        // extremely rare, but in that case the user will get an error on the navigation.
         
-        // FrameLoaderClient::didFinishLoad() tells the internal load delegate the load finished with no error
-        m_client->didFinishLoad();
+        if (ResourceHandle::willLoadFromCache(request, m_frame))
+            action = NavigationAction(itemURL, loadType, false);
+        else {
+            request.setCachePolicy(ReloadIgnoringCacheData);
+            action = NavigationAction(itemURL, NavigationTypeFormResubmitted);
+        }
     } else {
-        // Remember this item so we can traverse any child items as child frames load
-        history()->setProvisionalItem(item);
-
-        bool inPageCache = false;
-        
-        // Check if we'll be using the page cache.  We only use the page cache
-        // if one exists and it is less than _backForwardCacheExpirationInterval
-        // seconds old.  If the cache is expired it gets flushed here.
-        if (RefPtr<CachedPage> cachedPage = pageCache()->get(item)) {
-            double interval = currentTime() - cachedPage->timeStamp();
-            
-            // FIXME: 1800 should not be hardcoded, it should come from
-            // WebKitBackForwardCacheExpirationIntervalKey in WebKit.
-            // Or we should remove WebKitBackForwardCacheExpirationIntervalKey.
-            if (interval <= 1800) {
-                loadWithDocumentLoader(cachedPage->documentLoader(), loadType, 0);   
-                inPageCache = true;
-            } else {
-                LOG(PageCache, "Not restoring page for %s from back/forward cache because cache entry has expired", history()->provisionalItem()->url().string().ascii().data());
-                pageCache()->remove(item);
-            }
+        switch (loadType) {
+            case FrameLoadTypeReload:
+            case FrameLoadTypeReloadFromOrigin:
+                request.setCachePolicy(ReloadIgnoringCacheData);
+                break;
+            case FrameLoadTypeBack:
+            case FrameLoadTypeBackWMLDeckNotAccessible:
+            case FrameLoadTypeForward:
+            case FrameLoadTypeIndexedBackForward:
+                if (!itemURL.protocolIs("https"))
+                    request.setCachePolicy(ReturnCacheDataElseLoad);
+                break;
+            case FrameLoadTypeStandard:
+            case FrameLoadTypeRedirectWithLockedBackForwardList:
+                break;
+            case FrameLoadTypeSame:
+            default:
+                ASSERT_NOT_REACHED();
         }
-        
-        if (!inPageCache) {
-            bool addedExtraFields = false;
-            ResourceRequest request(itemURL);
 
-            if (!item->referrer().isNull())
-                request.setHTTPReferrer(item->referrer());
-            
-            // If this was a repost that failed the page cache, we might try to repost the form.
-            NavigationAction action;
-            if (formData) {
-                
-                formData->generateFiles(m_frame->page()->chrome()->client());
+        action = NavigationAction(itemOriginalURL, loadType, false);
+    }
+    
+    if (!addedExtraFields)
+        addExtraFieldsToRequest(request, m_loadType, true, formData);
 
-                request.setHTTPMethod("POST");
-                request.setHTTPBody(formData);
-                request.setHTTPContentType(item->formContentType());
-                RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::createFromString(item->referrer());
-                addHTTPOriginIfNeeded(request, securityOrigin->toString());
-        
-                // Make sure to add extra fields to the request after the Origin header is added for the FormData case.
-                // See https://bugs.webkit.org/show_bug.cgi?id=22194 for more discussion.
-                addExtraFieldsToRequest(request, m_loadType, true, formData);
-                addedExtraFields = true;
-                
-                // FIXME: Slight hack to test if the NSURL cache contains the page we're going to.
-                // We want to know this before talking to the policy delegate, since it affects whether 
-                // we show the DoYouReallyWantToRepost nag.
-                //
-                // This trick has a small bug (3123893) where we might find a cache hit, but then
-                // have the item vanish when we try to use it in the ensuing nav.  This should be
-                // extremely rare, but in that case the user will get an error on the navigation.
-                
-                if (ResourceHandle::willLoadFromCache(request, m_frame))
-                    action = NavigationAction(itemURL, loadType, false);
-                else {
-                    request.setCachePolicy(ReloadIgnoringCacheData);
-                    action = NavigationAction(itemURL, NavigationTypeFormResubmitted);
-                }
-            } else {
-                switch (loadType) {
-                    case FrameLoadTypeReload:
-                    case FrameLoadTypeReloadFromOrigin:
-                        request.setCachePolicy(ReloadIgnoringCacheData);
-                        break;
-                    case FrameLoadTypeBack:
-                    case FrameLoadTypeBackWMLDeckNotAccessible:
-                    case FrameLoadTypeForward:
-                    case FrameLoadTypeIndexedBackForward:
-                        if (itemURL.protocol() != "https")
-                            request.setCachePolicy(ReturnCacheDataElseLoad);
-                        break;
-                    case FrameLoadTypeStandard:
-                    case FrameLoadTypeRedirectWithLockedBackForwardList:
-                        break;
-                    case FrameLoadTypeSame:
-                    default:
-                        ASSERT_NOT_REACHED();
-                }
+    loadWithNavigationAction(request, action, false, loadType, 0);
+}
 
-                action = NavigationAction(itemOriginalURL, loadType, false);
-            }
-            
-            if (!addedExtraFields)
-                addExtraFieldsToRequest(request, m_loadType, true, formData);
+// Loads content into this frame, as specified by history item
+void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
+{
+    // We do same-document navigation in the following cases:
+    // - The HistoryItem has a history state object
+    // - Navigating to an anchor within the page, with no form data stored on the target item or the current history entry,
+    //   and the URLs in the frame tree match the history item for fragment scrolling.
+    // - The HistoryItem is not the same as the current item, because such cases are treated as a new load.
+    HistoryItem* currentItem = history()->currentItem();
+    bool sameDocumentNavigation = ((!item->formData() && !(currentItem && currentItem->formData()) && history()->urlsMatchItem(item))
+                                  || (currentItem && item->documentSequenceNumber() == currentItem->documentSequenceNumber()))
+                                  && item != currentItem;
 
-            loadWithNavigationAction(request, action, false, loadType, 0);
-        }
-    }
+#if ENABLE(WML)
+    // All WML decks should go through the real load mechanism, not the scroll-to-anchor code
+    // FIXME: Why do WML decks have this different behavior?
+    // Are WML decks incompatible with HTML5 pushState/replaceState which require inter-document history navigations?
+    // Should this new API be disabled for WML pages, or does WML need to update their mechanism to act like normal loads?
+    // If scroll-to-anchor navigations were broken for WML and required them to have different loading behavior, then  
+    // state object loads are certainly also broken for them.
+    if (frameContainsWMLContent(m_frame))
+        sameDocumentNavigation = false;
+#endif
+
+    if (sameDocumentNavigation)
+        navigateWithinDocument(item);
+    else
+        navigateToDifferentDocument(item, loadType);
 }
 
 void FrameLoader::setMainDocumentError(DocumentLoader* loader, const ResourceError& error)
@@ -3868,24 +3922,57 @@ void FrameLoader::dispatchDocumentElementAvailable()
     m_client->documentElementAvailable();
 }
 
-void FrameLoader::dispatchWindowObjectAvailable()
+void FrameLoader::dispatchDidClearWindowObjectsInAllWorlds()
+{
+    if (!m_frame->script()->canExecuteScripts(NotAboutToExecuteScript))
+        return;
+
+    Vector<DOMWrapperWorld*> worlds;
+    ScriptController::getAllWorlds(worlds);
+    for (size_t i = 0; i < worlds.size(); ++i)
+        dispatchDidClearWindowObjectInWorld(worlds[i]);
+}
+
+void FrameLoader::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld* world)
 {
-    // FIXME: should this be isolated-worlds-aware?
-    if (!m_frame->script()->isEnabled() || !m_frame->script()->existingWindowShell(mainThreadNormalWorld()))
+    if (!m_frame->script()->canExecuteScripts(NotAboutToExecuteScript) || !m_frame->script()->existingWindowShell(world))
         return;
 
-    m_client->windowObjectCleared();
+    m_client->dispatchDidClearWindowObjectInWorld(world);
 
 #if ENABLE(INSPECTOR)
+    if (world != mainThreadNormalWorld())
+        return;
+
     if (Page* page = m_frame->page()) {
         if (InspectorController* inspector = page->inspectorController())
             inspector->inspectedWindowScriptObjectCleared(m_frame);
-        if (InspectorController* inspector = page->parentInspectorController())
-            inspector->windowScriptObjectAvailable();
     }
 #endif
 }
 
+void FrameLoader::updateSandboxFlags()
+{
+    SandboxFlags flags = SandboxNone;
+    if (Frame* parentFrame = m_frame->tree()->parent())
+        flags |= parentFrame->loader()->sandboxFlags();
+    if (HTMLFrameOwnerElement* ownerElement = m_frame->ownerElement())
+        flags |= ownerElement->sandboxFlags();
+
+    if (m_sandboxFlags == flags)
+        return;
+
+    m_sandboxFlags = flags;
+
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
+        child->loader()->updateSandboxFlags();
+}
+
+bool FrameLoader::isDocumentSandboxed(SandboxFlags mask) const
+{
+    return m_frame->document() && m_frame->document()->securityOrigin()->isSandboxed(mask);
+}
+
 PassRefPtr<Widget> FrameLoader::createJavaAppletWidget(const IntSize& size, HTMLAppletElement* element, const HashMap<String, String>& args)
 {
     String baseURLString;
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
index 3bf6196b08..2acd98493d 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
@@ -50,6 +50,7 @@ class AuthenticationChallenge;
 class CachedFrameBase;
 class CachedPage;
 class CachedResource;
+class DOMWrapperWorld;
 class Document;
 class DocumentLoader;
 class Event;
@@ -64,7 +65,7 @@ class HTMLFrameOwnerElement;
 class IconLoader;
 class IntSize;
 class NavigationAction;
-class RenderPart;
+class RenderEmbeddedObject;
 class ResourceError;
 class ResourceLoader;
 class ResourceResponse;
@@ -72,6 +73,7 @@ class ScriptSourceCode;
 class ScriptString;
 class ScriptValue;
 class SecurityOrigin;
+class SerializedScriptValue;
 class SharedBuffer;
 class SubstituteData;
 class TextResourceDecoder;
@@ -209,7 +211,7 @@ public:
 
     void changeLocation(const KURL&, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false, bool refresh = false);
     void urlSelected(const ResourceRequest&, const String& target, PassRefPtr<Event>, bool lockHistory, bool lockBackForwardList, bool userGesture, ReferrerPolicy);
-    bool requestFrame(HTMLFrameOwnerElement*, const String& url, const AtomicString& frameName);
+    bool requestFrame(HTMLFrameOwnerElement*, const String& url, const AtomicString& frameName, bool lockHistory = true, bool lockBackForwardList = true);
 
     void submitForm(const char* action, const String& url,
         PassRefPtr<FormData>, const String& target, const String& contentType, const String& boundary,
@@ -246,9 +248,15 @@ public:
 
     PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const HashMap<String, String>& args);
 
-    void dispatchWindowObjectAvailable();
+    void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*);
+    void dispatchDidClearWindowObjectsInAllWorlds();
     void dispatchDocumentElementAvailable();
 
+    void ownerElementSandboxFlagsChanged() { updateSandboxFlags(); }
+
+    bool isSandboxed(SandboxFlags mask) const { return m_sandboxFlags & mask; }
+    SandboxFlags sandboxFlags() const { return m_sandboxFlags; }
+
     // Mixed content related functions.
     static bool isMixedContent(SecurityOrigin* context, const KURL&);
     void checkIfDisplayInsecureContent(SecurityOrigin* context, const KURL&);
@@ -272,6 +280,7 @@ public:
     void setResponseMIMEType(const String&);
     const String& responseMIMEType() const;
 
+    bool allowPlugins(ReasonForCallingAllowPlugins);
     bool containsPlugins() const;
 
     void loadDone();
@@ -282,7 +291,7 @@ public:
 
     bool isComplete() const;
 
-    bool requestObject(RenderPart* frame, const String& url, const AtomicString& frameName,
+    bool requestObject(RenderEmbeddedObject*, const String& url, const AtomicString& frameName,
         const String& serviceType, const Vector<String>& paramNames, const Vector<String>& paramValues);
 
     KURL completeURL(const String& url);
@@ -340,8 +349,11 @@ private:
     void started();
 
     bool shouldUsePlugin(const KURL&, const String& mimeType, bool hasFallback, bool& useFallback);
-    bool loadPlugin(RenderPart*, const KURL&, const String& mimeType,
-    const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
+    bool loadPlugin(RenderEmbeddedObject*, const KURL&, const String& mimeType,
+        const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
+    
+    void navigateWithinDocument(HistoryItem*);
+    void navigateToDifferentDocument(HistoryItem*, FrameLoadType);
     
     bool loadProvisionalItemFromCachedPage();
     void cachePageForHistoryItem(HistoryItem*);
@@ -417,7 +429,7 @@ private:
 
     Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
 
-    void scrollToAnchor(const KURL&);
+    void loadInSameDocument(const KURL&, SerializedScriptValue* stateObject, bool isNewNavigation);
 
     void provisionalLoadStarted();
 
@@ -433,6 +445,10 @@ private:
 
     bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
 
+    void updateSandboxFlags();
+    // FIXME: isDocumentSandboxed should eventually replace isSandboxed.
+    bool isDocumentSandboxed(SandboxFlags) const;
+
     Frame* m_frame;
     FrameLoaderClient* m_client;
 
@@ -470,6 +486,8 @@ private:
     bool m_isComplete;
     bool m_isLoadingMainResource;
 
+    RefPtr<SerializedScriptValue> m_pendingStateObject;
+
     KURL m_URL;
     KURL m_workingURL;
 
@@ -504,6 +522,8 @@ private:
     bool m_loadingFromCachedPage;
     bool m_suppressOpenerInNewFrame;
     
+    SandboxFlags m_sandboxFlags;
+
 #ifndef NDEBUG
     bool m_didDispatchDidCommitLoad;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
index 2042b32096..4397f123fa 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
@@ -32,7 +32,6 @@
 #include "FrameLoaderTypes.h"
 #include "ScrollTypes.h"
 #include <wtf/Forward.h>
-#include <wtf/Platform.h>
 #include <wtf/Vector.h>
 
 typedef class _jobject* jobject;
@@ -47,6 +46,7 @@ namespace WebCore {
     class AuthenticationChallenge;
     class CachedFrame;
     class Color;
+    class DOMWrapperWorld;
     class DocumentLoader;
     class Element;
     class FormState;
@@ -64,7 +64,7 @@ namespace WebCore {
     class ResourceError;
     class ResourceHandle;
     class ResourceLoader;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
     class ScriptString;
     class SecurityOrigin;
@@ -115,7 +115,11 @@ namespace WebCore {
         virtual void dispatchDidReceiveServerRedirectForProvisionalLoad() = 0;
         virtual void dispatchDidCancelClientRedirect() = 0;
         virtual void dispatchWillPerformClientRedirect(const KURL&, double interval, double fireDate) = 0;
+        virtual void dispatchDidNavigateWithinPage() { }
         virtual void dispatchDidChangeLocationWithinPage() = 0;
+        virtual void dispatchDidPushStateWithinPage() = 0;
+        virtual void dispatchDidReplaceStateWithinPage() = 0;
+        virtual void dispatchDidPopStateWithinPage() = 0;
         virtual void dispatchWillClose() = 0;
         virtual void dispatchDidReceiveIcon() = 0;
         virtual void dispatchDidStartProvisionalLoad() = 0;
@@ -165,6 +169,9 @@ namespace WebCore {
         virtual void updateGlobalHistoryRedirectLinks() = 0;
 
         virtual bool shouldGoToHistoryItem(HistoryItem*) const = 0;
+        virtual void dispatchDidAddBackForwardItem(HistoryItem*) const = 0;
+        virtual void dispatchDidRemoveBackForwardItem(HistoryItem*) const = 0;
+        virtual void dispatchDidChangeBackForwardIndex() const = 0;
 
         // This frame has displayed inactive content (such as an image) from an
         // insecure source.  Inactive content cannot spread to other frames.
@@ -212,6 +219,7 @@ namespace WebCore {
 
         virtual PassRefPtr<Frame> createFrame(const KURL& url, const String& name, HTMLFrameOwnerElement* ownerElement,
                                    const String& referrer, bool allowsScrolling, int marginWidth, int marginHeight) = 0;
+        virtual void didTransferChildFrameToNewDocument() = 0;
         virtual PassRefPtr<Widget> createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool loadManually) = 0;
         virtual void redirectDataToPlugin(Widget* pluginWidget) = 0;
 
@@ -222,7 +230,7 @@ namespace WebCore {
         virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType) = 0;
         virtual String overrideMediaType() const = 0;
 
-        virtual void windowObjectCleared() = 0;
+        virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*) = 0;
         virtual void documentElementAvailable() = 0;
         virtual void didPerformFirstNavigation() const = 0; // "Navigation" here means a transition from one page to another that ends up in the back/forward list.
 
@@ -246,6 +254,21 @@ namespace WebCore {
 
         virtual bool shouldUsePluginDocument(const String& /*mimeType*/) const { return false; }
         virtual bool shouldLoadMediaElementURL(const KURL&) const { return true; }
+
+        virtual void didChangeScrollOffset() { }
+
+        virtual bool allowJavaScript(bool enabledPerSettings) { return enabledPerSettings; }
+        virtual bool allowPlugins(bool enabledPerSettings) { return enabledPerSettings; }
+        virtual bool allowImages(bool enabledPerSettings) { return enabledPerSettings; }
+
+        // This callback notifies the client that the frame was about to run
+        // JavaScript but did not because allowJavaScript returned false. We
+        // have a separate callback here because there are a number of places
+        // that need to know if JavaScript is enabled but are not necessarily
+        // preparing to execute script.
+        virtual void didNotAllowScript() { }
+        // This callback is similar, but for plugins.
+        virtual void didNotAllowPlugins() { }
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h b/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
index e7d51c7974..678ab65b10 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
@@ -92,6 +92,28 @@ namespace WebCore {
         SendReferrer,
         NoReferrer
     };
+    
+    enum SandboxFlag {
+        SandboxNone = 0,
+        SandboxNavigation = 1,
+        SandboxPlugins = 1 << 1,
+        SandboxOrigin = 1 << 2,
+        SandboxForms = 1 << 3,
+        SandboxScripts = 1 << 4,
+        SandboxAll = -1 // Mask with all bits set to 1.
+    };
+    
+    enum SecurityCheckPolicy {
+        SkipSecurityCheck,
+        DoSecurityCheck
+    };
+
+    enum ReasonForCallingAllowPlugins {
+        AboutToInstantiatePlugin,
+        NotAboutToInstantiatePlugin
+    };
+
+    typedef int SandboxFlags;
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/loader/HistoryController.cpp b/src/3rdparty/webkit/WebCore/loader/HistoryController.cpp
index 501640a7b9..e065e8e0f8 100644
--- a/src/3rdparty/webkit/WebCore/loader/HistoryController.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/HistoryController.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "HistoryController.h"
 
+#include "BackForwardList.h"
 #include "CachedPage.h"
 #include "CString.h"
 #include "DocumentLoader.h"
@@ -105,6 +106,14 @@ void HistoryController::restoreScrollPositionAndViewState()
 void HistoryController::updateBackForwardListForFragmentScroll()
 {
     updateBackForwardListClippedAtTarget(false);
+    
+    // Since the document isn't changed as a result of a fragment scroll, we should
+    // preserve the DocumentSequenceNumber of the previous item.
+    if (!m_previousItem)
+        return;
+
+    ASSERT(m_currentItem);
+    m_currentItem->setDocumentSequenceNumber(m_previousItem->documentSequenceNumber());
 }
 
 void HistoryController::saveDocumentState()
@@ -402,7 +411,7 @@ void HistoryController::updateForCommit()
     }
 }
 
-void HistoryController::updateForAnchorScroll()
+void HistoryController::updateForSameDocumentNavigation()
 {
     if (m_frame->loader()->url().isEmpty())
         return;
@@ -624,4 +633,40 @@ void HistoryController::updateBackForwardListClippedAtTarget(bool doClip)
     page->backForwardList()->addItem(item);
 }
 
+void HistoryController::pushState(PassRefPtr<SerializedScriptValue> stateObject, const String& title, const String& urlString)
+{
+    Page* page = m_frame->page();
+    ASSERT(page);
+
+    // Get a HistoryItem tree for the current frame tree.
+    RefPtr<HistoryItem> item = createItemTree(m_frame, false);
+    ASSERT(item->isTargetItem());
+    
+    // Override data in the target item to reflect the pushState() arguments.
+    item->setTitle(title);
+    item->setStateObject(stateObject);
+    item->setURLString(urlString);
+
+    // Since the document isn't changed as a result of a pushState call, we
+    // should preserve the DocumentSequenceNumber of the previous item.
+    item->setDocumentSequenceNumber(m_previousItem->documentSequenceNumber());
+    
+    page->backForwardList()->pushStateItem(item.release());
+}
+
+void HistoryController::replaceState(PassRefPtr<SerializedScriptValue> stateObject, const String& title, const String& urlString)
+{
+    // FIXME: We should always have m_currentItem here!!
+    // https://bugs.webkit.org/show_bug.cgi?id=36464
+    if (!m_currentItem) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    if (!urlString.isEmpty())
+        m_currentItem->setURLString(urlString);
+    m_currentItem->setTitle(title);
+    m_currentItem->setStateObject(stateObject);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/HistoryController.h b/src/3rdparty/webkit/WebCore/loader/HistoryController.h
index 4ecae69f9e..7c4a1ac483 100644
--- a/src/3rdparty/webkit/WebCore/loader/HistoryController.h
+++ b/src/3rdparty/webkit/WebCore/loader/HistoryController.h
@@ -39,6 +39,7 @@ namespace WebCore {
 
 class Frame;
 class HistoryItem;
+class SerializedScriptValue;
 
 class HistoryController : public Noncopyable {
 public:
@@ -65,7 +66,7 @@ public:
     void updateForRedirectWithLockedBackForwardList();
     void updateForClientRedirect();
     void updateForCommit();
-    void updateForAnchorScroll();
+    void updateForSameDocumentNavigation();
     void updateForFrameLoadCompleted();
 
     HistoryItem* currentItem() const { return m_currentItem.get(); }
@@ -75,6 +76,9 @@ public:
     HistoryItem* provisionalItem() const { return m_provisionalItem.get(); }
     void setProvisionalItem(HistoryItem*);
 
+    void pushState(PassRefPtr<SerializedScriptValue>, const String& title, const String& url);
+    void replaceState(PassRefPtr<SerializedScriptValue>, const String& title, const String& url);
+
 private:
     PassRefPtr<HistoryItem> createItem(bool useOriginal);
     PassRefPtr<HistoryItem> createItemTree(Frame* targetFrame, bool clipAtTarget);
diff --git a/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp b/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp
index 9b5598df4a..2f564cc73b 100644
--- a/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp
@@ -33,6 +33,7 @@
 #include "EventNames.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderClient.h"
 #include "FrameView.h"
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
@@ -115,8 +116,13 @@ void ImageTokenizer::write(const SegmentedString&, bool)
 
 bool ImageTokenizer::writeRawData(const char*, int)
 {
+    Frame* frame = m_doc->frame();
+    Settings* settings = frame->settings();
+    if (!frame->loader()->client()->allowImages(!settings || settings->areImagesEnabled()))
+        return false;
+    
     CachedImage* cachedImage = m_doc->cachedImage();
-    cachedImage->data(m_doc->frame()->loader()->documentLoader()->mainResourceData(), false);
+    cachedImage->data(frame->loader()->documentLoader()->mainResourceData(), false);
 
     m_doc->imageChanged();
     
diff --git a/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp b/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp
index cdc31bcd09..929b28a681 100644
--- a/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,9 +29,27 @@
 #include "Element.h"
 #include "RenderImage.h"
 
+#if !ASSERT_DISABLED
+// ImageLoader objects are allocated as members of other objects, so generic pointer check would always fail.
+namespace WTF {
+
+template<> struct ValueCheck<WebCore::ImageLoader*> {
+    typedef WebCore::ImageLoader* TraitType;
+    static void checkConsistency(const WebCore::ImageLoader* p)
+    {
+        if (!p)
+            return;
+        ASSERT(p->element());
+        ValueCheck<WebCore::Element*>::checkConsistency(p->element());
+    }
+};
+
+}
+#endif
+
 namespace WebCore {
 
-class ImageEventSender {
+class ImageEventSender : public Noncopyable {
 public:
     ImageEventSender(const AtomicString& eventType);
 
@@ -40,6 +58,10 @@ public:
 
     void dispatchPendingEvents();
 
+#if !ASSERT_DISABLED
+    bool hasPendingEvents(ImageLoader* loader) { return m_dispatchSoonList.find(loader) != notFound; }
+#endif
+
 private:
     void timerFired(Timer<ImageEventSender>*);
 
@@ -75,8 +97,12 @@ ImageLoader::~ImageLoader()
 {
     if (m_image)
         m_image->removeClient(this);
+
+    ASSERT(!m_firedBeforeLoad || !beforeLoadEventSender().hasPendingEvents(this));
     if (!m_firedBeforeLoad)
         beforeLoadEventSender().cancelEvent(this);
+
+    ASSERT(!m_firedLoad || !loadEventSender().hasPendingEvents(this));
     if (!m_firedLoad)
         loadEventSender().cancelEvent(this);
 }
@@ -86,9 +112,15 @@ void ImageLoader::setImage(CachedImage* newImage)
     ASSERT(m_failedLoadURL.isEmpty());
     CachedImage* oldImage = m_image.get();
     if (newImage != oldImage) {
-        setLoadingImage(newImage);
-        m_firedBeforeLoad = true;
-        m_firedLoad = true;
+        m_image = newImage;
+        if (!m_firedBeforeLoad) {
+            beforeLoadEventSender().cancelEvent(this);
+            m_firedBeforeLoad = true;
+        }
+        if (!m_firedLoad) {
+            loadEventSender().cancelEvent(this);
+            m_firedLoad = true;
+        }
         m_imageComplete = true;
         if (newImage)
             newImage->addClient(this);
@@ -103,14 +135,6 @@ void ImageLoader::setImage(CachedImage* newImage)
     }
 }
 
-void ImageLoader::setLoadingImage(CachedImage* loadingImage)
-{
-    m_image = loadingImage;
-    m_firedBeforeLoad = !loadingImage;
-    m_firedLoad = !loadingImage;
-    m_imageComplete = !loadingImage;
-}
-
 void ImageLoader::updateFromElement()
 {
     // If we're not making renderers for the page, then don't load images.  We don't want to slow
@@ -146,7 +170,16 @@ void ImageLoader::updateFromElement()
     
     CachedImage* oldImage = m_image.get();
     if (newImage != oldImage) {
-        setLoadingImage(newImage);
+        if (!m_firedBeforeLoad)
+            beforeLoadEventSender().cancelEvent(this);
+        if (!m_firedLoad)
+            loadEventSender().cancelEvent(this);
+
+        m_image = newImage;
+        m_firedBeforeLoad = !newImage;
+        m_firedLoad = !newImage;
+        m_imageComplete = !newImage;
+
         if (newImage) {
             newImage->addClient(this);
             if (!m_element->document()->hasListenerType(Document::BEFORELOAD_LISTENER))
@@ -180,13 +213,16 @@ void ImageLoader::notifyFinished(CachedResource*)
     if (haveFiredBeforeLoadEvent())
         updateRenderer();
 
+    if (m_firedLoad)
+        return;
+
     loadEventSender().dispatchEventSoon(this);
 }
 
 void ImageLoader::updateRenderer()
 {
     if (RenderObject* renderer = m_element->renderer()) {
-        if (!renderer->isImage())
+        if (!renderer->isImage() && !renderer->isVideo())
             return;
         RenderImage* imageRenderer = toRenderImage(renderer);
         
@@ -194,7 +230,7 @@ void ImageLoader::updateRenderer()
         // is a complete image.  This prevents flickering in the case where a dynamic
         // change is happening between two images.
         CachedImage* cachedImage = imageRenderer->cachedImage();
-        if (m_image != cachedImage && (m_imageComplete || !imageRenderer->cachedImage()))
+        if (m_image != cachedImage && (m_imageComplete || !cachedImage))
             imageRenderer->setCachedImage(m_image.get());
     }
 }
@@ -231,9 +267,13 @@ void ImageLoader::dispatchPendingLoadEvent()
     dispatchLoadEvent();
 }
 
-void ImageLoader::dispatchPendingEvents()
+void ImageLoader::dispatchPendingBeforeLoadEvents()
 {
     beforeLoadEventSender().dispatchPendingEvents();
+}
+
+void ImageLoader::dispatchPendingLoadEvents()
+{
     loadEventSender().dispatchPendingEvents();
 }
 
@@ -278,6 +318,8 @@ void ImageEventSender::dispatchPendingEvents()
 
     m_timer.stop();
 
+    m_dispatchSoonList.checkConsistency();
+
     m_dispatchingList.swap(m_dispatchSoonList);
     size_t size = m_dispatchingList.size();
     for (size_t i = 0; i < size; ++i) {
diff --git a/src/3rdparty/webkit/WebCore/loader/ImageLoader.h b/src/3rdparty/webkit/WebCore/loader/ImageLoader.h
index 7f42e3397f..44fe98e9b6 100644
--- a/src/3rdparty/webkit/WebCore/loader/ImageLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/ImageLoader.h
@@ -49,14 +49,15 @@ public:
     bool imageComplete() const { return m_imageComplete; }
 
     CachedImage* image() const { return m_image.get(); }
-    void setImage(CachedImage*);
+    void setImage(CachedImage*); // Cancels pending beforeload and load events, and doesn't dispatch new ones.
 
     void setLoadManually(bool loadManually) { m_loadManually = loadManually; }
 
     bool haveFiredBeforeLoadEvent() const { return m_firedBeforeLoad; }
     bool haveFiredLoadEvent() const { return m_firedLoad; }
 
-    static void dispatchPendingEvents();
+    static void dispatchPendingBeforeLoadEvents();
+    static void dispatchPendingLoadEvents();
 
 protected:
     virtual void notifyFinished(CachedResource*);
@@ -69,8 +70,6 @@ private:
     void dispatchPendingBeforeLoadEvent();
     void dispatchPendingLoadEvent();
 
-    void setLoadingImage(CachedImage*);
-
     void updateRenderer();
 
     Element* m_element;
diff --git a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
index 4970f061fe..28587e29bb 100644
--- a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
@@ -38,6 +38,9 @@
 #include "FrameLoaderClient.h"
 #include "HTMLFormElement.h"
 #include "Page.h"
+#if PLATFORM(QT)
+#include "PluginDatabase.h"
+#endif
 #include "ResourceError.h"
 #include "ResourceHandle.h"
 #include "Settings.h"
@@ -279,6 +282,29 @@ void MainResourceLoader::continueAfterContentPolicy(PolicyAction policy)
     deref(); // balances ref in didReceiveResponse
 }
 
+#if PLATFORM(QT)
+void MainResourceLoader::substituteMIMETypeFromPluginDatabase(const ResourceResponse& r)
+{
+    if (!m_frame->loader()->allowPlugins(NotAboutToInstantiatePlugin))
+        return;
+
+    String filename = r.url().lastPathComponent();
+    if (filename.endsWith("/"))
+        return;
+
+    int extensionPos = filename.reverseFind('.');
+    if (extensionPos == -1)
+        return;
+
+    String extension = filename.substring(extensionPos + 1);
+    String mimeType = PluginDatabase::installedPlugins()->MIMETypeForExtension(extension);
+    if (!mimeType.isEmpty()) {
+        ResourceResponse* response = const_cast<ResourceResponse*>(&r);
+        response->setMimeType(mimeType);
+    }
+}
+#endif
+
 void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
 {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
@@ -301,6 +327,11 @@ void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
     ASSERT(shouldLoadAsEmptyDocument(r.url()) || !defersLoading());
 #endif
 
+#if PLATFORM(QT)
+    if (r.mimeType() == "application/octet-stream")
+        substituteMIMETypeFromPluginDatabase(r);
+#endif
+
     if (m_loadingMultipartContent) {
         frameLoader()->setupForReplaceByMIMEType(r.mimeType());
         clearResourceData();
@@ -433,10 +464,6 @@ void MainResourceLoader::handleDataLoadNow(MainResourceLoaderTimer*)
     KURL url = m_substituteData.responseURL();
     if (url.isEmpty())
         url = m_initialRequest.url();
-
-    // Clear the initial request here so that subsequent entries into the
-    // loader will not think there's still a deferred load left to do.
-    m_initialRequest = ResourceRequest();
         
     ResourceResponse response(url, m_substituteData.mimeType(), m_substituteData.content()->size(), m_substituteData.textEncoding(), "");
     didReceiveResponse(response);
@@ -490,7 +517,7 @@ bool MainResourceLoader::loadNow(ResourceRequest& r)
     else if (shouldLoadEmpty || frameLoader()->representationExistsForURLScheme(url.protocol()))
         handleEmptyLoad(url, !shouldLoadEmpty);
     else
-        m_handle = ResourceHandle::create(r, this, m_frame.get(), false, true, true);
+        m_handle = ResourceHandle::create(r, this, m_frame.get(), false, true);
 
     return false;
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h
index d3f411b40f..5ed0cc853a 100644
--- a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h
@@ -26,6 +26,9 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#ifndef MainResourceLoader_h
+#define MainResourceLoader_h
+
 #include "FrameLoaderTypes.h"
 #include "ResourceLoader.h"
 #include "SubstituteData.h"
@@ -40,7 +43,7 @@
 namespace WebCore {
 
     class FormState;
-    struct ResourceRequest;
+    class ResourceRequest;
 
     class MainResourceLoader : public ResourceLoader {
     public:
@@ -92,6 +95,10 @@ namespace WebCore {
         static void callContinueAfterContentPolicy(void*, PolicyAction);
         void continueAfterContentPolicy(PolicyAction);
         void continueAfterContentPolicy(PolicyAction, const ResourceResponse&);
+        
+#if PLATFORM(QT)
+        void substituteMIMETypeFromPluginDatabase(const ResourceResponse&);
+#endif
 
         ResourceRequest m_initialRequest;
         SubstituteData m_substituteData;
@@ -103,3 +110,5 @@ namespace WebCore {
     };
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp b/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp
index 656d0a0cf3..a2d62763ed 100644
--- a/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp
@@ -159,12 +159,12 @@ void MediaDocument::defaultEventHandler(Event* event)
         HTMLVideoElement* video = static_cast<HTMLVideoElement*>(targetNode);
         if (event->type() == eventNames().clickEvent) {
             if (!video->canPlay()) {
-                video->pause();
+                video->pause(event->fromUserGesture());
                 event->setDefaultHandled();
             }
         } else if (event->type() == eventNames().dblclickEvent) {
             if (video->canPlay()) {
-                video->play();
+                video->play(event->fromUserGesture());
                 event->setDefaultHandled();
             }
         }
@@ -186,9 +186,9 @@ void MediaDocument::defaultEventHandler(Event* event)
             if (keyboardEvent->keyIdentifier() == "U+0020") { // space
                 if (video->paused()) {
                     if (video->canPlay())
-                        video->play();
+                        video->play(event->fromUserGesture());
                 } else
-                    video->pause();
+                    video->pause(event->fromUserGesture());
                 event->setDefaultHandled();
             }
         }
diff --git a/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.cpp b/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.cpp
index af14c72683..81222b3d87 100644
--- a/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.cpp
@@ -35,11 +35,6 @@ void PlaceholderDocument::attach()
 {
     ASSERT(!attached());
 
-    if (!styleSelector()) {
-        RefPtr<StyleSheetList> styleSheetList = StyleSheetList::create(this);
-        setStyleSelector(new CSSStyleSelector(this, styleSheetList.get(), 0, pageUserSheet(), pageGroupUserSheets(), true, false));
-    }
-
     // Skipping Document::attach().
     ContainerNode::attach();
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.h b/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.h
index a7592661f9..5b76a9c704 100644
--- a/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.h
+++ b/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.h
@@ -40,7 +40,7 @@ public:
     virtual void attach();
 
 private:
-    PlaceholderDocument(Frame* frame) : Document(frame, false) { }
+    PlaceholderDocument(Frame* frame) : Document(frame, false, false) { }
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp b/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp
index 788691fcbf..1d2c2b7abd 100644
--- a/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp
@@ -34,6 +34,7 @@
 #include "HTMLNames.h"
 #include "MainResourceLoader.h"
 #include "Page.h"
+#include "RenderEmbeddedObject.h"
 #include "RenderWidget.h"
 #include "SegmentedString.h"
 #include "Settings.h"
@@ -47,6 +48,7 @@ using namespace HTMLNames;
 class PluginTokenizer : public Tokenizer {
 public:
     PluginTokenizer(Document* doc) : m_doc(doc), m_embedElement(0) {}
+    static Widget* pluginWidgetFromDocument(Document* doc);
         
 private:
     virtual void write(const SegmentedString&, bool appendData);
@@ -62,7 +64,21 @@ private:
     Document* m_doc;
     HTMLEmbedElement* m_embedElement;
 };
-    
+
+Widget* PluginTokenizer::pluginWidgetFromDocument(Document* doc)
+{
+    ASSERT(doc);
+    RefPtr<Element> body = doc->body();
+    if (body) {
+        RefPtr<Node> node = body->firstChild();
+        if (node && node->renderer()) {
+            ASSERT(node->renderer()->isEmbeddedObject());
+            return toRenderEmbeddedObject(node->renderer())->widget();
+        }
+    }
+    return 0;
+}
+
 void PluginTokenizer::write(const SegmentedString&, bool)
 {
     ASSERT_NOT_REACHED();
@@ -104,7 +120,7 @@ bool PluginTokenizer::writeRawData(const char*, int)
 
     if (Frame* frame = m_doc->frame()) {
         Settings* settings = frame->settings();
-        if (settings && settings->arePluginsEnabled()) {
+        if (settings && frame->loader()->allowPlugins(NotAboutToInstantiatePlugin)) {
             m_doc->updateLayout();
 
             if (RenderWidget* renderer = toRenderWidget(m_embedElement->renderer())) {
@@ -146,5 +162,19 @@ Tokenizer* PluginDocument::createTokenizer()
 {
     return new PluginTokenizer(this);
 }
-    
+
+Widget* PluginDocument::pluginWidget()
+{
+    return PluginTokenizer::pluginWidgetFromDocument(this);
+}
+
+Node* PluginDocument::pluginNode()
+{
+    RefPtr<Element> body_element = body();
+    if (body_element)
+        return body_element->firstChild();
+
+    return 0;
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/PluginDocument.h b/src/3rdparty/webkit/WebCore/loader/PluginDocument.h
index 1d5c96401a..7b4b36b3e7 100644
--- a/src/3rdparty/webkit/WebCore/loader/PluginDocument.h
+++ b/src/3rdparty/webkit/WebCore/loader/PluginDocument.h
@@ -28,7 +28,9 @@
 #include "HTMLDocument.h"
 
 namespace WebCore {
-    
+
+class Node;
+class Widget;
 class PluginDocument : public HTMLDocument {
 public:
     static PassRefPtr<PluginDocument> create(Frame* frame)
@@ -36,6 +38,9 @@ public:
         return adoptRef(new PluginDocument(frame));
     }
 
+    Widget* pluginWidget();
+    Node* pluginNode();
+
 private:
     PluginDocument(Frame*);
 
diff --git a/src/3rdparty/webkit/WebCore/loader/ProgressTracker.cpp b/src/3rdparty/webkit/WebCore/loader/ProgressTracker.cpp
index 6b6ce1b773..458de68887 100644
--- a/src/3rdparty/webkit/WebCore/loader/ProgressTracker.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ProgressTracker.cpp
@@ -26,10 +26,12 @@
 #include "config.h"
 #include "ProgressTracker.h"
 
+#include "CString.h"
 #include "DocumentLoader.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
+#include "Logging.h"
 #include "ResourceResponse.h"
 #include <wtf/CurrentTime.h>
 
@@ -47,7 +49,7 @@ static const double finalProgressValue = 0.9; // 1.0 - initialProgressValue
 
 static const int progressItemDefaultEstimatedLength = 1024 * 16;
 
-struct ProgressItem {
+struct ProgressItem : Noncopyable {
     ProgressItem(long long length) 
         : bytesReceived(0)
         , estimatedLength(length) { }
@@ -97,7 +99,7 @@ void ProgressTracker::reset()
 
 void ProgressTracker::progressStarted(Frame* frame)
 {
-    // LOG (Progress, "frame %p(%@), _private->numProgressTrackedFrames %d, _private->originatingProgressFrame %p", frame, [frame name], _private->numProgressTrackedFrames, _private->originatingProgressFrame);
+    LOG(Progress, "Progress started (%p) - frame %p(\"%s\"), value %f, tracked frames %d, originating frame %p", this, frame, frame->tree()->name().string().utf8().data(), m_progressValue, m_numProgressTrackedFrames, m_originatingProgressFrame.get());
 
     frame->loader()->client()->willChangeEstimatedProgress();
     
@@ -115,7 +117,7 @@ void ProgressTracker::progressStarted(Frame* frame)
 
 void ProgressTracker::progressCompleted(Frame* frame)
 {
-    // LOG (Progress, "frame %p(%@), _private->numProgressTrackedFrames %d, _private->originatingProgressFrame %p", frame, [frame name], _private->numProgressTrackedFrames, _private->originatingProgressFrame);
+    LOG(Progress, "Progress completed (%p) - frame %p(\"%s\"), value %f, tracked frames %d, originating frame %p", this, frame, frame->tree()->name().string().utf8().data(), m_progressValue, m_numProgressTrackedFrames, m_originatingProgressFrame.get());
     
     if (m_numProgressTrackedFrames <= 0)
         return;
@@ -132,7 +134,7 @@ void ProgressTracker::progressCompleted(Frame* frame)
 
 void ProgressTracker::finalProgressComplete()
 {
-    // LOG (Progress, "");
+    LOG(Progress, "Final progress complete (%p)", this);
     
     RefPtr<Frame> frame = m_originatingProgressFrame.release();
     
@@ -151,7 +153,7 @@ void ProgressTracker::finalProgressComplete()
 
 void ProgressTracker::incrementProgress(unsigned long identifier, const ResourceResponse& response)
 {
-    // LOG (Progress, "_private->numProgressTrackedFrames %d, _private->originatingProgressFrame %p", _private->numProgressTrackedFrames, _private->originatingProgressFrame);
+    LOG(Progress, "Progress incremented (%p) - value %f, tracked frames %d, originating frame %p", this, m_progressValue, m_numProgressTrackedFrames, m_originatingProgressFrame.get());
 
     if (m_numProgressTrackedFrames <= 0)
         return;
@@ -214,7 +216,7 @@ void ProgressTracker::incrementProgress(unsigned long identifier, const char*, i
     double now = currentTime();
     double notifiedProgressTimeDelta = now - m_lastNotifiedProgressTime;
     
-    // LOG (Progress, "_private->progressValue %g, _private->numProgressTrackedFrames %d", _private->progressValue, _private->numProgressTrackedFrames);
+    LOG(Progress, "Progress incremented (%p) - value %f, tracked frames %d", this, m_progressValue, m_numProgressTrackedFrames);
     double notificationProgressDelta = m_progressValue - m_lastNotifiedProgressValue;
     if ((notificationProgressDelta >= m_progressNotificationInterval ||
          notifiedProgressTimeDelta >= m_progressNotificationTimeInterval) &&
diff --git a/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.cpp b/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.cpp
index c0d78ae5f5..4b44422f8b 100644
--- a/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.cpp
@@ -32,18 +32,22 @@
 #include "config.h"
 #include "RedirectScheduler.h"
 
+#include "BackForwardList.h"
 #include "DocumentLoader.h"
 #include "Event.h"
 #include "FormState.h"
 #include "Frame.h"
 #include "FrameLoadRequest.h"
 #include "FrameLoader.h"
+#include "HistoryItem.h"
 #include "HTMLFormElement.h"
+#include "HTMLFrameOwnerElement.h"
+#include "Page.h"
 #include <wtf/CurrentTime.h>
 
 namespace WebCore {
 
-struct ScheduledRedirection {
+struct ScheduledRedirection : Noncopyable {
     enum Type { redirection, locationChange, historyNavigation, formSubmission };
 
     const Type type;
@@ -171,7 +175,7 @@ bool RedirectScheduler::mustLockBackForwardList(Frame* targetFrame)
     
     for (Frame* ancestor = targetFrame->tree()->parent(); ancestor; ancestor = ancestor->tree()->parent()) {
         Document* document = ancestor->document();
-        if (!ancestor->loader()->isComplete() || document && document->processingLoadEvent())
+        if (!ancestor->loader()->isComplete() || (document && document->processingLoadEvent()))
             return true;
     }
     return false;
@@ -217,7 +221,13 @@ void RedirectScheduler::scheduleFormSubmission(const FrameLoadRequest& frameRequ
     // This may happen when a frame changes the location of another frame.
     bool duringLoad = !m_frame->loader()->committedFirstRealDocumentLoad();
 
-    schedule(new ScheduledRedirection(frameRequest, lockHistory, mustLockBackForwardList(m_frame), event, formState, duringLoad));
+    // If this is a child frame and the form submission was triggered by a script, lock the back/forward list
+    // to match IE and Opera.
+    // See https://bugs.webkit.org/show_bug.cgi?id=32383 for the original motivation for this.
+
+    bool lockBackForwardList = mustLockBackForwardList(m_frame) || (formState->formSubmissionTrigger() == SubmittedByJavaScript && m_frame->tree()->parent());
+
+    schedule(new ScheduledRedirection(frameRequest, lockHistory, lockBackForwardList, event, formState, duringLoad));
 }
 
 void RedirectScheduler::scheduleRefresh(bool wasUserGesture)
@@ -257,11 +267,23 @@ void RedirectScheduler::scheduleHistoryNavigation(int steps)
 
     // Invalid history navigations (such as history.forward() during a new load) have the side effect of cancelling any scheduled
     // redirects. We also avoid the possibility of cancelling the current load by avoiding the scheduled redirection altogether.
-    if (!m_frame->page()->canGoBackOrForward(steps)) { 
-        cancel(); 
-        return; 
-    } 
-
+    HistoryItem* specifiedEntry = m_frame->page()->backForwardList()->itemAtIndex(steps);
+    if (!specifiedEntry) {
+        cancel();
+        return;
+    }
+    
+#if !ENABLE(HISTORY_ALWAYS_ASYNC)
+    // If the specified entry and the current entry have the same document, this is either a state object traversal or a fragment 
+    // traversal (or both) and should be performed synchronously.
+    HistoryItem* currentEntry = m_frame->loader()->history()->currentItem();
+    if (currentEntry != specifiedEntry && currentEntry->documentSequenceNumber() == specifiedEntry->documentSequenceNumber()) {
+        m_frame->loader()->history()->goToItem(specifiedEntry, FrameLoadTypeIndexedBackForward);
+        return;
+    }
+#endif
+    
+    // In all other cases, schedule the history traversal to occur asynchronously.
     schedule(new ScheduledRedirection(steps));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/Request.cpp b/src/3rdparty/webkit/WebCore/loader/Request.cpp
index 7791a48027..630a4bb87c 100644
--- a/src/3rdparty/webkit/WebCore/loader/Request.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/Request.cpp
@@ -28,12 +28,12 @@
 
 namespace WebCore {
 
-Request::Request(DocLoader* docLoader, CachedResource* object, bool incremental, bool shouldSkipCanLoadCheck, bool sendResourceLoadCallbacks)
+Request::Request(DocLoader* docLoader, CachedResource* object, bool incremental, SecurityCheckPolicy shouldDoSecurityCheck, bool sendResourceLoadCallbacks)
     : m_object(object)
     , m_docLoader(docLoader)
     , m_incremental(incremental)
     , m_multipart(false)
-    , m_shouldSkipCanLoadCheck(shouldSkipCanLoadCheck)
+    , m_shouldDoSecurityCheck(shouldDoSecurityCheck)
     , m_sendResourceLoadCallbacks(sendResourceLoadCallbacks)
 {
     m_object->setRequest(this);
diff --git a/src/3rdparty/webkit/WebCore/loader/Request.h b/src/3rdparty/webkit/WebCore/loader/Request.h
index 07d1b82d82..468f8ff6af 100644
--- a/src/3rdparty/webkit/WebCore/loader/Request.h
+++ b/src/3rdparty/webkit/WebCore/loader/Request.h
@@ -23,6 +23,7 @@
 #ifndef Request_h
 #define Request_h
 
+#include "FrameLoaderTypes.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -30,9 +31,9 @@ namespace WebCore {
     class CachedResource;
     class DocLoader;
 
-    class Request {
+    class Request : public Noncopyable {
     public:
-        Request(DocLoader*, CachedResource*, bool incremental, bool skipCanLoadCheck, bool sendResourceLoadCallbacks);
+        Request(DocLoader*, CachedResource*, bool incremental, SecurityCheckPolicy, bool sendResourceLoadCallbacks);
         ~Request();
         
         Vector<char>& buffer() { return m_buffer; }
@@ -45,7 +46,7 @@ namespace WebCore {
         bool isMultipart() { return m_multipart; }
         void setIsMultipart(bool b = true) { m_multipart = b; }
 
-        bool shouldSkipCanLoadCheck() const { return m_shouldSkipCanLoadCheck; }
+        SecurityCheckPolicy shouldDoSecurityCheck() const { return m_shouldDoSecurityCheck; }
         bool sendResourceLoadCallbacks() const { return m_sendResourceLoadCallbacks; }
         
     private:
@@ -54,7 +55,7 @@ namespace WebCore {
         DocLoader* m_docLoader;
         bool m_incremental;
         bool m_multipart;
-        bool m_shouldSkipCanLoadCheck;
+        SecurityCheckPolicy m_shouldDoSecurityCheck;
         bool m_sendResourceLoadCallbacks;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.cpp b/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.cpp
index 4cddd01c39..92804345b3 100644
--- a/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.cpp
@@ -96,6 +96,11 @@ void ResourceLoadNotifier::didFailToLoad(ResourceLoader* loader, const ResourceE
 
     if (!error.isNull())
         m_frame->loader()->client()->dispatchDidFailLoading(loader->documentLoader(), loader->identifier(), error);
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->didFailLoading(loader->identifier(), error);
+#endif
 }
 
 void ResourceLoadNotifier::didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
@@ -126,7 +131,7 @@ void ResourceLoadNotifier::dispatchWillSendRequest(DocumentLoader* loader, unsig
 
 #if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
-        page->inspectorController()->willSendRequest(loader, identifier, request, redirectResponse);
+        page->inspectorController()->willSendRequest(identifier, request, redirectResponse);
 #endif
 }
 
@@ -136,7 +141,7 @@ void ResourceLoadNotifier::dispatchDidReceiveResponse(DocumentLoader* loader, un
 
 #if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
-        page->inspectorController()->didReceiveResponse(loader, identifier, r);
+        page->inspectorController()->didReceiveResponse(identifier, r);
 #endif
 }
 
@@ -146,7 +151,7 @@ void ResourceLoadNotifier::dispatchDidReceiveContentLength(DocumentLoader* loade
 
 #if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
-        page->inspectorController()->didReceiveContentLength(loader, identifier, length);
+        page->inspectorController()->didReceiveContentLength(identifier, length);
 #endif
 }
 
@@ -156,7 +161,7 @@ void ResourceLoadNotifier::dispatchDidFinishLoading(DocumentLoader* loader, unsi
 
 #if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
-        page->inspectorController()->didFinishLoading(loader, identifier);
+        page->inspectorController()->didFinishLoading(identifier);
 #endif
 }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.h b/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.h
index b09d7be1e2..23e4246fc4 100644
--- a/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.h
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.h
@@ -41,7 +41,7 @@ class ResourceError;
 class ResourceLoader;
 class ResourceResponse;
 class ScriptString;
-struct ResourceRequest;
+class ResourceRequest;
 
 class ResourceLoadNotifier : public Noncopyable {
 public:
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
index 9244cf0b19..64001d1242 100644
--- a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
@@ -34,6 +34,7 @@
 #include "DocumentLoader.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "InspectorTimelineAgent.h"
 #include "Page.h"
 #include "ProgressTracker.h"
 #include "ResourceHandle.h"
@@ -111,6 +112,17 @@ bool ResourceLoader::load(const ResourceRequest& r)
     ASSERT(!m_documentLoader->isSubstituteLoadPending(this));
     
     ResourceRequest clientRequest(r);
+    
+    // https://bugs.webkit.org/show_bug.cgi?id=26391
+    // The various plug-in implementations call directly to ResourceLoader::load() instead of piping requests
+    // through FrameLoader. As a result, they miss the FrameLoader::addExtraFieldsToRequest() step which sets
+    // up the 1st party for cookies URL. Until plug-in implementations can be reigned in to pipe through that
+    // method, we need to make sure there is always a 1st party for cookies set.
+    if (clientRequest.firstPartyForCookies().isNull()) {
+        if (Document* document = m_frame->document())
+            clientRequest.setFirstPartyForCookies(document->firstPartyForCookies());
+    }
+
     willSendRequest(clientRequest, ResourceResponse());
     if (clientRequest.isNull()) {
         didFail(frameLoader()->cancelledError(r));
@@ -130,7 +142,7 @@ bool ResourceLoader::load(const ResourceRequest& r)
         return true;
     }
     
-    m_handle = ResourceHandle::create(clientRequest, this, m_frame.get(), m_defersLoading, m_shouldContentSniff, true);
+    m_handle = ResourceHandle::create(clientRequest, this, m_frame.get(), m_defersLoading, m_shouldContentSniff);
 
     return true;
 }
@@ -318,7 +330,7 @@ void ResourceLoader::didCancel(const ResourceError& error)
     // load itself to be cancelled (which could happen with a javascript that 
     // changes the window location). This is used to prevent both the body
     // of this method and the body of connectionDidFinishLoading: running
-    // for a single delegate. Cancelling wins.
+    // for a single delegate. Canceling wins.
     m_cancelled = true;
     
     if (m_handle)
@@ -386,16 +398,44 @@ void ResourceLoader::didSendData(ResourceHandle*, unsigned long long bytesSent,
 
 void ResourceLoader::didReceiveResponse(ResourceHandle*, const ResourceResponse& response)
 {
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent::instanceCount()) {
+        InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0;
+        if (timelineAgent)
+            timelineAgent->willReceiveResourceResponse(identifier(), response);
+    }
+#endif
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     if (documentLoader()->applicationCacheHost()->maybeLoadFallbackForResponse(this, response))
         return;
 #endif
     didReceiveResponse(response);
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent::instanceCount()) {
+        InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0;
+        if (timelineAgent)
+            timelineAgent->didReceiveResourceResponse();
+    }
+#endif
 }
 
 void ResourceLoader::didReceiveData(ResourceHandle*, const char* data, int length, int lengthReceived)
 {
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent::instanceCount()) {
+        InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0;
+        if (timelineAgent)
+            timelineAgent->willReceiveResourceData(identifier());
+    }
+#endif
     didReceiveData(data, length, lengthReceived, false);
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent::instanceCount()) {
+        InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0;
+        if (timelineAgent)
+            timelineAgent->didReceiveResourceData();
+    }
+#endif
 }
 
 void ResourceLoader::didFinishLoading(ResourceHandle*)
diff --git a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp
index 2ee46267bd..f92a074ab5 100644
--- a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp
@@ -61,18 +61,18 @@ SubresourceLoader::~SubresourceLoader()
 #endif
 }
 
-PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, SubresourceLoaderClient* client, const ResourceRequest& request, bool skipCanLoadCheck, bool sendResourceLoadCallbacks, bool shouldContentSniff)
+PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, SubresourceLoaderClient* client, const ResourceRequest& request, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks, bool shouldContentSniff)
 {
     if (!frame)
         return 0;
 
     FrameLoader* fl = frame->loader();
-    if (!skipCanLoadCheck && (fl->state() == FrameStateProvisional || fl->activeDocumentLoader()->isStopping()))
+    if (securityCheck == DoSecurityCheck && (fl->state() == FrameStateProvisional || fl->activeDocumentLoader()->isStopping()))
         return 0;
 
     ResourceRequest newRequest = request;
 
-    if (!skipCanLoadCheck
+    if (securityCheck == DoSecurityCheck
             && SecurityOrigin::restrictAccessToLocal()
             && !SecurityOrigin::canLoad(request.url(), String(), frame->document())) {
         FrameLoader::reportLocalLoadFailed(frame, request.url().string());
diff --git a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.h b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.h
index 0fce930412..907d917931 100644
--- a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.h
@@ -28,17 +28,18 @@
 
 #ifndef SubresourceLoader_h
 #define SubresourceLoader_h
- 
+
+#include "FrameLoaderTypes.h"
 #include "ResourceLoader.h"
  
 namespace WebCore {
 
-    struct ResourceRequest;
+    class ResourceRequest;
     class SubresourceLoaderClient;
     
     class SubresourceLoader : public ResourceLoader {
     public:
-        static PassRefPtr<SubresourceLoader> create(Frame*, SubresourceLoaderClient*, const ResourceRequest&, bool skipCanLoadCheck = false, bool sendResourceLoadCallbacks = true, bool shouldContentSniff = true);
+        static PassRefPtr<SubresourceLoader> create(Frame*, SubresourceLoaderClient*, const ResourceRequest&, SecurityCheckPolicy = DoSecurityCheck, bool sendResourceLoadCallbacks = true, bool shouldContentSniff = true);
 
         void clearClient() { m_client = 0; }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/SubresourceLoaderClient.h b/src/3rdparty/webkit/WebCore/loader/SubresourceLoaderClient.h
index acf8e6afea..76fde47560 100644
--- a/src/3rdparty/webkit/WebCore/loader/SubresourceLoaderClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/SubresourceLoaderClient.h
@@ -33,7 +33,7 @@ namespace WebCore {
 
 class AuthenticationChallenge;
 class ResourceError;
-struct ResourceRequest;
+class ResourceRequest;
 class ResourceResponse;
 class SubresourceLoader;
     
diff --git a/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h
index a52bfad44a..f41a774cef 100644
--- a/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h
@@ -38,7 +38,7 @@
 namespace WebCore {
 
     class ResourceError;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
     class ScriptExecutionContext;
     class ThreadableLoaderClient;
diff --git a/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClient.h b/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClient.h
index 93a8e869df..b8a65841ae 100644
--- a/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClient.h
@@ -36,7 +36,7 @@ namespace WebCore {
     class ResourceError;
     class ResourceResponse;
 
-    class ThreadableLoaderClient {
+    class ThreadableLoaderClient : public Noncopyable {
     public:
         virtual void didSendData(unsigned long long /*bytesSent*/, unsigned long long /*totalBytesToBeSent*/) { }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
index bd362f46f2..25834987c6 100644
--- a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -42,7 +42,6 @@
 #include "WorkerContext.h"
 #include "WorkerLoaderProxy.h"
 #include "WorkerThread.h"
-#include <memory>
 #include <wtf/OwnPtr.h>
 #include <wtf/Threading.h>
 #include <wtf/Vector.h>
@@ -101,7 +100,7 @@ WorkerThreadableLoader::MainThreadBridge::~MainThreadBridge()
 {
 }
 
-void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, auto_ptr<CrossThreadResourceRequestData> requestData, ThreadableLoaderOptions options)
+void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, PassOwnPtr<CrossThreadResourceRequestData> requestData, ThreadableLoaderOptions options)
 {
     ASSERT(isMainThread());
     ASSERT(context->isDocument());
@@ -147,7 +146,7 @@ void WorkerThreadableLoader::MainThreadBridge::mainThreadCancel(ScriptExecutionC
 void WorkerThreadableLoader::MainThreadBridge::cancel()
 {
     m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCancel, this));
-    ThreadableLoaderClientWrapper* clientWrapper = static_cast<ThreadableLoaderClientWrapper*>(m_workerClientWrapper.get());
+    ThreadableLoaderClientWrapper* clientWrapper = m_workerClientWrapper.get();
     if (!clientWrapper->done()) {
         // If the client hasn't reached a termination state, then transition it by sending a cancellation error.
         // Note: no more client callbacks will be done after this method -- the clearClientWrapper() call ensures that.
@@ -160,7 +159,7 @@ void WorkerThreadableLoader::MainThreadBridge::cancel()
 
 void WorkerThreadableLoader::MainThreadBridge::clearClientWrapper()
 {
-    static_cast<ThreadableLoaderClientWrapper*>(m_workerClientWrapper.get())->clearClient();
+    m_workerClientWrapper->clearClient();
 }
 
 static void workerContextDidSendData(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
@@ -174,7 +173,7 @@ void WorkerThreadableLoader::MainThreadBridge::didSendData(unsigned long long by
     m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidSendData, m_workerClientWrapper, bytesSent, totalBytesToBeSent), m_taskMode);
 }
 
-static void workerContextDidReceiveResponse(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, auto_ptr<CrossThreadResourceResponseData> responseData)
+static void workerContextDidReceiveResponse(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, PassOwnPtr<CrossThreadResourceResponseData> responseData)
 {
     ASSERT_UNUSED(context, context->isWorkerContext());
     OwnPtr<ResourceResponse> response(ResourceResponse::adopt(responseData));
@@ -186,7 +185,7 @@ void WorkerThreadableLoader::MainThreadBridge::didReceiveResponse(const Resource
     m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveResponse, m_workerClientWrapper, response), m_taskMode);
 }
 
-static void workerContextDidReceiveData(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, auto_ptr<Vector<char> > vectorData)
+static void workerContextDidReceiveData(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, PassOwnPtr<Vector<char> > vectorData)
 {
     ASSERT_UNUSED(context, context->isWorkerContext());
     workerClientWrapper->didReceiveData(vectorData->data(), vectorData->size());
@@ -194,9 +193,9 @@ static void workerContextDidReceiveData(ScriptExecutionContext* context, RefPtr<
 
 void WorkerThreadableLoader::MainThreadBridge::didReceiveData(const char* data, int lengthReceived)
 {
-    auto_ptr<Vector<char> > vector(new Vector<char>(lengthReceived)); // needs to be an auto_ptr for usage with createCallbackTask.
+    OwnPtr<Vector<char> > vector(new Vector<char>(lengthReceived)); // needs to be an OwnPtr for usage with createCallbackTask.
     memcpy(vector->data(), data, lengthReceived);
-    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveData, m_workerClientWrapper, vector), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveData, m_workerClientWrapper, vector.release()), m_taskMode);
 }
 
 static void workerContextDidFinishLoading(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, unsigned long identifier)
@@ -232,7 +231,7 @@ void WorkerThreadableLoader::MainThreadBridge::didFailRedirectCheck()
     m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFailRedirectCheck, m_workerClientWrapper), m_taskMode);
 }
 
-static void workerContextDidReceiveAuthenticationCancellation(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, auto_ptr<CrossThreadResourceResponseData> responseData)
+static void workerContextDidReceiveAuthenticationCancellation(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, PassOwnPtr<CrossThreadResourceResponseData> responseData)
 {
     ASSERT_UNUSED(context, context->isWorkerContext());
     OwnPtr<ResourceResponse> response(ResourceResponse::adopt(responseData));
diff --git a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h
index 230c77d5bd..81da2e07de 100644
--- a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h
@@ -38,7 +38,7 @@
 #include "ThreadableLoaderClient.h"
 #include "ThreadableLoaderClientWrapper.h"
 
-#include <memory>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -47,7 +47,7 @@
 namespace WebCore {
 
     class ResourceError;
-    struct ResourceRequest;
+    class ResourceRequest;
     class WorkerContext;
     class WorkerLoaderProxy;
     struct CrossThreadResourceResponseData;
@@ -82,7 +82,7 @@ namespace WebCore {
         //
         // all cases. All tasks posted from the worker context's thread are ok because
         //    the last task posted always is "mainThreadDestroy", so MainThreadBridge is
-        //    around for all tasks that use it on the mian thread.
+        //    around for all tasks that use it on the main thread.
         //
         // case 1. worker.terminate is called.
         //    In this case, no more tasks are posted from the worker object's thread to the worker
@@ -94,7 +94,7 @@ namespace WebCore {
         //    thread do "ThreadableLoaderClientWrapper::ref" (automatically inside of the cross thread copy
         //    done in createCallbackTask), so the ThreadableLoaderClientWrapper instance is there until all
         //    tasks are executed.
-        class MainThreadBridge : ThreadableLoaderClient {
+        class MainThreadBridge : public ThreadableLoaderClient {
         public:
             // All executed on the worker context's thread.
             MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, const ThreadableLoaderOptions&);
@@ -109,7 +109,7 @@ namespace WebCore {
             static void mainThreadDestroy(ScriptExecutionContext*, MainThreadBridge*);
             ~MainThreadBridge();
 
-            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, std::auto_ptr<CrossThreadResourceRequestData>, ThreadableLoaderOptions);
+            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, PassOwnPtr<CrossThreadResourceRequestData>, ThreadableLoaderOptions);
             static void mainThreadCancel(ScriptExecutionContext*, MainThreadBridge*);
             virtual void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
             virtual void didReceiveResponse(const ResourceResponse&);
@@ -124,7 +124,7 @@ namespace WebCore {
 
             // ThreadableLoaderClientWrapper is to be used on the worker context thread.
             // The ref counting is done on either thread.
-            RefPtr<ThreadSafeShared<ThreadableLoaderClientWrapper> > m_workerClientWrapper;
+            RefPtr<ThreadableLoaderClientWrapper> m_workerClientWrapper;
 
             // May be used on either thread.
             WorkerLoaderProxy& m_loaderProxy;
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h
index d1444c0b78..08e2dd305a 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h
@@ -42,7 +42,7 @@ class ApplicationCacheResource;
 class DocumentLoader;
 class KURL;
 
-struct ResourceRequest;
+class ResourceRequest;
 
 typedef Vector<std::pair<KURL, KURL> > FallbackURLVector;
 
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index c66f36f0ed..526043b1af 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -32,6 +32,7 @@
 #include "ApplicationCacheHost.h"
 #include "ApplicationCacheResource.h"
 #include "ApplicationCacheStorage.h"
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "DocumentLoader.h"
 #include "DOMApplicationCache.h"
@@ -442,7 +443,7 @@ PassRefPtr<ResourceHandle> ApplicationCacheGroup::createResourceHandle(const KUR
         }
     }
     
-    return ResourceHandle::create(request, this, m_frame, false, true, false);
+    return ResourceHandle::create(request, this, m_frame, false, true);
 }
 
 void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const ResourceResponse& response)
@@ -622,7 +623,7 @@ void ApplicationCacheGroup::didFinishLoadingManifest()
         ASSERT(newestManifest);
     
         if (!m_manifestResource || // The resource will be null if HTTP response was 304 Not Modified.
-            newestManifest->data()->size() == m_manifestResource->data()->size() && !memcmp(newestManifest->data()->data(), m_manifestResource->data()->data(), newestManifest->data()->size())) {
+            (newestManifest->data()->size() == m_manifestResource->data()->size() && !memcmp(newestManifest->data()->data(), m_manifestResource->data()->data(), newestManifest->data()->size()))) {
 
             m_completionType = NoUpdate;
             m_manifestResource = 0;
@@ -774,7 +775,7 @@ void ApplicationCacheGroup::checkIfLoadIsComplete()
             ASSERT(cacheStorage().isMaximumSizeReached() && m_calledReachedMaxAppCacheSize);
         }
 
-        RefPtr<ApplicationCache> oldNewestCache = (m_newestCache == m_cacheBeingUpdated) ? RefPtr<ApplicationCache>(0) : m_newestCache;
+        RefPtr<ApplicationCache> oldNewestCache = (m_newestCache == m_cacheBeingUpdated) ? 0 : m_newestCache;
 
         setNewestCache(m_cacheBeingUpdated.release());
         if (cacheStorage().storeNewestCache(this)) {
@@ -947,9 +948,9 @@ void ApplicationCacheGroup::scheduleReachedMaxAppCacheSizeCallback()
 
 class CallCacheListenerTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<CallCacheListenerTask> create(PassRefPtr<DocumentLoader> loader, ApplicationCacheHost::EventID eventID)
+    static PassOwnPtr<CallCacheListenerTask> create(PassRefPtr<DocumentLoader> loader, ApplicationCacheHost::EventID eventID)
     {
-        return adoptRef(new CallCacheListenerTask(loader, eventID));
+        return new CallCacheListenerTask(loader, eventID);
     }
 
     virtual void performTask(ScriptExecutionContext* context)
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheHost.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheHost.cpp
index 751efc15e9..fc987461a8 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheHost.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheHost.cpp
@@ -46,6 +46,7 @@ namespace WebCore {
 ApplicationCacheHost::ApplicationCacheHost(DocumentLoader* documentLoader)
     : m_domApplicationCache(0)
     , m_documentLoader(documentLoader)
+    , m_defersEvents(true)
     , m_candidateApplicationCacheGroup(0)
 {
     ASSERT(m_documentLoader);
@@ -229,6 +230,11 @@ void ApplicationCacheHost::setDOMApplicationCache(DOMApplicationCache* domApplic
 
 void ApplicationCacheHost::notifyDOMApplicationCache(EventID id)
 {
+    if (m_defersEvents) {
+        // Events are deferred until document.onload has fired.
+        m_deferredEvents.append(id);
+        return;
+    }
     if (m_domApplicationCache) {
         ExceptionCode ec = 0;
         m_domApplicationCache->dispatchEvent(Event::create(DOMApplicationCache::toEventType(id), false, false), ec);
@@ -236,6 +242,21 @@ void ApplicationCacheHost::notifyDOMApplicationCache(EventID id)
     }
 }
 
+void ApplicationCacheHost::stopDeferringEvents()
+{
+    RefPtr<DocumentLoader> protect(documentLoader());
+    for (unsigned i = 0; i < m_deferredEvents.size(); ++i) {
+        EventID id = m_deferredEvents[i];
+        if (m_domApplicationCache) {
+            ExceptionCode ec = 0;
+            m_domApplicationCache->dispatchEvent(Event::create(DOMApplicationCache::toEventType(id), false, false), ec);
+            ASSERT(!ec);
+        }
+    }
+    m_deferredEvents.clear();
+    m_defersEvents = false;
+}
+
 void ApplicationCacheHost::setCandidateApplicationCacheGroup(ApplicationCacheGroup* group)
 {
     ASSERT(!m_applicationCache);
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheHost.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheHost.h
index 236013d1bb..52d4d40b5f 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheHost.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheHost.h
@@ -33,6 +33,7 @@
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 
+#include <wtf/Deque.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -45,7 +46,7 @@ namespace WebCore {
     class KURL;
     class ResourceLoader;
     class ResourceError;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
     class SubstituteData;
 #if PLATFORM(CHROMIUM)
@@ -57,7 +58,7 @@ namespace WebCore {
     class ApplicationCacheStorage;
 #endif
 
-    class ApplicationCacheHost {
+    class ApplicationCacheHost : public Noncopyable {
     public:
         // The Status numeric values are specified in the HTML5 spec.
         enum Status {
@@ -110,12 +111,16 @@ namespace WebCore {
         void setDOMApplicationCache(DOMApplicationCache* domApplicationCache);
         void notifyDOMApplicationCache(EventID id);
 
+        void stopDeferringEvents(); // Also raises the events that have been queued up.
+
     private:
         bool isApplicationCacheEnabled();
         DocumentLoader* documentLoader() { return m_documentLoader; }
 
         DOMApplicationCache* m_domApplicationCache;
         DocumentLoader* m_documentLoader;
+        bool m_defersEvents; // Events are deferred until after document onload.
+        Vector<EventID> m_deferredEvents;
 
 #if PLATFORM(CHROMIUM)
         friend class ApplicationCacheHostInternal;
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp
index d6ee72390b..1e97d789bd 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp
@@ -405,7 +405,7 @@ int64_t ApplicationCacheStorage::spaceNeeded(int64_t cacheToSave)
         totalAvailableSize = (m_maximumSize - currentSize) + m_database.freeSpaceSize();
     }
 
-    // The space needed to be freed in order to accomodate the failed cache is
+    // The space needed to be freed in order to accommodate the failed cache is
     // the size of the failed cache minus any already available free space.
     spaceNeeded = cacheToSave - totalAvailableSize;
     // The space needed value must be positive (or else the total already
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h
index 1348aa92b5..aaa5c9cb46 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h
@@ -44,7 +44,7 @@ class KURL;
 template <class T>
 class StorageIDJournal;
 
-class ApplicationCacheStorage {
+class ApplicationCacheStorage : public Noncopyable {
 public:
     void setCacheDirectory(const String&);
     const String& cacheDirectory() const;
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp
index 29c1bd566d..b9297b1180 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp
@@ -42,7 +42,6 @@ namespace WebCore {
 DOMApplicationCache::DOMApplicationCache(Frame* frame)
     : m_frame(frame)
 {
-    ASSERT(!m_frame || applicationCacheHost());
     ApplicationCacheHost* cacheHost = applicationCacheHost();
     if (cacheHost)
         cacheHost->setDOMApplicationCache(this);
@@ -87,8 +86,9 @@ void DOMApplicationCache::swapCache(ExceptionCode& ec)
 
 ScriptExecutionContext* DOMApplicationCache::scriptExecutionContext() const
 {
-    ASSERT(m_frame);
-    return m_frame->document();
+    if (m_frame)
+        return m_frame->document();
+    return 0;
 }
 
 const AtomicString& DOMApplicationCache::toEventType(ApplicationCacheHost::EventID id)
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl
index dd5468ac4b..9794baf6cf 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl
@@ -27,7 +27,8 @@ module offline {
  
     interface [
         Conditional=OFFLINE_WEB_APPLICATIONS,
-        EventTarget
+        EventTarget,
+        OmitConstructor
     ] DOMApplicationCache {
         // update status
         const unsigned short UNCACHED = 0;
@@ -54,12 +55,12 @@ module offline {
         attribute EventListener onobsolete;
 
         // EventTarget interface
-        [Custom] void addEventListener(in DOMString type, 
-                                       in EventListener listener, 
-                                       in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type, 
+        [JSCCustom] void addEventListener(in DOMString type, 
                                           in EventListener listener, 
                                           in boolean useCapture);
+        [JSCCustom] void removeEventListener(in DOMString type, 
+                                             in EventListener listener, 
+                                             in boolean useCapture);
         boolean dispatchEvent(in Event evt)
             raises(EventException);
     };
diff --git a/src/3rdparty/webkit/WebCore/loader/archive/ArchiveFactory.cpp b/src/3rdparty/webkit/WebCore/loader/archive/ArchiveFactory.cpp
index 1322dbb81b..d09b0642db 100644
--- a/src/3rdparty/webkit/WebCore/loader/archive/ArchiveFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/archive/ArchiveFactory.cpp
@@ -29,12 +29,13 @@
 #include "config.h"
 #include "ArchiveFactory.h"
 
-#if PLATFORM(CF)
-#include "LegacyWebArchive.h"
-#endif
 #include "MIMETypeRegistry.h"
 #include "PlatformString.h"
 
+#if PLATFORM(CF) && !PLATFORM(QT)
+#include "LegacyWebArchive.h"
+#endif
+
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/StdLibExtras.h>
@@ -55,14 +56,14 @@ static ArchiveMIMETypesMap& archiveMIMETypes()
 {
     DEFINE_STATIC_LOCAL(ArchiveMIMETypesMap, mimeTypes, ());
     static bool initialized = false;
-    
+
     if (initialized)
         return mimeTypes;
-    
-#if PLATFORM(CF)
+
+#if PLATFORM(CF) && !PLATFORM(QT)
     mimeTypes.set("application/x-webarchive", archiveFactoryCreate<LegacyWebArchive>);
 #endif
-        
+
     initialized = true;
     return mimeTypes;
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.cpp b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.cpp
deleted file mode 100644
index 3141e98415..0000000000
--- a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.cpp
+++ /dev/null
@@ -1,590 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "LegacyWebArchive.h"
-
-#include "CString.h"
-#include "Cache.h"
-#include "Document.h"
-#include "DocumentLoader.h"
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "FrameTree.h"
-#include "HTMLFrameOwnerElement.h"
-#include "HTMLNames.h"
-#include "IconDatabase.h"
-#include "Image.h"
-#include "KURLHash.h"
-#include "Logging.h"
-#include "markup.h"
-#include "Node.h"
-#include "Range.h"
-#include "SelectionController.h"
-#include "SharedBuffer.h"
-#include <wtf/ListHashSet.h>
-#include <wtf/RetainPtr.h>
-
-namespace WebCore {
-
-static const CFStringRef LegacyWebArchiveMainResourceKey = CFSTR("WebMainResource");
-static const CFStringRef LegacyWebArchiveSubresourcesKey = CFSTR("WebSubresources");
-static const CFStringRef LegacyWebArchiveSubframeArchivesKey = CFSTR("WebSubframeArchives");
-static const CFStringRef LegacyWebArchiveResourceDataKey = CFSTR("WebResourceData");
-static const CFStringRef LegacyWebArchiveResourceFrameNameKey = CFSTR("WebResourceFrameName");
-static const CFStringRef LegacyWebArchiveResourceMIMETypeKey = CFSTR("WebResourceMIMEType");
-static const CFStringRef LegacyWebArchiveResourceURLKey = CFSTR("WebResourceURL");
-static const CFStringRef LegacyWebArchiveResourceTextEncodingNameKey = CFSTR("WebResourceTextEncodingName");
-static const CFStringRef LegacyWebArchiveResourceResponseKey = CFSTR("WebResourceResponse");
-static const CFStringRef LegacyWebArchiveResourceResponseVersionKey = CFSTR("WebResourceResponseVersion");
-
-RetainPtr<CFDictionaryRef> LegacyWebArchive::createPropertyListRepresentation(ArchiveResource* resource, MainResourceStatus isMainResource)
-{
-    if (!resource) {
-        // The property list representation of a null/empty WebResource has the following 3 objects stored as nil.
-        // FIXME: 0 is not serializable. Presumably we need to use kCFNull here instead for compatibility.
-        // FIXME: But why do we need to support a resource of 0? Who relies on that?
-        RetainPtr<CFMutableDictionaryRef> propertyList(AdoptCF, CFDictionaryCreateMutable(0, 3, 0, 0));
-        CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceDataKey, 0);
-        CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceURLKey, 0);
-        CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceMIMETypeKey, 0);
-        return propertyList;
-    }
-    
-    RetainPtr<CFMutableDictionaryRef> propertyList(AdoptCF, CFDictionaryCreateMutable(0, 6, 0, &kCFTypeDictionaryValueCallBacks));
-    
-    // Resource data can be empty, but must be represented by an empty CFDataRef
-    SharedBuffer* data = resource->data();
-    RetainPtr<CFDataRef> cfData;
-    if (data)
-        cfData.adoptCF(data->createCFData());
-    else
-        cfData.adoptCF(CFDataCreate(0, 0, 0));
-    CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceDataKey, cfData.get());
-    
-    // Resource URL cannot be null
-    RetainPtr<CFStringRef> cfURL(AdoptCF, resource->url().string().createCFString());
-    if (cfURL)
-        CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceURLKey, cfURL.get());
-    else {
-        LOG(Archives, "LegacyWebArchive - NULL resource URL is invalid - returning null property list");
-        return 0;
-    }
-
-    // FrameName should be left out if empty for subresources, but always included for main resources
-    const String& frameName(resource->frameName());
-    if (!frameName.isEmpty() || isMainResource) {
-        RetainPtr<CFStringRef> cfFrameName(AdoptCF, frameName.createCFString());
-        CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceFrameNameKey, cfFrameName.get());
-    }
-    
-    // Set MIMEType, TextEncodingName, and ResourceResponse only if they actually exist
-    const String& mimeType(resource->mimeType());
-    if (!mimeType.isEmpty()) {
-        RetainPtr<CFStringRef> cfMIMEType(AdoptCF, mimeType.createCFString());
-        CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceMIMETypeKey, cfMIMEType.get());
-    }
-    
-    const String& textEncoding(resource->textEncoding());
-    if (!textEncoding.isEmpty()) {
-        RetainPtr<CFStringRef> cfTextEncoding(AdoptCF, textEncoding.createCFString());
-        CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceTextEncodingNameKey, cfTextEncoding.get());
-    }
-
-    // Don't include the resource response for the main resource
-    if (!isMainResource) {
-        RetainPtr<CFDataRef> resourceResponseData = createPropertyListRepresentation(resource->response());
-        if (resourceResponseData)
-            CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceResponseKey, resourceResponseData.get());    
-    }
-    
-    return propertyList;
-}
-
-RetainPtr<CFDictionaryRef> LegacyWebArchive::createPropertyListRepresentation(Archive* archive)
-{
-    RetainPtr<CFMutableDictionaryRef> propertyList(AdoptCF, CFDictionaryCreateMutable(0, 3, 0, &kCFTypeDictionaryValueCallBacks));
-    
-    RetainPtr<CFDictionaryRef> mainResourceDict = createPropertyListRepresentation(archive->mainResource(), MainResource);
-    ASSERT(mainResourceDict);
-    if (!mainResourceDict)
-        return 0;
-    CFDictionarySetValue(propertyList.get(), LegacyWebArchiveMainResourceKey, mainResourceDict.get());
-
-    RetainPtr<CFMutableArrayRef> subresourcesArray(AdoptCF, CFArrayCreateMutable(0, archive->subresources().size(), &kCFTypeArrayCallBacks));
-    const Vector<RefPtr<ArchiveResource> >& subresources(archive->subresources());
-    for (unsigned i = 0; i < subresources.size(); ++i) {
-        RetainPtr<CFDictionaryRef> subresource = createPropertyListRepresentation(subresources[i].get(), Subresource);
-        if (subresource)
-            CFArrayAppendValue(subresourcesArray.get(), subresource.get());
-        else
-            LOG(Archives, "LegacyWebArchive - Failed to create property list for subresource");
-    }
-    if (CFArrayGetCount(subresourcesArray.get()))
-        CFDictionarySetValue(propertyList.get(), LegacyWebArchiveSubresourcesKey, subresourcesArray.get());
-
-    RetainPtr<CFMutableArrayRef> subframesArray(AdoptCF, CFArrayCreateMutable(0, archive->subframeArchives().size(), &kCFTypeArrayCallBacks));
-    const Vector<RefPtr<Archive> >& subframeArchives(archive->subframeArchives());
-    for (unsigned i = 0; i < subframeArchives.size(); ++i) {
-        RetainPtr<CFDictionaryRef> subframeArchive = createPropertyListRepresentation(subframeArchives[i].get());
-        if (subframeArchive)
-            CFArrayAppendValue(subframesArray.get(), subframeArchive.get());
-        else
-            LOG(Archives, "LegacyWebArchive - Failed to create property list for subframe archive");
-    }
-    if (CFArrayGetCount(subframesArray.get()))
-        CFDictionarySetValue(propertyList.get(), LegacyWebArchiveSubframeArchivesKey, subframesArray.get());
-
-    return propertyList;
-}
-
-ResourceResponse LegacyWebArchive::createResourceResponseFromPropertyListData(CFDataRef data, CFStringRef responseDataType)
-{
-    ASSERT(data);
-    if (!data)
-        return ResourceResponse();
-    
-    // If the ResourceResponseVersion (passed in as responseDataType) exists at all, this is a "new" web archive that we
-    // can parse well in a cross platform manner If it doesn't exist, we will assume this is an "old" web archive with,
-    // NSURLResponse objects in it and parse the ResourceResponse as such.
-    if (!responseDataType)
-        return createResourceResponseFromMacArchivedData(data);
-        
-    // FIXME: Parse the "new" format that the above comment references here. This format doesn't exist yet.
-    return ResourceResponse();
-}
-
-PassRefPtr<ArchiveResource> LegacyWebArchive::createResource(CFDictionaryRef dictionary)
-{
-    ASSERT(dictionary);
-    if (!dictionary)
-        return 0;
-        
-    CFDataRef resourceData = static_cast<CFDataRef>(CFDictionaryGetValue(dictionary, LegacyWebArchiveResourceDataKey));
-    if (resourceData && CFGetTypeID(resourceData) != CFDataGetTypeID()) {
-        LOG(Archives, "LegacyWebArchive - Resource data is not of type CFData, cannot create invalid resource");
-        return 0;
-    }
-    
-    CFStringRef frameName = static_cast<CFStringRef>(CFDictionaryGetValue(dictionary, LegacyWebArchiveResourceFrameNameKey));
-    if (frameName && CFGetTypeID(frameName) != CFStringGetTypeID()) {
-        LOG(Archives, "LegacyWebArchive - Frame name is not of type CFString, cannot create invalid resource");
-        return 0;
-    }
-    
-    CFStringRef mimeType = static_cast<CFStringRef>(CFDictionaryGetValue(dictionary, LegacyWebArchiveResourceMIMETypeKey));
-    if (mimeType && CFGetTypeID(mimeType) != CFStringGetTypeID()) {
-        LOG(Archives, "LegacyWebArchive - MIME type is not of type CFString, cannot create invalid resource");
-        return 0;
-    }
-    
-    CFStringRef url = static_cast<CFStringRef>(CFDictionaryGetValue(dictionary, LegacyWebArchiveResourceURLKey));
-    if (url && CFGetTypeID(url) != CFStringGetTypeID()) {
-        LOG(Archives, "LegacyWebArchive - URL is not of type CFString, cannot create invalid resource");
-        return 0;
-    }
-    
-    CFStringRef textEncoding = static_cast<CFStringRef>(CFDictionaryGetValue(dictionary, LegacyWebArchiveResourceTextEncodingNameKey));
-    if (textEncoding && CFGetTypeID(textEncoding) != CFStringGetTypeID()) {
-        LOG(Archives, "LegacyWebArchive - Text encoding is not of type CFString, cannot create invalid resource");
-        return 0;
-    }
-
-    ResourceResponse response;
-    
-    CFDataRef resourceResponseData = static_cast<CFDataRef>(CFDictionaryGetValue(dictionary, LegacyWebArchiveResourceResponseKey));
-    if (resourceResponseData) {
-        if (CFGetTypeID(resourceResponseData) != CFDataGetTypeID()) {
-            LOG(Archives, "LegacyWebArchive - Resource response data is not of type CFData, cannot create invalid resource");
-            return 0;
-        }
-        
-        CFStringRef resourceResponseVersion = static_cast<CFStringRef>(CFDictionaryGetValue(dictionary, LegacyWebArchiveResourceResponseVersionKey));
-        if (resourceResponseVersion && CFGetTypeID(resourceResponseVersion) != CFStringGetTypeID()) {
-            LOG(Archives, "LegacyWebArchive - Resource response version is not of type CFString, cannot create invalid resource");
-            return 0;
-        }
-        
-        response = createResourceResponseFromPropertyListData(resourceResponseData, resourceResponseVersion);
-    }
-    
-    return ArchiveResource::create(SharedBuffer::create(CFDataGetBytePtr(resourceData), CFDataGetLength(resourceData)), KURL(ParsedURLString, url), mimeType, textEncoding, frameName, response);
-}
-
-PassRefPtr<LegacyWebArchive> LegacyWebArchive::create()
-{
-    return adoptRef(new LegacyWebArchive);
-}
-
-PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(PassRefPtr<ArchiveResource> mainResource, Vector<PassRefPtr<ArchiveResource> >& subresources, Vector<PassRefPtr<LegacyWebArchive> >& subframeArchives)
-{
-    ASSERT(mainResource);
-    if (!mainResource)
-        return 0;
-    
-    RefPtr<LegacyWebArchive> archive = create();
-    archive->setMainResource(mainResource);
-    
-    for (unsigned i = 0; i < subresources.size(); ++i)
-        archive->addSubresource(subresources[i]);
-    
-    for (unsigned i = 0; i < subframeArchives.size(); ++i)
-        archive->addSubframeArchive(subframeArchives[i]);  
-        
-    return archive.release();
-}
-
-PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(SharedBuffer* data)
-{
-    LOG(Archives, "LegacyWebArchive - Creating from raw data");
-    
-    RefPtr<LegacyWebArchive> archive = create();
-        
-    ASSERT(data);
-    if (!data)
-        return 0;
-        
-    RetainPtr<CFDataRef> cfData(AdoptCF, data->createCFData());
-    if (!cfData)
-        return 0;
-        
-    CFStringRef errorString = 0;
-    
-    RetainPtr<CFDictionaryRef> plist(AdoptCF, static_cast<CFDictionaryRef>(CFPropertyListCreateFromXMLData(0, cfData.get(), kCFPropertyListImmutable, &errorString)));
-    if (!plist) {
-#ifndef NDEBUG
-        const char* cError = errorString ? CFStringGetCStringPtr(errorString, kCFStringEncodingUTF8) : "unknown error";
-        LOG(Archives, "LegacyWebArchive - Error parsing PropertyList from archive data - %s", cError);
-#endif
-        if (errorString)
-            CFRelease(errorString);
-        return 0;
-    }
-    
-    if (CFGetTypeID(plist.get()) != CFDictionaryGetTypeID()) {
-        LOG(Archives, "LegacyWebArchive - Archive property list is not the expected CFDictionary, aborting invalid WebArchive");
-        return 0;
-    }
-    
-    if (!archive->extract(plist.get()))
-        return 0;
-
-    return archive.release();
-}
-
-bool LegacyWebArchive::extract(CFDictionaryRef dictionary)
-{
-    ASSERT(dictionary);
-    if (!dictionary) {
-        LOG(Archives, "LegacyWebArchive - Null root CFDictionary, aborting invalid WebArchive");
-        return false;
-    }
-    
-    CFDictionaryRef mainResourceDict = static_cast<CFDictionaryRef>(CFDictionaryGetValue(dictionary, LegacyWebArchiveMainResourceKey));
-    if (!mainResourceDict) {
-        LOG(Archives, "LegacyWebArchive - No main resource in archive, aborting invalid WebArchive");
-        return false;
-    }
-    if (CFGetTypeID(mainResourceDict) != CFDictionaryGetTypeID()) {
-        LOG(Archives, "LegacyWebArchive - Main resource is not the expected CFDictionary, aborting invalid WebArchive");
-        return false;
-    }
-    
-    setMainResource(createResource(mainResourceDict));
-    if (!mainResource()) {
-        LOG(Archives, "LegacyWebArchive - Failed to parse main resource from CFDictionary or main resource does not exist, aborting invalid WebArchive");
-        return false;
-    }
-    
-    CFArrayRef subresourceArray = static_cast<CFArrayRef>(CFDictionaryGetValue(dictionary, LegacyWebArchiveSubresourcesKey));
-    if (subresourceArray && CFGetTypeID(subresourceArray) != CFArrayGetTypeID()) {
-        LOG(Archives, "LegacyWebArchive - Subresources is not the expected Array, aborting invalid WebArchive");
-        return false;
-    }
-    
-    if (subresourceArray) {
-        CFIndex count = CFArrayGetCount(subresourceArray);
-        for (CFIndex i = 0; i < count; ++i) {
-            CFDictionaryRef subresourceDict = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(subresourceArray, i));
-            if (CFGetTypeID(subresourceDict) != CFDictionaryGetTypeID()) {
-                LOG(Archives, "LegacyWebArchive - Subresource is not expected CFDictionary, aborting invalid WebArchive");
-                return false;
-            }
-            addSubresource(createResource(subresourceDict));
-        }
-    }
-    
-    CFArrayRef subframeArray = static_cast<CFArrayRef>(CFDictionaryGetValue(dictionary, LegacyWebArchiveSubframeArchivesKey));
-    if (subframeArray && CFGetTypeID(subframeArray) != CFArrayGetTypeID()) {
-        LOG(Archives, "LegacyWebArchive - Subframe archives is not the expected Array, aborting invalid WebArchive");
-        return false;
-    }
-    
-    if (subframeArray) {
-        CFIndex count = CFArrayGetCount(subframeArray);
-        for (CFIndex i = 0; i < count; ++i) {
-            CFDictionaryRef subframeDict = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(subframeArray, i));
-            if (CFGetTypeID(subframeDict) != CFDictionaryGetTypeID()) {
-                LOG(Archives, "LegacyWebArchive - Subframe array is not expected CFDictionary, aborting invalid WebArchive");
-                return false;
-            }
-            
-            RefPtr<LegacyWebArchive> subframeArchive = create();
-            if (subframeArchive->extract(subframeDict))
-                addSubframeArchive(subframeArchive.release());
-            else
-                LOG(Archives, "LegacyWebArchive - Invalid subframe archive skipped");
-        }
-    }
-    
-    return true;
-}
-
-RetainPtr<CFDataRef> LegacyWebArchive::rawDataRepresentation()
-{
-    RetainPtr<CFDictionaryRef> propertyList = createPropertyListRepresentation(this);
-    ASSERT(propertyList);
-    if (!propertyList) {
-        LOG(Archives, "LegacyWebArchive - Failed to create property list for archive, returning no data");
-        return 0;
-    }
-
-    RetainPtr<CFWriteStreamRef> stream(AdoptCF, CFWriteStreamCreateWithAllocatedBuffers(0, 0));
-
-    CFWriteStreamOpen(stream.get());
-    CFPropertyListWriteToStream(propertyList.get(), stream.get(), kCFPropertyListBinaryFormat_v1_0, 0);
-
-    RetainPtr<CFDataRef> plistData(AdoptCF, static_cast<CFDataRef>(CFWriteStreamCopyProperty(stream.get(), kCFStreamPropertyDataWritten)));
-    ASSERT(plistData);
-
-    CFWriteStreamClose(stream.get());
-
-    if (!plistData) {
-        LOG(Archives, "LegacyWebArchive - Failed to convert property list into raw data, returning no data");
-        return 0;
-    }
-
-    return plistData;
-}
-
-#if !PLATFORM(MAC)
-
-ResourceResponse LegacyWebArchive::createResourceResponseFromMacArchivedData(CFDataRef responseData)
-{
-    // FIXME: If is is possible to parse in a serialized NSURLResponse manually, without using
-    // NSKeyedUnarchiver, manipulating plists directly, then we want to do that here.
-    // Until then, this can be done on Mac only.
-    return ResourceResponse();
-}
-
-RetainPtr<CFDataRef> LegacyWebArchive::createPropertyListRepresentation(const ResourceResponse& response)
-{
-    // FIXME: Write out the "new" format described in createResourceResponseFromPropertyListData once we invent it.
-    return 0;
-}
-
-#endif
-
-PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(Node* node)
-{
-    ASSERT(node);
-    if (!node)
-        return create();
-        
-    Document* document = node->document();
-    Frame* frame = document ? document->frame() : 0;
-    if (!frame)
-        return create();
-        
-    Vector<Node*> nodeList;
-    String markupString = createMarkup(node, IncludeNode, &nodeList);
-    Node::NodeType nodeType = node->nodeType();
-    if (nodeType != Node::DOCUMENT_NODE && nodeType != Node::DOCUMENT_TYPE_NODE)
-        markupString = frame->documentTypeString() + markupString;
-
-    return create(markupString, frame, nodeList);
-}
-
-PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(Frame* frame)
-{
-    ASSERT(frame);
-    
-    DocumentLoader* documentLoader = frame->loader()->documentLoader();
-
-    if (!documentLoader)
-        return 0;
-        
-    Vector<PassRefPtr<LegacyWebArchive> > subframeArchives;
-    
-    unsigned children = frame->tree()->childCount();
-    for (unsigned i = 0; i < children; ++i) {
-        RefPtr<LegacyWebArchive> childFrameArchive = create(frame->tree()->child(i));
-        if (childFrameArchive)
-            subframeArchives.append(childFrameArchive.release());
-    }
-
-    Vector<PassRefPtr<ArchiveResource> > subresources;
-    documentLoader->getSubresources(subresources);
-
-    return create(documentLoader->mainResource(), subresources, subframeArchives);
-}
-
-PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(Range* range)
-{
-    if (!range)
-        return 0;
-    
-    Node* startContainer = range->startContainer();
-    if (!startContainer)
-        return 0;
-        
-    Document* document = startContainer->document();
-    if (!document)
-        return 0;
-        
-    Frame* frame = document->frame();
-    if (!frame)
-        return 0;
-    
-    Vector<Node*> nodeList;
-    
-    // FIXME: This is always "for interchange". Is that right? See the previous method.
-    String markupString = frame->documentTypeString() + createMarkup(range, &nodeList, AnnotateForInterchange);
-
-    return create(markupString, frame, nodeList);
-}
-
-PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString, Frame* frame, const Vector<Node*>& nodes)
-{
-    ASSERT(frame);
-    
-    const ResourceResponse& response = frame->loader()->documentLoader()->response();
-    KURL responseURL = response.url();
-    
-    // it's possible to have a response without a URL here
-    // <rdar://problem/5454935>
-    if (responseURL.isNull())
-        responseURL = KURL(ParsedURLString, "");
-        
-    PassRefPtr<ArchiveResource> mainResource = ArchiveResource::create(utf8Buffer(markupString), responseURL, response.mimeType(), "UTF-8", frame->tree()->name());
-
-    Vector<PassRefPtr<LegacyWebArchive> > subframeArchives;
-    Vector<PassRefPtr<ArchiveResource> > subresources;
-    HashSet<KURL> uniqueSubresources;
-
-    size_t nodesSize = nodes.size();    
-    for (size_t i = 0; i < nodesSize; ++i) {
-        Node* node = nodes[i];
-        Frame* childFrame;
-        if ((node->hasTagName(HTMLNames::frameTag) || node->hasTagName(HTMLNames::iframeTag) || node->hasTagName(HTMLNames::objectTag)) &&
-             (childFrame = static_cast<HTMLFrameOwnerElement*>(node)->contentFrame())) {
-            RefPtr<LegacyWebArchive> subframeArchive = create(childFrame->document());
-            
-            if (subframeArchive)
-                subframeArchives.append(subframeArchive);
-            else
-                LOG_ERROR("Unabled to archive subframe %s", childFrame->tree()->name().string().utf8().data());
-        } else {
-            ListHashSet<KURL> subresourceURLs;
-            node->getSubresourceURLs(subresourceURLs);
-            
-            DocumentLoader* documentLoader = frame->loader()->documentLoader();
-            ListHashSet<KURL>::iterator iterEnd = subresourceURLs.end();
-            for (ListHashSet<KURL>::iterator iter = subresourceURLs.begin(); iter != iterEnd; ++iter) {
-                const KURL& subresourceURL = *iter;
-                if (uniqueSubresources.contains(subresourceURL))
-                    continue;
-
-                uniqueSubresources.add(subresourceURL);
-
-                RefPtr<ArchiveResource> resource = documentLoader->subresource(subresourceURL);
-                if (resource) {
-                    subresources.append(resource.release());
-                    continue;
-                }
-
-                CachedResource *cachedResource = cache()->resourceForURL(subresourceURL);
-                if (cachedResource) {
-                    resource = ArchiveResource::create(cachedResource->data(), subresourceURL, cachedResource->response());
-                    if (resource) {
-                        subresources.append(resource.release());
-                        continue;
-                    }
-                }
-
-                // FIXME: should do something better than spew to console here
-                LOG_ERROR("Failed to archive subresource for %s", subresourceURL.string().utf8().data());
-            }
-        }
-    }
-
-    // Add favicon if one exists for this page, if we are archiving the entire page.
-    if (nodesSize && nodes[0]->isDocumentNode() && iconDatabase() && iconDatabase()->isEnabled()) {
-        const String& iconURL = iconDatabase()->iconURLForPageURL(responseURL);
-        if (!iconURL.isEmpty() && iconDatabase()->iconDataKnownForIconURL(iconURL)) {
-            if (Image* iconImage = iconDatabase()->iconForPageURL(responseURL, IntSize(16, 16))) {
-                if (RefPtr<ArchiveResource> resource = ArchiveResource::create(iconImage->data(), KURL(ParsedURLString, iconURL), "image/x-icon", "", ""))
-                    subresources.append(resource.release());
-            }
-        }
-    }
-
-    return create(mainResource, subresources, subframeArchives);
-}
-
-PassRefPtr<LegacyWebArchive> LegacyWebArchive::createFromSelection(Frame* frame)
-{
-    if (!frame)
-        return 0;
-    
-    RefPtr<Range> selectionRange = frame->selection()->toNormalizedRange();
-    Vector<Node*> nodeList;
-    String markupString = frame->documentTypeString() + createMarkup(selectionRange.get(), &nodeList, AnnotateForInterchange);
-    
-    RefPtr<LegacyWebArchive> archive = create(markupString, frame, nodeList);
-    
-    if (!frame->document() || !frame->document()->isFrameSet())
-        return archive.release();
-        
-    // Wrap the frameset document in an iframe so it can be pasted into
-    // another document (which will have a body or frameset of its own). 
-    String iframeMarkup = String::format("<iframe frameborder=\"no\" marginwidth=\"0\" marginheight=\"0\" width=\"98%%\" height=\"98%%\" src=\"%s\"></iframe>", 
-                                         frame->loader()->documentLoader()->response().url().string().utf8().data());
-    RefPtr<ArchiveResource> iframeResource = ArchiveResource::create(utf8Buffer(iframeMarkup), blankURL(), "text/html", "UTF-8", String());
-
-    Vector<PassRefPtr<ArchiveResource> > subresources;
-
-    Vector<PassRefPtr<LegacyWebArchive> > subframeArchives;
-    subframeArchives.append(archive);
-    
-    archive = create(iframeResource.release(), subresources, subframeArchives);
-    
-    return archive.release();
-}
-
-}
diff --git a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.h b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.h
deleted file mode 100644
index 8c8f2e4ff6..0000000000
--- a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.h
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef LegacyWebArchive_h
-#define LegacyWebArchive_h
-
-#include "Archive.h"
-
-namespace WebCore {
-
-class Frame;
-class Node;
-class Range;
-
-class LegacyWebArchive : public Archive {
-public:
-    static PassRefPtr<LegacyWebArchive> create();
-    static PassRefPtr<LegacyWebArchive> create(SharedBuffer*);
-    static PassRefPtr<LegacyWebArchive> create(PassRefPtr<ArchiveResource> mainResource, Vector<PassRefPtr<ArchiveResource> >& subresources, Vector<PassRefPtr<LegacyWebArchive> >& subframeArchives);
-    static PassRefPtr<LegacyWebArchive> create(Node*);
-    static PassRefPtr<LegacyWebArchive> create(Frame*);
-    static PassRefPtr<LegacyWebArchive> createFromSelection(Frame*);
-    static PassRefPtr<LegacyWebArchive> create(Range*);
-
-    RetainPtr<CFDataRef> rawDataRepresentation();
-
-private:
-    LegacyWebArchive() { }
-
-    enum MainResourceStatus { Subresource, MainResource };
-
-    static PassRefPtr<LegacyWebArchive> create(const String& markupString, Frame*, const Vector<Node*>& nodes);
-    static PassRefPtr<ArchiveResource> createResource(CFDictionaryRef);
-    static ResourceResponse createResourceResponseFromMacArchivedData(CFDataRef);
-    static ResourceResponse createResourceResponseFromPropertyListData(CFDataRef, CFStringRef responseDataType);
-    static RetainPtr<CFDataRef> createPropertyListRepresentation(const ResourceResponse&);
-    static RetainPtr<CFDictionaryRef> createPropertyListRepresentation(Archive*);
-    static RetainPtr<CFDictionaryRef> createPropertyListRepresentation(ArchiveResource*, MainResourceStatus);
-
-    bool extract(CFDictionaryRef);
-};
-
-}
-
-#endif // Archive
diff --git a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchiveMac.mm b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchiveMac.mm
deleted file mode 100644
index c474bbad50..0000000000
--- a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchiveMac.mm
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "LegacyWebArchive.h"
-
-namespace WebCore {
-
-static const NSString *LegacyWebArchiveResourceResponseKey = @"WebResourceResponse";
-
-// FIXME: If is is possible to parse in a serialized NSURLResponse manually, without using
-// NSKeyedUnarchiver, manipulating plists directly, we would prefer to do that instead.
-ResourceResponse LegacyWebArchive::createResourceResponseFromMacArchivedData(CFDataRef responseData)
-{    
-    ASSERT(responseData);
-    if (!responseData)
-        return ResourceResponse();
-    
-    NSURLResponse *response = nil;
-    NSKeyedUnarchiver *unarchiver = [[NSKeyedUnarchiver alloc] initForReadingWithData:(NSData *)responseData];
-    @try {
-        id responseObject = [unarchiver decodeObjectForKey:LegacyWebArchiveResourceResponseKey];
-        if ([responseObject isKindOfClass:[NSURLResponse class]])
-            response = responseObject;
-        [unarchiver finishDecoding];
-    } @catch(id) {
-        response = nil;
-    }
-    [unarchiver release];
-    
-    return ResourceResponse(response);
-}
-
-RetainPtr<CFDataRef> LegacyWebArchive::createPropertyListRepresentation(const ResourceResponse& response)
-{    
-    NSURLResponse *nsResponse = response.nsURLResponse();
-    ASSERT(nsResponse);
-    if (!nsResponse)
-        return 0;
-
-    CFMutableDataRef responseData = CFDataCreateMutable(0, 0);
-
-    NSKeyedArchiver *archiver = [[NSKeyedArchiver alloc] initForWritingWithMutableData:(NSMutableData *)responseData];
-    [archiver encodeObject:nsResponse forKey:LegacyWebArchiveResourceResponseKey];
-    [archiver finishEncoding];
-    [archiver release];
-    
-    return RetainPtr<CFDataRef>(AdoptCF, responseData);
-}
-
-}
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseClient.h b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseClient.h
index 8806406e45..18112145d8 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseClient.h
@@ -29,6 +29,8 @@
 #ifndef IconDatabaseClient_h
 #define IconDatabaseClient_h
 
+#include <wtf/Noncopyable.h>
+
 // All of these client methods will be called from a non-main thread
 // Take appropriate measures
  
@@ -36,7 +38,7 @@ namespace WebCore {
 
 class String;
 
-class IconDatabaseClient {
+class IconDatabaseClient : public Noncopyable {
 public:
     virtual ~IconDatabaseClient() { }
     virtual bool performImport() { return true; }
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconFetcher.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconFetcher.cpp
index d1aa2f3634..3d3df39895 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconFetcher.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconFetcher.cpp
@@ -32,6 +32,7 @@
 #include "HTMLNames.h"
 #include "ResourceHandle.h"
 #include "ResourceRequest.h"
+#include "SharedBuffer.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.cpp
index 5dd000e190..eb49087078 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.cpp
@@ -49,9 +49,9 @@ IconLoader::IconLoader(Frame* frame)
 {
 }
 
-auto_ptr<IconLoader> IconLoader::create(Frame* frame)
+PassOwnPtr<IconLoader> IconLoader::create(Frame* frame)
 {
-    return auto_ptr<IconLoader>(new IconLoader(frame));
+    return new IconLoader(frame);
 }
 
 IconLoader::~IconLoader()
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.h b/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.h
index 7b96ed8e1c..1ebac48972 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.h
@@ -27,7 +27,6 @@
 #define IconLoader_h
 
 #include "SubresourceLoaderClient.h"
-#include <memory>
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/RefPtr.h>
@@ -40,7 +39,7 @@ class SharedBuffer;
 
 class IconLoader : private SubresourceLoaderClient, public Noncopyable {
 public:
-    static std::auto_ptr<IconLoader> create(Frame*);
+    static PassOwnPtr<IconLoader> create(Frame*);
     ~IconLoader();
     
     void startLoading();
diff --git a/src/3rdparty/webkit/WebCore/loader/loader.cpp b/src/3rdparty/webkit/WebCore/loader/loader.cpp
index 0b6dff1e41..a45800cb99 100644
--- a/src/3rdparty/webkit/WebCore/loader/loader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/loader.cpp
@@ -37,6 +37,7 @@
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include "SecurityOrigin.h"
+#include "SharedBuffer.h"
 #include "SubresourceLoader.h"
 #include <wtf/Assertions.h>
 #include <wtf/Vector.h>
@@ -61,7 +62,9 @@ Loader::Loader()
     , m_isSuspendingPendingRequests(false)
 {
     m_nonHTTPProtocolHost = Host::create(AtomicString(), maxRequestsInFlightForNonHTTPProtocols);
+#if REQUEST_MANAGEMENT_ENABLED
     maxRequestsInFlightPerHost = initializeMaximumHTTPConnectionCountPerHost();
+#endif
 }
 
 Loader::~Loader()
@@ -69,6 +72,27 @@ Loader::~Loader()
     ASSERT_NOT_REACHED();
 }
     
+static ResourceRequest::TargetType cachedResourceTypeToTargetType(CachedResource::Type type)
+{
+    switch (type) {
+    case CachedResource::CSSStyleSheet:
+#if ENABLE(XSLT)
+    case CachedResource::XSLStyleSheet:
+#endif
+#if ENABLE(XBL)
+    case CachedResource::XBL:
+#endif
+        return ResourceRequest::TargetIsStyleSheet;
+    case CachedResource::Script: 
+        return ResourceRequest::TargetIsScript;
+    case CachedResource::FontResource:
+        return ResourceRequest::TargetIsFontResource;
+    case CachedResource::ImageResource:
+        return ResourceRequest::TargetIsImage;
+    }
+    return ResourceRequest::TargetIsSubresource;
+}
+
 Loader::Priority Loader::determinePriority(const CachedResource* resource) const
 {
 #if REQUEST_MANAGEMENT_ENABLED
@@ -94,14 +118,15 @@ Loader::Priority Loader::determinePriority(const CachedResource* resource) const
 #endif
 }
 
-void Loader::load(DocLoader* docLoader, CachedResource* resource, bool incremental, bool skipCanLoadCheck, bool sendResourceLoadCallbacks)
+void Loader::load(DocLoader* docLoader, CachedResource* resource, bool incremental, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks)
 {
     ASSERT(docLoader);
-    Request* request = new Request(docLoader, resource, incremental, skipCanLoadCheck, sendResourceLoadCallbacks);
+    Request* request = new Request(docLoader, resource, incremental, securityCheck, sendResourceLoadCallbacks);
 
     RefPtr<Host> host;
     KURL url(ParsedURLString, resource->url());
     if (url.protocolInHTTPFamily()) {
+        m_hosts.checkConsistency();
         AtomicString hostName = url.host();
         host = m_hosts.get(hostName.impl());
         if (!host) {
@@ -146,6 +171,7 @@ void Loader::servePendingRequests(Priority minimumPriority)
     m_nonHTTPProtocolHost->servePendingRequests(minimumPriority);
 
     Vector<Host*> hostsToServe;
+    m_hosts.checkConsistency();
     HostMap::iterator i = m_hosts.begin();
     HostMap::iterator end = m_hosts.end();
     for (;i != end; ++i)
@@ -182,6 +208,7 @@ void Loader::nonCacheRequestInFlight(const KURL& url)
         return;
     
     AtomicString hostName = url.host();
+    m_hosts.checkConsistency();
     RefPtr<Host> host = m_hosts.get(hostName.impl());
     if (!host) {
         host = Host::create(hostName, maxRequestsInFlightPerHost);
@@ -197,6 +224,7 @@ void Loader::nonCacheRequestComplete(const KURL& url)
         return;
     
     AtomicString hostName = url.host();
+    m_hosts.checkConsistency();
     RefPtr<Host> host = m_hosts.get(hostName.impl());
     ASSERT(host);
     if (!host)
@@ -213,6 +241,7 @@ void Loader::cancelRequests(DocLoader* docLoader)
         m_nonHTTPProtocolHost->cancelRequests(docLoader);
     
     Vector<Host*> hostsToCancel;
+    m_hosts.checkConsistency();
     HostMap::iterator i = m_hosts.begin();
     HostMap::iterator end = m_hosts.end();
     for (;i != end; ++i)
@@ -258,6 +287,8 @@ void Loader::Host::nonCacheRequestComplete()
 {
     --m_nonCachedRequestsInFlight;
     ASSERT(m_nonCachedRequestsInFlight >= 0);
+
+    cache()->loader()->scheduleServePendingRequests();
 }
 
 bool Loader::Host::hasRequests() const
@@ -299,6 +330,7 @@ void Loader::Host::servePendingRequests(RequestQueue& requestsPending, bool& ser
         requestsPending.removeFirst();
         
         ResourceRequest resourceRequest(request->cachedResource()->url());
+        resourceRequest.setTargetType(cachedResourceTypeToTargetType(request->cachedResource()->type()));
         
         if (!request->cachedResource()->accept().isEmpty())
             resourceRequest.setHTTPAccept(request->cachedResource()->accept());
@@ -323,7 +355,7 @@ void Loader::Host::servePendingRequests(RequestQueue& requestsPending, bool& ser
         }
 
         RefPtr<SubresourceLoader> loader = SubresourceLoader::create(docLoader->doc()->frame(),
-            this, resourceRequest, request->shouldSkipCanLoadCheck(), request->sendResourceLoadCallbacks());
+            this, resourceRequest, request->shouldDoSecurityCheck(), request->sendResourceLoadCallbacks());
         if (loader) {
             m_requestsLoading.add(loader.release(), request);
             request->cachedResource()->setRequestedFromNetworkingLayer();
@@ -375,7 +407,7 @@ void Loader::Host::didFinishLoading(SubresourceLoader* loader)
     docLoader->checkForPendingPreloads();
 
 #if REQUEST_DEBUG
-    KURL u(resource->url());
+    KURL u(ParsedURLString, resource->url());
     printf("HOST %s COUNT %d RECEIVED %s\n", u.host().latin1().data(), m_requestsLoading.size(), resource->url().latin1().data());
 #endif
     servePendingRequests();
diff --git a/src/3rdparty/webkit/WebCore/loader/loader.h b/src/3rdparty/webkit/WebCore/loader/loader.h
index d0a526f960..a9de032112 100644
--- a/src/3rdparty/webkit/WebCore/loader/loader.h
+++ b/src/3rdparty/webkit/WebCore/loader/loader.h
@@ -24,6 +24,7 @@
 
 #include "AtomicString.h"
 #include "AtomicStringImpl.h"
+#include "FrameLoaderTypes.h"
 #include "PlatformString.h"
 #include "SubresourceLoaderClient.h"
 #include "Timer.h"
@@ -43,7 +44,7 @@ namespace WebCore {
         Loader();
         ~Loader();
 
-        void load(DocLoader*, CachedResource*, bool incremental = true, bool skipCanLoadCheck = false, bool sendResourceLoadCallbacks = true);
+        void load(DocLoader*, CachedResource*, bool incremental = true, SecurityCheckPolicy = DoSecurityCheck, bool sendResourceLoadCallbacks = true);
 
         void cancelRequests(DocLoader*);
         
diff --git a/src/3rdparty/webkit/WebCore/mathml/MathMLElement.cpp b/src/3rdparty/webkit/WebCore/mathml/MathMLElement.cpp
index 14febe5aa3..b47f4a9623 100644
--- a/src/3rdparty/webkit/WebCore/mathml/MathMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/mathml/MathMLElement.cpp
@@ -1,21 +1,26 @@
 /*
- *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
- * 
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *  
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *  
- *  You should have received a copy of the GNU Library General Public
- *  License along with this library; if not, write to the
- *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
- *  Boston, MA  02110-1301, USA. 
- *  
+ * Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
diff --git a/src/3rdparty/webkit/WebCore/mathml/MathMLElement.h b/src/3rdparty/webkit/WebCore/mathml/MathMLElement.h
index b00af47aeb..2fa322f27d 100644
--- a/src/3rdparty/webkit/WebCore/mathml/MathMLElement.h
+++ b/src/3rdparty/webkit/WebCore/mathml/MathMLElement.h
@@ -1,21 +1,26 @@
 /*
- *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
- * 
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *  
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *  
- *  You should have received a copy of the GNU Library General Public
- *  License along with this library; if not, write to the
- *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
- *  Boston, MA  02110-1301, USA. 
- *  
+ * Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef MathMLElement_h
diff --git a/src/3rdparty/webkit/WebCore/mathml/MathMLInlineContainerElement.cpp b/src/3rdparty/webkit/WebCore/mathml/MathMLInlineContainerElement.cpp
index 2bb02f653e..2d682a2517 100644
--- a/src/3rdparty/webkit/WebCore/mathml/MathMLInlineContainerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/mathml/MathMLInlineContainerElement.cpp
@@ -1,21 +1,26 @@
 /*
- *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
- * 
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *  
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *  
- *  You should have received a copy of the GNU Library General Public
- *  License along with this library; if not, write to the
- *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
- *  Boston, MA  02110-1301, USA. 
- *  
+ * Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -25,7 +30,12 @@
 #include "MathMLInlineContainerElement.h"
 
 #include "MathMLNames.h"
-#include "RenderObject.h"
+#include "RenderMathMLBlock.h"
+#include "RenderMathMLFraction.h"
+#include "RenderMathMLMath.h"
+#include "RenderMathMLRow.h"
+#include "RenderMathMLSubSup.h"
+#include "RenderMathMLUnderOver.h"
 
 namespace WebCore {
     
@@ -41,10 +51,31 @@ PassRefPtr<MathMLInlineContainerElement> MathMLInlineContainerElement::create(co
     return new MathMLInlineContainerElement(tagName, document);
 }
 
-RenderObject* MathMLInlineContainerElement::createRenderer(RenderArena *, RenderStyle* style)
+RenderObject* MathMLInlineContainerElement::createRenderer(RenderArena *arena, RenderStyle* style)
 {
-    // FIXME: This method will contain the specialized renderers based on element name
-    return RenderObject::createObject(this, style);
+    RenderObject* object = 0;
+    if (hasLocalName(MathMLNames::mrowTag))
+        object = new (arena) RenderMathMLRow(this);
+    else if (hasLocalName(MathMLNames::mathTag))
+        object = new (arena) RenderMathMLMath(this);
+    else if (hasLocalName(MathMLNames::msubTag))
+        object = new (arena) RenderMathMLSubSup(this);
+    else if (hasLocalName(MathMLNames::msupTag))
+        object = new (arena) RenderMathMLSubSup(this);
+    else if (hasLocalName(MathMLNames::msubsupTag))
+        object = new (arena) RenderMathMLSubSup(this);
+    else if (hasLocalName(MathMLNames::moverTag))
+        object = new (arena) RenderMathMLUnderOver(this);
+    else if (hasLocalName(MathMLNames::munderTag))
+        object = new (arena) RenderMathMLUnderOver(this);
+    else if (hasLocalName(MathMLNames::munderoverTag))
+        object = new (arena) RenderMathMLUnderOver(this);
+    else if (hasLocalName(MathMLNames::mfracTag))
+        object = new (arena) RenderMathMLFraction(this);
+    else
+        object = new (arena) RenderMathMLBlock(this);
+    object->setStyle(style);
+    return object;
 }
     
     
diff --git a/src/3rdparty/webkit/WebCore/mathml/MathMLInlineContainerElement.h b/src/3rdparty/webkit/WebCore/mathml/MathMLInlineContainerElement.h
index 4529d3b80a..dc78dc43c3 100644
--- a/src/3rdparty/webkit/WebCore/mathml/MathMLInlineContainerElement.h
+++ b/src/3rdparty/webkit/WebCore/mathml/MathMLInlineContainerElement.h
@@ -1,21 +1,26 @@
 /*
- *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
- * 
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *  
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *  
- *  You should have received a copy of the GNU Library General Public
- *  License along with this library; if not, write to the
- *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
- *  Boston, MA  02110-1301, USA. 
- *  
+ * Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef MathMLInlineContainerElement_h
diff --git a/src/3rdparty/webkit/WebCore/mathml/MathMLMathElement.cpp b/src/3rdparty/webkit/WebCore/mathml/MathMLMathElement.cpp
index 8b083f46d1..bd3b797e12 100644
--- a/src/3rdparty/webkit/WebCore/mathml/MathMLMathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/mathml/MathMLMathElement.cpp
@@ -1,21 +1,26 @@
 /*
- *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
- * 
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *  
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *  
- *  You should have received a copy of the GNU Library General Public
- *  License along with this library; if not, write to the
- *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
- *  Boston, MA  02110-1301, USA. 
- *  
+ * Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
diff --git a/src/3rdparty/webkit/WebCore/mathml/MathMLMathElement.h b/src/3rdparty/webkit/WebCore/mathml/MathMLMathElement.h
index f363cd2ce2..e78452441c 100644
--- a/src/3rdparty/webkit/WebCore/mathml/MathMLMathElement.h
+++ b/src/3rdparty/webkit/WebCore/mathml/MathMLMathElement.h
@@ -1,21 +1,26 @@
 /*
- *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
- * 
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *  
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *  
- *  You should have received a copy of the GNU Library General Public
- *  License along with this library; if not, write to the
- *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
- *  Boston, MA  02110-1301, USA. 
- *  
+ * Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef MathMLMathElement_h
diff --git a/src/3rdparty/webkit/WebCore/mathml/MathMLTextElement.cpp b/src/3rdparty/webkit/WebCore/mathml/MathMLTextElement.cpp
new file mode 100644
index 0000000000..6f6bcbc98b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/MathMLTextElement.cpp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MATHML)
+
+#include "MathMLTextElement.h"
+
+#include "MathMLNames.h"
+#include "RenderMathMLOperator.h"
+
+namespace WebCore {
+    
+using namespace MathMLNames;
+
+MathMLTextElement::MathMLTextElement(const QualifiedName& tagName, Document* document)
+    : MathMLElement(tagName, document)
+{
+}
+
+PassRefPtr<MathMLTextElement> MathMLTextElement::create(const QualifiedName& tagName, Document* document)
+{
+    return new MathMLTextElement(tagName, document);
+}
+
+RenderObject* MathMLTextElement::createRenderer(RenderArena* arena, RenderStyle* style)
+{
+    if (hasLocalName(MathMLNames::moTag)) {
+        RenderObject* object = new (arena) RenderMathMLOperator(this);
+        object->setStyle(style);
+        return object;
+    }
+
+    return RenderObject::createObject(this, style);
+}
+
+    
+}
+
+#endif // ENABLE(MATHML)
+
diff --git a/src/3rdparty/webkit/WebCore/mathml/MathMLTextElement.h b/src/3rdparty/webkit/WebCore/mathml/MathMLTextElement.h
new file mode 100644
index 0000000000..e647bfaada
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/MathMLTextElement.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MathMLTextElement_h
+#define MathMLTextElement_h
+
+#if ENABLE(MATHML)
+#include "MathMLElement.h"
+
+namespace WebCore {
+    
+class MathMLTextElement : public MathMLElement {
+public:
+    static PassRefPtr<MathMLTextElement> create(const QualifiedName& tagName, Document*);
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    
+protected:
+    MathMLTextElement(const QualifiedName& tagName, Document*);
+    
+};
+    
+}
+
+#endif // ENABLE(MATHML)
+#endif // MathMLTextElement_h
diff --git a/src/3rdparty/webkit/WebCore/mathml/RenderMathMLBlock.cpp b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLBlock.cpp
new file mode 100644
index 0000000000..a897ff5b64
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLBlock.cpp
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MATHML)
+
+#include "RenderMathMLBlock.h"
+
+#include "FontSelector.h"
+#include "GraphicsContext.h"
+#include "MathMLNames.h"
+#include "RenderInline.h"
+#include "RenderText.h"
+
+namespace WebCore {
+    
+using namespace MathMLNames;
+    
+RenderMathMLBlock::RenderMathMLBlock(Node* container) 
+    : RenderBlock(container) 
+{
+}
+
+bool RenderMathMLBlock::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->node() && child->node()->nodeType() == Node::ELEMENT_NODE;
+}
+
+PassRefPtr<RenderStyle> RenderMathMLBlock::makeBlockStyle()
+{
+    RefPtr<RenderStyle> newStyle = RenderStyle::create();
+    newStyle->inheritFrom(style());
+    newStyle->setDisplay(BLOCK);
+    return newStyle;
+}
+
+int RenderMathMLBlock::nonOperatorHeight() const
+{
+    if (!isRenderMathMLOperator())
+        return offsetHeight();
+        
+    return 0;
+}
+
+void RenderMathMLBlock::stretchToHeight(int height) 
+{
+    for (RenderObject* current = firstChild(); current; current = current->nextSibling())
+       if (current->isRenderMathMLBlock()) {
+          RenderMathMLBlock* block = toRenderMathMLBlock(current);
+          block->stretchToHeight(height);
+       }
+}
+
+#if ENABLE(DEBUG_MATH_LAYOUT)
+void RenderMathMLBlock::paint(PaintInfo& info, int tx, int ty)
+{
+    RenderBlock::paint(info, tx, ty);
+    
+    if (info.context->paintingDisabled() || info.phase != PaintPhaseForeground)
+        return;
+
+    tx += x();
+    ty += y();
+    
+    info.context->save();
+    
+    info.context->setStrokeThickness(1.0f);
+    info.context->setStrokeStyle(SolidStroke);
+    info.context->setStrokeColor(Color(0, 0, 255), sRGBColorSpace);
+    
+    info.context->drawLine(IntPoint(tx, ty), IntPoint(tx + offsetWidth(), ty));
+    info.context->drawLine(IntPoint(tx + offsetWidth(), ty), IntPoint(tx + offsetWidth(), ty + offsetHeight()));
+    info.context->drawLine(IntPoint(tx, ty + offsetHeight()), IntPoint(tx + offsetWidth(), ty + offsetHeight()));
+    info.context->drawLine(IntPoint(tx, ty), IntPoint(tx, ty + offsetHeight()));
+    
+    int baseline = baselinePosition(true);
+    
+    info.context->setStrokeColor(Color(255, 0, 0), sRGBColorSpace);
+    
+    info.context->drawLine(IntPoint(tx, ty + baseline), IntPoint(tx + offsetWidth(), ty + baseline));
+    
+    info.context->restore();
+    
+}
+#endif // ENABLE(DEBUG_MATH_LAYOUT)
+
+
+}    
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/mathml/RenderMathMLBlock.h b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLBlock.h
new file mode 100644
index 0000000000..f05122a60a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLBlock.h
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2010 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderMathMLBlock_h
+#define RenderMathMLBlock_h
+
+#if ENABLE(MATHML)
+
+#include "RenderBlock.h"
+
+#define ENABLE_DEBUG_MATH_LAYOUT 0
+
+namespace WebCore {
+    
+class RenderMathMLBlock : public RenderBlock {
+public:
+    RenderMathMLBlock(Node* container);
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+    
+    virtual bool isRenderMathMLBlock() const { return true; }
+    virtual bool isRenderMathMLOperator() const { return false; }
+    virtual bool isRenderMathMLRow() const { return false; }
+    virtual bool isRenderMathMLMath() const { return false; }
+    virtual bool hasBase() const { return false; }
+    virtual int nonOperatorHeight() const;
+    virtual void stretchToHeight(int height);
+
+#if ENABLE(DEBUG_MATH_LAYOUT)
+    virtual void paint(PaintInfo&, int tx, int ty);
+#endif
+    
+protected:
+    int getBoxModelObjectHeight(RenderObject* object) 
+    {
+        if (object && object->isBoxModelObject()) {
+            RenderBoxModelObject* box = toRenderBoxModelObject(object);
+            return box->offsetHeight();
+        }
+        
+        return 0;
+    }
+    int getBoxModelObjectHeight(const RenderObject* object) 
+    {
+        if (object && object->isBoxModelObject()) {
+            const RenderBoxModelObject* box = toRenderBoxModelObject(object);
+            return box->offsetHeight();
+        }
+        
+        return 0;
+    }
+    int getBoxModelObjectWidth(RenderObject* object) 
+    {
+        if (object && object->isBoxModelObject()) {
+            RenderBoxModelObject* box = toRenderBoxModelObject(object);
+            return box->offsetWidth();
+        }
+        
+        return 0;
+    }
+    int getBoxModelObjectWidth(const RenderObject* object) 
+    {
+        if (object && object->isBoxModelObject()) {
+            const RenderBoxModelObject* box = toRenderBoxModelObject(object);
+            return box->offsetWidth();
+        }
+        
+        return 0;
+    }
+    virtual PassRefPtr<RenderStyle> makeBlockStyle();
+    
+};
+
+inline RenderMathMLBlock* toRenderMathMLBlock(RenderObject* object)
+{ 
+    ASSERT(!object || object->isRenderMathMLBlock());
+    return static_cast<RenderMathMLBlock*>(object);
+}
+
+inline const RenderMathMLBlock* toRenderMathMLBlock(const RenderObject* object)
+{ 
+    ASSERT(!object || object->isRenderMathMLBlock());
+    return static_cast<const RenderMathMLBlock*>(object);
+}
+
+}
+
+
+#endif // ENABLE(MATHML)
+#endif // RenderMathMLBlock_h
diff --git a/src/3rdparty/webkit/WebCore/mathml/RenderMathMLFraction.cpp b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLFraction.cpp
new file mode 100644
index 0000000000..3399e55b74
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLFraction.cpp
@@ -0,0 +1,208 @@
+/*
+ * Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ * Copyright (C) 2010 François Sausset (sausset@gmail.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MATHML)
+
+#include "RenderMathMLFraction.h"
+
+#include "GraphicsContext.h"
+#include "MathMLNames.h"
+#include "RenderText.h"
+
+namespace WebCore {
+    
+using namespace MathMLNames;
+
+static const double gHorizontalPad = 0.2;
+static const int gLineThin = 1;
+static const int gLineMedium = 3;
+static const int gLineThick = 5;
+static const double gFractionAlignment = 0.25;
+static const double gFractionBarWidth = 0.05;
+static const double gDenominatorPad = 0.1;
+
+RenderMathMLFraction::RenderMathMLFraction(Element* fraction) 
+    : RenderMathMLBlock(fraction)
+    , m_lineThickness(gLineThin)
+{
+    setChildrenInline(false);
+}
+
+void RenderMathMLFraction::updateFromElement()
+{
+    // FIXME: mfrac where bevelled=true will need to reorganize the descendants
+    if (isEmpty()) 
+        return;
+    
+    Element* fraction = static_cast<Element*>(node());
+    
+    RenderObject* numerator = firstChild();
+    String nalign = fraction->getAttribute(MathMLNames::numalignAttr);
+    if (equalIgnoringCase(nalign, "left"))
+        numerator->style()->setTextAlign(LEFT);
+    else if (equalIgnoringCase(nalign, "right"))
+        numerator->style()->setTextAlign(RIGHT);
+    else
+        numerator->style()->setTextAlign(CENTER);
+    
+    RenderObject* denominator = numerator->nextSibling();
+    if (!denominator)
+        return;
+    
+    String dalign = fraction->getAttribute(MathMLNames::denomalignAttr);
+    if (equalIgnoringCase(dalign, "left"))
+        denominator->style()->setTextAlign(LEFT);
+    else if (equalIgnoringCase(dalign, "right"))
+        denominator->style()->setTextAlign(RIGHT);
+    else
+        denominator->style()->setTextAlign(CENTER);
+    
+    // FIXME: parse units
+    String thickness = fraction->getAttribute(MathMLNames::linethicknessAttr);
+    m_lineThickness = gLineThin;
+    if (equalIgnoringCase(thickness, "thin"))
+        m_lineThickness = gLineThin;
+    else if (equalIgnoringCase(thickness, "medium"))
+        m_lineThickness = gLineMedium;
+    else if (equalIgnoringCase(thickness, "thick"))
+        m_lineThickness = gLineThick;
+    else if (equalIgnoringCase(thickness, "0"))
+        m_lineThickness = 0;
+
+    // Update the style for the padding of the denominator for the line thickness
+    lastChild()->style()->setPaddingTop(Length(static_cast<int>(m_lineThickness + style()->fontSize() * gDenominatorPad), Fixed));
+}
+
+void RenderMathMLFraction::addChild(RenderObject* child, RenderObject* beforeChild)
+{
+    RenderBlock* row = new (renderArena()) RenderMathMLBlock(node());
+    RefPtr<RenderStyle> rowStyle = makeBlockStyle();
+    
+    rowStyle->setTextAlign(CENTER);
+    Length pad(static_cast<int>(rowStyle->fontSize() * gHorizontalPad), Fixed);
+    rowStyle->setPaddingLeft(pad);
+    rowStyle->setPaddingRight(pad);
+    
+    // Only add padding for rows as denominators
+    bool isNumerator = isEmpty();
+    if (!isNumerator) 
+        rowStyle->setPaddingTop(Length(2, Fixed));
+    
+    row->setStyle(rowStyle.release());
+    RenderBlock::addChild(row, beforeChild);
+    row->addChild(child);
+    updateFromElement();
+}
+
+void RenderMathMLFraction::layout()
+{
+    updateFromElement();
+    
+    // Adjust the fraction line thickness for the zoom
+    if (lastChild() && lastChild()->isRenderBlock())
+        m_lineThickness = m_lineThickness * ceil(gFractionBarWidth * style()->fontSize());
+    
+    if (previousSibling() && previousSibling()->isRenderBlock()) {
+        RenderBlock* sibling = toRenderBlock(previousSibling());
+        verticalAlignCompute(sibling);
+    } else if (nextSibling() && nextSibling()->isRenderBlock()) {
+        RenderBlock* sibling = toRenderBlock(nextSibling());
+        verticalAlignCompute(sibling);
+    }
+
+    RenderBlock::layout();
+    
+    // The row layout can affect the numerator/denominator width.
+    // FIXME: This is probably only needed if one of the children
+    // contains an mrow.
+    setNeedsLayoutAndPrefWidthsRecalc();
+    markContainingBlocksForLayout();
+    
+    RenderBlock::layout();
+    
+}
+    
+void RenderMathMLFraction::paint(PaintInfo& info, int tx, int ty)
+{
+    RenderMathMLBlock::paint(info, tx, ty);
+    if (info.context->paintingDisabled() || info.phase != PaintPhaseForeground)
+        return;
+    
+    if (!firstChild() ||!m_lineThickness)
+        return;
+
+    int verticalOffset = 0;
+    // The children are always RenderMathMLBlock instances
+    if (firstChild()->isRenderMathMLBlock()) {
+        int adjustForThickness = m_lineThickness > 1 ? m_lineThickness / 2 : 1;
+        if (m_lineThickness % 2 == 1)
+            adjustForThickness++;
+        RenderMathMLBlock* numerator = toRenderMathMLBlock(firstChild());
+        if (numerator->isRenderMathMLRow())
+            verticalOffset = numerator->offsetHeight() + adjustForThickness;
+        else 
+            verticalOffset = numerator->offsetHeight();        
+    }
+    
+    tx += x();
+    ty += y() + verticalOffset;
+    
+    info.context->save();
+    
+    info.context->setStrokeThickness(static_cast<float>(m_lineThickness));
+    info.context->setStrokeStyle(SolidStroke);
+    info.context->setStrokeColor(Color(0, 0, 0), sRGBColorSpace);
+    
+    info.context->drawLine(IntPoint(tx, ty), IntPoint(tx + offsetWidth(), ty));
+    
+    info.context->restore();
+}
+
+void RenderMathMLFraction::verticalAlignCompute(RenderBlock* sibling)
+{
+    if (sibling->isRenderMathMLBlock()) {
+        RenderMathMLBlock* op = toRenderMathMLBlock(sibling);
+        style()->setVerticalAlign(LENGTH);
+        int verticalShift = static_cast<int>(ceil(gFractionAlignment * op->offsetHeight() + 0.5 * lastChild()->style()->borderTopWidth()));
+        style()->setVerticalAlignLength(Length(verticalShift, Fixed));
+    }
+}
+
+int RenderMathMLFraction::baselinePosition(bool firstLine, bool isRootLineBox) const
+{
+    if (firstChild()->isRenderMathMLBlock()) {
+        RenderMathMLBlock* numerator = toRenderMathMLBlock(firstChild());
+        return numerator->offsetHeight();
+    }
+    return RenderBlock::baselinePosition(firstLine, isRootLineBox);
+}
+
+}
+
+
+#endif // ENABLE(MATHML)
diff --git a/src/3rdparty/webkit/WebCore/mathml/RenderMathMLFraction.h b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLFraction.h
new file mode 100644
index 0000000000..30162acae1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLFraction.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ * Copyright (C) 2010 François Sausset (sausset@gmail.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderMathMLFraction_h
+#define RenderMathMLFraction_h
+
+#if ENABLE(MATHML)
+
+#include "RenderMathMLBlock.h"
+
+namespace WebCore {
+
+class RenderMathMLFraction : public RenderMathMLBlock {
+public:
+    RenderMathMLFraction(Element* fraction);
+    virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual void updateFromElement();
+    virtual int baselinePosition(bool , bool) const; 
+    virtual void paint(PaintInfo&, int tx, int ty);
+protected:
+    virtual void layout();
+private:
+    void verticalAlignCompute(RenderBlock*);
+    int m_lineThickness;
+};
+
+}
+
+#endif // ENABLE(MATHML)
+
+#endif // RenderMathMLFraction_h
diff --git a/src/3rdparty/webkit/WebCore/mathml/RenderMathMLMath.cpp b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLMath.cpp
new file mode 100644
index 0000000000..2b65f69a44
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLMath.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2010 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MATHML)
+
+#include "RenderMathMLMath.h"
+
+#include "MathMLNames.h"
+
+namespace WebCore {
+
+using namespace MathMLNames;
+
+RenderMathMLMath::RenderMathMLMath(Node* math)
+    : RenderMathMLRow(math)
+{
+}
+
+}
+
+#endif // ENABLE(MATHML)
+
diff --git a/src/3rdparty/webkit/WebCore/mathml/RenderMathMLMath.h b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLMath.h
new file mode 100644
index 0000000000..26f2093f90
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLMath.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2010 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderMathMLMath_h
+#define RenderMathMLMath_h
+
+#if ENABLE(MATHML)
+
+#include "RenderMathMLRow.h"
+
+namespace WebCore {
+    
+class RenderMathMLMath : public RenderMathMLRow {
+public:
+    RenderMathMLMath(Node* container);
+    virtual bool isRenderMathMLMath() const { return true; }
+};
+    
+}
+
+
+#endif // ENABLE(MATHML)
+#endif // RenderMathMLMath_h
diff --git a/src/3rdparty/webkit/WebCore/mathml/RenderMathMLOperator.cpp b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLOperator.cpp
new file mode 100644
index 0000000000..da9e8ec2a7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLOperator.cpp
@@ -0,0 +1,328 @@
+/*
+ * Copyright (C) 2010 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MATHML)
+
+#include "RenderMathMLOperator.h"
+
+#include "FontSelector.h"
+#include "MathMLNames.h"
+#include "RenderText.h"
+
+namespace WebCore {
+    
+using namespace MathMLNames;
+
+RenderMathMLOperator::RenderMathMLOperator(Node* container)
+    : RenderMathMLBlock(container),
+      m_stretchHeight(0),
+      m_operator(0)
+{
+}
+    
+RenderMathMLOperator::RenderMathMLOperator(Node* container, UChar operatorChar)
+    : RenderMathMLBlock(container),
+      m_stretchHeight(0),
+      m_operator(operatorChar)
+{
+}
+    
+bool RenderMathMLOperator::isChildAllowed(RenderObject*, RenderStyle*) const
+{
+    return false;
+}
+
+void  RenderMathMLOperator::stretchToHeight(int height)
+{
+    if (height == m_stretchHeight)
+        return;
+    m_stretchHeight = height;
+    
+    updateBoxModelInfoFromStyle();
+    setNeedsLayoutAndPrefWidthsRecalc();
+    markContainingBlocksForLayout();
+}
+
+void RenderMathMLOperator::layout() 
+{
+    // FIXME: This probably shouldn't be called here but when the operator
+    // isn't stretched (e.g. outside of a mrow), it needs to be called somehow
+    updateFromElement();
+    RenderBlock::layout();
+}
+
+// This is a table of stretchy characters.
+// FIXME: Should this be read from the unicode characteristics somehow?
+// table:  stretchy operator, top char, extension char, bottom char, middle char
+static struct StretchyCharacter {
+    UChar character;
+    UChar topGlyph;
+    UChar extensionGlyph;
+    UChar bottomGlyph;
+    UChar middleGlyph;
+} stretchyCharacters[9] = {
+{ 0x28  , 0x239b, 0x239c, 0x239d, 0x0    }, // left parenthesis
+{ 0x29  , 0x239e, 0x239f, 0x23a0, 0x0    }, // right parenthesis
+{ 0x5b  , 0x23a1, 0x23a2, 0x23a3, 0x0    }, // left square bracket
+{ 0x5d  , 0x23a4, 0x23a5, 0x23a6, 0x0    }, // right square bracket
+{ 0x7b  , 0x23a7, 0x23aa, 0x23a9, 0x23a8 }, // left curly bracket
+{ 0x7c  , 0x23d0, 0x23d0, 0x23d0, 0x0    }, // vertical bar
+{ 0x7d  , 0x23ab, 0x23aa, 0x23ad, 0x23ac }, // right curly bracket
+{ 0x222b, 0x2320, 0x23ae, 0x2321, 0x0    } // integral sign
+};
+
+// We stack glyphs using a 14px height with a displayed glyph height
+// of 10px.  The line height is set to less than the 14px so that there
+// are no blank spaces between the stacked glyphs.
+//
+// Certain glyphs (e.g. middle and bottom) need to be adjusted upwards
+// in the stack so that there isn't a gap.
+//
+// All of these settings are represented in the constants below.
+
+static const int gGlyphFontSize = 14;
+static const int gGlyphLineHeight = 12;
+static const int gMinimumStretchHeight = 24;
+static const int gGlyphHeight = 10;
+static const int gMiddleGlyphTopAdjust = -2;
+static const int gBottomGlyphTopAdjust = -4;
+
+void RenderMathMLOperator::updateFromElement()
+{
+    // clear our children
+    while (firstChild()) {
+       RenderObject* obj = firstChild();
+       removeChild(obj);
+    }
+    
+    // If the operator is fixed, it will be contained in m_operator
+    UChar firstChar = m_operator;
+    
+    // This boolean indicates whether stretching is disabled via the markup.
+    bool stretchDisabled = false;
+    
+    // We made need the element later if we can't stretch.
+    if (node()->nodeType() == Node::ELEMENT_NODE) {
+        if (Element* mo = static_cast<Element*>(node())) {
+            AtomicString stretchyAttr = mo->getAttribute(MathMLNames::stretchyAttr);
+            stretchDisabled = equalIgnoringCase(stretchyAttr, "false");
+            
+            // If stretching isn't disabled, get the character from the text content.
+            if (!stretchDisabled && !firstChar) {
+                String opText = mo->textContent();
+                for (unsigned int i = 0; !firstChar && i < opText.length(); i++) {
+                    if (!isSpaceOrNewline(opText[i]))
+                       firstChar = opText[i];
+                }
+            }
+        }
+    }
+    
+    // The 'index' holds the stretchable character's glyph information
+    int index = -1;
+    
+    // isStretchy indicates whether the character is streatchable via a number of factors.
+    bool isStretchy = false;
+    
+    // Check for a stretchable character.
+    if (!stretchDisabled && firstChar) {
+        const int maxIndex = sizeof(stretchyCharacters) / sizeof(stretchyCharacters[0]);
+        for (index++; index < maxIndex; index++) {
+            if (stretchyCharacters[index].character == firstChar) {
+                isStretchy = true;
+                break;
+            }
+        }
+    }
+    
+    // We only stretch character if the stretch height is larger than a minimum size (e.g. 24px).
+    bool shouldStretch = isStretchy && m_stretchHeight>gMinimumStretchHeight;
+    
+    // Either stretch is disabled or we don't have a stretchable character over the minimum height
+    if (stretchDisabled || !shouldStretch) {
+        m_isStacked = false;
+        RenderBlock* container = new (renderArena()) RenderBlock(node());
+        
+        RefPtr<RenderStyle> newStyle = RenderStyle::create();
+        newStyle->inheritFrom(style());
+        newStyle->setDisplay(BLOCK);
+
+        // Check for a stretchable character that is under the minimum height and use the
+        // font size to adjust the glyph size.
+        int currentFontSize = style()->fontSize();
+        if (!stretchDisabled && isStretchy && m_stretchHeight > 0 && m_stretchHeight <= gMinimumStretchHeight  && m_stretchHeight > currentFontSize) {
+            FontDescription* desc = new FontDescription();
+            desc->setIsAbsoluteSize(true);
+            desc->setSpecifiedSize(m_stretchHeight);
+            desc->setComputedSize(m_stretchHeight);
+            newStyle->setFontDescription(*desc);
+            newStyle->font().update(newStyle->font().fontSelector());
+        }
+        
+        newStyle->setVerticalAlign(BASELINE);
+        container->setStyle(newStyle.release());
+        addChild(container);
+     
+        // Build the text of the operator.  
+        RenderText* text = 0;
+        if (m_operator) 
+            text = new (renderArena()) RenderText(node(), StringImpl::create(&m_operator, 1));
+        else if (node()->nodeType() == Node::ELEMENT_NODE)
+            if (Element* mo = static_cast<Element*>(node()))
+                text = new (renderArena()) RenderText(node(), StringImpl::create(mo->textContent()));
+        // If we can't figure out the text, leave it blank.
+        if (text) {
+            text->setStyle(container->style());
+            container->addChild(text);
+        }
+    } else {
+        // Build stretchable characters as a stack of glyphs.
+        m_isStacked = true;
+        
+        if (stretchyCharacters[index].middleGlyph) {
+            // We have a middle glyph (e.g. a curly bracket) that requires special processing.
+            int half = (m_stretchHeight - gGlyphHeight) / 2;
+            if (half <= gGlyphHeight) {
+                // We only have enough space for a single middle glyph.
+                createGlyph(stretchyCharacters[index].topGlyph, half);
+                createGlyph(stretchyCharacters[index].middleGlyph, gGlyphHeight, gMiddleGlyphTopAdjust);
+                createGlyph(stretchyCharacters[index].bottomGlyph, 0, gBottomGlyphTopAdjust);
+            } else {
+                // We have to extend both the top and bottom to the middle.
+                createGlyph(stretchyCharacters[index].topGlyph, gGlyphHeight);
+                int remaining = half - gGlyphHeight;
+                while (remaining > 0) {
+                    if (remaining < gGlyphHeight) {
+                        createGlyph(stretchyCharacters[index].extensionGlyph, remaining);
+                        remaining = 0;
+                    } else {
+                        createGlyph(stretchyCharacters[index].extensionGlyph, gGlyphHeight);
+                        remaining -= gGlyphHeight;
+                    }
+                }
+                
+                // The middle glyph in the stack.
+                createGlyph(stretchyCharacters[index].middleGlyph, gGlyphHeight, gMiddleGlyphTopAdjust);
+                
+                // The remaining is the top half minus the middle glyph height.
+                remaining = half - gGlyphHeight;
+                // We need to make sure we have the full height in case the height is odd.
+                if (m_stretchHeight % 2 == 1)
+                    remaining++;
+                
+                // Extend to the bottom glyph.
+                while (remaining > 0) {
+                    if (remaining < gGlyphHeight) {
+                        createGlyph(stretchyCharacters[index].extensionGlyph, remaining);
+                        remaining = 0;
+                    } else {
+                        createGlyph(stretchyCharacters[index].extensionGlyph, gGlyphHeight);
+                        remaining -= gGlyphHeight;
+                    }
+                }
+                
+                // The bottom glyph in the stack.
+                createGlyph(stretchyCharacters[index].bottomGlyph, 0, gBottomGlyphTopAdjust);
+            }
+        } else {
+            // We do not have a middle glyph and so we just extend from the top to the bottom glyph.
+            int remaining = m_stretchHeight - 2 * gGlyphHeight;
+            createGlyph(stretchyCharacters[index].topGlyph, gGlyphHeight);
+            while (remaining > 0) {
+                if (remaining < gGlyphHeight) {
+                    createGlyph(stretchyCharacters[index].extensionGlyph, remaining);
+                    remaining = 0;
+                } else {
+                    createGlyph(stretchyCharacters[index].extensionGlyph, gGlyphHeight);
+                    remaining -= gGlyphHeight;
+                }
+            }
+            createGlyph(stretchyCharacters[index].bottomGlyph, 0, gBottomGlyphTopAdjust);
+        }
+    }
+}
+
+RefPtr<RenderStyle> RenderMathMLOperator::createStackableStyle(int size, int topRelative)
+{
+    RefPtr<RenderStyle> newStyle = RenderStyle::create();
+    newStyle->inheritFrom(style());
+    newStyle->setDisplay(BLOCK);
+
+    FontDescription* desc = new FontDescription();
+    desc->setIsAbsoluteSize(true);
+    desc->setSpecifiedSize(gGlyphFontSize);
+    desc->setComputedSize(gGlyphFontSize);
+    newStyle->setFontDescription(*desc);
+    newStyle->font().update(newStyle->font().fontSelector());
+    newStyle->setLineHeight(Length(gGlyphLineHeight, Fixed));
+    newStyle->setVerticalAlign(TOP);
+    
+    if (size > 0)
+        newStyle->setMaxHeight(Length(size, Fixed));
+        
+    newStyle->setOverflowY(OHIDDEN);
+    newStyle->setOverflowX(OHIDDEN);
+    if (topRelative) {
+        newStyle->setTop(Length(topRelative, Fixed));
+        newStyle->setPosition(RelativePosition);
+    }
+    
+    return newStyle;
+}
+
+RenderBlock* RenderMathMLOperator::createGlyph(UChar glyph, int size, int charRelative, int topRelative)
+{
+    RenderBlock* container = new (renderArena()) RenderBlock(node());
+    container->setStyle(createStackableStyle(size, topRelative).release());
+    addChild(container);
+    RenderBlock* parent = container;
+    if (charRelative) {
+        RenderBlock* charBlock = new (renderArena()) RenderBlock(node());
+        RefPtr<RenderStyle> charStyle = RenderStyle::create();
+        charStyle->inheritFrom(container->style());
+        charStyle->setDisplay(INLINE_BLOCK);
+        charStyle->setTop(Length(charRelative, Fixed));
+        charStyle->setPosition(RelativePosition);
+        charBlock->setStyle(charStyle);
+        parent->addChild(charBlock);
+        parent = charBlock;
+    }
+     
+    RenderText* text = new (renderArena()) RenderText(node(), StringImpl::create(&glyph, 1));
+    text->setStyle(container->style());
+    parent->addChild(text);
+    return container;
+}
+
+int RenderMathMLOperator::baselinePosition(bool firstLine, bool isRootLineBox) const
+{
+    return !m_isStacked && firstChild() ? firstChild()->baselinePosition(firstLine, isRootLineBox) : offsetHeight();
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/mathml/RenderMathMLOperator.h b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLOperator.h
new file mode 100644
index 0000000000..6566dd7c4c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLOperator.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2010 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderMathMLOperator_h
+#define RenderMathMLOperator_h
+
+#if ENABLE(MATHML)
+
+#include "RenderMathMLBlock.h"
+
+namespace WebCore {
+    
+class RenderMathMLOperator : public RenderMathMLBlock {
+public:
+    RenderMathMLOperator(Node* container);
+    RenderMathMLOperator(Node* container, UChar operatorChar);
+    virtual bool isRenderMathMLOperator() const { return true; }
+    virtual void stretchToHeight(int pixelHeight);
+    virtual void updateFromElement(); 
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+    virtual int baselinePosition(bool , bool) const;    
+    
+protected:
+    virtual void layout();
+    virtual RefPtr<RenderStyle> createStackableStyle(int size, int topRelative);
+    virtual RenderBlock* createGlyph(UChar glyph, int size = 0, int charRelative = 0, int topRelative = 0);
+    
+private:
+    int m_stretchHeight;
+    bool m_isStacked;
+    UChar m_operator;
+};
+
+inline RenderMathMLOperator* toRenderMathMLOperator(RenderMathMLBlock* block)
+{ 
+    ASSERT(!block || block->isRenderMathMLOperator());
+    return static_cast<RenderMathMLOperator*>(block);
+}
+
+inline const RenderMathMLOperator* toRenderMathMLOperator(const RenderMathMLBlock* block)
+{ 
+    ASSERT(!block || block->isRenderMathMLOperator());
+    return static_cast<const RenderMathMLOperator*>(block);
+}
+    
+}
+
+
+#endif // ENABLE(MATHML)
+#endif // RenderMathMLOperator_h
diff --git a/src/3rdparty/webkit/WebCore/mathml/RenderMathMLRow.cpp b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLRow.cpp
new file mode 100644
index 0000000000..1bb656fd5e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLRow.cpp
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2010 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MATHML)
+
+#include "RenderMathMLRow.h"
+
+#include "MathMLNames.h"
+#include "RenderMathMLOperator.h"
+
+namespace WebCore {
+
+using namespace MathMLNames;
+
+RenderMathMLRow::RenderMathMLRow(Node* row)
+    : RenderMathMLBlock(row)
+{
+}
+
+int RenderMathMLRow::nonOperatorHeight() const
+{
+    int maxHeight = 0;
+    for (RenderObject* current = firstChild(); current; current = current->nextSibling()) {
+        if (current->isRenderMathMLBlock()) {
+            RenderMathMLBlock* block = toRenderMathMLBlock(current);
+            int blockHeight = block->nonOperatorHeight();
+            // Check to see if this box has a larger height
+            if (blockHeight > maxHeight)
+                maxHeight = blockHeight;
+        } else if (current->isBoxModelObject()) {
+            RenderBoxModelObject* box = toRenderBoxModelObject(current);
+            // Check to see if this box has a larger height
+            if (box->offsetHeight() > maxHeight)
+                maxHeight = box->offsetHeight();
+        }
+        
+    }
+    return maxHeight;
+}
+
+void RenderMathMLRow::layout() 
+{
+    RenderBlock::layout();
+    
+    // Calculate the maximum height of the row without the operators.
+    int maxHeight = nonOperatorHeight();
+    
+    // Set the maximum height of the row for intermediate layouts.
+    style()->setHeight(Length(maxHeight, Fixed));
+
+    // Notify contained operators they may need to re-layout their stretched operators.
+    // We need to keep track of the number of children and operators because a row of
+    // operators needs some special handling.
+    int childCount = 0;
+    int operatorCount = 0;
+    for (RenderObject* current = firstChild(); current; current = current->nextSibling()) {
+        childCount++;
+        if (current->isRenderMathMLBlock()) {
+            RenderMathMLBlock* block = toRenderMathMLBlock(current);
+            block->stretchToHeight(maxHeight);
+            if (block->isRenderMathMLOperator()) 
+                operatorCount++;
+        }
+    }
+    
+    // Layout the non-operators which have just been stretched.
+    setNeedsLayoutAndPrefWidthsRecalc();
+    markContainingBlocksForLayout();
+    RenderBlock::layout();
+
+    // Make a second pass with the real height of the operators.
+    int operatorHeight = 0;
+    for (RenderObject* current = firstChild(); current; current = current->nextSibling()) {
+        if (current->isRenderMathMLBlock()) {
+            RenderMathMLBlock* block = toRenderMathMLBlock(current);
+            if (!block->hasBase() && !block->isRenderMathMLOperator()) {
+                // Check to see if this box has a larger height.
+                if (block->offsetHeight() > maxHeight)
+                    maxHeight = block->offsetHeight();
+            }
+            if (block->isRenderMathMLOperator())
+                if (block->offsetHeight() > operatorHeight)
+                    operatorHeight = block->offsetHeight();
+        } else if (current->isBoxModelObject()) {
+            RenderBoxModelObject* box = toRenderBoxModelObject(current);
+            // Check to see if this box has a larger height.
+            if (box->offsetHeight() > maxHeight)
+                maxHeight = box->offsetHeight();
+        }
+    }
+    
+    if (childCount > 0 && childCount == operatorCount) {
+        // We have only operators and so set the max height to the operator height.
+        maxHeight = operatorHeight;
+    }
+    
+    int stretchHeight = maxHeight;
+    
+    // Stretch the operators again and re-calculate the row height.
+    for (RenderObject* current = firstChild(); current; current = current->nextSibling()) {
+        if (current->isRenderMathMLBlock()) {
+            RenderMathMLBlock* block = toRenderMathMLBlock(current);
+            if (block->isRenderMathMLOperator()) {
+                RenderMathMLOperator* mathop = toRenderMathMLOperator(block);
+                mathop->stretchToHeight(stretchHeight);
+            } else {
+                block->stretchToHeight(stretchHeight);
+                RenderBoxModelObject* box = toRenderBoxModelObject(current);
+                // Check to see if this box has a larger height
+                if (box->offsetHeight() > maxHeight)
+                    maxHeight = box->offsetHeight();
+            }
+        } else if (current->isBoxModelObject()) {
+            RenderBoxModelObject* box = toRenderBoxModelObject(current);
+            // Check to see if this box has a larger height
+            if (box->offsetHeight() > maxHeight)
+                maxHeight = box->offsetHeight();
+        }
+    }
+
+    // Set the maximum height of the row based on the calculations.
+    style()->setHeight(Length(maxHeight, Fixed));
+    
+    // Do the final layout by calling our parent's layout again.
+    setNeedsLayoutAndPrefWidthsRecalc();
+    markContainingBlocksForLayout();
+    RenderBlock::layout();
+}
+
+}
+
+#endif // ENABLE(MATHML)
+
diff --git a/src/3rdparty/webkit/WebCore/mathml/RenderMathMLRow.h b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLRow.h
new file mode 100644
index 0000000000..a88b212760
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLRow.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderMathMLRow_h
+#define RenderMathMLRow_h
+
+#if ENABLE(MATHML)
+
+#include "RenderMathMLBlock.h"
+
+namespace WebCore {
+    
+class RenderMathMLRow : public RenderMathMLBlock {
+public:
+    RenderMathMLRow(Node* container);
+    virtual bool isRenderMathMLRow() const { return true; }
+    virtual int nonOperatorHeight() const;
+protected:
+    virtual void layout();
+};
+    
+}
+
+
+#endif // ENABLE(MATHML)
+#endif // RenderMathMLRow_h
diff --git a/src/3rdparty/webkit/WebCore/mathml/RenderMathMLSubSup.cpp b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLSubSup.cpp
new file mode 100644
index 0000000000..3124ac95da
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLSubSup.cpp
@@ -0,0 +1,213 @@
+/*
+ * Copyright (C) 2010 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MATHML)
+
+#include "RenderMathMLSubSup.h"
+
+#include "FontSelector.h"
+#include "MathMLNames.h"
+#include "RenderInline.h"
+#include "RenderTable.h"
+#include "RenderTableCell.h"
+#include "RenderTableRow.h"
+#include "RenderTableSection.h"
+#include "RenderText.h"
+
+namespace WebCore {
+    
+using namespace MathMLNames;
+
+static const int gTopAdjustDivisor = 3;
+static const int gSubsupScriptMargin = 1;
+static const float gSubSupStretch = 1.2;
+
+RenderMathMLSubSup::RenderMathMLSubSup(Element* element) 
+    : RenderMathMLBlock(element)
+    , m_scripts(0)
+{
+    // Determine what kind of under/over expression we have by element name
+    if (element->hasLocalName(MathMLNames::msubTag))
+        m_kind = Sub;
+    else if (element->hasLocalName(MathMLNames::msupTag))
+        m_kind = Sup;
+    else if (element->hasLocalName(MathMLNames::msubsupTag))
+        m_kind = SubSup;
+    else 
+        m_kind = SubSup;
+}
+
+void RenderMathMLSubSup::addChild(RenderObject* child, RenderObject* beforeChild)
+{
+    if (firstChild()) {
+        // We already have a base, so this is the super/subscripts being added.
+        
+        if (m_kind == SubSup) {
+            if (!m_scripts) {
+                m_scripts = new (renderArena()) RenderMathMLBlock(node());
+                RefPtr<RenderStyle> scriptsStyle = RenderStyle::create();
+                scriptsStyle->inheritFrom(style());
+                scriptsStyle->setDisplay(INLINE_BLOCK);
+                scriptsStyle->setVerticalAlign(MIDDLE);
+                scriptsStyle->setMarginLeft(Length(gSubsupScriptMargin, Fixed));
+                scriptsStyle->setTextAlign(LEFT);
+                m_scripts->setStyle(scriptsStyle.release());
+                RenderMathMLBlock::addChild(m_scripts, beforeChild);
+            }
+            
+            RenderBlock* script = new (renderArena()) RenderMathMLBlock(node());
+            RefPtr<RenderStyle> scriptStyle = RenderStyle::create();
+            scriptStyle->inheritFrom(m_scripts->style());
+            scriptStyle->setDisplay(BLOCK);
+            script->setStyle(scriptStyle.release());
+            
+            m_scripts->addChild(script, m_scripts->firstChild());
+            script->addChild(child);
+        } else
+            RenderMathMLBlock::addChild(child, beforeChild);
+        
+    } else {
+        RenderMathMLBlock* wrapper = new (renderArena()) RenderMathMLBlock(node());
+        RefPtr<RenderStyle> wrapperStyle = RenderStyle::create();
+        wrapperStyle->inheritFrom(style());
+        wrapperStyle->setDisplay(INLINE_BLOCK);
+        wrapperStyle->setVerticalAlign(MIDDLE);
+        wrapper->setStyle(wrapperStyle.release());
+        RenderMathMLBlock::addChild(wrapper, beforeChild);
+        wrapper->addChild(child);
+    }
+}
+
+void  RenderMathMLSubSup::stretchToHeight(int height)
+{
+    RenderObject* base = firstChild();
+    if (!base)
+        return;
+    
+    if (base->isRenderMathMLBlock()) {
+        RenderMathMLBlock* block = toRenderMathMLBlock(base);
+        block->stretchToHeight(static_cast<int>(gSubSupStretch * height));
+    }
+    if (height > 0 && m_kind == SubSup && m_scripts) {
+        RenderObject* script = m_scripts->firstChild();
+        if (script) {
+            // Calculate the script height without the container margins.
+            RenderObject* top = script;
+            int topHeight = getBoxModelObjectHeight(top->firstChild());
+            int topAdjust = topHeight / gTopAdjustDivisor;
+            top->style()->setMarginTop(Length(-topAdjust, Fixed));
+            top->style()->setMarginBottom(Length(height - topHeight + topAdjust, Fixed));
+            if (top->isBoxModelObject()) {
+                RenderBoxModelObject* topBox = toRenderBoxModelObject(top);
+                topBox->updateBoxModelInfoFromStyle();
+            }
+            m_scripts->setNeedsLayoutAndPrefWidthsRecalc();
+            m_scripts->markContainingBlocksForLayout();
+        }
+    }
+    updateBoxModelInfoFromStyle();
+    setNeedsLayoutAndPrefWidthsRecalc();
+    markContainingBlocksForLayout();
+}
+
+int RenderMathMLSubSup::nonOperatorHeight() const 
+{
+    return 0;
+}
+
+void RenderMathMLSubSup::layout() 
+{
+    RenderBlock::layout();
+    
+    if (m_kind == SubSup) {
+        int width = 0;
+        RenderObject* current = firstChild();
+        while (current) {
+            width += getBoxModelObjectWidth(current);
+            current = current->nextSibling();
+        }
+        width++;
+        // 1 + margin of scripts
+        if (m_scripts) 
+            width += gSubsupScriptMargin;
+        style()->setWidth(Length(width, Fixed));
+
+        setNeedsLayoutAndPrefWidthsRecalc();
+        markContainingBlocksForLayout();
+        RenderBlock::layout();
+    }    
+}
+
+int RenderMathMLSubSup::baselinePosition(bool firstLine, bool isRootLineBox) const
+{
+    RenderObject* base = firstChild();
+    if (!base) 
+        return offsetHeight();
+    base = base->firstChild();
+    if (!base) 
+        return offsetHeight();
+    
+    int baseline = offsetHeight();
+    
+    switch (m_kind) {
+    case SubSup:
+        if (m_scripts) {
+            int topAdjust = 0;
+            if (base->isBoxModelObject()) {
+                RenderBoxModelObject* box = toRenderBoxModelObject(base);
+                topAdjust = (m_scripts->offsetHeight() - box->offsetHeight()) / 2;
+            }
+            return topAdjust + (base ? base->baselinePosition(firstLine, isRootLineBox) : 0) + 4;
+        }
+        break;
+    case Sup:
+        if (base) {
+            baseline = base->baselinePosition(firstLine, isRootLineBox) + 4;
+            // FIXME: The extra amount of the superscript ascending above the base's box
+            // isn't taken into account.  This should be calculated in a more reliable
+            // way.
+            RenderObject* sup = base->nextSibling();
+            if (sup && sup->isBoxModelObject()) {
+                RenderBoxModelObject* box = toRenderBoxModelObject(sup);
+                // we'll take half of the sup's box height into account in the baseline
+                baseline += static_cast<int>(box->offsetHeight() * 0.5);
+            }
+            baseline++;
+        }
+        break;
+    case Sub:
+        if (base) 
+            baseline = base->baselinePosition(true) + 4;
+    }
+    
+    return baseline;
+    
+}
+    
+}    
+
+#endif // ENABLE(MATHML)
diff --git a/src/3rdparty/webkit/WebCore/mathml/RenderMathMLSubSup.h b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLSubSup.h
new file mode 100644
index 0000000000..037ef89317
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLSubSup.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2010 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef RenderMathMLSubSup_h
+#define RenderMathMLSubSup_h
+
+#if ENABLE(MATHML)
+
+#include "RenderMathMLBlock.h"
+#include "RenderTable.h"
+
+namespace WebCore {
+    
+class RenderMathMLSubSup : public RenderMathMLBlock {
+public:
+    RenderMathMLSubSup(Element* fraction);
+    virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual bool hasBase() const { return true; }
+    virtual int nonOperatorHeight() const;
+    virtual void stretchToHeight(int pixelHeight);
+    virtual int baselinePosition(bool, bool) const;    
+
+protected:
+    virtual void layout();
+    
+private:
+    enum SubSupType { Sub, Sup, SubSup };
+    SubSupType m_kind;
+    RenderBlock* m_scripts;
+};
+    
+}
+
+#endif // ENABLE(MATHML)
+
+#endif // RenderMathMLSubSup_h
+
diff --git a/src/3rdparty/webkit/WebCore/mathml/RenderMathMLUnderOver.cpp b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLUnderOver.cpp
new file mode 100644
index 0000000000..514b8723ac
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLUnderOver.cpp
@@ -0,0 +1,274 @@
+/*
+ * Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MATHML)
+
+#include "RenderMathMLUnderOver.h"
+
+#include "FontSelector.h"
+#include "MathMLNames.h"
+
+namespace WebCore {
+
+using namespace MathMLNames;
+    
+static const double gOverSpacingAdjustment = 0.5;
+    
+RenderMathMLUnderOver::RenderMathMLUnderOver(Node* expression) 
+    : RenderMathMLBlock(expression) 
+{
+    Element* element = static_cast<Element*>(expression);
+    // Determine what kind of under/over expression we have by element name
+    
+    if (element->hasLocalName(MathMLNames::munderTag))
+        m_kind = Under;
+    else if (element->hasLocalName(MathMLNames::moverTag))
+        m_kind = Over;
+    else if (element->hasLocalName(MathMLNames::munderoverTag))
+        m_kind = UnderOver;
+    else 
+        m_kind = Under;
+    
+}
+
+void RenderMathMLUnderOver::addChild(RenderObject* child, RenderObject* beforeChild)
+{    
+    RenderMathMLBlock* row = new (renderArena()) RenderMathMLBlock(node());
+    RefPtr<RenderStyle> rowStyle = makeBlockStyle();
+    row->setStyle(rowStyle.release());
+    
+    // look through the children for rendered elements counting the blocks so we know what child
+    // we are adding
+    int blocks = 0;
+    RenderObject* current = this->firstChild();
+    while (current) {
+        blocks++;
+        current = current->nextSibling();
+    }
+    
+    switch (blocks) {
+    case 0:
+        // this is the base so just append it
+        RenderBlock::addChild(row, beforeChild);
+        break;
+    case 1:
+        // the under or over
+        // FIXME: text-align: center does not work
+        row->style()->setTextAlign(CENTER);
+        if (m_kind == Over) {
+            // add the over as first
+            RenderBlock::addChild(row, firstChild());
+        } else {
+            // add the under as last
+            RenderBlock::addChild(row, beforeChild);
+        }
+        break;
+    case 2:
+        // the under or over
+        // FIXME: text-align: center does not work
+        row->style()->setTextAlign(CENTER);
+        if (m_kind == UnderOver) {
+            // add the over as first
+            RenderBlock::addChild(row, firstChild());
+        } else {
+            // we really shouldn't get here as only munderover should have three children
+            RenderBlock::addChild(row, beforeChild);
+        }
+        break;
+    default:
+        // munderover shouldn't have more than three children.  In theory we shouldn't 
+        // get here if the MathML is correctly formed, but that isn't a guarantee.
+        // We will treat this as another under element and they'll get something funky.
+        RenderBlock::addChild(row, beforeChild);
+    }
+    row->addChild(child);    
+}
+
+inline int getOffsetHeight(RenderObject* obj) 
+{
+    if (obj->isBoxModelObject()) {
+        RenderBoxModelObject* box = toRenderBoxModelObject(obj);
+        return box->offsetHeight();
+    }
+   
+    return 0;
+}
+
+void  RenderMathMLUnderOver::stretchToHeight(int height)
+{
+
+    RenderObject* base = firstChild();
+    if (!base)
+        return;
+        
+    // For over or underover, the base is the sibling of the first child
+    if (m_kind != Under) 
+        base = base->nextSibling();
+        
+    if (!base)
+        return;
+        
+    // use the child of the row which is the actual base
+    base = base->firstChild();
+    
+    if (base && base->isRenderMathMLBlock()) {
+        RenderMathMLBlock* block = toRenderMathMLBlock(base);
+        block->stretchToHeight(height);
+        updateBoxModelInfoFromStyle();
+        setNeedsLayoutAndPrefWidthsRecalc();
+        markContainingBlocksForLayout();
+    }
+}
+
+void RenderMathMLUnderOver::layout() 
+{
+    RenderBlock::layout();
+    RenderObject* over = 0;
+    RenderObject* base = 0;
+    switch (m_kind) {
+    case Over:
+        // We need to calculate the baseline over the over versus the start of the base and 
+        // adjust the placement of the base.
+        over = firstChild();
+        if (over) {
+            // FIXME: descending glyphs intrude into base (e.g. lowercase y over base)
+            // FIXME: bases that ascend higher than the line box intrude into the over
+            int overSpacing = static_cast<int>(gOverSpacingAdjustment * (getOffsetHeight(over) - over->firstChild()->baselinePosition(true)));
+            
+            // base row wrapper
+            base = over->nextSibling();
+            if (base) {
+                if (overSpacing > 0) 
+                    base->style()->setMarginTop(Length(-overSpacing, Fixed));
+                else 
+                    base->style()->setMarginTop(Length(0, Fixed));
+            }
+            
+        }
+        break;
+    case Under:
+        // FIXME: Non-ascending glyphs in the under should be moved closer to the base
+
+        // We need to calculate the baseline of the base versus the start of the under block and
+        // adjust the placement of the under block.
+        
+        // base row wrapper
+        base = firstChild();
+        if (base) {
+            int baseHeight = getOffsetHeight(base);
+            // actual base
+            base = base->firstChild();
+            // FIXME: We need to look at the space between a single maximum height of
+            //        the line boxes and the baseline and squeeze them together
+            int underSpacing = baseHeight - base->baselinePosition(true);
+            
+            // adjust the base's intrusion into the under
+            RenderObject* under = lastChild();
+            if (under && underSpacing > 0)
+                under->style()->setMarginTop(Length(-underSpacing, Fixed));
+        }
+        break;
+    case UnderOver:
+        // FIXME: Non-descending glyphs in the over should be moved closer to the base
+        // FIXME: Non-ascending glyphs in the under should be moved closer to the base
+        
+        // We need to calculate the baseline of the over versus the start of the base and 
+        // adjust the placement of the base.
+        
+        over = firstChild();
+        if (over) {
+            // FIXME: descending glyphs intrude into base (e.g. lowercase y over base)
+            // FIXME: bases that ascend higher than the line box intrude into the over
+            int overSpacing = static_cast<int>(gOverSpacingAdjustment * (getOffsetHeight(over) - over->firstChild()->baselinePosition(true)));
+            
+            // base row wrapper
+            base = over->nextSibling();
+            
+            if (base) {
+                if (overSpacing > 0)
+                    base->style()->setMarginTop(Length(-overSpacing, Fixed));
+                
+                // We need to calculate the baseline of the base versus the start of the under block and
+                // adjust the placement of the under block.
+                
+                int baseHeight = getOffsetHeight(base);
+                // actual base
+                base = base->firstChild();
+                // FIXME: We need to look at the space between a single maximum height of
+                //        the line boxes and the baseline and squeeze them together
+                int underSpacing = baseHeight - base->baselinePosition(true);
+                
+                RenderObject* under = lastChild();
+                if (under && under->firstChild()->isRenderInline() && underSpacing > 0)
+                    under->style()->setMarginTop(Length(-underSpacing, Fixed));
+                
+            }
+        }
+        break;
+    }
+    setNeedsLayoutAndPrefWidthsRecalc();
+    RenderBlock::layout();
+}
+
+int RenderMathMLUnderOver::baselinePosition(bool, bool) const
+{
+    int baseline = 0;
+    RenderObject* current = 0;
+    switch (m_kind) {
+    case UnderOver:
+    case Over:
+        current = firstChild();
+        baseline += getOffsetHeight(current);
+        current = current->nextSibling();
+        if (current) {
+            // actual base
+            RenderObject* base = current->firstChild();
+            baseline += base->baselinePosition(true);
+            // added the negative top margin
+            baseline += current->style()->marginTop().value();
+        }
+        break;
+    case Under:
+        current = firstChild();
+        if (current) {
+            RenderObject* base = current->firstChild();
+            baseline += base->baselinePosition(true);
+        }
+    }
+    return baseline;
+}
+
+
+int RenderMathMLUnderOver::nonOperatorHeight() const 
+{
+    return 0;
+}
+
+}
+
+
+#endif // ENABLE(MATHML)
diff --git a/src/3rdparty/webkit/WebCore/mathml/RenderMathMLUnderOver.h b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLUnderOver.h
new file mode 100644
index 0000000000..5917126056
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/RenderMathMLUnderOver.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef RenderMathMLUnderOver_h
+#define RenderMathMLUnderOver_h
+
+#if ENABLE(MATHML)
+
+#include "RenderMathMLBlock.h"
+
+namespace WebCore {
+    
+class RenderMathMLUnderOver : public RenderMathMLBlock {
+public:
+    RenderMathMLUnderOver(Node* expression);
+    virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual void layout();
+    virtual bool hasBase() const { return true; }
+    virtual int nonOperatorHeight() const;
+    virtual int baselinePosition(bool , bool) const;    
+    virtual void stretchToHeight(int pixelHeight);
+private:
+    enum UnderOverType { Under, Over, UnderOver };
+    UnderOverType m_kind;
+};
+    
+}
+
+#endif // ENABLE(MATHML)
+
+#endif // RenderMathMLUnderOver_h
diff --git a/src/3rdparty/webkit/WebCore/mathml/mathattrs.in b/src/3rdparty/webkit/WebCore/mathml/mathattrs.in
new file mode 100644
index 0000000000..df2329aede
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/mathml/mathattrs.in
@@ -0,0 +1,13 @@
+namespace="MathML"
+namespaceURI="http://www.w3.org/1998/Math/MathML"
+guardFactoryWith="ENABLE(MATHML)"
+attrsNullNamespace
+
+close
+denomalign
+linethickness
+mathsize
+numalign
+open
+separators
+stretchy
diff --git a/src/3rdparty/webkit/WebCore/mathml/mathtags.in b/src/3rdparty/webkit/WebCore/mathml/mathtags.in
index 8704dbf67b..36333a83c9 100644
--- a/src/3rdparty/webkit/WebCore/mathml/mathtags.in
+++ b/src/3rdparty/webkit/WebCore/mathml/mathtags.in
@@ -1,7 +1,6 @@
 namespace="MathML"
 namespaceURI="http://www.w3.org/1998/Math/MathML"
 guardFactoryWith="ENABLE(MATHML)"
-exportStrings
 
 math
 mfrac interfaceName=MathMLInlineContainerElement
@@ -13,9 +12,10 @@ munder interfaceName=MathMLInlineContainerElement
 munderover interfaceName=MathMLInlineContainerElement
 msqrt interfaceName=MathMLInlineContainerElement
 mroot interfaceName=MathMLInlineContainerElement
-mi interfaceName=MathMLElement, createWithNew
-mn interfaceName=MathMLElement, createWithNew
-mo interfaceName=MathMLElement, createWithNew
+mi interfaceName=MathMLTextElement
+mn interfaceName=MathMLTextElement
+mo interfaceName=MathMLTextElement
+mtext interfaceName=MathMLTextElement
 msub interfaceName=MathMLElement, createWithNew
 msup interfaceName=MathMLElement, createWithNew
 
diff --git a/src/3rdparty/webkit/WebCore/notifications/Notification.cpp b/src/3rdparty/webkit/WebCore/notifications/Notification.cpp
index 8dd168ff88..9763f7b878 100644
--- a/src/3rdparty/webkit/WebCore/notifications/Notification.cpp
+++ b/src/3rdparty/webkit/WebCore/notifications/Notification.cpp
@@ -38,7 +38,7 @@
 
 #include "Document.h"
 #include "EventNames.h"
-#include "WorkerContext.h" 
+#include "WorkerContext.h"
 
 namespace WebCore {
 
@@ -48,6 +48,7 @@ Notification::Notification(const String& url, ScriptExecutionContext* context, E
     , m_isShowing(false)
     , m_presenter(provider)
 {
+    ASSERT(m_presenter);
     if (m_presenter->checkPermission(context->securityOrigin()) != NotificationPresenter::PermissionAllowed) {
         ec = SECURITY_ERR;
         return;
@@ -67,13 +68,14 @@ Notification::Notification(const NotificationContents& contents, ScriptExecution
     , m_isShowing(false)
     , m_presenter(provider)
 {
+    ASSERT(m_presenter);
     if (m_presenter->checkPermission(context->securityOrigin()) != NotificationPresenter::PermissionAllowed) {
         ec = SECURITY_ERR;
         return;
     }
 
-    KURL icon = context->completeURL(contents.icon());
-    if (!icon.isEmpty() && !icon.isValid()) {
+    m_iconURL = context->completeURL(contents.icon());
+    if (!m_iconURL.isEmpty() && !m_iconURL.isValid()) {
         ec = SYNTAX_ERR;
         return;
     }
diff --git a/src/3rdparty/webkit/WebCore/notifications/Notification.h b/src/3rdparty/webkit/WebCore/notifications/Notification.h
index 6545579eec..c2ba5d9a12 100644
--- a/src/3rdparty/webkit/WebCore/notifications/Notification.h
+++ b/src/3rdparty/webkit/WebCore/notifications/Notification.h
@@ -65,6 +65,7 @@ namespace WebCore {
     
         bool isHTML() { return m_isHTML; }
         KURL url() { return m_notificationURL; }
+        KURL iconURL() { return m_iconURL; }
         NotificationContents& contents() { return m_contents; }
 
         DEFINE_ATTRIBUTE_EVENT_LISTENER(display);
@@ -90,6 +91,7 @@ namespace WebCore {
 
         bool m_isHTML;
         KURL m_notificationURL;
+        KURL m_iconURL;
         NotificationContents m_contents;
 
         bool m_isShowing;
diff --git a/src/3rdparty/webkit/WebCore/notifications/Notification.idl b/src/3rdparty/webkit/WebCore/notifications/Notification.idl
index ec6a9c86b1..b99da963f7 100644
--- a/src/3rdparty/webkit/WebCore/notifications/Notification.idl
+++ b/src/3rdparty/webkit/WebCore/notifications/Notification.idl
@@ -32,7 +32,8 @@ module threads {
 
     interface [
         Conditional=NOTIFICATIONS,
-        EventTarget
+        EventTarget,
+        OmitConstructor
     ] Notification {
         void show();
         void cancel();
@@ -42,12 +43,12 @@ module threads {
         attribute EventListener onclose;
 
         // EventTarget interface
-        [Custom] void addEventListener(in DOMString type, 
-                                       in EventListener listener, 
-                                       in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type, 
+        [JSCCustom] void addEventListener(in DOMString type, 
                                           in EventListener listener, 
                                           in boolean useCapture);
+        [JSCCustom] void removeEventListener(in DOMString type, 
+                                             in EventListener listener, 
+                                             in boolean useCapture);
         boolean dispatchEvent(in Event evt)
             raises(EventException);
     };
diff --git a/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.cpp b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.cpp
index 69b0075027..205b9a9c24 100644
--- a/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.cpp
+++ b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.cpp
@@ -40,32 +40,22 @@
 
 namespace WebCore {
 
-#if USE(V8)
-static bool notificationCenterAvailable = false;
-
-void NotificationCenter::setIsAvailable(bool available)
-{
-    notificationCenterAvailable = available;
-}
-
-bool NotificationCenter::isAvailable()
-{
-    return notificationCenterAvailable;
-}
-#endif
-
-NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationPresenter* presenter) 
+NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationPresenter* presenter)
     : ActiveDOMObject(context, this)
     , m_scriptExecutionContext(context)
     , m_notificationPresenter(presenter) {}
 
-int NotificationCenter::checkPermission() 
+int NotificationCenter::checkPermission()
 {
+    if (!presenter())
+        return NotificationPresenter::PermissionDenied;
     return m_notificationPresenter->checkPermission(m_scriptExecutionContext->securityOrigin());
 }
 
 void NotificationCenter::requestPermission(PassRefPtr<VoidCallback> callback)
 {
+    if (!presenter())
+        return;
     m_notificationPresenter->requestPermission(m_scriptExecutionContext->securityOrigin(), callback);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.h b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.h
index 10844420cc..ae3dc02471 100644
--- a/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.h
+++ b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.h
@@ -47,19 +47,23 @@ namespace WebCore {
 
     class NotificationCenter : public RefCounted<NotificationCenter>, public ActiveDOMObject { 
     public:
-#if USE(V8)
-        static void setIsAvailable(bool);
-        static bool isAvailable();
-#endif
         static PassRefPtr<NotificationCenter> create(ScriptExecutionContext* context, NotificationPresenter* presenter) { return adoptRef(new NotificationCenter(context, presenter)); }
 
         Notification* createHTMLNotification(const String& URI, ExceptionCode& ec)
         {
+            if (!presenter()) {
+                ec = INVALID_STATE_ERR;
+                return 0;
+            }
             return Notification::create(KURL(ParsedURLString, URI), context(), ec, presenter());
         }
 
         Notification* createNotification(const String& iconURI, const String& title, const String& body, ExceptionCode& ec)
         {
+            if (!presenter()) {
+                ec = INVALID_STATE_ERR;
+                return 0;
+            }
             NotificationContents contents(iconURI, title, body);
             return Notification::create(contents, context(), ec, presenter());
         }
@@ -70,6 +74,8 @@ namespace WebCore {
         int checkPermission();
         void requestPermission(PassRefPtr<VoidCallback> callback);
 
+        void disconnectFrame() { m_notificationPresenter = 0; }
+
     private:
         NotificationCenter(ScriptExecutionContext*, NotificationPresenter*);
 
diff --git a/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.idl b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.idl
index 3f6e36989d..86420b8fcf 100644
--- a/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.idl
+++ b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.idl
@@ -31,7 +31,8 @@
 module threads {
 
     interface [
-        Conditional=NOTIFICATIONS
+        Conditional=NOTIFICATIONS,
+        OmitConstructor
     ] NotificationCenter {
        [V8Custom] Notification createHTMLNotification(in DOMString url) raises(Exception);
        [V8Custom] Notification createNotification(in DOMString iconUrl, in DOMString title, in DOMString body) raises(Exception);
diff --git a/src/3rdparty/webkit/WebCore/notifications/NotificationPresenter.h b/src/3rdparty/webkit/WebCore/notifications/NotificationPresenter.h
index d70a3e9e97..9abf8a9c35 100644
--- a/src/3rdparty/webkit/WebCore/notifications/NotificationPresenter.h
+++ b/src/3rdparty/webkit/WebCore/notifications/NotificationPresenter.h
@@ -38,39 +38,41 @@
 
 namespace WebCore {
 
+    class Document;
     class Notification;
+    class KURL;
     class SecurityOrigin;
     class String;
-    
+
     class NotificationPresenter {
 
     public:
-        enum Permission { 
-            PermissionAllowed,     // User has allowed notifications
-            PermissionNotAllowed,  // User has not yet allowed
-            PermissionDenied       // User has explictly denied permission
+        enum Permission {
+            PermissionAllowed, // User has allowed notifications
+            PermissionNotAllowed, // User has not yet allowed
+            PermissionDenied // User has explicitly denied permission
         };
 
         virtual ~NotificationPresenter() {}
 
         // Requests that a notification be shown.
-        virtual bool show(Notification* object) = 0;
+        virtual bool show(Notification*) = 0;
 
         // Requests that a notification that has already been shown be canceled.
-        virtual void cancel(Notification* object) = 0;
+        virtual void cancel(Notification*) = 0;
 
-        // Informs the presenter that a Notification object has been destroyed 
+        // Informs the presenter that a Notification object has been destroyed
         // (such as by a page transition).  The presenter may continue showing
         // the notification, but must not attempt to call the event handlers.
-        virtual void notificationObjectDestroyed(Notification* object) = 0;
+        virtual void notificationObjectDestroyed(Notification*) = 0;
 
         // Requests user permission to show desktop notifications from a particular
-        // origin.  The callback parameter should be run when the user has
+        // origin. The callback parameter should be run when the user has
         // made a decision.
-        virtual void requestPermission(SecurityOrigin* origin, PassRefPtr<VoidCallback> callback) = 0;
+        virtual void requestPermission(SecurityOrigin*, PassRefPtr<VoidCallback>) = 0;
 
         // Checks the current level of permission.
-        virtual Permission checkPermission(SecurityOrigin* origin) = 0;
+        virtual Permission checkPermission(SecurityOrigin*) = 0;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/AbstractView.idl b/src/3rdparty/webkit/WebCore/page/AbstractView.idl
index 36865de44b..290bf4848a 100644
--- a/src/3rdparty/webkit/WebCore/page/AbstractView.idl
+++ b/src/3rdparty/webkit/WebCore/page/AbstractView.idl
@@ -28,7 +28,8 @@ module views {
 
     // Introduced in DOM Level 2:
     interface [
-        ObjCCustomImplementation
+        ObjCCustomImplementation,
+        OmitConstructor
     ] AbstractView {
         readonly attribute Document document;
         readonly attribute Media media;
diff --git a/src/3rdparty/webkit/WebCore/page/BarInfo.cpp b/src/3rdparty/webkit/WebCore/page/BarInfo.cpp
index 0f6cad5b56..b6ab68619c 100644
--- a/src/3rdparty/webkit/WebCore/page/BarInfo.cpp
+++ b/src/3rdparty/webkit/WebCore/page/BarInfo.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -60,23 +60,25 @@ bool BarInfo::visible() const
 {
     if (!m_frame)
         return false;
+    Page* page = m_frame->page();
+    if (!page)
+        return false;
 
     switch (m_type) {
     case Locationbar:
-        return m_frame->page()->chrome()->toolbarsVisible();
-    case Toolbar:
-        return m_frame->page()->chrome()->toolbarsVisible();
     case Personalbar:
-        return m_frame->page()->chrome()->toolbarsVisible();
+    case Toolbar:
+        return page->chrome()->toolbarsVisible();
     case Menubar:
-        return m_frame->page()->chrome()->menubarVisible();
+        return page->chrome()->menubarVisible();
     case Scrollbars:
-        return m_frame->page()->chrome()->scrollbarsVisible();
+        return page->chrome()->scrollbarsVisible();
     case Statusbar:
-        return m_frame->page()->chrome()->statusbarVisible();
-    default:
-        return false;
+        return page->chrome()->statusbarVisible();
     }
+
+    ASSERT_NOT_REACHED();
+    return false;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/BarInfo.idl b/src/3rdparty/webkit/WebCore/page/BarInfo.idl
index 42041c51f3..2089895b0b 100644
--- a/src/3rdparty/webkit/WebCore/page/BarInfo.idl
+++ b/src/3rdparty/webkit/WebCore/page/BarInfo.idl
@@ -28,7 +28,7 @@
 
 module window {
 
-    interface BarInfo {
+    interface [OmitConstructor] BarInfo {
         readonly attribute boolean visible;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/page/Chrome.cpp b/src/3rdparty/webkit/WebCore/page/Chrome.cpp
index 96f0fb7271..417469549a 100644
--- a/src/3rdparty/webkit/WebCore/page/Chrome.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Chrome.cpp
@@ -67,9 +67,19 @@ Chrome::~Chrome()
     m_client->chromeDestroyed();
 }
 
-void Chrome::repaint(const IntRect& windowRect, bool contentChanged, bool immediate, bool repaintContentOnly)
+void Chrome::invalidateWindow(const IntRect& updateRect, bool immediate)
 {
-    m_client->repaint(windowRect, contentChanged, immediate, repaintContentOnly);
+    m_client->invalidateWindow(updateRect, immediate);
+}
+
+void Chrome::invalidateContentsAndWindow(const IntRect& updateRect, bool immediate)
+{
+    m_client->invalidateContentsAndWindow(updateRect, immediate);
+}
+
+void Chrome::invalidateContentsForSlowScroll(const IntRect& updateRect, bool immediate)
+{
+    m_client->invalidateContentsForSlowScroll(updateRect, immediate);
 }
 
 void Chrome::scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect)
@@ -147,6 +157,11 @@ void Chrome::takeFocus(FocusDirection direction) const
     m_client->takeFocus(direction);
 }
 
+void Chrome::focusedNodeChanged(Node* node) const
+{
+    m_client->focusedNodeChanged(node);
+}
+
 Page* Chrome::createWindow(Frame* frame, const FrameLoadRequest& request, const WindowFeatures& features) const
 {
     Page* newPage = m_client->createWindow(frame, request, features);
@@ -302,6 +317,16 @@ bool Chrome::shouldInterruptJavaScript()
     return m_client->shouldInterruptJavaScript();
 }
 
+void Chrome::registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title)
+{
+    m_client->registerProtocolHandler(scheme, baseURL, url, title);
+}
+
+void Chrome::registerContentHandler(const String& mimeType, const String& baseURL, const String& url, const String& title)
+{
+    m_client->registerContentHandler(mimeType,  baseURL, url,  title);
+}
+
 IntRect Chrome::windowResizerRect() const
 {
     return m_client->windowResizerRect();
@@ -312,7 +337,7 @@ void Chrome::mouseDidMoveOverElement(const HitTestResult& result, unsigned modif
     if (result.innerNode()) {
         Document* document = result.innerNode()->document();
         if (document && document->isDNSPrefetchEnabled())
-            prefetchDNS(result.absoluteLinkURL().host());
+            ResourceHandle::prepareForURL(result.absoluteLinkURL());
     }
     m_client->mouseDidMoveOverElement(result, modifierFlags);
 
@@ -392,19 +417,24 @@ void Chrome::print(Frame* frame)
 
 void Chrome::requestGeolocationPermissionForFrame(Frame* frame, Geolocation* geolocation)
 {
-    // Defer loads in case the client method runs a new event loop that would
-    // otherwise cause the load to continue while we're in the middle of executing JavaScript.
-    PageGroupLoadDeferrer deferrer(m_page, true);
-
-    ASSERT(frame);
     m_client->requestGeolocationPermissionForFrame(frame, geolocation);
 }
 
+void Chrome::cancelGeolocationPermissionRequestForFrame(Frame* frame)
+{
+    m_client->cancelGeolocationPermissionRequestForFrame(frame);
+}
+
 void Chrome::runOpenPanel(Frame* frame, PassRefPtr<FileChooser> fileChooser)
 {
     m_client->runOpenPanel(frame, fileChooser);
 }
 
+void Chrome::chooseIconForFiles(const Vector<String>& filenames, PassRefPtr<FileChooser> fileChooser)
+{
+    m_client->chooseIconForFiles(filenames, fileChooser);
+}
+
 bool Chrome::setCursor(PlatformCursorHandle cursor)
 {
     return m_client->setCursor(cursor);
diff --git a/src/3rdparty/webkit/WebCore/page/Chrome.h b/src/3rdparty/webkit/WebCore/page/Chrome.h
index 033311dd18..72312bcfd3 100644
--- a/src/3rdparty/webkit/WebCore/page/Chrome.h
+++ b/src/3rdparty/webkit/WebCore/page/Chrome.h
@@ -42,6 +42,7 @@ namespace WebCore {
     class Geolocation;
     class HitTestResult;
     class IntRect;
+    class Node;
     class Page;
     class String;
 #if ENABLE(NOTIFICATIONS)
@@ -59,8 +60,11 @@ namespace WebCore {
         ChromeClient* client() { return m_client; }
 
         // HostWindow methods.
-        virtual void repaint(const IntRect&, bool contentChanged, bool immediate = false, bool repaintContentOnly = false);
-        virtual void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
+
+        virtual void invalidateWindow(const IntRect&, bool);
+        virtual void invalidateContentsAndWindow(const IntRect&, bool);
+        virtual void invalidateContentsForSlowScroll(const IntRect&, bool);
+        virtual void scroll(const IntSize&, const IntRect&, const IntRect&);
         virtual IntPoint screenToWindow(const IntPoint&) const;
         virtual IntRect windowToScreen(const IntRect&) const;
         virtual PlatformPageClient platformPageClient() const;
@@ -82,6 +86,8 @@ namespace WebCore {
         bool canTakeFocus(FocusDirection) const;
         void takeFocus(FocusDirection) const;
 
+        void focusedNodeChanged(Node*) const;
+
         Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&) const;
         void show() const;
 
@@ -114,6 +120,9 @@ namespace WebCore {
         void setStatusbarText(Frame*, const String&);
         bool shouldInterruptJavaScript();
 
+        void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title);
+        void registerContentHandler(const String& mimeType, const String& baseURL, const String& url, const String& title);
+
         IntRect windowResizerRect() const;
 
         void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
@@ -123,8 +132,10 @@ namespace WebCore {
         void print(Frame*);
 
         void requestGeolocationPermissionForFrame(Frame*, Geolocation*);
+        void cancelGeolocationPermissionRequestForFrame(Frame*);
 
         void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
+        void chooseIconForFiles(const Vector<String>&, PassRefPtr<FileChooser>);
 
         bool setCursor(PlatformCursorHandle);
 
diff --git a/src/3rdparty/webkit/WebCore/page/ChromeClient.h b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
index 5231603586..34e28938ec 100644
--- a/src/3rdparty/webkit/WebCore/page/ChromeClient.h
+++ b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
@@ -83,6 +83,8 @@ namespace WebCore {
         virtual bool canTakeFocus(FocusDirection) = 0;
         virtual void takeFocus(FocusDirection) = 0;
 
+        virtual void focusedNodeChanged(Node*) = 0;
+
         // The Frame pointer provides the ChromeClient with context about which
         // Frame wants to create the new Page.  Also, the newly created window
         // should not be shown to the user until the ChromeClient of the newly
@@ -121,11 +123,16 @@ namespace WebCore {
         virtual bool shouldInterruptJavaScript() = 0;
         virtual bool tabsToLinks() const = 0;
 
+        virtual void registerProtocolHandler(const String&, const String&, const String&, const String&) { }
+        virtual void registerContentHandler(const String&, const String&, const String&, const String&) { }
+
         virtual IntRect windowResizerRect() const = 0;
 
         // Methods used by HostWindow.
-        virtual void repaint(const IntRect&, bool contentChanged, bool immediate = false, bool repaintContentOnly = false) = 0;
-        virtual void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect) = 0;
+        virtual void invalidateWindow(const IntRect&, bool) = 0;
+        virtual void invalidateContentsAndWindow(const IntRect&, bool) = 0;
+        virtual void invalidateContentsForSlowScroll(const IntRect&, bool) = 0;
+        virtual void scroll(const IntSize&, const IntRect&, const IntRect&) = 0;
         virtual IntPoint screenToWindow(const IntPoint&) const = 0;
         virtual IntRect windowToScreen(const IntRect&) const = 0;
         virtual PlatformPageClient platformPageClient() const = 0;
@@ -176,10 +183,13 @@ namespace WebCore {
         virtual bool paintCustomScrollCorner(GraphicsContext*, const FloatRect&);
 
         // This can be either a synchronous or asynchronous call. The ChromeClient can display UI asking the user for permission
-        // to use Geolococation. The ChromeClient must call Geolocation::setShouldClearCache() appropriately.
+        // to use Geolocation.
         virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*) = 0;
+        virtual void cancelGeolocationPermissionRequestForFrame(Frame*) = 0;
             
         virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>) = 0;
+        // Asynchronous request to load an icon for specified filenames.
+        virtual void chooseIconForFiles(const Vector<String>&, PassRefPtr<FileChooser>) = 0;
 
         virtual bool setCursor(PlatformCursorHandle) = 0;
 
@@ -216,6 +226,17 @@ namespace WebCore {
         virtual void willPopUpMenu(NSMenu *) { }
 #endif
 
+#if ENABLE(TOUCH_EVENTS)
+        virtual void needTouchEvents(bool) = 0;
+#endif
+
+#if ENABLE(WIDGETS_10_SUPPORT)
+        virtual bool isDocked() { return false; }
+        virtual bool isFloating() { return false; }
+        virtual bool isApplication() { return false; }
+        virtual bool isFullscreen() { return false; }
+#endif
+
     protected:
         virtual ~ChromeClient() { }
     };
diff --git a/src/3rdparty/webkit/WebCore/page/Console.cpp b/src/3rdparty/webkit/WebCore/page/Console.cpp
index 7d0f697aef..99b31064b4 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Console.cpp
@@ -30,6 +30,7 @@
 #include "Console.h"
 
 #include "CString.h"
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "ConsoleMessage.h"
 #include "Frame.h"
@@ -40,11 +41,9 @@
 #include "PageGroup.h"
 #include "PlatformString.h"
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-#include <profiler/Profiler.h>
-#endif
-
 #include "ScriptCallStack.h"
+#include "ScriptProfile.h"
+#include "ScriptProfiler.h"
 #include <stdio.h>
 #include <wtf/UnusedParam.h>
 
@@ -191,7 +190,7 @@ void Console::addMessage(MessageType type, MessageLevel level, ScriptCallStack*
 
     for (unsigned i = 0; i < lastCaller.argumentCount(); ++i) {
         String argAsString;
-        if (lastCaller.argumentAt(i).getString(argAsString))
+        if (lastCaller.argumentAt(i).getString(callStack->state(), argAsString))
             printf(" %s", argAsString.utf8().data());
     }
     printf("\n");
@@ -270,6 +269,23 @@ void Console::count(ScriptCallStack* callStack)
 #endif
 }
 
+void Console::markTimeline(ScriptCallStack* callStack)
+{
+#if ENABLE(INSPECTOR)
+    Page* page = this->page();
+    if (!page)
+        return;
+
+    const ScriptCallFrame& lastCaller = callStack->at(0);
+    String message;
+    getFirstArgumentAsString(callStack->state(), lastCaller, message);
+
+    page->inspectorController()->markTimeline(message);
+#else
+    UNUSED_PARAM(callStack);
+#endif
+}
+
 #if ENABLE(WML)
 String Console::lastWMLErrorMessage() const
 {
@@ -298,7 +314,7 @@ String Console::lastWMLErrorMessage() const
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
-void Console::profile(const JSC::UString& title, ScriptCallStack* callStack)
+void Console::profile(const String& title, ScriptCallStack* callStack)
 {
     Page* page = this->page();
     if (!page)
@@ -311,15 +327,15 @@ void Console::profile(const JSC::UString& title, ScriptCallStack* callStack)
         return;
 #endif
 
-    JSC::UString resolvedTitle = title;
-    if (title.isNull())   // no title so give it the next user initiated profile title.
+    String resolvedTitle = title;
+    if (title.isNull()) // no title so give it the next user initiated profile title.
 #if ENABLE(INSPECTOR)
         resolvedTitle = controller->getCurrentUserInitiatedProfileName(true);
 #else
         resolvedTitle = "";
 #endif
 
-    JSC::Profiler::profiler()->startProfiling(callStack->state(), resolvedTitle);
+    ScriptProfiler::start(callStack->state(), resolvedTitle);
 
 #if ENABLE(INSPECTOR)
     const ScriptCallFrame& lastCaller = callStack->at(0);
@@ -327,22 +343,19 @@ void Console::profile(const JSC::UString& title, ScriptCallStack* callStack)
 #endif
 }
 
-void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
+void Console::profileEnd(const String& title, ScriptCallStack* callStack)
 {
     Page* page = this->page();
     if (!page)
         return;
 
-    if (!this->page())
-        return;
-
 #if ENABLE(INSPECTOR)
     InspectorController* controller = page->inspectorController();
     if (!controller->profilerEnabled())
         return;
 #endif
 
-    RefPtr<JSC::Profile> profile = JSC::Profiler::profiler()->stopProfiling(callStack->state(), title);
+    RefPtr<ScriptProfile> profile = ScriptProfiler::stop(callStack->state(), title);
     if (!profile)
         return;
 
diff --git a/src/3rdparty/webkit/WebCore/page/Console.h b/src/3rdparty/webkit/WebCore/page/Console.h
index 1b93a4aa3b..9a6d88c2b6 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.h
+++ b/src/3rdparty/webkit/WebCore/page/Console.h
@@ -31,100 +31,99 @@
 
 #include "PlatformString.h"
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-#include <profiler/Profile.h>
-#endif
+#include "ScriptProfile.h"
 
-#include <wtf/RefCounted.h>
 #include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    typedef Vector<RefPtr<JSC::Profile> > ProfilesArray;
+typedef Vector<RefPtr<ScriptProfile> > ProfilesArray;
 #endif
 
-    class Frame;
-    class Page;
-    class String;
-    class ScriptCallStack;
-
-    // Keep in sync with inspector/front-end/Console.js
-    enum MessageSource {
-        HTMLMessageSource,
-        WMLMessageSource,
-        XMLMessageSource,
-        JSMessageSource,
-        CSSMessageSource,
-        OtherMessageSource
-    };
-
-    enum MessageType {
-        LogMessageType,
-        ObjectMessageType,
-        TraceMessageType,
-        StartGroupMessageType,
-        EndGroupMessageType,
-        AssertMessageType
-    };
-
-    enum MessageLevel {
-        TipMessageLevel,
-        LogMessageLevel,
-        WarningMessageLevel,
-        ErrorMessageLevel,
-        DebugMessageLevel
-    };
-
-    class Console : public RefCounted<Console> {
-    public:
-        static PassRefPtr<Console> create(Frame* frame) { return adoptRef(new Console(frame)); }
-
-        Frame* frame() const;
-        void disconnectFrame();
-
-        void addMessage(MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
-
-        void debug(ScriptCallStack*);
-        void error(ScriptCallStack*);
-        void info(ScriptCallStack*);
-        void log(ScriptCallStack*);
-        void warn(ScriptCallStack*);
-        void dir(ScriptCallStack*);
-        void dirxml(ScriptCallStack*);
-        void trace(ScriptCallStack*);
-        void assertCondition(bool condition, ScriptCallStack*);
-        void count(ScriptCallStack*);
+class Frame;
+class Page;
+class String;
+class ScriptCallStack;
+
+// Keep in sync with inspector/front-end/Console.js
+enum MessageSource {
+    HTMLMessageSource,
+    WMLMessageSource,
+    XMLMessageSource,
+    JSMessageSource,
+    CSSMessageSource,
+    OtherMessageSource
+};
+
+enum MessageType {
+    LogMessageType,
+    ObjectMessageType,
+    TraceMessageType,
+    StartGroupMessageType,
+    EndGroupMessageType,
+    AssertMessageType
+};
+
+enum MessageLevel {
+    TipMessageLevel,
+    LogMessageLevel,
+    WarningMessageLevel,
+    ErrorMessageLevel,
+    DebugMessageLevel
+};
+
+class Console : public RefCounted<Console> {
+public:
+    static PassRefPtr<Console> create(Frame* frame) { return adoptRef(new Console(frame)); }
+
+    Frame* frame() const;
+    void disconnectFrame();
+
+    void addMessage(MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
+
+    void debug(ScriptCallStack*);
+    void error(ScriptCallStack*);
+    void info(ScriptCallStack*);
+    void log(ScriptCallStack*);
+    void warn(ScriptCallStack*);
+    void dir(ScriptCallStack*);
+    void dirxml(ScriptCallStack*);
+    void trace(ScriptCallStack*);
+    void assertCondition(bool condition, ScriptCallStack*);
+    void count(ScriptCallStack*);
+    void markTimeline(ScriptCallStack*);
 #if ENABLE(WML)
-        String lastWMLErrorMessage() const;
+    String lastWMLErrorMessage() const;
 #endif
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-        void profile(const JSC::UString&, ScriptCallStack*);
-        void profileEnd(const JSC::UString&, ScriptCallStack*);
+    void profile(const String&, ScriptCallStack*);
+    void profileEnd(const String&, ScriptCallStack*);
 #endif
-        void time(const String&);
-        void timeEnd(const String&, ScriptCallStack*);
-        void group(ScriptCallStack*);
-        void groupEnd();
+    void time(const String&);
+    void timeEnd(const String&, ScriptCallStack*);
+    void group(ScriptCallStack*);
+    void groupEnd();
 
-        static bool shouldPrintExceptions();
-        static void setShouldPrintExceptions(bool);
+    static bool shouldPrintExceptions();
+    static void setShouldPrintExceptions(bool);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-        const ProfilesArray& profiles() const { return m_profiles; }
+    const ProfilesArray& profiles() const { return m_profiles; }
 #endif
 
-    private:
-        inline Page* page() const;
-        void addMessage(MessageType, MessageLevel, ScriptCallStack*, bool acceptNoArguments = false);
+private:
+    inline Page* page() const;
+    void addMessage(MessageType, MessageLevel, ScriptCallStack*, bool acceptNoArguments = false);
 
-        Console(Frame*);
+    Console(Frame*);
 
-        Frame* m_frame;
+    Frame* m_frame;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-        ProfilesArray m_profiles;
+    ProfilesArray m_profiles;
 #endif
-    };
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/page/Console.idl b/src/3rdparty/webkit/WebCore/page/Console.idl
index 0e9f3dca40..c08fcc0c9e 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.idl
+++ b/src/3rdparty/webkit/WebCore/page/Console.idl
@@ -28,9 +28,10 @@
 
 module window {
 
-    interface Console {
+    interface [OmitConstructor] Console {
 
-#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
+        // Not enabled in V8 because it requires request-reply style.
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER && !(defined(V8_BINDING) && V8_BINDING)
         readonly attribute [CustomGetter] Array profiles;
 #endif
     
@@ -44,6 +45,7 @@ module window {
         [CustomArgumentHandling] void trace();
         [CustomArgumentHandling, ImplementationFunction=assertCondition] void assert(in boolean condition);
         [CustomArgumentHandling] void count();
+        [CustomArgumentHandling] void markTimeline();
 
 #if defined(ENABLE_WML) && ENABLE_WML
         [DontEnum] DOMString lastWMLErrorMessage();
diff --git a/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp b/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
index 7d773ca004..d384b02a11 100644
--- a/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
@@ -31,6 +31,7 @@
 #include "Chrome.h"
 #include "ContextMenu.h"
 #include "ContextMenuClient.h"
+#include "ContextMenuProvider.h"
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "DocumentLoader.h"
@@ -79,13 +80,38 @@ ContextMenuController::~ContextMenuController()
 void ContextMenuController::clearContextMenu()
 {
     m_contextMenu.set(0);
+    if (m_menuProvider)
+        m_menuProvider->contextMenuCleared();
+    m_menuProvider = 0;
 }
 
 void ContextMenuController::handleContextMenuEvent(Event* event)
 {
-    ASSERT(event->type() == eventNames().contextmenuEvent);
-    if (!event->isMouseEvent())
+    m_contextMenu.set(createContextMenu(event));
+    if (!m_contextMenu)
         return;
+    m_contextMenu->populate();
+    showContextMenu(event);
+}
+
+void ContextMenuController::showContextMenu(Event* event, PassRefPtr<ContextMenuProvider> menuProvider)
+{
+    m_menuProvider = menuProvider;
+
+    m_contextMenu.set(createContextMenu(event));
+    if (!m_contextMenu) {
+        clearContextMenu();
+        return;
+    }
+
+    m_menuProvider->populateContextMenu(m_contextMenu.get());
+    showContextMenu(event);
+}
+
+ContextMenu* ContextMenuController::createContextMenu(Event* event)
+{
+   if (!event->isMouseEvent())
+        return 0;
     MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
     HitTestResult result(mouseEvent->absoluteLocation());
 
@@ -93,18 +119,18 @@ void ContextMenuController::handleContextMenuEvent(Event* event)
         result = frame->eventHandler()->hitTestResultAtPoint(mouseEvent->absoluteLocation(), false);
 
     if (!result.innerNonSharedNode())
-        return;
+        return 0;
+    return new ContextMenu(result);
+}
 
-    m_contextMenu.set(new ContextMenu(result));
-    m_contextMenu->populate();
+void ContextMenuController::showContextMenu(Event* event)
+{
 #if ENABLE(INSPECTOR)
     if (m_page->inspectorController()->enabled())
         m_contextMenu->addInspectElementItem();
 #endif
-
     PlatformMenuDescription customMenu = m_client->getCustomMenuFromDefaultItems(m_contextMenu.get());
     m_contextMenu->setPlatformDescription(customMenu);
-
     event->setDefaultHandled();
 }
 
@@ -126,6 +152,12 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         return;
     }
 
+    if (item->action() >= ContextMenuItemBaseCustomTag) {
+        ASSERT(m_menuProvider);
+        m_menuProvider->contextMenuItemSelected(item);
+        return;
+    }
+
     HitTestResult result = m_contextMenu->hitTestResult();
     Frame* frame = result.innerNonSharedNode()->document()->frame();
     if (!frame)
diff --git a/src/3rdparty/webkit/WebCore/page/ContextMenuController.h b/src/3rdparty/webkit/WebCore/page/ContextMenuController.h
index 38095f6d1b..833b909993 100644
--- a/src/3rdparty/webkit/WebCore/page/ContextMenuController.h
+++ b/src/3rdparty/webkit/WebCore/page/ContextMenuController.h
@@ -28,12 +28,15 @@
 
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
 
 namespace WebCore {
 
     class ContextMenu;
     class ContextMenuClient;
     class ContextMenuItem;
+    class ContextMenuProvider;
     class Event;
     class Page;
 
@@ -48,12 +51,18 @@ namespace WebCore {
         void clearContextMenu();
 
         void handleContextMenuEvent(Event*);
+        void showContextMenu(Event*, PassRefPtr<ContextMenuProvider>);
+
         void contextMenuItemSelected(ContextMenuItem*);
 
     private:
+        ContextMenu* createContextMenu(Event*);
+        void showContextMenu(Event*);
+
         Page* m_page;
         ContextMenuClient* m_client;
         OwnPtr<ContextMenu> m_contextMenu;
+        RefPtr<ContextMenuProvider> m_menuProvider;
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/page/ContextMenuProvider.h b/src/3rdparty/webkit/WebCore/page/ContextMenuProvider.h
new file mode 100644
index 0000000000..57598d1bc0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/ContextMenuProvider.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ContextMenuProvider_h
+#define ContextMenuProvider_h
+
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class ContextMenu;
+class ContextMenuItem;
+
+class ContextMenuProvider : public RefCounted<ContextMenuProvider> {
+public:
+    virtual ~ContextMenuProvider() { };
+
+    virtual void populateContextMenu(ContextMenu*) = 0;
+    virtual void contextMenuItemSelected(ContextMenuItem*) = 0;
+    virtual void contextMenuCleared() = 0;
+};
+
+}
+
+#endif // ContextMenuProvider_h
diff --git a/src/3rdparty/webkit/WebCore/page/Coordinates.idl b/src/3rdparty/webkit/WebCore/page/Coordinates.idl
index f84732560d..5a5a1419ce 100644
--- a/src/3rdparty/webkit/WebCore/page/Coordinates.idl
+++ b/src/3rdparty/webkit/WebCore/page/Coordinates.idl
@@ -25,7 +25,7 @@
 
 module core {
 
-    interface Coordinates {
+    interface [OmitConstructor] Coordinates {
         readonly attribute double latitude;
         readonly attribute double longitude;
         readonly attribute [Custom] double altitude;
diff --git a/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp b/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp
index 0d21c565cb..12ae59df77 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp
@@ -326,7 +326,6 @@ void DOMSelection::extend(Node* node, int offset, ExceptionCode& ec)
     }
 
     SelectionController* selection = m_frame->selection();
-    selection->expandUsingGranularity(CharacterGranularity);
     selection->setExtent(VisiblePosition(node, offset, DOWNSTREAM));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/page/DOMSelection.idl b/src/3rdparty/webkit/WebCore/page/DOMSelection.idl
index be6c2b4f0f..4d0c942af9 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMSelection.idl
+++ b/src/3rdparty/webkit/WebCore/page/DOMSelection.idl
@@ -31,7 +31,7 @@ module window {
 
     // This is based off of Mozilla's Selection interface
     // https://developer.mozilla.org/En/DOM/Selection
-    interface DOMSelection {
+    interface [OmitConstructor] DOMSelection {
         readonly attribute Node anchorNode;
         readonly attribute long anchorOffset;
         readonly attribute Node focusNode;
diff --git a/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp b/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp
index 83bcb02913..72dc9ac053 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp
@@ -43,7 +43,7 @@ double DOMTimer::s_minTimerInterval = 0.010; // 10 milliseconds
 
 static int timerNestingLevel = 0;
 
-DOMTimer::DOMTimer(ScriptExecutionContext* context, ScheduledAction* action, int timeout, bool singleShot)
+DOMTimer::DOMTimer(ScriptExecutionContext* context, PassOwnPtr<ScheduledAction> action, int timeout, bool singleShot)
     : ActiveDOMObject(context, this)
     , m_action(action)
     , m_nextFireInterval(0)
@@ -82,7 +82,7 @@ DOMTimer::~DOMTimer()
         scriptExecutionContext()->removeTimeout(m_timeoutId);
 }
 
-int DOMTimer::install(ScriptExecutionContext* context, ScheduledAction* action, int timeout, bool singleShot)
+int DOMTimer::install(ScriptExecutionContext* context, PassOwnPtr<ScheduledAction> action, int timeout, bool singleShot)
 {
     // DOMTimer constructor links the new timer into a list of ActiveDOMObjects held by the 'context'.
     // The timer is deleted when context is deleted (DOMTimer::contextDestroyed) or explicitly via DOMTimer::removeById(),
@@ -119,8 +119,7 @@ void DOMTimer::fired()
     timerNestingLevel = m_nestingLevel;
 
 #if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context);
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
         timelineAgent->willFireTimer(m_timeoutId);
 #endif
 
@@ -135,7 +134,7 @@ void DOMTimer::fired()
         // No access to member variables after this point, it can delete the timer.
         m_action->execute(context);
 #if ENABLE(INSPECTOR)
-        if (timelineAgent)
+        if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
             timelineAgent->didFireTimer();
 #endif
         return;
@@ -149,7 +148,7 @@ void DOMTimer::fired()
 
     action->execute(context);
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
         timelineAgent->didFireTimer();
 #endif
     delete action;
diff --git a/src/3rdparty/webkit/WebCore/page/DOMTimer.h b/src/3rdparty/webkit/WebCore/page/DOMTimer.h
index 460430f4d2..da38178cdd 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMTimer.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMTimer.h
@@ -28,20 +28,21 @@
 #define DOMTimer_h
 
 #include "ActiveDOMObject.h"
+#include "ScheduledAction.h"
 #include "Timer.h"
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
     class InspectorTimelineAgent;
-    class ScheduledAction;
 
     class DOMTimer : public TimerBase, public ActiveDOMObject {
     public:
         virtual ~DOMTimer();
         // Creates a new timer owned by specified ScriptExecutionContext, starts it
         // and returns its Id.
-        static int install(ScriptExecutionContext*, ScheduledAction*, int timeout, bool singleShot);
+        static int install(ScriptExecutionContext*, PassOwnPtr<ScheduledAction>, int timeout, bool singleShot);
         static void removeById(ScriptExecutionContext*, int timeoutId);
 
         // ActiveDOMObject
@@ -59,7 +60,7 @@ namespace WebCore {
         static void setMinTimerInterval(double value) { s_minTimerInterval = value; }
 
     private:
-        DOMTimer(ScriptExecutionContext*, ScheduledAction*, int timeout, bool singleShot);
+        DOMTimer(ScriptExecutionContext*, PassOwnPtr<ScheduledAction>, int timeout, bool singleShot);
         virtual void fired();
 
         int m_timeoutId;
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
index c30b6b9c45..dd902005ef 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "DOMWindow.h"
 
+#include "Base64.h"
 #include "BarInfo.h"
 #include "BeforeUnloadEvent.h"
 #include "CSSComputedStyleDeclaration.h"
@@ -35,6 +36,7 @@
 #include "Chrome.h"
 #include "Console.h"
 #include "Database.h"
+#include "DatabaseCallback.h"
 #include "DOMApplicationCache.h"
 #include "DOMSelection.h"
 #include "DOMTimer.h"
@@ -53,6 +55,7 @@
 #include "HTMLFrameOwnerElement.h"
 #include "History.h"
 #include "InspectorController.h"
+#include "InspectorTimelineAgent.h"
 #include "Location.h"
 #include "Media.h"
 #include "MessageEvent.h"
@@ -262,7 +265,7 @@ void DOMWindow::dispatchAllPendingUnloadEvents()
         if (!set.contains(window))
             continue;
 
-        window->dispatchEvent(PageTransitionEvent::create(EventNames().pagehideEvent, false), window->document());
+        window->dispatchEvent(PageTransitionEvent::create(eventNames().pagehideEvent, false), window->document());
         window->dispatchEvent(Event::create(eventNames().unloadEvent, false, false), window->document());
     }
 
@@ -341,8 +344,6 @@ void DOMWindow::parseModalDialogFeatures(const String& featuresArg, HashMap<Stri
 bool DOMWindow::allowPopUp(Frame* activeFrame)
 {
     ASSERT(activeFrame);
-    if (activeFrame->script()->processingUserGesture())
-        return true;
     Settings* settings = activeFrame->settings();
     return settings && settings->javaScriptCanOpenWindowsAutomatically();
 }
@@ -441,6 +442,10 @@ void DOMWindow::clear()
     if (m_location)
         m_location->disconnectFrame();
     m_location = 0;
+
+    if (m_media)
+        m_media->disconnectFrame();
+    m_media = 0;
     
 #if ENABLE(DOM_STORAGE)
     if (m_sessionStorage)
@@ -459,6 +464,8 @@ void DOMWindow::clear()
 #endif
 
 #if ENABLE(NOTIFICATIONS)
+    if (m_notifications)
+        m_notifications->disconnectFrame();
     m_notifications = 0;
 #endif
 }
@@ -573,9 +580,6 @@ Storage* DOMWindow::sessionStorage() const
     if (!page)
         return 0;
 
-    if (!page->settings()->sessionStorageEnabled())
-        return 0;
-
     RefPtr<StorageArea> storageArea = page->sessionStorage()->storageArea(document->securityOrigin());
 #if ENABLE(INSPECTOR)
     page->inspectorController()->didUseDOMStorage(storageArea.get(), false, m_frame);
@@ -585,7 +589,7 @@ Storage* DOMWindow::sessionStorage() const
     return m_sessionStorage.get();
 }
 
-Storage* DOMWindow::localStorage() const
+Storage* DOMWindow::localStorage(ExceptionCode& ec) const
 {
     if (m_localStorage)
         return m_localStorage.get();
@@ -593,6 +597,11 @@ Storage* DOMWindow::localStorage() const
     Document* document = this->document();
     if (!document)
         return 0;
+    
+    if (!document->securityOrigin()->canAccessLocalStorage()) {
+        ec = SECURITY_ERR;
+        return 0;
+    }
         
     Page* page = document->page();
     if (!page)
@@ -625,9 +634,6 @@ NotificationCenter* DOMWindow::webkitNotifications() const
     if (!page)
         return 0;
 
-    if (!page->settings()->experimentalNotificationsEnabled())
-        return 0;
-
     NotificationPresenter* provider = page->chrome()->notificationPresenter();
     if (provider) 
         m_notifications = NotificationCenter::create(document, provider);    
@@ -636,6 +642,13 @@ NotificationCenter* DOMWindow::webkitNotifications() const
 }
 #endif
 
+#if ENABLE(INDEXED_DATABASE)
+IndexedDatabaseRequest* DOMWindow::indexedDB() const
+{
+    return 0;
+}
+#endif
+
 void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
 {
     MessagePortArray ports;
@@ -814,6 +827,57 @@ String DOMWindow::prompt(const String& message, const String& defaultValue)
     return String();
 }
 
+static bool isSafeToConvertCharList(const String& string)
+{
+    for (unsigned i = 0; i < string.length(); i++) {
+        if (string[i] > 0xFF)
+            return false;
+    }
+
+    return true;
+}
+
+String DOMWindow::btoa(const String& stringToEncode, ExceptionCode& ec)
+{
+    if (stringToEncode.isNull())
+        return String();
+
+    if (!isSafeToConvertCharList(stringToEncode)) {
+        ec = INVALID_CHARACTER_ERR;
+        return String();
+    }
+
+    Vector<char> in;
+    in.append(stringToEncode.characters(), stringToEncode.length());
+    Vector<char> out;
+
+    base64Encode(in, out);
+
+    return String(out.data(), out.size());
+}
+
+String DOMWindow::atob(const String& encodedString, ExceptionCode& ec)
+{
+    if (encodedString.isNull())
+        return String();
+
+    if (!isSafeToConvertCharList(encodedString)) {
+        ec = INVALID_CHARACTER_ERR;
+        return String();
+    }
+
+    Vector<char> in;
+    in.append(encodedString.characters(), encodedString.length());
+    Vector<char> out;
+
+    if (!base64Decode(in, out)) {
+        ec = INVALID_CHARACTER_ERR;
+        return String();
+    }
+
+    return String(out.data(), out.size());
+}
+
 bool DOMWindow::find(const String& string, bool caseSensitive, bool backwards, bool wrap, bool /*wholeWord*/, bool /*searchInFrames*/, bool /*showDialog*/) const
 {
     if (!m_frame)
@@ -1050,7 +1114,9 @@ Document* DOMWindow::document() const
 
 PassRefPtr<Media> DOMWindow::media() const
 {
-    return Media::create(const_cast<DOMWindow*>(this));
+    if (!m_media)
+        m_media = Media::create(m_frame);
+    return m_media.get();
 }
 
 PassRefPtr<CSSStyleDeclaration> DOMWindow::getComputedStyle(Element* elt, const String&) const
@@ -1078,7 +1144,9 @@ PassRefPtr<WebKitPoint> DOMWindow::webkitConvertPointFromNodeToPage(Node* node,
 {
     if (!node || !p)
         return 0;
-        
+
+    m_frame->document()->updateLayoutIgnorePendingStylesheets();
+
     FloatPoint pagePoint(p->x(), p->y());
     pagePoint = node->convertToPage(pagePoint);
     return WebKitPoint::create(pagePoint.x(), pagePoint.y());
@@ -1088,7 +1156,9 @@ PassRefPtr<WebKitPoint> DOMWindow::webkitConvertPointFromPageToNode(Node* node,
 {
     if (!node || !p)
         return 0;
-        
+
+    m_frame->document()->updateLayoutIgnorePendingStylesheets();
+
     FloatPoint nodePoint(p->x(), p->y());
     nodePoint = node->convertFromPage(nodePoint);
     return WebKitPoint::create(nodePoint.x(), nodePoint.y());
@@ -1107,18 +1177,21 @@ double DOMWindow::devicePixelRatio() const
 }
 
 #if ENABLE(DATABASE)
-PassRefPtr<Database> DOMWindow::openDatabase(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, ExceptionCode& ec)
+PassRefPtr<Database> DOMWindow::openDatabase(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode& ec)
 {
     if (!m_frame)
         return 0;
 
-    Document* doc = m_frame->document();
+    if (!Database::isAvailable())
+        return 0;
 
-    Settings* settings = m_frame->settings();
-    if (!settings || !settings->databasesEnabled())
+    Document* document = m_frame->document();
+    if (!document->securityOrigin()->canAccessDatabase()) {
+        ec = SECURITY_ERR;
         return 0;
+    }
 
-    return Database::openDatabase(doc, name, version, displayName, estimatedSize, ec);
+    return Database::openDatabase(document, name, version, displayName, estimatedSize, creationCallback, ec);
 }
 #endif
 
@@ -1232,24 +1305,40 @@ void DOMWindow::resizeTo(float width, float height) const
     page->chrome()->setWindowRect(fr);
 }
 
-int DOMWindow::setTimeout(ScheduledAction* action, int timeout)
+int DOMWindow::setTimeout(PassOwnPtr<ScheduledAction> action, int timeout, ExceptionCode& ec)
 {
-    return DOMTimer::install(scriptExecutionContext(), action, timeout, true);
+    ScriptExecutionContext* context = scriptExecutionContext();
+    if (!context) {
+        ec = INVALID_ACCESS_ERR;
+        return -1;
+    }
+    return DOMTimer::install(context, action, timeout, true);
 }
 
 void DOMWindow::clearTimeout(int timeoutId)
 {
-    DOMTimer::removeById(scriptExecutionContext(), timeoutId);
+    ScriptExecutionContext* context = scriptExecutionContext();
+    if (!context)
+        return;
+    DOMTimer::removeById(context, timeoutId);
 }
 
-int DOMWindow::setInterval(ScheduledAction* action, int timeout)
+int DOMWindow::setInterval(PassOwnPtr<ScheduledAction> action, int timeout, ExceptionCode& ec)
 {
-    return DOMTimer::install(scriptExecutionContext(), action, timeout, false);
+    ScriptExecutionContext* context = scriptExecutionContext();
+    if (!context) {
+        ec = INVALID_ACCESS_ERR;
+        return -1;
+    }
+    return DOMTimer::install(context, action, timeout, false);
 }
 
 void DOMWindow::clearInterval(int timeoutId)
 {
-    DOMTimer::removeById(scriptExecutionContext(), timeoutId);
+    ScriptExecutionContext* context = scriptExecutionContext();
+    if (!context)
+        return;
+    DOMTimer::removeById(context, timeoutId);
 }
 
 bool DOMWindow::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
@@ -1304,6 +1393,15 @@ void DOMWindow::dispatchLoadEvent()
 #endif
 }
 
+#if ENABLE(INSPECTOR)
+InspectorTimelineAgent* DOMWindow::inspectorTimelineAgent() 
+{
+    if (frame() && frame()->page())
+        return frame()->page()->inspectorTimelineAgent();
+    return 0;
+}
+#endif
+
 bool DOMWindow::dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget> prpTarget)
 {
     RefPtr<EventTarget> protect = this;
@@ -1313,7 +1411,24 @@ bool DOMWindow::dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget
     event->setCurrentTarget(this);
     event->setEventPhase(Event::AT_TARGET);
 
-    return fireEventListeners(event.get());
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
+    bool timelineAgentIsActive = timelineAgent && hasEventListeners(event->type());
+    if (timelineAgentIsActive)
+        timelineAgent->willDispatchEvent(*event);
+#endif
+
+    bool result = fireEventListeners(event.get());
+
+#if ENABLE(INSPECTOR)
+    if (timelineAgentIsActive) {
+      timelineAgent = inspectorTimelineAgent();
+      if (timelineAgent)
+            timelineAgent->didDispatchEvent();
+    }
+#endif
+
+    return result;
 }
 
 void DOMWindow::removeAllEventListeners()
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.h b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
index 25eadc87a4..a70713b201 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
@@ -45,6 +45,7 @@ namespace WebCore {
     class Console;
     class DOMSelection;
     class Database;
+    class DatabaseCallback;
     class Document;
     class Element;
     class Event;
@@ -52,6 +53,8 @@ namespace WebCore {
     class FloatRect;
     class Frame;
     class History;
+    class IndexedDatabaseRequest;
+    class InspectorTimelineAgent;
     class Location;
     class Media;
     class Navigator;
@@ -137,6 +140,8 @@ namespace WebCore {
         void alert(const String& message);
         bool confirm(const String& message);
         String prompt(const String& message, const String& defaultValue);
+        String btoa(const String& stringToEncode, ExceptionCode&);
+        String atob(const String& encodedString, ExceptionCode&);
 
         bool find(const String&, bool caseSensitive, bool backwards, bool wrap, bool wholeWord, bool searchInFrames, bool showDialog) const;
 
@@ -196,13 +201,13 @@ namespace WebCore {
 
 #if ENABLE(DATABASE)
         // HTML 5 client-side database
-        PassRefPtr<Database> openDatabase(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, ExceptionCode&);
+        PassRefPtr<Database> openDatabase(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode&);
 #endif
 
 #if ENABLE(DOM_STORAGE)
         // HTML 5 key/value storage
         Storage* sessionStorage() const;
-        Storage* localStorage() const;
+        Storage* localStorage(ExceptionCode&) const;
 #endif
 
         Console* console() const;
@@ -215,6 +220,10 @@ namespace WebCore {
         NotificationCenter* webkitNotifications() const;
 #endif
 
+#if ENABLE(INDEXED_DATABASE)
+        IndexedDatabaseRequest* indexedDB() const;
+#endif
+
         void postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
         void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
@@ -231,9 +240,9 @@ namespace WebCore {
         void resizeTo(float width, float height) const;
 
         // Timers
-        int setTimeout(ScheduledAction*, int timeout);
+        int setTimeout(PassOwnPtr<ScheduledAction>, int timeout, ExceptionCode&);
         void clearTimeout(int timeoutId);
-        int setInterval(ScheduledAction*, int timeout);
+        int setInterval(PassOwnPtr<ScheduledAction>, int timeout, ExceptionCode&);
         void clearInterval(int timeoutId);
 
         // Events
@@ -247,9 +256,13 @@ namespace WebCore {
         void dispatchLoadEvent();
 
         DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(beforeunload);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(blur);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplay);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplaythrough);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(change);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(click);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(dblclick);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(drag);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(dragend);
@@ -258,13 +271,22 @@ namespace WebCore {
         DEFINE_ATTRIBUTE_EVENT_LISTENER(dragover);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(dragstart);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(drop);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(durationchange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(emptied);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(ended);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(focus);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(hashchange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(keydown);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(keypress);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(keyup);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(load);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadeddata);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadedmetadata);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(mousedown);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(mousemove);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseout);
@@ -275,39 +297,30 @@ namespace WebCore {
         DEFINE_ATTRIBUTE_EVENT_LISTENER(online);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(pagehide);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(pageshow);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(pause);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(play);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(playing);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(popstate);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(ratechange);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(resize);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(scroll);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeked);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeking);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(select);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(stalled);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(storage);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(submit);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(unload);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(beforeunload);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplay);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplaythrough);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(durationchange);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(emptied);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(ended);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadeddata);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadedmetadata);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(pause);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(play);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(playing);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(ratechange);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeked);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeking);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(suspend);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(timeupdate);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(unload);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(volumechange);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(waiting);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(stalled);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(suspend);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitbeginfullscreen);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitendfullscreen);
+
 #if ENABLE(ORIENTATION_EVENTS)
         DEFINE_ATTRIBUTE_EVENT_LISTENER(orientationchange);
 #endif
@@ -317,6 +330,12 @@ namespace WebCore {
         DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkitanimationend, webkitAnimationEnd);
         DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkittransitionend, webkitTransitionEnd);
 
+#if ENABLE(TOUCH_EVENTS)
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(touchstart);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(touchmove);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(touchend);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(touchcancel);
+#endif
         void captureEvents();
         void releaseEvents();
 
@@ -334,6 +353,7 @@ namespace WebCore {
         Console* optionalConsole() const { return m_console.get(); }
         Navigator* optionalNavigator() const { return m_navigator.get(); }
         Location* optionalLocation() const { return m_location.get(); }
+        Media* optionalMedia() const { return m_media.get(); }
 #if ENABLE(DOM_STORAGE)
         Storage* optionalSessionStorage() const { return m_sessionStorage.get(); }
         Storage* optionalLocalStorage() const { return m_localStorage.get(); }
@@ -352,6 +372,7 @@ namespace WebCore {
         virtual void derefEventTarget() { deref(); }
         virtual EventTargetData* eventTargetData();
         virtual EventTargetData* ensureEventTargetData();
+        InspectorTimelineAgent* inspectorTimelineAgent();
 
         RefPtr<SecurityOrigin> m_securityOrigin;
         KURL m_url;
@@ -369,6 +390,7 @@ namespace WebCore {
         mutable RefPtr<Console> m_console;
         mutable RefPtr<Navigator> m_navigator;
         mutable RefPtr<Location> m_location;
+        mutable RefPtr<Media> m_media;
 #if ENABLE(DOM_STORAGE)
         mutable RefPtr<Storage> m_sessionStorage;
         mutable RefPtr<Storage> m_localStorage;
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
index 5addb8388f..d457bdcc1b 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
@@ -31,15 +31,15 @@ module window {
         CustomDefineSetter,
         CustomDeleteProperty,
         CustomGetOwnPropertySlot,
-        CustomGetPropertyAttributes,
         CustomGetPropertyNames,
         CustomLookupGetter,
         CustomLookupSetter,
         CustomMarkFunction,
         CustomNativeConverter,
         CustomPutFunction,
-        ExtendsDOMGlobalObject,
         EventTarget,
+        OmitConstructor,
+        ExtendsDOMGlobalObject,
         GenerateNativeConverter,
         LegacyParent=JSDOMWindowBase
     ] DOMWindow {
@@ -157,19 +157,23 @@ module window {
         WebKitPoint webkitConvertPointFromNodeToPage(in Node node, in WebKitPoint p);
 
 #if defined(ENABLE_OFFLINE_WEB_APPLICATIONS) && ENABLE_OFFLINE_WEB_APPLICATIONS
-        readonly attribute DOMApplicationCache applicationCache;
+        readonly attribute [EnabledAtRuntime] DOMApplicationCache applicationCache;
 #endif    
 #if defined(ENABLE_DATABASE) && ENABLE_DATABASE
-        [EnabledAtRuntime] Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize)
+        [EnabledAtRuntime, Custom] Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize, in DatabaseCallback creationCallback)
             raises(DOMException);
 #endif
 #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
         readonly attribute [EnabledAtRuntime] Storage sessionStorage;
-        readonly attribute [EnabledAtRuntime] Storage localStorage;
+        readonly attribute [EnabledAtRuntime] Storage localStorage
+            getter raises(DOMException);
 #endif
 #if defined(ENABLE_NOTIFICATIONS) && ENABLE_NOTIFICATIONS
         readonly attribute [EnabledAtRuntime] NotificationCenter webkitNotifications;
 #endif
+#if defined(ENABLE_INDEXED_DATABASE) && ENABLE_INDEXED_DATABASE
+        readonly attribute [EnabledAtRuntime] IndexedDatabaseRequest indexedDB;
+#endif
 
 #if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
         // This is the interface orientation in degrees. Some examples are:
@@ -201,9 +205,9 @@ module window {
         void clearInterval(in long handle);
 
         // Base64
-        [Custom] DOMString atob(in DOMString string)
+        DOMString atob(in [ConvertNullToNullString] DOMString string)
             raises(DOMException);
-        [Custom] DOMString btoa(in DOMString string)
+        DOMString btoa(in [ConvertNullToNullString] DOMString string)
             raises(DOMException);
 
         // Events
@@ -252,6 +256,7 @@ module window {
         attribute EventListener onpause;
         attribute EventListener onplay;
         attribute EventListener onplaying;
+        attribute EventListener onpopstate;
         attribute EventListener onprogress;
         attribute EventListener onratechange;
         attribute EventListener onresize;
@@ -273,7 +278,6 @@ module window {
         // attribute EventListener onbeforeprint;
         // attribute EventListener onformchange;
         // attribute EventListener onforminput;
-        // attribute EventListener onpopstate;
         // attribute EventListener onreadystatechange;
         // attribute EventListener onredo;
         // attribute EventListener onshow;
@@ -289,6 +293,12 @@ module window {
 #if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
         attribute EventListener onorientationchange;
 #endif
+ #if defined(ENABLE_TOUCH_EVENTS) && ENABLE_TOUCH_EVENTS
+        attribute [DontEnum] EventListener ontouchstart;
+        attribute [DontEnum] EventListener ontouchmove;
+        attribute [DontEnum] EventListener ontouchend;
+        attribute [DontEnum] EventListener ontouchcancel;
+ #endif
 
         // EventTarget interface
         [Custom] void addEventListener(in DOMString type,
@@ -411,6 +421,9 @@ module window {
         attribute HTMLParagraphElementConstructor HTMLParagraphElement;
         attribute HTMLParamElementConstructor HTMLParamElement;
         attribute HTMLPreElementConstructor HTMLPreElement;
+#if defined(ENABLE_PROGRESS_TAG) && ENABLE_PROGRESS_TAG
+        attribute HTMLProgressElementConstructor HTMLProgressElement;
+#endif
         attribute HTMLQuoteElementConstructor HTMLQuoteElement;
         attribute HTMLScriptElementConstructor HTMLScriptElement;
         attribute HTMLSelectElementConstructor HTMLSelectElement;
@@ -432,17 +445,18 @@ module window {
         attribute [CustomGetter] HTMLOptionElementConstructor Option; // Usable with new operator
 
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
-        attribute [Conditional=3D_CANVAS] CanvasRenderingContext3DConstructor CanvasRenderingContext3D;
+        attribute ImageDataConstructor ImageData;
+        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLRenderingContextConstructor WebGLRenderingContext;
         attribute TextMetricsConstructor TextMetrics;
 
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasArrayBufferConstructor CanvasArrayBuffer; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasByteArrayConstructor CanvasByteArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedByteArrayConstructor CanvasUnsignedByteArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasShortArrayConstructor CanvasShortArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedShortArrayConstructor CanvasUnsignedShortArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasIntArrayConstructor CanvasIntArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedIntArrayConstructor CanvasUnsignedIntArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasFloatArrayConstructor CanvasFloatArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] WebGLArrayBufferConstructor WebGLArrayBuffer; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] WebGLByteArrayConstructor WebGLByteArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] WebGLUnsignedByteArrayConstructor WebGLUnsignedByteArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] WebGLShortArrayConstructor WebGLShortArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] WebGLUnsignedShortArrayConstructor WebGLUnsignedShortArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] WebGLIntArrayConstructor WebGLIntArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] WebGLUnsignedIntArrayConstructor WebGLUnsignedIntArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] WebGLFloatArrayConstructor WebGLFloatArray; // Usable with new operator
 
         attribute EventConstructor Event;
         attribute BeforeLoadEventConstructor BeforeLoadEvent;
@@ -471,6 +485,7 @@ module window {
 
         attribute FileConstructor File;
         attribute FileListConstructor FileList;
+        attribute BlobConstructor Blob;
 
         attribute NodeFilterConstructor NodeFilter;
         attribute RangeConstructor Range;
@@ -537,35 +552,172 @@ module window {
 #endif
 
 #if defined(ENABLE_SVG) && ENABLE_SVG
+        // Expose all implemented SVG 1.1 interfaces, excluding the SVG MI interfaces:
+        // SVGAnimatedPathData, SVGAnimatedPoints, SVGExternalResourcesRequired,
+        // SVGFilterPrimitiveStandardAttributes, SVGFitToViewBox, SVGLangSpace, SVGLocatable
+        // SVGStylable, SVGTests, SVGTransformable, SVGURIReference, SVGZoomAndPan
+        attribute SVGAElementConstructor SVGAElement;
         attribute SVGAngleConstructor SVGAngle;
+        attribute SVGAnimatedAngleConstructor SVGAnimatedAngle;
+        attribute SVGAnimatedBooleanConstructor SVGAnimatedBoolean;
+        attribute SVGAnimatedEnumerationConstructor SVGAnimatedEnumeration;
+        attribute SVGAnimatedIntegerConstructor SVGAnimatedInteger;
+        attribute SVGAnimatedLengthConstructor SVGAnimatedLength;
+        attribute SVGAnimatedLengthListConstructor SVGAnimatedLengthList;
+        attribute SVGAnimatedNumberConstructor SVGAnimatedNumber;
+        attribute SVGAnimatedNumberListConstructor SVGAnimatedNumberList;
+        attribute SVGAnimatedPreserveAspectRatioConstructor SVGAnimatedPreserveAspectRatio;
+        attribute SVGAnimatedRectConstructor SVGAnimatedRect;
+        attribute SVGAnimatedStringConstructor SVGAnimatedString;
+        attribute SVGAnimatedTransformListConstructor SVGAnimatedTransformList;
+        attribute SVGCircleElementConstructor SVGCircleElement;
+        attribute SVGClipPathElementConstructor SVGClipPathElement;
         attribute SVGColorConstructor SVGColor;
+        attribute SVGCursorElementConstructor SVGCursorElement;
 //      attribute SVGCSSRuleConstructor SVGCSSRule;
+        attribute SVGDefsElementConstructor SVGDefsElement;
+        attribute SVGDescElementConstructor SVGDescElement;
+        attribute SVGDocumentConstructor SVGDocument;
+        attribute SVGElementConstructor SVGElement;
+        attribute SVGElementInstanceConstructor SVGElementInstance;
+        attribute SVGElementInstanceListConstructor SVGElementInstanceList;
+        attribute SVGEllipseElementConstructor SVGEllipseElement;
         attribute SVGExceptionConstructor SVGException;
+        attribute SVGGElementConstructor SVGGElement;
         attribute SVGGradientElementConstructor SVGGradientElement;
+        attribute SVGImageElementConstructor SVGImageElement;
         attribute SVGLengthConstructor SVGLength;
+        attribute SVGLengthListConstructor SVGLengthList;
+        attribute SVGLinearGradientElementConstructor SVGLinearGradientElement;
+        attribute SVGLineElementConstructor SVGLineElement;
         attribute SVGMarkerElementConstructor SVGMarkerElement;
+        attribute SVGMaskElementConstructor SVGMaskElement;
+        attribute SVGMatrixConstructor SVGMatrix;
+        attribute SVGMetadataElementConstructor SVGMetadataElement;
+        attribute SVGNumberConstructor SVGNumber;
+        attribute SVGNumberListConstructor SVGNumberList;
         attribute SVGPaintConstructor SVGPaint;
+        attribute SVGPathElementConstructor SVGPathElement;
         attribute SVGPathSegConstructor SVGPathSeg;
+        attribute SVGPathSegArcAbsConstructor SVGPathSegArcAbs;
+        attribute SVGPathSegArcRelConstructor SVGPathSegArcRel;
+        attribute SVGPathSegClosePathConstructor SVGPathSegClosePath;
+        attribute SVGPathSegCurvetoCubicAbsConstructor SVGPathSegCurvetoCubicAbs;
+        attribute SVGPathSegCurvetoCubicRelConstructor SVGPathSegCurvetoCubicRel;
+        attribute SVGPathSegCurvetoCubicSmoothAbsConstructor SVGPathSegCurvetoCubicSmoothAbs;
+        attribute SVGPathSegCurvetoCubicSmoothRelConstructor SVGPathSegCurvetoCubicSmoothRel;
+        attribute SVGPathSegCurvetoQuadraticAbsConstructor SVGPathSegCurvetoQuadraticAbs;
+        attribute SVGPathSegCurvetoQuadraticRelConstructor SVGPathSegCurvetoQuadraticRel;
+        attribute SVGPathSegCurvetoQuadraticSmoothAbsConstructor SVGPathSegCurvetoQuadraticSmoothAbs;
+        attribute SVGPathSegCurvetoQuadraticSmoothRelConstructor SVGPathSegCurvetoQuadraticSmoothRel;
+        attribute SVGPathSegLinetoAbsConstructor SVGPathSegLinetoAbs;
+        attribute SVGPathSegLinetoHorizontalAbsConstructor SVGPathSegLinetoHorizontalAbs;
+        attribute SVGPathSegLinetoHorizontalRelConstructor SVGPathSegLinetoHorizontalRel;
+        attribute SVGPathSegLinetoRelConstructor SVGPathSegLinetoRel;
+        attribute SVGPathSegLinetoVerticalAbsConstructor SVGPathSegLinetoVerticalAbs;
+        attribute SVGPathSegLinetoVerticalRelConstructor SVGPathSegLinetoVerticalRel;
+        attribute SVGPathSegListConstructor SVGPathSegList;
+        attribute SVGPathSegMovetoAbsConstructor SVGPathSegMovetoAbs;
+        attribute SVGPathSegMovetoRelConstructor SVGPathSegMovetoRel;
+        attribute SVGPatternElementConstructor SVGPatternElement;
+        attribute SVGPointConstructor SVGPoint;
+        attribute SVGPointListConstructor SVGPointList;
+        attribute SVGPolygonElementConstructor SVGPolygonElement;
+        attribute SVGPolylineElementConstructor SVGPolylineElement;
         attribute SVGPreserveAspectRatioConstructor SVGPreserveAspectRatio;
+        attribute SVGRadialGradientElementConstructor SVGRadialGradientElement;
+        attribute SVGRectConstructor SVGRect;
+        attribute SVGRectElementConstructor SVGRectElement;
         attribute SVGRenderingIntentConstructor SVGRenderingIntent;
+        attribute SVGScriptElementConstructor SVGScriptElement;
+        attribute SVGStopElementConstructor SVGStopElement;
+        attribute SVGStringListConstructor SVGStringList;
+        attribute SVGStyleElementConstructor SVGStyleElement;
+        attribute SVGSVGElementConstructor SVGSVGElement;
+        attribute SVGSwitchElementConstructor SVGSwitchElement;
+        attribute SVGSymbolElementConstructor SVGSymbolElement;
         attribute SVGTextContentElementConstructor SVGTextContentElement;
+        attribute SVGTextElementConstructor SVGTextElement;
         attribute SVGTextPathElementConstructor SVGTextPathElement;
+        attribute SVGTextPositioningElementConstructor SVGTextPositioningElement;
+        attribute SVGTitleElementConstructor SVGTitleElement;
         attribute SVGTransformConstructor SVGTransform;
+        attribute SVGTransformListConstructor SVGTransformList;
+        attribute SVGTRefElementConstructor SVGTRefElement;
+        attribute SVGTSpanElementConstructor SVGTSpanElement;
         attribute SVGUnitTypesConstructor SVGUnitTypes;
-//      attribute SVGZoomAndPanConstructor SVGZoomAndPan;
+        attribute SVGUseElementConstructor SVGUseElement;
+        attribute SVGViewElementConstructor SVGViewElement;
+//      attribute SVGViewSpecConstructor SVGViewSpec;
+        attribute SVGZoomEventConstructor SVGZoomEvent;
+
+#if defined(ENABLE_SVG_ANIMATION) && ENABLE_SVG_ANIMATION
+        attribute SVGAnimateColorElementConstructor SVGAnimateColorElement;
+        attribute SVGAnimateElementConstructor SVGAnimateElement;
+//      attribute SVGAnimateMotionElementConstructor SVGAnimateMotionElement;
+        attribute SVGAnimateTransformElementConstructor SVGAnimateTransformElement;
+//      attribute SVGMPathElementConstructor SVGMPathElement;
+        attribute SVGSetElementConstructor SVGSetElement;
+#endif
+
+#if ENABLE_SVG_FONTS && ENABLE_SVG_FONTS
+//      attribute SVGAltGlyphDefElementConstructor SVGAltGlyphDefElement;
+        attribute SVGAltGlyphElementConstructor SVGAltGlyphElement;
+//      attribute SVGAltGlyphItemElementConstructor SVGAltGlyphItemElement;
+//      attribute SVGDefinitionSrcElementConstructor SVGDefinitionSrcElement;
+        attribute SVGFontElementConstructor SVGFontElement;
+        attribute SVGFontFaceElementConstructor SVGFontFaceElement;
+        attribute SVGFontFaceFormatElementConstructor SVGFontFaceFormatElement;
+        attribute SVGFontFaceNameElementConstructor SVGFontFaceNameElement;
+        attribute SVGFontFaceSrcElementConstructor SVGFontFaceSrcElement;
+        attribute SVGFontFaceUriElementConstructor SVGFontFaceUriElement;
+        attribute SVGGlyphElementConstructor SVGGlyphElement;
+//      attribute SVGGlyphRefElementConstructor SVGGlyphRefElement;
+//      attribute SVGHKernElementConstructor SVGHKernElement;
+        attribute SVGMissingGlyphElementConstructor SVGMissingGlyphElement;
+//      attribute SVGVKernElementConstructor SVGVKernElement;
+#endif
+
+#if defined(ENABLE_SVG_FOREIGN_OBJECT) && ENABLE_SVG_FOREIGN_OBJECT
+        attribute SVGForeignObjectElementConstructor SVGForeignObjectElement;
+#endif
 
 #if defined(ENABLE_FILTERS) && ENABLE_FILTERS
         attribute SVGComponentTransferFunctionElementConstructor SVGComponentTransferFunctionElement;
         attribute SVGFEBlendElementConstructor SVGFEBlendElement;
         attribute SVGFEColorMatrixElementConstructor SVGFEColorMatrixElement;
+        attribute SVGFEComponentTransferElementConstructor SVGFEComponentTransferElement;
         attribute SVGFECompositeElementConstructor SVGFECompositeElement;
 //      attribute SVGFEConvolveMatrixElementConstructor SVGFEConvolveMatrixElement;
+        attribute SVGFEDiffuseLightingElementConstructor SVGFEDiffuseLightingElement;
         attribute SVGFEDisplacementMapElementConstructor SVGFEDisplacementMapElement;
+        attribute SVGFEDistantLightElementConstructor SVGFEDistantLightElement;
+        attribute SVGFEFloodElementConstructor SVGFEFloodElement;
+        attribute SVGFEFuncAElementConstructor SVGFEFuncAElement;
+        attribute SVGFEFuncBElementConstructor SVGFEFuncBElement;
+        attribute SVGFEFuncGElementConstructor SVGFEFuncGElement;
+        attribute SVGFEFuncRElementConstructor SVGFEFuncRElement;
+        attribute SVGFEGaussianBlurElementConstructor SVGFEGaussianBlurElement;
+        attribute SVGFEImageElementConstructor SVGFEImageElement;
+        attribute SVGFEMergeElementConstructor SVGFEMergeElement;
+        attribute SVGFEMergeNodeElementConstructor SVGFEMergeNodeElement;
         attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
+        attribute SVGFEOffsetElementConstructor SVGFEOffsetElement;
+        attribute SVGFEPointLightElementConstructor SVGFEPointLightElement;
+        attribute SVGFESpecularLightingElementConstructor SVGFESpecularLightingElement;
+        attribute SVGFESpotLightElementConstructor SVGFESpotLightElement;
+        attribute SVGFETileElementConstructor SVGFETileElement;
         attribute SVGFETurbulenceElementConstructor SVGFETurbulenceElement;
+        attribute SVGFilterElementConstructor SVGFilterElement;
+#endif
 #endif
+
+#if defined(ENABLE_TOUCH_EVENTS) && ENABLE_TOUCH_EVENTS
+        attribute TouchEventConstructor TouchEvent;
 #endif
 
+        attribute DOMFormDataConstructor FormData;
+
 #endif // defined(LANGUAGE_JAVASCRIPT)
 
 #if defined(V8_BINDING) && V8_BINDING
@@ -575,3 +727,4 @@ module window {
     };
 
 }
+
diff --git a/src/3rdparty/webkit/WebCore/page/DragController.cpp b/src/3rdparty/webkit/WebCore/page/DragController.cpp
index 634595add7..f238b2774b 100644
--- a/src/3rdparty/webkit/WebCore/page/DragController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DragController.cpp
@@ -53,6 +53,7 @@
 #include "MoveSelectionCommand.h"
 #include "Node.h"
 #include "Page.h"
+#include "PlatformKeyboardEvent.h"
 #include "RenderFileUploadControl.h"
 #include "RenderImage.h"
 #include "RenderView.h"
@@ -70,10 +71,12 @@ namespace WebCore {
 
 static PlatformMouseEvent createMouseEvent(DragData* dragData)
 {
-    // FIXME: We should fake modifier keys here.
+    bool shiftKey, ctrlKey, altKey, metaKey;
+    shiftKey = ctrlKey = altKey = metaKey = false;
+    PlatformKeyboardEvent::getCurrentModifierState(shiftKey, ctrlKey, altKey, metaKey);
     return PlatformMouseEvent(dragData->clientPosition(), dragData->globalPosition(),
-                              LeftButton, MouseEventMoved, 0, false, false, false, false, currentTime());
-
+                              LeftButton, MouseEventMoved, 0, shiftKey, ctrlKey, altKey,
+                              metaKey, currentTime());
 }
 
 DragController::DragController(Page* page, DragClient* client)
@@ -429,10 +432,11 @@ bool DragController::concludeEditDrag(DragData* dragData)
 
         m_client->willPerformDragDestinationAction(DragDestinationActionEdit, dragData);
         if (dragIsMove(innerFrame->selection())) {
-            bool smartMove = innerFrame->selectionGranularity() == WordGranularity
-                          && innerFrame->editor()->smartInsertDeleteEnabled()
-                          && dragData->canSmartReplace();
-            applyCommand(MoveSelectionCommand::create(fragment, dragCaret.base(), smartMove));
+            // NSTextView behavior is to always smart delete on moving a selection,
+            // but only to smart insert if the selection granularity is word granularity.
+            bool smartDelete = innerFrame->editor()->smartInsertDeleteEnabled();
+            bool smartInsert = smartDelete && innerFrame->selectionGranularity() == WordGranularity && dragData->canSmartReplace();
+            applyCommand(MoveSelectionCommand::create(fragment, dragCaret.base(), smartInsert, smartDelete));
         } else {
             if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
                 applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, fragment, true, dragData->canSmartReplace(), chosePlainText));
@@ -486,13 +490,17 @@ static DragOperation defaultOperationForDrag(DragOperation srcOpMask)
 {
     // This is designed to match IE's operation fallback for the case where
     // the page calls preventDefault() in a drag event but doesn't set dropEffect.
-    if (srcOpMask & DragOperationCopy)
-         return DragOperationCopy;
+    if (srcOpMask == DragOperationEvery)
+        return DragOperationCopy;
+    if (srcOpMask == DragOperationNone)
+        return DragOperationNone;
     if (srcOpMask & DragOperationMove || srcOpMask & DragOperationGeneric)
         return DragOperationMove;
+    if (srcOpMask & DragOperationCopy)
+        return DragOperationCopy;
     if (srcOpMask & DragOperationLink)
         return DragOperationLink;
-
+    
     // FIXME: Does IE really return "generic" even if no operations were allowed by the source?
     return DragOperationGeneric;
 }
@@ -517,10 +525,10 @@ bool DragController::tryDHTMLDrag(DragData* dragData, DragOperation& operation)
         return false;
     }
 
-    if (!clipboard->destinationOperation(operation)) {
-        // The element accepted but they didn't pick an operation, so we pick one (to match IE).
+    operation = clipboard->destinationOperation();
+    if (clipboard->dropEffectIsUninitialized())
         operation = defaultOperationForDrag(srcOpMask);
-    } else if (!(srcOpMask & operation)) {
+    else if (!(srcOpMask & operation)) {
         // The element picked an operation which is not supported by the source
         operation = DragOperationNone;
     }
@@ -529,7 +537,7 @@ bool DragController::tryDHTMLDrag(DragData* dragData, DragOperation& operation)
     return true;
 }
 
-bool DragController::mayStartDragAtEventLocation(const Frame* frame, const IntPoint& framePos)
+bool DragController::mayStartDragAtEventLocation(const Frame* frame, const IntPoint& framePos, Node* node)
 {
     ASSERT(frame);
     ASSERT(frame->settings());
@@ -540,6 +548,8 @@ bool DragController::mayStartDragAtEventLocation(const Frame* frame, const IntPo
     HitTestResult mouseDownTarget = HitTestResult(framePos);
 
     mouseDownTarget = frame->eventHandler()->hitTestResultAtPoint(framePos, true);
+    if (node)
+        mouseDownTarget.setInnerNonSharedNode(node);
 
     if (mouseDownTarget.image()
         && !mouseDownTarget.absoluteImageURL().isEmpty()
@@ -549,7 +559,8 @@ bool DragController::mayStartDragAtEventLocation(const Frame* frame, const IntPo
 
     if (!mouseDownTarget.absoluteLinkURL().isEmpty()
         && m_dragSourceAction & DragSourceActionLink
-        && mouseDownTarget.isLiveLink())
+        && mouseDownTarget.isLiveLink()
+        && mouseDownTarget.URLElement()->renderer() && mouseDownTarget.URLElement()->renderer()->style()->userDrag() != DRAG_NONE)
         return true;
 
     if (mouseDownTarget.isSelected()
@@ -557,7 +568,6 @@ bool DragController::mayStartDragAtEventLocation(const Frame* frame, const IntPo
         return true;
 
     return false;
-
 }
 
 static CachedImage* getCachedImage(Element* element)
@@ -573,14 +583,9 @@ static CachedImage* getCachedImage(Element* element)
 static Image* getImage(Element* element)
 {
     ASSERT(element);
-    RenderObject* renderer = element->renderer();
-    if (!renderer || !renderer->isImage())
-        return 0;
-
-    RenderImage* image = toRenderImage(renderer);
-    if (image->cachedImage() && !image->cachedImage()->errorOccurred())
-        return image->cachedImage()->image();
-    return 0;
+    CachedImage* cachedImage = getCachedImage(element);
+    return (cachedImage && !cachedImage->errorOccurred()) ?
+        cachedImage->image() : 0;
 }
 
 static void prepareClipboardForImageDrag(Frame* src, Clipboard* clipboard, Element* node, const KURL& linkURL, const KURL& imageURL, const String& label)
@@ -714,10 +719,16 @@ bool DragController::startDrag(Frame* src, Clipboard* clipboard, DragOperation s
         }
         doSystemDrag(dragImage, dragLoc, mouseDraggedPoint, clipboard, src, true);
     } else if (isSelected && (m_dragSourceAction & DragSourceActionSelection)) {
-        RefPtr<Range> selectionRange = src->selection()->toNormalizedRange();
-        ASSERT(selectionRange);
-        if (!clipboard->hasData())
-            clipboard->writeRange(selectionRange.get(), src);
+        if (!clipboard->hasData()) {
+            if (isNodeInTextFormControl(src->selection()->start().node()))
+                clipboard->writePlainText(src->selectedText());
+            else {
+                RefPtr<Range> selectionRange = src->selection()->toNormalizedRange();
+                ASSERT(selectionRange);
+
+                clipboard->writeRange(selectionRange.get(), src);
+            }
+        }
         m_client->willPerformDragSourceAction(DragSourceActionSelection, dragOrigin, clipboard);
         if (!dragImage) {
             dragImage = createDragImageForSelection(src);
diff --git a/src/3rdparty/webkit/WebCore/page/DragController.h b/src/3rdparty/webkit/WebCore/page/DragController.h
index 9472589cb4..3b2b0839db 100644
--- a/src/3rdparty/webkit/WebCore/page/DragController.h
+++ b/src/3rdparty/webkit/WebCore/page/DragController.h
@@ -47,7 +47,7 @@ namespace WebCore {
     class Range;
     class SelectionController;
     
-    class DragController {
+    class DragController : public Noncopyable {
     public:
         DragController(Page*, DragClient*);
         ~DragController();
@@ -77,7 +77,7 @@ namespace WebCore {
         DragDestinationAction dragDestinationAction() const { return m_dragDestinationAction; }
         DragSourceAction delegateDragSourceAction(const IntPoint& pagePoint);
         
-        bool mayStartDragAtEventLocation(const Frame*, const IntPoint& framePos);
+        bool mayStartDragAtEventLocation(const Frame*, const IntPoint& framePos, Node*);
         void dragEnded();
         
         void placeDragCaret(const IntPoint&);
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
index 4e97aba886..0a0e8c6458 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -29,6 +29,7 @@
 
 #include "AXObjectCache.h"
 #include "CachedImage.h"
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "Cursor.h"
 #include "Document.h"
@@ -56,6 +57,7 @@
 #include "Page.h"
 #include "PlatformKeyboardEvent.h"
 #include "PlatformWheelEvent.h"
+#include "PluginDocument.h"
 #include "RenderFrameSet.h"
 #include "RenderTextControlSingleLine.h"
 #include "RenderView.h"
@@ -64,7 +66,9 @@
 #include "SelectionController.h"
 #include "Settings.h"
 #include "TextEvent.h"
+#include "WheelEvent.h"
 #include "htmlediting.h" // for comparePositions()
+#include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(SVG)
@@ -74,6 +78,11 @@
 #include "SVGUseElement.h"
 #endif
 
+#if ENABLE(TOUCH_EVENTS)
+#include "PlatformTouchEvent.h"
+#include "TouchEvent.h"
+#endif
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -99,28 +108,36 @@ using namespace SVGNames;
 // When the autoscroll or the panScroll is triggered when do the scroll every 0.05s to make it smooth
 const double autoscrollInterval = 0.05;
 
+const double fakeMouseMoveInterval = 0.1;
+
 static Frame* subframeForHitTestResult(const MouseEventWithHitTestResults&);
 
-static inline void scrollAndAcceptEvent(float delta, ScrollDirection positiveDirection, ScrollDirection negativeDirection, PlatformWheelEvent& e, Node* node, Node** stopNode)
+static inline bool scrollNode(float delta, WheelEvent::Granularity granularity, ScrollDirection positiveDirection, ScrollDirection negativeDirection, Node* node, Node** stopNode)
 {
     if (!delta)
-        return;
-        
+        return false;
+    
+    if (!node->renderer())
+        return false;
+    
     // Find the nearest enclosing box.
     RenderBox* enclosingBox = node->renderer()->enclosingBox();
 
-    if (e.granularity() == ScrollByPageWheelEvent) {
-        if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPage, 1, stopNode))
-            e.accept();
-        return;
-    }
+    float absDelta = delta > 0 ? delta : -delta;
+    
+    if (granularity == WheelEvent::Page)
+        return enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPage, absDelta, stopNode);
+
+    if (granularity == WheelEvent::Line)
+        return enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByLine, absDelta, stopNode);
 
-    float pixelsToScroll = delta > 0 ? delta : -delta;
-    if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPixel, pixelsToScroll, stopNode))
-        e.accept();
+    if (granularity == WheelEvent::Pixel)
+        return enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPixel, absDelta, stopNode);
+        
+    return false;
 }
 
-#if !PLATFORM(MAC)
+#if !PLATFORM(MAC) || ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
 
 inline bool EventHandler::eventLoopHandleMouseUp(const MouseEventWithHitTestResults&)
 {
@@ -155,6 +172,7 @@ EventHandler::EventHandler(Frame* frame)
     , m_autoscrollInProgress(false)
     , m_mouseDownMayStartAutoscroll(false)
     , m_mouseDownWasInSubframe(false)
+    , m_fakeMouseMoveEventTimer(this, &EventHandler::fakeMouseMoveEventTimerFired)
 #if ENABLE(SVG)
     , m_svgPan(false)
 #endif
@@ -164,7 +182,7 @@ EventHandler::EventHandler(Frame* frame)
     , m_mouseDownTimestamp(0)
     , m_useLatchedWheelEventNode(false)
     , m_widgetIsLatched(false)
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
     , m_mouseDownView(nil)
     , m_sendingEventToSubview(false)
     , m_activationEventNumber(0)
@@ -174,6 +192,7 @@ EventHandler::EventHandler(Frame* frame)
 
 EventHandler::~EventHandler()
 {
+    ASSERT(!m_fakeMouseMoveEventTimer.isActive());
 }
     
 #if ENABLE(DRAG_SUPPORT)
@@ -187,6 +206,7 @@ EventHandler::EventHandlerDragState& EventHandler::dragState()
 void EventHandler::clear()
 {
     m_hoverTimer.stop();
+    m_fakeMouseMoveEventTimer.stop();
     m_resizeLayer = 0;
     m_nodeUnderMouse = 0;
     m_lastNodeUnderMouse = 0;
@@ -201,6 +221,7 @@ void EventHandler::clear()
     m_frameSetBeingResized = 0;
 #if ENABLE(DRAG_SUPPORT)
     m_dragTarget = 0;
+    m_shouldOnlyFireDragOverEvent = false;
 #endif
     m_currentMousePosition = IntPoint();
     m_mousePressNode = 0;
@@ -218,20 +239,21 @@ void EventHandler::selectClosestWordFromMouseEvent(const MouseEventWithHitTestRe
 
     if (innerNode && innerNode->renderer() && m_mouseDownMayStartSelect) {
         VisiblePosition pos(innerNode->renderer()->positionForPoint(result.localPoint()));
+        TextGranularity granularity = CharacterGranularity;
         if (pos.isNotNull()) {
             newSelection = VisibleSelection(pos);
             newSelection.expandUsingGranularity(WordGranularity);
         }
     
         if (newSelection.isRange()) {
-            m_frame->setSelectionGranularity(WordGranularity);
+            granularity = WordGranularity;
             m_beganSelectingText = true;
             if (result.event().clickCount() == 2 && m_frame->editor()->isSelectTrailingWhitespaceEnabled()) 
                 newSelection.appendTrailingWhitespace();            
         }
         
         if (m_frame->shouldChangeSelection(newSelection))
-            m_frame->selection()->setSelection(newSelection);
+            m_frame->selection()->setSelection(newSelection, granularity);
     }
 }
 
@@ -249,13 +271,14 @@ void EventHandler::selectClosestWordOrLinkFromMouseEvent(const MouseEventWithHit
         if (pos.isNotNull() && pos.deepEquivalent().node()->isDescendantOf(URLElement))
             newSelection = VisibleSelection::selectionFromContentsOfNode(URLElement);
     
+        TextGranularity granularity = CharacterGranularity;
         if (newSelection.isRange()) {
-            m_frame->setSelectionGranularity(WordGranularity);
+            granularity = WordGranularity;
             m_beganSelectingText = true;
         }
 
         if (m_frame->shouldChangeSelection(newSelection))
-            m_frame->selection()->setSelection(newSelection);
+            m_frame->selection()->setSelection(newSelection, granularity);
     }
 }
 
@@ -292,13 +315,15 @@ bool EventHandler::handleMousePressEventTripleClick(const MouseEventWithHitTestR
         newSelection = VisibleSelection(pos);
         newSelection.expandUsingGranularity(ParagraphGranularity);
     }
+    
+    TextGranularity granularity = CharacterGranularity;
     if (newSelection.isRange()) {
-        m_frame->setSelectionGranularity(ParagraphGranularity);
+        granularity = ParagraphGranularity;
         m_beganSelectingText = true;
     }
     
     if (m_frame->shouldChangeSelection(newSelection))
-        m_frame->selection()->setSelection(newSelection);
+        m_frame->selection()->setSelection(newSelection, granularity);
 
     return true;
 }
@@ -328,6 +353,8 @@ bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestR
     Position pos = visiblePos.deepEquivalent();
     
     VisibleSelection newSelection = m_frame->selection()->selection();
+    TextGranularity granularity = CharacterGranularity;
+
     if (extendSelection && newSelection.isCaretOrRange()) {
         m_frame->selection()->setLastChangeWasHorizontalExtension(false);
         
@@ -340,16 +367,17 @@ bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestR
         else
             newSelection = VisibleSelection(start, pos);
 
-        if (m_frame->selectionGranularity() != CharacterGranularity)
+        if (m_frame->selectionGranularity() != CharacterGranularity) {
+            granularity = m_frame->selectionGranularity();
             newSelection.expandUsingGranularity(m_frame->selectionGranularity());
+        }
+
         m_beganSelectingText = true;
-    } else {
+    } else
         newSelection = VisibleSelection(visiblePos);
-        m_frame->setSelectionGranularity(CharacterGranularity);
-    }
     
     if (m_frame->shouldChangeSelection(newSelection))
-        m_frame->selection()->setSelection(newSelection);
+        m_frame->selection()->setSelection(newSelection, granularity);
 
     return true;
 }
@@ -361,6 +389,8 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
     dragState().m_dragSrc = 0;
 #endif
 
+    cancelFakeMouseMoveEvent();
+
     if (ScrollView* scrollView = m_frame->view()) {
         if (scrollView->isPointInScrollbarCorner(event.event().pos()))
             return false;
@@ -562,7 +592,7 @@ void EventHandler::updateSelectionForMouseDrag(Node* targetNode, const IntPoint&
 
     if (m_frame->shouldChangeSelection(newSelection)) {
         m_frame->selection()->setLastChangeWasHorizontalExtension(false);
-        m_frame->selection()->setSelection(newSelection);
+        m_frame->selection()->setSelection(newSelection, m_frame->selectionGranularity());
     }
 }
 #endif // ENABLE(DRAG_SUPPORT)
@@ -688,6 +718,14 @@ void EventHandler::autoscrollTimerFired(Timer<EventHandler>*)
 
 #if ENABLE(PAN_SCROLLING)
 
+void EventHandler::startPanScrolling(RenderObject* renderer)
+{
+    m_panScrollInProgress = true;
+    m_panScrollButtonPressed = true;
+    handleAutoscroll(renderer);
+    invalidateClick();
+}
+
 void EventHandler::updatePanScrollState()
 {
     FrameView* view = m_frame->view();
@@ -1128,6 +1166,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 {
     RefPtr<FrameView> protector(m_frame->view());
 
+    cancelFakeMouseMoveEvent();
     m_mousePressed = true;
     m_capturesDragging = true;
     m_currentMousePosition = mouseEvent.pos();
@@ -1187,25 +1226,6 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
         invalidateClick();
         return true;
     }
-
-    if (mouseEvent.button() == MiddleButton && !mev.isOverLink()) {
-        RenderObject* renderer = mev.targetNode()->renderer();
-
-        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeScrolledAndHasScrollableArea())) {
-            if (!renderer->parent() && renderer->node() == renderer->document() && renderer->document()->ownerElement())
-                renderer = renderer->document()->ownerElement()->renderer();
-            else
-                renderer = renderer->parent();
-        }
-
-        if (renderer) {
-            m_panScrollInProgress = true;
-            m_panScrollButtonPressed = true;
-            handleAutoscroll(renderer);
-            invalidateClick();
-            return true;
-        }
-    }
 #endif
 
     m_clickCount = mouseEvent.clickCount();
@@ -1338,6 +1358,8 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
     if (m_hoverTimer.isActive())
         m_hoverTimer.stop();
 
+    cancelFakeMouseMoveEvent();
+
 #if ENABLE(SVG)
     if (m_svgPan) {
         static_cast<SVGDocument*>(m_frame->document())->updatePan(m_currentMousePosition);
@@ -1400,8 +1422,18 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
             scrollbar->mouseMoved(mouseEvent); // Handle hover effects on platforms that support visual feedback on scrollbar hovering.
         if (Page* page = m_frame->page()) {
             if ((!m_resizeLayer || !m_resizeLayer->inResizeMode()) && !page->mainFrame()->eventHandler()->panScrollInProgress()) {
-                if (FrameView* view = m_frame->view())
-                    view->setCursor(selectCursor(mev, scrollbar));
+                // Plugins set cursor on their own. The only case WebKit intervenes is resetting cursor to arrow on mouse enter,
+                // in case the particular plugin doesn't manipulate cursor at all. Thus,  even a CSS cursor set on body has no
+                // effect on plugins (which matches Firefox).
+                bool overPluginElement = false;
+                if (mev.targetNode() && mev.targetNode()->isHTMLElement()) {
+                    HTMLElement* el = static_cast<HTMLElement*>(mev.targetNode());
+                    overPluginElement = el->hasTagName(appletTag) || el->hasTagName(objectTag) || el->hasTagName(embedTag);
+                }
+                if (!overPluginElement) {
+                    if (FrameView* view = m_frame->view())
+                        view->setCursor(selectCursor(mev, scrollbar));
+                }
             }
         }
     }
@@ -1508,6 +1540,35 @@ bool EventHandler::dispatchDragEvent(const AtomicString& eventType, Node* dragTa
     return me->defaultPrevented();
 }
 
+bool EventHandler::canHandleDragAndDropForTarget(DragAndDropHandleType type, Node* target, const PlatformMouseEvent& event, Clipboard* clipboard, bool* accepted)
+{
+    bool canHandle = false;
+    bool wasAccepted = false;
+
+    if (target->hasTagName(frameTag) || target->hasTagName(iframeTag)) {
+        Frame* frame = static_cast<HTMLFrameElementBase*>(target)->contentFrame();
+        if (frame) {
+            switch (type) {
+                case UpdateDragAndDrop:
+                    wasAccepted = frame->eventHandler()->updateDragAndDrop(event, clipboard);
+                    break;
+                case CancelDragAndDrop:
+                    frame->eventHandler()->cancelDragAndDrop(event, clipboard);
+                    break;
+                case PerformDragAndDrop:
+                    wasAccepted = frame->eventHandler()->performDragAndDrop(event, clipboard);
+                    break;
+            }
+        }
+    } else
+        canHandle = true;
+
+    if (accepted)
+        *accepted = wasAccepted;
+
+    return canHandle;
+}
+
 bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard* clipboard)
 {
     bool accept = false;
@@ -1529,28 +1590,34 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
         // FIXME: this ordering was explicitly chosen to match WinIE. However,
         // it is sometimes incorrect when dragging within subframes, as seen with
         // LayoutTests/fast/events/drag-in-frames.html.
-        if (newTarget) {
-            Frame* frame = (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame() : 0;
-            if (frame)
-                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
-            else
-                accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget, event, clipboard);
+        //
+        // Moreover, this ordering conforms to section 7.9.4 of the HTML 5 spec. <http://dev.w3.org/html5/spec/Overview.html#drag-and-drop-processing-model>.
+        if (newTarget && canHandleDragAndDropForTarget(UpdateDragAndDrop, newTarget, event, clipboard, &accept)) {
+            // As per section 7.9.4 of the HTML 5 spec., we must always fire a drag event before firing a dragenter, dragleave, or dragover event.
+            if (dragState().m_dragSrc && dragState().m_dragSrcMayBeDHTML) {
+                // for now we don't care if event handler cancels default behavior, since there is none
+                dispatchDragSrcEvent(eventNames().dragEvent, event);
+            }
+            accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget, event, clipboard);
         }
 
-        if (m_dragTarget) {
-            Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
-            if (frame)
-                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
-            else
-                dispatchDragEvent(eventNames().dragleaveEvent, m_dragTarget.get(), event, clipboard);
+        if (m_dragTarget && canHandleDragAndDropForTarget(UpdateDragAndDrop, m_dragTarget.get(), event, clipboard, &accept))
+            dispatchDragEvent(eventNames().dragleaveEvent, m_dragTarget.get(), event, clipboard);
+        
+        if (newTarget) {
+            // We do not explicitly call dispatchDragEvent here because it could ultimately result in the appearance that
+            // two dragover events fired. So, we mark that we should only fire a dragover event on the next call to this function.
+            m_shouldOnlyFireDragOverEvent = true;
         }
     } else {
-        if (newTarget) {
-            Frame* frame = (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame() : 0;
-            if (frame)
-                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
-            else
-                accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget, event, clipboard);
+        if (newTarget && canHandleDragAndDropForTarget(UpdateDragAndDrop, newTarget, event, clipboard, &accept)) {
+            // Note, when dealing with sub-frames, we may need to fire only a dragover event as a drag event may have been fired earlier.
+            if (!m_shouldOnlyFireDragOverEvent && dragState().m_dragSrc && dragState().m_dragSrcMayBeDHTML) {
+                // for now we don't care if event handler cancels default behavior, since there is none
+                dispatchDragSrcEvent(eventNames().dragEvent, event);
+            }
+            accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget, event, clipboard);
+            m_shouldOnlyFireDragOverEvent = false;
         }
     }
     m_dragTarget = newTarget;
@@ -1560,13 +1627,10 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
 
 void EventHandler::cancelDragAndDrop(const PlatformMouseEvent& event, Clipboard* clipboard)
 {
-    if (m_dragTarget) {
-        Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) 
-                        ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
-        if (frame)
-            frame->eventHandler()->cancelDragAndDrop(event, clipboard);
-        else
-            dispatchDragEvent(eventNames().dragleaveEvent, m_dragTarget.get(), event, clipboard);
+    if (m_dragTarget && canHandleDragAndDropForTarget(CancelDragAndDrop, m_dragTarget.get(), event, clipboard)) {
+        if (dragState().m_dragSrc && dragState().m_dragSrcMayBeDHTML)
+            dispatchDragSrcEvent(eventNames().dragEvent, event);
+        dispatchDragEvent(eventNames().dragleaveEvent, m_dragTarget.get(), event, clipboard);
     }
     clearDragState();
 }
@@ -1574,14 +1638,8 @@ void EventHandler::cancelDragAndDrop(const PlatformMouseEvent& event, Clipboard*
 bool EventHandler::performDragAndDrop(const PlatformMouseEvent& event, Clipboard* clipboard)
 {
     bool accept = false;
-    if (m_dragTarget) {
-        Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) 
-                        ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
-        if (frame)
-            accept = frame->eventHandler()->performDragAndDrop(event, clipboard);
-        else
-            accept = dispatchDragEvent(eventNames().dropEvent, m_dragTarget.get(), event, clipboard);
-    }
+    if (m_dragTarget && canHandleDragAndDropForTarget(PerformDragAndDrop, m_dragTarget.get(), event, clipboard, &accept))
+        dispatchDragEvent(eventNames().dropEvent, m_dragTarget.get(), event, clipboard);
     clearDragState();
     return accept;
 }
@@ -1590,7 +1648,8 @@ void EventHandler::clearDragState()
 {
     m_dragTarget = 0;
     m_capturingMouseEventsNode = 0;
-#if PLATFORM(MAC)
+    m_shouldOnlyFireDragOverEvent = false;
+#if PLATFORM(MAC) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
     m_sendingEventToSubview = false;
 #endif
 }
@@ -1763,7 +1822,7 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
     return swallowEvent;
 }
 
-#if !PLATFORM(GTK)
+#if !PLATFORM(GTK) && !(PLATFORM(CHROMIUM) && OS(LINUX))
 bool EventHandler::shouldTurnVerticalTicksIntoHorizontal(const HitTestResult&) const
 {
     return false;
@@ -1832,21 +1891,6 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
         node->dispatchWheelEvent(e);
         if (e.isAccepted())
             return true;
-
-        // If we don't have a renderer, send the wheel event to the first node we find with a renderer.
-        // This is needed for <option> and <optgroup> elements so that <select>s get a wheel scroll.
-        while (node && !node->renderer())
-            node = node->parent();
-
-        if (node && node->renderer()) {
-            // Just break up into two scrolls if we need to.  Diagonal movement on 
-            // a MacBook pro is an example of a 2-dimensional mouse wheel event (where both deltaX and deltaY can be set).
-            Node* stopNode = m_previousWheelScrolledNode.get();
-            scrollAndAcceptEvent(e.deltaX(), ScrollLeft, ScrollRight, e, node, &stopNode);
-            scrollAndAcceptEvent(e.deltaY(), ScrollUp, ScrollDown, e, node, &stopNode);
-            if (!m_useLatchedWheelEventNode)
-                m_previousWheelScrolledNode = stopNode;
-        }
     }
 
     if (e.isAccepted())
@@ -1859,6 +1903,25 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
     view->wheelEvent(e);
     return e.isAccepted();
 }
+    
+void EventHandler::defaultWheelEventHandler(Node* startNode, WheelEvent* wheelEvent)
+{
+    if (!startNode || !wheelEvent)
+        return;
+    
+    Node* stopNode = m_previousWheelScrolledNode.get();
+    
+    // Break up into two scrolls if we need to.  Diagonal movement on 
+    // a MacBook pro is an example of a 2-dimensional mouse wheel event (where both deltaX and deltaY can be set).
+    if (scrollNode(wheelEvent->rawDeltaX(), wheelEvent->granularity(), ScrollLeft, ScrollRight, startNode, &stopNode))
+        wheelEvent->setDefaultHandled();
+    
+    if (scrollNode(wheelEvent->rawDeltaY(), wheelEvent->granularity(), ScrollUp, ScrollDown, startNode, &stopNode))
+        wheelEvent->setDefaultHandled();
+    
+    if (!m_useLatchedWheelEventNode)
+        m_previousWheelScrolledNode = stopNode;
+}
 
 #if ENABLE(CONTEXT_MENUS)
 bool EventHandler::sendContextMenuEvent(const PlatformMouseEvent& event)
@@ -1899,6 +1962,43 @@ void EventHandler::scheduleHoverStateUpdate()
         m_hoverTimer.startOneShot(0);
 }
 
+void EventHandler::dispatchFakeMouseMoveEventSoonInQuad(const FloatQuad& quad)
+{
+    FrameView* view = m_frame->view();
+    if (!view)
+        return;
+
+    if (m_mousePressed || !quad.containsPoint(view->windowToContents(m_currentMousePosition)))
+        return;
+
+    if (!m_fakeMouseMoveEventTimer.isActive())
+        m_fakeMouseMoveEventTimer.startOneShot(fakeMouseMoveInterval);
+}
+
+void EventHandler::cancelFakeMouseMoveEvent()
+{
+    m_fakeMouseMoveEventTimer.stop();
+}
+
+void EventHandler::fakeMouseMoveEventTimerFired(Timer<EventHandler>* timer)
+{
+    ASSERT_UNUSED(timer, timer == &m_fakeMouseMoveEventTimer);
+    ASSERT(!m_mousePressed);
+
+    FrameView* view = m_frame->view();
+    if (!view)
+        return;
+
+    bool shiftKey;
+    bool ctrlKey;
+    bool altKey;
+    bool metaKey;
+    PlatformKeyboardEvent::getCurrentModifierState(shiftKey, ctrlKey, altKey, metaKey);
+    IntPoint globalPoint = view->contentsToScreen(IntRect(view->windowToContents(m_currentMousePosition), IntSize())).location();
+    PlatformMouseEvent fakeMouseMoveEvent(m_currentMousePosition, globalPoint, NoButton, MouseEventMoved, 0, shiftKey, ctrlKey, altKey, metaKey, currentTime());
+    mouseMoved(fakeMouseMoveEvent);
+}
+
 // Whether or not a mouse down can begin the creation of a selection.  Fires the selectStart event.
 bool EventHandler::canMouseDownStartSelect(Node* node)
 {
@@ -1965,6 +2065,10 @@ static Node* eventTargetNodeForDocument(Document* doc)
     if (!doc)
         return 0;
     Node* node = doc->focusedNode();
+    if (!node && doc->isPluginDocument()) {
+        PluginDocument* pluginDocument = static_cast<PluginDocument*>(doc);
+        node =  pluginDocument->pluginNode();
+    }
     if (!node && doc->isHTMLDocument())
         node = doc->body();
     if (!node)
@@ -2133,10 +2237,15 @@ void EventHandler::defaultKeyboardEventHandler(KeyboardEvent* event)
             return;
         if (event->keyIdentifier() == "U+0009")
             defaultTabEventHandler(event);
+        else {
+            FocusDirection direction = focusDirectionForKey(event->keyIdentifier());
+            if (direction != FocusDirectionNone)
+                defaultArrowEventHandler(direction, event);
+        }
 
-       // provides KB navigation and selection for enhanced accessibility users
-       if (AXObjectCache::accessibilityEnhancedUserInterfaceEnabled())
-           handleKeyboardSelectionMovement(event);       
+        // provides KB navigation and selection for enhanced accessibility users
+        if (AXObjectCache::accessibilityEnhancedUserInterfaceEnabled())
+            handleKeyboardSelectionMovement(event);
     }
     if (event->type() == eventNames().keypressEvent) {
         m_frame->editor()->handleKeyboardEvent(event);
@@ -2147,6 +2256,27 @@ void EventHandler::defaultKeyboardEventHandler(KeyboardEvent* event)
     }
 }
 
+FocusDirection EventHandler::focusDirectionForKey(const AtomicString& keyIdentifier) const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, Down, ("Down"));
+    DEFINE_STATIC_LOCAL(AtomicString, Up, ("Up"));
+    DEFINE_STATIC_LOCAL(AtomicString, Left, ("Left"));
+    DEFINE_STATIC_LOCAL(AtomicString, Right, ("Right"));
+
+    FocusDirection retVal = FocusDirectionNone;
+
+    if (keyIdentifier == Down)
+        retVal = FocusDirectionDown;
+    else if (keyIdentifier == Up)
+        retVal = FocusDirectionUp;
+    else if (keyIdentifier == Left)
+        retVal = FocusDirectionLeft;
+    else if (keyIdentifier == Right)
+        retVal = FocusDirectionRight;
+
+    return retVal;
+}
+
 #if ENABLE(DRAG_SUPPORT)
 bool EventHandler::dragHysteresisExceeded(const FloatPoint& floatDragViewportLocation) const
 {
@@ -2184,16 +2314,9 @@ bool EventHandler::shouldDragAutoNode(Node* node, const IntPoint& point) const
     if (!node || !m_frame->view())
         return false;
     Page* page = m_frame->page();
-    return page && page->dragController()->mayStartDragAtEventLocation(m_frame, point);
-}
-    
-void EventHandler::dragSourceMovedTo(const PlatformMouseEvent& event)
-{
-    if (dragState().m_dragSrc && dragState().m_dragSrcMayBeDHTML)
-        // for now we don't care if event handler cancels default behavior, since there is none
-        dispatchDragSrcEvent(eventNames().dragEvent, event);
+    return page && page->dragController()->mayStartDragAtEventLocation(m_frame, point, node);
 }
-    
+
 void EventHandler::dragSourceEndedAt(const PlatformMouseEvent& event, DragOperation operation)
 {
     if (dragState().m_dragSrc && dragState().m_dragSrcMayBeDHTML) {
@@ -2276,9 +2399,11 @@ bool EventHandler::handleDrag(const MouseEventWithHitTestResults& event)
         return !mouseDownMayStartSelect() && !m_mouseDownMayStartAutoscroll;
     
     // We are starting a text/image/url drag, so the cursor should be an arrow
-    if (FrameView* view = m_frame->view())
+    if (FrameView* view = m_frame->view()) {
+        // FIXME <rdar://7577595>: Custom cursors aren't supported during drag and drop (default to pointer).
         view->setCursor(pointerCursor());
-    
+    }
+
     if (!dragHysteresisExceeded(event.event().pos())) 
         return true;
     
@@ -2299,7 +2424,7 @@ bool EventHandler::handleDrag(const MouseEventWithHitTestResults& event)
                 // FIXME: This doesn't work correctly with transforms.
                 FloatPoint absPos = renderer->localToAbsolute();
                 IntSize delta = m_mouseDownPos - roundedIntPoint(absPos);
-                dragState().m_dragClipboard->setDragImageElement(dragState().m_dragSrc.get(), IntPoint() + delta);
+                dragState().m_dragClipboard->setDragImageElement(dragState().m_dragSrc.get(), toPoint(delta));
             } else {
                 // The renderer has disappeared, this can happen if the onStartDrag handler has hidden
                 // the element in some way.  In this case we just kill the drag.
@@ -2317,11 +2442,12 @@ bool EventHandler::handleDrag(const MouseEventWithHitTestResults& event)
         
         if (m_mouseDownMayStartDrag) {
             // gather values from DHTML element, if it set any
-            dragState().m_dragClipboard->sourceOperation(srcOp);
+            srcOp = dragState().m_dragClipboard->sourceOperation();
             
-            // Yuck, dragSourceMovedTo() can be called as a result of kicking off the drag with
-            // dragImage!  Because of that dumb reentrancy, we may think we've not started the
-            // drag when that happens.  So we have to assume it's started before we kick it off.
+            // Yuck, a draggedImage:moveTo: message can be fired as a result of kicking off the
+            // drag with dragImage!  Because of that dumb reentrancy, we may think we've not
+            // started the drag when that happens.  So we have to assume it's started before we
+            // kick it off.
             dragState().m_dragClipboard->setDragHasStarted();
         }
     }
@@ -2378,8 +2504,7 @@ bool EventHandler::handleTextInputEvent(const String& text, Event* underlyingEve
     return event->defaultHandled();
 }
     
-    
-#if !PLATFORM(MAC) && !PLATFORM(QT) && !PLATFORM(HAIKU)
+#if !PLATFORM(MAC) && !PLATFORM(QT) && !PLATFORM(HAIKU) && !PLATFORM(EFL)
 bool EventHandler::invertSenseOfTabsToLinks(KeyboardEvent*) const
 {
     return false;
@@ -2445,6 +2570,27 @@ void EventHandler::defaultSpaceEventHandler(KeyboardEvent* event)
 
 #endif
 
+void EventHandler::defaultArrowEventHandler(FocusDirection focusDirection, KeyboardEvent* event)
+{
+    if (event->ctrlKey() || event->metaKey() || event->altGraphKey() || event->shiftKey())
+        return;
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    if (!page->settings() || !page->settings()->isSpatialNavigationEnabled())
+        return;
+
+    // Arrows and other possible directional navigation keys can be used in design
+    // mode editing.
+    if (m_frame->document()->inDesignMode())
+        return;
+
+    if (page->focusController()->advanceFocus(focusDirection, event))
+        event->setDefaultHandled();
+}
+
 void EventHandler::defaultTabEventHandler(KeyboardEvent* event)
 {
     // We should only advance focus on tabs if no special modifier keys are held down.
@@ -2517,4 +2663,174 @@ void EventHandler::updateLastScrollbarUnderMouse(Scrollbar* scrollbar, bool setL
     }
 }
 
+#if ENABLE(TOUCH_EVENTS)
+
+static PassRefPtr<TouchList> assembleTargetTouches(Touch* touchTarget, TouchList* touches)
+{
+    RefPtr<TouchList> targetTouches = TouchList::create();
+
+    for (unsigned i = 0; i < touches->length(); ++i) {
+        if (touches->item(i)->target()->toNode()->isSameNode(touchTarget->target()->toNode()))
+            targetTouches->append(touches->item(i));
+    }
+
+    return targetTouches.release();
+}
+
+bool EventHandler::handleTouchEvent(const PlatformTouchEvent& event)
+{
+    RefPtr<TouchList> touches = TouchList::create();
+    RefPtr<TouchList> pressedTouches = TouchList::create();
+    RefPtr<TouchList> releasedTouches = TouchList::create();
+    RefPtr<TouchList> movedTouches = TouchList::create();
+    RefPtr<TouchList> cancelTouches = TouchList::create();
+
+    const Vector<PlatformTouchPoint>& points = event.touchPoints();
+    AtomicString* eventName = 0;
+
+    for (unsigned i = 0; i < points.size(); ++i) {
+        const PlatformTouchPoint& point = points[i];
+        IntPoint pagePoint = documentPointForWindowPoint(m_frame, point.pos());
+        HitTestResult result = hitTestResultAtPoint(pagePoint, /*allowShadowContent*/ false);
+        Node* target = result.innerNode();
+
+        // Touch events should not go to text nodes
+        if (target && target->isTextNode())
+            target = target->parentNode();
+
+        Document* doc = target->document();
+        if (!doc)
+            continue;
+        if (!doc->hasListenerType(Document::TOUCH_LISTENER))
+            continue;
+
+        if (m_frame != doc->frame()) {
+            // pagePoint should always be relative to the target elements containing frame.
+            pagePoint = documentPointForWindowPoint(doc->frame(), point.pos());
+        }
+
+        int adjustedPageX = lroundf(pagePoint.x() / m_frame->pageZoomFactor());
+        int adjustedPageY = lroundf(pagePoint.y() / m_frame->pageZoomFactor());
+
+        // Increment the platform touch id by 1 to avoid storing a key of 0 in the hashmap.
+        unsigned touchPointTargetKey = point.id() + 1;
+        EventTarget* touchTarget = 0;
+        if (point.state() == PlatformTouchPoint::TouchPressed) {
+            m_originatingTouchPointTargets.set(touchPointTargetKey, target);
+            touchTarget = target;
+        } else if (point.state() == PlatformTouchPoint::TouchReleased || point.state() == PlatformTouchPoint::TouchCancelled) {
+            // The target should be the original target for this touch, so get it from the hashmap. As it's a release or cancel
+            // we also remove it from the map.
+            touchTarget = m_originatingTouchPointTargets.take(touchPointTargetKey).get();
+        } else
+            touchTarget = m_originatingTouchPointTargets.get(touchPointTargetKey).get();
+
+        if (!touchTarget)
+            continue;
+
+        RefPtr<Touch> touch = Touch::create(doc->frame(), touchTarget, point.id(),
+                                            point.screenPos().x(), point.screenPos().y(),
+                                            adjustedPageX, adjustedPageY);
+
+        // touches should contain information about every touch currently on the screen.
+        if (point.state() != PlatformTouchPoint::TouchReleased)
+            touches->append(touch);
+
+        // Now build up the correct list for changedTouches.
+        if (point.state() == PlatformTouchPoint::TouchReleased)
+            releasedTouches->append(touch);
+        else if (point.state() == PlatformTouchPoint::TouchCancelled)
+            cancelTouches->append(touch);
+        else if (point.state() == PlatformTouchPoint::TouchPressed)
+            pressedTouches->append(touch);
+        else if (point.state() == PlatformTouchPoint::TouchMoved)
+            movedTouches->append(touch);
+    }
+
+    bool defaultPrevented = false;
+    Touch* changedTouch = 0;
+    EventTarget* touchEventTarget = 0;
+
+    if (cancelTouches->length() > 0) {
+        // We dispatch the event to the target of the touch that caused this touch event to be generated, i.e.
+        // we take it from the list that will be used as the changedTouches property of the event.
+        // The choice to use the touch at index 0 guarantees that there is a target (as we checked the length
+        // above). In the case that there are multiple touches in what becomes the changedTouches list, it is
+        // difficult to say how we should prioritise touches and as such, item 0 is an arbitrary choice.
+        changedTouch = cancelTouches->item(0);
+        ASSERT(changedTouch);
+        touchEventTarget = changedTouch->target();
+        ASSERT(touchEventTarget);
+
+        eventName = &eventNames().touchcancelEvent;
+        RefPtr<TouchEvent> cancelEv =
+            TouchEvent::create(TouchList::create().get(), TouchList::create().get(), cancelTouches.get(),
+                                                   *eventName, touchEventTarget->toNode()->document()->defaultView(),
+                                                   0, 0, 0, 0, event.ctrlKey(), event.altKey(), event.shiftKey(),
+                                                   event.metaKey());
+        ExceptionCode ec = 0;
+        touchEventTarget->dispatchEvent(cancelEv.get(), ec);
+        defaultPrevented |= cancelEv->defaultPrevented();
+    }
+
+    if (releasedTouches->length() > 0) {
+        Touch* changedTouch = releasedTouches->item(0);
+        ASSERT(changedTouch);
+        touchEventTarget = changedTouch->target();
+        ASSERT(touchEventTarget);
+
+        RefPtr<TouchList> targetTouches = assembleTargetTouches(changedTouch, touches.get());
+
+        eventName = &eventNames().touchendEvent;
+        RefPtr<TouchEvent> endEv = 
+            TouchEvent::create(touches.get(), targetTouches.get(), releasedTouches.get(),
+                                                   *eventName, touchEventTarget->toNode()->document()->defaultView(),
+                                                   0, 0, 0, 0, event.ctrlKey(), event.altKey(), event.shiftKey(),
+                                                   event.metaKey());
+        ExceptionCode ec = 0;
+        touchEventTarget->dispatchEvent(endEv.get(), ec);
+        defaultPrevented |= endEv->defaultPrevented();
+    }
+    if (pressedTouches->length() > 0) {
+        Touch* changedTouch = pressedTouches->item(0);
+        ASSERT(changedTouch);
+        touchEventTarget = changedTouch->target();
+        ASSERT(touchEventTarget);
+
+        RefPtr<TouchList> targetTouches = assembleTargetTouches(changedTouch, touches.get());
+
+        eventName = &eventNames().touchstartEvent;
+        RefPtr<TouchEvent> startEv =
+            TouchEvent::create(touches.get(), targetTouches.get(), pressedTouches.get(),
+                                                   *eventName, touchEventTarget->toNode()->document()->defaultView(),
+                                                   0, 0, 0, 0, event.ctrlKey(), event.altKey(), event.shiftKey(),
+                                                   event.metaKey());
+        ExceptionCode ec = 0;
+        touchEventTarget->dispatchEvent(startEv.get(), ec);
+        defaultPrevented |= startEv->defaultPrevented();
+    }
+
+    if (movedTouches->length() > 0) {
+        Touch* changedTouch = movedTouches->item(0);
+        ASSERT(changedTouch);
+        touchEventTarget = changedTouch->target();
+        ASSERT(touchEventTarget);
+
+        RefPtr<TouchList> targetTouches = assembleTargetTouches(changedTouch, touches.get());
+
+        eventName = &eventNames().touchmoveEvent;
+        RefPtr<TouchEvent> moveEv = 
+            TouchEvent::create(touches.get(), targetTouches.get(), movedTouches.get(),
+                                                   *eventName, touchEventTarget->toNode()->document()->defaultView(),
+                                                   0, 0, 0, 0, event.ctrlKey(), event.altKey(), event.shiftKey(),
+                                                   event.metaKey());
+        ExceptionCode ec = 0;
+        touchEventTarget->dispatchEvent(moveEv.get(), ec);
+        defaultPrevented |= moveEv->defaultPrevented();
+    }
+
+    return defaultPrevented;
+}
+#endif
+
 }
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.h b/src/3rdparty/webkit/WebCore/page/EventHandler.h
index 0221397b94..282100d75b 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.h
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,6 +27,7 @@
 #define EventHandler_h
 
 #include "DragActions.h"
+#include "FocusDirection.h"
 #include "PlatformMouseEvent.h"
 #include "ScrollTypes.h"
 #include "Timer.h"
@@ -37,13 +38,19 @@
 class NSView;
 #endif
 
+#if ENABLE(TOUCH_EVENTS)
+#include <wtf/HashMap.h>
+#endif
+
 namespace WebCore {
 
 class AtomicString;
 class Clipboard;
 class Cursor;
 class Event;
+class EventTarget;
 class FloatPoint;
+class FloatQuad;
 class Frame;
 class HitTestRequest;
 class HitTestResult;
@@ -52,6 +59,7 @@ class KeyboardEvent;
 class MouseEventWithHitTestResults;
 class Node;
 class PlatformKeyboardEvent;
+class PlatformTouchEvent;
 class PlatformWheelEvent;
 class RenderLayer;
 class RenderObject;
@@ -60,6 +68,8 @@ class Scrollbar;
 class String;
 class SVGElementInstance;
 class TextEvent;
+class TouchEvent;
+class WheelEvent;
 class Widget;
     
 #if ENABLE(DRAG_SUPPORT)
@@ -85,6 +95,7 @@ public:
     Node* mousePressNode() const;
     void setMousePressNode(PassRefPtr<Node>);
 
+    void startPanScrolling(RenderObject*);
     bool panScrollInProgress() { return m_panScrollInProgress; }
     void setPanScrollInProgress(bool inProgress) { m_panScrollInProgress = inProgress; }
 
@@ -92,6 +103,8 @@ public:
     RenderObject* autoscrollRenderer() const;
     void updateAutoscrollRenderer();
 
+    void dispatchFakeMouseMoveEventSoonInQuad(const FloatQuad&);
+
     HitTestResult hitTestResultAtPoint(const IntPoint&, bool allowShadowContent, bool ignoreClipping = false, HitTestScrollbars scrollbars = DontHitTestScrollbars);
 
     bool mousePressed() const { return m_mousePressed; }
@@ -138,6 +151,7 @@ public:
     bool handleMouseMoveEvent(const PlatformMouseEvent&, HitTestResult* hoveredNode = 0);
     bool handleMouseReleaseEvent(const PlatformMouseEvent&);
     bool handleWheelEvent(PlatformWheelEvent&);
+    void defaultWheelEventHandler(Node*, WheelEvent*);
 
 #if ENABLE(CONTEXT_MENUS)
     bool sendContextMenuEvent(const PlatformMouseEvent&);
@@ -159,7 +173,6 @@ public:
 #if ENABLE(DRAG_SUPPORT)
     bool eventMayStartDrag(const PlatformMouseEvent&) const;
     
-    void dragSourceMovedTo(const PlatformMouseEvent&);
     void dragSourceEndedAt(const PlatformMouseEvent&, DragOperation);
 #endif
 
@@ -192,9 +205,19 @@ public:
     static NSEvent *currentNSEvent();
 #endif
 
+#if ENABLE(TOUCH_EVENTS)
+    bool handleTouchEvent(const PlatformTouchEvent&);
+#endif
+
 private:
 #if ENABLE(DRAG_SUPPORT)
-    struct EventHandlerDragState {
+    enum DragAndDropHandleType {
+        UpdateDragAndDrop,
+        CancelDragAndDrop,
+        PerformDragAndDrop
+    };
+
+    struct EventHandlerDragState : Noncopyable {
         RefPtr<Node> m_dragSrc; // element that may be a drag source, for the current mouse gesture
         bool m_dragSrcIsLink;
         bool m_dragSrcIsImage;
@@ -206,6 +229,8 @@ private:
     };
     static EventHandlerDragState& dragState();
     static const double TextDragDelay;
+
+    bool canHandleDragAndDropForTarget(DragAndDropHandleType, Node* target, const PlatformMouseEvent&, Clipboard*, bool* accepted = 0);
     
     PassRefPtr<Clipboard> createDraggingClipboard() const;
 #endif // ENABLE(DRAG_SUPPORT)
@@ -244,6 +269,9 @@ private:
     void setAutoscrollRenderer(RenderObject*);
     void autoscrollTimerFired(Timer<EventHandler>*);
 
+    void fakeMouseMoveEventTimerFired(Timer<EventHandler>*);
+    void cancelFakeMouseMoveEvent();
+
     void invalidateClick();
 
     Node* nodeUnderMouse() const;
@@ -287,6 +315,7 @@ private:
 
     void defaultSpaceEventHandler(KeyboardEvent*);
     void defaultTabEventHandler(KeyboardEvent*);
+    void defaultArrowEventHandler(FocusDirection, KeyboardEvent*);
 
 #if ENABLE(DRAG_SUPPORT)
     void allowDHTMLDrag(bool& flagDHTML, bool& flagUA) const;
@@ -309,9 +338,11 @@ private:
     
     void setFrameWasScrolledByUser();
 
+    FocusDirection focusDirectionForKey(const AtomicString&) const;
+
     bool capturesDragging() const { return m_capturesDragging; }
 
-#if PLATFORM(MAC) && defined(__OBJC__)
+#if PLATFORM(MAC) && defined(__OBJC__) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
     NSView *mouseDownViewIfStillGood();
 
     PlatformMouseEvent currentPlatformMouseEvent() const;
@@ -348,6 +379,8 @@ private:
     bool m_mouseDownMayStartAutoscroll;
     bool m_mouseDownWasInSubframe;
 
+    Timer<EventHandler> m_fakeMouseMoveEventTimer;
+
 #if ENABLE(SVG)
     bool m_svgPan;
     RefPtr<SVGElementInstance> m_instanceUnderMouse;
@@ -368,6 +401,7 @@ private:
 
 #if ENABLE(DRAG_SUPPORT)
     RefPtr<Node> m_dragTarget;
+    bool m_shouldOnlyFireDragOverEvent;
 #endif
     
     RefPtr<HTMLFrameSetElement> m_frameSetBeingResized;
@@ -386,10 +420,16 @@ private:
     RefPtr<Node> m_previousWheelScrolledNode;
 
 #if PLATFORM(MAC)
+#if !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
     NSView *m_mouseDownView;
     bool m_sendingEventToSubview;
+#endif
     int m_activationEventNumber;
 #endif
+#if ENABLE(TOUCH_EVENTS)
+    typedef HashMap<int, RefPtr<EventTarget> > TouchTargetMap;
+    TouchTargetMap m_originatingTouchPointTargets;
+#endif
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/EventSource.cpp b/src/3rdparty/webkit/WebCore/page/EventSource.cpp
index 2c9a34358b..9ccccd776d 100644
--- a/src/3rdparty/webkit/WebCore/page/EventSource.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventSource.cpp
@@ -57,6 +57,7 @@ EventSource::EventSource(const String& url, ScriptExecutionContext* context, Exc
     : ActiveDOMObject(context, this)
     , m_state(CONNECTING)
     , m_reconnectTimer(this, &EventSource::reconnectTimerFired)
+    , m_discardTrailingNewline(false)
     , m_failSilently(false)
     , m_requestInFlight(false)
     , m_reconnectDelay(defaultReconnectDelay)
@@ -210,21 +211,24 @@ void EventSource::parseEventStream()
 {
     unsigned int bufPos = 0;
     unsigned int bufSize = m_receiveBuf.size();
-    for (;;) {
+    while (bufPos < bufSize) {
+        if (m_discardTrailingNewline) {
+            if (m_receiveBuf[bufPos] == '\n')
+                bufPos++;
+            m_discardTrailingNewline = false;
+        }
+
         int lineLength = -1;
         int fieldLength = -1;
-        int carriageReturn = 0;
         for (unsigned int i = bufPos; lineLength < 0 && i < bufSize; i++) {
             switch (m_receiveBuf[i]) {
             case ':':
                 if (fieldLength < 0)
                     fieldLength = i - bufPos;
                 break;
+            case '\r':
+                m_discardTrailingNewline = true;
             case '\n':
-                if (i > bufPos && m_receiveBuf[i - 1] == '\r') {
-                    carriageReturn++;
-                    i--;
-                }
                 lineLength = i - bufPos;
                 break;
             }
@@ -234,7 +238,7 @@ void EventSource::parseEventStream()
             break;
 
         parseEventStreamLine(bufPos, fieldLength, lineLength);
-        bufPos += lineLength + carriageReturn + 1;
+        bufPos += lineLength + 1;
     }
 
     if (bufPos == bufSize)
@@ -246,8 +250,10 @@ void EventSource::parseEventStream()
 void EventSource::parseEventStreamLine(unsigned int bufPos, int fieldLength, int lineLength)
 {
     if (!lineLength) {
-        if (!m_data.isEmpty())
+        if (!m_data.isEmpty()) {
+            m_data.removeLast();
             dispatchEvent(createMessageEvent());
+        }
         if (!m_eventName.isEmpty())
             m_eventName = "";
     } else if (fieldLength) {
@@ -265,10 +271,9 @@ void EventSource::parseEventStreamLine(unsigned int bufPos, int fieldLength, int
         int valueLength = lineLength - step;
 
         if (field == "data") {
-            if (m_data.size() > 0)
-                m_data.append('\n');
             if (valueLength)
                 m_data.append(&m_receiveBuf[bufPos], valueLength);
+            m_data.append('\n');
         } else if (field == "event")
             m_eventName = valueLength ? String(&m_receiveBuf[bufPos], valueLength) : "";
         else if (field == "id")
diff --git a/src/3rdparty/webkit/WebCore/page/EventSource.h b/src/3rdparty/webkit/WebCore/page/EventSource.h
index 5b037a4cb0..d0d45cb123 100644
--- a/src/3rdparty/webkit/WebCore/page/EventSource.h
+++ b/src/3rdparty/webkit/WebCore/page/EventSource.h
@@ -36,7 +36,6 @@
 
 #include "ActiveDOMObject.h"
 #include "AtomicStringHash.h"
-#include "EventListener.h"
 #include "EventNames.h"
 #include "EventTarget.h"
 #include "KURL.h"
@@ -115,6 +114,7 @@ namespace WebCore {
         RefPtr<ThreadableLoader> m_loader;
         Timer<EventSource> m_reconnectTimer;
         Vector<UChar> m_receiveBuf;
+        bool m_discardTrailingNewline;
         bool m_failSilently;
         bool m_requestInFlight;
 
diff --git a/src/3rdparty/webkit/WebCore/page/EventSource.idl b/src/3rdparty/webkit/WebCore/page/EventSource.idl
index 561bd68f94..57bd807ac6 100644
--- a/src/3rdparty/webkit/WebCore/page/EventSource.idl
+++ b/src/3rdparty/webkit/WebCore/page/EventSource.idl
@@ -33,6 +33,7 @@ module window {
 
     interface [
         Conditional=EVENTSOURCE,
+        CustomConstructor,
         EventTarget,
         NoStaticTables
     ] EventSource {
@@ -52,12 +53,12 @@ module window {
         void close();
 
         // EventTarget interface
-        [Custom] void addEventListener(in DOMString type,
-                                      in EventListener listener,
-                                      in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type,
+        [JSCCustom] void addEventListener(in DOMString type,
                                           in EventListener listener,
                                           in boolean useCapture);
+        [JSCCustom] void removeEventListener(in DOMString type,
+                                             in EventListener listener,
+                                             in boolean useCapture);
         boolean dispatchEvent(in Event evt)
             raises(EventException);
 
diff --git a/src/3rdparty/webkit/WebCore/page/FocusController.cpp b/src/3rdparty/webkit/WebCore/page/FocusController.cpp
index 5e78c7d9b8..089fb8f9ae 100644
--- a/src/3rdparty/webkit/WebCore/page/FocusController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FocusController.cpp
@@ -38,8 +38,8 @@
 #include "EventNames.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
-#include "FrameView.h"
 #include "FrameTree.h"
+#include "FrameView.h"
 #include "HTMLFrameOwnerElement.h"
 #include "HTMLNames.h"
 #include "KeyboardEvent.h"
@@ -49,18 +49,26 @@
 #include "RenderWidget.h"
 #include "SelectionController.h"
 #include "Settings.h"
+#include "SpatialNavigation.h"
 #include "Widget.h"
-#include <wtf/Platform.h>
 
 namespace WebCore {
 
 using namespace HTMLNames;
+using namespace std;
 
 static inline void dispatchEventsOnWindowAndFocusedNode(Document* document, bool focused)
 {
     // If we have a focused node we should dispatch blur on it before we blur the window.
     // If we have a focused node we should dispatch focus on it after we focus the window.
     // https://bugs.webkit.org/show_bug.cgi?id=27105
+
+    // Do not fire events while modal dialogs are up.  See https://bugs.webkit.org/show_bug.cgi?id=33962
+    if (Page* page = document->page()) {
+        if (page->defersLoading())
+            return;
+    }
+
     if (!focused && document->focusedNode())
         document->focusedNode()->dispatchBlurEvent();
     document->dispatchWindowEvent(Event::create(focused ? eventNames().focusEvent : eventNames().blurEvent, false, false));
@@ -72,14 +80,17 @@ FocusController::FocusController(Page* page)
     : m_page(page)
     , m_isActive(false)
     , m_isFocused(false)
+    , m_isChangingFocusedFrame(false)
 {
 }
 
 void FocusController::setFocusedFrame(PassRefPtr<Frame> frame)
 {
-    if (m_focusedFrame == frame)
+    if (m_focusedFrame == frame || m_isChangingFocusedFrame)
         return;
 
+    m_isChangingFocusedFrame = true;
+
     RefPtr<Frame> oldFrame = m_focusedFrame;
     RefPtr<Frame> newFrame = frame;
 
@@ -95,6 +106,8 @@ void FocusController::setFocusedFrame(PassRefPtr<Frame> frame)
         newFrame->selection()->setFocused(true);
         newFrame->document()->dispatchWindowEvent(Event::create(eventNames().focusEvent, false, false));
     }
+
+    m_isChangingFocusedFrame = false;
 }
 
 Frame* FocusController::focusedOrMainFrame()
@@ -148,6 +161,24 @@ bool FocusController::setInitialFocus(FocusDirection direction, KeyboardEvent* e
 
 bool FocusController::advanceFocus(FocusDirection direction, KeyboardEvent* event, bool initialFocus)
 {
+    switch (direction) {
+    case FocusDirectionForward:
+    case FocusDirectionBackward:
+        return advanceFocusInDocumentOrder(direction, event, initialFocus);
+    case FocusDirectionLeft:
+    case FocusDirectionRight:
+    case FocusDirectionUp:
+    case FocusDirectionDown:
+        return advanceFocusDirectionally(direction, event);
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    return false;
+}
+
+bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, KeyboardEvent* event, bool initialFocus)
+{
     Frame* frame = focusedOrMainFrame();
     ASSERT(frame);
     Document* document = frame->document();
@@ -252,6 +283,140 @@ bool FocusController::advanceFocus(FocusDirection direction, KeyboardEvent* even
     return true;
 }
 
+bool FocusController::advanceFocusDirectionally(FocusDirection direction, KeyboardEvent* event)
+{
+    Frame* frame = focusedOrMainFrame();
+    ASSERT(frame);
+    Document* focusedDocument = frame->document();
+    if (!focusedDocument)
+        return false;
+
+    Node* focusedNode = focusedDocument->focusedNode();
+    if (!focusedNode) {
+        // Just move to the first focusable node.
+        FocusDirection tabDirection = (direction == FocusDirectionUp || direction == FocusDirectionLeft) ?
+                                       FocusDirectionForward : FocusDirectionBackward;
+        // 'initialFocus' is set to true so the chrome is not focused.
+        return advanceFocusInDocumentOrder(tabDirection, event, true);
+    }
+
+    // Move up in the chain of nested frames.
+    frame = frame->tree()->top();
+
+    FocusCandidate focusCandidate;
+    findFocusableNodeInDirection(frame->document(), focusedNode, direction, event, focusCandidate);
+
+    Node* node = focusCandidate.node;
+    if (!node || !node->isElementNode()) {
+        // FIXME: May need a way to focus a document here.
+        Frame* frame = focusedOrMainFrame();
+        scrollInDirection(frame, direction);
+        return false;
+    }
+
+    // In order to avoid crazy jump between links that are either far away from each other,
+    // or just not currently visible, lets do a scroll in the given direction and bail out
+    // if |node| element is not in the viewport.
+    if (hasOffscreenRect(node)) {
+        Frame* frame = node->document()->view()->frame();
+        scrollInDirection(frame, direction);
+        return true;
+    }
+
+    Document* newDocument = node->document();
+
+    if (newDocument != focusedDocument) {
+        // Focus is going away from the originally focused document, so clear the focused node.
+        focusedDocument->setFocusedNode(0);
+    }
+
+    if (newDocument)
+        setFocusedFrame(newDocument->frame());
+
+    Element* element = static_cast<Element*>(node);
+    ASSERT(element);
+
+    scrollIntoView(element);
+    element->focus(false);
+    return true;
+}
+
+static void updateFocusCandidateIfCloser(Node* focusedNode, Node* candidate, long long distance, FocusCandidate& closestFocusCandidate)
+{
+    // Bail out if |distance| is bigger than the current closest candidate.
+    if (distance >= closestFocusCandidate.distance)
+        return;
+
+    // If |focusedNode| and |candidate| are in the same document AND
+    // current |closestFocusCandidadte| is not in an {i}frame that is
+    // preferable to get focused.
+    if (focusedNode->document() == candidate->document()
+        && distance < closestFocusCandidate.parentDistance) {
+        closestFocusCandidate.node = candidate;
+        closestFocusCandidate.distance = distance;
+        closestFocusCandidate.parentDistance = maxDistance();
+    } else if (focusedNode->document() != candidate->document()) {
+        // If the |focusedNode| is in an inner document and the |candidate| is
+        // in a different document, we only consider to change focus if there is
+        // not another already good focusable candidate in the same document as
+        // |focusedNode|.
+        if (!((isInRootDocument(candidate) && !isInRootDocument(focusedNode))
+            && focusedNode->document() == closestFocusCandidate.document())) {
+            closestFocusCandidate.node = candidate;
+            closestFocusCandidate.distance = distance;
+        }
+    }
+}
+
+void FocusController::findFocusableNodeInDirection(Document* document, Node* focusedNode, FocusDirection direction, KeyboardEvent* event, FocusCandidate& closestFocusCandidate)
+{
+    ASSERT(document);
+
+    // Walk all the child nodes and update focusCandidate if we find a nearer node.
+    for (Node* candidate = document->firstChild(); candidate; candidate = candidate->traverseNextNode()) {
+        // Inner documents case.
+        if (candidate->isFrameOwnerElement())
+            deepFindFocusableNodeInDirection(focusedNode, candidate, direction, event, closestFocusCandidate);
+        else if (candidate != focusedNode && candidate->isKeyboardFocusable(event)) {
+            long long distance = distanceInDirection(focusedNode, candidate,
+                                                     direction, closestFocusCandidate);
+            updateFocusCandidateIfCloser(focusedNode, candidate, distance, closestFocusCandidate);
+        }
+    }
+}
+
+void FocusController::deepFindFocusableNodeInDirection(Node* focusedNode, Node* candidate, FocusDirection direction, KeyboardEvent* event, FocusCandidate& closestFocusCandidate)
+{
+    HTMLFrameOwnerElement* owner = static_cast<HTMLFrameOwnerElement*>(candidate);
+    if (!owner->contentFrame())
+        return;
+
+    Document* innerDocument = owner->contentFrame()->document();
+    if (!innerDocument)
+        return;
+
+    if (innerDocument == focusedNode->document())
+        findFocusableNodeInDirection(innerDocument, focusedNode, direction, event, closestFocusCandidate);
+    else {
+        // Check if the current {i}frame element itself is a good candidate
+        // to move focus to. If it is, then we traverse its inner nodes.
+        // Lets pass a copy of the best candidate, to not get fooled by a
+        // frame without focusable elements.
+        FocusCandidate focusCandidateCopy = closestFocusCandidate;
+        long long distance = distanceInDirection(focusedNode, candidate, direction, focusCandidateCopy);
+        if (distance < focusCandidateCopy.distance) {
+            focusCandidateCopy.parentAlignment = focusCandidateCopy.alignment;
+            focusCandidateCopy.parentDistance = distance;
+
+            findFocusableNodeInDirection(innerDocument, focusedNode, direction, event, focusCandidateCopy);
+
+            // If we really have an inner closer focus candidate node, take it.
+            if (closestFocusCandidate.node != focusCandidateCopy.node)
+                closestFocusCandidate = focusCandidateCopy;
+        }
+    }
+}
+
 static bool relinquishesEditingFocus(Node *node)
 {
     ASSERT(node);
diff --git a/src/3rdparty/webkit/WebCore/page/FocusController.h b/src/3rdparty/webkit/WebCore/page/FocusController.h
index 33debf1569..75591c712b 100644
--- a/src/3rdparty/webkit/WebCore/page/FocusController.h
+++ b/src/3rdparty/webkit/WebCore/page/FocusController.h
@@ -28,40 +28,50 @@
 
 #include "FocusDirection.h"
 #include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
-    class Frame;
-    class KeyboardEvent;
-    class Node;
-    class Page;
+class Document;
+class Frame;
+class KeyboardEvent;
+class Node;
+class Page;
+struct FocusCandidate;
 
-    class FocusController {
-    public:
-        FocusController(Page*);
+class FocusController : public Noncopyable {
+public:
+    FocusController(Page*);
 
-        void setFocusedFrame(PassRefPtr<Frame>);
-        Frame* focusedFrame() const { return m_focusedFrame.get(); }
-        Frame* focusedOrMainFrame();
+    void setFocusedFrame(PassRefPtr<Frame>);
+    Frame* focusedFrame() const { return m_focusedFrame.get(); }
+    Frame* focusedOrMainFrame();
 
-        bool setInitialFocus(FocusDirection, KeyboardEvent*);
-        bool advanceFocus(FocusDirection, KeyboardEvent*, bool initialFocus = false);
+    bool setInitialFocus(FocusDirection, KeyboardEvent*);
+    bool advanceFocus(FocusDirection, KeyboardEvent*, bool initialFocus = false);
         
-        bool setFocusedNode(Node*, PassRefPtr<Frame>);
+    bool setFocusedNode(Node*, PassRefPtr<Frame>);
 
-        void setActive(bool);
-        bool isActive() const { return m_isActive; }
+    void setActive(bool);
+    bool isActive() const { return m_isActive; }
 
-        void setFocused(bool);
-        bool isFocused() const { return m_isFocused; }
+    void setFocused(bool);
+    bool isFocused() const { return m_isFocused; }
 
-    private:
-        Page* m_page;
-        RefPtr<Frame> m_focusedFrame;
-        bool m_isActive;
-        bool m_isFocused;
-    };
+private:
+    bool advanceFocusDirectionally(FocusDirection, KeyboardEvent*);
+    bool advanceFocusInDocumentOrder(FocusDirection, KeyboardEvent*, bool initialFocus);
+
+    void findFocusableNodeInDirection(Document*, Node*, FocusDirection, KeyboardEvent*, FocusCandidate&);
+    void deepFindFocusableNodeInDirection(Node*, Node*, FocusDirection, KeyboardEvent*, FocusCandidate&);
+
+    Page* m_page;
+    RefPtr<Frame> m_focusedFrame;
+    bool m_isActive;
+    bool m_isFocused;
+    bool m_isChangingFocusedFrame;
+};
 
 } // namespace WebCore
     
diff --git a/src/3rdparty/webkit/WebCore/page/FocusDirection.h b/src/3rdparty/webkit/WebCore/page/FocusDirection.h
index 261c745bff..8a6d51f05b 100644
--- a/src/3rdparty/webkit/WebCore/page/FocusDirection.h
+++ b/src/3rdparty/webkit/WebCore/page/FocusDirection.h
@@ -28,8 +28,13 @@
 
 namespace WebCore {
     enum FocusDirection {
-        FocusDirectionForward = 0,
-        FocusDirectionBackward
+        FocusDirectionNone = 0,
+        FocusDirectionForward,
+        FocusDirectionBackward,
+        FocusDirectionUp,
+        FocusDirectionDown,
+        FocusDirectionLeft,
+        FocusDirectionRight
     };
 }
 
diff --git a/src/3rdparty/webkit/WebCore/page/Frame.cpp b/src/3rdparty/webkit/WebCore/page/Frame.cpp
index fab7e3fb33..614bbb9f10 100644
--- a/src/3rdparty/webkit/WebCore/page/Frame.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Frame.cpp
@@ -36,6 +36,7 @@
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CachedCSSStyleSheet.h"
+#include "Chrome.h"
 #include "DOMWindow.h"
 #include "DocLoader.h"
 #include "DocumentType.h"
@@ -74,6 +75,7 @@
 #include "TextIterator.h"
 #include "TextResourceDecoder.h"
 #include "UserContentURLPattern.h"
+#include "XMLNSNames.h"
 #include "XMLNames.h"
 #include "htmlediting.h"
 #include "markup.h"
@@ -102,6 +104,10 @@
 #include "MathMLNames.h"
 #endif
 
+#if ENABLE(TILED_BACKING_STORE)
+#include "TiledBackingStore.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -126,9 +132,7 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
     , m_redirectScheduler(this)
     , m_ownerElement(ownerElement)
     , m_script(this)
-    , m_selectionGranularity(CharacterGranularity)
     , m_selectionController(this)
-    , m_caretBlinkTimer(this, &Frame::caretBlinkTimerFired)
     , m_editor(this)
     , m_eventHandler(this)
     , m_animationController(this)
@@ -136,8 +140,6 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
 #if ENABLE(ORIENTATION_EVENTS)
     , m_orientation(0)
 #endif
-    , m_caretVisible(false)
-    , m_caretPaint(true)
     , m_highlightTextMatches(false)
     , m_inViewSourceMode(false)
     , m_needsReapplyStyles(false)
@@ -165,11 +167,16 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
     MathMLNames::init();
 #endif
 
+    XMLNSNames::init();
     XMLNames::init();
 
-    if (!ownerElement)
+    if (!ownerElement) {
         page->setMainFrame(this);
-    else {
+#if ENABLE(TILED_BACKING_STORE)
+        // Top level frame only for now.
+        setTiledBackingStoreEnabled(page->settings()->tiledBackingStoreEnabled());
+#endif
+    } else {
         page->incrementFrameCount();
         // Make sure we will not end up with two frames referencing the same owner element.
         ASSERT((!(ownerElement->m_contentFrame)) || (ownerElement->m_contentFrame->ownerElement() != ownerElement));
@@ -257,6 +264,11 @@ void Frame::setView(PassRefPtr<FrameView> view)
     // Since this part may be getting reused as a result of being
     // pulled from the back/forward cache, reset this flag.
     loader()->resetMultipleFormSubmissionProtection();
+    
+#if ENABLE(TILED_BACKING_STORE)
+    if (m_view && tiledBackingStore())
+        m_view->setPaintsEntireContents(true);
+#endif
 }
 
 ScriptController* Frame::script()
@@ -277,8 +289,7 @@ void Frame::setDocument(PassRefPtr<Document> newDoc)
     }
 
     m_doc = newDoc;
-    if (m_doc && selection()->isFocusedAndActive())
-        setUseSecureKeyboardEntry(m_doc->useSecureKeyboardEntryWhenActive());
+    selection()->updateSecureKeyboardEntryIfActive();
 
     if (m_doc && !m_doc->attached())
         m_doc->attach();
@@ -292,7 +303,7 @@ void Frame::sendOrientationChangeEvent(int orientation)
 {
     m_orientation = orientation;
     if (Document* doc = document())
-        doc->dispatchWindowEvent(eventNames().orientationchangeEvent, false, false);
+        doc->dispatchWindowEvent(Event::create(eventNames().orientationchangeEvent, false, false));
 }
 #endif // ENABLE(ORIENTATION_EVENTS)
     
@@ -358,12 +369,7 @@ Editor* Frame::editor() const
 
 TextGranularity Frame::selectionGranularity() const
 {
-    return m_selectionGranularity;
-}
-
-void Frame::setSelectionGranularity(TextGranularity granularity)
-{
-    m_selectionGranularity = granularity;
+    return m_selectionController.granularity();
 }
 
 SelectionController* Frame::dragCaretController() const
@@ -411,7 +417,7 @@ static RegularExpression* createRegExpForLabels(const Vector<String>& labels)
     return new RegularExpression(pattern, TextCaseInsensitive);
 }
 
-String Frame::searchForLabelsAboveCell(RegularExpression* regExp, HTMLTableCellElement* cell)
+String Frame::searchForLabelsAboveCell(RegularExpression* regExp, HTMLTableCellElement* cell, size_t* resultDistanceFromStartOfCell)
 {
     RenderObject* cellRenderer = cell->renderer();
 
@@ -425,23 +431,30 @@ String Frame::searchForLabelsAboveCell(RegularExpression* regExp, HTMLTableCellE
 
             if (aboveCell) {
                 // search within the above cell we found for a match
+                size_t lengthSearched = 0;    
                 for (Node* n = aboveCell->firstChild(); n; n = n->traverseNextNode(aboveCell)) {
                     if (n->isTextNode() && n->renderer() && n->renderer()->style()->visibility() == VISIBLE) {
                         // For each text chunk, run the regexp
                         String nodeString = n->nodeValue();
                         int pos = regExp->searchRev(nodeString);
-                        if (pos >= 0)
+                        if (pos >= 0) {
+                            if (resultDistanceFromStartOfCell)
+                                *resultDistanceFromStartOfCell = lengthSearched;
                             return nodeString.substring(pos, regExp->matchedLength());
+                        }
+                        lengthSearched += nodeString.length();
                     }
                 }
             }
         }
     }
     // Any reason in practice to search all cells in that are above cell?
+    if (resultDistanceFromStartOfCell)
+        *resultDistanceFromStartOfCell = notFound;
     return String();
 }
 
-String Frame::searchForLabelsBeforeElement(const Vector<String>& labels, Element* element)
+String Frame::searchForLabelsBeforeElement(const Vector<String>& labels, Element* element, size_t* resultDistance, bool* resultIsInCellAbove)
 {
     OwnPtr<RegularExpression> regExp(createRegExpForLabels(labels));
     // We stop searching after we've seen this many chars
@@ -453,6 +466,11 @@ String Frame::searchForLabelsBeforeElement(const Vector<String>& labels, Element
     HTMLTableCellElement* startingTableCell = 0;
     bool searchedCellAbove = false;
 
+    if (resultDistance)
+        *resultDistance = notFound;
+    if (resultIsInCellAbove)
+        *resultIsInCellAbove = false;
+    
     // walk backwards in the node tree, until another element, or form, or end of tree
     int unsigned lengthSearched = 0;
     Node* n;
@@ -468,9 +486,12 @@ String Frame::searchForLabelsBeforeElement(const Vector<String>& labels, Element
         } else if (n->hasTagName(tdTag) && !startingTableCell) {
             startingTableCell = static_cast<HTMLTableCellElement*>(n);
         } else if (n->hasTagName(trTag) && startingTableCell) {
-            String result = searchForLabelsAboveCell(regExp.get(), startingTableCell);
-            if (!result.isEmpty())
+            String result = searchForLabelsAboveCell(regExp.get(), startingTableCell, resultDistance);
+            if (!result.isEmpty()) {
+                if (resultIsInCellAbove)
+                    *resultIsInCellAbove = true;
                 return result;
+            }
             searchedCellAbove = true;
         } else if (n->isTextNode() && n->renderer() && n->renderer()->style()->visibility() == VISIBLE) {
             // For each text chunk, run the regexp
@@ -479,38 +500,48 @@ String Frame::searchForLabelsBeforeElement(const Vector<String>& labels, Element
             if (lengthSearched + nodeString.length() > maxCharsSearched)
                 nodeString = nodeString.right(charsSearchedThreshold - lengthSearched);
             int pos = regExp->searchRev(nodeString);
-            if (pos >= 0)
+            if (pos >= 0) {
+                if (resultDistance)
+                    *resultDistance = lengthSearched;
                 return nodeString.substring(pos, regExp->matchedLength());
+            }
             lengthSearched += nodeString.length();
         }
     }
 
     // If we started in a cell, but bailed because we found the start of the form or the
     // previous element, we still might need to search the row above us for a label.
-    if (startingTableCell && !searchedCellAbove)
-         return searchForLabelsAboveCell(regExp.get(), startingTableCell);
+    if (startingTableCell && !searchedCellAbove) {
+         String result = searchForLabelsAboveCell(regExp.get(), startingTableCell, resultDistance);
+        if (!result.isEmpty()) {
+            if (resultIsInCellAbove)
+                *resultIsInCellAbove = true;
+            return result;
+        }
+    }
     return String();
 }
 
-String Frame::matchLabelsAgainstElement(const Vector<String>& labels, Element* element)
+static String matchLabelsAgainstString(const Vector<String>& labels, const String& stringToMatch)
 {
-    String name = element->getAttribute(nameAttr);
-    if (name.isEmpty())
+    if (stringToMatch.isEmpty())
         return String();
 
-    // Make numbers and _'s in field names behave like word boundaries, e.g., "address2"
-    replace(name, RegularExpression("\\d", TextCaseSensitive), " ");
-    name.replace('_', ' ');
+    String mutableStringToMatch = stringToMatch;
 
+    // Make numbers and _'s in field names behave like word boundaries, e.g., "address2"
+    replace(mutableStringToMatch, RegularExpression("\\d", TextCaseSensitive), " ");
+    mutableStringToMatch.replace('_', ' ');
+    
     OwnPtr<RegularExpression> regExp(createRegExpForLabels(labels));
-    // Use the largest match we can find in the whole name string
+    // Use the largest match we can find in the whole string
     int pos;
     int length;
     int bestPos = -1;
     int bestLength = -1;
     int start = 0;
     do {
-        pos = regExp->match(name, start);
+        pos = regExp->match(mutableStringToMatch, start);
         if (pos != -1) {
             length = regExp->matchedLength();
             if (length >= bestLength) {
@@ -520,11 +551,24 @@ String Frame::matchLabelsAgainstElement(const Vector<String>& labels, Element* e
             start = pos + 1;
         }
     } while (pos != -1);
-
+    
     if (bestPos != -1)
-        return name.substring(bestPos, bestLength);
+        return mutableStringToMatch.substring(bestPos, bestLength);
     return String();
 }
+    
+String Frame::matchLabelsAgainstElement(const Vector<String>& labels, Element* element)
+{
+    // Match against the name element, then against the id element if no match is found for the name element.
+    // See 7538330 for one popular site that benefits from the id element check.
+    // FIXME: This code is mirrored in FrameMac.mm. It would be nice to make the Mac code call the platform-agnostic
+    // code, which would require converting the NSArray of NSStrings to a Vector of Strings somewhere along the way.
+    String resultFromNameAttribute = matchLabelsAgainstString(labels, element->getAttribute(nameAttr));
+    if (!resultFromNameAttribute.isEmpty())
+        return resultFromNameAttribute;
+    
+    return matchLabelsAgainstString(labels, element->getAttribute(idAttr));
+}
 
 const VisibleSelection& Frame::mark() const
 {
@@ -552,31 +596,6 @@ void Frame::notifyRendererOfSelectionChange(bool userTriggered)
         toRenderTextControl(renderer)->selectionChanged(userTriggered);
 }
 
-void Frame::invalidateSelection()
-{
-    selection()->setNeedsLayout();
-    selectionLayoutChanged();
-}
-
-void Frame::setCaretVisible(bool flag)
-{
-    if (m_caretVisible == flag)
-        return;
-    clearCaretRectIfNeeded();
-    m_caretVisible = flag;
-    selectionLayoutChanged();
-}
-
-void Frame::clearCaretRectIfNeeded()
-{
-#if ENABLE(TEXT_CARET)
-    if (m_caretPaint) {
-        m_caretPaint = false;
-        selection()->invalidateCaretRect();
-    }
-#endif
-}
-
 // Helper function that tells whether a particular node is an element that has an entire
 // Frame and FrameView, a <frame>, <iframe>, or <object>.
 static bool isFrameElement(const Node *n)
@@ -629,87 +648,6 @@ void Frame::setFocusedNodeIfNeeded()
         page()->focusController()->setFocusedNode(0, this);
 }
 
-void Frame::selectionLayoutChanged()
-{
-    bool caretRectChanged = selection()->recomputeCaretRect();
-
-#if ENABLE(TEXT_CARET)
-    bool caretBrowsing = settings() && settings()->caretBrowsingEnabled();
-    bool shouldBlink = m_caretVisible
-        && selection()->isCaret() && (selection()->isContentEditable() || caretBrowsing);
-
-    // If the caret moved, stop the blink timer so we can restart with a
-    // black caret in the new location.
-    if (caretRectChanged || !shouldBlink)
-        m_caretBlinkTimer.stop();
-
-    // Start blinking with a black caret. Be sure not to restart if we're
-    // already blinking in the right location.
-    if (shouldBlink && !m_caretBlinkTimer.isActive()) {
-        if (double blinkInterval = page()->theme()->caretBlinkInterval())
-            m_caretBlinkTimer.startRepeating(blinkInterval);
-
-        if (!m_caretPaint) {
-            m_caretPaint = true;
-            selection()->invalidateCaretRect();
-        }
-    }
-#else
-    if (!caretRectChanged)
-        return;
-#endif
-
-    RenderView* view = contentRenderer();
-    if (!view)
-        return;
-
-    VisibleSelection selection = this->selection()->selection();
-
-    if (!selection.isRange())
-        view->clearSelection();
-    else {
-        // Use the rightmost candidate for the start of the selection, and the leftmost candidate for the end of the selection.
-        // Example: foo <a>bar</a>.  Imagine that a line wrap occurs after 'foo', and that 'bar' is selected.   If we pass [foo, 3]
-        // as the start of the selection, the selection painting code will think that content on the line containing 'foo' is selected
-        // and will fill the gap before 'bar'.
-        Position startPos = selection.start();
-        if (startPos.downstream().isCandidate())
-            startPos = startPos.downstream();
-        Position endPos = selection.end();
-        if (endPos.upstream().isCandidate())
-            endPos = endPos.upstream();
-
-        // We can get into a state where the selection endpoints map to the same VisiblePosition when a selection is deleted
-        // because we don't yet notify the SelectionController of text removal.
-        if (startPos.isNotNull() && endPos.isNotNull() && selection.visibleStart() != selection.visibleEnd()) {
-            RenderObject *startRenderer = startPos.node()->renderer();
-            RenderObject *endRenderer = endPos.node()->renderer();
-            view->setSelection(startRenderer, startPos.deprecatedEditingOffset(), endRenderer, endPos.deprecatedEditingOffset());
-        }
-    }
-}
-
-void Frame::caretBlinkTimerFired(Timer<Frame>*)
-{
-#if ENABLE(TEXT_CARET)
-    ASSERT(m_caretVisible);
-    ASSERT(selection()->isCaret());
-    bool caretPaint = m_caretPaint;
-    if (selection()->isCaretBlinkingSuspended() && caretPaint)
-        return;
-    m_caretPaint = !caretPaint;
-    selection()->invalidateCaretRect();
-#endif
-}
-
-void Frame::paintCaret(GraphicsContext* p, int tx, int ty, const IntRect& clipRect) const
-{
-#if ENABLE(TEXT_CARET)
-    if (m_caretPaint && m_caretVisible)
-        selection()->paintCaret(p, tx, ty, clipRect);
-#endif
-}
-
 void Frame::paintDragCaret(GraphicsContext* p, int tx, int ty, const IntRect& clipRect) const
 {
 #if ENABLE(TEXT_CARET)
@@ -725,59 +663,51 @@ float Frame::zoomFactor() const
     return m_zoomFactor;
 }
 
-bool Frame::isZoomFactorTextOnly() const
+ZoomMode Frame::zoomMode() const
 {
-    return m_page->settings()->zoomsTextOnly();
+    return m_page->settings()->zoomMode();
 }
 
 bool Frame::shouldApplyTextZoom() const
 {
-    if (m_zoomFactor == 1.0f || !isZoomFactorTextOnly())
-        return false;
-#if ENABLE(SVG)
-    if (m_doc->isSVGDocument())
-        return false;
-#endif
-    return true;
+    return m_zoomFactor != 1.0f && zoomMode() == ZoomTextOnly;
 }
 
 bool Frame::shouldApplyPageZoom() const
 {
-    if (m_zoomFactor == 1.0f || isZoomFactorTextOnly())
-        return false;
-#if ENABLE(SVG)
-    if (m_doc->isSVGDocument())
-        return false;
-#endif
-    return true;
+    return m_zoomFactor != 1.0f && zoomMode() == ZoomPage;
 }
 
-void Frame::setZoomFactor(float percent, bool isTextOnly)
+void Frame::setZoomFactor(float percent, ZoomMode mode)
 {
-    if (m_zoomFactor == percent && isZoomFactorTextOnly() == isTextOnly)
+    if (m_zoomFactor == percent && zoomMode() == mode)
         return;
 
 #if ENABLE(SVG)
-    // SVG doesn't care if the zoom factor is text only.  It will always apply a
-    // zoom to the whole SVG.
+    // Respect SVGs zoomAndPan="disabled" property in standalone SVG documents.
+    // FIXME: How to handle compound documents + zoomAndPan="disabled"? Needs SVG WG clarification.
     if (m_doc->isSVGDocument()) {
         if (!static_cast<SVGDocument*>(m_doc.get())->zoomAndPanEnabled())
             return;
-        m_zoomFactor = percent;
-        m_page->settings()->setZoomsTextOnly(true); // We do this to avoid doing any scaling of CSS pixels, since the SVG has its own notion of zoom.
         if (m_doc->renderer())
-            m_doc->renderer()->repaint();
-        return;
+            m_doc->renderer()->setNeedsLayout(true);
     }
 #endif
 
+    if (mode == ZoomPage) {
+        // Update the scroll position when doing a full page zoom, so the content stays in relatively the same position.
+        IntPoint scrollPosition = view()->scrollPosition();
+        float percentDifference = (percent / m_zoomFactor);
+        view()->setScrollPosition(IntPoint(scrollPosition.x() * percentDifference, scrollPosition.y() * percentDifference));
+    }
+
     m_zoomFactor = percent;
-    m_page->settings()->setZoomsTextOnly(isTextOnly);
+    m_page->settings()->setZoomMode(mode);
 
     m_doc->recalcStyle(Node::Force);
 
     for (Frame* child = tree()->firstChild(); child; child = child->tree()->nextSibling())
-        child->setZoomFactor(m_zoomFactor, isTextOnly);
+        child->setZoomFactor(m_zoomFactor, mode);
 
     if (m_doc->renderer() && m_doc->renderer()->needsLayout() && view()->didFirstLayout())
         view()->layout();
@@ -786,7 +716,8 @@ void Frame::setZoomFactor(float percent, bool isTextOnly)
 void Frame::setPrinting(bool printing, float minPageWidth, float maxPageWidth, bool adjustViewSize)
 {
     m_doc->setPrinting(printing);
-    view()->setMediaType(printing ? "print" : "screen");
+    view()->adjustMediaTypeForPrinting(printing);
+
     m_doc->updateStyleSelector();
     view()->forceLayoutWithPageWidthRange(minPageWidth, maxPageWidth, adjustViewSize);
 
@@ -870,10 +801,10 @@ void Frame::injectUserScripts(UserScriptInjectionTime injectionTime)
         return;
     UserScriptMap::const_iterator end = userScripts->end();
     for (UserScriptMap::const_iterator it = userScripts->begin(); it != end; ++it)
-        injectUserScriptsForWorld(it->first, *it->second, injectionTime);
+        injectUserScriptsForWorld(it->first.get(), *it->second, injectionTime);
 }
 
-void Frame::injectUserScriptsForWorld(unsigned worldID, const UserScriptVector& userScripts, UserScriptInjectionTime injectionTime)
+void Frame::injectUserScriptsForWorld(DOMWrapperWorld* world, const UserScriptVector& userScripts, UserScriptInjectionTime injectionTime)
 {
     if (userScripts.isEmpty())
         return;
@@ -887,9 +818,8 @@ void Frame::injectUserScriptsForWorld(unsigned worldID, const UserScriptVector&
     for (unsigned i = 0; i < count; ++i) {
         UserScript* script = userScripts[i].get();
         if (script->injectionTime() == injectionTime && UserContentURLPattern::matchesPatterns(doc->url(), script->whitelist(), script->blacklist()))
-            sourceCode.append(ScriptSourceCode(script->source(), script->url()));
+            m_script.evaluateInWorld(ScriptSourceCode(script->source(), script->url()), world);
     }
-    script()->evaluateInIsolatedWorld(worldID, sourceCode);
 }
 
 bool Frame::shouldChangeSelection(const VisibleSelection& newSelection) const
@@ -915,20 +845,6 @@ bool Frame::isContentEditable() const
     return m_doc->inDesignMode();
 }
 
-#if !PLATFORM(MAC)
-
-void Frame::setUseSecureKeyboardEntry(bool)
-{
-}
-
-#endif
-
-void Frame::updateSecureKeyboardEntryIfActive()
-{
-    if (selection()->isFocusedAndActive())
-        setUseSecureKeyboardEntry(m_doc->useSecureKeyboardEntryWhenActive());
-}
-
 CSSMutableStyleDeclaration *Frame::typingStyle() const
 {
     return m_typingStyle.get();
@@ -1240,7 +1156,7 @@ FloatRect Frame::selectionBounds(bool clipToVisibleContent) const
     return clipToVisibleContent ? intersection(selectionRect, view->visibleContentRect()) : selectionRect;
 }
 
-void Frame::selectionTextRects(Vector<FloatRect>& rects, bool clipToVisibleContent) const
+void Frame::selectionTextRects(Vector<FloatRect>& rects, SelectionRectRespectTransforms respectTransforms, bool clipToVisibleContent) const
 {
     RenderView* root = contentRenderer();
     if (!root)
@@ -1248,19 +1164,36 @@ void Frame::selectionTextRects(Vector<FloatRect>& rects, bool clipToVisibleConte
 
     RefPtr<Range> selectedRange = selection()->toNormalizedRange();
 
-    Vector<IntRect> intRects;
-    selectedRange->textRects(intRects, true);
-
-    unsigned size = intRects.size();
     FloatRect visibleContentRect = m_view->visibleContentRect();
-    for (unsigned i = 0; i < size; ++i)
-        if (clipToVisibleContent)
-            rects.append(intersection(intRects[i], visibleContentRect));
-        else
-            rects.append(intRects[i]);
+    
+    // FIMXE: we are appending empty rects to the list for those that fall outside visibleContentRect.
+    // We may not want to do that.
+    if (respectTransforms) {
+        Vector<FloatQuad> quads;
+        selectedRange->textQuads(quads, true);
+
+        unsigned size = quads.size();
+        for (unsigned i = 0; i < size; ++i) {
+            IntRect currRect = quads[i].enclosingBoundingBox();
+            if (clipToVisibleContent)
+                rects.append(intersection(currRect, visibleContentRect));
+            else
+                rects.append(currRect);
+        }
+    } else {
+        Vector<IntRect> intRects;
+        selectedRange->textRects(intRects, true);
+
+        unsigned size = intRects.size();
+        for (unsigned i = 0; i < size; ++i) {
+            if (clipToVisibleContent)
+                rects.append(intersection(intRects[i], visibleContentRect));
+            else
+                rects.append(intRects[i]);
+        }
+    }
 }
 
-
 // Scans logically forward from "start", including any child frames
 static HTMLFormElement *scanForForm(Node *start)
 {
@@ -1523,12 +1456,6 @@ unsigned Frame::markAllMatchesForText(const String& target, bool caseFlag, unsig
             continue;
         }
 
-        // A non-collapsed result range can in some funky whitespace cases still not
-        // advance the range's start position (4509328). Break to avoid infinite loop.
-        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
-        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
-            break;
-
         // Only treat the result as a match if it is visible
         if (editor()->insideVisibleArea(resultRange.get())) {
             ++matchCount;
@@ -1539,7 +1466,12 @@ unsigned Frame::markAllMatchesForText(const String& target, bool caseFlag, unsig
         if (limit > 0 && matchCount >= limit)
             break;
 
-        setStart(searchRange.get(), newStart);
+        // Set the new start for the search range to be the end of the previous
+        // result range. There is no need to use a VisiblePosition here,
+        // since findPlainText will use a TextIterator to go over the visible
+        // text nodes. 
+        searchRange->setStart(resultRange->endContainer(exception), resultRange->endOffset(exception), exception);
+
         Node* shadowTreeRoot = searchRange->shadowTreeRootNode();
         if (searchRange->collapsed(exception) && shadowTreeRoot)
             searchRange->setEnd(shadowTreeRoot, shadowTreeRoot->childNodeCount(), exception);
@@ -1646,6 +1578,54 @@ void Frame::disconnectOwnerElement()
     m_ownerElement = 0;
 }
 
+// The frame is moved in DOM, potentially to another page.
+void Frame::transferChildFrameToNewDocument()
+{
+    ASSERT(m_ownerElement);
+    Frame* newParent = m_ownerElement->document()->frame();
+    bool didTransfer = false;
+
+    // Switch page.
+    Page* newPage = newParent ? newParent->page() : 0;
+    if (m_page != newPage) {
+        if (page()->focusController()->focusedFrame() == this)
+            page()->focusController()->setFocusedFrame(0);
+
+        if (m_page)
+            m_page->decrementFrameCount();
+
+        m_page = newPage;
+
+        if (newPage)
+            newPage->incrementFrameCount();
+
+        didTransfer = true;
+    }
+
+    // Update the frame tree.
+    Frame* oldParent = tree()->parent();
+    if (oldParent != newParent) {
+        if (oldParent)
+            oldParent->tree()->removeChild(this);
+        if (newParent) {
+            newParent->tree()->appendChild(this);
+            m_ownerElement->setName();
+        }
+        didTransfer = true;
+    }
+
+    // Avoid unnecessary calls to client and frame subtree if the frame ended
+    // up on the same page and under the same parent frame.
+    if (didTransfer) {
+        // Let external clients update themselves.
+        loader()->client()->didTransferChildFrameToNewDocument();
+
+        // Do the same for all the children.
+        for (Frame* child = tree()->firstChild(); child; child = child->tree()->nextSibling())
+            child->transferChildFrameToNewDocument();
+    }
+}
+
 String Frame::documentTypeString() const
 {
     if (DocumentType* doctype = document()->doctype())
@@ -1827,4 +1807,51 @@ void Frame::createView(const IntSize& viewportSize,
         view()->setCanHaveScrollbars(owner->scrollingMode() != ScrollbarAlwaysOff);
 }
 
+#if ENABLE(TILED_BACKING_STORE)
+void Frame::setTiledBackingStoreEnabled(bool enabled)
+{
+    if (!enabled) {
+        m_tiledBackingStore.clear();
+        return;
+    }
+    if (m_tiledBackingStore)
+        return;
+    m_tiledBackingStore.set(new TiledBackingStore(this));
+    if (m_view)
+        m_view->setPaintsEntireContents(true);
+}
+
+void Frame::tiledBackingStorePaintBegin()
+{
+    if (!m_view)
+        return;
+    m_view->layoutIfNeededRecursive();
+    m_view->flushDeferredRepaints();
+}
+
+void Frame::tiledBackingStorePaint(GraphicsContext* context, const IntRect& rect)
+{
+    if (!m_view)
+        return;
+    m_view->paintContents(context, rect);
+}
+
+void Frame::tiledBackingStorePaintEnd(const Vector<IntRect>& paintedArea)
+{
+    if (!m_page || !m_view)
+        return;
+    unsigned size = paintedArea.size();
+    // Request repaint from the system
+    for (int n = 0; n < size; ++n)
+        m_page->chrome()->invalidateContentsAndWindow(m_view->contentsToWindow(paintedArea[n]), false);
+}
+
+IntRect Frame::tiledBackingStoreContentsRect()
+{
+    if (!m_view)
+        return IntRect();
+    return IntRect(IntPoint(), m_view->contentsSize());
+}
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Frame.h b/src/3rdparty/webkit/WebCore/page/Frame.h
index 6208bbdfe1..65bdeb0326 100644
--- a/src/3rdparty/webkit/WebCore/page/Frame.h
+++ b/src/3rdparty/webkit/WebCore/page/Frame.h
@@ -29,24 +29,25 @@
 #define Frame_h
 
 #include "AnimationController.h"
-#include "Document.h"
 #include "DragImage.h"
-#include "EditAction.h"
 #include "Editor.h"
 #include "EventHandler.h"
 #include "FrameLoader.h"
 #include "FrameTree.h"
-#include "Range.h"
 #include "ScriptController.h"
 #include "ScrollBehavior.h"
 #include "SelectionController.h"
-#include "TextGranularity.h"
 #include "UserScriptTypes.h"
+#include "ZoomMode.h"
 
 #if PLATFORM(WIN)
 #include "FrameWin.h"
 #endif
 
+#if ENABLE(TILED_BACKING_STORE)
+#include "TiledBackingStoreClient.h"
+#endif
+
 #if PLATFORM(MAC)
 #ifndef __OBJC__
 class NSArray;
@@ -64,26 +65,16 @@ typedef struct HBITMAP__* HBITMAP;
 namespace WebCore {
 
     class CSSMutableStyleDeclaration;
-    class Editor;
-    class EventHandler;
-    class FrameLoader;
-    class RedirectScheduler;
-    class FrameLoaderClient;
-    class FrameTree;
-    class FrameView;
-    class HTMLFrameOwnerElement;
     class HTMLTableCellElement;
     class RegularExpression;
     class RenderPart;
-    class ScriptController;
-    class SelectionController;
-    class Settings;
-    class VisibleSelection;
-    class Widget;
-
-    template <typename T> class Timer;
+    class TiledBackingStore;
 
-    class Frame : public RefCounted<Frame> {
+    class Frame : public RefCounted<Frame>
+#if ENABLE(TILED_BACKING_STORE)
+        , public TiledBackingStoreClient
+#endif
+    {
     public:
         static PassRefPtr<Frame> create(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient* client)
         {
@@ -96,6 +87,8 @@ namespace WebCore {
 
         Page* page() const;
         void detachFromPage();
+        void transferChildFrameToNewDocument();
+
         HTMLFrameOwnerElement* ownerElement() const;
 
         void pageDestroyed();
@@ -131,7 +124,7 @@ namespace WebCore {
         void injectUserScripts(UserScriptInjectionTime);
 
     private:
-        void injectUserScriptsForWorld(unsigned worldID, const UserScriptVector&, UserScriptInjectionTime);
+        void injectUserScriptsForWorld(DOMWrapperWorld*, const UserScriptVector&, UserScriptInjectionTime);
 
     private:
         Frame(Page*, HTMLFrameOwnerElement*, FrameLoaderClient*);
@@ -181,15 +174,20 @@ namespace WebCore {
             return document() ? document()->displayStringModifiedByEncoding(str) : str;
         }
 
+#if ENABLE(TILED_BACKING_STORE)
+        TiledBackingStore* tiledBackingStore() const { return m_tiledBackingStore.get(); }
+        void setTiledBackingStoreEnabled(bool);
+#endif
+
     private:
         void lifeSupportTimerFired(Timer<Frame>*);
 
     // === to be moved into FrameView
 
     public:
-        void setZoomFactor(float scale, bool isTextOnly);
+        void setZoomFactor(float scale, ZoomMode);
         float zoomFactor() const;
-        bool isZoomFactorTextOnly() const;
+        ZoomMode zoomMode() const;
         bool shouldApplyTextZoom() const;
         bool shouldApplyPageZoom() const;
         float pageZoomFactor() const { return shouldApplyPageZoom() ? zoomFactor() : 1.0f; }
@@ -250,59 +248,54 @@ namespace WebCore {
 
     public:
         TextGranularity selectionGranularity() const;
-        void setSelectionGranularity(TextGranularity);
 
         bool shouldChangeSelection(const VisibleSelection&) const;
         bool shouldDeleteSelection(const VisibleSelection&) const;
-        void clearCaretRectIfNeeded();
         void setFocusedNodeIfNeeded();
-        void selectionLayoutChanged();
         void notifyRendererOfSelectionChange(bool userTriggered);
 
-        void invalidateSelection();
-
-        void setCaretVisible(bool = true);
-        void paintCaret(GraphicsContext*, int tx, int ty, const IntRect& clipRect) const;
         void paintDragCaret(GraphicsContext*, int tx, int ty, const IntRect& clipRect) const;
 
         bool isContentEditable() const; // if true, everything in frame is editable
 
-        void updateSecureKeyboardEntryIfActive();
-
         CSSMutableStyleDeclaration* typingStyle() const;
         void setTypingStyle(CSSMutableStyleDeclaration*);
         void clearTypingStyle();
 
         FloatRect selectionBounds(bool clipToVisibleContent = true) const;
-        void selectionTextRects(Vector<FloatRect>&, bool clipToVisibleContent = true) const;
+        enum SelectionRectRespectTransforms { RespectTransforms = true, IgnoreTransforms = false };
+        void selectionTextRects(Vector<FloatRect>&, SelectionRectRespectTransforms respectTransforms, bool clipToVisibleContent = true) const;
 
         HTMLFormElement* currentForm() const;
 
         void revealSelection(const ScrollAlignment& = ScrollAlignment::alignCenterIfNeeded, bool revealExtent = false);
         void setSelectionFromNone();
 
-        void setUseSecureKeyboardEntry(bool);
-
-    private:
-        void caretBlinkTimerFired(Timer<Frame>*);
-
-    public:
         SelectionController* dragCaretController() const;
 
-        String searchForLabelsAboveCell(RegularExpression*, HTMLTableCellElement*);
-        String searchForLabelsBeforeElement(const Vector<String>& labels, Element*);
+        String searchForLabelsAboveCell(RegularExpression*, HTMLTableCellElement*, size_t* resultDistanceFromStartOfCell);
+        String searchForLabelsBeforeElement(const Vector<String>& labels, Element*, size_t* resultDistance, bool* resultIsInCellAbove);
         String matchLabelsAgainstElement(const Vector<String>& labels, Element*);
 
         VisiblePosition visiblePositionForPoint(const IntPoint& framePoint);
         Document* documentAtPoint(const IntPoint& windowPoint);
+        
+    private:
+#if ENABLE(TILED_BACKING_STORE)
+        // TiledBackingStoreClient interface
+        virtual void tiledBackingStorePaintBegin();
+        virtual void tiledBackingStorePaint(GraphicsContext*, const IntRect&);
+        virtual void tiledBackingStorePaintEnd(const Vector<IntRect>& paintedArea);
+        virtual IntRect tiledBackingStoreContentsRect();
+#endif
 
     #if PLATFORM(MAC)
 
     // === undecided, would like to consider moving to another class
 
     public:
-        NSString* searchForNSLabelsAboveCell(RegularExpression*, HTMLTableCellElement*);
-        NSString* searchForLabelsBeforeElement(NSArray* labels, Element*);
+        NSString* searchForNSLabelsAboveCell(RegularExpression*, HTMLTableCellElement*, size_t* resultDistanceFromStartOfCell);
+        NSString* searchForLabelsBeforeElement(NSArray* labels, Element*, size_t* resultDistance, bool* resultIsInCellAbove);
         NSString* matchLabelsAgainstElement(NSArray* labels, Element*);
 
     #if ENABLE(DASHBOARD_SUPPORT)
@@ -352,11 +345,8 @@ namespace WebCore {
 
         float m_zoomFactor;
 
-        TextGranularity m_selectionGranularity;
-
         mutable SelectionController m_selectionController;
         mutable VisibleSelection m_mark;
-        Timer<Frame> m_caretBlinkTimer;
         mutable Editor m_editor;
         mutable EventHandler m_eventHandler;
         mutable AnimationController m_animationController;
@@ -368,15 +358,16 @@ namespace WebCore {
 #if ENABLE(ORIENTATION_EVENTS)
         int m_orientation;
 #endif
-        
-        bool m_caretVisible;
-        bool m_caretPaint;
 
         bool m_highlightTextMatches;
         bool m_inViewSourceMode;
         bool m_needsReapplyStyles;
         bool m_isDisconnected;
         bool m_excludeFromTextSearch;
+
+#if ENABLE(TILED_BACKING_STORE)        
+        OwnPtr<TiledBackingStore> m_tiledBackingStore;
+#endif
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/FrameTree.cpp b/src/3rdparty/webkit/WebCore/page/FrameTree.cpp
index 41caa9c1b6..d6170e1359 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameTree.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FrameTree.cpp
@@ -25,7 +25,6 @@
 #include "Page.h"
 #include "PageGroup.h"
 #include <stdarg.h>
-#include <wtf/Platform.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Vector.h>
 
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.cpp b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
index 4c3a0abf09..45764de9b6 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
@@ -29,6 +29,7 @@
 
 #include "AXObjectCache.h"
 #include "CSSStyleSelector.h"
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "DocLoader.h"
 #include "EventHandler.h"
@@ -45,8 +46,8 @@
 #include "HTMLNames.h"
 #include "InspectorTimelineAgent.h"
 #include "OverflowEvent.h"
+#include "RenderEmbeddedObject.h"
 #include "RenderPart.h"
-#include "RenderPartObject.h"
 #include "RenderScrollbar.h"
 #include "RenderScrollbarPart.h"
 #include "RenderTheme.h"
@@ -69,6 +70,9 @@
 #include "SVGViewSpec.h"
 #endif
 
+#if ENABLE(TILED_BACKING_STORE)
+#include "TiledBackingStore.h"
+#endif
 
 namespace WebCore {
 
@@ -98,13 +102,14 @@ static const double deferredRepaintDelayIncrementDuringLoading = 0;
 // The maximum number of updateWidgets iterations that should be done before returning.
 static const unsigned maxUpdateWidgetsIterations = 2;
 
-struct ScheduledEvent {
+struct ScheduledEvent : Noncopyable {
     RefPtr<Event> m_event;
     RefPtr<Node> m_eventTarget;
 };
 
 FrameView::FrameView(Frame* frame)
     : m_frame(frame)
+    , m_canHaveScrollbars(true)
     , m_slowRepaintObjectCount(0)
     , m_fixedObjectCount(0)
     , m_layoutTimer(this, &FrameView::layoutTimerFired)
@@ -198,7 +203,7 @@ void FrameView::reset()
     m_deferredRepaintDelay = initialDeferredRepaintDelayDuringLoading;
     m_deferredRepaintTimer.stop();
     m_lastPaintTime = 0;
-    m_paintRestriction = PaintRestrictionNone;
+    m_paintBehavior = PaintBehaviorNormal;
     m_isPainting = false;
     m_isVisuallyNonEmpty = false;
     m_firstVisuallyNonEmptyLayoutCallbackPending = true;
@@ -220,7 +225,10 @@ void FrameView::resetScrollbars()
     // Reset the document's scrollbars back to our defaults before we yield the floor.
     m_firstLayout = true;
     setScrollbarsSuppressed(true);
-    setScrollbarModes(ScrollbarAuto, ScrollbarAuto);
+    if (m_canHaveScrollbars)
+        setScrollbarModes(ScrollbarAuto, ScrollbarAuto);
+    else
+        setScrollbarModes(ScrollbarAlwaysOff, ScrollbarAlwaysOff);
     setScrollbarsSuppressed(false);
 }
 
@@ -288,7 +296,7 @@ void FrameView::invalidateRect(const IntRect& rect)
 {
     if (!parent()) {
         if (hostWindow())
-            hostWindow()->repaint(rect, true);
+            hostWindow()->invalidateContentsAndWindow(rect, false /*immediate*/);
         return;
     }
 
@@ -317,6 +325,40 @@ void FrameView::setMarginHeight(int h)
     m_margins.setHeight(h);
 }
 
+bool FrameView::avoidScrollbarCreation()
+{
+    ASSERT(m_frame);
+
+    // with frame flattening no subframe can have scrollbars
+    // but we also cannot turn scrollbars of as we determine
+    // our flattening policy using that.
+
+    if (!m_frame->ownerElement())
+        return false;
+
+    if (!m_frame->settings() || m_frame->settings()->frameFlatteningEnabled())
+        return true;
+
+    return false;
+}
+
+void FrameView::setCanHaveScrollbars(bool canHaveScrollbars)
+{
+    m_canHaveScrollbars = canHaveScrollbars;
+    ScrollView::setCanHaveScrollbars(canHaveScrollbars);
+}
+
+void FrameView::updateCanHaveScrollbars()
+{
+    ScrollbarMode hMode;
+    ScrollbarMode vMode;
+    scrollbarModes(hMode, vMode);
+    if (hMode == ScrollbarAlwaysOff && vMode == ScrollbarAlwaysOff)
+        m_canHaveScrollbars = false;
+    else
+        m_canHaveScrollbars = true;
+}
+
 PassRefPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientation)
 {
     // FIXME: We need to update the scrollbar dynamically as documents change (or as doc elements and bodies get discovered that have custom styles).
@@ -325,7 +367,7 @@ PassRefPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientatio
     // Try the <body> element first as a scrollbar source.
     Element* body = doc ? doc->body() : 0;
     if (body && body->renderer() && body->renderer()->style()->hasPseudoStyle(SCROLLBAR))
-        return RenderScrollbar::createCustomScrollbar(this, orientation, body->renderBox());
+        return RenderScrollbar::createCustomScrollbar(this, orientation, body->renderer()->enclosingBox());
     
     // If the <body> didn't have a custom style, then the root element might.
     Element* docElement = doc ? doc->documentElement() : 0;
@@ -343,6 +385,9 @@ PassRefPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientatio
 
 void FrameView::setContentsSize(const IntSize& size)
 {
+    if (size == contentsSize())
+        return;
+
     m_deferSetNeedsLayouts++;
 
     ScrollView::setContentsSize(size);
@@ -352,7 +397,7 @@ void FrameView::setContentsSize(const IntSize& size)
         return;
 
     page->chrome()->contentsSizeChanged(frame(), size); //notify only
-    
+
     m_deferSetNeedsLayouts--;
     
     if (!m_deferSetNeedsLayouts)
@@ -365,6 +410,7 @@ void FrameView::adjustViewSize()
     RenderView* root = m_frame->contentRenderer();
     if (!root)
         return;
+
     setContentsSize(IntSize(root->rightLayoutOverflow(), root->bottomLayoutOverflow()));
 }
 
@@ -415,12 +461,12 @@ void FrameView::updateCompositingLayers()
         return;
 
     // This call will make sure the cached hasAcceleratedCompositing is updated from the pref
-    view->compositor()->cacheAcceleratedCompositingEnabledFlag();
+    view->compositor()->cacheAcceleratedCompositingFlags();
     
     if (!view->usesCompositing())
         return;
 
-    view->compositor()->updateCompositingLayers();
+    view->compositor()->updateCompositingLayers(CompositingUpdateAfterLayoutOrStyleChange);
 }
 
 void FrameView::setNeedsOneShotDrawingSynchronization()
@@ -458,8 +504,22 @@ bool FrameView::syncCompositingStateRecursive()
         }
     }
     return allSubframesSynced;
-#endif // USE(ACCELERATED_COMPOSITING)
+#else // USE(ACCELERATED_COMPOSITING)
+    return true;
+#endif
+}
+
+bool FrameView::isSoftwareRenderable() const
+{
+#if USE(ACCELERATED_COMPOSITING)
+    RenderView* view = m_frame->contentRenderer();
+    if (!view)
+        return true;
+
+    return !view->compositor()->has3DContent();
+#else
     return true;
+#endif
 }
 
 void FrameView::didMoveOnscreen()
@@ -505,9 +565,8 @@ void FrameView::layout(bool allowSubtree)
     if (isPainting())
         return;
 
-#if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
-    if (timelineAgent)
+#if ENABLE(INSPECTOR)    
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->willLayout();
 #endif
 
@@ -564,27 +623,42 @@ void FrameView::layout(bool allowSubtree)
 
     ScrollbarMode hMode;
     ScrollbarMode vMode;
-    scrollbarModes(hMode, vMode);
+    if (m_canHaveScrollbars) {
+        hMode = ScrollbarAuto;
+        vMode = ScrollbarAuto;
+    } else {
+        hMode = ScrollbarAlwaysOff;
+        vMode = ScrollbarAlwaysOff;
+    }
 
     if (!subtree) {
-        RenderObject* rootRenderer = document->documentElement() ? document->documentElement()->renderer() : 0;
+        Node* documentElement = document->documentElement();
+        RenderObject* rootRenderer = documentElement ? documentElement->renderer() : 0;
         Node* body = document->body();
         if (body && body->renderer()) {
-            if (body->hasTagName(framesetTag)) {
+            if (body->hasTagName(framesetTag) && !m_frame->settings()->frameFlatteningEnabled()) {
                 body->renderer()->setChildNeedsLayout(true);
                 vMode = ScrollbarAlwaysOff;
                 hMode = ScrollbarAlwaysOff;
             } else if (body->hasTagName(bodyTag)) {
-                if (!m_firstLayout && m_size.height() != layoutHeight()
-                        && toRenderBox(body->renderer())->stretchesToViewHeight())
+                if (!m_firstLayout && m_size.height() != layoutHeight() && body->renderer()->enclosingBox()->stretchesToViewHeight())
                     body->renderer()->setChildNeedsLayout(true);
                 // It's sufficient to just check the X overflow,
                 // since it's illegal to have visible in only one direction.
                 RenderObject* o = rootRenderer->style()->overflowX() == OVISIBLE && document->documentElement()->hasTagName(htmlTag) ? body->renderer() : rootRenderer;
                 applyOverflowToViewport(o, hMode, vMode);
             }
-        } else if (rootRenderer)
+        } else if (rootRenderer) {
+#if ENABLE(SVG)
+            if (documentElement->isSVGElement()) {
+                if (!m_firstLayout && (m_size.width() != layoutWidth() || m_size.height() != layoutHeight()))
+                    rootRenderer->setChildNeedsLayout(true);
+            } else
+                applyOverflowToViewport(rootRenderer, hMode, vMode);
+#else
             applyOverflowToViewport(rootRenderer, hMode, vMode);
+#endif
+        }
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
         if (m_firstLayout && !document->ownerElement())
             printf("Elapsed time before first layout: %d\n", document->elapsedTime());
@@ -629,8 +703,14 @@ void FrameView::layout(bool allowSubtree)
 
     pauseScheduledEvents();
 
-    if (subtree)
-        root->view()->pushLayoutState(root);
+    bool disableLayoutState = false;
+    if (subtree) {
+        RenderView* view = root->view();
+        disableLayoutState = view->shouldDisableLayoutStateForSubtree(root);
+        view->pushLayoutState(root);
+        if (disableLayoutState)
+            view->disableLayoutState();
+    }
         
     m_midLayout = true;
     beginDeferredRepaints();
@@ -638,11 +718,16 @@ void FrameView::layout(bool allowSubtree)
     endDeferredRepaints();
     m_midLayout = false;
 
-    if (subtree)
-        root->view()->popLayoutState();
+    if (subtree) {
+        RenderView* view = root->view();
+        view->popLayoutState();
+        if (disableLayoutState)
+            view->enableLayoutState();
+    }
     m_layoutRoot = 0;
 
-    m_frame->invalidateSelection();
+    m_frame->selection()->setNeedsLayout();
+    m_frame->selection()->updateAppearance();
    
     m_layoutSchedulingEnabled = true;
 
@@ -697,22 +782,22 @@ void FrameView::layout(bool allowSubtree)
     }
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->didLayout();
 #endif
 
     m_nestedLayoutCount--;
 }
 
-void FrameView::addWidgetToUpdate(RenderPartObject* object)
+void FrameView::addWidgetToUpdate(RenderEmbeddedObject* object)
 {
     if (!m_widgetUpdateSet)
-        m_widgetUpdateSet.set(new HashSet<RenderPartObject*>);
+        m_widgetUpdateSet.set(new RenderEmbeddedObjectSet);
 
     m_widgetUpdateSet->add(object);
 }
 
-void FrameView::removeWidgetToUpdate(RenderPartObject* object)
+void FrameView::removeWidgetToUpdate(RenderEmbeddedObject* object)
 {
     if (!m_widgetUpdateSet)
         return;
@@ -734,11 +819,29 @@ String FrameView::mediaType() const
     return m_mediaType;
 }
 
+void FrameView::adjustMediaTypeForPrinting(bool printing)
+{
+    if (printing) {
+        if (m_mediaTypeWhenNotPrinting.isNull())
+            m_mediaTypeWhenNotPrinting = mediaType();
+            setMediaType("print");
+    } else {
+        if (!m_mediaTypeWhenNotPrinting.isNull())
+            setMediaType(m_mediaTypeWhenNotPrinting);
+        m_mediaTypeWhenNotPrinting = String();
+    }
+}
+
 bool FrameView::useSlowRepaints() const
 {
     return m_useSlowRepaints || m_slowRepaintObjectCount > 0 || (platformWidget() && m_fixedObjectCount > 0) || m_isOverlapped || !m_contentIsOpaque;
 }
 
+bool FrameView::useSlowRepaintsIfNotOverlapped() const
+{
+    return m_useSlowRepaints || m_slowRepaintObjectCount > 0 || (platformWidget() && m_fixedObjectCount > 0) || !m_contentIsOpaque;
+}
+
 void FrameView::setUseSlowRepaints()
 {
     m_useSlowRepaints = true;
@@ -770,12 +873,12 @@ void FrameView::addFixedObject()
 void FrameView::removeFixedObject()
 {
     ASSERT(m_fixedObjectCount > 0);
-    m_fixedObjectCount--;
+    --m_fixedObjectCount;
     if (!m_fixedObjectCount)
         setCanBlitOnScroll(!useSlowRepaints());
 }
 
-void FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect)
+bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect)
 {
     const size_t fixedObjectThreshold = 5;
 
@@ -785,7 +888,7 @@ void FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect
 
     if (!positionedObjects || positionedObjects->isEmpty()) {
         hostWindow()->scroll(scrollDelta, rectToScroll, clipRect);
-        return;
+        return true;
     }
 
     // Get the rects of the fixed objects visible in the rectToScroll
@@ -814,7 +917,7 @@ void FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect
         // 1) scroll
         hostWindow()->scroll(scrollDelta, rectToScroll, clipRect);
 
-        // 2) update the area of fixed objets that has been invalidated
+        // 2) update the area of fixed objects that has been invalidated
         size_t fixObjectsCount = subRectToUpdate.size();
         for (size_t i = 0; i < fixObjectsCount; ++i) {
             IntRect updateRect = subRectToUpdate[i];
@@ -822,14 +925,13 @@ void FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect
             scrolledRect.move(scrollDelta);
             updateRect.unite(scrolledRect);
             updateRect.intersect(rectToScroll);
-            hostWindow()->repaint(updateRect, true, false, true);
+            hostWindow()->invalidateContentsAndWindow(updateRect, false);
         }
-    } else {
-        // the number of fixed objects exceed the threshold, so we repaint everything.
-        IntRect updateRect = clipRect;
-        updateRect.intersect(rectToScroll);
-        hostWindow()->repaint(updateRect, true, false, true);
+        return true;
     }
+
+    // the number of fixed objects exceed the threshold, we cannot use the fast path
+    return false;
 }
 
 void FrameView::setIsOverlapped(bool isOverlapped)
@@ -959,16 +1061,18 @@ void FrameView::scrollPositionChanged()
 {
     frame()->eventHandler()->sendScrollEvent();
 
+    // For fixed position elements, update widget positions and compositing layers after scrolling,
+    // but only if we're not inside of layout.
+    // FIXME: we could skip this if we knew the page had no fixed position elements.
+    if (!m_nestedLayoutCount) {
+        if (RenderView* root = m_frame->contentRenderer()) {
+            root->updateWidgetPositions();
 #if USE(ACCELERATED_COMPOSITING)
-    // We need to update layer positions after scrolling to account for position:fixed layers.
-    Document* document = m_frame->document();
-    if (!document)
-        return;
-
-    RenderLayer* layer = document->renderer() ? document->renderer()->enclosingLayer() : 0;
-    if (layer)
-        layer->updateLayerPositions(RenderLayer::UpdateCompositingLayers);
+            if (root->usesCompositing())
+                root->compositor()->updateCompositingLayers(CompositingUpdateOnScroll);
 #endif
+        }
+    }
 }
 
 HostWindow* FrameView::hostWindow() const
@@ -987,9 +1091,10 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
 
     double delay = adjustedDeferredRepaintDelay();
     if ((m_deferringRepaints || m_deferredRepaintTimer.isActive() || delay) && !immediate) {
-        IntRect visibleContent = visibleContentRect();
-        visibleContent.intersect(r);
-        if (visibleContent.isEmpty())
+        IntRect paintRect = r;
+        if (!paintsEntireContents())
+            paintRect.intersect(visibleContentRect());
+        if (paintRect.isEmpty())
             return;
         if (m_repaintCount == cRepaintRectUnionThreshold) {
             IntRect unionedRect;
@@ -999,9 +1104,9 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
             m_repaintRects.append(unionedRect);
         }
         if (m_repaintCount < cRepaintRectUnionThreshold)
-            m_repaintRects.append(visibleContent);
+            m_repaintRects.append(paintRect);
         else
-            m_repaintRects[0].unite(visibleContent);
+            m_repaintRects[0].unite(paintRect);
         m_repaintCount++;
     
         if (!m_deferringRepaints && !m_deferredRepaintTimer.isActive())
@@ -1012,6 +1117,12 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
     if (!immediate && isOffscreen() && !shouldUpdateWhileOffscreen())
         return;
 
+#if ENABLE(TILED_BACKING_STORE)
+    if (frame()->tiledBackingStore()) {
+        frame()->tiledBackingStore()->invalidate(r);
+        return;
+    }
+#endif
     ScrollView::repaintContentRectangle(r, immediate);
 }
 
@@ -1083,8 +1194,15 @@ void FrameView::doDeferredRepaints()
         return;
     }
     unsigned size = m_repaintRects.size();
-    for (unsigned i = 0; i < size; i++)
+    for (unsigned i = 0; i < size; i++) {
+#if ENABLE(TILED_BACKING_STORE)
+        if (frame()->tiledBackingStore()) {
+            frame()->tiledBackingStore()->invalidate(m_repaintRects[i]);
+            continue;
+        }
+#endif
         ScrollView::repaintContentRectangle(m_repaintRects[i], false);
+    }
     m_repaintRects.clear();
     m_repaintCount = 0;
     
@@ -1154,6 +1272,13 @@ void FrameView::scheduleRelayout()
     if (!m_frame->document()->shouldScheduleLayout())
         return;
 
+    // When frame flattening is enabled, the contents of the frame affects layout of the parent frames.
+    // Also invalidate parent frame starting from the owner element of this frame.
+    if (m_frame->settings()->frameFlatteningEnabled() && m_frame->ownerRenderer()) {
+        if (m_frame->ownerElement()->hasTagName(iframeTag) || m_frame->ownerElement()->hasTagName(frameTag))
+            m_frame->ownerRenderer()->setNeedsLayout(true, true);
+    }
+
     int delay = m_frame->document()->minimumLayoutDelay();
     if (m_layoutTimer.isActive() && m_delayedLayout && !delay)
         unscheduleRelayout();
@@ -1363,11 +1488,11 @@ bool FrameView::updateWidgets()
     if (m_nestedLayoutCount > 1 || !m_widgetUpdateSet || m_widgetUpdateSet->isEmpty())
         return true;
     
-    Vector<RenderPartObject*> objectVector;
+    Vector<RenderEmbeddedObject*> objectVector;
     copyToVector(*m_widgetUpdateSet, objectVector);
     size_t size = objectVector.size();
     for (size_t i = 0; i < size; ++i) {
-        RenderPartObject* object = objectVector[i];
+        RenderEmbeddedObject* object = objectVector[i];
         object->updateWidget(false);
         
         // updateWidget() can destroy the RenderPartObject, so we need to make sure it's
@@ -1519,6 +1644,7 @@ void FrameView::valueChanged(Scrollbar* bar)
     ScrollView::valueChanged(bar);
     if (offset != scrollOffset())
         frame()->eventHandler()->sendScrollEvent();
+    frame()->loader()->client()->didChangeScrollOffset();
 }
 
 void FrameView::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& rect)
@@ -1683,9 +1809,8 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         return;
 
 #if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
-    if (timelineAgent)
-        timelineAgent->willPaint();
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
+        timelineAgent->willPaint(rect);
 #endif
 
     Document* document = frame()->document();
@@ -1698,7 +1823,7 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         fillWithRed = false; // Subframe, don't fill with red.
     else if (isTransparent())
         fillWithRed = false; // Transparent, don't fill with red.
-    else if (m_paintRestriction == PaintRestrictionSelectionOnly || m_paintRestriction == PaintRestrictionSelectionOnlyBlackText)
+    else if (m_paintBehavior & PaintBehaviorSelectionOnly)
         fillWithRed = false; // Selections are transparent, don't fill with red.
     else if (m_nodeToDraw)
         fillWithRed = false; // Element images are transparent, don't fill with red.
@@ -1706,7 +1831,7 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         fillWithRed = true;
     
     if (fillWithRed)
-        p->fillRect(rect, Color(0xFF, 0, 0));
+        p->fillRect(rect, Color(0xFF, 0, 0), DeviceColorSpace);
 #endif
 
     bool isTopLevelPainter = !sCurrentPaintTimeStamp;
@@ -1736,9 +1861,15 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         
     // m_nodeToDraw is used to draw only one element (and its descendants)
     RenderObject* eltRenderer = m_nodeToDraw ? m_nodeToDraw->renderer() : 0;
-    if (m_paintRestriction == PaintRestrictionNone)
+
+    PaintBehavior paintBehavior = m_paintBehavior;
+    if (paintBehavior == PaintBehaviorNormal)
         document->invalidateRenderedRectsForMarkersInRect(rect);
-    contentRenderer->layer()->paint(p, rect, m_paintRestriction, eltRenderer);
+
+    if (document->printing())
+        paintBehavior |= PaintBehaviorFlattenCompositingLayers;
+
+    contentRenderer->layer()->paint(p, rect, paintBehavior, eltRenderer);
     
     m_isPainting = false;
     m_lastPaintTime = currentTime();
@@ -1753,16 +1884,21 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         sCurrentPaintTimeStamp = 0;
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->didPaint();
 #endif
 }
 
-void FrameView::setPaintRestriction(PaintRestriction pr)
+void FrameView::setPaintBehavior(PaintBehavior behavior)
 {
-    m_paintRestriction = pr;
+    m_paintBehavior = behavior;
 }
-    
+
+PaintBehavior FrameView::paintBehavior() const
+{
+    return m_paintBehavior;
+}
+
 bool FrameView::isPainting() const
 {
     return m_isPainting;
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.h b/src/3rdparty/webkit/WebCore/page/FrameView.h
index 5243c024e6..7371d13643 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.h
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.h
@@ -45,7 +45,7 @@ class Node;
 class PlatformMouseEvent;
 class RenderLayer;
 class RenderObject;
-class RenderPartObject;
+class RenderEmbeddedObject;
 class ScheduledEvent;
 class String;
 
@@ -72,8 +72,13 @@ public:
     void setMarginWidth(int);
     void setMarginHeight(int);
 
+    virtual void setCanHaveScrollbars(bool);
+    void updateCanHaveScrollbars();
+
     virtual PassRefPtr<Scrollbar> createScrollbar(ScrollbarOrientation);
 
+    virtual bool avoidScrollbarCreation();
+
     virtual void setContentsSize(const IntSize&);
 
     void layout(bool allowSubtree = true);
@@ -87,7 +92,6 @@ public:
     RenderObject* layoutRoot(bool onlyDuringLayout = false) const;
     int layoutCount() const { return m_layoutCount; }
 
-    // These two helper functions just pass through to the RenderView.
     bool needsLayout() const;
     void setNeedsLayout();
 
@@ -104,6 +108,10 @@ public:
     // Returns true if the sync was completed.
     bool syncCompositingStateRecursive();
 
+    // Returns true when a paint with the PaintBehaviorFlattenCompositingLayers flag set gives
+    // a faithful representation of the content.
+    bool isSoftwareRenderable() const;
+
     void didMoveOnscreen();
     void willMoveOffscreen();
 
@@ -135,6 +143,7 @@ public:
 
     String mediaType() const;
     void setMediaType(const String&);
+    void adjustMediaTypeForPrinting(bool printing);
 
     void setUseSlowRepaints();
     void setIsOverlapped(bool);
@@ -166,11 +175,12 @@ public:
     bool wasScrolledByUser() const;
     void setWasScrolledByUser(bool);
 
-    void addWidgetToUpdate(RenderPartObject*);
-    void removeWidgetToUpdate(RenderPartObject*);
+    void addWidgetToUpdate(RenderEmbeddedObject*);
+    void removeWidgetToUpdate(RenderEmbeddedObject*);
 
     virtual void paintContents(GraphicsContext*, const IntRect& damageRect);
-    void setPaintRestriction(PaintRestriction);
+    void setPaintBehavior(PaintBehavior);
+    PaintBehavior paintBehavior() const;
     bool isPainting() const;
     void setNodeToDraw(Node*);
 
@@ -200,7 +210,7 @@ public:
     void invalidateScrollCorner();
 
 protected:
-    virtual void scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
+    virtual bool scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
 
 private:
     FrameView(Frame*);
@@ -212,6 +222,7 @@ private:
 
     friend class RenderWidget;
     bool useSlowRepaints() const;
+    bool useSlowRepaintsIfNotOverlapped() const;
 
     void applyOverflowToViewport(RenderObject*, ScrollbarMode& hMode, ScrollbarMode& vMode);
 
@@ -258,11 +269,14 @@ private:
 
     IntSize m_size;
     IntSize m_margins;
-    OwnPtr<HashSet<RenderPartObject*> > m_widgetUpdateSet;
+    
+    typedef HashSet<RenderEmbeddedObject*> RenderEmbeddedObjectSet;
+    OwnPtr<RenderEmbeddedObjectSet> m_widgetUpdateSet;
     RefPtr<Frame> m_frame;
 
     bool m_doFullRepaint;
     
+    bool m_canHaveScrollbars;
     bool m_useSlowRepaints;
     bool m_isOverlapped;
     bool m_contentIsOpaque;
@@ -289,7 +303,8 @@ private:
     float m_lastZoomFactor;
 
     String m_mediaType;
-    
+    String m_mediaTypeWhenNotPrinting;
+
     unsigned m_enqueueEvents;
     Vector<ScheduledEvent*> m_scheduledEvents;
     
@@ -314,7 +329,7 @@ private:
     bool m_setNeedsLayoutWasDeferred;
 
     RefPtr<Node> m_nodeToDraw;
-    PaintRestriction m_paintRestriction;
+    PaintBehavior m_paintBehavior;
     bool m_isPainting;
 
     bool m_isVisuallyNonEmpty;
diff --git a/src/3rdparty/webkit/WebCore/page/Geolocation.cpp b/src/3rdparty/webkit/WebCore/page/Geolocation.cpp
index de4a9a1ec3..86f6777f87 100644
--- a/src/3rdparty/webkit/WebCore/page/Geolocation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Geolocation.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  * Copyright (C) 2009 Torch Mobile, Inc.
+ * Copyright 2010, The Android Open Source Project
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,14 +28,54 @@
 #include "config.h"
 #include "Geolocation.h"
 
+#if ENABLE(GEOLOCATION)
+
 #include "Chrome.h"
-#include "Document.h"
 #include "Frame.h"
 #include "Page.h"
+#include <wtf/CurrentTime.h>
+
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+#include "Coordinates.h"
+#include "GeolocationController.h"
+#include "GeolocationError.h"
+#include "GeolocationPosition.h"
+#include "PositionError.h"
+#endif
 
 namespace WebCore {
 
 static const char permissionDeniedErrorMessage[] = "User denied Geolocation";
+static const char failedToStartServiceErrorMessage[] = "Failed to start Geolocation service";
+
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+
+static PassRefPtr<Geoposition> createGeoposition(GeolocationPosition* position)
+{
+    if (!position)
+        return 0;
+    
+    RefPtr<Coordinates> coordinates = Coordinates::create(position->latitude(), position->longitude(), position->canProvideAltitude(), position->altitude(), 
+                                                          position->accuracy(), position->canProvideAltitudeAccuracy(), position->altitudeAccuracy(),
+                                                          position->canProvideHeading(), position->heading(), position->canProvideSpeed(), position->speed());
+    return Geoposition::create(coordinates.release(), position->timestamp());
+}
+
+static PassRefPtr<PositionError> createPositionError(GeolocationError* error)
+{
+    PositionError::ErrorCode code = PositionError::POSITION_UNAVAILABLE;
+    switch (error->code()) {
+    case GeolocationError::PermissionDenied:
+        code = PositionError::PERMISSION_DENIED;
+        break;
+    case GeolocationError::PositionUnavailable:
+        code = PositionError::POSITION_UNAVAILABLE;
+        break;
+    }
+
+    return PositionError::create(code, error->message());
+}
+#endif
 
 Geolocation::GeoNotifier::GeoNotifier(Geolocation* geolocation, PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
     : m_geolocation(geolocation)
@@ -42,6 +83,7 @@ Geolocation::GeoNotifier::GeoNotifier(Geolocation* geolocation, PassRefPtr<Posit
     , m_errorCallback(errorCallback)
     , m_options(options)
     , m_timer(this, &Geolocation::GeoNotifier::timerFired)
+    , m_useCachedPosition(false)
 {
     ASSERT(m_geolocation);
     ASSERT(m_successCallback);
@@ -58,11 +100,22 @@ void Geolocation::GeoNotifier::setFatalError(PassRefPtr<PositionError> error)
     m_timer.startOneShot(0);
 }
 
+void Geolocation::GeoNotifier::setUseCachedPosition()
+{
+    m_useCachedPosition = true;
+    m_timer.startOneShot(0);
+}
+
 bool Geolocation::GeoNotifier::hasZeroTimeout() const
 {
     return m_options->hasTimeout() && m_options->timeout() == 0;
 }
 
+void Geolocation::GeoNotifier::runSuccessCallback(Geoposition* position)
+{
+    m_successCallback->handleEvent(position);
+}
+
 void Geolocation::GeoNotifier::startTimerIfNeeded()
 {
     if (m_options->hasTimeout())
@@ -73,6 +126,10 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
 {
     m_timer.stop();
 
+    // Protect this GeoNotifier object, since it
+    // could be deleted by a call to clearWatch in a callback.
+    RefPtr<GeoNotifier> protect(this);
+
     if (m_fatalError) {
         if (m_errorCallback)
             m_errorCallback->handleEvent(m_fatalError.get());
@@ -81,6 +138,14 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
         return;
     }
 
+    if (m_useCachedPosition) {
+        // Clear the cached position flag in case this is a watch request, which
+        // will continue to run.
+        m_useCachedPosition = false;
+        m_geolocation->requestUsesCachedPosition(this);
+        return;
+    }
+
     if (m_errorCallback) {
         RefPtr<PositionError> error = PositionError::create(PositionError::TIMEOUT, "Timeout expired");
         m_errorCallback->handleEvent(error.get());
@@ -88,10 +153,12 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
     m_geolocation->requestTimedOut(this);
 }
 
-void Geolocation::Watchers::set(int id, PassRefPtr<GeoNotifier> notifier)
+void Geolocation::Watchers::set(int id, PassRefPtr<GeoNotifier> prpNotifier)
 {
-    m_idToNotifierMap.set(id, notifier);
-    m_notifierToIdMap.set(notifier, id);
+    RefPtr<GeoNotifier> notifier = prpNotifier;
+
+    m_idToNotifierMap.set(id, notifier.get());
+    m_notifierToIdMap.set(notifier.release(), id);
 }
 
 void Geolocation::Watchers::remove(int id)
@@ -112,6 +179,11 @@ void Geolocation::Watchers::remove(GeoNotifier* notifier)
     m_notifierToIdMap.remove(iter);
 }
 
+bool Geolocation::Watchers::contains(GeoNotifier* notifier) const
+{
+    return m_notifierToIdMap.contains(notifier);
+}
+
 void Geolocation::Watchers::clear()
 {
     m_idToNotifierMap.clear();
@@ -130,9 +202,12 @@ void Geolocation::Watchers::getNotifiersVector(Vector<RefPtr<GeoNotifier> >& cop
 
 Geolocation::Geolocation(Frame* frame)
     : m_frame(frame)
+#if !ENABLE(CLIENT_BASED_GEOLOCATION)
     , m_service(GeolocationService::create(this))
+#endif
     , m_allowGeolocation(Unknown)
     , m_shouldClearCache(false)
+    , m_positionCache(new GeolocationPositionCache)
 {
     if (!m_frame)
         return;
@@ -140,19 +215,46 @@ Geolocation::Geolocation(Frame* frame)
     m_frame->document()->setUsingGeolocation(true);
 }
 
+Geolocation::~Geolocation()
+{
+}
+
 void Geolocation::disconnectFrame()
 {
-    m_service->stopUpdating();
-    if (m_frame && m_frame->document())
-        m_frame->document()->setUsingGeolocation(false);
+    stopUpdating();
+    if (m_frame) {
+        if (m_frame->document())
+            m_frame->document()->setUsingGeolocation(false);
+        if (m_frame->page() && m_allowGeolocation == InProgress)
+            m_frame->page()->chrome()->cancelGeolocationPermissionRequestForFrame(m_frame);
+    }
     m_frame = 0;
 }
 
+Geoposition* Geolocation::lastPosition()
+{
+    ASSERT(isAllowed());
+
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    if (!m_frame)
+        return 0;
+
+    Page* page = m_frame->page();
+    if (!page)
+        return 0;
+
+    m_lastPosition = createGeoposition(page->geolocationController()->lastPosition());
+#else
+    m_lastPosition = m_service->lastPosition();
+#endif
+
+    return m_lastPosition.get();
+}
+
 void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
     RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
-    if (!notifier)
-        return;
+    ASSERT(notifier);
 
     m_oneShots.add(notifier);
 }
@@ -160,8 +262,7 @@ void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallbac
 int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
     RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
-    if (!notifier)
-        return 0;
+    ASSERT(notifier);
 
     static int nextAvailableWatchId = 1;
     // In case of overflow, make sure the ID remains positive, but reuse the ID values.
@@ -179,17 +280,16 @@ PassRefPtr<Geolocation::GeoNotifier> Geolocation::startRequest(PassRefPtr<Positi
     // the permission state can not change again in the lifetime of this page.
     if (isDenied())
         notifier->setFatalError(PositionError::create(PositionError::PERMISSION_DENIED, permissionDeniedErrorMessage));
-    else {
-        if (notifier->hasZeroTimeout() || m_service->startUpdating(notifier->m_options.get()))
+    else if (haveSuitableCachedPosition(notifier->m_options.get()))
+        notifier->setUseCachedPosition();
+    else if (notifier->hasZeroTimeout() || startUpdating(notifier.get())) {
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+        // Only start timer if we're not waiting for user permission.
+        if (!m_startRequestPermissionNotifier)
+#endif            
             notifier->startTimerIfNeeded();
-        else {
-            if (notifier->m_errorCallback) {
-                RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "Unable to Start");
-                notifier->m_errorCallback->handleEvent(error.get());
-            }
-            return 0;
-        }
-    }
+    } else
+        notifier->setFatalError(PositionError::create(PositionError::POSITION_UNAVAILABLE, failedToStartServiceErrorMessage));
 
     return notifier.release();
 }
@@ -201,49 +301,129 @@ void Geolocation::fatalErrorOccurred(Geolocation::GeoNotifier* notifier)
     m_watchers.remove(notifier);
 
     if (!hasListeners())
-        m_service->stopUpdating();
+        stopUpdating();
 }
 
-void Geolocation::requestTimedOut(GeoNotifier* notifier)
+void Geolocation::requestUsesCachedPosition(GeoNotifier* notifier)
 {
-    // If this is a one-shot request, stop it.
-    m_oneShots.remove(notifier);
+    // This is called asynchronously, so the permissions could have been denied
+    // since we last checked in startRequest.
+    if (isDenied()) {
+        notifier->setFatalError(PositionError::create(PositionError::PERMISSION_DENIED, permissionDeniedErrorMessage));
+        return;
+    }
+
+    m_requestsAwaitingCachedPosition.add(notifier);
+
+    // If permissions are allowed, make the callback
+    if (isAllowed()) {
+        makeCachedPositionCallbacks();
+        return;
+    }
+
+    // Request permissions, which may be synchronous or asynchronous.
+    requestPermission();
+}
+
+void Geolocation::makeCachedPositionCallbacks()
+{
+    // All modifications to m_requestsAwaitingCachedPosition are done
+    // asynchronously, so we don't need to worry about it being modified from
+    // the callbacks.
+    GeoNotifierSet::const_iterator end = m_requestsAwaitingCachedPosition.end();
+    for (GeoNotifierSet::const_iterator iter = m_requestsAwaitingCachedPosition.begin(); iter != end; ++iter) {
+        GeoNotifier* notifier = iter->get();
+        notifier->runSuccessCallback(m_positionCache->cachedPosition());
+
+        // If this is a one-shot request, stop it. Otherwise, if the watch still
+        // exists, start the service to get updates.
+        if (m_oneShots.contains(notifier))
+            m_oneShots.remove(notifier);
+        else if (m_watchers.contains(notifier)) {
+            if (notifier->hasZeroTimeout() || startUpdating(notifier))
+                notifier->startTimerIfNeeded();
+            else
+                notifier->setFatalError(PositionError::create(PositionError::POSITION_UNAVAILABLE, failedToStartServiceErrorMessage));
+        }
+    }
+
+    m_requestsAwaitingCachedPosition.clear();
 
     if (!hasListeners())
-        m_service->stopUpdating();
+        stopUpdating();
 }
 
-void Geolocation::clearWatch(int watchId)
+void Geolocation::requestTimedOut(GeoNotifier* notifier)
 {
-    m_watchers.remove(watchId);
-    
+    // If this is a one-shot request, stop it.
+    m_oneShots.remove(notifier);
+
     if (!hasListeners())
-        m_service->stopUpdating();
+        stopUpdating();
 }
 
-void Geolocation::suspend()
+bool Geolocation::haveSuitableCachedPosition(PositionOptions* options)
 {
-    if (hasListeners())
-        m_service->suspend();
+    if (!m_positionCache->cachedPosition())
+        return false;
+    if (!options->hasMaximumAge())
+        return true;
+    if (!options->maximumAge())
+        return false;
+    DOMTimeStamp currentTimeMillis = currentTime() * 1000.0;
+    return m_positionCache->cachedPosition()->timestamp() > currentTimeMillis - options->maximumAge();
 }
 
-void Geolocation::resume()
+void Geolocation::clearWatch(int watchId)
 {
-    if (hasListeners())
-        m_service->resume();
+    m_watchers.remove(watchId);
+    
+    if (!hasListeners())
+        stopUpdating();
 }
 
 void Geolocation::setIsAllowed(bool allowed)
 {
+    // This may be due to either a new position from the service, or a cached
+    // position.
     m_allowGeolocation = allowed ? Yes : No;
     
-    if (isAllowed())
-        makeSuccessCallbacks();
-    else {
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    if (m_startRequestPermissionNotifier) {
+        if (isAllowed()) {
+            // Permission request was made during the startUpdating process
+            m_startRequestPermissionNotifier->startTimerIfNeeded();
+            m_startRequestPermissionNotifier = 0;
+            if (!m_frame)
+                return;
+            Page* page = m_frame->page();
+            if (!page)
+                return;
+            page->geolocationController()->addObserver(this);
+        } else {
+            m_startRequestPermissionNotifier->setFatalError(PositionError::create(PositionError::PERMISSION_DENIED, permissionDeniedErrorMessage));
+            m_oneShots.add(m_startRequestPermissionNotifier);
+            m_startRequestPermissionNotifier = 0;
+        }
+        return;
+    }
+#endif
+
+    if (!isAllowed()) {
         RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, permissionDeniedErrorMessage);
         error->setIsFatal(true);
         handleError(error.get());
+        m_requestsAwaitingCachedPosition.clear();
+        return;
     }
+
+    // If the service has a last position, use it to call back for all requests.
+    // If any of the requests are waiting for permission for a cached position,
+    // the position from the service will be at least as fresh.
+    if (lastPosition())
+        makeSuccessCallbacks();
+    else
+        makeCachedPositionCallbacks();
 }
 
 void Geolocation::sendError(Vector<RefPtr<GeoNotifier> >& notifiers, PositionError* error)
@@ -320,7 +500,7 @@ void Geolocation::handleError(PositionError* error)
     sendError(watchersCopy, error);
 
     if (!hasListeners())
-        m_service->stopUpdating();
+        stopUpdating();
 }
 
 void Geolocation::requestPermission()
@@ -341,10 +521,11 @@ void Geolocation::requestPermission()
     page->chrome()->requestGeolocationPermissionForFrame(m_frame, this);
 }
 
-void Geolocation::geolocationServicePositionChanged(GeolocationService* service)
+void Geolocation::positionChanged(PassRefPtr<Geoposition> newPosition)
 {
-    ASSERT_UNUSED(service, service == m_service);
-    ASSERT(m_service->lastPosition());
+    m_currentPosition = newPosition;
+
+    m_positionCache->setCachedPosition(m_currentPosition.get());
 
     // Stop all currently running timers.
     stopTimers();
@@ -363,7 +544,7 @@ void Geolocation::geolocationServicePositionChanged(GeolocationService* service)
 
 void Geolocation::makeSuccessCallbacks()
 {
-    ASSERT(m_service->lastPosition());
+    ASSERT(m_currentPosition);
     ASSERT(isAllowed());
     
     Vector<RefPtr<GeoNotifier> > oneShotsCopy;
@@ -377,18 +558,104 @@ void Geolocation::makeSuccessCallbacks()
     // further callbacks to these notifiers.
     m_oneShots.clear();
 
-    sendPosition(oneShotsCopy, m_service->lastPosition());
-    sendPosition(watchersCopy, m_service->lastPosition());
+    sendPosition(oneShotsCopy, m_currentPosition.get());
+    sendPosition(watchersCopy, m_currentPosition.get());
 
     if (!hasListeners())
-        m_service->stopUpdating();
+        stopUpdating();
+}
+
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+
+void Geolocation::setPosition(GeolocationPosition* position)
+{
+    positionChanged(createGeoposition(position));
+}
+
+void Geolocation::setError(GeolocationError* error)
+{
+    RefPtr<PositionError> positionError = createPositionError(error);
+    handleError(positionError.get());
+}
+
+#else
+
+void Geolocation::geolocationServicePositionChanged(GeolocationService* service)
+{
+    ASSERT_UNUSED(service, service == m_service);
+    ASSERT(m_service->lastPosition());
+
+    positionChanged(m_service->lastPosition());
 }
 
 void Geolocation::geolocationServiceErrorOccurred(GeolocationService* service)
 {
     ASSERT(service->lastError());
-    
+
+    // Note that we do not stop timers here. For one-shots, the request is
+    // cleared in handleError. For watchers, the spec requires that the timer is
+    // not cleared.
     handleError(service->lastError());
 }
 
+#endif
+
+bool Geolocation::startUpdating(GeoNotifier* notifier)
+{
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    // FIXME: Pass options to client.
+
+    if (!isAllowed()) {
+        m_startRequestPermissionNotifier = notifier;
+        requestPermission();
+        return true;
+    }
+    
+    if (!m_frame)
+        return false;
+
+    Page* page = m_frame->page();
+    if (!page)
+        return false;
+
+    page->geolocationController()->addObserver(this);
+    return true;
+#else
+    return m_service->startUpdating(notifier->m_options.get());
+#endif
+}
+
+void Geolocation::stopUpdating()
+{
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    if (!m_frame)
+        return;
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    page->geolocationController()->removeObserver(this);
+#else
+    m_service->stopUpdating();
+#endif
+
+}
+
 } // namespace WebCore
+
+#else
+
+namespace WebCore {
+
+void Geolocation::disconnectFrame() {}
+
+Geolocation::Geolocation(Frame*) {}
+
+Geolocation::~Geolocation() {}
+
+void Geolocation::setIsAllowed(bool) {}
+
+}
+                                                        
+#endif // ENABLE(GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/page/Geolocation.h b/src/3rdparty/webkit/WebCore/page/Geolocation.h
index 4827664e9d..29f3214231 100644
--- a/src/3rdparty/webkit/WebCore/page/Geolocation.h
+++ b/src/3rdparty/webkit/WebCore/page/Geolocation.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
+ * Copyright 2010, The Android Open Source Project
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,51 +27,56 @@
 #ifndef Geolocation_h
 #define Geolocation_h
 
+#include "GeolocationPositionCache.h"
 #include "GeolocationService.h"
+#include "Geoposition.h"
 #include "PositionCallback.h"
 #include "PositionError.h"
 #include "PositionErrorCallback.h"
 #include "PositionOptions.h"
 #include "Timer.h"
-#include <wtf/Platform.h>
-#include <wtf/HashMap.h>
-#include <wtf/HashSet.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
 
 namespace WebCore {
 
 class Frame;
-class Geoposition;
 
-class Geolocation : public RefCounted<Geolocation>, public GeolocationServiceClient {
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+class GeolocationPosition;
+class GeolocationError;
+#endif
+
+class Geolocation : public RefCounted<Geolocation>
+#if !ENABLE(CLIENT_BASED_GEOLOCATION) && ENABLE(GEOLOCATION)
+    , public GeolocationServiceClient
+#endif
+{
 public:
     static PassRefPtr<Geolocation> create(Frame* frame) { return adoptRef(new Geolocation(frame)); }
 
-    virtual ~Geolocation() {}
+    ~Geolocation();
 
     void disconnectFrame();
     
-    Geoposition* lastPosition() const { return m_service->lastPosition(); }
-
     void getCurrentPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
     int watchPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
     void clearWatch(int watchId);
 
-    void suspend();
-    void resume();
-    
     void setIsAllowed(bool);
+    Frame* frame() const { return m_frame; }
+
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    void setPosition(GeolocationPosition*);
+    void setError(GeolocationError*);
+#else
+    GeolocationService* getGeolocationService() const { return m_service.get(); }
+#endif
+
+private:
+    Geoposition* lastPosition();
+
     bool isAllowed() const { return m_allowGeolocation == Yes; }
     bool isDenied() const { return m_allowGeolocation == No; }
     
-    void setShouldClearCache(bool shouldClearCache) { m_shouldClearCache = shouldClearCache; }
-    bool shouldClearCache() const { return m_shouldClearCache; }
-
-private:
     Geolocation(Frame*);
 
     class GeoNotifier : public RefCounted<GeoNotifier> {
@@ -79,6 +85,8 @@ private:
         
         void setFatalError(PassRefPtr<PositionError>);
         bool hasZeroTimeout() const;
+        void setUseCachedPosition();
+        void runSuccessCallback(Geoposition*);
         void startTimerIfNeeded();
         void timerFired(Timer<GeoNotifier>*);
         
@@ -88,6 +96,7 @@ private:
         RefPtr<PositionOptions> m_options;
         Timer<GeoNotifier> m_timer;
         RefPtr<PositionError> m_fatalError;
+        bool m_useCachedPosition;
 
     private:
         GeoNotifier(Geolocation*, PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
@@ -98,6 +107,7 @@ private:
         void set(int id, PassRefPtr<GeoNotifier>);
         void remove(int id);
         void remove(GeoNotifier*);
+        bool contains(GeoNotifier*) const;
         void clear();
         bool isEmpty() const;
         void getNotifiersVector(Vector<RefPtr<GeoNotifier> >&) const;
@@ -118,26 +128,41 @@ private:
     void stopTimersForWatchers();
     void stopTimers();
     
+    void positionChanged(PassRefPtr<Geoposition>);
     void makeSuccessCallbacks();
     void handleError(PositionError*);
 
     void requestPermission();
 
+    bool startUpdating(GeoNotifier*);
+    void stopUpdating();
+
+#if !ENABLE(CLIENT_BASED_GEOLOCATION) && ENABLE(GEOLOCATION)
     // GeolocationServiceClient
     virtual void geolocationServicePositionChanged(GeolocationService*);
     virtual void geolocationServiceErrorOccurred(GeolocationService*);
+#endif
 
     PassRefPtr<GeoNotifier> startRequest(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
 
     void fatalErrorOccurred(GeoNotifier*);
     void requestTimedOut(GeoNotifier*);
+    void requestUsesCachedPosition(GeoNotifier*);
+    bool haveSuitableCachedPosition(PositionOptions*);
+    void makeCachedPositionCallbacks();
 
     typedef HashSet<RefPtr<GeoNotifier> > GeoNotifierSet;
     
     GeoNotifierSet m_oneShots;
     Watchers m_watchers;
     Frame* m_frame;
+#if !ENABLE(CLIENT_BASED_GEOLOCATION)
     OwnPtr<GeolocationService> m_service;
+#else
+    RefPtr<GeoNotifier> m_startRequestPermissionNotifier;
+#endif
+    RefPtr<Geoposition> m_lastPosition;
+    RefPtr<Geoposition> m_currentPosition;
 
     enum {
         Unknown,
@@ -146,6 +171,11 @@ private:
         No
     } m_allowGeolocation;
     bool m_shouldClearCache;
+
+#if ENABLE(GEOLOCATION)
+    OwnPtr<GeolocationPositionCache> m_positionCache;
+#endif
+    GeoNotifierSet m_requestsAwaitingCachedPosition;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Geolocation.idl b/src/3rdparty/webkit/WebCore/page/Geolocation.idl
index e125118a4a..aa5b59f63d 100644
--- a/src/3rdparty/webkit/WebCore/page/Geolocation.idl
+++ b/src/3rdparty/webkit/WebCore/page/Geolocation.idl
@@ -25,9 +25,7 @@
 
 module core {
 
-    interface Geolocation {
-        readonly attribute Geoposition lastPosition;
-
+    interface [Conditional=GEOLOCATION, OmitConstructor] Geolocation {
         [Custom] void getCurrentPosition(in PositionCallback successCallback, in PositionErrorCallback errorCallback, in PositionOptions options);
 
         [Custom] long watchPosition(in PositionCallback successCallback, in PositionErrorCallback errorCallback, in PositionOptions options);
diff --git a/src/3rdparty/webkit/WebCore/page/GeolocationController.cpp b/src/3rdparty/webkit/WebCore/page/GeolocationController.cpp
new file mode 100644
index 0000000000..fd18b45027
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/GeolocationController.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GeolocationController.h"
+
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+
+#include "GeolocationControllerClient.h"
+
+namespace WebCore {
+
+GeolocationController::GeolocationController(Page* page, GeolocationControllerClient* client)
+    : m_page(page)
+    , m_client(client)
+{
+}
+
+GeolocationController::~GeolocationController()
+{
+    if (m_client)
+        m_client->geolocationDestroyed();
+}
+
+void GeolocationController::addObserver(Geolocation* observer)
+{
+    ASSERT(!m_observers.contains(observer));
+
+    bool wasEmpty = m_observers.isEmpty();
+    m_observers.add(observer);
+    if (wasEmpty && m_client)
+        m_client->startUpdating();
+}
+
+void GeolocationController::removeObserver(Geolocation* observer)
+{
+    if (!m_observers.contains(observer))
+        return;
+
+    m_observers.remove(observer);
+    if (m_observers.isEmpty() && m_client)
+        m_client->stopUpdating();
+}
+
+void GeolocationController::positionChanged(GeolocationPosition* position)
+{
+    Vector<RefPtr<Geolocation> > observersVector;
+    copyToVector(m_observers, observersVector);
+    for (size_t i = 0; i < observersVector.size(); ++i)
+        observersVector[i]->setPosition(position);
+}
+
+void GeolocationController::errorOccurred(GeolocationError* error)
+{
+    Vector<RefPtr<Geolocation> > observersVector;
+    copyToVector(m_observers, observersVector);
+    for (size_t i = 0; i < observersVector.size(); ++i)
+        observersVector[i]->setError(error);
+}
+
+GeolocationPosition* GeolocationController::lastPosition()
+{
+    if (!m_client)
+        return 0;
+
+    return m_client->lastPosition();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(CLIENT_BASED_GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/page/GeolocationController.h b/src/3rdparty/webkit/WebCore/page/GeolocationController.h
new file mode 100644
index 0000000000..80f9ca8956
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/GeolocationController.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GeolocationController_h
+#define GeolocationController_h
+
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+
+#include "Geolocation.h"
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class GeolocationControllerClient;
+class GeolocationError;
+class GeolocationPosition;
+class Page;
+
+class GeolocationController : public Noncopyable {
+public:
+    GeolocationController(Page*, GeolocationControllerClient*);
+    ~GeolocationController();
+
+    void addObserver(Geolocation*);
+    void removeObserver(Geolocation*);
+
+    void positionChanged(GeolocationPosition*);
+    void errorOccurred(GeolocationError*);
+
+    GeolocationPosition* lastPosition();
+
+private:
+    Page* m_page;
+    GeolocationControllerClient* m_client;
+
+    HashSet<RefPtr<Geolocation> > m_observers;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(CLIENT_BASED_GEOLOCATION)
+
+#endif // GeolocationController_h
diff --git a/src/3rdparty/webkit/WebCore/page/GeolocationControllerClient.h b/src/3rdparty/webkit/WebCore/page/GeolocationControllerClient.h
new file mode 100644
index 0000000000..cc0e1e4acc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/GeolocationControllerClient.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GeolocationControllerClient_h
+#define GeolocationControllerClient_h
+
+namespace WebCore {
+
+class GeolocationPosition;
+
+class GeolocationControllerClient {
+public:
+    virtual void geolocationDestroyed() = 0;
+
+    virtual void startUpdating() = 0;
+    virtual void stopUpdating() = 0;
+    virtual GeolocationPosition* lastPosition() = 0;
+
+protected:
+    virtual ~GeolocationControllerClient() { }
+};
+
+} // namespace WebCore
+
+#endif // GeolocationControllerClient_h
diff --git a/src/3rdparty/webkit/WebCore/page/GeolocationError.h b/src/3rdparty/webkit/WebCore/page/GeolocationError.h
new file mode 100644
index 0000000000..2a3bad4a9f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/GeolocationError.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GeolocationError_h
+#define GeolocationError_h
+
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class GeolocationError : public RefCounted<GeolocationError> {
+public:
+    enum ErrorCode {
+        PermissionDenied,
+        PositionUnavailable
+    };
+
+    static PassRefPtr<GeolocationError> create(ErrorCode code, const String& message) { return adoptRef(new GeolocationError(code, message)); }
+
+    ErrorCode code() const { return m_code; }
+    const String& message() const { return m_message; }
+
+private:
+    GeolocationError(ErrorCode code, const String& message)
+        : m_code(code)
+        , m_message(message)
+    {
+    }
+
+    ErrorCode m_code;
+    String m_message; 
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(CLIENT_BASED_GEOLOCATION)
+
+#endif // GeolocationError_h
diff --git a/src/3rdparty/webkit/WebCore/page/GeolocationPosition.h b/src/3rdparty/webkit/WebCore/page/GeolocationPosition.h
new file mode 100644
index 0000000000..9f25b1147a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/GeolocationPosition.h
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GeolocationPosition_h
+#define GeolocationPosition_h
+
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class GeolocationPosition : public RefCounted<GeolocationPosition> {
+public:
+    static PassRefPtr<GeolocationPosition> create(double timestamp, double latitude, double longitude, double accuracy) { return adoptRef(new GeolocationPosition(timestamp, latitude, longitude, accuracy)); }
+
+    static PassRefPtr<GeolocationPosition> create(double timestamp, double latitude, double longitude, double accuracy, bool providesAltitude, double altitude, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed) { return adoptRef(new GeolocationPosition(timestamp, latitude, longitude, accuracy, providesAltitude, altitude, providesAltitudeAccuracy, altitudeAccuracy, providesHeading, heading, providesSpeed, speed)); }
+
+    double timestamp() const { return m_timestamp; }
+
+    double latitude() const { return m_latitude; }
+    double longitude() const { return m_longitude; }
+    double accuracy() const { return m_accuracy; }
+    double altitude() const { return m_altitude; }
+    double altitudeAccuracy() const { return m_altitudeAccuracy; }
+    double heading() const { return m_heading; }
+    double speed() const { return m_speed; }
+
+    bool canProvideAltitude() const { return m_canProvideAltitude; }
+    bool canProvideAltitudeAccuracy() const { return m_canProvideAltitudeAccuracy; }
+    bool canProvideHeading() const { return m_canProvideHeading; }
+    bool canProvideSpeed() const { return m_canProvideSpeed; }
+
+private:
+    GeolocationPosition(double timestamp, double latitude, double longitude, double accuracy)
+        : m_timestamp(timestamp)
+        , m_latitude(latitude)
+        , m_longitude(longitude)
+        , m_accuracy(accuracy)
+        , m_altitude(0)
+        , m_altitudeAccuracy(0)
+        , m_heading(0)
+        , m_speed(0)
+        , m_canProvideAltitude(false)
+        , m_canProvideAltitudeAccuracy(false)
+        , m_canProvideHeading(false)
+        , m_canProvideSpeed(false)
+    {
+    }
+
+    GeolocationPosition(double timestamp, double latitude, double longitude, double accuracy, bool providesAltitude, double altitude, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed)
+        : m_timestamp(timestamp)
+        , m_latitude(latitude)
+        , m_longitude(longitude)
+        , m_accuracy(accuracy)
+        , m_altitude(altitude)
+        , m_altitudeAccuracy(altitudeAccuracy)
+        , m_heading(heading)
+        , m_speed(speed)
+        , m_canProvideAltitude(providesAltitude)
+        , m_canProvideAltitudeAccuracy(providesAltitudeAccuracy)
+        , m_canProvideHeading(providesHeading)
+        , m_canProvideSpeed(providesSpeed)
+    {
+    }
+
+    double m_timestamp;
+
+    double m_latitude;
+    double m_longitude;
+    double m_accuracy;
+    double m_altitude;
+    double m_altitudeAccuracy;
+    double m_heading;
+    double m_speed;
+
+    bool m_canProvideAltitude;
+    bool m_canProvideAltitudeAccuracy;
+    bool m_canProvideHeading;
+    bool m_canProvideSpeed;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(CLIENT_BASED_GEOLOCATION)
+
+#endif // GeolocationPosition_h
diff --git a/src/3rdparty/webkit/WebCore/page/GeolocationPositionCache.cpp b/src/3rdparty/webkit/WebCore/page/GeolocationPositionCache.cpp
new file mode 100644
index 0000000000..06159f472d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/GeolocationPositionCache.cpp
@@ -0,0 +1,178 @@
+/*
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GeolocationPositionCache.h"
+
+#if ENABLE(GEOLOCATION)
+
+#include "Geoposition.h"
+#include "SQLValue.h"
+#include "SQLiteDatabase.h"
+#include "SQLiteFileSystem.h"
+#include "SQLiteStatement.h"
+#include "SQLiteTransaction.h"
+
+namespace WebCore {
+
+static const char* databaseName = "CachedGeoposition.db";
+
+int GeolocationPositionCache::s_instances = 0;
+RefPtr<Geoposition>* GeolocationPositionCache::s_cachedPosition;
+String* GeolocationPositionCache::s_databaseFile = 0;
+
+GeolocationPositionCache::GeolocationPositionCache()
+{
+    if (!(s_instances++)) {
+        s_cachedPosition = new RefPtr<Geoposition>;
+        *s_cachedPosition = readFromDB();
+    }
+}
+
+GeolocationPositionCache::~GeolocationPositionCache()
+{
+    if (!(--s_instances)) {
+        if (*s_cachedPosition)
+            writeToDB(s_cachedPosition->get());
+        delete s_cachedPosition;
+    }
+}
+
+void GeolocationPositionCache::setCachedPosition(Geoposition* cachedPosition)
+{
+    *s_cachedPosition = cachedPosition;
+}
+
+Geoposition* GeolocationPositionCache::cachedPosition()
+{
+    return s_cachedPosition->get();
+}
+
+void GeolocationPositionCache::setDatabasePath(const String& databasePath)
+{
+    if (!s_databaseFile)
+        s_databaseFile = new String;
+    *s_databaseFile = SQLiteFileSystem::appendDatabaseFileNameToPath(databasePath, databaseName);
+    // If we don't have have a cached position, attempt to read one from the
+    // DB at the new path.
+    if (s_instances && !(*s_cachedPosition))
+        *s_cachedPosition = readFromDB();
+}
+
+PassRefPtr<Geoposition> GeolocationPositionCache::readFromDB()
+{
+    SQLiteDatabase database;
+    if (!s_databaseFile || !database.open(*s_databaseFile))
+        return 0;
+
+    // Create the table here, such that even if we've just created the
+    // DB, the commands below should succeed.
+    if (!database.executeCommand("CREATE TABLE IF NOT EXISTS CachedPosition ("
+            "latitude REAL NOT NULL, "
+            "longitude REAL NOT NULL, "
+            "altitude REAL, "
+            "accuracy REAL NOT NULL, "
+            "altitudeAccuracy REAL, "
+            "heading REAL, "
+            "speed REAL, "
+            "timestamp INTEGER NOT NULL)"))
+        return 0;
+
+    SQLiteStatement statement(database, "SELECT * FROM CachedPosition");
+    if (statement.prepare() != SQLResultOk)
+        return 0;
+
+    if (statement.step() != SQLResultRow)
+        return 0;
+
+    bool providesAltitude = statement.getColumnValue(2).type() != SQLValue::NullValue;
+    bool providesAltitudeAccuracy = statement.getColumnValue(4).type() != SQLValue::NullValue;
+    bool providesHeading = statement.getColumnValue(5).type() != SQLValue::NullValue;
+    bool providesSpeed = statement.getColumnValue(6).type() != SQLValue::NullValue;
+    RefPtr<Coordinates> coordinates = Coordinates::create(statement.getColumnDouble(0), // latitude
+                                                          statement.getColumnDouble(1), // longitude
+                                                          providesAltitude, statement.getColumnDouble(2), // altitude
+                                                          statement.getColumnDouble(3), // accuracy
+                                                          providesAltitudeAccuracy, statement.getColumnDouble(4), // altitudeAccuracy
+                                                          providesHeading, statement.getColumnDouble(5), // heading
+                                                          providesSpeed, statement.getColumnDouble(6)); // speed
+    return Geoposition::create(coordinates.release(), statement.getColumnInt64(7)); // timestamp
+}
+
+void GeolocationPositionCache::writeToDB(const Geoposition* position)
+{
+    ASSERT(position);
+
+    SQLiteDatabase database;
+    if (!s_databaseFile || !database.open(*s_databaseFile))
+        return;
+
+    SQLiteTransaction transaction(database);
+
+    if (!database.executeCommand("DELETE FROM CachedPosition"))
+        return;
+
+    SQLiteStatement statement(database, "INSERT INTO CachedPosition ("
+        "latitude, "
+        "longitude, "
+        "altitude, "
+        "accuracy, "
+        "altitudeAccuracy, "
+        "heading, "
+        "speed, "
+        "timestamp) "
+        "VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
+    if (statement.prepare() != SQLResultOk)
+        return;
+
+    statement.bindDouble(1, position->coords()->latitude());
+    statement.bindDouble(2, position->coords()->longitude());
+    if (position->coords()->canProvideAltitude())
+        statement.bindDouble(3, position->coords()->altitude());
+    else
+        statement.bindNull(3);
+    statement.bindDouble(4, position->coords()->accuracy());
+    if (position->coords()->canProvideAltitudeAccuracy())
+        statement.bindDouble(5, position->coords()->altitudeAccuracy());
+    else
+        statement.bindNull(5);
+    if (position->coords()->canProvideHeading())
+        statement.bindDouble(6, position->coords()->heading());
+    else
+        statement.bindNull(6);
+    if (position->coords()->canProvideSpeed())
+        statement.bindDouble(7, position->coords()->speed());
+    else
+        statement.bindNull(7);
+    statement.bindInt64(8, position->timestamp());
+    if (!statement.executeCommand())
+        return;
+
+    transaction.commit();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/page/GeolocationPositionCache.h b/src/3rdparty/webkit/WebCore/page/GeolocationPositionCache.h
new file mode 100644
index 0000000000..c7f7e49845
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/GeolocationPositionCache.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GeolocationPositionCache_h
+#define GeolocationPositionCache_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+
+namespace WebCore {
+
+class Geoposition;
+class String;
+
+class GeolocationPositionCache {
+  public:
+    GeolocationPositionCache();
+    ~GeolocationPositionCache();
+
+    void setCachedPosition(Geoposition*);
+    Geoposition* cachedPosition();
+    static void setDatabasePath(const String&);
+
+  private:
+    static PassRefPtr<Geoposition> readFromDB();
+    static void writeToDB(const Geoposition*);
+
+    static int s_instances;
+    static RefPtr<Geoposition>* s_cachedPosition;
+    static String* s_databaseFile;
+};
+
+} // namespace WebCore
+
+#endif // GeolocationPositionCache_h
diff --git a/src/3rdparty/webkit/WebCore/page/Geoposition.h b/src/3rdparty/webkit/WebCore/page/Geoposition.h
index f3c703bf99..8b215b163a 100644
--- a/src/3rdparty/webkit/WebCore/page/Geoposition.h
+++ b/src/3rdparty/webkit/WebCore/page/Geoposition.h
@@ -37,8 +37,11 @@ typedef int ExceptionCode;
 
 class Geoposition : public RefCounted<Geoposition> {
 public:
-    static PassRefPtr<Geoposition> create(PassRefPtr<Coordinates> coordinates, DOMTimeStamp timestamp) { return adoptRef(new Geoposition(coordinates, timestamp)); }
-    
+    static PassRefPtr<Geoposition> create(PassRefPtr<Coordinates> coordinates, DOMTimeStamp timestamp)
+    {
+        return adoptRef(new Geoposition(coordinates, timestamp));
+    }
+
     DOMTimeStamp timestamp() const { return m_timestamp; }
     Coordinates* coords() const { return m_coordinates.get(); }
     
diff --git a/src/3rdparty/webkit/WebCore/page/Geoposition.idl b/src/3rdparty/webkit/WebCore/page/Geoposition.idl
index 3ec8b0b465..41a226285c 100644
--- a/src/3rdparty/webkit/WebCore/page/Geoposition.idl
+++ b/src/3rdparty/webkit/WebCore/page/Geoposition.idl
@@ -25,7 +25,7 @@
 
 module core {
 
-    interface Geoposition {
+    interface [Conditional=GEOLOCATION, OmitConstructor] Geoposition {
         readonly attribute Coordinates coords;
         readonly attribute DOMTimeStamp timestamp;
     };
diff --git a/src/3rdparty/webkit/WebCore/page/HaltablePlugin.h b/src/3rdparty/webkit/WebCore/page/HaltablePlugin.h
index a5fe0f430e..0f4aa41379 100644
--- a/src/3rdparty/webkit/WebCore/page/HaltablePlugin.h
+++ b/src/3rdparty/webkit/WebCore/page/HaltablePlugin.h
@@ -37,6 +37,8 @@ public:
     virtual void halt() = 0;
     virtual void restart() = 0;
     virtual Node* node() const = 0;
+    virtual bool isWindowed() const = 0;
+    virtual String pluginName() const = 0;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/History.cpp b/src/3rdparty/webkit/WebCore/page/History.cpp
index 9a27f1c39b..78e8ea6e96 100644
--- a/src/3rdparty/webkit/WebCore/page/History.cpp
+++ b/src/3rdparty/webkit/WebCore/page/History.cpp
@@ -26,8 +26,12 @@
 #include "config.h"
 #include "History.h"
 
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "HistoryItem.h"
+#include "Page.h"
 
 namespace WebCore {
 
@@ -76,4 +80,45 @@ void History::go(int distance)
     m_frame->redirectScheduler()->scheduleHistoryNavigation(distance);
 }
 
+KURL History::urlForState(const String& urlString)
+{
+    KURL baseURL = m_frame->loader()->baseURL();
+    if (urlString.isEmpty())
+        return baseURL;
+        
+    KURL absoluteURL(baseURL, urlString);
+    if (!absoluteURL.isValid())
+        return KURL();
+    
+    if (absoluteURL.string().left(absoluteURL.pathStart()) != baseURL.string().left(baseURL.pathStart()))
+        return KURL();
+    
+    return absoluteURL;
+}
+
+void History::stateObjectAdded(PassRefPtr<SerializedScriptValue> data, const String& title, const String& urlString, StateObjectType stateObjectType, ExceptionCode& ec)
+{
+    if (!m_frame || !m_frame->page())
+        return;
+    
+    KURL fullURL = urlForState(urlString);
+    if (!fullURL.isValid()) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
+    if (stateObjectType == StateObjectPush)
+        m_frame->loader()->history()->pushState(data, title, fullURL.string());
+    else if (stateObjectType == StateObjectReplace)
+        m_frame->loader()->history()->replaceState(data, title, fullURL.string());
+            
+    if (!urlString.isEmpty())
+        m_frame->document()->updateURLForPushOrReplaceState(fullURL);
+
+    if (stateObjectType == StateObjectPush)
+        m_frame->loader()->client()->dispatchDidPushStateWithinPage();
+    else if (stateObjectType == StateObjectReplace)
+        m_frame->loader()->client()->dispatchDidReplaceStateWithinPage();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/History.h b/src/3rdparty/webkit/WebCore/page/History.h
index f0df2de385..66a6a03b92 100644
--- a/src/3rdparty/webkit/WebCore/page/History.h
+++ b/src/3rdparty/webkit/WebCore/page/History.h
@@ -26,30 +26,42 @@
 #ifndef History_h
 #define History_h
 
+#include "KURL.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
 
-    class Frame;
+class Frame;
+class SerializedScriptValue;
+class String;
+typedef int ExceptionCode;
 
-    class History : public RefCounted<History> {
-    public:
-        static PassRefPtr<History> create(Frame* frame) { return adoptRef(new History(frame)); }
-        
-        Frame* frame() const;
-        void disconnectFrame();
+class History : public RefCounted<History> {
+public:
+    static PassRefPtr<History> create(Frame* frame) { return adoptRef(new History(frame)); }
+    
+    Frame* frame() const;
+    void disconnectFrame();
 
-        unsigned length() const;
-        void back();
-        void forward();
-        void go(int distance);
+    unsigned length() const;
+    void back();
+    void forward();
+    void go(int distance);
 
-    private:
-        History(Frame*);
-
-        Frame* m_frame;
+    enum StateObjectType {
+        StateObjectPush,
+        StateObjectReplace
     };
+    void stateObjectAdded(PassRefPtr<SerializedScriptValue>, const String& title, const String& url, StateObjectType, ExceptionCode&);
+
+private:
+    History(Frame*);
+
+    KURL urlForState(const String& url);
+
+    Frame* m_frame;
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/page/History.idl b/src/3rdparty/webkit/WebCore/page/History.idl
index 914d441713..d1be5aef39 100644
--- a/src/3rdparty/webkit/WebCore/page/History.idl
+++ b/src/3rdparty/webkit/WebCore/page/History.idl
@@ -32,13 +32,19 @@ module window {
         DelegatingGetOwnPropertySlot,
         DelegatingPutFunction,
         CustomDeleteProperty,
-        CustomGetPropertyNames
+        CustomGetPropertyNames,
+        OmitConstructor
     ] History {
         readonly attribute unsigned long length;
 
         [DoNotCheckDomainSecurity] void back();
         [DoNotCheckDomainSecurity] void forward();
         [DoNotCheckDomainSecurity] void go(in long distance);
+        
+        [Custom, EnabledAtRuntime] void pushState(in any data, in DOMString title, in optional DOMString url)
+            raises(DOMException);
+        [Custom, EnabledAtRuntime] void replaceState(in any data, in DOMString title, in optional DOMString url)
+            raises(DOMException);
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/page/Location.idl b/src/3rdparty/webkit/WebCore/page/Location.idl
index 7d680f2f13..b020267c50 100644
--- a/src/3rdparty/webkit/WebCore/page/Location.idl
+++ b/src/3rdparty/webkit/WebCore/page/Location.idl
@@ -38,7 +38,8 @@ module window {
         CustomGetPropertyNames,
         CustomDefineGetter,
         DelegatingPrototypePutFunction,
-        CustomPrototypeDefineGetter
+        CustomPrototypeDefineGetter,
+        OmitConstructor
     ] Location {
                  attribute [DoNotCheckDomainSecurityOnSet, CustomSetter, V8DisallowShadowing] DOMString href;
 
diff --git a/src/3rdparty/webkit/WebCore/page/MediaCanStartListener.h b/src/3rdparty/webkit/WebCore/page/MediaCanStartListener.h
new file mode 100644
index 0000000000..317babf418
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/MediaCanStartListener.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MediaCanStartListener_h
+#define MediaCanStartListener_h
+
+namespace WebCore {
+
+class MediaCanStartListener {
+public:
+    virtual void mediaCanStart() = 0;
+protected:
+    virtual ~MediaCanStartListener() { }
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/page/MouseEventWithHitTestResults.h b/src/3rdparty/webkit/WebCore/page/MouseEventWithHitTestResults.h
index 7330d939d2..8c28574998 100644
--- a/src/3rdparty/webkit/WebCore/page/MouseEventWithHitTestResults.h
+++ b/src/3rdparty/webkit/WebCore/page/MouseEventWithHitTestResults.h
@@ -1,4 +1,4 @@
-/* This file is part of the KDE project
+/* 
    Copyright (C) 2000 Simon Hausmann <hausmann@kde.org>
    Copyright (C) 2006 Apple Computer, Inc.
 
diff --git a/src/3rdparty/webkit/WebCore/page/Navigator.cpp b/src/3rdparty/webkit/WebCore/page/Navigator.cpp
index 4922860c1a..7078454dc4 100644
--- a/src/3rdparty/webkit/WebCore/page/Navigator.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Navigator.cpp
@@ -23,11 +23,14 @@
 #include "config.h"
 #include "Navigator.h"
 
+#include "Chrome.h"
 #include "CookieJar.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "Geolocation.h"
+#include "KURL.h"
 #include "Language.h"
 #include "MimeTypeArray.h"
 #include "Page.h"
@@ -169,4 +172,93 @@ void Navigator::getStorageUpdates()
 }
 #endif
 
+static bool verifyCustomHandlerURL(const String& baseURL, const String& url, ExceptionCode& ec)
+{
+    // The specification requires that it is a SYNTAX_ERR if the the "%s" token is not present.
+    static const char token[] = "%s";
+    int index = url.find(token);
+    if (-1 == index) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    // It is also a SYNTAX_ERR if the custom handler URL, as created by removing
+    // the "%s" token and prepending the base url, does not resolve.
+    String newURL = url;
+    newURL.remove(index, sizeof(token) / sizeof(token[0]));
+
+    KURL base(ParsedURLString, baseURL);
+    KURL kurl(base, newURL);
+
+    if (kurl.isEmpty() || !kurl.isValid()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    return true;
+}
+
+static bool verifyProtocolHandlerScheme(const String& scheme, ExceptionCode& ec)
+{
+    // It is a SECURITY_ERR for these schemes to be handled by a custom handler.
+    if (equalIgnoringCase(scheme, "http") || equalIgnoringCase(scheme, "https") || equalIgnoringCase(scheme, "file")) {
+        ec = SECURITY_ERR;
+        return false;
+    }
+    return true;
+}
+
+void Navigator::registerProtocolHandler(const String& scheme, const String& url, const String& title, ExceptionCode& ec)
+{
+    if (!verifyProtocolHandlerScheme(scheme, ec))
+        return;
+
+    if (!m_frame)
+        return;
+
+    Document* document = m_frame->document();
+    if (!document)
+        return;
+
+    String baseURL = document->baseURL().baseAsString();
+
+    if (!verifyCustomHandlerURL(baseURL, url, ec))
+        return;
+
+    if (Page* page = m_frame->page())
+        page->chrome()->registerProtocolHandler(scheme, baseURL, url, m_frame->displayStringModifiedByEncoding(title));
+}
+
+static bool verifyProtocolHandlerMimeType(const String& type, ExceptionCode& ec)
+{
+    // It is a SECURITY_ERR for these mime types to be assigned to a custom
+    // handler.
+    if (equalIgnoringCase(type, "text/html") || equalIgnoringCase(type, "text/css") || equalIgnoringCase(type, "application/x-javascript")) {
+        ec = SECURITY_ERR;
+        return false;
+    }
+    return true;
+}
+
+void Navigator::registerContentHandler(const String& mimeType, const String& url, const String& title, ExceptionCode& ec)
+{
+    if (!verifyProtocolHandlerMimeType(mimeType, ec))
+        return;
+
+    if (!m_frame)
+        return;
+
+    Document* document = m_frame->document();
+    if (!document)
+        return;
+
+    String baseURL = document->baseURL().baseAsString();
+
+    if (!verifyCustomHandlerURL(baseURL, url, ec))
+        return;
+
+    if (Page* page = m_frame->page())
+        page->chrome()->registerContentHandler(mimeType, baseURL, url, m_frame->displayStringModifiedByEncoding(title));
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Navigator.h b/src/3rdparty/webkit/WebCore/page/Navigator.h
index 4adebe1969..107082b962 100644
--- a/src/3rdparty/webkit/WebCore/page/Navigator.h
+++ b/src/3rdparty/webkit/WebCore/page/Navigator.h
@@ -34,6 +34,8 @@ namespace WebCore {
     class PluginArray;
     class String;
 
+    typedef int ExceptionCode;
+
     class Navigator : public NavigatorBase, public RefCounted<Navigator> {
     public:
         static PassRefPtr<Navigator> create(Frame* frame) { return adoptRef(new Navigator(frame)); }
@@ -60,6 +62,9 @@ namespace WebCore {
         void getStorageUpdates();
 #endif
 
+        void registerProtocolHandler(const String& scheme, const String& url, const String& title, ExceptionCode& ec);
+        void registerContentHandler(const String& mimeType, const String& url, const String& title, ExceptionCode& ec);
+
     private:
         Navigator(Frame*);
         Frame* m_frame;
diff --git a/src/3rdparty/webkit/WebCore/page/Navigator.idl b/src/3rdparty/webkit/WebCore/page/Navigator.idl
index 80ef4fb5c3..257ede1f80 100644
--- a/src/3rdparty/webkit/WebCore/page/Navigator.idl
+++ b/src/3rdparty/webkit/WebCore/page/Navigator.idl
@@ -20,7 +20,8 @@
 module window {
 
     interface [
-        CustomMarkFunction
+        CustomMarkFunction,
+        OmitConstructor
     ] Navigator {
         readonly attribute DOMString appCodeName;
         readonly attribute DOMString appName;
@@ -40,12 +41,17 @@ module window {
         readonly attribute boolean onLine;
 
 #if defined(ENABLE_GEOLOCATION) && ENABLE_GEOLOCATION
-        readonly attribute Geolocation geolocation;
+        readonly attribute [EnabledAtRuntime] Geolocation geolocation;
 #endif
 
 #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
         void getStorageUpdates();
 #endif
+
+        void registerProtocolHandler(in DOMString scheme, in DOMString url, in DOMString title)
+            raises(DomException);
+        void registerContentHandler(in DOMString mimeType, in DOMString url, in DOMString title)
+            raises(DomException);
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/page/NavigatorBase.cpp b/src/3rdparty/webkit/WebCore/page/NavigatorBase.cpp
index 5b0c5d42e0..ca51a29ee6 100644
--- a/src/3rdparty/webkit/WebCore/page/NavigatorBase.cpp
+++ b/src/3rdparty/webkit/WebCore/page/NavigatorBase.cpp
@@ -29,19 +29,19 @@
 
 #include "NetworkStateNotifier.h"
 #include "PlatformString.h"
-#if PLATFORM(LINUX)
+#if OS(LINUX)
 #include "sys/utsname.h"
 #include <wtf/StdLibExtras.h>
 #endif
 
 #ifndef WEBCORE_NAVIGATOR_PLATFORM
-#if PLATFORM(MAC) && (PLATFORM(PPC) || PLATFORM(PPC64))
+#if OS(MAC_OS_X) && (CPU(PPC) || CPU(PPC64))
 #define WEBCORE_NAVIGATOR_PLATFORM "MacPPC"
-#elif PLATFORM(MAC) && (PLATFORM(X86) || PLATFORM(X86_64))
+#elif OS(MAC_OS_X) && (CPU(X86) || CPU(X86_64))
 #define WEBCORE_NAVIGATOR_PLATFORM "MacIntel"
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 #define WEBCORE_NAVIGATOR_PLATFORM "Win32"
-#elif PLATFORM(SYMBIAN)
+#elif OS(SYMBIAN)
 #define WEBCORE_NAVIGATOR_PLATFORM "Symbian"
 #else
 #define WEBCORE_NAVIGATOR_PLATFORM ""
@@ -85,7 +85,7 @@ String NavigatorBase::appVersion() const
 
 String NavigatorBase::platform() const
 {
-#if PLATFORM(LINUX)
+#if OS(LINUX)
     if (String("") != WEBCORE_NAVIGATOR_PLATFORM)
         return WEBCORE_NAVIGATOR_PLATFORM;
     struct utsname osname;
diff --git a/src/3rdparty/webkit/WebCore/page/Page.cpp b/src/3rdparty/webkit/WebCore/page/Page.cpp
index 8a685f4676..d66e49702a 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Page.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All Rights Reserved.
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "Page.h"
 
+#include "BackForwardList.h"
 #include "Base64.h"
 #include "CSSStyleSelector.h"
 #include "Chrome.h"
@@ -29,10 +30,10 @@
 #include "ContextMenuController.h"
 #include "DOMWindow.h"
 #include "DragController.h"
-#include "ExceptionCode.h"
 #include "EditorClient.h"
-#include "EventNames.h"
 #include "Event.h"
+#include "EventNames.h"
+#include "ExceptionCode.h"
 #include "FileSystem.h"
 #include "FocusController.h"
 #include "Frame.h"
@@ -45,17 +46,20 @@
 #include "InspectorController.h"
 #include "InspectorTimelineAgent.h"
 #include "Logging.h"
+#include "MediaCanStartListener.h"
 #include "Navigator.h"
 #include "NetworkStateNotifier.h"
 #include "PageGroup.h"
 #include "PluginData.h"
 #include "PluginHalter.h"
+#include "PluginView.h"
 #include "ProgressTracker.h"
-#include "RenderWidget.h"
 #include "RenderTheme.h"
+#include "RenderWidget.h"
 #include "ScriptController.h"
 #include "SelectionController.h"
 #include "Settings.h"
+#include "SharedBuffer.h"
 #include "StringHash.h"
 #include "TextResourceDecoder.h"
 #include "Widget.h"
@@ -69,13 +73,17 @@
 #endif
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-#include "JavaScriptDebugServer.h"
+#include "ScriptDebugServer.h"
 #endif
 
 #if ENABLE(WML)
 #include "WMLPageState.h"
 #endif
 
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+#include "GeolocationController.h"
+#endif
+
 namespace WebCore {
 
 static HashSet<Page*>* allPages;
@@ -100,7 +108,7 @@ static void networkStateChanged()
         frames[i]->document()->dispatchWindowEvent(Event::create(eventName, false, false));
 }
 
-Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, EditorClient* editorClient, DragClient* dragClient, InspectorClient* inspectorClient, PluginHalterClient* pluginHalterClient)
+Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, EditorClient* editorClient, DragClient* dragClient, InspectorClient* inspectorClient, PluginHalterClient* pluginHalterClient, GeolocationControllerClient* geolocationControllerClient)
     : m_chrome(new Chrome(this, chromeClient))
     , m_dragCaretController(new SelectionController(0, true))
 #if ENABLE(DRAG_SUPPORT)
@@ -113,6 +121,9 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
 #if ENABLE(INSPECTOR)
     , m_inspectorController(new InspectorController(this, inspectorClient))
 #endif
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    , m_geolocationController(new GeolocationController(this, geolocationControllerClient))
+#endif
     , m_settings(new Settings(this))
     , m_progress(new ProgressTracker)
     , m_backForwardList(BackForwardList::create(this))
@@ -127,16 +138,13 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     , m_areMemoryCacheClientCallsEnabled(true)
     , m_mediaVolume(1)
     , m_javaScriptURLsAreAllowed(true)
-#if ENABLE(INSPECTOR)
-    , m_parentInspectorController(0)
-#endif
     , m_didLoadUserStyleSheet(false)
     , m_userStyleSheetModificationTime(0)
     , m_group(0)
     , m_debugger(0)
     , m_customHTMLTokenizerTimeDelay(-1)
     , m_customHTMLTokenizerChunkSize(-1)
-    , m_canStartPlugins(true)
+    , m_canStartMedia(true)
 {
 #if !ENABLE(CONTEXT_MENUS)
     UNUSED_PARAM(contextMenuClient);
@@ -147,6 +155,10 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
 #if !ENABLE(INSPECTOR)
     UNUSED_PARAM(inspectorClient);
 #endif
+#if !ENABLE(CLIENT_BASED_GEOLOCATION)
+    UNUSED_PARAM(geolocationControllerClient);
+#endif
+
     if (!allPages) {
         allPages = new HashSet<Page*>;
         
@@ -162,7 +174,7 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    JavaScriptDebugServer::shared().pageCreated(this);
+    ScriptDebugServer::shared().pageCreated(this);
 #endif
 
 #ifndef NDEBUG
@@ -181,8 +193,6 @@ Page::~Page()
 
     m_editorClient->pageDestroyed();
 #if ENABLE(INSPECTOR)
-    if (m_parentInspectorController)
-        m_parentInspectorController->pageDestroyed();
     m_inspectorController->inspectedPageDestroyed();
 #endif
 
@@ -277,26 +287,30 @@ void Page::goBackOrForward(int distance)
 
 void Page::goToItem(HistoryItem* item, FrameLoadType type)
 {
-    // Abort any current load if we're going to a history item
-
-    // Define what to do with any open database connections. By default we stop them and terminate the database thread.
-    DatabasePolicy databasePolicy = DatabasePolicyStop;
+    // Abort any current load unless we're navigating the current document to a new state object
+    HistoryItem* currentItem = m_mainFrame->loader()->history()->currentItem();
+    if (!item->stateObject() || !currentItem || item->documentSequenceNumber() != currentItem->documentSequenceNumber() || item == currentItem) {
+        // Define what to do with any open database connections. By default we stop them and terminate the database thread.
+        DatabasePolicy databasePolicy = DatabasePolicyStop;
 
 #if ENABLE(DATABASE)
-    // If we're navigating the history via a fragment on the same document, then we do not want to stop databases.
-    const KURL& currentURL = m_mainFrame->loader()->url();
-    const KURL& newURL = item->url();
-
-    if (newURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(currentURL, newURL))
-        databasePolicy = DatabasePolicyContinue;
+        // If we're navigating the history via a fragment on the same document, then we do not want to stop databases.
+        const KURL& currentURL = m_mainFrame->loader()->url();
+        const KURL& newURL = item->url();
+    
+        if (newURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(currentURL, newURL))
+            databasePolicy = DatabasePolicyContinue;
 #endif
-    m_mainFrame->loader()->stopAllLoaders(databasePolicy);
+
+        m_mainFrame->loader()->stopAllLoaders(databasePolicy);
+    }
+        
     m_mainFrame->loader()->history()->goToItem(item, type);
 }
 
 int Page::getHistoryLength()
 {
-    return m_backForwardList->backListCount() + 1;
+    return m_backForwardList->backListCount() + 1 + m_backForwardList->forwardListCount();
 }
 
 void Page::setGlobalHistoryItem(HistoryItem* item)
@@ -372,24 +386,44 @@ void Page::refreshPlugins(bool reload)
 
 PluginData* Page::pluginData() const
 {
-    if (!settings()->arePluginsEnabled())
+    if (!mainFrame()->loader()->allowPlugins(NotAboutToInstantiatePlugin))
         return 0;
     if (!m_pluginData)
         m_pluginData = PluginData::create(this);
     return m_pluginData.get();
 }
 
-void Page::addUnstartedPlugin(PluginView* view)
+void Page::addMediaCanStartListener(MediaCanStartListener* listener)
 {
-    ASSERT(!m_canStartPlugins);
-    m_unstartedPlugins.add(view);
+    ASSERT(!m_canStartMedia);
+    ASSERT(!m_mediaCanStartListeners.contains(listener));
+    m_mediaCanStartListeners.add(listener);
 }
 
-void Page::removeUnstartedPlugin(PluginView* view)
+void Page::removeMediaCanStartListener(MediaCanStartListener* listener)
 {
-    ASSERT(!m_canStartPlugins);
-    ASSERT(m_unstartedPlugins.contains(view));
-    m_unstartedPlugins.remove(view);
+    ASSERT(!m_canStartMedia);
+    ASSERT(m_mediaCanStartListeners.contains(listener));
+    m_mediaCanStartListeners.remove(listener);
+}
+
+void Page::setCanStartMedia(bool canStartMedia)
+{
+    if (m_canStartMedia == canStartMedia)
+        return;
+
+    m_canStartMedia = canStartMedia;
+
+    if (!m_canStartMedia || m_mediaCanStartListeners.isEmpty())
+        return;
+
+    Vector<MediaCanStartListener*> listeners;
+    copyToVector(m_mediaCanStartListeners, listeners);
+    m_mediaCanStartListeners.clear();
+
+    size_t size = listeners.size();
+    for (size_t i = 0; i < size; ++i)
+        listeners[i]->mediaCanStart();
 }
 
 static Frame* incrementFrame(Frame* curr, bool forward, bool wrapFlag)
@@ -463,6 +497,9 @@ const VisibleSelection& Page::selection() const
 
 void Page::setDefersLoading(bool defers)
 {
+    if (!m_settings->loadDeferringEnabled())
+        return;
+
     if (defers == m_defersLoading)
         return;
 
@@ -542,7 +579,7 @@ void Page::userStyleSheetLocationChanged()
 
         Vector<char> styleSheetAsUTF8;
         if (base64Decode(encodedData, styleSheetAsUTF8))
-            m_userStyleSheet = String::fromUTF8(styleSheetAsUTF8.data());
+            m_userStyleSheet = String::fromUTF8(styleSheetAsUTF8.data(), styleSheetAsUTF8.size());
     }
     
     for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext()) {
@@ -667,7 +704,7 @@ void Page::setDebugger(JSC::Debugger* debugger)
 StorageNamespace* Page::sessionStorage(bool optionalCreate)
 {
     if (!m_sessionStorage && optionalCreate)
-        m_sessionStorage = StorageNamespace::sessionStorageNamespace();
+        m_sessionStorage = StorageNamespace::sessionStorageNamespace(this);
 
     return m_sessionStorage.get();
 }
@@ -735,6 +772,35 @@ InspectorTimelineAgent* Page::inspectorTimelineAgent() const
 }
 #endif
 
+void Page::privateBrowsingStateChanged()
+{
+    bool privateBrowsingEnabled = m_settings->privateBrowsingEnabled();
+
+    // Collect the PluginViews in to a vector to ensure that action the plug-in takes
+    // from below privateBrowsingStateChanged does not affect their lifetime.
+
+    Vector<RefPtr<PluginView>, 32> pluginViews;
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+        FrameView* view = frame->view();
+        if (!view)
+            return;
+
+        const HashSet<RefPtr<Widget> >* children = view->children();
+        ASSERT(children);
+
+        HashSet<RefPtr<Widget> >::const_iterator end = children->end();
+        for (HashSet<RefPtr<Widget> >::const_iterator it = children->begin(); it != end; ++it) {
+            Widget* widget = (*it).get();
+            if (!widget->isPluginView())
+                continue;
+            pluginViews.append(static_cast<PluginView*>(widget));
+        }
+    }
+
+    for (size_t i = 0; i < pluginViews.size(); i++)
+        pluginViews[i]->privateBrowsingStateChanged(privateBrowsingEnabled);
+}
+
 void Page::pluginAllowedRunTimeChanged()
 {
     if (m_pluginHalter)
@@ -753,4 +819,16 @@ void Page::didStopPlugin(HaltablePlugin* obj)
         m_pluginHalter->didStopPlugin(obj);
 }
 
+#if !ASSERT_DISABLED
+void Page::checkFrameCountConsistency() const
+{
+    ASSERT(m_frameCount >= 0);
+
+    int frameCount = 0;
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext())
+        ++frameCount;
+
+    ASSERT(m_frameCount + 1 == frameCount);
+}
+#endif
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Page.h b/src/3rdparty/webkit/WebCore/page/Page.h
index 488646450a..94e6dd5e55 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.h
+++ b/src/3rdparty/webkit/WebCore/page/Page.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ -21,29 +21,23 @@
 #ifndef Page_h
 #define Page_h
 
-#include "BackForwardList.h"
-#include "Chrome.h"
-#include "ContextMenuController.h"
 #include "FrameLoaderTypes.h"
-#include "LinkHash.h"
 #include "PlatformString.h"
+#include <wtf/Forward.h>
 #include <wtf/HashSet.h>
-#include <wtf/OwnPtr.h>
+#include <wtf/Noncopyable.h>
 
 #if PLATFORM(MAC)
 #include "SchedulePair.h"
 #endif
 
-#if PLATFORM(WIN) || (PLATFORM(WX) && PLATFORM(WIN_OS)) || (PLATFORM(QT) && defined(Q_WS_WIN))
-typedef struct HINSTANCE__* HINSTANCE;
-#endif
-
 namespace JSC {
     class Debugger;
 }
 
 namespace WebCore {
 
+    class BackForwardList;
     class Chrome;
     class ChromeClient;
     class ContextMenuClient;
@@ -54,30 +48,36 @@ namespace WebCore {
     class EditorClient;
     class FocusController;
     class Frame;
+    class GeolocationController;
+    class GeolocationControllerClient;
     class HaltablePlugin;
+    class HistoryItem;
     class InspectorClient;
     class InspectorController;
     class InspectorTimelineAgent;
+    class MediaCanStartListener;
     class Node;
     class PageGroup;
     class PluginData;
     class PluginHalter;
     class PluginHalterClient;
-    class PluginView;
     class ProgressTracker;
     class RenderTheme;
     class VisibleSelection;
     class SelectionController;
     class Settings;
+
 #if ENABLE(DOM_STORAGE)
     class StorageNamespace;
 #endif
-#if ENABLE(WML)
-    class WMLPageState;
-#endif
 #if ENABLE(NOTIFICATIONS)
     class NotificationPresenter;
 #endif
+#if ENABLE(WML)
+    class WMLPageState;
+#endif
+
+    typedef uint64_t LinkHash;
 
     enum FindDirection { FindDirectionForward, FindDirectionBackward };
 
@@ -85,7 +85,7 @@ namespace WebCore {
     public:
         static void setNeedsReapplyStyles();
 
-        Page(ChromeClient*, ContextMenuClient*, EditorClient*, DragClient*, InspectorClient*, PluginHalterClient*);
+        Page(ChromeClient*, ContextMenuClient*, EditorClient*, DragClient*, InspectorClient*, PluginHalterClient*, GeolocationControllerClient*);
         ~Page();
 
         RenderTheme* theme() const { return m_theme.get(); };
@@ -93,10 +93,10 @@ namespace WebCore {
         static void refreshPlugins(bool reload);
         PluginData* pluginData() const;
 
-        void setCanStartPlugins(bool);
-        bool canStartPlugins() const { return m_canStartPlugins; }
-        void addUnstartedPlugin(PluginView*);
-        void removeUnstartedPlugin(PluginView*);
+        void setCanStartMedia(bool);
+        bool canStartMedia() const { return m_canStartMedia; }
+        void addMediaCanStartListener(MediaCanStartListener*);
+        void removeMediaCanStartListener(MediaCanStartListener*);
 
         EditorClient* editorClient() const { return m_editorClient; }
 
@@ -129,8 +129,8 @@ namespace WebCore {
         PageGroup* groupPtr() { return m_group; } // can return 0
 
         void incrementFrameCount() { ++m_frameCount; }
-        void decrementFrameCount() { --m_frameCount; }
-        int frameCount() const { return m_frameCount; }
+        void decrementFrameCount() { ASSERT(m_frameCount); --m_frameCount; }
+        int frameCount() const { checkFrameCountConsistency(); return m_frameCount; }
 
         Chrome* chrome() const { return m_chrome.get(); }
         SelectionController* dragCaretController() const { return m_dragCaretController.get(); }
@@ -144,13 +144,11 @@ namespace WebCore {
 #if ENABLE(INSPECTOR)
         InspectorController* inspectorController() const { return m_inspectorController.get(); }
 #endif
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+        GeolocationController* geolocationController() const { return m_geolocationController.get(); }
+#endif
         Settings* settings() const { return m_settings.get(); }
         ProgressTracker* progress() const { return m_progress.get(); }
-
-#if ENABLE(INSPECTOR)
-        void setParentInspectorController(InspectorController* controller) { m_parentInspectorController = controller; }
-        InspectorController* parentInspectorController() const { return m_parentInspectorController; }
-#endif
         
         void setTabKeyCyclesThroughElements(bool b) { m_tabKeyCyclesThroughElements = b; }
         bool tabKeyCyclesThroughElements() const { return m_tabKeyCyclesThroughElements; }
@@ -190,6 +188,8 @@ namespace WebCore {
         void userStyleSheetLocationChanged();
         const String& userStyleSheet() const;
 
+        void privateBrowsingStateChanged();
+
         void didStartPlugin(HaltablePlugin*);
         void didStopPlugin(HaltablePlugin*);
         void pluginAllowedRunTimeChanged();
@@ -198,12 +198,6 @@ namespace WebCore {
         void setDebugger(JSC::Debugger*);
         JSC::Debugger* debugger() const { return m_debugger; }
 
-#if PLATFORM(WIN) || (PLATFORM(WX) && PLATFORM(WIN_OS)) || (PLATFORM(QT) && defined(Q_WS_WIN))
-        // The global DLL or application instance used for all windows.
-        static void setInstanceHandle(HINSTANCE instanceHandle) { s_instanceHandle = instanceHandle; }
-        static HINSTANCE instanceHandle() { return s_instanceHandle; }
-#endif
-
         static void removeAllVisitedLinks();
 
         static void allVisitedStateChanged(PageGroup*);
@@ -238,6 +232,12 @@ namespace WebCore {
     private:
         void initGroup();
 
+#if ASSERT_DISABLED
+        void checkFrameCountConsistency() const { }
+#else
+        void checkFrameCountConsistency() const;
+#endif
+
         OwnPtr<Chrome> m_chrome;
         OwnPtr<SelectionController> m_dragCaretController;
 #if ENABLE(DRAG_SUPPORT)
@@ -250,6 +250,9 @@ namespace WebCore {
 #if ENABLE(INSPECTOR)
         OwnPtr<InspectorController> m_inspectorController;
 #endif
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+        OwnPtr<GeolocationController> m_geolocationController;
+#endif
         OwnPtr<Settings> m_settings;
         OwnPtr<ProgressTracker> m_progress;
         
@@ -278,10 +281,6 @@ namespace WebCore {
 
         bool m_javaScriptURLsAreAllowed;
 
-#if ENABLE(INSPECTOR)
-        InspectorController* m_parentInspectorController;
-#endif
-
         String m_userStyleSheetPath;
         mutable String m_userStyleSheet;
         mutable bool m_didLoadUserStyleSheet;
@@ -295,8 +294,8 @@ namespace WebCore {
         double m_customHTMLTokenizerTimeDelay;
         int m_customHTMLTokenizerChunkSize;
 
-        bool m_canStartPlugins;
-        HashSet<PluginView*> m_unstartedPlugins;
+        bool m_canStartMedia;
+        HashSet<MediaCanStartListener*> m_mediaCanStartListeners;
 
         OwnPtr<PluginHalter> m_pluginHalter;
 
@@ -304,10 +303,6 @@ namespace WebCore {
         RefPtr<StorageNamespace> m_sessionStorage;
 #endif
 
-#if PLATFORM(WIN) || (PLATFORM(WX) && defined(__WXMSW__)) || (PLATFORM(QT) && defined(Q_WS_WIN))
-        static HINSTANCE s_instanceHandle;
-#endif
-
 #if ENABLE(WML)
         OwnPtr<WMLPageState> m_wmlPageState;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/page/PageGroup.cpp b/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
index 427c240ec4..f376d5205a 100644
--- a/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "PageGroup.h"
 
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "Document.h"
 #include "Frame.h"
@@ -50,7 +51,7 @@ static unsigned getUniqueIdentifier()
 
 // --------
 
-static bool shouldTrackVisitedLinks;
+static bool shouldTrackVisitedLinks = false;
 
 PageGroup::PageGroup(const String& name)
     : m_name(name)
@@ -200,29 +201,29 @@ StorageNamespace* PageGroup::localStorage()
 }
 #endif
 
-void PageGroup::addUserScriptToWorld(unsigned worldID, const String& source, const KURL& url,  PassOwnPtr<Vector<String> > whitelist,
+void PageGroup::addUserScriptToWorld(DOMWrapperWorld* world, const String& source, const KURL& url,  PassOwnPtr<Vector<String> > whitelist,
                                      PassOwnPtr<Vector<String> > blacklist, UserScriptInjectionTime injectionTime)
 {
-    if (worldID == UINT_MAX)
-        return;
-    OwnPtr<UserScript> userScript(new UserScript(source, url, whitelist, blacklist, worldID, injectionTime));
+    ASSERT_ARG(world, world);
+
+    OwnPtr<UserScript> userScript(new UserScript(source, url, whitelist, blacklist, injectionTime));
     if (!m_userScripts)
         m_userScripts.set(new UserScriptMap);
-    UserScriptVector*& scriptsInWorld = m_userScripts->add(worldID, 0).first->second;
+    UserScriptVector*& scriptsInWorld = m_userScripts->add(world, 0).first->second;
     if (!scriptsInWorld)
         scriptsInWorld = new UserScriptVector;
     scriptsInWorld->append(userScript.release());
 }
 
-void PageGroup::addUserStyleSheetToWorld(unsigned worldID, const String& source, const KURL& url, PassOwnPtr<Vector<String> > whitelist,
+void PageGroup::addUserStyleSheetToWorld(DOMWrapperWorld* world, const String& source, const KURL& url, PassOwnPtr<Vector<String> > whitelist,
                                          PassOwnPtr<Vector<String> > blacklist)
 {
-    if (worldID == UINT_MAX)
-        return;
-    OwnPtr<UserStyleSheet> userStyleSheet(new UserStyleSheet(source, url, whitelist, blacklist, worldID));
+    ASSERT_ARG(world, world);
+
+    OwnPtr<UserStyleSheet> userStyleSheet(new UserStyleSheet(source, url, whitelist, blacklist));
     if (!m_userStyleSheets)
         m_userStyleSheets.set(new UserStyleSheetMap);
-    UserStyleSheetVector*& styleSheetsInWorld = m_userStyleSheets->add(worldID, 0).first->second;
+    UserStyleSheetVector*& styleSheetsInWorld = m_userStyleSheets->add(world, 0).first->second;
     if (!styleSheetsInWorld)
         styleSheetsInWorld = new UserStyleSheetVector;
     styleSheetsInWorld->append(userStyleSheet.release());
@@ -235,12 +236,14 @@ void PageGroup::addUserStyleSheetToWorld(unsigned worldID, const String& source,
     }
 }
 
-void PageGroup::removeUserScriptFromWorld(unsigned worldID, const KURL& url)
+void PageGroup::removeUserScriptFromWorld(DOMWrapperWorld* world, const KURL& url)
 {
+    ASSERT_ARG(world, world);
+
     if (!m_userScripts)
         return;
 
-    UserScriptMap::iterator it = m_userScripts->find(worldID);
+    UserScriptMap::iterator it = m_userScripts->find(world);
     if (it == m_userScripts->end())
         return;
     
@@ -257,12 +260,14 @@ void PageGroup::removeUserScriptFromWorld(unsigned worldID, const KURL& url)
     m_userScripts->remove(it);
 }
 
-void PageGroup::removeUserStyleSheetFromWorld(unsigned worldID, const KURL& url)
+void PageGroup::removeUserStyleSheetFromWorld(DOMWrapperWorld* world, const KURL& url)
 {
+    ASSERT_ARG(world, world);
+
     if (!m_userStyleSheets)
         return;
 
-    UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+    UserStyleSheetMap::iterator it = m_userStyleSheets->find(world);
     bool sheetsChanged = false;
     if (it == m_userStyleSheets->end())
         return;
@@ -291,12 +296,14 @@ void PageGroup::removeUserStyleSheetFromWorld(unsigned worldID, const KURL& url)
     }
 }
 
-void PageGroup::removeUserScriptsFromWorld(unsigned worldID)
+void PageGroup::removeUserScriptsFromWorld(DOMWrapperWorld* world)
 {
+    ASSERT_ARG(world, world);
+
     if (!m_userScripts)
         return;
 
-    UserScriptMap::iterator it = m_userScripts->find(worldID);
+    UserScriptMap::iterator it = m_userScripts->find(world);
     if (it == m_userScripts->end())
         return;
        
@@ -304,12 +311,14 @@ void PageGroup::removeUserScriptsFromWorld(unsigned worldID)
     m_userScripts->remove(it);
 }
 
-void PageGroup::removeUserStyleSheetsFromWorld(unsigned worldID)
+void PageGroup::removeUserStyleSheetsFromWorld(DOMWrapperWorld* world)
 {
+    ASSERT_ARG(world, world);
+
     if (!m_userStyleSheets)
         return;
     
-    UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+    UserStyleSheetMap::iterator it = m_userStyleSheets->find(world);
     if (it == m_userStyleSheets->end())
         return;
     
diff --git a/src/3rdparty/webkit/WebCore/page/PageGroup.h b/src/3rdparty/webkit/WebCore/page/PageGroup.h
index c233cd1118..446f0c7c12 100644
--- a/src/3rdparty/webkit/WebCore/page/PageGroup.h
+++ b/src/3rdparty/webkit/WebCore/page/PageGroup.h
@@ -70,17 +70,17 @@ namespace WebCore {
         bool hasLocalStorage() { return m_localStorage; }
 #endif
 
-        void addUserScriptToWorld(unsigned worldID, const String& source, const KURL&, 
+        void addUserScriptToWorld(DOMWrapperWorld*, const String& source, const KURL&, 
                                   PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
                                   UserScriptInjectionTime);
-        void addUserStyleSheetToWorld(unsigned worldID, const String& source, const KURL&,
+        void addUserStyleSheetToWorld(DOMWrapperWorld*, const String& source, const KURL&,
                                PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist);
         
-        void removeUserScriptFromWorld(unsigned, const KURL&);
-        void removeUserStyleSheetFromWorld(unsigned, const KURL&);
+        void removeUserScriptFromWorld(DOMWrapperWorld*, const KURL&);
+        void removeUserStyleSheetFromWorld(DOMWrapperWorld*, const KURL&);
         
-        void removeUserScriptsFromWorld(unsigned);
-        void removeUserStyleSheetsFromWorld(unsigned);
+        void removeUserScriptsFromWorld(DOMWrapperWorld*);
+        void removeUserStyleSheetsFromWorld(DOMWrapperWorld*);
     
         void removeAllUserContent();
         
diff --git a/src/3rdparty/webkit/WebCore/page/PluginHalter.cpp b/src/3rdparty/webkit/WebCore/page/PluginHalter.cpp
index 63f5469860..c0a645232f 100644
--- a/src/3rdparty/webkit/WebCore/page/PluginHalter.cpp
+++ b/src/3rdparty/webkit/WebCore/page/PluginHalter.cpp
@@ -28,6 +28,7 @@
 #include "PluginHalter.h"
 
 #include "HaltablePlugin.h"
+#include "PlatformString.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/Vector.h>
 
@@ -93,7 +94,7 @@ void PluginHalter::timerFired(Timer<PluginHalter>*)
             continue;
         }
 
-        if (m_client->shouldHaltPlugin(plugins[i]->node()))
+        if (m_client->shouldHaltPlugin(plugins[i]->node(), plugins[i]->isWindowed(), plugins[i]->pluginName()))
             plugins[i]->halt();
 
         m_plugins.remove(plugins[i]);
diff --git a/src/3rdparty/webkit/WebCore/page/PluginHalter.h b/src/3rdparty/webkit/WebCore/page/PluginHalter.h
index eddce34fbc..af8b31ea69 100644
--- a/src/3rdparty/webkit/WebCore/page/PluginHalter.h
+++ b/src/3rdparty/webkit/WebCore/page/PluginHalter.h
@@ -35,7 +35,7 @@ namespace WebCore {
 
 class HaltablePlugin;
 
-class PluginHalter {
+class PluginHalter : public Noncopyable {
 public:
     PluginHalter(PluginHalterClient*);
 
diff --git a/src/3rdparty/webkit/WebCore/page/PluginHalterClient.h b/src/3rdparty/webkit/WebCore/page/PluginHalterClient.h
index f77091f147..025154776a 100644
--- a/src/3rdparty/webkit/WebCore/page/PluginHalterClient.h
+++ b/src/3rdparty/webkit/WebCore/page/PluginHalterClient.h
@@ -29,12 +29,13 @@
 namespace WebCore {
 
 class Node;
+class String;
 
 class PluginHalterClient {
 public:
     virtual ~PluginHalterClient() { }
 
-    virtual bool shouldHaltPlugin(Node*) const = 0;
+    virtual bool shouldHaltPlugin(Node*, bool isWindowed, const String& pluginName) const = 0;
     virtual bool enabled() const = 0;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/page/PositionCallback.h b/src/3rdparty/webkit/WebCore/page/PositionCallback.h
index 9f36d7abb6..5b7a202966 100644
--- a/src/3rdparty/webkit/WebCore/page/PositionCallback.h
+++ b/src/3rdparty/webkit/WebCore/page/PositionCallback.h
@@ -26,7 +26,6 @@
 #ifndef PositionCallback_h
 #define PositionCallback_h
 
-#include <wtf/Platform.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/page/PositionError.h b/src/3rdparty/webkit/WebCore/page/PositionError.h
index f6f56f018d..146717041b 100644
--- a/src/3rdparty/webkit/WebCore/page/PositionError.h
+++ b/src/3rdparty/webkit/WebCore/page/PositionError.h
@@ -35,7 +35,6 @@ namespace WebCore {
 class PositionError : public RefCounted<PositionError> {
 public:
     enum ErrorCode {
-        UNKNOWN_ERROR = 0,
         PERMISSION_DENIED = 1,
         POSITION_UNAVAILABLE = 2,
         TIMEOUT = 3
diff --git a/src/3rdparty/webkit/WebCore/page/PositionError.idl b/src/3rdparty/webkit/WebCore/page/PositionError.idl
index cb2ef5e63d..5870e0d32b 100644
--- a/src/3rdparty/webkit/WebCore/page/PositionError.idl
+++ b/src/3rdparty/webkit/WebCore/page/PositionError.idl
@@ -25,13 +25,10 @@
 
 module core {
 
-    interface [
-        GenerateConstructor
-    ] PositionError {
+    interface [Conditional=GEOLOCATION] PositionError {
         readonly attribute unsigned short code;
         readonly attribute DOMString message;
 
-        const unsigned short UNKNOWN_ERROR = 0;
         const unsigned short PERMISSION_DENIED = 1;
         const unsigned short POSITION_UNAVAILABLE = 2;
         const unsigned short TIMEOUT = 3;
diff --git a/src/3rdparty/webkit/WebCore/page/PositionErrorCallback.h b/src/3rdparty/webkit/WebCore/page/PositionErrorCallback.h
index c23e8832f1..e784297bc6 100644
--- a/src/3rdparty/webkit/WebCore/page/PositionErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/page/PositionErrorCallback.h
@@ -26,7 +26,6 @@
 #ifndef PositionErrorCallback_h
 #define PositionErrorCallback_h
 
-#include <wtf/Platform.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/page/PrintContext.cpp b/src/3rdparty/webkit/WebCore/page/PrintContext.cpp
index 4d3a839927..b6806eb7dc 100644
--- a/src/3rdparty/webkit/WebCore/page/PrintContext.cpp
+++ b/src/3rdparty/webkit/WebCore/page/PrintContext.cpp
@@ -45,6 +45,11 @@ int PrintContext::pageCount() const
     return m_pageRects.size();
 }
 
+const IntRect& PrintContext::pageRect(int pageNumber) const
+{
+    return m_pageRects[pageNumber];
+}
+
 void PrintContext::computePageRects(const FloatRect& printRect, float headerHeight, float footerHeight, float userScaleFactor, float& outPageHeight)
 {
     m_pageRects.clear();
@@ -60,11 +65,6 @@ void PrintContext::computePageRects(const FloatRect& printRect, float headerHeig
         return;
     }
 
-    if (userScaleFactor <= 0) {
-        LOG_ERROR("userScaleFactor has bad value %.2f", userScaleFactor);
-        return;
-    }
-
     float ratio = printRect.height() / printRect.width();
 
     float pageWidth  = (float)root->rightLayoutOverflow();
@@ -77,14 +77,31 @@ void PrintContext::computePageRects(const FloatRect& printRect, float headerHeig
         return;
     }
 
-    float currPageHeight = pageHeight / userScaleFactor;
+    computePageRectsWithPageSize(FloatSize(pageWidth, pageHeight), userScaleFactor);
+}
+
+void PrintContext::computePageRectsWithPageSize(const FloatSize& pageSizeInPixels, float userScaleFactor)
+{
+    RenderView* root = toRenderView(m_frame->document()->renderer());
+
+    if (!root) {
+        LOG_ERROR("document to be printed has no renderer");
+        return;
+    }
+
+    if (userScaleFactor <= 0) {
+        LOG_ERROR("userScaleFactor has bad value %.2f", userScaleFactor);
+        return;
+    }
+
+    float currPageHeight = pageSizeInPixels.height() / userScaleFactor;
     float docHeight = root->layer()->height();
-    float currPageWidth = pageWidth / userScaleFactor;
+    float currPageWidth = pageSizeInPixels.width() / userScaleFactor;
 
     // always return at least one page, since empty files should print a blank page
-    float printedPagesHeight = 0.0;
+    float printedPagesHeight = 0;
     do {
-        float proposedBottom = std::min(docHeight, printedPagesHeight + pageHeight);
+        float proposedBottom = std::min(docHeight, printedPagesHeight + pageSizeInPixels.height());
         m_frame->view()->adjustPageHeight(&proposedBottom, printedPagesHeight, proposedBottom, printedPagesHeight);
         currPageHeight = max(1.0f, proposedBottom - printedPagesHeight);
 
@@ -134,4 +151,54 @@ void PrintContext::end()
     m_frame->setPrinting(false, 0, 0, true);
 }
 
+static RenderBoxModelObject* enclosingBoxModelObject(RenderObject* object)
+{
+
+    while (object && !object->isBoxModelObject())
+        object = object->parent();
+    if (!object)
+        return 0;
+    return toRenderBoxModelObject(object);
+}
+
+int PrintContext::pageNumberForElement(Element* element, const FloatSize& pageSizeInPixels)
+{
+    // Make sure the element is not freed during the layout.
+    RefPtr<Element> elementRef(element);
+    element->document()->updateLayout();
+
+    RenderBoxModelObject* box = enclosingBoxModelObject(element->renderer());
+    if (!box)
+        return -1;
+
+    Frame* frame = element->document()->frame();
+    FloatRect pageRect(FloatPoint(0, 0), pageSizeInPixels);
+    PrintContext printContext(frame);
+    printContext.begin(pageRect.width());
+    printContext.computePageRectsWithPageSize(pageSizeInPixels, 1);
+
+    int top = box->offsetTop();
+    int left = box->offsetLeft();
+    int pageNumber = 0;
+    for (; pageNumber < printContext.pageCount(); pageNumber++) {
+        const IntRect& page = printContext.pageRect(pageNumber);
+        if (page.x() <= left && left < page.right() && page.y() <= top && top < page.bottom())
+            break;
+    }
+    printContext.end();
+    return (pageNumber < printContext.pageCount() ? pageNumber : -1);
+}
+
+int PrintContext::numberOfPages(Frame* frame, const FloatSize& pageSizeInPixels)
+{
+    frame->document()->updateLayout();
+
+    FloatRect pageRect(FloatPoint(0, 0), pageSizeInPixels);
+    PrintContext printContext(frame);
+    printContext.begin(pageRect.width());
+    printContext.computePageRectsWithPageSize(pageSizeInPixels, 1);
+    printContext.end();
+    return printContext.pageCount();
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/page/PrintContext.h b/src/3rdparty/webkit/WebCore/page/PrintContext.h
index 0b3b303559..ec15b8420a 100644
--- a/src/3rdparty/webkit/WebCore/page/PrintContext.h
+++ b/src/3rdparty/webkit/WebCore/page/PrintContext.h
@@ -25,8 +25,10 @@
 
 namespace WebCore {
 
+class Element;
 class Frame;
 class FloatRect;
+class FloatSize;
 class GraphicsContext;
 class IntRect;
 
@@ -36,6 +38,8 @@ public:
     ~PrintContext();
 
     int pageCount() const;
+    const IntRect& pageRect(int pageNumber) const;
+    const Vector<IntRect>& pageRects() const { return m_pageRects; }
 
     void computePageRects(const FloatRect& printRect, float headerHeight, float footerHeight, float userScaleFactor, float& outPageHeight);
 
@@ -47,7 +51,13 @@ public:
 
     void end();
 
+    // Used by layout tests.
+    static int pageNumberForElement(Element*, const FloatSize& pageSizeInPixels);
+    static int numberOfPages(Frame*, const FloatSize& pageSizeInPixels);
+
 protected:
+    void computePageRectsWithPageSize(const FloatSize& pageSizeInPixels, float userScaleFactor);
+
     Frame* m_frame;
     Vector<IntRect> m_pageRects;
 };
diff --git a/src/3rdparty/webkit/WebCore/page/Screen.idl b/src/3rdparty/webkit/WebCore/page/Screen.idl
index ca7d20da08..cd181eb3b9 100644
--- a/src/3rdparty/webkit/WebCore/page/Screen.idl
+++ b/src/3rdparty/webkit/WebCore/page/Screen.idl
@@ -29,7 +29,7 @@
 
 module window {
 
-    interface Screen {
+    interface [OmitConstructor] Screen {
         readonly attribute unsigned long height;
         readonly attribute unsigned long width;
         readonly attribute unsigned long colorDepth;
diff --git a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
index 338bf9fa3d..c0b3e220ea 100644
--- a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
@@ -65,37 +65,37 @@ static URLSchemesMap& localSchemes()
     return localSchemes;
 }
 
-static URLSchemesMap& noAccessSchemes()
+static URLSchemesMap& secureSchemes()
 {
-    DEFINE_STATIC_LOCAL(URLSchemesMap, noAccessSchemes, ());
+    DEFINE_STATIC_LOCAL(URLSchemesMap, secureSchemes, ());
 
-    if (noAccessSchemes.isEmpty())
-        noAccessSchemes.add("data");
+    if (secureSchemes.isEmpty()) {
+        secureSchemes.add("https");
+        secureSchemes.add("about");
+        secureSchemes.add("data");
+    }
 
-    return noAccessSchemes;
+    return secureSchemes;
 }
 
-bool SecurityOrigin::isDefaultPortForProtocol(unsigned short port, const String& protocol)
+static URLSchemesMap& schemesWithUniqueOrigins()
 {
-    if (protocol.isEmpty())
-        return false;
+    DEFINE_STATIC_LOCAL(URLSchemesMap, schemesWithUniqueOrigins, ());
 
-    typedef HashMap<String, unsigned> DefaultPortsMap;
-    DEFINE_STATIC_LOCAL(DefaultPortsMap, defaultPorts, ());
-    if (defaultPorts.isEmpty()) {
-        defaultPorts.set("http", 80);
-        defaultPorts.set("https", 443);
-        defaultPorts.set("ftp", 21);
-        defaultPorts.set("ftps", 990);
-    }
-    return defaultPorts.get(protocol) == port;
+    // This is a willful violation of HTML5.
+    // See https://bugs.webkit.org/show_bug.cgi?id=11885
+    if (schemesWithUniqueOrigins.isEmpty())
+        schemesWithUniqueOrigins.add("data");
+
+    return schemesWithUniqueOrigins;
 }
 
-SecurityOrigin::SecurityOrigin(const KURL& url)
-    : m_protocol(url.protocol().isNull() ? "" : url.protocol().lower())
+SecurityOrigin::SecurityOrigin(const KURL& url, SandboxFlags sandboxFlags)
+    : m_sandboxFlags(sandboxFlags)
+    , m_protocol(url.protocol().isNull() ? "" : url.protocol().lower())
     , m_host(url.host().isNull() ? "" : url.host().lower())
     , m_port(url.port())
-    , m_noAccess(false)
+    , m_isUnique(isSandboxed(SandboxOrigin) || shouldTreatURLSchemeAsNoAccess(m_protocol))
     , m_universalAccess(false)
     , m_domainWasSetInDOM(false)
 {
@@ -103,26 +103,29 @@ SecurityOrigin::SecurityOrigin(const KURL& url)
     if (m_protocol == "about" || m_protocol == "javascript")
         m_protocol = "";
 
-    // Some URLs are not allowed access to anything other than themselves.
-    if (shouldTreatURLSchemeAsNoAccess(m_protocol))
-        m_noAccess = true;
-
     // document.domain starts as m_host, but can be set by the DOM.
     m_domain = m_host;
 
     // By default, only local SecurityOrigins can load local resources.
     m_canLoadLocalResources = isLocal();
+    if (m_canLoadLocalResources) {
+        // Directories should never be readable.
+        if (!url.hasPath() || url.path().endsWith("/"))
+            m_isUnique = true;
+    }
 
     if (isDefaultPortForProtocol(m_port, m_protocol))
         m_port = 0;
 }
 
 SecurityOrigin::SecurityOrigin(const SecurityOrigin* other)
-    : m_protocol(other->m_protocol.threadsafeCopy())
+    : m_sandboxFlags(other->m_sandboxFlags)
+    , m_protocol(other->m_protocol.threadsafeCopy())
     , m_host(other->m_host.threadsafeCopy())
+    , m_encodedHost(other->m_encodedHost.threadsafeCopy())
     , m_domain(other->m_domain.threadsafeCopy())
     , m_port(other->m_port)
-    , m_noAccess(other->m_noAccess)
+    , m_isUnique(other->m_isUnique)
     , m_universalAccess(other->m_universalAccess)
     , m_domainWasSetInDOM(other->m_domainWasSetInDOM)
     , m_canLoadLocalResources(other->m_canLoadLocalResources)
@@ -134,11 +137,11 @@ bool SecurityOrigin::isEmpty() const
     return m_protocol.isEmpty();
 }
 
-PassRefPtr<SecurityOrigin> SecurityOrigin::create(const KURL& url)
+PassRefPtr<SecurityOrigin> SecurityOrigin::create(const KURL& url, SandboxFlags sandboxFlags)
 {
     if (!url.isValid())
-        return adoptRef(new SecurityOrigin(KURL()));
-    return adoptRef(new SecurityOrigin(url));
+        return adoptRef(new SecurityOrigin(KURL(), sandboxFlags));
+    return adoptRef(new SecurityOrigin(url, sandboxFlags));
 }
 
 PassRefPtr<SecurityOrigin> SecurityOrigin::createEmpty()
@@ -157,20 +160,45 @@ void SecurityOrigin::setDomainFromDOM(const String& newDomain)
     m_domain = newDomain.lower();
 }
 
+static HashSet<String>& schemesForbiddenFromDomainRelaxation()
+{
+    DEFINE_STATIC_LOCAL(HashSet<String>, schemes, ());
+    return schemes;
+}
+
+void SecurityOrigin::setDomainRelaxationForbiddenForURLScheme(bool forbidden, const String& scheme)
+{
+    if (scheme.isEmpty())
+        return;
+
+    if (forbidden)
+        schemesForbiddenFromDomainRelaxation().add(scheme);
+    else
+        schemesForbiddenFromDomainRelaxation().remove(scheme);
+}
+
+bool SecurityOrigin::isDomainRelaxationForbiddenForURLScheme(const String& scheme)
+{
+    if (scheme.isEmpty())
+        return false;
+
+    return schemesForbiddenFromDomainRelaxation().contains(scheme);
+}
+
 bool SecurityOrigin::canAccess(const SecurityOrigin* other) const
 {  
     if (m_universalAccess)
         return true;
 
-    if (m_noAccess || other->m_noAccess)
+    if (isUnique() || other->isUnique())
         return false;
 
     // Here are two cases where we should permit access:
     //
-    // 1) Neither document has set document.domain.  In this case, we insist
+    // 1) Neither document has set document.domain. In this case, we insist
     //    that the scheme, host, and port of the URLs match.
     //
-    // 2) Both documents have set document.domain.  In this case, we insist
+    // 2) Both documents have set document.domain. In this case, we insist
     //    that the documents have set document.domain to the same value and
     //    that the scheme of the URLs match.
     //
@@ -203,10 +231,12 @@ bool SecurityOrigin::canRequest(const KURL& url) const
     if (m_universalAccess)
         return true;
 
-    if (m_noAccess)
+    if (isUnique())
         return false;
 
     RefPtr<SecurityOrigin> targetOrigin = SecurityOrigin::create(url);
+    if (targetOrigin->isUnique())
+        return false;
 
     // We call isSameSchemeHostPort here instead of canAccess because we want
     // to ignore document.domain effects.
@@ -228,11 +258,12 @@ bool SecurityOrigin::taintsCanvas(const KURL& url) const
     if (canRequest(url))
         return false;
 
-    // This method exists because we treat data URLs as noAccess, contrary
-    // to the current (9/19/2009) draft of the HTML5 specification.  We still
-    // want to let folks paint data URLs onto untainted canvases, so we special
-    // case data URLs below.  If we change to match HTML5 w.r.t. data URL
-    // security, then we can remove this method in favor of !canRequest.
+    // This function exists because we treat data URLs as having a unique origin,
+    // contrary to the current (9/19/2009) draft of the HTML5 specification.
+    // We still want to let folks paint data URLs onto untainted canvases, so
+    // we special case data URLs below. If we change to match HTML5 w.r.t.
+    // data URL security, then we can remove this function in favor of
+    // !canRequest.
     if (url.protocolIs("data"))
         return false;
 
@@ -255,8 +286,8 @@ bool SecurityOrigin::canLoad(const KURL& url, const String& referrer, Document*
 
 void SecurityOrigin::grantLoadLocalResources()
 {
-    // This method exists only to support backwards compatibility with older
-    // versions of WebKit.  Granting privileges to some, but not all, documents
+    // This function exists only to support backwards compatibility with older
+    // versions of WebKit. Granting privileges to some, but not all, documents
     // in a SecurityOrigin is a security hazard because the documents without
     // the privilege can obtain the privilege by injecting script into the
     // documents that have been granted the privilege.
@@ -269,6 +300,11 @@ void SecurityOrigin::grantUniversalAccess()
     m_universalAccess = true;
 }
 
+void SecurityOrigin::makeUnique()
+{
+    m_isUnique = true;
+}
+
 bool SecurityOrigin::isLocal() const
 {
     return shouldTreatURLSchemeAsLocal(m_protocol);
@@ -289,7 +325,7 @@ String SecurityOrigin::toString() const
     if (isEmpty())
         return "null";
 
-    if (m_noAccess)
+    if (isUnique())
         return "null";
 
     if (m_protocol == "file")
@@ -346,13 +382,92 @@ PassRefPtr<SecurityOrigin> SecurityOrigin::createFromDatabaseIdentifier(const St
     // Split out the 3 sections of data
     String protocol = databaseIdentifier.substring(0, separator1);
     String host = databaseIdentifier.substring(separator1 + 1, separator2 - separator1 - 1);
+    
+    host = decodeURLEscapeSequences(host);
     return create(KURL(KURL(), protocol + "://" + host + ":" + String::number(port)));
 }
 
+// The following lower-ASCII characters need escaping to be used in a filename
+// across all systems, including Windows:
+//     - Unprintable ASCII (00-1F)
+//     - Space             (20)
+//     - Double quote      (22)
+//     - Percent           (25) (escaped because it is our escape character)
+//     - Asterisk          (2A)
+//     - Slash             (2F)
+//     - Colon             (3A)
+//     - Less-than         (3C)
+//     - Greater-than      (3E)
+//     - Question Mark     (3F)
+//     - Backslash         (5C)
+//     - Pipe              (7C)
+//     - Delete            (7F)
+
+static const bool needsEscaping[128] = {
+    /* 00-07 */ true,  true,  true,  true,  true,  true,  true,  true, 
+    /* 08-0F */ true,  true,  true,  true,  true,  true,  true,  true, 
+
+    /* 10-17 */ true,  true,  true,  true,  true,  true,  true,  true, 
+    /* 18-1F */ true,  true,  true,  true,  true,  true,  true,  true, 
+
+    /* 20-27 */ true,  false, true,  false, false, true,  false, false, 
+    /* 28-2F */ false, false, true,  false, false, false, false, true, 
+    
+    /* 30-37 */ false, false, false, false, false, false, false, false, 
+    /* 38-3F */ false, false, true,  false, true,  false, true,  true, 
+    
+    /* 40-47 */ false, false, false, false, false, false, false, false, 
+    /* 48-4F */ false, false, false, false, false, false, false, false,
+    
+    /* 50-57 */ false, false, false, false, false, false, false, false, 
+    /* 58-5F */ false, false, false, false, true,  false, false, false,
+    
+    /* 60-67 */ false, false, false, false, false, false, false, false, 
+    /* 68-6F */ false, false, false, false, false, false, false, false,
+    
+    /* 70-77 */ false, false, false, false, false, false, false, false, 
+    /* 78-7F */ false, false, false, false, true,  false, false, true, 
+};
+
+static inline bool shouldEscapeUChar(UChar c)
+{
+    return c > 127 ? false : needsEscaping[c];
+}
+
+static const char hexDigits[17] = "0123456789ABCDEF";
+
+static String encodedHost(const String& host)
+{
+    unsigned length = host.length();
+    Vector<UChar, 512> buffer(length * 3 + 1);
+    UChar* p = buffer.data();
+
+    const UChar* str = host.characters();
+    const UChar* strEnd = str + length;
+
+    while (str < strEnd) {
+        UChar c = *str++;
+        if (shouldEscapeUChar(c)) {
+            *p++ = '%';
+            *p++ = hexDigits[(c >> 4) & 0xF];
+            *p++ = hexDigits[c & 0xF];
+        } else
+            *p++ = c;
+    }
+
+    ASSERT(p - buffer.data() <= static_cast<int>(buffer.size()));
+
+    return String(buffer.data(), p - buffer.data());
+}
+
 String SecurityOrigin::databaseIdentifier() const 
 {
-    DEFINE_STATIC_LOCAL(String, separatorString, (&SeparatorCharacter, 1));
-    return m_protocol + separatorString + m_host + separatorString + String::number(m_port); 
+    String separatorString(&SeparatorCharacter, 1);
+
+    if (m_encodedHost.isEmpty())
+        m_encodedHost = encodedHost(m_host);
+
+    return m_protocol + separatorString + m_encodedHost + separatorString + String::number(m_port); 
 }
 
 bool SecurityOrigin::equal(const SecurityOrigin* other) const 
@@ -399,14 +514,10 @@ void SecurityOrigin::removeURLSchemeRegisteredAsLocal(const String& scheme)
     if (scheme == "applewebdata")
         return;
 #endif
-#if PLATFORM(QT)
-    if (scheme == "qrc")
-        return;
-#endif
     localSchemes().remove(scheme);
 }
 
-const URLSchemesMap&  SecurityOrigin::localURLSchemes()
+const URLSchemesMap& SecurityOrigin::localURLSchemes()
 {
     return localSchemes();
 }
@@ -451,12 +562,22 @@ bool SecurityOrigin::shouldTreatURLSchemeAsLocal(const String& scheme)
 
 void SecurityOrigin::registerURLSchemeAsNoAccess(const String& scheme)
 {
-    noAccessSchemes().add(scheme);
+    schemesWithUniqueOrigins().add(scheme);
 }
 
 bool SecurityOrigin::shouldTreatURLSchemeAsNoAccess(const String& scheme)
 {
-    return noAccessSchemes().contains(scheme);
+    return schemesWithUniqueOrigins().contains(scheme);
+}
+
+void SecurityOrigin::registerURLSchemeAsSecure(const String& scheme)
+{
+    secureSchemes().add(scheme);
+}
+
+bool SecurityOrigin::shouldTreatURLSchemeAsSecure(const String& scheme)
+{
+    return secureSchemes().contains(scheme);
 }
 
 bool SecurityOrigin::shouldHideReferrer(const KURL& url, const String& referrer)
diff --git a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
index 6d4ce1ffb6..11c213ec76 100644
--- a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
+++ b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
@@ -34,152 +34,184 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
 
+#include "FrameLoaderTypes.h"
 #include "PlatformString.h"
 #include "StringHash.h"
 
 namespace WebCore {
 
-    typedef HashSet<String, CaseFoldingHash> URLSchemesMap;
-
-    class Document;
-    class KURL;
-    
-    class SecurityOrigin : public ThreadSafeShared<SecurityOrigin> {
-    public:
-        static PassRefPtr<SecurityOrigin> createFromDatabaseIdentifier(const String&);
-        static PassRefPtr<SecurityOrigin> createFromString(const String&);
-        static PassRefPtr<SecurityOrigin> create(const KURL&);
-        static PassRefPtr<SecurityOrigin> createEmpty();
-
-        // Create a deep copy of this SecurityOrigin.  This method is useful
-        // when marshalling a SecurityOrigin to another thread.
-        PassRefPtr<SecurityOrigin> threadsafeCopy();
-
-        // Set the domain property of this security origin to newDomain.  This
-        // function does not check whether newDomain is a suffix of the current
-        // domain.  The caller is responsible for validating newDomain.
-        void setDomainFromDOM(const String& newDomain);
-        bool domainWasSetInDOM() const { return m_domainWasSetInDOM; }
-
-        String protocol() const { return m_protocol; }
-        String host() const { return m_host; }
-        String domain() const { return m_domain; }
-        unsigned short port() const { return m_port; }
-
-        // Returns true if this SecurityOrigin can script objects in the given
-        // SecurityOrigin.  For example, call this function before allowing
-        // script from one security origin to read or write objects from
-        // another SecurityOrigin.
-        bool canAccess(const SecurityOrigin*) const;
-
-        // Returns true if this SecurityOrigin can read content retrieved from
-        // the given URL.  For example, call this function before issuing
-        // XMLHttpRequests.
-        bool canRequest(const KURL&) const;
-
-        // Returns true if drawing an image from this URL taints a canvas from
-        // this security origin.  For example, call this function before
-        // drawing an image onto an HTML canvas element with the drawImage API.
-        bool taintsCanvas(const KURL&) const;
-
-        // Returns true for any non-local URL. If document parameter is supplied,
-        // its local load policy dictates, otherwise if referrer is non-empty and
-        // represents a local file, then the local load is allowed.
-        static bool canLoad(const KURL&, const String& referrer, Document* document);
-
-        // Returns true if this SecurityOrigin can load local resources, such
-        // as images, iframes, and style sheets, and can link to local URLs.
-        // For example, call this function before creating an iframe to a
-        // file:// URL.
-        //
-        // Note: A SecurityOrigin might be allowed to load local resources
-        //       without being able to issue an XMLHttpRequest for a local URL.
-        //       To determine whether the SecurityOrigin can issue an
-        //       XMLHttpRequest for a URL, call canRequest(url).
-        bool canLoadLocalResources() const { return m_canLoadLocalResources; }
-
-        // Explicitly grant the ability to load local resources to this
-        // SecurityOrigin.
-        //
-        // Note: This method exists only to support backwards compatibility
-        //       with older versions of WebKit.
-        void grantLoadLocalResources();
-
-        // Explicitly grant the ability to access very other SecurityOrigin.
-        //
-        // WARNING: This is an extremely powerful ability.  Use with caution!
-        void grantUniversalAccess();
-
-        bool isSecureTransitionTo(const KURL&) const;
-
-        // The local SecurityOrigin is the most privileged SecurityOrigin.
-        // The local SecurityOrigin can script any document, navigate to local
-        // resources, and can set arbitrary headers on XMLHttpRequests.
-        bool isLocal() const;
-
-        // The empty SecurityOrigin is the least privileged SecurityOrigin.
-        bool isEmpty() const;
-
-        // Convert this SecurityOrigin into a string.  The string
-        // representation of a SecurityOrigin is similar to a URL, except it
-        // lacks a path component.  The string representation does not encode
-        // the value of the SecurityOrigin's domain property.  The empty
-        // SecurityOrigin is represented with the string "null".
-        String toString() const;
-
-        // Serialize the security origin to a string that could be used as part of
-        // file names. This format should be used in storage APIs only.
-        String databaseIdentifier() const;
-
-        // This method checks for equality between SecurityOrigins, not whether
-        // one origin can access another.  It is used for hash table keys.
-        // For access checks, use canAccess().
-        // FIXME: If this method is really only useful for hash table keys, it
-        // should be refactored into SecurityOriginHash.
-        bool equal(const SecurityOrigin*) const;
-
-        // This method checks for equality, ignoring the value of document.domain
-        // (and whether it was set) but considering the host. It is used for postMessage.
-        bool isSameSchemeHostPort(const SecurityOrigin*) const;
-
-        static void registerURLSchemeAsLocal(const String&);
-        static void removeURLSchemeRegisteredAsLocal(const String&);
-        static const URLSchemesMap& localURLSchemes();
-        static bool shouldTreatURLAsLocal(const String&);
-        static bool shouldTreatURLSchemeAsLocal(const String&);
-
-        static bool shouldHideReferrer(const KURL&, const String& referrer);
-
-        enum LocalLoadPolicy {
-            AllowLocalLoadsForAll,  // No restriction on local loads.
-            AllowLocalLoadsForLocalAndSubstituteData,
-            AllowLocalLoadsForLocalOnly,
-        };
-        static void setLocalLoadPolicy(LocalLoadPolicy);
-        static bool restrictAccessToLocal();
-        static bool allowSubstituteDataAccessToLocal();
-
-        static void registerURLSchemeAsNoAccess(const String&);
-        static bool shouldTreatURLSchemeAsNoAccess(const String&);
-
-        static void whiteListAccessFromOrigin(const SecurityOrigin& sourceOrigin, const String& destinationProtocol, const String& destinationDomains, bool allowDestinationSubdomains);
-        static void resetOriginAccessWhiteLists();
-
-        static bool isDefaultPortForProtocol(unsigned short port, const String& protocol);
-
-    private:
-        explicit SecurityOrigin(const KURL&);
-        explicit SecurityOrigin(const SecurityOrigin*);
-
-        String m_protocol;
-        String m_host;
-        String m_domain;
-        unsigned short m_port;
-        bool m_noAccess;
-        bool m_universalAccess;
-        bool m_domainWasSetInDOM;
-        bool m_canLoadLocalResources;
+typedef HashSet<String, CaseFoldingHash> URLSchemesMap;
+
+class Document;
+class KURL;
+
+class SecurityOrigin : public ThreadSafeShared<SecurityOrigin> {
+public:
+    static PassRefPtr<SecurityOrigin> createFromDatabaseIdentifier(const String&);
+    static PassRefPtr<SecurityOrigin> createFromString(const String&);
+    static PassRefPtr<SecurityOrigin> create(const KURL&, SandboxFlags = SandboxNone);
+    static PassRefPtr<SecurityOrigin> createEmpty();
+
+    // Create a deep copy of this SecurityOrigin. This method is useful
+    // when marshalling a SecurityOrigin to another thread.
+    PassRefPtr<SecurityOrigin> threadsafeCopy();
+
+    // Set the domain property of this security origin to newDomain. This
+    // function does not check whether newDomain is a suffix of the current
+    // domain. The caller is responsible for validating newDomain.
+    void setDomainFromDOM(const String& newDomain);
+    bool domainWasSetInDOM() const { return m_domainWasSetInDOM; }
+
+    static void setDomainRelaxationForbiddenForURLScheme(bool forbidden, const String&);
+    static bool isDomainRelaxationForbiddenForURLScheme(const String&);
+
+    String protocol() const { return m_protocol; }
+    String host() const { return m_host; }
+    String domain() const { return m_domain; }
+    unsigned short port() const { return m_port; }
+
+    // Returns true if this SecurityOrigin can script objects in the given
+    // SecurityOrigin. For example, call this function before allowing
+    // script from one security origin to read or write objects from
+    // another SecurityOrigin.
+    bool canAccess(const SecurityOrigin*) const;
+
+    // Returns true if this SecurityOrigin can read content retrieved from
+    // the given URL. For example, call this function before issuing
+    // XMLHttpRequests.
+    bool canRequest(const KURL&) const;
+
+    // Returns true if drawing an image from this URL taints a canvas from
+    // this security origin. For example, call this function before
+    // drawing an image onto an HTML canvas element with the drawImage API.
+    bool taintsCanvas(const KURL&) const;
+
+    // Returns true for any non-local URL. If document parameter is supplied,
+    // its local load policy dictates, otherwise if referrer is non-empty and
+    // represents a local file, then the local load is allowed.
+    static bool canLoad(const KURL&, const String& referrer, Document* document);
+
+    // Returns true if this SecurityOrigin can load local resources, such
+    // as images, iframes, and style sheets, and can link to local URLs.
+    // For example, call this function before creating an iframe to a
+    // file:// URL.
+    //
+    // Note: A SecurityOrigin might be allowed to load local resources
+    //       without being able to issue an XMLHttpRequest for a local URL.
+    //       To determine whether the SecurityOrigin can issue an
+    //       XMLHttpRequest for a URL, call canRequest(url).
+    bool canLoadLocalResources() const { return m_canLoadLocalResources; }
+
+    // Explicitly grant the ability to load local resources to this
+    // SecurityOrigin.
+    //
+    // Note: This method exists only to support backwards compatibility
+    //       with older versions of WebKit.
+    void grantLoadLocalResources();
+
+    // Explicitly grant the ability to access very other SecurityOrigin.
+    //
+    // WARNING: This is an extremely powerful ability. Use with caution!
+    void grantUniversalAccess();
+
+    bool isSandboxed(SandboxFlags mask) const { return m_sandboxFlags & mask; }
+
+    bool canAccessDatabase() const { return !isUnique(); }
+    bool canAccessLocalStorage() const { return !isUnique(); }
+    bool canAccessCookies() const { return !isUnique(); }
+
+    bool isSecureTransitionTo(const KURL&) const;
+
+    // The local SecurityOrigin is the most privileged SecurityOrigin.
+    // The local SecurityOrigin can script any document, navigate to local
+    // resources, and can set arbitrary headers on XMLHttpRequests.
+    bool isLocal() const;
+
+    // The empty SecurityOrigin is the least privileged SecurityOrigin.
+    bool isEmpty() const;
+
+    // The origin is a globally unique identifier assigned when the Document is
+    // created. http://www.whatwg.org/specs/web-apps/current-work/#sandboxOrigin
+    //
+    // There's a subtle difference between a unique origin and an origin that
+    // has the SandboxOrigin flag set. The latter implies the former, and, in
+    // addition, the SandboxOrigin flag is inherited by iframes.
+    bool isUnique() const { return m_isUnique; }
+
+    // Marks an origin as being unique.
+    void makeUnique();
+
+    // Convert this SecurityOrigin into a string. The string
+    // representation of a SecurityOrigin is similar to a URL, except it
+    // lacks a path component. The string representation does not encode
+    // the value of the SecurityOrigin's domain property.
+    //
+    // When using the string value, it's important to remember that it might be
+    // "null". This happens when this SecurityOrigin is unique. For example,
+    // this SecurityOrigin might have come from a sandboxed iframe, the
+    // SecurityOrigin might be empty, or we might have explicitly decided that
+    // we shouldTreatURLSchemeAsNoAccess.
+    String toString() const;
+
+    // Serialize the security origin to a string that could be used as part of
+    // file names. This format should be used in storage APIs only.
+    String databaseIdentifier() const;
+
+    // This method checks for equality between SecurityOrigins, not whether
+    // one origin can access another. It is used for hash table keys.
+    // For access checks, use canAccess().
+    // FIXME: If this method is really only useful for hash table keys, it
+    // should be refactored into SecurityOriginHash.
+    bool equal(const SecurityOrigin*) const;
+
+    // This method checks for equality, ignoring the value of document.domain
+    // (and whether it was set) but considering the host. It is used for postMessage.
+    bool isSameSchemeHostPort(const SecurityOrigin*) const;
+
+    static void registerURLSchemeAsLocal(const String&);
+    static void removeURLSchemeRegisteredAsLocal(const String&);
+    static const URLSchemesMap& localURLSchemes();
+    static bool shouldTreatURLAsLocal(const String&);
+    static bool shouldTreatURLSchemeAsLocal(const String&);
+
+    // Secure schemes do not trigger mixed content warnings. For example,
+    // https and data are secure schemes because they cannot be corrupted by
+    // active network attackers.
+    static void registerURLSchemeAsSecure(const String&);
+    static bool shouldTreatURLSchemeAsSecure(const String&);
+
+    static bool shouldHideReferrer(const KURL&, const String& referrer);
+
+    enum LocalLoadPolicy {
+        AllowLocalLoadsForAll, // No restriction on local loads.
+        AllowLocalLoadsForLocalAndSubstituteData,
+        AllowLocalLoadsForLocalOnly,
     };
+    static void setLocalLoadPolicy(LocalLoadPolicy);
+    static bool restrictAccessToLocal();
+    static bool allowSubstituteDataAccessToLocal();
+
+    static void registerURLSchemeAsNoAccess(const String&);
+    static bool shouldTreatURLSchemeAsNoAccess(const String&);
+
+    static void whiteListAccessFromOrigin(const SecurityOrigin& sourceOrigin, const String& destinationProtocol, const String& destinationDomains, bool allowDestinationSubdomains);
+    static void resetOriginAccessWhiteLists();
+
+private:
+    SecurityOrigin(const KURL&, SandboxFlags);
+    explicit SecurityOrigin(const SecurityOrigin*);
+
+    SandboxFlags m_sandboxFlags;
+    String m_protocol;
+    String m_host;
+    mutable String m_encodedHost;
+    String m_domain;
+    unsigned short m_port;
+    bool m_isUnique;
+    bool m_universalAccess;
+    bool m_domainWasSetInDOM;
+    bool m_canLoadLocalResources;
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.cpp b/src/3rdparty/webkit/WebCore/page/Settings.cpp
index f528f37bc1..475d373f00 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Settings.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "Settings.h"
 
+#include "BackForwardList.h"
+#include "Database.h"
 #include "Frame.h"
 #include "FrameTree.h"
 #include "FrameView.h"
@@ -48,7 +50,7 @@ static void setNeedsReapplyStylesInAllFrames(Page* page)
 bool Settings::gShouldPaintNativeControls = true;
 #endif
 
-#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+#if PLATFORM(WIN) || (OS(WINDOWS) && PLATFORM(WX))
 bool Settings::gShouldUseHighResolutionTimers = true;
 #endif
 
@@ -63,17 +65,19 @@ Settings::Settings(Page* page)
     , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
     , m_localStorageQuota(5 * 1024 * 1024)  // Suggested by the HTML5 spec.
     , m_pluginAllowedRunTime(numeric_limits<unsigned>::max())
+    , m_zoomMode(ZoomPage)
+    , m_isSpatialNavigationEnabled(false)
     , m_isJavaEnabled(false)
     , m_loadsImagesAutomatically(false)
     , m_privateBrowsingEnabled(false)
     , m_caretBrowsingEnabled(false)
+    , m_areImagesEnabled(true)
     , m_arePluginsEnabled(false)
-    , m_databasesEnabled(false)
     , m_localStorageEnabled(false)
-    , m_sessionStorageEnabled(true)
     , m_isJavaScriptEnabled(false)
     , m_isWebSecurityEnabled(true)
     , m_allowUniversalAccessFromFileURLs(true)
+    , m_allowFileAccessFromFileURLs(true)
     , m_javaScriptCanOpenWindowsAutomatically(false)
     , m_shouldPrintBackgrounds(false)
     , m_textAreasAreResizable(false)
@@ -94,17 +98,17 @@ Settings::Settings(Page* page)
     , m_authorAndUserStylesEnabled(true)
     , m_needsSiteSpecificQuirks(false)
     , m_fontRenderingMode(0)
+    , m_frameFlatteningEnabled(false)
     , m_webArchiveDebugModeEnabled(false)
     , m_localFileContentSniffingEnabled(false)
     , m_inApplicationChromeMode(false)
     , m_offlineWebApplicationCacheEnabled(false)
     , m_shouldPaintCustomScrollbars(false)
-    , m_zoomsTextOnly(false)
     , m_enforceCSSMIMETypeInStrictMode(true)
     , m_usesEncodingDetector(false)
     , m_allowScriptsToCloseWindows(false)
     , m_editingBehavior(
-#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
         // (PLATFORM(MAC) is always false in Chromium, hence the extra condition.)
         EditingMacBehavior
 #else
@@ -116,8 +120,12 @@ Settings::Settings(Page* page)
     , m_downloadableBinaryFontsEnabled(true)
     , m_xssAuditorEnabled(false)
     , m_acceleratedCompositingEnabled(true)
+    , m_showDebugBorders(false)
+    , m_showRepaintCounter(false)
     , m_experimentalNotificationsEnabled(false)
     , m_webGLEnabled(false)
+    , m_loadDeferringEnabled(true)
+    , m_tiledBackingStoreEnabled(false)
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -234,19 +242,29 @@ void Settings::setAllowUniversalAccessFromFileURLs(bool allowUniversalAccessFrom
     m_allowUniversalAccessFromFileURLs = allowUniversalAccessFromFileURLs;
 }
 
+void Settings::setAllowFileAccessFromFileURLs(bool allowFileAccessFromFileURLs)
+{
+    m_allowFileAccessFromFileURLs = allowFileAccessFromFileURLs;
+}
+
+void Settings::setSpatialNavigationEnabled(bool isSpatialNavigationEnabled)
+{
+    m_isSpatialNavigationEnabled = isSpatialNavigationEnabled;
+}
+
 void Settings::setJavaEnabled(bool isJavaEnabled)
 {
     m_isJavaEnabled = isJavaEnabled;
 }
 
-void Settings::setPluginsEnabled(bool arePluginsEnabled)
+void Settings::setImagesEnabled(bool areImagesEnabled)
 {
-    m_arePluginsEnabled = arePluginsEnabled;
+    m_areImagesEnabled = areImagesEnabled;
 }
 
-void Settings::setDatabasesEnabled(bool databasesEnabled)
+void Settings::setPluginsEnabled(bool arePluginsEnabled)
 {
-    m_databasesEnabled = databasesEnabled;
+    m_arePluginsEnabled = arePluginsEnabled;
 }
 
 void Settings::setLocalStorageEnabled(bool localStorageEnabled)
@@ -254,11 +272,6 @@ void Settings::setLocalStorageEnabled(bool localStorageEnabled)
     m_localStorageEnabled = localStorageEnabled;
 }
 
-void Settings::setSessionStorageEnabled(bool sessionStorageEnabled)
-{
-    m_sessionStorageEnabled = sessionStorageEnabled;
-}
-
 void Settings::setLocalStorageQuota(unsigned localStorageQuota)
 {
     m_localStorageQuota = localStorageQuota;
@@ -266,7 +279,11 @@ void Settings::setLocalStorageQuota(unsigned localStorageQuota)
 
 void Settings::setPrivateBrowsingEnabled(bool privateBrowsingEnabled)
 {
+    if (m_privateBrowsingEnabled == privateBrowsingEnabled)
+        return;
+
     m_privateBrowsingEnabled = privateBrowsingEnabled;
+    m_page->privateBrowsingStateChanged();
 }
 
 void Settings::setJavaScriptCanOpenWindowsAutomatically(bool javaScriptCanOpenWindowsAutomatically)
@@ -421,6 +438,11 @@ void Settings::setNeedsSiteSpecificQuirks(bool needsQuirks)
     m_needsSiteSpecificQuirks = needsQuirks;
 }
 
+void Settings::setFrameFlatteningEnabled(bool frameFlatteningEnabled)
+{
+    m_frameFlatteningEnabled = frameFlatteningEnabled;
+}
+
 void Settings::setWebArchiveDebugModeEnabled(bool enabled)
 {
     m_webArchiveDebugModeEnabled = enabled;
@@ -451,12 +473,12 @@ void Settings::setShouldPaintCustomScrollbars(bool shouldPaintCustomScrollbars)
     m_shouldPaintCustomScrollbars = shouldPaintCustomScrollbars;
 }
 
-void Settings::setZoomsTextOnly(bool zoomsTextOnly)
+void Settings::setZoomMode(ZoomMode mode)
 {
-    if (zoomsTextOnly == m_zoomsTextOnly)
+    if (mode == m_zoomMode)
         return;
     
-    m_zoomsTextOnly = zoomsTextOnly;
+    m_zoomMode = mode;
     setNeedsReapplyStylesInAllFrames(m_page);
 }
 
@@ -506,6 +528,24 @@ void Settings::setAcceleratedCompositingEnabled(bool enabled)
     setNeedsReapplyStylesInAllFrames(m_page);
 }
 
+void Settings::setShowDebugBorders(bool enabled)
+{
+    if (m_showDebugBorders == enabled)
+        return;
+        
+    m_showDebugBorders = enabled;
+    setNeedsReapplyStylesInAllFrames(m_page);
+}
+
+void Settings::setShowRepaintCounter(bool enabled)
+{
+    if (m_showRepaintCounter == enabled)
+        return;
+        
+    m_showRepaintCounter = enabled;
+    setNeedsReapplyStylesInAllFrames(m_page);
+}
+
 void Settings::setExperimentalNotificationsEnabled(bool enabled)
 {
     m_experimentalNotificationsEnabled = enabled;
@@ -517,7 +557,7 @@ void Settings::setPluginAllowedRunTime(unsigned runTime)
     m_page->pluginAllowedRunTimeChanged();
 }
 
-#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+#if PLATFORM(WIN) || (OS(WINDOWS) && PLATFORM(WX))
 void Settings::setShouldUseHighResolutionTimers(bool shouldUseHighResolutionTimers)
 {
     gShouldUseHighResolutionTimers = shouldUseHighResolutionTimers;
@@ -529,4 +569,18 @@ void Settings::setWebGLEnabled(bool enabled)
     m_webGLEnabled = enabled;
 }
 
+void Settings::setLoadDeferringEnabled(bool enabled)
+{
+    m_loadDeferringEnabled = enabled;
+}
+
+void Settings::setTiledBackingStoreEnabled(bool enabled)
+{
+    m_tiledBackingStoreEnabled = enabled;
+#if ENABLE(TILED_BACKING_STORE)
+    if (m_page->mainFrame())
+        m_page->mainFrame()->setTiledBackingStoreEnabled(enabled);
+#endif
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.h b/src/3rdparty/webkit/WebCore/page/Settings.h
index 09b5bec7dc..b6777125c6 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.h
+++ b/src/3rdparty/webkit/WebCore/page/Settings.h
@@ -30,6 +30,7 @@
 #include "AtomicString.h"
 #include "FontRenderingMode.h"
 #include "KURL.h"
+#include "ZoomMode.h"
 
 namespace WebCore {
 
@@ -64,7 +65,7 @@ namespace WebCore {
     // if possible in the future.
     enum EditingBehavior { EditingMacBehavior, EditingWindowsBehavior };
 
-    class Settings {
+    class Settings : public Noncopyable {
     public:
         Settings(Page*);
 
@@ -98,10 +99,15 @@ namespace WebCore {
         void setDefaultFixedFontSize(int);
         int defaultFixedFontSize() const { return m_defaultFixedFontSize; }
 
+        // Unlike areImagesEnabled, this only suppresses the network load of
+        // the image URL.  A cached image will still be rendered if requested.
         void setLoadsImagesAutomatically(bool);
         bool loadsImagesAutomatically() const { return m_loadsImagesAutomatically; }
 
         void setJavaScriptEnabled(bool);
+        // Instead of calling isJavaScriptEnabled directly, please consider calling
+        // ScriptController::canExecuteScripts, which takes things like the
+        // HTML sandbox attribute into account.
         bool isJavaScriptEnabled() const { return m_isJavaScriptEnabled; }
 
         void setWebSecurityEnabled(bool);
@@ -110,24 +116,27 @@ namespace WebCore {
         void setAllowUniversalAccessFromFileURLs(bool);
         bool allowUniversalAccessFromFileURLs() const { return m_allowUniversalAccessFromFileURLs; }
 
+        void setAllowFileAccessFromFileURLs(bool);
+        bool allowFileAccessFromFileURLs() const { return m_allowFileAccessFromFileURLs; }
+
         void setJavaScriptCanOpenWindowsAutomatically(bool);
         bool javaScriptCanOpenWindowsAutomatically() const { return m_javaScriptCanOpenWindowsAutomatically; }
 
+        void setSpatialNavigationEnabled(bool);
+        bool isSpatialNavigationEnabled() const { return m_isSpatialNavigationEnabled; }
+
         void setJavaEnabled(bool);
         bool isJavaEnabled() const { return m_isJavaEnabled; }
 
+        void setImagesEnabled(bool);
+        bool areImagesEnabled() const { return m_areImagesEnabled; }
+
         void setPluginsEnabled(bool);
         bool arePluginsEnabled() const { return m_arePluginsEnabled; }
 
-        void setDatabasesEnabled(bool);
-        bool databasesEnabled() const { return m_databasesEnabled; }
-
         void setLocalStorageEnabled(bool);
         bool localStorageEnabled() const { return m_localStorageEnabled; }
 
-        void setSessionStorageEnabled(bool);
-        bool sessionStorageEnabled() const { return m_sessionStorageEnabled; }
-
         void setLocalStorageQuota(unsigned);
         unsigned localStorageQuota() const { return m_localStorageQuota; }
 
@@ -198,7 +207,10 @@ namespace WebCore {
         
         void setDeveloperExtrasEnabled(bool);
         bool developerExtrasEnabled() const { return m_developerExtrasEnabled; }
-        
+
+        void setFrameFlatteningEnabled(bool);
+        bool frameFlatteningEnabled() const { return m_frameFlatteningEnabled; }
+
         void setAuthorAndUserStylesEnabled(bool);
         bool authorAndUserStylesEnabled() const { return m_authorAndUserStylesEnabled; }
         
@@ -226,8 +238,8 @@ namespace WebCore {
         void setShouldPaintCustomScrollbars(bool);
         bool shouldPaintCustomScrollbars() const { return m_shouldPaintCustomScrollbars; }
 
-        void setZoomsTextOnly(bool);
-        bool zoomsTextOnly() const { return m_zoomsTextOnly; }
+        void setZoomMode(ZoomMode);
+        ZoomMode zoomMode() const { return m_zoomMode; }
         
         void setEnforceCSSMIMETypeInStrictMode(bool);
         bool enforceCSSMIMETypeInStrictMode() { return m_enforceCSSMIMETypeInStrictMode; }
@@ -256,10 +268,16 @@ namespace WebCore {
         void setAcceleratedCompositingEnabled(bool);
         bool acceleratedCompositingEnabled() const { return m_acceleratedCompositingEnabled; }
 
+        void setShowDebugBorders(bool);
+        bool showDebugBorders() const { return m_showDebugBorders; }
+
+        void setShowRepaintCounter(bool);
+        bool showRepaintCounter() const { return m_showRepaintCounter; }
+
         void setExperimentalNotificationsEnabled(bool);
         bool experimentalNotificationsEnabled() const { return m_experimentalNotificationsEnabled; }
 
-#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+#if PLATFORM(WIN) || (OS(WINDOWS) && PLATFORM(WX))
         static void setShouldUseHighResolutionTimers(bool);
         static bool shouldUseHighResolutionTimers() { return gShouldUseHighResolutionTimers; }
 #endif
@@ -270,6 +288,12 @@ namespace WebCore {
         void setWebGLEnabled(bool);
         bool webGLEnabled() const { return m_webGLEnabled; }
 
+        void setLoadDeferringEnabled(bool);
+        bool loadDeferringEnabled() const { return m_loadDeferringEnabled; }
+        
+        void setTiledBackingStoreEnabled(bool);
+        bool tiledBackingStoreEnabled() const { return m_tiledBackingStoreEnabled; }
+
     private:
         Page* m_page;
         
@@ -292,17 +316,19 @@ namespace WebCore {
         size_t m_maximumDecodedImageSize;
         unsigned m_localStorageQuota;
         unsigned m_pluginAllowedRunTime;
+        ZoomMode m_zoomMode;
+        bool m_isSpatialNavigationEnabled : 1;
         bool m_isJavaEnabled : 1;
         bool m_loadsImagesAutomatically : 1;
         bool m_privateBrowsingEnabled : 1;
         bool m_caretBrowsingEnabled : 1;
+        bool m_areImagesEnabled : 1;
         bool m_arePluginsEnabled : 1;
-        bool m_databasesEnabled : 1;
         bool m_localStorageEnabled : 1;
-        bool m_sessionStorageEnabled : 1;
         bool m_isJavaScriptEnabled : 1;
         bool m_isWebSecurityEnabled : 1;
         bool m_allowUniversalAccessFromFileURLs: 1;
+        bool m_allowFileAccessFromFileURLs: 1;
         bool m_javaScriptCanOpenWindowsAutomatically : 1;
         bool m_shouldPrintBackgrounds : 1;
         bool m_textAreasAreResizable : 1;
@@ -323,12 +349,12 @@ namespace WebCore {
         bool m_authorAndUserStylesEnabled : 1;
         bool m_needsSiteSpecificQuirks : 1;
         unsigned m_fontRenderingMode : 1;
+        bool m_frameFlatteningEnabled : 1;
         bool m_webArchiveDebugModeEnabled : 1;
         bool m_localFileContentSniffingEnabled : 1;
         bool m_inApplicationChromeMode : 1;
         bool m_offlineWebApplicationCacheEnabled : 1;
         bool m_shouldPaintCustomScrollbars : 1;
-        bool m_zoomsTextOnly : 1;
         bool m_enforceCSSMIMETypeInStrictMode : 1;
         bool m_usesEncodingDetector : 1;
         bool m_allowScriptsToCloseWindows : 1;
@@ -336,13 +362,17 @@ namespace WebCore {
         bool m_downloadableBinaryFontsEnabled : 1;
         bool m_xssAuditorEnabled : 1;
         bool m_acceleratedCompositingEnabled : 1;
+        bool m_showDebugBorders : 1;
+        bool m_showRepaintCounter : 1;
         bool m_experimentalNotificationsEnabled : 1;
         bool m_webGLEnabled : 1;
+        bool m_loadDeferringEnabled : 1;
+        bool m_tiledBackingStoreEnabled : 1;
 
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
 #endif
-#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+#if PLATFORM(WIN) || (OS(WINDOWS) && PLATFORM(WX))
         static bool gShouldUseHighResolutionTimers;
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp b/src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp
new file mode 100644
index 0000000000..86c9c5d5d3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp
@@ -0,0 +1,503 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Antonio Gomes <tonikitoo@webkit.org>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SpatialNavigation.h"
+
+#include "Frame.h"
+#include "FrameTree.h"
+#include "FrameView.h"
+#include "HTMLFrameOwnerElement.h"
+#include "IntRect.h"
+#include "Node.h"
+#include "Page.h"
+
+namespace WebCore {
+
+static long long spatialDistance(FocusDirection, const IntRect&, const IntRect&);
+static IntRect renderRectRelativeToRootDocument(RenderObject*);
+static RectsAlignment alignmentForRects(FocusDirection, const IntRect&, const IntRect&);
+static bool areRectsFullyAligned(FocusDirection, const IntRect&, const IntRect&);
+static bool areRectsPartiallyAligned(FocusDirection, const IntRect&, const IntRect&);
+static bool isRectInDirection(FocusDirection, const IntRect&, const IntRect&);
+static void deflateIfOverlapped(IntRect&, IntRect&);
+
+long long distanceInDirection(Node* start, Node* dest, FocusDirection direction, FocusCandidate& candidate)
+{
+    RenderObject* startRender = start->renderer();
+    if (!startRender)
+        return maxDistance();
+
+    RenderObject* destRender = dest->renderer();
+    if (!destRender)
+        return maxDistance();
+
+    IntRect curRect = renderRectRelativeToRootDocument(startRender);
+    IntRect targetRect  = renderRectRelativeToRootDocument(destRender);
+
+    // The bounding rectangle of two consecutive nodes can overlap. In such cases,
+    // deflate both.
+    deflateIfOverlapped(curRect, targetRect);
+
+    if (curRect.isEmpty() || targetRect.isEmpty()
+        || targetRect.x() < 0 || targetRect.y() < 0)
+        return maxDistance();
+
+    if (!isRectInDirection(direction, curRect, targetRect))
+        return maxDistance();
+
+    // The distance between two nodes is not to be considered alone when evaluating/looking
+    // for the best focus candidate node. Alignment of rects can be also a good point to be
+    // considered in order to make the algorithm to behavior in a more intuitive way.
+    RectsAlignment alignment = alignmentForRects(direction, curRect, targetRect);
+
+    bool sameDocument = dest->document() == candidate.document();
+    if (sameDocument) {
+        if (candidate.alignment > alignment || (candidate.parentAlignment && alignment > candidate.parentAlignment))
+            return maxDistance();
+    } else if (candidate.alignment > alignment && (candidate.parentAlignment && alignment > candidate.parentAlignment))
+        return maxDistance();
+
+    // FIXME_tonikitoo: simplify the logic here !
+    if (alignment != None
+        || (!candidate.isNull() && candidate.parentAlignment >= alignment
+        && candidate.document() == dest->document())) {
+
+        // If we are now in an higher precedent case, lets reset the current |candidate|'s
+        // |distance| so we force it to be bigger than the result we will get from
+        // |spatialDistance| (see below).
+        if (candidate.alignment < alignment && candidate.parentAlignment < alignment)
+            candidate.distance = maxDistance();
+
+        candidate.alignment = alignment;
+    }
+
+    return spatialDistance(direction, curRect, targetRect);
+}
+
+// FIXME: This function does not behave correctly with transformed frames.
+static IntRect renderRectRelativeToRootDocument(RenderObject* render)
+{
+    ASSERT(render);
+
+    IntRect rect(render->absoluteClippedOverflowRect());
+
+    // In cases when the |render|'s associated node is in a scrollable inner
+    // document, we only consider its scrollOffset if it is not offscreen.
+    Node* node = render->node();
+    Document* mainDocument = node->document()->page()->mainFrame()->document();
+    bool considerScrollOffset = !(hasOffscreenRect(node) && node->document() != mainDocument);
+
+    if (considerScrollOffset) {
+        if (FrameView* frameView = render->node()->document()->view())
+            rect.move(-frameView->scrollOffset());
+    }
+
+    // Handle nested frames.
+    for (Frame* frame = render->document()->frame(); frame; frame = frame->tree()->parent()) {
+        if (HTMLFrameOwnerElement* ownerElement = frame->ownerElement())
+            rect.move(ownerElement->offsetLeft(), ownerElement->offsetTop());
+    }
+
+    return rect;
+}
+
+static RectsAlignment alignmentForRects(FocusDirection direction, const IntRect& curRect, const IntRect& targetRect)
+{
+    if (areRectsFullyAligned(direction, curRect, targetRect))
+        return Full;
+
+    if (areRectsPartiallyAligned(direction, curRect, targetRect))
+        return Partial;
+
+    return None;
+}
+
+static inline bool isHorizontalMove(FocusDirection direction)
+{
+    return direction == FocusDirectionLeft || direction == FocusDirectionRight;
+}
+
+static inline int start(FocusDirection direction, const IntRect& rect)
+{
+    return isHorizontalMove(direction) ? rect.y() : rect.x();
+}
+
+static inline int middle(FocusDirection direction, const IntRect& rect)
+{
+    IntPoint center(rect.center());
+    return isHorizontalMove(direction) ? center.y(): center.x();
+}
+
+static inline int end(FocusDirection direction, const IntRect& rect)
+{
+    return isHorizontalMove(direction) ? rect.bottom() : rect.right();
+}
+
+// This method checks if rects |a| and |b| are fully aligned either vertically or
+// horizontally. In general, rects whose central point falls between the top or
+// bottom of each other are considered fully aligned.
+// Rects that match this criteria are preferable target nodes in move focus changing
+// operations.
+// * a = Current focused node's rect.
+// * b = Focus candidate node's rect.
+static bool areRectsFullyAligned(FocusDirection direction, const IntRect& a, const IntRect& b)
+{
+    int aStart, bStart, aEnd, bEnd;
+
+    switch (direction) {
+    case FocusDirectionLeft:
+        aStart = a.x();
+        bEnd = b.right();
+        break;
+    case FocusDirectionRight:
+        aStart = b.x();
+        bEnd = a.right();
+        break;
+    case FocusDirectionUp:
+        aStart = a.y();
+        bEnd = b.y();
+        break;
+    case FocusDirectionDown:
+        aStart = b.y();
+        bEnd = a.y();
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    if (aStart < bEnd)
+        return false;
+
+    aStart = start(direction, a);
+    bStart = start(direction, b);
+
+    int aMiddle = middle(direction, a);
+    int bMiddle = middle(direction, b);
+
+    aEnd = end(direction, a);
+    bEnd = end(direction, b);
+
+    // Picture of the totally aligned logic:
+    //
+    //     Horizontal    Vertical        Horizontal     Vertical
+    //  ****************************  *****************************
+    //  *  _          *   _ _ _ _  *  *         _   *      _ _    *
+    //  * |_|     _   *  |_|_|_|_| *  *  _     |_|  *     |_|_|   *
+    //  * |_|....|_|  *      .     *  * |_|....|_|  *       .     *
+    //  * |_|    |_| (1)     .     *  * |_|    |_| (2)      .     *
+    //  * |_|         *     _._    *  *        |_|  *    _ _._ _  *
+    //  *             *    |_|_|   *  *             *   |_|_|_|_| *
+    //  *             *            *  *             *             *
+    //  ****************************  *****************************
+
+    //     Horizontal    Vertical        Horizontal     Vertical
+    //  ****************************  *****************************
+    //  *  _......_   *   _ _ _ _  *  *  _          *    _ _ _ _  *
+    //  * |_|    |_|  *  |_|_|_|_| *  * |_|     _   *   |_|_|_|_| *
+    //  * |_|    |_|  *  .         *  * |_|    |_|  *           . *
+    //  * |_|        (3) .         *  * |_|....|_| (4)          . *
+    //  *             *  ._ _      *  *             *        _ _. *
+    //  *             *  |_|_|     *  *             *       |_|_| *
+    //  *             *            *  *             *             *
+    //  ****************************  *****************************
+
+    return ((bMiddle >= aStart && bMiddle <= aEnd) // (1)
+            || (aMiddle >= bStart && aMiddle <= bEnd) // (2)
+            || (bStart == aStart) // (3)
+            || (bEnd == aEnd)); // (4)
+}
+
+// This method checks if |start| and |dest| have a partial intersection, either
+// horizontally or vertically.
+// * a = Current focused node's rect.
+// * b = Focus candidate node's rect.
+static bool areRectsPartiallyAligned(FocusDirection direction, const IntRect& a, const IntRect& b)
+{
+    int aStart  = start(direction, a);
+    int bStart  = start(direction, b);
+    int bMiddle = middle(direction, b);
+    int aEnd = end(direction, a);
+    int bEnd = end(direction, b);
+
+    // Picture of the partially aligned logic:
+    //
+    //    Horizontal       Vertical
+    // ********************************
+    // *  _            *   _ _ _      *
+    // * |_|           *  |_|_|_|     *
+    // * |_|.... _     *      . .     *
+    // * |_|    |_|    *      . .     *
+    // * |_|....|_|    *      ._._ _  *
+    // *        |_|    *      |_|_|_| *
+    // *        |_|    *              *
+    // *               *              *
+    // ********************************
+    //
+    // ... and variants of the above cases.
+    return ((bStart >= aStart && bStart <= aEnd)
+            || (bStart >= aStart && bStart <= aEnd)
+            || (bEnd >= aStart && bEnd <= aEnd)
+            || (bMiddle >= aStart && bMiddle <= aEnd)
+            || (bEnd >= aStart && bEnd <= aEnd));
+}
+
+// Return true if rect |a| is below |b|. False otherwise.
+static inline bool below(const IntRect& a, const IntRect& b)
+{
+    return a.y() > b.bottom();
+}
+
+// Return true if rect |a| is on the right of |b|. False otherwise.
+static inline bool rightOf(const IntRect& a, const IntRect& b)
+{
+    return a.x() > b.right();
+}
+
+// * a = Current focused node's rect.
+// * b = Focus candidate node's rect.
+static long long spatialDistance(FocusDirection direction, const IntRect& a, const IntRect& b)
+{
+    int x1 = 0, y1 = 0, x2 = 0, y2 = 0;
+
+    if (direction == FocusDirectionLeft) {
+        // #1  |--|
+        //
+        // #2  |--|  |--|
+        //
+        // #3  |--|
+
+        x1 = a.x();
+        x2 = b.right();
+
+        if (below(a, b)) {
+            // #1 The a rect is below b.
+            y1 = a.y();
+            y2 = b.bottom();
+        } else if (below(b, a)) {
+            // #3 The b rect is below a.
+            y1 = a.bottom();
+            y2 = b.y();
+        } else {
+            // #2 Both b and a share some common y's.
+            y1 = 0;
+            y2 = 0;
+        }
+    } else if (direction == FocusDirectionRight) {
+        //        |--|  #1
+        //
+        //  |--|  |--|  #2
+        //
+        //        |--|  #3
+
+        x1 = a.right();
+        x2 = b.x();
+
+        if (below(a, b)) {
+            // #1 The b rect is above a.
+            y1 = a.y();
+            y2 = b.bottom();
+        } else if (below(b, a)) {
+            // #3 The b rect is below a.
+            y1 = a.bottom();
+            y2 = b.y();
+        } else {
+            // #2 Both b and a share some common y's.
+            y1 = 0;
+            y2 = 0;
+        }
+    } else if (direction == FocusDirectionUp) {
+        //
+        //   #1    #2    #3
+        //
+        //  |--|  |--|  |--|
+        //
+        //        |--|
+
+        y1 = a.y();
+        y2 = b.bottom();
+
+        if (rightOf(a, b)) {
+            // #1 The b rect is to the left of a.
+            x1 = a.x();
+            x2 = b.right();
+        } else if (rightOf(b, a)) {
+            // #3 The b rect is to the right of a.
+            x1 = a.right();
+            x2 = b.x();
+        } else {
+            // #2 Both b and a share some common x's.
+            x1 = 0;
+            x2 = 0;
+        }
+    } else if (direction == FocusDirectionDown) {
+        //        |--|
+        //
+        //  |--|  |--|  |--|
+        //
+        //   #1    #2    #3
+
+        y1 = a.bottom();
+        y2 = b.y();
+
+        if (rightOf(a, b)) {
+            // #1 The b rect is to the left of a.
+            x1 = a.x();
+            x2 = b.right();
+        } else if (rightOf(b, a)) {
+            // #3 The b rect is to the right of a
+            x1 = a.right();
+            x2 = b.x();
+        } else {
+            // #2 Both b and a share some common x's.
+            x1 = 0;
+            x2 = 0;
+        }
+    }
+
+    long long dx = x1 - x2;
+    long long dy = y1 - y2;
+
+    long long distance = (dx * dx) + (dy * dy);
+
+    if (distance < 0)
+        distance *= -1;
+
+    return distance;
+}
+
+static bool isRectInDirection(FocusDirection direction, const IntRect& curRect, const IntRect& targetRect)
+{
+    IntPoint center(targetRect.center());
+    int targetMiddle = isHorizontalMove(direction) ? center.x() : center.y();
+
+    switch (direction) {
+    case FocusDirectionLeft:
+        return targetMiddle < curRect.x();
+    case FocusDirectionRight:
+        return targetMiddle > curRect.right();
+    case FocusDirectionUp:
+        return targetMiddle < curRect.y();
+    case FocusDirectionDown:
+        return targetMiddle > curRect.bottom();
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    return false;
+}
+
+// Checks if |node| is offscreen the visible area (viewport) of its container
+// document. In case it is, one can scroll in direction or take any different
+// desired action later on.
+bool hasOffscreenRect(Node* node)
+{
+    // Get the FrameView in which |node| is (which means the current viewport if |node|
+    // is not in an inner document), so we can check if its content rect is visible
+    // before we actually move the focus to it.
+    FrameView* frameView = node->document()->view();
+    if (!frameView)
+        return true;
+
+    IntRect containerViewportRect = frameView->visibleContentRect();
+
+    RenderObject* render = node->renderer();
+    if (!render)
+        return true;
+
+    IntRect rect(render->absoluteClippedOverflowRect());
+    return !containerViewportRect.intersects(rect);
+}
+
+// In a bottom-up way, this method tries to scroll |frame| in a given direction
+// |direction|, going up in the frame tree hierarchy in case it does not succeed.
+bool scrollInDirection(Frame* frame, FocusDirection direction)
+{
+    if (!frame)
+        return false;
+
+    ScrollDirection scrollDirection;
+
+    switch (direction) {
+    case FocusDirectionLeft:
+        scrollDirection = ScrollLeft;
+        break;
+    case FocusDirectionRight:
+        scrollDirection = ScrollRight;
+        break;
+    case FocusDirectionUp:
+        scrollDirection = ScrollUp;
+        break;
+    case FocusDirectionDown:
+        scrollDirection = ScrollDown;
+        break;
+    default:
+        return false;
+    }
+
+    return frame->eventHandler()->scrollRecursively(scrollDirection, ScrollByLine);
+}
+
+void scrollIntoView(Element* element)
+{
+    // NOTE: Element's scrollIntoView method could had been used here, but
+    // it is preferable to inflate |element|'s bounding rect a bit before
+    // scrolling it for accurate reason.
+    // Element's scrollIntoView method does not provide this flexibility.
+    static const int fudgeFactor = 2;
+    IntRect bounds = element->getRect();
+    bounds.inflate(fudgeFactor);
+    element->renderer()->enclosingLayer()->scrollRectToVisible(bounds);
+}
+
+bool isInRootDocument(Node* node)
+{
+    if (!node)
+        return false;
+
+    Document* rootDocument = node->document()->page()->mainFrame()->document();
+    return node->document() == rootDocument;
+}
+
+static void deflateIfOverlapped(IntRect& a, IntRect& b)
+{
+    if (!a.intersects(b) || a.contains(b) || b.contains(a))
+        return;
+
+    static const int fudgeFactor = -2;
+
+    // Avoid negative width or height values.
+    if ((a.width() + 2 * fudgeFactor > 0) && (a.height() + 2 * fudgeFactor > 0))
+        a.inflate(fudgeFactor);
+
+    if ((b.width() + 2 * fudgeFactor > 0) && (b.height() + 2 * fudgeFactor > 0))
+        b.inflate(fudgeFactor);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/SpatialNavigation.h b/src/3rdparty/webkit/WebCore/page/SpatialNavigation.h
new file mode 100644
index 0000000000..7c183df47a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/SpatialNavigation.h
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Antonio Gomes <tonikitoo@webkit.org>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef SpatialNavigation_h
+#define SpatialNavigation_h
+
+#include "FocusDirection.h"
+#include "Node.h"
+
+#include <limits>
+
+namespace WebCore {
+
+class Element;
+class Frame;
+class IntRect;
+class RenderObject;
+
+using namespace std;
+
+inline long long maxDistance()
+{
+    return numeric_limits<long long>::max();
+}
+
+// Spatially speaking, two given elements in a web page can be:
+// 1) Fully aligned: There is a full intersection between the rects, either
+//    vertically or horizontally.
+//
+// * Horizontally       * Vertically
+//    _
+//   |_|                   _ _ _ _ _ _
+//   |_|...... _          |_|_|_|_|_|_|
+//   |_|      |_|         .       .
+//   |_|......|_|   OR    .       .
+//   |_|      |_|         .       .
+//   |_|......|_|          _ _ _ _
+//   |_|                  |_|_|_|_|
+//
+//
+// 2) Partially aligned: There is a partial intersection between the rects, either
+//    vertically or horizontally.
+//
+// * Horizontally       * Vertically
+//    _                   _ _ _ _ _
+//   |_|                 |_|_|_|_|_|
+//   |_|.... _      OR           . .
+//   |_|    |_|                  . .
+//   |_|....|_|                  ._._ _
+//          |_|                  |_|_|_|
+//          |_|
+//
+// 3) Or, otherwise, not aligned at all.
+//
+// * Horizontally       * Vertically
+//         _              _ _ _ _
+//        |_|            |_|_|_|_|
+//        |_|                    .
+//        |_|                     .
+//       .          OR             .
+//    _ .                           ._ _ _ _ _
+//   |_|                            |_|_|_|_|_|
+//   |_|
+//   |_|
+//
+// "Totally Aligned" elements are preferable candidates to move
+// focus to over "Partially Aligned" ones, that on its turns are
+// more preferable than "Not Aligned".
+enum RectsAlignment {
+    None = 0,
+    Partial,
+    Full
+};
+
+struct FocusCandidate {
+    FocusCandidate()
+        : node(0)
+        , distance(maxDistance())
+        , parentDistance(maxDistance())
+        , alignment(None)
+        , parentAlignment(None)
+    {
+    }
+
+    FocusCandidate(Node* n)
+        : node(n)
+        , distance(maxDistance())
+        , parentDistance(maxDistance())
+        , alignment(None)
+        , parentAlignment(None)
+    {
+    }
+
+    bool isNull() const { return !node; }
+    Document* document() const { return node ? node->document() : 0; }
+
+    Node* node;
+    long long distance;
+    long long parentDistance;
+    RectsAlignment alignment;
+    RectsAlignment parentAlignment;
+};
+
+long long distanceInDirection(Node*, Node*, FocusDirection, FocusCandidate&);
+bool scrollInDirection(Frame*, FocusDirection);
+void scrollIntoView(Element*);
+bool hasOffscreenRect(Node*);
+bool isInRootDocument(Node*);
+
+} // namspace WebCore
+
+#endif // SpatialNavigation_h
diff --git a/src/3rdparty/webkit/WebCore/page/UserScript.h b/src/3rdparty/webkit/WebCore/page/UserScript.h
index dbbb87952b..8b3703f937 100644
--- a/src/3rdparty/webkit/WebCore/page/UserScript.h
+++ b/src/3rdparty/webkit/WebCore/page/UserScript.h
@@ -34,16 +34,15 @@
 
 namespace WebCore {
 
-class UserScript {
+class UserScript : public Noncopyable {
 public:
     UserScript(const String& source, const KURL& url,
                PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
-               unsigned worldID, UserScriptInjectionTime injectionTime)
+               UserScriptInjectionTime injectionTime)
         : m_source(source)
         , m_url(url)
         , m_whitelist(whitelist)
         , m_blacklist(blacklist)
-        , m_worldID(worldID)
         , m_injectionTime(injectionTime)
     {
     }
@@ -52,7 +51,6 @@ public:
     const KURL& url() const { return m_url; }
     const Vector<String>* whitelist() const { return m_whitelist.get(); }
     const Vector<String>* blacklist() const { return m_blacklist.get(); }
-    unsigned worldID() const { return m_worldID; }
     UserScriptInjectionTime injectionTime() const { return m_injectionTime; }
     
 private:
@@ -60,7 +58,6 @@ private:
     KURL m_url;
     OwnPtr<Vector<String> > m_whitelist;
     OwnPtr<Vector<String> > m_blacklist;
-    unsigned m_worldID;
     UserScriptInjectionTime m_injectionTime;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/page/UserScriptTypes.h b/src/3rdparty/webkit/WebCore/page/UserScriptTypes.h
index ac37662507..ad27e79b98 100644
--- a/src/3rdparty/webkit/WebCore/page/UserScriptTypes.h
+++ b/src/3rdparty/webkit/WebCore/page/UserScriptTypes.h
@@ -33,10 +33,11 @@ namespace WebCore {
 
 enum UserScriptInjectionTime { InjectAtDocumentStart, InjectAtDocumentEnd };
 
+class DOMWrapperWorld;
 class UserScript;
 
 typedef Vector<OwnPtr<UserScript> > UserScriptVector;
-typedef HashMap<unsigned, UserScriptVector*> UserScriptMap;
+typedef HashMap<RefPtr<DOMWrapperWorld>, UserScriptVector*> UserScriptMap;
 
 } // namespace WebCore
  
diff --git a/src/3rdparty/webkit/WebCore/page/UserStyleSheet.h b/src/3rdparty/webkit/WebCore/page/UserStyleSheet.h
index 56bec408b0..610778f3d7 100644
--- a/src/3rdparty/webkit/WebCore/page/UserStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/page/UserStyleSheet.h
@@ -34,16 +34,14 @@
 
 namespace WebCore {
 
-class UserStyleSheet {
+class UserStyleSheet : public Noncopyable {
 public:
     UserStyleSheet(const String& source, const KURL& url,
-                   PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
-                   unsigned worldID)
+                   PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist)
         : m_source(source)
         , m_url(url)
         , m_whitelist(whitelist)
         , m_blacklist(blacklist)
-        , m_worldID(worldID)
     {
     }
 
@@ -51,14 +49,12 @@ public:
     const KURL& url() const { return m_url; }
     const Vector<String>* whitelist() const { return m_whitelist.get(); }
     const Vector<String>* blacklist() const { return m_blacklist.get(); }
-    unsigned worldID() const { return m_worldID; }
 
 private:
     String m_source;
     KURL m_url;
     OwnPtr<Vector<String> > m_whitelist;
     OwnPtr<Vector<String> > m_blacklist;
-    unsigned m_worldID;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/UserStyleSheetTypes.h b/src/3rdparty/webkit/WebCore/page/UserStyleSheetTypes.h
index 094b2cf7c6..ef662f2dd7 100644
--- a/src/3rdparty/webkit/WebCore/page/UserStyleSheetTypes.h
+++ b/src/3rdparty/webkit/WebCore/page/UserStyleSheetTypes.h
@@ -31,10 +31,11 @@
 
 namespace WebCore {
 
+class DOMWrapperWorld;
 class UserStyleSheet;
 
 typedef Vector<OwnPtr<UserStyleSheet> > UserStyleSheetVector;
-typedef HashMap<unsigned, UserStyleSheetVector*> UserStyleSheetMap;
+typedef HashMap<RefPtr<DOMWrapperWorld>, UserStyleSheetVector*> UserStyleSheetMap;
 
 } // namespace WebCore
  
diff --git a/src/3rdparty/webkit/WebCore/page/WebKitPoint.idl b/src/3rdparty/webkit/WebCore/page/WebKitPoint.idl
index 1eefbc3a97..fd617b2ffd 100644
--- a/src/3rdparty/webkit/WebCore/page/WebKitPoint.idl
+++ b/src/3rdparty/webkit/WebCore/page/WebKitPoint.idl
@@ -25,7 +25,7 @@
 
 module window {
 
-    interface WebKitPoint {
+    interface [CustomConstructor] WebKitPoint {
         attribute float x;
         attribute float y;
     };
diff --git a/src/3rdparty/webkit/WebCore/page/WorkerNavigator.idl b/src/3rdparty/webkit/WebCore/page/WorkerNavigator.idl
index 195f0bcb56..ec75f8a38e 100644
--- a/src/3rdparty/webkit/WebCore/page/WorkerNavigator.idl
+++ b/src/3rdparty/webkit/WebCore/page/WorkerNavigator.idl
@@ -30,7 +30,8 @@ module threads {
 
     interface [
         Conditional=WORKERS,
-        NoStaticTables
+        NoStaticTables,
+        OmitConstructor
     ] WorkerNavigator {
         readonly attribute DOMString appName;
         readonly attribute DOMString appVersion;
diff --git a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
index 890c3fa832..094f20056d 100644
--- a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
+++ b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
@@ -105,7 +105,12 @@ bool XSSAuditor::canEvaluate(const String& code) const
     if (!isEnabled())
         return true;
 
-    if (findInRequest(code, false, true)) {
+    FindTask task;
+    task.string = code;
+    task.decodeEntities = false;
+    task.allowRequestIfNoIllegalURICharacters = true;
+
+    if (findInRequest(task)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
@@ -118,7 +123,11 @@ bool XSSAuditor::canEvaluateJavaScriptURL(const String& code) const
     if (!isEnabled())
         return true;
 
-    if (findInRequest(code, true, false, true)) {
+    FindTask task;
+    task.string = code;
+    task.decodeURLEscapeSequencesTwice = true;
+
+    if (findInRequest(task)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
@@ -131,7 +140,11 @@ bool XSSAuditor::canCreateInlineEventListener(const String&, const String& code)
     if (!isEnabled())
         return true;
 
-    if (findInRequest(code, true, true)) {
+    FindTask task;
+    task.string = code;
+    task.allowRequestIfNoIllegalURICharacters = true;
+
+    if (findInRequest(task)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
@@ -144,17 +157,14 @@ bool XSSAuditor::canLoadExternalScriptFromSrc(const String& context, const Strin
     if (!isEnabled())
         return true;
 
-    // If the script is loaded from the same URL as the enclosing page, it's
-    // probably not an XSS attack, so we reduce false positives by allowing the
-    // script. If the script has a query string, we're more suspicious,
-    // however, because that's pretty rare and the attacker might be able to
-    // trick a server-side script into doing something dangerous with the query
-    // string.
-    KURL scriptURL(m_frame->document()->url(), url);
-    if (m_frame->document()->url().host() == scriptURL.host() && scriptURL.query().isEmpty())
+    if (isSameOriginResource(url))
         return true;
 
-    if (findInRequest(context + url)) {
+    FindTask task;
+    task.context = context;
+    task.string = url;
+
+    if (findInRequest(task)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
@@ -167,8 +177,15 @@ bool XSSAuditor::canLoadObject(const String& url) const
     if (!isEnabled())
         return true;
 
-    if (findInRequest(url)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request"));
+    if (isSameOriginResource(url))
+        return true;
+
+    FindTask task;
+    task.string = url;
+    task.allowRequestIfNoIllegalURICharacters = true;
+
+    if (findInRequest(task)) {
+        String consoleMessage = String::format("Refused to load an object. URL found within request: \"%s\".\n", url.utf8().data());
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
     }
@@ -179,10 +196,16 @@ bool XSSAuditor::canSetBaseElementURL(const String& url) const
 {
     if (!isEnabled())
         return true;
-    
-    KURL baseElementURL(m_frame->document()->url(), url);
-    if (m_frame->document()->url().host() != baseElementURL.host() && findInRequest(url)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request"));
+
+    if (isSameOriginResource(url))
+        return true;
+
+    FindTask task;
+    task.string = url;
+    task.allowRequestIfNoIllegalURICharacters = true;
+
+    if (findInRequest(task)) {
+        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to load from document base URL. URL found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
     }
@@ -255,20 +278,61 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
     return String::adopt(result);
 }
 
-bool XSSAuditor::findInRequest(const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters, 
-                               bool decodeURLEscapeSequencesTwice) const
+bool XSSAuditor::isSameOriginResource(const String& url) const
+{
+    // If the resource is loaded from the same URL as the enclosing page, it's
+    // probably not an XSS attack, so we reduce false positives by allowing the
+    // request. If the resource has a query string, we're more suspicious,
+    // however, because that's pretty rare and the attacker might be able to
+    // trick a server-side script into doing something dangerous with the query
+    // string.
+    KURL resourceURL(m_frame->document()->url(), url);
+    return (m_frame->document()->url().host() == resourceURL.host() && resourceURL.query().isEmpty());
+}
+
+XSSProtectionDisposition XSSAuditor::xssProtection() const
+{
+    DEFINE_STATIC_LOCAL(String, XSSProtectionHeader, ("X-XSS-Protection"));
+
+    Frame* frame = m_frame;
+    if (frame->document()->url() == blankURL())
+        frame = m_frame->tree()->parent();
+
+    return parseXSSProtectionHeader(frame->loader()->documentLoader()->response().httpHeaderField(XSSProtectionHeader));
+}
+
+bool XSSAuditor::findInRequest(const FindTask& task) const
 {
     bool result = false;
     Frame* parentFrame = m_frame->tree()->parent();
+    Frame* blockFrame = parentFrame;
     if (parentFrame && m_frame->document()->url() == blankURL())
-        result = findInRequest(parentFrame, string, decodeEntities, allowRequestIfNoIllegalURICharacters, decodeURLEscapeSequencesTwice);
+        result = findInRequest(parentFrame, task);
+    if (!result) {
+        result = findInRequest(m_frame, task);
+        blockFrame = m_frame;
+    }
     if (!result)
-        result = findInRequest(m_frame, string, decodeEntities, allowRequestIfNoIllegalURICharacters, decodeURLEscapeSequencesTwice);
-    return result;
+        return false;
+
+    switch (xssProtection()) {
+    case XSSProtectionDisabled:
+        return false;
+    case XSSProtectionEnabled:
+        break;
+    case XSSProtectionBlockEnabled:
+        if (blockFrame) {
+            blockFrame->loader()->stopAllLoaders();
+            blockFrame->redirectScheduler()->scheduleLocationChange(blankURL(), String());
+        }
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    return true;
 }
 
-bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters, 
-                               bool decodeURLEscapeSequencesTwice) const
+bool XSSAuditor::findInRequest(Frame* frame, const FindTask& task) const
 {
     ASSERT(frame->document());
 
@@ -277,17 +341,19 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEn
         return false;
     }
 
-    if (string.isEmpty())
+    if (task.string.isEmpty())
         return false;
 
     FormData* formDataObj = frame->loader()->documentLoader()->originalRequest().httpBody();
+    const bool hasFormData = formDataObj && !formDataObj->isEmpty();
     String pageURL = frame->document()->url().string();
 
-    if (!formDataObj && string.length() >= 2 * pageURL.length()) {
+    String canonicalizedString;
+    if (!hasFormData && task.string.length() > 2 * pageURL.length()) {
         // Q: Why do we bother to do this check at all?
         // A: Canonicalizing large inline scripts can be expensive.  We want to
-        //    bail out before the call to canonicalize below, which could
-        //    result in an unneeded allocation and memcpy.
+        //    reduce the size of the string before we call canonicalize below,
+        //    since it could result in an unneeded allocation and memcpy.
         //
         // Q: Why do we multiply by two here?
         // A: We attempt to detect reflected XSS even when the server
@@ -295,39 +361,32 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEn
         //    attacker can do get the server to inflate his/her input by a
         //    factor of two by sending " characters, which the server
         //    transforms to \".
-        return false;
-    }
+        canonicalizedString = task.string.substring(0, 2 * pageURL.length());
+    } else
+        canonicalizedString = task.string;
 
     if (frame->document()->url().protocolIs("data"))
         return false;
 
-    String canonicalizedString = canonicalize(string);
+    canonicalizedString = canonicalize(canonicalizedString);
     if (canonicalizedString.isEmpty())
         return false;
 
-    if (string.length() < pageURL.length()) {
-        // The string can actually fit inside the pageURL.
-        String decodedPageURL = m_cache.canonicalizeURL(pageURL, frame->document()->decoder()->encoding(), decodeEntities, decodeURLEscapeSequencesTwice);
+    if (!task.context.isEmpty())
+        canonicalizedString = task.context + canonicalizedString;
 
-        if (allowRequestIfNoIllegalURICharacters && (!formDataObj || formDataObj->isEmpty()) 
-            && decodedPageURL.find(&isIllegalURICharacter, 0) == -1)
-            return false; // Injection is impossible because the request does not contain any illegal URI characters. 
+    String decodedPageURL = m_pageURLCache.canonicalizeURL(pageURL, frame->document()->decoder()->encoding(), task.decodeEntities, task.decodeURLEscapeSequencesTwice);
 
-        if (decodedPageURL.find(canonicalizedString, 0, false) != -1)
-            return true;  // We've found the smoking gun.
-    }
+    if (task.allowRequestIfNoIllegalURICharacters && !hasFormData && decodedPageURL.find(&isIllegalURICharacter, 0) == -1)
+        return false; // Injection is impossible because the request does not contain any illegal URI characters.
 
-    if (formDataObj && !formDataObj->isEmpty()) {
-        String formData = formDataObj->flattenToString();
-        if (string.length() < formData.length()) {
-            // Notice it is sufficient to compare the length of the string to
-            // the url-encoded POST data because the length of the url-decoded
-            // code is less than or equal to the length of the url-encoded
-            // string.
-            String decodedFormData = m_cache.canonicalizeURL(formData, frame->document()->decoder()->encoding(), decodeEntities, decodeURLEscapeSequencesTwice);
-            if (decodedFormData.find(canonicalizedString, 0, false) != -1)
-                return true;  // We found the string in the POST data.
-        }
+    if (decodedPageURL.find(canonicalizedString, 0, false) != -1)
+        return true; // We've found the string in the GET data.
+
+    if (hasFormData) {
+        String decodedFormData = m_formDataCache.canonicalizeURL(formDataObj->flattenToString(), frame->document()->decoder()->encoding(), task.decodeEntities, task.decodeURLEscapeSequencesTwice);
+        if (decodedFormData.find(canonicalizedString, 0, false) != -1)
+            return true; // We found the string in the POST data.
     }
 
     return false;
diff --git a/src/3rdparty/webkit/WebCore/page/XSSAuditor.h b/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
index adfa5c7959..a7628f3bec 100644
--- a/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
+++ b/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
@@ -27,6 +27,7 @@
 #ifndef XSSAuditor_h
 #define XSSAuditor_h
 
+#include "HTTPParsers.h"
 #include "PlatformString.h"
 #include "TextEncoding.h"
 
@@ -36,34 +37,37 @@ namespace WebCore {
     class ScriptSourceCode;
 
     // The XSSAuditor class is used to prevent type 1 cross-site scripting
-    // vulnerabilites (also known as reflected vulnerabilities).
+    // vulnerabilities (also known as reflected vulnerabilities).
     //
     // More specifically, the XSSAuditor class decides whether the execution of
     // a script is to be allowed or denied based on the content of any
     // user-submitted data, including:
     //
-    // * the query string of the URL.
+    // * the URL.
     // * the HTTP-POST data.
     //
     // If the source code of a script resembles any user-submitted data then it
     // is denied execution.
     //
-    // When you instantiate the XSSAuditor you must specify the {@link Frame}
-    // of the page that you wish to audit.
+    // When you instantiate the XSSAuditor you must specify the Frame of the
+    // page that you wish to audit.
     //
     // Bindings
     //
-    // An XSSAuditor is instantiated within the contructor of a
+    // An XSSAuditor is instantiated within the constructor of a
     // ScriptController object and passed the Frame the script originated. The
     // ScriptController calls back to the XSSAuditor to determine whether a
     // JavaScript script is safe to execute before executing it. The following
     // methods call into XSSAuditor:
     //
-    // * ScriptController::evaluate - used to evaluate JavaScript scripts.
-    // * ScriptController::createInlineEventListener - used to create JavaScript event handlers.
-    // * HTMLTokenizer::scriptHandler - used to load external JavaScript scripts.
+    // * ScriptController::evaluateInWorld - used to evaluate JavaScript scripts.
+    // * ScriptController::executeIfJavaScriptURL - used to evaluate JavaScript URLs.
+    // * ScriptEventListener::createAttributeEventListener - used to create JavaScript event handlers.
+    // * HTMLBaseElement::process - used to set the document base URL.
+    // * HTMLTokenizer::parseTag - used to load external JavaScript scripts.
+    // * FrameLoader::requestObject - used to load <object>/<embed> elements.
     //
-    class XSSAuditor {
+    class XSSAuditor : public Noncopyable {
     public:
         XSSAuditor(Frame*);
         ~XSSAuditor();
@@ -117,21 +121,43 @@ namespace WebCore {
             String m_cachedCanonicalizedURL;
         };
 
+        struct FindTask {
+            FindTask()
+                : decodeEntities(true)
+                , allowRequestIfNoIllegalURICharacters(false)
+                , decodeURLEscapeSequencesTwice(false)
+            {
+            }
+
+            String context;
+            String string;
+            bool decodeEntities;
+            bool allowRequestIfNoIllegalURICharacters;
+            bool decodeURLEscapeSequencesTwice;
+        };
+
         static String canonicalize(const String&);
         static String decodeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
                                 bool decodeURLEscapeSequencesTwice = false);
         static String decodeHTMLEntities(const String&, bool leaveUndecodableEntitiesUntouched = true);
 
-        bool findInRequest(const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false, 
-                           bool decodeURLEscapeSequencesTwice = false) const;
-        bool findInRequest(Frame*, const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false, 
-                           bool decodeURLEscapeSequencesTwice = false) const;
+        bool isSameOriginResource(const String& url) const;
+        bool findInRequest(const FindTask&) const;
+        bool findInRequest(Frame*, const FindTask&) const;
+
+        XSSProtectionDisposition xssProtection() const;
 
         // The frame to audit.
         Frame* m_frame;
 
         // A state store to help us avoid canonicalizing the same URL repeated.
-        mutable CachingURLCanonicalizer m_cache;
+        // When a page has form data, we need two caches: one to store the
+        // canonicalized URL and another to store the cannonicalized form
+        // data. If we only had one cache, we'd always generate a cache miss
+        // and load some pages extremely slowly.
+        // https://bugs.webkit.org/show_bug.cgi?id=35373
+        mutable CachingURLCanonicalizer m_pageURLCache;
+        mutable CachingURLCanonicalizer m_formDataCache;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/ZoomMode.h b/src/3rdparty/webkit/WebCore/page/ZoomMode.h
new file mode 100644
index 0000000000..3f02184be4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/ZoomMode.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2010 Research in Motion Ltd. http://www.rim.com/
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef ZoomMode_h
+#define ZoomMode_h
+
+namespace WebCore {
+
+enum ZoomMode {
+    ZoomPage,
+    ZoomTextOnly
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp b/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp
deleted file mode 100644
index cf2acfb2bb..0000000000
--- a/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp
+++ /dev/null
@@ -1,128 +0,0 @@
-/*
- * Copyright 2009, The Android Open Source Project
- * Copyright (C) 2006 Zack Rusin <zack@kde.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-#define LOG_TAG "WebCore"
-
-#include "config.h"
-#include "EventHandler.h"
-
-#include "FocusController.h"
-#include "Frame.h"
-#include "KeyboardEvent.h"
-#include "MouseEventWithHitTestResults.h"
-#include "Page.h"
-#include "PlatformKeyboardEvent.h"
-#include "PlatformWheelEvent.h"
-#include "RenderWidget.h"
-
-namespace WebCore {
-
-unsigned EventHandler::s_accessKeyModifiers = PlatformKeyboardEvent::AltKey;
-
-bool EventHandler::tabsToAllControls(KeyboardEvent*) const
-{
-    return true;
-}
-
-void EventHandler::focusDocumentView()
-{
-    if (Page* page = m_frame->page())
-        page->focusController()->setFocusedFrame(m_frame);
-}
-
-bool EventHandler::passWidgetMouseDownEventToWidget(const MouseEventWithHitTestResults& event)
-{
-    // Figure out which view to send the event to.
-    RenderObject* target = event.targetNode() ? event.targetNode()->renderer() : 0;
-    if (!target || !target->isWidget())
-        return false;
-    return passMouseDownEventToWidget(toRenderWidget(target)->widget());
-}
-
-bool EventHandler::passWidgetMouseDownEventToWidget(RenderWidget* renderWidget)
-{
-    return passMouseDownEventToWidget(renderWidget->widget());
-}
-
-// This function is used to route the mouse down event to the native widgets, it seems like a
-// work around for the Mac platform which does not support double clicks, but browsers do.
-bool EventHandler::passMouseDownEventToWidget(Widget*)
-{
-    // return false so the normal propogation handles the event
-    return false;
-}
-
-bool EventHandler::eventActivatedView(const PlatformMouseEvent&) const
-{
-    notImplemented();
-    return false;
-}
-
-// This function is called for mouse events by FrameView::handleMousePressEvent().
-// It is used to ensure that events are sync'ed correctly between frames. For example
-// if the user presses down in one frame and up in another frame, this function will
-// returns true, and pass the event to the correct frame.
-bool EventHandler::passSubframeEventToSubframe(MouseEventWithHitTestResults&, Frame*, HitTestResult*)
-{
-    notImplemented();
-    return false;
-}
-
-// This is called to route wheel events to child widgets when they are RenderWidget
-// as the parent usually gets wheel event. Don't have a mouse with a wheel to confirm
-// the operation of this function.
-bool EventHandler::passWheelEventToWidget(PlatformWheelEvent&, Widget*)
-{
-    notImplemented();
-    return false;
-}
-
-bool EventHandler::passMousePressEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe)
-{
-    return passSubframeEventToSubframe(mev, subframe);
-}
-
-bool EventHandler::passMouseMoveEventToSubframe(MouseEventWithHitTestResults& mev, 
-    Frame* subframe, HitTestResult*)
-{
-    return passSubframeEventToSubframe(mev, subframe);
-}
-
-bool EventHandler::passMouseReleaseEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe)
-{
-    return passSubframeEventToSubframe(mev, subframe);
-}
-
-class Clipboard : public RefCounted<Clipboard> {
-};
-
-PassRefPtr<Clipboard> EventHandler::createDraggingClipboard() const
-{
-    return PassRefPtr<Clipboard>(0);
-}
-
-const double EventHandler::TextDragDelay = 0.0;
-
-}  // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/android/InspectorControllerAndroid.cpp b/src/3rdparty/webkit/WebCore/page/android/InspectorControllerAndroid.cpp
deleted file mode 100644
index 978bc253bd..0000000000
--- a/src/3rdparty/webkit/WebCore/page/android/InspectorControllerAndroid.cpp
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Copyright 2007, The Android Open Source Project
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "InspectorController.h"
-
-#include "Frame.h"
-#include "Node.h"
-#include "Profile.h"
-
-// This stub file was created to avoid building and linking in all the
-// Inspector codebase. If you would like to enable the Inspector, do the
-// following steps:
-// 1. Replace this file in WebCore/Android.mk with the common
-//    implementation, ie page/InsepctorController.cpp
-// 2. Add the JS API files to JavaScriptCore/Android.mk:
-// ?  API/JSBase.cpp \
-//      API/JSCallbackConstructor.cpp \
-//      API/JSCallbackFunction.cpp \
-//      API/JSCallbackObject.cpp \
-//      API/JSClassRef.cpp \
-//      API/JSContextRef.cpp \
-//      API/JSObjectRef.cpp \
-//      API/JSStringRef.cpp \
-//      API/JSValueRef.cpp
-// 3. Add the following LOCAL_C_INCLUDES to JavaScriptCore/Android.mk:
-// ?$(LOCAL_PATH)/API \
-//      $(LOCAL_PATH)/ForwardingHeaders \
-//      $(LOCAL_PATH)/../../WebKit \
-// 4. Rebuild WebKit
-//
-// Note, for a functional Inspector, you must implement InspectorClientAndroid.
-
-namespace WebCore {
-
-struct InspectorResource : public RefCounted<InspectorResource> {
-};
-
-struct InspectorDatabaseResource : public RefCounted<InspectorDatabaseResource> {
-};
-
-InspectorController::InspectorController(Page*, InspectorClient*)
-    : m_startProfiling(this, 0)
-{
-}
-
-InspectorController::~InspectorController() {}
-
-void InspectorController::windowScriptObjectAvailable() {}
-void InspectorController::didCommitLoad(DocumentLoader*) {}
-void InspectorController::identifierForInitialRequest(unsigned long, DocumentLoader*, ResourceRequest const&) {}
-void InspectorController::willSendRequest(DocumentLoader*, unsigned long, ResourceRequest&, ResourceResponse const&) {}
-void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long, ResourceResponse const&) {}
-void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long, int) {}
-void InspectorController::didFinishLoading(DocumentLoader*, unsigned long) {}
-void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader*, ResourceRequest const&, ResourceResponse const&, int) {}
-void InspectorController::frameDetachedFromParent(Frame*) {}
-
-void InspectorController::addMessageToConsole(MessageSource, MessageLevel, JSC::ExecState*, JSC::ArgList const&, unsigned int, String const&) {}
-void InspectorController::addMessageToConsole(MessageSource, MessageLevel, const String& message, unsigned lineNumber, const String& sourceID) {}
-#if ENABLE(DATABASE)
-void InspectorController::didOpenDatabase(Database*, String const&, String const&, String const&) {}
-#endif
-bool InspectorController::enabled() const { return false; }
-void InspectorController::inspect(Node*) {}
-bool InspectorController::windowVisible() { return false; }
-void InspectorController::addProfile(PassRefPtr<JSC::Profile>, unsigned int, const JSC::UString&) {}
-void InspectorController::inspectedPageDestroyed() {}
-void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identifier, JSC::UString& sourceString) {}
-
-void InspectorController::inspectedWindowScriptObjectCleared(Frame* frame) {}
-void InspectorController::startGroup(MessageSource source, JSC::ExecState* exec, const JSC::ArgList& arguments, unsigned lineNumber, const String& sourceURL) {}
-void InspectorController::endGroup(MessageSource source, unsigned lineNumber, const String& sourceURL) {}
-void InspectorController::startTiming(const JSC::UString& title) {}
-bool InspectorController::stopTiming(const JSC::UString& title, double& elapsed) { return false; }
-void InspectorController::count(const JSC::UString& title, unsigned lineNumber, const String& sourceID) {}
-
-void InspectorController::mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags) {}
-void InspectorController::handleMousePressOnNode(Node*) {}
-void InspectorController::failedToParseSource(JSC::ExecState* exec, const JSC::SourceCode& source, int errorLine, const JSC::UString& errorMessage) {}    
-void InspectorController::didParseSource(JSC::ExecState* exec, const JSC::SourceCode& source) {}
-void InspectorController::didPause() {}
-
-}  // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
index 59797da694..c2d70ef0f4 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
@@ -92,10 +92,17 @@ static inline Color blendFunc(const AnimationBase* anim, const Color& from, cons
     if (progress == 1 && !to.isValid())
         return Color();
 
-    return Color(blendFunc(anim, from.red(), to.red(), progress),
-                 blendFunc(anim, from.green(), to.green(), progress),
-                 blendFunc(anim, from.blue(), to.blue(), progress),
-                 blendFunc(anim, from.alpha(), to.alpha(), progress));
+    // Contrary to the name, RGBA32 actually stores ARGB, so we can initialize Color directly from premultipliedARGBFromColor().
+    // Also, premultipliedARGBFromColor() bails on zero alpha, so special-case that.
+    Color premultFrom = from.alpha() ? premultipliedARGBFromColor(from) : 0;
+    Color premultTo = to.alpha() ? premultipliedARGBFromColor(to) : 0;
+
+    Color premultBlended(blendFunc(anim, premultFrom.red(), premultTo.red(), progress),
+                 blendFunc(anim, premultFrom.green(), premultTo.green(), progress),
+                 blendFunc(anim, premultFrom.blue(), premultTo.blue(), progress),
+                 blendFunc(anim, premultFrom.alpha(), premultTo.alpha(), progress));
+
+    return Color(colorFromPremultipliedARGB(premultBlended.rgb()));
 }
 
 static inline Length blendFunc(const AnimationBase*, const Length& from, const Length& to, double progress)
@@ -190,7 +197,7 @@ class PropertyWrapperBase;
 static void addShorthandProperties();
 static PropertyWrapperBase* wrapperForProperty(int propertyID);
 
-class PropertyWrapperBase {
+class PropertyWrapperBase : public Noncopyable {
 public:
     PropertyWrapperBase(int prop)
         : m_prop(prop)
@@ -407,7 +414,7 @@ public:
 };
 
 template <typename T>
-class FillLayerPropertyWrapperGetter : public FillLayerPropertyWrapperBase {
+class FillLayerPropertyWrapperGetter : public FillLayerPropertyWrapperBase, public Noncopyable {
 public:
     FillLayerPropertyWrapperGetter(T (FillLayer::*getter)() const)
         : m_getter(getter)
@@ -863,7 +870,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
         m_pauseTime = -1;
         m_requestedStartTime = 0;
         m_nextIterationDuration = -1;
-        endAnimation(false);
+        endAnimation();
         return;
     }
 
@@ -875,7 +882,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
         m_pauseTime = -1;
         m_requestedStartTime = 0;
         m_nextIterationDuration = -1;
-        endAnimation(false);
+        endAnimation();
 
         if (!paused())
             updateStateMachine(AnimationStateInputStartAnimation, -1);
@@ -886,7 +893,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
         if (m_animState == AnimationStateStartWaitStyleAvailable)
             m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
         m_animState = AnimationStateDone;
-        endAnimation(true);
+        endAnimation();
         return;
     }
 
@@ -894,7 +901,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
         if (m_animState == AnimationStateStartWaitResponse) {
             // If we are in AnimationStateStartWaitResponse, the animation will get canceled before 
             // we get a response, so move to the next state.
-            endAnimation(false);
+            endAnimation();
             updateStateMachine(AnimationStateInputStartTimeSet, beginAnimationUpdateTime());
         }
         return;
@@ -903,7 +910,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
     if (input == AnimationStateInputResumeOverride) {
         if (m_animState == AnimationStateLooping || m_animState == AnimationStateEnding) {
             // Start the animation
-            startAnimation(m_startTime);
+            startAnimation(beginAnimationUpdateTime() - m_startTime);
         }
         return;
     }
@@ -911,8 +918,8 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
     // Execute state machine
     switch (m_animState) {
         case AnimationStateNew:
-            ASSERT(input == AnimationStateInputStartAnimation || input == AnimationStateInputPlayStateRunnning || input == AnimationStateInputPlayStatePaused);
-            if (input == AnimationStateInputStartAnimation || input == AnimationStateInputPlayStateRunnning) {
+            ASSERT(input == AnimationStateInputStartAnimation || input == AnimationStateInputPlayStateRunning || input == AnimationStateInputPlayStatePaused);
+            if (input == AnimationStateInputStartAnimation || input == AnimationStateInputPlayStateRunning) {
                 m_requestedStartTime = beginAnimationUpdateTime();
                 m_animState = AnimationStateStartWaitTimer;
             }
@@ -956,7 +963,12 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
                 updateStateMachine(AnimationStateInputStartTimeSet, beginAnimationUpdateTime());
             }
             else {
-                bool started = startAnimation(0);
+                double timeOffset = 0;
+                // If the value for 'animation-delay' is negative then the animation appears to have started in the past.
+                if (m_animation->delay() < 0)
+                    timeOffset = -m_animation->delay();
+                bool started = startAnimation(timeOffset);
+
                 m_compAnim->animationController()->addToStartTimeResponseWaitList(this, started);
                 m_fallbackAnimating = !started;
             }
@@ -967,8 +979,12 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
             if (input == AnimationStateInputStartTimeSet) {
                 ASSERT(param >= 0);
                 // We have a start time, set it, unless the startTime is already set
-                if (m_startTime <= 0)
+                if (m_startTime <= 0) {
                     m_startTime = param;
+                    // If the value for 'animation-delay' is negative then the animation appears to have started in the past.
+                    if (m_animation->delay() < 0)
+                        m_startTime += m_animation->delay();
+                }
 
                 // Decide whether to go into looping or ending state
                 goIntoEndingOrLoopingState();
@@ -980,7 +996,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
                 // We are pausing while waiting for a start response. Cancel the animation and wait. When 
                 // we unpause, we will act as though the start timer just fired
                 m_pauseTime = -1;
-                endAnimation(false);
+                pauseAnimation(beginAnimationUpdateTime() - m_startTime);
                 m_animState = AnimationStatePausedWaitResponse;
             }
             break;
@@ -997,7 +1013,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
             } else {
                 // We are pausing while running. Cancel the animation and wait
                 m_pauseTime = beginAnimationUpdateTime();
-                endAnimation(false);
+                pauseAnimation(beginAnimationUpdateTime() - m_startTime);
                 m_animState = AnimationStatePausedRun;
             }
             break;
@@ -1005,6 +1021,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
             ASSERT(input == AnimationStateInputEndTimerFired || input == AnimationStateInputPlayStatePaused);
 
             if (input == AnimationStateInputEndTimerFired) {
+
                 ASSERT(param >= 0);
                 // End timer fired, finish up
                 onAnimationEnd(param);
@@ -1012,7 +1029,10 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
                 m_animState = AnimationStateDone;
                 
                 if (m_object) {
-                    resumeOverriddenAnimations();
+                    if (m_animation->fillsForwards())
+                        m_animState = AnimationStateFillingForwards;
+                    else
+                        resumeOverriddenAnimations();
 
                     // Fire off another style change so we can set the final value
                     m_compAnim->animationController()->addNodeChangeToDispatch(m_object->node());
@@ -1020,13 +1040,13 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
             } else {
                 // We are pausing while running. Cancel the animation and wait
                 m_pauseTime = beginAnimationUpdateTime();
-                endAnimation(false);
+                pauseAnimation(beginAnimationUpdateTime() - m_startTime);
                 m_animState = AnimationStatePausedRun;
             }
             // |this| may be deleted here
             break;
         case AnimationStatePausedWaitTimer:
-            ASSERT(input == AnimationStateInputPlayStateRunnning);
+            ASSERT(input == AnimationStateInputPlayStateRunning);
             ASSERT(paused());
             // Update the times
             m_startTime += beginAnimationUpdateTime() - m_pauseTime;
@@ -1042,7 +1062,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
             // AnimationStatePausedWaitResponse, we don't yet have a valid startTime, so we send 0 to startAnimation.
             // When the AnimationStateInputStartTimeSet comes in and we were in AnimationStatePausedRun, we will notice
             // that we have already set the startTime and will ignore it.
-            ASSERT(input == AnimationStateInputPlayStateRunnning || input == AnimationStateInputStartTimeSet);
+            ASSERT(input == AnimationStateInputPlayStateRunning || input == AnimationStateInputStartTimeSet);
             ASSERT(paused());
             
             // If we are paused, but we get the callback that notifies us that an accelerated animation started,
@@ -1072,11 +1092,12 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
                 updateStateMachine(AnimationStateInputStartTimeSet, beginAnimationUpdateTime());
                 m_fallbackAnimating = true;
             } else {
-                bool started = startAnimation(m_startTime);
+                bool started = startAnimation(beginAnimationUpdateTime() - m_startTime);
                 m_compAnim->animationController()->addToStartTimeResponseWaitList(this, started);
                 m_fallbackAnimating = !started;
             }
             break;
+        case AnimationStateFillingForwards:
         case AnimationStateDone:
             // We're done. Stay in this state until we are deleted
             break;
@@ -1136,14 +1157,14 @@ void AnimationBase::fireAnimationEventsIfNeeded()
 void AnimationBase::updatePlayState(bool run)
 {
     if (paused() == run || isNew())
-        updateStateMachine(run ? AnimationStateInputPlayStateRunnning : AnimationStateInputPlayStatePaused, -1);
+        updateStateMachine(run ? AnimationStateInputPlayStateRunning : AnimationStateInputPlayStatePaused, -1);
 }
 
 double AnimationBase::timeToNextService()
 {
     // Returns the time at which next service is required. -1 means no service is required. 0 means 
     // service is required now, and > 0 means service is required that many seconds in the future.
-    if (paused() || isNew())
+    if (paused() || isNew() || m_animState == AnimationStateFillingForwards)
         return -1;
     
     if (m_animState == AnimationStateStartWaitTimer) {
@@ -1168,8 +1189,10 @@ double AnimationBase::progress(double scale, double offset, const TimingFunction
     if (m_animation->iterationCount() > 0)
         dur *= m_animation->iterationCount();
 
-    if (postActive() || !m_animation->duration() || (m_animation->iterationCount() > 0 && elapsedTime >= dur))
+    if (postActive() || !m_animation->duration())
         return 1.0;
+    if (m_animation->iterationCount() > 0 && elapsedTime >= dur)
+        return (m_animation->iterationCount() % 2) ? 1.0 : 0.0;
 
     // Compute the fractional time, taking into account direction.
     // There is no need to worry about iterations, we assume that we would have
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.h b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.h
index 3482f65256..a957119254 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.h
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.h
@@ -71,7 +71,8 @@ public:
         AnimationStatePausedWaitTimer,      // in pause mode when animation started
         AnimationStatePausedWaitResponse,   // animation paused when in STARTING state
         AnimationStatePausedRun,            // animation paused when in LOOPING or ENDING state
-        AnimationStateDone                  // end timer fired, animation finished and removed
+        AnimationStateDone,                 // end timer fired, animation finished and removed
+        AnimationStateFillingForwards       // animation has ended and is retaining its final value
     };
 
     enum AnimStateInput {
@@ -85,7 +86,7 @@ public:
         AnimationStateInputEndTimerFired,     // end timer fired
         AnimationStateInputPauseOverride,     // pause an animation due to override
         AnimationStateInputResumeOverride,    // resume an overridden animation
-        AnimationStateInputPlayStateRunnning, // play state paused -> running
+        AnimationStateInputPlayStateRunning,  // play state paused -> running
         AnimationStateInputPlayStatePaused,   // play state running -> paused
         AnimationStateInputEndAnimation       // force an end from any state
     };
@@ -186,8 +187,13 @@ protected:
     virtual void onAnimationStart(double /*elapsedTime*/) { }
     virtual void onAnimationIteration(double /*elapsedTime*/) { }
     virtual void onAnimationEnd(double /*elapsedTime*/) { }
-    virtual bool startAnimation(double /*beginTime*/) { return false; }
-    virtual void endAnimation(bool /*reset*/) { }
+    
+    // timeOffset is an offset from the current time when the animation should start. Negative values are OK.
+    // Return value indicates whether to expect an asynchronous notifyAnimationStarted() callback.
+    virtual bool startAnimation(double /*timeOffset*/) { return false; }
+    // timeOffset is the time at which the animation is being paused.
+    virtual void pauseAnimation(double /*timeOffset*/) { }
+    virtual void endAnimation() { }
 
     void goIntoEndingOrLoopingState();
 
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
index aa5de2c872..cb609a57a6 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
@@ -134,6 +134,9 @@ void AnimationControllerPrivate::updateAnimationTimer(bool callSetChanged/* = fa
 
 void AnimationControllerPrivate::updateStyleIfNeededDispatcherFired(Timer<AnimationControllerPrivate>*)
 {
+    // Protect the frame from getting destroyed in the event handler
+    RefPtr<Frame> protector = m_frame;
+
     // fire all the events
     Vector<EventToDispatch>::const_iterator eventsToDispatchEnd = m_eventsToDispatch.end();
     for (Vector<EventToDispatch>::const_iterator it = m_eventsToDispatch.begin(); it != eventsToDispatchEnd; ++it) {
@@ -484,7 +487,7 @@ PassRefPtr<RenderStyle> AnimationController::updateAnimations(RenderObject* rend
     m_data->updateAnimationTimer();
 
     if (blendedStyle != newStyle) {
-        // If the animations/transitions change opacity or transform, we neeed to update
+        // If the animations/transitions change opacity or transform, we need to update
         // the style to impose the stacking rules. Note that this is also
         // done in CSSStyleSelector::adjustRenderStyle().
         if (blendedStyle->hasAutoZIndex() && (blendedStyle->opacity() < 1.0f || blendedStyle->hasTransform()))
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationControllerPrivate.h b/src/3rdparty/webkit/WebCore/page/animation/AnimationControllerPrivate.h
index 7db3803858..682dd75985 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationControllerPrivate.h
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationControllerPrivate.h
@@ -49,7 +49,7 @@ class Node;
 class RenderObject;
 class RenderStyle;
 
-class AnimationControllerPrivate {
+class AnimationControllerPrivate : public Noncopyable {
 public:
     AnimationControllerPrivate(Frame*);
     ~AnimationControllerPrivate();
diff --git a/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp b/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp
index 8946d8064f..34f03c7943 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp
@@ -57,6 +57,7 @@ void CompositeAnimation::clearRenderer()
         }
     }
     if (!m_keyframeAnimations.isEmpty()) {
+        m_keyframeAnimations.checkConsistency();
         AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
         for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
             KeyframeAnimation* anim = it->second.get();
@@ -186,6 +187,8 @@ void CompositeAnimation::updateKeyframeAnimations(RenderObject* renderer, Render
     if (m_keyframeAnimations.isEmpty() && !targetStyle->hasAnimations())
         return;
 
+    m_keyframeAnimations.checkConsistency();
+
     AnimationNameMap::const_iterator kfend = m_keyframeAnimations.end();
     
     if (currentStyle && currentStyle->hasAnimations() && targetStyle->hasAnimations() && *(currentStyle->animations()) == *(targetStyle->animations())) {
@@ -262,6 +265,7 @@ PassRefPtr<RenderStyle> CompositeAnimation::animate(RenderObject* renderer, Rend
     // We don't do any transitions if we don't have a currentStyle (on startup).
     updateTransitions(renderer, currentStyle, targetStyle);
     updateKeyframeAnimations(renderer, currentStyle, targetStyle);
+    m_keyframeAnimations.checkConsistency();
 
     if (currentStyle) {
         // Now that we have transition objects ready, let them know about the new goal state.  We want them
@@ -295,6 +299,8 @@ PassRefPtr<RenderStyle> CompositeAnimation::getAnimatedStyle() const
             implicitAnimation->getAnimatedStyle(resultStyle);
     }
 
+    m_keyframeAnimations.checkConsistency();
+
     for (Vector<AtomicStringImpl*>::const_iterator it = m_keyframeAnimationOrderMap.begin(); it != m_keyframeAnimationOrderMap.end(); ++it) {
         RefPtr<KeyframeAnimation> keyframeAnimation = m_keyframeAnimations.get(*it);
         if (keyframeAnimation)
@@ -315,6 +321,7 @@ void CompositeAnimation::setAnimating(bool animating)
         }
     }
     if (!m_keyframeAnimations.isEmpty()) {
+        m_keyframeAnimations.checkConsistency();
         AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
         for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
             KeyframeAnimation* anim = it->second.get();
@@ -341,6 +348,7 @@ double CompositeAnimation::timeToNextService() const
         }
     }
     if (!m_keyframeAnimations.isEmpty()) {
+        m_keyframeAnimations.checkConsistency();
         AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
         for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
             KeyframeAnimation* animation = it->second.get();
@@ -362,6 +370,7 @@ PassRefPtr<KeyframeAnimation> CompositeAnimation::getAnimationForProperty(int pr
     // We want to send back the last animation with the property if there are multiples.
     // So we need to iterate through all animations
     if (!m_keyframeAnimations.isEmpty()) {
+        m_keyframeAnimations.checkConsistency();
         AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
         for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
             RefPtr<KeyframeAnimation> anim = it->second;
@@ -381,6 +390,7 @@ void CompositeAnimation::suspendAnimations()
     m_isSuspended = true;
 
     if (!m_keyframeAnimations.isEmpty()) {
+        m_keyframeAnimations.checkConsistency();
         AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
         for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
             if (KeyframeAnimation* anim = it->second.get())
@@ -405,6 +415,7 @@ void CompositeAnimation::resumeAnimations()
     m_isSuspended = false;
 
     if (!m_keyframeAnimations.isEmpty()) {
+        m_keyframeAnimations.checkConsistency();
         AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
         for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
             KeyframeAnimation* anim = it->second.get();
@@ -450,6 +461,7 @@ void CompositeAnimation::resumeOverriddenImplicitAnimations(int property)
 bool CompositeAnimation::isAnimatingProperty(int property, bool isRunningNow) const
 {
     if (!m_keyframeAnimations.isEmpty()) {
+        m_keyframeAnimations.checkConsistency();
         AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
         for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
             KeyframeAnimation* anim = it->second.get();
@@ -474,6 +486,8 @@ bool CompositeAnimation::pauseAnimationAtTime(const AtomicString& name, double t
     if (!name)
         return false;
 
+    m_keyframeAnimations.checkConsistency();
+
     RefPtr<KeyframeAnimation> keyframeAnim = m_keyframeAnimations.get(name.impl());
     if (!keyframeAnim || !keyframeAnim->running())
         return false;
@@ -509,6 +523,7 @@ unsigned CompositeAnimation::numberOfActiveAnimations() const
     unsigned count = 0;
     
     if (!m_keyframeAnimations.isEmpty()) {
+        m_keyframeAnimations.checkConsistency();
         AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
         for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
             KeyframeAnimation* anim = it->second.get();
diff --git a/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp b/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp
index 50fc781bf5..328fe0e8f0 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp
@@ -55,7 +55,7 @@ ImplicitAnimation::~ImplicitAnimation()
 {
     // // Make sure to tell the renderer that we are ending. This will make sure any accelerated animations are removed.
     if (!postActive())
-        endAnimation(true);
+        endAnimation();
 }
 
 bool ImplicitAnimation::shouldSendEventForListener(Document::ListenerType inListenerType) const
@@ -106,21 +106,21 @@ void ImplicitAnimation::getAnimatedStyle(RefPtr<RenderStyle>& animatedStyle)
     blendProperties(this, m_animatingProperty, animatedStyle.get(), m_fromStyle.get(), m_toStyle.get(), progress(1, 0, 0));
 }
 
-bool ImplicitAnimation::startAnimation(double beginTime)
+bool ImplicitAnimation::startAnimation(double timeOffset)
 {
 #if USE(ACCELERATED_COMPOSITING)
     if (m_object && m_object->hasLayer()) {
         RenderLayer* layer = toRenderBoxModelObject(m_object)->layer();
         if (layer->isComposited())
-            return layer->backing()->startTransition(beginTime, m_animatingProperty, m_fromStyle.get(), m_toStyle.get());
+            return layer->backing()->startTransition(timeOffset, m_animatingProperty, m_fromStyle.get(), m_toStyle.get());
     }
 #else
-    UNUSED_PARAM(beginTime);
+    UNUSED_PARAM(timeOffset);
 #endif
     return false;
 }
 
-void ImplicitAnimation::endAnimation(bool /*reset*/)
+void ImplicitAnimation::endAnimation()
 {
 #if USE(ACCELERATED_COMPOSITING)
     if (m_object && m_object->hasLayer()) {
@@ -143,7 +143,7 @@ void ImplicitAnimation::onAnimationEnd(double elapsedTime)
         keyframeAnim->setUnanimatedStyle(m_toStyle);
     
     sendTransitionEvent(eventNames().webkitTransitionEndEvent, elapsedTime);
-    endAnimation(true);
+    endAnimation();
 }
 
 bool ImplicitAnimation::sendTransitionEvent(const AtomicString& eventType, double elapsedTime)
@@ -161,7 +161,7 @@ bool ImplicitAnimation::sendTransitionEvent(const AtomicString& eventType, doubl
             if (m_object->node() && m_object->node()->isElementNode())
                 element = static_cast<Element*>(m_object->node());
 
-            ASSERT(!element || element->document() && !element->document()->inPageCache());
+            ASSERT(!element || (element->document() && !element->document()->inPageCache()));
             if (!element)
                 return false;
 
diff --git a/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.h b/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.h
index 7e286d2f4f..be5c19767b 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.h
+++ b/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.h
@@ -47,8 +47,9 @@ public:
     int animatingProperty() const { return m_animatingProperty; }
 
     virtual void onAnimationEnd(double elapsedTime);
-    virtual bool startAnimation(double beginTime);
-    virtual void endAnimation(bool reset);
+    virtual bool startAnimation(double timeOffset);
+    virtual void pauseAnimation(double /*timeOffset*/) { }
+    virtual void endAnimation();
 
     virtual void animate(CompositeAnimation*, RenderObject*, const RenderStyle* currentStyle, RenderStyle* targetStyle, RefPtr<RenderStyle>& animatedStyle);
     virtual void getAnimatedStyle(RefPtr<RenderStyle>& animatedStyle);
diff --git a/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp b/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp
index 7e37e5f65b..0e76ea9b86 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp
@@ -36,6 +36,7 @@
 #include "EventNames.h"
 #include "RenderLayer.h"
 #include "RenderLayerBacking.h"
+#include "RenderStyle.h"
 #include <wtf/UnusedParam.h>
 
 namespace WebCore {
@@ -58,7 +59,7 @@ KeyframeAnimation::~KeyframeAnimation()
 {
     // Make sure to tell the renderer that we are ending. This will make sure any accelerated animations are removed.
     if (!postActive())
-        endAnimation(true);
+        endAnimation();
 }
 
 void KeyframeAnimation::getKeyframeAnimationInterval(const RenderStyle*& fromStyle, const RenderStyle*& toStyle, double& prog) const
@@ -119,9 +120,11 @@ void KeyframeAnimation::animate(CompositeAnimation*, RenderObject*, const Render
     }
 
     // If we are waiting for the start timer, we don't want to change the style yet.
-    // Special case - if the delay time is 0, then we do want to set the first frame of the
+    // Special case 1 - if the delay time is 0, then we do want to set the first frame of the
     // animation right away. This avoids a flash when the animation starts.
-    if (waitingToStart() && m_animation->delay() > 0)
+    // Special case 2 - if there is a backwards fill mode, then we want to continue
+    // through to the style blend so that we get the fromStyle.
+    if (waitingToStart() && m_animation->delay() > 0 && !m_animation->fillsBackwards())
         return;
 
     // FIXME: we need to be more efficient about determining which keyframes we are animating between.
@@ -191,40 +194,54 @@ bool KeyframeAnimation::hasAnimationForProperty(int property) const
     return false;
 }
 
-bool KeyframeAnimation::startAnimation(double beginTime)
+bool KeyframeAnimation::startAnimation(double timeOffset)
 {
 #if USE(ACCELERATED_COMPOSITING)
     if (m_object && m_object->hasLayer()) {
         RenderLayer* layer = toRenderBoxModelObject(m_object)->layer();
         if (layer->isComposited())
-            return layer->backing()->startAnimation(beginTime, m_animation.get(), m_keyframes);
+            return layer->backing()->startAnimation(timeOffset, m_animation.get(), m_keyframes);
     }
 #else
-    UNUSED_PARAM(beginTime);
+    UNUSED_PARAM(timeOffset);
 #endif
     return false;
 }
 
-void KeyframeAnimation::endAnimation(bool reset)
+void KeyframeAnimation::pauseAnimation(double timeOffset)
 {
-    if (m_object) {
+    if (!m_object)
+        return;
+
 #if USE(ACCELERATED_COMPOSITING)
-        if (m_object->hasLayer()) {
-            RenderLayer* layer = toRenderBoxModelObject(m_object)->layer();
-            if (layer->isComposited()) {
-                if (reset)
-                    layer->backing()->animationFinished(m_keyframes.animationName());
-                else
-                    layer->backing()->animationPaused(m_keyframes.animationName());
-            }
-        }
+    if (m_object->hasLayer()) {
+        RenderLayer* layer = toRenderBoxModelObject(m_object)->layer();
+        if (layer->isComposited())
+            layer->backing()->animationPaused(timeOffset, m_keyframes.animationName());
+    }
 #else
-        UNUSED_PARAM(reset);
+    UNUSED_PARAM(timeOffset);
 #endif
-        // Restore the original (unanimated) style
-        if (!paused())
-            setNeedsStyleRecalc(m_object->node());
+    // Restore the original (unanimated) style
+    if (!paused())
+        setNeedsStyleRecalc(m_object->node());
+}
+
+void KeyframeAnimation::endAnimation()
+{
+    if (!m_object)
+        return;
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_object->hasLayer()) {
+        RenderLayer* layer = toRenderBoxModelObject(m_object)->layer();
+        if (layer->isComposited())
+            layer->backing()->animationFinished(m_keyframes.animationName());
     }
+#endif
+    // Restore the original (unanimated) style
+    if (!paused())
+        setNeedsStyleRecalc(m_object->node());
 }
 
 bool KeyframeAnimation::shouldSendEventForListener(Document::ListenerType listenerType) const
@@ -245,7 +262,10 @@ void KeyframeAnimation::onAnimationIteration(double elapsedTime)
 void KeyframeAnimation::onAnimationEnd(double elapsedTime)
 {
     sendAnimationEvent(eventNames().webkitAnimationEndEvent, elapsedTime);
-    endAnimation(true);
+    // End the animation if we don't fill forwards. Forward filling
+    // animations are ended properly in the class destructor.
+    if (!m_animation->fillsForwards())
+        endAnimation();
 }
 
 bool KeyframeAnimation::sendAnimationEvent(const AtomicString& eventType, double elapsedTime)
@@ -266,7 +286,7 @@ bool KeyframeAnimation::sendAnimationEvent(const AtomicString& eventType, double
         if (m_object->node() && m_object->node()->isElementNode())
             element = static_cast<Element*>(m_object->node());
 
-        ASSERT(!element || element->document() && !element->document()->inPageCache());
+        ASSERT(!element || (element->document() && !element->document()->inPageCache()));
         if (!element)
             return false;
 
diff --git a/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.h b/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.h
index 4905fc3209..fab0ae8675 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.h
+++ b/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.h
@@ -32,10 +32,11 @@
 #include "AnimationBase.h"
 #include "Document.h"
 #include "KeyframeList.h"
-#include "RenderStyle.h"
 
 namespace WebCore {
 
+class RenderStyle;
+
 // A KeyframeAnimation tracks the state of an explicit animation
 // for a single RenderObject.
 class KeyframeAnimation : public AnimationBase {
@@ -63,8 +64,9 @@ protected:
     virtual void onAnimationStart(double elapsedTime);
     virtual void onAnimationIteration(double elapsedTime);
     virtual void onAnimationEnd(double elapsedTime);
-    virtual bool startAnimation(double beginTime);
-    virtual void endAnimation(bool reset);
+    virtual bool startAnimation(double timeOffset);
+    virtual void pauseAnimation(double timeOffset);
+    virtual void endAnimation();
 
     virtual void overrideAnimations();
     virtual void resumeOverriddenAnimations();
diff --git a/src/3rdparty/webkit/WebCore/page/qt/DragControllerQt.cpp b/src/3rdparty/webkit/WebCore/page/qt/DragControllerQt.cpp
index e6c76825d1..33815b5d54 100644
--- a/src/3rdparty/webkit/WebCore/page/qt/DragControllerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/page/qt/DragControllerQt.cpp
@@ -66,6 +66,7 @@ const IntSize& DragController::maxDragImageSize()
 
 void DragController::cleanupAfterSystemDrag()
 {
+    dragEnded();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/page/qt/EventHandlerQt.cpp b/src/3rdparty/webkit/WebCore/page/qt/EventHandlerQt.cpp
index 34252897f0..d7982fa72a 100644
--- a/src/3rdparty/webkit/WebCore/page/qt/EventHandlerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/page/qt/EventHandlerQt.cpp
@@ -132,7 +132,11 @@ bool EventHandler::passMouseReleaseEventToSubframe(MouseEventWithHitTestResults&
 
 unsigned EventHandler::accessKeyModifiers()
 {
-    return PlatformKeyboardEvent::CtrlKey;
+#if OS(DARWIN)
+    return PlatformKeyboardEvent::CtrlKey | PlatformKeyboardEvent::AltKey;
+#else
+    return PlatformKeyboardEvent::AltKey;
+#endif
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/page/win/EventHandlerWin.cpp b/src/3rdparty/webkit/WebCore/page/win/EventHandlerWin.cpp
index 50e50fb13e..5511209609 100644
--- a/src/3rdparty/webkit/WebCore/page/win/EventHandlerWin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/win/EventHandlerWin.cpp
@@ -88,7 +88,7 @@ bool EventHandler::eventActivatedView(const PlatformMouseEvent& event) const
 
 PassRefPtr<Clipboard> EventHandler::createDraggingClipboard() const
 {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     return 0;
 #else
     COMPtr<WCDataObject> dataObject;
diff --git a/src/3rdparty/webkit/WebCore/page/win/FrameCGWin.cpp b/src/3rdparty/webkit/WebCore/page/win/FrameCGWin.cpp
index 7483627ede..cce500487b 100644
--- a/src/3rdparty/webkit/WebCore/page/win/FrameCGWin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/win/FrameCGWin.cpp
@@ -45,13 +45,16 @@ static void drawRectIntoContext(IntRect rect, FrameView* view, GraphicsContext*
     rect.move(-offset.width(), -offset.height());
     rect = view->convertToContainingWindow(rect);
 
-    gc->concatCTM(TransformationMatrix().translate(-rect.x(), -rect.y()));
+    gc->concatCTM(AffineTransform().translate(-rect.x(), -rect.y()));
 
     view->paint(gc, rect);
 }
 
 static HBITMAP imageFromRect(const Frame* frame, IntRect& ir)
 {
+    PaintBehavior oldPaintBehavior = frame->view()->paintBehavior();
+    frame->view()->setPaintBehavior(oldPaintBehavior | PaintBehaviorFlattenCompositingLayers);
+
     void* bits;
     HDC hdc = CreateCompatibleDC(0);
     int w = ir.width();
@@ -74,6 +77,8 @@ static HBITMAP imageFromRect(const Frame* frame, IntRect& ir)
     SelectObject(hdc, hbmpOld);
     DeleteDC(hdc);
 
+    frame->view()->setPaintBehavior(oldPaintBehavior);
+
     return hbmp;
 }
 
@@ -81,12 +86,12 @@ HBITMAP imageFromSelection(Frame* frame, bool forceBlackText)
 {
     frame->document()->updateLayout();
 
-    frame->view()->setPaintRestriction(forceBlackText ? PaintRestrictionSelectionOnlyBlackText : PaintRestrictionSelectionOnly);
+    frame->view()->setPaintBehavior(PaintBehaviorSelectionOnly | (forceBlackText ? PaintBehaviorForceBlackText : 0));
     FloatRect fr = frame->selectionBounds();
     IntRect ir(static_cast<int>(fr.x()), static_cast<int>(fr.y()),
                static_cast<int>(fr.width()), static_cast<int>(fr.height()));
     HBITMAP image = imageFromRect(frame, ir);
-    frame->view()->setPaintRestriction(PaintRestrictionNone);
+    frame->view()->setPaintBehavior(PaintBehaviorNormal);
     return image;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/page/win/FrameCairoWin.cpp b/src/3rdparty/webkit/WebCore/page/win/FrameCairoWin.cpp
index f5b832e044..3e1fe28743 100644
--- a/src/3rdparty/webkit/WebCore/page/win/FrameCairoWin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/win/FrameCairoWin.cpp
@@ -24,6 +24,7 @@
  */
 
 #include "config.h"
+#include "Frame.h"
 #include "FrameWin.h"
 
 #include "EditorClient.h"
diff --git a/src/3rdparty/webkit/WebCore/page/win/FrameWin.cpp b/src/3rdparty/webkit/WebCore/page/win/FrameWin.cpp
index b15d19529a..2b5435ddf2 100644
--- a/src/3rdparty/webkit/WebCore/page/win/FrameWin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/win/FrameWin.cpp
@@ -24,69 +24,25 @@
  */
 
 #include "config.h"
-#include "runtime.h"
 #include "FrameWin.h"
 
-#include "TransformationMatrix.h"
-#include "FloatRect.h"
+#include "Bridge.h"
 #include "Document.h"
+#include "FloatRect.h"
+#include "PrintContext.h"
 #include "RenderView.h"
 #include "Settings.h"
-
-using std::min;
+#include "TransformationMatrix.h"
 
 namespace WebCore {
 
-void computePageRectsForFrame(Frame* frame, const IntRect& printRect, float headerHeight, float footerHeight, float userScaleFactor, Vector<IntRect>& pages, int& outPageHeight)
+void computePageRectsForFrame(Frame* frame, const IntRect& printRect, float headerHeight, float footerHeight, float userScaleFactor, Vector<IntRect>& outPages, int& outPageHeight)
 {
-    ASSERT(frame);
-
-    pages.clear();
-    outPageHeight = 0;
-
-    if (!frame->document() || !frame->view() || !frame->document()->renderer())
-        return;
- 
-    RenderView* root = toRenderView(frame->document()->renderer());
-
-    if (!root) {
-        LOG_ERROR("document to be printed has no renderer");
-        return;
-    }
-
-    if (userScaleFactor <= 0) {
-        LOG_ERROR("userScaleFactor has bad value %.2f", userScaleFactor);
-        return;
-    }
-    
-    float ratio = static_cast<float>(printRect.height()) / static_cast<float>(printRect.width());
- 
-    float pageWidth  = static_cast<float>(root->rightLayoutOverflow());
-    float pageHeight = pageWidth * ratio;
-    outPageHeight = static_cast<int>(pageHeight);   // this is the height of the page adjusted by margins
-    pageHeight -= (headerHeight + footerHeight);
-
-    if (pageHeight <= 0) {
-        LOG_ERROR("pageHeight has bad value %.2f", pageHeight);
-        return;
-    }
-
-    float currPageHeight = pageHeight / userScaleFactor;
-    float docHeight      = root->layer()->height();
-    float docWidth       = root->layer()->width();
-    float currPageWidth  = pageWidth / userScaleFactor;
-
-    
-    // always return at least one page, since empty files should print a blank page
-    float printedPagesHeight = 0.0f;
-    do {
-        float proposedBottom = min(docHeight, printedPagesHeight + pageHeight);
-        frame->view()->adjustPageHeight(&proposedBottom, printedPagesHeight, proposedBottom, printedPagesHeight);
-        currPageHeight = max(1.0f, proposedBottom - printedPagesHeight);
-       
-        pages.append(IntRect(0, printedPagesHeight, currPageWidth, currPageHeight));
-        printedPagesHeight += currPageHeight;
-    } while (printedPagesHeight < docHeight);
+    PrintContext printContext(frame);
+    float pageHeight = 0;
+    printContext.computePageRects(printRect, headerHeight, footerHeight, userScaleFactor, pageHeight);
+    outPageHeight = static_cast<int>(pageHeight);
+    outPages = printContext.pageRects();
 }
 
 DragImageRef Frame::dragImageForSelection()
diff --git a/src/3rdparty/webkit/WebCore/page/win/FrameWin.h b/src/3rdparty/webkit/WebCore/page/win/FrameWin.h
index 2924291621..4c274b7ecf 100644
--- a/src/3rdparty/webkit/WebCore/page/win/FrameWin.h
+++ b/src/3rdparty/webkit/WebCore/page/win/FrameWin.h
@@ -26,15 +26,18 @@
 #ifndef FrameWin_H
 #define FrameWin_H
 
-#include "Frame.h"
+#include <wtf/Vector.h>
 
 // Forward declared so we don't need wingdi.h.
 typedef struct HBITMAP__* HBITMAP;
 
 namespace WebCore {
 
+    class Frame;
+    class IntRect;
+
     HBITMAP imageFromSelection(Frame* frame, bool forceWhiteText);
-    void computePageRectsForFrame(Frame*, const IntRect& printRect, float headerHeight, float footerHeight, float userScaleFactor, Vector<IntRect>& pages, int& pageHeight);
+    void computePageRectsForFrame(Frame*, const IntRect& printRect, float headerHeight, float footerHeight, float userScaleFactor, Vector<IntRect>& outPages, int& outPageHeight);
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp b/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
index ee6aa4e277..0022a4738d 100644
--- a/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
@@ -40,6 +40,7 @@
 #include "Editor.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "InspectorController.h"
 #include "KURL.h"
 #include "LocalizedStrings.h"
 #include "Node.h"
@@ -48,7 +49,6 @@
 #include "SelectionController.h"
 #include "Settings.h"
 #include "TextIterator.h"
-#include <memory>
 
 using namespace std;
 using namespace WTF;
@@ -65,9 +65,9 @@ ContextMenuController* ContextMenu::controller() const
     return 0;
 }
 
-static auto_ptr<ContextMenuItem> separatorItem()
+static PassOwnPtr<ContextMenuItem> separatorItem()
 {
-    return auto_ptr<ContextMenuItem>(new ContextMenuItem(SeparatorType, ContextMenuItemTagNoAction, String()));
+    return new ContextMenuItem(SeparatorType, ContextMenuItemTagNoAction, String());
 }
 
 static void createAndAppendFontSubMenu(const HitTestResult& result, ContextMenuItem& fontMenuItem)
@@ -275,7 +275,9 @@ void ContextMenu::populate()
     ContextMenuItem LookInDictionaryItem(ActionType, ContextMenuItemTagLookUpInDictionary, 
         contextMenuItemTagLookUpInDictionary());
 #endif
+#if !PLATFORM(GTK)
     ContextMenuItem SearchWebItem(ActionType, ContextMenuItemTagSearchWeb, contextMenuItemTagSearchWeb());
+#endif
     ContextMenuItem CopyItem(ActionType, ContextMenuItemTagCopy, contextMenuItemTagCopy());
     ContextMenuItem BackItem(ActionType, ContextMenuItemTagGoBack, contextMenuItemTagGoBack());
     ContextMenuItem ForwardItem(ActionType, ContextMenuItemTagGoForward,  contextMenuItemTagGoForward());
@@ -340,8 +342,10 @@ void ContextMenu::populate()
 #if PLATFORM(MAC)
                     appendItem(SearchSpotlightItem);
 #endif
+#if !PLATFORM(GTK)
                     appendItem(SearchWebItem);
                     appendItem(*separatorItem());
+#endif
 #if PLATFORM(MAC)
                     appendItem(LookInDictionaryItem);
                     appendItem(*separatorItem());
@@ -355,6 +359,9 @@ void ContextMenu::populate()
                 appendItem(SpeechMenuItem);
 #endif                
             } else {
+#if ENABLE(INSPECTOR)
+                if (!(frame->page() && frame->page()->inspectorController()->hasInspectorFrontendClient())) {
+#endif
 #if PLATFORM(GTK)
                 appendItem(BackItem);
                 appendItem(ForwardItem);
@@ -374,6 +381,9 @@ void ContextMenu::populate()
                 else
                     appendItem(ReloadItem);
 #endif
+#if ENABLE(INSPECTOR)
+                }
+#endif
 
                 if (frame->page() && frame != frame->page()->mainFrame())
                     appendItem(OpenFrameItem);
@@ -444,8 +454,10 @@ void ContextMenu::populate()
 #if PLATFORM(MAC)
             appendItem(SearchSpotlightItem);
 #endif
+#if !PLATFORM(GTK)
             appendItem(SearchWebItem);
             appendItem(*separatorItem());
+#endif
      
 #if PLATFORM(MAC)
             appendItem(LookInDictionaryItem);
@@ -465,10 +477,12 @@ void ContextMenu::populate()
         if (!inPasswordField) {
             appendItem(*separatorItem());
 #ifndef BUILDING_ON_TIGER
+#if !PLATFORM(GTK)
             ContextMenuItem SpellingAndGrammarMenuItem(SubmenuType, ContextMenuItemTagSpellingMenu, 
                 contextMenuItemTagSpellingMenu());
             createAndAppendSpellingAndGrammarSubMenu(m_hitTestResult, SpellingAndGrammarMenuItem);
             appendItem(SpellingAndGrammarMenuItem);
+#endif
 #else
             ContextMenuItem SpellingMenuItem(SubmenuType, ContextMenuItemTagSpellingMenu, 
                 contextMenuItemTagSpellingMenu());
@@ -485,10 +499,17 @@ void ContextMenu::populate()
             createAndAppendTransformationsSubMenu(m_hitTestResult, transformationsMenuItem);
             appendItem(transformationsMenuItem);
 #endif
-            ContextMenuItem  FontMenuItem(SubmenuType, ContextMenuItemTagFontMenu, 
-                contextMenuItemTagFontMenu());
-            createAndAppendFontSubMenu(m_hitTestResult, FontMenuItem);
-            appendItem(FontMenuItem);
+#if PLATFORM(GTK)
+            bool shouldShowFontMenu = frame->editor()->canEditRichly();
+#else
+            bool shouldShowFontMenu = true;
+#endif
+            if (shouldShowFontMenu) {
+                ContextMenuItem FontMenuItem(SubmenuType, ContextMenuItemTagFontMenu, 
+                    contextMenuItemTagFontMenu());
+                createAndAppendFontSubMenu(m_hitTestResult, FontMenuItem);
+                appendItem(FontMenuItem);
+            }
 #if PLATFORM(MAC)
             ContextMenuItem SpeechMenuItem(SubmenuType, ContextMenuItemTagSpeechMenu, contextMenuItemTagSpeechMenu());
             createAndAppendSpeechSubMenu(m_hitTestResult, SpeechMenuItem);
@@ -535,7 +556,6 @@ void ContextMenu::addInspectElementItem()
         return;
 
     ContextMenuItem InspectElementItem(ActionType, ContextMenuItemTagInspectElement, contextMenuItemTagInspectElement());
-    appendItem(*separatorItem());
     appendItem(InspectElementItem);
 }
 #endif // ENABLE(INSPECTOR)
@@ -779,6 +799,7 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
 #if ENABLE(INSPECTOR)
         case ContextMenuItemTagInspectElement:
 #endif
+        case ContextMenuItemBaseCustomTag:
         case ContextMenuItemBaseApplicationTag:
             break;
     }
diff --git a/src/3rdparty/webkit/WebCore/platform/ContextMenu.h b/src/3rdparty/webkit/WebCore/platform/ContextMenu.h
index dc484b2b9f..77843dc34c 100644
--- a/src/3rdparty/webkit/WebCore/platform/ContextMenu.h
+++ b/src/3rdparty/webkit/WebCore/platform/ContextMenu.h
@@ -78,6 +78,8 @@ namespace WebCore {
         RetainPtr<NSMutableArray> m_platformDescription;
 #elif PLATFORM(QT)
         QList<ContextMenuItem> m_items;
+#elif PLATFORM(CHROMIUM)
+        Vector<ContextMenuItem> m_items;
 #else
         PlatformMenuDescription m_platformDescription;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/ContextMenuItem.h b/src/3rdparty/webkit/WebCore/platform/ContextMenuItem.h
index 0c6b81ab24..88ff0ad60d 100644
--- a/src/3rdparty/webkit/WebCore/platform/ContextMenuItem.h
+++ b/src/3rdparty/webkit/WebCore/platform/ContextMenuItem.h
@@ -143,6 +143,7 @@ namespace WebCore {
         ContextMenuItemTagCapitalize,
         ContextMenuItemTagChangeBack,
 #endif
+        ContextMenuItemBaseCustomTag = 5000,
         ContextMenuItemBaseApplicationTag = 10000
     };
 
@@ -208,11 +209,24 @@ namespace WebCore {
     };
 #elif PLATFORM(HAIKU)
     typedef BMenuItem* PlatformMenuItemDescription;
+#elif PLATFORM(CHROMIUM)
+    struct PlatformMenuItemDescription {
+        PlatformMenuItemDescription()
+            : type(ActionType)
+            , action(ContextMenuItemTagNoAction)
+            , checked(false)
+            , enabled(true) { }
+        ContextMenuItemType type;
+        ContextMenuAction action;
+        String title;
+        bool checked;
+        bool enabled;
+    };
 #else
     typedef void* PlatformMenuItemDescription;
 #endif
 
-    class ContextMenuItem {
+    class ContextMenuItem : public FastAllocBase {
     public:
         ContextMenuItem(PlatformMenuItemDescription);
         ContextMenuItem(ContextMenu* subMenu = 0);
@@ -237,7 +251,8 @@ namespace WebCore {
         void setSubMenu(ContextMenu*);
 
         void setChecked(bool = true);
-        
+        bool checked() const;
+
         void setEnabled(bool = true);
         bool enabled() const;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/CookieJar.h b/src/3rdparty/webkit/WebCore/platform/CookieJar.h
index 987543edff..fb1abeeb5c 100644
--- a/src/3rdparty/webkit/WebCore/platform/CookieJar.h
+++ b/src/3rdparty/webkit/WebCore/platform/CookieJar.h
@@ -36,7 +36,9 @@ namespace WebCore {
 
     struct Cookie;
 
+    // cookies omits HttpOnly cookies.
     String cookies(const Document*, const KURL&);
+    String cookieRequestHeaderFieldValue(const Document*, const KURL&);
     void setCookies(Document*, const KURL&, const String&);
     bool cookiesEnabled(const Document*);
     bool getRawCookies(const Document*, const KURL&, Vector<Cookie>&);
diff --git a/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.cpp b/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.cpp
index d02da6c41f..683ba5436f 100644
--- a/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.cpp
@@ -32,6 +32,7 @@
 
 #include "CrossThreadCopier.h"
 
+#include "KURL.h"
 #include "PlatformString.h"
 #include "ResourceError.h"
 #include "ResourceRequest.h"
@@ -39,22 +40,27 @@
 
 namespace WebCore {
 
-CrossThreadCopierBase<false, String>::Type CrossThreadCopierBase<false, String>::copy(const String& str)
+CrossThreadCopierBase<false, false, KURL>::Type CrossThreadCopierBase<false, false, KURL>::copy(const KURL& url)
+{
+    return url.copy();
+}
+
+CrossThreadCopierBase<false, false, String>::Type CrossThreadCopierBase<false, false, String>::copy(const String& str)
 {
     return str.crossThreadString();
 }
 
-CrossThreadCopierBase<false, ResourceError>::Type CrossThreadCopierBase<false, ResourceError>::copy(const ResourceError& error)
+CrossThreadCopierBase<false, false, ResourceError>::Type CrossThreadCopierBase<false, false, ResourceError>::copy(const ResourceError& error)
 {
     return error.copy();
 }
 
-CrossThreadCopierBase<false, ResourceRequest>::Type CrossThreadCopierBase<false, ResourceRequest>::copy(const ResourceRequest& request)
+CrossThreadCopierBase<false, false, ResourceRequest>::Type CrossThreadCopierBase<false, false, ResourceRequest>::copy(const ResourceRequest& request)
 {
     return request.copyData();
 }
 
-CrossThreadCopierBase<false, ResourceResponse>::Type CrossThreadCopierBase<false, ResourceResponse>::copy(const ResourceResponse& response)
+CrossThreadCopierBase<false, false, ResourceResponse>::Type CrossThreadCopierBase<false, false, ResourceResponse>::copy(const ResourceResponse& response)
 {
     return response.copyData();
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.h b/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.h
index 178e056ab4..e35a6b3bc4 100644
--- a/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.h
+++ b/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -31,7 +31,6 @@
 #ifndef CrossThreadCopier_h
 #define CrossThreadCopier_h
 
-#include <memory>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -40,8 +39,9 @@
 
 namespace WebCore {
 
+    class KURL;
     class ResourceError;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
     class String;
     struct CrossThreadResourceResponseData;
@@ -56,29 +56,30 @@ namespace WebCore {
         }
     };
 
-    template<bool isConvertibleToInteger, typename T> struct CrossThreadCopierBase;
+    template<bool isConvertibleToInteger, bool isThreadsafeShared, typename T> struct CrossThreadCopierBase;
 
     // Integers get passed through without any changes.
-    template<typename T> struct CrossThreadCopierBase<true, T> : public CrossThreadCopierPassThrough<T> {
+    template<typename T> struct CrossThreadCopierBase<true, false, T> : public CrossThreadCopierPassThrough<T> {
     };
 
     // Pointers get passed through without any significant changes.
-    template<typename T> struct CrossThreadCopierBase<false, T*> : public CrossThreadCopierPassThrough<T*> {
+    template<typename T> struct CrossThreadCopierBase<false, false, T*> : public CrossThreadCopierPassThrough<T*> {
     };
 
-    template<> struct CrossThreadCopierBase<false, ThreadableLoaderOptions> : public CrossThreadCopierPassThrough<ThreadableLoaderOptions> {
+    template<> struct CrossThreadCopierBase<false, false, ThreadableLoaderOptions> : public CrossThreadCopierPassThrough<ThreadableLoaderOptions> {
     };
 
     // Custom copy methods.
-    template<typename T> struct CrossThreadCopierBase<false, RefPtr<ThreadSafeShared<T> > > {
-        typedef PassRefPtr<T> Type;
-        static Type copy(const RefPtr<ThreadSafeShared<T> >& refPtr)
+    template<typename T> struct CrossThreadCopierBase<false, true, T> {
+        typedef typename WTF::RemoveTemplate<T, RefPtr>::Type RefCountedType;
+        typedef PassRefPtr<RefCountedType> Type;
+        static Type copy(const T& refPtr)
         {
-            return PassRefPtr<T>(static_cast<T*>(refPtr.get()));
+            return refPtr.get();
         }
     };
 
-    template<typename T> struct CrossThreadCopierBase<false, PassOwnPtr<T> > {
+    template<typename T> struct CrossThreadCopierBase<false, false, PassOwnPtr<T> > {
         typedef PassOwnPtr<T> Type;
         static Type copy(const PassOwnPtr<T>& ownPtr)
         {
@@ -86,35 +87,34 @@ namespace WebCore {
         }
     };
 
-    template<typename T> struct CrossThreadCopierBase<false, std::auto_ptr<T> > {
-        typedef std::auto_ptr<T> Type;
-        static Type copy(const std::auto_ptr<T>& autoPtr)
-        {
-            return std::auto_ptr<T>(*const_cast<std::auto_ptr<T>*>(&autoPtr));
-        }
+    template<> struct CrossThreadCopierBase<false, false, KURL> {
+        typedef KURL Type;
+        static Type copy(const KURL&);
     };
 
-    template<> struct CrossThreadCopierBase<false, String> {
+    template<> struct CrossThreadCopierBase<false, false, String> {
         typedef String Type;
         static Type copy(const String&);
     };
 
-    template<> struct CrossThreadCopierBase<false, ResourceError> {
+    template<> struct CrossThreadCopierBase<false, false, ResourceError> {
         typedef ResourceError Type;
         static Type copy(const ResourceError&);
     };
 
-    template<> struct CrossThreadCopierBase<false, ResourceRequest> {
-        typedef std::auto_ptr<CrossThreadResourceRequestData> Type;
+    template<> struct CrossThreadCopierBase<false, false, ResourceRequest> {
+        typedef PassOwnPtr<CrossThreadResourceRequestData> Type;
         static Type copy(const ResourceRequest&);
     };
 
-    template<> struct CrossThreadCopierBase<false, ResourceResponse> {
-        typedef std::auto_ptr<CrossThreadResourceResponseData> Type;
+    template<> struct CrossThreadCopierBase<false, false, ResourceResponse> {
+        typedef PassOwnPtr<CrossThreadResourceResponseData> Type;
         static Type copy(const ResourceResponse&);
     };
 
-    template<typename T> struct CrossThreadCopier : public CrossThreadCopierBase<WTF::IsConvertibleToInteger<T>::value, T> {
+    template<typename T> struct CrossThreadCopier : public CrossThreadCopierBase<WTF::IsConvertibleToInteger<T>::value,
+                                                                                 WTF::IsSubclassOfTemplate<typename WTF::RemoveTemplate<T, RefPtr>::Type, ThreadSafeShared>::value,
+                                                                                 T> {
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/Cursor.h b/src/3rdparty/webkit/WebCore/platform/Cursor.h
index 2d041d23f5..76f19e9585 100644
--- a/src/3rdparty/webkit/WebCore/platform/Cursor.h
+++ b/src/3rdparty/webkit/WebCore/platform/Cursor.h
@@ -26,8 +26,6 @@
 #ifndef Cursor_h
 #define Cursor_h
 
-#include <wtf/Platform.h>
-
 #if PLATFORM(WIN)
 typedef struct HICON__* HICON;
 typedef HICON HCURSOR;
@@ -56,6 +54,11 @@ class NSCursor;
 class wxCursor;
 #endif
 
+#if PLATFORM(WIN)
+typedef struct HICON__ *HICON;
+typedef HICON HCURSOR;
+#endif
+
 namespace WebCore {
 
     class Image;
@@ -65,7 +68,7 @@ namespace WebCore {
     class SharedCursor : public RefCounted<SharedCursor> {
     public:
         static PassRefPtr<SharedCursor> create(HCURSOR nativeCursor) { return adoptRef(new SharedCursor(nativeCursor)); }
-        ~SharedCursor() { DestroyIcon(m_nativeCursor); }
+        ~SharedCursor();
         HCURSOR nativeCursor() const { return m_nativeCursor; }
     private:
         SharedCursor(HCURSOR nativeCursor) : m_nativeCursor(nativeCursor) { }
@@ -79,6 +82,9 @@ namespace WebCore {
 #elif PLATFORM(GTK)
     typedef GdkCursor* PlatformCursor;
     typedef GdkCursor* PlatformCursorHandle;
+#elif PLATFORM(EFL)
+    typedef const char* PlatformCursor;
+    typedef const char* PlatformCursorHandle;
 #elif PLATFORM(QT) && !defined(QT_NO_CURSOR)
     typedef QCursor PlatformCursor;
     typedef QCursor* PlatformCursorHandle;
@@ -99,7 +105,7 @@ namespace WebCore {
     class Cursor {
     public:
         Cursor()
-#if !PLATFORM(QT)
+#if !PLATFORM(QT) && !PLATFORM(EFL)
         : m_impl(0)
 #endif
         { }
diff --git a/src/3rdparty/webkit/WebCore/platform/DeprecatedPtrList.h b/src/3rdparty/webkit/WebCore/platform/DeprecatedPtrList.h
index 67161af129..47cd5383b8 100644
--- a/src/3rdparty/webkit/WebCore/platform/DeprecatedPtrList.h
+++ b/src/3rdparty/webkit/WebCore/platform/DeprecatedPtrList.h
@@ -27,12 +27,13 @@
 #define DeprecatedPtrList_h
 
 #include "DeprecatedPtrListImpl.h"
+#include <wtf/FastAllocBase.h>
 
 namespace WebCore {
 
 template <class T> class DeprecatedPtrListIterator;
 
-template <class T> class DeprecatedPtrList {
+template <class T> class DeprecatedPtrList : public FastAllocBase {
 public:
     DeprecatedPtrList() : impl(deleteFunc), del_item(false) { }
     ~DeprecatedPtrList() { impl.clear(del_item); }
diff --git a/src/3rdparty/webkit/WebCore/platform/DeprecatedPtrListImpl.cpp b/src/3rdparty/webkit/WebCore/platform/DeprecatedPtrListImpl.cpp
index 6d6112ebd8..96fd51383f 100644
--- a/src/3rdparty/webkit/WebCore/platform/DeprecatedPtrListImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/DeprecatedPtrListImpl.cpp
@@ -29,10 +29,11 @@
 #include <cstddef>
 #include <algorithm>
 #include <wtf/Assertions.h>
+#include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
-class DeprecatedListNode
+class DeprecatedListNode : public Noncopyable
 {
 public:
     DeprecatedListNode(void *d) : data(d), next(0), prev(0) { }
diff --git a/src/3rdparty/webkit/WebCore/platform/DragData.h b/src/3rdparty/webkit/WebCore/platform/DragData.h
index 462424b02d..9ee3ca2059 100644
--- a/src/3rdparty/webkit/WebCore/platform/DragData.h
+++ b/src/3rdparty/webkit/WebCore/platform/DragData.h
@@ -59,6 +59,8 @@ typedef void* DragDataRef;
 #elif PLATFORM(HAIKU)
 class BMessage;
 typedef class BMessage* DragDataRef;
+#elif PLATFORM(EFL)
+typedef void* DragDataRef;
 #endif
 
 
diff --git a/src/3rdparty/webkit/WebCore/platform/DragImage.h b/src/3rdparty/webkit/WebCore/platform/DragImage.h
index 91e8aa0bd2..aafc09aa1e 100644
--- a/src/3rdparty/webkit/WebCore/platform/DragImage.h
+++ b/src/3rdparty/webkit/WebCore/platform/DragImage.h
@@ -50,6 +50,8 @@ class wxDragImage;
 typedef struct _GdkPixbuf GdkPixbuf;
 #elif PLATFORM(HAIKU)
 class BBitmap;
+#elif PLATFORM(BREWMP)
+typedef struct IImage IImage;
 #endif
 
 //We need to #define YOffset as it needs to be shared with WebKit
@@ -76,6 +78,10 @@ namespace WebCore {
     typedef GdkPixbuf* DragImageRef;
 #elif PLATFORM(HAIKU)
     typedef BBitmap* DragImageRef;
+#elif PLATFORM(BREWMP)
+    typedef IImage* DragImageRef;
+#elif PLATFORM(EFL)
+    typedef void* DragImageRef;
 #endif
     
     IntSize dragImageSize(DragImageRef);
diff --git a/src/3rdparty/webkit/WebCore/platform/FileChooser.cpp b/src/3rdparty/webkit/WebCore/platform/FileChooser.cpp
index 739181d5da..dd4fc0d272 100644
--- a/src/3rdparty/webkit/WebCore/platform/FileChooser.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/FileChooser.cpp
@@ -37,16 +37,16 @@ FileChooserClient::~FileChooserClient()
 {
 }
 
-inline FileChooser::FileChooser(FileChooserClient* client, const String& filename)
+inline FileChooser::FileChooser(FileChooserClient* client, const Vector<String>& initialFilenames)
     : m_client(client)
-    , m_icon(chooseIcon(filename))
 {
-    m_filenames.append(filename);
+    m_filenames = initialFilenames;
+    loadIcon();
 }
 
-PassRefPtr<FileChooser> FileChooser::create(FileChooserClient* client, const String& filename)
+PassRefPtr<FileChooser> FileChooser::create(FileChooserClient* client, const Vector<String>& initialFilenames)
 {
-    return adoptRef(new FileChooser(client, filename));
+    return adoptRef(new FileChooser(client, initialFilenames));
 }
 
 FileChooser::~FileChooser()
@@ -61,13 +61,9 @@ void FileChooser::clear()
 
 void FileChooser::chooseFile(const String& filename)
 {
-    if (m_filenames.size() == 1 && m_filenames[0] == filename)
-        return;
-    m_filenames.clear();
-    m_filenames.append(filename);
-    m_icon = chooseIcon(filename);
-    if (m_client)
-        m_client->valueChanged();
+    Vector<String> filenames;
+    filenames.append(filename);
+    chooseFiles(filenames);
 }
 
 void FileChooser::chooseFiles(const Vector<String>& filenames)
@@ -75,23 +71,22 @@ void FileChooser::chooseFiles(const Vector<String>& filenames)
     if (m_filenames == filenames)
         return;
     m_filenames = filenames;
-    m_icon = chooseIcon(filenames);
+    loadIcon();
     if (m_client)
         m_client->valueChanged();
 }
 
-PassRefPtr<Icon> FileChooser::chooseIcon(const String& filename)
+void FileChooser::loadIcon()
 {
-    return Icon::createIconForFile(filename);
+    if (m_filenames.size() && m_client)
+        m_client->chooseIconForFiles(m_filenames);
 }
 
-PassRefPtr<Icon> FileChooser::chooseIcon(Vector<String> filenames)
+void FileChooser::iconLoaded(PassRefPtr<Icon> icon)
 {
-    if (filenames.isEmpty())
-        return 0;
-    if (filenames.size() == 1)
-        return Icon::createIconForFile(filenames[0]);
-    return Icon::createIconForFiles(filenames);
+    m_icon = icon;
+    if (m_icon && m_client)
+        m_client->repaint();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/FileChooser.h b/src/3rdparty/webkit/WebCore/platform/FileChooser.h
index 8192fe80fc..4028d41c1e 100644
--- a/src/3rdparty/webkit/WebCore/platform/FileChooser.h
+++ b/src/3rdparty/webkit/WebCore/platform/FileChooser.h
@@ -41,13 +41,16 @@ class Icon;
 class FileChooserClient {
 public:
     virtual void valueChanged() = 0;
+    virtual void repaint() = 0;
     virtual bool allowsMultipleFiles() = 0;
+    virtual String acceptTypes() = 0;
+    virtual void chooseIconForFiles(const Vector<String>&) = 0;
     virtual ~FileChooserClient();
 };
 
 class FileChooser : public RefCounted<FileChooser> {
 public:
-    static PassRefPtr<FileChooser> create(FileChooserClient*, const String& initialFilename);
+    static PassRefPtr<FileChooser> create(FileChooserClient*, const Vector<String>& initialFilenames);
     ~FileChooser();
 
     void disconnectClient() { m_client = 0; }
@@ -62,13 +65,16 @@ public:
 
     void chooseFile(const String& path);
     void chooseFiles(const Vector<String>& paths);
-    
+    // Called when FileChooserClient finishes to load an icon requested by iconForFiles().
+    void iconLoaded(PassRefPtr<Icon>);
+
     bool allowsMultipleFiles() const { return m_client ? m_client->allowsMultipleFiles() : false; }
+    // Acceptable MIME types.  It's an 'accept' attribute value of the corresponding INPUT element.
+    String acceptTypes() const { return m_client ? m_client->acceptTypes() : String(); }
 
 private:
-    FileChooser(FileChooserClient*, const String& initialfilename);
-    static PassRefPtr<Icon> chooseIcon(const String& filename);
-    static PassRefPtr<Icon> chooseIcon(Vector<String> filenames);
+    FileChooser(FileChooserClient*, const Vector<String>& initialFilenames);
+    void loadIcon();
 
     FileChooserClient* m_client;
     Vector<String> m_filenames;
diff --git a/src/3rdparty/webkit/WebCore/platform/FileSystem.h b/src/3rdparty/webkit/WebCore/platform/FileSystem.h
index 791198d076..856d5bbb15 100644
--- a/src/3rdparty/webkit/WebCore/platform/FileSystem.h
+++ b/src/3rdparty/webkit/WebCore/platform/FileSystem.h
@@ -39,21 +39,19 @@
 #if defined(Q_OS_WIN32)
 #include <windows.h>
 #endif
-#if defined(Q_WS_MAC)
-#include <CoreFoundation/CFBundle.h>
 #endif
+
+#if PLATFORM(CF) || (PLATFORM(QT) && defined(Q_WS_MAC))
+#include <CoreFoundation/CFBundle.h>
 #endif
 
+#include "PlatformString.h"
 #include <time.h>
-
-#include <wtf/Platform.h>
 #include <wtf/Vector.h>
 
-#include "PlatformString.h"
-
 typedef const struct __CFData* CFDataRef;
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 // These are to avoid including <winbase.h> in a header for Chromium
 typedef void *HANDLE;
 // Assuming STRICT
@@ -66,7 +64,7 @@ namespace WebCore {
 class CString;
 
 // PlatformModule
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 typedef HMODULE PlatformModule;
 #elif PLATFORM(QT)
 #if defined(Q_WS_MAC)
@@ -76,12 +74,14 @@ typedef QLibrary* PlatformModule;
 #endif // defined(Q_WS_MAC)
 #elif PLATFORM(GTK)
 typedef GModule* PlatformModule;
+#elif PLATFORM(CF)
+typedef CFBundleRef PlatformModule;
 #else
 typedef void* PlatformModule;
 #endif
 
 // PlatformModuleVersion
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 struct PlatformModuleVersion {
     unsigned leastSig;
     unsigned mostSig;
@@ -98,17 +98,6 @@ struct PlatformModuleVersion {
     {
     }
 
-    bool operator != (const PlatformModuleVersion& rhs) const
-    {
-        return mostSig != rhs.mostSig && leastSig != rhs.leastSig;
-    }
-
-
-    bool operator > (const PlatformModuleVersion& rhs) const
-    {
-        return mostSig > rhs.mostSig && leastSig > rhs.leastSig;
-    }
-
 };
 #else
 typedef unsigned PlatformModuleVersion;
@@ -118,7 +107,7 @@ typedef unsigned PlatformModuleVersion;
 #if PLATFORM(QT)
 typedef QFile* PlatformFileHandle;
 const PlatformFileHandle invalidPlatformFileHandle = 0;
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 typedef HANDLE PlatformFileHandle;
 // FIXME: -1 is INVALID_HANDLE_VALUE, defined in <winbase.h>. Chromium tries to
 // avoid using Windows headers in headers.  We'd rather move this into the .cpp.
@@ -170,6 +159,10 @@ String filenameForDisplay(const String&);
 String pathGetDisplayFileName(const String&);
 #endif
 
+#if PLATFORM(EFL)
+char *filenameFromString(const String&);
+#endif
+
 } // namespace WebCore
 
 #endif // FileSystem_h
diff --git a/src/3rdparty/webkit/WebCore/platform/FloatConversion.h b/src/3rdparty/webkit/WebCore/platform/FloatConversion.h
index 9b26597373..655ab448e9 100644
--- a/src/3rdparty/webkit/WebCore/platform/FloatConversion.h
+++ b/src/3rdparty/webkit/WebCore/platform/FloatConversion.h
@@ -29,7 +29,6 @@
 #ifndef FloatConversion_h
 #define FloatConversion_h
 
-#include <wtf/Platform.h>
 #if PLATFORM(CG)
 #include <CoreGraphics/CGBase.h>
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/GeolocationService.cpp b/src/3rdparty/webkit/WebCore/platform/GeolocationService.cpp
index e60ef0057e..467600681f 100644
--- a/src/3rdparty/webkit/WebCore/platform/GeolocationService.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/GeolocationService.cpp
@@ -25,16 +25,17 @@
 
 #include "config.h"
 #include "GeolocationService.h"
-#include "Geoposition.h"
+
 #include "GeolocationServiceMock.h"
+#include "Geoposition.h"
 #include "PositionError.h"
 
-#include <wtf/CurrentTime.h>
 #include <wtf/Assertions.h>
+#include <wtf/CurrentTime.h>
 
 namespace WebCore {
 
-#if !ENABLE(GEOLOCATION)
+#if !ENABLE(GEOLOCATION) || ENABLE(CLIENT_BASED_GEOLOCATION)
 static GeolocationService* createGeolocationServiceNull(GeolocationServiceClient*)
 {
     return 0;
@@ -48,6 +49,7 @@ GeolocationService* GeolocationService::create(GeolocationServiceClient* client)
     return (*s_factoryFunction)(client);
 }
 
+#if ENABLE(GEOLOCATION)
 void GeolocationService::useMock()
 {
     s_factoryFunction = &GeolocationServiceMock::create;
@@ -69,4 +71,6 @@ void GeolocationService::errorOccurred()
     m_geolocationServiceClient->geolocationServiceErrorOccurred(this);
 }
 
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/GeolocationService.h b/src/3rdparty/webkit/WebCore/platform/GeolocationService.h
index cebf313304..43904961de 100644
--- a/src/3rdparty/webkit/WebCore/platform/GeolocationService.h
+++ b/src/3rdparty/webkit/WebCore/platform/GeolocationService.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef GeolocationService_h
@@ -46,10 +46,10 @@ class GeolocationService : public Noncopyable {
 public:
     static GeolocationService* create(GeolocationServiceClient*);
     virtual ~GeolocationService() { }
-    
+
     virtual bool startUpdating(PositionOptions*) { return false; }
     virtual void stopUpdating() { }
-    
+
     virtual void suspend() { }
     virtual void resume() { }
 
@@ -63,6 +63,7 @@ public:
 
 protected:
     GeolocationService(GeolocationServiceClient*);
+    GeolocationServiceClient* geolocationServiceClient() const { return m_geolocationServiceClient; }
 
 private:
     GeolocationServiceClient* m_geolocationServiceClient;
diff --git a/src/3rdparty/webkit/WebCore/platform/HostWindow.h b/src/3rdparty/webkit/WebCore/platform/HostWindow.h
index 80f6bdc35b..dc681a1e37 100644
--- a/src/3rdparty/webkit/WebCore/platform/HostWindow.h
+++ b/src/3rdparty/webkit/WebCore/platform/HostWindow.h
@@ -35,14 +35,17 @@ class HostWindow : public Noncopyable {
 public:
     virtual ~HostWindow() { }
 
-    // The repaint method asks the host window to repaint a rect in the window's coordinate space.  The
-    // contentChanged boolean indicates whether or not the Web page content actually changed (or if a repaint
-    // of unchanged content is being requested).
-    virtual void repaint(const IntRect&, bool contentChanged, bool immediate = false, bool repaintContentOnly = false) = 0;
+    // Requests the host invalidate the window, not the contents.  If immediate is true do so synchronously, otherwise async.
+    virtual void invalidateWindow(const IntRect& updateRect, bool immediate) = 0;
+
+    // Requests the host invalidate the contents and the window.  If immediate is true do so synchronously, otherwise async.
+    virtual void invalidateContentsAndWindow(const IntRect& updateRect, bool immediate) = 0;
+
+    // Requests the host scroll backingstore by the specified delta, rect to scroll, and clip rect.
     virtual void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect) = 0;
 
-    // The paint method just causes a synchronous update of the window to happen for platforms that need it (Windows).
-    void paint() { repaint(IntRect(), false, true); }
+    // Requests the host invalidate the contents, not the window.  This is the slow path for scrolling.
+    virtual void invalidateContentsForSlowScroll(const IntRect& updateRect, bool immediate) = 0;
     
     // Methods for doing coordinate conversions to and from screen coordinates.
     virtual IntPoint screenToWindow(const IntPoint&) const = 0;
diff --git a/src/3rdparty/webkit/WebCore/platform/KURL.cpp b/src/3rdparty/webkit/WebCore/platform/KURL.cpp
index c5829d2352..40adfbca15 100644
--- a/src/3rdparty/webkit/WebCore/platform/KURL.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/KURL.cpp
@@ -30,14 +30,18 @@
 #include "KURL.h"
 
 #include "CString.h"
-#include "PlatformString.h"
+#include "StringHash.h"
 #include "TextEncoding.h"
+#include <wtf/HashMap.h>
 #include <wtf/StdLibExtras.h>
 
 #if USE(ICU_UNICODE)
 #include <unicode/uidna.h>
 #elif USE(QT4_UNICODE)
 #include <QUrl>
+#elif USE(GLIB_UNICODE)
+#include <glib.h>
+#include "GOwnPtr.h"
 #endif
 
 #include <stdio.h>
@@ -102,7 +106,7 @@ static const unsigned char characterClassTable[256] = {
     /* 42  * */ UserInfoChar,    /* 43  + */ SchemeChar | UserInfoChar,
     /* 44  , */ UserInfoChar,
     /* 45  - */ SchemeChar | UserInfoChar | HostnameChar,
-    /* 46  . */ SchemeChar | UserInfoChar | HostnameChar,
+    /* 46  . */ SchemeChar | UserInfoChar | HostnameChar | IPv6Char,
     /* 47  / */ PathSegmentEndChar,
     /* 48  0 */ SchemeChar | UserInfoChar | HostnameChar | IPv6Char, 
     /* 49  1 */ SchemeChar | UserInfoChar | HostnameChar | IPv6Char,    
@@ -214,6 +218,7 @@ static const unsigned char characterClassTable[256] = {
 static int copyPathRemovingDots(char* dst, const char* src, int srcStart, int srcEnd);
 static void encodeRelativeString(const String& rel, const TextEncoding&, CharBuffer& ouput);
 static String substituteBackslashes(const String&);
+static bool isValidProtocol(const String&);
 
 static inline bool isSchemeFirstChar(char c) { return characterClassTable[static_cast<unsigned char>(c)] & SchemeFirstChar; }
 static inline bool isSchemeFirstChar(UChar c) { return c <= 0xff && (characterClassTable[c] & SchemeFirstChar); }
@@ -417,9 +422,9 @@ void KURL::init(const KURL& base, const String& relative, const TextEncoding& en
 
         switch (str[0]) {
         case '\0':
-            // the reference must be empty - the RFC says this is a
-            // reference to the same document
+            // The reference is empty, so this is a reference to the same document with any fragment identifier removed.
             *this = base;
+            removeFragmentIdentifier();
             break;
         case '#': {
             // must be fragment-only reference
@@ -633,7 +638,7 @@ bool KURL::protocolIs(const char* protocol) const
 
     // JavaScript URLs are "valid" and should be executed even if KURL decides they are invalid.
     // The free function protocolIsJavaScript() should be used instead. 
-    ASSERT(strcmp(protocol, "javascript") != 0);
+    ASSERT(!equalIgnoringCase(protocol, String("javascript")));
 
     if (!m_isValid)
         return false;
@@ -659,17 +664,22 @@ String KURL::path() const
     return decodeURLEscapeSequences(m_string.substring(m_portEnd, m_pathEnd - m_portEnd)); 
 }
 
-void KURL::setProtocol(const String& s)
+bool KURL::setProtocol(const String& s)
 {
-    // FIXME: Non-ASCII characters must be encoded and escaped to match parse() expectations,
-    // and to avoid changing more than just the protocol.
+    // Firefox and IE remove everything after the first ':'.
+    int separatorPosition = s.find(':');
+    String newProtocol = s.substring(0, separatorPosition);
+
+    if (!isValidProtocol(newProtocol))
+        return false;
 
     if (!m_isValid) {
-        parse(s + ":" + m_string);
-        return;
+        parse(newProtocol + ":" + m_string);
+        return true;
     }
 
-    parse(s + m_string.substring(m_schemeEnd));
+    parse(newProtocol + m_string.substring(m_schemeEnd));
+    return true;
 }
 
 void KURL::setHost(const String& s)
@@ -685,18 +695,22 @@ void KURL::setHost(const String& s)
     parse(m_string.left(hostStart()) + (slashSlashNeeded ? "//" : "") + s + m_string.substring(m_hostEnd));
 }
 
+void KURL::removePort()
+{
+    if (m_hostEnd == m_portEnd)
+        return;
+    parse(m_string.left(m_hostEnd) + m_string.substring(m_portEnd));
+}
+
 void KURL::setPort(unsigned short i)
 {
     if (!m_isValid)
         return;
 
-    if (i) {
-        bool colonNeeded = m_portEnd == m_hostEnd;
-        int portStart = (colonNeeded ? m_hostEnd : m_hostEnd + 1);
+    bool colonNeeded = m_portEnd == m_hostEnd;
+    int portStart = (colonNeeded ? m_hostEnd : m_hostEnd + 1);
 
-        parse(m_string.left(portStart) + (colonNeeded ? ":" : "") + String::number(i) + m_string.substring(m_portEnd));
-    } else
-        parse(m_string.left(m_hostEnd) + m_string.substring(m_portEnd));
+    parse(m_string.left(portStart) + (colonNeeded ? ":" : "") + String::number(i) + m_string.substring(m_portEnd));
 }
 
 void KURL::setHostAndPort(const String& hostAndPort)
@@ -819,7 +833,7 @@ String KURL::prettyURL() const
             authority.append('@');
         }
         append(authority, host());
-        if (port() != 0) {
+        if (hasPort()) {
             authority.append(':');
             append(authority, String::number(port()));
         }
@@ -1400,6 +1414,19 @@ static void appendEncodedHostname(UCharBuffer& buffer, const UChar* str, unsigne
 #elif USE(QT4_UNICODE)
     QByteArray result = QUrl::toAce(String(str, strLen));
     buffer.append(result.constData(), result.length());
+#elif USE(GLIB_UNICODE)
+    GOwnPtr<gchar> utf8Hostname;
+    GOwnPtr<GError> utf8Err;
+    utf8Hostname.set(g_utf16_to_utf8(str, strLen, 0, 0, &utf8Err.outPtr()));
+    if (utf8Err)
+        return;
+
+    GOwnPtr<gchar> encodedHostname;
+    encodedHostname.set(g_hostname_to_ascii(utf8Hostname.get()));
+    if (!encodedHostname) 
+        return;
+
+    buffer.append(encodedHostname.get(), strlen(encodedHostname.get()));
 #endif
 }
 
@@ -1624,6 +1651,141 @@ bool protocolIsJavaScript(const String& url)
     return protocolIs(url, "javascript");
 }
 
+bool isValidProtocol(const String& protocol)
+{
+    // RFC3986: ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
+    if (protocol.isEmpty())
+        return false;
+    if (!isSchemeFirstChar(protocol[0]))
+        return false;
+    unsigned protocolLength = protocol.length();
+    for (unsigned i = 1; i < protocolLength; i++) {
+        if (!isSchemeChar(protocol[i]))
+            return false;
+    }
+    return true;
+}
+
+bool isDefaultPortForProtocol(unsigned short port, const String& protocol)
+{
+    if (protocol.isEmpty())
+        return false;
+
+    typedef HashMap<String, unsigned, CaseFoldingHash> DefaultPortsMap;
+    DEFINE_STATIC_LOCAL(DefaultPortsMap, defaultPorts, ());
+    if (defaultPorts.isEmpty()) {
+        defaultPorts.set("http", 80);
+        defaultPorts.set("https", 443);
+        defaultPorts.set("ftp", 21);
+        defaultPorts.set("ftps", 990);
+    }
+    return defaultPorts.get(protocol) == port;
+}
+
+bool portAllowed(const KURL& url)
+{
+    unsigned short port = url.port();
+
+    // Since most URLs don't have a port, return early for the "no port" case.
+    if (!port)
+        return true;
+
+    // This blocked port list matches the port blocking that Mozilla implements.
+    // See http://www.mozilla.org/projects/netlib/PortBanning.html for more information.
+    static const unsigned short blockedPortList[] = {
+        1,    // tcpmux
+        7,    // echo
+        9,    // discard
+        11,   // systat
+        13,   // daytime
+        15,   // netstat
+        17,   // qotd
+        19,   // chargen
+        20,   // FTP-data
+        21,   // FTP-control
+        22,   // SSH
+        23,   // telnet
+        25,   // SMTP
+        37,   // time
+        42,   // name
+        43,   // nicname
+        53,   // domain
+        77,   // priv-rjs
+        79,   // finger
+        87,   // ttylink
+        95,   // supdup
+        101,  // hostriame
+        102,  // iso-tsap
+        103,  // gppitnp
+        104,  // acr-nema
+        109,  // POP2
+        110,  // POP3
+        111,  // sunrpc
+        113,  // auth
+        115,  // SFTP
+        117,  // uucp-path
+        119,  // nntp
+        123,  // NTP
+        135,  // loc-srv / epmap
+        139,  // netbios
+        143,  // IMAP2
+        179,  // BGP
+        389,  // LDAP
+        465,  // SMTP+SSL
+        512,  // print / exec
+        513,  // login
+        514,  // shell
+        515,  // printer
+        526,  // tempo
+        530,  // courier
+        531,  // Chat
+        532,  // netnews
+        540,  // UUCP
+        556,  // remotefs
+        563,  // NNTP+SSL
+        587,  // ESMTP
+        601,  // syslog-conn
+        636,  // LDAP+SSL
+        993,  // IMAP+SSL
+        995,  // POP3+SSL
+        2049, // NFS
+        3659, // apple-sasl / PasswordServer [Apple addition]
+        4045, // lockd
+        6000, // X11
+        6665, // Alternate IRC [Apple addition]
+        6666, // Alternate IRC [Apple addition]
+        6667, // Standard IRC [Apple addition]
+        6668, // Alternate IRC [Apple addition]
+        6669, // Alternate IRC [Apple addition]
+
+    };
+    const unsigned short* const blockedPortListEnd = blockedPortList + sizeof(blockedPortList) / sizeof(blockedPortList[0]);
+
+#ifndef NDEBUG
+    // The port list must be sorted for binary_search to work.
+    static bool checkedPortList = false;
+    if (!checkedPortList) {
+        for (const unsigned short* p = blockedPortList; p != blockedPortListEnd - 1; ++p)
+            ASSERT(*p < *(p + 1));
+        checkedPortList = true;
+    }
+#endif
+
+    // If the port is not in the blocked port list, allow it.
+    if (!binary_search(blockedPortList, blockedPortListEnd, port))
+        return true;
+
+    // Allow ports 21 and 22 for FTP URLs, as Mozilla does.
+    if ((port == 21 || port == 22) && url.protocolIs("ftp"))
+        return true;
+
+    // Allow any port number in a file URL, since the port number is ignored.
+    if (url.protocolIs("file"))
+        return true;
+
+    return false;
+}
+
 String mimeTypeFromDataURL(const String& url)
 {
     ASSERT(protocolIs(url, "data"));
diff --git a/src/3rdparty/webkit/WebCore/platform/KURL.h b/src/3rdparty/webkit/WebCore/platform/KURL.h
index 73fadd112f..6cd8f96c84 100644
--- a/src/3rdparty/webkit/WebCore/platform/KURL.h
+++ b/src/3rdparty/webkit/WebCore/platform/KURL.h
@@ -50,6 +50,10 @@ QT_END_NAMESPACE
 #include "KURLGooglePrivate.h"
 #endif
 
+#if USE(JSC)
+#include <runtime/UString.h>
+#endif
+
 namespace WebCore {
 
 class TextEncoding;
@@ -78,6 +82,7 @@ public:
     KURL(const KURL& base, const String& relative);
     KURL(const KURL& base, const String& relative, const TextEncoding&);
 
+
 #if USE(GOOGLEURL)
     // For conversions for other structures that have already parsed and
     // canonicalized the URL. The input must be exactly what KURL would have
@@ -104,6 +109,12 @@ public:
     // non-hierarchical (like "javascript:") URLs will have no path.
     bool hasPath() const;
 
+    // Returns true if you can set the host and port for the URL.
+    // Non-hierarchical URLs don't have a host and port.
+    bool canSetHostOrPort() const { return isHierarchical(); }
+
+    bool canSetPathname() const { return isHierarchical(); }
+    
 #if USE(GOOGLEURL)
     const String& string() const { return m_url.string(); }
 #else
@@ -113,6 +124,7 @@ public:
     String protocol() const;
     String host() const;
     unsigned short port() const;
+    bool hasPort() const;
     String user() const;
     String pass() const;
     String path() const;
@@ -132,10 +144,10 @@ public:
     bool protocolInHTTPFamily() const;
     bool isLocalFile() const;
 
-    void setProtocol(const String&);
+    bool setProtocol(const String&);
     void setHost(const String&);
 
-    // Setting the port to 0 will clear any port from the URL.
+    void removePort();
     void setPort(unsigned short);
 
     // Input is like "foo.com" or "foo.com:8000".
@@ -255,6 +267,9 @@ const KURL& blankURL();
 bool protocolIs(const String& url, const char* protocol);
 bool protocolIsJavaScript(const String& url);
 
+bool isDefaultPortForProtocol(unsigned short port, const String& protocol);
+bool portAllowed(const KURL&); // Blacklist ports that should never be used for Web resources.
+
 String mimeTypeFromDataURL(const String& url);
 
 // Unescapes the given string using URL escaping rules, given an optional
@@ -317,6 +332,11 @@ inline bool KURL::isValid() const
     return m_isValid;
 }
 
+inline bool KURL::hasPort() const
+{
+    return m_hostEnd < m_portEnd;
+}
+
 inline bool KURL::protocolInHTTPFamily() const
 {
     return m_protocolInHTTPFamily;
diff --git a/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp b/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
index d0aae0cf5d..8be7009066 100644
--- a/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
@@ -38,16 +38,22 @@
 #include <stdio.h>
 #endif
 
+#include <algorithm>
+
 #include "CString.h"
+#include "StringHash.h"
 #include "NotImplemented.h"
 #include "TextEncoding.h"
+#include <wtf/HashMap.h>
 #include <wtf/Vector.h>
+#include <wtf/StdLibExtras.h>
 
 #include <googleurl/src/url_canon_internal.h>
 #include <googleurl/src/url_util.h>
 
 using WTF::isASCIILower;
 using WTF::toASCIILower;
+using std::binary_search;
 
 namespace WebCore {
 
@@ -116,6 +122,16 @@ static bool lowerCaseEqualsASCII(const char* begin, const char* end, const char*
     return begin == end && !*str;
 }
 
+static inline bool isSchemeFirstChar(char c)
+{
+    return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z');
+}
+
+static inline bool isSchemeChar(char c)
+{
+    return isSchemeFirstChar(c) || (c >= '0' && c <= '9') || c == '.' || c == '-' || c == '*';
+}
+
 
 // KURLGooglePrivate -----------------------------------------------------------
 
@@ -426,6 +442,11 @@ bool KURL::isValid() const
     return m_url.m_isValid;
 }
 
+bool KURL::hasPort() const
+{
+    return hostEnd() < pathStart();
+}
+
 bool KURL::protocolInHTTPFamily() const
 {
     return m_url.m_protocolInHTTPFamily;
@@ -537,7 +558,10 @@ String KURL::query() const
     // Bug: https://bugs.webkit.org/show_bug.cgi?id=21015 this function returns
     // an empty string when the query is empty rather than a null (not sure
     // which is right).
-    return String("", 0);
+    // Returns a null if the query is not specified, instead of empty.
+    if (m_url.m_parsed.query.is_valid())
+        return String("", 0);
+    return String();
 }
 
 String KURL::path() const
@@ -546,12 +570,35 @@ String KURL::path() const
     return m_url.componentString(m_url.m_parsed.path);
 }
 
-void KURL::setProtocol(const String& protocol)
+bool KURL::setProtocol(const String& protocol)
 {
+    // Firefox and IE remove everything after the first ':'.
+    int separatorPosition = protocol.find(':');
+    String newProtocol = protocol.substring(0, separatorPosition);
+
+    // If KURL is given an invalid scheme, it returns failure without modifying
+    // the URL at all. This is in contrast to most other setters which modify
+    // the URL and set "m_isValid."
+    url_canon::RawCanonOutputT<char> canonProtocol;
+    url_parse::Component protocolComponent;
+    if (!url_canon::CanonicalizeScheme(newProtocol.characters(),
+                                       url_parse::Component(0, newProtocol.length()),
+                                       &canonProtocol, &protocolComponent)
+        || !protocolComponent.is_nonempty())
+        return false;
+
     KURLGooglePrivate::Replacements replacements;
-    replacements.SetScheme(CharactersOrEmpty(protocol),
-                           url_parse::Component(0, protocol.length()));
+    replacements.SetScheme(CharactersOrEmpty(newProtocol),
+                           url_parse::Component(0, newProtocol.length()));
     m_url.replaceComponents(replacements);
+
+    // isValid could be false but we still return true here. This is because
+    // WebCore or JS scripts can build up a URL by setting individual
+    // components, and a JS exception is based on the return value of this
+    // function. We want to throw the exception and stop the script only when
+    // its trying to set a bad protocol, and not when it maybe just hasn't
+    // finished building up its final scheme.
+    return true;
 }
 
 void KURL::setHost(const String& host)
@@ -562,24 +609,36 @@ void KURL::setHost(const String& host)
     m_url.replaceComponents(replacements);
 }
 
-// This function is used only in the JSC build.
 void KURL::setHostAndPort(const String& s)
 {
-    String newhost = s.left(s.find(":"));
-    String newport = s.substring(s.find(":") + 1);
+    String host = s;
+    String port;
+    int hostEnd = s.find(":");
+    if (hostEnd != -1) {
+        host = s.left(hostEnd);
+        port = s.substring(hostEnd + 1);
+    }
 
     KURLGooglePrivate::Replacements replacements;
     // Host can't be removed, so we always set.
-    replacements.SetHost(CharactersOrEmpty(newhost),
-                         url_parse::Component(0, newhost.length()));
+    replacements.SetHost(CharactersOrEmpty(host),
+                         url_parse::Component(0, host.length()));
 
-    if (newport.isEmpty())  // Port may be removed, so we support clearing.
+    if (port.isEmpty())  // Port may be removed, so we support clearing.
         replacements.ClearPort();
     else
-        replacements.SetPort(CharactersOrEmpty(newport), url_parse::Component(0, newport.length()));
+        replacements.SetPort(CharactersOrEmpty(port), url_parse::Component(0, port.length()));
     m_url.replaceComponents(replacements);
 }
 
+void KURL::removePort()
+{
+    if (hasPort()) {
+        String urlWithoutPort = m_url.string().left(hostEnd()) + m_url.string().substring(pathStart());
+        m_url.setUtf8(urlWithoutPort.utf8());
+    }
+}
+
 void KURL::setPort(unsigned short i)
 {
     KURLGooglePrivate::Replacements replacements;
@@ -698,6 +757,130 @@ bool protocolIsJavaScript(const String& url)
     return protocolIs(url, "javascript");
 }
 
+// We copied the KURL version here on Dec 4, 2009 while doing a WebKit
+// merge.
+//
+// FIXME Somehow share this with KURL? Like we'd theoretically merge with
+// decodeURLEscapeSequences below?
+bool isDefaultPortForProtocol(unsigned short port, const String& protocol)
+{
+    if (protocol.isEmpty())
+        return false;
+
+    typedef HashMap<String, unsigned, CaseFoldingHash> DefaultPortsMap;
+    DEFINE_STATIC_LOCAL(DefaultPortsMap, defaultPorts, ());
+    if (defaultPorts.isEmpty()) {
+        defaultPorts.set("http", 80);
+        defaultPorts.set("https", 443);
+        defaultPorts.set("ftp", 21);
+        defaultPorts.set("ftps", 990);
+    }
+    return defaultPorts.get(protocol) == port;
+}
+
+// We copied the KURL version here on Dec 4, 2009 while doing a WebKit
+// merge.
+//
+// FIXME Somehow share this with KURL? Like we'd theoretically merge with
+// decodeURLEscapeSequences below?
+bool portAllowed(const KURL& url)
+{
+    unsigned short port = url.port();
+
+    // Since most URLs don't have a port, return early for the "no port" case.
+    if (!port)
+        return true;
+
+    // This blocked port list matches the port blocking that Mozilla implements.
+    // See http://www.mozilla.org/projects/netlib/PortBanning.html for more information.
+    static const unsigned short blockedPortList[] = {
+        1,    // tcpmux
+        7,    // echo
+        9,    // discard
+        11,   // systat
+        13,   // daytime
+        15,   // netstat
+        17,   // qotd
+        19,   // chargen
+        20,   // FTP-data
+        21,   // FTP-control
+        22,   // SSH
+        23,   // telnet
+        25,   // SMTP
+        37,   // time
+        42,   // name
+        43,   // nicname
+        53,   // domain
+        77,   // priv-rjs
+        79,   // finger
+        87,   // ttylink
+        95,   // supdup
+        101,  // hostriame
+        102,  // iso-tsap
+        103,  // gppitnp
+        104,  // acr-nema
+        109,  // POP2
+        110,  // POP3
+        111,  // sunrpc
+        113,  // auth
+        115,  // SFTP
+        117,  // uucp-path
+        119,  // nntp
+        123,  // NTP
+        135,  // loc-srv / epmap
+        139,  // netbios
+        143,  // IMAP2
+        179,  // BGP
+        389,  // LDAP
+        465,  // SMTP+SSL
+        512,  // print / exec
+        513,  // login
+        514,  // shell
+        515,  // printer
+        526,  // tempo
+        530,  // courier
+        531,  // Chat
+        532,  // netnews
+        540,  // UUCP
+        556,  // remotefs
+        563,  // NNTP+SSL
+        587,  // ESMTP
+        601,  // syslog-conn
+        636,  // LDAP+SSL
+        993,  // IMAP+SSL
+        995,  // POP3+SSL
+        2049, // NFS
+        3659, // apple-sasl / PasswordServer [Apple addition]
+        4045, // lockd
+        6000, // X11
+    };
+    const unsigned short* const blockedPortListEnd = blockedPortList + sizeof(blockedPortList) / sizeof(blockedPortList[0]);
+
+#ifndef NDEBUG
+    // The port list must be sorted for binary_search to work.
+    static bool checkedPortList = false;
+    if (!checkedPortList) {
+        for (const unsigned short* p = blockedPortList; p != blockedPortListEnd - 1; ++p)
+            ASSERT(*p < *(p + 1));
+        checkedPortList = true;
+    }
+#endif
+
+    // If the port is not in the blocked port list, allow it.
+    if (!binary_search(blockedPortList, blockedPortListEnd, port))
+        return true;
+
+    // Allow ports 21 and 22 for FTP URLs, as Mozilla does.
+    if ((port == 21 || port == 22) && url.protocolIs("ftp"))
+        return true;
+
+    // Allow any port number in a file URL, since the port number is ignored.
+    if (url.protocolIs("file"))
+        return true;
+
+    return false;
+}
+
 // We copied the KURL version here on Sept 12, 2008 while doing a WebKit
 // merge.
 // 
@@ -854,7 +1037,6 @@ bool KURL::isHierarchical() const
         return false;
     return url_util::IsStandard(
         &m_url.utf8String().data()[m_url.m_parsed.scheme.begin],
-        m_url.utf8String().length(),
         m_url.m_parsed.scheme);
 }
 
@@ -933,12 +1115,10 @@ bool protocolIs(const String& url, const char* protocol)
 {
     // Do the comparison without making a new string object.
     assertProtocolIsGood(protocol);
-    for (int i = 0; ; ++i) {
-        if (!protocol[i])
-            return url[i] == ':';
-        if (toASCIILower(url[i]) != protocol[i])
-            return false;
-    }
+
+    // Check the scheme like GURL does.
+    return url_util::FindAndCompareScheme(url.characters(), url.length(), 
+        protocol, NULL); 
 }
 
 inline bool KURL::protocolIs(const String& string, const char* protocol)
diff --git a/src/3rdparty/webkit/WebCore/platform/KeyboardCodes.h b/src/3rdparty/webkit/WebCore/platform/KeyboardCodes.h
index 48582a87e0..4f42a91407 100644
--- a/src/3rdparty/webkit/WebCore/platform/KeyboardCodes.h
+++ b/src/3rdparty/webkit/WebCore/platform/KeyboardCodes.h
@@ -28,12 +28,10 @@
 #ifndef KeyboardCodes_h
 #define KeyboardCodes_h
 
-#include <wtf/Platform.h>
-
 // FIXME: We should get rid of these Chromium-related ifdefs.
 #if PLATFORM(CHROMIUM)
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #include "KeyboardCodesWin.h"
 #else
 #include "KeyboardCodesPosix.h"
@@ -43,7 +41,7 @@
 
 namespace WebCore {
 
-#if !PLATFORM(WIN_OS)
+#if !OS(WINDOWS)
 // VK_LBUTTON (01) Left mouse button
 // VK_RBUTTON (02) Right mouse button
 // VK_CANCEL (03) Control-break processing
@@ -160,7 +158,7 @@ const int VK_DELETE = 0x2E;
 // VK_HELP (2F) HELP key
 const int VK_HELP = 0x2F;
 
-#endif // PLATFORM(WIN_OS)
+#endif // OS(WINDOWS)
 
 // (30) 0 key
 const int VK_0 = 0x30;
@@ -271,7 +269,7 @@ const int VK_Y = 0x59;
 // (5A) Z key
 const int VK_Z = 0x5A;
 
-#if !PLATFORM(WIN_OS)
+#if !OS(WINDOWS)
 
 // VK_LWIN (5B) Left Windows key (Microsoft Natural keyboard)
 const int VK_LWIN = 0x5B;
@@ -483,9 +481,9 @@ const int VK_MEDIA_LAUNCH_APP1 = 0xB6;
 // VK_LAUNCH_APP2 (B7) Windows 2000/XP: Start Application 2 key
 const int VK_MEDIA_LAUNCH_APP2 = 0xB7;
 
-#endif // !PLATFORM(WIN_OS)
+#endif // !OS(WINDOWS)
 
-#if !PLATFORM(WIN_OS) || PLATFORM(WINCE)
+#if !OS(WINDOWS) || OS(WINCE)
 
 // VK_OEM_1 (BA) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the ';:' key
 const int VK_OEM_1 = 0xBA;
@@ -523,9 +521,9 @@ const int VK_OEM_7 = 0xDE;
 // VK_OEM_8 (DF) Used for miscellaneous characters; it can vary by keyboard.
 const int VK_OEM_8 = 0xDF;
 
-#endif // !PLATFORM(WIN_OS) || PLATFORM(WINCE)
+#endif // !OS(WINDOWS) || OS(WINCE)
 
-#if !PLATFORM(WIN_OS)
+#if !OS(WINDOWS)
 
 // VK_OEM_102 (E2) Windows 2000/XP: Either the angle bracket key or the backslash key on the RT 102-key keyboard
 const int VK_OEM_102 = 0xE2;
@@ -565,7 +563,7 @@ const int VK_OEM_CLEAR = 0xFE;
 
 const int VK_UNKNOWN = 0;
 
-#endif // PLATFORM(WIN_OS)
+#endif // OS(WINDOWS)
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/Length.h b/src/3rdparty/webkit/WebCore/platform/Length.h
index b4497b65f7..4f36577173 100644
--- a/src/3rdparty/webkit/WebCore/platform/Length.h
+++ b/src/3rdparty/webkit/WebCore/platform/Length.h
@@ -22,6 +22,7 @@
 #define Length_h
 
 #include <wtf/Assertions.h>
+#include <wtf/FastAllocBase.h>
 #include <wtf/MathExtras.h>
 
 namespace WebCore {
@@ -33,7 +34,7 @@ const int percentScaleFactor = 128;
 
 enum LengthType { Auto, Relative, Percent, Fixed, Static, Intrinsic, MinIntrinsic };
 
-struct Length {
+struct Length : FastAllocBase {
     Length()
         : m_value(0)
     {
diff --git a/src/3rdparty/webkit/WebCore/platform/LinkHash.cpp b/src/3rdparty/webkit/WebCore/platform/LinkHash.cpp
index 878933af00..c399aa249f 100644
--- a/src/3rdparty/webkit/WebCore/platform/LinkHash.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/LinkHash.cpp
@@ -81,7 +81,7 @@ static inline bool containsColonSlashSlash(const UChar* characters, unsigned len
 
 static inline void cleanPath(Vector<UChar, 512>& path)
 {
-    // FIXME: Shold not do this in the query or anchor part.
+    // FIXME: Should not do this in the query or anchor part.
     int pos;
     while ((pos = findSlashDotDotSlash(path.data(), path.size())) != -1) {
         int prev = reverseFind(path.data(), path.size(), '/', pos - 1);
@@ -92,7 +92,7 @@ static inline void cleanPath(Vector<UChar, 512>& path)
             path.remove(prev, pos - prev + 3);
     }
 
-    // FIXME: Shold not do this in the query part.
+    // FIXME: Should not do this in the query part.
     // Set refPos to -2 to mean "I haven't looked for the anchor yet".
     // We don't want to waste a function call on the search for the the anchor
     // in the vast majority of cases where there is no "//" in the path.
@@ -110,7 +110,7 @@ static inline void cleanPath(Vector<UChar, 512>& path)
             pos += 2;
     }
 
-    // FIXME: Shold not do this in the query or anchor part.
+    // FIXME: Should not do this in the query or anchor part.
     while ((pos = findSlashDotSlash(path.data(), path.size())) != -1)
         path.remove(pos, 2);
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/LocalizedStrings.h b/src/3rdparty/webkit/WebCore/platform/LocalizedStrings.h
index 0fa9f71f22..924ca22584 100644
--- a/src/3rdparty/webkit/WebCore/platform/LocalizedStrings.h
+++ b/src/3rdparty/webkit/WebCore/platform/LocalizedStrings.h
@@ -124,8 +124,11 @@ namespace WebCore {
     String AXTextFieldActionVerb();
     String AXCheckedCheckBoxActionVerb();
     String AXUncheckedCheckBoxActionVerb();
+    String AXMenuListActionVerb();
+    String AXMenuListPopupActionVerb();
     String AXLinkActionVerb();
 
+    String missingPluginText();
     String multipleFileUploadText(unsigned numberOfFiles);
     String unknownFileSizeText();
 
@@ -141,6 +144,15 @@ namespace WebCore {
     String localizedMediaControlElementString(const String&);
     String localizedMediaControlElementHelpText(const String&);
     String localizedMediaTimeDescription(float);
+
+    String validationMessageValueMissingText();
+    String validationMessageTypeMismatchText();
+    String validationMessagePatternMismatchText();
+    String validationMessageTooLongText();
+    String validationMessageRangeUnderflowText();
+    String validationMessageRangeOverflowText();
+    String validationMessageStepMismatchText();
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/Logging.cpp b/src/3rdparty/webkit/WebCore/platform/Logging.cpp
index f3c6f1ca3b..92e11e3a5d 100644
--- a/src/3rdparty/webkit/WebCore/platform/Logging.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/Logging.cpp
@@ -38,7 +38,7 @@ WTFLogChannel LogPopupBlocking =     { 0x00000040, "WebCoreLogLevel", WTFLogChan
 
 WTFLogChannel LogEvents =            { 0x00000080, "WebCoreLogLevel", WTFLogChannelOff };
 WTFLogChannel LogEditing =           { 0x00000100, "WebCoreLogLevel", WTFLogChannelOff };
-WTFLogChannel LogTextConversion =    { 0x00000200, "WebCoreLogLevel", WTFLogChannelOff };
+WTFLogChannel LogLiveConnect =       { 0x00000200, "WebCoreLogLevel", WTFLogChannelOff };
 
 WTFLogChannel LogIconDatabase =      { 0x00000400, "WebCoreLogLevel", WTFLogChannelOff };
 WTFLogChannel LogSQLDatabase =       { 0x00000800, "WebCoreLogLevel", WTFLogChannelOff };
@@ -59,6 +59,7 @@ WTFLogChannel LogMedia =             { 0x01000000, "WebCoreLogLevel", WTFLogChan
 
 WTFLogChannel LogPlugins =           { 0x02000000, "WebCoreLogLevel", WTFLogChannelOff };
 WTFLogChannel LogArchives =          { 0x04000000, "WebCoreLogLevel", WTFLogChannelOff };
+WTFLogChannel LogProgress =          { 0x08000000, "WebCoreLogLevel", WTFLogChannelOff };
 
 WTFLogChannel* getChannelFromName(const String& channelName)
 {
@@ -110,6 +111,9 @@ WTFLogChannel* getChannelFromName(const String& channelName)
     if (equalIgnoringCase(channelName, String("PopupBlocking")))
         return &LogPopupBlocking;
 
+    if (equalIgnoringCase(channelName, String("Progress")))
+        return &LogProgress;
+        
     if (equalIgnoringCase(channelName, String("SpellingAndGrammar")))
         return &LogSpellingAndGrammar;
 
@@ -119,8 +123,8 @@ WTFLogChannel* getChannelFromName(const String& channelName)
     if (equalIgnoringCase(channelName, String("StorageAPI")))
         return &LogStorageAPI;
 
-    if (equalIgnoringCase(channelName, String("TextConversion")))
-        return &LogTextConversion;
+    if (equalIgnoringCase(channelName, String("LiveConnect")))
+        return &LogLiveConnect;
 
     if (equalIgnoringCase(channelName, String("Threading")))
         return &LogThreading;
diff --git a/src/3rdparty/webkit/WebCore/platform/Logging.h b/src/3rdparty/webkit/WebCore/platform/Logging.h
index 5c958feb2c..c0c41c15cc 100644
--- a/src/3rdparty/webkit/WebCore/platform/Logging.h
+++ b/src/3rdparty/webkit/WebCore/platform/Logging.h
@@ -42,7 +42,7 @@ namespace WebCore {
     extern WTFLogChannel LogPopupBlocking;
     extern WTFLogChannel LogEvents;
     extern WTFLogChannel LogEditing;
-    extern WTFLogChannel LogTextConversion;
+    extern WTFLogChannel LogLiveConnect;
     extern WTFLogChannel LogIconDatabase;
     extern WTFLogChannel LogSQLDatabase;
     extern WTFLogChannel LogSpellingAndGrammar;
@@ -57,6 +57,7 @@ namespace WebCore {
     extern WTFLogChannel LogMedia;
     extern WTFLogChannel LogPlugins;
     extern WTFLogChannel LogArchives;
+    extern WTFLogChannel LogProgress;
 
     void InitializeLoggingChannelsIfNecessary();
     WTFLogChannel* getChannelFromName(const String& channelName);
diff --git a/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp b/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp
index 758863cc1a..dce8f6a0a5 100644
--- a/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp
@@ -233,8 +233,8 @@ static void initializeMediaTypeMaps()
     static const TypeExtensionPair pairs[] = {
     
         // Ogg
-        { "application/ogg", "ogg" },
         { "application/ogg", "ogx" },
+        { "audio/ogg", "ogg" },
         { "audio/ogg", "oga" },
         { "video/ogg", "ogv" },
 
diff --git a/src/3rdparty/webkit/WebCore/platform/NotImplemented.h b/src/3rdparty/webkit/WebCore/platform/NotImplemented.h
index 47748e7bde..e9758b0c48 100644
--- a/src/3rdparty/webkit/WebCore/platform/NotImplemented.h
+++ b/src/3rdparty/webkit/WebCore/platform/NotImplemented.h
@@ -29,7 +29,7 @@
 #include "Logging.h"
 #include <wtf/Assertions.h>
 
-#if PLATFORM(GTK)
+#if PLATFORM(GTK) || PLATFORM(EFL)
     #define supressNotImplementedWarning() getenv("DISABLE_NI_WARNING")
 #elif PLATFORM(QT)
     #include <QByteArray>
diff --git a/src/3rdparty/webkit/WebCore/platform/Pasteboard.h b/src/3rdparty/webkit/WebCore/platform/Pasteboard.h
index 188b962d14..7a47f00432 100644
--- a/src/3rdparty/webkit/WebCore/platform/Pasteboard.h
+++ b/src/3rdparty/webkit/WebCore/platform/Pasteboard.h
@@ -82,6 +82,7 @@ public:
     //Helper functions to allow Clipboard to share code
     static void writeSelection(NSPasteboard* pasteboard, Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame);
     static void writeURL(NSPasteboard* pasteboard, NSArray* types, const KURL& url, const String& titleStr, Frame* frame);
+    static void writePlainText(NSPasteboard* pasteboard, const String& text);
 #endif
     
     static Pasteboard* generalPasteboard();
diff --git a/src/3rdparty/webkit/WebCore/platform/PlatformKeyboardEvent.h b/src/3rdparty/webkit/WebCore/platform/PlatformKeyboardEvent.h
index 4a0673123d..d11d456558 100644
--- a/src/3rdparty/webkit/WebCore/platform/PlatformKeyboardEvent.h
+++ b/src/3rdparty/webkit/WebCore/platform/PlatformKeyboardEvent.h
@@ -28,7 +28,6 @@
 #define PlatformKeyboardEvent_h
 
 #include "PlatformString.h"
-#include <wtf/Platform.h>
 
 #if PLATFORM(MAC)
 #include <wtf/RetainPtr.h>
@@ -63,9 +62,15 @@ class wxKeyEvent;
 class BMessage;
 #endif
 
+#if PLATFORM(BREWMP)
+typedef unsigned short    uint16;
+typedef unsigned long int uint32;
+#define AEEEvent uint16
+#endif
+
 namespace WebCore {
 
-    class PlatformKeyboardEvent {
+    class PlatformKeyboardEvent : public FastAllocBase {
     public:
         enum Type {
             // KeyDown is sent by platforms such as Mac OS X, gtk and Qt, and has information about both physical pressed key, and its translation.
@@ -88,6 +93,28 @@ namespace WebCore {
             ShiftKey = 1 << 3,
         };
 
+        PlatformKeyboardEvent()
+            : m_type(KeyDown)
+            , m_autoRepeat(false)
+            , m_windowsVirtualKeyCode(0)
+            , m_nativeVirtualKeyCode(0)
+            , m_isKeypad(false)
+            , m_shiftKey(false)
+            , m_ctrlKey(false)
+            , m_altKey(false)
+            , m_metaKey(false)
+#if PLATFORM(WIN) || PLATFORM(CHROMIUM)
+            , m_isSystemKey(false)
+#endif
+#if PLATFORM(GTK)
+            , m_gdkEventKey(0)
+#endif
+#if PLATFORM(QT)
+            , m_qtEvent(0)
+#endif
+        {
+        }
+        
         Type type() const { return m_type; }
         void disambiguateKeyDownEvent(Type, bool backwardCompatibilityMode = false); // Only used on platforms that need it, i.e. those that generate KeyDown events.
 
@@ -128,6 +155,7 @@ namespace WebCore {
         }
 
         static bool currentCapsLockState();
+        static void getCurrentModifierState(bool& shiftKey, bool& ctrlKey, bool& altKey, bool& metaKey);
 
 #if PLATFORM(MAC)
         PlatformKeyboardEvent(NSEvent*);
@@ -156,6 +184,10 @@ namespace WebCore {
         PlatformKeyboardEvent(BMessage*);
 #endif
 
+#if PLATFORM(BREWMP)
+        PlatformKeyboardEvent(AEEEvent, uint16, uint32, Type);
+#endif
+
 #if PLATFORM(WIN) || PLATFORM(CHROMIUM)
         bool isSystemKey() const { return m_isSystemKey; }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/PlatformMouseEvent.h b/src/3rdparty/webkit/WebCore/platform/PlatformMouseEvent.h
index 99acc63cba..d8f63180e2 100644
--- a/src/3rdparty/webkit/WebCore/platform/PlatformMouseEvent.h
+++ b/src/3rdparty/webkit/WebCore/platform/PlatformMouseEvent.h
@@ -55,6 +55,12 @@ class wxMouseEvent;
 class BMessage;
 #endif
 
+#if PLATFORM(BREWMP)
+typedef unsigned short    uint16;
+typedef unsigned long int uint32;
+#define AEEEvent uint16
+#endif
+
 namespace WebCore {
     
     // These button numbers match the ones used in the DOM API, 0 through 2, except for NoButton which isn't specified.
@@ -114,8 +120,13 @@ namespace WebCore {
         PlatformMouseEvent(GdkEventMotion*);
 #endif
 
-#if PLATFORM(MAC) && defined(__OBJC__)
+#if PLATFORM(MAC)
+#if defined(__OBJC__)
         PlatformMouseEvent(NSEvent *, NSView *windowView);
+#endif
+        PlatformMouseEvent(int x, int y, int globalX, int globalY, MouseButton button, MouseEventType eventType,
+                           int clickCount, bool shiftKey, bool ctrlKey, bool altKey, bool metaKey, double timestamp,
+                           unsigned modifierFlags, int eventNumber);
         int eventNumber() const { return m_eventNumber; }
 #endif
 
@@ -138,6 +149,10 @@ namespace WebCore {
         PlatformMouseEvent(const BMessage*);
 #endif
 
+#if PLATFORM(BREWMP)
+        PlatformMouseEvent(AEEEvent, uint16 wParam, uint32 dwParam);
+#endif
+
     protected:
         IntPoint m_position;
         IntPoint m_globalPosition;
diff --git a/src/3rdparty/webkit/WebCore/platform/PlatformTouchEvent.h b/src/3rdparty/webkit/WebCore/platform/PlatformTouchEvent.h
new file mode 100644
index 0000000000..aab6249e88
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/PlatformTouchEvent.h
@@ -0,0 +1,83 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef PlatformTouchEvent_h
+#define PlatformTouchEvent_h
+
+#include "PlatformTouchPoint.h"
+#include <wtf/Vector.h>
+
+#if ENABLE(TOUCH_EVENTS)
+
+#if PLATFORM(QT)
+QT_BEGIN_NAMESPACE
+class QTouchEvent;
+QT_END_NAMESPACE
+#endif
+
+#if PLATFORM(ANDROID)
+#include "IntPoint.h"
+#endif
+
+namespace WebCore {
+
+enum TouchEventType {
+    TouchStart
+    , TouchMove
+    , TouchEnd
+    , TouchCancel
+};
+
+class PlatformTouchEvent {
+public:
+    PlatformTouchEvent()
+        : m_type(TouchStart)
+        , m_ctrlKey(false)
+        , m_altKey(false)
+        , m_shiftKey(false)
+        , m_metaKey(false)
+    {}
+#if PLATFORM(QT)
+    PlatformTouchEvent(QTouchEvent*);
+#elif PLATFORM(ANDROID)
+    PlatformTouchEvent(const IntPoint& windowPos, TouchEventType, PlatformTouchPoint::State, int metaState);
+#endif
+
+    TouchEventType type() const { return m_type; }
+    const Vector<PlatformTouchPoint>& touchPoints() const { return m_touchPoints; }
+
+    bool ctrlKey() const { return m_ctrlKey; }
+    bool altKey() const { return m_altKey; }
+    bool shiftKey() const { return m_shiftKey; }
+    bool metaKey() const { return m_metaKey; }
+
+protected:
+    TouchEventType m_type;
+    Vector<PlatformTouchPoint> m_touchPoints;
+    bool m_ctrlKey;
+    bool m_altKey;
+    bool m_shiftKey;
+    bool m_metaKey;
+};
+
+}
+
+#endif // ENABLE(TOUCH_EVENTS)
+
+#endif // PlatformTouchEvent_h
diff --git a/src/3rdparty/webkit/WebCore/platform/PlatformTouchPoint.h b/src/3rdparty/webkit/WebCore/platform/PlatformTouchPoint.h
new file mode 100644
index 0000000000..4a667a0f44
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/PlatformTouchPoint.h
@@ -0,0 +1,68 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef PlatformTouchPoint_h
+#define PlatformTouchPoint_h
+
+#include "IntPoint.h"
+#include <wtf/Vector.h>
+
+#if ENABLE(TOUCH_EVENTS)
+
+#if PLATFORM(QT)
+#include <QTouchEvent>
+#endif
+
+namespace WebCore {
+
+class PlatformTouchEvent;
+
+class PlatformTouchPoint {
+public:
+    enum State {
+        TouchReleased,
+        TouchPressed,
+        TouchMoved,
+        TouchStationary,
+        TouchCancelled
+    };
+
+#if PLATFORM(QT)
+    PlatformTouchPoint(const QTouchEvent::TouchPoint&);
+#elif PLATFORM(ANDROID)
+    PlatformTouchPoint(const IntPoint& windowPos, State);
+#endif
+
+    unsigned id() const { return m_id; }
+    State state() const { return m_state; }
+    IntPoint screenPos() const { return m_screenPos; }
+    IntPoint pos() const { return m_pos; }
+    
+protected:
+    unsigned m_id;
+    State m_state;
+    IntPoint m_screenPos;
+    IntPoint m_pos;
+};
+
+}
+
+#endif // ENABLE(TOUCH_EVENTS)
+
+#endif // PlatformTouchPoint_h
diff --git a/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h b/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
index 9a4a0cbff7..b8e0bb499e 100644
--- a/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
@@ -68,6 +68,20 @@ namespace WebCore {
     
     class PlatformWheelEvent {
     public:
+        PlatformWheelEvent()
+            : m_deltaX(0)
+            , m_deltaY(0)
+            , m_wheelTicksX(0)
+            , m_wheelTicksY(0)
+            , m_granularity(ScrollByPixelWheelEvent)
+            , m_isAccepted(false)
+            , m_shiftKey(false)
+            , m_ctrlKey(false)
+            , m_altKey(false)
+            , m_metaKey(false)
+        {
+        }
+
         const IntPoint& pos() const { return m_position; } // PlatformWindow coordinates.
         const IntPoint& globalPos() const { return m_globalPosition; } // Screen coordinates.
 
diff --git a/src/3rdparty/webkit/WebCore/platform/PopupMenu.h b/src/3rdparty/webkit/WebCore/platform/PopupMenu.h
index c150a94932..4df0dcdc06 100644
--- a/src/3rdparty/webkit/WebCore/platform/PopupMenu.h
+++ b/src/3rdparty/webkit/WebCore/platform/PopupMenu.h
@@ -42,15 +42,13 @@ typedef struct HDC__* HDC;
 typedef struct HBITMAP__* HBITMAP;
 #elif PLATFORM(QT)
 namespace WebCore {
-    class QWebPopup;
+class QtAbstractWebPopup;
 }
-QT_BEGIN_NAMESPACE
-class QGraphicsProxyWidget;
-QT_END_NAMESPACE
 #elif PLATFORM(GTK)
 typedef struct _GtkMenu GtkMenu;
 typedef struct _GtkMenuItem GtkMenuItem;
 typedef struct _GtkWidget GtkWidget;
+#include "GRefPtrGtk.h"
 #include <wtf/HashMap.h>
 #include <glib.h>
 #elif PLATFORM(WX)
@@ -63,7 +61,9 @@ class wxMenu;
 #elif PLATFORM(CHROMIUM)
 #include "PopupMenuPrivate.h"
 #elif PLATFORM(HAIKU)
-class BMenu;
+namespace WebCore {
+class PopupMenuHaiku;
+}
 #endif
 
 namespace WebCore {
@@ -147,10 +147,7 @@ private:
 
     RetainPtr<NSPopUpButtonCell> m_popup;
 #elif PLATFORM(QT)
-    void clear();
-    void populate(const IntRect&);
-    QWebPopup* m_popup;
-    QGraphicsProxyWidget* m_proxy;
+    QtAbstractWebPopup* m_popup;
 #elif PLATFORM(WIN)
     // ScrollBarClient
     virtual void valueChanged(Scrollbar*);
@@ -179,7 +176,7 @@ private:
     bool m_showPopup;
 #elif PLATFORM(GTK)
     IntPoint m_menuPosition;
-    GtkMenu* m_popup;
+    GRefPtr<GtkMenu> m_popup;
     HashMap<GtkWidget*, int> m_indexMap;
     static void menuItemActivated(GtkMenuItem* item, PopupMenu*);
     static void menuUnmapped(GtkWidget*, PopupMenu*);
@@ -191,7 +188,7 @@ private:
 #elif PLATFORM(CHROMIUM)
     PopupMenuPrivate p;
 #elif PLATFORM(HAIKU)
-    BMenu* m_menu;
+    PopupMenuHaiku* m_menu;
 #endif
 
 };
diff --git a/src/3rdparty/webkit/WebCore/platform/PopupMenuClient.h b/src/3rdparty/webkit/WebCore/platform/PopupMenuClient.h
index 2614fe20ea..2f3f892544 100644
--- a/src/3rdparty/webkit/WebCore/platform/PopupMenuClient.h
+++ b/src/3rdparty/webkit/WebCore/platform/PopupMenuClient.h
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
@@ -40,6 +41,7 @@ public:
 
     virtual String itemText(unsigned listIndex) const = 0;
     virtual String itemToolTip(unsigned listIndex) const = 0;
+    virtual String itemAccessibilityText(unsigned listIndex) const = 0;
     virtual bool itemIsEnabled(unsigned listIndex) const = 0;
     virtual PopupMenuStyle itemStyle(unsigned listIndex) const = 0;
     virtual PopupMenuStyle menuStyle() const = 0;
@@ -63,6 +65,15 @@ public:
     virtual PassRefPtr<Scrollbar> createScrollbar(ScrollbarClient*, ScrollbarOrientation, ScrollbarControlSize) = 0;
 };
 
+#if ENABLE(NO_LISTBOX_RENDERING)
+class ListPopupMenuClient : public PopupMenuClient {
+public:
+    virtual void listBoxSelectItem(int listIndex, bool allowMultiplySelections, bool shift, bool fireOnChangeNow = true) = 0;
+    virtual bool multiple() = 0;
+};
+#endif
+
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/PurgeableBuffer.h b/src/3rdparty/webkit/WebCore/platform/PurgeableBuffer.h
index c487eb994b..94e58da9f9 100644
--- a/src/3rdparty/webkit/WebCore/platform/PurgeableBuffer.h
+++ b/src/3rdparty/webkit/WebCore/platform/PurgeableBuffer.h
@@ -62,7 +62,7 @@ namespace WebCore {
         mutable State m_state;
     };
 
-#if !PLATFORM(DARWIN) || defined(BUILDING_ON_TIGER) || PLATFORM(QT) || PLATFORM(GTK)
+#if !OS(DARWIN) || defined(BUILDING_ON_TIGER) || PLATFORM(QT) || PLATFORM(GTK)
     inline PurgeableBuffer* PurgeableBuffer::create(const char*, size_t) { return 0; }
     inline PurgeableBuffer::~PurgeableBuffer() { }
     inline const char* PurgeableBuffer::data() const { return 0; }
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp b/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
index 9e15c430f7..fdd9749a88 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
@@ -34,6 +34,7 @@
 #include "ScrollbarTheme.h"
 #include <wtf/StdLibExtras.h>
 
+
 using std::max;
 
 namespace WebCore {
@@ -49,6 +50,7 @@ ScrollView::ScrollView()
     , m_updateScrollbarsPass(0)
     , m_drawPanScrollIcon(false)
     , m_useFixedLayout(false)
+    , m_paintsEntireContents(false)
 {
     platformInit();
 }
@@ -79,6 +81,9 @@ void ScrollView::removeChild(Widget* child)
 
 void ScrollView::setHasHorizontalScrollbar(bool hasBar)
 {
+    if (hasBar && avoidScrollbarCreation())
+        return;
+
     if (hasBar && !m_horizontalScrollbar) {
         m_horizontalScrollbar = createScrollbar(HorizontalScrollbar);
         addChild(m_horizontalScrollbar.get());
@@ -91,6 +96,9 @@ void ScrollView::setHasHorizontalScrollbar(bool hasBar)
 
 void ScrollView::setHasVerticalScrollbar(bool hasBar)
 {
+    if (hasBar && avoidScrollbarCreation())
+        return;
+
     if (hasBar && !m_verticalScrollbar) {
         m_verticalScrollbar = createScrollbar(VerticalScrollbar);
         addChild(m_verticalScrollbar.get());
@@ -168,6 +176,11 @@ bool ScrollView::canBlitOnScroll() const
     return m_canBlitOnScroll;
 }
 
+void ScrollView::setPaintsEntireContents(bool paintsEntireContents)
+{
+    m_paintsEntireContents = paintsEntireContents;
+}
+
 #if !PLATFORM(GTK)
 IntRect ScrollView::visibleContentRect(bool includeScrollbars) const
 {
@@ -419,9 +432,7 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
     if (m_horizontalScrollbar) {
         int clientWidth = visibleWidth();
         m_horizontalScrollbar->setEnabled(contentsWidth() > clientWidth);
-        int pageStep = (clientWidth - cAmountToKeepWhenPaging);
-        if (pageStep < 0)
-            pageStep = clientWidth;
+        int pageStep = max(max<int>(clientWidth * Scrollbar::minFractionToStepWhenPaging(), clientWidth - Scrollbar::maxOverlapBetweenPages()), 1);
         IntRect oldRect(m_horizontalScrollbar->frameRect());
         IntRect hBarRect = IntRect(0,
                                    height() - m_horizontalScrollbar->height(),
@@ -433,7 +444,7 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
 
         if (m_scrollbarsSuppressed)
             m_horizontalScrollbar->setSuppressInvalidation(true);
-        m_horizontalScrollbar->setSteps(cScrollbarPixelsPerLineStep, pageStep);
+        m_horizontalScrollbar->setSteps(Scrollbar::pixelsPerLineStep(), pageStep);
         m_horizontalScrollbar->setProportion(clientWidth, contentsWidth());
         m_horizontalScrollbar->setValue(scroll.width());
         if (m_scrollbarsSuppressed)
@@ -443,9 +454,7 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
     if (m_verticalScrollbar) {
         int clientHeight = visibleHeight();
         m_verticalScrollbar->setEnabled(contentsHeight() > clientHeight);
-        int pageStep = (clientHeight - cAmountToKeepWhenPaging);
-        if (pageStep < 0)
-            pageStep = clientHeight;
+        int pageStep = max(max<int>(clientHeight * Scrollbar::minFractionToStepWhenPaging(), clientHeight - Scrollbar::maxOverlapBetweenPages()), 1);
         IntRect oldRect(m_verticalScrollbar->frameRect());
         IntRect vBarRect = IntRect(width() - m_verticalScrollbar->width(), 
                                    0,
@@ -457,7 +466,7 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
 
         if (m_scrollbarsSuppressed)
             m_verticalScrollbar->setSuppressInvalidation(true);
-        m_verticalScrollbar->setSteps(cScrollbarPixelsPerLineStep, pageStep);
+        m_verticalScrollbar->setSteps(Scrollbar::pixelsPerLineStep(), pageStep);
         m_verticalScrollbar->setProportion(clientHeight, contentsHeight());
         m_verticalScrollbar->setValue(scroll.height());
         if (m_scrollbarsSuppressed)
@@ -497,36 +506,37 @@ void ScrollView::scrollContents(const IntSize& scrollDelta)
     updateRect.intersect(scrollViewRect);
 
     // Invalidate the window (not the backing store).
-    hostWindow()->repaint(updateRect, false);
+    hostWindow()->invalidateWindow(updateRect, false /*immediate*/);
 
     if (m_drawPanScrollIcon) {
         int panIconDirtySquareSizeLength = 2 * (panIconSizeLength + max(abs(scrollDelta.width()), abs(scrollDelta.height()))); // We only want to repaint what's necessary
         IntPoint panIconDirtySquareLocation = IntPoint(m_panScrollIconPoint.x() - (panIconDirtySquareSizeLength / 2), m_panScrollIconPoint.y() - (panIconDirtySquareSizeLength / 2));
         IntRect panScrollIconDirtyRect = IntRect(panIconDirtySquareLocation , IntSize(panIconDirtySquareSizeLength, panIconDirtySquareSizeLength));
         panScrollIconDirtyRect.intersect(clipRect);
-        hostWindow()->repaint(panScrollIconDirtyRect, true);
+        hostWindow()->invalidateContentsAndWindow(panScrollIconDirtyRect, false /*immediate*/);
     }
 
     if (canBlitOnScroll()) { // The main frame can just blit the WebView window
-       // FIXME: Find a way to blit subframes without blitting overlapping content
-       scrollContentsFastPath(-scrollDelta, scrollViewRect, clipRect);
+        // FIXME: Find a way to scroll subframes with this faster path
+        if (!scrollContentsFastPath(-scrollDelta, scrollViewRect, clipRect))
+            hostWindow()->invalidateContentsForSlowScroll(updateRect, false);
     } else { 
        // We need to go ahead and repaint the entire backing store.  Do it now before moving the
        // windowed plugins.
-       hostWindow()->repaint(updateRect, true, false, true); // Invalidate the backing store and repaint it synchronously
+       hostWindow()->invalidateContentsForSlowScroll(updateRect, false);
     }
 
     // This call will move children with native widgets (plugins) and invalidate them as well.
     frameRectsChanged();
 
-    // Now update the window (which should do nothing but a blit of the backing store's updateRect and so should
-    // be very fast).
-    hostWindow()->paint();
+    // Now blit the backingstore into the window which should be very fast.
+    hostWindow()->invalidateWindow(IntRect(), true);
 }
 
-void ScrollView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect)
+bool ScrollView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect)
 {
     hostWindow()->scroll(scrollDelta, rectToScroll, clipRect);
+    return true;
 }
 
 IntPoint ScrollView::windowToContents(const IntPoint& windowPoint) const
@@ -664,7 +674,7 @@ void ScrollView::wheelEvent(PlatformWheelEvent& e)
         if (e.granularity() == ScrollByPageWheelEvent) {
             ASSERT(deltaX == 0);
             bool negative = deltaY < 0;
-            deltaY = max(0, visibleHeight() - cAmountToKeepWhenPaging);
+            deltaY = max(max<int>(visibleHeight() * Scrollbar::minFractionToStepWhenPaging(), visibleHeight() - Scrollbar::maxOverlapBetweenPages()), 1);
             if (negative)
                 deltaY = -deltaY;
         }
@@ -704,18 +714,19 @@ void ScrollView::frameRectsChanged()
 
 void ScrollView::repaintContentRectangle(const IntRect& rect, bool now)
 {
-    IntRect visibleContent = visibleContentRect();
-    visibleContent.intersect(rect);
-    if (visibleContent.isEmpty())
+    IntRect paintRect = rect;
+    if (!paintsEntireContents())
+        paintRect.intersect(visibleContentRect());
+    if (paintRect.isEmpty())
         return;
 
     if (platformWidget()) {
-        platformRepaintContentRectangle(visibleContent, now);
+        platformRepaintContentRectangle(paintRect, now);
         return;
     }
 
     if (hostWindow())
-        hostWindow()->repaint(contentsToWindow(visibleContent), true, now);
+        hostWindow()->invalidateContentsAndWindow(contentsToWindow(paintRect), now /*immediate*/);
 }
 
 IntRect ScrollView::scrollCornerRect() const
@@ -761,7 +772,7 @@ void ScrollView::paintScrollbars(GraphicsContext* context, const IntRect& rect)
 void ScrollView::paintPanScrollIcon(GraphicsContext* context)
 {
     DEFINE_STATIC_LOCAL(Image*, panScrollIcon, (Image::loadPlatformResource("panIcon").releaseRef()));
-    context->drawImage(panScrollIcon, m_panScrollIconPoint);
+    context->drawImage(panScrollIcon, DeviceColorSpace, m_panScrollIconPoint);
 }
 
 void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
@@ -933,7 +944,7 @@ void ScrollView::addPanScrollIcon(const IntPoint& iconPosition)
         return;
     m_drawPanScrollIcon = true;    
     m_panScrollIconPoint = IntPoint(iconPosition.x() - panIconSizeLength / 2 , iconPosition.y() - panIconSizeLength / 2) ;
-    hostWindow()->repaint(IntRect(m_panScrollIconPoint, IntSize(panIconSizeLength,panIconSizeLength)), true, true);    
+    hostWindow()->invalidateContentsAndWindow(IntRect(m_panScrollIconPoint, IntSize(panIconSizeLength, panIconSizeLength)), true /*immediate*/);
 }
 
 void ScrollView::removePanScrollIcon()
@@ -941,7 +952,7 @@ void ScrollView::removePanScrollIcon()
     if (!hostWindow())
         return;
     m_drawPanScrollIcon = false; 
-    hostWindow()->repaint(IntRect(m_panScrollIconPoint, IntSize(panIconSizeLength, panIconSizeLength)), true, true);
+    hostWindow()->invalidateContentsAndWindow(IntRect(m_panScrollIconPoint, IntSize(panIconSizeLength, panIconSizeLength)), true /*immediate*/);
 }
 
 #if !PLATFORM(WX) && !PLATFORM(GTK) && !PLATFORM(QT)
@@ -970,7 +981,7 @@ void ScrollView::platformRemoveChild(Widget*)
 
 #if !PLATFORM(MAC)
 
-void ScrollView::platformSetScrollbarsSuppressed(bool repaintOnUnsuppress)
+void ScrollView::platformSetScrollbarsSuppressed(bool)
 {
 }
 
@@ -1030,7 +1041,7 @@ bool ScrollView::platformScroll(ScrollDirection, ScrollGranularity)
     return true;
 }
 
-void ScrollView::platformRepaintContentRectangle(const IntRect&, bool now)
+void ScrollView::platformRepaintContentRectangle(const IntRect&, bool /*now*/)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollView.h b/src/3rdparty/webkit/WebCore/platform/ScrollView.h
index 7060d07027..c356a60ef7 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollView.h
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollView.h
@@ -89,9 +89,16 @@ public:
     void scrollbarModes(ScrollbarMode& horizontalMode, ScrollbarMode& verticalMode) const;
     ScrollbarMode horizontalScrollbarMode() const { ScrollbarMode horizontal, vertical; scrollbarModes(horizontal, vertical); return horizontal; }
     ScrollbarMode verticalScrollbarMode() const { ScrollbarMode horizontal, vertical; scrollbarModes(horizontal, vertical); return vertical; }
-    void setCanHaveScrollbars(bool flag);
+    virtual void setCanHaveScrollbars(bool);
     bool canHaveScrollbars() const { return horizontalScrollbarMode() != ScrollbarAlwaysOff || verticalScrollbarMode() != ScrollbarAlwaysOff; }
 
+    virtual bool avoidScrollbarCreation() { return false; }
+
+    // By default you only receive paint events for the area that is visible. In the case of using a
+    // tiled backing store, this method can be set, so that the view paints the entire contents.
+    bool paintsEntireContents() const { return m_paintsEntireContents; }
+    void setPaintsEntireContents(bool);
+
     // Overridden by FrameView to create custom CSS scrollbars if applicable.
     virtual PassRefPtr<Scrollbar> createScrollbar(ScrollbarOrientation);
 
@@ -246,7 +253,7 @@ protected:
     virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
 
     // Scroll the content by blitting the pixels
-    virtual void scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
+    virtual bool scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
     
 private:
     RefPtr<Scrollbar> m_horizontalScrollbar;
@@ -275,6 +282,8 @@ private:
     bool m_drawPanScrollIcon;
     bool m_useFixedLayout;
 
+    bool m_paintsEntireContents;
+
     void init();
     void destroy();
 
@@ -310,7 +319,7 @@ private:
 
 #if PLATFORM(GTK)
 public:
-    void setGtkAdjustments(GtkAdjustment* hadj, GtkAdjustment* vadj);
+    void setGtkAdjustments(GtkAdjustment* hadj, GtkAdjustment* vadj, bool resetValues = true);
     GtkAdjustment* m_horizontalAdjustment;
     GtkAdjustment* m_verticalAdjustment;
     void setScrollOffset(const IntSize& offset) { m_scrollOffset = offset; }
diff --git a/src/3rdparty/webkit/WebCore/platform/Scrollbar.cpp b/src/3rdparty/webkit/WebCore/platform/Scrollbar.cpp
index 4eb2c4a13c..1b4f100c32 100644
--- a/src/3rdparty/webkit/WebCore/platform/Scrollbar.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/Scrollbar.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "Scrollbar.h"
 
+#include "AccessibilityScrollbar.h"
+#include "AXObjectCache.h"
 #include "EventHandler.h"
 #include "Frame.h"
 #include "FrameView.h"
@@ -36,8 +38,7 @@
 
 #include <algorithm>
 
-using std::max;
-using std::min;
+using namespace std;
 
 namespace WebCore {
 
@@ -48,6 +49,12 @@ PassRefPtr<Scrollbar> Scrollbar::createNativeScrollbar(ScrollbarClient* client,
 }
 #endif
 
+int Scrollbar::maxOverlapBetweenPages()
+{
+    static int maxOverlapBetweenPages = ScrollbarTheme::nativeTheme()->maxOverlapBetweenPages();
+    return maxOverlapBetweenPages;
+}
+
 Scrollbar::Scrollbar(ScrollbarClient* client, ScrollbarOrientation orientation, ScrollbarControlSize controlSize,
                      ScrollbarTheme* theme)
     : m_client(client)
@@ -117,6 +124,18 @@ void Scrollbar::setSteps(int lineStep, int pageStep, int pixelsPerStep)
 
 bool Scrollbar::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
 {
+#if HAVE(ACCESSIBILITY)
+    if (AXObjectCache::accessibilityEnabled()) {
+        if (parent() && parent()->isFrameView()) {
+            Document* document = static_cast<FrameView*>(parent())->frame()->document();
+            AXObjectCache* cache = document->axObjectCache();
+            AccessibilityScrollbar* axObject = static_cast<AccessibilityScrollbar*>(cache->getOrCreate(ScrollBarRole));
+            axObject->setScrollbar(this);
+            cache->postNotification(axObject, document, AXObjectCache::AXValueChanged, true);
+        }
+    }
+#endif
+
     float step = 0;
     if ((direction == ScrollUp && m_orientation == VerticalScrollbar) || (direction == ScrollLeft && m_orientation == HorizontalScrollbar))
         step = -1;
diff --git a/src/3rdparty/webkit/WebCore/platform/Scrollbar.h b/src/3rdparty/webkit/WebCore/platform/Scrollbar.h
index 67496f2388..87310c3a5b 100644
--- a/src/3rdparty/webkit/WebCore/platform/Scrollbar.h
+++ b/src/3rdparty/webkit/WebCore/platform/Scrollbar.h
@@ -40,20 +40,17 @@ class ScrollbarClient;
 class ScrollbarTheme;
 class PlatformMouseEvent;
 
-// These match the numbers we use over in WebKit (WebFrameView.m).
-const int cScrollbarPixelsPerLineStep = 40;
-const int cAmountToKeepWhenPaging = 40;
-
 class Scrollbar : public Widget {
-protected:
-    Scrollbar(ScrollbarClient*, ScrollbarOrientation, ScrollbarControlSize, ScrollbarTheme* = 0);
-
 public:
     virtual ~Scrollbar();
 
     // Must be implemented by platforms that can't simply use the Scrollbar base class.  Right now the only platform that is not using the base class is GTK.
     static PassRefPtr<Scrollbar> createNativeScrollbar(ScrollbarClient* client, ScrollbarOrientation orientation, ScrollbarControlSize size);
-    
+
+    static int pixelsPerLineStep() { return 40; }
+    static float minFractionToStepWhenPaging() { return 0.875f; }
+    static int maxOverlapBetweenPages();
+
     void setClient(ScrollbarClient* client) { m_client = client; }
     ScrollbarClient* client() const { return m_client; }
 
@@ -131,6 +128,8 @@ private:
     virtual bool isScrollbar() const { return true; }
 
 protected:
+    Scrollbar(ScrollbarClient*, ScrollbarOrientation, ScrollbarControlSize, ScrollbarTheme* = 0);
+
     virtual void updateThumbPosition();
     virtual void updateThumbProportion();
 
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollbarTheme.h b/src/3rdparty/webkit/WebCore/platform/ScrollbarTheme.h
index 9327dc6620..c5c20947e7 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollbarTheme.h
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollbarTheme.h
@@ -36,7 +36,7 @@ class PlatformMouseEvent;
 class Scrollbar;
 class ScrollView;
 
-class ScrollbarTheme {
+class ScrollbarTheme : public Noncopyable {
 public:
     virtual ~ScrollbarTheme() {};
 
@@ -73,7 +73,7 @@ public:
 
     virtual void invalidatePart(Scrollbar*, ScrollbarPart) {}
 
-    virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect) { context->fillRect(cornerRect, Color::white); }
+    virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect) { context->fillRect(cornerRect, Color::white, DeviceColorSpace); }
 
     virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&) { return false; }
     virtual bool shouldSnapBackToDragOrigin(Scrollbar*, const PlatformMouseEvent&) { return false; }
@@ -81,7 +81,9 @@ public:
     virtual int thumbLength(Scrollbar*) { return 0; } // The length of the thumb along the axis of the scrollbar.
     virtual int trackPosition(Scrollbar*) { return 0; } // The position of the track relative to the scrollbar.
     virtual int trackLength(Scrollbar*) { return 0; } // The length of the track along the axis of the scrollbar.
-    
+
+    virtual int maxOverlapBetweenPages() { return std::numeric_limits<int>::max(); }
+
     virtual double initialAutoscrollTimerDelay() { return 0.25; }
     virtual double autoscrollTimerDelay() { return 0.05; }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollbarThemeComposite.cpp b/src/3rdparty/webkit/WebCore/platform/ScrollbarThemeComposite.cpp
index ab5e16b6d2..d28e1c312b 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollbarThemeComposite.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollbarThemeComposite.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "ScrollbarThemeComposite.h"
 
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "Frame.h"
 #include "FrameView.h"
@@ -297,7 +298,7 @@ void ScrollbarThemeComposite::paintScrollCorner(ScrollView* view, GraphicsContex
     Page* page = frameView->frame() ? frameView->frame()->page() : 0;
     if (page && page->settings()->shouldPaintCustomScrollbars()) {
         if (!page->chrome()->client()->paintCustomScrollCorner(context, cornerRect))
-            context->fillRect(cornerRect, Color::white);
+            context->fillRect(cornerRect, Color::white, DeviceColorSpace);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/page/win/PageWin.cpp b/src/3rdparty/webkit/WebCore/platform/SecureTextInput.cpp
index 5d7450cc2d..bebb37eaee 100644
--- a/src/3rdparty/webkit/WebCore/page/win/PageWin.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/SecureTextInput.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,43 +20,53 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
-#include "Page.h"
+#include "SecureTextInput.h"
 
-#include "Frame.h"
-#include "FrameLoaderClient.h"
-#include "FrameView.h"
-#include "FloatRect.h"
-#include "PluginView.h"
-#include <windows.h>
+#if USE(CARBON_SECURE_INPUT_MODE)
+#import <Carbon/Carbon.h>
+#endif
 
 namespace WebCore {
 
-HINSTANCE Page::s_instanceHandle = 0;
+#if USE(CARBON_SECURE_INPUT_MODE)
 
-void Page::setCanStartPlugins(bool canStartPlugins)
+#ifdef BUILDING_ON_TIGER
+const short enableRomanKeyboardsOnly = -23;
+#endif
+
+void enableSecureTextInput()
 {
-    if (m_canStartPlugins == canStartPlugins)
+    if (IsSecureEventInputEnabled())
         return;
+    EnableSecureEventInput();
+#ifdef BUILDING_ON_TIGER
+    KeyScript(enableRomanKeyboardsOnly);
+#else
+    // WebKit substitutes nil for input context when in password field, which corresponds to null TSMDocument. So, there is
+    // no need to call TSMGetActiveDocument(), which may return an incorrect result when selection hasn't been yet updated
+    // after focusing a node.
+    CFArrayRef inputSources = TISCreateASCIICapableInputSourceList();
+    TSMSetDocumentProperty(0, kTSMDocumentEnabledInputSourcesPropertyTag, sizeof(CFArrayRef), &inputSources);
+    CFRelease(inputSources);
+#endif
+}
 
-    m_canStartPlugins = canStartPlugins;
-
-    if (!m_canStartPlugins || m_unstartedPlugins.isEmpty())
+void disableSecureTextInput()
+{
+    if (!IsSecureEventInputEnabled())
         return;
-
-    Vector<PluginView*> unstartedPlugins;
-    copyToVector(m_unstartedPlugins, unstartedPlugins);
-    m_unstartedPlugins.clear();
-
-    for (size_t i = 0; i < unstartedPlugins.size(); ++i) {
-        if (unstartedPlugins[i]->start())
-            continue;
-        unstartedPlugins[i]->parentFrame()->loader()->client()->dispatchDidFailToStartPlugin(unstartedPlugins[i]);
-    }
+    DisableSecureEventInput();
+#ifdef BUILDING_ON_TIGER
+    KeyScript(smKeyEnableKybds);
+#else
+    TSMRemoveDocumentProperty(0, kTSMDocumentEnabledInputSourcesPropertyTag);
+#endif
 }
 
-} // namespace WebCore
+#endif // USE(CARBON_SECURE_INPUT_MODE)
 
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/SecureTextInput.h b/src/3rdparty/webkit/WebCore/platform/SecureTextInput.h
new file mode 100644
index 0000000000..c55981e48f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/SecureTextInput.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SecureTextInput_h
+#define SecureTextInput_h
+
+#include <wtf/Platform.h>
+
+namespace WebCore {
+
+// Once enableSecureTextInput is called, secure text input mode is set until
+// disableSecureTextInput has been called.
+void enableSecureTextInput();
+void disableSecureTextInput();
+
+#if !USE(CARBON_SECURE_INPUT_MODE)
+inline void enableSecureTextInput() { }
+inline void disableSecureTextInput() { }
+#endif
+
+} // namespace WebCore
+
+#endif // SecureTextInput_h
diff --git a/src/3rdparty/webkit/WebCore/platform/SharedBuffer.cpp b/src/3rdparty/webkit/WebCore/platform/SharedBuffer.cpp
index 4a0d0f38f8..4a46c2c1ab 100644
--- a/src/3rdparty/webkit/WebCore/platform/SharedBuffer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/SharedBuffer.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,30 +29,60 @@
 
 #include "PurgeableBuffer.h"
 
+using namespace std;
+
 namespace WebCore {
 
+static const unsigned segmentSize = 0x1000;
+static const unsigned segmentPositionMask = 0x0FFF;
+
+static inline unsigned segmentIndex(unsigned position)
+{
+    return position / segmentSize;
+}
+
+static inline unsigned offsetInSegment(unsigned position)
+{
+    return position & segmentPositionMask;
+}
+
+static inline char* allocateSegment()
+{
+    return static_cast<char*>(fastMalloc(segmentSize));
+}
+
+static inline void freeSegment(char* p)
+{
+    fastFree(p);
+}
+
 SharedBuffer::SharedBuffer()
+    : m_size(0)
 {
 }
 
 SharedBuffer::SharedBuffer(const char* data, int size)
+    : m_size(0)
 {
-    m_buffer.append(data, size);
+    append(data, size);
 }
 
 SharedBuffer::SharedBuffer(const unsigned char* data, int size)
+    : m_size(0)
 {
-    m_buffer.append(data, size);
+    append(reinterpret_cast<const char*>(data), size);
 }
     
 SharedBuffer::~SharedBuffer()
 {
+    clear();
 }
 
 PassRefPtr<SharedBuffer> SharedBuffer::adoptVector(Vector<char>& vector)
 {
     RefPtr<SharedBuffer> buffer = create();
     buffer->m_buffer.swap(vector);
+    buffer->m_size = buffer->m_buffer.size();
     return buffer.release();
 }
 
@@ -71,7 +102,7 @@ unsigned SharedBuffer::size() const
     if (m_purgeableBuffer)
         return m_purgeableBuffer->size();
     
-    return m_buffer.size();
+    return m_size;
 }
 
 const char* SharedBuffer::data() const
@@ -82,29 +113,75 @@ const char* SharedBuffer::data() const
     if (m_purgeableBuffer)
         return m_purgeableBuffer->data();
     
-    return m_buffer.data();
+    return buffer().data();
 }
 
-void SharedBuffer::append(const char* data, int len)
+void SharedBuffer::append(const char* data, unsigned length)
 {
     ASSERT(!m_purgeableBuffer);
 
     maybeTransferPlatformData();
     
-    m_buffer.append(data, len);
+    unsigned positionInSegment = offsetInSegment(m_size - m_buffer.size());
+    m_size += length;
+
+    if (m_size <= segmentSize) {
+        // No need to use segments for small resource data
+        m_buffer.append(data, length);
+        return;
+    }
+
+    char* segment;
+    if (!positionInSegment) {
+        segment = allocateSegment();
+        m_segments.append(segment);
+    } else
+        segment = m_segments.last() + positionInSegment;
+
+    unsigned segmentFreeSpace = segmentSize - positionInSegment;
+    unsigned bytesToCopy = min(length, segmentFreeSpace);
+
+    for (;;) {
+        memcpy(segment, data, bytesToCopy);
+        if (static_cast<unsigned>(length) == bytesToCopy)
+            break;
+
+        length -= bytesToCopy;
+        data += bytesToCopy;
+        segment = allocateSegment();
+        m_segments.append(segment);
+        bytesToCopy = min(length, segmentSize);
+    }
 }
 
 void SharedBuffer::clear()
 {
     clearPlatformData();
     
+    for (unsigned i = 0; i < m_segments.size(); ++i)
+        freeSegment(m_segments[i]);
+
+    m_segments.clear();
+    m_size = 0;
+
     m_buffer.clear();
     m_purgeableBuffer.clear();
 }
 
 PassRefPtr<SharedBuffer> SharedBuffer::copy() const
 {
-    return SharedBuffer::create(data(), size());
+    RefPtr<SharedBuffer> clone(adoptRef(new SharedBuffer));
+    if (m_purgeableBuffer || hasPlatformData()) {
+        clone->append(data(), size());
+        return clone;
+    }
+
+    clone->m_size = m_size;
+    clone->m_buffer.reserveCapacity(m_size);
+    clone->m_buffer.append(m_buffer.data(), m_buffer.size());
+    for (unsigned i = 0; i < m_segments.size(); ++i)
+        clone->m_buffer.append(m_segments[i], segmentSize);
+    return clone;
 }
 
 PurgeableBuffer* SharedBuffer::releasePurgeableBuffer()
@@ -113,6 +190,54 @@ PurgeableBuffer* SharedBuffer::releasePurgeableBuffer()
     return m_purgeableBuffer.release(); 
 }
 
+const Vector<char>& SharedBuffer::buffer() const
+{
+    unsigned bufferSize = m_buffer.size();
+    if (m_size > bufferSize) {
+        m_buffer.resize(m_size);
+        char* destination = m_buffer.data() + bufferSize;
+        unsigned bytesLeft = m_size - bufferSize;
+        for (unsigned i = 0; i < m_segments.size(); ++i) {
+            unsigned bytesToCopy = min(bytesLeft, segmentSize);
+            memcpy(destination, m_segments[i], bytesToCopy);
+            destination += bytesToCopy;
+            bytesLeft -= bytesToCopy;
+            freeSegment(m_segments[i]);
+        }
+        m_segments.clear();
+    }
+    return m_buffer;
+}
+
+unsigned SharedBuffer::getSomeData(const char*& someData, unsigned position) const
+{
+    if (hasPlatformData() || m_purgeableBuffer) {
+        someData = data() + position;
+        return size() - position;
+    }
+
+    if (position >= m_size) {
+        someData = 0;
+        return 0;
+    }
+
+    unsigned consecutiveSize = m_buffer.size();
+    if (position < consecutiveSize) {
+        someData = m_buffer.data() + position;
+        return consecutiveSize - position;
+    }
+ 
+    position -= consecutiveSize;
+    unsigned segmentedSize = m_size - consecutiveSize;
+    unsigned segments = m_segments.size();
+    unsigned segment = segmentIndex(position);
+    ASSERT(segment < segments);
+
+    unsigned positionInSegment = offsetInSegment(position);
+    someData = m_segments[segment] + positionInSegment;
+    return segment == segments - 1 ? segmentedSize - position : segmentSize - positionInSegment;
+}
+
 #if !PLATFORM(CF)
 
 inline void SharedBuffer::clearPlatformData()
diff --git a/src/3rdparty/webkit/WebCore/platform/SharedBuffer.h b/src/3rdparty/webkit/WebCore/platform/SharedBuffer.h
index 3404a0c5ae..a5566f2dd5 100644
--- a/src/3rdparty/webkit/WebCore/platform/SharedBuffer.h
+++ b/src/3rdparty/webkit/WebCore/platform/SharedBuffer.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -73,13 +74,21 @@ public:
     static PassRefPtr<SharedBuffer> wrapCFData(CFDataRef);
 #endif
 
+    // Calling this function will force internal segmented buffers
+    // to be merged into a flat buffer. Use getSomeData() whenever possible
+    // for better performance.
     const char* data() const;
+
     unsigned size() const;
-    const Vector<char> &buffer() { return m_buffer; }
 
-    bool isEmpty() const { return size() == 0; }
+    // Calling this function will force internal segmented buffers
+    // to be merged into a flat buffer. Use getSomeData() whenever possible
+    // for better performance.
+    const Vector<char>& buffer() const;
+
+    bool isEmpty() const { return !size(); }
 
-    void append(const char*, int);
+    void append(const char*, unsigned);
     void clear();
     const char* platformData() const;
     unsigned platformDataSize() const;
@@ -90,7 +99,21 @@ public:
 
     // Ensure this buffer has no other clients before calling this.
     PurgeableBuffer* releasePurgeableBuffer();
-    
+
+    // Return the number of consecutive bytes after "position". "data"
+    // points to the first byte.
+    // Return 0 when no more data left.
+    // When extracting all data with getSomeData(), the caller should
+    // repeat calling it until it returns 0.
+    // Usage:
+    //      const char* segment;
+    //      unsigned pos = 0;
+    //      while (unsigned length = sharedBuffer->getSomeData(segment, pos)) {
+    //          // Use the data. for example: decoder->decode(segment, length);
+    //          pos += length;
+    //      }
+    unsigned getSomeData(const char*& data, unsigned position = 0) const;
+
 private:
     SharedBuffer();
     SharedBuffer(const char*, int);
@@ -100,7 +123,9 @@ private:
     void maybeTransferPlatformData();
     bool hasPlatformData() const;
     
-    Vector<char> m_buffer;
+    unsigned m_size;
+    mutable Vector<char> m_buffer;
+    mutable Vector<char*> m_segments;
     OwnPtr<PurgeableBuffer> m_purgeableBuffer;
 #if PLATFORM(CF)
     SharedBuffer(CFDataRef);
@@ -110,4 +135,4 @@ private:
     
 }
 
-#endif
+#endif // SharedBuffer_h
diff --git a/src/3rdparty/webkit/WebCore/platform/SharedTimer.h b/src/3rdparty/webkit/WebCore/platform/SharedTimer.h
index a005add87f..5b5cd1487e 100644
--- a/src/3rdparty/webkit/WebCore/platform/SharedTimer.h
+++ b/src/3rdparty/webkit/WebCore/platform/SharedTimer.h
@@ -26,12 +26,14 @@
 #ifndef SharedTimer_h
 #define SharedTimer_h
 
+#include <wtf/Noncopyable.h>
+
 namespace WebCore {
 
     // Each thread has its own single instance of shared timer, which implements this interface.
     // This instance is shared by all timers in the thread.
     // Not intended to be used directly; use the Timer class instead.
-    class SharedTimer {
+    class SharedTimer : public Noncopyable {
     public:
         virtual ~SharedTimer() {}
         virtual void setFiredFunction(void (*)()) = 0;
diff --git a/src/3rdparty/webkit/WebCore/platform/StaticConstructors.h b/src/3rdparty/webkit/WebCore/platform/StaticConstructors.h
index f22383b6ae..c0a9a539e6 100644
--- a/src/3rdparty/webkit/WebCore/platform/StaticConstructors.h
+++ b/src/3rdparty/webkit/WebCore/platform/StaticConstructors.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
@@ -56,7 +54,7 @@
 #if COMPILER(MSVC7)
 #define DEFINE_GLOBAL(type, name) \
     const type name;
-#elif PLATFORM(SYMBIAN)
+#elif COMPILER(WINSCW)
 #define DEFINE_GLOBAL(type, name, arg...) \
     const type name;
 #else
@@ -70,7 +68,7 @@
 #if COMPILER(MSVC7)
 #define DEFINE_GLOBAL(type, name) \
     void * name[(sizeof(type) + sizeof(void *) - 1) / sizeof(void *)];
-#elif PLATFORM(SYMBIAN)
+#elif COMPILER(WINSCW)
 #define DEFINE_GLOBAL(type, name, arg...) \
     void * name[(sizeof(type) + sizeof(void *) - 1) / sizeof(void *)];
 #else
diff --git a/src/3rdparty/webkit/WebCore/platform/SuddenTermination.h b/src/3rdparty/webkit/WebCore/platform/SuddenTermination.h
index 3fc5b0fd57..2c1cfe711b 100644
--- a/src/3rdparty/webkit/WebCore/platform/SuddenTermination.h
+++ b/src/3rdparty/webkit/WebCore/platform/SuddenTermination.h
@@ -26,8 +26,6 @@
 #ifndef SuddenTermination_h
 #define SuddenTermination_h
 
-#include <wtf/Platform.h>
-
 namespace WebCore {
 
     // Once disabled via one or more more calls to disableSuddenTermination(), fast shutdown
diff --git a/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h b/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h
index e13231379f..07a11fb20f 100644
--- a/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h
+++ b/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h
@@ -38,6 +38,7 @@ enum ControlState {
     DefaultState = 1 << 6,
     WindowInactiveState = 1 << 7,
     IndeterminateState = 1 << 8,
+    SpinUpState = 1 << 9, // Sub-state for HoverState and PressedState.
     AllStates = 0xffffffff
 };
 
@@ -46,12 +47,12 @@ typedef unsigned ControlStates;
 // Must follow CSSValueKeywords.in order
 enum ControlPart {
     NoControlPart, CheckboxPart, RadioPart, PushButtonPart, SquareButtonPart, ButtonPart,
-    ButtonBevelPart, DefaultButtonPart, ListButtonPart, ListboxPart, ListItemPart,
+    ButtonBevelPart, DefaultButtonPart, InnerSpinButtonPart, ListButtonPart, ListboxPart, ListItemPart,
     MediaFullscreenButtonPart, MediaMuteButtonPart, MediaPlayButtonPart, MediaSeekBackButtonPart, 
-    MediaSeekForwardButtonPart, MediaRewindButtonPart, MediaReturnToRealtimeButtonPart,
+    MediaSeekForwardButtonPart, MediaRewindButtonPart, MediaReturnToRealtimeButtonPart, MediaToggleClosedCaptionsButtonPart,
     MediaSliderPart, MediaSliderThumbPart, MediaVolumeSliderContainerPart, MediaVolumeSliderPart, MediaVolumeSliderThumbPart,
     MediaControlsBackgroundPart, MediaCurrentTimePart, MediaTimeRemainingPart,
-    MenulistPart, MenulistButtonPart, MenulistTextPart, MenulistTextFieldPart,
+    MenulistPart, MenulistButtonPart, MenulistTextPart, MenulistTextFieldPart, OuterSpinButtonPart, ProgressBarPart,
     SliderHorizontalPart, SliderVerticalPart, SliderThumbHorizontalPart,
     SliderThumbVerticalPart, CaretPart, SearchFieldPart, SearchFieldDecorationPart,
     SearchFieldResultsDecorationPart, SearchFieldResultsButtonPart,
diff --git a/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.cpp b/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.cpp
index a43e9bd564..ea8ee205f4 100644
--- a/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.cpp
@@ -32,7 +32,7 @@
 #include "ThreadTimers.h"
 #include <wtf/UnusedParam.h>
 
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
 #include "TextCodecICU.h"
 #endif
 
@@ -48,40 +48,32 @@ using namespace WTF;
 
 namespace WebCore {
 
-ThreadGlobalData& threadGlobalData()
-{
-    // FIXME: Workers are not necessarily the only feature that make per-thread global data necessary.
-    // We need to check for e.g. database objects manipulating strings on secondary threads.
 #if ENABLE(WORKERS)
-    // ThreadGlobalData is used on main thread before it could possibly be used on secondary ones, so there is no need for synchronization here.
-    static ThreadSpecific<ThreadGlobalData>* threadGlobalData = new ThreadSpecific<ThreadGlobalData>;
-    return **threadGlobalData;
+ThreadSpecific<ThreadGlobalData>* ThreadGlobalData::staticData;
 #else
-    static ThreadGlobalData* staticData;
-    if (!staticData) {
-        staticData = static_cast<ThreadGlobalData*>(fastMalloc(sizeof(ThreadGlobalData)));
-        // ThreadGlobalData constructor indirectly uses staticData, so we need to set up the memory before invoking it.
-        new (staticData) ThreadGlobalData;
-    }
-    return *staticData;
+ThreadGlobalData* ThreadGlobalData::staticData;
 #endif
-}
 
 ThreadGlobalData::ThreadGlobalData()
-    : m_emptyString(new StringImpl)
-    , m_atomicStringTable(new HashSet<StringImpl*>)
+    : m_atomicStringTable(new HashSet<StringImpl*>)
     , m_eventNames(new EventNames)
     , m_threadTimers(new ThreadTimers)
 #ifndef NDEBUG
     , m_isMainThread(isMainThread())
 #endif
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
     , m_cachedConverterICU(new ICUConverterWrapper)
 #endif
 #if PLATFORM(MAC)
     , m_cachedConverterTEC(new TECConverterWrapper)
 #endif
 {
+    // StringImpl::empty() does not construct its static string in a threadsafe fashion,
+    // so ensure it has been initialized from here.
+    //
+    // This constructor will have been called on the main thread before being called on
+    // any other thread, and is only called once per thread.
+    StringImpl::empty();
 }
 
 ThreadGlobalData::~ThreadGlobalData()
@@ -89,21 +81,12 @@ ThreadGlobalData::~ThreadGlobalData()
 #if PLATFORM(MAC)
     delete m_cachedConverterTEC;
 #endif
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
     delete m_cachedConverterICU;
 #endif
-
     delete m_eventNames;
     delete m_atomicStringTable;
     delete m_threadTimers;
-
-    // Using member variable m_isMainThread instead of calling WTF::isMainThread() directly
-    // to avoid issues described in https://bugs.webkit.org/show_bug.cgi?id=25973.
-    // In short, some pthread-based platforms and ports can not use WTF::CurrentThread() and WTF::isMainThread()
-    // in destructors of thread-specific data.
-    ASSERT(m_isMainThread || m_emptyString->hasOneRef()); // We intentionally don't clean up static data on application quit, so there will be many strings remaining on the main thread.
-
-    delete m_emptyString;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.h b/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.h
index 68f5ec04a5..a984645fb6 100644
--- a/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.h
+++ b/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.h
@@ -28,9 +28,16 @@
 #define ThreadGlobalData_h
 
 #include "StringHash.h"
+#include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 
+#if ENABLE(WORKERS)
+#include <wtf/ThreadSpecific.h>
+#include <wtf/Threading.h>
+using WTF::ThreadSpecific;
+#endif
+
 namespace WebCore {
 
     class EventNames;
@@ -44,11 +51,10 @@ namespace WebCore {
         ~ThreadGlobalData();
 
         EventNames& eventNames() { return *m_eventNames; }
-        StringImpl* emptyString() { return m_emptyString; }
         HashSet<StringImpl*>& atomicStringTable() { return *m_atomicStringTable; }
         ThreadTimers& threadTimers() { return *m_threadTimers; }
 
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
         ICUConverterWrapper& cachedConverterICU() { return *m_cachedConverterICU; }
 #endif
 
@@ -57,7 +63,6 @@ namespace WebCore {
 #endif
 
     private:
-        StringImpl* m_emptyString;
         HashSet<StringImpl*>* m_atomicStringTable;
         EventNames* m_eventNames;
         ThreadTimers* m_threadTimers;
@@ -66,17 +71,42 @@ namespace WebCore {
         bool m_isMainThread;
 #endif
 
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
         ICUConverterWrapper* m_cachedConverterICU;
 #endif
 
 #if PLATFORM(MAC)
         TECConverterWrapper* m_cachedConverterTEC;
 #endif
+
+#if ENABLE(WORKERS)
+        static ThreadSpecific<ThreadGlobalData>* staticData;
+#else
+        static ThreadGlobalData* staticData;
+#endif
+        friend ThreadGlobalData& threadGlobalData();
     };
 
-    ThreadGlobalData& threadGlobalData();
+inline ThreadGlobalData& threadGlobalData() 
+{
+    // FIXME: Workers are not necessarily the only feature that make per-thread global data necessary.
+    // We need to check for e.g. database objects manipulating strings on secondary threads.
 
+#if ENABLE(WORKERS)
+    // ThreadGlobalData is used on main thread before it could possibly be used on secondary ones, so there is no need for synchronization here.
+    if (!ThreadGlobalData::staticData)
+        ThreadGlobalData::staticData = new ThreadSpecific<ThreadGlobalData>;
+    return **ThreadGlobalData::staticData;
+#else
+    if (!ThreadGlobalData::staticData) {
+        ThreadGlobalData::staticData = static_cast<ThreadGlobalData*>(fastMalloc(sizeof(ThreadGlobalData)));
+        // ThreadGlobalData constructor indirectly uses staticData, so we need to set up the memory before invoking it.
+        new (ThreadGlobalData::staticData) ThreadGlobalData;
+    }
+    return *ThreadGlobalData::staticData;
+#endif
+}
+    
 } // namespace WebCore
 
 #endif // ThreadGlobalData_h
diff --git a/src/3rdparty/webkit/WebCore/platform/Timer.cpp b/src/3rdparty/webkit/WebCore/platform/Timer.cpp
index 539846c8c5..3f4e334f90 100644
--- a/src/3rdparty/webkit/WebCore/platform/Timer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/Timer.cpp
@@ -196,13 +196,6 @@ void TimerBase::stop()
     ASSERT(!inHeap());
 }
 
-bool TimerBase::isActive() const
-{
-    ASSERT(m_thread == currentThread());
-
-    return m_nextFireTime;
-}
-
 double TimerBase::nextFireInterval() const
 {
     ASSERT(isActive());
diff --git a/src/3rdparty/webkit/WebCore/platform/Timer.h b/src/3rdparty/webkit/WebCore/platform/Timer.h
index 9221df07d5..c4443da493 100644
--- a/src/3rdparty/webkit/WebCore/platform/Timer.h
+++ b/src/3rdparty/webkit/WebCore/platform/Timer.h
@@ -101,6 +101,12 @@ private:
     TimerFiredFunction m_function;
 };
 
+inline bool TimerBase::isActive() const
+{
+    ASSERT(m_thread == currentThread());
+    return m_nextFireTime;
+}
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/TreeShared.h b/src/3rdparty/webkit/WebCore/platform/TreeShared.h
index 02728ff30b..b844e5ff8e 100644
--- a/src/3rdparty/webkit/WebCore/platform/TreeShared.h
+++ b/src/3rdparty/webkit/WebCore/platform/TreeShared.h
@@ -23,6 +23,9 @@
 
 #include <wtf/Assertions.h>
 #include <wtf/Noncopyable.h>
+#ifndef NDEBUG
+#include <wtf/Threading.h>
+#endif
 
 namespace WebCore {
 
@@ -32,6 +35,7 @@ public:
         : m_refCount(initialRefCount)
         , m_parent(0)
     {
+        ASSERT(isMainThread());
 #ifndef NDEBUG
         m_deletionHasBegun = false;
         m_inRemovedLastRefFunction = false;
@@ -39,11 +43,14 @@ public:
     }
     virtual ~TreeShared()
     {
+        ASSERT(isMainThread());
+        ASSERT(!m_refCount);
         ASSERT(m_deletionHasBegun);
     }
 
     void ref()
     {
+        ASSERT(isMainThread());
         ASSERT(!m_deletionHasBegun);
         ASSERT(!m_inRemovedLastRefFunction);
         ++m_refCount;
@@ -51,6 +58,8 @@ public:
 
     void deref()
     {
+        ASSERT(isMainThread());
+        ASSERT(m_refCount >= 0);
         ASSERT(!m_deletionHasBegun);
         ASSERT(!m_inRemovedLastRefFunction);
         if (--m_refCount <= 0 && !m_parent) {
@@ -73,8 +82,17 @@ public:
         return m_refCount;
     }
 
-    void setParent(T* parent) { m_parent = parent; }
-    T* parent() const { return m_parent; }
+    void setParent(T* parent)
+    { 
+        ASSERT(isMainThread());
+        m_parent = parent; 
+    }
+
+    T* parent() const
+    {
+        ASSERT(isMainThread());
+        return m_parent;
+    }
 
 #ifndef NDEBUG
     bool m_deletionHasBegun;
diff --git a/src/3rdparty/webkit/WebCore/platform/Widget.h b/src/3rdparty/webkit/WebCore/platform/Widget.h
index e2a7349c59..ebd677b596 100644
--- a/src/3rdparty/webkit/WebCore/platform/Widget.h
+++ b/src/3rdparty/webkit/WebCore/platform/Widget.h
@@ -27,8 +27,6 @@
 #ifndef Widget_h
 #define Widget_h
 
-#include <wtf/Platform.h>
-
 #if PLATFORM(MAC)
 #ifdef __OBJC__
 @class NSView;
@@ -163,6 +161,8 @@ public:
 
     virtual bool isFrameView() const { return false; }
     virtual bool isPluginView() const { return false; }
+    // FIXME: The Mac plug-in code should inherit from PluginView. When this happens PluginWidget and PluginView can become one class. 
+    virtual bool isPluginWidget() const { return false; }
     virtual bool isScrollbar() const { return false; }
 
     void removeFromParent();
@@ -184,7 +184,10 @@ public:
 
     virtual void frameRectsChanged() {}
 
-#if PLATFORM(MAC)    
+    // Notifies this widget that other widgets on the page have been repositioned.
+    virtual void widgetPositionsUpdated() {}
+
+#if PLATFORM(MAC)
     NSView* getOuterView() const;
     
     static void beforeMouseDown(NSView*, Widget*);
diff --git a/src/3rdparty/webkit/WebCore/platform/android/ClipboardAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/android/ClipboardAndroid.cpp
deleted file mode 100644
index 0322e0194b..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/android/ClipboardAndroid.cpp
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Copyright 2009, The Android Open Source Project
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "ClipboardAndroid.h"
-
-#include "CachedImage.h"
-#include "Element.h"
-#include "Frame.h"
-#include "Range.h"
-
-namespace WebCore {
-
-ClipboardAndroid::ClipboardAndroid(ClipboardAccessPolicy policy, bool isForDragging)
-    : Clipboard(policy, isForDragging)
-{
-}
-
-ClipboardAndroid::~ClipboardAndroid()
-{
-}
-
-void ClipboardAndroid::clearData(const String&)
-{
-    ASSERT(isForDragging());
-}
-
-void ClipboardAndroid::clearAllData()
-{
-    ASSERT(isForDragging());
-}
-
-String ClipboardAndroid::getData(const String&, bool& success) const
-{     
-    success = false;
-    return "";
-}
-
-bool ClipboardAndroid::setData(const String&, const String&)
-{
-    ASSERT(isForDragging());
-    return false;
-}
-
-// extensions beyond IE's API
-HashSet<String> ClipboardAndroid::types() const
-{ 
-    return HashSet<String>();
-}
-
-void ClipboardAndroid::setDragImage(CachedImage*, const IntPoint&)
-{
-}
-
-void ClipboardAndroid::setDragImageElement(Node*, const IntPoint&)
-{
-}
-
-DragImageRef ClipboardAndroid::createDragImage(IntPoint&) const
-{
-    return 0;
-}
-
-void ClipboardAndroid::declareAndWriteDragImage(Element*, const KURL&, const String&, Frame*)
-{
-}
-
-void ClipboardAndroid::writeURL(const KURL&, const String&, Frame*)
-{
-}
-
-void ClipboardAndroid::writeRange(Range* selectedRange, Frame*)
-{
-    ASSERT(selectedRange);
-}
-
-bool ClipboardAndroid::hasData()
-{
-    return false;
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/android/ClipboardAndroid.h b/src/3rdparty/webkit/WebCore/platform/android/ClipboardAndroid.h
deleted file mode 100644
index 8c9d9fa94a..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/android/ClipboardAndroid.h
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Copyright 2009, The Android Open Source Project
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef ClipboardAndroid_h
-#define ClipboardAndroid_h
-
-#include "Clipboard.h"
-
-#include "CachedResourceClient.h"
-
-namespace WebCore {
-
-class CachedImage;
-
-class ClipboardAndroid : public Clipboard, public CachedResourceClient {
-public:
-    ClipboardAndroid(ClipboardAccessPolicy policy, bool isForDragging);
-    ~ClipboardAndroid();
-
-    void clearData(const String&);
-    void clearAllData();
-    String getData(const String&, bool& success) const;
-    bool setData(const String&, const String&);
-
-    // extensions beyond IE's API
-    HashSet<String> types() const;
-
-    void setDragImage(CachedImage*, const IntPoint&);
-    void setDragImageElement(Node*, const IntPoint&);
-    
-    virtual DragImageRef createDragImage(IntPoint&) const;
-    virtual void declareAndWriteDragImage(Element*, const KURL&, const String&, Frame*);
-    virtual void writeURL(const KURL&, const String&, Frame*);
-    virtual void writeRange(Range*, Frame*);
-
-    virtual bool hasData();
-};
-
-} // namespace WebCore
-
-#endif // ClipboardAndroid_h
diff --git a/src/3rdparty/webkit/WebCore/platform/android/CursorAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/android/CursorAndroid.cpp
deleted file mode 100644
index beef3b295f..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/android/CursorAndroid.cpp
+++ /dev/null
@@ -1,298 +0,0 @@
-/*
- * Copyright 2009, The Android Open Source Project
- * Copyright (C) 2004, 2006 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#define LOG_TAG "WebCore"
-
-#include "config.h"
-#include "Cursor.h"
-
-#include "NotImplemented.h"
-
-namespace WebCore {
-
-Cursor::Cursor(Image*, const IntPoint&)
-{
-    notImplemented();
-}
-
-Cursor::Cursor(const Cursor&)
-{
-    notImplemented();
-}
-
-Cursor::~Cursor()
-{
-    notImplemented();
-}
-
-Cursor& Cursor::operator=(const Cursor&)
-{
-    notImplemented();
-    return *this;
-}
-
-static Cursor c;
-const Cursor& pointerCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& crossCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& handCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& moveCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& iBeamCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& waitCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& helpCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& eastResizeCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& northResizeCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& northEastResizeCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& northWestResizeCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& southResizeCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& southEastResizeCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& southWestResizeCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& westResizeCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& northSouthResizeCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& eastWestResizeCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& northEastSouthWestResizeCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& northWestSouthEastResizeCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& columnResizeCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& rowResizeCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& verticalTextCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& cellCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& contextMenuCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& noDropCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& copyCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& progressCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& aliasCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& noneCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& middlePanningCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& eastPanningCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& northPanningCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& northEastPanningCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& northWestPanningCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& southPanningCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& southEastPanningCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& southWestPanningCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& westPanningCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& grabCursor()
-{
-    notImplemented();
-    return c;
-}
-
-const Cursor& grabbingCursor()
-{
-    notImplemented();
-    return c;
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/android/FileSystemAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/android/FileSystemAndroid.cpp
deleted file mode 100644
index 46c12970e8..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/android/FileSystemAndroid.cpp
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Copyright 2009, The Android Open Source Project
- * Copyright (C) 2007 Holger Hans Peter Freyther
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FileSystem.h"
-
-#include "CString.h"
-#include "StringBuilder.h"
-#include "cutils/log.h"
-#include <dirent.h>
-#include <dlfcn.h>
-#include <errno.h>
-#include <fnmatch.h>
-#include <sys/stat.h>
-
-namespace WebCore {
-
-// Global static used to store the base to the plugin path.
-// This is set in WebSettings.cpp
-String sPluginPath;
-
-CString fileSystemRepresentation(const String& path)
-{
-    return path.utf8();
-}
-
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
-{
-    int number = rand() % 10000 + 1;
-    CString filename;
-    do {
-        StringBuilder builder;
-        builder.append(sPluginPath);
-        builder.append('/');
-        builder.append(prefix);
-        builder.append(String::number(number));
-        filename = builder.toString().utf8();
-        const char* fstr = filename.data();
-        handle = open(filename.data(), O_WRONLY | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR);
-        number++;
-        
-        if (handle != -1)
-            return filename;
-    } while (errno == EEXIST);
-    
-    return CString();
-}
-
-bool unloadModule(PlatformModule module)
-{
-    return !dlclose(module);
-}
-
-void closeFile(PlatformFileHandle& handle)
-{
-    if (isHandleValid(handle)) {
-        close(handle);
-        handle = invalidPlatformFileHandle;
-    }
-}
-
-int writeToFile(PlatformFileHandle handle, const char* data, int length)
-{
-    int totalBytesWritten = 0;
-    while (totalBytesWritten < length) {
-        int bytesWritten = write(handle, data, (size_t)(length - totalBytesWritten));
-        if (bytesWritten < 0 && errno != EINTR)
-            return -1;
-        if (bytesWritten > 0)
-            totalBytesWritten += bytesWritten;
-    }
-
-    return totalBytesWritten;
-}
-
-String homeDirectoryPath() 
-{
-    return sPluginPath;
-}
-
-Vector<String> listDirectory(const String& path, const String& filter)
-{
-    Vector<String> entries;
-    CString cpath = path.utf8();
-    CString cfilter = filter.utf8();
-    DIR* dir = opendir(cpath.data());
-    if (dir) {
-        struct dirent* dp;
-        while (dp = readdir(dir)) {
-            const char* name = dp->d_name;
-            if (!strcmp(name, ".") || !strcmp(name, ".."))
-                continue;
-            if (fnmatch(cfilter.data(), name, 0))
-                continue;
-            char filePath[1024];
-            if ((int) (sizeof(filePath) - 1) < snprintf(filePath,
-                    sizeof(filePath), "%s/%s", cpath.data(), name)) {
-                continue; // buffer overflow
-            }
-            entries.append(filePath);
-        }
-        closedir(dir);
-    }
-    return entries;
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/android/KeyEventAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/android/KeyEventAndroid.cpp
deleted file mode 100644
index d3c48f5d58..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/android/KeyEventAndroid.cpp
+++ /dev/null
@@ -1,273 +0,0 @@
-/*
- * Copyright 2007, The Android Open Source Project
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
- * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com
- * Copyright (C) 2007 Holger Hans Peter Freyther
- * Copyright (C) 2008 Collabora, Ltd.  All rights reserved.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "PlatformKeyboardEvent.h"
-
-#include "KeyboardCodes.h"
-#include "NotImplemented.h"
-#include <ui/KeycodeLabels.h>
-
-namespace WebCore {
-
-// compare to same function in gdk/KeyEventGdk.cpp
-static int windowsKeyCodeForKeyEvent(unsigned int keyCode)
-{
-    // Does not provide all key codes, and does not handle all keys.
-    switch (keyCode) {
-    case kKeyCodeDel:
-        return VK_BACK;
-    case kKeyCodeTab:
-        return VK_TAB;
-    case kKeyCodeClear:
-        return VK_CLEAR;
-    case kKeyCodeDpadCenter:
-    case kKeyCodeNewline:
-        return VK_RETURN;
-    case kKeyCodeShiftLeft:
-    case kKeyCodeShiftRight:
-        return VK_SHIFT;
-    // back will serve as escape, although we probably do not have access to it
-    case kKeyCodeBack:
-        return VK_ESCAPE;
-    case kKeyCodeSpace:
-        return VK_SPACE;
-    case kKeyCodeHome:
-        return VK_HOME;
-    case kKeyCodeDpadLeft:
-        return VK_LEFT;
-    case kKeyCodeDpadUp:
-        return VK_UP;
-    case kKeyCodeDpadRight:
-        return VK_RIGHT;
-    case kKeyCodeDpadDown:
-        return VK_DOWN;
-    case kKeyCode0:
-        return VK_0;
-    case kKeyCode1:
-        return VK_1;
-    case kKeyCode2:
-        return VK_2;
-    case kKeyCode3:
-        return VK_3;
-    case kKeyCode4:
-        return VK_4;
-    case kKeyCode5:
-        return VK_5;
-    case kKeyCode6:
-        return VK_6;
-    case kKeyCode7:
-        return VK_7;
-    case kKeyCode8:
-        return VK_8;
-    case kKeyCode9:
-        return VK_9;
-    case kKeyCodeA:
-        return VK_A;
-    case kKeyCodeB:
-        return VK_B;
-    case kKeyCodeC:
-        return VK_C;
-    case kKeyCodeD:
-        return VK_D;
-    case kKeyCodeE:
-        return VK_E;
-    case kKeyCodeF:
-        return VK_F;
-    case kKeyCodeG:
-        return VK_G;
-    case kKeyCodeH:
-        return VK_H;
-    case kKeyCodeI:
-        return VK_I;
-    case kKeyCodeJ:
-        return VK_J;
-    case kKeyCodeK:
-        return VK_K;
-    case kKeyCodeL:
-        return VK_L;
-    case kKeyCodeM:
-        return VK_M;
-    case kKeyCodeN:
-        return VK_N;
-    case kKeyCodeO:
-        return VK_O;
-    case kKeyCodeP:
-        return VK_P;
-    case kKeyCodeQ:
-        return VK_Q;
-    case kKeyCodeR:
-        return VK_R;
-    case kKeyCodeS:
-        return VK_S;
-    case kKeyCodeT:
-        return VK_T;
-    case kKeyCodeU:
-        return VK_U;
-    case kKeyCodeV:
-        return VK_V;
-    case kKeyCodeW:
-        return VK_W;
-    case kKeyCodeX:
-        return VK_X;
-    case kKeyCodeY:
-        return VK_Y;
-    case kKeyCodeZ:
-        return VK_Z;
-    // colon
-    case kKeyCodeSemicolon:
-        return VK_OEM_1;
-    case kKeyCodeComma:
-        return VK_OEM_COMMA;
-    case kKeyCodeMinus:
-        return VK_OEM_MINUS;
-    case kKeyCodeEquals:
-        return VK_OEM_PLUS;
-    case kKeyCodePeriod:
-        return VK_OEM_PERIOD;
-    case kKeyCodeSlash:
-        return VK_OEM_2;
-    // maybe not the right choice
-    case kKeyCodeLeftBracket:
-        return VK_OEM_4;
-    case kKeyCodeBackslash:
-        return VK_OEM_5;
-    case kKeyCodeRightBracket:
-        return VK_OEM_6;
-    default:
-        return 0;
-    }
-}
-
-static String keyIdentifierForAndroidKeyCode(int keyCode)
-{
-    // Does not return all of the same key identifiers, and
-    // does not handle all the keys.
-    switch (keyCode) {
-    case kKeyCodeClear:
-        return "Clear";
-    case kKeyCodeNewline:
-    case kKeyCodeDpadCenter:
-        return "Enter";
-    case kKeyCodeHome:
-        return "Home";
-    case kKeyCodeDpadDown:
-        return "Down";
-    case kKeyCodeDpadLeft:
-        return "Left";
-    case kKeyCodeDpadRight:
-        return "Right";
-    case kKeyCodeDpadUp:
-        return "Up";
-    // Standard says that DEL becomes U+00007F.
-    case kKeyCodeDel:
-        return "U+00007F";
-    default:
-        char upper[16];
-        sprintf(upper, "U+%06X", windowsKeyCodeForKeyEvent(keyCode));
-        return String(upper);
-    }
-}
-
-static inline String singleCharacterString(UChar32 c) 
-{
-    if (!c)
-        return String();
-    if (c > 0xffff) {
-        UChar lead = U16_LEAD(c);
-        UChar trail = U16_TRAIL(c);
-        UChar utf16[2] = {lead, trail};
-        return String(utf16, 2);
-    }
-    UChar n = (UChar)c;
-    return String(&n, 1);
-}
-
-PlatformKeyboardEvent::PlatformKeyboardEvent(int keyCode, UChar32 unichar,
-                                             Type type, int repeatCount,
-                                             ModifierKey mods)
-    : m_type(type)
-    , m_text(singleCharacterString(unichar))
-    , m_unmodifiedText(singleCharacterString(unichar))
-    , m_keyIdentifier(keyIdentifierForAndroidKeyCode(keyCode))
-    , m_autoRepeat(repeatCount > 0)
-    , m_windowsVirtualKeyCode(windowsKeyCodeForKeyEvent(keyCode))
-    , m_nativeVirtualKeyCode(keyCode)
-    , m_isKeypad(false)
-    , m_shiftKey((mods & ShiftKey))
-    , m_ctrlKey((mods & CtrlKey))
-    , m_altKey((mods & AltKey))
-    , m_metaKey((mods & MetaKey))
-    // added for android
-    , m_repeatCount(repeatCount)
-    , m_unichar(unichar)
-{
-    // Copied from the mac port
-    if (m_windowsVirtualKeyCode == '\r') {
-        m_text = "\r";
-        m_unmodifiedText = "\r";
-    }
-
-    if (m_text == "\x7F")
-        m_text = "\x8";
-    if (m_unmodifiedText == "\x7F")
-        m_unmodifiedText = "\x8";
-
-    if (m_windowsVirtualKeyCode == 9) {
-        m_text = "\x9";
-        m_unmodifiedText = "\x9";
-    }
-}
-
-bool PlatformKeyboardEvent::currentCapsLockState()
-{
-    notImplemented();
-    return false;
-}
-
-void PlatformKeyboardEvent::disambiguateKeyDownEvent(Type type, bool backwardCompatibilityMode)
-{
-    // Copied with modification from the mac port.
-    ASSERT(m_type == KeyDown);
-    ASSERT(type == RawKeyDown || type == Char);
-    m_type = type;
-    if (backwardCompatibilityMode)
-        return;
-
-    if (type == RawKeyDown) {
-        m_text = String();
-        m_unmodifiedText = String();
-    } else {
-        m_keyIdentifier = String();
-        m_windowsVirtualKeyCode = 0;
-    }
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/android/KeyboardCodes.h b/src/3rdparty/webkit/WebCore/platform/android/KeyboardCodes.h
deleted file mode 100644
index 321e9da413..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/android/KeyboardCodes.h
+++ /dev/null
@@ -1,545 +0,0 @@
-/*
- * Copyright 2009, The Android Open Source Project
- * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com 
- *
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef KeyboardCodes_H
-#define KeyboardCodes_H
-
-namespace WebCore {
-
-// VK_LBUTTON (01) Left mouse button
-// VK_RBUTTON (02) Right mouse button
-// VK_CANCEL (03) Control-break processing
-// VK_MBUTTON (04) Middle mouse button (three-button mouse)
-// VK_XBUTTON1 (05)
-// VK_XBUTTON2 (06)
-
-// VK_BACK (08) BACKSPACE key
-const int VK_BACK = 0x08;
-
-// VK_TAB (09) TAB key
-const int VK_TAB = 0x09;
-
-// VK_CLEAR (0C) CLEAR key
-const int VK_CLEAR = 0x0C;
-
-// VK_RETURN (0D)
-const int VK_RETURN = 0x0D;
-
-// VK_SHIFT (10) SHIFT key
-const int VK_SHIFT = 0x10;
-
-// VK_CONTROL (11) CTRL key
-const int VK_CONTROL = 0x11;
-
-// VK_MENU (12) ALT key
-const int VK_MENU = 0x12;
-
-// VK_PAUSE (13) PAUSE key
-const int VK_PAUSE = 0x13;
-
-// VK_CAPITAL (14) CAPS LOCK key
-const int VK_CAPITAL = 0x14;
-
-// VK_KANA (15) Input Method Editor (IME) Kana mode
-const int VK_KANA = 0x15;
-
-// VK_HANGUEL (15) IME Hanguel mode (maintained for compatibility; use VK_HANGUL)
-// VK_HANGUL (15) IME Hangul mode
-const int VK_HANGUL = 0x15;
-
-// VK_JUNJA (17) IME Junja mode
-const int VK_JUNJA = 0x17;
-
-// VK_FINAL (18) IME final mode
-const int VK_FINAL = 0x18;
-
-// VK_HANJA (19) IME Hanja mode
-const int VK_HANJA = 0x19;
-
-// VK_KANJI (19) IME Kanji mode
-const int VK_KANJI = 0x19;
-
-// VK_ESCAPE (1B) ESC key
-const int VK_ESCAPE = 0x1B;
-
-// VK_CONVERT (1C) IME convert
-const int VK_CONVERT = 0x1C;
-
-// VK_NONCONVERT (1D) IME nonconvert
-const int VK_NONCONVERT = 0x1D;
-
-// VK_ACCEPT (1E) IME accept
-const int VK_ACCEPT = 0x1E;
-
-// VK_MODECHANGE (1F) IME mode change request
-const int VK_MODECHANGE = 0x1F;
-
-// VK_SPACE (20) SPACEBAR
-const int VK_SPACE = 0x20;
-
-// VK_PRIOR (21) PAGE UP key
-const int VK_PRIOR = 0x21;
-
-// VK_NEXT (22) PAGE DOWN key
-const int VK_NEXT = 0x22;
-
-// VK_END (23) END key
-const int VK_END = 0x23;
-
-// VK_HOME (24) HOME key
-const int VK_HOME = 0x24;
-
-// VK_LEFT (25) LEFT ARROW key
-const int VK_LEFT = 0x25;
-
-// VK_UP (26) UP ARROW key
-const int VK_UP = 0x26;
-
-// VK_RIGHT (27) RIGHT ARROW key
-const int VK_RIGHT = 0x27;
-
-// VK_DOWN (28) DOWN ARROW key
-const int VK_DOWN = 0x28;
-
-// VK_SELECT (29) SELECT key
-const int VK_SELECT = 0x29;
-
-// VK_PRINT (2A) PRINT key
-const int VK_PRINT = 0x2A;
-
-// VK_EXECUTE (2B) EXECUTE key
-const int VK_EXECUTE = 0x2B;
-
-// VK_SNAPSHOT (2C) PRINT SCREEN key
-const int VK_SNAPSHOT = 0x2C;
-
-// VK_INSERT (2D) INS key
-const int VK_INSERT = 0x2D;
-
-// VK_DELETE (2E) DEL key
-const int VK_DELETE = 0x2E;
-
-// VK_HELP (2F) HELP key
-const int VK_HELP = 0x2F;
-
-// (30) 0 key
-const int VK_0 = 0x30;
-
-// (31) 1 key
-const int VK_1 = 0x31;
-
-// (32) 2 key
-const int VK_2 = 0x32;
-
-// (33) 3 key
-const int VK_3 = 0x33;
-
-// (34) 4 key
-const int VK_4 = 0x34;
-
-// (35) 5 key;
-
-const int VK_5 = 0x35;
-
-// (36) 6 key
-const int VK_6 = 0x36;
-
-// (37) 7 key
-const int VK_7 = 0x37;
-
-// (38) 8 key
-const int VK_8 = 0x38;
-
-// (39) 9 key
-const int VK_9 = 0x39;
-
-// (41) A key
-const int VK_A = 0x41;
-
-// (42) B key
-const int VK_B = 0x42;
-
-// (43) C key
-const int VK_C = 0x43;
-
-// (44) D key
-const int VK_D = 0x44;
-
-// (45) E key
-const int VK_E = 0x45;
-
-// (46) F key
-const int VK_F = 0x46;
-
-// (47) G key
-const int VK_G = 0x47;
-
-// (48) H key
-const int VK_H = 0x48;
-
-// (49) I key
-const int VK_I = 0x49;
-
-// (4A) J key
-const int VK_J = 0x4A;
-
-// (4B) K key
-const int VK_K = 0x4B;
-
-// (4C) L key
-const int VK_L = 0x4C;
-
-// (4D) M key
-const int VK_M = 0x4D;
-
-// (4E) N key
-const int VK_N = 0x4E;
-
-// (4F) O key
-const int VK_O = 0x4F;
-
-// (50) P key
-const int VK_P = 0x50;
-
-// (51) Q key
-const int VK_Q = 0x51;
-
-// (52) R key
-const int VK_R = 0x52;
-
-// (53) S key
-const int VK_S = 0x53;
-
-// (54) T key
-const int VK_T = 0x54;
-
-// (55) U key
-const int VK_U = 0x55;
-
-// (56) V key
-const int VK_V = 0x56;
-
-// (57) W key
-const int VK_W = 0x57;
-
-// (58) X key
-const int VK_X = 0x58;
-
-// (59) Y key
-const int VK_Y = 0x59;
-
-// (5A) Z key
-const int VK_Z = 0x5A;
-
-// VK_LWIN (5B) Left Windows key (Microsoft Natural keyboard)
-const int VK_LWIN = 0x5B;
-
-// VK_RWIN (5C) Right Windows key (Natural keyboard)
-const int VK_RWIN = 0x5C;
-
-// VK_APPS (5D) Applications key (Natural keyboard)
-const int VK_APPS = 0x5D;
-
-// VK_SLEEP (5F) Computer Sleep key
-const int VK_SLEEP = 0x5F;
-
-// VK_NUMPAD0 (60) Numeric keypad 0 key
-const int VK_NUMPAD0 = 0x60;
-
-// VK_NUMPAD1 (61) Numeric keypad 1 key
-const int VK_NUMPAD1 = 0x61;
-
-// VK_NUMPAD2 (62) Numeric keypad 2 key
-const int VK_NUMPAD2 = 0x62;
-
-// VK_NUMPAD3 (63) Numeric keypad 3 key
-const int VK_NUMPAD3 = 0x63;
-
-// VK_NUMPAD4 (64) Numeric keypad 4 key
-const int VK_NUMPAD4 = 0x64;
-
-// VK_NUMPAD5 (65) Numeric keypad 5 key
-const int VK_NUMPAD5 = 0x65;
-
-// VK_NUMPAD6 (66) Numeric keypad 6 key
-const int VK_NUMPAD6 = 0x66;
-
-// VK_NUMPAD7 (67) Numeric keypad 7 key
-const int VK_NUMPAD7 = 0x67;
-
-// VK_NUMPAD8 (68) Numeric keypad 8 key
-const int VK_NUMPAD8 = 0x68;
-
-// VK_NUMPAD9 (69) Numeric keypad 9 key
-const int VK_NUMPAD9 = 0x69;
-
-// VK_MULTIPLY (6A) Multiply key
-const int VK_MULTIPLY = 0x6A;
-
-// VK_ADD (6B) Add key
-const int VK_ADD = 0x6B;
-
-// VK_SEPARATOR (6C) Separator key
-const int VK_SEPARATOR = 0x6C;
-
-// VK_SUBTRACT (6D) Subtract key
-const int VK_SUBTRACT = 0x6D;
-
-// VK_DECIMAL (6E) Decimal key
-const int VK_DECIMAL = 0x6E;
-
-// VK_DIVIDE (6F) Divide key
-const int VK_DIVIDE = 0x6F;
-
-// VK_F1 (70) F1 key
-const int VK_F1 = 0x70;
-
-// VK_F2 (71) F2 key
-const int VK_F2 = 0x71;
-
-// VK_F3 (72) F3 key
-const int VK_F3 = 0x72;
-
-// VK_F4 (73) F4 key
-const int VK_F4 = 0x73;
-
-// VK_F5 (74) F5 key
-const int VK_F5 = 0x74;
-
-// VK_F6 (75) F6 key
-const int VK_F6 = 0x75;
-
-// VK_F7 (76) F7 key
-const int VK_F7 = 0x76;
-
-// VK_F8 (77) F8 key
-const int VK_F8 = 0x77;
-
-// VK_F9 (78) F9 key
-const int VK_F9 = 0x78;
-
-// VK_F10 (79) F10 key
-const int VK_F10 = 0x79;
-
-// VK_F11 (7A) F11 key
-const int VK_F11 = 0x7A;
-
-// VK_F12 (7B) F12 key
-const int VK_F12 = 0x7B;
-
-// VK_F13 (7C) F13 key
-const int VK_F13 = 0x7C;
-
-// VK_F14 (7D) F14 key
-const int VK_F14 = 0x7D;
-
-// VK_F15 (7E) F15 key
-const int VK_F15 = 0x7E;
-
-// VK_F16 (7F) F16 key
-const int VK_F16 = 0x7F;
-
-// VK_F17 (80H) F17 key
-const int VK_F17 = 0x80;
-
-// VK_F18 (81H) F18 key
-const int VK_F18 = 0x81;
-
-// VK_F19 (82H) F19 key
-const int VK_F19 = 0x82;
-
-// VK_F20 (83H) F20 key
-const int VK_F20 = 0x83;
-
-// VK_F21 (84H) F21 key
-const int VK_F21 = 0x84;
-
-// VK_F22 (85H) F22 key
-const int VK_F22 = 0x85;
-
-// VK_F23 (86H) F23 key
-const int VK_F23 = 0x86;
-
-// VK_F24 (87H) F24 key
-const int VK_F24 = 0x87;
-
-// VK_NUMLOCK (90) NUM LOCK key
-const int VK_NUMLOCK = 0x90;
-
-// VK_SCROLL (91) SCROLL LOCK key
-const int VK_SCROLL = 0x91;
-
-// VK_LSHIFT (A0) Left SHIFT key
-const int VK_LSHIFT = 0xA0;
-
-// VK_RSHIFT (A1) Right SHIFT key
-const int VK_RSHIFT = 0xA1;
-
-// VK_LCONTROL (A2) Left CONTROL key
-const int VK_LCONTROL = 0xA2;
-
-// VK_RCONTROL (A3) Right CONTROL key
-const int VK_RCONTROL = 0xA3;
-
-// VK_LMENU (A4) Left MENU key
-const int VK_LMENU = 0xA4;
-
-// VK_RMENU (A5) Right MENU key
-const int VK_RMENU = 0xA5;
-
-// VK_BROWSER_BACK (A6) Windows 2000/XP: Browser Back key
-const int VK_BROWSER_BACK = 0xA6;
-
-// VK_BROWSER_FORWARD (A7) Windows 2000/XP: Browser Forward key
-const int VK_BROWSER_FORWARD = 0xA7;
-
-// VK_BROWSER_REFRESH (A8) Windows 2000/XP: Browser Refresh key
-const int VK_BROWSER_REFRESH = 0xA8;
-
-// VK_BROWSER_STOP (A9) Windows 2000/XP: Browser Stop key
-const int VK_BROWSER_STOP = 0xA9;
-
-// VK_BROWSER_SEARCH (AA) Windows 2000/XP: Browser Search key
-const int VK_BROWSER_SEARCH = 0xAA;
-
-// VK_BROWSER_FAVORITES (AB) Windows 2000/XP: Browser Favorites key
-const int VK_BROWSER_FAVORITES = 0xAB;
-
-// VK_BROWSER_HOME (AC) Windows 2000/XP: Browser Start and Home key
-const int VK_BROWSER_HOME = 0xAC;
-
-// VK_VOLUME_MUTE (AD) Windows 2000/XP: Volume Mute key
-const int VK_VOLUME_MUTE = 0xAD;
-
-// VK_VOLUME_DOWN (AE) Windows 2000/XP: Volume Down key
-const int VK_VOLUME_DOWN = 0xAE;
-
-// VK_VOLUME_UP (AF) Windows 2000/XP: Volume Up key
-const int VK_VOLUME_UP = 0xAF;
-
-// VK_MEDIA_NEXT_TRACK (B0) Windows 2000/XP: Next Track key
-const int VK_MEDIA_NEXT_TRACK = 0xB0;
-
-// VK_MEDIA_PREV_TRACK (B1) Windows 2000/XP: Previous Track key
-const int VK_MEDIA_PREV_TRACK = 0xB1;
-
-// VK_MEDIA_STOP (B2) Windows 2000/XP: Stop Media key
-const int VK_MEDIA_STOP = 0xB2;
-
-// VK_MEDIA_PLAY_PAUSE (B3) Windows 2000/XP: Play/Pause Media key
-const int VK_MEDIA_PLAY_PAUSE = 0xB3;
-
-// VK_LAUNCH_MAIL (B4) Windows 2000/XP: Start Mail key
-const int VK_MEDIA_LAUNCH_MAIL = 0xB4;
-
-// VK_LAUNCH_MEDIA_SELECT (B5) Windows 2000/XP: Select Media key
-const int VK_MEDIA_LAUNCH_MEDIA_SELECT = 0xB5;
-
-// VK_LAUNCH_APP1 (B6) Windows 2000/XP: Start Application 1 key
-const int VK_MEDIA_LAUNCH_APP1 = 0xB6;
-
-// VK_LAUNCH_APP2 (B7) Windows 2000/XP: Start Application 2 key
-const int VK_MEDIA_LAUNCH_APP2 = 0xB7;
-
-// VK_OEM_1 (BA) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the ';:' key
-const int VK_OEM_1 = 0xBA;
-
-// VK_OEM_PLUS (BB) Windows 2000/XP: For any country/region, the '+' key
-const int VK_OEM_PLUS = 0xBB;
-
-// VK_OEM_COMMA (BC) Windows 2000/XP: For any country/region, the ',' key
-const int VK_OEM_COMMA = 0xBC;
-
-// VK_OEM_MINUS (BD) Windows 2000/XP: For any country/region, the '-' key
-const int VK_OEM_MINUS = 0xBD;
-
-// VK_OEM_PERIOD (BE) Windows 2000/XP: For any country/region, the '.' key
-const int VK_OEM_PERIOD = 0xBE;
-
-// VK_OEM_2 (BF) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '/?' key
-const int VK_OEM_2 = 0xBF;
-
-// VK_OEM_3 (C0) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '`~' key
-const int VK_OEM_3 = 0xC0;
-
-// VK_OEM_4 (DB) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '[{' key
-const int VK_OEM_4 = 0xDB;
-
-// VK_OEM_5 (DC) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '\|' key
-const int VK_OEM_5 = 0xDC;
-
-// VK_OEM_6 (DD) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the ']}' key
-const int VK_OEM_6 = 0xDD;
-
-// VK_OEM_7 (DE) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the 'single-quote/double-quote' key
-const int VK_OEM_7 = 0xDE;
-
-// VK_OEM_8 (DF) Used for miscellaneous characters; it can vary by keyboard.
-const int VK_OEM_8 = 0xDF;
-
-// VK_OEM_102 (E2) Windows 2000/XP: Either the angle bracket key or the backslash key on the RT 102-key keyboard
-const int VK_OEM_102 = 0xE2;
-
-// VK_PROCESSKEY (E5) Windows 95/98/Me, Windows NT 4.0, Windows 2000/XP: IME PROCESS key
-const int VK_PROCESSKEY = 0xE5;
-
-// VK_PACKET (E7) Windows 2000/XP: Used to pass Unicode characters as if they were keystrokes. The VK_PACKET key is the low word of a 32-bit Virtual Key value used for non-keyboard input methods. For more information, see Remark in KEYBDINPUT,SendInput, WM_KEYDOWN, and WM_KEYUP
-const int VK_PACKET = 0xE7;
-
-// VK_ATTN (F6) Attn key
-const int VK_ATTN = 0xF6;
-
-// VK_CRSEL (F7) CrSel key
-const int VK_CRSEL = 0xF7;
-
-// VK_EXSEL (F8) ExSel key
-const int VK_EXSEL = 0xF8;
-
-// VK_EREOF (F9) Erase EOF key
-const int VK_EREOF = 0xF9;
-
-// VK_PLAY (FA) Play key
-const int VK_PLAY = 0xFA;
-
-// VK_ZOOM (FB) Zoom key
-const int VK_ZOOM = 0xFB;
-
-// VK_NONAME (FC) Reserved for future use
-const int VK_NONAME = 0xFC;
-
-// VK_PA1 (FD) PA1 key
-const int VK_PA1 = 0xFD;
-
-// VK_OEM_CLEAR (FE) Clear key
-const int VK_OEM_CLEAR = 0xFE;
-
-const int VK_UNKNOWN = 0;
-
-}
-
-#endif // KeyboardCodes_h
diff --git a/src/3rdparty/webkit/WebCore/platform/android/PopupMenuAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/android/PopupMenuAndroid.cpp
deleted file mode 100644
index 8a1ed07489..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/android/PopupMenuAndroid.cpp
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * This file is part of the popup menu implementation for <select> elements in WebCore.
- *
- * Copyright 2009, The Android Open Source Project
- * Copyright (C) 2006 Apple Computer, Inc.
- * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com 
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
- * Boston, MA 02111-1307, USA.
- *
- */
-
-#include "config.h"
-#include "PopupMenu.h"
-
-namespace WebCore {
-
-// Now we handle all of this in WebViewCore.cpp.
-PopupMenu::PopupMenu(PopupMenuClient* menuList)
-    : m_popupClient(menuList)
-{
-}
-
-PopupMenu::~PopupMenu()
-{
-}
-
-void PopupMenu::show(const IntRect&, FrameView*, int)
-{
-}
-
-void PopupMenu::hide()
-{
-}
-
-void PopupMenu::updateFromElement() 
-{
-}
-
-bool PopupMenu::itemWritingDirectionIsNatural()
-{
-    return false;
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/android/RenderThemeAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/android/RenderThemeAndroid.cpp
deleted file mode 100644
index a1e8bf61dd..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/android/RenderThemeAndroid.cpp
+++ /dev/null
@@ -1,334 +0,0 @@
-/*
- * Copyright 2006, The Android Open Source Project
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "RenderThemeAndroid.h"
-
-#include "Color.h"
-#include "FormControlElement.h"
-#include "GraphicsContext.h"
-#include "PlatformGraphicsContext.h"
-#include "RenderSkinAndroid.h"
-#include "RenderSkinButton.h"
-#include "RenderSkinCombo.h"
-#include "RenderSkinRadio.h"
-#include "SkCanvas.h"
-
-namespace WebCore {
-
-const int MAX_COMBO_HEIGHT = 20;
-
-// Add a constant amount of padding to the textsize to get the final height
-// of buttons, so that our button images are large enough to properly fit
-// the text.
-const int BUTTON_PADDING = 18;
-
-// Add padding to the fontSize of ListBoxes to get their maximum sizes.
-// Listboxes often have a specified size.  Since we change them into
-// dropdowns, we want a much smaller height, which encompasses the text.
-const int LISTBOX_PADDING = 5;
-
-// This is the color of selection in a textfield.  It was obtained by checking
-// the color of selection in TextViews in the system.
-const RGBA32 SELECTION_COLOR = makeRGB(255, 146, 0);
-
-static SkCanvas* getCanvasFromInfo(const RenderObject::PaintInfo& info)
-{
-    return info.context->platformContext()->mCanvas;
-}
-
-RenderTheme* theme()
-{
-    static RenderThemeAndroid androidTheme;
-    return &androidTheme;
-}
-
-RenderThemeAndroid::RenderThemeAndroid()
-{
-}
-
-RenderThemeAndroid::~RenderThemeAndroid()
-{
-}
-
-void RenderThemeAndroid::close()
-{
-}
-
-bool RenderThemeAndroid::stateChanged(RenderObject* obj, ControlState state) const
-{
-    if (CheckedState == state) {
-        obj->repaint();
-        return true;
-    }
-    return false;
-}
-
-Color RenderThemeAndroid::platformActiveSelectionBackgroundColor() const
-{
-    return Color(SELECTION_COLOR);
-}
-
-Color RenderThemeAndroid::platformInactiveSelectionBackgroundColor() const
-{
-    return Color(Color::transparent);
-}
-
-Color RenderThemeAndroid::platformActiveSelectionForegroundColor() const
-{
-    return Color::black;
-}
-
-Color RenderThemeAndroid::platformInactiveSelectionForegroundColor() const
-{
-    return Color::black;
-}
-
-Color RenderThemeAndroid::platformTextSearchHighlightColor() const
-{
-    return Color(Color::transparent);
-}
-
-int RenderThemeAndroid::baselinePosition(const RenderObject* obj) const
-{
-    // From the description of this function in RenderTheme.h:
-    // A method to obtain the baseline position for a "leaf" control.  This will only be used if a baseline
-    // position cannot be determined by examining child content. Checkboxes and radio buttons are examples of
-    // controls that need to do this.
-    //
-    // Our checkboxes and radio buttons need to be offset to line up properly.
-    return RenderTheme::baselinePosition(obj) - 5;
-}
-
-void RenderThemeAndroid::addIntrinsicMargins(RenderStyle* style) const
-{
-    // Cut out the intrinsic margins completely if we end up using a small font size
-    if (style->fontSize() < 11)
-        return;
-    
-    // Intrinsic margin value.
-    const int m = 2;
-    
-    // FIXME: Using width/height alone and not also dealing with min-width/max-width is flawed.
-    if (style->width().isIntrinsicOrAuto()) {
-        if (style->marginLeft().quirk())
-            style->setMarginLeft(Length(m, Fixed));
-        if (style->marginRight().quirk())
-            style->setMarginRight(Length(m, Fixed));
-    }
-
-    if (style->height().isAuto()) {
-        if (style->marginTop().quirk())
-            style->setMarginTop(Length(m, Fixed));
-        if (style->marginBottom().quirk())
-            style->setMarginBottom(Length(m, Fixed));
-    }
-}
-
-bool RenderThemeAndroid::supportsFocus(ControlPart appearance)
-{
-    switch (appearance) {
-    case PushButtonPart:
-    case ButtonPart:
-    case TextFieldPart:
-        return true;
-    default:
-        return false;
-    }
-
-    return false;
-}
-
-void RenderThemeAndroid::adjustButtonStyle(CSSStyleSelector*, RenderStyle* style, WebCore::Element*) const
-{
-    // Padding code is taken from RenderThemeSafari.cpp
-    // It makes sure we have enough space for the button text.
-    const int padding = 8;
-    style->setPaddingLeft(Length(padding, Fixed));
-    style->setPaddingRight(Length(padding, Fixed));
-    style->setMinHeight(Length(style->fontSize() + BUTTON_PADDING, Fixed));
-}
-
-bool RenderThemeAndroid::paintCheckbox(RenderObject* obj, const RenderObject::PaintInfo& info, const IntRect& rect)
-{
-    RenderSkinRadio::Draw(getCanvasFromInfo(info), obj->node(), rect, true);
-    return false;
-}
-
-bool RenderThemeAndroid::paintButton(RenderObject* obj, const RenderObject::PaintInfo& info, const IntRect& rect)
-{
-    // If it is a disabled button, simply paint it to the master picture.
-    Node* node = obj->node();
-    FormControlElement* formControlElement = toFormControlElement(static_cast<Element*>(node));
-    if (formControlElement && !formControlElement->isEnabled())
-        RenderSkinButton::Draw(getCanvasFromInfo(info), rect, RenderSkinAndroid::kDisabled);
-    else
-        // Store all the important information in the platform context.
-        info.context->platformContext()->storeButtonInfo(node, rect);
-
-    // We always return false so we do not request to be redrawn.
-    return false;
-}
-
-bool RenderThemeAndroid::paintRadio(RenderObject* obj, const RenderObject::PaintInfo& info, const IntRect& rect)
-{
-    RenderSkinRadio::Draw(getCanvasFromInfo(info), obj->node(), rect, false);
-    return false;
-}
-
-void RenderThemeAndroid::setCheckboxSize(RenderStyle* style) const
-{
-    style->setWidth(Length(19, Fixed));
-    style->setHeight(Length(19, Fixed));
-}
-
-void RenderThemeAndroid::setRadioSize(RenderStyle* style) const
-{
-    // This is the same as checkboxes.
-    setCheckboxSize(style);
-}
-
-void RenderThemeAndroid::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle* style, WebCore::Element*) const
-{
-    addIntrinsicMargins(style);
-}
-
-bool RenderThemeAndroid::paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
-{
-    return true;    
-}
-
-void RenderThemeAndroid::adjustTextAreaStyle(CSSStyleSelector*, RenderStyle* style, WebCore::Element*) const
-{
-    addIntrinsicMargins(style);
-}
-
-bool RenderThemeAndroid::paintTextArea(RenderObject* obj, const RenderObject::PaintInfo& info, const IntRect& rect)
-{
-    if (obj->isMenuList())
-        return paintCombo(obj, info, rect);
-    return true;    
-}
-
-void RenderThemeAndroid::adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
-{
-    addIntrinsicMargins(style);
-}
-
-bool RenderThemeAndroid::paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
-{
-    return true;    
-}
-
-void RenderThemeAndroid::adjustListboxStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
-{
-    style->setPaddingRight(Length(RenderSkinCombo::extraWidth(), Fixed));
-    style->setMaxHeight(Length(style->fontSize() + LISTBOX_PADDING, Fixed));
-    addIntrinsicMargins(style);
-}
-
-static void adjustMenuListStyleCommon(RenderStyle* style, Element* e)
-{
-    // Added to make room for our arrow.
-    style->setPaddingRight(Length(RenderSkinCombo::extraWidth(), Fixed));
-    // Code copied from RenderThemeMac.mm
-    // Makes sure that the text shows up on our treatment
-    bool isEnabled = true;
-    if (FormControlElement* formControlElement = toFormControlElement(e))
-        isEnabled = formControlElement->isEnabled();
-    style->setColor(isEnabled ? Color::black : Color::darkGray);
-}
-
-void RenderThemeAndroid::adjustMenuListStyle(CSSStyleSelector*, RenderStyle* style, Element* e) const
-{
-    adjustMenuListStyleCommon(style, e);
-    addIntrinsicMargins(style);
-}
-
-bool RenderThemeAndroid::paintCombo(RenderObject* obj, const RenderObject::PaintInfo& info,  const IntRect& rect)
-{
-    if (obj->style() && !obj->style()->backgroundColor().alpha())
-        return true;
-    Node* node = obj->node();
-    int height = rect.height();
-    int y = rect.y();
-    // If the combo box is too large, leave it at its max height, and center it.
-    if (height > MAX_COMBO_HEIGHT) {
-        y += (height - MAX_COMBO_HEIGHT) >> 1;
-        height = MAX_COMBO_HEIGHT;
-    }
-    return RenderSkinCombo::Draw(getCanvasFromInfo(info), node, rect.x(), y,
-            rect.width(), height);
-}
-
-bool RenderThemeAndroid::paintMenuList(RenderObject* obj, const RenderObject::PaintInfo& info, const IntRect& rect) 
-{ 
-    return paintCombo(obj, info, rect);
-}
-
-void RenderThemeAndroid::adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle* style, Element* e) const
-{
-    // Copied from RenderThemeSafari.
-    const float baseFontSize = 11.0f;
-    const int baseBorderRadius = 5;
-    float fontScale = style->fontSize() / baseFontSize;
-    
-    style->resetPadding();
-    style->setBorderRadius(IntSize(int(baseBorderRadius + fontScale - 1), int(baseBorderRadius + fontScale - 1))); // FIXME: Round up?
-
-    const int minHeight = 15;
-    style->setMinHeight(Length(minHeight, Fixed));
-    
-    style->setLineHeight(RenderStyle::initialLineHeight());
-    // Found these padding numbers by trial and error.
-    const int padding = 4;
-    style->setPaddingTop(Length(padding, Fixed));
-    style->setPaddingLeft(Length(padding, Fixed));
-    adjustMenuListStyleCommon(style, e);
-}
-
-bool RenderThemeAndroid::paintMenuListButton(RenderObject* obj, const RenderObject::PaintInfo& info, const IntRect& rect) 
-{
-    return paintCombo(obj, info, rect);
-}
-
-bool RenderThemeAndroid::supportsFocusRing(const RenderStyle* style) const
-{
-    return style->opacity() > 0
-        && style->hasAppearance() 
-        && style->appearance() != TextFieldPart 
-        && style->appearance() != SearchFieldPart 
-        && style->appearance() != TextAreaPart 
-        && style->appearance() != CheckboxPart
-        && style->appearance() != RadioPart
-        && style->appearance() != PushButtonPart
-        && style->appearance() != SquareButtonPart
-        && style->appearance() != ButtonPart
-        && style->appearance() != ButtonBevelPart
-        && style->appearance() != MenulistPart
-        && style->appearance() != MenulistButtonPart;
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/android/RenderThemeAndroid.h b/src/3rdparty/webkit/WebCore/platform/android/RenderThemeAndroid.h
deleted file mode 100644
index 056b2d68db..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/android/RenderThemeAndroid.h
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
- * Copyright 2006, The Android Open Source Project
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef RenderThemeAndroid_h
-#define RenderThemeAndroid_h
-
-#include "RenderTheme.h"
-
-namespace WebCore {
-
-class RenderSkinButton;
-class RenderSkinRadio;
-class RenderSkinCombo;
-
-struct ThemeData {
-    ThemeData()
-        : m_part(0)
-        , m_state(0)
-    {
-    }
-
-    unsigned m_part;
-    unsigned m_state;
-};
-
-class RenderThemeAndroid : public RenderTheme {
-public:
-    RenderThemeAndroid();
-    ~RenderThemeAndroid();
-    
-    virtual bool stateChanged(RenderObject*, ControlState) const;
-       
-    virtual bool supportsFocusRing(const RenderStyle*) const;
-    // A method asking if the theme's controls actually care about redrawing when hovered.
-    virtual bool supportsHover(const RenderStyle* style) const { return style->affectedByHoverRules(); }
-
-    virtual int baselinePosition(const RenderObject*) const;
-
-    virtual Color platformActiveSelectionBackgroundColor() const;
-    virtual Color platformInactiveSelectionBackgroundColor() const;
-    virtual Color platformActiveSelectionForegroundColor() const;
-    virtual Color platformInactiveSelectionForegroundColor() const;
-    virtual Color platformTextSearchHighlightColor() const;
-    
-    virtual void systemFont(int, WebCore::FontDescription&) const {}
-
-    virtual int minimumMenuListSize(RenderStyle*) const { return 0; }
-
-protected:
-    virtual bool paintCheckbox(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual void setCheckboxSize(RenderStyle*) const;
-
-    virtual bool paintRadio(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual void setRadioSize(RenderStyle*) const;
-
-    virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, WebCore::Element*) const;
-    virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-
-    virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, WebCore::Element*) const;
-    virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-
-    virtual void adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, WebCore::Element*) const;
-    virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    
-    bool paintCombo(RenderObject*, const RenderObject::PaintInfo&,  const IntRect&);
-
-    virtual void adjustListboxStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-
-    virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    
-    virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-
-private:
-    void addIntrinsicMargins(RenderStyle*) const;
-    void close();
-
-    bool supportsFocus(ControlPart);
-};
-
-} // namespace WebCore
-
-#endif // RenderThemeAndroid_h
-
diff --git a/src/3rdparty/webkit/WebCore/platform/android/ScreenAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/android/ScreenAndroid.cpp
deleted file mode 100644
index dcd2d100b5..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/android/ScreenAndroid.cpp
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
- * Copyright 2009, The Android Open Source Project
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#define LOG_TAG "WebCore"
-
-#include "config.h"
-#include "Screen.h"
-
-#include "FloatRect.h"
-#include "Widget.h"
-#include "ui/DisplayInfo.h"
-#include "ui/PixelFormat.h"
-#include "ui/SurfaceComposerClient.h"
-#undef LOG // FIXME: Still have to do this to get the log to show up
-#include "utils/Log.h"
-
-namespace WebCore {
-
-int screenDepth(Widget* page)
-{
-    android::DisplayInfo info;
-    android::SurfaceComposerClient::getDisplayInfo(android::DisplayID(0), &info);
-    return info.pixelFormatInfo.bitsPerPixel;
-}
-
-int screenDepthPerComponent(Widget* page)
-{
-    android::DisplayInfo info;
-    android::SurfaceComposerClient::getDisplayInfo(android::DisplayID(0), &info);
-    return info.pixelFormatInfo.bitsPerPixel;
-}
-
-bool screenIsMonochrome(Widget* page)
-{
-    return false;
-}
-
-#ifdef ANDROID_ORIENTATION_SUPPORT
-int Screen::orientation() const
-{
-    android::DisplayInfo info;
-    android::SurfaceComposerClient::getDisplayInfo(
-            android::DisplayID(0), &info);
-    // getDisplayInfo returns an enum describing the orientation. Map the enum
-    // to the values described here
-    // (http://developer.apple.com/documentation/AppleApplications/Reference/SafariWebContent/HandlingEvents/chapter_8_section_6.html)
-    switch (info.orientation) {
-    case android::ISurfaceComposer::eOrientationDefault:
-        return 0;
-    case android::ISurfaceComposer::eOrientation90:
-        return 90;
-    case android::ISurfaceComposer::eOrientation180:
-        return 180;
-    case android::ISurfaceComposer::eOrientation270:
-        return -90;
-    default:
-        LOGE("Bad orientation returned from getDisplayIndo %d",
-                info.orientation);
-        return 0;
-    }
-}
-#endif
-
-// The only place I have seen these values used is
-// positioning popup windows. If we support multiple windows
-// they will be most likely full screen. Therefore,
-// the accuracy of these number are not too important.
-FloatRect screenRect(Widget* page)
-{
-    android::DisplayInfo info;
-    android::SurfaceComposerClient::getDisplayInfo(android::DisplayID(0), &info);
-    return FloatRect(0.0, 0.0, info.w, info.h);
-}
-
-// Similar screenRect, this function is commonly used by javascripts
-// to position and resize windows (usually to full screen). 
-FloatRect screenAvailableRect(Widget*)
-{
-    android::DisplayInfo info;
-    android::SurfaceComposerClient::getDisplayInfo(android::DisplayID(0), &info);
-    return FloatRect(0.0, 0.0, info.w, info.h);
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/android/ScrollViewAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/android/ScrollViewAndroid.cpp
deleted file mode 100644
index 274c04f705..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/android/ScrollViewAndroid.cpp
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Copyright 2007, The Android Open Source Project
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#define LOG_TAG "WebCore"
-
-#include "config.h"
-#include "ScrollView.h"
-
-#include "FloatRect.h"
-#include "FrameView.h"
-#include "IntRect.h"
-#include "WebCoreFrameBridge.h"
-#include "WebCoreViewBridge.h"
-#include "WebViewCore.h"
-
-/*
-    This class implementation does NOT actually emulate the Qt ScrollView.
-    It does provide an implementation that khtml will use to interact with
-    WebKit's WebFrameView documentView and our NSScrollView subclass.
-
-    ScrollView's view is a NSScrollView (or subclass of NSScrollView)
-    in most cases. That scrollview is a subview of an
-    WebCoreFrameView. The WebCoreFrameView's documentView will also be
-    the scroll view's documentView.
-    
-    The WebCoreFrameView's size is the frame size.  The WebCoreFrameView's documentView
-    corresponds to the frame content size.  The scrollview itself is autosized to the
-    WebCoreFrameView's size (see Widget::resize).
-*/
-
-namespace WebCore {
-
-IntRect ScrollView::platformVisibleContentRect(bool includeScrollbars) const
-{
-    IntRect rect = platformWidget()->getBounds();
-    // This makes subframes draw correctly, since subframes cannot scroll.
-    if (parent())
-        return IntRect(0, 0, rect.width(), rect.height());
-    return rect;
-}
-
-IntSize ScrollView::platformContentsSize() const
-{
-    return m_contentsSize;
-}
-
-void ScrollView::platformSetScrollPosition(const WebCore::IntPoint& pt)
-{
-    if (parent()) // don't attempt to scroll subframes; they're fully visible
-        return;
-    android::WebViewCore::getWebViewCore(this)->scrollTo(pt.x(), pt.y());
-}
-
-void ScrollView::platformScrollbarModes(ScrollbarMode& h, ScrollbarMode& v) const
-{
-    h = v = ScrollbarAlwaysOff;
-}
-
-bool ScrollView::platformProhibitsScrolling()
-{
-    if (!isFrameView())
-        return false;
-    FrameView* view = static_cast<FrameView*>(this);
-    // We want to ignore requests to scroll that were not initiated by the user.  An
-    // example of this is when text is inserted into a textfield/area, which results in
-    // a scroll.  We ignore this because we now how to do this ourselves in the UI thread.
-    // An example of it being initiated by the user is if the user clicks an anchor
-    // element which simply scrolls the page.
-    return !android::WebFrame::getWebFrame(view->frame())->userInitiatedClick();
-}
-
-void ScrollView::platformRepaintContentRectangle(const IntRect &rect, bool now)
-{
-    android::WebViewCore::getWebViewCore(this)->contentInvalidate(rect);
-}
-
-#ifdef ANDROID_CAPTURE_OFFSCREEN_PAINTS
-void ScrollView::platformOffscreenContentRectangle(const IntRect& rect)
-{
-    android::WebViewCore::getWebViewCore(this)->offInvalidate(rect);
-}
-#endif
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp b/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp
deleted file mode 100644
index b82edaf50a..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp
+++ /dev/null
@@ -1,677 +0,0 @@
-/*
- * Copyright 2007, The Android Open Source Project
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#define LOG_TAG "WebCore"
-
-#include "config.h"
-
-#define ANDROID_COMPILE_HACK
-
-#include "AXObjectCache.h"
-#include "CString.h"
-#include "CachedPage.h"
-#include "CachedResource.h"
-#include "Clipboard.h"
-#include "Console.h"
-#include "ContextMenu.h"
-#include "ContextMenuItem.h"
-#include "CookieJar.h"
-#include "Cursor.h"
-#include "Database.h"
-#include "DocumentFragment.h"
-#include "DocumentLoader.h"
-#include "EditCommand.h"
-#include "Editor.h"
-#include "File.h"
-#include "FileList.h"
-#include "Font.h"
-#include "Frame.h"
-#include "FrameLoadRequest.h"
-#include "FrameLoader.h"
-#include "FrameView.h"
-#include "GraphicsContext.h"
-#include "HTMLFrameOwnerElement.h"
-#include "HTMLKeygenElement.h"
-#include "History.h"
-#include "Icon.h"
-#include "IconDatabase.h"
-#include "IconLoader.h"
-#include "IntPoint.h"
-#include "KURL.h"
-#include "Language.h"
-#include "LocalizedStrings.h"
-#include "MIMETypeRegistry.h"
-#include "MainResourceLoader.h"
-#include "Node.h"
-#include "NotImplemented.h"
-#include "PageCache.h"
-#include "Pasteboard.h"
-#include "Path.h"
-#include "PluginInfoStore.h"
-#include "ResourceError.h"
-#include "ResourceHandle.h"
-#include "ResourceLoader.h"
-#include "Screen.h"
-#include "Scrollbar.h"
-#include "ScrollbarTheme.h"
-#include "SmartReplace.h"
-#include "Widget.h"
-#include "loader.h"
-#include <stdio.h>
-#include <stdlib.h>
-
-#if USE(JSC)
-#include "API/JSClassRef.h"
-#include "JavaScriptCallFrame.h"
-#include "JavaScriptDebugServer.h"
-#include "JavaScriptProfile.h"
-#include "jni_utility.h"
-#endif
-
-using namespace WebCore;
-
-/********************************************************/
-/* Completely empty stubs (mostly to allow DRT to run): */
-/********************************************************/
-
-// This function is used by Javascript to find out what the default language
-// the user has selected. It is used by the JS object Navigator.language
-// I guess this information should be mapped with the Accept-Language: HTTP header.
-String WebCore::defaultLanguage()
-{
-    verifiedOk();
-    return "en";
-}
-
-namespace WebCore {
-
-#if !defined(ANDROID_PLUGINS)
-// If plugins support is turned on, don't use these stubs.
-
-// Except for supportsMIMEType(), these Plugin functions are used by javascript's
-// navigator.plugins[] object to provide the list of available plugins. This is most
-// often used with to check to see if the browser supports Flash or which video
-// codec to use.
-// The supportsMIMEType() is used by the Frame to determine if a full screen instance
-// of a plugin can be used to render a mimetype that is not native to the browser.
-PluginInfo* PluginInfoStore::createPluginInfoForPluginAtIndex(unsigned)
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-unsigned PluginInfoStore::pluginCount() const
-{
-    verifiedOk();
-    return 0;
-}
-
-String PluginInfoStore::pluginNameForMIMEType(const String&)
-{
-    notImplemented();
-    return String();
-}
-
-bool PluginInfoStore::supportsMIMEType(const String&)
-{
-    verifiedOk();
-    return false;
-}
-
-void refreshPlugins(bool)
-{
-    verifiedOk();
-}
-
-#endif // !defined(ANDROID_PLUGINS)
-
-// This function tells the bridge that a resource was loaded from the cache and thus
-// the app may update progress with the amount of data loaded.
-void CheckCacheObjectStatus(DocLoader*, CachedResource*)
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-}
-
-// This class is used in conjunction with the File Upload form element, and
-// therefore relates to the above. When a file has been selected, an icon
-// representing the file type can be rendered next to the filename on the
-// web page. The icon for the file is encapsulated within this class.
-Icon::~Icon() { }
-void Icon::paint(GraphicsContext*, const IntRect&) { }
-
-}  // namespace WebCore
-
-// FIXME, no support for spelling yet.
-Pasteboard* Pasteboard::generalPasteboard()
-{
-    return new Pasteboard();
-}
-
-void Pasteboard::writeSelection(Range*, bool, Frame*)
-{
-    notImplemented();
-}
-
-void Pasteboard::writePlainText(const String&)
-{
-    notImplemented();
-}
-
-void Pasteboard::writeURL(const KURL&, const String&, Frame*)
-{
-    notImplemented();
-}
-
-void Pasteboard::clear()
-{
-    notImplemented();
-}
-
-bool Pasteboard::canSmartReplace()
-{
-    notImplemented();
-    return false;
-}
-
-PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame*, PassRefPtr<Range>, bool, bool&)
-{
-    notImplemented();
-    return 0;
-}
-
-String Pasteboard::plainText(Frame*)
-{
-    notImplemented();
-    return String();
-}
-
-Pasteboard::Pasteboard()
-{
-    notImplemented();
-}
-
-Pasteboard::~Pasteboard()
-{
-    notImplemented();
-}
-
-
-ContextMenu::ContextMenu(const HitTestResult& result) : m_hitTestResult(result)
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-}
-
-ContextMenu::~ContextMenu()
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-}
-
-void ContextMenu::appendItem(ContextMenuItem&)
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-}
-
-void ContextMenu::setPlatformDescription(PlatformMenuDescription menu)
-{
-    ASSERT_NOT_REACHED();
-    m_platformDescription = menu;
-}
-
-PlatformMenuDescription ContextMenu::platformDescription() const
-{
-    ASSERT_NOT_REACHED();
-    return m_platformDescription;
-}
-
-ContextMenuItem::ContextMenuItem(PlatformMenuItemDescription)
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-}
-
-ContextMenuItem::ContextMenuItem(ContextMenu*)
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-}
-
-ContextMenuItem::ContextMenuItem(ContextMenuItemType, ContextMenuAction, const String&, ContextMenu*)
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-}
-
-ContextMenuItem::~ContextMenuItem()
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-}
-
-PlatformMenuItemDescription ContextMenuItem::releasePlatformDescription()
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-    return m_platformDescription;
-}
-
-ContextMenuItemType ContextMenuItem::type() const
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-    return ActionType;
-}
-
-void ContextMenuItem::setType(ContextMenuItemType)
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-}
-
-ContextMenuAction ContextMenuItem::action() const
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-    return ContextMenuItemTagNoAction;
-}
-
-void ContextMenuItem::setAction(ContextMenuAction)
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-}
-
-String ContextMenuItem::title() const
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-    return String();
-}
-
-void ContextMenuItem::setTitle(const String&)
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-}
-
-PlatformMenuDescription ContextMenuItem::platformSubMenu() const
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-    return 0;
-}
-
-void ContextMenuItem::setSubMenu(ContextMenu*)
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-}
-
-void ContextMenuItem::setChecked(bool)
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-}
-
-void ContextMenuItem::setEnabled(bool)
-{
-    ASSERT_NOT_REACHED();
-    notImplemented();
-}
-
-// systemBeep() is called by the Editor to indicate that there was nothing to copy, and may be called from
-// other places too.
-void systemBeep()
-{
-    notImplemented();
-}
-
-void* WebCore::Frame::dragImageForSelection()
-{
-    return 0;
-}
-
-
-WebCore::String WebCore::MIMETypeRegistry::getMIMETypeForExtension(WebCore::String const&)
-{
-    return WebCore::String();
-}
-
-void WebCore::Pasteboard::writeImage(WebCore::Node*, WebCore::KURL const&, WebCore::String const&) {}
-
-namespace WebCore {
-
-IntSize dragImageSize(void*)
-{
-    return IntSize(0, 0);
-}
-
-void deleteDragImage(void*) {}
-void* createDragImageFromImage(Image*)
-{
-    return 0;
-}
-
-void* dissolveDragImageToFraction(void*, float)
-{
-    return 0;
-}
-
-void* createDragImageIconForCachedImage(CachedImage*)
-{
-    return 0;
-}
-
-Cursor dummyCursor;
-const Cursor& zoomInCursor()
-{
-    return dummyCursor;
-}
-
-const Cursor& zoomOutCursor()
-{
-    return dummyCursor;
-}
-
-const Cursor& notAllowedCursor()
-{
-    return dummyCursor;
-}
-
-void* scaleDragImage(void*, FloatSize)
-{
-    return 0;
-}
-
-String searchMenuRecentSearchesText()
-{
-    return String();
-}
-
-String searchMenuNoRecentSearchesText()
-{
-    return String();
-}
-
-String searchMenuClearRecentSearchesText()
-{
-    return String();
-}
-
-Vector<String> supportedKeySizes()
-{
-    notImplemented();
-    return Vector<String>();
-}
-
-String signedPublicKeyAndChallengeString(unsigned int, String const&, WebCore::KURL const&)
-{
-    return String();
-}
-
-} // namespace WebCore
-
-namespace WebCore {
-// isCharacterSmartReplaceExempt is defined in SmartReplaceICU.cpp; in theory, we could use that one
-//      but we don't support all of the required icu functions
-bool isCharacterSmartReplaceExempt(UChar32, bool)
-{
-    notImplemented();
-    return false;
-}
-
-}  // WebCore
-
-int MakeDataExecutable;
-
-String KURL::fileSystemPath() const
-{
-    notImplemented();
-    return String();
-}
-
-
-PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String&)
-{
-    notImplemented();
-    return 0;
-}
-
-
-#if USE(JSC)
-namespace JSC { namespace Bindings {
-bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, 
-        jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValuePtr& exceptionDescription)
-{
-    notImplemented();
-    return false;
-}
-
-} }  // namespace Bindings
-#endif
-
-char* dirname(const char*)
-{
-    notImplemented();
-    return 0;
-}
-
-    // new as of SVN change 38068, Nov 5, 2008
-namespace WebCore {
-void prefetchDNS(const String&)
-{
-    notImplemented();
-}
-
-void getSupportedKeySizes(Vector<String>&)
-{
-    notImplemented();
-}
-
-PassRefPtr<Icon> Icon::createIconForFile(const String&)
-{
-    notImplemented();
-    return 0;
-}
-
-PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
-{
-    notImplemented();
-    return 0;
-}
-
-// ScrollbarTheme::nativeTheme() is called by RenderTextControl::calcPrefWidths()
-// like this: scrollbarSize = ScrollbarTheme::nativeTheme()->scrollbarThickness();
-// with this comment:
-// // FIXME: We should get the size of the scrollbar from the RenderTheme instead.
-// since our text control doesn't have scrollbars, the default size of 0 width should be
-// ok. notImplemented() is commented out below so that we can find other unresolved
-// unimplemented functions.
-ScrollbarTheme* ScrollbarTheme::nativeTheme()
-{
-    /* notImplemented(); */
-    static ScrollbarTheme theme;
-    return &theme;
-}
-
-}  // namespace WebCore
-
-FileList::FileList()
-{
-    notImplemented();
-}
-
-File* FileList::item(unsigned index) const
-{
-    notImplemented();
-    return 0;
-}
-
-AXObjectCache::~AXObjectCache()
-{
-    notImplemented();
-}
-
-// This value turns on or off the Mac specific Accessibility support.
-bool AXObjectCache::gAccessibilityEnabled = false;
-bool AXObjectCache::gAccessibilityEnhancedUserInterfaceEnabled = false;
-
-void AXObjectCache::childrenChanged(RenderObject*)
-{
-    notImplemented();
-}
-
-void AXObjectCache::remove(RenderObject*)
-{
-    notImplemented();
-}
-
-#if USE(JSC)
-using namespace JSC;
-
-
-OpaqueJSClass::~OpaqueJSClass()
-{
-    notImplemented();
-}
-
-OpaqueJSClassContextData::~OpaqueJSClassContextData()
-{
-    notImplemented();
-}
-
-// as we don't use inspector/*.cpp, add stub here.
-
-namespace WebCore {
-
-JSValuePtr toJS(ExecState*, Profile*)
-{
-    notImplemented();
-    return jsNull();
-}
-
-JSValuePtr JavaScriptCallFrame::evaluate(const UString& script, JSValuePtr& exception) const
-{
-    notImplemented();
-    return jsNull();
-}
-
-const ScopeChainNode* JavaScriptCallFrame::scopeChain() const
-{
-    notImplemented();
-    return 0;
-}
-
-JSObject* JavaScriptCallFrame::thisObject() const
-{
-    notImplemented();
-    return 0;
-}
-
-DebuggerCallFrame::Type JavaScriptCallFrame::type() const
-{
-    notImplemented();
-    return (DebuggerCallFrame::Type) 0;
-}
-
-JavaScriptCallFrame* JavaScriptCallFrame::caller()
-{
-    notImplemented();
-    return 0;
-}
-
-String JavaScriptCallFrame::functionName() const
-{
-    notImplemented();
-    return String();
-}
-
-}
-
-JavaScriptDebugServer::JavaScriptDebugServer() :
-    m_recompileTimer(this, 0)
-{
-    notImplemented();
-}
-
-JavaScriptDebugServer::~JavaScriptDebugServer()
-{
-    notImplemented();
-}
-
-JavaScriptDebugServer& JavaScriptDebugServer::shared()
-{
-    static JavaScriptDebugServer server;
-    notImplemented();
-    return server;
-}
-
-void JavaScriptDebugServer::atStatement(const DebuggerCallFrame&, int, int)
-{
-    notImplemented();
-}
-
-void JavaScriptDebugServer::callEvent(const DebuggerCallFrame&, int, int)
-{
-    notImplemented();
-}
-
-void JavaScriptDebugServer::didExecuteProgram(const DebuggerCallFrame&, int, int)
-{
-    notImplemented();
-}
-
-void JavaScriptDebugServer::didReachBreakpoint(const DebuggerCallFrame&, int, int)
-{
-    notImplemented();
-}
-
-void JavaScriptDebugServer::exception(const DebuggerCallFrame&, int, int)
-{
-    notImplemented();
-}
-
-void JavaScriptDebugServer::sourceParsed(ExecState*, const SourceCode&, int, const UString&)
-{
-    notImplemented();
-}
-
-void JavaScriptDebugServer::pageCreated(Page*)
-{
-    notImplemented();
-}
-
-void JavaScriptDebugServer::returnEvent(const DebuggerCallFrame&, int, int)
-{
-    notImplemented();
-}
-
-void JavaScriptDebugServer::willExecuteProgram(const DebuggerCallFrame&, int, int)
-{
-    notImplemented();
-}
-#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/android/WidgetAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/android/WidgetAndroid.cpp
deleted file mode 100644
index 850721de76..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/android/WidgetAndroid.cpp
+++ /dev/null
@@ -1,128 +0,0 @@
-/*
- * Copyright 2007, The Android Open Source Project
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "Widget.h"
-
-#include "Font.h"
-#include "FrameView.h"
-#include "GraphicsContext.h"
-#include "NotImplemented.h"
-#include "WebCoreFrameBridge.h"
-#include "WebCoreViewBridge.h"
-#include "WebViewCore.h"
-
-namespace WebCore {
-
-Widget::Widget(PlatformWidget widget)
-{
-    init(widget);
-}
-
-Widget::~Widget()
-{
-    ASSERT(!parent());
-    releasePlatformWidget();
-}
-
-IntRect Widget::frameRect() const
-{
-    // FIXME: use m_frame instead?
-    if (!platformWidget())
-        return IntRect(0, 0, 0, 0);
-    return platformWidget()->getBounds();
-}
-
-void Widget::setFocus()
-{
-    notImplemented();
-}
-
-void Widget::paint(GraphicsContext* ctx, const IntRect& r)
-{
-    // FIXME: in what case, will this be called for the top frame?
-    if (!platformWidget())
-        return;
-    platformWidget()->draw(ctx, r);
-}
-
-void Widget::releasePlatformWidget()
-{
-    Release(platformWidget());
-}
-
-void Widget::retainPlatformWidget()
-{
-    Retain(platformWidget());
-}
-
-void Widget::setCursor(const Cursor& cursor)
-{
-    notImplemented();
-}
-
-void Widget::show()
-{
-    notImplemented(); 
-}
-
-void Widget::hide()
-{
-    notImplemented(); 
-}
-
-void Widget::setFrameRect(const IntRect& rect)
-{
-    // FIXME: set m_frame instead?
-    // platformWidget() is NULL when called from Scrollbar
-    if (!platformWidget())
-        return;
-    platformWidget()->setLocation(rect.x(), rect.y());
-    platformWidget()->setSize(rect.width(), rect.height());
-}
-
-void Widget::setIsSelected(bool isSelected)
-{
-    notImplemented();
-}
-
-int Widget::screenWidth() const
-{
-    const Widget* widget = this;
-    while (!widget->isFrameView()) {
-        widget = widget->parent();
-        if (!widget)
-            break;
-    }
-    if (!widget)
-        return 0;
-    android::WebViewCore* core = android::WebViewCore::getWebViewCore(
-        static_cast<const ScrollView*>(widget));
-    if (!core)
-        return 0;
-    return core->screenWidth();
-}
-
-} // WebCore namepsace
diff --git a/src/3rdparty/webkit/WebCore/platform/animation/Animation.cpp b/src/3rdparty/webkit/WebCore/platform/animation/Animation.cpp
index 05761f8d39..bc33a9efed 100644
--- a/src/3rdparty/webkit/WebCore/platform/animation/Animation.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/animation/Animation.cpp
@@ -32,10 +32,12 @@ Animation::Animation()
     , m_duration(initialAnimationDuration())
     , m_timingFunction(initialAnimationTimingFunction())
     , m_direction(initialAnimationDirection())
+    , m_fillMode(initialAnimationFillMode())
     , m_playState(initialAnimationPlayState())
     , m_delaySet(false)
     , m_directionSet(false)
     , m_durationSet(false)
+    , m_fillModeSet(false)
     , m_iterationCountSet(false)
     , m_nameSet(false)
     , m_playStateSet(false)
@@ -54,10 +56,12 @@ Animation::Animation(const Animation& o)
     , m_duration(o.m_duration)
     , m_timingFunction(o.m_timingFunction)
     , m_direction(o.m_direction)
+    , m_fillMode(o.m_fillMode)
     , m_playState(o.m_playState)
     , m_delaySet(o.m_delaySet)
     , m_directionSet(o.m_directionSet)
     , m_durationSet(o.m_durationSet)
+    , m_fillModeSet(o.m_fillModeSet)
     , m_iterationCountSet(o.m_iterationCountSet)
     , m_nameSet(o.m_nameSet)
     , m_playStateSet(o.m_playStateSet)
@@ -76,11 +80,13 @@ Animation& Animation::operator=(const Animation& o)
     m_duration = o.m_duration;
     m_timingFunction = o.m_timingFunction;
     m_direction = o.m_direction;
+    m_fillMode = o.m_fillMode;
     m_playState = o.m_playState;
 
     m_delaySet = o.m_delaySet;
     m_directionSet = o.m_directionSet;
     m_durationSet = o.m_durationSet;
+    m_fillModeSet = o.m_fillModeSet;
     m_iterationCountSet = o.m_iterationCountSet;
     m_nameSet = o.m_nameSet;
     m_playStateSet = o.m_playStateSet;
@@ -107,9 +113,11 @@ bool Animation::animationsMatch(const Animation* o, bool matchPlayStates) const
                   m_duration == o->m_duration &&
                   m_timingFunction == o->m_timingFunction &&
                   m_direction == o->m_direction &&
+                  m_fillMode == o->m_fillMode &&
                   m_delaySet == o->m_delaySet &&
                   m_directionSet == o->m_directionSet &&
                   m_durationSet == o->m_durationSet &&
+                  m_fillModeSet == o->m_fillModeSet &&
                   m_iterationCountSet == o->m_iterationCountSet &&
                   m_nameSet == o->m_nameSet &&
                   m_propertySet == o->m_propertySet &&
diff --git a/src/3rdparty/webkit/WebCore/platform/animation/Animation.h b/src/3rdparty/webkit/WebCore/platform/animation/Animation.h
index 306a1b9fb6..a629f43600 100644
--- a/src/3rdparty/webkit/WebCore/platform/animation/Animation.h
+++ b/src/3rdparty/webkit/WebCore/platform/animation/Animation.h
@@ -44,6 +44,7 @@ public:
     bool isDelaySet() const { return m_delaySet; }
     bool isDirectionSet() const { return m_directionSet; }
     bool isDurationSet() const { return m_durationSet; }
+    bool isFillModeSet() const { return m_fillModeSet; }
     bool isIterationCountSet() const { return m_iterationCountSet; }
     bool isNameSet() const { return m_nameSet; }
     bool isPlayStateSet() const { return m_playStateSet; }
@@ -58,8 +59,9 @@ public:
 
     bool isEmpty() const
     {
-        return (!m_directionSet && !m_durationSet && !m_nameSet && !m_playStateSet && 
-               !m_iterationCountSet && !m_delaySet && !m_timingFunctionSet && !m_propertySet);
+        return (!m_directionSet && !m_durationSet && !m_fillModeSet
+                && !m_nameSet && !m_playStateSet && !m_iterationCountSet
+                && !m_delaySet && !m_timingFunctionSet && !m_propertySet);
     }
 
     bool isEmptyOrZeroDuration() const
@@ -70,6 +72,7 @@ public:
     void clearDelay() { m_delaySet = false; }
     void clearDirection() { m_directionSet = false; }
     void clearDuration() { m_durationSet = false; }
+    void clearFillMode() { m_fillModeSet = false; }
     void clearIterationCount() { m_iterationCountSet = false; }
     void clearName() { m_nameSet = false; }
     void clearPlayState() { m_playStateSet = AnimPlayStatePlaying; }
@@ -81,6 +84,8 @@ public:
     enum AnimationDirection { AnimationDirectionNormal, AnimationDirectionAlternate };
     AnimationDirection direction() const { return m_direction; }
 
+    unsigned fillMode() const { return m_fillMode; }
+
     double duration() const { return m_duration; }
 
     enum { IterationCountInfinite = -1 };
@@ -93,6 +98,7 @@ public:
     void setDelay(double c) { m_delay = c; m_delaySet = true; }
     void setDirection(AnimationDirection d) { m_direction = d; m_directionSet = true; }
     void setDuration(double d) { ASSERT(d >= 0); m_duration = d; m_durationSet = true; }
+    void setFillMode(unsigned f) { m_fillMode = f; m_fillModeSet = true; }
     void setIterationCount(int c) { m_iterationCount = c; m_iterationCountSet = true; }
     void setName(const String& n) { m_name = n; m_nameSet = true; }
     void setPlayState(unsigned d) { m_playState = d; m_playStateSet = true; }
@@ -110,6 +116,9 @@ public:
     bool operator==(const Animation& o) const { return animationsMatch(&o); }
     bool operator!=(const Animation& o) const { return !(*this == o); }
 
+    bool fillsBackwards() const { return m_fillModeSet && (m_fillMode == AnimationFillModeBackwards || m_fillMode == AnimationFillModeBoth); }
+    bool fillsForwards() const { return m_fillModeSet && (m_fillMode == AnimationFillModeForwards || m_fillMode == AnimationFillModeBoth); }
+
 private:
     Animation();
     Animation(const Animation& o);
@@ -121,12 +130,14 @@ private:
     double m_duration;
     TimingFunction m_timingFunction;
     AnimationDirection m_direction : 1;
+    unsigned m_fillMode : 2;
 
     unsigned m_playState     : 2;
 
     bool m_delaySet          : 1;
     bool m_directionSet      : 1;
     bool m_durationSet       : 1;
+    bool m_fillModeSet       : 1;
     bool m_iterationCountSet : 1;
     bool m_nameSet           : 1;
     bool m_playStateSet      : 1;
@@ -139,6 +150,7 @@ public:
     static float initialAnimationDelay() { return 0; }
     static AnimationDirection initialAnimationDirection() { return AnimationDirectionNormal; }
     static double initialAnimationDuration() { return 0; }
+    static unsigned initialAnimationFillMode() { return AnimationFillModeNone; }
     static int initialAnimationIterationCount() { return 1; }
     static String initialAnimationName() { return String("none"); }
     static unsigned initialAnimationPlayState() { return AnimPlayStatePlaying; }
diff --git a/src/3rdparty/webkit/WebCore/platform/animation/AnimationList.cpp b/src/3rdparty/webkit/WebCore/platform/animation/AnimationList.cpp
index 804dede9b7..bd5fdeed55 100644
--- a/src/3rdparty/webkit/WebCore/platform/animation/AnimationList.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/animation/AnimationList.cpp
@@ -37,6 +37,7 @@ void AnimationList::fillUnsetProperties()
     FILL_UNSET_PROPERTY(isDelaySet, delay, setDelay);
     FILL_UNSET_PROPERTY(isDirectionSet, direction, setDirection);
     FILL_UNSET_PROPERTY(isDurationSet, duration, setDuration);
+    FILL_UNSET_PROPERTY(isFillModeSet, fillMode, setFillMode);
     FILL_UNSET_PROPERTY(isIterationCountSet, iterationCount, setIterationCount);
     FILL_UNSET_PROPERTY(isPlayStateSet, playState, setPlayState);
     FILL_UNSET_PROPERTY(isNameSet, name, setName);
diff --git a/src/3rdparty/webkit/WebCore/platform/animation/AnimationList.h b/src/3rdparty/webkit/WebCore/platform/animation/AnimationList.h
index 990142495d..afad42271e 100644
--- a/src/3rdparty/webkit/WebCore/platform/animation/AnimationList.h
+++ b/src/3rdparty/webkit/WebCore/platform/animation/AnimationList.h
@@ -31,7 +31,7 @@
 
 namespace WebCore {
 
-class AnimationList {
+class AnimationList : public FastAllocBase {
 public:
     void fillUnsetProperties();
     bool operator==(const AnimationList& o) const;
diff --git a/src/3rdparty/webkit/WebCore/platform/animation/TimingFunction.h b/src/3rdparty/webkit/WebCore/platform/animation/TimingFunction.h
index f1145960a5..d3f71ff2b1 100644
--- a/src/3rdparty/webkit/WebCore/platform/animation/TimingFunction.h
+++ b/src/3rdparty/webkit/WebCore/platform/animation/TimingFunction.h
@@ -29,7 +29,7 @@
 
 namespace WebCore {
 
-struct TimingFunction {
+struct TimingFunction : FastAllocBase {
     TimingFunction()
         : m_type(CubicBezierTimingFunction)
         , m_x1(0.25)
@@ -39,6 +39,16 @@ struct TimingFunction {
     {
     }
 
+    // This explicit copy constructor works around an inlining bug in GCC 4.2 (only reproed on mac, but may exist on other platforms).
+    TimingFunction(const TimingFunction& that)
+        : m_type(that.m_type)
+        , m_x1(that.m_x1)
+        , m_y1(that.m_y1)
+        , m_x2(that.m_x2)
+        , m_y2(that.m_y2)
+    {
+    }
+
     TimingFunction(ETimingFunctionType timingFunction, double x1 = 0.0, double y1 = 0.0, double x2 = 1.0, double y2 = 1.0)
         : m_type(timingFunction)
         , m_x1(x1)
diff --git a/src/3rdparty/webkit/WebCore/platform/cf/BinaryPropertyList.cpp b/src/3rdparty/webkit/WebCore/platform/cf/BinaryPropertyList.cpp
new file mode 100644
index 0000000000..f0facaec07
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/cf/BinaryPropertyList.cpp
@@ -0,0 +1,832 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "BinaryPropertyList.h"
+
+#include "StringHash.h"
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <limits>
+
+using namespace std;
+
+namespace WebCore {
+
+static const size_t headerSize = 8;
+static const size_t trailerSize = 32;
+
+static const UInt8 booleanTrueMarkerByte = 0x09;
+static const UInt8 oneByteIntegerMarkerByte = 0x10;
+static const UInt8 twoByteIntegerMarkerByte = 0x11;
+static const UInt8 fourByteIntegerMarkerByte = 0x12;
+static const UInt8 eightByteIntegerMarkerByte = 0x13;
+static const UInt8 asciiStringMarkerByte = 0x50;
+static const UInt8 asciiStringWithSeparateLengthMarkerByte = 0x5F;
+static const UInt8 unicodeStringMarkerByte = 0x60;
+static const UInt8 unicodeStringWithSeparateLengthMarkerByte = 0x6F;
+static const UInt8 arrayMarkerByte = 0xA0;
+static const UInt8 arrayWithSeparateLengthMarkerByte = 0xAF;
+static const UInt8 dictionaryMarkerByte = 0xD0;
+static const UInt8 dictionaryWithSeparateLengthMarkerByte = 0xDF;
+static const size_t maxLengthInMarkerByte = 0xE;
+
+class IntegerArray {
+public:
+    IntegerArray() : m_integers(0), m_size(0) { }
+    IntegerArray(const int* integers, size_t size) : m_integers(integers), m_size(size) { ASSERT(integers); ASSERT(size); }
+
+    void markDeleted() { m_integers = 0; m_size = deletedValueSize(); }
+    bool isDeletedValue() const { return m_size == deletedValueSize(); }
+
+    const int* integers() const { ASSERT(!isDeletedValue()); return m_integers; }
+    size_t size() const { ASSERT(!isDeletedValue()); return m_size; }
+
+private:
+    static size_t deletedValueSize() { return numeric_limits<size_t>::max(); }
+
+    friend bool operator==(const IntegerArray&, const IntegerArray&);
+
+    const int* m_integers;
+    size_t m_size;
+};
+
+inline bool operator==(const IntegerArray& a, const IntegerArray& b)
+{
+    return a.m_integers == b.m_integers &&  a.m_size == b.m_size;
+}
+
+struct IntegerArrayHashTraits : WTF::GenericHashTraits<IntegerArray> {
+    static const bool needsDestruction = false;
+    static void constructDeletedValue(IntegerArray& slot) { slot.markDeleted(); }
+    static bool isDeletedValue(const IntegerArray& array) { return array.isDeletedValue(); }
+};
+
+struct IntegerArrayHash {
+    static unsigned hash(const IntegerArray&);
+    static bool equal(const IntegerArray&, const IntegerArray&);
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+unsigned IntegerArrayHash::hash(const IntegerArray& array)
+{
+    return StringImpl::computeHash(reinterpret_cast<const UChar*>(array.integers()), array.size() / (sizeof(int) / sizeof(UChar)));
+}
+
+bool IntegerArrayHash::equal(const IntegerArray& a, const IntegerArray& b)
+{
+    if (a.isDeletedValue() || b.isDeletedValue())
+        return a.isDeletedValue() == b.isDeletedValue();
+    if (a.size() != b.size())
+        return false;
+    for (size_t i = 0; i < a.size(); ++i) {
+        if (a.integers()[i] != b.integers()[i])
+            return false;
+    }
+    return true;
+}
+
+typedef size_t ObjectReference;
+
+class BinaryPropertyListPlan : private BinaryPropertyListObjectStream {
+public:
+    BinaryPropertyListPlan(BinaryPropertyListWriter&);
+
+    ObjectReference booleanTrueObjectReference() const;
+    ObjectReference integerObjectReference(int) const;
+    ObjectReference stringObjectReference(const String&) const;
+    ObjectReference integerArrayObjectReference(const int*, size_t) const;
+
+    ObjectReference objectCount() const { return m_currentObjectReference; }
+
+    ObjectReference byteCount() const { return m_byteCount; }
+    ObjectReference objectReferenceCount() const { return m_objectReferenceCount; }
+
+private:
+    virtual void writeBooleanTrue();
+    virtual void writeInteger(int);
+    virtual void writeString(const String&);
+    virtual void writeIntegerArray(const int*, size_t);
+    virtual void writeUniqueString(const String&);
+    virtual void writeUniqueString(const char*);
+    virtual size_t writeArrayStart();
+    virtual void writeArrayEnd(size_t);
+    virtual size_t writeDictionaryStart();
+    virtual void writeDictionaryEnd(size_t);
+
+    void writeArrayObject(size_t);
+    void writeDictionaryObject(size_t);
+    void writeStringObject(const String&);
+    void writeStringObject(const char*);
+
+    static ObjectReference invalidObjectReference() { return numeric_limits<ObjectReference>::max(); }
+
+    typedef HashMap<IntegerArray, ObjectReference, IntegerArrayHash, IntegerArrayHashTraits> IntegerArrayMap;
+
+    ObjectReference m_booleanTrueObjectReference;
+    ObjectReference m_integerZeroObjectReference;
+    HashMap<int, ObjectReference> m_integers;
+    HashMap<String, ObjectReference> m_strings;
+    IntegerArrayMap m_integerArrays;
+
+    ObjectReference m_currentObjectReference;
+
+    size_t m_currentAggregateSize;
+
+    size_t m_byteCount;
+    size_t m_objectReferenceCount;
+};
+
+BinaryPropertyListPlan::BinaryPropertyListPlan(BinaryPropertyListWriter& client)
+    : m_booleanTrueObjectReference(invalidObjectReference())
+    , m_integerZeroObjectReference(invalidObjectReference())
+    , m_currentObjectReference(0)
+    , m_currentAggregateSize(0)
+    , m_byteCount(0)
+    , m_objectReferenceCount(0)
+{
+    client.writeObjects(*this);
+    ASSERT(m_currentAggregateSize == 1);
+}
+
+void BinaryPropertyListPlan::writeBooleanTrue()
+{
+    ++m_currentAggregateSize;
+    if (m_booleanTrueObjectReference != invalidObjectReference())
+        return;
+    m_booleanTrueObjectReference = m_currentObjectReference++;
+    ++m_byteCount;
+}
+
+static inline int integerByteCount(size_t integer)
+{
+    if (integer <= 0xFF)
+        return 2;
+    if (integer <= 0xFFFF)
+        return 3;
+#ifdef __LP64__
+    if (integer <= 0xFFFFFFFFULL)
+        return 5;
+    return 9;
+#else
+    return 5;
+#endif
+}
+
+void BinaryPropertyListPlan::writeInteger(int integer)
+{
+    ASSERT(integer >= 0);
+    ++m_currentAggregateSize;
+    if (!integer) {
+        if (m_integerZeroObjectReference != invalidObjectReference())
+            return;
+        m_integerZeroObjectReference = m_currentObjectReference;
+    } else {
+        if (!m_integers.add(integer, m_currentObjectReference).second)
+            return;
+    }
+    ++m_currentObjectReference;
+    m_byteCount += integerByteCount(integer);
+}
+
+void BinaryPropertyListPlan::writeString(const String& string)
+{
+    ++m_currentAggregateSize;
+    if (!m_strings.add(string, m_currentObjectReference).second)
+        return;
+    ++m_currentObjectReference;
+    writeStringObject(string);
+}
+
+void BinaryPropertyListPlan::writeIntegerArray(const int* integers, size_t size)
+{
+    size_t savedAggregateSize = ++m_currentAggregateSize;
+    ASSERT(size);
+    pair<IntegerArrayMap::iterator, bool> addResult = m_integerArrays.add(IntegerArray(integers, size), 0);
+    if (!addResult.second)
+        return;
+    for (size_t i = 0; i < size; ++i)
+        writeInteger(integers[i]);
+    addResult.first->second = m_currentObjectReference++;
+    writeArrayObject(size);
+    m_currentAggregateSize = savedAggregateSize;
+}
+
+void BinaryPropertyListPlan::writeUniqueString(const String& string)
+{
+    ++m_currentAggregateSize;
+    ++m_currentObjectReference;
+    writeStringObject(string);
+}
+
+void BinaryPropertyListPlan::writeUniqueString(const char* string)
+{
+    ++m_currentAggregateSize;
+    ++m_currentObjectReference;
+    writeStringObject(string);
+}
+
+size_t BinaryPropertyListPlan::writeArrayStart()
+{
+    size_t savedAggregateSize = m_currentAggregateSize;
+    m_currentAggregateSize = 0;
+    return savedAggregateSize;
+}
+
+void BinaryPropertyListPlan::writeArrayEnd(size_t savedAggregateSize)
+{
+    ++m_currentObjectReference;
+    writeArrayObject(m_currentAggregateSize);
+    m_currentAggregateSize = savedAggregateSize + 1;
+}
+
+size_t BinaryPropertyListPlan::writeDictionaryStart()
+{
+    size_t savedAggregateSize = m_currentAggregateSize;
+    m_currentAggregateSize = 0;
+    return savedAggregateSize;
+}
+
+void BinaryPropertyListPlan::writeDictionaryEnd(size_t savedAggregateSize)
+{
+    ++m_currentObjectReference;
+    writeDictionaryObject(m_currentAggregateSize);
+    m_currentAggregateSize = savedAggregateSize + 1;
+}
+
+static size_t markerPlusLengthByteCount(size_t length)
+{
+    if (length <= maxLengthInMarkerByte)
+        return 1;
+    return 1 + integerByteCount(length);
+}
+
+void BinaryPropertyListPlan::writeStringObject(const String& string)
+{
+    const UChar* characters = string.characters();
+    unsigned length = string.length();
+    m_byteCount += markerPlusLengthByteCount(length) + length;
+    if (!charactersAreAllASCII(characters, length))
+        m_byteCount += length;
+}
+
+void BinaryPropertyListPlan::writeStringObject(const char* string)
+{
+    unsigned length = strlen(string);
+    m_byteCount += markerPlusLengthByteCount(length) + length;
+}
+
+void BinaryPropertyListPlan::writeArrayObject(size_t size)
+{
+    ASSERT(size);
+    m_byteCount += markerPlusLengthByteCount(size);
+    m_objectReferenceCount += size;
+}
+
+void BinaryPropertyListPlan::writeDictionaryObject(size_t size)
+{
+    ASSERT(size);
+    ASSERT(!(size & 1));
+    m_byteCount += markerPlusLengthByteCount(size / 2);
+    m_objectReferenceCount += size;
+}
+
+ObjectReference BinaryPropertyListPlan::booleanTrueObjectReference() const
+{
+    ASSERT(m_booleanTrueObjectReference != invalidObjectReference());
+    return m_booleanTrueObjectReference;
+}
+
+ObjectReference BinaryPropertyListPlan::integerObjectReference(int integer) const
+{
+    ASSERT(integer >= 0);
+    if (!integer) {
+        ASSERT(m_integerZeroObjectReference != invalidObjectReference());
+        return m_integerZeroObjectReference;
+    }
+    ASSERT(m_integers.contains(integer));
+    return m_integers.get(integer);
+}
+
+ObjectReference BinaryPropertyListPlan::stringObjectReference(const String& string) const
+{
+    ASSERT(m_strings.contains(string));
+    return m_strings.get(string);
+}
+
+ObjectReference BinaryPropertyListPlan::integerArrayObjectReference(const int* integers, size_t size) const
+{
+    ASSERT(m_integerArrays.contains(IntegerArray(integers, size)));
+    return m_integerArrays.get(IntegerArray(integers, size));
+}
+
+class BinaryPropertyListSerializer : private BinaryPropertyListObjectStream {
+public:
+    BinaryPropertyListSerializer(BinaryPropertyListWriter&);
+
+private:
+    virtual void writeBooleanTrue();
+    virtual void writeInteger(int);
+    virtual void writeString(const String&);
+    virtual void writeIntegerArray(const int*, size_t);
+    virtual void writeUniqueString(const String&);
+    virtual void writeUniqueString(const char*);
+    virtual size_t writeArrayStart();
+    virtual void writeArrayEnd(size_t);
+    virtual size_t writeDictionaryStart();
+    virtual void writeDictionaryEnd(size_t);
+
+    ObjectReference writeIntegerWithoutAddingAggregateObjectReference(int);
+
+    void appendIntegerObject(int);
+    void appendStringObject(const String&);
+    void appendStringObject(const char*);
+    void appendIntegerArrayObject(const int*, size_t);
+
+    void appendByte(unsigned char);
+    void appendByte(unsigned);
+    void appendByte(unsigned long);
+    void appendByte(int);
+
+    void appendInteger(size_t);
+
+    void appendObjectReference(ObjectReference);
+
+    void addAggregateObjectReference(ObjectReference);
+
+    void startObject();
+
+    const BinaryPropertyListPlan m_plan;
+    const int m_objectReferenceSize;
+    const size_t m_offsetTableStart;
+    const int m_offsetSize;
+    const size_t m_bufferSize;
+    UInt8* const m_buffer;
+
+    UInt8* m_currentByte;
+    ObjectReference m_currentObjectReference;
+    UInt8* m_currentAggregateBufferByte;
+};
+
+inline void BinaryPropertyListSerializer::appendByte(unsigned char byte)
+{
+    *m_currentByte++ = byte;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+}
+
+inline void BinaryPropertyListSerializer::appendByte(unsigned byte)
+{
+    *m_currentByte++ = byte;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+}
+
+inline void BinaryPropertyListSerializer::appendByte(unsigned long byte)
+{
+    *m_currentByte++ = byte;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+}
+
+inline void BinaryPropertyListSerializer::appendByte(int byte)
+{
+    *m_currentByte++ = byte;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+}
+
+static int bytesNeeded(size_t count)
+{
+    ASSERT(count);
+    int bytesNeeded = 1;
+    for (size_t mask = numeric_limits<size_t>::max() << 8; count & mask; mask <<= 8)
+        ++bytesNeeded;
+    return bytesNeeded;
+}
+
+static inline void storeLength(UInt8* destination, size_t length)
+{
+#ifdef __LP64__
+    destination[0] = length >> 56;
+    destination[1] = length >> 48;
+    destination[2] = length >> 40;
+    destination[3] = length >> 32;
+#else
+    destination[0] = 0;
+    destination[1] = 0;
+    destination[2] = 0;
+    destination[3] = 0;
+#endif
+    destination[4] = length >> 24;
+    destination[5] = length >> 16;
+    destination[6] = length >> 8;
+    destination[7] = length;
+}
+
+// Like memmove, but reverses the bytes.
+static void moveAndReverseBytes(UInt8* destination, const UInt8* source, size_t length)
+{
+    ASSERT(length);
+    memmove(destination, source, length);
+    UInt8* start = destination;
+    UInt8* end = destination + length;
+    while (end - start > 1)
+        std::swap(*start++, *--end);
+}
+
+// The serializer uses a single buffer for the property list.
+// The buffer contains:
+//
+//    8-byte header
+//    object data
+//    offset table
+//    32-byte trailer
+//
+// While serializing object, the offset table entry for each object is written just before
+// the object data for that object is written. Aggregates, arrays and dictionaries, are a
+// special case. The objects that go into an aggregate are written before the aggregate is.
+// As each object is written, the object reference is put in the aggregate buffer. Then,
+// when the aggregate is written, the aggregate buffer is copied into place in the object
+// data. Finally, the header and trailer are written.
+//
+// The aggregate buffer shares space with the object data, like this:
+//
+//    8-byte header
+//    object data
+//    >>> aggregate buffer <<<
+//    offset table
+//    32-byte trailer
+//
+// To make it easy to build it incrementally, the buffer starts at the end of the object
+// data space, and grows backwards. We're guaranteed the aggregate buffer will never collide
+// with the object data pointer because we know that the object data is correctly sized
+// based on our plan, and all the data in the aggregate buffer will be used to create the
+// actual aggregate objects; in the worst case the aggregate buffer will already be in
+// exactly the right place, but backwards.
+
+BinaryPropertyListSerializer::BinaryPropertyListSerializer(BinaryPropertyListWriter& client)
+    : m_plan(client)
+    , m_objectReferenceSize(bytesNeeded(m_plan.objectCount()))
+    , m_offsetTableStart(headerSize + m_plan.byteCount() + m_plan.objectReferenceCount() * m_objectReferenceSize)
+    , m_offsetSize(bytesNeeded(m_offsetTableStart))
+    , m_bufferSize(m_offsetTableStart + m_plan.objectCount() * m_offsetSize + trailerSize)
+    , m_buffer(client.buffer(m_bufferSize))
+    , m_currentObjectReference(0)
+{
+    ASSERT(m_objectReferenceSize > 0);
+    ASSERT(m_offsetSize > 0);
+
+#ifdef __LP64__
+    ASSERT(m_objectReferenceSize <= 8);
+    ASSERT(m_offsetSize <= 8);
+#else
+    ASSERT(m_objectReferenceSize <= 4);
+    ASSERT(m_offsetSize <= 4);
+#endif
+
+    if (!m_buffer)
+        return;
+
+    // Write objects and offset table.
+    m_currentByte = m_buffer + headerSize;
+    m_currentAggregateBufferByte = m_buffer + m_offsetTableStart;
+    client.writeObjects(*this);
+    ASSERT(m_currentObjectReference == m_plan.objectCount());
+    ASSERT(m_currentAggregateBufferByte == m_buffer + m_offsetTableStart);
+    ASSERT(m_currentByte == m_buffer + m_offsetTableStart);
+
+    // Write header.
+    memcpy(m_buffer, "bplist00", headerSize);
+
+    // Write trailer.
+    UInt8* trailer = m_buffer + m_bufferSize - trailerSize;
+    memset(trailer, 0, 6);
+    trailer[6] = m_offsetSize;
+    trailer[7] = m_objectReferenceSize;
+    storeLength(trailer + 8, m_plan.objectCount());
+    storeLength(trailer + 16, m_plan.objectCount() - 1);
+    storeLength(trailer + 24, m_offsetTableStart);
+}
+
+void BinaryPropertyListSerializer::writeBooleanTrue()
+{
+    ObjectReference reference = m_plan.booleanTrueObjectReference();
+    if (m_currentObjectReference != reference)
+        ASSERT(reference < m_currentObjectReference);
+    else {
+        startObject();
+        appendByte(booleanTrueMarkerByte);
+    }
+    addAggregateObjectReference(reference);
+}
+
+inline ObjectReference BinaryPropertyListSerializer::writeIntegerWithoutAddingAggregateObjectReference(int integer)
+{
+    ObjectReference reference = m_plan.integerObjectReference(integer);
+    if (m_currentObjectReference != reference)
+        ASSERT(reference < m_currentObjectReference);
+    else
+        appendIntegerObject(integer);
+    return reference;
+}
+
+void BinaryPropertyListSerializer::writeInteger(int integer)
+{
+    addAggregateObjectReference(writeIntegerWithoutAddingAggregateObjectReference(integer));
+}
+
+void BinaryPropertyListSerializer::writeString(const String& string)
+{
+    ObjectReference reference = m_plan.stringObjectReference(string);
+    if (m_currentObjectReference != reference)
+        ASSERT(reference < m_currentObjectReference);
+    else
+        appendStringObject(string);
+    addAggregateObjectReference(reference);
+}
+
+void BinaryPropertyListSerializer::writeIntegerArray(const int* integers, size_t size)
+{
+    ObjectReference reference = m_plan.integerArrayObjectReference(integers, size);
+    for (size_t i = 0; i < size; ++i)
+        writeIntegerWithoutAddingAggregateObjectReference(integers[i]);
+    if (m_currentObjectReference != reference)
+        ASSERT(reference < m_currentObjectReference);
+    else
+        appendIntegerArrayObject(integers, size);
+    addAggregateObjectReference(reference);
+}
+
+void BinaryPropertyListSerializer::writeUniqueString(const char* string)
+{
+    addAggregateObjectReference(m_currentObjectReference);
+    appendStringObject(string);
+}
+
+void BinaryPropertyListSerializer::writeUniqueString(const String& string)
+{
+    addAggregateObjectReference(m_currentObjectReference);
+    appendStringObject(string);
+}
+
+size_t BinaryPropertyListSerializer::writeArrayStart()
+{
+    return m_currentAggregateBufferByte - m_buffer;
+}
+
+void BinaryPropertyListSerializer::writeArrayEnd(size_t savedAggregateBufferOffset)
+{
+    ObjectReference reference = m_currentObjectReference;
+    startObject();
+    size_t aggregateBufferByteCount = savedAggregateBufferOffset - (m_currentAggregateBufferByte - m_buffer);
+    ASSERT(aggregateBufferByteCount);
+    ASSERT(!(aggregateBufferByteCount % m_objectReferenceSize));
+    size_t size = aggregateBufferByteCount / m_objectReferenceSize;
+    if (size <= maxLengthInMarkerByte)
+        appendByte(arrayMarkerByte | size);
+    else {
+        appendByte(arrayWithSeparateLengthMarkerByte);
+        appendInteger(size);
+    }
+    m_currentAggregateBufferByte = m_buffer + savedAggregateBufferOffset;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+    moveAndReverseBytes(m_currentByte, m_currentAggregateBufferByte - aggregateBufferByteCount, aggregateBufferByteCount);
+    m_currentByte += aggregateBufferByteCount;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+    if (m_currentObjectReference < m_plan.objectCount())
+        addAggregateObjectReference(reference);
+    else
+        ASSERT(m_currentObjectReference == m_plan.objectCount());
+}
+
+size_t BinaryPropertyListSerializer::writeDictionaryStart()
+{
+    return m_currentAggregateBufferByte - m_buffer;
+}
+
+void BinaryPropertyListSerializer::writeDictionaryEnd(size_t savedAggregateBufferOffset)
+{
+    ObjectReference reference = m_currentObjectReference;
+    startObject();
+    size_t aggregateBufferByteCount = savedAggregateBufferOffset - (m_currentAggregateBufferByte - m_buffer);
+    ASSERT(aggregateBufferByteCount);
+    ASSERT(!(aggregateBufferByteCount % (m_objectReferenceSize * 2)));
+    size_t size = aggregateBufferByteCount / (m_objectReferenceSize * 2);
+    if (size <= maxLengthInMarkerByte)
+        appendByte(dictionaryMarkerByte | size);
+    else {
+        appendByte(dictionaryWithSeparateLengthMarkerByte);
+        appendInteger(size);
+    }
+    m_currentAggregateBufferByte = m_buffer + savedAggregateBufferOffset;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+    moveAndReverseBytes(m_currentByte, m_currentAggregateBufferByte - aggregateBufferByteCount, aggregateBufferByteCount);
+    m_currentByte += aggregateBufferByteCount;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+    if (m_currentObjectReference != m_plan.objectCount())
+        addAggregateObjectReference(reference);
+    else
+        ASSERT(m_currentObjectReference == m_plan.objectCount());
+}
+
+void BinaryPropertyListSerializer::appendIntegerObject(int integer)
+{
+    startObject();
+    ASSERT(integer >= 0);
+    appendInteger(integer);
+}
+
+void BinaryPropertyListSerializer::appendInteger(size_t integer)
+{
+    if (integer <= 0xFF) {
+        appendByte(oneByteIntegerMarkerByte);
+        appendByte(integer);
+        return;
+    }
+    if (integer <= 0xFFFF) {
+        appendByte(twoByteIntegerMarkerByte);
+        appendByte(integer >> 8);
+        appendByte(integer);
+        return;
+    }
+#ifdef __LP64__
+    if (integer <= 0xFFFFFFFFULL) {
+#endif
+        appendByte(fourByteIntegerMarkerByte);
+        appendByte(integer >> 24);
+        appendByte(integer >> 16);
+        appendByte(integer >> 8);
+        appendByte(integer);
+#ifdef __LP64__
+        return;
+    }
+    appendByte(eightByteIntegerMarkerByte);
+    appendByte(integer >> 56);
+    appendByte(integer >> 48);
+    appendByte(integer >> 40);
+    appendByte(integer >> 32);
+    appendByte(integer >> 24);
+    appendByte(integer >> 16);
+    appendByte(integer >> 8);
+    appendByte(integer);
+#endif
+}
+
+void BinaryPropertyListSerializer::appendStringObject(const String& string)
+{
+    startObject();
+    const UChar* characters = string.characters();
+    unsigned length = string.length();
+    if (charactersAreAllASCII(characters, length)) {
+        if (length <= maxLengthInMarkerByte)
+            appendByte(asciiStringMarkerByte | length);
+        else {
+            appendByte(asciiStringWithSeparateLengthMarkerByte);
+            appendInteger(length);
+        }
+        for (unsigned i = 0; i < length; ++i)
+            appendByte(characters[i]);
+    } else {
+        if (length <= maxLengthInMarkerByte)
+            appendByte(unicodeStringMarkerByte | length);
+        else {
+            appendByte(unicodeStringWithSeparateLengthMarkerByte);
+            appendInteger(length);
+        }
+        for (unsigned i = 0; i < length; ++i) {
+            appendByte(characters[i] >> 8);
+            appendByte(characters[i]);
+        }
+    }
+}
+
+void BinaryPropertyListSerializer::appendStringObject(const char* string)
+{
+    startObject();
+    unsigned length = strlen(string);
+    if (length <= maxLengthInMarkerByte)
+        appendByte(asciiStringMarkerByte | length);
+    else {
+        appendByte(asciiStringWithSeparateLengthMarkerByte);
+        appendInteger(length);
+    }
+    for (unsigned i = 0; i < length; ++i)
+        appendByte(string[i]);
+}
+
+void BinaryPropertyListSerializer::appendIntegerArrayObject(const int* integers, size_t size)
+{
+    startObject();
+    if (size <= maxLengthInMarkerByte)
+        appendByte(arrayMarkerByte | size);
+    else {
+        appendByte(arrayWithSeparateLengthMarkerByte);
+        appendInteger(size);
+    }
+    for (unsigned i = 0; i < size; ++i)
+        appendObjectReference(m_plan.integerObjectReference(integers[i]));
+}
+
+void BinaryPropertyListSerializer::appendObjectReference(ObjectReference reference)
+{
+    switch (m_objectReferenceSize) {
+#ifdef __LP64__
+        case 8:
+            appendByte(reference >> 56);
+        case 7:
+            appendByte(reference >> 48);
+        case 6:
+            appendByte(reference >> 40);
+        case 5:
+            appendByte(reference >> 32);
+#endif
+        case 4:
+            appendByte(reference >> 24);
+        case 3:
+            appendByte(reference >> 16);
+        case 2:
+            appendByte(reference >> 8);
+        case 1:
+            appendByte(reference);
+    }
+}
+
+void BinaryPropertyListSerializer::startObject()
+{
+    ObjectReference reference = m_currentObjectReference++;
+
+    size_t offset = m_currentByte - m_buffer;
+
+    UInt8* offsetTableEntry = m_buffer + m_offsetTableStart + reference * m_offsetSize + m_offsetSize;
+    switch (m_offsetSize) {
+#ifdef __LP64__
+        case 8:
+            offsetTableEntry[-8] = offset >> 56;
+        case 7:
+            offsetTableEntry[-7] = offset >> 48;
+        case 6:
+            offsetTableEntry[-6] = offset >> 40;
+        case 5:
+            offsetTableEntry[-5] = offset >> 32;
+#endif
+        case 4:
+            offsetTableEntry[-4] = offset >> 24;
+        case 3:
+            offsetTableEntry[-3] = offset >> 16;
+        case 2:
+            offsetTableEntry[-2] = offset >> 8;
+        case 1:
+            offsetTableEntry[-1] = offset;
+    }
+}
+
+void BinaryPropertyListSerializer::addAggregateObjectReference(ObjectReference reference)
+{
+    switch (m_objectReferenceSize) {
+#ifdef __LP64__
+        case 8:
+            *--m_currentAggregateBufferByte = reference >> 56;
+        case 7:
+            *--m_currentAggregateBufferByte = reference >> 48;
+        case 6:
+            *--m_currentAggregateBufferByte = reference >> 40;
+        case 5:
+            *--m_currentAggregateBufferByte = reference >> 32;
+#endif
+        case 4:
+            *--m_currentAggregateBufferByte = reference >> 24;
+        case 3:
+            *--m_currentAggregateBufferByte = reference >> 16;
+        case 2:
+            *--m_currentAggregateBufferByte = reference >> 8;
+        case 1:
+            *--m_currentAggregateBufferByte = reference;
+    }
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+}
+
+void BinaryPropertyListWriter::writePropertyList()
+{
+    BinaryPropertyListSerializer(*this);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/cf/BinaryPropertyList.h b/src/3rdparty/webkit/WebCore/platform/cf/BinaryPropertyList.h
new file mode 100644
index 0000000000..a930b43f29
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/cf/BinaryPropertyList.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef BinaryPropertyList_h
+#define BinaryPropertyList_h
+
+#include <CoreFoundation/CoreFoundation.h>
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class String;
+
+// Writes a limited subset of binary property lists.
+// Covers only what's needed for writing browser history as of this writing.
+class BinaryPropertyListObjectStream {
+public:
+    // Call writeBooleanTrue to write the boolean true value.
+    // A single shared object will be used in the serialized list.
+    virtual void writeBooleanTrue() = 0;
+
+    // Call writeInteger to write an integer value.
+    // A single shared object will be used for each integer in the serialized list.
+    virtual void writeInteger(int) = 0;
+
+    // Call writeString to write a string value.
+    // A single shared object will be used for each string in the serialized list.
+    virtual void writeString(const String&) = 0;
+
+    // Call writeUniqueString instead of writeString when it's unlikely the
+    // string will be written twice in the same property list; this saves hash
+    // table overhead for such strings. A separate object will be used for each
+    // of these strings in the serialized list.
+    virtual void writeUniqueString(const String&) = 0;
+    virtual void writeUniqueString(const char*) = 0;
+
+    // Call writeIntegerArray instead of writeArrayStart/writeArrayEnd for
+    // arrays entirely composed of integers. A single shared object will be used
+    // for each identical array in the serialized list. Warning: The integer
+    // pointer must remain valid until the writeBinaryPropertyList function
+    // returns, because these lists are put into a hash table without copying
+    // them -- that's OK if the client already has a Vector<int>.
+    virtual void writeIntegerArray(const int*, size_t) = 0;
+
+    // After calling writeArrayStart, write array elements.
+    // Then call writeArrayEnd, passing in the result from writeArrayStart.
+    // A separate object will be used for each of these arrays in the serialized list.
+    virtual size_t writeArrayStart() = 0;
+    virtual void writeArrayEnd(size_t resultFromWriteArrayStart) = 0;
+
+    // After calling writeDictionaryStart, write all keys, then all values.
+    // Then call writeDictionaryEnd, passing in the result from writeDictionaryStart.
+    // A separate object will be used for each dictionary in the serialized list.
+    virtual size_t writeDictionaryStart() = 0;
+    virtual void writeDictionaryEnd(size_t resultFromWriteDictionaryStart) = 0;
+
+protected:
+    virtual ~BinaryPropertyListObjectStream() { }
+};
+
+class BinaryPropertyListWriter {
+public:
+    // Calls writeObjects once to prepare for writing and determine how big a
+    // buffer is required. Then calls buffer to get the appropriately-sized
+    // buffer, then calls writeObjects a second time and writes the property list.
+    void writePropertyList();
+
+protected:
+    virtual ~BinaryPropertyListWriter() { }
+
+private:
+    // Called by writePropertyList.
+    // Must call the object stream functions for the objects to be written
+    // into the property list.
+    virtual void writeObjects(BinaryPropertyListObjectStream&) = 0;
+
+    // Called by writePropertyList.
+    // Returns the buffer that the writer should write into.
+    virtual UInt8* buffer(size_t) = 0;
+
+    friend class BinaryPropertyListPlan;
+    friend class BinaryPropertyListSerializer;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/cf/FileSystemCF.cpp b/src/3rdparty/webkit/WebCore/platform/cf/FileSystemCF.cpp
new file mode 100644
index 0000000000..b6cc645d23
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/cf/FileSystemCF.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#import "config.h"
+#import "FileSystem.h"
+
+#import "CString.h"
+#import "PlatformString.h"
+#import <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+CString fileSystemRepresentation(const String& path)
+{
+    RetainPtr<CFStringRef> cfString(AdoptCF, path.createCFString());
+
+    if (!cfString)
+        return CString();
+
+    CFIndex size = CFStringGetMaximumSizeOfFileSystemRepresentation(cfString.get());
+
+    char* buffer;
+    CString string = CString::newUninitialized(size, buffer);
+
+    if (!CFStringGetFileSystemRepresentation(cfString.get(), buffer, size)) {
+        LOG_ERROR("Failed to get filesystem representation to create CString from cfString");
+        return CString();
+    }
+
+    return string;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/cf/KURLCFNet.cpp b/src/3rdparty/webkit/WebCore/platform/cf/KURLCFNet.cpp
new file mode 100644
index 0000000000..f060b28ed5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/cf/KURLCFNet.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2004, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "KURL.h"
+
+#include <wtf/RetainPtr.h>
+#include <CoreFoundation/CFURL.h>
+
+using namespace std;
+
+namespace WebCore {
+
+KURL::KURL(CFURLRef url)
+{
+    if (!url) {
+        parse(0, 0);
+        return;
+    }
+
+    CFIndex bytesLength = CFURLGetBytes(url, 0, 0);
+    Vector<char, 512> buffer(bytesLength + 6); // 5 for "file:", 1 for null character to end C string
+    char* bytes = &buffer[5];
+    CFURLGetBytes(url, reinterpret_cast<UInt8*>(bytes), bytesLength);
+    bytes[bytesLength] = '\0';
+    if (bytes[0] != '/') {
+        parse(bytes, 0);
+        return;
+    }
+
+    buffer[0] = 'f';
+    buffer[1] = 'i';
+    buffer[2] = 'l';
+    buffer[3] = 'e';
+    buffer[4] = ':';
+
+    parse(buffer.data(), 0);
+}
+
+CFURLRef KURL::createCFURL() const
+{
+    // FIXME: What should this return for invalid URLs?
+    // Currently it throws away the high bytes of the characters in the string in that case,
+    // which is clearly wrong.
+
+    Vector<char, 512> buffer;
+    copyToBuffer(buffer);
+
+    // NOTE: We use UTF-8 here since this encoding is used when computing strings when returning URL components
+    // (e.g calls to NSURL -path). However, this function is not tolerant of illegal UTF-8 sequences, which
+    // could either be a malformed string or bytes in a different encoding, like Shift-JIS, so we fall back
+    // onto using ISO Latin-1 in those cases.
+    CFURLRef result = CFURLCreateAbsoluteURLWithBytes(0, reinterpret_cast<const UInt8*>(buffer.data()), buffer.size(), kCFStringEncodingUTF8, 0, true);
+    if (!result)
+        result = CFURLCreateAbsoluteURLWithBytes(0, reinterpret_cast<const UInt8*>(buffer.data()), buffer.size(), kCFStringEncodingISOLatin1, 0, true);
+    return result;
+}
+
+String KURL::fileSystemPath() const
+{
+    RetainPtr<CFURLRef> cfURL(AdoptCF, createCFURL());
+    if (!cfURL)
+        return String();
+
+#if PLATFORM(WIN)
+    CFURLPathStyle pathStyle = kCFURLWindowsPathStyle;
+#else
+    CFURLPathStyle pathStyle = kCFURLPOSIXPathStyle;
+#endif
+    return RetainPtr<CFStringRef>(AdoptCF, CFURLCopyFileSystemPath(cfURL.get(), pathStyle)).get();
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/cf/RunLoopTimerCF.cpp b/src/3rdparty/webkit/WebCore/platform/cf/RunLoopTimerCF.cpp
new file mode 100644
index 0000000000..e2754fb761
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/cf/RunLoopTimerCF.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RunLoopTimer.h"
+
+#if PLATFORM(MAC) && HAVE(RUNLOOP_TIMER)
+
+namespace WebCore {
+
+RunLoopTimerBase::~RunLoopTimerBase()
+{
+    stop();
+}
+
+static void timerFired(CFRunLoopTimerRef, void* context)
+{
+    RunLoopTimerBase* timer = static_cast<RunLoopTimerBase*>(context);
+    timer->fired();
+}
+
+void RunLoopTimerBase::start(double nextFireInterval, double repeatInterval)
+{
+    if (m_timer)
+        CFRunLoopTimerInvalidate(m_timer.get());
+    CFRunLoopTimerContext context = { 0, this, 0, 0, 0 };
+    m_timer.adoptCF(CFRunLoopTimerCreate(0, CFAbsoluteTimeGetCurrent() + nextFireInterval, repeatInterval, 0, 0, timerFired, &context));
+}
+
+void RunLoopTimerBase::schedule(const SchedulePair* schedulePair)
+{
+    ASSERT_ARG(schedulePair, schedulePair);
+    ASSERT_WITH_MESSAGE(m_timer, "Timer must have one of the start functions called before calling schedule().");
+    CFRunLoopAddTimer(schedulePair->runLoop(), m_timer.get(), schedulePair->mode());
+}
+
+void RunLoopTimerBase::schedule(const SchedulePairHashSet& schedulePairs)
+{
+    SchedulePairHashSet::const_iterator end = schedulePairs.end();
+    for (SchedulePairHashSet::const_iterator it = schedulePairs.begin(); it != end; ++it)
+        schedule((*it).get());
+}
+
+void RunLoopTimerBase::stop()
+{
+    if (!m_timer)
+        return;
+    CFRunLoopTimerInvalidate(m_timer.get());
+    m_timer = 0;
+}
+
+bool RunLoopTimerBase::isActive() const
+{
+    return m_timer && CFRunLoopTimerIsValid(m_timer.get());
+}
+
+} // namespace WebCore
+
+#endif // PLATFORM(MAC) && HAVE(RUNLOOP_TIMER)
diff --git a/src/3rdparty/webkit/WebCore/platform/cf/SchedulePair.cpp b/src/3rdparty/webkit/WebCore/platform/cf/SchedulePair.cpp
new file mode 100644
index 0000000000..ee5ae95fd6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/cf/SchedulePair.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SchedulePair.h"
+
+namespace WebCore {
+
+SchedulePair::SchedulePair(CFRunLoopRef runLoop, CFStringRef mode)
+    : m_runLoop(runLoop)
+{
+    if (mode)
+        m_mode.adoptCF(CFStringCreateCopy(0, mode));
+}
+
+bool SchedulePair::operator==(const SchedulePair& other) const
+{
+    if (runLoop() != other.runLoop())
+        return false;
+    CFStringRef thisMode = mode();
+    CFStringRef otherMode = other.mode();
+    if (!thisMode || !otherMode)
+        return thisMode == otherMode;
+    return CFEqual(thisMode, otherMode);
+}
+
+} // namespace
diff --git a/src/3rdparty/webkit/WebCore/platform/cf/SchedulePair.h b/src/3rdparty/webkit/WebCore/platform/cf/SchedulePair.h
new file mode 100644
index 0000000000..ed58406dac
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/cf/SchedulePair.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SchedulePair_h
+#define SchedulePair_h
+
+#include "PlatformString.h"
+#include <wtf/HashSet.h>
+#include <wtf/RetainPtr.h>
+
+#if PLATFORM(MAC)
+#ifdef __OBJC__
+@class NSRunLoop;
+#else
+class NSRunLoop;
+#endif
+#endif
+
+namespace WebCore {
+
+class SchedulePair : public RefCounted<SchedulePair> {
+public:
+    static PassRefPtr<SchedulePair> create(CFRunLoopRef runLoop, CFStringRef mode) { return adoptRef(new SchedulePair(runLoop, mode)); }
+
+#if PLATFORM(MAC)
+    static PassRefPtr<SchedulePair> create(NSRunLoop* runLoop, CFStringRef mode) { return adoptRef(new SchedulePair(runLoop, mode)); }
+    NSRunLoop* nsRunLoop() const { return m_nsRunLoop.get(); }
+#endif
+
+    CFRunLoopRef runLoop() const { return m_runLoop.get(); }
+    CFStringRef mode() const { return m_mode.get(); }
+
+    bool operator==(const SchedulePair& other) const;
+
+private:
+    SchedulePair(CFRunLoopRef, CFStringRef);
+
+#if PLATFORM(MAC)
+    SchedulePair(NSRunLoop*, CFStringRef);
+    RetainPtr<NSRunLoop*> m_nsRunLoop;
+#endif
+
+    RetainPtr<CFRunLoopRef> m_runLoop;
+    RetainPtr<CFStringRef> m_mode;
+};
+
+struct SchedulePairHash {
+    static unsigned hash(const RefPtr<SchedulePair>& pair)
+    {
+        uintptr_t hashCodes[2] = { reinterpret_cast<uintptr_t>(pair->runLoop()), pair->mode() ? CFHash(pair->mode()) : 0 };
+        return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));
+    }
+
+    static bool equal(const RefPtr<SchedulePair>& a, const RefPtr<SchedulePair>& b) { return a == b; }
+
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+typedef HashSet<RefPtr<SchedulePair>, SchedulePairHash> SchedulePairHashSet;
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/cf/SharedBufferCF.cpp b/src/3rdparty/webkit/WebCore/platform/cf/SharedBufferCF.cpp
new file mode 100644
index 0000000000..18a65c2603
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/cf/SharedBufferCF.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2008, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+#include "SharedBuffer.h"
+
+#include "PurgeableBuffer.h"
+
+namespace WebCore {
+
+SharedBuffer::SharedBuffer(CFDataRef cfData)
+    : m_size(0)
+    , m_cfData(cfData)
+{
+}
+
+// Mac is a CF platform but has an even more efficient version of this method,
+// so only use this version for non-Mac
+#if !PLATFORM(MAC)
+CFDataRef SharedBuffer::createCFData()
+{
+    if (m_cfData) {
+        CFRetain(m_cfData.get());
+        return m_cfData.get();
+    }
+
+    // Internal data in SharedBuffer can be segmented. We need to get the contiguous buffer.
+    const Vector<char>& contiguousBuffer = buffer();
+    return CFDataCreate(0, reinterpret_cast<const UInt8*>(contiguousBuffer.data()), contiguousBuffer.size());
+}
+#endif
+
+PassRefPtr<SharedBuffer> SharedBuffer::wrapCFData(CFDataRef data)
+{
+    return adoptRef(new SharedBuffer(data));
+}
+
+bool SharedBuffer::hasPlatformData() const
+{
+    return m_cfData;
+}
+
+const char* SharedBuffer::platformData() const
+{
+    return (const char*)CFDataGetBytePtr(m_cfData.get());
+}
+
+unsigned SharedBuffer::platformDataSize() const
+{
+    return CFDataGetLength(m_cfData.get());
+}
+
+void SharedBuffer::maybeTransferPlatformData()
+{
+    if (!m_cfData)
+        return;
+    
+    ASSERT(!m_size);
+        
+    append((const char*)CFDataGetBytePtr(m_cfData.get()), CFDataGetLength(m_cfData.get()));
+        
+    m_cfData = 0;
+}
+
+void SharedBuffer::clearPlatformData()
+{
+    m_cfData = 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/cocoa/KeyEventCocoa.h b/src/3rdparty/webkit/WebCore/platform/cocoa/KeyEventCocoa.h
new file mode 100644
index 0000000000..8d486ad07e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/cocoa/KeyEventCocoa.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef KeyEventCocoa_h
+#define KeyEventCocoa_h
+
+namespace WebCore {
+
+class String;
+
+String keyIdentifierForCharCode(unichar charCode);
+
+int windowsKeyCodeForKeyCode(uint16_t keyCode);
+int windowsKeyCodeForCharCode(unichar charCode);
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/cocoa/KeyEventCocoa.mm b/src/3rdparty/webkit/WebCore/platform/cocoa/KeyEventCocoa.mm
new file mode 100644
index 0000000000..60b883b1db
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/cocoa/KeyEventCocoa.mm
@@ -0,0 +1,700 @@
+/*
+ * Copyright (C) 2004, 2006, 2007, 2008, 2009, 2010 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "KeyEventCocoa.h"
+
+#import "Logging.h"
+#import "PlatformString.h"
+#import <wtf/ASCIICType.h>
+
+#if PLATFORM(IPHONE)
+#import "KeyEventCodesIPhone.h"
+#endif
+
+using namespace WTF;
+
+namespace WebCore {
+
+String keyIdentifierForCharCode(unichar charCode)
+{
+    switch (charCode) {
+        // Each identifier listed in the DOM spec is listed here.
+        // Many are simply commented out since they do not appear on standard Macintosh keyboards
+        // or are on a key that doesn't have a corresponding character.
+
+        // "Accept"
+        // "AllCandidates"
+
+        // "Alt"
+        case NSMenuFunctionKey:
+            return "Alt";
+
+        // "Apps"
+        // "BrowserBack"
+        // "BrowserForward"
+        // "BrowserHome"
+        // "BrowserRefresh"
+        // "BrowserSearch"
+        // "BrowserStop"
+        // "CapsLock"
+
+        // "Clear"
+        case NSClearLineFunctionKey:
+            return "Clear";
+
+        // "CodeInput"
+        // "Compose"
+        // "Control"
+        // "Crsel"
+        // "Convert"
+        // "Copy"
+        // "Cut"
+
+        // "Down"
+        case NSDownArrowFunctionKey:
+            return "Down";
+        // "End"
+        case NSEndFunctionKey:
+            return "End";
+        // "Enter"
+        case 0x3: case 0xA: case 0xD: // Macintosh calls the one on the main keyboard Return, but Windows calls it Enter, so we'll do the same for the DOM
+            return "Enter";
+
+        // "EraseEof"
+
+        // "Execute"
+        case NSExecuteFunctionKey:
+            return "Execute";
+
+        // "Exsel"
+
+        // "F1"
+        case NSF1FunctionKey:
+            return "F1";
+        // "F2"
+        case NSF2FunctionKey:
+            return "F2";
+        // "F3"
+        case NSF3FunctionKey:
+            return "F3";
+        // "F4"
+        case NSF4FunctionKey:
+            return "F4";
+        // "F5"
+        case NSF5FunctionKey:
+            return "F5";
+        // "F6"
+        case NSF6FunctionKey:
+            return "F6";
+        // "F7"
+        case NSF7FunctionKey:
+            return "F7";
+        // "F8"
+        case NSF8FunctionKey:
+            return "F8";
+        // "F9"
+        case NSF9FunctionKey:
+            return "F9";
+        // "F10"
+        case NSF10FunctionKey:
+            return "F10";
+        // "F11"
+        case NSF11FunctionKey:
+            return "F11";
+        // "F12"
+        case NSF12FunctionKey:
+            return "F12";
+        // "F13"
+        case NSF13FunctionKey:
+            return "F13";
+        // "F14"
+        case NSF14FunctionKey:
+            return "F14";
+        // "F15"
+        case NSF15FunctionKey:
+            return "F15";
+        // "F16"
+        case NSF16FunctionKey:
+            return "F16";
+        // "F17"
+        case NSF17FunctionKey:
+            return "F17";
+        // "F18"
+        case NSF18FunctionKey:
+            return "F18";
+        // "F19"
+        case NSF19FunctionKey:
+            return "F19";
+        // "F20"
+        case NSF20FunctionKey:
+            return "F20";
+        // "F21"
+        case NSF21FunctionKey:
+            return "F21";
+        // "F22"
+        case NSF22FunctionKey:
+            return "F22";
+        // "F23"
+        case NSF23FunctionKey:
+            return "F23";
+        // "F24"
+        case NSF24FunctionKey:
+            return "F24";
+
+        // "FinalMode"
+
+        // "Find"
+        case NSFindFunctionKey:
+            return "Find";
+
+        // "FullWidth"
+        // "HalfWidth"
+        // "HangulMode"
+        // "HanjaMode"
+
+        // "Help"
+        case NSHelpFunctionKey:
+            return "Help";
+
+        // "Hiragana"
+
+        // "Home"
+        case NSHomeFunctionKey:
+            return "Home";
+        // "Insert"
+        case NSInsertFunctionKey:
+            return "Insert";
+
+        // "JapaneseHiragana"
+        // "JapaneseKatakana"
+        // "JapaneseRomaji"
+        // "JunjaMode"
+        // "KanaMode"
+        // "KanjiMode"
+        // "Katakana"
+        // "LaunchApplication1"
+        // "LaunchApplication2"
+        // "LaunchMail"
+
+        // "Left"
+        case NSLeftArrowFunctionKey:
+            return "Left";
+
+        // "Meta"
+        // "MediaNextTrack"
+        // "MediaPlayPause"
+        // "MediaPreviousTrack"
+        // "MediaStop"
+
+        // "ModeChange"
+        case NSModeSwitchFunctionKey:
+            return "ModeChange";
+
+        // "Nonconvert"
+        // "NumLock"
+
+        // "PageDown"
+        case NSPageDownFunctionKey:
+            return "PageDown";
+        // "PageUp"
+        case NSPageUpFunctionKey:
+            return "PageUp";
+
+        // "Paste"
+
+        // "Pause"
+        case NSPauseFunctionKey:
+            return "Pause";
+
+        // "Play"
+        // "PreviousCandidate"
+
+        // "PrintScreen"
+        case NSPrintScreenFunctionKey:
+            return "PrintScreen";
+
+        // "Process"
+        // "Props"
+
+        // "Right"
+        case NSRightArrowFunctionKey:
+            return "Right";
+
+        // "RomanCharacters"
+
+        // "Scroll"
+        case NSScrollLockFunctionKey:
+            return "Scroll";
+        // "Select"
+        case NSSelectFunctionKey:
+            return "Select";
+
+        // "SelectMedia"
+        // "Shift"
+
+        // "Stop"
+        case NSStopFunctionKey:
+            return "Stop";
+        // "Up"
+        case NSUpArrowFunctionKey:
+            return "Up";
+        // "Undo"
+        case NSUndoFunctionKey:
+            return "Undo";
+
+        // "VolumeDown"
+        // "VolumeMute"
+        // "VolumeUp"
+        // "Win"
+        // "Zoom"
+
+        // More function keys, not in the key identifier specification.
+        case NSF25FunctionKey:
+            return "F25";
+        case NSF26FunctionKey:
+            return "F26";
+        case NSF27FunctionKey:
+            return "F27";
+        case NSF28FunctionKey:
+            return "F28";
+        case NSF29FunctionKey:
+            return "F29";
+        case NSF30FunctionKey:
+            return "F30";
+        case NSF31FunctionKey:
+            return "F31";
+        case NSF32FunctionKey:
+            return "F32";
+        case NSF33FunctionKey:
+            return "F33";
+        case NSF34FunctionKey:
+            return "F34";
+        case NSF35FunctionKey:
+            return "F35";
+
+        // Turn 0x7F into 0x08, because backspace needs to always be 0x08.
+        case 0x7F:
+            return "U+0008";
+        // Standard says that DEL becomes U+007F.
+        case NSDeleteFunctionKey:
+            return "U+007F";
+
+        // Always use 0x09 for tab instead of AppKit's backtab character.
+        case NSBackTabCharacter:
+            return "U+0009";
+
+        case NSBeginFunctionKey:
+        case NSBreakFunctionKey:
+        case NSClearDisplayFunctionKey:
+        case NSDeleteCharFunctionKey:
+        case NSDeleteLineFunctionKey:
+        case NSInsertCharFunctionKey:
+        case NSInsertLineFunctionKey:
+        case NSNextFunctionKey:
+        case NSPrevFunctionKey:
+        case NSPrintFunctionKey:
+        case NSRedoFunctionKey:
+        case NSResetFunctionKey:
+        case NSSysReqFunctionKey:
+        case NSSystemFunctionKey:
+        case NSUserFunctionKey:
+            // FIXME: We should use something other than the vendor-area Unicode values for the above keys.
+            // For now, just fall through to the default.
+        default:
+            return String::format("U+%04X", toASCIIUpper(charCode));
+    }
+}
+
+int windowsKeyCodeForKeyCode(uint16_t keyCode)
+{
+    switch (keyCode) {
+        // VK_TAB (09) TAB key
+        case 48: return 0x09;
+
+        // VK_APPS (5D) Right windows/meta key
+        case 54: // Right Command
+            return 0x5D;
+
+        // VK_LWIN (5B) Left windows/meta key
+        case 55: // Left Command
+            return 0x5B;
+
+        // VK_CAPITAL (14) caps locks key
+        case 57: // Capslock
+            return 0x14;
+
+        // VK_SHIFT (10) either shift key
+        case 56: // Left Shift
+        case 60: // Right Shift
+            return 0x10;
+
+        // VK_MENU (12) either alt key
+        case 58: // Left Alt
+        case 61: // Right Alt
+            return 0x12;
+
+        // VK_CONTROL (11) either ctrl key
+        case 59: // Left Ctrl
+        case 62: // Right Ctrl
+            return 0x11;
+
+        // VK_CLEAR (0C) CLEAR key
+        case 71: return 0x0C;
+
+        // VK_NUMPAD0 (60) Numeric keypad 0 key
+        case 82: return 0x60;
+        // VK_NUMPAD1 (61) Numeric keypad 1 key
+        case 83: return 0x61;
+        // VK_NUMPAD2 (62) Numeric keypad 2 key
+        case 84: return 0x62;
+        // VK_NUMPAD3 (63) Numeric keypad 3 key
+        case 85: return 0x63;
+        // VK_NUMPAD4 (64) Numeric keypad 4 key
+        case 86: return 0x64;
+        // VK_NUMPAD5 (65) Numeric keypad 5 key
+        case 87: return 0x65;
+        // VK_NUMPAD6 (66) Numeric keypad 6 key
+        case 88: return 0x66;
+        // VK_NUMPAD7 (67) Numeric keypad 7 key
+        case 89: return 0x67;
+        // VK_NUMPAD8 (68) Numeric keypad 8 key
+        case 91: return 0x68;
+        // VK_NUMPAD9 (69) Numeric keypad 9 key
+        case 92: return 0x69;
+        // VK_MULTIPLY (6A) Multiply key
+        case 67: return 0x6A;
+        // VK_ADD (6B) Add key
+        case 69: return 0x6B;
+
+        // VK_SUBTRACT (6D) Subtract key
+        case 78: return 0x6D;
+        // VK_DECIMAL (6E) Decimal key
+        case 65: return 0x6E;
+        // VK_DIVIDE (6F) Divide key
+        case 75: return 0x6F;
+     }
+
+     return 0;
+}
+
+int windowsKeyCodeForCharCode(unichar charCode)
+{
+    switch (charCode) {
+        // VK_LBUTTON (01) Left mouse button
+        // VK_RBUTTON (02) Right mouse button
+        // VK_CANCEL (03) Control-break processing
+        // VK_MBUTTON (04) Middle mouse button (three-button mouse)
+        // VK_XBUTTON1 (05)
+        // VK_XBUTTON2 (06)
+
+        // VK_BACK (08) BACKSPACE key
+        case 8: case 0x7F: return 0x08;
+        // VK_TAB (09) TAB key
+        case 9: return 0x09;
+
+        // VK_CLEAR (0C) CLEAR key
+        // handled by key code above
+
+        // VK_RETURN (0D)
+        case 0xD: case 3: return 0x0D;
+
+        // VK_SHIFT (10) SHIFT key
+        // VK_CONTROL (11) CTRL key
+        // VK_MENU (12) ALT key
+
+        // VK_PAUSE (13) PAUSE key
+        case NSPauseFunctionKey: return 0x13;
+
+        // VK_CAPITAL (14) CAPS LOCK key
+        // VK_KANA (15) Input Method Editor (IME) Kana mode
+        // VK_HANGUEL (15) IME Hanguel mode (maintained for compatibility; use VK_HANGUL)
+        // VK_HANGUL (15) IME Hangul mode
+        // VK_JUNJA (17) IME Junja mode
+        // VK_FINAL (18) IME final mode
+        // VK_HANJA (19) IME Hanja mode
+        // VK_KANJI (19) IME Kanji mode
+
+        // VK_ESCAPE (1B) ESC key
+        case 0x1B: return 0x1B;
+
+        // VK_CONVERT (1C) IME convert
+        // VK_NONCONVERT (1D) IME nonconvert
+        // VK_ACCEPT (1E) IME accept
+        // VK_MODECHANGE (1F) IME mode change request
+
+        // VK_SPACE (20) SPACEBAR
+        case ' ': return 0x20;
+        // VK_PRIOR (21) PAGE UP key
+        case NSPageUpFunctionKey: return 0x21;
+        // VK_NEXT (22) PAGE DOWN key
+        case NSPageDownFunctionKey: return 0x22;
+        // VK_END (23) END key
+        case NSEndFunctionKey: return 0x23;
+        // VK_HOME (24) HOME key
+        case NSHomeFunctionKey: return 0x24;
+        // VK_LEFT (25) LEFT ARROW key
+        case NSLeftArrowFunctionKey: return 0x25;
+        // VK_UP (26) UP ARROW key
+        case NSUpArrowFunctionKey: return 0x26;
+        // VK_RIGHT (27) RIGHT ARROW key
+        case NSRightArrowFunctionKey: return 0x27;
+        // VK_DOWN (28) DOWN ARROW key
+        case NSDownArrowFunctionKey: return 0x28;
+        // VK_SELECT (29) SELECT key
+        case NSSelectFunctionKey: return 0x29;
+        // VK_PRINT (2A) PRINT key
+        case NSPrintFunctionKey: return 0x2A;
+        // VK_EXECUTE (2B) EXECUTE key
+        case NSExecuteFunctionKey: return 0x2B;
+        // VK_SNAPSHOT (2C) PRINT SCREEN key
+        case NSPrintScreenFunctionKey: return 0x2C;
+        // VK_INSERT (2D) INS key
+        case NSInsertFunctionKey: case NSHelpFunctionKey: return 0x2D;
+        // VK_DELETE (2E) DEL key
+        case NSDeleteFunctionKey: return 0x2E;
+
+        // VK_HELP (2F) HELP key
+
+        //  (30) 0 key
+        case '0': case ')': return 0x30;
+        //  (31) 1 key
+        case '1': case '!': return 0x31;
+        //  (32) 2 key
+        case '2': case '@': return 0x32;
+        //  (33) 3 key
+        case '3': case '#': return 0x33;
+        //  (34) 4 key
+        case '4': case '$': return 0x34;
+        //  (35) 5 key
+        case '5': case '%': return 0x35;
+        //  (36) 6 key
+        case '6': case '^': return 0x36;
+        //  (37) 7 key
+        case '7': case '&': return 0x37;
+        //  (38) 8 key
+        case '8': case '*': return 0x38;
+        //  (39) 9 key
+        case '9': case '(': return 0x39;
+        //  (41) A key
+        case 'a': case 'A': return 0x41;
+        //  (42) B key
+        case 'b': case 'B': return 0x42;
+        //  (43) C key
+        case 'c': case 'C': return 0x43;
+        //  (44) D key
+        case 'd': case 'D': return 0x44;
+        //  (45) E key
+        case 'e': case 'E': return 0x45;
+        //  (46) F key
+        case 'f': case 'F': return 0x46;
+        //  (47) G key
+        case 'g': case 'G': return 0x47;
+        //  (48) H key
+        case 'h': case 'H': return 0x48;
+        //  (49) I key
+        case 'i': case 'I': return 0x49;
+        //  (4A) J key
+        case 'j': case 'J': return 0x4A;
+        //  (4B) K key
+        case 'k': case 'K': return 0x4B;
+        //  (4C) L key
+        case 'l': case 'L': return 0x4C;
+        //  (4D) M key
+        case 'm': case 'M': return 0x4D;
+        //  (4E) N key
+        case 'n': case 'N': return 0x4E;
+        //  (4F) O key
+        case 'o': case 'O': return 0x4F;
+        //  (50) P key
+        case 'p': case 'P': return 0x50;
+        //  (51) Q key
+        case 'q': case 'Q': return 0x51;
+        //  (52) R key
+        case 'r': case 'R': return 0x52;
+        //  (53) S key
+        case 's': case 'S': return 0x53;
+        //  (54) T key
+        case 't': case 'T': return 0x54;
+        //  (55) U key
+        case 'u': case 'U': return 0x55;
+        //  (56) V key
+        case 'v': case 'V': return 0x56;
+        //  (57) W key
+        case 'w': case 'W': return 0x57;
+        //  (58) X key
+        case 'x': case 'X': return 0x58;
+        //  (59) Y key
+        case 'y': case 'Y': return 0x59;
+        //  (5A) Z key
+        case 'z': case 'Z': return 0x5A;
+
+        // VK_LWIN (5B) Left Windows key (Microsoft Natural keyboard)
+        // VK_RWIN (5C) Right Windows key (Natural keyboard)
+        // VK_APPS (5D) Applications key (Natural keyboard)
+        // VK_SLEEP (5F) Computer Sleep key
+
+        // VK_NUMPAD0 (60) Numeric keypad 0 key
+        // VK_NUMPAD1 (61) Numeric keypad 1 key
+        // VK_NUMPAD2 (62) Numeric keypad 2 key
+        // VK_NUMPAD3 (63) Numeric keypad 3 key
+        // VK_NUMPAD4 (64) Numeric keypad 4 key
+        // VK_NUMPAD5 (65) Numeric keypad 5 key
+        // VK_NUMPAD6 (66) Numeric keypad 6 key
+        // VK_NUMPAD7 (67) Numeric keypad 7 key
+        // VK_NUMPAD8 (68) Numeric keypad 8 key
+        // VK_NUMPAD9 (69) Numeric keypad 9 key
+        // VK_MULTIPLY (6A) Multiply key
+        // VK_ADD (6B) Add key
+        // handled by key code above
+
+        // VK_SEPARATOR (6C) Separator key
+
+        // VK_SUBTRACT (6D) Subtract key
+        // VK_DECIMAL (6E) Decimal key
+        // VK_DIVIDE (6F) Divide key
+        // handled by key code above
+
+        // VK_F1 (70) F1 key
+        case NSF1FunctionKey: return 0x70;
+        // VK_F2 (71) F2 key
+        case NSF2FunctionKey: return 0x71;
+        // VK_F3 (72) F3 key
+        case NSF3FunctionKey: return 0x72;
+        // VK_F4 (73) F4 key
+        case NSF4FunctionKey: return 0x73;
+        // VK_F5 (74) F5 key
+        case NSF5FunctionKey: return 0x74;
+        // VK_F6 (75) F6 key
+        case NSF6FunctionKey: return 0x75;
+        // VK_F7 (76) F7 key
+        case NSF7FunctionKey: return 0x76;
+        // VK_F8 (77) F8 key
+        case NSF8FunctionKey: return 0x77;
+        // VK_F9 (78) F9 key
+        case NSF9FunctionKey: return 0x78;
+        // VK_F10 (79) F10 key
+        case NSF10FunctionKey: return 0x79;
+        // VK_F11 (7A) F11 key
+        case NSF11FunctionKey: return 0x7A;
+        // VK_F12 (7B) F12 key
+        case NSF12FunctionKey: return 0x7B;
+        // VK_F13 (7C) F13 key
+        case NSF13FunctionKey: return 0x7C;
+        // VK_F14 (7D) F14 key
+        case NSF14FunctionKey: return 0x7D;
+        // VK_F15 (7E) F15 key
+        case NSF15FunctionKey: return 0x7E;
+        // VK_F16 (7F) F16 key
+        case NSF16FunctionKey: return 0x7F;
+        // VK_F17 (80H) F17 key
+        case NSF17FunctionKey: return 0x80;
+        // VK_F18 (81H) F18 key
+        case NSF18FunctionKey: return 0x81;
+        // VK_F19 (82H) F19 key
+        case NSF19FunctionKey: return 0x82;
+        // VK_F20 (83H) F20 key
+        case NSF20FunctionKey: return 0x83;
+        // VK_F21 (84H) F21 key
+        case NSF21FunctionKey: return 0x84;
+        // VK_F22 (85H) F22 key
+        case NSF22FunctionKey: return 0x85;
+        // VK_F23 (86H) F23 key
+        case NSF23FunctionKey: return 0x86;
+        // VK_F24 (87H) F24 key
+        case NSF24FunctionKey: return 0x87;
+
+        // VK_NUMLOCK (90) NUM LOCK key
+
+        // VK_SCROLL (91) SCROLL LOCK key
+        case NSScrollLockFunctionKey: return 0x91;
+
+        // VK_LSHIFT (A0) Left SHIFT key
+        // VK_RSHIFT (A1) Right SHIFT key
+        // VK_LCONTROL (A2) Left CONTROL key
+        // VK_RCONTROL (A3) Right CONTROL key
+        // VK_LMENU (A4) Left MENU key
+        // VK_RMENU (A5) Right MENU key
+        // VK_BROWSER_BACK (A6) Windows 2000/XP: Browser Back key
+        // VK_BROWSER_FORWARD (A7) Windows 2000/XP: Browser Forward key
+        // VK_BROWSER_REFRESH (A8) Windows 2000/XP: Browser Refresh key
+        // VK_BROWSER_STOP (A9) Windows 2000/XP: Browser Stop key
+        // VK_BROWSER_SEARCH (AA) Windows 2000/XP: Browser Search key
+        // VK_BROWSER_FAVORITES (AB) Windows 2000/XP: Browser Favorites key
+        // VK_BROWSER_HOME (AC) Windows 2000/XP: Browser Start and Home key
+        // VK_VOLUME_MUTE (AD) Windows 2000/XP: Volume Mute key
+        // VK_VOLUME_DOWN (AE) Windows 2000/XP: Volume Down key
+        // VK_VOLUME_UP (AF) Windows 2000/XP: Volume Up key
+        // VK_MEDIA_NEXT_TRACK (B0) Windows 2000/XP: Next Track key
+        // VK_MEDIA_PREV_TRACK (B1) Windows 2000/XP: Previous Track key
+        // VK_MEDIA_STOP (B2) Windows 2000/XP: Stop Media key
+        // VK_MEDIA_PLAY_PAUSE (B3) Windows 2000/XP: Play/Pause Media key
+        // VK_LAUNCH_MAIL (B4) Windows 2000/XP: Start Mail key
+        // VK_LAUNCH_MEDIA_SELECT (B5) Windows 2000/XP: Select Media key
+        // VK_LAUNCH_APP1 (B6) Windows 2000/XP: Start Application 1 key
+        // VK_LAUNCH_APP2 (B7) Windows 2000/XP: Start Application 2 key
+
+        // VK_OEM_1 (BA) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the ';:' key
+        case ';': case ':': return 0xBA;
+        // VK_OEM_PLUS (BB) Windows 2000/XP: For any country/region, the '+' key
+        case '=': case '+': return 0xBB;
+        // VK_OEM_COMMA (BC) Windows 2000/XP: For any country/region, the ',' key
+        case ',': case '<': return 0xBC;
+        // VK_OEM_MINUS (BD) Windows 2000/XP: For any country/region, the '-' key
+        case '-': case '_': return 0xBD;
+        // VK_OEM_PERIOD (BE) Windows 2000/XP: For any country/region, the '.' key
+        case '.': case '>': return 0xBE;
+        // VK_OEM_2 (BF) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '/?' key
+        case '/': case '?': return 0xBF;
+        // VK_OEM_3 (C0) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '`~' key
+        case '`': case '~': return 0xC0;
+        // VK_OEM_4 (DB) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '[{' key
+        case '[': case '{': return 0xDB;
+        // VK_OEM_5 (DC) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '\|' key
+        case '\\': case '|': return 0xDC;
+        // VK_OEM_6 (DD) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the ']}' key
+        case ']': case '}': return 0xDD;
+        // VK_OEM_7 (DE) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the 'single-quote/double-quote' key
+        case '\'': case '"': return 0xDE;
+
+        // VK_OEM_8 (DF) Used for miscellaneous characters; it can vary by keyboard.
+        // VK_OEM_102 (E2) Windows 2000/XP: Either the angle bracket key or the backslash key on the RT 102-key keyboard
+        // VK_PROCESSKEY (E5) Windows 95/98/Me, Windows NT 4.0, Windows 2000/XP: IME PROCESS key
+        // VK_PACKET (E7) Windows 2000/XP: Used to pass Unicode characters as if they were keystrokes. The VK_PACKET key is the low word of a 32-bit Virtual Key value used for non-keyboard input methods. For more information, see Remark in KEYBDINPUT,SendInput, WM_KEYDOWN, and WM_KEYUP
+        // VK_ATTN (F6) Attn key
+        // VK_CRSEL (F7) CrSel key
+        // VK_EXSEL (F8) ExSel key
+        // VK_EREOF (F9) Erase EOF key
+        // VK_PLAY (FA) Play key
+        // VK_ZOOM (FB) Zoom key
+        // VK_NONAME (FC) Reserved for future use
+        // VK_PA1 (FD) PA1 key
+        // VK_OEM_CLEAR (FE) Clear key
+    }
+
+    return 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp
index 32aefc96ce..910d39a0ac 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp
@@ -266,23 +266,10 @@ void BitmapImage::startAnimation(bool catchUpIfNecessary)
     if (m_frameTimer || !shouldAnimate() || frameCount() <= 1)
         return;
 
-    // Determine time for next frame to start.  By ignoring paint and timer lag
-    // in this calculation, we make the animation appear to run at its desired
-    // rate regardless of how fast it's being repainted.
-    const double currentDuration = frameDurationAtIndex(m_currentFrame);
+    // If we aren't already animating, set now as the animation start time.
     const double time = currentTime();
-    if (m_desiredFrameStartTime == 0) {
-        m_desiredFrameStartTime = time + currentDuration;
-    } else {
-        m_desiredFrameStartTime += currentDuration;
-
-        // When an animated image is more than five minutes out of date, the
-        // user probably doesn't care about resyncing and we could burn a lot of
-        // time looping through frames below.  Just reset the timings.
-        const double cAnimationResyncCutoff = 5 * 60;
-        if ((time - m_desiredFrameStartTime) > cAnimationResyncCutoff)
-            m_desiredFrameStartTime = time + currentDuration;
-    }
+    if (!m_desiredFrameStartTime)
+        m_desiredFrameStartTime = time;
 
     // Don't advance the animation to an incomplete frame.
     size_t nextFrame = (m_currentFrame + 1) % frameCount();
@@ -296,6 +283,19 @@ void BitmapImage::startAnimation(bool catchUpIfNecessary)
     if (!m_allDataReceived && repetitionCount(false) == cAnimationLoopOnce && m_currentFrame >= (frameCount() - 1))
         return;
 
+    // Determine time for next frame to start.  By ignoring paint and timer lag
+    // in this calculation, we make the animation appear to run at its desired
+    // rate regardless of how fast it's being repainted.
+    const double currentDuration = frameDurationAtIndex(m_currentFrame);
+    m_desiredFrameStartTime += currentDuration;
+
+    // When an animated image is more than five minutes out of date, the
+    // user probably doesn't care about resyncing and we could burn a lot of
+    // time looping through frames below.  Just reset the timings.
+    const double cAnimationResyncCutoff = 5 * 60;
+    if ((time - m_desiredFrameStartTime) > cAnimationResyncCutoff)
+        m_desiredFrameStartTime = time + currentDuration;
+
     // The image may load more slowly than it's supposed to animate, so that by
     // the time we reach the end of the first repetition, we're well behind.
     // Clamp the desired frame start time in this case, so that we don't skip
@@ -307,7 +307,7 @@ void BitmapImage::startAnimation(bool catchUpIfNecessary)
     // switch tabs (and thus stop drawing the animation, which will pause it)
     // during that initial loop, then switch back later.
     if (nextFrame == 0 && m_repetitionsComplete == 0 && m_desiredFrameStartTime < time)
-      m_desiredFrameStartTime = time;
+        m_desiredFrameStartTime = time;
 
     if (!catchUpIfNecessary || time < m_desiredFrameStartTime) {
         // Haven't yet reached time for next frame to start; delay until then.
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
index 7e8f2b075a..71606d12c1 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
@@ -140,7 +140,7 @@ public:
     virtual CGImageRef getCGImageRef();
 #endif
 
-#if PLATFORM(WIN) || (PLATFORM(QT) && PLATFORM(WIN_OS))
+#if PLATFORM(WIN) || (PLATFORM(QT) && OS(WINDOWS))
     static PassRefPtr<BitmapImage> create(HBITMAP);
 #endif
 #if PLATFORM(WIN)
@@ -165,13 +165,13 @@ protected:
     BitmapImage(ImageObserver* = 0);
 
 #if PLATFORM(WIN)
-    virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, CompositeOperator);
+    virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, ColorSpace styleColorSpace, CompositeOperator);
 #endif
-    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
+    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator);
 
-#if PLATFORM(WX) || (PLATFORM(WINCE) && !PLATFORM(QT))
+#if (OS(WINCE) && !PLATFORM(QT))
     virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
-                             const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
+                             const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator, const FloatRect& destRect);
 #endif
 
 #if PLATFORM(HAIKU)
@@ -236,7 +236,7 @@ protected:
             checkForSolidColor();
             // WINCE PORT: checkForSolidColor() doesn't set m_checkedForSolidColor until
             // it gets enough information to make final decision.
-#if !PLATFORM(WINCE)
+#if !OS(WINCE)
             ASSERT(m_checkedForSolidColor);
 #endif
         }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Color.h b/src/3rdparty/webkit/WebCore/platform/graphics/Color.h
index 4fa151380e..9a3ca75806 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Color.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Color.h
@@ -26,7 +26,7 @@
 #ifndef Color_h
 #define Color_h
 
-#include <wtf/Platform.h>
+#include <wtf/FastAllocBase.h>
 
 #if PLATFORM(CG)
 typedef struct CGColor* CGColorRef;
@@ -68,7 +68,7 @@ RGBA32 makeRGBAFromCMYKA(float c, float m, float y, float k, float a);
 
 int differenceSquared(const Color&, const Color&);
 
-class Color {
+class Color : public FastAllocBase {
 public:
     Color() : m_color(0), m_valid(false) { }
     Color(RGBA32 col) : m_color(col), m_valid(true) { }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/ColorSpace.h b/src/3rdparty/webkit/WebCore/platform/graphics/ColorSpace.h
new file mode 100644
index 0000000000..1bad58cc79
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/ColorSpace.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ColorSpace_h
+#define ColorSpace_h
+
+namespace WebCore {
+
+    enum ColorSpace { DeviceColorSpace, sRGBColorSpace };
+    
+} // namespace WebCore
+
+#endif // ColorSpace_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.cpp
index 7765ba9dd6..cf3d548af1 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.cpp
@@ -37,6 +37,13 @@ FloatPoint::FloatPoint(const IntPoint& p) : m_x(p.x()), m_y(p.y())
 {
 }
 
+FloatPoint FloatPoint::matrixTransform(const AffineTransform& transform) const
+{
+    double newX, newY;
+    transform.map(static_cast<double>(m_x), static_cast<double>(m_y), newX, newY);
+    return narrowPrecision(newX, newY);
+}
+
 FloatPoint FloatPoint::matrixTransform(const TransformationMatrix& transform) const
 {
     double newX, newY;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.h b/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.h
index 45a1e832da..24e0fcf509 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.h
@@ -30,13 +30,12 @@
 #include "FloatSize.h"
 #include "IntPoint.h"
 #include <wtf/MathExtras.h>
-#include <wtf/Platform.h>
 
 #if PLATFORM(CG)
 typedef struct CGPoint CGPoint;
 #endif
 
-#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
 #ifdef NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
 typedef struct CGPoint NSPoint;
 #else
@@ -61,6 +60,7 @@ struct SkPoint;
 
 namespace WebCore {
 
+class AffineTransform;
 class TransformationMatrix;
 class IntPoint;
 
@@ -85,7 +85,7 @@ public:
 #endif
 
 #if (PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)) \
-        || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+        || (PLATFORM(CHROMIUM) && OS(DARWIN))
     FloatPoint(const NSPoint&);
     operator NSPoint() const;
 #endif
@@ -106,6 +106,7 @@ public:
 #endif
 
     FloatPoint matrixTransform(const TransformationMatrix&) const;
+    FloatPoint matrixTransform(const AffineTransform&) const;
 
 private:
     float m_x, m_y;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.cpp
index 427230df4f..d1069fb7ad 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.cpp
@@ -85,6 +85,12 @@ FloatRect FloatQuad::boundingBox() const
     return FloatRect(left, top, right - left, bottom - top);
 }
 
+bool FloatQuad::isRectilinear() const
+{
+    return (m_p1.x() == m_p2.x() && m_p2.y() == m_p3.y() && m_p3.x() == m_p4.x() && m_p4.y() == m_p1.y())
+        || (m_p1.y() == m_p2.y() && m_p2.x() == m_p3.x() && m_p3.y() == m_p4.y() && m_p4.x() == m_p1.x());
+}
+
 bool FloatQuad::containsPoint(const FloatPoint& p) const
 {
     return isPointInTriangle(p, m_p1, m_p2, m_p3) || isPointInTriangle(p, m_p1, m_p3, m_p4);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.h b/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.h
index 5982967716..6cd86f6831 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.h
@@ -74,6 +74,12 @@ public:
     // "slanted" empty quads.
     bool isEmpty() const { return boundingBox().isEmpty(); }
 
+    // Tests whether this quad can be losslessly represented by a FloatRect,
+    // that is, if two edges are parallel to the x-axis and the other two
+    // are parallel to the y-axis. If this method returns true, the
+    // corresponding FloatRect can be retrieved with boundingBox().
+    bool isRectilinear() const;
+
     // Tests whether the given point is inside, or on an edge or corner of this quad.
     bool containsPoint(const FloatPoint&) const;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FloatRect.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/FloatRect.cpp
index 532f719713..7a54f214ca 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FloatRect.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FloatRect.cpp
@@ -102,12 +102,12 @@ void FloatRect::unite(const FloatRect& other)
     m_size.setHeight(b - t);
 }
 
-void FloatRect::scale(float s)
+void FloatRect::scale(float sx, float sy)
 {
-    m_location.setX(x() * s);
-    m_location.setY(y() * s);
-    m_size.setWidth(width() * s);
-    m_size.setHeight(height() * s);
+    m_location.setX(x() * sx);
+    m_location.setY(y() * sy);
+    m_size.setWidth(width() * sx);
+    m_size.setHeight(height() * sy);
 }
 
 IntRect enclosingIntRect(const FloatRect& rect)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FloatRect.h b/src/3rdparty/webkit/WebCore/platform/graphics/FloatRect.h
index 073f13569d..b265121045 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FloatRect.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FloatRect.h
@@ -33,7 +33,7 @@
 typedef struct CGRect CGRect;
 #endif
 
-#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
 #ifdef NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
 typedef struct CGRect NSRect;
 #else
@@ -61,6 +61,10 @@ struct SkRect;
 
 namespace WebCore {
 
+#if PLATFORM(OPENVG)
+class VGRect;
+#endif
+
 class IntRect;
 
 class FloatRect {
@@ -95,6 +99,8 @@ public:
     float right() const { return x() + width(); }
     float bottom() const { return y() + height(); }
 
+    FloatPoint center() const { return FloatPoint(x() + width() / 2, y() + height() / 2); }
+
     void move(const FloatSize& delta) { m_location += delta; } 
     void move(float dx, float dy) { m_location.move(dx, dy); } 
 
@@ -120,7 +126,8 @@ public:
         m_size.setHeight(m_size.height() + dy + dy);
     }
     void inflate(float d) { inflateX(d); inflateY(d); }
-    void scale(float s);
+    void scale(float s) { scale(s, s); }
+    void scale(float sx, float sy);
 
 #if PLATFORM(CG)
     FloatRect(const CGRect&);
@@ -128,7 +135,7 @@ public:
 #endif
 
 #if (PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)) \
-        || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+        || (PLATFORM(CHROMIUM) && OS(DARWIN))
     FloatRect(const NSRect&);
     operator NSRect() const;
 #endif
@@ -153,6 +160,10 @@ public:
     operator SkRect() const;
 #endif
 
+#if PLATFORM(OPENVG)
+    operator VGRect() const;
+#endif
+
 private:
     FloatPoint m_location;
     FloatSize m_size;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FloatSize.h b/src/3rdparty/webkit/WebCore/platform/graphics/FloatSize.h
index 5a84fd1a15..97ee00da84 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FloatSize.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FloatSize.h
@@ -28,13 +28,14 @@
 #ifndef FloatSize_h
 #define FloatSize_h
 
-#include <wtf/Platform.h>
+#include "IntSize.h"
+#include <wtf/MathExtras.h>
 
 #if PLATFORM(CG)
 typedef struct CGSize CGSize;
 #endif
 
-#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
 #ifdef NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
 typedef struct CGSize NSSize;
 #else
@@ -80,7 +81,7 @@ public:
 #endif
 
 #if (PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)) \
-        || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+        || (PLATFORM(CHROMIUM) && OS(DARWIN))
     explicit FloatSize(const NSSize &); // don't do this implicitly since it's lossy
     operator NSSize() const;
 #endif
@@ -128,6 +129,11 @@ inline bool operator!=(const FloatSize& a, const FloatSize& b)
     return a.width() != b.width() || a.height() != b.height();
 }
 
+inline IntSize roundedIntSize(const FloatSize& p)
+{
+    return IntSize(static_cast<int>(roundf(p.width())), static_cast<int>(roundf(p.height())));
+}
+
 } // namespace WebCore
 
 #endif // FloatSize_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Font.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/Font.cpp
index 88774cba16..3d3ffe36f7 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Font.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Font.cpp
@@ -24,7 +24,6 @@
 #include "config.h"
 #include "Font.h"
 
-#include "CharacterNames.h"
 #include "FloatRect.h"
 #include "FontCache.h"
 #include "FontFallbackList.h"
@@ -266,6 +265,23 @@ FontSelector* Font::fontSelector() const
     return m_fontList ? m_fontList->fontSelector() : 0;
 }
 
+String Font::normalizeSpaces(const String& string)
+{
+    const UChar* characters = string.characters();
+    unsigned length = string.length();
+    Vector<UChar, 256> buffer(length);
+    bool didReplacement = false;
+
+    for (unsigned i = 0; i < length; ++i) {
+        UChar originalCharacter = characters[i];
+        buffer[i] = normalizeSpaces(originalCharacter);
+        if (buffer[i] != originalCharacter)
+            didReplacement = true;
+    }
+
+    return didReplacement ? String(buffer.data(), length) : string;
+}
+
 static bool shouldUseFontSmoothing = true;
 
 void Font::setShouldUseSmoothing(bool shouldUseSmoothing)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Font.h b/src/3rdparty/webkit/WebCore/platform/graphics/Font.h
index c0670714ff..3c07be7412 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Font.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Font.h
@@ -25,10 +25,13 @@
 #ifndef Font_h
 #define Font_h
 
+#include "CharacterNames.h"
 #include "TextRun.h"
 #include "FontDescription.h"
 #include "SimpleFontData.h"
+#include "TypesettingFeatures.h"
 #include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
 #include <wtf/MathExtras.h>
 
 #if PLATFORM(QT)
@@ -96,6 +99,12 @@ public:
     
     FontRenderingMode renderingMode() const { return m_fontDescription.renderingMode(); }
 
+    TypesettingFeatures typesettingFeatures() const
+    {
+        TextRenderingMode textRenderingMode = m_fontDescription.textRenderingMode();
+        return textRenderingMode == OptimizeLegibility || textRenderingMode == GeometricPrecision ? Kerning | Ligatures : 0;
+    }
+
     FontFamily& firstFamily() { return m_fontDescription.firstFamily(); }
     const FontFamily& family() const { return m_fontDescription.family(); }
 
@@ -175,6 +184,19 @@ public:
     static bool treatAsSpace(UChar c) { return c == ' ' || c == '\t' || c == '\n' || c == 0x00A0; }
     static bool treatAsZeroWidthSpace(UChar c) { return c < 0x20 || (c >= 0x7F && c < 0xA0) || c == 0x200e || c == 0x200f || (c >= 0x202a && c <= 0x202e) || c == 0xFFFC; }
 
+    static inline UChar normalizeSpaces(UChar character)
+    {
+        if (treatAsSpace(character))
+            return space;
+
+        if (treatAsZeroWidthSpace(character))
+            return zeroWidthSpace;
+
+        return character;
+    }
+
+    static String normalizeSpaces(const String&);
+
 #if ENABLE(SVG_FONTS)
     bool isSVGFont() const;
     SVGFontElement* svgFont() const;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.cpp
index 06ea56bbd6..b3eca852f9 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.cpp
@@ -53,7 +53,7 @@ FontCache::FontCache()
 {
 }
 
-struct FontPlatformDataCacheKey {
+struct FontPlatformDataCacheKey : FastAllocBase {
     FontPlatformDataCacheKey(const AtomicString& family = AtomicString(), unsigned size = 0, unsigned weight = 0, bool italic = false,
                              bool isPrinterFont = false, FontRenderingMode renderingMode = NormalRenderingMode)
         : m_family(family)
@@ -139,7 +139,7 @@ static const AtomicString& alternateFamilyName(const AtomicString& familyName)
     DEFINE_STATIC_LOCAL(AtomicString, courierNew, ("Courier New"));
     if (equalIgnoringCase(familyName, courier))
         return courierNew;
-#if !PLATFORM(WIN_OS)
+#if !OS(WINDOWS)
     // On Windows, Courier New (truetype font) is always present and
     // Courier is a bitmap font. So, we don't want to map Courier New to
     // Courier.
@@ -163,7 +163,7 @@ static const AtomicString& alternateFamilyName(const AtomicString& familyName)
     if (equalIgnoringCase(familyName, helvetica))
         return arial;
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
     // On Windows, bitmap fonts are blocked altogether so that we have to 
     // alias MS Sans Serif (bitmap font) -> Microsoft Sans Serif (truetype font)
     DEFINE_STATIC_LOCAL(AtomicString, msSans, ("MS Sans Serif"));
@@ -257,6 +257,15 @@ const int cMaxInactiveFontData = 120;  // Pretty Low Threshold
 const float cTargetInactiveFontData = 100;
 static ListHashSet<const SimpleFontData*>* gInactiveFontData = 0;
 
+SimpleFontData* FontCache::getCachedFontData(const FontDescription& fontDescription, const AtomicString& family, bool checkingAlternateName)
+{
+    FontPlatformData* platformData = getCachedFontPlatformData(fontDescription, family, checkingAlternateName);
+    if (!platformData)
+        return 0;
+
+    return getCachedFontData(platformData);
+}
+
 SimpleFontData* FontCache::getCachedFontData(const FontPlatformData* platformData)
 {
     if (!platformData)
@@ -361,7 +370,7 @@ size_t FontCache::inactiveFontDataCount()
 
 const FontData* FontCache::getFontData(const Font& font, int& familyIndex, FontSelector* fontSelector)
 {
-    FontPlatformData* result = 0;
+    SimpleFontData* result = 0;
 
     int startIndex = familyIndex;
     const FontFamily* startFamily = &font.fontDescription().family();
@@ -376,7 +385,7 @@ const FontData* FontCache::getFontData(const Font& font, int& familyIndex, FontS
                 if (data)
                     return data;
             }
-            result = getCachedFontPlatformData(font.fontDescription(), currFamily->family());
+            result = getCachedFontData(font.fontDescription(), currFamily->family());
         }
         currFamily = currFamily->next();
     }
@@ -403,9 +412,7 @@ const FontData* FontCache::getFontData(const Font& font, int& familyIndex, FontS
         // Still no result.  Hand back our last resort fallback font.
         result = getLastResortFallbackFont(font.fontDescription());
     }
-
-    // Now that we have a result, we need to go from FontPlatformData -> FontData.
-    return getCachedFontData(result);
+    return result;
 }
 
 static HashSet<FontSelector*>* gClients;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.h b/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.h
index b88305f8de..dd5928d6c2 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.h
@@ -50,7 +50,7 @@ class FontDescription;
 class FontSelector;
 class SimpleFontData;
 
-class FontCache {
+class FontCache : public Noncopyable {
 public:
     friend FontCache* fontCache();
 
@@ -64,7 +64,7 @@ public:
     // Also implemented by the platform.
     void platformInit();
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if OS(WINCE) && !PLATFORM(QT)
 #if defined(IMLANG_FONT_LINK) && (IMLANG_FONT_LINK == 2)
     IMLangFontLink2* getFontLinkInterface();
 #else
@@ -78,9 +78,8 @@ public:
 
     void getTraitsInFamily(const AtomicString&, Vector<unsigned>&);
 
-    FontPlatformData* getCachedFontPlatformData(const FontDescription&, const AtomicString& family, bool checkingAlternateName = false);
-    SimpleFontData* getCachedFontData(const FontPlatformData*);
-    FontPlatformData* getLastResortFallbackFont(const FontDescription&);
+    SimpleFontData* getCachedFontData(const FontDescription& fontDescription, const AtomicString& family, bool checkingAlternateName = false);
+    SimpleFontData* getLastResortFallbackFont(const FontDescription&);
 
     void addClient(FontSelector*);
     void removeClient(FontSelector*);
@@ -96,16 +95,22 @@ private:
     FontCache();
     ~FontCache();
 
+    // FIXME: This method should eventually be removed.
+    FontPlatformData* getCachedFontPlatformData(const FontDescription&, const AtomicString& family, bool checkingAlternateName = false);
+
     // These methods are implemented by each platform.
-    FontPlatformData* getSimilarFontPlatformData(const Font&);
+    SimpleFontData* getSimilarFontPlatformData(const Font&);
     FontPlatformData* createFontPlatformData(const FontDescription&, const AtomicString& family);
 
-    friend class SimpleFontData;
+    SimpleFontData* getCachedFontData(const FontPlatformData*);
+
+    friend class SimpleFontData; // For getCachedFontData(const FontPlatformData*)
     friend class FontFallbackList;
 };
 
 // Get the global fontCache.
 FontCache* fontCache();
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp
index 5246593c76..428e85ef35 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp
@@ -135,13 +135,7 @@ GlyphData Font::glyphDataForCharacter(UChar32 c, bool mirror, bool forceSmallCap
     UChar codeUnits[2];
     int codeUnitsLength;
     if (c <= 0xFFFF) {
-        UChar c16 = c;
-        if (Font::treatAsSpace(c16))
-            codeUnits[0] = ' ';
-        else if (Font::treatAsZeroWidthSpace(c16))
-            codeUnits[0] = zeroWidthSpace;
-        else
-            codeUnits[0] = c16;
+        codeUnits[0] = Font::normalizeSpaces(c);
         codeUnitsLength = 1;
     } else {
         codeUnits[0] = U16_LEAD(c);
@@ -157,7 +151,7 @@ GlyphData Font::glyphDataForCharacter(UChar32 c, bool mirror, bool forceSmallCap
         GlyphData data = fallbackPage && fallbackPage->fontDataForCharacter(c) ? fallbackPage->glyphDataForCharacter(c) : characterFontData->missingGlyphData();
         // Cache it so we don't have to do system fallback again next time.
         if (!useSmallCapsFont) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
             // missingGlyphData returns a null character, which is not suitable for GDI to display.
             // Also, sometimes we cannot map a font for the character on WINCE, but GDI can still
             // display the character, probably because the font package is not installed correctly.
@@ -175,7 +169,7 @@ GlyphData Font::glyphDataForCharacter(UChar32 c, bool mirror, bool forceSmallCap
     // FIXME: It would be nicer to use the missing glyph from the last resort font instead.
     GlyphData data = primaryFont()->missingGlyphData();
     if (!useSmallCapsFont) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
         // See comment about WINCE GDI handling near setGlyphDataForCharacter above.
         page->setGlyphDataForCharacter(c, c, data.fontData);
         return page->glyphDataForCharacter(c);
@@ -251,8 +245,7 @@ bool Font::canUseGlyphCache(const TextRun& run) const
             return false;
     }
 
-    TextRenderingMode textMode = m_fontDescription.textRenderingMode();
-    if (textMode == OptimizeLegibility || textMode == GeometricPrecision)
+    if (typesettingFeatures())
         return false;
 
     return true;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.cpp
index bac9da0182..cd0748eb22 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,17 +10,17 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -34,7 +34,7 @@ using namespace std;
 
 namespace WebCore {
 
-void GeneratedImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator compositeOp)
+void GeneratedImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace, CompositeOperator compositeOp)
 {
     context->save();
     context->setCompositeOperation(compositeOp);
@@ -47,22 +47,27 @@ void GeneratedImage::draw(GraphicsContext* context, const FloatRect& dstRect, co
     context->restore();
 }
 
-void GeneratedImage::drawPattern(GraphicsContext* context, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
-                                 const FloatPoint& phase, CompositeOperator compositeOp, const FloatRect& destRect)
+void GeneratedImage::drawPattern(GraphicsContext* context, const FloatRect& srcRect, const AffineTransform& patternTransform,
+                                 const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator compositeOp, const FloatRect& destRect)
 {
+    // Allow the generator to provide visually-equivalent tiling parameters for better performance.
+    IntSize adjustedSize = m_size;
+    FloatRect adjustedSrcRect = srcRect;
+    m_generator->adjustParametersForTiledDrawing(adjustedSize, adjustedSrcRect);
+
     // Create a BitmapImage and call drawPattern on it.
-    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(m_size);
+    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(adjustedSize);
     ASSERT(imageBuffer.get());
-    
+
     // Fill with the gradient.
     GraphicsContext* graphicsContext = imageBuffer->context();
-    graphicsContext->fillRect(FloatRect(FloatPoint(), m_size), *m_generator.get());
-    
+    graphicsContext->fillRect(FloatRect(FloatPoint(), adjustedSize), *m_generator.get());
+
     // Grab the final image from the image buffer.
     Image* bitmap = imageBuffer->image();
-    
+
     // Now just call drawTiled on that image.
-    bitmap->drawPattern(context, srcRect, patternTransform, phase, compositeOp, destRect);
+    bitmap->drawPattern(context, adjustedSrcRect, patternTransform, phase, styleColorSpace, compositeOp, destRect);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.h b/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.h
index dea0c54817..67a31500bb 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.h
@@ -57,9 +57,9 @@ public:
     virtual unsigned decodedSize() const { return 0; }
 
 protected:
-    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
-    virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
-                             const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
+    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator);
+    virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const AffineTransform& patternTransform,
+                             const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator, const FloatRect& destRect);
     
     GeneratedImage(PassRefPtr<Generator> generator, const IntSize& size)
         : m_generator(generator)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Generator.h b/src/3rdparty/webkit/WebCore/platform/graphics/Generator.h
index a0af689dea..b64d051417 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Generator.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Generator.h
@@ -38,6 +38,7 @@ public:
     virtual ~Generator() {};
     
     virtual void fill(GraphicsContext*, const FloatRect&) = 0;
+    virtual void adjustParametersForTiledDrawing(IntSize& /* size */, FloatRect& /* srcRect */) { }
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphBuffer.h b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphBuffer.h
index 04491a7ce1..edb804cd93 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphBuffer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphBuffer.h
@@ -50,7 +50,7 @@ class SimpleFontData;
 #if PLATFORM(CAIRO)
 // FIXME: Why does Cairo use such a huge struct instead of just an offset into an array?
 typedef cairo_glyph_t GlyphBufferGlyph;
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
 typedef wchar_t GlyphBufferGlyph;
 #else
 typedef Glyph GlyphBufferGlyph;
@@ -60,7 +60,7 @@ typedef Glyph GlyphBufferGlyph;
 // can be passed directly to CGContextShowGlyphsWithAdvances in FontMac.mm
 #if PLATFORM(CG)
 typedef CGSize GlyphBufferAdvance;
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
 // There is no cross-platform code that uses the height of GlyphBufferAdvance,
 // so we can save memory space on embedded devices by storing only the width
 typedef float GlyphBufferAdvance;
@@ -124,7 +124,7 @@ public:
     {
 #if PLATFORM(CG)
         return m_advances[index].width;
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
         return m_advances[index];
 #else
         return m_advances[index].width();
@@ -156,7 +156,7 @@ public:
 #if PLATFORM(CG)
         CGSize advance = { width, 0 };
         m_advances.append(advance);
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
         m_advances.append(width);
 #else
         m_advances.append(FloatSize(width, 0));
@@ -172,7 +172,7 @@ public:
 #endif
     }
     
-#if !PLATFORM(WINCE)
+#if !OS(WINCE)
     void add(Glyph glyph, const SimpleFontData* font, GlyphBufferAdvance advance)
     {
         m_fontData.append(font);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.cpp
index 9f53f0b572..99df92b511 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.cpp
@@ -31,8 +31,10 @@
 
 #include "CString.h"
 #include "CharacterNames.h"
+#include "PlatformString.h"
 #include "SegmentedFontData.h"
 #include "SimpleFontData.h"
+#include <stdio.h>
 #include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.cpp
index 77a0d21a63..2d1e61d7dc 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -28,6 +28,8 @@
 #include "Gradient.h"
 
 #include "Color.h"
+#include "FloatRect.h"
+#include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
@@ -62,6 +64,28 @@ Gradient::~Gradient()
     platformDestroy();
 }
 
+void Gradient::adjustParametersForTiledDrawing(IntSize& size, FloatRect& srcRect)
+{
+    if (m_radial)
+        return;
+
+    if (srcRect.isEmpty())
+        return;
+
+    if (m_p0.x() == m_p1.x()) {
+        size.setWidth(1);
+        srcRect.setWidth(1);
+        srcRect.setX(0);
+        return;
+    }
+    if (m_p0.y() != m_p1.y())
+        return;
+
+    size.setHeight(1);
+    srcRect.setHeight(1);
+    srcRect.setY(0);
+}
+
 void Gradient::addColorStop(float value, const Color& color)
 {
     float r;
@@ -81,6 +105,16 @@ static inline bool compareStops(const Gradient::ColorStop& a, const Gradient::Co
     return a.stop < b.stop;
 }
 
+void Gradient::sortStopsIfNecessary()
+{
+    if (m_stopsSorted)
+        return;
+
+    if (m_stops.size())
+        std::stable_sort(m_stops.begin(), m_stops.end(), compareStops);
+    m_stopsSorted = true;
+}
+
 void Gradient::getColor(float value, float* r, float* g, float* b, float* a) const
 {
     ASSERT(value >= 0);
@@ -155,14 +189,14 @@ void Gradient::setSpreadMethod(GradientSpreadMethod spreadMethod)
     m_spreadMethod = spreadMethod;
 }
 
-void Gradient::setGradientSpaceTransform(const TransformationMatrix& gradientSpaceTransformation)
+void Gradient::setGradientSpaceTransform(const AffineTransform& gradientSpaceTransformation)
 { 
     m_gradientSpaceTransformation = gradientSpaceTransformation;
     setPlatformGradientSpaceTransform(gradientSpaceTransformation);
 }
 
 #if !PLATFORM(SKIA)
-void Gradient::setPlatformGradientSpaceTransform(const TransformationMatrix&)
+void Gradient::setPlatformGradientSpaceTransform(const AffineTransform&)
 {
 }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.h b/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.h
index 0e39e73302..471f0a7c55 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.h
@@ -28,16 +28,25 @@
 #ifndef Gradient_h
 #define Gradient_h
 
+#include "AffineTransform.h"
 #include "FloatPoint.h"
 #include "Generator.h"
 #include "GraphicsTypes.h"
-#include "TransformationMatrix.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/Vector.h>
 
 #if PLATFORM(CG)
+
+#define USE_CG_SHADING defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD)
+
+#if USE_CG_SHADING
 typedef struct CGShading* CGShadingRef;
 typedef CGShadingRef PlatformGradient;
+#else
+typedef struct CGGradient* CGGradientRef;
+typedef CGGradientRef PlatformGradient;
+#endif
+
 #elif PLATFORM(QT)
 QT_BEGIN_NAMESPACE
 class QGradient;
@@ -50,6 +59,9 @@ typedef cairo_pattern_t* PlatformGradient;
 class SkShader;
 typedef class SkShader* PlatformGradient;
 typedef class SkShader* PlatformPattern;
+#elif PLATFORM(HAIKU)
+class BGradient;
+typedef BGradient* PlatformGradient;
 #else
 typedef void* PlatformGradient;
 #endif
@@ -74,7 +86,7 @@ namespace WebCore {
 
         void getColor(float value, float* r, float* g, float* b, float* a) const;
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if OS(WINCE) && !PLATFORM(QT)
         const FloatPoint& p0() const { return m_p0; }
         const FloatPoint& p1() const { return m_p1; }
         float r0() const { return m_r0; }
@@ -97,16 +109,21 @@ namespace WebCore {
         };
 
         void setStopsSorted(bool s) { m_stopsSorted = s; }
-
+        
         void setSpreadMethod(GradientSpreadMethod);
         GradientSpreadMethod spreadMethod() { return m_spreadMethod; }
-        void setGradientSpaceTransform(const TransformationMatrix& gradientSpaceTransformation);
+        void setGradientSpaceTransform(const AffineTransform& gradientSpaceTransformation);
         // Qt and CG transform the gradient at draw time
-        TransformationMatrix gradientSpaceTransform() { return m_gradientSpaceTransformation; }
+        AffineTransform gradientSpaceTransform() { return m_gradientSpaceTransformation; }
 
         virtual void fill(GraphicsContext*, const FloatRect&);
-        void setPlatformGradientSpaceTransform(const TransformationMatrix& gradientSpaceTransformation);
+        virtual void adjustParametersForTiledDrawing(IntSize& size, FloatRect& srcRect);
+
+        void setPlatformGradientSpaceTransform(const AffineTransform& gradientSpaceTransformation);
 
+#if PLATFORM(CG)
+        void paint(GraphicsContext*);
+#endif
     private:
         Gradient(const FloatPoint& p0, const FloatPoint& p1);
         Gradient(const FloatPoint& p0, float r0, const FloatPoint& p1, float r1);
@@ -115,6 +132,7 @@ namespace WebCore {
         void platformDestroy();
 
         int findStop(float value) const;
+        void sortStopsIfNecessary();
 
         bool m_radial;
         FloatPoint m_p0;
@@ -125,7 +143,7 @@ namespace WebCore {
         mutable bool m_stopsSorted;
         mutable int m_lastStop;
         GradientSpreadMethod m_spreadMethod;
-        TransformationMatrix m_gradientSpaceTransformation;
+        AffineTransform m_gradientSpaceTransformation;
 
         PlatformGradient m_gradient;
     };
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.cpp
index ccdce089bc..17639113f8 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,17 +10,17 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -120,24 +120,21 @@ void GraphicsContext::setStrokeStyle(const StrokeStyle& style)
     setPlatformStrokeStyle(style);
 }
 
-void GraphicsContext::setStrokeColor(const Color& color)
+void GraphicsContext::setStrokeColor(const Color& color, ColorSpace colorSpace)
 {
-    m_common->state.strokeColorSpace = SolidColorSpace;
     m_common->state.strokeColor = color;
-    setPlatformStrokeColor(color);
+    m_common->state.strokeColorSpace = colorSpace;
+    m_common->state.strokeGradient.clear();
+    m_common->state.strokePattern.clear();
+    setPlatformStrokeColor(color, colorSpace);
 }
 
-ColorSpace GraphicsContext::strokeColorSpace() const
-{
-    return m_common->state.strokeColorSpace;
-}
-
-void GraphicsContext::setShadow(const IntSize& size, int blur, const Color& color)
+void GraphicsContext::setShadow(const IntSize& size, int blur, const Color& color, ColorSpace colorSpace)
 {
     m_common->state.shadowSize = size;
     m_common->state.shadowBlur = blur;
     m_common->state.shadowColor = color;
-    setPlatformShadow(size, blur, color);
+    setPlatformShadow(size, blur, color, colorSpace);
 }
 
 void GraphicsContext::clearShadow()
@@ -172,6 +169,11 @@ Color GraphicsContext::strokeColor() const
     return m_common->state.strokeColor;
 }
 
+ColorSpace GraphicsContext::strokeColorSpace() const
+{
+    return m_common->state.strokeColorSpace;
+}
+
 WindRule GraphicsContext::fillRule() const
 {
     return m_common->state.fillRule;
@@ -182,11 +184,13 @@ void GraphicsContext::setFillRule(WindRule fillRule)
     m_common->state.fillRule = fillRule;
 }
 
-void GraphicsContext::setFillColor(const Color& color)
+void GraphicsContext::setFillColor(const Color& color, ColorSpace colorSpace)
 {
-    m_common->state.fillColorSpace = SolidColorSpace;
     m_common->state.fillColor = color;
-    setPlatformFillColor(color);
+    m_common->state.fillColorSpace = colorSpace;
+    m_common->state.fillGradient.clear();
+    m_common->state.fillPattern.clear();
+    setPlatformFillColor(color, colorSpace);
 }
 
 Color GraphicsContext::fillColor() const
@@ -194,6 +198,11 @@ Color GraphicsContext::fillColor() const
     return m_common->state.fillColor;
 }
 
+ColorSpace GraphicsContext::fillColorSpace() const
+{
+    return m_common->state.fillColorSpace;
+}
+
 void GraphicsContext::setShouldAntialias(bool b)
 {
     m_common->state.shouldAntialias = b;
@@ -209,10 +218,10 @@ void GraphicsContext::setStrokePattern(PassRefPtr<Pattern> pattern)
 {
     ASSERT(pattern);
     if (!pattern) {
-        setStrokeColor(Color::black);
+        setStrokeColor(Color::black, DeviceColorSpace);
         return;
     }
-    m_common->state.strokeColorSpace = PatternColorSpace;
+    m_common->state.strokeGradient.clear();
     m_common->state.strokePattern = pattern;
     setPlatformStrokePattern(m_common->state.strokePattern.get());
 }
@@ -221,10 +230,10 @@ void GraphicsContext::setFillPattern(PassRefPtr<Pattern> pattern)
 {
     ASSERT(pattern);
     if (!pattern) {
-        setFillColor(Color::black);
+        setFillColor(Color::black, DeviceColorSpace);
         return;
     }
-    m_common->state.fillColorSpace = PatternColorSpace;
+    m_common->state.fillGradient.clear();
     m_common->state.fillPattern = pattern;
     setPlatformFillPattern(m_common->state.fillPattern.get());
 }
@@ -233,11 +242,11 @@ void GraphicsContext::setStrokeGradient(PassRefPtr<Gradient> gradient)
 {
     ASSERT(gradient);
     if (!gradient) {
-        setStrokeColor(Color::black);
+        setStrokeColor(Color::black, DeviceColorSpace);
         return;
     }
-    m_common->state.strokeColorSpace = GradientColorSpace;
     m_common->state.strokeGradient = gradient;
+    m_common->state.strokePattern.clear();
     setPlatformStrokeGradient(m_common->state.strokeGradient.get());
 }
 
@@ -245,11 +254,11 @@ void GraphicsContext::setFillGradient(PassRefPtr<Gradient> gradient)
 {
     ASSERT(gradient);
     if (!gradient) {
-        setFillColor(Color::black);
+        setFillColor(Color::black, DeviceColorSpace);
         return;
     }
-    m_common->state.fillColorSpace = GradientColorSpace;
     m_common->state.fillGradient = gradient;
+    m_common->state.fillPattern.clear();
     setPlatformFillGradient(m_common->state.fillGradient.get());
 }
 
@@ -258,11 +267,6 @@ Gradient* GraphicsContext::fillGradient() const
     return m_common->state.fillGradient.get();
 }
 
-ColorSpace GraphicsContext::fillColorSpace() const
-{
-    return m_common->state.fillColorSpace;
-}
-
 Gradient* GraphicsContext::strokeGradient() const
 {
     return m_common->state.strokeGradient.get();
@@ -304,27 +308,27 @@ bool GraphicsContext::paintingDisabled() const
     return m_common->state.paintingDisabled;
 }
 
-void GraphicsContext::drawImage(Image* image, const IntPoint& p, CompositeOperator op)
+void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const IntPoint& p, CompositeOperator op)
 {
-    drawImage(image, p, IntRect(0, 0, -1, -1), op);
+    drawImage(image, styleColorSpace, p, IntRect(0, 0, -1, -1), op);
 }
 
-void GraphicsContext::drawImage(Image* image, const IntRect& r, CompositeOperator op, bool useLowQualityScale)
+void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const IntRect& r, CompositeOperator op, bool useLowQualityScale)
 {
-    drawImage(image, r, IntRect(0, 0, -1, -1), op, useLowQualityScale);
+    drawImage(image, styleColorSpace, r, IntRect(0, 0, -1, -1), op, useLowQualityScale);
 }
 
-void GraphicsContext::drawImage(Image* image, const IntPoint& dest, const IntRect& srcRect, CompositeOperator op)
+void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const IntPoint& dest, const IntRect& srcRect, CompositeOperator op)
 {
-    drawImage(image, IntRect(dest, srcRect.size()), srcRect, op);
+    drawImage(image, styleColorSpace, IntRect(dest, srcRect.size()), srcRect, op);
 }
 
-void GraphicsContext::drawImage(Image* image, const IntRect& dest, const IntRect& srcRect, CompositeOperator op, bool useLowQualityScale)
+void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const IntRect& dest, const IntRect& srcRect, CompositeOperator op, bool useLowQualityScale)
 {
-    drawImage(image, FloatRect(dest), srcRect, op, useLowQualityScale);
+    drawImage(image, styleColorSpace, FloatRect(dest), srcRect, op, useLowQualityScale);
 }
 
-#if !PLATFORM(WINCE) || PLATFORM(QT)
+#if !OS(WINCE) || PLATFORM(QT)
 void GraphicsContext::drawText(const Font& font, const TextRun& run, const IntPoint& point, int from, int to)
 {
     if (paintingDisabled())
@@ -370,64 +374,15 @@ void GraphicsContext::drawBidiText(const Font& font, const TextRun& run, const F
     bidiResolver.deleteRuns();
 }
 
-void GraphicsContext::drawHighlightForText(const Font& font, const TextRun& run, const IntPoint& point, int h, const Color& backgroundColor, int from, int to)
+void GraphicsContext::drawHighlightForText(const Font& font, const TextRun& run, const IntPoint& point, int h, const Color& backgroundColor, ColorSpace colorSpace, int from, int to)
 {
     if (paintingDisabled())
         return;
 
-    fillRect(font.selectionRectForText(run, point, h, from, to), backgroundColor);
+    fillRect(font.selectionRectForText(run, point, h, from, to), backgroundColor, colorSpace);
 }
 
-void GraphicsContext::initFocusRing(int width, int offset)
-{
-    if (paintingDisabled())
-        return;
-    clearFocusRing();
-
-    m_common->m_focusRingWidth = width;
-    m_common->m_focusRingOffset = offset;
-}
-
-void GraphicsContext::clearFocusRing()
-{
-    m_common->m_focusRingRects.clear();
-}
-
-IntRect GraphicsContext::focusRingBoundingRect()
-{
-    IntRect result = IntRect(0, 0, 0, 0);
-
-    const Vector<IntRect>& rects = focusRingRects();
-    unsigned rectCount = rects.size();
-    for (unsigned i = 0; i < rectCount; i++)
-        result.unite(rects[i]);
-
-    return result;
-}
-
-void GraphicsContext::addFocusRingRect(const IntRect& rect)
-{
-    if (paintingDisabled() || rect.isEmpty())
-        return;
-    m_common->m_focusRingRects.append(rect);
-}
-
-int GraphicsContext::focusRingWidth() const
-{
-    return m_common->m_focusRingWidth;
-}
-
-int GraphicsContext::focusRingOffset() const
-{
-    return m_common->m_focusRingOffset;
-}
-
-const Vector<IntRect>& GraphicsContext::focusRingRects() const
-{
-    return m_common->m_focusRingRects;
-}
-
-void GraphicsContext::drawImage(Image* image, const FloatRect& dest, const FloatRect& src, CompositeOperator op, bool useLowQualityScale)
+void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const FloatRect& dest, const FloatRect& src, CompositeOperator op, bool useLowQualityScale)
 {
     if (paintingDisabled() || !image)
         return;
@@ -451,29 +406,40 @@ void GraphicsContext::drawImage(Image* image, const FloatRect& dest, const Float
         save();
         setImageInterpolationQuality(InterpolationNone);
     }
-    image->draw(this, FloatRect(dest.location(), FloatSize(tw, th)), FloatRect(src.location(), FloatSize(tsw, tsh)), op);
+    image->draw(this, FloatRect(dest.location(), FloatSize(tw, th)), FloatRect(src.location(), FloatSize(tsw, tsh)), styleColorSpace, op);
     if (useLowQualityScale)
         restore();
 }
 
-void GraphicsContext::drawTiledImage(Image* image, const IntRect& rect, const IntPoint& srcPoint, const IntSize& tileSize, CompositeOperator op)
+void GraphicsContext::drawTiledImage(Image* image, ColorSpace styleColorSpace, const IntRect& rect, const IntPoint& srcPoint, const IntSize& tileSize, CompositeOperator op, bool useLowQualityScale)
 {
     if (paintingDisabled() || !image)
         return;
-
-    image->drawTiled(this, rect, srcPoint, tileSize, op);
+    if (useLowQualityScale) {
+        save();
+        setImageInterpolationQuality(InterpolationLow);
+    }
+    image->drawTiled(this, rect, srcPoint, tileSize, styleColorSpace, op);
+    if (useLowQualityScale)
+        restore();
 }
 
-void GraphicsContext::drawTiledImage(Image* image, const IntRect& dest, const IntRect& srcRect, Image::TileRule hRule, Image::TileRule vRule, CompositeOperator op)
+void GraphicsContext::drawTiledImage(Image* image, ColorSpace styleColorSpace, const IntRect& dest, const IntRect& srcRect, Image::TileRule hRule, Image::TileRule vRule, CompositeOperator op, bool useLowQualityScale)
 {
     if (paintingDisabled() || !image)
         return;
 
+    if (useLowQualityScale) {
+        save();
+        setImageInterpolationQuality(InterpolationLow);
+    }
     if (hRule == Image::StretchTile && vRule == Image::StretchTile)
         // Just do a scale.
-        return drawImage(image, dest, srcRect, op);
-
-    image->drawTiled(this, dest, srcRect, hRule, vRule, op);
+        drawImage(image, styleColorSpace, dest, srcRect, op);
+    else
+        image->drawTiled(this, dest, srcRect, hRule, vRule, styleColorSpace, op);
+    if (useLowQualityScale)
+        restore();
 }
 
 void GraphicsContext::addRoundedRectClip(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight,
@@ -540,7 +506,7 @@ void GraphicsContext::setPlatformTextDrawingMode(int mode)
 }
 #endif
 
-#if !PLATFORM(QT) && !PLATFORM(CAIRO) && !PLATFORM(SKIA) && !PLATFORM(HAIKU)
+#if !PLATFORM(QT) && !PLATFORM(CAIRO) && !PLATFORM(SKIA) && !PLATFORM(HAIKU) && !PLATFORM(OPENVG)
 void GraphicsContext::setPlatformStrokeStyle(const StrokeStyle&)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h
index c6bb20c00b..1f99daba6e 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008-2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,6 +27,7 @@
 #ifndef GraphicsContext_h
 #define GraphicsContext_h
 
+#include "ColorSpace.h"
 #include "DashArray.h"
 #include "FloatRect.h"
 #include "Image.h"
@@ -34,12 +35,17 @@
 #include "Path.h"
 #include "TextDirection.h"
 #include <wtf/Noncopyable.h>
-#include <wtf/Platform.h>
+#include <wtf/PassOwnPtr.h>
 
 #if PLATFORM(CG)
 typedef struct CGContext PlatformGraphicsContext;
 #elif PLATFORM(CAIRO)
 typedef struct _cairo PlatformGraphicsContext;
+#elif PLATFORM(OPENVG)
+namespace WebCore {
+class SurfaceOpenVG;
+}
+typedef class WebCore::SurfaceOpenVG PlatformGraphicsContext;
 #elif PLATFORM(QT)
 QT_BEGIN_NAMESPACE
 class QPainter;
@@ -70,7 +76,7 @@ typedef class PlatformContextSkia PlatformGraphicsContext;
 class BView;
 typedef BView PlatformGraphicsContext;
 struct pattern;
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
 typedef struct HDC__ PlatformGraphicsContext;
 #else
 typedef void PlatformGraphicsContext;
@@ -95,7 +101,7 @@ typedef unsigned char UInt8;
 
 namespace WebCore {
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if OS(WINCE) && !PLATFORM(QT)
     class SharedBitmap;
     class SimpleFontData;
     class GlyphBuffer;
@@ -105,12 +111,12 @@ namespace WebCore {
     const int cMisspellingLinePatternWidth = 4;
     const int cMisspellingLinePatternGapWidth = 1;
 
-    class TransformationMatrix;
+    class AffineTransform;
     class Font;
     class Generator;
     class Gradient;
-    class GraphicsContextPrivate;
     class GraphicsContextPlatformPrivate;
+    class GraphicsContextPrivate;
     class ImageBuffer;
     class KURL;
     class Path;
@@ -130,18 +136,6 @@ namespace WebCore {
         DashedStroke
     };
 
-    // FIXME: This is a place-holder until we decide to add
-    // real color space support to WebCore.  At that time, ColorSpace will be a
-    // class and instances will be held  off of Colors.   There will be
-    // special singleton Gradient and Pattern color spaces to mark when
-    // a fill or stroke is using a gradient or pattern instead of a solid color.
-    // https://bugs.webkit.org/show_bug.cgi?id=20558
-    enum ColorSpace {
-        SolidColorSpace,
-        PatternColorSpace,
-        GradientColorSpace
-    };
-
     enum InterpolationQuality {
         InterpolationDefault,
         InterpolationNone,
@@ -155,7 +149,7 @@ namespace WebCore {
         GraphicsContext(PlatformGraphicsContext*);
         ~GraphicsContext();
 
-#if !PLATFORM(WINCE) || PLATFORM(QT)
+#if !OS(WINCE) || PLATFORM(QT)
         PlatformGraphicsContext* platformContext() const;
 #endif
 
@@ -164,9 +158,8 @@ namespace WebCore {
         StrokeStyle strokeStyle() const;
         void setStrokeStyle(const StrokeStyle& style);
         Color strokeColor() const;
-        void setStrokeColor(const Color&);
-
         ColorSpace strokeColorSpace() const;
+        void setStrokeColor(const Color&, ColorSpace);
 
         void setStrokePattern(PassRefPtr<Pattern>);
         Pattern* strokePattern() const;
@@ -177,7 +170,8 @@ namespace WebCore {
         WindRule fillRule() const;
         void setFillRule(WindRule);
         Color fillColor() const;
-        void setFillColor(const Color&);
+        ColorSpace fillColorSpace() const;
+        void setFillColor(const Color&, ColorSpace);
 
         void setFillPattern(PassRefPtr<Pattern>);
         Pattern* fillPattern() const;
@@ -185,8 +179,6 @@ namespace WebCore {
         void setFillGradient(PassRefPtr<Gradient>);
         Gradient* fillGradient() const;
 
-        ColorSpace fillColorSpace() const;
-
         void setShadowsIgnoreTransforms(bool);
 
         void setShouldAntialias(bool);
@@ -217,26 +209,26 @@ namespace WebCore {
         void strokeArc(const IntRect&, int startAngle, int angleSpan);
 
         void fillRect(const FloatRect&);
-        void fillRect(const FloatRect&, const Color&);
+        void fillRect(const FloatRect&, const Color&, ColorSpace);
         void fillRect(const FloatRect&, Generator&);
-        void fillRoundedRect(const IntRect&, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color&);
+        void fillRoundedRect(const IntRect&, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color&, ColorSpace);
 
         void clearRect(const FloatRect&);
 
         void strokeRect(const FloatRect&);
         void strokeRect(const FloatRect&, float lineWidth);
 
-        void drawImage(Image*, const IntPoint&, CompositeOperator = CompositeSourceOver);
-        void drawImage(Image*, const IntRect&, CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
-        void drawImage(Image*, const IntPoint& destPoint, const IntRect& srcRect, CompositeOperator = CompositeSourceOver);
-        void drawImage(Image*, const IntRect& destRect, const IntRect& srcRect, CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
-        void drawImage(Image*, const FloatRect& destRect, const FloatRect& srcRect = FloatRect(0, 0, -1, -1),
+        void drawImage(Image*, ColorSpace styleColorSpace, const IntPoint&, CompositeOperator = CompositeSourceOver);
+        void drawImage(Image*, ColorSpace styleColorSpace, const IntRect&, CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
+        void drawImage(Image*, ColorSpace styleColorSpace, const IntPoint& destPoint, const IntRect& srcRect, CompositeOperator = CompositeSourceOver);
+        void drawImage(Image*, ColorSpace styleColorSpace, const IntRect& destRect, const IntRect& srcRect, CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
+        void drawImage(Image*, ColorSpace styleColorSpace, const FloatRect& destRect, const FloatRect& srcRect = FloatRect(0, 0, -1, -1),
                        CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
-        void drawTiledImage(Image*, const IntRect& destRect, const IntPoint& srcPoint, const IntSize& tileSize,
-                       CompositeOperator = CompositeSourceOver);
-        void drawTiledImage(Image*, const IntRect& destRect, const IntRect& srcRect,
+        void drawTiledImage(Image*, ColorSpace styleColorSpace, const IntRect& destRect, const IntPoint& srcPoint, const IntSize& tileSize,
+                       CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
+        void drawTiledImage(Image*, ColorSpace styleColorSpace, const IntRect& destRect, const IntRect& srcRect,
                             Image::TileRule hRule = Image::StretchTile, Image::TileRule vRule = Image::StretchTile,
-                            CompositeOperator = CompositeSourceOver);
+                            CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
 
         void setImageInterpolationQuality(InterpolationQuality);
         InterpolationQuality imageInterpolationQuality() const;
@@ -255,7 +247,7 @@ namespace WebCore {
 
         void drawText(const Font&, const TextRun&, const IntPoint&, int from = 0, int to = -1);
         void drawBidiText(const Font&, const TextRun&, const FloatPoint&);
-        void drawHighlightForText(const Font&, const TextRun&, const IntPoint&, int h, const Color& backgroundColor, int from = 0, int to = -1);
+        void drawHighlightForText(const Font&, const TextRun&, const IntPoint&, int h, const Color& backgroundColor, ColorSpace, int from = 0, int to = -1);
 
         FloatRect roundToDevicePixels(const FloatRect&);
 
@@ -271,15 +263,12 @@ namespace WebCore {
         void beginTransparencyLayer(float opacity);
         void endTransparencyLayer();
 
-        void setShadow(const IntSize&, int blur, const Color&);
+        void setShadow(const IntSize&, int blur, const Color&, ColorSpace);
         bool getShadow(IntSize&, int&, Color&) const;
         void clearShadow();
 
-        void initFocusRing(int width, int offset);
-        void addFocusRingRect(const IntRect&);
-        void drawFocusRing(const Color&);
-        void clearFocusRing();
-        IntRect focusRingBoundingRect();
+        void drawFocusRing(const Vector<IntRect>&, int width, int offset, const Color&);
+        void drawFocusRing(const Vector<Path>&, int width, int offset, const Color&);
 
         void setLineCap(LineCap);
         void setLineDash(const DashArray&, float dashOffset);
@@ -289,6 +278,8 @@ namespace WebCore {
         void setAlpha(float);
 #if PLATFORM(CAIRO)
         float getAlpha();
+        void createPlatformShadow(PassOwnPtr<ImageBuffer> buffer, const Color& shadowColor, const FloatRect& shadowRect, float kernelSize);
+        static void calculateShadowBufferDimensions(IntSize& shadowBufferSize, FloatRect& shadowRect, float& kernelSize, const FloatRect& sourceRect, const IntSize& shadowSize, int shadowBlur);
 #endif
 
         void setCompositeOperation(CompositeOperator);
@@ -306,15 +297,16 @@ namespace WebCore {
 
         void scale(const FloatSize&);
         void rotate(float angleInRadians);
+        void translate(const FloatSize& size) { translate(size.width(), size.height()); }
         void translate(float x, float y);
         IntPoint origin();
 
         void setURLForRect(const KURL&, const IntRect&);
 
-        void concatCTM(const TransformationMatrix&);
-        TransformationMatrix getCTM() const;
+        void concatCTM(const AffineTransform&);
+        AffineTransform getCTM() const;
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if OS(WINCE) && !PLATFORM(QT)
         void setBitmap(PassRefPtr<SharedBitmap>);
         const TransformationMatrix& affineTransform() const;
         TransformationMatrix& affineTransform();
@@ -325,7 +317,7 @@ namespace WebCore {
         void drawFocusRect(const IntRect& rect);
         void paintTextField(const IntRect& rect, unsigned state);
         void drawBitmap(SharedBitmap*, const IntRect& dstRect, const IntRect& srcRect, CompositeOperator compositeOp);
-        void drawBitmapPattern(SharedBitmap*, const FloatRect& tileRectIn, const TransformationMatrix& patternTransform, const FloatPoint& phase, CompositeOperator op, const FloatRect& destRect, const IntSize& origSourceSize);
+        void drawBitmapPattern(SharedBitmap*, const FloatRect& tileRectIn, const AffineTransform& patternTransform, const FloatPoint& phase, CompositeOperator op, const FloatRect& destRect, const IntSize& origSourceSize);
         void drawIcon(HICON icon, const IntRect& dstRect, UINT flags);
         HDC getWindowsContext(const IntRect&, bool supportAlphaBlend = false, bool mayCreateBitmap = true); // The passed in rect is used to create a bitmap for compositing inside transparency layers.
         void releaseWindowsContext(HDC, const IntRect&, bool supportAlphaBlend = false, bool mayCreateBitmap = true);    // The passed in HDC should be the one handed back by getWindowsContext.
@@ -372,12 +364,16 @@ namespace WebCore {
         void drawWindowsBitmap(WindowsBitmap*, const IntPoint&);
 #endif
 
-#if PLATFORM(QT) && defined(Q_WS_WIN)
+#if (PLATFORM(QT) && defined(Q_WS_WIN)) || (PLATFORM(WX) && OS(WINDOWS))
         HDC getWindowsContext(const IntRect&, bool supportAlphaBlend = true, bool mayCreateBitmap = true);
         void releaseWindowsContext(HDC, const IntRect&, bool supportAlphaBlend = true, bool mayCreateBitmap = true);
         bool shouldIncludeChildWindows() const { return false; }
 #endif
 
+#if PLATFORM(WX)
+        bool inTransparencyLayer() const { return false; }
+#endif
+
 #if PLATFORM(QT)
         bool inTransparencyLayer() const;
         PlatformPath* currentPath();
@@ -401,27 +397,23 @@ namespace WebCore {
         void setPlatformTextDrawingMode(int);
         void setPlatformFont(const Font& font);
 
-        void setPlatformStrokeColor(const Color&);
+        void setPlatformStrokeColor(const Color&, ColorSpace);
         void setPlatformStrokeStyle(const StrokeStyle&);
         void setPlatformStrokeThickness(float);
         void setPlatformStrokeGradient(Gradient*);
         void setPlatformStrokePattern(Pattern*);
 
-        void setPlatformFillColor(const Color&);
+        void setPlatformFillColor(const Color&, ColorSpace);
         void setPlatformFillGradient(Gradient*);
         void setPlatformFillPattern(Pattern*);
 
         void setPlatformShouldAntialias(bool b);
 
-        void setPlatformShadow(const IntSize&, int blur, const Color&);
+        void setPlatformShadow(const IntSize&, int blur, const Color&, ColorSpace);
         void clearPlatformShadow();
 
         static void adjustLineToPixelBoundaries(FloatPoint& p1, FloatPoint& p2, float strokeWidth, const StrokeStyle&);
 
-        int focusRingWidth() const;
-        int focusRingOffset() const;
-        const Vector<IntRect>& focusRingRects() const;
-
         static GraphicsContextPrivate* createGraphicsContextPrivate();
         static void destroyGraphicsContextPrivate(GraphicsContextPrivate*);
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.cpp
new file mode 100644
index 0000000000..97465e2a80
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.cpp
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "GraphicsContext3D.h"
+
+#include "Image.h"
+#include "ImageData.h"
+
+namespace WebCore {
+
+bool GraphicsContext3D::extractImageData(Image* image,
+                                         bool flipY,
+                                         bool premultiplyAlpha,
+                                         Vector<uint8_t>& imageData,
+                                         unsigned int* format,
+                                         unsigned int* internalFormat)
+{
+    if (!image)
+        return false;
+    AlphaOp alphaOp = kAlphaDoNothing;
+    bool hasAlphaChannel = true;
+    if (!getImageData(image, imageData, premultiplyAlpha,
+                      &hasAlphaChannel, &alphaOp, format))
+        return false;
+    processImageData(imageData.data(),
+                     image->width(),
+                     image->height(),
+                     flipY,
+                     alphaOp);
+    *internalFormat = (hasAlphaChannel ? RGBA : RGB);
+    return true;
+}
+
+bool GraphicsContext3D::extractImageData(ImageData* imageData,
+                                         bool flipY,
+                                         bool premultiplyAlpha,
+                                         Vector<uint8_t>& data)
+{
+    if (!imageData)
+        return false;
+    int width = imageData->width();
+    int height = imageData->height();
+    int dataBytes = width * height * 4;
+    data.resize(dataBytes);
+    uint8_t* dst = data.data();
+    uint8_t* src = imageData->data()->data()->data();
+    memcpy(dst, src, dataBytes);
+    processImageData(dst,
+                     width,
+                     height,
+                     flipY,
+                     premultiplyAlpha ? kAlphaDoPremultiply : kAlphaDoNothing);
+    return true;
+}
+
+void GraphicsContext3D::processImageData(uint8_t* imageData,
+                                         unsigned width,
+                                         unsigned height,
+                                         bool flipVertically,
+                                         AlphaOp alphaOp)
+{
+    switch (alphaOp) {
+    case kAlphaDoPremultiply:
+        premultiplyAlpha(imageData, width * height);
+        break;
+    case kAlphaDoUnmultiply:
+        unmultiplyAlpha(imageData, width * height);
+        break;
+    default:
+        break;
+    }
+
+    if (flipVertically && width && height) {
+        int rowBytes = width * 4;
+        uint8_t* tempRow = new uint8_t[rowBytes];
+        for (unsigned i = 0; i < height / 2; i++) {
+            uint8_t* lowRow = imageData + (rowBytes * i);
+            uint8_t* highRow = imageData + (rowBytes * (height - i - 1));
+            memcpy(tempRow, lowRow, rowBytes);
+            memcpy(lowRow, highRow, rowBytes);
+            memcpy(highRow, tempRow, rowBytes);
+        }
+        delete[] tempRow;
+    }
+}
+
+// Premultiply alpha into color channels.
+void GraphicsContext3D::premultiplyAlpha(unsigned char* rgbaData, int numPixels)
+{
+    for (int j = 0; j < numPixels; j++) {
+        float r = rgbaData[4*j+0] / 255.0f;
+        float g = rgbaData[4*j+1] / 255.0f;
+        float b = rgbaData[4*j+2] / 255.0f;
+        float a = rgbaData[4*j+3] / 255.0f;
+        rgbaData[4*j+0] = (unsigned char) (r * a * 255.0f);
+        rgbaData[4*j+1] = (unsigned char) (g * a * 255.0f);
+        rgbaData[4*j+2] = (unsigned char) (b * a * 255.0f);
+    }
+}
+
+// Remove premultiplied alpha from color channels.
+// FIXME: this is lossy. Must retrieve original values from HTMLImageElement.
+void GraphicsContext3D::unmultiplyAlpha(unsigned char* rgbaData, int numPixels)
+{
+    for (int j = 0; j < numPixels; j++) {
+        float r = rgbaData[4*j+0] / 255.0f;
+        float g = rgbaData[4*j+1] / 255.0f;
+        float b = rgbaData[4*j+2] / 255.0f;
+        float a = rgbaData[4*j+3] / 255.0f;
+        if (a > 0.0f) {
+            r /= a;
+            g /= a;
+            b /= a;
+            r = (r > 1.0f) ? 1.0f : r;
+            g = (g > 1.0f) ? 1.0f : g;
+            b = (b > 1.0f) ? 1.0f : b;
+            rgbaData[4*j+0] = (unsigned char) (r * 255.0f);
+            rgbaData[4*j+1] = (unsigned char) (g * 255.0f);
+            rgbaData[4*j+2] = (unsigned char) (b * 255.0f);
+        }
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
index 07ec04d5c5..3acbebf187 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
@@ -28,9 +28,15 @@
 
 #include "PlatformString.h"
 
+#include <wtf/ListHashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/PassOwnPtr.h>
 
+// FIXME: Find a better way to avoid the name confliction for NO_ERROR.
+#if ((PLATFORM(CHROMIUM) && OS(WINDOWS)) || PLATFORM(WIN))
+#undef NO_ERROR
+#endif
+
 #if PLATFORM(MAC)
 #include <OpenGL/OpenGL.h>
 
@@ -38,6 +44,13 @@ typedef void* PlatformGraphicsContext3D;
 const  PlatformGraphicsContext3D NullPlatformGraphicsContext3D = 0;
 typedef GLuint Platform3DObject;
 const Platform3DObject NullPlatform3DObject = 0;
+#elif PLATFORM(QT)
+#include <QtOpenGL/QtOpenGL>
+
+typedef void* PlatformGraphicsContext3D;
+const  PlatformGraphicsContext3D NullPlatformGraphicsContext3D = 0;
+typedef int Platform3DObject;
+const Platform3DObject NullPlatform3DObject = 0;
 #else
 typedef void* PlatformGraphicsContext3D;
 const  PlatformGraphicsContext3D NullPlatformGraphicsContext3D = 0;
@@ -46,23 +59,20 @@ const Platform3DObject NullPlatform3DObject = 0;
 #endif
 
 namespace WebCore {
-    class CanvasActiveInfo;
-    class CanvasArray;
-    class CanvasBuffer;
-    class CanvasUnsignedByteArray;
-    class CanvasFloatArray;
-    class CanvasFramebuffer;
-    class CanvasIntArray;
-    class CanvasProgram;
-    class CanvasRenderbuffer;
-    class CanvasRenderingContext3D;
-    class CanvasShader;
-    class CanvasTexture;
-    class HTMLCanvasElement;
-    class HTMLImageElement;
-    class HTMLVideoElement;
+    class WebGLActiveInfo;
+    class WebGLArray;
+    class WebGLBuffer;
+    class WebGLUnsignedByteArray;
+    class WebGLFloatArray;
+    class WebGLFramebuffer;
+    class WebGLIntArray;
+    class WebGLProgram;
+    class WebGLRenderbuffer;
+    class WebGLRenderingContext;
+    class WebGLShader;
+    class WebGLTexture;
+    class Image;
     class ImageData;
-    class WebKitCSSMatrix;
 
     struct ActiveInfo {
         String name;
@@ -71,15 +81,334 @@ namespace WebCore {
     };
 
     // FIXME: ideally this would be used on all platforms.
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(QT)
     class GraphicsContext3DInternal;
 #endif
 
     class GraphicsContext3D : public Noncopyable {
     public:
-        enum ShaderType { FRAGMENT_SHADER, VERTEX_SHADER };
-    
-        static PassOwnPtr<GraphicsContext3D> create();
+        enum WebGLEnumType {
+            DEPTH_BUFFER_BIT = 0x00000100,
+            STENCIL_BUFFER_BIT = 0x00000400,
+            COLOR_BUFFER_BIT = 0x00004000,
+            POINTS = 0x0000,
+            LINES = 0x0001,
+            LINE_LOOP = 0x0002,
+            LINE_STRIP = 0x0003,
+            TRIANGLES = 0x0004,
+            TRIANGLE_STRIP = 0x0005,
+            TRIANGLE_FAN = 0x0006,
+            ZERO = 0,
+            ONE = 1,
+            SRC_COLOR = 0x0300,
+            ONE_MINUS_SRC_COLOR = 0x0301,
+            SRC_ALPHA = 0x0302,
+            ONE_MINUS_SRC_ALPHA = 0x0303,
+            DST_ALPHA = 0x0304,
+            ONE_MINUS_DST_ALPHA = 0x0305,
+            DST_COLOR = 0x0306,
+            ONE_MINUS_DST_COLOR = 0x0307,
+            SRC_ALPHA_SATURATE = 0x0308,
+            FUNC_ADD = 0x8006,
+            BLEND_EQUATION = 0x8009,
+            BLEND_EQUATION_RGB = 0x8009,
+            BLEND_EQUATION_ALPHA = 0x883D,
+            FUNC_SUBTRACT = 0x800A,
+            FUNC_REVERSE_SUBTRACT = 0x800B,
+            BLEND_DST_RGB = 0x80C8,
+            BLEND_SRC_RGB = 0x80C9,
+            BLEND_DST_ALPHA = 0x80CA,
+            BLEND_SRC_ALPHA = 0x80CB,
+            CONSTANT_COLOR = 0x8001,
+            ONE_MINUS_CONSTANT_COLOR = 0x8002,
+            CONSTANT_ALPHA = 0x8003,
+            ONE_MINUS_CONSTANT_ALPHA = 0x8004,
+            BLEND_COLOR = 0x8005,
+            ARRAY_BUFFER = 0x8892,
+            ELEMENT_ARRAY_BUFFER = 0x8893,
+            ARRAY_BUFFER_BINDING = 0x8894,
+            ELEMENT_ARRAY_BUFFER_BINDING = 0x8895,
+            STREAM_DRAW = 0x88E0,
+            STATIC_DRAW = 0x88E4,
+            DYNAMIC_DRAW = 0x88E8,
+            BUFFER_SIZE = 0x8764,
+            BUFFER_USAGE = 0x8765,
+            CURRENT_VERTEX_ATTRIB = 0x8626,
+            FRONT = 0x0404,
+            BACK = 0x0405,
+            FRONT_AND_BACK = 0x0408,
+            TEXTURE_2D = 0x0DE1,
+            CULL_FACE = 0x0B44,
+            BLEND = 0x0BE2,
+            DITHER = 0x0BD0,
+            STENCIL_TEST = 0x0B90,
+            DEPTH_TEST = 0x0B71,
+            SCISSOR_TEST = 0x0C11,
+            POLYGON_OFFSET_FILL = 0x8037,
+            SAMPLE_ALPHA_TO_COVERAGE = 0x809E,
+            SAMPLE_COVERAGE = 0x80A0,
+            NO_ERROR = 0,
+            INVALID_ENUM = 0x0500,
+            INVALID_VALUE = 0x0501,
+            INVALID_OPERATION = 0x0502,
+            OUT_OF_MEMORY = 0x0505,
+            CW = 0x0900,
+            CCW = 0x0901,
+            LINE_WIDTH = 0x0B21,
+            ALIASED_POINT_SIZE_RANGE = 0x846D,
+            ALIASED_LINE_WIDTH_RANGE = 0x846E,
+            CULL_FACE_MODE = 0x0B45,
+            FRONT_FACE = 0x0B46,
+            DEPTH_RANGE = 0x0B70,
+            DEPTH_WRITEMASK = 0x0B72,
+            DEPTH_CLEAR_VALUE = 0x0B73,
+            DEPTH_FUNC = 0x0B74,
+            STENCIL_CLEAR_VALUE = 0x0B91,
+            STENCIL_FUNC = 0x0B92,
+            STENCIL_FAIL = 0x0B94,
+            STENCIL_PASS_DEPTH_FAIL = 0x0B95,
+            STENCIL_PASS_DEPTH_PASS = 0x0B96,
+            STENCIL_REF = 0x0B97,
+            STENCIL_VALUE_MASK = 0x0B93,
+            STENCIL_WRITEMASK = 0x0B98,
+            STENCIL_BACK_FUNC = 0x8800,
+            STENCIL_BACK_FAIL = 0x8801,
+            STENCIL_BACK_PASS_DEPTH_FAIL = 0x8802,
+            STENCIL_BACK_PASS_DEPTH_PASS = 0x8803,
+            STENCIL_BACK_REF = 0x8CA3,
+            STENCIL_BACK_VALUE_MASK = 0x8CA4,
+            STENCIL_BACK_WRITEMASK = 0x8CA5,
+            VIEWPORT = 0x0BA2,
+            SCISSOR_BOX = 0x0C10,
+            COLOR_CLEAR_VALUE = 0x0C22,
+            COLOR_WRITEMASK = 0x0C23,
+            UNPACK_ALIGNMENT = 0x0CF5,
+            PACK_ALIGNMENT = 0x0D05,
+            MAX_TEXTURE_SIZE = 0x0D33,
+            MAX_VIEWPORT_DIMS = 0x0D3A,
+            SUBPIXEL_BITS = 0x0D50,
+            RED_BITS = 0x0D52,
+            GREEN_BITS = 0x0D53,
+            BLUE_BITS = 0x0D54,
+            ALPHA_BITS = 0x0D55,
+            DEPTH_BITS = 0x0D56,
+            STENCIL_BITS = 0x0D57,
+            POLYGON_OFFSET_UNITS = 0x2A00,
+            POLYGON_OFFSET_FACTOR = 0x8038,
+            TEXTURE_BINDING_2D = 0x8069,
+            SAMPLE_BUFFERS = 0x80A8,
+            SAMPLES = 0x80A9,
+            SAMPLE_COVERAGE_VALUE = 0x80AA,
+            SAMPLE_COVERAGE_INVERT = 0x80AB,
+            NUM_COMPRESSED_TEXTURE_FORMATS = 0x86A2,
+            COMPRESSED_TEXTURE_FORMATS = 0x86A3,
+            DONT_CARE = 0x1100,
+            FASTEST = 0x1101,
+            NICEST = 0x1102,
+            GENERATE_MIPMAP_HINT = 0x8192,
+            BYTE = 0x1400,
+            UNSIGNED_BYTE = 0x1401,
+            SHORT = 0x1402,
+            UNSIGNED_SHORT = 0x1403,
+            INT = 0x1404,
+            UNSIGNED_INT = 0x1405,
+            FLOAT = 0x1406,
+            FIXED = 0x140C,
+            DEPTH_COMPONENT = 0x1902,
+            ALPHA = 0x1906,
+            RGB = 0x1907,
+            RGBA = 0x1908,
+            LUMINANCE = 0x1909,
+            LUMINANCE_ALPHA = 0x190A,
+            UNSIGNED_SHORT_4_4_4_4 = 0x8033,
+            UNSIGNED_SHORT_5_5_5_1 = 0x8034,
+            UNSIGNED_SHORT_5_6_5 = 0x8363,
+            FRAGMENT_SHADER = 0x8B30,
+            VERTEX_SHADER = 0x8B31,
+            MAX_VERTEX_ATTRIBS = 0x8869,
+            MAX_VERTEX_UNIFORM_VECTORS = 0x8DFB,
+            MAX_VARYING_VECTORS = 0x8DFC,
+            MAX_COMBINED_TEXTURE_IMAGE_UNITS = 0x8B4D,
+            MAX_VERTEX_TEXTURE_IMAGE_UNITS = 0x8B4C,
+            MAX_TEXTURE_IMAGE_UNITS = 0x8872,
+            MAX_FRAGMENT_UNIFORM_VECTORS = 0x8DFD,
+            SHADER_TYPE = 0x8B4F,
+            DELETE_STATUS = 0x8B80,
+            LINK_STATUS = 0x8B82,
+            VALIDATE_STATUS = 0x8B83,
+            ATTACHED_SHADERS = 0x8B85,
+            ACTIVE_UNIFORMS = 0x8B86,
+            ACTIVE_UNIFORM_MAX_LENGTH = 0x8B87,
+            ACTIVE_ATTRIBUTES = 0x8B89,
+            ACTIVE_ATTRIBUTE_MAX_LENGTH = 0x8B8A,
+            SHADING_LANGUAGE_VERSION = 0x8B8C,
+            CURRENT_PROGRAM = 0x8B8D,
+            NEVER = 0x0200,
+            LESS = 0x0201,
+            EQUAL = 0x0202,
+            LEQUAL = 0x0203,
+            GREATER = 0x0204,
+            NOTEQUAL = 0x0205,
+            GEQUAL = 0x0206,
+            ALWAYS = 0x0207,
+            KEEP = 0x1E00,
+            REPLACE = 0x1E01,
+            INCR = 0x1E02,
+            DECR = 0x1E03,
+            INVERT = 0x150A,
+            INCR_WRAP = 0x8507,
+            DECR_WRAP = 0x8508,
+            VENDOR = 0x1F00,
+            RENDERER = 0x1F01,
+            VERSION = 0x1F02,
+            EXTENSIONS = 0x1F03,
+            NEAREST = 0x2600,
+            LINEAR = 0x2601,
+            NEAREST_MIPMAP_NEAREST = 0x2700,
+            LINEAR_MIPMAP_NEAREST = 0x2701,
+            NEAREST_MIPMAP_LINEAR = 0x2702,
+            LINEAR_MIPMAP_LINEAR = 0x2703,
+            TEXTURE_MAG_FILTER = 0x2800,
+            TEXTURE_MIN_FILTER = 0x2801,
+            TEXTURE_WRAP_S = 0x2802,
+            TEXTURE_WRAP_T = 0x2803,
+            TEXTURE = 0x1702,
+            TEXTURE_CUBE_MAP = 0x8513,
+            TEXTURE_BINDING_CUBE_MAP = 0x8514,
+            TEXTURE_CUBE_MAP_POSITIVE_X = 0x8515,
+            TEXTURE_CUBE_MAP_NEGATIVE_X = 0x8516,
+            TEXTURE_CUBE_MAP_POSITIVE_Y = 0x8517,
+            TEXTURE_CUBE_MAP_NEGATIVE_Y = 0x8518,
+            TEXTURE_CUBE_MAP_POSITIVE_Z = 0x8519,
+            TEXTURE_CUBE_MAP_NEGATIVE_Z = 0x851A,
+            MAX_CUBE_MAP_TEXTURE_SIZE = 0x851C,
+            TEXTURE0 = 0x84C0,
+            TEXTURE1 = 0x84C1,
+            TEXTURE2 = 0x84C2,
+            TEXTURE3 = 0x84C3,
+            TEXTURE4 = 0x84C4,
+            TEXTURE5 = 0x84C5,
+            TEXTURE6 = 0x84C6,
+            TEXTURE7 = 0x84C7,
+            TEXTURE8 = 0x84C8,
+            TEXTURE9 = 0x84C9,
+            TEXTURE10 = 0x84CA,
+            TEXTURE11 = 0x84CB,
+            TEXTURE12 = 0x84CC,
+            TEXTURE13 = 0x84CD,
+            TEXTURE14 = 0x84CE,
+            TEXTURE15 = 0x84CF,
+            TEXTURE16 = 0x84D0,
+            TEXTURE17 = 0x84D1,
+            TEXTURE18 = 0x84D2,
+            TEXTURE19 = 0x84D3,
+            TEXTURE20 = 0x84D4,
+            TEXTURE21 = 0x84D5,
+            TEXTURE22 = 0x84D6,
+            TEXTURE23 = 0x84D7,
+            TEXTURE24 = 0x84D8,
+            TEXTURE25 = 0x84D9,
+            TEXTURE26 = 0x84DA,
+            TEXTURE27 = 0x84DB,
+            TEXTURE28 = 0x84DC,
+            TEXTURE29 = 0x84DD,
+            TEXTURE30 = 0x84DE,
+            TEXTURE31 = 0x84DF,
+            ACTIVE_TEXTURE = 0x84E0,
+            REPEAT = 0x2901,
+            CLAMP_TO_EDGE = 0x812F,
+            MIRRORED_REPEAT = 0x8370,
+            FLOAT_VEC2 = 0x8B50,
+            FLOAT_VEC3 = 0x8B51,
+            FLOAT_VEC4 = 0x8B52,
+            INT_VEC2 = 0x8B53,
+            INT_VEC3 = 0x8B54,
+            INT_VEC4 = 0x8B55,
+            BOOL = 0x8B56,
+            BOOL_VEC2 = 0x8B57,
+            BOOL_VEC3 = 0x8B58,
+            BOOL_VEC4 = 0x8B59,
+            FLOAT_MAT2 = 0x8B5A,
+            FLOAT_MAT3 = 0x8B5B,
+            FLOAT_MAT4 = 0x8B5C,
+            SAMPLER_2D = 0x8B5E,
+            SAMPLER_CUBE = 0x8B60,
+            VERTEX_ATTRIB_ARRAY_ENABLED = 0x8622,
+            VERTEX_ATTRIB_ARRAY_SIZE = 0x8623,
+            VERTEX_ATTRIB_ARRAY_STRIDE = 0x8624,
+            VERTEX_ATTRIB_ARRAY_TYPE = 0x8625,
+            VERTEX_ATTRIB_ARRAY_NORMALIZED = 0x886A,
+            VERTEX_ATTRIB_ARRAY_POINTER = 0x8645,
+            VERTEX_ATTRIB_ARRAY_BUFFER_BINDING = 0x889F,
+            IMPLEMENTATION_COLOR_READ_TYPE = 0x8B9A,
+            IMPLEMENTATION_COLOR_READ_FORMAT = 0x8B9B,
+            COMPILE_STATUS = 0x8B81,
+            INFO_LOG_LENGTH = 0x8B84,
+            SHADER_SOURCE_LENGTH = 0x8B88,
+            SHADER_COMPILER = 0x8DFA,
+            SHADER_BINARY_FORMATS = 0x8DF8,
+            NUM_SHADER_BINARY_FORMATS = 0x8DF9,
+            LOW_FLOAT = 0x8DF0,
+            MEDIUM_FLOAT = 0x8DF1,
+            HIGH_FLOAT = 0x8DF2,
+            LOW_INT = 0x8DF3,
+            MEDIUM_INT = 0x8DF4,
+            HIGH_INT = 0x8DF5,
+            FRAMEBUFFER = 0x8D40,
+            RENDERBUFFER = 0x8D41,
+            RGBA4 = 0x8056,
+            RGB5_A1 = 0x8057,
+            RGB565 = 0x8D62,
+            DEPTH_COMPONENT16 = 0x81A5,
+            STENCIL_INDEX = 0x1901,
+            STENCIL_INDEX8 = 0x8D48,
+            RENDERBUFFER_WIDTH = 0x8D42,
+            RENDERBUFFER_HEIGHT = 0x8D43,
+            RENDERBUFFER_INTERNAL_FORMAT = 0x8D44,
+            RENDERBUFFER_RED_SIZE = 0x8D50,
+            RENDERBUFFER_GREEN_SIZE = 0x8D51,
+            RENDERBUFFER_BLUE_SIZE = 0x8D52,
+            RENDERBUFFER_ALPHA_SIZE = 0x8D53,
+            RENDERBUFFER_DEPTH_SIZE = 0x8D54,
+            RENDERBUFFER_STENCIL_SIZE = 0x8D55,
+            FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE = 0x8CD0,
+            FRAMEBUFFER_ATTACHMENT_OBJECT_NAME = 0x8CD1,
+            FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL = 0x8CD2,
+            FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE = 0x8CD3,
+            COLOR_ATTACHMENT0 = 0x8CE0,
+            DEPTH_ATTACHMENT = 0x8D00,
+            STENCIL_ATTACHMENT = 0x8D20,
+            NONE = 0,
+            FRAMEBUFFER_COMPLETE = 0x8CD5,
+            FRAMEBUFFER_INCOMPLETE_ATTACHMENT = 0x8CD6,
+            FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT = 0x8CD7,
+            FRAMEBUFFER_INCOMPLETE_DIMENSIONS = 0x8CD9,
+            FRAMEBUFFER_UNSUPPORTED = 0x8CDD,
+            FRAMEBUFFER_BINDING = 0x8CA6,
+            RENDERBUFFER_BINDING = 0x8CA7,
+            MAX_RENDERBUFFER_SIZE = 0x84E8,
+            INVALID_FRAMEBUFFER_OPERATION = 0x0506
+        };
+        
+        // Context creation attributes.
+        struct Attributes {
+            Attributes()
+                : alpha(true)
+                , depth(true)
+                , stencil(true)
+                , antialias(true)
+                , premultipliedAlpha(true)
+            {
+            }
+
+            bool alpha;
+            bool depth;
+            bool stencil;
+            bool antialias;
+            bool premultipliedAlpha;
+        };
+
+        static PassOwnPtr<GraphicsContext3D> create(Attributes attrs);
         virtual ~GraphicsContext3D();
 
 #if PLATFORM(MAC)
@@ -88,24 +417,71 @@ namespace WebCore {
 #elif PLATFORM(CHROMIUM)
         PlatformGraphicsContext3D platformGraphicsContext3D() const;
         Platform3DObject platformTexture() const;
+#elif PLATFORM(QT)
+        PlatformGraphicsContext3D platformGraphicsContext3D();
+        Platform3DObject platformTexture() const;
 #else
         PlatformGraphicsContext3D platformGraphicsContext3D() const { return NullPlatformGraphicsContext3D; }
         Platform3DObject platformTexture() const { return NullPlatform3DObject; }
 #endif
-        void checkError() const;
         void makeContextCurrent();
         
         // Helper to return the size in bytes of OpenGL data types
         // like GL_FLOAT, GL_INT, etc.
         int sizeInBytes(int type);
 
+        //----------------------------------------------------------------------
+        // Helpers for texture uploading.
+        //
+
+        // Extracts the contents of the given Image into the passed
+        // Vector, obeying the flipY and premultiplyAlpha flags.
+        // Returns the applicable OpenGL format and internalFormat for
+        // the subsequent glTexImage2D or glTexSubImage2D call.
+        // Returns true upon success.
+        bool extractImageData(Image* image,
+                              bool flipY,
+                              bool premultiplyAlpha,
+                              Vector<uint8_t>& imageData,
+                              unsigned int* format,
+                              unsigned int* internalFormat);
+
+        // Extracts the contents of the given ImageData into the passed
+        // Vector, obeying the flipY and premultiplyAlpha flags.
+        // Returns true upon success.
+        bool extractImageData(ImageData*,
+                              bool flipY,
+                              bool premultiplyAlpha,
+                              Vector<uint8_t>& data);
+
+        // Processes the given image data in preparation for uploading
+        // via texImage2D or texSubImage2D. The input data must be in
+        // 4-component format with the alpha channel last (i.e., RGBA
+        // or BGRA), tightly packed, with no space between rows.
+
+        enum AlphaOp {
+            kAlphaDoNothing = 0,
+            kAlphaDoPremultiply = 1,
+            kAlphaDoUnmultiply = 2
+        };
+
+        void processImageData(uint8_t* imageData,
+                              unsigned width,
+                              unsigned height,
+                              bool flipVertically,
+                              AlphaOp alphaOp);
+
+        //----------------------------------------------------------------------
+        // Entry points for WebGL.
+        //
+
         void activeTexture(unsigned long texture);
-        void attachShader(CanvasProgram* program, CanvasShader* shader);
-        void bindAttribLocation(CanvasProgram*, unsigned long index, const String& name);
-        void bindBuffer(unsigned long target, CanvasBuffer*);
-        void bindFramebuffer(unsigned long target, CanvasFramebuffer*);
-        void bindRenderbuffer(unsigned long target, CanvasRenderbuffer*);
-        void bindTexture(unsigned long target, CanvasTexture* texture);
+        void attachShader(WebGLProgram* program, WebGLShader* shader);
+        void bindAttribLocation(WebGLProgram*, unsigned long index, const String& name);
+        void bindBuffer(unsigned long target, WebGLBuffer*);
+        void bindFramebuffer(unsigned long target, WebGLFramebuffer*);
+        void bindRenderbuffer(unsigned long target, WebGLRenderbuffer*);
+        void bindTexture(unsigned long target, WebGLTexture* texture);
         void blendColor(double red, double green, double blue, double alpha);
         void blendEquation(unsigned long mode);
         void blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha);
@@ -113,8 +489,8 @@ namespace WebCore {
         void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
 
         void bufferData(unsigned long target, int size, unsigned long usage);
-        void bufferData(unsigned long target, CanvasArray* data, unsigned long usage);
-        void bufferSubData(unsigned long target, long offset, CanvasArray* data);
+        void bufferData(unsigned long target, WebGLArray* data, unsigned long usage);
+        void bufferSubData(unsigned long target, long offset, WebGLArray* data);
 
         unsigned long checkFramebufferStatus(unsigned long target);
         void clear(unsigned long mask);
@@ -122,7 +498,7 @@ namespace WebCore {
         void clearDepth(double depth);
         void clearStencil(long s);
         void colorMask(bool red, bool green, bool blue, bool alpha);
-        void compileShader(CanvasShader*);
+        void compileShader(WebGLShader*);
         
         //void compressedTexImage2D(unsigned long target, long level, unsigned long internalformat, unsigned long width, unsigned long height, long border, unsigned long imageSize, const void* data);
         //void compressedTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, unsigned long width, unsigned long height, unsigned long format, unsigned long imageSize, const void* data);
@@ -133,7 +509,7 @@ namespace WebCore {
         void depthFunc(unsigned long func);
         void depthMask(bool flag);
         void depthRange(double zNear, double zFar);
-        void detachShader(CanvasProgram*, CanvasShader*);
+        void detachShader(WebGLProgram*, WebGLShader*);
         void disable(unsigned long cap);
         void disableVertexAttribArray(unsigned long index);
         void drawArrays(unsigned long mode, long first, long count);
@@ -143,84 +519,79 @@ namespace WebCore {
         void enableVertexAttribArray(unsigned long index);
         void finish();
         void flush();
-        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer*);
-        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture*, long level);
+        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, WebGLRenderbuffer*);
+        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, WebGLTexture*, long level);
         void frontFace(unsigned long mode);
         void generateMipmap(unsigned long target);
 
-        bool getActiveAttrib(CanvasProgram* program, unsigned long index, ActiveInfo&);
-        bool getActiveUniform(CanvasProgram* program, unsigned long index, ActiveInfo&);
+        bool getActiveAttrib(WebGLProgram* program, unsigned long index, ActiveInfo&);
+        bool getActiveUniform(WebGLProgram* program, unsigned long index, ActiveInfo&);
+
+        int  getAttribLocation(WebGLProgram*, const String& name);
 
-        int  getAttribLocation(CanvasProgram*, const String& name);
+        void getBooleanv(unsigned long pname, unsigned char* value);
 
-        bool getBoolean(unsigned long pname);
-        PassRefPtr<CanvasUnsignedByteArray> getBooleanv(unsigned long pname);
-        int getBufferParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getBufferParameteriv(unsigned long target, unsigned long pname);
+        void getBufferParameteriv(unsigned long target, unsigned long pname, int* value);
+
+        Attributes getContextAttributes();
 
         unsigned long getError();
 
-        float getFloat(unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getFloatv(unsigned long pname);
-        int getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname);
-        int getInteger(unsigned long pname);
-        PassRefPtr<CanvasIntArray> getIntegerv(unsigned long pname);
-        int getProgrami(CanvasProgram*, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getProgramiv(CanvasProgram*, unsigned long pname);
-        String getProgramInfoLog(CanvasProgram*);
-        int getRenderbufferParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getRenderbufferParameteriv(unsigned long target, unsigned long pname);
-        int getShaderi(CanvasShader*, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getShaderiv(CanvasShader*, unsigned long pname);
-
-        String getShaderInfoLog(CanvasShader*);
+        void getFloatv(unsigned long pname, float* value);
+
+        void getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname, int* value);
+
+        void getIntegerv(unsigned long pname, int* value);
+
+        void getProgramiv(WebGLProgram* program, unsigned long pname, int* value);
+
+        String getProgramInfoLog(WebGLProgram*);
+
+        void getRenderbufferParameteriv(unsigned long target, unsigned long pname, int* value);
+
+        void getShaderiv(WebGLShader*, unsigned long pname, int* value);
+
+        String getShaderInfoLog(WebGLShader*);
 
         // TBD
         // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
 
-        String getShaderSource(CanvasShader*);
+        String getShaderSource(WebGLShader*);
         String getString(unsigned long name);
-        
-        float getTexParameterf(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getTexParameterfv(unsigned long target, unsigned long pname);
-        int getTexParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getTexParameteriv(unsigned long target, unsigned long pname);
-
-        float getUniformf(CanvasProgram* program, long location);
-        PassRefPtr<CanvasFloatArray> getUniformfv(CanvasProgram* program, long location);
-        int getUniformi(CanvasProgram* program, long location);
-        PassRefPtr<CanvasIntArray> getUniformiv(CanvasProgram* program, long location);
-
-        long getUniformLocation(CanvasProgram*, const String& name);
-
-        float getVertexAttribf(unsigned long index, unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getVertexAttribfv(unsigned long index, unsigned long pname);
-        int getVertexAttribi(unsigned long index, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getVertexAttribiv(unsigned long index, unsigned long pname);
-        
+
+        void getTexParameterfv(unsigned long target, unsigned long pname, float* value);
+        void getTexParameteriv(unsigned long target, unsigned long pname, int* value);
+
+        void getUniformfv(WebGLProgram* program, long location, float* value);
+        void getUniformiv(WebGLProgram* program, long location, int* value);
+
+        long getUniformLocation(WebGLProgram*, const String& name);
+
+        void getVertexAttribfv(unsigned long index, unsigned long pname, float* value);
+        void getVertexAttribiv(unsigned long index, unsigned long pname, int* value);
+
         long getVertexAttribOffset(unsigned long index, unsigned long pname);
 
         void hint(unsigned long target, unsigned long mode);
-        bool isBuffer(CanvasBuffer*);
+        bool isBuffer(WebGLBuffer*);
         bool isEnabled(unsigned long cap);
-        bool isFramebuffer(CanvasFramebuffer*);
-        bool isProgram(CanvasProgram*);
-        bool isRenderbuffer(CanvasRenderbuffer*);
-        bool isShader(CanvasShader*);
-        bool isTexture(CanvasTexture*);
+        bool isFramebuffer(WebGLFramebuffer*);
+        bool isProgram(WebGLProgram*);
+        bool isRenderbuffer(WebGLRenderbuffer*);
+        bool isShader(WebGLShader*);
+        bool isTexture(WebGLTexture*);
         void lineWidth(double);
-        void linkProgram(CanvasProgram*);
+        void linkProgram(WebGLProgram*);
         void pixelStorei(unsigned long pname, long param);
         void polygonOffset(double factor, double units);
         
-        PassRefPtr<CanvasArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
+        PassRefPtr<WebGLArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
         
         void releaseShaderCompiler();
         void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
         void sampleCoverage(double value, bool invert);
         void scissor(long x, long y, unsigned long width, unsigned long height);
-        void shaderSource(CanvasShader*, const String& string);
+        void shaderSource(WebGLShader*, const String& string);
         void stencilFunc(unsigned long func, long ref, unsigned long mask);
         void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
         void stencilMask(unsigned long mask);
@@ -230,37 +601,14 @@ namespace WebCore {
 
         // These next several functions return an error code (0 if no errors) rather than using an ExceptionCode.
         // Currently they return -1 on any error.
-        int texImage2D(unsigned target, unsigned level, unsigned internalformat,
-                       unsigned width, unsigned height, unsigned border,
-                       unsigned format, unsigned type, CanvasArray* pixels);
-        int texImage2D(unsigned target, unsigned level, unsigned internalformat,
-                       unsigned width, unsigned height, unsigned border,
-                       unsigned format, unsigned type, ImageData* pixels);
-        int texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
-                       bool flipY, bool premultiplyAlpha);
-        int texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
-                       bool flipY, bool premultiplyAlpha);
-        int texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
-                       bool flipY, bool premultiplyAlpha);
+        int texImage2D(unsigned target, unsigned level, unsigned internalformat, unsigned width, unsigned height, unsigned border, unsigned format, unsigned type, void* pixels);
+        int texImage2D(unsigned target, unsigned level, Image* image, bool flipY, bool premultiplyAlpha);
 
         void texParameterf(unsigned target, unsigned pname, float param);
         void texParameteri(unsigned target, unsigned pname, int param);
 
-        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                          unsigned width, unsigned height,
-                          unsigned format, unsigned type, CanvasArray* pixels);
-        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                          unsigned width, unsigned height,
-                          unsigned format, unsigned type, ImageData* pixels);
-        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                          unsigned width, unsigned height, HTMLImageElement* image,
-                          bool flipY, bool premultiplyAlpha);
-        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                          unsigned width, unsigned height, HTMLCanvasElement* canvas,
-                          bool flipY, bool premultiplyAlpha);
-        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                          unsigned width, unsigned height, HTMLVideoElement* video,
-                          bool flipY, bool premultiplyAlpha);
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset, unsigned width, unsigned height, unsigned format, unsigned type, void* pixels);
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset, Image* image, bool flipY, bool premultiplyAlpha);
 
         void uniform1f(long location, float x);
         void uniform1fv(long location, float* v, int size);
@@ -282,8 +630,8 @@ namespace WebCore {
         void uniformMatrix3fv(long location, bool transpose, float* value, int size);
         void uniformMatrix4fv(long location, bool transpose, float* value, int size);
 
-        void useProgram(CanvasProgram*);
-        void validateProgram(CanvasProgram*);
+        void useProgram(WebGLProgram*);
+        void validateProgram(WebGLProgram*);
 
         void vertexAttrib1f(unsigned long indx, float x);
         void vertexAttrib1fv(unsigned long indx, float* values);
@@ -301,7 +649,7 @@ namespace WebCore {
         void reshape(int width, int height);
         
         // Helpers for notification about paint events
-        void beginPaint(CanvasRenderingContext3D* context);
+        void beginPaint(WebGLRenderingContext* context);
         void endPaint();
 
         // Support for buffer creation and deletion
@@ -309,7 +657,7 @@ namespace WebCore {
         unsigned createFramebuffer();
         unsigned createProgram();
         unsigned createRenderbuffer();
-        unsigned createShader(ShaderType);
+        unsigned createShader(unsigned long);
         unsigned createTexture();
         
         void deleteBuffer(unsigned);
@@ -319,22 +667,63 @@ namespace WebCore {
         void deleteShader(unsigned);
         void deleteTexture(unsigned);        
         
+        // Synthesizes an OpenGL error which will be returned from a
+        // later call to getError. This is used to emulate OpenGL ES
+        // 2.0 behavior on the desktop and to enforce additional error
+        // checking mandated by WebGL.
+        //
+        // Per the behavior of glGetError, this stores at most one
+        // instance of any given error, and returns them from calls to
+        // getError in the order they were added.
+        void synthesizeGLError(unsigned long error);
+
     private:        
-        GraphicsContext3D();
+        GraphicsContext3D(Attributes attrs);
+
+        // Helpers for texture uploading.
+        void premultiplyAlpha(unsigned char* rgbaData, int numPixels);
+        void unmultiplyAlpha(uint8_t* imageData, int numPixels);
+
+        // Each platform must provide an implementation of this method.
+        //
+        // Gets the data for the given Image into outputVector,
+        // without doing any processing of the data (vertical flip or
+        // otherwise).
+        //
+        // premultiplyAlpha indicates whether the user will eventually
+        // want the alpha channel multiplied into the color channels.
+        //
+        // The out parameter hasAlphaChannel indicates whether the
+        // image actually had an alpha channel.
+        //
+        // The out parameter neededAlphaOp should be passed to a
+        // subsequent call of processImageData.
+        //
+        // The out parameter format should be passed to subsequent
+        // invocations of texImage2D and texSubImage2D.
+        bool getImageData(Image* image,
+                          Vector<uint8_t>& outputVector,
+                          bool premultiplyAlpha,
+                          bool* hasAlphaChannel,
+                          AlphaOp* neededAlphaOp,
+                          unsigned int* format);
 
         int m_currentWidth, m_currentHeight;
         
 #if PLATFORM(MAC)
+        Attributes m_attrs;
         Vector<Vector<float> > m_vertexArray;
         
         CGLContextObj m_contextObj;
         GLuint m_texture;
         GLuint m_fbo;
         GLuint m_depthBuffer;
+        // Errors raised by synthesizeGLError().
+        ListHashSet<unsigned long> m_syntheticErrors;
 #endif        
 
         // FIXME: ideally this would be used on all platforms.
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(QT)
         friend class GraphicsContext3DInternal;
         OwnPtr<GraphicsContext3DInternal> m_internal;
 #endif
@@ -343,4 +732,3 @@ namespace WebCore {
 } // namespace WebCore
 
 #endif // GraphicsContext3D_h
-
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContextPrivate.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContextPrivate.h
index 98baab1228..19803372d4 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContextPrivate.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContextPrivate.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,10 +26,10 @@
 #ifndef GraphicsContextPrivate_h
 #define GraphicsContextPrivate_h
 
-#include "TransformationMatrix.h"
 #include "Gradient.h"
 #include "GraphicsContext.h"
 #include "Pattern.h"
+#include "TransformationMatrix.h"
 
 namespace WebCore {
 
@@ -38,18 +38,18 @@ namespace WebCore {
             : textDrawingMode(cTextFill)
             , strokeStyle(SolidStroke)
             , strokeThickness(0)
-#if PLATFORM(CAIRO)
-            , globalAlpha(1.0f)
-#endif
-            , strokeColorSpace(SolidColorSpace)
             , strokeColor(Color::black)
+            , strokeColorSpace(DeviceColorSpace)
             , fillRule(RULE_NONZERO)
-            , fillColorSpace(SolidColorSpace)
             , fillColor(Color::black)
+            , fillColorSpace(DeviceColorSpace)
             , shouldAntialias(true)
             , paintingDisabled(false)
             , shadowBlur(0)
             , shadowsIgnoreTransforms(false)
+#if PLATFORM(CAIRO)
+            , globalAlpha(1)
+#endif
         {
         }
 
@@ -57,19 +57,14 @@ namespace WebCore {
         
         StrokeStyle strokeStyle;
         float strokeThickness;
-#if PLATFORM(CAIRO)
-        float globalAlpha;
-#elif PLATFORM(QT)
-        TransformationMatrix pathTransform;
-#endif
-        ColorSpace strokeColorSpace;
         Color strokeColor;
+        ColorSpace strokeColorSpace;
         RefPtr<Gradient> strokeGradient;
         RefPtr<Pattern> strokePattern;
         
         WindRule fillRule;
-        ColorSpace fillColorSpace;
         Color fillColor;
+        ColorSpace fillColorSpace;
         RefPtr<Gradient> fillGradient;
         RefPtr<Pattern> fillPattern;
 
@@ -82,22 +77,22 @@ namespace WebCore {
         Color shadowColor;
 
         bool shadowsIgnoreTransforms;
+#if PLATFORM(CAIRO)
+        float globalAlpha;
+#elif PLATFORM(QT)
+        TransformationMatrix pathTransform;
+#endif
     };
 
-    class GraphicsContextPrivate {
+    class GraphicsContextPrivate : public Noncopyable {
     public:
         GraphicsContextPrivate()
-            : m_focusRingWidth(0)
-            , m_focusRingOffset(0)
-            , m_updatingControlTints(false)
+            : m_updatingControlTints(false)
         {
         }
 
         GraphicsContextState state;
         Vector<GraphicsContextState> stack;
-        Vector<IntRect> m_focusRingRects;
-        int m_focusRingWidth;
-        int m_focusRingOffset;
         bool m_updatingControlTints;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
index c8582bb82f..2336d0b8e9 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -72,6 +72,8 @@ GraphicsLayer::GraphicsLayer(GraphicsLayerClient* client)
     , m_contentsOrientation(CompositingCoordinatesTopDown)
     , m_parent(0)
     , m_maskLayer(0)
+    , m_replicaLayer(0)
+    , m_replicatedLayer(0)
     , m_repaintCount(0)
 {
 }
@@ -92,6 +94,21 @@ bool GraphicsLayer::hasAncestor(GraphicsLayer* ancestor) const
     return false;
 }
 
+bool GraphicsLayer::setChildren(const Vector<GraphicsLayer*>& newChildren)
+{
+    // If the contents of the arrays are the same, nothing to do.
+    if (newChildren == m_children)
+        return false;
+
+    removeAllChildren();
+    
+    size_t listSize = newChildren.size();
+    for (size_t i = 0; i < listSize; ++i)
+        addChild(newChildren[i]);
+    
+    return true;
+}
+
 void GraphicsLayer::addChild(GraphicsLayer* childLayer)
 {
     ASSERT(childLayer != this);
@@ -199,6 +216,14 @@ void GraphicsLayer::removeFromParent()
     }
 }
 
+void GraphicsLayer::setReplicatedByLayer(GraphicsLayer* layer)
+{
+    if (layer)
+        layer->setReplicatedLayer(this);
+
+    m_replicaLayer = layer;
+}
+
 void GraphicsLayer::setBackgroundColor(const Color& color)
 {
     m_backgroundColor = color;
@@ -439,14 +464,27 @@ void GraphicsLayer::dumpProperties(TextStream& ts, int indent) const
     }
     ts << ")\n";
 
-    writeIndent(ts, indent + 1);
-    ts << "(children " << m_children.size() << "\n";
+    if (m_replicaLayer) {
+        writeIndent(ts, indent + 1);
+        ts << "(replica layer " << m_replicaLayer << ")\n";
+        m_replicaLayer->dumpLayer(ts, indent+2);
+    }
+
+    if (m_replicatedLayer) {
+        writeIndent(ts, indent + 1);
+        ts << "(replicated layer " << m_replicatedLayer << ")\n";
+    }
     
-    unsigned i;
-    for (i = 0; i < m_children.size(); i++)
-        m_children[i]->dumpLayer(ts, indent+2);
-    writeIndent(ts, indent + 1);
-    ts << ")\n";
+    if (m_children.size()) {
+        writeIndent(ts, indent + 1);
+        ts << "(children " << m_children.size() << "\n";
+        
+        unsigned i;
+        for (i = 0; i < m_children.size(); i++)
+            m_children[i]->dumpLayer(ts, indent+2);
+        writeIndent(ts, indent + 1);
+        ts << ")\n";
+    }
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
index 85eace092c..5a97c86a19 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
@@ -53,6 +53,22 @@ typedef CALayer* NativeLayer;
 typedef void* PlatformLayer;
 typedef void* NativeLayer;
 #endif
+#elif PLATFORM(WIN)
+namespace WebCore {
+class WKCACFLayer;
+typedef WKCACFLayer PlatformLayer;
+typedef void* NativeLayer;
+}
+#elif PLATFORM(QT)
+class QGraphicsItem;
+typedef QGraphicsItem PlatformLayer;
+typedef QGraphicsItem* NativeLayer;
+#elif PLATFORM(CHROMIUM)
+namespace WebCore {
+class LayerSkia;
+typedef LayerSkia PlatformLayer;
+typedef void* NativeLayer;
+}
 #else
 typedef void* PlatformLayer;
 typedef void* NativeLayer;
@@ -64,7 +80,7 @@ class FloatPoint3D;
 class GraphicsContext;
 class Image;
 class TextStream;
-class TimingFunction;
+struct TimingFunction;
 
 // Base class for animation values (also used for transitions). Here to
 // represent values for properties being animated via the GraphicsLayer,
@@ -176,6 +192,8 @@ public:
     bool hasAncestor(GraphicsLayer*) const;
     
     const Vector<GraphicsLayer*>& children() const { return m_children; }
+    // Returns true if the child list changed.
+    virtual bool setChildren(const Vector<GraphicsLayer*>&);
 
     // Add child layers. If the child is already parented, it will be removed from its old parent.
     virtual void addChild(GraphicsLayer*);
@@ -190,6 +208,16 @@ public:
     GraphicsLayer* maskLayer() const { return m_maskLayer; }
     virtual void setMaskLayer(GraphicsLayer* layer) { m_maskLayer = layer; }
     
+    // The given layer will replicate this layer and its children; the replica renders behind this layer.
+    virtual void setReplicatedByLayer(GraphicsLayer*);
+    // Whether this layer is being replicated by another layer.
+    bool isReplicated() const { return m_replicaLayer; }
+    // The layer that replicates this layer (if any).
+    GraphicsLayer* replicaLayer() const { return m_replicaLayer; }
+
+    const FloatPoint& replicatedLayerPosition() const { return m_replicatedLayerPosition; }
+    void setReplicatedLayerPosition(const FloatPoint& p) { m_replicatedLayerPosition = p; }
+
     // Offset is origin of the renderer minus origin of the graphics layer (so either zero or negative).
     IntSize offsetFromRenderer() const { return m_offsetFromRenderer; }
     void setOffsetFromRenderer(const IntSize& offset) { m_offsetFromRenderer = offset; }
@@ -252,17 +280,17 @@ public:
     
     // Return true if the animation is handled by the compositing system. If this returns
     // false, the animation will be run by AnimationController.
-    virtual bool addAnimation(const KeyframeValueList&, const IntSize& /*boxSize*/, const Animation*, const String& /*keyframesName*/, double /*beginTime*/) { return false; }
+    virtual bool addAnimation(const KeyframeValueList&, const IntSize& /*boxSize*/, const Animation*, const String& /*keyframesName*/, double /*timeOffset*/) { return false; }
     virtual void removeAnimationsForProperty(AnimatedPropertyID) { }
     virtual void removeAnimationsForKeyframes(const String& /* keyframesName */) { }
-    virtual void pauseAnimation(const String& /* keyframesName */) { }
+    virtual void pauseAnimation(const String& /* keyframesName */, double /*timeOffset*/) { }
     
     virtual void suspendAnimations(double time);
     virtual void resumeAnimations();
     
     // Layer contents
     virtual void setContentsToImage(Image*) { }
-    virtual void setContentsToVideo(PlatformLayer*) { }
+    virtual void setContentsToMedia(PlatformLayer*) { } // video or plug-in
     virtual void setContentsBackgroundColor(const Color&) { }
     
 #if ENABLE(3D_CANVAS)
@@ -271,6 +299,8 @@ public:
 #endif
     // Callback from the underlying graphics system to draw layer contents.
     void paintGraphicsLayerContents(GraphicsContext&, const IntRect& clip);
+    // Callback from the underlying graphics system when the layer has been displayed
+    virtual void didDisplay(PlatformLayer*) { }
     
     virtual PlatformLayer* platformLayer() const { return 0; }
     
@@ -292,8 +322,8 @@ public:
     virtual void setContentsOrientation(CompositingCoordinatesOrientation orientation) { m_contentsOrientation = orientation; }
     CompositingCoordinatesOrientation contentsOrientation() const { return m_contentsOrientation; }
 
-    static bool showDebugBorders();
-    static bool showRepaintCounter();
+    bool showDebugBorders() { return m_client ? m_client->showDebugBorders() : false; }
+    bool showRepaintCounter() { return m_client ? m_client->showRepaintCounter() : false; }
     
     void updateDebugIndicators();
     
@@ -319,6 +349,10 @@ protected:
 
     virtual void setOpacityInternal(float) { }
     
+    // The layer being replicated.
+    GraphicsLayer* replicatedLayer() const { return m_replicatedLayer; }
+    virtual void setReplicatedLayer(GraphicsLayer* layer) { m_replicatedLayer = layer; }
+
     GraphicsLayer(GraphicsLayerClient*);
 
     void dumpProperties(TextStream&, int indent) const;
@@ -357,6 +391,11 @@ protected:
 
     GraphicsLayer* m_maskLayer; // Reference to mask layer. We don't own this.
 
+    GraphicsLayer* m_replicaLayer; // A layer that replicates this layer. We only allow one, for now.
+                                   // The replica is not parented; this is the primary reference to it.
+    GraphicsLayer* m_replicatedLayer; // For a replica layer, a reference to the original layer.
+    FloatPoint m_replicatedLayerPosition; // For a replica layer, the position of the replica.
+
     IntRect m_contentsRect;
 
     int m_repaintCount;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayerClient.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayerClient.h
index 5facc94c49..afb297df97 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayerClient.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayerClient.h
@@ -62,6 +62,9 @@ public:
     virtual void notifySyncRequired(const GraphicsLayer*) = 0;
     
     virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& inClip) = 0;
+    
+    virtual bool showDebugBorders() const = 0;
+    virtual bool showRepaintCounter() const = 0;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Icon.h b/src/3rdparty/webkit/WebCore/platform/graphics/Icon.h
index 444c67cf6a..d7d694a010 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Icon.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Icon.h
@@ -51,7 +51,6 @@ class String;
     
 class Icon : public RefCounted<Icon> {
 public:
-    static PassRefPtr<Icon> createIconForFile(const String& filename);
     static PassRefPtr<Icon> createIconForFiles(const Vector<String>& filenames);
 
     ~Icon();
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Image.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/Image.cpp
index 80b54575d7..7fbd3a9462 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Image.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Image.cpp
@@ -27,14 +27,14 @@
 #include "config.h"
 #include "Image.h"
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "BitmapImage.h"
 #include "GraphicsContext.h"
 #include "IntRect.h"
 #include "MIMETypeRegistry.h"
-#include <wtf/StdLibExtras.h>
-
+#include "SharedBuffer.h"
 #include <math.h>
+#include <wtf/StdLibExtras.h>
 
 #if PLATFORM(CG)
 #include <CoreFoundation/CoreFoundation.h>
@@ -75,14 +75,14 @@ bool Image::setData(PassRefPtr<SharedBuffer> data, bool allDataReceived)
     return dataChanged(allDataReceived);
 }
 
-void Image::fillWithSolidColor(GraphicsContext* ctxt, const FloatRect& dstRect, const Color& color, CompositeOperator op)
+void Image::fillWithSolidColor(GraphicsContext* ctxt, const FloatRect& dstRect, const Color& color, ColorSpace styleColorSpace, CompositeOperator op)
 {
     if (color.alpha() <= 0)
         return;
     
     ctxt->save();
     ctxt->setCompositeOperation(!color.hasAlpha() && op == CompositeSourceOver ? CompositeCopy : op);
-    ctxt->fillRect(dstRect, color);
+    ctxt->fillRect(dstRect, color, styleColorSpace);
     ctxt->restore();
 }
 
@@ -104,10 +104,10 @@ static inline FloatSize calculatePatternScale(const FloatRect& dstRect, const Fl
 }
 
 
-void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& destRect, const FloatPoint& srcPoint, const FloatSize& scaledTileSize, CompositeOperator op)
+void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& destRect, const FloatPoint& srcPoint, const FloatSize& scaledTileSize, ColorSpace styleColorSpace, CompositeOperator op)
 {    
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, destRect, solidColor(), op);
+        fillWithSolidColor(ctxt, destRect, solidColor(), styleColorSpace, op);
         return;
     }
 
@@ -132,22 +132,22 @@ void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& destRect, const Fl
         visibleSrcRect.setY((destRect.y() - oneTileRect.y()) / scale.height());
         visibleSrcRect.setWidth(destRect.width() / scale.width());
         visibleSrcRect.setHeight(destRect.height() / scale.height());
-        draw(ctxt, destRect, visibleSrcRect, op);
+        draw(ctxt, destRect, visibleSrcRect, styleColorSpace, op);
         return;
     }
 
-    TransformationMatrix patternTransform = TransformationMatrix().scaleNonUniform(scale.width(), scale.height());
+    AffineTransform patternTransform = AffineTransform().scaleNonUniform(scale.width(), scale.height());
     FloatRect tileRect(FloatPoint(), intrinsicTileSize);    
-    drawPattern(ctxt, tileRect, patternTransform, oneTileRect.location(), op, destRect);
+    drawPattern(ctxt, tileRect, patternTransform, oneTileRect.location(), styleColorSpace, op, destRect);
     
     startAnimation();
 }
 
 // FIXME: Merge with the other drawTiled eventually, since we need a combination of both for some things.
-void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& dstRect, const FloatRect& srcRect, TileRule hRule, TileRule vRule, CompositeOperator op)
+void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& dstRect, const FloatRect& srcRect, TileRule hRule, TileRule vRule, ColorSpace styleColorSpace, CompositeOperator op)
 {    
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, dstRect, solidColor(), op);
+        fillWithSolidColor(ctxt, dstRect, solidColor(), styleColorSpace, op);
         return;
     }
     
@@ -158,7 +158,7 @@ void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& dstRect, const Flo
         vRule = RepeatTile;
 
     FloatSize scale = calculatePatternScale(dstRect, srcRect, hRule, vRule);
-    TransformationMatrix patternTransform = TransformationMatrix().scaleNonUniform(scale.width(), scale.height());
+    AffineTransform patternTransform = AffineTransform().scaleNonUniform(scale.width(), scale.height());
 
     // We want to construct the phase such that the pattern is centered (when stretch is not
     // set for a particular rule).
@@ -170,7 +170,7 @@ void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& dstRect, const Flo
         vPhase -= fmodf(dstRect.height(), scale.height() * srcRect.height()) / 2.0f;
     FloatPoint patternPhase(dstRect.x() - hPhase, dstRect.y() - vPhase);
     
-    drawPattern(ctxt, srcRect, patternTransform, patternPhase, op, dstRect);
+    drawPattern(ctxt, srcRect, patternTransform, patternPhase, styleColorSpace, op, dstRect);
 
     startAnimation();
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Image.h b/src/3rdparty/webkit/WebCore/platform/graphics/Image.h
index c0d07c91df..13722d0d05 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Image.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Image.h
@@ -28,11 +28,13 @@
 #define Image_h
 
 #include "Color.h"
+#include "ColorSpace.h"
 #include "GraphicsTypes.h"
 #include "ImageSource.h"
 #include "IntRect.h"
-#include "SharedBuffer.h"
+#include "PlatformString.h"
 #include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
 #if PLATFORM(MAC)
@@ -72,8 +74,7 @@ class FloatRect;
 class FloatSize;
 class GraphicsContext;
 class SharedBuffer;
-class String;
-class TransformationMatrix;
+class AffineTransform;
 
 // This class gets notified when an image creates or destroys decoded frames and when it advances animation frames.
 class ImageObserver;
@@ -149,26 +150,28 @@ public:
 
 #if PLATFORM(GTK)
     virtual GdkPixbuf* getGdkPixbuf() { return 0; }
+    static PassRefPtr<Image> loadPlatformThemeIcon(const char* name, int size);
 #endif
 
 protected:
     Image(ImageObserver* = 0);
 
-    static void fillWithSolidColor(GraphicsContext* ctxt, const FloatRect& dstRect, const Color& color, CompositeOperator op);
+    static void fillWithSolidColor(GraphicsContext*, const FloatRect& dstRect, const Color&, ColorSpace styleColorSpace, CompositeOperator);
 
+    // The ColorSpace parameter will only be used for untagged images.
 #if PLATFORM(WIN)
-    virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, CompositeOperator) { }
+    virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, ColorSpace styleColorSpace, CompositeOperator) { }
 #endif
-    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator) = 0;
-    void drawTiled(GraphicsContext*, const FloatRect& dstRect, const FloatPoint& srcPoint, const FloatSize& tileSize, CompositeOperator);
-    void drawTiled(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, TileRule hRule, TileRule vRule, CompositeOperator);
+    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator) = 0;
+    void drawTiled(GraphicsContext*, const FloatRect& dstRect, const FloatPoint& srcPoint, const FloatSize& tileSize, ColorSpace styleColorSpace, CompositeOperator);
+    void drawTiled(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, TileRule hRule, TileRule vRule, ColorSpace styleColorSpace, CompositeOperator);
 
     // Supporting tiled drawing
     virtual bool mayFillWithSolidColor() { return false; }
     virtual Color solidColor() const { return Color(); }
     
-    virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
-                             const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
+    virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const AffineTransform& patternTransform,
+                             const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator, const FloatRect& destRect);
 
 private:
     RefPtr<SharedBuffer> m_data; // The encoded raw data for the image. 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/ImageBuffer.h b/src/3rdparty/webkit/WebCore/platform/graphics/ImageBuffer.h
index 94320584d3..7821288e2f 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/ImageBuffer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/ImageBuffer.h
@@ -27,7 +27,7 @@
 #ifndef ImageBuffer_h
 #define ImageBuffer_h
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "Image.h"
 #include "IntSize.h"
 #include "ImageBufferData.h"
@@ -84,11 +84,11 @@ namespace WebCore {
 
         String toDataURL(const String& mimeType) const;
 #if !PLATFORM(CG)
-        TransformationMatrix baseTransform() const { return TransformationMatrix(); }
+        AffineTransform baseTransform() const { return AffineTransform(); }
         void transformColorSpace(ImageColorSpace srcColorSpace, ImageColorSpace dstColorSpace);
         void platformTransformColorSpace(const Vector<int>&);
 #else
-        TransformationMatrix baseTransform() const { return TransformationMatrix(1, 0, 0, -1, 0, m_size.height()); }
+        AffineTransform baseTransform() const { return AffineTransform(1, 0, 0, -1, 0, m_size.height()); }
 #endif
     private:
         ImageBufferData m_data;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.cpp
index bf7ae21bb5..c2366c1ba3 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.cpp
@@ -35,12 +35,6 @@
 #include "ImageDecoder.h"
 #endif
 
-#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
-#ifndef IMAGE_DECODER_DOWN_SAMPLING_MAX_NUMBER_OF_PIXELS
-#define IMAGE_DECODER_DOWN_SAMPLING_MAX_NUMBER_OF_PIXELS (1024 * 1024)
-#endif
-#endif
-
 namespace WebCore {
 
 ImageSource::ImageSource()
@@ -81,6 +75,9 @@ void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
     if (!m_decoder) {
         m_decoder = static_cast<NativeImageSourcePtr>(ImageDecoder::create(*data));
 #if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+#ifndef IMAGE_DECODER_DOWN_SAMPLING_MAX_NUMBER_OF_PIXELS
+#define IMAGE_DECODER_DOWN_SAMPLING_MAX_NUMBER_OF_PIXELS (1024 * 1024)
+#endif
         if (m_decoder)
             m_decoder->setMaxNumPixels(IMAGE_DECODER_DOWN_SAMPLING_MAX_NUMBER_OF_PIXELS);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h
index 3559abe951..258fd0f695 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h
@@ -49,7 +49,7 @@ typedef struct _cairo_surface cairo_surface_t;
 class NativeImageSkia;
 #elif PLATFORM(HAIKU)
 class BBitmap;
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
 #include "SharedBitmap.h"
 #endif
 
@@ -81,7 +81,7 @@ typedef cairo_surface_t* NativeImagePtr;
 typedef NativeImageSkia* NativeImagePtr;
 #elif PLATFORM(HAIKU)
 typedef BBitmap* NativeImagePtr;
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
 typedef RefPtr<SharedBitmap> NativeImagePtr;
 #endif
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h b/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h
index ab5f3ec566..02110f2c60 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h
@@ -27,7 +27,6 @@
 #define IntPoint_h
 
 #include "IntSize.h"
-#include <wtf/Platform.h>
 
 #if PLATFORM(QT)
 #include <QDataStream>
@@ -63,6 +62,10 @@ class BPoint;
 class wxPoint;
 #endif
 
+#if PLATFORM(BREWMP)
+typedef struct _point AEEPoint;
+#endif
+
 #if PLATFORM(SKIA)
 struct SkPoint;
 struct SkIPoint;
@@ -133,6 +136,11 @@ public:
     operator wxPoint() const;
 #endif
 
+#if PLATFORM(BREWMP)
+    IntPoint(const AEEPoint&);
+    operator AEEPoint() const;
+#endif
+
 #if PLATFORM(SKIA)
     IntPoint(const SkIPoint&);
     operator SkIPoint() const;
@@ -180,6 +188,11 @@ inline bool operator!=(const IntPoint& a, const IntPoint& b)
     return a.x() != b.x() || a.y() != b.y();
 }
 
+inline IntPoint toPoint(const IntSize& size)
+{
+    return IntPoint(size.width(), size.height());
+}
+
 #if PLATFORM(QT)
 inline QDataStream& operator<<(QDataStream& stream, const IntPoint& point)
 {
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/IntPointHash.h b/src/3rdparty/webkit/WebCore/platform/graphics/IntPointHash.h
new file mode 100644
index 0000000000..bf25b14799
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/IntPointHash.h
@@ -0,0 +1,48 @@
+/*
+ Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ 
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+ 
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+ 
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#ifndef IntPointHash_h
+#define IntPointHash_h
+
+#include "IntPoint.h"
+#include <wtf/HashFunctions.h>
+#include <wtf/HashTraits.h>
+
+namespace WTF {
+    
+// The empty value is (0, INT_MIN), the deleted value is (INT_MIN, 0)
+struct IntPointHash {
+    static unsigned hash(const WebCore::IntPoint& p) { return WTF::intHash(static_cast<uint64_t>(p.x()) << 32 | p.y()); }
+    static bool equal(const WebCore::IntPoint& a, const WebCore::IntPoint& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+template<> struct HashTraits<WebCore::IntPoint> : GenericHashTraits<WebCore::IntPoint> {
+    static const bool needsDestruction = false;
+    static WebCore::IntPoint emptyValue() { return WebCore::IntPoint(0, std::numeric_limits<int>::min()); }
+    
+    static void constructDeletedValue(WebCore::IntPoint& slot) { slot = WebCore::IntPoint(std::numeric_limits<int>::min(), 0); }
+    static bool isDeletedValue(const WebCore::IntPoint& slot) { return slot == WebCore::IntPoint(std::numeric_limits<int>::min(), 0); }
+};
+template<> struct DefaultHash<WebCore::IntPoint> {
+    typedef IntPointHash Hash;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/IntRect.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/IntRect.cpp
index 622e52527b..188b5f91fc 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/IntRect.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/IntRect.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,17 +10,17 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -104,4 +104,15 @@ void IntRect::scale(float s)
     m_size.setHeight((int)(height() * s));
 }
 
+IntRect unionRect(const Vector<IntRect>& rects)
+{
+    IntRect result;
+
+    size_t count = rects.size();
+    for (size_t i = 0; i < count; ++i)
+        result.unite(rects[i]);
+
+    return result;
 }
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/IntRect.h b/src/3rdparty/webkit/WebCore/platform/graphics/IntRect.h
index 97b21bc80b..ad90dd9636 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/IntRect.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/IntRect.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,30 +10,30 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef IntRect_h
 #define IntRect_h
 
 #include "IntPoint.h"
-#include <wtf/Platform.h>
+#include <wtf/Vector.h>
 
 #if PLATFORM(CG)
 typedef struct CGRect CGRect;
 #endif
 
-#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
 #ifdef NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
 typedef struct CGRect NSRect;
 #else
@@ -104,6 +104,10 @@ public:
     int right() const { return x() + width(); }
     int bottom() const { return y() + height(); }
 
+    // NOTE: The result is rounded to integer values, and thus may be not the exact
+    // center point.
+    IntPoint center() const { return IntPoint(x() + width() / 2, y() + height() / 2); }
+
     void move(const IntSize& s) { m_location += s; } 
     void move(int dx, int dy) { m_location.move(dx, dy); } 
 
@@ -162,7 +166,7 @@ public:
 #endif
 
 #if (PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)) \
-        || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+        || (PLATFORM(CHROMIUM) && OS(DARWIN))
     operator NSRect() const;
 #endif
 
@@ -185,6 +189,8 @@ inline IntRect unionRect(const IntRect& a, const IntRect& b)
     return c;
 }
 
+IntRect unionRect(const Vector<IntRect>&);
+
 inline bool operator==(const IntRect& a, const IntRect& b)
 {
     return a.location() == b.location() && a.size() == b.size();
@@ -200,7 +206,7 @@ IntRect enclosingIntRect(const CGRect&);
 #endif
 
 #if (PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)) \
-        || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+        || (PLATFORM(CHROMIUM) && OS(DARWIN))
 IntRect enclosingIntRect(const NSRect&);
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/IntSize.h b/src/3rdparty/webkit/WebCore/platform/graphics/IntSize.h
index b242784f1b..b60338cd30 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/IntSize.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/IntSize.h
@@ -26,8 +26,6 @@
 #ifndef IntSize_h
 #define IntSize_h
 
-#include <wtf/Platform.h>
-
 #if PLATFORM(CG)
 typedef struct CGSize CGSize;
 #endif
@@ -55,6 +53,10 @@ class BSize;
 class wxSize;
 #endif
 
+#if PLATFORM(BREWMP)
+typedef struct AEESize AEESize;
+#endif
+
 namespace WebCore {
 
 class IntSize {
@@ -69,7 +71,8 @@ public:
     void setHeight(int height) { m_height = height; }
 
     bool isEmpty() const { return m_width <= 0 || m_height <= 0; }
-
+    bool isZero() const { return !m_width && !m_height; }
+    
     void expand(int width, int height)
     {
         m_width += width;
@@ -129,6 +132,11 @@ public:
     operator wxSize() const;
 #endif
 
+#if PLATFORM(BREWMP)
+    IntSize(const AEESize&);
+    operator AEESize() const;
+#endif
+
 private:
     int m_width, m_height;
 };
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
index 3b32b654b0..1fdc1e5af5 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,16 +37,24 @@
 #include "Document.h"
 #include "TimeRanges.h"
 
+#if PLATFORM(QT)
+#include <QtGlobal>
+#endif
+
 #if PLATFORM(MAC)
 #include "MediaPlayerPrivateQTKit.h"
-#elif PLATFORM(WINCE) && !PLATFORM(QT)
+#elif OS(WINCE) && !PLATFORM(QT)
 #include "MediaPlayerPrivateWince.h"
 #elif PLATFORM(WIN)
 #include "MediaPlayerPrivateQuickTimeWin.h"
 #elif PLATFORM(GTK)
 #include "MediaPlayerPrivateGStreamer.h"
 #elif PLATFORM(QT)
+#if QT_VERSION < 0x040700
 #include "MediaPlayerPrivatePhonon.h"
+#else
+#include "MediaPlayerPrivateQt.h"
+#endif
 #elif PLATFORM(CHROMIUM)
 #include "MediaPlayerPrivateChromium.h"
 #endif
@@ -67,6 +75,9 @@ public:
     virtual void pause() { }    
 
     virtual PlatformMedia platformMedia() const { return NoPlatformMedia; }
+#if USE(ACCELERATED_COMPOSITING)
+    virtual PlatformLayer* platformLayer() const { return 0; }
+#endif
 
     virtual IntSize naturalSize() const { return IntSize(0, 0); }
 
@@ -81,23 +92,24 @@ public:
     virtual void seek(float) { }
     virtual bool seeking() const { return false; }
 
-    virtual void setEndTime(float) { }
-
     virtual void setRate(float) { }
     virtual void setPreservesPitch(bool) { }
     virtual bool paused() const { return false; }
 
     virtual void setVolume(float) { }
 
+    virtual bool supportsMuting() const { return false; }
+    virtual void setMuted(bool) { }
+
+    virtual bool hasClosedCaptions() const { return false; }
+    virtual void setClosedCaptionsVisible(bool) { };
+
     virtual MediaPlayer::NetworkState networkState() const { return MediaPlayer::Empty; }
     virtual MediaPlayer::ReadyState readyState() const { return MediaPlayer::HaveNothing; }
 
     virtual float maxTimeSeekable() const { return 0; }
     virtual PassRefPtr<TimeRanges> buffered() const { return TimeRanges::create(); }
 
-    virtual int dataRate() const { return 0; }
-
-    virtual bool totalBytesKnown() const { return false; }
     virtual unsigned totalBytes() const { return 0; }
     virtual unsigned bytesLoaded() const { return 0; }
 
@@ -124,7 +136,7 @@ static MediaPlayerPrivateInterface* createNullMediaPlayer(MediaPlayer* player)
 
 // engine support
 
-struct MediaPlayerFactory {
+struct MediaPlayerFactory : Noncopyable {
     MediaPlayerFactory(CreateMediaEnginePlayer constructor, MediaEngineSupportedTypes getSupportedTypes, MediaEngineSupportsType supportsTypeAndCodecs) 
         : constructor(constructor)
         , getSupportedTypes(getSupportedTypes)
@@ -192,11 +204,12 @@ MediaPlayer::MediaPlayer(MediaPlayerClient* client)
     , m_private(createNullMediaPlayer(this))
     , m_currentMediaEngine(0)
     , m_frameView(0)
+    , m_preload(Auto)
     , m_visible(false)
     , m_rate(1.0f)
     , m_volume(1.0f)
+    , m_muted(false)
     , m_preservesPitch(true)
-    , m_autobuffer(false)
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     , m_playerProxy(0)
 #endif
@@ -247,7 +260,8 @@ void MediaPlayer::load(const String& url, const ContentType& contentType)
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
         m_private->setMediaPlayerProxy(m_playerProxy);
 #endif
-
+        m_private->setPreload(m_preload);
+        m_private->setPreservesPitch(preservesPitch());
     }
 
     if (m_private)
@@ -256,6 +270,11 @@ void MediaPlayer::load(const String& url, const ContentType& contentType)
         m_private.set(createNullMediaPlayer(this));
 }    
 
+bool MediaPlayer::hasAvailableVideoFrame() const
+{
+    return m_private->hasAvailableVideoFrame();
+}
+    
 bool MediaPlayer::canLoadPoster() const
 {
     return m_private->canLoadPoster();
@@ -354,6 +373,13 @@ PlatformMedia MediaPlayer::platformMedia() const
     return m_private->platformMedia();
 }
 
+#if USE(ACCELERATED_COMPOSITING)
+PlatformLayer* MediaPlayer::platformLayer() const
+{
+    return m_private->platformLayer();
+}
+#endif
+
 MediaPlayer::NetworkState MediaPlayer::networkState()
 {
     return m_private->networkState();
@@ -372,7 +398,34 @@ float MediaPlayer::volume() const
 void MediaPlayer::setVolume(float volume)
 {
     m_volume = volume;
-    m_private->setVolume(volume);   
+
+    if (m_private->supportsMuting() || !m_muted)
+        m_private->setVolume(volume);
+}
+
+bool MediaPlayer::muted() const
+{
+    return m_muted;
+}
+
+void MediaPlayer::setMuted(bool muted)
+{
+    m_muted = muted;
+
+    if (m_private->supportsMuting())
+        m_private->setMuted(muted);
+    else
+        m_private->setVolume(muted ? 0 : m_volume);
+}
+
+bool MediaPlayer::hasClosedCaptions() const
+{
+    return m_private->hasClosedCaptions();
+}
+
+void MediaPlayer::setClosedCaptionsVisible(bool closedCaptionsVisible)
+{
+    m_private->setClosedCaptionsVisible(closedCaptionsVisible);
 }
 
 float MediaPlayer::rate() const
@@ -397,16 +450,6 @@ void MediaPlayer::setPreservesPitch(bool preservesPitch)
     m_private->setPreservesPitch(preservesPitch);
 }
 
-int MediaPlayer::dataRate() const
-{
-    return m_private->dataRate();
-}
-
-void MediaPlayer::setEndTime(float time)
-{
-    m_private->setEndTime(time);
-}
-
 PassRefPtr<TimeRanges> MediaPlayer::buffered()
 {
     return m_private->buffered();
@@ -422,16 +465,6 @@ unsigned MediaPlayer::bytesLoaded()
     return m_private->bytesLoaded();
 }
 
-bool MediaPlayer::totalBytesKnown()
-{
-    return m_private->totalBytesKnown();
-}
-
-unsigned MediaPlayer::totalBytes()
-{
-    return m_private->totalBytes();
-}
-
 void MediaPlayer::setSize(const IntSize& size)
 { 
     m_size = size;
@@ -449,17 +482,15 @@ void MediaPlayer::setVisible(bool b)
     m_private->setVisible(b);
 }
 
-bool MediaPlayer::autobuffer() const
+MediaPlayer::Preload MediaPlayer::preload() const
 {
-    return m_autobuffer;
+    return m_preload;
 }
 
-void MediaPlayer::setAutobuffer(bool b)
+void MediaPlayer::setPreload(MediaPlayer::Preload preload)
 {
-    if (m_autobuffer != b) {
-        m_autobuffer = b;
-        m_private->setAutobuffer(b);
-    }
+    m_preload = preload;
+    m_private->setPreload(preload);
 }
 
 void MediaPlayer::paint(GraphicsContext* p, const IntRect& r)
@@ -548,12 +579,20 @@ void MediaPlayer::readyStateChanged()
         m_mediaPlayerClient->mediaPlayerReadyStateChanged(this);
 }
 
-void MediaPlayer::volumeChanged()
+void MediaPlayer::volumeChanged(float newVolume)
 {
+    m_volume = newVolume;
     if (m_mediaPlayerClient)
         m_mediaPlayerClient->mediaPlayerVolumeChanged(this);
 }
 
+void MediaPlayer::muteChanged(bool newMuted)
+{
+    m_muted = newMuted;
+    if (m_mediaPlayerClient)
+        m_mediaPlayerClient->mediaPlayerMuteChanged(this);
+}
+
 void MediaPlayer::timeChanged()
 {
     if (m_mediaPlayerClient)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
index 4cc6476db7..95cc7f1a24 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,11 +32,17 @@
 #include "MediaPlayerProxy.h"
 #endif
 
+#include "Document.h"
 #include "IntRect.h"
 #include "StringHash.h"
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "GraphicsLayer.h"
+#endif
 
 #ifdef __OBJC__
 @class QTMovie;
@@ -66,23 +72,25 @@ class MediaPlayerPrivateInterface;
 class String;
 class TimeRanges;
 
-#if USE(ACCELERATED_COMPOSITING)
-class GraphicsLayer;
-#endif
-
 class MediaPlayerClient {
 public:
     virtual ~MediaPlayerClient() { }
 
+    // Get the document which the media player is owned by
+    virtual Document* mediaPlayerOwningDocument() { return 0; }
+
     // the network state has changed
     virtual void mediaPlayerNetworkStateChanged(MediaPlayer*) { }
 
     // the ready state has changed
     virtual void mediaPlayerReadyStateChanged(MediaPlayer*) { }
 
-    // the volume or muted state has changed
+    // the volume state has changed
     virtual void mediaPlayerVolumeChanged(MediaPlayer*) { }
 
+    // the mute state has changed
+    virtual void mediaPlayerMuteChanged(MediaPlayer*) { }
+
     // time has jumped, eg. not as a result of normal playback
     virtual void mediaPlayerTimeChanged(MediaPlayer*) { }
     
@@ -108,14 +116,19 @@ public:
     // whether the rendering system can accelerate the display of this MediaPlayer.
     virtual bool mediaPlayerRenderingCanBeAccelerated(MediaPlayer*) { return false; }
 
-    // return the GraphicsLayer that will host the presentation for this MediaPlayer.
-    virtual GraphicsLayer* mediaPlayerGraphicsLayer(MediaPlayer*) { return 0; }
+    // called when the media player's rendering mode changed, which indicates a change in the
+    // availability of the platformLayer().
+    virtual void mediaPlayerRenderingModeChanged(MediaPlayer*) { }
 #endif
 };
 
 class MediaPlayer : public Noncopyable {
 public:
-    MediaPlayer(MediaPlayerClient*);
+
+    static PassOwnPtr<MediaPlayer> create(MediaPlayerClient* client)
+    {
+        return new MediaPlayer(client);
+    }
     virtual ~MediaPlayer();
 
     // media engine support
@@ -127,6 +140,9 @@ public:
     bool supportsFullscreen() const;
     bool supportsSave() const;
     PlatformMedia platformMedia() const;
+#if USE(ACCELERATED_COMPOSITING)
+    PlatformLayer* platformLayer() const;
+#endif
 
     IntSize naturalSize();
     bool hasVideo() const;
@@ -158,8 +174,6 @@ public:
 
     float startTime() const;
     
-    void setEndTime(float time);
-    
     float rate() const;
     void setRate(float);
 
@@ -170,16 +184,18 @@ public:
     float maxTimeSeekable();
 
     unsigned bytesLoaded();
-    bool totalBytesKnown();
-    unsigned totalBytes();
     
     float volume() const;
     void setVolume(float);
-    
-    int dataRate() const;
 
-    bool autobuffer() const;    
-    void setAutobuffer(bool);
+    bool muted() const;
+    void setMuted(bool);
+
+    bool hasClosedCaptions() const;
+    void setClosedCaptionsVisible(bool closedCaptionsVisible);
+
+    bool autoplay() const;    
+    void setAutoplay(bool);
 
     void paint(GraphicsContext*, const IntRect&);
     void paintCurrentFrameInContext(GraphicsContext*, const IntRect&);
@@ -193,9 +209,14 @@ public:
     enum MovieLoadType { Unknown, Download, StoredStream, LiveStream };
     MovieLoadType movieLoadType() const;
 
+    enum Preload { None, MetaData, Auto };
+    Preload preload() const;
+    void setPreload(Preload);
+
     void networkStateChanged();
     void readyStateChanged();
-    void volumeChanged();
+    void volumeChanged(float);
+    void muteChanged(bool);
     void timeChanged();
     void sizeChanged();
     void rateChanged();
@@ -205,6 +226,8 @@ public:
 
     MediaPlayerClient* mediaPlayerClient() const { return m_mediaPlayerClient; }
 
+    bool hasAvailableVideoFrame() const;
+
     bool canLoadPoster() const;
     void setPoster(const String&);
 
@@ -223,6 +246,8 @@ public:
     bool hasSingleSecurityOrigin() const;
 
 private:
+    MediaPlayer(MediaPlayerClient*);
+
     static void initializeMediaEngines();
 
     MediaPlayerClient* m_mediaPlayerClient;
@@ -230,11 +255,12 @@ private:
     void* m_currentMediaEngine;
     FrameView* m_frameView;
     IntSize m_size;
+    Preload m_preload;
     bool m_visible;
     float m_rate;
     float m_volume;
+    bool m_muted;
     bool m_preservesPitch;
-    bool m_autobuffer;
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     WebMediaPlayerProxy* m_playerProxy;    // not owned or used, passed to m_private
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
index f5687b3112..16ff5437b0 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -36,7 +36,7 @@ class IntRect;
 class IntSize;
 class String;
 
-class MediaPlayerPrivateInterface {
+class MediaPlayerPrivateInterface : public Noncopyable {
 public:
     virtual ~MediaPlayerPrivateInterface() { }
 
@@ -45,6 +45,9 @@ public:
     
     virtual void prepareToPlay() { }
     virtual PlatformMedia platformMedia() const { return NoPlatformMedia; }
+#if USE(ACCELERATED_COMPOSITING)
+    virtual PlatformLayer* platformLayer() const { return 0; }
+#endif
 
     virtual void play() = 0;
     virtual void pause() = 0;    
@@ -67,8 +70,6 @@ public:
 
     virtual float startTime() const { return 0; }
 
-    virtual void setEndTime(float) = 0;
-
     virtual void setRate(float) = 0;
     virtual void setPreservesPitch(bool) { }
 
@@ -76,16 +77,18 @@ public:
 
     virtual void setVolume(float) = 0;
 
+    virtual bool supportsMuting() const { return false; }
+    virtual void setMuted(bool) { }
+
+    virtual bool hasClosedCaptions() const { return false; }    
+    virtual void setClosedCaptionsVisible(bool) { }
+
     virtual MediaPlayer::NetworkState networkState() const = 0;
     virtual MediaPlayer::ReadyState readyState() const = 0;
 
     virtual float maxTimeSeekable() const = 0;
     virtual PassRefPtr<TimeRanges> buffered() const = 0;
 
-    virtual int dataRate() const = 0;
-
-    virtual bool totalBytesKnown() const { return totalBytes() > 0; }
-    virtual unsigned totalBytes() const = 0;
     virtual unsigned bytesLoaded() const = 0;
 
     virtual void setSize(const IntSize&) = 0;
@@ -94,7 +97,9 @@ public:
 
     virtual void paintCurrentFrameInContext(GraphicsContext* c, const IntRect& r) { paint(c, r); }
 
-    virtual void setAutobuffer(bool) { };
+    virtual void setPreload(MediaPlayer::Preload) { };
+
+    virtual bool hasAvailableVideoFrame() const { return readyState() >= MediaPlayer::HaveCurrentData; }
 
     virtual bool canLoadPoster() const { return false; }
     virtual void setPoster(const String&) { }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Path.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/Path.cpp
index e30703cf5c..af94be74cf 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Path.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Path.cpp
@@ -39,6 +39,7 @@ static const float QUARTER = 0.552f; // approximation of control point positions
                               // to simulate a quarter of a circle.
 namespace WebCore {
 
+#if !PLATFORM(OPENVG)
 static void pathLengthApplierFunction(void* info, const PathElement* element)
 {
     PathTraversalState& traversalState = *static_cast<PathTraversalState*>(info);
@@ -107,6 +108,7 @@ float Path::normalAngleAtLength(float length, bool& ok)
     ok = traversalState.m_success;
     return traversalState.m_normalAngle;
 }
+#endif
 
 Path Path::createRoundedRectangle(const FloatRect& rectangle, const FloatSize& roundingRadii)
 {
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Path.h b/src/3rdparty/webkit/WebCore/platform/graphics/Path.h
index 26927a1f0e..b69670f763 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Path.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Path.h
@@ -29,14 +29,17 @@
 #define Path_h
 
 #include <algorithm>
+#include <wtf/FastAllocBase.h>
 
 #if PLATFORM(CG)
 typedef struct CGPath PlatformPath;
+#elif PLATFORM(OPENVG)
+namespace WebCore {
+class PlatformPathOpenVG;
+}
+typedef WebCore::PlatformPathOpenVG PlatformPath;
 #elif PLATFORM(QT)
-#include <qglobal.h>
-QT_BEGIN_NAMESPACE
-class QPainterPath;
-QT_END_NAMESPACE
+#include <qpainterpath.h>
 typedef QPainterPath PlatformPath;
 #elif PLATFORM(WX) && USE(WXGC)
 class wxGraphicsPath;
@@ -52,7 +55,7 @@ typedef SkPath PlatformPath;
 #elif PLATFORM(HAIKU)
 class BRegion;
 typedef BRegion PlatformPath;
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
 namespace WebCore {
     class PlatformPath;
 }
@@ -60,15 +63,22 @@ namespace WebCore {
 typedef void PlatformPath;
 #endif
 
+#if PLATFORM(QT)
+/* QPainterPath is valued based */
+typedef PlatformPath PlatformPathPtr;
+#else
+typedef PlatformPath* PlatformPathPtr;
+#endif
+
 namespace WebCore {
 
+    class AffineTransform;
     class FloatPoint;
     class FloatRect;
     class FloatSize;
     class GraphicsContext;
     class String;
     class StrokeStyleApplier;
-    class TransformationMatrix;
 
     enum WindRule {
         RULE_NONZERO = 0,
@@ -90,7 +100,7 @@ namespace WebCore {
 
     typedef void (*PathApplierFunction)(void* info, const PathElement*);
 
-    class Path {
+    class Path : public FastAllocBase {
     public:
         Path();
         ~Path();
@@ -130,7 +140,7 @@ namespace WebCore {
 
         String debugString() const;
 
-        PlatformPath* platformPath() const { return m_path; }
+        PlatformPathPtr platformPath() const { return m_path; }
 
         static Path createRoundedRectangle(const FloatRect&, const FloatSize& roundingRadii);
         static Path createRoundedRectangle(const FloatRect&, const FloatSize& topLeftRadius, const FloatSize& topRightRadius, const FloatSize& bottomLeftRadius, const FloatSize& bottomRightRadius);
@@ -140,10 +150,10 @@ namespace WebCore {
         static Path createLine(const FloatPoint&, const FloatPoint&);
 
         void apply(void* info, PathApplierFunction) const;
-        void transform(const TransformationMatrix&);
+        void transform(const AffineTransform&);
 
     private:
-        PlatformPath* m_path;
+        PlatformPathPtr m_path;
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.cpp
index d388bd7665..bb073073ed 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.cpp
@@ -35,12 +35,32 @@ Pattern::Pattern(Image* image, bool repeatX, bool repeatY)
     : m_tileImage(image)
     , m_repeatX(repeatX)
     , m_repeatY(repeatY)
+#if PLATFORM(SKIA)
+    , m_pattern(0)
+#endif
 {
     ASSERT(image);
 }
 
 Pattern::~Pattern()
 {
+    platformDestroy();
 }
 
+void Pattern::setPatternSpaceTransform(const AffineTransform& patternSpaceTransformation)
+{
+    m_patternSpaceTransformation = patternSpaceTransformation;
+    setPlatformPatternSpaceTransform();
+}
+
+#if !PLATFORM(SKIA)
+void Pattern::platformDestroy()
+{
+}
+
+void Pattern::setPlatformPatternSpaceTransform()
+{
+}
+#endif
+
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.h b/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.h
index aa0a357027..48e8d8b625 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.h
@@ -28,10 +28,11 @@
 #ifndef Pattern_h
 #define Pattern_h
 
+#include "AffineTransform.h"
+
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
-#include "TransformationMatrix.h"
 
 #if PLATFORM(CG)
 typedef struct CGPattern* CGPatternRef;
@@ -56,36 +57,48 @@ typedef wxBrush* PlatformPatternPtr;
 #elif PLATFORM(HAIKU)
 #include <interface/GraphicsDefs.h>
 typedef pattern* PlatformPatternPtr;
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
 typedef void* PlatformPatternPtr;
 #endif
 
 namespace WebCore {
-    class TransformationMatrix;
-    class Image;
 
-    class Pattern : public RefCounted<Pattern> {
-    public:
-        static PassRefPtr<Pattern> create(Image* tileImage, bool repeatX, bool repeatY)
-        {
-            return adoptRef(new Pattern(tileImage, repeatX, repeatY));
-        }
-        virtual ~Pattern();
+class AffineTransform;
+class Image;
+
+class Pattern : public RefCounted<Pattern> {
+public:
+    static PassRefPtr<Pattern> create(Image* tileImage, bool repeatX, bool repeatY)
+    {
+        return adoptRef(new Pattern(tileImage, repeatX, repeatY));
+    }
+    virtual ~Pattern();
+
+    Image* tileImage() const { return m_tileImage.get(); }
 
-        Image* tileImage() const { return m_tileImage.get(); }
+    void platformDestroy();
+
+    // Pattern space is an abstract space that maps to the default user space by the transformation 'userSpaceTransformation' 
+#if PLATFORM(SKIA)
+    PlatformPatternPtr platformPattern(const AffineTransform& userSpaceTransformation);
+#else
+    PlatformPatternPtr createPlatformPattern(const AffineTransform& userSpaceTransformation) const;
+#endif
+    void setPatternSpaceTransform(const AffineTransform& patternSpaceTransformation);
+    void setPlatformPatternSpaceTransform();
 
-        // Pattern space is an abstract space that maps to the default user space by the transformation 'userSpaceTransformation' 
-        PlatformPatternPtr createPlatformPattern(const TransformationMatrix& userSpaceTransformation) const;
-        void setPatternSpaceTransform(const TransformationMatrix& patternSpaceTransformation) { m_patternSpaceTransformation = patternSpaceTransformation; }
+    bool repeatX() const { return m_repeatX; }
+    bool repeatY() const { return m_repeatY; }
 
-    private:
-        Pattern(Image*, bool repeatX, bool repeatY);
+private:
+    Pattern(Image*, bool repeatX, bool repeatY);
 
-        RefPtr<Image> m_tileImage;
-        bool m_repeatX;
-        bool m_repeatY;
-        TransformationMatrix m_patternSpaceTransformation;
-    };
+    RefPtr<Image> m_tileImage;
+    bool m_repeatX;
+    bool m_repeatY;
+    AffineTransform m_patternSpaceTransformation;
+    PlatformPatternPtr m_pattern;
+};
 
 } //namespace
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h b/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h
index 387a5c77eb..0366e3b989 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h
@@ -28,14 +28,15 @@
 #include "FontPlatformData.h"
 #include "GlyphPageTreeNode.h"
 #include "GlyphWidthMap.h"
-#include "TextRenderingMode.h"
+#include "TypesettingFeatures.h"
 #include <wtf/OwnPtr.h>
 
 #if USE(ATSUI)
 typedef struct OpaqueATSUStyle* ATSUStyle;
 #endif
 
-#if PLATFORM(WIN) && !PLATFORM(WINCE)
+#if (PLATFORM(WIN) && !OS(WINCE)) \
+    || (OS(WINDOWS) && PLATFORM(WX))
 #include <usp10.h>
 #endif
 
@@ -86,7 +87,7 @@ public:
     float spaceWidth() const { return m_spaceWidth; }
     float adjustedSpaceWidth() const { return m_adjustedSpaceWidth; }
 
-#if PLATFORM(CG) || PLATFORM(CAIRO)
+#if PLATFORM(CG) || PLATFORM(CAIRO) || (OS(WINDOWS) && PLATFORM(WX))
     float syntheticBoldOffset() const { return m_syntheticBoldOffset; }
 #endif
 
@@ -115,13 +116,13 @@ public:
     virtual String description() const;
 #endif
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
     NSFont* getNSFont() const { return m_platformData.font(); }
 #endif
 
 #if USE(CORE_TEXT)
     CTFontRef getCTFont() const;
-    CFDictionaryRef getCFStringAttributes(TextRenderingMode) const;
+    CFDictionaryRef getCFStringAttributes(TypesettingFeatures) const;
 #endif
 
 #if USE(ATSUI)
@@ -138,9 +139,9 @@ public:
     QFont getQtFont() const { return m_platformData.font(); }
 #endif
 
-#if PLATFORM(WIN)
+#if PLATFORM(WIN) || (OS(WINDOWS) && PLATFORM(WX))
     bool isSystemFont() const { return m_isSystemFont; }
-#if !PLATFORM(WINCE)    // disable unused members to save space
+#if !OS(WINCE) // disable unused members to save space
     SCRIPT_FONTPROPERTIES* scriptFontProperties() const;
     SCRIPT_CACHE* scriptCache() const { return &m_scriptCache; }
 #endif
@@ -162,7 +163,8 @@ private:
 
     void commonInit();
 
-#if PLATFORM(WIN) && !PLATFORM(WINCE)
+#if (PLATFORM(WIN) && !OS(WINCE)) \
+    || (OS(WINDOWS) && PLATFORM(WX))
     void initGDIFont();
     void platformCommonDestroy();
     float widthForGDIGlyph(Glyph glyph) const;
@@ -198,7 +200,7 @@ private:
 
     mutable SimpleFontData* m_smallCapsFontData;
 
-#if PLATFORM(CG) || PLATFORM(CAIRO)
+#if PLATFORM(CG) || PLATFORM(CAIRO) || (OS(WINDOWS) && PLATFORM(WX))
     float m_syntheticBoldOffset;
 #endif
 
@@ -211,8 +213,7 @@ private:
 
 #if USE(ATSUI)
 public:
-    mutable ATSUStyle m_ATSUStyle;
-    mutable bool m_ATSUStyleInitialized;
+    mutable HashMap<unsigned, ATSUStyle> m_ATSUStyleMap;
     mutable bool m_ATSUMirrors;
     mutable bool m_checkedShapesArabic;
     mutable bool m_shapesArabic;
@@ -222,12 +223,12 @@ private:
 
 #if USE(CORE_TEXT)
     mutable RetainPtr<CTFontRef> m_CTFont;
-    mutable RetainPtr<CFDictionaryRef> m_CFStringAttributes;
+    mutable HashMap<unsigned, RetainPtr<CFDictionaryRef> > m_CFStringAttributes;
 #endif
 
-#if PLATFORM(WIN)
+#if PLATFORM(WIN) || (OS(WINDOWS) && PLATFORM(WX))
     bool m_isSystemFont;
-#if !PLATFORM(WINCE)    // disable unused members to save space
+#if !OS(WINCE) // disable unused members to save space
     mutable SCRIPT_CACHE m_scriptCache;
     mutable SCRIPT_FONTPROPERTIES* m_scriptFontProperties;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Tile.h b/src/3rdparty/webkit/WebCore/platform/graphics/Tile.h
new file mode 100644
index 0000000000..c55fcafc7c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Tile.h
@@ -0,0 +1,76 @@
+/*
+ Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ 
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+ 
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+ 
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#ifndef Tile_h
+#define Tile_h
+
+#if ENABLE(TILED_BACKING_STORE)
+
+#include "IntPoint.h"
+#include "IntPointHash.h"
+#include "IntRect.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+#if PLATFORM(QT)
+class QPixmap;
+class QRegion;
+#endif
+
+namespace WebCore {
+    
+class GraphicsContext;
+class TiledBackingStore;
+
+class Tile : public RefCounted<Tile> {
+public:
+    typedef IntPoint Coordinate;
+
+    static PassRefPtr<Tile> create(TiledBackingStore* backingStore, const Coordinate& tileCoordinate) { return adoptRef(new Tile(backingStore, tileCoordinate)); }
+    ~Tile();
+    
+    bool isDirty() const;
+    void invalidate(const IntRect&);
+    void updateBackBuffer();
+    void swapBackBufferToFront();
+    bool isReadyToPaint() const;
+    void paint(GraphicsContext*, const IntRect&);
+
+    const Tile::Coordinate& coordinate() const { return m_coordinate; }
+    const IntRect& rect() const { return m_rect; }
+    
+    static void paintCheckerPattern(GraphicsContext*, const FloatRect&);
+
+private:
+    Tile(TiledBackingStore*, const Coordinate&);
+    
+    TiledBackingStore* m_backingStore;
+    Coordinate m_coordinate;
+    IntRect m_rect;
+
+#if PLATFORM(QT)
+    QPixmap* m_buffer;
+    QPixmap* m_backBuffer;
+    QRegion* m_dirtyRegion;
+#endif
+};
+
+}
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/TiledBackingStore.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/TiledBackingStore.cpp
new file mode 100644
index 0000000000..6214f1bb9b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/TiledBackingStore.cpp
@@ -0,0 +1,378 @@
+/*
+ Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ 
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+ 
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+ 
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "TiledBackingStore.h"
+
+#if ENABLE(TILED_BACKING_STORE)
+
+#include "GraphicsContext.h"
+#include "TiledBackingStoreClient.h"
+
+namespace WebCore {
+    
+static const int defaultTileWidth = 512;
+static const int defaultTileHeight = 512;
+
+TiledBackingStore::TiledBackingStore(TiledBackingStoreClient* client)
+    : m_client(client)
+    , m_tileBufferUpdateTimer(new TileTimer(this, &TiledBackingStore::tileBufferUpdateTimerFired))
+    , m_tileCreationTimer(new TileTimer(this, &TiledBackingStore::tileCreationTimerFired))
+    , m_tileSize(defaultTileWidth, defaultTileHeight)
+    , m_contentsScale(1.f)
+    , m_pendingScale(0)
+    , m_contentsFrozen(false)
+{
+}
+
+TiledBackingStore::~TiledBackingStore()
+{
+    delete m_tileBufferUpdateTimer;
+    delete m_tileCreationTimer;
+}
+
+void TiledBackingStore::invalidate(const IntRect& contentsDirtyRect)
+{
+    IntRect dirtyRect(mapFromContents(contentsDirtyRect));
+    
+    Tile::Coordinate topLeft = tileCoordinateForPoint(dirtyRect.topLeft());
+    Tile::Coordinate bottomRight = tileCoordinateForPoint(dirtyRect.bottomRight());
+    
+    for (unsigned yCoordinate = topLeft.y(); yCoordinate <= bottomRight.y(); ++yCoordinate) {
+        for (unsigned xCoordinate = topLeft.x(); xCoordinate <= bottomRight.x(); ++xCoordinate) {
+            RefPtr<Tile> currentTile = tileAt(Tile::Coordinate(xCoordinate, yCoordinate));
+            if (!currentTile)
+                continue;
+            currentTile->invalidate(dirtyRect);
+        }
+    }
+
+    startTileBufferUpdateTimer();
+}
+
+void TiledBackingStore::updateTileBuffers()
+{
+    if (m_contentsFrozen)
+        return;
+    
+    Vector<IntRect> paintedArea;
+    Vector<RefPtr<Tile> > dirtyTiles;
+    TileMap::iterator end = m_tiles.end();
+    for (TileMap::iterator it = m_tiles.begin(); it != end; ++it) {
+        if (!it->second->isDirty())
+            continue;
+        dirtyTiles.append(it->second);
+        // FIXME: should not request system repaint for the full tile.
+        paintedArea.append(mapToContents(it->second->rect()));
+    }
+    
+    if (dirtyTiles.isEmpty())
+        return;
+    
+    m_client->tiledBackingStorePaintBegin();
+
+    // FIXME: In single threaded case, tile back buffers could be updated asynchronously 
+    // one by one and then swapped to front in one go. This would minimize the time spent
+    // blocking on tile updates.
+    unsigned size = dirtyTiles.size();
+    for (unsigned n = 0; n < size; ++n)
+        dirtyTiles[n]->updateBackBuffer();
+
+    for (unsigned n = 0; n < size; ++n)
+        dirtyTiles[n]->swapBackBufferToFront();
+
+    m_client->tiledBackingStorePaintEnd(paintedArea);
+}
+
+void TiledBackingStore::paint(GraphicsContext* context, const IntRect& rect)
+{
+    context->save();
+    
+    // Assumes the backing store is painted with the scale transform applied.
+    // Since tile content is already scaled, first revert the scaling from the painter.
+    context->scale(FloatSize(1.f / m_contentsScale, 1.f / m_contentsScale));
+    
+    IntRect dirtyRect = mapFromContents(rect);
+    
+    Tile::Coordinate topLeft = tileCoordinateForPoint(dirtyRect.topLeft());
+    Tile::Coordinate bottomRight = tileCoordinateForPoint(dirtyRect.bottomRight());
+
+    for (unsigned yCoordinate = topLeft.y(); yCoordinate <= bottomRight.y(); ++yCoordinate) {
+        for (unsigned xCoordinate = topLeft.x(); xCoordinate <= bottomRight.x(); ++xCoordinate) {
+            Tile::Coordinate currentCoordinate(xCoordinate, yCoordinate);
+            RefPtr<Tile> currentTile = tileAt(currentCoordinate);
+            if (currentTile && currentTile->isReadyToPaint())
+                currentTile->paint(context, dirtyRect);
+            else {
+                FloatRect tileRect = tileRectForCoordinate(currentCoordinate);
+                FloatRect target = intersection(tileRect, FloatRect(rect));
+                Tile::paintCheckerPattern(context, target);
+            }
+        }
+    }
+    context->restore();
+}
+
+void TiledBackingStore::viewportChanged(const IntRect& contentsViewport)
+{
+    IntRect viewport = mapFromContents(contentsViewport);
+    if (m_viewport == viewport)
+        return;
+
+    m_viewport = viewport;
+
+    startTileCreationTimer();
+}
+
+void TiledBackingStore::setContentsScale(float scale)
+{
+    if (m_pendingScale == m_contentsScale) {
+        m_pendingScale = 0;
+        return;
+    }
+    m_pendingScale = scale;
+    if (m_contentsFrozen)
+        return;
+    commitScaleChange();
+}
+    
+void TiledBackingStore::commitScaleChange()
+{
+    m_contentsScale = m_pendingScale;
+    m_pendingScale = 0;
+    m_tiles.clear();
+    createTiles();
+}
+
+double TiledBackingStore::tileDistance(const IntRect& viewport, const Tile::Coordinate& tileCoordinate)
+{
+    if (viewport.intersects(tileRectForCoordinate(tileCoordinate)))
+        return 0;
+    
+    IntPoint viewCenter = viewport.location() + IntSize(viewport.width() / 2, viewport.height() / 2);
+    Tile::Coordinate centerCoordinate = tileCoordinateForPoint(viewCenter);
+    
+    // Manhattan distance, biased so that vertical distances are shorter.
+    const double horizontalBias = 1.3;
+    return abs(centerCoordinate.y() - tileCoordinate.y()) + horizontalBias * abs(centerCoordinate.x() - tileCoordinate.x());
+}
+
+void TiledBackingStore::createTiles()
+{
+    if (m_contentsFrozen)
+        return;
+
+    if (m_viewport.isEmpty())
+        return;
+
+    // Remove tiles that extend outside the current contents rect.
+    dropOverhangingTiles();
+
+    // FIXME: Make configurable/adapt to memory.
+    IntRect keepRect = m_viewport;
+    keepRect.inflateX(m_viewport.width());
+    keepRect.inflateY(3 * m_viewport.height());
+    keepRect.intersect(contentsRect());
+    
+    dropTilesOutsideRect(keepRect);
+    
+    IntRect coverRect = m_viewport;
+    coverRect.inflateX(m_viewport.width() / 2);
+    coverRect.inflateY(2 * m_viewport.height());
+    coverRect.intersect(contentsRect());
+    
+    // Search for the tile position closest to the viewport center that does not yet contain a tile. 
+    // Which position is considered the closest depends on the tileDistance function.
+    double shortestDistance = std::numeric_limits<double>::infinity();
+    Vector<Tile::Coordinate> tilesToCreate;
+    unsigned requiredTileCount = 0;
+    Tile::Coordinate topLeft = tileCoordinateForPoint(coverRect.topLeft());
+    Tile::Coordinate bottomRight = tileCoordinateForPoint(coverRect.bottomRight());
+    for (unsigned yCoordinate = topLeft.y(); yCoordinate <= bottomRight.y(); ++yCoordinate) {
+        for (unsigned xCoordinate = topLeft.x(); xCoordinate <= bottomRight.x(); ++xCoordinate) {
+            Tile::Coordinate currentCoordinate(xCoordinate, yCoordinate);
+            if (tileAt(currentCoordinate))
+                continue;
+            ++requiredTileCount;
+            // Distance is 0 for all currently visible tiles.
+            double distance = tileDistance(m_viewport, currentCoordinate);
+            if (distance > shortestDistance)
+                continue;
+            if (distance < shortestDistance) {
+                tilesToCreate.clear();
+                shortestDistance = distance;
+            }
+            tilesToCreate.append(currentCoordinate);
+        }
+    }
+    
+    // Now construct the tile(s)
+    unsigned tilesToCreateCount = tilesToCreate.size();
+    for (unsigned n = 0; n < tilesToCreateCount; ++n) {
+        Tile::Coordinate coordinate = tilesToCreate[n];
+        setTile(coordinate, Tile::create(this, coordinate));
+    }
+    requiredTileCount -= tilesToCreateCount;
+    
+    // Paint the content of the newly created tiles
+    if (tilesToCreateCount)
+        updateTileBuffers();
+
+    // Keep creating tiles until the whole coverRect is covered.
+    if (requiredTileCount)
+        m_tileCreationTimer->startOneShot(0);
+}
+
+void TiledBackingStore::dropOverhangingTiles()
+{    
+    IntRect contentsRect = this->contentsRect();
+
+    Vector<Tile::Coordinate> tilesToRemove;
+    TileMap::iterator end = m_tiles.end();
+    for (TileMap::iterator it = m_tiles.begin(); it != end; ++it) {
+        Tile::Coordinate tileCoordinate = it->second->coordinate();
+        IntRect tileRect = it->second->rect();
+        IntRect expectedTileRect = tileRectForCoordinate(tileCoordinate);
+        if (expectedTileRect != tileRect || !contentsRect.contains(tileRect))
+            tilesToRemove.append(tileCoordinate);
+    }
+    unsigned removeCount = tilesToRemove.size();
+    for (unsigned n = 0; n < removeCount; ++n)
+        removeTile(tilesToRemove[n]);
+}
+
+void TiledBackingStore::dropTilesOutsideRect(const IntRect& keepRect)
+{
+    FloatRect keepRectF = keepRect;
+
+    Vector<Tile::Coordinate> toRemove;
+    TileMap::iterator end = m_tiles.end();
+    for (TileMap::iterator it = m_tiles.begin(); it != end; ++it) {
+        Tile::Coordinate coordinate = it->second->coordinate();
+        FloatRect tileRect = it->second->rect();
+        if (!tileRect.intersects(keepRectF))
+            toRemove.append(coordinate);
+    }
+    unsigned removeCount = toRemove.size();
+    for (unsigned n = 0; n < removeCount; ++n)
+        removeTile(toRemove[n]);
+}
+
+PassRefPtr<Tile> TiledBackingStore::tileAt(const Tile::Coordinate& coordinate) const
+{
+    return m_tiles.get(coordinate);
+}
+
+void TiledBackingStore::setTile(const Tile::Coordinate& coordinate, PassRefPtr<Tile> tile)
+{
+    m_tiles.set(coordinate, tile);
+}
+
+void TiledBackingStore::removeTile(const Tile::Coordinate& coordinate)
+{
+    m_tiles.remove(coordinate);
+}
+
+IntRect TiledBackingStore::mapToContents(const IntRect& rect) const
+{
+    return enclosingIntRect(FloatRect(rect.x() / m_contentsScale,
+        rect.y() / m_contentsScale,
+        rect.width() / m_contentsScale,
+        rect.height() / m_contentsScale));
+}
+
+IntRect TiledBackingStore::mapFromContents(const IntRect& rect) const
+{
+    return enclosingIntRect(FloatRect(rect.x() * m_contentsScale,
+        rect.y() * m_contentsScale,
+        rect.width() * m_contentsScale,
+        rect.height() * m_contentsScale));
+}
+
+IntRect TiledBackingStore::contentsRect() const
+{
+    return mapFromContents(m_client->tiledBackingStoreContentsRect());
+}
+
+IntRect TiledBackingStore::tileRectForCoordinate(const Tile::Coordinate& coordinate) const
+{
+    IntRect rect(coordinate.x() * m_tileSize.width(),
+        coordinate.y() * m_tileSize.height(),
+        m_tileSize.width(),
+        m_tileSize.height());
+
+    rect.intersect(contentsRect());
+    return rect;
+}
+    
+Tile::Coordinate TiledBackingStore::tileCoordinateForPoint(const IntPoint& point) const
+{
+    int x = point.x() / m_tileSize.width();
+    int y = point.y() / m_tileSize.height();
+    return Tile::Coordinate(std::max(x, 0), std::max(y, 0));
+}
+
+
+void TiledBackingStore::startTileBufferUpdateTimer()
+{
+    if (m_tileBufferUpdateTimer->isActive() || m_contentsFrozen)
+        return;
+    m_tileBufferUpdateTimer->startOneShot(0);
+}
+
+void TiledBackingStore::tileBufferUpdateTimerFired(TileTimer*)
+{
+    updateTileBuffers();
+}
+
+void TiledBackingStore::startTileCreationTimer()
+{
+    if (m_tileCreationTimer->isActive() || m_contentsFrozen)
+        return;
+    m_tileCreationTimer->startOneShot(0);
+}
+
+void TiledBackingStore::tileCreationTimerFired(TileTimer*)
+{
+    createTiles();
+}
+
+void TiledBackingStore::setContentsFrozen(bool freeze)
+{
+    if (m_contentsFrozen == freeze)
+        return;
+
+    m_contentsFrozen = freeze;
+
+    // Restart the timers. There might be pending invalidations that
+    // were not painted or created because tiles are not created or
+    // painted when in frozen state.
+    if (m_contentsFrozen)
+        return;
+    if (m_pendingScale)
+        commitScaleChange();
+    else {
+        startTileCreationTimer();
+        startTileBufferUpdateTimer();
+    }
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/TiledBackingStore.h b/src/3rdparty/webkit/WebCore/platform/graphics/TiledBackingStore.h
new file mode 100644
index 0000000000..8ed4336e47
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/TiledBackingStore.h
@@ -0,0 +1,110 @@
+/*
+ Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ 
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+ 
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+ 
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#ifndef TiledBackingStore_h
+#define TiledBackingStore_h
+
+#if ENABLE(TILED_BACKING_STORE)
+
+#include "FloatSize.h"
+#include "IntPoint.h"
+#include "IntRect.h"
+#include "Tile.h"
+#include "Timer.h"
+#include <wtf/Assertions.h>
+#include <wtf/HashMap.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class GraphicsContext;
+class TiledBackingStoreClient;
+
+class TiledBackingStore : public Noncopyable {
+public:
+    TiledBackingStore(TiledBackingStoreClient*);
+    ~TiledBackingStore();
+
+    void viewportChanged(const IntRect& viewportRect);
+    
+    float contentsScale() { return m_contentsScale; }
+    void setContentsScale(float);
+    
+    bool contentsFrozen() const { return m_contentsFrozen; }
+    void setContentsFrozen(bool);
+
+    void invalidate(const IntRect& dirtyRect);
+    void paint(GraphicsContext*, const IntRect&);
+
+private:
+    void startTileBufferUpdateTimer();
+    void startTileCreationTimer();
+    
+    typedef Timer<TiledBackingStore> TileTimer;
+
+    void tileBufferUpdateTimerFired(TileTimer*);
+    void tileCreationTimerFired(TileTimer*);
+    
+    void updateTileBuffers();
+    void createTiles();
+    
+    void commitScaleChange();
+
+    void dropOverhangingTiles();
+    void dropTilesOutsideRect(const IntRect&);
+    
+    PassRefPtr<Tile> tileAt(const Tile::Coordinate&) const;
+    void setTile(const Tile::Coordinate& coordinate, PassRefPtr<Tile> tile);
+    void removeTile(const Tile::Coordinate& coordinate);
+
+    IntRect mapToContents(const IntRect&) const;
+    IntRect mapFromContents(const IntRect&) const;
+    
+    IntRect contentsRect() const;
+    
+    IntRect tileRectForCoordinate(const Tile::Coordinate&) const;
+    Tile::Coordinate tileCoordinateForPoint(const IntPoint&) const;
+    double tileDistance(const IntRect& viewport, const Tile::Coordinate&);
+    
+    void paintCheckerPattern(GraphicsContext*, const IntRect&, const Tile::Coordinate&);
+
+private:
+    TiledBackingStoreClient* m_client;
+
+    typedef HashMap<Tile::Coordinate, RefPtr<Tile> > TileMap;
+    TileMap m_tiles;
+
+    TileTimer* m_tileBufferUpdateTimer;
+    TileTimer* m_tileCreationTimer;
+
+    IntSize m_tileSize;
+    
+    IntRect m_viewport;
+    float m_contentsScale;
+    float m_pendingScale;
+
+    bool m_contentsFrozen;
+
+    friend class Tile;
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/TiledBackingStoreClient.h b/src/3rdparty/webkit/WebCore/platform/graphics/TiledBackingStoreClient.h
new file mode 100644
index 0000000000..4adbbab501
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/TiledBackingStoreClient.h
@@ -0,0 +1,40 @@
+/*
+ Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ 
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+ 
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+ 
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#ifndef TiledBackingStoreClient_h
+#define TiledBackingStoreClient_h
+
+namespace WebCore {
+
+#if ENABLE(TILED_BACKING_STORE)
+class TiledBackingStoreClient {
+public:
+    virtual void tiledBackingStorePaintBegin() = 0;
+    virtual void tiledBackingStorePaint(GraphicsContext*, const IntRect&) = 0;
+    virtual void tiledBackingStorePaintEnd(const Vector<IntRect>& paintedArea) = 0;
+    virtual IntRect tiledBackingStoreContentsRect() = 0;
+};
+
+#else
+class TiledBackingStoreClient {};
+#endif
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/TypesettingFeatures.h b/src/3rdparty/webkit/WebCore/platform/graphics/TypesettingFeatures.h
new file mode 100644
index 0000000000..aa46beb02a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/TypesettingFeatures.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TypesettingFeatures_h
+#define TypesettingFeatures_h
+
+namespace WebCore {
+    enum TypesettingFeature {
+        Kerning = 1 << 0,
+        Ligatures = 1 << 1,
+    };
+
+    typedef unsigned TypesettingFeatures;
+} // namespace WebCore
+
+#endif // TypesettingFeatures_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.cpp
index 2364cc4737..f362148512 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.cpp
@@ -111,10 +111,10 @@ void FEBlend::apply(Filter* filter)
     if (!getEffectContext())
         return;
 
-    IntRect effectADrawingRect = calculateDrawingIntRect(m_in->subRegion());
+    IntRect effectADrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
     RefPtr<CanvasPixelArray> srcPixelArrayA(m_in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
 
-    IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->subRegion());
+    IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->scaledSubRegion());
     RefPtr<CanvasPixelArray> srcPixelArrayB(m_in2->resultImage()->getPremultipliedImageData(effectBDrawingRect)->data());
 
     IntRect imageRect(IntPoint(), resultImage()->size());
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp
index a2ed9bd088..bd19d14952 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp
@@ -164,7 +164,7 @@ void FEColorMatrix::apply(Filter* filter)
     if (!filterContext)
         return;
 
-    filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+    filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()));
 
     IntRect imageRect(IntPoint(), resultImage()->size());
     PassRefPtr<ImageData> imageData(resultImage()->getUnmultipliedImageData(imageRect));
@@ -184,6 +184,7 @@ void FEColorMatrix::apply(Filter* filter)
             break;
         case FECOLORMATRIX_TYPE_LUMINANCETOALPHA:
             effectType<FECOLORMATRIX_TYPE_LUMINANCETOALPHA>(srcPixelArray, imageData, m_values);
+            setIsAlphaImage(true);
             break;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
index 0d76d8d6a9..f9aa011f2c 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
@@ -3,6 +3,7 @@
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
                   2009 Dirk Schulze <krit@webkit.org>
+    Copyright (C) Research In Motion Limited 2010. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -140,7 +141,8 @@ static void linear(unsigned char* values, const ComponentTransferFunction& trans
 static void gamma(unsigned char* values, const ComponentTransferFunction& transferFunction)
 {
     for (unsigned i = 0; i < 256; ++i) {
-        double val = 255.0 * (transferFunction.amplitude * pow((i / 255.0), transferFunction.exponent) + transferFunction.offset);
+        double exponent = transferFunction.exponent; // RCVT doesn't like passing a double and a float to pow, so promote this to double
+        double val = 255.0 * (transferFunction.amplitude * pow((i / 255.0), exponent) + transferFunction.offset);
         val = std::max(0.0, std::min(255.0, val));
         values[i] = static_cast<unsigned char>(val);
     }
@@ -165,7 +167,7 @@ void FEComponentTransfer::apply(Filter* filter)
     for (unsigned channel = 0; channel < 4; channel++)
         (*callEffect[transferFunction[channel].type])(tables[channel], transferFunction[channel]);
 
-    IntRect drawingRect = calculateDrawingIntRect(m_in->subRegion());
+    IntRect drawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
     RefPtr<ImageData> imageData(m_in->resultImage()->getUnmultipliedImageData(drawingRect));
     CanvasPixelArray* srcPixelArray(imageData->data());
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.h
index 773aba7ade..ab84cf017f 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.h
@@ -25,7 +25,6 @@
 #if ENABLE(FILTERS)
 #include "FilterEffect.h"
 
-#include "SVGFEDisplacementMap.h"
 #include "Filter.h"
 #include <wtf/Vector.h>
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp
index 1b4116530e..67d3d27e33 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -111,9 +111,7 @@ inline void arithmetic(const RefPtr<CanvasPixelArray>& srcPixelArrayA, CanvasPix
             unsigned char i1 = srcPixelArrayA->get(pixelOffset + channel);
             unsigned char i2 = srcPixelArrayB->get(pixelOffset + channel);
 
-            unsigned char result = scaledK1 * i1 * i2 + k2 * i1 + k3 * i2 + scaledK4;
-            if (channel == 3 && i1 == 0 && i2 == 0)
-                result = 0;
+            double result = scaledK1 * i1 * i2 + k2 * i1 + k3 * i2 + scaledK4;
             srcPixelArrayB->set(pixelOffset + channel, result);
         }
     }
@@ -133,32 +131,32 @@ void FEComposite::apply(Filter* filter)
     FloatRect srcRect = FloatRect(0.f, 0.f, -1.f, -1.f);
     switch (m_type) {
     case FECOMPOSITE_OPERATOR_OVER:
-        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+        filterContext->drawImage(m_in2->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in2->scaledSubRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()));
         break;
     case FECOMPOSITE_OPERATOR_IN:
         filterContext->save();
-        filterContext->clipToImageBuffer(calculateDrawingRect(m_in2->subRegion()), m_in2->resultImage());
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+        filterContext->clipToImageBuffer(calculateDrawingRect(m_in2->scaledSubRegion()), m_in2->resultImage());
+        filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()));
         filterContext->restore();
         break;
     case FECOMPOSITE_OPERATOR_OUT:
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
-        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()), srcRect, CompositeDestinationOut);
+        filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()));
+        filterContext->drawImage(m_in2->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in2->scaledSubRegion()), srcRect, CompositeDestinationOut);
         break;
     case FECOMPOSITE_OPERATOR_ATOP:
-        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()), srcRect, CompositeSourceAtop);
+        filterContext->drawImage(m_in2->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in2->scaledSubRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()), srcRect, CompositeSourceAtop);
         break;
     case FECOMPOSITE_OPERATOR_XOR:
-        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()), srcRect, CompositeXOR);
+        filterContext->drawImage(m_in2->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in2->scaledSubRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()), srcRect, CompositeXOR);
         break;
     case FECOMPOSITE_OPERATOR_ARITHMETIC: {
-        IntRect effectADrawingRect = calculateDrawingIntRect(m_in->subRegion());
+        IntRect effectADrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
         RefPtr<CanvasPixelArray> srcPixelArrayA(m_in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
 
-        IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->subRegion());
+        IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->scaledSubRegion());
         RefPtr<ImageData> imageData(m_in2->resultImage()->getPremultipliedImageData(effectBDrawingRect));
         CanvasPixelArray* srcPixelArrayB(imageData->data());
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
index f480f10fca..0b97e39d86 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
@@ -32,6 +32,8 @@
 #include <math.h>
 #include <wtf/MathExtras.h>
 
+using std::max;
+
 namespace WebCore {
 
 FEGaussianBlur::FEGaussianBlur(FilterEffect* in, const float& x, const float& y)
@@ -111,10 +113,12 @@ void FEGaussianBlur::apply(Filter* filter)
     if (m_x == 0 || m_y == 0)
         return;
 
-    unsigned sdx = static_cast<unsigned>(floor(m_x * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
-    unsigned sdy = static_cast<unsigned>(floor(m_y * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
+    unsigned sdx = static_cast<unsigned>(floor(m_x * filter->filterResolution().width() * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
+    unsigned sdy = static_cast<unsigned>(floor(m_y * filter->filterResolution().height() * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
+    sdx = max(sdx, static_cast<unsigned>(1));
+    sdy = max(sdy, static_cast<unsigned>(1));
 
-    IntRect effectDrawingRect = calculateDrawingIntRect(m_in->subRegion());
+    IntRect effectDrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
     RefPtr<ImageData> srcImageData(m_in->resultImage()->getPremultipliedImageData(effectDrawingRect));
     CanvasPixelArray* srcPixelArray(srcImageData->data());
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/Filter.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/Filter.h
index ee97afce25..8924b94d1e 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/Filter.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/Filter.h
@@ -22,6 +22,7 @@
 
 #if ENABLE(FILTERS)
 #include "FloatRect.h"
+#include "FloatSize.h"
 #include "ImageBuffer.h"
 #include "StringHash.h"
 
@@ -40,15 +41,21 @@ namespace WebCore {
         void setSourceImage(PassOwnPtr<ImageBuffer> sourceImage) { m_sourceImage = sourceImage; }
         ImageBuffer* sourceImage() { return m_sourceImage.get(); }
 
-        virtual FloatRect sourceImageRect() = 0;
-        virtual FloatRect filterRegion() = 0;
+        FloatSize filterResolution() const { return m_filterResolution; }
+        void setFilterResolution(const FloatSize& filterResolution) { m_filterResolution = filterResolution; }
+
+        virtual FloatRect sourceImageRect() const = 0;
+        virtual FloatRect filterRegion() const = 0;
 
         // SVG specific
-        virtual void calculateEffectSubRegion(FilterEffect*) = 0;
-        virtual bool effectBoundingBoxMode() = 0;
+        virtual void calculateEffectSubRegion(FilterEffect*) { }
+
+        virtual FloatSize maxImageSize() const = 0;
+        virtual bool effectBoundingBoxMode() const = 0;
 
     private:
         OwnPtr<ImageBuffer> m_sourceImage;
+        FloatSize m_filterResolution;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp
index 68900b51b2..55838139c1 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -58,21 +58,21 @@ FloatRect FilterEffect::calculateEffectRect(Filter* filter)
 
 IntRect FilterEffect::calculateDrawingIntRect(const FloatRect& effectRect)
 {
-    IntPoint location = roundedIntPoint(FloatPoint(subRegion().x() - effectRect.x(),
-                                                   subRegion().y() - effectRect.y()));
+    IntPoint location = roundedIntPoint(FloatPoint(scaledSubRegion().x() - effectRect.x(),
+                                                   scaledSubRegion().y() - effectRect.y()));
     return IntRect(location, resultImage()->size());
 }
 
 FloatRect FilterEffect::calculateDrawingRect(const FloatRect& srcRect)
 {
-    FloatPoint startPoint = FloatPoint(srcRect.x() - subRegion().x(), srcRect.y() - subRegion().y());
+    FloatPoint startPoint = FloatPoint(srcRect.x() - scaledSubRegion().x(), srcRect.y() - scaledSubRegion().y());
     FloatRect drawingRect = FloatRect(startPoint, srcRect.size());
     return drawingRect;
 }
 
 GraphicsContext* FilterEffect::getEffectContext()
 {
-    IntRect bufferRect = enclosingIntRect(subRegion());
+    IntRect bufferRect = enclosingIntRect(scaledSubRegion());
     m_effectBuffer = ImageBuffer::create(bufferRect.size(), LinearRGB);
     return m_effectBuffer->context();
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h
index b30e513b63..a46d7956a2 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h
@@ -44,6 +44,12 @@ namespace WebCore {
         FloatRect subRegion() const { return m_subRegion; }
         void setSubRegion(const FloatRect& subRegion) { m_subRegion = subRegion; }
 
+        FloatRect scaledSubRegion() const { return m_scaledSubRegion; }
+        void setScaledSubRegion(const FloatRect& scaledSubRegion) { m_scaledSubRegion = scaledSubRegion; }
+
+        FloatRect effectBoundaries() const { return m_effectBoundaries; }
+        void setEffectBoundaries(const FloatRect& effectBoundaries) { m_effectBoundaries = effectBoundaries; }
+
         bool hasX() { return m_hasX; }
         void setHasX(bool value) { m_hasX = value; }
 
@@ -96,7 +102,9 @@ namespace WebCore {
 
         bool m_alphaImage;
 
+        FloatRect m_effectBoundaries;
         FloatRect m_subRegion;
+        FloatRect m_scaledSubRegion;
         FloatRect m_unionOfChildEffectSubregions;
 
         mutable OwnPtr<ImageBuffer> m_effectBuffer;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/ImageBufferFilter.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/ImageBufferFilter.cpp
new file mode 100644
index 0000000000..33953d65fc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/ImageBufferFilter.cpp
@@ -0,0 +1,43 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *  Copyright (C) 2009 Brent Fulgham <bfulgham@webkit.org>
+ *
+ *   This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(FILTERS)
+#include "ImageBufferFilter.h"
+
+#include "FloatSize.h"
+
+namespace WebCore {
+
+ImageBufferFilter::ImageBufferFilter()
+    : Filter()
+{
+    setFilterResolution(FloatSize(1.f, 1.f));
+}
+
+PassRefPtr<ImageBufferFilter> ImageBufferFilter::create()
+{
+    return adoptRef(new ImageBufferFilter());
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/ImageBufferFilter.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/ImageBufferFilter.h
new file mode 100644
index 0000000000..a2775eafb4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/ImageBufferFilter.h
@@ -0,0 +1,57 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *  Copyright (C) 2009 Brent Fulgham <bfulgham@webkit.org>
+ *
+ *   This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef ImageBufferFilter_h
+#define ImageBufferFilter_h
+
+#if ENABLE(FILTERS)
+#include "Filter.h"
+#include "FilterEffect.h"
+#include "FloatRect.h"
+#include "FloatSize.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class ImageBufferFilter : public Filter {
+public:
+    static PassRefPtr<ImageBufferFilter> create();
+
+    virtual FloatRect filterRegion() const { return FloatRect(); }
+    virtual FloatRect sourceImageRect() const { return FloatRect(); }
+
+    // SVG specific
+    virtual bool effectBoundingBoxMode() const { return false; }
+
+    virtual FloatSize maxImageSize() const { return FloatSize(); }
+    virtual void calculateEffectSubRegion(FilterEffect*) { }
+
+private:
+    ImageBufferFilter();
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
+
+#endif // ImageBufferFilter_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.cpp
index 1b6309b601..539bb4450c 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.cpp
@@ -50,6 +50,8 @@ FloatRect SourceAlpha::calculateEffectRect(Filter* filter)
     if (filter->sourceImageRect().y() < filter->filterRegion().y())
         clippedSourceRect.setY(filter->filterRegion().y());
     setSubRegion(clippedSourceRect);
+    clippedSourceRect.scale(filter->filterResolution().width(), filter->filterResolution().height());
+    setScaledSubRegion(clippedSourceRect);
     return filter->filterRegion();
 }
 
@@ -64,7 +66,7 @@ void SourceAlpha::apply(Filter* filter)
     FloatRect imageRect(FloatPoint(), filter->sourceImage()->image()->size());
     filterContext->save();
     filterContext->clipToImageBuffer(imageRect, filter->sourceImage());
-    filterContext->fillRect(imageRect, Color::black);
+    filterContext->fillRect(imageRect, Color::black, DeviceColorSpace);
     filterContext->restore();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceGraphic.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceGraphic.cpp
index 023eeacea5..cc55618ff0 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceGraphic.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceGraphic.cpp
@@ -49,6 +49,8 @@ FloatRect SourceGraphic::calculateEffectRect(Filter* filter)
     if (filter->sourceImageRect().y() < filter->filterRegion().y())
         clippedSourceRect.setY(filter->filterRegion().y());
     setSubRegion(clippedSourceRect);
+    clippedSourceRect.scale(filter->filterResolution().width(), filter->filterResolution().height());
+    setScaledSubRegion(clippedSourceRect);
     return filter->filterRegion();
 }
 
@@ -58,7 +60,7 @@ void SourceGraphic::apply(Filter* filter)
     if (!filterContext)
         return;
 
-    filterContext->drawImage(filter->sourceImage()->image(), IntPoint());
+    filterContext->drawImage(filter->sourceImage()->image(), DeviceColorSpace, IntPoint());
 }
 
 void SourceGraphic::dump()
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/DataSourceGStreamer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/DataSourceGStreamer.cpp
new file mode 100644
index 0000000000..567da741b0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/DataSourceGStreamer.cpp
@@ -0,0 +1,243 @@
+/*
+ *  Copyright (C) 2009 Igalia S.L
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "DataSourceGStreamer.h"
+
+#include <gio/gio.h>
+#include <glib.h>
+#include <gst/gst.h>
+#include <gst/pbutils/missing-plugins.h>
+
+static GstStaticPadTemplate src_template = GST_STATIC_PAD_TEMPLATE("src",
+                                                                   GST_PAD_SRC,
+                                                                   GST_PAD_ALWAYS,
+                                                                   GST_STATIC_CAPS_ANY);
+
+GST_DEBUG_CATEGORY_STATIC(webkit_data_src_debug);
+#define GST_CAT_DEFAULT webkit_data_src_debug
+
+static void webkit_data_src_uri_handler_init(gpointer g_iface,
+                                             gpointer iface_data);
+
+static void webkit_data_src_finalize(WebkitDataSrc* src);
+static GstStateChangeReturn webkit_data_src_change_state(GstElement* element,
+                                                         GstStateChange transition);
+
+static const GInterfaceInfo urihandler_info = {
+    webkit_data_src_uri_handler_init,
+    0, 0
+};
+
+
+static void _do_init(GType datasrc_type)
+{
+    GST_DEBUG_CATEGORY_INIT(webkit_data_src_debug, "webkit_data_src", 0, "datasrc element");
+    g_type_add_interface_static(datasrc_type, GST_TYPE_URI_HANDLER,
+                                &urihandler_info);
+}
+
+GST_BOILERPLATE_FULL(WebkitDataSrc, webkit_data_src, GstBin, GST_TYPE_BIN, _do_init);
+
+static void webkit_data_src_base_init(gpointer klass)
+{
+    GstElementClass* element_class = GST_ELEMENT_CLASS(klass);
+
+    gst_element_class_add_pad_template(element_class,
+                                       gst_static_pad_template_get(&src_template));
+    gst_element_class_set_details_simple(element_class, (gchar*) "WebKit data source element",
+                                         (gchar*) "Source",
+                                         (gchar*) "Handles data: uris",
+                                         (gchar*) "Philippe Normand <pnormand@igalia.com>");
+
+}
+
+static void webkit_data_src_class_init(WebkitDataSrcClass* klass)
+{
+    GObjectClass* oklass = G_OBJECT_CLASS(klass);
+    GstElementClass* eklass = GST_ELEMENT_CLASS(klass);
+
+    oklass->finalize = (GObjectFinalizeFunc) webkit_data_src_finalize;
+    eklass->change_state = webkit_data_src_change_state;
+}
+
+
+static gboolean webkit_data_src_reset(WebkitDataSrc* src)
+{
+    GstPad* targetpad;
+
+    if (src->kid) {
+        gst_element_set_state(src->kid, GST_STATE_NULL);
+        gst_bin_remove(GST_BIN(src), src->kid);
+    }
+
+    src->kid = gst_element_factory_make("giostreamsrc", "streamsrc");
+    if (!src->kid) {
+        GST_ERROR_OBJECT(src, "Failed to create giostreamsrc");
+        return FALSE;
+    }
+
+    gst_bin_add(GST_BIN(src), src->kid);
+
+    targetpad = gst_element_get_static_pad(src->kid, "src");
+    gst_ghost_pad_set_target(GST_GHOST_PAD(src->pad), targetpad);
+    gst_object_unref(targetpad);
+
+    return TRUE;
+}
+
+static void webkit_data_src_init(WebkitDataSrc* src,
+                                 WebkitDataSrcClass* g_class)
+{
+    GstPadTemplate* pad_template = gst_static_pad_template_get(&src_template);
+    src->pad = gst_ghost_pad_new_no_target_from_template("src",
+                                                         pad_template);
+
+    gst_element_add_pad(GST_ELEMENT(src), src->pad);
+
+    webkit_data_src_reset(src);
+}
+
+static void webkit_data_src_finalize(WebkitDataSrc* src)
+{
+    g_free(src->uri);
+
+    if (src->kid) {
+        GST_DEBUG_OBJECT(src, "Removing giostreamsrc element");
+        gst_element_set_state(src->kid, GST_STATE_NULL);
+        gst_bin_remove(GST_BIN(src), src->kid);
+        src->kid = 0;
+    }
+
+    GST_CALL_PARENT(G_OBJECT_CLASS, finalize, ((GObject* )(src)));
+}
+
+static GstStateChangeReturn webkit_data_src_change_state(GstElement* element, GstStateChange transition)
+{
+    GstStateChangeReturn ret = GST_STATE_CHANGE_SUCCESS;
+    WebkitDataSrc* src = WEBKIT_DATA_SRC(element);
+
+    switch (transition) {
+    case GST_STATE_CHANGE_NULL_TO_READY:
+        if (!src->kid) {
+            gst_element_post_message(element,
+                                     gst_missing_element_message_new(element, "giostreamsrc"));
+            GST_ELEMENT_ERROR(src, CORE, MISSING_PLUGIN, (0), ("no giostreamsrc"));
+            return GST_STATE_CHANGE_FAILURE;
+        }
+        break;
+    default:
+        break;
+    }
+
+    ret = GST_ELEMENT_CLASS(parent_class)->change_state(element, transition);
+    if (G_UNLIKELY(ret == GST_STATE_CHANGE_FAILURE))
+        return ret;
+
+    // Downwards state change code should be here, after chaining up
+    // to the parent class.
+
+    return ret;
+}
+
+/*** GSTURIHANDLER INTERFACE *************************************************/
+
+static GstURIType webkit_data_src_uri_get_type(void)
+{
+    return GST_URI_SRC;
+}
+
+static gchar** webkit_data_src_uri_get_protocols(void)
+{
+    static gchar* protocols[] = {(gchar*) "data", 0 };
+
+    return protocols;
+}
+
+static const gchar* webkit_data_src_uri_get_uri(GstURIHandler* handler)
+{
+    WebkitDataSrc* src = WEBKIT_DATA_SRC(handler);
+
+    return src->uri;
+}
+
+static gboolean webkit_data_src_uri_set_uri(GstURIHandler* handler, const gchar* uri)
+{
+    WebkitDataSrc* src = WEBKIT_DATA_SRC(handler);
+
+    // URI as defined in RFC2397:
+    // "data:" [ mediatype ] [ ";base64" ] "," data
+    // we parse URIs like this one:
+    // data:audio/3gpp;base64,AA...
+
+    gchar** scheme_and_remains = g_strsplit(uri, ":", 2);
+    gchar** mime_type_and_options = g_strsplit(scheme_and_remains[1], ";", 0);
+    gint options_size = g_strv_length(mime_type_and_options);
+    gchar* data = 0;
+    gchar* mime_type = 0;
+    gint ret = FALSE;
+
+    // we require uris with a specified mime-type and base64-encoded
+    // data. It doesn't make much sense anyway to play plain/text data
+    // with very few allowed characters (as per the RFC).
+
+    if (GST_STATE(src) >= GST_STATE_PAUSED) {
+        GST_ERROR_OBJECT(src, "Element already configured. Reset it and retry");
+    } else if (!options_size)
+        GST_ERROR_OBJECT(src, "A mime-type is needed in %s", uri);
+    else {
+        mime_type = mime_type_and_options[0];
+        data = mime_type_and_options[options_size-1];
+
+        guchar* decoded_data = 0;
+        gsize decoded_size;
+
+        if (!g_str_has_prefix(data, "base64"))
+            GST_ERROR_OBJECT(src, "Data has to be base64-encoded in %s", uri);
+        else {
+            decoded_data = g_base64_decode(data+7, &decoded_size);
+            GInputStream* stream = g_memory_input_stream_new_from_data(decoded_data,
+                                                                       decoded_size,
+                                                                       g_free);
+            g_object_set(src->kid, "stream", stream, NULL);
+            g_object_unref(stream);
+
+            if (src->uri) {
+                g_free(src->uri);
+                src->uri = 0;
+            }
+
+            src->uri = g_strdup(uri);
+            ret = TRUE;
+        }
+    }
+
+    g_strfreev(scheme_and_remains);
+    g_strfreev(mime_type_and_options);
+    return ret;
+}
+
+static void webkit_data_src_uri_handler_init(gpointer g_iface, gpointer iface_data)
+{
+    GstURIHandlerInterface* iface = (GstURIHandlerInterface *) g_iface;
+
+    iface->get_type = webkit_data_src_uri_get_type;
+    iface->get_protocols = webkit_data_src_uri_get_protocols;
+    iface->get_uri = webkit_data_src_uri_get_uri;
+    iface->set_uri = webkit_data_src_uri_set_uri;
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/DataSourceGStreamer.h b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/DataSourceGStreamer.h
new file mode 100644
index 0000000000..3e88f637b5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/DataSourceGStreamer.h
@@ -0,0 +1,54 @@
+/*
+ *  Copyright (C) 2009 Igalia S.L
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef DATA_SOURCE_GSTREAMER_H
+#define DATA_SOURCE_GSTREAMER_H
+
+#include <glib-object.h>
+#include <gst/base/gstbasesrc.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_DATA_SRC            (webkit_data_src_get_type ())
+#define WEBKIT_DATA_SRC(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), WEBKIT_TYPE_DATA_SRC, WebkitDataSrc))
+#define WEBKIT_DATA_SRC_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_DATA_SRC, WebkitDataSrcClass))
+#define WEBKIT_IS_DATA_SRC(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), WEBKIT_TYPE_DATA_SRC))
+#define WEBKIT_IS_DATA_SRC_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), WEBKIT_TYPE_DATA_SRC))
+
+typedef struct _WebkitDataSrc        WebkitDataSrc;
+typedef struct _WebkitDataSrcClass   WebkitDataSrcClass;
+
+
+struct _WebkitDataSrc {
+    GstBin parent;
+
+    /* explicit pointers to stuff used */
+    GstElement* kid;
+    GstPad* pad;
+    gchar* uri;
+};
+
+struct _WebkitDataSrcClass {
+    GstBinClass parent_class;
+};
+
+GType webkit_data_src_get_type(void);
+
+G_END_DECLS
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/GOwnPtrGStreamer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/GOwnPtrGStreamer.cpp
new file mode 100644
index 0000000000..1d14b5a833
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/GOwnPtrGStreamer.cpp
@@ -0,0 +1,35 @@
+/*
+ *  Copyright (C) 2010 Igalia S.L
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+
+#include "config.h"
+#include "GOwnPtrGStreamer.h"
+
+#if ENABLE(VIDEO)
+#include <gst/gstelement.h>
+
+namespace WTF {
+
+template <> void freeOwnedGPtr<GstElement>(GstElement* ptr)
+{
+    if (ptr)
+        gst_object_unref(ptr);
+}
+#endif
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/GOwnPtrGStreamer.h b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/GOwnPtrGStreamer.h
new file mode 100644
index 0000000000..6655f38ee7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/GOwnPtrGStreamer.h
@@ -0,0 +1,33 @@
+/*
+ *  Copyright (C) 2010 Igalia S.L
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef GOwnPtrGStreamer_h
+#define GOwnPtrGStreamer_h
+
+#include "GOwnPtr.h"
+
+typedef struct _GstElement GstElement;
+
+namespace WTF {
+
+template<> void freeOwnedGPtr<GstElement>(GstElement* ptr);
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/ImageGStreamer.h b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/ImageGStreamer.h
new file mode 100644
index 0000000000..2e97b4df65
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/ImageGStreamer.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2010 Igalia S.L
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef ImageGStreamer_h
+#define ImageGStreamer_h
+
+#if ENABLE(VIDEO)
+
+#include "BitmapImage.h"
+
+#include <gst/gst.h>
+#include <gst/video/video.h>
+#include <wtf/PassRefPtr.h>
+
+#if PLATFORM(CAIRO)
+#include <cairo.h>
+#endif
+
+namespace WebCore {
+class IntSize;
+
+class ImageGStreamer : public RefCounted<ImageGStreamer> {
+    public:
+        static PassRefPtr<ImageGStreamer> createImage(GstBuffer*);
+        ~ImageGStreamer();
+
+        PassRefPtr<BitmapImage> image()
+        {
+            ASSERT(m_image);
+            return m_image.get();
+        }
+
+    private:
+        RefPtr<BitmapImage> m_image;
+
+#if PLATFORM(CAIRO)
+        ImageGStreamer(GstBuffer*&, IntSize, cairo_format_t&);
+        cairo_surface_t* m_surface;
+#endif
+
+    };
+}
+
+#endif
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/ImageGStreamerCairo.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/ImageGStreamerCairo.cpp
new file mode 100644
index 0000000000..6f975a4c5f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/ImageGStreamerCairo.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2010 Igalia S.L
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#include "GOwnPtr.h"
+#include "ImageGStreamer.h"
+
+using namespace std;
+
+using namespace WebCore;
+
+PassRefPtr<ImageGStreamer> ImageGStreamer::createImage(GstBuffer* buffer)
+{
+    int width = 0, height = 0;
+    GstCaps* caps = gst_buffer_get_caps(buffer);
+    GstVideoFormat format;
+    if (!gst_video_format_parse_caps(caps, &format, &width, &height)) {
+        gst_caps_unref(caps);
+        return 0;
+    }
+
+    gst_caps_unref(caps);
+
+    cairo_format_t cairoFormat;
+    if (format == GST_VIDEO_FORMAT_ARGB || format == GST_VIDEO_FORMAT_BGRA)
+        cairoFormat = CAIRO_FORMAT_ARGB32;
+    else
+        cairoFormat = CAIRO_FORMAT_RGB24;
+
+    return adoptRef(new ImageGStreamer(buffer, IntSize(width, height), cairoFormat));
+}
+
+ImageGStreamer::ImageGStreamer(GstBuffer*& buffer, IntSize size, cairo_format_t& cairoFormat)
+    : m_image(0)
+    , m_surface(0)
+{
+    m_surface = cairo_image_surface_create_for_data(GST_BUFFER_DATA(buffer), cairoFormat,
+                                                    size.width(), size.height(),
+                                                    cairo_format_stride_for_width(cairoFormat, size.width()));
+    ASSERT(cairo_surface_status(m_surface) == CAIRO_STATUS_SUCCESS);
+    m_image = BitmapImage::create(m_surface);
+}
+
+ImageGStreamer::~ImageGStreamer()
+{
+    if (m_image)
+        m_image.clear();
+
+    m_image = 0;
+
+    if (m_surface && cairo_surface_get_reference_count(m_surface))
+        cairo_surface_destroy(m_surface);
+
+    m_surface = 0;
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
new file mode 100644
index 0000000000..ed66fdaa8d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -0,0 +1,1404 @@
+/*
+ * Copyright (C) 2007, 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007 Collabora Ltd.  All rights reserved.
+ * Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ * Copyright (C) 2009 Gustavo Noronha Silva <gns@gnome.org>
+ * Copyright (C) 2009, 2010 Igalia S.L
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * aint with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(VIDEO)
+
+#include "MediaPlayerPrivateGStreamer.h"
+
+
+#include "ColorSpace.h"
+#include "CString.h"
+#include "DataSourceGStreamer.h"
+#include "Document.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "GOwnPtrGStreamer.h"
+#include "GraphicsContext.h"
+#include "GraphicsTypes.h"
+#include "ImageGStreamer.h"
+#include "IntRect.h"
+#include "KURL.h"
+#include "MIMETypeRegistry.h"
+#include "MediaPlayer.h"
+#include "NotImplemented.h"
+#include "ScrollView.h"
+#include "SecurityOrigin.h"
+#include "TimeRanges.h"
+#include "VideoSinkGStreamer.h"
+#include "WebKitWebSourceGStreamer.h"
+#include "Widget.h"
+
+#include <GOwnPtr.h>
+#include <gst/gst.h>
+#include <gst/interfaces/mixer.h>
+#include <gst/interfaces/xoverlay.h>
+#include <gst/video/video.h>
+#include <limits>
+#include <math.h>
+
+// GstPlayFlags flags from playbin2. It is the policy of GStreamer to
+// not publicly expose element-specific enums. That's why this
+// GstPlayFlags enum has been copied here.
+typedef enum {
+    GST_PLAY_FLAG_VIDEO         = 0x00000001,
+    GST_PLAY_FLAG_AUDIO         = 0x00000002,
+    GST_PLAY_FLAG_TEXT          = 0x00000004,
+    GST_PLAY_FLAG_VIS           = 0x00000008,
+    GST_PLAY_FLAG_SOFT_VOLUME   = 0x00000010,
+    GST_PLAY_FLAG_NATIVE_AUDIO  = 0x00000020,
+    GST_PLAY_FLAG_NATIVE_VIDEO  = 0x00000040,
+    GST_PLAY_FLAG_DOWNLOAD      = 0x00000080,
+    GST_PLAY_FLAG_BUFFERING     = 0x000000100
+} GstPlayFlags;
+
+using namespace std;
+
+namespace WebCore {
+
+static int greatestCommonDivisor(int a, int b)
+{
+    while (b) {
+        int temp = a;
+        a = b;
+        b = temp % b;
+    }
+
+    return ABS(a);
+}
+
+gboolean mediaPlayerPrivateMessageCallback(GstBus* bus, GstMessage* message, gpointer data)
+{
+    GOwnPtr<GError> err;
+    GOwnPtr<gchar> debug;
+    MediaPlayer::NetworkState error;
+    MediaPlayerPrivate* mp = reinterpret_cast<MediaPlayerPrivate*>(data);
+    bool issueError = true;
+    bool attemptNextLocation = false;
+    GstElement* pipeline = mp->pipeline();
+
+    if (message->structure) {
+        const gchar* messageTypeName = gst_structure_get_name(message->structure);
+
+        // Redirect messages are sent from elements, like qtdemux, to
+        // notify of the new location(s) of the media.
+        if (!g_strcmp0(messageTypeName, "redirect")) {
+            mp->mediaLocationChanged(message);
+            return true;
+        }
+    }
+
+    switch (GST_MESSAGE_TYPE(message)) {
+    case GST_MESSAGE_ERROR:
+        if (mp && mp->pipelineReset())
+            break;
+        gst_message_parse_error(message, &err.outPtr(), &debug.outPtr());
+        LOG_VERBOSE(Media, "Error: %d, %s", err->code,  err->message);
+
+        error = MediaPlayer::Empty;
+        if (err->code == GST_STREAM_ERROR_CODEC_NOT_FOUND
+            || err->code == GST_STREAM_ERROR_WRONG_TYPE
+            || err->code == GST_STREAM_ERROR_FAILED
+            || err->code == GST_CORE_ERROR_MISSING_PLUGIN
+            || err->code == GST_RESOURCE_ERROR_NOT_FOUND)
+            error = MediaPlayer::FormatError;
+        else if (err->domain == GST_STREAM_ERROR) {
+            error = MediaPlayer::DecodeError;
+            attemptNextLocation = true;
+        } else if (err->domain == GST_RESOURCE_ERROR)
+            error = MediaPlayer::NetworkError;
+
+        if (mp) {
+            if (attemptNextLocation)
+                issueError = !mp->loadNextLocation();
+            if (issueError)
+                mp->loadingFailed(error);
+        }
+        break;
+    case GST_MESSAGE_EOS:
+        LOG_VERBOSE(Media, "End of Stream");
+        mp->didEnd();
+        break;
+    case GST_MESSAGE_STATE_CHANGED:
+        // Ignore state changes from internal elements. They are
+        // forwarded to playbin2 anyway.
+        if (GST_MESSAGE_SRC(message) == reinterpret_cast<GstObject*>(pipeline))
+            mp->updateStates();
+        break;
+    case GST_MESSAGE_BUFFERING:
+        mp->processBufferingStats(message);
+        break;
+    case GST_MESSAGE_DURATION:
+        LOG_VERBOSE(Media, "Duration changed");
+        mp->durationChanged();
+        break;
+    default:
+        LOG_VERBOSE(Media, "Unhandled GStreamer message type: %s",
+                    GST_MESSAGE_TYPE_NAME(message));
+        break;
+    }
+    return true;
+}
+
+void mediaPlayerPrivateSourceChangedCallback(GObject *object, GParamSpec *pspec, gpointer data)
+{
+    MediaPlayerPrivate* mp = reinterpret_cast<MediaPlayerPrivate*>(data);
+    GOwnPtr<GstElement> element;
+
+    g_object_get(mp->m_playBin, "source", &element.outPtr(), NULL);
+    gst_object_replace((GstObject**) &mp->m_source, (GstObject*) element.get());
+
+    if (WEBKIT_IS_WEB_SRC(element.get())) {
+        Frame* frame = mp->m_player->frameView() ? mp->m_player->frameView()->frame() : 0;
+
+        if (frame)
+            webKitWebSrcSetFrame(WEBKIT_WEB_SRC(element.get()), frame);
+    }
+}
+
+void mediaPlayerPrivateVolumeChangedCallback(GObject *element, GParamSpec *pspec, gpointer data)
+{
+    // This is called when playbin receives the notify::volume signal.
+    MediaPlayerPrivate* mp = reinterpret_cast<MediaPlayerPrivate*>(data);
+    mp->volumeChanged();
+}
+
+void mediaPlayerPrivateMuteChangedCallback(GObject *element, GParamSpec *pspec, gpointer data)
+{
+    // This is called when playbin receives the notify::mute signal.
+    MediaPlayerPrivate* mp = reinterpret_cast<MediaPlayerPrivate*>(data);
+    mp->muteChanged();
+}
+
+static float playbackPosition(GstElement* playbin)
+{
+
+    float ret = 0.0;
+
+    GstQuery* query = gst_query_new_position(GST_FORMAT_TIME);
+    if (!gst_element_query(playbin, query)) {
+        LOG_VERBOSE(Media, "Position query failed...");
+        gst_query_unref(query);
+        return ret;
+    }
+
+    gint64 position;
+    gst_query_parse_position(query, 0, &position);
+
+    // Position is available only if the pipeline is not in GST_STATE_NULL or
+    // GST_STATE_READY state.
+    if (position !=  static_cast<gint64>(GST_CLOCK_TIME_NONE))
+        ret = static_cast<float>(position) / static_cast<float>(GST_SECOND);
+
+    LOG_VERBOSE(Media, "Position %" GST_TIME_FORMAT, GST_TIME_ARGS(position));
+
+    gst_query_unref(query);
+
+    return ret;
+}
+
+
+void mediaPlayerPrivateRepaintCallback(WebKitVideoSink*, GstBuffer *buffer, MediaPlayerPrivate* playerPrivate)
+{
+    g_return_if_fail(GST_IS_BUFFER(buffer));
+    gst_buffer_replace(&playerPrivate->m_buffer, buffer);
+    playerPrivate->repaint();
+}
+
+MediaPlayerPrivateInterface* MediaPlayerPrivate::create(MediaPlayer* player)
+{
+    return new MediaPlayerPrivate(player);
+}
+
+void MediaPlayerPrivate::registerMediaEngine(MediaEngineRegistrar registrar)
+{
+    if (isAvailable())
+        registrar(create, getSupportedTypes, supportsType);
+}
+
+static bool gstInitialized = false;
+
+static bool doGstInit()
+{
+    // FIXME: We should pass the arguments from the command line
+    if (!gstInitialized) {
+        GOwnPtr<GError> error;
+        gstInitialized = gst_init_check(0, 0, &error.outPtr());
+        if (!gstInitialized) {
+            LOG_VERBOSE(Media, "Could not initialize GStreamer: %s",
+                        error ? error->message : "unknown error occurred");
+        } else {
+            gst_element_register(0, "webkitmediasrc", GST_RANK_PRIMARY,
+                                 WEBKIT_TYPE_DATA_SRC);
+            gst_element_register(0, "webkitwebsrc", GST_RANK_PRIMARY + 100,
+                                 WEBKIT_TYPE_WEB_SRC);
+        }
+
+    }
+    return gstInitialized;
+}
+
+bool MediaPlayerPrivate::isAvailable()
+{
+    if (!doGstInit())
+        return false;
+
+    GstElementFactory* factory = gst_element_factory_find("playbin2");
+    if (factory) {
+        gst_object_unref(GST_OBJECT(factory));
+        return true;
+    }
+    return false;
+}
+
+MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
+    : m_player(player)
+    , m_playBin(0)
+    , m_videoSink(0)
+    , m_fpsSink(0)
+    , m_source(0)
+    , m_seekTime(0)
+    , m_changingRate(false)
+    , m_endTime(numeric_limits<float>::infinity())
+    , m_networkState(MediaPlayer::Empty)
+    , m_readyState(MediaPlayer::HaveNothing)
+    , m_isStreaming(false)
+    , m_size(IntSize())
+    , m_buffer(0)
+    , m_mediaLocations(0)
+    , m_mediaLocationCurrentIndex(0)
+    , m_resetPipeline(false)
+    , m_paused(true)
+    , m_seeking(false)
+    , m_buffering(false)
+    , m_playbackRate(1)
+    , m_errorOccured(false)
+    , m_mediaDuration(0)
+    , m_startedBuffering(false)
+    , m_fillTimer(this, &MediaPlayerPrivate::fillTimerFired)
+    , m_maxTimeLoaded(0)
+    , m_bufferingPercentage(0)
+    , m_preload(MediaPlayer::Auto)
+    , m_delayingLoad(false)
+    , m_mediaDurationKnown(true)
+{
+    if (doGstInit())
+        createGSTPlayBin();
+}
+
+MediaPlayerPrivate::~MediaPlayerPrivate()
+{
+    if (m_fillTimer.isActive())
+        m_fillTimer.stop();
+
+    if (m_buffer)
+        gst_buffer_unref(m_buffer);
+    m_buffer = 0;
+
+    if (m_mediaLocations) {
+        gst_structure_free(m_mediaLocations);
+        m_mediaLocations = 0;
+    }
+
+    if (m_source) {
+        gst_object_unref(m_source);
+        m_source = 0;
+    }
+
+    if (m_playBin) {
+        gst_element_set_state(m_playBin, GST_STATE_NULL);
+        gst_object_unref(GST_OBJECT(m_playBin));
+    }
+
+    if (m_videoSink) {
+        g_object_unref(m_videoSink);
+        m_videoSink = 0;
+    }
+
+    if (m_fpsSink) {
+        g_object_unref(m_fpsSink);
+        m_fpsSink = 0;
+    }
+}
+
+void MediaPlayerPrivate::load(const String& url)
+{
+    g_object_set(m_playBin, "uri", url.utf8().data(), NULL);
+
+    LOG_VERBOSE(Media, "Load %s", url.utf8().data());
+
+    if (m_preload == MediaPlayer::None) {
+        LOG_VERBOSE(Media, "Delaying load.");
+        m_delayingLoad = true;
+        return;
+    }
+
+    commitLoad();
+}
+
+void MediaPlayerPrivate::commitLoad()
+{
+    // GStreamer needs to have the pipeline set to a paused state to
+    // start providing anything useful.
+    gst_element_set_state(m_playBin, GST_STATE_PAUSED);
+
+    LOG_VERBOSE(Media, "Committing load.");
+    if (m_networkState != MediaPlayer::Loading) {
+        m_networkState = MediaPlayer::Loading;
+        m_player->networkStateChanged();
+    }
+    if (m_readyState != MediaPlayer::HaveNothing) {
+        m_readyState = MediaPlayer::HaveNothing;
+        m_player->readyStateChanged();
+    }
+}
+
+bool MediaPlayerPrivate::changePipelineState(GstState newState)
+{
+    ASSERT(newState == GST_STATE_PLAYING || newState == GST_STATE_PAUSED);
+
+    GstState currentState;
+    GstState pending;
+
+    gst_element_get_state(m_playBin, &currentState, &pending, 0);
+    if (currentState != newState && pending != newState) {
+        GstStateChangeReturn ret = gst_element_set_state(m_playBin, newState);
+        GstState pausedOrPlaying = newState == GST_STATE_PLAYING ? GST_STATE_PAUSED : GST_STATE_PLAYING;
+        if (currentState != pausedOrPlaying && ret == GST_STATE_CHANGE_FAILURE) {
+            loadingFailed(MediaPlayer::Empty);
+            return false;
+        }
+    }
+    return true;
+}
+
+void MediaPlayerPrivate::prepareToPlay()
+{
+    if (m_delayingLoad) {
+        m_delayingLoad = false;
+        commitLoad();
+    }
+}
+
+void MediaPlayerPrivate::play()
+{
+    if (changePipelineState(GST_STATE_PLAYING))
+        LOG_VERBOSE(Media, "Play");
+}
+
+void MediaPlayerPrivate::pause()
+{
+    if (changePipelineState(GST_STATE_PAUSED))
+        LOG_VERBOSE(Media, "Pause");
+}
+
+float MediaPlayerPrivate::duration() const
+{
+    if (!m_playBin)
+        return 0.0;
+
+    if (m_errorOccured)
+        return 0.0;
+
+    // Media duration query failed already, don't attempt new useless queries.
+    if (!m_mediaDurationKnown)
+        return numeric_limits<float>::infinity();
+
+    if (m_mediaDuration)
+        return m_mediaDuration;
+
+    GstFormat timeFormat = GST_FORMAT_TIME;
+    gint64 timeLength = 0;
+
+    if (!gst_element_query_duration(m_playBin, &timeFormat, &timeLength) || timeFormat != GST_FORMAT_TIME || static_cast<guint64>(timeLength) == GST_CLOCK_TIME_NONE) {
+        LOG_VERBOSE(Media, "Time duration query failed.");
+        return numeric_limits<float>::infinity();
+    }
+
+    LOG_VERBOSE(Media, "Duration: %" GST_TIME_FORMAT, GST_TIME_ARGS(timeLength));
+
+    return (float) ((guint64) timeLength / 1000000000.0);
+    // FIXME: handle 3.14.9.5 properly
+}
+
+float MediaPlayerPrivate::currentTime() const
+{
+    if (!m_playBin)
+        return 0;
+
+    if (m_errorOccured)
+        return 0;
+
+    if (m_seeking)
+        return m_seekTime;
+
+    return playbackPosition(m_playBin);
+
+}
+
+void MediaPlayerPrivate::seek(float time)
+{
+    // Avoid useless seeking.
+    if (time == playbackPosition(m_playBin))
+        return;
+
+    if (!m_playBin)
+        return;
+
+    if (m_errorOccured)
+        return;
+
+    GstClockTime sec = (GstClockTime)(time * GST_SECOND);
+    LOG_VERBOSE(Media, "Seek: %" GST_TIME_FORMAT, GST_TIME_ARGS(sec));
+    if (!gst_element_seek(m_playBin, m_player->rate(),
+            GST_FORMAT_TIME,
+            (GstSeekFlags)(GST_SEEK_FLAG_FLUSH),
+            GST_SEEK_TYPE_SET, sec,
+            GST_SEEK_TYPE_NONE, GST_CLOCK_TIME_NONE))
+        LOG_VERBOSE(Media, "Seek to %f failed", time);
+    else {
+        m_seeking = true;
+        m_seekTime = sec;
+    }
+}
+
+void MediaPlayerPrivate::startEndPointTimerIfNeeded()
+{
+    notImplemented();
+}
+
+void MediaPlayerPrivate::cancelSeek()
+{
+    notImplemented();
+}
+
+void MediaPlayerPrivate::endPointTimerFired(Timer<MediaPlayerPrivate>*)
+{
+    notImplemented();
+}
+
+bool MediaPlayerPrivate::paused() const
+{
+    return m_paused;
+}
+
+bool MediaPlayerPrivate::seeking() const
+{
+    return m_seeking;
+}
+
+// Returns the size of the video
+IntSize MediaPlayerPrivate::naturalSize() const
+{
+    if (!hasVideo())
+        return IntSize();
+
+    GstPad* pad = gst_element_get_static_pad(m_videoSink, "sink");
+    if (!pad)
+        return IntSize();
+
+    int width = 0, height = 0;
+    GstCaps* caps = GST_PAD_CAPS(pad);
+    int pixelAspectRatioNumerator, pixelAspectRatioDenominator;
+    int displayWidth, displayHeight, displayAspectRatioGCD;
+    int originalWidth = 0, originalHeight = 0;
+
+    // TODO: handle possible clean aperture data. See
+    // https://bugzilla.gnome.org/show_bug.cgi?id=596571
+    // TODO: handle possible transformation matrix. See
+    // https://bugzilla.gnome.org/show_bug.cgi?id=596326
+
+    // Get the video PAR and original size.
+    if (!GST_IS_CAPS(caps) || !gst_caps_is_fixed(caps)
+        || !gst_video_format_parse_caps(caps, 0, &originalWidth, &originalHeight)
+        || !gst_video_parse_caps_pixel_aspect_ratio(caps, &pixelAspectRatioNumerator,
+                                                    &pixelAspectRatioDenominator)) {
+        gst_object_unref(GST_OBJECT(pad));
+        return IntSize();
+    }
+
+    gst_object_unref(GST_OBJECT(pad));
+
+    LOG_VERBOSE(Media, "Original video size: %dx%d", originalWidth, originalHeight);
+    LOG_VERBOSE(Media, "Pixel aspect ratio: %d/%d", pixelAspectRatioNumerator, pixelAspectRatioDenominator);
+
+    // Calculate DAR based on PAR and video size.
+    displayWidth = originalWidth * pixelAspectRatioNumerator;
+    displayHeight = originalHeight * pixelAspectRatioDenominator;
+
+    // Divide display width and height by their GCD to avoid possible overflows.
+    displayAspectRatioGCD = greatestCommonDivisor(displayWidth, displayHeight);
+    displayWidth /= displayAspectRatioGCD;
+    displayHeight /= displayAspectRatioGCD;
+
+    // Apply DAR to original video size. This is the same behavior as in xvimagesink's setcaps function.
+    if (!(originalHeight % displayHeight)) {
+        LOG_VERBOSE(Media, "Keeping video original height");
+        width = gst_util_uint64_scale_int(originalHeight, displayWidth, displayHeight);
+        height = originalHeight;
+    } else if (!(originalWidth % displayWidth)) {
+        LOG_VERBOSE(Media, "Keeping video original width");
+        height = gst_util_uint64_scale_int(originalWidth, displayHeight, displayWidth);
+        width = originalWidth;
+    } else {
+        LOG_VERBOSE(Media, "Approximating while keeping original video height");
+        width = gst_util_uint64_scale_int(originalHeight, displayWidth, displayHeight);
+        height = originalHeight;
+    }
+
+    LOG_VERBOSE(Media, "Natural size: %dx%d", width, height);
+    return IntSize(width, height);
+}
+
+bool MediaPlayerPrivate::hasVideo() const
+{
+    gint currentVideo = -1;
+    if (m_playBin)
+        g_object_get(m_playBin, "current-video", &currentVideo, NULL);
+    return currentVideo > -1;
+}
+
+bool MediaPlayerPrivate::hasAudio() const
+{
+    gint currentAudio = -1;
+    if (m_playBin)
+        g_object_get(m_playBin, "current-audio", &currentAudio, NULL);
+    return currentAudio > -1;
+}
+
+void MediaPlayerPrivate::setVolume(float volume)
+{
+    if (!m_playBin)
+        return;
+
+    g_object_set(m_playBin, "volume", static_cast<double>(volume), NULL);
+}
+
+void MediaPlayerPrivate::volumeChangedTimerFired(Timer<MediaPlayerPrivate>*)
+{
+    double volume;
+    g_object_get(m_playBin, "volume", &volume, NULL);
+    m_player->volumeChanged(static_cast<float>(volume));
+}
+
+void MediaPlayerPrivate::volumeChanged()
+{
+    Timer<MediaPlayerPrivate> volumeChangedTimer(this, &MediaPlayerPrivate::volumeChangedTimerFired);
+    volumeChangedTimer.startOneShot(0);
+}
+
+void MediaPlayerPrivate::setRate(float rate)
+{
+    // Avoid useless playback rate update.
+    if (m_playbackRate == rate)
+        return;
+
+    GstState state;
+    GstState pending;
+
+    gst_element_get_state(m_playBin, &state, &pending, 0);
+    if ((state != GST_STATE_PLAYING && state != GST_STATE_PAUSED)
+        || (pending == GST_STATE_PAUSED))
+        return;
+
+    if (m_isStreaming)
+        return;
+
+    m_playbackRate = rate;
+    m_changingRate = true;
+    float currentPosition = playbackPosition(m_playBin) * GST_SECOND;
+    GstSeekFlags flags = (GstSeekFlags)(GST_SEEK_FLAG_FLUSH);
+    gint64 start, end;
+    bool mute = false;
+
+    LOG_VERBOSE(Media, "Set Rate to %f", rate);
+    if (rate >= 0) {
+        // Mute the sound if the playback rate is too extreme.
+        // TODO: in other cases we should perform pitch adjustments.
+        mute = (bool) (rate < 0.8 || rate > 2);
+        start = currentPosition;
+        end = GST_CLOCK_TIME_NONE;
+    } else {
+        start = 0;
+        mute = true;
+
+        // If we are at beginning of media, start from the end to
+        // avoid immediate EOS.
+        if (currentPosition <= 0)
+            end = duration() * GST_SECOND;
+        else
+            end = currentPosition;
+    }
+
+    LOG_VERBOSE(Media, "Need to mute audio: %d", (int) mute);
+
+    if (!gst_element_seek(m_playBin, rate, GST_FORMAT_TIME, flags,
+                          GST_SEEK_TYPE_SET, start,
+                          GST_SEEK_TYPE_SET, end))
+        LOG_VERBOSE(Media, "Set rate to %f failed", rate);
+    else
+        g_object_set(m_playBin, "mute", mute, NULL);
+}
+
+MediaPlayer::NetworkState MediaPlayerPrivate::networkState() const
+{
+    return m_networkState;
+}
+
+MediaPlayer::ReadyState MediaPlayerPrivate::readyState() const
+{
+    return m_readyState;
+}
+
+PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
+{
+    RefPtr<TimeRanges> timeRanges = TimeRanges::create();
+    float loaded = maxTimeLoaded();
+    if (!m_errorOccured && !m_isStreaming && loaded > 0)
+        timeRanges->add(0, loaded);
+    return timeRanges.release();
+}
+
+void MediaPlayerPrivate::processBufferingStats(GstMessage* message)
+{
+    // This is the immediate buffering that needs to happen so we have
+    // enough to play right now.
+    m_buffering = true;
+    const GstStructure *structure = gst_message_get_structure(message);
+    gst_structure_get_int(structure, "buffer-percent", &m_bufferingPercentage);
+
+    LOG_VERBOSE(Media, "[Buffering] Buffering: %d%%.", m_bufferingPercentage);
+
+    GstBufferingMode mode;
+    gst_message_parse_buffering_stats(message, &mode, 0, 0, 0);
+    if (mode != GST_BUFFERING_DOWNLOAD) {
+        updateStates();
+        return;
+    }
+
+    // This is on-disk buffering, that allows us to download much more
+    // than needed for right now.
+    if (!m_startedBuffering) {
+        LOG_VERBOSE(Media, "[Buffering] Starting on-disk buffering.");
+
+        m_startedBuffering = true;
+
+        if (m_fillTimer.isActive())
+            m_fillTimer.stop();
+
+        m_fillTimer.startRepeating(0.2);
+    }
+}
+
+void MediaPlayerPrivate::fillTimerFired(Timer<MediaPlayerPrivate>*)
+{
+    GstQuery* query = gst_query_new_buffering(GST_FORMAT_PERCENT);
+
+    if (!gst_element_query(m_playBin, query)) {
+        gst_query_unref(query);
+        return;
+    }
+
+    gint64 start, stop;
+    gdouble fillStatus = 100.0;
+
+    gst_query_parse_buffering_range(query, 0, &start, &stop, 0);
+    gst_query_unref(query);
+
+    if (stop != -1)
+        fillStatus = 100.0 * stop / GST_FORMAT_PERCENT_MAX;
+
+    LOG_VERBOSE(Media, "[Buffering] Download buffer filled up to %f%%", fillStatus);
+
+    if (!m_mediaDuration)
+        durationChanged();
+
+    // Update maxTimeLoaded only if the media duration is
+    // available. Otherwise we can't compute it.
+    if (m_mediaDuration) {
+        m_maxTimeLoaded = static_cast<float>((fillStatus * m_mediaDuration) / 100.0);
+        LOG_VERBOSE(Media, "[Buffering] Updated maxTimeLoaded: %f", m_maxTimeLoaded);
+    }
+
+    if (fillStatus != 100.0) {
+        updateStates();
+        return;
+    }
+
+    // Media is now fully loaded. It will play even if network
+    // connection is cut. Buffering is done, remove the fill source
+    // from the main loop.
+    m_fillTimer.stop();
+    m_startedBuffering = false;
+    updateStates();
+}
+
+float MediaPlayerPrivate::maxTimeSeekable() const
+{
+    if (m_errorOccured)
+        return 0.0;
+
+    LOG_VERBOSE(Media, "maxTimeSeekable");
+    // infinite duration means live stream
+    if (isinf(duration()))
+        return 0.0;
+
+    return maxTimeLoaded();
+}
+
+float MediaPlayerPrivate::maxTimeLoaded() const
+{
+    if (m_errorOccured)
+        return 0.0;
+
+    float loaded = m_maxTimeLoaded;
+    if (!loaded && !m_fillTimer.isActive())
+        loaded = duration();
+    LOG_VERBOSE(Media, "maxTimeLoaded: %f", loaded);
+    return loaded;
+}
+
+unsigned MediaPlayerPrivate::bytesLoaded() const
+{
+    if (!m_playBin)
+        return 0;
+
+    if (!m_mediaDuration)
+        return 0;
+
+    unsigned loaded = totalBytes() * maxTimeLoaded() / m_mediaDuration;
+    LOG_VERBOSE(Media, "bytesLoaded: %d", loaded);
+    return loaded;
+}
+
+unsigned MediaPlayerPrivate::totalBytes() const
+{
+    if (!m_source)
+        return 0;
+
+    if (m_errorOccured)
+        return 0;
+
+    GstFormat fmt = GST_FORMAT_BYTES;
+    gint64 length = 0;
+    gst_element_query_duration(m_source, &fmt, &length);
+    LOG_VERBOSE(Media, "totalBytes %" G_GINT64_FORMAT, length);
+
+    return length;
+}
+
+void MediaPlayerPrivate::cancelLoad()
+{
+    if (m_networkState < MediaPlayer::Loading || m_networkState == MediaPlayer::Loaded)
+        return;
+
+    if (m_playBin)
+        gst_element_set_state(m_playBin, GST_STATE_NULL);
+}
+
+void MediaPlayerPrivate::updateStates()
+{
+    if (!m_playBin)
+        return;
+
+    if (m_errorOccured)
+        return;
+
+    MediaPlayer::NetworkState oldNetworkState = m_networkState;
+    MediaPlayer::ReadyState oldReadyState = m_readyState;
+    GstState state;
+    GstState pending;
+
+    GstStateChangeReturn ret = gst_element_get_state(m_playBin,
+        &state, &pending, 250 * GST_NSECOND);
+
+    bool shouldUpdateAfterSeek = false;
+    switch (ret) {
+    case GST_STATE_CHANGE_SUCCESS:
+        LOG_VERBOSE(Media, "State: %s, pending: %s",
+            gst_element_state_get_name(state),
+            gst_element_state_get_name(pending));
+
+        m_resetPipeline = state <= GST_STATE_READY;
+
+        // Try to figure out ready and network states.
+        if (state == GST_STATE_READY) {
+            m_readyState = MediaPlayer::HaveNothing;
+            m_networkState = MediaPlayer::Empty;
+        } else if (maxTimeLoaded() == duration()) {
+            m_networkState = MediaPlayer::Loaded;
+            m_readyState = MediaPlayer::HaveEnoughData;
+        } else {
+            m_readyState = currentTime() < maxTimeLoaded() ? MediaPlayer::HaveFutureData : MediaPlayer::HaveCurrentData;
+            m_networkState = MediaPlayer::Loading;
+        }
+
+        if (m_buffering && state != GST_STATE_READY) {
+            m_readyState = MediaPlayer::HaveCurrentData;
+            m_networkState = MediaPlayer::Loading;
+        }
+
+        // Now let's try to get the states in more detail using
+        // information from GStreamer, while we sync states where
+        // needed.
+        if (state == GST_STATE_PAUSED) {
+            if (m_buffering && m_bufferingPercentage == 100) {
+                m_buffering = false;
+                m_bufferingPercentage = 0;
+                m_readyState = MediaPlayer::HaveEnoughData;
+
+                LOG_VERBOSE(Media, "[Buffering] Complete.");
+
+                if (!m_paused) {
+                    LOG_VERBOSE(Media, "[Buffering] Restarting playback.");
+                    gst_element_set_state(m_playBin, GST_STATE_PLAYING);
+                }
+            } else if (!m_buffering && (currentTime() < duration())) {
+                m_paused = true;
+            }
+        } else if (state == GST_STATE_PLAYING) {
+            m_readyState = MediaPlayer::HaveEnoughData;
+            m_paused = false;
+
+            if (!m_mediaDuration) {
+                float newDuration = duration();
+                m_mediaDurationKnown = !isinf(newDuration);
+                if (m_mediaDurationKnown)
+                    m_mediaDuration = newDuration;
+            }
+
+            if (m_buffering) {
+                m_readyState = MediaPlayer::HaveCurrentData;
+                m_networkState = MediaPlayer::Loading;
+
+                LOG_VERBOSE(Media, "[Buffering] Pausing stream for buffering.");
+
+                gst_element_set_state(m_playBin, GST_STATE_PAUSED);
+            }
+        } else
+            m_paused = true;
+
+        // Is on-disk buffering in progress?
+        if (m_fillTimer.isActive())
+            m_networkState = MediaPlayer::Loading;
+
+        if (m_changingRate) {
+            m_player->rateChanged();
+            m_changingRate = false;
+        }
+
+        if (m_seeking) {
+            shouldUpdateAfterSeek = true;
+            m_seeking = false;
+        }
+
+        break;
+    case GST_STATE_CHANGE_ASYNC:
+        LOG_VERBOSE(Media, "Async: State: %s, pending: %s",
+            gst_element_state_get_name(state),
+            gst_element_state_get_name(pending));
+        // Change in progress
+
+        if (!m_isStreaming)
+            return;
+
+        // Resume playback if a seek was performed in a live pipeline.
+        if (m_seeking) {
+            shouldUpdateAfterSeek = true;
+            m_seeking = false;
+            if (m_paused)
+                gst_element_set_state(m_playBin, GST_STATE_PLAYING);
+        }
+        break;
+    case GST_STATE_CHANGE_FAILURE:
+        LOG_VERBOSE(Media, "Failure: State: %s, pending: %s",
+            gst_element_state_get_name(state),
+            gst_element_state_get_name(pending));
+        // Change failed
+        return;
+    case GST_STATE_CHANGE_NO_PREROLL:
+        LOG_VERBOSE(Media, "No preroll: State: %s, pending: %s",
+            gst_element_state_get_name(state),
+            gst_element_state_get_name(pending));
+
+        if (state == GST_STATE_READY)
+            m_readyState = MediaPlayer::HaveNothing;
+        else if (state == GST_STATE_PAUSED) {
+            m_readyState = MediaPlayer::HaveEnoughData;
+            m_paused = true;
+            // Live pipelines go in PAUSED without prerolling.
+            m_isStreaming = true;
+        } else if (state == GST_STATE_PLAYING)
+            m_paused = false;
+
+        if (m_seeking) {
+            shouldUpdateAfterSeek = true;
+            m_seeking = false;
+            if (!m_paused)
+                gst_element_set_state(m_playBin, GST_STATE_PLAYING);
+        } else if (!m_paused)
+            gst_element_set_state(m_playBin, GST_STATE_PLAYING);
+
+        m_networkState = MediaPlayer::Loading;
+        break;
+    default:
+        LOG_VERBOSE(Media, "Else : %d", ret);
+        break;
+    }
+
+    if (seeking())
+        m_readyState = MediaPlayer::HaveNothing;
+
+    if (shouldUpdateAfterSeek)
+        timeChanged();
+
+    if (m_networkState != oldNetworkState) {
+        LOG_VERBOSE(Media, "Network State Changed from %u to %u",
+            oldNetworkState, m_networkState);
+        m_player->networkStateChanged();
+    }
+    if (m_readyState != oldReadyState) {
+        LOG_VERBOSE(Media, "Ready State Changed from %u to %u",
+            oldReadyState, m_readyState);
+        m_player->readyStateChanged();
+    }
+}
+
+void MediaPlayerPrivate::mediaLocationChanged(GstMessage* message)
+{
+    if (m_mediaLocations)
+        gst_structure_free(m_mediaLocations);
+
+    if (message->structure) {
+        // This structure can contain:
+        // - both a new-location string and embedded locations structure
+        // - or only a new-location string.
+        m_mediaLocations = gst_structure_copy(message->structure);
+        const GValue* locations = gst_structure_get_value(m_mediaLocations, "locations");
+
+        if (locations)
+            m_mediaLocationCurrentIndex = static_cast<int>(gst_value_list_get_size(locations)) -1;
+
+        loadNextLocation();
+    }
+}
+
+bool MediaPlayerPrivate::loadNextLocation()
+{
+    if (!m_mediaLocations)
+        return false;
+
+    const GValue* locations = gst_structure_get_value(m_mediaLocations, "locations");
+    const gchar* newLocation = 0;
+
+    if (!locations) {
+        // Fallback on new-location string.
+        newLocation = gst_structure_get_string(m_mediaLocations, "new-location");
+        if (!newLocation)
+            return false;
+    }
+
+    if (!newLocation) {
+        if (m_mediaLocationCurrentIndex < 0) {
+            m_mediaLocations = 0;
+            return false;
+        }
+
+        const GValue* location = gst_value_list_get_value(locations,
+                                                          m_mediaLocationCurrentIndex);
+        const GstStructure* structure = gst_value_get_structure(location);
+
+        if (!structure) {
+            m_mediaLocationCurrentIndex--;
+            return false;
+        }
+
+        newLocation = gst_structure_get_string(structure, "new-location");
+    }
+
+    if (newLocation) {
+        // Found a candidate. new-location is not always an absolute url
+        // though. We need to take the base of the current url and
+        // append the value of new-location to it.
+
+        gchar* currentLocation = 0;
+        g_object_get(m_playBin, "uri", &currentLocation, NULL);
+
+        KURL currentUrl(KURL(), currentLocation);
+        g_free(currentLocation);
+
+        KURL newUrl;
+
+        if (gst_uri_is_valid(newLocation))
+            newUrl = KURL(KURL(), newLocation);
+        else
+            newUrl = KURL(KURL(), currentUrl.baseAsString() + newLocation);
+
+        RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::create(currentUrl);
+        if (securityOrigin->canRequest(newUrl)) {
+            LOG_VERBOSE(Media, "New media url: %s", newUrl.string().utf8().data());
+
+            // Reset player states.
+            m_networkState = MediaPlayer::Loading;
+            m_player->networkStateChanged();
+            m_readyState = MediaPlayer::HaveNothing;
+            m_player->readyStateChanged();
+
+            // Reset pipeline state.
+            m_resetPipeline = true;
+            gst_element_set_state(m_playBin, GST_STATE_READY);
+
+            GstState state;
+            gst_element_get_state(m_playBin, &state, 0, 0);
+            if (state <= GST_STATE_READY) {
+                // Set the new uri and start playing.
+                g_object_set(m_playBin, "uri", newUrl.string().utf8().data(), NULL);
+                gst_element_set_state(m_playBin, GST_STATE_PLAYING);
+                return true;
+            }
+        }
+    }
+    m_mediaLocationCurrentIndex--;
+    return false;
+
+}
+
+void MediaPlayerPrivate::loadStateChanged()
+{
+    updateStates();
+}
+
+void MediaPlayerPrivate::sizeChanged()
+{
+    notImplemented();
+}
+
+void MediaPlayerPrivate::timeChanged()
+{
+    updateStates();
+    m_player->timeChanged();
+}
+
+void MediaPlayerPrivate::didEnd()
+{
+    // EOS was reached but in case of reverse playback the position is
+    // not always 0. So to not confuse the HTMLMediaElement we
+    // synchronize position and duration values.
+    float now = currentTime();
+    if (now > 0) {
+        m_mediaDuration = now;
+        m_player->durationChanged();
+    }
+
+    gst_element_set_state(m_playBin, GST_STATE_PAUSED);
+
+    timeChanged();
+}
+
+void MediaPlayerPrivate::durationChanged()
+{
+    // Reset cached media duration
+    m_mediaDuration = 0;
+
+    // And re-cache it if possible.
+    GstState state;
+    gst_element_get_state(m_playBin, &state, 0, 0);
+    float newDuration = duration();
+
+    if (state <= GST_STATE_READY) {
+        // Don't set m_mediaDurationKnown yet if the pipeline is not
+        // paused. This allows duration() query to fail at least once
+        // before playback starts and duration becomes known.
+        if (!isinf(newDuration))
+            m_mediaDuration = newDuration;
+    } else {
+        m_mediaDurationKnown = !isinf(newDuration);
+        if (m_mediaDurationKnown)
+            m_mediaDuration = newDuration;
+    }
+
+    if (!isinf(newDuration))
+        m_mediaDuration = newDuration;
+
+    m_player->durationChanged();
+}
+
+bool MediaPlayerPrivate::supportsMuting() const
+{
+    return true;
+}
+
+void MediaPlayerPrivate::setMuted(bool muted)
+{
+    if (!m_playBin)
+        return;
+
+    g_object_set(m_playBin, "mute", muted, NULL);
+}
+
+void MediaPlayerPrivate::muteChangedTimerFired(Timer<MediaPlayerPrivate>*)
+{
+    gboolean muted;
+    g_object_get(m_playBin, "mute", &muted, NULL);
+    m_player->muteChanged(static_cast<bool>(muted));
+}
+
+void MediaPlayerPrivate::muteChanged()
+{
+    Timer<MediaPlayerPrivate> muteChangedTimer(this, &MediaPlayerPrivate::muteChangedTimerFired);
+    muteChangedTimer.startOneShot(0);
+}
+
+void MediaPlayerPrivate::loadingFailed(MediaPlayer::NetworkState error)
+{
+    m_errorOccured = true;
+    if (m_networkState != error) {
+        m_networkState = error;
+        m_player->networkStateChanged();
+    }
+    if (m_readyState != MediaPlayer::HaveNothing) {
+        m_readyState = MediaPlayer::HaveNothing;
+        m_player->readyStateChanged();
+    }
+}
+
+void MediaPlayerPrivate::setSize(const IntSize& size)
+{
+    m_size = size;
+}
+
+void MediaPlayerPrivate::setVisible(bool visible)
+{
+}
+
+void MediaPlayerPrivate::repaint()
+{
+    m_player->repaint();
+}
+
+void MediaPlayerPrivate::paint(GraphicsContext* context, const IntRect& rect)
+{
+    if (context->paintingDisabled())
+        return;
+
+    if (!m_player->visible())
+        return;
+    if (!m_buffer)
+        return;
+
+    RefPtr<ImageGStreamer> gstImage = ImageGStreamer::createImage(m_buffer);
+    if (!gstImage)
+        return;
+
+    context->drawImage(reinterpret_cast<Image*>(gstImage->image().get()), sRGBColorSpace,
+                       rect, CompositeCopy, false);
+}
+
+static HashSet<String> mimeTypeCache()
+{
+
+    doGstInit();
+
+    static HashSet<String> cache;
+    static bool typeListInitialized = false;
+
+    if (!typeListInitialized) {
+        // Build a whitelist of mime-types known to be supported by
+        // GStreamer.
+        HashSet<String> handledApplicationSubtypes;
+        handledApplicationSubtypes.add(String("ogg"));
+        handledApplicationSubtypes.add(String("x-3gp"));
+        handledApplicationSubtypes.add(String("vnd.rn-realmedia"));
+        handledApplicationSubtypes.add(String("x-pn-realaudio"));
+
+        GList* factories = gst_type_find_factory_get_list();
+        for (GList* iterator = factories; iterator; iterator = iterator->next) {
+            GstTypeFindFactory* factory = GST_TYPE_FIND_FACTORY(iterator->data);
+            GstCaps* caps = gst_type_find_factory_get_caps(factory);
+
+            if (!caps)
+                continue;
+
+            for (guint structureIndex = 0; structureIndex < gst_caps_get_size(caps); structureIndex++) {
+                GstStructure* structure = gst_caps_get_structure(caps, structureIndex);
+                const gchar* name = gst_structure_get_name(structure);
+                bool cached = false;
+
+                // These formats are supported by GStreamer, but not
+                // correctly advertised.
+                if (g_str_equal(name, "video/x-h264")
+                    || g_str_equal(name, "audio/x-m4a")) {
+                    cache.add(String("video/mp4"));
+                    cache.add(String("audio/aac"));
+                    cached = true;
+                }
+
+                if (g_str_equal(name, "video/x-theora")) {
+                    cache.add(String("video/ogg"));
+                    cached = true;
+                }
+
+                if (g_str_equal(name, "audio/x-vorbis")) {
+                    cache.add(String("audio/ogg"));
+                    cached = true;
+                }
+
+                if (g_str_equal(name, "audio/x-wav")) {
+                    cache.add(String("audio/wav"));
+                    cached = true;
+                }
+
+                if (g_str_equal(name, "audio/mpeg")) {
+                    cache.add(String(name));
+                    cached = true;
+
+                    // This is what we are handling:
+                    // mpegversion=(int)1, layer=(int)[ 1, 3 ]
+                    gint mpegVersion = 0;
+                    if (gst_structure_get_int(structure, "mpegversion", &mpegVersion) && (mpegVersion == 1)) {
+                        const GValue* layer = gst_structure_get_value(structure, "layer");
+                        if (G_VALUE_TYPE(layer) == GST_TYPE_INT_RANGE) {
+                            gint minLayer = gst_value_get_int_range_min(layer);
+                            gint maxLayer = gst_value_get_int_range_max(layer);
+                            if (minLayer <= 1 && 1 <= maxLayer)
+                                cache.add(String("audio/mp1"));
+                            if (minLayer <= 2 && 2 <= maxLayer)
+                                cache.add(String("audio/mp2"));
+                            if (minLayer <= 3 && 3 <= maxLayer)
+                                cache.add(String("audio/mp3"));
+                        }
+                    }
+                }
+
+                if (!cached) {
+                    // GStreamer plugins can be capable of supporting
+                    // types which WebKit supports by default. In that
+                    // case, we should not consider these types
+                    // supportable by GStreamer.  Examples of what
+                    // GStreamer can support but should not be added:
+                    // text/plain, text/html, image/jpeg,
+                    // application/xml
+                    gchar** mimetype = g_strsplit(name, "/", 2);
+                    if (g_str_equal(mimetype[0], "audio")
+                        || g_str_equal(mimetype[0], "video")
+                        || (g_str_equal(mimetype[0], "application")
+                            && handledApplicationSubtypes.contains(String(mimetype[1]))))
+                        cache.add(String(name));
+
+                    g_strfreev(mimetype);
+                }
+            }
+        }
+
+        gst_plugin_feature_list_free(factories);
+        typeListInitialized = true;
+    }
+
+    return cache;
+}
+
+void MediaPlayerPrivate::getSupportedTypes(HashSet<String>& types)
+{
+    types = mimeTypeCache();
+}
+
+MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String& type, const String& codecs)
+{
+    if (type.isNull() || type.isEmpty())
+        return MediaPlayer::IsNotSupported;
+
+    // spec says we should not return "probably" if the codecs string is empty
+    if (mimeTypeCache().contains(type))
+        return codecs.isEmpty() ? MediaPlayer::MayBeSupported : MediaPlayer::IsSupported;
+    return MediaPlayer::IsNotSupported;
+}
+
+bool MediaPlayerPrivate::hasSingleSecurityOrigin() const
+{
+    return true;
+}
+
+bool MediaPlayerPrivate::supportsFullscreen() const
+{
+    return true;
+}
+
+void MediaPlayerPrivate::setPreload(MediaPlayer::Preload preload)
+{
+    ASSERT(m_playBin);
+
+    m_preload = preload;
+
+    GstPlayFlags flags;
+    g_object_get(m_playBin, "flags", &flags, NULL);
+    if (preload == MediaPlayer::None)
+        g_object_set(m_playBin, "flags", flags & ~GST_PLAY_FLAG_DOWNLOAD, NULL);
+    else
+        g_object_set(m_playBin, "flags", flags | GST_PLAY_FLAG_DOWNLOAD, NULL);
+
+    if (m_delayingLoad && m_preload != MediaPlayer::None) {
+        m_delayingLoad = false;
+        commitLoad();
+    }
+}
+
+void MediaPlayerPrivate::createGSTPlayBin()
+{
+    ASSERT(!m_playBin);
+    m_playBin = gst_element_factory_make("playbin2", "play");
+
+    GstBus* bus = gst_pipeline_get_bus(GST_PIPELINE(m_playBin));
+    gst_bus_add_signal_watch(bus);
+    g_signal_connect(bus, "message", G_CALLBACK(mediaPlayerPrivateMessageCallback), this);
+    gst_object_unref(bus);
+
+    g_signal_connect(m_playBin, "notify::volume", G_CALLBACK(mediaPlayerPrivateVolumeChangedCallback), this);
+    g_signal_connect(m_playBin, "notify::source", G_CALLBACK(mediaPlayerPrivateSourceChangedCallback), this);
+    g_signal_connect(m_playBin, "notify::mute", G_CALLBACK(mediaPlayerPrivateMuteChangedCallback), this);
+
+    m_videoSink = webkit_video_sink_new();
+
+    g_object_ref_sink(m_videoSink);
+
+    WTFLogChannel* channel = getChannelFromName("Media");
+    if (channel->state == WTFLogChannelOn) {
+        m_fpsSink = gst_element_factory_make("fpsdisplaysink", "sink");
+        if (g_object_class_find_property(G_OBJECT_GET_CLASS(m_fpsSink), "video-sink")) {
+            g_object_set(m_fpsSink, "video-sink", m_videoSink, NULL);
+            g_object_ref_sink(m_fpsSink);
+            g_object_set(m_playBin, "video-sink", m_fpsSink, NULL);
+        } else {
+            m_fpsSink = 0;
+            g_object_set(m_playBin, "video-sink", m_videoSink, NULL);
+            LOG_VERBOSE(Media, "Can't display FPS statistics, you need gst-plugins-bad >= 0.10.18");
+        }
+    } else
+        g_object_set(m_playBin, "video-sink", m_videoSink, NULL);
+
+    g_signal_connect(m_videoSink, "repaint-requested", G_CALLBACK(mediaPlayerPrivateRepaintCallback), this);
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
new file mode 100644
index 0000000000..ab8ee01e9f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2007, 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007 Collabora Ltd. All rights reserved.
+ * Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ * Copyright (C) 2009, 2010 Igalia S.L
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * aint with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef MediaPlayerPrivateGStreamer_h
+#define MediaPlayerPrivateGStreamer_h
+
+#if ENABLE(VIDEO)
+
+#include "MediaPlayerPrivate.h"
+#include "Timer.h"
+
+#include <glib.h>
+#include <gst/gst.h>
+
+typedef struct _WebKitVideoSink WebKitVideoSink;
+typedef struct _GstBuffer GstBuffer;
+typedef struct _GstMessage GstMessage;
+typedef struct _GstElement GstElement;
+typedef struct _GstBus GstBus;
+
+namespace WebCore {
+
+class GraphicsContext;
+class IntSize;
+class IntRect;
+class String;
+
+gboolean mediaPlayerPrivateMessageCallback(GstBus* bus, GstMessage* message, gpointer data);
+void mediaPlayerPrivateVolumeChangedCallback(GObject* element, GParamSpec* pspec, gpointer data);
+void mediaPlayerPrivateSourceChangedCallback(GObject* element, GParamSpec* pspec, gpointer data);
+
+class MediaPlayerPrivate : public MediaPlayerPrivateInterface {
+        friend gboolean mediaPlayerPrivateMessageCallback(GstBus* bus, GstMessage* message, gpointer data);
+        friend void mediaPlayerPrivateRepaintCallback(WebKitVideoSink*, GstBuffer* buffer, MediaPlayerPrivate* playerPrivate);
+        friend void mediaPlayerPrivateSourceChangedCallback(GObject* element, GParamSpec* pspec, gpointer data);
+
+        public:
+            static void registerMediaEngine(MediaEngineRegistrar);
+            ~MediaPlayerPrivate();
+
+            IntSize naturalSize() const;
+            bool hasVideo() const;
+            bool hasAudio() const;
+
+            void load(const String &url);
+            void commitLoad();
+            void cancelLoad();
+            bool loadNextLocation();
+
+            void prepareToPlay();
+            void play();
+            void pause();
+
+            bool paused() const;
+            bool seeking() const;
+
+            float duration() const;
+            float currentTime() const;
+            void seek(float);
+
+            void setRate(float);
+
+            void setVolume(float);
+            void volumeChanged();
+            void volumeChangedTimerFired(Timer<MediaPlayerPrivate>*);
+
+            bool supportsMuting() const;
+            void setMuted(bool);
+            void muteChanged();
+            void muteChangedTimerFired(Timer<MediaPlayerPrivate>*);
+
+            void setPreload(MediaPlayer::Preload);
+            void fillTimerFired(Timer<MediaPlayerPrivate>*);
+
+            MediaPlayer::NetworkState networkState() const;
+            MediaPlayer::ReadyState readyState() const;
+
+            PassRefPtr<TimeRanges> buffered() const;
+            float maxTimeSeekable() const;
+            unsigned bytesLoaded() const;
+            unsigned totalBytes() const;
+
+            void setVisible(bool);
+            void setSize(const IntSize&);
+
+            void mediaLocationChanged(GstMessage*);
+            void loadStateChanged();
+            void sizeChanged();
+            void timeChanged();
+            void didEnd();
+            void durationChanged();
+            void loadingFailed(MediaPlayer::NetworkState);
+
+            void repaint();
+            void paint(GraphicsContext*, const IntRect&);
+
+            bool hasSingleSecurityOrigin() const;
+
+            bool supportsFullscreen() const;
+
+            GstElement* pipeline() const { return m_playBin; }
+            bool pipelineReset() const { return m_resetPipeline; }
+
+        private:
+            MediaPlayerPrivate(MediaPlayer*);
+            static MediaPlayerPrivateInterface* create(MediaPlayer* player);
+
+            static void getSupportedTypes(HashSet<String>&);
+            static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
+            static bool isAvailable();
+
+            void updateStates();
+            void cancelSeek();
+            void endPointTimerFired(Timer<MediaPlayerPrivate>*);
+            float maxTimeLoaded() const;
+            void startEndPointTimerIfNeeded();
+
+            void createGSTPlayBin();
+            bool changePipelineState(GstState state);
+
+            void processBufferingStats(GstMessage* message);
+
+        private:
+            MediaPlayer* m_player;
+            GstElement* m_playBin;
+            GstElement* m_videoSink;
+            GstElement* m_fpsSink;
+            GstElement* m_source;
+            GstClockTime m_seekTime;
+            bool m_changingRate;
+            float m_endTime;
+            bool m_isEndReached;
+            MediaPlayer::NetworkState m_networkState;
+            MediaPlayer::ReadyState m_readyState;
+            mutable bool m_isStreaming;
+            IntSize m_size;
+            GstBuffer* m_buffer;
+            GstStructure* m_mediaLocations;
+            int m_mediaLocationCurrentIndex;
+            bool m_resetPipeline;
+            bool m_paused;
+            bool m_seeking;
+            bool m_buffering;
+            float m_playbackRate;
+            bool m_errorOccured;
+            gfloat m_mediaDuration;
+            bool m_startedBuffering;
+            Timer<MediaPlayerPrivate> m_fillTimer;
+            float m_maxTimeLoaded;
+            int m_bufferingPercentage;
+            MediaPlayer::Preload m_preload;
+            bool m_delayingLoad;
+            bool m_mediaDurationKnown;
+    };
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.cpp
new file mode 100644
index 0000000000..dd8c3ee1c0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.cpp
@@ -0,0 +1,372 @@
+/*
+ *  Copyright (C) 2007 OpenedHand
+ *  Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/**
+ * SECTION:webkit-video-sink
+ * @short_description: GStreamer video sink
+ *
+ * #WebKitVideoSink is a GStreamer sink element that triggers
+ * repaints in the WebKit GStreamer media player for the
+ * current video buffer.
+ */
+
+#include "config.h"
+#include "VideoSinkGStreamer.h"
+
+#include <glib.h>
+#include <gst/gst.h>
+#include <gst/video/video.h>
+
+static GstStaticPadTemplate sinktemplate = GST_STATIC_PAD_TEMPLATE("sink",
+                                                                   GST_PAD_SINK, GST_PAD_ALWAYS,
+// CAIRO_FORMAT_RGB24 used to render the video buffers is little/big endian dependant.
+#if G_BYTE_ORDER == G_LITTLE_ENDIAN
+                                                                   GST_STATIC_CAPS(GST_VIDEO_CAPS_BGRx ";" GST_VIDEO_CAPS_BGRA)
+#else
+                                                                   GST_STATIC_CAPS(GST_VIDEO_CAPS_xRGB ";" GST_VIDEO_CAPS_ARGB)
+#endif
+);
+
+GST_DEBUG_CATEGORY_STATIC(webkit_video_sink_debug);
+#define GST_CAT_DEFAULT webkit_video_sink_debug
+
+enum {
+    REPAINT_REQUESTED,
+    LAST_SIGNAL
+};
+
+enum {
+    PROP_0
+};
+
+static guint webkit_video_sink_signals[LAST_SIGNAL] = { 0, };
+
+struct _WebKitVideoSinkPrivate {
+    GstBuffer* buffer;
+    guint timeout_id;
+    GMutex* buffer_mutex;
+    GCond* data_cond;
+
+    // If this is TRUE all processing should finish ASAP
+    // This is necessary because there could be a race between
+    // unlock() and render(), where unlock() wins, signals the
+    // GCond, then render() tries to render a frame although
+    // everything else isn't running anymore. This will lead
+    // to deadlocks because render() holds the stream lock.
+    //
+    // Protected by the buffer mutex
+    gboolean unlocked;
+};
+
+#define _do_init(bla) \
+    GST_DEBUG_CATEGORY_INIT(webkit_video_sink_debug, \
+                            "webkitsink", \
+                            0, \
+                            "webkit video sink")
+
+GST_BOILERPLATE_FULL(WebKitVideoSink,
+                     webkit_video_sink,
+                     GstVideoSink,
+                     GST_TYPE_VIDEO_SINK,
+                     _do_init);
+
+static void
+webkit_video_sink_base_init(gpointer g_class)
+{
+    GstElementClass* element_class = GST_ELEMENT_CLASS(g_class);
+
+    gst_element_class_add_pad_template(element_class, gst_static_pad_template_get(&sinktemplate));
+    gst_element_class_set_details_simple(element_class, "WebKit video sink",
+            "Sink/Video", "Sends video data from a GStreamer pipeline to a Cairo surface",
+            "Alp Toker <alp@atoker.com>");
+}
+
+static void
+webkit_video_sink_init(WebKitVideoSink* sink, WebKitVideoSinkClass* klass)
+{
+    WebKitVideoSinkPrivate* priv;
+
+    sink->priv = priv = G_TYPE_INSTANCE_GET_PRIVATE(sink, WEBKIT_TYPE_VIDEO_SINK, WebKitVideoSinkPrivate);
+    priv->data_cond = g_cond_new();
+    priv->buffer_mutex = g_mutex_new();
+}
+
+static gboolean
+webkit_video_sink_timeout_func(gpointer data)
+{
+    WebKitVideoSink* sink = reinterpret_cast<WebKitVideoSink*>(data);
+    WebKitVideoSinkPrivate* priv = sink->priv;
+    GstBuffer* buffer;
+
+    g_mutex_lock(priv->buffer_mutex);
+    buffer = priv->buffer;
+    priv->buffer = 0;
+    priv->timeout_id = 0;
+
+    if (!buffer || priv->unlocked || G_UNLIKELY(!GST_IS_BUFFER(buffer))) {
+        g_cond_signal(priv->data_cond);
+        g_mutex_unlock(priv->buffer_mutex);
+        return FALSE;
+    }
+
+    g_signal_emit(sink, webkit_video_sink_signals[REPAINT_REQUESTED], 0, buffer);
+    gst_buffer_unref(buffer);
+    g_cond_signal(priv->data_cond);
+    g_mutex_unlock(priv->buffer_mutex);
+
+    return FALSE;
+}
+
+static GstFlowReturn
+webkit_video_sink_render(GstBaseSink* bsink, GstBuffer* buffer)
+{
+    WebKitVideoSink* sink = WEBKIT_VIDEO_SINK(bsink);
+    WebKitVideoSinkPrivate* priv = sink->priv;
+
+    g_mutex_lock(priv->buffer_mutex);
+
+    if (priv->unlocked) {
+        g_mutex_unlock(priv->buffer_mutex);
+        return GST_FLOW_OK;
+    }
+
+    priv->buffer = gst_buffer_ref(buffer);
+
+    // For the unlikely case where the buffer has no caps, the caps
+    // are implicitely the caps of the pad. This shouldn't happen.
+    if (G_UNLIKELY(!GST_BUFFER_CAPS(buffer))) {
+        buffer = priv->buffer = gst_buffer_make_metadata_writable(priv->buffer);
+        gst_buffer_set_caps(priv->buffer, GST_PAD_CAPS(GST_BASE_SINK_PAD(bsink)));
+    }
+
+    GstCaps *caps = GST_BUFFER_CAPS(buffer);
+    GstVideoFormat format;
+    int width, height;
+    if (G_UNLIKELY(!gst_video_format_parse_caps(caps, &format, &width, &height))) {
+        gst_buffer_unref(buffer);
+        g_mutex_unlock(priv->buffer_mutex);
+        return GST_FLOW_ERROR;
+    }
+
+    // Cairo's ARGB has pre-multiplied alpha while GStreamer's doesn't.
+    // Here we convert to Cairo's ARGB.
+    if (format == GST_VIDEO_FORMAT_ARGB || format == GST_VIDEO_FORMAT_BGRA) {
+        // Because GstBaseSink::render() only owns the buffer reference in the
+        // method scope we can't use gst_buffer_make_writable() here. Also
+        // The buffer content should not be changed here because the same buffer
+        // could be passed multiple times to this method (in theory)
+        GstBuffer *newBuffer = gst_buffer_try_new_and_alloc(GST_BUFFER_SIZE(buffer));
+
+        // Check if allocation failed
+        if (G_UNLIKELY(!newBuffer)) {
+            gst_buffer_unref(buffer);
+            g_mutex_unlock(priv->buffer_mutex);
+            return GST_FLOW_ERROR;
+        }
+
+        gst_buffer_copy_metadata(newBuffer, buffer, (GstBufferCopyFlags) GST_BUFFER_COPY_ALL);
+
+        // We don't use Color::premultipliedARGBFromColor() here because
+        // one function call per video pixel is just too expensive:
+        // For 720p/PAL for example this means 1280*720*25=23040000
+        // function calls per second!
+        unsigned short alpha;
+        const guint8 *source = GST_BUFFER_DATA(buffer);
+        guint8 *destination = GST_BUFFER_DATA(newBuffer);
+
+        for (int x = 0; x < height; x++) {
+            for (int y = 0; y < width; y++) {
+#if G_BYTE_ORDER == G_LITTLE_ENDIAN
+                alpha = source[3];
+                destination[0] = (source[0] * alpha + 128) / 255;
+                destination[1] = (source[1] * alpha + 128) / 255;
+                destination[2] = (source[2] * alpha + 128) / 255;
+                destination[3] = alpha;
+#else
+                alpha = source[0];
+                destination[0] = alpha;
+                destination[1] = (source[1] * alpha + 128) / 255;
+                destination[2] = (source[2] * alpha + 128) / 255;
+                destination[3] = (source[3] * alpha + 128) / 255;
+#endif
+                source += 4;
+                destination += 4;
+            }
+        }
+        gst_buffer_unref(buffer);
+        buffer = priv->buffer = newBuffer;
+    }
+
+    // This should likely use a lower priority, but glib currently starves
+    // lower priority sources.
+    // See: https://bugzilla.gnome.org/show_bug.cgi?id=610830.
+    priv->timeout_id = g_timeout_add_full(G_PRIORITY_DEFAULT, 0,
+                                          webkit_video_sink_timeout_func,
+                                          gst_object_ref(sink),
+                                          (GDestroyNotify)gst_object_unref);
+
+    g_cond_wait(priv->data_cond, priv->buffer_mutex);
+    g_mutex_unlock(priv->buffer_mutex);
+    return GST_FLOW_OK;
+}
+
+static void
+webkit_video_sink_dispose(GObject* object)
+{
+    WebKitVideoSink* sink = WEBKIT_VIDEO_SINK(object);
+    WebKitVideoSinkPrivate* priv = sink->priv;
+
+    if (priv->data_cond) {
+        g_cond_free(priv->data_cond);
+        priv->data_cond = 0;
+    }
+
+    if (priv->buffer_mutex) {
+        g_mutex_free(priv->buffer_mutex);
+        priv->buffer_mutex = 0;
+    }
+
+    G_OBJECT_CLASS(parent_class)->dispose(object);
+}
+
+static void
+unlock_buffer_mutex(WebKitVideoSinkPrivate* priv)
+{
+    g_mutex_lock(priv->buffer_mutex);
+
+    if (priv->buffer) {
+        gst_buffer_unref(priv->buffer);
+        priv->buffer = 0;
+    }
+
+    priv->unlocked = TRUE;
+
+    g_cond_signal(priv->data_cond);
+    g_mutex_unlock(priv->buffer_mutex);
+}
+
+static gboolean
+webkit_video_sink_unlock(GstBaseSink* object)
+{
+    WebKitVideoSink* sink = WEBKIT_VIDEO_SINK(object);
+
+    unlock_buffer_mutex(sink->priv);
+
+    return GST_CALL_PARENT_WITH_DEFAULT(GST_BASE_SINK_CLASS, unlock,
+                                        (object), TRUE);
+}
+
+static gboolean
+webkit_video_sink_unlock_stop(GstBaseSink* object)
+{
+    WebKitVideoSink* sink = WEBKIT_VIDEO_SINK(object);
+    WebKitVideoSinkPrivate* priv = sink->priv;
+
+    g_mutex_lock(priv->buffer_mutex);
+    priv->unlocked = FALSE;
+    g_mutex_unlock(priv->buffer_mutex);
+
+    return GST_CALL_PARENT_WITH_DEFAULT(GST_BASE_SINK_CLASS, unlock_stop,
+                                        (object), TRUE);
+}
+
+static gboolean
+webkit_video_sink_stop(GstBaseSink* base_sink)
+{
+    WebKitVideoSinkPrivate* priv = WEBKIT_VIDEO_SINK(base_sink)->priv;
+
+    unlock_buffer_mutex(priv);
+    return TRUE;
+}
+
+static gboolean
+webkit_video_sink_start(GstBaseSink* base_sink)
+{
+    WebKitVideoSinkPrivate* priv = WEBKIT_VIDEO_SINK(base_sink)->priv;
+
+    g_mutex_lock(priv->buffer_mutex);
+    priv->unlocked = FALSE;
+    g_mutex_unlock(priv->buffer_mutex);
+    return TRUE;
+}
+
+static void
+marshal_VOID__MINIOBJECT(GClosure * closure, GValue * return_value,
+                         guint n_param_values, const GValue * param_values,
+                         gpointer invocation_hint, gpointer marshal_data)
+{
+  typedef void (*marshalfunc_VOID__MINIOBJECT) (gpointer obj, gpointer arg1, gpointer data2);
+  marshalfunc_VOID__MINIOBJECT callback;
+  GCClosure *cc = (GCClosure *) closure;
+  gpointer data1, data2;
+
+  g_return_if_fail(n_param_values == 2);
+
+  if (G_CCLOSURE_SWAP_DATA(closure)) {
+      data1 = closure->data;
+      data2 = g_value_peek_pointer(param_values + 0);
+  } else {
+      data1 = g_value_peek_pointer(param_values + 0);
+      data2 = closure->data;
+  }
+  callback = (marshalfunc_VOID__MINIOBJECT) (marshal_data ? marshal_data : cc->callback);
+
+  callback(data1, gst_value_get_mini_object(param_values + 1), data2);
+}
+
+static void
+webkit_video_sink_class_init(WebKitVideoSinkClass* klass)
+{
+    GObjectClass* gobject_class = G_OBJECT_CLASS(klass);
+    GstBaseSinkClass* gstbase_sink_class = GST_BASE_SINK_CLASS(klass);
+
+    g_type_class_add_private(klass, sizeof(WebKitVideoSinkPrivate));
+
+    gobject_class->dispose = webkit_video_sink_dispose;
+
+    gstbase_sink_class->unlock = webkit_video_sink_unlock;
+    gstbase_sink_class->unlock_stop = webkit_video_sink_unlock_stop;
+    gstbase_sink_class->render = webkit_video_sink_render;
+    gstbase_sink_class->preroll = webkit_video_sink_render;
+    gstbase_sink_class->stop = webkit_video_sink_stop;
+    gstbase_sink_class->start = webkit_video_sink_start;
+
+    webkit_video_sink_signals[REPAINT_REQUESTED] = g_signal_new("repaint-requested",
+            G_TYPE_FROM_CLASS(klass),
+            (GSignalFlags)(G_SIGNAL_RUN_LAST | G_SIGNAL_ACTION),
+            0,
+            0,
+            0,
+            marshal_VOID__MINIOBJECT,
+            G_TYPE_NONE, 1, GST_TYPE_BUFFER);
+}
+
+/**
+ * webkit_video_sink_new:
+ *
+ * Creates a new GStreamer video sink.
+ *
+ * Return value: a #GstElement for the newly created video sink
+ */
+GstElement*
+webkit_video_sink_new(void)
+{
+    return (GstElement*)g_object_new(WEBKIT_TYPE_VIDEO_SINK, 0);
+}
+
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.h b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.h
new file mode 100644
index 0000000000..7ea7d919f8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.h
@@ -0,0 +1,79 @@
+/*
+ *  Copyright (C) 2007 OpenedHand
+ *  Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef _HAVE_WEBKIT_VIDEO_SINK_H
+#define _HAVE_WEBKIT_VIDEO_SINK_H
+
+#include <cairo.h>
+#include <glib-object.h>
+#include <gst/video/gstvideosink.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_VIDEO_SINK webkit_video_sink_get_type()
+
+#define WEBKIT_VIDEO_SINK(obj) \
+    (G_TYPE_CHECK_INSTANCE_CAST((obj), \
+    WEBKIT_TYPE_VIDEO_SINK, WebKitVideoSink))
+
+#define WEBKIT_VIDEO_SINK_CLASS(klass) \
+    (G_TYPE_CHECK_CLASS_CAST((klass), \
+    WEBKIT_TYPE_VIDEO_SINK, WebKitVideoSinkClass))
+
+#define WEBKIT_IS_VIDEO_SINK(obj) \
+    (G_TYPE_CHECK_INSTANCE_TYPE((obj), \
+    WEBKIT_TYPE_VIDEO_SINK))
+
+#define WEBKIT_IS_VIDEO_SINK_CLASS(klass) \
+    (G_TYPE_CHECK_CLASS_TYPE((klass), \
+    WEBKIT_TYPE_VIDEO_SINK))
+
+#define WEBKIT_VIDEO_SINK_GET_CLASS(obj) \
+    (G_TYPE_INSTANCE_GET_CLASS((obj), \
+    WEBKIT_TYPE_VIDEO_SINK, WebKitVideoSinkClass))
+
+typedef struct _WebKitVideoSink        WebKitVideoSink;
+typedef struct _WebKitVideoSinkClass   WebKitVideoSinkClass;
+typedef struct _WebKitVideoSinkPrivate WebKitVideoSinkPrivate;
+
+struct _WebKitVideoSink {
+    /*< private >*/
+    GstVideoSink parent;
+    WebKitVideoSinkPrivate *priv;
+};
+
+struct _WebKitVideoSinkClass {
+    /*< private >*/
+    GstVideoSinkClass parent_class;
+
+    /* Future padding */
+    void (* _webkit_reserved1)(void);
+    void (* _webkit_reserved2)(void);
+    void (* _webkit_reserved3)(void);
+    void (* _webkit_reserved4)(void);
+    void (* _webkit_reserved5)(void);
+    void (* _webkit_reserved6)(void);
+};
+
+GType       webkit_video_sink_get_type(void) G_GNUC_CONST;
+GstElement *webkit_video_sink_new(void);
+
+G_END_DECLS
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
new file mode 100644
index 0000000000..8462ad181e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
@@ -0,0 +1,757 @@
+/*
+ *  Copyright (C) 2009, 2010 Sebastian Dröge <sebastian.droege@collabora.co.uk>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "WebKitWebSourceGStreamer.h"
+
+#include "CString.h"
+#include "Document.h"
+#include "GOwnPtr.h"
+#include "GRefPtr.h"
+#include "Noncopyable.h"
+#include "NotImplemented.h"
+#include "ResourceHandleClient.h"
+#include "ResourceHandleInternal.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
+#include <gst/app/gstappsrc.h>
+#include <gst/pbutils/missing-plugins.h>
+
+using namespace WebCore;
+
+class StreamingClient : public Noncopyable, public ResourceHandleClient {
+    public:
+        StreamingClient(WebKitWebSrc*);
+        virtual ~StreamingClient();
+
+        virtual void willSendRequest(ResourceHandle*, ResourceRequest&, const ResourceResponse&);
+        virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
+        virtual void didReceiveData(ResourceHandle*, const char*, int, int);
+        virtual void didFinishLoading(ResourceHandle*);
+        virtual void didFail(ResourceHandle*, const ResourceError&);
+        virtual void wasBlocked(ResourceHandle*);
+        virtual void cannotShowURL(ResourceHandle*);
+
+    private:
+        WebKitWebSrc* m_src;
+};
+
+#define WEBKIT_WEB_SRC_GET_PRIVATE(obj) (G_TYPE_INSTANCE_GET_PRIVATE((obj), WEBKIT_TYPE_WEB_SRC, WebKitWebSrcPrivate))
+struct _WebKitWebSrcPrivate {
+    GstAppSrc* appsrc;
+    GstPad* srcpad;
+    gchar* uri;
+
+    RefPtr<WebCore::Frame> frame;
+
+    StreamingClient* client;
+    RefPtr<ResourceHandle> resourceHandle;
+
+    guint64 offset;
+    guint64 size;
+    gboolean seekable;
+    gboolean paused;
+
+    guint64 requestedOffset;
+
+    guint needDataID;
+    guint enoughDataID;
+    guint seekID;
+
+    // icecast stuff
+    gboolean iradioMode;
+    gchar* iradioName;
+    gchar* iradioGenre;
+    gchar* iradioUrl;
+    gchar* iradioTitle;
+
+    // TRUE if appsrc's version is >= 0.10.27, see
+    // https://bugzilla.gnome.org/show_bug.cgi?id=609423
+    gboolean haveAppSrc27;
+};
+
+enum {
+    PROP_IRADIO_MODE = 1,
+    PROP_IRADIO_NAME,
+    PROP_IRADIO_GENRE,
+    PROP_IRADIO_URL,
+    PROP_IRADIO_TITLE
+};
+
+static GstStaticPadTemplate srcTemplate = GST_STATIC_PAD_TEMPLATE("src",
+                                                                  GST_PAD_SRC,
+                                                                  GST_PAD_ALWAYS,
+                                                                  GST_STATIC_CAPS_ANY);
+
+GST_DEBUG_CATEGORY_STATIC(webkit_web_src_debug);
+#define GST_CAT_DEFAULT webkit_web_src_debug
+
+static void webKitWebSrcUriHandlerInit(gpointer gIface,
+                                            gpointer ifaceData);
+
+static void webKitWebSrcFinalize(GObject* object);
+static void webKitWebSrcSetProperty(GObject* object, guint propID, const GValue* value, GParamSpec* pspec);
+static void webKitWebSrcGetProperty(GObject* object, guint propID, GValue* value, GParamSpec* pspec);
+static GstStateChangeReturn webKitWebSrcChangeState(GstElement* element, GstStateChange transition);
+
+static void webKitWebSrcNeedDataCb(GstAppSrc* appsrc, guint length, gpointer userData);
+static void webKitWebSrcEnoughDataCb(GstAppSrc* appsrc, gpointer userData);
+static gboolean webKitWebSrcSeekDataCb(GstAppSrc* appsrc, guint64 offset, gpointer userData);
+
+static void webKitWebSrcStop(WebKitWebSrc* src, bool seeking);
+
+static GstAppSrcCallbacks appsrcCallbacks = {
+    webKitWebSrcNeedDataCb,
+    webKitWebSrcEnoughDataCb,
+    webKitWebSrcSeekDataCb,
+    { 0 }
+};
+
+static void doInit(GType gtype)
+{
+    static const GInterfaceInfo uriHandlerInfo = {
+        webKitWebSrcUriHandlerInit,
+        0, 0
+    };
+
+    GST_DEBUG_CATEGORY_INIT(webkit_web_src_debug, "webkitwebsrc", 0, "websrc element");
+    g_type_add_interface_static(gtype, GST_TYPE_URI_HANDLER,
+                                &uriHandlerInfo);
+}
+
+GST_BOILERPLATE_FULL(WebKitWebSrc, webkit_web_src, GstBin, GST_TYPE_BIN, doInit);
+
+static void webkit_web_src_base_init(gpointer klass)
+{
+    GstElementClass* eklass = GST_ELEMENT_CLASS(klass);
+
+    gst_element_class_add_pad_template(eklass,
+                                       gst_static_pad_template_get(&srcTemplate));
+    gst_element_class_set_details_simple(eklass,
+                                         (gchar*) "WebKit Web source element",
+                                         (gchar*) "Source",
+                                         (gchar*) "Handles HTTP/HTTPS uris",
+                                         (gchar*) "Sebastian Dröge <sebastian.droege@collabora.co.uk>");
+}
+
+static void webkit_web_src_class_init(WebKitWebSrcClass* klass)
+{
+    GObjectClass* oklass = G_OBJECT_CLASS(klass);
+    GstElementClass* eklass = GST_ELEMENT_CLASS(klass);
+
+    oklass->finalize = webKitWebSrcFinalize;
+    oklass->set_property = webKitWebSrcSetProperty;
+    oklass->get_property = webKitWebSrcGetProperty;
+
+    // icecast stuff
+    g_object_class_install_property(oklass,
+                                    PROP_IRADIO_MODE,
+                                    g_param_spec_boolean("iradio-mode",
+                                                         "iradio-mode",
+                                                         "Enable internet radio mode (extraction of shoutcast/icecast metadata)",
+                                                         FALSE,
+                                                         (GParamFlags) (G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS)));
+
+    g_object_class_install_property(oklass,
+                                    PROP_IRADIO_NAME,
+                                    g_param_spec_string("iradio-name",
+                                                        "iradio-name",
+                                                        "Name of the stream",
+                                                        0,
+                                                        (GParamFlags) (G_PARAM_READABLE | G_PARAM_STATIC_STRINGS)));
+
+    g_object_class_install_property(oklass,
+                                    PROP_IRADIO_GENRE,
+                                    g_param_spec_string("iradio-genre",
+                                                        "iradio-genre",
+                                                        "Genre of the stream",
+                                                        0,
+                                                        (GParamFlags) (G_PARAM_READABLE | G_PARAM_STATIC_STRINGS)));
+                                                        
+    g_object_class_install_property(oklass,
+                                    PROP_IRADIO_URL,
+                                    g_param_spec_string("iradio-url",
+                                                        "iradio-url",
+                                                        "Homepage URL for radio stream",
+                                                        0,
+                                                        (GParamFlags) (G_PARAM_READABLE | G_PARAM_STATIC_STRINGS)));
+
+    g_object_class_install_property(oklass,
+                                    PROP_IRADIO_TITLE,
+                                    g_param_spec_string("iradio-title",
+                                                        "iradio-title",
+                                                        "Name of currently playing song",
+                                                        0,
+                                                        (GParamFlags) (G_PARAM_READABLE | G_PARAM_STATIC_STRINGS)));
+
+    eklass->change_state = webKitWebSrcChangeState;
+
+    g_type_class_add_private(klass, sizeof(WebKitWebSrcPrivate));
+}
+
+static void webkit_web_src_init(WebKitWebSrc* src,
+                                WebKitWebSrcClass* gKlass)
+{
+    GstPadTemplate* padTemplate = gst_static_pad_template_get(&srcTemplate);
+    GstPad* targetpad;
+    WebKitWebSrcPrivate* priv = WEBKIT_WEB_SRC_GET_PRIVATE(src);
+
+    src->priv = priv;
+
+    priv->client = new StreamingClient(src);
+
+    priv->srcpad = gst_ghost_pad_new_no_target_from_template("src",
+                                                             padTemplate);
+
+    gst_element_add_pad(GST_ELEMENT(src), priv->srcpad);
+
+    priv->appsrc = GST_APP_SRC(gst_element_factory_make("appsrc", 0));
+    if (!priv->appsrc) {
+        GST_ERROR_OBJECT(src, "Failed to create appsrc");
+        return;
+    }
+
+    GstElementFactory* factory = GST_ELEMENT_FACTORY(GST_ELEMENT_GET_CLASS(priv->appsrc)->elementfactory);
+    priv->haveAppSrc27 = gst_plugin_feature_check_version(GST_PLUGIN_FEATURE(factory), 0, 10, 27);
+
+    gst_bin_add(GST_BIN(src), GST_ELEMENT(priv->appsrc));
+
+    targetpad = gst_element_get_static_pad(GST_ELEMENT(priv->appsrc), "src");
+    gst_ghost_pad_set_target(GST_GHOST_PAD(priv->srcpad), targetpad);
+    gst_object_unref(targetpad);
+
+    gst_app_src_set_callbacks(priv->appsrc, &appsrcCallbacks, src, 0);
+    gst_app_src_set_emit_signals(priv->appsrc, FALSE);
+    gst_app_src_set_stream_type(priv->appsrc, GST_APP_STREAM_TYPE_SEEKABLE);
+
+    // 512k is a abitrary number but we should choose a value
+    // here to not pause/unpause the SoupMessage too often and
+    // to make sure there's always some data available for
+    // GStreamer to handle.
+    gst_app_src_set_max_bytes(priv->appsrc, 512 * 1024);
+
+    // Emit the need-data signal if the queue contains less
+    // than 20% of data. Without this the need-data signal
+    // is emitted when the queue is empty, we then dispatch
+    // the soup message unpausing to the main loop and from
+    // there unpause the soup message. This already takes
+    // quite some time and libsoup even needs some more time
+    // to actually provide data again. If we do all this
+    // already if the queue is 20% empty, it's much more
+    // likely that libsoup already provides new data before
+    // the queue is really empty.
+    if (priv->haveAppSrc27)
+        g_object_set(priv->appsrc, "min-percent", 20, NULL);
+
+    webKitWebSrcStop(src, false);
+}
+
+static void webKitWebSrcFinalize(GObject* object)
+{
+    WebKitWebSrc* src = WEBKIT_WEB_SRC(object);
+    WebKitWebSrcPrivate* priv = src->priv;
+
+    delete priv->client;
+
+    g_free(priv->uri);
+
+    GST_CALL_PARENT(G_OBJECT_CLASS, finalize, ((GObject* )(src)));
+}
+
+static void webKitWebSrcSetProperty(GObject* object, guint propID, const GValue* value, GParamSpec* pspec)
+{
+    WebKitWebSrc* src = WEBKIT_WEB_SRC(object);
+    WebKitWebSrcPrivate* priv = src->priv;
+
+    switch (propID) {
+    case PROP_IRADIO_MODE:
+        priv->iradioMode = g_value_get_boolean(value);
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propID, pspec);
+        break;
+    }
+}
+
+static void webKitWebSrcGetProperty(GObject* object, guint propID, GValue* value, GParamSpec* pspec)
+{
+    WebKitWebSrc* src = WEBKIT_WEB_SRC(object);
+    WebKitWebSrcPrivate* priv = src->priv;
+
+    switch (propID) {
+    case PROP_IRADIO_MODE:
+        g_value_set_boolean(value, priv->iradioMode);
+        break;
+    case PROP_IRADIO_NAME:
+        g_value_set_string(value, priv->iradioName);
+        break;
+    case PROP_IRADIO_GENRE:
+        g_value_set_string(value, priv->iradioGenre);
+        break;
+    case PROP_IRADIO_URL:
+        g_value_set_string(value, priv->iradioUrl);
+        break;
+    case PROP_IRADIO_TITLE:
+        g_value_set_string(value, priv->iradioTitle);
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propID, pspec);
+        break;
+    }
+}
+
+
+static void webKitWebSrcStop(WebKitWebSrc* src, bool seeking)
+{
+    WebKitWebSrcPrivate* priv = src->priv;
+
+    if (priv->resourceHandle) {
+        priv->resourceHandle->cancel();
+        priv->resourceHandle.release();
+    }
+    priv->resourceHandle = 0;
+
+    if (priv->frame)
+        priv->frame.release();
+
+    if (priv->needDataID)
+        g_source_remove(priv->needDataID);
+    priv->needDataID = 0;
+
+    if (priv->enoughDataID)
+        g_source_remove(priv->enoughDataID);
+    priv->enoughDataID = 0;
+
+    if (priv->seekID)
+        g_source_remove(priv->seekID);
+    priv->seekID = 0;
+
+    priv->paused = FALSE;
+
+    g_free(priv->iradioName);
+    priv->iradioName = 0;
+
+    g_free(priv->iradioGenre);
+    priv->iradioGenre = 0;
+
+    g_free(priv->iradioUrl);
+    priv->iradioUrl = 0;
+
+    g_free(priv->iradioTitle);
+    priv->iradioTitle = 0;
+
+    if (priv->appsrc) {
+        gst_app_src_set_caps(priv->appsrc, 0);
+        if (!seeking)
+            gst_app_src_set_size(priv->appsrc, -1);
+    }
+
+    priv->offset = 0;
+    priv->seekable = FALSE;
+
+    if (!seeking) {
+        priv->size = 0;
+        priv->requestedOffset = 0;
+    }
+
+    GST_DEBUG_OBJECT(src, "Stopped request");
+}
+
+static bool webKitWebSrcStart(WebKitWebSrc* src)
+{
+    WebKitWebSrcPrivate* priv = src->priv;
+
+    if (!priv->uri) {
+        GST_ERROR_OBJECT(src, "No URI provided");
+        return false;
+    }
+    
+    KURL url = KURL(KURL(), priv->uri);
+
+    ResourceRequest request(url);
+    request.setTargetType(ResourceRequestBase::TargetIsMedia);
+    request.setAllowCookies(true);
+
+    // Let Apple web servers know we want to access their nice movie trailers.
+    if (!g_ascii_strcasecmp("movies.apple.com", url.host().utf8().data()))
+        request.setHTTPUserAgent("Quicktime/7.2.0");
+
+    if (priv->frame) {
+        Document* document = priv->frame->document();
+        if (document)
+            request.setHTTPReferrer(document->documentURI());
+
+        FrameLoader* loader = priv->frame->loader();
+        if (loader)
+            loader->addExtraFieldsToSubresourceRequest(request);
+    }
+
+    if (priv->requestedOffset) {
+        GOwnPtr<gchar> val;
+
+        val.set(g_strdup_printf("bytes=%" G_GUINT64_FORMAT "-", priv->requestedOffset));
+        request.setHTTPHeaderField("Range", val.get());
+    }
+
+    if (priv->iradioMode)
+        request.setHTTPHeaderField("icy-metadata", "1");
+
+    // Needed to use DLNA streaming servers
+    request.setHTTPHeaderField("transferMode.dlna", "Streaming");
+
+    priv->resourceHandle = ResourceHandle::create(request, priv->client, 0, false, false);
+    if (!priv->resourceHandle) {
+        GST_ERROR_OBJECT(src, "Failed to create ResourceHandle");
+        return false;
+    }
+
+    GST_DEBUG_OBJECT(src, "Started request");
+
+    return true;
+}
+
+static GstStateChangeReturn webKitWebSrcChangeState(GstElement* element, GstStateChange transition)
+{
+    GstStateChangeReturn ret = GST_STATE_CHANGE_SUCCESS;
+    WebKitWebSrc* src = WEBKIT_WEB_SRC(element);
+    WebKitWebSrcPrivate* priv = src->priv;
+
+    switch (transition) {
+    case GST_STATE_CHANGE_NULL_TO_READY:
+        if (!priv->appsrc) {
+            gst_element_post_message(element,
+                                     gst_missing_element_message_new(element, "appsrc"));
+            GST_ELEMENT_ERROR(src, CORE, MISSING_PLUGIN, (0), ("no appsrc"));
+            return GST_STATE_CHANGE_FAILURE;
+        }
+        break;
+    default:
+        break;
+    }
+
+    ret = GST_ELEMENT_CLASS(parent_class)->change_state(element, transition);
+    if (G_UNLIKELY(ret == GST_STATE_CHANGE_FAILURE)) {
+        GST_DEBUG_OBJECT(src, "State change failed");
+        return ret;
+    }
+
+    switch (transition) {
+    case GST_STATE_CHANGE_READY_TO_PAUSED:
+        GST_DEBUG_OBJECT(src, "READY->PAUSED");
+        if (!webKitWebSrcStart(src))
+            ret = GST_STATE_CHANGE_FAILURE;
+        break;
+    case GST_STATE_CHANGE_PAUSED_TO_READY:
+        GST_DEBUG_OBJECT(src, "PAUSED->READY");
+        webKitWebSrcStop(src, false);
+        break;
+    default:
+        break;
+    }
+
+    return ret;
+}
+
+// uri handler interface
+
+static GstURIType webKitWebSrcUriGetType(void)
+{
+    return GST_URI_SRC;
+}
+
+static gchar** webKitWebSrcGetProtocols(void)
+{
+    static gchar* protocols[] = {(gchar*) "http", (gchar*) "https", 0 };
+
+    return protocols;
+}
+
+static const gchar* webKitWebSrcGetUri(GstURIHandler* handler)
+{
+    WebKitWebSrc* src = WEBKIT_WEB_SRC(handler);
+    WebKitWebSrcPrivate* priv = src->priv;
+
+    return priv->uri;
+}
+
+static gboolean webKitWebSrcSetUri(GstURIHandler* handler, const gchar* uri)
+{
+    WebKitWebSrc* src = WEBKIT_WEB_SRC(handler);
+    WebKitWebSrcPrivate* priv = src->priv;
+
+    if (GST_STATE(src) >= GST_STATE_PAUSED) {
+        GST_ERROR_OBJECT(src, "URI can only be set in states < PAUSED");
+        return FALSE;
+    }
+
+    g_free(priv->uri);
+    priv->uri = 0;
+
+    if (!uri)
+        return TRUE;
+
+    SoupURI* soupUri = soup_uri_new(uri);
+
+    if (!soupUri || !SOUP_URI_VALID_FOR_HTTP(soupUri)) {
+        GST_ERROR_OBJECT(src, "Invalid URI '%s'", uri);
+        soup_uri_free(soupUri);
+        return FALSE;
+    }
+
+    priv->uri = soup_uri_to_string(soupUri, FALSE);
+    soup_uri_free(soupUri);
+
+    return TRUE;
+}
+
+static void webKitWebSrcUriHandlerInit(gpointer gIface, gpointer ifaceData)
+{
+    GstURIHandlerInterface* iface = (GstURIHandlerInterface *) gIface;
+
+    iface->get_type = webKitWebSrcUriGetType;
+    iface->get_protocols = webKitWebSrcGetProtocols;
+    iface->get_uri = webKitWebSrcGetUri;
+    iface->set_uri = webKitWebSrcSetUri;
+}
+
+// appsrc callbacks
+
+static gboolean webKitWebSrcNeedDataMainCb(WebKitWebSrc* src)
+{
+    WebKitWebSrcPrivate* priv = src->priv;
+
+    ResourceHandleInternal* d = priv->resourceHandle->getInternal();
+    if (d->m_msg)
+        soup_session_unpause_message(ResourceHandle::defaultSession(), d->m_msg);
+
+    priv->paused = FALSE;
+    priv->needDataID = 0;
+    return FALSE;
+}
+
+static void webKitWebSrcNeedDataCb(GstAppSrc* appsrc, guint length, gpointer userData)
+{
+    WebKitWebSrc* src = WEBKIT_WEB_SRC(userData);
+    WebKitWebSrcPrivate* priv = src->priv;
+
+    GST_DEBUG_OBJECT(src, "Need more data: %u", length);
+    if (priv->needDataID || !priv->paused)
+        return;
+
+    priv->needDataID = g_timeout_add_full(G_PRIORITY_DEFAULT, 0, (GSourceFunc) webKitWebSrcNeedDataMainCb, gst_object_ref(src), (GDestroyNotify) gst_object_unref);
+}
+
+static gboolean webKitWebSrcEnoughDataMainCb(WebKitWebSrc* src)
+{
+    WebKitWebSrcPrivate* priv = src->priv;
+
+    ResourceHandleInternal* d = priv->resourceHandle->getInternal();
+    soup_session_pause_message(ResourceHandle::defaultSession(), d->m_msg);
+    
+    priv->paused = TRUE;
+    priv->enoughDataID = 0;
+    return FALSE;
+}
+
+static void webKitWebSrcEnoughDataCb(GstAppSrc* appsrc, gpointer userData)
+{
+    WebKitWebSrc* src = WEBKIT_WEB_SRC(userData);
+    WebKitWebSrcPrivate* priv = src->priv;
+
+    GST_DEBUG_OBJECT(src, "Have enough data");
+    if (priv->enoughDataID || priv->paused)
+        return;
+
+    priv->enoughDataID = g_timeout_add_full(G_PRIORITY_DEFAULT, 0, (GSourceFunc) webKitWebSrcEnoughDataMainCb, gst_object_ref(src), (GDestroyNotify) gst_object_unref);
+}
+
+static gboolean webKitWebSrcSeekMainCb(WebKitWebSrc* src)
+{
+    webKitWebSrcStop(src, true);
+    webKitWebSrcStart(src);
+
+    return FALSE;
+}
+
+static gboolean webKitWebSrcSeekDataCb(GstAppSrc* appsrc, guint64 offset, gpointer userData)
+{
+    WebKitWebSrc* src = WEBKIT_WEB_SRC(userData);
+    WebKitWebSrcPrivate* priv = src->priv;
+
+    GST_DEBUG_OBJECT(src, "Seeking to offset: %" G_GUINT64_FORMAT, offset);
+    if (offset == priv->offset)
+        return TRUE;
+
+    if (!priv->seekable)
+        return FALSE;
+    if (offset > priv->size)
+        return FALSE;
+
+    GST_DEBUG_OBJECT(src, "Doing range-request seek");
+    priv->requestedOffset = offset;
+    if (priv->seekID)
+        g_source_remove(priv->seekID);
+    priv->seekID = g_timeout_add_full(G_PRIORITY_DEFAULT, 0, (GSourceFunc) webKitWebSrcSeekMainCb, gst_object_ref(src), (GDestroyNotify) gst_object_unref);
+    
+    return TRUE;
+}
+
+void webKitWebSrcSetFrame(WebKitWebSrc* src, WebCore::Frame* frame)
+{
+    WebKitWebSrcPrivate* priv = src->priv;
+
+    priv->frame = frame;
+}
+
+StreamingClient::StreamingClient(WebKitWebSrc* src) : m_src(src)
+{
+
+}
+
+StreamingClient::~StreamingClient()
+{
+
+}
+
+void StreamingClient::willSendRequest(ResourceHandle*, ResourceRequest&, const ResourceResponse&)
+{
+}
+
+void StreamingClient::didReceiveResponse(ResourceHandle*, const ResourceResponse& response)
+{
+    WebKitWebSrcPrivate* priv = m_src->priv;
+
+    GST_DEBUG_OBJECT(m_src, "Received response: %d", response.httpStatusCode());
+
+    // If we seeked we need 206 == PARTIAL_CONTENT
+    if (priv->requestedOffset && response.httpStatusCode() != 206) {
+        GST_ELEMENT_ERROR(m_src, RESOURCE, READ, (0), (0));
+        gst_app_src_end_of_stream(priv->appsrc);
+        webKitWebSrcStop(m_src, false);
+        return;
+    }
+
+    long long length = response.expectedContentLength();
+    if (length > 0) {
+        length += priv->requestedOffset;
+        gst_app_src_set_size(priv->appsrc, length);
+        if (!priv->haveAppSrc27) {
+            gst_segment_set_duration(&GST_BASE_SRC(priv->appsrc)->segment, GST_FORMAT_BYTES, length);
+            gst_element_post_message(GST_ELEMENT(priv->appsrc),
+                                     gst_message_new_duration(GST_OBJECT(priv->appsrc),
+                                                              GST_FORMAT_BYTES, length));
+        }
+    }
+
+    priv->size = length >= 0 ? length : 0;
+    priv->seekable = length > 0 && g_ascii_strcasecmp("none", response.httpHeaderField("Accept-Ranges").utf8().data());
+
+    // icecast stuff
+    String value = response.httpHeaderField("icy-metaint");
+    if (!value.isEmpty()) {
+        gchar* endptr = 0;
+        gint64 icyMetaInt = g_ascii_strtoll(value.utf8().data(), &endptr, 10);
+            
+        if (endptr && *endptr == '\0' && icyMetaInt > 0) {
+            GstCaps* caps = gst_caps_new_simple("application/x-icy", "metadata-interval", G_TYPE_INT, (gint) icyMetaInt, NULL);
+
+            gst_app_src_set_caps(priv->appsrc, caps);
+            gst_caps_unref(caps);
+        }
+    }
+
+    GstTagList* tags = gst_tag_list_new();
+    value = response.httpHeaderField("icy-name");
+    if (!value.isEmpty()) {
+        g_free(priv->iradioName);
+        priv->iradioName = g_strdup(value.utf8().data());
+        g_object_notify(G_OBJECT(m_src), "iradio-name");
+        gst_tag_list_add(tags, GST_TAG_MERGE_REPLACE, GST_TAG_ORGANIZATION, priv->iradioName, NULL);
+    }
+    value = response.httpHeaderField("icy-genre");
+    if (!value.isEmpty()) {
+        g_free(priv->iradioGenre);
+        priv->iradioGenre = g_strdup(value.utf8().data());
+        g_object_notify(G_OBJECT(m_src), "iradio-genre");
+        gst_tag_list_add(tags, GST_TAG_MERGE_REPLACE, GST_TAG_GENRE, priv->iradioGenre, NULL);
+    }
+    value = response.httpHeaderField("icy-url");
+    if (!value.isEmpty()) {
+        g_free(priv->iradioUrl);
+        priv->iradioUrl = g_strdup(value.utf8().data());
+        g_object_notify(G_OBJECT(m_src), "iradio-url");
+        gst_tag_list_add(tags, GST_TAG_MERGE_REPLACE, GST_TAG_LOCATION, priv->iradioUrl, NULL);
+    }
+    value = response.httpHeaderField("icy-title");
+    if (!value.isEmpty()) {
+        g_free(priv->iradioTitle);
+        priv->iradioTitle = g_strdup(value.utf8().data());
+        g_object_notify(G_OBJECT(m_src), "iradio-title");
+        gst_tag_list_add(tags, GST_TAG_MERGE_REPLACE, GST_TAG_TITLE, priv->iradioTitle, NULL);
+    }
+
+    if (gst_tag_list_is_empty(tags))
+        gst_tag_list_free(tags);
+    else
+        gst_element_found_tags_for_pad(GST_ELEMENT(m_src), m_src->priv->srcpad, tags);
+}
+
+void StreamingClient::didReceiveData(ResourceHandle* handle, const char* data, int length, int lengthReceived)
+{
+    WebKitWebSrcPrivate* priv = m_src->priv;
+
+    GST_LOG_OBJECT(m_src, "Have %d bytes of data", length);
+
+    if (priv->seekID || handle != priv->resourceHandle) {
+        GST_DEBUG_OBJECT(m_src, "Seek in progress, ignoring data");
+        return;
+    }
+
+    GstBuffer* buffer = gst_buffer_new_and_alloc(length);
+
+    memcpy(GST_BUFFER_DATA(buffer), data, length);
+    GST_BUFFER_OFFSET(buffer) = priv->offset;
+    priv->offset += length;
+    GST_BUFFER_OFFSET_END(buffer) = priv->offset;
+
+    GstFlowReturn ret = gst_app_src_push_buffer(priv->appsrc, buffer);
+    if (ret != GST_FLOW_OK && ret != GST_FLOW_UNEXPECTED)
+        GST_ELEMENT_ERROR(m_src, CORE, FAILED, (0), (0));
+}
+
+void StreamingClient::didFinishLoading(ResourceHandle*)
+{
+    GST_DEBUG_OBJECT(m_src, "Have EOS");
+    gst_app_src_end_of_stream(m_src->priv->appsrc);
+}
+
+void StreamingClient::didFail(ResourceHandle*, const ResourceError& error)
+{
+    GST_ERROR_OBJECT(m_src, "Have failure: %s", error.localizedDescription().utf8().data());
+    GST_ELEMENT_ERROR(m_src, RESOURCE, FAILED, ("%s", error.localizedDescription().utf8().data()), (0));
+    gst_app_src_end_of_stream(m_src->priv->appsrc);
+}
+
+void StreamingClient::wasBlocked(ResourceHandle*)
+{
+}
+
+void StreamingClient::cannotShowURL(ResourceHandle*)
+{
+}
+
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h
new file mode 100644
index 0000000000..ae196402a0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h
@@ -0,0 +1,52 @@
+/*
+ *  Copyright (C) 2009,2010 Sebastian Dröge <sebastian.droege@collabora.co.uk>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef WebKitWebSourceGStreamer_h
+#define WebKitWebSourceGStreamer_h
+
+#include "Frame.h"
+#include <gst/gst.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_WEB_SRC            (webkit_web_src_get_type ())
+#define WEBKIT_WEB_SRC(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), WEBKIT_TYPE_WEB_SRC, WebKitWebSrc))
+#define WEBKIT_WEB_SRC_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_WEB_SRC, WebKitWebSrcClass))
+#define WEBKIT_IS_WEB_SRC(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), WEBKIT_TYPE_WEB_SRC))
+#define WEBKIT_IS_WEB_SRC_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), WEBKIT_TYPE_WEB_SRC))
+
+typedef struct _WebKitWebSrc        WebKitWebSrc;
+typedef struct _WebKitWebSrcClass   WebKitWebSrcClass;
+typedef struct _WebKitWebSrcPrivate WebKitWebSrcPrivate;
+
+struct _WebKitWebSrc {
+    GstBin parent;
+
+    WebKitWebSrcPrivate *priv;
+};
+
+struct _WebKitWebSrcClass {
+    GstBinClass parentClass;
+};
+
+GType webkit_web_src_get_type(void);
+void  webKitWebSrcSetFrame(WebKitWebSrc* src, WebCore::Frame* frame);
+
+G_END_DECLS
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeSanitizer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeSanitizer.cpp
new file mode 100644
index 0000000000..b4cdb09f77
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeSanitizer.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(OPENTYPE_SANITIZER)
+#include "OpenTypeSanitizer.h"
+
+#include "SharedBuffer.h"
+#include "opentype-sanitiser.h"
+#include "ots-memory-stream.h"
+#include <wtf/OwnArrayPtr.h>
+
+namespace WebCore {
+
+PassRefPtr<SharedBuffer> OpenTypeSanitizer::sanitize()
+{
+    if (!m_buffer)
+        return 0;
+
+    // This is the largest web font size which we'll try to transcode.
+    static const size_t maxWebFontSize = 30 * 1024 * 1024; // 30 MB
+    if (m_buffer->size() > maxWebFontSize)
+        return 0;
+
+    // A transcoded font is usually smaller than an original font.
+    // However, it can be slightly bigger than the original one due to
+    // name table replacement and/or padding for glyf table.
+    static const size_t padLen = 20 * 1024; // 20 kB
+
+    OwnArrayPtr<unsigned char> transcodeRawBuffer(new unsigned char[m_buffer->size() + padLen]);
+    ots::MemoryStream output(transcodeRawBuffer.get(), m_buffer->size() + padLen);
+    if (!ots::Process(&output, reinterpret_cast<const uint8_t*>(m_buffer->data()), m_buffer->size()))
+        return 0;
+
+    const size_t transcodeLen = output.Tell();
+    return SharedBuffer::create(transcodeRawBuffer.get(), transcodeLen);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(OPENTYPE_SANITIZER)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeSanitizer.h b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeSanitizer.h
new file mode 100644
index 0000000000..3f93448fca
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeSanitizer.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef OpenTypeSanitizer_h
+#define OpenTypeSanitizer_h
+
+#if ENABLE(OPENTYPE_SANITIZER)
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class SharedBuffer;
+
+class OpenTypeSanitizer {
+public:
+    explicit OpenTypeSanitizer(SharedBuffer* buffer)
+        : m_buffer(buffer)
+    {
+    }
+
+    PassRefPtr<SharedBuffer> sanitize();
+
+private:
+    SharedBuffer* const m_buffer;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(OPENTYPE_SANITIZER)
+#endif // OpenTypeSanitizer_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
index b2e3d922e8..12ae09d931 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
@@ -401,7 +401,7 @@ static size_t renameFontInternal(SharedBuffer* fontData, const String& fontName,
     return nameTableSize;
 }
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 // AddFontMemResourceEx does not exist on WinCE, so we must handle the font data manually
 // This function just renames the font and overwrites the old font data with the new
 bool renameFont(SharedBuffer* fontData, const String& fontName)
@@ -435,7 +435,7 @@ HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
     DWORD numFonts = 0;
     HANDLE fontHandle = AddFontMemResourceEx(rewrittenFontData.data(), fontData->size() + nameTableSize, 0, &numFonts);
 
-    if (fontHandle && numFonts != 1) {
+    if (fontHandle && numFonts < 1) {
         RemoveFontMemResourceEx(fontHandle);
         return 0;
     }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.h b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
index 4c753142ce..0ef1b2b92b 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
@@ -36,7 +36,7 @@ struct BigEndianUShort;
 struct EOTPrefix;
 class SharedBuffer;
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 typedef unsigned __int8 UInt8;
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/openvg/EGLDisplayOpenVG.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/EGLDisplayOpenVG.cpp
new file mode 100644
index 0000000000..d681d7581f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/EGLDisplayOpenVG.cpp
@@ -0,0 +1,455 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "EGLDisplayOpenVG.h"
+
+#include "EGLUtils.h"
+#include "IntSize.h"
+#include "SurfaceOpenVG.h"
+
+#include <wtf/Assertions.h>
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+// Need to typedef this, otherwise DEFINE_STATIC_LOCAL() doesn't swallow it.
+typedef HashMap<EGLDisplay, EGLDisplayOpenVG*> EGLDisplayManagerMap;
+
+// File-static variables.
+static EGLDisplayManagerMap& displayManagers()
+{
+    DEFINE_STATIC_LOCAL(EGLDisplayManagerMap, managers, ());
+    return managers;
+}
+
+static EGLDisplayOpenVG* s_current = 0;
+
+// Static class members.
+
+SurfaceOpenVG* EGLDisplayOpenVG::currentSurface()
+{
+    EGLDisplayManagerMap& managers = displayManagers();
+    EGLDisplay currentDisplay = eglGetCurrentDisplay();
+
+    if (currentDisplay == EGL_NO_DISPLAY || !managers.contains(currentDisplay))
+        return 0;
+
+    EGLDisplayOpenVG* displayManager = managers.get(currentDisplay);
+    EGLSurface currentSurface = eglGetCurrentSurface(EGL_DRAW);
+
+    if (currentSurface == EGL_NO_SURFACE || !displayManager->m_platformSurfaces.contains(currentSurface))
+        return 0;
+
+    return displayManager->m_platformSurfaces.get(currentSurface);
+}
+
+void EGLDisplayOpenVG::registerPlatformSurface(SurfaceOpenVG* platformSurface)
+{
+    EGLDisplayOpenVG* displayManager = EGLDisplayOpenVG::forDisplay(platformSurface->eglDisplay());
+    displayManager->m_platformSurfaces.set(platformSurface->eglSurface(), platformSurface);
+}
+
+void EGLDisplayOpenVG::unregisterPlatformSurface(SurfaceOpenVG* platformSurface)
+{
+    EGLDisplayOpenVG* displayManager = EGLDisplayOpenVG::forDisplay(platformSurface->eglDisplay());
+    displayManager->m_platformSurfaces.remove(platformSurface->eglSurface());
+}
+
+void EGLDisplayOpenVG::setCurrentDisplay(const EGLDisplay& display)
+{
+    s_current = EGLDisplayOpenVG::forDisplay(display);
+}
+
+EGLDisplayOpenVG* EGLDisplayOpenVG::current()
+{
+    if (!s_current) {
+        EGLDisplay display = eglGetDisplay(EGL_DEFAULT_DISPLAY);
+        eglInitialize(display, 0, 0);
+        ASSERT_EGL_NO_ERROR();
+
+        s_current = EGLDisplayOpenVG::forDisplay(display);
+    }
+    return s_current;
+}
+
+EGLDisplayOpenVG* EGLDisplayOpenVG::forDisplay(const EGLDisplay& display)
+{
+    EGLDisplayManagerMap& managers = displayManagers();
+
+    if (!managers.contains(display))
+        managers.set(display, new EGLDisplayOpenVG(display));
+
+    return managers.get(display);
+}
+
+
+// Object/instance members.
+
+EGLDisplayOpenVG::EGLDisplayOpenVG(const EGLDisplay& display)
+    : m_display(display)
+    , m_sharedPlatformSurface(0)
+    , m_pbufferConfigId(0)
+    , m_windowConfigId(0)
+{
+    eglBindAPI(EGL_OPENVG_API);
+    ASSERT_EGL_NO_ERROR();
+}
+
+EGLDisplayOpenVG::~EGLDisplayOpenVG()
+{
+    eglMakeCurrent(m_display, EGL_NO_SURFACE, EGL_NO_SURFACE, EGL_NO_CONTEXT);
+    ASSERT_EGL_NO_ERROR();
+
+    delete m_sharedPlatformSurface;
+
+    HashMap<EGLSurface, EGLint>::const_iterator end = m_surfaceConfigIds.end();
+    for (HashMap<EGLSurface, EGLint>::const_iterator it = m_surfaceConfigIds.begin(); it != end; ++it)
+        destroySurface((*it).first);
+
+    eglTerminate(m_display);
+    ASSERT_EGL_NO_ERROR();
+}
+
+void EGLDisplayOpenVG::setDefaultPbufferConfig(const EGLConfig& config)
+{
+    EGLint configId;
+    EGLBoolean success = eglGetConfigAttrib(m_display, config, EGL_CONFIG_ID, &configId);
+    ASSERT(success == EGL_TRUE);
+    ASSERT(configId != EGL_BAD_ATTRIBUTE);
+
+    m_pbufferConfigId = configId;
+}
+
+EGLConfig EGLDisplayOpenVG::defaultPbufferConfig()
+{
+    EGLConfig config;
+    EGLint numConfigs;
+
+    // Hopefully the client will have set the pbuffer config of its choice
+    // by now - if not, use a 32-bit generic one as default.
+    if (!m_pbufferConfigId) {
+        static const EGLint configAttribs[] = {
+            EGL_RED_SIZE, 8,
+            EGL_GREEN_SIZE, 8,
+            EGL_BLUE_SIZE, 8,
+            EGL_ALPHA_SIZE, 8,
+            EGL_ALPHA_MASK_SIZE, 1,
+            EGL_LUMINANCE_SIZE, EGL_DONT_CARE,
+            EGL_SURFACE_TYPE, EGL_PBUFFER_BIT,
+            EGL_RENDERABLE_TYPE, EGL_OPENVG_BIT,
+            EGL_NONE
+        };
+        eglChooseConfig(m_display, configAttribs, &config, 1, &numConfigs);
+    } else {
+        const EGLint configAttribs[] = {
+            EGL_CONFIG_ID, m_pbufferConfigId,
+            EGL_NONE
+        };
+        eglChooseConfig(m_display, configAttribs, &config, 1, &numConfigs);
+    }
+
+    ASSERT_EGL_NO_ERROR();
+    ASSERT(numConfigs == 1);
+    return config;
+}
+
+void EGLDisplayOpenVG::setDefaultWindowConfig(const EGLConfig& config)
+{
+    EGLint configId;
+    EGLBoolean success = eglGetConfigAttrib(m_display, config, EGL_CONFIG_ID, &configId);
+    ASSERT(success == EGL_TRUE);
+    ASSERT(configId != EGL_BAD_ATTRIBUTE);
+
+    m_windowConfigId = configId;
+}
+
+EGLConfig EGLDisplayOpenVG::defaultWindowConfig()
+{
+    EGLConfig config;
+    EGLint numConfigs;
+
+    // Hopefully the client will have set the window config of its choice
+    // by now - if not, use a 32-bit generic one as default.
+    if (!m_windowConfigId) {
+        static const EGLint configAttribs[] = {
+            EGL_RED_SIZE, 8,
+            EGL_GREEN_SIZE, 8,
+            EGL_BLUE_SIZE, 8,
+            EGL_ALPHA_SIZE, 8,
+            EGL_ALPHA_MASK_SIZE, 1,
+            EGL_LUMINANCE_SIZE, EGL_DONT_CARE,
+            EGL_SURFACE_TYPE, EGL_WINDOW_BIT,
+            EGL_RENDERABLE_TYPE, EGL_OPENVG_BIT,
+            EGL_NONE
+        };
+        eglChooseConfig(m_display, configAttribs, &config, 1, &numConfigs);
+    } else {
+        const EGLint configAttribs[] = {
+            EGL_CONFIG_ID, m_windowConfigId,
+            EGL_NONE
+        };
+        eglChooseConfig(m_display, configAttribs, &config, 1, &numConfigs);
+    }
+
+    ASSERT_EGL_NO_ERROR();
+    ASSERT(numConfigs == 1);
+    return config;
+}
+
+SurfaceOpenVG* EGLDisplayOpenVG::sharedPlatformSurface()
+{
+    if (!m_sharedPlatformSurface) {
+        // The shared surface doesn't need to be drawn on, it just exists so
+        // that we can always make the shared context current (which in turn is
+        // the owner of long-living resources such as images, paths and fonts).
+        // We'll just make the shared surface as small as possible: 1x1 pixel.
+        EGLConfig config = defaultPbufferConfig();
+        EGLSurface surface = createPbufferSurface(IntSize(1, 1), config);
+
+        EGLContext context = eglCreateContext(m_display, config, EGL_NO_CONTEXT, 0);
+        ASSERT_EGL_NO_ERROR();
+        m_contexts.set(m_surfaceConfigIds.get(surface), context);
+
+        m_sharedPlatformSurface = new SurfaceOpenVG;
+        m_sharedPlatformSurface->m_eglDisplay = m_display;
+        m_sharedPlatformSurface->m_eglSurface = surface;
+        m_sharedPlatformSurface->m_eglContext = context;
+        m_platformSurfaces.set(surface, m_sharedPlatformSurface); // a.k.a. registerPlatformSurface()
+    }
+    return m_sharedPlatformSurface;
+}
+
+EGLSurface EGLDisplayOpenVG::createPbufferSurface(const IntSize& size, const EGLConfig& config, EGLint* errorCode)
+{
+    const EGLint attribList[] = {
+        EGL_WIDTH, size.width(),
+        EGL_HEIGHT, size.height(),
+        EGL_NONE
+    };
+    EGLSurface surface = eglCreatePbufferSurface(m_display, config, attribList);
+
+    if (errorCode)
+        *errorCode = eglGetError();
+    else
+        ASSERT_EGL_NO_ERROR();
+
+    if (surface == EGL_NO_SURFACE)
+        return EGL_NO_SURFACE;
+
+    EGLint surfaceConfigId;
+    EGLBoolean success = eglGetConfigAttrib(m_display, config, EGL_CONFIG_ID, &surfaceConfigId);
+    ASSERT(success == EGL_TRUE);
+    ASSERT(surfaceConfigId != EGL_BAD_ATTRIBUTE);
+
+    ASSERT(!m_surfaceConfigIds.contains(surface));
+    m_surfaceConfigIds.set(surface, surfaceConfigId);
+    return surface;
+}
+
+EGLSurface EGLDisplayOpenVG::createPbufferFromClientBuffer(
+    EGLClientBuffer clientBuffer, EGLenum bufferType, const EGLConfig& config, EGLint* errorCode)
+{
+    EGLSurface surface = eglCreatePbufferFromClientBuffer(m_display,
+        bufferType, clientBuffer, config, 0 /* attribList */);
+
+    if (errorCode)
+        *errorCode = eglGetError();
+    else
+        ASSERT_EGL_NO_ERROR();
+
+    if (surface == EGL_NO_SURFACE)
+        return EGL_NO_SURFACE;
+
+    EGLint surfaceConfigId;
+    EGLBoolean success = eglGetConfigAttrib(m_display, config, EGL_CONFIG_ID, &surfaceConfigId);
+    ASSERT(success == EGL_TRUE);
+    ASSERT(surfaceConfigId != EGL_BAD_ATTRIBUTE);
+
+    ASSERT(!m_surfaceConfigIds.contains(surface));
+    m_surfaceConfigIds.set(surface, surfaceConfigId);
+    return surface;
+}
+
+EGLSurface EGLDisplayOpenVG::surfaceForWindow(EGLNativeWindowType wId, const EGLConfig& config)
+{
+    if (m_windowSurfaces.contains(wId))
+        return m_windowSurfaces.get(wId);
+
+    EGLSurface surface = eglCreateWindowSurface(m_display, config, wId, 0);
+    ASSERT_EGL_NO_ERROR();
+
+    EGLint surfaceConfigId;
+    EGLBoolean success = eglGetConfigAttrib(m_display, config, EGL_CONFIG_ID, &surfaceConfigId);
+    ASSERT(success == EGL_TRUE);
+    ASSERT(surfaceConfigId != EGL_BAD_ATTRIBUTE);
+
+    ASSERT(!m_surfaceConfigIds.contains(surface));
+    m_surfaceConfigIds.set(surface, surfaceConfigId);
+    return surface;
+}
+
+bool EGLDisplayOpenVG::surfacesCompatible(const EGLSurface& surface, const EGLSurface& otherSurface)
+{
+    if (surface == EGL_NO_SURFACE || otherSurface == EGL_NO_SURFACE)
+        return false;
+
+    // Currently, we assume that all surfaces known to this object are
+    // context-compatible to each other (which is reasonable to assume,
+    // otherwise eglCreateContext() would fail with EGL_BAD_MATCH for shared
+    // context compatibility anyways.
+    return m_surfaceConfigIds.contains(surface) && m_surfaceConfigIds.contains(otherSurface);
+}
+
+void EGLDisplayOpenVG::destroySurface(const EGLSurface& surface)
+{
+    ASSERT(surface != EGL_NO_SURFACE);
+
+    if (eglGetCurrentSurface(EGL_DRAW) == surface) {
+        eglMakeCurrent(m_display, EGL_NO_SURFACE, EGL_NO_SURFACE, EGL_NO_CONTEXT);
+        ASSERT_EGL_NO_ERROR();
+    }
+
+    // Destroy the context associated to the surface, if we already created one.
+    if (m_surfaceConfigIds.contains(surface)) {
+        EGLint surfaceConfigId = m_surfaceConfigIds.take(surface); // take = get and remove
+        bool isContextReferenced = false;
+
+        if (m_compatibleConfigIds.contains(surfaceConfigId))
+            surfaceConfigId = m_compatibleConfigIds.get(surfaceConfigId);
+
+        HashMap<EGLSurface, EGLint>::iterator end = m_surfaceConfigIds.end();
+
+        // ...but only if there's no other surfaces associated to that context.
+        for (HashMap<EGLSurface, EGLint>::iterator it = m_surfaceConfigIds.begin(); it != end; ++it) {
+            if ((*it).second == surfaceConfigId) {
+                isContextReferenced = true;
+                break;
+            }
+        }
+        if (!isContextReferenced && m_contexts.contains(surfaceConfigId)) {
+            EGLContext context = m_contexts.take(surfaceConfigId);
+            eglDestroyContext(m_display, context);
+            ASSERT_EGL_NO_ERROR();
+        }
+    }
+
+    m_platformSurfaces.remove(surface);
+
+    HashMap<EGLNativeWindowType, EGLSurface>::iterator end = m_windowSurfaces.end();
+    for (HashMap<EGLNativeWindowType, EGLSurface>::iterator it = m_windowSurfaces.begin(); it != end; ++it) {
+        if ((*it).second == surface) {
+            m_windowSurfaces.remove(it);
+            break;
+        }
+    }
+
+    eglDestroySurface(m_display, surface);
+    ASSERT_EGL_NO_ERROR();
+}
+
+EGLContext EGLDisplayOpenVG::contextForSurface(const EGLSurface& surface)
+{
+    ASSERT(surface != EGL_NO_SURFACE);
+
+    if (m_platformSurfaces.contains(surface))
+        return m_platformSurfaces.get(surface)->eglContext();
+
+    eglBindAPI(EGL_OPENVG_API);
+    ASSERT_EGL_NO_ERROR();
+
+    EGLint surfaceConfigId;
+
+    if (m_surfaceConfigIds.contains(surface))
+        surfaceConfigId = m_surfaceConfigIds.get(surface);
+    else {
+        // Retrieve the same EGL config for context creation that was used to
+        // create the the EGL surface.
+        EGLBoolean success = eglQuerySurface(m_display, surface, EGL_CONFIG_ID, &surfaceConfigId);
+        ASSERT(success == EGL_TRUE);
+        ASSERT(surfaceConfigId != EGL_BAD_ATTRIBUTE);
+
+        m_surfaceConfigIds.set(surface, surfaceConfigId);
+    }
+
+    if (m_compatibleConfigIds.contains(surfaceConfigId))
+        surfaceConfigId = m_compatibleConfigIds.get(surfaceConfigId);
+
+    if (m_contexts.contains(surfaceConfigId))
+        return m_contexts.get(surfaceConfigId);
+
+    if (!m_sharedPlatformSurface) // shared context has not been created yet
+        sharedPlatformSurface(); // creates the shared surface & context
+
+    EGLDisplay currentDisplay = eglGetCurrentDisplay();
+    EGLSurface currentReadSurface = eglGetCurrentSurface(EGL_READ);
+    EGLSurface currentDrawSurface = eglGetCurrentSurface(EGL_DRAW);
+    EGLContext currentContext = eglGetCurrentContext();
+
+    // Before creating a new context, let's try whether an existing one
+    // is compatible with the surface. EGL doesn't give us a different way
+    // to check context/surface compatibility than trying it out, so let's
+    // do just that.
+    HashMap<EGLint, EGLContext>::iterator end = m_contexts.end();
+
+    for (HashMap<EGLint, EGLContext>::iterator it = m_contexts.begin(); it != end; ++it) {
+        eglMakeCurrent(m_display, surface, surface, (*it).second);
+        if (eglGetError() == EGL_SUCCESS) {
+            // Restore previous surface/context.
+            if (currentContext != EGL_NO_CONTEXT) {
+                eglMakeCurrent(currentDisplay, currentReadSurface, currentDrawSurface, currentContext);
+                ASSERT_EGL_NO_ERROR();
+            }
+            // Cool, surface is compatible to one of our existing contexts.
+            m_compatibleConfigIds.set(surfaceConfigId, (*it).first);
+            return (*it).second;
+        }
+    }
+    // Restore previous surface/context.
+    if (currentContext != EGL_NO_CONTEXT) {
+        eglMakeCurrent(currentDisplay, currentReadSurface, currentDrawSurface, currentContext);
+        ASSERT_EGL_NO_ERROR();
+    }
+
+    EGLConfig config;
+    EGLint numConfigs;
+
+    const EGLint configAttribs[] = {
+        EGL_CONFIG_ID, surfaceConfigId,
+        EGL_NONE
+    };
+
+    eglChooseConfig(m_display, configAttribs, &config, 1, &numConfigs);
+    ASSERT_EGL_NO_ERROR();
+    ASSERT(numConfigs == 1);
+
+    // We share all of the images and paths amongst the different contexts,
+    // so that they can be used in all of them. Resources that are created
+    // while m_sharedPlatformSurface->context() is current will be
+    // accessible from all other contexts, but are not restricted to the
+    // lifetime of those contexts.
+    EGLContext context = eglCreateContext(m_display, config, m_sharedPlatformSurface->eglContext(), 0);
+    ASSERT_EGL_NO_ERROR();
+
+    ASSERT(!m_contexts.contains(surfaceConfigId));
+    m_contexts.set(surfaceConfigId, context);
+    return context;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/openvg/EGLDisplayOpenVG.h b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/EGLDisplayOpenVG.h
new file mode 100644
index 0000000000..0dff6c9387
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/EGLDisplayOpenVG.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef EGLDisplayOpenVG_h
+#define EGLDisplayOpenVG_h
+
+#include <egl.h>
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+class IntSize;
+class SurfaceOpenVG;
+
+class EGLDisplayOpenVG {
+public:
+    friend class SurfaceOpenVG;
+
+    static SurfaceOpenVG* currentSurface();
+    static void setCurrentDisplay(const EGLDisplay&);
+    static EGLDisplayOpenVG* current();
+    static EGLDisplayOpenVG* forDisplay(const EGLDisplay&);
+
+    void setDefaultPbufferConfig(const EGLConfig&);
+    EGLConfig defaultPbufferConfig();
+    void setDefaultWindowConfig(const EGLConfig&);
+    EGLConfig defaultWindowConfig();
+
+    EGLDisplay display() const { return m_display; }
+    SurfaceOpenVG* sharedPlatformSurface();
+
+    /** Creates a pbuffer surface using the given config. If no surface
+     * could be created, EGL_NO_SURFACE is returned and errors can be
+     * checked with the value that is written to the errorCode parameter
+     * If no surface could be created and errorCode is zero, this method
+     * will trigger an assertion by itself. */
+    EGLSurface createPbufferSurface(const IntSize&, const EGLConfig&, EGLint* errorCode = 0);
+    EGLSurface createPbufferFromClientBuffer(EGLClientBuffer, EGLenum bufferType, const EGLConfig&, EGLint* errorCode = 0);
+
+    EGLSurface surfaceForWindow(EGLNativeWindowType, const EGLConfig&);
+
+    bool surfacesCompatible(const EGLSurface&, const EGLSurface&);
+
+    /** Destroy the surface and its corresponding context (unless another
+     * surface is still using the same context, in which case the context
+     * is not destroyed). */
+    void destroySurface(const EGLSurface&);
+
+    /** Return the context corresponding to the surface.
+     * If no corresponding context exists, one is created automatically. */
+    EGLContext contextForSurface(const EGLSurface&);
+
+private:
+    static void registerPlatformSurface(SurfaceOpenVG*);
+    static void unregisterPlatformSurface(SurfaceOpenVG*);
+
+    EGLDisplayOpenVG(const EGLDisplay& display);
+    ~EGLDisplayOpenVG();
+
+    EGLDisplay m_display;
+    SurfaceOpenVG* m_sharedPlatformSurface;
+    EGLint m_pbufferConfigId;
+    EGLint m_windowConfigId;
+
+    HashMap<EGLSurface, SurfaceOpenVG*> m_platformSurfaces;
+    HashMap<EGLNativeWindowType, EGLSurface> m_windowSurfaces;
+    HashMap<EGLSurface, EGLint> m_surfaceConfigIds;
+    HashMap<EGLint, EGLint> m_compatibleConfigIds;
+    HashMap<EGLint, EGLContext> m_contexts;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/openvg/EGLUtils.h b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/EGLUtils.h
new file mode 100644
index 0000000000..6f5d793c0d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/EGLUtils.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef EGLUtils_h
+#define EGLUtils_h
+
+#include <egl.h>
+#include <wtf/Assertions.h>
+
+static inline const char* toEGLErrorConstant(EGLint error)
+{
+    switch (error) {
+    case EGL_NOT_INITIALIZED:
+        return "EGL_NOT_INITIALIZED";
+    case EGL_BAD_ACCESS:
+        return "EGL_BAD_ACCESS";
+    case EGL_BAD_ALLOC:
+        return "EGL_BAD_ALLOC";
+    case EGL_BAD_ATTRIBUTE:
+        return "EGL_BAD_ATTRIBUTE";
+    case EGL_BAD_CONTEXT:
+        return "EGL_BAD_CONTEXT";
+    case EGL_BAD_CONFIG:
+        return "EGL_BAD_CONFIG";
+    case EGL_BAD_CURRENT_SURFACE:
+        return "EGL_BAD_CURRENT_SURFACE";
+    case EGL_BAD_DISPLAY:
+        return "EGL_BAD_DISPLAY";
+    case EGL_BAD_SURFACE:
+        return "EGL_BAD_SURFACE";
+    case EGL_BAD_MATCH:
+        return "EGL_BAD_MATCH";
+    case EGL_BAD_PARAMETER:
+        return "EGL_BAD_PARAMETER";
+    case EGL_BAD_NATIVE_PIXMAP:
+        return "EGL_BAD_NATIVE_PIXMAP";
+    case EGL_BAD_NATIVE_WINDOW:
+        return "EGL_BAD_NATIVE_WINDOW";
+    case EGL_CONTEXT_LOST:
+        return "EGL_CONTEXT_LOST";
+    default:
+        return "UNKNOWN_ERROR";
+    }
+}
+
+#if ASSERT_DISABLED
+#define ASSERT_EGL_NO_ERROR() ((void)0)
+#else
+#define ASSERT_EGL_NO_ERROR() do { \
+    EGLint eglErrorCode = eglGetError(); \
+    ASSERT_WITH_MESSAGE(eglErrorCode == EGL_SUCCESS, "Found %s", toEGLErrorConstant(eglErrorCode)); \
+} while (0)
+#endif
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/openvg/GraphicsContextOpenVG.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/GraphicsContextOpenVG.cpp
new file mode 100644
index 0000000000..54cc7ee381
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/GraphicsContextOpenVG.cpp
@@ -0,0 +1,577 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "GraphicsContext.h"
+
+#include "AffineTransform.h"
+#include "GraphicsContextPrivate.h"
+#include "KURL.h"
+#include "NotImplemented.h"
+#include "PainterOpenVG.h"
+#include "SurfaceOpenVG.h"
+
+#include <wtf/Assertions.h>
+#include <wtf/MathExtras.h>
+#include <wtf/UnusedParam.h>
+#include <wtf/Vector.h>
+
+#if PLATFORM(EGL)
+#include "EGLDisplayOpenVG.h"
+#include "EGLUtils.h"
+#include <egl.h>
+#endif
+
+namespace WebCore {
+
+// typedef'ing doesn't work, let's inherit from PainterOpenVG instead
+class GraphicsContextPlatformPrivate : public PainterOpenVG {
+public:
+    GraphicsContextPlatformPrivate(SurfaceOpenVG* surface)
+        : PainterOpenVG(surface)
+    {
+    }
+};
+
+GraphicsContext::GraphicsContext(SurfaceOpenVG* surface)
+    : m_common(createGraphicsContextPrivate())
+    , m_data(surface ? new GraphicsContextPlatformPrivate(surface) : 0)
+{
+    setPaintingDisabled(!surface);
+}
+
+GraphicsContext::~GraphicsContext()
+{
+    destroyGraphicsContextPrivate(m_common);
+    delete m_data;
+}
+
+PlatformGraphicsContext* GraphicsContext::platformContext() const
+{
+    if (paintingDisabled())
+        return 0;
+
+    return m_data->baseSurface();
+}
+
+AffineTransform GraphicsContext::getCTM() const
+{
+    if (paintingDisabled())
+        return AffineTransform();
+
+    return m_data->transformation();
+}
+
+void GraphicsContext::savePlatformState()
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->save();
+}
+
+void GraphicsContext::restorePlatformState()
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->restore();
+}
+
+void GraphicsContext::drawRect(const IntRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->drawRect(rect);
+}
+
+void GraphicsContext::drawLine(const IntPoint& from, const IntPoint& to)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->drawLine(from, to);
+}
+
+/**
+ * Draw the largest ellipse that fits into the given rectangle.
+ */
+void GraphicsContext::drawEllipse(const IntRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->drawEllipse(rect);
+}
+
+void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSpan)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->drawArc(rect, startAngle, angleSpan, VG_STROKE_PATH);
+}
+
+void GraphicsContext::drawConvexPolygon(size_t numPoints, const FloatPoint* points, bool shouldAntialias)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->drawPolygon(numPoints, points);
+
+    UNUSED_PARAM(shouldAntialias); // FIXME
+}
+
+void GraphicsContext::fillPath()
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->drawPath(VG_FILL_PATH, m_common->state.fillRule);
+}
+
+void GraphicsContext::strokePath()
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->drawPath(VG_STROKE_PATH, m_common->state.fillRule);
+}
+
+void GraphicsContext::drawPath()
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->drawPath(VG_FILL_PATH | VG_STROKE_PATH, m_common->state.fillRule);
+}
+
+void GraphicsContext::fillRect(const FloatRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->drawRect(rect, VG_FILL_PATH);
+}
+
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
+{
+    if (paintingDisabled())
+        return;
+
+    Color oldColor = m_data->fillColor();
+    m_data->setFillColor(color);
+    m_data->drawRect(rect, VG_FILL_PATH);
+    m_data->setFillColor(oldColor);
+
+    UNUSED_PARAM(colorSpace); // FIXME
+}
+
+void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
+{
+    if (paintingDisabled())
+        return;
+
+    Color oldColor = m_data->fillColor();
+    m_data->setFillColor(color);
+    m_data->drawRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight, VG_FILL_PATH);
+    m_data->setFillColor(oldColor);
+
+    UNUSED_PARAM(colorSpace); // FIXME
+}
+
+void GraphicsContext::beginPath()
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->beginPath();
+}
+
+void GraphicsContext::addPath(const Path& path)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->addPath(path);
+}
+
+void GraphicsContext::clip(const FloatRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->intersectClipRect(rect);
+}
+
+void GraphicsContext::clipPath(WindRule clipRule)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->clipPath(*(m_data->currentPath()), PainterOpenVG::IntersectClip, clipRule);
+}
+
+void GraphicsContext::drawFocusRing(const Vector<IntRect>& rects, int width, int offset, const Color& color)
+{
+    if (paintingDisabled())
+        return;
+
+    if (rects.isEmpty())
+        return;
+
+    // FIXME: We just unite all focus ring rects into one for now.
+    // We should outline the edge of the full region.
+    offset += (width - 1) / 2;
+    IntRect finalFocusRect;
+
+    for (unsigned i = 0; i < rects.size(); i++) {
+        IntRect focusRect = rects[i];
+        focusRect.inflate(offset);
+        finalFocusRect.unite(focusRect);
+    }
+
+    StrokeStyle oldStyle = m_data->strokeStyle();
+    Color oldStrokeColor = m_data->strokeColor();
+    m_data->setStrokeStyle(DashedStroke);
+    m_data->setStrokeColor(color);
+    strokeRect(FloatRect(finalFocusRect), 1.f);
+    m_data->setStrokeStyle(oldStyle);
+    m_data->setStrokeColor(oldStrokeColor);
+}
+
+void GraphicsContext::drawLineForText(const IntPoint& origin, int width, bool printing)
+{
+    if (paintingDisabled())
+        return;
+
+    if (width <= 0)
+        return;
+
+    StrokeStyle oldStyle = m_data->strokeStyle();
+    m_data->setStrokeStyle(SolidStroke);
+    drawLine(origin, origin + IntSize(width, 0));
+    m_data->setStrokeStyle(oldStyle);
+
+    UNUSED_PARAM(printing);
+}
+
+void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint& origin, int width, bool grammar)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+    UNUSED_PARAM(origin);
+    UNUSED_PARAM(width);
+    UNUSED_PARAM(grammar);
+}
+
+FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
+{
+    if (paintingDisabled())
+        return FloatRect();
+
+    return FloatRect(enclosingIntRect(m_data->transformation().mapRect(rect)));
+}
+
+void GraphicsContext::setPlatformShadow(const IntSize& size, int blur, const Color& color, ColorSpace colorSpace)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+    UNUSED_PARAM(size);
+    UNUSED_PARAM(blur);
+    UNUSED_PARAM(color);
+    UNUSED_PARAM(colorSpace);
+}
+
+void GraphicsContext::clearPlatformShadow()
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::beginTransparencyLayer(float opacity)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+    UNUSED_PARAM(opacity);
+}
+
+void GraphicsContext::endTransparencyLayer()
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::clearRect(const FloatRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    CompositeOperator op = m_data->compositeOperation();
+    m_data->setCompositeOperation(CompositeClear);
+    m_data->drawRect(rect, VG_FILL_PATH);
+    m_data->setCompositeOperation(op);
+}
+
+void GraphicsContext::strokeRect(const FloatRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->drawRect(rect, VG_STROKE_PATH);
+}
+
+void GraphicsContext::strokeRect(const FloatRect& rect, float lineWidth)
+{
+    if (paintingDisabled())
+        return;
+
+    float oldThickness = m_data->strokeThickness();
+    m_data->setStrokeThickness(lineWidth);
+    m_data->drawRect(rect, VG_STROKE_PATH);
+    m_data->setStrokeThickness(oldThickness);
+}
+
+void GraphicsContext::setLineCap(LineCap lc)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->setLineCap(lc);
+}
+
+void GraphicsContext::setLineDash(const DashArray& dashes, float dashOffset)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->setLineDash(dashes, dashOffset);
+}
+
+void GraphicsContext::setLineJoin(LineJoin lj)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->setLineJoin(lj);
+}
+
+void GraphicsContext::setMiterLimit(float limit)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->setMiterLimit(limit);
+}
+
+void GraphicsContext::setAlpha(float opacity)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->setOpacity(opacity);
+}
+
+void GraphicsContext::setCompositeOperation(CompositeOperator op)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->setCompositeOperation(op);
+}
+
+void GraphicsContext::clip(const Path& path)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->clipPath(path, PainterOpenVG::IntersectClip, m_common->state.fillRule);
+}
+
+void GraphicsContext::canvasClip(const Path& path)
+{
+    clip(path);
+}
+
+void GraphicsContext::clipOut(const Path& path)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->clipPath(path, PainterOpenVG::SubtractClip, m_common->state.fillRule);
+}
+
+void GraphicsContext::scale(const FloatSize& scaleFactors)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->scale(scaleFactors);
+}
+
+void GraphicsContext::rotate(float radians)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->rotate(radians);
+}
+
+void GraphicsContext::translate(float dx, float dy)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->translate(dx, dy);
+}
+
+IntPoint GraphicsContext::origin()
+{
+    if (paintingDisabled())
+        return IntPoint();
+
+    AffineTransform transformation = m_data->transformation();
+    return IntPoint(roundf(transformation.e()), roundf(transformation.f()));
+}
+
+void GraphicsContext::clipOut(const IntRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    Path path;
+    path.addRect(rect);
+    m_data->clipPath(path, PainterOpenVG::SubtractClip, m_common->state.fillRule);
+}
+
+void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    Path path;
+    path.addEllipse(rect);
+    m_data->clipPath(path, PainterOpenVG::SubtractClip, m_common->state.fillRule);
+}
+
+void GraphicsContext::clipToImageBuffer(const FloatRect& rect, const ImageBuffer* imageBuffer)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+    UNUSED_PARAM(rect);
+    UNUSED_PARAM(imageBuffer);
+}
+
+void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness)
+{
+    if (paintingDisabled())
+        return;
+
+    Path path;
+    path.addEllipse(rect);
+    path.addEllipse(FloatRect(rect.x() + thickness, rect.y() + thickness,
+        rect.width() - (thickness * 2), rect.height() - (thickness * 2)));
+
+    m_data->clipPath(path, PainterOpenVG::IntersectClip, m_common->state.fillRule);
+}
+
+void GraphicsContext::concatCTM(const AffineTransform& transformation)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->concatTransformation(transformation);
+}
+
+void GraphicsContext::setURLForRect(const KURL& link, const IntRect& destRect)
+{
+    notImplemented();
+    UNUSED_PARAM(link);
+    UNUSED_PARAM(destRect);
+}
+
+void GraphicsContext::setPlatformStrokeColor(const Color& color, ColorSpace colorSpace)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->setStrokeColor(color);
+
+    UNUSED_PARAM(colorSpace); // FIXME
+}
+
+void GraphicsContext::setPlatformStrokeStyle(const StrokeStyle& strokeStyle)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->setStrokeStyle(strokeStyle);
+}
+
+void GraphicsContext::setPlatformStrokeThickness(float thickness)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->setStrokeThickness(thickness);
+}
+
+void GraphicsContext::setPlatformFillColor(const Color& color, ColorSpace colorSpace)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->setFillColor(color);
+
+    UNUSED_PARAM(colorSpace); // FIXME
+}
+
+void GraphicsContext::setPlatformShouldAntialias(bool enable)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->setAntialiasingEnabled(enable);
+}
+
+void GraphicsContext::setImageInterpolationQuality(InterpolationQuality)
+{
+    notImplemented();
+}
+
+InterpolationQuality GraphicsContext::imageInterpolationQuality() const
+{
+    notImplemented();
+    return InterpolationDefault;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/openvg/PainterOpenVG.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/PainterOpenVG.cpp
new file mode 100644
index 0000000000..5842afd094
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/PainterOpenVG.cpp
@@ -0,0 +1,1178 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "PainterOpenVG.h"
+
+#include "AffineTransform.h"
+#include "Color.h"
+#include "DashArray.h"
+#include "FloatPoint.h"
+#include "FloatQuad.h"
+#include "FloatRect.h"
+#include "IntRect.h"
+#include "IntSize.h"
+#include "NotImplemented.h"
+#include "PlatformPathOpenVG.h"
+#include "SurfaceOpenVG.h"
+#include "VGUtils.h"
+
+#if PLATFORM(EGL)
+#include "EGLUtils.h"
+#endif
+
+#include <vgu.h>
+
+#include <wtf/Assertions.h>
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+static bool isNonRotatedAffineTransformation(const AffineTransform& t)
+{
+    return t.b() <= FLT_EPSILON && t.c() <= FLT_EPSILON;
+}
+
+static VGCapStyle toVGCapStyle(LineCap lineCap)
+{
+    switch (lineCap) {
+    case RoundCap:
+        return VG_CAP_ROUND;
+    case SquareCap:
+        return VG_CAP_SQUARE;
+    case ButtCap:
+    default:
+        return VG_CAP_BUTT;
+    }
+}
+
+static VGJoinStyle toVGJoinStyle(LineJoin lineJoin)
+{
+    switch (lineJoin) {
+    case RoundJoin:
+        return VG_JOIN_ROUND;
+    case BevelJoin:
+        return VG_JOIN_BEVEL;
+    case MiterJoin:
+    default:
+        return VG_JOIN_MITER;
+    }
+}
+
+static VGFillRule toVGFillRule(WindRule fillRule)
+{
+    return fillRule == RULE_EVENODD ? VG_EVEN_ODD : VG_NON_ZERO;
+}
+
+static VGuint colorToVGColor(const Color& color)
+{
+    VGuint vgColor = color.red();
+    vgColor = (vgColor << 8) | color.green();
+    vgColor = (vgColor << 8) | color.blue();
+    vgColor = (vgColor << 8) | color.alpha();
+    return vgColor;
+}
+
+static void setVGSolidColor(VGPaintMode paintMode, const Color& color)
+{
+    VGPaint paint = vgCreatePaint();
+    vgSetParameteri(paint, VG_PAINT_TYPE, VG_PAINT_TYPE_COLOR);
+    vgSetColor(paint, colorToVGColor(color));
+    vgSetPaint(paint, paintMode);
+    vgDestroyPaint(paint);
+    ASSERT_VG_NO_ERROR();
+}
+
+
+struct PlatformPainterState {
+    AffineTransform surfaceTransformation;
+    CompositeOperator compositeOperation;
+    float opacity;
+
+    bool scissoringEnabled;
+    FloatRect scissorRect;
+#ifdef OPENVG_VERSION_1_1
+    bool maskingChangedAndEnabled;
+    VGMaskLayer mask;
+#endif
+
+    Color fillColor;
+    StrokeStyle strokeStyle;
+    Color strokeColor;
+    float strokeThickness;
+    LineCap strokeLineCap;
+    LineJoin strokeLineJoin;
+    float strokeMiterLimit;
+    DashArray strokeDashArray;
+    float strokeDashOffset;
+
+    int textDrawingMode;
+    bool antialiasingEnabled;
+
+    PlatformPainterState()
+        : compositeOperation(CompositeSourceOver)
+        , opacity(1.0)
+        , scissoringEnabled(false)
+#ifdef OPENVG_VERSION_1_1
+        , maskingChangedAndEnabled(false)
+        , mask(VG_INVALID_HANDLE)
+#endif
+        , fillColor(Color::black)
+        , strokeStyle(NoStroke)
+        , strokeThickness(0.0)
+        , strokeLineCap(ButtCap)
+        , strokeLineJoin(MiterJoin)
+        , strokeMiterLimit(4.0)
+        , strokeDashOffset(0.0)
+        , textDrawingMode(cTextFill)
+        , antialiasingEnabled(true)
+    {
+    }
+
+    ~PlatformPainterState()
+    {
+#ifdef OPENVG_VERSION_1_1
+        if (maskingChangedAndEnabled && mask != VG_INVALID_HANDLE) {
+            vgDestroyMaskLayer(mask);
+            ASSERT_VG_NO_ERROR();
+            mask = VG_INVALID_HANDLE;
+        }
+#endif
+    }
+
+    PlatformPainterState(const PlatformPainterState& state)
+    {
+        surfaceTransformation = state.surfaceTransformation;
+
+        scissoringEnabled = state.scissoringEnabled;
+        scissorRect = state.scissorRect;
+#ifdef OPENVG_VERSION_1_1
+        maskingChangedAndEnabled = false;
+        mask = state.mask;
+#endif
+        copyPaintState(&state);
+    }
+
+    inline bool maskingEnabled()
+    {
+        return maskingChangedAndEnabled || mask != VG_INVALID_HANDLE;
+    }
+
+    void copyPaintState(const PlatformPainterState* other)
+    {
+        compositeOperation = other->compositeOperation;
+        opacity = other->opacity;
+
+        fillColor = other->fillColor;
+        strokeStyle = other->strokeStyle;
+        strokeColor = other->strokeColor;
+        strokeThickness = other->strokeThickness;
+        strokeLineCap = other->strokeLineCap;
+        strokeLineJoin = other->strokeLineJoin;
+        strokeMiterLimit = other->strokeMiterLimit;
+        strokeDashArray = other->strokeDashArray;
+        strokeDashOffset = other->strokeDashOffset;
+
+        textDrawingMode = other->textDrawingMode;
+        antialiasingEnabled = other->antialiasingEnabled;
+    }
+
+    void applyState(PainterOpenVG* painter)
+    {
+        ASSERT(painter);
+
+        setVGSolidColor(VG_FILL_PATH, fillColor);
+        setVGSolidColor(VG_STROKE_PATH, strokeColor);
+
+        vgSetf(VG_STROKE_LINE_WIDTH, strokeThickness);
+        vgSeti(VG_STROKE_CAP_STYLE, toVGCapStyle(strokeLineCap));
+        vgSeti(VG_STROKE_JOIN_STYLE, toVGJoinStyle(strokeLineJoin));
+        vgSetf(VG_STROKE_MITER_LIMIT, strokeMiterLimit);
+
+        if (antialiasingEnabled)
+            vgSeti(VG_RENDERING_QUALITY, VG_RENDERING_QUALITY_FASTER);
+        else
+            vgSeti(VG_RENDERING_QUALITY, VG_RENDERING_QUALITY_NONANTIALIASED);
+
+        applyBlending(painter);
+        applyStrokeStyle();
+
+        applyTransformation(painter);
+        applyScissorRect();
+
+#ifdef OPENVG_VERSION_1_1
+        if (maskingEnabled()) {
+            vgSeti(VG_MASKING, VG_TRUE);
+            if (mask != VG_INVALID_HANDLE)
+                vgMask(mask, VG_SET_MASK, 0, 0, painter->surface()->width(), painter->surface()->height());
+        } else
+            vgSeti(VG_MASKING, VG_FALSE);
+#endif
+        ASSERT_VG_NO_ERROR();
+    }
+
+    void applyBlending(PainterOpenVG* painter)
+    {
+        VGBlendMode blendMode = VG_BLEND_SRC_OVER;
+
+        switch (compositeOperation) {
+        case CompositeClear: {
+            // Clear means "set to fully transparent regardless of SRC".
+            // We implement that by multiplying DST with white color
+            // (= no changes) and an alpha of 1.0 - opacity, so the destination
+            // pixels will be fully transparent when opacity == 1.0 and
+            // unchanged when opacity == 0.0.
+            blendMode = VG_BLEND_DST_IN;
+            const VGfloat values[] = { 0.0, 0.0, 0.0, 0.0, 1.0, 1.0, 1.0, 1.0 - opacity };
+            vgSetfv(VG_COLOR_TRANSFORM_VALUES, 8, values);
+            vgSeti(VG_COLOR_TRANSFORM, VG_TRUE);
+            ASSERT_VG_NO_ERROR();
+            break;
+        }
+        case CompositeCopy:
+            blendMode = VG_BLEND_SRC;
+            break;
+        case CompositeSourceOver:
+            blendMode = VG_BLEND_SRC_OVER;
+            break;
+        case CompositeSourceIn:
+            blendMode = VG_BLEND_SRC_IN;
+            break;
+        case CompositeSourceOut:
+            notImplemented();
+            break;
+        case CompositeSourceAtop:
+            notImplemented();
+            break;
+        case CompositeDestinationOver:
+            blendMode = VG_BLEND_DST_OVER;
+            break;
+        case CompositeDestinationIn:
+            blendMode = VG_BLEND_DST_IN;
+            break;
+        case CompositeDestinationOut:
+            notImplemented();
+            break;
+        case CompositeDestinationAtop:
+            notImplemented();
+            break;
+        case CompositeXOR:
+            notImplemented();
+            break;
+        case CompositePlusDarker:
+            blendMode = VG_BLEND_DARKEN;
+            break;
+        case CompositeHighlight:
+            notImplemented();
+            break;
+        case CompositePlusLighter:
+            blendMode = VG_BLEND_LIGHTEN;
+            break;
+        }
+
+        if (compositeOperation != CompositeClear) {
+            if (opacity >= (1.0 - FLT_EPSILON))
+                vgSeti(VG_COLOR_TRANSFORM, VG_FALSE);
+            else if (blendMode == VG_BLEND_SRC) {
+                blendMode = VG_BLEND_SRC_OVER;
+                VGfloat values[] = { 1.0, 1.0, 1.0, 0.0, 0.0, 0.0, 0.0, opacity };
+                vgSetfv(VG_COLOR_TRANSFORM_VALUES, 8, values);
+                vgSeti(VG_COLOR_TRANSFORM, VG_TRUE);
+            } else {
+                VGfloat values[] = { 1.0, 1.0, 1.0, opacity, 0.0, 0.0, 0.0, 0.0 };
+                vgSetfv(VG_COLOR_TRANSFORM_VALUES, 8, values);
+                vgSeti(VG_COLOR_TRANSFORM, VG_TRUE);
+            }
+            ASSERT_VG_NO_ERROR();
+        }
+
+        vgSeti(VG_BLEND_MODE, blendMode);
+        ASSERT_VG_NO_ERROR();
+    }
+
+    void applyTransformation(PainterOpenVG* painter)
+    {
+        // There are *five* separate transforms that can be applied to OpenVG as of 1.1
+        // but it is not clear that we need to set them separately.  Instead we set them
+        // all right here and let this be a call to essentially set the world transformation!
+        VGMatrix vgMatrix(surfaceTransformation);
+        const VGfloat* vgFloatArray = vgMatrix.toVGfloat();
+
+        vgSeti(VG_MATRIX_MODE, VG_MATRIX_PATH_USER_TO_SURFACE);
+        vgLoadMatrix(vgFloatArray);
+        ASSERT_VG_NO_ERROR();
+
+        vgSeti(VG_MATRIX_MODE, VG_MATRIX_IMAGE_USER_TO_SURFACE);
+        vgLoadMatrix(vgFloatArray);
+        ASSERT_VG_NO_ERROR();
+
+#ifdef OPENVG_VERSION_1_1
+        vgSeti(VG_MATRIX_MODE, VG_MATRIX_GLYPH_USER_TO_SURFACE);
+        vgLoadMatrix(vgFloatArray);
+        ASSERT_VG_NO_ERROR();
+#endif
+    }
+
+    void applyScissorRect()
+    {
+        if (scissoringEnabled) {
+            vgSeti(VG_SCISSORING, VG_TRUE);
+            vgSetfv(VG_SCISSOR_RECTS, 4, VGRect(scissorRect).toVGfloat());
+        } else
+            vgSeti(VG_SCISSORING, VG_FALSE);
+
+        ASSERT_VG_NO_ERROR();
+    }
+
+    void applyStrokeStyle()
+    {
+        if (strokeStyle == DottedStroke) {
+            VGfloat vgFloatArray[2] = { 1.0, 1.0 };
+            vgSetfv(VG_STROKE_DASH_PATTERN, 2, vgFloatArray);
+            vgSetf(VG_STROKE_DASH_PHASE, 0.0);
+        } else if (strokeStyle == DashedStroke) {
+            if (!strokeDashArray.size()) {
+                VGfloat vgFloatArray[2] = { 4.0, 3.0 };
+                vgSetfv(VG_STROKE_DASH_PATTERN, 2, vgFloatArray);
+            } else {
+                Vector<VGfloat> vgFloatArray(strokeDashArray.size());
+                for (int i = 0; i < strokeDashArray.size(); ++i)
+                    vgFloatArray[i] = strokeDashArray[i];
+
+                vgSetfv(VG_STROKE_DASH_PATTERN, vgFloatArray.size(), vgFloatArray.data());
+            }
+            vgSetf(VG_STROKE_DASH_PHASE, strokeDashOffset);
+        } else {
+            vgSetfv(VG_STROKE_DASH_PATTERN, 0, 0);
+            vgSetf(VG_STROKE_DASH_PHASE, 0.0);
+        }
+
+        ASSERT_VG_NO_ERROR();
+    }
+
+    inline bool strokeDisabled() const
+    {
+        return (compositeOperation == CompositeSourceOver
+            && (strokeStyle == NoStroke || !strokeColor.alpha()));
+    }
+
+    inline bool fillDisabled() const
+    {
+        return (compositeOperation == CompositeSourceOver && !fillColor.alpha());
+    }
+
+    void saveMaskIfNecessary(PainterOpenVG* painter)
+    {
+#ifdef OPENVG_VERSION_1_1
+        if (maskingChangedAndEnabled) {
+            if (mask != VG_INVALID_HANDLE) {
+                vgDestroyMaskLayer(mask);
+                ASSERT_VG_NO_ERROR();
+            }
+            mask = vgCreateMaskLayer(painter->surface()->width(), painter->surface()->height());
+            ASSERT(mask != VG_INVALID_HANDLE);
+            vgCopyMask(mask, 0, 0, 0, 0, painter->surface()->width(), painter->surface()->height());
+            ASSERT_VG_NO_ERROR();
+        }
+#endif
+    }
+};
+
+
+PainterOpenVG::PainterOpenVG()
+    : m_state(0)
+    , m_surface(0)
+    , m_currentPath(0)
+{
+}
+
+PainterOpenVG::PainterOpenVG(SurfaceOpenVG* surface)
+    : m_state(0)
+    , m_surface(0)
+    , m_currentPath(0)
+{
+    ASSERT(surface);
+    begin(surface);
+}
+
+PainterOpenVG::~PainterOpenVG()
+{
+    end();
+    delete m_currentPath;
+}
+
+void PainterOpenVG::begin(SurfaceOpenVG* surface)
+{
+    if (surface == m_surface)
+        return;
+
+    ASSERT(surface);
+    ASSERT(!m_state);
+
+    m_surface = surface;
+
+    m_stateStack.append(new PlatformPainterState());
+    m_state = m_stateStack.last();
+
+    m_surface->setActivePainter(this);
+    m_surface->makeCurrent();
+}
+
+void PainterOpenVG::end()
+{
+    if (!m_surface)
+        return;
+
+    m_surface->setActivePainter(0);
+    m_surface = 0;
+
+    destroyPainterStates();
+}
+
+void PainterOpenVG::destroyPainterStates()
+{
+    PlatformPainterState* state = 0;
+    while (!m_stateStack.isEmpty()) {
+        state = m_stateStack.last();
+        m_stateStack.removeLast();
+        delete state;
+    }
+    m_state = 0;
+}
+
+// Called by friend SurfaceOpenVG, private otherwise.
+void PainterOpenVG::applyState()
+{
+    ASSERT(m_state);
+    m_state->applyState(this);
+}
+
+/**
+ * Copy the current back buffer image onto the surface.
+ *
+ * Call this method when all painting operations have been completed,
+ * otherwise the surface won't visibly change.
+ */
+void PainterOpenVG::blitToSurface()
+{
+    ASSERT(m_state); // implies m_surface
+    m_surface->flush();
+}
+
+AffineTransform PainterOpenVG::transformation() const
+{
+    ASSERT(m_state);
+    return m_state->surfaceTransformation;
+}
+
+void PainterOpenVG::concatTransformation(const AffineTransform& transformation)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    // We do the multiplication ourself using WebCore's AffineTransform rather
+    // than offloading this to VG via vgMultMatrix() to keep things simple and
+    // so we can maintain state ourselves.
+    m_state->surfaceTransformation.multLeft(transformation);
+    m_state->applyTransformation(this);
+}
+
+void PainterOpenVG::setTransformation(const AffineTransform& transformation)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    m_state->surfaceTransformation = transformation;
+    m_state->applyTransformation(this);
+}
+
+void PainterOpenVG::transformPath(VGPath dst, VGPath src, const AffineTransform& transformation)
+{
+    vgSeti(VG_MATRIX_MODE, VG_MATRIX_PATH_USER_TO_SURFACE);
+
+    // Save the transform state
+    VGfloat currentMatrix[9];
+    vgGetMatrix(currentMatrix);
+    ASSERT_VG_NO_ERROR();
+
+    // Load the new transform
+    vgLoadMatrix(VGMatrix(transformation).toVGfloat());
+    ASSERT_VG_NO_ERROR();
+
+    // Apply the new transform
+    vgTransformPath(dst, src);
+    ASSERT_VG_NO_ERROR();
+
+    // Restore the transform state
+    vgLoadMatrix(currentMatrix);
+    ASSERT_VG_NO_ERROR();
+}
+
+CompositeOperator PainterOpenVG::compositeOperation() const
+{
+    ASSERT(m_state);
+    return m_state->compositeOperation;
+}
+
+void PainterOpenVG::setCompositeOperation(CompositeOperator op)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    m_state->compositeOperation = op;
+    m_state->applyBlending(this);
+}
+
+float PainterOpenVG::opacity() const
+{
+    ASSERT(m_state);
+    return m_state->opacity;
+}
+
+void PainterOpenVG::setOpacity(float opacity)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    m_state->opacity = opacity;
+    m_state->applyBlending(this);
+}
+
+float PainterOpenVG::strokeThickness() const
+{
+    ASSERT(m_state);
+    return m_state->strokeThickness;
+}
+
+void PainterOpenVG::setStrokeThickness(float thickness)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    m_state->strokeThickness = thickness;
+    vgSetf(VG_STROKE_LINE_WIDTH, thickness);
+    ASSERT_VG_NO_ERROR();
+}
+
+StrokeStyle PainterOpenVG::strokeStyle() const
+{
+    ASSERT(m_state);
+    return m_state->strokeStyle;
+}
+
+void PainterOpenVG::setStrokeStyle(const StrokeStyle& style)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    m_state->strokeStyle = style;
+    m_state->applyStrokeStyle();
+}
+
+void PainterOpenVG::setLineDash(const DashArray& dashArray, float dashOffset)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    m_state->strokeDashArray = dashArray;
+    m_state->strokeDashOffset = dashOffset;
+    m_state->applyStrokeStyle();
+}
+
+void PainterOpenVG::setLineCap(LineCap lineCap)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    m_state->strokeLineCap = lineCap;
+    vgSeti(VG_STROKE_CAP_STYLE, toVGCapStyle(lineCap));
+    ASSERT_VG_NO_ERROR();
+}
+
+void PainterOpenVG::setLineJoin(LineJoin lineJoin)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    m_state->strokeLineJoin = lineJoin;
+    vgSeti(VG_STROKE_JOIN_STYLE, toVGJoinStyle(lineJoin));
+    ASSERT_VG_NO_ERROR();
+}
+
+void PainterOpenVG::setMiterLimit(float miterLimit)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    m_state->strokeMiterLimit = miterLimit;
+    vgSetf(VG_STROKE_MITER_LIMIT, miterLimit);
+    ASSERT_VG_NO_ERROR();
+}
+
+Color PainterOpenVG::strokeColor() const
+{
+    ASSERT(m_state);
+    return m_state->strokeColor;
+}
+
+void PainterOpenVG::setStrokeColor(const Color& color)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    m_state->strokeColor = color;
+    setVGSolidColor(VG_STROKE_PATH, color);
+}
+
+Color PainterOpenVG::fillColor() const
+{
+    ASSERT(m_state);
+    return m_state->fillColor;
+}
+
+void PainterOpenVG::setFillColor(const Color& color)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    m_state->fillColor = color;
+    setVGSolidColor(VG_FILL_PATH, color);
+}
+
+int PainterOpenVG::textDrawingMode() const
+{
+    ASSERT(m_state);
+    return m_state->textDrawingMode;
+}
+
+void PainterOpenVG::setTextDrawingMode(int mode)
+{
+    ASSERT(m_state);
+    m_state->textDrawingMode = mode;
+}
+
+bool PainterOpenVG::antialiasingEnabled() const
+{
+    ASSERT(m_state);
+    return m_state->antialiasingEnabled;
+}
+
+void PainterOpenVG::setAntialiasingEnabled(bool enabled)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    m_state->antialiasingEnabled = enabled;
+
+    if (enabled)
+        vgSeti(VG_RENDERING_QUALITY, VG_RENDERING_QUALITY_FASTER);
+    else
+        vgSeti(VG_RENDERING_QUALITY, VG_RENDERING_QUALITY_NONANTIALIASED);
+}
+
+void PainterOpenVG::scale(const FloatSize& scaleFactors)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    AffineTransform transformation = m_state->surfaceTransformation;
+    transformation.scaleNonUniform(scaleFactors.width(), scaleFactors.height());
+    setTransformation(transformation);
+}
+
+void PainterOpenVG::rotate(float radians)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    AffineTransform transformation = m_state->surfaceTransformation;
+    transformation.rotate(rad2deg(radians));
+    setTransformation(transformation);
+}
+
+void PainterOpenVG::translate(float dx, float dy)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    AffineTransform transformation = m_state->surfaceTransformation;
+    transformation.translate(dx, dy);
+    setTransformation(transformation);
+}
+
+void PainterOpenVG::beginPath()
+{
+    delete m_currentPath;
+    m_currentPath = new Path();
+}
+
+void PainterOpenVG::addPath(const Path& path)
+{
+    m_currentPath->platformPath()->makeCompatibleContextCurrent();
+
+    vgAppendPath(m_currentPath->platformPath()->vgPath(), path.platformPath()->vgPath());
+    ASSERT_VG_NO_ERROR();
+}
+
+Path* PainterOpenVG::currentPath() const
+{
+    return m_currentPath;
+}
+
+void PainterOpenVG::drawPath(VGbitfield specifiedPaintModes, WindRule fillRule)
+{
+    ASSERT(m_state);
+
+    VGbitfield paintModes = 0;
+    if (!m_state->strokeDisabled())
+        paintModes |= VG_STROKE_PATH;
+    if (!m_state->fillDisabled())
+        paintModes |= VG_FILL_PATH;
+
+    paintModes &= specifiedPaintModes;
+
+    if (!paintModes)
+        return;
+
+    m_surface->makeCurrent();
+
+    vgSeti(VG_FILL_RULE, toVGFillRule(fillRule));
+    vgDrawPath(m_currentPath->platformPath()->vgPath(), paintModes);
+    ASSERT_VG_NO_ERROR();
+}
+
+void PainterOpenVG::intersectScissorRect(const FloatRect& rect)
+{
+    // Scissor rectangles are defined by float values, but e.g. painting
+    // something red to a float-clipped rectangle and then painting something
+    // white to the same rectangle will leave some red remnants as it is
+    // rendered to full pixels in between. Also, some OpenVG implementations
+    // are likely to clip to integer coordinates anyways because of the above
+    // effect. So considering the above (and confirming through tests) the
+    // visual result is better if we clip to the enclosing integer rectangle
+    // rather than the exact float rectangle for scissoring.
+    if (m_state->scissoringEnabled)
+        m_state->scissorRect.intersect(FloatRect(enclosingIntRect(rect)));
+    else {
+        m_state->scissoringEnabled = true;
+        m_state->scissorRect = FloatRect(enclosingIntRect(rect));
+    }
+
+    m_state->applyScissorRect();
+}
+
+void PainterOpenVG::intersectClipRect(const FloatRect& rect)
+{
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    if (m_state->surfaceTransformation.isIdentity()) {
+        // No transformation required, skip all the complex stuff.
+        intersectScissorRect(rect);
+        return;
+    }
+
+    // Check if the actual destination rectangle is still rectilinear (can be
+    // represented as FloatRect) so we could apply scissoring instead of
+    // (potentially more expensive) path clipping. Note that scissoring is not
+    // subject to transformations, so we need to do the transformation to
+    // surface coordinates by ourselves.
+    FloatQuad effectiveScissorQuad = m_state->surfaceTransformation.mapQuad(FloatQuad(rect));
+
+    if (effectiveScissorQuad.isRectilinear())
+        intersectScissorRect(effectiveScissorQuad.boundingBox());
+    else {
+        // The transformed scissorRect cannot be represented as FloatRect
+        // anymore, so we need to perform masking instead.
+        Path scissorRectPath;
+        scissorRectPath.addRect(rect);
+        clipPath(scissorRectPath, PainterOpenVG::IntersectClip);
+    }
+}
+
+void PainterOpenVG::clipPath(const Path& path, PainterOpenVG::ClipOperation maskOp, WindRule clipRule)
+{
+#ifdef OPENVG_VERSION_1_1
+    ASSERT(m_state);
+    m_surface->makeCurrent();
+
+    if (m_state->mask != VG_INVALID_HANDLE && !m_state->maskingChangedAndEnabled) {
+        // The parent's mask has been inherited - dispose the handle so that
+        // it won't be overwritten.
+        m_state->maskingChangedAndEnabled = true;
+        m_state->mask = VG_INVALID_HANDLE;
+    } else if (!m_state->maskingEnabled()) {
+        // None of the parent painter states had a mask enabled yet.
+        m_state->maskingChangedAndEnabled = true;
+        vgSeti(VG_MASKING, VG_TRUE);
+        // Make sure not to inherit previous mask state from previously written
+        // (but disabled) masks. For VG_FILL_MASK the first argument is ignored,
+        // we pass VG_INVALID_HANDLE which is what the OpenVG spec suggests.
+        vgMask(VG_INVALID_HANDLE, VG_FILL_MASK, 0, 0, m_surface->width(), m_surface->height());
+    }
+
+    // Intersect the path from the mask, or subtract it from there.
+    // (In either case we always decrease the visible area, never increase it,
+    // which means masking never has to modify scissor rectangles.)
+    vgSeti(VG_FILL_RULE, toVGFillRule(clipRule));
+    vgRenderToMask(path.platformPath()->vgPath(), VG_FILL_PATH, (VGMaskOperation) maskOp);
+    ASSERT_VG_NO_ERROR();
+#elseif
+    notImplemented();
+#endif
+}
+
+void PainterOpenVG::drawRect(const FloatRect& rect, VGbitfield specifiedPaintModes)
+{
+    ASSERT(m_state);
+
+    VGbitfield paintModes = 0;
+    if (!m_state->strokeDisabled())
+        paintModes |= VG_STROKE_PATH;
+    if (!m_state->fillDisabled())
+        paintModes |= VG_FILL_PATH;
+
+    paintModes &= specifiedPaintModes;
+
+    if (!paintModes)
+        return;
+
+    m_surface->makeCurrent();
+
+    VGPath path = vgCreatePath(
+        VG_PATH_FORMAT_STANDARD, VG_PATH_DATATYPE_F,
+        1.0 /* scale */, 0.0 /* bias */,
+        5 /* expected number of segments */,
+        5 /* expected number of total coordinates */,
+        VG_PATH_CAPABILITY_APPEND_TO);
+    ASSERT_VG_NO_ERROR();
+
+    if (vguRect(path, rect.x(), rect.y(), rect.width(), rect.height()) == VGU_NO_ERROR) {
+        vgDrawPath(path, paintModes);
+        ASSERT_VG_NO_ERROR();
+    }
+
+    vgDestroyPath(path);
+    ASSERT_VG_NO_ERROR();
+}
+
+void PainterOpenVG::drawRoundedRect(const FloatRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, VGbitfield specifiedPaintModes)
+{
+    ASSERT(m_state);
+
+    VGbitfield paintModes = 0;
+    if (!m_state->strokeDisabled())
+        paintModes |= VG_STROKE_PATH;
+    if (!m_state->fillDisabled())
+        paintModes |= VG_FILL_PATH;
+
+    paintModes &= specifiedPaintModes;
+
+    if (!paintModes)
+        return;
+
+    m_surface->makeCurrent();
+
+    VGPath path = vgCreatePath(
+        VG_PATH_FORMAT_STANDARD, VG_PATH_DATATYPE_F,
+        1.0 /* scale */, 0.0 /* bias */,
+        10 /* expected number of segments */,
+        25 /* expected number of total coordinates */,
+        VG_PATH_CAPABILITY_APPEND_TO);
+    ASSERT_VG_NO_ERROR();
+
+    // clamp corner arc sizes
+    FloatSize clampedTopLeft = FloatSize(topLeft).shrunkTo(rect.size()).expandedTo(FloatSize());
+    FloatSize clampedTopRight = FloatSize(topRight).shrunkTo(rect.size()).expandedTo(FloatSize());
+    FloatSize clampedBottomLeft = FloatSize(bottomLeft).shrunkTo(rect.size()).expandedTo(FloatSize());
+    FloatSize clampedBottomRight = FloatSize(bottomRight).shrunkTo(rect.size()).expandedTo(FloatSize());
+
+    // As OpenVG's coordinate system is flipped in comparison to WebKit's,
+    // we have to specify the opposite value for the "clockwise" value.
+    static const VGubyte pathSegments[] = {
+        VG_MOVE_TO_ABS,
+        VG_HLINE_TO_REL,
+        VG_SCCWARC_TO_REL,
+        VG_VLINE_TO_REL,
+        VG_SCCWARC_TO_REL,
+        VG_HLINE_TO_REL,
+        VG_SCCWARC_TO_REL,
+        VG_VLINE_TO_REL,
+        VG_SCCWARC_TO_REL,
+        VG_CLOSE_PATH
+    };
+    // Also, the rounded rectangle path proceeds from the top to the bottom,
+    // requiring height distances and clamped radius sizes to be flipped.
+    const VGfloat pathData[] = {
+        rect.x() + clampedTopLeft.width(), rect.y(),
+        rect.width() - clampedTopLeft.width() - clampedTopRight.width(),
+        clampedTopRight.width(), clampedTopRight.height(), 0, clampedTopRight.width(), clampedTopRight.height(),
+        rect.height() - clampedTopRight.height() - clampedBottomRight.height(),
+        clampedBottomRight.width(), clampedBottomRight.height(), 0, -clampedBottomRight.width(), clampedBottomRight.height(),
+        -(rect.width() - clampedBottomLeft.width() - clampedBottomRight.width()),
+        clampedBottomLeft.width(), clampedBottomLeft.height(), 0, -clampedBottomLeft.width(), -clampedBottomLeft.height(),
+        -(rect.height() - clampedTopLeft.height() - clampedBottomLeft.height()),
+        clampedTopLeft.width(), clampedTopLeft.height(), 0, clampedTopLeft.width(), -clampedTopLeft.height(),
+    };
+
+    vgAppendPathData(path, 10, pathSegments, pathData);
+    vgDrawPath(path, paintModes);
+    vgDestroyPath(path);
+    ASSERT_VG_NO_ERROR();
+}
+
+void PainterOpenVG::drawLine(const IntPoint& from, const IntPoint& to)
+{
+    ASSERT(m_state);
+
+    if (m_state->strokeDisabled())
+        return;
+
+    m_surface->makeCurrent();
+
+    VGPath path = vgCreatePath(
+        VG_PATH_FORMAT_STANDARD, VG_PATH_DATATYPE_F,
+        1.0 /* scale */, 0.0 /* bias */,
+        2 /* expected number of segments */,
+        4 /* expected number of total coordinates */,
+        VG_PATH_CAPABILITY_APPEND_TO);
+    ASSERT_VG_NO_ERROR();
+
+    VGUErrorCode errorCode;
+
+    // Try to align lines to pixels, centering them between pixels for odd thickness values.
+    if (fmod(m_state->strokeThickness + 0.5, 2.0) < 1.0)
+        errorCode = vguLine(path, from.x(), from.y(), to.x(), to.y());
+    else if ((to.y() - from.y()) > (to.x() - from.x())) // more vertical than horizontal
+        errorCode = vguLine(path, from.x() + 0.5, from.y(), to.x() + 0.5, to.y());
+    else
+        errorCode = vguLine(path, from.x(), from.y() + 0.5, to.x(), to.y() + 0.5);
+
+    if (errorCode == VGU_NO_ERROR) {
+        vgDrawPath(path, VG_STROKE_PATH);
+        ASSERT_VG_NO_ERROR();
+    }
+
+    vgDestroyPath(path);
+    ASSERT_VG_NO_ERROR();
+}
+
+void PainterOpenVG::drawArc(const IntRect& rect, int startAngle, int angleSpan, VGbitfield specifiedPaintModes)
+{
+    ASSERT(m_state);
+
+    VGbitfield paintModes = 0;
+    if (!m_state->strokeDisabled())
+        paintModes |= VG_STROKE_PATH;
+    if (!m_state->fillDisabled())
+        paintModes |= VG_FILL_PATH;
+
+    paintModes &= specifiedPaintModes;
+
+    if (!paintModes)
+        return;
+
+    m_surface->makeCurrent();
+
+    VGPath path = vgCreatePath(
+        VG_PATH_FORMAT_STANDARD, VG_PATH_DATATYPE_F,
+        1.0 /* scale */, 0.0 /* bias */,
+        2 /* expected number of segments */,
+        4 /* expected number of total coordinates */,
+        VG_PATH_CAPABILITY_APPEND_TO);
+    ASSERT_VG_NO_ERROR();
+
+    if (vguArc(path, rect.x() + rect.width() / 2.0, rect.y() + rect.height() / 2.0, rect.width(), rect.height(), -startAngle, -angleSpan, VGU_ARC_OPEN) == VGU_NO_ERROR) {
+        vgDrawPath(path, VG_STROKE_PATH);
+        ASSERT_VG_NO_ERROR();
+    }
+
+    vgDestroyPath(path);
+    ASSERT_VG_NO_ERROR();
+}
+
+void PainterOpenVG::drawEllipse(const IntRect& rect, VGbitfield specifiedPaintModes)
+{
+    ASSERT(m_state);
+
+    VGbitfield paintModes = 0;
+    if (!m_state->strokeDisabled())
+        paintModes |= VG_STROKE_PATH;
+    if (!m_state->fillDisabled())
+        paintModes |= VG_FILL_PATH;
+
+    paintModes &= specifiedPaintModes;
+
+    if (!paintModes)
+        return;
+
+    m_surface->makeCurrent();
+
+    VGPath path = vgCreatePath(
+        VG_PATH_FORMAT_STANDARD, VG_PATH_DATATYPE_F,
+        1.0 /* scale */, 0.0 /* bias */,
+        4 /* expected number of segments */,
+        12 /* expected number of total coordinates */,
+        VG_PATH_CAPABILITY_APPEND_TO);
+    ASSERT_VG_NO_ERROR();
+
+    if (vguEllipse(path, rect.x() + rect.width() / 2.0, rect.y() + rect.height() / 2.0, rect.width(), rect.height()) == VGU_NO_ERROR) {
+        vgDrawPath(path, paintModes);
+        ASSERT_VG_NO_ERROR();
+    }
+
+    vgDestroyPath(path);
+    ASSERT_VG_NO_ERROR();
+}
+
+void PainterOpenVG::drawPolygon(size_t numPoints, const FloatPoint* points, VGbitfield specifiedPaintModes)
+{
+    ASSERT(m_state);
+
+    VGbitfield paintModes = 0;
+    if (!m_state->strokeDisabled())
+        paintModes |= VG_STROKE_PATH;
+    if (!m_state->fillDisabled())
+        paintModes |= VG_FILL_PATH;
+
+    paintModes &= specifiedPaintModes;
+
+    if (!paintModes)
+        return;
+
+    m_surface->makeCurrent();
+
+    // Path segments: all points + "close path".
+    const VGint numSegments = numPoints + 1;
+    const VGint numCoordinates = numPoints * 2;
+
+    VGPath path = vgCreatePath(
+        VG_PATH_FORMAT_STANDARD, VG_PATH_DATATYPE_F,
+        1.0 /* scale */, 0.0 /* bias */,
+        numSegments /* expected number of segments */,
+        numCoordinates /* expected number of total coordinates */,
+        VG_PATH_CAPABILITY_APPEND_TO);
+    ASSERT_VG_NO_ERROR();
+
+    Vector<VGfloat> vgPoints(numCoordinates);
+    for (int i = 0; i < numPoints; ++i) {
+        vgPoints[i*2]     = points[i].x();
+        vgPoints[i*2 + 1] = points[i].y();
+    }
+
+    if (vguPolygon(path, vgPoints.data(), numPoints, VG_TRUE /* closed */) == VGU_NO_ERROR) {
+        vgDrawPath(path, paintModes);
+        ASSERT_VG_NO_ERROR();
+    }
+
+    vgDestroyPath(path);
+    ASSERT_VG_NO_ERROR();
+}
+
+#ifdef OPENVG_VERSION_1_1
+void PainterOpenVG::drawText(VGFont vgFont, Vector<VGuint>& characters, VGfloat* adjustmentsX, VGfloat* adjustmentsY, const FloatPoint& point)
+{
+    ASSERT(m_state);
+
+    VGbitfield paintModes = 0;
+
+    if (m_state->textDrawingMode & cTextClip)
+        return; // unsupported for every port except CG at the time of writing
+    if (m_state->textDrawingMode & cTextFill && !m_state->fillDisabled())
+        paintModes |= VG_FILL_PATH;
+    if (m_state->textDrawingMode & cTextStroke && !m_state->strokeDisabled())
+        paintModes |= VG_STROKE_PATH;
+
+    m_surface->makeCurrent();
+
+    FloatPoint effectivePoint = m_state->surfaceTransformation.mapPoint(point);
+    FloatPoint p = point;
+    AffineTransform* originalTransformation = 0;
+
+    // In case the font isn't drawn at a pixel-exact baseline and we can easily
+    // fix that (which is the case for non-rotated affine transforms), let's
+    // align the starting point to the pixel boundary in order to prevent
+    // font rendering issues such as glyphs that appear off by a pixel.
+    // This causes us to have inconsistent spacing between baselines in a
+    // larger paragraph, but that seems to be the least of all evils.
+    if ((fmod(effectivePoint.x() + 0.01, 1.0) > 0.02 || fmod(effectivePoint.y() + 0.01, 1.0) > 0.02)
+        && isNonRotatedAffineTransformation(m_state->surfaceTransformation))
+    {
+        originalTransformation = new AffineTransform(m_state->surfaceTransformation);
+        setTransformation(AffineTransform(
+            m_state->surfaceTransformation.a(), 0,
+            0, m_state->surfaceTransformation.d(),
+            roundf(effectivePoint.x()), roundf(effectivePoint.y())));
+        p = FloatPoint();
+    }
+
+    const VGfloat vgPoint[2] = { p.x(), p.y() };
+    vgSetfv(VG_GLYPH_ORIGIN, 2, vgPoint);
+    ASSERT_VG_NO_ERROR();
+
+    vgDrawGlyphs(vgFont, characters.size(), characters.data(),
+        adjustmentsX, adjustmentsY, paintModes, VG_TRUE /* allow autohinting */);
+    ASSERT_VG_NO_ERROR();
+
+    if (originalTransformation) {
+        setTransformation(*originalTransformation);
+        delete originalTransformation;
+    }
+}
+#endif
+
+void PainterOpenVG::save(PainterOpenVG::SaveMode saveMode)
+{
+    ASSERT(m_state);
+
+    // If the underlying context/surface was switched away by someone without
+    // telling us, it might not correspond to the one assigned to this painter.
+    // Switch back so we can save the state properly. (Should happen rarely.)
+    // Use DontSaveOrApplyPainterState mode in order to avoid recursion.
+    m_surface->makeCurrent(SurfaceOpenVG::DontSaveOrApplyPainterState);
+
+    if (saveMode == PainterOpenVG::CreateNewState) {
+        m_state->saveMaskIfNecessary(this);
+        PlatformPainterState* state = new PlatformPainterState(*m_state);
+        m_stateStack.append(state);
+        m_state = m_stateStack.last();
+    } else if (saveMode == PainterOpenVG::CreateNewStateWithPaintStateOnly) {
+        m_state->saveMaskIfNecessary(this);
+        PlatformPainterState* state = new PlatformPainterState();
+        state->copyPaintState(m_state);
+        m_stateStack.append(state);
+        m_state = m_stateStack.last();
+    } else // if (saveMode == PainterOpenVG::KeepCurrentState)
+        m_state->saveMaskIfNecessary(this);
+}
+
+void PainterOpenVG::restore()
+{
+    ASSERT(m_stateStack.size() >= 2);
+    m_surface->makeCurrent(SurfaceOpenVG::DontApplyPainterState);
+
+    PlatformPainterState* state = m_stateStack.last();
+    m_stateStack.removeLast();
+    delete state;
+
+    m_state = m_stateStack.last();
+    m_state->applyState(this);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/openvg/PainterOpenVG.h b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/PainterOpenVG.h
new file mode 100644
index 0000000000..30cdf31b24
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/PainterOpenVG.h
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef PainterOpenVG_h
+#define PainterOpenVG_h
+
+#include "Color.h"
+#include "GraphicsContext.h"
+
+#include <openvg.h>
+
+#include <wtf/Noncopyable.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class AffineTransform;
+class FloatPoint;
+class FloatRect;
+class IntRect;
+class IntSize;
+class Path;
+class SurfaceOpenVG;
+
+struct PlatformPainterState;
+
+class PainterOpenVG : public Noncopyable {
+public:
+    friend class SurfaceOpenVG;
+    friend struct PlatformPainterState;
+
+    enum SaveMode {
+        CreateNewState,
+        KeepCurrentState,
+        CreateNewStateWithPaintStateOnly // internal usage only, do not use outside PainterOpenVG
+    };
+    enum ClipOperation {
+        IntersectClip = VG_INTERSECT_MASK,
+        SubtractClip = VG_SUBTRACT_MASK
+    };
+
+    PainterOpenVG();
+    PainterOpenVG(SurfaceOpenVG*);
+    ~PainterOpenVG();
+
+    void begin(SurfaceOpenVG*);
+    void end();
+
+    AffineTransform transformation() const;
+    void setTransformation(const AffineTransform&);
+    void concatTransformation(const AffineTransform&);
+
+    static void transformPath(VGPath dst, VGPath src, const AffineTransform&);
+
+    CompositeOperator compositeOperation() const;
+    void setCompositeOperation(CompositeOperator);
+    float opacity() const;
+    void setOpacity(float);
+
+    float strokeThickness() const;
+    void setStrokeThickness(float);
+    StrokeStyle strokeStyle() const;
+    void setStrokeStyle(const StrokeStyle&);
+
+    void setLineDash(const DashArray&, float dashOffset);
+    void setLineCap(LineCap);
+    void setLineJoin(LineJoin);
+    void setMiterLimit(float);
+
+    Color strokeColor() const;
+    void setStrokeColor(const Color&);
+
+    Color fillColor() const;
+    void setFillColor(const Color&);
+
+    int textDrawingMode() const;
+    void setTextDrawingMode(int mode);
+
+    bool antialiasingEnabled() const;
+    void setAntialiasingEnabled(bool);
+
+    void drawRect(const FloatRect&, VGbitfield paintModes = (VG_STROKE_PATH | VG_FILL_PATH));
+    void drawRoundedRect(const FloatRect&, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, VGbitfield paintModes = (VG_STROKE_PATH | VG_FILL_PATH));
+    void drawLine(const IntPoint& from, const IntPoint& to);
+    void drawArc(const IntRect& ellipseBounds, int startAngle, int angleSpan, VGbitfield paintModes = (VG_STROKE_PATH | VG_FILL_PATH));
+    void drawEllipse(const IntRect& bounds, VGbitfield paintModes = (VG_STROKE_PATH | VG_FILL_PATH));
+    void drawPolygon(size_t numPoints, const FloatPoint* points, VGbitfield paintModes = (VG_STROKE_PATH | VG_FILL_PATH));
+#ifdef OPENVG_VERSION_1_1
+    void drawText(VGFont, Vector<VGuint>& characters, VGfloat* adjustmentsX, VGfloat* adjustmentsY, const FloatPoint&);
+#endif
+
+    void scale(const FloatSize& scaleFactors);
+    void rotate(float radians);
+    void translate(float dx, float dy);
+
+    void beginPath();
+    void addPath(const Path&);
+    Path* currentPath() const;
+    void drawPath(VGbitfield paintModes = (VG_STROKE_PATH | VG_FILL_PATH), WindRule fillRule = RULE_NONZERO);
+
+    void intersectClipRect(const FloatRect&);
+    void clipPath(const Path&, PainterOpenVG::ClipOperation, WindRule clipRule = RULE_NONZERO);
+
+    void save(PainterOpenVG::SaveMode saveMode = CreateNewState);
+    void restore();
+
+    SurfaceOpenVG* surface() { return m_surface; }
+    void blitToSurface();
+
+private:
+    void destroyPainterStates();
+    void applyState();
+
+    void intersectScissorRect(const FloatRect&);
+
+private:
+    Vector<PlatformPainterState*> m_stateStack;
+    PlatformPainterState* m_state;
+    SurfaceOpenVG* m_surface;
+    Path* m_currentPath;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/openvg/PathOpenVG.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/PathOpenVG.cpp
new file mode 100644
index 0000000000..2c366eed54
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/PathOpenVG.cpp
@@ -0,0 +1,502 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "Path.h"
+
+#include "AffineTransform.h"
+#include "FloatRect.h"
+#include "GraphicsContext.h"
+#include "NotImplemented.h"
+#include "PainterOpenVG.h"
+#include "PlatformPathOpenVG.h"
+#include "PlatformString.h"
+#include "StrokeStyleApplier.h"
+#include "VGUtils.h"
+
+#include <openvg.h>
+#include <wtf/MathExtras.h>
+
+#define WEBKIT_VG_PATH_CAPABILITIES VG_PATH_CAPABILITY_ALL
+
+#define FUZZY_COMPARE(number, reference, delta) \
+    (number >= (reference - delta) && number <= (reference + delta))
+
+namespace WebCore {
+
+PlatformPathOpenVG::PlatformPathOpenVG()
+    : SharedResourceOpenVG()
+{
+    createPath();
+}
+
+PlatformPathOpenVG::PlatformPathOpenVG(const PlatformPathOpenVG& other)
+    : SharedResourceOpenVG()
+    , m_currentPoint(other.m_currentPoint)
+    , m_subpathStartPoint(other.m_subpathStartPoint)
+{
+    createPath();
+    // makeCompatibleContextCurrent() is called by createPath(), so not necessary here.
+    vgAppendPath(m_vgPath, other.m_vgPath);
+    ASSERT_VG_NO_ERROR();
+}
+
+PlatformPathOpenVG& PlatformPathOpenVG::operator=(const PlatformPathOpenVG& other)
+{
+    if (&other != this) {
+        clear();
+        // makeCompatibleContextCurrent() is called by clear(), so not necessary here.
+        vgAppendPath(m_vgPath, other.m_vgPath);
+        ASSERT_VG_NO_ERROR();
+    }
+    return *this;
+}
+
+PlatformPathOpenVG::~PlatformPathOpenVG()
+{
+    makeCompatibleContextCurrent();
+
+    vgDestroyPath(m_vgPath);
+    ASSERT_VG_NO_ERROR();
+}
+
+void PlatformPathOpenVG::clear()
+{
+    makeCompatibleContextCurrent();
+
+    vgClearPath(m_vgPath, WEBKIT_VG_PATH_CAPABILITIES);
+    ASSERT_VG_NO_ERROR();
+
+    m_subpathStartPoint.setX(0);
+    m_subpathStartPoint.setY(0);
+    m_currentPoint = m_subpathStartPoint;
+}
+
+void PlatformPathOpenVG::createPath()
+{
+    makeSharedContextCurrent();
+
+    m_vgPath = vgCreatePath(
+        VG_PATH_FORMAT_STANDARD, VG_PATH_DATATYPE_F,
+        1.0 /* scale */, 0.0 /* bias */,
+        0 /* expected number of segments */,
+        0 /* expected number of total coordinates */,
+        WEBKIT_VG_PATH_CAPABILITIES);
+    ASSERT_VG_NO_ERROR();
+}
+
+
+Path::Path()
+{
+    m_path = new PlatformPathOpenVG();
+}
+
+Path::~Path()
+{
+    delete m_path;
+}
+
+Path::Path(const Path& other)
+{
+    m_path = new PlatformPathOpenVG(*(other.m_path));
+}
+
+Path& Path::operator=(const Path& other)
+{
+    *m_path = *(other.m_path);
+    return *this;
+}
+
+bool Path::contains(const FloatPoint& point, WindRule rule) const
+{
+    notImplemented();
+
+    // OpenVG has no path-contains function, so for now we approximate by
+    // using the bounding rect of the path.
+    return boundingRect().contains(point);
+}
+
+bool Path::strokeContains(StrokeStyleApplier* applier, const FloatPoint& point) const
+{
+    notImplemented();
+
+    // OpenVG has no path-contains function, so for now we approximate by
+    // using the stroke bounding rect of the path.
+    return (const_cast<Path*>(this))->strokeBoundingRect().contains(point);
+}
+
+void Path::translate(const FloatSize& size)
+{
+    AffineTransform transformation;
+    transformation.translate(size.width(), size.height());
+    transform(transformation);
+}
+
+FloatRect Path::boundingRect() const
+{
+    VGfloat minX;
+    VGfloat minY;
+    VGfloat width;
+    VGfloat height;
+
+    m_path->makeCompatibleContextCurrent();
+    vgPathBounds(m_path->vgPath(), &minX, &minY, &width, &height);
+    ASSERT_VG_NO_ERROR();
+
+    return FloatRect(FloatPoint(minX, minY), FloatSize(width, height));
+}
+
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
+{
+    notImplemented();
+
+    // vgPathBounds() ignores stroke parameters, and we don't currently have
+    // an approximation that takes stroke parameters into account.
+    return boundingRect();
+}
+
+void Path::moveTo(const FloatPoint& point)
+{
+    static const VGubyte pathSegments[] = { VG_MOVE_TO_ABS };
+    const VGfloat pathData[] = { point.x(), point.y() };
+
+    m_path->makeCompatibleContextCurrent();
+    vgAppendPathData(m_path->vgPath(), 1, pathSegments, pathData);
+    ASSERT_VG_NO_ERROR();
+
+    m_path->m_currentPoint = m_path->m_subpathStartPoint = point;
+}
+
+void Path::addLineTo(const FloatPoint& point)
+{
+    static const VGubyte pathSegments[] = { VG_LINE_TO_ABS };
+    const VGfloat pathData[] = { point.x(), point.y() };
+
+    m_path->makeCompatibleContextCurrent();
+    vgAppendPathData(m_path->vgPath(), 1, pathSegments, pathData);
+    ASSERT_VG_NO_ERROR();
+
+    m_path->m_currentPoint = point;
+}
+
+void Path::addQuadCurveTo(const FloatPoint& controlPoint, const FloatPoint& endPoint)
+{
+    static const VGubyte pathSegments[] = { VG_QUAD_TO_ABS };
+    const VGfloat pathData[] = { controlPoint.x(), controlPoint.y(), endPoint.x(), endPoint.y() };
+
+    m_path->makeCompatibleContextCurrent();
+    vgAppendPathData(m_path->vgPath(), 1, pathSegments, pathData);
+    ASSERT_VG_NO_ERROR();
+
+    m_path->m_currentPoint = endPoint;
+}
+
+void Path::addBezierCurveTo(const FloatPoint& controlPoint1, const FloatPoint& controlPoint2, const FloatPoint& endPoint)
+{
+    static const VGubyte pathSegments[] = { VG_CUBIC_TO_ABS };
+    const VGfloat pathData[] = { controlPoint1.x(), controlPoint1.y(), controlPoint2.x(), controlPoint2.y(), endPoint.x(), endPoint.y() };
+
+    m_path->makeCompatibleContextCurrent();
+    vgAppendPathData(m_path->vgPath(), 1, pathSegments, pathData);
+    ASSERT_VG_NO_ERROR();
+
+    m_path->m_currentPoint = endPoint;
+}
+
+void Path::addArcTo(const FloatPoint& point1, const FloatPoint& point2, float radius)
+{
+    // See http://philip.html5.org/tests/canvas/suite/tests/spec.html#arcto.
+
+    const FloatPoint& point0 = m_path->m_currentPoint;
+    if (!radius || point0 == point1 || point1 == point2) {
+        addLineTo(point1);
+        return;
+    }
+
+    FloatSize v01 = point0 - point1;
+    FloatSize v21 = point2 - point1;
+
+    // sin(A - B) = sin(A) * cos(B) - sin(B) * cos(A)
+    double cross = v01.width() * v21.height() - v01.height() * v21.width();
+
+    if (fabs(cross) < 1E-10) {
+        // on one line
+        addLineTo(point1);
+        return;
+    }
+
+    double d01 = hypot(v01.width(), v01.height());
+    double d21 = hypot(v21.width(), v21.height());
+    double angle = (piDouble - fabs(asin(cross / (d01 * d21)))) * 0.5;
+    double span = radius * tan(angle);
+    double rate = span / d01;
+    FloatPoint startPoint = FloatPoint(point1.x() + v01.width() * rate,
+                                       point1.y() + v01.height() * rate);
+    rate = span / d21;
+    FloatPoint endPoint = FloatPoint(point1.x() + v21.width() * rate,
+                                     point1.y() + v21.height() * rate);
+
+    // Fa: large arc flag, makes the difference between SCWARC_TO and LCWARC_TO
+    //     respectively SCCWARC_TO and LCCWARC_TO arcs. We always use small
+    //     arcs for arcTo(), as the arc is defined as the "shortest arc" of the
+    //     circle specified in HTML 5.
+
+    // Fs: sweep flag, specifying whether the arc is drawn in increasing (true)
+    //     or decreasing (0) direction.
+    const bool anticlockwise = cross < 0;
+
+    // Translate the large arc and sweep flags into an OpenVG segment command.
+    const VGubyte segmentCommand = anticlockwise ? VG_SCCWARC_TO_ABS : VG_SCWARC_TO_ABS;
+
+    const VGubyte pathSegments[] = {
+        VG_LINE_TO_ABS,
+        segmentCommand
+    };
+    const VGfloat pathData[] = {
+        startPoint.x(), startPoint.y(),
+        radius, radius, 0, endPoint.x(), endPoint.y()
+    };
+
+    m_path->makeCompatibleContextCurrent();
+    vgAppendPathData(m_path->vgPath(), 2, pathSegments, pathData);
+    ASSERT_VG_NO_ERROR();
+
+    m_path->m_currentPoint = endPoint;
+}
+
+void Path::closeSubpath()
+{
+    static const VGubyte pathSegments[] = { VG_CLOSE_PATH };
+    // pathData must not be 0, but certain compilers also don't create
+    // zero-size arrays. So let's use a random aligned value (sizeof(VGfloat)),
+    // it won't be accessed anyways as VG_CLOSE_PATH doesn't take coordinates.
+    static const VGfloat* pathData = reinterpret_cast<VGfloat*>(sizeof(VGfloat));
+
+    m_path->makeCompatibleContextCurrent();
+    vgAppendPathData(m_path->vgPath(), 1, pathSegments, pathData);
+    ASSERT_VG_NO_ERROR();
+
+    m_path->m_currentPoint = m_path->m_subpathStartPoint;
+}
+
+void Path::addArc(const FloatPoint& center, float radius, float startAngle, float endAngle, bool anticlockwise)
+{
+    // The OpenVG spec says nothing about inf as radius or start/end angle.
+    // WebKit seems to pass those (e.g. https://bugs.webkit.org/show_bug.cgi?id=16449),
+    // so abort instead of risking undefined behavior.
+    if (!isfinite(radius) || !isfinite(startAngle) || !isfinite(endAngle))
+        return;
+
+    // For some reason, the HTML 5 spec defines the angle as going clockwise
+    // from the positive X axis instead of going standard anticlockwise.
+    // So let's make it a proper angle in order to keep sanity.
+    startAngle = fmod((2.0 * piDouble) - startAngle, 2.0 * piDouble);
+    endAngle = fmod((2.0 * piDouble) - endAngle, 2.0 * piDouble);
+
+    // Make it so that endAngle > startAngle. fmod() above takes care of
+    // keeping the difference below 360 degrees.
+    if (endAngle <= startAngle)
+        endAngle += 2.0 * piDouble;
+
+    const VGfloat angleDelta = anticlockwise
+        ? (endAngle - startAngle)
+        : (startAngle - endAngle + (2.0 * piDouble));
+
+    // OpenVG uses endpoint parameterization while this method receives its
+    // values in center parameterization. It lacks an ellipse rotation
+    // parameter so we use 0 for that, and also the radius is only a single
+    // value which makes for rh == rv. In order to convert from endpoint to
+    // center parameterization, we use the formulas from the OpenVG/SVG specs:
+
+    // (x,y) = (cos rot, -sin rot; sin rot, -cos rot) * (rh * cos angle, rv * sin angle) + (center.x, center.y)
+    // rot is 0, which simplifies this a bit:
+    // (x,y) = (1, 0; 0, -1) * (rh * cos angle, rv * sin angle) + (center.x, center.y)
+    //       = (1 * rh * cos angle + 0 * rv * sin angle, 0 * rh * cos angle + -1 * rv * sin angle) + (center.x, center.y)
+    //       = (rh * cos angle, -rv * sin angle) + (center.x, center.y)
+    // (Set angle = {startAngle, endAngle} to retrieve the respective endpoints.)
+
+    const VGfloat startX = radius * cos(startAngle) + center.x();
+    const VGfloat startY = -radius * sin(startAngle) + center.y();
+    const VGfloat endX = radius * cos(endAngle) + center.x();
+    const VGfloat endY = -radius * sin(endAngle) + center.y();
+
+    // Fa: large arc flag, makes the difference between SCWARC_TO and LCWARC_TO
+    //     respectively SCCWARC_TO and LCCWARC_TO arcs.
+    const bool largeArc = (angleDelta > piDouble);
+
+    // Fs: sweep flag, specifying whether the arc is drawn in increasing (true)
+    //     or decreasing (0) direction. No need to calculate this value, as it
+    //     we already get it passed as a parameter (Fs == !anticlockwise).
+
+    // Translate the large arc and sweep flags into an OpenVG segment command.
+    // As OpenVG thinks of everything upside down, we need to reverse the
+    // anticlockwise parameter in order to get the specified rotation.
+    const VGubyte segmentCommand = !anticlockwise
+        ? (largeArc ? VG_LCCWARC_TO_ABS : VG_SCCWARC_TO_ABS)
+        : (largeArc ? VG_LCWARC_TO_ABS : VG_SCWARC_TO_ABS);
+
+    // So now, we've got all the parameters in endpoint parameterization format
+    // as OpenVG requires it. Which means we can just pass it like this.
+    const VGubyte pathSegments[] = {
+        hasCurrentPoint() ? VG_LINE_TO_ABS : VG_MOVE_TO_ABS,
+        segmentCommand
+    };
+    const VGfloat pathData[] = {
+        startX, startY,
+        radius, radius, 0, endX, endY
+    };
+
+    m_path->makeCompatibleContextCurrent();
+    vgAppendPathData(m_path->vgPath(), 2, pathSegments, pathData);
+    ASSERT_VG_NO_ERROR();
+
+    m_path->m_currentPoint.setX(endX);
+    m_path->m_currentPoint.setY(endY);
+}
+
+void Path::addRect(const FloatRect& rect)
+{
+    static const VGubyte pathSegments[] = {
+        VG_MOVE_TO_ABS,
+        VG_HLINE_TO_REL,
+        VG_VLINE_TO_REL,
+        VG_HLINE_TO_REL,
+        VG_CLOSE_PATH
+    };
+    const VGfloat pathData[] = {
+        rect.x(), rect.y(),
+        rect.width(),
+        rect.height(),
+        -rect.width()
+    };
+
+    m_path->makeCompatibleContextCurrent();
+    vgAppendPathData(m_path->vgPath(), 5, pathSegments, pathData);
+    ASSERT_VG_NO_ERROR();
+
+    m_path->m_currentPoint = m_path->m_subpathStartPoint = rect.location();
+}
+
+void Path::addEllipse(const FloatRect& rect)
+{
+    static const VGubyte pathSegments[] = {
+        VG_MOVE_TO_ABS,
+        VG_SCCWARC_TO_REL,
+        VG_SCCWARC_TO_REL,
+        VG_CLOSE_PATH
+    };
+    const VGfloat pathData[] = {
+        rect.x() + rect.width() / 2.0, rect.y(),
+        rect.width() / 2.0, rect.height() / 2.0, 0, 0, rect.height(),
+        rect.width() / 2.0, rect.height() / 2.0, 0, 0, -rect.height()
+    };
+
+    m_path->makeCompatibleContextCurrent();
+    vgAppendPathData(m_path->vgPath(), 4, pathSegments, pathData);
+    ASSERT_VG_NO_ERROR();
+}
+
+void Path::clear()
+{
+    m_path->clear();
+}
+
+bool Path::isEmpty() const
+{
+    m_path->makeCompatibleContextCurrent();
+    return !vgGetParameteri(m_path->vgPath(), VG_PATH_NUM_SEGMENTS);
+}
+
+bool Path::hasCurrentPoint() const
+{
+    m_path->makeCompatibleContextCurrent();
+    return vgGetParameteri(m_path->vgPath(), VG_PATH_NUM_SEGMENTS) > 0;
+}
+
+String Path::debugString() const
+{
+    String debugString = "";
+
+    // OpenVG provides no means to retrieve path segment information.
+    // This is a bit unfortunate, we might need to store the segments in
+    // memory if we want to implement this function properly.
+    notImplemented();
+
+    return debugString;
+}
+
+void Path::apply(void* info, PathApplierFunction function) const
+{
+    // OpenVG provides no means to retrieve path segment information.
+    // This is *very* unfortunate, we might need to store the segments in
+    // memory if we want to implement this function properly.
+    // See http://www.khronos.org/message_boards/viewtopic.php?f=6&t=1887
+    notImplemented();
+}
+
+void Path::transform(const AffineTransform& transformation)
+{
+    PlatformPathOpenVG* dst = new PlatformPathOpenVG();
+    // dst->makeCompatibleContextCurrent() is called by the platform path
+    // constructor, therefore not necessary to call it again here.
+    PainterOpenVG::transformPath(dst->vgPath(), m_path->vgPath(), transformation);
+    delete m_path;
+    m_path = dst;
+
+    m_path->m_currentPoint = transform.mapPoint(m_path->m_currentPoint);
+    m_path->m_subpathStartPoint = transform.mapPoint(m_path->m_subpathStartPoint);
+}
+
+
+// Path::length(), Path::pointAtLength() and Path::normalAngleAtLength() are
+// reimplemented here instead of in Path.cpp, because OpenVG has its own
+// functions and Path::apply() doesn't really work as long as we rely on VGPath
+// as primary path storage.
+
+float Path::length()
+{
+    m_path->makeCompatibleContextCurrent();
+    VGfloat length = vgPathLength(m_path->vgPath(), 0, vgGetParameteri(m_path->vgPath(), VG_PATH_NUM_SEGMENTS));
+    ASSERT_VG_NO_ERROR();
+    return length;
+}
+
+FloatPoint Path::pointAtLength(float length, bool& ok)
+{
+    VGfloat x = 0, y = 0;
+    m_path->makeCompatibleContextCurrent();
+
+    vgPointAlongPath(m_path->vgPath(), 0, vgGetParameteri(m_path->vgPath(), VG_PATH_NUM_SEGMENTS),
+                     length, &x, &y, 0, 0);
+    ok = (vgGetError() == VG_NO_ERROR);
+    return FloatPoint(x, y);
+}
+
+float Path::normalAngleAtLength(float length, bool& ok)
+{
+    VGfloat tangentX, tangentY;
+    m_path->makeCompatibleContextCurrent();
+
+    vgPointAlongPath(m_path->vgPath(), 0, vgGetParameteri(m_path->vgPath(), VG_PATH_NUM_SEGMENTS),
+                     length, 0, 0, &tangentX, &tangentY);
+    ok = (vgGetError() == VG_NO_ERROR);
+    return atan2f(tangentY, tangentX) * 180.0 / piFloat; // convert to degrees
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/openvg/PlatformPathOpenVG.h b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/PlatformPathOpenVG.h
new file mode 100644
index 0000000000..286da53e41
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/PlatformPathOpenVG.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef PlatformPathOpenVG_h
+#define PlatformPathOpenVG_h
+
+#include "FloatPoint.h"
+#include "SharedResourceOpenVG.h"
+
+#include <openvg.h>
+
+namespace WebCore {
+
+class PlatformPathOpenVG : public SharedResourceOpenVG {
+public:
+    PlatformPathOpenVG();
+    PlatformPathOpenVG(const PlatformPathOpenVG&);
+    ~PlatformPathOpenVG();
+
+    PlatformPathOpenVG& operator=(const PlatformPathOpenVG&);
+
+    VGPath vgPath() { return m_vgPath; }
+    void clear();
+
+public:
+    FloatPoint m_currentPoint;
+    FloatPoint m_subpathStartPoint;
+
+private:
+    void createPath();
+
+    VGPath m_vgPath;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/openvg/SharedResourceOpenVG.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/SharedResourceOpenVG.cpp
new file mode 100644
index 0000000000..a843db538e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/SharedResourceOpenVG.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "SharedResourceOpenVG.h"
+
+#include "SurfaceOpenVG.h"
+
+#if PLATFORM(EGL)
+#include "EGLDisplayOpenVG.h"
+#endif
+
+namespace WebCore {
+
+void SharedResourceOpenVG::makeSharedContextCurrent()
+{
+#if PLATFORM(EGL)
+    EGLDisplayOpenVG::current()->sharedPlatformSurface()->makeCurrent();
+#endif
+}
+
+void SharedResourceOpenVG::makeCompatibleContextCurrent()
+{
+#if PLATFORM(EGL)
+    EGLDisplayOpenVG::current()->sharedPlatformSurface()->makeCompatibleCurrent();
+#endif
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/QWebPopup.h b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/SharedResourceOpenVG.h
index 36d6781521..436ae90c38 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/QWebPopup.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/SharedResourceOpenVG.h
@@ -1,6 +1,5 @@
 /*
- *
- * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -16,32 +15,17 @@
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
- *
  */
-#ifndef QWebPopup_h
-#define QWebPopup_h
-
-#include <QComboBox>
 
-#include "PopupMenuClient.h"
+#ifndef SharedResourceOpenVG_h
+#define SharedResourceOpenVG_h
 
 namespace WebCore {
 
-class QWebPopup : public QComboBox {
-    Q_OBJECT
+class SharedResourceOpenVG {
 public:
-    QWebPopup(PopupMenuClient* client);
-
-    void exec();
-
-    virtual void showPopup();
-    virtual void hidePopup();
-
-private slots:
-    void activeChanged(int);
-private:
-    PopupMenuClient* m_client;
-    bool m_popupVisible;
+    void makeSharedContextCurrent();
+    void makeCompatibleContextCurrent();
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/openvg/SurfaceOpenVG.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/SurfaceOpenVG.cpp
new file mode 100644
index 0000000000..6700c6ffa0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/SurfaceOpenVG.cpp
@@ -0,0 +1,271 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "SurfaceOpenVG.h"
+
+#include "IntSize.h"
+#include "PainterOpenVG.h"
+
+#if PLATFORM(EGL)
+#include "EGLDisplayOpenVG.h"
+#include "EGLUtils.h"
+#endif
+
+#include <wtf/Assertions.h>
+
+namespace WebCore {
+
+PainterOpenVG* SurfaceOpenVG::s_currentPainter = 0;
+
+SurfaceOpenVG* SurfaceOpenVG::currentSurface()
+{
+#if PLATFORM(EGL)
+    return EGLDisplayOpenVG::currentSurface();
+#else
+    ASSERT_NOT_REACHED();
+    return 0;
+#endif
+}
+
+#if PLATFORM(EGL)
+SurfaceOpenVG::SurfaceOpenVG(const IntSize& size, const EGLDisplay& display, EGLConfig* confPtr, EGLint* errorCode)
+    : m_activePainter(0)
+    , m_eglDisplay(display)
+    , m_eglSurface(EGL_NO_SURFACE)
+    , m_eglContext(EGL_NO_CONTEXT)
+{
+    ASSERT(m_eglDisplay != EGL_NO_DISPLAY);
+
+    EGLDisplayOpenVG* displayManager = EGLDisplayOpenVG::forDisplay(m_eglDisplay);
+    EGLConfig config = confPtr ? (*confPtr) : displayManager->defaultPbufferConfig();
+    m_eglSurface = displayManager->createPbufferSurface(size, config, errorCode);
+
+    if (m_eglSurface == EGL_NO_SURFACE)
+        return;
+
+    m_eglContext = displayManager->contextForSurface(m_eglSurface);
+    EGLDisplayOpenVG::registerPlatformSurface(this);
+}
+
+SurfaceOpenVG::SurfaceOpenVG(EGLClientBuffer buffer, EGLenum bufferType, const EGLDisplay& display, EGLConfig* confPtr, EGLint* errorCode)
+    : m_activePainter(0)
+    , m_eglDisplay(display)
+    , m_eglSurface(EGL_NO_SURFACE)
+    , m_eglContext(EGL_NO_CONTEXT)
+{
+    ASSERT(m_eglDisplay != EGL_NO_DISPLAY);
+
+    EGLDisplayOpenVG* displayManager = EGLDisplayOpenVG::forDisplay(m_eglDisplay);
+    EGLConfig config = confPtr ? (*confPtr) : displayManager->defaultPbufferConfig();
+    m_eglSurface = displayManager->createPbufferFromClientBuffer(buffer, bufferType, config, errorCode);
+
+    if (m_eglSurface == EGL_NO_SURFACE)
+        return;
+
+    m_eglContext = displayManager->contextForSurface(m_eglSurface);
+    EGLDisplayOpenVG::registerPlatformSurface(this);
+}
+
+SurfaceOpenVG::SurfaceOpenVG(EGLNativeWindowType window, const EGLDisplay& display, EGLConfig* confPtr)
+    : m_activePainter(0)
+    , m_eglDisplay(display)
+    , m_eglSurface(EGL_NO_SURFACE)
+    , m_eglContext(EGL_NO_CONTEXT)
+{
+    ASSERT(m_eglDisplay != EGL_NO_DISPLAY);
+
+    EGLDisplayOpenVG* displayManager = EGLDisplayOpenVG::forDisplay(m_eglDisplay);
+    EGLConfig config = confPtr ? (*confPtr) : displayManager->defaultWindowConfig();
+    m_eglSurface = displayManager->surfaceForWindow(window, config);
+    ASSERT(m_eglSurface != EGL_NO_SURFACE);
+
+    m_eglContext = displayManager->contextForSurface(m_eglSurface);
+    EGLDisplayOpenVG::registerPlatformSurface(this);
+}
+
+// Constructor only accessible to EGLDisplayOpenVG for shared context
+// initialization. The parameter types might define to void* like in the
+// window surface constructor, so it can't be overloaded with all the required
+// arguments and EGLDisplayOpenVG basically implements the constructor
+// by itself.
+SurfaceOpenVG::SurfaceOpenVG()
+    : m_activePainter(0)
+    , m_eglDisplay(EGL_NO_DISPLAY)
+    , m_eglSurface(EGL_NO_SURFACE)
+    , m_eglContext(EGL_NO_CONTEXT)
+{
+}
+#endif
+
+SurfaceOpenVG::~SurfaceOpenVG()
+{
+    if (!isValid())
+        return;
+
+    if (m_activePainter && this == m_activePainter->baseSurface())
+        m_activePainter->end();
+
+#if PLATFORM(EGL)
+    EGLDisplayOpenVG::forDisplay(m_eglDisplay)->destroySurface(m_eglSurface);
+    EGLDisplayOpenVG::unregisterPlatformSurface(this);
+#else
+    ASSERT_NOT_REACHED();
+#endif
+}
+
+bool SurfaceOpenVG::isValid() const
+{
+#if PLATFORM(EGL)
+    return (m_eglSurface != EGL_NO_SURFACE);
+#else
+    ASSERT_NOT_REACHED();
+    return false;
+#endif
+}
+
+int SurfaceOpenVG::width() const
+{
+#if PLATFORM(EGL)
+    ASSERT(m_eglSurface != EGL_NO_SURFACE);
+
+    EGLint width;
+    eglQuerySurface(m_eglDisplay, m_eglSurface, EGL_WIDTH, &width);
+    ASSERT_EGL_NO_ERROR();
+    return width;
+#else
+    ASSERT_NOT_REACHED();
+    return 0;
+#endif
+}
+
+int SurfaceOpenVG::height() const
+{
+#if PLATFORM(EGL)
+    ASSERT(m_eglSurface != EGL_NO_SURFACE);
+
+    EGLint height;
+    eglQuerySurface(m_eglDisplay, m_eglSurface, EGL_HEIGHT, &height);
+    ASSERT_EGL_NO_ERROR();
+    return height;
+#else
+    ASSERT_NOT_REACHED();
+    return 0;
+#endif
+}
+
+SurfaceOpenVG* SurfaceOpenVG::sharedSurface() const
+{
+#if PLATFORM(EGL)
+    ASSERT(m_eglSurface != EGL_NO_SURFACE);
+    return EGLDisplayOpenVG::forDisplay(m_eglDisplay)->sharedPlatformSurface();
+#else
+    ASSERT_NOT_REACHED();
+    return 0;
+#endif
+}
+
+void SurfaceOpenVG::makeCurrent(MakeCurrentMode mode)
+{
+#if PLATFORM(EGL)
+    ASSERT(m_eglSurface != EGL_NO_SURFACE);
+
+    eglBindAPI(EGL_OPENVG_API);
+    ASSERT_EGL_NO_ERROR();
+    EGLSurface currentSurface = eglGetCurrentSurface(EGL_DRAW);
+    ASSERT_EGL_NO_ERROR();
+
+    if (currentSurface != m_eglSurface) {
+        // Save other context before switching over.
+        if (s_currentPainter && mode != DontSaveOrApplyPainterState
+            && s_currentPainter->surface()->m_eglSurface == currentSurface)
+            s_currentPainter->save(PainterOpenVG::KeepCurrentState);
+
+        eglMakeCurrent(m_eglDisplay, m_eglSurface, m_eglSurface, m_eglContext);
+        ASSERT_EGL_NO_ERROR();
+        s_currentPainter = 0;
+    }
+#endif
+
+    if (m_activePainter && mode == ApplyPainterStateOnSurfaceSwitch
+        && s_currentPainter != m_activePainter) {
+        m_activePainter->applyState();
+        s_currentPainter = m_activePainter;
+    }
+}
+
+void SurfaceOpenVG::makeCompatibleCurrent()
+{
+#if PLATFORM(EGL)
+    ASSERT(m_eglSurface != EGL_NO_SURFACE);
+
+    eglBindAPI(EGL_OPENVG_API);
+    ASSERT_EGL_NO_ERROR();
+    EGLSurface currentSurface = eglGetCurrentSurface(EGL_DRAW);
+    ASSERT_EGL_NO_ERROR();
+
+    if (currentSurface == m_eglSurface) {
+        if (m_activePainter && s_currentPainter != m_activePainter) {
+            m_activePainter->applyState();
+            s_currentPainter = m_activePainter;
+        }
+    } else if (!EGLDisplayOpenVG::forDisplay(m_eglDisplay)->surfacesCompatible(currentSurface, m_eglSurface)) {
+        // Save other context before switching over.
+        if (s_currentPainter && s_currentPainter->surface()->m_eglSurface == currentSurface)
+            s_currentPainter->save(PainterOpenVG::KeepCurrentState);
+
+        eglMakeCurrent(m_eglDisplay, m_eglSurface, m_eglSurface, m_eglContext);
+        ASSERT_EGL_NO_ERROR();
+        s_currentPainter = 0;
+    }
+    // else: surfaces compatible, no need to switch contexts
+#endif
+}
+
+void SurfaceOpenVG::flush()
+{
+#if PLATFORM(EGL)
+    ASSERT(m_eglSurface != EGL_NO_SURFACE);
+
+    eglSwapBuffers(m_eglDisplay, m_eglSurface);
+    ASSERT_EGL_NO_ERROR();
+#endif
+}
+
+void SurfaceOpenVG::setActivePainter(PainterOpenVG* painter)
+{
+    ASSERT(isValid());
+
+    // If painter is non-zero, we want to make sure there was no previous painter set.
+    ASSERT(!painter || !m_activePainter);
+
+    // Make sure a disabled painter isn't marked as global current painter anymore.
+    if (!painter && s_currentPainter == m_activePainter)
+        s_currentPainter = 0;
+
+    m_activePainter = painter;
+}
+
+PainterOpenVG* SurfaceOpenVG::activePainter()
+{
+    ASSERT(isValid());
+    return m_activePainter;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/openvg/SurfaceOpenVG.h b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/SurfaceOpenVG.h
new file mode 100644
index 0000000000..46d16460de
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/SurfaceOpenVG.h
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef SurfaceOpenVG_h
+#define SurfaceOpenVG_h
+
+#if PLATFORM(EGL)
+#include <egl.h>
+#endif
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+#if PLATFORM(EGL)
+class EGLDisplayOpenVG;
+#endif
+class PainterOpenVG;
+class IntSize;
+
+/**
+ * SurfaceOpenVG provides the functionality of surfaces and contexts that are
+ * underlying the OpenVG implementation. In the vast majority of cases, that
+ * underlying technology is EGL, but OpenVG doesn't depend on EGL per se.
+ * Wrapping surface/context functionality into a separate class avoids lots
+ * of #ifdefs and should make it easy to add different surface/context
+ * implementations than EGL.
+ */
+class SurfaceOpenVG : public Noncopyable {
+public:
+    enum MakeCurrentMode {
+        ApplyPainterStateOnSurfaceSwitch,
+        DontApplyPainterState,
+        DontSaveOrApplyPainterState
+    };
+
+    static SurfaceOpenVG* currentSurface();
+
+#if PLATFORM(EGL)
+    friend class EGLDisplayOpenVG;
+
+    /**
+     * Create a new EGL pbuffer surface with the specified size and config on
+     * the given display. If config is not specified, the display's default
+     * pbuffer config is used.
+     *
+     * This constructor will trigger an assertion if creation of the surface
+     * fails, unless you pledge to manually process the error code by passing
+     * a non-zero pointer as errorCode parameter. The error code returned by
+     * eglGetError() will be written to that variable.
+     */
+    SurfaceOpenVG(const IntSize& size, const EGLDisplay& display, EGLConfig* config = 0, EGLint* errorCode = 0);
+
+    /**
+     * Create a new EGL pbuffer surface that will be bound to the given
+     * client buffer (read: VGImage), with the specified config on the
+     * given display. If config is not specified, the display's default
+     * pbuffer config is used.
+     *
+     * After the surface is created, you will only be able to access the
+     * client buffer image if the surface is not current. The recommended way
+     * to ensure this is to call surface->sharedSurface()->makeCurrent() if you
+     * simply want to access the image's pixel contents, or if you intend to
+     * draw the image directly, making the draw target surface current.
+     *
+     * This constructor will trigger an assertion if creation of the surface
+     * fails, unless you pledge to manually process the error code by passing
+     * a non-zero pointer as errorCode parameter. The error code returned by
+     * eglGetError() will be written to that variable.
+     */
+    SurfaceOpenVG(EGLClientBuffer buffer, EGLenum bufferType,
+        const EGLDisplay& display, EGLConfig* config = 0, EGLint* errorCode = 0);
+
+    /**
+     * Create a new EGL window surface with the specified native window handle
+     * and config on the given display. If config is not specified, the
+     * display's default window config is used.
+     */
+    SurfaceOpenVG(EGLNativeWindowType window, const EGLDisplay& display, EGLConfig* config = 0);
+
+    EGLDisplay eglDisplay() const { return m_eglDisplay; }
+    EGLSurface eglSurface() const { return m_eglSurface; }
+    EGLContext eglContext() const { return m_eglContext; }
+#endif
+
+    ~SurfaceOpenVG();
+
+    /**
+     * If a surface is invalid (could not be created), all method calls will
+     * crash horribly.
+     */
+    bool isValid() const;
+
+    int width() const;
+    int height() const;
+
+    SurfaceOpenVG* sharedSurface() const;
+
+    /**
+     * Make the associated GL/EGL context the current one, so that subsequent
+     * OpenVG commands apply to it.
+     */
+    void makeCurrent(MakeCurrentMode mode = ApplyPainterStateOnSurfaceSwitch);
+
+    /**
+     * Make a surface/context combination current that is "compatible"
+     * (i.e. can access its shared resources) to the given one. If no
+     * surface/context is current, the given one is made current.
+     *
+     * This method is meant to avoid context changes if they're not
+     * necessary, particularly tailored for the case where something
+     * compatible to the shared surface is requested while actual painting
+     * happens on another surface.
+     */
+    void makeCompatibleCurrent();
+
+    /**
+     * Empty the OpenVG pipeline and make sure all the performed paint
+     * operations show up on the surface as actual drawn pixels.
+     */
+    void flush();
+
+    void setActivePainter(PainterOpenVG*);
+    PainterOpenVG* activePainter();
+
+private:
+    PainterOpenVG* m_activePainter;
+    static PainterOpenVG* s_currentPainter; // global currently active painter
+
+#if PLATFORM(EGL)
+    SurfaceOpenVG(); // for EGLDisplayOpenVG
+
+    EGLDisplay m_eglDisplay;
+    EGLSurface m_eglSurface;
+    EGLContext m_eglContext;
+#endif
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/openvg/VGUtils.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/VGUtils.cpp
new file mode 100644
index 0000000000..ce9bcd250b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/VGUtils.cpp
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "VGUtils.h"
+
+#include "AffineTransform.h"
+#include "FloatRect.h"
+#include "TransformationMatrix.h"
+
+namespace WebCore {
+
+VGMatrix::VGMatrix(const VGfloat data[9])
+{
+    m_data[0] = data[0];
+    m_data[1] = data[1];
+    m_data[2] = data[2];
+    m_data[3] = data[3];
+    m_data[4] = data[4];
+    m_data[5] = data[5];
+    m_data[6] = data[6];
+    m_data[7] = data[7];
+    m_data[8] = data[8];
+}
+
+VGMatrix::VGMatrix(const AffineTransform& transformation)
+{
+    m_data[0] = transformation.a();
+    m_data[1] = transformation.b();
+    m_data[2] = 0;
+    m_data[3] = transformation.c();
+    m_data[4] = transformation.d();
+    m_data[5] = 0;
+    m_data[6] = transformation.e();
+    m_data[7] = transformation.f();
+    m_data[8] = 1;
+}
+
+VGMatrix::VGMatrix(const TransformationMatrix& matrix)
+{
+    m_data[0] = matrix.m11();
+    m_data[1] = matrix.m12();
+    m_data[2] = matrix.m14();
+    m_data[3] = matrix.m21();
+    m_data[4] = matrix.m22();
+    m_data[5] = matrix.m24();
+    m_data[6] = matrix.m41();
+    m_data[7] = matrix.m42();
+    m_data[8] = matrix.m44();
+}
+
+VGMatrix::operator AffineTransform() const
+{
+    AffineTransform transformation(
+        m_data[0], m_data[1],
+        m_data[3], m_data[4],
+        m_data[6], m_data[7]);
+    return transformation;
+}
+
+VGMatrix::operator TransformationMatrix() const
+{
+    TransformationMatrix matrix(
+        m_data[0], m_data[1], 0, m_data[2],
+        m_data[3], m_data[4], 0, m_data[5],
+        0,         0,         1, 0,
+        m_data[6], m_data[7], 0, m_data[8]);
+    return matrix;
+}
+
+AffineTransform::operator VGMatrix() const
+{
+    return VGMatrix(*this);
+}
+
+TransformationMatrix::operator VGMatrix() const
+{
+    return VGMatrix(*this);
+}
+
+VGRect::VGRect(const VGfloat data[4])
+{
+    m_data[0] = data[0];
+    m_data[1] = data[1];
+    m_data[2] = data[2];
+    m_data[3] = data[3];
+}
+
+VGRect::VGRect(const FloatRect& rect)
+{
+    m_data[0] = rect.x();
+    m_data[1] = rect.y();
+    m_data[2] = rect.width();
+    m_data[3] = rect.height();
+}
+
+VGRect::operator FloatRect() const
+{
+    return FloatRect(m_data[0], m_data[1], m_data[2], m_data[3]);
+}
+
+FloatRect::operator VGRect() const
+{
+    return VGRect(*this);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/openvg/VGUtils.h b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/VGUtils.h
new file mode 100644
index 0000000000..3a290cbcc3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/openvg/VGUtils.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef VGUtils_h
+#define VGUtils_h
+
+#include <openvg.h>
+#include <wtf/Assertions.h>
+
+static inline const char* toVGErrorConstant(VGErrorCode error)
+{
+    switch (error) {
+    case VG_BAD_HANDLE_ERROR:
+        return "VG_BAD_HANDLE_ERROR";
+    case VG_ILLEGAL_ARGUMENT_ERROR:
+        return "VG_ILLEGAL_ARGUMENT_ERROR";
+    case VG_OUT_OF_MEMORY_ERROR:
+        return "VG_OUT_OF_MEMORY_ERROR";
+    case VG_PATH_CAPABILITY_ERROR:
+        return "VG_PATH_CAPABILITY_ERROR";
+    case VG_UNSUPPORTED_IMAGE_FORMAT_ERROR:
+        return "VG_UNSUPPORTED_IMAGE_FORMAT_ERROR";
+    case VG_UNSUPPORTED_PATH_FORMAT_ERROR:
+        return "VG_UNSUPPORTED_PATH_FORMAT_ERROR";
+    case VG_IMAGE_IN_USE_ERROR:
+        return "VG_IMAGE_IN_USE_ERROR";
+    case VG_NO_CONTEXT_ERROR:
+        return "VG_NO_CONTEXT_ERROR";
+    default:
+        return "UNKNOWN_ERROR";
+    }
+}
+
+#if ASSERT_DISABLED
+#define ASSERT_VG_NO_ERROR() ((void)0)
+#else
+#define ASSERT_VG_NO_ERROR() do { \
+    VGErrorCode vgErrorCode = vgGetError(); \
+    ASSERT_WITH_MESSAGE(vgErrorCode == VG_NO_ERROR, "Found %s", toVGErrorConstant(vgErrorCode)); \
+} while (0)
+#endif
+
+
+namespace WebCore {
+
+class AffineTransform;
+class FloatRect;
+class TransformationMatrix;
+
+class VGMatrix {
+public:
+    VGMatrix(const VGfloat data[9]);
+    VGMatrix(const AffineTransform&);
+    VGMatrix(const TransformationMatrix&);
+    const VGfloat* toVGfloat() const { return m_data; }
+    operator AffineTransform() const;
+    operator TransformationMatrix() const;
+private:
+    VGfloat m_data[9];
+};
+
+class VGRect {
+public:
+    VGRect(const VGfloat data[4]);
+    VGRect(const FloatRect&);
+    const VGfloat* toVGfloat() const { return m_data; }
+    operator FloatRect() const;
+private:
+    VGfloat m_data[4];
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCacheQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCacheQt.cpp
index 469a72ed91..bfcc5c39f9 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCacheQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCacheQt.cpp
@@ -34,265 +34,39 @@
 #include <wtf/ListHashSet.h>
 #include <wtf/StdLibExtras.h>
 
+#include <QFont>
+
 using namespace WTF;
 
 namespace WebCore {
 
-FontCache* fontCache()
-{
-    DEFINE_STATIC_LOCAL(FontCache, globalFontCache, ());
-    return &globalFontCache;
-}
-
-FontCache::FontCache()
-{
-}
-
-void FontCache::getTraitsInFamily(const AtomicString&, Vector<unsigned>&)
-{
-}
-
-// This type must be consistent with FontPlatformData's ctor - the one which
-// gets FontDescription as it's parameter.
-class FontPlatformDataCacheKey {
-public:
-    FontPlatformDataCacheKey(const FontDescription& description)
-        : m_familyName()
-        , m_size(description.computedPixelSize())
-        , m_bold(false)
-        , m_italic(description.italic())
-        , m_smallCaps(description.smallCaps())
-        , m_hash(0)
-    {
-        // FIXME: Map all FontWeight values to QFont weights in FontPlatformData's ctor and follow it here
-        if (FontPlatformData::toQFontWeight(description.weight()) > QFont::Normal)
-            m_bold = true;
-
-        const FontFamily* family = &description.family();
-        while (family) {
-            m_familyName.append(family->family());
-            family = family->next();
-            if (family)
-                m_familyName.append(',');
-        }
-
-        computeHash();
-    }
-
-    FontPlatformDataCacheKey(const FontPlatformData& fontData)
-        : m_familyName(static_cast<String>(fontData.family()))
-        , m_size(fontData.pixelSize())
-        , m_bold(fontData.bold())
-        , m_italic(fontData.italic())
-        , m_smallCaps(fontData.smallCaps())
-        , m_hash(0)
-    {
-        computeHash();
-    }
-
-    FontPlatformDataCacheKey(HashTableDeletedValueType) : m_size(hashTableDeletedSize()) { }
-    bool isHashTableDeletedValue() const { return m_size == hashTableDeletedSize(); }
-
-    enum HashTableEmptyValueType { HashTableEmptyValue };
-
-    FontPlatformDataCacheKey(HashTableEmptyValueType)
-        : m_familyName()
-        , m_size(0)
-        , m_bold(false)
-        , m_italic(false)
-        , m_smallCaps(false)
-        , m_hash(0)
-    {
-    }
-
-    bool operator==(const FontPlatformDataCacheKey& other) const
-    {
-        if (m_hash != other.m_hash)
-            return false;
-
-        return equalIgnoringCase(m_familyName, other.m_familyName) && m_size == other.m_size &&
-            m_bold == other.m_bold && m_italic == other.m_italic && m_smallCaps == other.m_smallCaps;
-    }
-
-    unsigned hash() const
-    {
-        return m_hash;
-    }
-
-    void computeHash()
-    {
-        unsigned hashCodes[] = {
-            CaseFoldingHash::hash(m_familyName),
-            m_size | static_cast<unsigned>(m_bold << sizeof(unsigned) * 8 - 1)
-                | static_cast<unsigned>(m_italic) << sizeof(unsigned) *8 - 2
-                | static_cast<unsigned>(m_smallCaps) << sizeof(unsigned) * 8 - 3
-        };
-        m_hash = StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));
-    }
-
-private:
-    String m_familyName;
-    int m_size;
-    bool m_bold;
-    bool m_italic;
-    bool m_smallCaps;
-    unsigned m_hash;
-
-    static unsigned hashTableDeletedSize() { return 0xFFFFFFFFU; }
-};
-
-struct FontPlatformDataCacheKeyHash {
-    static unsigned hash(const FontPlatformDataCacheKey& key)
-    {
-        return key.hash();
-    }
-
-    static bool equal(const FontPlatformDataCacheKey& a, const FontPlatformDataCacheKey& b)
-    {
-        return a == b;
-    }
-
-    static const bool safeToCompareToEmptyOrDeleted = true;
-};
-
-struct FontPlatformDataCacheKeyTraits : WTF::GenericHashTraits<FontPlatformDataCacheKey> {
-    static const bool needsDestruction = true;
-    static const FontPlatformDataCacheKey& emptyValue()
-    {
-        DEFINE_STATIC_LOCAL(FontPlatformDataCacheKey, key, (FontPlatformDataCacheKey::HashTableEmptyValue));
-        return key;
-    }
-    static void constructDeletedValue(FontPlatformDataCacheKey& slot)
-    {
-        new (&slot) FontPlatformDataCacheKey(HashTableDeletedValue);
-    }
-    static bool isDeletedValue(const FontPlatformDataCacheKey& value)
-    {
-        return value.isHashTableDeletedValue();
-    }
-};
-
-typedef HashMap<FontPlatformDataCacheKey, FontPlatformData*, FontPlatformDataCacheKeyHash, FontPlatformDataCacheKeyTraits> FontPlatformDataCache;
-
-// using Q_GLOBAL_STATIC leads to crash. TODO investigate the way to fix this.
-static FontPlatformDataCache* gFontPlatformDataCache = 0;
-
-FontPlatformData* FontCache::getCachedFontPlatformData(const FontDescription& description, const AtomicString& family, bool)
-{
-    if (!gFontPlatformDataCache)
-        gFontPlatformDataCache = new FontPlatformDataCache;
-
-    FontDescription descriptionWithResolvedFamily(description);
-    FontFamily resolvedFamily;
-    resolvedFamily.setFamily(family);
-    descriptionWithResolvedFamily.setFamily(resolvedFamily);
-
-    FontPlatformDataCacheKey key(descriptionWithResolvedFamily);
-    FontPlatformData* platformData = gFontPlatformDataCache->get(key);
-    if (!platformData) {
-        platformData = new FontPlatformData(descriptionWithResolvedFamily);
-        gFontPlatformDataCache->add(key, platformData);
-    }
-    return platformData;
-}
-
-typedef HashMap<FontPlatformDataCacheKey, std::pair<SimpleFontData*, unsigned>, FontPlatformDataCacheKeyHash, FontPlatformDataCacheKeyTraits> FontDataCache;
-
-static FontDataCache* gFontDataCache = 0;
-
-static const int cMaxInactiveFontData = 40;
-static const int cTargetInactiveFontData = 32;
-
-static ListHashSet<const SimpleFontData*>* gInactiveFontDataSet = 0;
-
-SimpleFontData* FontCache::getCachedFontData(const FontPlatformData* fontPlatformData)
+void FontCache::platformInit()
 {
-    if (!gFontDataCache) {
-        gFontDataCache = new FontDataCache;
-        gInactiveFontDataSet = new ListHashSet<const SimpleFontData*>;
-    }
-
-    FontPlatformDataCacheKey key(*fontPlatformData);
-    FontDataCache::iterator it = gFontDataCache->find(key);
-    if (it == gFontDataCache->end()) {
-        SimpleFontData* fontData = new SimpleFontData(*fontPlatformData);
-        gFontDataCache->add(key, std::pair<SimpleFontData*, unsigned>(fontData, 1));
-        return fontData;
-    }
-    if (!it->second.second++) {
-        ASSERT(gInactiveFontDataSet->contains(it->second.first));
-        gInactiveFontDataSet->remove(it->second.first);
-    }
-    return it->second.first;
 }
 
-FontPlatformData* FontCache::getLastResortFallbackFont(const FontDescription&)
+const SimpleFontData* FontCache::getFontDataForCharacters(const Font&, const UChar*, int)
 {
     return 0;
 }
 
-void FontCache::releaseFontData(const WebCore::SimpleFontData* fontData)
+SimpleFontData* FontCache::getSimilarFontPlatformData(const Font& font)
 {
-    ASSERT(gFontDataCache);
-    ASSERT(!fontData->isCustomFont());
-
-    FontPlatformDataCacheKey key(fontData->platformData());
-    FontDataCache::iterator it = gFontDataCache->find(key);
-    ASSERT(it != gFontDataCache->end());
-    if (!--it->second.second) {
-        gInactiveFontDataSet->add(it->second.first);
-        if (gInactiveFontDataSet->size() > cMaxInactiveFontData)
-            purgeInactiveFontData(gInactiveFontDataSet->size() - cTargetInactiveFontData);
-    }
-}
-
-void FontCache::purgeInactiveFontData(int count)
-{
-    static bool isPurging;  // Guard against reentry when e.g. a deleted FontData releases its small caps FontData.
-    if (isPurging)
-        return;
-
-    isPurging = true;
-
-    ListHashSet<const SimpleFontData*>::iterator it = gInactiveFontDataSet->begin();
-    ListHashSet<const SimpleFontData*>::iterator end = gInactiveFontDataSet->end();
-    for (int i = 0; i < count && it != end; ++i, ++it) {
-        FontPlatformDataCacheKey key = (*it)->platformData();
-        pair<SimpleFontData*, unsigned> fontDataPair = gFontDataCache->take(key);
-        ASSERT(fontDataPair.first != 0);
-        ASSERT(!fontDataPair.second);
-        delete fontDataPair.first;
-
-        FontPlatformData* platformData = gFontPlatformDataCache->take(key);
-        if (platformData)
-            delete platformData;
-    }
-
-    if (it == end) {
-        // Removed everything
-        gInactiveFontDataSet->clear();
-    } else {
-        for (int i = 0; i < count; ++i)
-            gInactiveFontDataSet->remove(gInactiveFontDataSet->begin());
-    }
-
-    isPurging = false;
+    return 0;
 }
 
-void FontCache::addClient(FontSelector*)
+SimpleFontData* FontCache::getLastResortFallbackFont(const FontDescription& fontDescription)
 {
+    const AtomicString fallbackFamily = QFont(fontDescription.family().family()).lastResortFamily();
+    return getCachedFontData(new FontPlatformData(fontDescription, fallbackFamily));
 }
 
-void FontCache::removeClient(FontSelector*)
+void FontCache::getTraitsInFamily(const AtomicString&, Vector<unsigned>&)
 {
 }
 
-void FontCache::invalidate()
+FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontDescription, const AtomicString& familyName)
 {
-    if (!gFontPlatformDataCache || !gFontDataCache)
-        return;
-
-    purgeInactiveFontData();
+    return new FontPlatformData(fontDescription, familyName);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCustomPlatformData.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
index a19464ebd7..6e9d053615 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCustomPlatformData.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
@@ -43,7 +43,7 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
         font.setWeight(QFont::Bold);
     font.setItalic(italic);
 
-    return FontPlatformData(font, bold);
+    return FontPlatformData(font);
 }
 
 FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontFallbackListQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontFallbackListQt.cpp
deleted file mode 100644
index 0306abf864..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontFallbackListQt.cpp
+++ /dev/null
@@ -1,138 +0,0 @@
-/*
-    Copyright (C) 2008 Holger Hans Peter Freyther
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-
-    Replacement of the stock FontFallbackList as Qt is going to find us a
-    replacement font, will do caching and the other stuff we implement in
-    WebKit.
-*/
-
-#include "config.h"
-#include "FontFallbackList.h"
-
-#include "Font.h"
-#include "FontCache.h"
-#include "SegmentedFontData.h"
-
-#include <QDebug>
-
-namespace WebCore {
-
-FontFallbackList::FontFallbackList()
-    : m_pageZero(0)
-    , m_cachedPrimarySimpleFontData(0)
-    , m_fontSelector(0)
-    , m_familyIndex(0)
-    , m_pitch(UnknownPitch)
-    , m_loadingCustomFonts(false)
-    , m_generation(0)
-{
-}
-
-void FontFallbackList::invalidate(WTF::PassRefPtr<WebCore::FontSelector> fontSelector)
-{
-    releaseFontData();
-    m_fontList.clear();
-    m_pageZero = 0;
-    m_pages.clear();
-    m_cachedPrimarySimpleFontData = 0;
-    m_familyIndex = 0;
-    m_pitch = UnknownPitch;
-    m_loadingCustomFonts = false;
-    m_fontSelector = fontSelector;
-    m_generation = 0;
-}
-
-void FontFallbackList::releaseFontData()
-{
-    unsigned numFonts = m_fontList.size();
-    for (unsigned i = 0; i < numFonts; ++i) {
-        if (m_fontList[i].second)
-            delete m_fontList[i].first;
-        else {
-            ASSERT(!m_fontList[i].first->isSegmented());
-            fontCache()->releaseFontData(static_cast<const SimpleFontData*>(m_fontList[i].first));
-        }
-    }
-}
-
-void FontFallbackList::determinePitch(const WebCore::Font* font) const
-{
-    const FontData* fontData = primaryFontData(font);
-    if (!fontData->isSegmented())
-        m_pitch = static_cast<const SimpleFontData*>(fontData)->pitch();
-    else {
-        const SegmentedFontData* segmentedFontData = static_cast<const SegmentedFontData*>(fontData);
-        unsigned numRanges = segmentedFontData->numRanges();
-        if (numRanges == 1)
-            m_pitch = segmentedFontData->rangeAt(0).fontData()->pitch();
-        else
-            m_pitch = VariablePitch;
-    }
-}
-
-const FontData* FontFallbackList::fontDataAt(const WebCore::Font* _font, unsigned index) const
-{
-    if (index != 0)
-        return 0;
-
-    // Search for the WebCore font that is already in the list
-    for (int i = m_fontList.size() - 1; i >= 0; --i) {
-        pair<const FontData*, bool> item = m_fontList[i];
-        // item.second means that the item was created locally or not
-        if (!item.second)
-            return item.first;
-    }
-
-    // Use the FontSelector to get a WebCore font and then fallback to Qt
-    const FontDescription& description = _font->fontDescription();
-    const FontFamily* family = &description.family();
-    while (family) {
-        if (family->family().length() && m_fontSelector) {
-            FontData* data = m_fontSelector->getFontData(description, family->family());
-            if (data) {
-                if (data->isLoading())
-                    m_loadingCustomFonts = true;
-                if (!data->isCustomFont()) {
-                    // Custom fonts can be freed anytime so we must not hold them
-                    m_fontList.append(pair<const FontData*, bool>(data, false));
-                }
-                return data;
-            }
-        }
-        family = family->next();
-    }
-
-    if (m_fontList.size())
-        return m_fontList[0].first;
-
-    const FontData* result = new SimpleFontData(FontPlatformData(description, _font->wordSpacing(), _font->letterSpacing()), true);
-    m_fontList.append(pair<const FontData*, bool>(result, true));
-    return result;
-}
-
-const FontData* FontFallbackList::fontDataForCharacters(const WebCore::Font* font, const UChar*, int) const
-{
-    return primaryFontData(font);
-}
-
-void FontFallbackList::setPlatformFont(const WebCore::FontPlatformData&)
-{
-    m_familyIndex = cAllFamiliesScanned;
-}
-
-}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontPlatformData.h b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontPlatformData.h
index 92219fde68..9355142734 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontPlatformData.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontPlatformData.h
@@ -26,20 +26,62 @@
 
 #include "FontDescription.h"
 #include <QFont>
+#include <QHash>
 
 namespace WebCore {
 
 class String;
+class FontPlatformDataPrivate : public Noncopyable {
+public:
+    FontPlatformDataPrivate()
+        : refCount(1)
+        , size(font.pointSizeF())
+        , bold(font.bold())
+        , oblique(false)
+    {}
+    FontPlatformDataPrivate(const float size, const bool bold, const bool oblique)
+        : refCount(1)
+        , size(size)
+        , bold(bold)
+        , oblique(oblique)
+    {}
+    FontPlatformDataPrivate(const QFont& font)
+        : refCount(1)
+        , font(font)
+        , size(font.pointSizeF())
+        , bold(font.bold())
+        , oblique(false)
+    {}
+    unsigned refCount;
+    QFont font;
+    float size;
+    bool bold : 1;
+    bool oblique : 1;
+};
+
+
 
-class FontPlatformData
-{
+class FontPlatformData : public FastAllocBase {
 public:
-#if ENABLE(SVG_FONTS)
     FontPlatformData(float size, bool bold, bool oblique);
-#endif
-    FontPlatformData();
-    FontPlatformData(const FontDescription&, int wordSpacing = 0, int letterSpacing = 0);
-    FontPlatformData(const QFont&, bool bold);
+    FontPlatformData(const FontPlatformData &);
+    FontPlatformData(const FontDescription&, const AtomicString& familyName, int wordSpacing = 0, int letterSpacing = 0);
+    FontPlatformData(const QFont& font)
+        : m_data(new FontPlatformDataPrivate(font))
+    {}
+    FontPlatformData(WTF::HashTableDeletedValueType)
+        : m_data(reinterpret_cast<FontPlatformDataPrivate*>(-1))
+    {}
+
+    ~FontPlatformData();
+
+    FontPlatformData& operator=(const FontPlatformData&);
+    bool operator==(const FontPlatformData&) const;
+
+    bool isHashTableDeletedValue() const
+    {
+        return m_data == reinterpret_cast<FontPlatformDataPrivate*>(-1);
+    }
 
     static inline QFont::Weight toQFontWeight(FontWeight fontWeight)
     {
@@ -62,22 +104,62 @@ public:
         }
     }
 
-    QFont font() const { return m_font; }
-    float size() const { return m_size; }
-    QString family() const { return m_font.family(); }
-    bool bold() const { return m_bold; }
-    bool italic() const { return m_font.italic(); }
-    bool smallCaps() const { return m_font.capitalization() == QFont::SmallCaps; }
-    int pixelSize() const { return m_font.pixelSize(); }
+    QFont font() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->font;
+        return QFont();
+    }
+    float size() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->size;
+        return 0.0f;
+    }
+    QString family() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->font.family();
+        return QString();
+    }
+    bool bold() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->bold;
+        return false;
+    }
+    bool italic() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->font.italic();
+        return false;
+    }
+    bool smallCaps() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->font.capitalization() == QFont::SmallCaps;
+        return false;
+    }
+    int pixelSize() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->font.pixelSize();
+        return 0;
+    }
+    unsigned hash() const;
 
 #ifndef NDEBUG
     String description() const;
 #endif
-
-    float m_size;
-    bool m_bold;
-    bool m_oblique;
-    QFont m_font;
+private:
+    FontPlatformDataPrivate* m_data;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
index 7709be6b4e..0a1075f02d 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
@@ -26,56 +26,93 @@
 
 namespace WebCore {
 
-FontPlatformData::FontPlatformData(const FontDescription& description, int wordSpacing, int letterSpacing)
-    : m_size(0.0f)
-    , m_bold(false)
-    , m_oblique(false)
+static inline bool isEmtpyValue(const float size, const bool bold, const bool oblique)
 {
-    QString familyName;
-    const FontFamily* family = &description.family();
-    while (family) {
-        familyName += family->family();
-        family = family->next();
-        if (family)
-            familyName += QLatin1Char(',');
-    }
+     // this is the empty value by definition of the trait FontDataCacheKeyTraits
+    return !bold && !oblique && size == 0.f;
+}
 
-    m_font.setFamily(familyName);
-    m_font.setPixelSize(qRound(description.computedSize()));
-    m_font.setItalic(description.italic());
+FontPlatformData::FontPlatformData(float size, bool bold, bool oblique)
+{
+    if (isEmtpyValue(size, bold, oblique))
+        m_data = 0;
+    else
+        m_data = new FontPlatformDataPrivate(size, bold, oblique);
+}
+
+FontPlatformData::FontPlatformData(const FontPlatformData &other) : m_data(other.m_data)
+{
+    if (m_data && m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1))
+        ++m_data->refCount;
+}
 
-    m_font.setWeight(toQFontWeight(description.weight()));
-    m_bold = m_font.bold();
+FontPlatformData::FontPlatformData(const FontDescription& description, const AtomicString& familyName, int wordSpacing, int letterSpacing)
+    : m_data(new FontPlatformDataPrivate())
+{
+    QFont& font = m_data->font;
+    font.setFamily(familyName);
+    font.setPixelSize(qRound(description.computedSize()));
+    font.setItalic(description.italic());
+    font.setWeight(toQFontWeight(description.weight()));
+    font.setWordSpacing(wordSpacing);
+    font.setLetterSpacing(QFont::AbsoluteSpacing, letterSpacing);
+    const bool smallCaps = description.smallCaps();
+    font.setCapitalization(smallCaps ? QFont::SmallCaps : QFont::MixedCase);
+
+    m_data->bold = font.bold();
+    m_data->size = font.pointSizeF();
+}
 
-    bool smallCaps = description.smallCaps();
-    m_font.setCapitalization(smallCaps ? QFont::SmallCaps : QFont::MixedCase);
-    m_font.setWordSpacing(wordSpacing);
-    m_font.setLetterSpacing(QFont::AbsoluteSpacing, letterSpacing);
-    m_size = m_font.pointSize();
+FontPlatformData::~FontPlatformData()
+{
+    if (!m_data || m_data == reinterpret_cast<FontPlatformDataPrivate*>(-1))
+        return;
+    --m_data->refCount;
+    if (!m_data->refCount)
+        delete m_data;
 }
 
-FontPlatformData::FontPlatformData(const QFont& font, bool bold)
-    : m_size(font.pointSize())
-    , m_bold(bold)
-    , m_oblique(false)
-    , m_font(font)
+FontPlatformData& FontPlatformData::operator=(const FontPlatformData& other)
 {
+    if (m_data == other.m_data)
+        return *this;
+    if (m_data && m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1)) {
+        --m_data->refCount;
+        if (!m_data->refCount)
+            delete m_data;
+    }
+    m_data = other.m_data;
+    if (m_data && m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1))
+        ++m_data->refCount;
+    return *this;
 }
 
-#if ENABLE(SVG_FONTS)
-FontPlatformData::FontPlatformData(float size, bool bold, bool oblique)
-    : m_size(size)
-    , m_bold(bold)
-    , m_oblique(oblique)
+bool FontPlatformData::operator==(const FontPlatformData& other) const
 {
+    if (m_data == other.m_data)
+        return true;
+
+    if (!m_data || !other.m_data
+        || m_data == reinterpret_cast<FontPlatformDataPrivate*>(-1) || other.m_data == reinterpret_cast<FontPlatformDataPrivate*>(-1))
+        return  false;
+
+    const bool equals = (m_data->size == other.m_data->size
+                         && m_data->bold == other.m_data->bold
+                         && m_data->oblique == other.m_data->oblique
+                         && m_data->font == other.m_data->font);
+    return equals;
 }
-#endif
 
-FontPlatformData::FontPlatformData()
-    : m_size(0.0f)
-    , m_bold(false)
-    , m_oblique(false)
+unsigned FontPlatformData::hash() const
 {
+    if (!m_data)
+        return 0;
+    if (m_data == reinterpret_cast<FontPlatformDataPrivate*>(-1))
+        return 1;
+    return qHash(m_data->font.toString())
+           ^ qHash(*reinterpret_cast<quint32*>(&m_data->size))
+           ^ qHash(m_data->bold)
+           ^ qHash(m_data->oblique);
 }
 
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontQt.cpp
index c5960ac2a6..fd75e344a8 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontQt.cpp
@@ -1,6 +1,6 @@
 /*
     Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
-    Copyright (C) 2008 Holger Hans Peter Freyther
+    Copyright (C) 2008, 2010 Holger Hans Peter Freyther
     Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
@@ -21,14 +21,14 @@
 
 #include "config.h"
 #include "Font.h"
+
+#include "AffineTransform.h"
 #include "FontDescription.h"
 #include "FontFallbackList.h"
 #include "FontSelector.h"
-
 #include "Gradient.h"
 #include "GraphicsContext.h"
 #include "Pattern.h"
-#include "TransformationMatrix.h"
 
 #include <QBrush>
 #include <QFontInfo>
@@ -42,27 +42,13 @@
 
 #include <limits.h>
 
-#if QT_VERSION >= 0x040400
 namespace WebCore {
 
-static const QString qstring(const TextRun& run)
-{
-    // We don't detach
-    return QString::fromRawData(reinterpret_cast<const QChar*>(run.characters()), run.length());
-}
-
-static const QString fixSpacing(const QString &string)
+static const QString fromRawDataWithoutRef(const String& string)
 {
-    //Only detach if we're actually changing something
-    QString possiblyDetached = string;
-    for (int i = 0; i < string.length(); ++i) {
-        const QChar c = string.at(i);
-        if (c.unicode() != 0x20 && Font::treatAsSpace(c.unicode()))
-            possiblyDetached[i] = 0x20; // detach
-        else if (c.unicode() != 0x200c && Font::treatAsZeroWidthSpace(c.unicode()))
-            possiblyDetached[i] = 0x200c; // detach
-    }
-    return possiblyDetached;
+    // We don't detach. This assumes the WebCore string data will stay valid for the
+    // lifetime of the QString we pass back, since we don't ref the WebCore string.
+    return QString::fromRawData(reinterpret_cast<const QChar*>(string.characters()), string.length());
 }
 
 static QTextLine setupLayout(QTextLayout* layout, const TextRun& style)
@@ -93,7 +79,7 @@ void Font::drawComplexText(GraphicsContext* ctx, const TextRun& run, const Float
             brush.setTransform(ctx->fillGradient()->gradientSpaceTransform());
             p->setPen(QPen(brush, 0));
         } else if (ctx->fillPattern()) {
-            TransformationMatrix affine;
+            AffineTransform affine;
             p->setPen(QPen(QBrush(ctx->fillPattern()->createPlatformPattern(affine)), 0));
         } else
             p->setPen(QColor(ctx->fillColor()));
@@ -105,13 +91,14 @@ void Font::drawComplexText(GraphicsContext* ctx, const TextRun& run, const Float
             brush.setTransform(ctx->strokeGradient()->gradientSpaceTransform());
             p->setPen(QPen(brush, ctx->strokeThickness()));
         } else if (ctx->strokePattern()) {
-            TransformationMatrix affine;
+            AffineTransform affine;
             p->setPen(QPen(QBrush(ctx->strokePattern()->createPlatformPattern(affine)), ctx->strokeThickness()));
         } else
             p->setPen(QPen(QColor(ctx->strokeColor()), ctx->strokeThickness()));
     }
 
-    const QString string = fixSpacing(qstring(run));
+    String sanitized = Font::normalizeSpaces(String(run.characters(), run.length()));
+    QString string = fromRawDataWithoutRef(sanitized);
 
     // text shadow
     IntSize shadowSize;
@@ -147,7 +134,7 @@ void Font::drawComplexText(GraphicsContext* ctx, const TextRun& run, const Float
             clip.adjust(dx1, dx2, dy1, dy2);
         }
         p->save();
-        p->setClipRect(clip.toRect());
+        p->setClipRect(clip.toRect(), Qt::IntersectClip);
         QPointF pt(point.x(), point.y() - ascent);
         if (hasShadow) {
             p->save();
@@ -186,7 +173,13 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
 {
     if (!run.length())
         return 0;
-    const QString string = fixSpacing(qstring(run));
+
+    if (run.length() == 1 && treatAsSpace(run[0]))
+        return QFontMetrics(font()).width(run[0]) - m_wordSpacing + run.padding();
+
+    String sanitized = Font::normalizeSpaces(String(run.characters(), run.length()));
+    QString string = fromRawDataWithoutRef(sanitized);
+
     QTextLayout layout(string, font());
     QTextLine line = setupLayout(&layout, run);
     int w = int(line.naturalTextWidth());
@@ -199,7 +192,9 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
 
 int Font::offsetForPositionForComplexText(const TextRun& run, int position, bool) const
 {
-    const QString string = fixSpacing(qstring(run));
+    String sanitized = Font::normalizeSpaces(String(run.characters(), run.length()));
+    QString string = fromRawDataWithoutRef(sanitized);
+
     QTextLayout layout(string, font());
     QTextLine line = setupLayout(&layout, run);
     return line.xToCursor(position);
@@ -207,7 +202,9 @@ int Font::offsetForPositionForComplexText(const TextRun& run, int position, bool
 
 FloatRect Font::selectionRectForComplexText(const TextRun& run, const IntPoint& pt, int h, int from, int to) const
 {
-    const QString string = fixSpacing(qstring(run));
+    String sanitized = Font::normalizeSpaces(String(run.characters(), run.length()));
+    QString string = fromRawDataWithoutRef(sanitized);
+
     QTextLayout layout(string, font());
     QTextLine line = setupLayout(&layout, run);
 
@@ -222,12 +219,12 @@ FloatRect Font::selectionRectForComplexText(const TextRun& run, const IntPoint&
 QFont Font::font() const
 {
     QFont f = primaryFont()->getQtFont();
-    f.setLetterSpacing(QFont::AbsoluteSpacing, m_letterSpacing);
-    f.setWordSpacing(m_wordSpacing);
+    if (m_letterSpacing != 0)
+        f.setLetterSpacing(QFont::AbsoluteSpacing, m_letterSpacing);
+    if (m_wordSpacing != 0)
+        f.setWordSpacing(m_wordSpacing);
     return f;
 }
 
 }
 
-#endif
-
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontQt43.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontQt43.cpp
deleted file mode 100644
index 45bf05d49a..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontQt43.cpp
+++ /dev/null
@@ -1,354 +0,0 @@
-/*
-    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
-    Copyright (C) 2008 Holger Hans Peter Freyther
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-#include "Font.h"
-#include "FontDescription.h"
-#include "FontFallbackList.h"
-#include "FontSelector.h"
-
-#include "GraphicsContext.h"
-#include <QTextLayout>
-#include <QPainter>
-#include <QFontMetrics>
-#include <QFontInfo>
-#include <qalgorithms.h>
-#include <qdebug.h>
-
-#include <limits.h>
-
-#if QT_VERSION < 0x040400
-
-namespace WebCore {
-
-struct TextRunComponent {
-    TextRunComponent() : font(0) {}
-    TextRunComponent(const UChar *start, int length, bool rtl, const QFont *font, int offset, bool sc = false);
-    TextRunComponent(int spaces, bool rtl, const QFont *font, int offset);
-
-    inline bool isSpace() const { return spaces != 0; }
-
-    QString string;
-    const QFont *font;
-    int width;
-    int offset;
-    int spaces;
-};
-
-TextRunComponent::TextRunComponent(const UChar *start, int length, bool rtl, const QFont *f, int o, bool sc)
-    : string(reinterpret_cast<const QChar*>(start), length)
-    , font(f)
-    , offset(o)
-    , spaces(0)
-{
-    if (sc)
-        string = string.toUpper();
-    string.prepend(rtl ? QChar(0x202e) : QChar(0x202d));
-    width = QFontMetrics(*font).width(string);
-}
-
-TextRunComponent::TextRunComponent(int s, bool rtl, const QFont *f, int o)
-    : string(s, QLatin1Char(' '))
-    , font(f)
-    , offset(o)
-    , spaces(s)
-{
-    string.prepend(rtl ? QChar(0x202e) : QChar(0x202d));
-    width = spaces * QFontMetrics(*font).width(QLatin1Char(' '));
-}
-
-
-static int generateComponents(Vector<TextRunComponent, 1024>* components, const Font &font, const TextRun &run)
-{
-//     qDebug() << "generateComponents" << QString((const QChar *)run.characters(), run.length());
-    int letterSpacing = font.letterSpacing();
-    int wordSpacing = font.wordSpacing();
-    bool smallCaps = font.fontDescription().smallCaps();
-    int padding = run.padding();
-    int numSpaces = 0;
-    if (padding) {
-        for (int i = 0; i < run.length(); i++)
-            if (Font::treatAsSpace(run[i]))
-                ++numSpaces;
-    }
-
-    int offset = 0;
-    const QFont *f = &font.font();
-    if (letterSpacing || smallCaps) {
-        // need to draw every letter on it's own
-        int start = 0;
-        if (Font::treatAsSpace(run[0])) {
-            int add = 0;
-            if (numSpaces) {
-                add = padding/numSpaces;
-                padding -= add;
-                --numSpaces;
-            }
-            components->append(TextRunComponent(1, run.rtl(), &font.font(), offset));
-            offset += add + letterSpacing + components->last().width;
-            start = 1;
-//         qDebug() << "space at 0" << offset;
-        } else if (smallCaps)
-            f = (QChar::category(run[0]) == QChar::Letter_Lowercase ? &font.scFont() : &font.font());
-
-        for (int i = 1; i < run.length(); ++i) {
-            uint ch = run[i];
-            if (QChar(ch).isHighSurrogate() && QChar(run[i-1]).isLowSurrogate())
-                ch = QChar::surrogateToUcs4(ch, run[i-1]);
-            if (QChar(ch).isLowSurrogate() || QChar::category(ch) == QChar::Mark_NonSpacing)
-                continue;
-            if (Font::treatAsSpace(run[i])) {
-                int add = 0;
-//                 qDebug() << "    treatAsSpace:" << i << start;
-                if (i - start > 0) {
-                    components->append(TextRunComponent(run.characters() + start, i - start,
-                                                        run.rtl(),
-                                                        f, offset, f == &font.scFont()));
-                    offset += components->last().width + letterSpacing;
-//                     qDebug() << "   appending(1) " << components->last().string << components->last().width;
-                }
-                if (numSpaces) {
-                    add = padding/numSpaces;
-                    padding -= add;
-                    --numSpaces;
-                }
-                components->append(TextRunComponent(1, run.rtl(), &font.font(), offset));
-                offset += wordSpacing + add + components->last().width + letterSpacing;
-                start = i + 1;
-                continue;
-            } else if (!letterSpacing) {
-//                 qDebug() << i << char(run[i]) << (QChar::category(ch) == QChar::Letter_Lowercase) <<
-//                     QFontInfo(*f).pointSizeF();
-                if (QChar::category(ch) == QChar::Letter_Lowercase) {
-                    if (f == &font.scFont())
-                        continue;
-                } else {
-                    if (f == &font.font())
-                        continue;
-                }
-            }
-            if (i - start > 0) {
-                components->append(TextRunComponent(run.characters() + start, i - start,
-                                                    run.rtl(),
-                                                    f, offset, f == &font.scFont()));
-                offset += components->last().width + letterSpacing;
-//                 qDebug() << "   appending(2) " << components->last().string << components->last().width;
-            }
-            if (smallCaps)
-                f = (QChar::category(ch) == QChar::Letter_Lowercase ? &font.scFont() : &font.font());
-            start = i;
-        }
-        if (run.length() - start > 0) {
-            components->append(TextRunComponent(run.characters() + start, run.length() - start,
-                                                run.rtl(),
-                                                f, offset, f == &font.scFont()));
-            offset += components->last().width;
-//             qDebug() << "   appending(3) " << components->last().string << components->last().width;
-        }
-        offset += letterSpacing;
-    } else {
-        int start = 0;
-        for (int i = 0; i < run.length(); ++i) {
-            if (Font::treatAsSpace(run[i])) {
-                if (i - start > 0) {
-                    components->append(TextRunComponent(run.characters() + start, i - start,
-                                                        run.rtl(),
-                                                        f, offset));
-                    offset += components->last().width;
-                }
-                int add = 0;
-                if (numSpaces) {
-                    add = padding/numSpaces;
-                    padding -= add;
-                    --numSpaces;
-                }
-                components->append(TextRunComponent(1, run.rtl(), &font.font(), offset));
-                offset += add + components->last().width;
-                if (i)
-                    offset += wordSpacing;
-                start = i + 1;
-            }
-        }
-        if (run.length() - start > 0) {
-            components->append(TextRunComponent(run.characters() + start, run.length() - start,
-                                                run.rtl(),
-                                                f, offset));
-            offset += components->last().width;
-        }
-    }
-    return offset;
-}
-
-void Font::drawComplexText(GraphicsContext* ctx, const TextRun& run, const FloatPoint& point, int from, int to) const
-{
-    if (to < 0)
-        to = run.length();
-
-    QPainter *p = ctx->platformContext();
-    Color color = ctx->fillColor();
-    p->setPen(QColor(color));
-
-    Vector<TextRunComponent, 1024> components;
-    int w = generateComponents(&components, *this, run);
-
-    if (from > 0 || to < run.length()) {
-        FloatRect clip = selectionRectForComplexText(run,
-                                              IntPoint(qRound(point.x()), qRound(point.y())),
-                                              QFontMetrics(font()).height(), from, to);
-        QRectF rect(clip.x(), clip.y() - ascent(), clip.width(), clip.height());
-        p->save();
-        p->setClipRect(rect.toRect());
-    }
-
-    if (run.rtl()) {
-        for (int i = 0; i < components.size(); ++i) {
-            if (!components.at(i).isSpace()) {
-                p->setFont(*components.at(i).font);
-                QPointF pt(point.x() + w - components.at(i).offset - components.at(i).width, point.y());
-                p->drawText(pt, components.at(i).string);
-            }
-        }
-    } else {
-        for (int i = 0; i < components.size(); ++i) {
-            if (!components.at(i).isSpace()) {
-                p->setFont(*components.at(i).font);
-                QPointF pt(point.x() + components.at(i).offset, point.y());
-                p->drawText(pt, components.at(i).string);
-            }
-        }
-    }
-    if (from > 0 || to < run.length())
-        p->restore();
-}
-
-float Font::floatWidthForComplexText(const TextRun& run) const
-{
-    Vector<TextRunComponent, 1024> components;
-    int w = generateComponents(&components, *this, run);
-
-    return w;
-}
-
-int Font::offsetForPositionForComplexText(const TextRun& run, int position, bool includePartialGlyphs) const
-{
-    Vector<TextRunComponent, 1024> components;
-    int w = generateComponents(&components, *this, run);
-
-    int offset = 0;
-    if (run.rtl()) {
-        for (int i = 0; i < components.size(); ++i) {
-            int xe = w - components.at(i).offset;
-            int xs = xe - components.at(i).width;
-            if (position >= xs) {
-                QTextLayout layout(components.at(i).string, *components.at(i).font);
-                layout.beginLayout();
-                QTextLine l = layout.createLine();
-                if (!l.isValid())
-                    return offset;
-
-                l.setLineWidth(INT_MAX / 256);
-                layout.endLayout();
-
-                if (position - xs >= l.width())
-                    return offset;
-                int cursor = l.xToCursor(position - xs);
-                if (cursor > 1)
-                    --cursor;
-                return offset + cursor;
-            } else
-                offset += components.at(i).string.length() - 1;
-        }
-    } else {
-        for (int i = 0; i < components.size(); ++i) {
-            int xs = components.at(i).offset;
-            int xe = xs + components.at(i).width;
-            if (position <= xe) {
-                QTextLayout layout(components.at(i).string, *components.at(i).font);
-                layout.beginLayout();
-                QTextLine l = layout.createLine();
-                if (!l.isValid())
-                    return offset;
-
-                l.setLineWidth(INT_MAX / 256);
-                layout.endLayout();
-
-                if (position - xs >= l.width())
-                    return offset + components.at(i).string.length() - 1;
-                int cursor = l.xToCursor(position - xs);
-                if (cursor > 1)
-                    --cursor;
-                return offset + cursor;
-            } else
-                offset += components.at(i).string.length() - 1;
-        }
-    }
-    return run.length();
-}
-
-static float cursorToX(const Vector<TextRunComponent, 1024>& components, int width, bool rtl, int cursor)
-{
-    int start = 0;
-    for (int i = 0; i < components.size(); ++i) {
-        if (start + components.at(i).string.length() - 1 < cursor) {
-            start += components.at(i).string.length() - 1;
-            continue;
-        }
-        int xs = components.at(i).offset;
-        if (rtl)
-            xs = width - xs - components.at(i).width;
-        QTextLayout layout(components.at(i).string, *components.at(i).font);
-        layout.beginLayout();
-        QTextLine l = layout.createLine();
-        if (!l.isValid())
-            return 0;
-
-        l.setLineWidth(INT_MAX / 256);
-        layout.endLayout();
-
-        return xs + l.cursorToX(cursor - start + 1);
-    }
-    return width;
-}
-
-FloatRect Font::selectionRectForComplexText(const TextRun& run, const IntPoint& pt,
-                                     int h, int from, int to) const
-{
-    Vector<TextRunComponent, 1024> components;
-    int w = generateComponents(&components, *this, run);
-
-    if (from == 0 && to == run.length())
-        return FloatRect(pt.x(), pt.y(), w, h);
-
-    float x1 = cursorToX(components, w, run.rtl(), from);
-    float x2 = cursorToX(components, w, run.rtl(), to);
-    if (x2 < x1)
-        qSwap(x1, x2);
-
-    return FloatRect(pt.x() + x1, pt.y(), x2 - x1, h);
-}
-
-int Font::lineGap() const
-{
-    return QFontMetrics(m_font).leading();
-}
-
-}
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GradientQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GradientQt.cpp
index 9b9acc28b7..8b9e2d7f85 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GradientQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GradientQt.cpp
@@ -51,6 +51,8 @@ QGradient* Gradient::platformGradient()
     else
         m_gradient = new QLinearGradient(m_p0.x(), m_p0.y(), m_p1.x(), m_p1.y());
 
+    sortStopsIfNecessary();
+
     QColor stopColor;
     Vector<ColorStop>::iterator stopIterator = m_stops.begin();
     qreal lastStop(0.0);
@@ -64,9 +66,17 @@ QGradient* Gradient::platformGradient()
         if (m_radial && m_r0)
             lastStop = m_r0 / m_r1 + lastStop * (1.0f - m_r0 / m_r1);
         m_gradient->setColorAt(lastStop, stopColor);
+        // Keep the lastStop as orginal value, since the following stopColor depend it
+        lastStop = stopIterator->stop;
         ++stopIterator;
     }
 
+    if (m_stops.isEmpty()) {
+        // The behavior of QGradient with no stops is defined differently from HTML5 spec,
+        // where the latter requires the gradient to be transparent black.
+        m_gradient->setColorAt(0.0, QColor(0, 0, 0, 0));
+    }
+
     switch (m_spreadMethod) {
     case SpreadMethodPad:
         m_gradient->setSpread(QGradient::PadSpread);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
new file mode 100644
index 0000000000..242c29c3a2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
@@ -0,0 +1,1631 @@
+/*
+    Copyright (C) 2010 Tieto Corporation.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+     
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+     
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+#include "config.h"
+
+#include "GraphicsContext3D.h"
+
+#include "CString.h"
+#include "CanvasObject.h"
+#include "GraphicsContext.h"
+#include "HTMLCanvasElement.h"
+#include "ImageBuffer.h"
+#include "NotImplemented.h"
+#include "WebGLActiveInfo.h"
+#include "WebGLArray.h"
+#include "WebGLBuffer.h"
+#include "WebGLFloatArray.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLIntArray.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLRenderingContext.h"
+#include "WebGLShader.h"
+#include "WebGLTexture.h"
+#include "WebGLUnsignedByteArray.h"
+#include <wtf/UnusedParam.h>
+
+#if ENABLE(3D_CANVAS)
+
+namespace WebCore {
+
+#if !defined(GLchar)
+typedef char GLchar;
+#endif
+
+#if !defined(APIENTRY)
+#define APIENTRY
+#endif
+
+typedef void (APIENTRY* glActiveTextureType) (GLenum);
+typedef void (APIENTRY* glAttachShaderType) (GLuint, GLuint);
+typedef void (APIENTRY* glBindAttribLocationType) (GLuint, GLuint, const char*);
+typedef void (APIENTRY* glBindBufferType) (GLenum, GLuint);
+typedef void (APIENTRY* glBindFramebufferType) (GLenum, GLuint);
+typedef void (APIENTRY* glBindRenderbufferType) (GLenum, GLuint);
+typedef void (APIENTRY* glBlendColorType) (GLclampf, GLclampf, GLclampf, GLclampf);
+typedef void (APIENTRY* glBlendEquationType) (GLenum);
+typedef void (APIENTRY* glBlendEquationSeparateType)(GLenum, GLenum);
+typedef void (APIENTRY* glBlendFuncSeparateType)(GLenum srcRGB, GLenum dstRGB, GLenum srcAlpha, GLenum dstAlpha);
+typedef void (APIENTRY* glBufferDataType) (GLenum, GLsizeiptr, const GLvoid*, GLenum);
+typedef void (APIENTRY* glBufferSubDataType) (GLenum, GLintptr, GLsizeiptr, const GLvoid*);
+typedef GLenum (APIENTRY* glCheckFramebufferStatusType) (GLenum);
+typedef void (APIENTRY* glCompileShaderType) (GLuint);
+typedef GLuint (APIENTRY* glCreateProgramType) ();
+typedef GLuint (APIENTRY* glCreateShaderType) (GLenum);
+typedef void (APIENTRY* glDeleteBuffersType) (GLsizei, const GLuint*);
+typedef void (APIENTRY* glDeleteFramebuffersType) (GLsizei n, const GLuint*);
+typedef void (APIENTRY* glDeleteProgramType) (GLuint);
+typedef void (APIENTRY* glDeleteRenderbuffersType) (GLsizei n, const GLuint*);
+typedef void (APIENTRY* glDeleteShaderType) (GLuint);
+typedef void (APIENTRY* glDetachShaderType) (GLuint, GLuint);
+typedef void (APIENTRY* glDisableVertexAttribArrayType) (GLuint);
+typedef void (APIENTRY* glEnableVertexAttribArrayType) (GLuint);
+typedef void (APIENTRY* glFramebufferRenderbufferType) (GLenum, GLenum, GLenum, GLuint);
+typedef void (APIENTRY* glFramebufferTexture2DType) (GLenum, GLenum, GLenum, GLuint, GLint);
+typedef void (APIENTRY* glGenBuffersType) (GLsizei, GLuint*);
+typedef void (APIENTRY* glGenerateMipmapType) (GLenum target);
+typedef void (APIENTRY* glGenFramebuffersType) (GLsizei, GLuint*);
+typedef void (APIENTRY* glGenRenderbuffersType) (GLsizei, GLuint*);
+typedef void (APIENTRY* glGetActiveAttribType) (GLuint, GLuint, GLsizei, GLsizei*, GLint*, GLenum*, GLchar*);
+typedef void (APIENTRY* glGetActiveUniformType) (GLuint, GLuint, GLsizei, GLsizei*, GLint*, GLenum*, GLchar*);
+typedef GLint (APIENTRY* glGetAttribLocationType) (GLuint, const char*);
+typedef void (APIENTRY* glGetBufferParameterivType) (GLenum, GLenum, GLint*);
+typedef void (APIENTRY* glGetFramebufferAttachmentParameterivType) (GLenum, GLenum, GLenum, GLint* params);
+typedef void (APIENTRY* glGetProgramInfoLogType) (GLuint, GLsizei, GLsizei*, char*);
+typedef void (APIENTRY* glGetProgramivType) (GLuint, GLenum, GLint*);
+typedef void (APIENTRY* glGetRenderbufferParameterivType) (GLenum, GLenum, GLint*);
+typedef void (APIENTRY* glGetShaderInfoLogType) (GLuint, GLsizei, GLsizei*, char*);
+typedef void (APIENTRY* glGetShaderivType) (GLuint, GLenum, GLint*);
+typedef void (APIENTRY* glGetShaderSourceType) (GLuint, GLsizei, GLsizei*, char*);
+typedef GLint (APIENTRY* glGetUniformLocationType) (GLuint, const char*);
+typedef void (APIENTRY* glGetUniformfvType) (GLuint, GLint, GLfloat*);
+typedef void (APIENTRY* glGetUniformivType) (GLuint, GLint, GLint*);
+typedef void (APIENTRY* glGetVertexAttribfvType) (GLuint, GLenum, GLfloat*);
+typedef void (APIENTRY* glGetVertexAttribivType) (GLuint, GLenum, GLint*);
+typedef void (APIENTRY* glGetVertexAttribPointervType) (GLuint, GLenum, GLvoid**);
+typedef GLboolean (APIENTRY* glIsBufferType) (GLuint);
+typedef GLboolean (APIENTRY* glIsFramebufferType) (GLuint);
+typedef GLboolean (APIENTRY* glIsProgramType) (GLuint);
+typedef GLboolean (APIENTRY* glIsRenderbufferType) (GLuint);
+typedef GLboolean (APIENTRY* glIsShaderType) (GLuint);
+typedef void (APIENTRY* glLinkProgramType) (GLuint);
+typedef void (APIENTRY* glRenderbufferStorageType) (GLenum, GLenum, GLsizei, GLsizei);
+typedef void (APIENTRY* glSampleCoverageType) (GLclampf, GLboolean);
+typedef void (APIENTRY* glShaderSourceType) (GLuint, GLsizei, const char**, const GLint*);
+typedef void (APIENTRY* glStencilFuncSeparateType) (GLenum, GLenum, GLint, GLuint);
+typedef void (APIENTRY* glStencilMaskSeparateType) (GLenum, GLuint);
+typedef void (APIENTRY* glStencilOpSeparateType) (GLenum, GLenum, GLenum, GLenum);
+typedef void (APIENTRY* glUniform1fType) (GLint, GLfloat);
+typedef void (APIENTRY* glUniform1fvType) (GLint, GLsizei, const GLfloat*);
+typedef void (APIENTRY* glUniform1iType) (GLint, GLint);
+typedef void (APIENTRY* glUniform1ivType) (GLint, GLsizei, const GLint*);
+typedef void (APIENTRY* glUniform2fType) (GLint, GLfloat, GLfloat);
+typedef void (APIENTRY* glUniform2fvType) (GLint, GLsizei, const GLfloat*);
+typedef void (APIENTRY* glUniform2iType) (GLint, GLint, GLint);
+typedef void (APIENTRY* glUniform2ivType) (GLint, GLsizei, const GLint*);
+typedef void (APIENTRY* glUniform3fType) (GLint, GLfloat, GLfloat, GLfloat);
+typedef void (APIENTRY* glUniform3fvType) (GLint, GLsizei, const GLfloat*);
+typedef void (APIENTRY* glUniform3iType) (GLint, GLint, GLint, GLint);
+typedef void (APIENTRY* glUniform3ivType) (GLint, GLsizei, const GLint*);
+typedef void (APIENTRY* glUniform4fType) (GLint, GLfloat, GLfloat, GLfloat, GLfloat);
+typedef void (APIENTRY* glUniform4fvType) (GLint, GLsizei, const GLfloat*);
+typedef void (APIENTRY* glUniform4iType) (GLint, GLint, GLint, GLint, GLint);
+typedef void (APIENTRY* glUniform4ivType) (GLint, GLsizei, const GLint*);
+typedef void (APIENTRY* glUniformMatrix2fvType) (GLint, GLsizei, GLboolean, const GLfloat*);
+typedef void (APIENTRY* glUniformMatrix3fvType) (GLint, GLsizei, GLboolean, const GLfloat*);
+typedef void (APIENTRY* glUniformMatrix4fvType) (GLint, GLsizei, GLboolean, const GLfloat*);
+typedef void (APIENTRY* glUseProgramType) (GLuint);
+typedef void (APIENTRY* glValidateProgramType) (GLuint);
+typedef void (APIENTRY* glVertexAttrib1fType) (GLuint, const GLfloat);
+typedef void (APIENTRY* glVertexAttrib1fvType) (GLuint, const GLfloat*);
+typedef void (APIENTRY* glVertexAttrib2fType) (GLuint, const GLfloat, const GLfloat);
+typedef void (APIENTRY* glVertexAttrib2fvType) (GLuint, const GLfloat*);
+typedef void (APIENTRY* glVertexAttrib3fType) (GLuint, const GLfloat, const GLfloat, const GLfloat);
+typedef void (APIENTRY* glVertexAttrib3fvType) (GLuint, const GLfloat*);
+typedef void (APIENTRY* glVertexAttrib4fType) (GLuint, const GLfloat, const GLfloat, const GLfloat, const GLfloat);
+typedef void (APIENTRY* glVertexAttrib4fvType) (GLuint, const GLfloat*);
+typedef void (APIENTRY* glVertexAttribPointerType) (GLuint, GLint, GLenum, GLboolean, GLsizei, const GLvoid*);
+
+class GraphicsContext3DInternal {
+public:
+    GraphicsContext3DInternal(GraphicsContext3D::Attributes attrs);
+    ~GraphicsContext3DInternal();
+
+    bool isContextValid() { return m_contextValid; }
+
+    glActiveTextureType activeTexture;
+    glAttachShaderType attachShader;
+    glBindAttribLocationType bindAttribLocation;
+    glBindBufferType bindBuffer;
+    glBindFramebufferType bindFramebuffer;
+    glBindRenderbufferType bindRenderbuffer;
+    glBlendColorType blendColor;
+    glBlendEquationType blendEquation;
+    glBlendEquationSeparateType blendEquationSeparate;
+    glBlendFuncSeparateType blendFuncSeparate;
+    glBufferDataType bufferData;
+    glBufferSubDataType bufferSubData;
+    glCheckFramebufferStatusType checkFramebufferStatus;
+    glCompileShaderType compileShader;
+    glCreateProgramType createProgram;
+    glCreateShaderType createShader;
+    glDeleteBuffersType deleteBuffers;
+    glDeleteFramebuffersType deleteFramebuffers;
+    glDeleteProgramType deleteProgram;
+    glDeleteRenderbuffersType deleteRenderbuffers;
+    glDeleteShaderType deleteShader;
+    glDetachShaderType detachShader;
+    glDisableVertexAttribArrayType disableVertexAttribArray;
+    glEnableVertexAttribArrayType enableVertexAttribArray;
+    glFramebufferRenderbufferType framebufferRenderbuffer;
+    glFramebufferTexture2DType framebufferTexture2D;
+    glGenBuffersType genBuffers;
+    glGenerateMipmapType generateMipmap;
+    glGenFramebuffersType genFramebuffers;
+    glGenRenderbuffersType genRenderbuffers;
+    glGetActiveAttribType getActiveAttrib;
+    glGetActiveUniformType getActiveUniform;
+    glGetAttribLocationType getAttribLocation;
+    glGetBufferParameterivType getBufferParameteriv;
+    glGetFramebufferAttachmentParameterivType getFramebufferAttachmentParameteriv;
+    glGetProgramInfoLogType getProgramInfoLog;
+    glGetProgramivType getProgramiv;
+    glGetRenderbufferParameterivType getRenderbufferParameteriv;
+    glGetShaderInfoLogType getShaderInfoLog;
+    glGetShaderivType getShaderiv;
+    glGetShaderSourceType getShaderSource;
+    glGetUniformfvType getUniformfv;
+    glGetUniformivType getUniformiv;
+    glGetUniformLocationType getUniformLocation;
+    glGetVertexAttribfvType getVertexAttribfv;
+    glGetVertexAttribivType getVertexAttribiv;
+    glGetVertexAttribPointervType getVertexAttribPointerv;
+    glIsBufferType isBuffer;
+    glIsFramebufferType isFramebuffer;
+    glIsProgramType isProgram;
+    glIsRenderbufferType isRenderbuffer;
+    glIsShaderType isShader;
+    glLinkProgramType linkProgram;
+    glRenderbufferStorageType renderbufferStorage;
+    glSampleCoverageType sampleCoverage;
+    glShaderSourceType shaderSource;
+    glStencilFuncSeparateType stencilFuncSeparate;
+    glStencilMaskSeparateType stencilMaskSeparate;
+    glStencilOpSeparateType stencilOpSeparate;
+    glUniform1fType uniform1f;
+    glUniform1fvType uniform1fv;
+    glUniform1iType uniform1i;
+    glUniform1ivType uniform1iv;
+    glUniform2fType uniform2f;
+    glUniform2fvType uniform2fv;
+    glUniform2iType uniform2i;
+    glUniform2ivType uniform2iv;
+    glUniform3fType uniform3f;
+    glUniform3fvType uniform3fv;
+    glUniform3iType uniform3i;
+    glUniform3ivType uniform3iv;
+    glUniform4fType uniform4f;
+    glUniform4fvType uniform4fv;
+    glUniform4iType uniform4i;
+    glUniform4ivType uniform4iv;
+    glUniformMatrix2fvType uniformMatrix2fv;
+    glUniformMatrix3fvType uniformMatrix3fv;
+    glUniformMatrix4fvType uniformMatrix4fv;
+    glUseProgramType useProgram;
+    glValidateProgramType validateProgram;
+    glVertexAttrib1fType vertexAttrib1f;
+    glVertexAttrib1fvType vertexAttrib1fv;
+    glVertexAttrib2fType vertexAttrib2f;
+    glVertexAttrib2fvType vertexAttrib2fv;
+    glVertexAttrib3fType vertexAttrib3f;
+    glVertexAttrib3fvType vertexAttrib3fv;
+    glVertexAttrib4fType vertexAttrib4f;
+    glVertexAttrib4fvType vertexAttrib4fv;
+    glVertexAttribPointerType vertexAttribPointer;
+
+    GraphicsContext3D::Attributes m_attrs;
+    QGLWidget* m_glWidget;
+    GLuint m_texture;
+    GLuint m_mainFbo;
+    GLuint m_currentFbo;
+    GLuint m_depthBuffer;
+    QImage m_pixels;
+    ListHashSet<unsigned long> m_syntheticErrors;
+
+private:
+
+    void* getProcAddress(const String& proc);
+    bool m_contextValid;
+};
+
+#if defined (QT_OPENGL_ES_2) 
+#define GET_PROC_ADDRESS(Proc) Proc
+#else
+#define GET_PROC_ADDRESS(Proc) reinterpret_cast<Proc##Type>(getProcAddress(#Proc));
+#endif
+ 
+GraphicsContext3DInternal::GraphicsContext3DInternal(GraphicsContext3D::Attributes attrs)
+    : m_attrs(attrs)
+    , m_glWidget(0)
+    , m_texture(0)
+    , m_mainFbo(0)
+    , m_currentFbo(0)
+    , m_depthBuffer(0)
+    , m_contextValid(true)
+{
+    m_attrs.alpha = true;
+    m_attrs.depth = true;
+    m_attrs.stencil = false;
+    m_attrs.antialias = false;
+    m_attrs.premultipliedAlpha = true;
+
+    QGLFormat format;
+
+    format.setDepth(true);
+    format.setSampleBuffers(true);
+    format.setStencil(false);
+
+    m_glWidget = new QGLWidget(format);
+    if (!m_glWidget->isValid()) {
+        LOG_ERROR("GraphicsContext3D: QGLWidget does not have a valid context");
+        m_contextValid = false;
+        return;
+    }
+
+    m_glWidget->makeCurrent();
+
+    activeTexture = GET_PROC_ADDRESS(glActiveTexture);
+    attachShader = GET_PROC_ADDRESS(glAttachShader);
+    bindAttribLocation = GET_PROC_ADDRESS(glBindAttribLocation);
+    bindBuffer = GET_PROC_ADDRESS(glBindBuffer);
+    bindFramebuffer = GET_PROC_ADDRESS(glBindFramebuffer);
+    bindRenderbuffer = GET_PROC_ADDRESS(glBindRenderbuffer);
+    blendColor = GET_PROC_ADDRESS(glBlendColor);
+    blendEquation = GET_PROC_ADDRESS(glBlendEquation);
+    blendEquationSeparate = GET_PROC_ADDRESS(glBlendEquationSeparate);
+    blendFuncSeparate = GET_PROC_ADDRESS(glBlendFuncSeparate);
+    bufferData = GET_PROC_ADDRESS(glBufferData);
+    bufferSubData = GET_PROC_ADDRESS(glBufferSubData);
+    checkFramebufferStatus = GET_PROC_ADDRESS(glCheckFramebufferStatus);
+    compileShader = GET_PROC_ADDRESS(glCompileShader);
+    createProgram = GET_PROC_ADDRESS(glCreateProgram);
+    createShader = GET_PROC_ADDRESS(glCreateShader);
+    deleteBuffers = GET_PROC_ADDRESS(glDeleteBuffers);
+    deleteFramebuffers = GET_PROC_ADDRESS(glDeleteFramebuffers);
+    deleteProgram = GET_PROC_ADDRESS(glDeleteProgram);
+    deleteRenderbuffers = GET_PROC_ADDRESS(glDeleteRenderbuffers);
+    deleteShader = GET_PROC_ADDRESS(glDeleteShader);
+    detachShader = GET_PROC_ADDRESS(glDetachShader);
+    disableVertexAttribArray = GET_PROC_ADDRESS(glDisableVertexAttribArray);
+    enableVertexAttribArray = GET_PROC_ADDRESS(glEnableVertexAttribArray);
+    framebufferRenderbuffer = GET_PROC_ADDRESS(glFramebufferRenderbuffer);
+    framebufferTexture2D = GET_PROC_ADDRESS(glFramebufferTexture2D);
+    genBuffers = GET_PROC_ADDRESS(glGenBuffers);
+    generateMipmap = GET_PROC_ADDRESS(glGenerateMipmap);
+    genFramebuffers = GET_PROC_ADDRESS(glGenFramebuffers);
+    genRenderbuffers = GET_PROC_ADDRESS(glGenRenderbuffers);
+    getActiveAttrib = GET_PROC_ADDRESS(glGetActiveAttrib);
+    getActiveUniform = GET_PROC_ADDRESS(glGetActiveUniform);
+    getAttribLocation = GET_PROC_ADDRESS(glGetAttribLocation);
+    getBufferParameteriv = GET_PROC_ADDRESS(glGetBufferParameteriv);
+    getFramebufferAttachmentParameteriv = GET_PROC_ADDRESS(glGetFramebufferAttachmentParameteriv);
+    getProgramInfoLog = GET_PROC_ADDRESS(glGetProgramInfoLog);
+    getProgramiv = GET_PROC_ADDRESS(glGetProgramiv);
+    getRenderbufferParameteriv = GET_PROC_ADDRESS(glGetRenderbufferParameteriv);
+    getShaderInfoLog = GET_PROC_ADDRESS(glGetShaderInfoLog);
+    getShaderiv = GET_PROC_ADDRESS(glGetShaderiv);
+    getShaderSource = GET_PROC_ADDRESS(glGetShaderSource);
+    getUniformfv = GET_PROC_ADDRESS(glGetUniformfv);
+    getUniformiv = GET_PROC_ADDRESS(glGetUniformiv);
+    getUniformLocation = GET_PROC_ADDRESS(glGetUniformLocation);
+    getVertexAttribfv = GET_PROC_ADDRESS(glGetVertexAttribfv);
+    getVertexAttribiv = GET_PROC_ADDRESS(glGetVertexAttribiv);
+    getVertexAttribPointerv = GET_PROC_ADDRESS(glGetVertexAttribPointerv);
+    isBuffer = GET_PROC_ADDRESS(glIsBuffer);
+    isFramebuffer = GET_PROC_ADDRESS(glIsFramebuffer);
+    isProgram = GET_PROC_ADDRESS(glIsProgram);
+    isRenderbuffer = GET_PROC_ADDRESS(glIsRenderbuffer);
+    isShader = GET_PROC_ADDRESS(glIsShader);
+    linkProgram = GET_PROC_ADDRESS(glLinkProgram);
+    renderbufferStorage = GET_PROC_ADDRESS(glRenderbufferStorage);
+    sampleCoverage = GET_PROC_ADDRESS(glSampleCoverage);
+    shaderSource = GET_PROC_ADDRESS(glShaderSource);
+    stencilFuncSeparate = GET_PROC_ADDRESS(glStencilFuncSeparate);
+    stencilMaskSeparate = GET_PROC_ADDRESS(glStencilMaskSeparate);
+    stencilOpSeparate = GET_PROC_ADDRESS(glStencilOpSeparate);
+    uniform1f = GET_PROC_ADDRESS(glUniform1f);
+    uniform1fv = GET_PROC_ADDRESS(glUniform1fv);
+    uniform1i = GET_PROC_ADDRESS(glUniform1i);
+    uniform1iv = GET_PROC_ADDRESS(glUniform1iv);
+    uniform2f = GET_PROC_ADDRESS(glUniform2f);
+    uniform2fv = GET_PROC_ADDRESS(glUniform2fv);
+    uniform2i = GET_PROC_ADDRESS(glUniform2i);
+    uniform2iv = GET_PROC_ADDRESS(glUniform2iv);
+    uniform3f = GET_PROC_ADDRESS(glUniform3f);
+    uniform3fv = GET_PROC_ADDRESS(glUniform3fv);
+    uniform3i = GET_PROC_ADDRESS(glUniform3i);
+    uniform3iv = GET_PROC_ADDRESS(glUniform3iv);
+    uniform4f = GET_PROC_ADDRESS(glUniform4f);
+    uniform4fv = GET_PROC_ADDRESS(glUniform4fv);
+    uniform4i = GET_PROC_ADDRESS(glUniform4i);
+    uniform4iv = GET_PROC_ADDRESS(glUniform4iv);
+    uniformMatrix2fv = GET_PROC_ADDRESS(glUniformMatrix2fv);
+    uniformMatrix3fv = GET_PROC_ADDRESS(glUniformMatrix3fv);
+    uniformMatrix4fv = GET_PROC_ADDRESS(glUniformMatrix4fv);
+    useProgram = GET_PROC_ADDRESS(glUseProgram);
+    validateProgram = GET_PROC_ADDRESS(glValidateProgram);
+    vertexAttrib1f = GET_PROC_ADDRESS(glVertexAttrib1f);
+    vertexAttrib1fv = GET_PROC_ADDRESS(glVertexAttrib1fv);
+    vertexAttrib2f = GET_PROC_ADDRESS(glVertexAttrib2f);
+    vertexAttrib2fv = GET_PROC_ADDRESS(glVertexAttrib2fv);
+    vertexAttrib3f = GET_PROC_ADDRESS(glVertexAttrib3f);
+    vertexAttrib3fv = GET_PROC_ADDRESS(glVertexAttrib3fv);
+    vertexAttrib4f = GET_PROC_ADDRESS(glVertexAttrib4f);
+    vertexAttrib4fv = GET_PROC_ADDRESS(glVertexAttrib4fv);
+    vertexAttribPointer = GET_PROC_ADDRESS(glVertexAttribPointer);
+
+    if (!m_contextValid) {
+        LOG_ERROR("GraphicsContext3D: All needed OpenGL extensions are not available");
+        m_contextValid = false;
+        return;
+    }
+
+    glGenTextures(1, &m_texture);
+    glBindTexture(GraphicsContext3D::TEXTURE_2D, m_texture);
+    glTexParameterf(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR);
+    glTexParameterf(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR);
+    glTexParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE);
+    glTexParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
+    glTexImage2D(GraphicsContext3D::TEXTURE_2D, 0, GraphicsContext3D::RGBA, 1, 1, 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, 0);
+    glBindTexture(GraphicsContext3D::TEXTURE_2D, 0);
+
+    genFramebuffers(/* count */ 1, &m_mainFbo);
+    m_currentFbo = m_mainFbo;
+
+    bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_mainFbo);
+
+    genRenderbuffers(/* count */ 1, &m_depthBuffer);
+    bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
+#if defined(QT_OPENGL_ES_2)
+    renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT16, /* width */ 1, /* height */ 1);
+#else
+    renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT, /* width */ 1, /* height */ 1);
+#endif
+
+    bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, 0);
+ 
+    framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, m_texture, 0);
+    framebufferRenderbuffer(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::DEPTH_ATTACHMENT, GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
+    glClearColor(/* red */ 0, /* green */ 0, /* blue */ 0, /* alpha */ 0);
+
+    if (checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER) != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
+        LOG_ERROR("GraphicsContext3D: Wasn't able to create the main framebuffer");
+        m_contextValid = false;
+    }
+}
+
+GraphicsContext3DInternal::~GraphicsContext3DInternal()
+{
+    delete m_glWidget;
+    m_glWidget = 0;
+}
+
+void* GraphicsContext3DInternal::getProcAddress(const String& proc)
+{
+    String ext[3] = { "", "ARB", "EXT" };
+
+    for (int i = 0; i < 3; i++) {
+        String nameWithExt = proc + ext[i];
+
+        void* addr = m_glWidget->context()->getProcAddress(nameWithExt.utf8().data());
+        if (addr) 
+            return addr;
+    }
+
+    LOG_ERROR("GraphicsContext3D: Did not find GL function %s", proc.utf8().data());
+    m_contextValid = false;
+    return 0;
+}
+
+PassOwnPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attrs)
+{
+    OwnPtr<GraphicsContext3D> context(new GraphicsContext3D(attrs));
+    return context->m_internal ? context.release() : 0;
+}
+
+GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs)
+    : m_internal(new GraphicsContext3DInternal(attrs))
+{
+    if (!m_internal->isContextValid()) 
+        m_internal = 0;
+}
+
+GraphicsContext3D::~GraphicsContext3D()
+{
+}
+
+PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D()
+{
+    return m_internal->m_glWidget;
+}
+
+Platform3DObject GraphicsContext3D::platformTexture() const
+{
+    return m_internal->m_texture;
+}
+
+void GraphicsContext3D::makeContextCurrent()
+{
+    m_internal->m_glWidget->makeCurrent();
+}
+
+void GraphicsContext3D::beginPaint(WebGLRenderingContext* context)
+{
+    m_internal->m_glWidget->makeCurrent();
+
+    HTMLCanvasElement* canvas = context->canvas();
+    ImageBuffer* imageBuffer = canvas->buffer();
+
+    m_internal->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_internal->m_mainFbo);
+
+    glReadPixels(/* x */ 0, /* y */ 0, m_currentWidth, m_currentHeight, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, m_internal->m_pixels.bits());
+
+    QPainter* p = imageBuffer->context()->platformContext();
+    p->drawImage(/* x */ 0, /* y */ 0, m_internal->m_pixels.transformed(QMatrix().rotate(180)));
+
+    m_internal->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_internal->m_currentFbo);
+}
+
+void GraphicsContext3D::endPaint()
+{
+}
+
+void GraphicsContext3D::reshape(int width, int height)
+{
+    if (((width == m_currentWidth) && (height == m_currentHeight)) || (!m_internal))
+        return;
+    
+    m_currentWidth = width;
+    m_currentHeight = height;
+
+    m_internal->m_pixels = QImage(m_currentWidth, m_currentHeight, QImage::Format_ARGB32);
+
+    m_internal->m_glWidget->makeCurrent();
+
+    glBindTexture(GraphicsContext3D::TEXTURE_2D, m_internal->m_texture);
+    glTexImage2D(GraphicsContext3D::TEXTURE_2D, /* level */ 0, GraphicsContext3D::RGBA, width, height, /* border */ 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, /* data */ 0);
+    glBindTexture(GraphicsContext3D::TEXTURE_2D, 0);
+   
+    m_internal->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_internal->m_mainFbo);
+    m_internal->bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, m_internal->m_depthBuffer);
+#if defined(QT_OPENGL_ES_2)
+    renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT16, width, height);
+#else
+    renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT, width, height);
+#endif
+    m_internal->bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, 0);
+    
+    m_internal->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, m_internal->m_texture, 0);
+    m_internal->framebufferRenderbuffer(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::DEPTH_ATTACHMENT, GraphicsContext3D::RENDERBUFFER, m_internal->m_depthBuffer);
+
+    GLenum status = m_internal->checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER);
+    if (status != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
+        LOG_ERROR("GraphicsContext3D: Wasn't able to reshape the main framebuffer");
+        notImplemented();
+    }
+
+    glClear(GraphicsContext3D::COLOR_BUFFER_BIT);
+    glFlush();
+}
+
+void GraphicsContext3D::activeTexture(unsigned long texture)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->activeTexture(texture);
+}
+
+void GraphicsContext3D::attachShader(WebGLProgram* program, WebGLShader* shader)
+{
+    ASSERT(program);
+    ASSERT(shader);
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->attachShader((GLuint) program->object(), (GLuint) shader->object());
+}
+
+void GraphicsContext3D::bindAttribLocation(WebGLProgram* program, unsigned long index, const String& name)
+{
+    ASSERT(program);
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->bindAttribLocation((GLuint) program->object(), index, name.utf8().data());
+}
+
+void GraphicsContext3D::bindBuffer(unsigned long target, WebGLBuffer* buffer)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->bindBuffer(target, buffer ? (GLuint) buffer->object() : 0);
+}
+
+void GraphicsContext3D::bindFramebuffer(unsigned long target, WebGLFramebuffer* buffer)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->m_currentFbo = (buffer && buffer->object()) ? (GLuint) buffer->object() : m_internal->m_mainFbo;
+    m_internal->bindFramebuffer(target, m_internal->m_currentFbo);
+}
+
+void GraphicsContext3D::bindRenderbuffer(unsigned long target, WebGLRenderbuffer* renderbuffer)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->bindRenderbuffer(target, renderbuffer ? (GLuint) renderbuffer->object() : 0);
+}
+
+void GraphicsContext3D::bindTexture(unsigned long target, WebGLTexture* texture)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glBindTexture(target, texture ? (GLuint) texture->object() : 0);
+}
+
+void GraphicsContext3D::blendColor(double red, double green, double blue, double alpha)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->blendColor(static_cast<float>(red), static_cast<float>(green), static_cast<float>(blue), static_cast<float>(alpha));
+}
+
+void GraphicsContext3D::blendEquation(unsigned long mode)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->blendEquation(mode);
+}
+
+void GraphicsContext3D::blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->blendEquationSeparate(modeRGB, modeAlpha);
+}
+
+void GraphicsContext3D::blendFunc(unsigned long sfactor, unsigned long dfactor)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glBlendFunc(sfactor, dfactor);
+}       
+
+void GraphicsContext3D::blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+}
+
+void GraphicsContext3D::bufferData(unsigned long target, int size, unsigned long usage)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->bufferData(target, size, /* data */ 0, usage);
+}
+
+void GraphicsContext3D::bufferData(unsigned long target, WebGLArray* array, unsigned long usage)
+{
+    if (!array || !array->length())
+        return;
+    
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->bufferData(target, array->byteLength(), array->baseAddress(), usage);
+}
+
+void GraphicsContext3D::bufferSubData(unsigned long target, long offset, WebGLArray* array)
+{
+    if (!array || !array->length())
+        return;
+    
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->bufferSubData(target, offset, array->byteLength(), array->baseAddress());
+}
+
+unsigned long GraphicsContext3D::checkFramebufferStatus(unsigned long target)
+{
+    m_internal->m_glWidget->makeCurrent();
+    return m_internal->checkFramebufferStatus(target);
+}
+
+void GraphicsContext3D::clearColor(double r, double g, double b, double a)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glClearColor(static_cast<float>(r), static_cast<float>(g), static_cast<float>(b), static_cast<float>(a));
+}
+
+void GraphicsContext3D::clear(unsigned long mask)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glClear(mask);
+}
+
+void GraphicsContext3D::clearDepth(double depth)
+{
+    m_internal->m_glWidget->makeCurrent();
+#if defined(QT_OPENGL_ES_2)
+    glClearDepthf(depth);
+#else
+    glClearDepth(depth);
+#endif
+}
+
+void GraphicsContext3D::clearStencil(long s)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glClearStencil(s);
+}
+
+void GraphicsContext3D::colorMask(bool red, bool green, bool blue, bool alpha)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glColorMask(red, green, blue, alpha);
+}
+
+void GraphicsContext3D::compileShader(WebGLShader* shader)
+{
+    ASSERT(shader);
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->compileShader((GLuint) shader->object());
+}
+
+void GraphicsContext3D::copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glCopyTexImage2D(target, level, internalformat, x, y, width, height, border);
+}
+
+void GraphicsContext3D::copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glCopyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
+}
+
+void GraphicsContext3D::cullFace(unsigned long mode)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glCullFace(mode);
+}
+
+void GraphicsContext3D::depthFunc(unsigned long func)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glDepthFunc(func);
+}
+
+void GraphicsContext3D::depthMask(bool flag)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glDepthMask(flag);
+}
+
+void GraphicsContext3D::depthRange(double zNear, double zFar)
+{
+    m_internal->m_glWidget->makeCurrent();
+#if defined(QT_OPENGL_ES_2)
+    glDepthRangef(zNear, zFar);
+#else
+    glDepthRange(zNear, zFar);
+#endif
+}
+
+void GraphicsContext3D::detachShader(WebGLProgram* program, WebGLShader* shader)
+{
+    ASSERT(program);
+    ASSERT(shader);
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->detachShader((GLuint) program->object(), (GLuint) shader->object());
+}
+
+void GraphicsContext3D::disable(unsigned long cap)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glDisable(cap);
+}
+
+void GraphicsContext3D::disableVertexAttribArray(unsigned long index)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->disableVertexAttribArray(index);
+}
+
+void GraphicsContext3D::drawArrays(unsigned long mode, long first, long count)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glDrawArrays(mode, first, count);
+}
+
+void GraphicsContext3D::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glDrawElements(mode, count, type, reinterpret_cast<void*>(static_cast<intptr_t>(offset)));
+}
+
+void GraphicsContext3D::enable(unsigned long cap)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glEnable(cap);
+}
+
+void GraphicsContext3D::enableVertexAttribArray(unsigned long index)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->enableVertexAttribArray(index);
+}
+
+void GraphicsContext3D::finish()
+{
+    m_internal->m_glWidget->makeCurrent();
+    glFinish();
+}
+
+void GraphicsContext3D::flush()
+{
+    m_internal->m_glWidget->makeCurrent();
+    glFlush();
+}
+
+void GraphicsContext3D::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, WebGLRenderbuffer* buffer)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->framebufferRenderbuffer(target, attachment, renderbuffertarget, buffer ? (GLuint) buffer->object() : 0);
+}
+
+void GraphicsContext3D::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, WebGLTexture* texture, long level)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->framebufferTexture2D(target, attachment, textarget, texture ? (GLuint) texture->object() : 0, level);
+}
+
+void GraphicsContext3D::frontFace(unsigned long mode)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glFrontFace(mode);
+}
+
+void GraphicsContext3D::generateMipmap(unsigned long target)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->generateMipmap(target);
+}
+
+bool GraphicsContext3D::getActiveAttrib(WebGLProgram* program, unsigned long index, ActiveInfo& info)
+{
+    if (!program->object()) {
+        synthesizeGLError(INVALID_VALUE);
+        return false;
+    }
+
+    m_internal->m_glWidget->makeCurrent();
+
+    GLint maxLength;
+    m_internal->getProgramiv(static_cast<GLuint>(program->object()), GraphicsContext3D::ACTIVE_ATTRIBUTE_MAX_LENGTH, &maxLength);
+
+    GLchar name[maxLength]; 
+    GLsizei nameLength;
+    GLint size;
+    GLenum type;
+
+    m_internal->getActiveAttrib(static_cast<GLuint>(program->object()), index, maxLength, &nameLength, &size, &type, name);
+
+    if (!nameLength)
+        return false;
+
+    info.name = String(name, nameLength);
+    info.type = type;
+    info.size = size;
+
+    return true;
+}
+    
+bool GraphicsContext3D::getActiveUniform(WebGLProgram* program, unsigned long index, ActiveInfo& info)
+{
+    if (!program->object()) {
+        synthesizeGLError(INVALID_VALUE);
+        return false;
+    }
+
+    m_internal->m_glWidget->makeCurrent();
+
+    GLint maxLength;
+    m_internal->getProgramiv(static_cast<GLuint>(program->object()), GraphicsContext3D::ACTIVE_UNIFORM_MAX_LENGTH, &maxLength);
+
+    GLchar name[maxLength];
+    GLsizei nameLength;
+    GLint size;
+    GLenum type;
+
+    m_internal->getActiveUniform(static_cast<GLuint>(program->object()), index, maxLength, &nameLength, &size, &type, name);
+
+    if (!nameLength)
+        return false;
+
+    info.name = String(name, nameLength);
+    info.type = type;
+    info.size = size;
+
+    return true;
+}
+
+int GraphicsContext3D::getAttribLocation(WebGLProgram* program, const String& name)
+{
+    if (!program)
+        return -1;
+    
+    m_internal->m_glWidget->makeCurrent();
+    return m_internal->getAttribLocation((GLuint) program->object(), name.utf8().data());
+}
+
+GraphicsContext3D::Attributes GraphicsContext3D::getContextAttributes()
+{
+    return m_internal->m_attrs;
+}
+
+unsigned long GraphicsContext3D::getError()
+{
+    if (m_internal->m_syntheticErrors.size() > 0) {
+        ListHashSet<unsigned long>::iterator iter = m_internal->m_syntheticErrors.begin();
+        unsigned long err = *iter;
+        m_internal->m_syntheticErrors.remove(iter);
+        return err;
+    }
+
+    m_internal->m_glWidget->makeCurrent();
+    return glGetError();
+}
+
+String GraphicsContext3D::getString(unsigned long name)
+{
+    m_internal->m_glWidget->makeCurrent();
+    return String((const char*) glGetString(name));
+}
+
+void GraphicsContext3D::hint(unsigned long target, unsigned long mode)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glHint(target, mode);
+}
+
+bool GraphicsContext3D::isBuffer(WebGLBuffer* buffer)
+{
+    if (!buffer)
+        return false;
+    
+    m_internal->m_glWidget->makeCurrent();
+    return m_internal->isBuffer((GLuint) buffer->object());
+}
+
+bool GraphicsContext3D::isEnabled(unsigned long cap)
+{
+    m_internal->m_glWidget->makeCurrent();
+    return glIsEnabled(cap);
+}
+
+bool GraphicsContext3D::isFramebuffer(WebGLFramebuffer* framebuffer)
+{
+    if (!framebuffer)
+        return false;
+    
+    m_internal->m_glWidget->makeCurrent();
+    return m_internal->isFramebuffer((GLuint) framebuffer->object());
+}
+
+bool GraphicsContext3D::isProgram(WebGLProgram* program)
+{
+    if (!program)
+        return false;
+    
+    m_internal->m_glWidget->makeCurrent();
+    return m_internal->isProgram((GLuint) program->object());
+}
+
+bool GraphicsContext3D::isRenderbuffer(WebGLRenderbuffer* renderbuffer)
+{
+    if (!renderbuffer)
+        return false;
+    
+    m_internal->m_glWidget->makeCurrent();
+    return m_internal->isRenderbuffer((GLuint) renderbuffer->object());
+}
+
+bool GraphicsContext3D::isShader(WebGLShader* shader)
+{
+    if (!shader)
+        return false;
+    
+    m_internal->m_glWidget->makeCurrent();
+    return m_internal->isShader((GLuint) shader->object());
+}
+
+bool GraphicsContext3D::isTexture(WebGLTexture* texture)
+{
+    if (!texture)
+        return false;
+    
+    m_internal->m_glWidget->makeCurrent();
+    return glIsTexture((GLuint) texture->object());
+}
+
+void GraphicsContext3D::lineWidth(double width)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glLineWidth(static_cast<float>(width));
+}
+
+void GraphicsContext3D::linkProgram(WebGLProgram* program)
+{
+    ASSERT(program);
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->linkProgram((GLuint) program->object());
+}
+
+void GraphicsContext3D::pixelStorei(unsigned long paramName, long param)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glPixelStorei(paramName, param);
+}
+
+void GraphicsContext3D::polygonOffset(double factor, double units)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glPolygonOffset(static_cast<float>(factor), static_cast<float>(units));
+}
+
+PassRefPtr<WebGLArray> GraphicsContext3D::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
+{
+    m_internal->m_glWidget->makeCurrent();
+    
+    if (type != GraphicsContext3D::UNSIGNED_BYTE || format != GraphicsContext3D::RGBA)
+        return 0;
+        
+    RefPtr<WebGLUnsignedByteArray> array = WebGLUnsignedByteArray::create(width * height * 4);
+    glReadPixels(x, y, width, height, format, type, (GLvoid*) array->data());
+    return array;    
+}
+
+void GraphicsContext3D::releaseShaderCompiler()
+{
+    m_internal->m_glWidget->makeCurrent();
+    notImplemented();
+}
+
+void GraphicsContext3D::renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->renderbufferStorage(target, internalformat, width, height);
+}
+
+void GraphicsContext3D::sampleCoverage(double value, bool invert)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->sampleCoverage(static_cast<float>(value), invert);
+}
+
+void GraphicsContext3D::scissor(long x, long y, unsigned long width, unsigned long height)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glScissor(x, y, width, height);
+}
+
+void GraphicsContext3D::shaderSource(WebGLShader* shader, const String& string)
+{
+    ASSERT(shader);
+    
+    m_internal->m_glWidget->makeCurrent();
+
+    // Force the use of GLSL 1.0:
+    // https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/doc/spec/WebGL-spec.html#4.4
+    // FIXME: Lines beginning with "#version" should be stripped out.
+
+    String prepared;
+   
+    prepared.append("#version 100\n");
+#if defined(QT_OPENGL_ES_2)
+    prepared.append("precision mediump float;\n");
+#endif
+    prepared.append(string);
+
+    CString preparedCS = prepared.utf8();
+    const char* data = preparedCS.data();
+    int length = prepared.length();
+    m_internal->shaderSource((GLuint) shader->object(), /* count */ 1, &data, &length);
+}
+
+void GraphicsContext3D::stencilFunc(unsigned long func, long ref, unsigned long mask)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glStencilFunc(func, ref, mask);
+}
+
+void GraphicsContext3D::stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->stencilFuncSeparate(face, func, ref, mask);
+}
+
+void GraphicsContext3D::stencilMask(unsigned long mask)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glStencilMask(mask);
+}
+
+void GraphicsContext3D::stencilMaskSeparate(unsigned long face, unsigned long mask)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->stencilMaskSeparate(face, mask);
+}
+
+void GraphicsContext3D::stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glStencilOp(fail, zfail, zpass);
+}
+
+void GraphicsContext3D::stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->stencilOpSeparate(face, fail, zfail, zpass);
+}
+
+void GraphicsContext3D::texParameterf(unsigned target, unsigned paramName, float value)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glTexParameterf(target, paramName, static_cast<float>(value));
+}
+
+void GraphicsContext3D::texParameteri(unsigned target, unsigned paramName, int value)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glTexParameteri(target, paramName, static_cast<float>(value));
+}
+
+void GraphicsContext3D::uniform1f(long location, float v0)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform1f(location, v0);
+}
+
+void GraphicsContext3D::uniform1fv(long location, float* array, int size)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform1fv(location, size, array);
+}
+
+void GraphicsContext3D::uniform2f(long location, float v0, float v1)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform2f(location, v0, v1);
+}
+
+void GraphicsContext3D::uniform2fv(long location, float* array, int size)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform2fv(location, size, array);
+}
+
+void GraphicsContext3D::uniform3f(long location, float v0, float v1, float v2)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform3f(location, v0, v1, v2);
+}
+
+void GraphicsContext3D::uniform3fv(long location, float* array, int size)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform3fv(location, size, array);
+}
+
+void GraphicsContext3D::uniform4f(long location, float v0, float v1, float v2, float v3)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform4f(location, v0, v1, v2, v3);
+}
+
+void GraphicsContext3D::uniform4fv(long location, float* array, int size)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform4fv(location, size, array);
+}
+
+void GraphicsContext3D::uniform1i(long location, int v0)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform1i(location, v0);
+}
+
+void GraphicsContext3D::uniform1iv(long location, int* array, int size)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform1iv(location, size, array);
+}
+
+void GraphicsContext3D::uniform2i(long location, int v0, int v1)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform2i(location, v0, v1);
+}
+
+void GraphicsContext3D::uniform2iv(long location, int* array, int size)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform2iv(location, size, array);
+}
+
+void GraphicsContext3D::uniform3i(long location, int v0, int v1, int v2)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform3i(location, v0, v1, v2);
+}
+
+void GraphicsContext3D::uniform3iv(long location, int* array, int size)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform3iv(location, size, array);
+}
+
+void GraphicsContext3D::uniform4i(long location, int v0, int v1, int v2, int v3)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform4i(location, v0, v1, v2, v3);
+}
+
+void GraphicsContext3D::uniform4iv(long location, int* array, int size)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniform4iv(location, size, array);
+}
+
+void GraphicsContext3D::uniformMatrix2fv(long location, bool transpose, float* array, int size)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniformMatrix2fv(location, size, transpose, array);
+}
+
+void GraphicsContext3D::uniformMatrix3fv(long location, bool transpose, float* array, int size)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniformMatrix3fv(location, size, transpose, array);
+}
+
+void GraphicsContext3D::uniformMatrix4fv(long location, bool transpose, float* array, int size)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->uniformMatrix4fv(location, size, transpose, array);
+}
+
+void GraphicsContext3D::useProgram(WebGLProgram* program)
+{
+    ASSERT(program);
+    
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->useProgram((GLuint) program->object());
+}
+
+void GraphicsContext3D::validateProgram(WebGLProgram* program)
+{
+    ASSERT(program);
+    
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->validateProgram((GLuint) program->object());
+}
+
+void GraphicsContext3D::vertexAttrib1f(unsigned long indx, float v0)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->vertexAttrib1f(indx, v0);
+}
+
+void GraphicsContext3D::vertexAttrib1fv(unsigned long indx, float* array)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->vertexAttrib1fv(indx, array);
+}
+
+void GraphicsContext3D::vertexAttrib2f(unsigned long indx, float v0, float v1)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->vertexAttrib2f(indx, v0, v1);
+}
+
+void GraphicsContext3D::vertexAttrib2fv(unsigned long indx, float* array)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->vertexAttrib2fv(indx, array);
+}
+
+void GraphicsContext3D::vertexAttrib3f(unsigned long indx, float v0, float v1, float v2)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->vertexAttrib3f(indx, v0, v1, v2);
+}
+
+void GraphicsContext3D::vertexAttrib3fv(unsigned long indx, float* array)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->vertexAttrib3fv(indx, array);
+}
+
+void GraphicsContext3D::vertexAttrib4f(unsigned long indx, float v0, float v1, float v2, float v3)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->vertexAttrib4f(indx, v0, v1, v2, v3);
+}
+
+void GraphicsContext3D::vertexAttrib4fv(unsigned long indx, float* array)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->vertexAttrib4fv(indx, array);
+}
+
+void GraphicsContext3D::vertexAttribPointer(unsigned long indx, int size, int type, bool normalized, unsigned long stride, unsigned long offset)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->vertexAttribPointer(indx, size, type, normalized, stride, reinterpret_cast<void*>(static_cast<intptr_t>(offset)));
+}
+
+void GraphicsContext3D::viewport(long x, long y, unsigned long width, unsigned long height)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glViewport(static_cast<GLint>(x), static_cast<GLint>(y), static_cast<GLsizei>(width), static_cast<GLsizei>(height));
+}
+
+void GraphicsContext3D::getBooleanv(unsigned long paramName, unsigned char* value)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glGetBooleanv(paramName, value);
+}
+
+void GraphicsContext3D::getBufferParameteriv(unsigned long target, unsigned long paramName, int* value)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->getBufferParameteriv(target, paramName, value);
+}
+
+void GraphicsContext3D::getFloatv(unsigned long paramName, float* value)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glGetFloatv(paramName, value);
+}
+
+void GraphicsContext3D::getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long paramName, int* value)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->getFramebufferAttachmentParameteriv(target, attachment, paramName, value);
+}
+
+void GraphicsContext3D::getIntegerv(unsigned long paramName, int* value)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glGetIntegerv(paramName, value);
+}
+
+void GraphicsContext3D::getProgramiv(WebGLProgram* program, unsigned long paramName, int* value)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->getProgramiv((GLuint) program->object(), paramName, value);
+}
+
+String GraphicsContext3D::getProgramInfoLog(WebGLProgram* program)
+{
+    m_internal->m_glWidget->makeCurrent();
+
+    GLint length;
+    m_internal->getProgramiv((GLuint) program->object(), GraphicsContext3D::INFO_LOG_LENGTH, &length);
+
+    GLsizei size;
+
+    GLchar* info = (GLchar*) fastMalloc(length);
+    if (!info)
+        return "";
+
+    m_internal->getProgramInfoLog((GLuint) program->object(), length, &size, info);
+
+    String result(info);
+    fastFree(info);
+
+    return result;
+}
+
+void GraphicsContext3D::getRenderbufferParameteriv(unsigned long target, unsigned long paramName, int* value)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->getRenderbufferParameteriv(target, paramName, value);
+}
+
+void GraphicsContext3D::getShaderiv(WebGLShader* shader, unsigned long paramName, int* value)
+{
+    ASSERT(shader);
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->getShaderiv((GLuint) shader->object(), paramName, value);
+}
+
+String GraphicsContext3D::getShaderInfoLog(WebGLShader* shader)
+{
+    m_internal->m_glWidget->makeCurrent();
+
+    GLint length;
+    m_internal->getShaderiv((GLuint) shader->object(), GraphicsContext3D::INFO_LOG_LENGTH, &length);
+
+    GLsizei size;
+    GLchar* info = (GLchar*) fastMalloc(length);
+    if (!info)
+        return "";
+
+    m_internal->getShaderInfoLog((GLuint) shader->object(), length, &size, info);
+
+    String result(info);
+    fastFree(info);
+
+    return result;
+}
+
+String GraphicsContext3D::getShaderSource(WebGLShader* shader)
+{
+    m_internal->m_glWidget->makeCurrent();
+
+    GLint length;
+    m_internal->getShaderiv((GLuint) shader->object(), GraphicsContext3D::SHADER_SOURCE_LENGTH, &length);
+
+    GLsizei size;
+    GLchar* info = (GLchar*) fastMalloc(length);
+    if (!info)
+        return "";
+
+    m_internal->getShaderSource((GLuint) shader->object(), length, &size, info);
+
+    String result(info);
+    fastFree(info);
+
+    return result;
+}
+
+void GraphicsContext3D::getTexParameterfv(unsigned long target, unsigned long paramName, float* value)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glGetTexParameterfv(target, paramName, value);
+}
+
+void GraphicsContext3D::getTexParameteriv(unsigned long target, unsigned long paramName, int* value)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glGetTexParameteriv(target, paramName, value);
+}
+
+void GraphicsContext3D::getUniformfv(WebGLProgram* program, long location, float* value)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->getUniformfv((GLuint) program->object(), location, value);
+}
+
+void GraphicsContext3D::getUniformiv(WebGLProgram* program, long location, int* value)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->getUniformiv((GLuint) program->object(), location, value);
+}
+
+long GraphicsContext3D::getUniformLocation(WebGLProgram* program, const String& name)
+{
+    ASSERT(program);
+    
+    m_internal->m_glWidget->makeCurrent();
+    return m_internal->getUniformLocation((GLuint) program->object(), name.utf8().data());
+}
+
+void GraphicsContext3D::getVertexAttribfv(unsigned long index, unsigned long paramName, float* value)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->getVertexAttribfv(index, paramName, value);
+}
+
+void GraphicsContext3D::getVertexAttribiv(unsigned long index, unsigned long paramName, int* value)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->getVertexAttribiv(index, paramName, value);
+}
+
+long GraphicsContext3D::getVertexAttribOffset(unsigned long index, unsigned long paramName)
+{
+    m_internal->m_glWidget->makeCurrent();
+    
+    void* pointer;
+    m_internal->getVertexAttribPointerv(index, paramName, &pointer);
+    return reinterpret_cast<long>(pointer);
+}
+
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat, unsigned width, unsigned height, unsigned border, unsigned format, unsigned type, void* pixels)
+{
+    glTexImage2D(target, level, internalformat, width, height, border, format, type, pixels);
+    return 0;
+}
+
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, Image* image, bool flipY, bool premultiplyAlpha)
+{
+    ASSERT(image);
+    
+    m_internal->m_glWidget->makeCurrent();
+
+    Vector<uint8_t> imageData;
+    GLuint format;
+    GLuint internalFormat;
+
+    if (!extractImageData(image, flipY, premultiplyAlpha, imageData, &format, &internalFormat)) {
+        LOG_ERROR("GraphicsContext3D::texImage2D: could not extract Image data");
+        return -1;
+    }
+
+    glTexImage2D(target, level, internalFormat, image->width(), image->height(), 
+                 /* border */ 0, format, GraphicsContext3D::UNSIGNED_BYTE, imageData.data());
+
+    return 0;
+}
+    
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, unsigned format, unsigned type, void* pixels)
+{
+    glTexSubImage2D(target, level, xoff, yoff, width, height, format, type, pixels);
+    return 0;
+}
+
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, Image* image, bool flipY, bool premultiplyAlpha)
+{
+    ASSERT(image);
+
+    Vector<uint8_t> imageData;
+    GLuint format;
+    GLuint internalFormat;
+
+    if (!extractImageData(image, flipY, premultiplyAlpha, imageData, &format, &internalFormat)) {
+        LOG_ERROR("GraphicsContext3D::texSubImage2D: could not extract Image data");
+        return -1;
+    }
+
+    glTexSubImage2D(target, level, xoff, yoff, image->width(), image->height(), 
+                    format, GraphicsContext3D::UNSIGNED_BYTE, imageData.data());
+
+    return 0;
+}
+
+unsigned GraphicsContext3D::createBuffer()
+{
+    m_internal->m_glWidget->makeCurrent();
+    GLuint handle;
+    m_internal->genBuffers(/* count */ 1, &handle);
+    return handle;
+}
+
+unsigned GraphicsContext3D::createFramebuffer()
+{
+    m_internal->m_glWidget->makeCurrent();
+    GLuint handle;
+    m_internal->genFramebuffers(/* count */ 1, &handle);
+    return handle;
+}
+
+unsigned GraphicsContext3D::createProgram()
+{
+    m_internal->m_glWidget->makeCurrent();
+    return m_internal->createProgram();
+}
+
+unsigned GraphicsContext3D::createRenderbuffer()
+{
+    m_internal->m_glWidget->makeCurrent();
+    GLuint handle;
+    m_internal->genRenderbuffers(/* count */ 1, &handle);
+    return handle;
+}
+
+unsigned GraphicsContext3D::createShader(unsigned long type)
+{
+    m_internal->m_glWidget->makeCurrent();
+    return m_internal->createShader((type == FRAGMENT_SHADER) ? GraphicsContext3D::FRAGMENT_SHADER : GraphicsContext3D::VERTEX_SHADER);
+}
+
+unsigned GraphicsContext3D::createTexture()
+{
+    m_internal->m_glWidget->makeCurrent();
+    GLuint handle;
+    glGenTextures(1, &handle);
+    return handle;
+}
+
+void GraphicsContext3D::deleteBuffer(unsigned buffer)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->deleteBuffers(1, &buffer);
+}
+
+void GraphicsContext3D::deleteFramebuffer(unsigned framebuffer)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->deleteFramebuffers(1, &framebuffer);
+}
+
+void GraphicsContext3D::deleteProgram(unsigned program)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->deleteProgram(program);
+}
+
+void GraphicsContext3D::deleteRenderbuffer(unsigned renderbuffer)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->deleteRenderbuffers(1, &renderbuffer);
+}
+
+void GraphicsContext3D::deleteShader(unsigned shader)
+{
+    m_internal->m_glWidget->makeCurrent();
+    m_internal->deleteShader(shader);
+}
+
+void GraphicsContext3D::deleteTexture(unsigned texture)
+{
+    m_internal->m_glWidget->makeCurrent();
+    glDeleteTextures(1, &texture);
+}
+
+int GraphicsContext3D::sizeInBytes(int type)
+{
+    switch (type) {
+    case GraphicsContext3D::BYTE:
+        return sizeof(GLbyte);
+    case GraphicsContext3D::UNSIGNED_BYTE:
+        return sizeof(GLubyte);
+    case GraphicsContext3D::SHORT:
+        return sizeof(GLshort);
+    case GraphicsContext3D::UNSIGNED_SHORT:
+        return sizeof(GLushort);
+    case GraphicsContext3D::INT:
+        return sizeof(GLint);
+    case GraphicsContext3D::UNSIGNED_INT:
+        return sizeof(GLuint);
+    case GraphicsContext3D::FLOAT:
+        return sizeof(GLfloat);
+    default:
+        return 0;
+    }
+}
+
+void GraphicsContext3D::synthesizeGLError(unsigned long error)
+{
+    m_internal->m_syntheticErrors.add(error);
+}
+
+bool GraphicsContext3D::getImageData(Image* image,
+                                     Vector<uint8_t>& outputVector,
+                                     bool premultiplyAlpha,
+                                     bool* hasAlphaChannel,
+                                     AlphaOp* neededAlphaOp,
+                                     unsigned int* format)
+{
+    QImage::Format imageFormat = (!premultiplyAlpha) ? 
+        QImage::Format_ARGB32 :
+        QImage::Format_ARGB32_Premultiplied;
+ 
+    QPixmap* nativePixmap = image->nativeImageForCurrentFrame(); 
+
+    *hasAlphaChannel = true;
+    *neededAlphaOp = kAlphaDoNothing;
+    *format = GraphicsContext3D::RGBA;
+
+    QImage nativeImage = nativePixmap->toImage().convertToFormat(imageFormat);
+    outputVector.append(nativeImage.bits(), nativeImage.byteCount());
+
+    return true;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index 57a481ae71..edac268f85 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -40,6 +40,7 @@
 #include <windows.h>
 #endif
 
+#include "AffineTransform.h"
 #include "Color.h"
 #include "FloatConversion.h"
 #include "Font.h"
@@ -49,7 +50,6 @@
 #include "Path.h"
 #include "Pattern.h"
 #include "Pen.h"
-#include "TransformationMatrix.h"
 
 #include <QBrush>
 #include <QDebug>
@@ -166,7 +166,7 @@ static inline Qt::FillRule toQtFillRule(WindRule rule)
     return Qt::OddEvenFill;
 }
 
-struct TransparencyLayer {
+struct TransparencyLayer : FastAllocBase {
     TransparencyLayer(const QPainter* p, const QRect &rect)
         : pixmap(rect.width(), rect.height())
     {
@@ -198,7 +198,7 @@ private:
     TransparencyLayer & operator=(const TransparencyLayer &) { return *this; }
 };
 
-class GraphicsContextPlatformPrivate {
+class GraphicsContextPlatformPrivate : public Noncopyable {
 public:
     GraphicsContextPlatformPrivate(QPainter* painter);
     ~GraphicsContextPlatformPrivate();
@@ -219,8 +219,11 @@ public:
     QStack<TransparencyLayer*> layers;
     QPainter* redirect;
 
+    // reuse this brush for solid color (to prevent expensive QBrush construction)
     QBrush solidColor;
 
+    InterpolationQuality imageInterpolationQuality;
+
     // Only used by SVG for now.
     QPainterPath currentPath;
 
@@ -236,6 +239,8 @@ GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate(QPainter* p)
 
     solidColor = QBrush(Qt::black);
 
+    imageInterpolationQuality = InterpolationDefault;
+
     if (painter) {
         // use the default the QPainter was constructed with
         antiAliasingForRectsAndLines = painter->testRenderHint(QPainter::Antialiasing);
@@ -256,8 +261,8 @@ GraphicsContext::GraphicsContext(PlatformGraphicsContext* context)
     setPaintingDisabled(!context);
     if (context) {
         // Make sure the context starts in sync with our state.
-        setPlatformFillColor(fillColor());
-        setPlatformStrokeColor(strokeColor());
+        setPlatformFillColor(fillColor(), DeviceColorSpace);
+        setPlatformStrokeColor(strokeColor(), DeviceColorSpace);
     }
 }
 
@@ -275,13 +280,11 @@ PlatformGraphicsContext* GraphicsContext::platformContext() const
     return m_data->p();
 }
 
-TransformationMatrix GraphicsContext::getCTM() const
+AffineTransform GraphicsContext::getCTM() const
 {
     QTransform matrix(platformContext()->combinedTransform());
-    return TransformationMatrix(matrix.m11(), matrix.m12(), 0, matrix.m13(),
-                                matrix.m21(), matrix.m22(), 0, matrix.m23(),
-                                           0,            0, 1,            0,
-                                matrix.m31(), matrix.m32(), 0, matrix.m33());
+    return AffineTransform(matrix.m11(), matrix.m12(), matrix.m21(),
+                           matrix.m22(), matrix.dx(), matrix.dy());
 }
 
 void GraphicsContext::savePlatformState()
@@ -299,112 +302,6 @@ void GraphicsContext::restorePlatformState()
     }
 }
 
-/* FIXME: DISABLED WHILE MERGING BACK FROM UNITY
-void GraphicsContext::drawTextShadow(const TextRun& run, const IntPoint& point, const FontStyle& style)
-{
-    if (paintingDisabled())
-        return;
-
-    if (m_data->shadow.isNull())
-        return;
-
-    TextShadow* shadow = &m_data->shadow;
-
-    if (shadow->blur <= 0) {
-        Pen p = pen();
-        setPen(shadow->color);
-        font().drawText(this, run, style, IntPoint(point.x() + shadow->x, point.y() + shadow->y));
-        setPen(p);
-    } else {
-        const int thickness = shadow->blur;
-        // FIXME: OPTIMIZE: limit the area to only the actually painted area + 2*thickness
-        const int w = m_data->p()->device()->width();
-        const int h = m_data->p()->device()->height();
-        const QRgb color = qRgb(255, 255, 255);
-        const QRgb bgColor = qRgb(0, 0, 0);
-        QImage image(QSize(w, h), QImage::Format_ARGB32);
-        image.fill(bgColor);
-        QPainter p;
-
-        Pen curPen = pen();
-        p.begin(&image);
-        setPen(color);
-        m_data->redirect = &p;
-        font().drawText(this, run, style, IntPoint(point.x() + shadow->x, point.y() + shadow->y));
-        m_data->redirect = 0;
-        p.end();
-        setPen(curPen);
-
-        int md = thickness * thickness; // max-dist^2
-
-        // blur map/precalculated shadow-decay
-        float* bmap = (float*) alloca(sizeof(float) * (md + 1));
-        for (int n = 0; n <= md; n++) {
-            float f;
-            f = n / (float) (md + 1);
-            f = 1.0 - f * f;
-            bmap[n] = f;
-        }
-
-        float factor = 0.0; // maximal potential opacity-sum
-        for (int n = -thickness; n <= thickness; n++) {
-            for (int m = -thickness; m <= thickness; m++) {
-                int d = n * n + m * m;
-                if (d <= md)
-                    factor += bmap[d];
-            }
-        }
-
-        // alpha map
-        float* amap = (float*) alloca(sizeof(float) * (h * w));
-        memset(amap, 0, h * w * (sizeof(float)));
-
-        for (int j = thickness; j<h-thickness; j++) {
-            for (int i = thickness; i<w-thickness; i++) {
-                QRgb col = image.pixel(i,j);
-                if (col == bgColor)
-                    continue;
-
-                float g = qAlpha(col);
-                g = g / 255;
-
-                for (int n = -thickness; n <= thickness; n++) {
-                    for (int m = -thickness; m <= thickness; m++) {
-                        int d = n * n + m * m;
-                        if (d > md)
-                            continue;
-
-                        float f = bmap[d];
-                        amap[(i + m) + (j + n) * w] += (g * f);
-                    }
-                }
-            }
-        }
-
-        QImage res(QSize(w,h),QImage::Format_ARGB32);
-        int r = shadow->color.red();
-        int g = shadow->color.green();
-        int b = shadow->color.blue();
-        int a1 = shadow->color.alpha();
-
-        // arbitratry factor adjustment to make shadows more solid.
-        factor = 1.333 / factor;
-
-        for (int j = 0; j < h; j++) {
-            for (int i = 0; i < w; i++) {
-                int a = (int) (amap[i + j * w] * factor * a1);
-                if (a > 255)
-                    a = 255;
-
-                res.setPixel(i,j, qRgba(r, g, b, a));
-            }
-        }
-
-        m_data->p()->drawImage(0, 0, res, 0, 0, -1, -1, Qt::DiffuseAlphaDither | Qt::ColorOnly | Qt::PreferDither);
-    }
-}
-*/
-
 // Draws a filled rectangle with a stroked border.
 void GraphicsContext::drawRect(const IntRect& rect)
 {
@@ -415,14 +312,16 @@ void GraphicsContext::drawRect(const IntRect& rect)
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, m_data->antiAliasingForRectsAndLines);
 
-    IntSize shadowSize;
-    int shadowBlur;
-    Color shadowColor;
-    if (getShadow(shadowSize, shadowBlur, shadowColor)) {
-        IntRect shadowRect = rect;
-        shadowRect.move(shadowSize.width(), shadowSize.height());
-        shadowRect.inflate(static_cast<int>(p->pen().widthF()));
-        p->fillRect(shadowRect, QColor(shadowColor));
+    if (m_common->state.shadowColor.isValid()) {
+        IntSize shadowSize;
+        int shadowBlur;
+        Color shadowColor;
+        if (getShadow(shadowSize, shadowBlur, shadowColor)) {
+            IntRect shadowRect = rect;
+            shadowRect.move(shadowSize.width(), shadowSize.height());
+            shadowRect.inflate(static_cast<int>(p->pen().widthF()));
+            p->fillRect(shadowRect, QColor(shadowColor));
+        }
     }
 
     p->drawRect(rect);
@@ -513,7 +412,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
                     patternOffset = patWidth / 2;
             } else {
                 if (remainder)
-                    patternOffset = (patWidth - remainder)/2;
+                    patternOffset = (patWidth - remainder) / 2;
             }
         }
 
@@ -618,14 +517,14 @@ QPen GraphicsContext::pen()
     return p->pen();
 }
 
-static void inline drawFilledShadowPath(GraphicsContext* context, QPainter* p, const QPainterPath *path)
+static void inline drawFilledShadowPath(GraphicsContext* context, QPainter* p, const QPainterPath& path)
 {
     IntSize shadowSize;
     int shadowBlur;
     Color shadowColor;
     if (context->getShadow(shadowSize, shadowBlur, shadowColor)) {
         p->translate(shadowSize.width(), shadowSize.height());
-        p->fillPath(*path, QBrush(shadowColor));
+        p->fillPath(path, QBrush(shadowColor));
         p->translate(-shadowSize.width(), -shadowSize.height());
     }
 }
@@ -639,24 +538,18 @@ void GraphicsContext::fillPath()
     QPainterPath path = m_data->currentPath;
     path.setFillRule(toQtFillRule(fillRule()));
 
-    if ((m_common->state.fillColorSpace != SolidColorSpace)
-            || (fillColor().alpha())) {
-        drawFilledShadowPath(this, p, &path);
-        switch (m_common->state.fillColorSpace) {
-        case SolidColorSpace:
-            if (fillColor().alpha())
-                p->fillPath(path, p->brush());
-            break;
-        case PatternColorSpace: {
-            TransformationMatrix affine;
+    if (m_common->state.fillPattern || m_common->state.fillGradient || fillColor().alpha()) {
+        drawFilledShadowPath(this, p, path);
+        if (m_common->state.fillPattern) {
+            AffineTransform affine;
             p->fillPath(path, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
-            break;
-        }
-        case GradientColorSpace:
+        } else if (m_common->state.fillGradient) {
             QBrush brush(*m_common->state.fillGradient->platformGradient());
             brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
             p->fillPath(path, brush);
-            break;
+        } else {
+            if (fillColor().alpha())
+                p->fillPath(path, p->brush());
         }
     }
     m_data->currentPath = QPainterPath();
@@ -672,8 +565,7 @@ void GraphicsContext::strokePath()
     QPainterPath path = m_data->currentPath;
     path.setFillRule(toQtFillRule(fillRule()));
 
-    if ((m_common->state.strokeColorSpace != SolidColorSpace)
-            || (strokeColor().alpha())) {
+    if (m_common->state.strokePattern || m_common->state.strokeGradient || strokeColor().alpha()) {
         IntSize shadowSize;
         int shadowBlur;
         Color shadowColor;
@@ -685,26 +577,20 @@ void GraphicsContext::strokePath()
             p->strokePath(path, shadowPen);
             p->setWorldTransform(t);
         }
-        switch (m_common->state.strokeColorSpace) {
-        case SolidColorSpace:
-            if (strokeColor().alpha())
-                p->strokePath(path, pen);
-            break;
-        case PatternColorSpace: {
-            TransformationMatrix affine;
+        if (m_common->state.strokePattern) {
+            AffineTransform affine;
             pen.setBrush(QBrush(m_common->state.strokePattern->createPlatformPattern(affine)));
             p->setPen(pen);
             p->strokePath(path, pen);
-            break;
-        }
-        case GradientColorSpace: {
+        } else if (m_common->state.strokeGradient) {
             QBrush brush(*m_common->state.strokeGradient->platformGradient());
             brush.setTransform(m_common->state.strokeGradient->gradientSpaceTransform());
             pen.setBrush(brush);
             p->setPen(pen);
             p->strokePath(path, pen);
-            break;
-        }
+        } else {
+            if (strokeColor().alpha())
+                p->strokePath(path, pen);
         }
     }
     m_data->currentPath = QPainterPath();
@@ -729,40 +615,45 @@ void GraphicsContext::fillRect(const FloatRect& rect)
 
     QPainter* p = m_data->p();
 
-    if ((m_common->state.fillColorSpace != SolidColorSpace)
-            || (fillColor().alpha())) {
-        drawBorderlessRectShadow(this, p, rect);
-        switch (m_common->state.fillColorSpace) {
-        case SolidColorSpace:
-            if (fillColor().alpha())
-                p->fillRect(rect, p->brush());
-            break;
-        case PatternColorSpace: {
-            TransformationMatrix affine;
-            p->fillRect(rect, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
-            break;
-        }
-        case GradientColorSpace:
+    if (m_common->state.fillPattern || m_common->state.fillGradient || fillColor().alpha()) {
+        if (m_common->state.shadowColor.isValid())
+            drawBorderlessRectShadow(this, p, rect);
+        if (m_common->state.fillPattern) {
+            AffineTransform affine;
+            FloatRect rectM(rect);
+            QBrush brush(m_common->state.fillPattern->createPlatformPattern(affine));
+            QPixmap* image = m_common->state.fillPattern->tileImage()->nativeImageForCurrentFrame();
+
+            if (!m_common->state.fillPattern->repeatX() && image)
+                rectM.setWidth(image->width());
+            if (!m_common->state.fillPattern->repeatY() && image)
+                rectM.setHeight(image->height());
+            p->fillRect(rectM, brush);
+
+        } else if (m_common->state.fillGradient) {
             QBrush brush(*m_common->state.fillGradient->platformGradient());
             brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
             p->fillRect(rect, brush);
-            break;
+        } else {
+            if (fillColor().alpha())
+                p->fillRect(rect, p->brush());
         }
     }
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& c)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& c, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
 
     m_data->solidColor.setColor(c);
     QPainter* p = m_data->p();
-    drawBorderlessRectShadow(this, p, rect);
+    if (m_common->state.shadowColor.isValid())
+        drawBorderlessRectShadow(this, p, rect);
     p->fillRect(rect, m_data->solidColor);
 }
 
-void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
+void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled() || !color.alpha())
         return;
@@ -770,7 +661,7 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLef
     Path path = Path::createRoundedRectangle(rect, topLeft, topRight, bottomLeft, bottomRight);
     QPainter* p = m_data->p();
     drawFilledShadowPath(this, p, path.platformPath());
-    p->fillPath(*path.platformPath(), QColor(color));
+    p->fillPath(path.platformPath(), QColor(color));
 }
 
 void GraphicsContext::beginPath()
@@ -781,7 +672,7 @@ void GraphicsContext::beginPath()
 void GraphicsContext::addPath(const Path& path)
 {
     QPainterPath newPath = m_data->currentPath;
-    newPath.addPath(*(path.platformPath()));
+    newPath.addPath(path.platformPath());
     m_data->currentPath = newPath;
 }
 
@@ -814,17 +705,21 @@ void GraphicsContext::clipPath(WindRule clipRule)
     p->setClipPath(newPath);
 }
 
+void GraphicsContext::drawFocusRing(const Vector<Path>& paths, int width, int offset, const Color& color)
+{
+    // FIXME: implement
+}
+
 /**
  * Focus ring handling is not handled here. Qt style in 
  * RenderTheme handles drawing focus on widgets which 
  * need it.
  */
-void GraphicsContext::drawFocusRing(const Color& color)
+void GraphicsContext::drawFocusRing(const Vector<IntRect>& rects, int /* width */, int /* offset */, const Color& color)
 {
     if (paintingDisabled())
         return;
 
-    const Vector<IntRect>& rects = focusRingRects();
     unsigned rectCount = rects.size();
 
     if (!rects.size())
@@ -879,14 +774,33 @@ void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint&, int, b
 
 FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect)
 {
-    QRectF rect(frect);
-    rect = m_data->p()->deviceMatrix().mapRect(rect);
+    // It is not enough just to round to pixels in device space. The rotation part of the
+    // affine transform matrix to device space can mess with this conversion if we have a
+    // rotating image like the hands of the world clock widget. We just need the scale, so
+    // we get the affine transform matrix and extract the scale.
+    QPainter* painter = platformContext();
+    QTransform deviceTransform = painter->deviceTransform();
+    if (deviceTransform.isIdentity())
+        return frect;
+
+    qreal deviceScaleX = sqrtf(deviceTransform.m11() * deviceTransform.m11() + deviceTransform.m12() * deviceTransform.m12());
+    qreal deviceScaleY = sqrtf(deviceTransform.m21() * deviceTransform.m21() + deviceTransform.m22() * deviceTransform.m22());
+
+    QPoint deviceOrigin(frect.x() * deviceScaleX, frect.y() * deviceScaleY);
+    QPoint deviceLowerRight(frect.right() * deviceScaleX, frect.bottom() * deviceScaleY);
+
+    // Don't let the height or width round to 0 unless either was originally 0
+    if (deviceOrigin.y() == deviceLowerRight.y() && frect.height())
+        deviceLowerRight.setY(deviceLowerRight.y() + 1);
+    if (deviceOrigin.x() == deviceLowerRight.x() && frect.width())
+        deviceLowerRight.setX(deviceLowerRight.x() + 1);
 
-    QRect result = rect.toRect(); //round it
-    return FloatRect(QRectF(result));
+    FloatPoint roundedOrigin = FloatPoint(deviceOrigin.x() / deviceScaleX, deviceOrigin.y() / deviceScaleY);
+    FloatPoint roundedLowerRight = FloatPoint(deviceLowerRight.x() / deviceScaleX, deviceLowerRight.y() / deviceScaleY);
+    return FloatRect(roundedOrigin, roundedLowerRight - roundedOrigin);
 }
 
-void GraphicsContext::setPlatformShadow(const IntSize& size, int, const Color&)
+void GraphicsContext::setPlatformShadow(const IntSize& size, int, const Color&, ColorSpace)
 {
     // Qt doesn't support shadows natively, they are drawn manually in the draw*
     // functions
@@ -1050,7 +964,7 @@ void GraphicsContext::clip(const Path& path)
     if (paintingDisabled())
         return;
 
-    m_data->p()->setClipPath(*path.platformPath(), Qt::IntersectClip);
+    m_data->p()->setClipPath(path.platformPath(), Qt::IntersectClip);
 }
 
 void GraphicsContext::canvasClip(const Path& path)
@@ -1064,16 +978,16 @@ void GraphicsContext::clipOut(const Path& path)
         return;
 
     QPainter* p = m_data->p();
-    QPainterPath clippedOut = *path.platformPath();
+    QPainterPath clippedOut = path.platformPath();
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
     if (p->hasClipping()) {
-        newClip.addRect(p->clipPath().boundingRect());
+        newClip.addRect(p->clipRegion().boundingRect());
         newClip.addPath(clippedOut);
         p->setClipPath(newClip, Qt::IntersectClip);
     } else {
         newClip.addRect(p->window());
-        newClip.addPath(clippedOut & newClip);
+        newClip.addPath(clippedOut.intersected(newClip));
         p->setClipPath(newClip);
     }
 }
@@ -1105,11 +1019,11 @@ void GraphicsContext::rotate(float radians)
     if (paintingDisabled())
         return;
 
-    m_data->p()->rotate(180/M_PI*radians);
+    m_data->p()->rotate(180 / M_PI*radians);
 
     if (!m_data->currentPath.isEmpty()) {
         QTransform matrix;
-        m_data->currentPath = m_data->currentPath * matrix.rotate(-180/M_PI*radians);
+        m_data->currentPath = m_data->currentPath * matrix.rotate(-180 / M_PI*radians);
         m_common->state.pathTransform.rotate(radians);
     }
 }
@@ -1137,7 +1051,7 @@ void GraphicsContext::clipOut(const IntRect& rect)
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
     if (p->hasClipping()) {
-        newClip.addRect(p->clipPath().boundingRect());
+        newClip.addRect(p->clipRegion().boundingRect());
         newClip.addRect(QRect(rect));
         p->setClipPath(newClip, Qt::IntersectClip);
     } else {
@@ -1159,7 +1073,7 @@ void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
     if (p->hasClipping()) {
-        newClip.addRect(p->clipPath().boundingRect());
+        newClip.addRect(p->clipRegion().boundingRect());
         newClip.addEllipse(QRect(rect));
         p->setClipPath(newClip, Qt::IntersectClip);
     } else {
@@ -1203,7 +1117,7 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect,
     p->setRenderHint(QPainter::Antialiasing, antiAlias);
 }
 
-void GraphicsContext::concatCTM(const TransformationMatrix& transform)
+void GraphicsContext::concatCTM(const AffineTransform& transform)
 {
     if (paintingDisabled())
         return;
@@ -1216,7 +1130,7 @@ void GraphicsContext::concatCTM(const TransformationMatrix& transform)
     if (!m_data->currentPath.isEmpty() && transform.isInvertible()) {
         QTransform matrix = transform.inverse();
         m_data->currentPath = m_data->currentPath * matrix;
-        m_common->state.pathTransform.multiply(transform);
+        m_common->state.pathTransform.multiply(transform.toTransformationMatrix());
     }
 }
 
@@ -1225,13 +1139,14 @@ void GraphicsContext::setURLForRect(const KURL&, const IntRect&)
     notImplemented();
 }
 
-void GraphicsContext::setPlatformStrokeColor(const Color& color)
+void GraphicsContext::setPlatformStrokeColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
     QPainter* p = m_data->p();
     QPen newPen(p->pen());
-    newPen.setColor(color);
+    m_data->solidColor.setColor(color);
+    newPen.setBrush(m_data->solidColor);
     p->setPen(newPen);
 }
 
@@ -1255,11 +1170,12 @@ void GraphicsContext::setPlatformStrokeThickness(float thickness)
     p->setPen(newPen);
 }
 
-void GraphicsContext::setPlatformFillColor(const Color& color)
+void GraphicsContext::setPlatformFillColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
-    m_data->p()->setBrush(QBrush(color));
+    m_data->solidColor.setColor(color);
+    m_data->p()->setBrush(m_data->solidColor);
 }
 
 void GraphicsContext::setPlatformShouldAntialias(bool enable)
@@ -1312,7 +1228,7 @@ HDC GraphicsContext::getWindowsContext(const IntRect& dstRect, bool supportAlpha
         memset(bmpInfo.bmBits, 0, bufferSize);
     }
 
-#if !PLATFORM(WINCE)
+#if !OS(WINCE)
     // Make sure we can do world transforms.
     SetGraphicsMode(bitmapDC, GM_ADVANCED);
 
@@ -1355,13 +1271,30 @@ void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, boo
 }
 #endif
 
-void GraphicsContext::setImageInterpolationQuality(InterpolationQuality)
+void GraphicsContext::setImageInterpolationQuality(InterpolationQuality quality)
 {
+    m_data->imageInterpolationQuality = quality;
+
+    switch (quality) {
+    case InterpolationDefault:
+    case InterpolationNone:
+    case InterpolationLow:
+        // use nearest-neigbor
+        m_data->p()->setRenderHint(QPainter::SmoothPixmapTransform, false);
+        break;
+
+    case InterpolationMedium:
+    case InterpolationHigh:
+    default:
+        // use the filter
+        m_data->p()->setRenderHint(QPainter::SmoothPixmapTransform, true);
+        break;
+    };
 }
 
 InterpolationQuality GraphicsContext::imageInterpolationQuality() const
 {
-    return InterpolationDefault;
+    return m_data->imageInterpolationQuality;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
new file mode 100644
index 0000000000..324956be94
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
@@ -0,0 +1,1333 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "GraphicsLayerQt.h"
+
+#include "CurrentTime.h"
+#include "FloatRect.h"
+#include "GraphicsContext.h"
+#include "Image.h"
+#include "RefCounted.h"
+#include "TranslateTransformOperation.h"
+#include "UnitBezier.h"
+#include <QtCore/qabstractanimation.h>
+#include <QtCore/qdebug.h>
+#include <QtCore/qmetaobject.h>
+#include <QtCore/qset.h>
+#include <QtCore/qtimer.h>
+#include <QtGui/qbitmap.h>
+#include <QtGui/qcolor.h>
+#include <QtGui/qgraphicseffect.h>
+#include <QtGui/qgraphicsitem.h>
+#include <QtGui/qgraphicsscene.h>
+#include <QtGui/qmatrix4x4.h>
+#include <QtGui/qpainter.h>
+#include <QtGui/qpalette.h>
+#include <QtGui/qpixmap.h>
+#include <QtGui/qstyleoption.h>
+
+namespace WebCore {
+
+class MaskEffectQt : public QGraphicsEffect {
+public:
+    MaskEffectQt(QObject* parent, QGraphicsItem* maskLayer)
+            : QGraphicsEffect(parent)
+            , m_maskLayer(maskLayer)
+    {
+    }
+
+    void draw(QPainter* painter)
+    {
+        // this is a modified clone of QGraphicsOpacityEffect.
+        // It's more efficient to do it this way because
+        // (a) we don't need the QBrush abstraction - we always end up using QGraphicsItem::paint from the mask layer
+        // (b) QGraphicsOpacityEffect detaches the pixmap, which is inefficient on OpenGL.
+        QPixmap maskPixmap(sourceBoundingRect().toAlignedRect().size());
+
+        // we need to do this so the pixmap would have hasAlpha()
+        maskPixmap.fill(Qt::transparent);
+        QPainter maskPainter(&maskPixmap);
+        QStyleOptionGraphicsItem option;
+        option.exposedRect = option.rect = maskPixmap.rect();
+        maskPainter.setRenderHints(painter->renderHints(), true);
+        m_maskLayer->paint(&maskPainter, &option, 0);
+        maskPainter.end();
+        QPoint offset;
+        QPixmap srcPixmap = sourcePixmap(Qt::LogicalCoordinates, &offset, QGraphicsEffect::NoPad);
+
+        // we have to use another intermediate pixmap, to make sure the mask applies only to this item
+        // and doesn't modify pixels already painted into this paint-device
+        QPixmap pixmap(srcPixmap.size());
+        pixmap.fill(Qt::transparent);
+
+        if (pixmap.isNull())
+            return;
+
+        QPainter pixmapPainter(&pixmap);
+        pixmapPainter.setRenderHints(painter->renderHints());
+        pixmapPainter.setCompositionMode(QPainter::CompositionMode_Source);
+        // We use drawPixmap rather than detaching, because it's more efficient on OpenGL
+        pixmapPainter.drawPixmap(0, 0, srcPixmap);
+        pixmapPainter.setCompositionMode(QPainter::CompositionMode_DestinationIn);
+        pixmapPainter.drawPixmap(0, 0, maskPixmap);
+        pixmapPainter.end();
+        painter->drawPixmap(offset, pixmap);
+    }
+
+    QGraphicsItem* m_maskLayer;
+};
+
+class GraphicsLayerQtImpl : public QGraphicsObject {
+    Q_OBJECT
+
+public:
+    // this set of flags help us defer which properties of the layer have been
+    // modified by the compositor, so we can know what to look for in the next flush
+    enum ChangeMask {
+        NoChanges =                 0,
+
+        ParentChange =              (1L << 0),
+        ChildrenChange =            (1L << 1),
+        MaskLayerChange =           (1L << 2),
+        PositionChange =            (1L << 3),
+
+        AnchorPointChange =         (1L << 4),
+        SizeChange  =               (1L << 5),
+        TransformChange =           (1L << 6),
+        ContentChange =             (1L << 7),
+
+        GeometryOrientationChange = (1L << 8),
+        ContentsOrientationChange = (1L << 9),
+        OpacityChange =             (1L << 10),
+        ContentsRectChange =        (1L << 11),
+
+        Preserves3DChange =         (1L << 12),
+        MasksToBoundsChange =       (1L << 13),
+        DrawsContentChange =        (1L << 14),
+        ContentsOpaqueChange =      (1L << 15),
+
+        BackfaceVisibilityChange =  (1L << 16),
+        ChildrenTransformChange =   (1L << 17),
+        DisplayChange =             (1L << 18),
+        BackgroundColorChange =     (1L << 19),
+
+        DistributesOpacityChange =  (1L << 20)
+    };
+
+    // the compositor lets us special-case images and colors, so we try to do so
+    enum StaticContentType { HTMLContentType, PixmapContentType, ColorContentType, MediaContentType};
+
+    GraphicsLayerQtImpl(GraphicsLayerQt* newLayer);
+    virtual ~GraphicsLayerQtImpl();
+
+    // reimps from QGraphicsItem
+    virtual QPainterPath opaqueArea() const;
+    virtual QRectF boundingRect() const;
+    virtual void paint(QPainter*, const QStyleOptionGraphicsItem*, QWidget*);
+
+    // we manage transforms ourselves because transform-origin acts differently in webkit and in Qt
+    void setBaseTransform(const TransformationMatrix&);
+    QTransform computeTransform(const TransformationMatrix& baseTransform) const;
+    void updateTransform();
+
+    // let the compositor-API tell us which properties were changed
+    void notifyChange(ChangeMask);
+
+    // called when the compositor is ready for us to show the changes on screen
+    // this is called indirectly from ChromeClientQt::setNeedsOneShotDrawingSynchronization
+    // (meaning the sync would happen together with the next draw)
+    // or ChromeClientQt::scheduleCompositingLayerSync (meaning the sync will happen ASAP)
+    void flushChanges(bool recursive = true, bool forceTransformUpdate = false);
+
+    // optimization: when we have an animation running on an element with no contents, that has child-elements with contents,
+    // ALL of them have to have ItemCoordinateCache and not DeviceCoordinateCache
+    void adjustCachingRecursively(bool animationIsRunning);
+
+    // optimization: returns true if this or an ancestor has a transform animation running.
+    // this enables us to use ItemCoordinatesCache while the animation is running, otherwise we have to recache for every frame
+    bool isTransformAnimationRunning() const;
+
+public slots:
+    // we need to notify the client (aka the layer compositor) when the animation actually starts
+    void notifyAnimationStarted();
+
+    // we notify WebCore of a layer changed asynchronously; otherwise we end up calling flushChanges too often.
+    void notifySyncRequired();
+
+signals:
+    // optimization: we don't want to use QTimer::singleShot
+    void notifyAnimationStartedAsync();
+
+public:
+    GraphicsLayerQt* m_layer;
+
+    TransformationMatrix m_baseTransform;
+    bool m_transformAnimationRunning;
+    bool m_opacityAnimationRunning;
+    QWeakPointer<MaskEffectQt> m_maskEffect;
+
+    struct ContentData {
+        QPixmap pixmap;
+        QRegion regionToUpdate;
+        bool updateAll;
+        QColor contentsBackgroundColor;
+        QColor backgroundColor;
+        QWeakPointer<QGraphicsObject> mediaLayer;
+        StaticContentType contentType;
+        float opacity;
+        ContentData()
+                : updateAll(false)
+                , contentType(HTMLContentType)
+                , opacity(1.f)
+        {
+        }
+
+    };
+
+    ContentData m_pendingContent;
+    ContentData m_currentContent;
+
+    int m_changeMask;
+
+    QSizeF m_size;
+    QList<QWeakPointer<QAbstractAnimation> > m_animations;
+    QTimer m_suspendTimer;
+
+    struct State {
+        GraphicsLayer* maskLayer;
+        FloatPoint pos;
+        FloatPoint3D anchorPoint;
+        FloatSize size;
+        TransformationMatrix transform;
+        TransformationMatrix childrenTransform;
+        Color backgroundColor;
+        Color currentColor;
+        GraphicsLayer::CompositingCoordinatesOrientation geoOrientation;
+        GraphicsLayer::CompositingCoordinatesOrientation contentsOrientation;
+        float opacity;
+        QRect contentsRect;
+
+        bool preserves3D: 1;
+        bool masksToBounds: 1;
+        bool drawsContent: 1;
+        bool contentsOpaque: 1;
+        bool backfaceVisibility: 1;
+        bool distributeOpacity: 1;
+        bool align: 2;
+        State(): maskLayer(0), opacity(1.f), preserves3D(false), masksToBounds(false),
+                  drawsContent(false), contentsOpaque(false), backfaceVisibility(false),
+                  distributeOpacity(false)
+        {
+        }
+    } m_state;
+
+    friend class AnimationQtBase;
+};
+
+GraphicsLayerQtImpl::GraphicsLayerQtImpl(GraphicsLayerQt* newLayer)
+    : QGraphicsObject(0)
+    , m_layer(newLayer)
+    , m_transformAnimationRunning(false)
+    , m_opacityAnimationRunning(false)
+    , m_changeMask(NoChanges)
+{
+    // we use graphics-view for compositing, not for interactivity
+    setAcceptedMouseButtons(Qt::NoButton);
+    // we need to have the item enabled, or else wheel events are not
+    // passed to the parent class implementation of wheelEvent, where
+    // they are ignored and passed to the item below.
+    setEnabled(true);
+
+    // we'll set the cache when we know what's going on
+    setCacheMode(NoCache);
+
+    connect(this, SIGNAL(notifyAnimationStartedAsync()), this, SLOT(notifyAnimationStarted()), Qt::QueuedConnection);
+}
+
+GraphicsLayerQtImpl::~GraphicsLayerQtImpl()
+{
+    // the compositor manages item lifecycle - we don't want the graphics-view
+    // system to automatically delete our items
+
+    const QList<QGraphicsItem*> children = childItems();
+    for (QList<QGraphicsItem*>::const_iterator it = children.begin(); it != children.end(); ++it) {
+        if (QGraphicsItem* item = *it) {
+            if (scene())
+                scene()->removeItem(item);
+            item->setParentItem(0);
+        }
+    }
+    
+    // we do, however, own the animations...
+    for (QList<QWeakPointer<QAbstractAnimation> >::iterator it = m_animations.begin(); it != m_animations.end(); ++it)
+        if (QAbstractAnimation* anim = it->data())
+            delete anim;
+}
+
+void GraphicsLayerQtImpl::adjustCachingRecursively(bool animationIsRunning)
+{
+    // optimization: we make sure all our children have ItemCoordinateCache -
+    // otherwise we end up re-rendering them during the animation
+    const QList<QGraphicsItem*> children = childItems();
+
+    for (QList<QGraphicsItem*>::const_iterator it = children.begin(); it != children.end(); ++it) {
+        if (QGraphicsItem* item = *it)
+            if (GraphicsLayerQtImpl* layer = qobject_cast<GraphicsLayerQtImpl*>(item->toGraphicsObject())) {
+                if (layer->m_layer->drawsContent() && layer->m_currentContent.contentType == HTMLContentType)
+                    layer->setCacheMode(animationIsRunning ? QGraphicsItem::ItemCoordinateCache : QGraphicsItem::DeviceCoordinateCache);
+            }
+    }    
+}
+
+void GraphicsLayerQtImpl::updateTransform()
+{
+    setBaseTransform(isTransformAnimationRunning() ? m_baseTransform : m_layer->transform());
+}
+
+void GraphicsLayerQtImpl::setBaseTransform(const TransformationMatrix& baseTransform)
+{
+    m_baseTransform = baseTransform;
+    setTransform(computeTransform(baseTransform));
+}
+
+QTransform GraphicsLayerQtImpl::computeTransform(const TransformationMatrix& baseTransform) const
+{
+    if (!m_layer)
+        return baseTransform;
+
+    TransformationMatrix computedTransform;
+
+    // The origin for childrenTransform is always the center of the ancestor which contains the childrenTransform.
+    // this has to do with how WebCore implements -webkit-perspective and -webkit-perspective-origin, which are the CSS
+    // attribute that call setChildrenTransform
+    QPointF offset = -pos() - boundingRect().bottomRight() / 2;
+
+    for (const GraphicsLayerQtImpl* ancestor = this; (ancestor = qobject_cast<GraphicsLayerQtImpl*>(ancestor->parentObject())); ) {
+        if (!ancestor->m_state.childrenTransform.isIdentity()) {
+            const QPointF offset = mapFromItem(ancestor, QPointF(ancestor->m_size.width() / 2, ancestor->m_size.height() / 2));
+            computedTransform
+                .translate(offset.x(), offset.y())
+                .multLeft(ancestor->m_state.childrenTransform)
+                .translate(-offset.x(), -offset.y());
+            break;
+        }
+    }
+
+    // webkit has relative-to-size originPoint, graphics-view has a pixel originPoint, here we convert
+    // we have to manage this ourselves because QGraphicsView's transformOrigin is incompatible
+    const qreal originX = m_state.anchorPoint.x() * m_size.width();
+    const qreal originY = m_state.anchorPoint.y() * m_size.height();
+    computedTransform
+            .translate3d(originX, originY, m_state.anchorPoint.z())
+            .multLeft(baseTransform)
+            .translate3d(-originX, -originY, -m_state.anchorPoint.z());
+
+    // now we project to 2D
+    return QTransform(computedTransform);
+}
+
+bool GraphicsLayerQtImpl::isTransformAnimationRunning() const
+{
+    if (m_transformAnimationRunning)
+        return true;
+    if (GraphicsLayerQtImpl* parent = qobject_cast<GraphicsLayerQtImpl*>(parentObject()))
+        return parent->isTransformAnimationRunning();
+    return false;
+}
+
+QPainterPath GraphicsLayerQtImpl::opaqueArea() const
+{
+    QPainterPath painterPath;
+    // we try out best to return the opaque area, maybe it will help graphics-view render less items
+    if (m_currentContent.backgroundColor.isValid() && m_currentContent.backgroundColor.alpha() == 0xff)
+        painterPath.addRect(boundingRect());
+    else {
+        if (m_state.contentsOpaque
+            || (m_currentContent.contentType == ColorContentType && m_currentContent.contentsBackgroundColor.alpha() == 0xff)
+            || (m_currentContent.contentType == MediaContentType)
+            || (m_currentContent.contentType == PixmapContentType && !m_currentContent.pixmap.hasAlpha())) {
+
+            painterPath.addRect(m_state.contentsRect);
+        }
+    }
+    return painterPath;
+}
+
+QRectF GraphicsLayerQtImpl::boundingRect() const
+{
+    return QRectF(QPointF(0, 0), QSizeF(m_size));
+}
+
+void GraphicsLayerQtImpl::paint(QPainter* painter, const QStyleOptionGraphicsItem* option, QWidget* widget)
+{
+    if (m_currentContent.backgroundColor.isValid())
+        painter->fillRect(option->exposedRect, QColor(m_currentContent.backgroundColor));
+
+    switch (m_currentContent.contentType) {
+    case HTMLContentType:
+        if (m_state.drawsContent) {
+            // this is the expensive bit. we try to minimize calls to this area by proper caching
+            GraphicsContext gc(painter);
+            m_layer->paintGraphicsLayerContents(gc, option->exposedRect.toAlignedRect());
+        }
+        break;
+    case PixmapContentType:
+        painter->drawPixmap(m_state.contentsRect, m_currentContent.pixmap);
+        break;
+    case ColorContentType:
+        painter->fillRect(m_state.contentsRect, m_currentContent.contentsBackgroundColor);
+        break;
+    case MediaContentType:
+        // we don't need to paint anything: we have a QGraphicsItem from the media element
+        break;
+    }
+}
+
+void GraphicsLayerQtImpl::notifySyncRequired()
+{
+    if (m_layer->client())
+        m_layer->client()->notifySyncRequired(m_layer);
+}
+
+void GraphicsLayerQtImpl::notifyChange(ChangeMask changeMask)
+{
+    m_changeMask |= changeMask;
+    static QMetaMethod syncMethod = staticMetaObject.method(staticMetaObject.indexOfMethod("notifySyncRequired()"));
+    syncMethod.invoke(this, Qt::QueuedConnection);
+}
+
+void GraphicsLayerQtImpl::flushChanges(bool recursive, bool forceUpdateTransform)
+{
+    // this is the bulk of the work. understanding what the compositor is trying to achieve,
+    // what graphics-view can do, and trying to find a sane common-grounds
+    if (!m_layer || m_changeMask == NoChanges)
+        goto afterLayerChanges;
+
+    if (m_currentContent.contentType == HTMLContentType && (m_changeMask & ParentChange)) {
+        // the WebCore compositor manages item ownership. We have to make sure
+        // graphics-view doesn't try to snatch that ownership...
+        if (!m_layer->parent() && !parentItem())
+            setParentItem(0);
+        else if (m_layer && m_layer->parent() && m_layer->parent()->nativeLayer() != parentItem())
+            setParentItem(m_layer->parent()->nativeLayer());
+    }
+
+    if (m_changeMask & ChildrenChange) {
+        // we basically do an XOR operation on the list of current children
+        // and the list of wanted children, and remove/add
+        QSet<QGraphicsItem*> newChildren;
+        const Vector<GraphicsLayer*> newChildrenVector = (m_layer->children());
+        newChildren.reserve(newChildrenVector.size());
+
+        for (size_t i = 0; i < newChildrenVector.size(); ++i)
+            newChildren.insert(newChildrenVector[i]->platformLayer());
+
+        const QSet<QGraphicsItem*> currentChildren = childItems().toSet();
+        const QSet<QGraphicsItem*> childrenToAdd = newChildren - currentChildren;
+        const QSet<QGraphicsItem*> childrenToRemove = currentChildren - newChildren;
+
+        for (QSet<QGraphicsItem*>::const_iterator it = childrenToAdd.begin(); it != childrenToAdd.end(); ++it)
+             if (QGraphicsItem* w = *it)
+                w->setParentItem(this);
+
+        for (QSet<QGraphicsItem*>::const_iterator it = childrenToRemove.begin(); it != childrenToRemove.end(); ++it)
+             if (GraphicsLayerQtImpl* w = qobject_cast<GraphicsLayerQtImpl*>((*it)->toGraphicsObject()))
+                w->setParentItem(0);
+
+        // children are ordered by z-value, let graphics-view know.
+        for (size_t i = 0; i < newChildrenVector.size(); ++i)
+            if (newChildrenVector[i]->platformLayer())
+                newChildrenVector[i]->platformLayer()->setZValue(i);
+    }
+
+    if (m_changeMask & MaskLayerChange) {
+        // we can't paint here, because we don't know if the mask layer
+        // itself is ready... we'll have to wait till this layer tries to paint
+        setFlag(ItemClipsChildrenToShape, m_layer->maskLayer() || m_layer->masksToBounds());
+        setGraphicsEffect(0);
+        if (m_layer->maskLayer()) {
+            if (GraphicsLayerQtImpl* mask = qobject_cast<GraphicsLayerQtImpl*>(m_layer->maskLayer()->platformLayer()->toGraphicsObject())) {
+                mask->m_maskEffect = new MaskEffectQt(this, mask);
+                mask->setCacheMode(NoCache);
+                setGraphicsEffect(mask->m_maskEffect.data());
+            }
+        }
+    }
+
+    if ((m_changeMask & PositionChange) && (m_layer->position() != m_state.pos))
+        setPos(m_layer->position().x(), m_layer->position().y());
+
+    if (m_changeMask & SizeChange) {
+        if (m_layer->size() != m_state.size) {
+            prepareGeometryChange();
+            m_size = QSizeF(m_layer->size().width(), m_layer->size().height());
+        }
+    }
+    // FIXME: this is a hack, due to a probable QGraphicsScene bug when rapidly modifying the perspective
+    // but without this line we get graphic artifacts
+    if ((m_changeMask & ChildrenTransformChange) && m_state.childrenTransform != m_layer->childrenTransform())
+        scene()->update();
+
+    if (m_changeMask & (ChildrenTransformChange | Preserves3DChange | TransformChange | AnchorPointChange | SizeChange)) {
+        // due to the differences between the way WebCore handles transforms and the way Qt handles transforms,
+        // all these elements affect the transforms of all the descendants.
+        forceUpdateTransform = true;
+    }
+
+    if (m_changeMask & (ContentChange | DrawsContentChange | MaskLayerChange)) {
+        switch (m_pendingContent.contentType) {
+        case PixmapContentType:
+            update();
+            setFlag(ItemHasNoContents, false);
+
+            break;
+        case MediaContentType:
+            setFlag(ItemHasNoContents, true);
+            m_pendingContent.mediaLayer.data()->setParentItem(this);
+            break;
+
+        case ColorContentType:
+            // no point in caching a solid-color rectangle
+            setCacheMode(m_layer->maskLayer() ? QGraphicsItem::DeviceCoordinateCache : QGraphicsItem::NoCache);
+            if (m_pendingContent.contentType != m_currentContent.contentType || m_pendingContent.contentsBackgroundColor != m_currentContent.contentsBackgroundColor)
+                update();
+            m_state.drawsContent = false;
+            setFlag(ItemHasNoContents, false);
+
+            // we only use ItemUsesExtendedStyleOption for HTML content - colors don't gain much from that anyway
+            setFlag(QGraphicsItem::ItemUsesExtendedStyleOption, false);
+            break;
+
+        case HTMLContentType:
+            if (m_pendingContent.contentType != m_currentContent.contentType)
+                update();
+            if (!m_state.drawsContent && m_layer->drawsContent())
+                update();
+                if (m_layer->drawsContent() && !m_maskEffect) {
+                    setCacheMode(isTransformAnimationRunning() ? ItemCoordinateCache : DeviceCoordinateCache);
+
+                    // HTML content: we want to use exposedRect so we don't use WebCore rendering if we don't have to
+                    setFlag(QGraphicsItem::ItemUsesExtendedStyleOption, true);
+                }
+            else
+                setCacheMode(NoCache);
+
+            setFlag(ItemHasNoContents, !m_layer->drawsContent());
+            break;
+        }
+    }
+
+    if ((m_changeMask & OpacityChange) && m_state.opacity != m_layer->opacity() && !m_opacityAnimationRunning)
+        setOpacity(m_layer->opacity());
+
+    if (m_changeMask & ContentsRectChange) {
+        const QRect rect(m_layer->contentsRect());
+        if (m_state.contentsRect != rect) {
+            m_state.contentsRect = rect;
+            update();
+        }
+    }
+
+    if ((m_changeMask & MasksToBoundsChange)
+        && m_state.masksToBounds != m_layer->masksToBounds()) {
+
+        setFlag(QGraphicsItem::ItemClipsToShape, m_layer->masksToBounds());
+        setFlag(QGraphicsItem::ItemClipsChildrenToShape, m_layer->masksToBounds());
+    }
+
+    if ((m_changeMask & ContentsOpaqueChange) && m_state.contentsOpaque != m_layer->contentsOpaque())
+        prepareGeometryChange();
+
+    if (m_maskEffect)
+        m_maskEffect.data()->update();
+    else if (m_changeMask & DisplayChange)
+        update(m_pendingContent.regionToUpdate.boundingRect());
+
+    if ((m_changeMask & BackgroundColorChange) && (m_pendingContent.backgroundColor != m_currentContent.backgroundColor))
+        update();
+
+    // FIXME: the following flags are currently not handled, as they don't have a clear test or are in low priority
+    // GeometryOrientationChange, ContentsOrientationChange, BackfaceVisibilityChange, ChildrenTransformChange, Preserves3DChange
+
+    m_state.maskLayer = m_layer->maskLayer();
+    m_state.pos = m_layer->position();
+    m_state.anchorPoint = m_layer->anchorPoint();
+    m_state.size = m_layer->size();
+    m_state.transform = m_layer->transform();
+    m_state.geoOrientation = m_layer->geometryOrientation();
+    m_state.contentsOrientation =m_layer->contentsOrientation();
+    m_state.opacity = m_layer->opacity();
+    m_state.contentsRect = m_layer->contentsRect();
+    m_state.preserves3D = m_layer->preserves3D();
+    m_state.masksToBounds = m_layer->masksToBounds();
+    m_state.drawsContent = m_layer->drawsContent();
+    m_state.contentsOpaque = m_layer->contentsOpaque();
+    m_state.backfaceVisibility = m_layer->backfaceVisibility();
+    m_state.childrenTransform = m_layer->childrenTransform();
+    m_currentContent.pixmap = m_pendingContent.pixmap;
+    m_currentContent.contentType = m_pendingContent.contentType;
+    m_currentContent.mediaLayer = m_pendingContent.mediaLayer;
+    m_currentContent.backgroundColor = m_pendingContent.backgroundColor;
+    m_currentContent.regionToUpdate |= m_pendingContent.regionToUpdate;
+    m_currentContent.contentsBackgroundColor = m_pendingContent.contentsBackgroundColor;
+    m_pendingContent.regionToUpdate = QRegion();
+    m_changeMask = NoChanges;
+
+
+afterLayerChanges:
+    if (forceUpdateTransform)
+        updateTransform();
+
+    if (!recursive)
+        return;    
+
+    QList<QGraphicsItem*> children = childItems();
+    if (m_state.maskLayer)
+        children.append(m_state.maskLayer->platformLayer());
+
+    for (QList<QGraphicsItem*>::const_iterator it = children.begin(); it != children.end(); ++it) {
+        if (QGraphicsItem* item = *it)
+            if (GraphicsLayerQtImpl* layer = qobject_cast<GraphicsLayerQtImpl*>(item->toGraphicsObject()))
+                layer->flushChanges(true, forceUpdateTransform);
+    }
+}
+
+void GraphicsLayerQtImpl::notifyAnimationStarted()
+{
+    // WebCore notifies javascript when the animation starts
+    // here we're letting it know
+    m_layer->client()->notifyAnimationStarted(m_layer, WTF::currentTime());
+}
+
+GraphicsLayerQt::GraphicsLayerQt(GraphicsLayerClient* client)
+    : GraphicsLayer(client)
+    , m_impl(PassOwnPtr<GraphicsLayerQtImpl>(new GraphicsLayerQtImpl(this)))
+{
+}
+
+GraphicsLayerQt::~GraphicsLayerQt()
+{
+}
+
+// this is the hook for WebCore compositor to know that Qt implements compositing with GraphicsLayerQt
+PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
+{
+    return new GraphicsLayerQt(client);
+}
+
+// reimp from GraphicsLayer.h: Qt is top-down
+GraphicsLayer::CompositingCoordinatesOrientation GraphicsLayer::compositingCoordinatesOrientation()
+{
+    return CompositingCoordinatesTopDown;
+}
+
+// reimp from GraphicsLayer.h: we'll need to update the whole display, and we can't count on the current size because it might change
+void GraphicsLayerQt::setNeedsDisplay()
+{
+    m_impl->m_pendingContent.regionToUpdate = QRegion(QRect(QPoint(0, 0), QSize(size().width(), size().height())));
+    m_impl->notifyChange(GraphicsLayerQtImpl::DisplayChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setNeedsDisplayInRect(const FloatRect& rect)
+{
+    m_impl->m_pendingContent.regionToUpdate|= QRectF(rect).toAlignedRect();
+    m_impl->notifyChange(GraphicsLayerQtImpl::DisplayChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setName(const String& name)
+{
+    m_impl->setObjectName(name);
+    GraphicsLayer::setName(name);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setParent(GraphicsLayer* layer)
+{
+    m_impl->notifyChange(GraphicsLayerQtImpl::ParentChange);
+    GraphicsLayer::setParent(layer);
+}
+
+// reimp from GraphicsLayer.h
+bool GraphicsLayerQt::setChildren(const Vector<GraphicsLayer*>& children)
+{
+    m_impl->notifyChange(GraphicsLayerQtImpl::ChildrenChange);
+    return GraphicsLayer::setChildren(children);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::addChild(GraphicsLayer* layer)
+{
+    m_impl->notifyChange(GraphicsLayerQtImpl::ChildrenChange);
+    GraphicsLayer::addChild(layer);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::addChildAtIndex(GraphicsLayer* layer, int index)
+{
+    GraphicsLayer::addChildAtIndex(layer, index);
+    m_impl->notifyChange(GraphicsLayerQtImpl::ChildrenChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::addChildAbove(GraphicsLayer* layer, GraphicsLayer* sibling)
+{
+     GraphicsLayer::addChildAbove(layer, sibling);
+     m_impl->notifyChange(GraphicsLayerQtImpl::ChildrenChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::addChildBelow(GraphicsLayer* layer, GraphicsLayer* sibling)
+{
+
+    GraphicsLayer::addChildBelow(layer, sibling);
+    m_impl->notifyChange(GraphicsLayerQtImpl::ChildrenChange);
+}
+
+// reimp from GraphicsLayer.h
+bool GraphicsLayerQt::replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild)
+{
+    if (GraphicsLayer::replaceChild(oldChild, newChild)) {
+        m_impl->notifyChange(GraphicsLayerQtImpl::ChildrenChange);
+        return true;
+    }
+
+    return false;
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::removeFromParent()
+{
+    if (parent())
+        m_impl->notifyChange(GraphicsLayerQtImpl::ParentChange);
+    GraphicsLayer::removeFromParent();
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setMaskLayer(GraphicsLayer* value)
+{
+    if (value == maskLayer())
+        return;
+    GraphicsLayer::setMaskLayer(value);
+    m_impl->notifyChange(GraphicsLayerQtImpl::MaskLayerChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setPosition(const FloatPoint& value)
+{
+    if (value == position())
+        return;
+    GraphicsLayer::setPosition(value);
+    m_impl->notifyChange(GraphicsLayerQtImpl::PositionChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setAnchorPoint(const FloatPoint3D& value)
+{
+    if (value == anchorPoint())
+        return;
+    GraphicsLayer::setAnchorPoint(value);
+    m_impl->notifyChange(GraphicsLayerQtImpl::AnchorPointChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setSize(const FloatSize& value)
+{
+    if (value == size())
+        return;
+    GraphicsLayer::setSize(value);
+    m_impl->notifyChange(GraphicsLayerQtImpl::SizeChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setTransform(const TransformationMatrix& value)
+{
+    if (value == transform())
+        return;
+    GraphicsLayer::setTransform(value);
+    m_impl->notifyChange(GraphicsLayerQtImpl::TransformChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setChildrenTransform(const TransformationMatrix& value)
+{
+    if (value == childrenTransform())
+        return;
+    GraphicsLayer::setChildrenTransform(value);
+    m_impl->notifyChange(GraphicsLayerQtImpl::ChildrenTransformChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setPreserves3D(bool value)
+{
+    if (value == preserves3D())
+        return;
+    GraphicsLayer::setPreserves3D(value);
+    m_impl->notifyChange(GraphicsLayerQtImpl::Preserves3DChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setMasksToBounds(bool value)
+{
+    if (value == masksToBounds())
+        return;
+    GraphicsLayer::setMasksToBounds(value);
+    m_impl->notifyChange(GraphicsLayerQtImpl::MasksToBoundsChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setDrawsContent(bool value)
+{
+    if (value == drawsContent())
+        return;
+    m_impl->notifyChange(GraphicsLayerQtImpl::DrawsContentChange);
+    GraphicsLayer::setDrawsContent(value);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setBackgroundColor(const Color& value)
+{
+    if (value == m_impl->m_pendingContent.backgroundColor)
+        return;
+    m_impl->m_pendingContent.backgroundColor = value;
+    GraphicsLayer::setBackgroundColor(value);
+    m_impl->notifyChange(GraphicsLayerQtImpl::BackgroundColorChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::clearBackgroundColor()
+{
+    if (!m_impl->m_pendingContent.backgroundColor.isValid())
+        return;
+    m_impl->m_pendingContent.backgroundColor = QColor();
+    GraphicsLayer::clearBackgroundColor();
+    m_impl->notifyChange(GraphicsLayerQtImpl::BackgroundColorChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setContentsOpaque(bool value)
+{
+    if (value == contentsOpaque())
+        return;
+    m_impl->notifyChange(GraphicsLayerQtImpl::ContentsOpaqueChange);
+    GraphicsLayer::setContentsOpaque(value);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setBackfaceVisibility(bool value)
+{
+    if (value == backfaceVisibility())
+        return;
+    GraphicsLayer::setBackfaceVisibility(value);
+    m_impl->notifyChange(GraphicsLayerQtImpl::BackfaceVisibilityChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setOpacity(float value)
+{
+    if (value == opacity())
+        return;
+    GraphicsLayer::setOpacity(value);
+    m_impl->notifyChange(GraphicsLayerQtImpl::OpacityChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setContentsRect(const IntRect& value)
+{
+    if (value == contentsRect())
+        return;
+    GraphicsLayer::setContentsRect(value);
+    m_impl->notifyChange(GraphicsLayerQtImpl::ContentsRectChange);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setContentsToImage(Image* image)
+{
+    m_impl->notifyChange(GraphicsLayerQtImpl::ContentChange);
+    m_impl->m_pendingContent.contentType = GraphicsLayerQtImpl::HTMLContentType;
+    GraphicsLayer::setContentsToImage(image);
+    if (image) {
+        QPixmap* pxm = image->nativeImageForCurrentFrame();
+        if (pxm) {
+            m_impl->m_pendingContent.pixmap = *pxm;
+            m_impl->m_pendingContent.contentType = GraphicsLayerQtImpl::PixmapContentType;
+            return;
+        }        
+    }
+    m_impl->m_pendingContent.pixmap = QPixmap();
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setContentsBackgroundColor(const Color& color)
+{
+    m_impl->notifyChange(GraphicsLayerQtImpl::ContentChange);
+    m_impl->m_pendingContent.contentType = GraphicsLayerQtImpl::ColorContentType;
+    m_impl->m_pendingContent.contentsBackgroundColor = QColor(color);
+    GraphicsLayer::setContentsBackgroundColor(color);
+}
+
+void GraphicsLayerQt::setContentsToMedia(PlatformLayer* media)
+{
+    if (media) {
+        m_impl->m_pendingContent.contentType = GraphicsLayerQtImpl::MediaContentType;
+        m_impl->m_pendingContent.mediaLayer = media->toGraphicsObject();
+    } else
+        m_impl->m_pendingContent.contentType = GraphicsLayerQtImpl::HTMLContentType;
+
+    m_impl->notifyChange(GraphicsLayerQtImpl::ContentChange);
+    GraphicsLayer::setContentsToMedia(media);
+}
+
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setGeometryOrientation(CompositingCoordinatesOrientation orientation)
+{
+    m_impl->notifyChange(GraphicsLayerQtImpl::GeometryOrientationChange);
+    GraphicsLayer::setGeometryOrientation(orientation);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::setContentsOrientation(CompositingCoordinatesOrientation orientation)
+{
+    m_impl->notifyChange(GraphicsLayerQtImpl::ContentsOrientationChange);
+    GraphicsLayer::setContentsOrientation(orientation);
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::distributeOpacity(float o)
+{
+    m_impl->notifyChange(GraphicsLayerQtImpl::OpacityChange);
+    m_impl->m_state.distributeOpacity = true;
+}
+
+// reimp from GraphicsLayer.h
+float GraphicsLayerQt::accumulatedOpacity() const
+{
+    return m_impl->effectiveOpacity();
+}
+
+// reimp from GraphicsLayer.h
+void GraphicsLayerQt::syncCompositingState()
+{
+    m_impl->flushChanges();
+    GraphicsLayer::syncCompositingState();
+}
+
+// reimp from GraphicsLayer.h
+NativeLayer GraphicsLayerQt::nativeLayer() const
+{
+    return m_impl.get();
+}
+
+// reimp from GraphicsLayer.h
+PlatformLayer* GraphicsLayerQt::platformLayer() const
+{
+    return m_impl.get();
+}
+
+// now we start dealing with WebCore animations translated to Qt animations
+
+template <typename T>
+struct KeyframeValueQt {
+    TimingFunction timingFunction;
+    T value;
+};
+
+// we copy this from the AnimationBase.cpp
+static inline double solveEpsilon(double duration)
+{
+    return 1.0 / (200.0 * duration);
+}
+
+static inline double solveCubicBezierFunction(qreal p1x, qreal p1y, qreal p2x, qreal p2y, double t, double duration)
+{
+    UnitBezier bezier(p1x, p1y, p2x, p2y);
+    return bezier.solve(t, solveEpsilon(duration));
+}
+
+// we want the timing function to be as close as possible to what the web-developer intended, so we're using the same function used by WebCore when compositing is disabled
+// Using easing-curves would probably work for some of the cases, but wouldn't really buy us anything as we'd have to convert the bezier function back to an easing curve
+static inline qreal applyTimingFunction(const TimingFunction& timingFunction, qreal progress, double duration)
+{
+    if (timingFunction.type() == LinearTimingFunction)
+        return progress;
+    if (timingFunction.type() == CubicBezierTimingFunction) {
+        return solveCubicBezierFunction(timingFunction.x1(),
+                                        timingFunction.y1(),
+                                        timingFunction.x2(),
+                                        timingFunction.y2(),
+                                        double(progress), double(duration) / 1000);
+    }
+    return progress;
+}
+
+// helper functions to safely get a value out of WebCore's AnimationValue*
+static void webkitAnimationToQtAnimationValue(const AnimationValue* animationValue, TransformOperations& transformOperations)
+{
+    transformOperations = TransformOperations();
+    if (!animationValue)
+        return;
+
+    if (const TransformOperations* ops = static_cast<const TransformAnimationValue*>(animationValue)->value())
+        transformOperations = *ops;
+}
+
+static void webkitAnimationToQtAnimationValue(const AnimationValue* animationValue, qreal& realValue)
+{
+    realValue = animationValue ? static_cast<const FloatAnimationValue*>(animationValue)->value() : 0;
+}
+
+// we put a bit of the functionality in a base class to allow casting and to save some code size
+class AnimationQtBase : public QAbstractAnimation {
+public:
+    AnimationQtBase(GraphicsLayerQtImpl* layer, const KeyframeValueList& values, const IntSize& boxSize, const Animation* anim, const QString & name)
+        : QAbstractAnimation(0)
+        , m_layer(layer)
+        , m_boxSize(boxSize)
+        , m_duration(anim->duration() * 1000)
+        , m_isAlternate(anim->direction() == Animation::AnimationDirectionAlternate)
+        , m_webkitPropertyID(values.property())
+        , m_webkitAnimation(anim)
+        , m_keyframesName(name)
+    {
+    }
+
+    virtual void updateState(QAbstractAnimation::State newState, QAbstractAnimation::State oldState)
+    {
+        QAbstractAnimation::updateState(newState, oldState);
+
+        // for some reason I have do this asynchronously - or the animation won't work
+        if (newState == Running && oldState == Stopped && m_layer.data())
+            m_layer.data()->notifyAnimationStartedAsync();
+    }
+
+    virtual int duration() const { return m_duration; }
+
+    QWeakPointer<GraphicsLayerQtImpl> m_layer;
+    IntSize m_boxSize;
+    int m_duration;
+    bool m_isAlternate;
+    AnimatedPropertyID m_webkitPropertyID;
+
+    // we might need this in case the same animation is added again (i.e. resumed by WebCore)
+    const Animation* m_webkitAnimation;
+    QString m_keyframesName;
+};
+
+// we'd rather have a templatized QAbstractAnimation than QPropertyAnimation / QVariantAnimation;
+// Since we know the types that we're dealing with, the QObject/QProperty/QVariant abstraction
+// buys us very little in this case, for too much overhead
+template <typename T>
+class AnimationQt : public AnimationQtBase {
+
+public:
+    AnimationQt(GraphicsLayerQtImpl* layer, const KeyframeValueList& values, const IntSize& boxSize, const Animation* anim, const QString & name)
+        :AnimationQtBase(layer, values, boxSize, anim, name)
+    {
+        // copying those WebCore structures is not trivial, we have to do it like this
+        for (size_t i = 0; i < values.size(); ++i) {
+            const AnimationValue* animationValue = values.at(i);
+            KeyframeValueQt<T> keyframeValue;
+            if (animationValue->timingFunction())
+                keyframeValue.timingFunction = *animationValue->timingFunction();
+            else
+                keyframeValue.timingFunction = anim->timingFunction();
+            webkitAnimationToQtAnimationValue(animationValue, keyframeValue.value);
+            m_keyframeValues[animationValue->keyTime()] = keyframeValue;
+        }
+    }
+
+protected:
+
+    // this is the part that differs between animated properties
+    virtual void applyFrame(const T& fromValue, const T& toValue, qreal progress) = 0;
+
+    virtual void updateCurrentTime(int currentTime)
+    {
+        if (!m_layer)
+            return;
+
+        qreal progress = qreal(currentLoopTime()) / duration();
+
+        if (m_isAlternate && currentLoop()%2)
+            progress = 1-progress;
+
+        if (m_keyframeValues.isEmpty())
+            return;
+
+        // we find the current from-to keyframes in our little map
+        typename QMap<qreal, KeyframeValueQt<T> >::iterator it = m_keyframeValues.find(progress);
+
+        // we didn't find an exact match, we try the closest match (lower bound)
+        if (it == m_keyframeValues.end())
+            it = m_keyframeValues.lowerBound(progress)-1;
+
+        // we didn't find any match - we use the first keyframe
+        if (it == m_keyframeValues.end())
+            it = m_keyframeValues.begin();
+
+        typename QMap<qreal, KeyframeValueQt<T> >::iterator it2 = it+1;
+        if (it2 == m_keyframeValues.end())
+            it2 = it;
+        const KeyframeValueQt<T>& fromKeyframe = it.value();
+        const KeyframeValueQt<T>& toKeyframe = it2.value();
+
+        const TimingFunction& timingFunc = fromKeyframe.timingFunction;
+        const T& fromValue = fromKeyframe.value;
+        const T& toValue = toKeyframe.value;
+
+        // now we have a source keyframe, origin keyframe and a timing function
+        // we can now process the progress and apply the frame
+        progress = (!progress || progress == 1 || it.key() == it2.key())
+                                         ? progress
+                                         : applyTimingFunction(timingFunc, (progress - it.key()) / (it2.key() - it.key()), duration());
+        applyFrame(fromValue, toValue, progress);
+    }
+
+    QMap<qreal, KeyframeValueQt<T> > m_keyframeValues;
+};
+
+class TransformAnimationQt : public AnimationQt<TransformOperations> {
+public:
+    TransformAnimationQt(GraphicsLayerQtImpl* layer, const KeyframeValueList& values, const IntSize& boxSize, const Animation* anim, const QString & name)
+        : AnimationQt<TransformOperations>(layer, values, boxSize, anim, name)
+    {
+    }
+
+    ~TransformAnimationQt()
+    {
+        // this came up during the compositing/animation LayoutTests
+        // when the animation dies, the transform has to go back to default
+        if (m_layer)
+            m_layer.data()->updateTransform();
+    }
+
+    // the idea is that we let WebCore manage the transform-operations
+    // and Qt just manages the animation heartbeat and the bottom-line QTransform
+    // we get the performance not by using QTransform instead of TransformationMatrix, but by proper caching of
+    // items that are expensive for WebCore to render. We want the rest to be as close to WebCore's idea as possible.
+    virtual void applyFrame(const TransformOperations& sourceOperations, const TransformOperations& targetOperations, qreal progress)
+    {
+        TransformationMatrix transformMatrix;
+
+        // sometimes the animation values from WebCore are misleading and we have to use the actual matrix as source
+        // The Mac implementation simply doesn't try to accelerate those (e.g. 360deg rotation), but we do.
+        if (progress == 1 || !targetOperations.size() || sourceOperations == targetOperations) {
+            TransformationMatrix sourceMatrix;
+            sourceOperations.apply(m_boxSize, sourceMatrix);
+            transformMatrix = m_sourceMatrix;
+            transformMatrix.blend(sourceMatrix, 1 - progress);
+        } else {
+            bool validTransformLists = true;
+            const int sourceOperationCount = sourceOperations.size();
+            if (sourceOperationCount) {
+                if (targetOperations.size() != sourceOperationCount)
+                    validTransformLists = false;
+                else
+                    for (size_t j = 0; j < sourceOperationCount && validTransformLists; ++j)
+                        if (!sourceOperations.operations()[j]->isSameType(*targetOperations.operations()[j]))
+                            validTransformLists = false;
+            }
+
+            if (validTransformLists) {
+                for (size_t i = 0; i < targetOperations.size(); ++i)
+                    targetOperations.operations()[i]->blend(sourceOperations.at(i), progress)->apply(transformMatrix, m_boxSize);
+            } else {
+                targetOperations.apply(m_boxSize, transformMatrix);
+                transformMatrix.blend(m_sourceMatrix, progress);
+            }
+        }
+        m_layer.data()->setBaseTransform(transformMatrix);
+    }
+
+    virtual void updateState(QAbstractAnimation::State newState, QAbstractAnimation::State oldState)
+    {
+        AnimationQtBase::updateState(newState, oldState);
+        if (!m_layer)
+            return;
+        m_layer.data()->flushChanges(true);
+
+        // to increase FPS, we use a less accurate caching mechanism while animation is going on
+        // this is a UX choice that should probably be customizable
+        if (newState == QAbstractAnimation::Running) {
+            m_sourceMatrix = m_layer.data()->m_layer->transform();
+            m_layer.data()->m_transformAnimationRunning = true;
+            m_layer.data()->adjustCachingRecursively(true);
+        } else if (newState == QAbstractAnimation::Stopped) {
+            m_layer.data()->m_transformAnimationRunning = false;
+            m_layer.data()->adjustCachingRecursively(false);
+        }
+    }
+
+    TransformationMatrix m_sourceMatrix;
+};
+
+class OpacityAnimationQt : public AnimationQt<qreal> {
+public:
+    OpacityAnimationQt(GraphicsLayerQtImpl* layer, const KeyframeValueList& values, const IntSize& boxSize, const Animation* anim, const QString & name)
+         : AnimationQt<qreal>(layer, values, boxSize, anim, name)
+    {
+    }
+
+    virtual void applyFrame(const qreal& fromValue, const qreal& toValue, qreal progress)
+    {
+        qreal opacity = qBound(qreal(0), fromValue + (toValue-fromValue)*progress, qreal(1));
+
+        // FIXME: this is a hack, due to a probable QGraphicsScene bug.
+        // Without this the opacity change doesn't always have immediate effect.
+        if (!m_layer.data()->opacity() && opacity)
+            m_layer.data()->scene()->update();
+
+        m_layer.data()->setOpacity(opacity);
+    }
+
+    virtual void updateState(QAbstractAnimation::State newState, QAbstractAnimation::State oldState)
+    {
+        QAbstractAnimation::updateState(newState, oldState);
+
+        if (m_layer)
+            m_layer.data()->m_opacityAnimationRunning = (newState == QAbstractAnimation::Running);
+    }
+};
+
+bool GraphicsLayerQt::addAnimation(const KeyframeValueList& values, const IntSize& boxSize, const Animation* anim, const String& keyframesName, double timeOffset)
+{
+    if (!anim->duration() || !anim->iterationCount())
+        return false;
+
+    QAbstractAnimation* newAnim = 0;
+
+    // fixed: we might already have the Qt animation object associated with this WebCore::Animation object
+    for (QList<QWeakPointer<QAbstractAnimation> >::iterator it = m_impl->m_animations.begin(); it != m_impl->m_animations.end(); ++it) {
+        if (*it) {
+            AnimationQtBase* curAnimation = static_cast<AnimationQtBase*>(it->data());
+            if (curAnimation && curAnimation->m_webkitAnimation == anim)
+                newAnim = curAnimation;
+        }
+    }
+
+    if (!newAnim) {
+        switch (values.property()) {
+        case AnimatedPropertyOpacity:
+            newAnim = new OpacityAnimationQt(m_impl.get(), values, boxSize, anim, keyframesName);
+            break;
+        case AnimatedPropertyWebkitTransform:
+            newAnim = new TransformAnimationQt(m_impl.get(), values, boxSize, anim, keyframesName);
+            break;
+        default:
+            return false;
+        }
+
+        // we make sure WebCore::Animation and QAnimation are on the same terms
+        newAnim->setLoopCount(anim->iterationCount());
+        m_impl->m_animations.append(QWeakPointer<QAbstractAnimation>(newAnim));
+        QObject::connect(&m_impl->m_suspendTimer, SIGNAL(timeout()), newAnim, SLOT(resume()));
+    }
+
+    // flush now or flicker...
+    m_impl->flushChanges(false);
+
+    if (anim->delay())
+        QTimer::singleShot(anim->delay() * 1000, newAnim, SLOT(start()));
+    else
+        newAnim->start();
+
+    // we synchronize the animation's clock to WebCore's timeOffset
+    newAnim->setCurrentTime(timeOffset * 1000);
+
+    // we don't need to manage the animation object's lifecycle:
+    // WebCore would call removeAnimations when it's time to delete.
+
+    return true;
+}
+
+void GraphicsLayerQt::removeAnimationsForProperty(AnimatedPropertyID id)
+{
+    for (QList<QWeakPointer<QAbstractAnimation> >::iterator it = m_impl->m_animations.begin(); it != m_impl->m_animations.end(); ++it) {
+        if (*it) {
+            AnimationQtBase* anim = static_cast<AnimationQtBase*>(it->data());
+            if (anim && anim->m_webkitPropertyID == id) {
+                anim->deleteLater();
+                it = m_impl->m_animations.erase(it);
+                --it;
+            }
+        }
+    }
+}
+
+void GraphicsLayerQt::removeAnimationsForKeyframes(const String& name)
+{
+    for (QList<QWeakPointer<QAbstractAnimation> >::iterator it = m_impl->m_animations.begin(); it != m_impl->m_animations.end(); ++it) {
+        if (*it) {
+            AnimationQtBase* anim = static_cast<AnimationQtBase*>((*it).data());
+            if (anim && anim->m_keyframesName == QString(name)) {
+                (*it).data()->deleteLater();
+                it = m_impl->m_animations.erase(it);
+                --it;
+            }
+        }
+    }
+}
+
+void GraphicsLayerQt::pauseAnimation(const String& name, double timeOffset)
+{
+    for (QList<QWeakPointer<QAbstractAnimation> >::iterator it = m_impl->m_animations.begin(); it != m_impl->m_animations.end(); ++it) {
+        if (!(*it))
+            continue;
+
+        AnimationQtBase* anim = static_cast<AnimationQtBase*>((*it).data());
+        if (anim && anim->m_keyframesName == QString(name)) {
+            // we synchronize the animation's clock to WebCore's timeOffset
+            anim->setCurrentTime(timeOffset * 1000);
+            anim->pause();
+        }
+    }
+}
+
+void GraphicsLayerQt::suspendAnimations(double time)
+{
+    if (m_impl->m_suspendTimer.isActive()) {
+        m_impl->m_suspendTimer.stop();
+        m_impl->m_suspendTimer.start(time * 1000);
+    } else {
+        for (QList<QWeakPointer<QAbstractAnimation> >::iterator it = m_impl->m_animations.begin(); it != m_impl->m_animations.end(); ++it) {
+            QAbstractAnimation* anim = it->data();
+            if (anim)
+                anim->pause();
+        }
+    }
+}
+
+void GraphicsLayerQt::resumeAnimations()
+{
+    if (m_impl->m_suspendTimer.isActive()) {
+        m_impl->m_suspendTimer.stop();
+        for (QList<QWeakPointer<QAbstractAnimation> >::iterator it = m_impl->m_animations.begin(); it != m_impl->m_animations.end(); ++it) {
+            QAbstractAnimation* anim = (*it).data();
+            if (anim)
+                anim->resume();
+        }
+    }
+}
+
+}
+
+#include <GraphicsLayerQt.moc>
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsLayerQt.h b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsLayerQt.h
new file mode 100644
index 0000000000..4132d7d7db
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsLayerQt.h
@@ -0,0 +1,86 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef GraphicsLayerQt_h
+#define GraphicsLayerQt_h
+
+#include "GraphicsLayer.h"
+#include "GraphicsLayerClient.h"
+
+namespace WebCore {
+
+class GraphicsLayerQtImpl;
+
+class GraphicsLayerQt : public GraphicsLayer {
+    friend class GraphicsLayerQtImpl;
+
+public:
+    GraphicsLayerQt(GraphicsLayerClient*);
+    virtual ~GraphicsLayerQt();
+
+    // reimps from GraphicsLayer.h
+    virtual NativeLayer nativeLayer() const;
+    virtual PlatformLayer* platformLayer() const;
+    virtual void setNeedsDisplay();
+    virtual void setNeedsDisplayInRect(const FloatRect&);
+    virtual void setParent(GraphicsLayer* layer);
+    virtual void setName(const String& name);
+    virtual bool setChildren(const Vector<GraphicsLayer*>&);
+    virtual void addChild(GraphicsLayer*);
+    virtual void addChildAtIndex(GraphicsLayer*, int index);
+    virtual void addChildAbove(GraphicsLayer* layer, GraphicsLayer* sibling);
+    virtual void addChildBelow(GraphicsLayer* layer, GraphicsLayer* sibling);
+    virtual bool replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild);
+    virtual void removeFromParent();
+    virtual void setMaskLayer(GraphicsLayer* layer);
+    virtual void setPosition(const FloatPoint& p);
+    virtual void setAnchorPoint(const FloatPoint3D& p);
+    virtual void setSize(const FloatSize& size);
+    virtual void setTransform(const TransformationMatrix& t);
+    virtual void setChildrenTransform(const TransformationMatrix& t);
+    virtual void setPreserves3D(bool b);
+    virtual void setMasksToBounds(bool b);
+    virtual void setDrawsContent(bool b);
+    virtual void setBackgroundColor(const Color&);
+    virtual void clearBackgroundColor();
+    virtual void setContentsOpaque(bool b);
+    virtual void setBackfaceVisibility(bool b);
+    virtual void setOpacity(float opacity);
+    virtual void setContentsRect(const IntRect& r);
+    virtual bool addAnimation(const KeyframeValueList&, const IntSize& boxSize, const Animation*, const String& keyframesName, double timeOffset);
+    virtual void removeAnimationsForProperty(AnimatedPropertyID);
+    virtual void removeAnimationsForKeyframes(const String& keyframesName);
+    virtual void pauseAnimation(const String& keyframesName, double timeOffset);
+    virtual void suspendAnimations(double time);
+    virtual void resumeAnimations();
+    virtual void setContentsToImage(Image*);
+    virtual void setContentsToMedia(PlatformLayer*);
+    virtual void setContentsBackgroundColor(const Color&);
+    virtual void setGeometryOrientation(CompositingCoordinatesOrientation orientation);
+    virtual void setContentsOrientation(CompositingCoordinatesOrientation orientation);
+    virtual void distributeOpacity(float);
+    virtual float accumulatedOpacity() const;
+    virtual void syncCompositingState();
+
+private:
+    OwnPtr<GraphicsLayerQtImpl> m_impl;
+};
+
+}
+#endif // GraphicsLayerQt_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/IconQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/IconQt.cpp
index 98f4606d16..eb09eda6b6 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/IconQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/IconQt.cpp
@@ -40,15 +40,18 @@ Icon::~Icon()
 {
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
+// FIXME: Move the code to ChromeClient::iconForFiles().
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 {
-    RefPtr<Icon> i = adoptRef(new Icon);
-    i->m_icon = QIcon(filename);
-    return i.release();
-}
+    if (filenames.isEmpty())
+        return 0;
+
+    if (filenames.size() == 1) {
+        RefPtr<Icon> i = adoptRef(new Icon);
+        i->m_icon = QIcon(filenames[0]);
+        return i.release();
+    }
 
-PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
-{
     //FIXME: Implement this
     return 0;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageBufferQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageBufferQt.cpp
index 5255428a38..d8315660a2 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageBufferQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageBufferQt.cpp
@@ -114,7 +114,7 @@ void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
             value = qRgba(lookUpTable[qRed(value)],
                           lookUpTable[qGreen(value)],
                           lookUpTable[qBlue(value)],
-                          lookUpTable[qAlpha(value)]);
+                          qAlpha(value));
             image.setPixel(x, y, value);
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
index 9bcb3e9eb2..b10cc714f5 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
@@ -47,21 +47,17 @@ ImageDecoder* ImageDecoder::create(const SharedBuffer& data)
 }
 
 ImageDecoderQt::ImageDecoderQt()
-    :  m_buffer(0)
-    , m_reader(0)
-    , m_repetitionCount(cAnimationNone)
+    : m_repetitionCount(cAnimationNone)
 {
 }
 
 ImageDecoderQt::~ImageDecoderQt()
 {
-    delete m_reader;
-    delete m_buffer;
 }
 
 void ImageDecoderQt::setData(SharedBuffer* data, bool allDataReceived)
 {
-    if (m_failed)
+    if (failed())
         return;
 
     // No progressive loading possible
@@ -77,10 +73,16 @@ void ImageDecoderQt::setData(SharedBuffer* data, bool allDataReceived)
 
     // Attempt to load the data
     QByteArray imageData = QByteArray::fromRawData(m_data->data(), m_data->size());
-    m_buffer = new QBuffer;
+    m_buffer.set(new QBuffer);
     m_buffer->setData(imageData);
-    m_buffer->open(QBuffer::ReadOnly | QIODevice::Unbuffered);
-    m_reader = new QImageReader(m_buffer, m_format);
+    m_buffer->open(QIODevice::ReadOnly | QIODevice::Unbuffered);
+    m_reader.set(new QImageReader(m_buffer.get(), m_format));
+
+    // This will force the JPEG decoder to use JDCT_IFAST
+    m_reader->setQuality(49);
+
+    // QImageReader only allows retrieving the format before reading the image
+    m_format = m_reader->format();
 }
 
 bool ImageDecoderQt::isSizeAvailable()
@@ -100,13 +102,12 @@ size_t ImageDecoderQt::frameCount()
             // Fixup for Qt decoders... imageCount() is wrong
             // and jumpToNextImage does not work either... so
             // we will have to parse everything...
-            if (imageCount == 0)
+            if (!imageCount)
                 forceLoadEverything();
             else
                 m_frameBufferCache.resize(imageCount);
-        } else {
+        } else
             m_frameBufferCache.resize(1);
-        }
     }
 
     return m_frameBufferCache.size();
@@ -114,8 +115,21 @@ size_t ImageDecoderQt::frameCount()
 
 int ImageDecoderQt::repetitionCount() const
 {
-    if (m_reader && m_reader->supportsAnimation())
-        m_repetitionCount = qMax(0, m_reader->loopCount());
+    if (m_reader && m_reader->supportsAnimation()) {
+        m_repetitionCount = m_reader->loopCount();
+
+        // Qt and WebCore have a incompatible understanding of
+        // the loop count and we can not completely map everything.
+        //  Qt   |   WebCore          | description
+        //  -1   |     0              | infinite animation
+        //   0   | cAnimationLoopOnce | show every frame once
+        //   n   |     n              | no idea if that is supported
+        //  n/a  | cAnimationNone     | show only the first frame
+        if (m_repetitionCount == -1)
+            m_repetitionCount = 0;
+        else if (m_repetitionCount == 0)
+            m_repetitionCount = cAnimationLoopOnce;
+    }
 
     return m_repetitionCount;
 }
@@ -130,13 +144,13 @@ RGBA32Buffer* ImageDecoderQt::frameBufferAtIndex(size_t index)
     // In case the ImageDecoderQt got recreated we don't know
     // yet how many images we are going to have and need to
     // find that out now.
-    int count = m_frameBufferCache.size();
-    if (!m_failed && count == 0) {
+    size_t count = m_frameBufferCache.size();
+    if (!failed() && !count) {
         internalDecodeSize();
         count = frameCount();
     }
 
-    if (index >= static_cast<size_t>(count))
+    if (index >= count)
         return 0;
 
     RGBA32Buffer& frame = m_frameBufferCache[index];
@@ -155,10 +169,11 @@ void ImageDecoderQt::internalDecodeSize()
 
     // If we have a QSize() something failed
     QSize size = m_reader->size();
-    if (size.isEmpty())
-        return failRead();
+    if (size.isEmpty()) {
+        setFailed();
+        return clearPointers();
+    }
 
-    m_format = m_reader->format();
     setSize(size.width(), size.height());
 }
 
@@ -168,28 +183,31 @@ void ImageDecoderQt::internalReadImage(size_t frameIndex)
 
     if (m_reader->supportsAnimation())
         m_reader->jumpToImage(frameIndex);
-    else if (frameIndex != 0)
-        return failRead();
+    else if (frameIndex) {
+        setFailed();
+        return clearPointers();
+    }
 
-    internalHandleCurrentImage(frameIndex);
+    if (!internalHandleCurrentImage(frameIndex))
+      setFailed();
 
     // Attempt to return some memory
-    for (int i = 0; i < m_frameBufferCache.size(); ++i)
+    for (int i = 0; i < m_frameBufferCache.size(); ++i) {
         if (m_frameBufferCache[i].status() != RGBA32Buffer::FrameComplete)
             return;
+    }
 
-    delete m_reader;
-    delete m_buffer;
-    m_buffer = 0;
-    m_reader = 0;
+    clearPointers();
 }
 
-void ImageDecoderQt::internalHandleCurrentImage(size_t frameIndex)
+bool ImageDecoderQt::internalHandleCurrentImage(size_t frameIndex)
 {
     // Now get the QImage from Qt and place it in the RGBA32Buffer
     QImage img;
-    if (!m_reader->read(&img))
-        return failRead();
+    if (!m_reader->read(&img)) {
+        clearPointers();
+        return false;
+    }
 
     // now into the RGBA32Buffer - even if the image is not
     QSize imageSize = img.size();
@@ -198,6 +216,7 @@ void ImageDecoderQt::internalHandleCurrentImage(size_t frameIndex)
     buffer->setStatus(RGBA32Buffer::FrameComplete);
     buffer->setDuration(m_reader->nextImageDelay());
     buffer->setDecodedImage(img);
+    return true;
 }
 
 // The QImageIOHandler is not able to tell us how many frames
@@ -205,8 +224,8 @@ void ImageDecoderQt::internalHandleCurrentImage(size_t frameIndex)
 // increasing the m_frameBufferCache by one and try to parse
 // the image. We stop when QImage::read fails and then need
 // to resize the m_frameBufferCache to the final size and update
-// the m_failed. In case we failed to decode the first image
-// we want to keep m_failed set to true.
+// the failed bit. If we failed to decode the first image
+// then we truly failed to decode, otherwise we're OK.
 
 // TODO: Do not increment the m_frameBufferCache.size() by one but more than one
 void ImageDecoderQt::forceLoadEverything()
@@ -215,24 +234,21 @@ void ImageDecoderQt::forceLoadEverything()
 
     do {
         m_frameBufferCache.resize(++imageCount);
-        internalHandleCurrentImage(imageCount - 1);
-    } while(!m_failed);
+    } while (internalHandleCurrentImage(imageCount - 1));
 
     // If we failed decoding the first image we actually
-    // have no images and need to keep m_failed set to
-    // true otherwise we want to reset it and forget about
+    // have no images and need to set the failed bit.
+    // Otherwise, we want to forget about
     // the last attempt to decode a image.
     m_frameBufferCache.resize(imageCount - 1);
-    m_failed = imageCount == 1;
+    if (imageCount == 1)
+      setFailed();
 }
 
-void ImageDecoderQt::failRead()
+void ImageDecoderQt::clearPointers()
 {
-    setFailed();
-    delete m_reader;
-    delete m_buffer;
-    m_reader = 0;
-    m_buffer = 0;
+    m_reader.clear();
+    m_buffer.clear();
 }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h
index d11b938497..ceef884124 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h
@@ -33,6 +33,7 @@
 #include <QtCore/QList>
 #include <QtCore/QHash>
 #include <QtCore/QBuffer>
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
@@ -60,14 +61,14 @@ private:
 private:
     void internalDecodeSize();
     void internalReadImage(size_t);
-    void internalHandleCurrentImage(size_t);
+    bool internalHandleCurrentImage(size_t);
     void forceLoadEverything();
-    void failRead();
+    void clearPointers();
 
 private:
     QByteArray m_format;
-    QBuffer* m_buffer;
-    QImageReader* m_reader;
+    OwnPtr<QBuffer> m_buffer;
+    OwnPtr<QImageReader> m_reader;
     mutable int m_repetitionCount;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp
index b671107509..db12738b98 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -31,12 +31,12 @@
 #include "config.h"
 #include "Image.h"
 
+#include "AffineTransform.h"
 #include "ImageObserver.h"
 #include "BitmapImage.h"
 #include "FloatRect.h"
 #include "PlatformString.h"
 #include "GraphicsContext.h"
-#include "TransformationMatrix.h"
 #include "StillImageQt.h"
 #include "qwebsettings.h"
 
@@ -44,9 +44,7 @@
 #include <QPainter>
 #include <QImage>
 #include <QImageReader>
-#if QT_VERSION >= 0x040300
 #include <QTransform>
-#endif
 
 #include <QDebug>
 
@@ -64,6 +62,8 @@ static QPixmap loadResourcePixmap(const char *name)
         pixmap = QWebSettings::webGraphic(QWebSettings::DefaultFrameIconGraphic);
     else if (qstrcmp(name, "textAreaResizeCorner") == 0)
         pixmap = QWebSettings::webGraphic(QWebSettings::TextAreaSizeGripCornerGraphic);
+    else if (qstrcmp(name, "deleteButton") == 0)
+        pixmap = QWebSettings::webGraphic(QWebSettings::DeleteButtonGraphic);
 
     return pixmap;
 }
@@ -93,8 +93,8 @@ PassRefPtr<Image> Image::loadPlatformResource(const char* name)
     return StillImage::create(loadResourcePixmap(name));
 }
 
-void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const TransformationMatrix& patternTransform,
-                        const FloatPoint& phase, CompositeOperator op, const FloatRect& destRect)
+void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const AffineTransform& patternTransform,
+                        const FloatPoint& phase, ColorSpace, CompositeOperator op, const FloatRect& destRect)
 {
     QPixmap* framePixmap = nativeImageForCurrentFrame();
     if (!framePixmap) // If it's too early we won't have an image yet.
@@ -162,7 +162,7 @@ void BitmapImage::invalidatePlatformData()
 
 // Drawing Routines
 void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst,
-                       const FloatRect& src, CompositeOperator op)
+                       const FloatRect& src, ColorSpace styleColorSpace, CompositeOperator op)
 {
     startAnimation();
 
@@ -171,7 +171,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst,
         return;
 
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, dst, solidColor(), op);
+        fillWithSolidColor(ctxt, dst, solidColor(), styleColorSpace, op);
         return;
     }
 
@@ -213,7 +213,7 @@ void BitmapImage::checkForSolidColor()
     m_solidColor = QColor::fromRgba(framePixmap->toImage().pixel(0, 0));
 }
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 PassRefPtr<BitmapImage> BitmapImage::create(HBITMAP hBitmap)
 {
     return BitmapImage::create(new QPixmap(QPixmap::fromWinHBITMAP(hBitmap)));
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
index 7a78391ab9..88c7a1c274 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
@@ -26,20 +26,22 @@
 #include "CString.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
+#include "MIMETypeRegistry.h"
 #include "NotImplemented.h"
 #include "TimeRanges.h"
 #include "Widget.h"
 #include <wtf/HashSet.h>
 
 #include <QDebug>
+#include <QEvent>
+#include <QMetaEnum>
 #include <QPainter>
 #include <QWidget>
-#include <QMetaEnum>
 #include <QUrl>
-#include <QEvent>
 
-#include <phonon/path.h>
 #include <phonon/audiooutput.h>
+#include <phonon/backendcapabilities.h>
+#include <phonon/path.h>
 #include <phonon/mediaobject.h>
 #include <phonon/videowidget.h>
 
@@ -47,6 +49,7 @@ using namespace Phonon;
 
 #define LOG_MEDIAOBJECT() (LOG(Media, "%s", debugMediaObject(this, *m_mediaObject).constData()))
 
+#if !LOG_DISABLED
 static QByteArray debugMediaObject(WebCore::MediaPlayerPrivate* mediaPlayer, const MediaObject& mediaObject)
 {
     QByteArray byteArray;
@@ -74,6 +77,7 @@ static QByteArray debugMediaObject(WebCore::MediaPlayerPrivate* mediaPlayer, con
 
     return byteArray;
 }
+#endif
 
 using namespace WTF;
 
@@ -90,9 +94,7 @@ MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
 {
     // Hint to Phonon to disable overlay painting
     m_videoWidget->setAttribute(Qt::WA_DontShowOnScreen);
-#if QT_VERSION < 0x040500
     m_videoWidget->setAttribute(Qt::WA_QuitOnClose, false);
-#endif
 
     createPath(m_mediaObject, m_videoWidget);
     createPath(m_mediaObject, m_audioOutput);
@@ -143,15 +145,62 @@ MediaPlayerPrivate::~MediaPlayerPrivate()
     m_mediaObject = 0;
 }
 
-void MediaPlayerPrivate::getSupportedTypes(HashSet<String>&)
+HashSet<String>& MediaPlayerPrivate::supportedTypesCache()
 {
-    notImplemented();
+    static HashSet<String> supportedTypes;
+    if (!supportedTypes.isEmpty())
+        return supportedTypes;
+
+    // FIXME: we should rebuild the MIME type cache every time the backend is changed,
+    // however, this would have no effect on MIMETypeRegistry anyway, because it
+    // pulls this data only once.
+
+    QStringList types = Phonon::BackendCapabilities::availableMimeTypes();
+    foreach (const QString& type, types) {
+        QString first = type.split(QLatin1Char('/')).at(0);
+
+        // We're only interested in types which are not supported by WebCore itself.
+        if (first != QLatin1String("video")
+            && first != QLatin1String("audio")
+            && first != QLatin1String("application"))
+            continue;
+        if (MIMETypeRegistry::isSupportedNonImageMIMEType(type))
+            continue;
+
+        supportedTypes.add(String(type));
+    }
+
+    // These formats are supported by GStreamer, but not correctly advertised.
+    if (supportedTypes.contains(String("video/x-h264"))
+        || supportedTypes.contains(String("audio/x-m4a"))) {
+        supportedTypes.add(String("video/mp4"));
+        supportedTypes.add(String("audio/aac"));
+    }
+
+    if (supportedTypes.contains(String("video/x-theora")))
+        supportedTypes.add(String("video/ogg"));
+
+    if (supportedTypes.contains(String("audio/x-vorbis")))
+        supportedTypes.add(String("audio/ogg"));
+
+    if (supportedTypes.contains(String("audio/x-wav")))
+        supportedTypes.add(String("audio/wav"));
+
+    return supportedTypes;
 }
 
-MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String&, const String&)
+void MediaPlayerPrivate::getSupportedTypes(HashSet<String>& types)
 {
-    // FIXME: do the real thing
-    notImplemented();
+    types = supportedTypesCache();
+}
+
+MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String& type, const String& codecs)
+{
+    if (type.isEmpty())
+        return MediaPlayer::IsNotSupported;
+
+    if (supportedTypesCache().contains(type))
+        return codecs.isEmpty() ? MediaPlayer::MayBeSupported : MediaPlayer::IsSupported;
     return MediaPlayer::IsNotSupported;
 }
 
@@ -257,11 +306,6 @@ float MediaPlayerPrivate::currentTime() const
     return currentTime;
 }
 
-void MediaPlayerPrivate::setEndTime(float)
-{
-    notImplemented();
-}
-
 PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
 {
     notImplemented();
@@ -280,12 +324,6 @@ unsigned MediaPlayerPrivate::bytesLoaded() const
     return 0;
 }
 
-bool MediaPlayerPrivate::totalBytesKnown() const
-{
-    //notImplemented();
-    return false;
-}
-
 unsigned MediaPlayerPrivate::totalBytes() const
 {
     //notImplemented();
@@ -309,14 +347,6 @@ void MediaPlayerPrivate::setMuted(bool muted)
     m_audioOutput->setMuted(muted);
 }
 
-
-int MediaPlayerPrivate::dataRate() const
-{
-    // This is not used at the moment
-    return 0;
-}
-
-
 MediaPlayer::NetworkState MediaPlayerPrivate::networkState() const
 {
     const QMetaObject* metaObj = this->metaObject();
@@ -503,7 +533,7 @@ void MediaPlayerPrivate::aboutToFinish()
 
 void MediaPlayerPrivate::totalTimeChanged(qint64 totalTime)
 {
-    LOG(Media, "MediaPlayerPrivatePhonon::totalTimeChanged(%d)", totalTime);
+    LOG(Media, "MediaPlayerPrivatePhonon::totalTimeChanged(%lld)", totalTime);
     LOG_MEDIAOBJECT();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h
index e1193b6c9c..ff6a01c8c1 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h
@@ -94,21 +94,17 @@ namespace WebCore {
         float duration() const;
         float currentTime() const;
         void seek(float);
-        void setEndTime(float);
 
         void setRate(float);
         void setVolume(float);
         void setMuted(bool);
 
-        int dataRate() const;
-
         MediaPlayer::NetworkState networkState() const;
         MediaPlayer::ReadyState readyState() const;
 
         PassRefPtr<TimeRanges> buffered() const;
         float maxTimeSeekable() const;
         unsigned bytesLoaded() const;
-        bool totalBytesKnown() const;
         unsigned totalBytes() const;
 
         void setVisible(bool);
@@ -136,6 +132,7 @@ namespace WebCore {
 
         static void getSupportedTypes(HashSet<String>&);
         static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
+        static HashSet<String>& supportedTypesCache();
         static bool isAvailable() { return true; }
 
         void updateStates();
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
new file mode 100644
index 0000000000..66ffe23f44
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
@@ -0,0 +1,571 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "MediaPlayerPrivateQt.h"
+
+#include "CString.h"
+#include "FrameLoaderClientQt.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "HTMLMediaElement.h"
+#include "HTMLVideoElement.h"
+#include "TimeRanges.h"
+#include "Widget.h"
+#include "qwebframe.h"
+#include "qwebpage.h"
+
+#include <QGraphicsScene>
+#include <QGraphicsVideoItem>
+#include <QMediaPlayerControl>
+#include <QMediaService>
+#include <QNetworkAccessManager>
+#include <QNetworkCookieJar>
+#include <QNetworkRequest>
+#include <QPainter>
+#include <QPoint>
+#include <QRect>
+#include <QTime>
+#include <QTimer>
+#include <QUrl>
+#include <limits>
+#include <wtf/HashSet.h>
+
+using namespace WTF;
+
+namespace WebCore {
+
+MediaPlayerPrivateInterface* MediaPlayerPrivate::create(MediaPlayer* player)
+{
+    return new MediaPlayerPrivate(player);
+}
+
+void MediaPlayerPrivate::registerMediaEngine(MediaEngineRegistrar registrar)
+{
+    registrar(create, getSupportedTypes, supportsType);
+}
+
+void MediaPlayerPrivate::getSupportedTypes(HashSet<String> &supported)
+{
+    QStringList types = QMediaPlayer::supportedMimeTypes();
+
+    for (int i = 0; i < types.size(); i++) {
+        QString mime = types.at(i);
+        if (mime.startsWith("audio/") || mime.startsWith("video/"))
+            supported.add(mime);
+    }
+}
+
+MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String& mime, const String& codec)
+{
+    if (!mime.startsWith("audio/") && !mime.startsWith("video/"))
+        return MediaPlayer::IsNotSupported;
+
+    if (QMediaPlayer::hasSupport(mime, QStringList(codec)) >= QtMultimedia::ProbablySupported)
+        return MediaPlayer::IsSupported;
+
+    return MediaPlayer::MayBeSupported;
+}
+
+MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
+    : m_player(player)
+    , m_mediaPlayer(new QMediaPlayer)
+    , m_mediaPlayerControl(0)
+    , m_videoItem(new QGraphicsVideoItem)
+    , m_videoScene(new QGraphicsScene)
+    , m_networkState(MediaPlayer::Empty)
+    , m_readyState(MediaPlayer::HaveNothing)
+    , m_isVisible(false)
+    , m_isSeeking(false)
+    , m_composited(false)
+    , m_queuedSeek(-1)
+{
+    m_videoItem->setMediaObject(m_mediaPlayer);
+    m_videoScene->addItem(m_videoItem);
+
+    // Signal Handlers
+    connect(m_mediaPlayer, SIGNAL(mediaStatusChanged(QMediaPlayer::MediaStatus)),
+            this, SLOT(mediaStatusChanged(QMediaPlayer::MediaStatus)));
+    connect(m_mediaPlayer, SIGNAL(stateChanged(QMediaPlayer::State)),
+            this, SLOT(stateChanged(QMediaPlayer::State)));
+    connect(m_mediaPlayer, SIGNAL(error(QMediaPlayer::Error)),
+            this, SLOT(handleError(QMediaPlayer::Error)));
+    connect(m_mediaPlayer, SIGNAL(durationChanged(qint64)),
+            this, SLOT(durationChanged(qint64)));
+    connect(m_mediaPlayer, SIGNAL(positionChanged(qint64)),
+            this, SLOT(positionChanged(qint64)));
+    connect(m_mediaPlayer, SIGNAL(volumeChanged(int)),
+            this, SLOT(volumeChanged(int)));
+    connect(m_mediaPlayer, SIGNAL(mutedChanged(bool)),
+            this, SLOT(mutedChanged(bool)));
+    connect(m_videoScene, SIGNAL(changed(QList<QRectF>)),
+            this, SLOT(repaint()));
+    connect(m_videoItem, SIGNAL(nativeSizeChanged(QSizeF)),
+           this, SLOT(nativeSizeChanged(QSizeF)));
+
+    // Grab the player control
+    QMediaService* service = m_mediaPlayer->service();
+    if (service) {
+        m_mediaPlayerControl = qobject_cast<QMediaPlayerControl *>(
+                service->control(QMediaPlayerControl_iid));
+    }
+}
+
+MediaPlayerPrivate::~MediaPlayerPrivate()
+{
+    delete m_mediaPlayer;
+    delete m_videoScene;
+}
+
+bool MediaPlayerPrivate::hasVideo() const
+{
+    return m_mediaPlayer->isVideoAvailable();
+}
+
+bool MediaPlayerPrivate::hasAudio() const
+{
+    return true;
+}
+
+void MediaPlayerPrivate::load(const String& url)
+{
+    // We are now loading
+    if (m_networkState != MediaPlayer::Loading) {
+        m_networkState = MediaPlayer::Loading;
+        m_player->networkStateChanged();
+    }
+
+    // And we don't have any data yet
+    if (m_readyState != MediaPlayer::HaveNothing) {
+        m_readyState = MediaPlayer::HaveNothing;
+        m_player->readyStateChanged();
+    }
+
+    const QUrl rUrl = QUrl(QString(url));
+    const QString scheme = rUrl.scheme().toLower();
+
+    // Grab the client media element
+    HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_player->mediaPlayerClient());
+
+    // Construct the media content with a network request if the resource is http[s]
+    if (scheme == "http" || scheme == "https") {
+        QNetworkRequest request = QNetworkRequest(rUrl);
+
+        // Grab the current document
+        Document* document = element->document();
+        if (!document)
+            document = element->ownerDocument();
+
+        // Grab the frame and network manager
+        Frame* frame = document ? document->frame() : 0;
+        FrameLoaderClientQt* frameLoader =  frame ? static_cast<FrameLoaderClientQt*>(frame->loader()->client()) : 0;
+        QNetworkAccessManager* manager = frameLoader ? frameLoader->webFrame()->page()->networkAccessManager() : 0;
+
+        if (document && manager) {
+            // Set the cookies
+            QNetworkCookieJar* jar = manager->cookieJar();
+            QList<QNetworkCookie> cookies = jar->cookiesForUrl(rUrl);
+
+            // Don't set the header if there are no cookies.
+            // This prevents a warning from being emitted.
+            if (!cookies.isEmpty())
+                request.setHeader(QNetworkRequest::CookieHeader, qVariantFromValue(cookies));
+
+            // Set the refferer, but not when requesting insecure content from a secure page
+            QUrl documentUrl = QUrl(QString(document->documentURI()));
+            if (documentUrl.scheme().toLower() == "http" || scheme == "https")
+                request.setRawHeader("Referer", documentUrl.toEncoded());
+
+            // Set the user agent
+            request.setRawHeader("User-Agent", frameLoader->userAgent(rUrl).utf8().data());
+        }
+
+        m_mediaPlayer->setMedia(QMediaContent(request));
+    } else {
+        // Otherwise, just use the URL
+        m_mediaPlayer->setMedia(QMediaContent(rUrl));
+    }
+
+    // Set the current volume and mute status
+    // We get these from the element, rather than the player, in case we have
+    // transitioned from a media engine which doesn't support muting, to a media
+    // engine which does.
+    m_mediaPlayer->setMuted(element->muted());
+    m_mediaPlayer->setVolume(static_cast<int>(element->volume() * 100.0));
+}
+
+void MediaPlayerPrivate::cancelLoad()
+{
+    m_mediaPlayer->setMedia(QMediaContent());
+    updateStates();
+}
+
+void MediaPlayerPrivate::play()
+{
+    if (m_mediaPlayer->state() != QMediaPlayer::PlayingState)
+        m_mediaPlayer->play();
+}
+
+void MediaPlayerPrivate::pause()
+{
+    if (m_mediaPlayer->state() == QMediaPlayer::PlayingState)
+        m_mediaPlayer->pause();
+}
+
+bool MediaPlayerPrivate::paused() const
+{
+    return (m_mediaPlayer->state() != QMediaPlayer::PlayingState);
+}
+
+void MediaPlayerPrivate::seek(float position)
+{
+    if (!m_mediaPlayer->isSeekable())
+        return;
+
+    if (m_mediaPlayerControl && !m_mediaPlayerControl->availablePlaybackRanges().contains(position * 1000))
+        return;
+
+    if (m_isSeeking)
+        return;
+
+    if (position > duration())
+        position = duration();
+
+    // Seeking is most reliable when we're paused.
+    // Webkit will try to pause before seeking, but due to the asynchronous nature
+    // of the backend, the player may not actually be paused yet.
+    // In this case, we should queue the seek and wait until pausing has completed
+    // before attempting to seek.
+    if (m_mediaPlayer->state() == QMediaPlayer::PlayingState) {
+        m_mediaPlayer->pause();
+        m_isSeeking = true;
+        m_queuedSeek = static_cast<qint64>(position * 1000);
+
+        // Set a timeout, so that in the event that we don't get a state changed
+        // signal, we still attempt the seek.
+        QTimer::singleShot(1000, this, SLOT(queuedSeekTimeout()));
+    } else {
+        m_isSeeking = true;
+        m_mediaPlayer->setPosition(static_cast<qint64>(position * 1000));
+
+        // Set a timeout, in case we don't get a position changed signal
+        QTimer::singleShot(10000, this, SLOT(seekTimeout()));
+    }
+}
+
+bool MediaPlayerPrivate::seeking() const
+{
+    return m_isSeeking;
+}
+
+float MediaPlayerPrivate::duration() const
+{
+    if (m_readyState < MediaPlayer::HaveMetadata)
+        return 0.0f;
+
+    float duration = m_mediaPlayer->duration() / 1000.0f;
+
+    // We are streaming
+    if (duration <= 0.0f)
+        duration = std::numeric_limits<float>::infinity();
+
+    return duration;
+}
+
+float MediaPlayerPrivate::currentTime() const
+{
+    float currentTime = m_mediaPlayer->position() / 1000.0f;
+    return currentTime;
+}
+
+PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
+{
+    RefPtr<TimeRanges> buffered = TimeRanges::create();
+
+    if (!m_mediaPlayerControl)
+        return buffered;
+
+    QMediaTimeRange playbackRanges = m_mediaPlayerControl->availablePlaybackRanges();
+
+    foreach (const QMediaTimeInterval interval, playbackRanges.intervals()) {
+        float rangeMin = static_cast<float>(interval.start()) / 1000.0f;
+        float rangeMax = static_cast<float>(interval.end()) / 1000.0f;
+        buffered->add(rangeMin, rangeMax);
+    }
+
+    return buffered.release();
+}
+
+float MediaPlayerPrivate::maxTimeSeekable() const
+{
+    if (!m_mediaPlayerControl)
+        return 0;
+
+    return static_cast<float>(m_mediaPlayerControl->availablePlaybackRanges().latestTime()) / 1000.0f;
+}
+
+unsigned MediaPlayerPrivate::bytesLoaded() const
+{
+    unsigned percentage = m_mediaPlayer->bufferStatus();
+
+    if (percentage == 100) {
+        if (m_networkState != MediaPlayer::Idle) {
+            m_networkState = MediaPlayer::Idle;
+            m_player->networkStateChanged();
+        }
+        if (m_readyState != MediaPlayer::HaveEnoughData) {
+            m_readyState = MediaPlayer::HaveEnoughData;
+            m_player->readyStateChanged();
+        }
+    }
+
+    QLatin1String bytesLoadedKey("bytes-loaded");
+    if (m_mediaPlayer->availableExtendedMetaData().contains(bytesLoadedKey))
+        return m_mediaPlayer->extendedMetaData(bytesLoadedKey).toInt();
+
+    return percentage;
+}
+
+unsigned MediaPlayerPrivate::totalBytes() const
+{
+    if (m_mediaPlayer->availableMetaData().contains(QtMultimedia::Size))
+        return m_mediaPlayer->metaData(QtMultimedia::Size).toInt();
+
+    return 100;
+}
+
+void MediaPlayerPrivate::setRate(float rate)
+{
+    m_mediaPlayer->setPlaybackRate(rate);
+}
+
+void MediaPlayerPrivate::setVolume(float volume)
+{
+    m_mediaPlayer->setVolume(static_cast<int>(volume * 100.0));
+}
+
+bool MediaPlayerPrivate::supportsMuting() const
+{
+    return true;
+}
+
+void MediaPlayerPrivate::setMuted(bool muted)
+{
+    m_mediaPlayer->setMuted(muted);
+}
+
+MediaPlayer::NetworkState MediaPlayerPrivate::networkState() const
+{
+    return m_networkState;
+}
+
+MediaPlayer::ReadyState MediaPlayerPrivate::readyState() const
+{
+    return m_readyState;
+}
+
+void MediaPlayerPrivate::setVisible(bool visible)
+{
+    m_isVisible = visible;
+}
+
+void MediaPlayerPrivate::mediaStatusChanged(QMediaPlayer::MediaStatus)
+{
+    updateStates();
+}
+
+void MediaPlayerPrivate::handleError(QMediaPlayer::Error)
+{
+    updateStates();
+}
+
+void MediaPlayerPrivate::stateChanged(QMediaPlayer::State state)
+{
+    if (state != QMediaPlayer::PlayingState && m_isSeeking && m_queuedSeek >= 0) {
+        m_mediaPlayer->setPosition(m_queuedSeek);
+        m_queuedSeek = -1;
+    }
+}
+
+void MediaPlayerPrivate::nativeSizeChanged(const QSizeF&)
+{
+    m_player->sizeChanged();
+}
+
+void MediaPlayerPrivate::queuedSeekTimeout()
+{
+    // If we haven't heard anything, assume the player is now paused
+    // and we can attempt the seek
+    if (m_isSeeking && m_queuedSeek >= 0) {
+        m_mediaPlayer->setPosition(m_queuedSeek);
+        m_queuedSeek = -1;
+
+        // Set a timeout, in case we don't get a position changed signal
+        QTimer::singleShot(10000, this, SLOT(seekTimeout()));
+    }
+}
+
+void MediaPlayerPrivate::seekTimeout()
+{
+    // If we haven't heard anything, assume the seek succeeded
+    if (m_isSeeking) {
+        m_player->timeChanged();
+        m_isSeeking = false;
+    }
+}
+
+void MediaPlayerPrivate::positionChanged(qint64)
+{
+    // Only propogate this event if we are seeking
+    if (m_isSeeking && m_queuedSeek == -1) {
+        m_player->timeChanged();
+        m_isSeeking = false;
+    }
+}
+
+void MediaPlayerPrivate::durationChanged(qint64)
+{
+    m_player->durationChanged();
+}
+
+void MediaPlayerPrivate::volumeChanged(int volume)
+{
+    m_player->volumeChanged(static_cast<float>(volume) / 100.0);
+}
+
+void MediaPlayerPrivate::mutedChanged(bool muted)
+{
+    m_player->muteChanged(muted);
+}
+
+void MediaPlayerPrivate::updateStates()
+{
+    // Store the old states so that we can detect a change and raise change events
+    MediaPlayer::NetworkState oldNetworkState = m_networkState;
+    MediaPlayer::ReadyState oldReadyState = m_readyState;
+
+    QMediaPlayer::MediaStatus currentStatus = m_mediaPlayer->mediaStatus();
+    QMediaPlayer::Error currentError = m_mediaPlayer->error();
+
+    if (currentError != QMediaPlayer::NoError) {
+        m_readyState = MediaPlayer::HaveNothing;
+        if (currentError == QMediaPlayer::FormatError)
+            m_networkState = MediaPlayer::FormatError;
+        else
+            m_networkState = MediaPlayer::NetworkError;
+    } else if (currentStatus == QMediaPlayer::UnknownMediaStatus
+               || currentStatus == QMediaPlayer::NoMedia) {
+        m_networkState = MediaPlayer::Idle;
+        m_readyState = MediaPlayer::HaveNothing;
+    } else if (currentStatus == QMediaPlayer::LoadingMedia) {
+        m_networkState = MediaPlayer::Loading;
+        m_readyState = MediaPlayer::HaveNothing;
+    } else if (currentStatus == QMediaPlayer::LoadedMedia) {
+        m_networkState = MediaPlayer::Loading;
+        m_readyState = MediaPlayer::HaveMetadata;
+    } else if (currentStatus == QMediaPlayer::BufferingMedia) {
+        m_networkState = MediaPlayer::Loading;
+        m_readyState = MediaPlayer::HaveFutureData;
+    } else if (currentStatus == QMediaPlayer::StalledMedia) {
+        m_networkState = MediaPlayer::Loading;
+        m_readyState = MediaPlayer::HaveCurrentData;
+    } else if (currentStatus == QMediaPlayer::BufferedMedia
+               || currentStatus == QMediaPlayer::EndOfMedia) {
+        m_networkState = MediaPlayer::Idle;
+        m_readyState = MediaPlayer::HaveEnoughData;
+    } else if (currentStatus == QMediaPlayer::InvalidMedia) {
+        m_networkState = MediaPlayer::NetworkError;
+        m_readyState = MediaPlayer::HaveNothing;
+    }
+
+    // Log the state changes and raise the state change events
+    // NB: The readyStateChanged event must come before the networkStateChanged event.
+    // Breaking this invariant will cause the resource selection algorithm for multiple
+    // sources to fail.
+    if (m_readyState != oldReadyState)
+        m_player->readyStateChanged();
+
+    if (m_networkState != oldNetworkState)
+        m_player->networkStateChanged();
+}
+
+void MediaPlayerPrivate::setSize(const IntSize& size)
+{
+    if (size == m_currentSize)
+        return;
+
+    m_currentSize = size;
+    m_videoItem->setSize(QSizeF(QSize(size)));
+}
+
+IntSize MediaPlayerPrivate::naturalSize() const
+{
+    if (!hasVideo() || m_readyState < MediaPlayer::HaveMetadata)
+        return IntSize();
+
+    return IntSize(m_videoItem->nativeSize().toSize());
+}
+
+void MediaPlayerPrivate::paint(GraphicsContext* context, const IntRect& rect)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_composited)
+        return;
+#endif
+    if (context->paintingDisabled())
+        return;
+
+    if (!m_isVisible)
+        return;
+
+    // Grab the painter and widget
+    QPainter* painter = context->platformContext();
+
+    // Render the video
+    m_videoScene->render(painter, QRectF(QRect(rect)), m_videoItem->sceneBoundingRect());
+}
+
+void MediaPlayerPrivate::repaint()
+{
+    m_player->repaint();
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+void MediaPlayerPrivate::acceleratedRenderingStateChanged()
+{
+    bool composited = m_player->mediaPlayerClient()->mediaPlayerRenderingCanBeAccelerated(m_player);
+    if (composited == m_composited)
+        return;
+
+    m_composited = composited;
+    if (composited)
+        m_videoScene->removeItem(m_videoItem);
+    else
+        m_videoScene->addItem(m_videoItem);
+}
+
+PlatformLayer* MediaPlayerPrivate::platformLayer() const
+{
+    return m_composited ? m_videoItem : 0;
+}
+#endif
+
+} // namespace WebCore
+
+#include "moc_MediaPlayerPrivateQt.cpp"
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
new file mode 100644
index 0000000000..8f8229ba30
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
@@ -0,0 +1,131 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef MediaPlayerPrivateQt_h
+#define MediaPlayerPrivateQt_h
+
+#include "MediaPlayerPrivate.h"
+
+#include <QMediaPlayer>
+#include <QObject>
+
+class QMediaPlayerControl;
+class QGraphicsVideoItem;
+class QGraphicsScene;
+
+namespace WebCore {
+
+class MediaPlayerPrivate : public QObject, public MediaPlayerPrivateInterface {
+
+    Q_OBJECT
+
+public:
+    static MediaPlayerPrivateInterface* create(MediaPlayer* player);
+    ~MediaPlayerPrivate();
+
+    static void registerMediaEngine(MediaEngineRegistrar);
+    static void getSupportedTypes(HashSet<String>&);
+    static MediaPlayer::SupportsType supportsType(const String&, const String&);
+    static bool isAvailable() { return true; }
+
+    bool hasVideo() const;
+    bool hasAudio() const;
+
+    void load(const String &url);
+    void cancelLoad();
+
+    void play();
+    void pause();
+
+    bool paused() const;
+    bool seeking() const;
+
+    float duration() const;
+    float currentTime() const;
+    void seek(float);
+
+    void setRate(float);
+    void setVolume(float);
+
+    bool supportsMuting() const;
+    void setMuted(bool);
+
+    MediaPlayer::NetworkState networkState() const;
+    MediaPlayer::ReadyState readyState() const;
+
+    PassRefPtr<TimeRanges> buffered() const;
+    float maxTimeSeekable() const;
+    unsigned bytesLoaded() const;
+    unsigned totalBytes() const;
+
+    void setVisible(bool);
+
+    IntSize naturalSize() const;
+    void setSize(const IntSize&);
+
+    void paint(GraphicsContext*, const IntRect&);
+
+    bool supportsFullscreen() const { return false; }
+
+#if USE(ACCELERATED_COMPOSITING)
+    // whether accelerated rendering is supported by the media engine for the current media.
+    virtual bool supportsAcceleratedRendering() const { return true; }
+    // called when the rendering system flips the into or out of accelerated rendering mode.
+    virtual void acceleratedRenderingStateChanged();
+    // returns an object that can be directly composited via GraphicsLayerQt (essentially a QGraphicsItem*)
+    virtual PlatformLayer* platformLayer() const;
+#endif
+
+private slots:
+    void mediaStatusChanged(QMediaPlayer::MediaStatus);
+    void handleError(QMediaPlayer::Error);
+    void stateChanged(QMediaPlayer::State);
+    void nativeSizeChanged(const QSizeF&);
+    void queuedSeekTimeout();
+    void seekTimeout();
+    void positionChanged(qint64);
+    void durationChanged(qint64);
+    void volumeChanged(int);
+    void mutedChanged(bool);
+    void repaint();
+
+private:
+    void updateStates();
+
+private:
+    MediaPlayerPrivate(MediaPlayer*);
+
+    MediaPlayer* m_player;
+    QMediaPlayer* m_mediaPlayer;
+    QMediaPlayerControl* m_mediaPlayerControl;
+    QGraphicsVideoItem* m_videoItem;
+    QGraphicsScene* m_videoScene;
+
+    mutable MediaPlayer::NetworkState m_networkState;
+    mutable MediaPlayer::ReadyState m_readyState;
+
+    IntSize m_currentSize;
+    bool m_isVisible;
+    bool m_isSeeking;
+    bool m_composited;
+    qint64 m_queuedSeek;
+};
+}
+
+#endif // MediaPlayerPrivateQt_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
index e5cecc833d..ee4af7fe01 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2006 Zack Rusin   <zack@kde.org>
  *               2006 Rob Buis     <buis@kde.org>
- *               2009 Dirk Schulze <krit@webkit.org>
+ *               2009, 2010 Dirk Schulze <krit@webkit.org>
  *
  * All rights reserved.
  *
@@ -30,7 +30,7 @@
 #include "config.h"
 #include "Path.h"
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "FloatRect.h"
 #include "GraphicsContext.h"
 #include "ImageBuffer.h"
@@ -51,38 +51,32 @@
 namespace WebCore {
 
 Path::Path()
-    : m_path(new QPainterPath())
 {
 }
 
 Path::~Path()
 {
-    delete m_path;
 }
 
 Path::Path(const Path& other)
-    : m_path(new QPainterPath(*other.platformPath()))
+    : m_path(other.m_path)
 {
 }
 
 Path& Path::operator=(const Path& other)
 {
-    if (&other != this) {
-        delete m_path;
-        m_path = new QPainterPath(*other.platformPath());
-    }
-
+    m_path = other.m_path;
     return *this;
 }
 
 bool Path::contains(const FloatPoint& point, WindRule rule) const
 {
-    Qt::FillRule savedRule = m_path->fillRule();
-    m_path->setFillRule(rule == RULE_EVENODD ? Qt::OddEvenFill : Qt::WindingFill);
+    Qt::FillRule savedRule = m_path.fillRule();
+    const_cast<QPainterPath*>(&m_path)->setFillRule(rule == RULE_EVENODD ? Qt::OddEvenFill : Qt::WindingFill);
 
-    bool contains = m_path->contains(point);
+    bool contains = m_path.contains(point);
 
-    m_path->setFillRule(savedRule);
+    const_cast<QPainterPath*>(&m_path)->setFillRule(savedRule);
     return contains;
 }
 
@@ -105,19 +99,19 @@ bool Path::strokeContains(StrokeStyleApplier* applier, const FloatPoint& point)
     stroke.setDashPattern(pen.dashPattern());
     stroke.setDashOffset(pen.dashOffset());
 
-    return (stroke.createStroke(*platformPath())).contains(point);
+    return stroke.createStroke(m_path).contains(point);
 }
 
 void Path::translate(const FloatSize& size)
 {
     QTransform matrix;
     matrix.translate(size.width(), size.height());
-    *m_path = (*m_path) * matrix;
+    m_path = m_path * matrix;
 }
 
 FloatRect Path::boundingRect() const
 {
-    return m_path->boundingRect();
+    return m_path.boundingRect();
 }
 
 FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
@@ -138,35 +132,35 @@ FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
         stroke.setDashPattern(pen.dashPattern());
         stroke.setDashOffset(pen.dashOffset());
     }
-    return (stroke.createStroke(*platformPath())).boundingRect();
+    return stroke.createStroke(m_path).boundingRect();
 }
 
 void Path::moveTo(const FloatPoint& point)
 {
-    m_path->moveTo(point);
+    m_path.moveTo(point);
 }
 
 void Path::addLineTo(const FloatPoint& p)
 {
-    m_path->lineTo(p);
+    m_path.lineTo(p);
 }
 
 void Path::addQuadCurveTo(const FloatPoint& cp, const FloatPoint& p)
 {
-    m_path->quadTo(cp, p);
+    m_path.quadTo(cp, p);
 }
 
 void Path::addBezierCurveTo(const FloatPoint& cp1, const FloatPoint& cp2, const FloatPoint& p)
 {
-    m_path->cubicTo(cp1, cp2, p);
+    m_path.cubicTo(cp1, cp2, p);
 }
 
 void Path::addArcTo(const FloatPoint& p1, const FloatPoint& p2, float radius)
 {
-    FloatPoint p0(m_path->currentPosition());
+    FloatPoint p0(m_path.currentPosition());
 
     if ((p1.x() == p0.x() && p1.y() == p0.y()) || (p1.x() == p2.x() && p1.y() == p2.y()) || radius == 0.f) {
-        m_path->lineTo(p1);
+        m_path.lineTo(p1);
         return;
     }
 
@@ -178,7 +172,7 @@ void Path::addArcTo(const FloatPoint& p1, const FloatPoint& p2, float radius)
     double cos_phi = (p1p0.x() * p1p2.x() + p1p0.y() * p1p2.y()) / (p1p0_length * p1p2_length);
     // all points on a line logic
     if (cos_phi == -1) {
-        m_path->lineTo(p1);
+        m_path.lineTo(p1);
         return;
     }
     if (cos_phi == 1) {
@@ -186,7 +180,7 @@ void Path::addArcTo(const FloatPoint& p1, const FloatPoint& p2, float radius)
         unsigned int max_length = 65535;
         double factor_max = max_length / p1p0_length;
         FloatPoint ep((p0.x() + factor_max * p1p0.x()), (p0.y() + factor_max * p1p0.y()));
-        m_path->lineTo(ep);
+        m_path.lineTo(ep);
         return;
     }
 
@@ -226,14 +220,14 @@ void Path::addArcTo(const FloatPoint& p1, const FloatPoint& p2, float radius)
     if ((sa < ea) && ((ea - sa) > piDouble))
         anticlockwise = true;
 
-    m_path->lineTo(t_p1p0);
+    m_path.lineTo(t_p1p0);
 
     addArc(p, radius, sa, ea, anticlockwise);
 }
 
 void Path::closeSubpath()
 {
-    m_path->closeSubpath();
+    m_path.closeSubpath();
 }
 
 #define DEGREES(t) ((t) * 180.0 / M_PI)
@@ -275,32 +269,34 @@ void Path::addArc(const FloatPoint& p, float r, float sar, float ear, bool antic
         span += ea - sa;
     }
 
-    m_path->moveTo(QPointF(xc + radius  * cos(sar),
+    // connect to the previous point by a straight line
+    m_path.lineTo(QPointF(xc + radius  * cos(sar),
                           yc - radius  * sin(sar)));
 
-    m_path->arcTo(xs, ys, width, height, sa, span);
+    m_path.arcTo(xs, ys, width, height, sa, span);
+
 }
 
 void Path::addRect(const FloatRect& r)
 {
-    m_path->addRect(r.x(), r.y(), r.width(), r.height());
+    m_path.addRect(r.x(), r.y(), r.width(), r.height());
 }
 
 void Path::addEllipse(const FloatRect& r)
 {
-    m_path->addEllipse(r.x(), r.y(), r.width(), r.height());
+    m_path.addEllipse(r.x(), r.y(), r.width(), r.height());
 }
 
 void Path::clear()
 {
-    *m_path = QPainterPath();
+    m_path = QPainterPath();
 }
 
 bool Path::isEmpty() const
 {
     // Don't use QPainterPath::isEmpty(), as that also returns true if there's only
     // one initial MoveTo element in the path.
-    return !m_path->elementCount();
+    return !m_path.elementCount();
 }
 
 bool Path::hasCurrentPoint() const
@@ -311,26 +307,26 @@ bool Path::hasCurrentPoint() const
 String Path::debugString() const
 {
     QString ret;
-    for (int i = 0; i < m_path->elementCount(); ++i) {
-        const QPainterPath::Element &cur = m_path->elementAt(i);
+    for (int i = 0; i < m_path.elementCount(); ++i) {
+        const QPainterPath::Element &cur = m_path.elementAt(i);
 
         switch (cur.type) {
             case QPainterPath::MoveToElement:
-                ret += QString(QLatin1String("M %1 %2")).arg(cur.x).arg(cur.y);
+                ret += QString(QLatin1String("M%1,%2 ")).arg(cur.x, 0, 'f', 2).arg(cur.y, 0, 'f', 2);
                 break;
             case QPainterPath::LineToElement:
-                ret += QString(QLatin1String("L %1 %2")).arg(cur.x).arg(cur.y);
+                ret += QString(QLatin1String("L%1,%2 ")).arg(cur.x, 0, 'f', 2).arg(cur.y, 0, 'f', 2);
                 break;
             case QPainterPath::CurveToElement:
             {
-                const QPainterPath::Element &c1 = m_path->elementAt(i + 1);
-                const QPainterPath::Element &c2 = m_path->elementAt(i + 2);
+                const QPainterPath::Element &c1 = m_path.elementAt(i + 1);
+                const QPainterPath::Element &c2 = m_path.elementAt(i + 2);
 
                 Q_ASSERT(c1.type == QPainterPath::CurveToDataElement);
                 Q_ASSERT(c2.type == QPainterPath::CurveToDataElement);
 
-                ret += QString(QLatin1String("C %1 %2 %3 %4 %5 %6")).arg(cur.x).arg(cur.y).arg(c1.x).arg(c1.y).arg(c2.x).arg(c2.y);
-
+                ret += QString(QLatin1String("C%1,%2,%3,%4,%5,%6 ")).arg(cur.x, 0, 'f', 2).arg(cur.y, 0, 'f', 2).arg(c1.x, 0, 'f', 2)
+                                                                    .arg(c1.y, 0, 'f', 2).arg(c2.x, 0, 'f', 2).arg(c2.y, 0, 'f', 2);
                 i += 2;
                 break;
             }
@@ -340,7 +336,7 @@ String Path::debugString() const
         }
     }
 
-    return ret;
+    return ret.trimmed();
 }
 
 void Path::apply(void* info, PathApplierFunction function) const
@@ -348,8 +344,8 @@ void Path::apply(void* info, PathApplierFunction function) const
     PathElement pelement;
     FloatPoint points[3];
     pelement.points = points;
-    for (int i = 0; i < m_path->elementCount(); ++i) {
-        const QPainterPath::Element& cur = m_path->elementAt(i);
+    for (int i = 0; i < m_path.elementCount(); ++i) {
+        const QPainterPath::Element& cur = m_path.elementAt(i);
 
         switch (cur.type) {
             case QPainterPath::MoveToElement:
@@ -364,8 +360,8 @@ void Path::apply(void* info, PathApplierFunction function) const
                 break;
             case QPainterPath::CurveToElement:
             {
-                const QPainterPath::Element& c1 = m_path->elementAt(i + 1);
-                const QPainterPath::Element& c2 = m_path->elementAt(i + 2);
+                const QPainterPath::Element& c1 = m_path.elementAt(i + 1);
+                const QPainterPath::Element& c2 = m_path.elementAt(i + 2);
 
                 Q_ASSERT(c1.type == QPainterPath::CurveToDataElement);
                 Q_ASSERT(c2.type == QPainterPath::CurveToDataElement);
@@ -385,14 +381,9 @@ void Path::apply(void* info, PathApplierFunction function) const
     }
 }
 
-void Path::transform(const TransformationMatrix& transform)
+void Path::transform(const AffineTransform& transform)
 {
-    if (m_path) {
-        QTransform mat = transform;
-        QPainterPath temp = mat.map(*m_path);
-        delete m_path;
-        m_path = new QPainterPath(temp);
-    }
+    m_path = QTransform(transform).map(m_path);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PatternQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PatternQt.cpp
index b261613069..af7b128588 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PatternQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PatternQt.cpp
@@ -26,12 +26,12 @@
 #include "config.h"
 #include "Pattern.h"
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "GraphicsContext.h"
 
 namespace WebCore {
 
-QBrush Pattern::createPlatformPattern(const TransformationMatrix&) const
+QBrush Pattern::createPlatformPattern(const AffineTransform&) const
 {
     QPixmap* pixmap = tileImage()->nativeImageForCurrentFrame();
     if (!pixmap)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/StillImageQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/StillImageQt.cpp
index 95b3bc8c9b..4653c5833d 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/StillImageQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/StillImageQt.cpp
@@ -50,15 +50,50 @@ NativeImagePtr StillImage::nativeImageForCurrentFrame()
 }
 
 void StillImage::draw(GraphicsContext* ctxt, const FloatRect& dst,
-                      const FloatRect& src, CompositeOperator op)
+                      const FloatRect& src, ColorSpace, CompositeOperator op)
 {
     if (m_pixmap.isNull())
         return;
 
     ctxt->save();
     ctxt->setCompositeOperation(op);
+
+    // To support width or height is negative
+    float sx = src.x();
+    float sy = src.y();
+    float sw = src.width();
+    float sh = src.height();
+
+    if (sw < 0) {
+        sx = sx + sw;
+        sw = -sw;
+    }
+
+    if (sh < 0) {
+        sy = sy + sh;
+        sh = -sh;
+    }
+
+    float dx = dst.x();
+    float dy = dst.y();
+    float dw = dst.width();
+    float dh = dst.height();
+
+    if (dw < 0) {
+        dx = dx + dw;
+        dw = -dw;
+    }
+
+    if (dh < 0) {
+        dy = dy + dh;
+        dh = -dh;
+    }
+
+    FloatRect srcM(sx, sy, sw, sh);
+    FloatRect dstM(dx, dy, dw, dh);
     QPainter* painter(ctxt->platformContext());
-    painter->drawPixmap(dst, m_pixmap, src);
+
+    painter->drawPixmap(dstM, m_pixmap, srcM);
     ctxt->restore();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/StillImageQt.h b/src/3rdparty/webkit/WebCore/platform/graphics/qt/StillImageQt.h
index 6c417b14ac..7be9136529 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/StillImageQt.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/StillImageQt.h
@@ -46,7 +46,7 @@ namespace WebCore {
 
         virtual IntSize size() const;
         virtual NativeImagePtr nativeImageForCurrentFrame();
-        virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
+        virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator);
 
     private:
         StillImage(const QPixmap& pixmap);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/TileQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/TileQt.cpp
new file mode 100644
index 0000000000..9628448874
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/TileQt.cpp
@@ -0,0 +1,178 @@
+/*
+ Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ 
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+ 
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+ 
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "Tile.h"
+
+#if ENABLE(TILED_BACKING_STORE)
+
+#include "GraphicsContext.h"
+#include "TiledBackingStore.h"
+#include "TiledBackingStoreClient.h"
+#include <QApplication>
+#include <QObject>
+#include <QPainter>
+#include <QRegion>
+
+namespace WebCore {
+    
+static const unsigned checkerSize = 16;
+static const unsigned checkerColor1 = 0xff555555;
+static const unsigned checkerColor2 = 0xffaaaaaa;
+    
+static QPixmap& checkeredPixmap()
+{
+    static QPixmap* pixmap;
+    if (!pixmap) {
+        pixmap = new QPixmap(checkerSize, checkerSize);
+        QPainter painter(pixmap);
+        QColor color1(checkerColor1);
+        QColor color2(checkerColor2);
+        for (unsigned y = 0; y < checkerSize; y += checkerSize / 2) {
+            bool alternate = y % checkerSize;
+            for (unsigned x = 0; x < checkerSize; x += checkerSize / 2) {
+                painter.fillRect(x, y, checkerSize / 2, checkerSize / 2, alternate ? color1 : color2);
+                alternate = !alternate;
+            }
+        }
+    }
+    return *pixmap;
+}
+    
+Tile::Tile(TiledBackingStore* backingStore, const Coordinate& tileCoordinate)
+    : m_backingStore(backingStore)
+    , m_coordinate(tileCoordinate)
+    , m_rect(m_backingStore->tileRectForCoordinate(tileCoordinate))
+    , m_buffer(0)
+    , m_backBuffer(0)
+    , m_dirtyRegion(new QRegion(m_rect))
+{
+}
+
+Tile::~Tile()
+{
+    delete m_buffer;
+    delete m_backBuffer;
+    delete m_dirtyRegion;
+}
+
+bool Tile::isDirty() const 
+{ 
+    return !m_dirtyRegion->isEmpty(); 
+}
+
+bool Tile::isReadyToPaint() const
+{ 
+    return m_buffer; 
+}
+
+void Tile::invalidate(const IntRect& dirtyRect)
+{
+    IntRect tileDirtyRect = intersection(dirtyRect, m_rect);
+    if (tileDirtyRect.isEmpty())
+        return;
+
+    *m_dirtyRegion += tileDirtyRect;
+}
+    
+void Tile::updateBackBuffer()
+{
+    if (m_buffer && !isDirty())
+        return;
+
+    if (!m_backBuffer) {
+        if (!m_buffer)
+            m_backBuffer = new QPixmap(m_backingStore->m_tileSize.width(), m_backingStore->m_tileSize.height());
+        else {
+            // Currently all buffers are updated synchronously at the same time so there is no real need
+            // to have separate back and front buffers. Just use the existing buffer.
+            m_backBuffer = m_buffer;
+            m_buffer = 0;
+        }
+    }
+
+    QVector<QRect> dirtyRects = m_dirtyRegion->rects();
+    *m_dirtyRegion = QRegion();
+    
+    QPainter painter(m_backBuffer);
+    GraphicsContext context(&painter);
+    context.translate(-m_rect.x(), -m_rect.y());
+
+    int size = dirtyRects.size();
+    for (int n = 0; n < size; ++n)  {
+        context.save();
+        IntRect rect = dirtyRects[n];
+        context.clip(FloatRect(rect));
+        context.scale(FloatSize(m_backingStore->m_contentsScale, m_backingStore->m_contentsScale));
+        m_backingStore->m_client->tiledBackingStorePaint(&context, m_backingStore->mapToContents(rect));
+        context.restore();
+    }
+}
+
+void Tile::swapBackBufferToFront()
+{
+    if (!m_backBuffer)
+        return;
+    delete m_buffer;
+    m_buffer = m_backBuffer;
+    m_backBuffer = 0;
+}
+
+void Tile::paint(GraphicsContext* context, const IntRect& rect)
+{
+    if (!m_buffer)
+        return;
+    
+    IntRect target = intersection(rect, m_rect);
+    IntRect source((target.x() - m_rect.x()),
+                   (target.y() - m_rect.y()),
+                   target.width(),
+                   target.height());
+    
+    context->platformContext()->drawPixmap(target, *m_buffer, source);
+}
+    
+void Tile::paintCheckerPattern(GraphicsContext* context, const FloatRect& target)
+{
+    QPainter* painter = context->platformContext();
+    QTransform worldTransform = painter->worldTransform();
+    qreal scaleX = worldTransform.m11();
+    qreal scaleY = worldTransform.m22();
+    
+    QRect targetViewRect = QRectF(target.x() * scaleX,
+                                  target.y() * scaleY,
+                                  target.width() * scaleX,
+                                  target.height() * scaleY).toAlignedRect();
+    
+    QTransform adjustedTransform(1., worldTransform.m12(), worldTransform.m13(),
+                  worldTransform.m21(), 1., worldTransform.m23(),
+                  worldTransform.m31(), worldTransform.m32(), worldTransform.m33());
+    painter->setWorldTransform(adjustedTransform);
+    
+    painter->drawTiledPixmap(targetViewRect,
+                             checkeredPixmap(),
+                             QPoint(targetViewRect.left() % checkerSize,
+                                    targetViewRect.top() % checkerSize));
+    
+    painter->setWorldTransform(worldTransform);
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp
index 37b86f30f5..a5bc3c3cf0 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp
@@ -24,6 +24,7 @@
  */
 
 #include "config.h"
+#include "AffineTransform.h"
 #include "TransformationMatrix.h"
 
 #include "IntRect.h"
@@ -36,6 +37,11 @@ TransformationMatrix::operator QTransform() const
     return QTransform(m11(), m12(), m14(), m21(), m22(), m24(), m41(), m42(), m44());
 }
 
+AffineTransform::operator QTransform() const
+{
+    return QTransform(a(), b(), c(), d(), e(), f());
+}
+
 }
 
 // vim: ts=4 sw=4 et
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/AffineTransform.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/AffineTransform.cpp
new file mode 100644
index 0000000000..be18e07864
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/AffineTransform.cpp
@@ -0,0 +1,378 @@
+/*
+ * Copyright (C) 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ *               2010 Dirk Schulze <krit@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AffineTransform.h"
+
+#include "FloatConversion.h"
+#include "FloatQuad.h"
+#include "FloatRect.h"
+#include "IntRect.h"
+
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+static void affineTransformDecompose(const AffineTransform& matrix, double sr[9])
+{
+    AffineTransform m(matrix);
+
+    // Compute scaling factors
+    double sx = sqrt(m.a() * m.a() + m.b() * m.b());
+    double sy = sqrt(m.c() * m.c() + m.d() * m.d());
+
+    // Compute cross product of transformed unit vectors. If negative,
+    // one axis was flipped.
+    if (m.a() * m.d() - m.c() * m.b() < 0.0) {
+        // Flip axis with minimum unit vector dot product
+        if (m.a() < m.d())
+            sx = -sx;
+        else
+            sy = -sy;
+    }
+
+    // Remove scale from matrix
+    m.scale(1.0 / sx, 1.0 / sy);
+
+    // Compute rotation
+    double angle = atan2(m.b(), m.a());
+
+    // Remove rotation from matrix
+    m.rotate(rad2deg(-angle));
+
+    // Return results
+    sr[0] = sx;
+    sr[1] = sy;
+    sr[2] = angle;
+    sr[3] = m.a();
+    sr[4] = m.b();
+    sr[5] = m.c();
+    sr[6] = m.d();
+    sr[7] = m.e();
+    sr[8] = m.f();
+}
+
+static void affineTransformCompose(AffineTransform& m, const double sr[9])
+{
+    m.setA(sr[3]);
+    m.setB(sr[4]);
+    m.setC(sr[5]);
+    m.setD(sr[6]);
+    m.setE(sr[7]);
+    m.setF(sr[8]);
+    m.rotate(rad2deg(sr[2]));
+    m.scale(sr[0], sr[1]);
+}
+
+AffineTransform::AffineTransform()
+{
+    setMatrix(1, 0, 0, 1, 0, 0);
+}
+
+AffineTransform::AffineTransform(double a, double b, double c, double d, double e, double f)
+{
+    setMatrix(a, b, c, d, e, f);
+}
+
+void AffineTransform::makeIdentity()
+{
+    setMatrix(1, 0, 0, 1, 0, 0);
+}
+
+void AffineTransform::setMatrix(double a, double b, double c, double d, double e, double f)
+{
+    m_transform[0] = a;
+    m_transform[1] = b;
+    m_transform[2] = c;
+    m_transform[3] = d;
+    m_transform[4] = e;
+    m_transform[5] = f;
+}
+
+bool AffineTransform::isIdentity() const
+{
+    return (m_transform[0] == 1 && m_transform[1] == 0
+         && m_transform[2] == 0 && m_transform[3] == 1
+         && m_transform[4] == 0 && m_transform[5] == 0);
+}
+
+double AffineTransform::det() const
+{
+    return m_transform[0] * m_transform[3] - m_transform[1] * m_transform[2];
+}
+
+bool AffineTransform::isInvertible() const
+{
+    return det() != 0.0;
+}
+
+AffineTransform AffineTransform::inverse() const
+{
+    double determinant = det();
+    if (determinant == 0.0)
+        return AffineTransform();
+
+    AffineTransform result;
+    if (isIdentityOrTranslation()) {
+        result.m_transform[4] = -m_transform[4];
+        result.m_transform[5] = -m_transform[5];
+        return result;
+    }
+
+    result.m_transform[0] = m_transform[3] / determinant;
+    result.m_transform[1] = -m_transform[1] / determinant;
+    result.m_transform[2] = -m_transform[2] / determinant;
+    result.m_transform[3] = m_transform[0] / determinant;
+    result.m_transform[4] = (m_transform[2] * m_transform[5]
+                           - m_transform[3] * m_transform[4]) / determinant;
+    result.m_transform[5] = (m_transform[1] * m_transform[4]
+                           - m_transform[0] * m_transform[5]) / determinant;
+
+    return result;
+}
+
+AffineTransform& AffineTransform::multiply(const AffineTransform& other)
+{
+    return (*this) *= other;
+}
+
+AffineTransform& AffineTransform::multLeft(const AffineTransform& other)
+{
+    AffineTransform trans;
+    
+    trans.m_transform[0] = other.m_transform[0] * m_transform[0] + other.m_transform[1] * m_transform[2];
+    trans.m_transform[1] = other.m_transform[0] * m_transform[1] + other.m_transform[1] * m_transform[3];
+    trans.m_transform[2] = other.m_transform[2] * m_transform[0] + other.m_transform[3] * m_transform[2];
+    trans.m_transform[3] = other.m_transform[2] * m_transform[1] + other.m_transform[3] * m_transform[3];
+    trans.m_transform[4] = other.m_transform[4] * m_transform[0] + other.m_transform[5] * m_transform[2] + m_transform[4];
+    trans.m_transform[5] = other.m_transform[4] * m_transform[1] + other.m_transform[5] * m_transform[3] + m_transform[5];
+
+    setMatrix(trans.m_transform);
+    return *this;
+}
+
+AffineTransform& AffineTransform::rotate(double a)
+{
+    // angle is in degree. Switch to radian
+    a = deg2rad(a);
+    double cosAngle = cos(a);
+    double sinAngle = sin(a);
+    AffineTransform rot(cosAngle, sinAngle, -sinAngle, cosAngle, 0, 0);
+
+    multLeft(rot);
+    return *this;
+}
+
+AffineTransform& AffineTransform::scale(double s)
+{
+    return scale(s, s);
+}
+
+AffineTransform& AffineTransform::scale(double sx, double sy)
+{
+    m_transform[0] *= sx;
+    m_transform[1] *= sx;
+    m_transform[2] *= sy;
+    m_transform[3] *= sy;
+    return *this;
+}
+
+// *this = *this * translation
+AffineTransform& AffineTransform::translate(double tx, double ty)
+{
+    if (isIdentityOrTranslation()) {
+        m_transform[4] += tx;
+        m_transform[5] += ty;
+        return *this;
+    }
+        
+    m_transform[4] += tx * m_transform[0] + ty * m_transform[2];
+    m_transform[5] += tx * m_transform[1] + ty * m_transform[3];
+    return *this;
+}
+
+// *this = translation * *this
+AffineTransform& AffineTransform::translateRight(double tx, double ty)
+{
+    m_transform[4] += tx;
+    m_transform[5] += ty;
+    return *this;
+}
+
+AffineTransform& AffineTransform::scaleNonUniform(double sx, double sy)
+{
+    return scale(sx, sy);
+}
+
+AffineTransform& AffineTransform::rotateFromVector(double x, double y)
+{
+    return rotate(rad2deg(atan2(y, x)));
+}
+
+AffineTransform& AffineTransform::flipX()
+{
+    return scale(-1, 1);
+}
+
+AffineTransform& AffineTransform::flipY()
+{
+    return scale(1, -1);
+}
+
+AffineTransform& AffineTransform::shear(double sx, double sy)
+{
+    double a = m_transform[0];
+    double b = m_transform[1];
+
+    m_transform[0] += sy * m_transform[2];
+    m_transform[1] += sy * m_transform[3];
+    m_transform[2] += sx * a;
+    m_transform[3] += sx * b;
+
+    return *this;
+}
+
+AffineTransform& AffineTransform::skew(double angleX, double angleY)
+{
+    return shear(tan(deg2rad(angleX)), tan(deg2rad(angleY)));
+}
+
+AffineTransform& AffineTransform::skewX(double angle)
+{
+    return shear(tan(deg2rad(angle)), 0);
+}
+
+AffineTransform& AffineTransform::skewY(double angle)
+{
+    return shear(0, tan(deg2rad(angle)));
+}
+
+AffineTransform makeMapBetweenRects(const FloatRect& source, const FloatRect& dest)
+{
+    AffineTransform transform;
+    transform.translate(dest.x() - source.x(), dest.y() - source.y());
+    transform.scale(dest.width() / source.width(), dest.height() / source.height());
+    return transform;
+}
+
+void AffineTransform::map(double x, double y, double& x2, double& y2) const
+{
+    x2 = (m_transform[0] * x + m_transform[2] * y + m_transform[4]);
+    y2 = (m_transform[1] * x + m_transform[3] * y + m_transform[5]);
+}
+
+IntPoint AffineTransform::mapPoint(const IntPoint& point) const
+{
+    double x2, y2;
+    map(point.x(), point.y(), x2, y2);
+    
+    // Round the point.
+    return IntPoint(lround(x2), lround(y2));
+}
+
+FloatPoint AffineTransform::mapPoint(const FloatPoint& point) const
+{
+    double x2, y2;
+    map(point.x(), point.y(), x2, y2);
+
+    return FloatPoint(narrowPrecisionToFloat(x2), narrowPrecisionToFloat(y2));
+}
+
+IntRect AffineTransform::mapRect(const IntRect &rect) const
+{
+    return enclosingIntRect(mapRect(FloatRect(rect)));
+}
+
+FloatRect AffineTransform::mapRect(const FloatRect& rect) const
+{
+    if (isIdentityOrTranslation()) {
+        FloatRect mappedRect(rect);
+        mappedRect.move(narrowPrecisionToFloat(m_transform[4]), narrowPrecisionToFloat(m_transform[5]));
+        return mappedRect;
+    }
+
+    FloatQuad result;
+    result.setP1(mapPoint(rect.location()));
+    result.setP2(mapPoint(FloatPoint(rect.right(), rect.y())));
+    result.setP3(mapPoint(FloatPoint(rect.right(), rect.bottom())));
+    result.setP4(mapPoint(FloatPoint(rect.x(), rect.bottom())));
+    return result.boundingBox();
+}
+
+FloatQuad AffineTransform::mapQuad(const FloatQuad& q) const
+{
+    if (isIdentityOrTranslation()) {
+        FloatQuad mappedQuad(q);
+        mappedQuad.move(narrowPrecisionToFloat(m_transform[4]), narrowPrecisionToFloat(m_transform[5]));
+        return mappedQuad;
+    }
+
+    FloatQuad result;
+    result.setP1(mapPoint(q.p1()));
+    result.setP2(mapPoint(q.p2()));
+    result.setP3(mapPoint(q.p3()));
+    result.setP4(mapPoint(q.p4()));
+    return result;
+}
+
+void AffineTransform::blend(const AffineTransform& from, double progress)
+{
+    double srA[9], srB[9];
+
+    affineTransformDecompose(from, srA);
+    affineTransformDecompose(*this, srB);
+
+    // If x-axis of one is flipped, and y-axis of the other, convert to an unflipped rotation.
+    if ((srA[0] < 0 && srB[1] < 0) || (srA[1] < 0 &&  srB[0] < 0)) {
+        srA[0] = -srA[0];
+        srA[1] = -srA[1];
+        srA[2] += srA[2] < 0 ? piDouble : -piDouble;
+    }
+
+    // Don't rotate the long way around.
+    srA[2] = fmod(srA[2], 2.0 * piDouble);
+    srB[2] = fmod(srB[2], 2.0 * piDouble);
+
+    if (fabs(srA[2] - srB[2]) > piDouble) {
+        if (srA[2] > srB[2])
+            srA[2] -= piDouble * 2.0;
+        else
+            srB[2] -= piDouble * 2.0;
+    }
+
+    for (int i = 0; i < 9; i++)
+        srA[i] = srA[i] + progress * (srB[i] - srA[i]);
+
+    affineTransformCompose(*this, srA);
+}
+
+TransformationMatrix AffineTransform::toTransformationMatrix() const
+{
+    return TransformationMatrix(m_transform[0], m_transform[1], m_transform[2],
+                                m_transform[3], m_transform[4], m_transform[5]);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/AffineTransform.h b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/AffineTransform.h
new file mode 100644
index 0000000000..289ec5437a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/AffineTransform.h
@@ -0,0 +1,187 @@
+/*
+ * Copyright (C) 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ *               2010 Dirk Schulze <krit@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef AffineTransform_h
+#define AffineTransform_h
+
+#include "TransformationMatrix.h"
+
+#include <string.h> // for memcpy
+#include <wtf/FastAllocBase.h>
+
+#if PLATFORM(CG)
+#include <CoreGraphics/CGAffineTransform.h>
+#elif PLATFORM(CAIRO)
+#include <cairo.h>
+#elif PLATFORM(OPENVG)
+#include "VGUtils.h"
+#elif PLATFORM(QT)
+#include <QTransform>
+#elif PLATFORM(SKIA)
+#include <SkMatrix.h>
+#elif PLATFORM(WX) && USE(WXGC)
+#include <wx/graphics.h>
+#endif
+
+namespace WebCore {
+
+class FloatPoint;
+class FloatQuad;
+class FloatRect;
+class IntPoint;
+class IntRect;
+class TransformationMatrix;
+
+class AffineTransform : public FastAllocBase {
+public:
+    typedef double Transform[6];
+
+    AffineTransform();
+    AffineTransform(double a, double b, double c, double d, double e, double f);
+
+    void setMatrix(double a, double b, double c, double d, double e, double f);
+
+    void map(double x, double y, double& x2, double& y2) const;
+
+    // Rounds the mapped point to the nearest integer value.
+    IntPoint mapPoint(const IntPoint&) const;
+
+    FloatPoint mapPoint(const FloatPoint&) const;
+
+    // Rounds the resulting mapped rectangle out. This is helpful for bounding
+    // box computations but may not be what is wanted in other contexts.
+    IntRect mapRect(const IntRect&) const;
+
+    FloatRect mapRect(const FloatRect&) const;
+    FloatQuad mapQuad(const FloatQuad&) const;
+
+    bool isIdentity() const;
+
+    double a() const { return m_transform[0]; }
+    void setA(double a) { m_transform[0] = a; }
+    double b() const { return m_transform[1]; }
+    void setB(double b) { m_transform[1] = b; }
+    double c() const { return m_transform[2]; }
+    void setC(double c) { m_transform[2] = c; }
+    double d() const { return m_transform[3]; }
+    void setD(double d) { m_transform[3] = d; }
+    double e() const { return m_transform[4]; }
+    void setE(double e) { m_transform[4] = e; }
+    double f() const { return m_transform[5]; }
+    void setF(double f) { m_transform[5] = f; }
+
+    void makeIdentity();
+
+    AffineTransform& multiply(const AffineTransform&);
+    AffineTransform& multLeft(const AffineTransform&);
+    AffineTransform& scale(double); 
+    AffineTransform& scale(double sx, double sy); 
+    AffineTransform& scaleNonUniform(double sx, double sy);
+    AffineTransform& rotate(double d);
+    AffineTransform& rotateFromVector(double x, double y);
+    AffineTransform& translate(double tx, double ty);
+    AffineTransform& translateRight(double tx, double ty);
+    AffineTransform& shear(double sx, double sy);
+    AffineTransform& flipX();
+    AffineTransform& flipY();
+    AffineTransform& skew(double angleX, double angleY);
+    AffineTransform& skewX(double angle);
+    AffineTransform& skewY(double angle);
+ 
+    double det() const;
+    bool isInvertible() const;
+    AffineTransform inverse() const;
+
+    void blend(const AffineTransform& from, double progress);
+
+    TransformationMatrix toTransformationMatrix() const;
+
+    bool isIdentityOrTranslation() const
+    {
+        return m_transform[0] == 1 && m_transform[1] == 0 && m_transform[2] == 0 && m_transform[3] == 1;
+    }
+    
+    bool isIdentityOrTranslationOrFlipped() const
+    {
+        return m_transform[0] == 1 && m_transform[1] == 0 && m_transform[2] == 0 && (m_transform[3] == 1 || m_transform[3] == -1);
+    }
+
+    bool operator== (const AffineTransform& m2) const
+    {
+        return (m_transform[0] == m2.m_transform[0]
+             && m_transform[1] == m2.m_transform[1]
+             && m_transform[2] == m2.m_transform[2]
+             && m_transform[3] == m2.m_transform[3]
+             && m_transform[4] == m2.m_transform[4]
+             && m_transform[5] == m2.m_transform[5]);
+    }
+
+    bool operator!=(const AffineTransform& other) const { return !(*this == other); }
+
+    // *this = *this * t (i.e., a multRight)
+    AffineTransform& operator*=(const AffineTransform& t)
+    {
+        *this = *this * t;
+        return *this;
+    }
+    
+    // result = *this * t (i.e., a multRight)
+    AffineTransform operator*(const AffineTransform& t) const
+    {
+        AffineTransform result = t;
+        result.multLeft(*this);
+        return result;
+    }
+
+#if PLATFORM(CG)
+    operator CGAffineTransform() const;
+#elif PLATFORM(CAIRO)
+    operator cairo_matrix_t() const;
+#elif PLATFORM(OPENVG)
+    operator VGMatrix() const;
+#elif PLATFORM(QT)
+    operator QTransform() const;
+#elif PLATFORM(SKIA)
+    operator SkMatrix() const;
+#elif PLATFORM(WX) && USE(WXGC)
+    operator wxGraphicsMatrix() const;
+#endif
+
+private:
+    void setMatrix(const Transform m)
+    {
+        if (m && m != m_transform)
+            memcpy(m_transform, m, sizeof(Transform));
+    }
+
+    Transform m_transform;
+};
+
+AffineTransform makeMapBetweenRects(const FloatRect& source, const FloatRect& dest);
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperations.h b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperations.h
index dd56408431..08efd230ca 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperations.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperations.h
@@ -31,7 +31,7 @@
 
 namespace WebCore {
 
-class TransformOperations {
+class TransformOperations : public FastAllocBase {
 public:
     TransformOperations(bool makeIdentity = false);
     
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
index 13ef281315..0400d40396 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
@@ -999,6 +999,12 @@ void TransformationMatrix::makeAffine()
     m_matrix[3][3] = 1;
 }
 
+AffineTransform TransformationMatrix::toAffineTransform() const
+{
+    return AffineTransform(m_matrix[0][0], m_matrix[0][1], m_matrix[1][0],
+                           m_matrix[1][1], m_matrix[3][0], m_matrix[3][1]);
+}
+
 static inline void blendFloat(double& from, double to, double progress)
 {
     if (from != to)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.h b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.h
index 83719d21b7..cdf101d960 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.h
@@ -26,14 +26,18 @@
 #ifndef TransformationMatrix_h
 #define TransformationMatrix_h
 
+#include "AffineTransform.h"
 #include "FloatPoint.h"
 #include "IntPoint.h"
 #include <string.h> //for memcpy
+#include <wtf/FastAllocBase.h>
 
 #if PLATFORM(CG)
 #include <CoreGraphics/CGAffineTransform.h>
 #elif PLATFORM(CAIRO)
 #include <cairo.h>
+#elif PLATFORM(OPENVG)
+#include "VGUtils.h"
 #elif PLATFORM(QT)
 #include <QTransform>
 #elif PLATFORM(SKIA)
@@ -42,14 +46,23 @@
 #include <wx/graphics.h>
 #endif
 
+#if PLATFORM(WIN) || (PLATFORM(QT) && OS(WINDOWS)) || (PLATFORM(WX) && OS(WINDOWS))
+#if COMPILER(MINGW)
+typedef struct _XFORM XFORM;
+#else
+typedef struct tagXFORM XFORM;
+#endif
+#endif
+
 namespace WebCore {
 
+class AffineTransform;
 class IntRect;
 class FloatPoint3D;
 class FloatRect;
 class FloatQuad;
 
-class TransformationMatrix {
+class TransformationMatrix : public FastAllocBase {
 public:
     typedef double Matrix4[4][4];
 
@@ -257,6 +270,8 @@ public:
     // Throw away the non-affine parts of the matrix (lossy!)
     void makeAffine();
 
+    AffineTransform toAffineTransform() const;
+
     bool operator==(const TransformationMatrix& m2) const
     {
         return (m_matrix[0][0] == m2.m_matrix[0][0] &&
@@ -298,6 +313,8 @@ public:
     operator CGAffineTransform() const;
 #elif PLATFORM(CAIRO)
     operator cairo_matrix_t() const;
+#elif PLATFORM(OPENVG)
+    operator VGMatrix() const;
 #elif PLATFORM(QT)
     operator QTransform() const;
 #elif PLATFORM(SKIA)
@@ -306,31 +323,31 @@ public:
     operator wxGraphicsMatrix() const;
 #endif
 
-#if PLATFORM(WIN)
+#if PLATFORM(WIN) || (PLATFORM(QT) && OS(WINDOWS)) || (PLATFORM(WX) && OS(WINDOWS))
     operator XFORM() const;
 #endif
 
+    bool isIdentityOrTranslation() const
+    {
+        return m_matrix[0][0] == 1 && m_matrix[0][1] == 0 && m_matrix[0][2] == 0 && m_matrix[0][3] == 0
+            && m_matrix[1][0] == 0 && m_matrix[1][1] == 1 && m_matrix[1][2] == 0 && m_matrix[1][3] == 0
+            && m_matrix[2][0] == 0 && m_matrix[2][1] == 0 && m_matrix[2][2] == 1 && m_matrix[2][3] == 0
+            && m_matrix[3][3] == 1;
+    }
+
 private:
     // multiply passed 2D point by matrix (assume z=0)
     void multVecMatrix(double x, double y, double& dstX, double& dstY) const;
-    
+
     // multiply passed 3D point by matrix
     void multVecMatrix(double x, double y, double z, double& dstX, double& dstY, double& dstZ) const;
-    
+
     void setMatrix(const Matrix4 m)
     {
         if (m && m != m_matrix)
             memcpy(m_matrix, m, sizeof(Matrix4));
     }
-    
-    bool isIdentityOrTranslation() const
-    {
-        return m_matrix[0][0] == 1 && m_matrix[0][1] == 0 && m_matrix[0][2] == 0 && m_matrix[0][3] == 0 &&
-               m_matrix[1][0] == 0 && m_matrix[1][1] == 1 && m_matrix[1][2] == 0 && m_matrix[1][3] == 0 &&
-               m_matrix[2][0] == 0 && m_matrix[2][1] == 0 && m_matrix[2][2] == 1 && m_matrix[2][3] == 0 &&
-               m_matrix[3][3] == 1;
-    }
-    
+
     Matrix4 m_matrix;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCGWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCGWin.cpp
new file mode 100644
index 0000000000..e4eb1598e3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCGWin.cpp
@@ -0,0 +1,386 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Font.h"
+
+#include "AffineTransform.h"
+#include "FloatConversion.h"
+#include "GlyphBuffer.h"
+#include "GraphicsContext.h"
+#include "IntRect.h"
+#include "SimpleFontData.h"
+#include "UniscribeController.h"
+#include "WebCoreTextRenderer.h"
+#include <ApplicationServices/ApplicationServices.h>
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+const int syntheticObliqueAngle = 14;
+
+static inline CGFloat toCGFloat(FIXED f)
+{
+    return f.value + f.fract / CGFloat(65536.0);
+}
+
+static CGPathRef createPathForGlyph(HDC hdc, Glyph glyph)
+{
+    CGMutablePathRef path = CGPathCreateMutable();
+
+    static const MAT2 identity = { 0, 1,  0, 0,  0, 0,  0, 1 };
+    GLYPHMETRICS glyphMetrics;
+    // GGO_NATIVE matches the outline perfectly when Windows font smoothing is off.
+    // GGO_NATIVE | GGO_UNHINTED does not match perfectly either when Windows font smoothing is on or off.
+    DWORD outlineLength = GetGlyphOutline(hdc, glyph, GGO_GLYPH_INDEX | GGO_NATIVE, &glyphMetrics, 0, 0, &identity);
+    ASSERT(outlineLength >= 0);
+    if (outlineLength < 0)
+        return path;
+
+    Vector<UInt8> outline(outlineLength);
+    GetGlyphOutline(hdc, glyph, GGO_GLYPH_INDEX | GGO_NATIVE, &glyphMetrics, outlineLength, outline.data(), &identity);
+
+    unsigned offset = 0;
+    while (offset < outlineLength) {
+        LPTTPOLYGONHEADER subpath = reinterpret_cast<LPTTPOLYGONHEADER>(outline.data() + offset);
+        ASSERT(subpath->dwType == TT_POLYGON_TYPE);
+        if (subpath->dwType != TT_POLYGON_TYPE)
+            return path;
+
+        CGPathMoveToPoint(path, 0, toCGFloat(subpath->pfxStart.x), toCGFloat(subpath->pfxStart.y));
+
+        unsigned subpathOffset = sizeof(*subpath);
+        while (subpathOffset < subpath->cb) {
+            LPTTPOLYCURVE segment = reinterpret_cast<LPTTPOLYCURVE>(reinterpret_cast<UInt8*>(subpath) + subpathOffset);
+            switch (segment->wType) {
+                case TT_PRIM_LINE:
+                    for (unsigned i = 0; i < segment->cpfx; i++)
+                        CGPathAddLineToPoint(path, 0, toCGFloat(segment->apfx[i].x), toCGFloat(segment->apfx[i].y));
+                    break;
+
+                case TT_PRIM_QSPLINE:
+                    for (unsigned i = 0; i < segment->cpfx; i++) {
+                        CGFloat x = toCGFloat(segment->apfx[i].x);
+                        CGFloat y = toCGFloat(segment->apfx[i].y);
+                        CGFloat cpx;
+                        CGFloat cpy;
+
+                        if (i == segment->cpfx - 2) {
+                            cpx = toCGFloat(segment->apfx[i + 1].x);
+                            cpy = toCGFloat(segment->apfx[i + 1].y);
+                            i++;
+                        } else {
+                            cpx = (toCGFloat(segment->apfx[i].x) + toCGFloat(segment->apfx[i + 1].x)) / 2;
+                            cpy = (toCGFloat(segment->apfx[i].y) + toCGFloat(segment->apfx[i + 1].y)) / 2;
+                        }
+
+                        CGPathAddQuadCurveToPoint(path, 0, x, y, cpx, cpy);
+                    }
+                    break;
+
+                case TT_PRIM_CSPLINE:
+                    for (unsigned i = 0; i < segment->cpfx; i += 3) {
+                        CGFloat cp1x = toCGFloat(segment->apfx[i].x);
+                        CGFloat cp1y = toCGFloat(segment->apfx[i].y);
+                        CGFloat cp2x = toCGFloat(segment->apfx[i + 1].x);
+                        CGFloat cp2y = toCGFloat(segment->apfx[i + 1].y);
+                        CGFloat x = toCGFloat(segment->apfx[i + 2].x);
+                        CGFloat y = toCGFloat(segment->apfx[i + 2].y);
+
+                        CGPathAddCurveToPoint(path, 0, cp1x, cp1y, cp2x, cp2y, x, y);
+                    }
+                    break;
+
+                default:
+                    ASSERT_NOT_REACHED();
+                    return path;
+            }
+
+            subpathOffset += sizeof(*segment) + (segment->cpfx - 1) * sizeof(segment->apfx[0]);
+        }
+        CGPathCloseSubpath(path);
+        offset += subpath->cb;
+    }
+    return path;
+}
+
+static void drawGDIGlyphs(GraphicsContext* graphicsContext, const SimpleFontData* font, const GlyphBuffer& glyphBuffer, 
+                      int from, int numGlyphs, const FloatPoint& point)
+{
+    Color fillColor = graphicsContext->fillColor();
+
+    bool drawIntoBitmap = false;
+    int drawingMode = graphicsContext->textDrawingMode();
+    if (drawingMode == cTextFill) {
+        if (!fillColor.alpha())
+            return;
+
+        drawIntoBitmap = fillColor.alpha() != 255 || graphicsContext->inTransparencyLayer();
+        if (!drawIntoBitmap) {
+            IntSize size;
+            int blur;
+            Color color;
+            graphicsContext->getShadow(size, blur, color);
+            drawIntoBitmap = !size.isEmpty() || blur;
+        }
+    }
+
+    // We have to convert CG's two-dimensional floating point advances to just horizontal integer advances.
+    Vector<int, 2048> gdiAdvances;
+    int totalWidth = 0;
+    for (int i = 0; i < numGlyphs; i++) {
+        gdiAdvances.append(lroundf(glyphBuffer.advanceAt(from + i)));
+        totalWidth += gdiAdvances[i];
+    }
+
+    HDC hdc = 0;
+    OwnPtr<GraphicsContext::WindowsBitmap> bitmap;
+    IntRect textRect;
+    if (!drawIntoBitmap)
+        hdc = graphicsContext->getWindowsContext(textRect, true, false);
+    if (!hdc) {
+        drawIntoBitmap = true;
+        // We put slop into this rect, since glyphs can overflow the ascent/descent bounds and the left/right edges.
+        // FIXME: Can get glyphs' optical bounds (even from CG) to get this right.
+        int lineGap = font->lineGap();
+        textRect = IntRect(point.x() - (font->ascent() + font->descent()) / 2, point.y() - font->ascent() - lineGap, totalWidth + font->ascent() + font->descent(), font->lineSpacing());
+        bitmap.set(graphicsContext->createWindowsBitmap(textRect.size()));
+        memset(bitmap->buffer(), 255, bitmap->bufferLength());
+        hdc = bitmap->hdc();
+
+        XFORM xform;
+        xform.eM11 = 1.0f;
+        xform.eM12 = 0.0f;
+        xform.eM21 = 0.0f;
+        xform.eM22 = 1.0f;
+        xform.eDx = -textRect.x();
+        xform.eDy = -textRect.y();
+        SetWorldTransform(hdc, &xform);
+    }
+
+    SelectObject(hdc, font->platformData().hfont());
+
+    // Set the correct color.
+    if (drawIntoBitmap)
+        SetTextColor(hdc, RGB(0, 0, 0));
+    else
+        SetTextColor(hdc, RGB(fillColor.red(), fillColor.green(), fillColor.blue()));
+
+    SetBkMode(hdc, TRANSPARENT);
+    SetTextAlign(hdc, TA_LEFT | TA_BASELINE);
+
+    // Uniscribe gives us offsets to help refine the positioning of combining glyphs.
+    FloatSize translation = glyphBuffer.offsetAt(from);
+    if (translation.width() || translation.height()) {
+        XFORM xform;
+        xform.eM11 = 1.0;
+        xform.eM12 = 0;
+        xform.eM21 = 0;
+        xform.eM22 = 1.0;
+        xform.eDx = translation.width();
+        xform.eDy = translation.height();
+        ModifyWorldTransform(hdc, &xform, MWT_LEFTMULTIPLY);
+    }
+
+    if (drawingMode == cTextFill) {
+        XFORM xform;
+        xform.eM11 = 1.0;
+        xform.eM12 = 0;
+        xform.eM21 = font->platformData().syntheticOblique() ? -tanf(syntheticObliqueAngle * piFloat / 180.0f) : 0;
+        xform.eM22 = 1.0;
+        xform.eDx = point.x();
+        xform.eDy = point.y();
+        ModifyWorldTransform(hdc, &xform, MWT_LEFTMULTIPLY);
+        ExtTextOut(hdc, 0, 0, ETO_GLYPH_INDEX, 0, reinterpret_cast<const WCHAR*>(glyphBuffer.glyphs(from)), numGlyphs, gdiAdvances.data());
+        if (font->syntheticBoldOffset()) {
+            xform.eM21 = 0;
+            xform.eDx = font->syntheticBoldOffset();
+            xform.eDy = 0;
+            ModifyWorldTransform(hdc, &xform, MWT_LEFTMULTIPLY);
+            ExtTextOut(hdc, 0, 0, ETO_GLYPH_INDEX, 0, reinterpret_cast<const WCHAR*>(glyphBuffer.glyphs(from)), numGlyphs, gdiAdvances.data());
+        }
+    } else {
+        XFORM xform;
+        GetWorldTransform(hdc, &xform);
+        AffineTransform hdcTransform(xform.eM11, xform.eM21, xform.eM12, xform.eM22, xform.eDx, xform.eDy);
+        CGAffineTransform initialGlyphTransform = hdcTransform.isInvertible() ? hdcTransform.inverse() : CGAffineTransformIdentity;
+        if (font->platformData().syntheticOblique())
+            initialGlyphTransform = CGAffineTransformConcat(initialGlyphTransform, CGAffineTransformMake(1, 0, tanf(syntheticObliqueAngle * piFloat / 180.0f), 1, 0, 0));
+        initialGlyphTransform.tx = 0;
+        initialGlyphTransform.ty = 0;
+        CGContextRef cgContext = graphicsContext->platformContext();
+
+        CGContextSaveGState(cgContext);
+
+        BOOL fontSmoothingEnabled = false;
+        SystemParametersInfo(SPI_GETFONTSMOOTHING, 0, &fontSmoothingEnabled, 0);
+        CGContextSetShouldAntialias(cgContext, fontSmoothingEnabled);
+
+        CGContextScaleCTM(cgContext, 1.0, -1.0);
+        CGContextTranslateCTM(cgContext, point.x() + glyphBuffer.offsetAt(from).width(), -(point.y() + glyphBuffer.offsetAt(from).height()));
+
+        for (unsigned i = 0; i < numGlyphs; ++i) {
+            RetainPtr<CGPathRef> glyphPath(AdoptCF, createPathForGlyph(hdc, glyphBuffer.glyphAt(from + i)));
+            CGContextSaveGState(cgContext);
+            CGContextConcatCTM(cgContext, initialGlyphTransform);
+
+            if (drawingMode & cTextFill) {
+                CGContextAddPath(cgContext, glyphPath.get());
+                CGContextFillPath(cgContext);
+                if (font->syntheticBoldOffset()) {
+                    CGContextTranslateCTM(cgContext, font->syntheticBoldOffset(), 0);
+                    CGContextAddPath(cgContext, glyphPath.get());
+                    CGContextFillPath(cgContext);
+                    CGContextTranslateCTM(cgContext, -font->syntheticBoldOffset(), 0);
+                }
+            }
+            if (drawingMode & cTextStroke) {
+                CGContextAddPath(cgContext, glyphPath.get());
+                CGContextStrokePath(cgContext);
+                if (font->syntheticBoldOffset()) {
+                    CGContextTranslateCTM(cgContext, font->syntheticBoldOffset(), 0);
+                    CGContextAddPath(cgContext, glyphPath.get());
+                    CGContextStrokePath(cgContext);
+                    CGContextTranslateCTM(cgContext, -font->syntheticBoldOffset(), 0);
+                }
+            }
+
+            CGContextRestoreGState(cgContext);
+            CGContextTranslateCTM(cgContext, gdiAdvances[i], 0);
+        }
+
+        CGContextRestoreGState(cgContext);
+    }
+
+    if (drawIntoBitmap) {
+        UInt8* buffer = bitmap->buffer();
+        unsigned bufferLength = bitmap->bufferLength();
+        for (unsigned i = 0; i < bufferLength; i += 4) {
+            // Use green, which is always in the middle.
+            UInt8 alpha = (255 - buffer[i + 1]) * fillColor.alpha() / 255;
+            buffer[i] = fillColor.blue();
+            buffer[i + 1] = fillColor.green();
+            buffer[i + 2] = fillColor.red();
+            buffer[i + 3] = alpha;
+        }
+        graphicsContext->drawWindowsBitmap(bitmap.get(), textRect.topLeft());
+    } else
+        graphicsContext->releaseWindowsContext(hdc, textRect, true, false);
+}
+
+void Font::drawGlyphs(GraphicsContext* graphicsContext, const SimpleFontData* font, const GlyphBuffer& glyphBuffer, 
+                      int from, int numGlyphs, const FloatPoint& point) const
+{
+    CGContextRef cgContext = graphicsContext->platformContext();
+    bool shouldUseFontSmoothing = WebCoreShouldUseFontSmoothing();
+
+    switch(fontDescription().fontSmoothing()) {
+    case Antialiased: {
+        graphicsContext->setShouldAntialias(true);
+        shouldUseFontSmoothing = false;
+        break;
+    }
+    case SubpixelAntialiased: {
+        graphicsContext->setShouldAntialias(true);
+        shouldUseFontSmoothing = true;
+        break;
+    }
+    case NoSmoothing: {
+        graphicsContext->setShouldAntialias(false);
+        shouldUseFontSmoothing = false;
+        break;
+    }
+    case AutoSmoothing: {
+        // For the AutoSmooth case, don't do anything! Keep the default settings.
+        break; 
+    }
+    default: 
+        ASSERT_NOT_REACHED();
+    }
+
+    if (font->platformData().useGDI() && !shouldUseFontSmoothing) {
+        drawGDIGlyphs(graphicsContext, font, glyphBuffer, from, numGlyphs, point);
+        return;
+    }
+
+    uint32_t oldFontSmoothingStyle = wkSetFontSmoothingStyle(cgContext, shouldUseFontSmoothing);
+
+    const FontPlatformData& platformData = font->platformData();
+
+    CGContextSetFont(cgContext, platformData.cgFont());
+
+    CGAffineTransform matrix = CGAffineTransformIdentity;
+    matrix.b = -matrix.b;
+    matrix.d = -matrix.d;
+
+    if (platformData.syntheticOblique()) {
+        static float skew = -tanf(syntheticObliqueAngle * piFloat / 180.0f);
+        matrix = CGAffineTransformConcat(matrix, CGAffineTransformMake(1, 0, skew, 1, 0, 0));
+    }
+
+    CGContextSetTextMatrix(cgContext, matrix);
+
+    // Uniscribe gives us offsets to help refine the positioning of combining glyphs.
+    FloatSize translation = glyphBuffer.offsetAt(from);
+
+    CGContextSetFontSize(cgContext, platformData.size());
+    wkSetCGContextFontRenderingStyle(cgContext, font->isSystemFont(), false, font->platformData().useGDI());
+
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    graphicsContext->getShadow(shadowSize, shadowBlur, shadowColor);
+
+    bool hasSimpleShadow = graphicsContext->textDrawingMode() == cTextFill && shadowColor.isValid() && !shadowBlur;
+    if (hasSimpleShadow) {
+        // Paint simple shadows ourselves instead of relying on CG shadows, to avoid losing subpixel antialiasing.
+        graphicsContext->clearShadow();
+        Color fillColor = graphicsContext->fillColor();
+        Color shadowFillColor(shadowColor.red(), shadowColor.green(), shadowColor.blue(), shadowColor.alpha() * fillColor.alpha() / 255);
+        graphicsContext->setFillColor(shadowFillColor, DeviceColorSpace);
+        CGContextSetTextPosition(cgContext, point.x() + translation.width() + shadowSize.width(), point.y() + translation.height() + shadowSize.height());
+        CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
+        if (font->syntheticBoldOffset()) {
+            CGContextSetTextPosition(cgContext, point.x() + translation.width() + shadowSize.width() + font->syntheticBoldOffset(), point.y() + translation.height() + shadowSize.height());
+            CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
+        }
+        graphicsContext->setFillColor(fillColor, DeviceColorSpace);
+    }
+
+    CGContextSetTextPosition(cgContext, point.x() + translation.width(), point.y() + translation.height());
+    CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
+    if (font->syntheticBoldOffset()) {
+        CGContextSetTextPosition(cgContext, point.x() + translation.width() + font->syntheticBoldOffset(), point.y() + translation.height());
+        CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
+    }
+
+    if (hasSimpleShadow)
+        graphicsContext->setShadow(shadowSize, shadowBlur, shadowColor, DeviceColorSpace);
+
+    wkRestoreFontSmoothingStyle(cgContext, oldFontSmoothingStyle);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCacheWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCacheWin.cpp
new file mode 100644
index 0000000000..5bdc3cf7de
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCacheWin.cpp
@@ -0,0 +1,557 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include <winsock2.h>
+#include "FontCache.h"
+#include "Font.h"
+#include "SimpleFontData.h"
+#include "StringHash.h"
+#include "UnicodeRange.h"
+#include <mlang.h>
+#include <windows.h>
+#include <wtf/StdLibExtras.h>
+#if PLATFORM(CG)
+#include <ApplicationServices/ApplicationServices.h>
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#endif
+
+using std::min;
+
+namespace WebCore
+{
+
+void FontCache::platformInit()
+{
+#if PLATFORM(CG)
+    wkSetUpFontCache(1536 * 1024 * 4); // This size matches Mac.
+#endif
+}
+
+IMLangFontLink2* FontCache::getFontLinkInterface()
+{
+    static IMultiLanguage *multiLanguage;
+    if (!multiLanguage) {
+        if (CoCreateInstance(CLSID_CMultiLanguage, 0, CLSCTX_ALL, IID_IMultiLanguage, (void**)&multiLanguage) != S_OK)
+            return 0;
+    }
+
+    static IMLangFontLink2* langFontLink;
+    if (!langFontLink) {
+        if (multiLanguage->QueryInterface(&langFontLink) != S_OK)
+            return 0;
+    }
+
+    return langFontLink;
+}
+
+static int CALLBACK metaFileEnumProc(HDC hdc, HANDLETABLE* table, CONST ENHMETARECORD* record, int tableEntries, LPARAM logFont)
+{
+    if (record->iType == EMR_EXTCREATEFONTINDIRECTW) {
+        const EMREXTCREATEFONTINDIRECTW* createFontRecord = reinterpret_cast<const EMREXTCREATEFONTINDIRECTW*>(record);
+        *reinterpret_cast<LOGFONT*>(logFont) = createFontRecord->elfw.elfLogFont;
+    }
+    return true;
+}
+
+static int CALLBACK linkedFontEnumProc(CONST LOGFONT* logFont, CONST TEXTMETRIC* metrics, DWORD fontType, LPARAM hfont)
+{
+    *reinterpret_cast<HFONT*>(hfont) = CreateFontIndirect(logFont);
+    return false;
+}
+
+static const Vector<String>* getLinkedFonts(String& family)
+{
+    static HashMap<String, Vector<String>*> systemLinkMap;
+    Vector<String>* result = systemLinkMap.get(family);
+    if (result)
+        return result;
+
+    result = new Vector<String>;
+    systemLinkMap.set(family, result);
+    HKEY fontLinkKey;
+    if (FAILED(RegOpenKeyEx(HKEY_LOCAL_MACHINE, L"Software\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink", 0, KEY_READ, &fontLinkKey)))
+        return result;
+
+    DWORD linkedFontsBufferSize = 0;
+    RegQueryValueEx(fontLinkKey, family.charactersWithNullTermination(), 0, NULL, NULL, &linkedFontsBufferSize);
+    WCHAR* linkedFonts = reinterpret_cast<WCHAR*>(malloc(linkedFontsBufferSize));
+    if (SUCCEEDED(RegQueryValueEx(fontLinkKey, family.charactersWithNullTermination(), 0, NULL, reinterpret_cast<BYTE*>(linkedFonts), &linkedFontsBufferSize))) {
+        unsigned i = 0;
+        unsigned length = linkedFontsBufferSize / sizeof(*linkedFonts);
+        while (i < length) {
+            while (i < length && linkedFonts[i] != ',')
+                i++;
+            i++;
+            unsigned j = i;
+            while (j < length && linkedFonts[j])
+                j++;
+            result->append(String(linkedFonts + i, j - i));
+            i = j + 1;
+        }
+    }
+    free(linkedFonts);
+    RegCloseKey(fontLinkKey);
+    return result;
+}
+
+static const Vector<DWORD, 4>& getCJKCodePageMasks()
+{
+    // The default order in which we look for a font for a CJK character. If the user's default code page is
+    // one of these, we will use it first.
+    static const UINT CJKCodePages[] = { 
+        932, /* Japanese */
+        936, /* Simplified Chinese */
+        950, /* Traditional Chinese */
+        949  /* Korean */
+    };
+
+    static Vector<DWORD, 4> codePageMasks;
+    static bool initialized;
+    if (!initialized) {
+        initialized = true;
+        IMLangFontLink2* langFontLink = fontCache()->getFontLinkInterface();
+        if (!langFontLink)
+            return codePageMasks;
+
+        UINT defaultCodePage;
+        DWORD defaultCodePageMask = 0;
+        if (GetLocaleInfo(LOCALE_USER_DEFAULT, LOCALE_RETURN_NUMBER | LOCALE_IDEFAULTANSICODEPAGE, reinterpret_cast<LPWSTR>(&defaultCodePage), sizeof(defaultCodePage)))
+            langFontLink->CodePageToCodePages(defaultCodePage, &defaultCodePageMask);
+
+        if (defaultCodePage == CJKCodePages[0] || defaultCodePage == CJKCodePages[1] || defaultCodePage == CJKCodePages[2] || defaultCodePage == CJKCodePages[3])
+            codePageMasks.append(defaultCodePageMask);
+        for (unsigned i = 0; i < 4; ++i) {
+            if (defaultCodePage != CJKCodePages[i]) {
+                DWORD codePageMask;
+                langFontLink->CodePageToCodePages(CJKCodePages[i], &codePageMask);
+                codePageMasks.append(codePageMask);
+            }
+        }
+    }
+    return codePageMasks;
+}
+
+static bool currentFontContainsCharacter(HDC hdc, UChar character)
+{
+    static Vector<char, 512> glyphsetBuffer;
+    glyphsetBuffer.resize(GetFontUnicodeRanges(hdc, 0));
+    GLYPHSET* glyphset = reinterpret_cast<GLYPHSET*>(glyphsetBuffer.data());
+    GetFontUnicodeRanges(hdc, glyphset);
+
+    // FIXME: Change this to a binary search.
+    unsigned i = 0;
+    while (i < glyphset->cRanges && glyphset->ranges[i].wcLow <= character)
+        i++;
+
+    return i && glyphset->ranges[i - 1].wcLow + glyphset->ranges[i - 1].cGlyphs > character;
+}
+
+static HFONT createMLangFont(IMLangFontLink2* langFontLink, HDC hdc, DWORD codePageMask, UChar character = 0)
+{
+    HFONT MLangFont;
+    HFONT hfont = 0;
+    if (SUCCEEDED(langFontLink->MapFont(hdc, codePageMask, character, &MLangFont)) && MLangFont) {
+        LOGFONT lf;
+        GetObject(MLangFont, sizeof(LOGFONT), &lf);
+        langFontLink->ReleaseFont(MLangFont);
+        hfont = CreateFontIndirect(&lf);
+    }
+    return hfont;
+}
+
+const SimpleFontData* FontCache::getFontDataForCharacters(const Font& font, const UChar* characters, int length)
+{
+    UChar character = characters[0];
+    SimpleFontData* fontData = 0;
+    HDC hdc = GetDC(0);
+    HFONT primaryFont = font.primaryFont()->fontDataForCharacter(character)->platformData().hfont();
+    HGDIOBJ oldFont = SelectObject(hdc, primaryFont);
+    HFONT hfont = 0;
+
+    if (IMLangFontLink2* langFontLink = getFontLinkInterface()) {
+        // Try MLang font linking first.
+        DWORD codePages = 0;
+        langFontLink->GetCharCodePages(character, &codePages);
+
+        if (codePages && findCharUnicodeRange(character) == cRangeSetCJK) {
+            // The CJK character may belong to multiple code pages. We want to
+            // do font linking against a single one of them, preferring the default
+            // code page for the user's locale.
+            const Vector<DWORD, 4>& CJKCodePageMasks = getCJKCodePageMasks();
+            unsigned numCodePages = CJKCodePageMasks.size();
+            for (unsigned i = 0; i < numCodePages && !hfont; ++i) {
+                hfont = createMLangFont(langFontLink, hdc, CJKCodePageMasks[i]);
+                if (hfont && !(codePages & CJKCodePageMasks[i])) {
+                    // We asked about a code page that is not one of the code pages
+                    // returned by MLang, so the font might not contain the character.
+                    SelectObject(hdc, hfont);
+                    if (!currentFontContainsCharacter(hdc, character)) {
+                        DeleteObject(hfont);
+                        hfont = 0;
+                    }
+                    SelectObject(hdc, primaryFont);
+                }
+            }
+        } else
+            hfont = createMLangFont(langFontLink, hdc, codePages, character);
+    }
+
+    // A font returned from MLang is trusted to contain the character.
+    bool containsCharacter = hfont;
+
+    if (!hfont) {
+        // To find out what font Uniscribe would use, we make it draw into a metafile and intercept
+        // calls to CreateFontIndirect().
+        HDC metaFileDc = CreateEnhMetaFile(hdc, NULL, NULL, NULL);
+        SelectObject(metaFileDc, primaryFont);
+
+        bool scriptStringOutSucceeded = false;
+        SCRIPT_STRING_ANALYSIS ssa;
+
+        // FIXME: If length is greater than 1, we actually return the font for the last character.
+        // This function should be renamed getFontDataForCharacter and take a single 32-bit character.
+        if (SUCCEEDED(ScriptStringAnalyse(metaFileDc, characters, length, 0, -1, SSA_METAFILE | SSA_FALLBACK | SSA_GLYPHS | SSA_LINK,
+            0, NULL, NULL, NULL, NULL, NULL, &ssa))) {
+            scriptStringOutSucceeded = SUCCEEDED(ScriptStringOut(ssa, 0, 0, 0, NULL, 0, 0, FALSE));
+            ScriptStringFree(&ssa);
+        }
+        HENHMETAFILE metaFile = CloseEnhMetaFile(metaFileDc);
+        if (scriptStringOutSucceeded) {
+            LOGFONT logFont;
+            logFont.lfFaceName[0] = 0;
+            EnumEnhMetaFile(0, metaFile, metaFileEnumProc, &logFont, NULL);
+            if (logFont.lfFaceName[0])
+                hfont = CreateFontIndirect(&logFont);
+        }
+        DeleteEnhMetaFile(metaFile);
+    }
+
+    String familyName;
+    const Vector<String>* linkedFonts = 0;
+    unsigned linkedFontIndex = 0;
+    while (hfont) {
+        SelectObject(hdc, hfont);
+        WCHAR name[LF_FACESIZE];
+        GetTextFace(hdc, LF_FACESIZE, name);
+        familyName = name;
+
+        if (containsCharacter || currentFontContainsCharacter(hdc, character))
+            break;
+
+        if (!linkedFonts)
+            linkedFonts = getLinkedFonts(familyName);
+        SelectObject(hdc, oldFont);
+        DeleteObject(hfont);
+        hfont = 0;
+
+        if (linkedFonts->size() <= linkedFontIndex)
+            break;
+
+        LOGFONT logFont;
+        logFont.lfCharSet = DEFAULT_CHARSET;
+        memcpy(logFont.lfFaceName, linkedFonts->at(linkedFontIndex).characters(), linkedFonts->at(linkedFontIndex).length() * sizeof(WCHAR));
+        logFont.lfFaceName[linkedFonts->at(linkedFontIndex).length()] = 0;
+        EnumFontFamiliesEx(hdc, &logFont, linkedFontEnumProc, reinterpret_cast<LPARAM>(&hfont), 0);
+        linkedFontIndex++;
+    }
+
+    if (hfont) {
+        if (!familyName.isEmpty()) {
+            FontPlatformData* result = getCachedFontPlatformData(font.fontDescription(), familyName);
+            if (result)
+                fontData = getCachedFontData(result);
+        }
+
+        SelectObject(hdc, oldFont);
+        DeleteObject(hfont);
+    }
+
+    ReleaseDC(0, hdc);
+    return fontData;
+}
+
+SimpleFontData* FontCache::getSimilarFontPlatformData(const Font& font)
+{
+    return 0;
+}
+
+SimpleFontData* FontCache::getLastResortFallbackFont(const FontDescription& fontDescription)
+{
+    // FIXME: Would be even better to somehow get the user's default font here.  For now we'll pick
+    // the default that the user would get without changing any prefs.
+    static AtomicString timesStr("Times New Roman");
+    if (SimpleFontData* simpleFont = getCachedFontData(fontDescription, timesStr))
+        return simpleFont;
+
+    DEFINE_STATIC_LOCAL(String, defaultGUIFontFamily, ());
+    if (defaultGUIFontFamily.isEmpty()) {
+        HFONT defaultGUIFont = static_cast<HFONT>(GetStockObject(DEFAULT_GUI_FONT));
+        LOGFONT logFont;
+        GetObject(defaultGUIFont, sizeof(logFont), &logFont);
+        defaultGUIFontFamily = String(logFont.lfFaceName, wcsnlen(logFont.lfFaceName, LF_FACESIZE));
+    }
+    return getCachedFontData(fontDescription, defaultGUIFontFamily);
+}
+
+static LONG toGDIFontWeight(FontWeight fontWeight)
+{
+    static LONG gdiFontWeights[] = {
+        FW_THIN,        // FontWeight100
+        FW_EXTRALIGHT,  // FontWeight200
+        FW_LIGHT,       // FontWeight300
+        FW_NORMAL,      // FontWeight400
+        FW_MEDIUM,      // FontWeight500
+        FW_SEMIBOLD,    // FontWeight600
+        FW_BOLD,        // FontWeight700
+        FW_EXTRABOLD,   // FontWeight800
+        FW_HEAVY        // FontWeight900
+    };
+    return gdiFontWeights[fontWeight];
+}
+
+static inline bool isGDIFontWeightBold(LONG gdiFontWeight)
+{
+    return gdiFontWeight >= FW_SEMIBOLD;
+}
+
+static LONG adjustedGDIFontWeight(LONG gdiFontWeight, const String& family)
+{
+    static AtomicString lucidaStr("Lucida Grande");
+    if (equalIgnoringCase(family, lucidaStr)) {
+        if (gdiFontWeight == FW_NORMAL)
+            return FW_MEDIUM;
+        if (gdiFontWeight == FW_BOLD)
+            return FW_SEMIBOLD;
+    }
+    return gdiFontWeight;
+}
+
+struct MatchImprovingProcData {
+    MatchImprovingProcData(LONG desiredWeight, bool desiredItalic)
+        : m_desiredWeight(desiredWeight)
+        , m_desiredItalic(desiredItalic)
+        , m_hasMatched(false)
+    {
+    }
+
+    LONG m_desiredWeight;
+    bool m_desiredItalic;
+    bool m_hasMatched;
+    LOGFONT m_chosen;
+};
+
+static int CALLBACK matchImprovingEnumProc(CONST LOGFONT* candidate, CONST TEXTMETRIC* metrics, DWORD fontType, LPARAM lParam)
+{
+    MatchImprovingProcData* matchData = reinterpret_cast<MatchImprovingProcData*>(lParam);
+
+    if (!matchData->m_hasMatched) {
+        matchData->m_hasMatched = true;
+        matchData->m_chosen = *candidate;
+        return 1;
+    }
+
+    if (!candidate->lfItalic != !matchData->m_chosen.lfItalic) {
+        if (!candidate->lfItalic == !matchData->m_desiredItalic)
+            matchData->m_chosen = *candidate;
+
+        return 1;
+    }
+
+    unsigned chosenWeightDeltaMagnitude = abs(matchData->m_chosen.lfWeight - matchData->m_desiredWeight);
+    unsigned candidateWeightDeltaMagnitude = abs(candidate->lfWeight - matchData->m_desiredWeight);
+
+    // If both are the same distance from the desired weight, prefer the candidate if it is further from regular.
+    if (chosenWeightDeltaMagnitude == candidateWeightDeltaMagnitude && abs(candidate->lfWeight - FW_NORMAL) > abs(matchData->m_chosen.lfWeight - FW_NORMAL)) {
+        matchData->m_chosen = *candidate;
+        return 1;
+    }
+
+    // Otherwise, prefer the one closer to the desired weight.
+    if (candidateWeightDeltaMagnitude < chosenWeightDeltaMagnitude)
+        matchData->m_chosen = *candidate;
+
+    return 1;
+}
+
+static HFONT createGDIFont(const AtomicString& family, LONG desiredWeight, bool desiredItalic, int size, bool synthesizeItalic)
+{
+    HDC hdc = GetDC(0);
+
+    LOGFONT logFont;
+    logFont.lfCharSet = DEFAULT_CHARSET;
+    unsigned familyLength = min(family.length(), static_cast<unsigned>(LF_FACESIZE - 1));
+    memcpy(logFont.lfFaceName, family.characters(), familyLength * sizeof(UChar));
+    logFont.lfFaceName[familyLength] = 0;
+    logFont.lfPitchAndFamily = 0;
+
+    MatchImprovingProcData matchData(desiredWeight, desiredItalic);
+    EnumFontFamiliesEx(hdc, &logFont, matchImprovingEnumProc, reinterpret_cast<LPARAM>(&matchData), 0);
+
+    ReleaseDC(0, hdc);
+
+    if (!matchData.m_hasMatched)
+        return 0;
+
+    matchData.m_chosen.lfHeight = -size;
+    matchData.m_chosen.lfWidth = 0;
+    matchData.m_chosen.lfEscapement = 0;
+    matchData.m_chosen.lfOrientation = 0;
+    matchData.m_chosen.lfUnderline = false;
+    matchData.m_chosen.lfStrikeOut = false;
+    matchData.m_chosen.lfCharSet = DEFAULT_CHARSET;
+#if PLATFORM(CG) || PLATFORM(CAIRO)
+    matchData.m_chosen.lfOutPrecision = OUT_TT_ONLY_PRECIS;
+#else
+    matchData.m_chosen.lfOutPrecision = OUT_TT_PRECIS;
+#endif
+    matchData.m_chosen.lfQuality = DEFAULT_QUALITY;
+    matchData.m_chosen.lfPitchAndFamily = DEFAULT_PITCH | FF_DONTCARE;
+
+   if (desiredItalic && !matchData.m_chosen.lfItalic && synthesizeItalic)
+       matchData.m_chosen.lfItalic = 1;
+
+    HFONT result = CreateFontIndirect(&matchData.m_chosen);
+    if (!result)
+        return 0;
+
+    HDC dc = GetDC(0);
+    SaveDC(dc);
+    SelectObject(dc, result);
+    WCHAR actualName[LF_FACESIZE];
+    GetTextFace(dc, LF_FACESIZE, actualName);
+    RestoreDC(dc, -1);
+    ReleaseDC(0, dc);
+
+    if (wcsicmp(matchData.m_chosen.lfFaceName, actualName)) {
+        DeleteObject(result);
+        result = 0;
+    }
+
+    return result;
+}
+
+struct TraitsInFamilyProcData {
+    TraitsInFamilyProcData(const AtomicString& familyName)
+        : m_familyName(familyName)
+    {
+    }
+
+    const AtomicString& m_familyName;
+    HashSet<unsigned> m_traitsMasks;
+};
+
+static int CALLBACK traitsInFamilyEnumProc(CONST LOGFONT* logFont, CONST TEXTMETRIC* metrics, DWORD fontType, LPARAM lParam)
+{
+    TraitsInFamilyProcData* procData = reinterpret_cast<TraitsInFamilyProcData*>(lParam);
+
+    unsigned traitsMask = 0;
+    traitsMask |= logFont->lfItalic ? FontStyleItalicMask : FontStyleNormalMask;
+    traitsMask |= FontVariantNormalMask;
+    LONG weight = adjustedGDIFontWeight(logFont->lfWeight, procData->m_familyName);
+    traitsMask |= weight == FW_THIN ? FontWeight100Mask :
+        weight == FW_EXTRALIGHT ? FontWeight200Mask :
+        weight == FW_LIGHT ? FontWeight300Mask :
+        weight == FW_NORMAL ? FontWeight400Mask :
+        weight == FW_MEDIUM ? FontWeight500Mask :
+        weight == FW_SEMIBOLD ? FontWeight600Mask :
+        weight == FW_BOLD ? FontWeight700Mask :
+        weight == FW_EXTRABOLD ? FontWeight800Mask :
+                                 FontWeight900Mask;
+    procData->m_traitsMasks.add(traitsMask);
+    return 1;
+}
+void FontCache::getTraitsInFamily(const AtomicString& familyName, Vector<unsigned>& traitsMasks)
+{
+    HDC hdc = GetDC(0);
+
+    LOGFONT logFont;
+    logFont.lfCharSet = DEFAULT_CHARSET;
+    unsigned familyLength = min(familyName.length(), static_cast<unsigned>(LF_FACESIZE - 1));
+    memcpy(logFont.lfFaceName, familyName.characters(), familyLength * sizeof(UChar));
+    logFont.lfFaceName[familyLength] = 0;
+    logFont.lfPitchAndFamily = 0;
+
+    TraitsInFamilyProcData procData(familyName);
+    EnumFontFamiliesEx(hdc, &logFont, traitsInFamilyEnumProc, reinterpret_cast<LPARAM>(&procData), 0);
+    copyToVector(procData.m_traitsMasks, traitsMasks);
+
+    ReleaseDC(0, hdc);
+}
+
+FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontDescription, const AtomicString& family)
+{
+    bool isLucidaGrande = false;
+    static AtomicString lucidaStr("Lucida Grande");
+    if (equalIgnoringCase(family, lucidaStr))
+        isLucidaGrande = true;
+
+    bool useGDI = fontDescription.renderingMode() == AlternateRenderingMode && !isLucidaGrande;
+
+    // The logical size constant is 32. We do this for subpixel precision when rendering using Uniscribe.
+    // This masks rounding errors related to the HFONT metrics being  different from the CGFont metrics.
+    // FIXME: We will eventually want subpixel precision for GDI mode, but the scaled rendering doesn't
+    // look as nice. That may be solvable though.
+    LONG weight = adjustedGDIFontWeight(toGDIFontWeight(fontDescription.weight()), family);
+    HFONT hfont = createGDIFont(family, weight, fontDescription.italic(),
+                                fontDescription.computedPixelSize() * (useGDI ? 1 : 32), useGDI);
+
+    if (!hfont)
+        return 0;
+
+    if (isLucidaGrande)
+        useGDI = false; // Never use GDI for Lucida Grande.
+
+    LOGFONT logFont;
+    GetObject(hfont, sizeof(LOGFONT), &logFont);
+
+    bool synthesizeBold = isGDIFontWeightBold(weight) && !isGDIFontWeightBold(logFont.lfWeight);
+    bool synthesizeItalic = fontDescription.italic() && !logFont.lfItalic;
+
+    FontPlatformData* result = new FontPlatformData(hfont, fontDescription.computedPixelSize(), synthesizeBold, synthesizeItalic, useGDI);
+
+#if PLATFORM(CG)
+    bool fontCreationFailed = !result->cgFont();
+#elif PLATFORM(CAIRO)
+    bool fontCreationFailed = !result->fontFace();
+#endif
+
+    if (fontCreationFailed) {
+        // The creation of the CGFontRef failed for some reason.  We already asserted in debug builds, but to make
+        // absolutely sure that we don't use this font, go ahead and return 0 so that we can fall back to the next
+        // font.
+        delete result;
+        DeleteObject(hfont);
+        return 0;
+    }        
+
+    return result;
+}
+
+}
+
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCustomPlatformData.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCustomPlatformData.cpp
new file mode 100644
index 0000000000..e9f83ab810
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCustomPlatformData.cpp
@@ -0,0 +1,203 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "FontCustomPlatformData.h"
+
+#include "Base64.h"
+#include "FontPlatformData.h"
+#include "OpenTypeUtilities.h"
+#include "SharedBuffer.h"
+#include "SoftLinking.h"
+#include <ApplicationServices/ApplicationServices.h>
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#include <wtf/RetainPtr.h>
+
+// From t2embapi.h, which is missing from the Microsoft Platform SDK.
+typedef unsigned long(WINAPIV *READEMBEDPROC) (void*, void*, unsigned long);
+struct TTLOADINFO;
+#define TTLOAD_PRIVATE 0x00000001
+#define LICENSE_PREVIEWPRINT 0x0004
+#define E_NONE 0x0000L
+
+namespace WebCore {
+
+using namespace std;
+
+SOFT_LINK_LIBRARY(T2embed);
+SOFT_LINK(T2embed, TTLoadEmbeddedFont, LONG, __stdcall, (HANDLE* phFontReference, ULONG ulFlags, ULONG* pulPrivStatus, ULONG ulPrivs, ULONG* pulStatus, READEMBEDPROC lpfnReadFromStream, LPVOID lpvReadStream, LPWSTR szWinFamilyName, LPSTR szMacFamilyName, TTLOADINFO* pTTLoadInfo), (phFontReference, ulFlags,pulPrivStatus, ulPrivs, pulStatus, lpfnReadFromStream, lpvReadStream, szWinFamilyName, szMacFamilyName, pTTLoadInfo));
+SOFT_LINK(T2embed, TTGetNewFontName, LONG, __stdcall, (HANDLE* phFontReference, LPWSTR szWinFamilyName, long cchMaxWinName, LPSTR szMacFamilyName, long cchMaxMacName), (phFontReference, szWinFamilyName, cchMaxWinName, szMacFamilyName, cchMaxMacName));
+SOFT_LINK(T2embed, TTDeleteEmbeddedFont, LONG, __stdcall, (HANDLE hFontReference, ULONG ulFlags, ULONG* pulStatus), (hFontReference, ulFlags, pulStatus));
+
+FontCustomPlatformData::~FontCustomPlatformData()
+{
+    if (m_fontReference) {
+        if (m_name.isNull()) {
+            ASSERT(T2embedLibrary());
+            ULONG status;
+            TTDeleteEmbeddedFont(m_fontReference, 0, &status);
+        } else
+            RemoveFontMemResourceEx(m_fontReference);
+    }
+}
+
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontRenderingMode renderingMode)
+{
+    ASSERT(m_fontReference);
+    ASSERT(T2embedLibrary());
+
+    LOGFONT& logFont = *static_cast<LOGFONT*>(malloc(sizeof(LOGFONT)));
+    if (m_name.isNull())
+        TTGetNewFontName(&m_fontReference, logFont.lfFaceName, LF_FACESIZE, 0, 0);
+    else
+        memcpy(logFont.lfFaceName, m_name.charactersWithNullTermination(), sizeof(logFont.lfFaceName[0]) * min(static_cast<size_t>(LF_FACESIZE), 1 + m_name.length()));
+
+    logFont.lfHeight = -size;
+    if (renderingMode == NormalRenderingMode)
+        logFont.lfHeight *= 32;
+    logFont.lfWidth = 0;
+    logFont.lfEscapement = 0;
+    logFont.lfOrientation = 0;
+    logFont.lfUnderline = false;
+    logFont.lfStrikeOut = false;
+    logFont.lfCharSet = DEFAULT_CHARSET;
+    logFont.lfOutPrecision = OUT_TT_ONLY_PRECIS;
+    logFont.lfQuality = CLEARTYPE_QUALITY;
+    logFont.lfPitchAndFamily = DEFAULT_PITCH | FF_DONTCARE;
+    logFont.lfItalic = italic;
+    logFont.lfWeight = bold ? 700 : 400;
+
+    HFONT hfont = CreateFontIndirect(&logFont);
+
+    RetainPtr<CGFontRef> cgFont(AdoptCF, CGFontCreateWithPlatformFont(&logFont));
+    return FontPlatformData(hfont, cgFont.get(), size, bold, italic, renderingMode == AlternateRenderingMode);
+}
+
+// Streams the concatenation of a header and font data.
+class EOTStream {
+public:
+    EOTStream(const EOTHeader& eotHeader, const SharedBuffer* fontData, size_t overlayDst, size_t overlaySrc, size_t overlayLength)
+        : m_eotHeader(eotHeader)
+        , m_fontData(fontData)
+        , m_overlayDst(overlayDst)
+        , m_overlaySrc(overlaySrc)
+        , m_overlayLength(overlayLength)
+        , m_offset(0)
+        , m_inHeader(true)
+    {
+    }
+
+    size_t read(void* buffer, size_t count);
+
+private:
+    const EOTHeader& m_eotHeader;
+    const SharedBuffer* m_fontData;
+    size_t m_overlayDst;
+    size_t m_overlaySrc;
+    size_t m_overlayLength;
+    size_t m_offset;
+    bool m_inHeader;
+};
+
+size_t EOTStream::read(void* buffer, size_t count)
+{
+    size_t bytesToRead = count;
+    if (m_inHeader) {
+        size_t bytesFromHeader = min(m_eotHeader.size() - m_offset, count);
+        memcpy(buffer, m_eotHeader.data() + m_offset, bytesFromHeader);
+        m_offset += bytesFromHeader;
+        bytesToRead -= bytesFromHeader;
+        if (m_offset == m_eotHeader.size()) {
+            m_inHeader = false;
+            m_offset = 0;
+        }
+    }
+    if (bytesToRead && !m_inHeader) {
+        size_t bytesFromData = min(m_fontData->size() - m_offset, bytesToRead);
+        memcpy(buffer, m_fontData->data() + m_offset, bytesFromData);
+        if (m_offset < m_overlayDst + m_overlayLength && m_offset + bytesFromData >= m_overlayDst) {
+            size_t dstOffset = max<int>(m_overlayDst - m_offset, 0);
+            size_t srcOffset = max<int>(0, m_offset - m_overlayDst);
+            size_t bytesToCopy = min(bytesFromData - dstOffset, m_overlayLength - srcOffset);
+            memcpy(reinterpret_cast<char*>(buffer) + dstOffset, m_fontData->data() + m_overlaySrc + srcOffset, bytesToCopy);
+        }
+        m_offset += bytesFromData;
+        bytesToRead -= bytesFromData;
+    }
+    return count - bytesToRead;
+}
+
+static unsigned long WINAPIV readEmbedProc(void* stream, void* buffer, unsigned long length)
+{
+    return static_cast<EOTStream*>(stream)->read(buffer, length);
+}
+
+// Creates a unique and unpredictable font name, in order to avoid collisions and to
+// not allow access from CSS.
+static String createUniqueFontName()
+{
+    Vector<char> fontUuid(sizeof(GUID));
+    CoCreateGuid(reinterpret_cast<GUID*>(fontUuid.data()));
+
+    Vector<char> fontNameVector;
+    base64Encode(fontUuid, fontNameVector);
+    ASSERT(fontNameVector.size() < LF_FACESIZE);
+    return String(fontNameVector.data(), fontNameVector.size());
+}
+
+FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
+{
+    ASSERT_ARG(buffer, buffer);
+    ASSERT(T2embedLibrary());
+
+    // Introduce the font to GDI. AddFontMemResourceEx cannot be used, because it will pollute the process's
+    // font namespace (Windows has no API for creating an HFONT from data without exposing the font to the
+    // entire process first). TTLoadEmbeddedFont lets us override the font family name, so using a unique name
+    // we avoid namespace collisions.
+
+    String fontName = createUniqueFontName();
+
+    // TTLoadEmbeddedFont works only with Embedded OpenType (.eot) data, so we need to create an EOT header
+    // and prepend it to the font data.
+    EOTHeader eotHeader;
+    size_t overlayDst;
+    size_t overlaySrc;
+    size_t overlayLength;
+    if (!getEOTHeader(buffer, eotHeader, overlayDst, overlaySrc, overlayLength))
+        return 0;
+
+    HANDLE fontReference;
+    ULONG privStatus;
+    ULONG status;
+    EOTStream eotStream(eotHeader, buffer, overlayDst, overlaySrc, overlayLength);
+
+    LONG loadEmbeddedFontResult = TTLoadEmbeddedFont(&fontReference, TTLOAD_PRIVATE, &privStatus, LICENSE_PREVIEWPRINT, &status, readEmbedProc, &eotStream, const_cast<LPWSTR>(fontName.charactersWithNullTermination()), 0, 0);
+    if (loadEmbeddedFontResult == E_NONE)
+        fontName = String();
+    else {
+        fontReference = renameAndActivateFont(buffer, fontName);
+        if (!fontReference)
+            return 0;
+    }
+
+    return new FontCustomPlatformData(fontReference, fontName);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCustomPlatformData.h b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCustomPlatformData.h
new file mode 100644
index 0000000000..f75f12add1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCustomPlatformData.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef FontCustomPlatformData_h
+#define FontCustomPlatformData_h
+
+#include "FontRenderingMode.h"
+#include "PlatformString.h"
+#include <wtf/Noncopyable.h>
+
+typedef struct CGFont* CGFontRef;
+
+namespace WebCore {
+
+class FontPlatformData;
+class SharedBuffer;
+
+struct FontCustomPlatformData : Noncopyable {
+    FontCustomPlatformData(HANDLE fontReference, const String& name)
+        : m_fontReference(fontReference)
+        , m_name(name)
+    {
+    }
+
+    ~FontCustomPlatformData();
+
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontRenderingMode = NormalRenderingMode);
+
+    HANDLE m_fontReference;
+    String m_name;
+};
+
+FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer*);
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.cpp
new file mode 100644
index 0000000000..e54d85ae90
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Computer, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "FontCustomPlatformDataCairo.h"
+
+#include "SharedBuffer.h"
+#include "FontPlatformData.h"
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+FontCustomPlatformDataCairo::~FontCustomPlatformDataCairo()
+{
+   cairo_font_face_destroy(m_fontFace);
+}
+
+FontPlatformData FontCustomPlatformDataCairo::fontPlatformData(int size, bool bold, bool italic)
+{
+    return FontPlatformData(m_fontFace, size, bold, italic);
+}
+
+static void releaseData(void* data)
+{
+    static_cast<SharedBuffer*>(data)->deref();
+}
+
+FontCustomPlatformDataCairo* createFontCustomPlatformData(SharedBuffer* buffer)
+{
+    ASSERT_ARG(buffer, buffer);
+
+    buffer->ref();
+    HFONT font = reinterpret_cast<HFONT>(buffer);
+    cairo_font_face_t* fontFace = cairo_win32_font_face_create_for_hfont(font);
+    if (!fontFace)
+       return 0;
+
+    static cairo_user_data_key_t bufferKey;
+    cairo_font_face_set_user_data(fontFace, &bufferKey, buffer, releaseData);
+
+    return new FontCustomPlatformDataCairo(fontFace);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.h b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.h
new file mode 100644
index 0000000000..87794b59d8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2007 Apple Computer, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef FontCustomPlatformDataCairo_h
+#define FontCustomPlatformDataCairo_h
+
+#include <wtf/Noncopyable.h>
+
+#include <cairo.h>
+
+namespace WebCore {
+
+class FontPlatformData;
+class SharedBuffer;
+
+struct FontCustomPlatformDataCairo : Noncopyable {
+    FontCustomPlatformDataCairo(cairo_font_face_t* fontFace)
+        : m_fontFace(fontFace)
+    {
+    }
+    ~FontCustomPlatformDataCairo();
+
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic);
+
+    cairo_font_face_t* m_fontFace;
+};
+
+FontCustomPlatformDataCairo* createFontCustomPlatformData(SharedBuffer*);
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/FontPlatformDataCGWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontPlatformDataCGWin.cpp
new file mode 100644
index 0000000000..ed9073fd71
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontPlatformDataCGWin.cpp
@@ -0,0 +1,131 @@
+/*
+ * This file is part of the internal font implementation. It should not be included by anyone other than
+ * FontMac.cpp, FontWin.cpp and Font.cpp.
+ *
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "FontPlatformData.h"
+
+#include "PlatformString.h"
+#include "StringHash.h"
+#include <ApplicationServices/ApplicationServices.h>
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#include <wtf/HashMap.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/Vector.h>
+
+using std::min;
+
+namespace WebCore {
+
+static inline USHORT readBigEndianWord(const BYTE* word) { return (word[0] << 8) | word[1]; }
+
+static CFStringRef getPostScriptName(CFStringRef faceName, HDC dc)
+{
+    const DWORD cMaxNameTableSize = 1024 * 1024;
+
+    static HashMap<String, RetainPtr<CFStringRef> > nameMap;
+
+    // Check our hash first.
+    String faceString(faceName);
+    RetainPtr<CFStringRef> result = nameMap.get(faceString);
+    if (result)
+        return result.get();
+
+    // We need to obtain the PostScript name from the name table and use it instead,.
+    DWORD bufferSize = GetFontData(dc, 'eman', 0, NULL, 0); // "name" backwards
+    if (bufferSize == 0 || bufferSize == GDI_ERROR || bufferSize > cMaxNameTableSize)
+        return NULL;
+   
+    Vector<BYTE> bufferVector(bufferSize);
+    BYTE* buffer = bufferVector.data();
+    if (GetFontData(dc, 'eman', 0, buffer, bufferSize) == GDI_ERROR)
+        return NULL;
+
+    if (bufferSize < 6)
+        return NULL;
+
+    USHORT numberOfRecords = readBigEndianWord(buffer + 2);
+    UINT stringsOffset = readBigEndianWord(buffer + 4);
+    if (bufferSize < stringsOffset)
+        return NULL;
+
+    BYTE* strings = buffer + stringsOffset;
+
+    // Now walk each name record looking for a Mac or Windows PostScript name.
+    UINT offset = 6;
+    for (int i = 0; i < numberOfRecords; i++) {
+        if (bufferSize < offset + 12)
+            return NULL;
+
+        USHORT platformID = readBigEndianWord(buffer + offset);
+        USHORT encodingID = readBigEndianWord(buffer + offset + 2);
+        USHORT languageID = readBigEndianWord(buffer + offset + 4);
+        USHORT nameID = readBigEndianWord(buffer + offset + 6);
+        USHORT length = readBigEndianWord(buffer + offset + 8);
+        USHORT nameOffset = readBigEndianWord(buffer + offset + 10);
+
+        if (platformID == 3 && encodingID == 1 && languageID == 0x409 && nameID == 6) {
+            // This is a Windows PostScript name and is therefore UTF-16.
+            // Pass Big Endian as the encoding.
+            if (bufferSize < stringsOffset + nameOffset + length)
+                return NULL;
+            result.adoptCF(CFStringCreateWithBytes(NULL, strings + nameOffset, length, kCFStringEncodingUTF16BE, false));
+            break;
+        } else if (platformID == 1 && encodingID == 0 && languageID == 0 && nameID == 6) {
+            // This is a Mac PostScript name and is therefore ASCII.
+            // See http://developer.apple.com/textfonts/TTRefMan/RM06/Chap6name.html
+            if (bufferSize < stringsOffset + nameOffset + length)
+                return NULL;
+            result.adoptCF(CFStringCreateWithBytes(NULL, strings + nameOffset, length, kCFStringEncodingASCII, false));
+            break;
+        }
+
+        offset += 12;
+    }
+
+    if (result)
+        nameMap.set(faceString, result);
+    return result.get();
+}
+
+void FontPlatformData::platformDataInit(HFONT font, float size, HDC hdc, WCHAR* faceName)
+{
+    LOGFONT logfont;
+    GetObject(font, sizeof(logfont), &logfont);
+    m_cgFont.adoptCF(CGFontCreateWithPlatformFont(&logfont));
+}
+
+FontPlatformData::FontPlatformData(HFONT hfont, CGFontRef font, float size, bool bold, bool oblique, bool useGDI)
+    : m_font(RefCountedHFONT::create(hfont))
+    , m_size(size)
+    , m_cgFont(font)
+    , m_syntheticBold(bold)
+    , m_syntheticOblique(oblique)
+    , m_useGDI(useGDI)
+{
+}
+
+FontPlatformData::~FontPlatformData()
+{
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp
new file mode 100644
index 0000000000..9b916bde97
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp
@@ -0,0 +1,143 @@
+/*
+ * This file is part of the internal font implementation.  It should not be included by anyone other than
+ * FontMac.cpp, FontWin.cpp and Font.cpp.
+ *
+ * Copyright (C) 2006, 2007, 2008 Apple Inc.
+ * Copyright (C) 2007 Alp Toker
+ * Copyright (C) 2008, 2010 Brent Fulgham
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "FontPlatformData.h"
+
+#include "PlatformString.h"
+#include "StringHash.h"
+#include <wtf/HashMap.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/Vector.h>
+
+#include <cairo-win32.h>
+
+using namespace std;
+
+namespace WebCore {
+
+void FontPlatformData::platformDataInit(HFONT font, float size, HDC hdc, WCHAR* faceName)
+{
+    m_fontFace = cairo_win32_font_face_create_for_hfont(font);
+
+    cairo_matrix_t sizeMatrix, ctm;
+    cairo_matrix_init_identity(&ctm);
+    cairo_matrix_init_scale(&sizeMatrix, size, size);
+
+    static cairo_font_options_t* fontOptions = 0;
+    if (!fontOptions) {
+       fontOptions = cairo_font_options_create();
+       cairo_font_options_set_antialias(fontOptions, CAIRO_ANTIALIAS_SUBPIXEL);
+    }
+
+    m_scaledFont = cairo_scaled_font_create(m_fontFace, &sizeMatrix, &ctm, fontOptions);
+}
+
+FontPlatformData::FontPlatformData(cairo_font_face_t* fontFace, float size, bool bold, bool oblique)
+    : m_font(0)
+    , m_size(size)
+    , m_fontFace(fontFace)
+    , m_scaledFont(0)
+    , m_syntheticBold(bold)
+    , m_syntheticOblique(oblique)
+    , m_useGDI(false)
+{
+   cairo_matrix_t fontMatrix;
+   cairo_matrix_init_scale(&fontMatrix, size, size);
+   cairo_matrix_t ctm;
+   cairo_matrix_init_identity(&ctm);
+   cairo_font_options_t* options = cairo_font_options_create();
+
+   // We force antialiasing and disable hinting to provide consistent
+   // typographic qualities for custom fonts on all platforms.
+   cairo_font_options_set_hint_style(options, CAIRO_HINT_STYLE_NONE);
+   cairo_font_options_set_antialias(options, CAIRO_ANTIALIAS_GRAY);
+
+   m_scaledFont = cairo_scaled_font_create(fontFace, &fontMatrix, &ctm, options);
+   cairo_font_options_destroy(options);
+}
+
+FontPlatformData::FontPlatformData(const FontPlatformData& source)
+    : m_font(source.m_font)
+    , m_size(source.m_size)
+    , m_fontFace(0)
+    , m_scaledFont(0)
+    , m_syntheticBold(source.m_syntheticBold)
+    , m_syntheticOblique(source.m_syntheticOblique)
+    , m_useGDI(source.m_useGDI)
+{
+    if (source.m_fontFace)
+        m_fontFace = cairo_font_face_reference(source.m_fontFace);
+
+    if (source.m_scaledFont)
+        m_scaledFont = cairo_scaled_font_reference(source.m_scaledFont);
+}
+
+
+FontPlatformData::~FontPlatformData()
+{
+    cairo_scaled_font_destroy(m_scaledFont);
+    cairo_font_face_destroy(m_fontFace);
+}
+
+FontPlatformData& FontPlatformData::operator=(const FontPlatformData& other)
+{
+    // Check for self-assignment.
+    if (this == &other)
+        return *this;
+
+    m_font = other.m_font;
+    m_size = other.m_size;
+    m_syntheticBold = other.m_syntheticBold;
+    m_syntheticOblique = other.m_syntheticOblique;
+    m_useGDI = other.m_useGDI;
+
+    if (other.m_fontFace)
+        cairo_font_face_reference(other.m_fontFace);
+    if (m_fontFace)
+        cairo_font_face_destroy(m_fontFace);
+    m_fontFace = other.m_fontFace;
+
+    if (other.m_scaledFont)
+        cairo_scaled_font_reference(other.m_scaledFont);
+    if (m_scaledFont)
+        cairo_scaled_font_destroy(m_scaledFont);
+    m_scaledFont = other.m_scaledFont;
+
+    return *this;
+}
+
+bool FontPlatformData::operator==(const FontPlatformData& other) const
+{ 
+    return m_font == other.m_font
+        && m_fontFace == other.m_fontFace
+        && m_scaledFont == other.m_scaledFont
+        && m_size == other.m_size
+        && m_syntheticBold == other.m_syntheticBold
+        && m_syntheticOblique == other.m_syntheticOblique
+        && m_useGDI == other.m_useGDI;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/FontPlatformDataWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontPlatformDataWin.cpp
new file mode 100644
index 0000000000..cc02c4c616
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontPlatformDataWin.cpp
@@ -0,0 +1,95 @@
+/*
+ * This file is part of the internal font implementation.  It should not be included by anyone other than
+ * FontMac.cpp, FontWin.cpp and Font.cpp.
+ *
+ * Copyright (C) 2006, 2007, 2008 Apple Inc.
+ * Copyright (C) 2008 Brent Fulgham
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "FontPlatformData.h"
+
+#include "PlatformString.h"
+#include "StringHash.h"
+#include <wtf/HashMap.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/Vector.h>
+
+using std::min;
+
+namespace WebCore {
+
+FontPlatformData::FontPlatformData(HFONT font, float size, bool bold, bool oblique, bool useGDI)
+    : m_font(RefCountedHFONT::create(font))
+    , m_size(size)
+#if PLATFORM(CG)
+    , m_cgFont(0)
+#elif PLATFORM(CAIRO)
+    , m_fontFace(0)
+    , m_scaledFont(0)
+#endif
+    , m_syntheticBold(bold)
+    , m_syntheticOblique(oblique)
+    , m_useGDI(useGDI)
+{
+    HDC hdc = GetDC(0);
+    SaveDC(hdc);
+    
+    SelectObject(hdc, font);
+    UINT bufferSize = GetOutlineTextMetrics(hdc, 0, NULL);
+
+    ASSERT_WITH_MESSAGE(bufferSize, "Bitmap fonts not supported with CoreGraphics.");
+
+    if (bufferSize) {
+        OUTLINETEXTMETRICW* metrics = (OUTLINETEXTMETRICW*)malloc(bufferSize);
+
+        GetOutlineTextMetricsW(hdc, bufferSize, metrics);
+        WCHAR* faceName = (WCHAR*)((uintptr_t)metrics + (uintptr_t)metrics->otmpFaceName);
+
+        platformDataInit(font, size, hdc, faceName);
+
+        free(metrics);
+    }
+
+    RestoreDC(hdc, -1);
+    ReleaseDC(0, hdc);
+}
+
+FontPlatformData::FontPlatformData(float size, bool bold, bool oblique)
+    : m_size(size)
+#if PLATFORM(CG)
+    , m_cgFont(0)
+#elif PLATFORM(CAIRO)
+    , m_fontFace(0)
+    , m_scaledFont(0)
+#endif
+    , m_syntheticBold(bold)
+    , m_syntheticOblique(oblique)
+    , m_useGDI(false)
+{
+}
+
+#ifndef NDEBUG
+String FontPlatformData::description() const
+{
+    return String();
+}
+#endif
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/FontWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontWin.cpp
new file mode 100644
index 0000000000..27d8dee712
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/FontWin.cpp
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Font.h"
+
+#include "FontFallbackList.h"
+#include "GlyphBuffer.h"
+#include "GraphicsContext.h"
+#include "IntRect.h"
+#include "SimpleFontData.h"
+#include "UniscribeController.h"
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+bool Font::canReturnFallbackFontsForComplexText()
+{
+    return true;
+}
+
+FloatRect Font::selectionRectForComplexText(const TextRun& run, const IntPoint& point, int h,
+                                            int from, int to) const
+{
+    UniscribeController it(this, run);
+    it.advance(from);
+    float beforeWidth = it.runWidthSoFar();
+    it.advance(to);
+    float afterWidth = it.runWidthSoFar();
+
+    // Using roundf() rather than ceilf() for the right edge as a compromise to ensure correct caret positioning
+    if (run.rtl()) {
+        it.advance(run.length());
+        float totalWidth = it.runWidthSoFar();
+        return FloatRect(point.x() + floorf(totalWidth - afterWidth), point.y(), roundf(totalWidth - beforeWidth) - floorf(totalWidth - afterWidth), h);
+    } 
+    
+    return FloatRect(point.x() + floorf(beforeWidth), point.y(), roundf(afterWidth) - floorf(beforeWidth), h);
+}
+
+void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const FloatPoint& point,
+                           int from, int to) const
+{
+    // This glyph buffer holds our glyphs + advances + font data for each glyph.
+    GlyphBuffer glyphBuffer;
+
+    float startX = point.x();
+    UniscribeController controller(this, run);
+    controller.advance(from);
+    float beforeWidth = controller.runWidthSoFar();
+    controller.advance(to, &glyphBuffer);
+    
+    // We couldn't generate any glyphs for the run.  Give up.
+    if (glyphBuffer.isEmpty())
+        return;
+    
+    float afterWidth = controller.runWidthSoFar();
+
+    if (run.rtl()) {
+        controller.advance(run.length());
+        startX += controller.runWidthSoFar() - afterWidth;
+    } else
+        startX += beforeWidth;
+
+    // Draw the glyph buffer now at the starting point returned in startX.
+    FloatPoint startPoint(startX, point.y());
+    drawGlyphBuffer(context, glyphBuffer, run, startPoint);
+}
+
+float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts) const
+{
+    UniscribeController controller(this, run, fallbackFonts);
+    controller.advance(run.length());
+    return controller.runWidthSoFar();
+}
+
+int Font::offsetForPositionForComplexText(const TextRun& run, int x, bool includePartialGlyphs) const
+{
+    UniscribeController controller(this, run);
+    return controller.offsetForPosition(x, includePartialGlyphs);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/GlyphPageTreeNodeCGWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/GlyphPageTreeNodeCGWin.cpp
new file mode 100644
index 0000000000..c11fc1b456
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/GlyphPageTreeNodeCGWin.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GlyphPageTreeNode.h"
+
+#include "SimpleFontData.h"
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+
+namespace WebCore {
+
+bool GlyphPage::fill(unsigned offset, unsigned length, UChar* buffer, unsigned bufferLength, const SimpleFontData* fontData)
+{
+    // bufferLength will be greater than the requested number of glyphs if the buffer contains surrogate pairs.
+    // We won't support this for now.
+    if (bufferLength > length)
+        return false;
+
+    bool haveGlyphs = false;
+    CGGlyph localGlyphBuffer[GlyphPage::size];
+    wkGetGlyphs(fontData->platformData().cgFont(), buffer, localGlyphBuffer, bufferLength);
+    for (unsigned i = 0; i < length; i++) {
+        Glyph glyph = localGlyphBuffer[i];
+        if (!glyph)
+            setGlyphDataForIndex(offset + i, 0, 0);
+        else {
+            setGlyphDataForIndex(offset + i, glyph, fontData);
+            haveGlyphs = true;
+        }
+    }
+    return haveGlyphs;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/GlyphPageTreeNodeCairoWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/GlyphPageTreeNodeCairoWin.cpp
new file mode 100644
index 0000000000..b679cedd11
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/GlyphPageTreeNodeCairoWin.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GlyphPageTreeNode.h"
+
+#include "SimpleFontData.h"
+
+namespace WebCore {
+
+bool GlyphPage::fill(unsigned offset, unsigned length, UChar* buffer, unsigned bufferLength, const SimpleFontData* fontData)
+{
+    // bufferLength will be greater than the requested number of glyphs if the buffer contains surrogate pairs.
+    // We won't support this for now.
+    if (bufferLength > length)
+        return false;
+
+    bool haveGlyphs = false;
+
+    HDC dc = GetDC((HWND)0);
+    SaveDC(dc);
+    SelectObject(dc, fontData->platformData().hfont());
+
+    TEXTMETRIC tm;
+    GetTextMetrics(dc, &tm);
+
+    WORD localGlyphBuffer[GlyphPage::size * 2];
+    DWORD result = GetGlyphIndices(dc, buffer, bufferLength, localGlyphBuffer, 0);
+    bool success = result != GDI_ERROR && static_cast<unsigned>(result) == bufferLength;
+    if (success) {
+        for (unsigned i = 0; i < length; i++) {
+            Glyph glyph = localGlyphBuffer[i];
+            if (!glyph)
+                setGlyphDataForIndex(offset + i, 0, 0);
+            else {
+                setGlyphDataForIndex(offset + i, glyph, fontData);
+                haveGlyphs = true;
+            }
+        }
+    }
+    RestoreDC(dc, -1);
+    ReleaseDC(0, dc);
+
+    return haveGlyphs;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
new file mode 100644
index 0000000000..84c4ce0881
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
@@ -0,0 +1,253 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "GraphicsContext.h"
+
+#include "AffineTransform.h"
+#include "Path.h"
+
+#include <CoreGraphics/CGBitmapContext.h>
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#include "GraphicsContextPlatformPrivateCG.h"
+
+using namespace std;
+
+namespace WebCore {
+
+static CGContextRef CGContextWithHDC(HDC hdc, bool hasAlpha)
+{
+    HBITMAP bitmap = static_cast<HBITMAP>(GetCurrentObject(hdc, OBJ_BITMAP));
+    CGColorSpaceRef deviceRGB = CGColorSpaceCreateDeviceRGB();
+    BITMAP info;
+
+    GetObject(bitmap, sizeof(info), &info);
+    ASSERT(info.bmBitsPixel == 32);
+
+    CGBitmapInfo bitmapInfo = kCGBitmapByteOrder32Little | (hasAlpha ? kCGImageAlphaPremultipliedFirst : kCGImageAlphaNoneSkipFirst);
+    CGContextRef context = CGBitmapContextCreate(info.bmBits, info.bmWidth, info.bmHeight, 8,
+                                                 info.bmWidthBytes, deviceRGB, bitmapInfo);
+    CGColorSpaceRelease(deviceRGB);
+
+    // Flip coords
+    CGContextTranslateCTM(context, 0, info.bmHeight);
+    CGContextScaleCTM(context, 1, -1);
+    
+    // Put the HDC In advanced mode so it will honor affine transforms.
+    SetGraphicsMode(hdc, GM_ADVANCED);
+    
+    return context;
+}
+
+GraphicsContext::GraphicsContext(HDC hdc, bool hasAlpha)
+    : m_common(createGraphicsContextPrivate())
+    , m_data(new GraphicsContextPlatformPrivate(CGContextWithHDC(hdc, hasAlpha)))
+{
+    CGContextRelease(m_data->m_cgContext.get());
+    m_data->m_hdc = hdc;
+    setPaintingDisabled(!m_data->m_cgContext);
+    if (m_data->m_cgContext) {
+        // Make sure the context starts in sync with our state.
+        setPlatformFillColor(fillColor(), DeviceColorSpace);
+        setPlatformStrokeColor(strokeColor(), DeviceColorSpace);
+    }
+}
+
+// FIXME: Is it possible to merge getWindowsContext and createWindowsBitmap into a single API
+// suitable for all clients?
+void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, bool supportAlphaBlend, bool mayCreateBitmap)
+{
+    if (mayCreateBitmap && hdc && inTransparencyLayer()) {
+        if (dstRect.isEmpty())
+            return;
+
+        HBITMAP bitmap = static_cast<HBITMAP>(GetCurrentObject(hdc, OBJ_BITMAP));
+
+        // Need to make a CGImage out of the bitmap's pixel buffer and then draw
+        // it into our context.
+        BITMAP info;
+        GetObject(bitmap, sizeof(info), &info);
+        ASSERT(info.bmBitsPixel == 32);
+
+        CGColorSpaceRef deviceRGB = CGColorSpaceCreateDeviceRGB();
+        CGContextRef bitmapContext = CGBitmapContextCreate(info.bmBits, info.bmWidth, info.bmHeight, 8,
+                                                           info.bmWidthBytes, deviceRGB, kCGBitmapByteOrder32Little | 
+                                                           (supportAlphaBlend ? kCGImageAlphaPremultipliedFirst : kCGImageAlphaNoneSkipFirst));
+        CGColorSpaceRelease(deviceRGB);
+
+        CGImageRef image = CGBitmapContextCreateImage(bitmapContext);
+        CGContextDrawImage(m_data->m_cgContext.get(), dstRect, image);
+        
+        // Delete all our junk.
+        CGImageRelease(image);
+        CGContextRelease(bitmapContext);
+        ::DeleteDC(hdc);
+        ::DeleteObject(bitmap);
+
+        return;
+    }
+
+    m_data->restore();
+}
+
+void GraphicsContext::drawWindowsBitmap(WindowsBitmap* image, const IntPoint& point)
+{
+    RetainPtr<CGColorSpaceRef> deviceRGB(AdoptCF, CGColorSpaceCreateDeviceRGB());
+    // FIXME: Creating CFData is non-optimal, but needed to avoid crashing when printing.  Ideally we should 
+    // make a custom CGDataProvider that controls the WindowsBitmap lifetime.  see <rdar://6394455>
+    RetainPtr<CFDataRef> imageData(AdoptCF, CFDataCreate(kCFAllocatorDefault, image->buffer(), image->bufferLength()));
+    RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateWithCFData(imageData.get()));
+    RetainPtr<CGImageRef> cgImage(AdoptCF, CGImageCreate(image->size().width(), image->size().height(), 8, 32, image->bytesPerRow(), deviceRGB.get(),
+                                                         kCGBitmapByteOrder32Little | kCGImageAlphaFirst, dataProvider.get(), 0, true, kCGRenderingIntentDefault));
+    CGContextDrawImage(m_data->m_cgContext.get(), CGRectMake(point.x(), point.y(), image->size().width(), image->size().height()), cgImage.get());   
+}
+
+void GraphicsContext::drawFocusRing(const Vector<Path>& paths, int width, int offset, const Color& color)
+{
+    // FIXME: implement
+}
+
+void GraphicsContext::drawFocusRing(const Vector<IntRect>& rects, int width, int offset, const Color& color)
+{
+    if (paintingDisabled())
+        return;
+
+    float radius = (width - 1) / 2.0f;
+    offset += radius;
+    CGColorRef colorRef = color.isValid() ? createCGColor(color) : 0;
+
+    CGMutablePathRef focusRingPath = CGPathCreateMutable();
+    unsigned rectCount = rects.size();
+    for (unsigned i = 0; i < rectCount; i++)
+        CGPathAddRect(focusRingPath, 0, CGRectInset(rects[i], -offset, -offset));
+
+    CGContextRef context = platformContext();
+    CGContextSaveGState(context);
+
+    CGContextBeginPath(context);
+    CGContextAddPath(context, focusRingPath);
+
+    wkDrawFocusRing(context, colorRef, radius);
+
+    CGColorRelease(colorRef);
+
+    CGPathRelease(focusRingPath);
+
+    CGContextRestoreGState(context);
+}
+
+// Pulled from GraphicsContextCG
+static void setCGStrokeColor(CGContextRef context, const Color& color)
+{
+    CGFloat red, green, blue, alpha;
+    color.getRGBA(red, green, blue, alpha);
+    CGContextSetRGBStrokeColor(context, red, green, blue, alpha);
+}
+
+static const Color& spellingPatternColor() {
+    static const Color spellingColor(255, 0, 0);
+    return spellingColor;
+}
+
+static const Color& grammarPatternColor() {
+    static const Color grammarColor(0, 128, 0);
+    return grammarColor;
+}
+
+void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint& point, int width, bool grammar)
+{
+    if (paintingDisabled())
+        return;
+
+    // These are the same for misspelling or bad grammar
+    const int patternHeight = 3; // 3 rows
+    ASSERT(cMisspellingLineThickness == patternHeight);
+    const int patternWidth = 4; // 4 pixels
+    ASSERT(patternWidth == cMisspellingLinePatternWidth);
+
+    // Make sure to draw only complete dots.
+    // NOTE: Code here used to shift the underline to the left and increase the width
+    // to make sure everything gets underlined, but that results in drawing out of
+    // bounds (e.g. when at the edge of a view) and could make it appear that the
+    // space between adjacent misspelled words was underlined.
+    // allow slightly more considering that the pattern ends with a transparent pixel
+    int widthMod = width % patternWidth;
+    if (patternWidth - widthMod > cMisspellingLinePatternGapWidth)
+        width -= widthMod;
+      
+    // Draw the underline
+    CGContextRef context = platformContext();
+    CGContextSaveGState(context);
+
+    const Color& patternColor = grammar ? grammarPatternColor() : spellingPatternColor();
+    setCGStrokeColor(context, patternColor);
+
+    wkSetPatternPhaseInUserSpace(context, point);
+    CGContextSetBlendMode(context, kCGBlendModeNormal);
+    
+    // 3 rows, each offset by half a pixel for blending purposes
+    const CGPoint upperPoints [] = {{point.x(), point.y() + patternHeight - 2.5 }, {point.x() + width, point.y() + patternHeight - 2.5}};
+    const CGPoint middlePoints [] = {{point.x(), point.y() + patternHeight - 1.5 }, {point.x() + width, point.y() + patternHeight - 1.5}};
+    const CGPoint lowerPoints [] = {{point.x(), point.y() + patternHeight - 0.5 }, {point.x() + width, point.y() + patternHeight - 0.5 }};
+    
+    // Dash lengths for the top and bottom of the error underline are the same.
+    // These are magic.
+    static const float edge_dash_lengths[] = {2.0f, 2.0f};
+    static const float middle_dash_lengths[] = {2.76f, 1.24f};
+    static const float edge_offset = -(edge_dash_lengths[1] - 1.0f) / 2.0f;
+    static const float middle_offset = -(middle_dash_lengths[1] - 1.0f) / 2.0f;
+
+    // Line opacities.  Once again, these are magic.
+    const float upperOpacity = 0.33f;
+    const float middleOpacity = 0.75f;
+    const float lowerOpacity = 0.88f;
+
+    //Top line
+    CGContextSetLineDash(context, edge_offset, edge_dash_lengths, 
+                         sizeof(edge_dash_lengths) / sizeof(edge_dash_lengths[0]));
+    CGContextSetAlpha(context, upperOpacity);
+    CGContextStrokeLineSegments(context, upperPoints, 2);
+ 
+    // Middle line
+    CGContextSetLineDash(context, middle_offset, middle_dash_lengths, 
+                         sizeof(middle_dash_lengths) / sizeof(middle_dash_lengths[0]));
+    CGContextSetAlpha(context, middleOpacity);
+    CGContextStrokeLineSegments(context, middlePoints, 2);
+    
+    // Bottom line
+    CGContextSetLineDash(context, edge_offset, edge_dash_lengths,
+                         sizeof(edge_dash_lengths) / sizeof(edge_dash_lengths[0]));
+    CGContextSetAlpha(context, lowerOpacity);
+    CGContextStrokeLineSegments(context, lowerPoints, 2);
+
+    CGContextRestoreGState(context);
+}
+
+void GraphicsContextPlatformPrivate::flush()
+{
+    CGContextFlush(m_cgContext.get());
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
new file mode 100644
index 0000000000..7387a14664
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "GraphicsContext.h"
+
+#include "AffineTransform.h"
+#include "Path.h"
+
+#include <cairo-win32.h>
+#include "GraphicsContextPlatformPrivateCairo.h"
+
+using namespace std;
+
+namespace WebCore {
+
+static cairo_t* createCairoContextWithHDC(HDC hdc, bool hasAlpha)
+{
+    // Put the HDC In advanced mode so it will honor affine transforms.
+    SetGraphicsMode(hdc, GM_ADVANCED);
+
+    cairo_surface_t* surface = 0;
+
+    HBITMAP bitmap = static_cast<HBITMAP>(GetCurrentObject(hdc, OBJ_BITMAP));
+
+    BITMAP info;
+    if (!GetObject(bitmap, sizeof(info), &info))
+        surface = cairo_win32_surface_create(hdc);
+    else {
+        ASSERT(info.bmBitsPixel == 32);
+
+        surface = cairo_image_surface_create_for_data((unsigned char*)info.bmBits,
+                                               CAIRO_FORMAT_ARGB32,
+                                               info.bmWidth,
+                                               info.bmHeight,
+                                               info.bmWidthBytes);
+    }
+
+    cairo_t* context = cairo_create(surface);
+    cairo_surface_destroy(surface);
+
+    return context;
+}
+
+GraphicsContext::GraphicsContext(HDC dc, bool hasAlpha)
+    : m_common(createGraphicsContextPrivate())
+    , m_data(new GraphicsContextPlatformPrivate)
+{
+    if (dc) {
+        m_data->cr = createCairoContextWithHDC(dc, hasAlpha);
+        m_data->m_hdc = dc;
+    } else {
+        setPaintingDisabled(true);
+        m_data->cr = 0;
+        m_data->m_hdc = 0;
+    }
+
+    if (m_data->cr) {
+        // Make sure the context starts in sync with our state.
+        setPlatformFillColor(fillColor(), fillColorSpace());
+        setPlatformStrokeColor(strokeColor(), strokeColorSpace());
+    }
+}
+
+void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, bool supportAlphaBlend, bool mayCreateBitmap)
+{
+    if (!mayCreateBitmap || !hdc || !inTransparencyLayer()) {
+        m_data->restore();
+        return;
+    }
+
+    if (dstRect.isEmpty())
+        return;
+
+    HBITMAP bitmap = static_cast<HBITMAP>(GetCurrentObject(hdc, OBJ_BITMAP));
+
+    BITMAP info;
+    GetObject(bitmap, sizeof(info), &info);
+    ASSERT(info.bmBitsPixel == 32);
+
+    // Need to make a cairo_surface_t out of the bitmap's pixel buffer and then draw
+    // it into our context.
+    cairo_surface_t* image = cairo_image_surface_create_for_data((unsigned char*)info.bmBits,
+                                            CAIRO_FORMAT_ARGB32,
+                                            info.bmWidth,
+                                            info.bmHeight,
+                                            info.bmWidthBytes);
+
+    // Scale the target surface to the new image size, and flip it
+    // so that when we set the srcImage as the surface it will draw
+    // right-side-up.
+    cairo_translate(m_data->cr, 0, dstRect.height());
+    cairo_scale(m_data->cr, dstRect.width(), -dstRect.height());
+    cairo_set_source_surface (m_data->cr, image, dstRect.x(), dstRect.y());
+
+    if (m_data->layers.size())
+        cairo_paint_with_alpha(m_data->cr, m_data->layers.last());
+    else
+        cairo_paint(m_data->cr);
+     
+    // Delete all our junk.
+    cairo_surface_destroy(image);
+    ::DeleteDC(hdc);
+    ::DeleteObject(bitmap);
+}
+
+void GraphicsContextPlatformPrivate::syncContext(PlatformGraphicsContext* cr)
+{
+    if (!cr)
+       return;
+
+    cairo_surface_t* surface = cairo_get_target(cr);
+    m_hdc = cairo_win32_surface_get_dc(surface);   
+
+    SetGraphicsMode(m_hdc, GM_ADVANCED); // We need this call for themes to honor world transforms.
+}
+
+void GraphicsContextPlatformPrivate::flush()
+{
+    cairo_surface_t* surface = cairo_win32_surface_create(m_hdc);
+    cairo_surface_flush(surface);
+    cairo_surface_destroy(surface);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/GraphicsContextWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/GraphicsContextWin.cpp
new file mode 100644
index 0000000000..b11014513c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/GraphicsContextWin.cpp
@@ -0,0 +1,211 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "GraphicsContext.h"
+
+#if PLATFORM(CG)
+#include "GraphicsContextPlatformPrivateCG.h"
+#elif PLATFORM(CAIRO)
+#include "GraphicsContextPlatformPrivateCairo.h"
+#endif
+
+#include "AffineTransform.h"
+#include "BitmapInfo.h"
+#include "TransformationMatrix.h"
+#include "NotImplemented.h"
+#include "Path.h"
+#include <wtf/MathExtras.h>
+
+using namespace std;
+
+namespace WebCore {
+
+class SVGResourceImage;
+
+static void fillWithClearColor(HBITMAP bitmap)
+{
+    BITMAP bmpInfo;
+    GetObject(bitmap, sizeof(bmpInfo), &bmpInfo);
+    int bufferSize = bmpInfo.bmWidthBytes * bmpInfo.bmHeight;
+    memset(bmpInfo.bmBits, 0, bufferSize);
+}
+
+bool GraphicsContext::inTransparencyLayer() const { return m_data->m_transparencyCount; }
+
+void GraphicsContext::setShouldIncludeChildWindows(bool include)
+{
+    m_data->m_shouldIncludeChildWindows = include;
+}
+
+bool GraphicsContext::shouldIncludeChildWindows() const
+{
+    return m_data->m_shouldIncludeChildWindows;
+}
+
+GraphicsContext::WindowsBitmap::WindowsBitmap(HDC hdc, IntSize size)
+    : m_hdc(0)
+    , m_size(size)
+{
+    BitmapInfo bitmapInfo = BitmapInfo::create(m_size);
+
+    m_bitmap = CreateDIBSection(0, &bitmapInfo, DIB_RGB_COLORS, reinterpret_cast<void**>(&m_bitmapBuffer), 0, 0);
+    if (!m_bitmap)
+        return;
+
+    m_hdc = CreateCompatibleDC(hdc);
+    SelectObject(m_hdc, m_bitmap);
+
+    BITMAP bmpInfo;
+    GetObject(m_bitmap, sizeof(bmpInfo), &bmpInfo);
+    m_bytesPerRow = bmpInfo.bmWidthBytes;
+    m_bitmapBufferLength = bmpInfo.bmWidthBytes * bmpInfo.bmHeight;
+
+    SetGraphicsMode(m_hdc, GM_ADVANCED);
+}
+
+GraphicsContext::WindowsBitmap::~WindowsBitmap()
+{
+    if (!m_bitmap)
+        return;
+
+    DeleteDC(m_hdc);
+    DeleteObject(m_bitmap);
+}
+
+GraphicsContext::WindowsBitmap* GraphicsContext::createWindowsBitmap(IntSize size)
+{
+    return new WindowsBitmap(m_data->m_hdc, size);
+}
+
+HDC GraphicsContext::getWindowsContext(const IntRect& dstRect, bool supportAlphaBlend, bool mayCreateBitmap)
+{
+    // FIXME: Should a bitmap be created also when a shadow is set?
+    if (mayCreateBitmap && inTransparencyLayer()) {
+        if (dstRect.isEmpty())
+            return 0;
+
+        // Create a bitmap DC in which to draw.
+        BitmapInfo bitmapInfo = BitmapInfo::create(dstRect.size());
+
+        void* pixels = 0;
+        HBITMAP bitmap = ::CreateDIBSection(NULL, &bitmapInfo, DIB_RGB_COLORS, &pixels, 0, 0);
+        if (!bitmap)
+            return 0;
+
+        HDC bitmapDC = ::CreateCompatibleDC(m_data->m_hdc);
+        ::SelectObject(bitmapDC, bitmap);
+
+        // Fill our buffer with clear if we're going to alpha blend.
+        if (supportAlphaBlend)
+           fillWithClearColor(bitmap);
+
+        // Make sure we can do world transforms.
+        SetGraphicsMode(bitmapDC, GM_ADVANCED);
+
+        // Apply a translation to our context so that the drawing done will be at (0,0) of the bitmap.
+        XFORM xform = TransformationMatrix().translate(-dstRect.x(), -dstRect.y());
+
+        ::SetWorldTransform(bitmapDC, &xform);
+
+        return bitmapDC;
+    }
+
+    m_data->flush();
+    m_data->save();
+    return m_data->m_hdc;
+}
+
+void GraphicsContextPlatformPrivate::save()
+{
+    if (!m_hdc)
+        return;
+    SaveDC(m_hdc);
+}
+
+void GraphicsContextPlatformPrivate::restore()
+{
+    if (!m_hdc)
+        return;
+    RestoreDC(m_hdc, -1);
+}
+
+void GraphicsContextPlatformPrivate::clip(const FloatRect& clipRect)
+{
+    if (!m_hdc)
+        return;
+    IntersectClipRect(m_hdc, clipRect.x(), clipRect.y(), clipRect.right(), clipRect.bottom());
+}
+
+void GraphicsContextPlatformPrivate::clip(const Path&)
+{
+    notImplemented();
+}
+
+void GraphicsContextPlatformPrivate::scale(const FloatSize& size)
+{
+    if (!m_hdc)
+        return;
+
+    XFORM xform = TransformationMatrix().scaleNonUniform(size.width(), size.height());
+    ModifyWorldTransform(m_hdc, &xform, MWT_LEFTMULTIPLY);
+}
+
+static const double deg2rad = 0.017453292519943295769; // pi/180
+
+void GraphicsContextPlatformPrivate::rotate(float degreesAngle)
+{
+    XFORM xform = TransformationMatrix().rotate(degreesAngle);
+    ModifyWorldTransform(m_hdc, &xform, MWT_LEFTMULTIPLY);
+}
+
+void GraphicsContextPlatformPrivate::translate(float x , float y)
+{
+    if (!m_hdc)
+        return;
+
+    XFORM xform = TransformationMatrix().translate(x, y);
+    ModifyWorldTransform(m_hdc, &xform, MWT_LEFTMULTIPLY);
+}
+
+void GraphicsContextPlatformPrivate::concatCTM(const AffineTransform& transform)
+{
+    if (!m_hdc)
+        return;
+
+    XFORM xform = transform.toTransformationMatrix();
+    ModifyWorldTransform(m_hdc, &xform, MWT_LEFTMULTIPLY);
+}
+
+#if ENABLE(SVG)
+GraphicsContext* contextForImage(SVGResourceImage*)
+{
+    // FIXME: This should go in GraphicsContextCG.cpp
+    notImplemented();
+    return 0;
+}
+#endif
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/GraphicsLayerCACF.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/GraphicsLayerCACF.cpp
new file mode 100644
index 0000000000..04e7081bdb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/GraphicsLayerCACF.cpp
@@ -0,0 +1,836 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayerCACF.h"
+
+#include "CString.h"
+#include "FloatConversion.h"
+#include "FloatRect.h"
+#include "Font.h"
+#include "FontSelector.h"
+#include "Image.h"
+#include "PlatformString.h"
+#include "SystemTime.h"
+#include "WKCACFLayer.h"
+#include <QuartzCoreInterface/QuartzCoreInterface.h>
+#include <wtf/CurrentTime.h>
+#include <wtf/StringExtras.h>
+
+using namespace std;
+
+namespace WebCore {
+
+class WebLayer : public WKCACFLayer {
+public:
+    static PassRefPtr<WKCACFLayer> create(LayerType layerType, GraphicsLayerCACF* owner)
+    {
+        return adoptRef(new WebLayer(layerType, owner));
+    }
+
+    virtual void setNeedsDisplay(const CGRect* dirtyRect)
+    {
+        if (m_owner) {
+            if (m_owner->showRepaintCounter()) {
+                CGRect layerBounds = bounds();
+                CGRect repaintCounterRect = layerBounds;
+                // We assume a maximum of 4 digits and a font size of 22.
+                repaintCounterRect.size.width = 48;
+                repaintCounterRect.size.height = 25;
+                if (m_owner->contentsOrientation() == WebCore::GraphicsLayer::CompositingCoordinatesTopDown)
+                    repaintCounterRect.origin.y = layerBounds.size.height - (layerBounds.origin.y + repaintCounterRect.size.height);
+                WKCACFLayer::setNeedsDisplay(&repaintCounterRect);
+            }
+            if (dirtyRect && m_owner->contentsOrientation() == WebCore::GraphicsLayer::CompositingCoordinatesTopDown) {
+                CGRect flippedDirtyRect = *dirtyRect;
+                flippedDirtyRect.origin.y = bounds().size.height - (flippedDirtyRect.origin.y + flippedDirtyRect.size.height);
+                WKCACFLayer::setNeedsDisplay(&flippedDirtyRect);
+                return;
+            }
+        }
+        WKCACFLayer::setNeedsDisplay(dirtyRect);
+    }
+
+    virtual void drawInContext(PlatformGraphicsContext* context)
+    {
+        if (!m_owner)
+            return;
+
+        CGContextSaveGState(context);
+
+        CGRect layerBounds = bounds();
+        if (m_owner->contentsOrientation() == WebCore::GraphicsLayer::CompositingCoordinatesTopDown) {
+            CGContextScaleCTM(context, 1, -1);
+            CGContextTranslateCTM(context, 0, -layerBounds.size.height);
+        }
+
+        if (m_owner->client()) {
+            GraphicsContext graphicsContext(context);
+
+            // It's important to get the clip from the context, because it may be significantly
+            // smaller than the layer bounds (e.g. tiled layers)
+            CGRect clipBounds = CGContextGetClipBoundingBox(context);
+            IntRect clip(enclosingIntRect(clipBounds));
+            m_owner->paintGraphicsLayerContents(graphicsContext, clip);
+        }
+#ifndef NDEBUG
+        else {
+            ASSERT_NOT_REACHED();
+
+            // FIXME: ideally we'd avoid calling -setNeedsDisplay on a layer that is a plain color,
+            // so CA never makes backing store for it (which is what -setNeedsDisplay will do above).
+            CGContextSetRGBFillColor(context, 0.0f, 1.0f, 0.0f, 1.0f);
+            CGContextFillRect(context, layerBounds);
+        }
+#endif
+
+        if (m_owner->showRepaintCounter()) {
+            String text = String::format("%d", m_owner->incrementRepaintCount());;
+
+            CGContextSaveGState(context);
+            CGContextSetRGBFillColor(context, 1.0f, 0.0f, 0.0f, 0.8f);
+            
+            CGRect aBounds = layerBounds;
+
+            aBounds.size.width = 10 + 12 * text.length();
+            aBounds.size.height = 25;
+            CGContextFillRect(context, aBounds);
+            
+            FontDescription desc;
+
+            NONCLIENTMETRICS metrics;
+            metrics.cbSize = sizeof(metrics);
+            SystemParametersInfo(SPI_GETNONCLIENTMETRICS, metrics.cbSize, &metrics, 0);
+            FontFamily family;
+            family.setFamily(metrics.lfSmCaptionFont.lfFaceName);
+            desc.setFamily(family);
+
+            desc.setComputedSize(22);
+            
+            Font font = Font(desc, 0, 0);
+            font.update(0);
+
+            GraphicsContext cg(context);
+            cg.setFillColor(Color::black, DeviceColorSpace);
+            cg.drawText(font, TextRun(text), IntPoint(aBounds.origin.x + 3, aBounds.origin.y + 20));
+
+            CGContextRestoreGState(context);        
+        }
+
+        CGContextRestoreGState(context);
+    }
+
+protected:
+    WebLayer(LayerType layerType, GraphicsLayerCACF* owner)
+     : WKCACFLayer(layerType)
+     , m_owner(owner)
+    {
+    }
+
+private:
+    GraphicsLayer* m_owner;
+};
+
+static inline void copyTransform(CATransform3D& toT3D, const TransformationMatrix& t)
+{
+    toT3D.m11 = narrowPrecisionToFloat(t.m11());
+    toT3D.m12 = narrowPrecisionToFloat(t.m12());
+    toT3D.m13 = narrowPrecisionToFloat(t.m13());
+    toT3D.m14 = narrowPrecisionToFloat(t.m14());
+    toT3D.m21 = narrowPrecisionToFloat(t.m21());
+    toT3D.m22 = narrowPrecisionToFloat(t.m22());
+    toT3D.m23 = narrowPrecisionToFloat(t.m23());
+    toT3D.m24 = narrowPrecisionToFloat(t.m24());
+    toT3D.m31 = narrowPrecisionToFloat(t.m31());
+    toT3D.m32 = narrowPrecisionToFloat(t.m32());
+    toT3D.m33 = narrowPrecisionToFloat(t.m33());
+    toT3D.m34 = narrowPrecisionToFloat(t.m34());
+    toT3D.m41 = narrowPrecisionToFloat(t.m41());
+    toT3D.m42 = narrowPrecisionToFloat(t.m42());
+    toT3D.m43 = narrowPrecisionToFloat(t.m43());
+    toT3D.m44 = narrowPrecisionToFloat(t.m44());
+}
+
+TransformationMatrix CAToTransform3D(const CATransform3D& fromT3D)
+{
+    return TransformationMatrix(
+        fromT3D.m11,
+        fromT3D.m12,
+        fromT3D.m13,
+        fromT3D.m14,
+        fromT3D.m21,
+        fromT3D.m22,
+        fromT3D.m23,
+        fromT3D.m24,
+        fromT3D.m31,
+        fromT3D.m32,
+        fromT3D.m33,
+        fromT3D.m34,
+        fromT3D.m41,
+        fromT3D.m42,
+        fromT3D.m43,
+        fromT3D.m44);
+}
+
+static void setLayerBorderColor(WKCACFLayer* layer, const Color& color)
+{
+    CGColorRef borderColor = createCGColor(color);
+    layer->setBorderColor(borderColor);
+    CGColorRelease(borderColor);
+}
+
+static void clearBorderColor(WKCACFLayer* layer)
+{
+    layer->setBorderColor(0);
+}
+
+static void setLayerBackgroundColor(WKCACFLayer* layer, const Color& color)
+{
+    CGColorRef bgColor = createCGColor(color);
+    layer->setBackgroundColor(bgColor);
+    CGColorRelease(bgColor);
+}
+
+static void clearLayerBackgroundColor(WKCACFLayer* layer)
+{
+    layer->setBackgroundColor(0);
+}
+
+GraphicsLayer::CompositingCoordinatesOrientation GraphicsLayer::compositingCoordinatesOrientation()
+{
+    return CompositingCoordinatesBottomUp;
+}
+
+PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
+{
+    return new GraphicsLayerCACF(client);
+}
+
+GraphicsLayerCACF::GraphicsLayerCACF(GraphicsLayerClient* client)
+    : GraphicsLayer(client)
+    , m_contentsLayerPurpose(NoContentsLayer)
+    , m_contentsLayerHasBackgroundColor(false)
+{
+    m_layer = WebLayer::create(WKCACFLayer::Layer, this);
+    
+    updateDebugIndicators();
+}
+
+GraphicsLayerCACF::~GraphicsLayerCACF()
+{
+    // clean up the WK layer
+    if (m_layer)
+        m_layer->removeFromSuperlayer();
+    
+    if (m_contentsLayer)
+        m_contentsLayer->removeFromSuperlayer();
+
+    if (m_transformLayer)
+        m_transformLayer->removeFromSuperlayer();
+}
+
+void GraphicsLayerCACF::setName(const String& name)
+{
+    String longName = String::format("CALayer(%p) GraphicsLayer(%p) ", m_layer.get(), this) + name;
+    GraphicsLayer::setName(longName);
+    
+    m_layer->setName(longName);
+}
+
+NativeLayer GraphicsLayerCACF::nativeLayer() const
+{
+    return m_layer.get();
+}
+
+bool GraphicsLayerCACF::setChildren(const Vector<GraphicsLayer*>& children)
+{
+    bool childrenChanged = GraphicsLayer::setChildren(children);
+    // FIXME: GraphicsLayer::setChildren calls addChild() for each sublayer, which
+    // will end up calling updateSublayerList() N times.
+    if (childrenChanged)
+        updateSublayerList();
+    
+    return childrenChanged;
+}
+
+void GraphicsLayerCACF::addChild(GraphicsLayer* childLayer)
+{
+    GraphicsLayer::addChild(childLayer);
+    updateSublayerList();
+}
+
+void GraphicsLayerCACF::addChildAtIndex(GraphicsLayer* childLayer, int index)
+{
+    GraphicsLayer::addChildAtIndex(childLayer, index);
+    updateSublayerList();
+}
+
+void GraphicsLayerCACF::addChildBelow(GraphicsLayer* childLayer, GraphicsLayer* sibling)
+{
+    GraphicsLayer::addChildBelow(childLayer, sibling);
+    updateSublayerList();
+}
+
+void GraphicsLayerCACF::addChildAbove(GraphicsLayer* childLayer, GraphicsLayer *sibling)
+{
+    GraphicsLayer::addChildAbove(childLayer, sibling);
+    updateSublayerList();
+}
+
+bool GraphicsLayerCACF::replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild)
+{
+    if (GraphicsLayer::replaceChild(oldChild, newChild)) {
+        updateSublayerList();
+        return true;
+    }
+    return false;
+}
+
+void GraphicsLayerCACF::removeFromParent()
+{
+    GraphicsLayer::removeFromParent();
+    layerForSuperlayer()->removeFromSuperlayer();            
+}
+
+void GraphicsLayerCACF::setPosition(const FloatPoint& point)
+{
+    GraphicsLayer::setPosition(point);
+    updateLayerPosition();
+}
+
+void GraphicsLayerCACF::setAnchorPoint(const FloatPoint3D& point)
+{
+    if (point == m_anchorPoint)
+        return;
+
+    GraphicsLayer::setAnchorPoint(point);
+    updateAnchorPoint();
+}
+
+void GraphicsLayerCACF::setSize(const FloatSize& size)
+{
+    if (size == m_size)
+        return;
+
+    GraphicsLayer::setSize(size);
+    updateLayerSize();
+}
+
+void GraphicsLayerCACF::setTransform(const TransformationMatrix& t)
+{
+    if (t == m_transform)
+        return;
+
+    GraphicsLayer::setTransform(t);
+    updateTransform();
+}
+
+void GraphicsLayerCACF::setChildrenTransform(const TransformationMatrix& t)
+{
+    if (t == m_childrenTransform)
+        return;
+
+    GraphicsLayer::setChildrenTransform(t);
+    updateChildrenTransform();
+}
+
+void GraphicsLayerCACF::setPreserves3D(bool preserves3D)
+{
+    if (preserves3D == m_preserves3D)
+        return;
+
+    GraphicsLayer::setPreserves3D(preserves3D);
+    updateLayerPreserves3D();
+}
+
+void GraphicsLayerCACF::setMasksToBounds(bool masksToBounds)
+{
+    if (masksToBounds == m_masksToBounds)
+        return;
+
+    GraphicsLayer::setMasksToBounds(masksToBounds);
+    updateMasksToBounds();
+}
+
+void GraphicsLayerCACF::setDrawsContent(bool drawsContent)
+{
+    if (drawsContent == m_drawsContent)
+        return;
+
+    GraphicsLayer::setDrawsContent(drawsContent);
+    updateLayerDrawsContent();
+}
+
+void GraphicsLayerCACF::setBackgroundColor(const Color& color)
+{
+    if (m_backgroundColorSet && m_backgroundColor == color)
+        return;
+
+    GraphicsLayer::setBackgroundColor(color);
+
+    m_contentsLayerHasBackgroundColor = true;
+    updateLayerBackgroundColor();
+}
+
+void GraphicsLayerCACF::clearBackgroundColor()
+{
+    if (!m_backgroundColorSet)
+        return;
+
+    GraphicsLayer::clearBackgroundColor();
+    clearLayerBackgroundColor(m_contentsLayer.get());
+}
+
+void GraphicsLayerCACF::setContentsOpaque(bool opaque)
+{
+    if (m_contentsOpaque == opaque)
+        return;
+
+    GraphicsLayer::setContentsOpaque(opaque);
+    updateContentsOpaque();
+}
+
+void GraphicsLayerCACF::setBackfaceVisibility(bool visible)
+{
+    if (m_backfaceVisibility == visible)
+        return;
+    
+    GraphicsLayer::setBackfaceVisibility(visible);
+    updateBackfaceVisibility();
+}
+    
+void GraphicsLayerCACF::setOpacity(float opacity)
+{
+    float clampedOpacity = max(min(opacity, 1.0f), 0.0f);
+    
+    if (m_opacity == clampedOpacity)
+        return;
+    
+    GraphicsLayer::setOpacity(clampedOpacity);
+    primaryLayer()->setOpacity(opacity);
+}
+
+void GraphicsLayerCACF::setNeedsDisplay()
+{
+    if (drawsContent())
+        m_layer->setNeedsDisplay();
+}
+
+void GraphicsLayerCACF::setNeedsDisplayInRect(const FloatRect& rect)
+{
+    if (drawsContent()) {
+        CGRect cgRect = rect;
+        m_layer->setNeedsDisplay(&cgRect);
+    }
+}
+
+void GraphicsLayerCACF::setContentsRect(const IntRect& rect)
+{
+    if (rect == m_contentsRect)
+        return;
+
+    GraphicsLayer::setContentsRect(rect);
+    updateContentsRect();
+}
+
+void GraphicsLayerCACF::setContentsToImage(Image* image)
+{
+    bool childrenChanged = false;
+
+    if (image) {
+        m_pendingContentsImage = image->nativeImageForCurrentFrame();
+        m_contentsLayerPurpose = ContentsLayerForImage;
+        if (!m_contentsLayer)
+            childrenChanged = true;
+    } else {
+        m_pendingContentsImage = 0;
+        m_contentsLayerPurpose = NoContentsLayer;
+        if (m_contentsLayer)
+            childrenChanged = true;
+    }
+
+    updateContentsImage();
+
+    // This has to happen after updateContentsImage
+    if (childrenChanged)
+        updateSublayerList();
+}
+
+void GraphicsLayerCACF::setContentsToMedia(PlatformLayer* mediaLayer)
+{
+    if (mediaLayer == m_contentsLayer)
+        return;
+
+    m_contentsLayer = mediaLayer;
+    m_contentsLayerPurpose = mediaLayer ? ContentsLayerForMedia : NoContentsLayer;
+
+    updateContentsMedia();
+
+    // This has to happen after updateContentsMedia
+    updateSublayerList();
+}
+
+void GraphicsLayerCACF::setGeometryOrientation(CompositingCoordinatesOrientation orientation)
+{
+    if (orientation == m_geometryOrientation)
+        return;
+
+    GraphicsLayer::setGeometryOrientation(orientation);
+    updateGeometryOrientation();
+}
+
+PlatformLayer* GraphicsLayerCACF::hostLayerForSublayers() const
+{
+    return m_transformLayer ? m_transformLayer.get() : m_layer.get();
+}
+
+PlatformLayer* GraphicsLayerCACF::layerForSuperlayer() const
+{
+    return m_transformLayer ? m_transformLayer.get() : m_layer.get();
+}
+
+PlatformLayer* GraphicsLayerCACF::platformLayer() const
+{
+    return primaryLayer();
+}
+
+void GraphicsLayerCACF::setDebugBackgroundColor(const Color& color)
+{
+    if (color.isValid())
+        setLayerBackgroundColor(m_layer.get(), color);
+    else
+        clearLayerBackgroundColor(m_layer.get());
+}
+
+void GraphicsLayerCACF::setDebugBorder(const Color& color, float borderWidth)
+{
+    if (color.isValid()) {
+        setLayerBorderColor(m_layer.get(), color);
+        m_layer->setBorderWidth(borderWidth);
+    } else {
+        clearBorderColor(m_layer.get());
+        m_layer->setBorderWidth(0);
+    }
+}
+
+GraphicsLayer::CompositingCoordinatesOrientation GraphicsLayerCACF::defaultContentsOrientation() const
+{
+    return CompositingCoordinatesTopDown;
+}
+
+void GraphicsLayerCACF::updateSublayerList()
+{
+    Vector<RefPtr<WKCACFLayer> > newSublayers;
+
+    if (m_transformLayer) {
+        // Add the primary layer first. Even if we have negative z-order children, the primary layer always comes behind.
+        newSublayers.append(m_layer.get());
+    } else if (m_contentsLayer) {
+        // FIXME: add the contents layer in the correct order with negative z-order children.
+        // This does not cause visible rendering issues because currently contents layers are only used
+        // for replaced elements that don't have children.
+        newSublayers.append(m_contentsLayer.get());
+    }
+    
+    const Vector<GraphicsLayer*>& childLayers = children();
+    size_t numChildren = childLayers.size();
+    for (size_t i = 0; i < numChildren; ++i) {
+        GraphicsLayerCACF* curChild = static_cast<GraphicsLayerCACF*>(childLayers[i]);
+     
+        WKCACFLayer* childLayer = curChild->layerForSuperlayer();
+        newSublayers.append(childLayer);
+    }
+
+    for (int i = 0; i < newSublayers.size(); ++i)
+        newSublayers[i]->removeFromSuperlayer();
+
+    if (m_transformLayer) {
+        m_transformLayer->setSublayers(newSublayers);
+
+        if (m_contentsLayer) {
+            // If we have a transform layer, then the contents layer is parented in the 
+            // primary layer (which is itself a child of the transform layer).
+            m_layer->removeAllSublayers();
+            m_layer->addSublayer(m_contentsLayer);
+        }
+    } else
+        m_layer->setSublayers(newSublayers);
+}
+
+void GraphicsLayerCACF::updateLayerPosition()
+{
+    // Position is offset on the layer by the layer anchor point.
+    CGPoint posPoint = CGPointMake(m_position.x() + m_anchorPoint.x() * m_size.width(),
+                                   m_position.y() + m_anchorPoint.y() * m_size.height());
+    
+    primaryLayer()->setPosition(posPoint);
+}
+
+void GraphicsLayerCACF::updateLayerSize()
+{
+    CGRect rect = CGRectMake(0, 0, m_size.width(), m_size.height());
+    if (m_transformLayer) {
+        m_transformLayer->setBounds(rect);
+        // The anchor of the contents layer is always at 0.5, 0.5, so the position is center-relative.
+        CGPoint centerPoint = CGPointMake(m_size.width() / 2.0f, m_size.height() / 2.0f);
+        m_layer->setPosition(centerPoint);
+    }
+    
+    m_layer->setBounds(rect);
+    
+    // Note that we don't resize m_contentsLayer. It's up the caller to do that.
+
+    // if we've changed the bounds, we need to recalculate the position
+    // of the layer, taking anchor point into account.
+    updateLayerPosition();
+}
+
+void GraphicsLayerCACF::updateAnchorPoint()
+{
+    primaryLayer()->setAnchorPoint(FloatPoint(m_anchorPoint.x(), m_anchorPoint.y()));
+    primaryLayer()->setAnchorPointZ(m_anchorPoint.z());
+    updateLayerPosition();
+}
+
+void GraphicsLayerCACF::updateTransform()
+{
+    CATransform3D transform;
+    copyTransform(transform, m_transform);
+    primaryLayer()->setTransform(transform);
+}
+
+void GraphicsLayerCACF::updateChildrenTransform()
+{
+    CATransform3D transform;
+    copyTransform(transform, m_childrenTransform);
+    primaryLayer()->setSublayerTransform(transform);
+}
+
+void GraphicsLayerCACF::updateMasksToBounds()
+{
+    m_layer->setMasksToBounds(m_masksToBounds);
+    updateDebugIndicators();
+}
+
+void GraphicsLayerCACF::updateContentsOpaque()
+{
+    m_layer->setOpaque(m_contentsOpaque);
+}
+
+void GraphicsLayerCACF::updateBackfaceVisibility()
+{
+    m_layer->setDoubleSided(m_backfaceVisibility);
+}
+
+void GraphicsLayerCACF::updateLayerPreserves3D()
+{
+    if (m_preserves3D && !m_transformLayer) {
+        // Create the transform layer.
+        m_transformLayer = WebLayer::create(WKCACFLayer::TransformLayer, this);
+
+#ifndef NDEBUG
+        m_transformLayer->setName(String().format("Transform Layer CATransformLayer(%p) GraphicsLayer(%p)", m_transformLayer.get(), this));
+#endif
+        // Copy the position from this layer.
+        updateLayerPosition();
+        updateLayerSize();
+        updateAnchorPoint();
+        updateTransform();
+        updateChildrenTransform();
+        
+        CGPoint point = CGPointMake(m_size.width() / 2.0f, m_size.height() / 2.0f);
+        m_layer->setPosition(point);
+
+        m_layer->setAnchorPoint(CGPointMake(0.5f, 0.5f));
+        m_layer->setTransform(wkqcCATransform3DIdentity());
+        
+        // Set the old layer to opacity of 1. Further down we will set the opacity on the transform layer.
+        m_layer->setOpacity(1);
+
+        // Move this layer to be a child of the transform layer.
+        if (m_layer->superlayer())
+            m_layer->superlayer()->replaceSublayer(m_layer.get(), m_transformLayer.get());
+        m_transformLayer->addSublayer(m_layer.get());
+
+        updateSublayerList();
+    } else if (!m_preserves3D && m_transformLayer) {
+        // Relace the transformLayer in the parent with this layer.
+        m_layer->removeFromSuperlayer();
+        m_transformLayer->superlayer()->replaceSublayer(m_transformLayer.get(), m_layer.get());
+
+        // Release the transform layer.
+        m_transformLayer = 0;
+
+        updateLayerPosition();
+        updateLayerSize();
+        updateAnchorPoint();
+        updateTransform();
+        updateChildrenTransform();
+
+        updateSublayerList();
+    }
+
+    updateOpacityOnLayer();
+}
+
+void GraphicsLayerCACF::updateLayerDrawsContent()
+{
+    if (m_drawsContent)
+        m_layer->setNeedsDisplay();
+    else
+        m_layer->setContents(nil);
+
+    updateDebugIndicators();
+}
+
+void GraphicsLayerCACF::updateLayerBackgroundColor()
+{
+    if (!m_contentsLayer)
+        return;
+
+    // We never create the contents layer just for background color yet.
+    if (m_backgroundColorSet)
+        setLayerBackgroundColor(m_contentsLayer.get(), m_backgroundColor);
+    else
+        clearLayerBackgroundColor(m_contentsLayer.get());
+}
+
+void GraphicsLayerCACF::updateContentsImage()
+{
+    if (m_pendingContentsImage) {
+        if (!m_contentsLayer.get()) {
+            RefPtr<WKCACFLayer> imageLayer = WebLayer::create(WKCACFLayer::Layer, this);
+#ifndef NDEBUG
+            imageLayer->setName("Image Layer");
+#endif
+            setupContentsLayer(imageLayer.get());
+            m_contentsLayer = imageLayer;
+            // m_contentsLayer will be parented by updateSublayerList
+        }
+
+        // FIXME: maybe only do trilinear if the image is being scaled down,
+        // but then what if the layer size changes?
+        m_contentsLayer->setMinificationFilter(WKCACFLayer::Trilinear);
+        m_contentsLayer->setContents(m_pendingContentsImage.get());
+        m_pendingContentsImage = 0;
+        
+        updateContentsRect();
+    } else {
+        // No image.
+        // m_contentsLayer will be removed via updateSublayerList.
+        m_contentsLayer = 0;
+    }
+}
+
+void GraphicsLayerCACF::updateContentsMedia()
+{
+    // Media layer was set as m_contentsLayer, and will get parented in updateSublayerList().
+    if (m_contentsLayer) {
+        setupContentsLayer(m_contentsLayer.get());
+        updateContentsRect();
+    }
+}
+
+void GraphicsLayerCACF::updateContentsRect()
+{
+    if (!m_contentsLayer)
+        return;
+        
+    CGPoint point = CGPointMake(m_contentsRect.x(),
+                                m_contentsRect.y());
+    CGRect rect = CGRectMake(0.0f,
+                             0.0f,
+                             m_contentsRect.width(),
+                             m_contentsRect.height());
+
+    m_contentsLayer->setPosition(point);
+    m_contentsLayer->setBounds(rect);
+}
+
+void GraphicsLayerCACF::updateGeometryOrientation()
+{
+    switch (geometryOrientation()) {
+        case CompositingCoordinatesTopDown:
+            m_layer->setGeometryFlipped(false);
+            break;
+        
+        case CompositingCoordinatesBottomUp:
+            m_layer->setGeometryFlipped(true);
+            break;
+    }
+    // Geometry orientation is mapped onto children transform in older QuartzCores,
+    // so is handled via setGeometryOrientation().
+}
+
+void GraphicsLayerCACF::setupContentsLayer(WKCACFLayer* contentsLayer)
+{
+    if (contentsLayer == m_contentsLayer)
+        return;
+
+    if (m_contentsLayer) {
+        m_contentsLayer->removeFromSuperlayer();
+        m_contentsLayer = 0;
+    }
+    
+    if (contentsLayer) {
+        m_contentsLayer = contentsLayer;
+
+        if (defaultContentsOrientation() == CompositingCoordinatesBottomUp) {
+            CATransform3D flipper = {
+                1.0f, 0.0f, 0.0f, 0.0f,
+                0.0f, -1.0f, 0.0f, 0.0f,
+                0.0f, 0.0f, 1.0f, 0.0f,
+                0.0f, 0.0f, 0.0f, 1.0f};
+            m_contentsLayer->setTransform(flipper);
+            m_contentsLayer->setAnchorPoint(CGPointMake(0.0f, 1.0f));
+        } else
+            m_contentsLayer->setAnchorPoint(CGPointMake(0.0f, 0.0f));
+
+        // Insert the content layer first. Video elements require this, because they have
+        // shadow content that must display in front of the video.
+        m_layer->insertSublayer(m_contentsLayer.get(), 0);
+
+        updateContentsRect();
+
+        if (showDebugBorders()) {
+            setLayerBorderColor(m_contentsLayer.get(), Color(0, 0, 128, 180));
+            m_contentsLayer->setBorderWidth(1.0f);
+        }
+    }
+    updateDebugIndicators();
+}
+
+// This function simply mimics the operation of GraphicsLayerCA
+void GraphicsLayerCACF::updateOpacityOnLayer()
+{
+    primaryLayer()->setOpacity(m_opacity);
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/GraphicsLayerCACF.h b/src/3rdparty/webkit/WebCore/platform/graphics/win/GraphicsLayerCACF.h
new file mode 100644
index 0000000000..8c3f848df5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/GraphicsLayerCACF.h
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef GraphicsLayerCACF_h_
+#define GraphicsLayerCACF_h_
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayer.h"
+#include "GraphicsContext.h"
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+class WKCACFLayer;
+
+class GraphicsLayerCACF : public GraphicsLayer {
+public:
+
+    GraphicsLayerCACF(GraphicsLayerClient*);
+    virtual ~GraphicsLayerCACF();
+
+    virtual void setName(const String& inName);
+
+    // for hosting this GraphicsLayer in a native layer hierarchy
+    virtual NativeLayer nativeLayer() const;
+
+    virtual bool setChildren(const Vector<GraphicsLayer*>&);
+    virtual void addChild(GraphicsLayer *layer);
+    virtual void addChildAtIndex(GraphicsLayer *layer, int index);
+    virtual void addChildAbove(GraphicsLayer *layer, GraphicsLayer *sibling);
+    virtual void addChildBelow(GraphicsLayer *layer, GraphicsLayer *sibling);
+    virtual bool replaceChild(GraphicsLayer *oldChild, GraphicsLayer *newChild);
+
+    virtual void removeFromParent();
+
+    virtual void setPosition(const FloatPoint& inPoint);
+    virtual void setAnchorPoint(const FloatPoint3D& inPoint);
+    virtual void setSize(const FloatSize& inSize);
+
+    virtual void setTransform(const TransformationMatrix&);
+
+    virtual void setChildrenTransform(const TransformationMatrix&);
+
+    virtual void setPreserves3D(bool);
+    virtual void setMasksToBounds(bool);
+    virtual void setDrawsContent(bool);
+
+    virtual void setBackgroundColor(const Color&);
+    virtual void clearBackgroundColor();
+
+    virtual void setContentsOpaque(bool);
+    virtual void setBackfaceVisibility(bool);
+
+    virtual void setOpacity(float opacity);
+
+    virtual void setNeedsDisplay();
+    virtual void setNeedsDisplayInRect(const FloatRect&);
+
+    virtual void setContentsRect(const IntRect&);
+
+    virtual void setContentsToImage(Image*);
+    virtual void setContentsToMedia(PlatformLayer*);
+    
+    virtual PlatformLayer* platformLayer() const;
+
+    virtual void setDebugBackgroundColor(const Color&);
+    virtual void setDebugBorder(const Color&, float borderWidth);
+
+    virtual void setGeometryOrientation(CompositingCoordinatesOrientation);
+
+private:
+    void updateOpacityOnLayer();
+
+    WKCACFLayer* primaryLayer() const  { return m_transformLayer.get() ? m_transformLayer.get() : m_layer.get(); }
+    WKCACFLayer* hostLayerForSublayers() const;
+    WKCACFLayer* layerForSuperlayer() const;
+
+    CompositingCoordinatesOrientation defaultContentsOrientation() const;
+    void updateSublayerList();
+    void updateLayerPosition();
+    void updateLayerSize();
+    void updateAnchorPoint();
+    void updateTransform();
+    void updateChildrenTransform();
+    void updateMasksToBounds();
+    void updateContentsOpaque();
+    void updateBackfaceVisibility();
+    void updateLayerPreserves3D();
+    void updateLayerDrawsContent();
+    void updateLayerBackgroundColor();
+
+    void updateContentsImage();
+    void updateContentsMedia();
+    void updateContentsRect();
+    void updateGeometryOrientation();
+    
+    void setupContentsLayer(WKCACFLayer*);
+    WKCACFLayer* contentsLayer() const { return m_contentsLayer.get(); }
+    
+    RefPtr<WKCACFLayer> m_layer;
+    RefPtr<WKCACFLayer> m_transformLayer;
+    RefPtr<WKCACFLayer> m_contentsLayer;
+
+    enum ContentsLayerPurpose {
+        NoContentsLayer = 0,
+        ContentsLayerForImage,
+        ContentsLayerForMedia
+    };
+    
+    ContentsLayerPurpose m_contentsLayerPurpose;
+    bool m_contentsLayerHasBackgroundColor : 1;
+    RetainPtr<CGImageRef> m_pendingContentsImage;
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // GraphicsLayerCACF_h_
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/IconWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/IconWin.cpp
new file mode 100644
index 0000000000..cc9343ac80
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/IconWin.cpp
@@ -0,0 +1,101 @@
+/*
+* Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+* Copyright (C) 2007-2009 Torch Mobile, Inc.
+*
+* This library is free software; you can redistribute it and/or
+* modify it under the terms of the GNU Library General Public
+* License as published by the Free Software Foundation; either
+* version 2 of the License, or (at your option) any later version.
+*
+* This library is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+* Library General Public License for more details.
+*
+* You should have received a copy of the GNU Library General Public License
+* along with this library; see the file COPYING.LIB.  If not, write to
+* the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+* Boston, MA 02110-1301, USA.
+*
+*/
+
+#include "config.h"
+#include "Icon.h"
+
+#include "GraphicsContext.h"
+#include "PlatformString.h"
+#include <tchar.h>
+#include <windows.h>
+
+#if OS(WINCE)
+// SHGFI_SHELLICONSIZE is not available on WINCE
+#define SHGFI_SHELLICONSIZE         0
+#endif
+
+namespace WebCore {
+
+static const int shell32MultipleFileIconIndex = 54;
+
+Icon::Icon(HICON icon)
+    : m_hIcon(icon)
+{
+    ASSERT(icon);
+}
+
+Icon::~Icon()
+{
+    DestroyIcon(m_hIcon);
+}
+
+// FIXME: Move the code to ChromeClient::iconForFiles().
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
+{
+    if (filenames.isEmpty())
+        return 0;
+
+    if (filenames.size() == 1) {
+        SHFILEINFO sfi;
+        memset(&sfi, 0, sizeof(sfi));
+
+        String tmpFilename = filenames[0];
+        if (!SHGetFileInfo(tmpFilename.charactersWithNullTermination(), 0, &sfi, sizeof(sfi), SHGFI_ICON | SHGFI_SHELLICONSIZE | SHGFI_SMALLICON))
+            return 0;
+
+        return adoptRef(new Icon(sfi.hIcon));
+    }
+
+#if OS(WINCE)
+    return 0;
+#else
+    TCHAR buffer[MAX_PATH];    
+    UINT length = ::GetSystemDirectory(buffer, ARRAYSIZE(buffer));
+    if (!length)
+        return 0;
+    
+    if (_tcscat_s(buffer, TEXT("\\shell32.dll")))
+        return 0;
+
+    HICON hIcon;
+    if (!::ExtractIconEx(buffer, shell32MultipleFileIconIndex, 0, &hIcon, 1))
+        return 0;
+    return adoptRef(new Icon(hIcon));
+#endif
+}
+
+void Icon::paint(GraphicsContext* context, const IntRect& r)
+{
+    if (context->paintingDisabled())
+        return;
+
+#if OS(WINCE)
+    context->drawIcon(m_hIcon, r, DI_NORMAL);
+#else
+    HDC hdc = context->getWindowsContext(r);
+
+    DrawIconEx(hdc, r.x(), r.y(), m_hIcon, r.width(), r.height(), 0, 0, DI_NORMAL);
+
+    context->releaseWindowsContext(hdc, r);
+#endif
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/ImageCGWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/ImageCGWin.cpp
new file mode 100644
index 0000000000..a0fbba73d9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/ImageCGWin.cpp
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Image.h"
+
+#include "BitmapImage.h"
+#include "BitmapInfo.h"
+#include "GraphicsContext.h"
+#include "PlatformString.h"
+#include <ApplicationServices/ApplicationServices.h>
+#include <windows.h>
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+PassRefPtr<BitmapImage> BitmapImage::create(HBITMAP hBitmap)
+{
+    DIBSECTION dibSection;
+    if (!GetObject(hBitmap, sizeof(DIBSECTION), &dibSection))
+        return 0;
+
+    ASSERT(dibSection.dsBm.bmBitsPixel == 32);
+    if (dibSection.dsBm.bmBitsPixel != 32)
+        return 0;
+
+    ASSERT(dibSection.dsBm.bmBits);
+    if (!dibSection.dsBm.bmBits)
+        return 0;
+
+    RetainPtr<CGColorSpaceRef> deviceRGB(AdoptCF, CGColorSpaceCreateDeviceRGB());
+    RetainPtr<CGContextRef> bitmapContext(AdoptCF, CGBitmapContextCreate(dibSection.dsBm.bmBits, dibSection.dsBm.bmWidth, dibSection.dsBm.bmHeight, 8,
+        dibSection.dsBm.bmWidthBytes, deviceRGB.get(), kCGBitmapByteOrder32Little | kCGImageAlphaPremultipliedFirst));
+
+    // The BitmapImage takes ownership of this.
+    CGImageRef cgImage = CGBitmapContextCreateImage(bitmapContext.get());
+
+    return adoptRef(new BitmapImage(cgImage));
+}
+
+bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
+{
+    ASSERT(bmp);
+
+    BITMAP bmpInfo;
+    GetObject(bmp, sizeof(BITMAP), &bmpInfo);
+
+    ASSERT(bmpInfo.bmBitsPixel == 32);
+    int bufferSize = bmpInfo.bmWidthBytes * bmpInfo.bmHeight;
+    
+    CGColorSpaceRef deviceRGB = CGColorSpaceCreateDeviceRGB();
+    CGContextRef cgContext = CGBitmapContextCreate(bmpInfo.bmBits, bmpInfo.bmWidth, bmpInfo.bmHeight,
+        8, bmpInfo.bmWidthBytes, deviceRGB, kCGBitmapByteOrder32Little | kCGImageAlphaPremultipliedFirst);
+  
+    GraphicsContext gc(cgContext);
+
+    IntSize imageSize = BitmapImage::size();
+    if (size)
+        drawFrameMatchingSourceSize(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), DeviceColorSpace, CompositeCopy);
+    else
+        draw(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), DeviceColorSpace, CompositeCopy);
+
+    // Do cleanup
+    CGContextRelease(cgContext);
+    CGColorSpaceRelease(deviceRGB);
+
+    return true;
+}
+
+void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const FloatRect& dstRect, const IntSize& srcSize, ColorSpace styleColorSpace, CompositeOperator compositeOp)
+{
+    size_t frames = frameCount();
+    for (size_t i = 0; i < frames; ++i) {
+        CGImageRef image = frameAtIndex(i);
+        if (CGImageGetHeight(image) == static_cast<size_t>(srcSize.height()) && CGImageGetWidth(image) == static_cast<size_t>(srcSize.width())) {
+            size_t currentFrame = m_currentFrame;
+            m_currentFrame = i;
+            draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, srcSize.width(), srcSize.height()), styleColorSpace, compositeOp);
+            m_currentFrame = currentFrame;
+            return;
+        }
+    }
+
+    // No image of the correct size was found, fallback to drawing the current frame
+    IntSize imageSize = BitmapImage::size();
+    draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), styleColorSpace, compositeOp);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/ImageCairoWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/ImageCairoWin.cpp
new file mode 100644
index 0000000000..e3c5ea03d6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/ImageCairoWin.cpp
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2008 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Image.h"
+#include "BitmapImage.h"
+#include "GraphicsContext.h"
+#include <cairo.h>
+#include <cairo-win32.h>
+
+#include <windows.h>
+#include "PlatformString.h"
+
+namespace WebCore {
+
+PassRefPtr<BitmapImage> BitmapImage::create(HBITMAP hBitmap)
+{
+    DIBSECTION dibSection;
+    if (!GetObject(hBitmap, sizeof(DIBSECTION), &dibSection))
+        return 0;
+
+    ASSERT(dibSection.dsBm.bmBitsPixel == 32);
+    if (dibSection.dsBm.bmBitsPixel != 32)
+        return 0;
+
+    ASSERT(dibSection.dsBm.bmBits);
+    if (!dibSection.dsBm.bmBits)
+        return 0;
+
+    cairo_surface_t* image = cairo_win32_surface_create_with_dib (CAIRO_FORMAT_ARGB32, dibSection.dsBm.bmWidth, dibSection.dsBm.bmHeight);
+
+    // The BitmapImage object takes over ownership of the cairo_surface_t*, so no need to destroy here.
+    return adoptRef(new BitmapImage(image));
+}
+
+bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
+{
+    ASSERT(bmp);
+
+    BITMAP bmpInfo;
+    GetObject(bmp, sizeof(BITMAP), &bmpInfo);
+
+    // If this is a 32bpp bitmap, which it always should be, we'll clear it so alpha-wise it will be visible
+    if (bmpInfo.bmBitsPixel == 32) {
+        int bufferSize = bmpInfo.bmWidthBytes * bmpInfo.bmHeight;
+        memset(bmpInfo.bmBits, 255, bufferSize);
+    }
+
+    cairo_surface_t* image = cairo_image_surface_create_for_data((unsigned char*)bmpInfo.bmBits,
+                                               CAIRO_FORMAT_ARGB32,
+                                               bmpInfo.bmWidth,
+                                               bmpInfo.bmHeight,
+                                               bmpInfo.bmWidthBytes);
+
+
+    cairo_t* targetRef = cairo_create(image);
+    cairo_surface_destroy(image);
+
+    GraphicsContext gc(targetRef);
+
+    IntSize imageSize = BitmapImage::size();
+    if (size)
+        drawFrameMatchingSourceSize(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), DeviceColorSpace, CompositeCopy);
+    else
+        draw(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), DeviceColorSpace, CompositeCopy);
+
+    // Do cleanup
+    cairo_destroy(targetRef);
+
+    return true;
+}
+
+void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const FloatRect& dstRect, const IntSize& srcSize, ColorSpace styleColorSpace, CompositeOperator compositeOp)
+{
+    size_t frames = frameCount();
+    for (size_t i = 0; i < frames; ++i) {
+        cairo_surface_t* image = frameAtIndex(i);
+        if (cairo_image_surface_get_height(image) == static_cast<size_t>(srcSize.height()) && cairo_image_surface_get_width(image) == static_cast<size_t>(srcSize.width())) {
+            size_t currentFrame = m_currentFrame;
+            m_currentFrame = i;
+            draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, srcSize.width(), srcSize.height()), DeviceColorSpace, compositeOp);
+            m_currentFrame = currentFrame;
+            return;
+        }
+    }
+
+    // No image of the correct size was found, fallback to drawing the current frame
+    IntSize imageSize = BitmapImage::size();
+    draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), DeviceColorSpace, compositeOp);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/android/LocalizedStringsAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/ImageWin.cpp
index 1fe80d85e4..54c5b41cce 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/LocalizedStringsAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/ImageWin.cpp
@@ -1,9 +1,5 @@
 /*
- * Copyright 2009, The Android Open Source Project
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
- * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com 
- * Copyright (C) 2007 Holger Hans Peter Freyther
- * All rights reserved.
+ * Copyright (C) 2006, 2007, 2008 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,31 +20,39 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
-#include "LocalizedStrings.h"
+#include "Image.h"
+#include "BitmapImage.h"
 
-#include "NotImplemented.h"
-#include "PlatformString.h"
+#include "SharedBuffer.h"
+
+// This function loads resources from WebKit
+PassRefPtr<WebCore::SharedBuffer> loadResourceIntoBuffer(const char*);
 
 namespace WebCore {
 
-String contextMenuItemTagInspectElement()
+void BitmapImage::initPlatformData()
+{
+}
+
+void BitmapImage::invalidatePlatformData()
 {
-    return String("Inspect Element");
 }
 
-String unknownFileSizeText()
+PassRefPtr<Image> Image::loadPlatformResource(const char *name)
 {
-    return String("Unknown");
+    RefPtr<SharedBuffer> buffer = loadResourceIntoBuffer(name);
+    RefPtr<BitmapImage> img = BitmapImage::create();
+    img->setData(buffer.release(), true);
+    return img.release();
 }
 
-String imageTitle(const String& filename, const IntSize& size)
+bool BitmapImage::getHBITMAP(HBITMAP bmp)
 {
-    notImplemented();
-    return String();
+    return getHBITMAPOfSize(bmp, 0);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/IntPointWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/IntPointWin.cpp
new file mode 100644
index 0000000000..73db1998f0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/IntPointWin.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "IntPoint.h"
+
+#include <windows.h>
+
+namespace WebCore {
+
+IntPoint::IntPoint(const POINT& p)
+    : m_x(p.x)
+    , m_y(p.y)
+{
+}
+
+IntPoint::operator POINT() const
+{
+    POINT p = {m_x, m_y};
+    return p;
+}
+
+IntPoint::IntPoint(const POINTS& p)
+    : m_x(p.x)
+    , m_y(p.y)
+{
+}
+
+IntPoint::operator POINTS() const
+{
+    POINTS p = {m_x, m_y};
+    return p;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/IntRectWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/IntRectWin.cpp
new file mode 100644
index 0000000000..fe25a7fce5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/IntRectWin.cpp
@@ -0,0 +1,45 @@
+
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "IntRect.h"
+
+#include <windows.h>
+
+namespace WebCore {
+
+IntRect::IntRect(const RECT& r)
+    : m_location(IntPoint(r.left, r.top)), m_size(IntSize(r.right-r.left, r.bottom-r.top))
+{
+}
+
+IntRect::operator RECT() const
+{
+    RECT rect = { x(), y(), right(), bottom() };
+    return rect;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.idl b/src/3rdparty/webkit/WebCore/platform/graphics/win/IntSizeWin.cpp
index bb236b941f..26e68dacc0 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.idl
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/IntSizeWin.cpp
@@ -20,17 +20,26 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-module html {
-    interface [
-        Conditional=3D_CANVAS,
-        HasNumericIndexGetter,
-        HasCustomIndexSetter,
-        GenerateNativeConverter,
-        GenerateCustomConstructor,
-        CustomToJS
-    ] CanvasFloatArray : CanvasArray {
-    };
+#include "config.h"
+#include "IntSize.h"
+
+#include <windows.h>
+
+namespace WebCore {
+
+IntSize::IntSize(const SIZE& s)
+    : m_width(s.cx)
+    , m_height(s.cy)
+{
+}
+
+IntSize::operator SIZE() const
+{
+    SIZE s = {m_width, m_height};
+    return s;
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
new file mode 100644
index 0000000000..c848eb3116
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
@@ -0,0 +1,972 @@
+/*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(VIDEO)
+#include "MediaPlayerPrivateQuickTimeWin.h"
+
+#include "Cookie.h"
+#include "CookieJar.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "KURL.h"
+#include "QTMovieWin.h"
+#include "ScrollView.h"
+#include "SoftLinking.h"
+#include "StringBuilder.h"
+#include "StringHash.h"
+#include "TimeRanges.h"
+#include "Timer.h"
+#include <Wininet.h>
+#include <wtf/CurrentTime.h>
+#include <wtf/HashSet.h>
+#include <wtf/MathExtras.h>
+#include <wtf/StdLibExtras.h>
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "GraphicsLayerCACF.h"
+#include "WKCACFLayer.h"
+#endif
+
+#if DRAW_FRAME_RATE
+#include "Font.h"
+#include "FrameView.h"
+#include "Frame.h"
+#include "Document.h"
+#include "RenderObject.h"
+#include "RenderStyle.h"
+#include "Windows.h"
+#endif
+
+using namespace std;
+
+namespace WebCore {
+
+SOFT_LINK_LIBRARY(Wininet)
+SOFT_LINK(Wininet, InternetSetCookieExW, DWORD, WINAPI, (LPCWSTR lpszUrl, LPCWSTR lpszCookieName, LPCWSTR lpszCookieData, DWORD dwFlags, DWORD_PTR dwReserved), (lpszUrl, lpszCookieName, lpszCookieData, dwFlags, dwReserved))
+
+MediaPlayerPrivateInterface* MediaPlayerPrivate::create(MediaPlayer* player) 
+{ 
+    return new MediaPlayerPrivate(player);
+}
+
+void MediaPlayerPrivate::registerMediaEngine(MediaEngineRegistrar registrar)
+{
+    if (isAvailable())
+        registrar(create, getSupportedTypes, supportsType);
+}
+
+MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
+    : m_player(player)
+    , m_seekTo(-1)
+    , m_seekTimer(this, &MediaPlayerPrivate::seekTimerFired)
+    , m_networkState(MediaPlayer::Empty)
+    , m_readyState(MediaPlayer::HaveNothing)
+    , m_enabledTrackCount(0)
+    , m_totalTrackCount(0)
+    , m_hasUnsupportedTracks(false)
+    , m_startedPlaying(false)
+    , m_isStreaming(false)
+    , m_visible(false)
+    , m_newFrameAvailable(false)
+#if DRAW_FRAME_RATE
+    , m_frameCountWhilePlaying(0)
+    , m_timeStartedPlaying(0)
+    , m_timeStoppedPlaying(0)
+#endif
+{
+}
+
+MediaPlayerPrivate::~MediaPlayerPrivate()
+{
+    tearDownVideoRendering();
+}
+
+bool MediaPlayerPrivate::supportsFullscreen() const
+{
+    return true;
+}
+
+PlatformMedia MediaPlayerPrivate::platformMedia() const
+{
+    PlatformMedia p;
+    p.qtMovie = reinterpret_cast<QTMovie*>(m_qtMovie.get());
+    return p;
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+PlatformLayer* MediaPlayerPrivate::platformLayer() const
+{
+    return m_qtVideoLayer ? m_qtVideoLayer->platformLayer() : 0;
+}
+#endif
+
+class TaskTimer : TimerBase {
+public:
+    static void initialize();
+    
+private:
+    static void setTaskTimerDelay(double);
+    static void stopTaskTimer();
+
+    void fired();
+
+    static TaskTimer* s_timer;
+};
+
+TaskTimer* TaskTimer::s_timer = 0;
+
+void TaskTimer::initialize()
+{
+    if (s_timer)
+        return;
+
+    s_timer = new TaskTimer;
+
+    QTMovieWin::setTaskTimerFuncs(setTaskTimerDelay, stopTaskTimer);
+}
+
+void TaskTimer::setTaskTimerDelay(double delayInSeconds)
+{
+    ASSERT(s_timer);
+
+    s_timer->startOneShot(delayInSeconds);
+}
+
+void TaskTimer::stopTaskTimer()
+{
+    ASSERT(s_timer);
+
+    s_timer->stop();
+}
+
+void TaskTimer::fired()
+{
+    QTMovieWin::taskTimerFired();
+}
+
+String MediaPlayerPrivate::rfc2616DateStringFromTime(CFAbsoluteTime time)
+{
+    static const char* const dayStrings[] = { "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun" };
+    static const char* const monthStrings[] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };
+    static const CFStringRef dateFormatString = CFSTR("%s, %02d %s %04d %02d:%02d:%02d GMT");
+    static CFTimeZoneRef gmtTimeZone;
+    if (!gmtTimeZone)
+        gmtTimeZone = CFTimeZoneCopyDefault();
+
+    CFGregorianDate dateValue = CFAbsoluteTimeGetGregorianDate(time, gmtTimeZone); 
+    if (!CFGregorianDateIsValid(dateValue, kCFGregorianAllUnits))
+        return String();
+
+    time = CFGregorianDateGetAbsoluteTime(dateValue, gmtTimeZone);
+    SInt32 day = CFAbsoluteTimeGetDayOfWeek(time, 0);
+
+    RetainPtr<CFStringRef> dateCFString(AdoptCF, CFStringCreateWithFormat(0, 0, dateFormatString, dayStrings[day - 1], dateValue.day, 
+        monthStrings[dateValue.month - 1], dateValue.year, dateValue.hour, dateValue.minute, (int)dateValue.second));
+    return dateCFString.get();
+}
+
+static void addCookieParam(StringBuilder& cookieBuilder, const String& name, const String& value)
+{
+    if (name.isEmpty())
+        return;
+
+    // If this isn't the first parameter added, terminate the previous one.
+    if (cookieBuilder.length())
+        cookieBuilder.append("; ");
+
+    // Add parameter name, and value if there is one.
+    cookieBuilder.append(name);
+    if (!value.isEmpty()) {
+        cookieBuilder.append("=");
+        cookieBuilder.append(value);
+    }
+}
+
+
+void MediaPlayerPrivate::setUpCookiesForQuickTime(const String& url)
+{
+    // WebCore loaded the page with the movie URL with CFNetwork but QuickTime will 
+    // use WinINet to download the movie, so we need to copy any cookies needed to
+    // download the movie into WinInet before asking QuickTime to open it.
+    Frame* frame = m_player->frameView() ? m_player->frameView()->frame() : 0;
+    if (!frame || !frame->page() || !frame->page()->cookieEnabled())
+        return;
+
+    KURL movieURL = KURL(KURL(), url);
+    Vector<Cookie> documentCookies;
+    if (!getRawCookies(frame->document(), movieURL, documentCookies))
+        return;
+
+    for (size_t ndx = 0; ndx < documentCookies.size(); ndx++) {
+        const Cookie& cookie = documentCookies[ndx];
+
+        if (cookie.name.isEmpty())
+            continue;
+
+        // Build up the cookie string with as much information as we can get so WinINet
+        // knows what to do with it.
+        StringBuilder cookieBuilder;
+        addCookieParam(cookieBuilder, cookie.name, cookie.value);
+        addCookieParam(cookieBuilder, "path", cookie.path);
+        if (cookie.expires) 
+            addCookieParam(cookieBuilder, "expires", rfc2616DateStringFromTime(cookie.expires));
+        if (cookie.httpOnly) 
+            addCookieParam(cookieBuilder, "httpOnly", String());
+        cookieBuilder.append(";");
+
+        String cookieURL;
+        if (!cookie.domain.isEmpty()) {
+            StringBuilder urlBuilder;
+
+            urlBuilder.append(movieURL.protocol());
+            urlBuilder.append("://");
+            if (cookie.domain[0] == '.')
+                urlBuilder.append(cookie.domain.substring(1));
+            else
+                urlBuilder.append(cookie.domain);
+            if (cookie.path.length() > 1)
+                urlBuilder.append(cookie.path);
+
+            cookieURL = urlBuilder.toString();
+        } else
+            cookieURL = movieURL;
+
+        InternetSetCookieExW(cookieURL.charactersWithNullTermination(), 0, cookieBuilder.toString().charactersWithNullTermination(), 0, 0);
+    }
+}
+
+void MediaPlayerPrivate::load(const String& url)
+{
+    if (!QTMovieWin::initializeQuickTime()) {
+        // FIXME: is this the right error to return?
+        m_networkState = MediaPlayer::DecodeError; 
+        m_player->networkStateChanged();
+        return;
+    }
+
+    // Initialize the task timer.
+    TaskTimer::initialize();
+
+    if (m_networkState != MediaPlayer::Loading) {
+        m_networkState = MediaPlayer::Loading;
+        m_player->networkStateChanged();
+    }
+    if (m_readyState != MediaPlayer::HaveNothing) {
+        m_readyState = MediaPlayer::HaveNothing;
+        m_player->readyStateChanged();
+    }
+    cancelSeek();
+
+    setUpCookiesForQuickTime(url);
+
+    m_qtMovie.set(new QTMovieWin(this));
+    m_qtMovie->load(url.characters(), url.length(), m_player->preservesPitch());
+    m_qtMovie->setVolume(m_player->volume());
+    m_qtMovie->setVisible(m_player->visible());
+}
+
+void MediaPlayerPrivate::play()
+{
+    if (!m_qtMovie)
+        return;
+    m_startedPlaying = true;
+#if DRAW_FRAME_RATE
+    m_frameCountWhilePlaying = 0;
+#endif
+
+    m_qtMovie->play();
+}
+
+void MediaPlayerPrivate::pause()
+{
+    if (!m_qtMovie)
+        return;
+    m_startedPlaying = false;
+#if DRAW_FRAME_RATE
+    m_timeStoppedPlaying = WTF::currentTime();
+#endif
+    m_qtMovie->pause();
+}
+
+float MediaPlayerPrivate::duration() const
+{
+    if (!m_qtMovie)
+        return 0;
+    return m_qtMovie->duration();
+}
+
+float MediaPlayerPrivate::currentTime() const
+{
+    if (!m_qtMovie)
+        return 0;
+    return m_qtMovie->currentTime();
+}
+
+void MediaPlayerPrivate::seek(float time)
+{
+    cancelSeek();
+    
+    if (!m_qtMovie)
+        return;
+    
+    if (time > duration())
+        time = duration();
+    
+    m_seekTo = time;
+    if (maxTimeLoaded() >= m_seekTo)
+        doSeek();
+    else 
+        m_seekTimer.start(0, 0.5f);
+}
+    
+void MediaPlayerPrivate::doSeek() 
+{
+    float oldRate = m_qtMovie->rate();
+    if (oldRate)
+        m_qtMovie->setRate(0);
+    m_qtMovie->setCurrentTime(m_seekTo);
+    float timeAfterSeek = currentTime();
+    // restore playback only if not at end, othewise QTMovie will loop
+    if (oldRate && timeAfterSeek < duration())
+        m_qtMovie->setRate(oldRate);
+    cancelSeek();
+}
+
+void MediaPlayerPrivate::cancelSeek()
+{
+    m_seekTo = -1;
+    m_seekTimer.stop();
+}
+
+void MediaPlayerPrivate::seekTimerFired(Timer<MediaPlayerPrivate>*)
+{        
+    if (!m_qtMovie || !seeking() || currentTime() == m_seekTo) {
+        cancelSeek();
+        updateStates();
+        m_player->timeChanged(); 
+        return;
+    } 
+    
+    if (maxTimeLoaded() >= m_seekTo)
+        doSeek();
+    else {
+        MediaPlayer::NetworkState state = networkState();
+        if (state == MediaPlayer::Empty || state == MediaPlayer::Loaded) {
+            cancelSeek();
+            updateStates();
+            m_player->timeChanged();
+        }
+    }
+}
+
+bool MediaPlayerPrivate::paused() const
+{
+    if (!m_qtMovie)
+        return true;
+    return m_qtMovie->rate() == 0.0f;
+}
+
+bool MediaPlayerPrivate::seeking() const
+{
+    if (!m_qtMovie)
+        return false;
+    return m_seekTo >= 0;
+}
+
+IntSize MediaPlayerPrivate::naturalSize() const
+{
+    if (!m_qtMovie)
+        return IntSize();
+    int width;
+    int height;
+    m_qtMovie->getNaturalSize(width, height);
+    return IntSize(width, height);
+}
+
+bool MediaPlayerPrivate::hasVideo() const
+{
+    if (!m_qtMovie)
+        return false;
+    return m_qtMovie->hasVideo();
+}
+
+bool MediaPlayerPrivate::hasAudio() const
+{
+    if (!m_qtMovie)
+        return false;
+    return m_qtMovie->hasAudio();
+}
+
+void MediaPlayerPrivate::setVolume(float volume)
+{
+    if (!m_qtMovie)
+        return;
+    m_qtMovie->setVolume(volume);
+}
+
+void MediaPlayerPrivate::setRate(float rate)
+{
+    if (!m_qtMovie)
+        return;
+    m_qtMovie->setRate(rate);
+}
+
+void MediaPlayerPrivate::setPreservesPitch(bool preservesPitch)
+{
+    if (!m_qtMovie)
+        return;
+    m_qtMovie->setPreservesPitch(preservesPitch);
+}
+
+bool MediaPlayerPrivate::hasClosedCaptions() const
+{
+    if (!m_qtMovie)
+        return false;
+    return m_qtMovie->hasClosedCaptions();
+}
+
+void MediaPlayerPrivate::setClosedCaptionsVisible(bool visible)
+{
+    if (!m_qtMovie)
+        return;
+    m_qtMovie->setClosedCaptionsVisible(visible);
+}
+
+PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
+{
+    RefPtr<TimeRanges> timeRanges = TimeRanges::create();
+    float loaded = maxTimeLoaded();
+    // rtsp streams are not buffered
+    if (!m_isStreaming && loaded > 0)
+        timeRanges->add(0, loaded);
+    return timeRanges.release();
+}
+
+float MediaPlayerPrivate::maxTimeSeekable() const
+{
+    // infinite duration means live stream
+    return !isfinite(duration()) ? 0 : maxTimeLoaded();
+}
+
+float MediaPlayerPrivate::maxTimeLoaded() const
+{
+    if (!m_qtMovie)
+        return 0;
+    return m_qtMovie->maxTimeLoaded(); 
+}
+
+unsigned MediaPlayerPrivate::bytesLoaded() const
+{
+    if (!m_qtMovie)
+        return 0;
+    float dur = duration();
+    float maxTime = maxTimeLoaded();
+    if (!dur)
+        return 0;
+    return totalBytes() * maxTime / dur;
+}
+
+unsigned MediaPlayerPrivate::totalBytes() const
+{
+    if (!m_qtMovie)
+        return 0;
+    return m_qtMovie->dataSize();
+}
+
+void MediaPlayerPrivate::cancelLoad()
+{
+    if (m_networkState < MediaPlayer::Loading || m_networkState == MediaPlayer::Loaded)
+        return;
+    
+    tearDownVideoRendering();
+
+    // Cancel the load by destroying the movie.
+    m_qtMovie.clear();
+
+    updateStates();
+}
+
+void MediaPlayerPrivate::updateStates()
+{
+    MediaPlayer::NetworkState oldNetworkState = m_networkState;
+    MediaPlayer::ReadyState oldReadyState = m_readyState;
+  
+    long loadState = m_qtMovie ? m_qtMovie->loadState() : QTMovieLoadStateError;
+
+    if (loadState >= QTMovieLoadStateLoaded && m_readyState < MediaPlayer::HaveMetadata) {
+        m_qtMovie->disableUnsupportedTracks(m_enabledTrackCount, m_totalTrackCount);
+        if (m_player->inMediaDocument()) {
+            if (!m_enabledTrackCount || m_enabledTrackCount != m_totalTrackCount) {
+                // This is a type of media that we do not handle directly with a <video> 
+                // element, eg. QuickTime VR, a movie with a sprite track, etc. Tell the 
+                // MediaPlayerClient that we won't support it.
+                sawUnsupportedTracks();
+                return;
+            }
+        } else if (!m_enabledTrackCount)
+            loadState = QTMovieLoadStateError;
+    }
+
+    // "Loaded" is reserved for fully buffered movies, never the case when streaming
+    if (loadState >= QTMovieLoadStateComplete && !m_isStreaming) {
+        m_networkState = MediaPlayer::Loaded;
+        m_readyState = MediaPlayer::HaveEnoughData;
+    } else if (loadState >= QTMovieLoadStatePlaythroughOK) {
+        m_readyState = MediaPlayer::HaveEnoughData;
+    } else if (loadState >= QTMovieLoadStatePlayable) {
+        // FIXME: This might not work correctly in streaming case, <rdar://problem/5693967>
+        m_readyState = currentTime() < maxTimeLoaded() ? MediaPlayer::HaveFutureData : MediaPlayer::HaveCurrentData;
+    } else if (loadState >= QTMovieLoadStateLoaded) {
+        m_readyState = MediaPlayer::HaveMetadata;
+    } else if (loadState > QTMovieLoadStateError) {
+        m_networkState = MediaPlayer::Loading;
+        m_readyState = MediaPlayer::HaveNothing;        
+    } else {
+        if (m_player->inMediaDocument()) {
+            // Something went wrong in the loading of media within a standalone file. 
+            // This can occur with chained ref movies that eventually resolve to a
+            // file we don't support.
+            sawUnsupportedTracks();
+            return;
+        }
+
+        float loaded = maxTimeLoaded();
+        if (!loaded)
+            m_readyState = MediaPlayer::HaveNothing;
+
+        if (!m_enabledTrackCount)
+            m_networkState = MediaPlayer::FormatError;
+        else {
+            // FIXME: We should differentiate between load/network errors and decode errors <rdar://problem/5605692>
+            if (loaded > 0)
+                m_networkState = MediaPlayer::DecodeError;
+            else
+                m_readyState = MediaPlayer::HaveNothing;
+        }
+    }
+
+    if (isReadyForRendering() && !hasSetUpVideoRendering())
+        setUpVideoRendering();
+
+    if (seeking())
+        m_readyState = MediaPlayer::HaveNothing;
+    
+    if (m_networkState != oldNetworkState)
+        m_player->networkStateChanged();
+    if (m_readyState != oldReadyState)
+        m_player->readyStateChanged();
+}
+
+bool MediaPlayerPrivate::isReadyForRendering() const
+{
+    return m_readyState >= MediaPlayer::HaveMetadata && m_player->visible();
+}
+
+void MediaPlayerPrivate::sawUnsupportedTracks()
+{
+    m_qtMovie->setDisabled(true);
+    m_hasUnsupportedTracks = true;
+    m_player->mediaPlayerClient()->mediaPlayerSawUnsupportedTracks(m_player);
+}
+
+void MediaPlayerPrivate::didEnd()
+{
+    if (m_hasUnsupportedTracks)
+        return;
+
+    m_startedPlaying = false;
+#if DRAW_FRAME_RATE
+    m_timeStoppedPlaying = WTF::currentTime();
+#endif
+    updateStates();
+    m_player->timeChanged();
+}
+
+void MediaPlayerPrivate::setSize(const IntSize& size) 
+{ 
+    if (m_hasUnsupportedTracks || !m_qtMovie || m_size == size)
+        return;
+    m_size = size;
+    m_qtMovie->setSize(size.width(), size.height());
+}
+
+void MediaPlayerPrivate::setVisible(bool visible)
+{
+    if (m_hasUnsupportedTracks || !m_qtMovie || m_visible == visible)
+        return;
+
+    m_qtMovie->setVisible(visible);
+    m_visible = visible;
+    if (m_visible) {
+        if (isReadyForRendering())
+            setUpVideoRendering();
+    } else
+        tearDownVideoRendering();
+}
+
+void MediaPlayerPrivate::paint(GraphicsContext* p, const IntRect& r)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_qtVideoLayer)
+        return;
+#endif
+    if (p->paintingDisabled() || !m_qtMovie || m_hasUnsupportedTracks)
+        return;
+
+    bool usingTempBitmap = false;
+    OwnPtr<GraphicsContext::WindowsBitmap> bitmap;
+    HDC hdc = p->getWindowsContext(r);
+    if (!hdc) {
+        // The graphics context doesn't have an associated HDC so create a temporary
+        // bitmap where QTMovieWin can draw the frame and we can copy it.
+        usingTempBitmap = true;
+        bitmap.set(p->createWindowsBitmap(r.size()));
+        hdc = bitmap->hdc();
+
+        // FIXME: is this necessary??
+        XFORM xform;
+        xform.eM11 = 1.0f;
+        xform.eM12 = 0.0f;
+        xform.eM21 = 0.0f;
+        xform.eM22 = 1.0f;
+        xform.eDx = -r.x();
+        xform.eDy = -r.y();
+        SetWorldTransform(hdc, &xform);
+    }
+
+    m_qtMovie->paint(hdc, r.x(), r.y());
+    if (usingTempBitmap)
+        p->drawWindowsBitmap(bitmap.get(), r.topLeft());
+    else
+        p->releaseWindowsContext(hdc, r);
+
+    paintCompleted(*p, r);
+}
+
+void MediaPlayerPrivate::paintCompleted(GraphicsContext& context, const IntRect& rect)
+{
+    m_newFrameAvailable = false;
+
+#if DRAW_FRAME_RATE
+    if (m_frameCountWhilePlaying > 10) {
+        double interval =  m_startedPlaying ? WTF::currentTime() - m_timeStartedPlaying : m_timeStoppedPlaying - m_timeStartedPlaying;
+        double frameRate = (m_frameCountWhilePlaying - 1) / interval;
+        CGContextRef cgContext = context.platformContext();
+        CGRect drawRect = rect;
+
+        char text[8];
+        _snprintf(text, sizeof(text), "%1.2f", frameRate);
+
+        static const int fontSize = 25;
+        static const int fontCharWidth = 12;
+        static const int boxHeight = 25;
+        static const int boxBorderWidth = 4;
+        drawRect.size.width = boxBorderWidth * 2 + fontCharWidth * strlen(text);
+        drawRect.size.height = boxHeight;
+
+        CGContextSaveGState(cgContext);
+#if USE(ACCELERATED_COMPOSITING)
+        if (m_qtVideoLayer)
+            CGContextScaleCTM(cgContext, 1, -1);
+        CGContextTranslateCTM(cgContext, rect.width() - drawRect.size.width, m_qtVideoLayer ? -rect.height() : 0);
+#else
+        CGContextTranslateCTM(cgContext, rect.width() - drawRect.size.width, 0);
+#endif
+        static const CGFloat backgroundColor[4] = { 0.98, 0.98, 0.82, 0.8 };
+        CGContextSetFillColor(cgContext, backgroundColor);
+        CGContextFillRect(cgContext, drawRect);
+
+        static const CGFloat textColor[4] = { 0, 0, 0, 1 };
+        CGContextSetFillColor(cgContext, textColor);
+        CGContextSetTextMatrix(cgContext, CGAffineTransformMakeScale(1, -1));
+        CGContextSelectFont(cgContext, "Helvetica", fontSize, kCGEncodingMacRoman);
+
+        CGContextShowTextAtPoint(cgContext, drawRect.origin.x + boxBorderWidth, drawRect.origin.y + boxHeight - boxBorderWidth, text, strlen(text));
+        
+        CGContextRestoreGState(cgContext);        
+    }
+#endif
+}
+
+static HashSet<String> mimeTypeCache()
+{
+    DEFINE_STATIC_LOCAL(HashSet<String>, typeCache, ());
+    static bool typeListInitialized = false;
+
+    if (!typeListInitialized) {
+        unsigned count = QTMovieWin::countSupportedTypes();
+        for (unsigned n = 0; n < count; n++) {
+            const UChar* character;
+            unsigned len;
+            QTMovieWin::getSupportedType(n, character, len);
+            if (len)
+                typeCache.add(String(character, len));
+        }
+
+        typeListInitialized = true;
+    }
+    
+    return typeCache;
+} 
+
+void MediaPlayerPrivate::getSupportedTypes(HashSet<String>& types)
+{
+    types = mimeTypeCache();
+} 
+
+bool MediaPlayerPrivate::isAvailable()
+{
+    return QTMovieWin::initializeQuickTime();
+}
+
+MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String& type, const String& codecs)
+{
+    // only return "IsSupported" if there is no codecs parameter for now as there is no way to ask QT if it supports an
+    //  extended MIME type
+    return mimeTypeCache().contains(type) ? (codecs.isEmpty() ? MediaPlayer::MayBeSupported : MediaPlayer::IsSupported) : MediaPlayer::IsNotSupported;
+}
+
+void MediaPlayerPrivate::movieEnded(QTMovieWin* movie)
+{
+    if (m_hasUnsupportedTracks)
+        return;
+
+    ASSERT(m_qtMovie.get() == movie);
+    didEnd();
+}
+
+void MediaPlayerPrivate::movieLoadStateChanged(QTMovieWin* movie)
+{
+    if (m_hasUnsupportedTracks)
+        return;
+
+    ASSERT(m_qtMovie.get() == movie);
+    updateStates();
+}
+
+void MediaPlayerPrivate::movieTimeChanged(QTMovieWin* movie)
+{
+    if (m_hasUnsupportedTracks)
+        return;
+
+    ASSERT(m_qtMovie.get() == movie);
+    updateStates();
+    m_player->timeChanged();
+}
+
+void MediaPlayerPrivate::movieNewImageAvailable(QTMovieWin* movie)
+{
+    if (m_hasUnsupportedTracks)
+        return;
+
+    ASSERT(m_qtMovie.get() == movie);
+#if DRAW_FRAME_RATE
+    if (m_startedPlaying) {
+        m_frameCountWhilePlaying++;
+        // To eliminate preroll costs from our calculation, our frame rate calculation excludes
+        // the first frame drawn after playback starts.
+        if (m_frameCountWhilePlaying == 1)
+            m_timeStartedPlaying = WTF::currentTime();
+    }
+#endif
+
+    m_newFrameAvailable = true;
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_qtVideoLayer)
+        m_qtVideoLayer->platformLayer()->setNeedsDisplay();
+    else
+#endif
+        m_player->repaint();
+}
+
+bool MediaPlayerPrivate::hasSingleSecurityOrigin() const
+{
+    // We tell quicktime to disallow resources that come from different origins
+    // so we all media is single origin.
+    return true;
+}
+
+MediaPlayerPrivate::MediaRenderingMode MediaPlayerPrivate::currentRenderingMode() const
+{
+    if (!m_qtMovie)
+        return MediaRenderingNone;
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_qtVideoLayer)
+        return MediaRenderingMovieLayer;
+#endif
+
+    return MediaRenderingSoftwareRenderer;
+}
+
+MediaPlayerPrivate::MediaRenderingMode MediaPlayerPrivate::preferredRenderingMode() const
+{
+    if (!m_player->frameView() || !m_qtMovie)
+        return MediaRenderingNone;
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (supportsAcceleratedRendering() && m_player->mediaPlayerClient()->mediaPlayerRenderingCanBeAccelerated(m_player))
+        return MediaRenderingMovieLayer;
+#endif
+
+    return MediaRenderingSoftwareRenderer;
+}
+
+void MediaPlayerPrivate::setUpVideoRendering()
+{
+    MediaRenderingMode currentMode = currentRenderingMode();
+    MediaRenderingMode preferredMode = preferredRenderingMode();
+
+#if !USE(ACCELERATED_COMPOSITING)
+    ASSERT(preferredMode != MediaRenderingMovieLayer);
+#endif
+
+    if (currentMode == preferredMode && currentMode != MediaRenderingNone)
+        return;
+
+    if (currentMode != MediaRenderingNone)  
+        tearDownVideoRendering();
+
+    if (preferredMode == MediaRenderingMovieLayer)
+        createLayerForMovie();
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (currentMode == MediaRenderingMovieLayer || preferredMode == MediaRenderingMovieLayer)
+        m_player->mediaPlayerClient()->mediaPlayerRenderingModeChanged(m_player);
+#endif
+}
+
+void MediaPlayerPrivate::tearDownVideoRendering()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_qtVideoLayer)
+        destroyLayerForMovie();
+#endif
+}
+
+bool MediaPlayerPrivate::hasSetUpVideoRendering() const
+{
+#if USE(ACCELERATED_COMPOSITING)
+    return m_qtVideoLayer || currentRenderingMode() != MediaRenderingMovieLayer;
+#else
+    return true;
+#endif
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+
+// Up-call from compositing layer drawing callback.
+void MediaPlayerPrivate::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase, const IntRect&)
+{
+     if (m_hasUnsupportedTracks)
+         return;
+
+    ASSERT(supportsAcceleratedRendering());
+
+    // No reason to replace the current layer image unless we have something new to show.
+    if (!m_newFrameAvailable)
+        return;
+
+    static CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
+    void* buffer;
+    unsigned bitsPerPixel;
+    unsigned rowBytes;
+    unsigned width;
+    unsigned height;
+
+    m_qtMovie->getCurrentFrameInfo(buffer, bitsPerPixel, rowBytes, width, height);
+    if (!buffer)
+        return ;
+
+    RetainPtr<CFDataRef> data(AdoptCF, CFDataCreateWithBytesNoCopy(0, static_cast<UInt8*>(buffer), rowBytes * height, kCFAllocatorNull));
+    RetainPtr<CGDataProviderRef> provider(AdoptCF, CGDataProviderCreateWithCFData(data.get()));
+    RetainPtr<CGImageRef> frameImage(AdoptCF, CGImageCreate(width, height, 8, bitsPerPixel, rowBytes, colorSpace, 
+        kCGBitmapByteOrder32Little | kCGImageAlphaFirst, provider.get(), 0, false, kCGRenderingIntentDefault));
+    if (!frameImage)
+        return;
+
+    IntRect rect(0, 0, m_size.width(), m_size.height());
+    CGContextDrawImage(context.platformContext(), rect, frameImage.get()); 
+    paintCompleted(context, rect);
+}
+#endif
+
+void MediaPlayerPrivate::createLayerForMovie()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    ASSERT(supportsAcceleratedRendering());
+
+    if (!m_qtMovie || m_qtVideoLayer)
+        return;
+
+    // Create a GraphicsLayer that won't be inserted directly into the render tree, but will used 
+    // as a wrapper for a WKCACFLayer which gets inserted as the content layer of the video 
+    // renderer's GraphicsLayer.
+    m_qtVideoLayer.set(new GraphicsLayerCACF(this));
+    if (!m_qtVideoLayer)
+        return;
+
+    // Mark the layer as drawing itself, anchored in the top left, and bottom-up.
+    m_qtVideoLayer->setDrawsContent(true);
+    m_qtVideoLayer->setAnchorPoint(FloatPoint3D());
+    m_qtVideoLayer->setContentsOrientation(GraphicsLayer::CompositingCoordinatesBottomUp);
+#ifndef NDEBUG
+    m_qtVideoLayer->setName("Video layer");
+#endif
+    // The layer will get hooked up via RenderLayerBacking::updateGraphicsLayerConfiguration().
+#endif
+}
+
+void MediaPlayerPrivate::destroyLayerForMovie()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (!m_qtVideoLayer)
+        return;
+    m_qtVideoLayer = 0;
+#endif
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+bool MediaPlayerPrivate::supportsAcceleratedRendering() const
+{
+    return isReadyForRendering();
+}
+
+void MediaPlayerPrivate::acceleratedRenderingStateChanged()
+{
+    // Set up or change the rendering path if necessary.
+    setUpVideoRendering();
+}
+
+#endif
+
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h b/src/3rdparty/webkit/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
new file mode 100644
index 0000000000..9de5894eaa
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
@@ -0,0 +1,191 @@
+/*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MediaPlayerPrivateQTKit_h
+#define MediaPlayerPrivateQTKit_h
+
+#if ENABLE(VIDEO)
+
+#include "MediaPlayerPrivate.h"
+#include "Timer.h"
+#include <QTMovieWin.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/RetainPtr.h>
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "GraphicsLayerClient.h"
+#endif 
+
+#ifndef DRAW_FRAME_RATE
+#define DRAW_FRAME_RATE 0
+#endif
+
+typedef struct CGImage *CGImageRef;
+
+namespace WebCore {
+
+class GraphicsContext;
+class IntSize;
+class IntRect;
+class String;
+
+class MediaPlayerPrivate : public MediaPlayerPrivateInterface, public QTMovieWinClient 
+#if USE(ACCELERATED_COMPOSITING)
+        , public GraphicsLayerClient
+#endif 
+{
+public:
+    static void registerMediaEngine(MediaEngineRegistrar);
+
+    ~MediaPlayerPrivate();
+
+private:
+
+#if USE(ACCELERATED_COMPOSITING)
+    // GraphicsLayerClient methods
+    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& inClip);
+    virtual void notifyAnimationStarted(const GraphicsLayer*, double time) { }
+    virtual void notifySyncRequired(const GraphicsLayer*) { }
+    virtual bool showDebugBorders() const { return false; }
+    virtual bool showRepaintCounter() const { return false; }
+#endif 
+
+    MediaPlayerPrivate(MediaPlayer*);
+
+    virtual bool supportsFullscreen() const;
+    virtual PlatformMedia platformMedia() const;
+#if USE(ACCELERATED_COMPOSITING)
+    PlatformLayer* platformLayer() const;
+#endif
+
+    IntSize naturalSize() const;
+    bool hasVideo() const;
+    bool hasAudio() const;
+
+    void load(const String& url);
+    void cancelLoad();
+    
+    void play();
+    void pause();    
+    
+    bool paused() const;
+    bool seeking() const;
+    
+    float duration() const;
+    float currentTime() const;
+    void seek(float time);
+    
+    void setRate(float);
+    void setVolume(float);
+    void setPreservesPitch(bool);
+    
+    MediaPlayer::NetworkState networkState() const { return m_networkState; }
+    MediaPlayer::ReadyState readyState() const { return m_readyState; }
+    
+    PassRefPtr<TimeRanges> buffered() const;
+    float maxTimeSeekable() const;
+    unsigned bytesLoaded() const;
+    unsigned totalBytes() const;
+    
+    void setVisible(bool);
+    void setSize(const IntSize&);
+    
+    void loadStateChanged();
+    void didEnd();
+    
+    void paint(GraphicsContext*, const IntRect&);
+    void paintCompleted(GraphicsContext&, const IntRect&);
+
+    bool hasSingleSecurityOrigin() const;
+
+    bool hasClosedCaptions() const;
+    void setClosedCaptionsVisible(bool);
+
+    void updateStates();
+    void doSeek();
+    void cancelSeek();
+    void seekTimerFired(Timer<MediaPlayerPrivate>*);
+    float maxTimeLoaded() const;
+    void sawUnsupportedTracks();
+
+    virtual void movieEnded(QTMovieWin*);
+    virtual void movieLoadStateChanged(QTMovieWin*);
+    virtual void movieTimeChanged(QTMovieWin*);
+    virtual void movieNewImageAvailable(QTMovieWin*);
+
+    // engine support
+    static MediaPlayerPrivateInterface* create(MediaPlayer*);
+    static void getSupportedTypes(HashSet<String>& types);
+    static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
+    static bool isAvailable();
+
+#if USE(ACCELERATED_COMPOSITING)
+    virtual bool supportsAcceleratedRendering() const;
+    virtual void acceleratedRenderingStateChanged();
+#endif
+
+    enum MediaRenderingMode { MediaRenderingNone, MediaRenderingSoftwareRenderer, MediaRenderingMovieLayer };
+    MediaRenderingMode currentRenderingMode() const;
+    MediaRenderingMode preferredRenderingMode() const;
+    bool isReadyForRendering() const;
+
+    void setUpVideoRendering();
+    void tearDownVideoRendering();
+    bool hasSetUpVideoRendering() const;
+
+    void createLayerForMovie();
+    void destroyLayerForMovie();
+
+    void setUpCookiesForQuickTime(const String& url);
+    String rfc2616DateStringFromTime(CFAbsoluteTime);
+
+    MediaPlayer* m_player;
+    OwnPtr<QTMovieWin> m_qtMovie;
+#if USE(ACCELERATED_COMPOSITING)
+    OwnPtr<GraphicsLayer> m_qtVideoLayer;
+#endif
+    float m_seekTo;
+    Timer<MediaPlayerPrivate> m_seekTimer;
+    IntSize m_size;
+    MediaPlayer::NetworkState m_networkState;
+    MediaPlayer::ReadyState m_readyState;
+    unsigned m_enabledTrackCount;
+    unsigned m_totalTrackCount;
+    bool m_hasUnsupportedTracks;
+    bool m_startedPlaying;
+    bool m_isStreaming;
+    bool m_visible;
+    bool m_newFrameAvailable;
+#if DRAW_FRAME_RATE
+    double m_frameCountWhilePlaying;
+    double m_timeStartedPlaying;
+    double m_timeStoppedPlaying;
+#endif
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/QTMovieWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/QTMovieWin.cpp
new file mode 100644
index 0000000000..48310625c2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/QTMovieWin.cpp
@@ -0,0 +1,1178 @@
+/*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+#include "config.h"
+
+#include "QTMovieWin.h"
+
+// Put Movies.h first so build failures here point clearly to QuickTime
+#include <Movies.h>
+
+#include "QTMovieWinTimer.h"
+#include <GXMath.h>
+#include <QTML.h>
+#include <QuickTimeComponents.h>
+#include <wtf/Assertions.h>
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/Vector.h>
+
+using namespace std;
+
+static const long minimumQuickTimeVersion = 0x07300000; // 7.3
+
+static const long closedCaptionTrackType = 'clcp';
+static const long subTitleTrackType = 'sbtl';
+static const long mpeg4ObjectDescriptionTrackType = 'odsm';
+static const long mpeg4SceneDescriptionTrackType = 'sdsm';
+static const long closedCaptionDisplayPropertyID = 'disp';
+static LPCTSTR fullscreenQTMovieWinPointerProp = TEXT("fullscreenQTMovieWinPointer");
+
+// Resizing GWorlds is slow, give them a minimum size so size of small 
+// videos can be animated smoothly
+static const int cGWorldMinWidth = 640;
+static const int cGWorldMinHeight = 360;
+
+static const float cNonContinuousTimeChange = 0.2f;
+
+union UppParam {
+    long longValue;
+    void* ptr;
+};
+
+static MovieDrawingCompleteUPP gMovieDrawingCompleteUPP = 0;
+static HashSet<QTMovieWinPrivate*>* gTaskList;
+static Vector<CFStringRef>* gSupportedTypes = 0;
+static SInt32 quickTimeVersion = 0;
+
+static QTMovieWin::SetTaskTimerDelayFunc gSetTaskTimerDelay = 0;
+static QTMovieWin::StopTaskTimerFunc gStopTaskTimer = 0;
+
+static void updateTaskTimer(int maxInterval = 1000)
+{
+    if (!gTaskList->size()) {
+        gStopTaskTimer();
+        return;    
+    }
+    
+    long intervalInMS;
+    QTGetTimeUntilNextTask(&intervalInMS, 1000);
+    if (intervalInMS > maxInterval)
+        intervalInMS = maxInterval;
+    gSetTaskTimerDelay(static_cast<float>(intervalInMS) / 1000);
+}
+
+class QTMovieWinPrivate : public Noncopyable {
+public:
+    QTMovieWinPrivate();
+    ~QTMovieWinPrivate();
+    void task();
+    void startTask();
+    void endTask();
+
+    void createMovieController();
+    void registerDrawingCallback();
+    void drawingComplete();
+    void updateGWorld();
+    void createGWorld();
+    void deleteGWorld();
+    void clearGWorld();
+    void cacheMovieScale();
+    void updateMovieSize();
+
+    void setSize(int, int);
+
+    QTMovieWin* m_movieWin;
+    Movie m_movie;
+    MovieController m_movieController;
+    bool m_tasking;
+    QTMovieWinClient* m_client;
+    long m_loadState;
+    bool m_ended;
+    bool m_seeking;
+    float m_lastMediaTime;
+    double m_lastLoadStateCheckTime;
+    int m_width;
+    int m_height;
+    bool m_visible;
+    GWorldPtr m_gWorld;
+    int m_gWorldWidth;
+    int m_gWorldHeight;
+    GWorldPtr m_savedGWorld;
+    long m_loadError;
+    float m_widthScaleFactor;
+    float m_heightScaleFactor;
+    CFURLRef m_currentURL;
+    float m_timeToRestore;
+    float m_rateToRestore;
+#if !ASSERT_DISABLED
+    bool m_scaleCached;
+#endif
+    WindowPtr m_fullscreenWindow;
+    GWorldPtr m_fullscreenOrigGWorld;
+    Rect m_fullscreenRect;
+    QTMovieWinFullscreenClient* m_fullscreenClient;
+    char* m_fullscreenRestoreState;
+};
+
+QTMovieWinPrivate::QTMovieWinPrivate()
+    : m_movieWin(0)
+    , m_movie(0)
+    , m_movieController(0)
+    , m_tasking(false)
+    , m_client(0)
+    , m_loadState(0)
+    , m_ended(false)
+    , m_seeking(false)
+    , m_lastMediaTime(0)
+    , m_lastLoadStateCheckTime(0)
+    , m_width(0)
+    , m_height(0)
+    , m_visible(false)
+    , m_gWorld(0)
+    , m_gWorldWidth(0)
+    , m_gWorldHeight(0)
+    , m_savedGWorld(0)
+    , m_loadError(0)
+    , m_widthScaleFactor(1)
+    , m_heightScaleFactor(1)
+    , m_currentURL(0)
+    , m_timeToRestore(-1.0f)
+    , m_rateToRestore(-1.0f)
+#if !ASSERT_DISABLED
+    , m_scaleCached(false)
+#endif
+    , m_fullscreenWindow(0)
+    , m_fullscreenOrigGWorld(0)
+    , m_fullscreenClient(0)
+    , m_fullscreenRestoreState(0)
+{
+    Rect rect = { 0, 0, 0, 0 };
+    m_fullscreenRect = rect;
+}
+
+QTMovieWinPrivate::~QTMovieWinPrivate()
+{
+    ASSERT(!m_fullscreenWindow);
+
+    endTask();
+    if (m_gWorld)
+        deleteGWorld();
+    if (m_movieController)
+        DisposeMovieController(m_movieController);
+    if (m_movie)
+        DisposeMovie(m_movie);
+    if (m_currentURL)
+        CFRelease(m_currentURL);
+}
+
+void QTMovieWin::taskTimerFired()
+{
+    // The hash content might change during task()
+    Vector<QTMovieWinPrivate*> tasks;
+    copyToVector(*gTaskList, tasks);
+    size_t count = tasks.size();
+    for (unsigned n = 0; n < count; ++n)
+        tasks[n]->task();
+
+    updateTaskTimer();
+}
+
+void QTMovieWinPrivate::startTask() 
+{
+    if (m_tasking)
+        return;
+    if (!gTaskList)
+        gTaskList = new HashSet<QTMovieWinPrivate*>;
+    gTaskList->add(this);
+    m_tasking = true;
+    updateTaskTimer();
+}
+
+void QTMovieWinPrivate::endTask() 
+{
+    if (!m_tasking)
+        return;
+    gTaskList->remove(this);
+    m_tasking = false;
+    updateTaskTimer();
+}
+
+void QTMovieWinPrivate::cacheMovieScale()
+{
+    Rect naturalRect;
+    Rect initialRect;
+
+    GetMovieNaturalBoundsRect(m_movie, &naturalRect);
+    GetMovieBox(m_movie, &initialRect);
+
+    float naturalWidth = naturalRect.right - naturalRect.left;
+    float naturalHeight = naturalRect.bottom - naturalRect.top;
+
+    if (naturalWidth)
+        m_widthScaleFactor = (initialRect.right - initialRect.left) / naturalWidth;
+    if (naturalHeight)
+        m_heightScaleFactor = (initialRect.bottom - initialRect.top) / naturalHeight;
+#if !ASSERT_DISABLED
+    m_scaleCached = true;;
+#endif
+}
+
+void QTMovieWinPrivate::task() 
+{
+    ASSERT(m_tasking);
+
+    if (!m_loadError) {
+        if (m_movieController)
+            MCIdle(m_movieController);
+        else
+            MoviesTask(m_movie, 0);
+    }
+
+    // GetMovieLoadState documentation says that you should not call it more often than every quarter of a second.
+    if (systemTime() >= m_lastLoadStateCheckTime + 0.25 || m_loadError) { 
+        // If load fails QT's load state is QTMovieLoadStateComplete.
+        // This is different from QTKit API and seems strange.
+        long loadState = m_loadError ? QTMovieLoadStateError : GetMovieLoadState(m_movie);
+        if (loadState != m_loadState) {
+
+            // we only need to erase the movie gworld when the load state changes to loaded while it
+            //  is visible as the gworld is destroyed/created when visibility changes
+            bool shouldRestorePlaybackState = false;
+            bool movieNewlyPlayable = loadState >= QTMovieLoadStateLoaded && m_loadState < QTMovieLoadStateLoaded;
+            m_loadState = loadState;
+            if (movieNewlyPlayable) {
+                cacheMovieScale();
+                updateMovieSize();
+                if (m_visible)
+                    clearGWorld();
+                shouldRestorePlaybackState = true;
+            }
+
+            if (!m_movieController && m_loadState >= QTMovieLoadStateLoaded)
+                createMovieController();
+            m_client->movieLoadStateChanged(m_movieWin);
+            
+            if (shouldRestorePlaybackState && m_timeToRestore != -1.0f) {
+                m_movieWin->setCurrentTime(m_timeToRestore);
+                m_timeToRestore = -1.0f;
+                m_movieWin->setRate(m_rateToRestore);
+                m_rateToRestore = -1.0f;
+            }
+
+            if (m_movieWin->m_disabled) {
+                endTask();
+                return;
+            }
+        }
+        m_lastLoadStateCheckTime = systemTime();
+    }
+
+    bool ended = !!IsMovieDone(m_movie);
+    if (ended != m_ended) {
+        m_ended = ended;
+        if (m_client && ended)
+            m_client->movieEnded(m_movieWin);
+    }
+
+    float time = m_movieWin->currentTime();
+    if (time < m_lastMediaTime || time >= m_lastMediaTime + cNonContinuousTimeChange || m_seeking) {
+        m_seeking = false;
+        if (m_client)
+            m_client->movieTimeChanged(m_movieWin);
+    }
+    m_lastMediaTime = time;
+
+    if (m_loadError)
+        endTask();
+}
+
+void QTMovieWinPrivate::createMovieController()
+{
+    Rect bounds;
+    long flags;
+
+    if (!m_movie)
+        return;
+
+    if (m_movieController)
+        DisposeMovieController(m_movieController);
+
+    GetMovieBox(m_movie, &bounds);
+    flags = mcTopLeftMovie | mcNotVisible;
+    m_movieController = NewMovieController(m_movie, &bounds, flags);
+    if (!m_movieController)
+        return;
+
+    MCSetControllerPort(m_movieController, m_gWorld);
+    MCSetControllerAttached(m_movieController, false);
+}
+
+void QTMovieWinPrivate::registerDrawingCallback()
+{
+    UppParam param;
+    param.ptr = this;
+    SetMovieDrawingCompleteProc(m_movie, movieDrawingCallWhenChanged, gMovieDrawingCompleteUPP, param.longValue);
+}
+
+void QTMovieWinPrivate::drawingComplete()
+{
+    if (!m_gWorld || m_movieWin->m_disabled || m_loadState < QTMovieLoadStateLoaded)
+        return;
+    m_client->movieNewImageAvailable(m_movieWin);
+}
+
+void QTMovieWinPrivate::updateGWorld()
+{
+    bool shouldBeVisible = m_visible;
+    if (!m_height || !m_width)
+        shouldBeVisible = false;
+
+    if (shouldBeVisible && !m_gWorld)
+        createGWorld();
+    else if (!shouldBeVisible && m_gWorld)
+        deleteGWorld();
+    else if (m_gWorld && (m_width > m_gWorldWidth || m_height > m_gWorldHeight)) {
+        // need a bigger, better gWorld
+        deleteGWorld();
+        createGWorld();
+    }
+}
+
+void QTMovieWinPrivate::createGWorld()
+{
+    ASSERT(!m_gWorld);
+    if (!m_movie || m_loadState < QTMovieLoadStateLoaded)
+        return;
+
+    m_gWorldWidth = max(cGWorldMinWidth, m_width);
+    m_gWorldHeight = max(cGWorldMinHeight, m_height);
+    Rect bounds; 
+    bounds.top = 0;
+    bounds.left = 0; 
+    bounds.right = m_gWorldWidth;
+    bounds.bottom = m_gWorldHeight;
+    OSErr err = QTNewGWorld(&m_gWorld, k32BGRAPixelFormat, &bounds, 0, 0, 0); 
+    if (err) 
+        return;
+    GetMovieGWorld(m_movie, &m_savedGWorld, 0);
+    if (m_movieController)
+        MCSetControllerPort(m_movieController, m_gWorld);
+    SetMovieGWorld(m_movie, m_gWorld, 0);
+    bounds.right = m_width;
+    bounds.bottom = m_height;
+    if (m_movieController)
+        MCSetControllerBoundsRect(m_movieController, &bounds);
+    SetMovieBox(m_movie, &bounds);
+}
+
+void QTMovieWinPrivate::clearGWorld()
+{
+    if (!m_movie||!m_gWorld)
+        return;
+
+    GrafPtr savePort;
+    GetPort(&savePort); 
+    MacSetPort((GrafPtr)m_gWorld);
+
+    Rect bounds; 
+    bounds.top = 0;
+    bounds.left = 0; 
+    bounds.right = m_gWorldWidth;
+    bounds.bottom = m_gWorldHeight;
+    EraseRect(&bounds);
+
+    MacSetPort(savePort);
+}
+
+void QTMovieWinPrivate::setSize(int width, int height)
+{
+    if (m_width == width && m_height == height)
+        return;
+    m_width = width;
+    m_height = height;
+
+    // Do not change movie box before reaching load state loaded as we grab
+    // the initial size when task() sees that state for the first time, and
+    // we need the initial size to be able to scale movie properly. 
+    if (!m_movie || m_loadState < QTMovieLoadStateLoaded)
+        return;
+
+#if !ASSERT_DISABLED
+    ASSERT(m_scaleCached);
+#endif
+
+    updateMovieSize();
+}
+
+void QTMovieWinPrivate::updateMovieSize()
+{
+    if (!m_movie || m_loadState < QTMovieLoadStateLoaded)
+        return;
+
+    Rect bounds; 
+    bounds.top = 0;
+    bounds.left = 0; 
+    bounds.right = m_width;
+    bounds.bottom = m_height;
+    if (m_movieController)
+        MCSetControllerBoundsRect(m_movieController, &bounds);
+    SetMovieBox(m_movie, &bounds);
+    updateGWorld();
+}
+
+
+void QTMovieWinPrivate::deleteGWorld()
+{
+    ASSERT(m_gWorld);
+    if (m_movieController)
+        MCSetControllerPort(m_movieController, m_savedGWorld);
+    if (m_movie)
+        SetMovieGWorld(m_movie, m_savedGWorld, 0);
+    m_savedGWorld = 0;
+    DisposeGWorld(m_gWorld); 
+    m_gWorld = 0;
+    m_gWorldWidth = 0;
+    m_gWorldHeight = 0;
+}
+
+
+QTMovieWin::QTMovieWin(QTMovieWinClient* client)
+    : m_private(new QTMovieWinPrivate())
+    , m_disabled(false)
+{
+    m_private->m_movieWin = this;
+    m_private->m_client = client;
+    initializeQuickTime();
+}
+
+QTMovieWin::~QTMovieWin()
+{
+    delete m_private;
+}
+
+void QTMovieWin::play()
+{
+    m_private->m_timeToRestore = -1.0f;
+
+    if (m_private->m_movieController)
+        MCDoAction(m_private->m_movieController, mcActionPrerollAndPlay, (void *)GetMoviePreferredRate(m_private->m_movie));
+    else
+        StartMovie(m_private->m_movie);
+    m_private->startTask();
+}
+
+void QTMovieWin::pause()
+{
+    m_private->m_timeToRestore = -1.0f;
+
+    if (m_private->m_movieController)
+        MCDoAction(m_private->m_movieController, mcActionPlay, 0);
+    else
+        StopMovie(m_private->m_movie);
+    updateTaskTimer();
+}
+
+float QTMovieWin::rate() const
+{
+    if (!m_private->m_movie)
+        return 0;
+    return FixedToFloat(GetMovieRate(m_private->m_movie));
+}
+
+void QTMovieWin::setRate(float rate)
+{
+    if (!m_private->m_movie)
+        return;    
+    m_private->m_timeToRestore = -1.0f;
+    
+    if (m_private->m_movieController)
+        MCDoAction(m_private->m_movieController, mcActionPrerollAndPlay, (void *)FloatToFixed(rate));
+    else
+        SetMovieRate(m_private->m_movie, FloatToFixed(rate));
+    updateTaskTimer();
+}
+
+float QTMovieWin::duration() const
+{
+    if (!m_private->m_movie)
+        return 0;
+    TimeValue val = GetMovieDuration(m_private->m_movie);
+    TimeScale scale = GetMovieTimeScale(m_private->m_movie);
+    return static_cast<float>(val) / scale;
+}
+
+float QTMovieWin::currentTime() const
+{
+    if (!m_private->m_movie)
+        return 0;
+    TimeValue val = GetMovieTime(m_private->m_movie, 0);
+    TimeScale scale = GetMovieTimeScale(m_private->m_movie);
+    return static_cast<float>(val) / scale;
+}
+
+void QTMovieWin::setCurrentTime(float time) const
+{
+    if (!m_private->m_movie)
+        return;
+
+    m_private->m_timeToRestore = -1.0f;
+    
+    m_private->m_seeking = true;
+    TimeScale scale = GetMovieTimeScale(m_private->m_movie);
+    if (m_private->m_movieController){
+        QTRestartAtTimeRecord restart = { time * scale , 0 };
+        MCDoAction(m_private->m_movieController, mcActionRestartAtTime, (void *)&restart);
+    } else
+        SetMovieTimeValue(m_private->m_movie, TimeValue(time * scale));
+    updateTaskTimer();
+}
+
+void QTMovieWin::setVolume(float volume)
+{
+    if (!m_private->m_movie)
+        return;
+    SetMovieVolume(m_private->m_movie, static_cast<short>(volume * 256));
+}
+
+void QTMovieWin::setPreservesPitch(bool preservesPitch)
+{
+    if (!m_private->m_movie || !m_private->m_currentURL)
+        return;
+
+    OSErr error;
+    bool prop = false;
+
+    error = QTGetMovieProperty(m_private->m_movie, kQTPropertyClass_Audio, kQTAudioPropertyID_RateChangesPreservePitch,
+                               sizeof(kQTAudioPropertyID_RateChangesPreservePitch), static_cast<QTPropertyValuePtr>(&prop), 0);
+
+    if (error || prop == preservesPitch)
+        return;
+
+    m_private->m_timeToRestore = currentTime();
+    m_private->m_rateToRestore = rate();
+    load(m_private->m_currentURL, preservesPitch);
+}
+
+unsigned QTMovieWin::dataSize() const
+{
+    if (!m_private->m_movie)
+        return 0;
+    return GetMovieDataSize(m_private->m_movie, 0, GetMovieDuration(m_private->m_movie));
+}
+
+float QTMovieWin::maxTimeLoaded() const
+{
+    if (!m_private->m_movie)
+        return 0;
+    TimeValue val;
+    GetMaxLoadedTimeInMovie(m_private->m_movie, &val);
+    TimeScale scale = GetMovieTimeScale(m_private->m_movie);
+    return static_cast<float>(val) / scale;
+}
+
+long QTMovieWin::loadState() const
+{
+    return m_private->m_loadState;
+}
+
+void QTMovieWin::getNaturalSize(int& width, int& height)
+{
+    Rect rect = { 0, };
+
+    if (m_private->m_movie)
+        GetMovieNaturalBoundsRect(m_private->m_movie, &rect);
+    width = (rect.right - rect.left) * m_private->m_widthScaleFactor;
+    height = (rect.bottom - rect.top) * m_private->m_heightScaleFactor;
+}
+
+void QTMovieWin::setSize(int width, int height)
+{
+    m_private->setSize(width, height);
+    updateTaskTimer(0);
+}
+
+void QTMovieWin::setVisible(bool b)
+{
+    m_private->m_visible = b;
+    m_private->updateGWorld();
+}
+
+void QTMovieWin::getCurrentFrameInfo(void*& buffer, unsigned& bitsPerPixel, unsigned& rowBytes, unsigned& width, unsigned& height)
+{
+    if (!m_private->m_gWorld) {
+        buffer = 0;
+        bitsPerPixel = 0;
+        rowBytes = 0;
+        width = 0;
+        height = 0;
+        return;
+    }
+    PixMapHandle offscreenPixMap = GetGWorldPixMap(m_private->m_gWorld);
+    buffer = (*offscreenPixMap)->baseAddr;
+    bitsPerPixel = (*offscreenPixMap)->pixelSize;
+    rowBytes = (*offscreenPixMap)->rowBytes & 0x3FFF;
+    width = m_private->m_width;
+    height = m_private->m_height;
+}
+
+void QTMovieWin::paint(HDC hdc, int x, int y)
+{
+    if (!m_private->m_gWorld)
+        return;
+
+    HDC hdcSrc = static_cast<HDC>(GetPortHDC(reinterpret_cast<GrafPtr>(m_private->m_gWorld))); 
+    if (!hdcSrc)
+        return;
+
+    // FIXME: If we could determine the movie has no alpha, we could use BitBlt for those cases, which might be faster.
+    BLENDFUNCTION blendFunction; 
+    blendFunction.BlendOp = AC_SRC_OVER;
+    blendFunction.BlendFlags = 0;
+    blendFunction.SourceConstantAlpha = 255;
+    blendFunction.AlphaFormat = AC_SRC_ALPHA;
+    AlphaBlend(hdc, x, y, m_private->m_width, m_private->m_height, hdcSrc, 
+         0, 0, m_private->m_width, m_private->m_height, blendFunction);
+}
+
+void QTMovieWin::load(const UChar* url, int len, bool preservesPitch)
+{
+    CFStringRef urlStringRef = CFStringCreateWithCharacters(kCFAllocatorDefault, reinterpret_cast<const UniChar*>(url), len);
+    CFURLRef cfURL = CFURLCreateWithString(kCFAllocatorDefault, urlStringRef, 0);
+
+    load(cfURL, preservesPitch);
+
+    CFRelease(cfURL);
+    CFRelease(urlStringRef);
+}
+
+void QTMovieWin::load(CFURLRef url, bool preservesPitch)
+{
+    if (!url)
+        return;
+
+    if (m_private->m_movie) {
+        m_private->endTask();
+        if (m_private->m_gWorld)
+            m_private->deleteGWorld();
+        if (m_private->m_movieController)
+            DisposeMovieController(m_private->m_movieController);
+        m_private->m_movieController = 0;
+        DisposeMovie(m_private->m_movie);
+        m_private->m_movie = 0;
+        m_private->m_loadState = 0;
+    }  
+
+    // Define a property array for NewMovieFromProperties. 8 should be enough for our needs. 
+    QTNewMoviePropertyElement movieProps[8]; 
+    ItemCount moviePropCount = 0; 
+
+    bool boolTrue = true;
+    
+    // Disable streaming support for now. 
+    CFStringRef scheme = CFURLCopyScheme(url);
+    bool isRTSP = CFStringHasPrefix(scheme, CFSTR("rtsp:"));
+    CFRelease(scheme);
+
+    if (isRTSP) {
+        m_private->m_loadError = noMovieFound;
+        goto end;
+    }
+
+    if (m_private->m_currentURL) {
+        if (m_private->m_currentURL != url) {
+            CFRelease(m_private->m_currentURL);
+            m_private->m_currentURL = url;
+            CFRetain(url);
+        }
+    } else {
+        m_private->m_currentURL = url;
+        CFRetain(url);
+    }
+
+    // Add the movie data location to the property array 
+    movieProps[moviePropCount].propClass = kQTPropertyClass_DataLocation; 
+    movieProps[moviePropCount].propID = kQTDataLocationPropertyID_CFURL; 
+    movieProps[moviePropCount].propValueSize = sizeof(m_private->m_currentURL); 
+    movieProps[moviePropCount].propValueAddress = &(m_private->m_currentURL); 
+    movieProps[moviePropCount].propStatus = 0; 
+    moviePropCount++; 
+
+    movieProps[moviePropCount].propClass = kQTPropertyClass_MovieInstantiation; 
+    movieProps[moviePropCount].propID = kQTMovieInstantiationPropertyID_DontAskUnresolvedDataRefs; 
+    movieProps[moviePropCount].propValueSize = sizeof(boolTrue); 
+    movieProps[moviePropCount].propValueAddress = &boolTrue; 
+    movieProps[moviePropCount].propStatus = 0; 
+    moviePropCount++; 
+
+    movieProps[moviePropCount].propClass = kQTPropertyClass_MovieInstantiation; 
+    movieProps[moviePropCount].propID = kQTMovieInstantiationPropertyID_AsyncOK; 
+    movieProps[moviePropCount].propValueSize = sizeof(boolTrue); 
+    movieProps[moviePropCount].propValueAddress = &boolTrue; 
+    movieProps[moviePropCount].propStatus = 0; 
+    moviePropCount++; 
+
+    movieProps[moviePropCount].propClass = kQTPropertyClass_NewMovieProperty; 
+    movieProps[moviePropCount].propID = kQTNewMoviePropertyID_Active; 
+    movieProps[moviePropCount].propValueSize = sizeof(boolTrue); 
+    movieProps[moviePropCount].propValueAddress = &boolTrue; 
+    movieProps[moviePropCount].propStatus = 0; 
+    moviePropCount++; 
+
+    movieProps[moviePropCount].propClass = kQTPropertyClass_NewMovieProperty; 
+    movieProps[moviePropCount].propID = kQTNewMoviePropertyID_DontInteractWithUser; 
+    movieProps[moviePropCount].propValueSize = sizeof(boolTrue); 
+    movieProps[moviePropCount].propValueAddress = &boolTrue; 
+    movieProps[moviePropCount].propStatus = 0; 
+    moviePropCount++; 
+
+    movieProps[moviePropCount].propClass = kQTPropertyClass_MovieInstantiation;
+    movieProps[moviePropCount].propID = '!url';
+    movieProps[moviePropCount].propValueSize = sizeof(boolTrue); 
+    movieProps[moviePropCount].propValueAddress = &boolTrue; 
+    movieProps[moviePropCount].propStatus = 0; 
+    moviePropCount++; 
+
+    movieProps[moviePropCount].propClass = kQTPropertyClass_MovieInstantiation; 
+    movieProps[moviePropCount].propID = 'site';
+    movieProps[moviePropCount].propValueSize = sizeof(boolTrue); 
+    movieProps[moviePropCount].propValueAddress = &boolTrue; 
+    movieProps[moviePropCount].propStatus = 0; 
+    moviePropCount++;
+
+    movieProps[moviePropCount].propClass = kQTPropertyClass_Audio; 
+    movieProps[moviePropCount].propID = kQTAudioPropertyID_RateChangesPreservePitch;
+    movieProps[moviePropCount].propValueSize = sizeof(preservesPitch); 
+    movieProps[moviePropCount].propValueAddress = &preservesPitch; 
+    movieProps[moviePropCount].propStatus = 0; 
+    moviePropCount++; 
+
+    ASSERT(moviePropCount <= sizeof(movieProps)/sizeof(movieProps[0]));
+    m_private->m_loadError = NewMovieFromProperties(moviePropCount, movieProps, 0, 0, &m_private->m_movie);
+
+end:
+    m_private->startTask();
+    // get the load fail callback quickly 
+    if (m_private->m_loadError)
+        updateTaskTimer(0);
+    else {
+        OSType mode = kQTApertureMode_CleanAperture;
+
+        // Set the aperture mode property on a movie to signal that we want aspect ratio
+        // and clean aperture dimensions. Don't worry about errors, we can't do anything if
+        // the installed version of QT doesn't support it and it isn't serious enough to 
+        // warrant failing.
+        QTSetMovieProperty(m_private->m_movie, kQTPropertyClass_Visual, kQTVisualPropertyID_ApertureMode, sizeof(mode), &mode);
+        m_private->registerDrawingCallback();
+    }
+}
+
+void QTMovieWin::disableUnsupportedTracks(unsigned& enabledTrackCount, unsigned& totalTrackCount)
+{
+    if (!m_private->m_movie) {
+        totalTrackCount = 0;
+        enabledTrackCount = 0;
+        return;
+    }
+
+    static HashSet<OSType>* allowedTrackTypes = 0;
+    if (!allowedTrackTypes) {
+        allowedTrackTypes = new HashSet<OSType>;
+        allowedTrackTypes->add(VideoMediaType);
+        allowedTrackTypes->add(SoundMediaType);
+        allowedTrackTypes->add(TextMediaType);
+        allowedTrackTypes->add(BaseMediaType);
+        allowedTrackTypes->add(closedCaptionTrackType);
+        allowedTrackTypes->add(subTitleTrackType);
+        allowedTrackTypes->add(mpeg4ObjectDescriptionTrackType);
+        allowedTrackTypes->add(mpeg4SceneDescriptionTrackType);
+        allowedTrackTypes->add(TimeCodeMediaType);
+        allowedTrackTypes->add(TimeCode64MediaType);
+    }
+
+    long trackCount = GetMovieTrackCount(m_private->m_movie);
+    enabledTrackCount = trackCount;
+    totalTrackCount = trackCount;
+
+    // Track indexes are 1-based. yuck. These things must descend from old-
+    // school mac resources or something.
+    for (long trackIndex = 1; trackIndex <= trackCount; trackIndex++) {
+        // Grab the track at the current index. If there isn't one there, then
+        // we can move onto the next one.
+        Track currentTrack = GetMovieIndTrack(m_private->m_movie, trackIndex);
+        if (!currentTrack)
+            continue;
+        
+        // Check to see if the track is disabled already, we should move along.
+        // We don't need to re-disable it.
+        if (!GetTrackEnabled(currentTrack))
+            continue;
+
+        // Grab the track's media. We're going to check to see if we need to
+        // disable the tracks. They could be unsupported.
+        Media trackMedia = GetTrackMedia(currentTrack);
+        if (!trackMedia)
+            continue;
+        
+        // Grab the media type for this track. Make sure that we don't
+        // get an error in doing so. If we do, then something really funky is
+        // wrong.
+        OSType mediaType;
+        GetMediaHandlerDescription(trackMedia, &mediaType, nil, nil);
+        OSErr mediaErr = GetMoviesError();    
+        if (mediaErr != noErr)
+            continue;
+        
+        if (!allowedTrackTypes->contains(mediaType)) {
+
+            // Different mpeg variants import as different track types so check for the "mpeg 
+            // characteristic" instead of hard coding the (current) list of mpeg media types.
+            if (GetMovieIndTrackType(m_private->m_movie, 1, 'mpeg', movieTrackCharacteristic | movieTrackEnabledOnly))
+                continue;
+
+            SetTrackEnabled(currentTrack, false);
+            --enabledTrackCount;
+        }
+        
+        // Grab the track reference count for chapters. This will tell us if it
+        // has chapter tracks in it. If there aren't any references, then we
+        // can move on the next track.
+        long referenceCount = GetTrackReferenceCount(currentTrack, kTrackReferenceChapterList);
+        if (referenceCount <= 0)
+            continue;
+        
+        long referenceIndex = 0;        
+        while (1) {
+            // If we get nothing here, we've overstepped our bounds and can stop
+            // looking. Chapter indices here are 1-based as well - hence, the
+            // pre-increment.
+            referenceIndex++;
+            Track chapterTrack = GetTrackReference(currentTrack, kTrackReferenceChapterList, referenceIndex);
+            if (!chapterTrack)
+                break;
+            
+            // Try to grab the media for the track.
+            Media chapterMedia = GetTrackMedia(chapterTrack);
+            if (!chapterMedia)
+                continue;
+        
+            // Grab the media type for this track. Make sure that we don't
+            // get an error in doing so. If we do, then something really
+            // funky is wrong.
+            OSType mediaType;
+            GetMediaHandlerDescription(chapterMedia, &mediaType, nil, nil);
+            OSErr mediaErr = GetMoviesError();
+            if (mediaErr != noErr)
+                continue;
+            
+            // Check to see if the track is a video track. We don't care about
+            // other non-video tracks.
+            if (mediaType != VideoMediaType)
+                continue;
+            
+            // Check to see if the track is already disabled. If it is, we
+            // should move along.
+            if (!GetTrackEnabled(chapterTrack))
+                continue;
+            
+            // Disabled the evil, evil track.
+            SetTrackEnabled(chapterTrack, false);
+            --enabledTrackCount;
+        }
+    }
+}
+
+void QTMovieWin::setDisabled(bool b)
+{
+    m_disabled = b;
+}
+
+
+bool QTMovieWin::hasVideo() const
+{
+    if (!m_private->m_movie)
+        return false;
+    return (GetMovieIndTrackType(m_private->m_movie, 1, VisualMediaCharacteristic, movieTrackCharacteristic | movieTrackEnabledOnly));
+}
+
+bool QTMovieWin::hasAudio() const
+{
+    if (!m_private->m_movie)
+        return false;
+    return (GetMovieIndTrackType(m_private->m_movie, 1, AudioMediaCharacteristic, movieTrackCharacteristic | movieTrackEnabledOnly));
+}
+
+
+bool QTMovieWin::hasClosedCaptions() const 
+{
+    if (!m_private->m_movie)
+        return false;
+    return GetMovieIndTrackType(m_private->m_movie, 1, closedCaptionTrackType, movieTrackMediaType);
+}
+
+void QTMovieWin::setClosedCaptionsVisible(bool visible)
+{
+    if (!m_private->m_movie)
+        return;
+
+    Track ccTrack = GetMovieIndTrackType(m_private->m_movie, 1, closedCaptionTrackType, movieTrackMediaType);
+    if (!ccTrack)
+        return;
+
+    Boolean doDisplay = visible;
+    QTSetTrackProperty(ccTrack, closedCaptionTrackType, closedCaptionDisplayPropertyID, sizeof(doDisplay), &doDisplay);
+}
+
+pascal OSErr movieDrawingCompleteProc(Movie movie, long data)
+{
+    UppParam param;
+    param.longValue = data;
+    QTMovieWinPrivate* mp = static_cast<QTMovieWinPrivate*>(param.ptr);
+    if (mp)
+        mp->drawingComplete();
+    return 0;
+}
+
+static void initializeSupportedTypes() 
+{
+    if (gSupportedTypes)
+        return;
+
+    gSupportedTypes = new Vector<CFStringRef>;
+    if (quickTimeVersion < minimumQuickTimeVersion) {
+        LOG_ERROR("QuickTime version %x detected, at least %x required. Returning empty list of supported media MIME types.", quickTimeVersion, minimumQuickTimeVersion);
+        return;
+    }
+
+    // QuickTime doesn't have an importer for video/quicktime. Add it manually.
+    gSupportedTypes->append(CFSTR("video/quicktime"));
+
+    for (int index = 0; index < 2; index++) {
+        ComponentDescription findCD;
+
+        // look at all movie importers that can import in place and are installed. 
+        findCD.componentType = MovieImportType;
+        findCD.componentSubType = 0;
+        findCD.componentManufacturer = 0;
+        findCD.componentFlagsMask = cmpIsMissing | movieImportSubTypeIsFileExtension | canMovieImportInPlace | dontAutoFileMovieImport;
+
+        // look at those registered by HFS file types the first time through, by file extension the second time
+        findCD.componentFlags = canMovieImportInPlace | (index ? movieImportSubTypeIsFileExtension : 0);
+        
+        long componentCount = CountComponents(&findCD);
+        if (!componentCount)
+            continue;
+
+        Component comp = 0;
+        while (comp = FindNextComponent(comp, &findCD)) {
+            // Does this component have a MIME type container?
+            ComponentDescription infoCD;
+            OSErr err = GetComponentInfo(comp, &infoCD, nil /*name*/, nil /*info*/, nil /*icon*/);
+            if (err)
+                continue;
+            if (!(infoCD.componentFlags & hasMovieImportMIMEList))
+                continue;
+            QTAtomContainer mimeList = 0;
+            err = MovieImportGetMIMETypeList((ComponentInstance)comp, &mimeList);
+            if (err || !mimeList)
+                continue;
+
+            // Grab every type from the container.
+            QTLockContainer(mimeList);
+            int typeCount = QTCountChildrenOfType(mimeList, kParentAtomIsContainer, kMimeInfoMimeTypeTag);
+            for (int typeIndex = 1; typeIndex <= typeCount; typeIndex++) {
+                QTAtom mimeTag = QTFindChildByIndex(mimeList, 0, kMimeInfoMimeTypeTag, typeIndex, 0);
+                if (!mimeTag)
+                    continue;
+                char* atomData;
+                long typeLength;
+                if (noErr != QTGetAtomDataPtr(mimeList, mimeTag, &typeLength, &atomData))
+                    continue;
+
+                char typeBuffer[256];
+                if (typeLength >= sizeof(typeBuffer))
+                    continue;
+                memcpy(typeBuffer, atomData, typeLength);
+                typeBuffer[typeLength] = 0;
+
+                // Only add "audio/..." and "video/..." types.
+                if (strncmp(typeBuffer, "audio/", 6) && strncmp(typeBuffer, "video/", 6))
+                    continue;
+
+                CFStringRef cfMimeType = CFStringCreateWithCString(0, typeBuffer, kCFStringEncodingUTF8);
+                if (!cfMimeType)
+                    continue;
+
+                // Only add each type once.
+                bool alreadyAdded = false;
+                for (int addedIndex = 0; addedIndex < gSupportedTypes->size(); addedIndex++) {
+                    CFStringRef type = gSupportedTypes->at(addedIndex);
+                    if (kCFCompareEqualTo == CFStringCompare(cfMimeType, type, kCFCompareCaseInsensitive)) {
+                        alreadyAdded = true;
+                        break;
+                    }
+                }
+                if (!alreadyAdded)
+                    gSupportedTypes->append(cfMimeType);
+                else
+                    CFRelease(cfMimeType);
+            }
+            DisposeHandle(mimeList);
+        }
+    }
+}
+
+unsigned QTMovieWin::countSupportedTypes()
+{
+    initializeSupportedTypes();
+    return static_cast<unsigned>(gSupportedTypes->size());
+}
+
+void QTMovieWin::getSupportedType(unsigned index, const UChar*& str, unsigned& len)
+{
+    initializeSupportedTypes();
+    ASSERT(index < gSupportedTypes->size());
+
+    // Allocate sufficient buffer to hold any MIME type
+    static UniChar* staticBuffer = 0;
+    if (!staticBuffer)
+        staticBuffer = new UniChar[32];
+
+    CFStringRef cfstr = gSupportedTypes->at(index);
+    len = CFStringGetLength(cfstr);
+    CFRange range = { 0, len };
+    CFStringGetCharacters(cfstr, range, staticBuffer);
+    str = reinterpret_cast<const UChar*>(staticBuffer);
+    
+}
+
+void QTMovieWin::setTaskTimerFuncs(SetTaskTimerDelayFunc setTaskTimerDelay, StopTaskTimerFunc stopTaskTimer)
+{
+    gSetTaskTimerDelay = setTaskTimerDelay;
+    gStopTaskTimer = stopTaskTimer;
+}
+
+bool QTMovieWin::initializeQuickTime() 
+{
+    static bool initialized = false;
+    static bool initializationSucceeded = false;
+    if (!initialized) {
+        initialized = true;
+        // Initialize and check QuickTime version
+        OSErr result = InitializeQTML(kInitializeQTMLEnableDoubleBufferedSurface);
+        if (result == noErr)
+            result = Gestalt(gestaltQuickTime, &quickTimeVersion);
+        if (result != noErr) {
+            LOG_ERROR("No QuickTime available. Disabling <video> and <audio> support.");
+            return false;
+        }
+        if (quickTimeVersion < minimumQuickTimeVersion) {
+            LOG_ERROR("QuickTime version %x detected, at least %x required. Disabling <video> and <audio> support.", quickTimeVersion, minimumQuickTimeVersion);
+            return false;
+        }
+        EnterMovies();
+        gMovieDrawingCompleteUPP = NewMovieDrawingCompleteUPP(movieDrawingCompleteProc);
+        initializationSucceeded = true;
+    }
+    return initializationSucceeded;
+}
+
+LRESULT QTMovieWin::fullscreenWndProc(HWND wnd, UINT message, WPARAM wParam, LPARAM lParam)
+{
+    QTMovieWin* movie = static_cast<QTMovieWin*>(GetProp(wnd, fullscreenQTMovieWinPointerProp));
+
+    if (message == WM_DESTROY)
+        RemoveProp(wnd, fullscreenQTMovieWinPointerProp);
+
+    if (!movie)
+        return DefWindowProc(wnd, message, wParam, lParam);
+
+    return movie->m_private->m_fullscreenClient->fullscreenClientWndProc(wnd, message, wParam, lParam);
+}
+
+HWND QTMovieWin::enterFullscreen(QTMovieWinFullscreenClient* client)
+{
+    m_private->m_fullscreenClient = client;
+    
+    BeginFullScreen(&m_private->m_fullscreenRestoreState, 0, 0, 0, &m_private->m_fullscreenWindow, 0, fullScreenAllowEvents); 
+    QTMLSetWindowWndProc(m_private->m_fullscreenWindow, fullscreenWndProc);
+    CreatePortAssociation(GetPortNativeWindow(m_private->m_fullscreenWindow), 0, 0);
+
+    GetMovieBox(m_private->m_movie, &m_private->m_fullscreenRect);
+    GetMovieGWorld(m_private->m_movie, &m_private->m_fullscreenOrigGWorld, 0);
+    SetMovieGWorld(m_private->m_movie, reinterpret_cast<CGrafPtr>(m_private->m_fullscreenWindow), GetGWorldDevice(reinterpret_cast<CGrafPtr>(m_private->m_fullscreenWindow)));
+
+    // Set the size of the box to preserve aspect ratio
+    Rect rect = m_private->m_fullscreenWindow->portRect;
+
+    float movieRatio = static_cast<float>(m_private->m_width) / m_private->m_height;
+    int windowWidth =  rect.right - rect.left;
+    int windowHeight = rect.bottom - rect.top;
+    float windowRatio = static_cast<float>(windowWidth) / windowHeight;
+    int actualWidth = (windowRatio > movieRatio) ? (windowHeight * movieRatio) : windowWidth;
+    int actualHeight = (windowRatio < movieRatio) ? (windowWidth / movieRatio) : windowHeight;
+    int offsetX = (windowWidth - actualWidth) / 2;
+    int offsetY = (windowHeight - actualHeight) / 2;
+
+    rect.left = offsetX;
+    rect.right = offsetX + actualWidth;
+    rect.top = offsetY;
+    rect.bottom = offsetY + actualHeight;
+
+    SetMovieBox(m_private->m_movie, &rect);
+    ShowHideTaskBar(true);
+
+    // Set the 'this' pointer on the HWND
+    HWND wnd = static_cast<HWND>(GetPortNativeWindow(m_private->m_fullscreenWindow));
+    SetProp(wnd, fullscreenQTMovieWinPointerProp, static_cast<HANDLE>(this));
+
+    return wnd;
+}
+
+void QTMovieWin::exitFullscreen()
+{
+    if (!m_private->m_fullscreenWindow)
+        return;
+
+    HWND wnd = static_cast<HWND>(GetPortNativeWindow(m_private->m_fullscreenWindow));
+    DestroyPortAssociation(reinterpret_cast<CGrafPtr>(m_private->m_fullscreenWindow));
+    SetMovieGWorld(m_private->m_movie, m_private->m_fullscreenOrigGWorld, 0);
+    EndFullScreen(m_private->m_fullscreenRestoreState, 0L);
+    SetMovieBox(m_private->m_movie, &m_private->m_fullscreenRect);
+    m_private->m_fullscreenWindow = 0;
+}
+
+BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
+{
+    switch (fdwReason) {
+    case DLL_PROCESS_ATTACH:
+        return TRUE;
+    case DLL_PROCESS_DETACH:
+    case DLL_THREAD_ATTACH:
+    case DLL_THREAD_DETACH:
+        return FALSE;
+    }
+    ASSERT_NOT_REACHED();
+    return FALSE;
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/QTMovieWin.h b/src/3rdparty/webkit/WebCore/platform/graphics/win/QTMovieWin.h
new file mode 100644
index 0000000000..d2a7ed0145
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/QTMovieWin.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef QTMovieWin_h
+#define QTMovieWin_h
+
+#include <Unicode.h>
+#include <windows.h>
+
+#ifdef QTMOVIEWIN_EXPORTS
+#define QTMOVIEWIN_API __declspec(dllexport)
+#else
+#define QTMOVIEWIN_API __declspec(dllimport)
+#endif
+
+class QTMovieWin;
+class QTMovieWinPrivate;
+
+class QTMovieWinClient {
+public:
+    virtual void movieEnded(QTMovieWin*) = 0;
+    virtual void movieLoadStateChanged(QTMovieWin*) = 0;
+    virtual void movieTimeChanged(QTMovieWin*) = 0;
+    virtual void movieNewImageAvailable(QTMovieWin*) = 0;
+};
+
+class QTMovieWinFullscreenClient {
+public:
+    virtual LRESULT fullscreenClientWndProc(HWND, UINT message, WPARAM, LPARAM) = 0;
+};
+
+enum {
+    QTMovieLoadStateError = -1L,
+    QTMovieLoadStateLoaded  = 2000L,
+    QTMovieLoadStatePlayable = 10000L,
+    QTMovieLoadStatePlaythroughOK = 20000L,
+    QTMovieLoadStateComplete = 100000L
+};
+
+typedef const struct __CFURL * CFURLRef;
+
+class QTMOVIEWIN_API QTMovieWin {
+public:
+    static bool initializeQuickTime();
+
+    typedef void (*SetTaskTimerDelayFunc)(double);
+    typedef void (*StopTaskTimerFunc)();
+    static void setTaskTimerFuncs(SetTaskTimerDelayFunc, StopTaskTimerFunc);
+    static void taskTimerFired();
+
+    QTMovieWin(QTMovieWinClient*);
+    ~QTMovieWin();
+
+    void load(const UChar* url, int len, bool preservesPitch);
+    long loadState() const;
+    float maxTimeLoaded() const;
+
+    void play();
+    void pause();
+
+    float rate() const;
+    void setRate(float);
+
+    float duration() const;
+    float currentTime() const;
+    void setCurrentTime(float) const;
+
+    void setVolume(float);
+    void setPreservesPitch(bool);
+
+    unsigned dataSize() const;
+
+    void getNaturalSize(int& width, int& height);
+    void setSize(int width, int height);
+
+    void setVisible(bool);
+    void paint(HDC, int x, int y);
+    void getCurrentFrameInfo(void*& buffer, unsigned& bitsPerPixel, unsigned& rowBytes, unsigned& width, unsigned& height);
+
+    void disableUnsupportedTracks(unsigned& enabledTrackCount, unsigned& totalTrackCount);
+    void setDisabled(bool);
+
+    bool hasVideo() const;
+    bool hasAudio() const;
+
+    bool hasClosedCaptions() const;
+    void setClosedCaptionsVisible(bool);
+
+    static unsigned countSupportedTypes();
+    static void getSupportedType(unsigned index, const UChar*& str, unsigned& len);
+
+    // Returns the full-screen window created
+    HWND enterFullscreen(QTMovieWinFullscreenClient*);
+    void exitFullscreen();
+
+private:
+    void load(CFURLRef, bool preservesPitch);
+    static LRESULT fullscreenWndProc(HWND, UINT message, WPARAM, LPARAM);
+
+    QTMovieWinPrivate* m_private;
+    bool m_disabled;
+    friend class QTMovieWinPrivate;
+};
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/QTMovieWinTimer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/QTMovieWinTimer.cpp
new file mode 100644
index 0000000000..f6103ea4cc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/QTMovieWinTimer.cpp
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2006, 2007, 2009 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+#include "config.h"
+
+#include <windows.h>
+
+#include "QTMovieWinTimer.h"
+
+#include <wtf/Assertions.h>
+
+// This file is used by the QuickTime access DLL. It copies some WebCore code 
+// which can't be used directly due to dependency issues.
+
+// FIXME: Find a way to do timers that can manage <10ms resolution properly too.
+
+static UINT_PTR timerID;
+static void (*sharedTimerFiredFunction)();
+
+static HINSTANCE instanceHandle = 0;
+
+static HWND timerWindowHandle = 0;
+static UINT timerFiredMessage = 0;
+static const LPCWSTR kTimerWindowClassName = L"TimerWindowClass";
+static bool processingCustomTimerMessage = false;
+
+static LRESULT CALLBACK TimerWindowWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
+{
+    if (message == timerFiredMessage) {
+        processingCustomTimerMessage = true;
+        sharedTimerFiredFunction();
+        processingCustomTimerMessage = false;
+    } else if (message == WM_TIMER && wParam == timerID) {
+        stopSharedTimer();
+        sharedTimerFiredFunction();
+    } else
+        return DefWindowProc(hWnd, message, wParam, lParam);
+    return 0;
+}
+
+static void initializeOffScreenTimerWindow()
+{
+    if (timerWindowHandle)
+        return;
+    
+    WNDCLASSEX wcex;
+    memset(&wcex, 0, sizeof(WNDCLASSEX));
+    wcex.cbSize = sizeof(WNDCLASSEX);
+    wcex.lpfnWndProc    = TimerWindowWndProc;
+    wcex.hInstance      = instanceHandle;
+    wcex.lpszClassName  = kTimerWindowClassName;
+    RegisterClassEx(&wcex);
+
+    timerWindowHandle = CreateWindow(kTimerWindowClassName, 0, 0,
+       CW_USEDEFAULT, 0, CW_USEDEFAULT, 0, HWND_MESSAGE, 0, instanceHandle, 0);
+    timerFiredMessage = RegisterWindowMessage(L"com.apple.WebKit.TimerFired");
+}
+
+void setSharedTimerFiredFunction(void (*f)())
+{
+    sharedTimerFiredFunction = f;
+}
+
+void setSharedTimerFireDelay(double interval)
+{
+    ASSERT(sharedTimerFiredFunction);
+
+    unsigned intervalInMS;
+    if (interval < 0)
+        intervalInMS = 0;
+    else {
+        interval *= 1000;
+        if (interval > USER_TIMER_MAXIMUM)
+            intervalInMS = USER_TIMER_MAXIMUM;
+        else
+            intervalInMS = (unsigned)interval;
+    }
+
+    stopSharedTimer();
+    initializeOffScreenTimerWindow();
+
+    // We don't allow nested PostMessages, since the custom messages will effectively starve
+    // painting and user input. (Win32 has a tri-level queue with application messages > 
+    // user input > WM_PAINT/WM_TIMER.)
+    // In addition, if the queue contains input events that have been there since the last call to
+    // GetQueueStatus, PeekMessage or GetMessage we favor timers.
+    if (intervalInMS < USER_TIMER_MINIMUM 
+        && !processingCustomTimerMessage 
+        && !LOWORD(::GetQueueStatus(QS_ALLINPUT))) {
+        // Windows SetTimer does not allow timeouts smaller than 10ms (USER_TIMER_MINIMUM)
+        PostMessage(timerWindowHandle, timerFiredMessage, 0, 0);
+    } else
+        timerID = SetTimer(timerWindowHandle, timerFiredMessage, intervalInMS, 0);
+}
+
+void stopSharedTimer()
+{
+    if (timerID) {
+        KillTimer(timerWindowHandle, timerID);
+        timerID = 0;
+    }
+}
+
+void setSharedTimerInstanceHandle(HINSTANCE handle)
+{
+    instanceHandle = handle;
+}
+
+double systemTime()
+{
+    FILETIME ft;
+    GetSystemTimeAsFileTime(&ft);
+    ULARGE_INTEGER t;
+    memcpy(&t, &ft, sizeof(t));
+    return t.QuadPart * 0.0000001 - 11644473600.0;
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/QTMovieWinTimer.h b/src/3rdparty/webkit/WebCore/platform/graphics/win/QTMovieWinTimer.h
new file mode 100644
index 0000000000..3e3c2bca33
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/QTMovieWinTimer.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef QTMovieViewTimer_h
+#define QTMovieViewTimer_h
+
+// This header should not be included from WebCore.
+// It is used by the QuickTime access DLL. It copies some WebCore code 
+// which can't be used directly due to dependency issues.
+
+void setSharedTimerFiredFunction(void (*)());
+void setSharedTimerFireDelay(double delay);
+void stopSharedTimer();
+void setSharedTimerInstanceHandle(HINSTANCE handle);
+double systemTime();
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/RefCountedHFONT.h b/src/3rdparty/webkit/WebCore/platform/graphics/win/RefCountedHFONT.h
new file mode 100644
index 0000000000..b1b691b5a5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/RefCountedHFONT.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#ifndef RefCountedHFONT_h
+#define RefCountedHFONT_h
+
+#include "StringImpl.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class RefCountedHFONT : public RefCounted<RefCountedHFONT> {
+public:
+    static PassRefPtr<RefCountedHFONT> create(HFONT hfont) { return adoptRef(new RefCountedHFONT(hfont)); }
+    static PassRefPtr<RefCountedHFONT> createDeleted() { return adoptRef(new RefCountedHFONT(reinterpret_cast<HFONT>(-1))); }
+
+    ~RefCountedHFONT()
+    {
+        if (m_hfont != reinterpret_cast<HFONT>(-1))
+            DeleteObject(m_hfont);
+    }
+
+    HFONT hfont() const { return m_hfont; }
+    unsigned hash() const
+    {
+        return StringImpl::computeHash(reinterpret_cast<const UChar*>(&m_hfont), sizeof(HFONT) / sizeof(UChar));
+    }
+
+private:
+    RefCountedHFONT(HFONT hfont)
+        : m_hfont(hfont)
+    {
+    }
+
+    HFONT m_hfont;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp
new file mode 100644
index 0000000000..6b3a96e067
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp
@@ -0,0 +1,146 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SimpleFontData.h"
+
+#include <winsock2.h>
+#include "Font.h"
+#include "FontCache.h"
+#include "FloatRect.h"
+#include "FontDescription.h"
+#include "PlatformString.h"
+#include <wtf/MathExtras.h>
+#include <wtf/RetainPtr.h>
+#include <unicode/uchar.h>
+#include <unicode/unorm.h>
+#include <ApplicationServices/ApplicationServices.h>
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#include <mlang.h>
+#include <tchar.h>
+
+namespace WebCore {
+
+using std::max;
+
+static inline float scaleEmToUnits(float x, unsigned unitsPerEm) { return unitsPerEm ? x / static_cast<float>(unitsPerEm) : x; }
+
+void SimpleFontData::platformInit()
+{
+    m_syntheticBoldOffset = m_platformData.syntheticBold() ? 1.0f : 0.f;
+    m_scriptCache = 0;
+    m_scriptFontProperties = 0;
+    m_isSystemFont = false;
+
+    if (m_platformData.useGDI())
+       return initGDIFont();
+
+    CGFontRef font = m_platformData.cgFont();
+    int iAscent = CGFontGetAscent(font);
+    int iDescent = CGFontGetDescent(font);
+    int iLineGap = CGFontGetLeading(font);
+    m_unitsPerEm = CGFontGetUnitsPerEm(font);
+    float pointSize = m_platformData.size();
+    float fAscent = scaleEmToUnits(iAscent, m_unitsPerEm) * pointSize;
+    float fDescent = -scaleEmToUnits(iDescent, m_unitsPerEm) * pointSize;
+    float fLineGap = scaleEmToUnits(iLineGap, m_unitsPerEm) * pointSize;
+
+    if (!isCustomFont()) {
+        HDC dc = GetDC(0);
+        HGDIOBJ oldFont = SelectObject(dc, m_platformData.hfont());
+        int faceLength = GetTextFace(dc, 0, 0);
+        Vector<TCHAR> faceName(faceLength);
+        GetTextFace(dc, faceLength, faceName.data());
+        m_isSystemFont = !_tcscmp(faceName.data(), _T("Lucida Grande"));
+        SelectObject(dc, oldFont);
+        ReleaseDC(0, dc);
+
+        if (shouldApplyMacAscentHack()) {
+            // This code comes from FontDataMac.mm. We only ever do this when running regression tests so that our metrics will match Mac.
+
+            // We need to adjust Times, Helvetica, and Courier to closely match the
+            // vertical metrics of their Microsoft counterparts that are the de facto
+            // web standard. The AppKit adjustment of 20% is too big and is
+            // incorrectly added to line spacing, so we use a 15% adjustment instead
+            // and add it to the ascent.
+            if (!_tcscmp(faceName.data(), _T("Times")) || !_tcscmp(faceName.data(), _T("Helvetica")) || !_tcscmp(faceName.data(), _T("Courier")))
+                fAscent += floorf(((fAscent + fDescent) * 0.15f) + 0.5f);
+        }
+    }
+
+    m_ascent = lroundf(fAscent);
+    m_descent = lroundf(fDescent);
+    m_lineGap = lroundf(fLineGap);
+    m_lineSpacing = m_ascent + m_descent + m_lineGap;
+
+    // Measure the actual character "x", because AppKit synthesizes X height rather than getting it from the font.
+    // Unfortunately, NSFont will round this for us so we don't quite get the right value.
+    GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
+    Glyph xGlyph = glyphPageZero ? glyphPageZero->glyphDataForCharacter('x').glyph : 0;
+    if (xGlyph) {
+        CGRect xBox;
+        CGFontGetGlyphBBoxes(font, &xGlyph, 1, &xBox);
+        // Use the maximum of either width or height because "x" is nearly square
+        // and web pages that foolishly use this metric for width will be laid out
+        // poorly if we return an accurate height. Classic case is Times 13 point,
+        // which has an "x" that is 7x6 pixels.
+        m_xHeight = scaleEmToUnits(max(CGRectGetMaxX(xBox), CGRectGetMaxY(xBox)), m_unitsPerEm) * pointSize;
+    } else {
+        int iXHeight = CGFontGetXHeight(font);
+        m_xHeight = scaleEmToUnits(iXHeight, m_unitsPerEm) * pointSize;
+    }
+}
+
+void SimpleFontData::platformCharWidthInit()
+{
+    // GDI Fonts init charwidths in initGDIFont.
+    if (!m_platformData.useGDI()) {
+        m_avgCharWidth = 0.f;
+        m_maxCharWidth = 0.f;
+        initCharWidths();
+    }
+}
+
+float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
+{
+    if (m_platformData.useGDI())
+       return widthForGDIGlyph(glyph);
+
+    CGFontRef font = m_platformData.cgFont();
+    float pointSize = m_platformData.size();
+    CGSize advance;
+    CGAffineTransform m = CGAffineTransformMakeScale(pointSize, pointSize);
+ 
+    // FIXME: Need to add real support for printer fonts.
+    bool isPrinterFont = false;
+    wkGetGlyphAdvances(font, m, m_isSystemFont, isPrinterFont, glyph, advance);
+
+    return advance.width + m_syntheticBoldOffset;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
new file mode 100644
index 0000000000..e845d852ff
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2008 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SimpleFontData.h"
+
+#include <windows.h>
+
+#include "Font.h"
+#include "FontCache.h"
+#include "FontDescription.h"
+#include <cairo.h>
+#include <cairo-win32.h>
+#include <mlang.h>
+#include <tchar.h>
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+void SimpleFontData::platformInit()
+{
+    m_scriptCache = 0;
+    m_scriptFontProperties = 0;
+    m_isSystemFont = false;
+
+    m_syntheticBoldOffset = m_platformData.syntheticBold() ? 1.0f : 0.f;
+
+    if (m_platformData.useGDI())
+       return initGDIFont();
+
+    HDC hdc = GetDC(0);
+    SaveDC(hdc);
+
+    cairo_scaled_font_t* scaledFont = m_platformData.scaledFont();
+    const double metricsMultiplier = cairo_win32_scaled_font_get_metrics_factor(scaledFont) * m_platformData.size();
+
+    cairo_win32_scaled_font_select_font(scaledFont, hdc);
+
+    TEXTMETRIC textMetrics;
+    GetTextMetrics(hdc, &textMetrics);
+    m_ascent = lroundf(textMetrics.tmAscent * metricsMultiplier);
+    m_descent = lroundf(textMetrics.tmDescent * metricsMultiplier);
+    m_xHeight = m_ascent * 0.56f; // Best guess for xHeight for non-Truetype fonts.
+    m_lineGap = lroundf(textMetrics.tmExternalLeading * metricsMultiplier);
+    m_lineSpacing = m_ascent + m_descent + m_lineGap;
+    m_avgCharWidth = lroundf(textMetrics.tmAveCharWidth * metricsMultiplier);
+    m_maxCharWidth = lroundf(textMetrics.tmMaxCharWidth * metricsMultiplier);
+
+    OUTLINETEXTMETRIC metrics;
+    if (GetOutlineTextMetrics(hdc, sizeof(metrics), &metrics) > 0) {
+        // This is a TrueType font.  We might be able to get an accurate xHeight
+        GLYPHMETRICS gm;
+        MAT2 mat = { 1, 0, 0, 1 };
+        DWORD len = GetGlyphOutline(hdc, 'x', GGO_METRICS, &gm, 0, 0, &mat);
+        if (len != GDI_ERROR && gm.gmptGlyphOrigin.y > 0)
+            m_xHeight = gm.gmptGlyphOrigin.y * metricsMultiplier;
+    }
+
+    cairo_win32_scaled_font_done_font(scaledFont);
+
+    m_isSystemFont = false;
+    m_scriptCache = 0;
+    m_scriptFontProperties = 0;
+
+    RestoreDC(hdc, -1);
+    ReleaseDC(0, hdc);
+}
+
+void SimpleFontData::platformCharWidthInit()
+{
+    // charwidths are set in platformInit.
+}
+
+float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
+{
+    if (m_platformData.useGDI())
+       return widthForGDIGlyph(glyph);
+
+    HDC hdc = GetDC(0);
+    SaveDC(hdc);
+
+    cairo_scaled_font_t* scaledFont = m_platformData.scaledFont();
+    cairo_win32_scaled_font_select_font(scaledFont, hdc);
+
+    int width;
+    GetCharWidthI(hdc, glyph, 1, 0, &width);
+
+    cairo_win32_scaled_font_done_font(scaledFont);
+
+    RestoreDC(hdc, -1);
+    ReleaseDC(0, hdc);
+
+    const double metricsMultiplier = cairo_win32_scaled_font_get_metrics_factor(scaledFont) * m_platformData.size();
+    return width * metricsMultiplier;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/SimpleFontDataWin.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/SimpleFontDataWin.cpp
new file mode 100644
index 0000000000..5a3244ce10
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/SimpleFontDataWin.cpp
@@ -0,0 +1,213 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SimpleFontData.h"
+
+#include <winsock2.h>
+#include "Font.h"
+#include "FontCache.h"
+#include "FloatRect.h"
+#include "FontDescription.h"
+#include <wtf/MathExtras.h>
+#include <unicode/uchar.h>
+#include <unicode/unorm.h>
+#include <mlang.h>
+#include <tchar.h>
+
+#if PLATFORM(CG)
+#include <ApplicationServices/ApplicationServices.h>
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#endif
+
+namespace WebCore {
+
+using std::max;
+
+const float cSmallCapsFontSizeMultiplier = 0.7f;
+
+static bool g_shouldApplyMacAscentHack;
+
+void SimpleFontData::setShouldApplyMacAscentHack(bool b)
+{
+    g_shouldApplyMacAscentHack = b;
+}
+
+bool SimpleFontData::shouldApplyMacAscentHack()
+{
+    return g_shouldApplyMacAscentHack;
+}
+
+void SimpleFontData::initGDIFont()
+{
+     HDC hdc = GetDC(0);
+     HGDIOBJ oldFont = SelectObject(hdc, m_platformData.hfont());
+     OUTLINETEXTMETRIC metrics;
+     GetOutlineTextMetrics(hdc, sizeof(metrics), &metrics);
+     TEXTMETRIC& textMetrics = metrics.otmTextMetrics;
+     m_ascent = textMetrics.tmAscent;
+     m_descent = textMetrics.tmDescent;
+     m_lineGap = textMetrics.tmExternalLeading;
+     m_lineSpacing = m_ascent + m_descent + m_lineGap;
+     m_avgCharWidth = textMetrics.tmAveCharWidth;
+     m_maxCharWidth = textMetrics.tmMaxCharWidth;
+     m_xHeight = m_ascent * 0.56f; // Best guess for xHeight if no x glyph is present.
+
+     GLYPHMETRICS gm;
+     MAT2 mat = { 1, 0, 0, 1 };
+     DWORD len = GetGlyphOutline(hdc, 'x', GGO_METRICS, &gm, 0, 0, &mat);
+     if (len != GDI_ERROR && gm.gmptGlyphOrigin.y > 0)
+         m_xHeight = gm.gmptGlyphOrigin.y;
+
+     m_unitsPerEm = metrics.otmEMSquare;
+
+     SelectObject(hdc, oldFont);
+     ReleaseDC(0, hdc);
+
+     return;
+}
+
+void SimpleFontData::platformDestroy()
+{
+    // We don't hash this on Win32, so it's effectively owned by us.
+    delete m_smallCapsFontData;
+    m_smallCapsFontData = 0;
+
+    ScriptFreeCache(&m_scriptCache);
+    delete m_scriptFontProperties;
+}
+
+SimpleFontData* SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
+{
+    if (!m_smallCapsFontData) {
+        float smallCapsHeight = cSmallCapsFontSizeMultiplier * m_platformData.size();
+        if (isCustomFont()) {
+            FontPlatformData smallCapsFontData(m_platformData);
+            smallCapsFontData.setSize(smallCapsHeight);
+            m_smallCapsFontData = new SimpleFontData(smallCapsFontData, true, false);
+        } else {
+            LOGFONT winfont;
+            GetObject(m_platformData.hfont(), sizeof(LOGFONT), &winfont);
+            winfont.lfHeight = -lroundf(smallCapsHeight * (m_platformData.useGDI() ? 1 : 32));
+            HFONT hfont = CreateFontIndirect(&winfont);
+            m_smallCapsFontData = new SimpleFontData(FontPlatformData(hfont, smallCapsHeight, m_platformData.syntheticBold(), m_platformData.syntheticOblique(), m_platformData.useGDI()));
+        }
+    }
+    return m_smallCapsFontData;
+}
+
+bool SimpleFontData::containsCharacters(const UChar* characters, int length) const
+{
+    // FIXME: Support custom fonts.
+    if (isCustomFont())
+        return false;
+
+    // FIXME: Microsoft documentation seems to imply that characters can be output using a given font and DC
+    // merely by testing code page intersection.  This seems suspect though.  Can't a font only partially
+    // cover a given code page?
+    IMLangFontLink2* langFontLink = fontCache()->getFontLinkInterface();
+    if (!langFontLink)
+        return false;
+
+    HDC dc = GetDC(0);
+    
+    DWORD acpCodePages;
+    langFontLink->CodePageToCodePages(CP_ACP, &acpCodePages);
+
+    DWORD fontCodePages;
+    langFontLink->GetFontCodePages(dc, m_platformData.hfont(), &fontCodePages);
+
+    DWORD actualCodePages;
+    long numCharactersProcessed;
+    long offset = 0;
+    while (offset < length) {
+        langFontLink->GetStrCodePages(characters, length, acpCodePages, &actualCodePages, &numCharactersProcessed);
+        if ((actualCodePages & fontCodePages) == 0)
+            return false;
+        offset += numCharactersProcessed;
+    }
+
+    ReleaseDC(0, dc);
+
+    return true;
+}
+
+void SimpleFontData::determinePitch()
+{
+    if (isCustomFont()) {
+        m_treatAsFixedPitch = false;
+        return;
+    }
+
+    // TEXTMETRICS have this.  Set m_treatAsFixedPitch based off that.
+    HDC dc = GetDC(0);
+    SaveDC(dc);
+    SelectObject(dc, m_platformData.hfont());
+
+    // Yes, this looks backwards, but the fixed pitch bit is actually set if the font
+    // is *not* fixed pitch.  Unbelievable but true.
+    TEXTMETRIC tm;
+    GetTextMetrics(dc, &tm);
+    m_treatAsFixedPitch = ((tm.tmPitchAndFamily & TMPF_FIXED_PITCH) == 0);
+
+    RestoreDC(dc, -1);
+    ReleaseDC(0, dc);
+}
+
+float SimpleFontData::widthForGDIGlyph(Glyph glyph) const
+{
+    HDC hdc = GetDC(0);
+    SetGraphicsMode(hdc, GM_ADVANCED);
+    HGDIOBJ oldFont = SelectObject(hdc, m_platformData.hfont());
+    int width;
+    GetCharWidthI(hdc, glyph, 1, 0, &width);
+    SelectObject(hdc, oldFont);
+    ReleaseDC(0, hdc);
+    return width + m_syntheticBoldOffset;
+}
+
+SCRIPT_FONTPROPERTIES* SimpleFontData::scriptFontProperties() const
+{
+    if (!m_scriptFontProperties) {
+        m_scriptFontProperties = new SCRIPT_FONTPROPERTIES;
+        memset(m_scriptFontProperties, 0, sizeof(SCRIPT_FONTPROPERTIES));
+        m_scriptFontProperties->cBytes = sizeof(SCRIPT_FONTPROPERTIES);
+        HRESULT result = ScriptGetFontProperties(0, scriptCache(), m_scriptFontProperties);
+        if (result == E_PENDING) {
+            HDC dc = GetDC(0);
+            SaveDC(dc);
+            SelectObject(dc, m_platformData.hfont());
+            ScriptGetFontProperties(dc, scriptCache(), m_scriptFontProperties);
+            RestoreDC(dc, -1);
+            ReleaseDC(0, dc);
+        }
+    }
+    return m_scriptFontProperties;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/editing/android/EditorAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/TransformationMatrixWin.cpp
index 8e003264ce..47806a271c 100644
--- a/src/3rdparty/webkit/WebCore/editing/android/EditorAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/TransformationMatrixWin.cpp
@@ -1,6 +1,5 @@
 /*
- * Copyright 2009, The Android Open Source Project
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,15 +24,23 @@
  */
 
 #include "config.h"
-#include "Editor.h"
+#include "TransformationMatrix.h"
 
-#include "ClipboardAndroid.h"
+#include <windows.h>
 
 namespace WebCore {
 
-PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
+TransformationMatrix::operator XFORM() const
 {
-    return new ClipboardAndroid(policy, false);
+    XFORM xform;
+    xform.eM11 = a();
+    xform.eM12 = b();
+    xform.eM21 = c();
+    xform.eM22 = d();
+    xform.eDx = e();
+    xform.eDy = f();
+
+    return xform;
 }
 
-} // namespace WebCore
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/UniscribeController.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/UniscribeController.cpp
new file mode 100644
index 0000000000..f382857715
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/UniscribeController.cpp
@@ -0,0 +1,441 @@
+/*
+ * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "UniscribeController.h"
+#include "Font.h"
+#include "SimpleFontData.h"
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+// FIXME: Rearchitect this to be more like WidthIterator in Font.cpp.  Have an advance() method
+// that does stuff in that method instead of doing everything in the constructor.  Have advance()
+// take the GlyphBuffer as an arg so that we don't have to populate the glyph buffer when
+// measuring.
+UniscribeController::UniscribeController(const Font* font, const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts)
+: m_font(*font)
+, m_run(run)
+, m_fallbackFonts(fallbackFonts)
+, m_end(run.length())
+, m_currentCharacter(0)
+, m_runWidthSoFar(0)
+, m_computingOffsetPosition(false)
+, m_includePartialGlyphs(false)
+, m_offsetX(0)
+, m_offsetPosition(0)
+{
+    m_padding = m_run.padding();
+    if (!m_padding)
+        m_padPerSpace = 0;
+    else {
+        float numSpaces = 0;
+        for (int s = 0; s < m_run.length(); s++)
+            if (Font::treatAsSpace(m_run[s]))
+                numSpaces++;
+
+        if (numSpaces == 0)
+            m_padPerSpace = 0;
+        else
+            m_padPerSpace = ceilf(m_run.padding() / numSpaces);
+    }
+
+    // Null out our uniscribe structs
+    resetControlAndState();
+}
+
+int UniscribeController::offsetForPosition(int x, bool includePartialGlyphs)
+{
+    m_computingOffsetPosition = true;
+    m_includePartialGlyphs = includePartialGlyphs;
+    m_offsetX = x;
+    m_offsetPosition = 0;
+    advance(m_run.length());
+    if (m_computingOffsetPosition) {
+        // The point is to the left or to the right of the entire run.
+        if (m_offsetX >= m_runWidthSoFar && m_run.ltr() || m_offsetX < 0 && m_run.rtl())
+            m_offsetPosition = m_end;
+    }
+    m_computingOffsetPosition = false;
+    return m_offsetPosition;
+}
+
+void UniscribeController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
+{
+    // FIXME: We really want to be using a newer version of Uniscribe that supports the new OpenType
+    // functions.  Those functions would allow us to turn off kerning and ligatures.  Without being able
+    // to do that, we will have buggy line breaking and metrics when simple and complex text are close
+    // together (the complex code path will narrow the text because of kerning and ligatures and then
+    // when bidi processing splits into multiple runs, the simple portions will get wider and cause us to
+    // spill off the edge of a line).
+    if (static_cast<int>(offset) > m_end)
+        offset = m_end;
+
+    // Itemize the string.
+    const UChar* cp = m_run.data(m_currentCharacter);
+    int length = offset - m_currentCharacter;
+    if (length <= 0)
+        return;
+
+    unsigned baseCharacter = m_currentCharacter;
+
+    // We break up itemization of the string by fontData and (if needed) the use of small caps.
+
+    // FIXME: It's inconsistent that we use logical order when itemizing, since this
+    // does not match normal RTL.
+
+    // FIXME: This function should decode surrogate pairs. Currently it makes little difference that
+    // it does not because the font cache on Windows does not support non-BMP characters.
+    Vector<UChar, 256> smallCapsBuffer;
+    if (m_font.isSmallCaps())
+        smallCapsBuffer.resize(length);
+
+    unsigned indexOfFontTransition = m_run.rtl() ? length - 1 : 0;
+    const UChar* curr = m_run.rtl() ? cp + length  - 1 : cp;
+    const UChar* end = m_run.rtl() ? cp - 1 : cp + length;
+
+    const SimpleFontData* fontData;
+    const SimpleFontData* nextFontData = m_font.glyphDataForCharacter(*curr, false).fontData;
+
+    UChar newC = 0;
+
+    bool isSmallCaps;
+    bool nextIsSmallCaps = m_font.isSmallCaps() && !(U_GET_GC_MASK(*curr) & U_GC_M_MASK) && (newC = u_toupper(*curr)) != *curr;
+
+    if (nextIsSmallCaps)
+        smallCapsBuffer[curr - cp] = newC;
+
+    while (true) {
+        curr = m_run.rtl() ? curr - 1 : curr + 1;
+        if (curr == end)
+            break;
+
+        fontData = nextFontData;
+        isSmallCaps = nextIsSmallCaps;
+        int index = curr - cp;
+        UChar c = *curr;
+
+        bool forceSmallCaps = isSmallCaps && (U_GET_GC_MASK(c) & U_GC_M_MASK);
+        nextFontData = m_font.glyphDataForCharacter(*curr, false, forceSmallCaps).fontData;
+        if (m_font.isSmallCaps()) {
+            nextIsSmallCaps = forceSmallCaps || (newC = u_toupper(c)) != c;
+            if (nextIsSmallCaps)
+                smallCapsBuffer[index] = forceSmallCaps ? c : newC;
+        }
+
+        if (m_fallbackFonts && nextFontData != fontData && fontData != m_font.primaryFont())
+            m_fallbackFonts->add(fontData);
+
+        if (nextFontData != fontData || nextIsSmallCaps != isSmallCaps) {
+            int itemStart = m_run.rtl() ? index + 1 : indexOfFontTransition;
+            int itemLength = m_run.rtl() ? indexOfFontTransition - index : index - indexOfFontTransition;
+            m_currentCharacter = baseCharacter + itemStart;
+            itemizeShapeAndPlace((isSmallCaps ? smallCapsBuffer.data() : cp) + itemStart, itemLength, fontData, glyphBuffer);
+            indexOfFontTransition = index;
+        }
+    }
+    
+    int itemLength = m_run.rtl() ? indexOfFontTransition + 1 : length - indexOfFontTransition;
+    if (itemLength) {
+        if (m_fallbackFonts && nextFontData != m_font.primaryFont())
+            m_fallbackFonts->add(nextFontData);
+
+        int itemStart = m_run.rtl() ? 0 : indexOfFontTransition;
+        m_currentCharacter = baseCharacter + itemStart;
+        itemizeShapeAndPlace((nextIsSmallCaps ? smallCapsBuffer.data() : cp) + itemStart, itemLength, nextFontData, glyphBuffer);
+    }
+
+    m_currentCharacter = baseCharacter + length;
+}
+
+void UniscribeController::itemizeShapeAndPlace(const UChar* cp, unsigned length, const SimpleFontData* fontData, GlyphBuffer* glyphBuffer)
+{
+    // ScriptItemize (in Windows XP versions prior to SP2) can overflow by 1.  This is why there is an extra empty item
+    // hanging out at the end of the array
+    m_items.resize(6);
+    int numItems = 0;
+    while (ScriptItemize(cp, length, m_items.size() - 1, &m_control, &m_state, m_items.data(), &numItems) == E_OUTOFMEMORY) {
+        m_items.resize(m_items.size() * 2);
+        resetControlAndState();
+    }
+    m_items.resize(numItems + 1);
+
+    if (m_run.rtl()) {
+        for (int i = m_items.size() - 2; i >= 0; i--) {
+            if (!shapeAndPlaceItem(cp, i, fontData, glyphBuffer))
+                return;
+        }
+    } else {
+        for (unsigned i = 0; i < m_items.size() - 1; i++) {
+            if (!shapeAndPlaceItem(cp, i, fontData, glyphBuffer))
+                return;
+        }
+    }
+}
+
+void UniscribeController::resetControlAndState()
+{
+    memset(&m_control, 0, sizeof(SCRIPT_CONTROL));
+    memset(&m_state, 0, sizeof(SCRIPT_STATE));
+
+    // Set up the correct direction for the run.
+    m_state.uBidiLevel = m_run.rtl();
+    
+    // Lock the correct directional override.
+    m_state.fOverrideDirection = m_run.directionalOverride();
+}
+
+bool UniscribeController::shapeAndPlaceItem(const UChar* cp, unsigned i, const SimpleFontData* fontData, GlyphBuffer* glyphBuffer)
+{
+    // Determine the string for this item.
+    const UChar* str = cp + m_items[i].iCharPos;
+    int len = m_items[i+1].iCharPos - m_items[i].iCharPos;
+    SCRIPT_ITEM item = m_items[i];
+
+    // Set up buffers to hold the results of shaping the item.
+    Vector<WORD> glyphs;
+    Vector<WORD> clusters;
+    Vector<SCRIPT_VISATTR> visualAttributes;
+    clusters.resize(len);
+     
+    // Shape the item.
+    // The recommended size for the glyph buffer is 1.5 * the character length + 16 in the uniscribe docs.
+    // Apparently this is a good size to avoid having to make repeated calls to ScriptShape.
+    glyphs.resize(1.5 * len + 16);
+    visualAttributes.resize(glyphs.size());
+
+    if (!shape(str, len, item, fontData, glyphs, clusters, visualAttributes))
+        return true;
+
+    // We now have a collection of glyphs.
+    Vector<GOFFSET> offsets;
+    Vector<int> advances;
+    offsets.resize(glyphs.size());
+    advances.resize(glyphs.size());
+    int glyphCount = 0;
+    HRESULT placeResult = ScriptPlace(0, fontData->scriptCache(), glyphs.data(), glyphs.size(), visualAttributes.data(),
+                                      &item.a, advances.data(), offsets.data(), 0);
+    if (placeResult == E_PENDING) {
+        // The script cache isn't primed with enough info yet.  We need to select our HFONT into
+        // a DC and pass the DC in to ScriptPlace.
+        HDC hdc = GetDC(0);
+        HFONT hfont = fontData->platformData().hfont();
+        HFONT oldFont = (HFONT)SelectObject(hdc, hfont);
+        placeResult = ScriptPlace(hdc, fontData->scriptCache(), glyphs.data(), glyphs.size(), visualAttributes.data(),
+                                  &item.a, advances.data(), offsets.data(), 0);
+        SelectObject(hdc, oldFont);
+        ReleaseDC(0, hdc);
+    }
+    
+    if (FAILED(placeResult) || glyphs.isEmpty())
+        return true;
+
+    // Convert all chars that should be treated as spaces to use the space glyph.
+    // We also create a map that allows us to quickly go from space glyphs or rounding
+    // hack glyphs back to their corresponding characters.
+    Vector<int> spaceCharacters(glyphs.size());
+    spaceCharacters.fill(-1);
+    Vector<int> roundingHackCharacters(glyphs.size());
+    roundingHackCharacters.fill(-1);
+    Vector<int> roundingHackWordBoundaries(glyphs.size());
+    roundingHackWordBoundaries.fill(-1);
+
+    const float cLogicalScale = fontData->platformData().useGDI() ? 1.0f : 32.0f;
+    unsigned logicalSpaceWidth = fontData->spaceWidth() * cLogicalScale;
+    float roundedSpaceWidth = roundf(fontData->spaceWidth());
+
+    for (int k = 0; k < len; k++) {
+        UChar ch = *(str + k);
+        if (Font::treatAsSpace(ch)) {
+            // Substitute in the space glyph at the appropriate place in the glyphs
+            // array.
+            glyphs[clusters[k]] = fontData->spaceGlyph();
+            advances[clusters[k]] = logicalSpaceWidth;
+            spaceCharacters[clusters[k]] = m_currentCharacter + k + item.iCharPos;
+        }
+
+        if (Font::isRoundingHackCharacter(ch))
+            roundingHackCharacters[clusters[k]] = m_currentCharacter + k + item.iCharPos;
+
+        int boundary = k + m_currentCharacter + item.iCharPos;
+        if (boundary < m_run.length() &&
+            Font::isRoundingHackCharacter(*(str + k + 1)))
+            roundingHackWordBoundaries[clusters[k]] = boundary;
+    }
+
+    // Populate our glyph buffer with this information.
+    bool hasExtraSpacing = m_font.letterSpacing() || m_font.wordSpacing() || m_padding;
+    
+    float leftEdge = m_runWidthSoFar;
+
+    for (unsigned k = 0; k < glyphs.size(); k++) {
+        Glyph glyph = glyphs[k];
+        float advance = advances[k] / cLogicalScale;
+        float offsetX = offsets[k].du / cLogicalScale;
+        float offsetY = offsets[k].dv / cLogicalScale;
+
+        // Match AppKit's rules for the integer vs. non-integer rendering modes.
+        float roundedAdvance = roundf(advance);
+        if (!m_font.isPrinterFont() && !fontData->isSystemFont()) {
+            advance = roundedAdvance;
+            offsetX = roundf(offsetX);
+            offsetY = roundf(offsetY);
+        }
+
+        advance += fontData->syntheticBoldOffset();
+
+        // We special case spaces in two ways when applying word rounding.
+        // First, we round spaces to an adjusted width in all fonts.
+        // Second, in fixed-pitch fonts we ensure that all glyphs that
+        // match the width of the space glyph have the same width as the space glyph.
+        if (roundedAdvance == roundedSpaceWidth && (fontData->pitch() == FixedPitch || glyph == fontData->spaceGlyph()) &&
+            m_run.applyWordRounding())
+            advance = fontData->adjustedSpaceWidth();
+
+        if (hasExtraSpacing) {
+            // If we're a glyph with an advance, go ahead and add in letter-spacing.
+            // That way we weed out zero width lurkers.  This behavior matches the fast text code path.
+            if (advance && m_font.letterSpacing())
+                advance += m_font.letterSpacing();
+
+            // Handle justification and word-spacing.
+            if (glyph == fontData->spaceGlyph()) {
+                // Account for padding. WebCore uses space padding to justify text.
+                // We distribute the specified padding over the available spaces in the run.
+                if (m_padding) {
+                    // Use leftover padding if not evenly divisible by number of spaces.
+                    if (m_padding < m_padPerSpace) {
+                        advance += m_padding;
+                        m_padding = 0;
+                    } else {
+                        advance += m_padPerSpace;
+                        m_padding -= m_padPerSpace;
+                    }
+                }
+
+                // Account for word-spacing.
+                int characterIndex = spaceCharacters[k];
+                if (characterIndex > 0 && !Font::treatAsSpace(*m_run.data(characterIndex - 1)) && m_font.wordSpacing())
+                    advance += m_font.wordSpacing();
+            }
+        }
+
+        // Deal with the float/integer impedance mismatch between CG and WebCore. "Words" (characters 
+        // followed by a character defined by isRoundingHackCharacter()) are always an integer width.
+        // We adjust the width of the last character of a "word" to ensure an integer width.
+        // Force characters that are used to determine word boundaries for the rounding hack
+        // to be integer width, so the following words will start on an integer boundary.
+        int roundingHackIndex = roundingHackCharacters[k];
+        if (m_run.applyWordRounding() && roundingHackIndex != -1)
+            advance = ceilf(advance);
+
+        // Check to see if the next character is a "rounding hack character", if so, adjust the
+        // width so that the total run width will be on an integer boundary.
+        int position = m_currentCharacter + len;
+        bool lastGlyph = (k == glyphs.size() - 1) && (m_run.rtl() ? i == 0 : i == m_items.size() - 2) && (position >= m_end);
+        if ((m_run.applyWordRounding() && roundingHackWordBoundaries[k] != -1) ||
+            (m_run.applyRunRounding() && lastGlyph)) { 
+            float totalWidth = m_runWidthSoFar + advance;
+            advance += ceilf(totalWidth) - totalWidth;
+        }
+
+        m_runWidthSoFar += advance;
+
+        // FIXME: We need to take the GOFFSETS for combining glyphs and store them in the glyph buffer
+        // as well, so that when the time comes to draw those glyphs, we can apply the appropriate
+        // translation.
+        if (glyphBuffer) {
+            FloatSize size(offsetX, -offsetY);
+            glyphBuffer->add(glyph, fontData, advance, &size);
+        }
+
+        // Mutate the glyph array to contain our altered advances.
+        if (m_computingOffsetPosition)
+            advances[k] = advance;
+    }
+
+    while (m_computingOffsetPosition && m_offsetX >= leftEdge && m_offsetX < m_runWidthSoFar) {
+        // The position is somewhere inside this run.
+        int trailing = 0;
+        ScriptXtoCP(m_offsetX - leftEdge, clusters.size(), glyphs.size(), clusters.data(), visualAttributes.data(),
+                    advances.data(), &item.a, &m_offsetPosition, &trailing);
+        if (trailing && m_includePartialGlyphs && m_offsetPosition < len - 1) {
+            m_offsetPosition += m_currentCharacter + m_items[i].iCharPos;
+            m_offsetX += m_run.rtl() ? -trailing : trailing;
+        } else {
+            m_computingOffsetPosition = false;
+            m_offsetPosition += m_currentCharacter + m_items[i].iCharPos;
+            if (trailing && m_includePartialGlyphs)
+               m_offsetPosition++;
+            return false;
+        }
+    }
+
+    return true;
+}
+
+bool UniscribeController::shape(const UChar* str, int len, SCRIPT_ITEM item, const SimpleFontData* fontData,
+                                Vector<WORD>& glyphs, Vector<WORD>& clusters,
+                                Vector<SCRIPT_VISATTR>& visualAttributes)
+{
+    HDC hdc = 0;
+    HFONT oldFont = 0;
+    HRESULT shapeResult = E_PENDING;
+    int glyphCount = 0;
+    do {
+        shapeResult = ScriptShape(hdc, fontData->scriptCache(), str, len, glyphs.size(), &item.a,
+                                  glyphs.data(), clusters.data(), visualAttributes.data(), &glyphCount);
+        if (shapeResult == E_PENDING) {
+            // The script cache isn't primed with enough info yet.  We need to select our HFONT into
+            // a DC and pass the DC in to ScriptShape.
+            ASSERT(!hdc);
+            hdc = GetDC(0);
+            HFONT hfont = fontData->platformData().hfont();
+            oldFont = (HFONT)SelectObject(hdc, hfont);
+        } else if (shapeResult == E_OUTOFMEMORY) {
+            // Need to resize our buffers.
+            glyphs.resize(glyphs.size() * 2);
+            visualAttributes.resize(glyphs.size());
+        }
+    } while (shapeResult == E_PENDING || shapeResult == E_OUTOFMEMORY);
+
+    if (hdc) {
+        SelectObject(hdc, oldFont);
+        ReleaseDC(0, hdc);
+    }
+
+    if (FAILED(shapeResult))
+        return false;
+
+    glyphs.shrink(glyphCount);
+    visualAttributes.shrink(glyphCount);
+
+    return true;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/UniscribeController.h b/src/3rdparty/webkit/WebCore/platform/graphics/win/UniscribeController.h
new file mode 100644
index 0000000000..23b8108b11
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/UniscribeController.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef UniscribeController_h
+#define UniscribeController_h
+
+#include <usp10.h>
+#include "Font.h"
+#include "GlyphBuffer.h"
+#include "Vector.h"
+
+namespace WebCore {
+
+class UniscribeController {
+public:
+    UniscribeController(const Font*, const TextRun&, HashSet<const SimpleFontData*>* fallbackFonts = 0);
+
+    // Advance and measure/place up to the specified character.
+    void advance(unsigned to, GlyphBuffer* = 0);
+
+    // Compute the character offset for a given x coordinate.
+    int offsetForPosition(int x, bool includePartialGlyphs);
+
+    // Returns the width of everything we've consumed so far.
+    float runWidthSoFar() const { return m_runWidthSoFar; }
+
+private:    
+    void resetControlAndState();
+
+    void itemizeShapeAndPlace(const UChar*, unsigned length, const SimpleFontData*, GlyphBuffer*);
+    bool shapeAndPlaceItem(const UChar*, unsigned index, const SimpleFontData*, GlyphBuffer*);
+    bool shape(const UChar* str, int len, SCRIPT_ITEM item, const SimpleFontData* fontData,
+               Vector<WORD>& glyphs, Vector<WORD>& clusters,
+               Vector<SCRIPT_VISATTR>& visualAttributes);
+
+    const Font& m_font;
+    const TextRun& m_run;
+    HashSet<const SimpleFontData*>* m_fallbackFonts;
+
+    SCRIPT_CONTROL m_control;
+    SCRIPT_STATE m_state;
+    Vector<SCRIPT_ITEM> m_items;
+ 
+    unsigned m_currentCharacter;
+    int m_end;
+
+    float m_runWidthSoFar;
+    float m_padding;
+    float m_padPerSpace;
+
+    bool m_computingOffsetPosition;
+    bool m_includePartialGlyphs;
+    float m_offsetX;
+    int m_offsetPosition;
+};
+
+}
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFContextFlusher.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFContextFlusher.cpp
new file mode 100644
index 0000000000..e97b530581
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFContextFlusher.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "WKCACFContextFlusher.h"
+
+#include <wtf/StdLibExtras.h>
+#include <QuartzCore/CACFContext.h>
+
+namespace WebCore {
+
+WKCACFContextFlusher& WKCACFContextFlusher::shared()
+{
+    DEFINE_STATIC_LOCAL(WKCACFContextFlusher, flusher, ());
+    return flusher;
+}
+
+WKCACFContextFlusher::WKCACFContextFlusher()
+{
+}
+
+WKCACFContextFlusher::~WKCACFContextFlusher()
+{
+}
+
+void WKCACFContextFlusher::addContext(CACFContextRef context)
+{
+    ASSERT(context);
+
+    m_contexts.add(context);
+    CFRetain(context);
+}
+
+void WKCACFContextFlusher::removeContext(CACFContextRef context)
+{
+    ASSERT(context);
+
+    ContextSet::iterator found = m_contexts.find(context);
+    if (found == m_contexts.end())
+        return;
+
+    CFRelease(*found);
+    m_contexts.remove(found);
+}
+
+void WKCACFContextFlusher::flushAllContexts()
+{
+    // addContext might get called beneath CACFContextFlush, and we don't want m_contexts to change while
+    // we're iterating over it, so we move the contexts into a local ContextSet and iterate over that instead.
+    ContextSet contextsToFlush;
+    contextsToFlush.swap(m_contexts);
+
+    ContextSet::const_iterator end = contextsToFlush.end();
+    for (ContextSet::const_iterator it = contextsToFlush.begin(); it != end; ++it) {
+        CACFContextRef context = *it;
+        CACFContextFlush(context);
+        CFRelease(context);
+    }
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFContextFlusher.h b/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFContextFlusher.h
new file mode 100644
index 0000000000..9ce76aa42c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFContextFlusher.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WKCACFContextFlusher_h
+#define WKCACFContextFlusher_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include <wtf/Noncopyable.h>
+
+#include <wtf/HashSet.h>
+
+typedef struct _CACFContext* CACFContextRef;
+
+namespace WebCore {
+
+class WKCACFContextFlusher : public Noncopyable {
+public:
+    static WKCACFContextFlusher& shared();
+
+    void addContext(CACFContextRef);
+    void removeContext(CACFContextRef);
+
+    void flushAllContexts();
+
+private:
+    WKCACFContextFlusher();
+    ~WKCACFContextFlusher();
+
+    typedef HashSet<CACFContextRef> ContextSet;
+    ContextSet m_contexts;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // WKCACFContextFlusher_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFLayer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFLayer.cpp
new file mode 100644
index 0000000000..39235986e0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFLayer.cpp
@@ -0,0 +1,557 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "WKCACFLayer.h"
+
+#include "CString.h"
+#include "WKCACFContextFlusher.h"
+#include "WKCACFLayerRenderer.h"
+
+#include <stdio.h>
+#include <QuartzCore/CACFContext.h>
+#include <QuartzCore/CARender.h>
+#include <QuartzCoreInterface/QuartzCoreInterface.h>
+
+#ifndef NDEBUG
+#include <wtf/CurrentTime.h>
+#endif
+
+#ifdef DEBUG_ALL
+#pragma comment(lib, "QuartzCore_debug")
+#pragma comment(lib, "QuartzCoreInterface_debug")
+#else
+#pragma comment(lib, "QuartzCore")
+#pragma comment(lib, "QuartzCoreInterface")
+#endif
+
+namespace WebCore {
+
+using namespace std;
+
+static void displayCallback(CACFLayerRef layer, CGContextRef context)
+{
+    ASSERT_ARG(layer, WKCACFLayer::layer(layer));
+    WKCACFLayer::layer(layer)->drawInContext(context);
+}
+
+#define STATIC_CACF_STRING(name) \
+    static CFStringRef name() \
+    { \
+        static CFStringRef name = wkqcCFStringRef(wkqc##name); \
+        return name; \
+    }
+
+STATIC_CACF_STRING(kCACFLayer)
+STATIC_CACF_STRING(kCACFTransformLayer)
+STATIC_CACF_STRING(kCACFGravityCenter)
+STATIC_CACF_STRING(kCACFGravityTop)
+STATIC_CACF_STRING(kCACFGravityBottom)
+STATIC_CACF_STRING(kCACFGravityLeft)
+STATIC_CACF_STRING(kCACFGravityRight)
+STATIC_CACF_STRING(kCACFGravityTopLeft)
+STATIC_CACF_STRING(kCACFGravityTopRight)
+STATIC_CACF_STRING(kCACFGravityBottomLeft)
+STATIC_CACF_STRING(kCACFGravityBottomRight)
+STATIC_CACF_STRING(kCACFGravityResize)
+STATIC_CACF_STRING(kCACFGravityResizeAspect)
+STATIC_CACF_STRING(kCACFGravityResizeAspectFill)
+STATIC_CACF_STRING(kCACFFilterLinear)
+STATIC_CACF_STRING(kCACFFilterNearest)
+STATIC_CACF_STRING(kCACFFilterTrilinear)
+STATIC_CACF_STRING(kCACFFilterLanczos)
+
+static CFStringRef toCACFLayerType(WKCACFLayer::LayerType type)
+{
+    switch (type) {
+    case WKCACFLayer::Layer: return kCACFLayer();
+    case WKCACFLayer::TransformLayer: return kCACFTransformLayer();
+    default: return 0;
+    }
+}
+
+static CFStringRef toCACFContentsGravityType(WKCACFLayer::ContentsGravityType type)
+{
+    switch (type) {
+    case WKCACFLayer::Center: return kCACFGravityCenter();
+    case WKCACFLayer::Top: return kCACFGravityTop();
+    case WKCACFLayer::Bottom: return kCACFGravityBottom();
+    case WKCACFLayer::Left: return kCACFGravityLeft();
+    case WKCACFLayer::Right: return kCACFGravityRight();
+    case WKCACFLayer::TopLeft: return kCACFGravityTopLeft();
+    case WKCACFLayer::TopRight: return kCACFGravityTopRight();
+    case WKCACFLayer::BottomLeft: return kCACFGravityBottomLeft();
+    case WKCACFLayer::BottomRight: return kCACFGravityBottomRight();
+    case WKCACFLayer::Resize: return kCACFGravityResize();
+    case WKCACFLayer::ResizeAspect: return kCACFGravityResizeAspect();
+    case WKCACFLayer::ResizeAspectFill: return kCACFGravityResizeAspectFill();
+    default: return 0;
+    }
+}
+
+static WKCACFLayer::ContentsGravityType fromCACFContentsGravityType(CFStringRef string)
+{
+    if (CFEqual(string, kCACFGravityTop()))
+        return WKCACFLayer::Top;
+
+    if (CFEqual(string, kCACFGravityBottom()))
+        return WKCACFLayer::Bottom;
+
+    if (CFEqual(string, kCACFGravityLeft()))
+        return WKCACFLayer::Left;
+
+    if (CFEqual(string, kCACFGravityRight()))
+        return WKCACFLayer::Right;
+
+    if (CFEqual(string, kCACFGravityTopLeft()))
+        return WKCACFLayer::TopLeft;
+
+    if (CFEqual(string, kCACFGravityTopRight()))
+        return WKCACFLayer::TopRight;
+
+    if (CFEqual(string, kCACFGravityBottomLeft()))
+        return WKCACFLayer::BottomLeft;
+
+    if (CFEqual(string, kCACFGravityBottomRight()))
+        return WKCACFLayer::BottomRight;
+
+    if (CFEqual(string, kCACFGravityResize()))
+        return WKCACFLayer::Resize;
+
+    if (CFEqual(string, kCACFGravityResizeAspect()))
+        return WKCACFLayer::ResizeAspect;
+
+    if (CFEqual(string, kCACFGravityResizeAspectFill()))
+        return WKCACFLayer::ResizeAspectFill;
+
+    return WKCACFLayer::Center;
+}
+
+static CFStringRef toCACFFilterType(WKCACFLayer::FilterType type)
+{
+    switch (type) {
+    case WKCACFLayer::Linear: return kCACFFilterLinear();
+    case WKCACFLayer::Nearest: return kCACFFilterNearest();
+    case WKCACFLayer::Trilinear: return kCACFFilterTrilinear();
+    case WKCACFLayer::Lanczos: return kCACFFilterLanczos();
+    default: return 0;
+    }
+}
+
+static WKCACFLayer::FilterType fromCACFFilterType(CFStringRef string)
+{
+    if (CFEqual(string, kCACFFilterNearest()))
+        return WKCACFLayer::Nearest;
+
+    if (CFEqual(string, kCACFFilterTrilinear()))
+        return WKCACFLayer::Trilinear;
+
+    if (CFEqual(string, kCACFFilterLanczos()))
+        return WKCACFLayer::Lanczos;
+
+    return WKCACFLayer::Linear;
+}
+
+PassRefPtr<WKCACFLayer> WKCACFLayer::create(LayerType type)
+{
+    if (!WKCACFLayerRenderer::acceleratedCompositingAvailable())
+        return 0;
+    return adoptRef(new WKCACFLayer(type));
+}
+
+// FIXME: It might be good to have a way of ensuring that all WKCACFLayers eventually
+// get destroyed in debug builds. A static counter could accomplish this pretty easily.
+
+WKCACFLayer::WKCACFLayer(LayerType type)
+    : m_layer(AdoptCF, CACFLayerCreate(toCACFLayerType(type)))
+    , m_needsDisplayOnBoundsChange(false)
+{
+    CACFLayerSetUserData(layer(), this);
+    CACFLayerSetDisplayCallback(layer(), displayCallback);
+}
+
+WKCACFLayer::~WKCACFLayer()
+{
+    // Our superlayer should be holding a reference to us, so there should be no way for us to be destroyed while we still have a superlayer.
+    ASSERT(!superlayer());
+
+    CACFLayerSetUserData(layer(), 0);
+    CACFLayerSetDisplayCallback(layer(), 0);
+}
+
+void WKCACFLayer::becomeRootLayerForContext(CACFContextRef context)
+{
+    CACFContextSetLayer(context, layer());
+    setNeedsCommit();
+}
+
+void WKCACFLayer::setNeedsCommit()
+{
+    WKCACFLayer* root = rootLayer();
+
+    CACFContextRef context = CACFLayerGetContext(root->layer());
+
+    // The context might now be set yet. This happens if a property gets set
+    // before placing the layer in the tree. In this case we don't need to 
+    // worry about remembering the context because we will when the layer is
+    // added to the tree.
+    if (context)
+        WKCACFContextFlusher::shared().addContext(context);
+
+    // Call setNeedsRender on the root layer, which will cause a render to 
+    // happen in WKCACFLayerRenderer
+    root->setNeedsRender();
+}
+
+bool WKCACFLayer::isTransformLayer() const
+{
+    return CACFLayerGetClass(layer()) == kCACFTransformLayer();
+}
+
+void WKCACFLayer::addSublayer(PassRefPtr<WKCACFLayer> sublayer)
+{
+    insertSublayer(sublayer, numSublayers());
+}
+
+void WKCACFLayer::insertSublayer(PassRefPtr<WKCACFLayer> sublayer, size_t index)
+{
+    index = min(index, numSublayers());
+    sublayer->removeFromSuperlayer();
+    CACFLayerInsertSublayer(layer(), sublayer->layer(), index);
+    setNeedsCommit();
+}
+
+void WKCACFLayer::insertSublayerAboveLayer(PassRefPtr<WKCACFLayer> sublayer, const WKCACFLayer* reference)
+{
+    if (!reference) {
+        insertSublayer(sublayer, 0);
+        return;
+    }
+
+    int referenceIndex = indexOfSublayer(reference);
+    if (referenceIndex == -1) {
+        addSublayer(sublayer);
+        return;
+    }
+
+    insertSublayer(sublayer, referenceIndex + 1);
+}
+
+void WKCACFLayer::insertSublayerBelowLayer(PassRefPtr<WKCACFLayer> sublayer, const WKCACFLayer* reference)
+{
+    if (!reference) {
+        insertSublayer(sublayer, 0);
+        return;
+    }
+
+    int referenceIndex = indexOfSublayer(reference);
+    if (referenceIndex == -1) {
+        addSublayer(sublayer);
+        return;
+    }
+
+    insertSublayer(sublayer, referenceIndex);
+}
+
+void WKCACFLayer::replaceSublayer(WKCACFLayer* reference, PassRefPtr<WKCACFLayer> newLayer)
+{
+    ASSERT_ARG(reference, reference);
+    ASSERT_ARG(reference, reference->superlayer() == this);
+
+    if (reference == newLayer)
+        return;
+
+    int referenceIndex = indexOfSublayer(reference);
+    ASSERT(referenceIndex != -1);
+    if (referenceIndex == -1)
+        return;
+
+    reference->removeFromSuperlayer();
+
+    if (newLayer) {
+        newLayer->removeFromSuperlayer();
+        insertSublayer(newLayer, referenceIndex);
+    }
+}
+
+void WKCACFLayer::removeFromSuperlayer()
+{
+    WKCACFLayer* superlayer = this->superlayer();
+    if (!superlayer)
+        return;
+
+    CACFLayerRemoveFromSuperlayer(layer());
+    superlayer->setNeedsCommit();
+}
+
+const WKCACFLayer* WKCACFLayer::sublayerAtIndex(int index) const
+{
+    CFArrayRef sublayers = CACFLayerGetSublayers(layer());
+    if (index < 0 || CFArrayGetCount(sublayers) <= index)
+        return 0;
+    
+    return layer(static_cast<CACFLayerRef>(const_cast<void*>(CFArrayGetValueAtIndex(sublayers, index))));
+}
+
+int WKCACFLayer::indexOfSublayer(const WKCACFLayer* reference)
+{
+    CACFLayerRef ref = reference->layer();
+    if (!ref)
+        return -1;
+
+    CFArrayRef sublayers = CACFLayerGetSublayers(layer());
+    size_t n = CFArrayGetCount(sublayers);
+
+    for (size_t i = 0; i < n; ++i)
+        if (CFArrayGetValueAtIndex(sublayers, i) == ref)
+            return i;
+
+    return -1;
+}
+
+WKCACFLayer* WKCACFLayer::ancestorOrSelfWithSuperlayer(WKCACFLayer* superlayer) const
+{
+    WKCACFLayer* layer = const_cast<WKCACFLayer*>(this);
+    for (WKCACFLayer* ancestor = this->superlayer(); ancestor; layer = ancestor, ancestor = ancestor->superlayer()) {
+        if (ancestor == superlayer)
+            return layer;
+    }
+    return 0;
+}
+
+void WKCACFLayer::setBounds(const CGRect& rect)
+{
+    if (CGRectEqualToRect(rect, bounds()))
+        return;
+
+    CACFLayerSetBounds(layer(), rect);
+    setNeedsCommit();
+
+    if (m_needsDisplayOnBoundsChange)
+        setNeedsDisplay();
+}
+
+void WKCACFLayer::setFrame(const CGRect& rect)
+{
+    CGRect oldFrame = frame();
+    if (CGRectEqualToRect(rect, oldFrame))
+        return;
+
+    CACFLayerSetFrame(layer(), rect);
+    setNeedsCommit();
+
+    if (m_needsDisplayOnBoundsChange)
+        setNeedsDisplay();
+}
+
+void WKCACFLayer::setContentsGravity(ContentsGravityType type)
+{
+    CACFLayerSetContentsGravity(layer(), toCACFContentsGravityType(type));
+    setNeedsCommit();
+}
+
+WKCACFLayer::ContentsGravityType WKCACFLayer::contentsGravity() const
+{
+    return fromCACFContentsGravityType(CACFLayerGetContentsGravity(layer()));
+}
+
+void WKCACFLayer::setMagnificationFilter(FilterType type)
+{
+    CACFLayerSetMagnificationFilter(layer(), toCACFFilterType(type));
+    setNeedsCommit();
+}
+
+WKCACFLayer::FilterType WKCACFLayer::magnificationFilter() const
+{
+    return fromCACFFilterType(CACFLayerGetMagnificationFilter(layer()));
+}
+
+void WKCACFLayer::setMinificationFilter(FilterType type)
+{
+    CACFLayerSetMinificationFilter(layer(), toCACFFilterType(type));
+    setNeedsCommit();
+}
+
+WKCACFLayer::FilterType WKCACFLayer::minificationFilter() const
+{
+    return fromCACFFilterType(CACFLayerGetMinificationFilter(layer()));
+}
+
+WKCACFLayer* WKCACFLayer::rootLayer() const
+{
+    WKCACFLayer* layer = const_cast<WKCACFLayer*>(this);
+    for (WKCACFLayer* superlayer = layer->superlayer(); superlayer; layer = superlayer, superlayer = superlayer->superlayer()) { }
+    return layer;
+}
+
+void WKCACFLayer::removeAllSublayers()
+{
+    CACFLayerSetSublayers(layer(), 0);
+    setNeedsCommit();
+}
+
+void WKCACFLayer::setSublayers(const Vector<RefPtr<WKCACFLayer> >& sublayers)
+{
+    // Remove all the current sublayers and add the passed layers
+    CACFLayerSetSublayers(layer(), 0);
+
+    // Perform removeFromSuperLayer in a separate pass. CACF requires superlayer to
+    // be null or CACFLayerInsertSublayer silently fails.
+    for (size_t i = 0; i < sublayers.size(); i++)
+        CACFLayerRemoveFromSuperlayer(sublayers[i]->layer());
+
+    for (size_t i = 0; i < sublayers.size(); i++)
+        CACFLayerInsertSublayer(layer(), sublayers[i]->layer(), i);
+
+    setNeedsCommit();
+}
+
+WKCACFLayer* WKCACFLayer::superlayer() const
+{
+    CACFLayerRef super = CACFLayerGetSuperlayer(layer());
+    if (!super)
+        return 0;
+    return WKCACFLayer::layer(super);
+}
+
+void WKCACFLayer::setNeedsDisplay(const CGRect* dirtyRect)
+{
+    CACFLayerSetNeedsDisplay(layer(), dirtyRect);
+    setNeedsCommit();
+}
+
+void WKCACFLayer::setNeedsDisplay()
+{
+    setNeedsDisplay(0);
+}
+
+#ifndef NDEBUG
+static void printIndent(int indent)
+{
+    for ( ; indent > 0; --indent)
+        fprintf(stderr, "  ");
+}
+
+static void printTransform(const CATransform3D& transform)
+{
+    fprintf(stderr, "[%g %g %g %g; %g %g %g %g; %g %g %g %g; %g %g %g %g]",
+                    transform.m11, transform.m12, transform.m13, transform.m14, 
+                    transform.m21, transform.m22, transform.m23, transform.m24, 
+                    transform.m31, transform.m32, transform.m33, transform.m34, 
+                    transform.m41, transform.m42, transform.m43, transform.m44);
+}
+
+void WKCACFLayer::printTree() const
+{
+    // Print heading info
+    CGRect rootBounds = bounds();
+    fprintf(stderr, "\n\n** Render tree at time %g (bounds %g, %g %gx%g) **\n\n", 
+        currentTime(), rootBounds.origin.x, rootBounds.origin.y, rootBounds.size.width, rootBounds.size.height);
+
+    // Print layer tree from the root
+    printLayer(0);
+}
+
+void WKCACFLayer::printLayer(int indent) const
+{
+    CGPoint layerPosition = position();
+    CGPoint layerAnchorPoint = anchorPoint();
+    CGRect layerBounds = bounds();
+    printIndent(indent);
+    fprintf(stderr, "(%s [%g %g %g] [%g %g %g %g] [%g %g %g] superlayer=%p\n",
+        isTransformLayer() ? "transform-layer" : "layer",
+        layerPosition.x, layerPosition.y, zPosition(), 
+        layerBounds.origin.x, layerBounds.origin.y, layerBounds.size.width, layerBounds.size.height,
+        layerAnchorPoint.x, layerAnchorPoint.y, anchorPointZ(), superlayer());
+
+    // Print name if needed
+    String layerName = name();
+    if (!layerName.isEmpty()) {
+        printIndent(indent + 1);
+        fprintf(stderr, "(name %s)\n", layerName.utf8().data());
+    }
+
+    // Print masksToBounds if needed
+    bool layerMasksToBounds = masksToBounds();
+    if (layerMasksToBounds) {
+        printIndent(indent + 1);
+        fprintf(stderr, "(masksToBounds true)\n");
+    }
+
+    // Print opacity if needed
+    float layerOpacity = opacity();
+    if (layerOpacity != 1) {
+        printIndent(indent + 1);
+        fprintf(stderr, "(opacity %hf)\n", layerOpacity);
+    }
+
+    // Print sublayerTransform if needed
+    CATransform3D layerTransform = sublayerTransform();
+    if (!CATransform3DIsIdentity(layerTransform)) {
+        printIndent(indent + 1);
+        fprintf(stderr, "(sublayerTransform ");
+        printTransform(layerTransform);
+        fprintf(stderr, ")\n");
+    }
+
+    // Print transform if needed
+    layerTransform = transform();
+    if (!CATransform3DIsIdentity(layerTransform)) {
+        printIndent(indent + 1);
+        fprintf(stderr, "(transform ");
+        printTransform(layerTransform);
+        fprintf(stderr, ")\n");
+    }
+
+    // Print contents if needed
+    CGImageRef layerContents = contents();
+    if (layerContents) {
+        printIndent(indent + 1);
+        fprintf(stderr, "(contents (image [%d %d]))\n",
+            CGImageGetWidth(layerContents), CGImageGetHeight(layerContents));
+    }
+
+    // Print sublayers if needed
+    int n = numSublayers();
+    if (n > 0) {
+        printIndent(indent + 1);
+        fprintf(stderr, "(sublayers\n");
+        for (int i = 0; i < n; ++i)
+            sublayerAtIndex(i)->printLayer(indent + 2);
+
+        printIndent(indent + 1);
+        fprintf(stderr, ")\n");
+    }
+
+    printIndent(indent);
+    fprintf(stderr, ")\n");
+}
+#endif // #ifndef NDEBUG
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFLayer.h b/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFLayer.h
new file mode 100644
index 0000000000..f1b2613e6b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFLayer.h
@@ -0,0 +1,264 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WKCACFLayer_h
+#define WKCACFLayer_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "StringHash.h"
+
+#include <wtf/RefCounted.h>
+
+#include <QuartzCore/CACFLayer.h>
+#include <QuartzCore/CACFVector.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/Vector.h>
+
+#include "GraphicsContext.h"
+#include "PlatformString.h"
+#include "TransformationMatrix.h"
+
+namespace WebCore {
+
+class WKCACFAnimation;
+class WKCACFTimingFunction;
+
+class WKCACFLayer : public RefCounted<WKCACFLayer> {
+public:
+    enum LayerType { Layer, TransformLayer };
+    enum FilterType { Linear, Nearest, Trilinear, Lanczos };
+    enum ContentsGravityType { Center, Top, Bottom, Left, Right, TopLeft, TopRight, 
+                               BottomLeft, BottomRight, Resize, ResizeAspect, ResizeAspectFill };
+
+    static PassRefPtr<WKCACFLayer> create(LayerType);
+    static WKCACFLayer* layer(CACFLayerRef layer) { return static_cast<WKCACFLayer*>(CACFLayerGetUserData(layer)); }
+
+    virtual ~WKCACFLayer();
+
+    virtual void setNeedsRender() { }
+    virtual void drawInContext(PlatformGraphicsContext*) { }
+    virtual void setNeedsDisplay(const CGRect* dirtyRect);
+    void setNeedsDisplay();
+
+    // Makes this layer the root when the passed context is rendered
+    void becomeRootLayerForContext(CACFContextRef);
+
+    static RetainPtr<CFTypeRef> cfValue(float value) { return RetainPtr<CFTypeRef>(AdoptCF, CFNumberCreate(0, kCFNumberFloat32Type, &value)); }
+    static RetainPtr<CFTypeRef> cfValue(const TransformationMatrix& value)
+    {
+        CATransform3D t;
+        t.m11 = value.m11();
+        t.m12 = value.m12();
+        t.m13 = value.m13();
+        t.m14 = value.m14(); 
+        t.m21 = value.m21();
+        t.m22 = value.m22();
+        t.m23 = value.m23();
+        t.m24 = value.m24(); 
+        t.m31 = value.m31();
+        t.m32 = value.m32();
+        t.m33 = value.m33();
+        t.m34 = value.m34(); 
+        t.m41 = value.m41();
+        t.m42 = value.m42();
+        t.m43 = value.m43();
+        t.m44 = value.m44(); 
+        return RetainPtr<CFTypeRef>(AdoptCF, CACFVectorCreateTransform(t));
+    }
+    static RetainPtr<CFTypeRef> cfValue(const FloatPoint& value)
+    {
+        CGPoint p;
+        p.x = value.x(); p.y = value.y();
+        return RetainPtr<CFTypeRef>(AdoptCF, CACFVectorCreatePoint(p));
+    }
+    static RetainPtr<CFTypeRef> cfValue(const FloatRect& rect)
+    {
+        CGRect r;
+        r.origin.x = rect.x();
+        r.origin.y = rect.y();
+        r.size.width = rect.width();
+        r.size.height = rect.height();
+        CGFloat v[4] = { CGRectGetMinX(r), CGRectGetMinY(r), CGRectGetMaxX(r), CGRectGetMaxY(r) };
+        return RetainPtr<CFTypeRef>(AdoptCF, CACFVectorCreate(4, v));
+    }
+    static RetainPtr<CFTypeRef> cfValue(const Color& color)
+    {
+        return RetainPtr<CFTypeRef>(AdoptCF, CGColorCreateGenericRGB(color.red(), color.green(), color.blue(), color.alpha()));
+    }
+
+    bool isTransformLayer() const;
+
+    void addSublayer(PassRefPtr<WKCACFLayer> sublayer);
+    void insertSublayer(PassRefPtr<WKCACFLayer>, size_t index);
+    void insertSublayerAboveLayer(PassRefPtr<WKCACFLayer>, const WKCACFLayer* reference);
+    void insertSublayerBelowLayer(PassRefPtr<WKCACFLayer>, const WKCACFLayer* reference);
+    void replaceSublayer(WKCACFLayer* reference, PassRefPtr<WKCACFLayer>);
+    void removeFromSuperlayer();
+
+    WKCACFLayer* ancestorOrSelfWithSuperlayer(WKCACFLayer*) const;
+    
+    void setAnchorPoint(const CGPoint& p) { CACFLayerSetAnchorPoint(layer(), p); setNeedsCommit(); }
+    CGPoint anchorPoint() const { return CACFLayerGetAnchorPoint(layer()); }
+
+    void setAnchorPointZ(CGFloat z) { CACFLayerSetAnchorPointZ(layer(), z); setNeedsCommit(); }
+    CGFloat anchorPointZ() const { return CACFLayerGetAnchorPointZ(layer()); }
+
+    void setBackgroundColor(CGColorRef color) { CACFLayerSetBackgroundColor(layer(), color); setNeedsCommit(); }
+    CGColorRef backgroundColor() const { return CACFLayerGetBackgroundColor(layer()); }
+
+    void setBorderColor(CGColorRef color) { CACFLayerSetBorderColor(layer(), color); setNeedsCommit(); }
+    CGColorRef borderColor() const { return CACFLayerGetBorderColor(layer()); }
+
+    void setBorderWidth(CGFloat width) { CACFLayerSetBorderWidth(layer(), width); setNeedsCommit(); }
+    CGFloat borderWidth() const { return CACFLayerGetBorderWidth(layer()); }
+
+    void setBounds(const CGRect&);
+    CGRect bounds() const { return CACFLayerGetBounds(layer()); }
+
+    void setClearsContext(bool clears) { CACFLayerSetClearsContext(layer(), clears); setNeedsCommit(); }
+    bool clearsContext() const { return CACFLayerGetClearsContext(layer()); }
+
+    void setContents(CGImageRef contents) { CACFLayerSetContents(layer(), contents); setNeedsCommit(); }
+    CGImageRef contents() const { return static_cast<CGImageRef>(const_cast<void*>(CACFLayerGetContents(layer()))); }
+
+    void setContentsRect(const CGRect& contentsRect) { CACFLayerSetContentsRect(layer(), contentsRect); setNeedsCommit(); }
+    CGRect contentsRect() const { return CACFLayerGetContentsRect(layer()); }
+
+    void setContentsGravity(ContentsGravityType);
+    ContentsGravityType contentsGravity() const;
+        
+    void setDoubleSided(bool b) { CACFLayerSetDoubleSided(layer(), b); setNeedsCommit(); }
+    bool doubleSided() const { return CACFLayerIsDoubleSided(layer()); }
+
+    void setEdgeAntialiasingMask(uint32_t mask) { CACFLayerSetEdgeAntialiasingMask(layer(), mask); setNeedsCommit(); }
+    uint32_t edgeAntialiasingMask() const { return CACFLayerGetEdgeAntialiasingMask(layer()); }
+
+    void setFilters(CFArrayRef filters) { CACFLayerSetFilters(layer(), filters); setNeedsCommit(); }
+    CFArrayRef filters() const { return CACFLayerGetFilters(layer()); }
+
+    void setFrame(const CGRect&);
+    CGRect frame() const { return CACFLayerGetFrame(layer()); }
+
+    void setHidden(bool hidden) { CACFLayerSetHidden(layer(), hidden); setNeedsCommit(); }
+    bool isHidden() const { return CACFLayerIsHidden(layer()); }
+
+    void setMasksToBounds(bool b) { CACFLayerSetMasksToBounds(layer(), b); }
+    bool masksToBounds() const { return CACFLayerGetMasksToBounds(layer()); }
+
+    void setMagnificationFilter(FilterType);
+    FilterType magnificationFilter() const;
+
+    void setMinificationFilter(FilterType);
+    FilterType minificationFilter() const;
+
+    void setMinificationFilterBias(float bias) { CACFLayerSetMinificationFilterBias(layer(), bias); }
+    float minificationFilterBias() const { return CACFLayerGetMinificationFilterBias(layer()); }
+
+    void setName(const String& name) { CACFLayerSetName(layer(), RetainPtr<CFStringRef>(AdoptCF, name.createCFString()).get()); }
+    String name() const { return CACFLayerGetName(layer()); }
+
+    void setNeedsDisplayOnBoundsChange(bool needsDisplay) { m_needsDisplayOnBoundsChange = needsDisplay; }
+
+    void setOpacity(float opacity) { CACFLayerSetOpacity(layer(), opacity); setNeedsCommit(); }
+    float opacity() const { return CACFLayerGetOpacity(layer()); }
+
+    void setOpaque(bool b) { CACFLayerSetOpaque(layer(), b); setNeedsCommit(); }
+    bool opaque() const { return CACFLayerIsOpaque(layer()); }
+
+    void setPosition(const CGPoint& position) { CACFLayerSetPosition(layer(), position); setNeedsCommit(); }
+    CGPoint position() const { return CACFLayerGetPosition(layer()); }
+
+    void setZPosition(CGFloat position) { CACFLayerSetZPosition(layer(), position); setNeedsCommit(); }
+    CGFloat zPosition() const { return CACFLayerGetZPosition(layer()); }
+
+    void setSpeed(float speed) { CACFLayerSetSpeed(layer(), speed); }
+    CFTimeInterval speed() const { CACFLayerGetSpeed(layer()); }
+
+    void setTimeOffset(CFTimeInterval t) { CACFLayerSetTimeOffset(layer(), t); }
+    CFTimeInterval timeOffset() const { CACFLayerGetTimeOffset(layer()); }
+
+    WKCACFLayer* rootLayer() const;
+
+    void setSortsSublayers(bool sorts) { CACFLayerSetSortsSublayers(layer(), sorts); setNeedsCommit(); }
+    bool sortsSublayers() const { return CACFLayerGetSortsSublayers(layer()); }
+
+    void removeAllSublayers();
+    
+    void setSublayers(const Vector<RefPtr<WKCACFLayer> >&);
+
+    void setSublayerTransform(const CATransform3D& transform) { CACFLayerSetSublayerTransform(layer(), transform); setNeedsCommit(); }
+    CATransform3D sublayerTransform() const { return CACFLayerGetSublayerTransform(layer()); }
+
+    WKCACFLayer* superlayer() const;
+
+    void setTransform(const CATransform3D& transform) { CACFLayerSetTransform(layer(), transform); setNeedsCommit(); }
+    CATransform3D transform() const { return CACFLayerGetTransform(layer()); }
+
+    void setGeometryFlipped(bool flipped) { CACFLayerSetGeometryFlipped(layer(), flipped); setNeedsCommit(); }
+    bool geometryFlipped() const { return CACFLayerIsGeometryFlipped(layer()); }
+
+#ifndef NDEBUG
+    // Print the tree from the root. Also does consistency checks
+    void printTree() const;
+#endif
+
+protected:
+    WKCACFLayer(LayerType);
+
+    void setNeedsCommit();
+
+private:
+    CACFLayerRef layer() const { return m_layer.get(); }
+    size_t numSublayers() const
+    {
+        CFArrayRef sublayers = CACFLayerGetSublayers(layer());
+        return sublayers ? CFArrayGetCount(sublayers) : 0;
+    }
+
+    const WKCACFLayer* sublayerAtIndex(int) const;
+    
+    // Returns the index of the passed layer in this layer's sublayers list
+    // or -1 if not found
+    int indexOfSublayer(const WKCACFLayer*);
+
+    // This should only be called from removeFromSuperlayer.
+    void removeSublayer(const WKCACFLayer*);
+
+#ifndef NDEBUG
+    // Print this layer and its children to the console
+    void printLayer(int indent) const;
+#endif
+
+    RetainPtr<CACFLayerRef> m_layer;
+    bool m_needsDisplayOnBoundsChange;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // WKCACFLayer_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFLayerRenderer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFLayerRenderer.cpp
new file mode 100644
index 0000000000..abe0acc7db
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFLayerRenderer.cpp
@@ -0,0 +1,597 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "WKCACFLayerRenderer.h"
+
+#include "WKCACFContextFlusher.h"
+#include "WKCACFLayer.h"
+#include "WebCoreInstanceHandle.h"
+#include <CoreGraphics/CGSRegion.h>
+#include <QuartzCore/CACFContext.h>
+#include <QuartzCore/CARenderOGL.h>
+#include <QuartzCoreInterface/QuartzCoreInterface.h>
+#include <wtf/HashMap.h>
+#include <wtf/OwnArrayPtr.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/StdLibExtras.h>
+#include <d3d9.h>
+#include <d3dx9.h>
+
+#pragma comment(lib, "d3d9")
+#pragma comment(lib, "d3dx9")
+#ifdef DEBUG_ALL
+#pragma comment(lib, "QuartzCore_debug")
+#else
+#pragma comment(lib, "QuartzCore")
+#endif
+
+static IDirect3D9* s_d3d = 0;
+static IDirect3D9* d3d()
+{
+    if (s_d3d)
+        return s_d3d;
+
+    if (!LoadLibrary(TEXT("d3d9.dll")))
+        return 0;
+
+    s_d3d = Direct3DCreate9(D3D_SDK_VERSION);
+
+    return s_d3d;
+}
+
+inline static CGRect winRectToCGRect(RECT rc)
+{
+    return CGRectMake(rc.left, rc.top, (rc.right - rc.left), (rc.bottom - rc.top));
+}
+
+inline static CGRect winRectToCGRect(RECT rc, RECT relativeToRect)
+{
+    return CGRectMake(rc.left, (relativeToRect.bottom-rc.bottom), (rc.right - rc.left), (rc.bottom - rc.top));
+}
+
+namespace WebCore {
+
+// Subclass of WKCACFLayer to allow the root layer to have a back pointer to the layer renderer
+// to fire off a draw
+class WKCACFRootLayer : public WKCACFLayer {
+public:
+    WKCACFRootLayer(WKCACFLayerRenderer* renderer)
+        : WKCACFLayer(WKCACFLayer::Layer)
+    {
+        m_renderer = renderer;
+    }
+
+    static PassRefPtr<WKCACFRootLayer> create(WKCACFLayerRenderer* renderer)
+    {
+        if (!WKCACFLayerRenderer::acceleratedCompositingAvailable())
+            return 0;
+        return adoptRef(new WKCACFRootLayer(renderer));
+    }
+
+    virtual void setNeedsRender() { m_renderer->renderSoon(); }
+
+    // Overload this to avoid calling setNeedsDisplay on the layer, which would override the contents
+    // we have placed on the root layer.
+    virtual void setNeedsDisplay(const CGRect* dirtyRect) { setNeedsCommit(); }
+
+private:
+    WKCACFLayerRenderer* m_renderer;
+};
+
+typedef HashMap<CACFContextRef, WKCACFLayerRenderer*> ContextToWindowMap;
+
+static ContextToWindowMap& windowsForContexts()
+{
+    DEFINE_STATIC_LOCAL(ContextToWindowMap, map, ());
+    return map;
+}
+
+static D3DPRESENT_PARAMETERS initialPresentationParameters()
+{
+    D3DPRESENT_PARAMETERS parameters = {0};
+    parameters.Windowed = TRUE;
+    parameters.SwapEffect = D3DSWAPEFFECT_COPY;
+    parameters.BackBufferCount = 1;
+    parameters.BackBufferFormat = D3DFMT_A8R8G8B8;
+    parameters.MultiSampleType = D3DMULTISAMPLE_NONE;
+
+    return parameters;
+}
+
+// FIXME: <rdar://6507851> Share this code with CoreAnimation.
+static bool hardwareCapabilitiesIndicateCoreAnimationSupport(const D3DCAPS9& caps)
+{
+    // CoreAnimation needs two or more texture units.
+    if (caps.MaxTextureBlendStages < 2)
+        return false;
+
+    // CoreAnimation needs non-power-of-two textures.
+    if ((caps.TextureCaps & D3DPTEXTURECAPS_POW2) && !(caps.TextureCaps & D3DPTEXTURECAPS_NONPOW2CONDITIONAL))
+        return false;
+
+    // CoreAnimation needs vertex shader 2.0 or greater.
+    if (D3DSHADER_VERSION_MAJOR(caps.VertexShaderVersion) < 2)
+        return false;
+
+    // CoreAnimation needs pixel shader 2.0 or greater.
+    if (D3DSHADER_VERSION_MAJOR(caps.PixelShaderVersion) < 2)
+        return false;
+
+    return true;
+}
+
+bool WKCACFLayerRenderer::acceleratedCompositingAvailable()
+{
+    static bool available;
+    static bool tested;
+
+    if (tested)
+        return available;
+
+    tested = true;
+
+    // Initialize available to true since this function will be called from a 
+    // propagation within createRenderer(). We want to be able to return true 
+    // when that happens so that the test can continue.
+    available = true;
+    
+    HMODULE library = LoadLibrary(TEXT("d3d9.dll"));
+    if (!library) {
+        available = false;
+        return available;
+    }
+
+    FreeLibrary(library);
+#ifdef DEBUG_ALL
+    library = LoadLibrary(TEXT("QuartzCore_debug.dll"));
+#else
+    library = LoadLibrary(TEXT("QuartzCore.dll"));
+#endif
+    if (!library) {
+        available = false;
+        return available;
+    }
+
+    FreeLibrary(library);
+
+    // Make a dummy HWND.
+    WNDCLASSEX wcex = { 0 };
+    wcex.cbSize = sizeof(WNDCLASSEX);
+    wcex.lpfnWndProc = DefWindowProc;
+    wcex.hInstance = WebCore::instanceHandle();
+    wcex.lpszClassName = L"CoreAnimationTesterWindowClass";
+    ::RegisterClassEx(&wcex);
+    HWND testWindow = ::CreateWindow(L"CoreAnimationTesterWindowClass", L"CoreAnimationTesterWindow", WS_POPUP, -500, -500, 0, 0, 0, 0, 0, 0);
+
+    if (!testWindow) {
+        available = false;
+        return available;
+    }
+
+    OwnPtr<WKCACFLayerRenderer> testLayerRenderer = WKCACFLayerRenderer::create();
+    testLayerRenderer->setHostWindow(testWindow);
+    available = testLayerRenderer->createRenderer();
+    ::DestroyWindow(testWindow);
+
+    return available;
+}
+
+void WKCACFLayerRenderer::didFlushContext(CACFContextRef context)
+{
+    WKCACFLayerRenderer* window = windowsForContexts().get(context);
+    if (!window)
+        return;
+
+    window->renderSoon();
+}
+
+PassOwnPtr<WKCACFLayerRenderer> WKCACFLayerRenderer::create()
+{
+    if (!acceleratedCompositingAvailable())
+        return 0;
+    return new WKCACFLayerRenderer;
+}
+
+WKCACFLayerRenderer::WKCACFLayerRenderer()
+    : m_triedToCreateD3DRenderer(false)
+    , m_renderContext(0)
+    , m_renderer(0)
+    , m_hostWindow(0)
+    , m_renderTimer(this, &WKCACFLayerRenderer::renderTimerFired)
+    , m_scrollPosition(0, 0)
+    , m_scrollSize(1, 1)
+    , m_backingStoreDirty(false)
+{
+#ifndef NDEBUG
+    char* printTreeFlag = getenv("CA_PRINT_TREE");
+    m_printTree = printTreeFlag && atoi(printTreeFlag);
+#endif
+}
+
+WKCACFLayerRenderer::~WKCACFLayerRenderer()
+{
+    destroyRenderer();
+}
+
+WKCACFLayer* WKCACFLayerRenderer::rootLayer() const
+{
+    return m_rootLayer.get();
+}
+
+void WKCACFLayerRenderer::setScrollFrame(const IntPoint& position, const IntSize& size)
+{
+    m_scrollSize = size;
+    m_scrollPosition = position;
+
+    updateScrollFrame();
+}
+
+void WKCACFLayerRenderer::updateScrollFrame()
+{
+    CGRect frameBounds = bounds();
+    m_clipLayer->setBounds(CGRectMake(0, 0, m_scrollSize.width(), m_scrollSize.height()));
+    m_clipLayer->setPosition(CGPointMake(0, frameBounds.size.height));
+    if (m_rootChildLayer) {
+        CGRect rootBounds = m_rootChildLayer->bounds();
+        m_scrollLayer->setBounds(rootBounds);
+    }
+    m_scrollLayer->setPosition(CGPointMake(-m_scrollPosition.x(), m_scrollPosition.y() + m_scrollSize.height()));
+}
+
+void WKCACFLayerRenderer::setRootContents(CGImageRef image)
+{
+    ASSERT(m_rootLayer);
+    m_rootLayer->setContents(image);
+    renderSoon();
+}
+
+void WKCACFLayerRenderer::setRootChildLayer(WKCACFLayer* layer)
+{
+    if (!m_scrollLayer)
+        return;
+
+    m_scrollLayer->removeAllSublayers();
+    m_rootChildLayer = layer;
+    if (layer) {
+        m_scrollLayer->addSublayer(layer);
+        // Adjust the scroll frame accordingly
+        updateScrollFrame();
+    }
+}
+   
+void WKCACFLayerRenderer::setNeedsDisplay()
+{
+    ASSERT(m_rootLayer);
+    m_rootLayer->setNeedsDisplay(0);
+    renderSoon();
+}
+
+bool WKCACFLayerRenderer::createRenderer()
+{
+    if (m_triedToCreateD3DRenderer)
+        return m_d3dDevice;
+
+    m_triedToCreateD3DRenderer = true;
+    D3DPRESENT_PARAMETERS parameters = initialPresentationParameters();
+
+    if (!d3d() || !::IsWindow(m_hostWindow))
+        return false;
+
+    // D3D doesn't like to make back buffers for 0 size windows. We skirt this problem if we make the
+    // passed backbuffer width and height non-zero. The window will necessarily get set to a non-zero
+    // size eventually, and then the backbuffer size will get reset.
+    RECT rect;
+    GetClientRect(m_hostWindow, &rect);
+
+    if (rect.left-rect.right == 0 || rect.bottom-rect.top == 0) {
+        parameters.BackBufferWidth = 1;
+        parameters.BackBufferHeight = 1;
+    }
+
+    COMPtr<IDirect3DDevice9> device;
+    if (FAILED(d3d()->CreateDevice(D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, m_hostWindow, D3DCREATE_HARDWARE_VERTEXPROCESSING | D3DCREATE_FPU_PRESERVE, &parameters, &device)))
+        return false;
+
+    // Now that we've created the IDirect3DDevice9 based on the capabilities we
+    // got from the IDirect3D9 global object, we requery the device for its
+    // actual capabilities. The capabilities returned by the device can
+    // sometimes be more complete, for example when using software vertex
+    // processing.
+    D3DCAPS9 deviceCaps;
+    if (FAILED(device->GetDeviceCaps(&deviceCaps)))
+        return false;
+
+    if (!hardwareCapabilitiesIndicateCoreAnimationSupport(deviceCaps))
+        return false;
+
+    m_d3dDevice = device;
+
+    D3DXMATRIXA16 projection;
+    D3DXMatrixOrthoOffCenterRH(&projection, rect.left, rect.right, rect.top, rect.bottom, -1.0f, 1.0f);
+
+    m_d3dDevice->SetTransform(D3DTS_PROJECTION, &projection);
+
+    m_context.adoptCF(CACFContextCreate(0));
+    windowsForContexts().set(m_context.get(), this);
+
+    m_renderContext = static_cast<CARenderContext*>(CACFContextGetRenderContext(m_context.get()));
+    m_renderer = CARenderOGLNew(wkqcCARenderOGLCallbacks(wkqckCARenderDX9Callbacks), m_d3dDevice.get(), 0);
+
+    // Create the root hierarchy.
+    // Under the root layer, we have a clipping layer to clip the content,
+    // that contains a scroll layer that we use for scrolling the content.
+    // The root layer is the size of the client area of the window.
+    // The clipping layer is the size of the WebView client area (window less the scrollbars).
+    // The scroll layer is the size of the root child layer.
+    // Resizing the window will change the bounds of the rootLayer and the clip layer and will not
+    // cause any repositioning.
+    // Scrolling will affect only the position of the scroll layer without affecting the bounds.
+
+    m_rootLayer = WKCACFRootLayer::create(this);
+    m_rootLayer->setName("WKCACFLayerRenderer rootLayer");
+
+    m_clipLayer = WKCACFLayer::create(WKCACFLayer::Layer);
+    m_clipLayer->setName("WKCACFLayerRenderer clipLayer");
+    
+    m_scrollLayer = WKCACFLayer::create(WKCACFLayer::Layer);
+    m_scrollLayer->setName("WKCACFLayerRenderer scrollLayer");
+
+    m_rootLayer->addSublayer(m_clipLayer);
+    m_clipLayer->addSublayer(m_scrollLayer);
+    m_clipLayer->setMasksToBounds(true);
+    m_scrollLayer->setAnchorPoint(CGPointMake(0, 1));
+    m_clipLayer->setAnchorPoint(CGPointMake(0, 1));
+
+#ifndef NDEBUG
+    CGColorRef debugColor = createCGColor(Color(255, 0, 0, 204));
+    m_rootLayer->setBackgroundColor(debugColor);
+    CGColorRelease(debugColor);
+#endif
+
+    if (IsWindow(m_hostWindow))
+        m_rootLayer->setFrame(bounds());
+
+    if (m_context)
+        m_rootLayer->becomeRootLayerForContext(m_context.get());
+
+    return true;
+}
+
+void WKCACFLayerRenderer::destroyRenderer()
+{
+    if (m_context) {
+        windowsForContexts().remove(m_context.get());
+        WKCACFContextFlusher::shared().removeContext(m_context.get());
+    }
+
+    if (m_renderer)
+        CARenderOGLDestroy(m_renderer);
+    m_renderer = 0;
+    m_d3dDevice = 0;
+    if (s_d3d)
+        s_d3d->Release();
+
+    s_d3d = 0;
+    m_rootLayer = 0;
+    m_clipLayer = 0;
+    m_scrollLayer = 0;
+    m_rootChildLayer = 0;
+
+    m_triedToCreateD3DRenderer = false;
+}
+
+void WKCACFLayerRenderer::resize()
+{
+    if (!m_d3dDevice)
+        return;
+
+    resetDevice();
+
+    if (m_rootLayer) {
+        m_rootLayer->setFrame(bounds());
+        WKCACFContextFlusher::shared().flushAllContexts();
+        updateScrollFrame();
+    }
+}
+
+static void getDirtyRects(HWND window, Vector<CGRect>& outRects)
+{
+    ASSERT_ARG(outRects, outRects.isEmpty());
+
+    RECT clientRect;
+    if (!GetClientRect(window, &clientRect))
+        return;
+
+    HRGN region = CreateRectRgn(0, 0, 0, 0);
+    int regionType = GetUpdateRgn(window, region, false);
+    if (regionType != COMPLEXREGION) {
+        RECT dirtyRect;
+        if (GetUpdateRect(window, &dirtyRect, false))
+            outRects.append(winRectToCGRect(dirtyRect, clientRect));
+        return;
+    }
+
+    DWORD dataSize = GetRegionData(region, 0, 0);
+    OwnArrayPtr<unsigned char> regionDataBuffer(new unsigned char[dataSize]);
+    RGNDATA* regionData = reinterpret_cast<RGNDATA*>(regionDataBuffer.get());
+    if (!GetRegionData(region, dataSize, regionData))
+        return;
+
+    outRects.resize(regionData->rdh.nCount);
+
+    RECT* rect = reinterpret_cast<RECT*>(regionData->Buffer);
+    for (size_t i = 0; i < outRects.size(); ++i, ++rect)
+        outRects[i] = winRectToCGRect(*rect, clientRect);
+
+    DeleteObject(region);
+}
+
+void WKCACFLayerRenderer::renderTimerFired(Timer<WKCACFLayerRenderer>*)
+{
+    paint();
+}
+
+void WKCACFLayerRenderer::paint()
+{
+    if (!m_d3dDevice)
+        return;
+
+    if (m_backingStoreDirty) {
+        // If the backing store is still dirty when we are about to draw the
+        // composited content, we need to force the window to paint into the
+        // backing store. The paint will only paint the dirty region that
+        // if being tracked in WebView.
+        UpdateWindow(m_hostWindow);
+        return;
+    }
+
+    Vector<CGRect> dirtyRects;
+    getDirtyRects(m_hostWindow, dirtyRects);
+    render(dirtyRects);
+}
+
+void WKCACFLayerRenderer::render(const Vector<CGRect>& dirtyRects)
+{
+    ASSERT(m_d3dDevice);
+
+    // Flush the root layer to the render tree.
+    WKCACFContextFlusher::shared().flushAllContexts();
+
+    CGRect bounds = this->bounds();
+
+    CFTimeInterval t = CACurrentMediaTime();
+
+    // Give the renderer some space to use. This needs to be valid until the
+    // CARenderUpdateFinish() call below.
+    char space[4096];
+    CARenderUpdate* u = CARenderUpdateBegin(space, sizeof(space), t, 0, 0, &bounds);
+    if (!u)
+        return;
+
+    CARenderContextLock(m_renderContext);
+    CARenderUpdateAddContext(u, m_renderContext);
+    CARenderContextUnlock(m_renderContext);
+
+    for (size_t i = 0; i < dirtyRects.size(); ++i)
+        CARenderUpdateAddRect(u, &dirtyRects[i]);
+
+    HRESULT err = S_OK;
+    do {
+        CGSRegionObj rgn = CARenderUpdateCopyRegion(u);
+
+        if (!rgn)
+            break;
+
+        // FIXME: don't need to clear dirty region if layer tree is opaque.
+
+        Vector<D3DRECT, 64> rects;
+        CGSRegionEnumeratorObj e = CGSRegionEnumerator(rgn);
+        for (const CGRect* r = CGSNextRect(e); r; r = CGSNextRect(e)) {
+            D3DRECT rect;
+            rect.x1 = r->origin.x;
+            rect.x2 = rect.x1 + r->size.width;
+            rect.y1 = bounds.origin.y + bounds.size.height - (r->origin.y + r->size.height);
+            rect.y2 = rect.y1 + r->size.height;
+
+            rects.append(rect);
+        }
+        CGSReleaseRegionEnumerator(e);
+        CGSReleaseRegion(rgn);
+
+        if (rects.isEmpty())
+            break;
+
+        m_d3dDevice->Clear(rects.size(), rects.data(), D3DCLEAR_TARGET, 0, 1.0f, 0);
+
+        m_d3dDevice->BeginScene();
+        CARenderOGLRender(m_renderer, u);
+        m_d3dDevice->EndScene();
+
+        err = m_d3dDevice->Present(0, 0, 0, 0);
+
+        if (err == D3DERR_DEVICELOST) {
+            // Lost device situation.
+            CARenderOGLPurge(m_renderer);
+            resetDevice();
+            CARenderUpdateAddRect(u, &bounds);
+        }
+    } while (err == D3DERR_DEVICELOST);
+
+    CARenderUpdateFinish(u);
+
+#ifndef NDEBUG
+    if (m_printTree)
+        m_rootLayer->printTree();
+#endif
+}
+
+void WKCACFLayerRenderer::renderSoon()
+{
+    if (!m_renderTimer.isActive())
+        m_renderTimer.startOneShot(0);
+}
+
+CGRect WKCACFLayerRenderer::bounds() const
+{
+    RECT clientRect;
+    GetClientRect(m_hostWindow, &clientRect);
+
+    return winRectToCGRect(clientRect);
+}
+
+void WKCACFLayerRenderer::initD3DGeometry()
+{
+    ASSERT(m_d3dDevice);
+
+    CGRect bounds = this->bounds();
+
+    float x0 = bounds.origin.x;
+    float y0 = bounds.origin.y;
+    float x1 = x0 + bounds.size.width;
+    float y1 = y0 + bounds.size.height;
+
+    D3DXMATRIXA16 projection;
+    D3DXMatrixOrthoOffCenterRH(&projection, x0, x1, y0, y1, -1.0f, 1.0f);
+
+    m_d3dDevice->SetTransform(D3DTS_PROJECTION, &projection);
+}
+
+void WKCACFLayerRenderer::resetDevice()
+{
+    ASSERT(m_d3dDevice);
+
+    D3DPRESENT_PARAMETERS parameters = initialPresentationParameters();
+    m_d3dDevice->Reset(&parameters);
+    initD3DGeometry();
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFLayerRenderer.h b/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFLayerRenderer.h
new file mode 100644
index 0000000000..ea710b67c9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/win/WKCACFLayerRenderer.h
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WKCACFLayerRenderer_h
+#define WKCACFLayerRenderer_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "COMPtr.h"
+#include "Timer.h"
+#include "WKCACFLayer.h"
+
+#include <wtf/Noncopyable.h>
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/RetainPtr.h>
+
+#include <CoreGraphics/CGGeometry.h>
+
+interface IDirect3DDevice9;
+typedef struct _CACFContext* CACFContextRef;
+typedef struct _CARenderContext CARenderContext;
+typedef struct _CARenderOGLContext CARenderOGLContext;
+
+namespace WebCore {
+
+class WKCACFRootLayer;
+
+// FIXME: Currently there is a WKCACFLayerRenderer for each WebView and each
+// has its own CARenderOGLContext and Direct3DDevice9, which is inefficient.
+// (https://bugs.webkit.org/show_bug.cgi?id=31855)
+class WKCACFLayerRenderer : public Noncopyable {
+public:
+    static PassOwnPtr<WKCACFLayerRenderer> create();
+    ~WKCACFLayerRenderer();
+
+    static bool acceleratedCompositingAvailable();
+    static void didFlushContext(CACFContextRef);
+
+    void setScrollFrame(const IntPoint&, const IntSize&);
+    void setRootContents(CGImageRef);
+    void setRootChildLayer(WKCACFLayer* layer);
+    void setNeedsDisplay();
+    void setHostWindow(HWND window) { m_hostWindow = window; }
+    void setBackingStoreDirty(bool dirty) { m_backingStoreDirty = dirty; }
+    bool createRenderer();
+    void destroyRenderer();
+    void resize();
+    void renderSoon();
+    void updateScrollFrame();
+
+protected:
+    WKCACFLayer* rootLayer() const;
+
+private:
+    WKCACFLayerRenderer();
+
+    void renderTimerFired(Timer<WKCACFLayerRenderer>*);
+
+    CGRect bounds() const;
+
+    void initD3DGeometry();
+    void resetDevice();
+
+    void render(const Vector<CGRect>& dirtyRects = Vector<CGRect>());
+    void paint();
+
+    bool m_triedToCreateD3DRenderer;
+    COMPtr<IDirect3DDevice9> m_d3dDevice;
+    RefPtr<WKCACFRootLayer> m_rootLayer;
+    RefPtr<WKCACFLayer> m_viewLayer;
+    RefPtr<WKCACFLayer> m_scrollLayer;
+    RefPtr<WKCACFLayer> m_rootChildLayer;
+    RefPtr<WKCACFLayer> m_clipLayer;
+    RetainPtr<CACFContextRef> m_context;
+    CARenderContext* m_renderContext;
+    CARenderOGLContext* m_renderer;
+    HWND m_hostWindow;
+    Timer<WKCACFLayerRenderer> m_renderTimer;
+    IntPoint m_scrollPosition;
+    IntSize m_scrollSize;
+    bool m_backingStoreDirty;
+#ifndef NDEBUG
+    bool m_printTree;
+#endif
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // WKCACFLayerRenderer_h
diff --git a/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.cpp b/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.cpp
index a16b940848..172bccfdd2 100644
--- a/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008-2009 Torch Mobile, Inc.
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -22,9 +23,8 @@
 
 #include "ImageDecoder.h"
 
-#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
 #include <algorithm>
-#endif
+#include <cmath>
 
 #include "BMPImageDecoder.h"
 #include "GIFImageDecoder.h"
@@ -32,35 +32,46 @@
 #include "JPEGImageDecoder.h"
 #include "PNGImageDecoder.h"
 #include "SharedBuffer.h"
-#include "XBMImageDecoder.h"
+
+using namespace std;
 
 namespace WebCore {
 
+static unsigned copyFromSharedBuffer(char* buffer, unsigned bufferLength, const SharedBuffer& sharedBuffer, unsigned offset)
+{
+    unsigned bytesExtracted = 0;
+    const char* moreData;
+    while (unsigned moreDataLength = sharedBuffer.getSomeData(moreData, offset)) {
+        unsigned bytesToCopy = min(bufferLength - bytesExtracted, moreDataLength);
+        memcpy(buffer + bytesExtracted, moreData, bytesToCopy);
+        bytesExtracted += bytesToCopy;
+        if (bytesExtracted == bufferLength)
+            break;
+        offset += bytesToCopy;
+    }
+    return bytesExtracted;
+}
+
 ImageDecoder* ImageDecoder::create(const SharedBuffer& data)
 {
-    // We need at least 4 bytes to figure out what kind of image we're dealing with.
-    int length = data.size();
-    if (length < 4)
+    // We need at least 4 bytes to figure out what kind of image we're dealing
+    // with.
+    static const unsigned maxMarkerLength = 4;
+    char contents[maxMarkerLength];
+    unsigned length = copyFromSharedBuffer(contents, maxMarkerLength, data, 0);
+    if (length < maxMarkerLength)
         return 0;
 
-    const unsigned char* uContents = (const unsigned char*)data.data();
-    const char* contents = data.data();
-
     // GIFs begin with GIF8(7 or 9).
     if (strncmp(contents, "GIF8", 4) == 0)
         return new GIFImageDecoder();
 
     // Test for PNG.
-    if (uContents[0]==0x89 &&
-        uContents[1]==0x50 &&
-        uContents[2]==0x4E &&
-        uContents[3]==0x47)
+    if (!memcmp(contents, "\x89\x50\x4E\x47", 4))
         return new PNGImageDecoder();
 
     // JPEG
-    if (uContents[0]==0xFF &&
-        uContents[1]==0xD8 &&
-        uContents[2]==0xFF)
+    if (!memcmp(contents, "\xFF\xD8\xFF", 3))
         return new JPEGImageDecoder();
 
     // BMP
@@ -69,14 +80,9 @@ ImageDecoder* ImageDecoder::create(const SharedBuffer& data)
 
     // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
     // CURs begin with 2-byte 0 followed by 2-byte 2.
-    if (!memcmp(contents, "\000\000\001\000", 4) ||
-        !memcmp(contents, "\000\000\002\000", 4))
+    if (!memcmp(contents, "\x00\x00\x01\x00", 4) || !memcmp(contents, "\x00\x00\x02\x00", 4))
         return new ICOImageDecoder();
 
-    // XBMs require 8 bytes of info.
-    if (length >= 8 && strncmp(contents, "#define ", 8) == 0)
-        return new XBMImageDecoder();
-
     // Give up. We don't know what the heck this is.
     return 0;
 }
@@ -91,14 +97,27 @@ RGBA32Buffer::RGBA32Buffer()
 {
 } 
 
+RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
+{
+    if (this == &other)
+        return *this;
+
+    copyBitmapData(other);
+    setRect(other.rect());
+    setStatus(other.status());
+    setDuration(other.duration());
+    setDisposalMethod(other.disposalMethod());
+    return *this;
+}
+
 void RGBA32Buffer::clear()
 {
     m_bytes.clear();
     m_status = FrameEmpty;
-    // NOTE: Do not reset other members here; clearFrameBufferCache()
-    // calls this to free the bitmap data, but other functions like
-    // initFrameBuffer() and frameComplete() may still need to read
-    // other metadata out of this frame later.
+    // NOTE: Do not reset other members here; clearFrameBufferCache() calls this
+    // to free the bitmap data, but other functions like initFrameBuffer() and
+    // frameComplete() may still need to read other metadata out of this frame
+    // later.
 }
 
 void RGBA32Buffer::zeroFill()
@@ -119,8 +138,8 @@ void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
 
 bool RGBA32Buffer::setSize(int newWidth, int newHeight)
 {
-    // NOTE: This has no way to check for allocation failure if the
-    // requested size was too big...
+    // NOTE: This has no way to check for allocation failure if the requested
+    // size was too big...
     m_bytes.resize(newWidth * newHeight);
     m_size = IntSize(newWidth, newHeight);
 
@@ -145,19 +164,6 @@ void RGBA32Buffer::setStatus(FrameStatus status)
     m_status = status;
 }
 
-RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return *this;
-
-    copyBitmapData(other);
-    setRect(other.rect());
-    setStatus(other.status());
-    setDuration(other.duration());
-    setDisposalMethod(other.disposalMethod());
-    return *this;
-}
-
 int RGBA32Buffer::width() const
 {
     return m_size.width();
@@ -170,8 +176,6 @@ int RGBA32Buffer::height() const
 
 #endif
 
-#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
-
 namespace {
 
 enum MatchType {
@@ -184,18 +188,19 @@ inline void fillScaledValues(Vector<int>& scaledValues, double scaleRate, int le
 {
     double inflateRate = 1. / scaleRate;
     scaledValues.reserveCapacity(static_cast<int>(length * scaleRate + 0.5));
-    for (int scaledIndex = 0;;) {
+    for (int scaledIndex = 0; ; ++scaledIndex) {
         int index = static_cast<int>(scaledIndex * inflateRate + 0.5);
-        if (index < length) {
-            scaledValues.append(index);
-            ++scaledIndex;
-        } else
+        if (index >= length)
             break;
+        scaledValues.append(index);
     }
 }
 
 template <MatchType type> int getScaledValue(const Vector<int>& scaledValues, int valueToMatch, int searchStart)
 {
+    if (scaledValues.isEmpty())
+        return valueToMatch;
+
     const int* dataStart = scaledValues.data();
     const int* dataEnd = dataStart + scaledValues.size();
     const int* matched = std::lower_bound(dataStart + searchStart, dataEnd, valueToMatch);
@@ -214,18 +219,19 @@ template <MatchType type> int getScaledValue(const Vector<int>& scaledValues, in
 
 void ImageDecoder::prepareScaleDataIfNecessary()
 {
-    int width = m_size.width();
-    int height = m_size.height();
+    int width = size().width();
+    int height = size().height();
     int numPixels = height * width;
-    if (m_maxNumPixels <= 0 || numPixels <= m_maxNumPixels) {
+    if (m_maxNumPixels > 0 && numPixels > m_maxNumPixels) {
+        m_scaled = true;
+        double scale = sqrt(m_maxNumPixels / (double)numPixels);
+        fillScaledValues(m_scaledColumns, scale, width);
+        fillScaledValues(m_scaledRows, scale, height);
+    } else if (m_scaled) {
         m_scaled = false;
-        return;
+        m_scaledColumns.clear();
+        m_scaledRows.clear();
     }
-
-    m_scaled = true;
-    double scale = sqrt(m_maxNumPixels / (double)numPixels);
-    fillScaledValues(m_scaledColumns, scale, width);
-    fillScaledValues(m_scaledRows, scale, height);
 }
 
 int ImageDecoder::upperBoundScaledX(int origX, int searchStart)
@@ -238,11 +244,19 @@ int ImageDecoder::lowerBoundScaledX(int origX, int searchStart)
     return getScaledValue<LowerBound>(m_scaledColumns, origX, searchStart);
 }
 
+int ImageDecoder::upperBoundScaledY(int origY, int searchStart)
+{
+    return getScaledValue<UpperBound>(m_scaledRows, origY, searchStart);
+}
+
+int ImageDecoder::lowerBoundScaledY(int origY, int searchStart)
+{
+    return getScaledValue<LowerBound>(m_scaledRows, origY, searchStart);
+}
+
 int ImageDecoder::scaledY(int origY, int searchStart)
 {
     return getScaledValue<Exact>(m_scaledRows, origY, searchStart);
 }
 
-#endif // ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
-
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h b/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h
index 5692de71d4..d526e5e819 100644
--- a/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2008-2009 Torch Mobile, Inc.
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
  * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -44,18 +45,21 @@
 
 namespace WebCore {
 
-    // The RGBA32Buffer object represents the decoded image data in RGBA32 format.  This buffer is what all
-    // decoders write a single frame into.  Frames are then instantiated for drawing by being handed this buffer.
+    // The RGBA32Buffer object represents the decoded image data in RGBA32
+    // format.  This buffer is what all decoders write a single frame into.
+    // Frames are then instantiated for drawing by being handed this buffer.
     class RGBA32Buffer {
     public:
         enum FrameStatus { FrameEmpty, FramePartial, FrameComplete };
         enum FrameDisposalMethod {
-            // If you change the numeric values of these, make sure you audit all
-            // users, as some users may cast raw values to/from these constants.
-            DisposeNotSpecified,       // Leave frame in framebuffer
-            DisposeKeep,               // Leave frame in framebuffer
-            DisposeOverwriteBgcolor,   // Clear frame to transparent
-            DisposeOverwritePrevious,  // Clear frame to previous framebuffer contents
+            // If you change the numeric values of these, make sure you audit
+            // all users, as some users may cast raw values to/from these
+            // constants.
+            DisposeNotSpecified,      // Leave frame in framebuffer
+            DisposeKeep,              // Leave frame in framebuffer
+            DisposeOverwriteBgcolor,  // Clear frame to transparent
+            DisposeOverwritePrevious, // Clear frame to previous framebuffer
+                                      // contents
         };
 #if PLATFORM(SKIA) || PLATFORM(QT)
         typedef uint32_t PixelData;
@@ -65,15 +69,11 @@ namespace WebCore {
 
         RGBA32Buffer();
 
-        // For backends which refcount their data, this constructor doesn't need
-        // to create a new copy of the image data, only increase the ref count.
-        //
-        // This exists because ImageDecoder keeps a Vector<RGBA32Buffer>, and
-        // Vector requires this constructor.
-        RGBA32Buffer(const RGBA32Buffer& other)
-        {
-            operator=(other);
-        }
+        RGBA32Buffer(const RGBA32Buffer& other) { operator=(other); }
+
+        // For backends which refcount their data, this operator doesn't need to
+        // create a new copy of the image data, only increase the ref count.
+        RGBA32Buffer& operator=(const RGBA32Buffer& other);
 
         // Deletes the pixel data entirely; used by ImageDecoder to save memory
         // when we no longer need to display a frame and only need its metadata.
@@ -135,8 +135,6 @@ namespace WebCore {
 #endif
 
     private:
-        RGBA32Buffer& operator=(const RGBA32Buffer& other);
-
         int width() const;
         int height() const;
 
@@ -177,33 +175,39 @@ namespace WebCore {
         Vector<PixelData> m_bytes;
         IntSize m_size;       // The size of the buffer.  This should be the
                               // same as ImageDecoder::m_size.
-        bool m_hasAlpha;      // Whether or not any of the pixels in the buffer have transparency.
+        bool m_hasAlpha;      // Whether or not any of the pixels in the buffer
+                              // have transparency.
 #endif
-        IntRect m_rect;       // The rect of the original specified frame within the overall buffer.
-                              // This will always just be the entire buffer except for GIF frames
-                              // whose original rect was smaller than the overall image size.
-        FrameStatus m_status; // Whether or not this frame is completely finished decoding.
+        IntRect m_rect;       // The rect of the original specified frame within
+                              // the overall buffer.  This will always just be
+                              // the entire buffer except for GIF frames whose
+                              // original rect was smaller than the overall
+                              // image size.
+        FrameStatus m_status; // Whether or not this frame is completely
+                              // finished decoding.
         unsigned m_duration;  // The animation delay.
         FrameDisposalMethod m_disposalMethod;
-                              // What to do with this frame's data when initializing the next frame.
+                              // What to do with this frame's data when
+                              // initializing the next frame.
     };
 
-    // The ImageDecoder class represents a base class for specific image format decoders
-    // (e.g., GIF, JPG, PNG, ICO) to derive from.  All decoders decode into RGBA32 format
-    // and the base class manages the RGBA32 frame cache.
-    class ImageDecoder {
+    // The ImageDecoder class represents a base class for specific image format
+    // decoders (e.g., GIF, JPG, PNG, ICO) to derive from.  All decoders decode
+    // into RGBA32 format and the base class manages the RGBA32 frame cache.
+    //
+    // ENABLE(IMAGE_DECODER_DOWN_SAMPLING) allows image decoders to write
+    // directly to scaled output buffers by down sampling. Call
+    // setMaxNumPixels() to specify the biggest size that decoded images can
+    // have. Image decoders will deflate those images that are bigger than
+    // m_maxNumPixels. (Not supported by all image decoders yet)
+    class ImageDecoder : public Noncopyable {
     public:
-        // ENABLE(IMAGE_DECODER_DOWN_SAMPLING) allows image decoders to write directly to
-        // scaled output buffers by down sampling. Call setMaxNumPixels() to specify the
-        // biggest size that decoded images can have. Image decoders will deflate those
-        // images that are bigger than m_maxNumPixels. (Not supported by all image decoders yet)
         ImageDecoder()
-            : m_failed(false)
+            : m_scaled(false)
             , m_sizeAvailable(false)
-#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
             , m_maxNumPixels(-1)
-            , m_scaled(false)
-#endif
+            , m_isAllDataReceived(false)
+            , m_failed(false)
         {
         }
 
@@ -214,16 +218,24 @@ namespace WebCore {
         // needing to write a dedicated setData() implementation.
         static ImageDecoder* create(const SharedBuffer& data);
 
-        // The the filename extension usually associated with an undecoded image of this type.
+        // The the filename extension usually associated with an undecoded image
+        // of this type.
         virtual String filenameExtension() const = 0;
 
-        // All specific decoder plugins must do something with the data they are given.
-        virtual void setData(SharedBuffer* data, bool allDataReceived) { m_data = data; }
+        bool isAllDataReceived() const { return m_isAllDataReceived; }
 
-        // Whether or not the size information has been decoded yet. This default
-        // implementation just returns true if the size has been set and we have not
-        // seen a failure. Decoders may want to override this to lazily decode
-        // enough of the image to get the size.
+        virtual void setData(SharedBuffer* data, bool allDataReceived)
+        {
+            if (failed())
+                return;
+            m_data = data;
+            m_isAllDataReceived = allDataReceived;
+        }
+
+        // Whether or not the size information has been decoded yet. This
+        // default implementation just returns true if the size has been set and
+        // we have not seen a failure. Decoders may want to override this to
+        // lazily decode enough of the image to get the size.
         virtual bool isSizeAvailable()
         {
             return !m_failed && m_sizeAvailable; 
@@ -232,11 +244,14 @@ namespace WebCore {
         // Returns the size of the image.
         virtual IntSize size() const
         {
-            // Requesting the size of an invalid bitmap is meaningless.
-            ASSERT(!m_failed);
             return m_size;
         }
 
+        IntSize scaledSize() const
+        {
+            return m_scaled ? IntSize(m_scaledColumns.size(), m_scaledRows.size()) : size();
+        }
+
         // Returns the size of frame |index|.  This will only differ from size()
         // for formats where different frames are different sizes (namely ICO,
         // where each frame represents a different icon within the master file).
@@ -248,44 +263,51 @@ namespace WebCore {
             return size();
         }
 
-        // Called by the image decoders to set their decoded size, this also check
-        // the size for validity. It will return true if the size was set, or false
-        // if there is an error. On error, the m_failed flag will be set and the
-        // caller should immediately stop decoding.
+        // Called by the image decoders to set their decoded size, this also
+        // checks the size for validity. It will return true if the size was
+        // set, or false if there is an error. On error, the m_failed flag will
+        // be set and the caller should immediately stop decoding.
         virtual bool setSize(unsigned width, unsigned height)
         {
-            if (isOverSize(width, height)) {
-                m_failed = true;
-                return false;
-            }
+            if (isOverSize(width, height))
+                return setFailed();
             m_size = IntSize(width, height);
             m_sizeAvailable = true;
             return true;
         }
 
-        // The total number of frames for the image.  Classes that support multiple frames
-        // will scan the image data for the answer if they need to (without necessarily
-        // decoding all of the individual frames).
+        // The total number of frames for the image.  Classes that support
+        // multiple frames will scan the image data for the answer if they need
+        // to (without necessarily decoding all of the individual frames).
         virtual size_t frameCount() { return 1; }
 
         // The number of repetitions to perform for an animation loop.
         virtual int repetitionCount() const { return cAnimationNone; }
 
-        // Called to obtain the RGBA32Buffer full of decoded data for rendering.  The
-        // decoder plugin will decode as much of the frame as it can before handing
-        // back the buffer.
+        // Called to obtain the RGBA32Buffer full of decoded data for rendering.
+        // The decoder plugin will decode as much of the frame as it can before
+        // handing back the buffer.
         virtual RGBA32Buffer* frameBufferAtIndex(size_t) = 0;
 
-        // Whether or not the underlying image format even supports alpha transparency.
+        // Whether or not the underlying image format even supports alpha
+        // transparency.
         virtual bool supportsAlpha() const { return true; }
 
+        // Sets the "decode failure" flag.  For caller convenience (since so
+        // many callers want to return false after calling this), returns false
+        // to enable easy tailcalling.
+        virtual bool setFailed()
+        {
+            m_failed = true;
+            return false;
+        }
+
         bool failed() const { return m_failed; }
-        void setFailed() { m_failed = true; }
 
         // Wipe out frames in the frame buffer cache before |clearBeforeFrame|,
-        // assuming this can be done without breaking decoding.  Different decoders
-        // place different restrictions on what frames are safe to destroy, so this
-        // is left to them to implement.
+        // assuming this can be done without breaking decoding.  Different
+        // decoders place different restrictions on what frames are safe to
+        // destroy, so this is left to them to implement.
         // For convenience's sake, we provide a default (empty) implementation,
         // since in practice only GIFs will ever use this.
         virtual void clearFrameBufferCache(size_t clearBeforeFrame) { }
@@ -295,22 +317,18 @@ namespace WebCore {
 #endif
 
     protected:
-#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
         void prepareScaleDataIfNecessary();
         int upperBoundScaledX(int origX, int searchStart = 0);
         int lowerBoundScaledX(int origX, int searchStart = 0);
+        int upperBoundScaledY(int origY, int searchStart = 0);
+        int lowerBoundScaledY(int origY, int searchStart = 0);
         int scaledY(int origY, int searchStart = 0);
-#endif
 
         RefPtr<SharedBuffer> m_data; // The encoded data.
-#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
-        int m_maxNumPixels;
+        Vector<RGBA32Buffer> m_frameBufferCache;
+        bool m_scaled;
         Vector<int> m_scaledColumns;
         Vector<int> m_scaledRows;
-        bool m_scaled;
-#endif
-        Vector<RGBA32Buffer> m_frameBufferCache;
-        bool m_failed;
 
     private:
         // Some code paths compute the size of the image as "width * height * 4"
@@ -326,6 +344,9 @@ namespace WebCore {
 
         IntSize m_size;
         bool m_sizeAvailable;
+        int m_maxNumPixels;
+        bool m_isAllDataReceived;
+        bool m_failed;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp b/src/3rdparty/webkit/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
index da6ab380cb..b2e5e1765a 100644
--- a/src/3rdparty/webkit/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
@@ -34,20 +34,25 @@
 namespace WebCore {
 
 RGBA32Buffer::RGBA32Buffer()
-    : m_status(FrameEmpty)
-    , m_hasAlpha(false)
+    : m_hasAlpha(false) 
     , m_size()
+    , m_status(FrameEmpty)
     , m_duration(0)
     , m_disposalMethod(DisposeNotSpecified)
 {
 }
 
-// The image must not have format 8888 pre multiplied...
-void RGBA32Buffer::setDecodedImage(const QImage& image)
+RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
 {
-    m_image = image;
-    m_size = image.size();
-    m_hasAlpha = image.hasAlphaChannel();
+    if (this == &other)
+        return *this;
+
+    copyBitmapData(other);
+    setRect(other.rect());
+    setStatus(other.status());
+    setDuration(other.duration());
+    setDisposalMethod(other.disposalMethod());
+    return *this;
 }
 
 void RGBA32Buffer::clear()
@@ -83,11 +88,8 @@ bool RGBA32Buffer::setSize(int newWidth, int newHeight)
 
     m_size = IntSize(newWidth, newHeight);
     m_image = QImage(newWidth, newHeight, QImage::Format_ARGB32_Premultiplied);
-    if (m_image.isNull()) {
-        // Allocation failure, maybe the bitmap was too big.
-        setStatus(FrameComplete);
+    if (m_image.isNull())
         return false;
-    }
 
     // Zero the image.
     zeroFill();
@@ -118,17 +120,12 @@ void RGBA32Buffer::setStatus(FrameStatus status)
     m_status = status;
 }
 
-RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
+// The image must not have format 8888 pre multiplied...
+void RGBA32Buffer::setDecodedImage(const QImage& image)
 {
-    if (this == &other)
-        return *this;
-
-    copyBitmapData(other);
-    setRect(other.rect());
-    setStatus(other.status());
-    setDuration(other.duration());
-    setDisposalMethod(other.disposalMethod());
-    return *this;
+    m_image = image;
+    m_size = image.size();
+    m_hasAlpha = image.hasAlphaChannel();
 }
 
 int RGBA32Buffer::width() const
diff --git a/src/3rdparty/webkit/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp b/src/3rdparty/webkit/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
deleted file mode 100644
index 3cadf1cf05..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "ImageDecoder.h"
-
-// FIXME: Are all these needed?
-#include <wx/defs.h>
-#include <wx/bitmap.h>
-#if USE(WXGC)
-#include <wx/graphics.h>
-#endif
-#include <wx/image.h>
-#include <wx/rawbmp.h>
-
-namespace WebCore {
-
-NativeImagePtr RGBA32Buffer::asNewNativeImage() const
-{
-    wxBitmap* bmp = new wxBitmap(width(), height(), 32);
-    typedef wxPixelData<wxBitmap, wxAlphaPixelFormat> WxPixelData;
-    WxPixelData data(*bmp);
-    
-    // NB: It appears that the data is in BGRA format instead of RGBA format.
-    // This code works properly on both ppc and intel, meaning the issue is
-    // likely not an issue of byte order getting mixed up on different archs. 
-    const unsigned char* bytes = (const unsigned char*)m_bytes.data();
-    int rowCounter = 0;
-    long pixelCounter = 0;
-    WxPixelData::Iterator p(data);
-    WxPixelData::Iterator rowStart = p; 
-    for (size_t i = 0; i < m_bytes.size() * sizeof(PixelData); i += sizeof(PixelData)) {
-        p.Red() = bytes[i+2];
-        p.Green() = bytes[i+1];
-        p.Blue() = bytes[i+0];
-        p.Alpha() = bytes[i+3];
-        
-        p++;
-
-        pixelCounter++;
-        if ((pixelCounter % width()) == 0) {
-            rowCounter++;
-            p = rowStart;
-            p.MoveTo(data, 0, rowCounter);
-        }
-    }
-#if !wxCHECK_VERSION(2,9,0)
-    bmp->UseAlpha();
-#endif
-    ASSERT(bmp->IsOk());
-
-#if USE(WXGC)
-    wxGraphicsBitmap* bitmap = new wxGraphicsBitmap(wxGraphicsRenderer::GetDefaultRenderer()->CreateBitmap(*bmp));
-    delete bmp;
-    return bitmap;
-#else
-    return bmp;
-#endif
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h
index 3d3c78eff1..adde09c547 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h
@@ -72,6 +72,7 @@ public:
 #endif
     virtual void writeRange(Range*, Frame* frame);
     virtual void writeURL(const KURL&, const String&, Frame* frame);
+    virtual void writePlainText(const String&);
     
     // Methods for getting info in Cocoa's type system
     NSImage *dragNSImage(NSPoint&) const; // loc converted from dragLoc, based on whole image size
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
index f4321ad263..ddfa0d569b 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
@@ -367,7 +367,12 @@ void ClipboardMac::writeRange(Range* range, Frame* frame)
     ASSERT(frame);
     Pasteboard::writeSelection(m_pasteboard.get(), range, frame->editor()->smartInsertDeleteEnabled() && frame->selectionGranularity() == WordGranularity, frame);
 }
-    
+
+void ClipboardMac::writePlainText(const String& text)
+{
+    Pasteboard::writePlainText(m_pasteboard.get(), text);
+}
+
 void ClipboardMac::writeURL(const KURL& url, const String& title, Frame* frame)
 {   
     ASSERT(frame);
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/CookieJar.mm b/src/3rdparty/webkit/WebCore/platform/mac/CookieJar.mm
index e1d3e5aaac..df24b0363f 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/CookieJar.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/CookieJar.mm
@@ -86,6 +86,18 @@ String cookies(const Document*, const KURL& url)
     return String();
 }
 
+String cookieRequestHeaderFieldValue(const Document*, const KURL& url)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+
+    NSURL *cookieURL = url;
+    NSArray *cookies = [[NSHTTPCookieStorage sharedHTTPCookieStorage] cookiesForURL:cookieURL];
+    return [[NSHTTPCookie requestHeaderFieldsWithCookies:cookies] objectForKey:@"Cookie"];
+
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
 void setCookies(Document* document, const KURL& url, const String& cookieStr)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.mm
index 1093e6955f..9c781ad074 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.mm
@@ -25,7 +25,7 @@
 
 #import "config.h"
 
-#if ENABLE(GEOLOCATION)
+#if ENABLE(GEOLOCATION) && !ENABLE(CLIENT_BASED_GEOLOCATION)
 
 #import "GeolocationServiceMac.h"
 
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/KeyEventMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/KeyEventMac.mm
index b6c3b21570..14ad2e4752 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/KeyEventMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/KeyEventMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2007, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,342 +20,22 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #import "config.h"
 #import "PlatformKeyboardEvent.h"
 
+#if PLATFORM(MAC)
+
+#import "KeyEventCocoa.h"
 #import "Logging.h"
 #import <Carbon/Carbon.h>
-#import <wtf/ASCIICType.h>
 
 using namespace WTF;
 
 namespace WebCore {
 
-static String keyIdentifierForKeyEvent(NSEvent* event)
-{
-    if ([event type] == NSFlagsChanged) 
-        switch ([event keyCode]) {
-            case 54: // Right Command
-            case 55: // Left Command
-                return "Meta";
-                
-            case 57: // Capslock
-                return "CapsLock";
-                
-            case 56: // Left Shift
-            case 60: // Right Shift
-                return "Shift";
-                
-            case 58: // Left Alt
-            case 61: // Right Alt
-                return "Alt";
-                
-            case 59: // Left Ctrl
-            case 62: // Right Ctrl
-                return "Control";
-                
-            default:
-                ASSERT_NOT_REACHED();
-                return "";
-        }
-    
-    NSString *s = [event charactersIgnoringModifiers];
-    if ([s length] != 1) {
-        LOG(Events, "received an unexpected number of characters in key event: %u", [s length]);
-        return "Unidentified";
-    }
-    unichar c = [s characterAtIndex:0];
-    switch (c) {
-        // Each identifier listed in the DOM spec is listed here.
-        // Many are simply commented out since they do not appear on standard Macintosh keyboards
-        // or are on a key that doesn't have a corresponding character.
-
-        // "Accept"
-        // "AllCandidates"
-
-        // "Alt"
-        case NSMenuFunctionKey:
-            return "Alt";
-
-        // "Apps"
-        // "BrowserBack"
-        // "BrowserForward"
-        // "BrowserHome"
-        // "BrowserRefresh"
-        // "BrowserSearch"
-        // "BrowserStop"
-        // "CapsLock"
-
-        // "Clear"
-        case NSClearLineFunctionKey:
-            return "Clear";
-
-        // "CodeInput"
-        // "Compose"
-        // "Control"
-        // "Crsel"
-        // "Convert"
-        // "Copy"
-        // "Cut"
-
-        // "Down"
-        case NSDownArrowFunctionKey:
-            return "Down";
-        // "End"
-        case NSEndFunctionKey:
-            return "End";
-        // "Enter"
-        case 0x3: case 0xA: case 0xD: // Macintosh calls the one on the main keyboard Return, but Windows calls it Enter, so we'll do the same for the DOM
-            return "Enter";
-
-        // "EraseEof"
-
-        // "Execute"
-        case NSExecuteFunctionKey:
-            return "Execute";
-
-        // "Exsel"
-
-        // "F1"
-        case NSF1FunctionKey:
-            return "F1";
-        // "F2"
-        case NSF2FunctionKey:
-            return "F2";
-        // "F3"
-        case NSF3FunctionKey:
-            return "F3";
-        // "F4"
-        case NSF4FunctionKey:
-            return "F4";
-        // "F5"
-        case NSF5FunctionKey:
-            return "F5";
-        // "F6"
-        case NSF6FunctionKey:
-            return "F6";
-        // "F7"
-        case NSF7FunctionKey:
-            return "F7";
-        // "F8"
-        case NSF8FunctionKey:
-            return "F8";
-        // "F9"
-        case NSF9FunctionKey:
-            return "F9";
-        // "F10"
-        case NSF10FunctionKey:
-            return "F10";
-        // "F11"
-        case NSF11FunctionKey:
-            return "F11";
-        // "F12"
-        case NSF12FunctionKey:
-            return "F12";
-        // "F13"
-        case NSF13FunctionKey:
-            return "F13";
-        // "F14"
-        case NSF14FunctionKey:
-            return "F14";
-        // "F15"
-        case NSF15FunctionKey:
-            return "F15";
-        // "F16"
-        case NSF16FunctionKey:
-            return "F16";
-        // "F17"
-        case NSF17FunctionKey:
-            return "F17";
-        // "F18"
-        case NSF18FunctionKey:
-            return "F18";
-        // "F19"
-        case NSF19FunctionKey:
-            return "F19";
-        // "F20"
-        case NSF20FunctionKey:
-            return "F20";
-        // "F21"
-        case NSF21FunctionKey:
-            return "F21";
-        // "F22"
-        case NSF22FunctionKey:
-            return "F22";
-        // "F23"
-        case NSF23FunctionKey:
-            return "F23";
-        // "F24"
-        case NSF24FunctionKey:
-            return "F24";
-
-        // "FinalMode"
-
-        // "Find"
-        case NSFindFunctionKey:
-            return "Find";
-
-        // "FullWidth"
-        // "HalfWidth"
-        // "HangulMode"
-        // "HanjaMode"
-
-        // "Help"
-        case NSHelpFunctionKey:
-            return "Help";
-
-        // "Hiragana"
-
-        // "Home"
-        case NSHomeFunctionKey:
-            return "Home";
-        // "Insert"
-        case NSInsertFunctionKey:
-            return "Insert";
-
-        // "JapaneseHiragana"
-        // "JapaneseKatakana"
-        // "JapaneseRomaji"
-        // "JunjaMode"
-        // "KanaMode"
-        // "KanjiMode"
-        // "Katakana"
-        // "LaunchApplication1"
-        // "LaunchApplication2"
-        // "LaunchMail"
-
-        // "Left"
-        case NSLeftArrowFunctionKey:
-            return "Left";
-
-        // "Meta"
-        // "MediaNextTrack"
-        // "MediaPlayPause"
-        // "MediaPreviousTrack"
-        // "MediaStop"
-
-        // "ModeChange"
-        case NSModeSwitchFunctionKey:
-            return "ModeChange";
-
-        // "Nonconvert"
-        // "NumLock"
-
-        // "PageDown"
-        case NSPageDownFunctionKey:
-            return "PageDown";
-        // "PageUp"
-        case NSPageUpFunctionKey:
-            return "PageUp";
-
-        // "Paste"
-
-        // "Pause"
-        case NSPauseFunctionKey:
-            return "Pause";
-
-        // "Play"
-        // "PreviousCandidate"
-
-        // "PrintScreen"
-        case NSPrintScreenFunctionKey:
-            return "PrintScreen";
-
-        // "Process"
-        // "Props"
-
-        // "Right"
-        case NSRightArrowFunctionKey:
-            return "Right";
-
-        // "RomanCharacters"
-
-        // "Scroll"
-        case NSScrollLockFunctionKey:
-            return "Scroll";
-        // "Select"
-        case NSSelectFunctionKey:
-            return "Select";
-
-        // "SelectMedia"
-        // "Shift"
-
-        // "Stop"
-        case NSStopFunctionKey:
-            return "Stop";
-        // "Up"
-        case NSUpArrowFunctionKey:
-            return "Up";
-        // "Undo"
-        case NSUndoFunctionKey:
-            return "Undo";
-
-        // "VolumeDown"
-        // "VolumeMute"
-        // "VolumeUp"
-        // "Win"
-        // "Zoom"
-
-        // More function keys, not in the key identifier specification.
-        case NSF25FunctionKey:
-            return "F25";
-        case NSF26FunctionKey:
-            return "F26";
-        case NSF27FunctionKey:
-            return "F27";
-        case NSF28FunctionKey:
-            return "F28";
-        case NSF29FunctionKey:
-            return "F29";
-        case NSF30FunctionKey:
-            return "F30";
-        case NSF31FunctionKey:
-            return "F31";
-        case NSF32FunctionKey:
-            return "F32";
-        case NSF33FunctionKey:
-            return "F33";
-        case NSF34FunctionKey:
-            return "F34";
-        case NSF35FunctionKey:
-            return "F35";
-
-        // Turn 0x7F into 0x08, because backspace needs to always be 0x08.
-        case 0x7F:
-            return "U+0008";
-        // Standard says that DEL becomes U+007F.
-        case NSDeleteFunctionKey:
-            return "U+007F";
-            
-        // Always use 0x09 for tab instead of AppKit's backtab character.
-        case NSBackTabCharacter:
-            return "U+0009";
-
-        case NSBeginFunctionKey:
-        case NSBreakFunctionKey:
-        case NSClearDisplayFunctionKey:
-        case NSDeleteCharFunctionKey:
-        case NSDeleteLineFunctionKey:
-        case NSInsertCharFunctionKey:
-        case NSInsertLineFunctionKey:
-        case NSNextFunctionKey:
-        case NSPrevFunctionKey:
-        case NSPrintFunctionKey:
-        case NSRedoFunctionKey:
-        case NSResetFunctionKey:
-        case NSSysReqFunctionKey:
-        case NSSystemFunctionKey:
-        case NSUserFunctionKey:
-            // FIXME: We should use something other than the vendor-area Unicode values for the above keys.
-            // For now, just fall through to the default.
-        default:
-            return String::format("U+%04X", toASCIIUpper(c));
-    }
-}
-
 static bool isKeypadEvent(NSEvent* event)
 {
     // Check that this is the type of event that has a keyCode.
@@ -368,6 +48,9 @@ static bool isKeypadEvent(NSEvent* event)
             return false;
     }
 
+    if ([event modifierFlags] & NSNumericPadKeyMask)
+        return true;
+
     switch ([event keyCode]) {
         case 71: // Clear
         case 81: // =
@@ -389,376 +72,8 @@ static bool isKeypadEvent(NSEvent* event)
         case 92: // 9
             return true;
      }
-     
-     return false;
-}
-
-static int windowsKeyCodeForKeyEvent(NSEvent* event)
-{
-    switch ([event keyCode]) {
-        // VK_TAB (09) TAB key
-        case 48: return 0x09;
-
-        // VK_APPS (5D) Right windows/meta key
-        case 54: // Right Command
-            return 0x5D;
-            
-        // VK_LWIN (5B) Left windows/meta key
-        case 55: // Left Command
-            return 0x5B;
-            
-        // VK_CAPITAL (14) caps locks key
-        case 57: // Capslock
-            return 0x14;
-            
-        // VK_SHIFT (10) either shift key
-        case 56: // Left Shift
-        case 60: // Right Shift
-            return 0x10;
-            
-        // VK_MENU (12) either alt key
-        case 58: // Left Alt
-        case 61: // Right Alt
-            return 0x12;
-            
-        // VK_CONTROL (11) either ctrl key
-        case 59: // Left Ctrl
-        case 62: // Right Ctrl
-            return 0x11;
-            
-        // VK_CLEAR (0C) CLEAR key
-        case 71: return 0x0C;
-
-        // VK_NUMPAD0 (60) Numeric keypad 0 key
-        case 82: return 0x60;
-        // VK_NUMPAD1 (61) Numeric keypad 1 key
-        case 83: return 0x61;
-        // VK_NUMPAD2 (62) Numeric keypad 2 key
-        case 84: return 0x62;
-        // VK_NUMPAD3 (63) Numeric keypad 3 key
-        case 85: return 0x63;
-        // VK_NUMPAD4 (64) Numeric keypad 4 key
-        case 86: return 0x64;
-        // VK_NUMPAD5 (65) Numeric keypad 5 key
-        case 87: return 0x65;
-        // VK_NUMPAD6 (66) Numeric keypad 6 key
-        case 88: return 0x66;
-        // VK_NUMPAD7 (67) Numeric keypad 7 key
-        case 89: return 0x67;
-        // VK_NUMPAD8 (68) Numeric keypad 8 key
-        case 91: return 0x68;
-        // VK_NUMPAD9 (69) Numeric keypad 9 key
-        case 92: return 0x69;
-        // VK_MULTIPLY (6A) Multiply key
-        case 67: return 0x6A;
-        // VK_ADD (6B) Add key
-        case 69: return 0x6B;
-
-        // VK_SUBTRACT (6D) Subtract key
-        case 78: return 0x6D;
-        // VK_DECIMAL (6E) Decimal key
-        case 65: return 0x6E;
-        // VK_DIVIDE (6F) Divide key
-        case 75: return 0x6F;
-     }
-
-    NSString* s = [event charactersIgnoringModifiers];
-    if ([s length] != 1)
-        return 0;
-
-    switch ([s characterAtIndex:0]) {
-        // VK_LBUTTON (01) Left mouse button
-        // VK_RBUTTON (02) Right mouse button
-        // VK_CANCEL (03) Control-break processing
-        // VK_MBUTTON (04) Middle mouse button (three-button mouse)
-        // VK_XBUTTON1 (05)
-        // VK_XBUTTON2 (06)
-
-        // VK_BACK (08) BACKSPACE key
-        case 8: case 0x7F: return 0x08;
-        // VK_TAB (09) TAB key
-        case 9: return 0x09;
-
-        // VK_CLEAR (0C) CLEAR key
-        // handled by key code above
-
-        // VK_RETURN (0D)
-        case 0xD: case 3: return 0x0D;
-
-        // VK_SHIFT (10) SHIFT key
-        // VK_CONTROL (11) CTRL key
-        // VK_MENU (12) ALT key
-
-        // VK_PAUSE (13) PAUSE key
-        case NSPauseFunctionKey: return 0x13;
-
-        // VK_CAPITAL (14) CAPS LOCK key
-        // VK_KANA (15) Input Method Editor (IME) Kana mode
-        // VK_HANGUEL (15) IME Hanguel mode (maintained for compatibility; use VK_HANGUL)
-        // VK_HANGUL (15) IME Hangul mode
-        // VK_JUNJA (17) IME Junja mode
-        // VK_FINAL (18) IME final mode
-        // VK_HANJA (19) IME Hanja mode
-        // VK_KANJI (19) IME Kanji mode
-
-        // VK_ESCAPE (1B) ESC key
-        case 0x1B: return 0x1B;
-
-        // VK_CONVERT (1C) IME convert
-        // VK_NONCONVERT (1D) IME nonconvert
-        // VK_ACCEPT (1E) IME accept
-        // VK_MODECHANGE (1F) IME mode change request
-
-        // VK_SPACE (20) SPACEBAR
-        case ' ': return 0x20;
-        // VK_PRIOR (21) PAGE UP key
-        case NSPageUpFunctionKey: return 0x21;
-        // VK_NEXT (22) PAGE DOWN key
-        case NSPageDownFunctionKey: return 0x22;
-        // VK_END (23) END key
-        case NSEndFunctionKey: return 0x23;
-        // VK_HOME (24) HOME key
-        case NSHomeFunctionKey: return 0x24;
-        // VK_LEFT (25) LEFT ARROW key
-        case NSLeftArrowFunctionKey: return 0x25;
-        // VK_UP (26) UP ARROW key
-        case NSUpArrowFunctionKey: return 0x26;
-        // VK_RIGHT (27) RIGHT ARROW key
-        case NSRightArrowFunctionKey: return 0x27;
-        // VK_DOWN (28) DOWN ARROW key
-        case NSDownArrowFunctionKey: return 0x28;
-        // VK_SELECT (29) SELECT key
-        case NSSelectFunctionKey: return 0x29;
-        // VK_PRINT (2A) PRINT key
-        case NSPrintFunctionKey: return 0x2A;
-        // VK_EXECUTE (2B) EXECUTE key
-        case NSExecuteFunctionKey: return 0x2B;
-        // VK_SNAPSHOT (2C) PRINT SCREEN key
-        case NSPrintScreenFunctionKey: return 0x2C;
-        // VK_INSERT (2D) INS key
-        case NSInsertFunctionKey: case NSHelpFunctionKey: return 0x2D;
-        // VK_DELETE (2E) DEL key
-        case NSDeleteFunctionKey: return 0x2E;
-
-        // VK_HELP (2F) HELP key
-
-        //  (30) 0 key
-        case '0': case ')': return 0x30;
-        //  (31) 1 key
-        case '1': case '!': return 0x31;
-        //  (32) 2 key
-        case '2': case '@': return 0x32;
-        //  (33) 3 key
-        case '3': case '#': return 0x33;
-        //  (34) 4 key
-        case '4': case '$': return 0x34;
-        //  (35) 5 key
-        case '5': case '%': return 0x35;
-        //  (36) 6 key
-        case '6': case '^': return 0x36;
-        //  (37) 7 key
-        case '7': case '&': return 0x37;
-        //  (38) 8 key
-        case '8': case '*': return 0x38;
-        //  (39) 9 key
-        case '9': case '(': return 0x39;
-        //  (41) A key
-        case 'a': case 'A': return 0x41;
-        //  (42) B key
-        case 'b': case 'B': return 0x42;
-        //  (43) C key
-        case 'c': case 'C': return 0x43;
-        //  (44) D key
-        case 'd': case 'D': return 0x44;
-        //  (45) E key
-        case 'e': case 'E': return 0x45;
-        //  (46) F key
-        case 'f': case 'F': return 0x46;
-        //  (47) G key
-        case 'g': case 'G': return 0x47;
-        //  (48) H key
-        case 'h': case 'H': return 0x48;
-        //  (49) I key
-        case 'i': case 'I': return 0x49;
-        //  (4A) J key
-        case 'j': case 'J': return 0x4A;
-        //  (4B) K key
-        case 'k': case 'K': return 0x4B;
-        //  (4C) L key
-        case 'l': case 'L': return 0x4C;
-        //  (4D) M key
-        case 'm': case 'M': return 0x4D;
-        //  (4E) N key
-        case 'n': case 'N': return 0x4E;
-        //  (4F) O key
-        case 'o': case 'O': return 0x4F;
-        //  (50) P key
-        case 'p': case 'P': return 0x50;
-        //  (51) Q key
-        case 'q': case 'Q': return 0x51;
-        //  (52) R key
-        case 'r': case 'R': return 0x52;
-        //  (53) S key
-        case 's': case 'S': return 0x53;
-        //  (54) T key
-        case 't': case 'T': return 0x54;
-        //  (55) U key
-        case 'u': case 'U': return 0x55;
-        //  (56) V key
-        case 'v': case 'V': return 0x56;
-        //  (57) W key
-        case 'w': case 'W': return 0x57;
-        //  (58) X key
-        case 'x': case 'X': return 0x58;
-        //  (59) Y key
-        case 'y': case 'Y': return 0x59;
-        //  (5A) Z key
-        case 'z': case 'Z': return 0x5A;
-
-        // VK_LWIN (5B) Left Windows key (Microsoft Natural keyboard)
-        // VK_RWIN (5C) Right Windows key (Natural keyboard)
-        // VK_APPS (5D) Applications key (Natural keyboard)
-        // VK_SLEEP (5F) Computer Sleep key
-
-        // VK_NUMPAD0 (60) Numeric keypad 0 key
-        // VK_NUMPAD1 (61) Numeric keypad 1 key
-        // VK_NUMPAD2 (62) Numeric keypad 2 key
-        // VK_NUMPAD3 (63) Numeric keypad 3 key
-        // VK_NUMPAD4 (64) Numeric keypad 4 key
-        // VK_NUMPAD5 (65) Numeric keypad 5 key
-        // VK_NUMPAD6 (66) Numeric keypad 6 key
-        // VK_NUMPAD7 (67) Numeric keypad 7 key
-        // VK_NUMPAD8 (68) Numeric keypad 8 key
-        // VK_NUMPAD9 (69) Numeric keypad 9 key
-        // VK_MULTIPLY (6A) Multiply key
-        // VK_ADD (6B) Add key
-        // handled by key code above
-
-        // VK_SEPARATOR (6C) Separator key
-
-        // VK_SUBTRACT (6D) Subtract key
-        // VK_DECIMAL (6E) Decimal key
-        // VK_DIVIDE (6F) Divide key
-        // handled by key code above
-
-        // VK_F1 (70) F1 key
-        case NSF1FunctionKey: return 0x70;
-        // VK_F2 (71) F2 key
-        case NSF2FunctionKey: return 0x71;
-        // VK_F3 (72) F3 key
-        case NSF3FunctionKey: return 0x72;
-        // VK_F4 (73) F4 key
-        case NSF4FunctionKey: return 0x73;
-        // VK_F5 (74) F5 key
-        case NSF5FunctionKey: return 0x74;
-        // VK_F6 (75) F6 key
-        case NSF6FunctionKey: return 0x75;
-        // VK_F7 (76) F7 key
-        case NSF7FunctionKey: return 0x76;
-        // VK_F8 (77) F8 key
-        case NSF8FunctionKey: return 0x77;
-        // VK_F9 (78) F9 key
-        case NSF9FunctionKey: return 0x78;
-        // VK_F10 (79) F10 key
-        case NSF10FunctionKey: return 0x79;
-        // VK_F11 (7A) F11 key
-        case NSF11FunctionKey: return 0x7A;
-        // VK_F12 (7B) F12 key
-        case NSF12FunctionKey: return 0x7B;
-        // VK_F13 (7C) F13 key
-        case NSF13FunctionKey: return 0x7C;
-        // VK_F14 (7D) F14 key
-        case NSF14FunctionKey: return 0x7D;
-        // VK_F15 (7E) F15 key
-        case NSF15FunctionKey: return 0x7E;
-        // VK_F16 (7F) F16 key
-        case NSF16FunctionKey: return 0x7F;
-        // VK_F17 (80H) F17 key
-        case NSF17FunctionKey: return 0x80;
-        // VK_F18 (81H) F18 key
-        case NSF18FunctionKey: return 0x81;
-        // VK_F19 (82H) F19 key
-        case NSF19FunctionKey: return 0x82;
-        // VK_F20 (83H) F20 key
-        case NSF20FunctionKey: return 0x83;
-        // VK_F21 (84H) F21 key
-        case NSF21FunctionKey: return 0x84;
-        // VK_F22 (85H) F22 key
-        case NSF22FunctionKey: return 0x85;
-        // VK_F23 (86H) F23 key
-        case NSF23FunctionKey: return 0x86;
-        // VK_F24 (87H) F24 key
-        case NSF24FunctionKey: return 0x87;
-
-        // VK_NUMLOCK (90) NUM LOCK key
-
-        // VK_SCROLL (91) SCROLL LOCK key
-        case NSScrollLockFunctionKey: return 0x91;
-
-        // VK_LSHIFT (A0) Left SHIFT key
-        // VK_RSHIFT (A1) Right SHIFT key
-        // VK_LCONTROL (A2) Left CONTROL key
-        // VK_RCONTROL (A3) Right CONTROL key
-        // VK_LMENU (A4) Left MENU key
-        // VK_RMENU (A5) Right MENU key
-        // VK_BROWSER_BACK (A6) Windows 2000/XP: Browser Back key
-        // VK_BROWSER_FORWARD (A7) Windows 2000/XP: Browser Forward key
-        // VK_BROWSER_REFRESH (A8) Windows 2000/XP: Browser Refresh key
-        // VK_BROWSER_STOP (A9) Windows 2000/XP: Browser Stop key
-        // VK_BROWSER_SEARCH (AA) Windows 2000/XP: Browser Search key
-        // VK_BROWSER_FAVORITES (AB) Windows 2000/XP: Browser Favorites key
-        // VK_BROWSER_HOME (AC) Windows 2000/XP: Browser Start and Home key
-        // VK_VOLUME_MUTE (AD) Windows 2000/XP: Volume Mute key
-        // VK_VOLUME_DOWN (AE) Windows 2000/XP: Volume Down key
-        // VK_VOLUME_UP (AF) Windows 2000/XP: Volume Up key
-        // VK_MEDIA_NEXT_TRACK (B0) Windows 2000/XP: Next Track key
-        // VK_MEDIA_PREV_TRACK (B1) Windows 2000/XP: Previous Track key
-        // VK_MEDIA_STOP (B2) Windows 2000/XP: Stop Media key
-        // VK_MEDIA_PLAY_PAUSE (B3) Windows 2000/XP: Play/Pause Media key
-        // VK_LAUNCH_MAIL (B4) Windows 2000/XP: Start Mail key
-        // VK_LAUNCH_MEDIA_SELECT (B5) Windows 2000/XP: Select Media key
-        // VK_LAUNCH_APP1 (B6) Windows 2000/XP: Start Application 1 key
-        // VK_LAUNCH_APP2 (B7) Windows 2000/XP: Start Application 2 key
-
-        // VK_OEM_1 (BA) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the ';:' key
-        case ';': case ':': return 0xBA;
-        // VK_OEM_PLUS (BB) Windows 2000/XP: For any country/region, the '+' key
-        case '=': case '+': return 0xBB;
-        // VK_OEM_COMMA (BC) Windows 2000/XP: For any country/region, the ',' key
-        case ',': case '<': return 0xBC;
-        // VK_OEM_MINUS (BD) Windows 2000/XP: For any country/region, the '-' key
-        case '-': case '_': return 0xBD;
-        // VK_OEM_PERIOD (BE) Windows 2000/XP: For any country/region, the '.' key
-        case '.': case '>': return 0xBE;
-        // VK_OEM_2 (BF) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '/?' key
-        case '/': case '?': return 0xBF;
-        // VK_OEM_3 (C0) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '`~' key
-        case '`': case '~': return 0xC0;
-        // VK_OEM_4 (DB) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '[{' key
-        case '[': case '{': return 0xDB;
-        // VK_OEM_5 (DC) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '\|' key
-        case '\\': case '|': return 0xDC;
-        // VK_OEM_6 (DD) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the ']}' key
-        case ']': case '}': return 0xDD;
-        // VK_OEM_7 (DE) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the 'single-quote/double-quote' key
-        case '\'': case '"': return 0xDE;
-
-        // VK_OEM_8 (DF) Used for miscellaneous characters; it can vary by keyboard.
-        // VK_OEM_102 (E2) Windows 2000/XP: Either the angle bracket key or the backslash key on the RT 102-key keyboard
-        // VK_PROCESSKEY (E5) Windows 95/98/Me, Windows NT 4.0, Windows 2000/XP: IME PROCESS key
-        // VK_PACKET (E7) Windows 2000/XP: Used to pass Unicode characters as if they were keystrokes. The VK_PACKET key is the low word of a 32-bit Virtual Key value used for non-keyboard input methods. For more information, see Remark in KEYBDINPUT,SendInput, WM_KEYDOWN, and WM_KEYUP
-        // VK_ATTN (F6) Attn key
-        // VK_CRSEL (F7) CrSel key
-        // VK_EXSEL (F8) ExSel key
-        // VK_EREOF (F9) Erase EOF key
-        // VK_PLAY (FA) Play key
-        // VK_ZOOM (FB) Zoom key
-        // VK_NONAME (FC) Reserved for future use
-        // VK_PA1 (FD) PA1 key
-        // VK_OEM_CLEAR (FE) Clear key
-    }
 
-    return 0;
+     return false;
 }
 
 static inline bool isKeyUpEvent(NSEvent *event)
@@ -771,22 +86,22 @@ static inline bool isKeyUpEvent(NSEvent *event)
         case 54: // Right Command
         case 55: // Left Command
             return ([event modifierFlags] & NSCommandKeyMask) == 0;
-            
+
         case 57: // Capslock
             return ([event modifierFlags] & NSAlphaShiftKeyMask) == 0;
-            
+
         case 56: // Left Shift
         case 60: // Right Shift
             return ([event modifierFlags] & NSShiftKeyMask) == 0;
-            
+
         case 58: // Left Alt
         case 61: // Right Alt
             return ([event modifierFlags] & NSAlternateKeyMask) == 0;
-            
+
         case 59: // Left Ctrl
         case 62: // Right Ctrl
             return ([event modifierFlags] & NSControlKeyMask) == 0;
-            
+
         case 63: // Function
             return ([event modifierFlags] & NSFunctionKeyMask) == 0;
     }
@@ -799,8 +114,8 @@ static inline String textFromEvent(NSEvent* event)
         return "";
     return [event characters];
 }
-    
-    
+
+
 static inline String unmodifiedTextFromEvent(NSEvent* event)
 {
     if ([event type] == NSFlagsChanged)
@@ -808,6 +123,54 @@ static inline String unmodifiedTextFromEvent(NSEvent* event)
     return [event charactersIgnoringModifiers];
 }
 
+static String keyIdentifierForKeyEvent(NSEvent* event)
+{
+    if ([event type] == NSFlagsChanged)
+        switch ([event keyCode]) {
+            case 54: // Right Command
+            case 55: // Left Command
+                return "Meta";
+
+            case 57: // Capslock
+                return "CapsLock";
+
+            case 56: // Left Shift
+            case 60: // Right Shift
+                return "Shift";
+
+            case 58: // Left Alt
+            case 61: // Right Alt
+                return "Alt";
+
+            case 59: // Left Ctrl
+            case 62: // Right Ctrl
+                return "Control";
+
+            default:
+                ASSERT_NOT_REACHED();
+                return "";
+        }
+
+    NSString *s = [event charactersIgnoringModifiers];
+    if ([s length] != 1) {
+        LOG(Events, "received an unexpected number of characters in key event: %u", [s length]);
+        return "Unidentified";
+    }
+    return keyIdentifierForCharCode([s characterAtIndex:0]);
+}
+
+static int windowsKeyCodeForKeyEvent(NSEvent *event)
+{
+    int code = windowsKeyCodeForKeyCode([event keyCode]);
+    if (code)
+        return code;
+
+    NSString* s = [event charactersIgnoringModifiers];
+    if ([s length] != 1)
+        return 0;
+    return windowsKeyCodeForCharCode([s characterAtIndex:0]);
+}
+
 PlatformKeyboardEvent::PlatformKeyboardEvent(NSEvent *event)
     : m_type(isKeyUpEvent(event) ? PlatformKeyboardEvent::KeyUp : PlatformKeyboardEvent::KeyDown)
     , m_text(textFromEvent(event))
@@ -873,4 +236,15 @@ bool PlatformKeyboardEvent::currentCapsLockState()
     return GetCurrentKeyModifiers() & alphaLock;
 }
 
+void PlatformKeyboardEvent::getCurrentModifierState(bool& shiftKey, bool& ctrlKey, bool& altKey, bool& metaKey)
+{
+    UInt32 currentModifiers = GetCurrentKeyModifiers();
+    shiftKey = currentModifiers & ::shiftKey;
+    ctrlKey = currentModifiers & ::controlKey;
+    altKey = currentModifiers & ::optionKey;
+    metaKey = currentModifiers & ::cmdKey;
+}
+
 }
+
+#endif // PLATFORM(MAC)
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/LocalizedStringsMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/LocalizedStringsMac.mm
index 261347f0a6..68f07b53fe 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/LocalizedStringsMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/LocalizedStringsMac.mm
@@ -683,6 +683,30 @@ String AXLinkActionVerb()
     return String();
 }
 
+String AXMenuListPopupActionVerb()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] AXMenuListPopupActionVerb];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String AXMenuListActionVerb()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] AXMenuListActionVerb];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String missingPluginText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] missingPluginText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
 String multipleFileUploadText(unsigned numberOfFiles)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
@@ -747,5 +771,60 @@ String localizedMediaTimeDescription(float time)
     return String();
 }
 
+String validationMessageValueMissingText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageValueMissingText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessageTypeMismatchText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageTypeMismatchText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessagePatternMismatchText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessagePatternMismatchText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessageTooLongText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageTooLongText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessageRangeUnderflowText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageRangeUnderflowText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessageRangeOverflowText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageRangeOverflowText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessageStepMismatchText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageStepMismatchText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/LoggingMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/LoggingMac.mm
index d3ba4d7a88..3e83579a64 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/LoggingMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/LoggingMac.mm
@@ -54,7 +54,7 @@ void InitializeLoggingChannelsIfNecessary()
     initializeWithUserDefault(LogPopupBlocking);
     initializeWithUserDefault(LogEvents);
     initializeWithUserDefault(LogEditing);
-    initializeWithUserDefault(LogTextConversion);
+    initializeWithUserDefault(LogLiveConnect);
     initializeWithUserDefault(LogIconDatabase);
     initializeWithUserDefault(LogSQLDatabase);
     initializeWithUserDefault(LogSpellingAndGrammar);
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm
index f048791d62..086b27245d 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm
@@ -136,7 +136,7 @@ static NSAttributedString *stripAttachmentCharacters(NSAttributedString *string)
 void Pasteboard::writeSelection(NSPasteboard* pasteboard, Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
     if (!WebArchivePboardType)
-        Pasteboard::generalPasteboard(); // Initialises pasteboard types
+        Pasteboard::generalPasteboard(); // Initializes pasteboard types.
     ASSERT(selectedRange);
     
     NSAttributedString *attributedString = [[[NSAttributedString alloc] _initWithDOMRange:kit(selectedRange)] autorelease];
@@ -197,6 +197,14 @@ void Pasteboard::writeSelection(NSPasteboard* pasteboard, Range* selectedRange,
         [pasteboard setData:nil forType:WebSmartPastePboardType];
     }
 }
+
+void Pasteboard::writePlainText(NSPasteboard* pasteboard, const String& text)
+{
+    NSArray *types = [NSArray arrayWithObject:NSStringPboardType];
+    [pasteboard declareTypes:types owner:nil];
+    
+    [pasteboard setString:text forType:NSStringPboardType];
+}
     
 void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
@@ -206,7 +214,7 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
 void Pasteboard::writePlainText(const String& text)
 {
     if (!WebArchivePboardType)
-        Pasteboard::generalPasteboard(); // Initialises pasteboard types
+        Pasteboard::generalPasteboard(); // Initializes pasteboard types.
 
     NSArray *types = [NSArray arrayWithObject:NSStringPboardType];
     NSPasteboard *pasteboard = m_pasteboard.get();
@@ -218,7 +226,7 @@ void Pasteboard::writePlainText(const String& text)
 void Pasteboard::writeURL(NSPasteboard* pasteboard, NSArray* types, const KURL& url, const String& titleStr, Frame* frame)
 {
     if (!WebArchivePboardType)
-        Pasteboard::generalPasteboard(); // Initialises pasteboard types
+        Pasteboard::generalPasteboard(); // Initializes pasteboard types.
    
     if (!types) {
         types = writableTypesForURL();
@@ -292,9 +300,7 @@ void Pasteboard::writeImage(Node* node, const KURL& url, const String& title)
     ASSERT(node->renderer() && node->renderer()->isImage());
     RenderImage* renderer = toRenderImage(node->renderer());
     CachedImage* cachedImage = renderer->cachedImage();
-    ASSERT(cachedImage);
-    
-    if (cachedImage->errorOccurred())
+    if (!cachedImage || cachedImage->errorOccurred())
         return;
 
     NSArray* types = writableTypesForImage();
@@ -372,7 +378,7 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
             }
         }
         if ([HTMLString length] != 0) {
-            RefPtr<DocumentFragment> fragment = createFragmentFromMarkup(frame->document(), HTMLString, "");
+            RefPtr<DocumentFragment> fragment = createFragmentFromMarkup(frame->document(), HTMLString, "", FragmentScriptingNotAllowed);
             if (fragment)
                 return fragment.release();
         }
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/PlatformMouseEventMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/PlatformMouseEventMac.mm
index 74f694e46c..5b84b4f566 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/PlatformMouseEventMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/PlatformMouseEventMac.mm
@@ -158,4 +158,22 @@ PlatformMouseEvent::PlatformMouseEvent(NSEvent* event, NSView *windowView)
 {
 }
 
+PlatformMouseEvent::PlatformMouseEvent(int x, int y, int globalX, int globalY, MouseButton button, MouseEventType eventType,
+                   int clickCount, bool shiftKey, bool ctrlKey, bool altKey, bool metaKey, double timestamp,
+                   unsigned modifierFlags, int eventNumber)
+    : m_position(IntPoint(x, y))
+    , m_globalPosition(IntPoint(globalX, globalY))
+    , m_button(button)
+    , m_eventType(eventType)
+    , m_clickCount(clickCount)
+    , m_shiftKey(shiftKey)
+    , m_ctrlKey(ctrlKey)
+    , m_altKey(altKey)
+    , m_metaKey(metaKey)
+    , m_timestamp(timestamp)
+    , m_modifierFlags(modifierFlags)
+    , m_eventNumber(eventNumber)
+{
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/PopupMenuMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/PopupMenuMac.mm
index dfb0fff8e0..0ecaa1333e 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/PopupMenuMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/PopupMenuMac.mm
@@ -20,6 +20,8 @@
 #import "config.h"
 #import "PopupMenu.h"
 
+#import "AXObjectCache.h"
+#import "Chrome.h"
 #import "ChromeClient.h"
 #import "EventHandler.h"
 #import "Frame.h"
@@ -80,8 +82,14 @@ void PopupMenu::populate()
         else {
             PopupMenuStyle style = client()->itemStyle(i);
             NSMutableDictionary* attributes = [[NSMutableDictionary alloc] init];
-            if (style.font() != Font())
-                [attributes setObject:style.font().primaryFont()->getNSFont() forKey:NSFontAttributeName];
+            if (style.font() != Font()) {
+                NSFont *font = style.font().primaryFont()->getNSFont();
+                if (!font) {
+                    CGFloat size = style.font().primaryFont()->platformData().size();
+                    font = style.font().weight() < FontWeightBold ? [NSFont systemFontOfSize:size] : [NSFont boldSystemFontOfSize:size];
+                }
+                [attributes setObject:font forKey:NSFontAttributeName];
+            }
             // FIXME: Add support for styling the foreground and background colors.
             // FIXME: Find a way to customize text color when an item is highlighted.
             NSAttributedString* string = [[NSAttributedString alloc] initWithString:client()->itemText(i) attributes:attributes];
@@ -93,12 +101,21 @@ void PopupMenu::populate()
             [menuItem setEnabled:client()->itemIsEnabled(i)];
             [menuItem setToolTip:client()->itemToolTip(i)];
             [string release];
+            
+            // Allow the accessible text of the item to be overriden if necessary.
+            if (AXObjectCache::accessibilityEnabled()) {
+                NSString *accessibilityOverride = client()->itemAccessibilityText(i);
+                if ([accessibilityOverride length])
+                    [menuItem accessibilitySetOverrideValue:accessibilityOverride forAttribute:NSAccessibilityDescriptionAttribute];
+            }
         }
     }
 
     [[m_popup.get() menu] setMenuChangedMessagesEnabled:messagesEnabled];
 }
 
+#if !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
 void PopupMenu::show(const IntRect& r, FrameView* v, int index)
 {
     populate();
@@ -179,6 +196,14 @@ void PopupMenu::show(const IntRect& r, FrameView* v, int index)
     [event release];
 }
 
+#else
+
+void PopupMenu::show(const IntRect&, FrameView*, int)
+{
+}
+
+#endif
+
 void PopupMenu::hide()
 {
     [m_popup.get() dismissPopUp];
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/PurgeableBufferMac.cpp b/src/3rdparty/webkit/WebCore/platform/mac/PurgeableBufferMac.cpp
index 1b49de0b96..9902f77ab1 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/PurgeableBufferMac.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/mac/PurgeableBufferMac.cpp
@@ -31,11 +31,12 @@
 
 #include <mach/mach.h>
 #include <wtf/Assertions.h>
+#include <wtf/VMTags.h>
 
 namespace WebCore {
-    
+
 static const size_t minPurgeableBufferSize = 4096; // one page
-    
+
 PurgeableBuffer::PurgeableBuffer(char* data, size_t size)
     : m_data(data)
     , m_size(size)
@@ -43,7 +44,7 @@ PurgeableBuffer::PurgeableBuffer(char* data, size_t size)
     , m_state(NonVolatile)
 {
 }
-    
+
 PurgeableBuffer::~PurgeableBuffer()
 {
     vm_deallocate(mach_task_self(), reinterpret_cast<vm_address_t>(m_data), m_size);
@@ -53,9 +54,9 @@ PurgeableBuffer* PurgeableBuffer::create(const char* data, size_t size)
 {
     if (size < minPurgeableBufferSize)
         return 0;
-    
+
     vm_address_t buffer = 0;
-    kern_return_t ret = vm_allocate(mach_task_self(), &buffer, size, VM_FLAGS_PURGABLE | VM_FLAGS_ANYWHERE);
+    kern_return_t ret = vm_allocate(mach_task_self(), &buffer, size, VM_FLAGS_PURGABLE | VM_FLAGS_ANYWHERE | VM_TAG_FOR_WEBCORE_PURGEABLE_MEMORY);
 
     ASSERT(ret == KERN_SUCCESS);
     if (ret != KERN_SUCCESS)
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/RuntimeApplicationChecks.h b/src/3rdparty/webkit/WebCore/platform/mac/RuntimeApplicationChecks.h
index f9c7079ed6..24b8ae188f 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/RuntimeApplicationChecks.h
+++ b/src/3rdparty/webkit/WebCore/platform/mac/RuntimeApplicationChecks.h
@@ -31,6 +31,7 @@ namespace WebCore {
 bool applicationIsAppleMail();
 bool applicationIsSafari();
 bool applicationIsMicrosoftMessenger();
+bool applicationIsAdobeInstaller();
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/RuntimeApplicationChecks.mm b/src/3rdparty/webkit/WebCore/platform/mac/RuntimeApplicationChecks.mm
index a3c4aa5eec..bcc1dc9828 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/RuntimeApplicationChecks.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/RuntimeApplicationChecks.mm
@@ -47,4 +47,10 @@ bool applicationIsMicrosoftMessenger()
     return isMicrosoftMessenger;
 }
 
+bool applicationIsAdobeInstaller()
+{
+    static bool isAdobeInstaller = [[[NSBundle mainBundle] bundleIdentifier] isEqualToString:@"com.adobe.Installers.Setup"];
+    return isAdobeInstaller;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ScrollViewMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ScrollViewMac.mm
index 202d49e2b7..7ef5dc436f 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ScrollViewMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ScrollViewMac.mm
@@ -107,13 +107,12 @@ bool ScrollView::platformCanBlitOnScroll() const
 
 IntRect ScrollView::platformVisibleContentRect(bool includeScrollbars) const
 {
-    BEGIN_BLOCK_OBJC_EXCEPTIONS; 
-    if (includeScrollbars) {
-        if (NSView* documentView = this->documentView())
-            return enclosingIntRect([documentView visibleRect]);
-    }
-    return enclosingIntRect([scrollView() documentVisibleRect]); 
-    END_BLOCK_OBJC_EXCEPTIONS; 
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    IntRect result = enclosingIntRect([scrollView() documentVisibleRect]);
+    if (includeScrollbars)
+        result.setSize(IntSize([scrollView() frame].size));
+    return result;
+    END_BLOCK_OBJC_EXCEPTIONS;
     return IntRect();
 }
 
@@ -203,4 +202,4 @@ bool ScrollView::platformIsOffscreen() const
     return ![platformWidget() window] || ![[platformWidget() window] isVisible];
 }
 
-}
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.h b/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.h
index 5af5fd54d9..c833ee7839 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.h
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.h
@@ -57,6 +57,8 @@ protected:
     virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
     virtual IntRect trackRect(Scrollbar*, bool painting = false);
 
+    virtual int maxOverlapBetweenPages() { return 40; }
+
     virtual int minimumThumbLength(Scrollbar*);
     
     virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.mm
index 0a20e2f892..067f28f0d2 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.mm
@@ -362,7 +362,7 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
     trackInfo.min = 0;
     trackInfo.max = scrollbar->maximum();
     trackInfo.value = scrollbar->currentPos();
-    trackInfo.trackInfo.scrollbar.viewsize = scrollbar->pageStep();
+    trackInfo.trackInfo.scrollbar.viewsize = scrollbar->visibleSize();
     trackInfo.attributes = 0;
     if (scrollbar->orientation() == HorizontalScrollbar)
         trackInfo.attributes |= kThemeTrackHorizontal;
@@ -396,7 +396,7 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
             return true;
         
         HIThemeDrawTrack(&trackInfo, 0, imageBuffer->context()->platformContext(), kHIThemeOrientationNormal);
-        context->drawImage(imageBuffer->image(), scrollbar->frameRect().location());
+        context->drawImage(imageBuffer->image(), DeviceColorSpace, scrollbar->frameRect().location());
     }
 
     return true;
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ThemeMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ThemeMac.mm
index fd2f944736..b71a651a47 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ThemeMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ThemeMac.mm
@@ -173,9 +173,9 @@ static LengthSize checkboxSize(const Font& font, const LengthSize& zoomedSize, f
     return sizeFromFont(font, zoomedSize, zoomFactor, checkboxSizes());
 }
 
-static NSButtonCell* checkbox(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+static NSButtonCell *checkbox(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
 {
-    static NSButtonCell* checkboxCell;
+    static NSButtonCell *checkboxCell;
     if (!checkboxCell) {
         checkboxCell = [[NSButtonCell alloc] init];
         [checkboxCell setButtonType:NSSwitchButton];
@@ -199,7 +199,7 @@ static void paintCheckbox(ControlStates states, GraphicsContext* context, const
     BEGIN_BLOCK_OBJC_EXCEPTIONS
 
     // Determine the width and height needed for the control and prepare the cell for painting.
-    NSButtonCell* checkboxCell = checkbox(states, zoomedRect, zoomFactor);
+    NSButtonCell *checkboxCell = checkbox(states, zoomedRect, zoomFactor);
 
     context->save();
 
@@ -254,9 +254,9 @@ static LengthSize radioSize(const Font& font, const LengthSize& zoomedSize, floa
     return sizeFromFont(font, zoomedSize, zoomFactor, radioSizes());
 }
 
-static NSButtonCell* radio(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+static NSButtonCell *radio(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
 {
-    static NSButtonCell* radioCell;
+    static NSButtonCell *radioCell;
     if (!radioCell) {
         radioCell = [[NSButtonCell alloc] init];
         [radioCell setButtonType:NSRadioButton];
@@ -276,7 +276,7 @@ static NSButtonCell* radio(ControlStates states, const IntRect& zoomedRect, floa
 static void paintRadio(ControlStates states, GraphicsContext* context, const IntRect& zoomedRect, float zoomFactor, ScrollView* scrollView)
 {
     // Determine the width and height needed for the control and prepare the cell for painting.
-    NSButtonCell* radioCell = radio(states, zoomedRect, zoomFactor);
+    NSButtonCell *radioCell = radio(states, zoomedRect, zoomFactor);
 
     context->save();
 
@@ -330,14 +330,14 @@ static const int* buttonMargins(NSControlSize controlSize)
     return margins[controlSize];
 }
 
-static NSButtonCell* button(ControlPart part, ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+static void setupButtonCell(NSButtonCell *&buttonCell, ControlPart part, ControlStates states, const IntRect& zoomedRect, float zoomFactor)
 {
-    static NSButtonCell *buttonCell;
-    static bool defaultButton;
     if (!buttonCell) {
         buttonCell = [[NSButtonCell alloc] init];
         [buttonCell setTitle:nil];
         [buttonCell setButtonType:NSMomentaryPushInButton];
+        if (states & DefaultState)
+            [buttonCell setKeyEquivalent:@"\r"];
     }
 
     // Set the control size based off the rectangle we're painting into.
@@ -355,17 +355,18 @@ static NSButtonCell* button(ControlPart part, ControlStates states, const IntRec
     } else if ([buttonCell bezelStyle] != NSRoundedBezelStyle)
         [buttonCell setBezelStyle:NSRoundedBezelStyle];
 
-    setControlSize(buttonCell, buttonSizes(), zoomedRect.size(), zoomFactor);
-
-    if (defaultButton != (states & DefaultState)) {
-        defaultButton = !defaultButton;
-        [buttonCell setKeyEquivalent:(defaultButton ? @"\r" : @"")];
-    }
+    setControlSize(buttonCell, sizes, zoomedRect.size(), zoomFactor);
 
     // Update the various states we respond to.
     updateStates(buttonCell, states);
+}
     
-    return buttonCell;
+static NSButtonCell *button(ControlPart part, ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+{
+    bool isDefault = states & DefaultState;
+    static NSButtonCell *cells[2];
+    setupButtonCell(cells[isDefault], part, states, zoomedRect, zoomFactor);    
+    return cells[isDefault];
 }
 
 static void paintButton(ControlPart part, ControlStates states, GraphicsContext* context, const IntRect& zoomedRect, float zoomFactor, ScrollView* scrollView)
@@ -408,15 +409,26 @@ static void paintButton(ControlPart part, ControlStates states, GraphicsContext*
     NSWindow *window = [view window];
     NSButtonCell *previousDefaultButtonCell = [window defaultButtonCell];
 
-    if ((states & DefaultState) && [window isKeyWindow]) {
+    if (states & DefaultState) {
         [window setDefaultButtonCell:buttonCell];
         wkAdvanceDefaultButtonPulseAnimation(buttonCell);
     } else if ([previousDefaultButtonCell isEqual:buttonCell])
         [window setDefaultButtonCell:nil];
 
+    if (!view) {
+        context->save();
+        context->translate(inflatedRect.x(), inflatedRect.y());
+        context->scale(FloatSize(1, -1));
+        context->translate(0, -inflatedRect.height());
+        inflatedRect.setLocation(IntPoint());
+    }
+
     [buttonCell drawWithFrame:NSRect(inflatedRect) inView:view];
     [buttonCell setControlView:nil];
 
+    if (!view)
+        context->restore();
+
     if (![previousDefaultButtonCell isEqual:buttonCell])
         [window setDefaultButtonCell:previousDefaultButtonCell];
 
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreObjCExtras.mm b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreObjCExtras.mm
index cb8d5048db..4fc757ca9d 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreObjCExtras.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreObjCExtras.mm
@@ -72,8 +72,13 @@ bool WebCoreObjCScheduleDeallocateOnMainThread(Class cls, id object)
 {
     ASSERT([object isKindOfClass:cls]);
     
+#if USE(WEB_THREAD)
+    if (isMainThread())
+        return false;
+#else
     if (pthread_main_np() != 0)
         return false;
+#endif
     
     ClassAndIdPair* pair = new ClassAndIdPair(cls, object);
     callOnMainThread(deallocCallback, pair);
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.h b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.h
index 768899e60c..f289ee4706 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.h
+++ b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -48,6 +48,7 @@ typedef struct _NSRect NSRect;
 @class NSFont;
 @class NSImage;
 @class NSMenu;
+@class NSMutableArray;
 @class NSMutableURLRequest;
 @class NSString;
 @class NSTextFieldCell;
@@ -66,6 +67,7 @@ typedef struct NSEvent NSEvent;
 typedef struct NSFont NSFont;
 typedef struct NSImage NSImage;
 typedef struct NSMenu NSMenu;
+typedef struct NSMutableArray NSMutableArray;
 typedef struct NSMutableURLRequest NSMutableURLRequest;
 typedef struct NSURLRequest NSURLRequest;
 typedef struct NSString NSString;
@@ -114,9 +116,10 @@ extern ATSUFontID (*wkGetNSFontATSUFontId)(NSFont*);
 extern double (*wkGetNSURLResponseCalculatedExpiration)(NSURLResponse *response);
 extern NSDate *(*wkGetNSURLResponseLastModifiedDate)(NSURLResponse *response);
 extern BOOL (*wkGetNSURLResponseMustRevalidate)(NSURLResponse *response);
-extern void (*wkGetWheelEventDeltas)(NSEvent*, float* deltaX, float* deltaY, BOOL* continuous);
+extern void (*wkGetWheelEventDeltas)(NSEvent*, float* deltaX, float* deltaY, float* wheelTicksX, float* wheelTicksY, BOOL* continuous);
 extern BOOL (*wkHitTestMediaUIPart)(int part, int themeStyle, CGRect bounds, CGPoint point);
 extern void (*wkMeasureMediaUIPart)(int part, int themeStyle, CGRect *bounds, CGSize *naturalSize);
+extern BOOL (*wkMediaControllerThemeAvailable)(int themeStyle);
 extern void (*wkPopupMenu)(NSMenu*, NSPoint location, float width, NSView*, int selectedItem, NSFont*);
 extern unsigned (*wkQTIncludeOnlyModernMediaFileTypes)(void);
 extern int (*wkQTMovieDataRate)(QTMovie*);
@@ -124,6 +127,8 @@ extern float (*wkQTMovieMaxTimeLoaded)(QTMovie*);
 extern NSString *(*wkQTMovieMaxTimeLoadedChangeNotification)(void);
 extern float (*wkQTMovieMaxTimeSeekable)(QTMovie*);
 extern int (*wkQTMovieGetType)(QTMovie* movie);
+extern BOOL (*wkQTMovieHasClosedCaptions)(QTMovie* movie);
+extern void (*wkQTMovieSetShowClosedCaptions)(QTMovie* movie, BOOL showClosedCaptions);
 extern void (*wkQTMovieViewSetDrawSynchronously)(QTMovieView*, BOOL);
 extern void (*wkSetCGFontRenderingMode)(CGContextRef, NSFont*);
 extern void (*wkSetDragImage)(NSImage*, NSPoint offset);
@@ -131,11 +136,15 @@ extern void (*wkSetNSURLConnectionDefersCallbacks)(NSURLConnection *, BOOL);
 extern void (*wkSetNSURLRequestShouldContentSniff)(NSMutableURLRequest *, BOOL);
 extern void (*wkSetPatternBaseCTM)(CGContextRef, CGAffineTransform);
 extern void (*wkSetPatternPhaseInUserSpace)(CGContextRef, CGPoint);
+extern CGAffineTransform (*wkGetUserToBaseCTM)(CGContextRef);
 extern void (*wkSetUpFontCache)();
 extern void (*wkSignalCFReadStreamEnd)(CFReadStreamRef stream);
 extern void (*wkSignalCFReadStreamError)(CFReadStreamRef stream, CFStreamError *error);
 extern void (*wkSignalCFReadStreamHasBytes)(CFReadStreamRef stream);
 extern unsigned (*wkInitializeMaximumHTTPConnectionCountPerHost)(unsigned preferredConnectionCount);
+extern void (*wkSetCONNECTProxyForStream)(CFReadStreamRef, CFStringRef proxyHost, CFNumberRef proxyPort);
+extern void (*wkSetCONNECTProxyAuthorizationForStream)(CFReadStreamRef, CFStringRef proxyAuthorizationString);
+extern CFHTTPMessageRef (*wkCopyCONNECTProxyResponse)(CFReadStreamRef, CFURLRef responseURL);
 extern BOOL (*wkIsLatchingWheelEvent)(NSEvent *);
 
 #ifndef BUILDING_ON_TIGER
@@ -160,6 +169,12 @@ extern BOOL (*wkSupportsMultipartXMixedReplace)(NSMutableURLRequest *);
 
 extern BOOL (*wkUseSharedMediaUI)();
 
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+extern NSMutableArray *(*wkNoteOpenPanelFiles)(NSArray *);
+#else
+extern void* wkNoteOpenPanelFiles;
+#endif
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.mm b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.mm
index d0e276f21b..b27646734f 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006, 2007, 2008 Apple Computer, Inc. All rights reserved.
+ * Copyright 2006, 2007, 2008, 2010 Apple Computer, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,13 +44,14 @@ void (*wkDrawMediaSliderTrack)(int themeStyle, CGContextRef context, CGRect rect
 BOOL (*wkHitTestMediaUIPart)(int part, int themeStyle, CGRect bounds, CGPoint point);
 void (*wkDrawMediaUIPart)(int part, int themeStyle, CGContextRef context, CGRect rect, unsigned state);
 void (*wkMeasureMediaUIPart)(int part, int themeStyle, CGRect *bounds, CGSize *naturalSize);
+BOOL (*wkMediaControllerThemeAvailable)(int themeStyle);
 NSString* (*wkGetPreferredExtensionForMIMEType)(NSString*);
 NSArray* (*wkGetExtensionsForMIMEType)(NSString*);
 NSString* (*wkGetMIMETypeForExtension)(NSString*);
 NSTimeInterval (*wkGetNSURLResponseCalculatedExpiration)(NSURLResponse *response);
 NSDate *(*wkGetNSURLResponseLastModifiedDate)(NSURLResponse *response);
 BOOL (*wkGetNSURLResponseMustRevalidate)(NSURLResponse *response);
-void (*wkGetWheelEventDeltas)(NSEvent*, float* deltaX, float* deltaY, BOOL* continuous);
+void (*wkGetWheelEventDeltas)(NSEvent*, float* deltaX, float* deltaY, float* wheelTicksX, float* wheelTicksY, BOOL* continuous);
 void (*wkPopupMenu)(NSMenu*, NSPoint location, float width, NSView*, int selectedItem, NSFont*);
 unsigned (*wkQTIncludeOnlyModernMediaFileTypes)(void);
 int (*wkQTMovieDataRate)(QTMovie*);
@@ -58,11 +59,14 @@ float (*wkQTMovieMaxTimeLoaded)(QTMovie*);
 NSString *(*wkQTMovieMaxTimeLoadedChangeNotification)(void);
 float (*wkQTMovieMaxTimeSeekable)(QTMovie*);
 int (*wkQTMovieGetType)(QTMovie* movie);
+BOOL (*wkQTMovieHasClosedCaptions)(QTMovie* movie);
+void (*wkQTMovieSetShowClosedCaptions)(QTMovie* movie, BOOL showClosedCaptions);
 void (*wkQTMovieViewSetDrawSynchronously)(QTMovieView*, BOOL);
 void (*wkSetCGFontRenderingMode)(CGContextRef, NSFont*);
 void (*wkSetDragImage)(NSImage*, NSPoint offset);
 void (*wkSetPatternBaseCTM)(CGContextRef, CGAffineTransform);
 void (*wkSetPatternPhaseInUserSpace)(CGContextRef, CGPoint point);
+CGAffineTransform (*wkGetUserToBaseCTM)(CGContextRef);
 void (*wkSetUpFontCache)();
 void (*wkSignalCFReadStreamEnd)(CFReadStreamRef stream);
 void (*wkSignalCFReadStreamHasBytes)(CFReadStreamRef stream);
@@ -80,6 +84,9 @@ void (*wkSetNSURLConnectionDefersCallbacks)(NSURLConnection *, BOOL);
 void (*wkSetNSURLRequestShouldContentSniff)(NSMutableURLRequest *, BOOL);
 id (*wkCreateNSURLConnectionDelegateProxy)(void);
 unsigned (*wkInitializeMaximumHTTPConnectionCountPerHost)(unsigned preferredConnectionCount);
+void (*wkSetCONNECTProxyForStream)(CFReadStreamRef, CFStringRef proxyHost, CFNumberRef proxyPort);
+void (*wkSetCONNECTProxyAuthorizationForStream)(CFReadStreamRef, CFStringRef proxyAuthorizationString);
+CFHTTPMessageRef (*wkCopyCONNECTProxyResponse)(CFReadStreamRef, CFURLRef responseURL);
 BOOL (*wkIsLatchingWheelEvent)(NSEvent *);
 
 #ifndef BUILDING_ON_TIGER
@@ -100,3 +107,9 @@ void (*wkReleaseStyleGroup)(void* group);
 ATSUFontID (*wkGetNSFontATSUFontId)(NSFont*);
 BOOL (*wkSupportsMultipartXMixedReplace)(NSMutableURLRequest *);
 #endif
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+NSMutableArray *(*wkNoteOpenPanelFiles)(NSArray *);
+#else
+void* wkNoteOpenPanelFiles;
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WheelEventMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/WheelEventMac.mm
index f380e3e03d..d7e2934c3a 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/WheelEventMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/WheelEventMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2006, 2010 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -43,15 +43,11 @@ PlatformWheelEvent::PlatformWheelEvent(NSEvent* event, NSView *windowView)
     , m_metaKey([event modifierFlags] & NSCommandKeyMask)
 {
     BOOL continuous;
-    wkGetWheelEventDeltas(event, &m_deltaX, &m_deltaY, &continuous);
-    if (continuous) {
-        m_wheelTicksX = m_deltaX / static_cast<float>(cScrollbarPixelsPerLineStep);
-        m_wheelTicksY = m_deltaY / static_cast<float>(cScrollbarPixelsPerLineStep);
-    } else {
-        m_wheelTicksX = m_deltaX;
-        m_wheelTicksY = m_deltaY;
-        m_deltaX *= static_cast<float>(cScrollbarPixelsPerLineStep);
-        m_deltaY *= static_cast<float>(cScrollbarPixelsPerLineStep);
+    wkGetWheelEventDeltas(event, &m_deltaX, &m_deltaY, &m_wheelTicksX, &m_wheelTicksY, &continuous);
+
+    if (!continuous) {
+        m_deltaX *= static_cast<float>(Scrollbar::pixelsPerLineStep());
+        m_deltaY *= static_cast<float>(Scrollbar::pixelsPerLineStep());
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WidgetMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/WidgetMac.mm
index 8653a03fed..1aad76fd68 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/WidgetMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/WidgetMac.mm
@@ -31,12 +31,14 @@
 #endif
 
 #import "BlockExceptions.h"
+#import "Chrome.h"
 #import "Cursor.h"
 #import "Document.h"
 #import "Font.h"
 #import "FoundationExtras.h"
 #import "Frame.h"
 #import "GraphicsContext.h"
+#import "NotImplemented.h"
 #import "Page.h"
 #import "PlatformMouseEvent.h"
 #import "ScrollView.h"
@@ -54,12 +56,22 @@
 - (void)webPlugInSetIsSelected:(BOOL)isSelected;
 @end
 
+@interface NSView (Widget)
+- (void)visibleRectDidChange;
+@end
+
 namespace WebCore {
 
 class WidgetPrivate {
 public:
+    WidgetPrivate()
+        : previousVisibleRect(NSZeroRect)
+    {
+    }
+
     bool mustStayInWindow;
     bool removeFromSuperviewSoon;
+    NSRect previousVisibleRect;
 };
 
 static void safeRemoveFromSuperview(NSView *view)
@@ -78,7 +90,7 @@ static void safeRemoveFromSuperview(NSView *view)
     [window _setNeedsToResetDragMargins:resetDragMargins];
 }
 
-Widget::Widget(NSView* view)
+Widget::Widget(NSView *view)
     : m_data(new WidgetPrivate)
 {
     init(view);
@@ -157,11 +169,18 @@ void Widget::setFrameRect(const IntRect& rect)
 
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
     NSView *v = getOuterView();
+    if (!v)
+        return;
+
+    NSRect visibleRect = [v visibleRect];
     NSRect f = rect;
     if (!NSEqualRects(f, [v frame])) {
         [v setFrame:f];
-        [v setNeedsDisplay: NO];
-    }
+        [v setNeedsDisplay:NO];
+    } else if (!NSEqualRects(visibleRect, m_data->previousVisibleRect) && [v respondsToSelector:@selector(visibleRectDidChange)])
+        [v visibleRectDidChange];
+
+    m_data->previousVisibleRect = visibleRect;
     END_BLOCK_OBJC_EXCEPTIONS;
 }
 
@@ -192,7 +211,7 @@ void Widget::paint(GraphicsContext* p, const IntRect& r)
         END_BLOCK_OBJC_EXCEPTIONS;
     } else {
         // This is the case of drawing into a bitmap context other than a window backing store. It gets hit beneath
-        // -cacheDisplayInRect:toBitmapImageRep:.
+        // -cacheDisplayInRect:toBitmapImageRep:, and when painting into compositing layers.
 
         // Transparent subframes are in fact implemented with scroll views that return YES from -drawsBackground (whenever the WebView
         // itself is in drawsBackground mode). In the normal drawing code path, the scroll views are never asked to draw the background,
@@ -334,6 +353,7 @@ IntPoint Widget::convertFromContainingWindowToRoot(const Widget* rootWidget, con
 void Widget::releasePlatformWidget()
 {
     HardRelease(m_widget);
+    m_data->previousVisibleRect = NSZeroRect;
 }
 
 void Widget::retainPlatformWidget()
@@ -341,5 +361,5 @@ void Widget::retainPlatformWidget()
     HardRetain(m_widget);
 }
 
-}
+} // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/platform/mock/GeolocationServiceMock.cpp b/src/3rdparty/webkit/WebCore/platform/mock/GeolocationServiceMock.cpp
index f1871047c5..b254cb8127 100644
--- a/src/3rdparty/webkit/WebCore/platform/mock/GeolocationServiceMock.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/mock/GeolocationServiceMock.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "GeolocationServiceMock.h"
 
+#if ENABLE(GEOLOCATION)
+
 #include "Logging.h"
 #include "Geolocation.h"
 #include "Geoposition.h"
@@ -134,3 +136,5 @@ void GeolocationServiceMock::cleanUpStatics()
 }
 
 } // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/network/AuthenticationClient.h b/src/3rdparty/webkit/WebCore/platform/network/AuthenticationClient.h
new file mode 100644
index 0000000000..1e17910e2c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/network/AuthenticationClient.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AuthenticationClient_h
+#define AuthenticationClient_h
+
+namespace WebCore {
+
+class AuthenticationChallenge;
+class Credential;
+
+class AuthenticationClient {
+public:
+    virtual void receivedCredential(const AuthenticationChallenge&, const Credential&) = 0;
+    virtual void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&) = 0;
+    virtual void receivedCancellation(const AuthenticationChallenge&) = 0;
+
+    void ref() { refAuthenticationClient(); }
+    void deref() { derefAuthenticationClient(); }
+
+protected:
+    virtual ~AuthenticationClient() { }
+
+private:
+    virtual void refAuthenticationClient() = 0;
+    virtual void derefAuthenticationClient() = 0;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/network/Credential.cpp b/src/3rdparty/webkit/WebCore/platform/network/Credential.cpp
index f905743190..87cd7ff320 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/Credential.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/Credential.cpp
@@ -33,6 +33,9 @@ Credential::Credential()
     : m_user("")
     , m_password("")
     , m_persistence(CredentialPersistenceNone)
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    , m_type(CredentialTypePassword)
+#endif    
 {
 }
    
@@ -42,11 +45,31 @@ Credential::Credential(const String& user, const String& password, CredentialPer
     : m_user(user.length() ? user : "")
     , m_password(password.length() ? password : "")
     , m_persistence(persistence)
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    , m_type(CredentialTypePassword)
+#endif
+{
+}
+    
+Credential::Credential(const Credential& original, CredentialPersistence persistence)
+    : m_user(original.user())
+    , m_password(original.password())
+    , m_persistence(persistence)
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    , m_identity(original.identity())
+    , m_certificates(original.certificates())
+    , m_type(original.type())
+#endif
 {
 }
 
 bool Credential::isEmpty() const
 {
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    if (m_type == CredentialTypeClientCertificate && (m_identity || m_certificates))
+        return false;
+#endif
+    
     return m_user.isEmpty() && m_password.isEmpty();
 }
     
@@ -69,15 +92,68 @@ CredentialPersistence Credential::persistence() const
 { 
     return m_persistence; 
 }
+    
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+Credential::Credential(SecIdentityRef identity, CFArrayRef certificates, CredentialPersistence persistence)
+    : m_user("")
+    , m_password("")
+    , m_persistence(persistence)
+    , m_identity(identity)
+    , m_certificates(certificates)
+    , m_type(CredentialTypeClientCertificate)
+{
+}
+    
+SecIdentityRef Credential::identity() const
+{
+    return m_identity.get();
+}
+    
+CFArrayRef Credential::certificates() const
+{
+    return m_certificates.get();
+}
+    
+const CredentialType Credential::type() const
+{
+    return m_type;
+}
+#endif
 
 bool operator==(const Credential& a, const Credential& b)
 {
+    // Check persistence first since all credential types
+    // have the persistence property.
+    if (a.persistence() != b.persistence())
+        return false;
+    
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    CredentialType aType = a.type();
+    if (aType != b.type())
+        return false;
+    
+    // Comparing identity and certificate chain pointers is valid only
+    // for client certificate type credentials.
+    //
+    // FIXME: Is pointer comparison of the identity and certificates properties sufficient?
+    if (aType == CredentialTypeClientCertificate) {
+        if (a.identity() != b.identity())
+            return false;
+        if (a.certificates() != b.certificates())
+            return false;
+        
+        // We only need to check identity and certificates to compare
+        // client certificate based credentials.
+        return true;
+    }
+    
+    ASSERT(a.type() == CredentialTypePassword && b.type() == CredentialTypePassword);
+#endif    
+    
     if (a.user() != b.user())
         return false;
     if (a.password() != b.password())
         return false;
-    if (a.persistence() != b.persistence())
-        return false;
         
     return true;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/network/Credential.h b/src/3rdparty/webkit/WebCore/platform/network/Credential.h
index 0471fbca71..199817cdda 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/Credential.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/Credential.h
@@ -27,6 +27,13 @@
 
 #include "PlatformString.h"
 
+#define CERTIFICATE_CREDENTIALS_SUPPORTED ((PLATFORM(MAC) || PLATFORM(IPHONE)) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD))
+
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+#include <Security/SecBase.h>
+#include <wtf/RetainPtr.h>
+#endif
+
 namespace WebCore {
 
 enum CredentialPersistence {
@@ -34,12 +41,23 @@ enum CredentialPersistence {
     CredentialPersistenceForSession,
     CredentialPersistencePermanent
 };
-    
+
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+enum CredentialType {
+    CredentialTypePassword,
+    CredentialTypeClientCertificate
+};
+#endif
+
 class Credential {
 
 public:
     Credential();
     Credential(const String& user, const String& password, CredentialPersistence);
+    Credential(const Credential& original, CredentialPersistence);
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    Credential(SecIdentityRef identity, CFArrayRef certificates, CredentialPersistence);
+#endif
     
     bool isEmpty() const;
     
@@ -48,10 +66,21 @@ public:
     bool hasPassword() const;
     CredentialPersistence persistence() const;
     
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    SecIdentityRef identity() const;
+    CFArrayRef certificates() const;
+    const CredentialType type() const;
+#endif    
+    
 private:
     String m_user;
     String m_password;
     CredentialPersistence m_persistence;
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    RetainPtr<SecIdentityRef> m_identity;
+    RetainPtr<CFArrayRef> m_certificates;
+    CredentialType m_type;
+#endif
 };
 
 bool operator==(const Credential& a, const Credential& b);
diff --git a/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.cpp b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.cpp
index ec78372640..2c78e3c5a3 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.cpp
@@ -31,7 +31,8 @@
 #include "KURL.h"
 #include "ProtectionSpaceHash.h"
 #include "StringHash.h"
-
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -85,16 +86,18 @@ static String protectionSpaceMapKeyFromURL(const KURL& url)
 
 void CredentialStorage::set(const Credential& credential, const ProtectionSpace& protectionSpace, const KURL& url)
 {
-    ASSERT(url.protocolInHTTPFamily());
-    ASSERT(url.isValid());
+    ASSERT(protectionSpace.isProxy() || url.protocolInHTTPFamily());
+    ASSERT(protectionSpace.isProxy() || url.isValid());
 
     protectionSpaceToCredentialMap().set(protectionSpace, credential);
-    originsWithCredentials().add(originStringFromURL(url));
-
-    ProtectionSpaceAuthenticationScheme scheme = protectionSpace.authenticationScheme();
-    if (scheme == ProtectionSpaceAuthenticationSchemeHTTPBasic || scheme == ProtectionSpaceAuthenticationSchemeDefault) {
-        // The map can contain both a path and its subpath - while redundant, this makes lookups faster.
-        pathToDefaultProtectionSpaceMap().set(protectionSpaceMapKeyFromURL(url), protectionSpace);
+    if (!protectionSpace.isProxy()) {
+        originsWithCredentials().add(originStringFromURL(url));
+
+        ProtectionSpaceAuthenticationScheme scheme = protectionSpace.authenticationScheme();
+        if (scheme == ProtectionSpaceAuthenticationSchemeHTTPBasic || scheme == ProtectionSpaceAuthenticationSchemeDefault) {
+            // The map can contain both a path and its subpath - while redundant, this makes lookups faster.
+            pathToDefaultProtectionSpaceMap().set(protectionSpaceMapKeyFromURL(url), protectionSpace);
+        }
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.h b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.h
index 5086f69f65..21fcbadbbb 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.h
@@ -34,9 +34,13 @@ class ProtectionSpace;
 
 class CredentialStorage {
 public:
+    // WebCore session credential storage.
     static void set(const Credential&, const ProtectionSpace&, const KURL&);
     static Credential get(const ProtectionSpace&);
 
+    // OS persistent storage.
+    static Credential getFromPersistentStorage(const ProtectionSpace&);
+
     // These methods work for authentication schemes that support sending credentials without waiting for a request. E.g., for HTTP Basic authentication scheme
     // a client should assume that all paths at or deeper than the depth of a known protected resource share are within the same protection space.
     static bool set(const Credential&, const KURL&); // Returns true if the URL corresponds to a known protection space, so credentials could be updated.
diff --git a/src/3rdparty/webkit/WebCore/platform/network/DNS.h b/src/3rdparty/webkit/WebCore/platform/network/DNS.h
index c232272539..1eeec3c4b6 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/DNS.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/DNS.h
@@ -30,7 +30,9 @@ namespace WebCore {
 
     class String;
 
+#if !USE(SOUP)
     void prefetchDNS(const String& hostname);
+#endif
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/network/FormData.cpp b/src/3rdparty/webkit/WebCore/platform/network/FormData.cpp
index af3b7f0782..597f859081 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/FormData.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/FormData.cpp
@@ -21,9 +21,16 @@
 #include "config.h"
 #include "FormData.h"
 
+#include "Blob.h"
 #include "CString.h"
+#include "Chrome.h"
 #include "ChromeClient.h"
+#include "DOMFormData.h"
+#include "Document.h"
 #include "FileSystem.h"
+#include "FormDataBuilder.h"
+#include "MIMETypeRegistry.h"
+#include "Page.h"
 #include "TextEncoding.h"
 
 namespace WebCore {
@@ -88,6 +95,20 @@ PassRefPtr<FormData> FormData::create(const Vector<char>& vector)
     return result.release();
 }
 
+PassRefPtr<FormData> FormData::create(const DOMFormData& domFormData)
+{
+    RefPtr<FormData> result = create();
+    result->appendDOMFormData(domFormData, false, 0);
+    return result.release();
+}
+
+PassRefPtr<FormData> FormData::createMultiPart(const DOMFormData& domFormData, Document* document)
+{
+    RefPtr<FormData> result = create();
+    result->appendDOMFormData(domFormData, true, document);
+    return result.release();
+}
+
 PassRefPtr<FormData> FormData::copy() const
 {
     return adoptRef(new FormData(*this));
@@ -108,7 +129,11 @@ PassRefPtr<FormData> FormData::deepCopy() const
             formData->m_elements.append(FormDataElement(e.m_data));
             break;
         case FormDataElement::encodedFile:
+#if ENABLE(BLOB_SLICE)
+            formData->m_elements.append(FormDataElement(e.m_filename, e.m_fileStart, e.m_fileLength, e.m_expectedFileModificationTime, e.m_shouldGenerateFile));
+#else
             formData->m_elements.append(FormDataElement(e.m_filename, e.m_shouldGenerateFile));
+#endif
             break;
         }
     }
@@ -127,7 +152,93 @@ void FormData::appendData(const void* data, size_t size)
 
 void FormData::appendFile(const String& filename, bool shouldGenerateFile)
 {
+#if ENABLE(BLOB_SLICE)
+    m_elements.append(FormDataElement(filename, 0, Blob::toEndOfFile, Blob::doNotCheckFileChange, shouldGenerateFile));
+#else
     m_elements.append(FormDataElement(filename, shouldGenerateFile));
+#endif
+}
+
+#if ENABLE(BLOB_SLICE)
+void FormData::appendFileRange(const String& filename, long long start, long long length, double expectedModificationTime, bool shouldGenerateFile)
+{
+    m_elements.append(FormDataElement(filename, start, length, expectedModificationTime, shouldGenerateFile));
+}
+#endif
+
+void FormData::appendDOMFormData(const DOMFormData& domFormData, bool isMultiPartForm, Document* document)
+{
+    FormDataBuilder formDataBuilder;
+    if (isMultiPartForm)
+        m_boundary = formDataBuilder.generateUniqueBoundaryString();
+
+    Vector<char> encodedData;
+    TextEncoding encoding = domFormData.encoding();
+
+    const Vector<FormDataList::Item>& list = domFormData.list();
+    size_t formDataListSize = list.size();
+    ASSERT(!(formDataListSize % 2));
+    for (size_t i = 0; i < formDataListSize; i += 2) {
+        const FormDataList::Item& key = list[i];
+        const FormDataList::Item& value = list[i + 1];
+        if (isMultiPartForm) {
+            Vector<char> header;
+            formDataBuilder.beginMultiPartHeader(header, m_boundary.data(), key.data());
+
+            bool shouldGenerateFile = false;
+            // If the current type is FILE, then we also need to include the filename
+            if (value.file()) {
+                const String& path = value.file()->path();
+                String fileName = value.file()->fileName();
+
+                // Let the application specify a filename if it's going to generate a replacement file for the upload.
+                if (!path.isEmpty()) {
+                    if (Page* page = document->page()) {
+                        String generatedFileName;
+                        shouldGenerateFile = page->chrome()->client()->shouldReplaceWithGeneratedFileForUpload(path, generatedFileName);
+                        if (shouldGenerateFile)
+                            fileName = generatedFileName;
+                    }
+                }
+
+                // We have to include the filename=".." part in the header, even if the filename is empty
+                formDataBuilder.addFilenameToMultiPartHeader(header, encoding, fileName);
+
+                if (!fileName.isEmpty()) {
+                    // FIXME: The MIMETypeRegistry function's name makes it sound like it takes a path,
+                    // not just a basename. But filename is not the path. But note that it's not safe to
+                    // just use path instead since in the generated-file case it will not reflect the
+                    // MIME type of the generated file.
+                    String mimeType = MIMETypeRegistry::getMIMETypeForPath(fileName);
+                    if (!mimeType.isEmpty())
+                        formDataBuilder.addContentTypeToMultiPartHeader(header, mimeType.latin1());
+                }
+            }
+
+            formDataBuilder.finishMultiPartHeader(header);
+
+            // Append body
+            appendData(header.data(), header.size());
+            if (size_t dataSize = value.data().length())
+                appendData(value.data().data(), dataSize);
+            else if (value.file() && !value.file()->path().isEmpty())
+                appendFile(value.file()->path(), shouldGenerateFile);
+
+            appendData("\r\n", 2);
+        } else {
+            // Omit the name "isindex" if it's the first form data element.
+            // FIXME: Why is this a good rule? Is this obsolete now?
+            if (encodedData.isEmpty() && key.data() == "isindex")
+                FormDataBuilder::encodeStringAsFormData(encodedData, value.data());
+            else
+                formDataBuilder.addKeyValuePairAsFormData(encodedData, key.data(), value.data());
+        }
+    } 
+
+    if (isMultiPartForm)
+        formDataBuilder.addBoundaryToMultiPartHeader(encodedData, m_boundary.data(), true);
+
+    appendData(encodedData.data(), encodedData.size());
 }
 
 void FormData::flatten(Vector<char>& data) const
diff --git a/src/3rdparty/webkit/WebCore/platform/network/FormData.h b/src/3rdparty/webkit/WebCore/platform/network/FormData.h
index 7278f2eee5..76b6be6a6e 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/FormData.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/FormData.h
@@ -27,16 +27,27 @@
 namespace WebCore {
 
 class ChromeClient;
+class DOMFormData;
+class Document;
 
 class FormDataElement {
 public:
     FormDataElement() : m_type(data) { }
     FormDataElement(const Vector<char>& array) : m_type(data), m_data(array) { }
+#if ENABLE(BLOB_SLICE)
+    FormDataElement(const String& filename, long long fileStart, long long fileLength, double expectedFileModificationTime, bool shouldGenerateFile) : m_type(encodedFile), m_filename(filename), m_fileStart(fileStart), m_fileLength(fileLength), m_expectedFileModificationTime(expectedFileModificationTime), m_shouldGenerateFile(shouldGenerateFile) { }
+#else
     FormDataElement(const String& filename, bool shouldGenerateFile) : m_type(encodedFile), m_filename(filename), m_shouldGenerateFile(shouldGenerateFile) { }
+#endif
 
     enum { data, encodedFile } m_type;
     Vector<char> m_data;
     String m_filename;
+#if ENABLE(BLOB_SLICE)
+    long long m_fileStart;
+    long long m_fileLength;
+    double m_expectedFileModificationTime;
+#endif
     String m_generatedFilename;
     bool m_shouldGenerateFile;
 };
@@ -50,7 +61,11 @@ inline bool operator==(const FormDataElement& a, const FormDataElement& b)
         return false;
     if (a.m_data != b.m_data)
         return false;
+#if ENABLE(BLOB_SLICE)
+    if (a.m_filename != b.m_filename || a.m_fileStart != b.m_fileStart || a.m_fileLength != b.m_fileLength || a.m_expectedFileModificationTime != b.m_expectedFileModificationTime)
+#else
     if (a.m_filename != b.m_filename)
+#endif
         return false;
 
     return true;
@@ -67,18 +82,24 @@ public:
     static PassRefPtr<FormData> create(const void*, size_t);
     static PassRefPtr<FormData> create(const CString&);
     static PassRefPtr<FormData> create(const Vector<char>&);
+    static PassRefPtr<FormData> create(const DOMFormData&);
+    static PassRefPtr<FormData> createMultiPart(const DOMFormData&, Document*);
     PassRefPtr<FormData> copy() const;
     PassRefPtr<FormData> deepCopy() const;
     ~FormData();
     
     void appendData(const void* data, size_t);
     void appendFile(const String& filename, bool shouldGenerateFile = false);
+#if ENABLE(BLOB_SLICE)
+    void appendFileRange(const String& filename, long long start, long long length, double expectedModificationTime, bool shouldGenerateFile = false);
+#endif
 
     void flatten(Vector<char>&) const; // omits files
     String flattenToString() const; // omits files
 
     bool isEmpty() const { return m_elements.isEmpty(); }
     const Vector<FormDataElement>& elements() const { return m_elements; }
+    const Vector<char>& boundary() const { return m_boundary; }
 
     void generateFiles(ChromeClient*);
     void removeGeneratedFilesIfNeeded();
@@ -95,10 +116,13 @@ private:
     FormData();
     FormData(const FormData&);
 
+    void appendDOMFormData(const DOMFormData& domFormData, bool isMultiPartForm, Document* document);
+
     Vector<FormDataElement> m_elements;
     int64_t m_identifier;
     bool m_hasGeneratedFiles;
     bool m_alwaysStream;
+    Vector<char> m_boundary;
 };
 
 inline bool operator==(const FormData& a, const FormData& b)
diff --git a/src/3rdparty/webkit/WebCore/platform/network/FormDataBuilder.cpp b/src/3rdparty/webkit/WebCore/platform/network/FormDataBuilder.cpp
index 04c75278cf..52f62f32dd 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/FormDataBuilder.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/FormDataBuilder.cpp
@@ -127,9 +127,6 @@ static void appendQuotedString(Vector<char>& buffer, const CString& string)
         case '"':
             append(buffer, "%22");
             break;
-        case '%':
-            append(buffer, "%25");
-            break;
         default:
             append(buffer, c);
         }
@@ -143,7 +140,10 @@ Vector<char> FormDataBuilder::generateUniqueBoundaryString()
     // The RFC 2046 spec says the alphanumeric characters plus the
     // following characters are legal for boundaries:  '()+_,-./:=?
     // However the following characters, though legal, cause some sites
-    // to fail: (),./:= (http://bugs.webkit.org/show_bug.cgi?id=13352)
+    // to fail: (),./:=+
+    // Note that our algorithm makes it twice as much likely for 'A' or 'B'
+    // to appear in the boundary string, because 0x41 and 0x42 are present in
+    // the below array twice.
     static const char alphaNumericEncodingMap[64] = {
         0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48,
         0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50,
@@ -152,18 +152,7 @@ Vector<char> FormDataBuilder::generateUniqueBoundaryString()
         0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E,
         0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76,
         0x77, 0x78, 0x79, 0x7A, 0x30, 0x31, 0x32, 0x33,
-        0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x2B, 0x41
-        // FIXME <rdar://problem/5252577> gmail does not accept legal characters in the form boundary
-        // As stated above, some legal characters cause, sites to fail. Specifically
-        // the / character which was the last character in the above array. I have
-        // replaced the last character with another character already in the array
-        // (notice the first and last values are both 0x41, A). Instead of picking
-        // another unique legal character for boundary strings that, because it has
-        // never been tested, may or may not break other sites, I simply
-        // replaced / with A.  This means A is twice as likely to occur in our boundary
-        // strings than any other character but I think this is fine for the time being.
-        // The FIXME here is about restoring the / character once the aforementioned
-        // radar has been resolved.
+        0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x41, 0x42
     };
 
     // Start with an informative prefix.
diff --git a/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.cpp b/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.cpp
index 07c66e8155..e304ffa3e8 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.cpp
@@ -31,26 +31,25 @@
 #include "config.h"
 #include "HTTPHeaderMap.h"
 
-#include <memory>
 #include <utility>
 
 using namespace std;
 
 namespace WebCore {
 
-auto_ptr<CrossThreadHTTPHeaderMapData> HTTPHeaderMap::copyData() const
+PassOwnPtr<CrossThreadHTTPHeaderMapData> HTTPHeaderMap::copyData() const
 {
-    auto_ptr<CrossThreadHTTPHeaderMapData> data(new CrossThreadHTTPHeaderMapData());
+    OwnPtr<CrossThreadHTTPHeaderMapData> data(new CrossThreadHTTPHeaderMapData());
     data->reserveInitialCapacity(size());
 
     HTTPHeaderMap::const_iterator end_it = end();
     for (HTTPHeaderMap::const_iterator it = begin(); it != end_it; ++it) {
         data->append(make_pair(it->first.string().crossThreadString(), it->second.crossThreadString()));
     }
-    return data;
+    return data.release();
 }
 
-void HTTPHeaderMap::adopt(auto_ptr<CrossThreadHTTPHeaderMapData> data)
+void HTTPHeaderMap::adopt(PassOwnPtr<CrossThreadHTTPHeaderMapData> data)
 {
     clear();
     size_t dataSize = data->size();
@@ -59,5 +58,41 @@ void HTTPHeaderMap::adopt(auto_ptr<CrossThreadHTTPHeaderMapData> data)
         set(header.first, header.second);
     }
 }
+    
+// Adapter that allows the HashMap to take C strings as keys.
+struct CaseFoldingCStringTranslator {
+    static unsigned hash(const char* cString)
+    {
+        return CaseFoldingHash::hash(cString, strlen(cString));
+    }
+    
+    static bool equal(const AtomicString& key, const char* cString)
+    {
+        return equalIgnoringCase(key, cString);
+    }
+    
+    static void translate(AtomicString& location, const char* cString, unsigned /*hash*/)
+    {
+        location = AtomicString(cString);
+    }
+};
+
+String HTTPHeaderMap::get(const char* name) const
+{
+    const_iterator i = find<const char*, CaseFoldingCStringTranslator>(name);
+    if (i == end())
+        return String();
+    return i->second;
+}
+    
+bool HTTPHeaderMap::contains(const char* name) const
+{
+    return find<const char*, CaseFoldingCStringTranslator>(name) != end();
+}
+
+pair<HTTPHeaderMap::iterator, bool> HTTPHeaderMap::add(const char* name, const String& value)
+{
+    return HashMap<AtomicString, String, CaseFoldingHash>::add<const char*, CaseFoldingCStringTranslator>(name, value);
+}
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.h b/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.h
index 6da1b90ad0..557ddb3183 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.h
@@ -30,9 +30,9 @@
 #include "AtomicString.h"
 #include "AtomicStringHash.h"
 #include "StringHash.h"
-#include <memory>
 #include <utility>
 #include <wtf/HashMap.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -42,9 +42,25 @@ namespace WebCore {
     class HTTPHeaderMap : public HashMap<AtomicString, String, CaseFoldingHash> {
     public:
         // Gets a copy of the data suitable for passing to another thread.
-        std::auto_ptr<CrossThreadHTTPHeaderMapData> copyData() const;
+        PassOwnPtr<CrossThreadHTTPHeaderMapData> copyData() const;
 
-        void adopt(std::auto_ptr<CrossThreadHTTPHeaderMapData>);
+        void adopt(PassOwnPtr<CrossThreadHTTPHeaderMapData>);
+        
+        String get(const AtomicString& name) const
+        {
+            return HashMap<AtomicString, String, CaseFoldingHash>::get(name);
+        }
+
+        pair<iterator, bool> add(const AtomicString& name, const String& value)
+        {
+            return HashMap<AtomicString, String, CaseFoldingHash>::add(name, value);
+        }
+
+        // Alternate accessors that are faster than converting the char* to AtomicString first.
+        bool contains(const char*) const;
+        String get(const char*) const;
+        pair<iterator, bool> add(const char* name, const String& value);
+        
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.cpp b/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.cpp
index 9202660df1..fc0c245f90 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.cpp
@@ -2,6 +2,7 @@
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +31,7 @@
 
 #include "config.h"
 #include "HTTPParsers.h"
+#include "ResourceResponseBase.h"
 
 #include "CString.h"
 #include "PlatformString.h"
@@ -55,6 +57,53 @@ static inline bool skipWhiteSpace(const String& str, int& pos, bool fromHttpEqui
     return pos != len;
 }
 
+// Returns true if the function can match the whole token (case insensitive).
+// Note: Might return pos == str.length()
+static inline bool skipToken(const String& str, int& pos, const char* token)
+{
+    int len = str.length();
+
+    while (pos != len && *token) {
+        if (toASCIILower(str[pos]) != *token++)
+            return false;
+        ++pos;
+    }
+
+    return true;
+}
+
+bool shouldTreatAsAttachment(const ResourceResponseBase& response)
+{
+    const String& contentDisposition = response.httpHeaderField("Content-Disposition");
+    
+    if (contentDisposition.isEmpty())
+        return false;
+
+    // Some broken sites just send
+    // Content-Disposition: ; filename="file"
+    // screen those out here.
+    if (contentDisposition.startsWith(";"))
+        return false;
+
+    if (contentDisposition.startsWith("inline", false))
+        return false;
+
+    // Some broken sites just send
+    // Content-Disposition: filename="file"
+    // without a disposition token... screen those out.
+    if (contentDisposition.startsWith("filename", false))
+        return false;
+
+    // Also in use is Content-Disposition: name="file"
+    if (contentDisposition.startsWith("name", false))
+        return false;
+
+    // We have a content-disposition of "attachment" or unknown.
+    // RFC 2183, section 2.8 says that an unknown disposition
+    // value should be treated as "attachment"
+    return true;  
+}
+
 bool parseHTTPRefresh(const String& refresh, bool fromHttpEquivMeta, double& delay, String& url)
 {
     int len = refresh.length();
@@ -220,4 +269,32 @@ String extractCharsetFromMediaType(const String& mediaType)
     
     return String();
 }
+
+XSSProtectionDisposition parseXSSProtectionHeader(const String& header)
+{
+    String stippedHeader = header.stripWhiteSpace();
+
+    if (stippedHeader.isEmpty())
+        return XSSProtectionEnabled;
+
+    if (stippedHeader[0] == '0')
+        return XSSProtectionDisabled;
+
+    int length = (int)header.length();
+    int pos = 0;
+    if (stippedHeader[pos++] == '1'
+        && skipWhiteSpace(stippedHeader, pos, false)
+        && stippedHeader[pos++] == ';'
+        && skipWhiteSpace(stippedHeader, pos, false)
+        && skipToken(stippedHeader, pos, "mode")
+        && skipWhiteSpace(stippedHeader, pos, false)
+        && stippedHeader[pos++] == '='
+        && skipWhiteSpace(stippedHeader, pos, false)
+        && skipToken(stippedHeader, pos, "block")
+        && pos == length)
+        return XSSProtectionBlockEnabled;
+
+    return XSSProtectionEnabled;
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.h b/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.h
index 0648aee09c..d568bd4d57 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,13 +32,24 @@
 
 namespace WebCore {
 
-    class String;
+class String;
+class ResourceResponseBase;
+
+enum XSSProtectionDisposition {
+    XSSProtectionDisabled,
+    XSSProtectionEnabled,
+    XSSProtectionBlockEnabled
+};
+
+
+bool shouldTreatAsAttachment(const ResourceResponseBase& response);
+bool parseHTTPRefresh(const String& refresh, bool fromHttpEquivMeta, double& delay, String& url);
+double parseDate(const String&);
+String filenameFromHTTPContentDisposition(const String&); 
+String extractMIMETypeFromMediaType(const String&);
+String extractCharsetFromMediaType(const String&); 
+XSSProtectionDisposition parseXSSProtectionHeader(const String&);
 
-    bool parseHTTPRefresh(const String& refresh, bool fromHttpEquivMeta, double& delay, String& url);
-    double parseDate(const String&);
-    String filenameFromHTTPContentDisposition(const String&); 
-    String extractMIMETypeFromMediaType(const String&);
-    String extractCharsetFromMediaType(const String&); 
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/network/NetworkStateNotifier.h b/src/3rdparty/webkit/WebCore/platform/network/NetworkStateNotifier.h
index 700a062e8f..781259cf1a 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/NetworkStateNotifier.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/NetworkStateNotifier.h
@@ -26,6 +26,8 @@
 #ifndef NetworkStateNotifier_h
 #define NetworkStateNotifier_h
 
+#include <wtf/Noncopyable.h>
+
 #if PLATFORM(MAC)
 
 #include <wtf/RetainPtr.h>
@@ -50,7 +52,7 @@ namespace WebCore {
 class NetworkStateNotifierPrivate;
 #endif
 
-class NetworkStateNotifier {
+class NetworkStateNotifier : public Noncopyable {
 public:
     NetworkStateNotifier();
     void setNetworkStateChangedFunction(void (*)());
@@ -87,6 +89,10 @@ private:
 #elif PLATFORM(CHROMIUM)
     NetworkStateNotifierPrivate p;
 
+#elif PLATFORM(ANDROID)
+public:
+    void networkStateChange(bool online);
+
 #elif PLATFORM(QT) && ENABLE(QT_BEARER)
     friend class NetworkStateNotifierPrivate;
     NetworkStateNotifierPrivate* p;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.cpp b/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.cpp
index d04bcbe819..26c258f440 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.cpp
@@ -111,7 +111,8 @@ bool operator==(const ProtectionSpace& a, const ProtectionSpace& b)
         return false;
     if (a.serverType() != b.serverType())
         return false;
-    if (a.realm() != b.realm())
+    // Ignore realm for proxies
+    if (!a.isProxy() && a.realm() != b.realm())
         return false;
     if (a.authenticationScheme() != b.authenticationScheme())
         return false;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpaceHash.h b/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpaceHash.h
index 6f68b5b8c3..08716b5961 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpaceHash.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpaceHash.h
@@ -27,6 +27,7 @@
 #define ProtectionSpaceHash_h
 
 #include "ProtectionSpace.h"
+#include <wtf/HashTraits.h>
 
 namespace WebCore {
 
@@ -37,11 +38,15 @@ struct ProtectionSpaceHash {
             protectionSpace.host().impl() ? protectionSpace.host().impl()->hash() : 0, 
             protectionSpace.port(), 
             protectionSpace.serverType(),
-            protectionSpace.realm().impl() ? protectionSpace.realm().impl()->hash() : 0,
-            protectionSpace.authenticationScheme()
+            protectionSpace.authenticationScheme(),
+            protectionSpace.realm().impl() ? protectionSpace.realm().impl()->hash() : 0
         };
 
-        return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));    
+        unsigned codeCount = sizeof(hashCodes) / sizeof(UChar);
+        // Ignore realm for proxies.
+        if (protectionSpace.isProxy())
+            codeCount -= sizeof(hashCodes[0]) / sizeof(UChar);
+        return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), codeCount);
     }
     
     static bool equal(const ProtectionSpace& a, const ProtectionSpace& b) { return a == b; }
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.cpp
index 5a40b21a0d..7f61d2deb5 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.cpp
@@ -27,6 +27,7 @@
 #include "ResourceHandle.h"
 #include "ResourceHandleInternal.h"
 
+#include "DNS.h"
 #include "Logging.h"
 #include "ResourceHandleClient.h"
 #include "Timer.h"
@@ -36,28 +37,26 @@ namespace WebCore {
 
 static bool shouldForceContentSniffing;
 
-static bool portAllowed(const ResourceRequest&);
-
 ResourceHandle::ResourceHandle(const ResourceRequest& request, ResourceHandleClient* client, bool defersLoading,
-         bool shouldContentSniff, bool mightDownloadFromHandle)
-    : d(new ResourceHandleInternal(this, request, client, defersLoading, shouldContentSniff, mightDownloadFromHandle))
+         bool shouldContentSniff)
+    : d(new ResourceHandleInternal(this, request, client, defersLoading, shouldContentSniff))
 {
 }
 
 PassRefPtr<ResourceHandle> ResourceHandle::create(const ResourceRequest& request, ResourceHandleClient* client,
-    Frame* frame, bool defersLoading, bool shouldContentSniff, bool mightDownloadFromHandle)
+    Frame* frame, bool defersLoading, bool shouldContentSniff)
 {
     if (shouldContentSniff)
         shouldContentSniff = shouldContentSniffURL(request.url());
 
-    RefPtr<ResourceHandle> newHandle(adoptRef(new ResourceHandle(request, client, defersLoading, shouldContentSniff, mightDownloadFromHandle)));
+    RefPtr<ResourceHandle> newHandle(adoptRef(new ResourceHandle(request, client, defersLoading, shouldContentSniff)));
 
     if (!request.url().isValid()) {
         newHandle->scheduleFailure(InvalidURLFailure);
         return newHandle.release();
     }
 
-    if (!portAllowed(request)) {
+    if (!portAllowed(request.url())) {
         newHandle->scheduleFailure(BlockedFailure);
         return newHandle.release();
     }
@@ -106,104 +105,18 @@ const ResourceRequest& ResourceHandle::request() const
     return d->m_request;
 }
 
+const String& ResourceHandle::lastHTTPMethod() const
+{
+    return d->m_lastHTTPMethod;
+}
+
 void ResourceHandle::clearAuthentication()
 {
 #if PLATFORM(MAC)
     d->m_currentMacChallenge = nil;
-#elif USE(CFNETWORK)
-    d->m_currentCFChallenge = 0;
 #endif
     d->m_currentWebChallenge.nullify();
 }
-
-static bool portAllowed(const ResourceRequest& request)
-{
-    unsigned short port = request.url().port();
-
-    // Since most URLs don't have a port, return early for the "no port" case.
-    if (!port)
-        return true;
-
-    // This blocked port list matches the port blocking that Mozilla implements.
-    // See http://www.mozilla.org/projects/netlib/PortBanning.html for more information.
-    static const unsigned short blockedPortList[] = {
-        1,    // tcpmux
-        7,    // echo
-        9,    // discard
-        11,   // systat
-        13,   // daytime
-        15,   // netstat
-        17,   // qotd
-        19,   // chargen
-        20,   // FTP-data
-        21,   // FTP-control
-        22,   // SSH
-        23,   // telnet
-        25,   // SMTP
-        37,   // time
-        42,   // name
-        43,   // nicname
-        53,   // domain
-        77,   // priv-rjs
-        79,   // finger
-        87,   // ttylink
-        95,   // supdup
-        101,  // hostriame
-        102,  // iso-tsap
-        103,  // gppitnp
-        104,  // acr-nema
-        109,  // POP2
-        110,  // POP3
-        111,  // sunrpc
-        113,  // auth
-        115,  // SFTP
-        117,  // uucp-path
-        119,  // nntp
-        123,  // NTP
-        135,  // loc-srv / epmap
-        139,  // netbios
-        143,  // IMAP2
-        179,  // BGP
-        389,  // LDAP
-        465,  // SMTP+SSL
-        512,  // print / exec
-        513,  // login
-        514,  // shell
-        515,  // printer
-        526,  // tempo
-        530,  // courier
-        531,  // Chat
-        532,  // netnews
-        540,  // UUCP
-        556,  // remotefs
-        563,  // NNTP+SSL
-        587,  // ESMTP
-        601,  // syslog-conn
-        636,  // LDAP+SSL
-        993,  // IMAP+SSL
-        995,  // POP3+SSL
-        2049, // NFS
-        3659, // apple-sasl / PasswordServer [Apple addition]
-        4045, // lockd
-        6000, // X11
-    };
-    const unsigned short* const blockedPortListEnd = blockedPortList
-        + sizeof(blockedPortList) / sizeof(blockedPortList[0]);
-
-    // If the port is not in the blocked port list, allow it.
-    if (!std::binary_search(blockedPortList, blockedPortListEnd, port))
-        return true;
-
-    // Allow ports 21 and 22 for FTP URLs, as Mozilla does.
-    if ((port == 21 || port == 22) && request.url().protocolIs("ftp"))
-        return true;
-
-    // Allow any port number in a file URL, since the port number is ignored.
-    if (request.url().protocolIs("file"))
-        return true;
-
-    return false;
-}
   
 bool ResourceHandle::shouldContentSniff() const
 {
@@ -225,4 +138,11 @@ void ResourceHandle::forceContentSniffing()
     shouldForceContentSniffing = true;
 }
 
+#if !USE(SOUP)
+void ResourceHandle::prepareForURL(const KURL& url)
+{
+    return prefetchDNS(url.host());
+}
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.h
index a7dc9566bb..759f5bffdd 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.h
@@ -27,6 +27,7 @@
 #define ResourceHandle_h
 
 #include "AuthenticationChallenge.h"
+#include "AuthenticationClient.h"
 #include "HTTPHeaderMap.h"
 #include "ThreadableLoader.h"
 #include <wtf/OwnPtr.h>
@@ -84,16 +85,20 @@ class KURL;
 class ResourceError;
 class ResourceHandleClient;
 class ResourceHandleInternal;
-struct ResourceRequest;
+class ResourceRequest;
 class ResourceResponse;
 class SchedulePair;
 class SharedBuffer;
 
 template <typename T> class Timer;
 
-class ResourceHandle : public RefCounted<ResourceHandle> {
+class ResourceHandle : public RefCounted<ResourceHandle>
+#if PLATFORM(MAC) || USE(CFNETWORK) || USE(CURL)
+    , public AuthenticationClient
+#endif
+    {
 private:
-    ResourceHandle(const ResourceRequest&, ResourceHandleClient*, bool defersLoading, bool shouldContentSniff, bool mightDownloadFromHandle);
+    ResourceHandle(const ResourceRequest&, ResourceHandleClient*, bool defersLoading, bool shouldContentSniff);
 
     enum FailureType {
         BlockedFailure,
@@ -102,15 +107,16 @@ private:
 
 public:
     // FIXME: should not need the Frame
-    static PassRefPtr<ResourceHandle> create(const ResourceRequest&, ResourceHandleClient*, Frame*, bool defersLoading, bool shouldContentSniff, bool mightDownloadFromHandle = false);
+    static PassRefPtr<ResourceHandle> create(const ResourceRequest&, ResourceHandleClient*, Frame*, bool defersLoading, bool shouldContentSniff);
 
     static void loadResourceSynchronously(const ResourceRequest&, StoredCredentials, ResourceError&, ResourceResponse&, Vector<char>& data, Frame* frame);
+    static void prepareForURL(const KURL&);
     static bool willLoadFromCache(ResourceRequest&, Frame*);
 #if PLATFORM(MAC)
     static bool didSendBodyDataDelegateExists();
 #endif
 
-    ~ResourceHandle();
+    virtual ~ResourceHandle();
 
 #if PLATFORM(MAC) || USE(CFNETWORK)
     void willSendRequest(ResourceRequest&, const ResourceResponse& redirectResponse);
@@ -118,9 +124,9 @@ public:
 #endif
 #if PLATFORM(MAC) || USE(CFNETWORK) || USE(CURL)
     void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
-    void receivedCredential(const AuthenticationChallenge&, const Credential&);
-    void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
-    void receivedCancellation(const AuthenticationChallenge&);
+    virtual void receivedCredential(const AuthenticationChallenge&, const Credential&);
+    virtual void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
+    virtual void receivedCancellation(const AuthenticationChallenge&);
 #endif
 
 #if PLATFORM(MAC)
@@ -133,7 +139,6 @@ public:
     void schedule(SchedulePair*);
     void unschedule(SchedulePair*);
 #elif USE(CFNETWORK)
-    static CFRunLoopRef loaderRunLoop();
     CFURLConnectionRef connection() const;
     CFURLConnectionRef releaseConnectionForDownload();
     static void setHostAllowsAnyHTTPSCertificate(const String&);
@@ -166,7 +171,7 @@ public:
     friend LRESULT __stdcall ResourceHandleWndProc(HWND, unsigned message, WPARAM, LPARAM);
 #endif
 
-#if PLATFORM(QT) || USE(CURL) || USE(SOUP)
+#if PLATFORM(QT) || USE(CURL) || USE(SOUP) || PLATFORM(ANDROID)
     ResourceHandleInternal* getInternal() { return d.get(); }
 #endif
 
@@ -187,14 +192,21 @@ public:
     void setDefersLoading(bool);
       
     const ResourceRequest& request() const;
+    const String& lastHTTPMethod() const;
 
     void fireFailure(Timer<ResourceHandle>*);
 
+    using RefCounted<ResourceHandle>::ref;
+    using RefCounted<ResourceHandle>::deref;
+
 private:
     void scheduleFailure(FailureType);
 
     bool start(Frame*);
 
+    virtual void refAuthenticationClient() { ref(); }
+    virtual void derefAuthenticationClient() { deref(); }
+
     friend class ResourceHandleInternal;
     OwnPtr<ResourceHandleInternal> d;
 };
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleClient.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleClient.h
index c99be54d65..0fe77a12a6 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleClient.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleClient.h
@@ -27,7 +27,6 @@
 #define ResourceHandleClient_h
 
 #include <wtf/RefCounted.h>
-#include <wtf/Platform.h>
 #include <wtf/RefPtr.h>
 
 #if USE(CFNETWORK)
@@ -50,7 +49,7 @@ namespace WebCore {
     class KURL;
     class ResourceHandle;
     class ResourceError;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
 
     enum CacheStoragePolicy {
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleInternal.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleInternal.h
index 1733deaa0c..f20f05513d 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleInternal.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleInternal.h
@@ -68,6 +68,10 @@ class NSURLConnection;
 #endif
 #endif
 
+#if PLATFORM(ANDROID)
+#include "ResourceLoaderAndroid.h"
+#endif
+
 // The allocations and releases in ResourceHandleInternal are
 // Cocoa-exception-free (either simple Foundation classes or
 // WebCoreResourceLoaderImp which avoids doing work in dealloc).
@@ -77,13 +81,13 @@ namespace WebCore {
 
     class ResourceHandleInternal : public Noncopyable {
     public:
-        ResourceHandleInternal(ResourceHandle* loader, const ResourceRequest& request, ResourceHandleClient* c, bool defersLoading, bool shouldContentSniff, bool mightDownloadFromHandle)
+        ResourceHandleInternal(ResourceHandle* loader, const ResourceRequest& request, ResourceHandleClient* c, bool defersLoading, bool shouldContentSniff)
             : m_client(c)
             , m_request(request)
+            , m_lastHTTPMethod(request.httpMethod())
             , status(0)
             , m_defersLoading(defersLoading)
             , m_shouldContentSniff(shouldContentSniff)
-            , m_mightDownloadFromHandle(mightDownloadFromHandle)
 #if USE(CFNETWORK)
             , m_connection(0)
 #endif
@@ -128,8 +132,6 @@ namespace WebCore {
             , m_startWhenScheduled(false)
             , m_needsSiteSpecificQuirks(false)
             , m_currentMacChallenge(nil)
-#elif USE(CFNETWORK)
-            , m_currentCFChallenge(0)
 #endif
             , m_failureTimer(loader, &ResourceHandle::fireFailure)
         {
@@ -145,6 +147,7 @@ namespace WebCore {
         ResourceHandleClient* m_client;
         
         ResourceRequest m_request;
+        String m_lastHTTPMethod;
 
         // Suggested credentials for the current redirection step.
         String m_user;
@@ -156,7 +159,6 @@ namespace WebCore {
 
         bool m_defersLoading;
         bool m_shouldContentSniff;
-        bool m_mightDownloadFromHandle;
 #if USE(CFNETWORK)
         RetainPtr<CFURLConnectionRef> m_connection;
 #elif PLATFORM(MAC)
@@ -204,20 +206,17 @@ namespace WebCore {
         Frame* m_frame;
 #endif
 #if PLATFORM(QT)
-#if QT_VERSION < 0x040400
-        QWebNetworkJob* m_job;
-#else
         QNetworkReplyHandler* m_job;
-#endif
         QWebFrame* m_frame;
 #endif
 
-        // FIXME: The platform challenge is almost identical to the one stored in m_currentWebChallenge, but it has a different sender. We only need to store a sender reference here.
 #if PLATFORM(MAC)
+        // We need to keep a reference to the original challenge to be able to cancel it.
+        // It is almost identical to m_currentWebChallenge.nsURLAuthenticationChallenge(), but has a different sender.
         NSURLAuthenticationChallenge *m_currentMacChallenge;
 #endif
-#if USE(CFNETWORK)
-        CFURLAuthChallengeRef m_currentCFChallenge;
+#if PLATFORM(ANDROID)
+        RefPtr<ResourceLoaderAndroid> m_loader;
 #endif
         AuthenticationChallenge m_currentWebChallenge;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
index e0707d9602..42c1c6e927 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
@@ -24,6 +24,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 #include "config.h"
+
 #include "ResourceRequestBase.h"
 #include "ResourceRequest.h"
 
@@ -36,9 +37,9 @@ inline const ResourceRequest& ResourceRequestBase::asResourceRequest() const
     return *static_cast<const ResourceRequest*>(this);
 }
 
-auto_ptr<ResourceRequest> ResourceRequestBase::adopt(auto_ptr<CrossThreadResourceRequestData> data)
+PassOwnPtr<ResourceRequest> ResourceRequestBase::adopt(PassOwnPtr<CrossThreadResourceRequestData> data)
 {
-    auto_ptr<ResourceRequest> request(new ResourceRequest());
+    OwnPtr<ResourceRequest> request(new ResourceRequest());
     request->setURL(data->m_url);
     request->setCachePolicy(data->m_cachePolicy);
     request->setTimeoutInterval(data->m_timeoutInterval);
@@ -46,7 +47,7 @@ auto_ptr<ResourceRequest> ResourceRequestBase::adopt(auto_ptr<CrossThreadResourc
     request->setHTTPMethod(data->m_httpMethod);
 
     request->updateResourceRequest();
-    request->m_httpHeaderFields.adopt(auto_ptr<CrossThreadHTTPHeaderMapData>(data->m_httpHeaders.release()));
+    request->m_httpHeaderFields.adopt(data->m_httpHeaders.release());
 
     size_t encodingCount = data->m_responseContentDispositionEncodingFallbackArray.size();
     if (encodingCount > 0) {
@@ -63,18 +64,18 @@ auto_ptr<ResourceRequest> ResourceRequestBase::adopt(auto_ptr<CrossThreadResourc
     }
     request->setHTTPBody(data->m_httpBody);
     request->setAllowCookies(data->m_allowCookies);
-    return request;
+    return request.release();
 }
 
-auto_ptr<CrossThreadResourceRequestData> ResourceRequestBase::copyData() const
+PassOwnPtr<CrossThreadResourceRequestData> ResourceRequestBase::copyData() const
 {
-    auto_ptr<CrossThreadResourceRequestData> data(new CrossThreadResourceRequestData());
+    OwnPtr<CrossThreadResourceRequestData> data(new CrossThreadResourceRequestData());
     data->m_url = url().copy();
     data->m_cachePolicy = cachePolicy();
     data->m_timeoutInterval = timeoutInterval();
     data->m_firstPartyForCookies = firstPartyForCookies().copy();
     data->m_httpMethod = httpMethod().crossThreadString();
-    data->m_httpHeaders.adopt(httpHeaderFields().copyData());
+    data->m_httpHeaders = httpHeaderFields().copyData();
 
     data->m_responseContentDispositionEncodingFallbackArray.reserveInitialCapacity(m_responseContentDispositionEncodingFallbackArray.size());
     size_t encodingArraySize = m_responseContentDispositionEncodingFallbackArray.size();
@@ -84,7 +85,7 @@ auto_ptr<CrossThreadResourceRequestData> ResourceRequestBase::copyData() const
     if (m_httpBody)
         data->m_httpBody = m_httpBody->deepCopy();
     data->m_allowCookies = m_allowCookies;
-    return data;
+    return data.release();
 }
 
 bool ResourceRequestBase::isEmpty() const
@@ -208,6 +209,13 @@ String ResourceRequestBase::httpHeaderField(const AtomicString& name) const
     return m_httpHeaderFields.get(name);
 }
 
+String ResourceRequestBase::httpHeaderField(const char* name) const
+{
+    updateResourceRequest(); 
+    
+    return m_httpHeaderFields.get(name);
+}
+
 void ResourceRequestBase::setHTTPHeaderField(const AtomicString& name, const String& value)
 {
     updateResourceRequest(); 
@@ -218,6 +226,11 @@ void ResourceRequestBase::setHTTPHeaderField(const AtomicString& name, const Str
         m_platformRequestUpdated = false;
 }
 
+void ResourceRequestBase::setHTTPHeaderField(const char* name, const String& value)
+{
+    setHTTPHeaderField(AtomicString(name), value);
+}
+
 void ResourceRequestBase::clearHTTPReferrer()
 {
     updateResourceRequest(); 
@@ -378,7 +391,7 @@ void ResourceRequestBase::updateResourceRequest() const
     m_resourceRequestUpdated = true;
 }
 
-#if !PLATFORM(MAC) && !USE(CFNETWORK) && !USE(SOUP) && !PLATFORM(CHROMIUM)
+#if !PLATFORM(MAC) && !USE(CFNETWORK) && !USE(SOUP) && !PLATFORM(CHROMIUM) && !PLATFORM(ANDROID) && !PLATFORM(QT)
 unsigned initializeMaximumHTTPConnectionCountPerHost()
 {
     // This is used by the loader to control the number of issued parallel load requests. 
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h
index 84a7bd0b7c..2ca5d7dc30 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h
@@ -32,7 +32,6 @@
 #include "KURL.h"
 #include "HTTPHeaderMap.h"
 
-#include <memory>
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
@@ -46,16 +45,29 @@ namespace WebCore {
 
     const int unspecifiedTimeoutInterval = INT_MAX;
 
-    struct ResourceRequest;
+    class ResourceRequest;
     struct CrossThreadResourceRequestData;
 
     // Do not use this type directly.  Use ResourceRequest instead.
-    class ResourceRequestBase {
+    class ResourceRequestBase : public FastAllocBase {
     public:
-        static std::auto_ptr<ResourceRequest> adopt(std::auto_ptr<CrossThreadResourceRequestData>);
+        // The type of this ResourceRequest, based on how the resource will be used.
+        enum TargetType {
+            TargetIsMainFrame,
+            TargetIsSubframe,
+            TargetIsSubresource,  // Resource is a generic subresource.  (Generally a specific type should be specified)
+            TargetIsStyleSheet,
+            TargetIsScript,
+            TargetIsFontResource,
+            TargetIsImage,
+            TargetIsObject,
+            TargetIsMedia
+        };
+
+        static PassOwnPtr<ResourceRequest> adopt(PassOwnPtr<CrossThreadResourceRequestData>);
 
         // Gets a copy of the data suitable for passing to another thread.
-        std::auto_ptr<CrossThreadResourceRequestData> copyData() const;
+        PassOwnPtr<CrossThreadResourceRequestData> copyData() const;
 
         bool isNull() const;
         bool isEmpty() const;
@@ -79,7 +91,9 @@ namespace WebCore {
         
         const HTTPHeaderMap& httpHeaderFields() const;
         String httpHeaderField(const AtomicString& name) const;
+        String httpHeaderField(const char* name) const;
         void setHTTPHeaderField(const AtomicString& name, const String& value);
+        void setHTTPHeaderField(const char* name, const String& value);
         void addHTTPHeaderField(const AtomicString& name, const String& value);
         void addHTTPHeaderFields(const HTTPHeaderMap& headerFields);
         
@@ -115,12 +129,17 @@ namespace WebCore {
         bool reportUploadProgress() const { return m_reportUploadProgress; }
         void setReportUploadProgress(bool reportUploadProgress) { m_reportUploadProgress = reportUploadProgress; }
 
+        // What this request is for.
+        TargetType targetType() const { return m_targetType; }
+        void setTargetType(TargetType type) { m_targetType = type; }
+
     protected:
         // Used when ResourceRequest is initialized from a platform representation of the request
         ResourceRequestBase()
             : m_resourceRequestUpdated(false)
             , m_platformRequestUpdated(true)
             , m_reportUploadProgress(false)
+            , m_targetType(TargetIsSubresource)
         {
         }
 
@@ -133,6 +152,7 @@ namespace WebCore {
             , m_resourceRequestUpdated(true)
             , m_platformRequestUpdated(false)
             , m_reportUploadProgress(false)
+            , m_targetType(TargetIsSubresource)
         {
         }
 
@@ -152,6 +172,7 @@ namespace WebCore {
         mutable bool m_resourceRequestUpdated;
         mutable bool m_platformRequestUpdated;
         bool m_reportUploadProgress;
+        TargetType m_targetType;
 
     private:
         const ResourceRequest& asResourceRequest() const;
@@ -162,7 +183,7 @@ namespace WebCore {
     bool operator==(const ResourceRequestBase&, const ResourceRequestBase&);
     inline bool operator!=(ResourceRequestBase& a, const ResourceRequestBase& b) { return !(a == b); }
 
-    struct CrossThreadResourceRequestData {
+    struct CrossThreadResourceRequestData : Noncopyable {
         KURL m_url;
 
         ResourceRequestCachePolicy m_cachePolicy;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
index fd442252f8..3192a18798 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
@@ -85,9 +85,9 @@ ResourceResponseBase::ResourceResponseBase(const KURL& url, const String& mimeTy
 {
 }
 
-auto_ptr<ResourceResponse> ResourceResponseBase::adopt(auto_ptr<CrossThreadResourceResponseData> data)
+PassOwnPtr<ResourceResponse> ResourceResponseBase::adopt(PassOwnPtr<CrossThreadResourceResponseData> data)
 {
-    auto_ptr<ResourceResponse> response(new ResourceResponse());
+    OwnPtr<ResourceResponse> response(new ResourceResponse());
     response->setURL(data->m_url);
     response->setMimeType(data->m_mimeType);
     response->setExpectedContentLength(data->m_expectedContentLength);
@@ -98,15 +98,15 @@ auto_ptr<ResourceResponse> ResourceResponseBase::adopt(auto_ptr<CrossThreadResou
     response->setHTTPStatusText(data->m_httpStatusText);
 
     response->lazyInit();
-    response->m_httpHeaderFields.adopt(std::auto_ptr<CrossThreadHTTPHeaderMapData>(data->m_httpHeaders.release()));
+    response->m_httpHeaderFields.adopt(data->m_httpHeaders.release());
     response->setLastModifiedDate(data->m_lastModifiedDate);
 
-    return response;
+    return response.release();
 }
 
-auto_ptr<CrossThreadResourceResponseData> ResourceResponseBase::copyData() const
+PassOwnPtr<CrossThreadResourceResponseData> ResourceResponseBase::copyData() const
 {
-    auto_ptr<CrossThreadResourceResponseData> data(new CrossThreadResourceResponseData());
+    OwnPtr<CrossThreadResourceResponseData> data(new CrossThreadResourceResponseData());
     data->m_url = url().copy();
     data->m_mimeType = mimeType().crossThreadString();
     data->m_expectedContentLength = expectedContentLength();
@@ -114,9 +114,9 @@ auto_ptr<CrossThreadResourceResponseData> ResourceResponseBase::copyData() const
     data->m_suggestedFilename = suggestedFilename().crossThreadString();
     data->m_httpStatusCode = httpStatusCode();
     data->m_httpStatusText = httpStatusText().crossThreadString();
-    data->m_httpHeaders.adopt(httpHeaderFields().copyData());
+    data->m_httpHeaders = httpHeaderFields().copyData();
     data->m_lastModifiedDate = lastModifiedDate();
-    return data;
+    return data.release();
 }
 
 bool ResourceResponseBase::isHTTP() const
@@ -239,6 +239,13 @@ String ResourceResponseBase::httpHeaderField(const AtomicString& name) const
     return m_httpHeaderFields.get(name); 
 }
 
+String ResourceResponseBase::httpHeaderField(const char* name) const
+{
+    lazyInit();
+
+    return m_httpHeaderFields.get(name); 
+}
+
 void ResourceResponseBase::setHTTPHeaderField(const AtomicString& name, const String& value)
 {
     lazyInit();
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h
index 7594c097b1..74e23a4413 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h
@@ -30,7 +30,7 @@
 #include "HTTPHeaderMap.h"
 #include "KURL.h"
 
-#include <memory>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -38,12 +38,12 @@ class ResourceResponse;
 struct CrossThreadResourceResponseData;
 
 // Do not use this class directly, use the class ResponseResponse instead
-class ResourceResponseBase {
+class ResourceResponseBase : public FastAllocBase {
 public:
-    static std::auto_ptr<ResourceResponse> adopt(std::auto_ptr<CrossThreadResourceResponseData>);
+    static PassOwnPtr<ResourceResponse> adopt(PassOwnPtr<CrossThreadResourceResponseData>);
 
     // Gets a copy of the data suitable for passing to another thread.
-    std::auto_ptr<CrossThreadResourceResponseData> copyData() const;
+    PassOwnPtr<CrossThreadResourceResponseData> copyData() const;
 
     bool isNull() const { return m_isNull; }
     bool isHTTP() const;
@@ -71,6 +71,7 @@ public:
     void setHTTPStatusText(const String&);
     
     String httpHeaderField(const AtomicString& name) const;
+    String httpHeaderField(const char* name) const;
     void setHTTPHeaderField(const AtomicString& name, const String& value);
     const HTTPHeaderMap& httpHeaderFields() const;
 
@@ -150,7 +151,7 @@ private:
 inline bool operator==(const ResourceResponse& a, const ResourceResponse& b) { return ResourceResponseBase::compare(a, b); }
 inline bool operator!=(const ResourceResponse& a, const ResourceResponse& b) { return !(a == b); }
 
-struct CrossThreadResourceResponseData {
+struct CrossThreadResourceResponseData : Noncopyable {
     KURL m_url;
     String m_mimeType;
     long long m_expectedContentLength;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleBase.cpp
index 875c2485d3..8472713da2 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleBase.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "SocketStreamHandleBase.h"
 
+#include "SocketStreamHandle.h"
 #include "SocketStreamHandleClient.h"
 
 namespace WebCore {
@@ -64,7 +65,7 @@ bool SocketStreamHandleBase::send(const char* data, int length)
     int bytesWritten = 0;
     if (m_state == Open)
         bytesWritten = platformSend(data, length);
-    if (bytesWritten <= 0)
+    if (bytesWritten < 0)
         return false;
     if (m_buffer.size() + length - bytesWritten > bufferSize) {
         // FIXME: report error to indicate that buffer has no more space.
@@ -77,6 +78,8 @@ bool SocketStreamHandleBase::send(const char* data, int length)
 
 void SocketStreamHandleBase::close()
 {
+    RefPtr<SocketStreamHandle> protect(static_cast<SocketStreamHandle*>(this)); // platformClose calls the client, which may make the handle get deallocated immediately.
+
     platformClose();
     m_state = Closed;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleClient.h b/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleClient.h
index 04c744e961..5d97ec0c71 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleClient.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleClient.h
@@ -43,18 +43,15 @@ namespace WebCore {
     public:
         virtual ~SocketStreamHandleClient() { }
 
-        virtual void willOpenStream(SocketStreamHandle*, const KURL&) { }
-        virtual void willSendData(SocketStreamHandle*, const char* /*data*/, int /*length*/) { }
-
         virtual void didOpen(SocketStreamHandle*) { }
         virtual void didClose(SocketStreamHandle*) { }
         virtual void didReceiveData(SocketStreamHandle*, const char* /*data*/, int /*length*/) { }
 
         virtual void didFail(SocketStreamHandle*, const SocketStreamError&) { }
 
+        // No authentication for streams per se, but proxy may ask for credentials.
         virtual void didReceiveAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&) { }
         virtual void didCancelAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&) { }
-        virtual void receivedCancellation(SocketStreamHandle*, const AuthenticationChallenge&) { }
     };
 
 }  // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.cpp
index e687976a1d..d017b90744 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.cpp
@@ -20,7 +20,7 @@
 #include "config.h"
 #include "DnsPrefetchHelper.h"
 
-#include "CString.h"
+#include "PlatformString.h"
 
 namespace WebCore {
 // this is called on mouse over a href and on page loading
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h b/src/3rdparty/webkit/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h
index 536b06a074..86b367b38b 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h
@@ -22,9 +22,13 @@
 
 #include <QObject>
 
+#if QT_VERSION < 0x040700
 namespace QtMobility {
 class QNetworkConfigurationManager;
 }
+#else
+class QNetworkConfigurationManager;
+#endif
 
 namespace WebCore {
 
@@ -40,7 +44,11 @@ public slots:
     void networkAccessPermissionChanged(bool);
 
 public:
+#if QT_VERSION < 0x040700
     QtMobility::QNetworkConfigurationManager* m_configurationManager;
+#else
+    QNetworkConfigurationManager* m_configurationManager;
+#endif
     bool m_online;
     bool m_networkAccessAllowed;
     NetworkStateNotifier* m_notifier;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp
index e694264875..52512aae2f 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp
@@ -23,7 +23,9 @@
 #include "NetworkStateNotifierPrivate.h"
 #include "qnetworkconfigmanager.h"
 
+#if QT_VERSION < 0x040700
 using namespace QtMobility;
+#endif
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 1ac80f68f9..4237fca5da 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -21,8 +21,7 @@
 #include "config.h"
 #include "QNetworkReplyHandler.h"
 
-#if QT_VERSION >= 0x040400
-
+#include "CString.h"
 #include "HTTPParsers.h"
 #include "MIMETypeRegistry.h"
 #include "ResourceHandle.h"
@@ -40,6 +39,16 @@
 #include <QDebug>
 #include <QCoreApplication>
 
+// What type of connection should be used for the signals of the
+// QNetworkReply? This depends on if Qt has a bugfix for this or not.
+// It is fixed in Qt 4.6.1. See https://bugs.webkit.org/show_bug.cgi?id=32113
+#if QT_VERSION > QT_VERSION_CHECK(4, 6, 0)
+#define SIGNAL_CONN Qt::DirectConnection
+#else
+#define SIGNAL_CONN Qt::QueuedConnection
+#endif
+
+
 namespace WebCore {
 
 // Take a deep copy of the FormDataElement
@@ -144,6 +153,10 @@ QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode load
     else if (r.httpMethod() == "DELETE")
         m_method = QNetworkAccessManager::DeleteOperation;
 #endif
+#if QT_VERSION >= 0x040700
+    else if (r.httpMethod() == "OPTIONS")
+        m_method = QNetworkAccessManager::CustomOperation;
+#endif
     else
         m_method = QNetworkAccessManager::UnknownOperation;
 
@@ -309,13 +322,21 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
         response.setHTTPStatusText(m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toByteArray().constData());
 
         // Add remaining headers.
+#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
+        foreach (const QNetworkReply::RawHeaderPair& pair, m_reply->rawHeaderPairs()) {
+            response.setHTTPHeaderField(QString::fromAscii(pair.first), QString::fromAscii(pair.second));
+        }
+#else
         foreach (const QByteArray& headerName, m_reply->rawHeaderList()) {
             response.setHTTPHeaderField(QString::fromAscii(headerName), QString::fromAscii(m_reply->rawHeader(headerName)));
         }
+#endif
     }
 
     QUrl redirection = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
     if (redirection.isValid()) {
+        m_redirected = true;
+
         QUrl newUrl = m_reply->url().resolved(redirection);
         ResourceRequest newRequest = m_resourceHandle->request();
         newRequest.setURL(newUrl);
@@ -330,7 +351,9 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
             newRequest.clearHTTPReferrer();
 
         client->willSendRequest(m_resourceHandle, newRequest, response);
-        m_redirected = true;
+        if (!m_resourceHandle) // network error did cancel the request
+            return;
+
         m_request = newRequest.toNetworkRequest(m_resourceHandle->getInternal()->m_frame);
         return;
     }
@@ -365,6 +388,18 @@ void QNetworkReplyHandler::forwardData()
     }
 }
 
+void QNetworkReplyHandler::uploadProgress(qint64 bytesSent, qint64 bytesTotal)
+{
+    if (!m_resourceHandle)
+        return;
+
+    ResourceHandleClient* client = m_resourceHandle->client();
+    if (!client)
+        return;
+
+    client->didSendData(m_resourceHandle, bytesSent, bytesTotal);
+}
+
 void QNetworkReplyHandler::start()
 {
     m_shouldStart = false;
@@ -407,6 +442,11 @@ void QNetworkReplyHandler::start()
             break;
         }
 #endif
+#if QT_VERSION >= 0x040700
+        case QNetworkAccessManager::CustomOperation:
+            m_reply = manager->sendCustomRequest(m_request, m_resourceHandle->request().httpMethod().latin1().data());
+            break;
+#endif
         case QNetworkAccessManager::UnknownOperation: {
             m_reply = 0;
             ResourceHandleClient* client = m_resourceHandle->client();
@@ -423,18 +463,25 @@ void QNetworkReplyHandler::start()
     m_reply->setParent(this);
 
     connect(m_reply, SIGNAL(finished()),
-            this, SLOT(finish()), Qt::QueuedConnection);
+            this, SLOT(finish()), SIGNAL_CONN);
 
     // For http(s) we know that the headers are complete upon metaDataChanged() emission, so we
     // can send the response as early as possible
     if (scheme == QLatin1String("http") || scheme == QLatin1String("https"))
         connect(m_reply, SIGNAL(metaDataChanged()),
-                this, SLOT(sendResponseIfNeeded()), Qt::QueuedConnection);
+                this, SLOT(sendResponseIfNeeded()), SIGNAL_CONN);
 
     connect(m_reply, SIGNAL(readyRead()),
-            this, SLOT(forwardData()), Qt::QueuedConnection);
+            this, SLOT(forwardData()), SIGNAL_CONN);
+
+    if (m_resourceHandle->request().reportUploadProgress()) {
+        connect(m_reply, SIGNAL(uploadProgress(qint64, qint64)),
+                this, SLOT(uploadProgress(qint64, qint64)), SIGNAL_CONN);
+    }
+
+    // Make this a direct function call once we require 4.6.1+.
     connect(this, SIGNAL(processQueuedItems()),
-            this, SLOT(sendQueuedItems()), Qt::QueuedConnection);
+            this, SLOT(sendQueuedItems()), SIGNAL_CONN);
 }
 
 void QNetworkReplyHandler::resetState()
@@ -470,5 +517,3 @@ void QNetworkReplyHandler::sendQueuedItems()
 }
 
 #include "moc_QNetworkReplyHandler.cpp"
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
index fccc4a6980..eb5ae3c80a 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -21,8 +21,6 @@
 
 #include <QObject>
 
-#if QT_VERSION >= 0x040400
-
 #include <QNetworkRequest>
 #include <QNetworkAccessManager>
 
@@ -64,6 +62,7 @@ private slots:
     void sendResponseIfNeeded();
     void forwardData();
     void sendQueuedItems();
+    void uploadProgress(qint64 bytesSent, qint64 bytesTotal);
 
 private:
     void start();
@@ -113,6 +112,4 @@ private:
 
 }
 
-#endif
-
 #endif // QNETWORKREPLYHANDLER_H
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceHandleQt.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceHandleQt.cpp
index b3844bf94b..f006c08add 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceHandleQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceHandleQt.cpp
@@ -28,33 +28,29 @@
  */
 
 #include "config.h"
-
-#include "Frame.h"
-#include "DocLoader.h"
 #include "ResourceHandle.h"
-#include "ResourceHandleClient.h"
-#include "ResourceHandleInternal.h"
-#include "qwebpage_p.h"
-#include "qwebframe_p.h"
+
 #include "ChromeClientQt.h"
+#include "DocLoader.h"
+#include "Frame.h"
 #include "FrameLoaderClientQt.h"
+#include "NotImplemented.h"
 #include "Page.h"
 #include "QNetworkReplyHandler.h"
+#include "ResourceHandleClient.h"
+#include "ResourceHandleInternal.h"
+#include "SharedBuffer.h"
 
-#include "NotImplemented.h"
+// FIXME: WebCore including these headers from WebKit is a massive layering violation.
+#include "qwebframe_p.h"
+#include "qwebpage_p.h"
 
-#if QT_VERSION >= 0x040500
 #include <QAbstractNetworkCache>
-#endif
 #include <QCoreApplication>
 #include <QUrl>
-#if QT_VERSION >= 0x040400
 #include <QNetworkAccessManager>
 #include <QNetworkRequest>
 #include <QNetworkReply>
-#else
-#include "qwebnetworkinterface_p.h"
-#endif
 
 namespace WebCore {
 
@@ -141,23 +137,15 @@ bool ResourceHandle::start(Frame* frame)
     }
 
     getInternal()->m_frame = static_cast<FrameLoaderClientQt*>(frame->loader()->client())->webFrame();
-#if QT_VERSION < 0x040400
-    return QWebNetworkManager::self()->add(this, getInternal()->m_frame->page()->d->networkInterface);
-#else
     ResourceHandleInternal *d = getInternal();
     d->m_job = new QNetworkReplyHandler(this, QNetworkReplyHandler::LoadMode(d->m_defersLoading));
     return true;
-#endif
 }
 
 void ResourceHandle::cancel()
 {
-#if QT_VERSION < 0x040400
-    QWebNetworkManager::self()->cancel(this);
-#else
     if (d->m_job)
         d->m_job->abort();
-#endif
 }
 
 bool ResourceHandle::loadsBlocked()
@@ -170,7 +158,6 @@ bool ResourceHandle::willLoadFromCache(ResourceRequest& request, Frame* frame)
     if (!frame)
         return false;
 
-#if QT_VERSION >= 0x040500
     QNetworkAccessManager* manager = QWebFramePrivate::kit(frame)->page()->networkAccessManager();
     QAbstractNetworkCache* cache = manager->cache();
 
@@ -184,9 +171,6 @@ bool ResourceHandle::willLoadFromCache(ResourceRequest& request, Frame* frame)
     }
 
     return false;
-#else
-    return false;
-#endif
 }
 
 bool ResourceHandle::supportsBufferedData()
@@ -203,15 +187,8 @@ PassRefPtr<SharedBuffer> ResourceHandle::bufferedData()
 void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, StoredCredentials /*storedCredentials*/, ResourceError& error, ResourceResponse& response, Vector<char>& data, Frame* frame)
 {
     WebCoreSynchronousLoader syncLoader;
-    ResourceHandle handle(request, &syncLoader, true, false, true);
+    ResourceHandle handle(request, &syncLoader, true, false);
 
-#if QT_VERSION < 0x040400
-    if (!QWebNetworkManager::self()->add(&handle, QWebNetworkInterface::defaultInterface(), QWebNetworkManager::SynchronousJob)) {
-        // FIXME Create a sane ResourceError
-        error = ResourceError(String(), -1, String(), String());
-        return;
-    }
-#else
     ResourceHandleInternal *d = handle.getInternal();
     if (!(d->m_user.isEmpty() || d->m_pass.isEmpty())) {
         // If credentials were specified for this request, add them to the url,
@@ -223,7 +200,6 @@ void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, S
     }
     d->m_frame = static_cast<FrameLoaderClientQt*>(frame->loader()->client())->webFrame();
     d->m_job = new QNetworkReplyHandler(&handle, QNetworkReplyHandler::LoadNormal);
-#endif
 
     syncLoader.waitForCompletion();
     error = syncLoader.resourceError();
@@ -236,10 +212,8 @@ void ResourceHandle::setDefersLoading(bool defers)
 {
     d->m_defersLoading = defers;
 
-#if QT_VERSION >= 0x040400
     if (d->m_job)
         d->m_job->setLoadMode(QNetworkReplyHandler::LoadMode(defers));
-#endif
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceRequest.h b/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceRequest.h
index 60d32dd0a4..fb69326c56 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceRequest.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceRequest.h
@@ -36,8 +36,8 @@ QT_END_NAMESPACE
 
 namespace WebCore {
 
-    struct ResourceRequest : ResourceRequestBase {
-
+    class ResourceRequest : public ResourceRequestBase {
+    public:
         ResourceRequest(const String& url) 
             : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
@@ -59,9 +59,7 @@ namespace WebCore {
         {
         }
 
-#if QT_VERSION >= 0x040400
         QNetworkRequest toNetworkRequest(QObject* originatingObject) const;
-#endif
 
     private:
         friend class ResourceRequestBase;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceRequestQt.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceRequestQt.cpp
index a183c402d2..341e6ae5ed 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceRequestQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceRequestQt.cpp
@@ -1,5 +1,5 @@
 /*
-    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -21,13 +21,26 @@
 #include "ResourceRequest.h"
 
 #include <qglobal.h>
-#if QT_VERSION >= 0x040400
 
 #include <QNetworkRequest>
 #include <QUrl>
 
 namespace WebCore {
 
+// Currently Qt allows three connections per host on symbian and six
+// for everyone else. The limit can be found in qhttpnetworkconnection.cpp.
+// To achieve the best result we want WebKit to schedule the jobs so we
+// are using the limit as found in Qt. To allow Qt to fill its queue
+// and prepare jobs we will schedule two more downloads.
+unsigned initializeMaximumHTTPConnectionCountPerHost()
+{
+#ifdef Q_OS_SYMBIAN
+    return 3 + 2;
+#else
+    return 6 + 2;
+#endif
+}
+
 QNetworkRequest ResourceRequest::toNetworkRequest(QObject* originatingFrame) const
 {
     QNetworkRequest request;
@@ -70,4 +83,3 @@ QNetworkRequest ResourceRequest::toNetworkRequest(QObject* originatingFrame) con
 
 }
 
-#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/SocketStreamHandle.h b/src/3rdparty/webkit/WebCore/platform/network/qt/SocketStreamHandle.h
index 64139e5cd3..5c5574938c 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/SocketStreamHandle.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/SocketStreamHandle.h
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2010 Nokia Inc. All rights reserved.
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc.  All rights reserved.
  *
@@ -42,6 +43,7 @@ namespace WebCore {
     class AuthenticationChallenge;
     class Credential;
     class SocketStreamHandleClient;
+    class SocketStreamHandlePrivate;
 
     class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase {
     public:
@@ -61,6 +63,8 @@ namespace WebCore {
         void receivedCredential(const AuthenticationChallenge&, const Credential&);
         void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
         void receivedCancellation(const AuthenticationChallenge&);
+        SocketStreamHandlePrivate* m_p;
+        friend class SocketStreamHandlePrivate;
     };
 
 }  // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/SocketStreamHandlePrivate.h b/src/3rdparty/webkit/WebCore/platform/network/qt/SocketStreamHandlePrivate.h
new file mode 100644
index 0000000000..235f1b1ffe
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/SocketStreamHandlePrivate.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2010 Nokia Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandlePrivate_h
+#define SocketStreamHandlePrivate_h
+
+#include "SocketStreamHandleBase.h"
+
+#include <QSslSocket>
+#include <QTcpSocket>
+
+namespace WebCore {
+
+class AuthenticationChallenge;
+class Credential;
+class SocketStreamHandleClient;
+class SocketStreamHandlePrivate;
+
+class SocketStreamHandlePrivate : public QObject {
+    Q_OBJECT
+public:
+    SocketStreamHandlePrivate(SocketStreamHandle*, const KURL&);
+    ~SocketStreamHandlePrivate();
+
+public slots:
+    void socketConnected();
+    void socketReadyRead();
+    int send(const char* data, int len);
+    void close();
+    void socketSentdata();
+    void socketClosed();
+    void socketError(QAbstractSocket::SocketError);
+    void socketClosedCallback();
+    void socketErrorCallback(int);
+#ifndef QT_NO_OPENSSL
+    void socketSslErrors(const QList<QSslError>&);
+#endif
+public:
+    QTcpSocket* m_socket;
+    SocketStreamHandle* m_streamHandle;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/SocketStreamHandleQt.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/SocketStreamHandleQt.cpp
new file mode 100644
index 0000000000..e666ff77ae
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/SocketStreamHandleQt.cpp
@@ -0,0 +1,208 @@
+/*
+ * Copyright (C) 2010 Nokia Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamHandle.h"
+
+#include "KURL.h"
+#include "Logging.h"
+#include "NotImplemented.h"
+#include "SocketStreamHandleClient.h"
+#include "SocketStreamHandlePrivate.h"
+
+namespace WebCore {
+
+SocketStreamHandlePrivate::SocketStreamHandlePrivate(SocketStreamHandle* streamHandle, const KURL& url) : QObject()
+{
+    m_streamHandle = streamHandle;
+    m_socket = 0;
+    bool isSecure = url.protocolIs("wss");
+
+    if (isSecure) {
+#ifndef QT_NO_OPENSSL
+        m_socket = new QSslSocket(this);
+#endif
+    } else
+        m_socket = new QTcpSocket(this);
+
+    if (!m_socket)
+        return;
+
+    connect(m_socket, SIGNAL(connected()), this, SLOT(socketConnected()));
+    connect(m_socket, SIGNAL(readyRead()), this, SLOT(socketReadyRead()));
+    connect(m_socket, SIGNAL(disconnected()), this, SLOT(socketClosed()));
+    connect(m_socket, SIGNAL(error(QAbstractSocket::SocketError)), this, SLOT(socketError(QAbstractSocket::SocketError)));
+    if (isSecure)
+        connect(m_socket, SIGNAL(sslErrors(const QList<QSslError>&)), this, SLOT(socketSslErrors(const QList<QSslError>&)));
+
+    unsigned int port = url.hasPort() ? url.port() : (isSecure ? 443 : 80);
+
+    QString host = url.host();
+    if (isSecure) {
+#ifndef QT_NO_OPENSSL
+        static_cast<QSslSocket*>(m_socket)->connectToHostEncrypted(host, port);
+#endif
+    } else
+        m_socket->connectToHost(host, port);
+}
+
+SocketStreamHandlePrivate::~SocketStreamHandlePrivate()
+{
+    Q_ASSERT(!(m_socket && m_socket->state() == QAbstractSocket::ConnectedState));
+}
+
+void SocketStreamHandlePrivate::socketConnected()
+{
+    if (m_streamHandle && m_streamHandle->client()) {
+        m_streamHandle->m_state = SocketStreamHandleBase::Open;
+        m_streamHandle->client()->didOpen(m_streamHandle);
+    }
+}
+
+void SocketStreamHandlePrivate::socketReadyRead()
+{
+    if (m_streamHandle && m_streamHandle->client()) {
+        QByteArray data = m_socket->read(m_socket->bytesAvailable());
+        m_streamHandle->client()->didReceiveData(m_streamHandle, data.constData(), data.size());
+    }
+}
+
+int SocketStreamHandlePrivate::send(const char* data, int len)
+{
+    if (!m_socket || m_socket->state() != QAbstractSocket::ConnectedState)
+        return 0;
+    quint64 sentSize = m_socket->write(data, len);
+    QMetaObject::invokeMethod(this, "socketSentData", Qt::QueuedConnection);
+    return sentSize;
+}
+
+void SocketStreamHandlePrivate::close()
+{
+    if (m_socket && m_socket->state() == QAbstractSocket::ConnectedState)
+        m_socket->close();
+}
+
+void SocketStreamHandlePrivate::socketSentdata()
+{
+    if (m_streamHandle)
+        m_streamHandle->sendPendingData();
+}
+
+void SocketStreamHandlePrivate::socketClosed()
+{
+    QMetaObject::invokeMethod(this, "socketClosedCallback", Qt::QueuedConnection);
+}
+
+void SocketStreamHandlePrivate::socketError(QAbstractSocket::SocketError error)
+{
+    QMetaObject::invokeMethod(this, "socketErrorCallback", Qt::QueuedConnection, Q_ARG(int, error));
+}
+
+void SocketStreamHandlePrivate::socketClosedCallback()
+{
+    if (m_streamHandle && m_streamHandle->client()) {
+        SocketStreamHandle* streamHandle = m_streamHandle;
+        m_streamHandle = 0;
+        // This following call deletes _this_. Nothing should be after it.
+        streamHandle->client()->didClose(streamHandle);
+    }
+}
+
+void SocketStreamHandlePrivate::socketErrorCallback(int error)
+{
+    // FIXME - in the future, we might not want to treat all errors as fatal.
+    if (m_streamHandle && m_streamHandle->client()) {
+        SocketStreamHandle* streamHandle = m_streamHandle;
+        m_streamHandle = 0;
+        // This following call deletes _this_. Nothing should be after it.
+        streamHandle->client()->didClose(streamHandle);
+    }
+}
+
+#ifndef QT_NO_OPENSSL
+void SocketStreamHandlePrivate::socketSslErrors(const QList<QSslError>&)
+{
+    // FIXME: based on http://tools.ietf.org/html/draft-hixie-thewebsocketprotocol-68#page-15
+    // we should abort on certificate errors.
+    // We don't abort while this is still work in progress.
+    static_cast<QSslSocket*>(m_socket)->ignoreSslErrors();
+}
+#endif
+
+SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient* client)
+    : SocketStreamHandleBase(url, client)
+{
+    LOG(Network, "SocketStreamHandle %p new client %p", this, m_client);
+    m_p = new SocketStreamHandlePrivate(this, url);
+}
+
+SocketStreamHandle::~SocketStreamHandle()
+{
+    LOG(Network, "SocketStreamHandle %p delete", this);
+    setClient(0);
+    delete m_p;
+}
+
+int SocketStreamHandle::platformSend(const char* data, int len)
+{
+    LOG(Network, "SocketStreamHandle %p platformSend", this);
+    return m_p->send(data, len);
+}
+
+void SocketStreamHandle::platformClose()
+{
+    LOG(Network, "SocketStreamHandle %p platformClose", this);
+    m_p->close();
+}
+
+void SocketStreamHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCredential(const AuthenticationChallenge&, const Credential&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCancellation(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
+#include "moc_SocketStreamHandlePrivate.cpp"
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
index 9d2c452ff0..c23e42eaac 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
@@ -95,21 +95,7 @@ void ClipboardQt::clearData(const String& type)
         return;
 
     if (m_writableData) {
-#if QT_VERSION >= 0x040400
         m_writableData->removeFormat(type);
-#else
-        const QString toClearType = type;
-        QMap<QString, QByteArray> formats;
-        foreach (QString format, m_writableData->formats()) {
-            if (format != toClearType)
-                formats[format] = m_writableData->data(format);
-        }
-
-        m_writableData->clear();
-        QMap<QString, QByteArray>::const_iterator it, end = formats.constEnd();
-        for (it = formats.begin(); it != end; ++it)
-            m_writableData->setData(it.key(), it.value());
-#endif
         if (m_writableData->formats().isEmpty()) {
             if (isForDragging())
                 delete m_writableData;
@@ -304,6 +290,19 @@ void ClipboardQt::writeRange(Range* range, Frame* frame)
 #endif
 }
 
+void ClipboardQt::writePlainText(const String& str)
+{
+    if (!m_writableData)
+        m_writableData = new QMimeData;
+    QString text = str;
+    text.replace(QChar(0xa0), QLatin1Char(' '));
+    m_writableData->setText(text);
+#ifndef QT_NO_CLIPBOARD
+    if (!isForDragging())
+        QApplication::clipboard()->setMimeData(m_writableData);
+#endif
+}
+
 bool ClipboardQt::hasData()
 {
     const QMimeData *data = m_readableData ? m_readableData : m_writableData;
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.h b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.h
index 9a918ed96d..9b54d5f4e3 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.h
+++ b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.h
@@ -66,6 +66,7 @@ namespace WebCore {
         virtual void declareAndWriteDragImage(Element*, const KURL&, const String& title, Frame*);
         virtual void writeURL(const KURL&, const String&, Frame*);
         virtual void writeRange(Range*, Frame*);
+        virtual void writePlainText(const String&);
 
         virtual bool hasData();
 
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/CookieJarQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/CookieJarQt.cpp
index a27a06e202..15053ebf6a 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/CookieJarQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/CookieJarQt.cpp
@@ -33,19 +33,14 @@
 #include "KURL.h"
 #include "PlatformString.h"
 
-#if QT_VERSION >= 0x040400
 #include "qwebpage.h"
 #include "qwebframe.h"
 #include "FrameLoaderClientQt.h"
 #include <QNetworkAccessManager>
 #include <QNetworkCookie>
-#else
-#include <qcookiejar.h>
-#endif
 
 namespace WebCore {
 
-#if QT_VERSION >= 0x040400
 static QNetworkCookieJar *cookieJar(const Document *document)
 {
     if (!document)
@@ -62,19 +57,16 @@ static QNetworkCookieJar *cookieJar(const Document *document)
     QNetworkCookieJar* jar = manager->cookieJar();
     return jar;
 }
-#endif
 
 void setCookies(Document* document, const KURL& url, const String& value)
 {
     QUrl u(url);
     QUrl p(document->firstPartyForCookies());
-#if QT_VERSION >= 0x040400
     QNetworkCookieJar* jar = cookieJar(document);
     if (!jar)
         return;
 
     QList<QNetworkCookie> cookies = QNetworkCookie::parseCookies(QString(value).toAscii());
-#if QT_VERSION >= 0x040500
     QList<QNetworkCookie>::Iterator it = cookies.begin();
     while (it != cookies.end()) {
         if (it->isHttpOnly())
@@ -82,17 +74,12 @@ void setCookies(Document* document, const KURL& url, const String& value)
         else
             ++it;
     }
-#endif
     jar->setCookiesFromUrl(cookies, u);
-#else
-    QCookieJar::cookieJar()->setCookies(u, p, (QString)value);
-#endif
 }
 
 String cookies(const Document* document, const KURL& url)
 {
     QUrl u(url);
-#if QT_VERSION >= 0x040400
     QNetworkCookieJar* jar = cookieJar(document);
     if (!jar)
         return String();
@@ -103,32 +90,39 @@ String cookies(const Document* document, const KURL& url)
 
     QStringList resultCookies;
     foreach (QNetworkCookie networkCookie, cookies) {
-#if QT_VERSION >= 0x040500
         if (networkCookie.isHttpOnly())
             continue;
-#endif
         resultCookies.append(QString::fromAscii(
                              networkCookie.toRawForm(QNetworkCookie::NameAndValueOnly).constData()));
     }
 
     return resultCookies.join(QLatin1String("; "));
-#else
-    QString cookies = QCookieJar::cookieJar()->cookies(u);
-    int idx = cookies.indexOf(QLatin1Char(';'));
-    if (idx > 0)
-        cookies = cookies.left(idx);
-    return cookies;
-#endif
+}
+
+String cookieRequestHeaderFieldValue(const Document* document, const KURL &url)
+{
+    QUrl u(url);
+    QNetworkCookieJar* jar = cookieJar(document);
+    if (!jar)
+        return String();
+
+    QList<QNetworkCookie> cookies = jar->cookiesForUrl(u);
+    if (cookies.isEmpty())
+        return String();
+
+    QStringList resultCookies;
+    foreach (QNetworkCookie networkCookie, cookies) {
+        resultCookies.append(QString::fromAscii(
+                             networkCookie.toRawForm(QNetworkCookie::NameAndValueOnly).constData()));
+    }
+
+    return resultCookies.join(QLatin1String("; "));
 }
 
 bool cookiesEnabled(const Document* document)
 {
-#if QT_VERSION >= 0x040400
     QNetworkCookieJar* jar = cookieJar(document);
     return (jar != 0);
-#else
-    return QCookieJar::cookieJar()->isEnabled();
-#endif
 }
 
 bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/CursorQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/CursorQt.cpp
index 3fc83f9275..87f4fcea57 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/CursorQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/CursorQt.cpp
@@ -73,7 +73,7 @@ Cursor& Cursor::operator=(const Cursor& other)
 namespace {
 
 // FIXME: static deleter
-class Cursors {
+class Cursors : public Noncopyable {
 protected:
     Cursors()
 #ifndef QT_NO_CURSOR
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/DragDataQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/DragDataQt.cpp
index b0611e61f4..09a797fafd 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/DragDataQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/DragDataQt.cpp
@@ -134,7 +134,7 @@ String DragData::asURL(String*) const
 PassRefPtr<DocumentFragment> DragData::asFragment(Document* doc) const
 {
     if (m_platformDragData && m_platformDragData->hasHtml())
-        return createFragmentFromMarkup(doc, m_platformDragData->html(), "");
+        return createFragmentFromMarkup(doc, m_platformDragData->html(), "", FragmentScriptingNotAllowed);
 
     return 0;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/KURLQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/KURLQt.cpp
index 1f62006b21..72dea919a4 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/KURLQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/KURLQt.cpp
@@ -27,14 +27,6 @@
 
 namespace WebCore {
 
-#if QT_VERSION < 0x040500
-static const char hexnumbers[] = "0123456789ABCDEF";
-static inline char toHex(char c)
-{
-    return hexnumbers[c & 0xf];
-}
-#endif
-
 KURL::KURL(const QUrl& url)
 {
     *this = KURL(KURL(), url.toEncoded().constData(), UTF8Encoding());
@@ -42,52 +34,8 @@ KURL::KURL(const QUrl& url)
 
 KURL::operator QUrl() const
 {
-#if QT_VERSION < 0x040500
-    unsigned length = m_string.length();
-
-    QByteArray ba;
-    ba.reserve(length);
-
-    int path = -1;
-    int host = m_string.find("://");
-    if (host != -1) {
-        host += 3;
-
-        path = m_string.find('/', host);
-    }
-
-    for (unsigned i = 0; i < length; ++i) {
-        const char chr = static_cast<char>(m_string[i]);
-
-        switch (chr) {
-            encode:
-            case '{':
-            case '}':
-            case '|':
-            case '\\':
-            case '^':
-            case '`':
-                ba.append('%');
-                ba.append(toHex((chr & 0xf0) >> 4));
-                ba.append(toHex(chr & 0xf));
-                break;
-            case '[':
-            case ']':
-                // special case: if this is the host part, don't encode
-                // otherwise, encode
-                if (host == -1 || (path != -1 && i >= path))
-                    goto encode;
-                // fall through
-            default:
-                ba.append(chr);
-                break;
-        }
-    }
-#else
-    // Qt 4.5 or later
-    // No need for special encoding
-    QByteArray ba = m_string.utf8().data();
-#endif
+    QString str = QString::fromRawData(reinterpret_cast<const QChar*>(m_string.characters()), m_string.length());
+    QByteArray ba = str.toUtf8();
 
     QUrl url = QUrl::fromEncoded(ba);
     return url;
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp b/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp
index ca3ca9dff1..db6c9d4480 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp
@@ -30,7 +30,9 @@
 
 #include "IntSize.h"
 #include "LocalizedStrings.h"
+#include "NotImplemented.h"
 #include "PlatformString.h"
+#include <wtf/MathExtras.h>
 
 #include <QCoreApplication>
 #include <QLocale>
@@ -339,6 +341,21 @@ String AXLinkActionVerb()
     return String();
 }
 
+String AXMenuListPopupActionVerb()
+{
+    return String();
+}
+
+String AXMenuListActionVerb()
+{
+    return String();
+}
+    
+String missingPluginText()
+{
+    return QCoreApplication::translate("QWebPage", "Missing Plug-in", "Label text to be used when a plug-in is missing");
+}
+
 String multipleFileUploadText(unsigned)
 {
     return String();
@@ -470,5 +487,47 @@ String localizedMediaTimeDescription(float time)
 }
 #endif  // ENABLE(VIDEO)
 
+String validationMessageValueMissingText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessagePatternMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTooLongText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeUnderflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeOverflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageStepMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
 }
 // vim: ts=4 sw=4 et
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/Maemo5Webstyle.cpp b/src/3rdparty/webkit/WebCore/platform/qt/Maemo5Webstyle.cpp
new file mode 100644
index 0000000000..42b0b7191d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/qt/Maemo5Webstyle.cpp
@@ -0,0 +1,268 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#include "config.h"
+#include "Maemo5Webstyle.h"
+
+#include "QtStyleOptionWebComboBox.h"
+
+#include <QPainter>
+#include <QPixmapCache>
+#include <QStyleOption>
+
+Maemo5WebStyle::Maemo5WebStyle()
+{
+}
+
+static inline void drawRectangularControlBackground(QPainter* painter, const QPen& pen, const QRect& rect, const QBrush& brush)
+{
+    QPen oldPen = painter->pen();
+    QBrush oldBrush = painter->brush();
+    painter->setPen(pen);
+    painter->setBrush(brush);
+
+    int line = 1;
+    painter->drawRect(rect.adjusted(line, line, -line, -line));
+
+    painter->setPen(oldPen);
+    painter->setBrush(oldBrush);
+}
+
+void Maemo5WebStyle::drawChecker(QPainter* painter, int size, QColor color) const
+{
+    int border = qMin(qMax(1, int(0.2 * size)), 6);
+    int checkerSize = size - 2 * border;
+    int width = checkerSize / 3;
+    int middle = qMax(3 * checkerSize / 7, 3);
+    int x = ((size - checkerSize) >> 1);
+    int y = ((size - checkerSize) >> 1) + (checkerSize - width - middle);
+    QVector<QLineF> lines(checkerSize + 1);
+    painter->setPen(color);
+    for (int i = 0; i < middle; ++i) {
+        lines[i] = QLineF(x, y, x, y + width);
+        ++x;
+        ++y;
+    }
+    for (int i = middle; i <= checkerSize; ++i) {
+        lines[i] = QLineF(x, y, x, y + width);
+        ++x;
+        --y;
+    }
+    painter->drawLines(lines.constData(), lines.size());
+}
+
+QPixmap Maemo5WebStyle::findChecker(const QRect& rect, bool disabled) const
+{
+    int size = qMin(rect.width(), rect.height());
+    QPixmap result;
+    static const QString prefix = "$qt-maemo5-" + QLatin1String(metaObject()->className()) + "-checker-";
+    QString key = prefix + QString::number(size) + "-" + (disabled ? "disabled" : "enabled");
+    if (!QPixmapCache::find(key, result)) {
+        result = QPixmap(size, size);
+        result.fill(Qt::transparent);
+        QPainter painter(&result);
+        drawChecker(&painter, size, disabled ? Qt::gray : Qt::black);
+        QPixmapCache::insert(key, result);
+    }
+    return result;
+}
+
+void Maemo5WebStyle::drawRadio(QPainter* painter, const QSize& size, bool checked, QColor color) const
+{
+    painter->setRenderHint(QPainter::Antialiasing, true);
+
+    // deflate one pixel
+    QRect rect = QRect(QPoint(1, 1), QSize(size.width() - 2, size.height() - 2));
+
+    QPen pen(Qt::black);
+    pen.setWidth(1);
+    painter->setPen(color);
+    painter->setBrush(Qt::white);
+    painter->drawEllipse(rect);
+    int border = 0.1 * (rect.width() + rect.height());
+    border = qMin(qMax(2, border), 10);
+    rect.adjust(border, border, -border, -border);
+    if (checked) {
+        painter->setPen(Qt::NoPen);
+        painter->setBrush(color);
+        painter->drawEllipse(rect);
+    }
+}
+
+QPixmap Maemo5WebStyle::findRadio(const QSize& size, bool checked, bool disabled) const
+{
+    QPixmap result;
+    static const QString prefix = "$qt-maemo5-" + QLatin1String(metaObject()->className()) + "-radio-";
+    QString key = prefix + QString::number(size.width()) + "-" + QString::number(size.height()) +
+                   + "-" + (disabled ? "disabled" : "enabled") + (checked ? "-checked" : "");
+    if (!QPixmapCache::find(key, result)) {
+        result = QPixmap(size);
+        result.fill(Qt::transparent);
+        QPainter painter(&result);
+        drawRadio(&painter, size, checked, disabled ? Qt::gray : Qt::black);
+        QPixmapCache::insert(key, result);
+    }
+    return result;
+}
+
+void Maemo5WebStyle::drawControl(ControlElement element, const QStyleOption* option, QPainter* painter, const QWidget* widget) const
+{
+    switch (element) {
+    case CE_CheckBox: {
+        QRect rect = option->rect;
+        const bool disabled = !(option->state & State_Enabled);
+        drawRectangularControlBackground(painter, QPen(disabled ? Qt::gray : Qt::black), rect, option->palette.base());
+        rect.adjust(1, 1, -1, -1);
+
+        if (option->state & State_Off)
+            break;
+
+        QPixmap checker = findChecker(rect, disabled);
+        if (checker.isNull())
+            break;
+
+        int x = (rect.width() - checker.width()) >> 1;
+        int y = (rect.height() - checker.height()) >> 1;
+        painter->drawPixmap(rect.x() + x, rect.y() + y, checker);
+        break;
+    }
+    case CE_RadioButton: {
+        const bool disabled = !(option->state & State_Enabled);
+        QPixmap radio = findRadio(option->rect.size(), option->state & State_On, disabled);
+        if (radio.isNull())
+            break;
+        painter->drawPixmap(option->rect.x(), option->rect.y(), radio);
+        break;
+    }
+    default:
+        QWindowsStyle::drawControl(element, option, painter, widget);
+    }
+}
+
+void Maemo5WebStyle::drawMultipleComboButton(QPainter* painter, const QSize& size, QColor color) const
+{
+    int rectWidth = size.width() - 1;
+    int width = qMax(2, rectWidth >> 3);
+    int distance = (rectWidth - 3 * width) >> 1;
+    int top = (size.height() - width) >> 1;
+
+    painter->setPen(color);
+    painter->setBrush(color);
+
+    painter->drawRect(0, top, width, width);
+    painter->drawRect(width + distance, top, width, width);
+    painter->drawRect(2 * (width + distance), top, width, width);
+}
+
+void Maemo5WebStyle::drawSimpleComboButton(QPainter* painter, const QSize& size, QColor color) const
+{
+    QPolygon polygon;
+    int width = size.width();
+    polygon.setPoints(3, 0, 0,  width - 1, 0,  width >> 1, size.height());
+    painter->setPen(color);
+    painter->setBrush(color);
+    painter->drawPolygon(polygon);
+}
+
+QSize Maemo5WebStyle::getButtonImageSize(const QSize& buttonSize) const
+{
+    const int border = qMax(3, buttonSize.width() >> 3) << 1;
+
+    int width = buttonSize.width() - border;
+    int height = buttonSize.height() - border;
+
+    if (width < 0 || height < 0)
+        return QSize();
+
+    if (height >= (width >> 1))
+        width = width >> 1 << 1;
+    else
+        width = height << 1;
+
+    return QSize(width + 1, width >> 1);
+}
+
+QPixmap Maemo5WebStyle::findComboButton(const QSize& size, bool multiple, bool disabled) const
+{
+    QPixmap result;
+    QSize imageSize = getButtonImageSize(size);
+
+    if (imageSize.isNull())
+        return QPixmap();
+    static const QString prefix = "$qt-maemo5-" + QLatin1String(metaObject()->className()) + "-combo-";
+    QString key = prefix + (multiple ? "multiple-" : "simple-") +
+                  QString::number(imageSize.width()) + "-" + QString::number(imageSize.height()) +
+                   + "-" + (disabled ? "disabled" : "enabled");
+    if (!QPixmapCache::find(key, result)) {
+        result = QPixmap(imageSize);
+        result.fill(Qt::transparent);
+        QPainter painter(&result);
+        if (multiple)
+            drawMultipleComboButton(&painter, imageSize, disabled ? Qt::gray : Qt::black);
+        else
+            drawSimpleComboButton(&painter, imageSize, disabled ? Qt::gray : Qt::black);
+        QPixmapCache::insert(key, result);
+    }
+    return result;
+}
+
+void Maemo5WebStyle::drawComplexControl(ComplexControl control, const QStyleOptionComplex* option, QPainter* painter, const QWidget* widget) const
+{
+    switch (control) {
+    case CC_ComboBox: {
+
+        bool multiple = false;
+        const bool disabled = !(option->state & State_Enabled);
+
+        const QStyleOptionComboBox* cmb = 0;
+        const WebCore::QtStyleOptionWebComboBox* webCombo = static_cast<const WebCore::QtStyleOptionWebComboBox*>(option);
+
+        if (webCombo) {
+            multiple = webCombo->multiple();
+            cmb = webCombo;
+        } else
+            cmb = qstyleoption_cast<const QStyleOptionComboBox*>(option);
+
+        if (!cmb) {
+            QWindowsStyle::drawComplexControl(control, option, painter, widget);
+            break;
+        }
+
+        if (!(cmb->subControls & SC_ComboBoxArrow))
+            break;
+
+        QRect rect = subControlRect(CC_ComboBox, cmb, SC_ComboBoxArrow, widget);
+        QPixmap pic = findComboButton(rect.size(), multiple, disabled);
+
+        if (pic.isNull())
+            break;
+
+        int x = (rect.width() - pic.width()) >> 1;
+        int y = (rect.height() - pic.height()) >> 1;
+        painter->drawPixmap(rect.x() + x, rect.y() + y, pic);
+
+        painter->setPen(disabled ? Qt::gray : Qt::darkGray);
+        painter->drawLine(rect.left() - 2, rect.top() + 2, rect.left() - 2, rect.bottom() - 2);
+
+        break;
+    }
+    default:
+        QWindowsStyle::drawComplexControl(control, option, painter, widget);
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/Maemo5Webstyle.h b/src/3rdparty/webkit/WebCore/platform/qt/Maemo5Webstyle.h
new file mode 100644
index 0000000000..ce717b6e3e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/qt/Maemo5Webstyle.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef Maemo5Webstyle_h
+#define Maemo5Webstyle_h
+
+#include <QWindowsStyle>
+
+class Maemo5WebStyle : public QWindowsStyle {
+public:
+    Maemo5WebStyle();
+
+    void drawControl(ControlElement element, const QStyleOption* option, QPainter* painter, const QWidget* widget = 0) const;
+    void drawComplexControl(ComplexControl cc, const QStyleOptionComplex* option, QPainter* painter, const QWidget* widget = 0) const;
+
+private:
+    void drawChecker(QPainter* painter, int size, QColor color) const;
+    QPixmap findChecker(const QRect& rect, bool disabled) const;
+
+    void drawRadio(QPainter* painter, const QSize& size, bool checked, QColor color) const;
+    QPixmap findRadio(const QSize& size, bool checked, bool disabled) const;
+
+    QSize getButtonImageSize(const QSize& buttonSize) const;
+    void drawSimpleComboButton(QPainter* painter, const QSize& size, QColor color) const;
+    void drawMultipleComboButton(QPainter* painter, const QSize& size, QColor color) const;
+    QPixmap findComboButton(const QSize& size, bool multiple, bool disabled) const;
+
+};
+
+#endif // Maemo5WebStyle_h
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PasteboardQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PasteboardQt.cpp
index 209a5730a8..70ec546e81 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PasteboardQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PasteboardQt.cpp
@@ -103,7 +103,7 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
     if (mimeData->hasHtml()) {
         QString html = mimeData->html();
         if (!html.isEmpty()) {
-            RefPtr<DocumentFragment> fragment = createFragmentFromMarkup(frame->document(), html, "");
+            RefPtr<DocumentFragment> fragment = createFragmentFromMarkup(frame->document(), html, "", FragmentScriptingNotAllowed);
             if (fragment)
                 return fragment.release();
         }
@@ -151,7 +151,8 @@ void Pasteboard::writeImage(Node* node, const KURL&, const String&)
 
 #ifndef QT_NO_CLIPBOARD
     CachedImage* cachedImage = toRenderImage(node->renderer())->cachedImage();
-    ASSERT(cachedImage);
+    if (!cachedImage || cachedImage->errorOccurred())
+        return;
 
     Image* image = cachedImage->image();
     ASSERT(image);
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
index 37ea681b34..895b15289b 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
@@ -52,10 +52,8 @@ static String keyIdentifierForQtKeyCode(int keyCode)
         case Qt::Key_Return:
         case Qt::Key_Enter:
             return "Enter";
-#if QT_VERSION >= 0x040200
         case Qt::Key_Execute:
             return "Execute";
-#endif
         case Qt::Key_F1:
             return "F1";
         case Qt::Key_F2:
@@ -129,6 +127,8 @@ static String keyIdentifierForQtKeyCode(int keyCode)
             // Standard says that DEL becomes U+007F.
         case Qt::Key_Delete:
             return "U+007F";
+        case Qt::Key_Backspace:
+            return "U+0008";
         case Qt::Key_Tab:
             return "U+0009";
         case Qt::Key_Backtab:
@@ -173,6 +173,22 @@ static int windowsKeyCodeForKeyEvent(unsigned int keycode, bool isKeypad = false
             return VK_DECIMAL;  // (6E) Decimal key
         case Qt::Key_Slash:
             return VK_DIVIDE;   // (6F) Divide key
+        case Qt::Key_PageUp:
+            return VK_PRIOR; // (21) PAGE UP key
+        case Qt::Key_PageDown:
+            return VK_NEXT; // (22) PAGE DOWN key
+        case Qt::Key_End:
+            return VK_END; // (23) END key
+        case Qt::Key_Home:
+            return VK_HOME; // (24) HOME key
+        case Qt::Key_Left:
+            return VK_LEFT; // (25) LEFT ARROW key
+        case Qt::Key_Up:
+            return VK_UP; // (26) UP ARROW key
+        case Qt::Key_Right:
+            return VK_RIGHT; // (27) RIGHT ARROW key
+        case Qt::Key_Down:
+            return VK_DOWN; // (28) DOWN ARROW key
         default:
             return 0;
         }
@@ -290,10 +306,8 @@ static int windowsKeyCodeForKeyEvent(unsigned int keycode, bool isKeypad = false
             return VK_SELECT; // (29) SELECT key
         case Qt::Key_Print:
             return VK_PRINT; // (2A) PRINT key
-#if QT_VERSION >= 0x040200
         case Qt::Key_Execute:
             return VK_EXECUTE;// (2B) EXECUTE key
-#endif
             //dunno on this
             //case Qt::Key_PrintScreen:
             //      return VK_SNAPSHOT; // (2C) PRINT SCREEN key
@@ -537,6 +551,15 @@ bool PlatformKeyboardEvent::currentCapsLockState()
     return false;
 }
 
+void PlatformKeyboardEvent::getCurrentModifierState(bool& shiftKey, bool& ctrlKey, bool& altKey, bool& metaKey)
+{
+    notImplemented();
+    shiftKey = false;
+    ctrlKey = false;
+    altKey = false;
+    metaKey = false;
+}
+
 }
 
 // vim: ts=4 sw=4 et
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PlatformTouchEventQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PlatformTouchEventQt.cpp
new file mode 100644
index 0000000000..338e9d4612
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PlatformTouchEventQt.cpp
@@ -0,0 +1,49 @@
+/*
+ * This file is part of the WebKit project.
+ *
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "PlatformTouchEvent.h"
+
+#if ENABLE(TOUCH_EVENTS)
+
+namespace WebCore {
+
+PlatformTouchEvent::PlatformTouchEvent(QTouchEvent* event)
+{
+    switch (event->type()) {
+    case QEvent::TouchBegin: m_type = TouchStart; break;
+    case QEvent::TouchUpdate: m_type = TouchMove; break;
+    case QEvent::TouchEnd: m_type = TouchEnd; break;
+    }
+    const QList<QTouchEvent::TouchPoint>& points = event->touchPoints();
+    for (int i = 0; i < points.count(); ++i)
+        m_touchPoints.append(PlatformTouchPoint(points.at(i)));
+
+    m_ctrlKey = (event->modifiers() & Qt::ControlModifier);
+    m_altKey = (event->modifiers() & Qt::AltModifier);
+    m_shiftKey = (event->modifiers() & Qt::ShiftModifier);
+    m_metaKey = (event->modifiers() & Qt::MetaModifier);
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/editing/gtk/SelectionControllerGtk.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PlatformTouchPointQt.cpp
index f3bd4bc118..c2932129c0 100644
--- a/src/3rdparty/webkit/WebCore/editing/gtk/SelectionControllerGtk.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PlatformTouchPointQt.cpp
@@ -1,5 +1,7 @@
 /*
- * Copyright (C) 2009 Igalia S.L.
+ * This file is part of the WebKit project.
+ *
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -15,31 +17,30 @@
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
+ *
  */
- 
-#include "config.h"
-#include "SelectionController.h"
 
-#include "AXObjectCache.h"
-#include "Frame.h"
+#include "config.h"
+#include "PlatformTouchPoint.h"
 
-#include <gtk/gtk.h>
+#if ENABLE(TOUCH_EVENTS)
 
 namespace WebCore {
 
-void SelectionController::notifyAccessibilityForSelectionChange()
+PlatformTouchPoint::PlatformTouchPoint(const QTouchEvent::TouchPoint& point)
 {
-    if (AXObjectCache::accessibilityEnabled() && m_sel.start().isNotNull() && m_sel.end().isNotNull()) {
-        RenderObject* focusedNode = m_sel.end().node()->renderer();
-        AccessibilityObject* accessibilityObject = m_frame->document()->axObjectCache()->getOrCreate(focusedNode);
-        AtkObject* wrapper = accessibilityObject->wrapper();
-        if (ATK_IS_TEXT(wrapper)) {
-            g_signal_emit_by_name(wrapper, "text-caret-moved", m_sel.end().computeOffsetInContainerNode());
-
-            if (m_sel.isRange())
-                g_signal_emit_by_name(wrapper, "text-selection-changed");
-        }
+    // The QTouchEvent::TouchPoint API states that ids will be >= 0.
+    m_id = static_cast<unsigned>(point.id());
+    switch (point.state()) {
+    case Qt::TouchPointReleased: m_state = TouchReleased; break;
+    case Qt::TouchPointMoved: m_state = TouchMoved; break;
+    case Qt::TouchPointPressed: m_state = TouchPressed; break;
+    case Qt::TouchPointStationary: m_state = TouchStationary; break;
     }
+    m_screenPos = point.screenPos().toPoint();
+    m_pos = point.pos().toPoint();
+}
+
 }
 
-} // namespace WebCore
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp
index d13c9a955a..315b891732 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp
@@ -1,8 +1,7 @@
 /*
  * This file is part of the popup menu implementation for <select> elements in WebCore.
  *
- * Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
- * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009, 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2006 Apple Computer, Inc.
  * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com 
  * Coypright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
@@ -27,99 +26,50 @@
 #include "config.h"
 #include "PopupMenu.h"
 
-#include "Frame.h"
+#include "Chrome.h"
+#include "ChromeClientQt.h"
 #include "FrameView.h"
-#include "HostWindow.h"
 #include "PopupMenuClient.h"
 #include "QWebPageClient.h"
-#include "QWebPopup.h"
-
-#include <QAction>
-#include <QDebug>
-#include <QGraphicsProxyWidget>
-#include <QGraphicsScene>
-#include <QGraphicsView>
-#include <qgraphicswebview.h>
-#include <QListWidget>
-#include <QListWidgetItem>
-#include <QMenu>
-#include <QPoint>
-#include <QStandardItemModel>
-#include <QWidgetAction>
+#include "QtAbstractWebPopup.h"
 
 namespace WebCore {
 
 PopupMenu::PopupMenu(PopupMenuClient* client)
     : m_popupClient(client)
-    , m_proxy(0)
+    , m_popup(0)
 {
-    m_popup = new QWebPopup(client);
 }
 
 PopupMenu::~PopupMenu()
 {
-    // If we create a proxy, then the deletion of the proxy and the
-    // combo will be done by the proxy's parent (QGraphicsWebView)
-    if (!m_proxy)
-        delete m_popup;
+    delete m_popup;
 }
 
-void PopupMenu::clear()
+void PopupMenu::show(const IntRect& rect, FrameView* view, int index)
 {
-    m_popup->clear();
-}
+    ChromeClientQt* chromeClient = static_cast<ChromeClientQt*>(
+        view->frame()->page()->chrome()->client());
+    ASSERT(chromeClient);
 
-void PopupMenu::populate(const IntRect&)
-{
-    clear();
-    Q_ASSERT(client());
-
-    QStandardItemModel* model = qobject_cast<QStandardItemModel*>(m_popup->model());
-    Q_ASSERT(model);
-
-    int size = client()->listSize();
-    for (int i = 0; i < size; i++) {
-        if (client()->itemIsSeparator(i))
-            m_popup->insertSeparator(i);
-        else {
-            m_popup->insertItem(i, client()->itemText(i));
-
-            if (model && !client()->itemIsEnabled(i))
-                model->item(i)->setEnabled(false);
-
-            if (client()->itemIsSelected(i))
-                m_popup->setCurrentIndex(i);
-        }
-    }
-}
+    if (!m_popup)
+        m_popup = chromeClient->createSelectPopup();
+
+    m_popup->m_popupClient = m_popupClient;
+    m_popup->m_currentIndex = index;
+    m_popup->m_pageClient = chromeClient->platformPageClient();
+
+    QRect geometry(rect);
+    geometry.moveTopLeft(view->contentsToWindow(rect.topLeft()));
+    m_popup->m_geometry = geometry;
+
+    m_popup->show();
 
-void PopupMenu::show(const IntRect& r, FrameView* v, int index)
-{
-    QWebPageClient* client = v->hostWindow()->platformPageClient();
-    populate(r);
-    QRect rect = r;
-    rect.moveTopLeft(v->contentsToWindow(r.topLeft()));
-    rect.setHeight(m_popup->sizeHint().height());
-
-    if (QGraphicsView* view = qobject_cast<QGraphicsView*>(client->ownerWidget())) {
-        if (!m_proxy) {
-            m_proxy = new QGraphicsProxyWidget(qobject_cast<QGraphicsWebView*>(client->pluginParent()));
-            m_proxy->setWidget(m_popup);
-        } else
-            m_proxy->setVisible(true);
-        m_proxy->setGeometry(rect);
-    } else {
-        m_popup->setParent(client->ownerWidget());
-        m_popup->setGeometry(rect);
-    }
-
-    m_popup->setCurrentIndex(index);
-    m_popup->exec();
 }
 
 void PopupMenu::hide()
 {
-    m_popup->hidePopup();
+    m_popup->hide();
 }
 
 void PopupMenu::updateFromElement()
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/QWebPageClient.h b/src/3rdparty/webkit/WebCore/platform/qt/QWebPageClient.h
index 61adb971af..f03ff08d3c 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/QWebPageClient.h
+++ b/src/3rdparty/webkit/WebCore/platform/qt/QWebPageClient.h
@@ -26,16 +26,37 @@
 #ifndef QWebPageClient_h
 #define QWebPageClient_h
 
+#ifndef QT_NO_CURSOR
+#include <QCursor>
+#endif
+
 #include <QRect>
 
+QT_BEGIN_NAMESPACE
+class QGraphicsItem;
+class QStyle;
+QT_END_NAMESPACE
+
 class QWebPageClient {
 public:
     virtual ~QWebPageClient() { }
-        
+
+    virtual bool isQWidgetClient() const { return false; }
+
     virtual void scroll(int dx, int dy, const QRect&) = 0;
     virtual void update(const QRect&) = 0;
     virtual void setInputMethodEnabled(bool enable) = 0;
     virtual bool inputMethodEnabled() const = 0;
+#if USE(ACCELERATED_COMPOSITING)
+    // this gets called when we start/stop compositing.
+    virtual void setRootGraphicsLayer(QGraphicsItem* layer) {}
+
+    // this gets called when the compositor wants us to sync the layers
+    // if scheduleSync is true, we schedule a sync ourselves. otherwise,
+    // we wait for the next update and sync the layers then.
+    virtual void markForSync(bool scheduleSync = false) {}
+#endif
+
 #if QT_VERSION >= 0x040600
     virtual void setInputMethodHint(Qt::InputMethodHint hint, bool enable) = 0;
 #endif
@@ -61,9 +82,12 @@ public:
     virtual QPalette palette() const = 0;
     virtual int screenNumber() const = 0;
     virtual QWidget* ownerWidget() const = 0;
+    virtual QRect geometryRelativeToOwnerWidget() const = 0;
 
     virtual QObject* pluginParent() const = 0;
 
+    virtual QStyle* style() const = 0;
+
 protected:
 #ifndef QT_NO_CURSOR
     virtual QCursor cursor() const = 0;
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/QWebPopup.cpp b/src/3rdparty/webkit/WebCore/platform/qt/QWebPopup.cpp
deleted file mode 100644
index 48bca1932a..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/qt/QWebPopup.cpp
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- *
- * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-#include "config.h"
-#include "QWebPopup.h"
-#include "PopupMenuStyle.h"
-
-#include <QAbstractItemView>
-#include <QApplication>
-#include <QInputContext>
-#include <QMouseEvent>
-#include <QGraphicsProxyWidget>
-
-namespace WebCore {
-
-QWebPopup::QWebPopup(PopupMenuClient* client)
-    : m_client(client)
-    , m_popupVisible(false)
-{
-    Q_ASSERT(m_client);
-
-#if !defined(Q_WS_S60) && !defined(Q_WS_MAEMO_5)
-    setFont(m_client->menuStyle().font().font());
-#endif
-    connect(this, SIGNAL(activated(int)),
-            SLOT(activeChanged(int)), Qt::QueuedConnection);
-}
-
-
-void QWebPopup::exec()
-{
-    // QCursor::pos() is not a great idea for a touch screen, but we don't need the coordinates
-    // as comboboxes with Qt on Maemo 5 come up in their full width on the screen.
-    // On the other platforms it's okay to use QCursor::pos().
-#if defined(Q_WS_MAEMO_5)
-    showPopup();
-#else
-    QMouseEvent event(QEvent::MouseButtonPress, QCursor::pos(), Qt::LeftButton,
-                      Qt::LeftButton, Qt::NoModifier);
-    QCoreApplication::sendEvent(this, &event);
-#endif
-}
-
-void QWebPopup::showPopup()
-{
-    QComboBox::showPopup();
-    m_popupVisible = true;
-}
-
-void QWebPopup::hidePopup()
-{
-    QWidget* activeFocus = QApplication::focusWidget();
-    if (activeFocus && activeFocus == view()
-        && activeFocus->testAttribute(Qt::WA_InputMethodEnabled)) {
-        QInputContext* qic = activeFocus->inputContext();
-        if (qic) {
-            qic->reset();
-            qic->setFocusWidget(0);
-        }
-    }
-
-    QComboBox::hidePopup();
-    
-    if (QGraphicsProxyWidget* proxy = graphicsProxyWidget())
-        proxy->setVisible(false);
-
-    if (!m_popupVisible)
-        return;
-
-    m_popupVisible = false;
-    m_client->popupDidHide();
-}
-
-void QWebPopup::activeChanged(int index)
-{
-    if (index < 0)
-        return;
-
-    m_client->valueChanged(index);
-}
-
-} // namespace WebCore
-
-#include "moc_QWebPopup.cpp"
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/QtAbstractWebPopup.cpp b/src/3rdparty/webkit/WebCore/platform/qt/QtAbstractWebPopup.cpp
new file mode 100644
index 0000000000..31ab28d37e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/qt/QtAbstractWebPopup.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#include "config.h"
+#include "QtAbstractWebPopup.h"
+
+#include "PopupMenuClient.h"
+
+
+namespace WebCore {
+
+QtAbstractWebPopup::QtAbstractWebPopup()
+    : m_popupClient(0)
+    , m_pageClient(0)
+    , m_currentIndex(-1)
+{
+}
+
+QtAbstractWebPopup::~QtAbstractWebPopup()
+{
+}
+
+void QtAbstractWebPopup::popupDidHide()
+{
+    Q_ASSERT(m_popupClient);
+    m_popupClient->popupDidHide();
+}
+
+void QtAbstractWebPopup::valueChanged(int index)
+{
+    Q_ASSERT(m_popupClient);
+    m_popupClient->valueChanged(index);
+}
+
+void QtAbstractWebPopup::selectItem(int index, bool allowMultiplySelections, bool shift)
+{
+#if ENABLE(NO_LISTBOX_RENDERING)
+    ListPopupMenuClient* client = static_cast<ListPopupMenuClient*>(m_popupClient);
+    if (client) {
+        client->listBoxSelectItem(index, allowMultiplySelections, shift);
+        return;
+    }
+#endif
+    valueChanged(index);
+}
+
+bool QtAbstractWebPopup::multiple()
+{
+#if ENABLE(NO_LISTBOX_RENDERING)
+    ListPopupMenuClient* client = static_cast<ListPopupMenuClient*>(m_popupClient);
+    return client && client->multiple();
+#else
+    return false;
+#endif
+}
+
+QtAbstractWebPopup::ItemType QtAbstractWebPopup::itemType(int idx) const
+{
+    if (m_popupClient->itemIsSeparator(idx))
+        return Separator;
+    if (m_popupClient->itemIsLabel(idx))
+        return Group;
+    return Option;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/QtAbstractWebPopup.h b/src/3rdparty/webkit/WebCore/platform/qt/QtAbstractWebPopup.h
new file mode 100644
index 0000000000..dad4997d16
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/qt/QtAbstractWebPopup.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#ifndef QtAbstractWebPopup_h
+#define QtAbstractWebPopup_h
+
+#include "PopupMenuClient.h"
+
+#include <QFont>
+#include <QList>
+#include <QRect>
+#include <QWidget>
+
+class QWebPageClient;
+
+namespace WebCore {
+
+class QtAbstractWebPopup {
+public:
+    enum ItemType { Option, Group, Separator };
+
+    ItemType itemType(int) const;
+    QString itemText(int idx) const { return m_popupClient->itemText(idx); }
+    QString itemToolTip(int idx) const { return m_popupClient->itemToolTip(idx); }
+    bool itemIsEnabled(int idx) const { return m_popupClient->itemIsEnabled(idx); }
+    int itemCount() const { return m_popupClient->listSize(); }
+    bool itemIsSelected(int idx) const { return m_popupClient->itemIsSelected(idx); }
+
+
+    QWebPageClient* pageClient() const { return m_pageClient; }
+    QRect geometry() const { return m_geometry; }
+    int currentIndex() const { return m_currentIndex; }
+
+    QtAbstractWebPopup();
+    virtual ~QtAbstractWebPopup();
+
+    virtual void show() = 0;
+    virtual void hide() = 0;
+
+    void popupDidHide();
+    void valueChanged(int index);
+
+    void selectItem(int index, bool allowMultiplySelections, bool shift);
+    bool multiple();
+
+
+    QFont font() { return m_popupClient->menuStyle().font().font(); }
+
+private:
+    friend class PopupMenu;
+    PopupMenuClient* m_popupClient;
+    QWebPageClient* m_pageClient;
+    int m_currentIndex;
+    QRect m_geometry;
+};
+
+}
+
+#endif // QtAbstractWebPopup_h
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/QtStyleOptionWebComboBox.h b/src/3rdparty/webkit/WebCore/platform/qt/QtStyleOptionWebComboBox.h
new file mode 100644
index 0000000000..29c8220aca
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/qt/QtStyleOptionWebComboBox.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef QtStyleOptionWebComboBox_h
+#define QtStyleOptionWebComboBox_h
+
+#include "HTMLSelectElement.h"
+#include "RenderObject.h"
+
+#include <QStyleOption>
+
+namespace WebCore {
+
+class RenderObject;
+
+class QtStyleOptionWebComboBox : public QStyleOptionComboBox {
+public:
+    QtStyleOptionWebComboBox(RenderObject* o)
+        : QStyleOptionComboBox()
+    #if ENABLE(NO_LISTBOX_RENDERING)
+        , m_multiple(checkMultiple(o))
+    #else
+        , m_multiple(false)
+    #endif
+    {
+    }
+
+    bool multiple() const { return m_multiple; }
+
+private:
+    bool m_multiple;
+
+    bool checkMultiple(RenderObject* o)
+    {
+        HTMLSelectElement* select = o ? static_cast<HTMLSelectElement*>(o->node()) : 0;
+        return select ? select->multiple() : false;
+    }
+};
+
+}
+
+#endif // QtStyleOptionWebComboBox_h
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
index 298d840f1a..0163adcfb8 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
@@ -32,23 +32,35 @@
 
 #include "CSSStyleSelector.h"
 #include "CSSStyleSheet.h"
+#include "Chrome.h"
 #include "ChromeClientQt.h"
 #include "Color.h"
 #include "Document.h"
 #include "Font.h"
 #include "FontSelector.h"
 #include "GraphicsContext.h"
+#include "HTMLInputElement.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
+#ifdef Q_WS_MAEMO_5
+#include "Maemo5Webstyle.h"
+#endif
 #include "NotImplemented.h"
 #include "Page.h"
+#include "QtStyleOptionWebComboBox.h"
+#include "QWebPageClient.h"
 #include "RenderBox.h"
+#if ENABLE(PROGRESS_TAG)
+#include "RenderProgress.h"
+#endif
+#include "RenderSlider.h"
 #include "RenderTheme.h"
+#include "TimeRanges.h"
 #include "ScrollbarThemeQt.h"
 #include "UserAgentStyleSheets.h"
-#include "QWebPageClient.h"
 #include "qwebpage.h"
 
+
 #include <QApplication>
 #include <QColor>
 #include <QDebug>
@@ -59,6 +71,10 @@
 #include <QStyleFactory>
 #include <QStyleOptionButton>
 #include <QStyleOptionFrameV2>
+#if ENABLE(PROGRESS_TAG)
+#include <QStyleOptionProgressBarV2>
+#endif
+#include <QStyleOptionSlider>
 #include <QWidget>
 
 
@@ -137,7 +153,11 @@ RenderThemeQt::RenderThemeQt(Page* page)
     m_buttonFontPixelSize = fontInfo.pixelSize();
 #endif
 
+#ifdef Q_WS_MAEMO_5
+    m_fallbackStyle = new Maemo5WebStyle;
+#else
     m_fallbackStyle = QStyleFactory::create(QLatin1String("windows"));
+#endif
 }
 
 RenderThemeQt::~RenderThemeQt()
@@ -146,6 +166,30 @@ RenderThemeQt::~RenderThemeQt()
     delete m_lineEdit;
 }
 
+#ifdef Q_WS_MAEMO_5
+bool RenderThemeQt::isControlStyled(const RenderStyle* style, const BorderData& border, const FillLayer& fill, const Color& backgroundColor) const
+{
+    switch (style->appearance()) {
+    case PushButtonPart:
+    case ButtonPart:
+    case MenulistPart:
+    case TextFieldPart:
+    case TextAreaPart:
+        return true;
+    case CheckboxPart:
+    case RadioPart:
+        return false;
+    default:
+        return RenderTheme::isControlStyled(style, border, fill, backgroundColor);
+    }
+}
+
+int RenderThemeQt::popupInternalPaddingBottom(RenderStyle* style) const
+{
+    return 1;
+}
+#endif
+
 // for some widget painting, we need to fallback to Windows style
 QStyle* RenderThemeQt::fallbackStyle() const
 {
@@ -159,18 +203,27 @@ QStyle* RenderThemeQt::qStyle() const
 #endif
 
     if (m_page) {
-        ChromeClientQt* client = static_cast<ChromeClientQt*>(m_page->chrome()->client());
-
-        if (!client->m_webPage)
-            return QApplication::style();
+        QWebPageClient* pageClient = m_page->chrome()->client()->platformPageClient();
 
-        if (QWidget* view = client->m_webPage->view())
-            return view->style();
+        if (pageClient)
+            return pageClient->style();
     }
 
     return QApplication::style();
 }
 
+String RenderThemeQt::extraDefaultStyleSheet()
+{
+    String result = RenderTheme::extraDefaultStyleSheet();
+#if ENABLE(NO_LISTBOX_RENDERING)
+    result += String(themeQtNoListboxesUserAgentStyleSheet, sizeof(themeQtNoListboxesUserAgentStyleSheet));
+#endif
+#ifdef Q_WS_MAEMO_5
+    result += String(themeQtMaemo5UserAgentStyleSheet, sizeof(themeQtMaemo5UserAgentStyleSheet));
+#endif
+    return result;
+}
+
 bool RenderThemeQt::supportsHover(const RenderStyle*) const
 {
     return true;
@@ -293,15 +346,30 @@ int RenderThemeQt::minimumMenuListSize(RenderStyle*) const
 
 void RenderThemeQt::computeSizeBasedOnStyle(RenderStyle* renderStyle) const
 {
-    // If the width and height are both specified, then we have nothing to do.
-    if (!renderStyle->width().isIntrinsicOrAuto() && !renderStyle->height().isAuto())
-        return;
-
     QSize size(0, 0);
     const QFontMetrics fm(renderStyle->font().font());
     QStyle* style = qStyle();
 
     switch (renderStyle->appearance()) {
+    case TextAreaPart:
+    case TextFieldPart: {
+        int padding = findFrameLineWidth(style);
+
+        renderStyle->setPaddingLeft(Length(padding, Fixed));
+        renderStyle->setPaddingRight(Length(padding, Fixed));
+        renderStyle->setPaddingTop(Length(padding, Fixed));
+        renderStyle->setPaddingBottom(Length(padding, Fixed));
+        break;
+    }
+    default:
+        break;
+    }
+
+    // If the width and height are both specified, then we have nothing to do.
+    if (!renderStyle->width().isIntrinsicOrAuto() && !renderStyle->height().isAuto())
+        return;
+
+    switch (renderStyle->appearance()) {
     case CheckboxPart: {
         QStyleOption styleOption;
         styleOption.state |= QStyle::State_Small;
@@ -345,23 +413,6 @@ void RenderThemeQt::computeSizeBasedOnStyle(RenderStyle* renderStyle) const
         size.setHeight(menuListSize.height());
         break;
     }
-    case TextFieldPart: {
-        const int verticalMargin = 1;
-        const int horizontalMargin = 2;
-        int h = qMax(fm.lineSpacing(), 14) + 2*verticalMargin;
-        int w = fm.width(QLatin1Char('x')) * 17 + 2*horizontalMargin;
-        QStyleOptionFrameV2 opt;
-        opt.lineWidth = findFrameLineWidth(style);
-        QSize sz = style->sizeFromContents(QStyle::CT_LineEdit,
-                                           &opt,
-                                           QSize(w, h).expandedTo(QApplication::globalStrut()),
-                                           0);
-        size.setHeight(sz.height());
-
-        renderStyle->setPaddingLeft(Length(opt.lineWidth, Fixed));
-        renderStyle->setPaddingRight(Length(opt.lineWidth, Fixed));
-        break;
-    }
     default:
         break;
     }
@@ -398,8 +449,13 @@ void RenderThemeQt::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle* s
     // Ditch the border.
     style->resetBorder();
 
-    // Height is locked to auto.
-    style->setHeight(Length(Auto));
+#ifdef Q_WS_MAC
+    if (style->appearance() == PushButtonPart) {
+        // The Mac ports ignore the specified height for <input type="button"> elements
+        // unless a border and/or background CSS property is also specified.
+        style->setHeight(Length(Auto));
+    }
+#endif
 
     // White-space is locked to pre
     style->setWhiteSpace(PRE);
@@ -480,7 +536,7 @@ bool RenderThemeQt::paintButton(RenderObject* o, const RenderObject::PaintInfo&
     option.rect = r;
     option.state |= QStyle::State_Small;
 
-    ControlPart appearance = applyTheme(option, o);
+    ControlPart appearance = initializeCommonQStyleOptions(option, o);
     if (appearance == PushButtonPart || appearance == ButtonPart) {
         option.rect = inflateButtonRect(option.rect, qStyle());
         p.drawControl(QStyle::CE_PushButton, option);
@@ -516,7 +572,7 @@ bool RenderThemeQt::paintTextField(RenderObject* o, const RenderObject::PaintInf
     panel.features = QStyleOptionFrameV2::None;
 
     // Get the correct theme data for a text field
-    ControlPart appearance = applyTheme(panel, o);
+    ControlPart appearance = initializeCommonQStyleOptions(panel, o);
     if (appearance != TextFieldPart
         && appearance != SearchFieldPart
         && appearance != TextAreaPart
@@ -575,10 +631,10 @@ bool RenderThemeQt::paintMenuList(RenderObject* o, const RenderObject::PaintInfo
     if (!p.isValid())
         return true;
 
-    QStyleOptionComboBox opt;
+    QtStyleOptionWebComboBox opt(o);
     if (p.widget)
         opt.initFrom(p.widget);
-    applyTheme(opt, o);
+    initializeCommonQStyleOptions(opt, o);
 
     const QPoint topLeft = r.topLeft();
     p.painter->translate(topLeft);
@@ -592,9 +648,11 @@ bool RenderThemeQt::paintMenuList(RenderObject* o, const RenderObject::PaintInfo
 
 void RenderThemeQt::adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
+#ifndef Q_WS_MAEMO_5
     // WORKAROUND because html.css specifies -webkit-border-radius for <select> so we override it here
     // see also http://bugs.webkit.org/show_bug.cgi?id=18399
     style->resetBorderRadius();
+#endif
 
     // Height is locked to auto.
     style->setHeight(Length(Auto));
@@ -615,10 +673,10 @@ bool RenderThemeQt::paintMenuListButton(RenderObject* o, const RenderObject::Pai
     if (!p.isValid())
         return true;
 
-    QStyleOptionComboBox option;
+    QtStyleOptionWebComboBox option(o);
     if (p.widget)
         option.initFrom(p.widget);
-    applyTheme(option, o);
+    initializeCommonQStyleOptions(option, o);
     option.rect = r;
 
     // for drawing the combo box arrow, rely only on the fallback style
@@ -629,25 +687,117 @@ bool RenderThemeQt::paintMenuListButton(RenderObject* o, const RenderObject::Pai
     return false;
 }
 
+#if ENABLE(PROGRESS_TAG)
+bool RenderThemeQt::getNumberOfPixelsForProgressPosition(double position, int& progressSize) const
+{
+    progressSize = 65536 * position;
+    return false;
+}
+
+void RenderThemeQt::adjustProgressBarStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    style->setBoxShadow(0);
+}
+
+bool RenderThemeQt::paintProgressBar(RenderObject* o, const RenderObject::PaintInfo& pi, const IntRect& r)
+{
+    StylePainter p(this, pi);
+    if (!p.isValid())
+       return true;
+
+    QStyleOptionProgressBarV2 option;
+    if (p.widget)
+       option.initFrom(p.widget);
+    initializeCommonQStyleOptions(option, o);
+
+    RenderProgress* renderProgress = toRenderProgress(o);
+    option.rect = r;
+    option.maximum = 65536;
+    option.minimum = 0;
+    option.progress = renderProgress->position();
+
+    const QPoint topLeft = r.topLeft();
+    p.painter->translate(topLeft);
+    option.rect.moveTo(QPoint(0, 0));
+    option.rect.setSize(r.size());
+
+    p.drawControl(QStyle::CE_ProgressBar, option);
+    p.painter->translate(-topLeft);
+
+    return false;
+}
+#endif
+
 bool RenderThemeQt::paintSliderTrack(RenderObject* o, const RenderObject::PaintInfo& pi,
                                      const IntRect& r)
 {
-    notImplemented();
-    return RenderTheme::paintSliderTrack(o, pi, r);
+    StylePainter p(this, pi);
+    if (!p.isValid())
+       return true;
+
+    QStyleOptionSlider option;
+    if (p.widget)
+       option.initFrom(p.widget);
+    ControlPart appearance = initializeCommonQStyleOptions(option, o);
+
+    RenderSlider* renderSlider = toRenderSlider(o);
+    IntRect thumbRect = renderSlider->thumbRect();
+
+    option.rect = r;
+
+    int value;
+    if (appearance == SliderVerticalPart) {
+        option.maximum = r.height() - thumbRect.height();
+        value = thumbRect.y();
+    } else {
+        option.maximum = r.width() - thumbRect.width();
+        value = thumbRect.x();
+    }
+
+    value = QStyle::sliderValueFromPosition(0, option.maximum, value, option.maximum);
+
+    option.sliderValue = value;
+    option.sliderPosition = value;
+    if (appearance == SliderVerticalPart)
+        option.orientation = Qt::Vertical;
+
+    if (renderSlider->inDragMode()) {
+        option.activeSubControls = QStyle::SC_SliderHandle;
+        option.state |= QStyle::State_Sunken;
+    }
+
+    const QPoint topLeft = r.topLeft();
+    p.painter->translate(topLeft);
+    option.rect.moveTo(QPoint(0, 0));
+    option.rect.setSize(r.size());
+
+    p.drawComplexControl(QStyle::CC_Slider, option);
+    p.painter->translate(-topLeft);
+
+    return false;
+}
+
+void RenderThemeQt::adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    style->setBoxShadow(0);
 }
 
 bool RenderThemeQt::paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& pi,
                                      const IntRect& r)
 {
-    notImplemented();
-    return RenderTheme::paintSliderThumb(o, pi, r);
+    // We've already painted it in paintSliderTrack(), no need to do anything here.
+    return false;
+}
+
+void RenderThemeQt::adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    style->setBoxShadow(0);
 }
 
 bool RenderThemeQt::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& pi,
                                      const IntRect& r)
 {
-    paintTextField(o, pi, r);
-    return false;
+    return true;
 }
 
 void RenderThemeQt::adjustSearchFieldStyle(CSSStyleSelector* selector, RenderStyle* style,
@@ -710,13 +860,37 @@ bool RenderThemeQt::supportsFocus(ControlPart appearance) const
     case MenulistPart:
     case RadioPart:
     case CheckboxPart:
+    case SliderHorizontalPart:
+    case SliderVerticalPart:
         return true;
     default: // No for all others...
         return false;
     }
 }
 
-ControlPart RenderThemeQt::applyTheme(QStyleOption& option, RenderObject* o) const
+void RenderThemeQt::setPaletteFromPageClientIfExists(QPalette& palette) const
+{
+#ifdef Q_WS_MAEMO_5
+    static QPalette lightGrayPalette(Qt::lightGray);
+    palette = lightGrayPalette;
+    return;
+#endif
+    // If the webview has a custom palette, use it
+    if (!m_page)
+        return;
+    Chrome* chrome = m_page->chrome();
+    if (!chrome)
+        return;
+    ChromeClient* chromeClient = chrome->client();
+    if (!chromeClient)
+        return;
+    QWebPageClient* pageClient = chromeClient->platformPageClient();
+    if (!pageClient)
+        return;
+    palette = pageClient->palette();
+}
+
+ControlPart RenderThemeQt::initializeCommonQStyleOptions(QStyleOption& option, RenderObject* o) const
 {
     // Default bits: no focus, no mouse over
     option.state &= ~(QStyle::State_HasFocus | QStyle::State_MouseOver);
@@ -728,19 +902,24 @@ ControlPart RenderThemeQt::applyTheme(QStyleOption& option, RenderObject* o) con
         // Readonly is supported on textfields.
         option.state |= QStyle::State_ReadOnly;
 
-    if (supportsFocus(o->style()->appearance()) && isFocused(o)) {
-        option.state |= QStyle::State_HasFocus;
-        option.state |= QStyle::State_KeyboardFocusChange;
-    }
+    option.direction = Qt::LeftToRight;
 
     if (isHovered(o))
         option.state |= QStyle::State_MouseOver;
 
-    option.direction = Qt::LeftToRight;
-    if (o->style() && o->style()->direction() == WebCore::RTL)
-        option.direction = Qt::RightToLeft;
+    setPaletteFromPageClientIfExists(option.palette);
+    RenderStyle* style = o->style();
+    if (!style)
+        return NoControlPart;
 
-    ControlPart result = o->style()->appearance();
+    ControlPart result = style->appearance();
+    if (supportsFocus(result) && isFocused(o)) {
+        option.state |= QStyle::State_HasFocus;
+        option.state |= QStyle::State_KeyboardFocusChange;
+    }
+
+    if (style->direction() == WebCore::RTL)
+        option.direction = Qt::RightToLeft;
 
     switch (result) {
     case PushButtonPart:
@@ -757,24 +936,10 @@ ControlPart RenderThemeQt::applyTheme(QStyleOption& option, RenderObject* o) con
             option.state |= QStyle::State_Raised;
         break;
     }
-    }
-
-    if (result == RadioPart || result == CheckboxPart)
+    case RadioPart:
+    case CheckboxPart:
         option.state |= (isChecked(o) ? QStyle::State_On : QStyle::State_Off);
-
-#ifdef Q_WS_MAEMO_5
-    static QPalette lightGrayPalette(Qt::lightGray);
-    option.palette = lightGrayPalette;
-#else
-    // If the owner widget has a custom palette, use it
-    Page* page = o->document()->page();
-    if (page) {
-        ChromeClient* client = page->chrome()->client();
-        QWebPageClient* pageClient = client->platformPageClient();
-        if (pageClient)
-            option.palette = pageClient->palette();
     }
-#endif
 
     return result;
 }
@@ -815,10 +980,15 @@ HTMLMediaElement* RenderThemeQt::getMediaElementFromRenderObject(RenderObject* o
     return static_cast<HTMLMediaElement*>(mediaNode);
 }
 
+double RenderThemeQt::mediaControlsBaselineOpacity() const
+{
+    return 0.4;
+}
+
 void RenderThemeQt::paintMediaBackground(QPainter* painter, const IntRect& r) const
 {
     painter->setPen(Qt::NoPen);
-    static QColor transparentBlack(0, 0, 0, 100);
+    static QColor transparentBlack(0, 0, 0, mediaControlsBaselineOpacity() * 255);
     painter->setBrush(transparentBlack);
     painter->drawRoundedRect(r.x(), r.y(), r.width(), r.height(), 5.0, 5.0);
 }
@@ -854,14 +1024,9 @@ bool RenderThemeQt::paintMediaMuteButton(RenderObject* o, const RenderObject::Pa
     const QPointF speakerPolygon[6] = { QPointF(20, 30), QPointF(50, 30), QPointF(80, 0),
             QPointF(80, 100), QPointF(50, 70), QPointF(20, 70)};
 
-    p.painter->setBrush(getMediaControlForegroundColor(o));
+    p.painter->setBrush(mediaElement->muted() ? Qt::darkRed : getMediaControlForegroundColor(o));
     p.painter->drawPolygon(speakerPolygon, 6);
 
-    if (mediaElement->muted()) {
-        p.painter->setPen(Qt::red);
-        p.painter->drawLine(0, 100, 100, 0);
-    }
-
     return false;
 }
 
@@ -904,6 +1069,86 @@ bool RenderThemeQt::paintMediaSeekForwardButton(RenderObject*, const RenderObjec
     return false;
 }
 
+bool RenderThemeQt::paintMediaCurrentTime(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    StylePainter p(this, paintInfo);
+    if (!p.isValid())
+        return true;
+
+    p.painter->setRenderHint(QPainter::Antialiasing, true);
+    paintMediaBackground(p.painter, r);
+
+    return false;
+}
+
+String RenderThemeQt::formatMediaControlsCurrentTime(float currentTime, float duration) const
+{
+    return formatMediaControlsTime(currentTime) + " / " + formatMediaControlsTime(duration);
+}
+
+String RenderThemeQt::formatMediaControlsRemainingTime(float currentTime, float duration) const
+{
+    return String();
+}
+
+bool RenderThemeQt::paintMediaVolumeSliderTrack(RenderObject *o, const RenderObject::PaintInfo &paintInfo, const IntRect &r)
+{
+    StylePainter p(this, paintInfo);
+    if (!p.isValid())
+        return true;
+
+    p.painter->setRenderHint(QPainter::Antialiasing, true);
+
+    paintMediaBackground(p.painter, r);
+
+    if (!o->isSlider())
+        return false;
+
+    IntRect b = toRenderBox(o)->contentBoxRect();
+
+    // Position the outer rectangle
+    int top = r.y() + b.y();
+    int left = r.x() + b.x();
+    int width = b.width();
+    int height = b.height();
+
+    // Get the scale color from the page client
+    QPalette pal = QApplication::palette();
+    setPaletteFromPageClientIfExists(pal);
+    const QColor highlightText = pal.brush(QPalette::Active, QPalette::HighlightedText).color();
+    const QColor scaleColor(highlightText.red(), highlightText.green(), highlightText.blue(), mediaControlsBaselineOpacity() * 255);
+
+    // Draw the outer rectangle
+    p.painter->setBrush(scaleColor);
+    p.painter->drawRect(left, top, width, height);
+
+    if (!o->node() || !o->node()->hasTagName(inputTag))
+        return false;
+
+    HTMLInputElement* slider = static_cast<HTMLInputElement*>(o->node());
+
+    // Position the inner rectangle
+    height = height * slider->valueAsNumber();
+    top += b.height() - height;
+
+    // Draw the inner rectangle
+    p.painter->setPen(Qt::NoPen);
+    p.painter->setBrush(getMediaControlForegroundColor(o));
+    p.painter->drawRect(left, top, width, height);
+
+    return false;
+}
+
+bool RenderThemeQt::paintMediaVolumeSliderThumb(RenderObject *o, const RenderObject::PaintInfo &paintInfo, const IntRect &r)
+{
+    StylePainter p(this, paintInfo);
+    if (!p.isValid())
+        return true;
+
+    // Nothing to draw here, this is all done in the track
+    return false;
+}
+
 bool RenderThemeQt::paintMediaSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     HTMLMediaElement* mediaElement = getMediaElementFromRenderObject(o);
@@ -918,25 +1163,31 @@ bool RenderThemeQt::paintMediaSliderTrack(RenderObject* o, const RenderObject::P
 
     paintMediaBackground(p.painter, r);
 
+#if QT_VERSION >= 0x040700
     if (MediaPlayer* player = mediaElement->player()) {
-        if (player->totalBytesKnown()) {
-            float percentLoaded = static_cast<float>(player->bytesLoaded()) / player->totalBytes();
-
+        // Get the buffered parts of the media
+        PassRefPtr<TimeRanges> buffered = player->buffered();
+        if (buffered->length() > 0 && player->duration() < std::numeric_limits<float>::infinity()) {
+            // Set the transform and brush
             WorldMatrixTransformer transformer(p.painter, o, r);
             p.painter->setBrush(getMediaControlForegroundColor());
-            p.painter->drawRect(0, 37, 100 * percentLoaded, 26);
+
+            // Paint each buffered section
+            ExceptionCode ex;
+            for (int i = 0; i < buffered->length(); i++) {
+                float startX = (buffered->start(i, ex) / player->duration()) * 100;
+                float width = ((buffered->end(i, ex) / player->duration()) * 100) - startX;
+                p.painter->drawRect(startX, 37, width, 26);
+            }
         }
     }
+#endif
 
     return false;
 }
 
 bool RenderThemeQt::paintMediaSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    HTMLMediaElement* mediaElement = getMediaElementFromRenderObject(o->parent());
-    if (!mediaElement)
-        return false;
-
     StylePainter p(this, paintInfo);
     if (!p.isValid())
         return true;
@@ -953,13 +1204,33 @@ bool RenderThemeQt::paintMediaSliderThumb(RenderObject* o, const RenderObject::P
 
 void RenderThemeQt::adjustSliderThumbSize(RenderObject* o) const
 {
-    if (o->style()->appearance() == MediaSliderThumbPart) {
+    ControlPart part = o->style()->appearance();
+
+    if (part == MediaSliderThumbPart) {
         RenderStyle* parentStyle = o->parent()->style();
         Q_ASSERT(parentStyle);
 
         int parentHeight = parentStyle->height().value();
         o->style()->setWidth(Length(parentHeight / 3, Fixed));
         o->style()->setHeight(Length(parentHeight, Fixed));
+    } else if (part == MediaVolumeSliderThumbPart) {
+        RenderStyle* parentStyle = o->parent()->style();
+        Q_ASSERT(parentStyle);
+
+        int parentWidth = parentStyle->width().value();
+        o->style()->setHeight(Length(parentWidth / 3, Fixed));
+        o->style()->setWidth(Length(parentWidth, Fixed));
+    } else if (part == SliderThumbHorizontalPart || part == SliderThumbVerticalPart) {
+        QStyleOptionSlider option;
+        if (part == SliderThumbVerticalPart)
+            option.orientation = Qt::Vertical;
+
+        QStyle* style = qStyle();
+
+        int width = style->pixelMetric(QStyle::PM_SliderLength, &option);
+        int height = style->pixelMetric(QStyle::PM_SliderThickness, &option);
+        o->style()->setWidth(Length(width, Fixed));
+        o->style()->setHeight(Length(height, Fixed));
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.h b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.h
index 64921b14b6..b16918af91 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.h
+++ b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.h
@@ -19,8 +19,8 @@
  * Boston, MA 02110-1301, USA.
  *
  */
-#ifndef RenderThemeQt_H
-#define RenderThemeQt_H
+#ifndef RenderThemeQt_h
+#define RenderThemeQt_h
 
 #include "RenderTheme.h"
 
@@ -46,6 +46,8 @@ private:
 public:
     static PassRefPtr<RenderTheme> create(Page*);
 
+    String extraDefaultStyleSheet();
+
     virtual bool supportsHover(const RenderStyle*) const;
     virtual bool supportsFocusRing(const RenderStyle* style) const;
 
@@ -73,6 +75,11 @@ public:
 
     virtual double caretBlinkInterval() const;
 
+#ifdef Q_WS_MAEMO_5
+    virtual bool isControlStyled(const RenderStyle*, const BorderData&, const FillLayer&, const Color& backgroundColor) const;
+    virtual int popupInternalPaddingBottom(RenderStyle*) const;
+#endif
+
 #if ENABLE(VIDEO)
     virtual String extraMediaControlsStyleSheet();
 #endif
@@ -102,8 +109,16 @@ protected:
     virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
+#if ENABLE(PROGRESS_TAG)
+    virtual void adjustProgressBarStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintProgressBar(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+#endif
+
     virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+
     virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
     virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
@@ -117,6 +132,13 @@ protected:
     virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
     virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
+#if ENABLE(PROGRESS_TAG)
+    // Helper method for optimizing the paint area of the progress bar.
+    // If supported, it returns number of pixels needed to draw the progress bar up to the progress position.
+    // progressSize is the value that is passed back to RenderTheme during drawing.
+    virtual bool getNumberOfPixelsForProgressPosition(double position, int& progressSize) const;
+#endif
+
 #if ENABLE(VIDEO)
     virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
@@ -125,10 +147,15 @@ protected:
     virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-
+    virtual bool paintMediaCurrentTime(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual String formatMediaControlsCurrentTime(float currentTime, float duration) const;
+    virtual String formatMediaControlsRemainingTime(float currentTime, float duration) const;
 private:
     HTMLMediaElement* getMediaElementFromRenderObject(RenderObject* o) const;
     void paintMediaBackground(QPainter* painter, const IntRect& r) const;
+    double mediaControlsBaselineOpacity() const;
     QColor getMediaControlForegroundColor(RenderObject* o = 0) const;
 #endif
     void computeSizeBasedOnStyle(RenderStyle* renderStyle) const;
@@ -136,11 +163,13 @@ private:
 private:
     bool supportsFocus(ControlPart) const;
 
-    ControlPart applyTheme(QStyleOption&, RenderObject*) const;
+    ControlPart initializeCommonQStyleOptions(QStyleOption&, RenderObject*) const;
 
     void setButtonPadding(RenderStyle*) const;
     void setPopupPadding(RenderStyle*) const;
 
+    void setPaletteFromPageClientIfExists(QPalette&) const;
+
     int findFrameLineWidth(QStyle* style) const;
 
     QStyle* fallbackStyle() const;
@@ -186,4 +215,4 @@ private:
 
 }
 
-#endif
+#endif // RenderThemeQt_h
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/ScrollbarThemeQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/ScrollbarThemeQt.cpp
index c0692caafc..04a2b1b0af 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/ScrollbarThemeQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/ScrollbarThemeQt.cpp
@@ -147,7 +147,7 @@ bool ScrollbarThemeQt::paint(Scrollbar* scrollbar, GraphicsContext* graphicsCont
     p.painter->save();
     QStyleOptionSlider* opt = styleOptionSlider(scrollbar, p.widget);
 
-    p.painter->setClipRect(opt->rect.intersected(damageRect));
+    p.painter->setClipRect(opt->rect.intersected(damageRect), Qt::IntersectClip);
 
 #ifdef Q_WS_MAC
     p.drawComplexControl(QStyle::CC_ScrollBar, *opt);
@@ -233,9 +233,6 @@ void ScrollbarThemeQt::paintScrollCorner(ScrollView* scrollView, GraphicsContext
        return;
     }
 
-#if QT_VERSION < 0x040500
-    context->fillRect(rect, QApplication::palette().color(QPalette::Normal, QPalette::Window));
-#else
     StylePainter p(this, context);
     if (!p.isValid())
         return;
@@ -243,7 +240,6 @@ void ScrollbarThemeQt::paintScrollCorner(ScrollView* scrollView, GraphicsContext
     QStyleOption option;
     option.rect = rect;
     p.drawPrimitive(QStyle::PE_PanelScrollAreaCorner, option);
-#endif
 }
 
 QStyle* ScrollbarThemeQt::style() const
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/SharedBufferQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/SharedBufferQt.cpp
index 8d62226fd2..029d9d6286 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/SharedBufferQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/SharedBufferQt.cpp
@@ -45,6 +45,8 @@ PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String& fi
     if (result->m_buffer.size() != file.size())
         return 0;
 
+    result->m_size = result->m_buffer.size();
+
     file.read(result->m_buffer.data(), result->m_buffer.size());
     return result.release();
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp
index 9cc27ab074..162a4f2abe 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp
@@ -45,8 +45,10 @@ void PlatformWheelEvent::applyDelta(int delta, Qt::Orientation orientation)
     // Use the same single scroll step as QTextEdit
     // (in QTextEditPrivate::init [h,v]bar->setSingleStep)
     static const float cDefaultQtScrollStep = 20.f;
+#ifndef QT_NO_WHEELEVENT
     m_deltaX *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
     m_deltaY *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
+#endif
 }
 
 PlatformWheelEvent::PlatformWheelEvent(QGraphicsSceneWheelEvent* e)
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/WidgetQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/WidgetQt.cpp
index e9c99a4515..252bdb4457 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/WidgetQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/WidgetQt.cpp
@@ -91,13 +91,17 @@ void Widget::setCursor(const Cursor& cursor)
 
 void Widget::show()
 {
-    if (platformWidget())
+    setSelfVisible(true);
+
+    if (isParentVisible() && platformWidget())
         platformWidget()->show();
 }
 
 void Widget::hide()
 {
-    if (platformWidget())
+    setSelfVisible(false);
+
+    if (isParentVisible() && platformWidget())
         platformWidget()->hide();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.cpp b/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.cpp
index 9a4e32a36e..b0de725be1 100644
--- a/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.cpp
@@ -48,6 +48,7 @@ SQLiteDatabase::SQLiteDatabase()
     : m_db(0)
     , m_pageSize(-1)
     , m_transactionInProgress(false)
+    , m_sharable(false)
     , m_openingThread(0)
 {
 }
@@ -252,6 +253,18 @@ const char* SQLiteDatabase::lastErrorMsg()
     return sqlite3_errmsg(m_db);
 }
 
+#ifndef NDEBUG
+void SQLiteDatabase::disableThreadingChecks()
+{
+    // This doesn't guarantee that SQList was compiled with -DTHREADSAFE, or that you haven't turned off the mutexes.
+#if SQLITE_VERSION_NUMBER >= 3003001
+    m_sharable = true;
+#else
+    ASSERT(0); // Your SQLite doesn't support sharing handles across threads.
+#endif
+}
+#endif
+
 int SQLiteDatabase::authorizerFunction(void* userData, int actionCode, const char* parameter1, const char* parameter2, const char* /*databaseName*/, const char* /*trigger_or_view*/)
 {
     DatabaseAuthorizer* auth = static_cast<DatabaseAuthorizer*>(userData);
@@ -320,7 +333,7 @@ int SQLiteDatabase::authorizerFunction(void* userData, int actionCode, const cha
         case SQLITE_DROP_VTABLE:
             return auth->dropVTable(parameter1, parameter2);
         case SQLITE_FUNCTION:
-            return auth->allowFunction(parameter1);
+            return auth->allowFunction(parameter2);
 #endif
         default:
             ASSERT_NOT_REACHED();
@@ -361,4 +374,9 @@ void SQLiteDatabase::unlock()
     m_lockingMutex.unlock();
 }
 
+bool SQLiteDatabase::isAutoCommitOn() const
+{
+    return sqlite3_get_autocommit(m_db);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.h b/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.h
index 99822545e8..97fa7d09f0 100644
--- a/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.h
+++ b/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.h
@@ -97,7 +97,7 @@ public:
     const char* lastErrorMsg();
     
     sqlite3* sqlite3Handle() const {
-        ASSERT(currentThread() == m_openingThread);
+        ASSERT(m_sharable || currentThread() == m_openingThread);
         return m_db;
     }
     
@@ -106,6 +106,15 @@ public:
     // (un)locks the database like a mutex
     void lock();
     void unlock();
+    bool isAutoCommitOn() const;
+
+    // Set this flag to allow access from multiple threads.  Not all multi-threaded accesses are safe!
+    // See http://www.sqlite.org/cvstrac/wiki?p=MultiThreading for more info.
+#ifndef NDEBUG
+    void disableThreadingChecks();
+#else
+    void disableThreadingChecks() {}
+#endif
 
 private:
     static int authorizerFunction(void*, int, const char*, const char*, const char*, const char*);
@@ -119,6 +128,7 @@ private:
     int m_pageSize;
     
     bool m_transactionInProgress;
+    bool m_sharable;
     
     Mutex m_authorizerLock;
     RefPtr<DatabaseAuthorizer> m_authorizer;
diff --git a/src/3rdparty/webkit/WebCore/platform/sql/SQLiteTransaction.cpp b/src/3rdparty/webkit/WebCore/platform/sql/SQLiteTransaction.cpp
index a4b2ac83a1..6f90eac089 100644
--- a/src/3rdparty/webkit/WebCore/platform/sql/SQLiteTransaction.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/sql/SQLiteTransaction.cpp
@@ -55,9 +55,9 @@ void SQLiteTransaction::begin()
         // http://www.sqlite.org/lang_transaction.html
         // http://www.sqlite.org/lockingv3.html#locking
         if (m_readOnly)
-            m_inProgress = m_db.executeCommand("BEGIN;");
+            m_inProgress = m_db.executeCommand("BEGIN");
         else
-            m_inProgress = m_db.executeCommand("BEGIN IMMEDIATE;");
+            m_inProgress = m_db.executeCommand("BEGIN IMMEDIATE");
         m_db.m_transactionInProgress = m_inProgress;
     }
 }
@@ -66,17 +66,20 @@ void SQLiteTransaction::commit()
 {
     if (m_inProgress) {
         ASSERT(m_db.m_transactionInProgress);
-        m_db.executeCommand("COMMIT;");
-        m_inProgress = false;
-        m_db.m_transactionInProgress = false;
+        m_inProgress = !m_db.executeCommand("COMMIT");
+        m_db.m_transactionInProgress = m_inProgress;
     }
 }
 
 void SQLiteTransaction::rollback()
 {
+    // We do not use the 'm_inProgress = m_db.executeCommand("ROLLBACK")' construct here,
+    // because m_inProgress should always be set to false after a ROLLBACK, and
+    // m_db.executeCommand("ROLLBACK") can sometimes harmlessly fail, thus returning
+    // a non-zero/true result (http://www.sqlite.org/lang_transaction.html).
     if (m_inProgress) {
         ASSERT(m_db.m_transactionInProgress);
-        m_db.executeCommand("ROLLBACK;");
+        m_db.executeCommand("ROLLBACK");
         m_inProgress = false;
         m_db.m_transactionInProgress = false;
     }
@@ -84,8 +87,17 @@ void SQLiteTransaction::rollback()
 
 void SQLiteTransaction::stop()
 {
-    m_inProgress = false;
-    m_db.m_transactionInProgress = false;
+    if (m_inProgress) {
+        m_inProgress = false;
+        m_db.m_transactionInProgress = false;
+    }
+}
+
+bool SQLiteTransaction::wasRolledBackBySqlite() const
+{
+    // According to http://www.sqlite.org/c3ref/get_autocommit.html,
+    // the auto-commit flag should be off in the middle of a transaction
+    return m_inProgress && m_db.isAutoCommitOn();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/sql/SQLiteTransaction.h b/src/3rdparty/webkit/WebCore/platform/sql/SQLiteTransaction.h
index 557d81cb4e..924241ff5c 100644
--- a/src/3rdparty/webkit/WebCore/platform/sql/SQLiteTransaction.h
+++ b/src/3rdparty/webkit/WebCore/platform/sql/SQLiteTransaction.h
@@ -44,6 +44,7 @@ public:
     void stop();
     
     bool inProgress() const { return m_inProgress; }
+    bool wasRolledBackBySqlite() const;
 private:
     SQLiteDatabase& m_db;
     bool m_inProgress;
diff --git a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp
index 17d7832b25..c313f7faf6 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp
@@ -103,7 +103,9 @@ static inline bool equal(StringImpl* string, const UChar* characters, unsigned l
     if (string->length() != length)
         return false;
 
-#if PLATFORM(ARM) || PLATFORM(SH4)
+    // FIXME: perhaps we should have a more abstract macro that indicates when
+    // going 4 bytes at a time is unsafe
+#if CPU(ARM) || CPU(SH4)
     const UChar* stringCharacters = string->characters();
     for (unsigned i = 0; i != length; ++i) {
         if (*stringCharacters++ != *characters++)
@@ -246,11 +248,11 @@ PassRefPtr<StringImpl> AtomicString::add(const JSC::Identifier& identifier)
         return 0;
 
     UString::Rep* string = identifier.ustring().rep();
-    unsigned length = string->size();
+    unsigned length = string->length();
     if (!length)
         return StringImpl::empty();
 
-    HashAndCharacters buffer = { string->computedHash(), string->data(), length }; 
+    HashAndCharacters buffer = { string->existingHash(), string->characters(), length }; 
     pair<HashSet<StringImpl*>::iterator, bool> addResult = stringTable().add<HashAndCharacters, HashAndCharactersTranslator>(buffer);
     if (!addResult.second)
         return *addResult.first;
@@ -263,11 +265,11 @@ PassRefPtr<StringImpl> AtomicString::add(const JSC::UString& ustring)
         return 0;
 
     UString::Rep* string = ustring.rep();
-    unsigned length = string->size();
+    unsigned length = string->length();
     if (!length)
         return StringImpl::empty();
 
-    HashAndCharacters buffer = { string->hash(), string->data(), length }; 
+    HashAndCharacters buffer = { string->hash(), string->characters(), length }; 
     pair<HashSet<StringImpl*>::iterator, bool> addResult = stringTable().add<HashAndCharacters, HashAndCharactersTranslator>(buffer);
     if (!addResult.second)
         return *addResult.first;
@@ -280,11 +282,11 @@ AtomicStringImpl* AtomicString::find(const JSC::Identifier& identifier)
         return 0;
 
     UString::Rep* string = identifier.ustring().rep();
-    unsigned length = string->size();
+    unsigned length = string->length();
     if (!length)
         return static_cast<AtomicStringImpl*>(StringImpl::empty());
 
-    HashAndCharacters buffer = { string->computedHash(), string->data(), length }; 
+    HashAndCharacters buffer = { string->existingHash(), string->characters(), length }; 
     HashSet<StringImpl*>::iterator iterator = stringTable().find<HashAndCharacters, HashAndCharactersTranslator>(buffer);
     if (iterator == stringTable().end())
         return 0;
@@ -302,6 +304,8 @@ DEFINE_GLOBAL(AtomicString, emptyAtom, "")
 DEFINE_GLOBAL(AtomicString, textAtom, "#text")
 DEFINE_GLOBAL(AtomicString, commentAtom, "#comment")
 DEFINE_GLOBAL(AtomicString, starAtom, "*")
+DEFINE_GLOBAL(AtomicString, xmlAtom, "xml")
+DEFINE_GLOBAL(AtomicString, xmlnsAtom, "xmlns")
 
 void AtomicString::init()
 {
@@ -316,6 +320,8 @@ void AtomicString::init()
         new ((void*)&textAtom) AtomicString("#text");
         new ((void*)&commentAtom) AtomicString("#comment");
         new ((void*)&starAtom) AtomicString("*");
+        new ((void*)&xmlAtom) AtomicString("xml");
+        new ((void*)&xmlnsAtom) AtomicString("xmlns");
 
         initialized = true;
     }
diff --git a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h
index 8805f4c7dc..e293f8605b 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h
@@ -24,11 +24,19 @@
 #include "AtomicStringImpl.h"
 #include "PlatformString.h"
 
+// Define 'NO_IMPLICIT_ATOMICSTRING' before including this header,
+// to disallow (expensive) implicit String-->AtomicString conversions.
+#ifdef NO_IMPLICIT_ATOMICSTRING
+#define ATOMICSTRING_CONVERSION explicit
+#else
+#define ATOMICSTRING_CONVERSION
+#endif
+
 namespace WebCore {
 
 struct AtomicStringHash;
 
-class AtomicString {
+class AtomicString : public FastAllocBase {
 public:
     static void init();
 
@@ -40,9 +48,9 @@ public:
     AtomicString(const JSC::UString& s) : m_string(add(s)) { }
     AtomicString(const JSC::Identifier& s) : m_string(add(s)) { }
 #endif
-    AtomicString(StringImpl* imp) : m_string(add(imp)) { }
+    ATOMICSTRING_CONVERSION AtomicString(StringImpl* imp) : m_string(add(imp)) { }
     AtomicString(AtomicStringImpl* imp) : m_string(imp) { }
-    AtomicString(const String& s) : m_string(add(s.impl())) { }
+    ATOMICSTRING_CONVERSION AtomicString(const String& s) : m_string(add(s.impl())) { }
 
     // Hash table deleted values, which are only constructed and never copied or destroyed.
     AtomicString(WTF::HashTableDeletedValueType) : m_string(WTF::HashTableDeletedValue) { }
@@ -96,7 +104,7 @@ public:
 
     static void remove(StringImpl*);
     
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
     AtomicString(CFStringRef s) :  m_string(add(String(s).impl())) { }
     CFStringRef createCFString() const { return m_string.createCFString(); }
 #endif    
@@ -148,6 +156,8 @@ inline bool equalIgnoringCase(const String& a, const AtomicString& b) { return e
     extern const AtomicString textAtom;
     extern const AtomicString commentAtom;
     extern const AtomicString starAtom;
+    extern const AtomicString xmlAtom;
+    extern const AtomicString xmlnsAtom;
 #endif
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/text/AtomicStringImpl.h b/src/3rdparty/webkit/WebCore/platform/text/AtomicStringImpl.h
index d905afce30..ba1c72cb5a 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/AtomicStringImpl.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/AtomicStringImpl.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/src/3rdparty/webkit/WebCore/platform/text/Base64.cpp b/src/3rdparty/webkit/WebCore/platform/text/Base64.cpp
index be1916431a..cc22cf8e00 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/Base64.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/Base64.cpp
@@ -24,8 +24,6 @@
 #include "Base64.h"
 
 #include <limits.h>
-
-#include <wtf/Platform.h>
 #include <wtf/StringExtras.h>
 
 namespace WebCore {
@@ -62,21 +60,24 @@ static const char base64DecMap[128] = {
 
 void base64Encode(const Vector<char>& in, Vector<char>& out, bool insertLFs)
 {
+    base64Encode(in.data(), in.size(), out, insertLFs);
+}
+
+void base64Encode(const char* data, unsigned len, Vector<char>& out, bool insertLFs)
+{
     out.clear();
-    if (in.isEmpty())
+    if (!len)
         return;
 
     // If the input string is pathologically large, just return nothing.
     // Note: Keep this in sync with the "out_len" computation below.
     // Rather than being perfectly precise, this is a bit conservative.
     const unsigned maxInputBufferSize = UINT_MAX / 77 * 76 / 4 * 3 - 2;
-    if (in.size() > maxInputBufferSize)
+    if (len > maxInputBufferSize)
         return;
 
     unsigned sidx = 0;
     unsigned didx = 0;
-    const char* data = in.data();
-    const unsigned len = in.size();
 
     unsigned out_len = ((len + 2) / 3) * 4;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/text/Base64.h b/src/3rdparty/webkit/WebCore/platform/text/Base64.h
index 0b176e679e..53b29b075d 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/Base64.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/Base64.h
@@ -31,6 +31,7 @@
 namespace WebCore {
 
 void base64Encode(const Vector<char>&, Vector<char>&, bool insertLFs = false);
+void base64Encode(const char*, unsigned, Vector<char>&, bool insertLFs = false);
 
 // this decoder is not general purpose - it returns an error if it encounters a linefeed, as needed for window.atob
 bool base64Decode(const Vector<char>&, Vector<char>&);
diff --git a/src/3rdparty/webkit/WebCore/platform/text/BidiContext.cpp b/src/3rdparty/webkit/WebCore/platform/text/BidiContext.cpp
index 546571e347..59db7bdef3 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/BidiContext.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/BidiContext.cpp
@@ -30,7 +30,7 @@ using namespace WTF::Unicode;
 
 PassRefPtr<BidiContext> BidiContext::create(unsigned char level, Direction direction, bool override, BidiContext* parent)
 {
-    ASSERT(direction == level % 2 ? RightToLeft : LeftToRight);
+    ASSERT(direction == (level % 2 ? RightToLeft : LeftToRight));
 
     if (parent)
         return adoptRef(new BidiContext(level, direction, override, parent));
diff --git a/src/3rdparty/webkit/WebCore/platform/text/CString.h b/src/3rdparty/webkit/WebCore/platform/text/CString.h
index b9030d6620..48e5c69f0f 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/CString.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/CString.h
@@ -20,14 +20,12 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef CString_h
 #define CString_h
 
-#include "SharedBuffer.h"
-
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
@@ -38,7 +36,7 @@ namespace WebCore {
     public:
         const char* data() { return m_vector.data(); }
         size_t length() { return m_vector.size(); }
-        
+
     private:
         friend class CString;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/text/CharacterNames.h b/src/3rdparty/webkit/WebCore/platform/text/CharacterNames.h
index cd09447392..c0b1750843 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/CharacterNames.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/CharacterNames.h
@@ -37,9 +37,11 @@ namespace WebCore {
 
     const UChar blackSquare = 0x25A0;
     const UChar bullet = 0x2022;
+    const UChar ethiopicPrefaceColon = 0x1366;
     const UChar hebrewPunctuationGeresh = 0x05F3;
     const UChar hebrewPunctuationGershayim = 0x05F4;
     const UChar horizontalEllipsis = 0x2026;
+    const UChar hyphenMinus = 0x002D;
     const UChar ideographicComma = 0x3001;
     const UChar ideographicFullStop = 0x3002;
     const UChar ideographicSpace = 0x3000;
@@ -59,6 +61,7 @@ namespace WebCore {
     const UChar rightToLeftMark = 0x200F;
     const UChar rightToLeftOverride = 0x202E;
     const UChar softHyphen = 0x00AD;
+    const UChar space = 0x0020;
     const UChar whiteBullet = 0x25E6;
     const UChar zeroWidthSpace = 0x200B;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h b/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
index 8d19c175f6..c8946e2afc 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
@@ -31,17 +31,7 @@
 #include <objc/objc.h>
 #endif
 
-#if USE(JSC)
-#include <runtime/Identifier.h>
-#else
-// runtime/Identifier.h brings in a variety of wtf headers.  We explicitly
-// include them in the case of non-JSC builds to keep things consistent.
-#include <wtf/HashMap.h>
-#include <wtf/HashSet.h>
-#include <wtf/OwnPtr.h>
-#endif
-
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
 typedef const struct __CFString * CFStringRef;
 #endif
 
@@ -60,12 +50,40 @@ class wxString;
 class BString;
 #endif
 
+#if USE(JSC)
+namespace JSC {
+class Identifier;
+class UString;
+}
+#endif
+
 namespace WebCore {
 
 class CString;
 class SharedBuffer;
 struct StringHash;
 
+// Declarations of string operations
+
+bool charactersAreAllASCII(const UChar*, size_t);
+int charactersToIntStrict(const UChar*, size_t, bool* ok = 0, int base = 10);
+unsigned charactersToUIntStrict(const UChar*, size_t, bool* ok = 0, int base = 10);
+int64_t charactersToInt64Strict(const UChar*, size_t, bool* ok = 0, int base = 10);
+uint64_t charactersToUInt64Strict(const UChar*, size_t, bool* ok = 0, int base = 10);
+intptr_t charactersToIntPtrStrict(const UChar*, size_t, bool* ok = 0, int base = 10);
+
+int charactersToInt(const UChar*, size_t, bool* ok = 0); // ignores trailing garbage
+unsigned charactersToUInt(const UChar*, size_t, bool* ok = 0); // ignores trailing garbage
+int64_t charactersToInt64(const UChar*, size_t, bool* ok = 0); // ignores trailing garbage
+uint64_t charactersToUInt64(const UChar*, size_t, bool* ok = 0); // ignores trailing garbage
+intptr_t charactersToIntPtr(const UChar*, size_t, bool* ok = 0); // ignores trailing garbage
+
+double charactersToDouble(const UChar*, size_t, bool* ok = 0);
+float charactersToFloat(const UChar*, size_t, bool* ok = 0);
+
+int find(const UChar*, size_t, UChar, int startPosition = 0);
+int reverseFind(const UChar*, size_t, UChar, int startPosition = -1);
+
 class String {
 public:
     String() { } // gives null string, distinguishable from an empty string
@@ -136,6 +154,11 @@ public:
     String& replace(const String& a, const String& b) { if (m_impl) m_impl = m_impl->replace(a.impl(), b.impl()); return *this; }
     String& replace(unsigned index, unsigned len, const String& b) { if (m_impl) m_impl = m_impl->replace(index, len, b.impl()); return *this; }
 
+    void makeLower() { if (m_impl) m_impl = m_impl->lower(); }
+    void makeUpper() { if (m_impl) m_impl = m_impl->upper(); }
+    void makeSecure(UChar aChar) { if (m_impl) m_impl = m_impl->secure(aChar); }
+    void makeCapitalized(UChar previousCharacter) { if (m_impl) m_impl = m_impl->capitalize(previousCharacter); }
+
     void truncate(unsigned len);
     void remove(unsigned pos, int len = 1);
 
@@ -206,7 +229,7 @@ public:
 
     StringImpl* impl() const { return m_impl.get(); }
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
     String(CFStringRef);
     CFStringRef createCFString() const;
 #endif
@@ -259,6 +282,8 @@ public:
     // the specified grapheme cluster length.
     unsigned numCharactersInGraphemeClusters(unsigned) const;
 
+    bool containsOnlyASCII() const { return charactersAreAllASCII(characters(), length()); }
+
 private:
     RefPtr<StringImpl> m_impl;
 };
@@ -286,33 +311,18 @@ inline bool equalIgnoringCase(const String& a, const String& b) { return equalIg
 inline bool equalIgnoringCase(const String& a, const char* b) { return equalIgnoringCase(a.impl(), b); }
 inline bool equalIgnoringCase(const char* a, const String& b) { return equalIgnoringCase(a, b.impl()); }
 
+inline bool equalPossiblyIgnoringCase(const String& a, const String& b, bool ignoreCase) 
+{
+    return ignoreCase ? equalIgnoringCase(a, b) : (a == b);
+}
+
 inline bool equalIgnoringNullity(const String& a, const String& b) { return equalIgnoringNullity(a.impl(), b.impl()); }
 
 inline bool operator!(const String& str) { return str.isNull(); }
 
 inline void swap(String& a, String& b) { a.swap(b); }
 
-// String Operations
-
-bool charactersAreAllASCII(const UChar*, size_t);
-
-int charactersToIntStrict(const UChar*, size_t, bool* ok = 0, int base = 10);
-unsigned charactersToUIntStrict(const UChar*, size_t, bool* ok = 0, int base = 10);
-int64_t charactersToInt64Strict(const UChar*, size_t, bool* ok = 0, int base = 10);
-uint64_t charactersToUInt64Strict(const UChar*, size_t, bool* ok = 0, int base = 10);
-intptr_t charactersToIntPtrStrict(const UChar*, size_t, bool* ok = 0, int base = 10);
-
-int charactersToInt(const UChar*, size_t, bool* ok = 0); // ignores trailing garbage
-unsigned charactersToUInt(const UChar*, size_t, bool* ok = 0); // ignores trailing garbage
-int64_t charactersToInt64(const UChar*, size_t, bool* ok = 0); // ignores trailing garbage
-uint64_t charactersToUInt64(const UChar*, size_t, bool* ok = 0); // ignores trailing garbage
-intptr_t charactersToIntPtr(const UChar*, size_t, bool* ok = 0); // ignores trailing garbage
-
-double charactersToDouble(const UChar*, size_t, bool* ok = 0);
-float charactersToFloat(const UChar*, size_t, bool* ok = 0);
-
-int find(const UChar*, size_t, UChar, int startPosition = 0);
-int reverseFind(const UChar*, size_t, UChar, int startPosition = -1);
+// Definitions of string operations
 
 #ifdef __OBJC__
 // This is for situations in WebKit where the long standing behavior has been
diff --git a/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.h b/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.h
index 3254067ba9..f1611e54b7 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.h
@@ -30,7 +30,7 @@
 
 namespace WebCore {
 
-class RegularExpression {
+class RegularExpression : public FastAllocBase {
 public:
     RegularExpression(const String&, TextCaseSensitivity);
     ~RegularExpression();
diff --git a/src/3rdparty/webkit/WebCore/platform/text/String.cpp b/src/3rdparty/webkit/WebCore/platform/text/String.cpp
index 44582a9259..4f4e385b68 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/String.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/String.cpp
@@ -24,19 +24,22 @@
 
 #include "CString.h"
 #include "FloatConversion.h"
+#include "SharedBuffer.h"
 #include "StringBuffer.h"
 #include "TextBreakIterator.h"
 #include "TextEncoding.h"
-#include <wtf/dtoa.h>
 #include <limits>
 #include <stdarg.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Vector.h>
-#include <wtf/unicode/Unicode.h>
+#include <wtf/dtoa.h>
 #include <wtf/unicode/UTF8.h>
+#include <wtf/unicode/Unicode.h>
 
 #if USE(JSC)
+#include <runtime/Identifier.h>
+
 using JSC::Identifier;
 using JSC::UString;
 #endif
@@ -81,6 +84,9 @@ String::String(const char* str, unsigned length)
 
 void String::append(const String& str)
 {
+    if (str.isEmpty())
+       return;
+
     // FIXME: This is extremely inefficient. So much so that we might want to take this
     // out of String's API. We can make it better by optimizing the case where exactly
     // one String is pointing at this StringImpl, but even then it's going to require a
@@ -349,7 +355,7 @@ String String::format(const char *format, ...)
 
     return buffer;
 
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
     va_list args;
     va_start(args, format);
 
@@ -441,7 +447,7 @@ String String::number(unsigned long n)
 
 String String::number(long long n)
 {
-#if PLATFORM(WIN_OS) && !PLATFORM(QT)
+#if OS(WINDOWS) && !PLATFORM(QT)
     return String::format("%I64i", n);
 #else
     return String::format("%lli", n);
@@ -450,7 +456,7 @@ String String::number(long long n)
 
 String String::number(unsigned long long n)
 {
-#if PLATFORM(WIN_OS) && !PLATFORM(QT)
+#if OS(WINDOWS) && !PLATFORM(QT)
     return String::format("%I64u", n);
 #else
     return String::format("%llu", n);
diff --git a/src/3rdparty/webkit/WebCore/platform/text/StringBuilder.cpp b/src/3rdparty/webkit/WebCore/platform/text/StringBuilder.cpp
index c21e36662a..3e34981328 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/StringBuilder.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/StringBuilder.cpp
@@ -95,4 +95,17 @@ String StringBuilder::toString() const
     return result;
 }
 
+void StringBuilder::clear()
+{
+    m_totalLength = UINT_MAX;
+    m_strings.clear();
+}
+
+unsigned StringBuilder::length() const
+{
+    if (m_totalLength == UINT_MAX)
+        return 0;
+    return m_totalLength;
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/text/StringBuilder.h b/src/3rdparty/webkit/WebCore/platform/text/StringBuilder.h
index 8d76b9c449..7f72fbfbe5 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/StringBuilder.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/StringBuilder.h
@@ -42,6 +42,9 @@ namespace WebCore {
         void append(const String&);
         void append(UChar);
         void append(char);
+        
+        void clear();
+        unsigned length() const;
 
         String toString() const;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/text/StringHash.h b/src/3rdparty/webkit/WebCore/platform/text/StringHash.h
index 336dce30f9..e6c548ac80 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/StringHash.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/StringHash.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved
+ * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,12 +24,16 @@
 
 #include "AtomicString.h"
 #include "PlatformString.h"
-#include <wtf/HashFunctions.h>
 #include <wtf/HashTraits.h>
+#include <wtf/StringHashFunctions.h>
 #include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
 
+    // The hash() functions on StringHash and CaseFoldingHash do not support
+    // null strings. get(), contains(), and add() on HashMap<String,..., StringHash>
+    // cause a null-pointer dereference when passed null strings.
+
     // FIXME: We should really figure out a way to put the computeHash function that's
     // currently a member function of StringImpl into this file so we can be a little
     // closer to having all the nearly-identical hash functions in one place.
@@ -47,6 +52,18 @@ namespace WebCore {
             if (aLength != bLength)
                 return false;
 
+            // FIXME: perhaps we should have a more abstract macro that indicates when
+            // going 4 bytes at a time is unsafe
+#if CPU(ARM) || CPU(SH4)
+            const UChar* aChars = a->characters();
+            const UChar* bChars = b->characters();
+            for (unsigned i = 0; i != aLength; ++i) {
+                if (*aChars++ != *bChars++)
+                    return false;
+            }
+            return true;
+#else
+            /* Do it 4-bytes-at-a-time on architectures where it's safe */
             const uint32_t* aChars = reinterpret_cast<const uint32_t*>(a->characters());
             const uint32_t* bChars = reinterpret_cast<const uint32_t*>(b->characters());
 
@@ -59,6 +76,7 @@ namespace WebCore {
                 return false;
 
             return true;
+#endif
         }
 
         static unsigned hash(const RefPtr<StringImpl>& key) { return key->hash(); }
diff --git a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp
index 5cf4ced911..bd04a51f94 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp
@@ -33,7 +33,7 @@
 #include "StringHash.h"
 #include "TextBreakIterator.h"
 #include "TextEncoding.h"
-#include "ThreadGlobalData.h"
+#include <runtime/UString.h>
 #include <wtf/dtoa.h>
 #include <wtf/Assertions.h>
 #include <wtf/Threading.h>
@@ -46,74 +46,107 @@ namespace WebCore {
 
 static const unsigned minLengthToShare = 20;
 
-static inline UChar* newUCharVector(unsigned n)
+StringImpl::~StringImpl()
 {
-    return static_cast<UChar*>(fastMalloc(sizeof(UChar) * n));
-}
+    ASSERT(!isStatic());
 
-static inline void deleteUCharVector(const UChar* p)
-{
-    fastFree(const_cast<UChar*>(p));
+    if (inTable())
+        AtomicString::remove(this);
+
+    BufferOwnership ownership = bufferOwnership();
+    if (ownership != BufferInternal) {
+        if (ownership == BufferOwned) {
+            ASSERT(!m_sharedBuffer);
+            ASSERT(m_data);
+            fastFree(const_cast<UChar*>(m_data));
+        } else {
+            ASSERT(ownership == BufferShared);
+            ASSERT(m_sharedBuffer);
+            m_sharedBuffer->deref();
+        }
+    }
 }
 
-// Some of the factory methods create buffers using fastMalloc.
-// We must ensure that all allocations of StringImpl are allocated using
-// fastMalloc so that we don't have mis-matched frees. We accomplish 
-// this by overriding the new and delete operators.
-void* StringImpl::operator new(size_t size, void* address)
+StringImpl* StringImpl::empty()
 {
-    if (address)
-        return address;  // Allocating using an internal buffer
-    return fastMalloc(size);
+    // A non-null pointer at an invalid address (in page zero) so that if it were to be accessed we
+    // should catch the error with fault (however it should be impossible to access, since length is zero).
+    static const UChar* invalidNonNullUCharPtr = reinterpret_cast<UChar*>(static_cast<intptr_t>(1));
+    DEFINE_STATIC_LOCAL(StringImpl, emptyString, (invalidNonNullUCharPtr, 0, ConstructStaticString));
+    return &emptyString;
 }
 
-void* StringImpl::operator new(size_t size)
+PassRefPtr<StringImpl> StringImpl::createUninitialized(unsigned length, UChar*& data)
 {
-    return fastMalloc(size);
+    if (!length) {
+        data = 0;
+        return empty();
+    }
+
+    // Allocate a single buffer large enough to contain the StringImpl
+    // struct as well as the data which it contains. This removes one 
+    // heap allocation from this call.
+    if (length > ((std::numeric_limits<size_t>::max() - sizeof(StringImpl)) / sizeof(UChar)))
+        CRASH();
+    size_t size = sizeof(StringImpl) + length * sizeof(UChar);
+    StringImpl* string = static_cast<StringImpl*>(fastMalloc(size));
+
+    data = reinterpret_cast<UChar*>(string + 1);
+    return adoptRef(new (string) StringImpl(length));
 }
 
-void StringImpl::operator delete(void* address)
+PassRefPtr<StringImpl> StringImpl::create(const UChar* characters, unsigned length)
 {
-    fastFree(address);
+    if (!characters || !length)
+        return empty();
+
+    UChar* data;
+    PassRefPtr<StringImpl> string = createUninitialized(length, data);
+    memcpy(data, characters, length * sizeof(UChar));
+    return string;
 }
 
-// This constructor is used only to create the empty string.
-StringImpl::StringImpl()
-    : m_data(0)
-    , m_length(0)
-    , m_hash(0)
+PassRefPtr<StringImpl> StringImpl::create(const char* characters, unsigned length)
 {
-    // Ensure that the hash is computed so that AtomicStringHash can call existingHash()
-    // with impunity. The empty string is special because it is never entered into
-    // AtomicString's HashKey, but still needs to compare correctly.
-    hash();
+    if (!characters || !length)
+        return empty();
+
+    UChar* data;
+    PassRefPtr<StringImpl> string = createUninitialized(length, data);
+    for (unsigned i = 0; i != length; ++i) {
+        unsigned char c = characters[i];
+        data[i] = c;
+    }
+    return string;
 }
 
-inline StringImpl::StringImpl(const UChar* characters, unsigned length)
-    : m_data(characters)
-    , m_length(length)
-    , m_hash(0)
+PassRefPtr<StringImpl> StringImpl::create(const char* string)
 {
-    ASSERT(characters);
-    ASSERT(length);
+    if (!string)
+        return empty();
+    return create(string, strlen(string));
 }
 
-StringImpl::~StringImpl()
+SharedUChar* StringImpl::sharedBuffer()
 {
-    if (inTable())
-        AtomicString::remove(this);
-    if (!bufferIsInternal()) {
-        SharedUChar* sharedBuffer = m_sharedBufferAndFlags.get();
-        if (sharedBuffer)
-            sharedBuffer->deref();
-        else
-            deleteUCharVector(m_data);
+    if (m_length < minLengthToShare)
+        return 0;
+    // All static strings are smaller that the minimim length to share.
+    ASSERT(!isStatic());
+
+    BufferOwnership ownership = bufferOwnership();
+
+    if (ownership == BufferInternal)
+        return 0;
+    if (ownership == BufferOwned) {
+        ASSERT(!m_sharedBuffer);
+        m_sharedBuffer = SharedUChar::create(new SharableUChar(m_data)).releaseRef();
+        m_refCountAndFlags = (m_refCountAndFlags & ~s_refCountMaskBufferOwnership) | BufferShared;
     }
-}
 
-StringImpl* StringImpl::empty()
-{
-    return threadGlobalData().emptyString();
+    ASSERT(bufferOwnership() == BufferShared);
+    ASSERT(m_sharedBuffer);
+    return m_sharedBuffer;
 }
 
 bool StringImpl::containsOnlyWhitespace()
@@ -905,73 +938,11 @@ PassRefPtr<StringImpl> StringImpl::adopt(StringBuffer& buffer)
     return adoptRef(new StringImpl(buffer.release(), length));
 }
 
-PassRefPtr<StringImpl> StringImpl::adopt(Vector<UChar>& vector)
-{
-    size_t size = vector.size();
-    if (size == 0)
-        return empty();
-    return adoptRef(new StringImpl(vector.releaseBuffer(), size));
-}
-
-PassRefPtr<StringImpl> StringImpl::createUninitialized(unsigned length, UChar*& data)
-{
-    if (!length) {
-        data = 0;
-        return empty();
-    }
-
-    // Allocate a single buffer large enough to contain the StringImpl
-    // struct as well as the data which it contains. This removes one 
-    // heap allocation from this call.
-    size_t size = sizeof(StringImpl) + length * sizeof(UChar);
-    StringImpl* string = static_cast<StringImpl*>(fastMalloc(size));
-    data = reinterpret_cast<UChar*>(string + 1);
-    string = new (string) StringImpl(data, length);
-    return adoptRef(string);
-}
-
-PassRefPtr<StringImpl> StringImpl::create(const UChar* characters, unsigned length)
-{
-    if (!characters || !length)
-        return empty();
-
-    UChar* data;
-    PassRefPtr<StringImpl> string = createUninitialized(length, data);
-    memcpy(data, characters, length * sizeof(UChar));
-    return string;
-}
-
-PassRefPtr<StringImpl> StringImpl::create(const char* characters, unsigned length)
-{
-    if (!characters || !length)
-        return empty();
-
-    UChar* data;
-    PassRefPtr<StringImpl> string = createUninitialized(length, data);
-    for (unsigned i = 0; i != length; ++i) {
-        unsigned char c = characters[i];
-        data[i] = c;
-    }
-    return string;
-}
-
-PassRefPtr<StringImpl> StringImpl::create(const char* string)
-{
-    if (!string)
-        return empty();
-    return create(string, strlen(string));
-}
-
 #if USE(JSC)
 PassRefPtr<StringImpl> StringImpl::create(const JSC::UString& str)
 {
-    SharedUChar* sharedBuffer = const_cast<JSC::UString*>(&str)->rep()->sharedBuffer();
-    if (sharedBuffer) {
-        PassRefPtr<StringImpl> impl = adoptRef(new StringImpl(str.data(), str.size()));
-        sharedBuffer->ref();
-        impl->m_sharedBufferAndFlags.set(sharedBuffer);
-        return impl;
-    }
+    if (SharedUChar* sharedBuffer = const_cast<JSC::UString*>(&str)->rep()->sharedBuffer())
+        return adoptRef(new StringImpl(str.data(), str.size(), sharedBuffer));
     return StringImpl::create(str.data(), str.size());
 }
 
@@ -979,7 +950,7 @@ JSC::UString StringImpl::ustring()
 {
     SharedUChar* sharedBuffer = this->sharedBuffer();
     if (sharedBuffer)
-        return JSC::UString::Rep::create(const_cast<UChar*>(m_data), m_length, sharedBuffer);
+        return JSC::UString::Rep::create(sharedBuffer, const_cast<UChar*>(m_data), m_length);
 
     return JSC::UString(m_data, m_length);
 }
@@ -996,40 +967,22 @@ PassRefPtr<StringImpl> StringImpl::createWithTerminatingNullCharacter(const Stri
     data[length] = 0;
     terminatedString->m_length--;
     terminatedString->m_hash = string.m_hash;
-    terminatedString->m_sharedBufferAndFlags.setFlag(HasTerminatingNullCharacter);
+    terminatedString->m_refCountAndFlags |= s_refCountFlagHasTerminatingNullCharacter;
     return terminatedString.release();
 }
 
 PassRefPtr<StringImpl> StringImpl::threadsafeCopy() const
 {
-    // Special-case empty strings to make sure that per-thread empty string instance isn't returned.
-    if (m_length == 0)
-        return adoptRef(new StringImpl);
     return create(m_data, m_length);
 }
 
 PassRefPtr<StringImpl> StringImpl::crossThreadString()
 {
-    SharedUChar* shared = sharedBuffer();
-    if (shared) {
-        RefPtr<StringImpl> impl = adoptRef(new StringImpl(m_data, m_length));
-        impl->m_sharedBufferAndFlags.set(shared->crossThreadCopy().releaseRef());
-        return impl.release();
-    }
+    if (SharedUChar* sharedBuffer = this->sharedBuffer())
+        return adoptRef(new StringImpl(m_data, m_length, sharedBuffer->crossThreadCopy()));
 
     // If no shared buffer is available, create a copy.
     return threadsafeCopy();
 }
 
-StringImpl::SharedUChar* StringImpl::sharedBuffer()
-{
-    if (m_length < minLengthToShare || bufferIsInternal())
-        return 0;
-
-    if (!m_sharedBufferAndFlags.get())
-        m_sharedBufferAndFlags.set(SharedUChar::create(new OwnFastMallocPtr<UChar>(const_cast<UChar*>(m_data))).releaseRef());
-    return m_sharedBufferAndFlags.get();
-}
-
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h
index dac25b289d..af9d650884 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h
@@ -26,18 +26,14 @@
 #include <limits.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/CrossThreadRefCounted.h>
+#include <wtf/Noncopyable.h>
 #include <wtf/OwnFastMallocPtr.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/PtrAndFlags.h>
 #include <wtf/RefCounted.h>
+#include <wtf/StringHashFunctions.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/Unicode.h>
 
-#if USE(JSC)
-#include <runtime/UString.h>
-#endif
-
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
 typedef const struct __CFString * CFStringRef;
 #endif
 
@@ -45,6 +41,10 @@ typedef const struct __CFString * CFStringRef;
 @class NSString;
 #endif
 
+namespace JSC {
+class UString;
+}
+
 namespace WebCore {
 
 class StringBuffer;
@@ -56,23 +56,82 @@ struct UCharBufferTranslator;
 
 enum TextCaseSensitivity { TextCaseSensitive, TextCaseInsensitive };
 
+typedef OwnFastMallocPtr<const UChar> SharableUChar;
+typedef CrossThreadRefCounted<SharableUChar> SharedUChar;
 typedef bool (*CharacterMatchFunctionPtr)(UChar);
 
-class StringImpl : public RefCounted<StringImpl> {
+class StringImpl : public Noncopyable {
     friend struct CStringTranslator;
     friend struct HashAndCharactersTranslator;
     friend struct UCharBufferTranslator;
 private:
-    friend class ThreadGlobalData;
-    StringImpl();
-    
-    // This adopts the UChar* without copying the buffer.
-    StringImpl(const UChar*, unsigned length);
+    enum BufferOwnership {
+        BufferInternal,
+        BufferOwned,
+        BufferShared,
+    };
+
+    // Used to construct static strings, which have an special refCount that can never hit zero.
+    // This means that the static string will never be destroyed, which is important because
+    // static strings will be shared across threads & ref-counted in a non-threadsafe manner.
+    enum StaticStringConstructType { ConstructStaticString };
+    StringImpl(const UChar* characters, unsigned length, StaticStringConstructType)
+        : m_data(characters)
+        , m_sharedBuffer(0)
+        , m_length(length)
+        , m_refCountAndFlags(s_refCountFlagStatic | BufferInternal)
+        , m_hash(0)
+    {
+        // Ensure that the hash is computed so that AtomicStringHash can call existingHash()
+        // with impunity. The empty string is special because it is never entered into
+        // AtomicString's HashKey, but still needs to compare correctly.
+        hash();
+    }
+
+    // Create a normal string with internal storage (BufferInternal)
+    StringImpl(unsigned length)
+        : m_data(reinterpret_cast<const UChar*>(this + 1))
+        , m_sharedBuffer(0)
+        , m_length(length)
+        , m_refCountAndFlags(s_refCountIncrement | BufferInternal)
+        , m_hash(0)
+    {
+        ASSERT(m_data);
+        ASSERT(m_length);
+    }
+
+    // Create a StringImpl adopting ownership of the provided buffer (BufferOwned)
+    StringImpl(const UChar* characters, unsigned length)
+        : m_data(characters)
+        , m_sharedBuffer(0)
+        , m_length(length)
+        , m_refCountAndFlags(s_refCountIncrement | BufferOwned)
+        , m_hash(0)
+    {
+        ASSERT(m_data);
+        ASSERT(m_length);
+    }
+
+    // Used to construct new strings sharing an existing SharedUChar (BufferShared)
+    StringImpl(const UChar* characters, unsigned length, PassRefPtr<SharedUChar> sharedBuffer)
+        : m_data(characters)
+        , m_sharedBuffer(sharedBuffer.releaseRef())
+        , m_length(length)
+        , m_refCountAndFlags(s_refCountIncrement | BufferShared)
+        , m_hash(0)
+    {
+        ASSERT(m_data);
+        ASSERT(m_length);
+    }
 
     // For use only by AtomicString's XXXTranslator helpers.
-    void setHash(unsigned hash) { ASSERT(!m_hash); m_hash = hash; }
-    
-    typedef CrossThreadRefCounted<OwnFastMallocPtr<UChar> > SharedUChar;
+    void setHash(unsigned hash)
+    {
+        ASSERT(!isStatic());
+        ASSERT(!m_hash);
+        ASSERT(hash == computeHash(m_data, m_length));
+        m_hash = hash;
+    }
 
 public:
     ~StringImpl();
@@ -80,32 +139,46 @@ public:
     static PassRefPtr<StringImpl> create(const UChar*, unsigned length);
     static PassRefPtr<StringImpl> create(const char*, unsigned length);
     static PassRefPtr<StringImpl> create(const char*);
-    static PassRefPtr<StringImpl> createUninitialized(unsigned length, UChar*& data);
-
-    static PassRefPtr<StringImpl> createWithTerminatingNullCharacter(const StringImpl&);
-
-    static PassRefPtr<StringImpl> createStrippingNullCharacters(const UChar*, unsigned length);
-    static PassRefPtr<StringImpl> adopt(StringBuffer&);
-    static PassRefPtr<StringImpl> adopt(Vector<UChar>&);
 #if USE(JSC)
     static PassRefPtr<StringImpl> create(const JSC::UString&);
     JSC::UString ustring();
 #endif
 
+    static PassRefPtr<StringImpl> createUninitialized(unsigned length, UChar*& data);
+    static PassRefPtr<StringImpl> createWithTerminatingNullCharacter(const StringImpl&);
+    static PassRefPtr<StringImpl> createStrippingNullCharacters(const UChar*, unsigned length);
+
+    template<size_t inlineCapacity>
+    static PassRefPtr<StringImpl> adopt(Vector<UChar, inlineCapacity>& vector)
+    {
+        if (size_t size = vector.size()) {
+            ASSERT(vector.data());
+            return adoptRef(new StringImpl(vector.releaseBuffer(), size));
+        }
+        return empty();
+    }
+    static PassRefPtr<StringImpl> adopt(StringBuffer&);
+
     SharedUChar* sharedBuffer();
-    const UChar* characters() { return m_data; }
+    const UChar* characters() const { return m_data; }
     unsigned length() { return m_length; }
 
-    bool hasTerminatingNullCharacter() const { return m_sharedBufferAndFlags.isFlagSet(HasTerminatingNullCharacter); }
+    bool hasTerminatingNullCharacter() const { return m_refCountAndFlags & s_refCountFlagHasTerminatingNullCharacter; }
 
-    bool inTable() const { return m_sharedBufferAndFlags.isFlagSet(InTable); }
-    void setInTable() { return m_sharedBufferAndFlags.setFlag(InTable); }
+    bool inTable() const { return m_refCountAndFlags & s_refCountFlagInTable; }
+    void setInTable() { m_refCountAndFlags |= s_refCountFlagInTable; }
 
-    unsigned hash() { if (m_hash == 0) m_hash = computeHash(m_data, m_length); return m_hash; }
+    unsigned hash() const { if (!m_hash) m_hash = computeHash(m_data, m_length); return m_hash; }
     unsigned existingHash() const { ASSERT(m_hash); return m_hash; }
-    static unsigned computeHash(const UChar*, unsigned len);
-    static unsigned computeHash(const char*);
-    
+    static unsigned computeHash(const UChar* data, unsigned length) { return WTF::stringHash(data, length); }
+    static unsigned computeHash(const char* data) { return WTF::stringHash(data); }
+
+    StringImpl* ref() { m_refCountAndFlags += s_refCountIncrement; return this; }
+    ALWAYS_INLINE void deref() { m_refCountAndFlags -= s_refCountIncrement; if (!(m_refCountAndFlags & (s_refCountMask | s_refCountFlagStatic))) delete this; }
+    ALWAYS_INLINE bool hasOneRef() const { return (m_refCountAndFlags & (s_refCountMask | s_refCountFlagStatic)) == s_refCountIncrement; }
+
+    static StringImpl* empty();
+
     // Returns a StringImpl suitable for use on another thread.
     PassRefPtr<StringImpl> crossThreadString();
     // Makes a deep copy. Helpful only if you need to use a String on another thread
@@ -162,44 +235,38 @@ public:
     PassRefPtr<StringImpl> replace(StringImpl*, StringImpl*);
     PassRefPtr<StringImpl> replace(unsigned index, unsigned len, StringImpl*);
 
-    static StringImpl* empty();
-
     Vector<char> ascii();
 
     WTF::Unicode::Direction defaultWritingDirection();
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
     CFStringRef createCFString();
 #endif
 #ifdef __OBJC__
     operator NSString*();
 #endif
 
-    void operator delete(void*);
-
 private:
-    // Allocation from a custom buffer is only allowed internally to avoid
-    // mismatched allocators. Callers should use create().
-    void* operator new(size_t size);
-    void* operator new(size_t size, void* address);
+    using Noncopyable::operator new;
+    void* operator new(size_t, void* inPlace) { ASSERT(inPlace); return inPlace; }
 
     static PassRefPtr<StringImpl> createStrippingNullCharactersSlowCase(const UChar*, unsigned length);
     
-    // The StringImpl struct and its data may be allocated within a single heap block.
-    // In this case, the m_data pointer is an "internal buffer", and does not need to be deallocated.
-    bool bufferIsInternal() { return m_data == reinterpret_cast<const UChar*>(this + 1); }
+    BufferOwnership bufferOwnership() const { return static_cast<BufferOwnership>(m_refCountAndFlags & s_refCountMaskBufferOwnership); }
+    bool isStatic() const { return m_refCountAndFlags & s_refCountFlagStatic; }
 
-    enum StringImplFlags {
-        HasTerminatingNullCharacter,
-        InTable,
-    };
+    static const unsigned s_refCountMask = 0xFFFFFFE0;
+    static const unsigned s_refCountIncrement = 0x20;
+    static const unsigned s_refCountFlagStatic = 0x10;
+    static const unsigned s_refCountFlagHasTerminatingNullCharacter = 0x8;
+    static const unsigned s_refCountFlagInTable = 0x4;
+    static const unsigned s_refCountMaskBufferOwnership = 0x3;
 
     const UChar* m_data;
+    SharedUChar* m_sharedBuffer;
     unsigned m_length;
+    unsigned m_refCountAndFlags;
     mutable unsigned m_hash;
-    PtrAndFlags<SharedUChar, StringImplFlags> m_sharedBufferAndFlags;
-    // There is a fictitious variable-length UChar array at the end, which is used
-    // as the internal buffer by the createUninitialized and create methods.
 };
 
 bool equal(StringImpl*, StringImpl*);
@@ -214,91 +281,6 @@ inline bool equalIgnoringCase(const char* a, const UChar* b, unsigned length) {
 
 bool equalIgnoringNullity(StringImpl*, StringImpl*);
 
-// Golden ratio - arbitrary start value to avoid mapping all 0's to all 0's
-// or anything like that.
-const unsigned phi = 0x9e3779b9U;
-
-// Paul Hsieh's SuperFastHash
-// http://www.azillionmonkeys.com/qed/hash.html
-inline unsigned StringImpl::computeHash(const UChar* data, unsigned length)
-{
-    unsigned hash = phi;
-    
-    // Main loop.
-    for (unsigned pairCount = length >> 1; pairCount; pairCount--) {
-        hash += data[0];
-        unsigned tmp = (data[1] << 11) ^ hash;
-        hash = (hash << 16) ^ tmp;
-        data += 2;
-        hash += hash >> 11;
-    }
-    
-    // Handle end case.
-    if (length & 1) {
-        hash += data[0];
-        hash ^= hash << 11;
-        hash += hash >> 17;
-    }
-
-    // Force "avalanching" of final 127 bits.
-    hash ^= hash << 3;
-    hash += hash >> 5;
-    hash ^= hash << 2;
-    hash += hash >> 15;
-    hash ^= hash << 10;
-
-    // This avoids ever returning a hash code of 0, since that is used to
-    // signal "hash not computed yet", using a value that is likely to be
-    // effectively the same as 0 when the low bits are masked.
-    hash |= !hash << 31;
-    
-    return hash;
-}
-
-// Paul Hsieh's SuperFastHash
-// http://www.azillionmonkeys.com/qed/hash.html
-inline unsigned StringImpl::computeHash(const char* data)
-{
-    // This hash is designed to work on 16-bit chunks at a time. But since the normal case
-    // (above) is to hash UTF-16 characters, we just treat the 8-bit chars as if they
-    // were 16-bit chunks, which should give matching results
-
-    unsigned hash = phi;
-    
-    // Main loop
-    for (;;) {
-        unsigned char b0 = data[0];
-        if (!b0)
-            break;
-        unsigned char b1 = data[1];
-        if (!b1) {
-            hash += b0;
-            hash ^= hash << 11;
-            hash += hash >> 17;
-            break;
-        }
-        hash += b0;
-        unsigned tmp = (b1 << 11) ^ hash;
-        hash = (hash << 16) ^ tmp;
-        data += 2;
-        hash += hash >> 11;
-    }
-    
-    // Force "avalanching" of final 127 bits.
-    hash ^= hash << 3;
-    hash += hash >> 5;
-    hash ^= hash << 2;
-    hash += hash >> 15;
-    hash ^= hash << 10;
-
-    // This avoids ever returning a hash code of 0, since that is used to
-    // signal "hash not computed yet", using a value that is likely to be
-    // effectively the same as 0 when the low bits are masked.
-    hash |= !hash << 31;
-    
-    return hash;
-}
-
 static inline bool isSpaceOrNewline(UChar c)
 {
     // Use isASCIISpace() for basic Latin-1.
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextBoundariesICU.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextBoundaries.cpp
index b1e8ee2fe2..2455f6d024 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextBoundariesICU.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextBoundaries.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Dominik Röttsches <dominik.roettsches@access-company.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,39 +27,40 @@
 #include "config.h"
 #include "TextBoundaries.h"
 
-#include <unicode/ubrk.h>
-#include <unicode/uchar.h>
-
 #include "StringImpl.h"
 #include "TextBreakIterator.h"
+#include <wtf/unicode/Unicode.h>
+
+using namespace WTF;
+using namespace Unicode;
 
 namespace WebCore {
 
 int findNextWordFromIndex(const UChar* chars, int len, int position, bool forward)
 {
-    UBreakIterator* it = wordBreakIterator(chars, len);
+    TextBreakIterator* it = wordBreakIterator(chars, len);
 
     if (forward) {
-        position = ubrk_following(it, position);
-        while (position != UBRK_DONE) {
+        position = textBreakFollowing(it, position);
+        while (position != TextBreakDone) {
             // We stop searching when the character preceeding the break
             // is alphanumeric.
-            if (position < len && u_isalnum(chars[position - 1]))
+            if (position < len && isAlphanumeric(chars[position - 1]))
                 return position;
 
-            position = ubrk_following(it, position);
+            position = textBreakFollowing(it, position);
         }
 
         return len;
     } else {
-        position = ubrk_preceding(it, position);
-        while (position != UBRK_DONE) {
+        position = textBreakPreceding(it, position);
+        while (position != TextBreakDone) {
             // We stop searching when the character following the break
             // is alphanumeric.
-            if (position > 0 && u_isalnum(chars[position]))
+            if (position > 0 && isAlphanumeric(chars[position]))
                 return position;
 
-            position = ubrk_preceding(it, position);
+            position = textBreakPreceding(it, position);
         }
 
         return 0;
@@ -67,11 +69,11 @@ int findNextWordFromIndex(const UChar* chars, int len, int position, bool forwar
 
 void findWordBoundary(const UChar* chars, int len, int position, int* start, int* end)
 {
-    UBreakIterator* it = wordBreakIterator(chars, len);
-    *end = ubrk_following(it, position);
+    TextBreakIterator* it = wordBreakIterator(chars, len);
+    *end = textBreakFollowing(it, position);
     if (*end < 0)
-        *end = ubrk_last(it);
-    *start = ubrk_previous(it);
+        *end = textBreakLast(it);
+    *start = textBreakPrevious(it);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextBreakIterator.h b/src/3rdparty/webkit/WebCore/platform/text/TextBreakIterator.h
index 7b3b963ff1..17cf5f046c 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextBreakIterator.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextBreakIterator.h
@@ -47,7 +47,9 @@ namespace WebCore {
     TextBreakIterator* sentenceBreakIterator(const UChar*, int length);
 
     int textBreakFirst(TextBreakIterator*);
+    int textBreakLast(TextBreakIterator*);
     int textBreakNext(TextBreakIterator*);
+    int textBreakPrevious(TextBreakIterator*);
     int textBreakCurrent(TextBreakIterator*);
     int textBreakPreceding(TextBreakIterator*, int);
     int textBreakFollowing(TextBreakIterator*, int);
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextBreakIteratorICU.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextBreakIteratorICU.cpp
index c922fbc842..f5575eee73 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextBreakIteratorICU.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextBreakIteratorICU.cpp
@@ -24,7 +24,6 @@
 
 #include "PlatformString.h"
 #include "TextBreakIteratorInternalICU.h"
-
 #include <unicode/ubrk.h>
 #include <wtf/Assertions.h>
 
@@ -38,7 +37,7 @@ static TextBreakIterator* setUpIterator(bool& createdIterator, TextBreakIterator
 
     if (!createdIterator) {
         UErrorCode openStatus = U_ZERO_ERROR;
-        iterator = static_cast<TextBreakIterator*>(ubrk_open(type, currentTextBreakLocaleID(), 0, 0, &openStatus));
+        iterator = reinterpret_cast<TextBreakIterator*>(ubrk_open(type, currentTextBreakLocaleID(), 0, 0, &openStatus));
         createdIterator = true;
         ASSERT_WITH_MESSAGE(U_SUCCESS(openStatus), "ICU could not open a break iterator: %s (%d)", u_errorName(openStatus), openStatus);
     }
@@ -46,7 +45,7 @@ static TextBreakIterator* setUpIterator(bool& createdIterator, TextBreakIterator
         return 0;
 
     UErrorCode setTextStatus = U_ZERO_ERROR;
-    ubrk_setText(iterator, string, length, &setTextStatus);
+    ubrk_setText(reinterpret_cast<UBreakIterator*>(iterator), string, length, &setTextStatus);
     if (U_FAILURE(setTextStatus))
         return 0;
 
@@ -85,34 +84,44 @@ TextBreakIterator* sentenceBreakIterator(const UChar* string, int length)
         staticSentenceBreakIterator, UBRK_SENTENCE, string, length);
 }
 
-int textBreakFirst(TextBreakIterator* bi)
+int textBreakFirst(TextBreakIterator* iterator)
+{
+    return ubrk_first(reinterpret_cast<UBreakIterator*>(iterator));
+}
+
+int textBreakLast(TextBreakIterator* iterator)
+{
+    return ubrk_last(reinterpret_cast<UBreakIterator*>(iterator));
+}
+
+int textBreakNext(TextBreakIterator* iterator)
 {
-    return ubrk_first(bi);
+    return ubrk_next(reinterpret_cast<UBreakIterator*>(iterator));
 }
 
-int textBreakNext(TextBreakIterator* bi)
+int textBreakPrevious(TextBreakIterator* iterator)
 {
-    return ubrk_next(bi);
+    return ubrk_previous(reinterpret_cast<UBreakIterator*>(iterator));
 }
 
-int textBreakPreceding(TextBreakIterator* bi, int pos)
+int textBreakPreceding(TextBreakIterator* iterator, int pos)
 {
-    return ubrk_preceding(bi, pos);
+    return ubrk_preceding(reinterpret_cast<UBreakIterator*>(iterator), pos);
 }
 
-int textBreakFollowing(TextBreakIterator* bi, int pos)
+int textBreakFollowing(TextBreakIterator* iterator, int pos)
 {
-    return ubrk_following(bi, pos);
+    return ubrk_following(reinterpret_cast<UBreakIterator*>(iterator), pos);
 }
 
-int textBreakCurrent(TextBreakIterator* bi)
+int textBreakCurrent(TextBreakIterator* iterator)
 {
-    return ubrk_current(bi);
+    return ubrk_current(reinterpret_cast<UBreakIterator*>(iterator));
 }
 
-bool isTextBreak(TextBreakIterator* bi, int pos)
+bool isTextBreak(TextBreakIterator* iterator, int position)
 {
-    return ubrk_isBoundary(bi, pos);
+    return ubrk_isBoundary(reinterpret_cast<UBreakIterator*>(iterator), position);
 }
 
 #ifndef BUILDING_ON_TIGER
@@ -126,7 +135,7 @@ static TextBreakIterator* setUpIteratorWithRules(bool& createdIterator, TextBrea
         UParseError parseStatus;
         UErrorCode openStatus = U_ZERO_ERROR;
         String rules(breakRules);
-        iterator = static_cast<TextBreakIterator*>(ubrk_openRules(rules.characters(), rules.length(), 0, 0, &parseStatus, &openStatus));
+        iterator = reinterpret_cast<TextBreakIterator*>(ubrk_openRules(rules.characters(), rules.length(), 0, 0, &parseStatus, &openStatus));
         createdIterator = true;
         ASSERT_WITH_MESSAGE(U_SUCCESS(openStatus), "ICU could not open a break iterator: %s (%d)", u_errorName(openStatus), openStatus);
     }
@@ -134,7 +143,7 @@ static TextBreakIterator* setUpIteratorWithRules(bool& createdIterator, TextBrea
         return 0;
 
     UErrorCode setTextStatus = U_ZERO_ERROR;
-    ubrk_setText(iterator, string, length, &setTextStatus);
+    ubrk_setText(reinterpret_cast<UBreakIterator*>(iterator), string, length, &setTextStatus);
     if (U_FAILURE(setTextStatus))
         return 0;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextCodecICU.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextCodecICU.cpp
index 7ebce2c5b8..a8a817f1d4 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextCodecICU.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextCodecICU.cpp
@@ -87,7 +87,7 @@ void TextCodecICU::registerExtendedEncodingNames(EncodingNameRegistrar registrar
         const char* name = ucnv_getAvailableName(i);
         UErrorCode error = U_ZERO_ERROR;
         // Try MIME before trying IANA to pick up commonly used names like
-        // 'EUC-JP' instead of horrendeously long names like 
+        // 'EUC-JP' instead of horrendously long names like 
         // 'Extended_UNIX_Code_Packed_Format_for_Japanese'. 
         const char* standardName = ucnv_getStandardName(name, "MIME", &error);
         if (!U_SUCCESS(error) || !standardName) {
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextCodecLatin1.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextCodecLatin1.cpp
index cfdc5b9b4e..0005753f8e 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextCodecLatin1.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextCodecLatin1.cpp
@@ -117,26 +117,76 @@ void TextCodecLatin1::registerCodecs(TextCodecRegistrar registrar)
     registrar("US-ASCII", newStreamingTextDecoderWindowsLatin1, 0);
 }
 
+template<size_t size> struct NonASCIIMask;
+template<> struct NonASCIIMask<4> {
+    static unsigned value() { return 0x80808080U; }
+};
+template<> struct NonASCIIMask<8> {
+    static unsigned long long value() { return 0x8080808080808080ULL; }
+};
+
+template<size_t size> struct UCharByteFiller;
+template<> struct UCharByteFiller<4> {
+    static void copy(UChar* dest, const unsigned char* src)
+    {
+        dest[0] = src[0];
+        dest[1] = src[1];
+        dest[2] = src[2];
+        dest[3] = src[3];
+    }
+};
+template<> struct UCharByteFiller<8> {
+    static void copy(UChar* dest, const unsigned char* src)
+    {
+        dest[0] = src[0];
+        dest[1] = src[1];
+        dest[2] = src[2];
+        dest[3] = src[3];
+        dest[4] = src[4];
+        dest[5] = src[5];
+        dest[6] = src[6];
+        dest[7] = src[7];
+    }
+};
+
 String TextCodecLatin1::decode(const char* bytes, size_t length, bool, bool, bool&)
 {
     UChar* characters;
     String result = String::createUninitialized(length, characters);
 
-    // Convert the string a fast way and simultaneously do an efficient check to see if it's all ASCII.
-    unsigned char ored = 0;
-    for (size_t i = 0; i < length; ++i) {
-        unsigned char c = bytes[i];
-        characters[i] = c;
-        ored |= c;
-    }
-
-    if (!(ored & 0x80))
-        return result;
+    const unsigned char* src = reinterpret_cast<const unsigned char*>(bytes);
+    const unsigned char* end = reinterpret_cast<const unsigned char*>(bytes + length);
+    const unsigned char* alignedEnd = reinterpret_cast<const unsigned char*>(reinterpret_cast<ptrdiff_t>(end) & ~(sizeof(uintptr_t) - 1));
+    UChar* dest = characters;
+
+    while (src < end) {
+        if (*src < 0x80) {
+            // Fast path for values < 0x80 (most Latin-1 text will be ASCII)
+            // Wait until we're at a properly aligned address, then read full CPU words.
+            if (!(reinterpret_cast<ptrdiff_t>(src) & (sizeof(uintptr_t) - 1))) {
+                while (src < alignedEnd) {
+                    uintptr_t chunk = *reinterpret_cast<const uintptr_t*>(src);
+
+                    if (chunk & NonASCIIMask<sizeof(uintptr_t)>::value())
+                        goto useLookupTable;
+
+                    UCharByteFiller<sizeof(uintptr_t)>::copy(dest, src);
+
+                    src += sizeof(uintptr_t);
+                    dest += sizeof(uintptr_t);
+                }
+
+                if (src == end)
+                    break;
+            }
+            *dest = *src;
+        } else {
+useLookupTable:
+            *dest = table[*src];
+        }
 
-    // Convert the slightly slower way when there are non-ASCII characters.
-    for (size_t i = 0; i < length; ++i) {
-        unsigned char c = bytes[i];
-        characters[i] = table[c];
+        ++src;
+        ++dest;
     }
 
     return result;
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.cpp
index c5c8cfdef7..14c935cbef 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.cpp
@@ -32,10 +32,13 @@
 #include "PlatformString.h"
 #include "TextCodec.h"
 #include "TextEncodingRegistry.h"
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
 #include <unicode/unorm.h>
 #elif USE(QT4_UNICODE)
 #include <QString>
+#elif USE(GLIB_UNICODE)
+#include <glib.h>
+#include "GOwnPtr.h"
 #endif
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
@@ -84,7 +87,7 @@ CString TextEncoding::encode(const UChar* characters, size_t length, Unencodable
     if (!length)
         return "";
 
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
     // FIXME: What's the right place to do normalization?
     // It's a little strange to do it inside the encode function.
     // Perhaps normalization should be an explicit step done before calling encode.
@@ -114,7 +117,19 @@ CString TextEncoding::encode(const UChar* characters, size_t length, Unencodable
     QString str(reinterpret_cast<const QChar*>(characters), length);
     str = str.normalized(QString::NormalizationForm_C);
     return newTextCodec(*this)->encode(reinterpret_cast<const UChar *>(str.utf16()), str.length(), handling);
-#elif PLATFORM(WINCE)
+#elif USE(GLIB_UNICODE)
+    GOwnPtr<char> UTF8Source;
+    UTF8Source.set(g_utf16_to_utf8(characters, length, 0, 0, 0));
+
+    GOwnPtr<char> UTF8Normalized;
+    UTF8Normalized.set(g_utf8_normalize(UTF8Source.get(), -1, G_NORMALIZE_NFC));
+
+    long UTF16Length;
+    GOwnPtr<UChar> UTF16Normalized;
+    UTF16Normalized.set(g_utf8_to_utf16(UTF8Normalized.get(), -1, 0, &UTF16Length, 0));
+
+    return newTextCodec(*this)->encode(UTF16Normalized.get(), UTF16Length, handling);
+#elif OS(WINCE)
     // normalization will be done by Windows CE API
     OwnPtr<TextCodec> textCodec = newTextCodec(*this);
     return textCodec.get() ? textCodec->encode(characters, length, handling) : CString();
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingDetectorICU.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingDetectorICU.cpp
index fcb2aa9160..c0d11dec15 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingDetectorICU.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingDetectorICU.cpp
@@ -69,7 +69,7 @@ bool detectTextEncoding(const char* data, size_t len,
     // "the context" (parent-encoding, referrer encoding, etc).
     // 2. 'Emulate' Firefox/IE's non-Universal detectors (e.g.
     // Chinese, Japanese, Russian, Korean and Hebrew) by picking the 
-    // encoding with a highest confidence among the detetctor-specific
+    // encoding with a highest confidence among the detector-specific
     // limited set of candidate encodings.
     // Below is a partial implementation of the first part of what's outlined
     // above.
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp
index d3e2965b95..00ad2c9853 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -39,7 +39,7 @@
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
 
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
 #include "TextCodecICU.h"
 #endif
 #if PLATFORM(MAC)
@@ -48,7 +48,10 @@
 #if PLATFORM(QT)
 #include "qt/TextCodecQt.h"
 #endif
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if USE(GLIB_UNICODE)
+#include "gtk/TextCodecGtk.h"
+#endif
+#if OS(WINCE) && !PLATFORM(QT)
 #include "TextCodecWince.h"
 #endif
 
@@ -217,12 +220,17 @@ static void buildBaseTextCodecMaps()
     TextCodecUserDefined::registerEncodingNames(addToTextEncodingNameMap);
     TextCodecUserDefined::registerCodecs(addToTextCodecMap);
 
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
     TextCodecICU::registerBaseEncodingNames(addToTextEncodingNameMap);
     TextCodecICU::registerBaseCodecs(addToTextCodecMap);
 #endif
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if USE(GLIB_UNICODE)
+    TextCodecGtk::registerBaseEncodingNames(addToTextEncodingNameMap);
+    TextCodecGtk::registerBaseCodecs(addToTextCodecMap);
+#endif
+
+#if OS(WINCE) && !PLATFORM(QT)
     TextCodecWince::registerBaseEncodingNames(addToTextEncodingNameMap);
     TextCodecWince::registerBaseCodecs(addToTextCodecMap);
 #endif
@@ -230,7 +238,7 @@ static void buildBaseTextCodecMaps()
 
 static void extendTextCodecMaps()
 {
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
     TextCodecICU::registerExtendedEncodingNames(addToTextEncodingNameMap);
     TextCodecICU::registerExtendedCodecs(addToTextCodecMap);
 #endif
@@ -245,7 +253,12 @@ static void extendTextCodecMaps()
     TextCodecMac::registerCodecs(addToTextCodecMap);
 #endif
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if USE(GLIB_UNICODE)
+    TextCodecGtk::registerExtendedEncodingNames(addToTextEncodingNameMap);
+    TextCodecGtk::registerExtendedCodecs(addToTextCodecMap);
+#endif
+
+#if OS(WINCE) && !PLATFORM(QT)
     TextCodecWince::registerExtendedEncodingNames(addToTextEncodingNameMap);
     TextCodecWince::registerExtendedCodecs(addToTextCodecMap);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextStream.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextStream.cpp
index eb4bae7b68..baaa8b90ca 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextStream.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextStream.cpp
@@ -90,6 +90,13 @@ TextStream& TextStream::operator<<(const char* string)
     return *this;
 }
 
+TextStream& TextStream::operator<<(void* p)
+{
+    char buffer[printBufferSize];
+    snprintf(buffer, sizeof(buffer) - 1, "%p", p);
+    return *this << buffer;
+}
+
 TextStream& TextStream::operator<<(const String& string)
 {
     append(m_text, string);
@@ -101,7 +108,7 @@ String TextStream::release()
     return String::adopt(m_text);
 }
 
-#if PLATFORM(WIN_OS) && PLATFORM(X86_64) && COMPILER(MSVC)
+#if OS(WINDOWS) && PLATFORM(X86_64) && COMPILER(MSVC)
 TextStream& TextStream::operator<<(__int64 i)
 {
     char buffer[printBufferSize];
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextStream.h b/src/3rdparty/webkit/WebCore/platform/text/TextStream.h
index 71034f3b9d..dfaa0480ff 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextStream.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextStream.h
@@ -43,8 +43,9 @@ public:
     TextStream& operator<<(float);
     TextStream& operator<<(double);
     TextStream& operator<<(const char*);
+    TextStream& operator<<(void*);
     TextStream& operator<<(const String&);
-#if PLATFORM(WIN_OS) && PLATFORM(X86_64) && COMPILER(MSVC)
+#if OS(WINDOWS) && PLATFORM(X86_64) && COMPILER(MSVC)
     TextStream& operator<<(unsigned __int64);
     TextStream& operator<<(__int64);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/text/cf/StringCF.cpp b/src/3rdparty/webkit/WebCore/platform/text/cf/StringCF.cpp
index b770d0ef39..97691e50a3 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/cf/StringCF.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/cf/StringCF.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 #include "PlatformString.h"
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
 
 #include <CoreFoundation/CoreFoundation.h>
 
@@ -52,4 +52,4 @@ CFStringRef String::createCFString() const
 
 }
 
-#endif // PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#endif // PLATFORM(CF)
diff --git a/src/3rdparty/webkit/WebCore/platform/text/cf/StringImplCF.cpp b/src/3rdparty/webkit/WebCore/platform/text/cf/StringImplCF.cpp
index 8a2ae79158..aff45b33db 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/cf/StringImplCF.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/cf/StringImplCF.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 #include "StringImpl.h"
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
 
 #include <CoreFoundation/CoreFoundation.h>
 #include <wtf/MainThread.h>
@@ -159,4 +159,4 @@ CFStringRef StringImpl::createCFString()
 
 }
 
-#endif // PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#endif // PLATFORM(CF)
diff --git a/src/3rdparty/webkit/WebCore/platform/text/mac/TextCodecMac.cpp b/src/3rdparty/webkit/WebCore/platform/text/mac/TextCodecMac.cpp
index a1750c9f59..7a1ad62288 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/mac/TextCodecMac.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/mac/TextCodecMac.cpp
@@ -34,6 +34,7 @@
 #include "ThreadGlobalData.h"
 #include <wtf/Assertions.h>
 #include <wtf/PassOwnPtr.h>
+#include <wtf/RetainPtr.h>
 #include <wtf/Threading.h>
 
 using namespace std;
diff --git a/src/3rdparty/webkit/WebCore/platform/text/qt/TextBoundaries.cpp b/src/3rdparty/webkit/WebCore/platform/text/qt/TextBoundariesQt.cpp
index ffc4c44bd3..a354ca650d 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/qt/TextBoundaries.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/qt/TextBoundariesQt.cpp
@@ -36,7 +36,6 @@
 #include <QDebug>
 #include <stdio.h>
 
-#if QT_VERSION >= 0x040400
 #include <qtextboundaryfinder.h>
 
 namespace WebCore {
@@ -76,48 +75,3 @@ void findWordBoundary(UChar const* buffer, int len, int position, int* start, in
 
 }
 
-#else
-namespace WebCore {
-
-int findNextWordFromIndex(UChar const* buffer, int len, int position, bool forward)
-{
-    QString str(reinterpret_cast<QChar const*>(buffer), len);
-    notImplemented();
-    return 0;
-}
-
-void findWordBoundary(UChar const* buffer, int len, int position, int* start, int* end)
-{
-    QString str(reinterpret_cast<QChar const*>(buffer), len);
-
-    if (position > str.length()) {
-        *start = 0;
-        *end = 0;
-        return;
-    }
-
-    int currentPosition = position - 1;
-    QString foundWord;
-    while (currentPosition >= 0 &&
-           str[currentPosition].isLetter()) {
-        foundWord.prepend(str[currentPosition]);
-        --currentPosition;
-    }
-
-    // currentPosition == 0 means the first char is not letter
-    // currentPosition == -1 means we reached the beginning
-    int startPos = (currentPosition < 0) ? 0 : ++currentPosition;
-    currentPosition = position;
-    if (str[currentPosition].isLetter()) {
-            while (str[currentPosition].isLetter()) {
-                foundWord.append(str[currentPosition]);
-                ++currentPosition;
-            }
-    }
-
-    *start = startPos;
-    *end = currentPosition;
-}
-
-}
-#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/text/qt/TextBreakIteratorQt.cpp b/src/3rdparty/webkit/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
index d80e270b78..5a8a812bfc 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006 Lars Knoll <lars@trolltech.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -23,7 +21,6 @@
 #include "config.h"
 #include "TextBreakIterator.h"
 
-#if QT_VERSION >= 0x040400
 #include <QtCore/qtextboundaryfinder.h>
 #include <qdebug.h>
 
@@ -43,7 +40,7 @@ namespace WebCore {
 
     TextBreakIterator* wordBreakIterator(const UChar* string, int length)
     {
-        if (!string)
+        if (!string || !length)
             return 0;
         if (!iterator)
             iterator = new QTextBoundaryFinder;
@@ -54,7 +51,7 @@ namespace WebCore {
 
     TextBreakIterator* characterBreakIterator(const UChar* string, int length)
     {
-        if (!string)
+        if (!string || !length)
             return 0;
         if (!iterator)
             iterator = new QTextBoundaryFinder;
@@ -71,7 +68,7 @@ namespace WebCore {
     TextBreakIterator* lineBreakIterator(const UChar* string, int length)
     {
         static QTextBoundaryFinder *iterator = 0;
-        if (!string)
+        if (!string || !length)
             return 0;
         if (!iterator)
             iterator = new QTextBoundaryFinder;
@@ -82,7 +79,7 @@ namespace WebCore {
 
     TextBreakIterator* sentenceBreakIterator(const UChar* string, int length)
     {
-        if (!string)
+        if (!string || !length)
             return 0;
         if (!iterator)
             iterator = new QTextBoundaryFinder;
@@ -132,183 +129,3 @@ namespace WebCore {
     }
 
 }
-#else
-#include <qtextlayout.h>
-
-namespace WebCore {
-
-    class TextBreakIterator {
-    public:
-        virtual int first() = 0;
-        virtual int next() = 0;
-        virtual int previous() = 0;
-        inline int following(int pos)
-        {
-            currentPos = pos;
-            return next();
-        }
-        inline int preceding(int pos)
-        {
-            currentPos = pos;
-            return previous();
-        }
-        int currentPos;
-        const UChar *string;
-        int length;
-    };
-
-    class WordBreakIteratorQt : public TextBreakIterator {
-    public:
-        virtual int first();
-        virtual int next();
-        virtual int previous();
-    };
-
-    class CharBreakIteratorQt : public TextBreakIterator {
-    public:
-        virtual int first();
-        virtual int next();
-        virtual int previous();
-        QTextLayout layout;
-    };
-
-    int WordBreakIteratorQt::first()
-    {
-        currentPos = 0;
-        return currentPos;
-    }
-
-    int WordBreakIteratorQt::next()
-    {
-        if (currentPos >= length) {
-            currentPos = -1;
-            return currentPos;
-        }
-        bool haveSpace = false;
-        while (currentPos < length) {
-            if (haveSpace && !QChar(string[currentPos]).isSpace())
-                break;
-            if (QChar(string[currentPos]).isSpace())
-                haveSpace = true;
-            ++currentPos;
-        }
-        return currentPos;
-    }
-
-    int WordBreakIteratorQt::previous()
-    {
-        if (currentPos <= 0) {
-            currentPos = -1;
-            return currentPos;
-        }
-        bool haveSpace = false;
-        while (currentPos > 0) {
-            if (haveSpace && !QChar(string[currentPos]).isSpace())
-                break;
-            if (QChar(string[currentPos]).isSpace())
-                haveSpace = true;
-            --currentPos;
-        }
-        return currentPos;
-    }
-
-    int CharBreakIteratorQt::first()
-    {
-        currentPos = 0;
-        return currentPos;
-    }
-
-    int CharBreakIteratorQt::next()
-    {
-        if (currentPos >= length)
-            return -1;
-        currentPos = layout.nextCursorPosition(currentPos);
-        return currentPos;
-    }
-
-    int CharBreakIteratorQt::previous()
-    {
-        if (currentPos <= 0)
-            return -1;
-        currentPos = layout.previousCursorPosition(currentPos);
-        return currentPos;
-    }
-
-
-TextBreakIterator* wordBreakIterator(const UChar* string, int length)
-{
-    static WordBreakIteratorQt *iterator = 0;
-    if (!iterator)
-        iterator = new WordBreakIteratorQt;
-
-    iterator->string = string;
-    iterator->length = length;
-    iterator->currentPos = 0;
-
-    return iterator;
-}
-
-TextBreakIterator* characterBreakIterator(const UChar* string, int length)
-{
-    static CharBreakIteratorQt *iterator = 0;
-    if (!iterator)
-        iterator = new CharBreakIteratorQt;
-
-    iterator->string = string;
-    iterator->length = length;
-    iterator->currentPos = 0;
-    iterator->layout.setText(QString(reinterpret_cast<const QChar*>(string), length));
-
-    return iterator;
-}
-
-TextBreakIterator* cursorMovementIterator(const UChar* string, int length)
-{
-    return characterBreakIterator(string, length);
-}
-
-TextBreakIterator* lineBreakIterator(const UChar*, int)
-{
-    // not yet implemented
-    return 0;
-}
-
-TextBreakIterator* sentenceBreakIterator(const UChar*, int)
-{
-    // not yet implemented
-    return 0;
-}
-
-int textBreakFirst(TextBreakIterator* bi)
-{
-    return bi->first();
-}
-
-int textBreakNext(TextBreakIterator* bi)
-{
-    return bi->next();
-}
-
-int textBreakPreceding(TextBreakIterator* bi, int pos)
-{
-    return bi->preceding(pos);
-}
-
-int textBreakFollowing(TextBreakIterator* bi, int pos)
-{
-    return bi->following(pos);
-}
-
-int textBreakCurrent(TextBreakIterator* bi)
-{
-    return bi->currentPos;
-}
-
-bool isTextBreak(TextBreakIterator*, int)
-{
-    return true;
-}
-
-}
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp b/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp
index b3f75ccd20..21e6e12b69 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp
@@ -97,7 +97,7 @@ String TextCodecQt::decode(const char* bytes, size_t length, bool flush, bool /*
     // We chop input buffer to smaller buffers to avoid excessive memory consumption
     // when the input buffer is big.  This helps reduce peak memory consumption in
     // mobile devices where system RAM is limited.
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
     static const int MaxInputChunkSize = 32 * 1024;
 #else
     static const int MaxInputChunkSize = 1024 * 1024;
diff --git a/src/3rdparty/webkit/WebCore/page/android/DragControllerAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/text/wince/TextBoundariesWince.cpp
index 19d02c621f..df6f7579d8 100644
--- a/src/3rdparty/webkit/WebCore/page/android/DragControllerAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/wince/TextBoundariesWince.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright 2009, The Android Open Source Project
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006 Zack Rusin <zack@kde.org>
+ * Copyright (C) 2007-2009 Torch Mobile, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -21,38 +21,55 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
-#include "DragController.h"
+#include "TextBoundaries.h"
 
-#include "DragData.h"
 #include "NotImplemented.h"
+#include "PlatformString.h"
+
+using namespace WTF::Unicode;
 
 namespace WebCore {
 
-bool DragController::isCopyKeyDown()
+int findNextWordFromIndex(const UChar * buffer, int len, int position, bool forward)
 {
-    return false;
+    notImplemented();
+    return 0;
 }
-    
-DragOperation DragController::dragOperation(DragData* dragData)
+
+void findWordBoundary(const UChar * buffer, int len, int position, int* start, int* end)
 {
-    // FIXME: This logic is incomplete
-    notImplemented();
-    if (dragData->containsURL())
-        return DragOperationCopy;
+    if (position > len) {
+        *start = 0;
+        *end = 0;
+        return;
+    }
+
+    String str(buffer, len);
 
-    return DragOperationNone;
-} 
+    int currentPosition = position - 1;
+    String foundWord;
+    while (currentPosition >= 0 && isLetter(str[currentPosition])) {
+        UChar c = str[currentPosition];
+        foundWord.insert(&c, 1, 0);
+        --currentPosition;
+    }
 
-const float DragController::DragImageAlpha = 1.0f;
-static IntSize dummy;
-const IntSize& DragController::maxDragImageSize() { return dummy; }
-const int DragController::DragIconRightInset = 0;
-const int DragController::DragIconBottomInset = 0;
-const int DragController::LinkDragBorderInset = 0;
-const int DragController::MaxOriginalImageArea = 0;
+    // currentPosition == 0 means the first char is not letter
+    // currentPosition == -1 means we reached the beginning
+    int startPos = (currentPosition < 0) ? 0 : ++currentPosition;
+    currentPosition = position;
+    while (isLetter(str[currentPosition])) {
+        foundWord.append(str[currentPosition]);
+        ++currentPosition;
+    }
 
-}  // namespace WebCore
+    *start = startPos;
+    *end = currentPosition;
+}
+
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/text/wince/TextBreakIteratorWince.cpp b/src/3rdparty/webkit/WebCore/platform/text/wince/TextBreakIteratorWince.cpp
new file mode 100644
index 0000000000..7f46e4f4fe
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/text/wince/TextBreakIteratorWince.cpp
@@ -0,0 +1,312 @@
+/*
+ * Copyright (C) 2006 Lars Knoll <lars@trolltech.com>
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ */
+
+#include "config.h"
+#include "TextBreakIterator.h"
+
+#include "PlatformString.h"
+#include <wtf/StdLibExtras.h>
+#include <wtf/unicode/Unicode.h>
+
+using namespace WTF::Unicode;
+
+namespace WebCore {
+
+// Hack, not entirely correct
+static inline bool isCharStop(UChar c)
+{
+    CharCategory charCategory = category(c);
+    return charCategory != Mark_NonSpacing && (charCategory != Other_Surrogate || (c < 0xd800 || c >= 0xdc00));
+}
+
+static inline bool isLineStop(UChar c)
+{
+    return category(c) != Separator_Line;
+}
+
+static inline bool isSentenceStop(UChar c)
+{
+    return isPunct(c);
+}
+
+class TextBreakIterator {
+public:
+    void reset(const UChar* str, int len)
+    {
+        string = str;
+        length = len;
+        currentPos = 0;
+    }
+    virtual int first() = 0;
+    virtual int next() = 0;
+    virtual int previous() = 0;
+    int following(int position)
+    {
+        currentPos = position;
+        return next();
+    }
+    int preceding(int position)
+    {
+        currentPos = position;
+        return previous();
+    }
+
+    int currentPos;
+    const UChar* string;
+    int length;
+};
+
+struct WordBreakIterator: TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+struct CharBreakIterator: TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+struct LineBreakIterator: TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+struct SentenceBreakIterator : TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+int WordBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int WordBreakIterator::next()
+{
+    if (currentPos == length) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos < length) {
+        if (haveSpace && !isSpace(string[currentPos]))
+            break;
+        if (isSpace(string[currentPos]))
+            haveSpace = true;
+        ++currentPos;
+    }
+    return currentPos;
+}
+
+int WordBreakIterator::previous()
+{
+    if (!currentPos) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos > 0) {
+        if (haveSpace && !isSpace(string[currentPos]))
+            break;
+        if (isSpace(string[currentPos]))
+            haveSpace = true;
+        --currentPos;
+    }
+    return currentPos;
+}
+
+int CharBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int CharBreakIterator::next()
+{
+    if (currentPos >= length)
+        return -1;
+    ++currentPos;
+    while (currentPos < length && !isCharStop(string[currentPos]))
+        ++currentPos;
+    return currentPos;
+}
+
+int CharBreakIterator::previous()
+{
+    if (currentPos <= 0)
+        return -1;
+    if (currentPos > length)
+        currentPos = length;
+    --currentPos;
+    while (currentPos > 0 && !isCharStop(string[currentPos]))
+        --currentPos;
+    return currentPos;
+}
+
+int LineBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int LineBreakIterator::next()
+{
+    if (currentPos == length) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos < length) {
+        if (haveSpace && !isLineStop(string[currentPos]))
+            break;
+        if (isLineStop(string[currentPos]))
+            haveSpace = true;
+        ++currentPos;
+    }
+    return currentPos;
+}
+
+int LineBreakIterator::previous()
+{
+    if (!currentPos) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos > 0) {
+        if (haveSpace && !isLineStop(string[currentPos]))
+            break;
+        if (isLineStop(string[currentPos]))
+            haveSpace = true;
+        --currentPos;
+    }
+    return currentPos;
+}
+
+int SentenceBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int SentenceBreakIterator::next()
+{
+    if (currentPos == length) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos < length) {
+        if (haveSpace && !isSentenceStop(string[currentPos]))
+            break;
+        if (isSentenceStop(string[currentPos]))
+            haveSpace = true;
+        ++currentPos;
+    }
+    return currentPos;
+}
+
+int SentenceBreakIterator::previous()
+{
+    if (!currentPos) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos > 0) {
+        if (haveSpace && !isSentenceStop(string[currentPos]))
+            break;
+        if (isSentenceStop(string[currentPos]))
+            haveSpace = true;
+        --currentPos;
+    }
+    return currentPos;
+}
+
+TextBreakIterator* wordBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(WordBreakIterator, iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+TextBreakIterator* characterBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(CharBreakIterator, iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+TextBreakIterator* lineBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(LineBreakIterator , iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+TextBreakIterator* sentenceBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(SentenceBreakIterator, iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+int textBreakFirst(TextBreakIterator* breakIterator)
+{
+    return breakIterator->first();
+}
+
+int textBreakNext(TextBreakIterator* breakIterator)
+{
+    return breakIterator->next();
+}
+
+int textBreakPreceding(TextBreakIterator* breakIterator, int position)
+{
+    return breakIterator->preceding(position);
+}
+
+int textBreakFollowing(TextBreakIterator* breakIterator, int position)
+{
+    return breakIterator->following(position);
+}
+
+int textBreakCurrent(TextBreakIterator* breakIterator)
+{
+    return breakIterator->currentPos;
+}
+
+bool isTextBreak(TextBreakIterator*, int)
+{
+    return true;
+}
+
+TextBreakIterator* cursorMovementIterator(const UChar* string, int length)
+{
+    return characterBreakIterator(string, length);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/win/SystemTimeWin.cpp b/src/3rdparty/webkit/WebCore/platform/win/SystemTimeWin.cpp
index 6ab4c27cfd..8c25c3291a 100644
--- a/src/3rdparty/webkit/WebCore/platform/win/SystemTimeWin.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/win/SystemTimeWin.cpp
@@ -37,7 +37,7 @@ namespace WebCore {
 
 float userIdleTime()
 {
-#if !PLATFORM(WINCE)
+#if !OS(WINCE)
     LASTINPUTINFO lastInputInfo = {0};
     lastInputInfo.cbSize = sizeof(LASTINPUTINFO);
     if (::GetLastInputInfo(&lastInputInfo))
diff --git a/src/3rdparty/webkit/WebCore/platform/win/WebCoreInstanceHandle.cpp b/src/3rdparty/webkit/WebCore/platform/win/WebCoreInstanceHandle.cpp
new file mode 100644
index 0000000000..dd21b2d61c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/win/WebCoreInstanceHandle.cpp
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebCoreInstanceHandle.h"
+
+namespace WebCore {
+
+HINSTANCE s_instanceHandle;
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/win/WebCoreInstanceHandle.h b/src/3rdparty/webkit/WebCore/platform/win/WebCoreInstanceHandle.h
new file mode 100644
index 0000000000..52cd985ac1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/win/WebCoreInstanceHandle.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCoreInstanceHandle_h
+#define WebCoreInstanceHandle_h
+
+typedef struct HINSTANCE__* HINSTANCE;
+
+namespace WebCore {
+
+    // The global DLL or application instance used for all windows.
+    extern HINSTANCE s_instanceHandle;
+
+    static void setInstanceHandle(HINSTANCE instanceHandle) { s_instanceHandle = instanceHandle; }
+    static HINSTANCE instanceHandle() { return s_instanceHandle; }
+    
+}
+
+#endif // WebCoreInstanceHandle_h
diff --git a/src/3rdparty/webkit/WebCore/plugins/MimeType.cpp b/src/3rdparty/webkit/WebCore/plugins/MimeType.cpp
index c4b051c180..954715ae41 100644
--- a/src/3rdparty/webkit/WebCore/plugins/MimeType.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/MimeType.cpp
@@ -20,6 +20,7 @@
 #include "MimeType.h"
 
 #include "Frame.h"
+#include "FrameLoaderClient.h"
 #include "Page.h"
 #include "Plugin.h"
 #include "PluginData.h"
@@ -55,7 +56,7 @@ const String &MimeType::description() const
 PassRefPtr<Plugin> MimeType::enabledPlugin() const
 {
     const Page* p = m_pluginData->page();
-    if (!p || !p->settings()->arePluginsEnabled())
+    if (!p || !p->mainFrame()->loader()->allowPlugins(NotAboutToInstantiatePlugin))
         return 0;
 
     const PluginInfo *info = m_pluginData->mimes()[m_index]->plugin;
diff --git a/src/3rdparty/webkit/WebCore/plugins/MimeType.idl b/src/3rdparty/webkit/WebCore/plugins/MimeType.idl
index 71fcca204c..9d84eeb31e 100644
--- a/src/3rdparty/webkit/WebCore/plugins/MimeType.idl
+++ b/src/3rdparty/webkit/WebCore/plugins/MimeType.idl
@@ -20,9 +20,7 @@
 
 module window {
 
-    interface [
-        GenerateConstructor
-    ] MimeType {
+    interface MimeType {
         readonly attribute DOMString type;
         readonly attribute DOMString suffixes;
         readonly attribute DOMString description;
diff --git a/src/3rdparty/webkit/WebCore/plugins/MimeTypeArray.idl b/src/3rdparty/webkit/WebCore/plugins/MimeTypeArray.idl
index 5316d567fc..ecbdc29174 100644
--- a/src/3rdparty/webkit/WebCore/plugins/MimeTypeArray.idl
+++ b/src/3rdparty/webkit/WebCore/plugins/MimeTypeArray.idl
@@ -21,7 +21,6 @@
 module window {
 
     interface [
-        GenerateConstructor,
         HasNameGetter,
         HasIndexGetter
     ] MimeTypeArray {
diff --git a/src/3rdparty/webkit/WebCore/plugins/Plugin.idl b/src/3rdparty/webkit/WebCore/plugins/Plugin.idl
index 8ecef36e6a..b418989bc2 100644
--- a/src/3rdparty/webkit/WebCore/plugins/Plugin.idl
+++ b/src/3rdparty/webkit/WebCore/plugins/Plugin.idl
@@ -21,7 +21,6 @@
 module window {
 
     interface [
-        GenerateConstructor,
         HasNameGetter,
         HasIndexGetter
     ] Plugin {
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginArray.idl b/src/3rdparty/webkit/WebCore/plugins/PluginArray.idl
index 4a55c562e6..d4c10ac65d 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginArray.idl
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginArray.idl
@@ -21,7 +21,6 @@
 module window {
 
     interface [
-        GenerateConstructor,
         HasNameGetter, 
         HasIndexGetter
     ] PluginArray {
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginData.h b/src/3rdparty/webkit/WebCore/plugins/PluginData.h
index b2866bff8c..6960a25f43 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginData.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginData.h
@@ -29,14 +29,14 @@ namespace WebCore {
     class Page;
     struct PluginInfo;
 
-    struct MimeClassInfo {
+    struct MimeClassInfo : Noncopyable {
         String type;
         String desc;
         String suffixes;
         PluginInfo* plugin;
     };
 
-    struct PluginInfo {
+    struct PluginInfo : Noncopyable {
         String name;
         String file;
         String desc;
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp
index ea8e4adeae..b09658f692 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp
@@ -257,8 +257,9 @@ PluginPackage* PluginDatabase::findPlugin(const KURL& url, String& mimeType)
             if (extensionPos != -1) {
                 String extension = filename.substring(extensionPos + 1);
 
-                mimeType = MIMETypeForExtension(extension);
-                plugin = pluginForMIMEType(mimeType);
+                String mimeTypeForExtension = MIMETypeForExtension(extension);
+                if ((plugin = pluginForMIMEType(mimeTypeForExtension)))
+                    mimeType = mimeTypeForExtension;
             }
         }
     }
@@ -320,7 +321,7 @@ void PluginDatabase::clear()
     m_preferredPlugins.clear();
 }
 
-#if (!PLATFORM(WINCE)) && (!PLATFORM(SYMBIAN)) && (!PLATFORM(WIN_OS) || PLATFORM(WX) || !ENABLE(NETSCAPE_PLUGIN_API))
+#if (!OS(WINCE)) && (!OS(SYMBIAN)) && (!OS(WINDOWS) || !ENABLE(NETSCAPE_PLUGIN_API))
 // For Safari/Win the following three methods are implemented
 // in PluginDatabaseWin.cpp, but if we can use WebCore constructs
 // for the logic we should perhaps move it here under XP_WIN?
@@ -428,6 +429,6 @@ void PluginDatabase::getPluginPathsInDirectories(HashSet<String>& paths) const
     }
 }
 
-#endif // !PLATFORM(SYMBIAN) && !PLATFORM(WIN_OS)
+#endif // !OS(SYMBIAN) && !OS(WINDOWS)
 
 }
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.h b/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.h
index fdc933067f..e134b946cd 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.h
@@ -45,7 +45,7 @@ namespace WebCore {
 
     typedef HashSet<RefPtr<PluginPackage>, PluginPackageHash> PluginSet;
 
-    class PluginDatabase {
+    class PluginDatabase : public Noncopyable {
     public:
         PluginDatabase();
 
@@ -83,6 +83,8 @@ namespace WebCore {
         static Vector<String> defaultPluginDirectories();
         Vector<String> pluginDirectories() const { return m_pluginDirectories; }
 
+        String MIMETypeForExtension(const String& extension) const;
+
     private:
         void getPluginPathsInDirectories(HashSet<String>&) const;
         void getDeletedPlugins(PluginSet&) const;
@@ -91,8 +93,6 @@ namespace WebCore {
         bool add(PassRefPtr<PluginPackage>);
         void remove(PluginPackage*);
 
-        String MIMETypeForExtension(const String& extension) const;
-
         Vector<String> m_pluginDirectories;
         HashSet<String> m_registeredMIMETypes;
         PluginSet m_plugins;
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginInfoStore.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginInfoStore.cpp
index 732a1e1f11..88dc7eed79 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginInfoStore.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginInfoStore.cpp
@@ -27,6 +27,7 @@
 #include "PluginInfoStore.h"
 
 #include "KURL.h"
+#include "Page.h"
 #include "PluginData.h"
 #include "PluginDatabase.h"
 #include "PluginPackage.h"
@@ -93,11 +94,7 @@ bool PluginInfoStore::supportsMIMEType(const WebCore::String& mimeType)
 
 void refreshPlugins(bool reloadOpenPages)
 {
-    PluginDatabase::installedPlugins()->refresh();
-
-    if (reloadOpenPages) {
-        // FIXME: reload open pages
-    }
+    Page::refreshPlugins(reloadOpenPages);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginMainThreadScheduler.h b/src/3rdparty/webkit/WebCore/plugins/PluginMainThreadScheduler.h
index 8872d56aee..610e89c7f9 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginMainThreadScheduler.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginMainThreadScheduler.h
@@ -36,7 +36,7 @@ typedef NPP_t* NPP;
 
 namespace WebCore {
 
-class PluginMainThreadScheduler {
+class PluginMainThreadScheduler : public Noncopyable {
 public:
     typedef void MainThreadFunction(void*);
 
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
index 8f2dfa990b..ad03ecd8d3 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
@@ -113,7 +113,7 @@ PluginPackage::PluginPackage(const String& path, const time_t& lastModified)
     m_parentDirectory = m_path.left(m_path.length() - m_fileName.length() - 1);
 }
 
-#if !PLATFORM(SYMBIAN)
+#if !OS(SYMBIAN)
 void PluginPackage::unload()
 {
     if (!m_isLoaded)
@@ -126,7 +126,7 @@ void PluginPackage::unload()
 
     unloadWithoutShutdown();
 }
-#endif //!PLATFORM(SYMBIAN)
+#endif // !OS(SYMBIAN)
 
 void PluginPackage::unloadWithoutShutdown()
 {
@@ -198,7 +198,7 @@ void PluginPackage::determineQuirks(const String& mimeType)
 }
 #endif
 
-#if !PLATFORM(WIN_OS)
+#if !OS(WINDOWS)
 void PluginPackage::determineModuleVersionFromDescription()
 {
     // It's a bit lame to detect the plugin version by parsing it
@@ -253,7 +253,7 @@ void PluginPackage::initializeBrowserFuncs()
 {
     memset(&m_browserFuncs, 0, sizeof(m_browserFuncs));
     m_browserFuncs.size = sizeof(m_browserFuncs);
-    m_browserFuncs.version = NP_VERSION_MINOR;
+    m_browserFuncs.version = NPVersion();
 
     m_browserFuncs.geturl = NPN_GetURL;
     m_browserFuncs.posturl = NPN_PostURL;
@@ -326,7 +326,7 @@ int PluginPackage::compareFileVersion(const PlatformModuleVersion& compareVersio
     // return -1, 0, or 1 if plug-in version is less than, equal to, or greater than
     // the passed version
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
     if (m_moduleVersion.mostSig != compareVersion.mostSig)
         return m_moduleVersion.mostSig > compareVersion.mostSig ? 1 : -1;
     if (m_moduleVersion.leastSig != compareVersion.leastSig)
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h
index d409ab60b8..aa2d272fd8 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h
@@ -36,7 +36,7 @@
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
 
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
 class QPluginLoader;
 class NPInterface;
 #endif
@@ -55,6 +55,7 @@ namespace WebCore {
         const String& path() const { return m_path; }
         const String& fileName() const { return m_fileName; }
         const String& parentDirectory() const { return m_parentDirectory; }
+        uint16 NPVersion() const;
         time_t lastModified() const { return m_lastModified; }
 
         const MIMEToDescriptionsMap& mimeToDescriptions() const { return m_mimeToDescriptions; }
@@ -75,17 +76,17 @@ namespace WebCore {
         int compare(const PluginPackage&) const;
         PluginQuirkSet quirks() const { return m_quirks; }
         const PlatformModuleVersion& version() const { return m_moduleVersion; }
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
         NPInterface* npInterface() const { return m_npInterface; }
-#endif // PLATFORM(SYMBIAN)
+#endif // OS(SYMBIAN)
 
     private:
         PluginPackage(const String& path, const time_t& lastModified);
 
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
         NPInterface* m_npInterface;
         QPluginLoader* m_pluginLoader;
-#endif // PLATFORM(SYMBIAN)
+#endif // OS(SYMBIAN)
         bool fetchInfo();
         bool isPluginBlacklisted();
         void determineQuirks(const String& mimeType);
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginStream.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginStream.cpp
index cd9f83dbd8..bf35ba4389 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginStream.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginStream.cpp
@@ -84,7 +84,7 @@ PluginStream::~PluginStream()
     ASSERT(m_streamState != StreamStarted);
     ASSERT(!m_loader);
 
-    free((char*)m_stream.url);
+    fastFree((char*)m_stream.url);
 
     streams().remove(&m_stream);
 }
@@ -120,6 +120,8 @@ void PluginStream::stop()
         m_loader->cancel();
         m_loader = 0;
     }
+
+    m_client = 0;
 }
 
 void PluginStream::startStream()
@@ -131,9 +133,9 @@ void PluginStream::startStream()
     // Some plugins (Flash) expect that javascript URLs are passed back decoded as this is the
     // format used when requesting the URL.
     if (protocolIsJavaScript(responseURL))
-        m_stream.url = strdup(decodeURLEscapeSequences(responseURL.string()).utf8().data());
+        m_stream.url = fastStrDup(decodeURLEscapeSequences(responseURL.string()).utf8().data());
     else
-        m_stream.url = strdup(responseURL.string().utf8().data());
+        m_stream.url = fastStrDup(responseURL.string().utf8().data());
 
     CString mimeTypeStr = m_resourceResponse.mimeType().utf8();
 
@@ -305,7 +307,7 @@ void PluginStream::destroyStream()
 
     m_streamState = StreamStopped;
 
-    if (!m_loadManually)
+    if (!m_loadManually && m_client)
         m_client->streamDidFinishLoading(this);
 
     if (!m_path.isNull()) {
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
index d69f8a731d..51a43ac51d 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,48 +27,50 @@
 #include "config.h"
 #include "PluginView.h"
 
+#include "Bridge.h"
+#include "Chrome.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
+#include "FocusController.h"
+#include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderClient.h"
 #include "FrameTree.h"
-#include "Frame.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
-#include "Image.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
+#include "Image.h"
+#include "JSDOMBinding.h"
 #include "JSDOMWindow.h"
 #include "KeyboardEvent.h"
 #include "MIMETypeRegistry.h"
 #include "MouseEvent.h"
 #include "NotImplemented.h"
 #include "Page.h"
-#include "FocusController.h"
 #include "PlatformMouseEvent.h"
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
-#include "PluginMessageThrottlerWin.h"
-#endif
-#include "PluginPackage.h"
-#include "JSDOMBinding.h"
-#include "ScriptController.h"
-#include "ScriptValue.h"
-#include "SecurityOrigin.h"
 #include "PluginDatabase.h"
 #include "PluginDebug.h"
 #include "PluginMainThreadScheduler.h"
 #include "PluginPackage.h"
 #include "RenderBox.h"
 #include "RenderObject.h"
+#include "ScriptController.h"
+#include "ScriptValue.h"
+#include "SecurityOrigin.h"
+#include "Settings.h"
 #include "c_instance.h"
 #include "npruntime_impl.h"
 #include "runtime_root.h"
-#include "Settings.h"
-#include "runtime.h"
 #include <runtime/JSLock.h>
 #include <runtime/JSValue.h>
 #include <wtf/ASCIICType.h>
 
+#if OS(WINDOWS) && ENABLE(NETSCAPE_PLUGIN_API)
+#include "PluginMessageThrottlerWin.h"
+#endif
+
 using JSC::ExecState;
 using JSC::JSLock;
 using JSC::JSObject;
@@ -85,6 +87,14 @@ using namespace HTMLNames;
 
 static int s_callingPlugin;
 
+typedef HashMap<NPP, PluginView*> InstanceMap;
+
+static InstanceMap& instanceMap()
+{
+    static InstanceMap& map = *new InstanceMap;
+    return map;
+}
+
 static String scriptStringIfJavaScriptURL(const KURL& url)
 {
     if (!protocolIsJavaScript(url))
@@ -124,10 +134,10 @@ void PluginView::setFrameRect(const IntRect& rect)
 
     updatePluginWidget();
 
-#if PLATFORM(WIN_OS) || PLATFORM(SYMBIAN)
+#if OS(WINDOWS) || OS(SYMBIAN)
     // On Windows and Symbian, always call plugin to change geometry.
     setNPWindowRect(rect);
-#elif XP_UNIX
+#elif defined(XP_UNIX)
     // On Unix, multiple calls to setNPWindow() in windowed mode causes Flash to crash
     if (m_mode == NP_FULL || !m_isWindowed)
         setNPWindowRect(rect);
@@ -144,11 +154,14 @@ void PluginView::handleEvent(Event* event)
     if (!m_plugin || m_isWindowed)
         return;
 
+    // Protect the plug-in from deletion while dispatching the event.
+    RefPtr<PluginView> protect(this);
+
     if (event->isMouseEvent())
         handleMouseEvent(static_cast<MouseEvent*>(event));
     else if (event->isKeyboardEvent())
         handleKeyboardEvent(static_cast<KeyboardEvent*>(event));
-#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
+#if defined(XP_UNIX) && ENABLE(NETSCAPE_PLUGIN_API)
     else if (event->type() == eventNames().DOMFocusOutEvent)
         handleFocusOutEvent();
     else if (event->type() == eventNames().DOMFocusInEvent)
@@ -189,8 +202,11 @@ bool PluginView::startOrAddToUnstartedList()
     if (!m_parentFrame->page())
         return false;
 
-    if (!m_parentFrame->page()->canStartPlugins()) {
-        m_parentFrame->page()->addUnstartedPlugin(this);
+    // We only delay starting the plug-in if we're going to kick off the load
+    // ourselves. Otherwise, the loader will try to deliver data before we've
+    // started the plug-in.
+    if (!m_loadManually && !m_parentFrame->page()->canStartMedia()) {
+        m_parentFrame->page()->addMediaCanStartListener(this);
         m_isWaitingToStart = true;
         return true;
     }
@@ -250,10 +266,21 @@ bool PluginView::start()
     return true;
 }
 
+void PluginView::mediaCanStart()
+{
+    ASSERT(!m_isStarted);
+    if (!start())
+        parentFrame()->loader()->client()->dispatchDidFailToStartPlugin(this);
+}
+
 PluginView::~PluginView()
 {
     LOG(Plugins, "PluginView::~PluginView()");
 
+    ASSERT(!m_lifeSupportTimer.isActive());
+
+    instanceMap().remove(m_instance);
+
     removeFromUnstartedListIfNecessary();
 
     stop();
@@ -279,7 +306,7 @@ void PluginView::removeFromUnstartedListIfNecessary()
     if (!m_parentFrame->page())
         return;
 
-    m_parentFrame->page()->removeUnstartedPlugin(this);
+    m_parentFrame->page()->removeMediaCanStartListener(this);
 }
 
 void PluginView::stop()
@@ -306,11 +333,10 @@ void PluginView::stop()
     JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
-#if !PLATFORM(WX) // FIXME: Revisit this when implementing plugins for wx
 #ifdef XP_WIN
     // Unsubclass the window
     if (m_isWindowed) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
         WNDPROC currentWndProc = (WNDPROC)GetWindowLong(platformPluginWidget(), GWL_WNDPROC);
 
         if (currentWndProc == PluginViewWndProc)
@@ -323,7 +349,6 @@ void PluginView::stop()
 #endif
     }
 #endif // XP_WIN
-#endif // !PLATFORM(WX)
 #endif // ENABLE(NETSCAPE_PLUGIN_API)
 
 #if !defined(XP_MACOSX)
@@ -421,7 +446,7 @@ void PluginView::performRequest(PluginRequest* request)
         // if this is not a targeted request, create a stream for it. otherwise,
         // just pass it off to the loader
         if (targetFrameName.isEmpty()) {
-            RefPtr<PluginStream> stream = PluginStream::create(this, m_parentFrame, request->frameLoadRequest().resourceRequest(), request->sendNotification(), request->notifyData(), plugin()->pluginFuncs(), instance(), m_plugin->quirks());
+            RefPtr<PluginStream> stream = PluginStream::create(this, m_parentFrame.get(), request->frameLoadRequest().resourceRequest(), request->sendNotification(), request->notifyData(), plugin()->pluginFuncs(), instance(), m_plugin->quirks());
             m_streams.add(stream);
             stream->start();
         } else {
@@ -459,7 +484,7 @@ void PluginView::performRequest(PluginRequest* request)
         if (getString(parentFrame->script(), result, resultString))
             cstr = resultString.utf8();
 
-        RefPtr<PluginStream> stream = PluginStream::create(this, m_parentFrame, request->frameLoadRequest().resourceRequest(), request->sendNotification(), request->notifyData(), plugin()->pluginFuncs(), instance(), m_plugin->quirks());
+        RefPtr<PluginStream> stream = PluginStream::create(this, m_parentFrame.get(), request->frameLoadRequest().resourceRequest(), request->sendNotification(), request->notifyData(), plugin()->pluginFuncs(), instance(), m_plugin->quirks());
         m_streams.add(stream);
         stream->sendJavaScriptStream(requestURL, cstr);
     }
@@ -508,12 +533,10 @@ NPError PluginView::load(const FrameLoadRequest& frameLoadRequest, bool sendNoti
     String jsString = scriptStringIfJavaScriptURL(url);
 
     if (!jsString.isNull()) {
-        Settings* settings = m_parentFrame->settings();
-
         // Return NPERR_GENERIC_ERROR if JS is disabled. This is what Mozilla does.
-        if (!settings || !settings->isJavaScriptEnabled())
+        if (!m_parentFrame->script()->canExecuteScripts(NotAboutToExecuteScript))
             return NPERR_GENERIC_ERROR;
-        
+
         // For security reasons, only allow JS requests to be made on the frame that contains the plug-in.
         if (!targetFrameName.isNull() && m_parentFrame->tree()->find(targetFrameName) != m_parentFrame)
             return NPERR_INVALID_PARAM;
@@ -598,7 +621,7 @@ NPError PluginView::destroyStream(NPStream* stream, NPReason reason)
 void PluginView::status(const char* message)
 {
     if (Page* page = m_parentFrame->page())
-        page->chrome()->setStatusbarText(m_parentFrame, String(message));
+        page->chrome()->setStatusbarText(m_parentFrame.get(), String(message));
 }
 
 NPError PluginView::setValue(NPPVariable variable, void* value)
@@ -790,6 +813,8 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     , m_requestTimer(this, &PluginView::requestTimerFired)
     , m_invalidateTimer(this, &PluginView::invalidateTimerFired)
     , m_popPopupsStateTimer(this, &PluginView::popPopupsStateTimerFired)
+    , m_lifeSupportTimer(this, &PluginView::lifeSupportTimerFired)
+    , m_mode(loadManually ? NP_FULL : NP_EMBED)
     , m_paramNames(0)
     , m_paramValues(0)
     , m_mimeType(mimeType)
@@ -801,25 +826,27 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     , m_isTransparent(false)
     , m_haveInitialized(false)
     , m_isWaitingToStart(false)
-#if defined(XP_UNIX) || defined(Q_WS_X11)
+#if defined(XP_UNIX)
     , m_needsXEmbed(false)
 #endif
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if OS(WINDOWS) && ENABLE(NETSCAPE_PLUGIN_API)
     , m_pluginWndProc(0)
     , m_lastMessage(0)
     , m_isCallingPluginWndProc(false)
     , m_wmPrintHDC(0)
     , m_haveUpdatedPluginWidget(false)
 #endif
-#if (PLATFORM(QT) && PLATFORM(WIN_OS)) || defined(XP_MACOSX)
+#if (PLATFORM(QT) && OS(WINDOWS)) || defined(XP_MACOSX)
     , m_window(0)
 #endif
 #if defined(XP_MACOSX)
     , m_drawingModel(NPDrawingModel(-1))
     , m_eventModel(NPEventModel(-1))
+    , m_contextRef(0)
+    , m_fakeWindow(0)
 #endif
-#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
-    , m_hasPendingGeometryChange(false)
+#if defined(XP_UNIX) && ENABLE(NETSCAPE_PLUGIN_API)
+    , m_hasPendingGeometryChange(true)
     , m_drawable(0)
     , m_visual(0)
     , m_colormap(0)
@@ -840,6 +867,8 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     m_instance->ndata = this;
     m_instance->pdata = 0;
 
+    instanceMap().add(m_instance, this);
+
     setParameters(paramNames, paramValues);
 
     memset(&m_npWindow, 0, sizeof(m_npWindow));
@@ -847,8 +876,6 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     memset(&m_npCgContext, 0, sizeof(m_npCgContext));
 #endif
 
-    m_mode = m_loadManually ? NP_FULL : NP_EMBED;
-
     resize(size);
 }
 
@@ -868,7 +895,7 @@ void PluginView::didReceiveResponse(const ResourceResponse& response)
     ASSERT(m_loadManually);
     ASSERT(!m_manualStream);
 
-    m_manualStream = PluginStream::create(this, m_parentFrame, m_parentFrame->loader()->activeDocumentLoader()->request(), false, 0, plugin()->pluginFuncs(), instance(), m_plugin->quirks());
+    m_manualStream = PluginStream::create(this, m_parentFrame.get(), m_parentFrame->loader()->activeDocumentLoader()->request(), false, 0, plugin()->pluginFuncs(), instance(), m_plugin->quirks());
     m_manualStream->setLoadManually(true);
 
     m_manualStream->didReceiveResponse(0, response);
@@ -1198,7 +1225,7 @@ void PluginView::paintMissingPluginIcon(GraphicsContext* context, const IntRect&
 
     context->save();
     context->clip(windowClipRect());
-    context->drawImage(nullPluginImage.get(), imageRect.location());
+    context->drawImage(nullPluginImage.get(), DeviceColorSpace, imageRect.location());
     context->restore();
 }
 
@@ -1209,7 +1236,7 @@ static const char* MozillaUserAgent = "Mozilla/5.0 ("
         "Windows; U; Windows NT 5.1;"
 #elif defined(XP_UNIX)
 // The Gtk port uses X11 plugins in Mac.
-#if PLATFORM(DARWIN) && PLATFORM(GTK)
+#if OS(DARWIN) && PLATFORM(GTK)
     "X11; U; Intel Mac OS X;"
 #else
     "X11; U; Linux i686;"
@@ -1241,4 +1268,122 @@ Node* PluginView::node() const
     return m_element;
 }
 
+String PluginView::pluginName() const
+{
+    return m_plugin->name();
+}
+
+void PluginView::lifeSupportTimerFired(Timer<PluginView>*)
+{
+    deref();
+}
+
+void PluginView::keepAlive()
+{
+    if (m_lifeSupportTimer.isActive())
+        return;
+
+    ref();
+    m_lifeSupportTimer.startOneShot(0);
+}
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+void PluginView::keepAlive(NPP instance)
+{
+    PluginView* view = instanceMap().get(instance);
+    if (!view)
+        return;
+
+    view->keepAlive();
+}
+#endif
+
+NPError PluginView::getValueStatic(NPNVariable variable, void* value)
+{
+    LOG(Plugins, "PluginView::getValueStatic(%s)", prettyNameForNPNVariable(variable).data());
+
+    NPError result;
+    if (platformGetValueStatic(variable, value, &result))
+        return result;
+
+    return NPERR_GENERIC_ERROR;
+}
+
+NPError PluginView::getValue(NPNVariable variable, void* value)
+{
+    LOG(Plugins, "PluginView::getValue(%s)", prettyNameForNPNVariable(variable).data());
+
+    NPError result;
+    if (platformGetValue(variable, value, &result))
+        return result;
+
+    if (platformGetValueStatic(variable, value, &result))
+        return result;
+
+    switch (variable) {
+#if ENABLE(NETSCAPE_PLUGIN_API)
+    case NPNVWindowNPObject: {
+        if (m_isJavaScriptPaused)
+            return NPERR_GENERIC_ERROR;
+
+        NPObject* windowScriptObject = m_parentFrame->script()->windowScriptNPObject();
+
+        // Return value is expected to be retained, as described here: <http://www.mozilla.org/projects/plugin/npruntime.html>
+        if (windowScriptObject)
+            _NPN_RetainObject(windowScriptObject);
+
+        void** v = (void**)value;
+        *v = windowScriptObject;
+
+        return NPERR_NO_ERROR;
+    }
+
+    case NPNVPluginElementNPObject: {
+        if (m_isJavaScriptPaused)
+            return NPERR_GENERIC_ERROR;
+
+        NPObject* pluginScriptObject = 0;
+
+        if (m_element->hasTagName(appletTag) || m_element->hasTagName(embedTag) || m_element->hasTagName(objectTag))
+            pluginScriptObject = static_cast<HTMLPlugInElement*>(m_element)->getNPObject();
+
+        // Return value is expected to be retained, as described here: <http://www.mozilla.org/projects/plugin/npruntime.html>
+        if (pluginScriptObject)
+            _NPN_RetainObject(pluginScriptObject);
+
+        void** v = (void**)value;
+        *v = pluginScriptObject;
+
+        return NPERR_NO_ERROR;
+    }
+#endif
+
+    case NPNVprivateModeBool: {
+        Page* page = m_parentFrame->page();
+        if (!page)
+            return NPERR_GENERIC_ERROR;
+        *((NPBool*)value) = !page->settings() || page->settings()->privateBrowsingEnabled();
+        return NPERR_NO_ERROR;
+    }
+
+    default:
+        return NPERR_GENERIC_ERROR;
+    }
+}
+
+void PluginView::privateBrowsingStateChanged(bool privateBrowsingEnabled)
+{
+    NPP_SetValueProcPtr setValue = m_plugin->pluginFuncs()->setvalue;
+    if (!setValue)
+        return;
+
+    PluginView::setCurrentPluginView(this);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    setCallingPlugin(true);
+    NPBool value = privateBrowsingEnabled;
+    setValue(m_instance, NPNVprivateModeBool, &value);
+    setCallingPlugin(false);
+    PluginView::setCurrentPluginView(0);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginView.h b/src/3rdparty/webkit/WebCore/plugins/PluginView.h
index 0a57fa62eb..21a25f6d2f 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginView.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginView.h
@@ -1,6 +1,7 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
+ * Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,15 +25,14 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef PluginView_H
-#define PluginView_H
+#ifndef PluginView_h
+#define PluginView_h
 
 #include "CString.h"
 #include "FrameLoadRequest.h"
 #include "HaltablePlugin.h"
 #include "IntRect.h"
-#include "KURL.h"
-#include "PlatformString.h"
+#include "MediaCanStartListener.h"
 #include "PluginStream.h"
 #include "ResourceRequest.h"
 #include "Timer.h"
@@ -45,11 +45,14 @@
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
-#if PLATFORM(WIN_OS) && PLATFORM(QT)
+#if OS(WINDOWS) && (PLATFORM(QT) || PLATFORM(WX))
 typedef struct HWND__* HWND;
 typedef HWND PlatformPluginWidget;
 #else
 typedef PlatformWidget PlatformPluginWidget;
+#if defined(XP_MACOSX) && PLATFORM(QT)
+#include <QPixmap>
+#endif
 #endif
 
 namespace JSC {
@@ -65,7 +68,7 @@ namespace WebCore {
     class KeyboardEvent;
     class MouseEvent;
     class KURL;
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if OS(WINDOWS) && ENABLE(NETSCAPE_PLUGIN_API)
     class PluginMessageThrottlerWin;
 #endif
     class PluginPackage;
@@ -80,7 +83,7 @@ namespace WebCore {
         PluginStatusLoadedSuccessfully
     };
 
-    class PluginRequest {
+    class PluginRequest : public Noncopyable {
     public:
         PluginRequest(const FrameLoadRequest& frameLoadRequest, bool sendNotification, void* notifyData, bool shouldAllowPopups)
             : m_frameLoadRequest(frameLoadRequest)
@@ -108,7 +111,7 @@ namespace WebCore {
         virtual void didFail(const ResourceError&) = 0;
     };
 
-    class PluginView : public Widget, private PluginStreamClient, public PluginManualLoader, private HaltablePlugin {
+    class PluginView : public Widget, private PluginStreamClient, public PluginManualLoader, private HaltablePlugin, private MediaCanStartListener {
     public:
         static PassRefPtr<PluginView> create(Frame* parentFrame, const IntSize&, Element*, const KURL&, const Vector<String>& paramNames, const Vector<String>& paramValues, const String& mimeType, bool loadManually);
         virtual ~PluginView();
@@ -153,6 +156,8 @@ namespace WebCore {
 
         void setJavaScriptPaused(bool);
 
+        void privateBrowsingStateChanged(bool);
+
         void disconnectStream(PluginStream*);
         void streamDidFinishLoading(PluginStream* stream) { disconnectStream(stream); }
 
@@ -175,7 +180,7 @@ namespace WebCore {
 
         virtual bool isPluginView() const { return true; }
 
-        Frame* parentFrame() const { return m_parentFrame; }
+        Frame* parentFrame() const { return m_parentFrame.get(); }
 
         void focusPluginElement();
 
@@ -183,7 +188,7 @@ namespace WebCore {
         const String& mimeType() const { return m_mimeType; }
         const KURL& url() const { return m_url; }
 
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if OS(WINDOWS) && ENABLE(NETSCAPE_PLUGIN_API)
         static LRESULT CALLBACK PluginViewWndProc(HWND, UINT, WPARAM, LPARAM);
         LRESULT wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam);
         WNDPROC pluginWndProc() const { return m_pluginWndProc; }
@@ -199,6 +204,8 @@ namespace WebCore {
         virtual void halt();
         virtual void restart();
         virtual Node* node() const;
+        virtual bool isWindowed() const { return m_isWindowed; }
+        virtual String pluginName() const;
 
         bool isHalted() const { return m_isHalted; }
         bool hasBeenHalted() const { return m_hasBeenHalted; }
@@ -207,6 +214,11 @@ namespace WebCore {
 
         bool start();
 
+#if ENABLE(NETSCAPE_PLUGIN_API)
+        static void keepAlive(NPP);
+#endif
+        void keepAlive();
+
     private:
         PluginView(Frame* parentFrame, const IntSize&, PluginPackage*, Element*, const KURL&, const Vector<String>& paramNames, const Vector<String>& paramValues, const String& mimeType, bool loadManually);
 
@@ -226,13 +238,18 @@ namespace WebCore {
 
         void invalidateWindowlessPluginRect(const IntRect&);
 
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+        virtual void mediaCanStart();
+
+#if OS(WINDOWS) && ENABLE(NETSCAPE_PLUGIN_API)
         void paintWindowedPluginIntoContext(GraphicsContext*, const IntRect&);
         static HDC WINAPI hookedBeginPaint(HWND, PAINTSTRUCT*);
         static BOOL WINAPI hookedEndPaint(HWND, const PAINTSTRUCT*);
 #endif
 
-        Frame* m_parentFrame;
+        static bool platformGetValueStatic(NPNVariable variable, void* value, NPError* result);
+        bool platformGetValue(NPNVariable variable, void* value, NPError* result);
+
+        RefPtr<Frame> m_parentFrame;
         RefPtr<PluginPackage> m_plugin;
         Element* m_element;
         bool m_isStarted;
@@ -251,6 +268,9 @@ namespace WebCore {
         void popPopupsStateTimerFired(Timer<PluginView>*);
         Timer<PluginView> m_popPopupsStateTimer;
 
+        void lifeSupportTimerFired(Timer<PluginView>*);
+        Timer<PluginView> m_lifeSupportTimer;
+
 #ifndef NP_NO_CARBON
         bool dispatchNPEvent(NPEvent&);
 #endif
@@ -259,12 +279,12 @@ namespace WebCore {
 
         void handleKeyboardEvent(KeyboardEvent*);
         void handleMouseEvent(MouseEvent*);
-#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
+#if defined(XP_UNIX) && ENABLE(NETSCAPE_PLUGIN_API)
         void handleFocusInEvent();
         void handleFocusOutEvent();
 #endif
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
         void paintIntoTransformedContext(HDC);
         PassRefPtr<Image> snapshot();
 #endif
@@ -292,11 +312,11 @@ namespace WebCore {
         bool m_haveInitialized;
         bool m_isWaitingToStart;
 
-#if defined(XP_UNIX) || defined(Q_WS_X11)
+#if defined(XP_UNIX)
         bool m_needsXEmbed;
 #endif
 
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if OS(WINDOWS) && ENABLE(NETSCAPE_PLUGIN_API)
         OwnPtr<PluginMessageThrottlerWin> m_messageThrottler;
         WNDPROC m_pluginWndProc;
         unsigned m_lastMessage;
@@ -305,7 +325,7 @@ namespace WebCore {
         bool m_haveUpdatedPluginWidget;
 #endif
 
-#if (PLATFORM(QT) && PLATFORM(WIN_OS)) || defined(XP_MACOSX)
+#if ((PLATFORM(QT) || PLATFORM(WX)) && OS(WINDOWS)) || defined(XP_MACOSX)
         // On Mac OSX and Qt/Windows the plugin does not have its own native widget,
         // but is using the containing window as its reference for positioning/painting.
         PlatformPluginWidget m_window;
@@ -320,20 +340,27 @@ public:
 
 private:
 
-#if defined(XP_UNIX) || defined(Q_WS_X11) || PLATFORM(SYMBIAN)
+#if defined(XP_UNIX) || OS(SYMBIAN)
         void setNPWindowIfNeeded();
 #elif defined(XP_MACOSX)
         NP_CGContext m_npCgContext;
         OwnPtr<Timer<PluginView> > m_nullEventTimer;
         NPDrawingModel m_drawingModel;
         NPEventModel m_eventModel;
+        CGContextRef m_contextRef;
+        WindowRef m_fakeWindow;
+#if PLATFORM(QT)
+        QPixmap m_pixmap;
+#endif
 
+        Point m_lastMousePos;
         void setNPWindowIfNeeded();
         void nullEventTimerFired(Timer<PluginView>*);
         Point globalMousePosForPlugin() const;
+        Point mousePosForPlugin(MouseEvent* event = 0) const;
 #endif
 
-#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
+#if defined(XP_UNIX) && ENABLE(NETSCAPE_PLUGIN_API)
         bool m_hasPendingGeometryChange;
         Pixmap m_drawable;
         Visual* m_visual;
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp
index 725af82e55..16383cca75 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp
@@ -67,15 +67,15 @@ NPError PluginView::handlePostReadFile(Vector<char>&, uint32, const char*)
     return 0;
 }
 
-NPError PluginView::getValue(NPNVariable, void*)
+bool PluginView::platformGetValue(NPNVariable, void*, NPError*)
 {
-    return 0;
+    return false;
 }
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
-NPError PluginView::getValueStatic(NPNVariable variable, void* value)
+bool PluginView::platformGetValueStatic(NPNVariable, void*, NPError*)
 {
-    return 0;
+    return false;
 }
 #endif
 
@@ -120,4 +120,18 @@ void PluginView::restart()
 {
 }
 
+#if ENABLE(NETSCAPE_PLUGIN_API)
+void PluginView::keepAlive(NPP)
+{
+}
+#endif
+
+void PluginView::privateBrowsingStateChanged(bool)
+{
+}
+
+void PluginView::setJavaScriptPaused(bool)
+{
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginWidget.h b/src/3rdparty/webkit/WebCore/plugins/PluginWidget.h
new file mode 100644
index 0000000000..7a76fc1bcb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginWidget.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PluginWidget_h
+#define PluginWidget_h
+
+#include "Widget.h"
+#include "GraphicsLayer.h"
+
+namespace WebCore {
+
+class PluginWidget : public Widget {
+    
+public:
+    PluginWidget(PlatformWidget widget = 0) : Widget(widget) { }
+#if USE(ACCELERATED_COMPOSITING)
+    PlatformLayer* platformLayer() const;
+#endif
+    
+private:
+    virtual void invalidateRect(const IntRect&);
+    virtual bool isPluginWidget() const { return true; }
+};
+
+#if USE(ACCELERATED_COMPOSITING) && !PLATFORM(MAC)
+inline PlatformLayer* PluginWidget::platformLayer() const
+{
+    return 0;
+}
+#endif
+
+} // namespace WebCore
+
+#endif // PluginWidget_h
diff --git a/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp b/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp
index 325bc4d6cd..69eaf76863 100644
--- a/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp
@@ -25,8 +25,6 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef __LP64__
-
 #include "config.h"
 #include "PluginPackage.h"
 
@@ -177,7 +175,7 @@ bool PluginPackage::fetchInfo()
 
             WTF::RetainPtr<CFDictionaryRef> extensionsDict = (CFDictionaryRef)values[i];
 
-            WTF:RetainPtr<CFNumberRef> enabled = (CFNumberRef)CFDictionaryGetValue(extensionsDict.get(), CFSTR("WebPluginTypeEnabled"));
+            WTF::RetainPtr<CFNumberRef> enabled = (CFNumberRef)CFDictionaryGetValue(extensionsDict.get(), CFSTR("WebPluginTypeEnabled"));
             if (enabled) {
                 int enabledValue = 0;
                 if (CFNumberGetValue(enabled.get(), kCFNumberIntType, &enabledValue) && enabledValue == 0)
@@ -302,10 +300,8 @@ abort:
     return false;
 }
 
+uint16 PluginPackage::NPVersion() const
+{
+    return NP_VERSION_MINOR;
+}
 } // namespace WebCore
-
-#else
-
-#include "../PluginPackageNone.cpp"
-
-#endif // !__LP64__
diff --git a/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp b/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp
index 6521c84efc..1fd46767e3 100644
--- a/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp
@@ -2,6 +2,7 @@
  * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,15 +26,10 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef __LP64__
-
 #include "config.h"
 #include "PluginView.h"
 
-#include <runtime/JSLock.h>
-#include <runtime/JSValue.h>
-#include "wtf/RetainPtr.h"
-
+#include "Bridge.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -45,6 +41,7 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
+#include "HostWindow.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
 #include "Image.h"
@@ -52,7 +49,6 @@
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
 #include "NotImplemented.h"
-#include "npruntime_impl.h"
 #include "Page.h"
 #include "PlatformMouseEvent.h"
 #include "PlatformKeyboardEvent.h"
@@ -60,10 +56,14 @@
 #include "PluginPackage.h"
 #include "PluginMainThreadScheduler.h"
 #include "RenderLayer.h"
-#include "runtime.h"
-#include "runtime_root.h"
 #include "ScriptController.h"
 #include "Settings.h"
+#include "npruntime_impl.h"
+#include "runtime_root.h"
+#include <runtime/JSLock.h>
+#include <runtime/JSValue.h>
+#include <wtf/RetainPtr.h>
+
 
 using JSC::ExecState;
 using JSC::Interpreter;
@@ -75,16 +75,18 @@ using JSC::UString;
 #if PLATFORM(QT)
 #include <QWidget>
 #include <QKeyEvent>
+#include <QPainter>
 #include "QWebPageClient.h"
 QT_BEGIN_NAMESPACE
-#if QT_VERSION < 0x040500
-extern Q_GUI_EXPORT WindowPtr qt_mac_window_for(const QWidget* w);
-#else
 extern Q_GUI_EXPORT OSWindowRef qt_mac_window_for(const QWidget* w);
-#endif
 QT_END_NAMESPACE
 #endif
 
+#if PLATFORM(WX)
+#include <wx/defs.h>
+#include <wx/wx.h>
+#endif
+
 using std::min;
 
 using namespace WTF;
@@ -93,7 +95,9 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+#ifndef NP_NO_CARBON
 static int modifiersForEvent(UIEventWithKeyState *event);
+#endif
 
 static inline WindowRef nativeWindowFor(PlatformWidget widget)
 {
@@ -101,6 +105,10 @@ static inline WindowRef nativeWindowFor(PlatformWidget widget)
     if (widget)
         return static_cast<WindowRef>(qt_mac_window_for(widget));
 #endif
+#if PLATFORM(WX)
+    if (widget)
+        return (WindowRef)widget->MacGetTopLevelWindowRef();
+#endif
     return 0;
 }
 
@@ -110,6 +118,10 @@ static inline CGContextRef cgHandleFor(PlatformWidget widget)
     if (widget)
         return (CGContextRef)widget->macCGHandle();
 #endif
+#if PLATFORM(WX)
+    if (widget)
+        return (CGContextRef)widget->MacGetCGContextRef();
+#endif
     return 0;
 }
 
@@ -121,6 +133,12 @@ static inline IntPoint topLevelOffsetFor(PlatformWidget widget)
         return widget->mapTo(topLevel, QPoint(0, 0)) + topLevel->geometry().topLeft() - topLevel->pos();
     }
 #endif
+#if PLATFORM(WX)
+    if (widget) {
+        PlatformWidget toplevel = wxGetTopLevelParent(widget);
+        return toplevel->ScreenToClient(widget->GetScreenPosition());
+    }
+#endif
     return IntPoint();
 }
 
@@ -155,30 +173,56 @@ bool PluginView::platformStart()
 
     // Gracefully handle unsupported drawing or event models. We can do this
     // now since the drawing and event model can only be set during NPP_New.
-    NPBool eventModelSupported, drawingModelSupported;
+#ifndef NP_NO_CARBON
+    NPBool eventModelSupported;
     if (getValueStatic(NPNVariable(NPNVsupportsCarbonBool + m_eventModel), &eventModelSupported) != NPERR_NO_ERROR
             || !eventModelSupported) {
+#endif
         m_status = PluginStatusCanNotLoadPlugin;
         LOG(Plugins, "Plug-in '%s' uses unsupported event model %s",
                 m_plugin->name().utf8().data(), prettyNameForEventModel(m_eventModel));
         return false;
+#ifndef NP_NO_CARBON
     }
+#endif
 
+#ifndef NP_NO_QUICKDRAW
+    NPBool drawingModelSupported;
     if (getValueStatic(NPNVariable(NPNVsupportsQuickDrawBool + m_drawingModel), &drawingModelSupported) != NPERR_NO_ERROR
             || !drawingModelSupported) {
+#endif
         m_status = PluginStatusCanNotLoadPlugin;
         LOG(Plugins, "Plug-in '%s' uses unsupported drawing model %s",
                 m_plugin->name().utf8().data(), prettyNameForDrawingModel(m_drawingModel));
         return false;
+#ifndef NP_NO_QUICKDRAW
     }
+#endif
 
 #if PLATFORM(QT)
+    // Set the platformPluginWidget only in the case of QWebView so that the context menu appears in the right place.
+    // In all other cases, we use off-screen rendering
     if (QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient()) {
-        if (QWidget* widget = client->ownerWidget()) {
+        if (QWidget* widget = qobject_cast<QWidget*>(client->pluginParent()))
             setPlatformPluginWidget(widget);
-        }
     }
 #endif
+#if PLATFORM(WX)
+    if (wxWindow* widget = m_parentFrame->view()->hostWindow()->platformPageClient())
+        setPlatformPluginWidget(widget);
+#endif
+
+    // Create a fake window relative to which all events will be sent when using offscreen rendering
+    if (!platformPluginWidget()) {
+#ifndef NP_NO_CARBON
+        // Make the default size really big. It is unclear why this is required but with a smaller size, mouse move
+        // events don't get processed. Resizing the fake window to flash's size doesn't help.
+        ::Rect windowBounds = { 0, 0, 1000, 1000 };
+        CreateNewWindow(kDocumentWindowClass, kWindowStandardDocumentAttributes, &windowBounds, &m_fakeWindow);
+        // Flash requires the window to be hilited to process mouse move events.
+        HiliteWindow(m_fakeWindow, true);
+#endif
+    }
 
     show();
 
@@ -186,6 +230,8 @@ bool PluginView::platformStart()
     m_nullEventTimer.set(new Timer<PluginView>(this, &PluginView::nullEventTimerFired));
     m_nullEventTimer->startRepeating(0.02);
 
+    m_lastMousePos.h = m_lastMousePos.v = 0;
+
     return true;
 }
 
@@ -193,37 +239,47 @@ void PluginView::platformDestroy()
 {
     if (platformPluginWidget())
         setPlatformPluginWidget(0);
+    else {
+        CGContextRelease(m_contextRef);
+#ifndef NP_NO_CARBON
+        if (m_fakeWindow)
+            DisposeWindow(m_fakeWindow);
+#endif
+    }
 }
 
 // Used before the plugin view has been initialized properly, and as a
 // fallback for variables that do not require a view to resolve.
-NPError PluginView::getValueStatic(NPNVariable variable, void* value)
+bool PluginView::platformGetValueStatic(NPNVariable variable, void* value, NPError* result)
 {
-    LOG(Plugins, "PluginView::getValueStatic(%s)", prettyNameForNPNVariable(variable).data());
-
     switch (variable) {
     case NPNVToolkit:
         *static_cast<uint32*>(value) = 0;
-        return NPERR_NO_ERROR;
+        *result = NPERR_NO_ERROR;
+        return true;
 
     case NPNVjavascriptEnabledBool:
         *static_cast<NPBool*>(value) = true;
-        return NPERR_NO_ERROR;
+        *result = NPERR_NO_ERROR;
+        return true;
 
 #ifndef NP_NO_CARBON
     case NPNVsupportsCarbonBool:
         *static_cast<NPBool*>(value) = true;
-        return NPERR_NO_ERROR;
+        *result = NPERR_NO_ERROR;
+        return true;
 
 #endif
     case NPNVsupportsCocoaBool:
         *static_cast<NPBool*>(value) = false;
-        return NPERR_NO_ERROR;
+        *result = NPERR_NO_ERROR;
+        return true;
 
     // CoreGraphics is the only drawing model we support
     case NPNVsupportsCoreGraphicsBool:
         *static_cast<NPBool*>(value) = true;
-        return NPERR_NO_ERROR;
+        *result = NPERR_NO_ERROR;
+        return true;
 
 #ifndef NP_NO_QUICKDRAW
     // QuickDraw is deprecated in 10.5 and not supported on 64-bit
@@ -232,61 +288,20 @@ NPError PluginView::getValueStatic(NPNVariable variable, void* value)
     case NPNVsupportsOpenGLBool:
     case NPNVsupportsCoreAnimationBool:
         *static_cast<NPBool*>(value) = false;
-        return NPERR_NO_ERROR;
+        *result = NPERR_NO_ERROR;
+        return true;
 
     default:
-        return NPERR_GENERIC_ERROR;
+        return false;
     }
 }
 
 // Used only for variables that need a view to resolve
-NPError PluginView::getValue(NPNVariable variable, void* value)
+bool PluginView::platformGetValue(NPNVariable variable, void* value, NPError* error)
 {
-    LOG(Plugins, "PluginView::getValue(%s)", prettyNameForNPNVariable(variable).data());
-
-    switch (variable) {
-    case NPNVWindowNPObject: {
-        if (m_isJavaScriptPaused)
-            return NPERR_GENERIC_ERROR;
-
-        NPObject* windowScriptObject = m_parentFrame->script()->windowScriptNPObject();
-
-        // Return value is expected to be retained, as described in
-        // <http://www.mozilla.org/projects/plugin/npruntime.html>
-        if (windowScriptObject)
-            _NPN_RetainObject(windowScriptObject);
-
-        void** v = (void**)value;
-        *v = windowScriptObject;
-
-        return NPERR_NO_ERROR;
-    }
-
-    case NPNVPluginElementNPObject: {
-        if (m_isJavaScriptPaused)
-            return NPERR_GENERIC_ERROR;
-
-        NPObject* pluginScriptObject = 0;
-
-        if (m_element->hasTagName(appletTag) || m_element->hasTagName(embedTag) || m_element->hasTagName(objectTag))
-            pluginScriptObject = static_cast<HTMLPlugInElement*>(m_element)->getNPObject();
-
-        // Return value is expected to be retained, as described in
-        // <http://www.mozilla.org/projects/plugin/npruntime.html>
-        if (pluginScriptObject)
-            _NPN_RetainObject(pluginScriptObject);
-
-        void** v = (void**)value;
-        *v = pluginScriptObject;
-
-        return NPERR_NO_ERROR;
-    }
-
-    default:
-        return getValueStatic(variable, value);
-    }
-
+    return false;
 }
+
 void PluginView::setParent(ScrollView* parent)
 {
     LOG(Plugins, "PluginView::setParent(%p)", parent);
@@ -322,12 +337,17 @@ void PluginView::setFocus()
     LOG(Plugins, "PluginView::setFocus()");
 
     if (platformPluginWidget())
+#if PLATFORM(QT)
        platformPluginWidget()->setFocus(Qt::OtherFocusReason);
+#else
+        platformPluginWidget()->SetFocus();
+#endif
    else
        Widget::setFocus();
 
     // TODO: Also handle and pass on blur events (focus lost)
 
+#ifndef NP_NO_CARBON
     EventRecord record;
     record.what = getFocusEvent;
     record.message = 0;
@@ -337,6 +357,7 @@ void PluginView::setFocus()
 
     if (!dispatchNPEvent(record))
         LOG(Events, "PluginView::setFocus(): Get-focus event not accepted");
+#endif
 }
 
 void PluginView::setParentVisible(bool visible)
@@ -357,17 +378,25 @@ void PluginView::setNPWindowIfNeeded()
     if (!m_isStarted || !parent() || !m_plugin->pluginFuncs()->setwindow)
         return;
 
-    CGContextRef newContextRef = cgHandleFor(platformPluginWidget());
-    if (!newContextRef)
-        return;
+    CGContextRef newContextRef = 0;
+    WindowRef newWindowRef = 0;
+    if (platformPluginWidget()) {
+        newContextRef = cgHandleFor(platformPluginWidget());
+        newWindowRef = nativeWindowFor(platformPluginWidget());
+        m_npWindow.type = NPWindowTypeWindow;
+    } else {
+        newContextRef = m_contextRef;
+        newWindowRef = m_fakeWindow;
+        m_npWindow.type = NPWindowTypeDrawable;
+    }
 
-    WindowRef newWindowRef = nativeWindowFor(platformPluginWidget());
-    if (!newWindowRef)
+    if (!newContextRef || !newWindowRef)
         return;
 
-    m_npWindow.type = NPWindowTypeWindow;
     m_npWindow.window = (void*)&m_npCgContext;
+#ifndef NP_NO_CARBON
     m_npCgContext.window = newWindowRef;
+#endif
     m_npCgContext.context = newContextRef;
 
     m_npWindow.x = m_windowRect.x();
@@ -409,6 +438,17 @@ void PluginView::updatePluginWidget()
     IntPoint offset = topLevelOffsetFor(platformPluginWidget());
     m_windowRect.move(offset.x(), offset.y());
 
+    if (!platformPluginWidget()) {
+        if (m_windowRect.size() != oldWindowRect.size()) {
+            CGContextRelease(m_contextRef);
+#if PLATFORM(QT)
+            m_pixmap = QPixmap(m_windowRect.size());
+            m_pixmap.fill(Qt::transparent);
+            m_contextRef = m_pixmap.isNull() ? 0 : qt_mac_cg_context(&m_pixmap);
+#endif
+        }
+    }
+
     m_clipRect = windowClipRect();
     m_clipRect.move(-m_windowRect.x(), -m_windowRect.y());
 
@@ -433,9 +473,31 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
         return;
 
     CGContextSaveGState(cgContext);
-    IntPoint offset = frameRect().location();
-    CGContextTranslateCTM(cgContext, offset.x(), offset.y());
+    if (platformPluginWidget()) {
+        IntPoint offset = frameRect().location();
+        CGContextTranslateCTM(cgContext, offset.x(), offset.y());
+    }
+
+    IntRect targetRect(frameRect());
+    targetRect.intersects(rect);
+
+    // clip the context so that plugin only updates the interested area.
+    CGRect r;
+    r.origin.x = targetRect.x() - frameRect().x();
+    r.origin.y = targetRect.y() - frameRect().y();
+    r.size.width = targetRect.width();
+    r.size.height = targetRect.height();
+    CGContextClipToRect(cgContext, r);
+
+    if (!platformPluginWidget() && m_isTransparent) { // clean the pixmap in transparent mode
+#if PLATFORM(QT)
+        QPainter painter(&m_pixmap);
+        painter.setCompositionMode(QPainter::CompositionMode_Clear);
+        painter.fillRect(QRectF(r.origin.x, r.origin.y, r.size.width, r.size.height), Qt::transparent);
+#endif
+    }
 
+#ifndef NP_NO_CARBON
     EventRecord event;
     event.what = updateEvt;
     event.message = (long unsigned int)m_npCgContext.window;
@@ -446,20 +508,35 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
 
     if (!dispatchNPEvent(event))
         LOG(Events, "PluginView::paint(): Paint event not accepted");
+#endif
 
     CGContextRestoreGState(cgContext);
+
+    if (!platformPluginWidget()) {
+#if PLATFORM(QT)
+        QPainter* painter = context->platformContext();
+        painter->drawPixmap(targetRect.x(), targetRect.y(), m_pixmap, 
+                            targetRect.x() - frameRect().x(), targetRect.y() - frameRect().y(), targetRect.width(), targetRect.height());
+#endif
+    }
 }
 
 void PluginView::invalidateRect(const IntRect& rect)
 {
     if (platformPluginWidget())
+#if PLATFORM(QT)
         platformPluginWidget()->update(convertToContainingWindow(rect));
+#else
+        platformPluginWidget()->RefreshRect(convertToContainingWindow(rect));
+#endif
+    else
+        invalidateWindowlessPluginRect(rect);
 }
 
 void PluginView::invalidateRect(NPRect* rect)
 {
-    // TODO: optimize
-    invalidate();
+    IntRect r(rect->left, rect->top, rect->right - rect->left, rect->bottom - rect->top);
+    invalidateRect(r);
 }
 
 void PluginView::invalidateRegion(NPRegion region)
@@ -481,10 +558,12 @@ void PluginView::handleMouseEvent(MouseEvent* event)
     if (!m_isStarted)
         return;
 
+#ifndef NP_NO_CARBON
     EventRecord record;
 
     if (event->type() == eventNames().mousemoveEvent) {
         // Mouse movement is handled by null timer events
+        m_lastMousePos = mousePosForPlugin(event);
         return;
     } else if (event->type() == eventNames().mouseoverEvent) {
         record.what = adjustCursorEvent;
@@ -501,8 +580,7 @@ void PluginView::handleMouseEvent(MouseEvent* event)
     } else {
         return;
     }
-
-    record.where = globalMousePosForPlugin();
+    record.where = mousePosForPlugin(event);
     record.modifiers = modifiersForEvent(event);
 
     if (!event->buttonDown())
@@ -520,6 +598,7 @@ void PluginView::handleMouseEvent(MouseEvent* event)
     } else {
         event->setDefaultHandled();
     }
+#endif
 }
 
 void PluginView::handleKeyboardEvent(KeyboardEvent* event)
@@ -532,6 +611,7 @@ void PluginView::handleKeyboardEvent(KeyboardEvent* event)
     LOG(Plugins, "PV::hKE(): KE.keyCode: 0x%02X, KE.charCode: %d",
             event->keyCode(), event->charCode());
 
+#ifndef NP_NO_CARBON
     EventRecord record;
 
     if (event->type() == eventNames().keydownEvent) {
@@ -583,15 +663,19 @@ void PluginView::handleKeyboardEvent(KeyboardEvent* event)
 
     LOG(Plugins, "PV::hKE(): record.modifiers: %d", record.modifiers);
 
+#if PLATFORM(QT)
     LOG(Plugins, "PV::hKE(): PKE.qtEvent()->nativeVirtualKey: 0x%02X, charCode: %d",
                keyCode, int(uchar(charCodes[0])));
+#endif
 
     if (!dispatchNPEvent(record))
         LOG(Events, "PluginView::handleKeyboardEvent(): Keyboard event type %d not accepted", record.what);
     else
         event->setDefaultHandled();
+#endif
 }
 
+#ifndef NP_NO_CARBON
 void PluginView::nullEventTimerFired(Timer<PluginView>*)
 {
     EventRecord record;
@@ -599,7 +683,7 @@ void PluginView::nullEventTimerFired(Timer<PluginView>*)
     record.what = nullEvent;
     record.message = 0;
     record.when = TickCount();
-    record.where = globalMousePosForPlugin();
+    record.where = m_lastMousePos;
     record.modifiers = GetCurrentKeyModifiers();
     if (!Button())
         record.modifiers |= btnState;
@@ -607,7 +691,9 @@ void PluginView::nullEventTimerFired(Timer<PluginView>*)
     if (!dispatchNPEvent(record))
         LOG(Events, "PluginView::nullEventTimerFired(): Null event not accepted");
 }
+#endif
 
+#ifndef NP_NO_CARBON
 static int modifiersForEvent(UIEventWithKeyState* event)
 {
     int modifiers = 0;
@@ -626,7 +712,9 @@ static int modifiersForEvent(UIEventWithKeyState* event)
 
      return modifiers;
 }
+#endif
 
+#ifndef NP_NO_CARBON
 static bool tigerOrBetter()
 {
     static SInt32 systemVersion = 0;
@@ -638,7 +726,9 @@ static bool tigerOrBetter()
 
     return systemVersion >= 0x1040;
 }
+#endif
 
+#ifndef NP_NO_CARBON
 Point PluginView::globalMousePosForPlugin() const
 {
     Point pos;
@@ -649,9 +739,45 @@ Point PluginView::globalMousePosForPlugin() const
     pos.h = short(pos.h * scaleFactor);
     pos.v = short(pos.v * scaleFactor);
 
+#if PLATFORM(WX)
+    // make sure the titlebar/toolbar size is included
+    WindowRef windowRef = nativeWindowFor(platformPluginWidget());
+    ::Rect content, structure;
+
+    GetWindowBounds(windowRef, kWindowStructureRgn, &structure);
+    GetWindowBounds(windowRef, kWindowContentRgn, &content);
+
+    int top = content.top  - structure.top;
+    pos.v -= top;
+#endif
+
     return pos;
 }
+#endif
 
+#ifndef NP_NO_CARBON
+Point PluginView::mousePosForPlugin(MouseEvent* event) const
+{
+    ASSERT(event);
+    if (platformPluginWidget())
+        return globalMousePosForPlugin();
+
+    if (event->button() == 2) {
+        // always pass the global position for right-click since Flash uses it to position the context menu
+        return globalMousePosForPlugin();
+    }
+
+    Point pos;
+    IntPoint postZoomPos = roundedIntPoint(m_element->renderer()->absoluteToLocal(event->absoluteLocation()));
+    pos.h = postZoomPos.x() + m_windowRect.x();
+    // The number 22 is the height of the title bar. As to why it figures in the calculation below
+    // is left as an exercise to the reader :-)
+    pos.v = postZoomPos.y() + m_windowRect.y() - 22;
+    return pos;
+}
+#endif
+
+#ifndef NP_NO_CARBON
 bool PluginView::dispatchNPEvent(NPEvent& event)
 {
     PluginView::setCurrentPluginView(this);
@@ -664,6 +790,7 @@ bool PluginView::dispatchNPEvent(NPEvent& event)
     PluginView::setCurrentPluginView(0);
     return accepted;
 }
+#endif
 
 // ------------------- Miscellaneous  ------------------
 
@@ -701,9 +828,3 @@ void PluginView::restart()
 }
 
 } // namespace WebCore
-
-#else
-
-#include "../PluginViewNone.cpp"
-
-#endif // !__LP64__
diff --git a/src/3rdparty/webkit/WebCore/plugins/mac/PluginWidgetMac.mm b/src/3rdparty/webkit/WebCore/plugins/mac/PluginWidgetMac.mm
new file mode 100644
index 0000000000..f407928082
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/mac/PluginWidgetMac.mm
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PluginWidget.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+@interface NSView (WebKitSecretsWebCoreKnowsAbout)
+- (CALayer *)pluginLayer;
+@end
+#endif
+namespace WebCore {
+
+void PluginWidget::invalidateRect(const IntRect& rect)
+{
+    [platformWidget() setNeedsDisplayInRect:rect];
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+PlatformLayer* PluginWidget::platformLayer() const
+{
+    if (![platformWidget() respondsToSelector:@selector(pluginLayer)])
+        return 0;
+    
+    return [platformWidget() pluginLayer];   
+}
+#endif
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginDataQt.cpp b/src/3rdparty/webkit/WebCore/plugins/qt/PluginDataQt.cpp
index 5478d38671..188365a78f 100644
--- a/src/3rdparty/webkit/WebCore/plugins/qt/PluginDataQt.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginDataQt.cpp
@@ -24,18 +24,16 @@
 #include "PluginDatabase.h"
 #include "PluginPackage.h"
 
-#if QT_VERSION >= 0x040400
+#include "Chrome.h"
 #include "ChromeClientQt.h"
 #include "Page.h"
 #include <qwebpage.h>
 #include <qwebpluginfactory.h>
-#endif
 
 namespace WebCore {
 
 void PluginData::initPlugins()
 {
-#if QT_VERSION >= 0x040400
     QWebPage* webPage = static_cast<ChromeClientQt*>(m_page->chrome()->client())->m_webPage;
     QWebPluginFactory* factory = webPage->pluginFactory();
     if (factory) {
@@ -62,7 +60,6 @@ void PluginData::initPlugins()
             m_plugins.append(info);
         }
     }
-#endif
 
     PluginDatabase *db = PluginDatabase::installedPlugins();
     const Vector<PluginPackage*> &plugins = db->plugins();
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp b/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp
index 811992444c..74deaf62d1 100644
--- a/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp
@@ -143,4 +143,8 @@ abort:
     return false;
 }
 
+uint16 PluginPackage::NPVersion() const
+{
+    return NP_VERSION_MINOR;
+}
 }
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp b/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
index 476ab8a65e..fb88b87bd1 100644
--- a/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
@@ -28,6 +28,7 @@
 #include "config.h"
 #include "PluginView.h"
 
+#include "Bridge.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -41,6 +42,7 @@
 #include "GraphicsContext.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
+#include "HostWindow.h"
 #include "Image.h"
 #include "JSDOMBinding.h"
 #include "KeyboardEvent.h"
@@ -53,27 +55,27 @@
 #include "PluginDebug.h"
 #include "PluginPackage.h"
 #include "PluginMainThreadScheduler.h"
+#include "QWebPageClient.h"
 #include "RenderLayer.h"
 #include "ScriptController.h"
 #include "Settings.h"
 #include "npruntime_impl.h"
-#include "runtime.h"
 #include "runtime_root.h"
-#include "QWebPageClient.h"
+
 #include <QApplication>
 #include <QDesktopWidget>
 #include <QKeyEvent>
 #include <QPainter>
 #include <QWidget>
 #include <QX11Info>
-#include <runtime/JSLock.h>
-#include <runtime/JSValue.h>
 #include <X11/X.h>
 #ifndef QT_NO_XRENDER
 #define Bool int
 #define Status int
 #include <X11/extensions/Xrender.h>
 #endif
+#include <runtime/JSLock.h>
+#include <runtime/JSValue.h>
 
 using JSC::ExecState;
 using JSC::Interpreter;
@@ -142,26 +144,14 @@ void PluginView::setFocus()
 
 void PluginView::show()
 {
-    setSelfVisible(true);
-
-    if (isParentVisible() && platformPluginWidget())
-        platformPluginWidget()->setVisible(true);
-
-    // do not call parent impl. here as it will set the platformWidget
-    // (same as platformPluginWidget in the Qt port) to visible, even
-    // when parent isn't visible.
+    Q_ASSERT(platformPluginWidget() == platformWidget());
+    Widget::show();
 }
 
 void PluginView::hide()
 {
-    setSelfVisible(false);
-
-    if (isParentVisible() && platformPluginWidget())
-        platformPluginWidget()->setVisible(false);
-
-    // do not call parent impl. here as it will set the platformWidget
-    // (same as platformPluginWidget in the Qt port) to invisible, even
-    // when parent isn't visible.
+    Q_ASSERT(platformPluginWidget() == platformWidget());
+    Widget::hide();
 }
 
 void PluginView::paint(GraphicsContext* context, const IntRect& rect)
@@ -544,18 +534,16 @@ NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const c
     if (filename.startsWith("file:///"))
         filename = filename.substring(8);
 
-    if (!fileExists(filename))
+    long long size;
+    if (!getFileSize(filename, size))
         return NPERR_FILE_NOT_FOUND;
 
-    // FIXME - read the file data into buffer
     FILE* fileHandle = fopen((filename.utf8()).data(), "r");
-
     if (!fileHandle)
         return NPERR_FILE_NOT_FOUND;
 
-    //buffer.resize();
-
-    int bytesRead = fread(buffer.data(), 1, 0, fileHandle);
+    buffer.resize(size);
+    int bytesRead = fread(buffer.data(), 1, size, fileHandle);
 
     fclose(fileHandle);
 
@@ -565,96 +553,64 @@ NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const c
     return NPERR_NO_ERROR;
 }
 
-NPError PluginView::getValueStatic(NPNVariable variable, void* value)
+bool PluginView::platformGetValueStatic(NPNVariable variable, void* value, NPError* result)
 {
-    LOG(Plugins, "PluginView::getValueStatic(%s)", prettyNameForNPNVariable(variable).data());
-
     switch (variable) {
     case NPNVToolkit:
         *static_cast<uint32*>(value) = 0;
-        return NPERR_NO_ERROR;
+        *result = NPERR_NO_ERROR;
+        return true;
 
     case NPNVSupportsXEmbedBool:
         *static_cast<NPBool*>(value) = true;
-        return NPERR_NO_ERROR;
+        *result = NPERR_NO_ERROR;
+        return true;
 
     case NPNVjavascriptEnabledBool:
         *static_cast<NPBool*>(value) = true;
-        return NPERR_NO_ERROR;
+        *result = NPERR_NO_ERROR;
+        return true;
 
     case NPNVSupportsWindowless:
         *static_cast<NPBool*>(value) = true;
-        return NPERR_NO_ERROR;
+        *result = NPERR_NO_ERROR;
+        return true;
 
     default:
-        return NPERR_GENERIC_ERROR;
+        return false;
     }
 }
 
-NPError PluginView::getValue(NPNVariable variable, void* value)
+bool PluginView::platformGetValue(NPNVariable variable, void* value, NPError* result)
 {
-    LOG(Plugins, "PluginView::getValue(%s)", prettyNameForNPNVariable(variable).data());
-
     switch (variable) {
     case NPNVxDisplay:
         *(void **)value = QX11Info::display();
-        return NPERR_NO_ERROR;
+        *result = NPERR_NO_ERROR;
+        return true;
 
     case NPNVxtAppContext:
-        return NPERR_GENERIC_ERROR;
-
-#if ENABLE(NETSCAPE_PLUGIN_API)
-    case NPNVWindowNPObject: {
-        if (m_isJavaScriptPaused)
-            return NPERR_GENERIC_ERROR;
-
-        NPObject* windowScriptObject = m_parentFrame->script()->windowScriptNPObject();
-
-        // Return value is expected to be retained, as described here: <http://www.mozilla.org/projects/plugin/npruntime.html>
-        if (windowScriptObject)
-            _NPN_RetainObject(windowScriptObject);
-
-        void** v = (void**)value;
-        *v = windowScriptObject;
-
-        return NPERR_NO_ERROR;
-    }
-
-    case NPNVPluginElementNPObject: {
-        if (m_isJavaScriptPaused)
-            return NPERR_GENERIC_ERROR;
-
-        NPObject* pluginScriptObject = 0;
-
-        if (m_element->hasTagName(appletTag) || m_element->hasTagName(embedTag) || m_element->hasTagName(objectTag))
-            pluginScriptObject = static_cast<HTMLPlugInElement*>(m_element)->getNPObject();
-
-        // Return value is expected to be retained, as described here: <http://www.mozilla.org/projects/plugin/npruntime.html>
-        if (pluginScriptObject)
-            _NPN_RetainObject(pluginScriptObject);
-
-        void** v = (void**)value;
-        *v = pluginScriptObject;
-
-        return NPERR_NO_ERROR;
-    }
-#endif
+        *result = NPERR_GENERIC_ERROR;
+        return true;
 
     case NPNVnetscapeWindow: {
         void* w = reinterpret_cast<void*>(value);
         QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
         *((XID *)w) = client ? client->ownerWidget()->window()->winId() : 0;
-        return NPERR_NO_ERROR;
+        *result = NPERR_NO_ERROR;
+        return true;
     }
 
     case NPNVToolkit:
         if (m_plugin->quirks().contains(PluginQuirkRequiresGtkToolKit)) {
             *((uint32 *)value) = 2;
-            return NPERR_NO_ERROR;
+            *result = NPERR_NO_ERROR;
+            return true;
         }
-        // fall through
+        return false;
+
     default:
-        return getValueStatic(variable, value);
+        return false;
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.cpp b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.cpp
index b839870c61..aece0e48b4 100644
--- a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.cpp
@@ -32,12 +32,12 @@
 
 using namespace WebCore;
 
-PluginContainerSymbian::PluginContainerSymbian(PluginView* view, QWidget* parent, QGraphicsProxyWidget* proxy)
-    : QWidget(parent)
+PluginContainerSymbian::PluginContainerSymbian(PluginView* view, QWidget* parent)
+    : m_parent(parent)
     , m_pluginView(view)
-    , m_proxy(proxy)
     , m_hasPendingGeometryChange(false)
 {
+    setParent(m_parent);
 }
 
 PluginContainerSymbian::~PluginContainerSymbian()
@@ -62,7 +62,7 @@ void PluginContainerSymbian::adjustGeometry()
     }
 }
 
-void PluginContainerSymbian::focusInEvent(QFocusEvent*)
+void PluginContainerSymbian::focusInEvent(QFocusEvent* event)
 {
     if (Page* page = m_pluginView->parentFrame()->page())
         page->focusController()->setActive(true);
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.h b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.h
index fead8723b6..fce4a7160a 100644
--- a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.h
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.h
@@ -22,8 +22,6 @@
 
 #include <QWidget>
 
-class QGraphicsProxyWidget;
-
 namespace WebCore {
 
     class PluginView;
@@ -31,19 +29,18 @@ namespace WebCore {
     class PluginContainerSymbian : public QWidget {
         Q_OBJECT
     public:
-        PluginContainerSymbian(PluginView*, QWidget* parent, QGraphicsProxyWidget* proxy = 0);
+        PluginContainerSymbian(PluginView*, QWidget* parent);
         ~PluginContainerSymbian();
 
         void requestGeometry(const QRect&, const QRegion& clip = QRegion());
         void adjustGeometry();
-        QGraphicsProxyWidget* proxy() { return m_proxy; }
 
     protected:
         virtual void focusInEvent(QFocusEvent*);
         virtual void focusOutEvent(QFocusEvent*);
     private:
         PluginView* m_pluginView;
-        QGraphicsProxyWidget* m_proxy;
+        QWidget* m_parent;
         QRect m_windowRect;
         QRegion m_clipRegion;
         bool m_hasPendingGeometryChange;
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginPackageSymbian.cpp b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginPackageSymbian.cpp
index d5c7533f63..44f815209e 100644
--- a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginPackageSymbian.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginPackageSymbian.cpp
@@ -173,5 +173,10 @@ void PluginPackage::unload()
     delete m_pluginLoader;
     m_pluginLoader = 0;
 }
+
+uint16 PluginPackage::NPVersion() const
+{
+    return NP_VERSION_MINOR;
+}
 }
 
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginViewSymbian.cpp b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginViewSymbian.cpp
index 9e107cd606..3f3e2c0d93 100644
--- a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginViewSymbian.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginViewSymbian.cpp
@@ -19,6 +19,7 @@
 #include "config.h"
 #include "PluginView.h"
 
+#include "Bridge.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -31,13 +32,12 @@
 #include "GraphicsContext.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
+#include "HostWindow.h"
 #include "Image.h"
 #include "JSDOMBinding.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
 #include "NotImplemented.h"
-#include "npfunctions.h"
-#include "npinterface.h"
 #include "Page.h"
 #include "PlatformKeyboardEvent.h"
 #include "PlatformMouseEvent.h"
@@ -45,15 +45,14 @@
 #include "PluginDebug.h"
 #include "PluginMainThreadScheduler.h"
 #include "PluginPackage.h"
+#include "QWebPageClient.h"
 #include "RenderLayer.h"
 #include "ScriptController.h"
 #include "Settings.h"
+#include "npfunctions.h"
+#include "npinterface.h"
 #include "npruntime_impl.h"
-#include "runtime.h"
 #include "runtime_root.h"
-#include "QWebPageClient.h"
-#include "qgraphicswebview.h"
-#include <QGraphicsProxyWidget>
 #include <QKeyEvent>
 #include <QPixmap>
 #include <QRegion>
@@ -86,7 +85,6 @@ void PluginView::updatePluginWidget()
     IntRect oldClipRect = m_clipRect;
     
     m_windowRect = IntRect(frameView->contentsToWindow(frameRect().location()), frameRect().size());
-    
     m_clipRect = windowClipRect();
     m_clipRect.move(-m_windowRect.x(), -m_windowRect.y());
     if (m_windowRect == oldWindowRect && m_clipRect == oldClipRect)
@@ -309,66 +307,27 @@ NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const c
     return NPERR_NO_ERROR;
 }
 
-NPError PluginView::getValueStatic(NPNVariable variable, void* value)
+bool PluginView::platformGetValueStatic(NPNVariable variable, void* value, NPError* result)
 {
-    LOG(Plugins, "PluginView::getValueStatic(%s)", prettyNameForNPNVariable(variable).data());
-
     switch (variable) {
     case NPNVjavascriptEnabledBool:
         *static_cast<NPBool*>(value) = true;
-        return NPERR_NO_ERROR;
+        *result = NPERR_NO_ERROR;
+        return true;
 
     case NPNVSupportsWindowless:
         *static_cast<NPBool*>(value) = true;
-        return NPERR_NO_ERROR;
+        *result = NPERR_NO_ERROR;
+        return true;
 
     default:
-        return NPERR_GENERIC_ERROR;
+        return false;
     }
 }
 
-NPError PluginView::getValue(NPNVariable variable, void* value)
+bool PluginView::platformGetValue(NPNVariable, void*, NPError*)
 {
-    LOG(Plugins, "PluginView::getValue(%s)", prettyNameForNPNVariable(variable).data());
-
-    switch (variable) {
-    case NPNVWindowNPObject: {
-        if (m_isJavaScriptPaused)
-            return NPERR_GENERIC_ERROR;
-
-        NPObject* windowScriptObject = m_parentFrame->script()->windowScriptNPObject();
-
-        // Return value is expected to be retained, as described here: <http://www.mozilla.org/projects/plugin/npruntime.html>
-        if (windowScriptObject)
-            _NPN_RetainObject(windowScriptObject);
-
-        void** v = (void**)value;
-        *v = windowScriptObject;
-            
-        return NPERR_NO_ERROR;
-    }
-
-    case NPNVPluginElementNPObject: {
-        if (m_isJavaScriptPaused)
-            return NPERR_GENERIC_ERROR;
-
-        NPObject* pluginScriptObject = 0;
-
-        if (m_element->hasTagName(appletTag) || m_element->hasTagName(embedTag) || m_element->hasTagName(objectTag))
-            pluginScriptObject = static_cast<HTMLPlugInElement*>(m_element)->getNPObject();
-
-        // Return value is expected to be retained, as described here: <http://www.mozilla.org/projects/plugin/npruntime.html>
-        if (pluginScriptObject)
-            _NPN_RetainObject(pluginScriptObject);
-
-        void** v = (void**)value;
-        *v = pluginScriptObject;
-
-        return NPERR_NO_ERROR;
-    }        
-    default:
-        return getValueStatic(variable, value);
-    }
+    return false;
 }
 
 void PluginView::invalidateRect(const IntRect& rect)
@@ -428,15 +387,12 @@ bool PluginView::platformStart()
 
     if (m_isWindowed) {
         QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
-        QGraphicsProxyWidget* proxy = 0;
-        if (QGraphicsWebView *webView = qobject_cast<QGraphicsWebView*>(client->pluginParent()))
-            proxy = new QGraphicsProxyWidget(webView);
-
-        PluginContainerSymbian* container = new PluginContainerSymbian(this, proxy ? 0 : client->ownerWidget(), proxy);
-        setPlatformWidget(container);
-        if (proxy)
-            proxy->setWidget(container);
-        
+        // FIXME this will not work for QGraphicsView.
+        // But we cannot use winId because it will create a window and on S60,
+        // QWidgets should not create a window. 
+        Q_ASSERT(qobject_cast<QWidget*>(client->pluginParent()));
+        setPlatformWidget(new PluginContainerSymbian(this, 
+            qobject_cast<QWidget*>(client->pluginParent())));
         m_npWindow.type = NPWindowTypeWindow;
         m_npWindow.window = (void*)platformPluginWidget();
 
@@ -452,11 +408,7 @@ bool PluginView::platformStart()
 
 void PluginView::platformDestroy()
 {
-    QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
-    if (QGraphicsWebView *webView = qobject_cast<QGraphicsWebView*>(client->pluginParent()))
-        delete static_cast<PluginContainerSymbian*>(platformPluginWidget())->proxy();
-    else
-        delete platformPluginWidget();
+    delete platformPluginWidget();
 }
 
 void PluginView::halt()
diff --git a/src/3rdparty/webkit/WebCore/plugins/win/PluginDatabaseWin.cpp b/src/3rdparty/webkit/WebCore/plugins/win/PluginDatabaseWin.cpp
index 634b2a1136..71bcdb545c 100644
--- a/src/3rdparty/webkit/WebCore/plugins/win/PluginDatabaseWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/win/PluginDatabaseWin.cpp
@@ -38,7 +38,7 @@
 #define _countof(x) (sizeof(x)/sizeof(x[0]))
 #endif
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 // WINCE doesn't support Registry Key Access Rights. The parameter should always be 0
 #define KEY_ENUMERATE_SUB_KEYS 0
 
@@ -252,7 +252,7 @@ static inline void addMozillaPluginDirectories(Vector<String>& directories)
 
 static inline void addWindowsMediaPlayerPluginDirectory(Vector<String>& directories)
 {
-#if !PLATFORM(WINCE)
+#if !OS(WINCE)
     // The new WMP Firefox plugin is installed in \PFiles\Plugins if it can't find any Firefox installs
     WCHAR pluginDirectoryStr[_MAX_PATH + 1];
     DWORD pluginDirectorySize = ::ExpandEnvironmentStringsW(TEXT("%SYSTEMDRIVE%\\PFiles\\Plugins"), pluginDirectoryStr, _countof(pluginDirectoryStr));
@@ -355,7 +355,7 @@ exit:
 
 static inline void addMacromediaPluginDirectories(Vector<String>& directories)
 {
-#if !PLATFORM(WINCE)
+#if !OS(WINCE)
     WCHAR systemDirectoryStr[MAX_PATH];
 
     if (GetSystemDirectory(systemDirectoryStr, _countof(systemDirectoryStr)) == 0)
diff --git a/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp b/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp
index dc9ec17bd9..203fb60628 100644
--- a/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp
@@ -234,7 +234,7 @@ bool PluginPackage::load()
         m_loadCount++;
         return true;
     } else {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
         m_module = ::LoadLibraryW(m_path.charactersWithNullTermination());
 #else
         WCHAR currentPath[MAX_PATH];
@@ -267,7 +267,7 @@ bool PluginPackage::load()
     NP_InitializeFuncPtr NP_Initialize = 0;
     NPError npErr;
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     NP_Initialize = (NP_InitializeFuncPtr)GetProcAddress(m_module, L"NP_Initialize");
     NP_GetEntryPoints = (NP_GetEntryPointsFuncPtr)GetProcAddress(m_module, L"NP_GetEntryPoints");
     m_NPP_Shutdown = (NPP_ShutdownProcPtr)GetProcAddress(m_module, L"NP_Shutdown");
@@ -335,4 +335,8 @@ bool PluginPackage::equal(const PluginPackage& a, const PluginPackage& b)
     return true;
 }
 
+uint16 PluginPackage::NPVersion() const
+{
+    return NP_VERSION_MINOR;
+}
 }
diff --git a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
index ab71273bcb..01e425f2c9 100644
--- a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
@@ -26,61 +26,73 @@
  */
 
 #include "config.h"
-
 #include "PluginView.h"
 
 #include "BitmapImage.h"
-#include "BitmapInfo.h"
+#include "Bridge.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
 #include "EventNames.h"
-#include "FrameLoader.h"
+#include "FocusController.h"
+#include "Frame.h"
 #include "FrameLoadRequest.h"
+#include "FrameLoader.h"
 #include "FrameTree.h"
-#include "Frame.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
-#include "Image.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
+#include "HostWindow.h"
+#include "Image.h"
+#include "JSDOMBinding.h"
 #include "JSDOMWindow.h"
 #include "KeyboardEvent.h"
 #include "MIMETypeRegistry.h"
 #include "MouseEvent.h"
 #include "Page.h"
-#include "FocusController.h"
 #include "PlatformMouseEvent.h"
+#include "PluginDatabase.h"
+#include "PluginDebug.h"
+#include "PluginMainThreadScheduler.h"
 #include "PluginMessageThrottlerWin.h"
 #include "PluginPackage.h"
-#include "PluginMainThreadScheduler.h"
 #include "RenderWidget.h"
-#include "JSDOMBinding.h"
 #include "ScriptController.h"
-#include "PluginDatabase.h"
-#include "PluginDebug.h"
-#include "PluginPackage.h"
+#include "Settings.h"
+#include "WebCoreInstanceHandle.h"
 #include "c_instance.h"
 #include "npruntime_impl.h"
 #include "runtime_root.h"
-#include "Settings.h"
-#include "runtime.h"
 #include <runtime/JSLock.h>
 #include <runtime/JSValue.h>
 #include <wtf/ASCIICType.h>
 
-#if PLATFORM(WINCE)
+#if !PLATFORM(WX)
+#include "BitmapInfo.h"
+#endif
+
+#if OS(WINCE)
 #undef LOG_NPERROR
 #define LOG_NPERROR(x)
 #undef LOG_PLUGIN_NET_ERROR
 #define LOG_PLUGIN_NET_ERROR()
 #endif
 
+#if PLATFORM(CAIRO)
+#include <cairo-win32.h>
+#endif
+
 #if PLATFORM(QT)
 #include "QWebPageClient.h"
 #include <QWidget>
 #endif
 
+#if PLATFORM(WX)
+#include <wx/defs.h>
+#include <wx/window.h>
+#endif
+
 static inline HWND windowHandleForPageClient(PlatformPageClient client)
 {
 #if PLATFORM(QT)
@@ -89,6 +101,10 @@ static inline HWND windowHandleForPageClient(PlatformPageClient client)
     if (QWidget* pluginParent = qobject_cast<QWidget*>(client->pluginParent()))
         return pluginParent->winId();
     return 0;
+#elif PLATFORM(WX)
+    if (!client)
+        return 0;
+    return (HWND)client->GetHandle();
 #else
     return client;
 #endif
@@ -110,7 +126,7 @@ using namespace HTMLNames;
 const LPCWSTR kWebPluginViewdowClassName = L"WebPluginView";
 const LPCWSTR kWebPluginViewProperty = L"WebPluginViewProperty";
 
-#if !PLATFORM(WINCE)
+#if !OS(WINCE)
 // The code used to hook BeginPaint/EndPaint originally came from
 // <http://www.fengyuan.com/article/wmprint.html>.
 // Copyright (C) 2000 by Feng Yuan (www.fengyuan.com).
@@ -124,7 +140,7 @@ static BYTE* endPaint;
 typedef HDC (WINAPI *PtrBeginPaint)(HWND, PAINTSTRUCT*);
 typedef BOOL (WINAPI *PtrEndPaint)(HWND, const PAINTSTRUCT*);
 
-#if PLATFORM(WIN_OS) && PLATFORM(X86_64) && COMPILER(MSVC)
+#if OS(WINDOWS) && PLATFORM(X86_64) && COMPILER(MSVC)
 extern "C" HDC __stdcall _HBeginPaint(HWND hWnd, LPPAINTSTRUCT lpPaint);
 extern "C" BOOL __stdcall _HEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint);
 #endif
@@ -273,12 +289,12 @@ static bool registerPluginView()
     haveRegisteredWindowClass = true;
 
 #if PLATFORM(QT)
-    Page::setInstanceHandle((HINSTANCE)(qWinAppInst()));
+    WebCore::setInstanceHandle((HINSTANCE)(qWinAppInst()));
 #endif
 
-    ASSERT(Page::instanceHandle());
+    ASSERT(WebCore::instanceHandle());
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     WNDCLASS wcex = { 0 };
 #else
     WNDCLASSEX wcex;
@@ -287,20 +303,20 @@ static bool registerPluginView()
 #endif
 
     wcex.style          = CS_DBLCLKS;
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     wcex.style          |= CS_PARENTDC;
 #endif
     wcex.lpfnWndProc    = DefWindowProc;
     wcex.cbClsExtra     = 0;
     wcex.cbWndExtra     = 0;
-    wcex.hInstance      = Page::instanceHandle();
+    wcex.hInstance      = WebCore::instanceHandle();
     wcex.hIcon          = 0;
     wcex.hCursor        = LoadCursor(0, IDC_ARROW);
     wcex.hbrBackground  = (HBRUSH)COLOR_WINDOW;
     wcex.lpszMenuName   = 0;
     wcex.lpszClassName  = kWebPluginViewdowClassName;
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     return !!RegisterClass(&wcex);
 #else
     return !!RegisterClassEx(&wcex);
@@ -376,7 +392,7 @@ PluginView::wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
         m_popPopupsStateTimer.startOneShot(0);
     }
 
-#if !PLATFORM(WINCE)
+#if !OS(WINCE)
     if (message == WM_PRINTCLIENT) {
         // Most (all?) windowed plugins don't respond to WM_PRINTCLIENT, so we
         // change the message to WM_PAINT and rely on our hooked versions of
@@ -407,7 +423,7 @@ void PluginView::updatePluginWidget()
     IntRect oldWindowRect = m_windowRect;
     IntRect oldClipRect = m_clipRect;
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     m_windowRect = frameView->contentsToWindow(frameRect());
 #else
     m_windowRect = IntRect(frameView->contentsToWindow(frameRect().location()), frameRect().size());
@@ -510,7 +526,7 @@ void PluginView::paintIntoTransformedContext(HDC hdc)
 
     WINDOWPOS windowpos = { 0 };
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     IntRect r = static_cast<FrameView*>(parent())->contentsToWindow(frameRect());
 
     windowpos.x = r.x();
@@ -547,7 +563,7 @@ void PluginView::paintIntoTransformedContext(HDC hdc)
 
 void PluginView::paintWindowedPluginIntoContext(GraphicsContext* context, const IntRect& rect)
 {
-#if !PLATFORM(WINCE)
+#if !OS(WINCE)
     ASSERT(m_isWindowed);
     ASSERT(context->shouldIncludeChildWindows());
 
@@ -556,14 +572,22 @@ void PluginView::paintWindowedPluginIntoContext(GraphicsContext* context, const
 
     HDC hdc = context->getWindowsContext(frameRect(), false);
 
+#if PLATFORM(CAIRO)
+    // Must flush drawings up to this point to the backing metafile, otherwise the
+    // plugin region will be overwritten with any clear regions specified in the
+    // cairo-controlled portions of the rendering.
+    PlatformGraphicsContext* ctx = context->platformContext();
+    cairo_show_page(ctx);
+#endif
+
     XFORM originalTransform;
     GetWorldTransform(hdc, &originalTransform);
 
     // The plugin expects the DC to be in client coordinates, so we translate
     // the DC to make that so.
-    XFORM transform = originalTransform;
-    transform.eDx = locationInWindow.x();
-    transform.eDy = locationInWindow.y();
+    AffineTransform ctm = context->getCTM();
+    ctm.translate(locationInWindow.x(), locationInWindow.y());
+    XFORM transform = static_cast<XFORM>(ctm.toTransformationMatrix());
 
     SetWorldTransform(hdc, &transform);
 
@@ -587,7 +611,7 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
         return;
 
     if (m_isWindowed) {
-#if !PLATFORM(WINCE)
+#if !OS(WINCE)
         if (context->shouldIncludeChildWindows())
             paintWindowedPluginIntoContext(context, rect);
 #endif
@@ -602,7 +626,7 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     // of the window and the plugin expects that the passed in DC has window coordinates.
     // In the Qt port we always draw in an offscreen buffer and therefore need to preserve
     // the translation set in getWindowsContext.
-#if !PLATFORM(QT) && !PLATFORM(WINCE)
+#if !PLATFORM(QT) && !OS(WINCE)
     if (!context->inTransparencyLayer()) {
         XFORM transform;
         GetWorldTransform(hdc, &transform);
@@ -636,7 +660,7 @@ void PluginView::handleKeyboardEvent(KeyboardEvent* event)
         event->setDefaultHandled();
 }
 
-#if !PLATFORM(WINCE)
+#if !OS(WINCE)
 extern HCURSOR lastSetCursor;
 extern bool ignoreNextSetCursor;
 #endif
@@ -704,7 +728,7 @@ void PluginView::handleMouseEvent(MouseEvent* event)
     if (!dispatchNPEvent(npEvent))
         event->setDefaultHandled();
 
-#if !PLATFORM(QT) && !PLATFORM(WINCE)
+#if !PLATFORM(QT) && !PLATFORM(WX) && !OS(WINCE)
     // Currently, Widget::setCursor is always called after this function in EventHandler.cpp
     // and since we don't want that we set ignoreNextSetCursor to true here to prevent that.
     ignoreNextSetCursor = true;
@@ -716,7 +740,7 @@ void PluginView::setParent(ScrollView* parent)
 {
     Widget::setParent(parent);
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     if (parent) {
         init();
         if (parent->isVisible())
@@ -761,7 +785,7 @@ void PluginView::setNPWindowRect(const IntRect& rect)
     if (!m_isStarted)
         return;
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     IntRect r = static_cast<FrameView*>(parent())->contentsToWindow(rect);
     m_npWindow.x = r.x();
     m_npWindow.y = r.y();
@@ -796,7 +820,7 @@ void PluginView::setNPWindowRect(const IntRect& rect)
 
         ASSERT(platformPluginWidget());
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
         if (!m_pluginWndProc) {
             WNDPROC currentWndProc = (WNDPROC)GetWindowLong(platformPluginWidget(), GWL_WNDPROC);
             if (currentWndProc != PluginViewWndProc)
@@ -843,73 +867,30 @@ NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const c
     return NPERR_NO_ERROR;
 }
 
-NPError PluginView::getValueStatic(NPNVariable variable, void* value)
+bool PluginView::platformGetValueStatic(NPNVariable, void*, NPError*)
 {
-    LOG(Plugins, "PluginView::getValueStatic(%s)", prettyNameForNPNVariable(variable).data());
-
-    return NPERR_GENERIC_ERROR;
+    return false;
 }
 
-NPError PluginView::getValue(NPNVariable variable, void* value)
+bool PluginView::platformGetValue(NPNVariable variable, void* value, NPError* result)
 {
-    LOG(Plugins, "PluginView::getValue(%s)", prettyNameForNPNVariable(variable).data());
-
     switch (variable) {
-#if ENABLE(NETSCAPE_PLUGIN_API)
-        case NPNVWindowNPObject: {
-            if (m_isJavaScriptPaused)
-                return NPERR_GENERIC_ERROR;
-
-            NPObject* windowScriptObject = m_parentFrame->script()->windowScriptNPObject();
-
-            // Return value is expected to be retained, as described here: <http://www.mozilla.org/projects/plugin/npruntime.html>
-            if (windowScriptObject)
-                _NPN_RetainObject(windowScriptObject);
-
-            void** v = (void**)value;
-            *v = windowScriptObject;
-
-            return NPERR_NO_ERROR;
-        }
-
-        case NPNVPluginElementNPObject: {
-            if (m_isJavaScriptPaused)
-                return NPERR_GENERIC_ERROR;
-
-            NPObject* pluginScriptObject = 0;
-
-            if (m_element->hasTagName(appletTag) || m_element->hasTagName(embedTag) || m_element->hasTagName(objectTag))
-                pluginScriptObject = static_cast<HTMLPlugInElement*>(m_element)->getNPObject();
-
-            // Return value is expected to be retained, as described here: <http://www.mozilla.org/projects/plugin/npruntime.html>
-            if (pluginScriptObject)
-                _NPN_RetainObject(pluginScriptObject);
-
-            void** v = (void**)value;
-            *v = pluginScriptObject;
-
-            return NPERR_NO_ERROR;
-        }
-#endif
-
         case NPNVnetscapeWindow: {
             HWND* w = reinterpret_cast<HWND*>(value);
-
             *w = windowHandleForPageClient(parent() ? parent()->hostWindow()->platformPageClient() : 0);
-
-            return NPERR_NO_ERROR;
+            *result = NPERR_NO_ERROR;
+            return true;
         }
 
         case NPNVSupportsWindowless: {
-            NPBool *result = reinterpret_cast<NPBool*>(value);
-
-            *result = TRUE;
-            
-            return NPERR_NO_ERROR;
+            NPBool* flag = reinterpret_cast<NPBool*>(value);
+            *flag = TRUE;
+            *result = NPERR_NO_ERROR;
+            return true;
         }
 
-        default:
-            return NPERR_GENERIC_ERROR;
+    default:
+        return false;
     }
 }
 
@@ -977,7 +958,7 @@ bool PluginView::platformStart()
 
     if (m_isWindowed) {
         registerPluginView();
-#if !PLATFORM(WINCE)
+#if !OS(WINCE)
         setUpOffscreenPaintingHooks(hookedBeginPaint, hookedEndPaint);
 #endif
 
@@ -987,9 +968,9 @@ bool PluginView::platformStart()
 
         HWND parentWindowHandle = windowHandleForPageClient(m_parentFrame->view()->hostWindow()->platformPageClient());
         HWND window = ::CreateWindowEx(0, kWebPluginViewdowClassName, 0, flags,
-                                       0, 0, 0, 0, parentWindowHandle, 0, Page::instanceHandle(), 0);
+                                       0, 0, 0, 0, parentWindowHandle, 0, WebCore::instanceHandle(), 0);
 
-#if PLATFORM(WIN_OS) && PLATFORM(QT)
+#if OS(WINDOWS) && (PLATFORM(QT) || PLATFORM(WX))
         m_window = window;
 #else
         setPlatformWidget(window);
@@ -997,9 +978,9 @@ bool PluginView::platformStart()
 
         // Calling SetWindowLongPtrA here makes the window proc ASCII, which is required by at least
         // the Shockwave Director plug-in.
-#if PLATFORM(WIN_OS) && PLATFORM(X86_64) && COMPILER(MSVC)
+#if OS(WINDOWS) && PLATFORM(X86_64) && COMPILER(MSVC)
         ::SetWindowLongPtrA(platformPluginWidget(), GWLP_WNDPROC, (LONG_PTR)DefWindowProcA);
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
         ::SetWindowLong(platformPluginWidget(), GWL_WNDPROC, (LONG)DefWindowProc);
 #else
         ::SetWindowLongPtrA(platformPluginWidget(), GWL_WNDPROC, (LONG)DefWindowProcA);
@@ -1032,6 +1013,7 @@ void PluginView::platformDestroy()
 
 PassRefPtr<Image> PluginView::snapshot()
 {
+#if !PLATFORM(WX)
     OwnPtr<HDC> hdc(CreateCompatibleDC(0));
 
     if (!m_isWindowed) {
@@ -1061,6 +1043,9 @@ PassRefPtr<Image> PluginView::snapshot()
     SelectObject(hdc.get(), hbmpOld);
 
     return BitmapImage::create(hbmp.get());
+#else
+    return 0;
+#endif
 }
 
 void PluginView::halt()
diff --git a/src/3rdparty/webkit/WebCore/rendering/AutoTableLayout.cpp b/src/3rdparty/webkit/WebCore/rendering/AutoTableLayout.cpp
index 3749782ff5..fdbec52a3b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/AutoTableLayout.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/AutoTableLayout.cpp
@@ -382,7 +382,7 @@ int AutoTableLayout::calcEffectiveWidth()
                 float spanMax = max(maxWidth, cMaxWidth);
                 tMaxWidth = max(tMaxWidth, spanMax * 100 * percentScaleFactor / w.rawValue());
 
-                // all non percent columns in the span get percent vlaues to sum up correctly.
+                // all non percent columns in the span get percent values to sum up correctly.
                 int percentMissing = w.rawValue() - totalPercent;
                 float totalWidth = 0;
                 for (unsigned int pos = col; pos < lastCol; pos++) {
@@ -664,8 +664,8 @@ void AutoTableLayout::layout()
         }
     }
 
-    // if we have overallocated, reduce every cell according to the difference between desired width and minwidth
-    // this seems to produce to the pixel exaxt results with IE. Wonder is some of this also holds for width distributing.
+    // If we have overallocated, reduce every cell according to the difference between desired width and minwidth
+    // this seems to produce to the pixel exact results with IE. Wonder is some of this also holds for width distributing.
     if (available < 0) {
         // Need to reduce cells with the following prioritization:
         // (1) Auto
diff --git a/src/3rdparty/webkit/WebCore/rendering/AutoTableLayout.h b/src/3rdparty/webkit/WebCore/rendering/AutoTableLayout.h
index 641a68b952..f1ef7681db 100644
--- a/src/3rdparty/webkit/WebCore/rendering/AutoTableLayout.h
+++ b/src/3rdparty/webkit/WebCore/rendering/AutoTableLayout.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2002 Lars Knoll (knoll@kde.org)
  *           (C) 2002 Dirk Mueller (mueller@kde.org)
  *
diff --git a/src/3rdparty/webkit/WebCore/rendering/BidiRun.cpp b/src/3rdparty/webkit/WebCore/rendering/BidiRun.cpp
new file mode 100644
index 0000000000..ac130469b3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/BidiRun.cpp
@@ -0,0 +1,74 @@
+/**
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "BidiRun.h"
+#include "InlineBox.h"
+#include "RenderArena.h"
+#include <wtf/RefCountedLeakCounter.h>
+
+using namespace WTF;
+
+namespace WebCore {
+
+#ifndef NDEBUG
+static RefCountedLeakCounter bidiRunCounter("BidiRun");
+
+static bool inBidiRunDestroy;
+#endif
+
+void BidiRun::destroy()
+{
+#ifndef NDEBUG
+    inBidiRunDestroy = true;
+#endif
+    RenderArena* renderArena = m_object->renderArena();
+    delete this;
+#ifndef NDEBUG
+    inBidiRunDestroy = false;
+#endif
+
+    // Recover the size left there for us by operator delete and free the memory.
+    renderArena->free(*reinterpret_cast<size_t*>(this), this);
+}
+
+void* BidiRun::operator new(size_t sz, RenderArena* renderArena) throw()
+{
+#ifndef NDEBUG
+    bidiRunCounter.increment();
+#endif
+    return renderArena->allocate(sz);
+}
+
+void BidiRun::operator delete(void* ptr, size_t sz)
+{
+#ifndef NDEBUG
+    bidiRunCounter.decrement();
+#endif
+    ASSERT(inBidiRunDestroy);
+
+    // Stash size where destroy() can find it.
+    *(size_t*)ptr = sz;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/rendering/BidiRun.h b/src/3rdparty/webkit/WebCore/rendering/BidiRun.h
new file mode 100644
index 0000000000..542081a720
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/BidiRun.h
@@ -0,0 +1,65 @@
+/**
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef BidiRun_h
+#define BidiRun_h
+
+#include <wtf/StdLibExtras.h>
+#include "BidiResolver.h"
+#include "RenderText.h"
+
+namespace WebCore {
+
+class BidiContext;
+class InlineBox;
+
+struct BidiRun : BidiCharacterRun {
+    BidiRun(int start, int stop, RenderObject* object, BidiContext* context, WTF::Unicode::Direction dir)
+        : BidiCharacterRun(start, stop, context, dir)
+        , m_object(object)
+        , m_box(0)
+    {
+    }
+
+    void destroy();
+
+    // Overloaded new operator.
+    void* operator new(size_t, RenderArena*) throw();
+
+    // Overridden to prevent the normal delete from being called.
+    void operator delete(void*, size_t);
+
+    BidiRun* next() { return static_cast<BidiRun*>(m_next); }
+
+private:
+    // The normal operator new is disallowed.
+    void* operator new(size_t) throw();
+
+public:
+    RenderObject* m_object;
+    InlineBox* m_box;
+};
+
+}
+
+#endif // BidiRun_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp b/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp
index f546abb113..c164c81a48 100644
--- a/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
  *
@@ -24,20 +22,14 @@
 #include "config.h"
 #include "CounterNode.h"
 
+#include "RenderCounter.h"
 #include "RenderObject.h"
 #include <stdio.h>
 
-// FIXME: There's currently no strategy for getting the counter tree updated when new
-// elements with counter-reset and counter-increment styles are added to the render tree.
-// Also, the code can't handle changes where an existing node needs to change into a
-// "reset" node, or from a "reset" node back to not a "reset" node. As of this writing,
-// at least some of these problems manifest as failures in the t1204-increment and
-// t1204-reset tests in the CSS 2.1 test suite.
-
 namespace WebCore {
 
-CounterNode::CounterNode(RenderObject* o, bool isReset, int value)
-    : m_isReset(isReset)
+CounterNode::CounterNode(RenderObject* o, bool hasResetType, int value)
+    : m_hasResetType(hasResetType)
     , m_value(value)
     , m_countInParent(0)
     , m_renderer(o)
@@ -46,38 +38,95 @@ CounterNode::CounterNode(RenderObject* o, bool isReset, int value)
     , m_nextSibling(0)
     , m_firstChild(0)
     , m_lastChild(0)
-{   
+{
+}
+
+CounterNode* CounterNode::nextInPreOrderAfterChildren(const CounterNode* stayWithin) const
+{
+    if (this == stayWithin)
+        return 0;
+
+    const CounterNode* current = this;
+    CounterNode* next;
+    while (!(next = current->m_nextSibling)) {
+        current = current->m_parent;
+        if (!current || current == stayWithin)
+            return 0;
+    }
+    return next;
+}
+
+CounterNode* CounterNode::nextInPreOrder(const CounterNode* stayWithin) const
+{
+    if (CounterNode* next = m_firstChild)
+        return next;
+
+    return nextInPreOrderAfterChildren(stayWithin);
+}
+
+CounterNode* CounterNode::lastDescendant() const
+{
+    CounterNode* last = m_lastChild;
+    if (!last)
+        return 0;
+
+    while (CounterNode* lastChild = last->m_lastChild)
+        last = lastChild;
+
+    return last;
+}
+
+CounterNode* CounterNode::previousInPreOrder() const
+{
+    CounterNode* previous = m_previousSibling;
+    if (!previous)
+        return m_parent;
+
+    while (CounterNode* lastChild = previous->m_lastChild)
+        previous = lastChild;
+
+    return previous;
 }
 
 int CounterNode::computeCountInParent() const
 {
-    int increment = m_isReset ? 0 : m_value;
+    int increment = actsAsReset() ? 0 : m_value;
     if (m_previousSibling)
         return m_previousSibling->m_countInParent + increment;
     ASSERT(m_parent->m_firstChild == this);
     return m_parent->m_value + increment;
 }
 
-void CounterNode::recount()
+void CounterNode::resetRenderer(const AtomicString& identifier) const
 {
-    for (CounterNode* c = this; c; c = c->m_nextSibling) {
-        int oldCount = c->m_countInParent;
-        int newCount = c->computeCountInParent();
+    if (!m_renderer || m_renderer->documentBeingDestroyed())
+        return;
+    if (RenderObjectChildList* children = m_renderer->virtualChildren())
+        children->invalidateCounters(m_renderer, identifier);
+}
+
+void CounterNode::resetRenderers(const AtomicString& identifier) const
+{
+    const CounterNode* node = this;
+    do {
+        node->resetRenderer(identifier);
+        node = node->nextInPreOrder(this);
+    } while (node);
+}
+
+void CounterNode::recount(const AtomicString& identifier)
+{
+    for (CounterNode* node = this; node; node = node->m_nextSibling) {
+        int oldCount = node->m_countInParent;
+        int newCount = node->computeCountInParent();
         if (oldCount == newCount)
             break;
-        c->m_countInParent = newCount;
-        // m_renderer contains the parent of the render node
-        // corresponding to a CounterNode. Let's find the counter
-        // child and make this re-layout.
-        for (RenderObject* o = c->m_renderer->firstChild(); o; o = o->nextSibling())
-            if (!o->documentBeingDestroyed() && o->isCounter()) {
-                o->setNeedsLayoutAndPrefWidthsRecalc();
-                break;
-            }
+        node->m_countInParent = newCount;
+        node->resetRenderers(identifier);
     }
 }
 
-void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild)
+void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild, const AtomicString& identifier)
 {
     ASSERT(newChild);
     ASSERT(!newChild->m_parent);
@@ -85,6 +134,11 @@ void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild)
     ASSERT(!newChild->m_nextSibling);
     ASSERT(!refChild || refChild->m_parent == this);
 
+    if (newChild->m_hasResetType) {
+        while (m_lastChild != refChild)
+            RenderCounter::destroyCounterNode(m_lastChild->renderer(), identifier);
+    }
+
     CounterNode* next;
 
     if (refChild) {
@@ -95,91 +149,106 @@ void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild)
         m_firstChild = newChild;
     }
 
-    if (next) {
-        ASSERT(next->m_previousSibling == refChild);
-        next->m_previousSibling = newChild;
-    } else {
-        ASSERT(m_lastChild == refChild);
-        m_lastChild = newChild;
-    }
-
     newChild->m_parent = this;
     newChild->m_previousSibling = refChild;
-    newChild->m_nextSibling = next;
 
-    newChild->m_countInParent = newChild->computeCountInParent();
+    if (!newChild->m_firstChild || newChild->m_hasResetType) {
+        newChild->m_nextSibling = next;
+        if (next) {
+            ASSERT(next->m_previousSibling == refChild);
+            next->m_previousSibling = newChild;
+        } else {
+            ASSERT(m_lastChild == refChild);
+            m_lastChild = newChild;
+        }
+
+        newChild->m_countInParent = newChild->computeCountInParent();
+        newChild->resetRenderers(identifier);
+        if (next)
+            next->recount(identifier);
+        return;
+    }
+
+    // The code below handles the case when a formerly root increment counter is loosing its root position
+    // and therefore its children become next siblings.
+    CounterNode* last = newChild->m_lastChild;
+    CounterNode* first = newChild->m_firstChild;
+
+    newChild->m_nextSibling = first;
+    first->m_previousSibling = newChild;
+    // The case when the original next sibling of the inserted node becomes a child of
+    // one of the former children of the inserted node is not handled as it is believed
+    // to be impossible since:
+    // 1. if the increment counter node lost it's root position as a result of another
+    //    counter node being created, it will be inserted as the last child so next is null.
+    // 2. if the increment counter node lost it's root position as a result of a renderer being
+    //    inserted into the document's render tree, all its former children counters are attached
+    //    to children of the inserted renderer and hence cannot be in scope for counter nodes
+    //    attached to renderers that were already in the document's render tree.
+    last->m_nextSibling = next;
     if (next)
-        next->recount();
+        next->m_previousSibling = last;
+    else
+        m_lastChild = last;
+    for (next = first; ; next = next->m_nextSibling) {
+        next->m_parent = this;
+        if (last == next)
+            break;
+    }
+    newChild->m_firstChild = 0;
+    newChild->m_lastChild = 0;
+    newChild->m_countInParent = newChild->computeCountInParent();
+    newChild->resetRenderer(identifier);
+    first->recount(identifier);
 }
 
-void CounterNode::removeChild(CounterNode* oldChild)
+void CounterNode::removeChild(CounterNode* oldChild, const AtomicString& identifier)
 {
     ASSERT(oldChild);
     ASSERT(!oldChild->m_firstChild);
     ASSERT(!oldChild->m_lastChild);
 
     CounterNode* next = oldChild->m_nextSibling;
-    CounterNode* prev = oldChild->m_previousSibling;
+    CounterNode* previous = oldChild->m_previousSibling;
 
     oldChild->m_nextSibling = 0;
     oldChild->m_previousSibling = 0;
     oldChild->m_parent = 0;
 
-    if (prev) 
-        prev->m_nextSibling = next;
+    if (previous) 
+        previous->m_nextSibling = next;
     else {
         ASSERT(m_firstChild == oldChild);
         m_firstChild = next;
     }
-    
+
     if (next)
-        next->m_previousSibling = prev;
+        next->m_previousSibling = previous;
     else {
         ASSERT(m_lastChild == oldChild);
-        m_lastChild = prev;
+        m_lastChild = previous;
     }
-    
+
     if (next)
-        next->recount();
+        next->recount(identifier);
 }
 
 #ifndef NDEBUG
 
-static const CounterNode* nextInPreOrderAfterChildren(const CounterNode* node)
-{
-    CounterNode* next = node->nextSibling();
-    if (!next) {
-        next = node->parent();
-        while (next && !next->nextSibling())
-            next = next->parent();
-        if (next)
-            next = next->nextSibling();
-    }
-    return next;
-}
-
-static const CounterNode* nextInPreOrder(const CounterNode* node)
-{
-    if (CounterNode* child = node->firstChild())
-        return child;
-    return nextInPreOrderAfterChildren(node);
-}
-
 static void showTreeAndMark(const CounterNode* node)
 {
     const CounterNode* root = node;
     while (root->parent())
         root = root->parent();
 
-    for (const CounterNode* c = root; c; c = nextInPreOrder(c)) {
-        if (c == node)
-            fprintf(stderr, "*");
-        for (const CounterNode* d = c; d && d != root; d = d->parent())
-            fprintf(stderr, "\t");
-        if (c->isReset())
-            fprintf(stderr, "reset: %d %d\n", c->value(), c->countInParent());
-        else
-            fprintf(stderr, "increment: %d %d\n", c->value(), c->countInParent());
+    for (const CounterNode* current = root; current; current = current->nextInPreOrder()) {
+        fwrite((current == node) ? "*" : " ", 1, 1, stderr);
+        for (const CounterNode* parent = current; parent && parent != root; parent = parent->parent())
+            fwrite("  ", 1, 2, stderr);
+        fprintf(stderr, "%p %s: %d %d P:%p PS:%p NS:%p R:%p\n",
+            current, current->actsAsReset() ? "reset____" : "increment", current->value(),
+            current->countInParent(), current->parent(), current->previousSibling(),
+            current->nextSibling(), current->renderer());
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/CounterNode.h b/src/3rdparty/webkit/WebCore/rendering/CounterNode.h
index b432e1d5ce..15f2eb8f19 100644
--- a/src/3rdparty/webkit/WebCore/rendering/CounterNode.h
+++ b/src/3rdparty/webkit/WebCore/rendering/CounterNode.h
@@ -35,13 +35,15 @@
 
 namespace WebCore {
 
+class AtomicString;
 class RenderObject;
 
 class CounterNode : public Noncopyable {
 public:
     CounterNode(RenderObject*, bool isReset, int value);
 
-    bool isReset() const { return m_isReset; }
+    bool actsAsReset() const { return m_hasResetType || !m_parent; }
+    bool hasResetType() const { return m_hasResetType; }
     int value() const { return m_value; }
     int countInParent() const { return m_countInParent; }
     RenderObject* renderer() const { return m_renderer; }
@@ -51,15 +53,30 @@ public:
     CounterNode* nextSibling() const { return m_nextSibling; }
     CounterNode* firstChild() const { return m_firstChild; }
     CounterNode* lastChild() const { return m_lastChild; }
+    CounterNode* lastDescendant() const;
+    CounterNode* previousInPreOrder() const;
+    CounterNode* nextInPreOrder(const CounterNode* stayWithin = 0) const;
+    CounterNode* nextInPreOrderAfterChildren(const CounterNode* stayWithin = 0) const;
 
-    void insertAfter(CounterNode* newChild, CounterNode* beforeChild);
-    void removeChild(CounterNode*);
+    void insertAfter(CounterNode* newChild, CounterNode* beforeChild, const AtomicString& identifier);
+
+    // identifier must match the identifier of this counter.
+    void removeChild(CounterNode*, const AtomicString& identifier);
 
 private:
     int computeCountInParent() const;
-    void recount();
+    void recount(const AtomicString& identifier);
+
+    // Invalidates the text in the renderer of this counter, if any.
+    // identifier must match the identifier of this counter.
+    void resetRenderer(const AtomicString& identifier) const;
+
+    // Invalidates the text in the renderer of this counter, if any,
+    // and in the renderers of all descendants of this counter, if any.
+    // identifier must match the identifier of this counter.
+    void resetRenderers(const AtomicString& identifier) const;
 
-    bool m_isReset;
+    bool m_hasResetType;
     int m_value;
     int m_countInParent;
     RenderObject* m_renderer;
diff --git a/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.cpp b/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.cpp
index db9a101fde..6ec31950ce 100644
--- a/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.cpp
@@ -1,6 +1,4 @@
 /**
-* This file is part of the html renderer for KDE.
- *
  * Copyright (C) 2003, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
@@ -25,6 +23,7 @@
 #include "Document.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
+#include "RootInlineBox.h"
 
 namespace WebCore {
 
@@ -34,17 +33,30 @@ void EllipsisBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     RenderStyle* style = m_renderer->style(m_firstLine);
     Color textColor = style->color();
     if (textColor != context->fillColor())
-        context->setFillColor(textColor);
+        context->setFillColor(textColor, style->colorSpace());
     bool setShadow = false;
     if (style->textShadow()) {
         context->setShadow(IntSize(style->textShadow()->x, style->textShadow()->y),
-                           style->textShadow()->blur, style->textShadow()->color);
+                           style->textShadow()->blur, style->textShadow()->color, style->colorSpace());
         setShadow = true;
     }
 
+    if (selectionState() != RenderObject::SelectionNone) {
+        paintSelection(context, tx, ty, style, style->font());
+
+        // Select the correct color for painting the text.
+        Color foreground = paintInfo.forceBlackText ? Color::black : renderer()->selectionForegroundColor();
+        if (foreground.isValid() && foreground != textColor)
+            context->setFillColor(foreground, style->colorSpace());
+    }
+
     const String& str = m_str;
     context->drawText(style->font(), TextRun(str.characters(), str.length(), false, 0, 0, false, style->visuallyOrdered()), IntPoint(m_x + tx, m_y + ty + style->font().ascent()));
 
+    // Restore the regular fill color.
+    if (textColor != context->fillColor())
+        context->setFillColor(textColor, style->colorSpace());
+
     if (setShadow)
         context->clearShadow();
 
@@ -56,6 +68,35 @@ void EllipsisBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     }
 }
 
+IntRect EllipsisBox::selectionRect(int tx, int ty)
+{
+    RenderStyle* style = m_renderer->style(m_firstLine);
+    const Font& f = style->font();
+    return enclosingIntRect(f.selectionRectForText(TextRun(m_str.characters(), m_str.length(), false, 0, 0, false, style->visuallyOrdered()),
+            IntPoint(m_x + tx, m_y + ty + root()->selectionTop()), root()->selectionHeight()));
+}
+
+void EllipsisBox::paintSelection(GraphicsContext* context, int tx, int ty, RenderStyle* style, const Font& font)
+{
+    Color textColor = style->color();
+    Color c = m_renderer->selectionBackgroundColor();
+    if (!c.isValid() || !c.alpha())
+        return;
+
+    // If the text color ends up being the same as the selection background, invert the selection
+    // background.
+    if (textColor == c)
+        c = Color(0xff - c.red(), 0xff - c.green(), 0xff - c.blue());
+
+    context->save();
+    int y = root()->selectionTop();
+    int h = root()->selectionHeight();
+    context->clip(IntRect(m_x + tx, y + ty, m_width, h));
+    context->drawHighlightForText(font, TextRun(m_str.characters(), m_str.length(), false, 0, 0, false, style->visuallyOrdered()),
+        IntPoint(m_x + tx, m_y + ty + y), h, c, style->colorSpace());
+    context->restore();
+}
+
 bool EllipsisBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty)
 {
     tx += m_x;
diff --git a/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.h b/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.h
index 9dbd27f994..087fc722c8 100644
--- a/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.h
@@ -1,6 +1,4 @@
 /**
-* This file is part of the html renderer for KDE.
- *
  * Copyright (C) 2003, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
@@ -37,18 +35,24 @@ public:
         , m_height(height)
         , m_str(ellipsisStr)
         , m_markupBox(markupBox)
+        , m_selectionState(RenderObject::SelectionNone)
     {
     }
 
     virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty);
+    void setSelectionState(RenderObject::SelectionState s) { m_selectionState = s; }
+    IntRect selectionRect(int tx, int ty);
 
 private:
     virtual int height() const { return m_height; }
+    virtual RenderObject::SelectionState selectionState() { return m_selectionState; }
+    void paintSelection(GraphicsContext*, int tx, int ty, RenderStyle*, const Font&);
 
     int m_height;
     AtomicString m_str;
     InlineBox* m_markupBox;
+    RenderObject::SelectionState m_selectionState;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp b/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp
index 4852708eba..09af518c43 100644
--- a/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2002 Lars Knoll (knoll@kde.org)
  *           (C) 2002 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2006 Apple Computer, Inc.
diff --git a/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.h b/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.h
index ed7c089e09..758ddbb3f2 100644
--- a/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.h
+++ b/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2002 Lars Knoll (knoll@kde.org)
  *           (C) 2002 Dirk Mueller (mueller@kde.org)
  *
diff --git a/src/3rdparty/webkit/WebCore/rendering/HitTestRequest.h b/src/3rdparty/webkit/WebCore/rendering/HitTestRequest.h
index 46dd7b8af1..ca1445ae02 100644
--- a/src/3rdparty/webkit/WebCore/rendering/HitTestRequest.h
+++ b/src/3rdparty/webkit/WebCore/rendering/HitTestRequest.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
  *
diff --git a/src/3rdparty/webkit/WebCore/rendering/HitTestResult.h b/src/3rdparty/webkit/WebCore/rendering/HitTestResult.h
index 25e10585c5..d1906ba64b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/HitTestResult.h
+++ b/src/3rdparty/webkit/WebCore/rendering/HitTestResult.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
index baea956bc0..23dc4e7ba6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
@@ -165,7 +165,7 @@ void InlineFlowBox::attachLineBoxToRenderObject()
 
 void InlineFlowBox::adjustPosition(int dx, int dy)
 {
-    InlineRunBox::adjustPosition(dx, dy);
+    InlineBox::adjustPosition(dx, dy);
     for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
         child->adjustPosition(dx, dy);
     if (m_overflow)
@@ -429,7 +429,7 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
                 }
                 lineHeight = baseline + baselineToBottom;
             } else if (parentLineHeight.isPercent()) {
-                lineHeight = parentLineHeight.calcMinValue(curr->renderer()->style()->fontSize(), true);
+                lineHeight = parentLineHeight.calcMinValue(curr->renderer()->style()->fontSize());
                 baseline = 0;
                 for (size_t i = 0; i < usedFonts.size(); ++i) {
                     int halfLeading = (lineHeight - usedFonts[i]->ascent() - usedFonts[i]->descent()) / 2;
@@ -532,9 +532,6 @@ void InlineFlowBox::computeVerticalOverflow(int lineTop, int lineBottom, bool st
 
     // Any spillage outside of the line top and bottom is not considered overflow.  We just ignore this, since it only happens
     // from the "your ascent/descent don't affect the line" quirk.
-    // FIXME: Technically this means there can be repaint errors in the case where a line box has a shadow or background that spills
-    // outside of the block. We should consider making any line box that has anything to render just stop respecting the quirk or making
-    // boxes that render something set visual overflow.
     int topOverflow = max(y(), lineTop);
     int bottomOverflow = min(y() + boxHeight, lineBottom);
     
@@ -706,11 +703,11 @@ void InlineFlowBox::paintFillLayer(const RenderObject::PaintInfo& paintInfo, con
         // FIXME: What the heck do we do with RTL here? The math we're using is obviously not right,
         // but it isn't even clear how this should work at all.
         int xOffsetOnLine = 0;
-        for (InlineRunBox* curr = prevLineBox(); curr; curr = curr->prevLineBox())
+        for (InlineFlowBox* curr = prevLineBox(); curr; curr = curr->prevLineBox())
             xOffsetOnLine += curr->width();
         int startX = tx - xOffsetOnLine;
         int totalWidth = xOffsetOnLine;
-        for (InlineRunBox* curr = this; curr; curr = curr->nextLineBox())
+        for (InlineFlowBox* curr = this; curr; curr = curr->nextLineBox())
             totalWidth += curr->width();
         paintInfo.context->save();
         paintInfo.context->clip(IntRect(tx, ty, width(), height()));
@@ -735,13 +732,24 @@ void InlineFlowBox::paintBoxDecorations(RenderObject::PaintInfo& paintInfo, int
     if (!renderer()->shouldPaintWithinRoot(paintInfo) || renderer()->style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseForeground)
         return;
 
-    // Move x/y to our coordinates.
-    tx += m_x;
-    ty += m_y;
-    
+    int x = m_x;
+    int y = m_y;
     int w = width();
     int h = height();
 
+    // Constrain our background/border painting to the line top and bottom if necessary.
+    bool strictMode = renderer()->document()->inStrictMode();
+    if (!hasTextChildren() && !strictMode) {
+        RootInlineBox* rootBox = root();
+        int bottom = min(rootBox->lineBottom(), y + h);
+        y = max(rootBox->lineTop(), y);
+        h = bottom - y;
+    }
+    
+    // Move x/y to our coordinates.
+    tx += x;
+    ty += y;
+    
     GraphicsContext* context = paintInfo.context;
     
     // You can use p::first-line to specify a background. If so, the root line boxes for
@@ -780,11 +788,11 @@ void InlineFlowBox::paintBoxDecorations(RenderObject::PaintInfo& paintInfo, int
                 // FIXME: What the heck do we do with RTL here? The math we're using is obviously not right,
                 // but it isn't even clear how this should work at all.
                 int xOffsetOnLine = 0;
-                for (InlineRunBox* curr = prevLineBox(); curr; curr = curr->prevLineBox())
+                for (InlineFlowBox* curr = prevLineBox(); curr; curr = curr->prevLineBox())
                     xOffsetOnLine += curr->width();
                 int startX = tx - xOffsetOnLine;
                 int totalWidth = xOffsetOnLine;
-                for (InlineRunBox* curr = this; curr; curr = curr->nextLineBox())
+                for (InlineFlowBox* curr = this; curr; curr = curr->nextLineBox())
                     totalWidth += curr->width();
                 context->save();
                 context->clip(IntRect(tx, ty, w, h));
@@ -800,13 +808,24 @@ void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty
     if (!renderer()->shouldPaintWithinRoot(paintInfo) || renderer()->style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseMask)
         return;
 
-    // Move x/y to our coordinates.
-    tx += m_x;
-    ty += m_y;
-    
+    int x = m_x;
+    int y = m_y;
     int w = width();
     int h = height();
 
+    // Constrain our background/border painting to the line top and bottom if necessary.
+    bool strictMode = renderer()->document()->inStrictMode();
+    if (!hasTextChildren() && !strictMode) {
+        RootInlineBox* rootBox = root();
+        int bottom = min(rootBox->lineBottom(), y + h);
+        y = max(rootBox->lineTop(), y);
+        h = bottom - y;
+    }
+    
+    // Move x/y to our coordinates.
+    tx += x;
+    ty += y;
+
     const NinePieceImage& maskNinePieceImage = renderer()->style()->maskBoxImage();
     StyleImage* maskBoxImage = renderer()->style()->maskBoxImage().image();
 
@@ -840,11 +859,11 @@ void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty
         // We have a mask image that spans multiple lines.
         // We need to adjust _tx and _ty by the width of all previous lines.
         int xOffsetOnLine = 0;
-        for (InlineRunBox* curr = prevLineBox(); curr; curr = curr->prevLineBox())
+        for (InlineFlowBox* curr = prevLineBox(); curr; curr = curr->prevLineBox())
             xOffsetOnLine += curr->width();
         int startX = tx - xOffsetOnLine;
         int totalWidth = xOffsetOnLine;
-        for (InlineRunBox* curr = this; curr; curr = curr->nextLineBox())
+        for (InlineFlowBox* curr = this; curr; curr = curr->nextLineBox())
             totalWidth += curr->width();
         paintInfo.context->save();
         paintInfo.context->clip(IntRect(tx, ty, w, h));
@@ -974,6 +993,7 @@ void InlineFlowBox::paintTextDecorations(RenderObject::PaintInfo& paintInfo, int
             setClip = true;
         }
 
+        ColorSpace colorSpace = renderer()->style()->colorSpace();
         bool setShadow = false;
         do {
             if (shadow) {
@@ -982,24 +1002,24 @@ void InlineFlowBox::paintTextDecorations(RenderObject::PaintInfo& paintInfo, int
                     ty -= extraOffset;
                     extraOffset = 0;
                 }
-                context->setShadow(IntSize(shadow->x, shadow->y - extraOffset), shadow->blur, shadow->color);
+                context->setShadow(IntSize(shadow->x, shadow->y - extraOffset), shadow->blur, shadow->color, colorSpace);
                 setShadow = true;
                 shadow = shadow->next;
             }
 
             if (paintUnderline) {
-                context->setStrokeColor(underline);
+                context->setStrokeColor(underline, colorSpace);
                 context->setStrokeStyle(SolidStroke);
                 // Leave one pixel of white between the baseline and the underline.
                 context->drawLineForText(IntPoint(tx, ty + baselinePos + 1), w, isPrinting);
             }
             if (paintOverline) {
-                context->setStrokeColor(overline);
+                context->setStrokeColor(overline, colorSpace);
                 context->setStrokeStyle(SolidStroke);
                 context->drawLineForText(IntPoint(tx, ty), w, isPrinting);
             }
             if (paintLineThrough) {
-                context->setStrokeColor(linethrough);
+                context->setStrokeColor(linethrough, colorSpace);
                 context->setStrokeStyle(SolidStroke);
                 context->drawLineForText(IntPoint(tx, ty + 2 * baselinePos / 3), w, isPrinting);
             }
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h
index 23b5cc99e2..ecb4724b0d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h
@@ -21,7 +21,7 @@
 #ifndef InlineFlowBox_h
 #define InlineFlowBox_h
 
-#include "InlineRunBox.h"
+#include "InlineBox.h"
 #include "RenderOverflow.h"
 
 namespace WebCore {
@@ -30,12 +30,14 @@ class HitTestRequest;
 class HitTestResult;
 class RenderLineBoxList;
 
-class InlineFlowBox : public InlineRunBox {
+class InlineFlowBox : public InlineBox {
 public:
     InlineFlowBox(RenderObject* obj)
-        : InlineRunBox(obj)
+        : InlineBox(obj)
         , m_firstChild(0)
         , m_lastChild(0)
+        , m_prevLineBox(0)
+        , m_nextLineBox(0)
         , m_includeLeftEdge(false)
         , m_includeRightEdge(false)
 #ifndef NDEBUG
@@ -54,8 +56,10 @@ public:
     virtual ~InlineFlowBox();
 #endif
 
-    InlineFlowBox* prevFlowBox() const { return static_cast<InlineFlowBox*>(m_prevLine); }
-    InlineFlowBox* nextFlowBox() const { return static_cast<InlineFlowBox*>(m_nextLine); }
+    InlineFlowBox* prevLineBox() const { return m_prevLineBox; }
+    InlineFlowBox* nextLineBox() const { return m_nextLineBox; }
+    void setNextLineBox(InlineFlowBox* n) { m_nextLineBox = n; }
+    void setPreviousLineBox(InlineFlowBox* p) { m_prevLineBox = p; }
 
     InlineBox* firstChild() const { checkConsistency(); return m_firstChild; }
     InlineBox* lastChild() const { checkConsistency(); return m_lastChild; }
@@ -164,12 +168,14 @@ public:
 protected:
     OwnPtr<RenderOverflow> m_overflow;
 
-private:
     virtual bool isInlineFlowBox() const { return true; }
 
     InlineBox* m_firstChild;
     InlineBox* m_lastChild;
     
+    InlineFlowBox* m_prevLineBox; // The previous box that also uses our RenderObject
+    InlineFlowBox* m_nextLineBox; // The next box that also uses our RenderObject
+
     bool m_includeLeftEdge : 1;
     bool m_includeRightEdge : 1;
     bool m_hasTextChildren : 1;
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineIterator.h b/src/3rdparty/webkit/WebCore/rendering/InlineIterator.h
new file mode 100644
index 0000000000..9310ea8ab8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineIterator.h
@@ -0,0 +1,266 @@
+/*
+ * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
+ * Copyright (C) 2003, 2004, 2006, 2007, 2008, 2009, 2010 Apple Inc. All right reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef InlineIterator_h
+#define InlineIterator_h
+
+#include "BidiRun.h"
+#include "RenderBlock.h"
+#include "RenderText.h"
+#include <wtf/AlwaysInline.h>
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+class InlineIterator {
+public:
+    InlineIterator()
+        : block(0)
+        , obj(0)
+        , pos(0)
+        , nextBreakablePosition(-1)
+    {
+    }
+
+    InlineIterator(RenderBlock* b, RenderObject* o, unsigned p)
+        : block(b)
+        , obj(o)
+        , pos(p)
+        , nextBreakablePosition(-1)
+    {
+    }
+
+    void increment(InlineBidiResolver* resolver = 0);
+    bool atEnd() const;
+
+    UChar current() const;
+    WTF::Unicode::Direction direction() const;
+
+    RenderBlock* block;
+    RenderObject* obj;
+    unsigned pos;
+    int nextBreakablePosition;
+};
+
+inline bool operator==(const InlineIterator& it1, const InlineIterator& it2)
+{
+    return it1.pos == it2.pos && it1.obj == it2.obj;
+}
+
+inline bool operator!=(const InlineIterator& it1, const InlineIterator& it2)
+{
+    return it1.pos != it2.pos || it1.obj != it2.obj;
+}
+
+static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current, InlineBidiResolver* resolver = 0, bool skipInlines = true, bool* endOfInlinePtr = 0)
+{
+    RenderObject* next = 0;
+    bool oldEndOfInline = endOfInlinePtr ? *endOfInlinePtr : false;
+    bool endOfInline = false;
+
+    while (current) {
+        next = 0;
+        if (!oldEndOfInline && !current->isFloating() && !current->isReplaced() && !current->isPositioned() && !current->isText()) {
+            next = current->firstChild();
+            if (next && resolver && next->isRenderInline()) {
+                EUnicodeBidi ub = next->style()->unicodeBidi();
+                if (ub != UBNormal) {
+                    TextDirection dir = next->style()->direction();
+                    WTF::Unicode::Direction d = (ub == Embed
+                        ? (dir == RTL ? WTF::Unicode::RightToLeftEmbedding : WTF::Unicode::LeftToRightEmbedding)
+                        : (dir == RTL ? WTF::Unicode::RightToLeftOverride : WTF::Unicode::LeftToRightOverride));
+                    resolver->embed(d);
+                }
+            }
+        }
+
+        if (!next) {
+            if (!skipInlines && !oldEndOfInline && current->isRenderInline()) {
+                next = current;
+                endOfInline = true;
+                break;
+            }
+
+            while (current && current != block) {
+                if (resolver && current->isRenderInline() && current->style()->unicodeBidi() != UBNormal)
+                    resolver->embed(WTF::Unicode::PopDirectionalFormat);
+
+                next = current->nextSibling();
+                if (next) {
+                    if (resolver && next->isRenderInline()) {
+                        EUnicodeBidi ub = next->style()->unicodeBidi();
+                        if (ub != UBNormal) {
+                            TextDirection dir = next->style()->direction();
+                            WTF::Unicode::Direction d = (ub == Embed
+                                ? (dir == RTL ? WTF::Unicode::RightToLeftEmbedding: WTF::Unicode::LeftToRightEmbedding)
+                                : (dir == RTL ? WTF::Unicode::RightToLeftOverride : WTF::Unicode::LeftToRightOverride));
+                            resolver->embed(d);
+                        }
+                    }
+                    break;
+                }
+                
+                current = current->parent();
+                if (!skipInlines && current && current != block && current->isRenderInline()) {
+                    next = current;
+                    endOfInline = true;
+                    break;
+                }
+            }
+        }
+
+        if (!next)
+            break;
+
+        if (next->isText() || next->isFloating() || next->isReplaced() || next->isPositioned()
+            || ((!skipInlines || !next->firstChild()) // Always return EMPTY inlines.
+                && next->isRenderInline()))
+            break;
+        current = next;
+    }
+
+    if (endOfInlinePtr)
+        *endOfInlinePtr = endOfInline;
+
+    return next;
+}
+
+static inline RenderObject* bidiFirst(RenderBlock* block, InlineBidiResolver* resolver, bool skipInlines = true)
+{
+    if (!block->firstChild())
+        return 0;
+    
+    RenderObject* o = block->firstChild();
+    if (o->isRenderInline()) {
+        if (resolver) {
+            EUnicodeBidi ub = o->style()->unicodeBidi();
+            if (ub != UBNormal) {
+                TextDirection dir = o->style()->direction();
+                WTF::Unicode::Direction d = (ub == Embed
+                    ? (dir == RTL ? WTF::Unicode::RightToLeftEmbedding : WTF::Unicode::LeftToRightEmbedding)
+                    : (dir == RTL ? WTF::Unicode::RightToLeftOverride : WTF::Unicode::LeftToRightOverride));
+                resolver->embed(d);
+            }
+        }
+        if (skipInlines && o->firstChild())
+            o = bidiNext(block, o, resolver, skipInlines);
+        else {
+            // Never skip empty inlines.
+            if (resolver)
+                resolver->commitExplicitEmbedding();
+            return o; 
+        }
+    }
+
+    if (o && !o->isText() && !o->isReplaced() && !o->isFloating() && !o->isPositioned())
+        o = bidiNext(block, o, resolver, skipInlines);
+
+    if (resolver)
+        resolver->commitExplicitEmbedding();
+    return o;
+}
+
+inline void InlineIterator::increment(InlineBidiResolver* resolver)
+{
+    if (!obj)
+        return;
+    if (obj->isText()) {
+        pos++;
+        if (pos >= toRenderText(obj)->textLength()) {
+            obj = bidiNext(block, obj, resolver);
+            pos = 0;
+            nextBreakablePosition = -1;
+        }
+    } else {
+        obj = bidiNext(block, obj, resolver);
+        pos = 0;
+        nextBreakablePosition = -1;
+    }
+}
+
+inline bool InlineIterator::atEnd() const
+{
+    return !obj;
+}
+
+inline UChar InlineIterator::current() const
+{
+    if (!obj || !obj->isText())
+        return 0;
+
+    RenderText* text = toRenderText(obj);
+    if (pos >= text->textLength())
+        return 0;
+
+    return text->characters()[pos];
+}
+
+ALWAYS_INLINE WTF::Unicode::Direction InlineIterator::direction() const
+{
+    if (UChar c = current())
+        return WTF::Unicode::direction(c);
+
+    if (obj && obj->isListMarker())
+        return obj->style()->direction() == LTR ? WTF::Unicode::LeftToRight : WTF::Unicode::RightToLeft;
+
+    return WTF::Unicode::OtherNeutral;
+}
+
+template<>
+inline void InlineBidiResolver::increment()
+{
+    current.increment(this);
+}
+
+template <>
+inline void InlineBidiResolver::appendRun()
+{
+    if (!emptyRun && !eor.atEnd()) {
+        int start = sor.pos;
+        RenderObject *obj = sor.obj;
+        while (obj && obj != eor.obj && obj != endOfLine.obj) {
+            RenderBlock::appendRunsForObject(start, obj->length(), obj, *this);        
+            start = 0;
+            obj = bidiNext(sor.block, obj);
+        }
+        if (obj) {
+            unsigned pos = obj == eor.obj ? eor.pos : UINT_MAX;
+            if (obj == endOfLine.obj && endOfLine.pos <= pos) {
+                reachedEndOfLine = true;
+                pos = endOfLine.pos;
+            }
+            // It's OK to add runs for zero-length RenderObjects, just don't make the run larger than it should be
+            int end = obj->length() ? pos+1 : 0;
+            RenderBlock::appendRunsForObject(start, end, obj, *this);
+        }
+        
+        eor.increment();
+        sor = eor;
+    }
+
+    m_direction = WTF::Unicode::OtherNeutral;
+    m_status.eor = WTF::Unicode::OtherNeutral;
+}
+
+}
+
+#endif // InlineIterator_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineRunBox.h b/src/3rdparty/webkit/WebCore/rendering/InlineRunBox.h
deleted file mode 100644
index 0f7c29bf1b..0000000000
--- a/src/3rdparty/webkit/WebCore/rendering/InlineRunBox.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * This file is part of the line box implementation for KDE.
- *
- * Copyright (C) 2003, 2006 Apple Computer, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef InlineRunBox_h
-#define InlineRunBox_h
-
-#include "InlineBox.h"
-
-namespace WebCore {
-
-class InlineRunBox : public InlineBox {
-public:
-    InlineRunBox(RenderObject* obj)
-        : InlineBox(obj)
-        , m_prevLine(0)
-        , m_nextLine(0)
-    {
-    }
-
-    InlineRunBox* prevLineBox() const { return m_prevLine; }
-    InlineRunBox* nextLineBox() const { return m_nextLine; }
-    void setNextLineBox(InlineRunBox* n) { m_nextLine = n; }
-    void setPreviousLineBox(InlineRunBox* p) { m_prevLine = p; }
-
-    virtual void paintBoxDecorations(RenderObject::PaintInfo&, int /*tx*/, int /*ty*/) { }
-    virtual void paintTextDecorations(RenderObject::PaintInfo&, int /*tx*/, int /*ty*/, bool /*paintedChildren*/ = false) { }
-    
-protected:
-    InlineRunBox* m_prevLine;  // The previous box that also uses our RenderObject
-    InlineRunBox* m_nextLine;  // The next box that also uses our RenderObject
-};
-
-} // namespace WebCore
-
-#endif // InlineRunBox_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.cpp b/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.cpp
index 751340d5f4..9f17b0c05d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.cpp
@@ -23,9 +23,11 @@
 #include "config.h"
 #include "InlineTextBox.h"
 
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "Document.h"
 #include "Editor.h"
+#include "EllipsisBox.h"
 #include "Frame.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
@@ -81,6 +83,23 @@ RenderObject::SelectionState InlineTextBox::selectionState()
         else if (state == RenderObject::SelectionBoth)
             state = RenderObject::SelectionNone;
     }
+
+    // If there are ellipsis following, make sure their selection is updated.
+    if (m_truncation != cNoTruncation && root()->ellipsisBox()) {
+        EllipsisBox* ellipsis = root()->ellipsisBox();
+        if (state != RenderObject::SelectionNone) {
+            int start, end;
+            selectionStartEnd(start, end);
+            // The ellipsis should be considered to be selected if the end of
+            // the selection is past the beginning of the truncation and the
+            // beginning of the selection is before or at the beginning of the
+            // truncation.
+            ellipsis->setSelectionState(end >= m_truncation && start <= m_truncation ?
+                RenderObject::SelectionInside : RenderObject::SelectionNone);
+        } else
+            ellipsis->setSelectionState(RenderObject::SelectionNone);
+    }
+
     return state;
 }
 
@@ -89,7 +108,7 @@ IntRect InlineTextBox::selectionRect(int tx, int ty, int startPos, int endPos)
     int sPos = max(startPos - m_start, 0);
     int ePos = min(endPos - m_start, (int)m_len);
     
-    if (sPos >= ePos)
+    if (sPos > ePos)
         return IntRect();
 
     RenderText* textObj = textRenderer();
@@ -214,7 +233,7 @@ Color correctedTextColor(Color textColor, Color backgroundColor)
     return textColor.light();
 }
 
-void updateGraphicsContext(GraphicsContext* context, const Color& fillColor, const Color& strokeColor, float strokeThickness)
+void updateGraphicsContext(GraphicsContext* context, const Color& fillColor, const Color& strokeColor, float strokeThickness, ColorSpace colorSpace)
 {
     int mode = context->textDrawingMode();
     if (strokeThickness > 0) {
@@ -225,12 +244,12 @@ void updateGraphicsContext(GraphicsContext* context, const Color& fillColor, con
         }
     }
     
-    if (mode & cTextFill && fillColor != context->fillColor())
-        context->setFillColor(fillColor);
+    if (mode & cTextFill && (fillColor != context->fillColor() || colorSpace != context->fillColorSpace()))
+        context->setFillColor(fillColor, colorSpace);
 
     if (mode & cTextStroke) {
         if (strokeColor != context->strokeColor())
-            context->setStrokeColor(strokeColor);
+            context->setStrokeColor(strokeColor, colorSpace);
         if (strokeThickness != context->strokeThickness())
             context->setStrokeThickness(strokeThickness);
     }
@@ -254,12 +273,13 @@ bool InlineTextBox::nodeAtPoint(const HitTestRequest&, HitTestResult& result, in
     return false;
 }
 
-static void paintTextWithShadows(GraphicsContext* context, const Font& font, const TextRun& textRun, int startOffset, int endOffset, const IntPoint& textOrigin, int x, int y, int w, int h, ShadowData* shadow, bool stroked)
+static void paintTextWithShadows(GraphicsContext* context, const Font& font, const TextRun& textRun, int startOffset, int endOffset, int truncationPoint, const IntPoint& textOrigin, int x, int y, int w, int h, ShadowData* shadow, bool stroked)
 {
     Color fillColor = context->fillColor();
+    ColorSpace fillColorSpace = context->fillColorSpace();
     bool opaque = fillColor.alpha() == 255;
     if (!opaque)
-        context->setFillColor(Color::black);
+        context->setFillColor(Color::black, fillColorSpace);
 
     do {
         IntSize extraOffset;
@@ -279,17 +299,17 @@ static void paintTextWithShadows(GraphicsContext* context, const Font& font, con
                 extraOffset = IntSize(0, 2 * h + max(0, shadowOffset.height()) + shadowBlur);
                 shadowOffset -= extraOffset;
             }
-            context->setShadow(shadowOffset, shadowBlur, shadowColor);
+            context->setShadow(shadowOffset, shadowBlur, shadowColor, fillColorSpace);
         } else if (!opaque)
-            context->setFillColor(fillColor);
+            context->setFillColor(fillColor, fillColorSpace);
 
         if (startOffset <= endOffset)
             context->drawText(font, textRun, textOrigin + extraOffset, startOffset, endOffset);
         else {
             if (endOffset > 0)
                 context->drawText(font, textRun, textOrigin + extraOffset,  0, endOffset);
-            if (startOffset < textRun.length())
-                context->drawText(font, textRun, textOrigin + extraOffset, startOffset);
+            if (startOffset < truncationPoint)
+                context->drawText(font, textRun, textOrigin + extraOffset, startOffset, truncationPoint);
         }
 
         if (!shadow)
@@ -459,18 +479,25 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     if (paintSelectedTextOnly || paintSelectedTextSeparately)
         selectionStartEnd(sPos, ePos);
 
+    int length = m_len;
+    if (m_truncation != cNoTruncation) {
+        sPos = min<int>(sPos, m_truncation);
+        ePos = min<int>(ePos, m_truncation);
+        length = m_truncation;
+    }
+
     if (!paintSelectedTextOnly) {
         // For stroked painting, we have to change the text drawing mode.  It's probably dangerous to leave that mutated as a side
         // effect, so only when we know we're stroking, do a save/restore.
         if (textStrokeWidth > 0)
             context->save();
 
-        updateGraphicsContext(context, textFillColor, textStrokeColor, textStrokeWidth);
+        updateGraphicsContext(context, textFillColor, textStrokeColor, textStrokeWidth, styleToUse->colorSpace());
         if (!paintSelectedTextSeparately || ePos <= sPos) {
             // FIXME: Truncate right-to-left text correctly.
-            paintTextWithShadows(context, font, textRun, 0, m_truncation == cNoTruncation ? m_len : m_truncation, textOrigin, m_x + tx, m_y + ty, width(), height(), textShadow, textStrokeWidth > 0);
+            paintTextWithShadows(context, font, textRun, 0, length, length, textOrigin, m_x + tx, m_y + ty, width(), height(), textShadow, textStrokeWidth > 0);
         } else
-            paintTextWithShadows(context, font, textRun, ePos, sPos, textOrigin, m_x + tx, m_y + ty, width(), height(), textShadow, textStrokeWidth > 0);
+            paintTextWithShadows(context, font, textRun, ePos, sPos, length, textOrigin, m_x + tx, m_y + ty, width(), height(), textShadow, textStrokeWidth > 0);
 
         if (textStrokeWidth > 0)
             context->restore();
@@ -481,8 +508,8 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
         if (selectionStrokeWidth > 0)
             context->save();
 
-        updateGraphicsContext(context, selectionFillColor, selectionStrokeColor, selectionStrokeWidth);
-        paintTextWithShadows(context, font, textRun, sPos, ePos, textOrigin, m_x + tx, m_y + ty, width(), height(), selectionShadow, selectionStrokeWidth > 0);
+        updateGraphicsContext(context, selectionFillColor, selectionStrokeColor, selectionStrokeWidth, styleToUse->colorSpace());
+        paintTextWithShadows(context, font, textRun, sPos, ePos, length, textOrigin, m_x + tx, m_y + ty, width(), height(), selectionShadow, selectionStrokeWidth > 0);
 
         if (selectionStrokeWidth > 0)
             context->restore();
@@ -490,7 +517,7 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 
     // Paint decorations
     if (d != TDNONE && paintInfo.phase != PaintPhaseSelection && styleToUse->htmlHacks()) {
-        context->setStrokeColor(styleToUse->color());
+        context->setStrokeColor(styleToUse->color(), styleToUse->colorSpace());
         paintDecoration(context, tx, ty, d, textShadow);
     }
 
@@ -561,13 +588,16 @@ void InlineTextBox::paintSelection(GraphicsContext* context, int tx, int ty, Ren
         c = Color(0xff - c.red(), 0xff - c.green(), 0xff - c.blue());
 
     context->save();
-    updateGraphicsContext(context, c, c, 0);  // Don't draw text at all!
+    updateGraphicsContext(context, c, c, 0, style->colorSpace());  // Don't draw text at all!
     int y = selectionTop();
     int h = selectionHeight();
+    // If the text is truncated, let the thing being painted in the truncation
+    // draw its own highlight.
+    int length = m_truncation != cNoTruncation ? m_truncation : m_len;
     context->clip(IntRect(m_x + tx, y + ty, m_width, h));
-    context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, 
+    context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, length, textRenderer()->allowTabs(), textPos(), m_toAdd, 
                                   direction() == RTL, m_dirOverride || style->visuallyOrdered()),
-                                  IntPoint(m_x + tx, y + ty), h, c, sPos, ePos);
+                                  IntPoint(m_x + tx, y + ty), h, c, style->colorSpace(), sPos, ePos);
     context->restore();
 }
 
@@ -584,13 +614,13 @@ void InlineTextBox::paintCompositionBackground(GraphicsContext* context, int tx,
 
     Color c = Color(225, 221, 85);
     
-    updateGraphicsContext(context, c, c, 0); // Don't draw text at all!
+    updateGraphicsContext(context, c, c, 0, style->colorSpace()); // Don't draw text at all!
 
     int y = selectionTop();
     int h = selectionHeight();
     context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd,
                                   direction() == RTL, m_dirOverride || style->visuallyOrdered()),
-                                  IntPoint(m_x + tx, y + ty), h, c, sPos, ePos);
+                                  IntPoint(m_x + tx, y + ty), h, c, style->colorSpace(), sPos, ePos);
     context->restore();
 }
 
@@ -660,6 +690,7 @@ void InlineTextBox::paintDecoration(GraphicsContext* context, int tx, int ty, in
         setClip = true;
     }
 
+    ColorSpace colorSpace = renderer()->style()->colorSpace();
     bool setShadow = false;
     
     do {
@@ -669,24 +700,24 @@ void InlineTextBox::paintDecoration(GraphicsContext* context, int tx, int ty, in
                 ty -= extraOffset;
                 extraOffset = 0;
             }
-            context->setShadow(IntSize(shadow->x, shadow->y - extraOffset), shadow->blur, shadow->color);
+            context->setShadow(IntSize(shadow->x, shadow->y - extraOffset), shadow->blur, shadow->color, colorSpace);
             setShadow = true;
             shadow = shadow->next;
         }
 
         if (deco & UNDERLINE) {
-            context->setStrokeColor(underline);
+            context->setStrokeColor(underline, colorSpace);
             context->setStrokeStyle(SolidStroke);
             // Leave one pixel of white between the baseline and the underline.
             context->drawLineForText(IntPoint(tx, ty + baseline + 1), width, isPrinting);
         }
         if (deco & OVERLINE) {
-            context->setStrokeColor(overline);
+            context->setStrokeColor(overline, colorSpace);
             context->setStrokeStyle(SolidStroke);
             context->drawLineForText(IntPoint(tx, ty), width, isPrinting);
         }
         if (deco & LINE_THROUGH) {
-            context->setStrokeColor(linethrough);
+            context->setStrokeColor(linethrough, colorSpace);
             context->setStrokeStyle(SolidStroke);
             context->drawLineForText(IntPoint(tx, ty + 2 * baseline / 3), width, isPrinting);
         }
@@ -698,7 +729,7 @@ void InlineTextBox::paintDecoration(GraphicsContext* context, int tx, int ty, in
         context->clearShadow();
 }
 
-void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, int ty, DocumentMarker marker, RenderStyle* style, const Font& font, bool grammar)
+void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, int ty, const DocumentMarker& marker, RenderStyle* style, const Font& font, bool grammar)
 {
     // Never print spelling/grammar markers (5327887)
     if (textRenderer()->document()->printing())
@@ -737,8 +768,11 @@ void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, in
         
         // Store rendered rects for bad grammar markers, so we can hit-test against it elsewhere in order to
         // display a toolTip. We don't do this for misspelling markers.
-        if (grammar)
+        if (grammar) {
+            markerRect.move(-tx, -ty);
+            markerRect = renderer()->localToAbsoluteQuad(FloatRect(markerRect)).enclosingBoundingBox();
             renderer()->document()->setRenderedRectForMarker(renderer()->node(), marker, markerRect);
+        }
     }
     
     // IMPORTANT: The misspelling underline is not considered when calculating the text bounds, so we have to
@@ -761,7 +795,7 @@ void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, in
     pt->drawLineForMisspellingOrBadGrammar(IntPoint(tx + m_x + start, ty + m_y + underlineOffset), width, grammar);
 }
 
-void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, DocumentMarker marker, RenderStyle* style, const Font& font)
+void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, const DocumentMarker& marker, RenderStyle* style, const Font& font)
 {
     // Use same y positioning and height as for selection, so that when the selection and this highlight are on
     // the same word there are no pieces sticking out.
@@ -771,10 +805,10 @@ void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, Do
     int sPos = max(marker.startOffset - m_start, (unsigned)0);
     int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
     TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered());
-    IntPoint startPoint = IntPoint(m_x + tx, y + ty);
     
-    // Always compute and store the rect associated with this marker
-    IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, startPoint, h, sPos, ePos));
+    // Always compute and store the rect associated with this marker. The computed rect is in absolute coordinates.
+    IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, IntPoint(m_x, y), h, sPos, ePos));
+    markerRect = renderer()->localToAbsoluteQuad(FloatRect(markerRect)).enclosingBoundingBox();
     renderer()->document()->setRenderedRectForMarker(renderer()->node(), marker, markerRect);
      
     // Optionally highlight the text
@@ -783,14 +817,14 @@ void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, Do
             renderer()->theme()->platformActiveTextSearchHighlightColor() :
             renderer()->theme()->platformInactiveTextSearchHighlightColor();
         pt->save();
-        updateGraphicsContext(pt, color, color, 0);  // Don't draw text at all!
+        updateGraphicsContext(pt, color, color, 0, style->colorSpace());  // Don't draw text at all!
         pt->clip(IntRect(tx + m_x, ty + y, m_width, h));
-        pt->drawHighlightForText(font, run, startPoint, h, color, sPos, ePos);
+        pt->drawHighlightForText(font, run, IntPoint(m_x + tx, y + ty), h, color, style->colorSpace(), sPos, ePos);
         pt->restore();
     }
 }
 
-void InlineTextBox::computeRectForReplacementMarker(int tx, int ty, DocumentMarker marker, RenderStyle* style, const Font& font)
+void InlineTextBox::computeRectForReplacementMarker(int /*tx*/, int /*ty*/, const DocumentMarker& marker, RenderStyle* style, const Font& font)
 {
     // Replacement markers are not actually drawn, but their rects need to be computed for hit testing.
     int y = selectionTop();
@@ -799,10 +833,11 @@ void InlineTextBox::computeRectForReplacementMarker(int tx, int ty, DocumentMark
     int sPos = max(marker.startOffset - m_start, (unsigned)0);
     int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
     TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered());
-    IntPoint startPoint = IntPoint(m_x + tx, y + ty);
+    IntPoint startPoint = IntPoint(m_x, y);
     
     // Compute and store the rect associated with this marker.
     IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, startPoint, h, sPos, ePos));
+    markerRect = renderer()->localToAbsoluteQuad(FloatRect(markerRect)).enclosingBoundingBox();
     renderer()->document()->setRenderedRectForMarker(renderer()->node(), marker, markerRect);
 }
     
@@ -817,7 +852,7 @@ void InlineTextBox::paintDocumentMarkers(GraphicsContext* pt, int tx, int ty, Re
     // Give any document markers that touch this run a chance to draw before the text has been drawn.
     // Note end() points at the last char, not one past it like endOffset and ranges do.
     for ( ; markerIt != markers.end(); markerIt++) {
-        DocumentMarker marker = *markerIt;
+        const DocumentMarker& marker = *markerIt;
         
         // Paint either the background markers or the foreground markers, but not both
         switch (marker.type) {
@@ -911,7 +946,7 @@ void InlineTextBox::paintCompositionUnderline(GraphicsContext* ctx, int tx, int
     start += 1;
     width -= 2;
 
-    ctx->setStrokeColor(underline.color);
+    ctx->setStrokeColor(underline.color, renderer()->style()->colorSpace());
     ctx->setStrokeThickness(lineThickness);
     ctx->drawLineForText(IntPoint(tx + start, ty + height() - lineThickness), width, textRenderer()->document()->printing());
 }
@@ -936,7 +971,7 @@ int InlineTextBox::textPos() const
     if (x() == 0)
         return 0;
         
-    RenderBlock *blockElement = renderer()->containingBlock();
+    RenderBlock* blockElement = renderer()->containingBlock();
     return direction() == RTL ? x() - blockElement->borderRight() - blockElement->paddingRight()
                       : x() - blockElement->borderLeft() - blockElement->paddingLeft();
 }
@@ -947,7 +982,7 @@ int InlineTextBox::offsetForPosition(int _x, bool includePartialGlyphs) const
         return 0;
 
     RenderText* text = toRenderText(renderer());
-    RenderStyle *style = text->style(m_firstLine);
+    RenderStyle* style = text->style(m_firstLine);
     const Font* f = &style->font();
     return f->offsetForPosition(TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered()),
                                 _x - m_x, includePartialGlyphs);
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.h b/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.h
index 3bbb4537ad..96ca4c3873 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.h
@@ -23,7 +23,7 @@
 #ifndef InlineTextBox_h
 #define InlineTextBox_h
 
-#include "InlineRunBox.h"
+#include "InlineBox.h"
 #include "RenderText.h" // so textRenderer() can be inline
 
 namespace WebCore {
@@ -34,21 +34,25 @@ const unsigned short cNoTruncation = USHRT_MAX;
 const unsigned short cFullTruncation = USHRT_MAX - 1;
 
 // Helper functions shared by InlineTextBox / SVGRootInlineBox
-void updateGraphicsContext(GraphicsContext* context, const Color& fillColor, const Color& strokeColor, float strokeThickness);
+void updateGraphicsContext(GraphicsContext*, const Color& fillColor, const Color& strokeColor, float strokeThickness, ColorSpace);
 Color correctedTextColor(Color textColor, Color backgroundColor);
 
-class InlineTextBox : public InlineRunBox {
+class InlineTextBox : public InlineBox {
 public:
     InlineTextBox(RenderObject* obj)
-        : InlineRunBox(obj)
+        : InlineBox(obj)
+        , m_prevTextBox(0)
+        , m_nextTextBox(0)
         , m_start(0)
         , m_len(0)
         , m_truncation(cNoTruncation)
     {
     }
 
-    InlineTextBox* nextTextBox() const { return static_cast<InlineTextBox*>(nextLineBox()); }
-    InlineTextBox* prevTextBox() const { return static_cast<InlineTextBox*>(prevLineBox()); }
+    InlineTextBox* prevTextBox() const { return m_prevTextBox; }
+    InlineTextBox* nextTextBox() const { return m_nextTextBox; }
+    void setNextTextBox(InlineTextBox* n) { m_nextTextBox = n; }
+    void setPreviousTextBox(InlineTextBox* p) { m_prevTextBox = p; }
 
     unsigned start() const { return m_start; }
     unsigned end() const { return m_len ? m_start + m_len - 1 : m_start; }
@@ -62,6 +66,8 @@ public:
     void setFallbackFonts(const HashSet<const SimpleFontData*>&);
     void takeFallbackFonts(Vector<const SimpleFontData*>&);
 
+    unsigned short truncation() { return m_truncation; }
+
 private:
     virtual int selectionTop();
     virtual int selectionHeight();
@@ -114,6 +120,9 @@ public:
     bool containsCaretOffset(int offset) const; // false for offset after line break
 
 private:
+    InlineTextBox* m_prevTextBox; // The previous box that also uses our RenderObject
+    InlineTextBox* m_nextTextBox; // The next box that also uses our RenderObject
+
     int m_start;
     unsigned short m_len;
 
@@ -131,9 +140,9 @@ protected:
 private:
     void paintDecoration(GraphicsContext*, int tx, int ty, int decoration, ShadowData*);
     void paintSelection(GraphicsContext*, int tx, int ty, RenderStyle*, const Font&);
-    void paintSpellingOrGrammarMarker(GraphicsContext*, int tx, int ty, DocumentMarker, RenderStyle*, const Font&, bool grammar);
-    void paintTextMatchMarker(GraphicsContext*, int tx, int ty, DocumentMarker, RenderStyle*, const Font&);
-    void computeRectForReplacementMarker(int tx, int ty, DocumentMarker, RenderStyle*, const Font&);
+    void paintSpellingOrGrammarMarker(GraphicsContext*, int tx, int ty, const DocumentMarker&, RenderStyle*, const Font&, bool grammar);
+    void paintTextMatchMarker(GraphicsContext*, int tx, int ty, const DocumentMarker&, RenderStyle*, const Font&);
+    void computeRectForReplacementMarker(int tx, int ty, const DocumentMarker&, RenderStyle*, const Font&);
 };
 
 inline RenderText* InlineTextBox::textRenderer() const
diff --git a/src/3rdparty/webkit/WebCore/rendering/LayoutState.cpp b/src/3rdparty/webkit/WebCore/rendering/LayoutState.cpp
index 883f74d563..c94e77b702 100644
--- a/src/3rdparty/webkit/WebCore/rendering/LayoutState.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/LayoutState.cpp
@@ -62,20 +62,17 @@ LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const IntSize&
     m_clipped = !fixed && prev->m_clipped;
     if (m_clipped)
         m_clipRect = prev->m_clipRect;
+
     if (renderer->hasOverflowClip()) {
-        int x = m_offset.width();
-        int y = m_offset.height();
         RenderLayer* layer = renderer->layer();
-        IntRect clipRect(x, y, layer->width(), layer->height());
-        clipRect.move(renderer->view()->layoutDelta());
+        IntRect clipRect(toPoint(m_offset) + renderer->view()->layoutDelta(), layer->size());
         if (m_clipped)
             m_clipRect.intersect(clipRect);
         else {
             m_clipRect = clipRect;
             m_clipped = true;
         }
-        layer->subtractScrolledContentOffset(x, y);
-        m_offset = IntSize(x, y);
+        m_offset -= layer->scrolledContentOffset();
     }
 
     m_layoutDelta = m_next->m_layoutDelta;
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
index 9611660427..569f214845 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
@@ -38,6 +38,7 @@
 #include "HTMLNames.h"
 #include "LocalizedStrings.h"
 #include "MouseEvent.h"
+#include "Page.h"
 #include "RenderMedia.h"
 #include "RenderSlider.h"
 #include "RenderTheme.h"
@@ -347,6 +348,9 @@ MediaControlInputElement::MediaControlInputElement(Document* document, PseudoId
     case MEDIA_CONTROLS_VOLUME_SLIDER:
         m_displayType = MediaVolumeSlider;
         break;
+    case MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON:
+        m_displayType = MediaShowClosedCaptionsButton;
+        break;
     default:
         ASSERT_NOT_REACHED();
         break;
@@ -500,7 +504,7 @@ void MediaControlSeekButtonElement::defaultEventHandler(Event* event)
             m_capturing = true;
             frame->eventHandler()->setCapturingMouseEventsNode(this);
         }
-        m_mediaElement->pause();
+        m_mediaElement->pause(event->fromUserGesture());
         m_seekTimer.startRepeating(cSeekRepeatDelay);
         event->setDefaultHandled();
     } else if (event->type() == eventNames().mouseupEvent) {
@@ -577,6 +581,29 @@ void MediaControlReturnToRealtimeButtonElement::defaultEventHandler(Event* event
 
 // ----------------------------
 
+MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCaptionsButtonElement(Document* doc, HTMLMediaElement* element)
+    : MediaControlInputElement(doc, MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON, "button", element)
+{
+}
+
+void MediaControlToggleClosedCaptionsButtonElement::defaultEventHandler(Event* event)
+{
+    if (event->type() == eventNames().clickEvent) {
+        m_mediaElement->setClosedCaptionsVisible(!m_mediaElement->closedCaptionsVisible());
+        setChecked(m_mediaElement->closedCaptionsVisible());
+        event->setDefaultHandled();
+    }
+    HTMLInputElement::defaultEventHandler(event);
+}
+
+void MediaControlToggleClosedCaptionsButtonElement::updateDisplayType()
+{
+    setDisplayType(m_mediaElement->closedCaptionsVisible() ? MediaHideClosedCaptionsButton : MediaShowClosedCaptionsButton);
+}
+
+
+// ----------------------------
+
 MediaControlTimelineElement::MediaControlTimelineElement(Document* document, HTMLMediaElement* element)
     : MediaControlInputElement(document, MEDIA_CONTROLS_TIMELINE, "range", element)
 {
@@ -588,6 +615,9 @@ void MediaControlTimelineElement::defaultEventHandler(Event* event)
     if (event->isMouseEvent() && static_cast<MouseEvent*>(event)->button())
         return;
 
+    if (!attached())
+        return;
+
     if (event->type() == eventNames().mousedownEvent)
         m_mediaElement->beginScrubbing();
 
@@ -633,6 +663,9 @@ void MediaControlVolumeSliderElement::defaultEventHandler(Event* event)
     if (event->isMouseEvent() && static_cast<MouseEvent*>(event)->button())
         return;
 
+    if (!attached())
+        return;
+
     MediaControlInputElement::defaultEventHandler(event);
 
     if (event->type() == eventNames().mouseoverEvent || event->type() == eventNames().mouseoutEvent || event->type() == eventNames().mousemoveEvent)
@@ -649,10 +682,9 @@ void MediaControlVolumeSliderElement::defaultEventHandler(Event* event)
 void MediaControlVolumeSliderElement::update()
 {
     float volume = m_mediaElement->volume();
-    if (value().toFloat() != volume) {
+    if (value().toFloat() != volume)
         setValue(String::number(volume));
-        MediaControlInputElement::update();
-    }
+    MediaControlInputElement::update();
 }
 
 // ----------------------------
@@ -705,30 +737,9 @@ void MediaControlTimeDisplayElement::setVisible(bool visible)
     renderer()->setStyle(style.get());
 }
 
-String MediaControlTimeDisplayElement::formatTime(float time)
-{
-    if (!isfinite(time))
-        time = 0;
-    int seconds = (int)fabsf(time);
-    int hours = seconds / (60 * 60);
-    int minutes = (seconds / 60) % 60;
-    seconds %= 60;
-    if (hours) {
-        if (hours > 9)
-            return String::format("%s%02d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
-
-        return String::format("%s%01d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
-    }
-
-    return String::format("%s%02d:%02d", (time < 0 ? "-" : ""), minutes, seconds);
-}
-
 void MediaControlTimeDisplayElement::setCurrentValue(float time)
 {
     m_currentValue = time;
-
-    ExceptionCode ec;
-    setInnerText(formatTime(m_currentValue), ec);
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
index 8b297733fd..21831ceef7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
@@ -54,6 +54,8 @@ enum MediaControlElementType {
     MediaSliderThumb,
     MediaRewindButton,
     MediaReturnToRealtimeButton,
+    MediaShowClosedCaptionsButton,
+    MediaHideClosedCaptionsButton,
     MediaUnMuteButton,
     MediaPauseButton,
     MediaTimelineContainer,
@@ -221,6 +223,15 @@ public:
 
 // ----------------------------
 
+class MediaControlToggleClosedCaptionsButtonElement : public MediaControlInputElement {
+public:
+    MediaControlToggleClosedCaptionsButtonElement(Document*, HTMLMediaElement*);
+    virtual void defaultEventHandler(Event*);
+    virtual void updateDisplayType();
+};    
+
+// ----------------------------
+
 class MediaControlTimelineElement : public MediaControlInputElement {
 public:
     MediaControlTimelineElement(Document*, HTMLMediaElement*);
@@ -257,8 +268,6 @@ public:
     float currentValue() const { return m_currentValue; }
 
 private:
-    String formatTime(float time);
-
     float m_currentValue;
     bool m_isVisible;
 };
diff --git a/src/3rdparty/webkit/WebCore/rendering/PointerEventsHitRules.cpp b/src/3rdparty/webkit/WebCore/rendering/PointerEventsHitRules.cpp
index 214fb096a0..ababcfd40f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/PointerEventsHitRules.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/PointerEventsHitRules.cpp
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/rendering/PointerEventsHitRules.h b/src/3rdparty/webkit/WebCore/rendering/PointerEventsHitRules.h
index 3d8939a76a..c17c19c7b7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/PointerEventsHitRules.h
+++ b/src/3rdparty/webkit/WebCore/rendering/PointerEventsHitRules.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderArena.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderArena.cpp
index 34325d4be9..1dafb2f1c5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderArena.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderArena.cpp
@@ -114,7 +114,7 @@ void RenderArena::free(size_t size, void* ptr)
     // Use standard free so that memory debugging tools work.
     RenderArenaDebugHeader* header = static_cast<RenderArenaDebugHeader*>(ptr) - 1;
     ASSERT(header->signature == signature);
-    ASSERT(header->size == size);
+    ASSERT_UNUSED(size, header->size == size);
     ASSERT(header->arena == this);
     header->signature = signatureDead;
     ::free(header);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderArena.h b/src/3rdparty/webkit/WebCore/rendering/RenderArena.h
index 3c27d15455..32139fbd77 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderArena.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderArena.h
@@ -36,12 +36,13 @@
 #define RenderArena_h
 
 #include "Arena.h"
+#include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
 static const size_t gMaxRecycledSize = 400;
 
-class RenderArena {
+class RenderArena : public Noncopyable {
 public:
     RenderArena(unsigned arenaSize = 4096);
     ~RenderArena();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp
index e05c8b4733..340d6b7927 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2006 Apple Computer, Inc.
  *
@@ -64,7 +62,7 @@ int RenderBR::lineHeight(bool firstLine, bool /*isRootLineBox*/) const
             return s->font().lineSpacing();
         }
         if (lh.isPercent())
-            return lh.calcMinValue(s->fontSize(), true);
+            return lh.calcMinValue(s->fontSize());
         return lh.value();
     }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBR.h b/src/3rdparty/webkit/WebCore/rendering/RenderBR.h
index 7eae8ea407..8850d4693f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBR.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBR.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  *
  * This library is free software; you can redistribute it and/or
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp
index d5bb7787c4..a7b8a0227f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -44,6 +44,7 @@
 #include "RenderView.h"
 #include "SelectionController.h"
 #include "Settings.h"
+#include "TransformState.h"
 #include <wtf/StdLibExtras.h>
 
 using namespace std;
@@ -58,13 +59,7 @@ static const int verticalLineClickFudgeFactor = 3;
 
 using namespace HTMLNames;
 
-static void moveChild(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* from, RenderObjectChildList* fromChildList, RenderObject* child)
-{
-    ASSERT(from == child->parent());
-    toChildList->appendChildNode(to, fromChildList->removeChildNode(from, child, false), false);
-}
-
-struct ColumnInfo {
+struct ColumnInfo : public Noncopyable {
     ColumnInfo()
         : m_desiredColumnWidth(0)
         , m_desiredColumnCount(1)
@@ -188,7 +183,7 @@ void RenderBlock::destroy()
             // that will outlast this block. In the non-anonymous block case those
             // children will be destroyed by the time we return from this function.
             if (isAnonymousBlock()) {
-                for (InlineFlowBox* box = firstLineBox(); box; box = box->nextFlowBox()) {
+                for (InlineFlowBox* box = firstLineBox(); box; box = box->nextLineBox()) {
                     while (InlineBox* childBox = box->firstChild())
                         childBox->remove();
                 }
@@ -266,8 +261,14 @@ void RenderBlock::updateBeforeAfterContent(PseudoId pseudoId)
 void RenderBlock::addChild(RenderObject* newChild, RenderObject* beforeChild)
 {
     // Make sure we don't append things after :after-generated content if we have it.
-    if (!beforeChild && isAfterContent(lastChild()))
-        beforeChild = lastChild();
+    if (!beforeChild) {
+        RenderObject* lastRenderer = lastChild();
+
+        if (isAfterContent(lastRenderer))
+            beforeChild = lastRenderer;
+        else if (lastRenderer && lastRenderer->isAnonymousBlock() && isAfterContent(lastRenderer->lastChild()))
+            beforeChild = lastRenderer->lastChild();
+    }
 
     bool madeBoxesNonInline = false;
 
@@ -402,6 +403,44 @@ RootInlineBox* RenderBlock::createAndAppendRootInlineBox()
     m_lineBoxes.appendLineBox(rootBox);
     return rootBox;
 }
+    
+void RenderBlock::moveChildTo(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* child)
+{
+    ASSERT(this == child->parent());
+    toChildList->appendChildNode(to, children()->removeChildNode(this, child, false), false);
+}
+
+void RenderBlock::moveChildTo(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* beforeChild, RenderObject* child)
+{
+    ASSERT(this == child->parent());
+    ASSERT(!beforeChild || to == beforeChild->parent());
+    toChildList->insertChildNode(to, children()->removeChildNode(this, child, false), beforeChild, false);
+}
+
+void RenderBlock::moveAllChildrenTo(RenderObject* to, RenderObjectChildList* toChildList)
+{
+    RenderObject* nextChild = children()->firstChild();
+    while (nextChild) {
+        RenderObject* child = nextChild;
+        nextChild = child->nextSibling();
+        toChildList->appendChildNode(to, children()->removeChildNode(this, child, false), false);
+    }
+}
+
+void RenderBlock::moveAllChildrenTo(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* beforeChild)
+{
+    ASSERT(!beforeChild || to == beforeChild->parent());
+    if (!beforeChild) {
+        moveAllChildrenTo(to, toChildList);
+        return;
+    }
+    RenderObject* nextChild = children()->firstChild();
+    while (nextChild) {
+        RenderObject* child = nextChild;
+        nextChild = child->nextSibling();
+        toChildList->insertChildNode(to, children()->removeChildNode(this, child, false), beforeChild, false);
+    }
+}
 
 void RenderBlock::makeChildrenNonInline(RenderObject *insertionPoint)
 {    
@@ -439,9 +478,9 @@ void RenderBlock::makeChildrenNonInline(RenderObject *insertionPoint)
             RenderObject* no = o;
             o = no->nextSibling();
             
-            moveChild(block, block->children(), this, children(), no);
+            moveChildTo(block, block->children(), no);
         }
-        moveChild(block, block->children(), this, children(), inlineRunEnd);
+        moveChildTo(block, block->children(), inlineRunEnd);
     }
 
 #ifndef NDEBUG
@@ -509,20 +548,12 @@ void RenderBlock::removeChild(RenderObject* oldChild)
         // Take all the children out of the |next| block and put them in
         // the |prev| block.
         prev->setNeedsLayoutAndPrefWidthsRecalc();
-        RenderObject* o = next->firstChild();
-    
         RenderBlock* nextBlock = toRenderBlock(next);
         RenderBlock* prevBlock = toRenderBlock(prev);
-        while (o) {
-            RenderObject* no = o;
-            o = no->nextSibling();
-            moveChild(prevBlock, prevBlock->children(), nextBlock, nextBlock->children(), no);
-        }
- 
+        nextBlock->moveAllChildrenTo(prevBlock, prevBlock->children());
+        // Delete the now-empty block's lines and nuke it.
         nextBlock->deleteLineBoxTree();
-        
-        // Nuke the now-empty block.
-        next->destroy();
+        nextBlock->destroy();
     }
 
     RenderBox::removeChild(oldChild);
@@ -535,17 +566,15 @@ void RenderBlock::removeChild(RenderObject* oldChild)
         setNeedsLayoutAndPrefWidthsRecalc();
         RenderBlock* anonBlock = toRenderBlock(children()->removeChildNode(this, child, false));
         setChildrenInline(true);
-        RenderObject* o = anonBlock->firstChild();
-        while (o) {
-            RenderObject* no = o;
-            o = no->nextSibling();
-            moveChild(this, children(), anonBlock, anonBlock->children(), no);
-        }
-
+        anonBlock->moveAllChildrenTo(this, children());
         // Delete the now-empty block's lines and nuke it.
         anonBlock->deleteLineBoxTree();
         anonBlock->destroy();
     }
+
+    // If this was our last child be sure to clear out our line boxes.
+    if (childrenInline() && !firstChild())
+        lineBoxes()->deleteLineBoxes(renderArena());
 }
 
 bool RenderBlock::isSelfCollapsingBlock() const
@@ -609,15 +638,15 @@ void RenderBlock::finishDelayUpdateScrollInfo()
     if (gDelayUpdateScrollInfo == 0) {
         ASSERT(gDelayedUpdateScrollInfoSet);
 
-        for (DelayedUpdateScrollInfoSet::iterator it = gDelayedUpdateScrollInfoSet->begin(); it != gDelayedUpdateScrollInfoSet->end(); ++it) {
+        OwnPtr<DelayedUpdateScrollInfoSet> infoSet(gDelayedUpdateScrollInfoSet);
+        gDelayedUpdateScrollInfoSet = 0;
+
+        for (DelayedUpdateScrollInfoSet::iterator it = infoSet->begin(); it != infoSet->end(); ++it) {
             RenderBlock* block = *it;
             if (block->hasOverflowClip()) {
                 block->layer()->updateScrollInfoAfterLayout();
             }
         }
-
-        delete gDelayedUpdateScrollInfoSet;
-        gDelayedUpdateScrollInfoSet = 0;
     }
 }
 
@@ -747,8 +776,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     if (previousHeight != height())
         relayoutChildren = true;
 
-    // It's weird that we're treating float information as normal flow overflow, but we do this because floatRect() isn't
-    // able to be propagated up the render tree yet.  Overflow information is however.  This check is designed to catch anyone
+    // This check is designed to catch anyone
     // who wasn't going to propagate float information up to the parent and yet could potentially be painted by its ancestor.
     if (isRoot() || expandsToEncloseOverhangingFloats())
         addOverflowFromFloats();
@@ -788,11 +816,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
         
         if (hasOverflowClip()) {
             // Adjust repaint rect for scroll offset
-            int x = repaintRect.x();
-            int y = repaintRect.y();
-            layer()->subtractScrolledContentOffset(x, y);
-            repaintRect.setX(x);
-            repaintRect.setY(y);
+            repaintRect.move(-layer()->scrolledContentOffset());
 
             // Don't allow this rect to spill out of our overflow box.
             repaintRect.intersect(IntRect(0, 0, width(), height()));
@@ -860,7 +884,11 @@ void RenderBlock::adjustPositionedBlock(RenderBox* child, const MarginInfo& marg
             }
             y += (collapsedTopPos - collapsedTopNeg) - marginTop;
         }
-        child->layer()->setStaticY(y);
+        RenderLayer* childLayer = child->layer();
+        if (childLayer->staticY() != y) {
+            child->layer()->setStaticY(y);
+            child->setChildNeedsLayout(true, false);
+        }
     }
 }
 
@@ -949,7 +977,7 @@ bool RenderBlock::handleRunInChild(RenderBox* child)
     // Move the nodes from the old child to the new child, but skip any :before/:after content.  It has already
     // been regenerated by the new inline.
     for (RenderObject* runInChild = blockRunIn->firstChild(); runInChild; runInChild = runInChild->nextSibling()) {
-        if (runInIsGenerated || runInChild->style()->styleType() != BEFORE && runInChild->style()->styleType() != AFTER) {
+        if (runInIsGenerated || (runInChild->style()->styleType() != BEFORE && runInChild->style()->styleType() != AFTER)) {
             blockRunIn->children()->removeChildNode(blockRunIn, runInChild, false);
             inlineRunIn->addChild(runInChild); // Use addChild instead of appendChildNode since it handles correct placement of the children relative to :after-generated content.
         }
@@ -1512,7 +1540,7 @@ void RenderBlock::paint(PaintInfo& paintInfo, int tx, int ty)
     // Our scrollbar widgets paint exactly when we tell them to, so that they work properly with
     // z-index.  We paint after we painted the background/border, so that the scrollbars will
     // sit above the background/border.
-    if (hasOverflowClip() && style()->visibility() == VISIBLE && (phase == PaintPhaseBlockBackground || phase == PaintPhaseChildBlockBackground))
+    if (hasOverflowClip() && style()->visibility() == VISIBLE && (phase == PaintPhaseBlockBackground || phase == PaintPhaseChildBlockBackground) && shouldPaintWithinRoot(paintInfo))
         layer()->paintOverflowControls(paintInfo.context, tx, ty, paintInfo.rect);
 }
 
@@ -1630,9 +1658,18 @@ void RenderBlock::paintChildren(PaintInfo& paintInfo, int tx, int ty)
 
     for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {        
         // Check for page-break-before: always, and if it's set, break and bail.
-        if (isPrinting && !childrenInline() && child->style()->pageBreakBefore() == PBALWAYS &&
-            inRootBlockContext() && (ty + child->y()) > paintInfo.rect.y() && 
-            (ty + child->y()) < paintInfo.rect.bottom()) {
+        if (isPrinting && !childrenInline() && child->style()->pageBreakBefore() == PBALWAYS
+            && (ty + child->y()) > paintInfo.rect.y()
+            && (ty + child->y()) < paintInfo.rect.bottom()) {
+            view()->setBestTruncatedAt(ty + child->y(), this, true);
+            return;
+        }
+
+        // Check for page-break-inside: avoid, and it it's set, break and bail.
+        if (isPrinting && !childrenInline() && child->style()->pageBreakInside() == PBAVOID
+            && ty + child->y() > paintInfo.rect.y()
+            && ty + child->y() < paintInfo.rect.bottom()
+            && ty + child->y() + child->height() > paintInfo.rect.bottom()) {
             view()->setBestTruncatedAt(ty + child->y(), this, true);
             return;
         }
@@ -1641,9 +1678,9 @@ void RenderBlock::paintChildren(PaintInfo& paintInfo, int tx, int ty)
             child->paint(info, tx, ty);
 
         // Check for page-break-after: always, and if it's set, break and bail.
-        if (isPrinting && !childrenInline() && child->style()->pageBreakAfter() == PBALWAYS && 
-            inRootBlockContext() && (ty + child->y() + child->height()) > paintInfo.rect.y() && 
-            (ty + child->y() + child->height()) < paintInfo.rect.bottom()) {
+        if (isPrinting && !childrenInline() && child->style()->pageBreakAfter() == PBALWAYS
+            && (ty + child->y() + child->height()) > paintInfo.rect.y()
+            && (ty + child->y() + child->height()) < paintInfo.rect.bottom()) {
             view()->setBestTruncatedAt(ty + child->y() + child->height() + max(0, child->collapsedMarginBottom()), this, true);
             return;
         }
@@ -1663,7 +1700,7 @@ void RenderBlock::paintCaret(PaintInfo& paintInfo, int tx, int ty, CaretType typ
         offsetForContents(tx, ty);
 
         if (type == CursorCaret)
-            document()->frame()->paintCaret(paintInfo.context, tx, ty, paintInfo.rect);
+            document()->frame()->selection()->paintCaret(paintInfo.context, tx, ty, paintInfo.rect);
         else
             document()->frame()->paintDragCaret(paintInfo.context, tx, ty, paintInfo.rect);
     }
@@ -1690,11 +1727,14 @@ void RenderBlock::paintObject(PaintInfo& paintInfo, int tx, int ty)
     if (paintPhase == PaintPhaseBlockBackground)
         return;
 
-    // Adjust our painting position if we're inside a scrolled layer (e.g., an overflow:auto div).s
+    // Adjust our painting position if we're inside a scrolled layer (e.g., an overflow:auto div).
     int scrolledX = tx;
     int scrolledY = ty;
-    if (hasOverflowClip())
-        layer()->subtractScrolledContentOffset(scrolledX, scrolledY);
+    if (hasOverflowClip()) {
+        IntSize offset = layer()->scrolledContentOffset();
+        scrolledX -= offset.width();
+        scrolledY -= offset.height();
+    }
 
     // 2. paint contents
     if (paintPhase != PaintPhaseSelfOutline) {
@@ -1896,23 +1936,26 @@ bool RenderBlock::isSelectionRoot() const
     return false;
 }
 
-GapRects RenderBlock::selectionGapRectsForRepaint(RenderBoxModelObject* /*repaintContainer*/)
+GapRects RenderBlock::selectionGapRectsForRepaint(RenderBoxModelObject* repaintContainer)
 {
     ASSERT(!needsLayout());
 
     if (!shouldPaintSelectionGaps())
         return GapRects();
 
-    // FIXME: this is broken with transforms and a non-null repaintContainer
-    FloatPoint absContentPoint = localToAbsolute(FloatPoint());
+    // FIXME: this is broken with transforms
+    TransformState transformState(TransformState::ApplyTransformDirection, FloatPoint());
+    mapLocalToContainer(repaintContainer, false, false, transformState);
+    IntPoint offsetFromRepaintContainer = roundedIntPoint(transformState.mappedPoint());
+
     if (hasOverflowClip())
-        absContentPoint -= layer()->scrolledContentOffset();
+        offsetFromRepaintContainer -= layer()->scrolledContentOffset();
 
     int lastTop = 0;
     int lastLeft = leftSelectionOffset(this, lastTop);
     int lastRight = rightSelectionOffset(this, lastTop);
     
-    return fillSelectionGaps(this, absContentPoint.x(), absContentPoint.y(), absContentPoint.x(), absContentPoint.y(), lastTop, lastLeft, lastRight);
+    return fillSelectionGaps(this, offsetFromRepaintContainer.x(), offsetFromRepaintContainer.y(), offsetFromRepaintContainer.x(), offsetFromRepaintContainer.y(), lastTop, lastLeft, lastRight);
 }
 
 void RenderBlock::paintSelection(PaintInfo& paintInfo, int tx, int ty)
@@ -1922,7 +1965,18 @@ void RenderBlock::paintSelection(PaintInfo& paintInfo, int tx, int ty)
         int lastLeft = leftSelectionOffset(this, lastTop);
         int lastRight = rightSelectionOffset(this, lastTop);
         paintInfo.context->save();
-        fillSelectionGaps(this, tx, ty, tx, ty, lastTop, lastLeft, lastRight, &paintInfo);
+        IntRect gapRectsBounds = fillSelectionGaps(this, tx, ty, tx, ty, lastTop, lastLeft, lastRight, &paintInfo);
+        if (!gapRectsBounds.isEmpty()) {
+            if (RenderLayer* layer = enclosingLayer()) {
+                gapRectsBounds.move(IntSize(-tx, -ty));
+                if (!hasLayer()) {
+                    FloatRect localBounds(gapRectsBounds);
+                    gapRectsBounds = localToContainerQuad(localBounds, layer->renderer()).enclosingBoundingBox();
+                    gapRectsBounds.move(layer->scrolledContentOffset());
+                }
+                layer->addBlockSelectionGapsBounds(gapRectsBounds);
+            }
+        }
         paintInfo.context->restore();
     }
 }
@@ -2109,7 +2163,7 @@ IntRect RenderBlock::fillHorizontalSelectionGap(RenderObject* selObj, int xPos,
         return IntRect();
     IntRect gapRect(xPos, yPos, width, height);
     if (paintInfo && selObj->style()->visibility() == VISIBLE)
-        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor());
+        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor(), selObj->style()->colorSpace());
     return gapRect;
 }
 
@@ -2130,7 +2184,7 @@ IntRect RenderBlock::fillVerticalSelectionGap(int lastTop, int lastLeft, int las
 
     IntRect gapRect(left, top, width, height);
     if (paintInfo)
-        paintInfo->context->fillRect(gapRect, selectionBackgroundColor());
+        paintInfo->context->fillRect(gapRect, selectionBackgroundColor(), style()->colorSpace());
     return gapRect;
 }
 
@@ -2146,7 +2200,7 @@ IntRect RenderBlock::fillLeftSelectionGap(RenderObject* selObj, int xPos, int yP
 
     IntRect gapRect(left, top, width, height);
     if (paintInfo)
-        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor());
+        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor(), selObj->style()->colorSpace());
     return gapRect;
 }
 
@@ -2162,7 +2216,7 @@ IntRect RenderBlock::fillRightSelectionGap(RenderObject* selObj, int xPos, int y
 
     IntRect gapRect(left, top, width, height);
     if (paintInfo)
-        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor());
+        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor(), selObj->style()->colorSpace());
     return gapRect;
 }
 
@@ -2304,8 +2358,14 @@ void RenderBlock::removeFloatingObject(RenderBox* o)
         DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
         while (it.current()) {
             if (it.current()->m_renderer == o) {
-                if (childrenInline())
-                    markLinesDirtyInVerticalRange(0, it.current()->m_bottom);
+                if (childrenInline()) {
+                    int bottom = it.current()->m_bottom;
+                    // Special-case zero- and less-than-zero-height floats: those don't touch
+                    // the line that they're on, but it still needs to be dirtied. This is
+                    // accomplished by pretending they have a height of 1.
+                    bottom = max(bottom, it.current()->m_top + 1);
+                    markLinesDirtyInVerticalRange(0, bottom);
+                }
                 m_floatingObjects->removeRef(it.current());
             }
             ++it;
@@ -2584,30 +2644,15 @@ RenderBlock::floatBottom() const
     return bottom;
 }
 
-IntRect RenderBlock::floatRect() const
-{
-    IntRect result;
-    if (!m_floatingObjects || hasOverflowClip() || hasColumns())
-        return result;
-    FloatingObject* r;
-    DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
-    for (; (r = it.current()); ++it) {
-        if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer()) {
-            IntRect childRect = r->m_renderer->visibleOverflowRect();
-            childRect.move(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop());
-            result.unite(childRect);
-        }
-    }
-
-    return result;
-}
-
 int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf) const
 {
     int bottom = includeSelf && width() > 0 ? height() : 0;
 
     if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
         return bottom;
+
+    if (!firstChild() && (!width() || !height()))
+        return bottom;
     
     if (!hasColumns()) {
         // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
@@ -2700,6 +2745,9 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
     if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
         return right;
 
+    if (!firstChild() && (!width() || !height()))
+        return right;
+
     if (!hasColumns()) {
         // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
         // For now, we have to descend into all the children, since we may have a huge abs div inside
@@ -2764,7 +2812,7 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
     if (!includeSelf) {
         right = max(right, borderLeft() + paddingLeft() + paddingRight() + relativeOffset);
         if (childrenInline()) {
-            for (InlineRunBox* currBox = firstLineBox(); currBox; currBox = currBox->nextLineBox()) {
+            for (InlineFlowBox* currBox = firstLineBox(); currBox; currBox = currBox->nextLineBox()) {
                 int childRightEdge = currBox->x() + currBox->width();
                 
                 // If this node is a root editable element, then the rightmostPosition should account for a caret at the end.
@@ -2794,6 +2842,9 @@ int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf
     if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
         return left;
 
+    if (!firstChild() && (!width() || !height()))
+        return left;
+
     if (!hasColumns()) {
         // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
         // For now, we have to descend into all the children, since we may have a huge abs div inside
@@ -2856,7 +2907,7 @@ int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf
     }
 
     if (!includeSelf && firstLineBox()) {
-        for (InlineRunBox* currBox = firstLineBox(); currBox; currBox = currBox->nextLineBox())
+        for (InlineFlowBox* currBox = firstLineBox(); currBox; currBox = currBox->nextLineBox())
             left = min(left, (int)currBox->x() + relativeOffset);
     }
     
@@ -2891,7 +2942,7 @@ RenderBlock::rightBottom()
     return bottom;
 }
 
-void RenderBlock::markLinesDirtyInVerticalRange(int top, int bottom)
+void RenderBlock::markLinesDirtyInVerticalRange(int top, int bottom, RootInlineBox* highest)
 {
     if (top >= bottom)
         return;
@@ -2903,7 +2954,7 @@ void RenderBlock::markLinesDirtyInVerticalRange(int top, int bottom)
         lowestDirtyLine = lowestDirtyLine->prevRootBox();
     }
 
-    while (afterLowest && afterLowest->blockHeight() >= top) {
+    while (afterLowest && afterLowest != highest && afterLowest->blockHeight() >= top) {
         afterLowest->markDirty();
         afterLowest = afterLowest->prevRootBox();
     }
@@ -2965,8 +3016,8 @@ void RenderBlock::clearFloats()
         addIntrudingFloats(block, xoffset, offset);
 
     if (childrenInline()) {
-        int changeTop = INT_MAX;
-        int changeBottom = INT_MIN;
+        int changeTop = numeric_limits<int>::max();
+        int changeBottom = numeric_limits<int>::min();
         if (m_floatingObjects) {
             for (FloatingObject* f = m_floatingObjects->first(); f; f = m_floatingObjects->next()) {
                 FloatingObject* oldFloatingObject = floatMap.get(f->m_renderer);
@@ -3143,6 +3194,32 @@ void RenderBlock::markAllDescendantsWithFloatsForLayout(RenderBox* floatToRemove
     }
 }
 
+int RenderBlock::visibleTopOfHighestFloatExtendingBelow(int bottom, int maxHeight) const
+{
+    int top = bottom;
+    if (m_floatingObjects) {
+        FloatingObject* floatingObject;
+        for (DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects); (floatingObject = it.current()); ++it) {
+            RenderBox* floatingBox = floatingObject->m_renderer;
+            IntRect visibleOverflow = floatingBox->visibleOverflowRect();
+            visibleOverflow.move(floatingBox->x(), floatingBox->y());
+            if (visibleOverflow.y() < top && visibleOverflow.bottom() > bottom && visibleOverflow.height() <= maxHeight && floatingBox->containingBlock() == this)
+                top = visibleOverflow.y();
+        }
+    }
+
+    if (!childrenInline()) {
+        for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
+            if (child->isFloatingOrPositioned() || !child->isRenderBlock())
+                continue;
+            RenderBlock* childBlock = toRenderBlock(child);
+            top = min(top, childBlock->y() + childBlock->visibleTopOfHighestFloatExtendingBelow(bottom - childBlock->y(), maxHeight));
+        }
+    }
+
+    return top;
+}
+
 int RenderBlock::getClearDelta(RenderBox* child, int yPos)
 {
     // There is no need to compute clearance if we have no floats.
@@ -3167,18 +3244,35 @@ int RenderBlock::getClearDelta(RenderBox* child, int yPos)
     }
 
     // We also clear floats if we are too big to sit on the same line as a float (and wish to avoid floats by default).
-    // FIXME: Note that the remaining space checks aren't quite accurate, since you should be able to clear only some floats (the minimum # needed
-    // to fit) and not all (we should be using nextFloatBottomBelow and looping).
     int result = clearSet ? max(0, bottom - yPos) : 0;
     if (!result && child->avoidsFloats()) {
-        int oldYPos = child->y();
-        int oldWidth = child->width();
-        child->setY(yPos);
-        child->calcWidth();
-        if (child->width() > lineWidth(yPos, false) && child->minPrefWidth() <= availableWidth())
-            result = max(0, floatBottom() - yPos);
-        child->setY(oldYPos);
-        child->setWidth(oldWidth);
+        int availableWidth = this->availableWidth();
+        if (child->minPrefWidth() > availableWidth)
+            return 0;
+
+        int y = yPos;
+        while (true) {
+            int widthAtY = lineWidth(y, false);
+            if (widthAtY == availableWidth)
+                return y - yPos;
+
+            int oldChildY = child->y();
+            int oldChildWidth = child->width();
+            child->setY(y);
+            child->calcWidth();
+            int childWidthAtY = child->width();
+            child->setY(oldChildY);
+            child->setWidth(oldChildWidth);
+
+            if (childWidthAtY <= widthAtY)
+                return y - yPos;
+
+            y = nextFloatBottomBelow(y);
+            ASSERT(y >= yPos);
+            if (y < yPos)
+                break;
+        }
+        ASSERT_NOT_REACHED();
     }
     return result;
 }
@@ -3217,8 +3311,11 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
         // Hit test descendants first.
         int scrolledX = tx;
         int scrolledY = ty;
-        if (hasOverflowClip())
-            layer()->subtractScrolledContentOffset(scrolledX, scrolledY);
+        if (hasOverflowClip()) {
+            IntSize offset = layer()->scrolledContentOffset();
+            scrolledX -= offset.width();
+            scrolledY -= offset.height();
+        }
 
         // Hit test contents if we don't have columns.
         if (!hasColumns() && hitTestContents(request, result, _x, _y, scrolledX, scrolledY, hitTestAction))
@@ -3395,7 +3492,7 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const IntPoint&
     RootInlineBox* firstRootBoxWithChildren = 0;
     RootInlineBox* lastRootBoxWithChildren = 0;
     for (RootInlineBox* root = firstRootBox(); root; root = root->nextRootBox()) {
-        if (!root->firstChild())
+        if (!root->firstLeafChild())
             continue;
         if (!firstRootBoxWithChildren)
             firstRootBoxWithChildren = root;
@@ -3493,15 +3590,16 @@ VisiblePosition RenderBlock::positionForPoint(const IntPoint& point)
 
 void RenderBlock::offsetForContents(int& tx, int& ty) const
 {
+    IntPoint contentsPoint(tx, ty);
+
     if (hasOverflowClip())
-        layer()->addScrolledContentOffset(tx, ty);
+        contentsPoint += layer()->scrolledContentOffset();
 
-    if (hasColumns()) {
-        IntPoint contentsPoint(tx, ty);
+    if (hasColumns())
         adjustPointToColumnContents(contentsPoint);
-        tx = contentsPoint.x();
-        ty = contentsPoint.y();
-    }
+
+    tx = contentsPoint.x();
+    ty = contentsPoint.y();
 }
 
 int RenderBlock::availableWidth() const
@@ -3542,11 +3640,15 @@ void RenderBlock::calcColumnWidth()
             desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
         } else if (colGap < availWidth) {
             desiredColumnCount = availWidth / colGap;
+            if (desiredColumnCount < 1)
+                desiredColumnCount = 1;
             desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
         }
     } else if (style()->hasAutoColumnCount()) {
         if (colWidth < availWidth) {
             desiredColumnCount = (availWidth + colGap) / (colWidth + colGap);
+            if (desiredColumnCount < 1)
+                desiredColumnCount = 1;
             desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
         }
     } else {
@@ -3556,6 +3658,8 @@ void RenderBlock::calcColumnWidth()
             desiredColumnWidth = colWidth;
         } else if (colWidth < availWidth) {
             desiredColumnCount = (availWidth + colGap) / (colWidth + colGap);
+            if (desiredColumnCount < 1)
+                desiredColumnCount = 1;
             desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
         }
     }
@@ -3606,7 +3710,7 @@ Vector<IntRect>* RenderBlock::columnRects() const
     return &gColumnInfoMap->get(this)->m_columnRects;    
 }
 
-int RenderBlock::layoutColumns(int endOfContent)
+int RenderBlock::layoutColumns(int endOfContent, int requestedColumnHeight)
 {
     // Don't do anything if we have no columns
     if (!hasColumns())
@@ -3619,17 +3723,20 @@ int RenderBlock::layoutColumns(int endOfContent)
     
     bool computeIntrinsicHeight = (endOfContent == -1);
 
-    // Fill the columns in to the available height.  Attempt to balance the height of the columns
-    int availableHeight = contentHeight();
-    int colHeight = computeIntrinsicHeight ? availableHeight / desiredColumnCount : availableHeight;
-    
+    // Fill the columns in to the available height.  Attempt to balance the height of the columns.
     // Add in half our line-height to help with best-guess initial balancing.
     int columnSlop = lineHeight(false) / 2;
     int remainingSlopSpace = columnSlop * desiredColumnCount;
+    int availableHeight = contentHeight();
+    int colHeight;
+    if (computeIntrinsicHeight && requestedColumnHeight >= 0)
+        colHeight = requestedColumnHeight;
+    else if (computeIntrinsicHeight)
+        colHeight = availableHeight / desiredColumnCount + columnSlop;
+    else
+        colHeight = availableHeight;
+    int originalColHeight = colHeight;
 
-    if (computeIntrinsicHeight)
-        colHeight += columnSlop;
-                                                                            
     int colGap = columnGap();
 
     // Compute a collection of column rects.
@@ -3645,7 +3752,8 @@ int RenderBlock::layoutColumns(int endOfContent)
     int currY = top;
     unsigned colCount = desiredColumnCount;
     int maxColBottom = borderTop() + paddingTop();
-    int contentBottom = top + availableHeight; 
+    int contentBottom = top + availableHeight;
+    int minimumColumnHeight = -1;
     for (unsigned i = 0; i < colCount; i++) {
         // If we aren't constrained, then the last column can just get all the remaining space.
         if (computeIntrinsicHeight && i == colCount - 1)
@@ -3653,11 +3761,13 @@ int RenderBlock::layoutColumns(int endOfContent)
 
         // This represents the real column position.
         IntRect colRect(currX, top, desiredColumnWidth, colHeight);
-        
+
+        int truncationPoint = visibleTopOfHighestFloatExtendingBelow(currY + colHeight, colHeight);
+
         // For the simulated paint, we pretend like everything is in one long strip.
-        IntRect pageRect(left, currY, desiredColumnWidth, colHeight);
+        IntRect pageRect(left, currY, desiredColumnWidth, truncationPoint - currY);
         v->setPrintRect(pageRect);
-        v->setTruncatedAt(currY + colHeight);
+        v->setTruncatedAt(truncationPoint);
         GraphicsContext context((PlatformGraphicsContext*)0);
         RenderObject::PaintInfo paintInfo(&context, pageRect, PaintPhaseForeground, false, 0, 0);
         
@@ -3665,9 +3775,14 @@ int RenderBlock::layoutColumns(int endOfContent)
         paintObject(paintInfo, 0, 0);
         setHasColumns(true);
 
+        if (computeIntrinsicHeight && v->minimumColumnHeight() > originalColHeight) {
+            // The initial column height was too small to contain one line of text.
+            minimumColumnHeight = max(minimumColumnHeight, v->minimumColumnHeight());
+        }
+
         int adjustedBottom = v->bestTruncatedAt();
         if (adjustedBottom <= currY)
-            adjustedBottom = currY + colHeight;
+            adjustedBottom = truncationPoint;
         
         colRect.setHeight(adjustedBottom - currY);
         
@@ -3701,6 +3816,11 @@ int RenderBlock::layoutColumns(int endOfContent)
             colCount++;
     }
 
+    if (minimumColumnHeight >= 0) {
+        // If originalColHeight was too small, we need to try to layout again.
+        return layoutColumns(endOfContent, minimumColumnHeight);
+    }
+
     int overflowRight = max(width(), currX - colGap);
     int overflowLeft = min(0, currX + desiredColumnWidth + colGap);
     int overflowHeight = maxColBottom;
@@ -3737,8 +3857,20 @@ void RenderBlock::adjustPointToColumnContents(IntPoint& point) const
         // Add in half the column gap to the left and right of the rect.
         IntRect colRect = colRects->at(i);
         IntRect gapAndColumnRect(colRect.x() - leftGap, colRect.y(), colRect.width() + colGap, colRect.height());
-        
-        if (gapAndColumnRect.contains(point)) {
+
+        if (point.x() >= gapAndColumnRect.x() && point.x() < gapAndColumnRect.right()) {
+            // FIXME: The clamping that follows is not completely right for right-to-left
+            // content.
+            // Clamp everything above the column to its top left.
+            if (point.y() < gapAndColumnRect.y())
+                point = gapAndColumnRect.location();
+            // Clamp everything below the column to the next column's top left. If there is
+            // no next column, this still maps to just after this column.
+            else if (point.y() >= gapAndColumnRect.bottom()) {
+                point = gapAndColumnRect.location();
+                point.move(0, gapAndColumnRect.height());
+            }
+
             // We're inside the column.  Translate the x and y into our column coordinate space.
             point.move(columnPoint.x() - colRect.x(), yOffset);
             return;
@@ -3786,6 +3918,31 @@ void RenderBlock::adjustRectForColumns(IntRect& r) const
     r = result;
 }
 
+void RenderBlock::adjustForColumns(IntSize& offset, const IntPoint& point) const
+{
+    if (!hasColumns())
+        return;
+
+    // FIXME: This is incorrect for right-to-left columns.
+
+    Vector<IntRect>& columnRects = *this->columnRects();
+
+    int gapWidth = columnGap();
+    int xOffset = 0;
+    int yOffset = 0;
+    size_t columnCount = columnRects.size();
+    for (size_t i = 0; i < columnCount; ++i) {
+        IntRect columnRect = columnRects[i];
+        if (point.y() < columnRect.bottom() + yOffset) {
+            offset.expand(xOffset, -yOffset);
+            return;
+        }
+
+        xOffset += columnRect.width() + gapWidth;
+        yOffset += columnRect.height();
+    }
+}
+
 void RenderBlock::calcPrefWidths()
 {
     ASSERT(prefWidthsDirty());
@@ -4181,6 +4338,10 @@ void RenderBlock::calcInlinePrefWidths()
                 } else
                     inlineMax += childMax;
             }
+
+            // Ignore spaces after a list marker.
+            if (child->isListMarker())
+                stripFrontSpaces = true;
         } else {
             m_minPrefWidth = max(inlineMin, m_minPrefWidth);
             m_maxPrefWidth = max(inlineMax, m_maxPrefWidth);
@@ -4484,7 +4645,7 @@ void RenderBlock::updateFirstLetter()
 
     // Drill into inlines looking for our first text child.
     RenderObject* currChild = firstLetterBlock->firstChild();
-    while (currChild && currChild->needsLayout() && (!currChild->isReplaced() || currChild->isFloatingOrPositioned()) && !currChild->isText()) {
+    while (currChild && currChild->needsLayout() && ((!currChild->isReplaced() && !currChild->isRenderButton() && !currChild->isMenuList()) || currChild->isFloatingOrPositioned()) && !currChild->isText()) {
         if (currChild->isFloatingOrPositioned()) {
             if (currChild->style()->styleType() == FIRST_LETTER)
                 break;
@@ -4582,17 +4743,6 @@ void RenderBlock::updateFirstLetter()
     }
 }
 
-bool RenderBlock::inRootBlockContext() const
-{
-    if (isTableCell() || isFloatingOrPositioned() || hasOverflowClip())
-        return false;
-    
-    if (isRoot() || isRenderView())
-        return true;
-    
-    return containingBlock()->inRootBlockContext();
-}
-
 // Helper methods for obtaining the last line, computing line counts and heights for line counts
 // (crawling into blocks).
 static bool shouldCheckLines(RenderObject* obj)
@@ -4943,7 +5093,7 @@ IntRect RenderBlock::localCaretRect(InlineBox* inlineBox, int caretOffset, int*
     return IntRect(x, y, caretWidth, height);
 }
 
-void RenderBlock::addFocusRingRects(GraphicsContext* graphicsContext, int tx, int ty)
+void RenderBlock::addFocusRingRects(Vector<IntRect>& rects, int tx, int ty)
 {
     // For blocks inside inlines, we go ahead and include margins so that we run right up to the
     // inline boxes above and below us (thus getting merged with them to form a single irregular
@@ -4955,16 +5105,19 @@ void RenderBlock::addFocusRingRects(GraphicsContext* graphicsContext, int tx, in
         bool prevInlineHasLineBox = toRenderInline(inlineContinuation()->node()->renderer())->firstLineBox(); 
         int topMargin = prevInlineHasLineBox ? collapsedMarginTop() : 0;
         int bottomMargin = nextInlineHasLineBox ? collapsedMarginBottom() : 0;
-        graphicsContext->addFocusRingRect(IntRect(tx, ty - topMargin, 
-                                                  width(), height() + topMargin + bottomMargin));
-    } else
-        graphicsContext->addFocusRingRect(IntRect(tx, ty, width(), height()));
+        IntRect rect(tx, ty - topMargin, width(), height() + topMargin + bottomMargin);
+        if (!rect.isEmpty())
+            rects.append(rect);
+    } else if (width() && height())
+        rects.append(IntRect(tx, ty, width(), height()));
 
     if (!hasOverflowClip() && !hasControlClip()) {
         for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
             int top = max(curr->lineTop(), curr->y());
             int bottom = min(curr->lineBottom(), curr->y() + curr->height());
-            graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + top, curr->width(), bottom - top));
+            IntRect rect(tx + curr->x(), ty + top, curr->width(), bottom - top);
+            if (!rect.isEmpty())
+                rects.append(rect);
         }
 
         for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
@@ -4976,13 +5129,13 @@ void RenderBlock::addFocusRingRects(GraphicsContext* graphicsContext, int tx, in
                     pos = curr->localToAbsolute();
                 else
                     pos = FloatPoint(tx + box->x(), ty + box->y());
-                box->addFocusRingRects(graphicsContext, pos.x(), pos.y());
+                box->addFocusRingRects(rects, pos.x(), pos.y());
             }
         }
     }
 
     if (inlineContinuation())
-        inlineContinuation()->addFocusRingRects(graphicsContext, 
+        inlineContinuation()->addFocusRingRects(rects, 
                                                 tx - x() + inlineContinuation()->containingBlock()->x(),
                                                 ty - y() + inlineContinuation()->containingBlock()->y());
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.h b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.h
index 3300d01117..184f98384c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -34,7 +34,6 @@ namespace WebCore {
 
 class InlineIterator;
 class RenderInline;
-class RootInlineBox;
 
 struct BidiRun;
 
@@ -91,8 +90,6 @@ public:
     bool containsFloats() { return m_floatingObjects && !m_floatingObjects->isEmpty(); }
     bool containsFloat(RenderObject*);
 
-    IntRect floatRect() const;
-
     int lineWidth(int y, bool firstLine) const;
     
     virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
@@ -130,6 +127,7 @@ public:
     void clearTruncation();
 
     void adjustRectForColumns(IntRect&) const;
+    virtual void adjustForColumns(IntSize&, const IntPoint&) const;
 
     void addContinuationWithOutline(RenderInline*);
 
@@ -140,7 +138,15 @@ public:
     // style from this RenderBlock.
     RenderBlock* createAnonymousBlock(bool isFlexibleBox = false) const;
 
+    static void appendRunsForObject(int start, int end, RenderObject*, InlineBidiResolver&);    
+    static bool requiresLineBox(const InlineIterator&, bool isLineEmpty = true, bool previousLineBrokeCleanly = true);
+
 protected:
+    void moveChildTo(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* child);
+    void moveChildTo(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* beforeChild, RenderObject* child);
+    void moveAllChildrenTo(RenderObject* to, RenderObjectChildList* toChildList);
+    void moveAllChildrenTo(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* beforeChild);
+
     int maxTopPosMargin() const { return m_maxMargin ? m_maxMargin->m_topPos : MaxMargin::topPosDefault(this); }
     int maxTopNegMargin() const { return m_maxMargin ? m_maxMargin->m_topNeg : MaxMargin::topNegDefault(this); }
     int maxBottomPosMargin() const { return m_maxMargin ? m_maxMargin->m_bottomPos : MaxMargin::bottomPosDefault(this); }
@@ -310,7 +316,6 @@ private:
     // Obtains the nearest enclosing block (including this block) that contributes a first-line style to our inline
     // children.
     virtual RenderBlock* firstLineBlock() const;
-    bool inRootBlockContext() const;
 
     virtual IntRect rectWithOutlineForRepaint(RenderBoxModelObject* repaintContainer, int outlineWidth);
     virtual RenderStyle* outlineStyleForRepaint() const;
@@ -349,12 +354,12 @@ private:
 
     virtual IntRect localCaretRect(InlineBox*, int caretOffset, int* extraWidthToEndOfLine = 0);
 
-    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
+    virtual void addFocusRingRects(Vector<IntRect>&, int tx, int ty);
 
     void adjustPointToColumnContents(IntPoint&) const;
     void adjustForBorderFit(int x, int& left, int& right) const; // Helper function for borderFitAdjust
 
-    void markLinesDirtyInVerticalRange(int top, int bottom);
+    void markLinesDirtyInVerticalRange(int top, int bottom, RootInlineBox* highest = 0);
 
     void newLine(EClear);
 
@@ -366,13 +371,14 @@ private:
     void offsetForContents(int& tx, int& ty) const;
 
     void calcColumnWidth();
-    int layoutColumns(int endOfContent = -1);
+    int layoutColumns(int endOfContent = -1, int requestedColumnHeight = -1);
+    int visibleTopOfHighestFloatExtendingBelow(int bottom, int maxHeight) const;
 
     bool expandsToEncloseOverhangingFloats() const;
 
     void updateScrollInfoAfterLayout();
 
-    struct FloatingObject {
+    struct FloatingObject : Noncopyable {
         enum Type {
             FloatLeft,
             FloatRight
@@ -488,7 +494,7 @@ private:
     RenderInline* m_inlineContinuation;
 
     // Allocated only when some of these fields have non-default values
-    struct MaxMargin {
+    struct MaxMargin : Noncopyable {
         MaxMargin(const RenderBlock* o) 
             : m_topPos(topPosDefault(o))
             , m_topNeg(topNegDefault(o))
@@ -514,6 +520,10 @@ private:
     RenderLineBoxList m_lineBoxes;   // All of the root line boxes created for this block flow.  For example, <div>Hello<br>world.</div> will have two total lines for the <div>.
 
     mutable int m_lineHeight;
+    
+    // RenderRubyBase objects need to be able to split and merge, moving their children around
+    // (calling moveChildTo, moveAllChildrenTo, and makeChildrenNonInline).
+    friend class RenderRubyBase;
 };
 
 inline RenderBlock* toRenderBlock(RenderObject* object)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBlockLineLayout.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBlockLineLayout.cpp
index 19923f15c0..6e890606c5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2003, 2004, 2006, 2007, 2008, 2009 Apple Inc. All right reserved.
+ * Copyright (C) 2003, 2004, 2006, 2007, 2008, 2009, 2010 Apple Inc. All right reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,12 +24,14 @@
 
 #include "BidiResolver.h"
 #include "CharacterNames.h"
+#include "InlineIterator.h"
 #include "InlineTextBox.h"
 #include "Logging.h"
 #include "RenderArena.h"
 #include "RenderInline.h"
 #include "RenderListMarker.h"
 #include "RenderView.h"
+#include "TrailingFloatsRootInlineBox.h"
 #include "break_lines.h"
 #include <wtf/AlwaysInline.h>
 #include <wtf/RefCountedLeakCounter.h>
@@ -44,36 +47,6 @@ namespace WebCore {
 // We don't let our line box tree for a single line get any deeper than this.
 const unsigned cMaxLineDepth = 200;
 
-class InlineIterator {
-public:
-    InlineIterator()
-        : block(0)
-        , obj(0)
-        , pos(0)
-        , nextBreakablePosition(-1)
-    {
-    }
-
-    InlineIterator(RenderBlock* b, RenderObject* o, unsigned p)
-        : block(b)
-        , obj(o)
-        , pos(p)
-        , nextBreakablePosition(-1)
-    {
-    }
-
-    void increment(InlineBidiResolver* resolver = 0);
-    bool atEnd() const;
-
-    UChar current() const;
-    Direction direction() const;
-
-    RenderBlock* block;
-    RenderObject* obj;
-    unsigned pos;
-    int nextBreakablePosition;
-};
-
 static int getBorderPaddingMargin(RenderBoxModelObject* child, bool endOfInline)
 {
     bool leftSide = (child->style()->direction() == LTR) ? !endOfInline : endOfInline;
@@ -98,247 +71,6 @@ static int inlineWidth(RenderObject* child, bool start = true, bool end = true)
     return extraWidth;
 }
 
-struct BidiRun : BidiCharacterRun {
-    BidiRun(int start, int stop, RenderObject* object, BidiContext* context, Direction dir)
-        : BidiCharacterRun(start, stop, context, dir)
-        , m_object(object)
-        , m_box(0)
-    {
-    }
-
-    void destroy();
-
-    // Overloaded new operator.
-    void* operator new(size_t, RenderArena*) throw();
-
-    // Overridden to prevent the normal delete from being called.
-    void operator delete(void*, size_t);
-
-    BidiRun* next() { return static_cast<BidiRun*>(m_next); }
-
-private:
-    // The normal operator new is disallowed.
-    void* operator new(size_t) throw();
-
-public:
-    RenderObject* m_object;
-    InlineBox* m_box;
-};
-
-#ifndef NDEBUG
-static RefCountedLeakCounter bidiRunCounter("BidiRun");
-
-static bool inBidiRunDestroy;
-#endif
-
-void BidiRun::destroy()
-{
-#ifndef NDEBUG
-    inBidiRunDestroy = true;
-#endif
-    RenderArena* renderArena = m_object->renderArena();
-    delete this;
-#ifndef NDEBUG
-    inBidiRunDestroy = false;
-#endif
-
-    // Recover the size left there for us by operator delete and free the memory.
-    renderArena->free(*reinterpret_cast<size_t*>(this), this);
-}
-
-void* BidiRun::operator new(size_t sz, RenderArena* renderArena) throw()
-{
-#ifndef NDEBUG
-    bidiRunCounter.increment();
-#endif
-    return renderArena->allocate(sz);
-}
-
-void BidiRun::operator delete(void* ptr, size_t sz)
-{
-#ifndef NDEBUG
-    bidiRunCounter.decrement();
-#endif
-    ASSERT(inBidiRunDestroy);
-
-    // Stash size where destroy() can find it.
-    *(size_t*)ptr = sz;
-}
-
-// ---------------------------------------------------------------------
-
-inline bool operator==(const InlineIterator& it1, const InlineIterator& it2)
-{
-    return it1.pos == it2.pos && it1.obj == it2.obj;
-}
-
-inline bool operator!=(const InlineIterator& it1, const InlineIterator& it2)
-{
-    return it1.pos != it2.pos || it1.obj != it2.obj;
-}
-
-static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current, InlineBidiResolver* resolver = 0, bool skipInlines = true, bool* endOfInlinePtr = 0)
-{
-    RenderObject* next = 0;
-    bool oldEndOfInline = endOfInlinePtr ? *endOfInlinePtr : false;
-    bool endOfInline = false;
-
-    while (current) {
-        next = 0;
-        if (!oldEndOfInline && !current->isFloating() && !current->isReplaced() && !current->isPositioned() && !current->isText()) {
-            next = current->firstChild();
-            if (next && resolver && next->isRenderInline()) {
-                EUnicodeBidi ub = next->style()->unicodeBidi();
-                if (ub != UBNormal) {
-                    TextDirection dir = next->style()->direction();
-                    Direction d = (ub == Embed
-                        ? (dir == RTL ? RightToLeftEmbedding : LeftToRightEmbedding)
-                        : (dir == RTL ? RightToLeftOverride : LeftToRightOverride));
-                    resolver->embed(d);
-                }
-            }
-        }
-
-        if (!next) {
-            if (!skipInlines && !oldEndOfInline && current->isRenderInline()) {
-                next = current;
-                endOfInline = true;
-                break;
-            }
-
-            while (current && current != block) {
-                if (resolver && current->isRenderInline() && current->style()->unicodeBidi() != UBNormal)
-                    resolver->embed(PopDirectionalFormat);
-
-                next = current->nextSibling();
-                if (next) {
-                    if (resolver && next->isRenderInline()) {
-                        EUnicodeBidi ub = next->style()->unicodeBidi();
-                        if (ub != UBNormal) {
-                            TextDirection dir = next->style()->direction();
-                            Direction d = (ub == Embed
-                                ? (dir == RTL ? RightToLeftEmbedding: LeftToRightEmbedding)
-                                : (dir == RTL ? RightToLeftOverride : LeftToRightOverride));
-                            resolver->embed(d);
-                        }
-                    }
-                    break;
-                }
-                
-                current = current->parent();
-                if (!skipInlines && current && current != block && current->isRenderInline()) {
-                    next = current;
-                    endOfInline = true;
-                    break;
-                }
-            }
-        }
-
-        if (!next)
-            break;
-
-        if (next->isText() || next->isFloating() || next->isReplaced() || next->isPositioned()
-            || ((!skipInlines || !next->firstChild()) // Always return EMPTY inlines.
-                && next->isRenderInline()))
-            break;
-        current = next;
-    }
-
-    if (endOfInlinePtr)
-        *endOfInlinePtr = endOfInline;
-
-    return next;
-}
-
-static RenderObject* bidiFirst(RenderBlock* block, InlineBidiResolver* resolver, bool skipInlines = true)
-{
-    if (!block->firstChild())
-        return 0;
-    
-    RenderObject* o = block->firstChild();
-    if (o->isRenderInline()) {
-        if (resolver) {
-            EUnicodeBidi ub = o->style()->unicodeBidi();
-            if (ub != UBNormal) {
-                TextDirection dir = o->style()->direction();
-                Direction d = (ub == Embed
-                    ? (dir == RTL ? RightToLeftEmbedding : LeftToRightEmbedding)
-                    : (dir == RTL ? RightToLeftOverride : LeftToRightOverride));
-                resolver->embed(d);
-            }
-        }
-        if (skipInlines && o->firstChild())
-            o = bidiNext(block, o, resolver, skipInlines);
-        else {
-            // Never skip empty inlines.
-            if (resolver)
-                resolver->commitExplicitEmbedding();
-            return o; 
-        }
-    }
-
-    if (o && !o->isText() && !o->isReplaced() && !o->isFloating() && !o->isPositioned())
-        o = bidiNext(block, o, resolver, skipInlines);
-
-    if (resolver)
-        resolver->commitExplicitEmbedding();
-    return o;
-}
-
-inline void InlineIterator::increment(InlineBidiResolver* resolver)
-{
-    if (!obj)
-        return;
-    if (obj->isText()) {
-        pos++;
-        if (pos >= toRenderText(obj)->textLength()) {
-            obj = bidiNext(block, obj, resolver);
-            pos = 0;
-            nextBreakablePosition = -1;
-        }
-    } else {
-        obj = bidiNext(block, obj, resolver);
-        pos = 0;
-        nextBreakablePosition = -1;
-    }
-}
-
-template<>
-inline void InlineBidiResolver::increment()
-{
-    current.increment(this);
-}
-
-inline bool InlineIterator::atEnd() const
-{
-    return !obj;
-}
-
-inline UChar InlineIterator::current() const
-{
-    if (!obj || !obj->isText())
-        return 0;
-
-    RenderText* text = toRenderText(obj);
-    if (pos >= text->textLength())
-        return 0;
-
-    return text->characters()[pos];
-}
-
-ALWAYS_INLINE Direction InlineIterator::direction() const
-{
-    if (UChar c = current())
-        return Unicode::direction(c);
-
-    if (obj && obj->isListMarker())
-        return obj->style()->direction() == LTR ? LeftToRight : RightToLeft;
-
-    return OtherNeutral;
-}
-
-// -------------------------------------------------------------------------------------------------
-
 static void chopMidpointsAt(LineMidpointState& lineMidpointState, RenderObject* obj, unsigned pos)
 {
     if (!lineMidpointState.numMidpoints)
@@ -396,7 +128,7 @@ static void addMidpoint(LineMidpointState& lineMidpointState, const InlineIterat
     midpoints[lineMidpointState.numMidpoints++] = midpoint;
 }
 
-static void appendRunsForObject(int start, int end, RenderObject* obj, InlineBidiResolver& resolver)
+void RenderBlock::appendRunsForObject(int start, int end, RenderObject* obj, InlineBidiResolver& resolver)
 {
     if (start > end || obj->isFloating() ||
         (obj->isPositioned() && !obj->style()->hasStaticX() && !obj->style()->hasStaticY() && !obj->container()->isRenderInline()))
@@ -439,36 +171,6 @@ static void appendRunsForObject(int start, int end, RenderObject* obj, InlineBid
     }
 }
 
-template <>
-void InlineBidiResolver::appendRun()
-{
-    if (!emptyRun && !eor.atEnd()) {
-        int start = sor.pos;
-        RenderObject *obj = sor.obj;
-        while (obj && obj != eor.obj && obj != endOfLine.obj) {
-            appendRunsForObject(start, obj->length(), obj, *this);        
-            start = 0;
-            obj = bidiNext(sor.block, obj);
-        }
-        if (obj) {
-            unsigned pos = obj == eor.obj ? eor.pos : UINT_MAX;
-            if (obj == endOfLine.obj && endOfLine.pos <= pos) {
-                reachedEndOfLine = true;
-                pos = endOfLine.pos;
-            }
-            // It's OK to add runs for zero-length RenderObjects, just don't make the run larger than it should be
-            int end = obj->length() ? pos+1 : 0;
-            appendRunsForObject(start, end, obj, *this);
-        }
-        
-        eor.increment();
-        sor = eor;
-    }
-
-    m_direction = OtherNeutral;
-    m_status.eor = OtherNeutral;
-}
-
 static inline InlineBox* createInlineBoxForRenderer(RenderObject* obj, bool isRootLineBox, bool isOnlyRun = false)
 {
     if (isRootLineBox)
@@ -823,7 +525,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
 
     // Figure out if we should clear out our line boxes.
     // FIXME: Handle resize eventually!
-    bool fullLayout = !firstLineBox() || !firstChild() || selfNeedsLayout() || relayoutChildren;
+    bool fullLayout = !firstLineBox() || selfNeedsLayout() || relayoutChildren;
     if (fullLayout)
         lineBoxes()->deleteLineBoxes(renderArena());
 
@@ -843,6 +545,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
         bool endOfInline = false;
         RenderObject* o = bidiFirst(this, 0, false);
         Vector<FloatWithRect> floats;
+        bool hasInlineChild = false;
         while (o) {
             if (o->isReplaced() || o->isFloating() || o->isPositioned()) {
                 RenderBox* box = toRenderBox(o);
@@ -865,6 +568,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                     o->layoutIfNeeded();
                 }
             } else if (o->isText() || (o->isRenderInline() && !endOfInline)) {
+                hasInlineChild = true;
                 if (fullLayout || o->selfNeedsLayout())
                     dirtyLineBoxesForRenderer(o, fullLayout);
                 o->setNeedsLayout(false);
@@ -881,7 +585,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
         bool previousLineBrokeCleanly = true;
         RootInlineBox* startLine = determineStartPosition(firstLine, fullLayout, previousLineBrokeCleanly, resolver, floats, floatIndex);
 
-        if (fullLayout && !selfNeedsLayout()) {
+        if (fullLayout && hasInlineChild && !selfNeedsLayout()) {
             setNeedsLayout(true, false);  // Mark ourselves as needing a full layout. This way we'll repaint like
                                           // we're supposed to.
             RenderView* v = view();
@@ -942,7 +646,6 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
         bool endLineMatched = false;
         bool checkForEndLineMatch = endLine;
         bool checkForFloatsFromLastLine = false;
-        int lastHeight = height();
 
         bool isLineEmpty = true;
 
@@ -1067,8 +770,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                 } else
                     m_floatingObjects->first();
                 for (FloatingObject* f = m_floatingObjects->current(); f; f = m_floatingObjects->next()) {
-                    if (f->m_bottom > lastHeight)
-                        lastRootBox()->floats().append(f->m_renderer);
+                    lastRootBox()->floats().append(f->m_renderer);
                     ASSERT(f->m_renderer == floats[floatIndex].object);
                     // If a float's geometry has changed, give up on syncing with clean lines.
                     if (floats[floatIndex].rect != IntRect(f->m_left, f->m_top, f->m_width, f->m_bottom - f->m_top))
@@ -1078,7 +780,6 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                 lastFloat = m_floatingObjects->last();
             }
 
-            lastHeight = height();
             lineMidpointState.reset();
             resolver.setPosition(end);
         }
@@ -1122,16 +823,24 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
             // In case we have a float on the last line, it might not be positioned up to now.
             // This has to be done before adding in the bottom border/padding, or the float will
             // include the padding incorrectly. -dwh
+            if (checkForFloatsFromLastLine) {
+                int bottomVisualOverflow = lastRootBox()->bottomVisualOverflow();
+                int bottomLayoutOverflow = lastRootBox()->bottomLayoutOverflow();
+                TrailingFloatsRootInlineBox* trailingFloatsLineBox = new (renderArena()) TrailingFloatsRootInlineBox(this);
+                m_lineBoxes.appendLineBox(trailingFloatsLineBox);
+                trailingFloatsLineBox->setConstructed();
+                trailingFloatsLineBox->verticallyAlignBoxes(height());
+                trailingFloatsLineBox->setVerticalOverflowPositions(height(), bottomLayoutOverflow, height(), bottomVisualOverflow, 0);
+                trailingFloatsLineBox->setBlockHeight(height());
+            }
             if (lastFloat) {
                 for (FloatingObject* f = m_floatingObjects->last(); f != lastFloat; f = m_floatingObjects->prev()) {
                 }
                 m_floatingObjects->next();
             } else
                 m_floatingObjects->first();
-            for (FloatingObject* f = m_floatingObjects->current(); f; f = m_floatingObjects->next()) {
-                if (f->m_bottom > lastHeight)
-                    lastRootBox()->floats().append(f->m_renderer);
-            }
+            for (FloatingObject* f = m_floatingObjects->current(); f; f = m_floatingObjects->next())
+                lastRootBox()->floats().append(f->m_renderer);
             lastFloat = m_floatingObjects->last();
         }
         size_t floatCount = floats.size();
@@ -1184,7 +893,7 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
                     if (floats[floatIndex].rect.size() != newSize) {
                         int floatTop = floats[floatIndex].rect.y();
                         curr->markDirty();
-                        markLinesDirtyInVerticalRange(curr->blockHeight(), floatTop + max(floats[floatIndex].rect.height(), newSize.height()));
+                        markLinesDirtyInVerticalRange(curr->blockHeight(), floatTop + max(floats[floatIndex].rect.height(), newSize.height()), curr);
                         floats[floatIndex].rect.setSize(newSize);
                         dirtiedByFloat = true;
                     }
@@ -1430,7 +1139,7 @@ static bool inlineFlowRequiresLineBox(RenderInline* flow)
     return !flow->firstChild() && flow->hasHorizontalBordersPaddingOrMargin();
 }
 
-static inline bool requiresLineBox(const InlineIterator& it, bool isLineEmpty, bool previousLineBrokeCleanly)
+bool RenderBlock::requiresLineBox(const InlineIterator& it, bool isLineEmpty, bool previousLineBrokeCleanly)
 {
     if (it.obj->isFloatingOrPositioned())
         return false;
@@ -1769,10 +1478,10 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             currentCharacterIsSpace = false;
             currentCharacterIsWS = false;
             trailingSpaceObject = 0;
-            
+
             // Optimize for a common case. If we can't find whitespace after the list
             // item, then this is all moot. -dwh
-            if (o->isListMarker() && !toRenderListMarker(o)->isInside()) {
+            if (o->isListMarker()) {
                 if (style()->collapseWhiteSpace() && shouldSkipWhitespaceAfterStartObject(this, o, lineMidpointState)) {
                     // Like with inline flows, we start ignoring spaces to make sure that any 
                     // additional spaces we see will be discarded.
@@ -1780,6 +1489,8 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                     currentCharacterIsWS = true;
                     ignoringSpaces = true;
                 }
+                if (toRenderListMarker(o)->isInside())
+                    tmpW += replacedBox->width() + replacedBox->marginLeft() + replacedBox->marginRight() + inlineWidth(o);
             } else
                 tmpW += replacedBox->width() + replacedBox->marginLeft() + replacedBox->marginRight() + inlineWidth(o);
         } else if (o->isText()) {
@@ -1799,6 +1510,10 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             int wordSpacing = o->style()->wordSpacing();
             int lastSpaceWordSpacing = 0;
 
+            // Non-zero only when kerning is enabled, in which case we measure words with their trailing
+            // space, then subtract its width.
+            int wordTrailingSpaceWidth = f.typesettingFeatures() & Kerning ? f.spaceWidth() + wordSpacing : 0;
+
             int wrapW = tmpW + inlineWidth(o, !appliedStartWidth, true);
             int charWidth = 0;
             bool breakNBSP = autoWrap && o->style()->nbspMode() == SPACE;
@@ -1893,7 +1608,11 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                         }
                     }
 
-                    int additionalTmpW = textWidth(t, lastSpace, pos - lastSpace, f, w + tmpW, isFixedPitch, collapseWhiteSpace) + lastSpaceWordSpacing;
+                    int additionalTmpW;
+                    if (wordTrailingSpaceWidth && currentCharacterIsSpace)
+                        additionalTmpW = textWidth(t, lastSpace, pos + 1 - lastSpace, f, w + tmpW, isFixedPitch, collapseWhiteSpace) - wordTrailingSpaceWidth + lastSpaceWordSpacing;
+                    else
+                        additionalTmpW = textWidth(t, lastSpace, pos - lastSpace, f, w + tmpW, isFixedPitch, collapseWhiteSpace) + lastSpaceWordSpacing;
                     tmpW += additionalTmpW;
                     if (!appliedStartWidth) {
                         tmpW += inlineWidth(o, true, false);
@@ -1925,7 +1644,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                             }
                         }
                         if (lineWasTooWide || w + tmpW > width) {
-                            if (lBreak.obj && shouldPreserveNewline(lBreak.obj) && lBreak.obj->isText() && !toRenderText(lBreak.obj)->isWordBreak() && toRenderText(lBreak.obj)->characters()[lBreak.pos] == '\n') {
+                            if (lBreak.obj && shouldPreserveNewline(lBreak.obj) && lBreak.obj->isText() && toRenderText(lBreak.obj)->textLength() && !toRenderText(lBreak.obj)->isWordBreak() && toRenderText(lBreak.obj)->characters()[lBreak.pos] == '\n') {
                                 if (!stoppedIgnoringSpaces && pos > 0) {
                                     // We need to stop right before the newline and then start up again.
                                     addMidpoint(lineMidpointState, InlineIterator(0, o, pos - 1)); // Stop
@@ -2134,19 +1853,12 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                 lBreak.nextBreakablePosition = -1;
             }
         } else if (lBreak.obj) {
-            if (last != o && !last->isListMarker()) {
-                // better to break between object boundaries than in the middle of a word (except for list markers)
-                lBreak.obj = o;
-                lBreak.pos = 0;
-                lBreak.nextBreakablePosition = -1;
-            } else {
-                // Don't ever break in the middle of a word if we can help it.
-                // There's no room at all. We just have to be on this line,
-                // even though we'll spill out.
-                lBreak.obj = o;
-                lBreak.pos = pos;
-                lBreak.nextBreakablePosition = -1;
-            }
+            // Don't ever break in the middle of a word if we can help it.
+            // There's no room at all. We just have to be on this line,
+            // even though we'll spill out.
+            lBreak.obj = o;
+            lBreak.pos = pos;
+            lBreak.nextBreakablePosition = -1;
         }
     }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
index 7ca2ff84fc..1c0e837394 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
@@ -26,6 +26,7 @@
 #include "RenderBox.h"
 
 #include "CachedImage.h"
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "Document.h"
 #include "FrameView.h"
@@ -339,12 +340,12 @@ IntRect RenderBox::outlineBoundsForRepaint(RenderBoxModelObject* repaintContaine
     return box;
 }
 
-void RenderBox::addFocusRingRects(GraphicsContext* graphicsContext, int tx, int ty)
+void RenderBox::addFocusRingRects(Vector<IntRect>& rects, int tx, int ty)
 {
-    graphicsContext->addFocusRingRect(IntRect(tx, ty, width(), height()));
+    if (width() && height())
+        rects.append(IntRect(tx, ty, width(), height()));
 }
 
-
 IntRect RenderBox::reflectionBox() const
 {
     IntRect result;
@@ -572,13 +573,14 @@ void RenderBox::paintRootBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 {
     const FillLayer* bgLayer = style()->backgroundLayers();
     Color bgColor = style()->backgroundColor();
+    RenderObject* bodyObject = 0;
     if (!style()->hasBackground() && node() && node()->hasTagName(HTMLNames::htmlTag)) {
         // Locate the <body> element using the DOM.  This is easier than trying
         // to crawl around a render tree with potential :before/:after content and
         // anonymous blocks created by inline <body> tags etc.  We can locate the <body>
         // render object very easily via the DOM.
         HTMLElement* body = document()->body();
-        RenderObject* bodyObject = (body && body->hasLocalName(bodyTag)) ? body->renderer() : 0;
+        bodyObject = (body && body->hasLocalName(bodyTag)) ? body->renderer() : 0;
         if (bodyObject) {
             bgLayer = bodyObject->style()->backgroundLayers();
             bgColor = bodyObject->style()->backgroundColor();
@@ -606,7 +608,7 @@ void RenderBox::paintRootBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
     int bw = max(w + marginLeft() + marginRight() + borderLeft() + borderRight(), rw);
     int bh = max(h + marginTop() + marginBottom() + borderTop() + borderBottom(), rh);
 
-    paintFillLayers(paintInfo, bgColor, bgLayer, bx, by, bw, bh);
+    paintFillLayers(paintInfo, bgColor, bgLayer, bx, by, bw, bh, CompositeSourceOver, bodyObject);
 
     if (style()->hasBorder() && style()->display() != INLINE)
         paintBorder(paintInfo.context, tx, ty, w, h, style());
@@ -674,9 +676,25 @@ void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int tx, int ty, int
     bool compositedMask = hasLayer() && layer()->hasCompositedMask();
     CompositeOperator compositeOp = CompositeSourceOver;
 
+    bool allMaskImagesLoaded = true;
+    
     if (!compositedMask) {
         StyleImage* maskBoxImage = style()->maskBoxImage().image();
-        if (maskBoxImage && style()->maskLayers()->hasImage()) {
+        const FillLayer* maskLayers = style()->maskLayers();
+
+        // Don't render a masked element until all the mask images have loaded, to prevent a flash of unmasked content.
+        if (maskBoxImage)
+            allMaskImagesLoaded &= maskBoxImage->isLoaded();
+
+        if (maskLayers)
+            allMaskImagesLoaded &= maskLayers->imagesAreLoaded();
+
+        // Before all images have loaded, just use an empty transparency layer as the mask.
+        if (!allMaskImagesLoaded)
+            pushTransparencyLayer = true;
+
+        if (maskBoxImage && maskLayers->hasImage()) {
+            // We have a mask-box-image and mask-image, so need to composite them together before using the result as a mask.
             pushTransparencyLayer = true;
         } else {
             // We have to use an extra image buffer to hold the mask. Multiple mask images need
@@ -686,7 +704,7 @@ void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int tx, int ty, int
             // and composite that buffer as the mask.
             // We have to check that the mask images to be rendered contain at least one image that can be actually used in rendering
             // before pushing the transparency layer.
-            for (const FillLayer* fillLayer = style()->maskLayers()->next(); fillLayer; fillLayer = fillLayer->next()) {
+            for (const FillLayer* fillLayer = maskLayers->next(); fillLayer; fillLayer = fillLayer->next()) {
                 if (fillLayer->hasImage() && fillLayer->image()->canRender(style()->effectiveZoom())) {
                     pushTransparencyLayer = true;
                     // We found one image that can be used in rendering, exit the loop
@@ -703,8 +721,10 @@ void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int tx, int ty, int
         }
     }
 
-    paintFillLayers(paintInfo, Color(), style()->maskLayers(), tx, ty, w, h, compositeOp);
-    paintNinePieceImage(paintInfo.context, tx, ty, w, h, style(), style()->maskBoxImage(), compositeOp);
+    if (allMaskImagesLoaded) {
+        paintFillLayers(paintInfo, Color(), style()->maskLayers(), tx, ty, w, h, compositeOp);
+        paintNinePieceImage(paintInfo.context, tx, ty, w, h, style(), style()->maskBoxImage(), compositeOp);
+    }
     
     if (pushTransparencyLayer)
         paintInfo.context->endTransparencyLayer();
@@ -729,18 +749,18 @@ IntRect RenderBox::maskClipRect()
     return result;
 }
 
-void RenderBox::paintFillLayers(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int width, int height, CompositeOperator op)
+void RenderBox::paintFillLayers(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int width, int height, CompositeOperator op, RenderObject* backgroundObject)
 {
     if (!fillLayer)
         return;
 
-    paintFillLayers(paintInfo, c, fillLayer->next(), tx, ty, width, height, op);
-    paintFillLayer(paintInfo, c, fillLayer, tx, ty, width, height, op);
+    paintFillLayers(paintInfo, c, fillLayer->next(), tx, ty, width, height, op, backgroundObject);
+    paintFillLayer(paintInfo, c, fillLayer, tx, ty, width, height, op, backgroundObject);
 }
 
-void RenderBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int width, int height, CompositeOperator op)
+void RenderBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int width, int height, CompositeOperator op, RenderObject* backgroundObject)
 {
-    paintFillLayerExtended(paintInfo, c, fillLayer, tx, ty, width, height, 0, op);
+    paintFillLayerExtended(paintInfo, c, fillLayer, tx, ty, width, height, 0, op, backgroundObject);
 }
 
 void RenderBox::imageChanged(WrappedImagePtr image, const IntRect*)
@@ -950,19 +970,21 @@ void RenderBox::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool
         }
     }
 
-    if (style()->position() == FixedPosition)
-        fixed = true;
-
     bool containerSkipped;
     RenderObject* o = container(repaintContainer, &containerSkipped);
     if (!o)
         return;
 
+    bool isFixedPos = style()->position() == FixedPosition;
     bool hasTransform = hasLayer() && layer()->transform();
-    if (hasTransform)
-        fixed = false;  // Elements with transforms act as a containing block for fixed position descendants
-
-    IntSize containerOffset = offsetFromContainer(o);
+    if (hasTransform) {
+        // If this box has a transform, it acts as a fixed position container for fixed descendants,
+        // and may itself also be fixed position. So propagate 'fixed' up only if this box is fixed position.
+        fixed &= isFixedPos;
+    } else
+        fixed |= isFixedPos;
+    
+    IntSize containerOffset = offsetFromContainer(o, roundedIntPoint(transformState.mappedPoint()));
 
     bool preserve3D = useTransforms && (o->style()->preserves3D() || style()->preserves3D());
     if (useTransforms && shouldUseTransformFromContainer(o)) {
@@ -988,12 +1010,14 @@ void RenderBox::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, Transfor
     // We don't expect absoluteToLocal() to be called during layout (yet)
     ASSERT(!view() || !view()->layoutStateEnabled());
     
-    if (style()->position() == FixedPosition)
-        fixed = true;
-
+    bool isFixedPos = style()->position() == FixedPosition;
     bool hasTransform = hasLayer() && layer()->transform();
-    if (hasTransform)
-        fixed = false;  // Elements with transforms act as a containing block for fixed position descendants
+    if (hasTransform) {
+        // If this box has a transform, it acts as a fixed position container for fixed descendants,
+        // and may itself also be fixed position. So propagate 'fixed' up only if this box is fixed position.
+        fixed &= isFixedPos;
+    } else
+        fixed |= isFixedPos;
     
     RenderObject* o = container();
     if (!o)
@@ -1001,7 +1025,7 @@ void RenderBox::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, Transfor
 
     o->mapAbsoluteToLocalPoint(fixed, useTransforms, transformState);
 
-    IntSize containerOffset = offsetFromContainer(o);
+    IntSize containerOffset = offsetFromContainer(o, IntPoint());
 
     bool preserve3D = useTransforms && (o->style()->preserves3D() || style()->preserves3D());
     if (useTransforms && shouldUseTransformFromContainer(o)) {
@@ -1012,7 +1036,7 @@ void RenderBox::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, Transfor
         transformState.move(-containerOffset.width(), -containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
 }
 
-IntSize RenderBox::offsetFromContainer(RenderObject* o) const
+IntSize RenderBox::offsetFromContainer(RenderObject* o, const IntPoint& point) const
 {
     ASSERT(o == container());
 
@@ -1021,14 +1045,9 @@ IntSize RenderBox::offsetFromContainer(RenderObject* o) const
         offset += relativePositionOffset();
 
     if (!isInline() || isReplaced()) {
-        RenderBlock* cb;
-        if (o->isBlockFlow() && style()->position() != AbsolutePosition && style()->position() != FixedPosition
-                && (cb = toRenderBlock(o))->hasColumns()) {
-            IntRect rect(x(), y(), 1, 1);
-            cb->adjustRectForColumns(rect);
-            offset.expand(rect.x(), rect.y());
-        } else
-            offset.expand(x(), y());
+        if (style()->position() != AbsolutePosition && style()->position() != FixedPosition)
+            o->adjustForColumns(offset, IntPoint(point.x() + x(), point.y() + y()));
+        offset.expand(x(), y());
     }
 
     if (o->hasOverflowClip())
@@ -1481,7 +1500,7 @@ void RenderBox::calcHeight()
     // height since we don't set a height in RenderView when we're printing. So without this quirk, the 
     // height has nothing to be a percentage of, and it ends up being 0. That is bad.
     bool printingNeedsBaseHeight = document()->printing() && h.isPercent()
-        && (isRoot() || isBody() && document()->documentElement()->renderer()->style()->height().isPercent());
+        && (isRoot() || (isBody() && document()->documentElement()->renderer()->style()->height().isPercent()));
     if (stretchesToViewHeight() || printingNeedsBaseHeight) {
         int margins = collapsedMarginTop() + collapsedMarginBottom();
         int visHeight = document()->printing() ? view()->frameView()->visibleHeight() : view()->viewHeight();
@@ -1926,7 +1945,7 @@ void RenderBox::calcAbsoluteHorizontalValues(Length width, const RenderBoxModelO
                                              int& widthValue, int& marginLeftValue, int& marginRightValue, int& xPos)
 {
     // 'left' and 'right' cannot both be 'auto' because one would of been
-    // converted to the static postion already
+    // converted to the static position already
     ASSERT(!(left.isAuto() && right.isAuto()));
 
     int leftValue = 0;
@@ -1960,7 +1979,7 @@ void RenderBox::calcAbsoluteHorizontalValues(Length width, const RenderBoxModelO
         if (marginLeft.isAuto() && marginRight.isAuto()) {
             // Both margins auto, solve for equality
             if (availableSpace >= 0) {
-                marginLeftValue = availableSpace / 2; // split the diference
+                marginLeftValue = availableSpace / 2; // split the difference
                 marginRightValue = availableSpace - marginLeftValue;  // account for odd valued differences
             } else {
                 // see FIXME 1
@@ -2245,7 +2264,7 @@ void RenderBox::calcAbsoluteVerticalValues(Length h, const RenderBoxModelObject*
         if (marginTop.isAuto() && marginBottom.isAuto()) {
             // Both margins auto, solve for equality
             // NOTE: This may result in negative values.
-            marginTopValue = availableSpace / 2; // split the diference
+            marginTopValue = availableSpace / 2; // split the difference
             marginBottomValue = availableSpace - marginTopValue; // account for odd valued differences
         } else if (marginTop.isAuto()) {
             // Solve for top margin
@@ -2323,7 +2342,7 @@ void RenderBox::calcAbsoluteVerticalValues(Length h, const RenderBoxModelObject*
 void RenderBox::calcAbsoluteHorizontalReplaced()
 {
     // The following is based off of the W3C Working Draft from April 11, 2006 of
-    // CSS 2.1: Section 10.3.8 "Absolutly positioned, replaced elements"
+    // CSS 2.1: Section 10.3.8 "Absolutely positioned, replaced elements"
     // <http://www.w3.org/TR/2005/WD-CSS21-20050613/visudet.html#abs-replaced-width>
     // (block-style-comments in this function correspond to text from the spec and
     // the numbers correspond to numbers in spec)
@@ -2414,7 +2433,7 @@ void RenderBox::calcAbsoluteHorizontalReplaced()
 
         int difference = availableSpace - (leftValue + rightValue);
         if (difference > 0) {
-            m_marginLeft = difference / 2; // split the diference
+            m_marginLeft = difference / 2; // split the difference
             m_marginRight = difference - m_marginLeft; // account for odd valued differences
         } else {
             // see FIXME 1
@@ -2501,7 +2520,7 @@ void RenderBox::calcAbsoluteHorizontalReplaced()
 void RenderBox::calcAbsoluteVerticalReplaced()
 {
     // The following is based off of the W3C Working Draft from April 11, 2006 of
-    // CSS 2.1: Section 10.6.5 "Absolutly positioned, replaced elements"
+    // CSS 2.1: Section 10.6.5 "Absolutely positioned, replaced elements"
     // <http://www.w3.org/TR/2005/WD-CSS21-20050613/visudet.html#abs-replaced-height>
     // (block-style-comments in this function correspond to text from the spec and
     // the numbers correspond to numbers in spec)
@@ -2565,7 +2584,7 @@ void RenderBox::calcAbsoluteVerticalReplaced()
     int bottomValue = 0;
 
     if (marginTop.isAuto() && marginBottom.isAuto()) {
-        // 'top' and 'bottom' cannot be 'auto' due to step 2 and 3 combinded.
+        // 'top' and 'bottom' cannot be 'auto' due to step 2 and 3 combined.
         ASSERT(!(top.isAuto() || bottom.isAuto()));
 
         topValue = top.calcValue(containerHeight);
@@ -2705,7 +2724,7 @@ VisiblePosition RenderBox::positionForPoint(const IntPoint& point)
 {
     // no children...return this render object's element, if there is one, and offset 0
     if (!firstChild())
-        return createVisiblePosition(firstDeepEditingPositionForNode(node()));
+        return createVisiblePosition(node() ? firstDeepEditingPositionForNode(node()) : Position(0, 0));
 
     int xPos = point.x();
     int yPos = point.y();
@@ -2885,9 +2904,9 @@ void RenderBox::clearLayoutOverflow()
 
 #if ENABLE(SVG)
 
-TransformationMatrix RenderBox::localTransform() const
+AffineTransform RenderBox::localTransform() const
 {
-    return TransformationMatrix(1, 0, 0, 1, x(), y());
+    return AffineTransform(1, 0, 0, 1, x(), y());
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBox.h b/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
index 9050dcbe14..90a17ae0bb 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
@@ -74,7 +74,7 @@ public:
 
     // Bounds of the outline box in absolute coords. Respects transforms
     virtual IntRect outlineBoundsForRepaint(RenderBoxModelObject* /*repaintContainer*/) const;
-    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
+    virtual void addFocusRingRects(Vector<IntRect>&, int tx, int ty);
 
     // Use this with caution! No type checking is done!
     RenderBox* previousSiblingBox() const;
@@ -173,7 +173,7 @@ public:
     int overrideHeight() const;
     virtual void setOverrideSize(int);
 
-    virtual IntSize offsetFromContainer(RenderObject*) const;
+    virtual IntSize offsetFromContainer(RenderObject*, const IntPoint&) const;
     
     int calcBorderBoxWidth(int width) const;
     int calcBorderBoxHeight(int height) const;
@@ -271,9 +271,9 @@ public:
     virtual void paintMask(PaintInfo&, int tx, int ty);
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
-    // Called when a positioned object moves but doesn't change size.  A simplified layout is done
-    // that just updates the object's position.
-    virtual void tryLayoutDoingPositionedMovementOnly()
+    // Called when a positioned object moves but doesn't necessarily change size.  A simplified layout is attempted
+    // that just updates the object's position. If the size does change, the object remains dirty.
+    void tryLayoutDoingPositionedMovementOnly()
     {
         int oldWidth = width();
         calcWidth();
@@ -297,7 +297,7 @@ public:
     virtual bool avoidsFloats() const;
 
 #if ENABLE(SVG)
-    virtual TransformationMatrix localTransform() const;
+    virtual AffineTransform localTransform() const;
 #endif
 
 protected:
@@ -305,8 +305,8 @@ protected:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
     virtual void updateBoxModelInfoFromStyle();
 
-    void paintFillLayer(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver);
-    void paintFillLayers(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver);
+    void paintFillLayer(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, CompositeOperator op, RenderObject* backgroundObject);
+    void paintFillLayers(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver, RenderObject* backgroundObject = 0);
 
     void paintMaskImages(const PaintInfo&, int tx, int ty, int width, int height);
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp
index 9d0f1edf43..ba4b8dd904 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp
@@ -33,6 +33,7 @@
 #include "RenderInline.h"
 #include "RenderLayer.h"
 #include "RenderView.h"
+#include <wtf/CurrentTime.h>
 
 using namespace std;
 
@@ -44,6 +45,142 @@ bool RenderBoxModelObject::s_wasFloating = false;
 bool RenderBoxModelObject::s_hadLayer = false;
 bool RenderBoxModelObject::s_layerWasSelfPainting = false;
 
+static const double cInterpolationCutoff = 800. * 800.;
+static const double cLowQualityTimeThreshold = 0.500; // 500 ms
+
+class RenderBoxModelScaleData : public Noncopyable {
+public:
+    RenderBoxModelScaleData(RenderBoxModelObject* object, const IntSize& size, const AffineTransform& transform, double time, bool lowQualityScale)
+        : m_size(size)
+        , m_transform(transform)
+        , m_lastPaintTime(time)
+        , m_lowQualityScale(lowQualityScale)
+        , m_highQualityRepaintTimer(object, &RenderBoxModelObject::highQualityRepaintTimerFired)
+    {
+    }
+
+    ~RenderBoxModelScaleData()
+    {
+        m_highQualityRepaintTimer.stop();
+    }
+
+    Timer<RenderBoxModelObject>& hiqhQualityRepaintTimer() { return m_highQualityRepaintTimer; }
+
+    const IntSize& size() const { return m_size; }
+    void setSize(const IntSize& s) { m_size = s; }
+    double lastPaintTime() const { return m_lastPaintTime; }
+    void setLastPaintTime(double t) { m_lastPaintTime = t; }
+    bool useLowQualityScale() const { return m_lowQualityScale; }
+    const AffineTransform& transform() const { return m_transform; }
+    void setTransform(const AffineTransform& transform) { m_transform = transform; }
+    void setUseLowQualityScale(bool b)
+    {
+        m_highQualityRepaintTimer.stop();
+        m_lowQualityScale = b;
+        if (b)
+            m_highQualityRepaintTimer.startOneShot(cLowQualityTimeThreshold);
+    }
+
+private:
+    IntSize m_size;
+    AffineTransform m_transform;
+    double m_lastPaintTime;
+    bool m_lowQualityScale;
+    Timer<RenderBoxModelObject> m_highQualityRepaintTimer;
+};
+
+class RenderBoxModelScaleObserver {
+public:
+    static bool shouldPaintBackgroundAtLowQuality(GraphicsContext*, RenderBoxModelObject*, Image*, const IntSize&);
+
+    static void boxModelObjectDestroyed(RenderBoxModelObject* object)
+    {
+        if (gBoxModelObjects) {
+            RenderBoxModelScaleData* data = gBoxModelObjects->take(object);
+            delete data;
+            if (!gBoxModelObjects->size()) {
+                delete gBoxModelObjects;
+                gBoxModelObjects = 0;
+            }
+        }
+    }
+
+    static void highQualityRepaintTimerFired(RenderBoxModelObject* object)
+    {
+        RenderBoxModelScaleObserver::boxModelObjectDestroyed(object);
+        object->repaint();
+    }
+
+    static HashMap<RenderBoxModelObject*, RenderBoxModelScaleData*>* gBoxModelObjects;
+};
+
+bool RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality(GraphicsContext* context, RenderBoxModelObject* object, Image* image, const IntSize& size)
+{
+    // If the image is not a bitmap image, then none of this is relevant and we just paint at high
+    // quality.
+    if (!image || !image->isBitmapImage())
+        return false;
+
+    // Make sure to use the unzoomed image size, since if a full page zoom is in effect, the image
+    // is actually being scaled.
+    IntSize imageSize(image->width(), image->height());
+
+    // Look ourselves up in the hashtable.
+    RenderBoxModelScaleData* data = 0;
+    if (gBoxModelObjects)
+        data = gBoxModelObjects->get(object);
+
+    const AffineTransform& currentTransform = context->getCTM();
+    bool contextIsScaled = !currentTransform.isIdentityOrTranslationOrFlipped();
+    if (!contextIsScaled && imageSize == size) {
+        // There is no scale in effect.  If we had a scale in effect before, we can just delete this data.
+        if (data) {
+            gBoxModelObjects->remove(object);
+            delete data;
+        }
+        return false;
+    }
+
+    // There is no need to hash scaled images that always use low quality mode when the page demands it.  This is the iChat case.
+    if (object->document()->page()->inLowQualityImageInterpolationMode()) {
+        double totalPixels = static_cast<double>(image->width()) * static_cast<double>(image->height());
+        if (totalPixels > cInterpolationCutoff)
+            return true;
+    }
+
+    // If there is no data yet, we will paint the first scale at high quality and record the paint time in case a second scale happens
+    // very soon.
+    if (!data) {
+        data = new RenderBoxModelScaleData(object, size, currentTransform, currentTime(), false);
+        if (!gBoxModelObjects)
+            gBoxModelObjects = new HashMap<RenderBoxModelObject*, RenderBoxModelScaleData*>;
+        gBoxModelObjects->set(object, data);
+        return false;
+    }
+
+    const AffineTransform& tr = data->transform();
+    bool scaleUnchanged = tr.a() == currentTransform.a() && tr.b() == currentTransform.b() && tr.c() == currentTransform.c() && tr.d() == currentTransform.d();
+    // We are scaled, but we painted already at this size, so just keep using whatever mode we last painted with.
+    if ((!contextIsScaled || scaleUnchanged) && data->size() == size)
+        return data->useLowQualityScale();
+
+    // We have data and our size just changed.  If this change happened quickly, go into low quality mode and then set a repaint
+    // timer to paint in high quality mode.  Otherwise it is ok to just paint in high quality mode.
+    double newTime = currentTime();
+    data->setUseLowQualityScale(newTime - data->lastPaintTime() < cLowQualityTimeThreshold);
+    data->setLastPaintTime(newTime);
+    data->setTransform(currentTransform);
+    data->setSize(size);
+    return data->useLowQualityScale();
+}
+
+HashMap<RenderBoxModelObject*, RenderBoxModelScaleData*>* RenderBoxModelScaleObserver::gBoxModelObjects = 0;
+
+void RenderBoxModelObject::highQualityRepaintTimerFired(Timer<RenderBoxModelObject>*)
+{
+    RenderBoxModelScaleObserver::highQualityRepaintTimerFired(this);
+}
+
 RenderBoxModelObject::RenderBoxModelObject(Node* node)
     : RenderObject(node)
     , m_layer(0)
@@ -55,6 +192,7 @@ RenderBoxModelObject::~RenderBoxModelObject()
     // Our layer should have been destroyed and cleared by now
     ASSERT(!hasLayer());
     ASSERT(!m_layer);
+    RenderBoxModelScaleObserver::boxModelObjectDestroyed(this);
 }
 
 void RenderBoxModelObject::destroyLayer()
@@ -304,9 +442,12 @@ int RenderBoxModelObject::paddingRight(bool) const
 }
 
 
-void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, const Color& c, const FillLayer* bgLayer, int tx, int ty, int w, int h, InlineFlowBox* box, CompositeOperator op)
+void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, const Color& c, const FillLayer* bgLayer, int tx, int ty, int w, int h, InlineFlowBox* box, CompositeOperator op, RenderObject* backgroundObject)
 {
     GraphicsContext* context = paintInfo.context;
+    if (context->paintingDisabled())
+        return;
+
     bool includeLeftEdge = box ? box->includeLeftEdge() : true;
     bool includeRightEdge = box ? box->includeRightEdge() : true;
     int bLeft = includeLeftEdge ? borderLeft() : 0;
@@ -340,7 +481,9 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
         context->clip(toRenderBox(this)->overflowClipRect(tx, ty));
         
         // Now adjust our tx, ty, w, h to reflect a scrolled content box with borders at the ends.
-        layer()->subtractScrolledContentOffset(tx, ty);
+        IntSize offset = layer()->scrolledContentOffset();
+        tx -= offset.width();
+        ty -= offset.height();
         w = bLeft + layer()->scrollWidth() + bRight;
         h = borderTop() + layer()->scrollHeight() + borderBottom();
     }
@@ -441,14 +584,14 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
             if (baseColor.alpha() > 0) {
                 context->save();
                 context->setCompositeOperation(CompositeCopy);
-                context->fillRect(rect, baseColor);
+                context->fillRect(rect, baseColor, style()->colorSpace());
                 context->restore();
             } else
                 context->clearRect(rect);
         }
 
         if (bgColor.isValid() && bgColor.alpha() > 0)
-            context->fillRect(rect, bgColor);
+            context->fillRect(rect, bgColor, style()->colorSpace());
     }
 
     // no progressive loading of the background image
@@ -463,21 +606,10 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
         if (!destRect.isEmpty()) {
             phase += destRect.location() - destOrigin;
             CompositeOperator compositeOp = op == CompositeSourceOver ? bgLayer->composite() : op;
-            RenderObject* clientForBackgroundImage = this;
-            // Check if this is the root element painting a background layer propagated from <body>,
-            // and pass the body's renderer as the client in that case.
-            if (isRoot && !style()->hasBackground()) {
-                ASSERT(node()->hasTagName(htmlTag));
-                HTMLElement* body = document()->body();
-                ASSERT(body);
-                ASSERT(body->hasLocalName(bodyTag));
-                ASSERT(body->renderer());
-                if (body) {
-                    if (RenderObject* bodyRenderer = body->renderer())
-                        clientForBackgroundImage = bodyRenderer;
-                }
-            }
-            context->drawTiledImage(bg->image(clientForBackgroundImage, tileSize), destRect, phase, tileSize, compositeOp);
+            RenderObject* clientForBackgroundImage = backgroundObject ? backgroundObject : this;
+            Image* image = bg->image(clientForBackgroundImage, tileSize);
+            bool useLowQualityScaling = RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality(context, this, image, tileSize);
+            context->drawTiledImage(image, style()->colorSpace(), destRect, phase, tileSize, compositeOp, useLowQualityScaling);
         }
     }
 
@@ -663,7 +795,8 @@ int RenderBoxModelObject::verticalPosition(bool firstLine) const
             vpos += -static_cast<int>(f.xHeight() / 2) - lineHeight(firstLine) / 2 + baselinePosition(firstLine);
         else if (va == TEXT_BOTTOM) {
             vpos += f.descent();
-            if (!isReplaced()) // lineHeight - baselinePosition is always 0 for replaced elements, so don't bother wasting time in that case.
+            // lineHeight - baselinePosition is always 0 for replaced elements (except inline blocks), so don't bother wasting time in that case.
+            if (!isReplaced() || style()->display() == INLINE_BLOCK)
                 vpos -= (lineHeight(firstLine) - baselinePosition(firstLine));
         } else if (va == BASELINE_MIDDLE)
             vpos += -lineHeight(firstLine) / 2 + baselinePosition(firstLine);
@@ -717,6 +850,7 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
                       (imageHeight - topSlice - bottomSlice) > 0 && (h - topWidth - bottomWidth) > 0;
 
     Image* image = styleImage->image(this, imageSize);
+    ColorSpace colorSpace = style->colorSpace();
 
     if (drawLeft) {
         // Paint the top and bottom left corners.
@@ -724,18 +858,18 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
         // The top left corner rect is (tx, ty, leftWidth, topWidth)
         // The rect to use from within the image is obtained from our slice, and is (0, 0, leftSlice, topSlice)
         if (drawTop)
-            graphicsContext->drawImage(image, IntRect(tx, ty, leftWidth, topWidth),
+            graphicsContext->drawImage(image, colorSpace, IntRect(tx, ty, leftWidth, topWidth),
                                        IntRect(0, 0, leftSlice, topSlice), op);
 
         // The bottom left corner rect is (tx, ty + h - bottomWidth, leftWidth, bottomWidth)
         // The rect to use from within the image is (0, imageHeight - bottomSlice, leftSlice, botomSlice)
         if (drawBottom)
-            graphicsContext->drawImage(image, IntRect(tx, ty + h - bottomWidth, leftWidth, bottomWidth),
+            graphicsContext->drawImage(image, colorSpace, IntRect(tx, ty + h - bottomWidth, leftWidth, bottomWidth),
                                        IntRect(0, imageHeight - bottomSlice, leftSlice, bottomSlice), op);
 
         // Paint the left edge.
         // Have to scale and tile into the border rect.
-        graphicsContext->drawTiledImage(image, IntRect(tx, ty + topWidth, leftWidth,
+        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx, ty + topWidth, leftWidth,
                                         h - topWidth - bottomWidth),
                                         IntRect(0, topSlice, leftSlice, imageHeight - topSlice - bottomSlice),
                                         Image::StretchTile, (Image::TileRule)vRule, op);
@@ -746,17 +880,17 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
         // The top right corner rect is (tx + w - rightWidth, ty, rightWidth, topWidth)
         // The rect to use from within the image is obtained from our slice, and is (imageWidth - rightSlice, 0, rightSlice, topSlice)
         if (drawTop)
-            graphicsContext->drawImage(image, IntRect(tx + w - rightWidth, ty, rightWidth, topWidth),
+            graphicsContext->drawImage(image, colorSpace, IntRect(tx + w - rightWidth, ty, rightWidth, topWidth),
                                        IntRect(imageWidth - rightSlice, 0, rightSlice, topSlice), op);
 
         // The bottom right corner rect is (tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth)
         // The rect to use from within the image is (imageWidth - rightSlice, imageHeight - bottomSlice, rightSlice, bottomSlice)
         if (drawBottom)
-            graphicsContext->drawImage(image, IntRect(tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth),
+            graphicsContext->drawImage(image, colorSpace, IntRect(tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth),
                                        IntRect(imageWidth - rightSlice, imageHeight - bottomSlice, rightSlice, bottomSlice), op);
 
         // Paint the right edge.
-        graphicsContext->drawTiledImage(image, IntRect(tx + w - rightWidth, ty + topWidth, rightWidth,
+        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + w - rightWidth, ty + topWidth, rightWidth,
                                         h - topWidth - bottomWidth),
                                         IntRect(imageWidth - rightSlice, topSlice, rightSlice, imageHeight - topSlice - bottomSlice),
                                         Image::StretchTile, (Image::TileRule)vRule, op);
@@ -764,20 +898,20 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
 
     // Paint the top edge.
     if (drawTop)
-        graphicsContext->drawTiledImage(image, IntRect(tx + leftWidth, ty, w - leftWidth - rightWidth, topWidth),
+        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + leftWidth, ty, w - leftWidth - rightWidth, topWidth),
                                         IntRect(leftSlice, 0, imageWidth - rightSlice - leftSlice, topSlice),
                                         (Image::TileRule)hRule, Image::StretchTile, op);
 
     // Paint the bottom edge.
     if (drawBottom)
-        graphicsContext->drawTiledImage(image, IntRect(tx + leftWidth, ty + h - bottomWidth,
+        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + leftWidth, ty + h - bottomWidth,
                                         w - leftWidth - rightWidth, bottomWidth),
                                         IntRect(leftSlice, imageHeight - bottomSlice, imageWidth - rightSlice - leftSlice, bottomSlice),
                                         (Image::TileRule)hRule, Image::StretchTile, op);
 
     // Paint the middle.
     if (drawMiddle)
-        graphicsContext->drawTiledImage(image, IntRect(tx + leftWidth, ty + topWidth, w - leftWidth - rightWidth,
+        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + leftWidth, ty + topWidth, w - leftWidth - rightWidth,
                                         h - topWidth - bottomWidth),
                                         IntRect(leftSlice, topSlice, imageWidth - rightSlice - leftSlice, imageHeight - topSlice - bottomSlice),
                                         (Image::TileRule)hRule, (Image::TileRule)vRule, op);
@@ -1209,7 +1343,7 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
             shadowOffset -= extraOffset;
             fillRect.move(extraOffset);
 
-            context->setShadow(shadowOffset, shadowBlur, shadowColor);
+            context->setShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
             if (hasBorderRadius) {
                 IntRect rectToClipOut = rect;
                 IntSize topLeftToClipOut = topLeft;
@@ -1252,7 +1386,7 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
 
                 if (!rectToClipOut.isEmpty())
                     context->clipOutRoundedRect(rectToClipOut, topLeftToClipOut, topRightToClipOut, bottomLeftToClipOut, bottomRightToClipOut);
-                context->fillRoundedRect(fillRect, topLeft, topRight, bottomLeft, bottomRight, Color::black);
+                context->fillRoundedRect(fillRect, topLeft, topRight, bottomLeft, bottomRight, Color::black, s->colorSpace());
             } else {
                 IntRect rectToClipOut = rect;
 
@@ -1261,7 +1395,7 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
                 // edges if they are not pixel-aligned. Those are avoided by insetting the clipping path
                 // by one pixel.
                 if (hasOpaqueBackground) {
-                    TransformationMatrix currentTransformation = context->getCTM();
+                    AffineTransform currentTransformation = context->getCTM();
                     if (currentTransformation.a() != 1 || (currentTransformation.d() != 1 && currentTransformation.d() != -1)
                             || currentTransformation.b() || currentTransformation.c())
                         rectToClipOut.inflate(-1);
@@ -1269,7 +1403,7 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
 
                 if (!rectToClipOut.isEmpty())
                     context->clipOut(rectToClipOut);
-                context->fillRect(fillRect, Color::black);
+                context->fillRect(fillRect, Color::black, s->colorSpace());
             }
 
             context->restore();
@@ -1280,9 +1414,9 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
 
             if (holeRect.isEmpty()) {
                 if (hasBorderRadius)
-                    context->fillRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight, shadowColor);
+                    context->fillRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight, shadowColor, s->colorSpace());
                 else
-                    context->fillRect(rect, shadowColor);
+                    context->fillRect(rect, shadowColor, s->colorSpace());
                 continue;
             }
             if (!begin) {
@@ -1331,8 +1465,8 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
                 context->addPath(Path::createRectangle(holeRect));
 
             context->setFillRule(RULE_EVENODD);
-            context->setFillColor(fillColor);
-            context->setShadow(shadowOffset, shadowBlur, shadowColor);
+            context->setFillColor(fillColor, s->colorSpace());
+            context->setShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
             context->fillPath();
 
             context->restore();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h
index c9a4a0a0e1..db7538d9ed 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h
@@ -90,7 +90,7 @@ public:
     void paintBorder(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, bool begin = true, bool end = true);
     bool paintNinePieceImage(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, const NinePieceImage&, CompositeOperator = CompositeSourceOver);
     void paintBoxShadow(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, ShadowStyle, bool begin = true, bool end = true);
-    void paintFillLayerExtended(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, InlineFlowBox* = 0, CompositeOperator = CompositeSourceOver);
+    void paintFillLayerExtended(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, InlineFlowBox* = 0, CompositeOperator = CompositeSourceOver, RenderObject* backgroundObject = 0);
 
     // The difference between this inline's baseline position and the line's baseline position.
     int verticalPosition(bool firstLine) const;
@@ -98,6 +98,8 @@ public:
     // Called by RenderObject::destroy() (and RenderWidget::destroy()) and is the only way layers should ever be destroyed
     void destroyLayer();
 
+    void highQualityRepaintTimerFired(Timer<RenderBoxModelObject>*);
+
 protected:
     void calculateBackgroundImageGeometry(const FillLayer*, int tx, int ty, int w, int h, IntRect& destRect, IntPoint& phase, IntSize& tileSize);
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderButton.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderButton.cpp
index f3ae5580f3..3ecd38247d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderButton.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderButton.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the html renderer for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderButton.h b/src/3rdparty/webkit/WebCore/rendering/RenderButton.h
index 3a74589677..7fd6ab0437 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderButton.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderButton.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the html renderer for KDE.
- *
  * Copyright (C) 2005 Apple Computer
  *
  * This library is free software; you can redistribute it and/or
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp
index 17c6dad211..3cb9a078f0 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp
@@ -38,7 +38,7 @@ using namespace HTMLNames;
 typedef HashMap<RefPtr<AtomicStringImpl>, CounterNode*> CounterMap;
 typedef HashMap<const RenderObject*, CounterMap*> CounterMaps;
 
-static CounterNode* counter(RenderObject*, const AtomicString& counterName, bool alwaysCreateCounter);
+static CounterNode* makeCounterNode(RenderObject*, const AtomicString& identifier, bool alwaysCreateCounter);
 
 static CounterMaps& counterMaps()
 {
@@ -53,31 +53,7 @@ static inline RenderObject* previousSiblingOrParent(RenderObject* object)
     return object->parent();
 }
 
-static CounterNode* lastDescendant(CounterNode* node)
-{
-    CounterNode* last = node->lastChild();
-    if (!last)
-        return 0;
-
-    while (CounterNode* lastChild = last->lastChild())
-        last = lastChild;
-
-    return last;
-}
-
-static CounterNode* previousInPreOrder(CounterNode* node)
-{
-    CounterNode* previous = node->previousSibling();
-    if (!previous)
-        return node->parent();
-
-    while (CounterNode* lastChild = previous->lastChild())
-        previous = lastChild;
-
-    return previous;
-}
-
-static bool planCounter(RenderObject* object, const AtomicString& counterName, bool& isReset, int& value)
+static bool planCounter(RenderObject* object, const AtomicString& identifier, bool& isReset, int& value)
 {
     ASSERT(object);
 
@@ -90,7 +66,7 @@ static bool planCounter(RenderObject* object, const AtomicString& counterName, b
     ASSERT(style);
 
     if (const CounterDirectiveMap* directivesMap = style->counterDirectives()) {
-        CounterDirectives directives = directivesMap->get(counterName.impl());
+        CounterDirectives directives = directivesMap->get(identifier.impl());
         if (directives.m_reset) {
             value = directives.m_resetValue;
             if (directives.m_increment)
@@ -105,7 +81,7 @@ static bool planCounter(RenderObject* object, const AtomicString& counterName, b
         }
     }
 
-    if (counterName == "list-item") {
+    if (identifier == "list-item") {
         if (object->isListItem()) {
             if (toRenderListItem(object)->hasExplicitValue()) {
                 value = toRenderListItem(object)->explicitValue();
@@ -133,83 +109,142 @@ static bool planCounter(RenderObject* object, const AtomicString& counterName, b
     return false;
 }
 
-static bool findPlaceForCounter(RenderObject* object, const AtomicString& counterName,
-    bool isReset, CounterNode*& parent, CounterNode*& previousSibling)
+// - Finds the insertion point for the counter described by counterOwner, isReset and 
+// identifier in the CounterNode tree for identifier and sets parent and
+// previousSibling accordingly.
+// - The function returns true if the counter whose insertion point is searched is NOT
+// the root of the tree.
+// - The root of the tree is a counter reference that is not in the scope of any other
+// counter with the same identifier.
+// - All the counter references with the same identifier as this one that are in
+// children or subsequent siblings of the renderer that owns the root of the tree
+// form the rest of of the nodes of the tree.
+// - The root of the tree is always a reset type reference.
+// - A subtree rooted at any reset node in the tree is equivalent to all counter 
+// references that are in the scope of the counter or nested counter defined by that
+// reset node.
+// - Non-reset CounterNodes cannot have descendants.
+
+static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString& identifier, bool isReset, CounterNode*& parent, CounterNode*& previousSibling)
 {
-    // Find the appropriate previous sibling for insertion into the parent node
-    // by searching in render tree order for a child of the counter.
-    parent = 0;
+    // We cannot stop searching for counters with the same identifier before we also
+    // check this renderer, because it may affect the positioning in the tree of our counter.
+    RenderObject* searchEndRenderer = previousSiblingOrParent(counterOwner);
+    // We check renderers in preOrder from the renderer that our counter is attached to
+    // towards the begining of the document for counters with the same identifier as the one
+    // we are trying to find a place for. This is the next renderer to be checked.
+    RenderObject* currentRenderer = counterOwner->previousInPreOrder();
     previousSibling = 0;
-    RenderObject* resetCandidate = isReset ? object->parent() : previousSiblingOrParent(object);
-    RenderObject* prevCounterCandidate = object;
-    CounterNode* candidateCounter = 0;
-    // When a reset counter is chosen as candidateCounter, we'll
-    // decide the new node should be a child of the reset node or a
-    // sibling or the reset node. This flag controls it.
-    bool createChildForReset = true;
-    while ((prevCounterCandidate = prevCounterCandidate->previousInPreOrder())) {
-        CounterNode* c = counter(prevCounterCandidate, counterName, false);
-        if (prevCounterCandidate == resetCandidate) {
-            if (!candidateCounter) {
-                candidateCounter = c;
-                createChildForReset = true;
-            }
-            if (candidateCounter) {
-                if (createChildForReset && candidateCounter->isReset()) {
-                    parent = candidateCounter;
-                    previousSibling = 0;
-                } else {
-                    parent = candidateCounter->parent();
-                    previousSibling = candidateCounter;
+    while (currentRenderer) {
+        CounterNode* currentCounter = makeCounterNode(currentRenderer, identifier, false);
+        if (searchEndRenderer == currentRenderer) {
+            // We may be at the end of our search.
+            if (currentCounter) {
+                // We have a suitable counter on the EndSearchRenderer.
+                if (previousSibling) { // But we already found another counter that we come after.
+                    if (currentCounter->actsAsReset()) {
+                        // We found a reset counter that is on a renderer that is a sibling of ours or a parent.
+                        if (isReset && currentRenderer->parent() == counterOwner->parent()) {
+                            // We are also a reset counter and the previous reset was on a sibling renderer
+                            // hence we are the next sibling of that counter if that reset is not a root or
+                            // we are a root node if that reset is a root.
+                            parent = currentCounter->parent();
+                            previousSibling = parent ? currentCounter : 0;
+                            return parent;
+                        }
+                        // We are not a reset node or the previous reset must be on an ancestor of our renderer
+                        // hence we must be a child of that reset counter.
+                        parent = currentCounter;
+                        ASSERT(previousSibling->parent() == currentCounter);
+                        return true;
+                    }
+                    // CurrentCounter, the counter at the EndSearchRenderer, is not reset.
+                    if (!isReset || currentRenderer->parent() != counterOwner->parent()) {
+                        // If the node we are placing is not reset or we have found a counter that is attached
+                        // to an ancestor of the placed counter's renderer we know we are a sibling of that node.
+                        ASSERT(currentCounter->parent() == previousSibling->parent());
+                        parent = currentCounter->parent();
+                        return true;
+                    }
+                } else { 
+                    // We are at the potential end of the search, but we had no previous sibling candidate
+                    // In this case we follow pretty much the same logic as above but no ASSERTs about 
+                    // previousSibling, and when we are a sibling of the end counter we must set previousSibling
+                    // to currentCounter.
+                    if (currentCounter->actsAsReset()) {
+                        if (isReset && currentRenderer->parent() == counterOwner->parent()) {
+                            parent = currentCounter->parent();
+                            previousSibling = currentCounter;
+                            return parent;
+                        }
+                        parent = currentCounter;
+                        return true;
+                    }
+                    if (!isReset || currentRenderer->parent() != counterOwner->parent()) {
+                        parent = currentCounter->parent();
+                        previousSibling = currentCounter;
+                        return true;
+                    }
+                    previousSibling = currentCounter;
                 }
-                return true;
             }
-            resetCandidate = previousSiblingOrParent(resetCandidate);
-        } else if (c) {
-            if (c->isReset()) {
-                if (c->parent()) {
-                    // The new node may be the next sibling of this reset node.
-                    createChildForReset = false;
-                    candidateCounter = c;
-                } else {
-                    createChildForReset = true;
-                    candidateCounter = 0;
-                }
-            } else if (!candidateCounter) {
-                createChildForReset = true;
-                candidateCounter = c;
+            // We come here if the previous sibling or parent of our renderer had no 
+            // good counter, or we are a reset node and the counter on the previous sibling
+            // of our renderer was not a reset counter.
+            // Set a new goal for the end of the search.
+            searchEndRenderer = previousSiblingOrParent(currentRenderer);
+        } else {
+            // We are searching descendants of a previous sibling of the renderer that the
+            // counter being placed is attached to.
+            if (currentCounter) {
+                // We found a suitable counter.
+                if (previousSibling) {
+                    // Since we had a suitable previous counter before, we should only consider this one as our 
+                    // previousSibling if it is a reset counter and hence the current previousSibling is its child.
+                    if (currentCounter->actsAsReset()) {
+                        previousSibling = currentCounter;
+                        // We are no longer interested in previous siblings of the currentRenderer or their children
+                        // as counters they may have attached cannot be the previous sibling of the counter we are placing.
+                        currentRenderer = currentRenderer->parent();
+                        continue;
+                    }
+                } else
+                    previousSibling = currentCounter;
+                currentRenderer = previousSiblingOrParent(currentRenderer);
+                continue;
             }
         }
+        // This function is designed so that the same test is not done twice in an iteration, except for this one
+        // which may be done twice in some cases. Rearranging the decision points though, to accommodate this 
+        // performance improvement would create more code duplication than is worthwhile in my oppinion and may further
+        // impede the readability of this already complex algorithm.
+        if (previousSibling)
+            currentRenderer = previousSiblingOrParent(currentRenderer);
+        else
+            currentRenderer = currentRenderer->previousInPreOrder();
     }
-
     return false;
 }
 
-static CounterNode* counter(RenderObject* object, const AtomicString& counterName, bool alwaysCreateCounter)
+static CounterNode* makeCounterNode(RenderObject* object, const AtomicString& identifier, bool alwaysCreateCounter)
 {
     ASSERT(object);
 
     if (object->m_hasCounterNodeMap)
         if (CounterMap* nodeMap = counterMaps().get(object))
-            if (CounterNode* node = nodeMap->get(counterName.impl()))
+            if (CounterNode* node = nodeMap->get(identifier.impl()))
                 return node;
 
     bool isReset = false;
     int value = 0;
-    if (!planCounter(object, counterName, isReset, value) && !alwaysCreateCounter)
+    if (!planCounter(object, identifier, isReset, value) && !alwaysCreateCounter)
         return 0;
 
     CounterNode* newParent = 0;
     CounterNode* newPreviousSibling = 0;
-    CounterNode* newNode;
-    if (findPlaceForCounter(object, counterName, isReset, newParent, newPreviousSibling)) {
-        newNode = new CounterNode(object, isReset, value);
-        newParent->insertAfter(newNode, newPreviousSibling);
-    } else {
-        // Make a reset node for counters that aren't inside an existing reset node.
-        newNode = new CounterNode(object, true, value);
-    }
-
+    CounterNode* newNode = new CounterNode(object, isReset, value);
+    if (findPlaceForCounter(object, identifier, isReset, newParent, newPreviousSibling))
+        newParent->insertAfter(newNode, newPreviousSibling, identifier);
     CounterMap* nodeMap;
     if (object->m_hasCounterNodeMap)
         nodeMap = counterMaps().get(object);
@@ -218,8 +253,30 @@ static CounterNode* counter(RenderObject* object, const AtomicString& counterNam
         counterMaps().set(object, nodeMap);
         object->m_hasCounterNodeMap = true;
     }
-    nodeMap->set(counterName.impl(), newNode);
-
+    nodeMap->set(identifier.impl(), newNode);
+    if (newNode->parent() || !object->nextInPreOrder(object->parent()))
+        return newNode;
+    // Checking if some nodes that were previously counter tree root nodes
+    // should become children of this node now.
+    CounterMaps& maps = counterMaps();
+    RenderObject* stayWithin = object->parent();
+    for (RenderObject* currentRenderer = object->nextInPreOrder(stayWithin); currentRenderer; currentRenderer = currentRenderer->nextInPreOrder(stayWithin)) {
+        if (!currentRenderer->m_hasCounterNodeMap)
+            continue;
+        CounterNode* currentCounter = maps.get(currentRenderer)->get(identifier.impl());
+        if (!currentCounter)
+            continue;
+        if (currentCounter->parent()) {
+            ASSERT(newNode->firstChild());
+            if (currentRenderer->lastChild())
+                currentRenderer = currentRenderer->lastChild();
+            continue;
+        }
+        if (stayWithin != currentRenderer->parent() || !currentCounter->hasResetType())
+            newNode->insertAfter(currentCounter, newNode->lastChild(), identifier);
+        if (currentRenderer->lastChild())
+            currentRenderer = currentRenderer->lastChild();
+    }
     return newNode;
 }
 
@@ -246,15 +303,15 @@ PassRefPtr<StringImpl> RenderCounter::originalText() const
         return 0;
 
     if (!m_counterNode)
-        m_counterNode = counter(parent(), m_counter.identifier(), true);
+        m_counterNode = makeCounterNode(parent(), m_counter.identifier(), true);
 
     CounterNode* child = m_counterNode;
-    int value = child->isReset() ? child->value() : child->countInParent();
+    int value = child->actsAsReset() ? child->value() : child->countInParent();
 
     String text = listMarkerText(m_counter.listStyle(), value);
 
     if (!m_counter.separator().isNull()) {
-        if (!child->isReset())
+        if (!child->actsAsReset())
             child = child->parent();
         while (CounterNode* parent = child->parent()) {
             text = listMarkerText(m_counter.listStyle(), child->countInParent())
@@ -272,47 +329,156 @@ void RenderCounter::calcPrefWidths(int lead)
     RenderText::calcPrefWidths(lead);
 }
 
-void RenderCounter::invalidate()
+void RenderCounter::invalidate(const AtomicString& identifier)
 {
+    if (m_counter.identifier() != identifier)
+        return;
     m_counterNode = 0;
     setNeedsLayoutAndPrefWidthsRecalc();
 }
 
-static void destroyCounterNodeChildren(AtomicStringImpl* identifier, CounterNode* node)
+static void destroyCounterNodeWithoutMapRemoval(const AtomicString& identifier, CounterNode* node)
 {
     CounterNode* previous;
-    for (CounterNode* child = lastDescendant(node); child && child != node; child = previous) {
-        previous = previousInPreOrder(child);
-        child->parent()->removeChild(child);
-        ASSERT(counterMaps().get(child->renderer())->get(identifier) == child);
-        counterMaps().get(child->renderer())->remove(identifier);
+    for (CounterNode* child = node->lastDescendant(); child && child != node; child = previous) {
+        previous = child->previousInPreOrder();
+        child->parent()->removeChild(child, identifier);
+        ASSERT(counterMaps().get(child->renderer())->get(identifier.impl()) == child);
+        counterMaps().get(child->renderer())->remove(identifier.impl());
         if (!child->renderer()->documentBeingDestroyed()) {
             RenderObjectChildList* children = child->renderer()->virtualChildren();
             if (children)
-                children->invalidateCounters(child->renderer());
+                children->invalidateCounters(child->renderer(), identifier);
         }
         delete child;
     }
+    RenderObject* renderer = node->renderer();
+    if (!renderer->documentBeingDestroyed()) {
+        if (RenderObjectChildList* children = renderer->virtualChildren())
+            children->invalidateCounters(renderer, identifier);
+    }
+    if (CounterNode* parent = node->parent())
+        parent->removeChild(node, identifier);
+    delete node;
 }
 
-void RenderCounter::destroyCounterNodes(RenderObject* object)
+void RenderCounter::destroyCounterNodes(RenderObject* renderer)
 {
     CounterMaps& maps = counterMaps();
-    CounterMap* map = maps.get(object);
-    if (!map)
+    CounterMaps::iterator mapsIterator = maps.find(renderer);
+    if (mapsIterator == maps.end())
         return;
-    maps.remove(object);
-
+    CounterMap* map = mapsIterator->second;
     CounterMap::const_iterator end = map->end();
     for (CounterMap::const_iterator it = map->begin(); it != end; ++it) {
-        CounterNode* node = it->second;
-        destroyCounterNodeChildren(it->first.get(), node);
-        if (CounterNode* parent = node->parent())
-            parent->removeChild(node);
-        delete node;
+        AtomicString identifier(it->first.get());
+        destroyCounterNodeWithoutMapRemoval(identifier, it->second);
     }
-
+    maps.remove(mapsIterator);
     delete map;
+    renderer->m_hasCounterNodeMap = false;
+}
+
+void RenderCounter::destroyCounterNode(RenderObject* renderer, const AtomicString& identifier)
+{
+    CounterMap* map = counterMaps().get(renderer);
+    if (!map)
+        return;
+    CounterMap::iterator mapIterator = map->find(identifier.impl());
+    if (mapIterator == map->end())
+        return;
+    destroyCounterNodeWithoutMapRemoval(identifier, mapIterator->second);
+    map->remove(mapIterator);
+    // We do not delete "map" here even if empty because we expect to reuse
+    // it soon. In order for a renderer to lose all its counters permanently,
+    // a style change for the renderer involving removal of all counter
+    // directives must occur, in which case, RenderCounter::destroyCounterNodes()
+    // must be called.
+    // The destruction of the Renderer (possibly caused by the removal of its 
+    // associated DOM node) is the other case that leads to the permanent
+    // destruction of all counters attached to a Renderer. In this case
+    // RenderCounter::destroyCounterNodes() must be and is now called, too.
+    // RenderCounter::destroyCounterNodes() handles destruction of the counter
+    // map associated with a renderer, so there is no risk in leaking the map.
+}
+
+static void updateCounters(RenderObject* renderer)
+{
+    ASSERT(renderer->style());
+    const CounterDirectiveMap* directiveMap = renderer->style()->counterDirectives();
+    if (!directiveMap)
+        return;
+    CounterDirectiveMap::const_iterator end = directiveMap->end();
+    if (!renderer->m_hasCounterNodeMap) {
+        for (CounterDirectiveMap::const_iterator it = directiveMap->begin(); it != end; ++it)
+            makeCounterNode(renderer, AtomicString(it->first.get()), false);
+        return;
+    }
+    CounterMap* counterMap = counterMaps().get(renderer);
+    ASSERT(counterMap);
+    for (CounterDirectiveMap::const_iterator it = directiveMap->begin(); it != end; ++it) {
+        CounterNode* node = counterMap->get(it->first.get());
+        if (!node) {
+            makeCounterNode(renderer, AtomicString(it->first.get()), false);
+            continue;
+        }
+        CounterNode* newParent = 0;
+        CounterNode* newPreviousSibling;
+        findPlaceForCounter(renderer, AtomicString(it->first.get()), node->hasResetType(), newParent, newPreviousSibling);
+        CounterNode* parent = node->parent();
+        if (newParent == parent && newPreviousSibling == node->previousSibling())
+            continue;
+        if (parent)
+            parent->removeChild(node, it->first.get());
+        if (newParent)
+            newParent->insertAfter(node, newPreviousSibling, it->first.get());
+    }
+}
+
+void RenderCounter::rendererSubtreeAttached(RenderObject* renderer)
+{
+    for (RenderObject* descendant = renderer; descendant; descendant = descendant->nextInPreOrder(renderer))
+        updateCounters(descendant);
+}
+
+void RenderCounter::rendererStyleChanged(RenderObject* renderer, const RenderStyle* oldStyle, const RenderStyle* newStyle)
+{
+    const CounterDirectiveMap* newCounterDirectives;
+    const CounterDirectiveMap* oldCounterDirectives;
+    if (oldStyle && (oldCounterDirectives = oldStyle->counterDirectives())) {
+        if (newStyle && (newCounterDirectives = newStyle->counterDirectives())) {
+            CounterDirectiveMap::const_iterator newMapEnd = newCounterDirectives->end();
+            CounterDirectiveMap::const_iterator oldMapEnd = oldCounterDirectives->end();
+            for (CounterDirectiveMap::const_iterator it = newCounterDirectives->begin(); it != newMapEnd; ++it) {
+                CounterDirectiveMap::const_iterator oldMapIt = oldCounterDirectives->find(it->first);
+                if (oldMapIt != oldMapEnd) {
+                    if (oldMapIt->second == it->second)
+                        continue;
+                    RenderCounter::destroyCounterNode(renderer, it->first.get());
+                }
+                // We must create this node here, because the changed node may be a node with no display such as
+                // as those created by the increment or reset directives and the re-layout that will happen will
+                // not catch the change if the node had no children.
+                makeCounterNode(renderer, it->first.get(), false);
+            }
+            // Destroying old counters that do not exist in the new counterDirective map.
+            for (CounterDirectiveMap::const_iterator it = oldCounterDirectives->begin(); it !=oldMapEnd; ++it) {
+                if (!newCounterDirectives->contains(it->first))
+                    RenderCounter::destroyCounterNode(renderer, it->first.get());
+            }
+        } else {
+            if (renderer->m_hasCounterNodeMap)
+                RenderCounter::destroyCounterNodes(renderer);
+        }
+    } else if (newStyle && (newCounterDirectives = newStyle->counterDirectives())) {
+        CounterDirectiveMap::const_iterator newMapEnd = newCounterDirectives->end();
+        for (CounterDirectiveMap::const_iterator it = newCounterDirectives->begin(); it != newMapEnd; ++it) {
+            // We must create this node here, because the added node may be a node with no display such as
+            // as those created by the increment or reset directives and the re-layout that will happen will
+            // not catch the change if the node had no children.
+            makeCounterNode(renderer, it->first.get(), false);
+        }
+    }
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.h b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.h
index 961968e16c..10ba1dc574 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.h
@@ -33,9 +33,16 @@ class RenderCounter : public RenderText {
 public:
     RenderCounter(Document*, const CounterContent&);
 
-    void invalidate();
+    // Removes the reference to the CounterNode associated with this renderer
+    // if its identifier matches the argument.
+    // This is used to cause a counter display update when the CounterNode
+    // tree for identifier changes.
+    void invalidate(const AtomicString& identifier);
 
     static void destroyCounterNodes(RenderObject*);
+    static void destroyCounterNode(RenderObject*, const AtomicString& identifier);
+    static void rendererSubtreeAttached(RenderObject*);
+    static void rendererStyleChanged(RenderObject*, const RenderStyle* oldStyle, const RenderStyle* newStyle);
 
 private:
     virtual const char* renderName() const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderEmbeddedObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderEmbeddedObject.cpp
new file mode 100644
index 0000000000..d2e9999b78
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderEmbeddedObject.cpp
@@ -0,0 +1,427 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 2000 Simon Hausmann <hausmann@kde.org>
+ *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
+ * Copyright (C) 2004, 2005, 2006, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "RenderEmbeddedObject.h"
+
+#include "CSSValueKeywords.h"
+#include "Font.h"
+#include "FontSelector.h"
+#include "Frame.h"
+#include "FrameLoaderClient.h"
+#include "GraphicsContext.h"
+#include "HTMLEmbedElement.h"
+#include "HTMLIFrameElement.h"
+#include "HTMLNames.h"
+#include "HTMLObjectElement.h"
+#include "HTMLParamElement.h"
+#include "LocalizedStrings.h"
+#include "MIMETypeRegistry.h"
+#include "Page.h"
+#include "Path.h"
+#include "PluginWidget.h"
+#include "RenderTheme.h"
+#include "RenderView.h"
+#include "RenderWidgetProtector.h"
+#include "Text.h"
+
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+#include "HTMLVideoElement.h"
+#endif
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "PluginWidget.h"
+#endif
+
+namespace WebCore {
+
+using namespace HTMLNames;
+    
+static const float missingPluginRoundedRectHeight = 18;
+static const float missingPluginRoundedRectLeftRightTextMargin = 6;
+static const float missingPluginRoundedRectOpacity = 0.20f;
+static const float missingPluginRoundedRectRadius = 5;
+static const float missingPluginTextOpacity = 0.55f;
+
+RenderEmbeddedObject::RenderEmbeddedObject(Element* element)
+    : RenderPartObject(element)
+    , m_showsMissingPluginIndicator(false)
+{
+    view()->frameView()->setIsVisuallyNonEmpty();
+}
+
+RenderEmbeddedObject::~RenderEmbeddedObject()
+{
+    if (frameView())
+        frameView()->removeWidgetToUpdate(this);
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+bool RenderEmbeddedObject::requiresLayer() const
+{
+    if (RenderPartObject::requiresLayer())
+        return true;
+    
+    return allowsAcceleratedCompositing();
+}
+
+bool RenderEmbeddedObject::allowsAcceleratedCompositing() const
+{
+    return widget() && widget()->isPluginWidget() && static_cast<PluginWidget*>(widget())->platformLayer();
+}
+#endif
+
+static bool isURLAllowed(Document* doc, const String& url)
+{
+    if (doc->frame()->page()->frameCount() >= 200)
+        return false;
+
+    // We allow one level of self-reference because some sites depend on that.
+    // But we don't allow more than one.
+    KURL completeURL = doc->completeURL(url);
+    bool foundSelfReference = false;
+    for (Frame* frame = doc->frame(); frame; frame = frame->tree()->parent()) {
+        if (equalIgnoringFragmentIdentifier(frame->loader()->url(), completeURL)) {
+            if (foundSelfReference)
+                return false;
+            foundSelfReference = true;
+        }
+    }
+    return true;
+}
+
+typedef HashMap<String, String, CaseFoldingHash> ClassIdToTypeMap;
+
+static ClassIdToTypeMap* createClassIdToTypeMap()
+{
+    ClassIdToTypeMap* map = new ClassIdToTypeMap;
+    map->add("clsid:D27CDB6E-AE6D-11CF-96B8-444553540000", "application/x-shockwave-flash");
+    map->add("clsid:CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA", "audio/x-pn-realaudio-plugin");
+    map->add("clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B", "video/quicktime");
+    map->add("clsid:166B1BCA-3F9C-11CF-8075-444553540000", "application/x-director");
+    map->add("clsid:6BF52A52-394A-11D3-B153-00C04F79FAA6", "application/x-mplayer2");
+    map->add("clsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95", "application/x-mplayer2");
+    return map;
+}
+
+static String serviceTypeForClassId(const String& classId)
+{
+    // Return early if classId is empty (since we won't do anything below).
+    // Furthermore, if classId is null, calling get() below will crash.
+    if (classId.isEmpty())
+        return String();
+
+    static ClassIdToTypeMap* map = createClassIdToTypeMap();
+    return map->get(classId);
+}
+
+static void mapDataParamToSrc(Vector<String>* paramNames, Vector<String>* paramValues)
+{
+    // Some plugins don't understand the "data" attribute of the OBJECT tag (i.e. Real and WMP
+    // require "src" attribute).
+    int srcIndex = -1, dataIndex = -1;
+    for (unsigned int i = 0; i < paramNames->size(); ++i) {
+        if (equalIgnoringCase((*paramNames)[i], "src"))
+            srcIndex = i;
+        else if (equalIgnoringCase((*paramNames)[i], "data"))
+            dataIndex = i;
+    }
+
+    if (srcIndex == -1 && dataIndex != -1) {
+        paramNames->append("src");
+        paramValues->append((*paramValues)[dataIndex]);
+    }
+}
+
+void RenderEmbeddedObject::updateWidget(bool onlyCreateNonNetscapePlugins)
+{
+    if (m_showsMissingPluginIndicator)
+        return;
+
+    String url;
+    String serviceType;
+    Vector<String> paramNames;
+    Vector<String> paramValues;
+    Frame* frame = frameView()->frame();
+
+    // The calls to FrameLoader::requestObject within this function can result in a plug-in being initialized.
+    // This can run cause arbitrary JavaScript to run and may result in this RenderObject being detached from
+    // the render tree and destroyed, causing a crash like <rdar://problem/6954546>.  By extending our lifetime
+    // artifically to ensure that we remain alive for the duration of plug-in initialization.
+    RenderWidgetProtector protector(this);
+
+    if (node()->hasTagName(objectTag)) {
+        HTMLObjectElement* objectElement = static_cast<HTMLObjectElement*>(node());
+
+        objectElement->setNeedWidgetUpdate(false);
+        if (!objectElement->isFinishedParsingChildren())
+          return;
+
+        // Check for a child EMBED tag.
+        HTMLEmbedElement* embed = 0;
+        for (Node* child = objectElement->firstChild(); child; ) {
+            if (child->hasTagName(embedTag)) {
+                embed = static_cast<HTMLEmbedElement*>(child);
+                break;
+            }
+            
+            if (child->hasTagName(objectTag))
+                child = child->nextSibling(); // Don't descend into nested OBJECT tags
+            else
+                child = child->traverseNextNode(objectElement); // Otherwise descend (EMBEDs may be inside COMMENT tags)
+        }
+
+        // Use the attributes from the EMBED tag instead of the OBJECT tag including WIDTH and HEIGHT.
+        HTMLElement* embedOrObject;
+        if (embed) {
+            embedOrObject = embed;
+            url = embed->url();
+            serviceType = embed->serviceType();
+        } else
+            embedOrObject = objectElement;
+
+        // If there was no URL or type defined in EMBED, try the OBJECT tag.
+        if (url.isEmpty())
+            url = objectElement->url();
+        if (serviceType.isEmpty())
+            serviceType = objectElement->serviceType();
+
+        HashSet<StringImpl*, CaseFoldingHash> uniqueParamNames;
+
+        // Scan the PARAM children.
+        // Get the URL and type from the params if we don't already have them.
+        // Get the attributes from the params if there is no EMBED tag.
+        Node* child = objectElement->firstChild();
+        while (child && (url.isEmpty() || serviceType.isEmpty() || !embed)) {
+            if (child->hasTagName(paramTag)) {
+                HTMLParamElement* p = static_cast<HTMLParamElement*>(child);
+                String name = p->name();
+                if (url.isEmpty() && (equalIgnoringCase(name, "src") || equalIgnoringCase(name, "movie") || equalIgnoringCase(name, "code") || equalIgnoringCase(name, "url")))
+                    url = p->value();
+                if (serviceType.isEmpty() && equalIgnoringCase(name, "type")) {
+                    serviceType = p->value();
+                    int pos = serviceType.find(";");
+                    if (pos != -1)
+                        serviceType = serviceType.left(pos);
+                }
+                if (!embed && !name.isEmpty()) {
+                    uniqueParamNames.add(name.impl());
+                    paramNames.append(p->name());
+                    paramValues.append(p->value());
+                }
+            }
+            child = child->nextSibling();
+        }
+
+        // When OBJECT is used for an applet via Sun's Java plugin, the CODEBASE attribute in the tag
+        // points to the Java plugin itself (an ActiveX component) while the actual applet CODEBASE is
+        // in a PARAM tag. See <http://java.sun.com/products/plugin/1.2/docs/tags.html>. This means
+        // we have to explicitly suppress the tag's CODEBASE attribute if there is none in a PARAM,
+        // else our Java plugin will misinterpret it. [4004531]
+        String codebase;
+        if (!embed && MIMETypeRegistry::isJavaAppletMIMEType(serviceType)) {
+            codebase = "codebase";
+            uniqueParamNames.add(codebase.impl()); // pretend we found it in a PARAM already
+        }
+        
+        // Turn the attributes of either the EMBED tag or OBJECT tag into arrays, but don't override PARAM values.
+        NamedNodeMap* attributes = embedOrObject->attributes();
+        if (attributes) {
+            for (unsigned i = 0; i < attributes->length(); ++i) {
+                Attribute* it = attributes->attributeItem(i);
+                const AtomicString& name = it->name().localName();
+                if (embed || !uniqueParamNames.contains(name.impl())) {
+                    paramNames.append(name.string());
+                    paramValues.append(it->value().string());
+                }
+            }
+        }
+
+        mapDataParamToSrc(&paramNames, &paramValues);
+
+        // If we still don't have a type, try to map from a specific CLASSID to a type.
+        if (serviceType.isEmpty())
+            serviceType = serviceTypeForClassId(objectElement->classId());
+
+        if (!isURLAllowed(document(), url))
+            return;
+
+        // Find out if we support fallback content.
+        m_hasFallbackContent = false;
+        for (Node* child = objectElement->firstChild(); child && !m_hasFallbackContent; child = child->nextSibling()) {
+            if ((!child->isTextNode() && !child->hasTagName(embedTag) && !child->hasTagName(paramTag))  // Discount <embed> and <param>
+                || (child->isTextNode() && !static_cast<Text*>(child)->containsOnlyWhitespace()))
+                m_hasFallbackContent = true;
+        }
+
+        if (onlyCreateNonNetscapePlugins) {
+            KURL completedURL;
+            if (!url.isEmpty())
+                completedURL = frame->loader()->completeURL(url);
+
+            if (frame->loader()->client()->objectContentType(completedURL, serviceType) == ObjectContentNetscapePlugin)
+                return;
+        }
+
+        bool success = objectElement->dispatchBeforeLoadEvent(url) && frame->loader()->requestObject(this, url, objectElement->getAttribute(nameAttr), serviceType, paramNames, paramValues);
+        if (!success && m_hasFallbackContent)
+            objectElement->renderFallbackContent();
+
+    } else if (node()->hasTagName(embedTag)) {
+        HTMLEmbedElement* embedElement = static_cast<HTMLEmbedElement*>(node());
+        embedElement->setNeedWidgetUpdate(false);
+        url = embedElement->url();
+        serviceType = embedElement->serviceType();
+
+        if (url.isEmpty() && serviceType.isEmpty())
+            return;
+        if (!isURLAllowed(document(), url))
+            return;
+
+        // add all attributes set on the embed object
+        NamedNodeMap* attributes = embedElement->attributes();
+        if (attributes) {
+            for (unsigned i = 0; i < attributes->length(); ++i) {
+                Attribute* it = attributes->attributeItem(i);
+                paramNames.append(it->name().localName().string());
+                paramValues.append(it->value().string());
+            }
+        }
+
+        if (onlyCreateNonNetscapePlugins) {
+            KURL completedURL;
+            if (!url.isEmpty())
+                completedURL = frame->loader()->completeURL(url);
+
+            if (frame->loader()->client()->objectContentType(completedURL, serviceType) == ObjectContentNetscapePlugin)
+                return;
+        }
+
+        if (embedElement->dispatchBeforeLoadEvent(url))
+            frame->loader()->requestObject(this, url, embedElement->getAttribute(nameAttr), serviceType, paramNames, paramValues);
+    }
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)        
+    else if (node()->hasTagName(videoTag) || node()->hasTagName(audioTag)) {
+        HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(node());
+
+        mediaElement->setNeedWidgetUpdate(false);
+        if (node()->hasTagName(videoTag)) {
+            HTMLVideoElement* vid = static_cast<HTMLVideoElement*>(node());
+            String poster = vid->poster();
+            if (!poster.isEmpty()) {
+                paramNames.append("_media_element_poster_");
+                paramValues.append(poster);
+            }
+        }
+
+        url = mediaElement->initialURL();
+        if (!url.isEmpty()) {
+            paramNames.append("_media_element_src_");
+            paramValues.append(url);
+        }
+
+        serviceType = "application/x-media-element-proxy-plugin";
+        
+        if (mediaElement->dispatchBeforeLoadEvent(url))
+            frame->loader()->requestObject(this, url, nullAtom, serviceType, paramNames, paramValues);
+    }
+#endif
+}
+
+void RenderEmbeddedObject::paint(PaintInfo& paintInfo, int tx, int ty)
+{
+    if (m_showsMissingPluginIndicator) {
+        RenderReplaced::paint(paintInfo, tx, ty);
+        return;
+    }
+    
+    RenderPartObject::paint(paintInfo, tx, ty);
+}
+    
+void RenderEmbeddedObject::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
+{
+    if (!m_showsMissingPluginIndicator)
+        return;
+
+    if (paintInfo.phase == PaintPhaseSelection)
+        return;
+    
+    GraphicsContext* context = paintInfo.context;
+    if (context->paintingDisabled())
+        return;
+    
+    FloatRect pluginRect = contentBoxRect();
+    pluginRect.move(tx, ty);
+    
+    FontDescription fontDescription;
+    RenderTheme::defaultTheme()->systemFont(CSSValueWebkitSmallControl, fontDescription);
+    fontDescription.setWeight(FontWeightBold);
+    Font font(fontDescription, 0, 0);
+    font.update(0);
+    
+    String label = missingPluginText();
+    TextRun run(label.characters(), label.length());
+    run.disableRoundingHacks();
+    float textWidth = font.floatWidth(run);
+    
+    FloatRect missingPluginRect;
+    missingPluginRect.setSize(FloatSize(textWidth + missingPluginRoundedRectLeftRightTextMargin * 2, missingPluginRoundedRectHeight));
+    missingPluginRect.setLocation(FloatPoint((pluginRect.size().width() / 2 - missingPluginRect.size().width() / 2) + pluginRect.location().x(),
+                                             (pluginRect.size().height() / 2 - missingPluginRect.size().height() / 2) + pluginRect.location().y()));
+   
+    Path path = Path::createRoundedRectangle(missingPluginRect, FloatSize(missingPluginRoundedRectRadius, missingPluginRoundedRectRadius));
+    context->save();
+    context->clip(pluginRect);
+    context->beginPath();
+    context->addPath(path);  
+    context->setAlpha(missingPluginRoundedRectOpacity);
+    context->setFillColor(Color::white, style()->colorSpace());
+    context->fillPath();
+
+    FloatPoint labelPoint(roundf(missingPluginRect.location().x() + (missingPluginRect.size().width() - textWidth) / 2),
+                          roundf(missingPluginRect.location().y()+ (missingPluginRect.size().height() - font.height()) / 2 + font.ascent()));
+    context->setAlpha(missingPluginTextOpacity);
+    context->setFillColor(Color::black, style()->colorSpace());
+    context->drawBidiText(font, run, labelPoint);
+    context->restore();
+}
+
+void RenderEmbeddedObject::layout()
+{
+    ASSERT(needsLayout());
+
+    calcWidth();
+    calcHeight();
+
+    RenderPart::layout();
+
+    m_overflow.clear();
+    addShadowOverflow();
+
+    if (!widget() && frameView())
+        frameView()->addWidgetToUpdate(this);
+
+    setNeedsLayout(false);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderEmbeddedObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderEmbeddedObject.h
new file mode 100644
index 0000000000..657701fd23
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderEmbeddedObject.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 2000 Simon Hausmann <hausmann@kde.org>
+ * Copyright (C) 2004, 2005, 2006, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef RenderEmbeddedObject_h
+#define RenderEmbeddedObject_h
+
+#include "RenderPartObject.h"
+
+namespace WebCore {
+
+// Renderer for embeds and objects.
+class RenderEmbeddedObject : public RenderPartObject {
+public:
+    RenderEmbeddedObject(Element*);
+    virtual ~RenderEmbeddedObject();
+
+    void updateWidget(bool onlyCreateNonNetscapePlugins);
+    void setShowsMissingPluginIndicator(bool showsMissingPluginIndicator) { m_showsMissingPluginIndicator = showsMissingPluginIndicator; }
+    bool showsMissingPluginIndicator() const { return m_showsMissingPluginIndicator; }
+#if USE(ACCELERATED_COMPOSITING)
+    virtual bool allowsAcceleratedCompositing() const;
+#endif
+
+private:
+    virtual const char* renderName() const { return "RenderEmbeddedObject"; }
+    virtual bool isEmbeddedObject() const { return true; }
+
+    virtual void paintReplaced(PaintInfo&, int, int);
+    virtual void paint(PaintInfo& paintInfo, int, int);
+
+#if USE(ACCELERATED_COMPOSITING)
+    virtual bool requiresLayer() const;
+#endif
+
+    virtual void layout();
+    bool m_showsMissingPluginIndicator;
+};
+
+inline RenderEmbeddedObject* toRenderEmbeddedObject(RenderObject* object)
+{
+    ASSERT(!object || !strcmp(object->renderName(), "RenderEmbeddedObject"));
+    return static_cast<RenderEmbeddedObject*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderEmbeddedObject(const RenderEmbeddedObject*);
+
+} // namespace WebCore
+
+#endif // RenderEmbeddedObject_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp
index 8618d11c04..889b0bc025 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
@@ -121,6 +119,9 @@ RenderBox* RenderFieldset::findLegend() const
 
 void RenderFieldset::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 {
+    if (!shouldPaintWithinRoot(paintInfo))
+        return;
+
     int w = width();
     int h = height();
     RenderBox* legend = findLegend();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.cpp
index 72623f73e4..14d126d247 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "RenderFileUploadControl.h"
 
+#include "Chrome.h"
 #include "FileList.h"
 #include "Frame.h"
 #include "FrameView.h"
@@ -63,8 +64,13 @@ private:
 RenderFileUploadControl::RenderFileUploadControl(HTMLInputElement* input)
     : RenderBlock(input)
     , m_button(0)
-    , m_fileChooser(FileChooser::create(this, input->value()))
 {
+    FileList* list = input->files();
+    Vector<String> filenames;
+    unsigned length = list ? list->length() : 0;
+    for (unsigned i = 0; i < length; ++i)
+        filenames.append(list->item(i)->path());
+    m_fileChooser = FileChooser::create(this, filenames);
 }
 
 RenderFileUploadControl::~RenderFileUploadControl()
@@ -103,15 +109,32 @@ bool RenderFileUploadControl::allowsMultipleFiles()
     return !input->getAttribute(multipleAttr).isNull();
 }
 
+String RenderFileUploadControl::acceptTypes()
+{
+    return static_cast<HTMLInputElement*>(node())->accept();
+}
+
+void RenderFileUploadControl::chooseIconForFiles(const Vector<String>& filenames)
+{
+    if (Chrome* chromePointer = chrome())
+        chromePointer->chooseIconForFiles(filenames, m_fileChooser);
+}
+
 void RenderFileUploadControl::click()
 {
+    if (Chrome* chromePointer = chrome())
+        chromePointer->runOpenPanel(node()->document()->frame(), m_fileChooser);
+}
+
+Chrome* RenderFileUploadControl::chrome() const
+{
     Frame* frame = node()->document()->frame();
     if (!frame)
-        return;
+        return 0;
     Page* page = frame->page();
     if (!page)
-        return;
-    page->chrome()->runOpenPanel(frame, m_fileChooser);
+        return 0;
+    return page->chrome();
 }
 
 void RenderFileUploadControl::updateFromElement()
@@ -184,7 +207,7 @@ void RenderFileUploadControl::paintObject(PaintInfo& paintInfo, int tx, int ty)
     }
 
     if (paintInfo.phase == PaintPhaseForeground) {
-        const String& displayedFilename = m_fileChooser->basenameForWidth(style()->font(), maxFilenameWidth());        
+        const String& displayedFilename = fileTextValue();
         unsigned length = displayedFilename.length();
         const UChar* string = displayedFilename.characters();
         TextRun textRun(string, length, false, 0, 0, style()->direction() == RTL, style()->unicodeBidi() == Override);
@@ -204,7 +227,7 @@ void RenderFileUploadControl::paintObject(PaintInfo& paintInfo, int tx, int ty)
             + buttonRenderer->marginTop() + buttonRenderer->borderTop() + buttonRenderer->paddingTop()
             + buttonRenderer->baselinePosition(true, false);
 
-        paintInfo.context->setFillColor(style()->color());
+        paintInfo.context->setFillColor(style()->color(), style()->colorSpace());
         
         // Draw the filename
         paintInfo.context->drawBidiText(style()->font(), textRun, IntPoint(textX, textY));
@@ -284,7 +307,7 @@ String RenderFileUploadControl::buttonValue()
     return m_button->value();
 }
 
-String RenderFileUploadControl::fileTextValue()
+String RenderFileUploadControl::fileTextValue() const
 {
     return m_fileChooser->basenameForWidth(style()->font(), maxFilenameWidth());
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h b/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h
index bd7d62a490..99dd35c365 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h
@@ -26,6 +26,7 @@
 
 namespace WebCore {
 
+class Chrome;
 class HTMLInputElement;
     
 // Each RenderFileUploadControl contains a RenderButton (for opening the file chooser), and
@@ -37,17 +38,15 @@ public:
     RenderFileUploadControl(HTMLInputElement*);
     virtual ~RenderFileUploadControl();
 
+    virtual bool isFileUploadControl() const { return true; }
+
     void click();
 
-    void valueChanged();
-    
     void receiveDroppedFiles(const Vector<String>&);
 
     String buttonValue();
-    String fileTextValue();
+    String fileTextValue() const;
     
-    bool allowsMultipleFiles();
-
 private:
     virtual const char* renderName() const { return "RenderFileUploadControl"; }
 
@@ -57,6 +56,14 @@ private:
 
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
+    // FileChooserClient methods.
+    void valueChanged();
+    void repaint() { RenderBlock::repaint(); }
+    bool allowsMultipleFiles();
+    String acceptTypes();
+    void chooseIconForFiles(const Vector<String>&);
+
+    Chrome* chrome() const;
     int maxFilenameWidth() const;
     PassRefPtr<RenderStyle> createButtonStyle(const RenderStyle* parentStyle) const;
 
@@ -66,10 +73,16 @@ private:
 
 inline RenderFileUploadControl* toRenderFileUploadControl(RenderObject* object)
 {
-    ASSERT(!object || !strcmp(object->renderName(), "RenderFileUploadControl"));
+    ASSERT(!object || object->isFileUploadControl());
     return static_cast<RenderFileUploadControl*>(object);
 }
 
+inline const RenderFileUploadControl* toRenderFileUploadControl(const RenderObject* object)
+{
+    ASSERT(!object || object->isFileUploadControl());
+    return static_cast<const RenderFileUploadControl*>(object);
+}
+
 // This will catch anyone doing an unnecessary cast.
 void toRenderFileUploadControl(const RenderFileUploadControl*);
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.cpp
index 63c72fd0d0..7991b61ce8 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.cpp
@@ -410,8 +410,13 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
                         child->layer()->setStaticX(xPos);
                     else child->layer()->setStaticX(width() - xPos);
                 }
-                if (child->style()->hasStaticY())
-                    child->layer()->setStaticY(yPos);
+                if (child->style()->hasStaticY()) {
+                    RenderLayer* childLayer = child->layer();
+                    if (childLayer->staticY() != yPos) {
+                        child->layer()->setStaticY(yPos);
+                        child->setChildNeedsLayout(true, false);
+                    }
+                }
                 child = iterator.next();
                 continue;
             }
@@ -640,7 +645,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
 
     // We confine the line clamp ugliness to vertical flexible boxes (thus keeping it out of
     // mainstream block layout); this is not really part of the XUL box model.
-    bool haveLineClamp = style()->lineClamp() >= 0 && style()->lineClamp() <= 100;
+    bool haveLineClamp = !style()->lineClamp().isNone();
     if (haveLineClamp) {
         int maxLineCount = 0;
         child = iterator.first();
@@ -665,7 +670,8 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
         
         // Get the # of lines and then alter all block flow children with auto height to use the
         // specified height. We always try to leave room for at least one line.
-        int numVisibleLines = max(1, static_cast<int>((maxLineCount + 1) * style()->lineClamp() / 100.0));
+        LineClampValue lineClamp = style()->lineClamp();
+        int numVisibleLines = lineClamp.isPercentage() ? max(1, (maxLineCount + 1) * lineClamp.value() / 100) : lineClamp.value();
         if (numVisibleLines < maxLineCount) {
             for (child = iterator.first(); child; child = iterator.next()) {
                 if (child->isPositioned() || !child->style()->height().isAuto() || !child->isBlockFlow())
@@ -696,28 +702,25 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                 if (!lastLine)
                     continue;
                 
-                // See if the last item is an anchor
-                InlineBox* anchorBox = lastLine->lastChild();
-                if (!anchorBox)
-                    continue;
-                if (!anchorBox->renderer()->node())
-                    continue;
-                if (!anchorBox->renderer()->node()->isLink())
-                    continue;
-                
                 RootInlineBox* lastVisibleLine = blockChild->lineAtIndex(numVisibleLines-1);
                 if (!lastVisibleLine)
                     continue;
 
                 const UChar ellipsisAndSpace[2] = { horizontalEllipsis, ' ' };
                 DEFINE_STATIC_LOCAL(AtomicString, ellipsisAndSpaceStr, (ellipsisAndSpace, 2));
-
+                DEFINE_STATIC_LOCAL(AtomicString, ellipsisStr, (&horizontalEllipsis, 1));
                 const Font& font = style(numVisibleLines == 1)->font();
-                int ellipsisAndSpaceWidth = font.width(TextRun(ellipsisAndSpace, 2));
 
-                // Get ellipsis width + " " + anchor width
-                int totalWidth = ellipsisAndSpaceWidth + anchorBox->width();
-                
+                // Get ellipsis width, and if the last child is an anchor, it will go after the ellipsis, so add in a space and the anchor width too 
+                int totalWidth;
+                InlineBox* anchorBox = lastLine->lastChild();
+                if (anchorBox && anchorBox->renderer()->node() && anchorBox->renderer()->node()->isLink())
+                    totalWidth = anchorBox->width() + font.width(TextRun(ellipsisAndSpace, 2));
+                else {
+                    anchorBox = 0;
+                    totalWidth = font.width(TextRun(&horizontalEllipsis, 1));
+                }
+                                
                 // See if this width can be accommodated on the last visible line
                 RenderBlock* destBlock = toRenderBlock(lastVisibleLine->renderer());
                 RenderBlock* srcBlock = toRenderBlock(lastLine->renderer());
@@ -739,7 +742,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                     continue;
 
                 // Let the truncation code kick in.
-                lastVisibleLine->placeEllipsis(ellipsisAndSpaceStr, ltr, blockLeftEdge, blockRightEdge, totalWidth, anchorBox);
+                lastVisibleLine->placeEllipsis(anchorBox ? ellipsisAndSpaceStr : ellipsisStr, ltr, blockLeftEdge, blockRightEdge, totalWidth, anchorBox);
                 destBlock->setHasMarkupTruncation(true);
             }
         }
@@ -769,8 +772,13 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                     else
                         child->layer()->setStaticX(borderRight()+paddingRight());
                 }
-                if (child->style()->hasStaticY())
-                    child->layer()->setStaticY(height());
+                if (child->style()->hasStaticY()) {
+                    RenderLayer* childLayer = child->layer();
+                    if (childLayer->staticY() != height()) {
+                        child->layer()->setStaticY(height());
+                        child->setChildNeedsLayout(true, false);
+                    }
+                }
                 child = iterator.next();
                 continue;
             } 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.cpp
index b15d55c347..aa28ff08e6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.
  * Copyright (C) 2009 Google, Inc.
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved. 
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,9 +28,9 @@
 #include "GraphicsContext.h"
 #include "RenderView.h"
 #include "SVGForeignObjectElement.h"
-#include "SVGLength.h"
 #include "SVGRenderSupport.h"
-#include "SVGTransformList.h"
+#include "SVGSVGElement.h"
+#include "TransformState.h"
 
 namespace WebCore {
 
@@ -38,22 +39,18 @@ RenderForeignObject::RenderForeignObject(SVGForeignObjectElement* node)
 {
 }
 
-TransformationMatrix RenderForeignObject::translationForAttributes() const
-{
-    SVGForeignObjectElement* foreign = static_cast<SVGForeignObjectElement*>(node());
-    return TransformationMatrix().translate(foreign->x().value(foreign), foreign->y().value(foreign));
-}
-
 void RenderForeignObject::paint(PaintInfo& paintInfo, int, int)
 {
     if (paintInfo.context->paintingDisabled())
         return;
 
-    // Copy the paint info so that modifications to the damage rect do not affect callers
-    PaintInfo childPaintInfo = paintInfo;
+    PaintInfo childPaintInfo(paintInfo);
     childPaintInfo.context->save();
-    applyTransformToPaintInfo(childPaintInfo, localToParentTransform());
-    childPaintInfo.context->clip(clipRect(0, 0));
+
+    applyTransformToPaintInfo(childPaintInfo, localTransform());
+
+    if (SVGRenderBase::isOverflowHidden(this))
+        childPaintInfo.context->clip(m_viewport);
 
     float opacity = style()->opacity();
     if (opacity < 1.0f)
@@ -67,29 +64,33 @@ void RenderForeignObject::paint(PaintInfo& paintInfo, int, int)
     childPaintInfo.context->restore();
 }
 
-FloatRect RenderForeignObject::objectBoundingBox() const
+IntRect RenderForeignObject::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
-    return borderBoxRect();
+    return SVGRenderBase::clippedOverflowRectForRepaint(this, repaintContainer);
 }
 
-FloatRect RenderForeignObject::repaintRectInLocalCoordinates() const
+void RenderForeignObject::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
 {
-    // HACK: to maintain historical LayoutTest results for now.
-    // RenderForeignObject is a RenderBlock (not a RenderSVGModelObject) so this
-    // should not affect repaint correctness.  But it should really be:
-    // return borderBoxRect();
-    return FloatRect();
+    SVGRenderBase::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
 }
 
-void RenderForeignObject::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& rect, bool fixed)
+const AffineTransform& RenderForeignObject::localToParentTransform() const
 {
-    rect = localToParentTransform().mapRect(rect);
-    RenderBlock::computeRectForRepaint(repaintContainer, rect, fixed);
+    m_localToParentTransform = localTransform();
+    m_localToParentTransform.translate(m_viewport.x(), m_viewport.y());
+    return m_localToParentTransform;
 }
 
-TransformationMatrix RenderForeignObject::localToParentTransform() const
+void RenderForeignObject::calcWidth()
 {
-    return localTransform() * translationForAttributes();
+    // FIXME: Investigate in size rounding issues
+    setWidth(static_cast<int>(roundf(m_viewport.width())));
+}
+
+void RenderForeignObject::calcHeight()
+{
+    // FIXME: Investigate in size rounding issues
+    setHeight(static_cast<int>(roundf(m_viewport.height())));
 }
 
 void RenderForeignObject::layout()
@@ -98,18 +99,36 @@ void RenderForeignObject::layout()
     ASSERT(!view()->layoutStateEnabled()); // RenderSVGRoot disables layoutState for the SVG rendering tree.
 
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
-    m_localTransform = static_cast<SVGForeignObjectElement*>(node())->animatedLocalTransform();
 
+    SVGForeignObjectElement* foreign = static_cast<SVGForeignObjectElement*>(node());
+    m_localTransform = foreign->animatedLocalTransform();
+
+    // Cache viewport boundaries
+    FloatPoint viewportLocation(foreign->x().value(foreign), foreign->y().value(foreign));
+    m_viewport = FloatRect(viewportLocation, FloatSize(foreign->width().value(foreign), foreign->height().value(foreign)));
+
+    // Set box origin to the foreignObject x/y translation, so positioned objects in XHTML content get correct
+    // positions. A regular RenderBoxModelObject would pull this information from RenderStyle - in SVG those
+    // properties are ignored for non <svg> elements, so we mimic what happens when specifying them through CSS.
+
+    // FIXME: Investigate in location rounding issues - only affects RenderForeignObject & RenderSVGText
+    setLocation(roundedIntPoint(viewportLocation));
     RenderBlock::layout();
-    repainter.repaintAfterLayout();
 
+    repainter.repaintAfterLayout();
     setNeedsLayout(false);
 }
 
 bool RenderForeignObject::nodeAtFloatPoint(const HitTestRequest& request, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
 {
-    FloatPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
-    return RenderBlock::nodeAtPoint(request, result, static_cast<int>(localPoint.x()), static_cast<int>(localPoint.y()), 0, 0, hitTestAction);
+    FloatPoint localPoint = localTransform().inverse().mapPoint(pointInParent);
+
+    // Early exit if local point is not contained in clipped viewport area
+    if (SVGRenderBase::isOverflowHidden(this) && !m_viewport.contains(localPoint))
+        return false;
+
+    IntPoint roundedLocalPoint = roundedIntPoint(localPoint);
+    return RenderBlock::nodeAtPoint(request, result, roundedLocalPoint.x(), roundedLocalPoint.y(), 0, 0, hitTestAction);
 }
 
 bool RenderForeignObject::nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int, HitTestAction)
@@ -118,6 +137,14 @@ bool RenderForeignObject::nodeAtPoint(const HitTestRequest&, HitTestResult&, int
     return false;
 }
 
-} // namespace WebCore
+void RenderForeignObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState& transformState) const
+{
+    // When crawling up the hierachy starting from foreignObject child content, useTransforms may not be set to true.
+    if (!useTransforms)
+        useTransforms = true;
+    SVGRenderBase::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
+}
+
+}
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FOREIGN_OBJECT)
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.h
index e014f22a5d..bb6b555636 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.h
@@ -21,9 +21,10 @@
 
 #ifndef RenderForeignObject_h
 #define RenderForeignObject_h
-#if ENABLE(SVG) && ENABLE(SVG_FOREIGN_OBJECT)
 
-#include "TransformationMatrix.h"
+#if ENABLE(SVG) && ENABLE(SVG_FOREIGN_OBJECT)
+#include "AffineTransform.h"
+#include "FloatPoint.h"
 #include "RenderSVGBlock.h"
 
 namespace WebCore {
@@ -38,28 +39,35 @@ public:
 
     virtual void paint(PaintInfo&, int parentX, int parentY);
 
-    virtual TransformationMatrix localToParentTransform() const;
-
+    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
+
     virtual bool requiresLayer() const { return false; }
     virtual void layout();
 
-    virtual FloatRect objectBoundingBox() const;
-    virtual FloatRect repaintRectInLocalCoordinates() const;
+    virtual FloatRect objectBoundingBox() const { return m_viewport; }
+    virtual FloatRect strokeBoundingBox() const { return m_viewport; }
+    virtual FloatRect repaintRectInLocalCoordinates() const { return m_viewport; }
 
     virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
     virtual bool isSVGForeignObject() const { return true; }
 
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState) const;
+
  private:
-    TransformationMatrix translationForAttributes() const;
+    virtual void calcWidth();
+    virtual void calcHeight();
 
-    virtual TransformationMatrix localTransform() const { return m_localTransform; }
+    virtual const AffineTransform& localToParentTransform() const;
+    virtual AffineTransform localTransform() const { return m_localTransform; }
 
-    TransformationMatrix m_localTransform;
+    FloatRect m_viewport;
+    AffineTransform m_localTransform;
+    mutable AffineTransform m_localToParentTransform;
 };
 
-} // namespace WebCore
+}
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FOREIGN_OBJECT)
-#endif // RenderForeignObject_h
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFrame.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFrame.cpp
index a7b131b2b6..5f87417cc6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFrame.cpp
@@ -26,6 +26,7 @@
 
 #include "FrameView.h"
 #include "HTMLFrameElement.h"
+#include "RenderView.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.cpp
index 2fe1ddbf1f..7855b2d8f7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the KDE project.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
@@ -38,6 +36,7 @@
 #include "MouseEvent.h"
 #include "RenderFrame.h"
 #include "RenderView.h"
+#include "Settings.h"
 
 namespace WebCore {
 
@@ -87,13 +86,14 @@ void RenderFrameSet::paintColumnBorder(const PaintInfo& paintInfo, const IntRect
     
     // Fill first.
     GraphicsContext* context = paintInfo.context;
-    context->fillRect(borderRect, frameSet()->hasBorderColor() ? style()->borderLeftColor() : borderFillColor());
+    ColorSpace colorSpace = style()->colorSpace();
+    context->fillRect(borderRect, frameSet()->hasBorderColor() ? style()->borderLeftColor() : borderFillColor(), colorSpace);
     
     // Now stroke the edges but only if we have enough room to paint both edges with a little
     // bit of the fill color showing through.
     if (borderRect.width() >= 3) {
-        context->fillRect(IntRect(borderRect.topLeft(), IntSize(1, height())), borderStartEdgeColor());
-        context->fillRect(IntRect(borderRect.topRight(), IntSize(1, height())), borderEndEdgeColor());
+        context->fillRect(IntRect(borderRect.topLeft(), IntSize(1, height())), borderStartEdgeColor(), colorSpace);
+        context->fillRect(IntRect(borderRect.topRight(), IntSize(1, height())), borderEndEdgeColor(), colorSpace);
     }
 }
 
@@ -106,13 +106,14 @@ void RenderFrameSet::paintRowBorder(const PaintInfo& paintInfo, const IntRect& b
     
     // Fill first.
     GraphicsContext* context = paintInfo.context;
-    context->fillRect(borderRect, frameSet()->hasBorderColor() ? style()->borderLeftColor() : borderFillColor());
+    ColorSpace colorSpace = style()->colorSpace();
+    context->fillRect(borderRect, frameSet()->hasBorderColor() ? style()->borderLeftColor() : borderFillColor(), colorSpace);
 
     // Now stroke the edges but only if we have enough room to paint both edges with a little
     // bit of the fill color showing through.
     if (borderRect.height() >= 3) {
-        context->fillRect(IntRect(borderRect.topLeft(), IntSize(width(), 1)), borderStartEdgeColor());
-        context->fillRect(IntRect(borderRect.bottomLeft(), IntSize(width(), 1)), borderEndEdgeColor());
+        context->fillRect(IntRect(borderRect.topLeft(), IntSize(width(), 1)), borderStartEdgeColor(), colorSpace);
+        context->fillRect(IntRect(borderRect.bottomLeft(), IntSize(width(), 1)), borderEndEdgeColor(), colorSpace);
     }
 }
 
@@ -473,7 +474,10 @@ void RenderFrameSet::layout()
     layOutAxis(m_rows, frameSet()->rowLengths(), height() - (rows - 1) * borderThickness);
     layOutAxis(m_cols, frameSet()->colLengths(), width() - (cols - 1) * borderThickness);
 
-    positionFrames();
+    if (flattenFrameSet())
+        positionFramesWithFlattening();
+    else
+        positionFrames();
 
     RenderBox::layout();
 
@@ -532,6 +536,119 @@ void RenderFrameSet::positionFrames()
     }
 }
 
+void RenderFrameSet::positionFramesWithFlattening()
+{
+    RenderBox* child = firstChildBox();
+    if (!child)
+        return;
+
+    int rows = frameSet()->totalRows();
+    int cols = frameSet()->totalCols();
+
+    int borderThickness = frameSet()->border();
+    bool repaintNeeded = false;
+
+    // calculate frameset height based on actual content height to eliminate scrolling
+    bool out = false;
+    for (int r = 0; r < rows && !out; r++) {
+        int extra = 0;
+        int height = m_rows.m_sizes[r];
+
+        for (int c = 0; c < cols; c++) {
+            IntRect oldFrameRect = child->frameRect();
+
+            int width = m_cols.m_sizes[c];
+
+            bool fixedWidth = frameSet()->colLengths() && frameSet()->colLengths()[c].isFixed();
+            bool fixedHeight = frameSet()->rowLengths() && frameSet()->rowLengths()[r].isFixed();
+
+            // has to be resized and itself resize its contents
+            if (!fixedWidth)
+                child->setWidth(width ? width + extra / (cols - c) : 0);
+            else
+                child->setWidth(width);
+            child->setHeight(height);
+
+            child->setNeedsLayout(true);
+
+            if (child->isFrameSet())
+                toRenderFrameSet(child)->layout();
+            else
+                toRenderFrame(child)->layoutWithFlattening(fixedWidth, fixedHeight);
+
+            if (child->height() > m_rows.m_sizes[r])
+                m_rows.m_sizes[r] = child->height();
+            if (child->width() > m_cols.m_sizes[c])
+                m_cols.m_sizes[c] = child->width();
+
+            if (child->frameRect() != oldFrameRect)
+                repaintNeeded = true;
+
+            // difference between calculated frame width and the width it actually decides to have
+            extra += width - m_cols.m_sizes[c];
+
+            child = child->nextSiblingBox();
+            if (!child) {
+                out = true;
+                break;
+            }
+        }
+    }
+
+    int xPos = 0;
+    int yPos = 0;
+    out = false;
+    child = firstChildBox();
+    for (int r = 0; r < rows && !out; r++) {
+        xPos = 0;
+        for (int c = 0; c < cols; c++) {
+            // ensure the rows and columns are filled
+            IntRect oldRect = child->frameRect();
+
+            child->setLocation(xPos, yPos);
+            child->setHeight(m_rows.m_sizes[r]);
+            child->setWidth(m_cols.m_sizes[c]);
+
+            if (child->frameRect() != oldRect) {
+                repaintNeeded = true;
+
+                // update to final size
+                child->setNeedsLayout(true);
+                if (child->isFrameSet())
+                    toRenderFrameSet(child)->layout();
+                else
+                    toRenderFrame(child)->layoutWithFlattening(true, true);
+            }
+
+            xPos += m_cols.m_sizes[c] + borderThickness;
+            child = child->nextSiblingBox();
+            if (!child) {
+                out = true;
+                break;
+            }
+        }
+        yPos += m_rows.m_sizes[r] + borderThickness;
+    }
+
+    setWidth(xPos - borderThickness);
+    setHeight(yPos - borderThickness);
+
+    if (repaintNeeded)
+        repaint();
+
+    // all the remaining frames are hidden to avoid ugly spurious unflowed frames
+    for (; child; child = child->nextSiblingBox()) {
+        child->setWidth(0);
+        child->setHeight(0);
+        child->setNeedsLayout(false);
+    }
+}
+
+bool RenderFrameSet::flattenFrameSet() const
+{
+    return document()->frame() && document()->frame()->settings()->frameFlatteningEnabled();
+}
+
 void RenderFrameSet::startResizing(GridAxis& axis, int position)
 {
     int split = hitTestSplit(axis, position);
@@ -560,6 +677,9 @@ void RenderFrameSet::continueResizing(GridAxis& axis, int position)
 
 bool RenderFrameSet::userResize(MouseEvent* evt)
 {
+    if (flattenFrameSet())
+        return false;
+
     if (!m_isResizing) {
         if (needsLayout())
             return false;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.h b/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.h
index 26bf73281d..d0ab346be9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.h
@@ -95,15 +95,18 @@ private:
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
-    
+
     inline HTMLFrameSetElement* frameSet() const;
 
+    bool flattenFrameSet() const;
+
     void setIsResizing(bool);
 
     void layOutAxis(GridAxis&, const Length*, int availableSpace);
     void computeEdgeInfo();
     void fillFromEdgeInfo(const FrameEdgeInfo& edgeInfo, int r, int c);
     void positionFrames();
+    void positionFramesWithFlattening();
 
     int splitPosition(const GridAxis&, int split) const;
     int hitTestSplit(const GridAxis&, int position) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
index 4206b1cf1c..a14ab2753c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
@@ -4,7 +4,7 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
- * Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,14 +26,19 @@
 #include "config.h"
 #include "RenderImage.h"
 
+#include "Frame.h"
 #include "GraphicsContext.h"
+#include "HTMLAreaElement.h"
+#include "HTMLCollection.h"
 #include "HTMLImageElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLMapElement.h"
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "Page.h"
+#include "RenderTheme.h"
 #include "RenderView.h"
+#include "SelectionController.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/UnusedParam.h>
 
@@ -49,7 +54,7 @@ namespace WebCore {
 static const double cInterpolationCutoff = 800. * 800.;
 static const double cLowQualityTimeThreshold = 0.050; // 50 ms
 
-class RenderImageScaleData {
+class RenderImageScaleData : public Noncopyable {
 public:
     RenderImageScaleData(RenderImage* image, const IntSize& size, double time, bool lowQualityScale)
         : m_size(size)
@@ -364,8 +369,8 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
         if (cWidth > 2 && cHeight > 2) {
             // Draw an outline rect where the image should be.
             context->setStrokeStyle(SolidStroke);
-            context->setStrokeColor(Color::lightGray);
-            context->setFillColor(Color::transparent);
+            context->setStrokeColor(Color::lightGray, style()->colorSpace());
+            context->setFillColor(Color::transparent, style()->colorSpace());
             context->drawRect(IntRect(tx + leftBorder + leftPad, ty + topBorder + topPad, cWidth, cHeight));
 
             bool errorPictureDrawn = false;
@@ -386,13 +391,13 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
                     centerY = 0;
                 imageX = leftBorder + leftPad + centerX + 1;
                 imageY = topBorder + topPad + centerY + 1;
-                context->drawImage(image(), IntPoint(tx + imageX, ty + imageY));
+                context->drawImage(image(), style()->colorSpace(), IntPoint(tx + imageX, ty + imageY));
                 errorPictureDrawn = true;
             }
 
             if (!m_altText.isEmpty()) {
                 String text = document()->displayStringModifiedByEncoding(m_altText);
-                context->setFillColor(style()->color());
+                context->setFillColor(style()->color(), style()->colorSpace());
                 int ax = tx + leftBorder + leftPad;
                 int ay = ty + topBorder + topPad;
                 const Font& font = style()->font();
@@ -420,20 +425,77 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
 #endif
 
         IntSize contentSize(cWidth, cHeight);
-        bool useLowQualityScaling = RenderImageScaleObserver::shouldImagePaintAtLowQuality(this, contentSize);
         IntRect rect(IntPoint(tx + leftBorder + leftPad, ty + topBorder + topPad), contentSize);
-        HTMLImageElement* imageElt = (node() && node()->hasTagName(imgTag)) ? static_cast<HTMLImageElement*>(node()) : 0;
-        CompositeOperator compositeOperator = imageElt ? imageElt->compositeOperator() : CompositeSourceOver;
-        context->drawImage(image(cWidth, cHeight), rect, compositeOperator, useLowQualityScaling);
+        paintIntoRect(context, rect);
     }
 }
 
+void RenderImage::paint(PaintInfo& paintInfo, int tx, int ty)
+{
+    RenderReplaced::paint(paintInfo, tx, ty);
+    
+    if (paintInfo.phase == PaintPhaseOutline)
+        paintFocusRings(paintInfo, style());
+}
+    
+void RenderImage::paintFocusRings(PaintInfo& paintInfo, const RenderStyle* style)
+{
+    // Don't draw focus rings if printing.
+    if (document()->printing() || !document()->frame()->selection()->isFocusedAndActive())
+        return;
+    
+    if (paintInfo.context->paintingDisabled() && !paintInfo.context->updatingControlTints())
+        return;
+
+    HTMLMapElement* mapElement = imageMap();
+    if (!mapElement)
+        return;
+    
+    Document* document = mapElement->document();
+    if (!document)
+        return;
+    
+    Node* focusedNode = document->focusedNode();
+    if (!focusedNode)
+        return;
+    
+    RefPtr<HTMLCollection> areas = mapElement->areas();
+    unsigned numAreas = areas->length();
+    
+    // FIXME: Clip the paths to the image bounding box.
+    for (unsigned k = 0; k < numAreas; ++k) {
+        HTMLAreaElement* areaElement = static_cast<HTMLAreaElement*>(areas->item(k));
+        if (focusedNode != areaElement)
+            continue;
+        
+        Vector<Path> focusRingPaths;
+        focusRingPaths.append(areaElement->getPath(this));
+        paintInfo.context->drawFocusRing(focusRingPaths, style->outlineWidth(), style->outlineOffset(), style->outlineColor());
+        break;
+    }
+}
+    
+void RenderImage::paintIntoRect(GraphicsContext* context, const IntRect& rect)
+{
+    if (!hasImage() || errorOccurred() || rect.width() <= 0 || rect.height() <= 0)
+        return;
+
+    Image* img = image(rect.width(), rect.height());
+    if (!img || img->isNull())
+        return;
+
+    HTMLImageElement* imageElt = (node() && node()->hasTagName(imgTag)) ? static_cast<HTMLImageElement*>(node()) : 0;
+    CompositeOperator compositeOperator = imageElt ? imageElt->compositeOperator() : CompositeSourceOver;
+    bool useLowQualityScaling = RenderImageScaleObserver::shouldImagePaintAtLowQuality(this, rect.size());
+    context->drawImage(image(rect.width(), rect.height()), style()->colorSpace(), rect, compositeOperator, useLowQualityScaling);
+}
+
 int RenderImage::minimumReplacedHeight() const
 {
     return errorOccurred() ? intrinsicSize().height() : 0;
 }
 
-HTMLMapElement* RenderImage::imageMap()
+HTMLMapElement* RenderImage::imageMap() const
 {
     HTMLImageElement* i = node() && node()->hasTagName(imgTag) ? static_cast<HTMLImageElement*>(node()) : 0;
     return i ? i->document()->getImageMap(i->getAttribute(usemapAttr)) : 0;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderImage.h b/src/3rdparty/webkit/WebCore/rendering/RenderImage.h
index 2224412ae1..b89a65249d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderImage.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderImage.h
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2006 Allan Sandfeld Jensen (kde@carewolf.com) 
  *           (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
- * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -43,7 +43,7 @@ public:
     void setCachedImage(CachedImage*);
     CachedImage* cachedImage() const { return m_cachedImage.get(); }
 
-    HTMLMapElement* imageMap();
+    HTMLMapElement* imageMap() const;
 
     void resetAnimation();
 
@@ -57,6 +57,15 @@ protected:
 
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
+    virtual void paintIntoRect(GraphicsContext*, const IntRect&);
+    void paintFocusRings(PaintInfo&, const RenderStyle*);
+    virtual void paint(PaintInfo&, int tx, int ty);
+
+    bool isWidthSpecified() const;
+    bool isHeightSpecified() const;
+
+    virtual void intrinsicSizeChanged() { imageChanged(imagePtr()); }
+
 private:
     virtual const char* renderName() const { return "RenderImage"; }
 
@@ -82,14 +91,9 @@ private:
     virtual IntSize imageSize(float multiplier) const { return m_cachedImage ? m_cachedImage->imageSize(multiplier) : IntSize(); }
     virtual WrappedImagePtr imagePtr() const { return m_cachedImage.get(); }
 
-    virtual void intrinsicSizeChanged() { imageChanged(imagePtr()); }
-
     int calcAspectRatioWidth() const;
     int calcAspectRatioHeight() const;
 
-    bool isWidthSpecified() const;
-    bool isHeightSpecified() const;
-
 protected:
     // The image we are rendering.
     CachedResourceHandle<CachedImage> m_cachedImage;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
index 2f9a247a5e..1d76742efe 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
@@ -23,6 +23,7 @@
 #include "config.h"
 #include "RenderInline.h"
 
+#include "Chrome.h"
 #include "FloatQuad.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
@@ -79,7 +80,7 @@ void RenderInline::destroy()
             // not have a parent that means they are either already disconnected or
             // root lines that can just be destroyed without disconnecting.
             if (firstLineBox()->parent()) {
-                for (InlineRunBox* box = firstLineBox(); box; box = box->nextLineBox())
+                for (InlineFlowBox* box = firstLineBox(); box; box = box->nextLineBox())
                     box->remove();
             }
         } else if (isInline() && parent())
@@ -409,7 +410,7 @@ void RenderInline::paint(PaintInfo& paintInfo, int tx, int ty)
 
 void RenderInline::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
 {
-    if (InlineRunBox* curr = firstLineBox()) {
+    if (InlineFlowBox* curr = firstLineBox()) {
         for (; curr; curr = curr->nextLineBox())
             rects.append(IntRect(tx + curr->x(), ty + curr->y(), curr->width(), curr->height()));
     } else
@@ -428,7 +429,7 @@ void RenderInline::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
 
 void RenderInline::absoluteQuads(Vector<FloatQuad>& quads)
 {
-    if (InlineRunBox* curr = firstLineBox()) {
+    if (InlineFlowBox* curr = firstLineBox()) {
         for (; curr; curr = curr->nextLineBox()) {
             FloatRect localRect(curr->x(), curr->y(), curr->width(), curr->height());
             quads.append(localToAbsoluteQuad(localRect));
@@ -533,7 +534,7 @@ IntRect RenderInline::linesBoundingBox() const
         // Return the width of the minimal left side and the maximal right side.
         int leftSide = 0;
         int rightSide = 0;
-        for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
+        for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
             if (curr == firstLineBox() || curr->x() < leftSide)
                 leftSide = curr->x();
             if (curr == firstLineBox() || curr->x() + curr->width() > rightSide)
@@ -556,7 +557,7 @@ IntRect RenderInline::linesVisibleOverflowBoundingBox() const
     // Return the width of the minimal left side and the maximal right side.
     int leftSide = numeric_limits<int>::max();
     int rightSide = numeric_limits<int>::min();
-    for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextFlowBox()) {
+    for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
         leftSide = min(leftSide, curr->leftVisibleOverflow());
         rightSide = max(rightSide, curr->rightVisibleOverflow());
     }
@@ -598,11 +599,10 @@ IntRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* repain
         // cb->height() is inaccurate if we're in the middle of a layout of |cb|, so use the
         // layer's size instead.  Even if the layer's size is wrong, the layer itself will repaint
         // anyway if its size does change.
-        int x = r.x();
-        int y = r.y();
+        IntRect repaintRect(r);
+        repaintRect.move(-cb->layer()->scrolledContentOffset()); // For overflow:auto/scroll/hidden.
+
         IntRect boxRect(0, 0, cb->layer()->width(), cb->layer()->height());
-        cb->layer()->subtractScrolledContentOffset(x, y); // For overflow:auto/scroll/hidden.
-        IntRect repaintRect(x, y, r.width(), r.height());
         r = intersection(repaintRect, boxRect);
     }
     
@@ -709,7 +709,7 @@ void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
     o->computeRectForRepaint(repaintContainer, rect, fixed);
 }
 
-IntSize RenderInline::offsetFromContainer(RenderObject* container) const
+IntSize RenderInline::offsetFromContainer(RenderObject* container, const IntPoint& point) const
 {
     ASSERT(container == this->container());
 
@@ -717,13 +717,7 @@ IntSize RenderInline::offsetFromContainer(RenderObject* container) const
     if (isRelPositioned())
         offset += relativePositionOffset();
 
-    if (!isInline() || isReplaced()) {
-        RenderBlock* cb;
-        if (container->isBlockFlow() && (cb = toRenderBlock(container))->hasColumns()) {
-            IntRect rect(0, 0, 1, 1);
-            cb->adjustRectForColumns(rect);
-        }
-    }
+    container->adjustForColumns(offset, point);
 
     if (container->hasOverflowClip())
         offset -= toRenderBox(container)->layer()->scrolledContentOffset();
@@ -752,7 +746,7 @@ void RenderInline::mapLocalToContainer(RenderBoxModelObject* repaintContainer, b
     if (!o)
         return;
 
-    IntSize containerOffset = offsetFromContainer(o);
+    IntSize containerOffset = offsetFromContainer(o, roundedIntPoint(transformState.mappedPoint()));
 
     bool preserve3D = useTransforms && (o->style()->preserves3D() || style()->preserves3D());
     if (useTransforms && shouldUseTransformFromContainer(o)) {
@@ -784,7 +778,7 @@ void RenderInline::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, Trans
 
     o->mapAbsoluteToLocalPoint(fixed, useTransforms, transformState);
 
-    IntSize containerOffset = offsetFromContainer(o);
+    IntSize containerOffset = offsetFromContainer(o, IntPoint());
 
     bool preserve3D = useTransforms && (o->style()->preserves3D() || style()->preserves3D());
     if (useTransforms && shouldUseTransformFromContainer(o)) {
@@ -931,13 +925,15 @@ void RenderInline::imageChanged(WrappedImagePtr, const IntRect*)
     repaint();
 }
 
-void RenderInline::addFocusRingRects(GraphicsContext* graphicsContext, int tx, int ty)
+void RenderInline::addFocusRingRects(Vector<IntRect>& rects, int tx, int ty)
 {
-    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
+    for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
         RootInlineBox* root = curr->root();
         int top = max(root->lineTop(), curr->y());
         int bottom = min(root->lineBottom(), curr->y() + curr->height());
-        graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + top, curr->width(), bottom - top));
+        IntRect rect(tx + curr->x(), ty + top, curr->width(), bottom - top);
+        if (!rect.isEmpty())
+            rects.append(rect);
     }
 
     for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
@@ -948,17 +944,17 @@ void RenderInline::addFocusRingRects(GraphicsContext* graphicsContext, int tx, i
                 pos = curr->localToAbsolute();
             else if (curr->isBox())
                 pos.move(toRenderBox(curr)->x(), toRenderBox(curr)->y());
-           curr->addFocusRingRects(graphicsContext, pos.x(), pos.y());
+           curr->addFocusRingRects(rects, pos.x(), pos.y());
         }
     }
 
     if (continuation()) {
         if (continuation()->isInline())
-            continuation()->addFocusRingRects(graphicsContext, 
+            continuation()->addFocusRingRects(rects, 
                                               tx - containingBlock()->x() + continuation()->containingBlock()->x(),
                                               ty - containingBlock()->y() + continuation()->containingBlock()->y());
         else
-            continuation()->addFocusRingRects(graphicsContext, 
+            continuation()->addFocusRingRects(rects, 
                                               tx - containingBlock()->x() + toRenderBox(continuation())->x(),
                                               ty - containingBlock()->y() + toRenderBox(continuation())->y());
     }
@@ -975,13 +971,12 @@ void RenderInline::paintOutline(GraphicsContext* graphicsContext, int tx, int ty
         if (!oc.isValid())
             oc = style()->color();
 
-        graphicsContext->initFocusRing(ow, style()->outlineOffset());
-        addFocusRingRects(graphicsContext, tx, ty);
+        Vector<IntRect> focusRingRects;
+        addFocusRingRects(focusRingRects, tx, ty);
         if (style()->outlineStyleIsAuto())
-            graphicsContext->drawFocusRing(oc);
+            graphicsContext->drawFocusRing(focusRingRects, ow, style()->outlineOffset(), oc);
         else
-            addPDFURLRect(graphicsContext, graphicsContext->focusRingBoundingRect());
-        graphicsContext->clearFocusRing();
+            addPDFURLRect(graphicsContext, unionRect(focusRingRects));
     }
 
     if (style()->outlineStyleIsAuto() || style()->outlineStyle() == BNONE)
@@ -990,7 +985,7 @@ void RenderInline::paintOutline(GraphicsContext* graphicsContext, int tx, int ty
     Vector<IntRect> rects;
 
     rects.append(IntRect());
-    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
+    for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
         RootInlineBox* root = curr->root();
         int top = max(root->lineTop(), curr->y());
         int bottom = min(root->lineBottom(), curr->y() + curr->height());
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderInline.h b/src/3rdparty/webkit/WebCore/rendering/RenderInline.h
index 8e9715ccbd..7fcb5161bc 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderInline.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderInline.h
@@ -44,7 +44,7 @@ public:
     virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
     virtual void absoluteQuads(Vector<FloatQuad>&);
 
-    virtual IntSize offsetFromContainer(RenderObject*) const;
+    virtual IntSize offsetFromContainer(RenderObject*, const IntPoint&) const;
 
     IntRect linesBoundingBox() const;
     IntRect linesVisibleOverflowBoundingBox() const;
@@ -65,7 +65,7 @@ public:
     
     IntSize relativePositionedInlineOffset(const RenderBox* child) const;
 
-    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
+    virtual void addFocusRingRects(Vector<IntRect>&, int tx, int ty);
     void paintOutline(GraphicsContext*, int tx, int ty);
 
     int verticalPositionFromCache(bool firstLine) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
index fea61c9feb..15ffb64b49 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
@@ -73,11 +73,13 @@
 #include "RenderScrollbar.h"
 #include "RenderScrollbarPart.h"
 #include "RenderTheme.h"
+#include "RenderTreeAsText.h"
 #include "RenderView.h"
 #include "ScaleTransformOperation.h"
 #include "Scrollbar.h"
 #include "ScrollbarTheme.h"
 #include "SelectionController.h"
+#include "TextStream.h"
 #include "TransformationMatrix.h"
 #include "TransformState.h"
 #include "TranslateTransformOperation.h"
@@ -243,14 +245,6 @@ bool RenderLayer::hasAcceleratedCompositing() const
 #endif
 }
 
-void RenderLayer::setStaticY(int staticY)
-{
-    if (m_staticY == staticY)
-        return;
-    m_staticY = staticY;
-    renderer()->setChildNeedsLayout(true, false);
-}
-
 void RenderLayer::updateLayerPositions(UpdateLayerPositionsFlags flags)
 {
     if (flags & DoFullRepaint) {
@@ -295,7 +289,7 @@ void RenderLayer::updateLayerPositions(UpdateLayerPositionsFlags flags)
                     if (newRect != m_repaintRect)
                         renderer()->repaintUsingContainer(repaintContainer, newRect);
                 } else
-                    renderer()->repaintAfterLayoutIfNeeded(repaintContainer, m_repaintRect, m_outlineBox);
+                    renderer()->repaintAfterLayoutIfNeeded(repaintContainer, m_repaintRect, m_outlineBox, &newRect, &newOutlineBox);
             }
         }
         m_repaintRect = newRect;
@@ -383,6 +377,20 @@ TransformationMatrix RenderLayer::currentTransform() const
     return *m_transform;
 }
 
+TransformationMatrix RenderLayer::renderableTransform(PaintBehavior paintBehavior) const
+{
+    if (!m_transform)
+        return TransformationMatrix();
+    
+    if (paintBehavior & PaintBehaviorFlattenCompositingLayers) {
+        TransformationMatrix matrix = *m_transform;
+        makeMatrixRenderable(matrix, false /* flatten 3d */);
+        return matrix;
+    }
+
+    return *m_transform;
+}
+
 void RenderLayer::setHasVisibleContent(bool b)
 { 
     if (m_hasVisibleContent == b && !m_visibleContentStatusDirty)
@@ -563,15 +571,20 @@ void RenderLayer::updateLayerPosition()
         RenderLayer* positionedParent = enclosingPositionedAncestor();
 
         // For positioned layers, we subtract out the enclosing positioned layer's scroll offset.
-        positionedParent->subtractScrolledContentOffset(x, y);
+        IntSize offset = positionedParent->scrolledContentOffset();
+        x -= offset.width();
+        y -= offset.height();
         
         if (renderer()->isPositioned() && positionedParent->renderer()->isRelPositioned() && positionedParent->renderer()->isRenderInline()) {
             IntSize offset = toRenderInline(positionedParent->renderer())->relativePositionedInlineOffset(toRenderBox(renderer()));
             x += offset.width();
             y += offset.height();
         }
-    } else if (parent())
-        parent()->subtractScrolledContentOffset(x, y);
+    } else if (parent()) {
+        IntSize offset = parent()->scrolledContentOffset();
+        x -= offset.width();
+        y -= offset.height();
+    }
     
     // FIXME: We'd really like to just get rid of the concept of a layer rectangle and rely on the renderers.
 
@@ -651,6 +664,12 @@ static inline bool isPositionedContainer(RenderLayer* layer)
     return o->isRenderView() || o->isPositioned() || o->isRelPositioned() || layer->hasTransform();
 }
 
+static inline bool isFixedPositionedContainer(RenderLayer* layer)
+{
+    RenderObject* o = layer->renderer();
+    return o->isRenderView() || layer->hasTransform();
+}
+
 RenderLayer* RenderLayer::enclosingPositionedAncestor() const
 {
     RenderLayer* curr = parent();
@@ -689,6 +708,32 @@ RenderLayer* RenderLayer::enclosingCompositingLayer(bool includeSelf) const
 }
 #endif
 
+RenderLayer* RenderLayer::clippingRoot() const
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (isComposited())
+        return const_cast<RenderLayer*>(this);
+#endif
+
+    const RenderLayer* current = this;
+    while (current) {
+        if (current->renderer()->isRenderView())
+            return const_cast<RenderLayer*>(current);
+
+        current = compositingContainer(current);
+        ASSERT(current);
+        if (current->transform()
+#if USE(ACCELERATED_COMPOSITING)
+            || current->isComposited()
+#endif
+        )
+            return const_cast<RenderLayer*>(current);
+    }
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
 IntPoint RenderLayer::absoluteToContents(const IntPoint& absolutePoint) const
 {
     // We don't use convertToLayerCoords because it doesn't know about transforms
@@ -727,46 +772,18 @@ RenderLayer* RenderLayer::transparentPaintingAncestor()
     return 0;
 }
 
-static IntRect transparencyClipBox(const TransformationMatrix& enclosingTransform, const RenderLayer* l, const RenderLayer* rootLayer)
-{
-    // FIXME: Although this function completely ignores CSS-imposed clipping, we did already intersect with the
-    // paintDirtyRect, and that should cut down on the amount we have to paint.  Still it
-    // would be better to respect clips.
-    
-    if (rootLayer != l && l->paintsWithTransform()) {
-        // The best we can do here is to use enclosed bounding boxes to establish a "fuzzy" enough clip to encompass
-        // the transformed layer and all of its children.
-        int x = 0;
-        int y = 0;
-        l->convertToLayerCoords(rootLayer, x, y);
-
-        TransformationMatrix transform;
-        transform.translate(x, y);
-        transform = *l->transform() * transform;
-        transform = transform * enclosingTransform;
+static IntRect transparencyClipBox(const RenderLayer* l, const RenderLayer* rootLayer, PaintBehavior paintBehavior);
 
-        // We now have a transform that will produce a rectangle in our view's space.
-        IntRect clipRect = transform.mapRect(l->boundingBox(l));
-        
-        // Now shift the root layer to be us and pass down the new enclosing transform.
-        for (RenderLayer* curr = l->firstChild(); curr; curr = curr->nextSibling()) {
-            if (!l->reflection() || l->reflectionLayer() != curr)
-                clipRect.unite(transparencyClipBox(transform, curr, l));
-        }
-            
-        return clipRect;
-    }
-    
-    // Note: we don't have to walk z-order lists since transparent elements always establish
-    // a stacking context.  This means we can just walk the layer tree directly.
-    IntRect clipRect = l->boundingBox(rootLayer);
-    
+static void expandClipRectForDescendantsAndReflection(IntRect& clipRect, const RenderLayer* l, const RenderLayer* rootLayer, PaintBehavior paintBehavior)
+{
     // If we have a mask, then the clip is limited to the border box area (and there is
     // no need to examine child layers).
     if (!l->renderer()->hasMask()) {
+        // Note: we don't have to walk z-order lists since transparent elements always establish
+        // a stacking context.  This means we can just walk the layer tree directly.
         for (RenderLayer* curr = l->firstChild(); curr; curr = curr->nextSibling()) {
             if (!l->reflection() || l->reflectionLayer() != curr)
-                clipRect.unite(transparencyClipBox(enclosingTransform, curr, rootLayer));
+                clipRect.unite(transparencyClipBox(curr, rootLayer, paintBehavior));
         }
     }
 
@@ -782,25 +799,54 @@ static IntRect transparencyClipBox(const TransformationMatrix& enclosingTransfor
         clipRect.unite(l->renderBox()->reflectedRect(clipRect));
         clipRect.move(deltaX, deltaY);
     }
+}
+
+static IntRect transparencyClipBox(const RenderLayer* l, const RenderLayer* rootLayer, PaintBehavior paintBehavior)
+{
+    // FIXME: Although this function completely ignores CSS-imposed clipping, we did already intersect with the
+    // paintDirtyRect, and that should cut down on the amount we have to paint.  Still it
+    // would be better to respect clips.
+    
+    if (rootLayer != l && l->paintsWithTransform(paintBehavior)) {
+        // The best we can do here is to use enclosed bounding boxes to establish a "fuzzy" enough clip to encompass
+        // the transformed layer and all of its children.
+        int x = 0;
+        int y = 0;
+        l->convertToLayerCoords(rootLayer, x, y);
 
-    // Now map the clipRect via the enclosing transform
-    return enclosingTransform.mapRect(clipRect);
+        TransformationMatrix transform;
+        transform.translate(x, y);
+        transform = *l->transform() * transform;
+
+        IntRect clipRect = l->boundingBox(l);
+        expandClipRectForDescendantsAndReflection(clipRect, l, l, paintBehavior);
+        return transform.mapRect(clipRect);
+    }
+    
+    IntRect clipRect = l->boundingBox(rootLayer);
+    expandClipRectForDescendantsAndReflection(clipRect, l, rootLayer, paintBehavior);
+    return clipRect;
 }
 
-void RenderLayer::beginTransparencyLayers(GraphicsContext* p, const RenderLayer* rootLayer)
+void RenderLayer::beginTransparencyLayers(GraphicsContext* p, const RenderLayer* rootLayer, PaintBehavior paintBehavior)
 {
-    if (p->paintingDisabled() || (paintsWithTransparency() && m_usedTransparency))
+    if (p->paintingDisabled() || (paintsWithTransparency(paintBehavior) && m_usedTransparency))
         return;
     
     RenderLayer* ancestor = transparentPaintingAncestor();
     if (ancestor)
-        ancestor->beginTransparencyLayers(p, rootLayer);
+        ancestor->beginTransparencyLayers(p, rootLayer, paintBehavior);
     
-    if (paintsWithTransparency()) {
+    if (paintsWithTransparency(paintBehavior)) {
         m_usedTransparency = true;
         p->save();
-        p->clip(transparencyClipBox(TransformationMatrix(), this, rootLayer));
+        IntRect clipRect = transparencyClipBox(this, rootLayer, paintBehavior);
+        p->clip(clipRect);
         p->beginTransparencyLayer(renderer()->opacity());
+#ifdef REVEAL_TRANSPARENCY_LAYERS
+        p->setFillColor(Color(0.0f, 0.0f, 0.5f, 0.2f), DeviceColorSpace);
+        p->fillRect(clipRect);
+#endif
     }
 }
 
@@ -958,9 +1004,10 @@ RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, int& xPos, i
 {
     if (ancestorLayer == this)
         return;
-        
-    if (renderer()->style()->position() == FixedPosition) {
-        // Add in the offset of the view.  We can obtain this by calling
+
+    EPosition position = renderer()->style()->position();
+    if (position == FixedPosition && (!ancestorLayer || ancestorLayer == renderer()->view()->layer())) {
+        // If the fixed layer's container is the root, just add in the offset of the view. We can obtain this by calling
         // localToAbsolute() on the RenderView.
         FloatPoint absPos = renderer()->localToAbsolute(FloatPoint(), true);
         xPos += absPos.x();
@@ -968,9 +1015,43 @@ RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, int& xPos, i
         return;
     }
  
+    if (position == FixedPosition) {
+        // For a fixed layers, we need to walk up to the root to see if there's a fixed position container
+        // (e.g. a transformed layer). It's an error to call convertToLayerCoords() across a layer with a transform,
+        // so we should always find the ancestor at or before we find the fixed position container.
+        RenderLayer* fixedPositionContainerLayer = 0;
+        bool foundAncestor = false;
+        for (RenderLayer* currLayer = parent(); currLayer; currLayer = currLayer->parent()) {
+            if (currLayer == ancestorLayer)
+                foundAncestor = true;
+
+            if (isFixedPositionedContainer(currLayer)) {
+                fixedPositionContainerLayer = currLayer;
+                ASSERT(foundAncestor);
+                break;
+            }
+        }
+        
+        ASSERT(fixedPositionContainerLayer); // We should have hit the RenderView's layer at least.
+
+        if (fixedPositionContainerLayer != ancestorLayer) {
+            int fixedContainerX = 0;
+            int fixedContainerY = 0;
+            convertToLayerCoords(fixedPositionContainerLayer, fixedContainerX, fixedContainerY);
+            
+            int ancestorX = 0;
+            int ancestorY = 0;
+            ancestorLayer->convertToLayerCoords(fixedPositionContainerLayer, ancestorX, ancestorY);
+        
+            xPos += (fixedContainerX - ancestorX);
+            yPos += (fixedContainerY - ancestorY);
+            return;
+        }
+    }
+    
     RenderLayer* parentLayer;
-    if (renderer()->style()->position() == AbsolutePosition) {
-        // Do what enclosingPositionedAncestor() does, but check for ancestorLayer along the way
+    if (position == AbsolutePosition || position == FixedPosition) {
+        // Do what enclosingPositionedAncestor() does, but check for ancestorLayer along the way.
         parentLayer = parent();
         bool foundAncestorFirst = false;
         while (parentLayer) {
@@ -1061,7 +1142,7 @@ void RenderLayer::scrollByRecursively(int xDelta, int yDelta)
 
     bool restrictedByLineClamp = false;
     if (renderer()->parent())
-        restrictedByLineClamp = renderer()->parent()->style()->lineClamp() >= 0;
+        restrictedByLineClamp = !renderer()->parent()->style()->lineClamp().isNone();
 
     if (renderer()->hasOverflowClip() && !restrictedByLineClamp) {
         int newOffsetX = scrollXOffset() + xDelta;
@@ -1086,7 +1167,7 @@ void RenderLayer::scrollByRecursively(int xDelta, int yDelta)
                 frame->eventHandler()->updateAutoscrollRenderer();
         }
     } else if (renderer()->view()->frameView()) {
-        // If we are here, we were called on a renderer that can be programatically scrolled, but doesn't
+        // If we are here, we were called on a renderer that can be programmatically scrolled, but doesn't
         // have an overflow clip. Which means that it is a document node that can be scrolled.
         renderer()->view()->frameView()->scrollBy(IntSize(xDelta, yDelta));
         // FIXME: If we didn't scroll the whole way, do we want to try looking at the frames ownerElement? 
@@ -1094,21 +1175,6 @@ void RenderLayer::scrollByRecursively(int xDelta, int yDelta)
     }
 }
 
-
-void
-RenderLayer::addScrolledContentOffset(int& x, int& y) const
-{
-    x += scrollXOffset() + m_scrollLeftOverflow;
-    y += scrollYOffset();
-}
-
-void
-RenderLayer::subtractScrolledContentOffset(int& x, int& y) const
-{
-    x -= scrollXOffset() + m_scrollLeftOverflow;
-    y -= scrollYOffset();
-}
-
 void RenderLayer::scrollToOffset(int x, int y, bool updateScrollbars, bool repaint)
 {
     RenderBox* box = renderBox();
@@ -1146,7 +1212,9 @@ void RenderLayer::scrollToOffset(int x, int y, bool updateScrollbars, bool repai
 
 #if USE(ACCELERATED_COMPOSITING)
     if (compositor()->inCompositingMode()) {
-        if (RenderLayer* compositingAncestor = ancestorCompositingLayer()) {
+        // Our stacking context is guaranteed to contain all of our descendants that may need
+        // repositioning, so update compositing layers from there.
+        if (RenderLayer* compositingAncestor = stackingContext()->enclosingCompositingLayer()) {
             bool isUpdateRoot = true;
             compositingAncestor->backing()->updateAfterLayout(RenderLayerBacking::AllDescendants, isUpdateRoot);
         }
@@ -1167,15 +1235,24 @@ void RenderLayer::scrollToOffset(int x, int y, bool updateScrollbars, bool repai
         view->updateWidgetPositions();
     }
 
-    // The caret rect needs to be invalidated after scrolling
+    RenderBoxModelObject* repaintContainer = renderer()->containerForRepaint();
+    IntRect rectForRepaint = renderer()->clippedOverflowRectForRepaint(repaintContainer);
+
     Frame* frame = renderer()->document()->frame();
-    if (frame)
-        frame->invalidateSelection();
+    if (frame) {
+        // The caret rect needs to be invalidated after scrolling
+        frame->selection()->setNeedsLayout();
+
+        FloatQuad quadForFakeMouseMoveEvent = FloatQuad(rectForRepaint);
+        if (repaintContainer)
+            quadForFakeMouseMoveEvent = repaintContainer->localToAbsoluteQuad(quadForFakeMouseMoveEvent);
+        frame->eventHandler()->dispatchFakeMouseMoveEventSoonInQuad(quadForFakeMouseMoveEvent);
+    }
 
     // Just schedule a full repaint of our object.
-    if (repaint)
-        renderer()->repaint();
-    
+    if (view && repaint)
+        renderer()->repaintUsingContainer(repaintContainer, rectForRepaint);
+
     if (updateScrollbars) {
         if (m_hBar)
             m_hBar->setValue(scrollXOffset());
@@ -1205,7 +1282,7 @@ void RenderLayer::scrollRectToVisible(const IntRect &rect, bool scrollToAnchor,
     bool restrictedByLineClamp = false;
     if (renderer()->parent()) {
         parentLayer = renderer()->parent()->enclosingLayer();
-        restrictedByLineClamp = renderer()->parent()->style()->lineClamp() >= 0;
+        restrictedByLineClamp = !renderer()->parent()->style()->lineClamp().isNone();
     }
 
     if (renderer()->hasOverflowClip() && !restrictedByLineClamp) {
@@ -1673,6 +1750,11 @@ IntSize RenderLayer::offsetFromResizeCorner(const IntPoint& absolutePoint) const
     return localPoint - bottomRight;
 }
 
+bool RenderLayer::hasOverflowControls() const
+{
+    return m_hBar || m_vBar || m_scrollCorner || renderer()->style()->resize() != RESIZE_NONE;
+}
+
 void RenderLayer::positionOverflowControls(int tx, int ty)
 {
     if (!m_hBar && !m_vBar && (!renderer()->hasOverflowClip() || renderer()->style()->resize() == RESIZE_NONE))
@@ -1858,17 +1940,23 @@ RenderLayer::updateScrollInfoAfterLayout()
     // Set up the range (and page step/line step).
     if (m_hBar) {
         int clientWidth = box->clientWidth();
-        int pageStep = (clientWidth - cAmountToKeepWhenPaging);
-        if (pageStep < 0) pageStep = clientWidth;
-        m_hBar->setSteps(cScrollbarPixelsPerLineStep, pageStep);
+        int pageStep = max(max<int>(clientWidth * Scrollbar::minFractionToStepWhenPaging(), clientWidth - Scrollbar::maxOverlapBetweenPages()), 1);
+        m_hBar->setSteps(Scrollbar::pixelsPerLineStep(), pageStep);
         m_hBar->setProportion(clientWidth, m_scrollWidth);
+        // Explicitly set the horizontal scroll value.  This ensures that when a
+        // right-to-left scrollable area's width (or content width) changes, the
+        // top right corner of the content doesn't shift with respect to the top
+        // right corner of the area. Conceptually, right-to-left areas have
+        // their origin at the top-right, but RenderLayer is top-left oriented,
+        // so this is needed to keep everything working (see how scrollXOffset()
+        // differs from scrollYOffset() to get an idea of why the horizontal and
+        // vertical scrollbars need to be treated differently).
         m_hBar->setValue(scrollXOffset());
     }
     if (m_vBar) {
         int clientHeight = box->clientHeight();
-        int pageStep = (clientHeight - cAmountToKeepWhenPaging);
-        if (pageStep < 0) pageStep = clientHeight;
-        m_vBar->setSteps(cScrollbarPixelsPerLineStep, pageStep);
+        int pageStep = max(max<int>(clientHeight * Scrollbar::minFractionToStepWhenPaging(), clientHeight - Scrollbar::maxOverlapBetweenPages()), 1);
+        m_vBar->setSteps(Scrollbar::pixelsPerLineStep(), pageStep);
         m_vBar->setProportion(clientHeight, m_scrollHeight);
     }
  
@@ -1921,7 +2009,7 @@ void RenderLayer::paintScrollCorner(GraphicsContext* context, int tx, int ty, co
         return;
     }
     
-    context->fillRect(absRect, Color::white);
+    context->fillRect(absRect, Color::white, box->style()->colorSpace());
 }
 
 void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const IntRect& damageRect)
@@ -1950,7 +2038,7 @@ void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const I
     // Paint the resizer control.
     DEFINE_STATIC_LOCAL(RefPtr<Image>, resizeCornerImage, (Image::loadPlatformResource("textAreaResizeCorner")));
     IntPoint imagePoint(absRect.right() - resizeCornerImage->width(), absRect.bottom() - resizeCornerImage->height());
-    context->drawImage(resizeCornerImage.get(), imagePoint);
+    context->drawImage(resizeCornerImage.get(), box->style()->colorSpace(), imagePoint);
 
     // Draw a frame around the resizer (1px grey line) if there are any scrollbars present.
     // Clipping will exclude the right and bottom edges of this frame.
@@ -1959,9 +2047,9 @@ void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const I
         context->clip(absRect);
         IntRect largerCorner = absRect;
         largerCorner.setSize(IntSize(largerCorner.width() + 1, largerCorner.height() + 1));
-        context->setStrokeColor(Color(makeRGB(217, 217, 217)));
+        context->setStrokeColor(Color(makeRGB(217, 217, 217)), DeviceColorSpace);
         context->setStrokeThickness(1.0f);
-        context->setFillColor(Color::transparent);
+        context->setFillColor(Color::transparent, DeviceColorSpace);
         context->drawRect(largerCorner);
         context->restore();
     }
@@ -2044,10 +2132,10 @@ bool RenderLayer::scroll(ScrollDirection direction, ScrollGranularity granularit
     return (didHorizontalScroll || didVerticalScroll);
 }
 
-void RenderLayer::paint(GraphicsContext* p, const IntRect& damageRect, PaintRestriction paintRestriction, RenderObject *paintingRoot)
+void RenderLayer::paint(GraphicsContext* p, const IntRect& damageRect, PaintBehavior paintBehavior, RenderObject *paintingRoot)
 {
     RenderObject::OverlapTestRequestMap overlapTestRequests;
-    paintLayer(this, p, damageRect, paintRestriction, paintingRoot, &overlapTestRequests);
+    paintLayer(this, p, damageRect, paintBehavior, paintingRoot, &overlapTestRequests);
     RenderObject::OverlapTestRequestMap::iterator end = overlapTestRequests.end();
     for (RenderObject::OverlapTestRequestMap::iterator it = overlapTestRequests.begin(); it != end; ++it)
         it->first->setOverlapTestResult(false);
@@ -2091,7 +2179,7 @@ static bool shouldDoSoftwarePaint(const RenderLayer* layer, bool paintingReflect
 #endif
 
 void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
-                        const IntRect& paintDirtyRect, PaintRestriction paintRestriction,
+                        const IntRect& paintDirtyRect, PaintBehavior paintBehavior,
                         RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* overlapTestRequests,
                         PaintLayerFlags paintFlags)
 {
@@ -2099,7 +2187,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     if (isComposited()) {
         // The updatingControlTints() painting pass goes through compositing layers,
         // but we need to ensure that we don't cache clip rects computed with the wrong root in this case.
-        if (p->updatingControlTints())
+        if (p->updatingControlTints() || (paintBehavior & PaintBehaviorFlattenCompositingLayers))
             paintFlags |= PaintLayerTemporaryClipRects;
         else if (!backing()->paintingGoesToWindow() && !shouldDoSoftwarePaint(this, paintFlags & PaintLayerPaintingReflection)) {
             // If this RenderLayer should paint into its backing, that will be done via RenderLayerBacking::paintIntoLayer().
@@ -2118,19 +2206,20 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     if (!renderer()->opacity())
         return;
 
-    if (paintsWithTransparency())
+    if (paintsWithTransparency(paintBehavior))
         paintFlags |= PaintLayerHaveTransparency;
 
     // Apply a transform if we have one.  A reflection is considered to be a transform, since it is a flip and a translate.
-    if (paintsWithTransform() && !(paintFlags & PaintLayerAppliedTransform)) {
+    if (paintsWithTransform(paintBehavior) && !(paintFlags & PaintLayerAppliedTransform)) {
+        TransformationMatrix layerTransform = renderableTransform(paintBehavior);
         // If the transform can't be inverted, then don't paint anything.
-        if (!m_transform->isInvertible())
+        if (!layerTransform.isInvertible())
             return;
 
         // If we have a transparency layer enclosing us and we are the root of a transform, then we need to establish the transparency
         // layer from the parent now.
         if (paintFlags & PaintLayerHaveTransparency)
-            parent()->beginTransparencyLayers(p, rootLayer);
+            parent()->beginTransparencyLayers(p, rootLayer, paintBehavior);
   
         // Make sure the parent's clip rects have been calculated.
         IntRect clipRect = paintDirtyRect;
@@ -2147,16 +2236,15 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
         int x = 0;
         int y = 0;
         convertToLayerCoords(rootLayer, x, y);
-        TransformationMatrix transform;
-        transform.translate(x, y);
-        transform = *m_transform * transform;
+        TransformationMatrix transform(layerTransform);
+        transform.translateRight(x, y);
         
         // Apply the transform.
         p->save();
-        p->concatCTM(transform);
+        p->concatCTM(transform.toAffineTransform());
 
         // Now do a paint with the root layer shifted to be us.
-        paintLayer(this, p, transform.inverse().mapRect(paintDirtyRect), paintRestriction, paintingRoot, overlapTestRequests, paintFlags | PaintLayerAppliedTransform);
+        paintLayer(this, p, transform.inverse().mapRect(paintDirtyRect), paintBehavior, paintingRoot, overlapTestRequests, paintFlags | PaintLayerAppliedTransform);
 
         p->restore();
         
@@ -2173,7 +2261,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     if (m_reflection && !m_paintingInsideReflection) {
         // Mark that we are now inside replica painting.
         m_paintingInsideReflection = true;
-        reflectionLayer()->paintLayer(rootLayer, p, paintDirtyRect, paintRestriction, paintingRoot, overlapTestRequests, localPaintFlags | PaintLayerPaintingReflection);
+        reflectionLayer()->paintLayer(rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags | PaintLayerPaintingReflection);
         m_paintingInsideReflection = false;
     }
 
@@ -2188,13 +2276,13 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     // Ensure our lists are up-to-date.
     updateCompositingAndLayerListsIfNeeded();
 
-    bool selectionOnly = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
-    bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+    bool forceBlackText = paintBehavior & PaintBehaviorForceBlackText;
+    bool selectionOnly  = paintBehavior & PaintBehaviorSelectionOnly;
     
     // If this layer's renderer is a child of the paintingRoot, we render unconditionally, which
     // is done by passing a nil paintingRoot down to our renderer (as if no paintingRoot was ever set).
     // Else, our renderer tree may or may not contain the painting root, so we pass that root along
-    // so it will be tested against as we decend through the renderers.
+    // so it will be tested against as we descend through the renderers.
     RenderObject* paintingRootForRenderer = 0;
     if (paintingRoot && !renderer()->isDescendantOf(paintingRoot))
         paintingRootForRenderer = paintingRoot;
@@ -2207,7 +2295,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     if (shouldPaint && !selectionOnly && !damageRect.isEmpty()) {
         // Begin transparency layers lazily now that we know we have to paint something.
         if (haveTransparency)
-            beginTransparencyLayers(p, rootLayer);
+            beginTransparencyLayers(p, rootLayer, paintBehavior);
         
         // Paint our background first, before painting any child layers.
         // Establish the clip used to paint our background.
@@ -2224,13 +2312,13 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     // Now walk the sorted list of children with negative z-indices.
     if (m_negZOrderList)
         for (Vector<RenderLayer*>::iterator it = m_negZOrderList->begin(); it != m_negZOrderList->end(); ++it)
-            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintRestriction, paintingRoot, overlapTestRequests, localPaintFlags);
+            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags);
     
     // Now establish the appropriate clip and paint our child RenderObjects.
     if (shouldPaint && !clipRectToApply.isEmpty()) {
         // Begin transparency layers lazily now that we know we have to paint something.
         if (haveTransparency)
-            beginTransparencyLayers(p, rootLayer);
+            beginTransparencyLayers(p, rootLayer, paintBehavior);
 
         // Set up the clip used when painting our children.
         setClip(p, paintDirtyRect, clipRectToApply);
@@ -2263,12 +2351,12 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     // Paint any child layers that have overflow.
     if (m_normalFlowList)
         for (Vector<RenderLayer*>::iterator it = m_normalFlowList->begin(); it != m_normalFlowList->end(); ++it)
-            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintRestriction, paintingRoot, overlapTestRequests, localPaintFlags);
+            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags);
 
     // Now walk the sorted list of children with positive z-indices.
     if (m_posZOrderList)
         for (Vector<RenderLayer*>::iterator it = m_posZOrderList->begin(); it != m_posZOrderList->end(); ++it)
-            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintRestriction, paintingRoot, overlapTestRequests, localPaintFlags);
+            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags);
     
     if (renderer()->hasMask() && shouldPaint && !selectionOnly && !damageRect.isEmpty()) {
         setClip(p, paintDirtyRect, damageRect);
@@ -2317,15 +2405,10 @@ bool RenderLayer::hitTest(const HitTestRequest& request, HitTestResult& result)
         }
     }
 
-    // Now determine if the result is inside an anchor; make sure an image map wins if
-    // it already set URLElement and only use the innermost.
+    // Now determine if the result is inside an anchor - if the urlElement isn't already set.
     Node* node = result.innerNode();
-    while (node) {
-        // for imagemaps, URLElement is the associated area element not the image itself
-        if (node->isLink() && !result.URLElement() && !node->hasTagName(imgTag))
-            result.setURLElement(static_cast<Element*>(node));
-        node = node->eventParentNode();
-    }
+    if (node && !result.URLElement())
+        result.setURLElement(static_cast<Element*>(node->enclosingLinkEventParentOrSelf()));
 
     // Next set up the correct :hover/:active state along the new chain.
     updateHoverActiveState(request, result);
@@ -2569,7 +2652,7 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
 
     // Next we want to see if the mouse pos is inside the child RenderObjects of the layer.
     if (fgRect.contains(hitTestPoint) && isSelfPaintingLayer()) {
-        // Hit test with a temporary HitTestResult, because we onlyl want to commit to 'result' if we know we're frontmost.
+        // Hit test with a temporary HitTestResult, because we only want to commit to 'result' if we know we're frontmost.
         HitTestResult tempResult(result.point());
         if (hitTestContents(request, tempResult, layerBounds, hitTestPoint, HitTestDescendants) &&
             isHitCandidate(this, false, zOffsetForContentsPtr, unflattenedTransformState.get())) {
@@ -2808,17 +2891,49 @@ void RenderLayer::calculateRects(const RenderLayer* rootLayer, const IntRect& pa
 IntRect RenderLayer::childrenClipRect() const
 {
     RenderLayer* rootLayer = renderer()->view()->layer();
+    RenderLayer* clippingRootLayer = clippingRoot();
     IntRect layerBounds, backgroundRect, foregroundRect, outlineRect;
-    calculateRects(rootLayer, rootLayer->boundingBox(rootLayer), layerBounds, backgroundRect, foregroundRect, outlineRect);
-    return foregroundRect;
+    calculateRects(clippingRootLayer, rootLayer->boundingBox(rootLayer), layerBounds, backgroundRect, foregroundRect, outlineRect);
+    return clippingRootLayer->renderer()->localToAbsoluteQuad(FloatQuad(foregroundRect)).enclosingBoundingBox();
 }
 
 IntRect RenderLayer::selfClipRect() const
 {
     RenderLayer* rootLayer = renderer()->view()->layer();
+    RenderLayer* clippingRootLayer = clippingRoot();
     IntRect layerBounds, backgroundRect, foregroundRect, outlineRect;
-    calculateRects(rootLayer, rootLayer->boundingBox(rootLayer), layerBounds, backgroundRect, foregroundRect, outlineRect);
-    return backgroundRect;
+    calculateRects(clippingRootLayer, rootLayer->boundingBox(rootLayer), layerBounds, backgroundRect, foregroundRect, outlineRect);
+    return clippingRootLayer->renderer()->localToAbsoluteQuad(FloatQuad(backgroundRect)).enclosingBoundingBox();
+}
+
+void RenderLayer::addBlockSelectionGapsBounds(const IntRect& bounds)
+{
+    m_blockSelectionGapsBounds.unite(bounds);
+}
+
+void RenderLayer::clearBlockSelectionGapsBounds()
+{
+    m_blockSelectionGapsBounds = IntRect();
+    for (RenderLayer* child = firstChild(); child; child = child->nextSibling())
+        child->clearBlockSelectionGapsBounds();
+}
+
+void RenderLayer::repaintBlockSelectionGaps()
+{
+    for (RenderLayer* child = firstChild(); child; child = child->nextSibling())
+        child->repaintBlockSelectionGaps();
+
+    if (m_blockSelectionGapsBounds.isEmpty())
+        return;
+
+    IntRect rect = m_blockSelectionGapsBounds;
+    rect.move(-scrolledContentOffset());
+    if (renderer()->hasOverflowClip())
+        rect.intersect(toRenderBox(renderer())->overflowClipRect(0, 0));
+    if (renderer()->hasClip())
+        rect.intersect(toRenderBox(renderer())->clipRect(0, 0));
+    if (!rect.isEmpty())
+        renderer()->repaintRectangle(rect);
 }
 
 bool RenderLayer::intersectsDamageRect(const IntRect& layerBounds, const IntRect& damageRect, const RenderLayer* rootLayer) const
@@ -2866,7 +2981,7 @@ IntRect RenderLayer::localBoundingBox() const
         int top = firstBox->topVisibleOverflow();
         int bottom = inlineFlow->lastLineBox()->bottomVisibleOverflow();
         int left = firstBox->x();
-        for (InlineRunBox* curr = firstBox->nextLineBox(); curr; curr = curr->nextLineBox())
+        for (InlineFlowBox* curr = firstBox->nextLineBox(); curr; curr = curr->nextLineBox())
             left = min(left, curr->x());
         result = IntRect(left, top, width(), bottom - top);
     } else if (renderer()->isTableRow()) {
@@ -3172,7 +3287,7 @@ void RenderLayer::updateCompositingAndLayerListsIfNeeded()
 #if USE(ACCELERATED_COMPOSITING)
     if (compositor()->inCompositingMode()) {
         if ((isStackingContext() && m_zOrderListsDirty) || m_normalFlowListDirty)
-            compositor()->updateCompositingLayers(this);
+            compositor()->updateCompositingLayers(CompositingUpdateOnPaitingOrHitTest, this);
         return;
     }
 #endif
@@ -3233,7 +3348,7 @@ void RenderLayer::repaintIncludingNonCompositingDescendants(RenderBoxModelObject
 
 bool RenderLayer::shouldBeNormalFlowOnly() const
 {
-    return (renderer()->hasOverflowClip() || renderer()->hasReflection() || renderer()->hasMask() || renderer()->isVideo()) &&
+    return (renderer()->hasOverflowClip() || renderer()->hasReflection() || renderer()->hasMask() || renderer()->isVideo() || renderer()->isEmbeddedObject()) &&
            !renderer()->isPositioned() &&
            !renderer()->isRelPositioned() &&
            !renderer()->hasTransform() &&
@@ -3242,7 +3357,7 @@ bool RenderLayer::shouldBeNormalFlowOnly() const
 
 bool RenderLayer::isSelfPaintingLayer() const
 {
-    return !isNormalFlowOnly() || renderer()->hasReflection() || renderer()->hasMask() || renderer()->isTableRow() || renderer()->isVideo();
+    return !isNormalFlowOnly() || renderer()->hasReflection() || renderer()->hasMask() || renderer()->isTableRow() || renderer()->isVideo() || renderer()->isEmbeddedObject();
 }
 
 void RenderLayer::styleChanged(StyleDifference diff, const RenderStyle*)
@@ -3256,7 +3371,7 @@ void RenderLayer::styleChanged(StyleDifference diff, const RenderStyle*)
         dirtyStackingContextZOrderLists();
     }
 
-    if (renderer()->style()->overflowX() == OMARQUEE && renderer()->style()->marqueeBehavior() != MNONE) {
+    if (renderer()->style()->overflowX() == OMARQUEE && renderer()->style()->marqueeBehavior() != MNONE && renderer()->isBox()) {
         if (!m_marquee)
             m_marquee = new RenderMarquee(this);
         m_marquee->updateMarqueeStyle();
@@ -3390,3 +3505,16 @@ void RenderLayer::updateReflectionStyle()
 }
 
 } // namespace WebCore
+
+#ifndef NDEBUG
+void showLayerTree(const WebCore::RenderLayer* layer)
+{
+    if (!layer)
+        return;
+
+    if (WebCore::Frame* frame = layer->renderer()->document()->frame()) {
+        WebCore::String output = externalRepresentation(frame, WebCore::RenderAsTextShowAllLayers | WebCore::RenderAsTextShowLayerNesting | WebCore::RenderAsTextShowCompositedLayers);
+        fprintf(stderr, "%s\n", output.utf8().data());
+    }
+}
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
index a274638586..9210e95c92 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
@@ -202,9 +202,10 @@ public:
 
     bool isTransparent() const;
     RenderLayer* transparentPaintingAncestor();
-    void beginTransparencyLayers(GraphicsContext*, const RenderLayer* rootLayer);
+    void beginTransparencyLayers(GraphicsContext*, const RenderLayer* rootLayer, PaintBehavior);
 
     bool hasReflection() const { return renderer()->hasReflection(); }
+    bool isReflection() const { return renderer()->isReplica(); }
     RenderReplica* reflection() const { return m_reflection; }
     RenderLayer* reflectionLayer() const;
 
@@ -226,6 +227,8 @@ public:
 
     int width() const { return m_width; }
     int height() const { return m_height; }
+    IntSize size() const { return IntSize(m_width, m_height); }
+    
     void setWidth(int w) { m_width = w; }
     void setHeight(int h) { m_height = h; }
 
@@ -236,8 +239,7 @@ public:
 
     // Scrolling methods for layers that can scroll their overflow.
     void scrollByRecursively(int xDelta, int yDelta);
-    void addScrolledContentOffset(int& x, int& y) const;
-    void subtractScrolledContentOffset(int& x, int& y) const;
+
     IntSize scrolledContentOffset() const { return IntSize(scrollXOffset() + m_scrollLeftOverflow, scrollYOffset()); }
 
     int scrollXOffset() const { return m_scrollX + m_scrollOriginX; }
@@ -262,6 +264,7 @@ public:
     int verticalScrollbarWidth() const;
     int horizontalScrollbarHeight() const;
 
+    bool hasOverflowControls() const;
     void positionOverflowControls(int tx, int ty);
     bool isPointInResizeControl(const IntPoint& absolutePoint) const;
     bool hitTestOverflowControls(HitTestResult&, const IntPoint& localPoint);
@@ -312,6 +315,10 @@ public:
     void clearClipRectsIncludingDescendants();
     void clearClipRects();
 
+    void addBlockSelectionGapsBounds(const IntRect&);
+    void clearBlockSelectionGapsBounds();
+    void repaintBlockSelectionGaps();
+
     // Get the enclosing stacking context for this layer.  A stacking context is a layer
     // that has a non-auto z-index.
     RenderLayer* stackingContext() const;
@@ -336,6 +343,9 @@ public:
     // the <html> layer and the root layer).
     RenderLayer* enclosingPositionedAncestor() const;
 
+    // The layer relative to which clipping rects for this layer are computed.
+    RenderLayer* clippingRoot() const;
+
 #if USE(ACCELERATED_COMPOSITING)
     // Enclosing compositing layer; if includeSelf is true, may return this.
     RenderLayer* enclosingCompositingLayer(bool includeSelf = true) const;
@@ -352,7 +362,7 @@ public:
     // paints the layers that intersect the damage rect from back to
     // front.  The hitTest method looks for mouse events by walking
     // layers that intersect the point from front to back.
-    void paint(GraphicsContext*, const IntRect& damageRect, PaintRestriction = PaintRestrictionNone, RenderObject* paintingRoot = 0);
+    void paint(GraphicsContext*, const IntRect& damageRect, PaintBehavior = PaintBehaviorNormal, RenderObject* paintingRoot = 0);
     bool hitTest(const HitTestRequest&, HitTestResult&);
 
     // This method figures out our layerBounds in coordinates relative to
@@ -390,7 +400,7 @@ public:
     int staticX() const { return m_staticX; }
     int staticY() const { return m_staticY; }
     void setStaticX(int staticX) { m_staticX = staticX; }
-    void setStaticY(int staticY);
+    void setStaticY(int staticY) { m_staticY = staticY; }
 
     bool hasTransform() const { return renderer()->hasTransform(); }
     // Note that this transform has the transform-origin baked in.
@@ -399,6 +409,7 @@ public:
     // resulting transform has transform-origin baked in. If the layer does not have a transform,
     // returns the identity matrix.
     TransformationMatrix currentTransform() const;
+    TransformationMatrix renderableTransform(PaintBehavior) const;
     
     // Get the perspective transform, which is applied to transformed sublayers.
     // Returns true if the layer has a -webkit-perspective.
@@ -426,14 +437,14 @@ public:
     bool hasCompositedMask() const { return false; }
 #endif
 
-    bool paintsWithTransparency() const
+    bool paintsWithTransparency(PaintBehavior paintBehavior) const
     {
-        return isTransparent() && !isComposited();
+        return isTransparent() && ((paintBehavior & PaintBehaviorFlattenCompositingLayers) || !isComposited());
     }
 
-    bool paintsWithTransform() const
+    bool paintsWithTransform(PaintBehavior paintBehavior) const
     {
-        return transform() && !isComposited();
+        return transform() && ((paintBehavior & PaintBehaviorFlattenCompositingLayers) || !isComposited());
     }
 
 private:
@@ -465,7 +476,7 @@ private:
     typedef unsigned PaintLayerFlags;
 
     void paintLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect,
-                    PaintRestriction, RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* = 0,
+                    PaintBehavior, RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* = 0,
                     PaintLayerFlags paintFlags = 0);
 
     RenderLayer* hitTestLayer(RenderLayer* rootLayer, RenderLayer* containerLayer, const HitTestRequest& request, HitTestResult& result,
@@ -644,6 +655,9 @@ protected:
     RenderScrollbarPart* m_scrollCorner;
     RenderScrollbarPart* m_resizer;
 
+private:
+    IntRect m_blockSelectionGapsBounds;
+
 #if USE(ACCELERATED_COMPOSITING)
     OwnPtr<RenderLayerBacking> m_backing;
 #endif
@@ -651,4 +665,9 @@ protected:
 
 } // namespace WebCore
 
+#ifndef NDEBUG
+// Outside the WebCore namespace for ease of invocation from gdb.
+void showLayerTree(const WebCore::RenderLayer* layer);
+#endif
+
 #endif // RenderLayer_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
index d7248d49f0..b5f74c6710 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
@@ -28,7 +28,9 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "AnimationController.h"
-#include "CanvasRenderingContext3D.h"
+#if ENABLE(3D_CANVAS)    
+#include "WebGLRenderingContext.h"
+#endif
 #include "CSSPropertyNames.h"
 #include "CSSStyleSelector.h"
 #include "FrameView.h"
@@ -36,12 +38,18 @@
 #include "GraphicsLayer.h"
 #include "HTMLCanvasElement.h"
 #include "HTMLElement.h"
+#include "HTMLMediaElement.h"
 #include "HTMLNames.h"
+#include "InspectorTimelineAgent.h"
+#include "KeyframeList.h"
+#include "PluginWidget.h"
 #include "RenderBox.h"
 #include "RenderImage.h"
 #include "RenderLayerCompositor.h"
+#include "RenderEmbeddedObject.h"
 #include "RenderVideo.h"
 #include "RenderView.h"
+#include "Settings.h"
 
 #include "RenderLayerBacking.h"
 
@@ -52,12 +60,22 @@ namespace WebCore {
 using namespace HTMLNames;
 
 static bool hasBorderOutlineOrShadow(const RenderStyle*);
-static bool hasBoxDecorations(const RenderStyle*);
-static bool hasBoxDecorationsWithBackgroundImage(const RenderStyle*);
+static bool hasBoxDecorationsOrBackground(const RenderStyle*);
+static bool hasBoxDecorationsOrBackgroundImage(const RenderStyle*);
+
+static inline bool is3DCanvas(RenderObject* renderer)
+{
+#if ENABLE(3D_CANVAS)    
+    if (renderer->isCanvas())
+        return static_cast<HTMLCanvasElement*>(renderer->node())->is3D();
+#else
+    UNUSED_PARAM(renderer);
+#endif
+    return false;
+}
 
 RenderLayerBacking::RenderLayerBacking(RenderLayer* layer)
     : m_owningLayer(layer)
-    , m_hasDirectlyCompositedContent(false)
     , m_artificiallyInflatedBounds(false)
 {
     createGraphicsLayer();
@@ -81,11 +99,13 @@ void RenderLayerBacking::createGraphicsLayer()
             m_graphicsLayer->setName("Document Node");
         else {
             if (renderer()->node()->isHTMLElement() && renderer()->node()->hasID())
-                m_graphicsLayer->setName(renderer()->renderName() + String(" ") + static_cast<HTMLElement*>(renderer()->node())->getAttribute(idAttr));
+                m_graphicsLayer->setName(renderer()->renderName() + String(" ") + static_cast<HTMLElement*>(renderer()->node())->getIDAttribute());
             else
                 m_graphicsLayer->setName(renderer()->renderName());
         }
-    } else
+    } else if (m_owningLayer->isReflection())
+        m_graphicsLayer->setName("Reflection");
+    else
         m_graphicsLayer->setName("Anonymous Node");
 #endif  // NDEBUG
 
@@ -181,29 +201,35 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
     if (updateMaskLayer(m_owningLayer->renderer()->hasMask()))
         m_graphicsLayer->setMaskLayer(m_maskLayer.get());
 
-    m_hasDirectlyCompositedContent = false;
-    if (canUseDirectCompositing()) {
-        if (renderer()->isImage()) {
-            updateImageContents();
-            m_hasDirectlyCompositedContent = true;
-            m_graphicsLayer->setDrawsContent(false);
-        }
-#if ENABLE(3D_CANVAS)    
-        else if (renderer()->isCanvas()) {
-            HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer()->node());
-            if (canvas->is3D()) {
-                CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(canvas->renderingContext());
-                if (context->graphicsContext3D()->platformGraphicsContext3D())
-                    m_graphicsLayer->setContentsToGraphicsContext3D(context->graphicsContext3D());
-            }
+    if (m_owningLayer->hasReflection()) {
+        if (m_owningLayer->reflectionLayer()->backing()) {
+            GraphicsLayer* reflectionLayer = m_owningLayer->reflectionLayer()->backing()->graphicsLayer();
+            m_graphicsLayer->setReplicatedByLayer(reflectionLayer);
         }
-#endif
+    } else
+        m_graphicsLayer->setReplicatedByLayer(0);
+
+    if (isDirectlyCompositedImage())
+        updateImageContents();
 
-        if (rendererHasBackground())
-            m_graphicsLayer->setBackgroundColor(rendererBackgroundColor());
-        else
-            m_graphicsLayer->clearBackgroundColor();
+    if (renderer()->isEmbeddedObject() && toRenderEmbeddedObject(renderer())->allowsAcceleratedCompositing()) {
+        PluginWidget* pluginWidget = static_cast<PluginWidget*>(toRenderEmbeddedObject(renderer())->widget());
+        m_graphicsLayer->setContentsToMedia(pluginWidget->platformLayer());
+    }
+#if ENABLE(VIDEO)
+    else if (renderer()->isVideo()) {
+        HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(renderer()->node());
+        m_graphicsLayer->setContentsToMedia(mediaElement->platformLayer());
     }
+#endif
+#if ENABLE(3D_CANVAS)    
+    else if (is3DCanvas(renderer())) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer()->node());
+        WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(canvas->renderingContext());
+        if (context->graphicsContext3D()->platformGraphicsContext3D())
+            m_graphicsLayer->setContentsToGraphicsContext3D(context->graphicsContext3D());
+    }
+#endif
 
     return layerConfigChanged;
 }
@@ -224,7 +250,7 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
         updateLayerOpacity(renderer()->style());
     
     RenderStyle* style = renderer()->style();
-    m_graphicsLayer->setPreserves3D(style->transformStyle3D() == TransformStyle3DPreserve3D);
+    m_graphicsLayer->setPreserves3D(style->transformStyle3D() == TransformStyle3DPreserve3D && !renderer()->hasReflection());
     m_graphicsLayer->setBackfaceVisibility(style->backfaceVisibility() == BackfaceVisibilityVisible);
 
     RenderLayer* compAncestor = m_owningLayer->ancestorCompositingLayer();
@@ -345,9 +371,19 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
         m_foregroundLayer->setOffsetFromRenderer(foregroundOffset);
     }
 
+    if (m_owningLayer->reflectionLayer() && m_owningLayer->reflectionLayer()->isComposited()) {
+        RenderLayerBacking* reflectionBacking = m_owningLayer->reflectionLayer()->backing();
+        reflectionBacking->updateGraphicsLayerGeometry();
+        
+        // The reflection layer has the bounds of m_owningLayer->reflectionLayer(),
+        // but the reflected layer is the bounds of this layer, so we need to position it appropriately.
+        FloatRect layerBounds = compositedBounds();
+        FloatRect reflectionLayerBounds = reflectionBacking->compositedBounds();
+        reflectionBacking->graphicsLayer()->setReplicatedLayerPosition(FloatPoint() + (layerBounds.location() - reflectionLayerBounds.location()));
+    }
+
     m_graphicsLayer->setContentsRect(contentsBox());
-    if (!m_hasDirectlyCompositedContent)
-        m_graphicsLayer->setDrawsContent(!isSimpleContainerCompositingLayer() && !paintingGoesToWindow() && !m_artificiallyInflatedBounds);
+    m_graphicsLayer->setDrawsContent(containsPaintedContent());
 }
 
 void RenderLayerBacking::updateInternalHierarchy()
@@ -388,7 +424,7 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
     
     if (needsDescendantClip) {
         if (!m_clippingLayer) {
-            m_clippingLayer = GraphicsLayer::create(0);
+            m_clippingLayer = GraphicsLayer::create(this);
 #ifndef NDEBUG
             m_clippingLayer->setName("Child clipping Layer");
 #endif
@@ -493,12 +529,12 @@ static bool hasBorderOutlineOrShadow(const RenderStyle* style)
     return style->hasBorder() || style->hasBorderRadius() || style->hasOutline() || style->hasAppearance() || style->boxShadow();
 }
 
-static bool hasBoxDecorations(const RenderStyle* style)
+static bool hasBoxDecorationsOrBackground(const RenderStyle* style)
 {
     return hasBorderOutlineOrShadow(style) || style->hasBackground();
 }
 
-static bool hasBoxDecorationsWithBackgroundImage(const RenderStyle* style)
+static bool hasBoxDecorationsOrBackgroundImage(const RenderStyle* style)
 {
     return hasBorderOutlineOrShadow(style) || style->hasBackgroundImage();
 }
@@ -558,7 +594,7 @@ bool RenderLayerBacking::isSimpleContainerCompositingLayer() const
     // Reject anything that has a border, a border-radius or outline,
     // or any background (color or image).
     // FIXME: we could optimize layers for simple backgrounds.
-    if (hasBoxDecorations(style))
+    if (hasBoxDecorationsOrBackground(style))
         return false;
 
     // If we have got this far and the renderer has no children, then we're ok.
@@ -575,7 +611,7 @@ bool RenderLayerBacking::isSimpleContainerCompositingLayer() const
         
         // Reject anything that has a border, a border-radius or outline,
         // or is not a simple background (no background, or solid color).
-        if (hasBoxDecorationsWithBackgroundImage(style))
+        if (hasBoxDecorationsOrBackgroundImage(style))
             return false;
         
         // Now look at the body's renderer.
@@ -586,7 +622,7 @@ bool RenderLayerBacking::isSimpleContainerCompositingLayer() const
         
         style = bodyObject->style();
         
-        if (hasBoxDecorationsWithBackgroundImage(style))
+        if (hasBoxDecorationsOrBackgroundImage(style))
             return false;
 
         // Ceck to see if all the body's children are compositing layers.
@@ -603,9 +639,11 @@ bool RenderLayerBacking::isSimpleContainerCompositingLayer() const
     return true;
 }
 
+// Conservative test for having no rendered children.
 bool RenderLayerBacking::hasNonCompositingContent() const
 {
-    // Conservative test for having no rendered children.
+    if (m_owningLayer->hasOverflowControls())
+        return true;
     
     // Some HTML can cause whitespace text nodes to have renderers, like:
     // <div>
@@ -622,7 +660,6 @@ bool RenderLayerBacking::hasNonCompositingContent() const
         }
     }
 
-    // FIXME: test for overflow controls.
     if (m_owningLayer->isStackingContext()) {
         // Use the m_hasCompositingDescendant bit to optimize?
         if (Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList()) {
@@ -656,51 +693,43 @@ bool RenderLayerBacking::hasNonCompositingContent() const
     return false;
 }
 
-// A layer can use direct compositing if the render layer's object is a replaced object and has no children.
-// This allows the GraphicsLayer to display the RenderLayer contents directly; it's used for images.
-bool RenderLayerBacking::canUseDirectCompositing() const
+bool RenderLayerBacking::containsPaintedContent() const
 {
-    RenderObject* renderObject = renderer();
-    
-    // Canvas3D is always direct composited
-#if ENABLE(3D_CANVAS)    
-    if (renderer()->isCanvas()) {
-        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer()->node());
-        return canvas->is3D();
-    }
-#endif
-
-    // Reject anything that isn't an image
-    if (!renderObject->isImage() && !renderObject->isVideo())
+    if (isSimpleContainerCompositingLayer() || paintingGoesToWindow() || m_artificiallyInflatedBounds || m_owningLayer->isReflection())
         return false;
-    
-    if (renderObject->hasMask() || renderObject->hasReflection())
+
+    if (isDirectlyCompositedImage())
         return false;
 
-    // Video can use an inner layer even if it has box decorations; we draw those into another layer.
-    if (renderObject->isVideo())
-        return true;
-    
-    // Reject anything that would require the image to be drawn via the GraphicsContext,
-    // like border, shadows etc. Solid background color is OK.
-    return !hasBoxDecorationsWithBackgroundImage(renderObject->style());
+    // FIXME: we could optimize cases where the image, video or canvas is known to fill the border box entirely,
+    // and set background color on the layer in that case, instead of allocating backing store and painting.
+    if (renderer()->isVideo() || is3DCanvas(renderer()))
+        return hasBoxDecorationsOrBackground(renderer()->style());
+
+    return true;
 }
-    
+
+// An image can be directly compositing if it's the sole content of the layer, and has no box decorations
+// that require painting. Direct compositing saves backing store.
+bool RenderLayerBacking::isDirectlyCompositedImage() const
+{
+    RenderObject* renderObject = renderer();
+    return renderObject->isImage() && !hasBoxDecorationsOrBackground(renderObject->style());
+}
+
 void RenderLayerBacking::rendererContentChanged()
 {
-    if (canUseDirectCompositing()) {
-        if (renderer()->isImage())
-            updateImageContents();
-        else {
+    if (isDirectlyCompositedImage()) {
+        updateImageContents();
+        return;
+    }
+
 #if ENABLE(3D_CANVAS)    
-            if (renderer()->isCanvas()) {
-                HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer()->node());
-                if (canvas->is3D())
-                    m_graphicsLayer->setGraphicsContext3DNeedsDisplay();
-            }
-#endif
-        }
+    if (is3DCanvas(renderer())) {
+        m_graphicsLayer->setGraphicsContext3DNeedsDisplay();
+        return;
     }
+#endif
 }
 
 void RenderLayerBacking::updateImageContents()
@@ -849,7 +878,7 @@ static void restoreClip(GraphicsContext* p, const IntRect& paintDirtyRect, const
 // Share this with RenderLayer::paintLayer, which would have to be educated about GraphicsLayerPaintingPhase?
 void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext* context,
                     const IntRect& paintDirtyRect,      // in the coords of rootLayer
-                    PaintRestriction paintRestriction, GraphicsLayerPaintingPhase paintingPhase,
+                    PaintBehavior paintBehavior, GraphicsLayerPaintingPhase paintingPhase,
                     RenderObject* paintingRoot)
 {
     if (paintingGoesToWindow()) {
@@ -859,14 +888,6 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
     
     m_owningLayer->updateLayerListsIfNeeded();
     
-    // Paint the reflection first if we have one.
-    if (m_owningLayer->hasReflection()) {
-        // Mark that we are now inside replica painting.
-        m_owningLayer->setPaintingInsideReflection(true);
-        m_owningLayer->reflectionLayer()->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot, 0, RenderLayer::PaintLayerPaintingReflection);
-        m_owningLayer->setPaintingInsideReflection(false);
-    }
-
     // Calculate the clip rects we should use.
     IntRect layerBounds, damageRect, clipRectToApply, outlineRect;
     m_owningLayer->calculateRects(rootLayer, paintDirtyRect, layerBounds, damageRect, clipRectToApply, outlineRect);
@@ -899,9 +920,9 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
             
             int rw;
             int rh;
-            if (box->view()->frameView()) {
-                rw = box->view()->frameView()->contentsWidth();
-                rh = box->view()->frameView()->contentsHeight();
+            if (FrameView* frameView = box->view()->frameView()) {
+                rw = frameView->contentsWidth();
+                rh = frameView->contentsHeight();
             } else {
                 rw = box->view()->width();
                 rh = box->view()->height();
@@ -930,8 +951,8 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         restoreClip(context, paintDirtyRect, damageRect);
     }
                 
-    bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
-    bool selectionOnly  = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+    bool forceBlackText = paintBehavior & PaintBehaviorForceBlackText;
+    bool selectionOnly  = paintBehavior & PaintBehaviorSelectionOnly;
 
     if (shouldPaint && (paintingPhase & GraphicsLayerPaintForeground)) {
         // Now walk the sorted list of children with negative z-indices. Only RenderLayers without compositing layers will paint.
@@ -939,7 +960,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList();
         if (negZOrderList) {
             for (Vector<RenderLayer*>::iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it)
-                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
+                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot);
         }
 
         // Set up the clip used when painting our children.
@@ -975,14 +996,14 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         Vector<RenderLayer*>* normalFlowList = m_owningLayer->normalFlowList();
         if (normalFlowList) {
             for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it)
-                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
+                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot);
         }
 
         // Now walk the sorted list of children with positive z-indices.
         Vector<RenderLayer*>* posZOrderList = m_owningLayer->posZOrderList();
         if (posZOrderList) {
             for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it)
-                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
+                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot);
         }
     }
     
@@ -1002,9 +1023,27 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
     ASSERT(!m_owningLayer->m_usedTransparency);
 }
 
+#if ENABLE(INSPECTOR)
+static InspectorTimelineAgent* inspectorTimelineAgent(RenderObject* renderer)
+{
+    Frame* frame = renderer->document()->frame();
+    if (!frame)
+        return 0;
+    Page* page = frame->page();
+    if (!page)
+        return 0;
+    return page->inspectorTimelineAgent();
+}
+#endif
+
 // Up-call from compositing layer drawing callback.
 void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
 {
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent(m_owningLayer->renderer()))
+        timelineAgent->willPaint(clip);
+#endif
+
     // We have to use the same root as for hit testing, because both methods
     // can compute and cache clipRects.
     IntRect enclosingBBox = compositedBounds();
@@ -1021,10 +1060,25 @@ void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& co
     IntRect dirtyRect = enclosingBBox;
     dirtyRect.intersect(clipRect);
 
-    paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintRestrictionNone, paintingPhase, renderer());
+    paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintBehaviorNormal, paintingPhase, renderer());
+
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent(m_owningLayer->renderer()))
+        timelineAgent->didPaint();
+#endif
+}
+
+bool RenderLayerBacking::showDebugBorders() const
+{
+    return compositor() ? compositor()->showDebugBorders() : false;
+}
+
+bool RenderLayerBacking::showRepaintCounter() const
+{
+    return compositor() ? compositor()->showRepaintCounter() : false;
 }
 
-bool RenderLayerBacking::startAnimation(double beginTime, const Animation* anim, const KeyframeList& keyframes)
+bool RenderLayerBacking::startAnimation(double timeOffset, const Animation* anim, const KeyframeList& keyframes)
 {
     bool hasOpacity = keyframes.containsProperty(CSSPropertyOpacity);
     bool hasTransform = keyframes.containsProperty(CSSPropertyWebkitTransform);
@@ -1055,10 +1109,10 @@ bool RenderLayerBacking::startAnimation(double beginTime, const Animation* anim,
     bool didAnimateTransform = !hasTransform;
     bool didAnimateOpacity = !hasOpacity;
     
-    if (hasTransform && m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), anim, keyframes.animationName(), beginTime))
+    if (hasTransform && m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), anim, keyframes.animationName(), timeOffset))
         didAnimateTransform = true;
 
-    if (hasOpacity && m_graphicsLayer->addAnimation(opacityVector, IntSize(), anim, keyframes.animationName(), beginTime))
+    if (hasOpacity && m_graphicsLayer->addAnimation(opacityVector, IntSize(), anim, keyframes.animationName(), timeOffset))
         didAnimateOpacity = true;
     
     bool runningAcceleratedAnimation = didAnimateTransform && didAnimateOpacity;
@@ -1068,7 +1122,7 @@ bool RenderLayerBacking::startAnimation(double beginTime, const Animation* anim,
     return runningAcceleratedAnimation;
 }
 
-bool RenderLayerBacking::startTransition(double beginTime, int property, const RenderStyle* fromStyle, const RenderStyle* toStyle)
+bool RenderLayerBacking::startTransition(double timeOffset, int property, const RenderStyle* fromStyle, const RenderStyle* toStyle)
 {
     bool didAnimate = false;
     ASSERT(property != cAnimateAll);
@@ -1080,7 +1134,7 @@ bool RenderLayerBacking::startTransition(double beginTime, int property, const R
             opacityVector.insert(new FloatAnimationValue(0, compositingOpacity(fromStyle->opacity())));
             opacityVector.insert(new FloatAnimationValue(1, compositingOpacity(toStyle->opacity())));
             // The boxSize param is only used for transform animations (which can only run on RenderBoxes), so we pass an empty size here.
-            if (m_graphicsLayer->addAnimation(opacityVector, IntSize(), opacityAnim, String(), beginTime)) {
+            if (m_graphicsLayer->addAnimation(opacityVector, IntSize(), opacityAnim, String(), timeOffset)) {
                 // To ensure that the correct opacity is visible when the animation ends, also set the final opacity.
                 updateLayerOpacity(toStyle);
                 didAnimate = true;
@@ -1094,7 +1148,7 @@ bool RenderLayerBacking::startTransition(double beginTime, int property, const R
             KeyframeValueList transformVector(AnimatedPropertyWebkitTransform);
             transformVector.insert(new TransformAnimationValue(0, &fromStyle->transform()));
             transformVector.insert(new TransformAnimationValue(1, &toStyle->transform()));
-            if (m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), transformAnim, String(), beginTime)) {
+            if (m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), transformAnim, String(), timeOffset)) {
                 // To ensure that the correct transform is visible when the animation ends, also set the final opacity.
                 updateLayerTransform(toStyle);
                 didAnimate = true;
@@ -1124,9 +1178,9 @@ void RenderLayerBacking::animationFinished(const String& animationName)
     m_graphicsLayer->removeAnimationsForKeyframes(animationName);
 }
 
-void RenderLayerBacking::animationPaused(const String& animationName)
+void RenderLayerBacking::animationPaused(double timeOffset, const String& animationName)
 {
-    m_graphicsLayer->pauseAnimation(animationName);
+    m_graphicsLayer->pauseAnimation(animationName, timeOffset);
 }
 
 void RenderLayerBacking::transitionFinished(int property)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h
index 17bcaf707f..a6907e7f5e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h
@@ -46,7 +46,7 @@ class RenderLayerCompositor;
 // 
 // There is one RenderLayerBacking for each RenderLayer that is composited.
 
-class RenderLayerBacking : public GraphicsLayerClient {
+class RenderLayerBacking : public GraphicsLayerClient, public Noncopyable {
 public:
     RenderLayerBacking(RenderLayer*);
     ~RenderLayerBacking();
@@ -97,10 +97,10 @@ public:
     void rendererContentChanged();
 
     // Interface to start, finish, suspend and resume animations and transitions
-    bool startAnimation(double beginTime, const Animation* anim, const KeyframeList& keyframes);
-    bool startTransition(double beginTime, int property, const RenderStyle* fromStyle, const RenderStyle* toStyle);
+    bool startAnimation(double timeOffset, const Animation* anim, const KeyframeList& keyframes);
+    bool startTransition(double timeOffset, int property, const RenderStyle* fromStyle, const RenderStyle* toStyle);
     void animationFinished(const String& name);
-    void animationPaused(const String& name);
+    void animationPaused(double timeOffset, const String& name);
     void transitionFinished(int property);
 
     void suspendAnimations(double time = 0);
@@ -119,6 +119,9 @@ public:
 
     virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& clip);
 
+    virtual bool showDebugBorders() const;
+    virtual bool showRepaintCounter() const;
+
     IntRect contentsBox() const;
     
 private:
@@ -146,12 +149,12 @@ private:
     // Return the opacity value that this layer should use for compositing.
     float compositingOpacity(float rendererOpacity) const;
     
-    // Returns true if this RenderLayer only has content that can be rendered directly
-    // by the compositing layer, without drawing (e.g. solid background color).
+    // Returns true if this compositing layer has no visible content.
     bool isSimpleContainerCompositingLayer() const;
-    // Returns true if we can optimize the RenderLayer to draw the replaced content
-    // directly into a compositing buffer
-    bool canUseDirectCompositing() const;
+    // Returns true if this layer has content that needs to be rendered by painting into the backing store.
+    bool containsPaintedContent() const;
+    // Returns true if the RenderLayer just contains an image that we can composite directly.
+    bool isDirectlyCompositedImage() const;
     void updateImageContents();
 
     bool rendererHasBackground() const;
@@ -160,7 +163,7 @@ private:
     bool hasNonCompositingContent() const;
     
     void paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect,
-                    PaintRestriction paintRestriction, GraphicsLayerPaintingPhase, RenderObject* paintingRoot);
+                    PaintBehavior paintBehavior, GraphicsLayerPaintingPhase, RenderObject* paintingRoot);
 
     static int graphicsLayerToCSSProperty(AnimatedPropertyID);
     static AnimatedPropertyID cssToGraphicsLayerProperty(int);
@@ -176,7 +179,6 @@ private:
 
     IntRect m_compositedBounds;
 
-    bool m_hasDirectlyCompositedContent;
     bool m_artificiallyInflatedBounds;      // bounds had to be made non-zero to make transform-origin work
 };
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
index 5201287eb9..93af664778 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
@@ -29,6 +29,7 @@
 #include "RenderLayerCompositor.h"
 
 #include "AnimationController.h"
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "CSSPropertyNames.h"
 #include "Frame.h"
@@ -37,7 +38,9 @@
 #include "HitTestResult.h"
 #include "HTMLCanvasElement.h"
 #include "Page.h"
+#include "RenderEmbeddedObject.h"
 #include "RenderLayerBacking.h"
+#include "RenderReplica.h"
 #include "RenderVideo.h"
 #include "RenderView.h"
 #include "Settings.h"
@@ -58,6 +61,8 @@ bool WebCoreHas3DRendering = true;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 struct CompositingState {
     CompositingState(RenderLayer* compAncestor)
         : m_compositingAncestor(compAncestor)
@@ -79,6 +84,8 @@ RenderLayerCompositor::RenderLayerCompositor(RenderView* renderView)
     : m_renderView(renderView)
     , m_rootPlatformLayer(0)
     , m_hasAcceleratedCompositing(true)
+    , m_showDebugBorders(false)
+    , m_showRepaintCounter(false)
     , m_compositingConsultsOverlap(true)
     , m_compositing(false)
     , m_rootLayerAttached(false)
@@ -109,16 +116,24 @@ void RenderLayerCompositor::enableCompositingMode(bool enable /* = true */)
     }
 }
 
-void RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag()
+void RenderLayerCompositor::cacheAcceleratedCompositingFlags()
 {
     bool hasAcceleratedCompositing = false;
-    if (Settings* settings = m_renderView->document()->settings())
+    bool showDebugBorders = false;
+    bool showRepaintCounter = false;
+    
+    if (Settings* settings = m_renderView->document()->settings()) {
         hasAcceleratedCompositing = settings->acceleratedCompositingEnabled();
+        showDebugBorders = settings->showDebugBorders();
+        showRepaintCounter = settings->showRepaintCounter();
+    }
 
-    if (hasAcceleratedCompositing != m_hasAcceleratedCompositing)
+    if (hasAcceleratedCompositing != m_hasAcceleratedCompositing || showDebugBorders != m_showDebugBorders || showRepaintCounter != m_showRepaintCounter)
         setCompositingLayersNeedRebuild();
         
     m_hasAcceleratedCompositing = hasAcceleratedCompositing;
+    m_showDebugBorders = showDebugBorders;
+    m_showRepaintCounter = showRepaintCounter;
 }
 
 void RenderLayerCompositor::setCompositingLayersNeedRebuild(bool needRebuild)
@@ -137,16 +152,30 @@ void RenderLayerCompositor::scheduleSync()
     page->chrome()->client()->scheduleCompositingLayerSync();
 }
 
-void RenderLayerCompositor::updateCompositingLayers(RenderLayer* updateRoot)
+void RenderLayerCompositor::updateCompositingLayers(CompositingUpdateType updateType, RenderLayer* updateRoot)
 {
-    // When m_compositingConsultsOverlap is true, then layer positions affect compositing,
-    // so we can only bail here when we're not looking at overlap.
-    if (!m_compositingLayersNeedRebuild && !m_compositingConsultsOverlap)
+    bool checkForHierarchyUpdate = false;
+    bool needGeometryUpdate = false;
+    
+    switch (updateType) {
+    case CompositingUpdateAfterLayoutOrStyleChange:
+    case CompositingUpdateOnPaitingOrHitTest:
+        checkForHierarchyUpdate = true;
+        break;
+    case CompositingUpdateOnScroll:
+        if (m_compositingConsultsOverlap)
+            checkForHierarchyUpdate = true; // Overlap can change with scrolling, so need to check for hierarchy updates.
+
+        needGeometryUpdate = true;
+        break;
+    }
+
+    if (!checkForHierarchyUpdate && !needGeometryUpdate)
         return;
 
     ASSERT(inCompositingMode());
 
-    bool needLayerRebuild = m_compositingLayersNeedRebuild;
+    bool needHierarchyUpdate = m_compositingLayersNeedRebuild;
     if (!updateRoot) {
         // Only clear the flag if we're updating the entire hierarchy.
         m_compositingLayersNeedRebuild = false;
@@ -159,26 +188,38 @@ void RenderLayerCompositor::updateCompositingLayers(RenderLayer* updateRoot)
     double startTime = WTF::currentTime();
 #endif        
 
-    // Go through the layers in presentation order, so that we can compute which
-    // RLs need compositing layers.
-    // FIXME: we could maybe do this in one pass, but the parenting logic would be more
-    // complex.
-    {
+    if (checkForHierarchyUpdate) {
+        // Go through the layers in presentation order, so that we can compute which RenderLayers need compositing layers.
+        // FIXME: we could maybe do this and the hierarchy udpate in one pass, but the parenting logic would be more complex.
         CompositingState compState(updateRoot);
-        bool layersChanged;
+        bool layersChanged = false;
         if (m_compositingConsultsOverlap) {
             OverlapMap overlapTestRequestMap;
             computeCompositingRequirements(updateRoot, &overlapTestRequestMap, compState, layersChanged);
         } else
             computeCompositingRequirements(updateRoot, 0, compState, layersChanged);
         
-        needLayerRebuild |= layersChanged;
+        needHierarchyUpdate |= layersChanged;
     }
 
-    // Now create and parent the compositing layers.
-    {
+    if (needHierarchyUpdate) {
+        // Update the hierarchy of the compositing layers.
         CompositingState compState(updateRoot);
-        rebuildCompositingLayerTree(updateRoot, compState, needLayerRebuild);
+        Vector<GraphicsLayer*> childList;
+        rebuildCompositingLayerTree(updateRoot, compState, childList);
+
+        // Host the document layer in the RenderView's root layer.
+        if (updateRoot == rootRenderLayer()) {
+            if (childList.isEmpty()) {
+                willMoveOffscreen();
+                m_rootPlatformLayer = 0;
+            } else
+                m_rootPlatformLayer->setChildren(childList);
+        }
+    } else if (needGeometryUpdate) {
+        // We just need to do a geometry update. This is only used for position:fixed scrolling;
+        // most of the time, geometry is updated via RenderLayer::styleChanged().
+        updateLayerTreeGeometry(updateRoot);
     }
     
 #if PROFILE_LAYER_REBUILD
@@ -215,6 +256,17 @@ bool RenderLayerCompositor::updateBacking(RenderLayer* layer, CompositingChangeR
         }
     } else {
         if (layer->backing()) {
+            // If we're removing backing on a reflection, clear the source GraphicsLayer's pointer to
+            // its replica GraphicsLayer. In practice this should never happen because reflectee and reflection 
+            // are both either composited, or not composited.
+            if (layer->isReflection()) {
+                RenderLayer* sourceLayer = toRenderBoxModelObject(layer->renderer()->parent())->layer();
+                if (RenderLayerBacking* backing = sourceLayer->backing()) {
+                    ASSERT(backing->graphicsLayer()->replicaLayer() == layer->backing()->graphicsLayer());
+                    backing->graphicsLayer()->setReplicatedByLayer(0);
+                }
+            }
+            
             layer->clearBacking();
             layerChanged = true;
 
@@ -328,7 +380,7 @@ IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* laye
         }
     }
 
-    if (layer->paintsWithTransform()) {
+    if (layer->paintsWithTransform(PaintBehaviorNormal)) {
         TransformationMatrix* affineTrans = layer->transform();
         boundingBoxRect = affineTrans->mapRect(boundingBoxRect);
         unionBounds = affineTrans->mapRect(unionBounds);
@@ -391,6 +443,9 @@ void RenderLayerCompositor::addToOverlapMap(OverlapMap& overlapMap, RenderLayer*
 
     if (!boundsComputed) {
         layerBounds = layer->renderer()->localToAbsoluteQuad(FloatRect(layer->localBoundingBox())).enclosingBoundingBox();
+        // Empty rects never intersect, but we need them to for the purposes of overlap testing.
+        if (layerBounds.isEmpty())
+            layerBounds.setSize(IntSize(1, 1));
         boundsComputed = true;
     }
 
@@ -434,6 +489,9 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     if (overlapMap && !overlapMap->isEmpty()) {
         // If we're testing for overlap, we only need to composite if we overlap something that is already composited.
         absBounds = layer->renderer()->localToAbsoluteQuad(FloatRect(layer->localBoundingBox())).enclosingBoundingBox();
+        // Empty rects never intersect, but we need them to for the purposes of overlap testing.
+        if (absBounds.isEmpty())
+            absBounds.setSize(IntSize(1, 1));
         haveComputedBounds = true;
         mustOverlapCompositedLayers = overlapsCompositedLayers(*overlapMap, absBounds);
     }
@@ -448,7 +506,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     ++childState.m_depth;
 #endif
 
-    const bool willBeComposited = needsToBeComposited(layer);
+    bool willBeComposited = needsToBeComposited(layer);
     if (willBeComposited) {
         // Tell the parent it has compositing descendants.
         compositingState.m_subtreeIsCompositing = true;
@@ -476,7 +534,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
 
                 // If we have to make a layer for this child, make one now so we can have a contents layer
                 // (since we need to ensure that the -ve z-order child renders underneath our contents).
-                if (childState.m_subtreeIsCompositing) {
+                if (!willBeComposited && childState.m_subtreeIsCompositing) {
                     // make layer compositing
                     layer->setMustOverlapCompositedLayers(true);
                     childState.m_compositingAncestor = layer;
@@ -509,28 +567,50 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     // If we have a software transform, and we have layers under us, we need to also
     // be composited. Also, if we have opacity < 1, then we need to be a layer so that
     // the child layers are opaque, then rendered with opacity on this layer.
-    if (childState.m_subtreeIsCompositing && requiresCompositingWhenDescendantsAreCompositing(layer->renderer())) {
+    if (!willBeComposited && childState.m_subtreeIsCompositing && requiresCompositingWhenDescendantsAreCompositing(layer->renderer())) {
         layer->setMustOverlapCompositedLayers(true);
         if (overlapMap)
             addToOverlapMap(*overlapMap, layer, absBounds, haveComputedBounds);
+        willBeComposited = true;
     }
 
+    ASSERT(willBeComposited == needsToBeComposited(layer));
+    if (layer->reflectionLayer())
+        layer->reflectionLayer()->setMustOverlapCompositedLayers(willBeComposited);
+
     // Subsequent layers in the parent stacking context also need to composite.
     if (childState.m_subtreeIsCompositing)
         compositingState.m_subtreeIsCompositing = true;
 
-    // If the layer is going into compositing mode, repaint its old location.
-    if (!layer->isComposited() && needsToBeComposited(layer))
-        repaintOnCompositingChange(layer);
-
     // Set the flag to say that this SC has compositing children.
-    // this can affect the answer to needsToBeComposited() when clipping,
-    // but that's ok here.
     layer->setHasCompositingDescendant(childState.m_subtreeIsCompositing);
 
+    // setHasCompositingDescendant() may have changed the answer to needsToBeComposited() when clipping,
+    // so test that again.
+    if (!willBeComposited && clipsCompositingDescendants(layer)) {
+        if (overlapMap)
+            addToOverlapMap(*overlapMap, layer, absBounds, haveComputedBounds);
+        willBeComposited = true;
+    }
+
+    // If we're back at the root, and no other layers need to be composited, and the root layer itself doesn't need
+    // to be composited, then we can drop out of compositing mode altogether.
+    if (layer->isRootLayer() && !childState.m_subtreeIsCompositing && !requiresCompositingLayer(layer)) {
+        m_compositing = false;
+        willBeComposited = false;
+    }
+    
+    // If the layer is going into compositing mode, repaint its old location.
+    ASSERT(willBeComposited == needsToBeComposited(layer));
+    if (!layer->isComposited() && willBeComposited)
+        repaintOnCompositingChange(layer);
+
     // Update backing now, so that we can use isComposited() reliably during tree traversal in rebuildCompositingLayerTree().
     if (updateBacking(layer, CompositingChangeRepaintNow))
         layersChanged = true;
+
+    if (layer->reflectionLayer() && updateLayerCompositingState(layer->reflectionLayer(), CompositingChangeRepaintNow))
+        layersChanged = true;
 }
 
 void RenderLayerCompositor::setCompositingParent(RenderLayer* childLayer, RenderLayer* parentLayer)
@@ -577,39 +657,41 @@ void RenderLayerCompositor::parentInRootLayer(RenderLayer* layer)
 #if ENABLE(VIDEO)
 bool RenderLayerCompositor::canAccelerateVideoRendering(RenderVideo* o) const
 {
-    // FIXME: ideally we need to look at all ancestors for mask or video. But for now,
-    // just bail on the obvious cases.
-    if (o->hasReflection() || !m_hasAcceleratedCompositing)
+    if (!m_hasAcceleratedCompositing)
         return false;
 
     return o->supportsAcceleratedRendering();
 }
 #endif
 
-void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, struct CompositingState& compositingState, bool updateHierarchy)
+void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, const CompositingState& compositingState, Vector<GraphicsLayer*>& childLayersOfEnclosingLayer)
 {
     // Make the layer compositing if necessary, and set up clipping and content layers.
     // Note that we can only do work here that is independent of whether the descendant layers
     // have been processed. computeCompositingRequirements() will already have done the repaint if necessary.
+    
     RenderLayerBacking* layerBacking = layer->backing();
     if (layerBacking) {
         // The compositing state of all our children has been updated already, so now
         // we can compute and cache the composited bounds for this layer.
         layerBacking->updateCompositedBounds();
+
+        if (RenderLayer* reflection = layer->reflectionLayer()) {
+            if (reflection->backing())
+                reflection->backing()->updateCompositedBounds();
+        }
+
         layerBacking->updateGraphicsLayerConfiguration();
         layerBacking->updateGraphicsLayerGeometry();
 
         if (!layer->parent())
             updateRootLayerPosition();
-
-        // FIXME: make this more incremental
-        if (updateHierarchy)
-            layerBacking->parentForSublayers()->removeAllChildren();
     }
 
-    // host the document layer in the RenderView's root layer
-    if (updateHierarchy && layer->isRootLayer() && layer->isComposited())
-        parentInRootLayer(layer);
+    // If this layer has backing, then we are collecting its children, otherwise appending
+    // to the compositing child list of an enclosing layer.
+    Vector<GraphicsLayer*> layerChildren;
+    Vector<GraphicsLayer*>& childList = layerBacking ? layerChildren : childLayersOfEnclosingLayer;
 
     CompositingState childState = compositingState;
     if (layer->isComposited())
@@ -630,19 +712,13 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
             size_t listSize = negZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = negZOrderList->at(i);
-                rebuildCompositingLayerTree(curLayer, childState, updateHierarchy);
-                if (updateHierarchy && curLayer->isComposited())
-                    setCompositingParent(curLayer, childState.m_compositingAncestor);
+                rebuildCompositingLayerTree(curLayer, childState, childList);
             }
         }
 
-        if (updateHierarchy && layerBacking && layerBacking->foregroundLayer()) {
-            layerBacking->foregroundLayer()->removeFromParent();
-            
-            // The foreground layer has to be correctly sorted with child layers, so needs to become a child of the clipping layer.
-            GraphicsLayer* hostingLayer = layerBacking->parentForSublayers();
-            hostingLayer->addChild(layerBacking->foregroundLayer());
-        }
+        // If a negative z-order child is compositing, we get a foreground layer which needs to get parented.
+        if (layerBacking && layerBacking->foregroundLayer())
+            childList.append(layerBacking->foregroundLayer());
     }
 
     ASSERT(!layer->m_normalFlowListDirty);
@@ -650,9 +726,7 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
         size_t listSize = normalFlowList->size();
         for (size_t i = 0; i < listSize; ++i) {
             RenderLayer* curLayer = normalFlowList->at(i);
-            rebuildCompositingLayerTree(curLayer, childState, updateHierarchy);
-            if (updateHierarchy && curLayer->isComposited())
-                setCompositingParent(curLayer, childState.m_compositingAncestor);
+            rebuildCompositingLayerTree(curLayer, childState, childList);
         }
     }
     
@@ -661,14 +735,62 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
             size_t listSize = posZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = posZOrderList->at(i);
-                rebuildCompositingLayerTree(curLayer, childState, updateHierarchy);
-                if (updateHierarchy && curLayer->isComposited())
-                    setCompositingParent(curLayer, childState.m_compositingAncestor);
+                rebuildCompositingLayerTree(curLayer, childState, childList);
             }
         }
     }
+    
+    if (layerBacking) {
+        layerBacking->parentForSublayers()->setChildren(layerChildren);
+        childLayersOfEnclosingLayer.append(layerBacking->childForSuperlayers());
+    }
 }
 
+// This just updates layer geometry without changing the hierarchy.
+void RenderLayerCompositor::updateLayerTreeGeometry(RenderLayer* layer)
+{
+    if (RenderLayerBacking* layerBacking = layer->backing()) {
+        // The compositing state of all our children has been updated already, so now
+        // we can compute and cache the composited bounds for this layer.
+        layerBacking->updateCompositedBounds();
+
+        if (RenderLayer* reflection = layer->reflectionLayer()) {
+            if (reflection->backing())
+                reflection->backing()->updateCompositedBounds();
+        }
+
+        layerBacking->updateGraphicsLayerConfiguration();
+        layerBacking->updateGraphicsLayerGeometry();
+
+        if (!layer->parent())
+            updateRootLayerPosition();
+    }
+
+    if (layer->isStackingContext()) {
+        ASSERT(!layer->m_zOrderListsDirty);
+
+        if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
+            size_t listSize = negZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i)
+                updateLayerTreeGeometry(negZOrderList->at(i));
+        }
+    }
+
+    ASSERT(!layer->m_normalFlowListDirty);
+    if (Vector<RenderLayer*>* normalFlowList = layer->normalFlowList()) {
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i)
+            updateLayerTreeGeometry(normalFlowList->at(i));
+    }
+    
+    if (layer->isStackingContext()) {
+        if (Vector<RenderLayer*>* posZOrderList = layer->posZOrderList()) {
+            size_t listSize = posZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i)
+                updateLayerTreeGeometry(posZOrderList->at(i));
+        }
+    }
+}
 
 // Recurs down the RenderLayer tree until its finds the compositing descendants of compositingAncestor and updates their geometry.
 void RenderLayerCompositor::updateCompositingDescendantGeometry(RenderLayer* compositingAncestor, RenderLayer* layer, RenderLayerBacking::UpdateDepth updateDepth)
@@ -676,12 +798,21 @@ void RenderLayerCompositor::updateCompositingDescendantGeometry(RenderLayer* com
     if (layer != compositingAncestor) {
         if (RenderLayerBacking* layerBacking = layer->backing()) {
             layerBacking->updateCompositedBounds();
+
+            if (RenderLayer* reflection = layer->reflectionLayer()) {
+                if (reflection->backing())
+                    reflection->backing()->updateCompositedBounds();
+            }
+
             layerBacking->updateGraphicsLayerGeometry();
             if (updateDepth == RenderLayerBacking::CompositingChildren)
                 return;
         }
     }
 
+    if (layer->reflectionLayer())
+        updateCompositingDescendantGeometry(compositingAncestor, layer->reflectionLayer(), updateDepth);
+
     if (!layer->hasCompositingDescendant())
         return;
     
@@ -716,6 +847,7 @@ void RenderLayerCompositor::repaintCompositedLayersAbsoluteRect(const IntRect& a
 
 void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const IntRect& rect)
 {
+    // FIXME: This method does not work correctly with transforms.
     if (layer->isComposited())
         layer->setBackingNeedsRepaintInRect(rect);
 
@@ -724,7 +856,8 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
             size_t listSize = negZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = negZOrderList->at(i);
-                int x = 0, y = 0;
+                int x = 0;
+                int y = 0;
                 curLayer->convertToLayerCoords(layer, x, y);
                 IntRect childRect(rect);
                 childRect.move(-x, -y);
@@ -736,7 +869,8 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
             size_t listSize = posZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = posZOrderList->at(i);
-                int x = 0, y = 0;
+                int x = 0;
+                int y = 0;
                 curLayer->convertToLayerCoords(layer, x, y);
                 IntRect childRect(rect);
                 childRect.move(-x, -y);
@@ -748,7 +882,8 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
         size_t listSize = normalFlowList->size();
         for (size_t i = 0; i < listSize; ++i) {
             RenderLayer* curLayer = normalFlowList->at(i);
-            int x = 0, y = 0;
+            int x = 0;
+            int y = 0;
             curLayer->convertToLayerCoords(layer, x, y);
             IntRect childRect(rect);
             childRect.move(-x, -y);
@@ -819,22 +954,28 @@ bool RenderLayerCompositor::needsToBeComposited(const RenderLayer* layer) const
     if (!m_hasAcceleratedCompositing || !layer->isSelfPaintingLayer())
         return false;
 
-    return requiresCompositingLayer(layer) || layer->mustOverlapCompositedLayers();
+    return requiresCompositingLayer(layer) || layer->mustOverlapCompositedLayers() || (inCompositingMode() && layer->isRootLayer());
 }
 
 // Note: this specifies whether the RL needs a compositing layer for intrinsic reasons.
 // Use needsToBeComposited() to determine if a RL actually needs a compositing layer.
 // static
 bool RenderLayerCompositor::requiresCompositingLayer(const RenderLayer* layer) const
-{    
+{
+    RenderObject* renderer = layer->renderer();
+    // The compositing state of a reflection should match that of its reflected layer.
+    if (layer->isReflection()) {
+        renderer = renderer->parent(); // The RenderReplica's parent is the object being reflected.
+        layer = toRenderBoxModelObject(renderer)->layer();
+    }
     // The root layer always has a compositing layer, but it may not have backing.
-    return (inCompositingMode() && layer->isRootLayer()) ||
-             requiresCompositingForTransform(layer->renderer()) ||
-             requiresCompositingForVideo(layer->renderer()) ||
-             requiresCompositingForCanvas(layer->renderer()) ||
-             layer->renderer()->style()->backfaceVisibility() == BackfaceVisibilityHidden ||
-             clipsCompositingDescendants(layer) ||
-             requiresCompositingForAnimation(layer->renderer());
+    return requiresCompositingForTransform(renderer)
+             || requiresCompositingForVideo(renderer)
+             || requiresCompositingForCanvas(renderer)
+             || requiresCompositingForPlugin(renderer)
+             || renderer->style()->backfaceVisibility() == BackfaceVisibilityHidden
+             || clipsCompositingDescendants(layer)
+             || requiresCompositingForAnimation(renderer);
 }
 
 // Return true if the given layer has some ancestor in the RenderLayer hierarchy that clips,
@@ -897,6 +1038,8 @@ bool RenderLayerCompositor::requiresCompositingForVideo(RenderObject* renderer)
         RenderVideo* video = toRenderVideo(renderer);
         return canAccelerateVideoRendering(video);
     }
+#else
+    UNUSED_PARAM(renderer);
 #endif
     return false;
 }
@@ -914,6 +1057,11 @@ bool RenderLayerCompositor::requiresCompositingForCanvas(RenderObject* renderer)
     return false;
 }
 
+bool RenderLayerCompositor::requiresCompositingForPlugin(RenderObject* renderer) const
+{
+    return renderer->isEmbeddedObject() && toRenderEmbeddedObject(renderer)->allowsAcceleratedCompositing();
+}
+
 bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* renderer) const
 {
     if (AnimationController* animController = renderer->animation()) {
@@ -925,7 +1073,7 @@ bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* render
 
 bool RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing(RenderObject* renderer) const
 {
-    return renderer->hasTransform() || renderer->isTransparent() || renderer->hasMask();
+    return renderer->hasTransform() || renderer->isTransparent() || renderer->hasMask() || renderer->hasReflection();
 }
 
 // If an element has negative z-index children, those children render in front of the 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
index a809a7077a..5f1a178e21 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
@@ -38,6 +38,12 @@ class GraphicsLayer;
 class RenderVideo;
 #endif
 
+enum CompositingUpdateType {
+    CompositingUpdateAfterLayoutOrStyleChange,
+    CompositingUpdateOnPaitingOrHitTest,
+    CompositingUpdateOnScroll
+};
+
 // RenderLayerCompositor manages the hierarchy of
 // composited RenderLayers. It determines which RenderLayers
 // become compositing, and creates and maintains a hierarchy of
@@ -47,7 +53,6 @@ class RenderVideo;
 
 class RenderLayerCompositor {
 public:
-
     RenderLayerCompositor(RenderView*);
     ~RenderLayerCompositor();
     
@@ -61,8 +66,11 @@ public:
     // Returns true if the accelerated compositing is enabled
     bool hasAcceleratedCompositing() const { return m_hasAcceleratedCompositing; }
     
-    // Copy the acceleratedCompositingEnabledFlag from Settings
-    void cacheAcceleratedCompositingEnabledFlag();
+    bool showDebugBorders() const { return m_showDebugBorders; }
+    bool showRepaintCounter() const { return m_showRepaintCounter; }
+    
+    // Copy the accelerated compositing related flags from Settings
+    void cacheAcceleratedCompositingFlags();
 
     // Called when the layer hierarchy needs to be updated (compositing layers have been
     // created, destroyed or re-parented).
@@ -77,7 +85,7 @@ public:
     void scheduleSync();
     
     // Rebuild the tree of compositing layers
-    void updateCompositingLayers(RenderLayer* updateRoot = 0);
+    void updateCompositingLayers(CompositingUpdateType = CompositingUpdateAfterLayoutOrStyleChange, RenderLayer* updateRoot = 0);
 
     // Update the compositing state of the given layer. Returns true if that state changed.
     enum CompositingChangeRepaint { CompositingChangeRepaintNow, CompositingChangeWillRepaintLater };
@@ -147,8 +155,13 @@ private:
 
     // Returns true if any layer's compositing changed
     void computeCompositingRequirements(RenderLayer*, OverlapMap*, struct CompositingState&, bool& layersChanged);
-    void rebuildCompositingLayerTree(RenderLayer* layer, struct CompositingState&, bool updateHierarchy);
+    
+    // Recurses down the tree, parenting descendant compositing layers and collecting an array of child layers for the current compositing layer.
+    void rebuildCompositingLayerTree(RenderLayer* layer, const struct CompositingState&, Vector<GraphicsLayer*>& childGraphicsLayersOfEnclosingLayer);
 
+    // Recurses down the tree, updating layer geometry only.
+    void updateLayerTreeGeometry(RenderLayer*);
+    
     // Hook compositing layers together
     void setCompositingParent(RenderLayer* childLayer, RenderLayer* parentLayer);
     void removeCompositedChildren(RenderLayer*);
@@ -165,12 +178,15 @@ private:
     bool requiresCompositingForTransform(RenderObject*) const;
     bool requiresCompositingForVideo(RenderObject*) const;
     bool requiresCompositingForCanvas(RenderObject*) const;
+    bool requiresCompositingForPlugin(RenderObject*) const;
     bool requiresCompositingWhenDescendantsAreCompositing(RenderObject*) const;
 
 private:
     RenderView* m_renderView;
     OwnPtr<GraphicsLayer> m_rootPlatformLayer;
     bool m_hasAcceleratedCompositing;
+    bool m_showDebugBorders;
+    bool m_showRepaintCounter;
     bool m_compositingConsultsOverlap;
     bool m_compositing;
     bool m_rootLayerAttached;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLineBoxList.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLineBoxList.cpp
index 76a2e2f4ed..9736874983 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLineBoxList.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLineBoxList.cpp
@@ -67,7 +67,7 @@ void RenderLineBoxList::deleteLineBoxTree(RenderArena* arena)
     InlineFlowBox* line = m_firstLineBox;
     InlineFlowBox* nextLine;
     while (line) {
-        nextLine = line->nextFlowBox();
+        nextLine = line->nextLineBox();
         line->deleteLine(arena);
         line = nextLine;
     }
@@ -78,13 +78,13 @@ void RenderLineBoxList::extractLineBox(InlineFlowBox* box)
 {
     checkConsistency();
     
-    m_lastLineBox = box->prevFlowBox();
+    m_lastLineBox = box->prevLineBox();
     if (box == m_firstLineBox)
         m_firstLineBox = 0;
     if (box->prevLineBox())
         box->prevLineBox()->setNextLineBox(0);
     box->setPreviousLineBox(0);
-    for (InlineRunBox* curr = box; curr; curr = curr->nextLineBox())
+    for (InlineFlowBox* curr = box; curr; curr = curr->nextLineBox())
         curr->setExtracted();
 
     checkConsistency();
@@ -100,7 +100,7 @@ void RenderLineBoxList::attachLineBox(InlineFlowBox* box)
     } else
         m_firstLineBox = box;
     InlineFlowBox* last = box;
-    for (InlineFlowBox* curr = box; curr; curr = curr->nextFlowBox()) {
+    for (InlineFlowBox* curr = box; curr; curr = curr->nextLineBox()) {
         curr->setExtracted(false);
         last = curr;
     }
@@ -114,9 +114,9 @@ void RenderLineBoxList::removeLineBox(InlineFlowBox* box)
     checkConsistency();
 
     if (box == m_firstLineBox)
-        m_firstLineBox = box->nextFlowBox();
+        m_firstLineBox = box->nextLineBox();
     if (box == m_lastLineBox)
-        m_lastLineBox = box->prevFlowBox();
+        m_lastLineBox = box->prevLineBox();
     if (box->nextLineBox())
         box->nextLineBox()->setPreviousLineBox(box->prevLineBox());
     if (box->prevLineBox())
@@ -128,8 +128,8 @@ void RenderLineBoxList::removeLineBox(InlineFlowBox* box)
 void RenderLineBoxList::deleteLineBoxes(RenderArena* arena)
 {
     if (m_firstLineBox) {
-        InlineRunBox* next;
-        for (InlineRunBox* curr = m_firstLineBox; curr; curr = next) {
+        InlineFlowBox* next;
+        for (InlineFlowBox* curr = m_firstLineBox; curr; curr = next) {
             next = curr->nextLineBox();
             curr->destroy(arena);
         }
@@ -140,7 +140,7 @@ void RenderLineBoxList::deleteLineBoxes(RenderArena* arena)
 
 void RenderLineBoxList::dirtyLineBoxes()
 {
-    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
+    for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
         curr->dirtyLineBoxes();
 }
 
@@ -177,7 +177,7 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, RenderObject::Pain
     // based off positions of our first line box or our last line box.
     RenderView* v = renderer->view();
     bool usePrintRect = !v->printRect().isEmpty();
-    for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextFlowBox()) {
+    for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
         if (usePrintRect) {
             // FIXME: This is a feeble effort to avoid splitting a line across two pages.
             // It is utterly inadequate, and this should not be done at paint time at all.
@@ -199,6 +199,7 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, RenderObject::Pain
         int bottom = curr->bottomVisibleOverflow() + renderer->maximalOutlineSize(info.phase);
         h = bottom - top;
         yPos = ty + top;
+        v->setMinimumColumnHeight(h);
         if (yPos < info.rect.bottom() && yPos + h > info.rect.y())
             curr->paint(info, tx, ty);
     }
@@ -235,7 +236,7 @@ bool RenderLineBoxList::hitTest(RenderBoxModelObject* renderer, const HitTestReq
     // See if our root lines contain the point.  If so, then we hit test
     // them further.  Note that boxes can easily overlap, so we can't make any assumptions
     // based off positions of our first line box or our last line box.
-    for (InlineFlowBox* curr = lastLineBox(); curr; curr = curr->prevFlowBox()) {
+    for (InlineFlowBox* curr = lastLineBox(); curr; curr = curr->prevLineBox()) {
         if (y >= ty + curr->root()->topVisibleOverflow() && y < ty + curr->root()->bottomVisibleOverflow()) {
             bool inside = curr->nodeAtPoint(request, result, x, y, tx, ty);
             if (inside) {
@@ -280,9 +281,9 @@ void RenderLineBoxList::dirtyLinesFromChangedChild(RenderObject* container, Rend
             if (textBox)
                 box = textBox->root();
         } else if (curr->isRenderInline()) {
-            InlineRunBox* runBox = toRenderInline(curr)->lastLineBox();
-            if (runBox)
-                box = runBox->root();
+            InlineFlowBox* flowBox = toRenderInline(curr)->lastLineBox();
+            if (flowBox)
+                box = flowBox->root();
         }
 
         if (box)
@@ -320,8 +321,8 @@ void RenderLineBoxList::checkConsistency() const
 {
 #ifdef CHECK_CONSISTENCY
     const InlineFlowBox* prev = 0;
-    for (const InlineFlowBox* child = m_firstLineBox; child != 0; child = child->nextFlowBox()) {
-        ASSERT(child->prevFlowBox() == prev);
+    for (const InlineFlowBox* child = m_firstLineBox; child != 0; child = child->nextLineBox()) {
+        ASSERT(child->prevLineBox() == prev);
         prev = child;
     }
     ASSERT(prev == m_lastLineBox);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp
index 0edfdef31b..15c652ca32 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp
@@ -321,7 +321,8 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, in
             textColor = theme()->inactiveListBoxSelectionForegroundColor();
     }
 
-    paintInfo.context->setFillColor(textColor);
+    ColorSpace colorSpace = itemStyle->colorSpace();
+    paintInfo.context->setFillColor(textColor, colorSpace);
 
     Font itemFont = style()->font();
     if (isOptionGroupElement(element)) {
@@ -358,9 +359,10 @@ void RenderListBox::paintItemBackground(PaintInfo& paintInfo, int tx, int ty, in
 
     // Draw the background for this list box item
     if (!element->renderStyle() || element->renderStyle()->visibility() != HIDDEN) {
+        ColorSpace colorSpace = element->renderStyle() ? element->renderStyle()->colorSpace() : style()->colorSpace();
         IntRect itemRect = itemBoundingBoxRect(tx, ty, listIndex);
         itemRect.intersect(controlClipRect(tx, ty));
-        paintInfo.context->fillRect(itemRect, backColor);
+        paintInfo.context->fillRect(itemRect, backColor, colorSpace);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListItem.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderListItem.cpp
index e487c603e5..54a7dd2908 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListItem.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListItem.cpp
@@ -1,9 +1,7 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
  *
  * This library is free software; you can redistribute it and/or
@@ -53,8 +51,8 @@ void RenderListItem::styleDidChange(StyleDifference diff, const RenderStyle* old
 {
     RenderBlock::styleDidChange(diff, oldStyle);
 
-    if (style()->listStyleType() != LNONE ||
-        (style()->listStyleImage() && !style()->listStyleImage()->errorOccurred())) {
+    if (style()->listStyleType() != NoneListStyle
+        || (style()->listStyleImage() && !style()->listStyleImage()->errorOccurred())) {
         RefPtr<RenderStyle> newStyle = RenderStyle::create();
         // The marker always inherits from the list item, regardless of where it might end
         // up (e.g., in some deeply nested line box). See CSS3 spec.
@@ -77,11 +75,16 @@ void RenderListItem::destroy()
     RenderBlock::destroy();
 }
 
+static bool isList(Node* node)
+{
+    return (node->hasTagName(ulTag) || node->hasTagName(olTag));
+}
+
 static Node* enclosingList(Node* node)
 {
     Node* parent = node->parentNode();
     for (Node* n = parent; n; n = n->parentNode())
-        if (n->hasTagName(ulTag) || n->hasTagName(olTag))
+        if (isList(n))
             return n;
     // If there's no actual <ul> or <ol> list element, then our parent acts as
     // our list for purposes of determining what other list items should be
@@ -89,22 +92,38 @@ static Node* enclosingList(Node* node)
     return parent;
 }
 
+static Node* enclosingList(const RenderObject* renderer)
+{
+    Node* node = renderer->node();
+    if (node)
+        return enclosingList(node);
+
+    renderer = renderer->parent();
+    while (renderer && !renderer->node())
+        renderer = renderer->parent();
+
+    node = renderer->node();
+    if (isList(node))
+        return node;
+
+    return enclosingList(node);
+}
+
 static RenderListItem* previousListItem(Node* list, const RenderListItem* item)
 {
-    for (Node* node = item->node()->traversePreviousNode(); node != list; node = node->traversePreviousNode()) {
-        RenderObject* renderer = node->renderer();
-        if (!renderer || !renderer->isListItem())
+    for (RenderObject* renderer = item->previousInPreOrder(); renderer != list->renderer(); renderer = renderer->previousInPreOrder()) {
+        if (!renderer->isListItem())
             continue;
-        Node* otherList = enclosingList(node);
+        Node* otherList = enclosingList(renderer);
         // This item is part of our current list, so it's what we're looking for.
         if (list == otherList)
             return toRenderListItem(renderer);
         // We found ourself inside another list; lets skip the rest of it.
-        // Use traverseNextNode() here because the other list itself may actually
+        // Use nextInPreOrder() here because the other list itself may actually
         // be a list item itself. We need to examine it, so we do this to counteract
-        // the traversePreviousNode() that will be done by the loop.
+        // the previousInPreOrder() that will be done by the loop.
         if (otherList)
-            node = otherList->traverseNextNode();
+            renderer = otherList->renderer()->nextInPreOrder();
     }
     return 0;
 }
@@ -113,7 +132,7 @@ inline int RenderListItem::calcValue() const
 {
     if (m_hasExplicitValue)
         return m_explicitValue;
-    Node* list = enclosingList(node());
+    Node* list = enclosingList(this);
     // FIXME: This recurses to a possible depth of the length of the list.
     // That's not good -- we need to change this to an iterative algorithm.
     if (RenderListItem* previousItem = previousListItem(list, this))
@@ -324,6 +343,8 @@ void RenderListItem::explicitValueChanged()
 
 void RenderListItem::setExplicitValue(int value)
 {
+    ASSERT(node());
+
     if (m_hasExplicitValue && m_explicitValue == value)
         return;
     m_explicitValue = value;
@@ -334,6 +355,8 @@ void RenderListItem::setExplicitValue(int value)
 
 void RenderListItem::clearExplicitValue()
 {
+    ASSERT(node());
+
     if (!m_hasExplicitValue)
         return;
     m_hasExplicitValue = false;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.cpp
index 9627711780..d0353ee091 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.cpp
@@ -3,6 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
+ * Copyright (C) 2010 Daniel Bates (dbates@intudata.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -40,6 +41,8 @@ namespace WebCore {
 
 const int cMarkerPadding = 7;
 
+enum SequenceType { NumericSequence, AlphabeticSequence };
+
 static String toRoman(int number, bool upper)
 {
     // FIXME: CSS3 describes how to make this work for much larger numbers,
@@ -48,7 +51,9 @@ static String toRoman(int number, bool upper)
     if (number < 1 || number > 3999)
         return String::number(number);
 
-    const int lettersSize = 12; // big enough for three each of I, X, C, and M
+    // Big enough to store largest roman number less than 3999 which
+    // is 3888 (MMMDCCCLXXXVIII)
+    const int lettersSize = 15;
     UChar letters[lettersSize];
 
     int length = 0;
@@ -75,26 +80,63 @@ static String toRoman(int number, bool upper)
     return String(&letters[lettersSize - length], length);
 }
 
-static String toAlphabetic(int number, const UChar* alphabet, int alphabetSize)
+static inline String toAlphabeticOrNumeric(int number, const UChar* sequence, int sequenceSize, SequenceType type)
 {
-    ASSERT(alphabetSize >= 10);
+    ASSERT(sequenceSize >= 2);
 
-    if (number < 1)
-        return String::number(number);
+    const int lettersSize = sizeof(number) * 8 + 1; // Binary is the worst case; requires one character per bit plus a minus sign.
 
-    const int lettersSize = 10; // big enough for a 32-bit int, with a 10-letter alphabet
     UChar letters[lettersSize];
 
-    --number;
-    letters[lettersSize - 1] = alphabet[number % alphabetSize];
+    bool isNegativeNumber = false;
+    unsigned numberShadow = number;
+    if (type == AlphabeticSequence) {
+        ASSERT(number > 0);
+        --numberShadow;
+    } else if (number < 0) {
+        numberShadow = -number;
+        isNegativeNumber = true;
+    }
+    letters[lettersSize - 1] = sequence[numberShadow % sequenceSize];
     int length = 1;
-    while ((number /= alphabetSize) > 0)
-        letters[lettersSize - ++length] = alphabet[number % alphabetSize - 1];
+
+    if (type == AlphabeticSequence) {
+        while ((numberShadow /= sequenceSize) > 0)
+            letters[lettersSize - ++length] = sequence[numberShadow % sequenceSize - 1];
+    } else {
+        while ((numberShadow /= sequenceSize) > 0)
+            letters[lettersSize - ++length] = sequence[numberShadow % sequenceSize];
+    }
+    if (isNegativeNumber)
+        letters[lettersSize - ++length] = hyphenMinus;
 
     ASSERT(length <= lettersSize);
     return String(&letters[lettersSize - length], length);
 }
 
+static String toAlphabetic(int number, const UChar* alphabet, int alphabetSize)
+{
+    if (number < 1)
+        return String::number(number);
+
+    return toAlphabeticOrNumeric(number, alphabet, alphabetSize, AlphabeticSequence);
+}
+
+static String toNumeric(int number, const UChar* numerals, int numeralsSize)
+{
+    return toAlphabeticOrNumeric(number, numerals, numeralsSize, NumericSequence);
+}
+
+template <size_t size> static inline String toAlphabetic(int number, const UChar(&alphabet)[size])
+{
+    return toAlphabetic(number, alphabet, size);
+}
+
+template <size_t size> static inline String toNumeric(int number, const UChar(&alphabet)[size])
+{
+    return toNumeric(number, alphabet, size);
+}
+
 static int toHebrewUnder1000(int number, UChar letters[5])
 {
     // FIXME: CSS3 mentions various refinements not implemented here.
@@ -335,58 +377,273 @@ static String toCJKIdeographic(int number, const UChar table[16])
     return String(characters, length);
 }
 
+static UChar listMarkerSuffix(EListStyleType type)
+{
+    // Note, the following switch statement has been explicitly
+    // grouped by list-style-type suffix.
+    switch (type) {
+    case NoneListStyle:
+    case Disc:
+    case Circle:
+    case Square:
+        ASSERT_NOT_REACHED();
+        return ' ';
+    case Afar:
+    case Amharic:
+    case AmharicAbegede:
+    case Ethiopic:
+    case EthiopicAbegede:
+    case EthiopicAbegedeAmEt:
+    case EthiopicAbegedeGez:
+    case EthiopicAbegedeTiEr:
+    case EthiopicAbegedeTiEt:
+    case EthiopicHalehameAaEr:
+    case EthiopicHalehameAaEt:
+    case EthiopicHalehameAmEt:
+    case EthiopicHalehameGez:
+    case EthiopicHalehameOmEt:
+    case EthiopicHalehameSidEt:
+    case EthiopicHalehameSoEt:
+    case EthiopicHalehameTiEr:
+    case EthiopicHalehameTiEt:
+    case EthiopicHalehameTig:
+    case Oromo:
+    case Sidama:
+    case Somali:
+    case Tigre:
+    case TigrinyaEr:
+    case TigrinyaErAbegede:
+    case TigrinyaEt:
+    case TigrinyaEtAbegede:
+        return ethiopicPrefaceColon;
+    case Armenian:
+    case ArabicIndic:
+    case Bengali:
+    case BinaryListStyle:
+    case Cambodian:
+    case CJKIdeographic:
+    case CjkEarthlyBranch:
+    case CjkHeavenlyStem:
+    case DecimalLeadingZero:
+    case DecimalListStyle:
+    case Devanagari:
+    case Georgian:
+    case Gujarati:
+    case Gurmukhi:
+    case Hangul:
+    case HangulConsonant:
+    case Hebrew:
+    case Hiragana:
+    case HiraganaIroha:
+    case Kannada:
+    case Katakana:
+    case KatakanaIroha:
+    case Khmer:
+    case Lao:
+    case LowerAlpha:
+    case LowerGreek:
+    case LowerHexadecimal:
+    case LowerLatin:
+    case LowerNorwegian:
+    case LowerRoman:
+    case Malayalam:
+    case Mongolian:
+    case Myanmar:
+    case Octal:
+    case Oriya:
+    case Persian:
+    case Telugu:
+    case Thai:
+    case Tibetan:
+    case UpperAlpha:
+    case UpperGreek:
+    case UpperHexadecimal:
+    case UpperLatin:
+    case UpperNorwegian:
+    case UpperRoman:
+    case Urdu:
+        return '.';
+    }
+
+    ASSERT_NOT_REACHED();
+    return '.';
+}
+
 String listMarkerText(EListStyleType type, int value)
 {
     switch (type) {
-        case LNONE:
+        case NoneListStyle:
             return "";
 
         // We use the same characters for text security.
         // See RenderText::setInternalString.
-        case CIRCLE:
+        case Circle:
             return String(&whiteBullet, 1);
-        case DISC:
+        case Disc:
             return String(&bullet, 1);
-        case SQUARE:
+        case Square:
             // The CSS 2.1 test suite uses U+25EE BLACK MEDIUM SMALL SQUARE
             // instead, but I think this looks better.
             return String(&blackSquare, 1);
 
-        case LDECIMAL:
+        case DecimalListStyle:
             return String::number(value);
-        case DECIMAL_LEADING_ZERO:
+        case DecimalLeadingZero:
             if (value < -9 || value > 9)
                 return String::number(value);
             if (value < 0)
                 return "-0" + String::number(-value); // -01 to -09
             return "0" + String::number(value); // 00 to 09
 
-        case LOWER_ALPHA:
-        case LOWER_LATIN: {
+        case ArabicIndic: {
+            static const UChar arabicIndicNumerals[10] = {
+                0x0660, 0x0661, 0x0662, 0x0663, 0x0664, 0x0665, 0x0666, 0x0667, 0x0668, 0x0669
+            };
+            return toNumeric(value, arabicIndicNumerals);
+        }
+        case BinaryListStyle: {
+            static const UChar binaryNumerals[2] = {
+                '0', '1'
+            };
+            return toNumeric(value, binaryNumerals);
+        }
+        case Bengali: {
+            static const UChar bengaliNumerals[10] = {
+                0x09E6, 0x09E7, 0x09E8, 0x09E9, 0x09EA, 0x09EB, 0x09EC, 0x09ED, 0x09EE, 0x09EF
+            };
+            return toNumeric(value, bengaliNumerals);
+        }
+        case Cambodian:
+        case Khmer: {
+            static const UChar khmerNumerals[10] = {
+                0x17E0, 0x17E1, 0x17E2, 0x17E3, 0x17E4, 0x17E5, 0x17E6, 0x17E7, 0x17E8, 0x17E9
+            };
+            return toNumeric(value, khmerNumerals);
+        }
+        case Devanagari: {
+            static const UChar devanagariNumerals[10] = {
+                0x0966, 0x0967, 0x0968, 0x0969, 0x096A, 0x096B, 0x096C, 0x096D, 0x096E, 0x096F
+            };
+            return toNumeric(value, devanagariNumerals);
+        }
+        case Gujarati: {
+            static const UChar gujaratiNumerals[10] = {
+                0x0AE6, 0x0AE7, 0x0AE8, 0x0AE9, 0x0AEA, 0x0AEB, 0x0AEC, 0x0AED, 0x0AEE, 0x0AEF
+            };
+            return toNumeric(value, gujaratiNumerals);
+        }
+        case Gurmukhi: {
+            static const UChar gurmukhiNumerals[10] = {
+                0x0A66, 0x0A67, 0x0A68, 0x0A69, 0x0A6A, 0x0A6B, 0x0A6C, 0x0A6D, 0x0A6E, 0x0A6F
+            };
+            return toNumeric(value, gurmukhiNumerals);
+        }
+        case Kannada: {
+            static const UChar kannadaNumerals[10] = {
+                0x0CE6, 0x0CE7, 0x0CE8, 0x0CE9, 0x0CEA, 0x0CEB, 0x0CEC, 0x0CED, 0x0CEE, 0x0CEF
+            };
+            return toNumeric(value, kannadaNumerals);
+        }
+        case LowerHexadecimal: {
+            static const UChar lowerHexadecimalNumerals[16] = {
+                '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'
+            };
+            return toNumeric(value, lowerHexadecimalNumerals);
+        }
+        case Lao: {
+            static const UChar laoNumerals[10] = {
+                0x0ED0, 0x0ED1, 0x0ED2, 0x0ED3, 0x0ED4, 0x0ED5, 0x0ED6, 0x0ED7, 0x0ED8, 0x0ED9
+            };
+            return toNumeric(value, laoNumerals);
+        }
+        case Malayalam: {
+            static const UChar malayalamNumerals[10] = {
+                0x0D66, 0x0D67, 0x0D68, 0x0D69, 0x0D6A, 0x0D6B, 0x0D6C, 0x0D6D, 0x0D6E, 0x0D6F
+            };
+            return toNumeric(value, malayalamNumerals);
+        }
+        case Mongolian: {
+            static const UChar mongolianNumerals[10] = {
+                0x1810, 0x1811, 0x1812, 0x1813, 0x1814, 0x1815, 0x1816, 0x1817, 0x1818, 0x1819
+            };
+            return toNumeric(value, mongolianNumerals);
+        }
+        case Myanmar: {
+            static const UChar myanmarNumerals[10] = {
+                0x1040, 0x1041, 0x1042, 0x1043, 0x1044, 0x1045, 0x1046, 0x1047, 0x1048, 0x1049
+            };
+            return toNumeric(value, myanmarNumerals);
+        }
+        case Octal: {
+            static const UChar octalNumerals[8] = {
+                '0', '1', '2', '3', '4', '5', '6', '7'
+            };
+            return toNumeric(value, octalNumerals);
+        }
+        case Oriya: {
+            static const UChar oriyaNumerals[10] = {
+                0x0B66, 0x0B67, 0x0B68, 0x0B69, 0x0B6A, 0x0B6B, 0x0B6C, 0x0B6D, 0x0B6E, 0x0B6F
+            };
+            return toNumeric(value, oriyaNumerals);
+        }
+        case Persian:
+        case Urdu: {
+            static const UChar urduNumerals[10] = {
+                0x06F0, 0x06F1, 0x06F2, 0x06F3, 0x06F4, 0x06F5, 0x06F6, 0x06F7, 0x06F8, 0x06F9
+            };
+            return toNumeric(value, urduNumerals);
+        }
+        case Telugu: {
+            static const UChar teluguNumerals[10] = {
+                0x0C66, 0x0C67, 0x0C68, 0x0C69, 0x0C6A, 0x0C6B, 0x0C6C, 0x0C6D, 0x0C6E, 0x0C6F
+            };
+            return toNumeric(value, teluguNumerals);
+        }
+        case Tibetan: {
+            static const UChar tibetanNumerals[10] = {
+                0x0F20, 0x0F21, 0x0F22, 0x0F23, 0x0F24, 0x0F25, 0x0F26, 0x0F27, 0x0F28, 0x0F29
+            };
+            return toNumeric(value, tibetanNumerals);
+        }
+        case Thai: {
+            static const UChar thaiNumerals[10] = {
+                0x0E50, 0x0E51, 0x0E52, 0x0E53, 0x0E54, 0x0E55, 0x0E56, 0x0E57, 0x0E58, 0x0E59
+            };
+            return toNumeric(value, thaiNumerals);
+        }
+        case UpperHexadecimal: {
+            static const UChar upperHexadecimalNumerals[16] = {
+                '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E', 'F'
+            };
+            return toNumeric(value, upperHexadecimalNumerals);
+        }
+
+        case LowerAlpha:
+        case LowerLatin: {
             static const UChar lowerLatinAlphabet[26] = {
                 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm',
                 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z'
             };
-            return toAlphabetic(value, lowerLatinAlphabet, 26);
+            return toAlphabetic(value, lowerLatinAlphabet);
         }
-        case UPPER_ALPHA:
-        case UPPER_LATIN: {
+        case UpperAlpha:
+        case UpperLatin: {
             static const UChar upperLatinAlphabet[26] = {
                 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M',
                 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z'
             };
-            return toAlphabetic(value, upperLatinAlphabet, 26);
+            return toAlphabetic(value, upperLatinAlphabet);
         }
-        case LOWER_GREEK: {
+        case LowerGreek: {
             static const UChar lowerGreekAlphabet[24] = {
                 0x03B1, 0x03B2, 0x03B3, 0x03B4, 0x03B5, 0x03B6, 0x03B7, 0x03B8,
                 0x03B9, 0x03BA, 0x03BB, 0x03BC, 0x03BD, 0x03BE, 0x03BF, 0x03C0,
                 0x03C1, 0x03C3, 0x03C4, 0x03C5, 0x03C6, 0x03C7, 0x03C8, 0x03C9
             };
-            return toAlphabetic(value, lowerGreekAlphabet, 24);
+            return toAlphabetic(value, lowerGreekAlphabet);
         }
 
-        case HIRAGANA: {
+        case Hiragana: {
             // FIXME: This table comes from the CSS3 draft, and is probably
             // incorrect, given the comments in that draft.
             static const UChar hiraganaAlphabet[48] = {
@@ -397,9 +654,9 @@ String listMarkerText(EListStyleType type, int value)
                 0x3080, 0x3081, 0x3082, 0x3084, 0x3086, 0x3088, 0x3089, 0x308A,
                 0x308B, 0x308C, 0x308D, 0x308F, 0x3090, 0x3091, 0x3092, 0x3093
             };
-            return toAlphabetic(value, hiraganaAlphabet, 48);
+            return toAlphabetic(value, hiraganaAlphabet);
         }
-        case HIRAGANA_IROHA: {
+        case HiraganaIroha: {
             // FIXME: This table comes from the CSS3 draft, and is probably
             // incorrect, given the comments in that draft.
             static const UChar hiraganaIrohaAlphabet[47] = {
@@ -410,9 +667,9 @@ String listMarkerText(EListStyleType type, int value)
                 0x3053, 0x3048, 0x3066, 0x3042, 0x3055, 0x304D, 0x3086, 0x3081,
                 0x307F, 0x3057, 0x3091, 0x3072, 0x3082, 0x305B, 0x3059
             };
-            return toAlphabetic(value, hiraganaIrohaAlphabet, 47);
+            return toAlphabetic(value, hiraganaIrohaAlphabet);
         }
-        case KATAKANA: {
+        case Katakana: {
             // FIXME: This table comes from the CSS3 draft, and is probably
             // incorrect, given the comments in that draft.
             static const UChar katakanaAlphabet[48] = {
@@ -423,9 +680,9 @@ String listMarkerText(EListStyleType type, int value)
                 0x30E0, 0x30E1, 0x30E2, 0x30E4, 0x30E6, 0x30E8, 0x30E9, 0x30EA,
                 0x30EB, 0x30EC, 0x30ED, 0x30EF, 0x30F0, 0x30F1, 0x30F2, 0x30F3
             };
-            return toAlphabetic(value, katakanaAlphabet, 48);
+            return toAlphabetic(value, katakanaAlphabet);
         }
-        case KATAKANA_IROHA: {
+        case KatakanaIroha: {
             // FIXME: This table comes from the CSS3 draft, and is probably
             // incorrect, given the comments in that draft.
             static const UChar katakanaIrohaAlphabet[47] = {
@@ -436,10 +693,187 @@ String listMarkerText(EListStyleType type, int value)
                 0x30B3, 0x30A8, 0x30C6, 0x30A2, 0x30B5, 0x30AD, 0x30E6, 0x30E1,
                 0x30DF, 0x30B7, 0x30F1, 0x30D2, 0x30E2, 0x30BB, 0x30B9
             };
-            return toAlphabetic(value, katakanaIrohaAlphabet, 47);
+            return toAlphabetic(value, katakanaIrohaAlphabet);
         }
 
-        case CJK_IDEOGRAPHIC: {
+        case Afar:
+        case EthiopicHalehameAaEt:
+        case EthiopicHalehameAaEr: {
+            static const UChar ethiopicHalehameAaErAlphabet[18] = {
+                0x1200, 0x1208, 0x1210, 0x1218, 0x1228, 0x1230, 0x1260, 0x1270, 0x1290,
+                0x12A0, 0x12A8, 0x12C8, 0x12D0, 0x12E8, 0x12F0, 0x1308, 0x1338, 0x1348
+            };
+            return toAlphabetic(value, ethiopicHalehameAaErAlphabet);
+        }
+        case Amharic:
+        case EthiopicHalehameAmEt: {
+            static const UChar ethiopicHalehameAmEtAlphabet[33] = {
+                0x1200, 0x1208, 0x1210, 0x1218, 0x1220, 0x1228, 0x1230, 0x1238, 0x1240,
+                0x1260, 0x1270, 0x1278, 0x1280, 0x1290, 0x1298, 0x12A0, 0x12A8, 0x12B8,
+                0x12C8, 0x12D0, 0x12D8, 0x12E0, 0x12E8, 0x12F0, 0x1300, 0x1308, 0x1320,
+                0x1328, 0x1330, 0x1338, 0x1340, 0x1348, 0x1350
+            };
+            return toAlphabetic(value, ethiopicHalehameAmEtAlphabet);
+        }
+        case AmharicAbegede:
+        case EthiopicAbegedeAmEt: {
+            static const UChar ethiopicAbegedeAmEtAlphabet[33] = {
+                0x12A0, 0x1260, 0x1308, 0x12F0, 0x1300, 0x1200, 0x12C8, 0x12D8, 0x12E0,
+                0x1210, 0x1320, 0x1328, 0x12E8, 0x12A8, 0x12B8, 0x1208, 0x1218, 0x1290,
+                0x1298, 0x1220, 0x12D0, 0x1348, 0x1338, 0x1240, 0x1228, 0x1230, 0x1238,
+                0x1270, 0x1278, 0x1280, 0x1340, 0x1330, 0x1350
+            };
+            return toAlphabetic(value, ethiopicAbegedeAmEtAlphabet);
+        }
+        case CjkEarthlyBranch: {
+            static const UChar cjkEarthlyBranchAlphabet[12] = {
+                0x5B50, 0x4E11, 0x5BC5, 0x536F, 0x8FB0, 0x5DF3, 0x5348, 0x672A, 0x7533,
+                0x9149, 0x620C, 0x4EA5
+            };
+            return toAlphabetic(value, cjkEarthlyBranchAlphabet);
+        }
+        case CjkHeavenlyStem: {
+            static const UChar cjkHeavenlyStemAlphabet[10] = {
+                0x7532, 0x4E59, 0x4E19, 0x4E01, 0x620A, 0x5DF1, 0x5E9A, 0x8F9B, 0x58EC,
+                0x7678
+            };
+            return toAlphabetic(value, cjkHeavenlyStemAlphabet);
+        }
+        case Ethiopic:
+        case EthiopicHalehameGez: {
+            static const UChar ethiopicHalehameGezAlphabet[26] = {
+                0x1200, 0x1208, 0x1210, 0x1218, 0x1220, 0x1228, 0x1230, 0x1240, 0x1260,
+                0x1270, 0x1280, 0x1290, 0x12A0, 0x12A8, 0x12C8, 0x12D0, 0x12D8, 0x12E8,
+                0x12F0, 0x1308, 0x1320, 0x1330, 0x1338, 0x1340, 0x1348, 0x1350
+            };
+            return toAlphabetic(value, ethiopicHalehameGezAlphabet);
+        }
+        case EthiopicAbegede:
+        case EthiopicAbegedeGez: {
+            static const UChar ethiopicAbegedeGezAlphabet[26] = {
+                0x12A0, 0x1260, 0x1308, 0x12F0, 0x1200, 0x12C8, 0x12D8, 0x1210, 0x1320,
+                0x12E8, 0x12A8, 0x1208, 0x1218, 0x1290, 0x1220, 0x12D0, 0x1348, 0x1338,
+                0x1240, 0x1228, 0x1230, 0x1270, 0x1280, 0x1340, 0x1330, 0x1350
+            };
+            return toAlphabetic(value, ethiopicAbegedeGezAlphabet);
+        }
+        case HangulConsonant: {
+            static const UChar hangulConsonantAlphabet[14] = {
+                0x3131, 0x3134, 0x3137, 0x3139, 0x3141, 0x3142, 0x3145, 0x3147, 0x3148,
+                0x314A, 0x314B, 0x314C, 0x314D, 0x314E
+            };
+            return toAlphabetic(value, hangulConsonantAlphabet);
+        }
+        case Hangul: {
+            static const UChar hangulAlphabet[14] = {
+                0xAC00, 0xB098, 0xB2E4, 0xB77C, 0xB9C8, 0xBC14, 0xC0AC, 0xC544, 0xC790,
+                0xCC28, 0xCE74, 0xD0C0, 0xD30C, 0xD558
+            };
+            return toAlphabetic(value, hangulAlphabet);
+        }
+        case Oromo:
+        case EthiopicHalehameOmEt: {
+            static const UChar ethiopicHalehameOmEtAlphabet[25] = {
+                0x1200, 0x1208, 0x1218, 0x1228, 0x1230, 0x1238, 0x1240, 0x1260, 0x1270,
+                0x1278, 0x1290, 0x1298, 0x12A0, 0x12A8, 0x12C8, 0x12E8, 0x12F0, 0x12F8,
+                0x1300, 0x1308, 0x1320, 0x1328, 0x1338, 0x1330, 0x1348
+            };
+            return toAlphabetic(value, ethiopicHalehameOmEtAlphabet);
+        }
+        case Sidama:
+        case EthiopicHalehameSidEt: {
+            static const UChar ethiopicHalehameSidEtAlphabet[26] = {
+                0x1200, 0x1208, 0x1210, 0x1218, 0x1228, 0x1230, 0x1238, 0x1240, 0x1260,
+                0x1270, 0x1278, 0x1290, 0x1298, 0x12A0, 0x12A8, 0x12C8, 0x12E8, 0x12F0,
+                0x12F8, 0x1300, 0x1308, 0x1320, 0x1328, 0x1338, 0x1330, 0x1348
+            };
+            return toAlphabetic(value, ethiopicHalehameSidEtAlphabet);
+        }
+        case Somali:
+        case EthiopicHalehameSoEt: {
+            static const UChar ethiopicHalehameSoEtAlphabet[22] = {
+                0x1200, 0x1208, 0x1210, 0x1218, 0x1228, 0x1230, 0x1238, 0x1240, 0x1260,
+                0x1270, 0x1290, 0x12A0, 0x12A8, 0x12B8, 0x12C8, 0x12D0, 0x12E8, 0x12F0,
+                0x1300, 0x1308, 0x1338, 0x1348
+            };
+            return toAlphabetic(value, ethiopicHalehameSoEtAlphabet);
+        }
+        case Tigre:
+        case EthiopicHalehameTig: {
+            static const UChar ethiopicHalehameTigAlphabet[27] = {
+                0x1200, 0x1208, 0x1210, 0x1218, 0x1228, 0x1230, 0x1238, 0x1240, 0x1260,
+                0x1270, 0x1278, 0x1290, 0x12A0, 0x12A8, 0x12C8, 0x12D0, 0x12D8, 0x12E8,
+                0x12F0, 0x1300, 0x1308, 0x1320, 0x1328, 0x1338, 0x1330, 0x1348, 0x1350
+            };
+            return toAlphabetic(value, ethiopicHalehameTigAlphabet);
+        }
+        case TigrinyaEr:
+        case EthiopicHalehameTiEr: {
+            static const UChar ethiopicHalehameTiErAlphabet[31] = {
+                0x1200, 0x1208, 0x1210, 0x1218, 0x1228, 0x1230, 0x1238, 0x1240, 0x1250,
+                0x1260, 0x1270, 0x1278, 0x1290, 0x1298, 0x12A0, 0x12A8, 0x12B8, 0x12C8,
+                0x12D0, 0x12D8, 0x12E0, 0x12E8, 0x12F0, 0x1300, 0x1308, 0x1320, 0x1328,
+                0x1330, 0x1338, 0x1348, 0x1350
+            };
+            return toAlphabetic(value, ethiopicHalehameTiErAlphabet);
+        }
+        case TigrinyaErAbegede:
+        case EthiopicAbegedeTiEr: {
+            static const UChar ethiopicAbegedeTiErAlphabet[31] = {
+                0x12A0, 0x1260, 0x1308, 0x12F0, 0x1300, 0x1200, 0x12C8, 0x12D8, 0x12E0,
+                0x1210, 0x1320, 0x1328, 0x12E8, 0x12A8, 0x12B8, 0x1208, 0x1218, 0x1290,
+                0x1298, 0x12D0, 0x1348, 0x1338, 0x1240, 0x1250, 0x1228, 0x1230, 0x1238,
+                0x1270, 0x1278, 0x1330, 0x1350
+            };
+            return toAlphabetic(value, ethiopicAbegedeTiErAlphabet);
+        }
+        case TigrinyaEt:
+        case EthiopicHalehameTiEt: {
+            static const UChar ethiopicHalehameTiEtAlphabet[34] = {
+                0x1200, 0x1208, 0x1210, 0x1218, 0x1220, 0x1228, 0x1230, 0x1238, 0x1240,
+                0x1250, 0x1260, 0x1270, 0x1278, 0x1280, 0x1290, 0x1298, 0x12A0, 0x12A8,
+                0x12B8, 0x12C8, 0x12D0, 0x12D8, 0x12E0, 0x12E8, 0x12F0, 0x1300, 0x1308,
+                0x1320, 0x1328, 0x1330, 0x1338, 0x1340, 0x1348, 0x1350
+            };
+            return toAlphabetic(value, ethiopicHalehameTiEtAlphabet);
+        }
+        case TigrinyaEtAbegede:
+        case EthiopicAbegedeTiEt: {
+            static const UChar ethiopicAbegedeTiEtAlphabet[34] = {
+                0x12A0, 0x1260, 0x1308, 0x12F0, 0x1300, 0x1200, 0x12C8, 0x12D8, 0x12E0,
+                0x1210, 0x1320, 0x1328, 0x12E8, 0x12A8, 0x12B8, 0x1208, 0x1218, 0x1290,
+                0x1298, 0x1220, 0x12D0, 0x1348, 0x1338, 0x1240, 0x1250, 0x1228, 0x1230,
+                0x1238, 0x1270, 0x1278, 0x1280, 0x1340, 0x1330, 0x1350
+            };
+            return toAlphabetic(value, ethiopicAbegedeTiEtAlphabet);
+        }
+        case UpperGreek: {
+            static const UChar upperGreekAlphabet[24] = {
+                0x0391, 0x0392, 0x0393, 0x0394, 0x0395, 0x0396, 0x0397, 0x0398, 0x0399,
+                0x039A, 0x039B, 0x039C, 0x039D, 0x039E, 0x039F, 0x03A0, 0x03A1, 0x03A3,
+                0x03A4, 0x03A5, 0x03A6, 0x03A7, 0x03A8, 0x03A9
+            };
+            return toAlphabetic(value, upperGreekAlphabet);
+        }
+        case LowerNorwegian: {
+            static const UChar lowerNorwegianAlphabet[29] = {
+                0x0061, 0x0062, 0x0063, 0x0064, 0x0065, 0x0066, 0x0067, 0x0068, 0x0069,
+                0x006A, 0x006B, 0x006C, 0x006D, 0x006E, 0x006F, 0x0070, 0x0071, 0x0072,
+                0x0073, 0x0074, 0x0075, 0x0076, 0x0077, 0x0078, 0x0079, 0x007A, 0x00E6,
+                0x00F8, 0x00E5
+            };
+            return toAlphabetic(value, lowerNorwegianAlphabet);
+        }
+        case UpperNorwegian: {
+            static const UChar upperNorwegianAlphabet[29] = {
+                0x0041, 0x0042, 0x0043, 0x0044, 0x0045, 0x0046, 0x0047, 0x0048, 0x0049,
+                0x004A, 0x004B, 0x004C, 0x004D, 0x004E, 0x004F, 0x0050, 0x0051, 0x0052,
+                0x0053, 0x0054, 0x0055, 0x0056, 0x0057, 0x0058, 0x0059, 0x005A, 0x00C6,
+                0x00D8, 0x00C5
+            };
+            return toAlphabetic(value, upperNorwegianAlphabet);
+        }
+        case CJKIdeographic: {
             static const UChar traditionalChineseInformalTable[16] = {
                 0x842C, 0x5104, 0x5146,
                 0x5341, 0x767E, 0x5343,
@@ -449,19 +883,19 @@ String listMarkerText(EListStyleType type, int value)
             return toCJKIdeographic(value, traditionalChineseInformalTable);
         }
 
-        case LOWER_ROMAN:
+        case LowerRoman:
             return toRoman(value, false);
-        case UPPER_ROMAN:
+        case UpperRoman:
             return toRoman(value, true);
 
-        case ARMENIAN:
+        case Armenian:
             // CSS3 says "armenian" means "lower-armenian".
             // But the CSS2.1 test suite contains uppercase test results for "armenian",
             // so we'll match the test suite.
             return toArmenian(value, true);
-        case GEORGIAN:
+        case Georgian:
             return toGeorgian(value);
-        case HEBREW:
+        case Hebrew:
             return toHebrew(value);
     }
 
@@ -517,6 +951,15 @@ bool RenderListMarker::isImage() const
     return m_image && !m_image->errorOccurred();
 }
 
+IntRect RenderListMarker::localSelectionRect()
+{
+    InlineBox* box = inlineBoxWrapper();
+    if (!box)
+        return IntRect();
+    RootInlineBox* root = box->root();
+    return IntRect(x(), root->selectionTop() - y(), width(), root->selectionHeight());
+}
+
 void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
 {
     if (paintInfo.phase != PaintPhaseForeground)
@@ -543,10 +986,11 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
         if (style()->highlight() != nullAtom && !paintInfo.context->paintingDisabled())
             paintCustomHighlight(tx, ty, style()->highlight(), true);
 #endif
-        context->drawImage(m_image->image(this, marker.size()), marker.location());
+        context->drawImage(m_image->image(this, marker.size()), style()->colorSpace(), marker.location());
         if (selectionState() != SelectionNone) {
-            // FIXME: selectionRect() is in absolute, not painting coordinates.
-            context->fillRect(selectionRect(), selectionBackgroundColor());
+            IntRect selRect = localSelectionRect();
+            selRect.move(tx, ty);
+            context->fillRect(selRect, selectionBackgroundColor(), style()->colorSpace());
         }
         return;
     }
@@ -558,46 +1002,104 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
 #endif
 
     if (selectionState() != SelectionNone) {
-        // FIXME: selectionRect() is in absolute, not painting coordinates.
-        context->fillRect(selectionRect(), selectionBackgroundColor());
+        IntRect selRect = localSelectionRect();
+        selRect.move(tx, ty);
+        context->fillRect(selRect, selectionBackgroundColor(), style()->colorSpace());
     }
 
     const Color color(style()->color());
-    context->setStrokeColor(color);
+    context->setStrokeColor(color, style()->colorSpace());
     context->setStrokeStyle(SolidStroke);
     context->setStrokeThickness(1.0f);
-    context->setFillColor(color);
+    context->setFillColor(color, style()->colorSpace());
 
-    switch (style()->listStyleType()) {
-        case DISC:
+    EListStyleType type = style()->listStyleType();
+    switch (type) {
+        case Disc:
             context->drawEllipse(marker);
             return;
-        case CIRCLE:
-            context->setFillColor(Color::transparent);
+        case Circle:
+            context->setFillColor(Color::transparent, DeviceColorSpace);
             context->drawEllipse(marker);
             return;
-        case SQUARE:
+        case Square:
             context->drawRect(marker);
             return;
-        case LNONE:
+        case NoneListStyle:
             return;
-        case ARMENIAN:
-        case CJK_IDEOGRAPHIC:
-        case DECIMAL_LEADING_ZERO:
-        case GEORGIAN:
-        case HEBREW:
-        case HIRAGANA:
-        case HIRAGANA_IROHA:
-        case KATAKANA:
-        case KATAKANA_IROHA:
-        case LDECIMAL:
-        case LOWER_ALPHA:
-        case LOWER_GREEK:
-        case LOWER_LATIN:
-        case LOWER_ROMAN:
-        case UPPER_ALPHA:
-        case UPPER_LATIN:
-        case UPPER_ROMAN:
+        case Afar:
+        case Amharic:
+        case AmharicAbegede:
+        case ArabicIndic:
+        case Armenian:
+        case BinaryListStyle:
+        case Bengali:
+        case Cambodian:
+        case CJKIdeographic:
+        case CjkEarthlyBranch:
+        case CjkHeavenlyStem:
+        case DecimalLeadingZero:
+        case DecimalListStyle:
+        case Devanagari:
+        case Ethiopic:
+        case EthiopicAbegede:
+        case EthiopicAbegedeAmEt:
+        case EthiopicAbegedeGez:
+        case EthiopicAbegedeTiEr:
+        case EthiopicAbegedeTiEt:
+        case EthiopicHalehameAaEr:
+        case EthiopicHalehameAaEt:
+        case EthiopicHalehameAmEt:
+        case EthiopicHalehameGez:
+        case EthiopicHalehameOmEt:
+        case EthiopicHalehameSidEt:
+        case EthiopicHalehameSoEt:
+        case EthiopicHalehameTiEr:
+        case EthiopicHalehameTiEt:
+        case EthiopicHalehameTig:
+        case Georgian:
+        case Gujarati:
+        case Gurmukhi:
+        case Hangul:
+        case HangulConsonant:
+        case Hebrew:
+        case Hiragana:
+        case HiraganaIroha:
+        case Kannada:
+        case Katakana:
+        case KatakanaIroha:
+        case Khmer:
+        case Lao:
+        case LowerAlpha:
+        case LowerGreek:
+        case LowerHexadecimal:
+        case LowerLatin:
+        case LowerNorwegian:
+        case LowerRoman:
+        case Malayalam:
+        case Mongolian:
+        case Myanmar:
+        case Octal:
+        case Oriya:
+        case Oromo:
+        case Persian:
+        case Sidama:
+        case Somali:
+        case Telugu:
+        case Thai:
+        case Tibetan:
+        case Tigre:
+        case TigrinyaEr:
+        case TigrinyaErAbegede:
+        case TigrinyaEt:
+        case TigrinyaEtAbegede:
+        case UpperAlpha:
+        case UpperGreek:
+        case UpperHexadecimal:
+        case UpperLatin:
+        case UpperNorwegian:
+        case UpperRoman:
+        case Urdu:
             break;
     }
     if (m_text.isEmpty())
@@ -618,16 +1120,17 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
     }
 
     const Font& font = style()->font();
+    const UChar suffix = listMarkerSuffix(type);
     if (style()->direction() == LTR) {
         int width = font.width(textRun);
         context->drawText(style()->font(), textRun, marker.location());
-        const UChar periodSpace[2] = { '.', ' ' };
-        context->drawText(style()->font(), TextRun(periodSpace, 2), marker.location() + IntSize(width, 0));
+        UChar suffixSpace[2] = { suffix, ' ' };
+        context->drawText(style()->font(), TextRun(suffixSpace, 2), marker.location() + IntSize(width, 0));
     } else {
-        const UChar spacePeriod[2] = { ' ', '.' };
-        TextRun spacePeriodRun(spacePeriod, 2);
-        int width = font.width(spacePeriodRun);
-        context->drawText(style()->font(), spacePeriodRun, marker.location());
+        UChar spaceSuffix[2] = { ' ', suffix };
+        TextRun spaceSuffixRun(spaceSuffix, 2);
+        int width = font.width(spaceSuffixRun);
+        context->drawText(style()->font(), spaceSuffixRun, marker.location());
         context->drawText(style()->font(), textRun, marker.location() + IntSize(width, 0));
     }
 }
@@ -691,39 +1194,95 @@ void RenderListMarker::calcPrefWidths()
     int width = 0;
     EListStyleType type = style()->listStyleType();
     switch (type) {
-        case LNONE:
+        case NoneListStyle:
             break;
-        case CIRCLE:
-        case DISC:
-        case SQUARE:
+        case Circle:
+        case Disc:
+        case Square:
             m_text = listMarkerText(type, 0); // value is ignored for these types
             width = (font.ascent() * 2 / 3 + 1) / 2 + 2;
             break;
-        case ARMENIAN:
-        case CJK_IDEOGRAPHIC:
-        case DECIMAL_LEADING_ZERO:
-        case GEORGIAN:
-        case HEBREW:
-        case HIRAGANA:
-        case HIRAGANA_IROHA:
-        case KATAKANA:
-        case KATAKANA_IROHA:
-        case LDECIMAL:
-        case LOWER_ALPHA:
-        case LOWER_GREEK:
-        case LOWER_LATIN:
-        case LOWER_ROMAN:
-        case UPPER_ALPHA:
-        case UPPER_LATIN:
-        case UPPER_ROMAN:
+        case Afar:
+        case Amharic:
+        case AmharicAbegede:
+        case ArabicIndic:
+        case Armenian:
+        case BinaryListStyle:
+        case Bengali:
+        case Cambodian:
+        case CJKIdeographic:
+        case CjkEarthlyBranch:
+        case CjkHeavenlyStem:
+        case DecimalLeadingZero:
+        case DecimalListStyle:
+        case Devanagari:
+        case Ethiopic:
+        case EthiopicAbegede:
+        case EthiopicAbegedeAmEt:
+        case EthiopicAbegedeGez:
+        case EthiopicAbegedeTiEr:
+        case EthiopicAbegedeTiEt:
+        case EthiopicHalehameAaEr:
+        case EthiopicHalehameAaEt:
+        case EthiopicHalehameAmEt:
+        case EthiopicHalehameGez:
+        case EthiopicHalehameOmEt:
+        case EthiopicHalehameSidEt:
+        case EthiopicHalehameSoEt:
+        case EthiopicHalehameTiEr:
+        case EthiopicHalehameTiEt:
+        case EthiopicHalehameTig:
+        case Georgian:
+        case Gujarati:
+        case Gurmukhi:
+        case Hangul:
+        case HangulConsonant:
+        case Hebrew:
+        case Hiragana:
+        case HiraganaIroha:
+        case Kannada:
+        case Katakana:
+        case KatakanaIroha:
+        case Khmer:
+        case Lao:
+        case LowerAlpha:
+        case LowerGreek:
+        case LowerHexadecimal:
+        case LowerLatin:
+        case LowerNorwegian:
+        case LowerRoman:
+        case Malayalam:
+        case Mongolian:
+        case Myanmar:
+        case Octal:
+        case Oriya:
+        case Oromo:
+        case Persian:
+        case Sidama:
+        case Somali:
+        case Telugu:
+        case Thai:
+        case Tibetan:
+        case Tigre:
+        case TigrinyaEr:
+        case TigrinyaErAbegede:
+        case TigrinyaEt:
+        case TigrinyaEtAbegede:
+        case UpperAlpha:
+        case UpperGreek:
+        case UpperHexadecimal:
+        case UpperLatin:
+        case UpperNorwegian:
+        case UpperRoman:
+        case Urdu:
             m_text = listMarkerText(type, m_listItem->value());
             if (m_text.isEmpty())
                 width = 0;
             else {
                 int itemWidth = font.width(m_text);
-                const UChar periodSpace[2] = { '.', ' ' };
-                int periodSpaceWidth = font.width(TextRun(periodSpace, 2));
-                width = itemWidth + periodSpaceWidth;
+                UChar suffixSpace[2] = { listMarkerSuffix(type), ' ' };
+                int suffixSpaceWidth = font.width(TextRun(suffixSpace, 2));
+                width = itemWidth + suffixSpaceWidth;
             }
             break;
     }
@@ -750,9 +1309,9 @@ void RenderListMarker::updateMargins()
             else
                 marginLeft = cMarkerPadding;
         } else switch (style()->listStyleType()) {
-            case DISC:
-            case CIRCLE:
-            case SQUARE:
+            case Disc:
+            case Circle:
+            case Square:
                 if (style()->direction() == LTR) {
                     marginLeft = -1;
                     marginRight = font.ascent() - minPrefWidth() + 1;
@@ -771,12 +1330,12 @@ void RenderListMarker::updateMargins()
             else {
                 int offset = font.ascent() * 2 / 3;
                 switch (style()->listStyleType()) {
-                    case DISC:
-                    case CIRCLE:
-                    case SQUARE:
+                    case Disc:
+                    case Circle:
+                    case Square:
                         marginLeft = -offset - cMarkerPadding - 1;
                         break;
-                    case LNONE:
+                    case NoneListStyle:
                         break;
                     default:
                         marginLeft = m_text.isEmpty() ? 0 : -minPrefWidth() - offset / 2;
@@ -788,12 +1347,12 @@ void RenderListMarker::updateMargins()
             else {
                 int offset = font.ascent() * 2 / 3;
                 switch (style()->listStyleType()) {
-                    case DISC:
-                    case CIRCLE:
-                    case SQUARE:
+                    case Disc:
+                    case Circle:
+                    case Square:
                         marginLeft = offset + cMarkerPadding + 1 - minPrefWidth();
                         break;
-                    case LNONE:
+                    case NoneListStyle:
                         break;
                     default:
                         marginLeft = m_text.isEmpty() ? 0 : offset / 2;
@@ -833,42 +1392,99 @@ IntRect RenderListMarker::getRelativeMarkerRect()
     if (isImage())
         return IntRect(x(), y(), m_image->imageSize(this, style()->effectiveZoom()).width(), m_image->imageSize(this, style()->effectiveZoom()).height());
 
-    switch (style()->listStyleType()) {
-        case DISC:
-        case CIRCLE:
-        case SQUARE: {
+    EListStyleType type = style()->listStyleType();
+    switch (type) {
+        case Disc:
+        case Circle:
+        case Square: {
             // FIXME: Are these particular rounding rules necessary?
             const Font& font = style()->font();
             int ascent = font.ascent();
             int bulletWidth = (ascent * 2 / 3 + 1) / 2;
             return IntRect(x() + 1, y() + 3 * (ascent - ascent * 2 / 3) / 2, bulletWidth, bulletWidth);
         }
-        case LNONE:
+        case NoneListStyle:
             return IntRect();
-        case ARMENIAN:
-        case CJK_IDEOGRAPHIC:
-        case DECIMAL_LEADING_ZERO:
-        case GEORGIAN:
-        case HEBREW:
-        case HIRAGANA:
-        case HIRAGANA_IROHA:
-        case KATAKANA:
-        case KATAKANA_IROHA:
-        case LDECIMAL:
-        case LOWER_ALPHA:
-        case LOWER_GREEK:
-        case LOWER_LATIN:
-        case LOWER_ROMAN:
-        case UPPER_ALPHA:
-        case UPPER_LATIN:
-        case UPPER_ROMAN:
+        case Afar:
+        case Amharic:
+        case AmharicAbegede:
+        case ArabicIndic:
+        case Armenian:
+        case BinaryListStyle:
+        case Bengali:
+        case Cambodian:
+        case CJKIdeographic:
+        case CjkEarthlyBranch:
+        case CjkHeavenlyStem:
+        case DecimalLeadingZero:
+        case DecimalListStyle:
+        case Devanagari:
+        case Ethiopic:
+        case EthiopicAbegede:
+        case EthiopicAbegedeAmEt:
+        case EthiopicAbegedeGez:
+        case EthiopicAbegedeTiEr:
+        case EthiopicAbegedeTiEt:
+        case EthiopicHalehameAaEr:
+        case EthiopicHalehameAaEt:
+        case EthiopicHalehameAmEt:
+        case EthiopicHalehameGez:
+        case EthiopicHalehameOmEt:
+        case EthiopicHalehameSidEt:
+        case EthiopicHalehameSoEt:
+        case EthiopicHalehameTiEr:
+        case EthiopicHalehameTiEt:
+        case EthiopicHalehameTig:
+        case Georgian:
+        case Gujarati:
+        case Gurmukhi:
+        case Hangul:
+        case HangulConsonant:
+        case Hebrew:
+        case Hiragana:
+        case HiraganaIroha:
+        case Kannada:
+        case Katakana:
+        case KatakanaIroha:
+        case Khmer:
+        case Lao:
+        case LowerAlpha:
+        case LowerGreek:
+        case LowerHexadecimal:
+        case LowerLatin:
+        case LowerNorwegian:
+        case LowerRoman:
+        case Malayalam:
+        case Mongolian:
+        case Myanmar:
+        case Octal:
+        case Oriya:
+        case Oromo:
+        case Persian:
+        case Sidama:
+        case Somali:
+        case Telugu:
+        case Thai:
+        case Tibetan:
+        case Tigre:
+        case TigrinyaEr:
+        case TigrinyaErAbegede:
+        case TigrinyaEt:
+        case TigrinyaEtAbegede:
+        case UpperAlpha:
+        case UpperGreek:
+        case UpperHexadecimal:
+        case UpperLatin:
+        case UpperNorwegian:
+        case UpperRoman:
+        case Urdu:
             if (m_text.isEmpty())
                 return IntRect();
             const Font& font = style()->font();
             int itemWidth = font.width(m_text);
-            const UChar periodSpace[2] = { '.', ' ' };
-            int periodSpaceWidth = font.width(TextRun(periodSpace, 2));
-            return IntRect(x(), y() + font.ascent(), itemWidth + periodSpaceWidth, font.height());
+            UChar suffixSpace[2] = { listMarkerSuffix(type), ' ' };
+            int suffixSpaceWidth = font.width(TextRun(suffixSpace, 2));
+            return IntRect(x(), y() + font.ascent(), itemWidth + suffixSpaceWidth, font.height());
     }
 
     return IntRect();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.h b/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.h
index 5b46278daa..971877b41f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.h
@@ -73,6 +73,7 @@ private:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     IntRect getRelativeMarkerRect();
+    IntRect localSelectionRect();
 
     String m_text;
     RefPtr<StyleImage> m_image;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.h b/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.h
index 886c3431b1..1651454df5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.h
@@ -53,7 +53,7 @@ namespace WebCore {
 class RenderLayer;
 
 // This class handles the auto-scrolling of layers with overflow: marquee.
-class RenderMarquee {
+class RenderMarquee : public Noncopyable {
 public:
     RenderMarquee(RenderLayer*);
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
index 1d4da23381..7100435a96 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -45,32 +45,30 @@ using namespace HTMLNames;
 
 static const double cTimeUpdateRepeatDelay = 0.2;
 static const double cOpacityAnimationRepeatDelay = 0.05;
-// FIXME get this from style
-static const double cOpacityAnimationDurationFadeIn = 0.1;
-static const double cOpacityAnimationDurationFadeOut = 0.3;
 
 RenderMedia::RenderMedia(HTMLMediaElement* video)
-    : RenderReplaced(video)
+    : RenderImage(video)
     , m_timeUpdateTimer(this, &RenderMedia::timeUpdateTimerFired)
     , m_opacityAnimationTimer(this, &RenderMedia::opacityAnimationTimerFired)
     , m_mouseOver(false)
     , m_opacityAnimationStartTime(0)
-    , m_opacityAnimationDuration(cOpacityAnimationDurationFadeIn)
+    , m_opacityAnimationDuration(0)
     , m_opacityAnimationFrom(0)
     , m_opacityAnimationTo(1.0f)
 {
 }
 
 RenderMedia::RenderMedia(HTMLMediaElement* video, const IntSize& intrinsicSize)
-    : RenderReplaced(video, intrinsicSize)
+    : RenderImage(video)
     , m_timeUpdateTimer(this, &RenderMedia::timeUpdateTimerFired)
     , m_opacityAnimationTimer(this, &RenderMedia::opacityAnimationTimerFired)
     , m_mouseOver(false)
     , m_opacityAnimationStartTime(0)
-    , m_opacityAnimationDuration(cOpacityAnimationDurationFadeIn)
+    , m_opacityAnimationDuration(0)
     , m_opacityAnimationFrom(0)
     , m_opacityAnimationTo(1.0f)
 {
+    setIntrinsicSize(intrinsicSize);
 }
 
 RenderMedia::~RenderMedia()
@@ -89,7 +87,7 @@ void RenderMedia::destroy()
         m_controlsShadowRoot->detach();
         m_controlsShadowRoot = 0;
     }
-    RenderReplaced::destroy();
+    RenderImage::destroy();
 }
 
 HTMLMediaElement* RenderMedia::mediaElement() const
@@ -104,7 +102,7 @@ MediaPlayer* RenderMedia::player() const
 
 void RenderMedia::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
-    RenderReplaced::styleDidChange(diff, oldStyle);
+    RenderImage::styleDidChange(diff, oldStyle);
 
     if (m_controlsShadowRoot) {
         if (m_panel)
@@ -121,6 +119,8 @@ void RenderMedia::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
             m_rewindButton->updateStyle();
         if (m_returnToRealtimeButton)
             m_returnToRealtimeButton->updateStyle();
+        if (m_toggleClosedCaptionsButton)
+            m_toggleClosedCaptionsButton->updateStyle();
         if (m_statusDisplay)
             m_statusDisplay->updateStyle();
         if (m_timelineContainer)
@@ -144,7 +144,7 @@ void RenderMedia::layout()
 {
     IntSize oldSize = contentBoxRect().size();
 
-    RenderReplaced::layout();
+    RenderImage::layout();
 
     RenderBox* controlsRenderer = m_controlsShadowRoot ? m_controlsShadowRoot->renderBox() : 0;
     if (!controlsRenderer)
@@ -223,6 +223,13 @@ void RenderMedia::createReturnToRealtimeButton()
     m_returnToRealtimeButton->attachToParent(m_panel.get());
 }
 
+void RenderMedia::createToggleClosedCaptionsButton()
+{
+    ASSERT(!m_toggleClosedCaptionsButton);
+    m_toggleClosedCaptionsButton = new MediaControlToggleClosedCaptionsButtonElement(document(), mediaElement());
+    m_toggleClosedCaptionsButton->attachToParent(m_panel.get());
+}
+
 void RenderMedia::createStatusDisplay()
 {
     ASSERT(!m_statusDisplay);
@@ -310,6 +317,7 @@ void RenderMedia::updateControls()
             m_volumeSliderContainer = 0;
             m_volumeSlider = 0;
             m_controlsShadowRoot = 0;
+            m_toggleClosedCaptionsButton = 0;
         }
         m_opacityAnimationTo = 1.0f;
         m_opacityAnimationTimer.stop();
@@ -333,6 +341,7 @@ void RenderMedia::updateControls()
             }
             createSeekBackButton();
             createSeekForwardButton();
+            createToggleClosedCaptionsButton();
             createFullscreenButton();
             createMuteButton();
             createVolumeSliderContainer();
@@ -379,6 +388,8 @@ void RenderMedia::updateControls()
         m_rewindButton->update();
     if (m_returnToRealtimeButton)
         m_returnToRealtimeButton->update();
+    if (m_toggleClosedCaptionsButton)
+        m_toggleClosedCaptionsButton->update();
     if (m_statusDisplay)
         m_statusDisplay->update();
     if (m_fullscreenButton)
@@ -401,10 +412,15 @@ void RenderMedia::updateTimeDisplay()
 {
     if (!m_currentTimeDisplay || !m_currentTimeDisplay->renderer() || m_currentTimeDisplay->renderer()->style()->display() == NONE || style()->visibility() != VISIBLE)
         return;
+
     float now = mediaElement()->currentTime();
     float duration = mediaElement()->duration();
 
+    // Allow the theme to format the time
+    ExceptionCode ec;
+    m_currentTimeDisplay->setInnerText(theme()->formatMediaControlsCurrentTime(now, duration), ec);
     m_currentTimeDisplay->setCurrentValue(now);
+    m_timeRemainingDisplay->setInnerText(theme()->formatMediaControlsRemainingTime(now, duration), ec);
     m_timeRemainingDisplay->setCurrentValue(now - duration);
 }
 
@@ -439,9 +455,9 @@ void RenderMedia::updateControlVisibility()
     }
 
     if (animateFrom < animateTo)
-        m_opacityAnimationDuration = cOpacityAnimationDurationFadeIn;
+        m_opacityAnimationDuration = m_panel->renderer()->theme()->mediaControlsFadeInDuration();
     else
-        m_opacityAnimationDuration = cOpacityAnimationDurationFadeOut;
+        m_opacityAnimationDuration = m_panel->renderer()->theme()->mediaControlsFadeOutDuration();
 
     m_opacityAnimationFrom = animateFrom;
     m_opacityAnimationTo = animateTo;
@@ -535,6 +551,9 @@ void RenderMedia::forwardEvent(Event* event)
         if (m_returnToRealtimeButton && m_returnToRealtimeButton->hitTest(point))
             m_returnToRealtimeButton->defaultEventHandler(event);
 
+       if (m_toggleClosedCaptionsButton && m_toggleClosedCaptionsButton->hitTest(point))
+            m_toggleClosedCaptionsButton->defaultEventHandler(event);
+
         if (m_timeline && m_timeline->hitTest(point))
             m_timeline->defaultEventHandler(event);
 
@@ -557,7 +576,7 @@ void RenderMedia::forwardEvent(Event* event)
 
 int RenderMedia::lowestPosition(bool includeOverflowInterior, bool includeSelf) const
 {
-    int bottom = RenderReplaced::lowestPosition(includeOverflowInterior, includeSelf);
+    int bottom = RenderImage::lowestPosition(includeOverflowInterior, includeSelf);
     if (!m_controlsShadowRoot || !m_controlsShadowRoot->renderer())
         return bottom;
     
@@ -566,7 +585,7 @@ int RenderMedia::lowestPosition(bool includeOverflowInterior, bool includeSelf)
 
 int RenderMedia::rightmostPosition(bool includeOverflowInterior, bool includeSelf) const
 {
-    int right = RenderReplaced::rightmostPosition(includeOverflowInterior, includeSelf);
+    int right = RenderImage::rightmostPosition(includeOverflowInterior, includeSelf);
     if (!m_controlsShadowRoot || !m_controlsShadowRoot->renderer())
         return right;
     
@@ -575,7 +594,7 @@ int RenderMedia::rightmostPosition(bool includeOverflowInterior, bool includeSel
 
 int RenderMedia::leftmostPosition(bool includeOverflowInterior, bool includeSelf) const
 {
-    int left = RenderReplaced::leftmostPosition(includeOverflowInterior, includeSelf);
+    int left = RenderImage::leftmostPosition(includeOverflowInterior, includeSelf);
     if (!m_controlsShadowRoot || !m_controlsShadowRoot->renderer())
         return left;
     
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h
index 602cd2648a..0d24c4c596 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,7 +28,7 @@
 
 #if ENABLE(VIDEO)
 
-#include "RenderReplaced.h"
+#include "RenderImage.h"
 #include "Timer.h"
 
 namespace WebCore {
@@ -40,6 +40,7 @@ class MediaControlPlayButtonElement;
 class MediaControlSeekButtonElement;
 class MediaControlRewindButtonElement;
 class MediaControlReturnToRealtimeButtonElement;
+class MediaControlToggleClosedCaptionsButtonElement;
 class MediaControlTimelineElement;
 class MediaControlVolumeSliderElement;
 class MediaControlFullscreenButtonElement;
@@ -50,12 +51,12 @@ class MediaControlVolumeSliderContainerElement;
 class MediaControlElement;
 class MediaPlayer;
 
-class RenderMedia : public RenderReplaced {
+class RenderMedia : public RenderImage {
 public:
     RenderMedia(HTMLMediaElement*);
     RenderMedia(HTMLMediaElement*, const IntSize& intrinsicSize);
     virtual ~RenderMedia();
-    
+
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
@@ -82,6 +83,7 @@ private:
     
     virtual const char* renderName() const { return "RenderMedia"; }
     virtual bool isMedia() const { return true; }
+    virtual bool isImage() const { return false; }
 
     virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
     virtual int rightmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
@@ -96,6 +98,7 @@ private:
     void createSeekForwardButton();
     void createRewindButton();
     void createReturnToRealtimeButton();
+    void createToggleClosedCaptionsButton();
     void createStatusDisplay();
     void createTimelineContainer();
     void createTimeline();
@@ -123,6 +126,7 @@ private:
     RefPtr<MediaControlSeekButtonElement> m_seekForwardButton;
     RefPtr<MediaControlRewindButtonElement> m_rewindButton;
     RefPtr<MediaControlReturnToRealtimeButtonElement> m_returnToRealtimeButton;
+    RefPtr<MediaControlToggleClosedCaptionsButtonElement> m_toggleClosedCaptionsButton;
     RefPtr<MediaControlTimelineElement> m_timeline;
     RefPtr<MediaControlVolumeSliderElement> m_volumeSlider;
     RefPtr<MediaControlFullscreenButtonElement> m_fullscreenButton;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp
index 9cc1493f52..17576ae06b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp
@@ -90,6 +90,15 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
         case MediaFullscreenButton:
             paintThemePart(SafariTheme::MediaFullscreenButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
             break;
+        case MediaShowClosedCaptionsButton:
+        case MediaHideClosedCaptionsButton:
+#if SAFARI_THEME_VERSION >= 4
+            if (MediaControlToggleClosedCaptionsButtonElement* btn = static_cast<MediaControlToggleClosedCaptionsButtonElement*>(o->node())) {
+                bool captionsVisible = btn->displayType() == MediaHideClosedCaptionsButton;
+                paintThemePart(captionsVisible ? SafariTheme::MediaHideClosedCaptionsButtonPart : SafariTheme::MediaShowClosedCaptionsButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+            }
+#endif
+            break;
         case MediaMuteButton:
         case MediaUnMuteButton:
             if (MediaControlMuteButtonElement* btn = static_cast<MediaControlMuteButtonElement*>(o->node())) {
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.cpp
index 56fbec43c2..50feb4604e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -63,7 +63,7 @@ static bool hasSource(const HTMLMediaElement* mediaElement)
 static bool paintMediaButton(GraphicsContext* context, const IntRect& rect, Image* image)
 {
     IntRect imageRect = image->rect();
-    context->drawImage(image, rect);
+    context->drawImage(image, DeviceColorSpace, rect);
     return true;
 }
 
@@ -114,9 +114,9 @@ static bool paintMediaSlider(RenderObject* object, const RenderObject::PaintInfo
     context->save();
     context->setShouldAntialias(true);
     context->setStrokeStyle(SolidStroke);
-    context->setStrokeColor(style->borderLeftColor());
+    context->setStrokeColor(style->borderLeftColor(), DeviceColorSpace);
     context->setStrokeThickness(style->borderLeftWidth());
-    context->setFillColor(style->backgroundColor());
+    context->setFillColor(style->backgroundColor(), DeviceColorSpace);
     context->drawRect(rect);
     context->restore();
 
@@ -172,13 +172,13 @@ static bool paintMediaVolumeSlider(RenderObject* object, const RenderObject::Pai
     GraphicsContext* context = paintInfo.context;
     Color originalColor = context->strokeColor();
     if (originalColor != Color::white)
-        context->setStrokeColor(Color::white);
+        context->setStrokeColor(Color::white, DeviceColorSpace);
 
     int x = rect.x() + rect.width() / 2;
     context->drawLine(IntPoint(x, rect.y()),  IntPoint(x, rect.y() + rect.height()));
 
     if (originalColor != Color::white)
-        context->setStrokeColor(originalColor);
+        context->setStrokeColor(originalColor, DeviceColorSpace);
     return true;
 }
 
@@ -207,17 +207,17 @@ static bool paintMediaTimelineContainer(RenderObject* object, const RenderObject
 
         // Draw the left border using CSS defined width and color.
         context->setStrokeThickness(object->style()->borderLeftWidth());
-        context->setStrokeColor(object->style()->borderLeftColor().rgb());
+        context->setStrokeColor(object->style()->borderLeftColor().rgb(), DeviceColorSpace);
         context->drawLine(IntPoint(rect.x() + 1, rect.y()),
                           IntPoint(rect.x() + 1, rect.y() + rect.height()));
 
         // Draw the right border using CSS defined width and color.
         context->setStrokeThickness(object->style()->borderRightWidth());
-        context->setStrokeColor(object->style()->borderRightColor().rgb());
+        context->setStrokeColor(object->style()->borderRightColor().rgb(), DeviceColorSpace);
         context->drawLine(IntPoint(rect.x() + rect.width() - 1, rect.y()),
                           IntPoint(rect.x() + rect.width() - 1, rect.y() + rect.height()));
 
-        context->setStrokeColor(originalColor);
+        context->setStrokeColor(originalColor, DeviceColorSpace);
         context->setStrokeThickness(originalThickness);
         context->setStrokeStyle(originalStyle);
     }
@@ -275,6 +275,8 @@ bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType
     case MediaRewindButton:
     case MediaReturnToRealtimeButton:
     case MediaStatusDisplay:
+    case MediaShowClosedCaptionsButton:
+    case MediaHideClosedCaptionsButton:
         ASSERT_NOT_REACHED();
         break;
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp
index cbbc7cbad9..518925af56 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp
@@ -1,7 +1,8 @@
 /*
  * This file is part of the select element renderer in WebCore.
  *
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *               2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ -24,6 +25,8 @@
 #include "config.h"
 #include "RenderMenuList.h"
 
+#include "AXObjectCache.h"
+#include "AccessibilityObject.h"
 #include "CSSStyleSelector.h"
 #include "Frame.h"
 #include "FrameView.h"
@@ -50,6 +53,7 @@ RenderMenuList::RenderMenuList(Element* element)
     , m_innerBlock(0)
     , m_optionsChanged(true)
     , m_optionsWidth(0)
+    , m_lastSelectedIndex(-1)
     , m_popup(0)
     , m_popupIsVisible(false)
 {
@@ -306,10 +310,39 @@ void RenderMenuList::valueChanged(unsigned listIndex, bool fireOnChange)
     select->setSelectedIndexByUser(select->listToOptionIndex(listIndex), true, fireOnChange);
 }
 
+#if ENABLE(NO_LISTBOX_RENDERING)
+void RenderMenuList::listBoxSelectItem(int listIndex, bool allowMultiplySelections, bool shift, bool fireOnChangeNow)
+{
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    select->listBoxSelectItem(select->listToOptionIndex(listIndex), allowMultiplySelections, shift, fireOnChangeNow);
+}
+
+bool RenderMenuList::multiple()
+{
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    return select->multiple();
+}
+#endif
+
+void RenderMenuList::didSetSelectedIndex()
+{
+    int index = selectedIndex();
+    if (m_lastSelectedIndex == index)
+        return;
+
+    m_lastSelectedIndex = index;
+
+    if (AXObjectCache::accessibilityEnabled())
+        document()->axObjectCache()->postNotification(this, AXObjectCache::AXMenuListValueChanged, true, PostSynchronously);
+}
+
 String RenderMenuList::itemText(unsigned listIndex) const
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
-    Element* element = select->listItems()[listIndex];
+    const Vector<Element*>& listItems = select->listItems();
+    if (listIndex >= listItems.size())
+        return String();
+    Element* element = listItems[listIndex];
     if (OptionGroupElement* optionGroupElement = toOptionGroupElement(element))
         return optionGroupElement->groupLabelText();
     else if (OptionElement* optionElement = toOptionElement(element))
@@ -317,17 +350,34 @@ String RenderMenuList::itemText(unsigned listIndex) const
     return String();
 }
 
+String RenderMenuList::itemAccessibilityText(unsigned listIndex) const
+{
+    // Allow the accessible name be changed if necessary.
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    const Vector<Element*>& listItems = select->listItems();
+    if (listIndex >= listItems.size())
+        return String();
+
+    return AccessibilityObject::getAttribute(listItems[listIndex], aria_labelAttr); 
+}
+    
 String RenderMenuList::itemToolTip(unsigned listIndex) const
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
-    Element* element = select->listItems()[listIndex];
+    const Vector<Element*>& listItems = select->listItems();
+    if (listIndex >= listItems.size())
+        return String();
+    Element* element = listItems[listIndex];
     return element->title();
 }
 
 bool RenderMenuList::itemIsEnabled(unsigned listIndex) const
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
-    Element* element = select->listItems()[listIndex];
+    const Vector<Element*>& listItems = select->listItems();
+    if (listIndex >= listItems.size())
+        return false;
+    Element* element = listItems[listIndex];
     if (!isOptionElement(element))
         return false;
 
@@ -345,7 +395,18 @@ bool RenderMenuList::itemIsEnabled(unsigned listIndex) const
 PopupMenuStyle RenderMenuList::itemStyle(unsigned listIndex) const
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
-    Element* element = select->listItems()[listIndex];
+    const Vector<Element*>& listItems = select->listItems();
+    if (listIndex >= listItems.size()) {
+        // If we are making an out of bounds access, then we want to use the style
+        // of a different option element (index 0). However, if there isn't an option element
+        // before at index 0, we fall back to the menu's style.
+        if (!listIndex)
+            return menuStyle();
+
+        // Try to retrieve the style of an option element we know exists (index 0).
+        listIndex = 0;
+    }
+    Element* element = listItems[listIndex];
     
     RenderStyle* style = element->renderStyle() ? element->renderStyle() : element->computedStyle();
     return style ? PopupMenuStyle(style->color(), itemBackgroundColor(listIndex), style->font(), style->visibility() == VISIBLE, style->textIndent(), style->direction()) : menuStyle();
@@ -354,7 +415,10 @@ PopupMenuStyle RenderMenuList::itemStyle(unsigned listIndex) const
 Color RenderMenuList::itemBackgroundColor(unsigned listIndex) const
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
-    Element* element = select->listItems()[listIndex];
+    const Vector<Element*>& listItems = select->listItems();
+    if (listIndex >= listItems.size())
+        return style()->backgroundColor();
+    Element* element = listItems[listIndex];
 
     Color backgroundColor;
     if (element->renderStyle())
@@ -374,7 +438,6 @@ Color RenderMenuList::itemBackgroundColor(unsigned listIndex) const
 
 PopupMenuStyle RenderMenuList::menuStyle() const
 {
-
     RenderStyle* s = m_innerBlock ? m_innerBlock->style() : style();
     return PopupMenuStyle(s->color(), s->backgroundColor(), s->font(), s->visibility() == VISIBLE, s->textIndent(), s->direction());
 }
@@ -410,8 +473,19 @@ int RenderMenuList::clientPaddingLeft() const
     return paddingLeft();
 }
 
+const int endOfLinePadding = 2;
 int RenderMenuList::clientPaddingRight() const
 {
+    if (style()->appearance() == MenulistPart || style()->appearance() == MenulistButtonPart) {
+        // For these appearance values, the theme applies padding to leave room for the
+        // drop-down button. But leaving room for the button inside the popup menu itself
+        // looks strange, so we return a small default padding to avoid having a large empty
+        // space appear on the side of the popup menu.
+        return endOfLinePadding;
+    }
+
+    // If the appearance isn't MenulistPart, then the select is styled (non-native), so
+    // we want to return the user specified padding.
     return paddingRight();
 }
 
@@ -435,21 +509,30 @@ void RenderMenuList::popupDidHide()
 bool RenderMenuList::itemIsSeparator(unsigned listIndex) const
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
-    Element* element = select->listItems()[listIndex];
+    const Vector<Element*>& listItems = select->listItems();
+    if (listIndex >= listItems.size())
+        return false;
+    Element* element = listItems[listIndex];
     return element->hasTagName(hrTag);
 }
 
 bool RenderMenuList::itemIsLabel(unsigned listIndex) const
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
-    Element* element = select->listItems()[listIndex];
+    const Vector<Element*>& listItems = select->listItems();
+    if (listIndex >= listItems.size())
+        return false;
+    Element* element = listItems[listIndex];
     return isOptionGroupElement(element);
 }
 
 bool RenderMenuList::itemIsSelected(unsigned listIndex) const
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
-    Element* element = select->listItems()[listIndex];
+    const Vector<Element*>& listItems = select->listItems();
+    if (listIndex >= listItems.size())
+        return false;
+    Element* element = listItems[listIndex];
     if (OptionElement* optionElement = toOptionElement(element))
         return optionElement->selected();
     return false;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h
index 2d617c115d..aeb62058b6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h
@@ -1,7 +1,8 @@
 /*
  * This file is part of the select element renderer in WebCore.
  *
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -37,7 +38,12 @@ namespace WebCore {
 class PopupMenu;
 class RenderText;
 
+#if ENABLE(NO_LISTBOX_RENDERING)
+class RenderMenuList : public RenderFlexibleBox, private ListPopupMenuClient {
+#else
 class RenderMenuList : public RenderFlexibleBox, private PopupMenuClient {
+#endif
+
 public:
     RenderMenuList(Element*);
     virtual ~RenderMenuList();
@@ -49,6 +55,8 @@ public:
 
     void setOptionsChanged(bool changed) { m_optionsChanged = changed; }
 
+    void didSetSelectedIndex();
+
     String text() const;
 
 private:
@@ -73,6 +81,7 @@ private:
     // PopupMenuClient methods
     virtual String itemText(unsigned listIndex) const;
     virtual String itemToolTip(unsigned listIndex) const;
+    virtual String itemAccessibilityText(unsigned listIndex) const;
     virtual bool itemIsEnabled(unsigned listIndex) const;
     virtual PopupMenuStyle itemStyle(unsigned listIndex) const;
     virtual PopupMenuStyle menuStyle() const;
@@ -94,6 +103,11 @@ private:
     virtual HostWindow* hostWindow() const;
     virtual PassRefPtr<Scrollbar> createScrollbar(ScrollbarClient*, ScrollbarOrientation, ScrollbarControlSize);
 
+#if ENABLE(NO_LISTBOX_RENDERING)
+    virtual void listBoxSelectItem(int listIndex, bool allowMultiplySelections, bool shift, bool fireOnChangeNow = true);
+    virtual bool multiple();
+#endif
+
     virtual bool hasLineIfEmpty() const { return true; }
 
     Color itemBackgroundColor(unsigned listIndex) const;
@@ -110,6 +124,8 @@ private:
     bool m_optionsChanged;
     int m_optionsWidth;
 
+    int m_lastSelectedIndex;
+
     RefPtr<PopupMenu> m_popup;
     bool m_popupIsVisible;
 };
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
index 199de4a224..8212dcad32 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
@@ -4,6 +4,7 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ -27,6 +28,7 @@
 #include "RenderObject.h"
 
 #include "AXObjectCache.h"
+#include "Chrome.h"
 #include "CSSStyleSelector.h"
 #include "FloatQuad.h"
 #include "Frame.h"
@@ -41,6 +43,8 @@
 #include "RenderImageGeneratedContent.h"
 #include "RenderInline.h"
 #include "RenderListItem.h"
+#include "RenderRuby.h"
+#include "RenderRubyText.h"
 #include "RenderTableCell.h"
 #include "RenderTableCol.h"
 #include "RenderTableRow.h"
@@ -61,6 +65,11 @@
 #include "WMLNames.h"
 #endif
 
+#if ENABLE(SVG)
+#include "RenderSVGResource.h"
+#include "SVGRenderSupport.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -103,46 +112,44 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
         return image;
     }
 
-    RenderObject* o = 0;
+#if ENABLE(RUBY)
+    if (node->hasTagName(rubyTag)) {
+        if (style->display() == INLINE)
+            return new (arena) RenderRubyAsInline(node);
+        else
+            return new (arena) RenderRubyAsBlock(node);
+    }
+    // treat <rt> as ruby text ONLY if it still has its default treatment of block
+    if (node->hasTagName(rtTag) && style->display() == BLOCK)
+        return new (arena) RenderRubyText(node); 
+#endif
 
     switch (style->display()) {
         case NONE:
-            break;
+            return 0;
         case INLINE:
-            o = new (arena) RenderInline(node);
-            break;
+            return new (arena) RenderInline(node);
         case BLOCK:
-            o = new (arena) RenderBlock(node);
-            break;
         case INLINE_BLOCK:
-            o = new (arena) RenderBlock(node);
-            break;
-        case LIST_ITEM:
-            o = new (arena) RenderListItem(node);
-            break;
         case RUN_IN:
         case COMPACT:
-            o = new (arena) RenderBlock(node);
-            break;
+            return new (arena) RenderBlock(node);
+        case LIST_ITEM:
+            return new (arena) RenderListItem(node);
         case TABLE:
         case INLINE_TABLE:
-            o = new (arena) RenderTable(node);
-            break;
+            return new (arena) RenderTable(node);
         case TABLE_ROW_GROUP:
         case TABLE_HEADER_GROUP:
         case TABLE_FOOTER_GROUP:
-            o = new (arena) RenderTableSection(node);
-            break;
+            return new (arena) RenderTableSection(node);
         case TABLE_ROW:
-            o = new (arena) RenderTableRow(node);
-            break;
+            return new (arena) RenderTableRow(node);
         case TABLE_COLUMN_GROUP:
         case TABLE_COLUMN:
-            o = new (arena) RenderTableCol(node);
-            break;
+            return new (arena) RenderTableCol(node);
         case TABLE_CELL:
-            o = new (arena) RenderTableCell(node);
-            break;
+            return new (arena) RenderTableCell(node);
         case TABLE_CAPTION:
 #if ENABLE(WCSS)
         // As per the section 17.1 of the spec WAP-239-WCSS-20011026-a.pdf, 
@@ -150,15 +157,13 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
         // principal block box ([CSS2] section 9.2.1).
         case WAP_MARQUEE:
 #endif
-            o = new (arena) RenderBlock(node);
-            break;
+            return new (arena) RenderBlock(node);
         case BOX:
         case INLINE_BOX:
-            o = new (arena) RenderFlexibleBox(node);
-            break;
+            return new (arena) RenderFlexibleBox(node);
     }
 
-    return o;
+    return 0;
 }
 
 #ifndef NDEBUG 
@@ -307,7 +312,7 @@ void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
         // Just add it...
         children->insertChildNode(this, newChild, beforeChild);
     }
-    
+    RenderCounter::rendererSubtreeAttached(newChild);
     if (newChild->isText() && newChild->style()->textTransform() == CAPITALIZE) {
         RefPtr<StringImpl> textToTransform = toRenderText(newChild)->originalText();
         if (textToTransform)
@@ -366,19 +371,14 @@ RenderObject* RenderObject::nextInPreOrderAfterChildren(RenderObject* stayWithin
     if (this == stayWithin)
         return 0;
 
-    RenderObject* o;
-    if (!(o = nextSibling())) {
-        o = parent();
-        while (o && !o->nextSibling()) {
-            if (o == stayWithin)
-                return 0;
-            o = o->parent();
-        }
-        if (o)
-            o = o->nextSibling();
+    const RenderObject* current = this;
+    RenderObject* next;
+    while (!(next = current->nextSibling())) {
+        current = current->parent();
+        if (!current || current == stayWithin)
+            return 0;
     }
-
-    return o;
+    return next;
 }
 
 RenderObject* RenderObject::previousInPreOrder() const
@@ -643,7 +643,7 @@ RenderBlock* RenderObject::containingBlock() const
     }
 
     if (!o || !o->isRenderBlock())
-        return 0; // Probably doesn't happen any more, but leave just in case. -dwh
+        return 0; // This can still happen in case of an orphaned tree
 
     return toRenderBlock(o);
 }
@@ -719,7 +719,7 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
             return;
         case DOTTED:
         case DASHED:
-            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeColor(c, m_style->colorSpace());
             graphicsContext->setStrokeThickness(width);
             graphicsContext->setStrokeStyle(style == DASHED ? DashedStroke : DottedStroke);
 
@@ -740,7 +740,7 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
 
             if (adjbw1 == 0 && adjbw2 == 0) {
                 graphicsContext->setStrokeStyle(NoStroke);
-                graphicsContext->setFillColor(c);
+                graphicsContext->setFillColor(c, m_style->colorSpace());
                 switch (s) {
                     case BSTop:
                     case BSBottom:
@@ -853,7 +853,7 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
             // fall through
         case SOLID: {
             graphicsContext->setStrokeStyle(NoStroke);
-            graphicsContext->setFillColor(c);
+            graphicsContext->setFillColor(c, m_style->colorSpace());
             ASSERT(x2 >= x1);
             ASSERT(y2 >= y1);
             if (!adjbw1 && !adjbw2) {
@@ -913,7 +913,7 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
             return;
         case DOTTED:
         case DASHED:
-            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeColor(c, m_style->colorSpace());
             graphicsContext->setStrokeStyle(style == DOTTED ? DottedStroke : DashedStroke);
             graphicsContext->setStrokeThickness(thickness);
             graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
@@ -935,7 +935,7 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
             }
 
             graphicsContext->setStrokeStyle(SolidStroke);
-            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeColor(c, m_style->colorSpace());
             graphicsContext->setStrokeThickness(third);
             graphicsContext->strokeArc(IntRect(x, outerY, radius.width() * 2, outerHeight), angleStart, angleSpan);
             graphicsContext->setStrokeThickness(innerThird > 2 ? innerThird - 1 : innerThird);
@@ -954,13 +954,13 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
             }
 
             graphicsContext->setStrokeStyle(SolidStroke);
-            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeColor(c, m_style->colorSpace());
             graphicsContext->setStrokeThickness(thickness);
             graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
 
             float halfThickness = (thickness + 1.0f) / 4.0f;
             int shiftForInner = static_cast<int>(halfThickness * 1.5f);
-            graphicsContext->setStrokeColor(c2);
+            graphicsContext->setStrokeColor(c2, m_style->colorSpace());
             graphicsContext->setStrokeThickness(halfThickness > 2 ? halfThickness - 1 : halfThickness);
             graphicsContext->strokeArc(IntRect(x + shiftForInner, y + shiftForInner, (radius.width() - shiftForInner) * 2,
                                        (radius.height() - shiftForInner) * 2), angleStart, angleSpan);
@@ -974,7 +974,7 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
                 c = c.dark();
         case SOLID:
             graphicsContext->setStrokeStyle(SolidStroke);
-            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeColor(c, m_style->colorSpace());
             graphicsContext->setStrokeThickness(thickness);
             graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
             break;
@@ -1011,13 +1011,12 @@ void RenderObject::paintOutline(GraphicsContext* graphicsContext, int tx, int ty
     if (style->outlineStyleIsAuto() || hasOutlineAnnotation()) {
         if (!theme()->supportsFocusRing(style)) {
             // Only paint the focus ring by hand if the theme isn't able to draw the focus ring.
-            graphicsContext->initFocusRing(ow, offset);
-            addFocusRingRects(graphicsContext, tx, ty);
+            Vector<IntRect> focusRingRects;
+            addFocusRingRects(focusRingRects, tx, ty);
             if (style->outlineStyleIsAuto())
-                graphicsContext->drawFocusRing(oc);
+                graphicsContext->drawFocusRing(focusRingRects, ow, offset, oc);
             else
-                addPDFURLRect(graphicsContext, graphicsContext->focusRingBoundingRect());
-            graphicsContext->clearFocusRing();
+                addPDFURLRect(graphicsContext, unionRect(focusRingRects));
         }
     }
 
@@ -1075,6 +1074,23 @@ IntRect RenderObject::absoluteBoundingBoxRect(bool useTransforms)
     return result;
 }
 
+void RenderObject::absoluteFocusRingQuads(Vector<FloatQuad>& quads)
+{
+    Vector<IntRect> rects;
+    // FIXME: addFocusRingRects() needs to be passed this transform-unaware
+    // localToAbsolute() offset here because RenderInline::addFocusRingRects()
+    // implicitly assumes that. This doesn't work correctly with transformed
+    // descendants.
+    FloatPoint absolutePoint = localToAbsolute();
+    addFocusRingRects(rects, absolutePoint.x(), absolutePoint.y());
+    size_t count = rects.size();
+    for (size_t i = 0; i < count; ++i) {
+        IntRect rect = rects[i];
+        rect.move(-absolutePoint.x(), -absolutePoint.y());
+        quads.append(localToAbsoluteQuad(FloatQuad(rect)));
+    }
+}
+
 void RenderObject::addAbsoluteRectForLayer(IntRect& result)
 {
     if (hasLayer())
@@ -1163,13 +1179,14 @@ void RenderObject::repaintRectangle(const IntRect& r, bool immediate)
     repaintUsingContainer(repaintContainer ? repaintContainer : view, dirtyRect, immediate);
 }
 
-bool RenderObject::repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintContainer, const IntRect& oldBounds, const IntRect& oldOutlineBox)
+bool RenderObject::repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintContainer, const IntRect& oldBounds, const IntRect& oldOutlineBox, const IntRect* newBoundsPtr, const IntRect* newOutlineBoxRectPtr)
 {
     RenderView* v = view();
     if (v->printing())
         return false; // Don't repaint if we're printing.
 
-    IntRect newBounds = clippedOverflowRectForRepaint(repaintContainer);
+    ASSERT(!newBoundsPtr || *newBoundsPtr == clippedOverflowRectForRepaint(repaintContainer));
+    IntRect newBounds = newBoundsPtr ? *newBoundsPtr : clippedOverflowRectForRepaint(repaintContainer);
     IntRect newOutlineBox;
 
     bool fullRepaint = selfNeedsLayout();
@@ -1177,7 +1194,8 @@ bool RenderObject::repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintConta
     if (!fullRepaint && style()->borderFit() == BorderFitLines)
         fullRepaint = true;
     if (!fullRepaint) {
-        newOutlineBox = outlineBoundsForRepaint(repaintContainer);
+        ASSERT(!newOutlineBoxRectPtr || *newOutlineBoxRectPtr == outlineBoundsForRepaint(repaintContainer));
+        newOutlineBox = newOutlineBoxRectPtr ? *newOutlineBoxRectPtr : outlineBoundsForRepaint(repaintContainer);
         if (newOutlineBox.location() != oldOutlineBox.location() || (mustRepaintBackgroundOrBorder() && (newBounds != oldBounds || newOutlineBox != oldOutlineBox)))
             fullRepaint = true;
     }
@@ -1312,11 +1330,10 @@ void RenderObject::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
             // anyway if its size does change.
             RenderBox* boxParent = toRenderBox(o);
 
+            IntRect repaintRect(rect);
+            repaintRect.move(-boxParent->layer()->scrolledContentOffset()); // For overflow:auto/scroll/hidden.
+
             IntRect boxRect(0, 0, boxParent->layer()->width(), boxParent->layer()->height());
-            int x = rect.x();
-            int y = rect.y();
-            boxParent->layer()->subtractScrolledContentOffset(x, y); // For overflow:auto/scroll/hidden.
-            IntRect repaintRect(x, y, rect.width(), rect.height());
             rect = intersection(repaintRect, boxRect);
             if (rect.isEmpty())
                 return;
@@ -1338,6 +1355,50 @@ void RenderObject::showTreeForThis() const
         node()->showTreeForThis();
 }
 
+void RenderObject::showRenderObject() const
+{
+    showRenderObject(0);
+}
+
+void RenderObject::showRenderObject(int printedCharacters) const
+{
+    // As this function is intended to be used when debugging, the
+    // this pointer may be 0.
+    if (!this) {
+        fputs("(null)\n", stderr);
+        return;
+    }
+
+    printedCharacters += fprintf(stderr, "%s %p", renderName(), this);
+
+    if (node()) {
+        if (printedCharacters)
+            for (; printedCharacters < 39; printedCharacters++)
+                fputc(' ', stderr);
+        fputc('\t', stderr);
+        node()->showNode();
+    } else
+        fputc('\n', stderr);
+}
+
+void RenderObject::showRenderTreeAndMark(const RenderObject* markedObject1, const char* markedLabel1, const RenderObject* markedObject2, const char* markedLabel2, int depth) const
+{
+    int printedCharacters = 0;
+    if (markedObject1 == this && markedLabel1)
+        printedCharacters += fprintf(stderr, "%s", markedLabel1);
+    if (markedObject2 == this && markedLabel2)
+        printedCharacters += fprintf(stderr, "%s", markedLabel2);
+    for (; printedCharacters < depth * 2; printedCharacters++)
+        fputc(' ', stderr);
+
+    showRenderObject(printedCharacters);
+    if (!this)
+        return;
+
+    for (const RenderObject* child = firstChild(); child; child = child->nextSibling())
+        child->showRenderTreeAndMark(markedObject1, markedLabel1, markedObject2, markedLabel2, depth + 1);
+}
+
 #endif // NDEBUG
 
 Color RenderObject::selectionBackgroundColor() const
@@ -1611,7 +1672,7 @@ void RenderObject::styleWillChange(StyleDifference diff, const RenderStyle* newS
     }
 }
 
-void RenderObject::styleDidChange(StyleDifference diff, const RenderStyle*)
+void RenderObject::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     if (s_affectsParentBlock)
         handleDynamicFloatPositionChange();
@@ -1619,9 +1680,19 @@ void RenderObject::styleDidChange(StyleDifference diff, const RenderStyle*)
     if (!m_parent)
         return;
     
-    if (diff == StyleDifferenceLayout)
+    if (diff == StyleDifferenceLayout) {
+        RenderCounter::rendererStyleChanged(this, oldStyle, m_style.get());
+
+        // If the object already needs layout, then setNeedsLayout won't do
+        // any work. But if the containing block has changed, then we may need
+        // to mark the new containing blocks for layout. The change that can
+        // directly affect the containing block of this object is a change to
+        // the position style.
+        if (m_needsLayout && oldStyle->position() != m_style->position())
+            markContainingBlocksForLayout();
+
         setNeedsLayoutAndPrefWidthsRecalc();
-    else if (diff == StyleDifferenceLayoutPositionedMovementOnly)
+    } else if (diff == StyleDifferenceLayoutPositionedMovementOnly)
         setNeedsPositionedMovementLayout();
 
     // Don't check for repaint here; we need to wait until the layer has been
@@ -1688,6 +1759,11 @@ void RenderObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, b
     if (!o)
         return;
 
+    IntSize columnOffset;
+    o->adjustForColumns(columnOffset, roundedIntPoint(transformState.mappedPoint()));
+    if (!columnOffset.isZero())
+        transformState.move(columnOffset);
+
     if (o->hasOverflowClip())
         transformState.move(-toRenderBox(o)->layer()->scrolledContentOffset());
 
@@ -1744,18 +1820,23 @@ void RenderObject::getTransformFromContainer(const RenderObject* containerObject
 
 FloatQuad RenderObject::localToContainerQuad(const FloatQuad& localQuad, RenderBoxModelObject* repaintContainer, bool fixed) const
 {
-    TransformState transformState(TransformState::ApplyTransformDirection, FloatPoint(), &localQuad);
+    // Track the point at the center of the quad's bounding box. As mapLocalToContainer() calls offsetFromContainer(),
+    // it will use that point as the reference point to decide which column's transform to apply in multiple-column blocks.
+    TransformState transformState(TransformState::ApplyTransformDirection, localQuad.boundingBox().center(), &localQuad);
     mapLocalToContainer(repaintContainer, fixed, true, transformState);
     transformState.flatten();
     
     return transformState.lastPlanarQuad();
 }
 
-IntSize RenderObject::offsetFromContainer(RenderObject* o) const
+IntSize RenderObject::offsetFromContainer(RenderObject* o, const IntPoint& point) const
 {
     ASSERT(o == container());
 
     IntSize offset;
+
+    o->adjustForColumns(offset, point);
+
     if (o->hasOverflowClip())
         offset -= toRenderBox(o)->layer()->scrolledContentOffset();
 
@@ -1765,6 +1846,7 @@ IntSize RenderObject::offsetFromContainer(RenderObject* o) const
 IntSize RenderObject::offsetFromAncestorContainer(RenderObject* container) const
 {
     IntSize offset;
+    IntPoint referencePoint;
     const RenderObject* currContainer = this;
     do {
         RenderObject* nextContainer = currContainer->container();
@@ -1772,7 +1854,9 @@ IntSize RenderObject::offsetFromAncestorContainer(RenderObject* container) const
         if (!nextContainer)
             break;
         ASSERT(!currContainer->hasTransform());
-        offset += currContainer->offsetFromContainer(nextContainer);
+        IntSize currentOffset = currContainer->offsetFromContainer(nextContainer, referencePoint);
+        offset += currentOffset;
+        referencePoint.move(currentOffset);
         currContainer = nextContainer;
     } while (currContainer != container);
 
@@ -1875,7 +1959,7 @@ void RenderObject::destroy()
 
     // If this renderer is being autoscrolled, stop the autoscroll timer
     
-    // FIXME: RenderObject::destroy should not get called with a renderar whose document
+    // FIXME: RenderObject::destroy should not get called with a renderer whose document
     // has a null frame, so we assert this. However, we don't want release builds to crash which is why we
     // check that the frame is not null.
     ASSERT(document()->frame());
@@ -2376,9 +2460,20 @@ RenderBoxModelObject* RenderObject::offsetParent() const
 
 VisiblePosition RenderObject::createVisiblePosition(int offset, EAffinity affinity)
 {
-    // If this is a non-anonymous renderer, then it's simple.
-    if (Node* node = this->node())
+    // If this is a non-anonymous renderer in an editable area, then it's simple.
+    if (Node* node = this->node()) {
+        if (!node->isContentEditable()) {
+            // If it can be found, we prefer a visually equivalent position that is editable. 
+            Position position(node, offset);
+            Position candidate = position.downstream(Position::CanCrossEditingBoundary);
+            if (candidate.node()->isContentEditable())
+                return VisiblePosition(candidate, affinity);
+            candidate = position.upstream(Position::CanCrossEditingBoundary);
+            if (candidate.node()->isContentEditable())
+                return VisiblePosition(candidate, affinity);
+        }
         return VisiblePosition(node, offset, affinity);
+    }
 
     // We don't want to cross the boundary between editable and non-editable
     // regions of the document, but that is either impossible or at least
@@ -2426,6 +2521,17 @@ VisiblePosition RenderObject::createVisiblePosition(const Position& position)
 }
 
 #if ENABLE(SVG)
+const SVGRenderBase* RenderObject::toSVGRenderBase() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+RenderSVGResource* RenderObject::toRenderSVGResource()
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
 
 FloatRect RenderObject::objectBoundingBox() const
 {
@@ -2441,25 +2547,16 @@ FloatRect RenderObject::repaintRectInLocalCoordinates() const
     return FloatRect();
 }
 
-TransformationMatrix RenderObject::localTransform() const
+AffineTransform RenderObject::localTransform() const
 {
-    return TransformationMatrix();
+    static const AffineTransform identity;
+    return identity;
 }
 
-TransformationMatrix RenderObject::localToParentTransform() const
+const AffineTransform& RenderObject::localToParentTransform() const
 {
-    // FIXME: This double virtual call indirection is temporary until I can land the
-    // rest of the of the localToParentTransform() support for SVG.
-    return localTransform();
-}
-
-TransformationMatrix RenderObject::absoluteTransform() const
-{
-    // FIXME: This should use localToParentTransform(), but much of the SVG code
-    // depends on RenderBox::absoluteTransform() being the sum of the localTransform()s of all parent renderers.
-    if (parent())
-        return localTransform() * parent()->absoluteTransform();
-    return localTransform();
+    static const AffineTransform identity;
+    return identity;
 }
 
 bool RenderObject::nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint&, HitTestAction)
@@ -2480,4 +2577,19 @@ void showTree(const WebCore::RenderObject* ro)
         ro->showTreeForThis();
 }
 
+void showRenderTree(const WebCore::RenderObject* object1)
+{
+    showRenderTree(object1, 0);
+}
+
+void showRenderTree(const WebCore::RenderObject* object1, const WebCore::RenderObject* object2)
+{
+    if (object1) {
+        const WebCore::RenderObject* root = object1;
+        while (root->parent())
+            root = root->parent();
+        root->showRenderTreeAndMark(object1, "*", object2, "-", 0);
+    }
+}
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
index e358c981ac..d928521d54 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
@@ -4,6 +4,7 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,6 +26,7 @@
 #ifndef RenderObject_h
 #define RenderObject_h
 
+#include "AffineTransform.h"
 #include "CachedResourceClient.h"
 #include "Document.h"
 #include "Element.h"
@@ -51,6 +53,10 @@ class RenderLayer;
 class RenderTheme;
 class TransformState;
 class VisiblePosition;
+#if ENABLE(SVG)
+class RenderSVGResource;
+class SVGRenderBase;
+#endif
 
 /*
  *  The painting of a layer occurs in three distinct phases.  Each phase involves
@@ -76,11 +82,13 @@ enum PaintPhase {
     PaintPhaseMask
 };
 
-enum PaintRestriction {
-    PaintRestrictionNone,
-    PaintRestrictionSelectionOnly,
-    PaintRestrictionSelectionOnlyBlackText
+enum PaintBehaviorFlags {
+    PaintBehaviorNormal = 0,
+    PaintBehaviorSelectionOnly = 1 << 0,
+    PaintBehaviorForceBlackText = 1 << 1,
+    PaintBehaviorFlattenCompositingLayers = 1 << 2
 };
+typedef unsigned PaintBehavior;
 
 enum HitTestFilter {
     HitTestAll,
@@ -228,6 +236,12 @@ private:
 public:
 #ifndef NDEBUG
     void showTreeForThis() const;
+
+    void showRenderObject() const;
+    // We don't make printedCharacters an optional parameter so that
+    // showRenderObject can be called from gdb easily.
+    void showRenderObject(int printedCharacters) const;
+    void showRenderTreeAndMark(const RenderObject* markedObject1 = 0, const char* markedLabel1 = 0, const RenderObject* markedObject2 = 0, const char* markedLabel2 = 0, int depth = 0) const;
 #endif
 
     static RenderObject* createObject(Node*, RenderStyle*);
@@ -251,7 +265,9 @@ public:
     virtual bool isBlockFlow() const { return false; }
     virtual bool isBoxModelObject() const { return false; }
     virtual bool isCounter() const { return false; }
+    virtual bool isEmbeddedObject() const { return false; }
     virtual bool isFieldset() const { return false; }
+    virtual bool isFileUploadControl() const { return false; }
     virtual bool isFrame() const { return false; }
     virtual bool isFrameSet() const { return false; }
     virtual bool isImage() const { return false; }
@@ -261,12 +277,22 @@ public:
     virtual bool isListMarker() const { return false; }
     virtual bool isMedia() const { return false; }
     virtual bool isMenuList() const { return false; }
+#if ENABLE(PROGRESS_TAG)
+    virtual bool isProgress() const { return false; }
+#endif
     virtual bool isRenderBlock() const { return false; }
     virtual bool isRenderButton() const { return false; }
     virtual bool isRenderImage() const { return false; }
     virtual bool isRenderInline() const { return false; }
     virtual bool isRenderPart() const { return false; }
     virtual bool isRenderView() const { return false; }
+    virtual bool isReplica() const { return false; }
+#if ENABLE(RUBY)
+    virtual bool isRuby() const { return false; }
+    virtual bool isRubyBase() const { return false; }
+    virtual bool isRubyRun() const { return false; }
+    virtual bool isRubyText() const { return false; }
+#endif
     virtual bool isSlider() const { return false; }
     virtual bool isTable() const { return false; }
     virtual bool isTableCell() const { return false; }
@@ -296,6 +322,10 @@ public:
     bool cellWidthChanged() const { return m_cellWidthChanged; }
     void setCellWidthChanged(bool b = true) { m_cellWidthChanged = b; }
 
+#if ENABLE(MATHML)
+    virtual bool isRenderMathMLBlock() const { return false; }
+#endif // ENABLE(MATHML)
+
 #if ENABLE(SVG)
     // FIXME: Until all SVG renders can be subclasses of RenderSVGModelObject we have
     // to add SVG renderer methods to RenderObject with an ASSERT_NOT_REACHED() default implementation.
@@ -306,6 +336,10 @@ public:
     virtual bool isSVGText() const { return false; }
     virtual bool isSVGImage() const { return false; }
     virtual bool isSVGForeignObject() const { return false; }
+    virtual bool isSVGResource() const { return false; }
+
+    virtual const SVGRenderBase* toSVGRenderBase() const;
+    virtual RenderSVGResource* toRenderSVGResource();
 
     // Per SVG 1.1 objectBoundingBox ignores clipping, masking, filter effects, opacity and stroke-width.
     // This is used for all computation of objectBoundingBox relative units and by SVGLocateable::getBBox().
@@ -322,16 +356,11 @@ public:
     // FIXME: This accessor is deprecated and mostly around for SVGRenderTreeAsText.
     // This only returns the transform="" value from the element
     // most callsites want localToParentTransform() instead.
-    virtual TransformationMatrix localTransform() const;
+    virtual AffineTransform localTransform() const;
 
     // Returns the full transform mapping from local coordinates to local coords for the parent SVG renderer
     // This includes any viewport transforms and x/y offsets as well as the transform="" value off the element.
-    virtual TransformationMatrix localToParentTransform() const;
-
-    // Walks up the parent chain to create a transform which maps from local to document coords
-    // NOTE: This method is deprecated!  It doesn't respect scroll offsets or repaint containers.
-    // FIXME: This is only virtual so that RenderSVGHiddenContainer can override it to match old LayoutTest results.
-    virtual TransformationMatrix absoluteTransform() const;
+    virtual const AffineTransform& localToParentTransform() const;
 
     // SVG uses FloatPoint precise hit testing, and passes the point in parent
     // coordinates instead of in repaint container coordinates.  Eventually the
@@ -486,10 +515,6 @@ public:
 
     /* This function performs a layout only if one is needed. */
     void layoutIfNeeded() { if (needsLayout()) layout(); }
-
-    // Called when a positioned object moves but doesn't necessarily change size.  A simplified layout is attempted
-    // that just updates the object's position. If the size does change, the object remains dirty.
-    virtual void tryLayoutDoingPositionedMovementOnly() { }
     
     // used for element state updates that cannot be fixed with a
     // repaint and do not need a relayout
@@ -539,8 +564,9 @@ public:
     // Convert a local quad into the coordinate system of container, taking transforms into account.
     FloatQuad localToContainerQuad(const FloatQuad&, RenderBoxModelObject* repaintContainer, bool fixed = false) const;
 
-    // Return the offset from the container() renderer (excluding transforms)
-    virtual IntSize offsetFromContainer(RenderObject*) const;
+    // Return the offset from the container() renderer (excluding transforms). In multi-column layout,
+    // different offsets apply at different points, so return the offset that applies to the given point.
+    virtual IntSize offsetFromContainer(RenderObject*, const IntPoint&) const;
     // Return the offset from an object up the container() chain. Asserts that none of the intermediate objects have transforms.
     IntSize offsetFromAncestorContainer(RenderObject*) const;
     
@@ -551,6 +577,8 @@ public:
     // Build an array of quads in absolute coords for line boxes
     virtual void absoluteQuads(Vector<FloatQuad>&) { }
 
+    void absoluteFocusRingQuads(Vector<FloatQuad>&);
+
     // the rect that will be painted if this object is passed as the paintingRoot
     IntRect paintingRootRect(IntRect& topLevelRect);
 
@@ -587,8 +615,8 @@ public:
     // Repaint a specific subrectangle within a given object.  The rect |r| is in the object's coordinate space.
     void repaintRectangle(const IntRect&, bool immediate = false);
 
-    // Repaint only if our old bounds and new bounds are different.
-    bool repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintContainer, const IntRect& oldBounds, const IntRect& oldOutlineBox);
+    // Repaint only if our old bounds and new bounds are different. The caller may pass in newBounds and newOutlineBox if they are known.
+    bool repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintContainer, const IntRect& oldBounds, const IntRect& oldOutlineBox, const IntRect* newBoundsPtr = 0, const IntRect* newOutlineBoxPtr = 0);
 
     // Repaint only if the object moved.
     virtual void repaintDuringLayoutIfMoved(const IntRect& rect);
@@ -617,6 +645,10 @@ public:
     // that rect in the coordinate space of repaintContainer.
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
 
+    // If multiple-column layout results in applying an offset to the given point, add the same
+    // offset to the given size.
+    virtual void adjustForColumns(IntSize&, const IntPoint&) const { }
+
     virtual unsigned int length() const { return 1; }
 
     bool isFloatingOrPositioned() const { return (isFloating() || isPositioned()); }
@@ -736,7 +768,7 @@ public:
     bool shouldUseTransformFromContainer(const RenderObject* container) const;
     void getTransformFromContainer(const RenderObject* container, const IntSize& offsetInContainer, TransformationMatrix&) const;
     
-    virtual void addFocusRingRects(GraphicsContext*, int /*tx*/, int /*ty*/) { };
+    virtual void addFocusRingRects(Vector<IntRect>&, int /*tx*/, int /*ty*/) { };
 
     IntRect absoluteOutlineBounds() const
     {
@@ -1028,6 +1060,10 @@ inline void adjustFloatQuadForAbsoluteZoom(FloatQuad& quad, RenderObject* render
 #ifndef NDEBUG
 // Outside the WebCore namespace for ease of invocation from gdb.
 void showTree(const WebCore::RenderObject*);
+void showRenderTree(const WebCore::RenderObject* object1);
+// We don't make object2 an optional parameter so that showRenderTree
+// can be called from gdb easily.
+void showRenderTree(const WebCore::RenderObject* object1, const WebCore::RenderObject* object2);
 #endif
 
 #endif // RenderObject_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.cpp
index 23ab98f277..d56a015f76 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.cpp
@@ -271,24 +271,29 @@ static RenderObject* findBeforeAfterParent(RenderObject* object)
     return beforeAfterParent;
 }
 
-static void invalidateCountersInContainer(RenderObject* container)
+static void invalidateCountersInContainer(RenderObject* container, const AtomicString& identifier)
 {
     if (!container)
         return;
     container = findBeforeAfterParent(container);
     if (!container)
         return;
+    // Sometimes the counter is attached directly on the container.
+    if (container->isCounter()) {
+        toRenderCounter(container)->invalidate(identifier);
+        return;
+    }
     for (RenderObject* content = container->firstChild(); content; content = content->nextSibling()) {
         if (content->isCounter())
-            toRenderCounter(content)->invalidate();
+            toRenderCounter(content)->invalidate(identifier);
     }
 }
 
-void RenderObjectChildList::invalidateCounters(RenderObject* owner)
+void RenderObjectChildList::invalidateCounters(RenderObject* owner, const AtomicString& identifier)
 {
     ASSERT(!owner->documentBeingDestroyed());
-    invalidateCountersInContainer(beforeAfterContainer(owner, BEFORE));
-    invalidateCountersInContainer(beforeAfterContainer(owner, AFTER));
+    invalidateCountersInContainer(beforeAfterContainer(owner, BEFORE), identifier);
+    invalidateCountersInContainer(beforeAfterContainer(owner, AFTER), identifier);
 }
 
 void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, PseudoId type, RenderObject* styledObject)
@@ -369,9 +374,11 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
                     RefPtr<RenderStyle> style = RenderStyle::create();
                     style->inheritFrom(pseudoElementStyle);
                     genChild->setStyle(style.release());
-                } else
-                    // Must be a first-letter container. updateFirstLetter() will take care of it.
-                    ASSERT(genChild->style()->styleType() == FIRST_LETTER);
+                } else {
+                    // RenderListItem may insert a list marker here. We do not need to care about this case.
+                    // Otherwise, genChild must be a first-letter container. updateFirstLetter() will take care of it.
+                    ASSERT(genChild->isListMarker() || genChild->style()->styleType() == FIRST_LETTER);
+                }
             }
         }
         return; // We've updated the generated content. That's all we needed to do.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.h b/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.h
index bf8800a2d8..ba73c50cb4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.h
@@ -30,6 +30,7 @@
 
 namespace WebCore {
 
+class AtomicString;
 class RenderObject;
 
 class RenderObjectChildList {
@@ -55,7 +56,7 @@ public:
     void insertChildNode(RenderObject* owner, RenderObject* child, RenderObject* before, bool fullInsert = true);
 
     void updateBeforeAfterContent(RenderObject* owner, PseudoId type, RenderObject* styledObject = 0);
-    void invalidateCounters(RenderObject* owner);
+    void invalidateCounters(RenderObject* owner, const AtomicString& identifier);
 
 private:
     RenderObject* m_firstChild;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderOverflow.h b/src/3rdparty/webkit/WebCore/rendering/RenderOverflow.h
index ed8976a5b7..253a672231 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderOverflow.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderOverflow.h
@@ -37,7 +37,7 @@ namespace WebCore
 // Examples of visual overflow are shadows, text stroke (and eventually outline and border-image).
 
 // This object is allocated only when some of these fields have non-default values in the owning box.
-class RenderOverflow {
+class RenderOverflow : public Noncopyable {
 public:
     RenderOverflow(const IntRect& defaultRect = IntRect()) 
         : m_topLayoutOverflow(defaultRect.y())
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPart.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderPart.cpp
index cb56c0c310..74b467f238 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPart.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPart.cpp
@@ -24,13 +24,16 @@
 #include "config.h"
 #include "RenderPart.h"
 
+#include "RenderView.h"
 #include "Frame.h"
 #include "FrameView.h"
+#include "HTMLFrameElementBase.h"
 
 namespace WebCore {
 
 RenderPart::RenderPart(Element* node)
     : RenderWidget(node)
+    , m_hasFallbackContent(false)
 {
     // init RenderObject attributes
     setInline(false);
@@ -53,6 +56,60 @@ void RenderPart::setWidget(PassRefPtr<Widget> widget)
     viewCleared();
 }
 
+void RenderPart::layoutWithFlattening(bool fixedWidth, bool fixedHeight)
+{
+    FrameView* childFrameView = static_cast<FrameView*>(widget());
+    RenderView* childRoot = childFrameView ? static_cast<RenderView*>(childFrameView->frame()->contentRenderer()) : 0;
+
+    // Do not expand frames which has zero width or height
+    if (!width() || !height() || !childRoot) {
+        updateWidgetPosition();
+        if (childFrameView)
+            childFrameView->layout();
+        setNeedsLayout(false);
+        return;
+    }
+
+    // need to update to calculate min/max correctly
+    updateWidgetPosition();
+    if (childRoot->prefWidthsDirty())
+        childRoot->calcPrefWidths();
+
+    // if scrollbars are off, and the width or height are fixed
+    // we obey them and do not expand. With frame flattening
+    // no subframe much ever become scrollable.
+
+    HTMLFrameElementBase* element = static_cast<HTMLFrameElementBase*>(node());
+    bool isScrollable = element->scrollingMode() != ScrollbarAlwaysOff;
+
+    // consider iframe inset border
+    int hBorder = borderLeft() + borderRight();
+    int vBorder = borderTop() + borderBottom();
+
+    // make sure minimum preferred width is enforced
+    if (isScrollable || !fixedWidth) {
+        setWidth(max(width(), childRoot->minPrefWidth() + hBorder));
+        // update again to pass the new width to the child frame
+        updateWidgetPosition();
+        childFrameView->layout();
+    }
+
+    // expand the frame by setting frame height = content height
+    if (isScrollable || !fixedHeight || childRoot->isFrameSet())
+        setHeight(max(height(), childFrameView->contentsHeight() + vBorder));
+    if (isScrollable || !fixedWidth || childRoot->isFrameSet())
+        setWidth(max(width(), childFrameView->contentsWidth() + hBorder));
+
+    updateWidgetPosition();
+
+    ASSERT(!childFrameView->layoutPending());
+    ASSERT(!childRoot->needsLayout());
+    ASSERT(!childRoot->firstChild() || !childRoot->firstChild()->firstChild() || !childRoot->firstChild()->firstChild()->needsLayout());
+
+    setNeedsLayout(false);
+}
+
+
 void RenderPart::viewCleared()
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPart.h b/src/3rdparty/webkit/WebCore/rendering/RenderPart.h
index 08abf99049..ef4b5e1b83 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPart.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPart.h
@@ -27,16 +27,22 @@
 
 namespace WebCore {
 
+// Renderer for frames via RenderPartObject, and plug-ins via RenderEmbeddedObject.
+
+// FIXME: This class is subclassed in RenderPartObject for iframes, which is in turn
+// subclassed in RenderEmbeddedObject for object and embed. This class itself could be removed.
 class RenderPart : public RenderWidget {
 public:
     RenderPart(Element*);
     virtual ~RenderPart();
-    
+
     bool hasFallbackContent() const { return m_hasFallbackContent; }
 
     virtual void setWidget(PassRefPtr<Widget>);
     virtual void viewCleared();
 
+    void layoutWithFlattening(bool fixedWidth, bool fixedHeight);
+
 protected:
     bool m_hasFallbackContent;
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
index e2c8e7d8af..c4c515ede4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
@@ -35,6 +35,7 @@
 #include "Page.h"
 #include "RenderView.h"
 #include "RenderWidgetProtector.h"
+#include "Settings.h"
 #include "Text.h"
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
@@ -48,288 +49,72 @@ using namespace HTMLNames;
 RenderPartObject::RenderPartObject(Element* element)
     : RenderPart(element)
 {
-    // init RenderObject attributes
-    setInline(true);
-    m_hasFallbackContent = false;
-    
-    if (element->hasTagName(embedTag) || element->hasTagName(objectTag))
-        view()->frameView()->setIsVisuallyNonEmpty();
 }
 
-RenderPartObject::~RenderPartObject()
+bool RenderPartObject::flattenFrame() const
 {
-    if (frameView())
-        frameView()->removeWidgetToUpdate(this);
-}
-
-static bool isURLAllowed(Document* doc, const String& url)
-{
-    if (doc->frame()->page()->frameCount() >= 200)
+    if (!node() || !node()->hasTagName(iframeTag))
         return false;
 
-    // We allow one level of self-reference because some sites depend on that.
-    // But we don't allow more than one.
-    KURL completeURL = doc->completeURL(url);
-    bool foundSelfReference = false;
-    for (Frame* frame = doc->frame(); frame; frame = frame->tree()->parent()) {
-        if (equalIgnoringFragmentIdentifier(frame->loader()->url(), completeURL)) {
-            if (foundSelfReference)
-                return false;
-            foundSelfReference = true;
-        }
-    }
-    return true;
-}
+    HTMLIFrameElement* frame = static_cast<HTMLIFrameElement*>(node());
+    bool isScrollable = frame->scrollingMode() != ScrollbarAlwaysOff;
 
-typedef HashMap<String, String, CaseFoldingHash> ClassIdToTypeMap;
+    if (!isScrollable && style()->width().isFixed()
+        && style()->height().isFixed())
+        return false;
 
-static ClassIdToTypeMap* createClassIdToTypeMap()
-{
-    ClassIdToTypeMap* map = new ClassIdToTypeMap;
-    map->add("clsid:D27CDB6E-AE6D-11CF-96B8-444553540000", "application/x-shockwave-flash");
-    map->add("clsid:CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA", "audio/x-pn-realaudio-plugin");
-    map->add("clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B", "video/quicktime");
-    map->add("clsid:166B1BCA-3F9C-11CF-8075-444553540000", "application/x-director");
-    map->add("clsid:6BF52A52-394A-11D3-B153-00C04F79FAA6", "application/x-mplayer2");
-    map->add("clsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95", "application/x-mplayer2");
-    return map;
+    return frame->document()->frame() && frame->document()->frame()->settings()->frameFlatteningEnabled();
 }
 
-static String serviceTypeForClassId(const String& classId)
+void RenderPartObject::calcHeight()
 {
-    // Return early if classId is empty (since we won't do anything below).
-    // Furthermore, if classId is null, calling get() below will crash.
-    if (classId.isEmpty())
-        return String();
-
-    static ClassIdToTypeMap* map = createClassIdToTypeMap();
-    return map->get(classId);
-}
+    RenderPart::calcHeight();
+    if (!flattenFrame())
+         return;
 
-static void mapDataParamToSrc(Vector<String>* paramNames, Vector<String>* paramValues)
-{
-    // Some plugins don't understand the "data" attribute of the OBJECT tag (i.e. Real and WMP
-    // require "src" attribute).
-    int srcIndex = -1, dataIndex = -1;
-    for (unsigned int i = 0; i < paramNames->size(); ++i) {
-        if (equalIgnoringCase((*paramNames)[i], "src"))
-            srcIndex = i;
-        else if (equalIgnoringCase((*paramNames)[i], "data"))
-            dataIndex = i;
-    }
+    HTMLIFrameElement* frame = static_cast<HTMLIFrameElement*>(node());
+    bool isScrollable = frame->scrollingMode() != ScrollbarAlwaysOff;
 
-    if (srcIndex == -1 && dataIndex != -1) {
-        paramNames->append("src");
-        paramValues->append((*paramValues)[dataIndex]);
+    if (isScrollable || !style()->height().isFixed()) {
+        FrameView* view = static_cast<FrameView*>(widget());
+        int border = borderTop() + borderBottom();
+        setHeight(max(height(), view->contentsHeight() + border));
     }
 }
 
-void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
+void RenderPartObject::calcWidth()
 {
-    String url;
-    String serviceType;
-    Vector<String> paramNames;
-    Vector<String> paramValues;
-    Frame* frame = frameView()->frame();
-
-    // The calls to FrameLoader::requestObject within this function can result in a plug-in being initialized.
-    // This can run cause arbitrary JavaScript to run and may result in this RenderObject being detached from
-    // the render tree and destroyed, causing a crash like <rdar://problem/6954546>.  By extending our lifetime
-    // artifically to ensure that we remain alive for the duration of plug-in initialization.
-    RenderWidgetProtector protector(this);
-
-    if (node()->hasTagName(objectTag)) {
-        HTMLObjectElement* o = static_cast<HTMLObjectElement*>(node());
-
-        o->setNeedWidgetUpdate(false);
-        if (!o->isFinishedParsingChildren())
-          return;
-
-        // Check for a child EMBED tag.
-        HTMLEmbedElement* embed = 0;
-        for (Node* child = o->firstChild(); child; ) {
-            if (child->hasTagName(embedTag)) {
-                embed = static_cast<HTMLEmbedElement*>(child);
-                break;
-            } else if (child->hasTagName(objectTag))
-                child = child->nextSibling();         // Don't descend into nested OBJECT tags
-            else
-                child = child->traverseNextNode(o);   // Otherwise descend (EMBEDs may be inside COMMENT tags)
-        }
-
-        // Use the attributes from the EMBED tag instead of the OBJECT tag including WIDTH and HEIGHT.
-        HTMLElement *embedOrObject;
-        if (embed) {
-            embedOrObject = (HTMLElement *)embed;
-            url = embed->url();
-            serviceType = embed->serviceType();
-        } else
-            embedOrObject = (HTMLElement *)o;
-
-        // If there was no URL or type defined in EMBED, try the OBJECT tag.
-        if (url.isEmpty())
-            url = o->url();
-        if (serviceType.isEmpty())
-            serviceType = o->serviceType();
-
-        HashSet<StringImpl*, CaseFoldingHash> uniqueParamNames;
-
-        // Scan the PARAM children.
-        // Get the URL and type from the params if we don't already have them.
-        // Get the attributes from the params if there is no EMBED tag.
-        Node *child = o->firstChild();
-        while (child && (url.isEmpty() || serviceType.isEmpty() || !embed)) {
-            if (child->hasTagName(paramTag)) {
-                HTMLParamElement* p = static_cast<HTMLParamElement*>(child);
-                String name = p->name();
-                if (url.isEmpty() && (equalIgnoringCase(name, "src") || equalIgnoringCase(name, "movie") || equalIgnoringCase(name, "code") || equalIgnoringCase(name, "url")))
-                    url = p->value();
-                if (serviceType.isEmpty() && equalIgnoringCase(name, "type")) {
-                    serviceType = p->value();
-                    int pos = serviceType.find(";");
-                    if (pos != -1)
-                        serviceType = serviceType.left(pos);
-                }
-                if (!embed && !name.isEmpty()) {
-                    uniqueParamNames.add(name.impl());
-                    paramNames.append(p->name());
-                    paramValues.append(p->value());
-                }
-            }
-            child = child->nextSibling();
-        }
-
-        // When OBJECT is used for an applet via Sun's Java plugin, the CODEBASE attribute in the tag
-        // points to the Java plugin itself (an ActiveX component) while the actual applet CODEBASE is
-        // in a PARAM tag. See <http://java.sun.com/products/plugin/1.2/docs/tags.html>. This means
-        // we have to explicitly suppress the tag's CODEBASE attribute if there is none in a PARAM,
-        // else our Java plugin will misinterpret it. [4004531]
-        String codebase;
-        if (!embed && MIMETypeRegistry::isJavaAppletMIMEType(serviceType)) {
-            codebase = "codebase";
-            uniqueParamNames.add(codebase.impl()); // pretend we found it in a PARAM already
-        }
-        
-        // Turn the attributes of either the EMBED tag or OBJECT tag into arrays, but don't override PARAM values.
-        NamedNodeMap* attributes = embedOrObject->attributes();
-        if (attributes) {
-            for (unsigned i = 0; i < attributes->length(); ++i) {
-                Attribute* it = attributes->attributeItem(i);
-                const AtomicString& name = it->name().localName();
-                if (embed || !uniqueParamNames.contains(name.impl())) {
-                    paramNames.append(name.string());
-                    paramValues.append(it->value().string());
-                }
-            }
-        }
+    RenderPart::calcWidth();
+    if (!flattenFrame())
+        return;
 
-        mapDataParamToSrc(&paramNames, &paramValues);
+    HTMLIFrameElement* frame = static_cast<HTMLIFrameElement*>(node());
+    bool isScrollable = frame->scrollingMode() != ScrollbarAlwaysOff;
 
-        // If we still don't have a type, try to map from a specific CLASSID to a type.
-        if (serviceType.isEmpty())
-            serviceType = serviceTypeForClassId(o->classId());
-
-        if (!isURLAllowed(document(), url))
-            return;
-
-        // Find out if we support fallback content.
-        m_hasFallbackContent = false;
-        for (Node *child = o->firstChild(); child && !m_hasFallbackContent; child = child->nextSibling()) {
-            if ((!child->isTextNode() && !child->hasTagName(embedTag) && !child->hasTagName(paramTag)) || // Discount <embed> and <param>
-                (child->isTextNode() && !static_cast<Text*>(child)->containsOnlyWhitespace()))
-                m_hasFallbackContent = true;
-        }
-
-        if (onlyCreateNonNetscapePlugins) {
-            KURL completedURL;
-            if (!url.isEmpty())
-                completedURL = frame->loader()->completeURL(url);
-
-            if (frame->loader()->client()->objectContentType(completedURL, serviceType) == ObjectContentNetscapePlugin)
-                return;
-        }
-
-        bool success = o->dispatchBeforeLoadEvent(url) &&
-                       frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
-        if (!success && m_hasFallbackContent)
-            o->renderFallbackContent();
-    } else if (node()->hasTagName(embedTag)) {
-        HTMLEmbedElement *o = static_cast<HTMLEmbedElement*>(node());
-        o->setNeedWidgetUpdate(false);
-        url = o->url();
-        serviceType = o->serviceType();
-
-        if (url.isEmpty() && serviceType.isEmpty())
-            return;
-        if (!isURLAllowed(document(), url))
-            return;
-
-        // add all attributes set on the embed object
-        NamedNodeMap* a = o->attributes();
-        if (a) {
-            for (unsigned i = 0; i < a->length(); ++i) {
-                Attribute* it = a->attributeItem(i);
-                paramNames.append(it->name().localName().string());
-                paramValues.append(it->value().string());
-            }
-        }
-
-        if (onlyCreateNonNetscapePlugins) {
-            KURL completedURL;
-            if (!url.isEmpty())
-                completedURL = frame->loader()->completeURL(url);
-
-            if (frame->loader()->client()->objectContentType(completedURL, serviceType) == ObjectContentNetscapePlugin)
-                return;
-
-        }
-
-        if (o->dispatchBeforeLoadEvent(url))
-            frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
-    }
-#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)        
-    else if (node()->hasTagName(videoTag) || node()->hasTagName(audioTag)) {
-        HTMLMediaElement* o = static_cast<HTMLMediaElement*>(node());
-
-        o->setNeedWidgetUpdate(false);
-        if (node()->hasTagName(videoTag)) {
-            HTMLVideoElement* vid = static_cast<HTMLVideoElement*>(node());
-            String poster = vid->poster();
-            if (!poster.isEmpty()) {
-                paramNames.append("_media_element_poster_");
-                paramValues.append(poster);
-            }
-        }
-
-        url = o->initialURL();
-        if (!url.isEmpty()) {
-            paramNames.append("_media_element_src_");
-            paramValues.append(url);
-        }
-
-        serviceType = "application/x-media-element-proxy-plugin";
-        
-        if (o->dispatchBeforeLoadEvent(url))
-            frame->loader()->requestObject(this, url, nullAtom, serviceType, paramNames, paramValues);
+    if (isScrollable || !style()->width().isFixed()) {
+        FrameView* view = static_cast<FrameView*>(widget());
+        int border = borderLeft() + borderRight();
+        setWidth(max(width(), view->contentsWidth() + border));
     }
-#endif
 }
 
 void RenderPartObject::layout()
 {
     ASSERT(needsLayout());
 
-    calcWidth();
-    calcHeight();
+    RenderPart::calcWidth();
+    RenderPart::calcHeight();
+
+    if (flattenFrame()) {
+        layoutWithFlattening(style()->width().isFixed(), style()->height().isFixed());
+        return;
+    }
 
     RenderPart::layout();
 
     m_overflow.clear();
     addShadowOverflow();
 
-    if (!widget() && frameView())
-        frameView()->addWidgetToUpdate(this);
-
     setNeedsLayout(false);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.h
index ad956bd1ea..5c7277e44e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.h
@@ -27,12 +27,13 @@
 
 namespace WebCore {
 
+// Renderer for iframes. Is subclassed in RenderEmbeddedObject for object and embed.
 class RenderPartObject : public RenderPart {
 public:
     RenderPartObject(Element*);
-    virtual ~RenderPartObject();
 
-    void updateWidget(bool onlyCreateNonNetscapePlugins);
+    virtual void calcHeight();
+    virtual void calcWidth();
 
 private:
     virtual const char* renderName() const { return "RenderPartObject"; }
@@ -40,6 +41,8 @@ private:
     virtual void layout();
 
     virtual void viewCleared();
+
+    bool flattenFrame() const;
 };
 
 inline RenderPartObject* toRenderPartObject(RenderObject* object)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPath.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderPath.cpp
index 4a7662f23f..bcedd38088 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPath.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPath.cpp
@@ -3,6 +3,7 @@
                   2004, 2005, 2008 Rob Buis <buis@kde.org>
                   2005, 2007 Eric Seidel <eric@webkit.org>
                   2009 Google, Inc.
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -33,9 +34,7 @@
 #include "StrokeStyleApplier.h"
 #include "SVGPaintServer.h"
 #include "SVGRenderSupport.h"
-#include "SVGResourceFilter.h"
 #include "SVGResourceMarker.h"
-#include "SVGResourceMasker.h"
 #include "SVGStyledTransformableElement.h"
 #include "SVGTransformList.h"
 #include "SVGURIReference.h"
@@ -68,12 +67,12 @@ RenderPath::RenderPath(SVGStyledTransformableElement* node)
 {
 }
 
-TransformationMatrix RenderPath::localToParentTransform() const
+const AffineTransform& RenderPath::localToParentTransform() const
 {
     return m_localTransform;
 }
 
-TransformationMatrix RenderPath::localTransform() const
+AffineTransform RenderPath::localTransform() const
 {
     return m_localTransform;
 }
@@ -112,6 +111,34 @@ FloatRect RenderPath::objectBoundingBox() const
     return m_cachedLocalFillBBox;
 }
 
+FloatRect RenderPath::strokeBoundingBox() const
+{
+    if (m_path.isEmpty())
+        return FloatRect();
+
+    if (!m_cachedLocalStrokeBBox.isEmpty())
+        return m_cachedLocalStrokeBBox;
+
+    m_cachedLocalStrokeBBox = objectBoundingBox();
+    if (style()->svgStyle()->hasStroke()) {
+        BoundingRectStrokeStyleApplier strokeStyle(this, style());
+        m_cachedLocalStrokeBBox.unite(m_path.strokeBoundingRect(&strokeStyle));
+    }
+
+    return m_cachedLocalStrokeBBox;
+}
+
+FloatRect RenderPath::markerBoundingBox() const
+{
+    if (m_path.isEmpty())
+        return FloatRect();
+
+    if (m_cachedLocalMarkerBBox.isEmpty())
+        calculateMarkerBoundsIfNeeded();
+
+    return m_cachedLocalMarkerBBox;
+}
+
 FloatRect RenderPath::repaintRectInLocalCoordinates() const
 {
     if (m_path.isEmpty())
@@ -121,16 +148,25 @@ FloatRect RenderPath::repaintRectInLocalCoordinates() const
     if (!m_cachedLocalRepaintRect.isEmpty())
         return m_cachedLocalRepaintRect;
 
-    if (!style()->svgStyle()->hasStroke())
-        m_cachedLocalRepaintRect = objectBoundingBox();
+    // FIXME: We need to be careful here. We assume that there is no filter,
+    // clipper, marker or masker if the rects are empty.
+    FloatRect rect = filterBoundingBoxForRenderer(this);
+    if (!rect.isEmpty())
+        m_cachedLocalRepaintRect = rect;
     else {
-        BoundingRectStrokeStyleApplier strokeStyle(this, style());
-        m_cachedLocalRepaintRect = m_path.strokeBoundingRect(&strokeStyle);
+        m_cachedLocalRepaintRect = strokeBoundingBox();
+        m_cachedLocalRepaintRect.unite(markerBoundingBox());
     }
 
-    // Markers and filters can paint outside of the stroke path
-    m_cachedLocalRepaintRect.unite(m_markerBounds);
-    m_cachedLocalRepaintRect.unite(filterBoundingBoxForRenderer(this));
+    rect = clipperBoundingBoxForRenderer(this);
+    if (!rect.isEmpty())
+        m_cachedLocalRepaintRect.intersect(rect);
+
+    rect = maskerBoundingBoxForRenderer(this);
+    if (!rect.isEmpty())
+        m_cachedLocalRepaintRect.intersect(rect);
+
+    style()->svgStyle()->inflateForShadow(m_cachedLocalRepaintRect);
 
     return m_cachedLocalRepaintRect;
 }
@@ -139,12 +175,9 @@ void RenderPath::setPath(const Path& newPath)
 {
     m_path = newPath;
     m_cachedLocalRepaintRect = FloatRect();
+    m_cachedLocalStrokeBBox = FloatRect();
     m_cachedLocalFillBBox = FloatRect();
-}
-
-const Path& RenderPath::path() const
-{
-    return m_path;
+    m_cachedLocalMarkerBBox = FloatRect();
 }
 
 void RenderPath::layout()
@@ -180,39 +213,48 @@ void RenderPath::paint(PaintInfo& paintInfo, int, int)
 {
     if (paintInfo.context->paintingDisabled() || style()->visibility() == HIDDEN || m_path.isEmpty())
         return;
-            
-    paintInfo.context->save();
-    paintInfo.context->concatCTM(localToParentTransform());
-
-    SVGResourceFilter* filter = 0;
 
     FloatRect boundingBox = repaintRectInLocalCoordinates();
-    if (paintInfo.phase == PaintPhaseForeground) {
-        PaintInfo savedInfo(paintInfo);
+    FloatRect nonLocalBoundingBox = m_localTransform.mapRect(boundingBox);
+    // FIXME: The empty rect check is to deal with incorrect initial clip in renderSubtreeToImage
+    // unfortunately fixing that problem is fairly complex unless we were willing to just futz the
+    // rect to something "close enough"
+    if (!nonLocalBoundingBox.intersects(paintInfo.rect) && !paintInfo.rect.isEmpty())
+        return;
+
+    PaintInfo childPaintInfo(paintInfo);
+    childPaintInfo.context->save();
+    applyTransformToPaintInfo(childPaintInfo, m_localTransform);
+    SVGResourceFilter* filter = 0;
 
-        prepareToRenderSVGContent(this, paintInfo, boundingBox, filter);
-        if (style()->svgStyle()->shapeRendering() == SR_CRISPEDGES)
-            paintInfo.context->setShouldAntialias(false);
-        fillAndStrokePath(m_path, paintInfo.context, style(), this);
+    if (childPaintInfo.phase == PaintPhaseForeground) {
+        PaintInfo savedInfo(childPaintInfo);
 
-        if (static_cast<SVGStyledElement*>(node())->supportsMarkers())
-            m_markerBounds = drawMarkersIfNeeded(paintInfo.context, paintInfo.rect, m_path);
+        if (prepareToRenderSVGContent(this, childPaintInfo, boundingBox, filter)) {
+            if (style()->svgStyle()->shapeRendering() == SR_CRISPEDGES)
+                childPaintInfo.context->setShouldAntialias(false);
+            fillAndStrokePath(m_path, childPaintInfo.context, style(), this);
 
-        finishRenderSVGContent(this, paintInfo, filter, savedInfo.context);
+            if (static_cast<SVGStyledElement*>(node())->supportsMarkers())
+                m_markerLayoutInfo.drawMarkers(childPaintInfo);
+        }
+        finishRenderSVGContent(this, childPaintInfo, filter, savedInfo.context);
     }
 
-    if ((paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) && style()->outlineWidth())
-        paintOutline(paintInfo.context, static_cast<int>(boundingBox.x()), static_cast<int>(boundingBox.y()),
+    if ((childPaintInfo.phase == PaintPhaseOutline || childPaintInfo.phase == PaintPhaseSelfOutline) && style()->outlineWidth())
+        paintOutline(childPaintInfo.context, static_cast<int>(boundingBox.x()), static_cast<int>(boundingBox.y()),
             static_cast<int>(boundingBox.width()), static_cast<int>(boundingBox.height()), style());
     
-    paintInfo.context->restore();
+    childPaintInfo.context->restore();
 }
 
 // This method is called from inside paintOutline() since we call paintOutline()
 // while transformed to our coord system, return local coords
-void RenderPath::addFocusRingRects(GraphicsContext* graphicsContext, int, int) 
+void RenderPath::addFocusRingRects(Vector<IntRect>& rects, int, int) 
 {
-    graphicsContext->addFocusRingRect(enclosingIntRect(repaintRectInLocalCoordinates()));
+    IntRect rect = enclosingIntRect(repaintRectInLocalCoordinates());
+    if (!rect.isEmpty())
+        rects.append(rect);
 }
 
 bool RenderPath::nodeAtFloatPoint(const HitTestRequest&, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
@@ -221,7 +263,7 @@ bool RenderPath::nodeAtFloatPoint(const HitTestRequest&, HitTestResult& result,
     if (hitTestAction != HitTestForeground)
         return false;
 
-    FloatPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
+    FloatPoint localPoint = m_localTransform.inverse().mapPoint(pointInParent);
 
     PointerEventsHitRules hitRules(PointerEventsHitRules::SVG_PATH_HITTESTING, style()->pointerEvents());
 
@@ -237,143 +279,27 @@ bool RenderPath::nodeAtFloatPoint(const HitTestRequest&, HitTestResult& result,
     return false;
 }
 
-enum MarkerType {
-    Start,
-    Mid,
-    End
-};
-
-struct MarkerData {
-    FloatPoint origin;
-    FloatPoint subpathStart;
-    double strokeWidth;
-    FloatPoint inslopePoints[2];
-    FloatPoint outslopePoints[2];
-    MarkerType type;
-    SVGResourceMarker* marker;
-};
-
-struct DrawMarkersData {
-    DrawMarkersData(GraphicsContext*, SVGResourceMarker* startMarker, SVGResourceMarker* midMarker, double strokeWidth);
-    GraphicsContext* context;
-    int elementIndex;
-    MarkerData previousMarkerData;
-    SVGResourceMarker* midMarker;
-};
-
-DrawMarkersData::DrawMarkersData(GraphicsContext* c, SVGResourceMarker *start, SVGResourceMarker *mid, double strokeWidth)
-    : context(c)
-    , elementIndex(0)
-    , midMarker(mid)
-{
-    previousMarkerData.origin = FloatPoint();
-    previousMarkerData.subpathStart = FloatPoint();
-    previousMarkerData.strokeWidth = strokeWidth;
-    previousMarkerData.marker = start;
-    previousMarkerData.type = Start;
-}
-
-static void drawMarkerWithData(GraphicsContext* context, MarkerData &data)
-{
-    if (!data.marker)
-        return;
-
-    FloatPoint inslopeChange = data.inslopePoints[1] - FloatSize(data.inslopePoints[0].x(), data.inslopePoints[0].y());
-    FloatPoint outslopeChange = data.outslopePoints[1] - FloatSize(data.outslopePoints[0].x(), data.outslopePoints[0].y());
-
-    double inslope = rad2deg(atan2(inslopeChange.y(), inslopeChange.x()));
-    double outslope = rad2deg(atan2(outslopeChange.y(), outslopeChange.x()));
-
-    double angle = 0.0;
-    switch (data.type) {
-        case Start:
-            angle = outslope;
-            break;
-        case Mid:
-            angle = (inslope + outslope) / 2;
-            break;
-        case End:
-            angle = inslope;
-    }
-
-    data.marker->draw(context, FloatRect(), data.origin.x(), data.origin.y(), data.strokeWidth, angle);
-}
-
-static inline void updateMarkerDataForElement(MarkerData& previousMarkerData, const PathElement* element)
-{
-    FloatPoint* points = element->points;
-    
-    switch (element->type) {
-    case PathElementAddQuadCurveToPoint:
-        // TODO
-        previousMarkerData.origin = points[1];
-        break;
-    case PathElementAddCurveToPoint:
-        previousMarkerData.inslopePoints[0] = points[1];
-        previousMarkerData.inslopePoints[1] = points[2];
-        previousMarkerData.origin = points[2];
-        break;
-    case PathElementMoveToPoint:
-        previousMarkerData.subpathStart = points[0];
-    case PathElementAddLineToPoint:
-        previousMarkerData.inslopePoints[0] = previousMarkerData.origin;
-        previousMarkerData.inslopePoints[1] = points[0];
-        previousMarkerData.origin = points[0];
-        break;
-    case PathElementCloseSubpath:
-        previousMarkerData.inslopePoints[0] = previousMarkerData.origin;
-        previousMarkerData.inslopePoints[1] = points[0];
-        previousMarkerData.origin = previousMarkerData.subpathStart;
-        previousMarkerData.subpathStart = FloatPoint();
-    }
-}
-
-static void drawStartAndMidMarkers(void* info, const PathElement* element)
-{
-    DrawMarkersData& data = *reinterpret_cast<DrawMarkersData*>(info);
-
-    int elementIndex = data.elementIndex;
-    MarkerData& previousMarkerData = data.previousMarkerData;
-
-    FloatPoint* points = element->points;
-
-    // First update the outslope for the previous element
-    previousMarkerData.outslopePoints[0] = previousMarkerData.origin;
-    previousMarkerData.outslopePoints[1] = points[0];
-
-    // Draw the marker for the previous element
-    if (elementIndex != 0)
-        drawMarkerWithData(data.context, previousMarkerData);
-
-    // Update our marker data for this element
-    updateMarkerDataForElement(previousMarkerData, element);
-
-    if (elementIndex == 1) {
-        // After drawing the start marker, switch to drawing mid markers
-        previousMarkerData.marker = data.midMarker;
-        previousMarkerData.type = Mid;
-    }
-
-    data.elementIndex++;
-}
-
-FloatRect RenderPath::drawMarkersIfNeeded(GraphicsContext* context, const FloatRect&, const Path& path) const
+void RenderPath::calculateMarkerBoundsIfNeeded() const
 {
     Document* doc = document();
 
     SVGElement* svgElement = static_cast<SVGElement*>(node());
-    ASSERT(svgElement && svgElement->document() && svgElement->isStyled());
+    ASSERT(svgElement && svgElement->document());
+    if (!svgElement->isStyled())
+        return;
 
     SVGStyledElement* styledElement = static_cast<SVGStyledElement*>(svgElement);
-    const SVGRenderStyle* svgStyle = style()->svgStyle();
+    if (!styledElement->supportsMarkers())
+        return;
 
+    const SVGRenderStyle* svgStyle = style()->svgStyle();
     AtomicString startMarkerId(svgStyle->startMarker());
     AtomicString midMarkerId(svgStyle->midMarker());
     AtomicString endMarkerId(svgStyle->endMarker());
 
-    SVGResourceMarker* startMarker = getMarkerById(doc, startMarkerId);
-    SVGResourceMarker* midMarker = getMarkerById(doc, midMarkerId);
-    SVGResourceMarker* endMarker = getMarkerById(doc, endMarkerId);
+    SVGResourceMarker* startMarker = getMarkerById(doc, startMarkerId, this);
+    SVGResourceMarker* midMarker = getMarkerById(doc, midMarkerId, this);
+    SVGResourceMarker* endMarker = getMarkerById(doc, endMarkerId, this);
 
     if (!startMarker && !startMarkerId.isEmpty())
         svgElement->document()->accessSVGExtensions()->addPendingResource(startMarkerId, styledElement);
@@ -391,32 +317,10 @@ FloatRect RenderPath::drawMarkersIfNeeded(GraphicsContext* context, const FloatR
         endMarker->addClient(styledElement);
 
     if (!startMarker && !midMarker && !endMarker)
-        return FloatRect();
-
-    double strokeWidth = SVGRenderStyle::cssPrimitiveToLength(this, svgStyle->strokeWidth(), 1.0f);
-    DrawMarkersData data(context, startMarker, midMarker, strokeWidth);
-
-    path.apply(&data, drawStartAndMidMarkers);
-
-    data.previousMarkerData.marker = endMarker;
-    data.previousMarkerData.type = End;
-    drawMarkerWithData(context, data.previousMarkerData);
-
-    // We know the marker boundaries, only after they're drawn!
-    // Otherwhise we'd need to do all the marker calculation twice
-    // once here (through paint()) and once in absoluteClippedOverflowRect().
-    FloatRect bounds;
-
-    if (startMarker)
-        bounds.unite(startMarker->cachedBounds());
-
-    if (midMarker)
-        bounds.unite(midMarker->cachedBounds());
-
-    if (endMarker)
-        bounds.unite(endMarker->cachedBounds());
+        return;
 
-    return bounds;
+    float strokeWidth = SVGRenderStyle::cssPrimitiveToLength(this, svgStyle->strokeWidth(), 1.0f);
+    m_cachedLocalMarkerBBox = m_markerLayoutInfo.calculateBoundaries(startMarker, midMarker, endMarker, strokeWidth, m_path);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPath.h b/src/3rdparty/webkit/WebCore/rendering/RenderPath.h
index 2ff179e243..d530f3cdaa 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPath.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPath.h
@@ -25,10 +25,10 @@
 #define RenderPath_h
 
 #if ENABLE(SVG)
-
+#include "AffineTransform.h"
 #include "FloatRect.h"
 #include "RenderSVGModelObject.h"
-#include "TransformationMatrix.h"
+#include "SVGMarkerLayoutInfo.h"
 
 namespace WebCore {
 
@@ -40,7 +40,7 @@ class RenderPath : public RenderSVGModelObject {
 public:
     RenderPath(SVGStyledTransformableElement*);
 
-    const Path& path() const;
+    const Path& path() const { return m_path; }
 
 private:
     // Hit-detection seperated for the fill and the stroke
@@ -48,9 +48,11 @@ private:
     bool strokeContains(const FloatPoint&, bool requiresStroke = true) const;
 
     virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect strokeBoundingBox() const;
+    virtual FloatRect markerBoundingBox() const;
     virtual FloatRect repaintRectInLocalCoordinates() const;
 
-    virtual TransformationMatrix localToParentTransform() const;
+    virtual const AffineTransform& localToParentTransform() const;
 
     void setPath(const Path&);
 
@@ -59,20 +61,22 @@ private:
 
     virtual void layout();
     virtual void paint(PaintInfo&, int parentX, int parentY);
-    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
+    virtual void addFocusRingRects(Vector<IntRect>&, int tx, int ty);
 
     virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
 
-    FloatRect drawMarkersIfNeeded(GraphicsContext*, const FloatRect&, const Path&) const;
+    void calculateMarkerBoundsIfNeeded() const;
 
 private:
-    virtual TransformationMatrix localTransform() const;
+    virtual AffineTransform localTransform() const;
 
     mutable Path m_path;
     mutable FloatRect m_cachedLocalFillBBox;
+    mutable FloatRect m_cachedLocalStrokeBBox;
     mutable FloatRect m_cachedLocalRepaintRect;
-    FloatRect m_markerBounds;
-    TransformationMatrix m_localTransform;
+    mutable FloatRect m_cachedLocalMarkerBBox;
+    mutable SVGMarkerLayoutInfo m_markerLayoutInfo;
+    AffineTransform m_localTransform;
 };
 
 inline RenderPath* toRenderPath(RenderObject* object)
@@ -94,5 +98,3 @@ void toRenderPath(const RenderPath*);
 
 #endif // ENABLE(SVG)
 #endif
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderProgress.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderProgress.cpp
new file mode 100644
index 0000000000..8a57612f29
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderProgress.cpp
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#if ENABLE(PROGRESS_TAG)
+
+#include "RenderProgress.h"
+
+#include "HTMLProgressElement.h"
+#include "RenderTheme.h"
+
+using namespace std;
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+static const int defaultProgressWidth = 120;
+static const int defaultProgressHeight = 20;
+
+RenderProgress::RenderProgress(HTMLProgressElement* element)
+    : RenderBlock(element)
+    , m_position(-1)
+{
+    setSize(IntSize(defaultProgressWidth, defaultProgressHeight));
+    setReplaced(true);
+}
+
+int RenderProgress::baselinePosition(bool, bool) const
+{
+    return height() + marginTop();
+}
+
+void RenderProgress::calcPrefWidths()
+{
+    m_minPrefWidth = 0;
+    m_maxPrefWidth = 0;
+
+    if (style()->width().isFixed() && style()->width().value() > 0)
+        m_minPrefWidth = m_maxPrefWidth = calcContentBoxWidth(style()->width().value());
+    else
+        m_maxPrefWidth = defaultProgressWidth * style()->effectiveZoom();
+
+    if (style()->minWidth().isFixed() && style()->minWidth().value() > 0) {
+        m_maxPrefWidth = max(m_maxPrefWidth, calcContentBoxWidth(style()->minWidth().value()));
+        m_minPrefWidth = max(m_minPrefWidth, calcContentBoxWidth(style()->minWidth().value()));
+    } else if (style()->width().isPercent() || (style()->width().isAuto() && style()->height().isPercent()))
+        m_minPrefWidth = 0;
+    else
+        m_minPrefWidth = m_maxPrefWidth;
+
+    if (style()->maxWidth().isFixed() && style()->maxWidth().value() != undefinedLength) {
+        m_maxPrefWidth = min(m_maxPrefWidth, calcContentBoxWidth(style()->maxWidth().value()));
+        m_minPrefWidth = min(m_minPrefWidth, calcContentBoxWidth(style()->maxWidth().value()));
+    }
+
+    int toAdd = paddingLeft() + paddingRight() + borderLeft() + borderRight();
+    m_minPrefWidth += toAdd;
+    m_maxPrefWidth += toAdd;
+
+    setPrefWidthsDirty(false);
+}
+
+void RenderProgress::layout()
+{
+    ASSERT(needsLayout());
+
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
+
+    calcWidth();
+    calcHeight();
+
+    m_overflow.clear();
+
+    repainter.repaintAfterLayout();
+
+    setNeedsLayout(false);
+}
+
+void RenderProgress::updateFromElement()
+{
+    HTMLProgressElement* element = static_cast<HTMLProgressElement*>(node());
+    double position = element->position();
+    int oldPosition = m_position;
+    bool canOptimize = theme()->getNumberOfPixelsForProgressPosition(position, m_position);
+    if (oldPosition == m_position)
+        return;
+
+    IntRect paintRect = contentBoxRect();
+    if (canOptimize) {
+        // FIXME: Need to handle indeterminate progress bar and RTL
+        int adjustedPosition = (m_position >= 0) ? m_position : 0;
+        int adjustedOldPosition = (oldPosition >= 0) ? oldPosition : 0;
+        paintRect.setX(std::min(adjustedPosition, adjustedOldPosition));
+        paintRect.setWidth(std::max(adjustedPosition, adjustedOldPosition) - paintRect.x());
+    }
+    repaintRectangle(paintRect);
+}
+
+} // namespace WebCore
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderProgress.h b/src/3rdparty/webkit/WebCore/rendering/RenderProgress.h
new file mode 100644
index 0000000000..0a90fde54a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderProgress.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef RenderProgress_h
+#define RenderProgress_h
+
+#if ENABLE(PROGRESS_TAG)
+#include "RenderBlock.h"
+
+namespace WebCore {
+
+class HTMLProgressElement;
+
+class RenderProgress : public RenderBlock {
+public:
+    RenderProgress(HTMLProgressElement*);
+    int position() { return m_position; }
+
+private:
+    virtual const char* renderName() const { return "RenderProgress"; }
+    virtual bool isProgress() const { return true; }
+    virtual int baselinePosition(bool, bool) const;
+    virtual void calcPrefWidths();
+    virtual void layout();
+    virtual void updateFromElement();
+    int m_position;
+};
+
+inline RenderProgress* toRenderProgress(RenderObject* object)
+{
+    ASSERT(!object || object->isProgress());
+    return static_cast<RenderProgress*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderProgress(const RenderProgress*);
+
+} // namespace WebCore
+
+#endif
+
+#endif // RenderProgress_h
+
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.cpp
index 27d2e72af7..ba579dfcea 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.cpp
@@ -153,7 +153,7 @@ void RenderReplaced::paint(PaintInfo& paintInfo, int tx, int ty)
     if (drawSelectionTint) {
         IntRect selectionPaintingRect = localSelectionRect();
         selectionPaintingRect.move(tx, ty);
-        paintInfo.context->fillRect(selectionPaintingRect, selectionBackgroundColor());
+        paintInfo.context->fillRect(selectionPaintingRect, selectionBackgroundColor(), style()->colorSpace());
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.h b/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.h
index 0ba6b8abc2..b5c61791b6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.h
@@ -46,8 +46,8 @@ protected:
     void setIntrinsicSize(const IntSize&);
     virtual void intrinsicSizeChanged();
 
+    virtual void paint(PaintInfo&, int tx, int ty);
     bool shouldPaint(PaintInfo&, int& tx, int& ty);
-    void adjustOverflowForBoxShadowAndReflect();
     IntRect localSelectionRect(bool checkWhetherSelected = true) const;
 
 private:
@@ -62,7 +62,6 @@ private:
 
     virtual int minimumReplacedHeight() const { return 0; }
 
-    virtual void paint(PaintInfo&, int tx, int ty);
     virtual void paintReplaced(PaintInfo&, int /*tx*/, int /*ty*/) { }
 
     virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderReplica.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderReplica.cpp
index 5fa3c620cc..1d589ae725 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderReplica.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderReplica.cpp
@@ -72,7 +72,7 @@ void RenderReplica::paint(PaintInfo& paintInfo, int tx, int ty)
         // computing using the wrong rootLayer
         layer()->parent()->paintLayer(layer()->transform() ? layer()->parent() : layer()->enclosingTransformedAncestor(),
                                       paintInfo.context, paintInfo.rect,
-                                      PaintRestrictionNone, 0, 0,
+                                      PaintBehaviorNormal, 0, 0,
                                       RenderLayer::PaintLayerHaveTransparency | RenderLayer::PaintLayerAppliedTransform | RenderLayer::PaintLayerTemporaryClipRects | RenderLayer::PaintLayerPaintingReflection);
     else if (paintInfo.phase == PaintPhaseMask)
         paintMask(paintInfo, tx, ty);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderReplica.h b/src/3rdparty/webkit/WebCore/rendering/RenderReplica.h
index d5db3b742f..48c64e4aa5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderReplica.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderReplica.h
@@ -46,6 +46,10 @@ public:
     virtual void calcPrefWidths();
     
     virtual void paint(PaintInfo&, int tx, int ty);
+
+private:
+    virtual bool isReplica() const { return true; }
+
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderRuby.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderRuby.cpp
new file mode 100644
index 0000000000..4ab9d735e6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderRuby.cpp
@@ -0,0 +1,197 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(RUBY)
+#include "RenderRuby.h"
+
+#include "RenderRubyRun.h"
+
+namespace WebCore {
+
+//=== generic helper functions to avoid excessive code duplication ===
+
+static RenderRubyRun* lastRubyRun(const RenderObject* ruby)
+{
+    RenderObject* child = ruby->lastChild();
+    if (child && ruby->isAfterContent(child))
+        child = child->previousSibling();
+    ASSERT(!child || child->isRubyRun());
+    return static_cast<RenderRubyRun*>(child);
+}
+
+static inline RenderRubyRun* findRubyRunParent(RenderObject* child)
+{
+    while (child && !child->isRubyRun())
+        child = child->parent();
+    return static_cast<RenderRubyRun*>(child);
+}
+
+//=== ruby as inline object ===
+
+RenderRubyAsInline::RenderRubyAsInline(Node* node)
+    : RenderInline(node)
+{
+}
+
+RenderRubyAsInline::~RenderRubyAsInline()
+{
+}
+
+bool RenderRubyAsInline::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isRubyText()
+        || child->isRubyRun()
+        || child->isInline();
+}
+
+void RenderRubyAsInline::addChild(RenderObject* child, RenderObject* beforeChild)
+{
+    // Note: ':after' content is handled implicitely below
+
+    // if child is a ruby run, just add it normally
+    if (child->isRubyRun()) {
+        RenderInline::addChild(child, beforeChild);
+        return;
+    }
+
+    if (beforeChild && !isAfterContent(beforeChild)) {
+        // insert child into run
+        ASSERT(!beforeChild->isRubyRun());
+        RenderRubyRun* run = findRubyRunParent(beforeChild);
+        ASSERT(run); // beforeChild should always have a run as parent
+        if (run) {
+            run->addChild(child, beforeChild);
+            return;
+        }
+        ASSERT(false); // beforeChild should always have a run as parent!
+        // Emergency fallback: fall through and just append.
+    }
+
+    // If the new child would be appended, try to add the child to the previous run
+    // if possible, or create a new run otherwise.
+    // (The RenderRubyRun object will handle the details)
+    RenderRubyRun* lastRun = lastRubyRun(this);
+    if (!lastRun || lastRun->hasRubyText()) {
+        lastRun = RenderRubyRun::staticCreateRubyRun(this);
+        RenderInline::addChild(lastRun);
+    }
+    lastRun->addChild(child);
+}
+
+void RenderRubyAsInline::removeChild(RenderObject* child)
+{
+    // If the child's parent is *this, i.e. a ruby run or ':after' content,
+    // just use the normal remove method.
+    if (child->parent() == this) {
+        ASSERT(child->isRubyRun() || child->isAfterContent());
+        RenderInline::removeChild(child);
+        return;
+    }
+
+    // Find the containing run
+    RenderRubyRun* run = findRubyRunParent(child);
+    ASSERT(run);
+    run->removeChild(child);
+}
+
+
+//=== ruby as block object ===
+
+RenderRubyAsBlock::RenderRubyAsBlock(Node* node)
+    : RenderBlock(node)
+{
+}
+
+RenderRubyAsBlock::~RenderRubyAsBlock()
+{
+}
+
+bool RenderRubyAsBlock::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isRubyText()
+        || child->isRubyRun()
+        || child->isInline();
+}
+
+void RenderRubyAsBlock::addChild(RenderObject* child, RenderObject* beforeChild)
+{
+    // Note: ':after' content is handled implicitely below
+
+    // if child is a ruby run, just add it normally
+    if (child->isRubyRun()) {
+        RenderBlock::addChild(child, beforeChild);
+        return;
+    }
+
+    if (beforeChild && !isAfterContent(beforeChild)) {
+        // insert child into run
+        ASSERT(!beforeChild->isRubyRun());
+        RenderObject* run = beforeChild;
+        while (run && !run->isRubyRun())
+            run = run->parent();
+        if (run) {
+            run->addChild(child, beforeChild);
+            return;
+        }
+        ASSERT(false); // beforeChild should always have a run as parent!
+        // Emergency fallback: fall through and just append.
+    }
+
+    // If the new child would be appended, try to add the child to the previous run
+    // if possible, or create a new run otherwise.
+    // (The RenderRubyRun object will handle the details)
+    RenderRubyRun* lastRun = lastRubyRun(this);
+    if (!lastRun || lastRun->hasRubyText()) {
+        lastRun = RenderRubyRun::staticCreateRubyRun(this);
+        RenderBlock::addChild(lastRun);
+    }
+    lastRun->addChild(child);
+}
+
+void RenderRubyAsBlock::removeChild(RenderObject* child)
+{
+    // If the child's parent is *this, just use the normal remove method.
+    if (child->parent() == this) {
+        // This should happen only during destruction of the whole ruby element, though.
+        RenderBlock::removeChild(child);
+        return;
+    }
+
+    // Find the containing run
+    RenderRubyRun* run = findRubyRunParent(child);
+    ASSERT(run);
+    run->removeChild(child);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(RUBY)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderRuby.h b/src/3rdparty/webkit/WebCore/rendering/RenderRuby.h
new file mode 100644
index 0000000000..a5dafe981d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderRuby.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderRuby_h
+#define RenderRuby_h
+
+#if ENABLE(RUBY)
+
+#include "RenderBlock.h"
+#include "RenderInline.h"
+
+namespace WebCore {
+
+// Following the HTML 5 spec, the box object model for a <ruby> element allows several runs of ruby
+// bases with their respective ruby texts looks as follows:
+//
+// 1 RenderRuby object, corresponding to the whole <ruby> HTML element
+//      1+ RenderRubyRun (anonymous)
+//          0 or 1 RenderRubyText - shuffled to the front in order to re-use existing block layouting
+//              0-n inline object(s)
+//          0 or 1 RenderRubyBase - contains the inline objects that make up the ruby base
+//              1-n inline object(s)
+//
+// Note: <rp> elements are defined as having 'display:none' and thus normally are not assigned a renderer.
+
+// <ruby> when used as 'display:inline'
+class RenderRubyAsInline : public RenderInline {
+public:
+    RenderRubyAsInline(Node*);
+    virtual ~RenderRubyAsInline();
+
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+    virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual void removeChild(RenderObject* child);
+
+private:
+    virtual bool isRuby() const { return true; }
+    virtual const char* renderName() const { return "RenderRuby (inline)"; }
+    virtual bool createsAnonymousWrapper() const { return true; }
+    virtual void removeLeftoverAnonymousBlock(RenderBlock*) { ASSERT_NOT_REACHED(); }
+};
+
+// <ruby> when used as 'display:block' or 'display:inline-block'
+class RenderRubyAsBlock : public RenderBlock {
+public:
+    RenderRubyAsBlock(Node*);
+    virtual ~RenderRubyAsBlock();
+
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+    virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual void removeChild(RenderObject* child);
+
+private:
+    virtual bool isRuby() const { return true; }
+    virtual const char* renderName() const { return "RenderRuby (block)"; }
+    virtual bool createsAnonymousWrapper() const { return true; }
+    virtual void removeLeftoverAnonymousBlock(RenderBlock*) { ASSERT_NOT_REACHED(); }
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // RenderRuby_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderRubyBase.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderRubyBase.cpp
new file mode 100644
index 0000000000..9b2dc9ef6f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderRubyBase.cpp
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(RUBY)
+#include "RenderRubyBase.h"
+
+namespace WebCore {
+
+RenderRubyBase::RenderRubyBase(Node* node)
+    : RenderBlock(node)
+{
+    setInline(false);
+}
+
+RenderRubyBase::~RenderRubyBase()
+{
+}
+
+bool RenderRubyBase::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isInline();
+}
+
+bool RenderRubyBase::hasOnlyWrappedInlineChildren(RenderObject* beforeChild) const
+{
+    // Tests whether all children in the base before beforeChild are either floated/positioned,
+    // or inline objects wrapped in anonymous blocks.
+    // Note that beforeChild may be 0, in which case all children are looked at.
+    for (RenderObject* child = firstChild(); child != beforeChild; child = child->nextSibling()) {
+        if (!child->isFloatingOrPositioned() && !(child->isAnonymousBlock() && child->childrenInline()))
+            return false;
+    }
+    return true;
+}
+
+void RenderRubyBase::moveChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild)
+{
+    // This function removes all children that are before (!) beforeChild
+    // and appends them to toBase.
+    ASSERT(toBase);
+    
+    // First make sure that beforeChild (if set) is indeed a direct child of this.
+    // Inline children might be wrapped in an anonymous block if there's a continuation.
+    // Theoretically, in ruby bases, this can happen with only the first such a child,
+    // so it should be OK to just climb the tree.
+    while (fromBeforeChild && fromBeforeChild->parent() != this)
+        fromBeforeChild = fromBeforeChild->parent();
+
+    if (childrenInline())
+        moveInlineChildren(toBase, fromBeforeChild);
+    else
+        moveBlockChildren(toBase, fromBeforeChild);
+
+    setNeedsLayoutAndPrefWidthsRecalc();
+    toBase->setNeedsLayoutAndPrefWidthsRecalc();
+}
+
+void RenderRubyBase::moveInlineChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild)
+{
+    RenderBlock* toBlock;
+
+    if (toBase->childrenInline()) {
+        // The standard and easy case: move the children into the target base
+        toBlock = toBase;
+    } else {
+        // We need to wrap the inline objects into an anonymous block.
+        // If toBase has a suitable block, we re-use it, otherwise create a new one.
+        RenderObject* lastChild = toBase->lastChild();
+        if (lastChild && lastChild->isAnonymousBlock() && lastChild->childrenInline())
+            toBlock = toRenderBlock(lastChild);
+        else {
+            toBlock = toBase->createAnonymousBlock();
+            toBase->children()->appendChildNode(toBase, toBlock);
+        }
+    }
+    // Move our inline children into the target block we determined above.
+    for (RenderObject* child = firstChild(); child != fromBeforeChild; child = firstChild())
+        moveChildTo(toBlock, toBlock->children(), child);
+}
+
+void RenderRubyBase::moveBlockChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild)
+{
+    if (toBase->childrenInline()) {
+        // First check whether we move only wrapped inline objects.
+        if (hasOnlyWrappedInlineChildren(fromBeforeChild)) {
+            // The reason why the base is in block flow must be after beforeChild.
+            // We therefore can extract the inline objects and move them to toBase.
+            for (RenderObject* child = firstChild(); child != fromBeforeChild; child = firstChild()) {
+                if (child->isAnonymousBlock()) {
+                    RenderBlock* anonBlock = toRenderBlock(child);
+                    ASSERT(anonBlock->childrenInline());
+                    ASSERT(!anonBlock->inlineContinuation());
+                    anonBlock->moveAllChildrenTo(toBase, toBase->children());
+                    anonBlock->deleteLineBoxTree();
+                    anonBlock->destroy();
+                } else {
+                    ASSERT(child->isFloatingOrPositioned());
+                    moveChildTo(toBase, toBase->children(), child);
+                }
+            }
+        } else {
+            // Moving block children -> have to set toBase as block flow
+            toBase->makeChildrenNonInline();
+            // Move children, potentially collapsing anonymous block wrappers.
+            mergeBlockChildren(toBase, fromBeforeChild);
+
+            // Now we need to check if the leftover children are all inline.
+            // If so, make this base inline again.
+            if (hasOnlyWrappedInlineChildren()) {
+                RenderObject* next = 0;
+                for (RenderObject* child = firstChild(); child; child = next) {
+                    next = child->nextSibling();
+                    if (child->isFloatingOrPositioned())
+                        continue;
+                    ASSERT(child->isAnonymousBlock());
+
+                    RenderBlock* anonBlock = toRenderBlock(child);
+                    ASSERT(anonBlock->childrenInline());
+                    ASSERT(!anonBlock->inlineContinuation());
+                    // Move inline children out of anonymous block.
+                    anonBlock->moveAllChildrenTo(this, children(), anonBlock);
+                    anonBlock->deleteLineBoxTree();
+                    anonBlock->destroy();
+                }
+                setChildrenInline(true);
+            }
+        }
+    } else
+        mergeBlockChildren(toBase, fromBeforeChild);
+}
+
+void RenderRubyBase::mergeBlockChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild)
+{
+    // This function removes all children that are before fromBeforeChild and appends them to toBase.
+    ASSERT(!childrenInline());
+    ASSERT(toBase);
+    ASSERT(!toBase->childrenInline());
+
+    // Quick check whether we have anything to do, to simplify the following code.
+    if (fromBeforeChild != firstChild())
+        return;
+
+    // If an anonymous block would be put next to another such block, then merge those.
+    RenderObject* firstChildHere = firstChild();
+    RenderObject* lastChildThere = toBase->lastChild();
+    if (firstChildHere && firstChildHere->isAnonymousBlock() && firstChildHere->childrenInline() 
+            && lastChildThere && lastChildThere->isAnonymousBlock() && lastChildThere->childrenInline()) {            
+        RenderBlock* anonBlockHere = toRenderBlock(firstChildHere);
+        RenderBlock* anonBlockThere = toRenderBlock(lastChildThere);
+        anonBlockHere->moveAllChildrenTo(anonBlockThere, anonBlockThere->children());
+        anonBlockHere->deleteLineBoxTree();
+        anonBlockHere->destroy();
+    }
+    // Move all remaining children normally.
+    for (RenderObject* child = firstChild(); child != fromBeforeChild; child = firstChild())
+        moveChildTo(toBase, toBase->children(), child);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(RUBY)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderRubyBase.h b/src/3rdparty/webkit/WebCore/rendering/RenderRubyBase.h
new file mode 100644
index 0000000000..29c4858f57
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderRubyBase.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderRubyBase_h
+#define RenderRubyBase_h
+
+#if ENABLE(RUBY)
+
+#include "RenderBlock.h"
+
+namespace WebCore {
+
+class RenderRubyBase : public RenderBlock {
+public:
+    RenderRubyBase(Node*);
+    virtual ~RenderRubyBase();
+
+    virtual const char* renderName() const { return "RenderRubyBase (anonymous)"; }
+
+    virtual bool isRubyBase() const { return true; }
+
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+
+private:
+    bool hasOnlyWrappedInlineChildren(RenderObject* beforeChild = 0) const;
+
+    void moveChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild = 0);
+    void moveInlineChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild = 0);
+    void moveBlockChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild = 0);
+    void mergeBlockChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild = 0);
+    
+    // Allow RenderRubyRun to manipulate the children within ruby bases.
+    friend class RenderRubyRun;
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // RenderRubyBase_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderRubyRun.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderRubyRun.cpp
new file mode 100644
index 0000000000..d91c625eef
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderRubyRun.cpp
@@ -0,0 +1,228 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(RUBY)
+#include "RenderRubyRun.h"
+
+#include "RenderRubyBase.h"
+#include "RenderRubyText.h"
+#include "RenderView.h"
+
+using namespace std;
+
+namespace WebCore {
+
+RenderRubyRun::RenderRubyRun(Node* node)
+    : RenderBlock(node)
+    , m_beingDestroyed(false)
+{
+    setReplaced(true);
+    setInline(true);
+}
+
+RenderRubyRun::~RenderRubyRun()
+{
+}
+
+void RenderRubyRun::destroy()
+{
+    // Mark if the run is being destroyed to avoid trouble in removeChild().
+    m_beingDestroyed = true;
+    RenderBlock::destroy();
+}
+
+bool RenderRubyRun::hasRubyText() const
+{
+    // The only place where a ruby text can be is in the first position
+    // Note: As anonymous blocks, ruby runs do not have ':before' or ':after' content themselves.
+    return firstChild() && firstChild()->isRubyText();
+}
+
+bool RenderRubyRun::hasRubyBase() const
+{
+    // The only place where a ruby base can be is in the last position
+    // Note: As anonymous blocks, ruby runs do not have ':before' or ':after' content themselves.
+    return lastChild() && lastChild()->isRubyBase();
+}
+
+bool RenderRubyRun::isEmpty() const
+{
+    return !hasRubyText() && !hasRubyBase();
+}
+
+RenderRubyText* RenderRubyRun::rubyText() const
+{
+    RenderObject* child = firstChild();
+    return child && child->isRubyText() ? static_cast<RenderRubyText*>(child) : 0;
+}
+
+RenderRubyBase* RenderRubyRun::rubyBase() const
+{
+    RenderObject* child = lastChild();
+    return child && child->isRubyBase() ? static_cast<RenderRubyBase*>(child) : 0;
+}
+
+RenderRubyBase* RenderRubyRun::rubyBaseSafe()
+{
+    RenderRubyBase* base = rubyBase();
+    if (!base) {
+        base = createRubyBase();
+        RenderBlock::addChild(base);
+    }
+    return base;
+}
+
+RenderBlock* RenderRubyRun::firstLineBlock() const
+{
+    return 0;
+}
+
+void RenderRubyRun::updateFirstLetter()
+{
+}
+
+bool RenderRubyRun::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isRubyText() || child->isInline();
+}
+
+void RenderRubyRun::addChild(RenderObject* child, RenderObject* beforeChild)
+{
+    ASSERT(child);
+
+    // If child is a ruby text
+    if (child->isRubyText()) {
+        if (!beforeChild) {
+            // RenderRuby has already ascertained that we can add the child here.
+            ASSERT(!hasRubyText());
+            // prepend ruby texts as first child
+            RenderBlock::addChild(child, firstChild());
+        }  else if (beforeChild->isRubyText()) {
+            // New text is inserted just before another.
+            // In this case the new text takes the place of the old one, and
+            // the old text goes into a new run that is inserted as next sibling.
+            ASSERT(beforeChild->parent() == this);
+            RenderObject* ruby = parent();
+            ASSERT(ruby->isRuby());
+            RenderBlock* newRun = staticCreateRubyRun(ruby);
+            ruby->addChild(newRun, nextSibling());
+            // Add the new ruby text and move the old one to the new run
+            // Note: Doing it in this order and not using RenderRubyRun's methods,
+            // in order to avoid automatic removal of the ruby run in case there is no
+            // other child besides the old ruby text.
+            RenderBlock::addChild(child, beforeChild);
+            RenderBlock::removeChild(beforeChild);
+            newRun->addChild(beforeChild);
+        } else {
+            ASSERT(hasRubyBase()); // Otherwise beforeChild would be borked.
+            // Insertion before a ruby base object.
+            // In this case we need insert a new run before the current one and split the base.
+            RenderObject* ruby = parent();
+            RenderRubyRun* newRun = staticCreateRubyRun(ruby);
+            ruby->addChild(newRun, this);
+            newRun->addChild(child);
+            rubyBaseSafe()->moveChildren(newRun->rubyBaseSafe(), beforeChild);
+        }
+    } else {
+        // child is not a text -> insert it into the base
+        // (append it instead if beforeChild is the ruby text)
+        if (beforeChild && beforeChild->isRubyText())
+            beforeChild = 0;
+        rubyBaseSafe()->addChild(child, beforeChild);
+    }
+}
+
+void RenderRubyRun::removeChild(RenderObject* child)
+{
+    // If the child is a ruby text, then merge the ruby base with the base of
+    // the right sibling run, if possible.
+    if (!m_beingDestroyed && !documentBeingDestroyed() && child->isRubyText()) {
+        RenderRubyBase* base = rubyBase();
+        RenderObject* rightNeighbour = nextSibling();
+        if (base && rightNeighbour && rightNeighbour->isRubyRun()) {
+            // Ruby run without a base can happen only at the first run.
+            RenderRubyRun* rightRun = static_cast<RenderRubyRun*>(rightNeighbour);
+            ASSERT(rightRun->hasRubyBase());
+            RenderRubyBase* rightBase = rightRun->rubyBaseSafe();
+            // Collect all children in a single base, then swap the bases.
+            rightBase->moveChildren(base);
+            moveChildTo(rightRun, rightRun->children(), base);
+            rightRun->moveChildTo(this, children(), rightBase);
+            // The now empty ruby base will be removed below.
+        }
+    }
+
+    RenderBlock::removeChild(child);
+
+    if (!m_beingDestroyed && !documentBeingDestroyed()) {
+        // Check if our base (if any) is now empty. If so, destroy it.
+        RenderBlock* base = rubyBase();
+        if (base && !base->firstChild()) {
+            RenderBlock::removeChild(base);
+            base->deleteLineBoxTree();
+            base->destroy();
+        }
+
+        // If any of the above leaves the run empty, destroy it as well.
+        if (isEmpty()) {
+            parent()->removeChild(this);
+            deleteLineBoxTree();
+            destroy();
+        }
+    }
+}
+
+RenderRubyBase* RenderRubyRun::createRubyBase() const
+{
+    RenderRubyBase* rb = new (renderArena()) RenderRubyBase(document() /* anonymous */);
+    RefPtr<RenderStyle> newStyle = RenderStyle::create();
+    newStyle->inheritFrom(style());
+    newStyle->setDisplay(BLOCK);
+    newStyle->setTextAlign(CENTER); // FIXME: use WEBKIT_CENTER?
+    rb->setStyle(newStyle.release());
+    return rb;
+}
+
+RenderRubyRun* RenderRubyRun::staticCreateRubyRun(const RenderObject* parentRuby)
+{
+    ASSERT(parentRuby && parentRuby->isRuby());
+    RenderRubyRun* rr = new (parentRuby->renderArena()) RenderRubyRun(parentRuby->document() /* anonymous */);
+    RefPtr<RenderStyle> newStyle = RenderStyle::create();
+    newStyle->inheritFrom(parentRuby->style());
+    newStyle->setDisplay(INLINE_BLOCK);
+    rr->setStyle(newStyle.release());
+    return rr;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(RUBY)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderRubyRun.h b/src/3rdparty/webkit/WebCore/rendering/RenderRubyRun.h
new file mode 100644
index 0000000000..acf359bb01
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderRubyRun.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderRubyRun_h
+#define RenderRubyRun_h
+
+#if ENABLE(RUBY)
+
+#include "RenderBlock.h"
+
+namespace WebCore {
+
+class RenderRubyBase;
+class RenderRubyText;
+
+// RenderRubyRun are 'inline-block/table' like objects,and wrap a single pairing of a ruby base with its ruby text(s).
+// See RenderRuby.h for further comments on the structure
+
+class RenderRubyRun : public RenderBlock {
+public:
+    RenderRubyRun(Node*);
+    virtual ~RenderRubyRun();
+
+    virtual void destroy();
+
+    bool hasRubyText() const;
+    bool hasRubyBase() const;
+    bool isEmpty() const;
+    RenderRubyText* rubyText() const;
+    RenderRubyBase* rubyBase() const;
+    RenderRubyBase* rubyBaseSafe(); // creates the base if it doesn't already exist
+
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+    virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual void removeChild(RenderObject* child);
+
+    virtual RenderBlock* firstLineBlock() const;
+    virtual void updateFirstLetter();
+
+    static RenderRubyRun* staticCreateRubyRun(const RenderObject* parentRuby);
+
+protected:
+    RenderRubyBase* createRubyBase() const;
+
+private:
+    virtual bool isRubyRun() const { return true; }
+    virtual const char* renderName() const { return "RenderRubyRun (anonymous)"; }
+    virtual bool createsAnonymousWrapper() const { return true; }
+    virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
+
+    bool m_beingDestroyed;
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // RenderRubyRun_h
diff --git a/src/3rdparty/webkit/WebCore/editing/chromium/EditorChromium.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderRubyText.cpp
index 1ea085b7d8..12e8feace3 100644
--- a/src/3rdparty/webkit/WebCore/editing/chromium/EditorChromium.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderRubyText.cpp
@@ -1,10 +1,10 @@
 /*
- * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
- * 
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -29,16 +29,26 @@
  */
 
 #include "config.h"
-#include "Editor.h"
 
-#include "ChromiumDataObject.h"
-#include "ClipboardChromium.h"
+#if ENABLE(RUBY)
+#include "RenderRubyText.h"
 
 namespace WebCore {
 
-PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
+RenderRubyText::RenderRubyText(Node* node)
+    : RenderBlock(node)
 {
-    return ClipboardChromium::create(false, ChromiumDataObject::create(), policy);
+}
+
+RenderRubyText::~RenderRubyText()
+{
+}
+
+bool RenderRubyText::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isInline();
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(RUBY)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h b/src/3rdparty/webkit/WebCore/rendering/RenderRubyText.h
index df52379f46..865d1798bd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderRubyText.h
@@ -28,31 +28,29 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ScriptObjectQuarantine_h
-#define ScriptObjectQuarantine_h
+#ifndef RenderRubyText_h
+#define RenderRubyText_h
 
-#include "ScriptState.h"
+#if ENABLE(RUBY)
+
+#include "RenderBlock.h"
 
 namespace WebCore {
 
-    class Database;
-    class DOMWindow;
-    class Node;
-    class ScriptObject;
-    class ScriptValue;
-    class Storage;
+class RenderRubyText : public RenderBlock {
+public:
+    RenderRubyText(Node*);
+    virtual ~RenderRubyText();
 
-    ScriptValue quarantineValue(ScriptState*, const ScriptValue&);
+    virtual const char* renderName() const { return "RenderRubyText"; }
 
-#if ENABLE(DATABASE)
-    bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
-#endif
-#if ENABLE(DOM_STORAGE)
-    bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject);
-#endif
-    bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
-    bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
+    virtual bool isRubyText() const { return true; }
 
-}
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+};
+
+} // namespace WebCore
+
+#endif
 
-#endif // ScriptObjectQuarantine_h
+#endif // RenderRubyText_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.cpp
index f065c44b07..99725d618c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.cpp
@@ -1,8 +1,7 @@
 /*
- * This file is part of the WebKit project.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
- *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -40,9 +39,7 @@ void RenderSVGBlock::setStyle(PassRefPtr<RenderStyle> style)
     RefPtr<RenderStyle> useStyle = style;
 
     // SVG text layout code expects us to be a block-level style element.   
-    if (useStyle->display() == NONE)
-        setChildrenInline(false);
-    else if (useStyle->isDisplayInlineType()) {
+    if (useStyle->isDisplayInlineType()) {
         RefPtr<RenderStyle> newStyle = RenderStyle::create();
         newStyle->inheritFrom(useStyle.get());
         newStyle->setDisplay(BLOCK);
@@ -50,14 +47,27 @@ void RenderSVGBlock::setStyle(PassRefPtr<RenderStyle> style)
     }
 
     RenderBlock::setStyle(useStyle.release());
-    setReplaced(false);
+}
+
+void RenderSVGBlock::updateBoxModelInfoFromStyle()
+{
+    RenderBlock::updateBoxModelInfoFromStyle();
 
-    //FIXME: Once overflow rules are supported by SVG we should
-    //probably map the CSS overflow rules rather than just ignoring
-    //them
+    // RenderSVGlock, used by Render(SVGText|ForeignObject), is not allowed to call setHasOverflowClip(true).
+    // RenderBlock assumes a layer to be present when the overflow clip functionality is requested. Both
+    // Render(SVGText|ForeignObject) return 'false' on 'requiresLayer'. Fine for RenderSVGText.
+    //
+    // If we want to support overflow rules for <foreignObject> we can choose between two solutions:
+    // a) make RenderForeignObject require layers and SVG layer aware
+    // b) reactor overflow logic out of RenderLayer (as suggested by dhyatt), which is a large task
+    //
+    // Until this is resolved, disable overflow support. Opera/FF don't support it as well at the moment (Feb 2010).
+    //
+    // Note: This does NOT affect overflow handling on outer/inner <svg> elements - this is handled
+    // manually by RenderSVGRoot - which owns the documents enclosing root layer and thus works fine.
     setHasOverflowClip(false);
 }
 
 }
 
-#endif // ENABLE(SVG)
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.h
index a4ececb3cd..19cac62720 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the WebKit project.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
@@ -22,8 +20,8 @@
 
 #ifndef RenderSVGBlock_h
 #define RenderSVGBlock_h
-#if ENABLE(SVG)
 
+#if ENABLE(SVG)
 #include "RenderBlock.h"
 #include "SVGRenderSupport.h"
 
@@ -35,10 +33,13 @@ class RenderSVGBlock : public RenderBlock, protected SVGRenderBase {
 public:
     RenderSVGBlock(SVGElement*);
 
+    virtual const SVGRenderBase* toSVGRenderBase() const { return this; }
+
 private:
     virtual void setStyle(PassRefPtr<RenderStyle>);
+    virtual void updateBoxModelInfoFromStyle();
 };
 
 }
-#endif // ENABLE(SVG)
-#endif // !RenderSVGBlock_h
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.cpp
index d7aec99dfe..6d1b965682 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.cpp
@@ -3,6 +3,7 @@
                   2004, 2005, 2007, 2008 Rob Buis <buis@kde.org>
                   2007 Eric Seidel <eric@webkit.org>
     Copyright (C) 2009 Google, Inc.  All rights reserved.
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -25,14 +26,11 @@
 #if ENABLE(SVG)
 #include "RenderSVGContainer.h"
 
-#include "AXObjectCache.h"
-#include "FloatQuad.h"
 #include "GraphicsContext.h"
 #include "RenderView.h"
 #include "SVGRenderSupport.h"
 #include "SVGResourceFilter.h"
 #include "SVGStyledElement.h"
-#include "SVGURIReference.h"
 
 namespace WebCore {
 
@@ -62,17 +60,7 @@ void RenderSVGContainer::layout()
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout() || selfWillPaint());
     calculateLocalTransform(); // Allow RenderSVGTransformableContainer to update its transform
 
-    for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
-        // Only force our kids to layout if we're being asked to relayout as a result of a parent changing
-        // FIXME: We should be able to skip relayout of non-relative kids when only bounds size has changed
-        // that's a possible future optimization using LayoutState
-        // http://bugs.webkit.org/show_bug.cgi?id=15391
-        if (selfNeedsLayout())
-            child->setNeedsLayout(true);
-
-        child->layoutIfNeeded();
-        ASSERT(!child->needsLayout());
-    }
+    layoutChildren(this, selfNeedsLayout());
     repainter.repaintAfterLayout();
 
     setNeedsLayout(false);
@@ -82,7 +70,7 @@ bool RenderSVGContainer::selfWillPaint() const
 {
 #if ENABLE(FILTERS)
     const SVGRenderStyle* svgStyle = style()->svgStyle();
-    SVGResourceFilter* filter = getFilterById(document(), svgStyle->filter());
+    SVGResourceFilter* filter = getFilterById(document(), svgStyle->filter(), this);
     if (filter)
         return true;
 #endif
@@ -94,7 +82,7 @@ void RenderSVGContainer::paint(PaintInfo& paintInfo, int, int)
     if (paintInfo.context->paintingDisabled() || !drawsContents())
         return;
 
-     // Spec: groups w/o children still may render filter content.
+    // Spec: groups w/o children still may render filter content.
     if (!firstChild() && !selfWillPaint())
         return;
 
@@ -109,12 +97,16 @@ void RenderSVGContainer::paint(PaintInfo& paintInfo, int, int)
 
     SVGResourceFilter* filter = 0;
     FloatRect boundingBox = repaintRectInLocalCoordinates();
+
+    bool continueRendering = true;
     if (childPaintInfo.phase == PaintPhaseForeground)
-        prepareToRenderSVGContent(this, childPaintInfo, boundingBox, filter);
+        continueRendering = prepareToRenderSVGContent(this, childPaintInfo, boundingBox, filter);
 
-    childPaintInfo.paintingRoot = paintingRootForChildren(childPaintInfo);
-    for (RenderObject* child = firstChild(); child; child = child->nextSibling())
-        child->paint(childPaintInfo, 0, 0);
+    if (continueRendering) {
+        childPaintInfo.paintingRoot = paintingRootForChildren(childPaintInfo);
+        for (RenderObject* child = firstChild(); child; child = child->nextSibling())
+            child->paint(childPaintInfo, 0, 0);
+    }
 
     if (paintInfo.phase == PaintPhaseForeground)
         finishRenderSVGContent(this, childPaintInfo, filter, paintInfo.context);
@@ -132,10 +124,11 @@ void RenderSVGContainer::paint(PaintInfo& paintInfo, int, int)
 }
 
 // addFocusRingRects is called from paintOutline and needs to be in the same coordinates as the paintOuline call
-void RenderSVGContainer::addFocusRingRects(GraphicsContext* graphicsContext, int, int)
+void RenderSVGContainer::addFocusRingRects(Vector<IntRect>& rects, int, int)
 {
     IntRect paintRectInParent = enclosingIntRect(localToParentTransform().mapRect(repaintRectInLocalCoordinates()));
-    graphicsContext->addFocusRingRect(paintRectInParent);
+    if (!paintRectInParent.isEmpty())
+        rects.append(paintRectInParent);
 }
 
 FloatRect RenderSVGContainer::objectBoundingBox() const
@@ -143,14 +136,30 @@ FloatRect RenderSVGContainer::objectBoundingBox() const
     return computeContainerBoundingBox(this, false);
 }
 
+FloatRect RenderSVGContainer::strokeBoundingBox() const
+{
+    return computeContainerBoundingBox(this, true);
+}
+
 // RenderSVGContainer is used for <g> elements which do not themselves have a
 // width or height, so we union all of our child rects as our repaint rect.
 FloatRect RenderSVGContainer::repaintRectInLocalCoordinates() const
 {
     FloatRect repaintRect = computeContainerBoundingBox(this, true);
 
-    // A filter on this container can paint outside of the union of the child repaint rects
-    repaintRect.unite(filterBoundingBoxForRenderer(this));
+    FloatRect rect = filterBoundingBoxForRenderer(this);
+    if (!rect.isEmpty())
+        repaintRect = rect;
+
+    rect = clipperBoundingBoxForRenderer(this);
+    if (!rect.isEmpty())
+        repaintRect.intersect(rect);
+
+    rect = maskerBoundingBoxForRenderer(this);
+    if (!rect.isEmpty())
+        repaintRect.intersect(rect);
+
+    style()->svgStyle()->inflateForShadow(repaintRect);
 
     return repaintRect;
 }
@@ -178,5 +187,3 @@ bool RenderSVGContainer::nodeAtFloatPoint(const HitTestRequest& request, HitTest
 }
 
 #endif // ENABLE(SVG)
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.h
index f2195e3faf..f681e505f7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.h
@@ -42,10 +42,9 @@ public:
     void setDrawsContents(bool);
     bool drawsContents() const;
 
-protected:
     virtual void paint(PaintInfo&, int parentX, int parentY);
 
-private:
+protected:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
 
@@ -54,9 +53,10 @@ private:
 
     virtual void layout();
 
-    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
+    virtual void addFocusRingRects(Vector<IntRect>&, int tx, int ty);
 
     virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect strokeBoundingBox() const;
     virtual FloatRect repaintRectInLocalCoordinates() const;
 
     virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
@@ -71,6 +71,7 @@ private:
 
     bool selfWillPaint() const;
 
+private:
     RenderObjectChildList m_children;
     bool m_drawsContents : 1;
 };
@@ -78,14 +79,14 @@ private:
 inline RenderSVGContainer* toRenderSVGContainer(RenderObject* object)
 {
     // Note: isSVGContainer is also true for RenderSVGViewportContainer, which is not derived from this.
-    ASSERT(!object || object->isSVGContainer() && strcmp(object->renderName(), "RenderSVGViewportContainer"));
+    ASSERT(!object || (object->isSVGContainer() && strcmp(object->renderName(), "RenderSVGViewportContainer")));
     return static_cast<RenderSVGContainer*>(object);
 }
 
 inline const RenderSVGContainer* toRenderSVGContainer(const RenderObject* object)
 {
     // Note: isSVGContainer is also true for RenderSVGViewportContainer, which is not derived from this.
-    ASSERT(!object || object->isSVGContainer() && strcmp(object->renderName(), "RenderSVGViewportContainer"));
+    ASSERT(!object || (object->isSVGContainer() && strcmp(object->renderName(), "RenderSVGViewportContainer")));
     return static_cast<const RenderSVGContainer*>(object);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGGradientStop.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGGradientStop.cpp
index b81e7f41ff..66391c82c6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGGradientStop.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGGradientStop.cpp
@@ -49,7 +49,7 @@ void RenderSVGGradientStop::styleDidChange(StyleDifference diff, const RenderSty
     // <stop> elements should only be allowed to make renderers under gradient elements
     // but I can imagine a few cases we might not be catching, so let's not crash if our parent isn't a gradient.
     if (SVGGradientElement* gradient = gradientElement()) {
-        if (SVGResource* resource = gradient->canvasResource())
+        if (SVGResource* resource = gradient->canvasResource(this))
             resource->invalidate();
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.cpp
index d4b39d3a74..bb0a15d344 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.cpp
@@ -38,17 +38,7 @@ RenderSVGHiddenContainer::RenderSVGHiddenContainer(SVGStyledElement* element)
 void RenderSVGHiddenContainer::layout()
 {
     ASSERT(needsLayout());
- 
-    // Layout our kids to prevent a kid from being marked as needing layout
-    // then never being asked to layout.
-    for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
-        if (selfNeedsLayout())
-            child->setNeedsLayout(true);
-        
-        child->layoutIfNeeded();
-        ASSERT(!child->needsLayout());
-    }
-    
+    layoutChildren(this, selfNeedsLayout()); 
     setNeedsLayout(false);    
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.h
index 0ef0a430e7..fdbd2bcfa3 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.h
@@ -51,9 +51,6 @@ namespace WebCore {
         virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
         virtual void absoluteQuads(Vector<FloatQuad>&);
 
-        // FIXME: This override only exists to match existing LayoutTest results.
-        virtual TransformationMatrix absoluteTransform() const { return TransformationMatrix(); }
-
         virtual FloatRect objectBoundingBox() const;
         virtual FloatRect repaintRectInLocalCoordinates() const;
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.cpp
index 7e0b40d539..6fb9501674 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.cpp
@@ -4,6 +4,7 @@
     Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
     Copyright (C) 2007, 2008, 2009 Rob Buis <buis@kde.org>
     Copyright (C) 2009, Google, Inc.
+    Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -36,9 +37,6 @@
 #include "SVGLength.h"
 #include "SVGPreserveAspectRatio.h"
 #include "SVGRenderSupport.h"
-#include "SVGResourceClipper.h"
-#include "SVGResourceFilter.h"
-#include "SVGResourceMasker.h"
 
 namespace WebCore {
 
@@ -47,81 +45,6 @@ RenderSVGImage::RenderSVGImage(SVGImageElement* impl)
 {
 }
 
-void RenderSVGImage::adjustRectsForAspectRatio(FloatRect& destRect, FloatRect& srcRect, SVGPreserveAspectRatio* aspectRatio)
-{
-    float origDestWidth = destRect.width();
-    float origDestHeight = destRect.height();
-    if (aspectRatio->meetOrSlice() == SVGPreserveAspectRatio::SVG_MEETORSLICE_MEET) {
-        float widthToHeightMultiplier = srcRect.height() / srcRect.width();
-        if (origDestHeight > (origDestWidth * widthToHeightMultiplier)) {
-            destRect.setHeight(origDestWidth * widthToHeightMultiplier);
-            switch (aspectRatio->align()) {
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMINYMID:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMID:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMID:
-                    destRect.setY(destRect.y() + origDestHeight / 2.0f - destRect.height() / 2.0f);
-                    break;
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMINYMAX:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMAX:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMAX:
-                    destRect.setY(destRect.y() + origDestHeight - destRect.height());
-                    break;
-            }
-        }
-        if (origDestWidth > (origDestHeight / widthToHeightMultiplier)) {
-            destRect.setWidth(origDestHeight / widthToHeightMultiplier);
-            switch (aspectRatio->align()) {
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMIN:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMID:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMAX:
-                    destRect.setX(destRect.x() + origDestWidth / 2.0f - destRect.width() / 2.0f);
-                    break;
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMIN:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMID:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMAX:
-                    destRect.setX(destRect.x() + origDestWidth - destRect.width());
-                    break;
-            }
-        }
-    } else if (aspectRatio->meetOrSlice() == SVGPreserveAspectRatio::SVG_MEETORSLICE_SLICE) {
-        float widthToHeightMultiplier = srcRect.height() / srcRect.width();
-        // if the destination height is less than the height of the image we'll be drawing
-        if (origDestHeight < (origDestWidth * widthToHeightMultiplier)) {
-            float destToSrcMultiplier = srcRect.width() / destRect.width();
-            srcRect.setHeight(destRect.height() * destToSrcMultiplier);
-            switch (aspectRatio->align()) {
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMINYMID:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMID:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMID:
-                    srcRect.setY(destRect.y() + image()->height() / 2.0f - srcRect.height() / 2.0f);
-                    break;
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMINYMAX:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMAX:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMAX:
-                    srcRect.setY(destRect.y() + image()->height() - srcRect.height());
-                    break;
-            }
-        }
-        // if the destination width is less than the width of the image we'll be drawing
-        if (origDestWidth < (origDestHeight / widthToHeightMultiplier)) {
-            float destToSrcMultiplier = srcRect.height() / destRect.height();
-            srcRect.setWidth(destRect.width() * destToSrcMultiplier);
-            switch (aspectRatio->align()) {
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMIN:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMID:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMAX:
-                    srcRect.setX(destRect.x() + image()->width() / 2.0f - srcRect.width() / 2.0f);
-                    break;
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMIN:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMID:
-                case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMAX:
-                    srcRect.setX(destRect.x() + image()->width() - srcRect.width());
-                    break;
-            }
-        }
-    }
-}
-
 void RenderSVGImage::layout()
 {
     ASSERT(needsLayout());
@@ -138,6 +61,7 @@ void RenderSVGImage::layout()
     calcHeight();
 
     m_localBounds = FloatRect(image->x().value(image), image->y().value(image), image->width().value(image), image->height().value(image));
+    m_cachedLocalRepaintRect = FloatRect();
 
     repainter.repaintAfterLayout();
     
@@ -157,16 +81,16 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, int, int)
 
         PaintInfo savedInfo(paintInfo);
 
-        prepareToRenderSVGContent(this, paintInfo, m_localBounds, filter);
-
-        FloatRect destRect = m_localBounds;
-        FloatRect srcRect(0, 0, image()->width(), image()->height());
+        if (prepareToRenderSVGContent(this, paintInfo, m_localBounds, filter)) {
+            FloatRect destRect = m_localBounds;
+            FloatRect srcRect(0, 0, image()->width(), image()->height());
 
-        SVGImageElement* imageElt = static_cast<SVGImageElement*>(node());
-        if (imageElt->preserveAspectRatio()->align() != SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_NONE)
-            adjustRectsForAspectRatio(destRect, srcRect, imageElt->preserveAspectRatio());
+            SVGImageElement* imageElt = static_cast<SVGImageElement*>(node());
+            if (imageElt->preserveAspectRatio().align() != SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_NONE)
+                imageElt->preserveAspectRatio().transformRect(destRect, srcRect);
 
-        paintInfo.context->drawImage(image(), destRect, srcRect);
+            paintInfo.context->drawImage(image(), DeviceColorSpace, destRect, srcRect);
+        }
         finishRenderSVGContent(this, paintInfo, filter, savedInfo.context);
     }
 
@@ -176,6 +100,12 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, int, int)
     paintInfo.context->restore();
 }
 
+void RenderSVGImage::destroy()
+{
+    SVGRenderBase::deregisterFromResources(this);
+    RenderImage::destroy();
+}
+
 bool RenderSVGImage::nodeAtFloatPoint(const HitTestRequest&, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
 {
     // We only draw in the forground phase, so we only hit-test then.
@@ -212,12 +142,29 @@ FloatRect RenderSVGImage::objectBoundingBox() const
 
 FloatRect RenderSVGImage::repaintRectInLocalCoordinates() const
 {
-    FloatRect repaintRect = m_localBounds;
+    // If we already have a cached repaint rect, return that
+    if (!m_cachedLocalRepaintRect.isEmpty())
+        return m_cachedLocalRepaintRect;
+
+    m_cachedLocalRepaintRect = m_localBounds;
+
+    // FIXME: We need to be careful here. We assume that there is no filter,
+    // clipper or masker if the rects are empty.
+    FloatRect rect = filterBoundingBoxForRenderer(this);
+    if (!rect.isEmpty())
+        m_cachedLocalRepaintRect = rect;
+
+    rect = clipperBoundingBoxForRenderer(this);
+    if (!rect.isEmpty())
+        m_cachedLocalRepaintRect.intersect(rect);
+
+    rect = maskerBoundingBoxForRenderer(this);
+    if (!rect.isEmpty())
+        m_cachedLocalRepaintRect.intersect(rect);
 
-    // Filters can paint outside the image content
-    repaintRect.unite(filterBoundingBoxForRenderer(this));
+    style()->svgStyle()->inflateForShadow(m_cachedLocalRepaintRect);
 
-    return repaintRect;
+    return m_cachedLocalRepaintRect;
 }
 
 void RenderSVGImage::imageChanged(WrappedImagePtr image, const IntRect* rect)
@@ -241,11 +188,12 @@ void RenderSVGImage::mapLocalToContainer(RenderBoxModelObject* repaintContainer,
     SVGRenderBase::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
 }
 
-void RenderSVGImage::addFocusRingRects(GraphicsContext* graphicsContext, int, int)
+void RenderSVGImage::addFocusRingRects(Vector<IntRect>& rects, int, int)
 {
     // this is called from paint() after the localTransform has already been applied
     IntRect contentRect = enclosingIntRect(repaintRectInLocalCoordinates());
-    graphicsContext->addFocusRingRect(contentRect);
+    if (!contentRect.isEmpty())
+        rects.append(contentRect);
 }
 
 void RenderSVGImage::absoluteRects(Vector<IntRect>& rects, int, int)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.h
index ef117191d9..f48b9dd9f1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.h
@@ -24,55 +24,58 @@
 #define RenderSVGImage_h
 
 #if ENABLE(SVG)
-
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "FloatRect.h"
 #include "RenderImage.h"
+#include "SVGPreserveAspectRatio.h"
 #include "SVGRenderSupport.h"
 
 namespace WebCore {
 
-    class SVGImageElement;
-    class SVGPreserveAspectRatio;
+class SVGImageElement;
+
+class RenderSVGImage : public RenderImage, protected SVGRenderBase {
+public:
+    RenderSVGImage(SVGImageElement*);
 
-    class RenderSVGImage : public RenderImage, SVGRenderBase {
-    public:
-        RenderSVGImage(SVGImageElement*);
+private:
+    virtual const SVGRenderBase* toSVGRenderBase() const { return this; }
+    virtual const char* renderName() const { return "RenderSVGImage"; }
+    virtual bool isSVGImage() const { return true; }
 
-    private:
-        virtual const char* renderName() const { return "RenderSVGImage"; }
-        virtual bool isSVGImage() const { return true; }
+    virtual const AffineTransform& localToParentTransform() const { return m_localTransform; }
 
-        virtual TransformationMatrix localToParentTransform() const { return m_localTransform; }
+    virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect strokeBoundingBox() const { return m_localBounds; }
+    virtual FloatRect repaintRectInLocalCoordinates() const;
 
-        virtual FloatRect objectBoundingBox() const;
-        virtual FloatRect repaintRectInLocalCoordinates() const;
+    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
+    virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
 
-        virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
-        virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
 
-        virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
+    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
+    virtual void addFocusRingRects(Vector<IntRect>&, int tx, int ty);
 
-        virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
-        virtual void absoluteQuads(Vector<FloatQuad>&);
-        virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
+    virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
+    
+    virtual void layout();
+    virtual void paint(PaintInfo&, int parentX, int parentY);
 
-        virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
-        void adjustRectsForAspectRatio(FloatRect& destRect, FloatRect& srcRect, SVGPreserveAspectRatio*);
-        
-        virtual void layout();
-        virtual void paint(PaintInfo&, int parentX, int parentY);
+    virtual void destroy();
 
-        virtual bool requiresLayer() const { return false; }
+    virtual bool requiresLayer() const { return false; }
 
-        virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
-        virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+    virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
-        virtual TransformationMatrix localTransform() const { return m_localTransform; }
+    virtual AffineTransform localTransform() const { return m_localTransform; }
 
-        TransformationMatrix m_localTransform;
-        FloatRect m_localBounds;
-    };
+    AffineTransform m_localTransform;
+    FloatRect m_localBounds;
+    mutable FloatRect m_cachedLocalRepaintRect;
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.cpp
index cf97b52add..33459ce93c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.cpp
@@ -48,9 +48,9 @@ InlineFlowBox* RenderSVGInline::createInlineFlowBox()
 
 void RenderSVGInline::absoluteRects(Vector<IntRect>& rects, int, int)
 {
-    InlineRunBox* firstBox = firstLineBox();
+    InlineFlowBox* firstBox = firstLineBox();
 
-    SVGRootInlineBox* rootBox = firstBox ? static_cast<SVGInlineTextBox*>(firstBox)->svgRootInlineBox() : 0;
+    RootInlineBox* rootBox = firstBox ? firstBox->root() : 0;
     RenderBox* object = rootBox ? rootBox->block() : 0;
 
     if (!object)
@@ -59,17 +59,45 @@ void RenderSVGInline::absoluteRects(Vector<IntRect>& rects, int, int)
     int xRef = object->x();
     int yRef = object->y();
 
-    for (InlineRunBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
+    for (InlineFlowBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
         FloatRect rect(xRef + curr->x(), yRef + curr->y(), curr->width(), curr->height());
         rects.append(enclosingIntRect(localToAbsoluteQuad(rect).boundingBox()));
     }
 }
 
+FloatRect RenderSVGInline::objectBoundingBox() const
+{
+    if (const RenderObject* object = findTextRootObject(this))
+        return object->objectBoundingBox();
+
+    return FloatRect();
+}
+
+FloatRect RenderSVGInline::strokeBoundingBox() const
+{
+    const RenderObject* object = findTextRootObject(this);
+    ASSERT(object);
+
+    const SVGRenderBase* renderer = object->toSVGRenderBase();
+    if (!renderer)
+        return FloatRect();
+
+    return renderer->strokeBoundingBox();
+}
+
+FloatRect RenderSVGInline::repaintRectInLocalCoordinates() const
+{
+    if (const RenderObject* object = findTextRootObject(this))
+        return object->repaintRectInLocalCoordinates();
+
+    return FloatRect();
+}
+
 void RenderSVGInline::absoluteQuads(Vector<FloatQuad>& quads)
 {
-    InlineRunBox* firstBox = firstLineBox();
+    InlineFlowBox* firstBox = firstLineBox();
 
-    SVGRootInlineBox* rootBox = firstBox ? static_cast<SVGInlineTextBox*>(firstBox)->svgRootInlineBox() : 0;
+    RootInlineBox* rootBox = firstBox ? firstBox->root() : 0;
     RenderBox* object = rootBox ? rootBox->block() : 0;
 
     if (!object)
@@ -78,7 +106,7 @@ void RenderSVGInline::absoluteQuads(Vector<FloatQuad>& quads)
     int xRef = object->x();
     int yRef = object->y();
 
-    for (InlineRunBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
+    for (InlineFlowBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
         FloatRect rect(xRef + curr->x(), yRef + curr->y(), curr->width(), curr->height());
         quads.append(localToAbsoluteQuad(rect));
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.h
index 9f9f3f5f2e..e57b93605d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.h
@@ -27,17 +27,31 @@
 #if ENABLE(SVG)
 #include "RenderInline.h"
 
+#include "SVGRenderSupport.h"
+
 namespace WebCore {
 
-class RenderSVGInline : public RenderInline {
+class RenderSVGInline : public RenderInline, protected SVGRenderBase {
 public:
     RenderSVGInline(Node*);
+
+    virtual const SVGRenderBase* toSVGRenderBase() const { return this; }
+
     virtual const char* renderName() const { return "RenderSVGInline"; }
     virtual bool requiresLayer() const { return false; }
 
     // These are shared between RenderSVGTSpan and RenderSVGTextPath
     virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
     virtual void absoluteQuads(Vector<FloatQuad>&);
+
+    // Chapter 10.4 of the SVG Specification say that we should use the
+    // object bounding box of the parent text element.
+    // We search for the root text element and take it's bounding box.
+    // It is also necessary to take the stroke and repaint rect of
+    // this element, since we need it for filters.
+    virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect strokeBoundingBox() const;
+    virtual FloatRect repaintRectInLocalCoordinates() const;
     
 private:
     virtual InlineFlowBox* createInlineFlowBox();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.h
index e9c5d6e190..b475067909 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.h
@@ -39,6 +39,10 @@ private:
         
     virtual void styleDidChange(StyleDifference, const RenderStyle*);
 
+    // FIXME: We need objectBoundingBox for DRT results and filters at the moment.
+    // This should be fixed to give back the objectBoundingBox of the text root.
+    virtual FloatRect objectBoundingBox() const { return FloatRect(); }
+
     virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
     virtual void absoluteQuads(Vector<FloatQuad>&);
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGModelObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGModelObject.cpp
index 3fab5a6bab..c163dc6363 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGModelObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGModelObject.cpp
@@ -38,10 +38,6 @@
 #include "RenderView.h"
 #include "SVGStyledElement.h"
 
-#if ENABLE(FILTERS)
-#include "SVGResourceFilter.h"
-#endif
-
 namespace WebCore {
 
 RenderSVGModelObject::RenderSVGModelObject(SVGStyledElement* node)
@@ -86,6 +82,12 @@ void RenderSVGModelObject::absoluteQuads(Vector<FloatQuad>& quads)
     quads.append(absoluteClippedOverflowRect());
 }
 
+void RenderSVGModelObject::destroy()
+{
+    deregisterFromResources(this);
+    RenderObject::destroy();
+}
+
 bool RenderSVGModelObject::nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int, HitTestAction)
 {
     ASSERT_NOT_REACHED();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGModelObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGModelObject.h
index 0aa13adc8f..c04c5900a2 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGModelObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGModelObject.h
@@ -49,6 +49,8 @@ class RenderSVGModelObject : public RenderObject, protected SVGRenderBase {
 public:
     RenderSVGModelObject(SVGStyledElement*);
 
+    virtual const SVGRenderBase* toSVGRenderBase() const { return this; }
+
     virtual bool requiresLayer() const { return false; }
 
     virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
@@ -58,6 +60,8 @@ public:
     virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
     virtual void absoluteQuads(Vector<FloatQuad>&);
 
+    virtual void destroy();
+
     virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGResource.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGResource.h
new file mode 100644
index 0000000000..184ffe3954
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGResource.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef RenderSVGResource_h
+#define RenderSVGResource_h
+
+#if ENABLE(SVG)
+#include "FloatRect.h"
+#include "RenderSVGHiddenContainer.h"
+
+namespace WebCore {
+
+enum RenderSVGResourceType {
+    MaskerResourceType,
+    ClipperResourceType
+};
+
+class RenderSVGResource : public RenderSVGHiddenContainer {
+public:
+    RenderSVGResource(SVGStyledElement* node) : RenderSVGHiddenContainer(node) { }
+
+    template<class Renderer>
+    Renderer* cast()
+    {
+        if (Renderer::s_resourceType == resourceType())
+            return static_cast<Renderer*>(this);
+
+        return 0;
+    }
+
+    virtual RenderSVGResource* toRenderSVGResource() { return this; }
+    virtual bool isSVGResource() const { return true; }
+    virtual bool drawsContents() { return false; }
+
+    virtual void invalidateClients() = 0;
+    virtual void invalidateClient(RenderObject*) = 0;
+
+    virtual bool applyResource(RenderObject*, GraphicsContext*) = 0;
+    virtual FloatRect resourceBoundingBox(const FloatRect&) const = 0;
+
+    virtual RenderSVGResourceType resourceType() const = 0;
+};
+
+template<typename Renderer>
+Renderer* getRenderSVGResourceById(Document* document, const AtomicString& id)
+{
+    if (id.isEmpty())
+        return 0;
+
+    Element* element = document->getElementById(id);
+    if (!element || !element->isSVGElement())
+        return 0;
+
+    RenderObject* renderer = element->renderer();
+    if (!renderer)
+        return 0;
+
+    RenderSVGResource* renderResource = renderer->toRenderSVGResource();
+    if (!renderResource)
+        return 0;
+
+    return renderResource->cast<Renderer>();
+}
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGResourceClipper.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGResourceClipper.cpp
new file mode 100644
index 0000000000..dfc4b1e9bb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGResourceClipper.cpp
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ *               2004, 2005, 2006, 2007, 2008 Rob Buis <buis@kde.org>
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "RenderSVGResourceClipper.h"
+
+#include "AffineTransform.h"
+#include "FloatRect.h"
+#include "GraphicsContext.h"
+#include "RenderSVGResource.h"
+#include "SVGClipPathElement.h"
+#include "SVGElement.h"
+#include "SVGRenderSupport.h"
+#include "SVGStyledElement.h"
+#include "SVGStyledTransformableElement.h"
+#include "SVGUnitTypes.h"
+
+namespace WebCore {
+
+RenderSVGResourceType RenderSVGResourceClipper::s_resourceType = ClipperResourceType;
+
+RenderSVGResourceClipper::RenderSVGResourceClipper(SVGStyledElement* node)
+    : RenderSVGResource(node)
+{
+}
+
+RenderSVGResourceClipper::~RenderSVGResourceClipper()
+{
+    m_clipper.clear();
+}
+
+void RenderSVGResourceClipper::invalidateClients()
+{
+    HashSet<RenderObject*>::const_iterator end = m_clipper.end();
+    for (HashSet<RenderObject*>::const_iterator it = m_clipper.begin(); it != end; ++it)
+        (*it)->setNeedsLayout(true);
+    m_clipper.clear();
+}
+
+void RenderSVGResourceClipper::invalidateClient(RenderObject* object)
+{
+    ASSERT(object);
+
+    // FIXME: The HashSet should always contain the object on calling invalidateClient. A race condition
+    // during the parsing can causes a call of invalidateClient right before the call of applyResource.
+    // We return earlier for the moment. This bug should be fixed in:
+    // https://bugs.webkit.org/show_bug.cgi?id=35181
+    if (!m_clipper.contains(object))
+        return;
+
+    m_clipper.remove(object);
+}
+
+bool RenderSVGResourceClipper::applyResource(RenderObject* object, GraphicsContext* context)
+{
+    ASSERT(object);
+    ASSERT(context);
+
+    m_clipper.add(object);
+
+    context->beginPath();
+
+    AffineTransform obbTransform;
+    FloatRect objectBoundingBox = object->objectBoundingBox();
+    bool bbox = static_cast<SVGClipPathElement*>(node())->clipPathUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX;
+    if (bbox) {
+        obbTransform.translate(objectBoundingBox.x(), objectBoundingBox.y());
+        obbTransform.scaleNonUniform(objectBoundingBox.width(), objectBoundingBox.height());
+    }
+
+    bool hasClipPath = false;
+    WindRule clipRule = RULE_EVENODD;
+    for (Node* childNode = node()->firstChild(); childNode; childNode = childNode->nextSibling()) {
+        if (!childNode->isSVGElement() || !static_cast<SVGElement*>(childNode)->isStyledTransformable())
+            continue;
+        SVGStyledTransformableElement* styled = static_cast<SVGStyledTransformableElement*>(childNode);
+        RenderStyle* style = styled->renderer() ? styled->renderer()->style() : 0;
+        if (!style || style->display() == NONE)
+            continue;
+        Path pathData = styled->toClipPath();
+        if (pathData.isEmpty())
+            continue;
+        if (bbox)
+            pathData.transform(obbTransform);
+        hasClipPath = true;
+        context->addPath(pathData);
+        clipRule = style->svgStyle()->clipRule();
+    }
+
+    if (!hasClipPath) {
+        Path clipPath;
+        clipPath.addRect(FloatRect());
+        context->addPath(clipPath);
+    }
+
+    // FIXME!
+    // We don't currently allow for heterogenous clip rules.
+    // we would have to detect such, draw to a mask, and then clip
+    // to that mask
+    context->clipPath(clipRule);
+
+    return true;
+}
+
+FloatRect RenderSVGResourceClipper::resourceBoundingBox(const FloatRect& objectBoundingBox) const
+{
+    FloatRect clipRect;
+    for (Node* childNode = node()->firstChild(); childNode; childNode = childNode->nextSibling()) {
+        if (!childNode->isSVGElement() || !static_cast<SVGElement*>(childNode)->isStyledTransformable())
+            continue;
+        SVGStyledTransformableElement* styled = static_cast<SVGStyledTransformableElement*>(childNode);
+        RenderStyle* style = styled->renderer() ? styled->renderer()->style() : 0;
+        if (!style || style->display() == NONE || styled->toClipPath().isEmpty())
+            continue;
+        clipRect.unite(styled->renderer()->objectBoundingBox());
+    }
+
+    if (clipRect.isEmpty())
+        return FloatRect();
+
+    if (static_cast<SVGClipPathElement*>(node())->clipPathUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
+        AffineTransform obbTransform;
+        obbTransform.translate(objectBoundingBox.x(), objectBoundingBox.y());
+        obbTransform.scaleNonUniform(objectBoundingBox.width(), objectBoundingBox.height());
+        return obbTransform.mapRect(clipRect);
+    }
+
+    return clipRect;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGResourceClipper.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGResourceClipper.h
new file mode 100644
index 0000000000..0e1d2b5ce9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGResourceClipper.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef RenderSVGResourceClipper_h
+#define RenderSVGResourceClipper_h
+
+#if ENABLE(SVG)
+#include "FloatRect.h"
+#include "GraphicsContext.h"
+#include "RenderSVGResource.h"
+#include "SVGClipPathElement.h"
+#include "SVGUnitTypes.h"
+
+#include <wtf/HashSet.h>
+
+namespace WebCore {
+
+class RenderSVGResourceClipper : public RenderSVGResource {
+
+public:
+    RenderSVGResourceClipper(SVGStyledElement*);
+    virtual ~RenderSVGResourceClipper();
+
+    virtual const char* renderName() const { return "RenderSVGResourceClipper"; }
+
+    virtual void invalidateClients();
+    virtual void invalidateClient(RenderObject*);
+
+    virtual bool applyResource(RenderObject*, GraphicsContext*);
+    virtual FloatRect resourceBoundingBox(const FloatRect&) const;
+
+    virtual RenderSVGResourceType resourceType() const { return ClipperResourceType; }
+
+    SVGUnitTypes::SVGUnitType clipPathUnits() const { return toUnitType(static_cast<SVGClipPathElement*>(node())->clipPathUnits()); }
+
+    static RenderSVGResourceType s_resourceType;
+private:
+    HashSet<RenderObject*> m_clipper;
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGResourceMasker.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGResourceMasker.cpp
new file mode 100644
index 0000000000..2923c6e2d1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGResourceMasker.cpp
@@ -0,0 +1,196 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "RenderSVGResourceMasker.h"
+
+#include "AffineTransform.h"
+#include "CanvasPixelArray.h"
+#include "Element.h"
+#include "FloatPoint.h"
+#include "FloatRect.h"
+#include "GraphicsContext.h"
+#include "Image.h"
+#include "ImageBuffer.h"
+#include "ImageData.h"
+#include "IntRect.h"
+#include "SVGElement.h"
+#include "SVGMaskElement.h"
+#include "SVGStyledElement.h"
+#include "SVGUnitTypes.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+RenderSVGResourceType RenderSVGResourceMasker::s_resourceType = MaskerResourceType;
+
+RenderSVGResourceMasker::RenderSVGResourceMasker(SVGStyledElement* node)
+    : RenderSVGResource(node)
+{
+}
+
+RenderSVGResourceMasker::~RenderSVGResourceMasker()
+{
+    deleteAllValues(m_masker);
+    m_masker.clear();
+}
+
+void RenderSVGResourceMasker::invalidateClients()
+{
+    HashMap<RenderObject*, MaskerData*>::const_iterator end = m_masker.end();
+    for (HashMap<RenderObject*, MaskerData*>::const_iterator it = m_masker.begin(); it != end; ++it)
+        it->first->setNeedsLayout(true);
+    deleteAllValues(m_masker);
+    m_masker.clear();
+}
+
+void RenderSVGResourceMasker::invalidateClient(RenderObject* object)
+{
+    ASSERT(object);
+
+    // FIXME: The HashMap should always contain the object on calling invalidateClient. A race condition
+    // during the parsing can causes a call of invalidateClient right before the call of applyResource.
+    // We return earlier for the moment. This bug should be fixed in:
+    // https://bugs.webkit.org/show_bug.cgi?id=35181
+    if (!m_masker.contains(object))
+        return;
+
+    delete m_masker.take(object); 
+}
+
+bool RenderSVGResourceMasker::applyResource(RenderObject* object, GraphicsContext* context)
+{
+    ASSERT(object);
+    ASSERT(context);
+
+    if (!m_masker.contains(object))
+        m_masker.set(object, new MaskerData);
+
+    MaskerData* maskerData = m_masker.get(object);
+    if (!maskerData->maskImage && !maskerData->emptyMask) {
+        SVGMaskElement* maskElement = static_cast<SVGMaskElement*>(node());
+        if (!maskElement)
+            return false;
+
+        createMaskImage(maskerData, maskElement, object);
+    }
+
+    if (!maskerData->maskImage)
+        return false;
+
+    context->clipToImageBuffer(maskerData->maskRect, maskerData->maskImage.get());
+    return true;
+}
+
+FloatRect RenderSVGResourceMasker::resourceBoundingBox(const FloatRect& objectBoundingBox) const
+{
+    if (SVGMaskElement* element = static_cast<SVGMaskElement*>(node()))
+        return element->maskBoundingBox(objectBoundingBox);
+
+    return FloatRect();
+}
+
+void RenderSVGResourceMasker::createMaskImage(MaskerData* maskerData, const SVGMaskElement* maskElement, RenderObject* object)
+{
+    FloatRect objectBoundingBox = object->objectBoundingBox();
+
+    // Mask rect clipped with clippingBoundingBox and filterBoundingBox as long as they are present.
+    maskerData->maskRect = object->repaintRectInLocalCoordinates();
+    if (maskerData->maskRect.isEmpty()) {
+        maskerData->emptyMask = true;
+        return;
+    }
+
+    // Calculate the smallest rect for the mask ImageBuffer.
+    FloatRect repaintRect;
+    Vector<RenderObject*> rendererList;
+    for (Node* node = maskElement->firstChild(); node; node = node->nextSibling()) {
+        RenderObject* renderer = node->renderer();
+        if (!node->isSVGElement() || !static_cast<SVGElement*>(node)->isStyled() || !renderer)
+            continue;
+
+        rendererList.append(renderer);
+        repaintRect.unite(renderer->localToParentTransform().mapRect(renderer->repaintRectInLocalCoordinates()));
+    }
+
+    AffineTransform contextTransform;
+    // We need to scale repaintRect for objectBoundingBox to get the drawing area.
+    if (maskElement->maskContentUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
+        contextTransform.scaleNonUniform(objectBoundingBox.width(), objectBoundingBox.height());
+        FloatPoint contextAdjustment = repaintRect.location();
+        repaintRect = contextTransform.mapRect(repaintRect);
+        repaintRect.move(objectBoundingBox.x(), objectBoundingBox.y());
+        contextTransform.translate(-contextAdjustment.x(), -contextAdjustment.y());
+    }
+    repaintRect.intersect(maskerData->maskRect);
+    maskerData->maskRect = repaintRect;
+    IntRect maskImageRect = enclosingIntRect(maskerData->maskRect);
+
+    maskImageRect.setLocation(IntPoint());
+
+    // Don't create ImageBuffers with image size of 0
+    if (!maskImageRect.width() || !maskImageRect.height()) {
+        maskerData->emptyMask = true;
+        return;
+    }
+
+    // FIXME: This changes color space to linearRGB, the default color space
+    // for masking operations in SVG. We need a switch for the other color-space
+    // attribute values sRGB, inherit and auto.
+    maskerData->maskImage = ImageBuffer::create(maskImageRect.size(), LinearRGB);
+    if (!maskerData->maskImage)
+        return;
+
+    GraphicsContext* maskImageContext = maskerData->maskImage->context();
+    ASSERT(maskImageContext);
+
+    maskImageContext->save();
+
+    if (maskElement->maskContentUnits() == SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
+        maskImageContext->translate(-maskerData->maskRect.x(), -maskerData->maskRect.y());
+    maskImageContext->concatCTM(contextTransform);
+
+    // draw the content into the ImageBuffer
+    Vector<RenderObject*>::iterator end = rendererList.end();
+    for (Vector<RenderObject*>::iterator it = rendererList.begin(); it != end; it++)
+        renderSubtreeToImage(maskerData->maskImage.get(), *it);
+
+    maskImageContext->restore();
+
+    // create the luminance mask
+    RefPtr<ImageData> imageData(maskerData->maskImage->getUnmultipliedImageData(maskImageRect));
+    CanvasPixelArray* srcPixelArray(imageData->data());
+
+    for (unsigned pixelOffset = 0; pixelOffset < srcPixelArray->length(); pixelOffset += 4) {
+        unsigned char a = srcPixelArray->get(pixelOffset + 3);
+        if (!a)
+            continue;
+        unsigned char r = srcPixelArray->get(pixelOffset);
+        unsigned char g = srcPixelArray->get(pixelOffset + 1);
+        unsigned char b = srcPixelArray->get(pixelOffset + 2);
+
+        double luma = (r * 0.2125 + g * 0.7154 + b * 0.0721) * ((double)a / 255.0);
+        srcPixelArray->set(pixelOffset + 3, luma);
+    }
+
+    maskerData->maskImage->putUnmultipliedImageData(imageData.get(), maskImageRect, IntPoint());
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGResourceMasker.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGResourceMasker.h
new file mode 100644
index 0000000000..6c73c84dc6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGResourceMasker.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef RenderSVGResourceMasker_h
+#define RenderSVGResourceMasker_h
+
+#if ENABLE(SVG)
+#include "FloatRect.h"
+#include "GraphicsContext.h"
+#include "ImageBuffer.h"
+#include "IntSize.h"
+#include "RenderSVGResource.h"
+#include "SVGMaskElement.h"
+#include "SVGUnitTypes.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+struct MaskerData {
+    MaskerData(FloatRect rect = FloatRect(), bool emptyObject = false)
+        : maskRect(rect)
+        , emptyMask(emptyObject)
+    {
+    }
+
+    OwnPtr<ImageBuffer> maskImage;
+    FloatRect maskRect;
+    bool emptyMask;
+};
+
+class RenderSVGResourceMasker : public RenderSVGResource {
+
+public:
+    RenderSVGResourceMasker(SVGStyledElement*);
+    virtual ~RenderSVGResourceMasker();
+
+    virtual const char* renderName() const { return "RenderSVGResourceMasker"; }
+
+    virtual void invalidateClients();
+    virtual void invalidateClient(RenderObject*);
+
+    virtual bool applyResource(RenderObject*, GraphicsContext*);
+    virtual FloatRect resourceBoundingBox(const FloatRect&) const;
+
+    SVGUnitTypes::SVGUnitType maskUnits() const { return toUnitType(static_cast<SVGMaskElement*>(node())->maskUnits()); }
+    SVGUnitTypes::SVGUnitType maskContentUnits() const { return toUnitType(static_cast<SVGMaskElement*>(node())->maskContentUnits()); }
+
+    virtual RenderSVGResourceType resourceType() const { return s_resourceType; }
+    static RenderSVGResourceType s_resourceType;
+
+private:
+    void createMaskImage(MaskerData*, const SVGMaskElement*, RenderObject*);
+
+    HashMap<RenderObject*, MaskerData*> m_masker;
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.cpp
index 0a39bf4725..51bf3e733a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.cpp
@@ -77,6 +77,28 @@ void RenderSVGRoot::calcPrefWidths()
     setPrefWidthsDirty(false);
 }
 
+int RenderSVGRoot::calcReplacedWidth(bool includeMaxWidth) const
+{
+    int replacedWidth = RenderBox::calcReplacedWidth(includeMaxWidth);
+    if (!style()->width().isPercent())
+        return replacedWidth;
+
+    // FIXME: Investigate in size rounding issues
+    SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
+    return static_cast<int>(roundf(replacedWidth * svg->currentScale()));
+}
+
+int RenderSVGRoot::calcReplacedHeight() const
+{
+    int replacedHeight = RenderBox::calcReplacedHeight();
+    if (!style()->height().isPercent())
+        return replacedHeight;
+
+    // FIXME: Investigate in size rounding issues
+    SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
+    return static_cast<int>(roundf(replacedHeight * svg->currentScale()));
+}
+
 void RenderSVGRoot::layout()
 {
     ASSERT(needsLayout());
@@ -84,25 +106,19 @@ void RenderSVGRoot::layout()
     // Arbitrary affine transforms are incompatible with LayoutState.
     view()->disableLayoutState();
 
-    LayoutRepainter repainter(*this, checkForRepaintDuringLayout() && selfNeedsLayout());
+    bool needsLayout = selfNeedsLayout();
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout() && needsLayout);
 
+    IntSize oldSize(width(), height());
     calcWidth();
     calcHeight();
 
-    SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
-    setWidth(static_cast<int>(width() * svg->currentScale()));
-    setHeight(static_cast<int>(height() * svg->currentScale()));
-
     calcViewport();
-    
-    for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
-        if (selfNeedsLayout()) // either bounds or transform changed, force kids to relayout
-            child->setNeedsLayout(true, false);
-        
-        child->layoutIfNeeded();
-        ASSERT(!child->needsLayout());
-    }
 
+    // RenderSVGRoot needs to take special care to propagate window size changes to the children,
+    // if the outermost <svg> is using relative x/y/width/height values. Hence the additonal parameters.
+    SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
+    layoutChildren(this, needsLayout || (svg->hasRelativeValues() && oldSize != size()));
     repainter.repaintAfterLayout();
 
     view()->enableLayoutState();
@@ -113,7 +129,7 @@ bool RenderSVGRoot::selfWillPaint() const
 {
 #if ENABLE(FILTERS)
     const SVGRenderStyle* svgStyle = style()->svgStyle();
-    SVGResourceFilter* filter = getFilterById(document(), svgStyle->filter());
+    SVGResourceFilter* filter = getFilterById(document(), svgStyle->filter(), this);
     if (filter)
         return true;
 #endif
@@ -126,13 +142,13 @@ void RenderSVGRoot::paint(PaintInfo& paintInfo, int parentX, int parentY)
         return;
 
     IntPoint parentOriginInContainer(parentX, parentY);
-    IntPoint borderBoxOriginInContainer = parentOriginInContainer + IntSize(x(), y());
+    IntPoint borderBoxOriginInContainer = parentOriginInContainer + parentOriginToBorderBox();
 
     if (hasBoxDecorations() && (paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection)) 
         paintBoxDecorations(paintInfo, borderBoxOriginInContainer.x(), borderBoxOriginInContainer.y());
 
     // An empty viewport disables rendering.  FIXME: Should we still render filters?
-    if (viewportSize().isEmpty())
+    if (m_viewportSize.isEmpty())
         return;
 
     // Don't paint if we don't have kids, except if we have filters we should paint those.
@@ -143,9 +159,8 @@ void RenderSVGRoot::paint(PaintInfo& paintInfo, int parentX, int parentY)
     RenderObject::PaintInfo childPaintInfo(paintInfo);
     childPaintInfo.context->save();
 
-    // SVG does not support independent x/y clipping
-    if (style()->overflowX() != OVISIBLE)
-        childPaintInfo.context->clip(overflowClipRect(borderBoxOriginInContainer.x(), borderBoxOriginInContainer.y()));
+    // Apply initial viewport clip - not affected by overflow handling
+    childPaintInfo.context->clip(overflowClipRect(borderBoxOriginInContainer.x(), borderBoxOriginInContainer.y()));
 
     // Convert from container offsets (html renderers) to a relative transform (svg renderers).
     // Transform from our paint container's coordinate system to our local coords.
@@ -153,10 +168,13 @@ void RenderSVGRoot::paint(PaintInfo& paintInfo, int parentX, int parentY)
 
     SVGResourceFilter* filter = 0;
     FloatRect boundingBox = repaintRectInLocalCoordinates();
+
+    bool continueRendering = true;
     if (childPaintInfo.phase == PaintPhaseForeground)
-        prepareToRenderSVGContent(this, childPaintInfo, boundingBox, filter);
+        continueRendering = prepareToRenderSVGContent(this, childPaintInfo, boundingBox, filter);
 
-    RenderBox::paint(childPaintInfo, 0, 0);
+    if (continueRendering)
+        RenderBox::paint(childPaintInfo, 0, 0);
 
     if (childPaintInfo.phase == PaintPhaseForeground)
         finishRenderSVGContent(this, childPaintInfo, filter, paintInfo.context);
@@ -167,9 +185,10 @@ void RenderSVGRoot::paint(PaintInfo& paintInfo, int parentX, int parentY)
         paintOutline(paintInfo.context, borderBoxOriginInContainer.x(), borderBoxOriginInContainer.y(), width(), height(), style());
 }
 
-const FloatSize& RenderSVGRoot::viewportSize() const
+void RenderSVGRoot::destroy()
 {
-    return m_viewportSize;
+    deregisterFromResources(this);
+    RenderBox::destroy();
 }
 
 void RenderSVGRoot::calcViewport()
@@ -183,28 +202,28 @@ void RenderSVGRoot::calcViewport()
         // In the normal case of <svg> being stand-alone or in a CSSBoxModel object we use
         // RenderBox::width()/height() (which pulls data from RenderStyle)
         m_viewportSize = FloatSize(width(), height());
-    } else {
-        // In the SVGImage case grab the SVGLength values off of SVGSVGElement and use
-        // the special relativeWidthValue accessors which respect the specified containerSize
-        SVGLength width = svg->width();
-        SVGLength height = svg->height();
-        float viewportWidth = (width.unitType() == LengthTypePercentage) ? svg->relativeWidthValue() : width.value(svg);
-        float viewportHeight = (height.unitType() == LengthTypePercentage) ? svg->relativeHeightValue() : height.value(svg);
-        m_viewportSize = FloatSize(viewportWidth, viewportHeight);
+        return;
     }
+
+    // In the SVGImage case grab the SVGLength values off of SVGSVGElement and use
+    // the special relativeWidthValue accessors which respect the specified containerSize
+    // FIXME: Check how SVGImage + zooming is supposed to be handled?
+    SVGLength width = svg->width();
+    SVGLength height = svg->height();
+    m_viewportSize = FloatSize(width.unitType() == LengthTypePercentage ? svg->relativeWidthValue() : width.value(svg),
+                               height.unitType() == LengthTypePercentage ? svg->relativeHeightValue() : height.value(svg));
 }
 
 // RenderBox methods will expect coordinates w/o any transforms in coordinates
 // relative to our borderBox origin.  This method gives us exactly that.
-TransformationMatrix RenderSVGRoot::localToBorderBoxTransform() const
+AffineTransform RenderSVGRoot::localToBorderBoxTransform() const
 {
-    TransformationMatrix ctm;
     IntSize borderAndPadding = borderOriginToContentBox();
-    ctm.translate(borderAndPadding.width(), borderAndPadding.height());
     SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
-    ctm.scale(svg->currentScale());
-    ctm.translate(svg->currentTranslate().x(), svg->currentTranslate().y());
-    return svg->viewBoxToViewTransform(width(), height()) * ctm;
+    float scale = svg->currentScale();
+    FloatPoint translate = svg->currentTranslate();
+    AffineTransform ctm(scale, 0, 0, scale, borderAndPadding.width() + translate.x(), borderAndPadding.height() + translate.y());
+    return svg->viewBoxToViewTransform(width() / scale, height() / scale) * ctm;
 }
 
 IntSize RenderSVGRoot::parentOriginToBorderBox() const
@@ -217,28 +236,21 @@ IntSize RenderSVGRoot::borderOriginToContentBox() const
     return IntSize(borderLeft() + paddingLeft(), borderTop() + paddingTop());
 }
 
-TransformationMatrix RenderSVGRoot::localToRepaintContainerTransform(const IntPoint& parentOriginInContainer) const
+AffineTransform RenderSVGRoot::localToRepaintContainerTransform(const IntPoint& parentOriginInContainer) const
 {
-    TransformationMatrix parentToContainer;
-    parentToContainer.translate(parentOriginInContainer.x(), parentOriginInContainer.y());
-    return localToParentTransform() * parentToContainer;
+    AffineTransform parentToContainer(localToParentTransform());
+    return parentToContainer.translateRight(parentOriginInContainer.x(), parentOriginInContainer.y());
 }
 
-TransformationMatrix RenderSVGRoot::localToParentTransform() const
+const AffineTransform& RenderSVGRoot::localToParentTransform() const
 {
     IntSize parentToBorderBoxOffset = parentOriginToBorderBox();
 
-    TransformationMatrix borderBoxOriginToParentOrigin;
-    borderBoxOriginToParentOrigin.translate(parentToBorderBoxOffset.width(), parentToBorderBoxOffset.height());
-
-    return localToBorderBoxTransform() * borderBoxOriginToParentOrigin;
-}
+    AffineTransform borderBoxOriginToParentOrigin(localToBorderBoxTransform());
+    borderBoxOriginToParentOrigin.translateRight(parentToBorderBoxOffset.width(), parentToBorderBoxOffset.height());
 
-// FIXME: This method should be removed as soon as callers to RenderBox::absoluteTransform() can be removed.
-TransformationMatrix RenderSVGRoot::absoluteTransform() const
-{
-    // This would apply localTransform() twice if localTransform() were not the identity.
-    return localToParentTransform() * RenderBox::absoluteTransform();
+    m_localToParentTransform = borderBoxOriginToParentOrigin;
+    return m_localToParentTransform;
 }
 
 FloatRect RenderSVGRoot::objectBoundingBox() const
@@ -249,18 +261,26 @@ FloatRect RenderSVGRoot::objectBoundingBox() const
 FloatRect RenderSVGRoot::repaintRectInLocalCoordinates() const
 {
     // FIXME: This does not include the border but it should!
-    return computeContainerBoundingBox(this, true);
+    FloatRect repaintRect = computeContainerBoundingBox(this, true);
+    style()->svgStyle()->inflateForShadow(repaintRect);
+    return repaintRect;
 }
 
-TransformationMatrix RenderSVGRoot::localTransform() const
+AffineTransform RenderSVGRoot::localTransform() const
 {
-    return TransformationMatrix();
+    return AffineTransform();
 }
 
 void RenderSVGRoot::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
 {
-    // Apply our local transforms (except for x/y translation) and call RenderBox's method to handle all the normal CSS Box model bits
+    // Apply our local transforms (except for x/y translation), then our shadow, 
+    // and then call RenderBox's method to handle all the normal CSS Box model bits
     repaintRect = localToBorderBoxTransform().mapRect(repaintRect);
+
+    // Apply initial viewport clip - not affected by overflow settings    
+    repaintRect.intersect(enclosingIntRect(FloatRect(FloatPoint(), m_viewportSize)));
+
+    style()->svgStyle()->inflateForShadow(repaintRect);
     RenderBox::computeRectForRepaint(repaintContainer, repaintRect, fixed);
 }
 
@@ -283,14 +303,9 @@ bool RenderSVGRoot::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
     IntPoint pointInBorderBox = pointInParent - parentOriginToBorderBox();
 
     // Note: For now, we're ignoring hits to border and padding for <svg>
-
-    if (style()->overflowX() == OHIDDEN) {
-        // SVG doesn't support independent x/y overflow
-        ASSERT(style()->overflowY() == OHIDDEN);
-        IntPoint pointInContentBox = pointInBorderBox - borderOriginToContentBox();
-        if (!contentBoxRect().contains(pointInContentBox))
-            return false;
-    }
+    IntPoint pointInContentBox = pointInBorderBox - borderOriginToContentBox();
+    if (!contentBoxRect().contains(pointInContentBox))
+        return false;
 
     IntPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
 
@@ -310,5 +325,3 @@ bool RenderSVGRoot::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
 }
 
 #endif // ENABLE(SVG)
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.h
index 08c3058e70..53c1298c54 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.h
@@ -31,9 +31,9 @@
 namespace WebCore {
 
 class SVGStyledElement;
-class TransformationMatrix;
+class AffineTransform;
 
-class RenderSVGRoot : public RenderBox, SVGRenderBase {
+class RenderSVGRoot : public RenderBox, protected SVGRenderBase {
 public:
     RenderSVGRoot(SVGStyledElement*);
 
@@ -50,21 +50,24 @@ private:
     virtual int lineHeight(bool b, bool isRootLineBox = false) const;
     virtual int baselinePosition(bool b, bool isRootLineBox = false) const;
     virtual void calcPrefWidths();
-
+    virtual int calcReplacedWidth(bool includeMaxWidth = true) const;
+    virtual int calcReplacedHeight() const;
     virtual void layout();
     virtual void paint(PaintInfo&, int parentX, int parentY);
 
-    virtual TransformationMatrix localToParentTransform() const;
+    virtual void destroy();
+
+    virtual const AffineTransform& localToParentTransform() const;
 
     bool fillContains(const FloatPoint&) const;
     bool strokeContains(const FloatPoint&) const;
 
     virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect strokeBoundingBox() const { return computeContainerBoundingBox(this, true); }
     virtual FloatRect repaintRectInLocalCoordinates() const;
 
-    // FIXME: Both of these overrides should be removed.
-    virtual TransformationMatrix localTransform() const;
-    virtual TransformationMatrix absoluteTransform() const;
+    // FIXME: This override should be removed.
+    virtual AffineTransform localTransform() const;
 
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
@@ -73,17 +76,17 @@ private:
     virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
 
     void calcViewport();
-    const FloatSize& viewportSize() const;
 
     bool selfWillPaint() const;
 
     IntSize parentOriginToBorderBox() const;
     IntSize borderOriginToContentBox() const;
-    TransformationMatrix localToRepaintContainerTransform(const IntPoint& parentOriginInContainer) const;
-    TransformationMatrix localToBorderBoxTransform() const;
+    AffineTransform localToRepaintContainerTransform(const IntPoint& parentOriginInContainer) const;
+    AffineTransform localToBorderBoxTransform() const;
 
     RenderObjectChildList m_children;
     FloatSize m_viewportSize;
+    mutable AffineTransform m_localToParentTransform;
 };
 
 inline RenderSVGRoot* toRenderSVGRoot(RenderObject* object)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGShadowTreeRootContainer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGShadowTreeRootContainer.cpp
new file mode 100644
index 0000000000..9d3d26f232
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGShadowTreeRootContainer.cpp
@@ -0,0 +1,101 @@
+/*
+    Copyright (C) Research In Motion Limited 2010. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    aint with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "RenderSVGShadowTreeRootContainer.h"
+
+#include "MouseEvent.h"
+#include "SVGShadowTreeElements.h"
+#include "SVGUseElement.h"
+
+namespace WebCore {
+
+RenderSVGShadowTreeRootContainer::RenderSVGShadowTreeRootContainer(SVGUseElement* node)
+    : RenderSVGTransformableContainer(node)
+    , m_recreateTree(false)
+{
+}
+
+RenderSVGShadowTreeRootContainer::~RenderSVGShadowTreeRootContainer()
+{
+    if (m_shadowRoot && m_shadowRoot->attached())
+        m_shadowRoot->detach();
+}
+
+void RenderSVGShadowTreeRootContainer::updateStyle(Node::StyleChange change)
+{
+    if (m_shadowRoot && m_shadowRoot->attached())
+        m_shadowRoot->recalcStyle(change);
+}
+
+void RenderSVGShadowTreeRootContainer::updateFromElement()
+{
+    bool hadExistingTree = m_shadowRoot;
+
+    SVGUseElement* useElement = static_cast<SVGUseElement*>(node());
+    if (!m_shadowRoot) {
+        ASSERT(!m_recreateTree);
+        m_shadowRoot = new SVGShadowTreeRootElement(document(), useElement);
+        useElement->buildPendingResource();
+    }
+
+    ASSERT(m_shadowRoot->shadowParentNode() == useElement);
+
+    bool shouldRecreateTree = m_recreateTree;
+    if (m_recreateTree) {
+        ASSERT(hadExistingTree);
+
+        if (m_shadowRoot->attached())
+            m_shadowRoot->detach();
+
+        m_shadowRoot->removeAllChildren();
+        m_recreateTree = false;
+    }
+
+    // Only rebuild the shadow tree, if we a) never had a tree or b) we were specifically asked to do so
+    // If the use element is a pending resource, and a) or b) is true, do nothing, and wait for the use
+    // element to be asked to buildPendingResource(), this will call us again, with m_recreateTrue=true.
+    if ((shouldRecreateTree || !hadExistingTree) && !useElement->isPendingResource()) {
+        useElement->buildShadowAndInstanceTree(m_shadowRoot.get());
+
+        // Attach shadow root element
+        m_shadowRoot->attachElement(style(), renderArena());
+
+        // Attach subtree, as if it was a regular non-shadow tree
+        for (Node* child = m_shadowRoot->firstChild(); child; child = child->nextSibling())
+            child->attach();
+    }
+
+    ASSERT(!m_recreateTree);
+    RenderSVGTransformableContainer::updateFromElement();
+}
+
+void RenderSVGShadowTreeRootContainer::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderSVGTransformableContainer::styleDidChange(diff, oldStyle);
+
+    if (RenderObject* shadowRootRenderer = m_shadowRoot ? m_shadowRoot->renderer() : 0)
+        shadowRootRenderer->setStyle(style());
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGShadowTreeRootContainer.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGShadowTreeRootContainer.h
new file mode 100644
index 0000000000..01cd4270c8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGShadowTreeRootContainer.h
@@ -0,0 +1,50 @@
+/*
+    Copyright (C) Research In Motion Limited 2010. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    aint with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef RenderSVGShadowTreeRootContainer_h
+#define RenderSVGShadowTreeRootContainer_h
+
+#if ENABLE(SVG)
+#include "RenderSVGTransformableContainer.h"
+
+namespace WebCore {
+    
+class SVGUseElement;
+class SVGShadowTreeRootElement;
+
+class RenderSVGShadowTreeRootContainer : public RenderSVGTransformableContainer {
+public:
+    RenderSVGShadowTreeRootContainer(SVGUseElement*);
+    virtual ~RenderSVGShadowTreeRootContainer();
+
+    void markShadowTreeForRecreation() { m_recreateTree = true; }
+    void updateStyle(Node::StyleChange);
+    virtual void updateFromElement();
+
+private:
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+
+    bool m_recreateTree;
+    RefPtr<SVGShadowTreeRootElement> m_shadowRoot;
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTSpan.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTSpan.h
index 652c5e39ea..931bd8c432 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTSpan.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTSpan.h
@@ -31,12 +31,6 @@ class RenderSVGTSpan : public RenderSVGInline {
 public:
     RenderSVGTSpan(Node*);
     virtual const char* renderName() const { return "RenderSVGTSpan"; }
-
-    // FIXME: These are incorrect, but have always behaved this way.
-    // These empty implementations prevent us from hitting RenderObject ASSERTS.
-    // tspan.getBBox() will be wrong, and repainting for tspans may not work correctly!
-    virtual FloatRect objectBoundingBox() const { return FloatRect(); }
-    virtual FloatRect repaintRectInLocalCoordinates() const { return FloatRect(); }
 };
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.cpp
index 3919d7fef6..76b8b86a56 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.cpp
@@ -6,6 +6,7 @@
  *               2006 Oliver Hunt <ojh16@student.canterbury.ac.nz>
  *               2007 Nikolas Zimmermann <zimmermann@kde.org>
  *               2008 Rob Buis <buis@kde.org>
+ *               2009 Dirk Schulze <krit@webkit.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -69,10 +70,6 @@ void RenderSVGText::mapLocalToContainer(RenderBoxModelObject* repaintContainer,
 void RenderSVGText::layout()
 {
     ASSERT(needsLayout());
-
-    // FIXME: This is a hack to avoid the RenderBlock::layout() partial repainting code which is not (yet) SVG aware
-    setNeedsLayout(true);
-
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
 
     // Best guess for a relative starting point
@@ -111,6 +108,12 @@ bool RenderSVGText::nodeAtFloatPoint(const HitTestRequest& request, HitTestResul
     return false;
 }
 
+void RenderSVGText::destroy()
+{
+    deregisterFromResources(this);
+    RenderSVGBlock::destroy();
+}
+
 bool RenderSVGText::nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int, HitTestAction)
 {
     ASSERT_NOT_REACHED();
@@ -125,11 +128,8 @@ void RenderSVGText::absoluteRects(Vector<IntRect>& rects, int, int)
  
     // Don't use objectBoundingBox here, as it's unites the selection rects. Makes it hard
     // to spot errors, if there are any using WebInspector. Individually feed them into 'rects'.
-    for (InlineRunBox* runBox = firstLineBox(); runBox; runBox = runBox->nextLineBox()) {
-        ASSERT(runBox->isInlineFlowBox());
-
-        InlineFlowBox* flowBox = static_cast<InlineFlowBox*>(runBox);
-        for (InlineBox* box = flowBox->firstChild(); box; box = box->nextOnLine()) {
+    for (InlineFlowBox* flow = firstLineBox(); flow; flow = flow->nextLineBox()) {
+        for (InlineBox* box = flow->firstChild(); box; box = box->nextOnLine()) {
             FloatRect boxRect(box->x(), box->y(), box->width(), box->height());
             // FIXME: crawling up the parent chain to map each rect is very inefficient
             // we should compute the absoluteTransform outside this loop first.
@@ -146,11 +146,8 @@ void RenderSVGText::absoluteQuads(Vector<FloatQuad>& quads)
  
     // Don't use objectBoundingBox here, as it's unites the selection rects. Makes it hard
     // to spot errors, if there are any using WebInspector. Individually feed them into 'rects'.
-    for (InlineRunBox* runBox = firstLineBox(); runBox; runBox = runBox->nextLineBox()) {
-        ASSERT(runBox->isInlineFlowBox());
-
-        InlineFlowBox* flowBox = static_cast<InlineFlowBox*>(runBox);
-        for (InlineBox* box = flowBox->firstChild(); box; box = box->nextOnLine()) {
+    for (InlineFlowBox* flow = firstLineBox(); flow; flow = flow->nextLineBox()) {
+        for (InlineBox* box = flow->firstChild(); box; box = box->nextOnLine()) {
             FloatRect boxRect(box->x(), box->y(), box->width(), box->height());
             // FIXME: crawling up the parent chain to map each quad is very inefficient
             // we should compute the absoluteTransform outside this loop first.
@@ -172,11 +169,8 @@ FloatRect RenderSVGText::objectBoundingBox() const
 {
     FloatRect boundingBox;
 
-    for (InlineRunBox* runBox = firstLineBox(); runBox; runBox = runBox->nextLineBox()) {
-        ASSERT(runBox->isInlineFlowBox());
-
-        InlineFlowBox* flowBox = static_cast<InlineFlowBox*>(runBox);
-        for (InlineBox* box = flowBox->firstChild(); box; box = box->nextOnLine())
+    for (InlineFlowBox* flow = firstLineBox(); flow; flow = flow->nextLineBox()) {
+        for (InlineBox* box = flow->firstChild(); box; box = box->nextOnLine())
             boundingBox.unite(FloatRect(box->x(), box->y(), box->width(), box->height()));
     }
 
@@ -184,13 +178,13 @@ FloatRect RenderSVGText::objectBoundingBox() const
     return boundingBox;
 }
 
-FloatRect RenderSVGText::repaintRectInLocalCoordinates() const
+FloatRect RenderSVGText::strokeBoundingBox() const
 {
     FloatRect repaintRect = objectBoundingBox();
 
     // SVG needs to include the strokeWidth(), not the textStrokeWidth().
     if (style()->svgStyle()->hasStroke()) {
-        float strokeWidth = SVGRenderStyle::cssPrimitiveToLength(this, style()->svgStyle()->strokeWidth(), 0.0f);
+        float strokeWidth = SVGRenderStyle::cssPrimitiveToLength(this, style()->svgStyle()->strokeWidth(), 1.0f);
 
 #if ENABLE(SVG_FONTS)
         const Font& font = style()->font();
@@ -205,7 +199,28 @@ FloatRect RenderSVGText::repaintRectInLocalCoordinates() const
         repaintRect.inflate(strokeWidth);
     }
 
-    repaintRect.unite(filterBoundingBoxForRenderer(this));
+    return repaintRect;
+}
+
+FloatRect RenderSVGText::repaintRectInLocalCoordinates() const
+{
+    FloatRect repaintRect = strokeBoundingBox();
+
+    // FIXME: We need to be careful here. We assume that there is no filter,
+    // clipper or masker if the rects are empty.
+    FloatRect rect = filterBoundingBoxForRenderer(this);
+    if (!rect.isEmpty())
+        repaintRect = rect;
+
+    rect = clipperBoundingBoxForRenderer(this);
+    if (!rect.isEmpty())
+        repaintRect.intersect(rect);
+
+    rect = maskerBoundingBoxForRenderer(this);
+    if (!rect.isEmpty())
+        repaintRect.intersect(rect);
+
+    style()->svgStyle()->inflateForShadow(repaintRect);
 
     return repaintRect;
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h
index 9a2770ba3c..ab4b09b5c8 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h
@@ -26,7 +26,7 @@
 
 #if ENABLE(SVG)
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "RenderSVGBlock.h"
 
 namespace WebCore {
@@ -40,9 +40,11 @@ public:
 private:
     virtual const char* renderName() const { return "RenderSVGText"; }
 
+    virtual const SVGRenderBase* toSVGRenderBase() const { return this; }
+
     virtual bool isSVGText() const { return true; }
 
-    virtual TransformationMatrix localToParentTransform() const { return m_localTransform; }
+    virtual const AffineTransform& localToParentTransform() const { return m_localTransform; }
 
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
@@ -51,6 +53,8 @@ private:
     virtual bool requiresLayer() const { return false; }
     virtual void layout();
 
+    virtual void destroy();
+
     virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
     virtual void absoluteQuads(Vector<FloatQuad>&);
 
@@ -60,14 +64,15 @@ private:
     virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
 
     virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect strokeBoundingBox() const;
     virtual FloatRect repaintRectInLocalCoordinates() const;
 
     // FIXME: This can be removed when localTransform() is removed from RenderObject
-    virtual TransformationMatrix localTransform() const { return m_localTransform; }
+    virtual AffineTransform localTransform() const { return m_localTransform; }
 
     virtual RootInlineBox* createRootInlineBox();
 
-    TransformationMatrix m_localTransform;
+    AffineTransform m_localTransform;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.cpp
index 2324eee4f0..4bec7a7918 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.cpp
@@ -1,5 +1,5 @@
 /*
-    Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
+    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
                   2009 Google, Inc.
 
@@ -20,12 +20,12 @@
  */
 
 #include "config.h"
-#if ENABLE(SVG)
 
+#if ENABLE(SVG)
 #include "RenderSVGTransformableContainer.h"
 
+#include "SVGShadowTreeElements.h"
 #include "SVGStyledTransformableElement.h"
-#include "SVGTransformList.h"
 
 namespace WebCore {
     
@@ -34,12 +34,12 @@ RenderSVGTransformableContainer::RenderSVGTransformableContainer(SVGStyledTransf
 {
 }
 
-TransformationMatrix RenderSVGTransformableContainer::localToParentTransform() const
+const AffineTransform& RenderSVGTransformableContainer::localToParentTransform() const
 {
     return m_localTransform;
 }
 
-TransformationMatrix RenderSVGTransformableContainer::localTransform() const
+AffineTransform RenderSVGTransformableContainer::localTransform() const
 {
     return m_localTransform;
 }
@@ -47,6 +47,14 @@ TransformationMatrix RenderSVGTransformableContainer::localTransform() const
 void RenderSVGTransformableContainer::calculateLocalTransform()
 {
     m_localTransform = static_cast<SVGStyledTransformableElement*>(node())->animatedLocalTransform();
+    if (!node()->hasTagName(SVGNames::gTag) || !static_cast<SVGGElement*>(node())->isShadowTreeContainerElement())
+        return;
+
+    FloatSize translation = static_cast<SVGShadowTreeContainerElement*>(node())->containerTranslation();
+    if (translation.width() == 0 && translation.height() == 0)
+        return;
+
+    m_localTransform.translate(translation.width(), translation.height());
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.h
index c929761f16..1de0b195c6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.h
@@ -31,14 +31,14 @@ namespace WebCore {
     public:
         RenderSVGTransformableContainer(SVGStyledTransformableElement*);
 
-        virtual TransformationMatrix localToParentTransform() const;
+        virtual const AffineTransform& localToParentTransform() const;
 
     private:
         virtual void calculateLocalTransform();
         // FIXME: This can be made non-virtual once SVGRenderTreeAsText stops using localTransform()
-        virtual TransformationMatrix localTransform() const;
+        virtual AffineTransform localTransform() const;
 
-        TransformationMatrix m_localTransform;
+        AffineTransform m_localTransform;
     };
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.cpp
index a432ef3b76..103d9d2f26 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.cpp
@@ -38,23 +38,33 @@ RenderSVGViewportContainer::RenderSVGViewportContainer(SVGStyledElement* node)
 {
 }
 
-void RenderSVGViewportContainer::paint(PaintInfo& paintInfo, int parentX, int parentY)
+FloatRect RenderSVGViewportContainer::markerBoundaries(const AffineTransform& markerTransformation) const
 {
-    // FIXME: The if statement here evaluates to false. isEmpty() is exactly the same
-    // as what is on the right side, so it's basically !isEmpty && isEmpty. So this
-    // function does nothing.
+    FloatRect coordinates = repaintRectInLocalCoordinates();
 
-    // A value of zero disables rendering of the element. 
-    if (!m_viewport.isEmpty() && (m_viewport.width() <= 0. || m_viewport.height() <= 0.))
-        return;
+    // Map repaint rect into parent coordinate space, in which the marker boundaries have to be evaluated
+    coordinates = localToParentTransform().mapRect(coordinates);
 
-    RenderSVGContainer::paint(paintInfo, parentX, parentY);
+    return markerTransformation.mapRect(coordinates);
+}
+
+AffineTransform RenderSVGViewportContainer::markerContentTransformation(const AffineTransform& contentTransformation, const FloatPoint& origin, float strokeWidth) const
+{
+    // The 'origin' coordinate maps to SVGs refX/refY, given in coordinates relative to the viewport established by the marker
+    FloatPoint mappedOrigin = viewportTransform().mapPoint(origin);
+
+    AffineTransform transformation = contentTransformation;
+    if (strokeWidth != -1)
+        transformation.scaleNonUniform(strokeWidth, strokeWidth);
+
+    transformation.translate(-mappedOrigin.x(), -mappedOrigin.y());
+    return transformation;
 }
 
 void RenderSVGViewportContainer::applyViewportClip(PaintInfo& paintInfo)
 {
-    if (style()->overflowX() != OVISIBLE)
-        paintInfo.context->clip(enclosingIntRect(m_viewport)); // FIXME: Eventually we'll want float-precision clipping
+    if (SVGRenderBase::isOverflowHidden(this))
+        paintInfo.context->clip(m_viewport);
 }
 
 void RenderSVGViewportContainer::calcViewport()
@@ -82,7 +92,7 @@ void RenderSVGViewportContainer::calcViewport()
     }
 }
 
-TransformationMatrix RenderSVGViewportContainer::viewportTransform() const
+AffineTransform RenderSVGViewportContainer::viewportTransform() const
 {
     if (node()->hasTagName(SVGNames::svgTag)) {
         SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
@@ -92,38 +102,27 @@ TransformationMatrix RenderSVGViewportContainer::viewportTransform() const
         return marker->viewBoxToViewTransform(m_viewport.width(), m_viewport.height());
     }
 
-    return TransformationMatrix();
+    return AffineTransform();
 }
 
-TransformationMatrix RenderSVGViewportContainer::localToParentTransform() const
+const AffineTransform& RenderSVGViewportContainer::localToParentTransform() const
 {
-    TransformationMatrix viewportTranslation;
-    viewportTranslation.translate(m_viewport.x(), m_viewport.y());
-    return viewportTransform() * viewportTranslation;
+    AffineTransform viewportTranslation(viewportTransform());
+    m_localToParentTransform = viewportTranslation.translateRight(m_viewport.x(), m_viewport.y());
+    return m_localToParentTransform;
     // If this class were ever given a localTransform(), then the above would read:
     // return viewportTransform() * localTransform() * viewportTranslation;
 }
 
-// FIXME: This method should be removed as soon as callers to RenderBox::absoluteTransform() can be removed.
-TransformationMatrix RenderSVGViewportContainer::absoluteTransform() const
-{
-    // This would apply localTransform() twice if localTransform() were not the identity.
-    return localToParentTransform() * RenderSVGContainer::absoluteTransform();
-}
-
 bool RenderSVGViewportContainer::pointIsInsideViewportClip(const FloatPoint& pointInParent)
 {
-    // Respect the viewport clip (which is in parent coords).  SVG does not support separate x/y overflow rules.
-    if (style()->overflowX() == OHIDDEN) {
-        ASSERT(style()->overflowY() == OHIDDEN);
-        if (!m_viewport.contains(pointInParent))
-            return false;
-    }
-    return true;
+    // Respect the viewport clip (which is in parent coords)
+    if (!SVGRenderBase::isOverflowHidden(this))
+        return true;
+    
+    return m_viewport.contains(pointInParent);
 }
 
 }
 
 #endif // ENABLE(SVG)
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.h
index b8b30b5506..c4043ec946 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.h
@@ -24,7 +24,6 @@
 #define RenderSVGViewportContainer_h
 
 #if ENABLE(SVG)
-
 #include "RenderSVGContainer.h"
 
 namespace WebCore {
@@ -35,19 +34,19 @@ class RenderSVGViewportContainer : public RenderSVGContainer {
 public:
     RenderSVGViewportContainer(SVGStyledElement*);
 
-    // FIXME: This is only public for SVGResourceMarker::draw, likely the callsite should be changed.
-    TransformationMatrix viewportTransform() const;
+    // Calculates marker boundaries, mapped to the target element's coordinate space
+    FloatRect markerBoundaries(const AffineTransform& markerTransformation) const;
 
-    virtual void paint(PaintInfo&, int parentX, int parentY);
+    // Generates a transformation matrix usable to render marker content. Handles scaling the marker content
+    // acording to SVGs markerUnits="strokeWidth" concept, when a strokeWidth value != -1 is passed in.
+    AffineTransform markerContentTransformation(const AffineTransform& contentTransformation, const FloatPoint& origin, float strokeWidth = -1) const;
 
 private:
     virtual bool isSVGContainer() const { return true; }
     virtual const char* renderName() const { return "RenderSVGViewportContainer"; }
 
-    virtual TransformationMatrix localToParentTransform() const;
-
-    // FIXME: This override should be removed once callers of RenderBox::absoluteTransform() can be removed.
-    virtual TransformationMatrix absoluteTransform() const;
+    AffineTransform viewportTransform() const;
+    virtual const AffineTransform& localToParentTransform() const;
 
     virtual void calcViewport();
 
@@ -55,6 +54,7 @@ private:
     virtual bool pointIsInsideViewportClip(const FloatPoint& pointInParent);
 
     FloatRect m_viewport;
+    mutable AffineTransform m_localToParentTransform;
 };
   
 inline RenderSVGViewportContainer* toRenderSVGViewportContainer(RenderObject* object)
@@ -70,5 +70,3 @@ void toRenderSVGViewportContainer(const RenderSVGViewportContainer*);
 
 #endif // ENABLE(SVG)
 #endif // RenderSVGViewportContainer_h
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarTheme.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarTheme.cpp
index 06ca32ad9c..19143ccc40 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarTheme.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarTheme.cpp
@@ -109,7 +109,7 @@ IntRect RenderScrollbarTheme::constrainTrackRectToTrackPieces(Scrollbar* scrollb
 void RenderScrollbarTheme::paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect)
 {
     // FIXME: Implement.
-    context->fillRect(cornerRect, Color::white);
+    context->fillRect(cornerRect, Color::white, DeviceColorSpace);
 }
 
 void RenderScrollbarTheme::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSelectionInfo.h b/src/3rdparty/webkit/WebCore/rendering/RenderSelectionInfo.h
index e7b7b7893f..c06a9ae476 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSelectionInfo.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSelectionInfo.h
@@ -30,7 +30,7 @@
 
 namespace WebCore {
 
-class RenderSelectionInfoBase {
+class RenderSelectionInfoBase : public Noncopyable {
 public:
     RenderSelectionInfoBase()
         : m_object(0)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp
index 442af39401..729fd1522b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,6 +35,7 @@
 #include "RenderLayer.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
+#include "StepRange.h"
 #include <wtf/MathExtras.h>
 
 using std::min;
@@ -45,70 +46,10 @@ using namespace HTMLNames;
 
 static const int defaultTrackLength = 129;
 
-// FIXME: The SliderRange class and functions are entirely based on the DOM,
-// and could be put with HTMLInputElement (possibly with a new name) instead of here.
-struct SliderRange {
-    bool isIntegral;
-    double minimum;
-    double maximum;  // maximum must be >= minimum.
-
-    explicit SliderRange(HTMLInputElement*);
-    double clampValue(double value);
-
-    // Map value into 0-1 range
-    double proportionFromValue(double value)
-    {
-        if (minimum == maximum)
-            return 0;
-
-        return (value - minimum) / (maximum - minimum);
-    }
-    
-    // Map from 0-1 range to value
-    double valueFromProportion(double proportion)
-    {
-        return minimum + proportion * (maximum - minimum);
-    }
-    
-    double valueFromElement(HTMLInputElement*, bool* wasClamped = 0);
-};
-
-SliderRange::SliderRange(HTMLInputElement* element)
-{
-    // FIXME: What's the right way to handle an integral range with non-integral minimum and maximum?
-    // Currently values are guaranteed to be integral but could be outside the range in that case.
-
-    isIntegral = !equalIgnoringCase(element->getAttribute(precisionAttr), "float");
-
-    maximum = element->rangeMaximum();
-    minimum = element->rangeMinimum();
-}
-
-double SliderRange::clampValue(double value)
-{
-    double clampedValue = max(minimum, min(value, maximum));
-    return isIntegral ? round(clampedValue) : clampedValue;
-}
-
-double SliderRange::valueFromElement(HTMLInputElement* element, bool* wasClamped)
-{
-    double oldValue;
-    bool parseSuccess = HTMLInputElement::formStringToDouble(element->value(), &oldValue);
-    if (!parseSuccess)
-        oldValue = (minimum + maximum) / 2;
-    double newValue = clampValue(oldValue);
-
-    if (wasClamped)
-        *wasClamped = !parseSuccess || newValue != oldValue;
-
-    return newValue;
-}
-
 // Returns a value between 0 and 1.
-// As with SliderRange, this could be on HTMLInputElement instead of here.
 static double sliderPosition(HTMLInputElement* element)
 {
-    SliderRange range(element);
+    StepRange range(element);
     return range.proportionFromValue(range.valueFromElement(element));
 }
 
@@ -352,10 +293,9 @@ void RenderSlider::layout()
             thumb->repaintDuringLayoutIfMoved(oldThumbRect);
 
         statePusher.pop();
+        addOverflowFromChild(thumb);
     }
 
-    addOverflowFromChild(thumb);
-
     repainter.repaintAfterLayout();    
 
     setNeedsLayout(false);
@@ -363,15 +303,6 @@ void RenderSlider::layout()
 
 void RenderSlider::updateFromElement()
 {
-    HTMLInputElement* element = static_cast<HTMLInputElement*>(node());
-
-    // Send the value back to the element if the range changes it.
-    SliderRange range(element);
-    bool clamped;
-    double value = range.valueFromElement(element, &clamped);
-    if (clamped)
-        element->setValueFromRenderer(String::number(value));
-
     // Layout will take care of the thumb's size and position.
     if (!m_thumb) {
         m_thumb = new SliderThumbElement(document(), node());
@@ -421,12 +352,12 @@ void RenderSlider::setValueForPosition(int position)
     HTMLInputElement* element = static_cast<HTMLInputElement*>(node());
 
     // Calculate the new value based on the position, and send it to the element.
-    SliderRange range(element);
+    StepRange range(element);
     double fraction = static_cast<double>(position) / trackSize();
     if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart)
         fraction = 1 - fraction;
     double value = range.clampValue(range.valueFromProportion(fraction));
-    element->setValueFromRenderer(String::number(value));
+    element->setValueFromRenderer(HTMLInputElement::serializeForNumberType(value));
 
     // Also update the position if appropriate.
     if (position != currentPosition()) {
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp
index 73f365410d..e0fbebef2f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp
@@ -485,6 +485,9 @@ void RenderTable::paintObject(PaintInfo& paintInfo, int tx, int ty)
 
 void RenderTable::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 {
+    if (!shouldPaintWithinRoot(paintInfo))
+        return;
+
     int w = width();
     int h = height();
 
@@ -578,6 +581,25 @@ void RenderTable::appendColumn(int span)
     setNeedsLayoutAndPrefWidthsRecalc();
 }
 
+RenderTableCol* RenderTable::nextColElement(RenderTableCol* current) const
+{
+    RenderObject* next = current->firstChild();
+    if (!next)
+        next = current->nextSibling();
+    if (!next && current->parent()->isTableCol())
+        next = current->parent()->nextSibling();
+
+    while (next) {
+        if (next->isTableCol())
+            return toRenderTableCol(next);
+        if (next != m_caption)
+            return 0;
+        next = next->nextSibling();
+    }
+    
+    return 0;
+}
+
 RenderTableCol* RenderTable::colElement(int col, bool* startEdge, bool* endEdge) const
 {
     if (!m_hasColElements)
@@ -586,32 +608,31 @@ RenderTableCol* RenderTable::colElement(int col, bool* startEdge, bool* endEdge)
     int cCol = 0;
 
     while (child) {
-        if (child->isTableCol()) {
-            RenderTableCol* colElem = toRenderTableCol(child);
-            int span = colElem->span();
-            if (!colElem->firstChild()) {
-                int startCol = cCol;
-                int endCol = cCol + span - 1;
-                cCol += span;
-                if (cCol > col) {
-                    if (startEdge)
-                        *startEdge = startCol == col;
-                    if (endEdge)
-                        *endEdge = endCol == col;
-                    return colElem;
-                }
-            }
-
-            RenderObject* next = child->firstChild();
-            if (!next)
-                next = child->nextSibling();
-            if (!next && child->parent()->isTableCol())
-                next = child->parent()->nextSibling();
-            child = next;
-        } else if (child == m_caption)
-            child = child->nextSibling();
-        else
+        if (child->isTableCol())
             break;
+        if (child != m_caption)
+            return 0;
+        child = child->nextSibling();
+    }
+    if (!child)
+        return 0;
+
+    RenderTableCol* colElem = toRenderTableCol(child);
+    while (colElem) {
+        int span = colElem->span();
+        if (!colElem->firstChild()) {
+            int startCol = cCol;
+            int endCol = cCol + span - 1;
+            cCol += span;
+            if (cCol > col) {
+                if (startEdge)
+                    *startEdge = startCol == col;
+                if (endEdge)
+                    *endEdge = endCol == col;
+                return colElem;
+            }
+        }
+        colElem = nextColElement(colElem);
     }
 
     return 0;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTable.h b/src/3rdparty/webkit/WebCore/rendering/RenderTable.h
index e75d644d3c..5978c0b066 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTable.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTable.h
@@ -113,6 +113,7 @@ public:
     }
 
     RenderTableCol* colElement(int col, bool* startEdge = 0, bool* endEdge = 0) const;
+    RenderTableCol* nextColElement(RenderTableCol* current) const;
 
     bool needsSectionRecalc() const { return m_needsSectionRecalc; }
     void setNeedsSectionRecalc()
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp
index 8dc9145b4d..7309ace5b7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp
@@ -83,18 +83,42 @@ void RenderTableCell::updateFromElement()
 Length RenderTableCell::styleOrColWidth() const
 {
     Length w = style()->width();
-    if (colSpan() > 1 || !w.isAuto())
+    if (!w.isAuto())
         return w;
+
     RenderTableCol* tableCol = table()->colElement(col());
+
     if (tableCol) {
-        w = tableCol->style()->width();
-        
+        int colSpanCount = colSpan();
+
+        Length colWidthSum = Length(0, Fixed);
+        for (int i = 1; i <= colSpanCount; i++) {
+            Length colWidth = tableCol->style()->width();
+
+            // Percentage value should be returned only for colSpan == 1.
+            // Otherwise we return original width for the cell.
+            if (!colWidth.isFixed()) {
+                if (colSpanCount > 1)
+                    return w;
+                return colWidth;
+            }
+
+            colWidthSum = Length(colWidthSum.value() + colWidth.value(), Fixed);
+
+            tableCol = table()->nextColElement(tableCol);
+            // If no next <col> tag found for the span we just return what we have for now.
+            if (!tableCol)
+                break;
+        }
+
         // Column widths specified on <col> apply to the border box of the cell.
         // Percentages don't need to be handled since they're always treated this way (even when specified on the cells).
         // See Bugzilla bug 8126 for details.
-        if (w.isFixed() && w.value() > 0)
-            w = Length(max(0, w.value() - borderLeft() - borderRight() - paddingLeft() - paddingRight()), Fixed);
+        if (colWidthSum.isFixed() && colWidthSum.value() > 0)
+            colWidthSum = Length(max(0, colWidthSum.value() - borderLeft() - borderRight() - paddingLeft() - paddingRight()), Fixed);
+        return colWidthSum;
     }
+
     return w;
 }
 
@@ -154,6 +178,17 @@ void RenderTableCell::setOverrideSize(int size)
     RenderBlock::setOverrideSize(size);
 }
 
+IntSize RenderTableCell::offsetFromContainer(RenderObject* o, const IntPoint& point) const
+{
+    ASSERT(o == container());
+
+    IntSize offset = RenderBlock::offsetFromContainer(o, point);
+    if (parent())
+        offset.expand(-parentBox()->x(), -parentBox()->y());
+
+    return offset;
+}
+
 IntRect RenderTableCell::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     // If the table grid is dirty, we cannot get reliable information about adjoining cells,
@@ -212,35 +247,11 @@ void RenderTableCell::computeRectForRepaint(RenderBoxModelObject* repaintContain
         return;
     r.setY(r.y());
     RenderView* v = view();
-    if ((!v || !v->layoutStateEnabled()) && parent())
+    if ((!v || !v->layoutStateEnabled() || repaintContainer) && parent())
         r.move(-parentBox()->x(), -parentBox()->y()); // Rows are in the same coordinate space, so don't add their offset in.
     RenderBlock::computeRectForRepaint(repaintContainer, r, fixed);
 }
 
-void RenderTableCell::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState& transformState) const
-{
-    if (repaintContainer == this)
-        return;
-
-    RenderView* v = view();
-    if ((!v || !v->layoutStateEnabled()) && parent()) {
-        // Rows are in the same coordinate space, so don't add their offset in.
-        // FIXME: this is wrong with transforms
-        transformState.move(-parentBox()->x(), -parentBox()->y());
-    }
-    RenderBlock::mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
-}
-
-void RenderTableCell::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState& transformState) const
-{
-    RenderBlock::mapAbsoluteToLocalPoint(fixed, useTransforms, transformState);
-    if (parent()) {
-        // Rows are in the same coordinate space, so add their offset back in.
-        // FIXME: this is wrong with transforms
-        transformState.move(parentBox()->x(), parentBox()->y());
-    }
-}
-
 int RenderTableCell::baselinePosition(bool firstLine, bool isRootLineBox) const
 {
     if (isRootLineBox)
@@ -642,6 +653,9 @@ int RenderTableCell::borderHalfBottom(bool outer) const
 void RenderTableCell::paint(PaintInfo& paintInfo, int tx, int ty)
 {
     if (paintInfo.phase == PaintPhaseCollapsedTableBorders && style()->visibility() == VISIBLE) {
+        if (!shouldPaintWithinRoot(paintInfo))
+            return;
+
         tx += x();
         ty += y();
         int os = 2 * maximalOutlineSize(paintInfo.phase);
@@ -800,6 +814,9 @@ void RenderTableCell::paintCollapsedBorder(GraphicsContext* graphicsContext, int
 
 void RenderTableCell::paintBackgroundsBehindCell(PaintInfo& paintInfo, int tx, int ty, RenderObject* backgroundObject)
 {
+    if (!shouldPaintWithinRoot(paintInfo))
+        return;
+
     if (!backgroundObject)
         return;
 
@@ -831,7 +848,7 @@ void RenderTableCell::paintBackgroundsBehindCell(PaintInfo& paintInfo, int tx, i
             paintInfo.context->save();
             paintInfo.context->clip(clipRect);
         }
-        paintFillLayers(paintInfo, c, bgLayer, tx, ty, w, h);
+        paintFillLayers(paintInfo, c, bgLayer, tx, ty, w, h, CompositeSourceOver, backgroundObject);
         if (shouldClip)
             paintInfo.context->restore();
     }
@@ -839,6 +856,9 @@ void RenderTableCell::paintBackgroundsBehindCell(PaintInfo& paintInfo, int tx, i
 
 void RenderTableCell::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 {
+    if (!shouldPaintWithinRoot(paintInfo))
+        return;
+
     RenderTable* tableElt = table();
     if (!tableElt->collapseBorders() && style()->emptyCells() == HIDE && !firstChild())
         return;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.h b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.h
index 8855dff9cb..b6622f4f74 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.h
@@ -99,13 +99,12 @@ public:
 
     virtual void setOverrideSize(int);
 
+    bool hasVisibleOverflow() const { return m_overflow; }
+
 protected:
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
-    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
-    virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
-
 private:
     virtual const char* renderName() const { return isAnonymous() ? "RenderTableCell (anonymous)" : "RenderTableCell"; }
 
@@ -120,6 +119,7 @@ private:
     virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
     virtual void paintMask(PaintInfo&, int tx, int ty);
 
+    virtual IntSize offsetFromContainer(RenderObject*, const IntPoint&) const;
     virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.cpp
index bafadfc460..a11a14ba85 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.cpp
index b8ac497b78..34c854bd5e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.cpp
@@ -42,6 +42,14 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static inline void setRowHeightToRowStyleHeightIfNotRelative(RenderTableSection::RowStruct* row)
+{
+    ASSERT(row && row->rowRenderer);
+    row->height = row->rowRenderer->style()->height();
+    if (row->height.isRelative())
+        row->height = Length();
+}
+
 RenderTableSection::RenderTableSection(Node* node)
     : RenderBox(node)
     , m_gridRows(0)
@@ -122,11 +130,8 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
 
     m_grid[m_cRow].rowRenderer = toRenderTableRow(child);
 
-    if (!beforeChild) {
-        m_grid[m_cRow].height = child->style()->height();
-        if (m_grid[m_cRow].height.isRelative())
-            m_grid[m_cRow].height = Length();
-    }
+    if (!beforeChild)
+        setRowHeightToRowStyleHeightIfNotRelative(&m_grid[m_cRow]);
 
     // If the next renderer is actually wrapped in an anonymous table row, we need to go up and find that.
     while (beforeChild && beforeChild->parent() != this)
@@ -641,12 +646,11 @@ int RenderTableSection::layoutRows(int toAdd)
             if (r < totalRows - 1 && cell == cellAt(r + 1, c).cell)
                 continue;
             addOverflowFromChild(cell);
+            m_hasOverflowingCell |= cell->hasVisibleOverflow();
         }
     }
-    m_hasOverflowingCell = m_overflow;
-    
-    statePusher.pop();
 
+    statePusher.pop();
     return height();
 }
 
@@ -1083,6 +1087,7 @@ void RenderTableSection::recalcCells()
             
             RenderTableRow* tableRow = toRenderTableRow(row);
             m_grid[m_cRow].rowRenderer = tableRow;
+            setRowHeightToRowStyleHeightIfNotRelative(&m_grid[m_cRow]);
 
             for (RenderObject* cell = row->firstChild(); cell; cell = cell->nextSibling()) {
                 if (cell->isTableCell())
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
index 88a05e5f5f..aa919e0fb5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
@@ -25,7 +25,9 @@
 #include "config.h"
 #include "RenderText.h"
 
+#include "AXObjectCache.h"
 #include "CharacterNames.h"
+#include "EllipsisBox.h"
 #include "FloatQuad.h"
 #include "FrameView.h"
 #include "InlineTextBox.h"
@@ -46,12 +48,6 @@ using namespace Unicode;
 
 namespace WebCore {
 
-// FIXME: Move to StringImpl.h eventually.
-static inline bool charactersAreAllASCII(StringImpl* text)
-{
-    return charactersAreAllASCII(text->characters(), text->length());
-}
-
 RenderText::RenderText(Node* node, PassRefPtr<StringImpl> str)
      : RenderObject(node)
      , m_minWidth(-1)
@@ -64,7 +60,7 @@ RenderText::RenderText(Node* node, PassRefPtr<StringImpl> str)
      , m_hasTab(false)
      , m_linesDirty(false)
      , m_containsReversedText(false)
-     , m_isAllASCII(charactersAreAllASCII(m_text.get()))
+     , m_isAllASCII(m_text.containsOnlyASCII())
      , m_knownNotToUseFallbackFonts(false)
 {
     ASSERT(m_text);
@@ -148,9 +144,9 @@ void RenderText::extractTextBox(InlineTextBox* box)
     if (box == m_firstTextBox)
         m_firstTextBox = 0;
     if (box->prevTextBox())
-        box->prevTextBox()->setNextLineBox(0);
-    box->setPreviousLineBox(0);
-    for (InlineRunBox* curr = box; curr; curr = curr->nextLineBox())
+        box->prevTextBox()->setNextTextBox(0);
+    box->setPreviousTextBox(0);
+    for (InlineTextBox* curr = box; curr; curr = curr->nextTextBox())
         curr->setExtracted();
 
     checkConsistency();
@@ -161,8 +157,8 @@ void RenderText::attachTextBox(InlineTextBox* box)
     checkConsistency();
 
     if (m_lastTextBox) {
-        m_lastTextBox->setNextLineBox(box);
-        box->setPreviousLineBox(m_lastTextBox);
+        m_lastTextBox->setNextTextBox(box);
+        box->setPreviousTextBox(m_lastTextBox);
     } else
         m_firstTextBox = box;
     InlineTextBox* last = box;
@@ -184,9 +180,9 @@ void RenderText::removeTextBox(InlineTextBox* box)
     if (box == m_lastTextBox)
         m_lastTextBox = box->prevTextBox();
     if (box->nextTextBox())
-        box->nextTextBox()->setPreviousLineBox(box->prevTextBox());
+        box->nextTextBox()->setPreviousTextBox(box->prevTextBox());
     if (box->prevTextBox())
-        box->prevTextBox()->setNextLineBox(box->nextTextBox());
+        box->prevTextBox()->setNextTextBox(box->nextTextBox());
 
     checkConsistency();
 }
@@ -228,27 +224,32 @@ void RenderText::absoluteRectsForRange(Vector<IntRect>& rects, unsigned start, u
     start = min(start, static_cast<unsigned>(INT_MAX));
     end = min(end, static_cast<unsigned>(INT_MAX));
     
-    FloatPoint absPos = localToAbsolute(FloatPoint());
-
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
         // Note: box->end() returns the index of the last character, not the index past it
         if (start <= box->start() && box->end() < end) {
-            IntRect r = IntRect(absPos.x() + box->x(), absPos.y() + box->y(), box->width(), box->height());
+            IntRect r = IntRect(box->x(), box->y(), box->width(), box->height());
             if (useSelectionHeight) {
-                IntRect selectionRect = box->selectionRect(absPos.x(), absPos.y(), start, end);
+                IntRect selectionRect = box->selectionRect(0, 0, start, end);
                 r.setHeight(selectionRect.height());
                 r.setY(selectionRect.y());
             }
+            FloatPoint origin = localToAbsolute(r.location());
+            r.setX(origin.x());
+            r.setY(origin.y());
             rects.append(r);
         } else {
             unsigned realEnd = min(box->end() + 1, end);
-            IntRect r = box->selectionRect(absPos.x(), absPos.y(), start, realEnd);
+            IntRect r = box->selectionRect(0, 0, start, realEnd);
             if (!r.isEmpty()) {
                 if (!useSelectionHeight) {
                     // change the height and y position because selectionRect uses selection-specific values
                     r.setHeight(box->height());
-                    r.setY(absPos.y() + box->y());
+                    r.setY(box->y());
                 }
+                FloatPoint origin = localToAbsolute(r.location());
+                localToAbsolute(origin);
+                r.setX(origin.x());
+                r.setY(origin.y());
                 rects.append(r);
             }
         }
@@ -286,7 +287,7 @@ void RenderText::absoluteQuadsForRange(Vector<FloatQuad>& quads, unsigned start,
         } else {
             unsigned realEnd = min(box->end() + 1, end);
             IntRect r = box->selectionRect(0, 0, start, realEnd);
-            if (!r.isEmpty()) {
+            if (r.height()) {
                 if (!useSelectionHeight) {
                     // change the height and y position because selectionRect uses selection-specific values
                     r.setHeight(box->height());
@@ -338,7 +339,7 @@ VisiblePosition RenderText::positionForPoint(const IntPoint& point)
         // at the y coordinate of the last line or below
         // and the x coordinate is to the right of the last text box right edge
         offset = lastTextBox()->offsetForPosition(point.x());
-        return createVisiblePosition(offset + lastTextBox()->start(), DOWNSTREAM);
+        return createVisiblePosition(offset + lastTextBox()->start(), VP_UPSTREAM_IF_POSSIBLE);
     }
 
     InlineTextBox* lastBoxAbove = 0;
@@ -435,8 +436,10 @@ ALWAYS_INLINE int RenderText::widthFromCache(const Font& f, int start, int len,
         int w = 0;
         bool isSpace;
         bool previousCharWasSpace = true; // FIXME: Preserves historical behavior, but seems wrong for start > 0.
+        ASSERT(m_text);
+        StringImpl& text = *m_text.impl();
         for (int i = start; i < start + len; i++) {
-            char c = (*m_text)[i];
+            char c = text[i];
             if (c <= ' ') {
                 if (c == ' ' || c == '\n') {
                     w += monospaceCharacterWidth;
@@ -479,7 +482,7 @@ void RenderText::trimmedPrefWidths(int leadWidth,
 
     int len = textLength();
 
-    if (!len || (stripFrontSpaces && m_text->containsOnlyWhitespace())) {
+    if (!len || (stripFrontSpaces && text()->containsOnlyWhitespace())) {
         beginMinW = 0;
         endMinW = 0;
         beginMaxW = 0;
@@ -499,7 +502,9 @@ void RenderText::trimmedPrefWidths(int leadWidth,
     hasBreakableChar = m_hasBreakableChar;
     hasBreak = m_hasBreak;
 
-    if ((*m_text)[0] == ' ' || ((*m_text)[0] == '\n' && !style()->preserveNewline()) || (*m_text)[0] == '\t') {
+    ASSERT(m_text);
+    StringImpl& text = *m_text.impl();
+    if (text[0] == ' ' || (text[0] == '\n' && !style()->preserveNewline()) || text[0] == '\t') {
         const Font& f = style()->font(); // FIXME: This ignores first-line.
         if (stripFrontSpaces) {
             const UChar space = ' ';
@@ -522,7 +527,7 @@ void RenderText::trimmedPrefWidths(int leadWidth,
         endMaxW = maxW;
         for (int i = 0; i < len; i++) {
             int linelen = 0;
-            while (i + linelen < len && (*m_text)[i + linelen] != '\n')
+            while (i + linelen < len && text[i + linelen] != '\n')
                 linelen++;
 
             if (linelen) {
@@ -757,11 +762,24 @@ void RenderText::calcPrefWidths(int leadWidth, HashSet<const SimpleFontData*>& f
     setPrefWidthsDirty(false);
 }
 
+bool RenderText::isAllCollapsibleWhitespace()
+{
+    int length = textLength();
+    const UChar* text = characters();
+    for (int i = 0; i < length; i++) {
+        if (!style()->isCollapsibleWhiteSpace(text[i]))
+            return false;
+    }
+    return true;
+}
+    
 bool RenderText::containsOnlyWhitespace(unsigned from, unsigned len) const
 {
+    ASSERT(m_text);
+    StringImpl& text = *m_text.impl();
     unsigned currPos;
     for (currPos = from;
-         currPos < from + len && ((*m_text)[currPos] == '\n' || (*m_text)[currPos] == ' ' || (*m_text)[currPos] == '\t');
+         currPos < from + len && (text[currPos] == '\n' || text[currPos] == ' ' || text[currPos] == '\t');
          currPos++) { }
     return currPos >= (from + len);
 }
@@ -813,7 +831,9 @@ void RenderText::setSelectionState(SelectionState state)
         }
     }
 
-    containingBlock()->setSelectionState(state);
+    // The returned value can be null in case of an orphaned tree.
+    if (RenderBlock* cb = containingBlock())
+        cb->setSelectionState(state);
 }
 
 void RenderText::setTextWithOffset(PassRefPtr<StringImpl> text, unsigned offset, unsigned len, bool force)
@@ -932,7 +952,7 @@ void RenderText::setTextInternal(PassRefPtr<StringImpl> text)
             // characters into space characters. Then, it will draw all space characters, including
             // leading, trailing and multiple contiguous space characters.
 
-            m_text = m_text->replace('\n', ' ');
+            m_text.replace('\n', ' ');
 
             // If xml:space="preserve" is set, white-space is set to "pre", which
             // preserves leading, trailing & contiguous space character for us.
@@ -943,13 +963,13 @@ void RenderText::setTextInternal(PassRefPtr<StringImpl> text)
             // Then, it will strip off all leading and trailing space characters.
             // Then, all contiguous space characters will be consolidated.    
 
-           m_text = m_text->replace('\n', StringImpl::empty());
+           m_text.replace('\n', StringImpl::empty());
 
            // If xml:space="default" is set, white-space is set to "nowrap", which handles
            // leading, trailing & contiguous space character removal for us.
         }
 
-        m_text = m_text->replace('\t', ' ');
+        m_text.replace('\t', ' ');
     }
 #endif
 
@@ -957,15 +977,14 @@ void RenderText::setTextInternal(PassRefPtr<StringImpl> text)
         switch (style()->textTransform()) {
             case TTNONE:
                 break;
-            case CAPITALIZE: {
-                m_text = m_text->capitalize(previousCharacter());
+            case CAPITALIZE:
+                m_text.makeCapitalized(previousCharacter());
                 break;
-            }
             case UPPERCASE:
-                m_text = m_text->upper();
+                m_text.makeUpper();
                 break;
             case LOWERCASE:
-                m_text = m_text->lower();
+                m_text.makeLower();
                 break;
         }
 
@@ -975,32 +994,36 @@ void RenderText::setTextInternal(PassRefPtr<StringImpl> text)
             case TSNONE:
                 break;
             case TSCIRCLE:
-                m_text = m_text->secure(whiteBullet);
+                m_text.makeSecure(whiteBullet);
                 break;
             case TSDISC:
-                m_text = m_text->secure(bullet);
+                m_text.makeSecure(bullet);
                 break;
             case TSSQUARE:
-                m_text = m_text->secure(blackSquare);
+                m_text.makeSecure(blackSquare);
         }
     }
 
     ASSERT(m_text);
-    ASSERT(!isBR() || (textLength() == 1 && (*m_text)[0] == '\n'));
+    ASSERT(!isBR() || (textLength() == 1 && m_text[0] == '\n'));
 
-    m_isAllASCII = charactersAreAllASCII(m_text.get());
+    m_isAllASCII = m_text.containsOnlyASCII();
 }
 
 void RenderText::setText(PassRefPtr<StringImpl> text, bool force)
 {
     ASSERT(text);
 
-    if (!force && equal(m_text.get(), text.get()))
+    if (!force && equal(m_text.impl(), text.get()))
         return;
 
     setTextInternal(text);
     setNeedsLayoutAndPrefWidthsRecalc();
     m_knownNotToUseFallbackFonts = false;
+    
+    AXObjectCache* axObjectCache = document()->axObjectCache();
+    if (axObjectCache->accessibilityEnabled())
+        axObjectCache->contentChanged(this);
 }
 
 int RenderText::lineHeight(bool firstLine, bool) const
@@ -1031,8 +1054,8 @@ InlineTextBox* RenderText::createInlineTextBox()
     if (!m_firstTextBox)
         m_firstTextBox = m_lastTextBox = textBox;
     else {
-        m_lastTextBox->setNextLineBox(textBox);
-        textBox->setPreviousLineBox(m_lastTextBox);
+        m_lastTextBox->setNextTextBox(textBox);
+        textBox->setPreviousTextBox(m_lastTextBox);
         m_lastTextBox = textBox;
     }
     textBox->setIsText(true);
@@ -1050,11 +1073,11 @@ void RenderText::positionLineBox(InlineBox* box)
         if (m_firstTextBox == s)
             m_firstTextBox = s->nextTextBox();
         else
-            s->prevTextBox()->setNextLineBox(s->nextTextBox());
+            s->prevTextBox()->setNextTextBox(s->nextTextBox());
         if (m_lastTextBox == s)
             m_lastTextBox = s->prevTextBox();
         else
-            s->nextTextBox()->setPreviousLineBox(s->prevTextBox());
+            s->nextTextBox()->setPreviousTextBox(s->prevTextBox());
         s->destroy(renderArena());
         return;
     }
@@ -1158,9 +1181,25 @@ IntRect RenderText::selectionRectForRepaint(RenderBoxModelObject* repaintContain
         return IntRect();
 
     IntRect rect;
-    for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox())
+    for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
         rect.unite(box->selectionRect(0, 0, startPos, endPos));
 
+        // Check if there are ellipsis which fall within the selection.
+        unsigned short truncation = box->truncation();
+        if (truncation != cNoTruncation) {
+            if (EllipsisBox* ellipsis = box->root()->ellipsisBox()) {
+                int ePos = min<int>(endPos - box->start(), box->len());
+                int sPos = max<int>(startPos - box->start(), 0);
+                // The ellipsis should be considered to be selected if the end of
+                // the selection is past the beginning of the truncation and the
+                // beginning of the selection is before or at the beginning of the
+                // truncation.
+                if (ePos >= truncation && sPos <= truncation)
+                    rect.unite(ellipsis->selectionRect(0, 0));
+            }
+        }
+    }
+
     if (clipToVisibleContent)
         computeRectForRepaint(repaintContainer, rect);
     else {
@@ -1205,7 +1244,7 @@ unsigned RenderText::caretMaxRenderedOffset() const
 
 int RenderText::previousOffset(int current) const
 {
-    StringImpl* si = m_text.get();
+    StringImpl* si = m_text.impl();
     TextBreakIterator* iterator = cursorMovementIterator(si->characters(), si->length());
     if (!iterator)
         return current - 1;
@@ -1253,14 +1292,16 @@ inline bool isHangulLVT(UChar32 character)
 int RenderText::previousOffsetForBackwardDeletion(int current) const
 {
 #if PLATFORM(MAC)
+    ASSERT(m_text);
+    StringImpl& text = *m_text.impl();
     UChar32 character;
     while (current > 0) {
-        if (U16_IS_TRAIL((*m_text)[--current]))
+        if (U16_IS_TRAIL(text[--current]))
             --current;
         if (current < 0)
             break;
 
-        UChar32 character = m_text->characterStartingAt(current);
+        UChar32 character = text.characterStartingAt(current);
 
         // We don't combine characters in Armenian ... Limbu range for backward deletion.
         if ((character >= 0x0530) && (character < 0x1950))
@@ -1274,7 +1315,7 @@ int RenderText::previousOffsetForBackwardDeletion(int current) const
         return current;
 
     // Hangul
-    character = m_text->characterStartingAt(current);
+    character = text.characterStartingAt(current);
     if (((character >= HANGUL_CHOSEONG_START) && (character <= HANGUL_JONGSEONG_END)) || ((character >= HANGUL_SYLLABLE_START) && (character <= HANGUL_SYLLABLE_END))) {
         HangulState state;
         HangulState initialState;
@@ -1290,7 +1331,7 @@ int RenderText::previousOffsetForBackwardDeletion(int current) const
 
         initialState = state;
 
-        while (current > 0 && ((character = m_text->characterStartingAt(current - 1)) >= HANGUL_CHOSEONG_START) && (character <= HANGUL_SYLLABLE_END) && ((character <= HANGUL_JONGSEONG_END) || (character >= HANGUL_SYLLABLE_START))) {
+        while (current > 0 && ((character = text.characterStartingAt(current - 1)) >= HANGUL_CHOSEONG_START) && (character <= HANGUL_SYLLABLE_END) && ((character <= HANGUL_JONGSEONG_END) || (character >= HANGUL_SYLLABLE_START))) {
             switch (state) {
             case HangulStateV:
                 if (character <= HANGUL_CHOSEONG_END)
@@ -1328,7 +1369,7 @@ int RenderText::previousOffsetForBackwardDeletion(int current) const
 
 int RenderText::nextOffset(int current) const
 {
-    StringImpl* si = m_text.get();
+    StringImpl* si = m_text.impl();
     TextBreakIterator* iterator = cursorMovementIterator(si->characters(), si->length());
     if (!iterator)
         return current + 1;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderText.h b/src/3rdparty/webkit/WebCore/rendering/RenderText.h
index 915ff40acb..e9ed147a4d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderText.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderText.h
@@ -50,7 +50,7 @@ public:
 
     virtual void destroy();
 
-    StringImpl* text() const { return m_text.get(); }
+    StringImpl* text() const { return m_text.impl(); }
 
     InlineTextBox* createInlineTextBox();
     void dirtyLineBoxes(bool fullLayout);
@@ -63,8 +63,8 @@ public:
 
     virtual VisiblePosition positionForPoint(const IntPoint&);
 
-    const UChar* characters() const { return m_text->characters(); }
-    unsigned textLength() const { return m_text->length(); } // non virtual implementation of length()
+    const UChar* characters() const { return m_text.characters(); }
+    unsigned textLength() const { return m_text.length(); } // non virtual implementation of length()
     void positionLineBox(InlineBox*);
 
     virtual unsigned width(unsigned from, unsigned len, const Font&, int xPos, HashSet<const SimpleFontData*>* fallbackFonts = 0) const;
@@ -121,7 +121,8 @@ public:
     void checkConsistency() const;
 
     virtual void calcPrefWidths(int leadWidth);
-
+    bool isAllCollapsibleWhitespace();
+    
 protected:
     virtual void styleWillChange(StyleDifference, const RenderStyle*) { }
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
@@ -150,7 +151,7 @@ private:
 
     int m_minWidth; // here to minimize padding in 64-bit.
 
-    RefPtr<StringImpl> m_text;
+    String m_text;
 
     InlineTextBox* m_firstTextBox;
     InlineTextBox* m_lastTextBox;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp
index f430399568..b98900a223 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp
@@ -70,8 +70,8 @@ static Color disabledTextColor(const Color& textColor, const Color& backgroundCo
 RenderTextControl::RenderTextControl(Node* node, bool placeholderVisible)
     : RenderBlock(node)
     , m_placeholderVisible(placeholderVisible)
-    , m_edited(false)
-    , m_userEdited(false)
+    , m_wasChangedSinceLastChangeEvent(false)
+    , m_lastChangeWasUserEdit(false)
 {
 }
 
@@ -195,17 +195,17 @@ void RenderTextControl::setInnerTextValue(const String& innerTextValue)
             ASSERT(!ec);
         }
 
-        m_edited = false;
-        m_userEdited = false;
+        // We set m_lastChangeWasUserEdit to false since this change was not explicitly made by the user (say, via typing on the keyboard), see <rdar://problem/5359921>.
+        m_lastChangeWasUserEdit = false;
     }
 
     static_cast<Element*>(node())->setFormControlValueMatchesRenderer(true);
 }
 
-void RenderTextControl::setUserEdited(bool isUserEdited)
+void RenderTextControl::setLastChangeWasUserEdit(bool lastChangeWasUserEdit)
 {
-    m_userEdited = isUserEdited;
-    document()->setIgnoreAutofocus(isUserEdited);
+    m_lastChangeWasUserEdit = lastChangeWasUserEdit;
+    document()->setIgnoreAutofocus(lastChangeWasUserEdit);
 }
 
 int RenderTextControl::selectionStart()
@@ -266,11 +266,6 @@ void RenderTextControl::setSelectionRange(int start, int end)
 
     if (Frame* frame = document()->frame())
         frame->selection()->setSelection(newSelection);
-
-    // FIXME: Granularity is stored separately on the frame, but also in the selection controller.
-    // The granularity in the selection controller should be used, and then this line of code would not be needed.
-    if (Frame* frame = document()->frame())
-        frame->setSelectionGranularity(CharacterGranularity);
 }
 
 VisibleSelection RenderTextControl::selection(int start, int end) const
@@ -312,8 +307,8 @@ int RenderTextControl::indexForVisiblePosition(const VisiblePosition& pos)
 
 void RenderTextControl::subtreeHasChanged()
 {
-    m_edited = true;
-    m_userEdited = true;
+    m_wasChangedSinceLastChangeEvent = true;
+    m_lastChangeWasUserEdit = true;
 }
 
 String RenderTextControl::finishText(Vector<UChar>& result) const
@@ -459,6 +454,78 @@ IntRect RenderTextControl::controlClipRect(int tx, int ty) const
     return clipRect;
 }
 
+static const char* fontFamiliesWithInvalidCharWidth[] = {
+    "American Typewriter",
+    "Arial Hebrew",
+    "Chalkboard",
+    "Cochin",
+    "Corsiva Hebrew",
+    "Courier",
+    "Euphemia UCAS",
+    "Geneva",
+    "Gill Sans",
+    "Hei",
+    "Helvetica",
+    "Hoefler Text",
+    "InaiMathi",
+    "Kai",
+    "Lucida Grande",
+    "Marker Felt",
+    "Monaco",
+    "Mshtakan",
+    "New Peninim MT",
+    "Osaka",
+    "Raanana",
+    "STHeiti",
+    "Symbol",
+    "Times",
+    "Apple Braille",
+    "Apple LiGothic",
+    "Apple LiSung",
+    "Apple Symbols",
+    "AppleGothic",
+    "AppleMyungjo",
+    "#GungSeo",
+    "#HeadLineA",
+    "#PCMyungjo",
+    "#PilGi",
+};
+
+// For font families where any of the fonts don't have a valid entry in the OS/2 table
+// for avgCharWidth, fallback to the legacy webkit behavior of getting the avgCharWidth
+// from the width of a '0'. This only seems to apply to a fixed number of Mac fonts,
+// but, in order to get similar rendering across platforms, we do this check for
+// all platforms.
+bool RenderTextControl::hasValidAvgCharWidth(AtomicString family)
+{
+    static HashSet<AtomicString>* fontFamiliesWithInvalidCharWidthMap = 0;
+    
+    if (!fontFamiliesWithInvalidCharWidthMap) {
+        fontFamiliesWithInvalidCharWidthMap = new HashSet<AtomicString>;
+        
+        for (unsigned i = 0; i < sizeof(fontFamiliesWithInvalidCharWidth) / sizeof(fontFamiliesWithInvalidCharWidth[0]); i++)
+            fontFamiliesWithInvalidCharWidthMap->add(AtomicString(fontFamiliesWithInvalidCharWidth[i]));
+    }
+
+    return !fontFamiliesWithInvalidCharWidthMap->contains(family);
+}
+
+float RenderTextControl::getAvgCharWidth(AtomicString family)
+{
+    if (hasValidAvgCharWidth(family))
+        return roundf(style()->font().primaryFont()->avgCharWidth());
+
+    const UChar ch = '0'; 
+    return style()->font().floatWidth(TextRun(&ch, 1, false, 0, 0, false, false, false));
+}
+
+float RenderTextControl::scaleEmToUnits(int x) const
+{
+    // This matches the unitsPerEm value for MS Shell Dlg and Courier New from the "head" font table.
+    float unitsPerEm = 2048.0f;
+    return roundf(style()->font().size() * x / unitsPerEm);
+}
+
 void RenderTextControl::calcPrefWidths()
 {
     ASSERT(prefWidthsDirty());
@@ -470,8 +537,8 @@ void RenderTextControl::calcPrefWidths()
         m_minPrefWidth = m_maxPrefWidth = calcContentBoxWidth(style()->width().value());
     else {
         // Use average character width. Matches IE.
-        float charWidth = style()->font().primaryFont()->avgCharWidth();
-        m_maxPrefWidth = preferredContentWidth(charWidth) + m_innerText->renderBox()->paddingLeft() + m_innerText->renderBox()->paddingRight();
+        AtomicString family = style()->font().family().family();
+        m_maxPrefWidth = preferredContentWidth(getAvgCharWidth(family)) + m_innerText->renderBox()->paddingLeft() + m_innerText->renderBox()->paddingRight();
     }
 
     if (style()->minWidth().isFixed() && style()->minWidth().value() > 0) {
@@ -505,9 +572,10 @@ void RenderTextControl::selectionChanged(bool userTriggered)
     }
 }
 
-void RenderTextControl::addFocusRingRects(GraphicsContext* graphicsContext, int tx, int ty)
+void RenderTextControl::addFocusRingRects(Vector<IntRect>& rects, int tx, int ty)
 {
-    graphicsContext->addFocusRingRect(IntRect(tx, ty, width(), height()));
+    if (width() && height())
+        rects.append(IntRect(tx, ty, width(), height()));
 }
 
 HTMLElement* RenderTextControl::innerTextElement() const
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h
index cdd8716d63..2fc8edca47 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h
@@ -34,11 +34,11 @@ class RenderTextControl : public RenderBlock {
 public:
     virtual ~RenderTextControl();
 
-    bool isEdited() const { return m_edited; }
-    void setEdited(bool isEdited) { m_edited = isEdited; }
+    bool wasChangedSinceLastChangeEvent() const { return m_wasChangedSinceLastChangeEvent; }
+    void setChangedSinceLastChangeEvent(bool wasChangedSinceLastChangeEvent) { m_wasChangedSinceLastChangeEvent = wasChangedSinceLastChangeEvent; }
 
-    bool isUserEdited() const { return m_userEdited; }
-    void setUserEdited(bool isUserEdited);
+    bool lastChangeWasUserEdit() const { return m_lastChangeWasUserEdit; }
+    void setLastChangeWasUserEdit(bool lastChangeWasUserEdit);
 
     int selectionStart();
     int selectionEnd();
@@ -74,6 +74,10 @@ protected:
     int textBlockWidth() const;
     int textBlockHeight() const;
 
+    float scaleEmToUnits(int x) const;
+
+    static bool hasValidAvgCharWidth(AtomicString family);
+    virtual float getAvgCharWidth(AtomicString family);
     virtual int preferredContentWidth(float charWidth) const = 0;
     virtual void adjustControlHeightBasedOnLineHeight(int lineHeight) = 0;
     virtual void cacheSelection(int start, int end) = 0;
@@ -99,14 +103,14 @@ private:
     virtual bool avoidsFloats() const { return true; }
     void setInnerTextStyle(PassRefPtr<RenderStyle>);
     
-    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
+    virtual void addFocusRingRects(Vector<IntRect>&, int tx, int ty);
 
     virtual bool canBeProgramaticallyScrolled(bool) const { return true; }
 
     String finishText(Vector<UChar>&) const;
 
-    bool m_edited;
-    bool m_userEdited;
+    bool m_wasChangedSinceLastChangeEvent;
+    bool m_lastChangeWasUserEdit;
     RefPtr<TextControlInnerTextElement> m_innerText;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
index a49e092b1b..af422538ac 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -47,7 +47,7 @@ void RenderTextControlMultiLine::subtreeHasChanged()
     RenderTextControl::subtreeHasChanged();
     HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(node());
     textArea->setFormControlValueMatchesRenderer(false);
-    textArea->updateValidity();
+    textArea->setNeedsValidityCheck();
 
     if (!node()->focused())
         return;
@@ -64,8 +64,8 @@ bool RenderTextControlMultiLine::nodeAtPoint(const HitTestRequest& request, HitT
         return false;
 
     bool resultIsTextValueOrPlaceholder
-        = !m_placeholderVisible && result.innerNode() == innerTextElement()
-        || m_placeholderVisible && result.innerNode()->isDescendantOf(innerTextElement());
+        = (!m_placeholderVisible && result.innerNode() == innerTextElement())
+        || (m_placeholderVisible && result.innerNode()->isDescendantOf(innerTextElement()));
     if (result.innerNode() == node() || resultIsTextValueOrPlaceholder)
         hitInnerTextElement(result, x, y, tx, ty);
 
@@ -77,6 +77,17 @@ void RenderTextControlMultiLine::forwardEvent(Event* event)
     RenderTextControl::forwardEvent(event);
 }
 
+float RenderTextControlMultiLine::getAvgCharWidth(AtomicString family)
+{
+    // Since Lucida Grande is the default font, we want this to match the width
+    // of Courier New, the default font for textareas in IE, Firefox and Safari Win.
+    // 1229 is the avgCharWidth value in the OS/2 table for Courier New.
+    if (family == AtomicString("Lucida Grande"))
+        return scaleEmToUnits(1229);
+
+    return RenderTextControl::getAvgCharWidth(family);
+}
+
 int RenderTextControlMultiLine::preferredContentWidth(float charWidth) const
 {
     int factor = static_cast<HTMLTextAreaElement*>(node())->cols();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h
index 3371a8f1a0..fbca308145 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h
@@ -40,6 +40,7 @@ private:
 
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
+    virtual float getAvgCharWidth(AtomicString family);
     virtual int preferredContentWidth(float charWidth) const;
     virtual void adjustControlHeightBasedOnLineHeight(int lineHeight);
     virtual int baselinePosition(bool firstLine, bool isRootLineBox) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
index be800a7310..a762ac5499 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -150,7 +150,7 @@ void RenderTextControlSingleLine::hidePopup()
 
 void RenderTextControlSingleLine::subtreeHasChanged()
 {
-    bool wasEdited = isEdited();
+    bool wasChanged = wasChangedSinceLastChangeEvent();
     RenderTextControl::subtreeHasChanged();
 
     InputElement* input = inputElement();
@@ -167,7 +167,7 @@ void RenderTextControlSingleLine::subtreeHasChanged()
     if (input->searchEventsShouldBeDispatched())
         startSearchEventTimer();
 
-    if (!wasEdited && node()->focused()) {
+    if (!wasChanged && node()->focused()) {
         if (Frame* frame = document()->frame())
             frame->textFieldDidBeginEditing(static_cast<Element*>(node()));
     }
@@ -374,7 +374,19 @@ int RenderTextControlSingleLine::textBlockWidth() const
 
     return width;
 }
+    
+float RenderTextControlSingleLine::getAvgCharWidth(AtomicString family)
+{
+    // Since Lucida Grande is the default font, we want this to match the width
+    // of MS Shell Dlg, the default font for textareas in Firefox, Safari Win and
+    // IE for some encodings (in IE, the default font is encoding specific).
+    // 901 is the avgCharWidth value in the OS/2 table for MS Shell Dlg.
+    if (family == AtomicString("Lucida Grande"))
+        return scaleEmToUnits(901);
 
+    return RenderTextControl::getAvgCharWidth(family);
+}
+    
 int RenderTextControlSingleLine::preferredContentWidth(float charWidth) const
 {
     int factor = inputElement()->size();
@@ -383,8 +395,20 @@ int RenderTextControlSingleLine::preferredContentWidth(float charWidth) const
 
     int result = static_cast<int>(ceilf(charWidth * factor));
 
+    float maxCharWidth = 0.f;
+    AtomicString family = style()->font().family().family();
+    // Since Lucida Grande is the default font, we want this to match the width
+    // of MS Shell Dlg, the default font for textareas in Firefox, Safari Win and
+    // IE for some encodings (in IE, the default font is encoding specific).
+    // 4027 is the (xMax - xMin) value in the "head" font table for MS Shell Dlg.
+    if (family == AtomicString("Lucida Grande"))
+        maxCharWidth = scaleEmToUnits(4027);
+    else if (hasValidAvgCharWidth(family))
+        maxCharWidth = roundf(style()->font().primaryFont()->maxCharWidth());
+
     // For text inputs, IE adds some extra width.
-    result += style()->font().primaryFont()->maxCharWidth() - charWidth;
+    if (maxCharWidth > 0.f)
+        result += maxCharWidth - charWidth;
 
     if (RenderBox* resultsRenderer = m_resultsButton ? m_resultsButton->renderBox() : 0)
         result += resultsRenderer->borderLeft() + resultsRenderer->borderRight() +
@@ -461,8 +485,12 @@ void RenderTextControlSingleLine::updateFromElement()
         ExceptionCode ec = 0;
         innerTextElement()->setInnerText(static_cast<Element*>(node())->getAttribute(placeholderAttr), ec);
         ASSERT(!ec);
-    } else
-        setInnerTextValue(inputElement()->value());
+    } else {
+        if (!inputElement()->suggestedValue().isNull())
+            setInnerTextValue(inputElement()->suggestedValue());
+        else
+            setInnerTextValue(inputElement()->value());
+    }
 
     if (m_searchPopupIsVisible)
         m_searchPopup->updateFromElement();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
index e30ff0d3d1..e1bcc84568 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
@@ -75,6 +75,7 @@ private:
     virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f, Node** stopNode = 0);
 
     int textBlockWidth() const;
+    virtual float getAvgCharWidth(AtomicString family);
     virtual int preferredContentWidth(float charWidth) const;
     virtual void adjustControlHeightBasedOnLineHeight(int lineHeight);
 
@@ -100,6 +101,7 @@ private:
     virtual void valueChanged(unsigned listIndex, bool fireEvents = true);
     virtual String itemText(unsigned listIndex) const;
     virtual String itemToolTip(unsigned) const { return String(); }
+    virtual String itemAccessibilityText(unsigned) const { return String(); }
     virtual bool itemIsEnabled(unsigned listIndex) const;
     virtual PopupMenuStyle itemStyle(unsigned listIndex) const;
     virtual PopupMenuStyle menuStyle() const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp
index 9ff110649e..f3398a3e35 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp
@@ -69,6 +69,10 @@ void RenderTextFragment::setTextInternal(PassRefPtr<StringImpl> text)
         m_firstLetter = 0;
         m_start = 0;
         m_end = textLength();
+        if (Node* t = node()) {
+            ASSERT(!t->renderer());
+            t->setRenderer(this);
+        }
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
index 5ee01e445a..7c284a6ced 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
@@ -1,7 +1,7 @@
 /**
  * This file is part of the theme implementation for form controls in WebCore.
  *
- * Copyright (C) 2005, 2006, 2007, 2008 Apple Computer, Inc.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -87,6 +87,8 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
     switch (part) {
         case ListButtonPart:
         case CheckboxPart:
+        case InnerSpinButtonPart:
+        case OuterSpinButtonPart:
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
@@ -176,6 +178,10 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
         case DefaultButtonPart:
         case ButtonPart:
             return adjustButtonStyle(selector, style, e);
+        case InnerSpinButtonPart:
+            return adjustInnerSpinButtonStyle(selector, style, e);
+        case OuterSpinButtonPart:
+            return adjustOuterSpinButtonStyle(selector, style, e);
 #endif
         case TextFieldPart:
             return adjustTextFieldStyle(selector, style, e);
@@ -203,6 +209,10 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
             return adjustSearchFieldResultsDecorationStyle(selector, style, e);
         case SearchFieldResultsButtonPart:
             return adjustSearchFieldResultsButtonStyle(selector, style, e);
+#if ENABLE(PROGRESS_TAG)
+        case ProgressBarPart:
+            return adjustProgressBarStyle(selector, style, e);
+#endif
         default:
             break;
     }
@@ -232,6 +242,8 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
         case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
+        case InnerSpinButtonPart:
+        case OuterSpinButtonPart:
             m_theme->paint(part, controlStatesForRenderer(o), const_cast<GraphicsContext*>(paintInfo.context), r, o->style()->effectiveZoom(), o->view()->frameView());
             return false;
         default:
@@ -252,9 +264,17 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
         case DefaultButtonPart:
         case ButtonPart:
             return paintButton(o, paintInfo, r);
+        case InnerSpinButtonPart:
+            return paintInnerSpinButton(o, paintInfo, r);
+        case OuterSpinButtonPart:
+            return paintOuterSpinButton(o, paintInfo, r);
 #endif
         case MenulistPart:
             return paintMenuList(o, paintInfo, r);
+#if ENABLE(PROGRESS_TAG)
+        case ProgressBarPart:
+            return paintProgressBar(o, paintInfo, r);
+#endif
         case SliderHorizontalPart:
         case SliderVerticalPart:
             return paintSliderTrack(o, paintInfo, r);
@@ -278,6 +298,8 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
             return paintMediaRewindButton(o, paintInfo, r);
         case MediaReturnToRealtimeButtonPart:
             return paintMediaReturnToRealtimeButton(o, paintInfo, r);
+        case MediaToggleClosedCaptionsButtonPart:
+            return paintMediaToggleClosedCaptionsButton(o, paintInfo, r);
         case MediaSliderPart:
             return paintMediaSliderTrack(o, paintInfo, r);
         case MediaSliderThumbPart:
@@ -343,6 +365,9 @@ bool RenderTheme::paintBorderOnly(RenderObject* o, const RenderObject::PaintInfo
         case DefaultButtonPart:
         case ButtonPart:
         case MenulistPart:
+#if ENABLE(PROGRESS_TAG)
+        case ProgressBarPart:
+#endif
         case SliderHorizontalPart:
         case SliderVerticalPart:
         case SliderThumbHorizontalPart:
@@ -378,6 +403,9 @@ bool RenderTheme::paintDecorations(RenderObject* o, const RenderObject::PaintInf
         case DefaultButtonPart:
         case ButtonPart:
         case MenulistPart:
+#if ENABLE(PROGRESS_TAG)
+        case ProgressBarPart:
+#endif
         case SliderHorizontalPart:
         case SliderVerticalPart:
         case SliderThumbHorizontalPart:
@@ -416,10 +444,41 @@ bool RenderTheme::shouldRenderMediaControlPart(ControlPart part, Element* e)
         return mediaElement->movieLoadType() == MediaPlayer::LiveStream;
     case MediaFullscreenButtonPart:
         return mediaElement->supportsFullscreen();
+    case MediaToggleClosedCaptionsButtonPart:
+        return mediaElement->hasClosedCaptions();
     default:
         return true;
     }
 }
+
+String RenderTheme::formatMediaControlsTime(float time) const
+{
+    if (!isfinite(time))
+        time = 0;
+    int seconds = (int)fabsf(time);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+    if (hours) {
+        if (hours > 9)
+            return String::format("%s%02d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
+
+        return String::format("%s%01d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
+    }
+
+    return String::format("%s%02d:%02d", (time < 0 ? "-" : ""), minutes, seconds);
+}
+
+String RenderTheme::formatMediaControlsCurrentTime(float currentTime, float /*duration*/) const
+{
+    return formatMediaControlsTime(currentTime);
+}
+
+String RenderTheme::formatMediaControlsRemainingTime(float currentTime, float duration) const
+{
+    return formatMediaControlsTime(currentTime - duration);
+}
+
 #endif
 
 Color RenderTheme::activeSelectionBackgroundColor() const
@@ -581,7 +640,7 @@ bool RenderTheme::supportsFocusRing(const RenderStyle* style) const
 
 bool RenderTheme::stateChanged(RenderObject* o, ControlState state) const
 {
-    // Default implementation assumes the controls dont respond to changes in :hover state
+    // Default implementation assumes the controls don't respond to changes in :hover state
     if (state == HoverState && !supportsHover(o->style()))
         return false;
 
@@ -701,6 +760,10 @@ bool RenderTheme::isHovered(const RenderObject* o) const
 
 bool RenderTheme::isDefault(const RenderObject* o) const
 {
+    // A button should only have the default appearance if the page is active
+    if (!isActive(o))
+        return false;
+
     if (!o->document())
         return false;
 
@@ -754,6 +817,14 @@ void RenderTheme::adjustButtonStyle(CSSStyleSelector*, RenderStyle* style, Eleme
     setButtonSize(style);
 }
 
+void RenderTheme::adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const
+{
+}
+
+void RenderTheme::adjustOuterSpinButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const
+{
+}
+
 #endif
 
 void RenderTheme::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const
@@ -768,6 +839,18 @@ void RenderTheme::adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*)
 {
 }
 
+#if ENABLE(PROGRESS_TAG)
+bool RenderTheme::getNumberOfPixelsForProgressPosition(double , int& progressSize) const
+{
+    progressSize = 0;
+    return false;
+}
+
+void RenderTheme::adjustProgressBarStyle(CSSStyleSelector*, RenderStyle*, Element*) const
+{
+}
+#endif
+
 void RenderTheme::adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h
index 1b6a7e44e5..fbdf91030d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h
@@ -169,10 +169,22 @@ public:
     // Method for painting the caps lock indicator
     virtual bool paintCapsLockIndicator(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return 0; };
 
+#if ENABLE(PROGRESS_TAG)
+    // Helper method for optimizing the paint area of the progress bar.
+    // If supported, it returns number of pixels needed to draw the progress bar up to the progress position.
+    // progressSize is the value that is passed back to RenderTheme during drawing.
+    virtual bool getNumberOfPixelsForProgressPosition(double position, int& progressSize) const;
+#endif
+
 #if ENABLE(VIDEO)
     // Media controls
     virtual bool hitTestMediaControlPart(RenderObject*, const IntPoint& absPoint);
     virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
+    virtual double mediaControlsFadeInDuration() { return 0.1; }
+    virtual double mediaControlsFadeOutDuration() { return 0.3; }
+    virtual String formatMediaControlsTime(float time) const;
+    virtual String formatMediaControlsCurrentTime(float currentTime, float duration) const;
+    virtual String formatMediaControlsRemainingTime(float currentTime, float duration) const;
 #endif
 
 protected:
@@ -203,6 +215,11 @@ protected:
     virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
     virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual void setButtonSize(RenderStyle*) const { }
+
+    virtual void adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintInnerSpinButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual void adjustOuterSpinButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintOuterSpinButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
 #endif
 
     virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
@@ -217,6 +234,11 @@ protected:
     virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
     virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
 
+#if ENABLE(PROGRESS_TAG)
+    virtual void adjustProgressBarStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintProgressBar(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+#endif
+
     virtual void adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
     virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
 
@@ -250,6 +272,7 @@ protected:
     virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaRewindButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaReturnToRealtimeButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaToggleClosedCaptionsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaCurrentTime(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaTimeRemaining(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.cpp
index 9048ce38e2..13c9cd62ad 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.cpp
@@ -25,13 +25,27 @@
 #include "config.h"
 #include "RenderThemeChromiumLinux.h"
 
-#include "Color.h"
 #include "CSSValueKeywords.h"
+#include "Color.h"
 #include "RenderObject.h"
 #include "UserAgentStyleSheets.h"
 
 namespace WebCore {
 
+unsigned RenderThemeChromiumLinux::m_thumbInactiveColor = 0xf0ebe5;
+unsigned RenderThemeChromiumLinux::m_thumbActiveColor = 0xfaf8f5;
+unsigned RenderThemeChromiumLinux::m_trackColor = 0xe3ddd8;
+unsigned RenderThemeChromiumLinux::m_activeSelectionBackgroundColor =
+    0xff1e90ff;
+unsigned RenderThemeChromiumLinux::m_activeSelectionForegroundColor =
+    Color::black;
+unsigned RenderThemeChromiumLinux::m_inactiveSelectionBackgroundColor =
+    0xffc8c8c8;
+unsigned RenderThemeChromiumLinux::m_inactiveSelectionForegroundColor =
+    0xff323232;
+
+double RenderThemeChromiumLinux::m_caretBlinkInterval;
+
 PassRefPtr<RenderTheme> RenderThemeChromiumLinux::create()
 {
     return adoptRef(new RenderThemeChromiumLinux());
@@ -92,6 +106,26 @@ Color RenderThemeChromiumLinux::inactiveListBoxSelectionForegroundColor() const
     return Color(0x32, 0x32, 0x32);
 }
 
+Color RenderThemeChromiumLinux::platformActiveSelectionBackgroundColor() const
+{
+    return m_activeSelectionBackgroundColor;
+}
+
+Color RenderThemeChromiumLinux::platformInactiveSelectionBackgroundColor() const
+{
+    return m_inactiveSelectionBackgroundColor;
+}
+
+Color RenderThemeChromiumLinux::platformActiveSelectionForegroundColor() const
+{
+    return m_activeSelectionForegroundColor;
+}
+
+Color RenderThemeChromiumLinux::platformInactiveSelectionForegroundColor() const
+{
+    return m_inactiveSelectionForegroundColor;
+}
+
 void RenderThemeChromiumLinux::adjustSliderThumbSize(RenderObject* o) const
 {
     // These sizes match the sizes in Chromium Win.
@@ -122,4 +156,24 @@ double RenderThemeChromiumLinux::caretBlinkIntervalInternal() const
     return m_caretBlinkInterval;
 }
 
+void RenderThemeChromiumLinux::setSelectionColors(
+    unsigned activeBackgroundColor,
+    unsigned activeForegroundColor,
+    unsigned inactiveBackgroundColor,
+    unsigned inactiveForegroundColor)
+{
+    m_activeSelectionBackgroundColor = activeBackgroundColor;
+    m_activeSelectionForegroundColor = activeForegroundColor;
+    m_inactiveSelectionBackgroundColor = inactiveBackgroundColor;
+    m_inactiveSelectionForegroundColor = inactiveForegroundColor;
+}
+
+void RenderThemeChromiumLinux::setScrollbarColors(
+    SkColor inactiveColor, SkColor activeColor, SkColor trackColor)
+{
+    m_thumbInactiveColor = inactiveColor;
+    m_thumbActiveColor = activeColor;
+    m_trackColor = trackColor;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.h
index e137ad598e..c60dec3266 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.h
@@ -49,11 +49,28 @@ namespace WebCore {
         virtual Color inactiveListBoxSelectionBackgroundColor() const;
         virtual Color inactiveListBoxSelectionForegroundColor() const;
 
+        virtual Color platformActiveSelectionBackgroundColor() const;
+        virtual Color platformInactiveSelectionBackgroundColor() const;
+        virtual Color platformActiveSelectionForegroundColor() const;
+        virtual Color platformInactiveSelectionForegroundColor() const;
+
         virtual void adjustSliderThumbSize(RenderObject*) const;
 
-        void setCaretBlinkInterval(double interval);
+        static void setCaretBlinkInterval(double interval);
         virtual double caretBlinkIntervalInternal() const;
 
+        static void setSelectionColors(unsigned activeBackgroundColor,
+                                       unsigned activeForegroundColor,
+                                       unsigned inactiveBackgroundColor,
+                                       unsigned inactiveForegroundColor);
+
+        static void setScrollbarColors(unsigned inactive_color,
+                                       unsigned active_color,
+                                       unsigned track_color);
+        static unsigned thumbInactiveColor() { return m_thumbInactiveColor; }
+        static unsigned thumbActiveColor() { return m_thumbActiveColor; }
+        static unsigned trackColor() { return m_trackColor; }
+
     private:
         RenderThemeChromiumLinux();
         virtual ~RenderThemeChromiumLinux();
@@ -61,7 +78,16 @@ namespace WebCore {
         // A general method asking if any control tinting is supported at all.
         virtual bool supportsControlTints() const;
 
-        double m_caretBlinkInterval;
+        static double m_caretBlinkInterval;
+
+        static unsigned m_activeSelectionBackgroundColor;
+        static unsigned m_activeSelectionForegroundColor;
+        static unsigned m_inactiveSelectionBackgroundColor;
+        static unsigned m_inactiveSelectionForegroundColor;
+
+        static unsigned m_thumbInactiveColor;
+        static unsigned m_thumbActiveColor;
+        static unsigned m_trackColor;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
index 61b5e8f39c..81010382fb 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
@@ -191,7 +191,6 @@ private:
     mutable HashMap<int, RGBA32> m_systemColorCache;
 
     RetainPtr<WebCoreRenderThemeNotificationObserver> m_notificationObserver;
-    bool paintMediaButtonInternal(GraphicsContext*, const IntRect&, Image*);
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
index bcfcd577c6..03aab1cb5b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -41,7 +41,7 @@
 #import "RenderSlider.h"
 #import "RenderView.h"
 #import "SharedBuffer.h"
-#import "UserAgentStyleSheets.h"
+#import "TimeRanges.h"
 #import "WebCoreSystemInterface.h"
 #import "UserAgentStyleSheets.h"
 #import <Carbon/Carbon.h>
@@ -78,7 +78,7 @@ using std::min;
 
 // The methods in this file are specific to the Mac OS X platform.
 
-// FIXME: The platform-independent code in this class should be factored out and merged with RenderThemeSafari. 
+// FIXME: The platform-independent code in this class should be factored out and merged with RenderThemeSafari.
 
 @interface WebCoreRenderThemeNotificationObserver : NSObject
 {
@@ -96,7 +96,7 @@ using std::min;
 {
     [super init];
     _theme = theme;
-    
+
     return self;
 }
 
@@ -322,7 +322,7 @@ static RGBA32 convertNSColorToColor(NSColor *color)
             static_cast<int>(scaleFactor * [colorInColorSpace blueComponent]));
     }
 
-    // This conversion above can fail if the NSColor in question is an NSPatternColor 
+    // This conversion above can fail if the NSColor in question is an NSPatternColor
     // (as many system colors are). These colors are actually a repeating pattern
     // not just a solid color. To work around this we simply draw a 1x1 image of
     // the color and use that pixel's color. It might be better to use an average of
@@ -390,7 +390,7 @@ Color RenderThemeChromiumMac::systemColor(int cssValueId) const
 {
     if (m_systemColorCache.contains(cssValueId))
         return m_systemColorCache.get(cssValueId);
-    
+
     Color color;
     switch (cssValueId) {
         case CSSValueActiveborder:
@@ -504,7 +504,7 @@ bool RenderThemeChromiumMac::isControlStyled(const RenderStyle* style, const Bor
 {
     if (style->appearance() == TextFieldPart || style->appearance() == TextAreaPart || style->appearance() == ListboxPart)
         return style->border() != border;
-        
+
     // FIXME: This is horrible, but there is not much else that can be done.  Menu lists cannot draw properly when
     // scaled.  They can't really draw properly when transformed either.  We can't detect the transform case at style
     // adjustment time so that will just have to stay broken.  We can however detect that we're zooming.  If zooming
@@ -518,13 +518,14 @@ bool RenderThemeChromiumMac::isControlStyled(const RenderStyle* style, const Bor
 void RenderThemeChromiumMac::adjustRepaintRect(const RenderObject* o, IntRect& r)
 {
     ControlPart part = o->style()->appearance();
-    
+
 #if USE(NEW_THEME)
     switch (part) {
         case CheckboxPart:
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
             return RenderTheme::adjustRepaintRect(o, r);
@@ -565,13 +566,13 @@ IntRect RenderThemeChromiumMac::inflateRect(const IntRect& r, const IntSize& siz
 FloatRect RenderThemeChromiumMac::convertToPaintingRect(const RenderObject* inputRenderer, const RenderObject* partRenderer, const FloatRect& inputRect, const IntRect& r) const
 {
     FloatRect partRect(inputRect);
-    
+
     // Compute an offset between the part renderer and the input renderer
     FloatSize offsetFromInputRenderer;
     const RenderObject* renderer = partRenderer;
     while (renderer && renderer != inputRenderer) {
         RenderObject* containingRenderer = renderer->container();
-        offsetFromInputRenderer -= renderer->offsetFromContainer(containingRenderer);
+        offsetFromInputRenderer -= renderer->offsetFromContainer(containingRenderer, IntPoint());
         renderer = containingRenderer;
     }
     // If the input renderer was not a container, something went wrong
@@ -760,7 +761,7 @@ bool RenderThemeChromiumMac::paintCapsLockIndicator(RenderObject*, const RenderO
 
     LocalCurrentGraphicsContext localContext(paintInfo.context);
     wkDrawCapsLockIndicator(paintInfo.context->platformContext(), r);
-    
+
     return false;
 }
 
@@ -820,7 +821,7 @@ bool RenderThemeChromiumMac::paintMenuList(RenderObject* o, const RenderObject::
         inflatedRect = inflateRect(inflatedRect, size, popupButtonMargins(), zoomLevel);
 
     paintInfo.context->save();
-    
+
 #ifndef BUILDING_ON_TIGER
     // On Leopard, the cell will draw outside of the given rect, so we have to clip to the rect
     paintInfo.context->clip(inflatedRect);
@@ -980,10 +981,10 @@ bool RenderThemeChromiumMac::paintMenuListButton(RenderObject* o, const RenderOb
 
     if (bounds.width() < arrowWidth + arrowPaddingLeft * o->style()->effectiveZoom())
         return false;
-    
+
     paintInfo.context->save();
 
-    paintInfo.context->setFillColor(o->style()->color());
+    paintInfo.context->setFillColor(o->style()->color(), o->style()->colorSpace());
     paintInfo.context->setStrokeStyle(NoStroke);
 
     FloatPoint arrow1[3];
@@ -1012,11 +1013,11 @@ bool RenderThemeChromiumMac::paintMenuListButton(RenderObject* o, const RenderOb
     // Draw the separator to the left of the arrows
     paintInfo.context->setStrokeThickness(1.0f); // Deliberately ignores zoom since it looks nicer if it stays thin.
     paintInfo.context->setStrokeStyle(SolidStroke);
-    paintInfo.context->setStrokeColor(leftSeparatorColor);
+    paintInfo.context->setStrokeColor(leftSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator, bounds.bottom()));
 
-    paintInfo.context->setStrokeColor(rightSeparatorColor);
+    paintInfo.context->setStrokeColor(rightSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.bottom()));
 
@@ -1036,7 +1037,7 @@ void RenderThemeChromiumMac::adjustMenuListStyle(CSSStyleSelector* selector, Ren
 
     style->resetBorder();
     style->resetPadding();
-    
+
     // Height is locked to auto.
     style->setHeight(Length(Auto));
 
@@ -1106,7 +1107,7 @@ void RenderThemeChromiumMac::adjustMenuListButtonStyle(CSSStyleSelector*, Render
 
     const int minHeight = 15;
     style->setMinHeight(Length(minHeight, Fixed));
-    
+
     style->setLineHeight(RenderStyle::initialLineHeight());
 }
 
@@ -1136,6 +1137,9 @@ int RenderThemeChromiumMac::minimumMenuListSize(RenderStyle* style) const
     return sizeForSystemFont(style, menuListSizes()).width();
 }
 
+const int trackWidth = 5;
+const int trackRadius = 2;
+
 void RenderThemeChromiumMac::adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     style->setBoxShadow(0);
@@ -1143,9 +1147,6 @@ void RenderThemeChromiumMac::adjustSliderTrackStyle(CSSStyleSelector*, RenderSty
 
 bool RenderThemeChromiumMac::paintSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    static const int trackWidth = 5;
-    static const int trackRadius = 2;
-  
     IntRect bounds = r;
     float zoomLevel = o->style()->effectiveZoom();
     float zoomedTrackWidth = trackWidth * zoomLevel;
@@ -1179,7 +1180,7 @@ bool RenderThemeChromiumMac::paintSliderTrack(RenderObject* o, const RenderObjec
         radius, radius);
     CGContextDrawShading(context, mainShading.get());
     paintInfo.context->restore();
-    
+
     return false;
 }
 
@@ -1201,7 +1202,7 @@ bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObjec
     LocalCurrentGraphicsContext localContext(paintInfo.context);
 
     // Update the various states we respond to.
-    updateActiveState(sliderThumbCell, o);
+    updateActiveState(sliderThumbCell, o->parent());
     updateEnabledState(sliderThumbCell, o->parent());
     updateFocusedState(sliderThumbCell, o->parent());
 
@@ -1233,7 +1234,7 @@ bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObjec
 
     paintInfo.context->save();
     float zoomLevel = o->style()->effectiveZoom();
-    
+
     FloatRect unzoomedRect = bounds;
     if (zoomLevel != 1.0f) {
         unzoomedRect.setWidth(unzoomedRect.width() / zoomLevel);
@@ -1251,22 +1252,6 @@ bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObjec
     return false;
 }
 
-void RenderThemeChromiumMac::adjustSliderThumbSize(RenderObject* o) const
-{
-    static const int sliderThumbWidth = 15;
-    static const int sliderThumbHeight = 15;
-
-    float zoomLevel = o->style()->effectiveZoom();
-    if (o->style()->appearance() == SliderThumbHorizontalPart || o->style()->appearance() == SliderThumbVerticalPart) {
-        o->style()->setWidth(Length(static_cast<int>(sliderThumbWidth * zoomLevel), Fixed));
-        o->style()->setHeight(Length(static_cast<int>(sliderThumbHeight * zoomLevel), Fixed));
-    }
-
-#if ENABLE(VIDEO)
-    RenderMediaControlsChromium::adjustMediaSliderThumbSize(o);
-#endif
-}
-
 bool RenderThemeChromiumMac::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     NSSearchFieldCell* search = this->search();
@@ -1279,7 +1264,7 @@ bool RenderThemeChromiumMac::paintSearchField(RenderObject* o, const RenderObjec
     float zoomLevel = o->style()->effectiveZoom();
 
     IntRect unzoomedRect = r;
-    
+
     if (zoomLevel != 1.0f) {
         unzoomedRect.setWidth(unzoomedRect.width() / zoomLevel);
         unzoomedRect.setHeight(unzoomedRect.height() / zoomLevel);
@@ -1328,7 +1313,7 @@ void RenderThemeChromiumMac::setSearchFieldSize(RenderStyle* style) const
     // If the width and height are both specified, then we have nothing to do.
     if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
         return;
-    
+
     // Use the font size to determine the intrinsic width of the control.
     setSizeFromFont(style, searchFieldSizes());
 }
@@ -1345,19 +1330,19 @@ void RenderThemeChromiumMac::adjustSearchFieldStyle(CSSStyleSelector* selector,
     style->setBorderBottomWidth(borderWidth);
     style->setBorderBottomStyle(INSET);
     style->setBorderTopWidth(borderWidth);
-    style->setBorderTopStyle(INSET);    
-    
+    style->setBorderTopStyle(INSET);
+
     // Override height.
     style->setHeight(Length(Auto));
     setSearchFieldSize(style);
-    
+
     // Override padding size to match AppKit text positioning.
     const int padding = 1 * style->effectiveZoom();
     style->setPaddingLeft(Length(padding, Fixed));
     style->setPaddingRight(Length(padding, Fixed));
     style->setPaddingTop(Length(padding, Fixed));
     style->setPaddingBottom(Length(padding, Fixed));
-    
+
     NSControlSize controlSize = controlSizeForFont(style);
     setFontFromControlSize(selector, style, controlSize);
 
@@ -1495,7 +1480,7 @@ bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, cons
 
     FloatRect localBounds = [search searchButtonRectForBounds:NSRect(input->renderBox()->borderBoxRect())];
     localBounds = convertToPaintingRect(input->renderer(), o, localBounds, r);
-    
+
     IntRect unzoomedRect(localBounds);
     if (zoomLevel != 1.0f) {
         unzoomedRect.setWidth(unzoomedRect.width() / zoomLevel);
@@ -1507,12 +1492,28 @@ bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, cons
 
     [[search searchButtonCell] drawWithFrame:unzoomedRect inView:FlippedView()];
     [[search searchButtonCell] setControlView:nil];
-    
+
     paintInfo.context->restore();
 
     return false;
 }
 
+const int sliderThumbWidth = 15;
+const int sliderThumbHeight = 15;
+
+void RenderThemeChromiumMac::adjustSliderThumbSize(RenderObject* o) const
+{
+    float zoomLevel = o->style()->effectiveZoom();
+    if (o->style()->appearance() == SliderThumbHorizontalPart || o->style()->appearance() == SliderThumbVerticalPart) {
+        o->style()->setWidth(Length(static_cast<int>(sliderThumbWidth * zoomLevel), Fixed));
+        o->style()->setHeight(Length(static_cast<int>(sliderThumbHeight * zoomLevel), Fixed));
+    }
+
+#if ENABLE(VIDEO)
+    RenderMediaControlsChromium::adjustMediaSliderThumbSize(o);
+#endif
+}
+
 #if ENABLE(VIDEO)
 bool RenderThemeChromiumMac::shouldRenderMediaControlPart(ControlPart part, Element* e)
 {
@@ -1553,7 +1554,7 @@ bool RenderThemeChromiumMac::paintMediaControlsBackground(RenderObject* object,
 {
     return RenderMediaControlsChromium::paintMediaControlsPart(MediaTimelineContainer, object, paintInfo, rect);
 }
-    
+
 String RenderThemeChromiumMac::extraMediaControlsStyleSheet()
 {
     return String(mediaControlsChromiumUserAgentStyleSheet, sizeof(mediaControlsChromiumUserAgentStyleSheet));
@@ -1568,7 +1569,7 @@ NSPopUpButtonCell* RenderThemeChromiumMac::popupButton() const
         [m_popupButton.get() setUsesItemFromMenu:NO];
         [m_popupButton.get() setFocusRingType:NSFocusRingTypeExterior];
     }
-    
+
     return m_popupButton.get();
 }
 
@@ -1602,7 +1603,7 @@ NSSliderCell* RenderThemeChromiumMac::sliderThumbHorizontal() const
         [m_sliderThumbHorizontal.get() setControlSize:NSSmallControlSize];
         [m_sliderThumbHorizontal.get() setFocusRingType:NSFocusRingTypeExterior];
     }
-    
+
     return m_sliderThumbHorizontal.get();
 }
 
@@ -1615,7 +1616,7 @@ NSSliderCell* RenderThemeChromiumMac::sliderThumbVertical() const
         [m_sliderThumbVertical.get() setControlSize:NSSmallControlSize];
         [m_sliderThumbVertical.get() setFocusRingType:NSFocusRingTypeExterior];
     }
-    
+
     return m_sliderThumbVertical.get();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
index fb42bb7af5..8b3b388ca9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -217,6 +217,22 @@ int RenderThemeChromiumSkia::minimumMenuListSize(RenderStyle* style) const
     return 0;
 }
 
+// These are the default dimensions of radio buttons and checkboxes.
+static const int widgetStandardWidth = 13;
+static const int widgetStandardHeight = 13;
+
+// Return a rectangle that has the same center point as |original|, but with a
+// size capped at |width| by |height|.
+IntRect center(const IntRect& original, int width, int height)
+{
+    width = std::min(original.width(), width);
+    height = std::min(original.height(), height);
+    int x = original.x() + (original.width() - width) / 2;
+    int y = original.y() + (original.height() - height) / 2;
+
+    return IntRect(x, y, width, height);
+}
+
 bool RenderThemeChromiumSkia::paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
 {
     static Image* const checkedImage = Image::loadPlatformResource("linuxCheckboxOn").releaseRef();
@@ -231,7 +247,7 @@ bool RenderThemeChromiumSkia::paintCheckbox(RenderObject* o, const RenderObject:
     else
         image = this->isChecked(o) ? disabledCheckedImage : disabledUncheckedImage;
 
-    i.context->drawImage(image, rect);
+    i.context->drawImage(image, o->style()->colorSpace(), center(rect, widgetStandardHeight, widgetStandardWidth));
     return false;
 }
 
@@ -246,7 +262,7 @@ void RenderThemeChromiumSkia::setCheckboxSize(RenderStyle* style) const
     // querying the theme gives you a larger size that accounts for the higher
     // DPI.  Until our entire engine honors a DPI setting other than 96, we
     // can't rely on the theme's metrics.
-    const IntSize size(13, 13);
+    const IntSize size(widgetStandardHeight, widgetStandardWidth);
     setSizeIfAuto(style, size);
 }
 
@@ -263,7 +279,7 @@ bool RenderThemeChromiumSkia::paintRadio(RenderObject* o, const RenderObject::Pa
     else
         image = this->isChecked(o) ? disabledCheckedImage : disabledUncheckedImage;
 
-    i.context->drawImage(image, rect);
+    i.context->drawImage(image, o->style()->colorSpace(), center(rect, widgetStandardHeight, widgetStandardWidth));
     return false;
 }
 
@@ -348,6 +364,15 @@ bool RenderThemeChromiumSkia::paintButton(RenderObject* o, const RenderObject::P
     return false;
 }
 
+void RenderThemeChromiumSkia::adjustButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    if (style->appearance() == PushButtonPart) {
+        // Ignore line-height.
+        style->setLineHeight(RenderStyle::initialLineHeight());
+    }
+}
+
+
 bool RenderThemeChromiumSkia::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
 {
     return true;
@@ -358,6 +383,12 @@ bool RenderThemeChromiumSkia::paintTextArea(RenderObject* o, const RenderObject:
     return paintTextField(o, i, r);
 }
 
+void RenderThemeChromiumSkia::adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+     // Ignore line-height.
+     style->setLineHeight(RenderStyle::initialLineHeight());
+}
+
 bool RenderThemeChromiumSkia::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
 {
     return paintTextField(o, i, r);
@@ -372,28 +403,41 @@ void RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle(CSSStyleSelecto
     style->setHeight(Length(cancelButtonSize, Fixed));
 }
 
-bool RenderThemeChromiumSkia::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+IntRect RenderThemeChromiumSkia::convertToPaintingRect(RenderObject* inputRenderer, const RenderObject* partRenderer, IntRect partRect, const IntRect& localOffset) const
 {
-    IntRect bounds = r;
-    ASSERT(o->parent());
-    if (!o->parent() || !o->parent()->isBox())
-        return false;
-
-    RenderBox* parentRenderBox = toRenderBox(o->parent());
+    // Compute an offset between the part renderer and the input renderer.
+    IntSize offsetFromInputRenderer = -(partRenderer->offsetFromAncestorContainer(inputRenderer));
+    // Move the rect into partRenderer's coords.
+    partRect.move(offsetFromInputRenderer);
+    // Account for the local drawing offset.
+    partRect.move(localOffset.x(), localOffset.y());
 
-    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    return partRect;
+}
 
-    // Make sure the scaled button stays square and will fit in its parent's box
-    bounds.setHeight(std::min(parentBox.width(), std::min(parentBox.height(), bounds.height())));
-    bounds.setWidth(bounds.height());
+bool RenderThemeChromiumSkia::paintSearchFieldCancelButton(RenderObject* cancelButtonObject, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    // Get the renderer of <input> element.
+    Node* input = cancelButtonObject->node()->shadowAncestorNode();
+    if (!input->renderer()->isBox())
+        return false;
+    RenderBox* inputRenderBox = toRenderBox(input->renderer());
+    IntRect inputContentBox = inputRenderBox->contentBoxRect();
 
+    // Make sure the scaled button stays square and will fit in its parent's box.
+    int cancelButtonSize = std::min(inputContentBox.width(), std::min(inputContentBox.height(), r.height()));
+    // Calculate cancel button's coordinates relative to the input element.
     // Center the button vertically.  Round up though, so if it has to be one pixel off-center, it will
     // be one pixel closer to the bottom of the field.  This tends to look better with the text.
-    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+    IntRect cancelButtonRect(cancelButtonObject->offsetFromAncestorContainer(inputRenderBox).width(),
+                             inputContentBox.y() + (inputContentBox.height() - cancelButtonSize + 1) / 2,
+                             cancelButtonSize, cancelButtonSize);
+    IntRect paintingRect = convertToPaintingRect(inputRenderBox, cancelButtonObject, cancelButtonRect, r);
 
     static Image* cancelImage = Image::loadPlatformResource("searchCancel").releaseRef();
     static Image* cancelPressedImage = Image::loadPlatformResource("searchCancelPressed").releaseRef();
-    i.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, bounds);
+    paintInfo.context->drawImage(isPressed(cancelButtonObject) ? cancelPressedImage : cancelImage,
+                                 cancelButtonObject->style()->colorSpace(), paintingRect);
     return false;
 }
 
@@ -414,26 +458,27 @@ void RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle(CSSStyleSe
     style->setHeight(Length(magnifierSize, Fixed));
 }
 
-bool RenderThemeChromiumSkia::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeChromiumSkia::paintSearchFieldResultsDecoration(RenderObject* magnifierObject, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    IntRect bounds = r;
-    ASSERT(o->parent());
-    if (!o->parent() || !o->parent()->isBox())
+    // Get the renderer of <input> element.
+    Node* input = magnifierObject->node()->shadowAncestorNode();
+    if (!input->renderer()->isBox())
         return false;
+    RenderBox* inputRenderBox = toRenderBox(input->renderer());
+    IntRect inputContentBox = inputRenderBox->contentBoxRect();
 
-    RenderBox* parentRenderBox = toRenderBox(o->parent());
-    IntRect parentBox = parentRenderBox->absoluteContentBox();
-
-    // Make sure the scaled decoration stays square and will fit in its parent's box
-    bounds.setHeight(std::min(parentBox.width(), std::min(parentBox.height(), bounds.height())));
-    bounds.setWidth(bounds.height());
-
+    // Make sure the scaled decoration stays square and will fit in its parent's box.
+    int magnifierSize = std::min(inputContentBox.width(), std::min(inputContentBox.height(), r.height()));
+    // Calculate decoration's coordinates relative to the input element.
     // Center the decoration vertically.  Round up though, so if it has to be one pixel off-center, it will
     // be one pixel closer to the bottom of the field.  This tends to look better with the text.
-    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+    IntRect magnifierRect(magnifierObject->offsetFromAncestorContainer(inputRenderBox).width(),
+                          inputContentBox.y() + (inputContentBox.height() - magnifierSize + 1) / 2,
+                          magnifierSize, magnifierSize);
+    IntRect paintingRect = convertToPaintingRect(inputRenderBox, magnifierObject, magnifierRect, r);
 
     static Image* magnifierImage = Image::loadPlatformResource("searchMagnifier").releaseRef();
-    i.context->drawImage(magnifierImage, bounds);
+    paintInfo.context->drawImage(magnifierImage, magnifierObject->style()->colorSpace(), paintingRect);
     return false;
 }
 
@@ -448,28 +493,25 @@ void RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle(CSSStyleSelect
     style->setHeight(Length(magnifierHeight, Fixed));
 }
 
-bool RenderThemeChromiumSkia::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeChromiumSkia::paintSearchFieldResultsButton(RenderObject* magnifierObject, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    IntRect bounds = r;
-    ASSERT(o->parent());
-    if (!o->parent())
-        return false;
-    if (!o->parent() || !o->parent()->isBox())
+    // Get the renderer of <input> element.
+    Node* input = magnifierObject->node()->shadowAncestorNode();
+    if (!input->renderer()->isBox())
         return false;
+    RenderBox* inputRenderBox = toRenderBox(input->renderer());
+    IntRect inputContentBox = inputRenderBox->contentBoxRect();
 
-    RenderBox* parentRenderBox = toRenderBox(o->parent());
-    IntRect parentBox = parentRenderBox->absoluteContentBox();
-
-    // Make sure the scaled decoration will fit in its parent's box
-    bounds.setHeight(std::min(parentBox.height(), bounds.height()));
-    bounds.setWidth(std::min(parentBox.width(), static_cast<int>(bounds.height() * defaultSearchFieldResultsButtonWidth / defaultSearchFieldResultsDecorationSize)));
-
-    // Center the button vertically.  Round up though, so if it has to be one pixel off-center, it will
-    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
-    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+    // Make sure the scaled decoration will fit in its parent's box.
+    int magnifierHeight = std::min(inputContentBox.height(), r.height());
+    int magnifierWidth = std::min(inputContentBox.width(), static_cast<int>(magnifierHeight * defaultSearchFieldResultsButtonWidth / defaultSearchFieldResultsDecorationSize));
+    IntRect magnifierRect(magnifierObject->offsetFromAncestorContainer(inputRenderBox).width(),
+                          inputContentBox.y() + (inputContentBox.height() - magnifierHeight + 1) / 2,
+                          magnifierWidth, magnifierHeight);
+    IntRect paintingRect = convertToPaintingRect(inputRenderBox, magnifierObject, magnifierRect, r);
 
     static Image* magnifierImage = Image::loadPlatformResource("searchMagnifierResults").releaseRef();
-    i.context->drawImage(magnifierImage, bounds);
+    paintInfo.context->drawImage(magnifierImage, magnifierObject->style()->colorSpace(), paintingRect);
     return false;
 }
 
@@ -690,26 +732,6 @@ int RenderThemeChromiumSkia::popupInternalPaddingBottom(RenderStyle* style) cons
     return menuListInternalPadding(style, BottomPadding);
 }
 
-int RenderThemeChromiumSkia::buttonInternalPaddingLeft() const
-{
-    return 3;
-}
-
-int RenderThemeChromiumSkia::buttonInternalPaddingRight() const
-{
-    return 3;
-}
-
-int RenderThemeChromiumSkia::buttonInternalPaddingTop() const
-{
-    return 1;
-}
-
-int RenderThemeChromiumSkia::buttonInternalPaddingBottom() const
-{
-    return 1;
-}
-
 #if ENABLE(VIDEO)
 bool RenderThemeChromiumSkia::shouldRenderMediaControlPart(ControlPart part, Element* e)
 {
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
index 98e3a35571..dc920b1cf2 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
@@ -71,11 +71,13 @@ namespace WebCore {
         virtual void setRadioSize(RenderStyle*) const;
 
         virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
         virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
         virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
+        virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
         virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
         virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
@@ -121,11 +123,6 @@ namespace WebCore {
         virtual int popupInternalPaddingTop(RenderStyle*) const;
         virtual int popupInternalPaddingBottom(RenderStyle*) const;
 
-        virtual int buttonInternalPaddingLeft() const;
-        virtual int buttonInternalPaddingRight() const;
-        virtual int buttonInternalPaddingTop() const;
-        virtual int buttonInternalPaddingBottom() const;
-
 #if ENABLE(VIDEO)
         // Media controls
         virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
@@ -151,6 +148,7 @@ namespace WebCore {
     private:
         int menuListInternalPadding(RenderStyle*, int paddingType) const;
         bool paintMediaButtonInternal(GraphicsContext*, const IntRect&, Image*);
+        IntRect convertToPaintingRect(RenderObject* inputRenderer, const RenderObject* partRenderer, IntRect partRect, const IntRect& localOffset) const;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
index 4b38d53e74..db31825a0f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
@@ -86,7 +86,7 @@ private:
             return transformMode == KeepTransform ? NoLayer : OpaqueCompositeLayer;
     }
 
-    static TransformMode getTransformMode(const TransformationMatrix& matrix)
+    static TransformMode getTransformMode(const AffineTransform& matrix)
     {
         if (matrix.b() != 0 || matrix.c() != 0)  // Skew.
             return Untransform;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
index 1d68c630c9..48c6c42c20 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
@@ -126,6 +126,7 @@ protected:
     virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaRewindButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaReturnToRealtimeButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaToggleClosedCaptionsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaCurrentTime(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaTimeRemaining(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
index 2ea3b8beaf..9e97079386 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
@@ -830,8 +830,8 @@ bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const RenderObject:
 
     paintInfo.context->save();
 
-    paintInfo.context->setFillColor(o->style()->color());
-    paintInfo.context->setStrokeColor(NoStroke);
+    paintInfo.context->setFillColor(o->style()->color(), DeviceColorSpace);
+    paintInfo.context->setStrokeColor(NoStroke, DeviceColorSpace);
 
     FloatPoint arrow[3];
     arrow[0] = FloatPoint(leftEdge, centerY - arrowHeight / 2.0f);
@@ -851,11 +851,11 @@ bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const RenderObject:
     // Draw the separator to the left of the arrows
     paintInfo.context->setStrokeThickness(1.0f);
     paintInfo.context->setStrokeStyle(SolidStroke);
-    paintInfo.context->setStrokeColor(leftSeparatorColor);
+    paintInfo.context->setStrokeColor(leftSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator, bounds.bottom()));
 
-    paintInfo.context->setStrokeColor(rightSeparatorColor);
+    paintInfo.context->setStrokeColor(rightSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.bottom()));
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.cpp
index 92bfd03587..52afbd6c05 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.cpp
@@ -819,7 +819,7 @@ bool RenderThemeWin::paintSearchFieldCancelButton(RenderObject* o, const RenderO
 
     static Image* cancelImage = Image::loadPlatformResource("searchCancel").releaseRef();
     static Image* cancelPressedImage = Image::loadPlatformResource("searchCancelPressed").releaseRef();
-    paintInfo.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, bounds);
+    paintInfo.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, o->style()->colorSpace(), bounds);
     return false;
 }
 
@@ -868,7 +868,7 @@ bool RenderThemeWin::paintSearchFieldResultsDecoration(RenderObject* o, const Re
     bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
     
     static Image* magnifierImage = Image::loadPlatformResource("searchMagnifier").releaseRef();
-    paintInfo.context->drawImage(magnifierImage, bounds);
+    paintInfo.context->drawImage(magnifierImage, o->style()->colorSpace(), bounds);
     return false;
 }
 
@@ -904,7 +904,7 @@ bool RenderThemeWin::paintSearchFieldResultsButton(RenderObject* o, const Render
     bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
 
     static Image* magnifierImage = Image::loadPlatformResource("searchMagnifierResults").releaseRef();
-    paintInfo.context->drawImage(magnifierImage, bounds);
+    paintInfo.context->drawImage(magnifierImage, o->style()->colorSpace(), bounds);
     return false;
 }
 
@@ -955,6 +955,23 @@ Color RenderThemeWin::systemColor(int cssValueId) const
 }
 
 #if ENABLE(VIDEO)
+
+bool RenderThemeWin::shouldRenderMediaControlPart(ControlPart part, Element* element)
+{
+    if (part == MediaToggleClosedCaptionsButtonPart) {
+        // We rely on QuickTime to render captions so only enable the button for a video element.
+#if SAFARI_THEME_VERSION >= 4
+        if (!element->hasTagName(videoTag))
+            return false;
+#else
+        return false;
+#endif
+    }
+
+    return RenderTheme::shouldRenderMediaControlPart(part, element);
+}
+
+
 bool RenderThemeWin::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaFullscreenButton, o, paintInfo, r);
@@ -989,6 +1006,12 @@ bool RenderThemeWin::paintMediaSliderThumb(RenderObject* o, const RenderObject::
 {
     return RenderMediaControls::paintMediaControlsPart(MediaSliderThumb, o, paintInfo, r);
 }
+
+bool RenderThemeWin::paintMediaToggleClosedCaptionsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaShowClosedCaptionsButton, o, paintInfo, r);
+}
+
 #endif
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.h
index 99c200417c..a9fa5e66ac 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.h
@@ -125,6 +125,7 @@ public:
     virtual bool supportsFocusRing(const RenderStyle*) const;
 
 #if ENABLE(VIDEO)
+    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
     virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
@@ -132,6 +133,7 @@ public:
     virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaToggleClosedCaptionsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 #endif
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeWince.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeWince.cpp
index fb89678b6c..c4aaaad878 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeWince.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeWince.cpp
@@ -28,6 +28,7 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "GraphicsContext.h"
+#include "NotImplemented.h"
 #if ENABLE(VIDEO)
 #include "HTMLMediaElement.h"
 #endif
@@ -377,12 +378,12 @@ bool RenderThemeWince::paintSearchFieldCancelButton(RenderObject* o, const Rende
     IntRect cancelBounds(IntPoint(x, y), cancelSize);
     paintInfo.context->save();
     paintInfo.context->addRoundedRectClip(cancelBounds, cancelRadius, cancelRadius, cancelRadius, cancelRadius);
-    paintInfo.context->fillRect(cancelBounds, buttonColor);
+    paintInfo.context->fillRect(cancelBounds, buttonColor, DeviceColorSpace);
 
     // Draw the 'x'
     IntSize xSize(3, 3);
     IntRect xBounds(cancelBounds.location() + IntSize(3, 3), xSize);
-    paintInfo.context->setStrokeColor(Color::white);
+    paintInfo.context->setStrokeColor(Color::white, DeviceColorSpace);
     paintInfo.context->drawLine(xBounds.location(),  xBounds.location() + xBounds.size());
     paintInfo.context->drawLine(IntPoint(xBounds.right(), xBounds.y()),  IntPoint(xBounds.x(), xBounds.bottom()));
 
@@ -489,11 +490,11 @@ bool RenderThemeWince::paintSliderTrack(RenderObject* o, const RenderObject::Pai
     bool rc = RenderTheme::paintSliderTrack(o, i, r);
     IntPoint left = IntPoint(r.x() + 2, (r.y() + r.bottom()) / 2);
     i.context->save();
-    i.context->setStrokeColor(Color::gray);
-    i.context->setFillColor(Color::gray);
+    i.context->setStrokeColor(Color::gray, DeviceColorSpace);
+    i.context->setFillColor(Color::gray, DeviceColorSpace);
     i.context->fillRect(r);
 #if ENABLE(VIDEO)
-    HTMLMediaElement *mediaElement = mediaElementParent(o->node());
+    HTMLMediaElement* mediaElement = mediaElementParent(o->node());
     if (mediaElement) {
         i.context->setStrokeColor(Color(0, 0xff, 0));
         IntPoint right = IntPoint(left.x() + mediaElement->percentLoaded() * (r.right() - r.x() - 4), (r.y() + r.bottom()) / 2);
@@ -501,7 +502,7 @@ bool RenderThemeWince::paintSliderTrack(RenderObject* o, const RenderObject::Pai
         left = right;
     }
 #endif
-    i.context->setStrokeColor(Color::black);
+    i.context->setStrokeColor(Color::black, DeviceColorSpace);
     i.context->drawLine(left, IntPoint(r.right() - 2, left.y()));
     i.context->restore();
     return rc;
@@ -511,10 +512,10 @@ bool RenderThemeWince::paintSliderThumb(RenderObject* o, const RenderObject::Pai
 {
     bool rc = RenderTheme::paintSliderThumb(o, i, r);
     i.context->save();
-    i.context->setStrokeColor(Color::black);
-    i.context->setFillColor(Color::black);
+    i.context->setStrokeColor(Color::black, DeviceColorSpace);
+    i.context->setFillColor(Color::black, DeviceColorSpace);
 #if ENABLE(VIDEO)
-    HTMLMediaElement *mediaElement = mediaElementParent(o->node());
+    HTMLMediaElement* mediaElement = mediaElementParent(o->node());
     if (mediaElement) {
         float pt = (mediaElement->currentTime() - mediaElement->startTime()) / mediaElement->duration();
         FloatRect intRect = r;
@@ -574,7 +575,7 @@ bool RenderThemeWince::paintMediaFullscreenButton(RenderObject* o, const RenderO
 bool RenderThemeWince::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     bool rc = paintButton(o, paintInfo, r);
-    HTMLMediaElement *mediaElement = mediaElementParent(o->node());
+    HTMLMediaElement* mediaElement = mediaElementParent(o->node());
     bool muted = !mediaElement || mediaElement->muted();
     FloatRect imRect = r;
     imRect.inflate(-2);
@@ -604,7 +605,7 @@ bool RenderThemeWince::paintMediaPlayButton(RenderObject* o, const RenderObject:
     paintInfo.context->save();
     paintInfo.context->setStrokeColor(Color::black);
     paintInfo.context->setFillColor(Color::black);
-    HTMLMediaElement *mediaElement = mediaElementParent(o->node());
+    HTMLMediaElement* mediaElement = mediaElementParent(o->node());
     bool paused = !mediaElement || mediaElement->paused();
     if (paused) {
         float width = imRect.width();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp
index b7ab191d7d..164a6560ad 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp
@@ -36,13 +36,16 @@
 #include "HTMLNames.h"
 #include "InlineTextBox.h"
 #include "RenderBR.h"
+#include "RenderFileUploadControl.h"
 #include "RenderInline.h"
 #include "RenderListMarker.h"
+#include "RenderPart.h"
 #include "RenderTableCell.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
 #include "SelectionController.h"
 #include "TextStream.h"
+#include <wtf/UnusedParam.h>
 #include <wtf/Vector.h>
 
 #if ENABLE(SVG)
@@ -55,11 +58,19 @@
 #include "SVGRenderTreeAsText.h"
 #endif
 
+#if USE(ACCELERATED_COMPOSITING)
+#include "RenderLayerBacking.h"
+#endif
+
+#if PLATFORM(QT)
+#include <QWidget>
+#endif
+
 namespace WebCore {
 
 using namespace HTMLNames;
 
-static void writeLayers(TextStream&, const RenderLayer* rootLayer, RenderLayer*, const IntRect& paintDirtyRect, int indent = 0);
+static void writeLayers(TextStream&, const RenderLayer* rootLayer, RenderLayer*, const IntRect& paintDirtyRect, int indent = 0, RenderAsTextBehavior behavior = RenderAsTextBehaviorNormal);
 
 #if !ENABLE(SVG)
 static TextStream &operator<<(TextStream& ts, const IntRect& r)
@@ -217,6 +228,9 @@ static TextStream &operator<<(TextStream& ts, const RenderObject& o)
     ts << " " << r;
 
     if (!(o.isText() && !o.isBR())) {
+        if (o.isFileUploadControl()) {
+            ts << " " << quoteAndEscapeNonPrintables(toRenderFileUploadControl(&o)->fileTextValue());
+        }
         if (o.parent() && (o.parent()->style()->color() != o.style()->color()))
             ts << " [color=" << o.style()->color().name() << "]";
 
@@ -336,6 +350,24 @@ static TextStream &operator<<(TextStream& ts, const RenderObject& o)
         }
     }
 
+#if PLATFORM(QT)
+    // Print attributes of embedded QWidgets. E.g. when the WebCore::Widget
+    // is invisible the QWidget should be invisible too.
+    if (o.isRenderPart()) {
+        const RenderPart* part = toRenderPart(const_cast<RenderObject*>(&o));
+        if (part->widget() && part->widget()->platformWidget()) {
+            QWidget* wid = part->widget()->platformWidget();
+
+            ts << " [QT: ";
+            ts << "geometry: {" << wid->geometry() << "} ";
+            ts << "isHidden: " << wid->isHidden() << " ";
+            ts << "isSelfVisible: " << part->widget()->isSelfVisible() << " ";
+            ts << "isParentVisible: " << part->widget()->isParentVisible() << " ";
+            ts << "mask: {" << wid->mask().boundingRect() << "} ] ";
+        }
+    }
+#endif
+
     return ts;
 }
 
@@ -363,6 +395,10 @@ void write(TextStream& ts, const RenderObject& o, int indent)
         write(ts, *toRenderPath(&o), indent);
         return;
     }
+    if (o.isSVGResource()) {
+        writeSVGResource(ts, o, indent);
+        return;
+    }
     if (o.isSVGContainer()) {
         writeSVGContainer(ts, o, indent);
         return;
@@ -417,9 +453,15 @@ void write(TextStream& ts, const RenderObject& o, int indent)
     }
 }
 
+enum LayerPaintPhase {
+    LayerPaintPhaseAll = 0,
+    LayerPaintPhaseBackground = -1,
+    LayerPaintPhaseForeground = 1
+};
+
 static void write(TextStream& ts, RenderLayer& l,
                   const IntRect& layerBounds, const IntRect& backgroundClipRect, const IntRect& clipRect, const IntRect& outlineClipRect,
-                  int layerType = 0, int indent = 0)
+                  LayerPaintPhase paintPhase = LayerPaintPhaseAll, int indent = 0, RenderAsTextBehavior behavior = RenderAsTextBehaviorNormal)
 {
     writeIndent(ts, indent);
 
@@ -445,19 +487,28 @@ static void write(TextStream& ts, RenderLayer& l,
             ts << " scrollHeight " << l.scrollHeight();
     }
 
-    if (layerType == -1)
+    if (paintPhase == LayerPaintPhaseBackground)
         ts << " layerType: background only";
-    else if (layerType == 1)
+    else if (paintPhase == LayerPaintPhaseForeground)
         ts << " layerType: foreground only";
-
+    
+#if USE(ACCELERATED_COMPOSITING)
+    if (behavior & RenderAsTextShowCompositedLayers) {
+        if (l.isComposited())
+            ts << " (composited, bounds " << l.backing()->compositedBounds() << ")";
+    }
+#else
+    UNUSED_PARAM(behavior);
+#endif
+    
     ts << "\n";
 
-    if (layerType != -1)
+    if (paintPhase != LayerPaintPhaseBackground)
         write(ts, *l.renderer(), indent + 1);
 }
 
 static void writeLayers(TextStream& ts, const RenderLayer* rootLayer, RenderLayer* l,
-                        const IntRect& paintDirtyRect, int indent)
+                        const IntRect& paintDirtyRect, int indent, RenderAsTextBehavior behavior)
 {
     // Calculate the clip rects we should use.
     IntRect layerBounds, damageRect, clipRectToApply, outlineRect;
@@ -467,29 +518,46 @@ static void writeLayers(TextStream& ts, const RenderLayer* rootLayer, RenderLaye
     l->updateZOrderLists();
     l->updateNormalFlowList();
 
-    bool shouldPaint = l->intersectsDamageRect(layerBounds, damageRect, rootLayer);
+    bool shouldPaint = (behavior & RenderAsTextShowAllLayers) ? true : l->intersectsDamageRect(layerBounds, damageRect, rootLayer);
     Vector<RenderLayer*>* negList = l->negZOrderList();
-    if (shouldPaint && negList && negList->size() > 0)
-        write(ts, *l, layerBounds, damageRect, clipRectToApply, outlineRect, -1, indent);
+    bool paintsBackgroundSeparately = negList && negList->size() > 0;
+    if (shouldPaint && paintsBackgroundSeparately)
+        write(ts, *l, layerBounds, damageRect, clipRectToApply, outlineRect, LayerPaintPhaseBackground, indent, behavior);
 
     if (negList) {
+        int currIndent = indent;
+        if (behavior & RenderAsTextShowLayerNesting) {
+            writeIndent(ts, indent);
+            ts << " negative z-order list(" << negList->size() << ")\n";
+            ++currIndent;
+        }
         for (unsigned i = 0; i != negList->size(); ++i)
-            writeLayers(ts, rootLayer, negList->at(i), paintDirtyRect, indent);
+            writeLayers(ts, rootLayer, negList->at(i), paintDirtyRect, currIndent, behavior);
     }
 
     if (shouldPaint)
-        write(ts, *l, layerBounds, damageRect, clipRectToApply, outlineRect, negList && negList->size() > 0, indent);
-
-    Vector<RenderLayer*>* normalFlowList = l->normalFlowList();
-    if (normalFlowList) {
+        write(ts, *l, layerBounds, damageRect, clipRectToApply, outlineRect, paintsBackgroundSeparately ? LayerPaintPhaseForeground : LayerPaintPhaseAll, indent, behavior);
+
+    if (Vector<RenderLayer*>* normalFlowList = l->normalFlowList()) {
+        int currIndent = indent;
+        if (behavior & RenderAsTextShowLayerNesting) {
+            writeIndent(ts, indent);
+            ts << " normal flow list(" << normalFlowList->size() << ")\n";
+            ++currIndent;
+        }
         for (unsigned i = 0; i != normalFlowList->size(); ++i)
-            writeLayers(ts, rootLayer, normalFlowList->at(i), paintDirtyRect, indent);
+            writeLayers(ts, rootLayer, normalFlowList->at(i), paintDirtyRect, currIndent, behavior);
     }
 
-    Vector<RenderLayer*>* posList = l->posZOrderList();
-    if (posList) {
+    if (Vector<RenderLayer*>* posList = l->posZOrderList()) {
+        int currIndent = indent;
+        if (behavior & RenderAsTextShowLayerNesting) {
+            writeIndent(ts, indent);
+            ts << " positive z-order list(" << posList->size() << ")\n";
+            ++currIndent;
+        }
         for (unsigned i = 0; i != posList->size(); ++i)
-            writeLayers(ts, rootLayer, posList->at(i), paintDirtyRect, indent);
+            writeLayers(ts, rootLayer, posList->at(i), paintDirtyRect, currIndent, behavior);
     }
 }
 
@@ -535,8 +603,11 @@ static void writeSelection(TextStream& ts, const RenderObject* o)
            << "selection end:   position " << selection.end().deprecatedEditingOffset() << " of " << nodePosition(selection.end().node()) << "\n";
 }
 
-String externalRepresentation(RenderObject* o)
+String externalRepresentation(Frame* frame, RenderAsTextBehavior behavior)
 {
+    frame->document()->updateLayout();
+
+    RenderObject* o = frame->contentRenderer();
     if (!o)
         return String();
 
@@ -544,20 +615,21 @@ String externalRepresentation(RenderObject* o)
 #if ENABLE(SVG)
     writeRenderResources(ts, o->document());
 #endif
-    if (o->view()->frameView())
-        o->view()->frameView()->layout();
     if (o->hasLayer()) {
         RenderLayer* l = toRenderBox(o)->layer();
-        writeLayers(ts, l, l, IntRect(l->x(), l->y(), l->width(), l->height()));
+        writeLayers(ts, l, l, IntRect(l->x(), l->y(), l->width(), l->height()), 0, behavior);
         writeSelection(ts, o);
     }
     return ts.release();
 }
 
-static void writeCounterValuesFromChildren(TextStream& stream, RenderObject* parent)
+static void writeCounterValuesFromChildren(TextStream& stream, RenderObject* parent, bool& isFirstCounter)
 {
     for (RenderObject* child = parent->firstChild(); child; child = child->nextSibling()) {
         if (child->isCounter()) {
+            if (!isFirstCounter)
+                stream << " ";
+            isFirstCounter = false;
             String str(toRenderText(child)->text());
             stream << str;
         }
@@ -570,12 +642,13 @@ String counterValueForElement(Element* element)
     RefPtr<Element> elementRef(element);
     element->document()->updateLayout();
     TextStream stream;
+    bool isFirstCounter = true;
     // The counter renderers should be children of anonymous children
     // (i.e., :before or :after pseudo-elements).
     if (RenderObject* renderer = element->renderer()) {
         for (RenderObject* child = renderer->firstChild(); child; child = child->nextSibling()) {
             if (child->isAnonymous())
-                writeCounterValuesFromChildren(stream, child);
+                writeCounterValuesFromChildren(stream, child, isFirstCounter);
         }
     }
     return stream.release();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.h b/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.h
index 325f109478..13525e7d77 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.h
@@ -29,11 +29,20 @@
 namespace WebCore {
 
 class Element;
+class Frame;
 class RenderObject;
 class String;
 class TextStream;
 
-String externalRepresentation(RenderObject*);
+enum RenderAsTextBehaviorFlags {
+    RenderAsTextBehaviorNormal = 0,
+    RenderAsTextShowAllLayers = 1 << 0, // Dump all layers, not just those that would paint.
+    RenderAsTextShowLayerNesting = 1 << 1, // Annotate the layer lists.
+    RenderAsTextShowCompositedLayers = 1 << 2 // Show which layers are composited.
+};
+typedef unsigned RenderAsTextBehavior;
+
+String externalRepresentation(Frame*, RenderAsTextBehavior = RenderAsTextBehaviorNormal);
 void write(TextStream&, const RenderObject&, int indent = 0);
 
 // Helper function shared with SVGRenderTreeAsText
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderVideo.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderVideo.cpp
index 246d0c0b7e..13d6f60d61 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderVideo.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderVideo.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,6 +34,7 @@
 #include "HTMLNames.h"
 #include "HTMLVideoElement.h"
 #include "MediaPlayer.h"
+#include "RenderView.h"
 
 #if USE(ACCELERATED_COMPOSITING)
 #include "RenderLayer.h"
@@ -49,18 +50,25 @@ using namespace HTMLNames;
 static const int cDefaultWidth = 300;
 static const int cDefaultHeight = 150;
 
-RenderVideo::RenderVideo(HTMLMediaElement* video)
+RenderVideo::RenderVideo(HTMLVideoElement* video)
     : RenderMedia(video)
 {
     if (video->player())
         setIntrinsicSize(video->player()->naturalSize());
     else {
-        // Video in standalone media documents should not use the default 300x150
-        // size since they also have audio thrown at them. By setting the intrinsic
-        // size to 300x1 the video will resize itself in these cases, and audio will
-        // have the correct height (it needs to be > 0 for controls to render properly).
-        if (video->ownerDocument() && video->ownerDocument()->isMediaDocument())
+        // When the natural size of the video is unavailable, we use the provided
+        // width and height attributes of the video element as the intrinsic size until
+        // better values become available. If these attributes are not set, we fall back
+        // to a default video size (300x150).
+        if (video->hasAttribute(widthAttr) && video->hasAttribute(heightAttr))
+            setIntrinsicSize(IntSize(video->width(), video->height()));
+        else if (video->ownerDocument() && video->ownerDocument()->isMediaDocument()) {
+            // Video in standalone media documents should not use the default 300x150
+            // size since they also have audio thrown at them. By setting the intrinsic
+            // size to 300x1 the video will resize itself in these cases, and audio will
+            // have the correct height (it needs to be > 0 for controls to render properly).
             setIntrinsicSize(IntSize(cDefaultWidth, 1));
+        }
         else
             setIntrinsicSize(IntSize(cDefaultWidth, cDefaultHeight));
     }
@@ -73,7 +81,15 @@ RenderVideo::~RenderVideo()
         p->setFrameView(0);
     }
 }
-    
+
+void RenderVideo::intrinsicSizeChanged()
+{
+    if (videoElement()->shouldDisplayPosterImage())
+        RenderMedia::intrinsicSizeChanged();
+    videoSizeChanged(); 
+}
+
+
 void RenderVideo::videoSizeChanged()
 {
     if (!player())
@@ -86,41 +102,72 @@ void RenderVideo::videoSizeChanged()
     }
 }
 
-IntRect RenderVideo::videoBox() const 
+void RenderVideo::imageChanged(WrappedImagePtr newImage, const IntRect* rect)
 {
+    RenderMedia::imageChanged(newImage, rect);
+
+    // Cache the image intrinsic size so we can continue to use it to draw the image correctly
+    // even after we know the video intrisic size but aren't able to draw video frames yet
+    // (we don't want to scale the poster to the video size).
+    if (videoElement()->shouldDisplayPosterImage())
+        m_cachedImageSize = intrinsicSize();
+}
+
+IntRect RenderVideo::videoBox() const
+{
+    if (m_cachedImageSize.isEmpty() && videoElement()->shouldDisplayPosterImage())
+        return IntRect();
+
+    IntSize elementSize;
+    if (videoElement()->shouldDisplayPosterImage())
+        elementSize = m_cachedImageSize;
+    else
+        elementSize = intrinsicSize();
+
     IntRect contentRect = contentBoxRect();
-    
-    if (intrinsicSize().isEmpty() || contentRect.isEmpty())
+    if (elementSize.isEmpty() || contentRect.isEmpty())
         return IntRect();
 
-    IntRect resultRect = contentRect;
-    int ratio = contentRect.width() * intrinsicSize().height() - contentRect.height() * intrinsicSize().width();
+    IntRect renderBox = contentRect;
+    int ratio = renderBox.width() * elementSize.height() - renderBox.height() * elementSize.width();
     if (ratio > 0) {
-        int newWidth = contentRect.height() * intrinsicSize().width() / intrinsicSize().height();
+        int newWidth = renderBox.height() * elementSize.width() / elementSize.height();
         // Just fill the whole area if the difference is one pixel or less (in both sides)
-        if (resultRect.width() - newWidth > 2)
-            resultRect.setWidth(newWidth);
-        resultRect.move((contentRect.width() - resultRect.width()) / 2, 0);
+        if (renderBox.width() - newWidth > 2)
+            renderBox.setWidth(newWidth);
+        renderBox.move((contentRect.width() - renderBox.width()) / 2, 0);
     } else if (ratio < 0) {
-        int newHeight = contentRect.width() * intrinsicSize().height() / intrinsicSize().width();
-        if (resultRect.height() - newHeight > 2)
-            resultRect.setHeight(newHeight);
-        resultRect.move(0, (contentRect.height() - resultRect.height()) / 2);
+        int newHeight = renderBox.width() * elementSize.height() / elementSize.width();
+        if (renderBox.height() - newHeight > 2)
+            renderBox.setHeight(newHeight);
+        renderBox.move(0, (contentRect.height() - renderBox.height()) / 2);
     }
-    return resultRect;
+
+    return renderBox;
 }
     
 void RenderVideo::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
 {
     MediaPlayer* mediaPlayer = player();
-    if (!mediaPlayer)
+    bool displayingPoster = videoElement()->shouldDisplayPosterImage();
+
+    if (displayingPoster && document()->printing() && !view()->printImages())
         return;
-    updatePlayer();
+
+    if (!displayingPoster) {
+        if (!mediaPlayer)
+            return;
+        updatePlayer();
+    }
+
     IntRect rect = videoBox();
     if (rect.isEmpty())
         return;
     rect.move(tx, ty);
-    mediaPlayer->paint(paintInfo.context, rect);
+    if (displayingPoster)
+        paintIntoRect(paintInfo.context, rect);
+    else
+        mediaPlayer->paint(paintInfo.context, rect);
 }
 
 void RenderVideo::layout()
@@ -129,6 +176,12 @@ void RenderVideo::layout()
     updatePlayer();
 }
     
+HTMLVideoElement* RenderVideo::videoElement() const
+{
+    ASSERT(node()->hasTagName(videoTag));
+    return static_cast<HTMLVideoElement*>(node()); 
+}
+
 void RenderVideo::updateFromElement()
 {
     RenderMedia::updateFromElement();
@@ -140,7 +193,7 @@ void RenderVideo::updatePlayer()
     MediaPlayer* mediaPlayer = player();
     if (!mediaPlayer)
         return;
-    if (!mediaElement()->inActiveDocument()) {
+    if (!videoElement()->inActiveDocument()) {
         mediaPlayer->setVisible(false);
         return;
     }
@@ -155,40 +208,6 @@ void RenderVideo::updatePlayer()
     mediaPlayer->setVisible(true);
 }
 
-bool RenderVideo::isWidthSpecified() const
-{
-    switch (style()->width().type()) {
-        case Fixed:
-        case Percent:
-            return true;
-        case Auto:
-        case Relative: // FIXME: Shouldn't this case return true? It doesn't for images.
-        case Static:
-        case Intrinsic:
-        case MinIntrinsic:
-            return false;
-    }
-    ASSERT(false);
-    return false;
-}
-
-bool RenderVideo::isHeightSpecified() const
-{
-    switch (style()->height().type()) {
-        case Fixed:
-        case Percent:
-            return true;
-        case Auto:
-        case Relative: // FIXME: Shouldn't this case return true? It doesn't for images.
-        case Static:
-        case Intrinsic:
-        case MinIntrinsic:
-            return false;
-    }
-    ASSERT(false);
-    return false;
-}
-
 int RenderVideo::calcReplacedWidth(bool includeMaxWidth) const
 {
     int width;
@@ -235,24 +254,9 @@ int RenderVideo::calcAspectRatioHeight() const
     return RenderBox::calcReplacedWidth() * intrinsicHeight / intrinsicWidth;
 }
 
-void RenderVideo::calcPrefWidths()
+int RenderVideo::minimumReplacedHeight() const 
 {
-    ASSERT(prefWidthsDirty());
-
-    int paddingAndBorders = paddingLeft() + paddingRight() + borderLeft() + borderRight();
-    m_maxPrefWidth = calcReplacedWidth(false) + paddingAndBorders;
-
-    if (style()->maxWidth().isFixed() && style()->maxWidth().value() != undefinedLength)
-        m_maxPrefWidth = min(m_maxPrefWidth, style()->maxWidth().value() + (style()->boxSizing() == CONTENT_BOX ? paddingAndBorders : 0));
-
-    if (style()->width().isPercent() || style()->height().isPercent() || 
-        style()->maxWidth().isPercent() || style()->maxHeight().isPercent() ||
-        style()->minWidth().isPercent() || style()->minHeight().isPercent())
-        m_minPrefWidth = 0;
-    else
-        m_minPrefWidth = m_maxPrefWidth;
-
-    setPrefWidthsDirty(false);
+    return 0; 
 }
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -271,14 +275,6 @@ void RenderVideo::acceleratedRenderingStateChanged()
     if (p)
         p->acceleratedRenderingStateChanged();
 }
-
-GraphicsLayer* RenderVideo::videoGraphicsLayer() const
-{
-    if (hasLayer() && layer()->isComposited())
-        return layer()->backing()->graphicsLayer();
-
-    return 0;
-}
 #endif  // USE(ACCELERATED_COMPOSITING)
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderVideo.h b/src/3rdparty/webkit/WebCore/rendering/RenderVideo.h
index 79e5b4e3c4..16c846d290 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderVideo.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderVideo.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,13 +33,11 @@
 namespace WebCore {
     
 class HTMLMediaElement;
-#if USE(ACCELERATED_COMPOSITING)
-class GraphicsLayer;
-#endif
+class HTMLVideoElement;
 
 class RenderVideo : public RenderMedia {
 public:
-    RenderVideo(HTMLMediaElement*);
+    RenderVideo(HTMLVideoElement*);
     virtual ~RenderVideo();
 
     void videoSizeChanged();
@@ -48,13 +46,14 @@ public:
 #if USE(ACCELERATED_COMPOSITING)
     bool supportsAcceleratedRendering() const;
     void acceleratedRenderingStateChanged();
-    GraphicsLayer* videoGraphicsLayer() const;
 #endif
 
 private:
     virtual void updateFromElement();
+    inline HTMLVideoElement* videoElement() const;
 
-    virtual void intrinsicSizeChanged() { videoSizeChanged(); }
+    virtual void intrinsicSizeChanged();
+    virtual void imageChanged(WrappedImagePtr, const IntRect*);
 
     virtual const char* renderName() const { return "RenderVideo"; }
 
@@ -67,16 +66,14 @@ private:
 
     virtual int calcReplacedWidth(bool includeMaxWidth = true) const;
     virtual int calcReplacedHeight() const;
-
-    virtual void calcPrefWidths();
+    virtual int minimumReplacedHeight() const;
     
     int calcAspectRatioWidth() const;
     int calcAspectRatioHeight() const;
 
-    bool isWidthSpecified() const;
-    bool isHeightSpecified() const;
-    
     void updatePlayer();
+
+    IntSize m_cachedImageSize;
 };
 
 inline RenderVideo* toRenderVideo(RenderObject* object)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderView.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderView.cpp
index e2b4b045f1..4f76e8010b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderView.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderView.cpp
@@ -198,7 +198,7 @@ void RenderView::paintBoxDecorations(PaintInfo& paintInfo, int, int)
         if (baseColor.alpha() > 0) {
             paintInfo.context->save();
             paintInfo.context->setCompositeOperation(CompositeCopy);
-            paintInfo.context->fillRect(paintInfo.rect, baseColor);
+            paintInfo.context->fillRect(paintInfo.rect, baseColor, style()->colorSpace());
             paintInfo.context->restore();
         } else
             paintInfo.context->clearRect(paintInfo.rect);
@@ -326,7 +326,13 @@ IntRect RenderView::selectionBounds(bool clipToVisibleContent) const
     SelectionMap::iterator end = selectedObjects.end();
     for (SelectionMap::iterator i = selectedObjects.begin(); i != end; ++i) {
         RenderSelectionInfo* info = i->second;
-        selRect.unite(info->rect());
+        // RenderSelectionInfo::rect() is in the coordinates of the repaintContainer, so map to page coordinates.
+        IntRect currRect = info->rect();
+        if (RenderBoxModelObject* repaintContainer = info->repaintContainer()) {
+            FloatQuad absQuad = repaintContainer->localToAbsoluteQuad(FloatRect(currRect));
+            currRect = absQuad.enclosingBoundingBox(); 
+        }
+        selRect.unite(currRect);
         delete info;
     }
     return selRect;
@@ -425,7 +431,7 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
         o = o->nextInPreOrder();
     }
 
-    m_cachedSelectionBounds = IntRect();
+    m_layer->clearBlockSelectionGapsBounds();
 
     // Now that the selection state has been updated for the new objects, walk them again and
     // put them in the new objects list.
@@ -438,9 +444,7 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
                 RenderBlockSelectionInfo* blockInfo = newSelectedBlocks.get(cb);
                 if (blockInfo)
                     break;
-                blockInfo = new RenderBlockSelectionInfo(cb);
-                newSelectedBlocks.set(cb, blockInfo);
-                m_cachedSelectionBounds.unite(blockInfo->rects());
+                newSelectedBlocks.set(cb, new RenderBlockSelectionInfo(cb));
                 cb = cb->containingBlock();
             }
         }
@@ -517,7 +521,7 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
 
 void RenderView::clearSelection()
 {
-    repaintViewRectangle(m_cachedSelectionBounds);
+    m_layer->repaintBlockSelectionGaps();
     setSelection(0, -1, 0, -1, RepaintNewMinusOld);
 }
 
@@ -537,6 +541,8 @@ void RenderView::updateWidgetPositions()
     RenderWidgetSet::iterator end = m_widgets.end();
     for (RenderWidgetSet::iterator it = m_widgets.begin(); it != end; ++it)
         (*it)->updateWidgetPosition();
+    for (RenderWidgetSet::iterator it = m_widgets.begin(); it != end; ++it)
+        (*it)->widgetPositionsUpdated();
 }
 
 void RenderView::addWidget(RenderWidget* o)
@@ -648,6 +654,17 @@ void RenderView::pushLayoutState(RenderObject* root)
     m_layoutState = new (renderArena()) LayoutState(root);
 }
 
+bool RenderView::shouldDisableLayoutStateForSubtree(RenderObject* renderer) const
+{
+    RenderObject* o = renderer;
+    while (o) {
+        if (o->hasColumns() || o->hasTransform() || o->hasReflection())
+            return true;
+        o = o->container();
+    }
+    return false;
+}
+
 void RenderView::updateHitTestResult(HitTestResult& result, const IntPoint& point)
 {
     if (result.innerNode())
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderView.h b/src/3rdparty/webkit/WebCore/rendering/RenderView.h
index bc5db9e643..1e007e8af9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderView.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderView.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML widget for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2006 Apple Computer, Inc.
  *
@@ -77,9 +75,11 @@ public:
     bool printing() const;
     void setPrintImages(bool enable) { m_printImages = enable; }
     bool printImages() const { return m_printImages; }
-    void setTruncatedAt(int y) { m_truncatedAt = y; m_bestTruncatedAt = m_truncatorWidth = 0; m_forcedPageBreak = false; }
+    void setTruncatedAt(int y) { m_truncatedAt = y; m_bestTruncatedAt = m_truncatorWidth = 0; m_minimumColumnHeight = 0; m_forcedPageBreak = false; }
     void setBestTruncatedAt(int y, RenderBoxModelObject* forRenderer, bool forcedBreak = false);
+    void setMinimumColumnHeight(int height) { m_minimumColumnHeight = height; }
     int bestTruncatedAt() const { return m_bestTruncatedAt; }
+    int minimumColumnHeight() const { return m_minimumColumnHeight; }
 
     int truncatedAt() const { return m_truncatedAt; }
 
@@ -140,6 +140,8 @@ public:
         state->destroy(renderArena());
     }
 
+    bool shouldDisableLayoutStateForSubtree(RenderObject*) const;
+
     // Returns true if layoutState should be used for its cached offset and clip.
     bool layoutStateEnabled() const { return m_layoutStateDisableCount == 0 && m_layoutState; }
     LayoutState* layoutState() const { return m_layoutState; }
@@ -193,10 +195,9 @@ protected:
     RenderWidgetSet m_widgets;
 
 private:
-    IntRect m_cachedSelectionBounds;
-
     int m_bestTruncatedAt;
     int m_truncatorWidth;
+    int m_minimumColumnHeight;
     bool m_forcedPageBreak;
     LayoutState* m_layoutState;
     unsigned m_layoutStateDisableCount;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp
index 9af7137faf..561bead868 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp
@@ -23,8 +23,8 @@
 #include "config.h"
 #include "RenderWidget.h"
 
-#include "AnimationController.h"
 #include "AXObjectCache.h"
+#include "AnimationController.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
 #include "RenderView.h"
@@ -40,18 +40,65 @@ static HashMap<const Widget*, RenderWidget*>& widgetRendererMap()
     return *staticWidgetRendererMap;
 }
 
+static size_t widgetHierarchyUpdateSuspendCount;
+
+typedef HashMap<RefPtr<Widget>, FrameView*> WidgetToParentMap;
+
+static WidgetToParentMap& widgetNewParentMap()
+{
+    DEFINE_STATIC_LOCAL(WidgetToParentMap, map, ());
+    return map;
+}
+
+void RenderWidget::suspendWidgetHierarchyUpdates()
+{
+    widgetHierarchyUpdateSuspendCount++;
+}
+
+void RenderWidget::resumeWidgetHierarchyUpdates()
+{
+    ASSERT(widgetHierarchyUpdateSuspendCount);
+    if (widgetHierarchyUpdateSuspendCount == 1) {
+        WidgetToParentMap map = widgetNewParentMap();
+        widgetNewParentMap().clear();
+        WidgetToParentMap::iterator end = map.end();
+        for (WidgetToParentMap::iterator it = map.begin(); it != end; ++it) {
+            Widget* child = it->first.get();
+            ScrollView* currentParent = child->parent();
+            FrameView* newParent = it->second;
+            if (newParent != currentParent) {
+                if (currentParent)
+                    currentParent->removeChild(child);
+                if (newParent)
+                    newParent->addChild(child);
+            }
+        }
+    }
+    widgetHierarchyUpdateSuspendCount--;
+}
+
+static void moveWidgetToParentSoon(Widget* child, FrameView* parent)
+{
+    if (!widgetHierarchyUpdateSuspendCount) {
+        if (parent)
+            parent->addChild(child);
+        else
+            child->removeFromParent();
+        return;
+    }
+    widgetNewParentMap().set(child, parent);
+}
+
 RenderWidget::RenderWidget(Node* node)
     : RenderReplaced(node)
     , m_widget(0)
     , m_frameView(node->document()->view())
-    , m_refCount(0)
-{
-    view()->addWidget(this);
-
     // Reference counting is used to prevent the widget from being
     // destroyed while inside the Widget code, which might not be
     // able to handle that.
-    ref();
+    , m_refCount(1)
+{
+    view()->addWidget(this);
 }
 
 void RenderWidget::destroy()
@@ -62,14 +109,6 @@ void RenderWidget::destroy()
     // both RenderBox::destroy() and RenderObject::destroy().
     // Fix originally made for <rdar://problem/4228818>.
 
-    // <rdar://problem/6937089> suggests that node() can be null by the time we call renderArena()
-    // in the end of this function. One way this might happen is if this function was invoked twice
-    // in a row, so bail out and turn a crash into an assertion failure in debug builds and a leak
-    // in release builds.
-    ASSERT(node());
-    if (!node())
-        return;
-
     animation()->cancelAnimations(this);
 
     if (RenderView* v = view())
@@ -81,12 +120,8 @@ void RenderWidget::destroy()
     }
     remove();
 
-    if (m_widget) {
-        if (m_frameView)
-            m_frameView->removeChild(m_widget.get());
-        widgetRendererMap().remove(m_widget.get());
-    }
-    
+    setWidget(0);
+
     // removes from override size map
     if (hasOverrideSize())
         setOverrideSize(-1);
@@ -100,14 +135,6 @@ void RenderWidget::destroy()
         destroyLayer();
     }
 
-    // <rdar://problem/6937089> suggests that node() can be null here. One way this might happen is
-    // if this function was re-entered (and therefore the null check at the beginning did not fail),
-    // so bail out and turn a crash into an assertion failure in debug builds and a leak in release
-    // builds.
-    ASSERT(node());
-    if (!node())
-        return;
-
     // Grab the arena from node()->document()->renderArena() before clearing the node pointer.
     // Clear the node before deref-ing, as this may be deleted when deref is called.
     RenderArena* arena = renderArena();
@@ -121,39 +148,52 @@ RenderWidget::~RenderWidget()
     clearWidget();
 }
 
-void RenderWidget::setWidgetGeometry(const IntRect& frame)
+bool RenderWidget::setWidgetGeometry(const IntRect& frame)
 {
-    if (node() && m_widget->frameRect() != frame) {
-        RenderWidgetProtector protector(this);
-        RefPtr<Node> protectedNode(node());
-        m_widget->setFrameRect(frame);
-    }
+    ASSERT(!widgetHierarchyUpdateSuspendCount);
+    if (!node())
+        return false;
+
+    IntRect windowClipRect = m_frameView ? m_frameView->windowClipRectForLayer(enclosingLayer(), true) : IntRect();
+    bool clipChanged = m_windowClipRect != windowClipRect;
+    bool boundsChanged = m_widget->frameRect() != frame;
+
+    if (!boundsChanged && !clipChanged)
+        return false;
+
+    m_windowClipRect = windowClipRect;
+
+    RenderWidgetProtector protector(this);
+    RefPtr<Node> protectedNode(node());
+    m_widget->setFrameRect(frame);
+    return boundsChanged;
 }
 
 void RenderWidget::setWidget(PassRefPtr<Widget> widget)
 {
-    if (widget != m_widget) {
-        if (m_widget) {
-            m_widget->removeFromParent();
-            widgetRendererMap().remove(m_widget.get());
-            clearWidget();
-        }
-        m_widget = widget;
-        if (m_widget) {
-            widgetRendererMap().add(m_widget.get(), this);
-            // if we've already received a layout, apply the calculated space to the
-            // widget immediately, but we have to have really been full constructed (with a non-null
-            // style pointer).
-            if (style()) {
-                if (!needsLayout())
-                    setWidgetGeometry(absoluteContentBox());
-                if (style()->visibility() != VISIBLE)
-                    m_widget->hide();
-                else
-                    m_widget->show();
-            }
-            m_frameView->addChild(m_widget.get());
+    if (widget == m_widget)
+        return;
+
+    if (m_widget) {
+        moveWidgetToParentSoon(m_widget.get(), 0);
+        widgetRendererMap().remove(m_widget.get());
+        clearWidget();
+    }
+    m_widget = widget;
+    if (m_widget) {
+        widgetRendererMap().add(m_widget.get(), this);
+        // If we've already received a layout, apply the calculated space to the
+        // widget immediately, but we have to have really been fully constructed (with a non-null
+        // style pointer).
+        if (style()) {
+            if (!needsLayout())
+                setWidgetGeometry(absoluteContentBox());
+            if (style()->visibility() != VISIBLE)
+                m_widget->hide();
+            else
+                m_widget->show();
         }
+        moveWidgetToParentSoon(m_widget.get(), m_frameView);
     }
 }
 
@@ -221,19 +261,28 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
     }
 
     if (m_widget) {
-        // Move the widget if necessary.  We normally move and resize widgets during layout, but sometimes
-        // widgets can move without layout occurring (most notably when you scroll a document that
-        // contains fixed positioned elements).
-        m_widget->move(tx + borderLeft() + paddingLeft(), ty + borderTop() + paddingTop());
-
         // Tell the widget to paint now.  This is the only time the widget is allowed
         // to paint itself.  That way it will composite properly with z-indexed layers.
         if (m_substituteImage)
-            paintInfo.context->drawImage(m_substituteImage.get(), m_widget->frameRect());
-        else
-            m_widget->paint(paintInfo.context, paintInfo.rect);
+            paintInfo.context->drawImage(m_substituteImage.get(), style()->colorSpace(), m_widget->frameRect());
+        else {
+            IntPoint widgetLocation = m_widget->frameRect().location();
+            IntPoint paintLocation(tx + borderLeft() + paddingLeft(), ty + borderTop() + paddingTop());
+            IntRect paintRect = paintInfo.rect;
+
+            IntSize paintOffset = paintLocation - widgetLocation;
+            // When painting widgets into compositing layers, tx and ty are relative to the enclosing compositing layer,
+            // not the root. In this case, shift the CTM and adjust the paintRect to be root-relative to fix plug-in drawing.
+            if (!paintOffset.isZero()) {
+                paintInfo.context->translate(paintOffset);
+                paintRect.move(-paintOffset);
+            }
+            m_widget->paint(paintInfo.context, paintRect);
 
-        if (m_widget->isFrameView() && paintInfo.overlapTestRequests && !static_cast<FrameView*>(m_widget.get())->useSlowRepaints()) {
+            if (!paintOffset.isZero())
+                paintInfo.context->translate(-paintOffset);
+        }
+        if (m_widget->isFrameView() && paintInfo.overlapTestRequests && !static_cast<FrameView*>(m_widget.get())->useSlowRepaintsIfNotOverlapped()) {
             ASSERT(!paintInfo.overlapTestRequests->contains(this));
             paintInfo.overlapTestRequests->set(this, m_widget->frameRect());
         }
@@ -245,7 +294,7 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
     // Paint a partially transparent wash over selected widgets.
     if (isSelected() && !document()->printing()) {
         // FIXME: selectionRect() is in absolute, not painting coordinates.
-        paintInfo.context->fillRect(selectionRect(), selectionBackgroundColor());
+        paintInfo.context->fillRect(selectionRect(), selectionBackgroundColor(), style()->colorSpace());
     }
 }
 
@@ -274,15 +323,8 @@ void RenderWidget::updateWidgetPosition()
     int w = width() - borderLeft() - borderRight() - paddingLeft() - paddingRight();
     int h = height() - borderTop() - borderBottom() - paddingTop() - paddingBottom();
 
-    IntRect newBounds(absPos.x(), absPos.y(), w, h);
-    IntRect oldBounds(m_widget->frameRect());
-    bool boundsChanged = newBounds != oldBounds;
-    if (boundsChanged) {
-        RenderWidgetProtector protector(this);
-        RefPtr<Node> protectedNode(node());
-        m_widget->setFrameRect(newBounds);
-    }
-    
+    bool boundsChanged = setWidgetGeometry(IntRect(absPos.x(), absPos.y(), w, h));
+
     // if the frame bounds got changed, or if view needs layout (possibly indicating
     // content size is wrong) we have to do a layout to set the right widget size
     if (m_widget->isFrameView()) {
@@ -292,6 +334,13 @@ void RenderWidget::updateWidgetPosition()
     }
 }
 
+void RenderWidget::widgetPositionsUpdated()
+{
+    if (!m_widget)
+        return;
+    m_widget->widgetPositionsUpdated();
+}
+
 void RenderWidget::setSelectionState(SelectionState state)
 {
     if (selectionState() != state) {
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h
index 78537fdfa5..e57955600b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h
@@ -39,9 +39,14 @@ public:
     static RenderWidget* find(const Widget*);
 
     void updateWidgetPosition();
+    void widgetPositionsUpdated();
+    IntRect windowClipRect() const { return m_windowClipRect; }
 
     void showSubstituteImage(PassRefPtr<Image>);
 
+    static void suspendWidgetHierarchyUpdates();
+    static void resumeWidgetHierarchyUpdates();
+
 protected:
     RenderWidget(Node*);
 
@@ -51,17 +56,17 @@ protected:
 
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
     virtual void layout();
+    virtual void paint(PaintInfo&, int x, int y);
 
 private:
     virtual bool isWidget() const { return true; }
 
-    virtual void paint(PaintInfo&, int x, int y);
     virtual void destroy();
     virtual void setSelectionState(SelectionState);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
     virtual void setOverlapTestResult(bool);
 
-    void setWidgetGeometry(const IntRect&);
+    bool setWidgetGeometry(const IntRect&);
 
     friend class RenderWidgetProtector;
     RenderArena* ref() { ++m_refCount; return renderArena(); }
@@ -70,6 +75,7 @@ private:
     RefPtr<Widget> m_widget;
     RefPtr<Image> m_substituteImage;
     FrameView* m_frameView;
+    IntRect m_windowClipRect;
     int m_refCount;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.cpp
index c8e072ea79..23316f7104 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.cpp
@@ -21,6 +21,7 @@
 #include "RootInlineBox.h"
 
 #include "BidiResolver.h"
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "Document.h"
 #include "EllipsisBox.h"
diff --git a/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.h b/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.h
index b0b0e15daa..fae0cba0e0 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the line box implementation for KDE.
- *
  * Copyright (C) 2003, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ -51,8 +49,8 @@ public:
 
     void detachEllipsisBox(RenderArena*);
 
-    RootInlineBox* nextRootBox() const { return static_cast<RootInlineBox*>(m_nextLine); }
-    RootInlineBox* prevRootBox() const { return static_cast<RootInlineBox*>(m_prevLine); }
+    RootInlineBox* nextRootBox() const { return static_cast<RootInlineBox*>(m_nextLineBox); }
+    RootInlineBox* prevRootBox() const { return static_cast<RootInlineBox*>(m_prevLineBox); }
 
     virtual void adjustPosition(int dx, int dy);
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.cpp
index 900e0baed0..7e856725a5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.cpp
@@ -512,9 +512,9 @@ bool SVGChar::isHidden() const
     return pathData && pathData->hidden;
 }
 
-TransformationMatrix SVGChar::characterTransform() const
+AffineTransform SVGChar::characterTransform() const
 {
-    TransformationMatrix ctm;
+    AffineTransform ctm;
 
     // Rotate character around angle, and possibly scale.
     ctm.translate(x, y);
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.h b/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.h
index b5b4f3e00d..f0d1fa4b26 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.h
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.h
@@ -24,15 +24,15 @@
 #define SVGCharacterLayoutInfo_h
 
 #if ENABLE(SVG)
+#include "AffineTransform.h"
+#include "SVGRenderStyle.h"
+#include "SVGTextContentElement.h"
+
 #include <wtf/Assertions.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
-#include <wtf/Vector.h>
-
-#include "TransformationMatrix.h"
 #include <wtf/RefCounted.h>
-#include "SVGRenderStyle.h"
-#include "SVGTextContentElement.h"
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
@@ -234,7 +234,7 @@ struct SVGChar {
 
     // Helper methods
     bool isHidden() const;
-    TransformationMatrix characterTransform() const;
+    AffineTransform characterTransform() const;
 };
 
 struct SVGInlineBoxCharacterRange {
@@ -275,7 +275,7 @@ struct SVGTextChunk {
     // textLength & lengthAdjust support
     float textLength;
     ELengthAdjust lengthAdjust;
-    TransformationMatrix ctm;
+    AffineTransform ctm;
 
     // status flags
     bool isVerticalText : 1;
@@ -291,15 +291,12 @@ struct SVGTextChunk {
 struct SVGTextChunkWalkerBase {
     virtual ~SVGTextChunkWalkerBase() { }
 
-    virtual void operator()(SVGInlineTextBox* textBox, int startOffset, const TransformationMatrix& chunkCtm,
+    virtual void operator()(SVGInlineTextBox* textBox, int startOffset, const AffineTransform& chunkCtm,
                             const Vector<SVGChar>::iterator& start, const Vector<SVGChar>::iterator& end) = 0;
 
     // Followings methods are only used for painting text chunks
     virtual void start(InlineBox*) = 0;
     virtual void end(InlineBox*) = 0;
-    
-    virtual bool setupFill(InlineBox*) = 0;
-    virtual bool setupStroke(InlineBox*) = 0;
 };
 
 template<typename CallbackClass>
@@ -307,7 +304,7 @@ struct SVGTextChunkWalker : public SVGTextChunkWalkerBase {
 public:
     typedef void (CallbackClass::*SVGTextChunkWalkerCallback)(SVGInlineTextBox* textBox,
                                                               int startOffset,
-                                                              const TransformationMatrix& chunkCtm,
+                                                              const AffineTransform& chunkCtm,
                                                               const Vector<SVGChar>::iterator& start,
                                                               const Vector<SVGChar>::iterator& end);
 
@@ -315,27 +312,20 @@ public:
     typedef void (CallbackClass::*SVGTextChunkStartCallback)(InlineBox* box);
     typedef void (CallbackClass::*SVGTextChunkEndCallback)(InlineBox* box);
 
-    typedef bool (CallbackClass::*SVGTextChunkSetupFillCallback)(InlineBox* box);
-    typedef bool (CallbackClass::*SVGTextChunkSetupStrokeCallback)(InlineBox* box);
-
-    SVGTextChunkWalker(CallbackClass* object,
+    SVGTextChunkWalker(CallbackClass* object, 
                        SVGTextChunkWalkerCallback walker,
                        SVGTextChunkStartCallback start = 0,
-                       SVGTextChunkEndCallback end = 0,
-                       SVGTextChunkSetupFillCallback fill = 0,
-                       SVGTextChunkSetupStrokeCallback stroke = 0)
+                       SVGTextChunkEndCallback end = 0)
         : m_object(object)
         , m_walkerCallback(walker)
         , m_startCallback(start)
         , m_endCallback(end)
-        , m_setupFillCallback(fill)
-        , m_setupStrokeCallback(stroke)
     {
         ASSERT(object);
         ASSERT(walker);
     }
 
-    virtual void operator()(SVGInlineTextBox* textBox, int startOffset, const TransformationMatrix& chunkCtm,
+    virtual void operator()(SVGInlineTextBox* textBox, int startOffset, const AffineTransform& chunkCtm,
                             const Vector<SVGChar>::iterator& start, const Vector<SVGChar>::iterator& end)
     {
         (*m_object.*m_walkerCallback)(textBox, startOffset, chunkCtm, start, end);
@@ -358,31 +348,11 @@ public:
             ASSERT_NOT_REACHED();
     }
 
-    virtual bool setupFill(InlineBox* box)
-    {
-        if (m_setupFillCallback)
-            return (*m_object.*m_setupFillCallback)(box);
-
-        ASSERT_NOT_REACHED();
-        return false;
-    }
-
-    virtual bool setupStroke(InlineBox* box)
-    {
-        if (m_setupStrokeCallback)
-            return (*m_object.*m_setupStrokeCallback)(box);
-
-        ASSERT_NOT_REACHED();
-        return false;
-    }
-
 private:
     CallbackClass* m_object;
     SVGTextChunkWalkerCallback m_walkerCallback;
     SVGTextChunkStartCallback m_startCallback;
     SVGTextChunkEndCallback m_endCallback;
-    SVGTextChunkSetupFillCallback m_setupFillCallback;
-    SVGTextChunkSetupStrokeCallback m_setupStrokeCallback;
 };
 
 struct SVGTextChunkLayoutInfo {
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.cpp
index d0fa9ae0ca..65aa5a14e1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2007 Rob Buis <buis@kde.org>
  *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  *
@@ -110,9 +108,7 @@ FloatRect SVGInlineTextBox::calculateGlyphBoundaries(RenderStyle* style, int off
     FloatRect glyphRect(x1, y1, x2 - x1, y2 - y1);
 
     // Take per-character transformations into account
-    TransformationMatrix ctm = svgChar.characterTransform();
-    if (!ctm.isIdentity())
-        glyphRect = ctm.mapRect(glyphRect);
+    glyphRect = svgChar.characterTransform().mapRect(glyphRect);
 
     return glyphRect;
 }
@@ -128,7 +124,7 @@ struct SVGInlineTextBoxClosestCharacterToPositionWalker {
     {
     }
 
-    void chunkPortionCallback(SVGInlineTextBox* textBox, int startOffset, const TransformationMatrix& chunkCtm,
+    void chunkPortionCallback(SVGInlineTextBox* textBox, int startOffset, const AffineTransform& chunkCtm,
                               const Vector<SVGChar>::iterator& start, const Vector<SVGChar>::iterator& end)
     {
         RenderStyle* style = textBox->textRenderer()->style();
@@ -195,7 +191,7 @@ struct SVGInlineTextBoxSelectionRectWalker {
     {
     }
 
-    void chunkPortionCallback(SVGInlineTextBox* textBox, int startOffset, const TransformationMatrix& chunkCtm,
+    void chunkPortionCallback(SVGInlineTextBox* textBox, int startOffset, const AffineTransform& chunkCtm,
                               const Vector<SVGChar>::iterator& start, const Vector<SVGChar>::iterator& end)
     {
         RenderStyle* style = textBox->textRenderer()->style();
@@ -326,7 +322,33 @@ IntRect SVGInlineTextBox::selectionRect(int, int, int startPos, int endPos)
     return enclosingIntRect(walkerCallback.selectionRect());
 }
 
-void SVGInlineTextBox::paintCharacters(RenderObject::PaintInfo& paintInfo, int tx, int ty, const SVGChar& svgChar, const UChar* chars, int length, SVGPaintServer* activePaintServer)
+bool SVGInlineTextBox::chunkSelectionStartEnd(const UChar* chunk, int chunkLength, int& selectionStart, int& selectionEnd)
+{
+    // NOTE: We ignore SVGInlineTextBox::m_start here because it is always 0.
+    //       Curently SVG doesn't use HTML block-level layout, in which m_start would be set.
+
+    int chunkStart = chunk - textRenderer()->characters();
+    ASSERT(0 <= chunkStart);    
+
+    selectionStartEnd(selectionStart, selectionEnd);
+    if (selectionEnd <= chunkStart)
+        return false;
+    if (chunkStart + chunkLength <= selectionStart)
+        return false;
+
+    // Map indices from view-global to chunk-local.
+    selectionStart -= chunkStart;
+    selectionEnd -= chunkStart;
+    // Then clamp with chunk range
+    if (selectionStart < 0)
+        selectionStart = 0;
+    if (chunkLength < selectionEnd)
+        selectionEnd = chunkLength;
+
+    return selectionStart < selectionEnd;
+}
+
+void SVGInlineTextBox::paintCharacters(RenderObject::PaintInfo& paintInfo, int tx, int ty, const SVGChar& svgChar, const UChar* chars, int length, SVGTextPaintInfo& textPaintInfo)
 {
     if (renderer()->style()->visibility() != VISIBLE || paintInfo.phase == PaintPhaseOutline)
         return;
@@ -352,13 +374,13 @@ void SVGInlineTextBox::paintCharacters(RenderObject::PaintInfo& paintInfo, int t
     RenderStyle* styleToUse = text->style(isFirstLineStyle());
     const Font& font = styleToUse->font();
 
-    TransformationMatrix ctm = svgChar.characterTransform();
+    AffineTransform ctm = svgChar.characterTransform();
     if (!ctm.isIdentity())
         paintInfo.context->concatCTM(ctm);
 
     // 1. Paint backgrounds behind text if needed.  Examples of such backgrounds include selection
     // and marked text.
-    if (paintInfo.phase != PaintPhaseSelection && !isPrinting) {
+    if (paintInfo.phase != PaintPhaseSelection && !isPrinting && textPaintInfo.subphase == SVGTextPaintSubphaseBackground) {
 #if PLATFORM(MAC)
         // Custom highlighters go behind everything else.
         if (styleToUse->highlight() != nullAtom && !paintInfo.context->paintingDisabled())
@@ -378,28 +400,52 @@ void SVGInlineTextBox::paintCharacters(RenderObject::PaintInfo& paintInfo, int t
         }
     }
 
-    // Set a text shadow if we have one.
-    // FIXME: Support multiple shadow effects.  Need more from the CG API before
-    // we can do this.
-    bool setShadow = false;
-    if (styleToUse->textShadow()) {
-        paintInfo.context->setShadow(IntSize(styleToUse->textShadow()->x, styleToUse->textShadow()->y),
-                                     styleToUse->textShadow()->blur, styleToUse->textShadow()->color);
-        setShadow = true;
-    }
+    bool isGlyphPhase = textPaintInfo.subphase == SVGTextPaintSubphaseGlyphFill || textPaintInfo.subphase == SVGTextPaintSubphaseGlyphStroke;
+    bool isSelectionGlyphPhase = textPaintInfo.subphase == SVGTextPaintSubphaseGlyphFillSelection || textPaintInfo.subphase == SVGTextPaintSubphaseGlyphStrokeSelection;
+
+    if  (isGlyphPhase || isSelectionGlyphPhase) {
+        // Set a text shadow if we have one.
+        // FIXME: Support multiple shadow effects.  Need more from the CG API before
+        // we can do this.
+        bool setShadow = false;
+        if (styleToUse->textShadow()) {
+            paintInfo.context->setShadow(IntSize(styleToUse->textShadow()->x, styleToUse->textShadow()->y),
+                                         styleToUse->textShadow()->blur, styleToUse->textShadow()->color,
+                                         styleToUse->colorSpace());
+            setShadow = true;
+        }
 
-    IntPoint origin((int) svgChar.x, (int) svgChar.y);
-    TextRun run = svgTextRunForInlineTextBox(chars, length, styleToUse, this, svgChar.x);
+        IntPoint origin((int) svgChar.x, (int) svgChar.y);
+        TextRun run = svgTextRunForInlineTextBox(chars, length, styleToUse, this, svgChar.x);
 
 #if ENABLE(SVG_FONTS)
-    // SVG Fonts need access to the paint server used to draw the current text chunk.
-    // They need to be able to call renderPath() on a SVGPaintServer object.
-    run.setActivePaintServer(activePaintServer);
+        // SVG Fonts need access to the paint server used to draw the current text chunk.
+        // They need to be able to call renderPath() on a SVGPaintServer object.
+        ASSERT(textPaintInfo.activePaintServer);
+        run.setActivePaintServer(textPaintInfo.activePaintServer);
 #endif
 
-    paintInfo.context->drawText(font, run, origin);
+        int selectionStart = 0;
+        int selectionEnd = 0;
+        bool haveSelectedRange = haveSelection && chunkSelectionStartEnd(chars, length, selectionStart, selectionEnd);
+        
+        if (isGlyphPhase) {
+            if (haveSelectedRange) {
+                paintInfo.context->drawText(font, run, origin, 0, selectionStart);
+                paintInfo.context->drawText(font, run, origin, selectionEnd, run.length());
+            } else
+                paintInfo.context->drawText(font, run, origin);
+        } else {
+            ASSERT(isSelectionGlyphPhase);
+            if (haveSelectedRange)
+                paintInfo.context->drawText(font, run, origin, selectionStart, selectionEnd);
+        }
+
+        if (setShadow)
+            paintInfo.context->clearShadow();
+    }
 
-    if (paintInfo.phase != PaintPhaseSelection) {
+    if (paintInfo.phase != PaintPhaseSelection && textPaintInfo.subphase == SVGTextPaintSubphaseForeground) {
         paintDocumentMarkers(paintInfo.context, tx, ty, styleToUse, font, false);
 
         if (useCustomUnderlines) {
@@ -429,9 +475,6 @@ void SVGInlineTextBox::paintCharacters(RenderObject::PaintInfo& paintInfo, int t
         
     }
 
-    if (setShadow)
-        paintInfo.context->clearShadow();
-
     if (!ctm.isIdentity())
         paintInfo.context->concatCTM(ctm.inverse());
 }
@@ -477,7 +520,7 @@ void SVGInlineTextBox::paintSelection(int boxStartOffset, const SVGChar& svgChar
     int adjust = startPos >= boxStartOffset ? boxStartOffset : 0;
     p->drawHighlightForText(font, svgTextRunForInlineTextBox(textRenderer()->text()->characters() + start() + boxStartOffset, length, style, this, svgChar.x),
                             IntPoint((int) svgChar.x, (int) svgChar.y - font.ascent()),
-                            font.ascent() + font.descent(), color, startPos - adjust, endPos - adjust);
+                            font.ascent() + font.descent(), color, style->colorSpace(), startPos - adjust, endPos - adjust);
 
     p->restore();
 }
@@ -521,7 +564,7 @@ void SVGInlineTextBox::paintDecoration(ETextDecoration decoration, GraphicsConte
     context->save();
     context->beginPath();
 
-    TransformationMatrix ctm = svgChar.characterTransform();
+    AffineTransform ctm = svgChar.characterTransform();
     if (!ctm.isIdentity())
         context->concatCTM(ctm);
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.h b/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.h
index 76837ccdfa..596fdf325b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2007 Rob Buis <buis@kde.org>
  *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  *
@@ -34,6 +32,22 @@ namespace WebCore {
     struct SVGChar;
     struct SVGTextDecorationInfo;
 
+    enum SVGTextPaintSubphase {
+        SVGTextPaintSubphaseBackground,
+        SVGTextPaintSubphaseGlyphFill,
+        SVGTextPaintSubphaseGlyphFillSelection,
+        SVGTextPaintSubphaseGlyphStroke,
+        SVGTextPaintSubphaseGlyphStrokeSelection,
+        SVGTextPaintSubphaseForeground
+    };
+
+    struct SVGTextPaintInfo {
+        SVGTextPaintInfo() : activePaintServer(0), subphase(SVGTextPaintSubphaseBackground) {}
+
+        SVGPaintServer* activePaintServer;
+        SVGTextPaintSubphase subphase;
+    };
+
     class SVGInlineTextBox : public InlineTextBox {
     public:
         SVGInlineTextBox(RenderObject* obj);
@@ -51,7 +65,7 @@ namespace WebCore {
         virtual IntRect selectionRect(int absx, int absy, int startPos, int endPos);
 
         // SVGs custom paint text method
-        void paintCharacters(RenderObject::PaintInfo&, int tx, int ty, const SVGChar&, const UChar* chars, int length, SVGPaintServer*);
+        void paintCharacters(RenderObject::PaintInfo&, int tx, int ty, const SVGChar&, const UChar* chars, int length, SVGTextPaintInfo&);
 
         // SVGs custom paint selection method
         void paintSelection(int boxStartOffset, const SVGChar&, const UChar*, int length, GraphicsContext*, RenderStyle*, const Font&);
@@ -71,6 +85,7 @@ namespace WebCore {
     private:
         friend class RenderSVGInlineText;
         bool svgCharacterHitsPosition(int x, int y, int& offset) const;
+        bool chunkSelectionStartEnd(const UChar* chunk, int chunkLength, int& selectionStart, int& selectionEnd);
         
         int m_height;
     };
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGMarkerData.h b/src/3rdparty/webkit/WebCore/rendering/SVGMarkerData.h
new file mode 100644
index 0000000000..5ff29939cc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGMarkerData.h
@@ -0,0 +1,134 @@
+/*
+    Copyright (C) Research In Motion Limited 2010. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    aint with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef SVGMarkerData_h
+#define SVGMarkerData_h
+
+#if ENABLE(SVG)
+#include "FloatConversion.h"
+#include "Path.h"
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+class SVGResourceMarker;
+
+class SVGMarkerData {
+public:
+    enum Type {
+        Unknown = 0,
+        Start,
+        Mid,
+        End
+    };
+
+    SVGMarkerData(const Type& type = Unknown, SVGResourceMarker* marker = 0)
+        : m_type(type)
+        , m_marker(marker)
+    {
+    }
+
+    FloatPoint origin() const { return m_origin; }
+    SVGResourceMarker* marker() const { return m_marker; }
+
+    float currentAngle() const
+    {
+        FloatSize inslopeChange = m_inslopePoints[1] - m_inslopePoints[0];
+        FloatSize outslopeChange = m_outslopePoints[1] - m_outslopePoints[0];
+
+        double inslope = rad2deg(atan2(inslopeChange.height(), inslopeChange.width()));
+        double outslope = rad2deg(atan2(outslopeChange.height(), outslopeChange.width()));
+
+        double angle = 0;
+        switch (m_type) {
+        case Start:
+            angle = outslope;
+            break;
+        case Mid:
+            angle = (inslope + outslope) / 2;
+            break;
+        case End:
+            angle = inslope;
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            break;
+        }
+
+        return narrowPrecisionToFloat(angle);
+    }
+
+    void updateTypeAndMarker(const Type& type, SVGResourceMarker* marker)
+    {
+        m_type = type;
+        m_marker = marker;
+    }
+
+    void updateOutslope(const FloatPoint& point)
+    {
+        m_outslopePoints[0] = m_origin;
+        m_outslopePoints[1] = point;
+    }
+
+    void updateMarkerDataForPathElement(const PathElement* element)
+    {
+        FloatPoint* points = element->points;
+
+        switch (element->type) {
+        case PathElementAddQuadCurveToPoint:
+            // FIXME: https://bugs.webkit.org/show_bug.cgi?id=33115 (PathElementAddQuadCurveToPoint not handled for <marker>)
+            m_origin = points[1];
+            break;
+        case PathElementAddCurveToPoint:
+            m_inslopePoints[0] = points[1];
+            m_inslopePoints[1] = points[2];
+            m_origin = points[2];
+            break;
+        case PathElementMoveToPoint:
+            m_subpathStart = points[0];
+        case PathElementAddLineToPoint:
+            updateInslope(points[0]);
+            m_origin = points[0];
+            break;
+        case PathElementCloseSubpath:
+            updateInslope(points[0]);
+            m_origin = m_subpathStart;
+            m_subpathStart = FloatPoint();
+        }
+    }
+
+private:
+    void updateInslope(const FloatPoint& point)
+    {
+        m_inslopePoints[0] = m_origin;
+        m_inslopePoints[1] = point;
+    }
+
+    Type m_type;
+    SVGResourceMarker* m_marker;
+    FloatPoint m_origin;
+    FloatPoint m_subpathStart;
+    FloatPoint m_inslopePoints[2];
+    FloatPoint m_outslopePoints[2];
+};
+
+}
+
+#endif // ENABLE(SVG)
+#endif // SVGMarkerData_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGMarkerLayoutInfo.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGMarkerLayoutInfo.cpp
new file mode 100644
index 0000000000..3fe513f527
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGMarkerLayoutInfo.cpp
@@ -0,0 +1,124 @@
+/*
+    Copyright (C) Research In Motion Limited 2010. All rights reserved.
+                  2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
+                  2004, 2005, 2008 Rob Buis <buis@kde.org>
+                  2005, 2007 Eric Seidel <eric@webkit.org>
+                  2009 Google, Inc.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    aint with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "SVGMarkerLayoutInfo.h"
+
+#include "RenderSVGViewportContainer.h"
+#include "SVGResourceMarker.h"
+
+namespace WebCore {
+
+SVGMarkerLayoutInfo::SVGMarkerLayoutInfo()
+    : m_midMarker(0)
+    , m_elementIndex(0)
+    , m_strokeWidth(0)
+{
+}
+
+SVGMarkerLayoutInfo::~SVGMarkerLayoutInfo()
+{
+}
+
+static inline void processStartAndMidMarkers(void* infoPtr, const PathElement* element)
+{
+    SVGMarkerLayoutInfo& info = *reinterpret_cast<SVGMarkerLayoutInfo*>(infoPtr);
+    SVGMarkerData& markerData = info.markerData();
+    int& elementIndex = info.elementIndex();
+
+    // First update the outslope for the previous element
+    markerData.updateOutslope(element->points[0]);
+
+    // Draw the marker for the previous element
+    SVGResourceMarker* marker = markerData.marker();
+    if (elementIndex > 0 && marker)
+        info.addLayoutedMarker(marker, markerData.origin(), markerData.currentAngle());
+
+    // Update our marker data for this element
+    markerData.updateMarkerDataForPathElement(element);
+
+    // After drawing the start marker, switch to drawing mid markers
+    if (elementIndex == 1)
+        markerData.updateTypeAndMarker(SVGMarkerData::Mid, info.midMarker());
+
+    ++elementIndex;
+}
+
+FloatRect SVGMarkerLayoutInfo::calculateBoundaries(SVGResourceMarker* startMarker, SVGResourceMarker* midMarker, SVGResourceMarker* endMarker, float strokeWidth, const Path& path)
+{
+    m_layout.clear();
+    m_midMarker = midMarker;
+    m_strokeWidth = strokeWidth;
+    m_elementIndex = 0;
+    m_markerData = SVGMarkerData(SVGMarkerData::Start, startMarker);
+    path.apply(this, processStartAndMidMarkers);
+
+    if (endMarker) {
+        m_markerData.updateTypeAndMarker(SVGMarkerData::End, endMarker);
+        addLayoutedMarker(endMarker, m_markerData.origin(), m_markerData.currentAngle());
+    }
+
+    if (m_layout.isEmpty())
+        return FloatRect();
+
+    Vector<MarkerLayout>::iterator it = m_layout.begin();
+    Vector<MarkerLayout>::iterator end = m_layout.end();
+
+    FloatRect bounds;
+    for (; it != end; ++it) {
+        MarkerLayout& layout = *it;
+
+        RenderSVGViewportContainer* markerContent = layout.marker->renderer();
+        ASSERT(markerContent);
+
+        bounds.unite(markerContent->markerBoundaries(layout.matrix));
+    }
+
+    return bounds;
+}
+
+void SVGMarkerLayoutInfo::drawMarkers(RenderObject::PaintInfo& paintInfo)
+{
+    if (m_layout.isEmpty())
+        return;
+
+    Vector<MarkerLayout>::iterator it = m_layout.begin();
+    Vector<MarkerLayout>::iterator end = m_layout.end();
+
+    for (; it != end; ++it) {
+        MarkerLayout& layout = *it;
+        layout.marker->draw(paintInfo, layout.matrix);
+    }
+}
+
+void SVGMarkerLayoutInfo::addLayoutedMarker(SVGResourceMarker* marker, const FloatPoint& origin, float angle)
+{
+    ASSERT(marker);
+    m_layout.append(MarkerLayout(marker, marker->markerTransformation(origin, angle, m_strokeWidth)));
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGMarkerLayoutInfo.h b/src/3rdparty/webkit/WebCore/rendering/SVGMarkerLayoutInfo.h
new file mode 100644
index 0000000000..517c993eb6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGMarkerLayoutInfo.h
@@ -0,0 +1,74 @@
+/*
+    Copyright (C) Research In Motion Limited 2010. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    aint with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef SVGMarkerLayoutInfo_h
+#define SVGMarkerLayoutInfo_h
+
+#if ENABLE(SVG)
+#include "RenderObject.h"
+#include "SVGMarkerData.h"
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class Path;
+class SVGResourceMarker;
+
+struct MarkerLayout {
+    MarkerLayout(SVGResourceMarker* markerObj = 0, AffineTransform matrixObj = AffineTransform())
+        : marker(markerObj)
+        , matrix(matrixObj)
+    {
+        ASSERT(marker);
+    }
+
+    SVGResourceMarker* marker;
+    AffineTransform matrix;
+};
+
+class SVGMarkerLayoutInfo : public Noncopyable {
+public:
+    SVGMarkerLayoutInfo();
+    ~SVGMarkerLayoutInfo();
+
+    FloatRect calculateBoundaries(SVGResourceMarker* startMarker, SVGResourceMarker* midMarker, SVGResourceMarker* endMarker, float strokeWidth, const Path&);
+    void drawMarkers(RenderObject::PaintInfo&);
+
+    // Used by static inline helper functions in SVGMarkerLayoutInfo.cpp
+    SVGMarkerData& markerData() { return m_markerData; }
+    SVGResourceMarker* midMarker() const { return m_midMarker; }
+    int& elementIndex() { return m_elementIndex; }
+    void addLayoutedMarker(SVGResourceMarker*, const FloatPoint& origin, float angle);
+
+private:
+    SVGResourceMarker* m_midMarker;
+
+    // Used while layouting markers
+    int m_elementIndex;
+    SVGMarkerData m_markerData;
+    float m_strokeWidth;
+
+    // Holds the final computed result
+    Vector<MarkerLayout> m_layout;
+};
+
+}
+
+#endif // ENABLE(SVG)
+#endif // SVGMarkerLayoutInfo_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
index ea087f9031..284a9da7d0 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
@@ -2,7 +2,9 @@
  * Copyright (C) 2007, 2008 Rob Buis <buis@kde.org>
  *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  *           (C) 2007 Eric Seidel <eric@webkit.org>
- * Copyright (C) 2009 Google, Inc.  All rights reserved.
+ *           (C) 2009 Google, Inc.  All rights reserved.
+ *           (C) 2009 Dirk Schulze <krit@webkit.org>
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,21 +28,27 @@
 #if ENABLE(SVG)
 #include "SVGRenderSupport.h"
 
+#include "AffineTransform.h"
+#include "Document.h"
 #include "ImageBuffer.h"
 #include "RenderObject.h"
 #include "RenderSVGContainer.h"
+#include "RenderSVGResource.h"
+#include "RenderSVGResourceClipper.h"
+#include "RenderSVGResourceMasker.h"
 #include "RenderView.h"
-#include "SVGResourceClipper.h"
 #include "SVGResourceFilter.h"
-#include "SVGResourceMasker.h"
 #include "SVGStyledElement.h"
 #include "SVGURIReference.h"
 #include "TransformState.h"
-#include "TransformationMatrix.h"
 #include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
+SVGRenderBase::~SVGRenderBase()
+{
+}
+
 IntRect SVGRenderBase::clippedOverflowRectForRepaint(RenderObject* object, RenderBoxModelObject* repaintContainer)
 {
     // Return early for any cases where we don't actually paint
@@ -56,6 +64,8 @@ IntRect SVGRenderBase::clippedOverflowRectForRepaint(RenderObject* object, Rende
 
 void SVGRenderBase::computeRectForRepaint(RenderObject* object, RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
 {
+    object->style()->svgStyle()->inflateForShadow(repaintRect);
+
     // Translate to coords in our parent renderer, and then call computeRectForRepaint on our parent
     repaintRect = object->localToParentTransform().mapRect(repaintRect);
     object->parent()->computeRectForRepaint(repaintContainer, repaintRect, fixed);
@@ -64,12 +74,12 @@ void SVGRenderBase::computeRectForRepaint(RenderObject* object, RenderBoxModelOb
 void SVGRenderBase::mapLocalToContainer(const RenderObject* object, RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState)
 {
     ASSERT(!fixed); // We should have no fixed content in the SVG rendering tree.
-    ASSERT(useTransforms); // mapping a point through SVG w/o respecting trasnforms is useless.
+    ASSERT(useTransforms); // Mapping a point through SVG w/o respecting transforms is useless.
     transformState.applyTransform(object->localToParentTransform());
     object->parent()->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
 }
 
-void SVGRenderBase::prepareToRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& paintInfo, const FloatRect& boundingBox, SVGResourceFilter*& filter, SVGResourceFilter* rootFilter)
+bool SVGRenderBase::prepareToRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& paintInfo, const FloatRect& repaintRect, SVGResourceFilter*& filter, SVGResourceFilter* rootFilter)
 {
 #if !ENABLE(FILTERS)
     UNUSED_PARAM(filter);
@@ -90,12 +100,15 @@ void SVGRenderBase::prepareToRenderSVGContent(RenderObject* object, RenderObject
     // Setup transparency layers before setting up filters!
     float opacity = style->opacity(); 
     if (opacity < 1.0f) {
-        paintInfo.context->clip(enclosingIntRect(boundingBox));
+        paintInfo.context->clip(repaintRect);
         paintInfo.context->beginTransparencyLayer(opacity);
     }
 
-    if (ShadowData* shadow = svgStyle->shadow())
-        paintInfo.context->setShadow(IntSize(shadow->x, shadow->y), shadow->blur, shadow->color); 
+    if (ShadowData* shadow = svgStyle->shadow()) {
+        paintInfo.context->clip(repaintRect);
+        paintInfo.context->setShadow(IntSize(shadow->x, shadow->y), shadow->blur, shadow->color, style->colorSpace());
+        paintInfo.context->beginTransparencyLayer(1.0f);
+    }
 
 #if ENABLE(FILTERS)
     AtomicString filterId(svgStyle->filter());
@@ -107,7 +120,7 @@ void SVGRenderBase::prepareToRenderSVGContent(RenderObject* object, RenderObject
     Document* document = object->document();
 
 #if ENABLE(FILTERS)
-    SVGResourceFilter* newFilter = getFilterById(document, filterId);
+    SVGResourceFilter* newFilter = getFilterById(document, filterId, object);
     if (newFilter == rootFilter) {
         // Catch <text filter="url(#foo)">Test<tspan filter="url(#foo)">123</tspan></text>.
         // The filter is NOT meant to be applied twice in that case!
@@ -117,28 +130,27 @@ void SVGRenderBase::prepareToRenderSVGContent(RenderObject* object, RenderObject
         filter = newFilter;
 #endif
 
-    SVGResourceClipper* clipper = getClipperById(document, clipperId);
-    SVGResourceMasker* masker = getMaskerById(document, maskerId);
+    if (RenderSVGResourceMasker* masker = getRenderSVGResourceById<RenderSVGResourceMasker>(document, maskerId)) {
+        if (!masker->applyResource(object, paintInfo.context))
+            return false;
+    } else if (!maskerId.isEmpty())
+        svgElement->document()->accessSVGExtensions()->addPendingResource(maskerId, styledElement);
+
+    if (RenderSVGResourceClipper* clipper = getRenderSVGResourceById<RenderSVGResourceClipper>(document, clipperId))
+        clipper->applyResource(object, paintInfo.context);
+    else if (!clipperId.isEmpty())
+        svgElement->document()->accessSVGExtensions()->addPendingResource(clipperId, styledElement);
 
 #if ENABLE(FILTERS)
     if (filter) {
         filter->addClient(styledElement);
-        filter->prepareFilter(paintInfo.context, object);
+        if (!filter->prepareFilter(paintInfo.context, object))
+            return false;
     } else if (!filterId.isEmpty())
         svgElement->document()->accessSVGExtensions()->addPendingResource(filterId, styledElement);
 #endif
 
-    if (clipper) {
-        clipper->addClient(styledElement);
-        clipper->applyClip(paintInfo.context, boundingBox);
-    } else if (!clipperId.isEmpty())
-        svgElement->document()->accessSVGExtensions()->addPendingResource(clipperId, styledElement);
-
-    if (masker) {
-        masker->addClient(styledElement);
-        masker->applyMask(paintInfo.context, boundingBox);
-    } else if (!maskerId.isEmpty())
-        svgElement->document()->accessSVGExtensions()->addPendingResource(maskerId, styledElement);
+    return true;
 }
 
 void SVGRenderBase::finishRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& paintInfo, SVGResourceFilter*& filter, GraphicsContext* savedContext)
@@ -163,6 +175,11 @@ void SVGRenderBase::finishRenderSVGContent(RenderObject* object, RenderObject::P
     float opacity = style->opacity();    
     if (opacity < 1.0f)
         paintInfo.context->endTransparencyLayer();
+
+    // This needs to be done separately from opacity, because if both properties are set,
+    // then the transparency layers are nested. 
+    if (style->svgStyle()->shadow())
+        paintInfo.context->endTransparencyLayer();
 }
 
 void renderSubtreeToImage(ImageBuffer* image, RenderObject* item)
@@ -218,19 +235,81 @@ FloatRect SVGRenderBase::computeContainerBoundingBox(const RenderObject* contain
     return boundingBox;
 }
 
-FloatRect SVGRenderBase::filterBoundingBoxForRenderer(const RenderObject* object)
+void SVGRenderBase::layoutChildren(RenderObject* start, bool selfNeedsLayout)
+{
+    for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) {
+        // Only force our kids to layout if we're being asked to relayout as a result of a parent changing
+        // FIXME: We should be able to skip relayout of non-relative kids when only bounds size has changed
+        // that's a possible future optimization using LayoutState
+        // http://bugs.webkit.org/show_bug.cgi?id=15391
+        bool needsLayout = selfNeedsLayout;
+        if (!needsLayout) {
+            if (SVGElement* element = child->node()->isSVGElement() ? static_cast<SVGElement*>(child->node()) : 0) {
+                if (element->isStyled())
+                    needsLayout = static_cast<SVGStyledElement*>(element)->hasRelativeValues();
+            }
+        }
+
+        if (needsLayout)
+            child->setNeedsLayout(true, false);
+
+        child->layoutIfNeeded();
+        ASSERT(!child->needsLayout());
+    }
+}
+
+bool SVGRenderBase::isOverflowHidden(const RenderObject* object)
+{
+    // SVG doesn't support independent x/y overflow
+    ASSERT(object->style()->overflowX() == object->style()->overflowY());
+
+    // OSCROLL is never set for SVG - see CSSStyleSelector::adjustRenderStyle
+    ASSERT(object->style()->overflowX() != OSCROLL);
+
+    // RenderSVGRoot should never query for overflow state - it should always clip itself to the initial viewport size.
+    ASSERT(!object->isRoot());
+
+    return object->style()->overflowX() == OHIDDEN;
+}
+
+FloatRect SVGRenderBase::filterBoundingBoxForRenderer(const RenderObject* object) const
 {
 #if ENABLE(FILTERS)
-    SVGResourceFilter* filter = getFilterById(object->document(), object->style()->svgStyle()->filter());
+    SVGResourceFilter* filter = getFilterById(object->document(), object->style()->svgStyle()->filter(), object);
     if (filter)
-        return filter->filterBoundingBox();
+        return filter->filterBoundingBox(object->objectBoundingBox());
 #else
     UNUSED_PARAM(object);
 #endif
     return FloatRect();
 }
 
-void applyTransformToPaintInfo(RenderObject::PaintInfo& paintInfo, const TransformationMatrix& localToAncestorTransform)
+FloatRect SVGRenderBase::clipperBoundingBoxForRenderer(const RenderObject* object) const
+{
+    if (RenderSVGResourceClipper* clipper = getRenderSVGResourceById<RenderSVGResourceClipper>(object->document(), object->style()->svgStyle()->clipPath()))
+        return clipper->resourceBoundingBox(object->objectBoundingBox());
+
+    return FloatRect();
+}
+
+FloatRect SVGRenderBase::maskerBoundingBoxForRenderer(const RenderObject* object) const
+{
+    if (RenderSVGResourceMasker* masker = getRenderSVGResourceById<RenderSVGResourceMasker>(object->document(), object->style()->svgStyle()->maskElement()))
+        return masker->resourceBoundingBox(object->objectBoundingBox());
+
+    return FloatRect();
+}
+
+void SVGRenderBase::deregisterFromResources(RenderObject* object)
+{
+    // We only have the renderer for masker and clipper at the moment.
+    if (RenderSVGResourceMasker* masker = getRenderSVGResourceById<RenderSVGResourceMasker>(object->document(), object->style()->svgStyle()->maskElement()))
+        masker->invalidateClient(object);
+    if (RenderSVGResourceClipper* clipper = getRenderSVGResourceById<RenderSVGResourceClipper>(object->document(), object->style()->svgStyle()->clipPath()))
+        clipper->invalidateClient(object);
+}
+
+void applyTransformToPaintInfo(RenderObject::PaintInfo& paintInfo, const AffineTransform& localToAncestorTransform)
 {
     if (localToAncestorTransform.isIdentity())
         return;
@@ -239,6 +318,16 @@ void applyTransformToPaintInfo(RenderObject::PaintInfo& paintInfo, const Transfo
     paintInfo.rect = localToAncestorTransform.inverse().mapRect(paintInfo.rect);
 }
 
-} // namespace WebCore
+const RenderObject* findTextRootObject(const RenderObject* start)
+{
+    while (start && !start->isSVGText())
+        start = start->parent();
+    ASSERT(start);
+    ASSERT(start->isSVGText());
 
-#endif // ENABLE(SVG)
+    return start;
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.h b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.h
index da2bf5910c..7170855e37 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.h
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.h
@@ -26,46 +26,67 @@
 
 #if ENABLE(SVG)
 #include "RenderObject.h"
+#include "SVGElement.h"
+#include "SVGStyledElement.h"
 
 namespace WebCore {
 
-    class SVGResourceFilter;
-    class ImageBuffer;
+class SVGResourceFilter;
+class ImageBuffer;
 
-    // SVGRendererBase is an abstract base class which all SVG renderers inherit
-    // from in order to share SVG renderer code.
-    // FIXME: This code can all move into RenderSVGModelObject once
-    // all SVG renderers inherit from RenderSVGModelObject.
-    class SVGRenderBase {
-    public:
-        // FIXME: These are only public for SVGRootInlineBox.
-        // It's unclear if these should be exposed or not.  SVGRootInlineBox may
-        // pass the wrong RenderObject* and boundingBox to these functions.
-        static void prepareToRenderSVGContent(RenderObject*, RenderObject::PaintInfo&, const FloatRect& boundingBox, SVGResourceFilter*&, SVGResourceFilter* rootFilter = 0);
-        static void finishRenderSVGContent(RenderObject*, RenderObject::PaintInfo&, SVGResourceFilter*&, GraphicsContext* savedContext);
+// SVGRendererBase is an abstract base class which all SVG renderers inherit
+// from in order to share SVG renderer code.
+// FIXME: This code can all move into RenderSVGModelObject once
+// all SVG renderers inherit from RenderSVGModelObject.
+class SVGRenderBase {
+public:
+    virtual ~SVGRenderBase();
 
-    protected:
-        static IntRect clippedOverflowRectForRepaint(RenderObject*, RenderBoxModelObject* repaintContainer);
-        static void computeRectForRepaint(RenderObject*, RenderBoxModelObject* repaintContainer, IntRect&, bool fixed);
+    virtual const SVGRenderBase* toSVGRenderBase() const { return this; }
 
-        static void mapLocalToContainer(const RenderObject*, RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&);
+    // FIXME: These are only public for SVGRootInlineBox.
+    // It's unclear if these should be exposed or not.  SVGRootInlineBox may
+    // pass the wrong RenderObject* and boundingBox to these functions.
+    static bool prepareToRenderSVGContent(RenderObject*, RenderObject::PaintInfo&, const FloatRect& boundingBox, SVGResourceFilter*&, SVGResourceFilter* rootFilter = 0);
+    static void finishRenderSVGContent(RenderObject*, RenderObject::PaintInfo&, SVGResourceFilter*&, GraphicsContext* savedContext);
 
-        // Used to share the "walk all the children" logic between objectBoundingBox
-        // and repaintRectInLocalCoordinates in RenderSVGRoot and RenderSVGContainer
-        static FloatRect computeContainerBoundingBox(const RenderObject* container, bool includeAllPaintedContent);
+    // Layout all children of the passed render object
+    static void layoutChildren(RenderObject*, bool selfNeedsLayout);
 
-        // returns the filter bounding box (or the empty rect if no filter) in local coordinates
-        static FloatRect filterBoundingBoxForRenderer(const RenderObject*);
-    };
+    // Helper function determining wheter overflow is hidden
+    static bool isOverflowHidden(const RenderObject*);
 
-    // FIXME: This should move to RenderObject or PaintInfo
-    // Used for transforming the GraphicsContext and damage rect before passing PaintInfo to child renderers.
-    void applyTransformToPaintInfo(RenderObject::PaintInfo&, const TransformationMatrix& localToChildTransform);
+    virtual FloatRect strokeBoundingBox() const { return FloatRect(); }
+    virtual FloatRect markerBoundingBox() const { return FloatRect(); }
 
-    // This offers a way to render parts of a WebKit rendering tree into a ImageBuffer.
-    void renderSubtreeToImage(ImageBuffer*, RenderObject*);
+    // returns the bounding box of filter, clipper, marker and masker (or the empty rect if no filter) in local coordinates
+    FloatRect filterBoundingBoxForRenderer(const RenderObject*) const;
+    FloatRect clipperBoundingBoxForRenderer(const RenderObject*) const;
+    FloatRect maskerBoundingBoxForRenderer(const RenderObject*) const;
 
-    void clampImageBufferSizeToViewport(FrameView*, IntSize& imageBufferSize);
+protected:
+    static IntRect clippedOverflowRectForRepaint(RenderObject*, RenderBoxModelObject* repaintContainer);
+    static void computeRectForRepaint(RenderObject*, RenderBoxModelObject* repaintContainer, IntRect&, bool fixed);
+
+    static void mapLocalToContainer(const RenderObject*, RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&);
+
+    // Used to share the "walk all the children" logic between objectBoundingBox
+    // and repaintRectInLocalCoordinates in RenderSVGRoot and RenderSVGContainer
+    static FloatRect computeContainerBoundingBox(const RenderObject* container, bool includeAllPaintedContent);
+
+    static void deregisterFromResources(RenderObject*);
+};
+
+// FIXME: This should move to RenderObject or PaintInfo
+// Used for transforming the GraphicsContext and damage rect before passing PaintInfo to child renderers.
+void applyTransformToPaintInfo(RenderObject::PaintInfo&, const AffineTransform& localToChildTransform);
+
+// This offers a way to render parts of a WebKit rendering tree into a ImageBuffer.
+void renderSubtreeToImage(ImageBuffer*, RenderObject*);
+
+void clampImageBufferSizeToViewport(FrameView*, IntSize& imageBufferSize);
+
+const RenderObject* findTextRootObject(const RenderObject* start);
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.cpp
index 28e506ad90..5d70505f57 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.cpp
@@ -34,10 +34,13 @@
 #include "HTMLNames.h"
 #include "InlineTextBox.h"
 #include "NodeRenderStyle.h"
+#include "Path.h"
 #include "RenderImage.h"
 #include "RenderPath.h"
 #include "RenderSVGContainer.h"
 #include "RenderSVGInlineText.h"
+#include "RenderSVGResourceClipper.h"
+#include "RenderSVGResourceMasker.h"
 #include "RenderSVGRoot.h"
 #include "RenderSVGText.h"
 #include "RenderTreeAsText.h"
@@ -46,7 +49,6 @@
 #include "SVGPaintServerGradient.h"
 #include "SVGPaintServerPattern.h"
 #include "SVGPaintServerSolid.h"
-#include "SVGResourceClipper.h"
 #include "SVGRootInlineBox.h"
 #include "SVGStyledElement.h"
 #include <math.h>
@@ -179,7 +181,7 @@ TextStream& operator<<(TextStream& ts, const FloatSize& s)
     return ts;
 }
 
-TextStream& operator<<(TextStream& ts, const TransformationMatrix& transform)
+TextStream& operator<<(TextStream& ts, const AffineTransform& transform)
 {
     if (transform.isIdentity())
         ts << "identity";
@@ -195,6 +197,37 @@ TextStream& operator<<(TextStream& ts, const TransformationMatrix& transform)
     return ts;
 }
 
+static TextStream& operator<<(TextStream& ts, const WindRule rule)
+{
+    switch (rule) {
+    case RULE_NONZERO:
+        ts << "NON-ZERO";
+        break;
+    case RULE_EVENODD:
+        ts << "EVEN-ODD";
+        break;
+    }
+
+    return ts;
+}
+
+static TextStream& operator<<(TextStream& ts, const SVGUnitTypes::SVGUnitType& unitType)
+{
+    switch (unitType) {
+    case SVGUnitTypes::SVG_UNIT_TYPE_UNKNOWN:
+        ts << "unknown";
+        break;
+    case SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE:
+        ts << "userSpaceOnUse";
+        break;
+    case SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX:
+        ts << "objectBoundingBox";
+        break;
+    }
+
+    return ts;
+}
+
 TextStream& operator<<(TextStream& ts, const Color& c)
 {
     return ts << c.name();
@@ -298,10 +331,9 @@ static void writeStyle(TextStream& ts, const RenderObject& object)
             writeIfNotDefault(ts, "fill rule", svgStyle->fillRule(), RULE_NONZERO);
             ts << "}]";
         }
+        writeIfNotDefault(ts, "clip rule", svgStyle->clipRule(), RULE_NONZERO);
     }
 
-    if (!svgStyle->clipPath().isEmpty())
-        writeNameAndQuotedValue(ts, "clip path", svgStyle->clipPath());
     writeIfNotEmpty(ts, "start marker", svgStyle->startMarker());
     writeIfNotEmpty(ts, "middle marker", svgStyle->midMarker());
     writeIfNotEmpty(ts, "end marker", svgStyle->endMarker());
@@ -310,7 +342,7 @@ static void writeStyle(TextStream& ts, const RenderObject& object)
 
 static TextStream& writePositionAndStyle(TextStream& ts, const RenderObject& object)
 {
-    ts << " " << object.absoluteTransform().mapRect(object.repaintRectInLocalCoordinates());
+    ts << " " << const_cast<RenderObject&>(object).absoluteClippedOverflowRect();
     writeStyle(ts, object);
     return ts;
 }
@@ -464,11 +496,37 @@ static void writeChildren(TextStream& ts, const RenderObject& object, int indent
         write(ts, *child, indent + 1);
 }
 
+void writeSVGResource(TextStream& ts, const RenderObject& object, int indent)
+{
+    writeStandardPrefix(ts, object, indent);
+
+    Element* element = static_cast<Element*>(object.node());
+    const AtomicString& id = element->getIDAttribute();
+    writeNameAndQuotedValue(ts, "id", id);    
+
+    RenderSVGResource* resource = const_cast<RenderObject&>(object).toRenderSVGResource();
+    if (resource->resourceType() == MaskerResourceType) {
+        RenderSVGResourceMasker* masker = static_cast<RenderSVGResourceMasker*>(resource);
+        ASSERT(masker);
+        writeNameValuePair(ts, "maskUnits", masker->maskUnits());
+        writeNameValuePair(ts, "maskContentUnits", masker->maskContentUnits());
+    } else if (resource->resourceType() == ClipperResourceType) {
+        RenderSVGResourceClipper* clipper = static_cast<RenderSVGResourceClipper*>(resource);
+        ASSERT(clipper);
+        writeNameValuePair(ts, "clipPathUnits", clipper->clipPathUnits());
+    }
+
+    // FIXME: Handle other RenderSVGResource* classes here, after converting them from SVGResource*.
+    ts << "\n";
+    writeChildren(ts, object, indent);
+}
+
 void writeSVGContainer(TextStream& ts, const RenderObject& container, int indent)
 {
     writeStandardPrefix(ts, container, indent);
     writePositionAndStyle(ts, container);
     ts << "\n";
+    writeResources(ts, container, indent);
     writeChildren(ts, container, indent);
 }
 
@@ -484,6 +542,7 @@ void writeSVGText(TextStream& ts, const RenderBlock& text, int indent)
     writeStandardPrefix(ts, text, indent);
     writeRenderSVGTextBox(ts, text);
     ts << "\n";
+    writeResources(ts, text, indent);
     writeChildren(ts, text, indent);
 }
 
@@ -493,20 +552,51 @@ void writeSVGInlineText(TextStream& ts, const RenderText& text, int indent)
 
     // Why not just linesBoundingBox()?
     ts << " " << FloatRect(text.firstRunOrigin(), text.linesBoundingBox().size()) << "\n";
+    writeResources(ts, text, indent);
     writeSVGInlineTextBoxes(ts, text, indent);
 }
 
+void writeSVGImage(TextStream& ts, const RenderImage& image, int indent)
+{
+    writeStandardPrefix(ts, image, indent);
+    writePositionAndStyle(ts, image);
+    ts << "\n";
+    writeResources(ts, image, indent);
+}
+
 void write(TextStream& ts, const RenderPath& path, int indent)
 {
     writeStandardPrefix(ts, path, indent);
     ts << path << "\n";
+    writeResources(ts, path, indent);
 }
 
-void writeSVGImage(TextStream& ts, const RenderImage& image, int indent)
+void writeResources(TextStream& ts, const RenderObject& object, int indent)
 {
-    writeStandardPrefix(ts, image, indent);
-    writePositionAndStyle(ts, image);
-    ts << "\n";
+    const RenderStyle* style = object.style();
+    const SVGRenderStyle* svgStyle = style->svgStyle();
+
+    if (!svgStyle->maskElement().isEmpty()) {
+        if (RenderSVGResourceMasker* masker = getRenderSVGResourceById<RenderSVGResourceMasker>(object.document(), svgStyle->maskElement())) {
+            writeIndent(ts, indent);
+            ts << " ";
+            writeNameAndQuotedValue(ts, "masker", svgStyle->maskElement());
+            ts << " ";
+            writeStandardPrefix(ts, *masker, 0);
+            ts << " " << masker->resourceBoundingBox(object.objectBoundingBox()) << "\n";
+        }
+    }
+    if (!svgStyle->clipPath().isEmpty()) {
+        if (RenderSVGResourceClipper* clipper = getRenderSVGResourceById<RenderSVGResourceClipper>(object.document(), svgStyle->clipPath())) {
+            writeIndent(ts, indent);
+            ts << " ";
+            writeNameAndQuotedValue(ts, "clipPath", svgStyle->clipPath());
+            ts << " ";
+            writeStandardPrefix(ts, *clipper, 0);
+            ts << " " << clipper->resourceBoundingBox(object.objectBoundingBox()) << "\n";
+        }
+    }
+    // FIXME: Handle other RenderSVGResource* classes here, after converting them from SVGResource*.
 }
 
 void writeRenderResources(TextStream& ts, Node* parent)
@@ -521,11 +611,11 @@ void writeRenderResources(TextStream& ts, Node* parent)
             continue;
 
         SVGStyledElement* styled = static_cast<SVGStyledElement*>(svgElement);
-        RefPtr<SVGResource> resource(styled->canvasResource());
+        RefPtr<SVGResource> resource(styled->canvasResource(node->renderer()));
         if (!resource)
             continue;
 
-        String elementId = svgElement->getAttribute(HTMLNames::idAttr);
+        String elementId = svgElement->getAttribute(svgElement->idAttributeName());
         // FIXME: These names are lies!
         if (resource->isPaintServer()) {
             RefPtr<SVGPaintServer> paintServer = WTF::static_pointer_cast<SVGPaintServer>(resource);
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.h b/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.h
index bee4f36fbe..905652b279 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.h
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.h
@@ -45,20 +45,23 @@ namespace WebCore {
     class RenderPath;
     class RenderSVGRoot;
     class RenderText;
-    class TransformationMatrix;
+    class AffineTransform;
+    class SVGUnitTypes;
 
 // functions used by the main RenderTreeAsText code
 void write(TextStream&, const RenderPath&, int indent);
 void write(TextStream&, const RenderSVGRoot&, int indent);
+void writeSVGResource(TextStream&, const RenderObject&, int indent);
 void writeSVGContainer(TextStream&, const RenderObject&, int indent);
 void writeSVGImage(TextStream&, const RenderImage&, int indent);
 void writeSVGInlineText(TextStream&, const RenderText&, int indent);
 void writeSVGText(TextStream&, const RenderBlock&, int indent);
+void writeResources(TextStream&, const RenderObject&, int indent);
 
 void writeRenderResources(TextStream&, Node* parent);
 
 // helper operators defined used in various classes to dump the render tree.
-TextStream& operator<<(TextStream&, const TransformationMatrix&);
+TextStream& operator<<(TextStream&, const AffineTransform&);
 TextStream& operator<<(TextStream&, const IntRect&);
 TextStream& operator<<(TextStream&, const Color&);
 TextStream& operator<<(TextStream&, const IntPoint&);
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.cpp
index 58297428da..03b9db4a7a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.cpp
@@ -363,6 +363,13 @@ struct SVGRootInlineBoxPaintWalker {
         ASSERT(!m_chunkStarted);
     }
 
+    bool mayHaveSelection(SVGInlineTextBox* box) const
+    {
+        int selectionStart = 0, selectionEnd = 0;
+        box->selectionStartEnd(selectionStart, selectionEnd);
+        return selectionStart < selectionEnd;
+    }
+
     void teardownFillPaintServer()
     {
         if (!m_fillPaintServer)
@@ -429,7 +436,13 @@ struct SVGRootInlineBoxPaintWalker {
         m_paintInfo.rect = m_savedInfo.rect;
     }
 
-    bool chunkSetupFillCallback(InlineBox* box)
+    bool setupBackground(SVGInlineTextBox* /*box*/)
+    {
+        m_textPaintInfo.subphase = SVGTextPaintSubphaseBackground;
+        return true;
+    }
+
+    bool setupFill(SVGInlineTextBox* box)
     {
         InlineFlowBox* flowBox = box->parent();
 
@@ -440,6 +453,7 @@ struct SVGRootInlineBoxPaintWalker {
         ASSERT(!m_strokePaintServer);
         teardownFillPaintServer();
 
+        m_textPaintInfo.subphase = SVGTextPaintSubphaseGlyphFill;
         m_fillPaintServer = SVGPaintServer::fillPaintServer(object->style(), object);
         if (m_fillPaintServer) {
             m_fillPaintServer->setup(m_paintInfo.context, object, ApplyToFillTargetType, true);
@@ -450,7 +464,35 @@ struct SVGRootInlineBoxPaintWalker {
         return false;
     }
 
-    bool chunkSetupStrokeCallback(InlineBox* box)
+    bool setupFillSelection(SVGInlineTextBox* box)
+    {
+        InlineFlowBox* flowBox = box->parent();
+
+        // Setup fill paint server
+        RenderObject* object = flowBox->renderer();
+        ASSERT(object);
+        RenderStyle* style = object->getCachedPseudoStyle(SELECTION);
+        if (!style)
+            style = object->style();
+
+        ASSERT(!m_strokePaintServer);
+        teardownFillPaintServer();
+
+        if (!mayHaveSelection(box))
+            return false;
+
+        m_textPaintInfo.subphase = SVGTextPaintSubphaseGlyphFillSelection;
+        m_fillPaintServer = SVGPaintServer::fillPaintServer(style, object);
+        if (m_fillPaintServer) {
+            m_fillPaintServer->setup(m_paintInfo.context, object, style, ApplyToFillTargetType, true);
+            m_fillPaintServerObject = object;
+            return true;
+        }
+
+        return false;
+    }
+
+    bool setupStroke(SVGInlineTextBox* box)
     {
         InlineFlowBox* flowBox = box->parent();
 
@@ -462,6 +504,7 @@ struct SVGRootInlineBoxPaintWalker {
         teardownFillPaintServer();
         teardownStrokePaintServer();
 
+        m_textPaintInfo.subphase = SVGTextPaintSubphaseGlyphStroke;
         m_strokePaintServer = SVGPaintServer::strokePaintServer(object->style(), object);
 
         if (m_strokePaintServer) {
@@ -473,9 +516,88 @@ struct SVGRootInlineBoxPaintWalker {
         return false;
     }
 
-    void chunkPortionCallback(SVGInlineTextBox* textBox, int startOffset, const TransformationMatrix& chunkCtm,
+    bool setupStrokeSelection(SVGInlineTextBox* box)
+    {
+        InlineFlowBox* flowBox = box->parent();
+
+        // Setup stroke paint server
+        RenderObject* object = flowBox->renderer();
+        ASSERT(object);
+        RenderStyle* style = object->getCachedPseudoStyle(SELECTION);
+        if (!style)
+            style = object->style();
+
+        // If we're both stroked & filled, teardown fill paint server before stroking.
+        teardownFillPaintServer();
+        teardownStrokePaintServer();
+
+        if (!mayHaveSelection(box))
+            return false;
+
+        m_textPaintInfo.subphase = SVGTextPaintSubphaseGlyphStrokeSelection;
+        m_strokePaintServer = SVGPaintServer::strokePaintServer(style, object);
+        if (m_strokePaintServer) {
+            m_strokePaintServer->setup(m_paintInfo.context, object, style, ApplyToStrokeTargetType, true);
+            m_strokePaintServerObject = object;
+            return true;
+        }
+
+        return false;
+    }
+
+    bool setupForeground(SVGInlineTextBox* /*box*/)
+    {
+        teardownFillPaintServer();
+        teardownStrokePaintServer();
+
+        m_textPaintInfo.subphase = SVGTextPaintSubphaseForeground;
+
+        return true;
+    }
+
+    SVGPaintServer* activePaintServer() const
+    {
+        switch (m_textPaintInfo.subphase) {
+        case SVGTextPaintSubphaseGlyphFill:
+        case SVGTextPaintSubphaseGlyphFillSelection:
+            ASSERT(m_fillPaintServer);
+            return m_fillPaintServer;
+        case SVGTextPaintSubphaseGlyphStroke:
+        case SVGTextPaintSubphaseGlyphStrokeSelection:
+            ASSERT(m_strokePaintServer);
+            return m_strokePaintServer;
+        case SVGTextPaintSubphaseBackground:
+        case SVGTextPaintSubphaseForeground:
+        default:
+            return 0;
+        }
+    }
+
+    void chunkPortionCallback(SVGInlineTextBox* textBox, int startOffset, const AffineTransform& chunkCtm,
                               const Vector<SVGChar>::iterator& start, const Vector<SVGChar>::iterator& end)
     {
+        if (setupBackground(textBox))
+            paintChunk(textBox, startOffset, chunkCtm, start, end);
+
+        if (setupFill(textBox))
+            paintChunk(textBox, startOffset, chunkCtm, start, end);
+        
+        if (setupFillSelection(textBox))
+            paintChunk(textBox, startOffset, chunkCtm, start, end);
+
+        if (setupStroke(textBox))
+            paintChunk(textBox, startOffset, chunkCtm, start, end);
+
+        if (setupStrokeSelection(textBox))
+            paintChunk(textBox, startOffset, chunkCtm, start, end);
+
+        if (setupForeground(textBox))
+            paintChunk(textBox, startOffset, chunkCtm, start, end);
+    }
+
+    void paintChunk(SVGInlineTextBox* textBox, int startOffset, const AffineTransform& chunkCtm,
+                    const Vector<SVGChar>::iterator& start, const Vector<SVGChar>::iterator& end)
+    {
         RenderText* text = textBox->textRenderer();
         ASSERT(text);
 
@@ -523,12 +645,8 @@ struct SVGRootInlineBoxPaintWalker {
                 textBox->paintDecoration(OVERLINE, m_paintInfo.context, decorationOrigin.x(), decorationOrigin.y(), textWidth, *it, info);
 
             // Paint text
-            SVGPaintServer* activePaintServer = m_fillPaintServer;
-            if (!activePaintServer)
-                activePaintServer = m_strokePaintServer;
-
-            ASSERT(activePaintServer);
-            textBox->paintCharacters(m_paintInfo, m_tx, m_ty, *it, stringStart, stringLength, activePaintServer);
+            m_textPaintInfo.activePaintServer = activePaintServer();
+            textBox->paintCharacters(m_paintInfo, m_tx, m_ty, *it, stringStart, stringLength, m_textPaintInfo);
 
             // Paint decorations, that have to be drawn afterwards
             if (textDecorations & LINE_THROUGH && textWidth != 0.0f)
@@ -561,6 +679,8 @@ private:
 
     int m_tx;
     int m_ty;
+
+    SVGTextPaintInfo m_textPaintInfo;
 };
 
 void SVGRootInlineBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
@@ -575,18 +695,16 @@ void SVGRootInlineBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     FloatRect boundingBox(tx + x(), ty + y(), width(), height());
 
     // Initialize text rendering
-    SVGRenderBase::prepareToRenderSVGContent(renderer(), paintInfo, boundingBox, filter);
- 
-    // Render text, chunk-by-chunk
-    SVGRootInlineBoxPaintWalker walkerCallback(this, filter, paintInfo, tx, ty);
-    SVGTextChunkWalker<SVGRootInlineBoxPaintWalker> walker(&walkerCallback,
-                                                           &SVGRootInlineBoxPaintWalker::chunkPortionCallback,
-                                                           &SVGRootInlineBoxPaintWalker::chunkStartCallback,
-                                                           &SVGRootInlineBoxPaintWalker::chunkEndCallback,
-                                                           &SVGRootInlineBoxPaintWalker::chunkSetupFillCallback,
-                                                           &SVGRootInlineBoxPaintWalker::chunkSetupStrokeCallback);
-
-    walkTextChunks(&walker);
+    if (SVGRenderBase::prepareToRenderSVGContent(renderer(), paintInfo, boundingBox, filter)) {
+        // Render text, chunk-by-chunk
+        SVGRootInlineBoxPaintWalker walkerCallback(this, filter, paintInfo, tx, ty);
+        SVGTextChunkWalker<SVGRootInlineBoxPaintWalker> walker(&walkerCallback,
+                                                               &SVGRootInlineBoxPaintWalker::chunkPortionCallback,
+                                                               &SVGRootInlineBoxPaintWalker::chunkStartCallback,
+                                                               &SVGRootInlineBoxPaintWalker::chunkEndCallback);
+
+        walkTextChunks(&walker);
+    }
 
     // Finalize text rendering 
     SVGRenderBase::finishRenderSVGContent(renderer(), paintInfo, filter, savedInfo.context);
@@ -831,9 +949,8 @@ static void applyTextLengthCorrectionToTextChunk(SVGTextChunk& chunk)
         SVGChar& firstChar = *(chunk.start);
 
         // Assure we apply the chunk scaling in the right origin
-        TransformationMatrix newChunkCtm;
-        newChunkCtm.translate(firstChar.x, firstChar.y);
-        newChunkCtm = chunk.ctm * newChunkCtm;
+        AffineTransform newChunkCtm(chunk.ctm);
+        newChunkCtm.translateRight(firstChar.x, firstChar.y);
         newChunkCtm.translate(-firstChar.x, -firstChar.y);
 
         chunk.ctm = newChunkCtm;
@@ -944,7 +1061,6 @@ void SVGRootInlineBox::buildLayoutInformation(InlineFlowBox* start, SVGCharacter
                 Vector<SVGTextChunk>::iterator it = tempChunks.begin();
                 Vector<SVGTextChunk>::iterator end = tempChunks.end();
 
-                TransformationMatrix ctm;
                 float computedLength = 0.0f;
  
                 for (; it != end; ++it) {
@@ -1388,7 +1504,7 @@ void SVGRootInlineBox::buildTextChunks(Vector<SVGChar>& svgChars, InlineFlowBox*
             } else
                 ASSERT(!info.chunk.boxes.isEmpty());
 
-            // Walk string to find out new chunk positions, if existant
+            // Walk string to find out new chunk positions, if existent
             for (unsigned i = 0; i < length; ++i) {
                 ASSERT(info.it != svgChars.end());
 
@@ -1677,15 +1793,7 @@ void SVGRootInlineBox::walkTextChunks(SVGTextChunkWalkerBase* walker, const SVGI
             ASSERT(itCharEnd <= curChunk.end);
 
             // Process this chunk portion
-            if (textBox)
-                (*walker)(rangeTextBox, range.startOffset, curChunk.ctm, itCharBegin, itCharEnd);
-            else {
-                if (walker->setupFill(range.box))
-                    (*walker)(rangeTextBox, range.startOffset, curChunk.ctm, itCharBegin, itCharEnd);
-
-                if (walker->setupStroke(range.box))
-                    (*walker)(rangeTextBox, range.startOffset, curChunk.ctm, itCharBegin, itCharEnd);
-            }
+            (*walker)(rangeTextBox, range.startOffset, curChunk.ctm, itCharBegin, itCharEnd);
 
             chunkOffset += length;
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.h b/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.h
index 65bade04fb..7b1dcc44d0 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.h
@@ -28,6 +28,7 @@
 #if ENABLE(SVG)
 #include "RootInlineBox.h"
 #include "SVGCharacterLayoutInfo.h"
+#include "SVGRenderSupport.h"
 
 namespace WebCore {
 
@@ -43,13 +44,14 @@ struct LastGlyphInfo {
     bool isValid;
 };
 
-class SVGRootInlineBox : public RootInlineBox {
+class SVGRootInlineBox : public RootInlineBox, protected SVGRenderBase {
 public:
     SVGRootInlineBox(RenderObject* obj)
         : RootInlineBox(obj)
         , m_height(0)
     {
     }
+    virtual const SVGRenderBase* toSVGRenderBase() const { return this; }
 
     virtual bool isSVGRootInlineBox() { return true; }
 
@@ -63,6 +65,9 @@ public:
 
     virtual void computePerCharacterLayoutInformation();
 
+    virtual FloatRect objectBoundingBox() const { return FloatRect(); }
+    virtual FloatRect repaintRectInLocalCoordinates() const { return FloatRect(); }
+
     // Used by SVGInlineTextBox
     const Vector<SVGTextChunk>& svgTextChunks() const;
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGShadowTreeElements.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGShadowTreeElements.cpp
new file mode 100644
index 0000000000..d9ce640028
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGShadowTreeElements.cpp
@@ -0,0 +1,80 @@
+/*
+    Copyright (C) Research In Motion Limited 2010. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    aint with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "SVGShadowTreeElements.h"
+
+#include "Document.h"
+#include "FloatSize.h"
+#include "RenderObject.h"
+#include "SVGNames.h"
+
+namespace WebCore {
+
+// SVGShadowTreeContainerElement
+SVGShadowTreeContainerElement::SVGShadowTreeContainerElement(Document* document)
+    : SVGGElement(SVGNames::gTag, document)
+{
+}
+    
+SVGShadowTreeContainerElement::~SVGShadowTreeContainerElement()
+{
+}
+
+FloatSize SVGShadowTreeContainerElement::containerTranslation() const
+{
+    return FloatSize(m_xOffset.value(this), m_yOffset.value(this));
+}
+
+// SVGShadowTreeRootElement
+SVGShadowTreeRootElement::SVGShadowTreeRootElement(Document* document, Node* shadowParent)
+    : SVGShadowTreeContainerElement(document)
+    , m_shadowParent(shadowParent)
+{
+    setInDocument(true);
+}
+
+SVGShadowTreeRootElement::~SVGShadowTreeRootElement()
+{
+}
+
+void SVGShadowTreeRootElement::attachElement(PassRefPtr<RenderStyle> style, RenderArena* arena)
+{
+    ASSERT(m_shadowParent);
+
+    // Create the renderer with the specified style
+    RenderObject* renderer = createRenderer(arena, style.get());
+    if (renderer) {
+        setRenderer(renderer);
+        renderer->setStyle(style);
+    }
+
+    // Set these explicitly since this normally happens during an attach()
+    setAttached();
+
+    // Add the renderer to the render tree
+    if (renderer)
+        m_shadowParent->renderer()->addChild(renderer);
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGShadowTreeElements.h b/src/3rdparty/webkit/WebCore/rendering/SVGShadowTreeElements.h
new file mode 100644
index 0000000000..ed42e89740
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGShadowTreeElements.h
@@ -0,0 +1,67 @@
+/*
+    Copyright (C) Research In Motion Limited 2010. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    aint with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef SVGShadowTreeElements_h
+#define SVGShadowTreeElements_h
+
+#if ENABLE(SVG)
+#include "SVGGElement.h"
+#include "SVGLength.h"
+
+namespace WebCore {
+
+class FloatSize;
+
+class SVGShadowTreeContainerElement : public SVGGElement {
+public:
+    SVGShadowTreeContainerElement(Document*);
+    virtual ~SVGShadowTreeContainerElement();
+
+    virtual bool isShadowTreeContainerElement() const { return true; }
+
+    FloatSize containerTranslation() const;
+    void setContainerOffset(const SVGLength& x, const SVGLength& y)
+    {
+        m_xOffset = x;
+        m_yOffset = y;
+    }
+
+private:
+    SVGLength m_xOffset;
+    SVGLength m_yOffset;
+};
+
+class SVGShadowTreeRootElement : public SVGShadowTreeContainerElement {
+public:
+    SVGShadowTreeRootElement(Document*, Node* shadowParent);
+    virtual ~SVGShadowTreeRootElement();
+
+    virtual bool isShadowNode() const { return m_shadowParent; }
+    virtual Node* shadowParentNode() { return m_shadowParent; }
+
+    void attachElement(PassRefPtr<RenderStyle>, RenderArena*);
+
+private:
+    Node* m_shadowParent;
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/TableLayout.h b/src/3rdparty/webkit/WebCore/rendering/TableLayout.h
index 8ae0ce781e..10d6e260d2 100644
--- a/src/3rdparty/webkit/WebCore/rendering/TableLayout.h
+++ b/src/3rdparty/webkit/WebCore/rendering/TableLayout.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2002 Lars Knoll (knoll@kde.org)
  *           (C) 2002 Dirk Mueller (mueller@kde.org)
  *
@@ -23,11 +21,13 @@
 #ifndef TableLayout_h
 #define TableLayout_h
 
+#include <wtf/Noncopyable.h>
+
 namespace WebCore {
 
 class RenderTable;
 
-class TableLayout {
+class TableLayout : public Noncopyable {
 public:
     TableLayout(RenderTable* table)
         : m_table(table)
diff --git a/src/3rdparty/webkit/WebCore/rendering/TextControlInnerElements.cpp b/src/3rdparty/webkit/WebCore/rendering/TextControlInnerElements.cpp
index fc7f7f0e0c..4cd55c5fc9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/TextControlInnerElements.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/TextControlInnerElements.cpp
@@ -63,18 +63,17 @@ bool RenderTextControlInnerBlock::nodeAtPoint(const HitTestRequest& request, Hit
 
 VisiblePosition RenderTextControlInnerBlock::positionForPoint(const IntPoint& point)
 {
-    int contentsX = point.x();
-    int contentsY = point.y();
+    IntPoint contentsPoint(point);
 
     // Multiline text controls have the scroll on shadowAncestorNode, so we need to take that
     // into account here.
     if (m_multiLine) {
         RenderTextControl* renderer = toRenderTextControl(node()->shadowAncestorNode()->renderer());
         if (renderer->hasOverflowClip())
-            renderer->layer()->addScrolledContentOffset(contentsX, contentsY);
+            contentsPoint += renderer->layer()->scrolledContentOffset();
     }
 
-    return RenderBlock::positionForPoint(IntPoint(contentsX, contentsY));
+    return RenderBlock::positionForPoint(contentsPoint);
 }
 
 TextControlInnerElement::TextControlInnerElement(Document* doc, Node* shadowParent)
diff --git a/src/3rdparty/webkit/WebCore/rendering/TrailingFloatsRootInlineBox.h b/src/3rdparty/webkit/WebCore/rendering/TrailingFloatsRootInlineBox.h
new file mode 100644
index 0000000000..68bf637bab
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/TrailingFloatsRootInlineBox.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TrailingFloatsRootInlineBox_h
+#define TrailingFloatsRootInlineBox_h
+
+#include "RootInlineBox.h"
+
+namespace WebCore {
+
+class TrailingFloatsRootInlineBox : public RootInlineBox {
+public:
+    TrailingFloatsRootInlineBox(RenderObject* object) : RootInlineBox(object)
+    {
+#if ENABLE(SVG)
+        setHasVirtualHeight();
+#endif
+    }
+
+private:
+    virtual int virtualHeight() const { return 0; }
+};
+
+} // namespace WebCore
+
+#endif // TrailingFloatsRootInlineBox_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/TransformState.cpp b/src/3rdparty/webkit/WebCore/rendering/TransformState.cpp
index a9e68f4b1a..ecc614e0e4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/TransformState.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/TransformState.cpp
@@ -49,6 +49,12 @@ void TransformState::move(int x, int y, TransformAccumulation accumulate)
     m_accumulatingTransform = accumulate == AccumulateTransform;
 }
 
+// FIXME: We transform AffineTransform to TransformationMatrix. This is rather inefficient.
+void TransformState::applyTransform(const AffineTransform& transformFromContainer, TransformAccumulation accumulate)
+{
+    applyTransform(transformFromContainer.toTransformationMatrix(), accumulate);
+}
+
 void TransformState::applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation accumulate)
 {
     // If we have an accumulated transform from last time, multiply in this transform
@@ -115,7 +121,7 @@ void TransformState::flattenWithTransform(const TransformationMatrix& t)
     }
 
     // We could throw away m_accumulatedTransform if we wanted to here, but that
-    // would cause thrash when traversing hierarachies with alternating
+    // would cause thrash when traversing hierarchies with alternating
     // preserve-3d and flat elements.
     if (m_accumulatedTransform)
         m_accumulatedTransform->makeIdentity();
diff --git a/src/3rdparty/webkit/WebCore/rendering/TransformState.h b/src/3rdparty/webkit/WebCore/rendering/TransformState.h
index d2c962a90c..0b4ca46b23 100644
--- a/src/3rdparty/webkit/WebCore/rendering/TransformState.h
+++ b/src/3rdparty/webkit/WebCore/rendering/TransformState.h
@@ -26,6 +26,7 @@
 #ifndef TransformState_h
 #define TransformState_h
 
+#include "AffineTransform.h"
 #include "FloatPoint.h"
 #include "FloatQuad.h"
 #include "IntSize.h"
@@ -59,6 +60,7 @@ public:
     }
     
     void move(int x, int y, TransformAccumulation = FlattenTransform);
+    void applyTransform(const AffineTransform& transformFromContainer, TransformAccumulation = FlattenTransform);
     void applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation = FlattenTransform);
     void flatten();
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/break_lines.cpp b/src/3rdparty/webkit/WebCore/rendering/break_lines.cpp
index 9b46cd2e34..1cc6fd1efe 100644
--- a/src/3rdparty/webkit/WebCore/rendering/break_lines.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/break_lines.cpp
@@ -1,21 +1,26 @@
 /*
- * Copyright (C) 2005, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2005, 2007, 2010 Apple Inc. All rights reserved.
  *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -44,13 +49,30 @@ static inline bool isBreakableSpace(UChar ch, bool treatNoBreakSpaceAsBreak)
     }
 }
 
-static inline bool shouldBreakAfter(UChar ch)
+// This differs from the Unicode algorithm only in that Unicode does not break
+// between a question mark and a vertical line (U+007C).
+static const unsigned char internetExplorerLineBreaksAfterQuestionMarkTable[0x80] = {
+    1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, // \t
+    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
+    1, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, // ! " ' ) , . /
+    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 1, 1, 1, 0, // : ; ?
+    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
+    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, // ]
+    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 
+    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1  // }
+};
+
+static const size_t internetExplorerLineBreaksAfterQuestionMarkTableSize = sizeof(internetExplorerLineBreaksAfterQuestionMarkTable) / sizeof(*internetExplorerLineBreaksAfterQuestionMarkTable);
+
+static inline bool shouldBreakAfter(UChar ch, UChar nextCh)
 {
-    // Match WinIE's breaking strategy, which is to always allow breaks after hyphens and question marks.
-    // FIXME: it appears that IE behavior is more complex, see <http://bugs.webkit.org/show_bug.cgi?id=17475>.
     switch (ch) {
-        case '-':
+        // For a question mark preceding a non-ASCII characters, defer to the Unicode algorithm by returning false.
+        // For ASCII characters, use a lookup table for enhanced speed and for compatibility with Internet Explorer. 
         case '?':
+            return nextCh < internetExplorerLineBreaksAfterQuestionMarkTableSize && internetExplorerLineBreaksAfterQuestionMarkTable[nextCh];
+        // Internet Explorer always allows breaking after a hyphen.
+        case '-':
         case softHyphen:
         // FIXME: cases for ideographicComma and ideographicFullStop are a workaround for an issue in Unicode 5.0
         // which is likely to be resolved in Unicode 5.1 <http://bugs.webkit.org/show_bug.cgi?id=17411>.
@@ -88,7 +110,7 @@ int nextBreakablePosition(const UChar* str, int pos, int len, bool treatNoBreakS
     for (int i = pos; i < len; i++) {
         UChar ch = str[i];
 
-        if (isBreakableSpace(ch, treatNoBreakSpaceAsBreak) || shouldBreakAfter(lastCh))
+        if (isBreakableSpace(ch, treatNoBreakSpaceAsBreak) || shouldBreakAfter(lastCh, ch))
             return i;
 
         if (needsLineBreakIterator(ch) || needsLineBreakIterator(lastCh)) {
diff --git a/src/3rdparty/webkit/WebCore/rendering/break_lines.h b/src/3rdparty/webkit/WebCore/rendering/break_lines.h
index 14f740fe87..4d6b8dcd7d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/break_lines.h
+++ b/src/3rdparty/webkit/WebCore/rendering/break_lines.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/ContentData.h b/src/3rdparty/webkit/WebCore/rendering/style/ContentData.h
index 24d5f86f95..2c261f84be 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/ContentData.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/ContentData.h
@@ -25,15 +25,15 @@
 #ifndef ContentData_h
 #define ContentData_h
 
-#include "PlatformString.h"
 #include "RenderStyleConstants.h"
-#include "StringImpl.h"
-#include "StyleImage.h"
 #include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
 class CounterContent;
+class StringImpl;
+class StyleImage;
 
 struct ContentData : Noncopyable {
 public:
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/CounterContent.h b/src/3rdparty/webkit/WebCore/rendering/style/CounterContent.h
index cf118132ee..702d9c2395 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/CounterContent.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/CounterContent.h
@@ -30,7 +30,7 @@
 
 namespace WebCore {
 
-class CounterContent {
+class CounterContent : public FastAllocBase {
 public:
     CounterContent(const AtomicString& identifier, EListStyleType style, const AtomicString& separator)
         : m_identifier(identifier)
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.cpp b/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.cpp
index ec910c9cfa..597e919656 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.cpp
@@ -270,4 +270,15 @@ bool FillLayer::containsImage(StyleImage* s) const
     return false;
 }
 
+bool FillLayer::imagesAreLoaded() const
+{
+    const FillLayer* curr;
+    for (curr = this; curr; curr = curr->next()) {
+        if (curr->m_image && !curr->m_image->isLoaded())
+            return false;
+    }
+
+    return true;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.h b/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.h
index fb928b6596..cef6b19beb 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.h
@@ -59,7 +59,7 @@ struct FillSize {
     LengthSize size;
 };
 
-struct FillLayer {
+struct FillLayer : FastAllocBase {
 public:
     FillLayer(EFillLayerType);
     ~FillLayer();
@@ -126,6 +126,7 @@ public:
     }
 
     bool containsImage(StyleImage*) const;
+    bool imagesAreLoaded() const;
 
     bool hasImage() const
     {
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/LineClampValue.h b/src/3rdparty/webkit/WebCore/rendering/style/LineClampValue.h
new file mode 100644
index 0000000000..2119ca2916
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/style/LineClampValue.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LineClampValue_h
+#define LineClampValue_h
+
+#include "RenderStyleConstants.h"
+
+namespace WebCore {
+    
+class LineClampValue {
+public:
+    LineClampValue()
+        : m_type(LineClampLineCount)
+        , m_value(-1)
+    {
+    }
+    
+    LineClampValue(int value, ELineClampType type)
+        : m_type(type)
+        , m_value(value)
+    {
+    }
+    
+    int value() const { return m_value; }
+    
+    bool isPercentage() const { return m_type == LineClampPercentage; }
+
+    bool isNone() const { return m_value == -1; }
+
+    bool operator==(const LineClampValue& o) const
+    {
+        return value() == o.value() && isPercentage() == o.isPercentage();
+    }
+    
+    bool operator!=(const LineClampValue& o) const
+    {
+        return !(*this == o);
+    }
+    
+private:
+    ELineClampType m_type;
+    int m_value;
+};
+    
+} // namespace WebCore
+
+#endif // LineClampValue_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.cpp b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.cpp
index a861fea314..712344fdd2 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.cpp
@@ -192,6 +192,11 @@ static inline int pseudoBit(PseudoId pseudo)
     return 1 << (pseudo - 1);
 }
 
+bool RenderStyle::hasAnyPublicPseudoStyles() const
+{
+    return PUBLIC_PSEUDOID_MASK & noninherited_flags._pseudoBits;
+}
+
 bool RenderStyle::hasPseudoStyle(PseudoId pseudo) const
 {
     ASSERT(pseudo > NOPSEUDO);
@@ -454,8 +459,8 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
     if (inherited->m_effectiveZoom != other->inherited->m_effectiveZoom)
         return StyleDifferenceLayout;
 
-    if (rareNonInheritedData->opacity == 1 && other->rareNonInheritedData->opacity < 1 ||
-        rareNonInheritedData->opacity < 1 && other->rareNonInheritedData->opacity == 1) {
+    if ((rareNonInheritedData->opacity == 1 && other->rareNonInheritedData->opacity < 1) ||
+        (rareNonInheritedData->opacity < 1 && other->rareNonInheritedData->opacity == 1)) {
         // FIXME: We should add an optimized form of layout that just recomputes visual overflow.
         return StyleDifferenceLayout;
     }
@@ -702,7 +707,7 @@ void RenderStyle::addBindingURI(StringImpl* uri)
 
 void RenderStyle::setTextShadow(ShadowData* val, bool add)
 {
-    ASSERT(!val || !val->spread && val->style == Normal);
+    ASSERT(!val || (!val->spread && val->style == Normal));
 
     StyleRareInheritedData* rareData = rareInheritedData.access();
     if (!add) {
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h
index 2e8fb0acda..6ec05343c5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h
@@ -37,6 +37,7 @@
 #include "CachedImage.h"
 #include "CollapsedBorderValue.h"
 #include "Color.h"
+#include "ColorSpace.h"
 #include "ContentData.h"
 #include "CounterDirectives.h"
 #include "CursorList.h"
@@ -49,6 +50,7 @@
 #include "Length.h"
 #include "LengthBox.h"
 #include "LengthSize.h"
+#include "LineClampValue.h"
 #include "NinePieceImage.h"
 #include "OutlineValue.h"
 #include "Pair.h"
@@ -87,8 +89,8 @@
 #include "BindingURI.h"
 #endif
 
-#ifdef __WINS__
-#define compareEqual(t, u)              ((t) == (u))
+#if COMPILER(WINSCW)
+#define compareEqual(t, u)      ((t) == (u))
 #else
 template<typename T, typename U> inline bool compareEqual(const T& t, const U& u) { return t == static_cast<T>(u); }
 #endif
@@ -181,7 +183,7 @@ protected:
 
         unsigned _empty_cells : 1; // EEmptyCell
         unsigned _caption_side : 2; // ECaptionSide
-        unsigned _list_style_type : 5 ; // EListStyleType
+        unsigned _list_style_type : 7; // EListStyleType
         unsigned _list_style_position : 1; // EListStylePosition
         unsigned _visibility : 2; // EVisibility
         unsigned _text_align : 3; // ETextAlign
@@ -192,37 +194,38 @@ protected:
         bool _border_collapse : 1 ;
         unsigned _white_space : 3; // EWhiteSpace
         unsigned _box_direction : 1; // EBoxDirection (CSS3 box_direction property, flexible box layout module)
-        // 32 bits
+        // 34 bits
         
         // non CSS2 inherited
         bool _visuallyOrdered : 1;
         bool _htmlHacks : 1;
         bool _force_backgrounds_to_white : 1;
         unsigned _pointerEvents : 4; // EPointerEvents
-        // 39 bits
+        // 41 bits
     } inherited_flags;
 
 // don't inherit
     struct NonInheritedFlags {
         bool operator==(const NonInheritedFlags& other) const
         {
-            return (_effectiveDisplay == other._effectiveDisplay) &&
-            (_originalDisplay == other._originalDisplay) &&
-            (_overflowX == other._overflowX) &&
-            (_overflowY == other._overflowY) &&
-            (_vertical_align == other._vertical_align) &&
-            (_clear == other._clear) &&
-            (_position == other._position) &&
-            (_floating == other._floating) &&
-            (_table_layout == other._table_layout) &&
-            (_page_break_before == other._page_break_before) &&
-            (_page_break_after == other._page_break_after) &&
-            (_styleType == other._styleType) &&
-            (_affectedByHover == other._affectedByHover) &&
-            (_affectedByActive == other._affectedByActive) &&
-            (_affectedByDrag == other._affectedByDrag) &&
-            (_pseudoBits == other._pseudoBits) &&
-            (_unicodeBidi == other._unicodeBidi);
+            return _effectiveDisplay == other._effectiveDisplay
+                && _originalDisplay == other._originalDisplay
+                && _overflowX == other._overflowX
+                && _overflowY == other._overflowY
+                && _vertical_align == other._vertical_align
+                && _clear == other._clear
+                && _position == other._position
+                && _floating == other._floating
+                && _table_layout == other._table_layout
+                && _page_break_before == other._page_break_before
+                && _page_break_after == other._page_break_after
+                && _page_break_inside == other._page_break_inside
+                && _styleType == other._styleType
+                && _affectedByHover == other._affectedByHover
+                && _affectedByActive == other._affectedByActive
+                && _affectedByDrag == other._affectedByDrag
+                && _pseudoBits == other._pseudoBits
+                && _unicodeBidi == other._unicodeBidi;
         }
 
         bool operator!=(const NonInheritedFlags& other) const { return !(*this == other); }
@@ -239,6 +242,7 @@ protected:
 
         unsigned _page_break_before : 2; // EPageBreak
         unsigned _page_break_after : 2; // EPageBreak
+        unsigned _page_break_inside : 2; // EPageBreak
 
         unsigned _styleType : 5; // PseudoId
         bool _affectedByHover : 1;
@@ -246,7 +250,7 @@ protected:
         bool _affectedByDrag : 1;
         unsigned _pseudoBits : 7;
         unsigned _unicodeBidi : 2; // EUnicodeBidi
-        // 48 bits
+        // 50 bits
     } noninherited_flags;
 
 // !END SYNC!
@@ -282,6 +286,7 @@ protected:
         noninherited_flags._table_layout = initialTableLayout();
         noninherited_flags._page_break_before = initialPageBreak();
         noninherited_flags._page_break_after = initialPageBreak();
+        noninherited_flags._page_break_inside = initialPageBreak();
         noninherited_flags._styleType = NOPSEUDO;
         noninherited_flags._affectedByHover = false;
         noninherited_flags._affectedByActive = false;
@@ -345,6 +350,7 @@ public:
 
     bool isStyleAvailable() const;
 
+    bool hasAnyPublicPseudoStyles() const;
     bool hasPseudoStyle(PseudoId pseudo) const;
     void setHasPseudoStyle(PseudoId pseudo);
 
@@ -462,7 +468,7 @@ public:
             return font().lineSpacing();
 
         if (lh.isPercent())
-            return lh.calcMinValue(fontSize(), true);
+            return lh.calcMinValue(fontSize());
 
         return lh.value();
     }
@@ -583,7 +589,7 @@ public:
 
     short widows() const { return inherited->widows; }
     short orphans() const { return inherited->orphans; }
-    EPageBreak pageBreakInside() const { return static_cast<EPageBreak>(inherited->page_break_inside); }
+    EPageBreak pageBreakInside() const { return static_cast<EPageBreak>(noninherited_flags._page_break_inside); }
     EPageBreak pageBreakBefore() const { return static_cast<EPageBreak>(noninherited_flags._page_break_before); }
     EPageBreak pageBreakAfter() const { return static_cast<EPageBreak>(noninherited_flags._page_break_after); }
 
@@ -603,6 +609,7 @@ public:
     const Color& textStrokeColor() const { return rareInheritedData->textStrokeColor; }
     float textStrokeWidth() const { return rareInheritedData->textStrokeWidth; }
     const Color& textFillColor() const { return rareInheritedData->textFillColor; }
+    ColorSpace colorSpace() const { return static_cast<ColorSpace>(rareInheritedData->colorSpace); }
     float opacity() const { return rareNonInheritedData->opacity; }
     ControlPart appearance() const { return static_cast<ControlPart>(rareNonInheritedData->m_appearance); }
     EBoxAlignment boxAlign() const { return static_cast<EBoxAlignment>(rareNonInheritedData->flexibleBox->align); }
@@ -697,7 +704,7 @@ public:
     bool isRunningAcceleratedAnimation() const { return rareNonInheritedData->m_runningAcceleratedAnimation; }
 #endif
 
-    int lineClamp() const { return rareNonInheritedData->lineClamp; }
+    const LineClampValue& lineClamp() const { return rareNonInheritedData->lineClamp; }
     bool textSizeAdjust() const { return rareInheritedData->textSizeAdjust; }
     ETextSecurity textSecurity() const { return static_cast<ETextSecurity>(rareInheritedData->textSecurity); }
 
@@ -918,7 +925,7 @@ public:
 
     void setWidows(short w) { SET_VAR(inherited, widows, w); }
     void setOrphans(short o) { SET_VAR(inherited, orphans, o); }
-    void setPageBreakInside(EPageBreak b) { SET_VAR(inherited, page_break_inside, b); }
+    void setPageBreakInside(EPageBreak b) { noninherited_flags._page_break_inside = b; }
     void setPageBreakBefore(EPageBreak b) { noninherited_flags._page_break_before = b; }
     void setPageBreakAfter(EPageBreak b) { noninherited_flags._page_break_after = b; }
 
@@ -934,6 +941,7 @@ public:
     void setTextStrokeColor(const Color& c) { SET_VAR(rareInheritedData, textStrokeColor, c) }
     void setTextStrokeWidth(float w) { SET_VAR(rareInheritedData, textStrokeWidth, w) }
     void setTextFillColor(const Color& c) { SET_VAR(rareInheritedData, textFillColor, c) }
+    void setColorSpace(ColorSpace space) { SET_VAR(rareInheritedData, colorSpace, space) }
     void setOpacity(float f) { SET_VAR(rareNonInheritedData, opacity, f); }
     void setAppearance(ControlPart a) { SET_VAR(rareNonInheritedData, m_appearance, a); }
     void setBoxAlign(EBoxAlignment a) { SET_VAR(rareNonInheritedData.access()->flexibleBox, align, a); }
@@ -1013,7 +1021,7 @@ public:
     void setIsRunningAcceleratedAnimation(bool b = true) { SET_VAR(rareNonInheritedData, m_runningAcceleratedAnimation, b); }
 #endif
 
-    void setLineClamp(int c) { SET_VAR(rareNonInheritedData, lineClamp, c); }
+    void setLineClamp(LineClampValue c) { SET_VAR(rareNonInheritedData, lineClamp, c); }
     void setTextSizeAdjust(bool b) { SET_VAR(rareInheritedData, textSizeAdjust, b); }
     void setTextSecurity(ETextSecurity aTextSecurity) { SET_VAR(rareInheritedData, textSecurity, aTextSecurity); }
 
@@ -1106,7 +1114,7 @@ public:
     static EEmptyCell initialEmptyCells() { return SHOW; }
     static EFloat initialFloating() { return FNONE; }
     static EListStylePosition initialListStylePosition() { return OUTSIDE; }
-    static EListStyleType initialListStyleType() { return DISC; }
+    static EListStyleType initialListStyleType() { return Disc; }
     static EOverflow initialOverflowX() { return OVISIBLE; }
     static EOverflow initialOverflowY() { return OVISIBLE; }
     static EPageBreak initialPageBreak() { return PBAUTO; }
@@ -1185,7 +1193,7 @@ public:
     static Color initialBackgroundColor() { return Color::transparent; }
 
     // Keep these at the end.
-    static int initialLineClamp() { return -1; }
+    static LineClampValue initialLineClamp() { return LineClampValue(); }
     static bool initialTextSizeAdjust() { return true; }
     static ETextSecurity initialTextSecurity() { return TSNONE; }
 #if ENABLE(DASHBOARD_SUPPORT)
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h
index 3010947ad7..29412c67b5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h
@@ -2,7 +2,7 @@
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
@@ -66,15 +66,19 @@ enum StyleDifferenceContextSensitiveProperty {
 
 // Static pseudo styles. Dynamic ones are produced on the fly.
 enum PseudoId {
+    // The order must be NOP ID, public IDs, and then internal IDs.
     NOPSEUDO, FIRST_LINE, FIRST_LETTER, BEFORE, AFTER, SELECTION, FIRST_LINE_INHERITED, SCROLLBAR, FILE_UPLOAD_BUTTON, INPUT_PLACEHOLDER,
     SLIDER_THUMB, SEARCH_CANCEL_BUTTON, SEARCH_DECORATION, SEARCH_RESULTS_DECORATION, SEARCH_RESULTS_BUTTON, MEDIA_CONTROLS_PANEL,
     MEDIA_CONTROLS_PLAY_BUTTON, MEDIA_CONTROLS_MUTE_BUTTON, MEDIA_CONTROLS_TIMELINE, MEDIA_CONTROLS_TIMELINE_CONTAINER,
-    MEDIA_CONTROLS_VOLUME_SLIDER, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER, MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, MEDIA_CONTROLS_SEEK_BACK_BUTTON,
-    MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, MEDIA_CONTROLS_REWIND_BUTTON, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON,
+    MEDIA_CONTROLS_VOLUME_SLIDER, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER, MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, 
+    MEDIA_CONTROLS_SEEK_BACK_BUTTON, MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, MEDIA_CONTROLS_REWIND_BUTTON, 
+    MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON, MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON,
     MEDIA_CONTROLS_STATUS_DISPLAY, SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER,
-    INPUT_LIST_BUTTON,
+    INPUT_LIST_BUTTON, INNER_SPIN_BUTTON, OUTER_SPIN_BUTTON,
 
-    FIRST_INTERNAL_PSEUDOID = FILE_UPLOAD_BUTTON
+    FIRST_PUBLIC_PSEUDOID = FIRST_LINE,
+    FIRST_INTERNAL_PSEUDOID = FILE_UPLOAD_BUTTON,
+    PUBLIC_PSEUDOID_MASK = ((1 << FIRST_INTERNAL_PSEUDOID) - 1) & ~((1 << FIRST_PUBLIC_PSEUDOID) - 1)
 };
 
 // These have been defined in the order of their precedence for border-collapsing. Do
@@ -202,12 +206,85 @@ enum EResize {
     RESIZE_NONE, RESIZE_BOTH, RESIZE_HORIZONTAL, RESIZE_VERTICAL
 };
 
+// The order of this enum must match the order of the list style types in CSSValueKeywords.in. 
 enum EListStyleType {
-     DISC, CIRCLE, SQUARE, LDECIMAL, DECIMAL_LEADING_ZERO,
-     LOWER_ROMAN, UPPER_ROMAN, LOWER_GREEK,
-     LOWER_ALPHA, LOWER_LATIN, UPPER_ALPHA, UPPER_LATIN,
-     HEBREW, ARMENIAN, GEORGIAN, CJK_IDEOGRAPHIC,
-     HIRAGANA, KATAKANA, HIRAGANA_IROHA, KATAKANA_IROHA, LNONE
+    Disc,
+    Circle,
+    Square,
+    DecimalListStyle,
+    DecimalLeadingZero,
+    ArabicIndic,
+    BinaryListStyle,
+    Bengali,
+    Cambodian,
+    Khmer,
+    Devanagari,
+    Gujarati,
+    Gurmukhi,
+    Kannada,
+    LowerHexadecimal,
+    Lao,
+    Malayalam,
+    Mongolian,
+    Myanmar,
+    Octal,
+    Oriya,
+    Persian,
+    Urdu,
+    Telugu,
+    Tibetan,
+    Thai,
+    UpperHexadecimal,
+    LowerRoman,
+    UpperRoman,
+    LowerGreek,
+    LowerAlpha,
+    LowerLatin,
+    UpperAlpha,
+    UpperLatin,
+    Afar,
+    EthiopicHalehameAaEt,
+    EthiopicHalehameAaEr,
+    Amharic,
+    EthiopicHalehameAmEt,
+    AmharicAbegede,
+    EthiopicAbegedeAmEt,
+    CjkEarthlyBranch,
+    CjkHeavenlyStem,
+    Ethiopic,
+    EthiopicHalehameGez,
+    EthiopicAbegede,
+    EthiopicAbegedeGez,
+    HangulConsonant,
+    Hangul,
+    LowerNorwegian,
+    Oromo,
+    EthiopicHalehameOmEt,
+    Sidama,
+    EthiopicHalehameSidEt,
+    Somali,
+    EthiopicHalehameSoEt,
+    Tigre,
+    EthiopicHalehameTig,
+    TigrinyaEr,
+    EthiopicHalehameTiEr,
+    TigrinyaErAbegede,
+    EthiopicAbegedeTiEr,
+    TigrinyaEt,
+    EthiopicHalehameTiEt,
+    TigrinyaEtAbegede,
+    EthiopicAbegedeTiEt,
+    UpperGreek,
+    UpperNorwegian,
+    Hebrew,
+    Armenian,
+    Georgian,
+    CJKIdeographic,
+    Hiragana,
+    Katakana,
+    HiraganaIroha,
+    KatakanaIroha,
+    NoneListStyle
 };
 
 enum StyleContentType {
@@ -216,6 +293,8 @@ enum StyleContentType {
 
 enum EBorderFit { BorderFitBorder, BorderFitLines };
 
+enum EAnimationFillMode { AnimationFillModeNone, AnimationFillModeForwards, AnimationFillModeBackwards, AnimationFillModeBoth };
+
 enum EAnimPlayState {
     AnimPlayStatePlaying = 0x0,
     AnimPlayStatePaused = 0x1
@@ -321,6 +400,8 @@ enum ETransformStyle3D {
 enum EBackfaceVisibility {
     BackfaceVisibilityVisible, BackfaceVisibilityHidden
 };
+    
+enum ELineClampType { LineClampLineCount, LineClampPercentage };
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.cpp b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.cpp
index e8827c4733..79580885bd 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.cpp
@@ -8,8 +8,6 @@
     Copyright (C) 2002-2003 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Apple Computer, Inc.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -32,11 +30,14 @@
 
 #include "CSSPrimitiveValue.h"
 #include "CSSValueList.h"
+#include "IntRect.h"
 #include "NodeRenderStyle.h"
 #include "RenderObject.h"
 #include "RenderStyle.h"
 #include "SVGStyledElement.h"
 
+using namespace std;
+
 namespace WebCore {
 
 SVGRenderStyle::SVGRenderStyle()
@@ -143,6 +144,56 @@ float SVGRenderStyle::cssPrimitiveToLength(const RenderObject* item, CSSValue* v
     return primitive->computeLengthFloat(const_cast<RenderStyle*>(item->style()), item->document()->documentElement()->renderStyle());
 }
 
+
+static void getSVGShadowExtent(ShadowData* shadow, int& top, int& right, int& bottom, int& left)
+{
+    top = 0;
+    right = 0;
+    bottom = 0;
+    left = 0;
+
+    int blurAndSpread = shadow->blur + shadow->spread;
+
+    top = min(top, shadow->y - blurAndSpread);
+    right = max(right, shadow->x + blurAndSpread);
+    bottom = max(bottom, shadow->y + blurAndSpread);
+    left = min(left, shadow->x - blurAndSpread);
+}
+
+void SVGRenderStyle::inflateForShadow(IntRect& repaintRect) const
+{
+    ShadowData* svgShadow = shadow();
+    if (!svgShadow)
+        return;
+
+    FloatRect repaintFloatRect = FloatRect(repaintRect);
+    inflateForShadow(repaintFloatRect);
+    repaintRect = enclosingIntRect(repaintFloatRect);
+}
+
+void SVGRenderStyle::inflateForShadow(FloatRect& repaintRect) const
+{
+    ShadowData* svgShadow = shadow();
+    if (!svgShadow)
+        return;
+
+    int shadowTop;
+    int shadowRight;
+    int shadowBottom;
+    int shadowLeft;
+    getSVGShadowExtent(svgShadow, shadowTop, shadowRight, shadowBottom, shadowLeft);
+
+    int overflowLeft = repaintRect.x() + shadowLeft;
+    int overflowRight = repaintRect.right() + shadowRight;
+    int overflowTop = repaintRect.y() + shadowTop;
+    int overflowBottom = repaintRect.bottom() + shadowBottom;
+
+    repaintRect.setX(overflowLeft);
+    repaintRect.setY(overflowTop);
+    repaintRect.setWidth(overflowRight - overflowLeft);
+    repaintRect.setHeight(overflowBottom - overflowTop);
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h
index 12477d771e..3f35a636b6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2005, 2006 Apple Computer, Inc.
 
-     This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -32,180 +30,184 @@
 #include "SVGRenderStyleDefs.h"
 #include "ShadowData.h"
 
-#include <wtf/Platform.h>
-
 namespace WebCore {
 
-    class RenderObject;
-    class RenderStyle;
-
-    class SVGRenderStyle : public RefCounted<SVGRenderStyle> {    
-    public:
-        static PassRefPtr<SVGRenderStyle> create() { return adoptRef(new SVGRenderStyle); }
-        PassRefPtr<SVGRenderStyle> copy() const { return adoptRef(new SVGRenderStyle(*this));}
-        ~SVGRenderStyle();
+class FloatRect;
+class IntRect;
+class RenderObject;
+class RenderStyle;
+
+class SVGRenderStyle : public RefCounted<SVGRenderStyle> {    
+public:
+    static PassRefPtr<SVGRenderStyle> create() { return adoptRef(new SVGRenderStyle); }
+    PassRefPtr<SVGRenderStyle> copy() const { return adoptRef(new SVGRenderStyle(*this));}
+    ~SVGRenderStyle();
+
+    bool inheritedNotEqual(const SVGRenderStyle*) const;
+    void inheritFrom(const SVGRenderStyle*);
+
+    // FIXME: These functions should move to ShadowData.
+    void inflateForShadow(IntRect&) const;
+    void inflateForShadow(FloatRect&) const;
+    
+    bool operator==(const SVGRenderStyle&) const;
+    bool operator!=(const SVGRenderStyle& o) const { return !(*this == o); }
+
+    // SVG CSS Properties
+    SVG_RS_DEFINE_ATTRIBUTE(EAlignmentBaseline, AlignmentBaseline, alignmentBaseline, AB_AUTO)
+    SVG_RS_DEFINE_ATTRIBUTE(EDominantBaseline, DominantBaseline, dominantBaseline, DB_AUTO)
+    SVG_RS_DEFINE_ATTRIBUTE(EBaselineShift, BaselineShift, baselineShift, BS_BASELINE)
+
+    SVG_RS_DEFINE_ATTRIBUTE_INHERITED(LineCap, CapStyle, capStyle, ButtCap)
+    SVG_RS_DEFINE_ATTRIBUTE_INHERITED(WindRule, ClipRule, clipRule, RULE_NONZERO)
+    SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EColorInterpolation, ColorInterpolation, colorInterpolation, CI_SRGB)
+    SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EColorInterpolation, ColorInterpolationFilters, colorInterpolationFilters, CI_LINEARRGB)
+    SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EColorRendering, ColorRendering, colorRendering, CR_AUTO)
+    SVG_RS_DEFINE_ATTRIBUTE_INHERITED(WindRule, FillRule, fillRule, RULE_NONZERO)
+    SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EImageRendering, ImageRendering, imageRendering, IR_AUTO)
+    SVG_RS_DEFINE_ATTRIBUTE_INHERITED(LineJoin, JoinStyle, joinStyle, MiterJoin)
+    SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EShapeRendering, ShapeRendering, shapeRendering, SR_AUTO)
+    SVG_RS_DEFINE_ATTRIBUTE_INHERITED(ETextAnchor, TextAnchor, textAnchor, TA_START)
+    SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EWritingMode, WritingMode, writingMode, WM_LRTB)
+    SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EGlyphOrientation, GlyphOrientationHorizontal, glyphOrientationHorizontal, GO_0DEG)
+    SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EGlyphOrientation, GlyphOrientationVertical, glyphOrientationVertical, GO_AUTO)
+
+    // SVG CSS Properties (using DataRef's)
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(float, fill, opacity, FillOpacity, fillOpacity, 1.0f)
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(SVGPaint, fill, paint, FillPaint, fillPaint, SVGPaint::defaultFill())
+
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(float, stroke, opacity, StrokeOpacity, strokeOpacity, 1.0f)
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(SVGPaint, stroke, paint, StrokePaint, strokePaint, SVGPaint::defaultStroke())
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(CSSValueList, stroke, dashArray, StrokeDashArray, strokeDashArray, 0)
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(float, stroke, miterLimit, StrokeMiterLimit, strokeMiterLimit, 4.0f)
+    
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(CSSValue, stroke, width, StrokeWidth, strokeWidth, 0)
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(CSSValue, stroke, dashOffset, StrokeDashOffset, strokeDashOffset, 0);
+
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(CSSValue, text, kerning, Kerning, kerning, 0)
+
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(float, stops, opacity, StopOpacity, stopOpacity, 1.0f)
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(Color, stops, color, StopColor, stopColor, Color(0, 0, 0))    
+
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(String, clip, clipPath, ClipPath, clipPath, String())
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(String, mask, maskElement, MaskElement, maskElement, String())
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(String, markers, startMarker, StartMarker, startMarker, String())
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(String, markers, midMarker, MidMarker, midMarker, String())
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(String, markers, endMarker, EndMarker, endMarker, String())
+
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(String, misc, filter, Filter, filter, String())
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(float, misc, floodOpacity, FloodOpacity, floodOpacity, 1.0f)
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(Color, misc, floodColor, FloodColor, floodColor, Color(0, 0, 0))
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(Color, misc, lightingColor, LightingColor, lightingColor, Color(255, 255, 255))
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(CSSValue, misc, baselineShiftValue, BaselineShiftValue, baselineShiftValue, 0)
+
+    SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_OWNPTR(ShadowData, shadowSVG, shadow, Shadow, shadow, 0)
+
+    // convenience
+    bool hasStroke() const { return (strokePaint()->paintType() != SVGPaint::SVG_PAINTTYPE_NONE); }
+    bool hasFill() const { return (fillPaint()->paintType() != SVGPaint::SVG_PAINTTYPE_NONE); }
+
+    static float cssPrimitiveToLength(const RenderObject*, CSSValue*, float defaultValue = 0.0f);
+
+protected:
+    // inherit
+    struct InheritedFlags {
+        bool operator==(const InheritedFlags& other) const
+        {
+            return (_colorRendering == other._colorRendering)
+                && (_imageRendering == other._imageRendering)
+                && (_shapeRendering == other._shapeRendering)
+                && (_clipRule == other._clipRule)
+                && (_fillRule == other._fillRule)
+                && (_capStyle == other._capStyle)
+                && (_joinStyle == other._joinStyle)
+                && (_textAnchor == other._textAnchor)
+                && (_colorInterpolation == other._colorInterpolation)
+                && (_colorInterpolationFilters == other._colorInterpolationFilters)
+                && (_writingMode == other._writingMode)
+                && (_glyphOrientationHorizontal == other._glyphOrientationHorizontal)
+                && (_glyphOrientationVertical == other._glyphOrientationVertical);
+        }
 
-        bool inheritedNotEqual(const SVGRenderStyle*) const;
-        void inheritFrom(const SVGRenderStyle*);
-        
-        bool operator==(const SVGRenderStyle&) const;
-        bool operator!=(const SVGRenderStyle& o) const { return !(*this == o); }
-
-        // SVG CSS Properties
-        SVG_RS_DEFINE_ATTRIBUTE(EAlignmentBaseline, AlignmentBaseline, alignmentBaseline, AB_AUTO)
-        SVG_RS_DEFINE_ATTRIBUTE(EDominantBaseline, DominantBaseline, dominantBaseline, DB_AUTO)
-        SVG_RS_DEFINE_ATTRIBUTE(EBaselineShift, BaselineShift, baselineShift, BS_BASELINE)
-
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(LineCap, CapStyle, capStyle, ButtCap)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(WindRule, ClipRule, clipRule, RULE_NONZERO)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EColorInterpolation, ColorInterpolation, colorInterpolation, CI_SRGB)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EColorInterpolation, ColorInterpolationFilters, colorInterpolationFilters, CI_LINEARRGB)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EColorRendering, ColorRendering, colorRendering, CR_AUTO)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(WindRule, FillRule, fillRule, RULE_NONZERO)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EImageRendering, ImageRendering, imageRendering, IR_AUTO)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(LineJoin, JoinStyle, joinStyle, MiterJoin)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EShapeRendering, ShapeRendering, shapeRendering, SR_AUTO)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(ETextAnchor, TextAnchor, textAnchor, TA_START)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EWritingMode, WritingMode, writingMode, WM_LRTB)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EGlyphOrientation, GlyphOrientationHorizontal, glyphOrientationHorizontal, GO_0DEG)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EGlyphOrientation, GlyphOrientationVertical, glyphOrientationVertical, GO_AUTO)
-
-        // SVG CSS Properties (using DataRef's)
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(float, fill, opacity, FillOpacity, fillOpacity, 1.0f)
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(SVGPaint, fill, paint, FillPaint, fillPaint, SVGPaint::defaultFill())
-
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(float, stroke, opacity, StrokeOpacity, strokeOpacity, 1.0f)
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(SVGPaint, stroke, paint, StrokePaint, strokePaint, SVGPaint::defaultStroke())
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(CSSValueList, stroke, dashArray, StrokeDashArray, strokeDashArray, 0)
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(float, stroke, miterLimit, StrokeMiterLimit, strokeMiterLimit, 4.0f)
-        
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(CSSValue, stroke, width, StrokeWidth, strokeWidth, 0)
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(CSSValue, stroke, dashOffset, StrokeDashOffset, strokeDashOffset, 0);
-
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(CSSValue, text, kerning, Kerning, kerning, 0)
-
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(float, stops, opacity, StopOpacity, stopOpacity, 1.0f)
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(Color, stops, color, StopColor, stopColor, Color(0, 0, 0))    
-
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(String, clip, clipPath, ClipPath, clipPath, String())
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(String, mask, maskElement, MaskElement, maskElement, String())
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(String, markers, startMarker, StartMarker, startMarker, String())
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(String, markers, midMarker, MidMarker, midMarker, String())
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(String, markers, endMarker, EndMarker, endMarker, String())
-
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(String, misc, filter, Filter, filter, String())
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(float, misc, floodOpacity, FloodOpacity, floodOpacity, 1.0f)
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(Color, misc, floodColor, FloodColor, floodColor, Color(0, 0, 0))
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(Color, misc, lightingColor, LightingColor, lightingColor, Color(255, 255, 255))
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(CSSValue, misc, baselineShiftValue, BaselineShiftValue, baselineShiftValue, 0)
-
-        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_OWNPTR(ShadowData, shadowSVG, shadow, Shadow, shadow, 0)
-
-        // convenience
-        bool hasStroke() const { return (strokePaint()->paintType() != SVGPaint::SVG_PAINTTYPE_NONE); }
-        bool hasFill() const { return (fillPaint()->paintType() != SVGPaint::SVG_PAINTTYPE_NONE); }
-
-        static float cssPrimitiveToLength(const RenderObject*, CSSValue*, float defaultValue = 0.0f);
-
-    protected:
-        // inherit
-        struct InheritedFlags {
-            bool operator==(const InheritedFlags& other) const
-            {
-                return (_colorRendering == other._colorRendering) &&
-                       (_imageRendering == other._imageRendering) &&
-                       (_shapeRendering == other._shapeRendering) &&
-                       (_clipRule == other._clipRule) &&
-                       (_fillRule == other._fillRule) &&
-                       (_capStyle == other._capStyle) &&
-                       (_joinStyle == other._joinStyle) &&
-                       (_textAnchor == other._textAnchor) &&
-                       (_colorInterpolation == other._colorInterpolation) &&
-                       (_colorInterpolationFilters == other._colorInterpolationFilters) &&
-                       (_writingMode == other._writingMode) &&
-                       (_glyphOrientationHorizontal == other._glyphOrientationHorizontal) &&
-                       (_glyphOrientationVertical == other._glyphOrientationVertical);
-            }
-
-            bool operator!=(const InheritedFlags& other) const
-            {
-                return !(*this == other);
-            }
-
-            unsigned _colorRendering : 2; // EColorRendering
-            unsigned _imageRendering : 2; // EImageRendering 
-            unsigned _shapeRendering : 2; // EShapeRendering 
-            unsigned _clipRule : 1; // WindRule
-            unsigned _fillRule : 1; // WindRule
-            unsigned _capStyle : 2; // LineCap
-            unsigned _joinStyle : 2; // LineJoin
-            unsigned _textAnchor : 2; // ETextAnchor
-            unsigned _colorInterpolation : 2; // EColorInterpolation
-            unsigned _colorInterpolationFilters : 2; // EColorInterpolation
-            unsigned _writingMode : 3; // EWritingMode
-            unsigned _glyphOrientationHorizontal : 3; // EGlyphOrientation
-            unsigned _glyphOrientationVertical : 3; // EGlyphOrientation
-        } svg_inherited_flags;
-
-        // don't inherit
-        struct NonInheritedFlags {
-            // 32 bit non-inherited, don't add to the struct, or the operator will break.
-            bool operator==(const NonInheritedFlags &other) const { return _niflags == other._niflags; }
-            bool operator!=(const NonInheritedFlags &other) const { return _niflags != other._niflags; }
-
-            union {
-                struct {
-                    unsigned _alignmentBaseline : 4; // EAlignmentBaseline 
-                    unsigned _dominantBaseline : 4; // EDominantBaseline
-                    unsigned _baselineShift : 2; // EBaselineShift
-                    // 22 bits unused
-                } f;
-                uint32_t _niflags;
-            };
-        } svg_noninherited_flags;
-
-        // inherited attributes
-        DataRef<StyleFillData> fill;
-        DataRef<StyleStrokeData> stroke;
-        DataRef<StyleMarkerData> markers;
-        DataRef<StyleTextData> text;
-
-        // non-inherited attributes
-        DataRef<StyleStopData> stops;
-        DataRef<StyleClipData> clip;
-        DataRef<StyleMaskData> mask;
-        DataRef<StyleMiscData> misc;
-        DataRef<StyleShadowSVGData> shadowSVG;
-
-    private:
-        enum CreateDefaultType { CreateDefault };
-            
-        SVGRenderStyle();
-        SVGRenderStyle(const SVGRenderStyle&);
-        SVGRenderStyle(CreateDefaultType); // Used to create the default style.
-
-        void setBitDefaults()
+        bool operator!=(const InheritedFlags& other) const
         {
-            svg_inherited_flags._clipRule = initialClipRule();
-            svg_inherited_flags._colorRendering = initialColorRendering();
-            svg_inherited_flags._fillRule = initialFillRule();
-            svg_inherited_flags._imageRendering = initialImageRendering();
-            svg_inherited_flags._shapeRendering = initialShapeRendering();
-            svg_inherited_flags._textAnchor = initialTextAnchor();
-            svg_inherited_flags._capStyle = initialCapStyle();
-            svg_inherited_flags._joinStyle = initialJoinStyle();
-            svg_inherited_flags._colorInterpolation = initialColorInterpolation();
-            svg_inherited_flags._colorInterpolationFilters = initialColorInterpolationFilters();
-            svg_inherited_flags._writingMode = initialWritingMode();
-            svg_inherited_flags._glyphOrientationHorizontal = initialGlyphOrientationHorizontal();
-            svg_inherited_flags._glyphOrientationVertical = initialGlyphOrientationVertical();
-
-            svg_noninherited_flags._niflags = 0;
-            svg_noninherited_flags.f._alignmentBaseline = initialAlignmentBaseline();
-            svg_noninherited_flags.f._dominantBaseline = initialDominantBaseline();
-            svg_noninherited_flags.f._baselineShift = initialBaselineShift();
+            return !(*this == other);
         }
-    };
+
+        unsigned _colorRendering : 2; // EColorRendering
+        unsigned _imageRendering : 2; // EImageRendering 
+        unsigned _shapeRendering : 2; // EShapeRendering 
+        unsigned _clipRule : 1; // WindRule
+        unsigned _fillRule : 1; // WindRule
+        unsigned _capStyle : 2; // LineCap
+        unsigned _joinStyle : 2; // LineJoin
+        unsigned _textAnchor : 2; // ETextAnchor
+        unsigned _colorInterpolation : 2; // EColorInterpolation
+        unsigned _colorInterpolationFilters : 2; // EColorInterpolation
+        unsigned _writingMode : 3; // EWritingMode
+        unsigned _glyphOrientationHorizontal : 3; // EGlyphOrientation
+        unsigned _glyphOrientationVertical : 3; // EGlyphOrientation
+    } svg_inherited_flags;
+
+    // don't inherit
+    struct NonInheritedFlags {
+        // 32 bit non-inherited, don't add to the struct, or the operator will break.
+        bool operator==(const NonInheritedFlags &other) const { return _niflags == other._niflags; }
+        bool operator!=(const NonInheritedFlags &other) const { return _niflags != other._niflags; }
+
+        union {
+            struct {
+                unsigned _alignmentBaseline : 4; // EAlignmentBaseline 
+                unsigned _dominantBaseline : 4; // EDominantBaseline
+                unsigned _baselineShift : 2; // EBaselineShift
+                // 22 bits unused
+            } f;
+            uint32_t _niflags;
+        };
+    } svg_noninherited_flags;
+
+    // inherited attributes
+    DataRef<StyleFillData> fill;
+    DataRef<StyleStrokeData> stroke;
+    DataRef<StyleMarkerData> markers;
+    DataRef<StyleTextData> text;
+
+    // non-inherited attributes
+    DataRef<StyleStopData> stops;
+    DataRef<StyleClipData> clip;
+    DataRef<StyleMaskData> mask;
+    DataRef<StyleMiscData> misc;
+    DataRef<StyleShadowSVGData> shadowSVG;
+
+private:
+    enum CreateDefaultType { CreateDefault };
+        
+    SVGRenderStyle();
+    SVGRenderStyle(const SVGRenderStyle&);
+    SVGRenderStyle(CreateDefaultType); // Used to create the default style.
+
+    void setBitDefaults()
+    {
+        svg_inherited_flags._clipRule = initialClipRule();
+        svg_inherited_flags._colorRendering = initialColorRendering();
+        svg_inherited_flags._fillRule = initialFillRule();
+        svg_inherited_flags._imageRendering = initialImageRendering();
+        svg_inherited_flags._shapeRendering = initialShapeRendering();
+        svg_inherited_flags._textAnchor = initialTextAnchor();
+        svg_inherited_flags._capStyle = initialCapStyle();
+        svg_inherited_flags._joinStyle = initialJoinStyle();
+        svg_inherited_flags._colorInterpolation = initialColorInterpolation();
+        svg_inherited_flags._colorInterpolationFilters = initialColorInterpolationFilters();
+        svg_inherited_flags._writingMode = initialWritingMode();
+        svg_inherited_flags._glyphOrientationHorizontal = initialGlyphOrientationHorizontal();
+        svg_inherited_flags._glyphOrientationVertical = initialGlyphOrientationVertical();
+
+        svg_noninherited_flags._niflags = 0;
+        svg_noninherited_flags.f._alignmentBaseline = initialAlignmentBaseline();
+        svg_noninherited_flags.f._dominantBaseline = initialDominantBaseline();
+        svg_noninherited_flags.f._baselineShift = initialBaselineShift();
+    }
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.cpp b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.cpp
index 2ed1d8fcc1..093f1f1fb6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.cpp
@@ -8,8 +8,6 @@
     Copyright (C) 2002-2003 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Apple Computer, Inc.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h
index f4cf9327a3..8f01d9f12d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h
@@ -8,8 +8,6 @@
               (C) 2000-2003 Dirk Mueller (mueller@kde.org)
               (C) 2002-2003 Apple Computer, Inc.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/ShadowData.h b/src/3rdparty/webkit/WebCore/rendering/style/ShadowData.h
index f4061f2e5e..089cf77599 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/ShadowData.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/ShadowData.h
@@ -26,6 +26,7 @@
 #define ShadowData_h
 
 #include "Color.h"
+#include <wtf/FastAllocBase.h>
 
 namespace WebCore {
 
@@ -33,7 +34,7 @@ enum ShadowStyle { Normal, Inset };
 
 // This struct holds information about shadows for the text-shadow and box-shadow properties.
 
-struct ShadowData {
+struct ShadowData : FastAllocBase {
     ShadowData()
         : x(0)
         , y(0)
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/StyleInheritedData.cpp b/src/3rdparty/webkit/WebCore/rendering/style/StyleInheritedData.cpp
index f59c0c2420..c73497f397 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/StyleInheritedData.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/StyleInheritedData.cpp
@@ -37,7 +37,6 @@ StyleInheritedData::StyleInheritedData()
     , vertical_border_spacing(RenderStyle::initialVerticalBorderSpacing())
     , widows(RenderStyle::initialWidows())
     , orphans(RenderStyle::initialOrphans())
-    , page_break_inside(RenderStyle::initialPageBreak())
 {
 }
 
@@ -58,7 +57,6 @@ StyleInheritedData::StyleInheritedData(const StyleInheritedData& o)
     , vertical_border_spacing(o.vertical_border_spacing)
     , widows(o.widows)
     , orphans(o.orphans)
-    , page_break_inside(o.page_break_inside)
 {
 }
 
@@ -84,8 +82,7 @@ bool StyleInheritedData::operator==(const StyleInheritedData& o) const
         horizontal_border_spacing == o.horizontal_border_spacing &&
         vertical_border_spacing == o.vertical_border_spacing &&
         widows == o.widows &&
-        orphans == o.orphans &&
-        page_break_inside == o.page_break_inside;
+        orphans == o.orphans;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/StyleInheritedData.h b/src/3rdparty/webkit/WebCore/rendering/style/StyleInheritedData.h
index 548ca72364..3b30b8f64a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/StyleInheritedData.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/StyleInheritedData.h
@@ -68,7 +68,6 @@ public:
     // Paged media properties.
     short widows;
     short orphans;
-    unsigned page_break_inside : 2; // EPageBreak
     
 private:
     StyleInheritedData();
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/StyleRareInheritedData.cpp b/src/3rdparty/webkit/WebCore/rendering/style/StyleRareInheritedData.cpp
index ce21720c5b..f731098f80 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/StyleRareInheritedData.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/StyleRareInheritedData.cpp
@@ -39,6 +39,7 @@ StyleRareInheritedData::StyleRareInheritedData()
     , textSizeAdjust(RenderStyle::initialTextSizeAdjust())
     , resize(RenderStyle::initialResize())
     , userSelect(RenderStyle::initialUserSelect())
+    , colorSpace(DeviceColorSpace)
 {
 }
 
@@ -58,6 +59,7 @@ StyleRareInheritedData::StyleRareInheritedData(const StyleRareInheritedData& o)
     , textSizeAdjust(o.textSizeAdjust)
     , resize(o.resize)
     , userSelect(o.userSelect)
+    , colorSpace(o.colorSpace)
 {
 }
 
@@ -81,7 +83,8 @@ bool StyleRareInheritedData::operator==(const StyleRareInheritedData& o) const
         && khtmlLineBreak == o.khtmlLineBreak
         && textSizeAdjust == o.textSizeAdjust
         && resize == o.resize
-        && userSelect == o.userSelect;
+        && userSelect == o.userSelect
+        && colorSpace == o.colorSpace;
 }
 
 bool StyleRareInheritedData::shadowDataEquivalent(const StyleRareInheritedData& o) const
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/StyleRareInheritedData.h b/src/3rdparty/webkit/WebCore/rendering/style/StyleRareInheritedData.h
index 06ad400480..2e87e6b97f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/StyleRareInheritedData.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/StyleRareInheritedData.h
@@ -65,6 +65,7 @@ public:
     bool textSizeAdjust : 1; // An Apple extension.
     unsigned resize : 2; // EResize
     unsigned userSelect : 1;  // EUserSelect
+    unsigned colorSpace : 1; // ColorSpace
     
 private:
     StyleRareInheritedData();
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/StyleRareNonInheritedData.h b/src/3rdparty/webkit/WebCore/rendering/style/StyleRareNonInheritedData.h
index 8dd22b39b1..452b273de2 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/StyleRareNonInheritedData.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/StyleRareNonInheritedData.h
@@ -29,6 +29,7 @@
 #include "CursorData.h"
 #include "DataRef.h"
 #include "FillLayer.h"
+#include "LineClampValue.h"
 #include "NinePieceImage.h"
 #include "StyleTransformData.h"
 #include <wtf/OwnPtr.h>
@@ -77,7 +78,7 @@ public:
     bool animationDataEquivalent(const StyleRareNonInheritedData&) const;
     bool transitionDataEquivalent(const StyleRareNonInheritedData&) const;
 
-    int lineClamp; // An Apple extension.
+    LineClampValue lineClamp; // An Apple extension.
 #if ENABLE(DASHBOARD_SUPPORT)
     Vector<StyleDashboardRegion> m_dashboardRegions;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/storage/Database.cpp b/src/3rdparty/webkit/WebCore/storage/Database.cpp
index 2f82743ec8..b8023dd6b4 100644
--- a/src/3rdparty/webkit/WebCore/storage/Database.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/Database.cpp
@@ -35,6 +35,7 @@
 #include "ChangeVersionWrapper.h"
 #include "CString.h"
 #include "DatabaseAuthorizer.h"
+#include "DatabaseCallback.h"
 #include "DatabaseTask.h"
 #include "DatabaseThread.h"
 #include "DatabaseTracker.h"
@@ -53,8 +54,8 @@
 #include "SQLResultSet.h"
 #include "SQLTransactionClient.h"
 #include "SQLTransactionCoordinator.h"
-#include <wtf/MainThread.h>
-#endif
+
+#endif // ENABLE(DATABASE)
 
 #if USE(JSC)
 #include "JSDOMWindow.h"
@@ -73,6 +74,18 @@ const String& Database::databaseInfoTableName()
 
 #if ENABLE(DATABASE)
 
+static bool isDatabaseAvailable = true;
+
+void Database::setIsAvailable(bool available)
+{
+    isDatabaseAvailable = available;
+}
+
+bool Database::isAvailable()
+{
+    return isDatabaseAvailable;
+}
+
 static Mutex& guidMutex()
 {
     // Note: We don't have to use AtomicallyInitializedStatic here because
@@ -120,36 +133,75 @@ static const String& databaseVersionKey()
 
 static int guidForOriginAndName(const String& origin, const String& name);
 
-PassRefPtr<Database> Database::openDatabase(Document* document, const String& name, const String& expectedVersion, const String& displayName, unsigned long estimatedSize, ExceptionCode& e)
+class DatabaseCreationCallbackTask : public ScriptExecutionContext::Task {
+public:
+    static PassOwnPtr<DatabaseCreationCallbackTask> create(PassRefPtr<Database> database)
+    {
+        return new DatabaseCreationCallbackTask(database);
+    }
+
+    virtual void performTask(ScriptExecutionContext*)
+    {
+        m_database->performCreationCallback();
+    }
+
+private:
+    DatabaseCreationCallbackTask(PassRefPtr<Database> database)
+        : m_database(database)
+    {
+    }
+
+    RefPtr<Database> m_database;
+};
+
+PassRefPtr<Database> Database::openDatabase(ScriptExecutionContext* context, const String& name,
+                                            const String& expectedVersion, const String& displayName,
+                                            unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback,
+                                            ExceptionCode& e)
 {
-    if (!DatabaseTracker::tracker().canEstablishDatabase(document, name, displayName, estimatedSize)) {
+    if (!DatabaseTracker::tracker().canEstablishDatabase(context, name, displayName, estimatedSize)) {
         // FIXME: There should be an exception raised here in addition to returning a null Database object.  The question has been raised with the WHATWG.
-        LOG(StorageAPI, "Database %s for origin %s not allowed to be established", name.ascii().data(), document->securityOrigin()->toString().ascii().data());
+        LOG(StorageAPI, "Database %s for origin %s not allowed to be established", name.ascii().data(), context->securityOrigin()->toString().ascii().data());
         return 0;
     }
 
-    RefPtr<Database> database = adoptRef(new Database(document, name, expectedVersion, displayName, estimatedSize));
+    RefPtr<Database> database = adoptRef(new Database(context, name, expectedVersion, displayName, estimatedSize, creationCallback));
 
     if (!database->openAndVerifyVersion(e)) {
-       LOG(StorageAPI, "Failed to open and verify version (expected %s) of database %s", expectedVersion.ascii().data(), database->databaseDebugName().ascii().data());
-       return 0;
+        LOG(StorageAPI, "Failed to open and verify version (expected %s) of database %s", expectedVersion.ascii().data(), database->databaseDebugName().ascii().data());
+        context->removeOpenDatabase(database.get());
+        DatabaseTracker::tracker().removeOpenDatabase(database.get());
+        return 0;
     }
 
-    DatabaseTracker::tracker().setDatabaseDetails(document->securityOrigin(), name, displayName, estimatedSize);
-
-    document->setHasOpenDatabases();
+    DatabaseTracker::tracker().setDatabaseDetails(context->securityOrigin(), name, displayName, estimatedSize);
 
+    context->setHasOpenDatabases();
 #if ENABLE(INSPECTOR)
-    if (Page* page = document->frame()->page())
-        page->inspectorController()->didOpenDatabase(database.get(), document->securityOrigin()->host(), name, expectedVersion);
+    if (context->isDocument()) {
+        Document* document = static_cast<Document*>(context);
+        if (Page* page = document->page())
+            page->inspectorController()->didOpenDatabase(database.get(), context->securityOrigin()->host(), name, expectedVersion);
+    }
 #endif
 
+    // If it's a new database and a creation callback was provided, reset the expected
+    // version to "" and schedule the creation callback. Because of some subtle String
+    // implementation issues, we have to reset m_expectedVersion here instead of doing
+    // it inside performOpenAndVerify() which is run on the DB thread.
+    if (database->isNew() && database->m_creationCallback.get()) {
+        database->m_expectedVersion = "";
+        LOG(StorageAPI, "Scheduling DatabaseCreationCallbackTask for database %p\n", database.get());
+        database->m_scriptExecutionContext->postTask(DatabaseCreationCallbackTask::create(database));
+    }
+
     return database;
 }
 
-Database::Database(Document* document, const String& name, const String& expectedVersion, const String& displayName, unsigned long estimatedSize)
+Database::Database(ScriptExecutionContext* context, const String& name, const String& expectedVersion, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback)
     : m_transactionInProgress(false)
-    , m_document(document)
+    , m_isTransactionQueueEnabled(true)
+    , m_scriptExecutionContext(context)
     , m_name(name.crossThreadString())
     , m_guid(0)
     , m_expectedVersion(expectedVersion.crossThreadString())
@@ -158,17 +210,18 @@ Database::Database(Document* document, const String& name, const String& expecte
     , m_deleted(false)
     , m_stopped(false)
     , m_opened(false)
+    , m_new(false)
+    , m_creationCallback(creationCallback)
 {
-    ASSERT(document);
-    m_mainThreadSecurityOrigin = document->securityOrigin();
+    ASSERT(m_scriptExecutionContext.get());
+    m_mainThreadSecurityOrigin = m_scriptExecutionContext->securityOrigin();
     m_databaseThreadSecurityOrigin = m_mainThreadSecurityOrigin->threadsafeCopy();
-
     if (m_name.isNull())
         m_name = "";
 
     ScriptController::initializeThreading();
 
-    m_guid = guidForOriginAndName(m_mainThreadSecurityOrigin->toString(), name);
+    m_guid = guidForOriginAndName(securityOrigin()->toString(), name);
 
     {
         MutexLocker locker(guidMutex());
@@ -182,38 +235,51 @@ Database::Database(Document* document, const String& name, const String& expecte
         hashSet->add(this);
     }
 
-    ASSERT(m_document->databaseThread());
-
-    m_filename = DatabaseTracker::tracker().fullPathForDatabase(m_mainThreadSecurityOrigin.get(), m_name);
+    ASSERT(m_scriptExecutionContext->databaseThread());
+    m_filename = DatabaseTracker::tracker().fullPathForDatabase(securityOrigin(), m_name);
 
     DatabaseTracker::tracker().addOpenDatabase(this);
-    m_document->addOpenDatabase(this);
+    context->addOpenDatabase(this);
 }
 
+class DerefContextTask : public ScriptExecutionContext::Task {
+public:
+    static PassOwnPtr<DerefContextTask> create()
+    {
+        return new DerefContextTask();
+    }
+
+    virtual void performTask(ScriptExecutionContext* context)
+    {
+        context->deref();
+    }
+
+    virtual bool isCleanupTask() const { return true; }
+};
+
 Database::~Database()
 {
-    if (m_document->databaseThread())
-        m_document->databaseThread()->unscheduleDatabaseTasks(this);
-
-    DatabaseTracker::tracker().removeOpenDatabase(this);
-    m_document->removeOpenDatabase(this);
+    // The reference to the ScriptExecutionContext needs to be cleared on the JavaScript thread.  If we're on that thread already, we can just let the RefPtr's destruction do the dereffing.
+    if (!m_scriptExecutionContext->isContextThread()) {
+        m_scriptExecutionContext->postTask(DerefContextTask::create());
+        m_scriptExecutionContext.release().releaseRef();
+    }
 }
 
 bool Database::openAndVerifyVersion(ExceptionCode& e)
 {
-    if (!m_document->databaseThread())
+    if (!m_scriptExecutionContext->databaseThread())
         return false;
     m_databaseAuthorizer = DatabaseAuthorizer::create();
 
-    RefPtr<DatabaseOpenTask> task = DatabaseOpenTask::create(this);
+    bool success = false;
+    DatabaseTaskSynchronizer synchronizer;
+    OwnPtr<DatabaseOpenTask> task = DatabaseOpenTask::create(this, &synchronizer, e, success);
 
-    task->lockForSynchronousScheduling();
-    m_document->databaseThread()->scheduleImmediateTask(task);
-    task->waitForSynchronousCompletion();
+    m_scriptExecutionContext->databaseThread()->scheduleImmediateTask(task.release());
+    synchronizer.waitForTaskCompletion();
 
-    ASSERT(task->isComplete());
-    e = task->exceptionCode();
-    return task->openSuccessful();
+    return success;
 }
 
 
@@ -305,49 +371,85 @@ bool Database::versionMatchesExpected() const
 
 void Database::markAsDeletedAndClose()
 {
-    if (m_deleted || !m_document->databaseThread())
+    if (m_deleted || !m_scriptExecutionContext->databaseThread())
         return;
 
     LOG(StorageAPI, "Marking %s (%p) as deleted", stringIdentifier().ascii().data(), this);
     m_deleted = true;
 
-    if (m_document->databaseThread()->terminationRequested()) {
+    if (m_scriptExecutionContext->databaseThread()->terminationRequested()) {
         LOG(StorageAPI, "Database handle %p is on a terminated DatabaseThread, cannot be marked for normal closure\n", this);
         return;
     }
 
-    m_document->databaseThread()->unscheduleDatabaseTasks(this);
+    m_scriptExecutionContext->databaseThread()->unscheduleDatabaseTasks(this);
 
-    RefPtr<DatabaseCloseTask> task = DatabaseCloseTask::create(this);
+    DatabaseTaskSynchronizer synchronizer;
+    OwnPtr<DatabaseCloseTask> task = DatabaseCloseTask::create(this, &synchronizer);
 
-    task->lockForSynchronousScheduling();
-    m_document->databaseThread()->scheduleImmediateTask(task);
-    task->waitForSynchronousCompletion();
+    m_scriptExecutionContext->databaseThread()->scheduleImmediateTask(task.release());
+    synchronizer.waitForTaskCompletion();
+
+    // DatabaseCloseTask tells Database::close not to do these two removals so that we can do them here synchronously.
+    m_scriptExecutionContext->removeOpenDatabase(this);
+    DatabaseTracker::tracker().removeOpenDatabase(this);
 }
 
-void Database::close()
+class ContextRemoveOpenDatabaseTask : public ScriptExecutionContext::Task {
+public:
+    static PassOwnPtr<ContextRemoveOpenDatabaseTask> create(PassRefPtr<Database> database)
+    {
+        return new ContextRemoveOpenDatabaseTask(database);
+    }
+
+    virtual void performTask(ScriptExecutionContext* context)
+    {
+        context->removeOpenDatabase(m_database.get());
+        DatabaseTracker::tracker().removeOpenDatabase(m_database.get());
+    }
+
+    virtual bool isCleanupTask() const { return true; }
+
+private:
+    ContextRemoveOpenDatabaseTask(PassRefPtr<Database> database)
+        : m_database(database)
+    {
+    }
+
+    RefPtr<Database> m_database;
+};
+
+void Database::close(ClosePolicy policy)
 {
-    if (m_opened) {
-        ASSERT(m_document->databaseThread());
-        ASSERT(currentThread() == document()->databaseThread()->getThreadID());
-        m_sqliteDatabase.close();
-        m_document->databaseThread()->recordDatabaseClosed(this);
-        m_opened = false;
-
-        {
-            MutexLocker locker(guidMutex());
-
-            HashSet<Database*>* hashSet = guidToDatabaseMap().get(m_guid);
-            ASSERT(hashSet);
-            ASSERT(hashSet->contains(this));
-            hashSet->remove(this);
-            if (hashSet->isEmpty()) {
-                guidToDatabaseMap().remove(m_guid);
-                delete hashSet;
-                guidToVersionMap().remove(m_guid);
-            }
+    RefPtr<Database> protect = this;
+
+    if (!m_opened)
+        return;
+
+    ASSERT(m_scriptExecutionContext->databaseThread());
+    ASSERT(currentThread() == m_scriptExecutionContext->databaseThread()->getThreadID());
+    m_sqliteDatabase.close();
+    // Must ref() before calling databaseThread()->recordDatabaseClosed().
+    m_scriptExecutionContext->databaseThread()->recordDatabaseClosed(this);
+    m_opened = false;
+
+    {
+        MutexLocker locker(guidMutex());
+
+        HashSet<Database*>* hashSet = guidToDatabaseMap().get(m_guid);
+        ASSERT(hashSet);
+        ASSERT(hashSet->contains(this));
+        hashSet->remove(this);
+        if (hashSet->isEmpty()) {
+            guidToDatabaseMap().remove(m_guid);
+            delete hashSet;
+            guidToVersionMap().remove(m_guid);
         }
     }
+
+    m_scriptExecutionContext->databaseThread()->unscheduleDatabaseTasks(this);
+    if (policy == RemoveDatabaseFromContext)
+        m_scriptExecutionContext->postTask(ContextRemoveOpenDatabaseTask::create(this));
 }
 
 void Database::stop()
@@ -362,7 +464,7 @@ void Database::stop()
 
     {
         MutexLocker locker(m_transactionInProgressMutex);
-        m_transactionQueue.kill();
+        m_isTransactionQueueEnabled = false;
         m_transactionInProgress = false;
     }
 }
@@ -443,10 +545,6 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
         return false;
     }
 
-    m_opened = true;
-    if (m_document->databaseThread())
-        m_document->databaseThread()->recordDatabaseOpen(this);
-
     ASSERT(m_databaseAuthorizer);
     m_sqliteDatabase.setAuthorizer(m_databaseAuthorizer);
     m_sqliteDatabase.setBusyTimeout(maxSqliteBusyWaitTime);
@@ -464,9 +562,13 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
             LOG(StorageAPI, "No cached version for guid %i", m_guid);
 
             if (!m_sqliteDatabase.tableExists(databaseInfoTableName())) {
+                m_new = true;
+
                 if (!m_sqliteDatabase.executeCommand("CREATE TABLE " + databaseInfoTableName() + " (key TEXT NOT NULL ON CONFLICT FAIL UNIQUE ON CONFLICT REPLACE,value TEXT NOT NULL ON CONFLICT FAIL);")) {
                     LOG_ERROR("Unable to create table %s in database %s", databaseInfoTableName().ascii().data(), databaseDebugName().ascii().data());
                     e = INVALID_STATE_ERR;
+                    // Close the handle to the database file.
+                    m_sqliteDatabase.close();
                     return false;
                 }
             }
@@ -474,15 +576,19 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
             if (!getVersionFromDatabase(currentVersion)) {
                 LOG_ERROR("Failed to get current version from database %s", databaseDebugName().ascii().data());
                 e = INVALID_STATE_ERR;
+                // Close the handle to the database file.
+                m_sqliteDatabase.close();
                 return false;
             }
             if (currentVersion.length()) {
                 LOG(StorageAPI, "Retrieved current version %s from database %s", currentVersion.ascii().data(), databaseDebugName().ascii().data());
-            } else {
+            } else if (!m_new || !m_creationCallback) {
                 LOG(StorageAPI, "Setting version %s in database %s that was just created", m_expectedVersion.ascii().data(), databaseDebugName().ascii().data());
                 if (!setVersionInDatabase(m_expectedVersion)) {
                     LOG_ERROR("Failed to set version %s in database %s", m_expectedVersion.ascii().data(), databaseDebugName().ascii().data());
                     e = INVALID_STATE_ERR;
+                    // Close the handle to the database file.
+                    m_sqliteDatabase.close();
                     return false;
                 }
                 currentVersion = m_expectedVersion;
@@ -497,17 +603,23 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
         currentVersion = "";
     }
 
-    // FIXME: For now, the spec says that if the database has no version, it is valid for any "Expected version" string.  That seems silly and I think it should be
-    // changed, and here's where we would change it
-    if (m_expectedVersion.length()) {
-        if (currentVersion.length() && m_expectedVersion != currentVersion) {
-            LOG(StorageAPI, "page expects version %s from database %s, which actually has version name %s - openDatabase() call will fail", m_expectedVersion.ascii().data(),
-                databaseDebugName().ascii().data(), currentVersion.ascii().data());
-            e = INVALID_STATE_ERR;
-            return false;
-        }
+    // If the expected version isn't the empty string, ensure that the current database version we have matches that version. Otherwise, set an exception.
+    // If the expected version is the empty string, then we always return with whatever version of the database we have.
+    if ((!m_new || !m_creationCallback) && m_expectedVersion.length() && m_expectedVersion != currentVersion) {
+        LOG(StorageAPI, "page expects version %s from database %s, which actually has version name %s - openDatabase() call will fail", m_expectedVersion.ascii().data(),
+            databaseDebugName().ascii().data(), currentVersion.ascii().data());
+        e = INVALID_STATE_ERR;
+        // Close the handle to the database file.
+        m_sqliteDatabase.close();
+        return false;
     }
 
+    // All checks passed and we still have a handle to this database file.
+    // Make sure DatabaseThread closes it when DatabaseThread goes away.
+    m_opened = true;
+    if (m_scriptExecutionContext->databaseThread())
+        m_scriptExecutionContext->databaseThread()->recordDatabaseOpen(this);
+
     return true;
 }
 
@@ -534,32 +646,58 @@ void Database::scheduleTransaction()
 {
     ASSERT(!m_transactionInProgressMutex.tryLock()); // Locked by caller.
     RefPtr<SQLTransaction> transaction;
-    if (m_transactionQueue.tryGetMessage(transaction) && m_document->databaseThread()) {
-        RefPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
+
+    if (m_isTransactionQueueEnabled && !m_transactionQueue.isEmpty()) {
+        transaction = m_transactionQueue.first();
+        m_transactionQueue.removeFirst();
+    }
+
+    if (transaction && m_scriptExecutionContext->databaseThread()) {
+        OwnPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
         LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for transaction %p\n", task.get(), task->transaction());
         m_transactionInProgress = true;
-        m_document->databaseThread()->scheduleTask(task.release());
+        m_scriptExecutionContext->databaseThread()->scheduleTask(task.release());
     } else
         m_transactionInProgress = false;
 }
 
 void Database::scheduleTransactionStep(SQLTransaction* transaction, bool immediately)
 {
-    if (!m_document->databaseThread())
+    if (!m_scriptExecutionContext->databaseThread())
         return;
 
-    RefPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
+    OwnPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
     LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for the transaction step\n", task.get());
     if (immediately)
-        m_document->databaseThread()->scheduleImmediateTask(task.release());
+        m_scriptExecutionContext->databaseThread()->scheduleImmediateTask(task.release());
     else
-        m_document->databaseThread()->scheduleTask(task.release());
+        m_scriptExecutionContext->databaseThread()->scheduleTask(task.release());
 }
 
+class DeliverPendingCallbackTask : public ScriptExecutionContext::Task {
+public:
+    static PassOwnPtr<DeliverPendingCallbackTask> create(PassRefPtr<SQLTransaction> transaction)
+    {
+        return new DeliverPendingCallbackTask(transaction);
+    }
+
+    virtual void performTask(ScriptExecutionContext*)
+    {
+        m_transaction->performPendingCallback();
+    }
+
+private:
+    DeliverPendingCallbackTask(PassRefPtr<SQLTransaction> transaction)
+        : m_transaction(transaction)
+    {
+    }
+
+    RefPtr<SQLTransaction> m_transaction;
+};
+
 void Database::scheduleTransactionCallback(SQLTransaction* transaction)
 {
-    transaction->ref();
-    callOnMainThread(deliverPendingCallback, transaction);
+    m_scriptExecutionContext->postTask(DeliverPendingCallbackTask::create(transaction));
 }
 
 Vector<String> Database::performGetTableNames()
@@ -591,14 +729,19 @@ Vector<String> Database::performGetTableNames()
     return tableNames;
 }
 
+void Database::performCreationCallback()
+{
+    m_creationCallback->handleEvent(m_scriptExecutionContext.get(), this);
+}
+
 SQLTransactionClient* Database::transactionClient() const
 {
-    return m_document->databaseThread()->transactionClient();
+    return m_scriptExecutionContext->databaseThread()->transactionClient();
 }
 
 SQLTransactionCoordinator* Database::transactionCoordinator() const
 {
-    return m_document->databaseThread()->transactionCoordinator();
+    return m_scriptExecutionContext->databaseThread()->transactionCoordinator();
 }
 
 String Database::version() const
@@ -609,24 +752,21 @@ String Database::version() const
     return guidToVersionMap().get(m_guid).threadsafeCopy();
 }
 
-void Database::deliverPendingCallback(void* context)
-{
-    SQLTransaction* transaction = static_cast<SQLTransaction*>(context);
-    transaction->performPendingCallback();
-    transaction->deref(); // Was ref'd in scheduleTransactionCallback().
-}
-
 Vector<String> Database::tableNames()
 {
-    if (!m_document->databaseThread())
-        return Vector<String>();
-    RefPtr<DatabaseTableNamesTask> task = DatabaseTableNamesTask::create(this);
+    // FIXME: Not using threadsafeCopy on these strings looks ok since threads take strict turns
+    // in dealing with them. However, if the code changes, this may not be true anymore.
+    Vector<String> result;
+    if (!m_scriptExecutionContext->databaseThread())
+        return result;
+
+    DatabaseTaskSynchronizer synchronizer;
+    OwnPtr<DatabaseTableNamesTask> task = DatabaseTableNamesTask::create(this, &synchronizer, result);
 
-    task->lockForSynchronousScheduling();
-    m_document->databaseThread()->scheduleImmediateTask(task);
-    task->waitForSynchronousCompletion();
+    m_scriptExecutionContext->databaseThread()->scheduleImmediateTask(task.release());
+    synchronizer.waitForTaskCompletion();
 
-    return task->tableNames();
+    return result;
 }
 
 void Database::setExpectedVersion(const String& version)
@@ -639,9 +779,9 @@ void Database::setExpectedVersion(const String& version)
 
 SecurityOrigin* Database::securityOrigin() const
 {
-    if (isMainThread())
+    if (scriptExecutionContext()->isContextThread())
         return m_mainThreadSecurityOrigin.get();
-    if (currentThread() == document()->databaseThread()->getThreadID())
+    if (currentThread() == m_scriptExecutionContext->databaseThread()->getThreadID())
         return m_databaseThreadSecurityOrigin.get();
     return 0;
 }
@@ -669,6 +809,6 @@ String Database::fileName() const
     return m_filename.threadsafeCopy();
 }
 
-#endif
+#endif // ENABLE(DATABASE)
 
-}
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/Database.h b/src/3rdparty/webkit/WebCore/storage/Database.h
index f275027e20..f7b88a27f8 100644
--- a/src/3rdparty/webkit/WebCore/storage/Database.h
+++ b/src/3rdparty/webkit/WebCore/storage/Database.h
@@ -30,7 +30,6 @@
 #define Database_h
 
 #if ENABLE(DATABASE)
-#include <wtf/MessageQueue.h>
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
 #include "SQLiteDatabase.h"
@@ -52,8 +51,9 @@
 namespace WebCore {
 
 class DatabaseAuthorizer;
+class DatabaseCallback;
 class DatabaseThread;
-class Document;
+class ScriptExecutionContext;
 class SQLResultSet;
 class SQLTransactionCallback;
 class SQLTransactionClient;
@@ -68,10 +68,16 @@ class Database : public ThreadSafeShared<Database> {
     friend class SQLStatement;
     friend class SQLTransaction;
 public:
+    static void setIsAvailable(bool);
+    static bool isAvailable();
+
     ~Database();
 
 // Direct support for the DOM API
-    static PassRefPtr<Database> openDatabase(Document* document, const String& name, const String& expectedVersion, const String& displayName, unsigned long estimatedSize, ExceptionCode&);
+    static PassRefPtr<Database> openDatabase(ScriptExecutionContext* context, const String& name,
+                                             const String& expectedVersion, const String& displayName,
+                                             unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback,
+                                             ExceptionCode&);
     String version() const;
     void changeVersion(const String& oldVersion, const String& newVersion,
                        PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
@@ -88,7 +94,7 @@ public:
 
     Vector<String> tableNames();
 
-    Document* document() const { return m_document.get(); }
+    ScriptExecutionContext* scriptExecutionContext() const { return m_scriptExecutionContext.get(); }
     SecurityOrigin* securityOrigin() const;
     String stringIdentifier() const;
     String displayName() const;
@@ -103,12 +109,15 @@ public:
     void markAsDeletedAndClose();
     bool deleted() const { return m_deleted; }
 
-    void close();
+    enum ClosePolicy { DoNotRemoveDatabaseFromContext, RemoveDatabaseFromContext };
+    void close(ClosePolicy);
     bool opened() const { return m_opened; }
 
     void stop();
     bool stopped() const { return m_stopped; }
 
+    bool isNew() const { return m_new; }
+
     unsigned long long databaseSize() const;
     unsigned long long maximumSize() const;
 
@@ -119,13 +128,15 @@ public:
     bool performOpenAndVerify(ExceptionCode&);
 
     Vector<String> performGetTableNames();
+    void performCreationCallback();
 
     SQLTransactionClient* transactionClient() const;
     SQLTransactionCoordinator* transactionCoordinator() const;
 
 private:
-    Database(Document* document, const String& name, const String& expectedVersion,
-             const String& displayName, unsigned long estimatedSize);
+    Database(ScriptExecutionContext* context, const String& name,
+             const String& expectedVersion, const String& displayName,
+             unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback);
 
     bool openAndVerifyVersion(ExceptionCode&);
 
@@ -133,13 +144,14 @@ private:
     void scheduleTransactionCallback(SQLTransaction*);
     void scheduleTransactionStep(SQLTransaction* transaction, bool immediately = false);
 
-    MessageQueue<RefPtr<SQLTransaction> > m_transactionQueue;
+    Deque<RefPtr<SQLTransaction> > m_transactionQueue;
     Mutex m_transactionInProgressMutex;
     bool m_transactionInProgress;
+    bool m_isTransactionQueueEnabled;
 
     static void deliverPendingCallback(void*);
 
-    RefPtr<Document> m_document;
+    RefPtr<ScriptExecutionContext> m_scriptExecutionContext;
     RefPtr<SecurityOrigin> m_mainThreadSecurityOrigin;
     RefPtr<SecurityOrigin> m_databaseThreadSecurityOrigin;
     String m_name;
@@ -155,9 +167,13 @@ private:
 
     bool m_opened;
 
+    bool m_new;
+
     SQLiteDatabase m_sqliteDatabase;
     RefPtr<DatabaseAuthorizer> m_databaseAuthorizer;
 
+    RefPtr<DatabaseCallback> m_creationCallback;
+
 #ifndef NDEBUG
     String databaseDebugName() const { return m_mainThreadSecurityOrigin->toString() + "::" + m_name; }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/storage/Database.idl b/src/3rdparty/webkit/WebCore/storage/Database.idl
index 6ca9c952b9..c8a537c1aa 100644
--- a/src/3rdparty/webkit/WebCore/storage/Database.idl
+++ b/src/3rdparty/webkit/WebCore/storage/Database.idl
@@ -29,7 +29,8 @@
 module storage {
 
     interface [
-        Conditional=DATABASE
+        Conditional=DATABASE,
+        OmitConstructor
     ] Database {
         readonly attribute DOMString version;
         [Custom] void changeVersion(in DOMString oldVersion, in DOMString newVersion, in SQLTransactionCallback callback, in SQLTransactionErrorCallback errorCallback, in VoidCallback successCallback);
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.cpp b/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.cpp
index 93f91067ff..6b6b1470a8 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.cpp
@@ -38,6 +38,7 @@ DatabaseAuthorizer::DatabaseAuthorizer()
     : m_securityEnabled(false)
 {
     reset();
+    addWhitelistedFunctions();
 }
 
 void DatabaseAuthorizer::reset()
@@ -47,6 +48,69 @@ void DatabaseAuthorizer::reset()
     m_readOnly = false;
 }
 
+void DatabaseAuthorizer::addWhitelistedFunctions()
+{
+    // SQLite functions used to help implement some operations
+    // ALTER TABLE helpers
+    m_whitelistedFunctions.add("sqlite_rename_table");
+    m_whitelistedFunctions.add("sqlite_rename_trigger");
+    // GLOB helpers
+    m_whitelistedFunctions.add("glob");
+
+    // SQLite core functions
+    m_whitelistedFunctions.add("abs");
+    m_whitelistedFunctions.add("changes");
+    m_whitelistedFunctions.add("coalesce");
+    m_whitelistedFunctions.add("glob");
+    m_whitelistedFunctions.add("ifnull");
+    m_whitelistedFunctions.add("hex");
+    m_whitelistedFunctions.add("last_insert_rowid");
+    m_whitelistedFunctions.add("length");
+    m_whitelistedFunctions.add("like");
+    m_whitelistedFunctions.add("lower");
+    m_whitelistedFunctions.add("ltrim");
+    m_whitelistedFunctions.add("max");
+    m_whitelistedFunctions.add("min");
+    m_whitelistedFunctions.add("nullif");
+    m_whitelistedFunctions.add("quote");
+    m_whitelistedFunctions.add("replace");
+    m_whitelistedFunctions.add("round");
+    m_whitelistedFunctions.add("rtrim");
+    m_whitelistedFunctions.add("soundex");
+    m_whitelistedFunctions.add("sqlite_source_id");
+    m_whitelistedFunctions.add("sqlite_version");
+    m_whitelistedFunctions.add("substr");
+    m_whitelistedFunctions.add("total_changes");
+    m_whitelistedFunctions.add("trim");
+    m_whitelistedFunctions.add("typeof");
+    m_whitelistedFunctions.add("upper");
+    m_whitelistedFunctions.add("zeroblob");
+
+    // SQLite date and time functions
+    m_whitelistedFunctions.add("date");
+    m_whitelistedFunctions.add("time");
+    m_whitelistedFunctions.add("datetime");
+    m_whitelistedFunctions.add("julianday");
+    m_whitelistedFunctions.add("strftime");
+
+    // SQLite aggregate functions
+    // max() and min() are already in the list
+    m_whitelistedFunctions.add("avg");
+    m_whitelistedFunctions.add("count");
+    m_whitelistedFunctions.add("group_concat");
+    m_whitelistedFunctions.add("sum");
+    m_whitelistedFunctions.add("total");
+
+    // SQLite FTS functions
+    m_whitelistedFunctions.add("snippet");
+    m_whitelistedFunctions.add("offsets");
+    m_whitelistedFunctions.add("optimize");
+
+    // SQLite ICU functions
+    // like(), lower() and upper() are already in the list
+    m_whitelistedFunctions.add("regexp");
+}
+
 int DatabaseAuthorizer::createTable(const String& tableName)
 {
     if (m_readOnly && m_securityEnabled)
@@ -199,21 +263,29 @@ int DatabaseAuthorizer::dropTempView(const String&)
     return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
 }
 
-int DatabaseAuthorizer::createVTable(const String&, const String&)
+int DatabaseAuthorizer::createVTable(const String& tableName, const String& moduleName)
 {
     if (m_readOnly && m_securityEnabled)
         return SQLAuthDeny;
 
+    // fts2 is used in Chromium
+    if (moduleName != "fts2")
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
-    return m_securityEnabled ? SQLAuthDeny : SQLAuthAllow;
+    return denyBasedOnTableName(tableName);
 }
 
-int DatabaseAuthorizer::dropVTable(const String&, const String&)
+int DatabaseAuthorizer::dropVTable(const String& tableName, const String& moduleName)
 {
     if (m_readOnly && m_securityEnabled)
         return SQLAuthDeny;
 
-    return m_securityEnabled ? SQLAuthDeny : SQLAuthAllow;
+    // fts2 is used in Chromium
+    if (moduleName != "fts2")
+        return SQLAuthDeny;
+
+    return denyBasedOnTableName(tableName);
 }
 
 int DatabaseAuthorizer::allowDelete(const String& tableName)
@@ -278,11 +350,11 @@ int DatabaseAuthorizer::allowDetach(const String&)
     return m_securityEnabled ? SQLAuthDeny : SQLAuthAllow;
 }
 
-int DatabaseAuthorizer::allowFunction(const String&)
+int DatabaseAuthorizer::allowFunction(const String& functionName)
 {
-    // FIXME: Are there any of these we need to prevent?  One might guess current_date, current_time, current_timestamp because
-    // they would violate the "sandbox environment" part of 4.11.3, but scripts can generate the local client side information via
-    // javascript directly, anyways.  Are there any other built-ins we need to be worried about?
+    if (m_securityEnabled && !m_whitelistedFunctions.contains(functionName))
+        return SQLAuthDeny;
+
     return SQLAuthAllow;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.h b/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.h
index 248b659d81..037409e2f9 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.h
@@ -28,6 +28,8 @@
 #ifndef DatabaseAuthorizer_h
 #define DatabaseAuthorizer_h
 
+#include "StringHash.h"
+#include <wtf/HashSet.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
 
@@ -94,12 +96,15 @@ public:
 
 private:
     DatabaseAuthorizer();
+    void addWhitelistedFunctions();
     int denyBasedOnTableName(const String&);
 
     bool m_securityEnabled : 1;
     bool m_lastActionWasInsert : 1;
     bool m_lastActionChangedDatabase : 1;
     bool m_readOnly : 1;
+
+    HashSet<String, CaseFoldingHash> m_whitelistedFunctions;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseCallback.h b/src/3rdparty/webkit/WebCore/storage/DatabaseCallback.h
new file mode 100644
index 0000000000..2115a21df6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseCallback.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DatabaseCallback_h
+#define DatabaseCallback_h
+
+#if ENABLE(DATABASE)
+
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+class Database;
+class ScriptExecutionContext;
+
+class DatabaseCallback : public ThreadSafeShared<DatabaseCallback> {
+public:
+    virtual ~DatabaseCallback() { }
+    virtual void handleEvent(ScriptExecutionContext*, Database*) = 0;
+};
+
+}
+
+#endif
+
+#endif // DatabaseCallback_h
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseDetails.h b/src/3rdparty/webkit/WebCore/storage/DatabaseDetails.h
index 9b0f506477..ceebd35250 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseDetails.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseDetails.h
@@ -41,6 +41,9 @@ public:
         : m_expectedUsage(0)
         , m_currentUsage(0)
     {
+#ifndef NDEBUG
+        m_thread = currentThread();
+#endif
     }
 
     DatabaseDetails(const String& databaseName, const String& displayName, unsigned long long expectedUsage, unsigned long long currentUsage)
@@ -49,19 +52,27 @@ public:
         , m_expectedUsage(expectedUsage)
         , m_currentUsage(currentUsage)
     {
+#ifndef NDEBUG
+        m_thread = currentThread();
+#endif
     }
 
     const String& name() const { return m_name; }
     const String& displayName() const { return m_displayName; }
     unsigned long long expectedUsage() const { return m_expectedUsage; }
     unsigned long long currentUsage() const { return m_currentUsage; }
+#ifndef NDEBUG
+    ThreadIdentifier thread() const { return m_thread; }
+#endif
 
 private:
     String m_name;
     String m_displayName;
     unsigned long long m_expectedUsage;
     unsigned long long m_currentUsage;
-
+#ifndef NDEBUG
+    ThreadIdentifier m_thread;
+#endif
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseTask.cpp b/src/3rdparty/webkit/WebCore/storage/DatabaseTask.cpp
index 755da7c487..20908027fd 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseTask.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseTask.cpp
@@ -35,9 +35,33 @@
 
 namespace WebCore {
 
-DatabaseTask::DatabaseTask(Database* database)
+DatabaseTaskSynchronizer::DatabaseTaskSynchronizer()
+    : m_taskCompleted(false)
+{
+}
+
+void DatabaseTaskSynchronizer::waitForTaskCompletion()
+{
+    m_synchronousMutex.lock();
+    if (!m_taskCompleted)
+        m_synchronousCondition.wait(m_synchronousMutex);
+    m_synchronousMutex.unlock();
+}
+
+void DatabaseTaskSynchronizer::taskCompleted()
+{
+    m_synchronousMutex.lock();
+    m_taskCompleted = true;
+    m_synchronousCondition.signal();
+    m_synchronousMutex.unlock();
+}
+
+DatabaseTask::DatabaseTask(Database* database, DatabaseTaskSynchronizer* synchronizer)
     : m_database(database)
+    , m_synchronizer(synchronizer)
+#ifndef NDEBUG
     , m_complete(false)
+#endif
 {
 }
 
@@ -56,43 +80,19 @@ void DatabaseTask::performTask()
     doPerformTask();
     m_database->performPolicyChecks();
 
-    if (m_synchronousMutex)
-        m_synchronousMutex->lock();
-
-    m_complete = true;
-
-    if (m_synchronousMutex) {
-        m_synchronousCondition->signal();
-        m_synchronousMutex->unlock();
-    }
-}
-
-void DatabaseTask::lockForSynchronousScheduling()
-{
-    // Called from main thread.
-    ASSERT(!m_synchronousMutex);
-    ASSERT(!m_synchronousCondition);
-    m_synchronousMutex.set(new Mutex);
-    m_synchronousCondition.set(new ThreadCondition);
-}
-
-void DatabaseTask::waitForSynchronousCompletion()
-{
-    // Called from main thread.
-    m_synchronousMutex->lock();
-    if (!m_complete)
-        m_synchronousCondition->wait(*m_synchronousMutex);
-    m_synchronousMutex->unlock();
+    if (m_synchronizer)
+        m_synchronizer->taskCompleted();
 }
 
 // *** DatabaseOpenTask ***
 // Opens the database file and verifies the version matches the expected version.
 
-DatabaseOpenTask::DatabaseOpenTask(Database* database)
-    : DatabaseTask(database)
-    , m_code(0)
-    , m_success(false)
+DatabaseOpenTask::DatabaseOpenTask(Database* database, DatabaseTaskSynchronizer* synchronizer, ExceptionCode& code, bool& success)
+    : DatabaseTask(database, synchronizer)
+    , m_code(code)
+    , m_success(success)
 {
+    ASSERT(synchronizer); // A task with output parameters is supposed to be synchronous.
 }
 
 void DatabaseOpenTask::doPerformTask()
@@ -110,14 +110,15 @@ const char* DatabaseOpenTask::debugTaskName() const
 // *** DatabaseCloseTask ***
 // Closes the database.
 
-DatabaseCloseTask::DatabaseCloseTask(Database* database)
-    : DatabaseTask(database)
+DatabaseCloseTask::DatabaseCloseTask(Database* database, DatabaseTaskSynchronizer* synchronizer)
+    : DatabaseTask(database, synchronizer)
 {
 }
 
 void DatabaseCloseTask::doPerformTask()
 {
-    database()->close();
+    // Tell the database not to call back to the context thread; we'll handle it.
+    database()->close(Database::DoNotRemoveDatabaseFromContext);
 }
 
 #ifndef NDEBUG
@@ -131,7 +132,7 @@ const char* DatabaseCloseTask::debugTaskName() const
 // Starts a transaction that will report its results via a callback.
 
 DatabaseTransactionTask::DatabaseTransactionTask(PassRefPtr<SQLTransaction> transaction)
-    : DatabaseTask(transaction->database())
+    : DatabaseTask(transaction->database(), 0)
     , m_transaction(transaction)
 {
 }
@@ -159,9 +160,11 @@ const char* DatabaseTransactionTask::debugTaskName() const
 // *** DatabaseTableNamesTask ***
 // Retrieves a list of all tables in the database - for WebInspector support.
 
-DatabaseTableNamesTask::DatabaseTableNamesTask(Database* database)
-    : DatabaseTask(database)
+DatabaseTableNamesTask::DatabaseTableNamesTask(Database* database, DatabaseTaskSynchronizer* synchronizer, Vector<String>& names)
+    : DatabaseTask(database, synchronizer)
+    , m_tableNames(names)
 {
+    ASSERT(synchronizer); // A task with output parameters is supposed to be synchronous.
 }
 
 void DatabaseTableNamesTask::doPerformTask()
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseTask.h b/src/3rdparty/webkit/WebCore/storage/DatabaseTask.h
index 4aef892bd2..998e37346d 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseTask.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseTask.h
@@ -32,6 +32,7 @@
 #include "ExceptionCode.h"
 #include "PlatformString.h"
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
 #include <wtf/Vector.h>
@@ -39,13 +40,32 @@
 namespace WebCore {
 
 class Database;
+class DatabaseTask;
 class DatabaseThread;
 class SQLValue;
 class SQLCallback;
 class SQLTransaction;
 class VersionChangeCallback;
 
-class DatabaseTask : public ThreadSafeShared<DatabaseTask> {
+// Can be used to wait until DatabaseTask is completed.
+// Has to be passed into DatabaseTask::create to be associated with the task.
+class DatabaseTaskSynchronizer : public Noncopyable {
+public:
+    DatabaseTaskSynchronizer();
+
+    // Called from main thread to wait until task is completed.
+    void waitForTaskCompletion();
+
+    // Called by the task.
+    void taskCompleted();
+private:
+
+    bool m_taskCompleted;
+    Mutex m_synchronousMutex;
+    ThreadCondition m_synchronousCondition;
+};
+
+class DatabaseTask : public Noncopyable {
     friend class Database;
 public:
     virtual ~DatabaseTask();
@@ -53,53 +73,50 @@ public:
     void performTask();
 
     Database* database() const { return m_database; }
-    bool isComplete() const { return m_complete; }
 
 protected:
-    DatabaseTask(Database*);
+    DatabaseTask(Database*, DatabaseTaskSynchronizer*);
 
 private:
     virtual void doPerformTask() = 0;
-#ifndef NDEBUG
-    virtual const char* debugTaskName() const = 0;
-#endif
-
-    void lockForSynchronousScheduling();
-    void waitForSynchronousCompletion();
 
     Database* m_database;
+    DatabaseTaskSynchronizer* m_synchronizer;
 
-    bool m_complete;
-
-    OwnPtr<Mutex> m_synchronousMutex;
-    OwnPtr<ThreadCondition> m_synchronousCondition;
+#ifndef NDEBUG
+     virtual const char* debugTaskName() const = 0;
+     bool m_complete;
+#endif
 };
 
 class DatabaseOpenTask : public DatabaseTask {
 public:
-    static PassRefPtr<DatabaseOpenTask> create(Database* db) { return adoptRef(new DatabaseOpenTask(db)); }
-
-    ExceptionCode exceptionCode() const { return m_code; }
-    bool openSuccessful() const { return m_success; }
+    static PassOwnPtr<DatabaseOpenTask> create(Database* db, DatabaseTaskSynchronizer* synchronizer, ExceptionCode& code, bool& success)
+    {
+        return new DatabaseOpenTask(db, synchronizer, code, success);
+    }
 
 private:
-    DatabaseOpenTask(Database*);
+    DatabaseOpenTask(Database*, DatabaseTaskSynchronizer*, ExceptionCode&, bool& success);
 
     virtual void doPerformTask();
 #ifndef NDEBUG
     virtual const char* debugTaskName() const;
 #endif
 
-    ExceptionCode m_code;
-    bool m_success;
+    ExceptionCode& m_code;
+    bool& m_success;
 };
 
 class DatabaseCloseTask : public DatabaseTask {
 public:
-    static PassRefPtr<DatabaseCloseTask> create(Database* db) { return adoptRef(new DatabaseCloseTask(db)); }
+    static PassOwnPtr<DatabaseCloseTask> create(Database* db, DatabaseTaskSynchronizer* synchronizer)
+    { 
+        return new DatabaseCloseTask(db, synchronizer);
+    }
 
 private:
-    DatabaseCloseTask(Database*);
+    DatabaseCloseTask(Database*, DatabaseTaskSynchronizer*);
 
     virtual void doPerformTask();
 #ifndef NDEBUG
@@ -109,7 +126,11 @@ private:
 
 class DatabaseTransactionTask : public DatabaseTask {
 public:
-    static PassRefPtr<DatabaseTransactionTask> create(PassRefPtr<SQLTransaction> transaction) { return adoptRef(new DatabaseTransactionTask(transaction)); }
+    // Transaction task is never synchronous, so no 'synchronizer' parameter.
+    static PassOwnPtr<DatabaseTransactionTask> create(PassRefPtr<SQLTransaction> transaction)
+    {
+        return new DatabaseTransactionTask(transaction);
+    }
 
     SQLTransaction* transaction() const { return m_transaction.get(); }
 
@@ -127,19 +148,20 @@ private:
 
 class DatabaseTableNamesTask : public DatabaseTask {
 public:
-    static PassRefPtr<DatabaseTableNamesTask> create(Database* db) { return adoptRef(new DatabaseTableNamesTask(db)); }
-
-    Vector<String>& tableNames() { return m_tableNames; }
+    static PassOwnPtr<DatabaseTableNamesTask> create(Database* db, DatabaseTaskSynchronizer* synchronizer, Vector<String>& names)
+    {
+        return new DatabaseTableNamesTask(db, synchronizer, names);
+    }
 
 private:
-    DatabaseTableNamesTask(Database*);
+    DatabaseTableNamesTask(Database*, DatabaseTaskSynchronizer*, Vector<String>& names);
 
     virtual void doPerformTask();
 #ifndef NDEBUG
     virtual const char* debugTaskName() const;
 #endif
 
-    Vector<String> m_tableNames;
+    Vector<String>& m_tableNames;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp b/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp
index 40c83ee116..ec6241ce1d 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp
@@ -44,6 +44,7 @@ DatabaseThread::DatabaseThread()
     : m_threadID(0)
     , m_transactionClient(new SQLTransactionClient())
     , m_transactionCoordinator(new SQLTransactionCoordinator())
+    , m_cleanupSync(0)
 {
     m_selfRef = this;
 }
@@ -51,6 +52,7 @@ DatabaseThread::DatabaseThread()
 DatabaseThread::~DatabaseThread()
 {
     // FIXME: Any cleanup required here?  Since the thread deletes itself after running its detached course, I don't think so.  Lets be sure.
+    ASSERT(terminationRequested());
 }
 
 bool DatabaseThread::start()
@@ -65,8 +67,10 @@ bool DatabaseThread::start()
     return m_threadID;
 }
 
-void DatabaseThread::requestTermination()
+void DatabaseThread::requestTermination(DatabaseTaskSynchronizer *cleanupSync)
 {
+    ASSERT(!m_cleanupSync);
+    m_cleanupSync = cleanupSync;
     LOG(StorageAPI, "DatabaseThread %p was asked to terminate\n", this);
     m_queue.kill();
 }
@@ -91,13 +95,8 @@ void* DatabaseThread::databaseThread()
     }
 
     AutodrainedPool pool;
-    while (true) {
-        RefPtr<DatabaseTask> task;
-        if (!m_queue.waitForMessage(task))
-            break;
-
+    while (OwnPtr<DatabaseTask> task = m_queue.waitForMessage()) {
         task->performTask();
-
         pool.cycle();
     }
 
@@ -114,15 +113,20 @@ void* DatabaseThread::databaseThread()
         openSetCopy.swap(m_openDatabaseSet);
         DatabaseSet::iterator end = openSetCopy.end();
         for (DatabaseSet::iterator it = openSetCopy.begin(); it != end; ++it)
-           (*it)->close();
+           (*it)->close(Database::RemoveDatabaseFromContext);
     }
 
     // Detach the thread so its resources are no longer of any concern to anyone else
     detachThread(m_threadID);
 
+    DatabaseTaskSynchronizer* cleanupSync = m_cleanupSync;
+    
     // Clear the self refptr, possibly resulting in deletion
     m_selfRef = 0;
 
+    if (cleanupSync) // Someone wanted to know when we were done cleaning up.
+        cleanupSync->taskCompleted();
+
     return 0;
 }
 
@@ -142,12 +146,12 @@ void DatabaseThread::recordDatabaseClosed(Database* database)
     m_openDatabaseSet.remove(database);
 }
 
-void DatabaseThread::scheduleTask(PassRefPtr<DatabaseTask> task)
+void DatabaseThread::scheduleTask(PassOwnPtr<DatabaseTask> task)
 {
     m_queue.append(task);
 }
 
-void DatabaseThread::scheduleImmediateTask(PassRefPtr<DatabaseTask> task)
+void DatabaseThread::scheduleImmediateTask(PassOwnPtr<DatabaseTask> task)
 {
     m_queue.prepend(task);
 }
@@ -155,7 +159,7 @@ void DatabaseThread::scheduleImmediateTask(PassRefPtr<DatabaseTask> task)
 class SameDatabasePredicate {
 public:
     SameDatabasePredicate(const Database* database) : m_database(database) { }
-    bool operator()(RefPtr<DatabaseTask>& task) const { return task->database() == m_database; }
+    bool operator()(DatabaseTask* task) const { return task->database() == m_database; }
 private:
     const Database* m_database;
 };
@@ -167,6 +171,5 @@ void DatabaseThread::unscheduleDatabaseTasks(Database* database)
     SameDatabasePredicate predicate(database);
     m_queue.removeIf(predicate);
 }
-
 } // namespace WebCore
 #endif
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseThread.h b/src/3rdparty/webkit/WebCore/storage/DatabaseThread.h
index 83b1baf558..3702619dc4 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseThread.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseThread.h
@@ -34,6 +34,7 @@
 #include <wtf/HashSet.h>
 #include <wtf/MessageQueue.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Threading.h>
@@ -42,6 +43,7 @@ namespace WebCore {
 
 class Database;
 class DatabaseTask;
+class DatabaseTaskSynchronizer;
 class Document;
 class SQLTransactionClient;
 class SQLTransactionCoordinator;
@@ -52,11 +54,11 @@ public:
     ~DatabaseThread();
 
     bool start();
-    void requestTermination();
+    void requestTermination(DatabaseTaskSynchronizer* cleanupSync);
     bool terminationRequested() const;
 
-    void scheduleTask(PassRefPtr<DatabaseTask>);
-    void scheduleImmediateTask(PassRefPtr<DatabaseTask>); // This just adds the task to the front of the queue - the caller needs to be extremely careful not to create deadlocks when waiting for completion.
+    void scheduleTask(PassOwnPtr<DatabaseTask>);
+    void scheduleImmediateTask(PassOwnPtr<DatabaseTask>); // This just adds the task to the front of the queue - the caller needs to be extremely careful not to create deadlocks when waiting for completion.
     void unscheduleDatabaseTasks(Database*);
 
     void recordDatabaseOpen(Database*);
@@ -76,7 +78,7 @@ private:
     ThreadIdentifier m_threadID;
     RefPtr<DatabaseThread> m_selfRef;
 
-    MessageQueue<RefPtr<DatabaseTask> > m_queue;
+    MessageQueue<DatabaseTask> m_queue;
 
     // This set keeps track of the open databases that have been used on this thread.
     typedef HashSet<RefPtr<Database> > DatabaseSet;
@@ -84,6 +86,7 @@ private:
 
     OwnPtr<SQLTransactionClient> m_transactionClient;
     OwnPtr<SQLTransactionCoordinator> m_transactionCoordinator;
+    DatabaseTaskSynchronizer* m_cleanupSync;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
index c0c424209b..34b4567577 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
@@ -31,14 +31,15 @@
 
 #if ENABLE(DATABASE)
 
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "Database.h"
 #include "DatabaseThread.h"
 #include "DatabaseTrackerClient.h"
-#include "Document.h"
 #include "Logging.h"
 #include "OriginQuotaManager.h"
 #include "Page.h"
+#include "ScriptExecutionContext.h"
 #include "SecurityOrigin.h"
 #include "SecurityOriginHash.h"
 #include "SQLiteFileSystem.h"
@@ -50,13 +51,19 @@ using namespace std;
 
 namespace WebCore {
 
-OriginQuotaManager& DatabaseTracker::originQuotaManager()
+OriginQuotaManager& DatabaseTracker::originQuotaManagerNoLock()
 {
-    populateOrigins();
     ASSERT(m_quotaManager);
     return *m_quotaManager;
 }
 
+OriginQuotaManager& DatabaseTracker::originQuotaManager()
+{
+    MutexLocker lockDatabase(m_databaseGuard);
+    populateOrigins();
+    return originQuotaManagerNoLock();
+}
+
 DatabaseTracker& DatabaseTracker::tracker()
 {
     DEFINE_STATIC_LOCAL(DatabaseTracker, tracker, ());
@@ -65,36 +72,30 @@ DatabaseTracker& DatabaseTracker::tracker()
 
 DatabaseTracker::DatabaseTracker()
     : m_client(0)
-    , m_proposedDatabase(0)
-#ifndef NDEBUG
-    , m_thread(currentThread())
-#endif
 {
     SQLiteFileSystem::registerSQLiteVFS();
 }
 
 void DatabaseTracker::setDatabaseDirectoryPath(const String& path)
 {
-    ASSERT(currentThread() == m_thread);
+    MutexLocker lockDatabase(m_databaseGuard);
     ASSERT(!m_database.isOpen());
-    m_databaseDirectoryPath = path;
+    m_databaseDirectoryPath = path.threadsafeCopy();
 }
 
-const String& DatabaseTracker::databaseDirectoryPath() const
+String DatabaseTracker::databaseDirectoryPath() const
 {
-    ASSERT(currentThread() == m_thread);
-    return m_databaseDirectoryPath;
+    return m_databaseDirectoryPath.threadsafeCopy();
 }
 
 String DatabaseTracker::trackerDatabasePath() const
 {
-    ASSERT(currentThread() == m_thread);
     return SQLiteFileSystem::appendDatabaseFileNameToPath(m_databaseDirectoryPath, "Databases.db");
 }
 
 void DatabaseTracker::openTrackerDatabase(bool createIfDoesNotExist)
 {
-    ASSERT(currentThread() == m_thread);
+    ASSERT(!m_databaseGuard.tryLock());
 
     if (m_database.isOpen())
         return;
@@ -105,70 +106,98 @@ void DatabaseTracker::openTrackerDatabase(bool createIfDoesNotExist)
 
     if (!m_database.open(databasePath)) {
         // FIXME: What do do here?
+        LOG_ERROR("Failed to open databasePath %s.", databasePath.ascii().data());
         return;
     }
+    m_database.disableThreadingChecks();
     if (!m_database.tableExists("Origins")) {
         if (!m_database.executeCommand("CREATE TABLE Origins (origin TEXT UNIQUE ON CONFLICT REPLACE, quota INTEGER NOT NULL ON CONFLICT FAIL);")) {
             // FIXME: and here
+            LOG_ERROR("Failed to create Origins table");
         }
     }
     if (!m_database.tableExists("Databases")) {
         if (!m_database.executeCommand("CREATE TABLE Databases (guid INTEGER PRIMARY KEY AUTOINCREMENT, origin TEXT, name TEXT, displayName TEXT, estimatedSize INTEGER, path TEXT);")) {
             // FIXME: and here
+            LOG_ERROR("Failed to create Databases table");
         }
     }
 }
 
-bool DatabaseTracker::canEstablishDatabase(Document* document, const String& name, const String& displayName, unsigned long estimatedSize)
+bool DatabaseTracker::canEstablishDatabase(ScriptExecutionContext* context, const String& name, const String& displayName, unsigned long estimatedSize)
 {
-    ASSERT(currentThread() == m_thread);
+    SecurityOrigin* origin = context->securityOrigin();
+    ProposedDatabase details;
 
-    // Populate the origins before we establish a database; this guarantees that quotaForOrigin
-    // can run on the database thread later.
-    populateOrigins();
+    unsigned long long requirement;
+    unsigned long long tempUsage;
+    {
+        Locker<OriginQuotaManager> locker(originQuotaManager());
+        MutexLocker lockDatabase(m_databaseGuard);
 
-    SecurityOrigin* origin = document->securityOrigin();
+        if (!canCreateDatabase(origin, name))
+            return false;
 
-    // Since we're imminently opening a database within this Document's origin, make sure this origin is being tracked by the QuotaTracker
-    // by fetching it's current usage now
-    unsigned long long usage = usageForOrigin(origin);
+        recordCreatingDatabase(origin, name);
 
-    // If a database already exists, ignore the passed-in estimated size and say it's OK.
-    if (hasEntryForDatabase(origin, name))
-        return true;
+        populateOrigins();
 
-    // If the database will fit, allow its creation.
-    unsigned long long requirement = usage + max(1UL, estimatedSize);
-    if (requirement < usage)
-        return false; // If the estimated size is so big it causes an overflow, don't allow creation.
+        // Since we're imminently opening a database within this context's origin, make sure this origin is being tracked by the QuotaTracker
+        // by fetching its current usage now.
+        unsigned long long usage = usageForOriginNoLock(origin);
+
+        // If a database already exists, ignore the passed-in estimated size and say it's OK.
+        if (hasEntryForDatabase(origin, name))
+            return true;
+
+        // If the database will fit, allow its creation.
+        requirement = usage + max(1UL, estimatedSize);
+        tempUsage = usage;
+        if (requirement < usage) {
+            doneCreatingDatabase(origin, name);
+            return false; // If the estimated size is so big it causes an overflow, don't allow creation.
+        }
+        if (requirement <= quotaForOriginNoLock(origin))
+            return true;
+
+        // Give the chrome client a chance to increase the quota.
+        // Temporarily make the details of the proposed database available, so the client can get at them.
+        // FIXME: We should really just pass the details into this call, rather than using m_proposedDatabases.
+        details = ProposedDatabase(origin->threadsafeCopy(), DatabaseDetails(name.threadsafeCopy(), displayName.threadsafeCopy(), estimatedSize, 0));
+        m_proposedDatabases.add(&details);
+    }
+    // Drop all locks before calling out; we don't know what they'll do.
+    context->databaseExceededQuota(name);
+    {
+        MutexLocker lockDatabase(m_databaseGuard);
+        m_proposedDatabases.remove(&details);
+    }
+
+    // If the database will fit now, allow its creation.
     if (requirement <= quotaForOrigin(origin))
         return true;
 
-    // Give the chrome client a chance to increase the quota.
-    // Temporarily make the details of the proposed database available, so the client can get at them.
-    Page* page = document->page();
-    if (!page)
-        return false;
-    pair<SecurityOrigin*, DatabaseDetails> details(origin, DatabaseDetails(name, displayName, estimatedSize, 0));
-    m_proposedDatabase = &details;
-    page->chrome()->client()->exceededDatabaseQuota(document->frame(), name);
-    m_proposedDatabase = 0;
+    doneCreatingDatabase(origin, name);
+    return false;
+}
 
-    // If the database will fit now, allow its creation.
-    return requirement <= quotaForOrigin(origin);
+bool DatabaseTracker::hasEntryForOriginNoLock(SecurityOrigin* origin)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    ASSERT(m_quotaMap);
+    return m_quotaMap->contains(origin);
 }
 
 bool DatabaseTracker::hasEntryForOrigin(SecurityOrigin* origin)
 {
-    ASSERT(currentThread() == m_thread);
+    MutexLocker lockDatabase(m_databaseGuard);
     populateOrigins();
-    MutexLocker lockQuotaMap(m_quotaMapGuard);
-    return m_quotaMap->contains(origin);
+    return hasEntryForOriginNoLock(origin);
 }
 
 bool DatabaseTracker::hasEntryForDatabase(SecurityOrigin* origin, const String& databaseIdentifier)
 {
-    ASSERT(currentThread() == m_thread);
+    ASSERT(!m_databaseGuard.tryLock());
     openTrackerDatabase(false);
     if (!m_database.isOpen())
         return false;
@@ -185,7 +214,7 @@ bool DatabaseTracker::hasEntryForDatabase(SecurityOrigin* origin, const String&
 
 unsigned long long DatabaseTracker::getMaxSizeForDatabase(const Database* database)
 {
-    ASSERT(currentThread() == database->document()->databaseThread()->getThreadID());
+    ASSERT(currentThread() == database->scriptExecutionContext()->databaseThread()->getThreadID());
     // The maximum size for a database is the full quota for its origin, minus the current usage within the origin,
     // plus the current usage of the given database
     Locker<OriginQuotaManager> locker(originQuotaManager());
@@ -195,16 +224,17 @@ unsigned long long DatabaseTracker::getMaxSizeForDatabase(const Database* databa
 
 String DatabaseTracker::originPath(SecurityOrigin* origin) const
 {
-    ASSERT(currentThread() == m_thread);
-    return SQLiteFileSystem::appendDatabaseFileNameToPath(m_databaseDirectoryPath, origin->databaseIdentifier());
+    return SQLiteFileSystem::appendDatabaseFileNameToPath(m_databaseDirectoryPath.threadsafeCopy(), origin->databaseIdentifier());
 }
 
-String DatabaseTracker::fullPathForDatabase(SecurityOrigin* origin, const String& name, bool createIfNotExists)
+String DatabaseTracker::fullPathForDatabaseNoLock(SecurityOrigin* origin, const String& name, bool createIfNotExists)
 {
-    ASSERT(currentThread() == m_thread);
+    ASSERT(!m_databaseGuard.tryLock());
+    ASSERT(!originQuotaManagerNoLock().tryLock());
 
-    if (m_proposedDatabase && m_proposedDatabase->first == origin && m_proposedDatabase->second.name() == name)
-        return String();
+    for (HashSet<ProposedDatabase*>::iterator iter = m_proposedDatabases.begin(); iter != m_proposedDatabases.end(); ++iter)
+        if ((*iter)->first == origin && (*iter)->second.name() == name)
+            return String();
 
     String originIdentifier = origin->databaseIdentifier();
     String originPath = this->originPath(origin);
@@ -214,7 +244,6 @@ String DatabaseTracker::fullPathForDatabase(SecurityOrigin* origin, const String
         return String();
 
     // See if we have a path for this database yet
-    openTrackerDatabase(false);
     if (!m_database.isOpen())
         return String();
     SQLiteStatement statement(m_database, "SELECT path FROM Databases WHERE origin=? AND name=?;");
@@ -233,36 +262,42 @@ String DatabaseTracker::fullPathForDatabase(SecurityOrigin* origin, const String
         return String();
 
     if (result != SQLResultDone) {
-        LOG_ERROR("Failed to retrieve filename from Database Tracker for origin %s, name %s", origin->databaseIdentifier().ascii().data(), name.ascii().data());
+        LOG_ERROR("Failed to retrieve filename from Database Tracker for origin %s, name %s", originIdentifier.ascii().data(), name.ascii().data());
         return String();
     }
     statement.finalize();
 
-    String fileName = SQLiteFileSystem::getFileNameForNewDatabase(originPath, name, origin->databaseIdentifier(), &m_database);
+    String fileName = SQLiteFileSystem::getFileNameForNewDatabase(originPath, name, originIdentifier, &m_database);
     if (!addDatabase(origin, name, fileName))
         return String();
 
     // If this origin's quota is being tracked (open handle to a database in this origin), add this new database
     // to the quota manager now
     String fullFilePath = SQLiteFileSystem::appendDatabaseFileNameToPath(originPath, fileName);
-    {
-        Locker<OriginQuotaManager> locker(originQuotaManager());
-        if (originQuotaManager().tracksOrigin(origin))
-            originQuotaManager().addDatabase(origin, name, fullFilePath);
-    }
+    if (originQuotaManagerNoLock().tracksOrigin(origin))
+        originQuotaManagerNoLock().addDatabase(origin, name, fullFilePath);
 
     return fullFilePath;
 }
 
+String DatabaseTracker::fullPathForDatabase(SecurityOrigin* origin, const String& name, bool createIfNotExists)
+{
+    Locker<OriginQuotaManager> locker(originQuotaManager());
+    MutexLocker lockDatabase(m_databaseGuard);
+    populateOrigins();
+
+    return fullPathForDatabaseNoLock(origin, name, createIfNotExists).threadsafeCopy();
+}
+
 void DatabaseTracker::populateOrigins()
 {
+    ASSERT(!m_databaseGuard.tryLock());
     if (m_quotaMap)
         return;
 
-    ASSERT(currentThread() == m_thread);
-
     m_quotaMap.set(new QuotaMap);
-    m_quotaManager.set(new OriginQuotaManager);
+    if (!m_quotaManager)
+        m_quotaManager.set(new OriginQuotaManager);
 
     openTrackerDatabase(false);
     if (!m_database.isOpen())
@@ -270,30 +305,32 @@ void DatabaseTracker::populateOrigins()
 
     SQLiteStatement statement(m_database, "SELECT origin, quota FROM Origins");
 
-    if (statement.prepare() != SQLResultOk)
+    if (statement.prepare() != SQLResultOk) {
+        LOG_ERROR("Failed to prepare statement.");
         return;
+    }
 
     int result;
     while ((result = statement.step()) == SQLResultRow) {
         RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromDatabaseIdentifier(statement.getColumnText(0));
-        m_quotaMap->set(origin.get(), statement.getColumnInt64(1));
+        m_quotaMap->set(origin.get()->threadsafeCopy(), statement.getColumnInt64(1));
     }
 
     if (result != SQLResultDone)
-        LOG_ERROR("Failed to read in all origins from the database");
+        LOG_ERROR("Failed to read in all origins from the database.");
 }
 
 void DatabaseTracker::origins(Vector<RefPtr<SecurityOrigin> >& result)
 {
-    ASSERT(currentThread() == m_thread);
+    MutexLocker lockDatabase(m_databaseGuard);
     populateOrigins();
-    MutexLocker lockQuotaMap(m_quotaMapGuard);
+    ASSERT(m_quotaMap);
     copyKeysToVector(*m_quotaMap, result);
 }
 
-bool DatabaseTracker::databaseNamesForOrigin(SecurityOrigin* origin, Vector<String>& resultVector)
+bool DatabaseTracker::databaseNamesForOriginNoLock(SecurityOrigin* origin, Vector<String>& resultVector)
 {
-    ASSERT(currentThread() == m_thread);
+    ASSERT(!m_databaseGuard.tryLock());
     openTrackerDatabase(false);
     if (!m_database.isOpen())
         return false;
@@ -317,44 +354,65 @@ bool DatabaseTracker::databaseNamesForOrigin(SecurityOrigin* origin, Vector<Stri
     return true;
 }
 
-DatabaseDetails DatabaseTracker::detailsForNameAndOrigin(const String& name, SecurityOrigin* origin)
+bool DatabaseTracker::databaseNamesForOrigin(SecurityOrigin* origin, Vector<String>& resultVector)
 {
-    ASSERT(currentThread() == m_thread);
+    MutexLocker lockDatabase(m_databaseGuard);
+    Vector<String> temp;
+    if (!databaseNamesForOriginNoLock(origin, temp))
+        return false;
 
-    if (m_proposedDatabase && m_proposedDatabase->first == origin && m_proposedDatabase->second.name() == name)
-        return m_proposedDatabase->second;
+    for (Vector<String>::iterator iter = temp.begin(); iter != temp.end(); ++iter)
+        resultVector.append(iter->threadsafeCopy());
+    return true;
+}
 
+DatabaseDetails DatabaseTracker::detailsForNameAndOrigin(const String& name, SecurityOrigin* origin)
+{
     String originIdentifier = origin->databaseIdentifier();
+    String displayName;
+    int64_t expectedUsage;
 
-    openTrackerDatabase(false);
-    if (!m_database.isOpen())
-        return DatabaseDetails();
-    SQLiteStatement statement(m_database, "SELECT displayName, estimatedSize FROM Databases WHERE origin=? AND name=?");
-    if (statement.prepare() != SQLResultOk)
-        return DatabaseDetails();
+    {
+        MutexLocker lockDatabase(m_databaseGuard);
 
-    statement.bindText(1, originIdentifier);
-    statement.bindText(2, name);
+        for (HashSet<ProposedDatabase*>::iterator iter = m_proposedDatabases.begin(); iter != m_proposedDatabases.end(); ++iter)
+            if ((*iter)->first == origin && (*iter)->second.name() == name) {
+                ASSERT((*iter)->second.thread() == currentThread());
+                return (*iter)->second;
+            }
 
-    int result = statement.step();
-    if (result == SQLResultDone)
-        return DatabaseDetails();
+        openTrackerDatabase(false);
+        if (!m_database.isOpen())
+            return DatabaseDetails();
+        SQLiteStatement statement(m_database, "SELECT displayName, estimatedSize FROM Databases WHERE origin=? AND name=?");
+        if (statement.prepare() != SQLResultOk)
+            return DatabaseDetails();
+
+        statement.bindText(1, originIdentifier);
+        statement.bindText(2, name);
 
-    if (result != SQLResultRow) {
-        LOG_ERROR("Error retrieving details for database %s in origin %s from tracker database", name.ascii().data(), originIdentifier.ascii().data());
-        return DatabaseDetails();
+        int result = statement.step();
+        if (result == SQLResultDone)
+            return DatabaseDetails();
+
+        if (result != SQLResultRow) {
+            LOG_ERROR("Error retrieving details for database %s in origin %s from tracker database", name.ascii().data(), originIdentifier.ascii().data());
+            return DatabaseDetails();
+        }
+        displayName = statement.getColumnText(0);
+        expectedUsage = statement.getColumnInt64(1);
     }
 
-    return DatabaseDetails(name, statement.getColumnText(0), statement.getColumnInt64(1), usageForDatabase(name, origin));
+    return DatabaseDetails(name, displayName, expectedUsage, usageForDatabase(name, origin));
 }
 
 void DatabaseTracker::setDatabaseDetails(SecurityOrigin* origin, const String& name, const String& displayName, unsigned long estimatedSize)
 {
-    ASSERT(currentThread() == m_thread);
-
     String originIdentifier = origin->databaseIdentifier();
     int64_t guid = 0;
 
+    MutexLocker lockDatabase(m_databaseGuard);
+
     openTrackerDatabase(true);
     if (!m_database.isOpen())
         return;
@@ -402,7 +460,6 @@ void DatabaseTracker::setDatabaseDetails(SecurityOrigin* origin, const String& n
 
 unsigned long long DatabaseTracker::usageForDatabase(const String& name, SecurityOrigin* origin)
 {
-    ASSERT(currentThread() == m_thread);
     String path = fullPathForDatabase(origin, name, false);
     if (path.isEmpty())
         return 0;
@@ -424,18 +481,21 @@ void DatabaseTracker::addOpenDatabase(Database* database)
     DatabaseNameMap* nameMap = m_openDatabaseMap->get(database->securityOrigin());
     if (!nameMap) {
         nameMap = new DatabaseNameMap;
-        m_openDatabaseMap->set(database->securityOrigin(), nameMap);
+        m_openDatabaseMap->set(database->securityOrigin()->threadsafeCopy(), nameMap);
     }
 
     DatabaseSet* databaseSet = nameMap->get(name);
     if (!databaseSet) {
         databaseSet = new DatabaseSet;
-        nameMap->set(name, databaseSet);
+        nameMap->set(name.threadsafeCopy(), databaseSet);
     }
 
     databaseSet->add(database);
 
     LOG(StorageAPI, "Added open Database %s (%p)\n", database->stringIdentifier().ascii().data(), database);
+
+    MutexLocker lockDatabase(m_databaseGuard);
+    doneCreatingDatabase(database->securityOrigin(), database->stringIdentifier());
 }
 
 void DatabaseTracker::removeOpenDatabase(Database* database)
@@ -443,6 +503,8 @@ void DatabaseTracker::removeOpenDatabase(Database* database)
     if (!database)
         return;
 
+    Locker<OriginQuotaManager> quotaManagerLocker(originQuotaManager());
+    MutexLocker lockDatabase(m_databaseGuard);
     MutexLocker openDatabaseMapLock(m_openDatabaseMapGuard);
 
     if (!m_openDatabaseMap) {
@@ -478,94 +540,124 @@ void DatabaseTracker::removeOpenDatabase(Database* database)
 
     m_openDatabaseMap->remove(database->securityOrigin());
     delete nameMap;
+    originQuotaManagerNoLock().removeOrigin(database->securityOrigin());
 }
 
-unsigned long long DatabaseTracker::usageForOrigin(SecurityOrigin* origin)
+void DatabaseTracker::getOpenDatabases(SecurityOrigin* origin, const String& name, HashSet<RefPtr<Database> >* databases)
 {
-    ASSERT(currentThread() == m_thread);
-    Locker<OriginQuotaManager> locker(originQuotaManager());
+    MutexLocker openDatabaseMapLock(m_openDatabaseMapGuard);
+    if (!m_openDatabaseMap)
+        return;
+
+    DatabaseNameMap* nameMap = m_openDatabaseMap->get(origin);
+    if (!nameMap)
+        return;
+
+    DatabaseSet* databaseSet = nameMap->get(name);
+    if (!databaseSet)
+        return;
+
+    for (DatabaseSet::iterator it = databaseSet->begin(); it != databaseSet->end(); ++it)
+        databases->add(*it);
+}
+
+unsigned long long DatabaseTracker::usageForOriginNoLock(SecurityOrigin* origin)
+{
+    ASSERT(!originQuotaManagerNoLock().tryLock());
 
     // Use the OriginQuotaManager mechanism to calculate the usage
-    if (originQuotaManager().tracksOrigin(origin))
-        return originQuotaManager().diskUsage(origin);
+    if (originQuotaManagerNoLock().tracksOrigin(origin))
+        return originQuotaManagerNoLock().diskUsage(origin);
 
     // If the OriginQuotaManager doesn't track this origin already, prime it to do so
-    originQuotaManager().trackOrigin(origin);
+    originQuotaManagerNoLock().trackOrigin(origin);
 
     Vector<String> names;
-    databaseNamesForOrigin(origin, names);
+    databaseNamesForOriginNoLock(origin, names);
 
     for (unsigned i = 0; i < names.size(); ++i)
-        originQuotaManager().addDatabase(origin, names[i], fullPathForDatabase(origin, names[i], false));
+        originQuotaManagerNoLock().addDatabase(origin, names[i], fullPathForDatabaseNoLock(origin, names[i], false));
 
-    if (!originQuotaManager().tracksOrigin(origin))
+    if (!originQuotaManagerNoLock().tracksOrigin(origin))
         return 0;
-    return originQuotaManager().diskUsage(origin);
+    return originQuotaManagerNoLock().diskUsage(origin);
+}
+
+unsigned long long DatabaseTracker::usageForOrigin(SecurityOrigin* origin)
+{
+    Locker<OriginQuotaManager> locker(originQuotaManager());
+
+    return usageForOriginNoLock(origin);
+}
+
+unsigned long long DatabaseTracker::quotaForOriginNoLock(SecurityOrigin* origin)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    ASSERT(m_quotaMap);
+    return m_quotaMap->get(origin);
 }
 
 unsigned long long DatabaseTracker::quotaForOrigin(SecurityOrigin* origin)
 {
-    ASSERT(currentThread() == m_thread || m_quotaMap);
+    MutexLocker lockDatabase(m_databaseGuard);
     populateOrigins();
-    MutexLocker lockQuotaMap(m_quotaMapGuard);
-    return m_quotaMap->get(origin);
+    return quotaForOriginNoLock(origin);
 }
 
 void DatabaseTracker::setQuota(SecurityOrigin* origin, unsigned long long quota)
 {
-    ASSERT(currentThread() == m_thread);
-    if (quotaForOrigin(origin) == quota)
+    MutexLocker lockDatabase(m_databaseGuard);
+
+    populateOrigins();
+    if (quotaForOriginNoLock(origin) == quota)
         return;
 
     openTrackerDatabase(true);
     if (!m_database.isOpen())
         return;
 
-    {
-        MutexLocker lockQuotaMap(m_quotaMapGuard);
-
-        if (!m_quotaMap->contains(origin)) {
-            SQLiteStatement statement(m_database, "INSERT INTO Origins VALUES (?, ?)");
-            if (statement.prepare() != SQLResultOk) {
-                LOG_ERROR("Unable to establish origin %s in the tracker", origin->databaseIdentifier().ascii().data());
-            } else {
-                statement.bindText(1, origin->databaseIdentifier());
-                statement.bindInt64(2, quota);
-
-                if (statement.step() != SQLResultDone)
-                    LOG_ERROR("Unable to establish origin %s in the tracker", origin->databaseIdentifier().ascii().data());
-            }
+    if (!m_quotaMap->contains(origin)) {
+        SQLiteStatement statement(m_database, "INSERT INTO Origins VALUES (?, ?)");
+        if (statement.prepare() != SQLResultOk) {
+            LOG_ERROR("Unable to establish origin %s in the tracker", origin->databaseIdentifier().ascii().data());
         } else {
-            SQLiteStatement statement(m_database, "UPDATE Origins SET quota=? WHERE origin=?");
-            bool error = statement.prepare() != SQLResultOk;
-            if (!error) {
-                statement.bindInt64(1, quota);
-                statement.bindText(2, origin->databaseIdentifier());
-
-                error = !statement.executeCommand();
-            }
+            statement.bindText(1, origin->databaseIdentifier());
+            statement.bindInt64(2, quota);
 
-            if (error)
-                LOG_ERROR("Failed to set quota %llu in tracker database for origin %s", quota, origin->databaseIdentifier().ascii().data());
+            if (statement.step() != SQLResultDone)
+                LOG_ERROR("Unable to establish origin %s in the tracker", origin->databaseIdentifier().ascii().data());
+        }
+    } else {
+        SQLiteStatement statement(m_database, "UPDATE Origins SET quota=? WHERE origin=?");
+        bool error = statement.prepare() != SQLResultOk;
+        if (!error) {
+            statement.bindInt64(1, quota);
+            statement.bindText(2, origin->databaseIdentifier());
+
+            error = !statement.executeCommand();
         }
 
-        // FIXME: Is it really OK to update the quota in memory if we failed to update it on disk?
-        m_quotaMap->set(origin, quota);
+        if (error)
+            LOG_ERROR("Failed to set quota %llu in tracker database for origin %s", quota, origin->databaseIdentifier().ascii().data());
     }
 
+    // FIXME: Is it really OK to update the quota in memory if we failed to update it on disk?
+    m_quotaMap->set(origin->threadsafeCopy(), quota);
+
     if (m_client)
         m_client->dispatchDidModifyOrigin(origin);
 }
 
 bool DatabaseTracker::addDatabase(SecurityOrigin* origin, const String& name, const String& path)
 {
-    ASSERT(currentThread() == m_thread);
+    ASSERT(!m_databaseGuard.tryLock());
+    ASSERT(m_quotaMap);
     openTrackerDatabase(true);
     if (!m_database.isOpen())
         return false;
 
     // New database should never be added until the origin has been established
-    ASSERT(hasEntryForOrigin(origin));
+    ASSERT(hasEntryForOriginNoLock(origin));
 
     SQLiteStatement statement(m_database, "INSERT INTO Databases (origin, name, path) VALUES (?, ?, ?);");
 
@@ -589,8 +681,6 @@ bool DatabaseTracker::addDatabase(SecurityOrigin* origin, const String& name, co
 
 void DatabaseTracker::deleteAllDatabases()
 {
-    ASSERT(currentThread() == m_thread);
-
     Vector<RefPtr<SecurityOrigin> > originsCopy;
     origins(originsCopy);
 
@@ -598,19 +688,30 @@ void DatabaseTracker::deleteAllDatabases()
         deleteOrigin(originsCopy[i].get());
 }
 
+// It is the caller's responsibility to make sure that nobody is trying to create, delete, open, or close databases in this origin while the deletion is
+// taking place.
 void DatabaseTracker::deleteOrigin(SecurityOrigin* origin)
 {
-    ASSERT(currentThread() == m_thread);
-    openTrackerDatabase(false);
-    if (!m_database.isOpen())
-        return;
-
     Vector<String> databaseNames;
-    if (!databaseNamesForOrigin(origin, databaseNames)) {
-        LOG_ERROR("Unable to retrieve list of database names for origin %s", origin->databaseIdentifier().ascii().data());
-        return;
+    {
+        MutexLocker lockDatabase(m_databaseGuard);
+        openTrackerDatabase(false);
+        if (!m_database.isOpen())
+            return;
+
+        if (!databaseNamesForOriginNoLock(origin, databaseNames)) {
+            LOG_ERROR("Unable to retrieve list of database names for origin %s", origin->databaseIdentifier().ascii().data());
+            return;
+        }
+        if (!canDeleteOrigin(origin)) {
+            LOG_ERROR("Tried to delete an origin (%s) while either creating database in it or already deleting it", origin->databaseIdentifier().ascii().data());
+            ASSERT(false);
+            return;
+        }
+        recordDeletingOrigin(origin);
     }
 
+    // We drop the lock here because holding locks during a call to deleteDatabaseFile will deadlock.
     for (unsigned i = 0; i < databaseNames.size(); ++i) {
         if (!deleteDatabaseFile(origin, databaseNames[i])) {
             // Even if the file can't be deleted, we want to try and delete the rest, don't return early here.
@@ -618,41 +719,45 @@ void DatabaseTracker::deleteOrigin(SecurityOrigin* origin)
         }
     }
 
-    SQLiteStatement statement(m_database, "DELETE FROM Databases WHERE origin=?");
-    if (statement.prepare() != SQLResultOk) {
-        LOG_ERROR("Unable to prepare deletion of databases from origin %s from tracker", origin->databaseIdentifier().ascii().data());
-        return;
-    }
+    {
+        // To satisfy the lock hierarchy, we have to lock the originQuotaManager before m_databaseGuard if there's any chance we'll to lock both.
+        Locker<OriginQuotaManager> quotaManagerLocker(originQuotaManager());
+        MutexLocker lockDatabase(m_databaseGuard);
+        SQLiteStatement statement(m_database, "DELETE FROM Databases WHERE origin=?");
 
-    statement.bindText(1, origin->databaseIdentifier());
+        doneDeletingOrigin(origin);
 
-    if (!statement.executeCommand()) {
-        LOG_ERROR("Unable to execute deletion of databases from origin %s from tracker", origin->databaseIdentifier().ascii().data());
-        return;
-    }
+        if (statement.prepare() != SQLResultOk) {
+            LOG_ERROR("Unable to prepare deletion of databases from origin %s from tracker", origin->databaseIdentifier().ascii().data());
+            return;
+        }
 
-    SQLiteStatement originStatement(m_database, "DELETE FROM Origins WHERE origin=?");
-    if (originStatement.prepare() != SQLResultOk) {
-        LOG_ERROR("Unable to prepare deletion of origin %s from tracker", origin->databaseIdentifier().ascii().data());
-        return;
-    }
+        statement.bindText(1, origin->databaseIdentifier());
 
-    originStatement.bindText(1, origin->databaseIdentifier());
+        if (!statement.executeCommand()) {
+            LOG_ERROR("Unable to execute deletion of databases from origin %s from tracker", origin->databaseIdentifier().ascii().data());
+            return;
+        }
 
-    if (!originStatement.executeCommand()) {
-        LOG_ERROR("Unable to execute deletion of databases from origin %s from tracker", origin->databaseIdentifier().ascii().data());
-        return;
-    }
+        SQLiteStatement originStatement(m_database, "DELETE FROM Origins WHERE origin=?");
+        if (originStatement.prepare() != SQLResultOk) {
+            LOG_ERROR("Unable to prepare deletion of origin %s from tracker", origin->databaseIdentifier().ascii().data());
+            return;
+        }
 
-    SQLiteFileSystem::deleteEmptyDatabaseDirectory(originPath(origin));
+        originStatement.bindText(1, origin->databaseIdentifier());
 
-    RefPtr<SecurityOrigin> originPossiblyLastReference = origin;
-    {
-        MutexLocker lockQuotaMap(m_quotaMapGuard);
+        if (!originStatement.executeCommand()) {
+            LOG_ERROR("Unable to execute deletion of databases from origin %s from tracker", origin->databaseIdentifier().ascii().data());
+            return;
+        }
+
+        SQLiteFileSystem::deleteEmptyDatabaseDirectory(originPath(origin));
+
+        RefPtr<SecurityOrigin> originPossiblyLastReference = origin;
         m_quotaMap->remove(origin);
 
-        Locker<OriginQuotaManager> quotaManagerLocker(originQuotaManager());
-        originQuotaManager().removeOrigin(origin);
+        originQuotaManagerNoLock().removeOrigin(origin);
 
         // If we removed the last origin, do some additional deletion.
         if (m_quotaMap->isEmpty()) {
@@ -661,30 +766,159 @@ void DatabaseTracker::deleteOrigin(SecurityOrigin* origin)
            SQLiteFileSystem::deleteDatabaseFile(trackerDatabasePath());
            SQLiteFileSystem::deleteEmptyDatabaseDirectory(m_databaseDirectoryPath);
         }
+
+        if (m_client) {
+            m_client->dispatchDidModifyOrigin(origin);
+            for (unsigned i = 0; i < databaseNames.size(); ++i)
+                m_client->dispatchDidModifyDatabase(origin, databaseNames[i]);
+        }
     }
+}
 
-    if (m_client) {
-        m_client->dispatchDidModifyOrigin(origin);
-        for (unsigned i = 0; i < databaseNames.size(); ++i)
-            m_client->dispatchDidModifyDatabase(origin, databaseNames[i]);
+bool DatabaseTracker::canCreateDatabase(SecurityOrigin *origin, const String& name)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    // Can't create a database while someone else is deleting it; there's a risk of leaving untracked database debris on the disk.
+    return !deletingDatabase(origin, name) && !deletingOrigin(origin);
+}
+
+void DatabaseTracker::recordCreatingDatabase(SecurityOrigin *origin, const String& name)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    NameCountMap* nameMap = m_beingCreated.get(origin);
+    if (!nameMap) {
+        nameMap = new NameCountMap();
+        m_beingCreated.set(origin->threadsafeCopy(), nameMap);
+    }
+    long count = nameMap->get(name);
+    nameMap->set(name.threadsafeCopy(), count + 1);
+}
+
+void DatabaseTracker::doneCreatingDatabase(SecurityOrigin *origin, const String& name)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    NameCountMap* nameMap = m_beingCreated.get(origin);
+    if (nameMap) {
+        long count = nameMap->get(name);
+        ASSERT(count > 0);
+        if (count <= 1) {
+            nameMap->remove(name);
+            if (nameMap->isEmpty()) {
+                m_beingCreated.remove(origin);
+                delete nameMap;
+            }
+        } else
+            nameMap->set(name, count - 1);
+    } else
+        ASSERT(false);
+}
+
+bool DatabaseTracker::creatingDatabase(SecurityOrigin *origin, const String& name)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    NameCountMap* nameMap = m_beingCreated.get(origin);
+    return nameMap && nameMap->get(name);
+}
+
+bool DatabaseTracker::canDeleteDatabase(SecurityOrigin *origin, const String& name)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    return !creatingDatabase(origin, name) && !deletingDatabase(origin, name);
+}
+
+void DatabaseTracker::recordDeletingDatabase(SecurityOrigin *origin, const String& name)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    ASSERT(canDeleteDatabase(origin, name));
+    NameSet* nameSet = m_beingDeleted.get(origin);
+    if (!nameSet) {
+        nameSet = new NameSet();
+        m_beingDeleted.set(origin->threadsafeCopy(), nameSet);
     }
+    ASSERT(!nameSet->contains(name));
+    nameSet->add(name.threadsafeCopy());
+}
+
+void DatabaseTracker::doneDeletingDatabase(SecurityOrigin *origin, const String& name)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    NameSet* nameSet = m_beingDeleted.get(origin);
+    if (nameSet) {
+        ASSERT(nameSet->contains(name));
+        nameSet->remove(name);
+        if (nameSet->isEmpty()) {
+            m_beingDeleted.remove(origin);
+            delete nameSet;
+        }
+    } else {
+        ASSERT(false);
+    }
+}
+
+bool DatabaseTracker::deletingDatabase(SecurityOrigin *origin, const String& name)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    NameSet* nameSet = m_beingDeleted.get(origin);
+    return nameSet && nameSet->contains(name);
+}
+
+bool DatabaseTracker::canDeleteOrigin(SecurityOrigin *origin)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    return !(deletingOrigin(origin) || m_beingCreated.get(origin));
+}
+
+bool DatabaseTracker::deletingOrigin(SecurityOrigin *origin)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    return m_originsBeingDeleted.contains(origin);
+}
+
+void DatabaseTracker::recordDeletingOrigin(SecurityOrigin *origin)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    ASSERT(!deletingOrigin(origin));
+    m_originsBeingDeleted.add(origin->threadsafeCopy());
+}
+
+void DatabaseTracker::doneDeletingOrigin(SecurityOrigin *origin)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    ASSERT(deletingOrigin(origin));
+    m_originsBeingDeleted.remove(origin);
 }
 
 void DatabaseTracker::deleteDatabase(SecurityOrigin* origin, const String& name)
 {
-    ASSERT(currentThread() == m_thread);
-    openTrackerDatabase(false);
-    if (!m_database.isOpen())
-        return;
+    {
+        MutexLocker lockDatabase(m_databaseGuard);
+        openTrackerDatabase(false);
+        if (!m_database.isOpen())
+            return;
+
+        if (!canDeleteDatabase(origin, name)) {
+            ASSERT(FALSE);
+            return;
+        }
+        recordDeletingDatabase(origin, name);
+    }
 
+    // We drop the lock here because holding locks during a call to deleteDatabaseFile will deadlock.
     if (!deleteDatabaseFile(origin, name)) {
         LOG_ERROR("Unable to delete file for database %s in origin %s", name.ascii().data(), origin->databaseIdentifier().ascii().data());
+        MutexLocker lockDatabase(m_databaseGuard);
+        doneDeletingDatabase(origin, name);
         return;
     }
 
+    // To satisfy the lock hierarchy, we have to lock the originQuotaManager before m_databaseGuard if there's any chance we'll to lock both.
+    Locker<OriginQuotaManager> quotaManagerLocker(originQuotaManager());
+    MutexLocker lockDatabase(m_databaseGuard);
+
     SQLiteStatement statement(m_database, "DELETE FROM Databases WHERE origin=? AND name=?");
     if (statement.prepare() != SQLResultOk) {
         LOG_ERROR("Unable to prepare deletion of database %s from origin %s from tracker", name.ascii().data(), origin->databaseIdentifier().ascii().data());
+        doneDeletingDatabase(origin, name);
         return;
     }
 
@@ -693,40 +927,46 @@ void DatabaseTracker::deleteDatabase(SecurityOrigin* origin, const String& name)
 
     if (!statement.executeCommand()) {
         LOG_ERROR("Unable to execute deletion of database %s from origin %s from tracker", name.ascii().data(), origin->databaseIdentifier().ascii().data());
+        doneDeletingDatabase(origin, name);
         return;
     }
 
-    {
-        Locker<OriginQuotaManager> quotaManagerLocker(originQuotaManager());
-        originQuotaManager().removeDatabase(origin, name);
-    }
+    originQuotaManagerNoLock().removeDatabase(origin, name);
 
     if (m_client) {
         m_client->dispatchDidModifyOrigin(origin);
         m_client->dispatchDidModifyDatabase(origin, name);
     }
+    doneDeletingDatabase(origin, name);
 }
 
+// deleteDatabaseFile has to release locks between looking up the list of databases to close and closing them.  While this is in progress, the caller
+// is responsible for making sure no new databases are opened in the file to be deleted.
 bool DatabaseTracker::deleteDatabaseFile(SecurityOrigin* origin, const String& name)
 {
-    ASSERT(currentThread() == m_thread);
     String fullPath = fullPathForDatabase(origin, name, false);
     if (fullPath.isEmpty())
         return true;
 
+#ifndef NDEBUG
+    {
+    MutexLocker lockDatabase(m_databaseGuard);
+    ASSERT(deletingDatabase(origin, name) || deletingOrigin(origin));
+    }
+#endif
+
     Vector<RefPtr<Database> > deletedDatabases;
 
-    // Make sure not to hold the m_openDatabaseMapGuard mutex when calling
+    // Make sure not to hold the any locks when calling
     // Database::markAsDeletedAndClose(), since that can cause a deadlock
     // during the synchronous DatabaseThread call it triggers.
-
     {
         MutexLocker openDatabaseMapLock(m_openDatabaseMapGuard);
         if (m_openDatabaseMap) {
             // There are some open databases, lets check if they are for this origin.
             DatabaseNameMap* nameMap = m_openDatabaseMap->get(origin);
             if (nameMap && nameMap->size()) {
-                // There are some open databases for this origin, lets check
+                // There are some open databases for this origin, let's check
                 // if they are this database by name.
                 DatabaseSet* databaseSet = nameMap->get(name);
                 if (databaseSet && databaseSet->size()) {
@@ -747,7 +987,6 @@ bool DatabaseTracker::deleteDatabaseFile(SecurityOrigin* origin, const String& n
 
 void DatabaseTracker::setClient(DatabaseTrackerClient* client)
 {
-    ASSERT(currentThread() == m_thread);
     m_client = client;
 }
 
@@ -757,7 +996,7 @@ static Mutex& notificationMutex()
     return mutex;
 }
 
-typedef Vector<pair<SecurityOrigin*, String> > NotificationQueue;
+typedef Vector<pair<RefPtr<SecurityOrigin>, String> > NotificationQueue;
 
 static NotificationQueue& notificationQueue()
 {
@@ -769,7 +1008,7 @@ void DatabaseTracker::scheduleNotifyDatabaseChanged(SecurityOrigin* origin, cons
 {
     MutexLocker locker(notificationMutex());
 
-    notificationQueue().append(pair<SecurityOrigin*, String>(origin, name.crossThreadString()));
+    notificationQueue().append(pair<RefPtr<SecurityOrigin>, String>(origin->threadsafeCopy(), name.crossThreadString()));
     scheduleForNotification();
 }
 
@@ -804,7 +1043,7 @@ void DatabaseTracker::notifyDatabasesChanged(void*)
         return;
 
     for (unsigned i = 0; i < notifications.size(); ++i)
-        theTracker.m_client->dispatchDidModifyDatabase(notifications[i].first, notifications[i].second);
+        theTracker.m_client->dispatchDidModifyDatabase(notifications[i].first.get(), notifications[i].second);
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h
index 85e4858ad0..79419660ed 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h
@@ -31,41 +31,71 @@
 
 #if ENABLE(DATABASE)
 
-#include "DatabaseDetails.h"
 #include "PlatformString.h"
-#include "SQLiteDatabase.h"
 #include "StringHash.h"
+#include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+
+#if !PLATFORM(CHROMIUM)
+#include "DatabaseDetails.h"
+#include "SQLiteDatabase.h"
 #include <wtf/OwnPtr.h>
+#endif // !PLATFORM(CHROMIUM)
 
 namespace WebCore {
 
 class Database;
-class DatabaseTrackerClient;
-class Document;
-class OriginQuotaManager;
+class ScriptExecutionContext;
 class SecurityOrigin;
 
 struct SecurityOriginHash;
+
+#if !PLATFORM(CHROMIUM)
+class DatabaseTrackerClient;
+class OriginQuotaManager;
+
 struct SecurityOriginTraits;
+#endif // !PLATFORM(CHROMIUM)
 
-class DatabaseTracker {
+class DatabaseTracker : public Noncopyable {
 public:
-    void setDatabaseDirectoryPath(const String&);
-    const String& databaseDirectoryPath() const;
+    static DatabaseTracker& tracker();
+    // This singleton will potentially be used from multiple worker threads and the page's context thread simultaneously.  To keep this safe, it's
+    // currently using 4 locks.  In order to avoid deadlock when taking multiple locks, you must take them in the correct order:
+    // originQuotaManager() before m_databaseGuard or m_openDatabaseMapGuard
+    // m_databaseGuard before m_openDatabaseMapGuard
+    // notificationMutex() is currently independent of the other locks.
 
-    bool canEstablishDatabase(Document*, const String& name, const String& displayName, unsigned long estimatedSize);
+    bool canEstablishDatabase(ScriptExecutionContext*, const String& name, const String& displayName, unsigned long estimatedSize);
     void setDatabaseDetails(SecurityOrigin*, const String& name, const String& displayName, unsigned long estimatedSize);
     String fullPathForDatabase(SecurityOrigin*, const String& name, bool createIfDoesNotExist = true);
 
+    void addOpenDatabase(Database*);
+    void removeOpenDatabase(Database*);
+    void getOpenDatabases(SecurityOrigin* origin, const String& name, HashSet<RefPtr<Database> >* databases);
+
+    unsigned long long getMaxSizeForDatabase(const Database*);
+
+private:
+    DatabaseTracker();
+
+    typedef HashSet<Database*> DatabaseSet;
+    typedef HashMap<String, DatabaseSet*> DatabaseNameMap;
+    typedef HashMap<RefPtr<SecurityOrigin>, DatabaseNameMap*, SecurityOriginHash> DatabaseOriginMap;
+
+    Mutex m_openDatabaseMapGuard;
+    mutable OwnPtr<DatabaseOriginMap> m_openDatabaseMap;
+
+#if !PLATFORM(CHROMIUM)
+public:
+    void setDatabaseDirectoryPath(const String&);
+    String databaseDirectoryPath() const;
+
     void origins(Vector<RefPtr<SecurityOrigin> >& result);
     bool databaseNamesForOrigin(SecurityOrigin*, Vector<String>& result);
 
     DatabaseDetails detailsForNameAndOrigin(const String&, SecurityOrigin*);
 
-    void addOpenDatabase(Database*);
-    void removeOpenDatabase(Database*);
-
     unsigned long long usageForDatabase(const String&, SecurityOrigin*);
     unsigned long long usageForOrigin(SecurityOrigin*);
     unsigned long long quotaForOrigin(SecurityOrigin*);
@@ -82,14 +112,16 @@ public:
 
     OriginQuotaManager& originQuotaManager();
 
-    static DatabaseTracker& tracker();
 
     bool hasEntryForOrigin(SecurityOrigin*);
 
-    unsigned long long getMaxSizeForDatabase(const Database*);
-
 private:
-    DatabaseTracker();
+    OriginQuotaManager& originQuotaManagerNoLock();
+    bool hasEntryForOriginNoLock(SecurityOrigin* origin);
+    String fullPathForDatabaseNoLock(SecurityOrigin*, const String& name, bool createIfDoesNotExist);
+    bool databaseNamesForOriginNoLock(SecurityOrigin* origin, Vector<String>& resultVector);
+    unsigned long long usageForOriginNoLock(SecurityOrigin* origin);
+    unsigned long long quotaForOriginNoLock(SecurityOrigin* origin);
 
     String trackerDatabasePath() const;
     void openTrackerDatabase(bool createIfDoesNotExist);
@@ -103,33 +135,44 @@ private:
 
     bool deleteDatabaseFile(SecurityOrigin*, const String& name);
 
+    // This lock protects m_database, m_quotaMap, m_proposedDatabases, m_databaseDirectoryPath, m_originsBeingDeleted, m_beingCreated, and m_beingDeleted.
+    Mutex m_databaseGuard;
     SQLiteDatabase m_database;
 
     typedef HashMap<RefPtr<SecurityOrigin>, unsigned long long, SecurityOriginHash> QuotaMap;
-    Mutex m_quotaMapGuard;
     mutable OwnPtr<QuotaMap> m_quotaMap;
 
-    typedef HashSet<Database*> DatabaseSet;
-    typedef HashMap<String, DatabaseSet*> DatabaseNameMap;
-    typedef HashMap<RefPtr<SecurityOrigin>, DatabaseNameMap*, SecurityOriginHash> DatabaseOriginMap;
-
-    Mutex m_openDatabaseMapGuard;
-    mutable OwnPtr<DatabaseOriginMap> m_openDatabaseMap;
-
     OwnPtr<OriginQuotaManager> m_quotaManager;
 
     String m_databaseDirectoryPath;
 
     DatabaseTrackerClient* m_client;
 
-    std::pair<SecurityOrigin*, DatabaseDetails>* m_proposedDatabase;
-
-#ifndef NDEBUG
-    ThreadIdentifier m_thread;
-#endif
+    typedef std::pair<RefPtr<SecurityOrigin>, DatabaseDetails> ProposedDatabase;
+    HashSet<ProposedDatabase*> m_proposedDatabases;
+
+    typedef HashMap<String, long> NameCountMap;
+    typedef HashMap<RefPtr<SecurityOrigin>, NameCountMap*, SecurityOriginHash> CreateSet;
+    CreateSet m_beingCreated;
+    typedef HashSet<String> NameSet;
+    HashMap<RefPtr<SecurityOrigin>, NameSet*, SecurityOriginHash> m_beingDeleted;
+    HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash> m_originsBeingDeleted;
+    bool canCreateDatabase(SecurityOrigin *origin, const String& name);
+    void recordCreatingDatabase(SecurityOrigin *origin, const String& name);
+    void doneCreatingDatabase(SecurityOrigin *origin, const String& name);
+    bool creatingDatabase(SecurityOrigin *origin, const String& name);
+    bool canDeleteDatabase(SecurityOrigin *origin, const String& name);
+    void recordDeletingDatabase(SecurityOrigin *origin, const String& name);
+    void doneDeletingDatabase(SecurityOrigin *origin, const String& name);
+    bool deletingDatabase(SecurityOrigin *origin, const String& name);
+    bool canDeleteOrigin(SecurityOrigin *origin);
+    bool deletingOrigin(SecurityOrigin *origin);
+    void recordDeletingOrigin(SecurityOrigin *origin);
+    void doneDeletingOrigin(SecurityOrigin *origin);
 
     static void scheduleForNotification();
     static void notifyDatabasesChanged(void*);
+#endif // !PLATFORM(CHROMIUM)
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/IDBDatabaseError.h b/src/3rdparty/webkit/WebCore/storage/IDBDatabaseError.h
new file mode 100644
index 0000000000..e8fd2dd236
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IDBDatabaseError.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef IDBDatabaseError_h
+#define IDBDatabaseError_h
+
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+class IDBDatabaseError : public RefCounted<IDBDatabaseError> {
+public:
+    static PassRefPtr<IDBDatabaseError> create()
+    {
+        return adoptRef(new IDBDatabaseError());
+    }
+    ~IDBDatabaseError() { }
+
+    unsigned short code() const { return m_code; }
+    void setCode(unsigned short value) { m_code = value; }
+    String message() const { return m_message; }
+    void setMessage(const String& value) { m_message = value; }
+
+private:
+    IDBDatabaseError() { }
+
+    unsigned short m_code;
+    String m_message;
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // IDBDatabaseError_h
+
diff --git a/src/3rdparty/webkit/WebCore/storage/IDBDatabaseError.idl b/src/3rdparty/webkit/WebCore/storage/IDBDatabaseError.idl
new file mode 100644
index 0000000000..6c6019cfea
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IDBDatabaseError.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+module storage {
+
+    interface [
+        Conditional=INDEXED_DATABASE
+    ] IDBDatabaseError {
+        attribute unsigned short code;
+        attribute DOMString message;
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/storage/IDBDatabaseException.h b/src/3rdparty/webkit/WebCore/storage/IDBDatabaseException.h
new file mode 100644
index 0000000000..d94a7f9faf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IDBDatabaseException.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef IDBDatabaseException_h
+#define IDBDatabaseException_h
+
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+class IDBDatabaseException : public RefCounted<IDBDatabaseException> {
+public:
+    static PassRefPtr<IDBDatabaseException> create()
+    {
+        return adoptRef(new IDBDatabaseException());
+    }
+    ~IDBDatabaseException() { }
+    
+    unsigned short code() const { return m_code; }
+    void setCode(unsigned short value) { m_code = value; }
+    String message() const { return m_message; }
+    void setMessage(const String& value) { m_message = value; }
+
+private:
+    IDBDatabaseException() { }
+
+    unsigned short m_code;
+    String m_message;
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // IDBDatabaseException_h
+
diff --git a/src/3rdparty/webkit/WebCore/storage/IDBDatabaseException.idl b/src/3rdparty/webkit/WebCore/storage/IDBDatabaseException.idl
new file mode 100644
index 0000000000..898e5f9c13
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IDBDatabaseException.idl
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+module storage {
+
+    interface [
+        Conditional=INDEXED_DATABASE
+    ] IDBDatabaseException {
+        const unsigned short UNKNOWN_ERR = 0;
+        const unsigned short NON_TRANSIENT_ERR = 1;
+        const unsigned short NOT_FOUND_ERR = 2;
+        const unsigned short CONSTRAINT_ERR = 3;
+        const unsigned short DATA_ERR = 4;
+        const unsigned short NOT_ALLOWED_ERR = 5;
+        const unsigned short SERIAL_ERR = 11;
+        const unsigned short RECOVERABLE_ERR = 21;
+        const unsigned short TRANSIENT_ERR = 31;
+        const unsigned short TIMEOUT_ERR = 32;
+        const unsigned short DEADLOCK_ERR = 33;
+        attribute unsigned short code;
+        attribute DOMString message;
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/storage/IDBDatabaseRequest.h b/src/3rdparty/webkit/WebCore/storage/IDBDatabaseRequest.h
new file mode 100644
index 0000000000..859aae4f12
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IDBDatabaseRequest.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef IDBDatabaseRequest_h
+#define IDBDatabaseRequest_h
+
+#include <wtf/RefCounted.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+class IDBRequest;
+
+class IDBDatabaseRequest : public RefCounted<IDBDatabaseRequest> {
+public:
+    // FIXME: Write.
+    IDBRequest* request() const { return 0; }
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // IDBDatabaseRequest_h
+
diff --git a/src/3rdparty/webkit/WebCore/storage/IDBDatabaseRequest.idl b/src/3rdparty/webkit/WebCore/storage/IDBDatabaseRequest.idl
new file mode 100644
index 0000000000..030bb6e5c7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IDBDatabaseRequest.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+module storage {
+
+    interface [
+        Conditional=INDEXED_DATABASE
+    ] IDBDatabaseRequest {
+        readonly attribute IDBRequest request;
+        // FIXME: Write.
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/storage/IDBRequest.cpp b/src/3rdparty/webkit/WebCore/storage/IDBRequest.cpp
new file mode 100644
index 0000000000..1a2049949b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IDBRequest.cpp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+#include "IDBRequest.h"
+
+#if ENABLE(INDEXED_DATABASE)
+
+#include "IDBDatabaseError.h"
+#include "SerializedScriptValue.h"
+
+namespace WebCore {
+
+IDBRequest::IDBRequest(ScriptExecutionContext* context)
+    : ActiveDOMObject(context, this)
+{
+}
+
+IDBRequest::~IDBRequest()
+{
+}
+
+void IDBRequest::abort()
+{
+}
+
+EventTargetData* IDBRequest::eventTargetData()
+{
+    return 0;
+}
+
+EventTargetData* IDBRequest::ensureEventTargetData()
+{
+    return 0;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INDEXED_DATABASE)
+
diff --git a/src/3rdparty/webkit/WebCore/storage/IDBRequest.h b/src/3rdparty/webkit/WebCore/storage/IDBRequest.h
new file mode 100644
index 0000000000..5f00aa8624
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IDBRequest.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef IDBRequest_h
+#define IDBRequest_h
+
+#include "ActiveDOMObject.h"
+#include "EventTarget.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+class IDBDatabaseError;
+class SerializedScriptValue;
+
+class IDBRequest : public RefCounted<IDBRequest>, public ActiveDOMObject, public EventTarget {
+public:
+    static PassRefPtr<IDBRequest> create(ScriptExecutionContext* context)
+    {
+        return adoptRef(new IDBRequest(context));
+    }
+    ~IDBRequest();
+
+    void abort();
+    unsigned short readyState() const { return m_readyState; }
+    IDBDatabaseError* error() const { return m_error.get(); }
+    SerializedScriptValue* result() const { return m_result.get(); }
+
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(success);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+
+    using RefCounted<IDBRequest>::ref;
+    using RefCounted<IDBRequest>::deref;
+
+    // EventTarget interface
+    virtual ScriptExecutionContext* scriptExecutionContext() const { return ActiveDOMObject::scriptExecutionContext(); }
+    virtual IDBRequest* toIDBRequest() { return this; }
+
+private:
+    explicit IDBRequest(ScriptExecutionContext* context);
+
+    // EventTarget interface
+    virtual void refEventTarget() { ref(); }
+    virtual void derefEventTarget() { deref(); }
+    virtual EventTargetData* eventTargetData();
+    virtual EventTargetData* ensureEventTargetData();
+
+    unsigned short m_readyState;
+    RefPtr<IDBDatabaseError> m_error;
+    RefPtr<SerializedScriptValue> m_result;
+
+    EventTargetData m_eventTargetData;
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // IDBRequest_h
+
diff --git a/src/3rdparty/webkit/WebCore/storage/IDBRequest.idl b/src/3rdparty/webkit/WebCore/storage/IDBRequest.idl
new file mode 100644
index 0000000000..b34184c5ce
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IDBRequest.idl
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+module storage {
+
+    interface [
+        Conditional=INDEXED_DATABASE,
+        EventTarget
+    ] IDBRequest {
+        void abort();
+        const unsigned short INITIAL = 0;
+        const unsigned short LOADING = 1;
+        const unsigned short DONE = 2;
+        readonly attribute unsigned short readyState;
+        readonly attribute IDBDatabaseError error;
+        readonly attribute [CustomGetter] any result;
+        attribute EventListener onsuccess;
+        attribute EventListener onerror;
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/storage/IndexedDatabase.cpp b/src/3rdparty/webkit/WebCore/storage/IndexedDatabase.cpp
new file mode 100644
index 0000000000..167494e049
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IndexedDatabase.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+#include "IndexedDatabase.h"
+
+#include "IndexedDatabaseImpl.h"
+
+#if PLATFORM(CHROMIUM)
+#error "Chromium should not compile this file and instead define its own version of this factory that navigates the multi-process boundry."
+#endif
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+PassRefPtr<IndexedDatabase> IndexedDatabase::get()
+{
+    return IndexedDatabaseImpl::get();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INDEXED_DATABASE)
+
diff --git a/src/3rdparty/webkit/WebCore/storage/IndexedDatabase.h b/src/3rdparty/webkit/WebCore/storage/IndexedDatabase.h
new file mode 100644
index 0000000000..e00f0558cc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IndexedDatabase.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef IndexedDatabase_h
+#define IndexedDatabase_h
+
+#include "ExceptionCode.h"
+#include "PlatformString.h"
+#include <wtf/Threading.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+// This class is shared by IndexedDatabaseRequest (async) and IndexedDatabaseSync (sync).
+// This is implemented by IndexedDatabaseImpl and optionally others (in order to proxy
+// calls across process barriers). All calls to these classes should be non-blocking and
+// trigger work on a background thread if necessary.
+class IndexedDatabase : public ThreadSafeShared<IndexedDatabase> {
+public:
+    static PassRefPtr<IndexedDatabase> get();
+    virtual ~IndexedDatabase() { }
+
+    virtual void open(const String& name, const String& description, bool modifyDatabase, ExceptionCode&) = 0;
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // IndexedDatabase_h
+
diff --git a/src/3rdparty/webkit/WebCore/storage/IndexedDatabaseImpl.cpp b/src/3rdparty/webkit/WebCore/storage/IndexedDatabaseImpl.cpp
new file mode 100644
index 0000000000..cfba05dc59
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IndexedDatabaseImpl.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+#include "IndexedDatabaseImpl.h"
+
+#include <wtf/Threading.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+IndexedDatabaseImpl* IndexedDatabaseImpl::indexedDatabaseImpl = 0;
+
+PassRefPtr<IndexedDatabaseImpl> IndexedDatabaseImpl::get()
+{
+    if (!indexedDatabaseImpl)
+        indexedDatabaseImpl = new IndexedDatabaseImpl();
+    ASSERT(indexedDatabaseImpl);
+    return indexedDatabaseImpl;
+}
+
+IndexedDatabaseImpl::IndexedDatabaseImpl()
+{
+    // FIXME: Make this thread safe.
+    ASSERT(!indexedDatabaseImpl);
+    indexedDatabaseImpl = this;
+}
+
+IndexedDatabaseImpl::~IndexedDatabaseImpl()
+{
+    // FIXME: Make this thread safe.
+    ASSERT(indexedDatabaseImpl == this);
+    indexedDatabaseImpl = 0;
+}
+
+void IndexedDatabaseImpl::open(const String& name, const String& description, bool modifyDatabase, ExceptionCode&)
+{
+    // FIXME: Write.
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INDEXED_DATABASE)
+
diff --git a/src/3rdparty/webkit/WebCore/storage/IndexedDatabaseImpl.h b/src/3rdparty/webkit/WebCore/storage/IndexedDatabaseImpl.h
new file mode 100644
index 0000000000..37bbc273bf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IndexedDatabaseImpl.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef IndexedDatabaseImpl_h
+#define IndexedDatabaseImpl_h
+
+#include "IndexedDatabase.h"
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+class IndexedDatabaseImpl : public IndexedDatabase {
+public:
+    static PassRefPtr<IndexedDatabaseImpl> get();
+    virtual ~IndexedDatabaseImpl();
+
+    virtual void open(const String& name, const String& description, bool modifyDatabase, ExceptionCode&);
+
+private:
+    IndexedDatabaseImpl();
+
+    // We only create one instance of this class at a time.
+    static IndexedDatabaseImpl* indexedDatabaseImpl;
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // IndexedDatabaseImpl_h
+
diff --git a/src/3rdparty/webkit/WebCore/storage/IndexedDatabaseRequest.cpp b/src/3rdparty/webkit/WebCore/storage/IndexedDatabaseRequest.cpp
new file mode 100644
index 0000000000..827493bf5c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IndexedDatabaseRequest.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+#include "IndexedDatabaseRequest.h"
+
+#if ENABLE(INDEXED_DATABASE)
+
+#include "ExceptionCode.h"
+#include "IDBRequest.h"
+
+namespace WebCore {
+
+IndexedDatabaseRequest::IndexedDatabaseRequest()
+{
+}
+
+IndexedDatabaseRequest::~IndexedDatabaseRequest()
+{
+}
+
+void IndexedDatabaseRequest::open(const String& name, const String& description, bool modifyDatabase, ExceptionCode& exception)
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INDEXED_DATABASE)
+
diff --git a/src/3rdparty/webkit/WebCore/storage/IndexedDatabaseRequest.h b/src/3rdparty/webkit/WebCore/storage/IndexedDatabaseRequest.h
new file mode 100644
index 0000000000..74aada3276
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IndexedDatabaseRequest.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef IndexedDatabaseRequest_h
+#define IndexedDatabaseRequest_h
+
+#include "ExceptionCode.h"
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+class IDBRequest;
+
+class IndexedDatabaseRequest : public RefCounted<IndexedDatabaseRequest> {
+public:
+    static PassRefPtr<IndexedDatabaseRequest> create()
+    {
+        return adoptRef(new IndexedDatabaseRequest());
+    }
+    ~IndexedDatabaseRequest();
+
+    IDBRequest* request() const { return m_request.get(); }
+    void open(const String& name, const String& description, bool modifyDatabase, ExceptionCode&);
+
+private:
+    IndexedDatabaseRequest();
+
+    PassRefPtr<IDBRequest> m_request;
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // IndexedDatabaseRequest_h
+
diff --git a/src/3rdparty/webkit/WebCore/storage/IndexedDatabaseRequest.idl b/src/3rdparty/webkit/WebCore/storage/IndexedDatabaseRequest.idl
new file mode 100644
index 0000000000..5f3b63e988
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/IndexedDatabaseRequest.idl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+module storage {
+
+    interface [
+        Conditional=INDEXED_DATABASE
+    ] IndexedDatabaseRequest {
+        readonly attribute IDBRequest request;
+        [Custom] void open(in DOMString name, in DOMString description, in optional boolean modifyDatabase, IDBDatabaseErrorCallback onerror, IDBDatabaseRequestCallback onsuccess)
+            raises(IDBDatabaseException);
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
index f03d851c76..dc3e7e2dac 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
@@ -28,8 +28,7 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Threading.h>
 
 namespace WebCore {
@@ -38,15 +37,15 @@ namespace WebCore {
     class LocalStorageThread;
 
     // FIXME: Rename this class to StorageTask
-    class LocalStorageTask : public ThreadSafeShared<LocalStorageTask> {
+    class LocalStorageTask : public Noncopyable {
     public:
         enum Type { AreaImport, AreaSync, TerminateThread };
 
         ~LocalStorageTask();
 
-        static PassRefPtr<LocalStorageTask> createImport(StorageAreaSync* area) { return adoptRef(new LocalStorageTask(AreaImport, area)); }
-        static PassRefPtr<LocalStorageTask> createSync(StorageAreaSync* area) { return adoptRef(new LocalStorageTask(AreaSync, area)); }
-        static PassRefPtr<LocalStorageTask> createTerminate(LocalStorageThread* thread) { return adoptRef(new LocalStorageTask(TerminateThread, thread)); }
+        static PassOwnPtr<LocalStorageTask> createImport(StorageAreaSync* area) { return new LocalStorageTask(AreaImport, area); }
+        static PassOwnPtr<LocalStorageTask> createSync(StorageAreaSync* area) { return new LocalStorageTask(AreaSync, area); }
+        static PassOwnPtr<LocalStorageTask> createTerminate(LocalStorageThread* thread) { return new LocalStorageTask(TerminateThread, thread); }
 
         void performTask();
 
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
index 78640a92f7..d4a7b4cc63 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
@@ -33,96 +33,70 @@
 
 namespace WebCore {
 
-PassRefPtr<LocalStorageThread> LocalStorageThread::create()
+PassOwnPtr<LocalStorageThread> LocalStorageThread::create()
 {
-    return adoptRef(new LocalStorageThread);
+    return new LocalStorageThread;
 }
 
 LocalStorageThread::LocalStorageThread()
     : m_threadID(0)
 {
-    m_selfRef = this;
 }
 
-bool LocalStorageThread::start()
+LocalStorageThread::~LocalStorageThread()
 {
-    MutexLocker lock(m_threadCreationMutex);
-
-    if (m_threadID)
-        return true;
-
-    m_threadID = createThread(LocalStorageThread::localStorageThreadStart, this, "WebCore: LocalStorage");
+    ASSERT(isMainThread());
+    ASSERT(!m_threadID);
+}
 
+bool LocalStorageThread::start()
+{
+    ASSERT(isMainThread());
+    if (!m_threadID)
+        m_threadID = createThread(LocalStorageThread::threadEntryPointCallback, this, "WebCore: LocalStorage");
     return m_threadID;
 }
 
-void* LocalStorageThread::localStorageThreadStart(void* thread)
+void* LocalStorageThread::threadEntryPointCallback(void* thread)
 {
-    return static_cast<LocalStorageThread*>(thread)->localStorageThread();
+    return static_cast<LocalStorageThread*>(thread)->threadEntryPoint();
 }
 
-void* LocalStorageThread::localStorageThread()
+void* LocalStorageThread::threadEntryPoint()
 {
-    {
-        // Wait for LocalStorageThread::start() to complete.
-        MutexLocker lock(m_threadCreationMutex);
-    }
-
-    while (true) {
-        RefPtr<LocalStorageTask> task;
-        if (!m_queue.waitForMessage(task))
-            break;
-
+    ASSERT(!isMainThread());
+    while (OwnPtr<LocalStorageTask> task = m_queue.waitForMessage())
         task->performTask();
-    }
-
-    // Detach the thread so its resources are no longer of any concern to anyone else
-    detachThread(m_threadID);
-    m_threadID = 0;
-
-    // Clear the self refptr, possibly resulting in deletion
-    m_selfRef = 0;
 
     return 0;
 }
 
-void LocalStorageThread::scheduleImport(StorageAreaSync* area)
-{
-    ASSERT(!m_queue.killed() && m_threadID);
-    m_queue.append(LocalStorageTask::createImport(area));
-}
-
-void LocalStorageThread::scheduleSync(StorageAreaSync* area)
+void LocalStorageThread::scheduleTask(PassOwnPtr<LocalStorageTask> task)
 {
+    ASSERT(isMainThread());
     ASSERT(!m_queue.killed() && m_threadID);
-    m_queue.append(LocalStorageTask::createSync(area));
+    m_queue.append(task);
 }
 
 void LocalStorageThread::terminate()
 {
     ASSERT(isMainThread());
-
-    // Ideally we'd never be killing a thread that wasn't live, so ASSERT it.
-    // But if we do in a release build, make sure to not wait on a condition that will never get signalled
     ASSERT(!m_queue.killed() && m_threadID);
+    // Even in weird, exceptional cases, don't wait on a nonexistent thread to terminate.
     if (!m_threadID)
         return;
 
-    MutexLocker locker(m_terminateLock);
-
+    void* returnValue;
     m_queue.append(LocalStorageTask::createTerminate(this));
-
-    m_terminateCondition.wait(m_terminateLock);
+    waitForThreadCompletion(m_threadID, &returnValue);
+    ASSERT(m_queue.killed());
+    m_threadID = 0;
 }
 
 void LocalStorageThread::performTerminate()
 {
     ASSERT(!isMainThread());
-
     m_queue.kill();
-
-    MutexLocker locker(m_terminateLock);
-    m_terminateCondition.signal();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
index e9e2b58862..6f05911445 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
@@ -30,6 +30,7 @@
 
 #include <wtf/HashSet.h>
 #include <wtf/MessageQueue.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
 
@@ -39,34 +40,27 @@ namespace WebCore {
     class LocalStorageTask;
 
     // FIXME: Rename this class to StorageThread
-    class LocalStorageThread : public ThreadSafeShared<LocalStorageThread> {
+    class LocalStorageThread : public Noncopyable {
     public:
-        static PassRefPtr<LocalStorageThread> create();
+        static PassOwnPtr<LocalStorageThread> create();
+        ~LocalStorageThread();
 
         bool start();
-
-        void scheduleImport(StorageAreaSync*);
-        void scheduleSync(StorageAreaSync*);
-
-        // Called from the main thread to synchronously shut down this thread
         void terminate();
-        // Background thread part of the terminate procedure
+        void scheduleTask(PassOwnPtr<LocalStorageTask>);
+
+        // Background thread part of the terminate procedure.
         void performTerminate();
 
     private:
         LocalStorageThread();
 
-        static void* localStorageThreadStart(void*);
-        void* localStorageThread();
+        // Called on background thread.
+        static void* threadEntryPointCallback(void*);
+        void* threadEntryPoint();
 
-        Mutex m_threadCreationMutex;
         ThreadIdentifier m_threadID;
-        RefPtr<LocalStorageThread> m_selfRef;
-
-        MessageQueue<RefPtr<LocalStorageTask> > m_queue;
-
-        Mutex m_terminateLock;
-        ThreadCondition m_terminateCondition;
+        MessageQueue<LocalStorageTask> m_queue;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
index 30b32717ac..88f75b8b56 100644
--- a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
@@ -42,6 +42,18 @@ OriginQuotaManager::OriginQuotaManager()
 {
 }
 
+bool OriginQuotaManager::tryLock()
+{
+    bool locked = m_usageRecordGuard.tryLock();
+#ifndef NDEBUG
+    if (locked)
+        m_usageRecordGuardLocked = true;
+    else
+        ASSERT(m_usageRecordGuardLocked);
+#endif
+    return locked;
+}
+
 void OriginQuotaManager::lock()
 {
     m_usageRecordGuard.lock();
@@ -63,7 +75,7 @@ void OriginQuotaManager::trackOrigin(PassRefPtr<SecurityOrigin> origin)
     ASSERT(m_usageRecordGuardLocked);
     ASSERT(!m_usageMap.contains(origin.get()));
 
-    m_usageMap.set(origin, new OriginUsageRecord);
+    m_usageMap.set(origin->threadsafeCopy(), new OriginUsageRecord);
 }
 
 bool OriginQuotaManager::tracksOrigin(SecurityOrigin* origin) const
diff --git a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.h b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.h
index 2e3615d271..33c201af2b 100644
--- a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.h
+++ b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.h
@@ -45,6 +45,7 @@ class OriginQuotaManager : public Noncopyable {
 public:
     OriginQuotaManager();
 
+    bool tryLock();
     void lock();
     void unlock();
 
diff --git a/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.cpp b/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.cpp
index 684df530f2..8128a1bfa7 100644
--- a/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.cpp
@@ -42,8 +42,8 @@ OriginUsageRecord::OriginUsageRecord()
 void OriginUsageRecord::addDatabase(const String& identifier, const String& fullPath)
 {
     ASSERT(!m_databaseMap.contains(identifier));
-    ASSERT_ARG(identifier, identifier.impl()->refCount() == 1);
-    ASSERT_ARG(fullPath, fullPath.impl()->refCount() == 1);
+    ASSERT_ARG(identifier, identifier.impl()->hasOneRef());
+    ASSERT_ARG(fullPath, fullPath.impl()->hasOneRef());
 
     m_databaseMap.set(identifier, DatabaseEntry(fullPath));
     m_unknownSet.add(identifier);
@@ -63,7 +63,7 @@ void OriginUsageRecord::removeDatabase(const String& identifier)
 void OriginUsageRecord::markDatabase(const String& identifier)
 {
     ASSERT(m_databaseMap.contains(identifier));
-    ASSERT_ARG(identifier, identifier.impl()->refCount() == 1);
+    ASSERT_ARG(identifier, identifier.impl()->hasOneRef());
 
     m_unknownSet.add(identifier);
     m_cachedDiskUsageIsValid = false;
diff --git a/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.h b/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.h
index 609a793df4..25bddf2db2 100644
--- a/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.h
+++ b/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.h
@@ -40,7 +40,7 @@ namespace WebCore {
 
 // Objects of this class can be used from multiple threads with external synchronization.
 // String arguments are also supposed to be deeply copied by the caller when necessary.
-class OriginUsageRecord {
+class OriginUsageRecord : public Noncopyable {
 public:
     OriginUsageRecord();
 
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLError.idl b/src/3rdparty/webkit/WebCore/storage/SQLError.idl
index d889c5b8a2..503fe6f075 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLError.idl
+++ b/src/3rdparty/webkit/WebCore/storage/SQLError.idl
@@ -29,7 +29,8 @@
 module storage {
 
     interface [
-        Conditional=DATABASE
+        Conditional=DATABASE,
+        OmitConstructor
     ] SQLError {
         readonly attribute unsigned long code;
         readonly attribute DOMString message;
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLResultSet.idl b/src/3rdparty/webkit/WebCore/storage/SQLResultSet.idl
index 1db07cdc1a..c98fff6371 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLResultSet.idl
+++ b/src/3rdparty/webkit/WebCore/storage/SQLResultSet.idl
@@ -29,7 +29,8 @@
 module storage {
 
     interface [
-        Conditional=DATABASE
+        Conditional=DATABASE,
+        OmitConstructor
     ] SQLResultSet {
         readonly attribute SQLResultSetRowList rows;
 
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.idl b/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.idl
index 6a477e9071..7ae7a9c369 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.idl
+++ b/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.idl
@@ -29,7 +29,8 @@
 module storage {
 
     interface [
-        Conditional=DATABASE
+        Conditional=DATABASE,
+        OmitConstructor
     ] SQLResultSetRowList {
         readonly attribute unsigned long length;
         [Custom] DOMObject item(in unsigned long index);
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
index 165685b15e..a7c2558754 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
@@ -35,11 +35,12 @@
 #include "Database.h"
 #include "DatabaseAuthorizer.h"
 #include "DatabaseDetails.h"
-#include "Document.h"
+#include "DatabaseThread.h"
 #include "ExceptionCode.h"
 #include "Logging.h"
 #include "Page.h"
 #include "PlatformString.h"
+#include "ScriptExecutionContext.h"
 #include "Settings.h"
 #include "SQLError.h"
 #include "SQLiteTransaction.h"
@@ -83,6 +84,7 @@ SQLTransaction::SQLTransaction(Database* db, PassRefPtr<SQLTransactionCallback>
 
 SQLTransaction::~SQLTransaction()
 {
+    ASSERT(!m_sqliteTransaction);
 }
 
 void SQLTransaction::executeSQL(const String& sqlStatement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> callbackError, ExceptionCode& e)
@@ -94,8 +96,7 @@ void SQLTransaction::executeSQL(const String& sqlStatement, const Vector<SQLValu
 
     bool readOnlyMode = m_readOnly;
     if (!readOnlyMode) {
-        Page* page = m_database->document()->page();
-        if (!page || page->settings()->privateBrowsingEnabled())
+        if (m_database->scriptExecutionContext()->isDatabaseReadOnly())
             readOnlyMode = true;
     }
 
@@ -157,6 +158,10 @@ void SQLTransaction::checkAndHandleClosedDatabase()
     m_statementQueue.clear();
     m_nextStep = 0;
 
+    // The next steps should be executed only if we're on the DB thread.
+    if (currentThread() != database()->scriptExecutionContext()->databaseThread()->getThreadID())
+        return;
+
     // The current SQLite transaction should be stopped, as well
     if (m_sqliteTransaction) {
         m_sqliteTransaction->stop();
@@ -204,6 +209,16 @@ void SQLTransaction::performPendingCallback()
         (this->*m_nextStep)();
 }
 
+void SQLTransaction::notifyDatabaseThreadIsShuttingDown()
+{
+    ASSERT(currentThread() == database()->scriptExecutionContext()->databaseThread()->getThreadID());
+
+    // If the transaction is in progress, we should roll it back here, since this is our last
+    // oportunity to do something related to this transaction on the DB thread.
+    // Clearing m_sqliteTransaction invokes SQLiteTransaction's destructor which does just that.
+    m_sqliteTransaction.clear();
+}
+
 void SQLTransaction::acquireLock()
 {
     m_database->transactionCoordinator()->acquireLock(this);
@@ -302,7 +317,7 @@ void SQLTransaction::runStatements()
     // If there is a series of statements queued up that are all successful and have no associated
     // SQLStatementCallback objects, then we can burn through the queue
     do {
-        if (m_shouldRetryCurrentStatement) {
+        if (m_shouldRetryCurrentStatement && !m_sqliteTransaction->wasRolledBackBySqlite()) {
             m_shouldRetryCurrentStatement = false;
             // FIXME - Another place that needs fixing up after <rdar://problem/5628468> is addressed.
             // See ::openTransactionAndPreflight() for discussion
@@ -382,8 +397,8 @@ bool SQLTransaction::runCurrentStatement()
 void SQLTransaction::handleCurrentStatementError()
 {
     // Transaction Steps 6.error - Call the statement's error callback, but if there was no error callback,
-    // jump to the transaction error callback
-    if (m_currentStatement->hasStatementErrorCallback()) {
+    // or the transaction was rolled back, jump to the transaction error callback
+    if (m_currentStatement->hasStatementErrorCallback() && !m_sqliteTransaction->wasRolledBackBySqlite()) {
         m_nextStep = &SQLTransaction::deliverStatementCallback;
         LOG(StorageAPI, "Scheduling deliverStatementCallback for transaction %p\n", this);
         m_database->scheduleTransactionCallback(this);
@@ -492,6 +507,7 @@ void SQLTransaction::cleanupAfterSuccessCallback()
     // There is no next step
     LOG(StorageAPI, "Transaction %p is complete\n", this);
     ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
+    m_sqliteTransaction.clear();
     m_nextStep = 0;
 
     // Release the lock on this database
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.h b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.h
index 6d6a8d7b16..1b02d013be 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.h
@@ -80,6 +80,7 @@ public:
 
     Database* database() { return m_database.get(); }
     bool isReadOnly() { return m_readOnly; }
+    void notifyDatabaseThreadIsShuttingDown();
 
 private:
     SQLTransaction(Database*, PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>,
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.idl b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.idl
index 5d4885c9c9..7d694e8777 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.idl
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.idl
@@ -29,7 +29,8 @@
 module storage {
 
     interface [
-        Conditional=DATABASE
+        Conditional=DATABASE,
+        OmitConstructor
     ] SQLTransaction {
         [Custom] void executeSql(in DOMString sqlStatement, in ObjectArray arguments, in SQLStatementCallback callback, in SQLStatementErrorCallback errorCallback);
     };
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.cpp b/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.cpp
index 5918bd8ef0..6064c993c8 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.cpp
@@ -31,6 +31,9 @@
 #include "config.h"
 #include "SQLTransactionClient.h"
 
+#if ENABLE(DATABASE)
+
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "Database.h"
 #include "DatabaseThread.h"
@@ -44,7 +47,7 @@ namespace WebCore {
 
 void SQLTransactionClient::didCommitTransaction(SQLTransaction* transaction)
 {
-    ASSERT(currentThread() == transaction->database()->document()->databaseThread()->getThreadID());
+    ASSERT(currentThread() == transaction->database()->scriptExecutionContext()->databaseThread()->getThreadID());
     Database* database = transaction->database();
     DatabaseTracker::tracker().scheduleNotifyDatabaseChanged(
         database->securityOrigin(), database->stringIdentifier());
@@ -52,7 +55,7 @@ void SQLTransactionClient::didCommitTransaction(SQLTransaction* transaction)
 
 void SQLTransactionClient::didExecuteStatement(SQLTransaction* transaction)
 {
-    ASSERT(currentThread() == transaction->database()->document()->databaseThread()->getThreadID());
+    ASSERT(currentThread() == transaction->database()->scriptExecutionContext()->databaseThread()->getThreadID());
     OriginQuotaManager& manager(DatabaseTracker::tracker().originQuotaManager());
     Locker<OriginQuotaManager> locker(manager);
     manager.markDatabase(transaction->database());
@@ -60,15 +63,15 @@ void SQLTransactionClient::didExecuteStatement(SQLTransaction* transaction)
 
 bool SQLTransactionClient::didExceedQuota(SQLTransaction* transaction)
 {
-    ASSERT(isMainThread());
+    ASSERT(transaction->database()->scriptExecutionContext()->isContextThread());
     Database* database = transaction->database();
-    Page* page = database->document()->page();
-    ASSERT(page);
 
     unsigned long long currentQuota = DatabaseTracker::tracker().quotaForOrigin(database->securityOrigin());
-    page->chrome()->client()->exceededDatabaseQuota(database->document()->frame(), database->stringIdentifier());
+    database->scriptExecutionContext()->databaseExceededQuota(database->stringIdentifier());
     unsigned long long newQuota = DatabaseTracker::tracker().quotaForOrigin(database->securityOrigin());
     return (newQuota > currentQuota);
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.h b/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.h
index 941c1638aa..801647ba28 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.h
@@ -31,13 +31,17 @@
 #ifndef SQLTransactionClient_h
 #define SQLTransactionClient_h
 
+#if ENABLE(DATABASE)
+
+#include <wtf/Noncopyable.h>
+
 namespace WebCore {
 
     class SQLTransaction;
 
     // A client to the SQLTransaction class. Allows SQLTransaction to notify interested
     // parties that certain things have happened in a transaction.
-    class SQLTransactionClient {
+    class SQLTransactionClient : public Noncopyable {
     public:
         void didCommitTransaction(SQLTransaction*);
         void didExecuteStatement(SQLTransaction*);
@@ -45,4 +49,6 @@ namespace WebCore {
     };
 }
 
+#endif // ENABLE(DATABASE)
+
 #endif // SQLTransactionClient_h
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionCoordinator.cpp b/src/3rdparty/webkit/WebCore/storage/SQLTransactionCoordinator.cpp
index 30b0c4a895..0fe5bda9c3 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransactionCoordinator.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransactionCoordinator.cpp
@@ -31,6 +31,8 @@
 #include "config.h"
 #include "SQLTransactionCoordinator.h"
 
+#if ENABLE(DATABASE)
+
 #include "CString.h"
 #include "Database.h"
 #include "SQLTransaction.h"
@@ -107,8 +109,24 @@ void SQLTransactionCoordinator::releaseLock(SQLTransaction* transaction)
 
 void SQLTransactionCoordinator::shutdown()
 {
+    // Notify all transactions in progress that the database thread is shutting down
+    for (CoordinationInfoMap::iterator coordinationInfoIterator = m_coordinationInfoMap.begin();
+         coordinationInfoIterator != m_coordinationInfoMap.end(); ++coordinationInfoIterator) {
+        CoordinationInfo& info = coordinationInfoIterator->second;
+        if (info.activeWriteTransaction)
+            info.activeWriteTransaction->notifyDatabaseThreadIsShuttingDown();
+        for (HashSet<RefPtr<SQLTransaction> >::iterator activeReadTransactionsIterator =
+                     info.activeReadTransactions.begin();
+             activeReadTransactionsIterator != info.activeReadTransactions.end();
+             ++activeReadTransactionsIterator) {
+            (*activeReadTransactionsIterator)->notifyDatabaseThreadIsShuttingDown();
+        }
+    }
+
     // Clean up all pending transactions for all databases
     m_coordinationInfoMap.clear();
 }
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionCoordinator.h b/src/3rdparty/webkit/WebCore/storage/SQLTransactionCoordinator.h
index 20cc863881..a51084f211 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransactionCoordinator.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransactionCoordinator.h
@@ -31,6 +31,8 @@
 #ifndef SQLTransactionCoordinator_h
 #define SQLTransactionCoordinator_h
 
+#if ENABLE(DATABASE)
+
 #include "CString.h"
 #include "StringHash.h"
 #include <wtf/Deque.h>
@@ -42,7 +44,7 @@ namespace WebCore {
 
     class SQLTransaction;
 
-    class SQLTransactionCoordinator {
+    class SQLTransactionCoordinator : public Noncopyable {
     public:
         void acquireLock(SQLTransaction*);
         void releaseLock(SQLTransaction*);
@@ -62,4 +64,6 @@ namespace WebCore {
     };
 }
 
+#endif // ENABLE(DATABASE)
+
 #endif // SQLTransactionCoordinator_h
diff --git a/src/3rdparty/webkit/WebCore/storage/Storage.idl b/src/3rdparty/webkit/WebCore/storage/Storage.idl
index 7127efd205..ffd1af15bb 100644
--- a/src/3rdparty/webkit/WebCore/storage/Storage.idl
+++ b/src/3rdparty/webkit/WebCore/storage/Storage.idl
@@ -26,7 +26,6 @@
 module storage {
 
     interface [
-        GenerateConstructor,
         HasNameGetter,
         CustomDeleteProperty,
         CustomGetPropertyNames,
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageArea.h b/src/3rdparty/webkit/WebCore/storage/StorageArea.h
index a64d44a035..6081240dd9 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageArea.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageArea.h
@@ -50,9 +50,9 @@ namespace WebCore {
         virtual unsigned length() const = 0;
         virtual String key(unsigned index) const = 0;
         virtual String getItem(const String& key) const = 0;
-        virtual void setItem(const String& key, const String& value, ExceptionCode& ec, Frame* sourceFrame) = 0;
-        virtual void removeItem(const String& key, Frame* sourceFrame) = 0;
-        virtual void clear(Frame* sourceFrame) = 0;
+        virtual String setItem(const String& key, const String& value, ExceptionCode& ec, Frame* sourceFrame) = 0;
+        virtual String removeItem(const String& key, Frame* sourceFrame) = 0;
+        virtual bool clear(Frame* sourceFrame) = 0;
         virtual bool contains(const String& key) const = 0;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp
index 612cb5fde2..aa04781489 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp
@@ -30,6 +30,7 @@
 
 #include "ExceptionCode.h"
 #include "Frame.h"
+#include "Page.h"
 #include "Settings.h"
 #include "StorageAreaSync.h"
 #include "StorageEventDispatcher.h"
@@ -64,7 +65,7 @@ StorageAreaImpl::StorageAreaImpl(StorageType storageType, PassRefPtr<SecurityOri
     // FIXME: If there's no backing storage for LocalStorage, the default WebKit behavior should be that of private browsing,
     // not silently ignoring it.  https://bugs.webkit.org/show_bug.cgi?id=25894
     if (m_storageSyncManager) {
-        m_storageAreaSync = StorageAreaSync::create(m_storageSyncManager, this);
+        m_storageAreaSync = StorageAreaSync::create(m_storageSyncManager, this, m_securityOrigin->databaseIdentifier());
         ASSERT(m_storageAreaSync);
     }
 }
@@ -106,6 +107,8 @@ static bool privateBrowsingEnabled(Frame* frame)
 unsigned StorageAreaImpl::length() const
 {
     ASSERT(!m_isShutdown);
+    blockUntilImportComplete();
+
     return m_storageMap->length();
 }
 
@@ -113,6 +116,7 @@ String StorageAreaImpl::key(unsigned index) const
 {
     ASSERT(!m_isShutdown);
     blockUntilImportComplete();
+
     return m_storageMap->key(index);
 }
 
@@ -124,7 +128,7 @@ String StorageAreaImpl::getItem(const String& key) const
     return m_storageMap->getItem(key);
 }
 
-void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionCode& ec, Frame* frame)
+String StorageAreaImpl::setItem(const String& key, const String& value, ExceptionCode& ec, Frame* frame)
 {
     ASSERT(!m_isShutdown);
     ASSERT(!value.isNull());
@@ -132,57 +136,61 @@ void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionC
 
     if (privateBrowsingEnabled(frame)) {
         ec = QUOTA_EXCEEDED_ERR;
-        return;
+        return String();
     }
 
     String oldValue;
     bool quotaException;
     RefPtr<StorageMap> newMap = m_storageMap->setItem(key, value, oldValue, quotaException);
+    if (newMap)
+        m_storageMap = newMap.release();
 
     if (quotaException) {
         ec = QUOTA_EXCEEDED_ERR;
-        return;
+        return oldValue;
     }
 
-    if (newMap)
-        m_storageMap = newMap.release();
+    if (oldValue == value)
+        return oldValue;
 
-    // Only notify the client if an item was actually changed
-    if (oldValue != value) {
-        if (m_storageAreaSync)
-            m_storageAreaSync->scheduleItemForSync(key, value);
-        StorageEventDispatcher::dispatch(key, oldValue, value, m_storageType, m_securityOrigin.get(), frame);
-    }
+    if (m_storageAreaSync)
+        m_storageAreaSync->scheduleItemForSync(key, value);
+    StorageEventDispatcher::dispatch(key, oldValue, value, m_storageType, m_securityOrigin.get(), frame);
+    return oldValue;
 }
 
-void StorageAreaImpl::removeItem(const String& key, Frame* frame)
+String StorageAreaImpl::removeItem(const String& key, Frame* frame)
 {
     ASSERT(!m_isShutdown);
     blockUntilImportComplete();
 
     if (privateBrowsingEnabled(frame))
-        return;
+        return String();
 
     String oldValue;
     RefPtr<StorageMap> newMap = m_storageMap->removeItem(key, oldValue);
     if (newMap)
         m_storageMap = newMap.release();
 
-    // Only notify the client if an item was actually removed
-    if (!oldValue.isNull()) {
-        if (m_storageAreaSync)
-            m_storageAreaSync->scheduleItemForSync(key, String());
-        StorageEventDispatcher::dispatch(key, oldValue, String(), m_storageType, m_securityOrigin.get(), frame);
-    }
+    if (oldValue.isNull())
+        return oldValue;
+
+    if (m_storageAreaSync)
+        m_storageAreaSync->scheduleItemForSync(key, String());
+    StorageEventDispatcher::dispatch(key, oldValue, String(), m_storageType, m_securityOrigin.get(), frame);
+    return oldValue;
 }
 
-void StorageAreaImpl::clear(Frame* frame)
+bool StorageAreaImpl::clear(Frame* frame)
 {
     ASSERT(!m_isShutdown);
     blockUntilImportComplete();
 
     if (privateBrowsingEnabled(frame))
-        return;
+        return false;
+
+    if (!m_storageMap->length())
+        return false;
 
     unsigned quota = m_storageMap->quota();
     m_storageMap = StorageMap::create(quota);
@@ -190,6 +198,7 @@ void StorageAreaImpl::clear(Frame* frame)
     if (m_storageAreaSync)
         m_storageAreaSync->scheduleClear();
     StorageEventDispatcher::dispatch(String(), String(), String(), m_storageType, m_securityOrigin.get(), frame);
+    return true;
 }
 
 bool StorageAreaImpl::contains(const String& key) const
@@ -206,11 +215,6 @@ void StorageAreaImpl::importItem(const String& key, const String& value)
     m_storageMap->importItem(key, value);
 }
 
-SecurityOrigin* StorageAreaImpl::securityOrigin()
-{
-    return m_securityOrigin.get();
-}
-
 void StorageAreaImpl::close()
 {
     if (m_storageAreaSync)
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h
index fe21a45906..60d72cbd9f 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h
@@ -48,17 +48,16 @@ namespace WebCore {
         virtual unsigned length() const;
         virtual String key(unsigned index) const;
         virtual String getItem(const String& key) const;
-        virtual void setItem(const String& key, const String& value, ExceptionCode& ec, Frame* sourceFrame);
-        virtual void removeItem(const String& key, Frame* sourceFrame);
-        virtual void clear(Frame* sourceFrame);
+        virtual String setItem(const String& key, const String& value, ExceptionCode& ec, Frame* sourceFrame);
+        virtual String removeItem(const String& key, Frame* sourceFrame);
+        virtual bool clear(Frame* sourceFrame);
         virtual bool contains(const String& key) const;
 
         PassRefPtr<StorageAreaImpl> copy();
         void close();
 
-        // Could be called from a background thread.
+        // Only called from a background thread.
         void importItem(const String& key, const String& value);
-        SecurityOrigin* securityOrigin();
 
     private:
         StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>, unsigned quota);
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
index ad41e2860b..3434c1ff2d 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
@@ -31,6 +31,7 @@
 #include "CString.h"
 #include "EventNames.h"
 #include "HTMLElement.h"
+#include "SecurityOrigin.h"
 #include "SQLiteStatement.h"
 #include "StorageAreaImpl.h"
 #include "StorageSyncManager.h"
@@ -42,19 +43,25 @@ namespace WebCore {
 // Instead, queue up a batch of items to sync and actually do the sync at the following interval.
 static const double StorageSyncInterval = 1.0;
 
-PassRefPtr<StorageAreaSync> StorageAreaSync::create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea)
+// A sane limit on how many items we'll schedule to sync all at once.  This makes it
+// much harder to starve the rest of LocalStorage and the OS's IO subsystem in general.
+static const int MaxiumItemsToSync = 100;
+
+PassRefPtr<StorageAreaSync> StorageAreaSync::create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea, String databaseIdentifier)
 {
-    return adoptRef(new StorageAreaSync(storageSyncManager, storageArea));
+    return adoptRef(new StorageAreaSync(storageSyncManager, storageArea, databaseIdentifier));
 }
 
-StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea)
+StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea, String databaseIdentifier)
     : m_syncTimer(this, &StorageAreaSync::syncTimerFired)
     , m_itemsCleared(false)
     , m_finalSyncScheduled(false)
     , m_storageArea(storageArea)
     , m_syncManager(storageSyncManager)
+    , m_databaseIdentifier(databaseIdentifier.crossThreadString())
     , m_clearItemsWhileSyncing(false)
     , m_syncScheduled(false)
+    , m_syncInProgress(false)
     , m_importComplete(false)
 {
     ASSERT(isMainThread());
@@ -71,6 +78,7 @@ StorageAreaSync::~StorageAreaSync()
 {
     ASSERT(isMainThread());
     ASSERT(!m_syncTimer.isActive());
+    ASSERT(m_finalSyncScheduled);
 }
 
 void StorageAreaSync::scheduleFinalSync()
@@ -78,6 +86,7 @@ void StorageAreaSync::scheduleFinalSync()
     ASSERT(isMainThread());
     // FIXME: We do this to avoid races, but it'd be better to make things safe without blocking.
     blockUntilImportComplete();
+    m_storageArea = 0;  // This is done in blockUntilImportComplete() but this is here as a form of documentation that we must be absolutely sure the ref count cycle is broken.
 
     if (m_syncTimer.isActive())
         m_syncTimer.stop();
@@ -88,8 +97,8 @@ void StorageAreaSync::scheduleFinalSync()
     }
     // FIXME: This is synchronous.  We should do it on the background process, but
     // we should do it safely.
-    syncTimerFired(&m_syncTimer);
     m_finalSyncScheduled = true;
+    syncTimerFired(&m_syncTimer);
 }
 
 void StorageAreaSync::scheduleItemForSync(const String& key, const String& value)
@@ -127,20 +136,43 @@ void StorageAreaSync::syncTimerFired(Timer<StorageAreaSync>*)
 {
     ASSERT(isMainThread());
 
-    HashMap<String, String>::iterator it = m_changedItems.begin();
-    HashMap<String, String>::iterator end = m_changedItems.end();
-
+    bool partialSync = false;
     {
         MutexLocker locker(m_syncLock);
 
+        // Do not schedule another sync if we're still trying to complete the
+        // previous one.  But, if we're shutting down, schedule it anyway.
+        if (m_syncInProgress && !m_finalSyncScheduled) {
+            ASSERT(!m_syncTimer.isActive());
+            m_syncTimer.startOneShot(StorageSyncInterval);
+            return;
+        }
+
         if (m_itemsCleared) {
             m_itemsPendingSync.clear();
             m_clearItemsWhileSyncing = true;
             m_itemsCleared = false;
         }
 
-        for (; it != end; ++it)
-            m_itemsPendingSync.set(it->first.crossThreadString(), it->second.crossThreadString());
+        HashMap<String, String>::iterator changed_it = m_changedItems.begin();
+        HashMap<String, String>::iterator changed_end = m_changedItems.end();
+        for (int count = 0; changed_it != changed_end; ++count, ++changed_it) {
+            if (count >= MaxiumItemsToSync && !m_finalSyncScheduled) {
+                partialSync = true;
+                break;
+            }
+            m_itemsPendingSync.set(changed_it->first.crossThreadString(), changed_it->second.crossThreadString());
+        }
+
+        if (partialSync) {
+            // We can't do the fast path of simply clearing all items, so we'll need to manually
+            // remove them one by one.  Done under lock since m_itemsPendingSync is modified by
+            // the background thread.
+            HashMap<String, String>::iterator pending_it = m_itemsPendingSync.begin();
+            HashMap<String, String>::iterator pending_end = m_itemsPendingSync.end();
+            for (; pending_it != pending_end; ++pending_it)
+                m_changedItems.remove(pending_it->first);
+        }
 
         if (!m_syncScheduled) {
             m_syncScheduled = true;
@@ -153,11 +185,17 @@ void StorageAreaSync::syncTimerFired(Timer<StorageAreaSync>*)
         }
     }
 
-    // The following is balanced by the calls to disableSuddenTermination in the
-    // scheduleItemForSync, scheduleClear, and scheduleFinalSync functions.
-    enableSuddenTermination();
+    if (partialSync) {
+        // If we didn't finish syncing, then we need to finish the job later.
+        ASSERT(!m_syncTimer.isActive());
+        m_syncTimer.startOneShot(StorageSyncInterval);
+    } else {
+        // The following is balanced by the calls to disableSuddenTermination in the
+        // scheduleItemForSync, scheduleClear, and scheduleFinalSync functions.
+        enableSuddenTermination();
 
-    m_changedItems.clear();
+        m_changedItems.clear();
+    }
 }
 
 void StorageAreaSync::performImport()
@@ -165,7 +203,7 @@ void StorageAreaSync::performImport()
     ASSERT(!isMainThread());
     ASSERT(!m_database.isOpen());
 
-    String databaseFilename = m_syncManager->fullDatabaseFilename(m_storageArea->securityOrigin());
+    String databaseFilename = m_syncManager->fullDatabaseFilename(m_databaseIdentifier);
 
     if (databaseFilename.isEmpty()) {
         LOG_ERROR("Filename for local storage database is empty - cannot open for persistent storage");
@@ -206,27 +244,18 @@ void StorageAreaSync::performImport()
         return;
     }
 
-    MutexLocker locker(m_importLock);
-
     HashMap<String, String>::iterator it = itemMap.begin();
     HashMap<String, String>::iterator end = itemMap.end();
 
     for (; it != end; ++it)
         m_storageArea->importItem(it->first, it->second);
 
-    // Break the (ref count) cycle.
-    m_storageArea = 0;
-    m_importComplete = true;
-    m_importCondition.signal();
+    markImported();
 }
 
 void StorageAreaSync::markImported()
 {
-    ASSERT(!isMainThread());
-
     MutexLocker locker(m_importLock);
-    // Break the (ref count) cycle.
-    m_storageArea = 0;
     m_importComplete = true;
     m_importCondition.signal();
 }
@@ -238,19 +267,18 @@ void StorageAreaSync::markImported()
 // item currently in the map. Get/remove can work whether or not it's in the map, but we'll need a list
 // of items the import should not overwrite. Clear can also work, but it'll need to kill the import
 // job first.
-void StorageAreaSync::blockUntilImportComplete() const
+void StorageAreaSync::blockUntilImportComplete()
 {
     ASSERT(isMainThread());
 
-    // Fast path to avoid locking.
-    if (m_importComplete)
+    // Fast path.  We set m_storageArea to 0 only after m_importComplete being true.
+    if (!m_storageArea)
         return;
 
     MutexLocker locker(m_importLock);
     while (!m_importComplete)
         m_importCondition.wait(m_importLock);
-    ASSERT(m_importComplete);
-    ASSERT(!m_storageArea);
+    m_storageArea = 0;
 }
 
 void StorageAreaSync::sync(bool clearItems, const HashMap<String, String>& items)
@@ -325,10 +353,16 @@ void StorageAreaSync::performSync()
 
         m_clearItemsWhileSyncing = false;
         m_syncScheduled = false;
+        m_syncInProgress = true;
     }
 
     sync(clearItems, items);
 
+    {
+        MutexLocker locker(m_syncLock);
+        m_syncInProgress = false;
+    }
+
     // The following is balanced by the call to disableSuddenTermination in the
     // syncTimerFired function.
     enableSuddenTermination();
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.h b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.h
index 9d6436f32b..0e467630eb 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.h
@@ -42,17 +42,17 @@ namespace WebCore {
 
     class StorageAreaSync : public RefCounted<StorageAreaSync> {
     public:
-        static PassRefPtr<StorageAreaSync> create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea);
+        static PassRefPtr<StorageAreaSync> create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea, String databaseIdentifier);
         ~StorageAreaSync();
 
         void scheduleFinalSync();
-        void blockUntilImportComplete() const;
+        void blockUntilImportComplete();
 
         void scheduleItemForSync(const String& key, const String& value);
         void scheduleClear();
 
     private:
-        StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea);
+        StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea, String databaseIdentifier);
 
         void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
 
@@ -78,10 +78,13 @@ namespace WebCore {
         void syncTimerFired(Timer<StorageAreaSync>*);
         void sync(bool clearItems, const HashMap<String, String>& items);
 
+        const String m_databaseIdentifier;
+
         Mutex m_syncLock;
         HashMap<String, String> m_itemsPendingSync;
         bool m_clearItemsWhileSyncing;
         bool m_syncScheduled;
+        bool m_syncInProgress;
 
         mutable Mutex m_importLock;
         mutable ThreadCondition m_importCondition;
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp b/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp
index 13ccfe98aa..126aca0bff 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp
@@ -47,7 +47,7 @@ PassRefPtr<StorageEvent> StorageEvent::create(const AtomicString& type, const St
 }
 
 StorageEvent::StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea)
-    : Event(type, false, true)
+    : Event(type, false, false)
     , m_key(key)
     , m_oldValue(oldValue)
     , m_newValue(newValue)
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl b/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl
index 7c875618d2..3e77edac21 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl
@@ -26,10 +26,9 @@
 module storage {
 
     interface [
-        GenerateConstructor,
         Conditional=DOM_STORAGE
     ] StorageEvent : Event {
-        readonly attribute DOMString key;
+        readonly attribute [ConvertNullStringTo=Null] DOMString key;
         readonly attribute [ConvertNullStringTo=Null] DOMString oldValue;
         readonly attribute [ConvertNullStringTo=Null] DOMString newValue;
         readonly attribute DOMString uri;
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEventDispatcher.cpp b/src/3rdparty/webkit/WebCore/storage/StorageEventDispatcher.cpp
index 9763e076cd..2118a8323b 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageEventDispatcher.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEventDispatcher.cpp
@@ -50,25 +50,29 @@ void StorageEventDispatcher::dispatch(const String& key, const String& oldValue,
     if (storageType == SessionStorage) {
         // Send events only to our page.
         for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-            if (frame->document()->securityOrigin()->equal(securityOrigin))
+            if (sourceFrame != frame && frame->document()->securityOrigin()->equal(securityOrigin))
                 frames.append(frame);
         }
 
         for (unsigned i = 0; i < frames.size(); ++i)
-            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), frames[i]->domWindow()->sessionStorage()));
+            frames[i]->document()->enqueueEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), frames[i]->domWindow()->sessionStorage()));
     } else {
         // Send events to every page.
         const HashSet<Page*>& pages = page->group().pages();
         HashSet<Page*>::const_iterator end = pages.end();
         for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
             for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-                if (frame->document()->securityOrigin()->equal(securityOrigin))
+                if (sourceFrame != frame && frame->document()->securityOrigin()->equal(securityOrigin))
                     frames.append(frame);
             }
         }
 
-        for (unsigned i = 0; i < frames.size(); ++i)
-            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), frames[i]->domWindow()->localStorage()));
+        for (unsigned i = 0; i < frames.size(); ++i) {
+            ExceptionCode ec = 0;
+            Storage* storage = frames[i]->domWindow()->localStorage(ec);
+            if (!ec)
+                frames[i]->document()->enqueueEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), storage));
+        }
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp b/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp
index 5498d9ee45..790fde25a5 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp
@@ -47,6 +47,7 @@ PassRefPtr<StorageMap> StorageMap::copy()
 {
     RefPtr<StorageMap> newMap = create(m_quotaSize);
     newMap->m_map = m_map;
+    newMap->m_currentLength = m_currentLength;
     return newMap.release();
 }
 
@@ -111,12 +112,21 @@ PassRefPtr<StorageMap> StorageMap::setItem(const String& key, const String& valu
         return newStorageMap.release();
     }
 
-    // Quota tracking.  If the quota is enabled and this would go over it, bail.
+    // Quota tracking.  This is done in a couple of steps to keep the overflow tracking simple.
+    unsigned newLength = m_currentLength;
+    bool overflow = newLength + value.length() < newLength;
+    newLength += value.length();
+
     oldValue = m_map.get(key);
-    unsigned newLength = m_currentLength + value.length() - oldValue.length();
+    overflow |= newLength - oldValue.length() > newLength;
+    newLength -= oldValue.length();
+
+    unsigned adjustedKeyLength = oldValue.isNull() ? key.length() : 0;
+    overflow |= newLength + adjustedKeyLength < newLength;
+    newLength += adjustedKeyLength;
+
+    ASSERT(!overflow);  // Overflow is bad...even if quotas are off.
     bool overQuota = newLength > m_quotaSize / sizeof(UChar);
-    bool overflow = (newLength > m_currentLength) != (value.length() > oldValue.length());
-    ASSERT(!overflow);  // If we're debugging, make a fuss.  But it's still worth checking this in the following if statement.
     if (m_quotaSize != noQuota && (overflow || overQuota)) {
         quotaException = true;
         return 0;
@@ -143,10 +153,11 @@ PassRefPtr<StorageMap> StorageMap::removeItem(const String& key, String& oldValu
     }
 
     oldValue = m_map.take(key);
-    if (!oldValue.isNull())
+    if (!oldValue.isNull()) {
         invalidateIterator();
-
-    // Update quota.
+        ASSERT(m_currentLength - key.length() <= m_currentLength);
+        m_currentLength -= key.length();
+    }
     ASSERT(m_currentLength - oldValue.length() <= m_currentLength);
     m_currentLength -= oldValue.length();
 
@@ -162,12 +173,11 @@ void StorageMap::importItem(const String& key, const String& value)
 {
     // Be sure to copy the keys/values as items imported on a background thread are destined
     // to cross a thread boundary
-    pair<HashMap<String, String>::iterator, bool> result = m_map.add(key.threadsafeCopy(), String());
-
-    if (result.second)
-        result.first->second = value.threadsafeCopy();
+    pair<HashMap<String, String>::iterator, bool> result = m_map.add(key.threadsafeCopy(), value.threadsafeCopy());
+    ASSERT(result.second);  // True if the key didn't exist previously.
 
-    // Update quota.
+    ASSERT(m_currentLength + key.length() >= m_currentLength);
+    m_currentLength += key.length();
     ASSERT(m_currentLength + value.length() >= m_currentLength);
     m_currentLength += value.length();
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp
index 6b8caebc00..b54ba16324 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp
@@ -41,7 +41,8 @@ PassRefPtr<StorageNamespace> StorageNamespace::localStorageNamespace(const Strin
     return StorageNamespaceImpl::localStorageNamespace(path, quota);
 }
 
-PassRefPtr<StorageNamespace> StorageNamespace::sessionStorageNamespace()
+// The page argument is only used by the Chromium port.
+PassRefPtr<StorageNamespace> StorageNamespace::sessionStorageNamespace(Page*)
 {
     return StorageNamespaceImpl::sessionStorageNamespace();
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
index 0ac5f8628f..e84e5a6068 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
@@ -35,21 +35,22 @@
 
 namespace WebCore {
 
-    class SecurityOrigin;
-    class StorageArea;
-
-    // This interface is required for Chromium since these actions need to be proxied between processes.
-    class StorageNamespace : public RefCounted<StorageNamespace> {
-    public:
-        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path, unsigned quota);
-        static PassRefPtr<StorageNamespace> sessionStorageNamespace();
-
-        virtual ~StorageNamespace() { }
-        virtual PassRefPtr<StorageArea> storageArea(PassRefPtr<SecurityOrigin>) = 0;
-        virtual PassRefPtr<StorageNamespace> copy() = 0;
-        virtual void close() = 0;
-        virtual void unlock() = 0;
-    };
+class Page;
+class SecurityOrigin;
+class StorageArea;
+
+// This interface is required for Chromium since these actions need to be proxied between processes.
+class StorageNamespace : public RefCounted<StorageNamespace> {
+public:
+    static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path, unsigned quota);
+    static PassRefPtr<StorageNamespace> sessionStorageNamespace(Page*);
+
+    virtual ~StorageNamespace() { }
+    virtual PassRefPtr<StorageArea> storageArea(PassRefPtr<SecurityOrigin>) = 0;
+    virtual PassRefPtr<StorageNamespace> copy() = 0;
+    virtual void close() = 0;
+    virtual void unlock() = 0;
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
index f9276ddae6..d9641b7578 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
@@ -48,28 +48,29 @@ PassRefPtr<StorageSyncManager> StorageSyncManager::create(const String& path)
 }
 
 StorageSyncManager::StorageSyncManager(const String& path)
-    : m_path(path.crossThreadString())
+    : m_thread(LocalStorageThread::create())
+    , m_path(path.crossThreadString())
 {
     ASSERT(isMainThread());
     ASSERT(!m_path.isEmpty());
-    m_thread = LocalStorageThread::create();
     m_thread->start();
 }
 
 StorageSyncManager::~StorageSyncManager()
 {
     ASSERT(isMainThread());
+    ASSERT(!m_thread);
 }
 
-String StorageSyncManager::fullDatabaseFilename(SecurityOrigin* origin)
+// Called on a background thread.
+String StorageSyncManager::fullDatabaseFilename(const String& databaseIdentifier)
 {
-    ASSERT(origin);
     if (!makeAllDirectories(m_path)) {
         LOG_ERROR("Unabled to create LocalStorage database path %s", m_path.utf8().data());
         return String();
     }
 
-    return pathByAppendingComponent(m_path, origin->databaseIdentifier() + ".localstorage");
+    return pathByAppendingComponent(m_path, databaseIdentifier + ".localstorage");
 }
 
 void StorageSyncManager::close()
@@ -85,19 +86,18 @@ void StorageSyncManager::close()
 bool StorageSyncManager::scheduleImport(PassRefPtr<StorageAreaSync> area)
 {
     ASSERT(isMainThread());
-
+    ASSERT(m_thread);
     if (m_thread)
-        m_thread->scheduleImport(area.get());
-
+        m_thread->scheduleTask(LocalStorageTask::createImport(area.get()));
     return m_thread;
 }
 
 void StorageSyncManager::scheduleSync(PassRefPtr<StorageAreaSync> area)
 {
     ASSERT(isMainThread());
-
+    ASSERT(m_thread);
     if (m_thread)
-        m_thread->scheduleSync(area.get());
+        m_thread->scheduleTask(LocalStorageTask::createSync(area.get()));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
index fe35e3daaa..e2dfa76ad1 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
@@ -32,7 +32,7 @@
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
-#include <wtf/RefPtr.h>
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
@@ -53,12 +53,12 @@ namespace WebCore {
     private:
         StorageSyncManager(const String& path);
 
-        RefPtr<LocalStorageThread> m_thread;
+        OwnPtr<LocalStorageThread> m_thread;
 
     // The following members are subject to thread synchronization issues
     public:
         // To be called from the background thread:
-        String fullDatabaseFilename(SecurityOrigin*);
+        String fullDatabaseFilename(const String& databaseIdentifier);
 
     private:
         String m_path;
diff --git a/src/3rdparty/webkit/WebCore/svg/ElementTimeControl.idl b/src/3rdparty/webkit/WebCore/svg/ElementTimeControl.idl
index e8ca61510e..4ac01c4ca9 100644
--- a/src/3rdparty/webkit/WebCore/svg/ElementTimeControl.idl
+++ b/src/3rdparty/webkit/WebCore/svg/ElementTimeControl.idl
@@ -26,7 +26,7 @@
  
 module svg {
 
-    interface [Conditional=SVG, ObjCProtocol] ElementTimeControl { 
+    interface [Conditional=SVG, ObjCProtocol, OmitConstructor] ElementTimeControl { 
         void beginElement();
         void beginElementAt(in float offset);
         void endElement();
diff --git a/src/3rdparty/webkit/WebCore/svg/GradientAttributes.h b/src/3rdparty/webkit/WebCore/svg/GradientAttributes.h
index 6b3408ecf8..ba513b8f65 100644
--- a/src/3rdparty/webkit/WebCore/svg/GradientAttributes.h
+++ b/src/3rdparty/webkit/WebCore/svg/GradientAttributes.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -38,12 +36,12 @@ namespace WebCore {
 
         GradientSpreadMethod spreadMethod() const { return m_spreadMethod; }
         bool boundingBoxMode() const { return m_boundingBoxMode; }
-        TransformationMatrix gradientTransform() const { return m_gradientTransform; }
+        AffineTransform gradientTransform() const { return m_gradientTransform; }
         const Vector<SVGGradientStop>& stops() const { return m_stops; }
 
         void setSpreadMethod(GradientSpreadMethod value) { m_spreadMethod = value; m_spreadMethodSet = true; }
         void setBoundingBoxMode(bool value) { m_boundingBoxMode = value; m_boundingBoxModeSet = true; }
-        void setGradientTransform(const TransformationMatrix& value) { m_gradientTransform = value; m_gradientTransformSet = true; }
+        void setGradientTransform(const AffineTransform& value) { m_gradientTransform = value; m_gradientTransformSet = true; }
         void setStops(const Vector<SVGGradientStop>& value) { m_stops = value; m_stopsSet = true; } 
 
         bool hasSpreadMethod() const { return m_spreadMethodSet; }
@@ -55,7 +53,7 @@ namespace WebCore {
         // Properties
         GradientSpreadMethod m_spreadMethod;
         bool m_boundingBoxMode;
-        TransformationMatrix m_gradientTransform;
+        AffineTransform m_gradientTransform;
         Vector<SVGGradientStop> m_stops;
 
         // Property states
diff --git a/src/3rdparty/webkit/WebCore/svg/LinearGradientAttributes.h b/src/3rdparty/webkit/WebCore/svg/LinearGradientAttributes.h
index 0aefbac891..b71dc221a0 100644
--- a/src/3rdparty/webkit/WebCore/svg/LinearGradientAttributes.h
+++ b/src/3rdparty/webkit/WebCore/svg/LinearGradientAttributes.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/PatternAttributes.h b/src/3rdparty/webkit/WebCore/svg/PatternAttributes.h
index b43d87e0d5..2d25763b2d 100644
--- a/src/3rdparty/webkit/WebCore/svg/PatternAttributes.h
+++ b/src/3rdparty/webkit/WebCore/svg/PatternAttributes.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -51,7 +49,7 @@ namespace WebCore {
         SVGLength height() const { return m_height; }
         bool boundingBoxMode() const { return m_boundingBoxMode; }
         bool boundingBoxModeContent() const { return m_boundingBoxModeContent; }
-        TransformationMatrix patternTransform() const { return m_patternTransform; }
+        AffineTransform patternTransform() const { return m_patternTransform; }
         const SVGPatternElement* patternContentElement() const { return m_patternContentElement; }
 
         void setX(const SVGLength& value) { m_x = value; m_xSet = true; }
@@ -60,7 +58,7 @@ namespace WebCore {
         void setHeight(const SVGLength& value) { m_height = value; m_heightSet = true; }
         void setBoundingBoxMode(bool value) { m_boundingBoxMode = value; m_boundingBoxModeSet = true; }
         void setBoundingBoxModeContent(bool value) { m_boundingBoxModeContent = value; m_boundingBoxModeContentSet = true; }
-        void setPatternTransform(const TransformationMatrix& value) { m_patternTransform = value; m_patternTransformSet = true; }
+        void setPatternTransform(const AffineTransform& value) { m_patternTransform = value; m_patternTransformSet = true; }
         void setPatternContentElement(const SVGPatternElement* value) { m_patternContentElement = value; m_patternContentElementSet = true; }
 
         bool hasX() const { return m_xSet; }
@@ -80,7 +78,7 @@ namespace WebCore {
         SVGLength m_height;
         bool m_boundingBoxMode;
         bool m_boundingBoxModeContent;
-        TransformationMatrix m_patternTransform;
+        AffineTransform m_patternTransform;
         const SVGPatternElement* m_patternContentElement;
 
         // Property states
diff --git a/src/3rdparty/webkit/WebCore/svg/RadialGradientAttributes.h b/src/3rdparty/webkit/WebCore/svg/RadialGradientAttributes.h
index 76457215a6..76a78ec046 100644
--- a/src/3rdparty/webkit/WebCore/svg/RadialGradientAttributes.h
+++ b/src/3rdparty/webkit/WebCore/svg/RadialGradientAttributes.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp
index 7cb7b3e917..b344a4e26a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp
@@ -3,8 +3,6 @@
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
                   2007 Eric Seidel <eric@webkit.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -53,9 +51,6 @@ SVGAElement::SVGAElement(const QualifiedName& tagName, Document *doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
-    , m_target(this, SVGNames::targetAttr)
-    , m_href(this, XLinkNames::hrefAttr)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -100,6 +95,25 @@ void SVGAElement::svgAttributeChanged(const QualifiedName& attrName)
     }
 }
 
+void SVGAElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledTransformableElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeTarget();
+        synchronizeHref();
+        synchronizeExternalResourcesRequired();
+        return;
+    }
+
+    if (attrName == SVGNames::targetAttr)
+        synchronizeTarget();
+    else if (SVGURIReference::isKnownAttribute(attrName))
+        synchronizeHref();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+}
+
 RenderObject* SVGAElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     if (static_cast<SVGElement*>(parent())->isTextContent())
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAElement.h b/src/3rdparty/webkit/WebCore/svg/SVGAElement.h
index a3e59c5785..36046d3279 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAElement.h
@@ -46,6 +46,7 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
@@ -59,15 +60,13 @@ namespace WebCore {
         virtual bool childShouldCreateRenderer(Node*) const;
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGNames::aTagString, SVGNames::targetAttrString, String, Target, target)
+        DECLARE_ANIMATED_PROPERTY(SVGAElement, SVGNames::targetAttr, String, Target, target)
 
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+        DECLARE_ANIMATED_PROPERTY(SVGAElement, XLinkNames::hrefAttr, String, Href, href)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGAElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp
index 66062439ae..067adf2749 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp
@@ -30,11 +30,11 @@
 #include "SVGAltGlyphElement.cpp"
 #include "SVGAngle.cpp"
 #include "SVGAnimateColorElement.cpp"
+#include "SVGAnimatedPathData.cpp"
+#include "SVGAnimatedPoints.cpp"
 #include "SVGAnimateElement.cpp"
 #include "SVGAnimateMotionElement.cpp"
 #include "SVGAnimateTransformElement.cpp"
-#include "SVGAnimatedPathData.cpp"
-#include "SVGAnimatedPoints.cpp"
 #include "SVGAnimationElement.cpp"
 #include "SVGCircleElement.cpp"
 #include "SVGClipPathElement.cpp"
@@ -80,13 +80,16 @@
 #include "SVGFont.cpp"
 #include "SVGFontData.cpp"
 #include "SVGFontElement.cpp"
+#include "SVGFontFaceElement.cpp"
 #include "SVGFontFaceFormatElement.cpp"
 #include "SVGFontFaceNameElement.cpp"
 #include "SVGFontFaceSrcElement.cpp"
 #include "SVGFontFaceUriElement.cpp"
 #include "SVGForeignObjectElement.cpp"
 #include "SVGGElement.cpp"
+#include "SVGGlyphElement.cpp"
 #include "SVGGradientElement.cpp"
+#include "SVGHKernElement.cpp"
 #include "SVGImageElement.cpp"
 #include "SVGImageLoader.cpp"
 #include "SVGLangSpace.cpp"
@@ -97,6 +100,7 @@
 #include "SVGLocatable.cpp"
 #include "SVGMPathElement.cpp"
 #include "SVGMarkerElement.cpp"
+#include "SVGMaskElement.cpp"
 #include "SVGMetadataElement.cpp"
 #include "SVGMissingGlyphElement.cpp"
 #include "SVGNumberList.cpp"
@@ -128,6 +132,8 @@
 #include "SVGStopElement.cpp"
 #include "SVGStringList.cpp"
 #include "SVGStylable.cpp"
+#include "SVGStyleElement.cpp"
+#include "SVGStyledElement.cpp"
 #include "SVGStyledLocatableElement.cpp"
 #include "SVGStyledTransformableElement.cpp"
 #include "SVGSwitchElement.cpp"
@@ -141,13 +147,12 @@
 #include "SVGTextPositioningElement.cpp"
 #include "SVGTitleElement.cpp"
 #include "SVGTransform.cpp"
+#include "SVGTransformable.cpp"
 #include "SVGTransformDistance.cpp"
 #include "SVGTransformList.cpp"
-#include "SVGTransformable.cpp"
 #include "SVGURIReference.cpp"
 #include "SVGUseElement.cpp"
 #include "SVGViewElement.cpp"
 #include "SVGViewSpec.cpp"
 #include "SVGZoomAndPan.cpp"
 #include "SVGZoomEvent.cpp"
-#include "SynchronizablePropertyController.cpp"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.cpp
index f13edf582d..8371867b4b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.cpp
@@ -35,7 +35,6 @@ namespace WebCore {
 
 SVGAltGlyphElement::SVGAltGlyphElement(const QualifiedName& tagName, Document* doc)
     : SVGTextPositioningElement(tagName, doc)
-    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
@@ -43,6 +42,14 @@ SVGAltGlyphElement::~SVGAltGlyphElement()
 {
 }
 
+void SVGAltGlyphElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGTextPositioningElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName() || SVGURIReference::isKnownAttribute(attrName))
+        synchronizeHref();
+}
+
 void SVGAltGlyphElement::setGlyphRef(const AtomicString&, ExceptionCode& ec)
 {
     ec = NO_MODIFICATION_ALLOWED_ERR;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.h b/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.h
index b5718808d2..a28bbadcc8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.h
@@ -36,7 +36,9 @@ namespace WebCore {
     public:
         SVGAltGlyphElement(const QualifiedName&, Document*);
         virtual ~SVGAltGlyphElement();
-                
+
+        virtual void synchronizeProperty(const QualifiedName&);
+
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
         bool childShouldCreateRenderer(Node*) const;
 
@@ -49,7 +51,7 @@ namespace WebCore {
 
     private:    
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGAltGlyphElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+        DECLARE_ANIMATED_PROPERTY(SVGAltGlyphElement, XLinkNames::hrefAttr, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAngle.h b/src/3rdparty/webkit/WebCore/svg/SVGAngle.h
index 13b9fd4e3c..3d0bdeb5cc 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAngle.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAngle.h
@@ -27,16 +27,11 @@
 
 namespace WebCore {
 
-    class SVGStyledElement;
-
-    class SVGAngle : public RefCounted<SVGAngle> {
+    class SVGAngle {
     public:
-        static PassRefPtr<SVGAngle> create()
-        {
-            return adoptRef(new SVGAngle);
-        }
+        SVGAngle();
         virtual ~SVGAngle();
-        
+
         enum SVGAngleType {
             SVG_ANGLETYPE_UNKNOWN           = 0,
             SVG_ANGLETYPE_UNSPECIFIED       = 1,
@@ -59,12 +54,7 @@ namespace WebCore {
         void newValueSpecifiedUnits(unsigned short unitType, float valueInSpecifiedUnits);
         void convertToSpecifiedUnits(unsigned short unitType);
 
-        // Throughout SVG 1.1 'SVGAngle' is only used for 'SVGMarkerElement' (orient-angle)
-        const QualifiedName& associatedAttributeName() const { return SVGNames::orientAttr; }
-
     private:
-        SVGAngle();
-
         SVGAngleType m_unitType;
         float m_value;
         float m_valueInSpecifiedUnits;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAngle.idl b/src/3rdparty/webkit/WebCore/svg/SVGAngle.idl
index fc7c1e1ad3..023fb39695 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAngle.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAngle.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -24,7 +22,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, GenerateConstructor] SVGAngle { 
+    interface [Conditional=SVG, PODType=SVGAngle] SVGAngle { 
         // Angle Unit Types
         const unsigned short SVG_ANGLETYPE_UNKNOWN     = 0;
         const unsigned short SVG_ANGLETYPE_UNSPECIFIED = 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimateColorElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAnimateColorElement.cpp
index 1555f5ee82..ab48f180e3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimateColorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimateColorElement.cpp
@@ -3,8 +3,6 @@
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimateColorElement.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimateColorElement.h
index 595f0a91a2..9071185031 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimateColorElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimateColorElement.h
@@ -3,8 +3,6 @@
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimateElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAnimateElement.cpp
index c2a83c016c..31d681bd04 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimateElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimateElement.cpp
@@ -3,8 +3,6 @@
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -64,7 +62,7 @@ static bool parseNumberValueAndUnit(const String& in, double& value, String& uni
         unitLength = 4;
     String newUnit = parse.right(unitLength);
     String number = parse.left(parse.length() - unitLength);
-    if (!unit.isEmpty() && newUnit != unit || number.isEmpty())
+    if ((!unit.isEmpty() && newUnit != unit) || number.isEmpty())
         return false;
     UChar last = number[number.length() - 1];
     if (last < '0' || last > '9')
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimateElement.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimateElement.h
index b90e5c8efe..ac5883c56e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimateElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimateElement.h
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimateMotionElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAnimateMotionElement.cpp
index 44bf5fb014..93554364d4 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimateMotionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimateMotionElement.cpp
@@ -149,7 +149,7 @@ void SVGAnimateMotionElement::resetToBaseValue(const String&)
     if (!hasValidTarget())
         return;
     SVGElement* target = targetElement();
-    TransformationMatrix* transform = target->supplementalTransform();
+    AffineTransform* transform = target->supplementalTransform();
     if (!transform)
         return;
     transform->makeIdentity();
@@ -176,7 +176,7 @@ void SVGAnimateMotionElement::calculateAnimatedValue(float percentage, unsigned,
     SVGElement* target = targetElement();
     if (!target)
         return;
-    TransformationMatrix* transform = target->supplementalTransform();
+    AffineTransform* transform = target->supplementalTransform();
     if (!transform)
         return;
     
@@ -215,13 +215,13 @@ void SVGAnimateMotionElement::applyResultsToTarget()
         targetElement->renderer()->setNeedsLayout(true);
     
     // ...except in case where we have additional instances in <use> trees.
-    HashSet<SVGElementInstance*> instances = targetElement->instancesForElement();
-    HashSet<SVGElementInstance*>::iterator end = instances.end();
-    for (HashSet<SVGElementInstance*>::iterator it = instances.begin(); it != end; ++it) {
+    const HashSet<SVGElementInstance*>& instances = targetElement->instancesForElement();
+    const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
+    for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
         SVGElement* shadowTreeElement = (*it)->shadowTreeElement();
         ASSERT(shadowTreeElement);
-        TransformationMatrix* transform = shadowTreeElement->supplementalTransform();
-        TransformationMatrix* t = targetElement->supplementalTransform();
+        AffineTransform* transform = shadowTreeElement->supplementalTransform();
+        AffineTransform* t = targetElement->supplementalTransform();
         transform->setMatrix(t->a(), t->b(), t->c(), t->d(), t->e(), t->f());
         if (shadowTreeElement->renderer())
             shadowTreeElement->renderer()->setNeedsLayout(true);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimateMotionElement.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimateMotionElement.h
index 910ef17df7..f4012201a3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimateMotionElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimateMotionElement.h
@@ -23,10 +23,9 @@
 #ifndef SVGAnimateMotionElement_h
 #define SVGAnimateMotionElement_h
 #if ENABLE(SVG_ANIMATION)
-
-#include "SVGAnimationElement.h"
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "Path.h"
+#include "SVGAnimationElement.h"
 
 namespace WebCore {
             
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimateTransformElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAnimateTransformElement.cpp
index 3ebba06313..8e077a4daa 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimateTransformElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimateTransformElement.cpp
@@ -27,6 +27,7 @@
 #if ENABLE(SVG) && ENABLE(SVG_ANIMATION)
 #include "SVGAnimateTransformElement.h"
 
+#include "AffineTransform.h"
 #include "MappedAttribute.h"
 #include "RenderObject.h"
 #include "SVGAngle.h"
@@ -38,7 +39,6 @@
 #include "SVGTransform.h"
 #include "SVGTransformList.h"
 #include "SVGUseElement.h"
-#include "TransformationMatrix.h"
 #include <math.h>
 #include <wtf/MathExtras.h>
 
@@ -163,16 +163,16 @@ void SVGAnimateTransformElement::applyResultsToTarget()
         targetElement->renderer()->setNeedsLayout(true);
     
     // ...except in case where we have additional instances in <use> trees.
-    HashSet<SVGElementInstance*> instances = targetElement->instancesForElement();
+    const HashSet<SVGElementInstance*>& instances = targetElement->instancesForElement();
     RefPtr<SVGTransformList> transformList = transformListFor(targetElement);
-    HashSet<SVGElementInstance*>::iterator end = instances.end();
-    for (HashSet<SVGElementInstance*>::iterator it = instances.begin(); it != end; ++it) {
+    const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
+    for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
         SVGElement* shadowTreeElement = (*it)->shadowTreeElement();
         ASSERT(shadowTreeElement);
         if (shadowTreeElement->isStyledTransformable())
-            static_cast<SVGStyledTransformableElement*>(shadowTreeElement)->setTransform(transformList.get());
+            static_cast<SVGStyledTransformableElement*>(shadowTreeElement)->setTransformBaseValue(transformList.get());
         else if (shadowTreeElement->hasTagName(SVGNames::textTag))
-            static_cast<SVGTextElement*>(shadowTreeElement)->setTransform(transformList.get());
+            static_cast<SVGTextElement*>(shadowTreeElement)->setTransformBaseValue(transformList.get());
         if (shadowTreeElement->renderer())
             shadowTreeElement->renderer()->setNeedsLayout(true);
     }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimateTransformElement.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimateTransformElement.h
index 9b1f192ebd..c93e69425f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimateTransformElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimateTransformElement.h
@@ -4,8 +4,6 @@
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
     Copyright (C) 2008 Apple Inc. All Rights Reserved.
     
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -32,34 +30,34 @@
 
 namespace WebCore {
 
-    class TransformationMatrix;
+class AffineTransform;
 
-    class SVGAnimateTransformElement : public SVGAnimationElement {
-    public:
-        SVGAnimateTransformElement(const QualifiedName&, Document*);
-        virtual ~SVGAnimateTransformElement();
-        
-        virtual bool hasValidTarget() const;
+class SVGAnimateTransformElement : public SVGAnimationElement {
+public:
+    SVGAnimateTransformElement(const QualifiedName&, Document*);
+    virtual ~SVGAnimateTransformElement();
+    
+    virtual bool hasValidTarget() const;
 
-        virtual void parseMappedAttribute(MappedAttribute*);
+    virtual void parseMappedAttribute(MappedAttribute*);
 
-    private:
-        virtual void resetToBaseValue(const String&);
-        virtual bool calculateFromAndToValues(const String& fromString, const String& toString);
-        virtual bool calculateFromAndByValues(const String& fromString, const String& byString);
-        virtual void calculateAnimatedValue(float percentage, unsigned repeat, SVGSMILElement* resultElement);
-        virtual void applyResultsToTarget();
-        virtual float calculateDistance(const String& fromString, const String& toString);
+private:
+    virtual void resetToBaseValue(const String&);
+    virtual bool calculateFromAndToValues(const String& fromString, const String& toString);
+    virtual bool calculateFromAndByValues(const String& fromString, const String& byString);
+    virtual void calculateAnimatedValue(float percentage, unsigned repeat, SVGSMILElement* resultElement);
+    virtual void applyResultsToTarget();
+    virtual float calculateDistance(const String& fromString, const String& toString);
 
-        SVGTransform parseTransformValue(const String&) const;
-        
-        SVGTransform::SVGTransformType m_type;
-        
-        unsigned m_baseIndexInTransformList;
+    SVGTransform parseTransformValue(const String&) const;
+    
+    SVGTransform::SVGTransformType m_type;
+    
+    unsigned m_baseIndexInTransformList;
 
-        SVGTransform m_toTransform;
-        SVGTransform m_fromTransform;
-    };
+    SVGTransform m_toTransform;
+    SVGTransform m_fromTransform;
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPathData.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPathData.cpp
index be75809768..0f43f2c70f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPathData.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPathData.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPathData.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPathData.h
index 88b994bc62..79bd586275 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPathData.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPathData.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPathData.idl b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPathData.idl
index 46ec7b1aa8..63a5209de4 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPathData.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPathData.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, ObjCProtocol] SVGAnimatedPathData {
+    interface [Conditional=SVG, ObjCProtocol, OmitConstructor] SVGAnimatedPathData {
         readonly attribute SVGPathSegList   pathSegList;
         readonly attribute SVGPathSegList   normalizedPathSegList;
         readonly attribute SVGPathSegList   animatedPathSegList;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPoints.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPoints.cpp
index 584f875c4d..57101b3660 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPoints.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPoints.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPoints.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPoints.h
index 1e610575f7..9f44e1fa9f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPoints.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPoints.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPoints.idl b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPoints.idl
index 877f684745..056b1393b3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPoints.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPoints.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, ObjCProtocol] SVGAnimatedPoints {
+    interface [Conditional=SVG, ObjCProtocol, OmitConstructor] SVGAnimatedPoints {
         readonly attribute SVGPointList   points;
         readonly attribute SVGPointList   animatedPoints;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
index 984046fbe3..0e3ceda5e6 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
@@ -1,6 +1,6 @@
 /*
     Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
-    Copyright (C) Research In Motion Limited 2009. All rights reserved.
+    Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -22,493 +22,196 @@
 #define SVGAnimatedProperty_h
 
 #if ENABLE(SVG)
+#include "SVGAnimatedPropertySynchronizer.h"
+#include "SVGAnimatedPropertyTraits.h"
 #include "SVGAnimatedTemplate.h"
-#include "SVGDocumentExtensions.h"
-#include "SynchronizableTypeWrapper.h"
 
 namespace WebCore {
 
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    class SVGAnimatedProperty;
-
-    template<typename OwnerType, typename OwnerElement, typename AnimatedType, typename DecoratedType, const char* TagName, const char* PropertyName>
-    class SVGAnimatedPropertyTearOff : public SVGAnimatedTemplate<DecoratedType> {
-    public:
-        typedef SVGAnimatedPropertyTearOff<OwnerType, OwnerElement, AnimatedType, DecoratedType, TagName, PropertyName> Self;
-        typedef SVGAnimatedProperty<OwnerType, AnimatedType, TagName, PropertyName> Creator;
+template<typename AnimatedType>
+class SVGAnimatedProperty;
 
-        static PassRefPtr<Self> create(const Creator& creator, const OwnerElement* owner, const QualifiedName& attributeName)
-        {
-            return adoptRef(new Self(creator, owner, attributeName));
-        }
+template<typename AnimatedType>
+class SVGAnimatedPropertyTearOff : public SVGAnimatedTemplate<AnimatedType> {
+public:
+    typedef typename SVGAnimatedPropertyTraits<AnimatedType>::PassType PassType;
+    typedef typename SVGAnimatedPropertyTraits<AnimatedType>::ReturnType ReturnType;
 
-        virtual DecoratedType baseVal() const;
-        virtual void setBaseVal(DecoratedType);
+    typedef SVGAnimatedPropertyTearOff<AnimatedType> Self;
+    typedef SVGAnimatedProperty<AnimatedType> Creator;
 
-        virtual DecoratedType animVal() const;
-        virtual void setAnimVal(DecoratedType);
-
-    private:
-        SVGAnimatedPropertyTearOff(const Creator&, const OwnerElement*, const QualifiedName& attributeName);
-
-        Creator& m_creator;
-        RefPtr<OwnerElement> m_ownerElement;
-    };
-
-    // Helper templates mapping owner types to owner elements (for SVG*Element OwnerType is equal to OwnerElement, for non-SVG*Element derived types, they're different)
-    template<typename OwnerType, bool isDerivedFromSVGElement>
-    struct GetOwnerElementForType;
-
-    template<typename OwnerType>
-    struct IsDerivedFromSVGElement;
-
-    // Helper template used for synchronizing SVG <-> XML properties
-    template<typename OwnerType, typename DecoratedType, bool isDerivedFromSVGElement>
-    struct PropertySynchronizer;
-
-    // Abstract base class
-    class SVGAnimatedPropertyBase : public Noncopyable {
-    public:
-        virtual ~SVGAnimatedPropertyBase() { }
-        virtual void synchronize() const = 0;
-        virtual void startAnimation() const = 0;
-        virtual void stopAnimation() = 0;
-    };
-
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    class SVGAnimatedProperty : public SVGAnimatedPropertyBase {
-    public:
-        typedef OwnerTypeArg OwnerType;
-        typedef AnimatedTypeArg AnimatedType;
-
-        typedef typename SVGAnimatedTypeValue<AnimatedType>::StorableType StorableType;
-        typedef typename SVGAnimatedTypeValue<AnimatedType>::DecoratedType DecoratedType;
-
-        typedef GetOwnerElementForType<OwnerType, IsDerivedFromSVGElement<OwnerType>::value> OwnerElementForType;
-        typedef typename OwnerElementForType::OwnerElement OwnerElement;
-        typedef SVGAnimatedPropertyTearOff<OwnerType, OwnerElement, AnimatedType, DecoratedType, TagName, PropertyName> TearOff;
-
-        // attributeName & attributeIdentifier may differ. For SVGMarkerElement, there are two exposed SVG animatable
-        // properties: orientType & orientAngle, though only one DOM attribute "orient", handle these cases!
-        SVGAnimatedProperty(const OwnerType*, const QualifiedName& attributeName);
-        SVGAnimatedProperty(const OwnerType*, const QualifiedName& attributeName, const AtomicString& attributeIdentifier);
-
-        // "Forwarding constructors" for primitive type assignment with more than one argument
-        template<typename T1>
-        SVGAnimatedProperty(const OwnerType*, const QualifiedName& attributeName,
-                            const T1&);
-
-        template<typename T1>
-        SVGAnimatedProperty(const OwnerType*, const QualifiedName& attributeName, const AtomicString& attributeIdentifier,
-                            const T1&);
-
-        template<typename T1, typename T2>
-        SVGAnimatedProperty(const OwnerType*, const QualifiedName& attributeName,
-                            const T1&, const T2&);
-
-        template<typename T1, typename T2>
-        SVGAnimatedProperty(const OwnerType*, const QualifiedName& attributeName, const AtomicString& attributeIdentifier,
-                            const T1&, const T2&);
-
-        template<typename T1, typename T2, typename T3>
-        SVGAnimatedProperty(const OwnerType*, const QualifiedName& attributeName,
-                            const T1&, const T2&, const T3&);
-    
-        template<typename T1, typename T2, typename T3>
-        SVGAnimatedProperty(const OwnerType*, const QualifiedName& attributeName, const AtomicString& attributeIdentifier,
-                            const T1&, const T2&, const T3&);
-
-        DecoratedType value() const;
-        void setValue(DecoratedType);
-
-        DecoratedType baseValue() const;
-        void setBaseValue(DecoratedType);
-
-        // Tear offs only used by bindings, never in internal code
-        PassRefPtr<TearOff> animatedTearOff() const;
-
-        void registerProperty();
-        virtual void synchronize() const;
-
-        void startAnimation() const;
-        void stopAnimation();
-
-    private:
-        const OwnerElement* ownerElement() const;
-
-    private:
-        // We're a member variable on stack, living in OwnerType, NO need to ref here.
-        const OwnerType* m_ownerType;
-
-        const QualifiedName& m_attributeName;
-        const AtomicString& m_attributeIdentifier;
-
-        mutable SynchronizableTypeWrapper<StorableType> m_value;
-
-#ifndef NDEBUG
-        bool m_registered;
-#endif
-    };
-
-    // SVGAnimatedPropertyTearOff implementation
-    template<typename OwnerType, typename OwnerElement, typename AnimatedType, typename DecoratedType, const char* TagName, const char* PropertyName>
-    SVGAnimatedPropertyTearOff<OwnerType, OwnerElement, AnimatedType, DecoratedType, TagName, PropertyName>::SVGAnimatedPropertyTearOff(const Creator& creator,
-                                                                                                                                        const OwnerElement* owner,
-                                                                                                                                        const QualifiedName& attributeName)
-        : SVGAnimatedTemplate<DecoratedType>(attributeName)
-        , m_creator(const_cast<Creator&>(creator))
-        , m_ownerElement(const_cast<OwnerElement*>(owner))
+    static PassRefPtr<Self> create(Creator& creator, SVGElement* contextElement)
     {
-        ASSERT(m_ownerElement);
+        return adoptRef(new Self(creator, contextElement));
     }
 
-    template<typename OwnerType, typename OwnerElement, typename AnimatedType, typename DecoratedType, const char* TagName, const char* PropertyName>
-    DecoratedType SVGAnimatedPropertyTearOff<OwnerType, OwnerElement, AnimatedType, DecoratedType, TagName, PropertyName>::baseVal() const
+    virtual void setBaseVal(PassType type)
     {
-        return m_creator.baseValue();
+        m_creator.setBaseValue(type);
+        m_contextElement->setSynchronizedSVGAttributes(false);
     }
 
-    template<typename OwnerType, typename OwnerElement, typename AnimatedType, typename DecoratedType, const char* TagName, const char* PropertyName>
-    void SVGAnimatedPropertyTearOff<OwnerType, OwnerElement, AnimatedType, DecoratedType, TagName, PropertyName>::setBaseVal(DecoratedType newBaseVal)
+    virtual void setAnimVal(PassType type)
     {
-        m_creator.setBaseValue(newBaseVal);
+        m_creator.setValue(type);
+        m_contextElement->setSynchronizedSVGAttributes(false);
     }
 
-    template<typename OwnerType, typename OwnerElement, typename AnimatedType, typename DecoratedType, const char* TagName, const char* PropertyName>
-    DecoratedType SVGAnimatedPropertyTearOff<OwnerType, OwnerElement, AnimatedType, DecoratedType, TagName, PropertyName>::animVal() const
-    {
-        return m_creator.value();
-    }
+    virtual ReturnType baseVal() const { return m_creator.baseValue(); }
+    virtual ReturnType animVal() const { return m_creator.value(); }
+    virtual const QualifiedName& associatedAttributeName() const { return m_creator.associatedAttributeName(); }
 
-    template<typename OwnerType, typename OwnerElement, typename AnimatedType, typename DecoratedType, const char* TagName, const char* PropertyName>
-    void SVGAnimatedPropertyTearOff<OwnerType, OwnerElement, AnimatedType, DecoratedType, TagName, PropertyName>::setAnimVal(DecoratedType newAnimVal)
+private:
+    SVGAnimatedPropertyTearOff(Creator& creator, SVGElement* contextElement)
+        : m_creator(creator)
+        , m_contextElement(contextElement)
     {
-        m_creator.setValue(newAnimVal);
+        m_creator.setShouldSynchronize(true);
     }
 
-    // SVGAnimatedProperty implementation
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::SVGAnimatedProperty(const OwnerType* owner,
-                                                                                                   const QualifiedName& attributeName)
-        : m_ownerType(owner)
-        , m_attributeName(attributeName)
-        , m_attributeIdentifier(attributeName.localName())
-        , m_value()
-#ifndef NDEBUG
-        , m_registered(false)
-#endif
+    virtual ~SVGAnimatedPropertyTearOff()
     {
-        ASSERT(m_ownerType);
-        registerProperty();
+        m_creator.setShouldSynchronize(false);
     }
 
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::SVGAnimatedProperty(const OwnerType* owner,
-                                                                                                   const QualifiedName& attributeName,
-                                                                                                   const AtomicString& attributeIdentifier)
-        : m_ownerType(owner)
-        , m_attributeName(attributeName)
-        , m_attributeIdentifier(attributeIdentifier)
-        , m_value()
-#ifndef NDEBUG
-        , m_registered(false)
-#endif
-    {
-        ASSERT(m_ownerType);
-        registerProperty();
-    }
-
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    template<typename T1>
-    SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::SVGAnimatedProperty(const OwnerType* owner,
-                                                                                                   const QualifiedName& attributeName,
-                                                                                                   const T1& arg1)
-        : m_ownerType(owner)
-        , m_attributeName(attributeName)
-        , m_attributeIdentifier(attributeName.localName())
-        , m_value(arg1)
-#ifndef NDEBUG
-        , m_registered(false)
-#endif
-    {
-        ASSERT(m_ownerType);
-        registerProperty();
-    }
-
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    template<typename T1>
-    SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::SVGAnimatedProperty(const OwnerType* owner,
-                                                                                                   const QualifiedName& attributeName,
-                                                                                                   const AtomicString& attributeIdentifier,
-                                                                                                   const T1& arg1)
-        : m_ownerType(owner)
-        , m_attributeName(attributeName)
-        , m_attributeIdentifier(attributeIdentifier)
-        , m_value(arg1)
-#ifndef NDEBUG
-        , m_registered(false)
-#endif
-    {
-        ASSERT(m_ownerType);
-        registerProperty();
-    }
-
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    template<typename T1, typename T2>
-    SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::SVGAnimatedProperty(const OwnerType* owner,
-                                                                                                   const QualifiedName& attributeName,
-                                                                                                   const T1& arg1,
-                                                                                                   const T2& arg2)
-        : m_ownerType(owner)
-        , m_attributeName(attributeName)
-        , m_attributeIdentifier(attributeName.localName())
-        , m_value(arg1, arg2)
-#ifndef NDEBUG
-        , m_registered(false)
-#endif
-    {
-        ASSERT(m_ownerType);
-        registerProperty();
-    }
-
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    template<typename T1, typename T2>
-    SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::SVGAnimatedProperty(const OwnerType* owner,
-                                                                                                   const QualifiedName& attributeName,
-                                                                                                   const AtomicString& attributeIdentifier,
-                                                                                                   const T1& arg1,
-                                                                                                   const T2& arg2)
-        : m_ownerType(owner)
-        , m_attributeName(attributeName)
-        , m_attributeIdentifier(attributeIdentifier)
-        , m_value(arg1, arg2)
-#ifndef NDEBUG
-        , m_registered(false)
-#endif
-    {
-        ASSERT(m_ownerType);
-        registerProperty();
-    }
-
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    template<typename T1, typename T2, typename T3>
-    SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::SVGAnimatedProperty(const OwnerType* owner,
-                                                                                                   const QualifiedName& attributeName,
-                                                                                                   const T1& arg1,
-                                                                                                   const T2& arg2,
-                                                                                                   const T3& arg3)
-        : m_ownerType(owner)
-        , m_attributeName(attributeName)
-        , m_attributeIdentifier(attributeName.localName())
-        , m_value(arg1, arg2, arg3)
-#ifndef NDEBUG
-        , m_registered(false)
-#endif
-    {
-        ASSERT(m_ownerType);
-        registerProperty();
-    }
-
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    template<typename T1, typename T2, typename T3>
-    SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::SVGAnimatedProperty(const OwnerType* owner,
-                                                                                                   const QualifiedName& attributeName,
-                                                                                                   const AtomicString& attributeIdentifier,
-                                                                                                   const T1& arg1,
-                                                                                                   const T2& arg2,
-                                                                                                   const T3& arg3)
-        : m_ownerType(owner)
-        , m_attributeName(attributeName)
-        , m_attributeIdentifier(attributeIdentifier)
-        , m_value(arg1, arg2, arg3)
-#ifndef NDEBUG
-        , m_registered(false)
-#endif
-    {
-        ASSERT(m_ownerType);
-        registerProperty();
-    }
-
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    typename SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::DecoratedType
-    SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::value() const
-    {
-        ASSERT(m_registered);
-        return m_value;
-    }
-
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::setValue(typename SVGAnimatedProperty::DecoratedType newValue)
-    {
-        ASSERT(m_registered);
-        m_value = newValue;
-        ownerElement()->setSynchronizedSVGAttributes(false);
-    }
+    Creator& m_creator;
+    RefPtr<SVGElement> m_contextElement;
+};
 
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    typename SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::DecoratedType
-    SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::baseValue() const
-    {
-        ASSERT(m_registered);
-        const OwnerElement* ownerElement = this->ownerElement();
-        SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions();
-        if (extensions && extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier))
-            return extensions->baseValue<DecoratedType>(ownerElement, m_attributeIdentifier);
+template<typename AnimatedType>
+class SVGAnimatedProperty {
+public:
+    virtual ~SVGAnimatedProperty() { }
 
-        return m_value;
-    }
+    typedef typename SVGAnimatedPropertyTraits<AnimatedType>::PassType PassType;
+    typedef typename SVGAnimatedPropertyTraits<AnimatedType>::ReturnType ReturnType;
+    typedef typename SVGAnimatedPropertyTraits<AnimatedType>::StoredType StoredType;
 
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::setBaseValue(typename SVGAnimatedProperty::DecoratedType newValue)
+    SVGAnimatedProperty()
+        : m_value(SVGAnimatedPropertyTraits<AnimatedType>::null())
+        , m_shouldSynchronize(false)
     {
-        ASSERT(m_registered);
-        const OwnerElement* ownerElement = this->ownerElement();
-        SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions();
-        if (extensions && extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier)) {
-            extensions->setBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier, newValue);
-            return;
-        }
-
-        // Only update stored property, if not animating
-        m_value = newValue;
-        ownerElement->setSynchronizedSVGAttributes(false);
     }
 
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    PassRefPtr<typename SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::TearOff>
-    SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::animatedTearOff() const
+    template<typename ConstructorParameterOne>
+    SVGAnimatedProperty(const ConstructorParameterOne& value1)
+        : m_value(value1)
+        , m_shouldSynchronize(false)
     {
-        ASSERT(m_registered);
-        return lookupOrCreateWrapper<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName, TearOff, OwnerElement>(*this, ownerElement(), m_attributeName, m_attributeIdentifier);
     }
 
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::registerProperty()
+    template<typename ConstructorParameterOne, typename ConstructorParameterTwo>
+    SVGAnimatedProperty(const ConstructorParameterOne& value1, const ConstructorParameterTwo& value2)
+        : m_value(value1, value2)
+        , m_shouldSynchronize(false)
     {
-        ASSERT(!m_registered);
-        ownerElement()->propertyController().registerProperty(m_attributeName, this);
-
-#ifndef NDEBUG
-        m_registered = true;
-#endif
     }
 
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::synchronize() const
-    {
-        ASSERT(m_registered);
-        if (!m_value.needsSynchronization()) 
-            return; 
+    ReturnType value() const { return SVGAnimatedPropertyTraits<AnimatedType>::toReturnType(m_value); }
+    ReturnType baseValue() const { return SVGAnimatedPropertyTraits<AnimatedType>::toReturnType(m_value); }
 
-        PropertySynchronizer<OwnerElement, DecoratedType, IsDerivedFromSVGElement<OwnerType>::value>::synchronize(ownerElement(), m_attributeName, baseValue());
-        m_value.setSynchronized(); 
-    }
+    void setValue(PassType type) { m_value = type; }
+    void setBaseValue(PassType type) { m_value = type; }
 
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::startAnimation() const
-    {
-        ASSERT(m_registered);
-        const OwnerElement* ownerElement = this->ownerElement();
-        if (SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions()) {
-            ASSERT(!extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier));
-            extensions->setBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier, m_value);
-        }
-    }
-    
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::stopAnimation()
-    {
-        ASSERT(m_registered);
-        const OwnerElement* ownerElement = this->ownerElement();
-        if (SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions()) {
-            ASSERT(extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier));
-            setValue(extensions->baseValue<DecoratedType>(ownerElement, m_attributeIdentifier));
-            extensions->removeBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier);
-        }
-    }
+    bool shouldSynchronize() const { return m_shouldSynchronize; }
+    void setShouldSynchronize(bool value) { m_shouldSynchronize = value; }
 
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
-    const typename SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::OwnerElement*
-    SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::ownerElement() const
-    {
-        return OwnerElementForType::ownerElement(m_ownerType);
-    }
+    virtual const QualifiedName& associatedAttributeName() const = 0;
 
-    // GetOwnerElementForType implementation
-    template<typename OwnerType>
-    struct GetOwnerElementForType<OwnerType, true> : Noncopyable {
-        typedef OwnerType OwnerElement;
-
-        static const OwnerElement* ownerElement(const OwnerType* type)
-        {
-            return type;
-        }
-    };
-
-    template<typename OwnerType>
-    struct GetOwnerElementForType<OwnerType, false> : Noncopyable {    
-        typedef SVGElement OwnerElement;
-
-        static const OwnerElement* ownerElement(const OwnerType* type)
-        {
-            const OwnerElement* context = type->contextElement();
-            ASSERT(context);
-            return context;
-        }
-    };
-
-    // IsDerivedFromSVGElement implementation
-    template<typename OwnerType>
-    struct IsDerivedFromSVGElement : Noncopyable {
-        static const bool value = true;
-    };
-
-    class SVGViewSpec;
-    template<>
-    struct IsDerivedFromSVGElement<SVGViewSpec> : Noncopyable {
-        static const bool value = false;
-    };
-
-    // PropertySynchronizer implementation
-    template<typename OwnerElement, typename DecoratedType>
-    struct PropertySynchronizer<OwnerElement, DecoratedType, true> : Noncopyable {
-        static void synchronize(const OwnerElement* ownerElement, const QualifiedName& attributeName, DecoratedType baseValue)
-        {
-            AtomicString value(SVGAnimatedTypeValue<DecoratedType>::toString(baseValue));
-
-            NamedNodeMap* namedAttrMap = ownerElement->attributes(false); 
-            Attribute* old = namedAttrMap->getAttributeItem(attributeName);
-            if (old && value.isNull()) 
-                namedAttrMap->removeAttribute(old->name()); 
-            else if (!old && !value.isNull()) 
-                namedAttrMap->addAttribute(const_cast<OwnerElement*>(ownerElement)->createAttribute(attributeName, value));
-            else if (old && !value.isNull()) 
-                old->setValue(value); 
-        }
-    };
-
-    template<typename OwnerElement, typename DecoratedType>
-    struct PropertySynchronizer<OwnerElement, DecoratedType, false> : Noncopyable {
-        static void synchronize(const OwnerElement*, const QualifiedName&, DecoratedType)
-        {
-            // no-op, for types not inheriting from Element, thus nothing to synchronize
-        }
-    };
-
-    // Helper macro used to register animated properties within SVG* classes
-    #define ANIMATED_PROPERTY_DECLARATIONS(OwnerType, ElementTag, AttributeTag, AnimatedType, UpperProperty, LowerProperty) \
-    private: \
-        typedef SVGAnimatedProperty<OwnerType, AnimatedType, ElementTag, AttributeTag> SVGAnimatedProperty##UpperProperty; \
-        typedef SVGAnimatedTypeValue<AnimatedType>::DecoratedType DecoratedTypeFor##UpperProperty; \
-        SVGAnimatedProperty##UpperProperty m_##LowerProperty; \
-    public: \
-        DecoratedTypeFor##UpperProperty LowerProperty() const { return m_##LowerProperty.value(); } \
-        void set##UpperProperty(DecoratedTypeFor##UpperProperty type) { m_##LowerProperty.setValue(type); } \
-        DecoratedTypeFor##UpperProperty LowerProperty##BaseValue() const { return m_##LowerProperty.baseValue(); } \
-        void set##UpperProperty##BaseValue(DecoratedTypeFor##UpperProperty type) { m_##LowerProperty.setBaseValue(type); } \
-        PassRefPtr<SVGAnimatedProperty##UpperProperty::TearOff> LowerProperty##Animated() const { return m_##LowerProperty.animatedTearOff(); }
+protected:
+    StoredType m_value;
+    bool m_shouldSynchronize;
+};
 
 };
 
+// Helper macro used within DECLARE_ANIMATED_PROPERTY below
+#define DEFINE_ANIMATED_PROPERTY(OwnerType, DOMAttribute, AnimatedType, UpperProperty) \
+class SVGAnimatedProperty##UpperProperty : public SVGAnimatedProperty<AnimatedType> { \
+public: \
+    SVGAnimatedProperty##UpperProperty() \
+        : SVGAnimatedProperty<AnimatedType>() \
+    { \
+    } \
+    \
+    template<typename ConstructorParameterOne> \
+    SVGAnimatedProperty##UpperProperty(const ConstructorParameterOne& value1) \
+        : SVGAnimatedProperty<AnimatedType>(value1) \
+    { \
+    } \
+    \
+    template<typename ConstructorParameterOne, typename ConstructorParameterTwo> \
+    SVGAnimatedProperty##UpperProperty(const ConstructorParameterOne& value1, const ConstructorParameterTwo& value2) \
+        : SVGAnimatedProperty<AnimatedType>(value1, value2) \
+    { \
+    } \
+    \
+    void synchronize(SVGElement* contextElement) \
+    { \
+        ASSERT(m_shouldSynchronize); \
+        AtomicString value(SVGAnimatedPropertyTraits<AnimatedType>::toString(baseValue())); \
+        SVGAnimatedPropertySynchronizer<IsDerivedFromSVGElement<OwnerType>::value>::synchronize(contextElement, DOMAttribute, value); \
+    } \
+    \
+    virtual const QualifiedName& associatedAttributeName() const \
+    { \
+        return DOMAttribute; \
+    } \
+}
+
+// Helper macro shared by DECLARE_ANIMATED_PROPERTY / DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS
+#define DECLARE_ANIMATED_PROPERTY_SHARED(OwnerType, DOMAttribute, SVGDOMAttributeIdentifier, AnimatedType, UpperProperty, LowerProperty) \
+private: \
+    typedef SVGAnimatedPropertyTearOff<AnimatedType> SVGAnimatedPropertyTearOff##UpperProperty; \
+    DEFINE_ANIMATED_PROPERTY(OwnerType, DOMAttribute, AnimatedType, UpperProperty); \
+    SVGAnimatedProperty##UpperProperty m_##LowerProperty; \
+    \
+public: \
+    SVGAnimatedPropertyTraits<AnimatedType>::ReturnType LowerProperty() const \
+    { \
+        return m_##LowerProperty.value(); \
+    } \
+    \
+    SVGAnimatedPropertyTraits<AnimatedType>::ReturnType LowerProperty##BaseValue() const \
+    { \
+        return m_##LowerProperty.baseValue(); \
+    } \
+    \
+    void set##UpperProperty(SVGAnimatedPropertyTraits<AnimatedType>::PassType type) \
+    { \
+        m_##LowerProperty.setValue(type); \
+        SVGElement* contextElement = GetOwnerElementForType<OwnerType, IsDerivedFromSVGElement<OwnerType>::value>::ownerElement(this); \
+        contextElement->setSynchronizedSVGAttributes(false); \
+    } \
+    \
+    void set##UpperProperty##BaseValue(SVGAnimatedPropertyTraits<AnimatedType>::PassType type) \
+    { \
+        m_##LowerProperty.setBaseValue(type); \
+        SVGElement* contextElement = GetOwnerElementForType<OwnerType, IsDerivedFromSVGElement<OwnerType>::value>::ownerElement(this); \
+        contextElement->setSynchronizedSVGAttributes(false); \
+    } \
+    \
+    void synchronize##UpperProperty() \
+    { \
+        if (!m_##LowerProperty.shouldSynchronize()) \
+            return; \
+        SVGElement* contextElement = GetOwnerElementForType<OwnerType, IsDerivedFromSVGElement<OwnerType>::value>::ownerElement(this); \
+        m_##LowerProperty.synchronize(contextElement); \
+    } \
+    \
+    PassRefPtr<SVGAnimatedPropertyTearOff##UpperProperty> LowerProperty##Animated() \
+    { \
+        SVGElement* contextElement = GetOwnerElementForType<OwnerType, IsDerivedFromSVGElement<OwnerType>::value>::ownerElement(this); \
+        return lookupOrCreateWrapper<AnimatedType, SVGAnimatedPropertyTearOff##UpperProperty>(contextElement, m_##LowerProperty, DOMAttribute); \
+    }
+
+// Used for SVG DOM properties that map exactly to one XML DOM attribute
+#define DECLARE_ANIMATED_PROPERTY(OwnerType, DOMAttribute, AnimatedType, UpperProperty, LowerProperty) \
+DECLARE_ANIMATED_PROPERTY_SHARED(OwnerType, DOMAttribute, DOMAttribute.localName(), AnimatedType, UpperProperty, LowerProperty)
+
+// Used for the rare case multiple SVG DOM properties that map to the same XML dom attribute
+#define DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(OwnerType, DOMAttribute, SVGDOMAttributeIdentifier, AnimatedType, UpperProperty, LowerProperty) \
+DECLARE_ANIMATED_PROPERTY_SHARED(OwnerType, DOMAttribute, SVGDOMAttributeIdentifier, AnimatedType, UpperProperty, LowerProperty)
+
 #endif
 #endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPropertySynchronizer.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPropertySynchronizer.h
new file mode 100644
index 0000000000..ddd04931e7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPropertySynchronizer.h
@@ -0,0 +1,96 @@
+/*
+    Copyright (C) Research In Motion Limited 2010. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef SVGAnimatedPropertySynchronizer_h
+#define SVGAnimatedPropertySynchronizer_h
+
+#include "SVGAnimatedPropertyTraits.h"
+
+#if ENABLE(SVG)
+namespace WebCore {
+
+class SVGElement;
+
+// GetOwnerElementForType implementation
+template<typename OwnerType, bool isDerivedFromSVGElement>
+struct GetOwnerElementForType;
+
+template<typename OwnerType>
+struct GetOwnerElementForType<OwnerType, true> : public Noncopyable {
+    static SVGElement* ownerElement(OwnerType* type)
+    {
+        return type;
+    }
+};
+
+template<typename OwnerType>
+struct GetOwnerElementForType<OwnerType, false> : public Noncopyable {    
+    static SVGElement* ownerElement(OwnerType* type)
+    {
+        SVGElement* context = type->contextElement();
+        ASSERT(context);
+        return context;
+    }
+};
+
+// IsDerivedFromSVGElement implementation
+template<typename OwnerType>
+struct IsDerivedFromSVGElement : public Noncopyable {
+    static const bool value = true;
+};
+
+class SVGViewSpec;
+template<>
+struct IsDerivedFromSVGElement<SVGViewSpec> : public Noncopyable {
+    static const bool value = false;
+};
+
+// Helper template used for synchronizing SVG <-> XML properties
+template<bool isDerivedFromSVGElement>
+struct SVGAnimatedPropertySynchronizer {
+    static void synchronize(SVGElement*, const QualifiedName&, const AtomicString&);
+};
+
+template<>
+struct SVGAnimatedPropertySynchronizer<true> {
+    static void synchronize(SVGElement* ownerElement, const QualifiedName& attrName, const AtomicString& value)
+    {
+        NamedNodeMap* namedAttrMap = ownerElement->attributes(false); 
+        Attribute* old = namedAttrMap->getAttributeItem(attrName);
+        if (old && value.isNull()) 
+            namedAttrMap->removeAttribute(old->name()); 
+        else if (!old && !value.isNull()) 
+            namedAttrMap->addAttribute(ownerElement->createAttribute(attrName, value));
+        else if (old && !value.isNull()) 
+            old->setValue(value); 
+    }
+};
+
+template<>
+struct SVGAnimatedPropertySynchronizer<false> {
+    static void synchronize(SVGElement*, const QualifiedName&, const AtomicString&)
+    {
+        // no-op, for types not inheriting from Element, thus nothing to synchronize
+    }
+};
+
+};
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPropertyTraits.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPropertyTraits.h
new file mode 100644
index 0000000000..4e34dbe310
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedPropertyTraits.h
@@ -0,0 +1,186 @@
+/*
+    Copyright (C) Research In Motion Limited 2010. All rights reserved.
+    Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef SVGAnimatedPropertyTraits_h
+#define SVGAnimatedPropertyTraits_h
+
+#if ENABLE(SVG)
+#include "FloatRect.h"
+#include "PlatformString.h"
+#include "SVGAngle.h"
+#include "SVGLength.h"
+#include "SVGLengthList.h"
+#include "SVGNumberList.h"
+#include "SVGPreserveAspectRatio.h"
+#include "SVGTransformList.h"
+
+namespace WebCore {
+
+template<typename Type>
+struct SVGAnimatedPropertyTraits : public Noncopyable { };
+
+// SVGAnimatedAngle
+template<>
+struct SVGAnimatedPropertyTraits<SVGAngle> : public Noncopyable {
+    typedef const SVGAngle& PassType;
+    typedef SVGAngle ReturnType;
+    typedef SVGAngle StoredType;
+
+    static ReturnType null() { return SVGAngle(); }
+    static ReturnType toReturnType(const StoredType& type) { return type; }
+    static String toString(PassType type) { return type.valueAsString(); }
+};
+
+// SVGAnimatedBoolean
+template<>
+struct SVGAnimatedPropertyTraits<bool> : public Noncopyable {
+    typedef const bool& PassType;
+    typedef bool ReturnType;
+    typedef bool StoredType;
+
+    static ReturnType null() { return false; }
+    static ReturnType toReturnType(const StoredType& type) { return type; }
+    static String toString(PassType type) { return type ? "true" : "false"; }
+};
+
+// SVGAnimatedEnumeration
+template<>
+struct SVGAnimatedPropertyTraits<int> : public Noncopyable {
+    typedef const int& PassType;
+    typedef int ReturnType;
+    typedef int StoredType;
+
+    static ReturnType null() { return 0; }
+    static ReturnType toReturnType(const StoredType& type) { return type; }
+    static String toString(PassType type) { return String::number(type); }
+};
+
+// SVGAnimatedInteger
+template<>
+struct SVGAnimatedPropertyTraits<long> : public Noncopyable {
+    typedef const long& PassType;
+    typedef long ReturnType;
+    typedef long StoredType;
+
+    static ReturnType null() { return 0l; }
+    static ReturnType toReturnType(const StoredType& type) { return type; }
+    static String toString(PassType type) { return String::number(type); }
+};
+
+// SVGAnimatedLength
+template<>
+struct SVGAnimatedPropertyTraits<SVGLength> : public Noncopyable {
+    typedef const SVGLength& PassType;
+    typedef SVGLength ReturnType;
+    typedef SVGLength StoredType;
+
+    static ReturnType null() { return SVGLength(); }
+    static ReturnType toReturnType(const StoredType& type) { return type; }
+    static String toString(PassType type) { return type.valueAsString(); }
+};
+
+// SVGAnimatedLengthList
+template<>
+struct SVGAnimatedPropertyTraits<SVGLengthList*> : public Noncopyable {
+    typedef SVGLengthList* PassType;
+    typedef SVGLengthList* ReturnType;
+    typedef RefPtr<SVGLengthList> StoredType;
+
+    static ReturnType null() { return 0; }
+    static ReturnType toReturnType(const StoredType& type) { return type.get(); }
+    static String toString(PassType type) { return type ? type->valueAsString() : String(); }
+};
+
+// SVGAnimatedNumber
+template<>
+struct SVGAnimatedPropertyTraits<float> : public Noncopyable {
+    typedef const float& PassType;
+    typedef float ReturnType;
+    typedef float StoredType;
+
+    static ReturnType null() { return 0.0f; }
+    static ReturnType toReturnType(const StoredType& type) { return type; }
+    static String toString(PassType type) { return String::number(type); }
+};
+
+// SVGAnimatedNumberList
+template<>
+struct SVGAnimatedPropertyTraits<SVGNumberList*> : public Noncopyable {
+    typedef SVGNumberList* PassType;
+    typedef SVGNumberList* ReturnType;
+    typedef RefPtr<SVGNumberList> StoredType;
+
+    static ReturnType null() { return 0; }
+    static ReturnType toReturnType(const StoredType& type) { return type.get(); }
+    static String toString(PassType type) { return type ? type->valueAsString() : String(); }
+};
+
+// SVGAnimatedPreserveAspectRatio
+template<>
+struct SVGAnimatedPropertyTraits<SVGPreserveAspectRatio> : public Noncopyable {
+    typedef const SVGPreserveAspectRatio& PassType;
+    typedef SVGPreserveAspectRatio ReturnType;
+    typedef SVGPreserveAspectRatio StoredType;
+
+    static ReturnType null() { return SVGPreserveAspectRatio(); }
+    static ReturnType toReturnType(const StoredType& type) { return type; }
+    static String toString(PassType type) { return type.valueAsString(); }
+};
+
+// SVGAnimatedRect
+template<>
+struct SVGAnimatedPropertyTraits<FloatRect> : public Noncopyable {
+    typedef const FloatRect& PassType;
+    typedef FloatRect ReturnType;
+    typedef FloatRect StoredType;
+
+    static ReturnType null() { return FloatRect(); }
+    static ReturnType toReturnType(const StoredType& type) { return type; }
+    static String toString(PassType type) { return String::format("%f %f %f %f", type.x(), type.y(), type.width(), type.height()); }
+};
+
+// SVGAnimatedString
+template<>
+struct SVGAnimatedPropertyTraits<String> : public Noncopyable {
+    typedef const String& PassType;
+    typedef String ReturnType;
+    typedef String StoredType;
+
+    static ReturnType null() { return String(); }
+    static ReturnType toReturnType(const StoredType& type) { return type; }
+    static String toString(PassType type) { return type; }
+};
+
+// SVGAnimatedTransformList
+template<>
+struct SVGAnimatedPropertyTraits<SVGTransformList*> : public Noncopyable {
+    typedef SVGTransformList* PassType;
+    typedef SVGTransformList* ReturnType;
+    typedef RefPtr<SVGTransformList> StoredType;
+
+    static ReturnType null() { return 0; }
+    static ReturnType toReturnType(const StoredType& type) { return type.get(); }
+    static String toString(PassType type) { return type ? type->valueAsString() : String(); }
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedTemplate.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedTemplate.h
index e7c49c157b..589d7244e5 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedTemplate.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedTemplate.h
@@ -22,9 +22,7 @@
 #define SVGAnimatedTemplate_h
 
 #if ENABLE(SVG)
-#include "AtomicString.h"
-#include "FloatRect.h"
-#include "SVGLength.h"
+#include "SVGAnimatedPropertyTraits.h"
 #include <wtf/HashMap.h>
 
 namespace WebCore {
@@ -101,18 +99,23 @@ namespace WebCore {
         }
     };
  
-    template<typename BareType>
-    class SVGAnimatedTemplate : public RefCounted<SVGAnimatedTemplate<BareType> > {
+    template<typename AnimatedType>
+    class SVGAnimatedTemplate : public RefCounted<SVGAnimatedTemplate<AnimatedType> > {
     public:
+        typedef typename SVGAnimatedPropertyTraits<AnimatedType>::PassType PassType;
+        typedef typename SVGAnimatedPropertyTraits<AnimatedType>::ReturnType ReturnType;
+
         virtual ~SVGAnimatedTemplate() { forgetWrapper(this); }
 
-        virtual BareType baseVal() const = 0;
-        virtual void setBaseVal(BareType) = 0;
+        virtual ReturnType baseVal() const = 0;
+        virtual void setBaseVal(PassType) = 0;
+
+        virtual ReturnType animVal() const = 0;
+        virtual void setAnimVal(PassType) = 0;
 
-        virtual BareType animVal() const = 0;
-        virtual void setAnimVal(BareType) = 0;
+        virtual const QualifiedName& associatedAttributeName() const = 0;
 
-        typedef HashMap<SVGAnimatedTypeWrapperKey, SVGAnimatedTemplate<BareType>*, SVGAnimatedTypeWrapperKeyHash, SVGAnimatedTypeWrapperKeyHashTraits > ElementToWrapperMap;
+        typedef HashMap<SVGAnimatedTypeWrapperKey, SVGAnimatedTemplate<AnimatedType>*, SVGAnimatedTypeWrapperKeyHash, SVGAnimatedTypeWrapperKeyHashTraits > ElementToWrapperMap;
         typedef typename ElementToWrapperMap::const_iterator ElementToWrapperMapIterator;
 
         static ElementToWrapperMap* wrapperCache()
@@ -121,7 +124,7 @@ namespace WebCore {
             return s_wrapperCache;
         }
 
-        static void forgetWrapper(SVGAnimatedTemplate<BareType>* wrapper)
+        static void forgetWrapper(SVGAnimatedTemplate<AnimatedType>* wrapper)
         {
             ElementToWrapperMap* cache = wrapperCache();
             ElementToWrapperMapIterator itr = cache->begin();
@@ -133,113 +136,27 @@ namespace WebCore {
                 }
             }
         }
-
-        const QualifiedName& associatedAttributeName() const { return m_associatedAttributeName; }
-
-    protected:
-        SVGAnimatedTemplate(const QualifiedName& attributeName)
-            : m_associatedAttributeName(attributeName)
-        {
-        }
-
-    private:
-        const QualifiedName& m_associatedAttributeName;
     };
 
-    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
+    template<typename AnimatedType>
     class SVGAnimatedProperty;
 
-    template<typename OwnerType, typename AnimatedType, const char* TagName, const char* PropertyName, typename Type, typename OwnerElement> 
-    PassRefPtr<Type> lookupOrCreateWrapper(const SVGAnimatedProperty<OwnerType, AnimatedType, TagName, PropertyName>& creator,
-                                           const OwnerElement* element, const QualifiedName& attrName, const AtomicString& attrIdentifier)
+    template<typename AnimatedType, typename AnimatedTearOff>
+    PassRefPtr<AnimatedTearOff> lookupOrCreateWrapper(SVGElement* element, SVGAnimatedProperty<AnimatedType>& creator, const QualifiedName& attrName)
     {
-        SVGAnimatedTypeWrapperKey key(element, attrIdentifier);
-        RefPtr<Type> wrapper = static_cast<Type*>(Type::wrapperCache()->get(key));
+        SVGAnimatedTypeWrapperKey key(element, attrName.localName());
+        RefPtr<AnimatedTearOff> wrapper = static_cast<AnimatedTearOff*>(AnimatedTearOff::wrapperCache()->get(key));
 
         if (!wrapper) {
-            wrapper = Type::create(creator, element, attrName);
-            element->propertyController().setPropertyNeedsSynchronization(attrName);
-            Type::wrapperCache()->set(key, wrapper.get());
+            wrapper = AnimatedTearOff::create(creator, element);
+            AnimatedTearOff::wrapperCache()->set(key, wrapper.get());
         }
 
         return wrapper.release();
     }
 
-    // Default implementation for pointer types
-    template<typename Type>
-    struct SVGAnimatedTypeValue : Noncopyable {
-        typedef RefPtr<Type> StorableType;
-        typedef Type* DecoratedType;
-
-        static Type null() { return 0; }
-        static AtomicString toString(Type type) { return type ? AtomicString(type->valueAsString()) : nullAtom; }
-    };
-
-    template<>
-    struct SVGAnimatedTypeValue<bool> : Noncopyable {
-        typedef bool StorableType;
-        typedef bool DecoratedType;
-
-        static bool null() { return false; }
-        static AtomicString toString(bool type) { return type ? "true" : "false"; }
-    };
-
-    template<>
-    struct SVGAnimatedTypeValue<int> : Noncopyable {
-        typedef int StorableType;
-        typedef int DecoratedType;
-
-        static int null() { return 0; }
-        static AtomicString toString(int type) { return String::number(type); }
-    };
-
-    template<>
-    struct SVGAnimatedTypeValue<long> : Noncopyable {
-        typedef long StorableType;
-        typedef long DecoratedType;
-
-        static long null() { return 0l; }
-        static AtomicString toString(long type) { return String::number(type); }
-    };
-
-    template<>
-    struct SVGAnimatedTypeValue<SVGLength> : Noncopyable {
-        typedef SVGLength StorableType;
-        typedef SVGLength DecoratedType;
-
-        static SVGLength null() { return SVGLength(); }
-        static AtomicString toString(const SVGLength& type) { return type.valueAsString(); }
-    };
-
-    template<>
-    struct SVGAnimatedTypeValue<float> : Noncopyable {
-        typedef float StorableType;
-        typedef float DecoratedType;
-
-        static float null() { return 0.0f; }
-        static AtomicString toString(float type) { return String::number(type); }
-    };
-
-    template<>
-    struct SVGAnimatedTypeValue<FloatRect> : Noncopyable {
-        typedef FloatRect StorableType;
-        typedef FloatRect DecoratedType;
-
-        static FloatRect null() { return FloatRect(); }
-        static AtomicString toString(const FloatRect& type) { return String::format("%f %f %f %f", type.x(), type.y(), type.width(), type.height()); }
-    };
-
-    template<>
-    struct SVGAnimatedTypeValue<String> : Noncopyable {
-        typedef String StorableType;
-        typedef String DecoratedType;
-
-        static String null() { return String(); }
-        static AtomicString toString(const String& type) { return type; }
-    };
-
     // Common type definitions, to ease IDL generation.
-    typedef SVGAnimatedTemplate<SVGAngle*> SVGAnimatedAngle;
+    typedef SVGAnimatedTemplate<SVGAngle> SVGAnimatedAngle;
     typedef SVGAnimatedTemplate<bool> SVGAnimatedBoolean;
     typedef SVGAnimatedTemplate<int> SVGAnimatedEnumeration;
     typedef SVGAnimatedTemplate<long> SVGAnimatedInteger;
@@ -247,12 +164,12 @@ namespace WebCore {
     typedef SVGAnimatedTemplate<SVGLengthList*> SVGAnimatedLengthList;
     typedef SVGAnimatedTemplate<float> SVGAnimatedNumber;
     typedef SVGAnimatedTemplate<SVGNumberList*> SVGAnimatedNumberList; 
-    typedef SVGAnimatedTemplate<SVGPreserveAspectRatio*> SVGAnimatedPreserveAspectRatio;
+    typedef SVGAnimatedTemplate<SVGPreserveAspectRatio> SVGAnimatedPreserveAspectRatio;
     typedef SVGAnimatedTemplate<FloatRect> SVGAnimatedRect;
     typedef SVGAnimatedTemplate<String> SVGAnimatedString;
     typedef SVGAnimatedTemplate<SVGTransformList*> SVGAnimatedTransformList;
 
 }
 
-#endif // ENABLE(SVG)
-#endif // SVGAnimatedTemplate_h
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp
index 67e32e04d0..7e0785829f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp
@@ -1,12 +1,10 @@
 /*
-    Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
+    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
     Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -53,7 +51,6 @@ SVGAnimationElement::SVGAnimationElement(const QualifiedName& tagName, Document*
     : SVGSMILElement(tagName, doc)
     , SVGTests()
     , SVGExternalResourcesRequired() 
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
     , m_animationValid(false)
 {
 }
@@ -61,7 +58,7 @@ SVGAnimationElement::SVGAnimationElement(const QualifiedName& tagName, Document*
 SVGAnimationElement::~SVGAnimationElement()
 {
 }
-    
+
 static void parseKeyTimes(const String& parse, Vector<float>& result, bool verifyOrder)
 {
     result.clear();
@@ -143,6 +140,14 @@ void SVGAnimationElement::attributeChanged(Attribute* attr, bool preserveDecls)
     SVGSMILElement::attributeChanged(attr, preserveDecls);
 }
 
+void SVGAnimationElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGSMILElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName() || SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+}
+
 float SVGAnimationElement::getStartTime() const
 {
     return narrowPrecisionToFloat(intervalBegin().value());
@@ -311,9 +316,9 @@ void SVGAnimationElement::setTargetAttributeAnimatedValue(const String& value)
         static_cast<SVGStyledElement*>(target)->setInstanceUpdatesBlocked(false);
     
     // If the target element is used in an <use> instance tree, update that as well.
-    HashSet<SVGElementInstance*> instances = target->instancesForElement();
-    HashSet<SVGElementInstance*>::iterator end = instances.end();
-    for (HashSet<SVGElementInstance*>::iterator it = instances.begin(); it != end; ++it) {
+    const HashSet<SVGElementInstance*>& instances = target->instancesForElement();
+    const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
+    for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
         SVGElement* shadowTreeElement = (*it)->shadowTreeElement();
         ASSERT(shadowTreeElement);
         if (isCSS)
@@ -471,6 +476,17 @@ void SVGAnimationElement::startedActiveInterval()
     if (!hasValidTarget())
         return;
 
+    // These validations are appropriate for all animation modes.
+    if (hasAttribute(SVGNames::keyPointsAttr) && m_keyPoints.size() != m_keyTimes.size())
+        return;
+
+    CalcMode calcMode = this->calcMode();
+    if (calcMode == CalcModeSpline) {
+        unsigned num = m_keySplines.size() + 1;
+        if ((hasAttribute(SVGNames::keyPointsAttr) && m_keyPoints.size() != num) || m_values.size() != num)
+            return;
+    }
+
     AnimationMode animationMode = this->animationMode();
     if (animationMode == NoAnimation)
         return;
@@ -485,16 +501,15 @@ void SVGAnimationElement::startedActiveInterval()
     else if (animationMode == ByAnimation)
         m_animationValid = calculateFromAndByValues(String(), byValue());
     else if (animationMode == ValuesAnimation) {
-        CalcMode calcMode = this->calcMode();
         m_animationValid = m_values.size() > 1
             && (calcMode == CalcModePaced || !hasAttribute(SVGNames::keyTimesAttr) || hasAttribute(SVGNames::keyPointsAttr) || (m_values.size() == m_keyTimes.size()))
             && (calcMode == CalcModeDiscrete || !m_keyTimes.size() || m_keyTimes.last() == 1.0)
-            && (calcMode != CalcModeSpline || (m_keySplines.size() && (m_keySplines.size() == m_values.size() - 1) || m_keySplines.size() == m_keyPoints.size() - 1))
+            && (calcMode != CalcModeSpline || ((m_keySplines.size() && (m_keySplines.size() == m_values.size() - 1)) || m_keySplines.size() == m_keyPoints.size() - 1))
             && (!hasAttribute(SVGNames::keyPointsAttr) || (m_keyTimes.size() > 1 && m_keyTimes.size() == m_keyPoints.size()));
         if (calcMode == CalcModePaced && m_animationValid)
             calculateKeyTimesForCalcModePaced();
     } else if (animationMode == PathAnimation)
-        m_animationValid = calcMode() == CalcModePaced || !hasAttribute(SVGNames::keyPointsAttr) || (m_keyTimes.size() > 1 && m_keyTimes.size() == m_keyPoints.size());
+        m_animationValid = calcMode == CalcModePaced || !hasAttribute(SVGNames::keyPointsAttr) || (m_keyTimes.size() > 1 && m_keyTimes.size() == m_keyPoints.size());
 }
     
 void SVGAnimationElement::updateAnimation(float percent, unsigned repeat, SVGSMILElement* resultElement)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h
index b0b091b72b..27cec88e80 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h
@@ -46,9 +46,10 @@ namespace WebCore {
     public:
         SVGAnimationElement(const QualifiedName&, Document*);
         virtual ~SVGAnimationElement();
-        
+
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void attributeChanged(Attribute*, bool preserveDecls);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         // SVGAnimationElement
         float getStartTime() const;
@@ -106,9 +107,7 @@ namespace WebCore {
         
     protected:
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGAnimationElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGAnimationElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
 
         bool m_animationValid;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.idl
index afa3cbb5c7..e221545072 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG_ANIMATION] SVGAnimationElement : SVGElement,
+    interface [Conditional=SVG_ANIMATION, OmitConstructor] SVGAnimationElement : SVGElement,
                                                       SVGTests,
                                                       SVGExternalResourcesRequired,
                                                       ElementTimeControl {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp
index 23292991d6..10da742a3f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -38,10 +36,9 @@ SVGCircleElement::SVGCircleElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
-    , m_cx(this, SVGNames::cxAttr, LengthModeWidth)
-    , m_cy(this, SVGNames::cyAttr, LengthModeHeight)
-    , m_r(this, SVGNames::rAttr, LengthModeOther)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_cx(LengthModeWidth)
+    , m_cy(LengthModeHeight)
+    , m_r(LengthModeOther)
 {
 }
 
@@ -86,6 +83,28 @@ void SVGCircleElement::svgAttributeChanged(const QualifiedName& attrName)
         renderer()->setNeedsLayout(true);
 }
 
+void SVGCircleElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledTransformableElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeCx();
+        synchronizeCy();
+        synchronizeR();
+        synchronizeExternalResourcesRequired();
+        return;
+    }
+
+    if (attrName == SVGNames::cxAttr)
+        synchronizeCx();
+    else if (attrName == SVGNames::cyAttr)
+        synchronizeCy();
+    else if (attrName == SVGNames::rAttr)
+        synchronizeR();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+}
+
 Path SVGCircleElement::toPathData() const
 {
     return Path::createCircle(FloatPoint(cx().value(this), cy().value(this)), r().value(this));
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.h b/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.h
index 69b015de9e..027918c34a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.h
@@ -41,6 +41,7 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         virtual Path toPathData() const;
 
@@ -48,14 +49,12 @@ namespace WebCore {
         virtual bool hasRelativeValues() const;
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGNames::circleTagString, SVGNames::cxAttrString, SVGLength, Cx, cx)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGNames::circleTagString, SVGNames::cyAttrString, SVGLength, Cy, cy)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGNames::circleTagString, SVGNames::rAttrString, SVGLength, R, r)
+        DECLARE_ANIMATED_PROPERTY(SVGCircleElement, SVGNames::cxAttr, SVGLength, Cx, cx)
+        DECLARE_ANIMATED_PROPERTY(SVGCircleElement, SVGNames::cyAttr, SVGLength, Cy, cy)
+        DECLARE_ANIMATED_PROPERTY(SVGCircleElement, SVGNames::rAttr, SVGLength, R, r)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGCircleElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp
index bbeac910b8..694e0bc789 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007, 2008 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+    Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -28,6 +27,7 @@
 #include "CSSStyleSelector.h"
 #include "Document.h"
 #include "MappedAttribute.h"
+#include "RenderSVGResourceClipper.h"
 #include "SVGNames.h"
 #include "SVGTransformList.h"
 #include "SVGUnitTypes.h"
@@ -39,8 +39,7 @@ SVGClipPathElement::SVGClipPathElement(const QualifiedName& tagName, Document* d
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
-    , m_clipPathUnits(this, SVGNames::clipPathUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_clipPathUnits(SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
 {
 }
 
@@ -70,54 +69,39 @@ void SVGClipPathElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledTransformableElement::svgAttributeChanged(attrName);
 
-    if (!m_clipper)
-        return;
-
     if (attrName == SVGNames::clipPathUnitsAttr ||
         SVGTests::isKnownAttribute(attrName) || 
         SVGLangSpace::isKnownAttribute(attrName) ||
         SVGExternalResourcesRequired::isKnownAttribute(attrName) ||
         SVGStyledTransformableElement::isKnownAttribute(attrName))
-        m_clipper->invalidate();
+        invalidateCanvasResources();
 }
 
-void SVGClipPathElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+void SVGClipPathElement::synchronizeProperty(const QualifiedName& attrName)
 {
-    SVGStyledTransformableElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    SVGStyledTransformableElement::synchronizeProperty(attrName);
 
-    if (!m_clipper)
+    if (attrName == anyQName()) {
+        synchronizeClipPathUnits();
+        synchronizeExternalResourcesRequired();
         return;
+    }
 
-    m_clipper->invalidate();
+    if (attrName == SVGNames::clipPathUnitsAttr)
+        synchronizeClipPathUnits();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
 }
 
-SVGResource* SVGClipPathElement::canvasResource()
+void SVGClipPathElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    if (!m_clipper)
-        m_clipper = SVGResourceClipper::create();
-    else
-        m_clipper->resetClipData();
-
-    bool bbox = clipPathUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX;
-
-    RefPtr<RenderStyle> clipPathStyle = styleForRenderer(); // FIXME: Manual style resolution is a hack
-    for (Node* n = firstChild(); n; n = n->nextSibling()) {
-        if (n->isSVGElement() && static_cast<SVGElement*>(n)->isStyledTransformable()) {
-            SVGStyledTransformableElement* styled = static_cast<SVGStyledTransformableElement*>(n);
-            RefPtr<RenderStyle> pathStyle = document()->styleSelector()->styleForElement(styled, clipPathStyle.get());
-            if (pathStyle->display() != NONE) {
-                Path pathData = styled->toClipPath();
-                if (!pathData.isEmpty())
-                    m_clipper->addClipData(pathData, pathStyle->svgStyle()->clipRule(), bbox);
-            }
-        }
-    }
-    if (m_clipper->clipData().isEmpty()) {
-        Path pathData;
-        pathData.addRect(FloatRect());
-        m_clipper->addClipData(pathData, RULE_EVENODD, bbox);
-    }
-    return m_clipper.get();
+    SVGStyledTransformableElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    invalidateCanvasResources();
+}
+
+RenderObject* SVGClipPathElement::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    return new (arena) RenderSVGResourceClipper(this);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.h b/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.h
index 60791591ca..dbf538058e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.h
@@ -22,43 +22,38 @@
 #define SVGClipPathElement_h
 
 #if ENABLE(SVG)
+#include "RenderObject.h"
 #include "SVGExternalResourcesRequired.h"
 #include "SVGLangSpace.h"
-#include "SVGResourceClipper.h"
 #include "SVGStyledTransformableElement.h"
 #include "SVGTests.h"
 
 namespace WebCore {
+class SVGClipPathElement : public SVGStyledTransformableElement,
+                           public SVGTests,
+                           public SVGLangSpace,
+                           public SVGExternalResourcesRequired {
+public:
+    SVGClipPathElement(const QualifiedName&, Document*);
+    virtual ~SVGClipPathElement();
 
-    class SVGClipPathElement : public SVGStyledTransformableElement,
-                               public SVGTests,
-                               public SVGLangSpace,
-                               public SVGExternalResourcesRequired {
-    public:
-        SVGClipPathElement(const QualifiedName&, Document*);
-        virtual ~SVGClipPathElement();
+    virtual bool isValid() const { return SVGTests::isValid(); }
 
-        virtual bool isValid() const { return SVGTests::isValid(); }
-        virtual bool rendererIsNeeded(RenderStyle*) { return false; }
+    virtual void parseMappedAttribute(MappedAttribute*);
+    virtual void svgAttributeChanged(const QualifiedName&);
+    virtual void synchronizeProperty(const QualifiedName&);
+    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
-        virtual void parseMappedAttribute(MappedAttribute*);
-        virtual void svgAttributeChanged(const QualifiedName&);
-        virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-        virtual SVGResource* canvasResource();
+private:
+    DECLARE_ANIMATED_PROPERTY(SVGClipPathElement, SVGNames::clipPathUnitsAttr, int, ClipPathUnits, clipPathUnits)
 
-    private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGClipPathElement, SVGNames::clipPathTagString, SVGNames::clipPathUnitsAttrString, int, ClipPathUnits, clipPathUnits)
+    // SVGExternalResourcesRequired
+    DECLARE_ANIMATED_PROPERTY(SVGClipPathElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
+};
 
-        // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGClipPathElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+}
 
-        RefPtr<SVGResourceClipper> m_clipper;
-    };
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG)
+#endif
 #endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGColor.cpp b/src/3rdparty/webkit/WebCore/svg/SVGColor.cpp
index d819ebf601..ede0b0abde 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGColor.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGColor.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGColor.idl b/src/3rdparty/webkit/WebCore/svg/SVGColor.idl
index 320a9b76a0..32a26836e6 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGColor.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGColor.idl
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -23,7 +21,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, GenerateConstructor] SVGColor : css::CSSValue {
+    interface [Conditional=SVG] SVGColor : css::CSSValue {
         // Color Types
         const unsigned short SVG_COLORTYPE_UNKNOWN           = 0;
         const unsigned short SVG_COLORTYPE_RGBCOLOR          = 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.cpp
index e479fae049..f61b2ea0d2 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -32,17 +30,13 @@
 
 namespace WebCore {
 
-char SVGComponentTransferFunctionElementIdentifier[] = "SVGComponentTransferFunctionElement";
-
 SVGComponentTransferFunctionElement::SVGComponentTransferFunctionElement(const QualifiedName& tagName, Document* doc)
     : SVGElement(tagName, doc)
-    , m_type(this, SVGNames::typeAttr, FECOMPONENTTRANSFER_TYPE_UNKNOWN)
-    , m_tableValues(this, SVGNames::tableValuesAttr, SVGNumberList::create(SVGNames::tableValuesAttr))
-    , m_slope(this, SVGNames::slopeAttr, 1.0f)
-    , m_intercept(this, SVGNames::interceptAttr)
-    , m_amplitude(this, SVGNames::amplitudeAttr, 1.0f)
-    , m_exponent(this, SVGNames::exponentAttr, 1.0f)
-    , m_offset(this, SVGNames::offsetAttr)
+    , m_type(FECOMPONENTTRANSFER_TYPE_UNKNOWN)
+    , m_tableValues(SVGNumberList::create(SVGNames::tableValuesAttr))
+    , m_slope(1.0f)
+    , m_amplitude(1.0f)
+    , m_exponent(1.0f)
 {
 }
 
@@ -53,8 +47,7 @@ SVGComponentTransferFunctionElement::~SVGComponentTransferFunctionElement()
 void SVGComponentTransferFunctionElement::parseMappedAttribute(MappedAttribute* attr)
 {
     const String& value = attr->value();
-    if (attr->name() == SVGNames::typeAttr)
-    {
+    if (attr->name() == SVGNames::typeAttr) {
         if (value == "identity")
             setTypeBaseValue(FECOMPONENTTRANSFER_TYPE_IDENTITY);
         else if (value == "table")
@@ -82,6 +75,37 @@ void SVGComponentTransferFunctionElement::parseMappedAttribute(MappedAttribute*
         SVGElement::parseMappedAttribute(attr);
 }
 
+void SVGComponentTransferFunctionElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeType();
+        synchronizeTableValues();
+        synchronizeSlope();
+        synchronizeIntercept();
+        synchronizeAmplitude();
+        synchronizeExponent();
+        synchronizeOffset();
+        return;
+    }
+
+    if (attrName == SVGNames::typeAttr)
+        synchronizeType();
+    else if (attrName == SVGNames::tableValuesAttr)
+        synchronizeTableValues();
+    else if (attrName == SVGNames::slopeAttr)
+        synchronizeSlope();
+    else if (attrName == SVGNames::interceptAttr)
+        synchronizeIntercept();
+    else if (attrName == SVGNames::amplitudeAttr)
+        synchronizeAmplitude();
+    else if (attrName == SVGNames::exponentAttr)
+        synchronizeExponent();
+    else if (attrName == SVGNames::offsetAttr)
+        synchronizeOffset();
+}
+
 ComponentTransferFunction SVGComponentTransferFunctionElement::transferFunction() const
 {
     ComponentTransferFunction func;
@@ -102,6 +126,4 @@ ComponentTransferFunction SVGComponentTransferFunctionElement::transferFunction(
 
 }
 
-// vim:ts=4:noet
 #endif // ENABLE(SVG)
-
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.h b/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.h
index a26c953bc8..9862a99978 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -31,25 +29,24 @@
 
 namespace WebCore {
 
-    extern char SVGComponentTransferFunctionElementIdentifier[];
-
     class SVGComponentTransferFunctionElement : public SVGElement {
     public:
         SVGComponentTransferFunctionElement(const QualifiedName&, Document*);
         virtual ~SVGComponentTransferFunctionElement();
 
-        virtual void parseMappedAttribute(MappedAttribute* attr);
+        virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         
         ComponentTransferFunction transferFunction() const;
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGComponentTransferFunctionElement, SVGComponentTransferFunctionElementIdentifier, SVGNames::typeAttrString, int, Type, type)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGComponentTransferFunctionElement, SVGComponentTransferFunctionElementIdentifier, SVGNames::tableValuesAttrString, SVGNumberList, TableValues, tableValues)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGComponentTransferFunctionElement, SVGComponentTransferFunctionElementIdentifier, SVGNames::slopeAttrString, float, Slope, slope)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGComponentTransferFunctionElement, SVGComponentTransferFunctionElementIdentifier, SVGNames::interceptAttrString, float, Intercept, intercept)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGComponentTransferFunctionElement, SVGComponentTransferFunctionElementIdentifier, SVGNames::amplitudeAttrString, float, Amplitude, amplitude)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGComponentTransferFunctionElement, SVGComponentTransferFunctionElementIdentifier, SVGNames::exponentAttrString, float, Exponent, exponent)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGComponentTransferFunctionElement, SVGComponentTransferFunctionElementIdentifier, SVGNames::offsetAttrString, float, Offset, offset)
+        DECLARE_ANIMATED_PROPERTY(SVGComponentTransferFunctionElement, SVGNames::typeAttr, int, Type, type)
+        DECLARE_ANIMATED_PROPERTY(SVGComponentTransferFunctionElement, SVGNames::tableValuesAttr, SVGNumberList*, TableValues, tableValues)
+        DECLARE_ANIMATED_PROPERTY(SVGComponentTransferFunctionElement, SVGNames::slopeAttr, float, Slope, slope)
+        DECLARE_ANIMATED_PROPERTY(SVGComponentTransferFunctionElement, SVGNames::interceptAttr, float, Intercept, intercept)
+        DECLARE_ANIMATED_PROPERTY(SVGComponentTransferFunctionElement, SVGNames::amplitudeAttr, float, Amplitude, amplitude)
+        DECLARE_ANIMATED_PROPERTY(SVGComponentTransferFunctionElement, SVGNames::exponentAttr, float, Exponent, exponent)
+        DECLARE_ANIMATED_PROPERTY(SVGComponentTransferFunctionElement, SVGNames::offsetAttr, float, Offset, offset)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.idl
index 0868175c74..950f77d646 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGComponentTransferFunctionElement : SVGElement {
+    interface [Conditional=SVG&FILTERS] SVGComponentTransferFunctionElement : SVGElement {
         // Component Transfer Types
         const unsigned short SVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN  = 0;
         const unsigned short SVG_FECOMPONENTTRANSFER_TYPE_IDENTITY = 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp
index b282aa3c54..e904516dea 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -38,10 +36,8 @@ SVGCursorElement::SVGCursorElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGExternalResourcesRequired()
     , SVGURIReference()
-    , m_x(this, SVGNames::xAttr, LengthModeWidth)
-    , m_y(this, SVGNames::yAttr, LengthModeHeight)
-    , m_href(this, XLinkNames::hrefAttr)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_x(LengthModeWidth)
+    , m_y(LengthModeHeight)
 {
 }
 
@@ -98,6 +94,28 @@ void SVGCursorElement::svgAttributeChanged(const QualifiedName& attrName)
     }
 }
 
+void SVGCursorElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeX();
+        synchronizeY();
+        synchronizeExternalResourcesRequired();
+        synchronizeHref();
+        return;
+    }
+
+    if (attrName == SVGNames::xAttr)
+        synchronizeX();
+    else if (attrName == SVGNames::yAttr)
+        synchronizeY();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+    else if (SVGURIReference::isKnownAttribute(attrName))
+        synchronizeHref();
+}
+
 void SVGCursorElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
     SVGElement::addSubresourceAttributeURLs(urls);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.h b/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.h
index ee919a4762..097812499d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.h
@@ -45,20 +45,19 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGNames::cursorTagString, SVGNames::xAttrString, SVGLength, X, x)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGNames::cursorTagString, SVGNames::yAttrString, SVGLength, Y, y)
+        DECLARE_ANIMATED_PROPERTY(SVGCursorElement, SVGNames::xAttr, SVGLength, X, x)
+        DECLARE_ANIMATED_PROPERTY(SVGCursorElement, SVGNames::yAttr, SVGLength, Y, y)
 
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+        DECLARE_ANIMATED_PROPERTY(SVGCursorElement, XLinkNames::hrefAttr, String, Href, href)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGCursorElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
 
         HashSet<SVGElement*> m_clients;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.cpp
index c03c09b26e..e7bf51d516 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -34,7 +32,6 @@ SVGDefsElement::SVGDefsElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -52,6 +49,14 @@ RenderObject* SVGDefsElement::createRenderer(RenderArena* arena, RenderStyle*)
     return new (arena) RenderSVGHiddenContainer(this);
 }
 
+void SVGDefsElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledTransformableElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName() || SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.h b/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.h
index 4bb206e4f2..cb62d458f3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.h
@@ -40,12 +40,11 @@ namespace WebCore {
         virtual bool isValid() const;
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+        virtual void synchronizeProperty(const QualifiedName&);
 
     private:
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGDefsElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGDefsElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDescElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGDescElement.cpp
index 0297ad28eb..319dfda905 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGDescElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGDescElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDescElement.h b/src/3rdparty/webkit/WebCore/svg/SVGDescElement.h
index c8bc501c0a..846a23e344 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGDescElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGDescElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDocument.cpp b/src/3rdparty/webkit/WebCore/svg/SVGDocument.cpp
index fe8ab80429..2264a112b0 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGDocument.cpp
@@ -36,7 +36,7 @@
 namespace WebCore {
 
 SVGDocument::SVGDocument(Frame* frame)
-    : Document(frame, false)
+    : Document(frame, false, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDocument.idl b/src/3rdparty/webkit/WebCore/svg/SVGDocument.idl
index 61f4e2eb7f..26b70d1089 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGDocument.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGDocument.idl
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDocumentExtensions.cpp b/src/3rdparty/webkit/WebCore/svg/SVGDocumentExtensions.cpp
index 61645f4ee8..ad74ec5966 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGDocumentExtensions.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGDocumentExtensions.cpp
@@ -34,6 +34,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "Page.h"
+#include "SVGSMILElement.h"
 #include "SVGSVGElement.h"
 #include "SMILTimeContainer.h"
 #include "XMLTokenizer.h"
@@ -86,6 +87,17 @@ void SVGDocumentExtensions::unpauseAnimations()
         (*itr)->unpauseAnimations();
 }
 
+bool SVGDocumentExtensions::sampleAnimationAtTime(const String& elementId, SVGSMILElement* element, double time)
+{
+    ASSERT(element);
+    SMILTimeContainer* container = element->timeContainer();
+    if (!container || container->isPaused())
+        return false;
+
+    container->sampleAnimationAtTime(elementId, time);
+    return true;
+}
+
 void SVGDocumentExtensions::reportWarning(const String& message)
 {
     if (Frame* frame = m_doc->frame())
@@ -123,13 +135,13 @@ bool SVGDocumentExtensions::isPendingResource(const AtomicString& id) const
     return m_pendingResources.contains(id);
 }
 
-std::auto_ptr<HashSet<SVGStyledElement*> > SVGDocumentExtensions::removePendingResource(const AtomicString& id)
+PassOwnPtr<HashSet<SVGStyledElement*> > SVGDocumentExtensions::removePendingResource(const AtomicString& id)
 {
     ASSERT(m_pendingResources.contains(id));
 
-    std::auto_ptr<HashSet<SVGStyledElement*> > set(m_pendingResources.get(id));
+    OwnPtr<HashSet<SVGStyledElement*> > set(m_pendingResources.get(id));
     m_pendingResources.remove(id);
-    return set;
+    return set.release();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDocumentExtensions.h b/src/3rdparty/webkit/WebCore/svg/SVGDocumentExtensions.h
index cd20a30fce..8d37226a22 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGDocumentExtensions.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGDocumentExtensions.h
@@ -24,26 +24,23 @@
 #define SVGDocumentExtensions_h
 
 #if ENABLE(SVG)
-#include <memory>
 
+#include <wtf/PassOwnPtr.h>
 #include <wtf/HashSet.h>
 #include <wtf/HashMap.h>
 
 #include "StringHash.h"
 #include "StringImpl.h"
-#include "SVGAnimatedTemplate.h"
 
 namespace WebCore {
 
 class Document;
-class EventListener;
-class Node;
 class String;
-class SVGElementInstance;
 class SVGStyledElement;
+class SVGSMILElement;
 class SVGSVGElement;
 
-class SVGDocumentExtensions {
+class SVGDocumentExtensions : public Noncopyable {
 public:
     SVGDocumentExtensions(Document*);
     ~SVGDocumentExtensions();
@@ -54,6 +51,7 @@ public:
     void startAnimations();
     void pauseAnimations();
     void unpauseAnimations();
+    bool sampleAnimationAtTime(const String& elementId, SVGSMILElement*, double time);
 
     void reportWarning(const String&);
     void reportError(const String&);
@@ -66,66 +64,16 @@ private:
     SVGDocumentExtensions(const SVGDocumentExtensions&);
     SVGDocumentExtensions& operator=(const SVGDocumentExtensions&);
 
-    template<typename ValueType>
-    HashMap<const SVGElement*, HashMap<StringImpl*, ValueType>*>* baseValueMap() const
-    {
-        static HashMap<const SVGElement*, HashMap<StringImpl*, ValueType>*>* s_baseValueMap = new HashMap<const SVGElement*, HashMap<StringImpl*, ValueType>*>();
-        return s_baseValueMap;
-    }
-
 public:
     // This HashMap contains a list of pending resources. Pending resources, are such
     // which are referenced by any object in the SVG document, but do NOT exist yet.
     // For instance, dynamically build gradients / patterns / clippers...
     void addPendingResource(const AtomicString& id, SVGStyledElement*);
     bool isPendingResource(const AtomicString& id) const;
-    std::auto_ptr<HashSet<SVGStyledElement*> > removePendingResource(const AtomicString& id);
-
-    // Used by the ANIMATED_PROPERTY_* macros
-    template<typename ValueType>
-    ValueType baseValue(const SVGElement* element, const AtomicString& propertyName) const
-    {
-        HashMap<StringImpl*, ValueType>* propertyMap = baseValueMap<ValueType>()->get(element);
-        if (propertyMap)
-            return propertyMap->get(propertyName.impl());
-
-        return SVGAnimatedTypeValue<ValueType>::null();
-    }
-
-    template<typename ValueType>
-    void setBaseValue(const SVGElement* element, const AtomicString& propertyName, ValueType newValue)
-    {
-        HashMap<StringImpl*, ValueType>* propertyMap = baseValueMap<ValueType>()->get(element);
-        if (!propertyMap) {
-            propertyMap = new HashMap<StringImpl*, ValueType>();
-            baseValueMap<ValueType>()->set(element, propertyMap);
-        }
-
-        propertyMap->set(propertyName.impl(), newValue);
-    }
-
-    template<typename ValueType>
-    void removeBaseValue(const SVGElement* element, const AtomicString& propertyName)
-    {
-        HashMap<StringImpl*, ValueType>* propertyMap = baseValueMap<ValueType>()->get(element);
-        if (!propertyMap)
-            return;
-
-        propertyMap->remove(propertyName.impl());
-    }
-
-    template<typename ValueType>
-    bool hasBaseValue(const SVGElement* element, const AtomicString& propertyName) const
-    {
-        HashMap<StringImpl*, ValueType>* propertyMap = baseValueMap<ValueType>()->get(element);
-        if (propertyMap)
-            return propertyMap->contains(propertyName.impl());
-
-        return false;
-    }
+    PassOwnPtr<HashSet<SVGStyledElement*> > removePendingResource(const AtomicString& id);
 };
 
 }
 
-#endif // ENABLE(SVG)
+#endif
 #endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp
index a16493ada1..41bbba4e48 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp
@@ -38,8 +38,8 @@
 #include "RegisteredEventListener.h"
 #include "RenderObject.h"
 #include "SVGCursorElement.h"
-#include "SVGDocumentExtensions.h"
 #include "SVGElementInstance.h"
+#include "SVGElementRareData.h"
 #include "SVGNames.h"
 #include "SVGResource.h"
 #include "SVGSVGElement.h"
@@ -54,9 +54,6 @@ using namespace HTMLNames;
 
 SVGElement::SVGElement(const QualifiedName& tagName, Document* document)
     : StyledElement(tagName, document, CreateElementZeroRefCount)
-    , m_shadowParent(0)
-    , m_cursorElement(0)
-    , m_cursorImageValue(0)
 {
 }
 
@@ -67,10 +64,40 @@ PassRefPtr<SVGElement> SVGElement::create(const QualifiedName& tagName, Document
 
 SVGElement::~SVGElement()
 {
-    if (m_cursorElement)
-        m_cursorElement->removeClient(this);
-    if (m_cursorImageValue)
-        m_cursorImageValue->removeReferencedElement(this);
+    if (!hasRareSVGData())
+        ASSERT(!SVGElementRareData::rareDataMap().contains(this));
+    else {
+        SVGElementRareData::SVGElementRareDataMap& rareDataMap = SVGElementRareData::rareDataMap();
+        SVGElementRareData::SVGElementRareDataMap::iterator it = rareDataMap.find(this);
+        ASSERT(it != rareDataMap.end());
+
+        SVGElementRareData* rareData = it->second;
+        if (SVGCursorElement* cursorElement = rareData->cursorElement())
+            cursorElement->removeClient(this);
+        if (CSSCursorImageValue* cursorImageValue = rareData->cursorImageValue())
+            cursorImageValue->removeReferencedElement(this);
+
+        delete rareData;
+        rareDataMap.remove(it);
+    }
+}
+
+SVGElementRareData* SVGElement::rareSVGData() const
+{
+    ASSERT(hasRareSVGData());
+    return SVGElementRareData::rareDataFromMap(this);
+}
+
+SVGElementRareData* SVGElement::ensureRareSVGData()
+{
+    if (hasRareSVGData())
+        return rareSVGData();
+
+    ASSERT(!SVGElementRareData::rareDataMap().contains(this));
+    SVGElementRareData* data = new SVGElementRareData;
+    SVGElementRareData::rareDataMap().set(this, data);
+    m_hasRareSVGData = true;
+    return data;
 }
 
 bool SVGElement::isSupported(StringImpl* feature, StringImpl* version) const
@@ -118,7 +145,6 @@ SVGElement* SVGElement::viewportElement() const
 
 SVGDocumentExtensions* SVGElement::accessDocumentSVGExtensions() const
 {
-
     // This function is provided for use by SVGAnimatedProperty to avoid
     // global inclusion of Document.h in SVG code.
     return document() ? document()->accessSVGExtensions() : 0;
@@ -127,20 +153,41 @@ SVGDocumentExtensions* SVGElement::accessDocumentSVGExtensions() const
 void SVGElement::mapInstanceToElement(SVGElementInstance* instance)
 {
     ASSERT(instance);
-    ASSERT(!m_elementInstances.contains(instance));
-    m_elementInstances.add(instance);
+
+    HashSet<SVGElementInstance*>& instances = ensureRareSVGData()->elementInstances();
+    ASSERT(!instances.contains(instance));
+
+    instances.add(instance);
 }
  
 void SVGElement::removeInstanceMapping(SVGElementInstance* instance)
 {
     ASSERT(instance);
-    ASSERT(m_elementInstances.contains(instance));
-    m_elementInstances.remove(instance);
+    ASSERT(hasRareSVGData());
+
+    HashSet<SVGElementInstance*>& instances = rareSVGData()->elementInstances();
+    ASSERT(instances.contains(instance));
+
+    instances.remove(instance);
 }
 
-HashSet<SVGElementInstance*> SVGElement::instancesForElement() const
+const HashSet<SVGElementInstance*>& SVGElement::instancesForElement() const
 {
-    return m_elementInstances;
+    if (!hasRareSVGData()) {
+        DEFINE_STATIC_LOCAL(HashSet<SVGElementInstance*>, emptyInstances, ());
+        return emptyInstances;
+    }
+    return rareSVGData()->elementInstances();
+}
+
+void SVGElement::setCursorElement(SVGCursorElement* cursorElement)
+{
+    ensureRareSVGData()->setCursorElement(cursorElement);
+}
+
+void SVGElement::setCursorImageValue(CSSCursorImageValue* cursorImageValue)
+{
+    ensureRareSVGData()->setCursorImageValue(cursorImageValue);
 }
 
 void SVGElement::parseMappedAttribute(MappedAttribute* attr)
@@ -161,9 +208,9 @@ void SVGElement::parseMappedAttribute(MappedAttribute* attr)
     else if (attr->name() == onmouseupAttr)
         setAttributeEventListener(eventNames().mouseupEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == SVGNames::onfocusinAttr)
-        setAttributeEventListener(eventNames().DOMFocusInEvent, createAttributeEventListener(this, attr));
+        setAttributeEventListener(eventNames().focusinEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == SVGNames::onfocusoutAttr)
-        setAttributeEventListener(eventNames().DOMFocusOutEvent, createAttributeEventListener(this, attr));
+        setAttributeEventListener(eventNames().focusoutEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == SVGNames::onactivateAttr)
         setAttributeEventListener(eventNames().DOMActivateEvent, createAttributeEventListener(this, attr));
     else
@@ -209,7 +256,7 @@ void SVGElement::sendSVGLoadEventIfPossible(bool sendParentLoadEvents)
             event->setTarget(currentTarget);
             currentTarget->dispatchGenericEvent(event.release());
         }
-        currentTarget = (parent && parent->isSVGElement()) ? static_pointer_cast<SVGElement>(parent) : RefPtr<SVGElement> (0);
+        currentTarget = (parent && parent->isSVGElement()) ? static_pointer_cast<SVGElement>(parent) : 0;
     }
 }
 
@@ -234,9 +281,9 @@ void SVGElement::insertedIntoDocument()
     StyledElement::insertedIntoDocument();
     SVGDocumentExtensions* extensions = document()->accessSVGExtensions();
 
-    String resourceId = SVGURIReference::getTarget(getAttribute(idAttr));
+    String resourceId = SVGURIReference::getTarget(getAttribute(idAttributeName()));
     if (extensions->isPendingResource(resourceId)) {
-        std::auto_ptr<HashSet<SVGStyledElement*> > clients(extensions->removePendingResource(resourceId));
+        OwnPtr<HashSet<SVGStyledElement*> > clients(extensions->removePendingResource(resourceId));
         if (clients->isEmpty())
             return;
 
@@ -260,7 +307,7 @@ void SVGElement::attributeChanged(Attribute* attr, bool preserveDecls)
     svgAttributeChanged(attr->name());
 }
 
-void SVGElement::updateAnimatedSVGAttribute(const String& name) const
+void SVGElement::updateAnimatedSVGAttribute(const QualifiedName& name) const
 {
     ASSERT(!m_areSVGAttributesValid);
 
@@ -269,23 +316,20 @@ void SVGElement::updateAnimatedSVGAttribute(const String& name) const
 
     m_synchronizingSVGAttributes = true;
 
-    if (name.isEmpty()) {
-        m_propertyController.synchronizeAllProperties();
-        setSynchronizedSVGAttributes(true);
-    } else
-        m_propertyController.synchronizeProperty(name);
+    const_cast<SVGElement*>(this)->synchronizeProperty(name);
+    if (name == anyQName())
+        m_areSVGAttributesValid = true;
 
     m_synchronizingSVGAttributes = false;
 }
 
-void SVGElement::setSynchronizedSVGAttributes(bool value) const
-{
-    m_areSVGAttributesValid = value;
-}
-
 ContainerNode* SVGElement::eventParentNode()
 {
-    return m_shadowParent ? m_shadowParent : StyledElement::eventParentNode();
+    if (Node* shadowParent = shadowParentNode()) {
+        ASSERT(shadowParent->isContainerNode());
+        return static_cast<ContainerNode*>(shadowParent);
+    }
+    return StyledElement::eventParentNode();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElement.h b/src/3rdparty/webkit/WebCore/svg/SVGElement.h
index b247a7472a..88d74120bb 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElement.h
@@ -23,19 +23,18 @@
 #define SVGElement_h
 
 #if ENABLE(SVG)
+#include "SVGDocumentExtensions.h"
 #include "StyledElement.h"
-#include "SVGAnimatedProperty.h"
-#include "SynchronizablePropertyController.h"
 
 namespace WebCore {
 
     class CSSCursorImageValue;
     class Document;
     class SVGCursorElement;
-    class SVGDocumentExtensions;
     class SVGElementInstance;
+    class SVGElementRareData;
     class SVGSVGElement;
-    class TransformationMatrix;
+    class AffineTransform;
 
     class SVGElement : public StyledElement {
     public:
@@ -60,8 +59,6 @@ namespace WebCore {
         virtual bool isGradientStop() const { return false; }
         virtual bool isTextContent() const { return false; }
 
-        void setShadowParentNode(ContainerNode* node) { m_shadowParent = node; }
-
         // For SVGTests
         virtual bool isValid() const { return true; }
 
@@ -69,19 +66,18 @@ namespace WebCore {
         virtual bool childShouldCreateRenderer(Node*) const;
 
         virtual void svgAttributeChanged(const QualifiedName&) { }
+        virtual void synchronizeProperty(const QualifiedName&) { }
 
         void sendSVGLoadEventIfPossible(bool sendParentLoadEvents = false);
         
-        virtual TransformationMatrix* supplementalTransform() { return 0; }
+        virtual AffineTransform* supplementalTransform() { return 0; }
 
-        virtual void setSynchronizedSVGAttributes(bool) const;
+        void setSynchronizedSVGAttributes(bool value) { m_areSVGAttributesValid = value; }
 
-        HashSet<SVGElementInstance*> instancesForElement() const;
+        const HashSet<SVGElementInstance*>& instancesForElement() const;
 
-        void setCursorElement(SVGCursorElement* cursorElement) { m_cursorElement = cursorElement; }
-        void setCursorImageValue(CSSCursorImageValue* cursorImageValue) { m_cursorImageValue = cursorImageValue; }
-
-        SynchronizablePropertyController& propertyController() const { return m_propertyController; }
+        void setCursorElement(SVGCursorElement*);
+        void setCursorImageValue(CSSCursorImageValue*);
 
     protected:
         SVGElement(const QualifiedName&, Document*);
@@ -89,36 +85,30 @@ namespace WebCore {
         virtual void finishParsingChildren();
         virtual void insertedIntoDocument();
         virtual void attributeChanged(Attribute*, bool preserveDecls = false);
-        virtual void updateAnimatedSVGAttribute(const String&) const;
+        virtual void updateAnimatedSVGAttribute(const QualifiedName&) const;
+
+        SVGElementRareData* rareSVGData() const;
+        SVGElementRareData* ensureRareSVGData();
 
     private:
         friend class SVGElementInstance;
 
         virtual bool isSVGElement() const { return true; }
-
         virtual bool isSupported(StringImpl* feature, StringImpl* version) const;
-        
-        virtual bool isShadowNode() const { return m_shadowParent; }
-        virtual Node* shadowParentNode() { return m_shadowParent; }
-        virtual ContainerNode* eventParentNode();
 
+        virtual ContainerNode* eventParentNode();
         virtual void buildPendingResource() { }
 
         void mapInstanceToElement(SVGElementInstance*);
         void removeInstanceMapping(SVGElementInstance*);
 
         virtual bool haveLoadedRequiredResources();
-
-        ContainerNode* m_shadowParent;
-        mutable SynchronizablePropertyController m_propertyController;
-
-        SVGCursorElement* m_cursorElement;
-        CSSCursorImageValue* m_cursorImageValue;
-
-        HashSet<SVGElementInstance*> m_elementInstances;
     };
 
-} // namespace WebCore 
+}
+
+// This file needs to be included after the SVGElement declaration
+#include "SVGAnimatedProperty.h"
 
-#endif // ENABLE(SVG)
-#endif // SVGElement_h
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGElement.idl
index e4112c1fac..27fcb8d1f9 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElement.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.cpp b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.cpp
index 46e82216df..ca0a70ca95 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.cpp
@@ -1,5 +1,6 @@
 /*
     Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+    Copyright (C) Research In Motion Limited 2010. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -33,26 +34,14 @@
 
 #include <wtf/RefCountedLeakCounter.h>
 
-#if USE(JSC)
-#include "GCController.h"
-#endif
-
 namespace WebCore {
 
 #ifndef NDEBUG
 static WTF::RefCountedLeakCounter instanceCounter("WebCoreSVGElementInstance");
 #endif
 
-static EventTargetData& dummyEventTargetData()
-{
-    DEFINE_STATIC_LOCAL(EventTargetData, dummyEventTargetData, ());
-    dummyEventTargetData.eventListenerMap.clear();
-    return dummyEventTargetData;
-}
-
 SVGElementInstance::SVGElementInstance(SVGUseElement* useElement, PassRefPtr<SVGElement> originalElement)
-    : m_needsUpdate(false)
-    , m_useElement(useElement)
+    : m_useElement(useElement)
     , m_element(originalElement)
     , m_previousSibling(0)
     , m_nextSibling(0)
@@ -93,20 +82,6 @@ void SVGElementInstance::setShadowTreeElement(SVGElement* element)
     m_shadowTreeElement = element;
 }
 
-void SVGElementInstance::forgetWrapper()
-{
-#if USE(JSC)
-    // FIXME: This is fragile, as discussed with Sam. Need to find a better solution.
-    // Think about the case where JS explicitely holds "var root = useElement.instanceRoot;".
-    // We still have to recreate this wrapper somehow. The gc collection below, won't catch it.
-
-    // If the use shadow tree has been rebuilt, just the JSSVGElementInstance objects
-    // are still holding RefPtrs of SVGElementInstance objects, which prevent us to
-    // be deleted (and the shadow tree is not destructed as well). Force JS GC.
-    gcController().garbageCollectNow();
-#endif
-}
-
 void SVGElementInstance::appendChild(PassRefPtr<SVGElementInstance> child)
 {
     appendChildToContainer<SVGElementInstance, SVGElementInstance>(child.get(), this);
@@ -117,52 +92,39 @@ void SVGElementInstance::invalidateAllInstancesOfElement(SVGElement* element)
     if (!element)
         return;
 
-    HashSet<SVGElementInstance*> set = element->instancesForElement();
+    if (element->isStyled() && static_cast<SVGStyledElement*>(element)->instanceUpdatesBlocked())
+        return;
+
+    const HashSet<SVGElementInstance*>& set = element->instancesForElement();
     if (set.isEmpty())
         return;
 
-    // Find all use elements referencing the instances - ask them _once_ to rebuild.
-    HashSet<SVGElementInstance*>::const_iterator it = set.begin();
+    // Mark all use elements referencing 'element' for rebuilding
     const HashSet<SVGElementInstance*>::const_iterator end = set.end();
-
-    for (; it != end; ++it)
-        (*it)->setNeedsUpdate(true);
-}
-
-void SVGElementInstance::setNeedsUpdate(bool value)
-{
-    m_needsUpdate = value;
-
-    if (m_needsUpdate)
-        correspondingUseElement()->setNeedsStyleRecalc();
+    for (HashSet<SVGElementInstance*>::const_iterator it = set.begin(); it != end; ++it) {
+        ASSERT((*it)->correspondingElement() == element);
+        (*it)->correspondingUseElement()->invalidateShadowTree();
+    }
 }
 
 ScriptExecutionContext* SVGElementInstance::scriptExecutionContext() const
 {
-    if (SVGElement* element = correspondingElement())
-        return element->document();
-    return 0;
+    return m_element->document();
 }
 
 bool SVGElementInstance::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
-    if (!correspondingElement())
-        return false;
-    return correspondingElement()->addEventListener(eventType, listener, useCapture);
+    return m_element->addEventListener(eventType, listener, useCapture);
 }
 
 bool SVGElementInstance::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    if (!correspondingElement())
-        return false;
-    return correspondingElement()->removeEventListener(eventType, listener, useCapture);
+    return m_element->removeEventListener(eventType, listener, useCapture);
 }
 
 void SVGElementInstance::removeAllEventListeners()
 {
-    if (!correspondingElement())
-        return;
-    correspondingElement()->removeAllEventListeners();
+    m_element->removeAllEventListeners();
 }
 
 bool SVGElementInstance::dispatchEvent(PassRefPtr<Event> prpEvent)
@@ -182,14 +144,17 @@ bool SVGElementInstance::dispatchEvent(PassRefPtr<Event> prpEvent)
 
 EventTargetData* SVGElementInstance::eventTargetData()
 {
-    return correspondingElement() ? correspondingElement()->eventTargetData() : 0;
+    return m_element->eventTargetData();
 }
 
 EventTargetData* SVGElementInstance::ensureEventTargetData()
 {
-    return &dummyEventTargetData(); // return something, so we don't crash
+    // Avoid crashing - return a default dummy value
+    DEFINE_STATIC_LOCAL(EventTargetData, dummyEventTargetData, ());
+    dummyEventTargetData.eventListenerMap.clear();
+    return &dummyEventTargetData;
 }
 
-} // namespace WebCore
+}
 
-#endif // ENABLE(SVG)
+#endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.h b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.h
index 3cdc76164f..58152be773 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.h
@@ -46,9 +46,6 @@ namespace WebCore {
 
         virtual ~SVGElementInstance();
 
-        bool needsUpdate() const { return m_needsUpdate; }
-        void setNeedsUpdate(bool);
-
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
         virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
@@ -129,7 +126,6 @@ namespace WebCore {
 
         void appendChild(PassRefPtr<SVGElementInstance> child);
         void setShadowTreeElement(SVGElement*);
-        void forgetWrapper();
 
         template<class GenericNode, class GenericNodeContainer>
         friend void appendChildToContainer(GenericNode* child, GenericNodeContainer* container);
@@ -153,8 +149,6 @@ namespace WebCore {
         virtual EventTargetData* eventTargetData();
         virtual EventTargetData* ensureEventTargetData();
 
-        bool m_needsUpdate : 1;
-
         SVGUseElement* m_useElement;
         RefPtr<SVGElement> m_element;
         RefPtr<SVGElement> m_shadowTreeElement;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.idl b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.idl
index cd4213c85c..d23fea2b24 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.idl
@@ -90,12 +90,12 @@ module svg {
         attribute [DontEnum] EventListener onsubmit;
         attribute [DontEnum] EventListener onunload;
 
-        [Custom] void addEventListener(in DOMString type, 
-                                       in EventListener listener, 
-                                       in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type, 
+        [JSCCustom] void addEventListener(in DOMString type, 
                                           in EventListener listener, 
                                           in boolean useCapture);
+        [JSCCustom] void removeEventListener(in DOMString type, 
+                                             in EventListener listener, 
+                                             in boolean useCapture);
         boolean dispatchEvent(in Event event)
             raises(EventException);
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElementInstanceList.cpp b/src/3rdparty/webkit/WebCore/svg/SVGElementInstanceList.cpp
index f039d44ae4..9404734f55 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElementInstanceList.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElementInstanceList.cpp
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElementInstanceList.h b/src/3rdparty/webkit/WebCore/svg/SVGElementInstanceList.h
index ef4c73c9a5..9da4cdce47 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElementInstanceList.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElementInstanceList.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElementRareData.h b/src/3rdparty/webkit/WebCore/svg/SVGElementRareData.h
new file mode 100644
index 0000000000..4e7f67151a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElementRareData.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef SVGElementRareData_h
+#define SVGElementRareData_h
+
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+class CSSCursorImageValue;
+class SVGCursorElement;
+class SVGElement;
+class SVGElementInstance;
+
+class SVGElementRareData : public Noncopyable {
+public:
+    SVGElementRareData()
+        : m_cursorElement(0)
+        , m_cursorImageValue(0)
+        , m_instancesUpdatesBlocked(false)
+    {
+    }
+
+    typedef HashMap<const SVGElement*, SVGElementRareData*> SVGElementRareDataMap;
+
+    static SVGElementRareDataMap& rareDataMap()
+    {
+        DEFINE_STATIC_LOCAL(SVGElementRareDataMap, rareDataMap, ());
+        return rareDataMap;
+    }
+
+    static SVGElementRareData* rareDataFromMap(const SVGElement* element)
+    {
+        return rareDataMap().get(element);
+    }
+
+    HashSet<SVGElementInstance*>& elementInstances() { return m_elementInstances; }
+    const HashSet<SVGElementInstance*>& elementInstances() const { return m_elementInstances; }
+
+    bool instanceUpdatesBlocked() const { return m_instancesUpdatesBlocked; }
+    void setInstanceUpdatesBlocked(bool value) { m_instancesUpdatesBlocked = value; }
+
+    SVGCursorElement* cursorElement() const { return m_cursorElement; }
+    void setCursorElement(SVGCursorElement* cursorElement) { m_cursorElement = cursorElement; }
+
+    CSSCursorImageValue* cursorImageValue() const { return m_cursorImageValue; }
+    void setCursorImageValue(CSSCursorImageValue* cursorImageValue) { m_cursorImageValue = cursorImageValue; }
+
+private:
+    HashSet<SVGElementInstance*> m_elementInstances;
+    SVGCursorElement* m_cursorElement;
+    CSSCursorImageValue* m_cursorImageValue;
+    bool m_instancesUpdatesBlocked : 1;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp
index 4c67ff3e44..a7400faf9c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -38,11 +36,10 @@ SVGEllipseElement::SVGEllipseElement(const QualifiedName& tagName, Document* doc
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
-    , m_cx(this, SVGNames::cxAttr, LengthModeWidth)
-    , m_cy(this, SVGNames::cyAttr, LengthModeHeight)
-    , m_rx(this, SVGNames::rxAttr, LengthModeWidth)
-    , m_ry(this, SVGNames::ryAttr, LengthModeHeight)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_cx(LengthModeWidth)
+    , m_cy(LengthModeHeight)
+    , m_rx(LengthModeWidth)
+    , m_ry(LengthModeHeight)
 {
 }    
 
@@ -91,6 +88,31 @@ void SVGEllipseElement::svgAttributeChanged(const QualifiedName& attrName)
         renderer()->setNeedsLayout(true);
 }
 
+void SVGEllipseElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledTransformableElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeCx();
+        synchronizeCy();
+        synchronizeRx();
+        synchronizeRy();
+        synchronizeExternalResourcesRequired();
+        return;
+    }
+
+    if (attrName == SVGNames::cxAttr)
+        synchronizeCx();
+    else if (attrName == SVGNames::cyAttr)
+        synchronizeCy();
+    else if (attrName == SVGNames::rxAttr)
+        synchronizeRx();
+    else if (attrName == SVGNames::ryAttr)
+        synchronizeRy();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+}
+
 Path SVGEllipseElement::toPathData() const
 {
     return Path::createEllipse(FloatPoint(cx().value(this), cy().value(this)),
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.h b/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.h
index 5b54fd5949..adaa0d2ab7 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.h
@@ -41,6 +41,7 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         virtual Path toPathData() const;
 
@@ -48,15 +49,13 @@ namespace WebCore {
         virtual bool hasRelativeValues() const;
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGNames::ellipseTagString, SVGNames::cxAttrString, SVGLength, Cx, cx)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGNames::ellipseTagString, SVGNames::cyAttrString, SVGLength, Cy, cy)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGNames::ellipseTagString, SVGNames::rxAttrString, SVGLength, Rx, rx)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGNames::ellipseTagString, SVGNames::ryAttrString, SVGLength, Ry, ry)
+        DECLARE_ANIMATED_PROPERTY(SVGEllipseElement, SVGNames::cxAttr, SVGLength, Cx, cx)
+        DECLARE_ANIMATED_PROPERTY(SVGEllipseElement, SVGNames::cyAttr, SVGLength, Cy, cy)
+        DECLARE_ANIMATED_PROPERTY(SVGEllipseElement, SVGNames::rxAttr, SVGLength, Rx, rx)
+        DECLARE_ANIMATED_PROPERTY(SVGEllipseElement, SVGNames::ryAttr, SVGLength, Ry, ry)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGEllipseElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGException.idl b/src/3rdparty/webkit/WebCore/svg/SVGException.idl
index 233f653883..db565ff3d6 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGException.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGException.idl
@@ -21,8 +21,7 @@
 module svg {
 
     interface [
-        Conditional=SVG,
-        GenerateConstructor
+        Conditional=SVG
     ] SVGException {
 
         readonly attribute unsigned short   code;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp
index 201ecbf920..99bc5eba30 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -32,8 +30,6 @@
 
 namespace WebCore {
 
-char SVGExternalResourcesRequiredIdentifier[] = "SVGExternalResourcesRequired";
-
 SVGExternalResourcesRequired::SVGExternalResourcesRequired()
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h
index f088c82684..b2a741d575 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h
@@ -27,7 +27,6 @@
 
 namespace WebCore {
 
-    extern char SVGExternalResourcesRequiredIdentifier[];
     class MappedAttribute;
 
     // Notes on a SVG 1.1 spec discrepancy:
@@ -44,7 +43,7 @@ namespace WebCore {
         bool isKnownAttribute(const QualifiedName&);
 
     protected:
-        virtual void setExternalResourcesRequiredBaseValue(SVGAnimatedTypeValue<bool>::DecoratedType type) = 0;
+        virtual void setExternalResourcesRequiredBaseValue(SVGAnimatedPropertyTraits<bool>::PassType) = 0;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.idl b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.idl
index 6600939bef..c1a0352b6e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.idl
@@ -26,7 +26,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, ObjCProtocol] SVGExternalResourcesRequired { 
+    interface [Conditional=SVG, ObjCProtocol, OmitConstructor] SVGExternalResourcesRequired { 
         readonly attribute SVGAnimatedBoolean externalResourcesRequired;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.cpp
index 0497ea9f25..46c412c32f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -32,9 +30,7 @@ namespace WebCore {
 
 SVGFEBlendElement::SVGFEBlendElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_in1(this, SVGNames::inAttr)
-    , m_in2(this, SVGNames::in2Attr)
-    , m_mode(this, SVGNames::modeAttr, FEBLEND_MODE_NORMAL)
+    , m_mode(FEBLEND_MODE_NORMAL)
 {
 }
 
@@ -64,6 +60,25 @@ void SVGFEBlendElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+void SVGFEBlendElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeMode();
+        synchronizeIn1();
+        synchronizeIn2();
+        return;
+    }
+
+    if (attrName == SVGNames::modeAttr)
+        synchronizeMode();
+    else if (attrName == SVGNames::inAttr)
+        synchronizeIn1();
+    else if (attrName == SVGNames::in2Attr)
+        synchronizeIn2();
+}
+
 bool SVGFEBlendElement::build(SVGResourceFilter* filterResource)
 {
     FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.h
index bed649f460..7e32244734 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -34,12 +32,13 @@ namespace WebCore {
         virtual ~SVGFEBlendElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool build(SVGResourceFilter*);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEBlendElement, SVGNames::feBlendTagString, SVGNames::inAttrString, String, In1, in1)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEBlendElement, SVGNames::feBlendTagString, SVGNames::in2AttrString, String, In2, in2)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEBlendElement, SVGNames::feBlendTagString, SVGNames::modeAttrString, int, Mode, mode)
+        DECLARE_ANIMATED_PROPERTY(SVGFEBlendElement, SVGNames::inAttr, String, In1, in1)
+        DECLARE_ANIMATED_PROPERTY(SVGFEBlendElement, SVGNames::in2Attr, String, In2, in2)
+        DECLARE_ANIMATED_PROPERTY(SVGFEBlendElement, SVGNames::modeAttr, int, Mode, mode)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.idl
index 4c1a18bc1a..bb6d86dd6c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEBlendElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEBlendElement : SVGElement,
                                                     SVGFilterPrimitiveStandardAttributes {
         // Blend Mode Types
         const unsigned short SVG_FEBLEND_MODE_UNKNOWN  = 0;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.cpp
index c2d605bc27..e62393f09f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -34,9 +32,8 @@ namespace WebCore {
 
 SVGFEColorMatrixElement::SVGFEColorMatrixElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_in1(this, SVGNames::inAttr)
-    , m_type(this, SVGNames::typeAttr, FECOLORMATRIX_TYPE_UNKNOWN)
-    , m_values(this, SVGNames::valuesAttr, SVGNumberList::create(SVGNames::valuesAttr))
+    , m_type(FECOLORMATRIX_TYPE_UNKNOWN)
+    , m_values(SVGNumberList::create(SVGNames::valuesAttr))
 {
 }
 
@@ -65,6 +62,25 @@ void SVGFEColorMatrixElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+void SVGFEColorMatrixElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeType();
+        synchronizeIn1();
+        synchronizeValues();
+        return;
+    }
+
+    if (attrName == SVGNames::typeAttr)
+        synchronizeType();
+    else if (attrName == SVGNames::inAttr)
+        synchronizeIn1();
+    else if (attrName == SVGNames::valuesAttr)
+        synchronizeValues();
+}
+
 bool SVGFEColorMatrixElement::build(SVGResourceFilter* filterResource)
 {
     FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
@@ -72,15 +88,42 @@ bool SVGFEColorMatrixElement::build(SVGResourceFilter* filterResource)
     if (!input1)
         return false;
 
-    Vector<float> _values;
+    Vector<float> filterValues;
     SVGNumberList* numbers = values();
+    const ColorMatrixType filterType(static_cast<const ColorMatrixType>(type()));
+
+    // Use defaults if values is empty (SVG 1.1 15.10).
+    if (!hasAttribute(SVGNames::valuesAttr)) {
+        switch (filterType) {
+        case FECOLORMATRIX_TYPE_MATRIX:
+            for (size_t i = 0; i < 20; i++)
+                filterValues.append((i % 6) ? 0.0f : 1.0f);
+            break;
+        case FECOLORMATRIX_TYPE_HUEROTATE:
+            filterValues.append(0.0f);
+            break;
+        case FECOLORMATRIX_TYPE_SATURATE:
+            filterValues.append(1.0f);
+            break;
+        default:
+            break;
+        }
+    } else {
+        size_t size = numbers->numberOfItems();
+        for (size_t i = 0; i < size; i++) {
+            ExceptionCode ec = 0;
+            filterValues.append(numbers->getItem(i, ec));
+        }
+        size = filterValues.size();
+
+        if ((filterType == FECOLORMATRIX_TYPE_MATRIX && size != 20)
+            || (filterType == FECOLORMATRIX_TYPE_HUEROTATE && size != 1)
+            || (filterType == FECOLORMATRIX_TYPE_SATURATE && (size != 1
+                || filterValues[0] < 0.0f || filterValues[0] > 1.0f)))
+            return false;
+    }
 
-    ExceptionCode ec = 0;
-    unsigned int nr = numbers->numberOfItems();
-    for (unsigned int i = 0;i < nr;i++)
-        _values.append(numbers->getItem(i, ec));
-
-    RefPtr<FilterEffect> effect = FEColorMatrix::create(input1, static_cast<ColorMatrixType>(type()), _values);
+    RefPtr<FilterEffect> effect = FEColorMatrix::create(input1, filterType, filterValues);
     filterResource->addFilterEffect(this, effect.release());
     
     return true;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.h
index 5b7a9aedc9..811494d608 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -36,12 +34,13 @@ namespace WebCore {
         virtual ~SVGFEColorMatrixElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool build(SVGResourceFilter*);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEColorMatrixElement, SVGNames::feColorMatrixTagString, SVGNames::inAttrString, String, In1, in1)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEColorMatrixElement, SVGNames::feColorMatrixTagString, SVGNames::typeAttrString, int, Type, type)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEColorMatrixElement, SVGNames::feColorMatrixTagString, SVGNames::valuesAttrString, SVGNumberList, Values, values)
+        DECLARE_ANIMATED_PROPERTY(SVGFEColorMatrixElement, SVGNames::inAttr, String, In1, in1)
+        DECLARE_ANIMATED_PROPERTY(SVGFEColorMatrixElement, SVGNames::typeAttr, int, Type, type)
+        DECLARE_ANIMATED_PROPERTY(SVGFEColorMatrixElement, SVGNames::valuesAttr, SVGNumberList*, Values, values)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.idl
index c116fe755c..d704906f8d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEColorMatrixElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEColorMatrixElement : SVGElement,
                                                           SVGFilterPrimitiveStandardAttributes {
         // Color Matrix Types
         const unsigned short SVG_FECOLORMATRIX_TYPE_UNKNOWN          = 0;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.cpp
index 691d5cd1a1..4cda9c971c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -39,7 +37,6 @@ namespace WebCore {
 
 SVGFEComponentTransferElement::SVGFEComponentTransferElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_in1(this, SVGNames::inAttr)
 {
 }
 
@@ -56,6 +53,14 @@ void SVGFEComponentTransferElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+void SVGFEComponentTransferElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
+
+    if (attrName == anyQName() || attrName == SVGNames::inAttr)
+        synchronizeIn1();
+}
+
 bool SVGFEComponentTransferElement::build(SVGResourceFilter* filterResource)
 {
     FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.h
index 21c95d20d4..b1d9373bcd 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -35,10 +33,11 @@ namespace WebCore {
         virtual ~SVGFEComponentTransferElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool build(SVGResourceFilter*);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEComponentTransferElement, SVGNames::feComponentTransferTagString, SVGNames::inAttrString, String, In1, in1)
+        DECLARE_ANIMATED_PROPERTY(SVGFEComponentTransferElement, SVGNames::inAttr, String, In1, in1)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.cpp
index 6eec6ea797..734c2fef5a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -33,13 +31,7 @@ namespace WebCore {
 
 SVGFECompositeElement::SVGFECompositeElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_in1(this, SVGNames::inAttr)
-    , m_in2(this, SVGNames::in2Attr)
-    , m__operator(this, SVGNames::operatorAttr, FECOMPOSITE_OPERATOR_OVER)
-    , m_k1(this, SVGNames::k1Attr)
-    , m_k2(this, SVGNames::k2Attr)
-    , m_k3(this, SVGNames::k3Attr)
-    , m_k4(this, SVGNames::k4Attr)
+    , m__operator(FECOMPOSITE_OPERATOR_OVER)
 {
 }
 
@@ -63,8 +55,7 @@ void SVGFECompositeElement::parseMappedAttribute(MappedAttribute *attr)
             set_operatorBaseValue(FECOMPOSITE_OPERATOR_XOR);
         else if (value == "arithmetic")
             set_operatorBaseValue(FECOMPOSITE_OPERATOR_ARITHMETIC);
-    }
-    else if (attr->name() == SVGNames::inAttr)
+    } else if (attr->name() == SVGNames::inAttr)
         setIn1BaseValue(value);
     else if (attr->name() == SVGNames::in2Attr)
         setIn2BaseValue(value);
@@ -80,6 +71,37 @@ void SVGFECompositeElement::parseMappedAttribute(MappedAttribute *attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+void SVGFECompositeElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronize_operator();
+        synchronizeIn1();
+        synchronizeIn2();
+        synchronizeK1();
+        synchronizeK2();
+        synchronizeK3();
+        synchronizeK4();
+        return;
+    }
+
+    if (attrName == SVGNames::operatorAttr)
+        synchronize_operator();
+    else if (attrName == SVGNames::inAttr)
+        synchronizeIn1();
+    else if (attrName == SVGNames::in2Attr)
+        synchronizeIn2();
+    else if (attrName == SVGNames::k1Attr)
+        synchronizeK1();
+    else if (attrName == SVGNames::k2Attr)
+        synchronizeK2();
+    else if (attrName == SVGNames::k3Attr)
+        synchronizeK3();
+    else if (attrName == SVGNames::k4Attr)
+        synchronizeK4();
+}
+
 bool SVGFECompositeElement::build(SVGResourceFilter* filterResource)
 {
     FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.h
index fc97169638..c9fecc883a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -35,16 +33,17 @@ namespace WebCore {
         virtual ~SVGFECompositeElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool build(SVGResourceFilter*);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFECompositeElement, SVGNames::feCompositeTagString, SVGNames::inAttrString, String, In1, in1)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFECompositeElement, SVGNames::feCompositeTagString, SVGNames::in2AttrString, String, In2, in2)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFECompositeElement, SVGNames::feCompositeTagString, SVGNames::operatorAttrString, int, _operator, _operator)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFECompositeElement, SVGNames::feCompositeTagString, SVGNames::k1AttrString, float, K1, k1)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFECompositeElement, SVGNames::feCompositeTagString, SVGNames::k2AttrString, float, K2, k2)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFECompositeElement, SVGNames::feCompositeTagString, SVGNames::k3AttrString, float, K3, k3)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFECompositeElement, SVGNames::feCompositeTagString, SVGNames::k4AttrString, float, K4, k4)
+        DECLARE_ANIMATED_PROPERTY(SVGFECompositeElement, SVGNames::inAttr, String, In1, in1)
+        DECLARE_ANIMATED_PROPERTY(SVGFECompositeElement, SVGNames::in2Attr, String, In2, in2)
+        DECLARE_ANIMATED_PROPERTY(SVGFECompositeElement, SVGNames::operatorAttr, int, _operator, _operator)
+        DECLARE_ANIMATED_PROPERTY(SVGFECompositeElement, SVGNames::k1Attr, float, K1, k1)
+        DECLARE_ANIMATED_PROPERTY(SVGFECompositeElement, SVGNames::k2Attr, float, K2, k2)
+        DECLARE_ANIMATED_PROPERTY(SVGFECompositeElement, SVGNames::k3Attr, float, K3, k3)
+        DECLARE_ANIMATED_PROPERTY(SVGFECompositeElement, SVGNames::k4Attr, float, K4, k4)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl
index d3179979e3..d3adb25b1d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFECompositeElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFECompositeElement : SVGElement,
                                                         SVGFilterPrimitiveStandardAttributes {
         // Composite Operators
         const unsigned short SVG_FECOMPOSITE_OPERATOR_UNKNOWN    = 0;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.cpp
index edbd8521cb..a3db66dc5e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.cpp
@@ -40,11 +40,8 @@ char SVGKernelUnitLengthYIdentifier[] = "SVGKernelUnitLengthY";
 
 SVGFEDiffuseLightingElement::SVGFEDiffuseLightingElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_in1(this, SVGNames::inAttr)
-    , m_diffuseConstant(this, SVGNames::diffuseConstantAttr, 1.0f)
-    , m_surfaceScale(this, SVGNames::surfaceScaleAttr, 1.0f)
-    , m_kernelUnitLengthX(this, SVGNames::kernelUnitLengthAttr)
-    , m_kernelUnitLengthY(this, SVGNames::kernelUnitLengthAttr)
+    , m_diffuseConstant(1.0f)
+    , m_surfaceScale(1.0f)
 {
 }
 
@@ -71,6 +68,31 @@ void SVGFEDiffuseLightingElement::parseMappedAttribute(MappedAttribute *attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+void SVGFEDiffuseLightingElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeIn1();
+        synchronizeSurfaceScale();
+        synchronizeDiffuseConstant();
+        synchronizeKernelUnitLengthX();
+        synchronizeKernelUnitLengthY();
+        return;
+    }
+
+    if (attrName == SVGNames::inAttr)
+        synchronizeIn1();
+    else if (attrName == SVGNames::surfaceScaleAttr)
+        synchronizeSurfaceScale();
+    else if (attrName == SVGNames::diffuseConstantAttr)
+        synchronizeDiffuseConstant();
+    else if (attrName == SVGNames::kernelUnitLengthAttr) {
+        synchronizeKernelUnitLengthX();
+        synchronizeKernelUnitLengthY();
+    }
+}
+
 bool SVGFEDiffuseLightingElement::build(SVGResourceFilter* filterResource)
 {
     FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
@@ -88,20 +110,18 @@ bool SVGFEDiffuseLightingElement::build(SVGResourceFilter* filterResource)
     return true;
 }
 
-LightSource* SVGFEDiffuseLightingElement::findLights() const
+PassRefPtr<LightSource> SVGFEDiffuseLightingElement::findLights() const
 {
-    LightSource* light = 0;
     for (Node* n = firstChild(); n; n = n->nextSibling()) {
         if (n->hasTagName(SVGNames::feDistantLightTag) ||
             n->hasTagName(SVGNames::fePointLightTag) ||
             n->hasTagName(SVGNames::feSpotLightTag)) {
             SVGFELightElement* lightNode = static_cast<SVGFELightElement*>(n); 
-            light = lightNode->lightSource();
-            break;
+            return lightNode->lightSource();
         }
     }
 
-    return light;
+    return 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.h
index fcb5eee938..2e1b8cf756 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.h
@@ -40,16 +40,17 @@ namespace WebCore {
         virtual ~SVGFEDiffuseLightingElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool build(SVGResourceFilter*);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEDiffuseLightingElement, SVGNames::feDiffuseLightingTagString, SVGNames::inAttrString, String, In1, in1)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEDiffuseLightingElement, SVGNames::feDiffuseLightingTagString, SVGNames::diffuseConstantAttrString, float, DiffuseConstant, diffuseConstant)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEDiffuseLightingElement, SVGNames::feDiffuseLightingTagString, SVGNames::surfaceScaleAttrString, float, SurfaceScale, surfaceScale)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEDiffuseLightingElement, SVGNames::feDiffuseLightingTagString, SVGKernelUnitLengthXIdentifier, float, KernelUnitLengthX, kernelUnitLengthX)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEDiffuseLightingElement, SVGNames::feDiffuseLightingTagString, SVGKernelUnitLengthYIdentifier, float, KernelUnitLengthY, kernelUnitLengthY)
+        DECLARE_ANIMATED_PROPERTY(SVGFEDiffuseLightingElement, SVGNames::inAttr, String, In1, in1)
+        DECLARE_ANIMATED_PROPERTY(SVGFEDiffuseLightingElement, SVGNames::diffuseConstantAttr, float, DiffuseConstant, diffuseConstant)
+        DECLARE_ANIMATED_PROPERTY(SVGFEDiffuseLightingElement, SVGNames::surfaceScaleAttr, float, SurfaceScale, surfaceScale)
+        DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGFEDiffuseLightingElement, SVGNames::kernelUnitLengthAttr, SVGKernelUnitLengthXIdentifier, float, KernelUnitLengthX, kernelUnitLengthX)
+        DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGFEDiffuseLightingElement, SVGNames::kernelUnitLengthAttr, SVGKernelUnitLengthYIdentifier, float, KernelUnitLengthY, kernelUnitLengthY)
 
-        LightSource* findLights() const;
+        PassRefPtr<LightSource> findLights() const;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.cpp
index adf02fee91..b4fcb92249 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.cpp
@@ -29,11 +29,8 @@ namespace WebCore {
 
 SVGFEDisplacementMapElement::SVGFEDisplacementMapElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_in1(this, SVGNames::inAttr)
-    , m_in2(this, SVGNames::in2Attr)
-    , m_xChannelSelector(this, SVGNames::xChannelSelectorAttr, CHANNEL_A)
-    , m_yChannelSelector(this, SVGNames::yChannelSelectorAttr, CHANNEL_A)
-    , m_scale(this, SVGNames::scaleAttr)
+    , m_xChannelSelector(CHANNEL_A)
+    , m_yChannelSelector(CHANNEL_A)
 {
 }
 
@@ -72,6 +69,31 @@ void SVGFEDisplacementMapElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+void SVGFEDisplacementMapElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeXChannelSelector();
+        synchronizeYChannelSelector();
+        synchronizeIn1();
+        synchronizeIn2();
+        synchronizeScale();
+        return;
+    }
+
+    if (attrName == SVGNames::xChannelSelectorAttr)
+        synchronizeXChannelSelector();
+    else if (attrName == SVGNames::yChannelSelectorAttr)
+        synchronizeYChannelSelector();
+    else if (attrName == SVGNames::inAttr)
+        synchronizeIn1();
+    else if (attrName == SVGNames::in2Attr)
+        synchronizeIn2();
+    else if (attrName == SVGNames::scaleAttr)
+        synchronizeScale();
+}
+
 bool SVGFEDisplacementMapElement::build(SVGResourceFilter* filterResource)
 {
     FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.h
index 48e6930623..95c6672944 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.h
@@ -34,14 +34,15 @@ namespace WebCore {
         static ChannelSelectorType stringToChannel(const String&);
         
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool build(SVGResourceFilter*);
         
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEDisplacementMapElement, SVGNames::feDisplacementMapTagString, SVGNames::inAttrString, String, In1, in1)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEDisplacementMapElement, SVGNames::feDisplacementMapTagString, SVGNames::in2AttrString, String, In2, in2)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEDisplacementMapElement, SVGNames::feDisplacementMapTagString, SVGNames::xChannelSelectorAttrString, int, XChannelSelector, xChannelSelector)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEDisplacementMapElement, SVGNames::feDisplacementMapTagString, SVGNames::yChannelSelectorAttrString, int, YChannelSelector, yChannelSelector)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEDisplacementMapElement, SVGNames::feDisplacementMapTagString, SVGNames::scaleAttrString, float, Scale, scale)
+        DECLARE_ANIMATED_PROPERTY(SVGFEDisplacementMapElement, SVGNames::inAttr, String, In1, in1)
+        DECLARE_ANIMATED_PROPERTY(SVGFEDisplacementMapElement, SVGNames::in2Attr, String, In2, in2)
+        DECLARE_ANIMATED_PROPERTY(SVGFEDisplacementMapElement, SVGNames::xChannelSelectorAttr, int, XChannelSelector, xChannelSelector)
+        DECLARE_ANIMATED_PROPERTY(SVGFEDisplacementMapElement, SVGNames::yChannelSelectorAttr, int, YChannelSelector, yChannelSelector)
+        DECLARE_ANIMATED_PROPERTY(SVGFEDisplacementMapElement, SVGNames::scaleAttr, float, Scale, scale)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.idl
index 4fde2191bd..b003e8f877 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEDisplacementMapElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEDisplacementMapElement : SVGElement,
                                                               SVGFilterPrimitiveStandardAttributes {    
         // Channel Selectors
         const unsigned short SVG_CHANNEL_UNKNOWN = 0;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.cpp
index 35c487bed7..8322a3aaee 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.cpp
@@ -34,9 +34,9 @@ SVGFEDistantLightElement::~SVGFEDistantLightElement()
 {
 }
 
-LightSource* SVGFEDistantLightElement::lightSource() const
+PassRefPtr<LightSource> SVGFEDistantLightElement::lightSource() const
 {
-    return new DistantLightSource(azimuth(), elevation());
+    return DistantLightSource::create(azimuth(), elevation());
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.h
index 95f45c853b..3d0c03936d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.h
@@ -29,7 +29,7 @@ namespace WebCore {
         SVGFEDistantLightElement(const QualifiedName&, Document*);
         virtual ~SVGFEDistantLightElement();
 
-        virtual LightSource* lightSource() const;
+        virtual PassRefPtr<LightSource> lightSource() const;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp
index 3d807994cc..d69c240679 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h
index e83fc94a29..b8b49e7725 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl
index b3c3180024..59b97519da 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEFloodElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEFloodElement : SVGElement,
                                                     SVGFilterPrimitiveStandardAttributes {
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.cpp
index 41118fefa1..a02b0e5047 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.h
index 8ec6b1cd25..55a3c9da21 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.cpp
index 190b23ac37..2bf939bb82 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.h
index 5d86f878a6..177ed268ef 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.cpp
index d5e5625e6c..e0d60f4b7a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.h
index 9f5d3d732d..4eeafa0324 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.cpp
index e3d7ee4052..e8e6b9996f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.h
index 0a0d115bf0..196cfa332f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.cpp
index 4cddb5ae59..fd49fe7a59 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -37,9 +35,6 @@ char SVGStdDeviationYAttrIdentifier[] = "SVGStdDeviationYAttr";
 
 SVGFEGaussianBlurElement::SVGFEGaussianBlurElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_in1(this, SVGNames::inAttr)
-    , m_stdDeviationX(this, SVGNames::stdDeviationAttr)
-    , m_stdDeviationY(this, SVGNames::stdDeviationAttr)
 {
 }
 
@@ -67,6 +62,24 @@ void SVGFEGaussianBlurElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+void SVGFEGaussianBlurElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeStdDeviationX();
+        synchronizeStdDeviationY();
+        synchronizeIn1();
+        return;
+    }
+
+    if (attrName == SVGNames::stdDeviationAttr) {
+        synchronizeStdDeviationX();
+        synchronizeStdDeviationY();
+    } else if (attrName == SVGNames::inAttr)
+        synchronizeIn1();
+}
+
 bool SVGFEGaussianBlurElement::build(SVGResourceFilter* filterResource)
 {
     FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h
index c9bb61310b..a03b9dfab7 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -40,12 +38,13 @@ namespace WebCore {
         void setStdDeviation(float stdDeviationX, float stdDeviationY);
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool build(SVGResourceFilter*);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEGaussianBlurElement, SVGNames::feGaussianBlurTagString, SVGNames::inAttrString, String, In1, in1)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEGaussianBlurElement, SVGNames::feGaussianBlurTagString, SVGStdDeviationXAttrIdentifier, float, StdDeviationX, stdDeviationX)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEGaussianBlurElement, SVGNames::feGaussianBlurTagString, SVGStdDeviationYAttrIdentifier, float, StdDeviationY, stdDeviationY)
+        DECLARE_ANIMATED_PROPERTY(SVGFEGaussianBlurElement, SVGNames::inAttr, String, In1, in1)
+        DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGFEGaussianBlurElement, SVGNames::stdDeviationAttr, SVGStdDeviationXAttrIdentifier, float, StdDeviationX, stdDeviationX)
+        DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGFEGaussianBlurElement, SVGNames::stdDeviationAttr, SVGStdDeviationYAttrIdentifier, float, StdDeviationY, stdDeviationY)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp
index 269d6b2e38..7be972c446 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+                  2010 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -33,6 +32,7 @@
 #include "SVGLength.h"
 #include "SVGNames.h"
 #include "SVGPreserveAspectRatio.h"
+#include "SVGRenderSupport.h"
 #include "SVGResourceFilter.h"
 
 namespace WebCore {
@@ -42,9 +42,6 @@ SVGFEImageElement::SVGFEImageElement(const QualifiedName& tagName, Document* doc
     , SVGURIReference()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
-    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
-    , m_href(this, XLinkNames::hrefAttr)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -54,23 +51,31 @@ SVGFEImageElement::~SVGFEImageElement()
         m_cachedImage->removeClient(this);
 }
 
+void SVGFEImageElement::requestImageResource()
+{
+    if (m_cachedImage) {
+        m_cachedImage->removeClient(this);
+        m_cachedImage = 0;
+    }
+
+    Element* hrefElement = document()->getElementById(SVGURIReference::getTarget(href()));
+    if (hrefElement && hrefElement->isSVGElement() && hrefElement->renderer())
+        return;
+
+    m_cachedImage = ownerDocument()->docLoader()->requestImage(href());
+
+    if (m_cachedImage)
+        m_cachedImage->addClient(this);
+}
+
 void SVGFEImageElement::parseMappedAttribute(MappedAttribute* attr)
 {
     const String& value = attr->value();
-    if (attr->name() == SVGNames::preserveAspectRatioAttr) {
-        const UChar* c = value.characters();
-        const UChar* end = c + value.length();
-        preserveAspectRatioBaseValue()->parsePreserveAspectRatio(c, end);
-    } else {
+    if (attr->name() == SVGNames::preserveAspectRatioAttr)
+        SVGPreserveAspectRatio::parsePreserveAspectRatio(this, value);
+    else {
         if (SVGURIReference::parseMappedAttribute(attr)) {
-            if (!href().startsWith("#")) {
-                // FIXME: this code needs to special-case url fragments and later look them up using getElementById instead of loading them here
-                if (m_cachedImage)
-                    m_cachedImage->removeClient(this);
-                m_cachedImage = ownerDocument()->docLoader()->requestImage(href());
-                if (m_cachedImage)
-                    m_cachedImage->addClient(this);
-            }
+            requestImageResource();
             return;
         }
         if (SVGLangSpace::parseMappedAttribute(attr))
@@ -82,16 +87,48 @@ void SVGFEImageElement::parseMappedAttribute(MappedAttribute* attr)
     }
 }
 
+void SVGFEImageElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizePreserveAspectRatio();
+        synchronizeHref();
+        synchronizeExternalResourcesRequired();
+        return;
+    }
+
+    if (attrName == SVGNames::preserveAspectRatioAttr)
+        synchronizePreserveAspectRatio();
+    else if (SVGURIReference::isKnownAttribute(attrName))
+        synchronizeHref();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+}
+
 void SVGFEImageElement::notifyFinished(CachedResource*)
 {
+    SVGStyledElement::invalidateResourcesInAncestorChain();
 }
 
 bool SVGFEImageElement::build(SVGResourceFilter* filterResource)
 {
-    if (!m_cachedImage)
-        return false;
+    if (!m_cachedImage && !m_targetImage) {
+        Element* hrefElement = document()->getElementById(SVGURIReference::getTarget(href()));
+        if (!hrefElement || !hrefElement->isSVGElement())
+            return false;
+
+        RenderObject* renderer = hrefElement->renderer();
+        if (!renderer)
+            return false;
+
+        IntRect targetRect = enclosingIntRect(renderer->objectBoundingBox());
+        m_targetImage = ImageBuffer::create(targetRect.size(), LinearRGB);
+
+        renderSubtreeToImage(m_targetImage.get(), renderer);
+    }
 
-    RefPtr<FilterEffect> effect = FEImage::create(m_cachedImage.get());
+    RefPtr<FilterEffect> effect = FEImage::create(m_targetImage ? m_targetImage->image() : m_cachedImage->image(), preserveAspectRatio());
     filterResource->addFilterEffect(this, effect.release());
 
     return true;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h
index 7c6d89bad4..72cd94977b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h
@@ -23,12 +23,13 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "CachedResourceHandle.h"
-#include "SVGFilterPrimitiveStandardAttributes.h"
-#include "SVGURIReference.h"
-#include "SVGLangSpace.h"
+#include "ImageBuffer.h"
 #include "SVGExternalResourcesRequired.h"
 #include "SVGFEImage.h"
+#include "SVGFilterPrimitiveStandardAttributes.h"
+#include "SVGLangSpace.h"
 #include "SVGPreserveAspectRatio.h"
+#include "SVGURIReference.h"
 
 namespace WebCore {
 
@@ -42,23 +43,25 @@ namespace WebCore {
         virtual ~SVGFEImageElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual void notifyFinished(CachedResource*);
 
         virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
         virtual bool build(SVGResourceFilter*);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGNames::feImageTagString, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+        void requestImageResource();
+
+        DECLARE_ANIMATED_PROPERTY(SVGFEImageElement, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
 
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+        DECLARE_ANIMATED_PROPERTY(SVGFEImageElement, XLinkNames::hrefAttr, String, Href, href)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGFEImageElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
 
         CachedResourceHandle<CachedImage> m_cachedImage;
+        OwnPtr<ImageBuffer> m_targetImage;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.idl
index 23b9c86c8f..0ebe53ec50 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.idl
@@ -26,10 +26,11 @@
 module svg {
 
     interface [Conditional=SVG&FILTERS] SVGFEImageElement : SVGElement,
-                                                    SVGURIReference,
-                                                    SVGLangSpace,
-                                                    SVGExternalResourcesRequired,
-                                                    SVGFilterPrimitiveStandardAttributes {
+                                                            SVGURIReference,
+                                                            SVGLangSpace,
+                                                            SVGExternalResourcesRequired,
+                                                            SVGFilterPrimitiveStandardAttributes {
+        readonly attribute SVGAnimatedPreserveAspectRatio preserveAspectRatio;
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.cpp
index bb954eb4a4..dc711cfeab 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.cpp
@@ -29,20 +29,9 @@
 
 namespace WebCore {
 
-char SVGFELightElementIdentifier[] = "SVGFELightElement";
-
 SVGFELightElement::SVGFELightElement(const QualifiedName& tagName, Document* doc)
     : SVGElement(tagName, doc)
-    , m_azimuth(this, SVGNames::azimuthAttr)
-    , m_elevation(this, SVGNames::elevationAttr)
-    , m_x(this, SVGNames::xAttr)
-    , m_y(this, SVGNames::yAttr)
-    , m_z(this, SVGNames::zAttr)
-    , m_pointsAtX(this, SVGNames::pointsAtXAttr)
-    , m_pointsAtY(this, SVGNames::pointsAtYAttr)
-    , m_pointsAtZ(this, SVGNames::pointsAtZAttr)
-    , m_specularExponent(this, SVGNames::specularExponentAttr, 1.0f)
-    , m_limitingConeAngle(this, SVGNames::limitingConeAngleAttr)
+    , m_specularExponent(1.0f)
 {
 }
 
@@ -77,8 +66,46 @@ void SVGFELightElement::parseMappedAttribute(MappedAttribute* attr)
         SVGElement::parseMappedAttribute(attr);
 }
 
+void SVGFELightElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeAzimuth();
+        synchronizeElevation();
+        synchronizeX();
+        synchronizeY();
+        synchronizeZ();
+        synchronizePointsAtX();
+        synchronizePointsAtY();
+        synchronizePointsAtZ();
+        synchronizeSpecularExponent();
+        synchronizeLimitingConeAngle();
+        return;
+    }
+
+    if (attrName == SVGNames::azimuthAttr)
+        synchronizeAzimuth();
+    else if (attrName == SVGNames::elevationAttr)
+        synchronizeElevation();
+    else if (attrName == SVGNames::xAttr)
+        synchronizeX();
+    else if (attrName == SVGNames::yAttr)
+        synchronizeY();
+    else if (attrName == SVGNames::zAttr)
+        synchronizeZ();
+    else if (attrName == SVGNames::pointsAtXAttr)
+        synchronizePointsAtX();
+    else if (attrName == SVGNames::pointsAtYAttr)
+        synchronizePointsAtY();
+    else if (attrName == SVGNames::pointsAtZAttr)
+        synchronizePointsAtZ();
+    else if (attrName == SVGNames::specularExponentAttr)
+        synchronizeSpecularExponent();
+    else if (attrName == SVGNames::limitingConeAngleAttr)
+        synchronizeLimitingConeAngle();
 }
 
-#endif // ENABLE(SVG)
+}
 
-// vim:ts=4:noet
+#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h
index 92947a1f00..4e9c389a5b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h
@@ -29,27 +29,26 @@
 
 namespace WebCore {
 
-    extern char SVGFELightElementIdentifier[];
-
     class SVGFELightElement : public SVGElement {
     public:
         SVGFELightElement(const QualifiedName&, Document*);
         virtual ~SVGFELightElement();
         
-        virtual LightSource* lightSource() const = 0;
+        virtual PassRefPtr<LightSource> lightSource() const = 0;
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::azimuthAttrString, float, Azimuth, azimuth)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::elevationAttrString, float, Elevation, elevation)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::xAttrString, float, X, x)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::yAttrString, float, Y, y)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::zAttrString, float, Z, z)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::pointsAtXAttrString, float, PointsAtX, pointsAtX)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::pointsAtYAttrString, float, PointsAtY, pointsAtY)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::pointsAtZAttrString, float, PointsAtZ, pointsAtZ)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::specularExponentAttrString, float, SpecularExponent, specularExponent)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::limitingConeAngleAttrString, float, LimitingConeAngle, limitingConeAngle)
+        DECLARE_ANIMATED_PROPERTY(SVGFELightElement, SVGNames::azimuthAttr, float, Azimuth, azimuth)
+        DECLARE_ANIMATED_PROPERTY(SVGFELightElement, SVGNames::elevationAttr, float, Elevation, elevation)
+        DECLARE_ANIMATED_PROPERTY(SVGFELightElement, SVGNames::xAttr, float, X, x)
+        DECLARE_ANIMATED_PROPERTY(SVGFELightElement, SVGNames::yAttr, float, Y, y)
+        DECLARE_ANIMATED_PROPERTY(SVGFELightElement, SVGNames::zAttr, float, Z, z)
+        DECLARE_ANIMATED_PROPERTY(SVGFELightElement, SVGNames::pointsAtXAttr, float, PointsAtX, pointsAtX)
+        DECLARE_ANIMATED_PROPERTY(SVGFELightElement, SVGNames::pointsAtYAttr, float, PointsAtY, pointsAtY)
+        DECLARE_ANIMATED_PROPERTY(SVGFELightElement, SVGNames::pointsAtZAttr, float, PointsAtZ, pointsAtZ)
+        DECLARE_ANIMATED_PROPERTY(SVGFELightElement, SVGNames::specularExponentAttr, float, SpecularExponent, specularExponent)
+        DECLARE_ANIMATED_PROPERTY(SVGFELightElement, SVGNames::limitingConeAngleAttr, float, LimitingConeAngle, limitingConeAngle)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp
index 8f4eed95c7..078de22b0e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -41,7 +39,7 @@ SVGFEMergeElement::~SVGFEMergeElement()
 
 bool SVGFEMergeElement::build(SVGResourceFilter* filterResource)
 {
-    Vector<FilterEffect*> mergeInputs;
+    Vector<RefPtr<FilterEffect> > mergeInputs;
     for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
         if (n->hasTagName(SVGNames::feMergeNodeTag)) {
             FilterEffect* mergeEffect = filterResource->builder()->getEffectById(static_cast<SVGFEMergeNodeElement*>(n)->in1());
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.h
index e63ed04fa4..f84ddce6bd 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.cpp
index ae08706ba4..9551d2981b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -31,7 +29,6 @@ namespace WebCore {
 
 SVGFEMergeNodeElement::SVGFEMergeNodeElement(const QualifiedName& tagName, Document* doc)
     : SVGElement(tagName, doc)
-    , m_in1(this, SVGNames::inAttr)
 {
 }
 
@@ -48,6 +45,14 @@ void SVGFEMergeNodeElement::parseMappedAttribute(MappedAttribute* attr)
         SVGElement::parseMappedAttribute(attr);
 }
 
+void SVGFEMergeNodeElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName() || attrName == SVGNames::inAttr)
+        synchronizeIn1();
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h
index cdec8d2152..5ccfe9416e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h
@@ -33,9 +33,10 @@ namespace WebCore {
         virtual ~SVGFEMergeNodeElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMergeNodeElement, SVGNames::feMergeNodeTagString, SVGNames::inAttrString, String, In1, in1)
+        DECLARE_ANIMATED_PROPERTY(SVGFEMergeNodeElement, SVGNames::inAttr, String, In1, in1)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.cpp
index 4a06188f52..f66a6c8071 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.cpp
@@ -34,10 +34,7 @@ char SVGRadiusYAttrIdentifier[] = "SVGRadiusYAttr";
 
 SVGFEMorphologyElement::SVGFEMorphologyElement(const QualifiedName& tagName, Document* document)
     : SVGFilterPrimitiveStandardAttributes(tagName, document)
-    , m_in1(this, SVGNames::inAttr)
-    , m__operator(this, SVGNames::operatorAttr, FEMORPHOLOGY_OPERATOR_ERODE)
-    , m_radiusX(this, SVGNames::radiusAttr)
-    , m_radiusY(this, SVGNames::radiusAttr)
+    , m__operator(FEMORPHOLOGY_OPERATOR_ERODE)
 {
 }
 
@@ -70,14 +67,41 @@ void SVGFEMorphologyElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+void SVGFEMorphologyElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronize_operator();
+        synchronizeIn1();
+        synchronizeRadiusX();
+        synchronizeRadiusY();
+        return;
+    }
+
+    if (attrName == SVGNames::operatorAttr)
+        synchronize_operator();
+    else if (attrName == SVGNames::inAttr)
+        synchronizeIn1();
+    else if (attrName == SVGNames::radiusAttr) {
+        synchronizeRadiusX();
+        synchronizeRadiusY();
+    }
+}
+
 bool SVGFEMorphologyElement::build(SVGResourceFilter* filterResource)
 {
     FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
+    SVGAnimatedPropertyTraits<float>::ReturnType radX = radiusX(),
+        radY = radiusY();
 
     if (!input1)
         return false;
 
-    RefPtr<FilterEffect> effect = FEMorphology::create(input1, static_cast<MorphologyOperatorType>(_operator()), radiusX(), radiusY());
+    if (radX < 0 || radY < 0)
+        return false;
+
+    RefPtr<FilterEffect> effect = FEMorphology::create(input1, static_cast<MorphologyOperatorType>(_operator()), radX, radY);
     filterResource->addFilterEffect(this, effect.release());
     
     return true;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.h
index 6c1aec1e04..c7e3f6f7c1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.h
@@ -37,13 +37,14 @@ namespace WebCore {
         void setRadius(float radiusX, float radiusY);
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool build(SVGResourceFilter*);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGNames::inAttrString, String, In1, in1)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGNames::operatorAttrString, int, _operator, _operator)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGRadiusXAttrIdentifier, float, RadiusX, radiusX)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGRadiusYAttrIdentifier, float, RadiusY, radiusY)
+        DECLARE_ANIMATED_PROPERTY(SVGFEMorphologyElement, SVGNames::inAttr, String, In1, in1)
+        DECLARE_ANIMATED_PROPERTY(SVGFEMorphologyElement, SVGNames::operatorAttr, int, _operator, _operator)
+        DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGFEMorphologyElement, SVGNames::radiusAttr, SVGRadiusXAttrIdentifier, float, RadiusX, radiusX)
+        DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGFEMorphologyElement, SVGNames::radiusAttr, SVGRadiusYAttrIdentifier, float, RadiusY, radiusY)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.idl
index cce0e365a8..ffd228957e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEMorphologyElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEMorphologyElement : SVGElement,
                                                              SVGFilterPrimitiveStandardAttributes {
         // Morphology Operators
         const unsigned short SVG_MORPHOLOGY_OPERATOR_UNKNOWN  = 0;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.cpp
index 945a9dab79..28955c0df2 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -33,9 +31,6 @@ namespace WebCore {
 
 SVGFEOffsetElement::SVGFEOffsetElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_in1(this, SVGNames::inAttr)
-    , m_dx(this, SVGNames::dxAttr)
-    , m_dy(this, SVGNames::dyAttr)
 {
 }
 
@@ -56,6 +51,25 @@ void SVGFEOffsetElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+void SVGFEOffsetElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeDx();
+        synchronizeDy();
+        synchronizeIn1();
+        return;
+    }
+
+    if (attrName == SVGNames::dxAttr)
+        synchronizeDx();
+    else if (attrName == SVGNames::dyAttr)
+        synchronizeDy();
+    else if (attrName == SVGNames::inAttr)
+        synchronizeIn1();
+}
+
 bool SVGFEOffsetElement::build(SVGResourceFilter* filterResource)
 {
     FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.h
index 1471abe8e3..df61a9c357 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -35,12 +33,13 @@ namespace WebCore {
         virtual ~SVGFEOffsetElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool build(SVGResourceFilter*);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEOffsetElement, SVGNames::feOffsetTagString, SVGNames::inAttrString, String, In1, in1)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEOffsetElement, SVGNames::feOffsetTagString, SVGNames::dxAttrString, float, Dx, dx)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEOffsetElement, SVGNames::feOffsetTagString, SVGNames::dyAttrString, float, Dy, dy)
+        DECLARE_ANIMATED_PROPERTY(SVGFEOffsetElement, SVGNames::inAttr, String, In1, in1)
+        DECLARE_ANIMATED_PROPERTY(SVGFEOffsetElement, SVGNames::dxAttr, float, Dx, dx)
+        DECLARE_ANIMATED_PROPERTY(SVGFEOffsetElement, SVGNames::dyAttr, float, Dy, dy)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.cpp
index 088f8787c8..36ed2e97ab 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.cpp
@@ -34,10 +34,10 @@ SVGFEPointLightElement::~SVGFEPointLightElement()
 {
 }
 
-LightSource* SVGFEPointLightElement::lightSource() const
+PassRefPtr<LightSource> SVGFEPointLightElement::lightSource() const
 {
     FloatPoint3D pos(x(), y(), z());
-    return new PointLightSource(pos);
+    return PointLightSource::create(pos);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.h
index b39fffa21b..9b1f997b51 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.h
@@ -29,7 +29,7 @@ namespace WebCore {
         SVGFEPointLightElement(const QualifiedName&, Document*);
         virtual ~SVGFEPointLightElement();
 
-        virtual LightSource* lightSource() const;
+        virtual PassRefPtr<LightSource> lightSource() const;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.cpp
index 7afa4cc366..0602103022 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.cpp
@@ -36,12 +36,9 @@ namespace WebCore {
 
 SVGFESpecularLightingElement::SVGFESpecularLightingElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_in1(this, SVGNames::inAttr)
-    , m_specularConstant(this, SVGNames::specularConstantAttr, 1.0f)
-    , m_specularExponent(this, SVGNames::specularExponentAttr, 1.0f)
-    , m_surfaceScale(this, SVGNames::surfaceScaleAttr, 1.0f)
-    , m_kernelUnitLengthX(this, SVGNames::kernelUnitLengthAttr)
-    , m_kernelUnitLengthY(this, SVGNames::kernelUnitLengthAttr)
+    , m_specularConstant(1.0f)
+    , m_specularExponent(1.0f)
+    , m_surfaceScale(1.0f)
 {
 }
 
@@ -70,20 +67,46 @@ void SVGFESpecularLightingElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-LightSource* SVGFESpecularLightingElement::findLights() const
+void SVGFESpecularLightingElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeIn1();
+        synchronizeSurfaceScale();
+        synchronizeSpecularConstant();
+        synchronizeSpecularExponent();
+        synchronizeKernelUnitLengthX();
+        synchronizeKernelUnitLengthY();
+        return;
+    }
+
+    if (attrName == SVGNames::inAttr)
+        synchronizeIn1();
+    else if (attrName == SVGNames::surfaceScaleAttr)
+        synchronizeSurfaceScale();
+    else if (attrName == SVGNames::specularConstantAttr)
+        synchronizeSpecularConstant();
+    else if (attrName == SVGNames::specularExponentAttr)
+        synchronizeSpecularExponent();
+    else if (attrName == SVGNames::kernelUnitLengthAttr) {
+        synchronizeKernelUnitLengthX();
+        synchronizeKernelUnitLengthY();
+    }
+}
+
+PassRefPtr<LightSource> SVGFESpecularLightingElement::findLights() const
 {
-    LightSource* light = 0;
     for (Node* n = firstChild(); n; n = n->nextSibling()) {
         if (n->hasTagName(SVGNames::feDistantLightTag) ||
             n->hasTagName(SVGNames::fePointLightTag) ||
             n->hasTagName(SVGNames::feSpotLightTag)) {
             SVGFELightElement* lightNode = static_cast<SVGFELightElement*>(n); 
-            light = lightNode->lightSource();
-            break;
+            return lightNode->lightSource();
         }
     }
 
-    return light;
+    return 0;
 }
 
 bool SVGFESpecularLightingElement::build(SVGResourceFilter* filterResource)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.h
index 8ef490a01e..fe569802af 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.h
@@ -31,25 +31,24 @@ namespace WebCore {
     extern char SVGKernelUnitLengthXIdentifier[];
     extern char SVGKernelUnitLengthYIdentifier[];
 
-    class SVGColor;
-    
     class SVGFESpecularLightingElement : public SVGFilterPrimitiveStandardAttributes {
     public:
         SVGFESpecularLightingElement(const QualifiedName&, Document*);
         virtual ~SVGFESpecularLightingElement();
         
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool build(SVGResourceFilter*);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGNames::inAttrString, String, In1, in1)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGNames::specularConstantAttrString, float, SpecularConstant, specularConstant)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGNames::specularExponentAttrString, float, SpecularExponent, specularExponent)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGNames::surfaceScaleAttrString, float, SurfaceScale, surfaceScale)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGKernelUnitLengthXIdentifier, float, KernelUnitLengthX, kernelUnitLengthX)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGKernelUnitLengthYIdentifier, float, KernelUnitLengthY, kernelUnitLengthY)
-        
-        LightSource* findLights() const;
+        DECLARE_ANIMATED_PROPERTY(SVGFESpecularLightingElement, SVGNames::inAttr, String, In1, in1)
+        DECLARE_ANIMATED_PROPERTY(SVGFESpecularLightingElement, SVGNames::specularConstantAttr, float, SpecularConstant, specularConstant)
+        DECLARE_ANIMATED_PROPERTY(SVGFESpecularLightingElement, SVGNames::specularExponentAttr, float, SpecularExponent, specularExponent)
+        DECLARE_ANIMATED_PROPERTY(SVGFESpecularLightingElement, SVGNames::surfaceScaleAttr, float, SurfaceScale, surfaceScale)
+        DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGFESpecularLightingElement, SVGNames::kernelUnitLengthAttr, SVGKernelUnitLengthXIdentifier, float, KernelUnitLengthX, kernelUnitLengthX)
+        DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGFESpecularLightingElement, SVGNames::kernelUnitLengthAttr, SVGKernelUnitLengthYIdentifier, float, KernelUnitLengthY, kernelUnitLengthY)
+
+        PassRefPtr<LightSource> findLights() const;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.cpp
index 980a3bb6cd..01fe54e88d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.cpp
@@ -34,7 +34,7 @@ SVGFESpotLightElement::~SVGFESpotLightElement()
 {
 }
 
-LightSource* SVGFESpotLightElement::lightSource() const
+PassRefPtr<LightSource> SVGFESpotLightElement::lightSource() const
 {
     FloatPoint3D pos(x(), y(), z());
 
@@ -44,7 +44,7 @@ LightSource* SVGFESpotLightElement::lightSource() const
                            pointsAtZ() - pos.z());
 
     direction.normalize();
-    return new SpotLightSource(pos, direction, specularExponent(), limitingConeAngle());
+    return SpotLightSource::create(pos, direction, specularExponent(), limitingConeAngle());
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.h
index 440c664cf8..d54e2324a7 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.h
@@ -29,7 +29,7 @@ namespace WebCore {
         SVGFESpotLightElement(const QualifiedName&, Document*);
         virtual ~SVGFESpotLightElement();
 
-        virtual LightSource* lightSource() const;
+        virtual PassRefPtr<LightSource> lightSource() const;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.cpp
index 14af25fa76..94c8e74822 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -34,7 +32,6 @@ namespace WebCore {
 
 SVGFETileElement::SVGFETileElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_in1(this, SVGNames::inAttr)
 {
 }
 
@@ -51,6 +48,14 @@ void SVGFETileElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+void SVGFETileElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
+
+    if (attrName == anyQName() || attrName == SVGNames::inAttr)
+        synchronizeIn1();
+}
+
 bool SVGFETileElement::build(SVGResourceFilter* filterResource)
 {
     FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.h
index b4fc0c54ba..2c86abd55c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -35,10 +33,11 @@ namespace WebCore {
         virtual ~SVGFETileElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool build(SVGResourceFilter*);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFETileElement, SVGNames::feTileTagString, SVGNames::inAttrString, String, In1, in1)
+        DECLARE_ANIMATED_PROPERTY(SVGFETileElement, SVGNames::inAttr, String, In1, in1)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.cpp
index b296e00598..622971cb05 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -36,12 +34,9 @@ char SVGBaseFrequencyYIdentifier[] = "SVGBaseFrequencyY";
 
 SVGFETurbulenceElement::SVGFETurbulenceElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_baseFrequencyX(this, SVGNames::baseFrequencyAttr)
-    , m_baseFrequencyY(this, SVGNames::baseFrequencyAttr)
-    , m_numOctaves(this, SVGNames::numOctavesAttr, 1)
-    , m_seed(this, SVGNames::seedAttr)
-    , m_stitchTiles(this, SVGNames::stitchTilesAttr, SVG_STITCHTYPE_NOSTITCH)
-    , m_type(this, SVGNames::typeAttr, FETURBULENCE_TYPE_TURBULENCE)
+    , m_numOctaves(1)
+    , m_stitchTiles(SVG_STITCHTYPE_NOSTITCH)
+    , m_type(FETURBULENCE_TYPE_TURBULENCE)
 {
 }
 
@@ -76,6 +71,33 @@ void SVGFETurbulenceElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+void SVGFETurbulenceElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeType();
+        synchronizeStitchTiles();
+        synchronizeBaseFrequencyX();
+        synchronizeBaseFrequencyY();
+        synchronizeSeed();
+        synchronizeNumOctaves();
+        return;
+    }
+
+    if (attrName == SVGNames::typeAttr)
+        synchronizeType();
+    else if (attrName == SVGNames::stitchTilesAttr)
+        synchronizeStitchTiles();
+    else if (attrName == SVGNames::baseFrequencyAttr) {
+        synchronizeBaseFrequencyX();
+        synchronizeBaseFrequencyY();
+    } else if (attrName == SVGNames::seedAttr)
+        synchronizeSeed();
+    else if (attrName == SVGNames::numOctavesAttr)
+        synchronizeNumOctaves();
+}
+
 bool SVGFETurbulenceElement::build(SVGResourceFilter* filterResource)
 {
     RefPtr<FilterEffect> effect = FETurbulence::create(static_cast<TurbulanceType>(type()), baseFrequencyX(), 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.h
index 3c95da8d1b..464ce25862 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -44,15 +42,16 @@ namespace WebCore {
         virtual ~SVGFETurbulenceElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool build(SVGResourceFilter*);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFETurbulenceElement, SVGNames::feTurbulenceTagString, SVGBaseFrequencyXIdentifier, float, BaseFrequencyX, baseFrequencyX)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFETurbulenceElement, SVGNames::feTurbulenceTagString, SVGBaseFrequencyYIdentifier, float, BaseFrequencyY, baseFrequencyY)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFETurbulenceElement, SVGNames::feTurbulenceTagString, SVGNames::numOctavesAttrString, long, NumOctaves, numOctaves)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFETurbulenceElement, SVGNames::feTurbulenceTagString, SVGNames::seedAttrString, float, Seed, seed)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFETurbulenceElement, SVGNames::feTurbulenceTagString, SVGNames::stitchTilesAttrString, int, StitchTiles, stitchTiles)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFETurbulenceElement, SVGNames::feTurbulenceTagString, SVGNames::typeAttrString, int, Type, type)
+        DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGFETurbulenceElement, SVGNames::baseFrequencyAttr, SVGBaseFrequencyXIdentifier, float, BaseFrequencyX, baseFrequencyX)
+        DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGFETurbulenceElement, SVGNames::baseFrequencyAttr, SVGBaseFrequencyYIdentifier, float, BaseFrequencyY, baseFrequencyY)
+        DECLARE_ANIMATED_PROPERTY(SVGFETurbulenceElement, SVGNames::numOctavesAttr, long, NumOctaves, numOctaves)
+        DECLARE_ANIMATED_PROPERTY(SVGFETurbulenceElement, SVGNames::seedAttr, float, Seed, seed)
+        DECLARE_ANIMATED_PROPERTY(SVGFETurbulenceElement, SVGNames::stitchTilesAttr, int, StitchTiles, stitchTiles)
+        DECLARE_ANIMATED_PROPERTY(SVGFETurbulenceElement, SVGNames::typeAttr, int, Type, type)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.idl
index 9cec66c111..934eddf449 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFETurbulenceElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFETurbulenceElement : SVGElement,
                                                          SVGFilterPrimitiveStandardAttributes { 
         // Turbulence Types
         const unsigned short SVG_TURBULENCE_TYPE_UNKNOWN      = 0;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp
index db461796bd..60375fbb4e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -28,12 +26,14 @@
 #include "SVGFilterElement.h"
 
 #include "Attr.h"
-#include "SVGFilterBuilder.h"
+#include "FloatSize.h"
 #include "MappedAttribute.h"
 #include "PlatformString.h"
+#include "SVGFilterBuilder.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
+#include "SVGParserUtilities.h"
 #include "SVGResourceFilter.h"
 #include "SVGUnitTypes.h"
 
@@ -47,16 +47,12 @@ SVGFilterElement::SVGFilterElement(const QualifiedName& tagName, Document* doc)
     , SVGURIReference()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
-    , m_filterUnits(this, SVGNames::filterUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
-    , m_primitiveUnits(this, SVGNames::primitiveUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
-    , m_x(this, SVGNames::xAttr, LengthModeWidth, "-10%")
-    , m_y(this, SVGNames::yAttr, LengthModeHeight, "-10%")
-    , m_width(this, SVGNames::widthAttr, LengthModeWidth, "120%")
-    , m_height(this, SVGNames::heightAttr, LengthModeHeight, "120%")
-    , m_filterResX(this, SVGNames::filterResAttr)
-    , m_filterResY(this, SVGNames::filterResAttr)
-    , m_href(this, XLinkNames::hrefAttr)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_filterUnits(SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
+    , m_primitiveUnits(SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
+    , m_x(LengthModeWidth, "-10%")
+    , m_y(LengthModeHeight, "-10%")
+    , m_width(LengthModeWidth, "120%")
+    , m_height(LengthModeHeight, "120%")
 {
     // Spec: If the x/y attribute is not specified, the effect is as if a value of "-10%" were specified.
     // Spec: If the width/height attribute is not specified, the effect is as if a value of "120%" were specified.
@@ -91,7 +87,13 @@ void SVGFilterElement::parseMappedAttribute(MappedAttribute* attr)
         setWidthBaseValue(SVGLength(LengthModeWidth, value));
     else if (attr->name() == SVGNames::heightAttr)
         setHeightBaseValue(SVGLength(LengthModeHeight, value));
-    else {
+    else if (attr->name() == SVGNames::filterResAttr) {
+        float x, y;
+        if (parseNumberOptionalNumber(value, x, y)) {
+            setFilterResXBaseValue(x);
+            setFilterResYBaseValue(y);
+        }
+    } else {
         if (SVGURIReference::parseMappedAttribute(attr))
             return;
         if (SVGLangSpace::parseMappedAttribute(attr))
@@ -103,6 +105,62 @@ void SVGFilterElement::parseMappedAttribute(MappedAttribute* attr)
     }
 }
 
+void SVGFilterElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeX();
+        synchronizeY();
+        synchronizeWidth();
+        synchronizeHeight();
+        synchronizeFilterUnits();
+        synchronizePrimitiveUnits();
+        synchronizeFilterResX();
+        synchronizeFilterResY();
+        synchronizeExternalResourcesRequired();
+        synchronizeHref();
+        return;
+    }
+
+    if (attrName == SVGNames::xAttr)
+        synchronizeX();
+    else if (attrName == SVGNames::yAttr)
+        synchronizeY();
+    else if (attrName == SVGNames::widthAttr)
+        synchronizeWidth();
+    else if (attrName == SVGNames::heightAttr)
+        synchronizeHeight();
+    else if (attrName == SVGNames::filterUnitsAttr)
+        synchronizeFilterUnits();
+    else if (attrName == SVGNames::primitiveUnitsAttr)
+        synchronizePrimitiveUnits();
+    else if (attrName == SVGNames::filterResAttr) {
+        synchronizeFilterResX();
+        synchronizeFilterResY();
+    } else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+    else if (SVGURIReference::isKnownAttribute(attrName))
+        synchronizeHref();
+}
+
+FloatRect SVGFilterElement::filterBoundingBox(const FloatRect& objectBoundingBox) const
+{
+    FloatRect filterBBox;
+    if (filterUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
+        filterBBox = FloatRect(x().valueAsPercentage() * objectBoundingBox.width() + objectBoundingBox.x(),
+                               y().valueAsPercentage() * objectBoundingBox.height() + objectBoundingBox.y(),
+                               width().valueAsPercentage() * objectBoundingBox.width(),
+                               height().valueAsPercentage() * objectBoundingBox.height());
+    else
+        filterBBox = FloatRect(x().value(this),
+                               y().value(this),
+                               width().value(this),
+                               height().value(this));
+
+    return filterBBox;
+}
+
 void SVGFilterElement::buildFilter(const FloatRect& targetRect) const
 {
     bool filterBBoxMode = filterUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX;
@@ -132,6 +190,11 @@ void SVGFilterElement::buildFilter(const FloatRect& targetRect) const
     m_filter->setEffectBoundingBoxMode(primitiveBBoxMode);
     m_filter->setFilterBoundingBoxMode(filterBBoxMode);
 
+    if (hasAttribute(SVGNames::filterResAttr)) {
+        m_filter->setHasFilterResolution(true);
+        m_filter->setFilterResolution(FloatSize(filterResX(), filterResY()));
+    }
+
     // Add effects to the filter
     m_filter->builder()->clearEffects();
     for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
@@ -149,7 +212,7 @@ void SVGFilterElement::buildFilter(const FloatRect& targetRect) const
     }
 }
 
-SVGResource* SVGFilterElement::canvasResource()
+SVGResource* SVGFilterElement::canvasResource(const RenderObject*)
 {
     if (!attached())
         return 0;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h
index 836c689364..c89352beae 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h
@@ -23,6 +23,7 @@
 #define SVGFilterElement_h
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
+#include "RenderObject.h"
 #include "SVGResourceFilter.h"
 #include "SVGExternalResourcesRequired.h"
 #include "SVGLangSpace.h"
@@ -34,6 +35,8 @@ namespace WebCore {
     extern char SVGFilterResXIdentifier[];
     extern char SVGFilterResYIdentifier[];
 
+    class SVGResourceFilter;
+
     class SVGFilterElement : public SVGStyledElement,
                              public SVGURIReference,
                              public SVGLangSpace,
@@ -42,35 +45,35 @@ namespace WebCore {
         SVGFilterElement(const QualifiedName&, Document*);
         virtual ~SVGFilterElement();
 
-        virtual SVGResource* canvasResource();
+        virtual SVGResource* canvasResource(const RenderObject*);
 
         void setFilterRes(unsigned long filterResX, unsigned long filterResY) const;
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGNames::filterUnitsAttrString, int, FilterUnits, filterUnits)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGNames::primitiveUnitsAttrString, int, PrimitiveUnits, primitiveUnits)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGNames::xAttrString, SVGLength, X, x)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGNames::yAttrString, SVGLength, Y, y)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGNames::widthAttrString, SVGLength, Width, width)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGNames::heightAttrString, SVGLength, Height, height)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGFilterResXIdentifier, long, FilterResX, filterResX)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGFilterResYIdentifier, long, FilterResY, filterResY)
+        DECLARE_ANIMATED_PROPERTY(SVGFilterElement, SVGNames::filterUnitsAttr, int, FilterUnits, filterUnits)
+        DECLARE_ANIMATED_PROPERTY(SVGFilterElement, SVGNames::primitiveUnitsAttr, int, PrimitiveUnits, primitiveUnits)
+        DECLARE_ANIMATED_PROPERTY(SVGFilterElement, SVGNames::xAttr, SVGLength, X, x)
+        DECLARE_ANIMATED_PROPERTY(SVGFilterElement, SVGNames::yAttr, SVGLength, Y, y)
+        DECLARE_ANIMATED_PROPERTY(SVGFilterElement, SVGNames::widthAttr, SVGLength, Width, width)
+        DECLARE_ANIMATED_PROPERTY(SVGFilterElement, SVGNames::heightAttr, SVGLength, Height, height)
+        DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGFilterElement, SVGNames::filterResAttr, SVGFilterResXIdentifier, long, FilterResX, filterResX)
+        DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGFilterElement, SVGNames::filterResAttr, SVGFilterResYIdentifier, long, FilterResY, filterResY)
 
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+        DECLARE_ANIMATED_PROPERTY(SVGFilterElement, XLinkNames::hrefAttr, String, Href, href)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGFilterElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
 
         mutable RefPtr<SVGResourceFilter> m_filter;
 
     private:
         friend class SVGResourceFilter;
+        FloatRect filterBoundingBox(const FloatRect&) const;
         void buildFilter(const FloatRect& targetRect) const;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
index 67c8bff5f9..0a9552278b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
@@ -33,15 +33,12 @@
 
 namespace WebCore {
 
-char SVGFilterPrimitiveStandardAttributesIdentifierIdentifier[] = "SVGFilterPrimitiveStandardAttributesIdentifier";
-
 SVGFilterPrimitiveStandardAttributes::SVGFilterPrimitiveStandardAttributes(const QualifiedName& tagName, Document* doc)
     : SVGStyledElement(tagName, doc)
-    , m_x(this, SVGNames::xAttr, LengthModeWidth, "0%")
-    , m_y(this, SVGNames::yAttr, LengthModeHeight, "0%")
-    , m_width(this, SVGNames::widthAttr, LengthModeWidth, "100%")
-    , m_height(this, SVGNames::heightAttr, LengthModeHeight, "100%")
-    , m_result(this, SVGNames::resultAttr)
+    , m_x(LengthModeWidth, "0%")
+    , m_y(LengthModeHeight, "0%")
+    , m_width(LengthModeWidth, "100%")
+    , m_height(LengthModeHeight, "100%")
 {
     // Spec: If the x/y attribute is not specified, the effect is as if a value of "0%" were specified.
     // Spec: If the width/height attribute is not specified, the effect is as if a value of "100%" were specified.
@@ -68,6 +65,31 @@ void SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(MappedAttribute*
         return SVGStyledElement::parseMappedAttribute(attr);
 }
 
+void SVGFilterPrimitiveStandardAttributes::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeX();
+        synchronizeY();
+        synchronizeWidth();
+        synchronizeHeight();
+        synchronizeResult();
+        return;
+    }
+
+    if (attrName == SVGNames::xAttr)
+        synchronizeX();
+    else if (attrName == SVGNames::yAttr)
+        synchronizeY();
+    else if (attrName == SVGNames::widthAttr)
+        synchronizeWidth();
+    else if (attrName == SVGNames::heightAttr)
+        synchronizeHeight();
+    else if (attrName == SVGNames::resultAttr)
+        synchronizeResult();
+}
+
 void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(SVGResourceFilter* resourceFilter, FilterEffect* filterEffect) const
 {
     ASSERT(filterEffect);
@@ -97,7 +119,7 @@ void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(SVGResourceFilt
                                width().value(this),
                                height().value(this));
 
-    filterEffect->setSubRegion(effectBBox);
+    filterEffect->setEffectBoundaries(effectBBox);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
index cb8ec1c1e3..fb8e5f2128 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
@@ -29,8 +29,6 @@
 
 namespace WebCore {
 
-    extern char SVGFilterPrimitiveStandardAttributesIdentifier[];
-
     class SVGResourceFilter;
 
     class SVGFilterPrimitiveStandardAttributes : public SVGStyledElement {
@@ -41,6 +39,7 @@ namespace WebCore {
         virtual bool isFilterEffect() const { return true; }
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool build(SVGResourceFilter*) = 0;
 
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
@@ -50,11 +49,11 @@ namespace WebCore {
         void setStandardAttributes(SVGResourceFilter*, FilterEffect*) const;
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterPrimitiveStandardAttributes, SVGFilterPrimitiveStandardAttributesIdentifier, SVGNames::xAttrString, SVGLength, X, x)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterPrimitiveStandardAttributes, SVGFilterPrimitiveStandardAttributesIdentifier, SVGNames::yAttrString, SVGLength, Y, y)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterPrimitiveStandardAttributes, SVGFilterPrimitiveStandardAttributesIdentifier, SVGNames::widthAttrString, SVGLength, Width, width)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterPrimitiveStandardAttributes, SVGFilterPrimitiveStandardAttributesIdentifier, SVGNames::heightAttrString, SVGLength, Height, height)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterPrimitiveStandardAttributes, SVGFilterPrimitiveStandardAttributesIdentifier, SVGNames::resultAttrString, String, Result, result)
+        DECLARE_ANIMATED_PROPERTY(SVGFilterPrimitiveStandardAttributes, SVGNames::xAttr, SVGLength, X, x)
+        DECLARE_ANIMATED_PROPERTY(SVGFilterPrimitiveStandardAttributes, SVGNames::yAttr, SVGLength, Y, y)
+        DECLARE_ANIMATED_PROPERTY(SVGFilterPrimitiveStandardAttributes, SVGNames::widthAttr, SVGLength, Width, width)
+        DECLARE_ANIMATED_PROPERTY(SVGFilterPrimitiveStandardAttributes, SVGNames::heightAttr, SVGLength, Height, height)
+        DECLARE_ANIMATED_PROPERTY(SVGFilterPrimitiveStandardAttributes, SVGNames::resultAttr, String, Result, result)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp
index c566a8f89e..64c978fe34 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp
@@ -23,6 +23,7 @@
 #if ENABLE(SVG)
 #include "SVGFitToViewBox.h"
 
+#include "AffineTransform.h"
 #include "Attr.h"
 #include "Document.h"
 #include "FloatRect.h"
@@ -31,12 +32,9 @@
 #include "SVGParserUtilities.h"
 #include "SVGPreserveAspectRatio.h"
 #include "StringImpl.h"
-#include "TransformationMatrix.h"
 
 namespace WebCore {
 
-char SVGFitToViewBoxIdentifier[] = "SVGFitToViewBox";
-
 SVGFitToViewBox::SVGFitToViewBox()
 {
 }
@@ -77,13 +75,12 @@ bool SVGFitToViewBox::parseViewBox(Document* doc, const UChar*& c, const UChar*
     return true;
 }
 
-TransformationMatrix SVGFitToViewBox::viewBoxToViewTransform(const FloatRect& viewBoxRect, SVGPreserveAspectRatio* preserveAspectRatio, float viewWidth, float viewHeight)
+AffineTransform SVGFitToViewBox::viewBoxToViewTransform(const FloatRect& viewBoxRect, const SVGPreserveAspectRatio& preserveAspectRatio, float viewWidth, float viewHeight)
 {
-    ASSERT(preserveAspectRatio);
     if (!viewBoxRect.width() || !viewBoxRect.height())
-        return TransformationMatrix();
+        return AffineTransform();
 
-    return preserveAspectRatio->getCTM(viewBoxRect.x(), viewBoxRect.y(), viewBoxRect.width(), viewBoxRect.height(), 0, 0, viewWidth, viewHeight);
+    return preserveAspectRatio.getCTM(viewBoxRect.x(), viewBoxRect.y(), viewBoxRect.width(), viewBoxRect.height(), 0, 0, viewWidth, viewHeight);
 }
 
 bool SVGFitToViewBox::parseMappedAttribute(Document* document, MappedAttribute* attr)
@@ -96,9 +93,7 @@ bool SVGFitToViewBox::parseMappedAttribute(Document* document, MappedAttribute*
             setViewBoxBaseValue(FloatRect(x, y, w, h));
         return true;
     } else if (attr->name() == SVGNames::preserveAspectRatioAttr) {
-        const UChar* c = attr->value().characters();
-        const UChar* end = c + attr->value().length();
-        preserveAspectRatioBaseValue()->parsePreserveAspectRatio(c, end);
+        SVGPreserveAspectRatio::parsePreserveAspectRatio(this, attr->value());
         return true;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.h b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.h
index 503a0ef064..ef7e54b56f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.h
@@ -27,27 +27,22 @@
 
 namespace WebCore {
 
-    extern char SVGFitToViewBoxIdentifier[];
+class AffineTransform;
 
-    class TransformationMatrix;
+class SVGFitToViewBox {
+public:
+    SVGFitToViewBox();
+    virtual ~SVGFitToViewBox();
 
-    class SVGFitToViewBox {
-    public:
-        SVGFitToViewBox();
-        virtual ~SVGFitToViewBox();
+    bool parseViewBox(Document*, const UChar*& start, const UChar* end, float& x, float& y, float& w, float& h, bool validate = true);
+    static AffineTransform viewBoxToViewTransform(const FloatRect& viewBoxRect, const SVGPreserveAspectRatio&, float viewWidth, float viewHeight);
 
-        bool parseViewBox(Document*, const UChar*& start, const UChar* end, float& x, float& y, float& w, float& h, bool validate = true);
-        static TransformationMatrix viewBoxToViewTransform(const FloatRect& viewBoxRect, SVGPreserveAspectRatio*, float viewWidth, float viewHeight);
+    bool parseMappedAttribute(Document*, MappedAttribute*);
+    bool isKnownAttribute(const QualifiedName&);
 
-        bool parseMappedAttribute(Document*, MappedAttribute*);
-        bool isKnownAttribute(const QualifiedName&);
-
-    protected:
-        virtual SVGAnimatedTypeValue<FloatRect>::DecoratedType viewBoxBaseValue() const = 0;
-        virtual void setViewBoxBaseValue(SVGAnimatedTypeValue<FloatRect>::DecoratedType type) = 0;
-
-        virtual SVGAnimatedTypeValue<SVGPreserveAspectRatio>::DecoratedType preserveAspectRatioBaseValue() const = 0;
-    };
+    virtual void setViewBoxBaseValue(SVGAnimatedPropertyTraits<FloatRect>::PassType) = 0;
+    virtual void setPreserveAspectRatioBaseValue(SVGAnimatedPropertyTraits<SVGPreserveAspectRatio>::PassType) = 0;
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.idl b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.idl
index a747fc8258..d456cf813f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.idl
@@ -26,7 +26,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, ObjCProtocol] SVGFitToViewBox {
+    interface [Conditional=SVG, ObjCProtocol, OmitConstructor] SVGFitToViewBox {
         readonly attribute SVGAnimatedRect                viewBox;
         readonly attribute SVGAnimatedPreserveAspectRatio preserveAspectRatio;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFont.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFont.cpp
index 7e3cec049f..dacbac2546 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFont.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFont.cpp
@@ -1,5 +1,6 @@
 /**
  * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -240,10 +241,10 @@ struct SVGTextRunWalker {
 
     void walk(const TextRun& run, bool isVerticalText, const String& language, int from, int to)
     {
-        // Should hold true for SVG text, otherwhise sth. is wrong
-        ASSERT(to - from == run.length());
+        ASSERT(0 <= from && from <= to && to - from <= run.length());
 
-        Vector<SVGGlyphIdentifier::ArabicForm> chars(charactersWithArabicForm(String(run.data(from), run.length()), run.rtl()));
+        const String text = Font::normalizeSpaces(String(run.data(from), run.length()));
+        Vector<SVGGlyphIdentifier::ArabicForm> chars(charactersWithArabicForm(text, run.rtl()));
 
         SVGGlyphIdentifier identifier;
         bool foundGlyph = false;
@@ -270,7 +271,8 @@ struct SVGTextRunWalker {
             // extended to the n-th next character (where n is 'characterLookupRange'), to check for any possible ligature.
             characterLookupRange = endOfScanRange - i;
 
-            String lookupString(run.data(i), characterLookupRange);
+            String lookupString = Font::normalizeSpaces(String(run.data(i), characterLookupRange));
+
             Vector<SVGGlyphIdentifier> glyphs;
             if (haveAltGlyph)
                 glyphs.append(altGlyphIdentifier);
@@ -527,22 +529,16 @@ void Font::drawTextUsingSVGFont(GraphicsContext* context, const TextRun& run,
                         glyphOrigin.setY(identifier.verticalOriginY * scale);
                     }
 
-                    context->translate(xStartOffset + currentPoint.x() + glyphOrigin.x(), currentPoint.y() + glyphOrigin.y());
-                    context->scale(FloatSize(scale, -scale));
+                    AffineTransform glyphPathTransform;
+                    glyphPathTransform.translate(xStartOffset + currentPoint.x() + glyphOrigin.x(), currentPoint.y() + glyphOrigin.y());
+                    glyphPathTransform.scale(scale, -scale);
 
-                    context->beginPath();
-                    context->addPath(identifier.pathData);
+                    Path glyphPath = identifier.pathData;
+                    glyphPath.transform(glyphPathTransform);
 
-                    // FIXME: setup() tries to get objectBoundingBox() from run.referencingRenderObject()
-                    // which is wrong.  We need to change setup() to take a bounding box instead, or pass
-                    // a RenderObject which would return the bounding box for identifier.pathData
+                    context->beginPath();
+                    context->addPath(glyphPath);
                     if (activePaintServer->setup(context, run.referencingRenderObject(), targetType)) {
-                        // Spec: Any properties specified on a text elements which represents a length, such as the
-                        // 'stroke-width' property, might produce surprising results since the length value will be
-                        // processed in the coordinate system of the glyph. (TODO: What other lengths? miter-limit? dash-offset?)
-                        if (targetType == ApplyToStrokeTargetType && scale != 0.0f)
-                            context->setStrokeThickness(context->strokeThickness() / scale);
-
                         activePaintServer->renderPath(context, run.referencingRenderObject(), targetType);
                         activePaintServer->teardown(context, run.referencingRenderObject(), targetType);
                     }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFontData.h b/src/3rdparty/webkit/WebCore/svg/SVGFontData.h
index 4df3db2f74..3f17e3e095 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFontData.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFontData.h
@@ -26,7 +26,7 @@
 
 namespace WebCore {
 
-class SVGFontData {
+class SVGFontData : public Noncopyable {
 public:
     SVGFontData(SVGFontFaceElement*);
     virtual ~SVGFontData();
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFontElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFontElement.cpp
index 7d62b8ccfa..91d222ce9c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFontElement.cpp
@@ -40,7 +40,6 @@ using namespace SVGNames;
 
 SVGFontElement::SVGFontElement(const QualifiedName& tagName, Document* doc)
     : SVGStyledElement(tagName, doc) 
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
     , m_isGlyphCacheValid(false)
 {
 }
@@ -49,6 +48,14 @@ SVGFontElement::~SVGFontElement()
 {
 }
 
+void SVGFontElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName() || SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+}
+
 void SVGFontElement::invalidateGlyphCache()
 {
     if (m_isGlyphCacheValid) {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFontElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFontElement.h
index 1fc51367ec..90641a85e2 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFontElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFontElement.h
@@ -37,6 +37,7 @@ namespace WebCore {
         SVGFontElement(const QualifiedName&, Document*);
         virtual ~SVGFontElement();
 
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }    
 
         void invalidateGlyphCache();
@@ -49,9 +50,7 @@ namespace WebCore {
 
     private:
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFontElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGFontElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
 
         void ensureGlyphCache() const;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp
index aa0b6d8cea..25b3aea61d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp
@@ -62,13 +62,6 @@ SVGFontFaceElement::~SVGFontFaceElement()
     removeFromMappedElementSheet();
 }
 
-static void mapAttributeToCSSProperty(HashMap<AtomicStringImpl*, int>* propertyNameToIdMap, const QualifiedName& attrName)
-{
-    int propertyId = cssPropertyID(attrName.localName());
-    ASSERT(propertyId > 0);
-    propertyNameToIdMap->set(attrName.localName().impl(), propertyId);
-}
-
 static int cssPropertyIdForSVGAttributeName(const QualifiedName& attrName)
 {
     if (!attrName.namespaceURI().isNull())
@@ -282,7 +275,7 @@ void SVGFontFaceElement::rebuildFontFace()
             srcElement = static_cast<SVGFontFaceSrcElement*>(child);
     }
 
-    bool describesParentFont = parentNode()->hasTagName(fontTag);
+    bool describesParentFont = parentNode()->hasTagName(SVGNames::fontTag);
     RefPtr<CSSValueList> list;
 
     if (describesParentFont) {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFontFaceUriElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFontFaceUriElement.cpp
index 096f0c25f1..bfcda70f73 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFontFaceUriElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFontFaceUriElement.cpp
@@ -91,9 +91,11 @@ void SVGFontFaceUriElement::loadFont()
     if (!href.isNull()) {        
         DocLoader* docLoader = document()->docLoader();
         m_cachedFont = docLoader->requestFont(href);
-        m_cachedFont->setSVGFont(true);
-        m_cachedFont->addClient(this);
-        m_cachedFont->beginLoadIfNeeded(docLoader);
+        if (m_cachedFont) {
+            m_cachedFont->setSVGFont(true);
+            m_cachedFont->addClient(this);
+            m_cachedFont->beginLoadIfNeeded(docLoader);
+        }
     } else
         m_cachedFont = 0;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp
index 1e75741456..d28e2a4363 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp
@@ -39,12 +39,10 @@ SVGForeignObjectElement::SVGForeignObjectElement(const QualifiedName& tagName, D
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
-    , m_x(this, SVGNames::xAttr, LengthModeWidth)
-    , m_y(this, SVGNames::yAttr, LengthModeHeight)
-    , m_width(this, SVGNames::widthAttr, LengthModeWidth)
-    , m_height(this, SVGNames::heightAttr, LengthModeHeight)
-    , m_href(this, XLinkNames::hrefAttr)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_x(LengthModeWidth)
+    , m_y(LengthModeHeight)
+    , m_width(LengthModeWidth)
+    , m_height(LengthModeHeight)
 {
 }
 
@@ -74,83 +72,50 @@ void SVGForeignObjectElement::parseMappedAttribute(MappedAttribute* attr)
     }
 }
 
-// TODO: Move this function in some SVG*Element base class, as SVGSVGElement / SVGImageElement will need the same logic!
-
-// This function mimics addCSSProperty and StyledElement::attributeChanged.
-// In HTML code, you'd always call addCSSProperty from your derived parseMappedAttribute()
-// function - though in SVG code we need to move this logic into svgAttributeChanged, in
-// order to support SVG DOM changes (which don't use the parseMappedAttribute/attributeChanged).
-// If we'd ignore SVG DOM, we could use _exactly_ the same logic as HTML.
-static inline void addCSSPropertyAndNotifyAttributeMap(StyledElement* element, const QualifiedName& name, int cssProperty, const String& value)
+void SVGForeignObjectElement::svgAttributeChanged(const QualifiedName& attrName)
 {
-    ASSERT(element);
-
-    if (!element)
-        return;
-
-    NamedMappedAttrMap* attrs = element->mappedAttributes();
-    ASSERT(attrs);
-
-    if (!attrs)
-        return;
-
-    Attribute* attr = attrs->getAttributeItem(name);
-    if (!attr || !attr->isMappedAttribute())
-        return;
-
-    MappedAttribute* mappedAttr = static_cast<MappedAttribute*>(attr);
-
-    // This logic is only meant to be used for entries that have to be parsed and are mapped to eNone. Assert that.
-    MappedAttributeEntry entry;
-    bool needToParse = element->mapToEntry(mappedAttr->name(), entry);
-
-    ASSERT(needToParse);
-    ASSERT(entry == eNone);
+    SVGStyledTransformableElement::svgAttributeChanged(attrName);
 
-    if (!needToParse || entry != eNone) 
+    if (!renderer())
         return;
 
-    if (mappedAttr->decl()) {
-        mappedAttr->setDecl(0);
-        attrs->declRemoved();
-    }
-
-    element->setNeedsStyleRecalc();
-    element->addCSSProperty(mappedAttr, cssProperty, value);
-
-    if (CSSMappedAttributeDeclaration* decl = mappedAttr->decl()) {
-        // Add the decl to the table in the appropriate spot.
-        element->setMappedAttributeDecl(entry, mappedAttr, decl);
-
-        decl->setMappedState(entry, mappedAttr->name(), mappedAttr->value());
-        decl->setParent(0);
-        decl->setNode(0);
-
-        attrs->declAdded();
-    }
+    if (attrName == SVGNames::xAttr
+        || attrName == SVGNames::yAttr
+        || attrName == SVGNames::widthAttr
+        || attrName == SVGNames::heightAttr
+        || SVGTests::isKnownAttribute(attrName)
+        || SVGLangSpace::isKnownAttribute(attrName)
+        || SVGExternalResourcesRequired::isKnownAttribute(attrName)
+        || SVGStyledTransformableElement::isKnownAttribute(attrName))
+        renderer()->setNeedsLayout(true);
 }
 
-void SVGForeignObjectElement::svgAttributeChanged(const QualifiedName& attrName)
+void SVGForeignObjectElement::synchronizeProperty(const QualifiedName& attrName)
 {
-    SVGStyledTransformableElement::svgAttributeChanged(attrName);
-
-    if (attrName == SVGNames::widthAttr) {
-        addCSSPropertyAndNotifyAttributeMap(this, attrName, CSSPropertyWidth, width().valueAsString());
-        return;
-    } else if (attrName == SVGNames::heightAttr) {
-        addCSSPropertyAndNotifyAttributeMap(this, attrName, CSSPropertyHeight, height().valueAsString());
+    SVGStyledTransformableElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeX();
+        synchronizeY();
+        synchronizeWidth();
+        synchronizeHeight();
+        synchronizeExternalResourcesRequired();
+        synchronizeHref();
         return;
     }
 
-    if (!renderer())
-        return;
-
-    if (attrName == SVGNames::xAttr || attrName == SVGNames::yAttr ||
-        SVGTests::isKnownAttribute(attrName) ||
-        SVGLangSpace::isKnownAttribute(attrName) ||
-        SVGExternalResourcesRequired::isKnownAttribute(attrName) ||
-        SVGStyledTransformableElement::isKnownAttribute(attrName))
-        renderer()->setNeedsLayout(true);
+    if (attrName == SVGNames::xAttr)
+        synchronizeX();
+    else if (attrName == SVGNames::yAttr)
+        synchronizeY();
+    else if (attrName == SVGNames::widthAttr)
+        synchronizeWidth();
+    else if (attrName == SVGNames::heightAttr)
+        synchronizeHeight();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+    else if (SVGURIReference::isKnownAttribute(attrName))
+        synchronizeHref();
 }
 
 RenderObject* SVGForeignObjectElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -164,6 +129,6 @@ bool SVGForeignObjectElement::childShouldCreateRenderer(Node* child) const
     return StyledElement::childShouldCreateRenderer(child);
 }
 
-} // namespace WebCore
+}
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FOREIGN_OBJECT)
+#endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.h b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.h
index 1848e2ba7e..fe36a20898 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.h
@@ -42,23 +42,22 @@ namespace WebCore {
         virtual bool isValid() const { return SVGTests::isValid(); }
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         bool childShouldCreateRenderer(Node*) const;
         virtual RenderObject* createRenderer(RenderArena* arena, RenderStyle* style);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::xAttrString, SVGLength, X, x)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::yAttrString, SVGLength, Y, y)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::widthAttrString, SVGLength, Width, width)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::heightAttrString, SVGLength, Height, height)
+        DECLARE_ANIMATED_PROPERTY(SVGForeignObjectElement, SVGNames::xAttr, SVGLength, X, x)
+        DECLARE_ANIMATED_PROPERTY(SVGForeignObjectElement, SVGNames::yAttr, SVGLength, Y, y)
+        DECLARE_ANIMATED_PROPERTY(SVGForeignObjectElement, SVGNames::widthAttr, SVGLength, Width, width)
+        DECLARE_ANIMATED_PROPERTY(SVGForeignObjectElement, SVGNames::heightAttr, SVGLength, Height, height)
 
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+        DECLARE_ANIMATED_PROPERTY(SVGForeignObjectElement, XLinkNames::hrefAttr, String, Href, href)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGForeignObjectElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGGElement.cpp
index 241f2645e2..0fd329fc2d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -34,7 +32,6 @@ SVGGElement::SVGGElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -68,6 +65,14 @@ void SVGGElement::svgAttributeChanged(const QualifiedName& attrName)
         renderer()->setNeedsLayout(true);
 }
 
+void SVGGElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledTransformableElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName() || SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+}
+
 void SVGGElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGStyledTransformableElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGElement.h b/src/3rdparty/webkit/WebCore/svg/SVGGElement.h
index 9cfb5a3637..3e0dd8e73f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGElement.h
@@ -37,22 +37,19 @@ namespace WebCore {
         SVGGElement(const QualifiedName&, Document*);
         virtual ~SVGGElement();
 
+        virtual bool isShadowTreeContainerElement() const { return false; }
         virtual bool isValid() const { return SVGTests::isValid(); }
 
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
     private:
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGGElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
-
-        friend class SVGUseElement;
-        TransformationMatrix localMatrix() const;
+        DECLARE_ANIMATED_PROPERTY(SVGGElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGlyphElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGGlyphElement.cpp
index 7be0181552..2d15569eb6 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGlyphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGlyphElement.cpp
@@ -49,7 +49,7 @@ SVGGlyphElement::~SVGGlyphElement()
 void SVGGlyphElement::invalidateGlyphCache()
 {
     Node* fontNode = parentNode();
-    if (fontNode && fontNode->hasTagName(fontTag)) {
+    if (fontNode && fontNode->hasTagName(SVGNames::fontTag)) {
         if (SVGFontElement* element = static_cast<SVGFontElement*>(fontNode))
             element->invalidateGlyphCache();
     }
@@ -167,7 +167,7 @@ SVGGlyphIdentifier SVGGlyphElement::buildGlyphIdentifier() const
     identifier.orientation = parseOrientation(getAttribute(orientationAttr));
     identifier.arabicForm = parseArabicForm(getAttribute(arabic_formAttr));
 
-    String language = getAttribute(langAttr);
+    String language = getAttribute(SVGNames::langAttr);
     if (!language.isEmpty())
         identifier.languages = parseDelimitedString(language, ',');
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp
index 93e2cb4ca0..f57326534d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -39,17 +37,12 @@
 
 namespace WebCore {
 
-char SVGGradientElementIdentifier[] = "SVGGradientElement";
-
 SVGGradientElement::SVGGradientElement(const QualifiedName& tagName, Document* doc)
     : SVGStyledElement(tagName, doc)
     , SVGURIReference()
     , SVGExternalResourcesRequired()
-    , m_spreadMethod(this, SVGNames::spreadMethodAttr)
-    , m_gradientUnits(this, SVGNames::gradientUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
-    , m_gradientTransform(this, SVGNames::gradientTransformAttr, SVGTransformList::create(SVGNames::gradientTransformAttr))
-    , m_href(this, XLinkNames::hrefAttr)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_gradientUnits(SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
+    , m_gradientTransform(SVGTransformList::create(SVGNames::gradientTransformAttr))
 {
 }
 
@@ -103,6 +96,31 @@ void SVGGradientElement::svgAttributeChanged(const QualifiedName& attrName)
         m_resource->invalidate();
 }
 
+void SVGGradientElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeGradientUnits();
+        synchronizeGradientTransform();
+        synchronizeSpreadMethod();
+        synchronizeExternalResourcesRequired();
+        synchronizeHref();
+        return;
+    }
+
+    if (attrName == SVGNames::gradientUnitsAttr)
+        synchronizeGradientUnits();
+    else if (attrName == SVGNames::gradientTransformAttr)
+        synchronizeGradientTransform();
+    else if (attrName == SVGNames::spreadMethodAttr)
+        synchronizeSpreadMethod();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+    else if (SVGURIReference::isKnownAttribute(attrName))
+        synchronizeHref();
+}
+
 void SVGGradientElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGStyledElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
@@ -116,7 +134,7 @@ RenderObject* SVGGradientElement::createRenderer(RenderArena* arena, RenderStyle
     return new (arena) RenderSVGHiddenContainer(this);
 }
 
-SVGResource* SVGGradientElement::canvasResource()
+SVGResource* SVGGradientElement::canvasResource(const RenderObject*)
 {
     if (!m_resource) {
         if (gradientType() == LinearGradientPaintServer)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.h b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.h
index 8413597126..122e1d99a8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.h
@@ -22,6 +22,7 @@
 #define SVGGradientElement_h
 
 #if ENABLE(SVG)
+#include "RenderObject.h"
 #include "SVGPaintServerGradient.h"
 #include "SVGExternalResourcesRequired.h"
 #include "SVGStyledElement.h"
@@ -30,8 +31,6 @@
 
 namespace WebCore {
 
-    extern char SVGGradientElementIdentifier[];
-
     class SVGGradientElement : public SVGStyledElement,
                                public SVGURIReference,
                                public SVGExternalResourcesRequired {
@@ -41,11 +40,12 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-        virtual SVGResource* canvasResource();
+        virtual SVGResource* canvasResource(const RenderObject*);
 
     protected:
         friend class SVGPaintServerGradient;
@@ -59,17 +59,15 @@ namespace WebCore {
         mutable RefPtr<SVGPaintServerGradient> m_resource;
  
     protected:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::spreadMethodAttrString, int, SpreadMethod, spreadMethod)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::gradientUnitsAttrString, int, GradientUnits, gradientUnits)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::gradientTransformAttrString, SVGTransformList, GradientTransform, gradientTransform)
+        DECLARE_ANIMATED_PROPERTY(SVGGradientElement, SVGNames::spreadMethodAttr, int, SpreadMethod, spreadMethod)
+        DECLARE_ANIMATED_PROPERTY(SVGGradientElement, SVGNames::gradientUnitsAttr, int, GradientUnits, gradientUnits)
+        DECLARE_ANIMATED_PROPERTY(SVGGradientElement, SVGNames::gradientTransformAttr, SVGTransformList*, GradientTransform, gradientTransform)
 
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+        DECLARE_ANIMATED_PROPERTY(SVGGradientElement, XLinkNames::hrefAttr, String, Href, href)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGGradientElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.idl
index 8b09d829d0..7485780a09 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, GenerateConstructor] SVGGradientElement : SVGElement,
+    interface [Conditional=SVG] SVGGradientElement : SVGElement,
                                                      SVGURIReference,
                                                      SVGExternalResourcesRequired,
                                                      SVGStylable
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGHKernElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGHKernElement.cpp
index f232fdc030..0ee3e76f6a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGHKernElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGHKernElement.cpp
@@ -48,7 +48,7 @@ SVGHKernElement::~SVGHKernElement()
 void SVGHKernElement::insertedIntoDocument()
 {
     Node* fontNode = parentNode();
-    if (fontNode && fontNode->hasTagName(fontTag)) {
+    if (fontNode && fontNode->hasTagName(SVGNames::fontTag)) {
         if (SVGFontElement* element = static_cast<SVGFontElement*>(fontNode))
             element->invalidateGlyphCache();
     }
@@ -57,7 +57,7 @@ void SVGHKernElement::insertedIntoDocument()
 void SVGHKernElement::removedFromDocument()
 {
     Node* fontNode = parentNode();
-    if (fontNode && fontNode->hasTagName(fontTag)) {
+    if (fontNode && fontNode->hasTagName(SVGNames::fontTag)) {
         if (SVGFontElement* element = static_cast<SVGFontElement*>(fontNode))
             element->invalidateGlyphCache();
     }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGHKernElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGHKernElement.idl
index 1971aefa56..77065784f4 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGHKernElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGHKernElement.idl
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2008 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
index e29846c095..40555339db 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
@@ -41,13 +41,10 @@ SVGImageElement::SVGImageElement(const QualifiedName& tagName, Document* doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , SVGURIReference()
-    , m_x(this, SVGNames::xAttr, LengthModeWidth)
-    , m_y(this, SVGNames::yAttr, LengthModeHeight)
-    , m_width(this, SVGNames::widthAttr, LengthModeWidth)
-    , m_height(this, SVGNames::heightAttr, LengthModeHeight)
-    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create()) 
-    , m_href(this, XLinkNames::hrefAttr)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_x(LengthModeWidth)
+    , m_y(LengthModeHeight)
+    , m_width(LengthModeWidth)
+    , m_height(LengthModeHeight)
     , m_imageLoader(this)
 {
 }
@@ -62,11 +59,9 @@ void SVGImageElement::parseMappedAttribute(MappedAttribute *attr)
         setXBaseValue(SVGLength(LengthModeWidth, attr->value()));
     else if (attr->name() == SVGNames::yAttr)
         setYBaseValue(SVGLength(LengthModeHeight, attr->value()));
-    else if (attr->name() == SVGNames::preserveAspectRatioAttr) {
-        const UChar* c = attr->value().characters();
-        const UChar* end = c + attr->value().length();
-        preserveAspectRatioBaseValue()->parsePreserveAspectRatio(c, end);
-    } else if (attr->name() == SVGNames::widthAttr) {
+    else if (attr->name() == SVGNames::preserveAspectRatioAttr)
+        SVGPreserveAspectRatio::parsePreserveAspectRatio(this, attr->value());
+    else if (attr->name() == SVGNames::widthAttr) {
         setWidthBaseValue(SVGLength(LengthModeWidth, attr->value()));
         addCSSProperty(attr, CSSPropertyWidth, attr->value());
         if (widthBaseValue().value(this) < 0.0)
@@ -110,6 +105,37 @@ void SVGImageElement::svgAttributeChanged(const QualifiedName& attrName)
     }
 }
 
+void SVGImageElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledTransformableElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeX();
+        synchronizeY();
+        synchronizeWidth();
+        synchronizeHeight();
+        synchronizePreserveAspectRatio();
+        synchronizeExternalResourcesRequired();
+        synchronizeHref();
+        return;
+    }
+
+    if (attrName == SVGNames::xAttr)
+        synchronizeX();
+    else if (attrName == SVGNames::yAttr)
+        synchronizeY();
+    else if (attrName == SVGNames::widthAttr)
+        synchronizeWidth();
+    else if (attrName == SVGNames::heightAttr)
+        synchronizeHeight();
+    else if (attrName == SVGNames::preserveAspectRatioAttr)
+        synchronizePreserveAspectRatio();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+    else if (SVGURIReference::isKnownAttribute(attrName))
+        synchronizeHref();
+}
+
 bool SVGImageElement::hasRelativeValues() const
 {
     return (x().isRelative() || width().isRelative() ||
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.h b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.h
index 1bdcdbac89..3fa0e3f7fa 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.h
@@ -47,6 +47,7 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         virtual void attach();
         virtual void insertedIntoDocument();
@@ -61,19 +62,17 @@ namespace WebCore {
         virtual bool hasRelativeValues() const;
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::xAttrString, SVGLength, X, x)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::yAttrString, SVGLength, Y, y)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::widthAttrString, SVGLength, Width, width)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::heightAttrString, SVGLength, Height, height)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+        DECLARE_ANIMATED_PROPERTY(SVGImageElement, SVGNames::xAttr, SVGLength, X, x)
+        DECLARE_ANIMATED_PROPERTY(SVGImageElement, SVGNames::yAttr, SVGLength, Y, y)
+        DECLARE_ANIMATED_PROPERTY(SVGImageElement, SVGNames::widthAttr, SVGLength, Width, width)
+        DECLARE_ANIMATED_PROPERTY(SVGImageElement, SVGNames::heightAttr, SVGLength, Height, height)
+        DECLARE_ANIMATED_PROPERTY(SVGImageElement, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
 
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+        DECLARE_ANIMATED_PROPERTY(SVGImageElement, XLinkNames::hrefAttr, String, Href, href)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGImageElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
 
         SVGImageLoader m_imageLoader;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.cpp b/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.cpp
index d49e09a332..f0d6997f57 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.h b/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.h
index df8606ea97..1613998d0e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.idl b/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.idl
index a10867e128..277e514b49 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.idl
@@ -26,7 +26,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, ObjCProtocol] SVGLangSpace {
+    interface [Conditional=SVG, ObjCProtocol, OmitConstructor] SVGLangSpace {
                  attribute core::DOMString xmllang
                      /*setter raises(DOMException)*/;
                  attribute core::DOMString xmlspace
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLength.cpp b/src/3rdparty/webkit/WebCore/svg/SVGLength.cpp
index ca3bac3f3f..e342acf77a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLength.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLength.cpp
@@ -3,8 +3,6 @@
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
                   2007 Apple Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -282,15 +280,16 @@ float SVGLength::PercentageOfViewport(float value, const SVGElement* context, SV
     float width = 0.0f, height = 0.0f;
     SVGElement* viewportElement = context->viewportElement();
 
+    // PercentageOfViewport() is used to resolve all relative-positioned values within a SVG document (fragment)
     Document* doc = context->document();
     if (doc->documentElement() == context) {
-        // We have to ask the canvas for the full "canvas size"...
-        RenderView* view = toRenderView(doc->renderer());
-        if (view && view->frameView()) {
-            width = view->frameView()->visibleWidth(); // TODO: recheck!
-            height = view->frameView()->visibleHeight(); // TODO: recheck!
+        // Resolve value against outermost <svg> element
+        if (RenderView* view = toRenderView(doc->renderer())) {
+            width = view->viewWidth();
+            height = view->viewHeight();
          }
     } else if (viewportElement && viewportElement->isSVG()) {
+        // Resolve value against nearest viewport element (common case: inner <svg> elements)
         const SVGSVGElement* svg = static_cast<const SVGSVGElement*>(viewportElement);
         if (svg->hasAttribute(SVGNames::viewBoxAttr)) {
             width = svg->viewBox().width();
@@ -300,6 +299,7 @@ float SVGLength::PercentageOfViewport(float value, const SVGElement* context, SV
             height = svg->height().value(svg);
         }
     } else if (context->parent() && !context->parent()->isSVGElement()) {
+        // Resolve value against enclosing non-SVG RenderBox
         if (RenderObject* renderer = context->renderer()) {
             if (renderer->isBox()) {
                 RenderBox* box = toRenderBox(renderer);
@@ -321,6 +321,4 @@ float SVGLength::PercentageOfViewport(float value, const SVGElement* context, SV
 
 }
 
-#endif // ENABLE(SVG)
-
-// vim:ts=4:noet
+#endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLength.h b/src/3rdparty/webkit/WebCore/svg/SVGLength.h
index 7846b4a3d3..a14bc68e2f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLength.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLength.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLength.idl b/src/3rdparty/webkit/WebCore/svg/SVGLength.idl
index 20748b1267..a349c47f89 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLength.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLength.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -24,7 +22,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, GenerateConstructor, PODType=SVGLength] SVGLength { 
+    interface [Conditional=SVG, PODType=SVGLength] SVGLength { 
         // Length Unit Types
         const unsigned short SVG_LENGTHTYPE_UNKNOWN    = 0;
         const unsigned short SVG_LENGTHTYPE_NUMBER     = 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLengthList.cpp b/src/3rdparty/webkit/WebCore/svg/SVGLengthList.cpp
index 20b61d6f3f..367befb4a8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLengthList.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLengthList.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLengthList.h b/src/3rdparty/webkit/WebCore/svg/SVGLengthList.h
index e83fee8194..00fc3f8979 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLengthList.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLengthList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp
index 4f7b7e5f1b..6c8a16b599 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -38,11 +36,10 @@ SVGLineElement::SVGLineElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
-    , m_x1(this, SVGNames::x1Attr, LengthModeWidth)
-    , m_y1(this, SVGNames::y1Attr, LengthModeHeight)
-    , m_x2(this, SVGNames::x2Attr, LengthModeWidth)
-    , m_y2(this, SVGNames::y2Attr, LengthModeHeight)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_x1(LengthModeWidth)
+    , m_y1(LengthModeHeight)
+    , m_x2(LengthModeWidth)
+    , m_y2(LengthModeHeight)
 {
 }
 
@@ -87,6 +84,31 @@ void SVGLineElement::svgAttributeChanged(const QualifiedName& attrName)
         renderer()->setNeedsLayout(true);
 }
 
+void SVGLineElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledTransformableElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeX1();
+        synchronizeY1();
+        synchronizeX2();
+        synchronizeY2();
+        synchronizeExternalResourcesRequired();
+        return;
+    }
+
+    if (attrName == SVGNames::x1Attr)
+        synchronizeX1();
+    else if (attrName == SVGNames::y1Attr)
+        synchronizeY1();
+    else if (attrName == SVGNames::x2Attr)
+        synchronizeX2();
+    else if (attrName == SVGNames::y2Attr)
+        synchronizeY2();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+}
+
 Path SVGLineElement::toPathData() const
 {
     return Path::createLine(FloatPoint(x1().value(this), y1().value(this)),
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLineElement.h b/src/3rdparty/webkit/WebCore/svg/SVGLineElement.h
index a24e009cb8..c5ecafa9c8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLineElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLineElement.h
@@ -43,6 +43,7 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         virtual Path toPathData() const;
 
@@ -52,15 +53,13 @@ namespace WebCore {
         virtual bool hasRelativeValues() const;
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGNames::lineTagString, SVGNames::x1AttrString, SVGLength, X1, x1)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGNames::lineTagString, SVGNames::y1AttrString, SVGLength, Y1, y1)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGNames::lineTagString, SVGNames::x2AttrString, SVGLength, X2, x2)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGNames::lineTagString, SVGNames::y2AttrString, SVGLength, Y2, y2)
+        DECLARE_ANIMATED_PROPERTY(SVGLineElement, SVGNames::x1Attr, SVGLength, X1, x1)
+        DECLARE_ANIMATED_PROPERTY(SVGLineElement, SVGNames::y1Attr, SVGLength, Y1, y1)
+        DECLARE_ANIMATED_PROPERTY(SVGLineElement, SVGNames::x2Attr, SVGLength, X2, x2)
+        DECLARE_ANIMATED_PROPERTY(SVGLineElement, SVGNames::y2Attr, SVGLength, Y2, y2)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGLineElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp
index f5c8ceeeb3..665a1dad6d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp
@@ -40,10 +40,10 @@ namespace WebCore {
 
 SVGLinearGradientElement::SVGLinearGradientElement(const QualifiedName& tagName, Document* doc)
     : SVGGradientElement(tagName, doc)
-    , m_x1(this, SVGNames::x1Attr, LengthModeWidth)
-    , m_y1(this, SVGNames::y1Attr, LengthModeHeight)
-    , m_x2(this, SVGNames::x2Attr, LengthModeWidth, "100%")
-    , m_y2(this, SVGNames::y2Attr, LengthModeHeight)
+    , m_x1(LengthModeWidth)
+    , m_y1(LengthModeHeight)
+    , m_x2(LengthModeWidth, "100%")
+    , m_y2(LengthModeHeight)
 {
     // Spec: If the x2 attribute is not specified, the effect is as if a value of "100%" were specified.
 }
@@ -78,6 +78,28 @@ void SVGLinearGradientElement::svgAttributeChanged(const QualifiedName& attrName
         m_resource->invalidate();
 }
 
+void SVGLinearGradientElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGGradientElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeX1();
+        synchronizeY1();
+        synchronizeX2();
+        synchronizeY2();
+        return;
+    }
+
+    if (attrName == SVGNames::x1Attr)
+        synchronizeX1();
+    else if (attrName == SVGNames::y1Attr)
+        synchronizeY1();
+    else if (attrName == SVGNames::x2Attr)
+        synchronizeX2();
+    else if (attrName == SVGNames::y2Attr)
+        synchronizeY2();
+}
+
 void SVGLinearGradientElement::buildGradient() const
 {
     LinearGradientAttributes attributes = collectGradientProperties();
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.h b/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.h
index 0e1efd4b23..0308c0ea85 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -38,6 +36,7 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
     protected:
         virtual void buildGradient() const;
@@ -46,10 +45,10 @@ namespace WebCore {
         LinearGradientAttributes collectGradientProperties() const;
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGLinearGradientElement, SVGNames::linearGradientTagString, SVGNames::x1AttrString, SVGLength, X1, x1)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGLinearGradientElement, SVGNames::linearGradientTagString, SVGNames::y1AttrString, SVGLength, Y1, y1)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGLinearGradientElement, SVGNames::linearGradientTagString, SVGNames::x2AttrString, SVGLength, X2, x2)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGLinearGradientElement, SVGNames::linearGradientTagString, SVGNames::y2AttrString, SVGLength, Y2, y2)
+        DECLARE_ANIMATED_PROPERTY(SVGLinearGradientElement, SVGNames::x1Attr, SVGLength, X1, x1)
+        DECLARE_ANIMATED_PROPERTY(SVGLinearGradientElement, SVGNames::y1Attr, SVGLength, Y1, y1)
+        DECLARE_ANIMATED_PROPERTY(SVGLinearGradientElement, SVGNames::x2Attr, SVGLength, X2, x2)
+        DECLARE_ANIMATED_PROPERTY(SVGLinearGradientElement, SVGNames::y2Attr, SVGLength, Y2, y2)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGList.h b/src/3rdparty/webkit/WebCore/svg/SVGList.h
index c04c20075e..e1249e2fba 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGList.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -41,6 +39,10 @@ namespace WebCore {
         {
             return SVGListTraits<UsesDefaultInitializer<Item>::value, Item>::nullItem();
         }
+        static bool isNull(const Item& it)
+        {
+            return SVGListTraits<UsesDefaultInitializer<Item>::value, Item>::isNull(it);
+        }
     };
 
     template<typename Item>
@@ -58,6 +60,10 @@ namespace WebCore {
 
         Item initialize(Item newItem, ExceptionCode& ec)
         {
+            if (TypeOperations::isNull(newItem)) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
             clear(ec);
             return appendItem(newItem, ec);
         }
@@ -94,8 +100,13 @@ namespace WebCore {
             return m_vector[index];
         }
 
-        Item insertItemBefore(Item newItem, unsigned int index, ExceptionCode&)
+        Item insertItemBefore(Item newItem, unsigned int index, ExceptionCode& ec)
         {
+            if (TypeOperations::isNull(newItem)) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
+
             if (index < m_vector.size()) {
                 m_vector.insert(index, newItem);
             } else {
@@ -110,6 +121,11 @@ namespace WebCore {
                 ec = INDEX_SIZE_ERR;
                 return TypeOperations::nullItem();
             }
+    
+            if (TypeOperations::isNull(newItem)) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
 
             m_vector[index] = newItem;
             return newItem;
@@ -127,8 +143,13 @@ namespace WebCore {
             return item;
         }
 
-        Item appendItem(Item newItem, ExceptionCode&)
+        Item appendItem(Item newItem, ExceptionCode& ec)
         {
+            if (TypeOperations::isNull(newItem)) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
+
             m_vector.append(newItem);
             return newItem;
         }
@@ -155,7 +176,7 @@ namespace WebCore {
 
         // Updating facilities, used by JSSVGPODTypeWrapperCreatorForList
         Item value() const { return m_item; }
-        void setValue(Item newItem) { m_item = newItem; }
+        void setValue(const Item& newItem) { m_item = newItem; }
 
     private:
         SVGPODListItem() : m_item() { }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGListTraits.h b/src/3rdparty/webkit/WebCore/svg/SVGListTraits.h
index d96bc67d53..f58b9b992a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGListTraits.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGListTraits.h
@@ -2,8 +2,6 @@
     Copyright (C) 2006 Nikolas Zimmermann <wildfox@kde.org>
                   2006 Apple Computer Inc.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -25,24 +23,48 @@
 
 #if ENABLE(SVG)
 
+#include <wtf/RefPtr.h>
+
 namespace WebCore {
 
     template<typename Item> struct UsesDefaultInitializer { static const bool value = true; };
     template<> struct UsesDefaultInitializer<double>      { static const bool value = false; };
+    template<> struct UsesDefaultInitializer<float>       { static const bool value = false; };
 
     template<bool usesDefaultInitializer, typename Item>
     struct SVGListTraits { };
 
+    template<typename ItemPtr>
+    struct SVGListTraits<true, ItemPtr*> {
+        static ItemPtr* nullItem() { return 0; }
+        static bool isNull(ItemPtr* it) { return !it; }
+    };
+    
+    template<typename ItemPtr>
+    struct SVGListTraits<true, RefPtr<ItemPtr> > {
+        static RefPtr<ItemPtr> nullItem() { return 0; }
+        static bool isNull(const RefPtr<ItemPtr>& it) { return !it; }
+    };
+    
     template<typename Item>
     struct SVGListTraits<true, Item> {
-        static Item nullItem() { return Item(); } 
+        static Item nullItem() { return Item(); }
+        static bool isNull(Item it) { return !it; }
     };
 
     template<>
     struct SVGListTraits<false, double> {
         static double nullItem() { return 0.0; }
+        static bool isNull(double) { return false; }
     };
 
+    template<>
+    struct SVGListTraits<false, float> {
+        static float nullItem() { return 0; }
+        static bool isNull(float) { return false; }
+    };
+
+
 } // namespace WebCore
 
 #endif // SVG_SUPPORT
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLocatable.cpp b/src/3rdparty/webkit/WebCore/svg/SVGLocatable.cpp
index 00acc2a0d7..39cf589a06 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLocatable.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLocatable.cpp
@@ -24,7 +24,7 @@
 
 #include "SVGLocatable.h"
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "RenderPath.h"
 #include "SVGException.h"
 #include "SVGSVGElement.h"
@@ -82,16 +82,16 @@ FloatRect SVGLocatable::getBBox(const SVGElement* element)
     return element->renderer()->objectBoundingBox();
 }
 
-TransformationMatrix SVGLocatable::getCTM(const SVGElement* element)
+AffineTransform SVGLocatable::getCTM(const SVGElement* element)
 {
     ASSERT(element);
-    TransformationMatrix ctm;
+    AffineTransform ctm;
 
     Node* parent = element->parentNode();
     if (parent && parent->isSVGElement()) {
         SVGElement* parentElement = static_cast<SVGElement*>(parent);
         if (parentElement && parentElement->isStyledLocatable()) {
-            TransformationMatrix parentCTM = static_cast<SVGStyledLocatableElement*>(parentElement)->getCTM();
+            AffineTransform parentCTM = static_cast<SVGStyledLocatableElement*>(parentElement)->getCTM();
             ctm = parentCTM * ctm;
         }
     }
@@ -99,16 +99,16 @@ TransformationMatrix SVGLocatable::getCTM(const SVGElement* element)
     return ctm;
 }
 
-TransformationMatrix SVGLocatable::getScreenCTM(const SVGElement* element)
+AffineTransform SVGLocatable::getScreenCTM(const SVGElement* element)
 {
     ASSERT(element);
-    TransformationMatrix ctm;
+    AffineTransform ctm;
 
     Node* parent = element->parentNode();
     if (parent && parent->isSVGElement()) {
         SVGElement* parentElement = static_cast<SVGElement*>(parent);
         if (parentElement && parentElement->isStyledLocatable()) {
-            TransformationMatrix parentCTM = static_cast<SVGStyledLocatableElement*>(parentElement)->getScreenCTM();
+            AffineTransform parentCTM = static_cast<SVGStyledLocatableElement*>(parentElement)->getScreenCTM();
             ctm = parentCTM * ctm;
         }
     }
@@ -116,12 +116,12 @@ TransformationMatrix SVGLocatable::getScreenCTM(const SVGElement* element)
     return ctm;
 }
 
-TransformationMatrix SVGLocatable::getTransformToElement(SVGElement* target, ExceptionCode& ec) const
+AffineTransform SVGLocatable::getTransformToElement(SVGElement* target, ExceptionCode& ec) const
 {
-    TransformationMatrix ctm = getCTM();
+    AffineTransform ctm = getCTM();
 
     if (target && target->isStyledLocatable()) {
-        TransformationMatrix targetCTM = static_cast<SVGStyledLocatableElement*>(target)->getCTM();
+        AffineTransform targetCTM = static_cast<SVGStyledLocatableElement*>(target)->getCTM();
         if (!targetCTM.isInvertible()) {
             ec = SVGException::SVG_MATRIX_NOT_INVERTABLE;
             return ctm;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLocatable.h b/src/3rdparty/webkit/WebCore/svg/SVGLocatable.h
index ccb9072d85..b7d8d30f00 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLocatable.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLocatable.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -29,32 +27,32 @@
 
 namespace WebCore {
 
-    class TransformationMatrix;
-    class FloatRect;
-    class SVGElement;
+class AffineTransform;
+class FloatRect;
+class SVGElement;
 
-    class SVGLocatable {
-    public:
-        SVGLocatable();
-        virtual ~SVGLocatable();
+class SVGLocatable {
+public:
+    SVGLocatable();
+    virtual ~SVGLocatable();
 
-        // 'SVGLocatable' functions
-        virtual SVGElement* nearestViewportElement() const = 0;
-        virtual SVGElement* farthestViewportElement() const = 0;
+    // 'SVGLocatable' functions
+    virtual SVGElement* nearestViewportElement() const = 0;
+    virtual SVGElement* farthestViewportElement() const = 0;
 
-        virtual FloatRect getBBox() const = 0;
-        virtual TransformationMatrix getCTM() const = 0;
-        virtual TransformationMatrix getScreenCTM() const = 0;
-        TransformationMatrix getTransformToElement(SVGElement*, ExceptionCode&) const;
+    virtual FloatRect getBBox() const = 0;
+    virtual AffineTransform getCTM() const = 0;
+    virtual AffineTransform getScreenCTM() const = 0;
+    AffineTransform getTransformToElement(SVGElement*, ExceptionCode&) const;
 
-        static SVGElement* nearestViewportElement(const SVGElement*);
-        static SVGElement* farthestViewportElement(const SVGElement*);
+    static SVGElement* nearestViewportElement(const SVGElement*);
+    static SVGElement* farthestViewportElement(const SVGElement*);
 
-    protected:
-        static FloatRect getBBox(const SVGElement*);
-        static TransformationMatrix getCTM(const SVGElement*);
-        static TransformationMatrix getScreenCTM(const SVGElement*);
-    };
+protected:
+    static FloatRect getBBox(const SVGElement*);
+    static AffineTransform getCTM(const SVGElement*);
+    static AffineTransform getScreenCTM(const SVGElement*);
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLocatable.idl b/src/3rdparty/webkit/WebCore/svg/SVGLocatable.idl
index b0512865ef..72db8f4b89 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLocatable.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLocatable.idl
@@ -26,7 +26,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, ObjCProtocol] SVGLocatable {
+    interface [Conditional=SVG, ObjCProtocol, OmitConstructor] SVGLocatable {
         readonly attribute SVGElement nearestViewportElement;
         readonly attribute SVGElement farthestViewportElement;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.cpp
index b8c862acad..dfe7e99cd2 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.cpp
@@ -31,8 +31,6 @@ namespace WebCore {
 
 SVGMPathElement::SVGMPathElement(const QualifiedName& qname, Document* doc)
     : SVGElement(qname, doc)
-    , m_href(this, XLinkNames::hrefAttr)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -47,6 +45,22 @@ void SVGMPathElement::parseMappedAttribute(MappedAttribute* attr)
     SVGElement::parseMappedAttribute(attr);
 }
 
+void SVGMPathElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeExternalResourcesRequired();
+        synchronizeHref();
+        return;
+    }
+
+    if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+    else if (SVGURIReference::isKnownAttribute(attrName))
+        synchronizeHref();
+}
+
 SVGPathElement* SVGMPathElement::pathElement()
 {
     Element* target = document()->getElementById(getTarget(href()));
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.h b/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.h
index ded6cdf830..50a7dd1845 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.h
@@ -36,17 +36,16 @@ namespace WebCore {
         virtual ~SVGMPathElement();
         
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         
         SVGPathElement* pathElement();
         
     private:
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMPathElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+        DECLARE_ANIMATED_PROPERTY(SVGMPathElement, XLinkNames::hrefAttr, String, Href, href)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMPathElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGMPathElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp
index 2e9692609e..7716af74ab 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp
@@ -26,7 +26,6 @@
 #include "MappedAttribute.h"
 #include "PlatformString.h"
 #include "RenderSVGViewportContainer.h"
-#include "SVGAngle.h"
 #include "SVGFitToViewBox.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
@@ -43,30 +42,21 @@ SVGMarkerElement::SVGMarkerElement(const QualifiedName& tagName, Document* doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , SVGFitToViewBox()
-    , m_refX(this, SVGNames::refXAttr, LengthModeWidth)
-    , m_refY(this, SVGNames::refYAttr, LengthModeHeight)
-    , m_markerWidth(this, SVGNames::markerWidthAttr, LengthModeWidth, "3")
-    , m_markerHeight(this, SVGNames::markerHeightAttr, LengthModeHeight, "3") 
-    , m_markerUnits(this, SVGNames::markerUnitsAttr, SVG_MARKERUNITS_STROKEWIDTH)
-    , m_orientType(this, SVGNames::orientAttr, SVG_MARKER_ORIENT_ANGLE)
-    , m_orientAngle(this, SVGNames::orientAttr, SVGAngle::create())
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
-    , m_viewBox(this, SVGNames::viewBoxAttr)
-    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
+    , m_refX(LengthModeWidth)
+    , m_refY(LengthModeHeight)
+    , m_markerWidth(LengthModeWidth, "3")
+    , m_markerHeight(LengthModeHeight, "3") 
+    , m_markerUnits(SVG_MARKERUNITS_STROKEWIDTH)
+    , m_orientType(SVG_MARKER_ORIENT_ANGLE)
 {
     // Spec: If the markerWidth/markerHeight attribute is not specified, the effect is as if a value of "3" were specified.
 }
 
 SVGMarkerElement::~SVGMarkerElement()
 {
-    // Call detach() here because if we wait until ~Node() calls it, we crash during
-    // RenderSVGViewportContainer destruction, as the renderer assumes that the element
-    // is still fully constructed. See <https://bugs.webkit.org/show_bug.cgi?id=21293>.
-    if (renderer())
-        detach();
 }
 
-TransformationMatrix SVGMarkerElement::viewBoxToViewTransform(float viewWidth, float viewHeight) const
+AffineTransform SVGMarkerElement::viewBoxToViewTransform(float viewWidth, float viewHeight) const
 {
     return SVGFitToViewBox::viewBoxToViewTransform(viewBox(), preserveAspectRatio(), viewWidth, viewHeight);
 }
@@ -87,16 +77,16 @@ void SVGMarkerElement::parseMappedAttribute(MappedAttribute* attr)
     else if (attr->name() == SVGNames::markerHeightAttr)
         setMarkerHeightBaseValue(SVGLength(LengthModeHeight, attr->value()));
     else if (attr->name() == SVGNames::orientAttr) {
-        RefPtr<SVGAngle> angle = SVGAngle::create();
+        SVGAngle angle;
 
         if (attr->value() == "auto")
             setOrientTypeBaseValue(SVG_MARKER_ORIENT_AUTO);
         else {
-            angle->setValueAsString(attr->value());
+            angle.setValueAsString(attr->value());
             setOrientTypeBaseValue(SVG_MARKER_ORIENT_ANGLE);
         }
 
-        setOrientAngleBaseValue(angle.get());
+        setOrientAngleBaseValue(angle);
     } else {
         if (SVGLangSpace::parseMappedAttribute(attr))
             return;
@@ -130,6 +120,45 @@ void SVGMarkerElement::svgAttributeChanged(const QualifiedName& attrName)
     }
 }
 
+void SVGMarkerElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeMarkerUnits();
+        synchronizeRefX();
+        synchronizeRefY();
+        synchronizeMarkerWidth();
+        synchronizeMarkerHeight();
+        synchronizeOrientAngle();
+        synchronizeOrientType();
+        synchronizeExternalResourcesRequired();
+        synchronizeViewBox();
+        synchronizePreserveAspectRatio();
+        return;
+    }
+
+    if (attrName == SVGNames::markerUnitsAttr)
+        synchronizeMarkerUnits();
+    else if (attrName == SVGNames::refXAttr)
+        synchronizeRefX();
+    else if (attrName == SVGNames::refYAttr)
+        synchronizeRefY();
+    else if (attrName == SVGNames::markerWidthAttr)
+        synchronizeMarkerWidth();
+    else if (attrName == SVGNames::markerHeightAttr)
+        synchronizeMarkerHeight();
+    else if (attrName == SVGNames::orientAttr) {
+        synchronizeOrientAngle();
+        synchronizeOrientType();
+    } else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+    else if (SVGFitToViewBox::isKnownAttribute(attrName)) {
+        synchronizeViewBox();
+        synchronizePreserveAspectRatio();
+    }
+}
+
 void SVGMarkerElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGStyledElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
@@ -146,9 +175,7 @@ void SVGMarkerElement::childrenChanged(bool changedByParser, Node* beforeChange,
 void SVGMarkerElement::setOrientToAuto()
 {
     setOrientTypeBaseValue(SVG_MARKER_ORIENT_AUTO);
-
-    RefPtr<SVGAngle> angle = SVGAngle::create();
-    setOrientAngleBaseValue(angle.get());
+    setOrientAngleBaseValue(SVGAngle());
 
     if (!m_marker)
         return;
@@ -159,10 +186,10 @@ void SVGMarkerElement::setOrientToAuto()
     m_marker->invalidate();
 }
 
-void SVGMarkerElement::setOrientToAngle(PassRefPtr<SVGAngle> angle)
+void SVGMarkerElement::setOrientToAngle(const SVGAngle& angle)
 {
     setOrientTypeBaseValue(SVG_MARKER_ORIENT_ANGLE);
-    setOrientAngleBaseValue(angle.get());
+    setOrientAngleBaseValue(angle);
 
     if (!m_marker)
         return;
@@ -173,20 +200,20 @@ void SVGMarkerElement::setOrientToAngle(PassRefPtr<SVGAngle> angle)
     m_marker->invalidate();
 }
 
-SVGResource* SVGMarkerElement::canvasResource()
+SVGResource* SVGMarkerElement::canvasResource(const RenderObject*)
 {
     if (!m_marker)
         m_marker = SVGResourceMarker::create();
 
-    m_marker->setMarker(toRenderSVGViewportContainer(renderer()));
+    ASSERT(renderer());
+    m_marker->setRenderer(toRenderSVGViewportContainer(renderer()));
 
-    if (orientType() == SVG_MARKER_ORIENT_ANGLE) {
-        if (orientAngle())
-            m_marker->setAngle(orientAngle()->value());
-    } else
+    if (orientType() == SVG_MARKER_ORIENT_ANGLE)
+        m_marker->setAngle(orientAngle().value());
+    else
         m_marker->setAutoAngle();
 
-    m_marker->setRef(refX().value(this), refY().value(this));
+    m_marker->setReferencePoint(FloatPoint(refX().value(this), refY().value(this)));
     m_marker->setUseStrokeWidth(markerUnits() == SVG_MARKERUNITS_STROKEWIDTH);
 
     return m_marker.get();
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.h b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.h
index 7e08a96f13..fd5a13bd67 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.h
@@ -22,7 +22,7 @@
 #define SVGMarkerElement_h
 
 #if ENABLE(SVG)
-
+#include "RenderObject.h"
 #include "SVGAngle.h"
 #include "SVGExternalResourcesRequired.h"
 #include "SVGFitToViewBox.h"
@@ -33,7 +33,6 @@
 namespace WebCore {
 
     class Document;
-    class SVGAngle;
 
     extern char SVGOrientTypeAttrIdentifier[];
     extern char SVGOrientAngleAttrIdentifier[];
@@ -58,35 +57,34 @@ namespace WebCore {
         SVGMarkerElement(const QualifiedName&, Document*);
         virtual ~SVGMarkerElement();
 
-        TransformationMatrix viewBoxToViewTransform(float viewWidth, float viewHeight) const;
+        AffineTransform viewBoxToViewTransform(float viewWidth, float viewHeight) const;
 
         void setOrientToAuto();
-        void setOrientToAngle(PassRefPtr<SVGAngle>);
+        void setOrientToAngle(const SVGAngle&);
 
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-        virtual SVGResource* canvasResource();
+        virtual SVGResource* canvasResource(const RenderObject*);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGNames::refXAttrString, SVGLength, RefX, refX)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGNames::refYAttrString, SVGLength, RefY, refY)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGNames::markerWidthAttrString, SVGLength, MarkerWidth, markerWidth)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGNames::markerHeightAttrString, SVGLength, MarkerHeight, markerHeight)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGNames::markerUnitsAttrString, int, MarkerUnits, markerUnits)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGOrientTypeAttrIdentifier, int, OrientType, orientType)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGOrientAngleAttrIdentifier, SVGAngle, OrientAngle, orientAngle)
+        DECLARE_ANIMATED_PROPERTY(SVGMarkerElement, SVGNames::refXAttr, SVGLength, RefX, refX)
+        DECLARE_ANIMATED_PROPERTY(SVGMarkerElement, SVGNames::refYAttr, SVGLength, RefY, refY)
+        DECLARE_ANIMATED_PROPERTY(SVGMarkerElement, SVGNames::markerWidthAttr, SVGLength, MarkerWidth, markerWidth)
+        DECLARE_ANIMATED_PROPERTY(SVGMarkerElement, SVGNames::markerHeightAttr, SVGLength, MarkerHeight, markerHeight)
+        DECLARE_ANIMATED_PROPERTY(SVGMarkerElement, SVGNames::markerUnitsAttr, int, MarkerUnits, markerUnits)
+        DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGMarkerElement, SVGNames::orientAttr, SVGOrientTypeAttrIdentifier, int, OrientType, orientType)
+        DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGMarkerElement, SVGNames::orientAttr, SVGOrientAngleAttrIdentifier, SVGAngle, OrientAngle, orientAngle)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGMarkerElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
 
         // SVGFitToViewBox
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+        DECLARE_ANIMATED_PROPERTY(SVGMarkerElement, SVGNames::viewBoxAttr, FloatRect, ViewBox, viewBox)
+        DECLARE_ANIMATED_PROPERTY(SVGMarkerElement, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
  
         RefPtr<SVGResourceMarker> m_marker;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.idl
index 2f6c45ee10..c715d70b55 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, GenerateConstructor] SVGMarkerElement : SVGElement,
+    interface [Conditional=SVG] SVGMarkerElement : SVGElement,
                                                    SVGLangSpace,
                                                    SVGExternalResourcesRequired,
                                                    SVGStylable,
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp
index 127f6f42eb..67b0a98a0b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp
@@ -2,8 +2,8 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
                   2005 Alexander Kellett <lypanov@kde.org>
-
-    This file is part of the KDE project
+                  2009 Dirk Schulze <krit@webkit.org>
+    Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -27,17 +27,12 @@
 #include "SVGMaskElement.h"
 
 #include "CSSStyleSelector.h"
-#include "GraphicsContext.h"
-#include "ImageBuffer.h"
 #include "MappedAttribute.h"
-#include "RenderSVGContainer.h"
+#include "RenderSVGResourceMasker.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
 #include "SVGRenderSupport.h"
 #include "SVGUnitTypes.h"
-#include <math.h>
-#include <wtf/MathExtras.h>
-#include <wtf/OwnPtr.h>
 
 using namespace std;
 
@@ -49,14 +44,12 @@ SVGMaskElement::SVGMaskElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
-    , m_maskUnits(this, SVGNames::maskUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
-    , m_maskContentUnits(this, SVGNames::maskContentUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
-    , m_x(this, SVGNames::xAttr, LengthModeWidth, "-10%")
-    , m_y(this, SVGNames::yAttr, LengthModeHeight, "-10%")
-    , m_width(this, SVGNames::widthAttr, LengthModeWidth, "120%")
-    , m_height(this, SVGNames::heightAttr, LengthModeHeight, "120%")
-    , m_href(this, XLinkNames::hrefAttr)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_maskUnits(SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
+    , m_maskContentUnits(SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
+    , m_x(LengthModeWidth, "-10%")
+    , m_y(LengthModeHeight, "-10%")
+    , m_width(LengthModeWidth, "120%")
+    , m_height(LengthModeHeight, "120%")
 {
     // Spec: If the x/y attribute is not specified, the effect is as if a value of "-10%" were specified.
     // Spec: If the width/height attribute is not specified, the effect is as if a value of "120%" were specified.
@@ -103,9 +96,6 @@ void SVGMaskElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledElement::svgAttributeChanged(attrName);
 
-    if (!m_masker)
-        return;
-
     if (attrName == SVGNames::maskUnitsAttr || attrName == SVGNames::maskContentUnitsAttr ||
         attrName == SVGNames::xAttr || attrName == SVGNames::yAttr ||
         attrName == SVGNames::widthAttr || attrName == SVGNames::heightAttr ||
@@ -114,102 +104,63 @@ void SVGMaskElement::svgAttributeChanged(const QualifiedName& attrName)
         SVGLangSpace::isKnownAttribute(attrName) ||
         SVGExternalResourcesRequired::isKnownAttribute(attrName) ||
         SVGStyledElement::isKnownAttribute(attrName))
-        m_masker->invalidate();
+        invalidateCanvasResources();
 }
 
-void SVGMaskElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+void SVGMaskElement::synchronizeProperty(const QualifiedName& attrName)
 {
-    SVGStyledElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-
-    if (!m_masker)
+    SVGStyledElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeMaskUnits();
+        synchronizeMaskContentUnits();
+        synchronizeX();
+        synchronizeY();
+        synchronizeExternalResourcesRequired();
+        synchronizeHref();
         return;
+    }
 
-    m_masker->invalidate();
+    if (attrName == SVGNames::maskUnitsAttr)
+        synchronizeMaskUnits();
+    else if (attrName == SVGNames::maskContentUnitsAttr)
+        synchronizeMaskContentUnits();
+    else if (attrName == SVGNames::xAttr)
+        synchronizeX();
+    else if (attrName == SVGNames::yAttr)
+        synchronizeY();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+    else if (SVGURIReference::isKnownAttribute(attrName))
+        synchronizeHref();
 }
 
-PassOwnPtr<ImageBuffer> SVGMaskElement::drawMaskerContent(const FloatRect& targetRect, FloatRect& maskDestRect) const
-{    
-    // Determine specified mask size
-    if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
-        maskDestRect = FloatRect(x().valueAsPercentage() * targetRect.width(),
-                                 y().valueAsPercentage() * targetRect.height(),
-                                 width().valueAsPercentage() * targetRect.width(),
-                                 height().valueAsPercentage() * targetRect.height());
-    else
-        maskDestRect = FloatRect(x().value(this),
-                                 y().value(this),
-                                 width().value(this),
-                                 height().value(this));
-
-    IntSize imageSize(lroundf(maskDestRect.width()), lroundf(maskDestRect.height()));
-    clampImageBufferSizeToViewport(document()->view(), imageSize);
-
-    if (imageSize.width() < static_cast<int>(maskDestRect.width()))
-        maskDestRect.setWidth(imageSize.width());
-
-    if (imageSize.height() < static_cast<int>(maskDestRect.height()))
-        maskDestRect.setHeight(imageSize.height());
-
-    // FIXME: This changes color space to linearRGB, the default color space
-    // for masking operations in SVG. We need a switch for the other color-space
-    // attribute values sRGB, inherit and auto.
-    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(imageSize, LinearRGB);
-    if (!maskImage)
-        return 0;
+void SVGMaskElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+{
+    SVGStyledElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    invalidateCanvasResources();
+}
 
-    FloatPoint maskContextLocation = maskDestRect.location();
+FloatRect SVGMaskElement::maskBoundingBox(const FloatRect& objectBoundingBox) const
+{
+    FloatRect maskBBox;
     if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
-        maskDestRect.move(targetRect.x(), targetRect.y());
-
-    if (maskContentUnits() != SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
-        maskContextLocation.move(targetRect.x(), targetRect.y());
-
-    GraphicsContext* maskImageContext = maskImage->context();
-    ASSERT(maskImageContext);
-
-    maskImageContext->save();
-    maskImageContext->translate(-maskContextLocation.x(), -maskContextLocation.y());
-
-    if (maskContentUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
-        maskImageContext->save();
-        maskImageContext->scale(FloatSize(targetRect.width(), targetRect.height()));
-    }
-
-    // Render subtree into ImageBuffer
-    for (Node* n = firstChild(); n; n = n->nextSibling()) {
-        SVGElement* elem = 0;
-        if (n->isSVGElement())
-            elem = static_cast<SVGElement*>(n);
-        if (!elem || !elem->isStyled())
-            continue;
-
-        SVGStyledElement* e = static_cast<SVGStyledElement*>(elem);
-        RenderObject* item = e->renderer();
-        if (!item)
-            continue;
-
-        renderSubtreeToImage(maskImage.get(), item);
-    }
-
-    if (maskContentUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
-        maskImageContext->restore();
+        maskBBox = FloatRect(x().valueAsPercentage() * objectBoundingBox.width() + objectBoundingBox.x(),
+                             y().valueAsPercentage() * objectBoundingBox.height() + objectBoundingBox.y(),
+                             width().valueAsPercentage() * objectBoundingBox.width(),
+                             height().valueAsPercentage() * objectBoundingBox.height());
+    else
+        maskBBox = FloatRect(x().value(this),
+                             y().value(this),
+                             width().value(this),
+                             height().value(this));
 
-    maskImageContext->restore();
-    return maskImage.release();
-}
- 
-RenderObject* SVGMaskElement::createRenderer(RenderArena* arena, RenderStyle*)
-{
-    RenderSVGContainer* maskContainer = new (arena) RenderSVGContainer(this);
-    maskContainer->setDrawsContents(false);
-    return maskContainer;
+    return maskBBox;
 }
 
-SVGResource* SVGMaskElement::canvasResource()
+RenderObject* SVGMaskElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    if (!m_masker)
-        m_masker = SVGResourceMasker::create(this);
-    return m_masker.get();
+    return new (arena) RenderSVGResourceMasker(this);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h
index 362c7301bc..7730e37c6a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h
@@ -21,13 +21,12 @@
 #define SVGMaskElement_h
 
 #if ENABLE(SVG)
-#include "SVGResourceMasker.h"
+#include "RenderObject.h"
 #include "SVGExternalResourcesRequired.h"
 #include "SVGLangSpace.h"
 #include "SVGStyledLocatableElement.h"
 #include "SVGTests.h"
 #include "SVGURIReference.h"
-#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -43,35 +42,30 @@ namespace WebCore {
         virtual ~SVGMaskElement();
         virtual bool isValid() const { return SVGTests::isValid(); }
 
+        FloatRect maskBoundingBox(const FloatRect&) const;
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-        virtual SVGResource* canvasResource();
-
-        PassOwnPtr<ImageBuffer> drawMaskerContent(const FloatRect& targetRect, FloatRect& maskRect) const;
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::maskUnitsAttrString, int, MaskUnits, maskUnits)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::maskContentUnitsAttrString, int, MaskContentUnits, maskContentUnits)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::xAttrString, SVGLength, X, x)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::yAttrString, SVGLength, Y, y)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::widthAttrString, SVGLength, Width, width)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::heightAttrString, SVGLength, Height, height)
+        DECLARE_ANIMATED_PROPERTY(SVGMaskElement, SVGNames::maskUnitsAttr, int, MaskUnits, maskUnits)
+        DECLARE_ANIMATED_PROPERTY(SVGMaskElement, SVGNames::maskContentUnitsAttr, int, MaskContentUnits, maskContentUnits)
+        DECLARE_ANIMATED_PROPERTY(SVGMaskElement, SVGNames::xAttr, SVGLength, X, x)
+        DECLARE_ANIMATED_PROPERTY(SVGMaskElement, SVGNames::yAttr, SVGLength, Y, y)
+        DECLARE_ANIMATED_PROPERTY(SVGMaskElement, SVGNames::widthAttr, SVGLength, Width, width)
+        DECLARE_ANIMATED_PROPERTY(SVGMaskElement, SVGNames::heightAttr, SVGLength, Height, height)
 
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+        DECLARE_ANIMATED_PROPERTY(SVGMaskElement, XLinkNames::hrefAttr, String, Href, href)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
-
-        RefPtr<SVGResourceMasker> m_masker;
+        DECLARE_ANIMATED_PROPERTY(SVGMaskElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
     };
 
-} // namespace WebCore
+}
 
-#endif // ENABLE(SVG)
+#endif
 #endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMatrix.idl b/src/3rdparty/webkit/WebCore/svg/SVGMatrix.idl
index cb8c08bd03..1b91d5374e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMatrix.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMatrix.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -24,9 +22,9 @@
 
 module svg {
 
-    interface [Conditional=SVG, PODType=TransformationMatrix] SVGMatrix {
+    interface [Conditional=SVG, PODType=AffineTransform] SVGMatrix {
         // FIXME: these attributes should all be floats but since we implement
-        // TransformationMatrix with doubles setting these as doubles makes more sense.
+        // AffineTransform with doubles setting these as doubles makes more sense.
         attribute double a;
         attribute double b;
         attribute double c;
@@ -34,7 +32,7 @@ module svg {
         attribute double e;
         attribute double f;
 
-        [Immutable] SVGMatrix multiply(in SVGMatrix secondMatrix);
+        [Custom] SVGMatrix multiply(in SVGMatrix secondMatrix);
         [Custom] SVGMatrix inverse()
             raises(SVGException);
         [Immutable] SVGMatrix translate(in float x, in float y);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMetadataElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGMetadataElement.cpp
index a18f73af9d..2cefc7dda3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMetadataElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMetadataElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMetadataElement.h b/src/3rdparty/webkit/WebCore/svg/SVGMetadataElement.h
index 63d0aaef07..afa6a8ecb0 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMetadataElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMetadataElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMetadataElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGMetadataElement.idl
index ce65b5e2ca..9434f4ddee 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMetadataElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMetadataElement.idl
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGNumber.idl b/src/3rdparty/webkit/WebCore/svg/SVGNumber.idl
index 7e4c8bd249..7e1a11744f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGNumber.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGNumber.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGNumberList.cpp b/src/3rdparty/webkit/WebCore/svg/SVGNumberList.cpp
index 4e904f4393..11aebde4e1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGNumberList.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGNumberList.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -30,7 +28,7 @@
 namespace WebCore {
 
 SVGNumberList::SVGNumberList(const QualifiedName& attributeName)
-    : SVGList<float>(attributeName)
+    : SVGPODList<float>(attributeName)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGNumberList.h b/src/3rdparty/webkit/WebCore/svg/SVGNumberList.h
index 6cd43ff986..329968b482 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGNumberList.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGNumberList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -31,7 +29,7 @@ namespace WebCore {
 
     class String;
 
-    class SVGNumberList : public SVGList<float> {
+    class SVGNumberList : public SVGPODList<float> {
     public:
         static PassRefPtr<SVGNumberList> create(const QualifiedName& attributeName) { return adoptRef(new SVGNumberList(attributeName)); }
         virtual ~SVGNumberList();
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPaint.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPaint.cpp
index 45abe69ae2..3b39b91b4e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPaint.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPaint.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPaint.idl b/src/3rdparty/webkit/WebCore/svg/SVGPaint.idl
index 7799aa3a0f..392ae33d7f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPaint.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPaint.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, GenerateConstructor] SVGPaint : SVGColor {
+    interface [Conditional=SVG] SVGPaint : SVGColor {
         // SVGPaintType
         const unsigned short SVG_PAINTTYPE_UNKNOWN               = 0;
         const unsigned short SVG_PAINTTYPE_RGBCOLOR              = 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp
index 70799298bd..f6e7867049 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -49,8 +47,6 @@ SVGPathElement::SVGPathElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
-    , m_pathLength(this, SVGNames::pathLengthAttr, 0.0f)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -71,9 +67,9 @@ FloatPoint SVGPathElement::getPointAtLength(float length)
     return toPathData().pointAtLength(length, ok);
 }
 
-unsigned long SVGPathElement::getPathSegAtLength(float length)
+unsigned long SVGPathElement::getPathSegAtLength(float length, ExceptionCode& ec)
 {
-    return pathSegList()->getPathSegAtLength(length);
+    return pathSegList()->getPathSegAtLength(length, ec);
 }
 
 PassRefPtr<SVGPathSegClosePath> SVGPathElement::createSVGPathSegClosePath()
@@ -208,6 +204,22 @@ void SVGPathElement::svgAttributeChanged(const QualifiedName& attrName)
         renderer()->setNeedsLayout(true);
 }
 
+void SVGPathElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledTransformableElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizePathLength();
+        synchronizeExternalResourcesRequired();
+        return;
+    }
+
+    if (attrName == SVGNames::pathLengthAttr)
+        synchronizePathLength();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+}
+
 SVGPathSegList* SVGPathElement::pathSegList() const
 {
     if (!m_pathSegList)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.h b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.h
index 7ea010bd96..e46ed92dbe 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.h
@@ -62,7 +62,7 @@ namespace WebCore {
         virtual bool isValid() const { return SVGTests::isValid(); }
         float getTotalLength();
         FloatPoint getPointAtLength(float distance);
-        unsigned long getPathSegAtLength(float distance);
+        unsigned long getPathSegAtLength(float distance, ExceptionCode&);
 
         static PassRefPtr<SVGPathSegClosePath> createSVGPathSegClosePath();
         static PassRefPtr<SVGPathSegMovetoAbs> createSVGPathSegMovetoAbs(float x, float y);
@@ -92,6 +92,7 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         virtual Path toPathData() const;
 
@@ -100,12 +101,10 @@ namespace WebCore {
     private:
         mutable RefPtr<SVGPathSegList> m_pathSegList;
 
-        ANIMATED_PROPERTY_DECLARATIONS(SVGPathElement, SVGNames::pathTagString, SVGNames::pathLengthAttrString, float, PathLength, pathLength)
+        DECLARE_ANIMATED_PROPERTY(SVGPathElement, SVGNames::pathLengthAttr, float, PathLength, pathLength)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGPathElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGPathElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.idl
index d66df1dd6d..9a389c8147 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.idl
@@ -37,7 +37,8 @@ module svg {
 
         float getTotalLength();
         SVGPoint getPointAtLength(in float distance);
-        unsigned long getPathSegAtLength(in float distance);
+        unsigned long getPathSegAtLength(in float distance)
+            raises(DOMException, SVGException);
 
         SVGPathSegClosePath createSVGPathSegClosePath();
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSeg.h b/src/3rdparty/webkit/WebCore/svg/SVGPathSeg.h
index 84de92ff62..b88806caa6 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSeg.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSeg.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSeg.idl b/src/3rdparty/webkit/WebCore/svg/SVGPathSeg.idl
index 6754d2ab8b..afabb418be 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSeg.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSeg.idl
@@ -26,7 +26,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, CustomToJS, GenerateConstructor, Polymorphic] SVGPathSeg {
+    interface [Conditional=SVG, CustomToJS, Polymorphic] SVGPathSeg {
         // Path Segment Types
         const unsigned short PATHSEG_UNKNOWN                      = 0;
         const unsigned short PATHSEG_CLOSEPATH                    = 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegArc.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPathSegArc.cpp
index a54f05755e..5fb024341b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegArc.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegArc.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegArc.h b/src/3rdparty/webkit/WebCore/svg/SVGPathSegArc.h
index 8611e8a8ff..e1cbeb11ed 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegArc.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegArc.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegClosePath.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPathSegClosePath.cpp
index 04b711c126..1f58096afc 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegClosePath.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegClosePath.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegClosePath.h b/src/3rdparty/webkit/WebCore/svg/SVGPathSegClosePath.h
index 190af9e303..0e29bb306e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegClosePath.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegClosePath.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubic.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubic.cpp
index 14359de06d..6b87f55a4c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubic.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubic.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubic.h b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubic.h
index 68e3311c3e..125b3a363a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubic.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubic.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubicSmooth.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubicSmooth.cpp
index 26babdb597..97b256b45d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubicSmooth.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubicSmooth.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h
index 816ba0f795..db71dacf6d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadratic.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadratic.cpp
index 8594fde5e2..f3de51316f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadratic.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadratic.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadratic.h b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadratic.h
index 1625f13928..eb8b0d5659 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadratic.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadratic.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.cpp
index 3377709264..a64cbb6572 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.h b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.h
index 3017689cec..00eeec7bdc 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegLineto.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPathSegLineto.cpp
index ac3a8bdcf4..9ad300e144 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegLineto.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegLineto.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegLineto.h b/src/3rdparty/webkit/WebCore/svg/SVGPathSegLineto.h
index 1818ad29f5..500d5e420e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegLineto.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegLineto.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoHorizontal.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoHorizontal.cpp
index 3de2cc7452..f217919405 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoHorizontal.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoHorizontal.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoHorizontal.h b/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoHorizontal.h
index 84965a5ab1..87d6475c1c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoHorizontal.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoHorizontal.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoVertical.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoVertical.cpp
index 4f667ee341..341ab021cb 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoVertical.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoVertical.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoVertical.h b/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoVertical.h
index 8d4ba2914c..844f2f28a0 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoVertical.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegLinetoVertical.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegList.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPathSegList.cpp
index 8d6fdef985..11cad14bdf 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegList.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegList.cpp
@@ -51,15 +51,16 @@ SVGPathSegList::~SVGPathSegList()
 {
 }
 
-unsigned SVGPathSegList::getPathSegAtLength(double)
+unsigned SVGPathSegList::getPathSegAtLength(double, ExceptionCode& ec)
 {
     // FIXME : to be useful this will need to support non-normalized SVGPathSegLists
-    ExceptionCode ec = 0;
     int len = numberOfItems();
     // FIXME: Eventually this will likely move to a "path applier"-like model, until then PathTraversalState is less useful as we could just use locals
     PathTraversalState traversalState(PathTraversalState::TraversalSegmentAtLength);
     for (int i = 0; i < len; ++i) {
         SVGPathSeg* segment = getItem(i, ec).get();
+        if (ec)
+            return 0;
         float segmentLength = 0;
         switch (segment->pathSegType()) {
         case SVGPathSeg::PATHSEG_MOVETO_ABS:
@@ -104,10 +105,12 @@ Path SVGPathSegList::toPathData()
 {
     // FIXME : This should also support non-normalized PathSegLists
     Path pathData;
-    ExceptionCode ec = 0;
     int len = numberOfItems();
+    ExceptionCode ec = 0;
     for (int i = 0; i < len; ++i) {
         SVGPathSeg* segment = getItem(i, ec).get();
+        if (ec)
+            return Path();
         switch (segment->pathSegType()) {
             case SVGPathSeg::PATHSEG_MOVETO_ABS:
             {
@@ -182,10 +185,14 @@ PassRefPtr<SVGPathSegList> SVGPathSegList::createAnimated(const SVGPathSegList*
     if (!itemCount || itemCount != toList->numberOfItems())
         return 0;
     RefPtr<SVGPathSegList> result = create(fromList->associatedAttributeName());
-    ExceptionCode ec;
+    ExceptionCode ec = 0;
     for (unsigned n = 0; n < itemCount; ++n) {
         SVGPathSeg* from = fromList->getItem(n, ec).get();
+        if (ec)
+            return 0;
         SVGPathSeg* to = toList->getItem(n, ec).get();
+        if (ec)
+            return 0;
         if (from->pathSegType() == SVGPathSeg::PATHSEG_UNKNOWN || from->pathSegType() != to->pathSegType())
             return 0;
         RefPtr<SVGPathSeg> segment = 0;
@@ -251,6 +258,8 @@ PassRefPtr<SVGPathSegList> SVGPathSegList::createAnimated(const SVGPathSegList*
             ASSERT_NOT_REACHED();
         }
         result->appendItem(segment, ec);
+        if (ec)
+            return 0;
     }
     return result.release();
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegList.h b/src/3rdparty/webkit/WebCore/svg/SVGPathSegList.h
index d9325ce62f..d2999f0270 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegList.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegList.h
@@ -36,7 +36,7 @@ namespace WebCore {
         static PassRefPtr<SVGPathSegList> create(const QualifiedName& attributeName) { return adoptRef(new SVGPathSegList(attributeName)); }
         virtual ~SVGPathSegList();
 
-        unsigned getPathSegAtLength(double);
+        unsigned getPathSegAtLength(double, ExceptionCode&);
         Path toPathData();
         
         static PassRefPtr<SVGPathSegList> createAnimated(const SVGPathSegList* fromList, const SVGPathSegList* toList, float progress);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegMoveto.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPathSegMoveto.cpp
index fc67b2955e..1144779288 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegMoveto.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegMoveto.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegMoveto.h b/src/3rdparty/webkit/WebCore/svg/SVGPathSegMoveto.h
index 726b819235..5d30633886 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegMoveto.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegMoveto.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp
index 34b7db4397..7659afa578 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -25,6 +23,7 @@
 #if ENABLE(SVG)
 #include "SVGPatternElement.h"
 
+#include "AffineTransform.h"
 #include "Document.h"
 #include "FloatConversion.h"
 #include "GraphicsContext.h"
@@ -41,7 +40,6 @@
 #include "SVGTransformList.h"
 #include "SVGTransformable.h"
 #include "SVGUnitTypes.h"
-#include "TransformationMatrix.h"
 #include <math.h>
 #include <wtf/MathExtras.h>
 #include <wtf/OwnPtr.h>
@@ -57,17 +55,13 @@ SVGPatternElement::SVGPatternElement(const QualifiedName& tagName, Document* doc
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , SVGFitToViewBox()
-    , m_x(this, SVGNames::xAttr, LengthModeWidth)
-    , m_y(this, SVGNames::yAttr, LengthModeHeight)
-    , m_width(this, SVGNames::widthAttr, LengthModeWidth)
-    , m_height(this, SVGNames::heightAttr, LengthModeHeight)
-    , m_patternUnits(this, SVGNames::patternUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
-    , m_patternContentUnits(this, SVGNames::patternContentUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
-    , m_patternTransform(this, SVGNames::patternTransformAttr, SVGTransformList::create(SVGNames::patternTransformAttr))
-    , m_href(this, XLinkNames::hrefAttr)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
-    , m_viewBox(this, SVGNames::viewBoxAttr)
-    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
+    , m_x(LengthModeWidth)
+    , m_y(LengthModeHeight)
+    , m_width(LengthModeWidth)
+    , m_height(LengthModeHeight)
+    , m_patternUnits(SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
+    , m_patternContentUnits(SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
+    , m_patternTransform(SVGTransformList::create(SVGNames::patternTransformAttr))
 {
 }
 
@@ -140,6 +134,48 @@ void SVGPatternElement::svgAttributeChanged(const QualifiedName& attrName)
         m_resource->invalidate();
 }
 
+void SVGPatternElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizePatternUnits();
+        synchronizePatternContentUnits();
+        synchronizePatternTransform();
+        synchronizeX();
+        synchronizeY();
+        synchronizeWidth();
+        synchronizeHeight();
+        synchronizeExternalResourcesRequired();
+        synchronizeViewBox();
+        synchronizePreserveAspectRatio();
+        synchronizeHref();
+        return;
+    }
+
+    if (attrName == SVGNames::patternUnitsAttr)
+        synchronizePatternUnits();
+    else if (attrName == SVGNames::patternContentUnitsAttr)
+        synchronizePatternContentUnits();
+    else if (attrName == SVGNames::patternTransformAttr)
+        synchronizePatternTransform();
+    else if (attrName == SVGNames::xAttr)
+        synchronizeX();
+    else if (attrName == SVGNames::yAttr)
+        synchronizeY();
+    else if (attrName == SVGNames::widthAttr)
+        synchronizeWidth();
+    else if (attrName == SVGNames::heightAttr)
+        synchronizeHeight();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+    else if (SVGFitToViewBox::isKnownAttribute(attrName)) {
+        synchronizeViewBox();
+        synchronizePreserveAspectRatio();
+    } else if (SVGURIReference::isKnownAttribute(attrName))
+        synchronizeHref();
+}
+
 void SVGPatternElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGStyledElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
@@ -173,13 +209,6 @@ void SVGPatternElement::buildPattern(const FloatRect& targetRect) const
                                       attributes.width().value(this),
                                       attributes.height().value(this));
 
-    // Clip pattern boundaries to target boundaries
-    if (patternBoundaries.width() > targetRect.width())
-        patternBoundaries.setWidth(targetRect.width());
-
-    if (patternBoundaries.height() > targetRect.height())
-        patternBoundaries.setHeight(targetRect.height());
-
     IntSize patternSize(patternBoundaries.width(), patternBoundaries.height());
     clampImageBufferSizeToViewport(document()->view(), patternSize);
 
@@ -199,7 +228,7 @@ void SVGPatternElement::buildPattern(const FloatRect& targetRect) const
         }
     }
 
-    TransformationMatrix viewBoxCTM = viewBoxToViewTransform(viewBox(), preserveAspectRatio(), patternBoundaries.width(), patternBoundaries.height()); 
+    AffineTransform viewBoxCTM = viewBoxToViewTransform(viewBox(), preserveAspectRatio(), patternBoundaries.width(), patternBoundaries.height()); 
     FloatRect patternBoundariesIncludingOverflow = patternBoundaries;
 
     // Apply objectBoundingBoxMode fixup for patternContentUnits, if viewBox is not set.
@@ -265,7 +294,7 @@ RenderObject* SVGPatternElement::createRenderer(RenderArena* arena, RenderStyle*
     return patternContainer;
 }
 
-SVGResource* SVGPatternElement::canvasResource()
+SVGResource* SVGPatternElement::canvasResource(const RenderObject*)
 {
     if (!m_resource)
         m_resource = SVGPaintServerPattern::create(this);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.h b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.h
index 6a679afbd5..fffbbca23f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.h
@@ -22,6 +22,7 @@
 #define SVGPatternElement_h
 
 #if ENABLE(SVG)
+#include "RenderObject.h"
 #include "SVGExternalResourcesRequired.h"
 #include "SVGFitToViewBox.h"
 #include "SVGLangSpace.h"
@@ -51,31 +52,30 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-        virtual SVGResource* canvasResource();
+        virtual SVGResource* canvasResource(const RenderObject*);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::xAttrString, SVGLength, X, x)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::yAttrString, SVGLength, Y, y)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::widthAttrString, SVGLength, Width, width)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::heightAttrString, SVGLength, Height, height)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::patternUnitsAttrString, int, PatternUnits, patternUnits)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::patternContentUnitsAttrString, int, PatternContentUnits, patternContentUnits)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::patternTransformAttrString, SVGTransformList, PatternTransform, patternTransform)
+        DECLARE_ANIMATED_PROPERTY(SVGPatternElement, SVGNames::xAttr, SVGLength, X, x)
+        DECLARE_ANIMATED_PROPERTY(SVGPatternElement, SVGNames::yAttr, SVGLength, Y, y)
+        DECLARE_ANIMATED_PROPERTY(SVGPatternElement, SVGNames::widthAttr, SVGLength, Width, width)
+        DECLARE_ANIMATED_PROPERTY(SVGPatternElement, SVGNames::heightAttr, SVGLength, Height, height)
+        DECLARE_ANIMATED_PROPERTY(SVGPatternElement, SVGNames::patternUnitsAttr, int, PatternUnits, patternUnits)
+        DECLARE_ANIMATED_PROPERTY(SVGPatternElement, SVGNames::patternContentUnitsAttr, int, PatternContentUnits, patternContentUnits)
+        DECLARE_ANIMATED_PROPERTY(SVGPatternElement, SVGNames::patternTransformAttr, SVGTransformList*, PatternTransform, patternTransform)
 
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+        DECLARE_ANIMATED_PROPERTY(SVGPatternElement, XLinkNames::hrefAttr, String, Href, href)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGPatternElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
 
         // SVGPatternElement
-        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+        DECLARE_ANIMATED_PROPERTY(SVGPatternElement, SVGNames::viewBoxAttr, FloatRect, ViewBox, viewBox)
+        DECLARE_ANIMATED_PROPERTY(SVGPatternElement, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
  
         mutable RefPtr<SVGPaintServerPattern> m_resource;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPoint.idl b/src/3rdparty/webkit/WebCore/svg/SVGPoint.idl
index 1a0d2271d5..1bf96f8e66 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPoint.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPoint.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPointList.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPointList.cpp
index c5a6dd2f30..02a67ed95f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPointList.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPointList.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPointList.h b/src/3rdparty/webkit/WebCore/svg/SVGPointList.h
index d443e2dd08..cc12366f2c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPointList.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPointList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPointList.idl b/src/3rdparty/webkit/WebCore/svg/SVGPointList.idl
index cf82dff099..24b10424a2 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPointList.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPointList.idl
@@ -28,19 +28,19 @@ module svg {
     interface [Conditional=SVG] SVGPointList {
         readonly attribute unsigned long numberOfItems;
 
-        [JSCCustom] void clear()
+        void clear()
             raises(DOMException);
-        [JSCCustom] SVGPoint initialize(in SVGPoint item)
+        SVGPoint initialize(in SVGPoint item)
             raises(DOMException, SVGException);
-        [JSCCustom] SVGPoint getItem(in unsigned long index)
+        SVGPoint getItem(in unsigned long index)
             raises(DOMException);
-        [JSCCustom] SVGPoint insertItemBefore(in SVGPoint item, in unsigned long index)
+        SVGPoint insertItemBefore(in SVGPoint item, in unsigned long index)
             raises(DOMException, SVGException);
-        [JSCCustom] SVGPoint replaceItem(in SVGPoint item, in unsigned long index)
+        SVGPoint replaceItem(in SVGPoint item, in unsigned long index)
             raises(DOMException, SVGException);
-        [JSCCustom] SVGPoint removeItem(in unsigned long index)
+        SVGPoint removeItem(in unsigned long index)
             raises(DOMException);
-        [JSCCustom] SVGPoint appendItem(in SVGPoint item)
+        SVGPoint appendItem(in SVGPoint item)
             raises(DOMException, SVGException);
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp
index 62e53a330c..800bdfa503 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -29,7 +27,6 @@
 #include "FloatPoint.h"
 #include "MappedAttribute.h"
 #include "RenderPath.h"
-#include "SVGAnimatedProperty.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SVGPointList.h"
@@ -42,7 +39,6 @@ SVGPolyElement::SVGPolyElement(const QualifiedName& tagName, Document* doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , SVGAnimatedPoints()
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -90,41 +86,35 @@ void SVGPolyElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledTransformableElement::svgAttributeChanged(attrName);
 
-    if (!renderer())
-        return;
-
-    if (attrName == SVGNames::pointsAttr) {
+    // The points property is not a regular SVGAnimatedProperty, still we use the same SVG<->XML DOM synchronization framework.
+    if (attrName == SVGNames::pointsAttr)
         setSynchronizedSVGAttributes(false);
-        renderer()->setNeedsLayout(true);
+
+    if (!renderer())
         return;
-    }
 
-    if (SVGTests::isKnownAttribute(attrName) ||
-        SVGLangSpace::isKnownAttribute(attrName) ||
-        SVGExternalResourcesRequired::isKnownAttribute(attrName) ||
-        SVGStyledTransformableElement::isKnownAttribute(attrName))
+    if (attrName == SVGNames::pointsAttr
+        || SVGTests::isKnownAttribute(attrName)
+        || SVGLangSpace::isKnownAttribute(attrName)
+        || SVGExternalResourcesRequired::isKnownAttribute(attrName)
+        || SVGStyledTransformableElement::isKnownAttribute(attrName))
         renderer()->setNeedsLayout(true);
 }
 
-// Custom SVG<->XML synchronization logic, as SVGPoly*Element doesn't use animated
-// properties for this, but a special solution: SVGAnimatedPoints inheritance.
-void SVGPolyElement::updateAnimatedSVGAttribute(const String& name) const
+void SVGPolyElement::synchronizeProperty(const QualifiedName& attrName)
 {
-    ASSERT(!m_areSVGAttributesValid);
-
-    if (m_synchronizingSVGAttributes)
-        return;
-
-    if (name == SVGNames::pointsAttr.localName()) {
-        m_synchronizingSVGAttributes = true;
+    SVGStyledTransformableElement::synchronizeProperty(attrName);
 
-        PropertySynchronizer<SVGPolyElement, SVGPointList*, true>::synchronize(this, SVGNames::pointsAttr, m_points.get());
-        setSynchronizedSVGAttributes(true);
-        m_synchronizingSVGAttributes = false;
+    if (attrName == anyQName()) {
+        synchronizeExternalResourcesRequired();
+        SVGAnimatedPropertySynchronizer<true>::synchronize(this, SVGNames::pointsAttr, points()->valueAsString());
         return;
     }
 
-    SVGStyledTransformableElement::updateAnimatedSVGAttribute(name);
+    if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+    else if (attrName == SVGNames::pointsAttr)
+        SVGAnimatedPropertySynchronizer<true>::synchronize(this, attrName, points()->valueAsString());
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.h b/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.h
index 2ffd150705..b881ca24fb 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.h
@@ -46,17 +46,14 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*); 
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         virtual bool rendererIsNeeded(RenderStyle* style) { return StyledElement::rendererIsNeeded(style); }
         virtual bool supportsMarkers() const { return true; }
 
-        virtual void updateAnimatedSVGAttribute(const String&) const;
-
     private:
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGPolyElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGPolyElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
 
         mutable RefPtr<SVGPointList> m_points;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPolygonElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPolygonElement.cpp
index 95513e4a9c..a4a62af94a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPolygonElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPolygonElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPolygonElement.h b/src/3rdparty/webkit/WebCore/svg/SVGPolygonElement.h
index 7afb553af6..fa6eef6228 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPolygonElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPolygonElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPolylineElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPolylineElement.cpp
index 9ea136ef3e..899c072f03 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPolylineElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPolylineElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPolylineElement.h b/src/3rdparty/webkit/WebCore/svg/SVGPolylineElement.h
index d43dbbe206..e070c9fd5e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPolylineElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPolylineElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.cpp
index 57939760ed..6853a14ded 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.cpp
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+                  2010 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -25,7 +24,7 @@
 #if ENABLE(SVG)
 #include "SVGPreserveAspectRatio.h"
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "SVGParserUtilities.h"
 #include "SVGSVGElement.h"
 
@@ -62,11 +61,12 @@ unsigned short SVGPreserveAspectRatio::meetOrSlice() const
     return m_meetOrSlice;
 }
 
-bool SVGPreserveAspectRatio::parsePreserveAspectRatio(const UChar*& currParam, const UChar* end, bool validate)
+SVGPreserveAspectRatio SVGPreserveAspectRatio::parsePreserveAspectRatio(const UChar*& currParam, const UChar* end, bool validate, bool& result)
 {
-    SVGPreserveAspectRatioType align = SVG_PRESERVEASPECTRATIO_NONE;
-    SVGMeetOrSliceType meetOrSlice = SVG_MEETORSLICE_MEET;
-    bool ret = false;
+    SVGPreserveAspectRatio aspectRatio;
+    aspectRatio.m_align = SVG_PRESERVEASPECTRATIO_NONE;
+    aspectRatio.m_meetOrSlice = SVG_MEETORSLICE_MEET;
+    result = false;
 
     if (!skipOptionalSpaces(currParam, end))
         goto bail_out;
@@ -92,25 +92,25 @@ bool SVGPreserveAspectRatio::parsePreserveAspectRatio(const UChar*& currParam, c
             if (currParam[3] == 'n') {
                 if (currParam[6] == 'i') {
                     if (currParam[7] == 'n')
-                        align = SVG_PRESERVEASPECTRATIO_XMINYMIN;
+                        aspectRatio.m_align = SVG_PRESERVEASPECTRATIO_XMINYMIN;
                     else if (currParam[7] == 'd')
-                        align = SVG_PRESERVEASPECTRATIO_XMINYMID;
+                        aspectRatio.m_align = SVG_PRESERVEASPECTRATIO_XMINYMID;
                     else
                         goto bail_out;
                 } else if (currParam[6] == 'a' && currParam[7] == 'x')
-                     align = SVG_PRESERVEASPECTRATIO_XMINYMAX;
+                     aspectRatio.m_align = SVG_PRESERVEASPECTRATIO_XMINYMAX;
                 else
                      goto bail_out;
              } else if (currParam[3] == 'd') {
                 if (currParam[6] == 'i') {
                     if (currParam[7] == 'n')
-                        align = SVG_PRESERVEASPECTRATIO_XMIDYMIN;
+                        aspectRatio.m_align = SVG_PRESERVEASPECTRATIO_XMIDYMIN;
                     else if (currParam[7] == 'd')
-                        align = SVG_PRESERVEASPECTRATIO_XMIDYMID;
+                        aspectRatio.m_align = SVG_PRESERVEASPECTRATIO_XMIDYMID;
                     else
                         goto bail_out;
                 } else if (currParam[6] == 'a' && currParam[7] == 'x')
-                    align = SVG_PRESERVEASPECTRATIO_XMIDYMAX;
+                    aspectRatio.m_align = SVG_PRESERVEASPECTRATIO_XMIDYMAX;
                 else
                     goto bail_out;
             } else
@@ -118,13 +118,13 @@ bool SVGPreserveAspectRatio::parsePreserveAspectRatio(const UChar*& currParam, c
         } else if (currParam[2] == 'a' && currParam[3] == 'x') {
             if (currParam[6] == 'i') {
                 if (currParam[7] == 'n')
-                    align = SVG_PRESERVEASPECTRATIO_XMAXYMIN;
+                    aspectRatio.m_align = SVG_PRESERVEASPECTRATIO_XMAXYMIN;
                 else if (currParam[7] == 'd')
-                    align = SVG_PRESERVEASPECTRATIO_XMAXYMID;
+                    aspectRatio.m_align = SVG_PRESERVEASPECTRATIO_XMAXYMID;
                 else
                     goto bail_out;
             } else if (currParam[6] == 'a' && currParam[7] == 'x')
-                align = SVG_PRESERVEASPECTRATIO_XMAXYMAX;
+                aspectRatio.m_align = SVG_PRESERVEASPECTRATIO_XMAXYMAX;
             else
                 goto bail_out;
         } else
@@ -143,33 +143,104 @@ bool SVGPreserveAspectRatio::parsePreserveAspectRatio(const UChar*& currParam, c
             if (!skipString(currParam, end, "slice"))
                 goto bail_out;
             skipOptionalSpaces(currParam, end);
-            if (align != SVG_PRESERVEASPECTRATIO_NONE)
-                meetOrSlice = SVG_MEETORSLICE_SLICE;    
+            if (aspectRatio.m_align != SVG_PRESERVEASPECTRATIO_NONE)
+                aspectRatio.m_meetOrSlice = SVG_MEETORSLICE_SLICE;    
         }
     }
 
     if (end != currParam && validate) {
 bail_out:
         // FIXME: Should the two values be set to UNKNOWN instead?
-        align = SVG_PRESERVEASPECTRATIO_NONE;
-        meetOrSlice = SVG_MEETORSLICE_MEET;
+        aspectRatio.m_align = SVG_PRESERVEASPECTRATIO_NONE;
+        aspectRatio.m_meetOrSlice = SVG_MEETORSLICE_MEET;
     } else
-        ret = true;
+        result = true;
 
-    if (m_align == align && m_meetOrSlice == meetOrSlice)
-        return ret;
+    return aspectRatio;
+}
 
-    m_align = align;
-    m_meetOrSlice = meetOrSlice;
-    return ret;
+void SVGPreserveAspectRatio::transformRect(FloatRect& destRect, FloatRect& srcRect)
+{
+    FloatSize imageSize = srcRect.size();
+    float origDestWidth = destRect.width();
+    float origDestHeight = destRect.height();
+    if (meetOrSlice() == SVGPreserveAspectRatio::SVG_MEETORSLICE_MEET) {
+        float widthToHeightMultiplier = srcRect.height() / srcRect.width();
+        if (origDestHeight > (origDestWidth * widthToHeightMultiplier)) {
+            destRect.setHeight(origDestWidth * widthToHeightMultiplier);
+            switch (align()) {
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMINYMID:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMID:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMID:
+                destRect.setY(destRect.y() + origDestHeight / 2.0f - destRect.height() / 2.0f);
+                break;
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMINYMAX:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMAX:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMAX:
+                destRect.setY(destRect.y() + origDestHeight - destRect.height());
+                break;
+            }
+        }
+        if (origDestWidth > (origDestHeight / widthToHeightMultiplier)) {
+            destRect.setWidth(origDestHeight / widthToHeightMultiplier);
+            switch (align()) {
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMIN:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMID:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMAX:
+                destRect.setX(destRect.x() + origDestWidth / 2.0f - destRect.width() / 2.0f);
+                break;
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMIN:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMID:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMAX:
+                destRect.setX(destRect.x() + origDestWidth - destRect.width());
+                break;
+            }
+        }
+    } else if (meetOrSlice() == SVGPreserveAspectRatio::SVG_MEETORSLICE_SLICE) {
+        float widthToHeightMultiplier = srcRect.height() / srcRect.width();
+        // if the destination height is less than the height of the image we'll be drawing
+        if (origDestHeight < (origDestWidth * widthToHeightMultiplier)) {
+            float destToSrcMultiplier = srcRect.width() / destRect.width();
+            srcRect.setHeight(destRect.height() * destToSrcMultiplier);
+            switch (align()) {
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMINYMID:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMID:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMID:
+                srcRect.setY(destRect.y() + imageSize.height() / 2.0f - srcRect.height() / 2.0f);
+                break;
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMINYMAX:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMAX:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMAX:
+                srcRect.setY(destRect.y() + imageSize.height() - srcRect.height());
+                break;
+            }
+        }
+        // if the destination width is less than the width of the image we'll be drawing
+        if (origDestWidth < (origDestHeight / widthToHeightMultiplier)) {
+            float destToSrcMultiplier = srcRect.height() / destRect.height();
+            srcRect.setWidth(destRect.width() * destToSrcMultiplier);
+            switch (align()) {
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMIN:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMID:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMIDYMAX:
+                srcRect.setX(destRect.x() + imageSize.width() / 2.0f - srcRect.width() / 2.0f);
+                break;
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMIN:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMID:
+            case SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_XMAXYMAX:
+                srcRect.setX(destRect.x() + imageSize.width() - srcRect.width());
+                break;
+            }
+        }
+    }
 }
 
-TransformationMatrix SVGPreserveAspectRatio::getCTM(double logicX, double logicY,
+AffineTransform SVGPreserveAspectRatio::getCTM(double logicX, double logicY,
                                                double logicWidth, double logicHeight,
                                                double /*physX*/, double /*physY*/,
-                                               double physWidth, double physHeight)
+                                               double physWidth, double physHeight) const
 {
-    TransformationMatrix temp;
+    AffineTransform temp;
 
     if (align() == SVG_PRESERVEASPECTRATIO_UNKNOWN)
         return temp;
@@ -180,7 +251,7 @@ TransformationMatrix SVGPreserveAspectRatio::getCTM(double logicX, double logicY
     if (align() == SVG_PRESERVEASPECTRATIO_NONE) {
         temp.scaleNonUniform(physWidth / logicWidth, physHeight / logicHeight);
         temp.translate(-logicX, -logicY);
-    } else if (vpar < svgar && (meetOrSlice() == SVG_MEETORSLICE_MEET) || vpar >= svgar && (meetOrSlice() == SVG_MEETORSLICE_SLICE)) {
+    } else if ((vpar < svgar && (meetOrSlice() == SVG_MEETORSLICE_MEET)) || (vpar >= svgar && (meetOrSlice() == SVG_MEETORSLICE_SLICE))) {
         temp.scaleNonUniform(physHeight / logicHeight, physHeight / logicHeight);
 
         if (align() == SVG_PRESERVEASPECTRATIO_XMINYMIN || align() == SVG_PRESERVEASPECTRATIO_XMINYMID || align() == SVG_PRESERVEASPECTRATIO_XMINYMAX)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.h b/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.h
index a0100ff421..8ee8d07f61 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -24,21 +22,17 @@
 #define SVGPreserveAspectRatio_h
 
 #if ENABLE(SVG)
+#include "FloatRect.h"
 #include "PlatformString.h"
 #include "SVGNames.h"
 
-#include <wtf/RefCounted.h>
-
 namespace WebCore {
 
     class String;
-    class TransformationMatrix;
-    class SVGStyledElement;
+    class AffineTransform;
 
-    class SVGPreserveAspectRatio : public RefCounted<SVGPreserveAspectRatio> { 
+    class SVGPreserveAspectRatio {
     public:
-        static PassRefPtr<SVGPreserveAspectRatio> create() { return adoptRef(new SVGPreserveAspectRatio); }
-
         enum SVGPreserveAspectRatioType {
             SVG_PRESERVEASPECTRATIO_UNKNOWN     = 0,
             SVG_PRESERVEASPECTRATIO_NONE        = 1,
@@ -59,6 +53,7 @@ namespace WebCore {
             SVG_MEETORSLICE_SLICE      = 2
         };
 
+        SVGPreserveAspectRatio();
         virtual ~SVGPreserveAspectRatio();
 
         void setAlign(unsigned short);
@@ -66,21 +61,30 @@ namespace WebCore {
 
         void setMeetOrSlice(unsigned short);
         unsigned short meetOrSlice() const;
+
+        void transformRect(FloatRect& destRect, FloatRect& srcRect);
         
-        TransformationMatrix getCTM(double logicX, double logicY,
+        AffineTransform getCTM(double logicX, double logicY,
                                double logicWidth, double logicHeight,
                                double physX, double physY,
-                               double physWidth, double physHeight);
+                               double physWidth, double physHeight) const;
 
-        // Helper
-        bool parsePreserveAspectRatio(const UChar*& currParam, const UChar* end, bool validate = true);
-        String valueAsString() const;
+        template<class Consumer>
+        static bool parsePreserveAspectRatio(Consumer* consumer, const String& value, bool validate = true)
+        {
+            bool result = false;
+            const UChar* begin = value.characters();
+            const UChar* end = begin + value.length();
+            consumer->setPreserveAspectRatioBaseValue(parsePreserveAspectRatio(begin, end, validate, result));
+            return result;
+        }
 
-        const QualifiedName& associatedAttributeName() const { return SVGNames::preserveAspectRatioAttr; }
+        // It's recommended to use the method above, only SVGViewSpec needs this parsing method
+        static SVGPreserveAspectRatio parsePreserveAspectRatio(const UChar*& currParam, const UChar* end, bool validate, bool& result);
+
+        String valueAsString() const;
 
     private:
-        SVGPreserveAspectRatio();
-        
         unsigned short m_align;
         unsigned short m_meetOrSlice;
     };
@@ -89,4 +93,3 @@ namespace WebCore {
 
 #endif // ENABLE(SVG)
 #endif // SVGPreserveAspectRatio_h
-
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.idl b/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.idl
index 066353e8f1..b21daba4cf 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, GenerateConstructor] SVGPreserveAspectRatio {
+    interface [Conditional=SVG, PODType=SVGPreserveAspectRatio] SVGPreserveAspectRatio {
         // Alignment Types
         const unsigned short SVG_PRESERVEASPECTRATIO_UNKNOWN  = 0;
         const unsigned short SVG_PRESERVEASPECTRATIO_NONE     = 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp
index a9b5cff5f1..b153c0f5ed 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp
@@ -42,11 +42,11 @@ namespace WebCore {
 
 SVGRadialGradientElement::SVGRadialGradientElement(const QualifiedName& tagName, Document* doc)
     : SVGGradientElement(tagName, doc)
-    , m_cx(this, SVGNames::cxAttr, LengthModeWidth, "50%")
-    , m_cy(this, SVGNames::cyAttr, LengthModeHeight, "50%")
-    , m_r(this, SVGNames::rAttr, LengthModeOther, "50%")
-    , m_fx(this, SVGNames::fxAttr, LengthModeWidth)
-    , m_fy(this, SVGNames::fyAttr, LengthModeHeight)
+    , m_cx(LengthModeWidth, "50%")
+    , m_cy(LengthModeHeight, "50%")
+    , m_r(LengthModeOther, "50%")
+    , m_fx(LengthModeWidth)
+    , m_fy(LengthModeHeight)
 {
     // Spec: If the cx/cy/r attribute is not specified, the effect is as if a value of "50%" were specified.
 }
@@ -86,6 +86,31 @@ void SVGRadialGradientElement::svgAttributeChanged(const QualifiedName& attrName
         m_resource->invalidate();
 }
 
+void SVGRadialGradientElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGGradientElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeCx();
+        synchronizeCy();
+        synchronizeFx();
+        synchronizeFy();
+        synchronizeR();
+        return;
+    }
+
+    if (attrName == SVGNames::cxAttr)
+        synchronizeCx();
+    else if (attrName == SVGNames::cyAttr)
+        synchronizeCy();
+    else if (attrName == SVGNames::fxAttr)
+        synchronizeFx();
+    else if (attrName == SVGNames::fyAttr)
+        synchronizeFy();
+    else if (attrName == SVGNames::rAttr)
+        synchronizeR();
+}
+
 void SVGRadialGradientElement::buildGradient() const
 {
     RadialGradientAttributes attributes = collectGradientProperties();
@@ -105,23 +130,25 @@ void SVGRadialGradientElement::buildGradient() const
         radius = attributes.r().value(this);
     }
 
-    float adjustedFocusX = focalPoint.x();
-    float adjustedFocusY = focalPoint.y();
-
-    float fdx = focalPoint.x() - centerPoint.x();
-    float fdy = focalPoint.y() - centerPoint.y();
+    FloatPoint adjustedFocalPoint = focalPoint;
+    float dfx = focalPoint.x() - centerPoint.x();
+    float dfy = focalPoint.y() - centerPoint.y();
+    float rMax = 0.99f * radius;
 
     // Spec: If (fx, fy) lies outside the circle defined by (cx, cy) and
     // r, set (fx, fy) to the point of intersection of the line through
     // (fx, fy) and the circle.
-    if (sqrt(fdx * fdx + fdy * fdy) > radius) {
-        float angle = atan2f(focalPoint.y() * 100.0f, focalPoint.x() * 100.0f);
-        adjustedFocusX = cosf(angle) * radius;
-        adjustedFocusY = sinf(angle) * radius;
+    // We scale the radius by 0.99 to match the behavior of FireFox.
+    if (sqrt(dfx * dfx + dfy * dfy) > rMax) {
+        float angle = atan2f(dfy, dfx);
+
+        dfx = cosf(angle) * rMax;
+        dfy = sinf(angle) * rMax;
+        adjustedFocalPoint = FloatPoint(dfx + centerPoint.x(), dfy + centerPoint.y());
     }
 
     RefPtr<Gradient> gradient = Gradient::create(
-        FloatPoint(adjustedFocusX, adjustedFocusY),
+        adjustedFocalPoint,
         0.f, // SVG does not support a "focus radius"
         centerPoint,
         radius);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.h b/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.h
index 6813e655ff..180948fd86 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -38,6 +36,7 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
     protected:
         virtual void buildGradient() const;
@@ -46,11 +45,11 @@ namespace WebCore {
         RadialGradientAttributes collectGradientProperties() const;
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGRadialGradientElement, SVGNames::radialGradientTagString, SVGNames::cxAttrString, SVGLength, Cx, cx)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGRadialGradientElement, SVGNames::radialGradientTagString, SVGNames::cyAttrString, SVGLength, Cy, cy)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGRadialGradientElement, SVGNames::radialGradientTagString, SVGNames::rAttrString, SVGLength, R, r)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGRadialGradientElement, SVGNames::radialGradientTagString, SVGNames::fxAttrString, SVGLength, Fx, fx)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGRadialGradientElement, SVGNames::radialGradientTagString, SVGNames::fyAttrString, SVGLength, Fy, fy)
+        DECLARE_ANIMATED_PROPERTY(SVGRadialGradientElement, SVGNames::cxAttr, SVGLength, Cx, cx)
+        DECLARE_ANIMATED_PROPERTY(SVGRadialGradientElement, SVGNames::cyAttr, SVGLength, Cy, cy)
+        DECLARE_ANIMATED_PROPERTY(SVGRadialGradientElement, SVGNames::rAttr, SVGLength, R, r)
+        DECLARE_ANIMATED_PROPERTY(SVGRadialGradientElement, SVGNames::fxAttr, SVGLength, Fx, fx)
+        DECLARE_ANIMATED_PROPERTY(SVGRadialGradientElement, SVGNames::fyAttr, SVGLength, Fy, fy)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGRect.idl b/src/3rdparty/webkit/WebCore/svg/SVGRect.idl
index 7fdce65104..02780303c9 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGRect.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGRect.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp
index 966976a1a8..014c42f6e9 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -37,13 +35,12 @@ SVGRectElement::SVGRectElement(const QualifiedName& tagName, Document *doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
-    , m_x(this, SVGNames::xAttr, LengthModeWidth)
-    , m_y(this, SVGNames::yAttr, LengthModeHeight)
-    , m_width(this, SVGNames::widthAttr, LengthModeWidth)
-    , m_height(this, SVGNames::heightAttr, LengthModeHeight)
-    , m_rx(this, SVGNames::rxAttr, LengthModeWidth)
-    , m_ry(this, SVGNames::ryAttr, LengthModeHeight)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_x(LengthModeWidth)
+    , m_y(LengthModeHeight)
+    , m_width(LengthModeWidth)
+    , m_height(LengthModeHeight)
+    , m_rx(LengthModeWidth)
+    , m_ry(LengthModeHeight)
 {
 }
 
@@ -101,6 +98,37 @@ void SVGRectElement::svgAttributeChanged(const QualifiedName& attrName)
         renderer()->setNeedsLayout(true);
 }
 
+void SVGRectElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledTransformableElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeX();
+        synchronizeY();
+        synchronizeWidth();
+        synchronizeHeight();
+        synchronizeRx();
+        synchronizeRy();
+        synchronizeExternalResourcesRequired();
+        return;
+    }
+
+    if (attrName == SVGNames::xAttr)
+        synchronizeX();
+    else if (attrName == SVGNames::yAttr)
+        synchronizeY();
+    else if (attrName == SVGNames::widthAttr)
+        synchronizeWidth();
+    else if (attrName == SVGNames::heightAttr)
+        synchronizeHeight();
+    else if (attrName == SVGNames::rxAttr)
+        synchronizeRx();
+    else if (attrName == SVGNames::ryAttr)
+        synchronizeRy();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+}
+
 Path SVGRectElement::toPathData() const
 {
     FloatRect rect(x().value(this), y().value(this), width().value(this), height().value(this));
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGRectElement.h b/src/3rdparty/webkit/WebCore/svg/SVGRectElement.h
index a4d859efc3..df382f93a0 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGRectElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGRectElement.h
@@ -41,6 +41,7 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         virtual Path toPathData() const;
 
@@ -48,17 +49,15 @@ namespace WebCore {
         virtual bool hasRelativeValues() const;
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGNames::rectTagString, SVGNames::xAttrString, SVGLength, X, x)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGNames::rectTagString, SVGNames::yAttrString, SVGLength, Y, y)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGNames::rectTagString, SVGNames::widthAttrString, SVGLength, Width, width)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGNames::rectTagString, SVGNames::heightAttrString, SVGLength, Height, height)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGNames::rectTagString, SVGNames::rxAttrString, SVGLength, Rx, rx)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGNames::rectTagString, SVGNames::ryAttrString, SVGLength, Ry, ry)
+        DECLARE_ANIMATED_PROPERTY(SVGRectElement, SVGNames::xAttr, SVGLength, X, x)
+        DECLARE_ANIMATED_PROPERTY(SVGRectElement, SVGNames::yAttr, SVGLength, Y, y)
+        DECLARE_ANIMATED_PROPERTY(SVGRectElement, SVGNames::widthAttr, SVGLength, Width, width)
+        DECLARE_ANIMATED_PROPERTY(SVGRectElement, SVGNames::heightAttr, SVGLength, Height, height)
+        DECLARE_ANIMATED_PROPERTY(SVGRectElement, SVGNames::rxAttr, SVGLength, Rx, rx)
+        DECLARE_ANIMATED_PROPERTY(SVGRectElement, SVGNames::ryAttr, SVGLength, Ry, ry)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGRectElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGRenderingIntent.h b/src/3rdparty/webkit/WebCore/svg/SVGRenderingIntent.h
index 699f228d3e..f4bfa6ad32 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGRenderingIntent.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGRenderingIntent.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGRenderingIntent.idl b/src/3rdparty/webkit/WebCore/svg/SVGRenderingIntent.idl
index fc21549a19..ff2f6ce1f8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGRenderingIntent.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGRenderingIntent.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, GenerateConstructor] SVGRenderingIntent {
+    interface [Conditional=SVG] SVGRenderingIntent {
         // Rendering Intent Types
         const unsigned short RENDERING_INTENT_UNKNOWN               = 0;
         const unsigned short RENDERING_INTENT_AUTO                  = 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp
index 2d5008b6d5..4c060084f5 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp
@@ -24,6 +24,7 @@
 #if ENABLE(SVG)
 #include "SVGSVGElement.h"
 
+#include "AffineTransform.h"
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "Document.h"
@@ -48,7 +49,6 @@
 #include "SVGZoomEvent.h"
 #include "ScriptEventListener.h"
 #include "SelectionController.h"
-#include "TransformationMatrix.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -63,15 +63,13 @@ SVGSVGElement::SVGSVGElement(const QualifiedName& tagName, Document* doc)
     , SVGExternalResourcesRequired()
     , SVGFitToViewBox()
     , SVGZoomAndPan()
-    , m_x(this, SVGNames::xAttr, LengthModeWidth)
-    , m_y(this, SVGNames::yAttr, LengthModeHeight)
-    , m_width(this, SVGNames::widthAttr, LengthModeWidth, "100%")
-    , m_height(this, SVGNames::heightAttr, LengthModeHeight, "100%") 
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
-    , m_viewBox(this, SVGNames::viewBoxAttr)
-    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
+    , m_x(LengthModeWidth)
+    , m_y(LengthModeHeight)
+    , m_width(LengthModeWidth, "100%")
+    , m_height(LengthModeHeight, "100%") 
     , m_useCurrentView(false)
     , m_timeContainer(SMILTimeContainer::create(this))
+    , m_scale(1)
     , m_viewSpec(0)
     , m_containerSize(300, 150)
     , m_hasSetContainerSize(false)
@@ -85,12 +83,6 @@ SVGSVGElement::~SVGSVGElement()
     // There are cases where removedFromDocument() is not called.
     // see ContainerNode::removeAllChildren, called by its destructor.
     document()->accessSVGExtensions()->removeTimeContainer(this);
-
-    // Call detach() here because if we wait until ~Node() calls it, we crash during
-    // RenderSVGViewportContainer destruction, as the renderer assumes that the element
-    // is still fully constructed. See <https://bugs.webkit.org/show_bug.cgi?id=21293>.
-    if (renderer())
-        detach();
 }
 
 const AtomicString& SVGSVGElement::contentScriptType() const
@@ -127,7 +119,7 @@ FloatRect SVGSVGElement::viewport() const
     }
     float w = width().value(this);
     float h = height().value(this);
-    TransformationMatrix viewBox = viewBoxToViewTransform(w, h);
+    AffineTransform viewBox = viewBoxToViewTransform(w, h);
     double wDouble = w;
     double hDouble = h;
     viewBox.map(_x, _y, _x, _y);
@@ -195,15 +187,25 @@ SVGViewSpec* SVGSVGElement::currentView() const
 
 float SVGSVGElement::currentScale() const
 {
-    if (document() && document()->frame())
-        return document()->frame()->zoomFactor();
-    return 1.0f;
+    // Only the page zoom factor is relevant for SVG
+    if (Frame* frame = document()->frame())
+        return frame->pageZoomFactor();
+    return m_scale;
 }
 
 void SVGSVGElement::setCurrentScale(float scale)
 {
-    if (document() && document()->frame())
-        document()->frame()->setZoomFactor(scale, true);
+    if (Frame* frame = document()->frame()) {
+        // Calling setCurrentScale() on the outermost <svg> element in a standalone SVG document
+        // is allowed to change the page zoom factor, influencing the document size, scrollbars etc.
+        if (parentNode() == document())
+            frame->setZoomFactor(scale, ZoomPage);
+        return;
+    }
+
+    m_scale = scale;
+    if (renderer())
+        renderer()->setNeedsLayout(true);
 }
 
 FloatPoint SVGSVGElement::currentTranslate() const
@@ -310,6 +312,37 @@ void SVGSVGElement::svgAttributeChanged(const QualifiedName& attrName)
         renderer()->setNeedsLayout(true);
 }
 
+void SVGSVGElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeX();
+        synchronizeY();
+        synchronizeWidth();
+        synchronizeHeight();
+        synchronizeExternalResourcesRequired();
+        synchronizeViewBox();
+        synchronizePreserveAspectRatio();
+        return;
+    }
+
+    if (attrName == SVGNames::xAttr)
+        synchronizeX();
+    else if (attrName == SVGNames::yAttr)
+        synchronizeY();
+    else if (attrName == SVGNames::widthAttr)
+        synchronizeWidth();
+    else if (attrName == SVGNames::heightAttr)
+        synchronizeHeight();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+    else if (SVGFitToViewBox::isKnownAttribute(attrName)) {
+        synchronizeViewBox();
+        synchronizePreserveAspectRatio();
+    }
+}
+
 unsigned SVGSVGElement::suspendRedraw(unsigned /* maxWaitMilliseconds */)
 {
     // FIXME: Implement me (see bug 11275)
@@ -361,7 +394,8 @@ bool SVGSVGElement::checkEnclosure(SVGElement*, const FloatRect& rect)
 
 void SVGSVGElement::deselectAll()
 {
-    document()->frame()->selection()->clear();
+    if (Frame* frame = document()->frame())
+        frame->selection()->clear();
 }
 
 float SVGSVGElement::createSVGNumber()
@@ -374,9 +408,9 @@ SVGLength SVGSVGElement::createSVGLength()
     return SVGLength();
 }
 
-PassRefPtr<SVGAngle> SVGSVGElement::createSVGAngle()
+SVGAngle SVGSVGElement::createSVGAngle()
 {
-    return SVGAngle::create();
+    return SVGAngle();
 }
 
 FloatPoint SVGSVGElement::createSVGPoint()
@@ -384,9 +418,9 @@ FloatPoint SVGSVGElement::createSVGPoint()
     return FloatPoint();
 }
 
-TransformationMatrix SVGSVGElement::createSVGMatrix()
+AffineTransform SVGSVGElement::createSVGMatrix()
 {
-    return TransformationMatrix();
+    return AffineTransform();
 }
 
 FloatRect SVGSVGElement::createSVGRect()
@@ -399,26 +433,26 @@ SVGTransform SVGSVGElement::createSVGTransform()
     return SVGTransform();
 }
 
-SVGTransform SVGSVGElement::createSVGTransformFromMatrix(const TransformationMatrix& matrix)
+SVGTransform SVGSVGElement::createSVGTransformFromMatrix(const AffineTransform& matrix)
 {
     return SVGTransform(matrix);
 }
 
-TransformationMatrix SVGSVGElement::getCTM() const
+AffineTransform SVGSVGElement::getCTM() const
 {
-    TransformationMatrix mat;
+    AffineTransform mat;
     if (!isOutermostSVG())
         mat.translate(x().value(this), y().value(this));
 
     if (attributes()->getAttributeItem(SVGNames::viewBoxAttr)) {
-        TransformationMatrix viewBox = viewBoxToViewTransform(width().value(this), height().value(this));
+        AffineTransform viewBox = viewBoxToViewTransform(width().value(this), height().value(this));
         mat = viewBox * mat;
     }
 
     return mat;
 }
 
-TransformationMatrix SVGSVGElement::getScreenCTM() const
+AffineTransform SVGSVGElement::getScreenCTM() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
     FloatPoint rootLocation;
@@ -434,11 +468,11 @@ TransformationMatrix SVGSVGElement::getScreenCTM() const
             rootLocation.move(x().value(this), y().value(this));
     }
     
-    TransformationMatrix mat = SVGStyledLocatableElement::getScreenCTM();
+    AffineTransform mat = SVGStyledLocatableElement::getScreenCTM();
     mat.translate(rootLocation.x(), rootLocation.y());
 
     if (attributes()->getAttributeItem(SVGNames::viewBoxAttr)) {
-        TransformationMatrix viewBox = viewBoxToViewTransform(width().value(this), height().value(this));
+        AffineTransform viewBox = viewBoxToViewTransform(width().value(this), height().value(this));
         mat = viewBox * mat;
     }
 
@@ -508,7 +542,7 @@ bool SVGSVGElement::isOutermostSVG() const
     return !parentNode()->isSVGElement();
 }
 
-TransformationMatrix SVGSVGElement::viewBoxToViewTransform(float viewWidth, float viewHeight) const
+AffineTransform SVGSVGElement::viewBoxToViewTransform(float viewWidth, float viewHeight) const
 {
     FloatRect viewBoxRect;
     if (useCurrentView()) {
@@ -517,7 +551,7 @@ TransformationMatrix SVGSVGElement::viewBoxToViewTransform(float viewWidth, floa
     } else
         viewBoxRect = viewBox();
 
-    TransformationMatrix ctm = SVGFitToViewBox::viewBoxToViewTransform(viewBoxRect, preserveAspectRatio(), viewWidth, viewHeight);
+    AffineTransform ctm = SVGFitToViewBox::viewBoxToViewTransform(viewBoxRect, preserveAspectRatio(), viewWidth, viewHeight);
     if (useCurrentView() && currentView())
         return currentView()->transform()->concatenate().matrix() * ctm;
 
@@ -531,13 +565,14 @@ void SVGSVGElement::inheritViewAttributes(SVGViewElement* viewElement)
         currentView()->setViewBox(viewElement->viewBox());
     else
         currentView()->setViewBox(viewBox());
-    if (viewElement->hasAttribute(SVGNames::preserveAspectRatioAttr)) {
-        currentView()->preserveAspectRatio()->setAlign(viewElement->preserveAspectRatio()->align());
-        currentView()->preserveAspectRatio()->setMeetOrSlice(viewElement->preserveAspectRatio()->meetOrSlice());
-    } else {
-        currentView()->preserveAspectRatio()->setAlign(preserveAspectRatio()->align());
-        currentView()->preserveAspectRatio()->setMeetOrSlice(preserveAspectRatio()->meetOrSlice());
-    }
+
+    SVGPreserveAspectRatio aspectRatio;
+    if (viewElement->hasAttribute(SVGNames::preserveAspectRatioAttr))
+        aspectRatio = viewElement->preserveAspectRatioBaseValue();
+    else
+        aspectRatio = preserveAspectRatioBaseValue();
+    currentView()->setPreserveAspectRatioBaseValue(aspectRatio);
+
     if (viewElement->hasAttribute(SVGNames::zoomAndPanAttr))
         currentView()->setZoomAndPan(viewElement->zoomAndPan());
     renderer()->setNeedsLayout(true);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h
index f30e8f6832..dde6534f34 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h
@@ -105,18 +105,18 @@ namespace WebCore {
 
         static float createSVGNumber();
         static SVGLength createSVGLength();
-        static PassRefPtr<SVGAngle> createSVGAngle();
+        static SVGAngle createSVGAngle();
         static FloatPoint createSVGPoint();
-        static TransformationMatrix createSVGMatrix();
+        static AffineTransform createSVGMatrix();
         static FloatRect createSVGRect();
         static SVGTransform createSVGTransform();
-        static SVGTransform createSVGTransformFromMatrix(const TransformationMatrix&);
+        static SVGTransform createSVGTransformFromMatrix(const AffineTransform&);
 
         virtual void parseMappedAttribute(MappedAttribute*);
 
         // 'virtual SVGLocatable' functions
-        virtual TransformationMatrix getCTM() const;
-        virtual TransformationMatrix getScreenCTM() const;
+        virtual AffineTransform getCTM() const;
+        virtual AffineTransform getScreenCTM() const;
 
         virtual bool rendererIsNeeded(RenderStyle* style) { return StyledElement::rendererIsNeeded(style); }
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
@@ -125,33 +125,27 @@ namespace WebCore {
         virtual void removedFromDocument();
 
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
-        TransformationMatrix viewBoxToViewTransform(float viewWidth, float viewHeight) const;
+        AffineTransform viewBoxToViewTransform(float viewWidth, float viewHeight) const;
 
         void inheritViewAttributes(SVGViewElement*);
 
-    protected:
-        friend class RenderSVGRoot;
-        friend class RenderSVGViewportContainer;
-
-        virtual bool hasRelativeValues() const;
-        
         bool isOutermostSVG() const;
+        virtual bool hasRelativeValues() const;
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGNames::svgTagString, SVGNames::xAttrString, SVGLength, X, x)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGNames::svgTagString, SVGNames::yAttrString, SVGLength, Y, y)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGNames::svgTagString, SVGNames::widthAttrString, SVGLength, Width, width)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGNames::svgTagString, SVGNames::heightAttrString, SVGLength, Height, height)
+        DECLARE_ANIMATED_PROPERTY(SVGSVGElement, SVGNames::xAttr, SVGLength, X, x)
+        DECLARE_ANIMATED_PROPERTY(SVGSVGElement, SVGNames::yAttr, SVGLength, Y, y)
+        DECLARE_ANIMATED_PROPERTY(SVGSVGElement, SVGNames::widthAttr, SVGLength, Width, width)
+        DECLARE_ANIMATED_PROPERTY(SVGSVGElement, SVGNames::heightAttr, SVGLength, Height, height)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGSVGElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
 
         // SVGFitToViewBox
-        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+        DECLARE_ANIMATED_PROPERTY(SVGSVGElement, SVGNames::viewBoxAttr, FloatRect, ViewBox, viewBox)
+        DECLARE_ANIMATED_PROPERTY(SVGSVGElement, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
  
         virtual void documentWillBecomeInactive();
         virtual void documentDidBecomeActive();
@@ -159,6 +153,7 @@ namespace WebCore {
         bool m_useCurrentView;
         RefPtr<SMILTimeContainer> m_timeContainer;
         FloatPoint m_translation;
+        float m_scale;
         mutable OwnPtr<SVGViewSpec> m_viewSpec;
         IntSize m_containerSize;
         bool m_hasSetContainerSize;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.idl
index b188894fab..46a17b024c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp
index c2f4a6eae9..a6d0f47202 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -37,8 +35,6 @@ SVGScriptElement::SVGScriptElement(const QualifiedName& tagName, Document* doc,
     : SVGElement(tagName, doc)
     , SVGURIReference()
     , SVGExternalResourcesRequired()
-    , m_href(this, XLinkNames::hrefAttr) 
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
     , m_data(this, this)
 {
     m_data.setCreatedByParser(createdByParser);
@@ -88,6 +84,22 @@ void SVGScriptElement::svgAttributeChanged(const QualifiedName& attrName)
     }
 }
 
+void SVGScriptElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeExternalResourcesRequired();
+        synchronizeHref();
+        return;
+    }
+
+    if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+    else if (SVGURIReference::isKnownAttribute(attrName))
+        synchronizeHref();
+}
+
 void SVGScriptElement::insertedIntoDocument()
 {
     SVGElement::insertedIntoDocument();
@@ -182,6 +194,11 @@ String SVGScriptElement::forAttributeValue() const
     return String();
 }
 
+String SVGScriptElement::eventAttributeValue() const
+{
+    return String();
+}
+
 void SVGScriptElement::dispatchLoadEvent()
 {
     bool externalResourcesRequired = externalResourcesRequiredBaseValue();
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h
index 699c535fe5..623228c061 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h
@@ -45,6 +45,7 @@ namespace WebCore {
         virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool isURLAttribute(Attribute*) const;
         virtual void finishParsingChildren();
 
@@ -65,18 +66,17 @@ namespace WebCore {
         virtual String typeAttributeValue() const;
         virtual String languageAttributeValue() const;
         virtual String forAttributeValue() const;
+        virtual String eventAttributeValue() const;
 
         virtual void dispatchLoadEvent();
         virtual void dispatchErrorEvent();
 
     private:
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGScriptElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+        DECLARE_ANIMATED_PROPERTY(SVGScriptElement, XLinkNames::hrefAttr, String, Href, href)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGScriptElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGScriptElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
 
     private:
         ScriptElementData m_data;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSetElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGSetElement.cpp
index 580058037b..a6e81b367b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSetElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSetElement.h b/src/3rdparty/webkit/WebCore/svg/SVGSetElement.h
index fda6919e14..7d0ecede5c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSetElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSetElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStopElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGStopElement.cpp
index 51582d7f51..3c97827a63 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStopElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStopElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -35,7 +33,7 @@ namespace WebCore {
 
 SVGStopElement::SVGStopElement(const QualifiedName& tagName, Document* doc)
     : SVGStyledElement(tagName, doc)
-    , m_offset(this, SVGNames::offsetAttr, 0.0f)
+    , m_offset(0.0f)
 {
 }
 
@@ -57,6 +55,14 @@ void SVGStopElement::parseMappedAttribute(MappedAttribute* attr)
         SVGStyledElement::parseMappedAttribute(attr);
 }
 
+void SVGStopElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName() || attrName == SVGNames::offsetAttr)
+        synchronizeOffset();
+}
+
 RenderObject* SVGStopElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     return new (arena) RenderSVGGradientStop(this);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStopElement.h b/src/3rdparty/webkit/WebCore/svg/SVGStopElement.h
index 5d14a407f7..23c09bbce6 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStopElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStopElement.h
@@ -32,6 +32,8 @@ namespace WebCore {
         SVGStopElement(const QualifiedName&, Document*);
         virtual ~SVGStopElement();
 
+        virtual void synchronizeProperty(const QualifiedName&);
+
     private:
         virtual bool isGradientStop() const { return true; }
 
@@ -39,7 +41,7 @@ namespace WebCore {
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-        ANIMATED_PROPERTY_DECLARATIONS(SVGStopElement, SVGNames::stopTagString, SVGNames::offsetAttrString, float, Offset, offset)
+        DECLARE_ANIMATED_PROPERTY(SVGStopElement, SVGNames::offsetAttr, float, Offset, offset)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStringList.cpp b/src/3rdparty/webkit/WebCore/svg/SVGStringList.cpp
index 9a23a4a5f2..70bfad8ed4 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStringList.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStringList.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStringList.h b/src/3rdparty/webkit/WebCore/svg/SVGStringList.h
index 1cbe9d290c..2fca6bc71a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStringList.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStringList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStylable.cpp b/src/3rdparty/webkit/WebCore/svg/SVGStylable.cpp
index 5d063c3374..c72843ac54 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStylable.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStylable.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStylable.h b/src/3rdparty/webkit/WebCore/svg/SVGStylable.h
index ade5c2f27b..7e13d35b46 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStylable.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStylable.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStylable.idl b/src/3rdparty/webkit/WebCore/svg/SVGStylable.idl
index 731d8182ae..2da2b7727d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStylable.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStylable.idl
@@ -27,7 +27,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, ObjCProtocol] SVGStylable {
+    interface [Conditional=SVG, ObjCProtocol, OmitConstructor] SVGStylable {
         readonly attribute SVGAnimatedString className;
         readonly attribute css::CSSStyleDeclaration style;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.cpp
index 31f5920303..2a21670b28 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.cpp
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Apple Computer, Inc.
     Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -48,40 +46,40 @@ SVGStyleElement::SVGStyleElement(const QualifiedName& tagName, Document* doc, bo
 const AtomicString& SVGStyleElement::type() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, defaultValue, ("text/css"));
-    const AtomicString& n = getAttribute(typeAttr);
+    const AtomicString& n = getAttribute(SVGNames::typeAttr);
     return n.isNull() ? defaultValue : n;
 }
 
 void SVGStyleElement::setType(const AtomicString& type, ExceptionCode& ec)
 {
-    setAttribute(typeAttr, type, ec);
+    setAttribute(SVGNames::typeAttr, type, ec);
 }
 
 const AtomicString& SVGStyleElement::media() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, defaultValue, ("all"));
-    const AtomicString& n = getAttribute(mediaAttr);
+    const AtomicString& n = getAttribute(SVGNames::mediaAttr);
     return n.isNull() ? defaultValue : n;
 }
 
 void SVGStyleElement::setMedia(const AtomicString& media, ExceptionCode& ec)
 {
-    setAttribute(mediaAttr, media, ec);
+    setAttribute(SVGNames::mediaAttr, media, ec);
 }
 
 String SVGStyleElement::title() const
 {
-    return getAttribute(titleAttr);
+    return getAttribute(SVGNames::titleAttr);
 }
 
 void SVGStyleElement::setTitle(const AtomicString& title, ExceptionCode& ec)
 {
-    setAttribute(titleAttr, title, ec);
+    setAttribute(SVGNames::titleAttr, title, ec);
 }
 
 void SVGStyleElement::parseMappedAttribute(MappedAttribute* attr)
 {
-    if (attr->name() == titleAttr && m_sheet)
+    if (attr->name() == SVGNames::titleAttr && m_sheet)
         m_sheet->setTitle(attr->value());
     else {
         if (SVGLangSpace::parseMappedAttribute(attr))
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.h b/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.h
index 3853fb3961..de37f5ddad 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.cpp
index 6960519a5c..e0dbabdabc 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.cpp
@@ -32,11 +32,15 @@
 #include "MappedAttribute.h"
 #include "PlatformString.h"
 #include "RenderObject.h"
+#include "RenderSVGResource.h"
+#include "RenderSVGResourceClipper.h"
+#include "RenderSVGResourceMasker.h"
 #include "SVGElement.h"
 #include "SVGElementInstance.h"
+#include "SVGElementRareData.h"
 #include "SVGNames.h"
 #include "SVGRenderStyle.h"
-#include "SVGResource.h"
+#include "SVGResourceFilter.h"
 #include "SVGSVGElement.h"
 #include <wtf/Assertions.h>
 
@@ -44,12 +48,15 @@ namespace WebCore {
 
 using namespace SVGNames;
 
-char SVGStyledElementIdentifier[] = "SVGStyledElement";
-static HashSet<const SVGStyledElement*>* gElementsWithInstanceUpdatesBlocked = 0;
+void mapAttributeToCSSProperty(HashMap<AtomicStringImpl*, int>* propertyNameToIdMap, const QualifiedName& attrName)
+{
+    int propertyId = cssPropertyID(attrName.localName());
+    ASSERT(propertyId > 0);
+    propertyNameToIdMap->set(attrName.localName().impl(), propertyId);
+}
 
 SVGStyledElement::SVGStyledElement(const QualifiedName& tagName, Document* doc)
     : SVGElement(tagName, doc)
-    , m_className(this, HTMLNames::classAttr)
 {
 }
 
@@ -71,13 +78,6 @@ bool SVGStyledElement::rendererIsNeeded(RenderStyle* style)
     return false;
 }
 
-static void mapAttributeToCSSProperty(HashMap<AtomicStringImpl*, int>* propertyNameToIdMap, const QualifiedName& attrName)
-{
-    int propertyId = cssPropertyID(attrName.localName());
-    ASSERT(propertyId > 0);
-    propertyNameToIdMap->set(attrName.localName().impl(), propertyId);
-}
-
 int SVGStyledElement::cssPropertyIdForSVGAttributeName(const QualifiedName& attrName)
 {
     if (!attrName.namespaceURI().isNull())
@@ -92,13 +92,13 @@ int SVGStyledElement::cssPropertyIdForSVGAttributeName(const QualifiedName& attr
         mapAttributeToCSSProperty(propertyNameToIdMap, clipAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, clip_pathAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, clip_ruleAttr);
-        mapAttributeToCSSProperty(propertyNameToIdMap, colorAttr);
+        mapAttributeToCSSProperty(propertyNameToIdMap, SVGNames::colorAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, color_interpolationAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, color_interpolation_filtersAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, color_profileAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, color_renderingAttr); 
         mapAttributeToCSSProperty(propertyNameToIdMap, cursorAttr);
-        mapAttributeToCSSProperty(propertyNameToIdMap, directionAttr);
+        mapAttributeToCSSProperty(propertyNameToIdMap, SVGNames::directionAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, displayAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, dominant_baselineAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, enable_backgroundAttr);
@@ -176,7 +176,7 @@ void SVGStyledElement::parseMappedAttribute(MappedAttribute* attr)
     // style updates (instead of StyledElement::parseMappedAttribute). We don't
     // tell StyledElement about the change to avoid parsing the class list twice
     if (attrName.matches(HTMLNames::classAttr))
-        setClassName(attr->value());
+        setClassNameBaseValue(attr->value());
     else
         // id is handled by StyledElement which SVGElement inherits from
         SVGElement::parseMappedAttribute(attr);
@@ -189,7 +189,7 @@ bool SVGStyledElement::isKnownAttribute(const QualifiedName& attrName)
     if (propId > 0)
         return true;
 
-    return (attrName == HTMLNames::idAttr || attrName == HTMLNames::styleAttr); 
+    return (attrName == idAttributeName() || attrName == HTMLNames::styleAttr); 
 }
 
 void SVGStyledElement::svgAttributeChanged(const QualifiedName& attrName)
@@ -202,10 +202,46 @@ void SVGStyledElement::svgAttributeChanged(const QualifiedName& attrName)
     // If we're the child of a resource element, be sure to invalidate it.
     invalidateResourcesInAncestorChain();
 
+    // If the element is using resources, invalidate them.
+    invalidateResources();
+
     // Invalidate all SVGElementInstances associated with us
     SVGElementInstance::invalidateAllInstancesOfElement(this);
 }
 
+void SVGStyledElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName() || attrName.matches(HTMLNames::classAttr))
+        synchronizeClassName();
+}
+
+void SVGStyledElement::invalidateResources()
+{
+    RenderObject* object = renderer();
+    if (!object)
+        return;
+
+    const SVGRenderStyle* svgStyle = object->style()->svgStyle();
+    Document* document = this->document();
+
+    if (document->parsing())
+        return;
+
+#if ENABLE(FILTERS)
+    SVGResourceFilter* filter = getFilterById(document, svgStyle->filter(), object);
+    if (filter)
+        filter->invalidate();
+#endif
+
+    if (RenderSVGResourceMasker* masker = getRenderSVGResourceById<RenderSVGResourceMasker>(document, svgStyle->maskElement()))
+        masker->invalidateClient(object);
+
+    if (RenderSVGResourceClipper* clipper = getRenderSVGResourceById<RenderSVGResourceClipper>(document, svgStyle->clipPath()))
+        clipper->invalidateClient(object);
+}
+
 void SVGStyledElement::invalidateResourcesInAncestorChain() const
 {
     Node* node = parentNode();
@@ -214,20 +250,30 @@ void SVGStyledElement::invalidateResourcesInAncestorChain() const
             break;
 
         SVGElement* element = static_cast<SVGElement*>(node);
-        if (SVGStyledElement* styledElement = static_cast<SVGStyledElement*>(element->isStyled() ? element : 0)) {
-            if (SVGResource* resource = styledElement->canvasResource())
-                resource->invalidate();
-        }
+        if (SVGStyledElement* styledElement = static_cast<SVGStyledElement*>(element->isStyled() ? element : 0))
+            styledElement->invalidateCanvasResources();
 
         node = node->parentNode();
     }
 }
 
+void SVGStyledElement::invalidateCanvasResources()
+{
+    RenderObject* object = renderer();
+    if (!object)
+        return;
+
+    if (object->isSVGResource())
+        object->toRenderSVGResource()->invalidateClients();
+
+    // The following lines will be removed soon, once all resources are handled by renderers.
+    if (SVGResource* resource = canvasResource(object))
+        resource->invalidate();
+}
+
 void SVGStyledElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-    if (document()->parsing())
-        return;
 
     // Invalidate all SVGElementInstances associated with us
     SVGElementInstance::invalidateAllInstancesOfElement(this);
@@ -271,19 +317,17 @@ void SVGStyledElement::detach()
     SVGElement::detach();
 }
 
-void SVGStyledElement::setInstanceUpdatesBlocked(bool blockUpdates)
+bool SVGStyledElement::instanceUpdatesBlocked() const
 {
-    if (blockUpdates) {
-        if (!gElementsWithInstanceUpdatesBlocked)
-            gElementsWithInstanceUpdatesBlocked = new HashSet<const SVGStyledElement*>;
-        gElementsWithInstanceUpdatesBlocked->add(this);
-    } else {
-        ASSERT(gElementsWithInstanceUpdatesBlocked);
-        ASSERT(gElementsWithInstanceUpdatesBlocked->contains(this));
-        gElementsWithInstanceUpdatesBlocked->remove(this);
-    }
+    return hasRareSVGData() && rareSVGData()->instanceUpdatesBlocked();
 }
-    
+
+void SVGStyledElement::setInstanceUpdatesBlocked(bool value)
+{
+    if (hasRareSVGData())
+        rareSVGData()->setInstanceUpdatesBlocked(value);
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.h b/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.h
index e21db97398..9645db4391 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -30,15 +28,17 @@
 
 namespace WebCore {
 
-    extern char SVGStyledElementIdentifier[];
     class SVGResource;
 
+    void mapAttributeToCSSProperty(HashMap<AtomicStringImpl*, int>* propertyNameToIdMap, const QualifiedName& attrName);
+
     class SVGStyledElement : public SVGElement,
                              public SVGStylable {
     public:
         SVGStyledElement(const QualifiedName&, Document*);
         virtual ~SVGStyledElement();
-        
+
+        virtual bool hasRelativeValues() const { return false; }
         virtual bool isStyled() const { return true; }
         virtual bool supportsMarkers() const { return false; }
 
@@ -48,30 +48,33 @@ namespace WebCore {
         bool isKnownAttribute(const QualifiedName&);
 
         virtual bool rendererIsNeeded(RenderStyle*);
-        virtual SVGResource* canvasResource() { return 0; }
-        
+        virtual SVGResource* canvasResource(const RenderObject*) { return 0; }
+
         virtual bool mapToEntry(const QualifiedName&, MappedAttributeEntry&) const;
         virtual void parseMappedAttribute(MappedAttribute*);
-
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
         // Centralized place to force a manual style resolution. Hacky but needed for now.
         PassRefPtr<RenderStyle> resolveStyle(RenderStyle* parentStyle);
 
-        void invalidateResourcesInAncestorChain() const;        
+        void invalidateResourcesInAncestorChain() const;
+        void invalidateResources();
+
         virtual void detach();
-                                 
+
+        bool instanceUpdatesBlocked() const;
         void setInstanceUpdatesBlocked(bool);
-        
-    protected:
-        virtual bool hasRelativeValues() const { return true; }
-        
+
+    protected: 
         static int cssPropertyIdForSVGAttributeName(const QualifiedName&);
 
+        void invalidateCanvasResources();
+
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGStyledElement, SVGStyledElementIdentifier, HTMLNames::classAttrString, String, ClassName, className)
+        DECLARE_ANIMATED_PROPERTY(SVGStyledElement, HTMLNames::classAttr, String, ClassName, className)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStyledLocatableElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGStyledLocatableElement.cpp
index 39ecb7dca2..79b1fe3b2e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStyledLocatableElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStyledLocatableElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -25,9 +23,9 @@
 #if ENABLE(SVG)
 #include "SVGStyledLocatableElement.h"
 
+#include "AffineTransform.h"
 #include "RenderPath.h"
 #include "SVGElement.h"
-#include "TransformationMatrix.h"
 #include "SVGSVGElement.h"
 
 namespace WebCore {
@@ -57,12 +55,12 @@ FloatRect SVGStyledLocatableElement::getBBox() const
     return SVGLocatable::getBBox(this);
 }
 
-TransformationMatrix SVGStyledLocatableElement::getCTM() const
+AffineTransform SVGStyledLocatableElement::getCTM() const
 {
     return SVGLocatable::getCTM(this);
 }
 
-TransformationMatrix SVGStyledLocatableElement::getScreenCTM() const
+AffineTransform SVGStyledLocatableElement::getScreenCTM() const
 {
     return SVGLocatable::getScreenCTM(this);
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStyledLocatableElement.h b/src/3rdparty/webkit/WebCore/svg/SVGStyledLocatableElement.h
index 41a034d771..5e835bd609 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStyledLocatableElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStyledLocatableElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -43,8 +41,8 @@ namespace WebCore {
         virtual SVGElement* farthestViewportElement() const;
 
         virtual FloatRect getBBox() const;
-        virtual TransformationMatrix getCTM() const;
-        virtual TransformationMatrix getScreenCTM() const;
+        virtual AffineTransform getCTM() const;
+        virtual AffineTransform getScreenCTM() const;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStyledTransformableElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGStyledTransformableElement.cpp
index b7cf979fa8..a71cd16e8c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStyledTransformableElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStyledTransformableElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -25,22 +23,20 @@
 #if ENABLE(SVG)
 #include "SVGStyledTransformableElement.h"
 
+#include "AffineTransform.h"
 #include "Attr.h"
 #include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "SVGDocument.h"
 #include "SVGStyledElement.h"
 #include "SVGTransformList.h"
-#include "TransformationMatrix.h"
 
 namespace WebCore {
 
-char SVGStyledTransformableElementIdentifier[] = "SVGStyledTransformableElement";
-
 SVGStyledTransformableElement::SVGStyledTransformableElement(const QualifiedName& tagName, Document* doc)
     : SVGStyledLocatableElement(tagName, doc)
     , SVGTransformable()
-    , m_transform(this, SVGNames::transformAttr, SVGTransformList::create(SVGNames::transformAttr))
+    , m_transform(SVGTransformList::create(SVGNames::transformAttr))
 {
 }
 
@@ -48,44 +44,48 @@ SVGStyledTransformableElement::~SVGStyledTransformableElement()
 {
 }
 
-TransformationMatrix SVGStyledTransformableElement::getCTM() const
+AffineTransform SVGStyledTransformableElement::getCTM() const
 {
     return SVGTransformable::getCTM(this);
 }
 
-TransformationMatrix SVGStyledTransformableElement::getScreenCTM() const
+AffineTransform SVGStyledTransformableElement::getScreenCTM() const
 {
     return SVGTransformable::getScreenCTM(this);
 }
 
-TransformationMatrix SVGStyledTransformableElement::animatedLocalTransform() const
+AffineTransform SVGStyledTransformableElement::animatedLocalTransform() const
 {
     return m_supplementalTransform ? transform()->concatenate().matrix() * *m_supplementalTransform : transform()->concatenate().matrix();
 }
     
-TransformationMatrix* SVGStyledTransformableElement::supplementalTransform()
+AffineTransform* SVGStyledTransformableElement::supplementalTransform()
 {
     if (!m_supplementalTransform)
-        m_supplementalTransform.set(new TransformationMatrix());
+        m_supplementalTransform.set(new AffineTransform());
     return m_supplementalTransform.get();
 }
 
 void SVGStyledTransformableElement::parseMappedAttribute(MappedAttribute* attr)
 {
-    if (attr->name() == SVGNames::transformAttr) {
+    if (SVGTransformable::isKnownAttribute(attr->name())) {
         SVGTransformList* localTransforms = transformBaseValue();
-
-        ExceptionCode ec = 0;
-        localTransforms->clear(ec);
- 
-        if (!SVGTransformable::parseTransformAttribute(localTransforms, attr->value()))
+        if (!SVGTransformable::parseTransformAttribute(localTransforms, attr->value())) {
+            ExceptionCode ec = 0;
             localTransforms->clear(ec);
-        else
-            setTransformBaseValue(localTransforms);
-    } else
+        }
+    } else 
         SVGStyledLocatableElement::parseMappedAttribute(attr);
 }
 
+void SVGStyledTransformableElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledLocatableElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName() || SVGTransformable::isKnownAttribute(attrName))
+        synchronizeTransform();
+}
+
 bool SVGStyledTransformableElement::isKnownAttribute(const QualifiedName& attrName)
 {
     return SVGTransformable::isKnownAttribute(attrName) ||
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStyledTransformableElement.h b/src/3rdparty/webkit/WebCore/svg/SVGStyledTransformableElement.h
index cf5713e45f..ee204adb72 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStyledTransformableElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStyledTransformableElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -30,44 +28,42 @@
 
 namespace WebCore {
 
-    extern char SVGStyledTransformableElementIdentifier[];
-
-    class TransformationMatrix;
-
-    class SVGStyledTransformableElement : public SVGStyledLocatableElement,
-                                          public SVGTransformable {
-    public:
-        SVGStyledTransformableElement(const QualifiedName&, Document*);
-        virtual ~SVGStyledTransformableElement();
-        
-        virtual bool isStyledTransformable() const { return true; }
-
-        virtual TransformationMatrix getCTM() const;
-        virtual TransformationMatrix getScreenCTM() const;
-        virtual SVGElement* nearestViewportElement() const;
-        virtual SVGElement* farthestViewportElement() const;
-        
-        virtual TransformationMatrix animatedLocalTransform() const;
-        virtual TransformationMatrix* supplementalTransform();
-
-        virtual FloatRect getBBox() const;
-
-        virtual void parseMappedAttribute(MappedAttribute*);
-        bool isKnownAttribute(const QualifiedName&);
-
-        // "base class" methods for all the elements which render as paths
-        virtual Path toPathData() const { return Path(); }
-        virtual Path toClipPath() const;
-        virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-
-    protected:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGStyledTransformableElement, SVGStyledTransformableElementIdentifier,
-                                       SVGNames::transformAttrString, SVGTransformList, Transform, transform)
-
-    private:
-        // Used by <animateMotion>
-        OwnPtr<TransformationMatrix> m_supplementalTransform;
-    };
+class AffineTransform;
+
+class SVGStyledTransformableElement : public SVGStyledLocatableElement,
+                                      public SVGTransformable {
+public:
+    SVGStyledTransformableElement(const QualifiedName&, Document*);
+    virtual ~SVGStyledTransformableElement();
+    
+    virtual bool isStyledTransformable() const { return true; }
+
+    virtual AffineTransform getCTM() const;
+    virtual AffineTransform getScreenCTM() const;
+    virtual SVGElement* nearestViewportElement() const;
+    virtual SVGElement* farthestViewportElement() const;
+    
+    virtual AffineTransform animatedLocalTransform() const;
+    virtual AffineTransform* supplementalTransform();
+
+    virtual FloatRect getBBox() const;
+
+    virtual void parseMappedAttribute(MappedAttribute*);
+    virtual void synchronizeProperty(const QualifiedName&);
+    bool isKnownAttribute(const QualifiedName&);
+
+    // "base class" methods for all the elements which render as paths
+    virtual Path toPathData() const { return Path(); }
+    virtual Path toClipPath() const;
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+
+protected:
+    DECLARE_ANIMATED_PROPERTY(SVGStyledTransformableElement, SVGNames::transformAttr, SVGTransformList*, Transform, transform)
+
+private:
+    // Used by <animateMotion>
+    OwnPtr<AffineTransform> m_supplementalTransform;
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.cpp
index a07b2a7ff3..3268b9a0d0 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.cpp
@@ -1,9 +1,7 @@
 /*
-    Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
+    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -34,7 +32,6 @@ SVGSwitchElement::SVGSwitchElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -60,8 +57,14 @@ RenderObject* SVGSwitchElement::createRenderer(RenderArena* arena, RenderStyle*)
     return new (arena) RenderSVGTransformableContainer(this);
 }
 
+void SVGSwitchElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledTransformableElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName() || SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+}
+
 }
 
-// vim:ts=4:noet
 #endif // ENABLE(SVG)
-
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.h b/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.h
index f5e9a0d19d..4d6491a10d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.h
@@ -41,12 +41,11 @@ namespace WebCore {
         virtual bool childShouldCreateRenderer(Node*) const;
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+        virtual void synchronizeProperty(const QualifiedName&);
 
     private:
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGSwitchElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGSwitchElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.cpp
index 4155b0c2d1..c7edae119e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.cpp
@@ -1,9 +1,7 @@
 /*
-    Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
+    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -34,9 +32,6 @@ SVGSymbolElement::SVGSymbolElement(const QualifiedName& tagName, Document* doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , SVGFitToViewBox()
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
-    , m_viewBox(this, SVGNames::viewBoxAttr)
-    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
 }
 
@@ -56,8 +51,31 @@ void SVGSymbolElement::parseMappedAttribute(MappedAttribute* attr)
     SVGStyledElement::parseMappedAttribute(attr);
 }
 
+void SVGSymbolElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizePreserveAspectRatio();
+        synchronizeViewBox();
+        synchronizeExternalResourcesRequired();
+        synchronizeViewBox();
+        synchronizePreserveAspectRatio();
+        return;
+    }
+
+    if (attrName == SVGNames::preserveAspectRatioAttr)
+        synchronizePreserveAspectRatio();
+    else if (attrName == SVGNames::viewBoxAttr)
+        synchronizeViewBox();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+    else if (SVGFitToViewBox::isKnownAttribute(attrName)) {
+        synchronizeViewBox();
+        synchronizePreserveAspectRatio();
+    } 
+}
+
 }
 
-// vim:ts=4:noet
 #endif // ENABLE(SVG)
-
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.h b/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.h
index 5c682027e2..907bf0fedb 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.h
@@ -38,19 +38,16 @@ namespace WebCore {
         virtual ~SVGSymbolElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual bool shouldAttachChild(Element*) const { return false; }
-    
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
     private:
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGSymbolElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGSymbolElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
  
         // SVGFitToViewBox
-        ANIMATED_PROPERTY_DECLARATIONS(SVGSymbolElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGSymbolElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio) 
+        DECLARE_ANIMATED_PROPERTY(SVGSymbolElement, SVGNames::viewBoxAttr, FloatRect, ViewBox, viewBox)
+        DECLARE_ANIMATED_PROPERTY(SVGSymbolElement, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio) 
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.cpp
index 5b8640a7c8..06ae896a87 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.cpp
@@ -1,9 +1,7 @@
 /*
-    Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
+    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -21,6 +19,7 @@
 */
 
 #include "config.h"
+
 #if ENABLE(SVG)
 #include "SVGTRefElement.h"
 
@@ -35,7 +34,6 @@ namespace WebCore {
 SVGTRefElement::SVGTRefElement(const QualifiedName& tagName, Document* doc)
     : SVGTextPositioningElement(tagName, doc)
     , SVGURIReference()
-    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
@@ -63,6 +61,25 @@ void SVGTRefElement::parseMappedAttribute(MappedAttribute* attr)
     SVGTextPositioningElement::parseMappedAttribute(attr);
 }
 
+void SVGTRefElement::svgAttributeChanged(const QualifiedName& attrName)
+{
+    SVGTextPositioningElement::svgAttributeChanged(attrName);
+
+    if (!renderer())
+        return;
+
+    if (SVGURIReference::isKnownAttribute(attrName))
+        renderer()->setNeedsLayout(true);
+}
+
+void SVGTRefElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGTextPositioningElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName() || SVGURIReference::isKnownAttribute(attrName))
+        synchronizeHref();
+}
+
 bool SVGTRefElement::childShouldCreateRenderer(Node* child) const
 {
     if (child->isTextNode() || child->hasTagName(SVGNames::tspanTag) ||
@@ -78,6 +95,4 @@ RenderObject* SVGTRefElement::createRenderer(RenderArena* arena, RenderStyle*)
 
 }
 
-// vim:ts=4:noet
 #endif // ENABLE(SVG)
-
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.h b/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.h
index 71d40a0514..ff6eac0b0d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.h
@@ -34,6 +34,8 @@ namespace WebCore {
         virtual ~SVGTRefElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
         bool childShouldCreateRenderer(Node*) const;
@@ -42,7 +44,7 @@ namespace WebCore {
         void updateReferencedText();
 
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGTRefElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+        DECLARE_ANIMATED_PROPERTY(SVGTRefElement, XLinkNames::hrefAttr, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTSpanElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTSpanElement.cpp
index eadae1e8e2..12bf377514 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTSpanElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTSpanElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTSpanElement.h b/src/3rdparty/webkit/WebCore/svg/SVGTSpanElement.h
index 7a29e966a5..17445d3918 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTSpanElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTSpanElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTests.h b/src/3rdparty/webkit/WebCore/svg/SVGTests.h
index 2d82cb42e5..a2abddf6fa 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTests.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTests.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTests.idl b/src/3rdparty/webkit/WebCore/svg/SVGTests.idl
index fe20a04f6a..8a5f7c2b60 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTests.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTests.idl
@@ -26,7 +26,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, ObjCProtocol] SVGTests {
+    interface [Conditional=SVG, ObjCProtocol, OmitConstructor] SVGTests {
         readonly attribute SVGStringList requiredFeatures;
         readonly attribute SVGStringList requiredExtensions;
         readonly attribute SVGStringList systemLanguage;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp
index 933430413e..b28536bf25 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp
@@ -43,16 +43,13 @@
 
 namespace WebCore {
 
-char SVGTextContentElementIdentifier[] = "SVGTextContentElement";
-
 SVGTextContentElement::SVGTextContentElement(const QualifiedName& tagName, Document* doc)
     : SVGStyledElement(tagName, doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
-    , m_textLength(this, SVGNames::textLengthAttr, LengthModeOther)
-    , m_lengthAdjust(this, SVGNames::lengthAdjustAttr, LENGTHADJUST_SPACING)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_textLength(LengthModeOther)
+    , m_lengthAdjust(LENGTHADJUST_SPACING)
 {
 }
 
@@ -127,7 +124,7 @@ struct SVGInlineTextBoxQueryWalker {
     {
     }
 
-    void chunkPortionCallback(SVGInlineTextBox* textBox, int startOffset, const TransformationMatrix&,
+    void chunkPortionCallback(SVGInlineTextBox* textBox, int startOffset, const AffineTransform&,
                               const Vector<SVGChar>::iterator& start, const Vector<SVGChar>::iterator& end)
     {
         RenderStyle* style = textBox->textRenderer()->style();
@@ -517,6 +514,25 @@ void SVGTextContentElement::parseMappedAttribute(MappedAttribute* attr)
     }
 }
 
+void SVGTextContentElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeLengthAdjust();
+        synchronizeTextLength();
+        synchronizeExternalResourcesRequired();
+        return;
+    }
+
+    if (attrName == SVGNames::lengthAdjustAttr)
+        synchronizeLengthAdjust();
+    else if (attrName == SVGNames::textLengthAttr)
+        synchronizeTextLength();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+}
+
 bool SVGTextContentElement::isKnownAttribute(const QualifiedName& attrName)
 {
     return (attrName.matches(SVGNames::lengthAdjustAttr) ||
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h
index 9b2c938292..7dff3d5bd0 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h
@@ -29,8 +29,6 @@
 
 namespace WebCore {
 
-    extern char SVGTextContentElementIdentifier[];
-
     class SVGLength;
 
     class SVGTextContentElement : public SVGStyledElement,
@@ -61,17 +59,16 @@ namespace WebCore {
         void selectSubString(unsigned charnum, unsigned nchars, ExceptionCode&) const;
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         bool isKnownAttribute(const QualifiedName&);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGTextContentElement, SVGTextContentElementIdentifier, SVGNames::textLengthAttrString, SVGLength, TextLength, textLength)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGTextContentElement, SVGTextContentElementIdentifier, SVGNames::lengthAdjustAttrString, int, LengthAdjust, lengthAdjust)
+        DECLARE_ANIMATED_PROPERTY(SVGTextContentElement, SVGNames::textLengthAttr, SVGLength, TextLength, textLength)
+        DECLARE_ANIMATED_PROPERTY(SVGTextContentElement, SVGNames::lengthAdjustAttr, int, LengthAdjust, lengthAdjust)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGTextContentElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired) 
+        DECLARE_ANIMATED_PROPERTY(SVGTextContentElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired) 
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.idl
index 394b39876b..9cf1748c9a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, GenerateConstructor] SVGTextContentElement : SVGElement,
+    interface [Conditional=SVG] SVGTextContentElement : SVGElement,
                                                         SVGTests,
                                                         SVGLangSpace,
                                                         SVGExternalResourcesRequired,
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTextElement.cpp
index b8c7331796..96fd11a858 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -25,6 +23,7 @@
 #if ENABLE(SVG)
 #include "SVGTextElement.h"
 
+#include "AffineTransform.h"
 #include "FloatRect.h"
 #include "MappedAttribute.h"
 #include "RenderSVGText.h"
@@ -32,14 +31,13 @@
 #include "SVGRenderStyle.h"
 #include "SVGTSpanElement.h"
 #include "SVGTransformList.h"
-#include "TransformationMatrix.h"
 
 namespace WebCore {
 
 SVGTextElement::SVGTextElement(const QualifiedName& tagName, Document* doc)
     : SVGTextPositioningElement(tagName, doc)
     , SVGTransformable()
-    , m_transform(this, SVGNames::transformAttr, SVGTransformList::create(SVGNames::transformAttr))
+    , m_transform(SVGTransformList::create(SVGNames::transformAttr))
 {
 }
 
@@ -49,18 +47,11 @@ SVGTextElement::~SVGTextElement()
 
 void SVGTextElement::parseMappedAttribute(MappedAttribute* attr)
 {
-    if (attr->name() == SVGNames::transformAttr) {
+    if (SVGTransformable::isKnownAttribute(attr->name())) {
         SVGTransformList* localTransforms = transformBaseValue();
-
-        ExceptionCode ec = 0;
-        localTransforms->clear(ec);
-
-        if (!SVGTransformable::parseTransformAttribute(localTransforms, attr->value()))
+        if (!SVGTransformable::parseTransformAttribute(localTransforms, attr->value())) {
+            ExceptionCode ec = 0;
             localTransforms->clear(ec);
-        else {
-            setTransformBaseValue(localTransforms);
-            if (renderer())
-                renderer()->setNeedsLayout(true); // should be in setTransformBaseValue
         }
     } else
         SVGTextPositioningElement::parseMappedAttribute(attr);
@@ -81,25 +72,25 @@ FloatRect SVGTextElement::getBBox() const
     return SVGTransformable::getBBox(this);
 }
 
-TransformationMatrix SVGTextElement::getScreenCTM() const
+AffineTransform SVGTextElement::getScreenCTM() const
 {
     return SVGTransformable::getScreenCTM(this);
 }
 
-TransformationMatrix SVGTextElement::getCTM() const
+AffineTransform SVGTextElement::getCTM() const
 {
     return SVGTransformable::getCTM(this);
 }
 
-TransformationMatrix SVGTextElement::animatedLocalTransform() const
+AffineTransform SVGTextElement::animatedLocalTransform() const
 {
     return m_supplementalTransform ? transform()->concatenate().matrix() * *m_supplementalTransform : transform()->concatenate().matrix();
 }
 
-TransformationMatrix* SVGTextElement::supplementalTransform()
+AffineTransform* SVGTextElement::supplementalTransform()
 {
     if (!m_supplementalTransform)
-        m_supplementalTransform.set(new TransformationMatrix());
+        m_supplementalTransform.set(new AffineTransform());
     return m_supplementalTransform.get();
 }
 
@@ -126,10 +117,28 @@ void SVGTextElement::svgAttributeChanged(const QualifiedName& attrName)
     if (!renderer())
         return;
 
-    if (SVGTextPositioningElement::isKnownAttribute(attrName))
+    if (SVGTransformable::isKnownAttribute(attrName))
         renderer()->setNeedsLayout(true);
 }
 
+void SVGTextElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGTextPositioningElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName() || SVGTransformable::isKnownAttribute(attrName))
+        synchronizeTransform();
+}
+
+void SVGTextElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+{
+    SVGTextPositioningElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+
+    if (!renderer())
+        return;
+
+    renderer()->setNeedsLayout(true);
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextElement.h b/src/3rdparty/webkit/WebCore/svg/SVGTextElement.h
index a5cb3829a7..4fca6bf601 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -41,21 +39,23 @@ namespace WebCore {
         virtual SVGElement* farthestViewportElement() const;
 
         virtual FloatRect getBBox() const;
-        virtual TransformationMatrix getCTM() const;
-        virtual TransformationMatrix getScreenCTM() const;
-        virtual TransformationMatrix animatedLocalTransform() const;
-        virtual TransformationMatrix* supplementalTransform();
+        virtual AffineTransform getCTM() const;
+        virtual AffineTransform getScreenCTM() const;
+        virtual AffineTransform animatedLocalTransform() const;
+        virtual AffineTransform* supplementalTransform();
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
         virtual bool childShouldCreateRenderer(Node*) const;
                 
         virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
+        virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGTextElement, SVGNames::textTagString, SVGNames::transformAttrString, SVGTransformList, Transform, transform)
+        DECLARE_ANIMATED_PROPERTY(SVGTextElement, SVGNames::transformAttr, SVGTransformList*, Transform, transform)
        
        // Used by <animateMotion>
-       OwnPtr<TransformationMatrix> m_supplementalTransform;
+       OwnPtr<AffineTransform> m_supplementalTransform;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp
index ebbb628515..a428a44985 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -24,6 +22,7 @@
 #if ENABLE(SVG)
 #include "SVGTextPathElement.h"
 
+#include "AffineTransform.h"
 #include "FloatRect.h"
 #include "MappedAttribute.h"
 #include "RenderSVGTextPath.h"
@@ -31,17 +30,15 @@
 #include "SVGPathElement.h"
 #include "SVGRenderStyle.h"
 #include "SVGTransformList.h"
-#include "TransformationMatrix.h"
 
 namespace WebCore {
 
 SVGTextPathElement::SVGTextPathElement(const QualifiedName& tagName, Document* doc)
     : SVGTextContentElement(tagName, doc)
     , SVGURIReference()
-    , m_startOffset(this, SVGNames::startOffsetAttr, LengthModeOther)
-    , m_method(this, SVGNames::methodAttr, SVG_TEXTPATH_METHODTYPE_ALIGN)
-    , m_spacing(this, SVGNames::spacingAttr, SVG_TEXTPATH_SPACINGTYPE_EXACT)
-    , m_href(this, XLinkNames::hrefAttr)
+    , m_startOffset(LengthModeOther)
+    , m_method(SVG_TEXTPATH_METHODTYPE_ALIGN)
+    , m_spacing(SVG_TEXTPATH_SPACINGTYPE_EXACT)
 {
 }
 
@@ -72,6 +69,28 @@ void SVGTextPathElement::parseMappedAttribute(MappedAttribute* attr)
     }
 }
 
+void SVGTextPathElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGTextContentElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeStartOffset();
+        synchronizeMethod();
+        synchronizeSpacing();
+        synchronizeHref();
+        return;
+    }
+
+    if (attrName == SVGNames::startOffsetAttr)
+        synchronizeStartOffset();
+    else if (attrName == SVGNames::methodAttr)
+        synchronizeMethod();
+    else if (attrName == SVGNames::spacingAttr)
+        synchronizeSpacing();
+    else if (SVGURIReference::isKnownAttribute(attrName))
+        synchronizeHref();
+}
+
 RenderObject* SVGTextPathElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     return new (arena) RenderSVGTextPath(this);
@@ -104,5 +123,3 @@ void SVGTextPathElement::insertedIntoDocument()
 }
 
 #endif // ENABLE(SVG)
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.h b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.h
index 1bfcc8b140..ff09ed2105 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.h
@@ -57,18 +57,19 @@ namespace WebCore {
         virtual void insertedIntoDocument();
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
         virtual bool rendererIsNeeded(RenderStyle* style) { return StyledElement::rendererIsNeeded(style); }
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
         bool childShouldCreateRenderer(Node*) const;
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::startOffsetAttrString, SVGLength, StartOffset, startOffset)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::methodAttrString, int, Method, method)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::spacingAttrString, int, Spacing, spacing)
+        DECLARE_ANIMATED_PROPERTY(SVGTextPathElement, SVGNames::startOffsetAttr, SVGLength, StartOffset, startOffset)
+        DECLARE_ANIMATED_PROPERTY(SVGTextPathElement, SVGNames::methodAttr, int, Method, method)
+        DECLARE_ANIMATED_PROPERTY(SVGTextPathElement, SVGNames::spacingAttr, int, Spacing, spacing)
     
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+        DECLARE_ANIMATED_PROPERTY(SVGTextPathElement, XLinkNames::hrefAttr, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.idl
index 0183def4ba..511f792b1e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, GenerateConstructor] SVGTextPathElement : SVGTextContentElement,
+    interface [Conditional=SVG] SVGTextPathElement : SVGTextContentElement,
                                                      SVGURIReference {    
         // textPath Method Types
         const unsigned short TEXTPATH_METHODTYPE_UNKNOWN   = 0;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextPositioningElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTextPositioningElement.cpp
index 32d9dc0c12..dd99b490da 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextPositioningElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextPositioningElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -26,21 +24,20 @@
 #include "SVGTextPositioningElement.h"
 
 #include "MappedAttribute.h"
+#include "RenderObject.h"
 #include "SVGLengthList.h"
 #include "SVGNames.h"
 #include "SVGNumberList.h"
 
 namespace WebCore {
 
-char SVGTextPositioningElementIdentifier[] = "SVGTextPositioningElement";
-
 SVGTextPositioningElement::SVGTextPositioningElement(const QualifiedName& tagName, Document* doc)
     : SVGTextContentElement(tagName, doc)
-    , m_x(this, SVGNames::xAttr, SVGLengthList::create(SVGNames::xAttr))
-    , m_y(this, SVGNames::yAttr, SVGLengthList::create(SVGNames::yAttr))
-    , m_dx(this, SVGNames::dxAttr, SVGLengthList::create(SVGNames::dxAttr))
-    , m_dy(this, SVGNames::dyAttr, SVGLengthList::create(SVGNames::dyAttr))
-    , m_rotate(this, SVGNames::rotateAttr, SVGNumberList::create(SVGNames::rotateAttr))
+    , m_x(SVGLengthList::create(SVGNames::xAttr))
+    , m_y(SVGLengthList::create(SVGNames::yAttr))
+    , m_dx(SVGLengthList::create(SVGNames::dxAttr))
+    , m_dy(SVGLengthList::create(SVGNames::dyAttr))
+    , m_rotate(SVGNumberList::create(SVGNames::rotateAttr))
 {
 }
 
@@ -64,6 +61,42 @@ void SVGTextPositioningElement::parseMappedAttribute(MappedAttribute* attr)
         SVGTextContentElement::parseMappedAttribute(attr);
 }
 
+void SVGTextPositioningElement::svgAttributeChanged(const QualifiedName& attrName)
+{
+    SVGTextContentElement::svgAttributeChanged(attrName);
+
+    if (!renderer())
+        return;
+
+    if (isKnownAttribute(attrName))
+        renderer()->setNeedsLayout(true);
+}
+
+void SVGTextPositioningElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGTextContentElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeX();
+        synchronizeY();
+        synchronizeDx();
+        synchronizeDy();
+        synchronizeRotate();
+        return;
+    }
+
+    if (attrName == SVGNames::xAttr)
+        synchronizeX();
+    else if (attrName == SVGNames::yAttr)
+        synchronizeY();
+    else if (attrName == SVGNames::dxAttr)
+        synchronizeDx();
+    else if (attrName == SVGNames::dyAttr)
+        synchronizeDy();
+    else if (attrName == SVGNames::rotateAttr)
+        synchronizeRotate();
+}
+
 bool SVGTextPositioningElement::isKnownAttribute(const QualifiedName& attrName)
 {
     return (attrName.matches(SVGNames::xAttr) ||
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextPositioningElement.h b/src/3rdparty/webkit/WebCore/svg/SVGTextPositioningElement.h
index 3e01dab1f8..71e8900e98 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextPositioningElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextPositioningElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -30,23 +28,23 @@
 
 namespace WebCore {
 
-    extern char SVGTextPositioningElementIdentifier[];
-
     class SVGTextPositioningElement : public SVGTextContentElement {
     public:
         SVGTextPositioningElement(const QualifiedName&, Document*);
         virtual ~SVGTextPositioningElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void svgAttributeChanged(const QualifiedName&);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         bool isKnownAttribute(const QualifiedName&);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGTextPositioningElement, SVGTextPositioningElementIdentifier, SVGNames::xAttrString, SVGLengthList, X, x)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGTextPositioningElement, SVGTextPositioningElementIdentifier, SVGNames::yAttrString, SVGLengthList, Y, y)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGTextPositioningElement, SVGTextPositioningElementIdentifier, SVGNames::dxAttrString, SVGLengthList, Dx, dx)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGTextPositioningElement, SVGTextPositioningElementIdentifier, SVGNames::dyAttrString, SVGLengthList, Dy, dy)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGTextPositioningElement, SVGTextPositioningElementIdentifier, SVGNames::rotateAttrString, SVGNumberList, Rotate, rotate)
+        DECLARE_ANIMATED_PROPERTY(SVGTextPositioningElement, SVGNames::xAttr, SVGLengthList*, X, x)
+        DECLARE_ANIMATED_PROPERTY(SVGTextPositioningElement, SVGNames::yAttr, SVGLengthList*, Y, y)
+        DECLARE_ANIMATED_PROPERTY(SVGTextPositioningElement, SVGNames::dxAttr, SVGLengthList*, Dx, dx)
+        DECLARE_ANIMATED_PROPERTY(SVGTextPositioningElement, SVGNames::dyAttr, SVGLengthList*, Dy, dy)
+        DECLARE_ANIMATED_PROPERTY(SVGTextPositioningElement, SVGNames::rotateAttr, SVGNumberList*, Rotate, rotate)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTitleElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTitleElement.cpp
index 3e23a1b39f..5afde8dfef 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTitleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTitleElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTitleElement.h b/src/3rdparty/webkit/WebCore/svg/SVGTitleElement.h
index e053a4234b..340f72596a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTitleElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTitleElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTransform.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTransform.cpp
index 17d9b8f1e8..1af0cd9767 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTransform.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTransform.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -43,11 +41,11 @@ SVGTransform::SVGTransform(SVGTransformType type)
     : m_type(type)
     , m_angle(0)
     , m_center(FloatPoint())
-    , m_matrix(TransformationMatrix())
+    , m_matrix(AffineTransform())
 {
 }
 
-SVGTransform::SVGTransform(const TransformationMatrix& matrix)
+SVGTransform::SVGTransform(const AffineTransform& matrix)
     : m_type(SVG_TRANSFORM_MATRIX)
     , m_angle(0)
     , m_matrix(matrix)
@@ -68,7 +66,7 @@ SVGTransform::SVGTransformType SVGTransform::type() const
     return m_type;
 }
 
-TransformationMatrix SVGTransform::matrix() const
+AffineTransform SVGTransform::matrix() const
 {
     return m_matrix;
 }
@@ -83,7 +81,7 @@ FloatPoint SVGTransform::rotationCenter() const
     return m_center;
 }
 
-void SVGTransform::setMatrix(TransformationMatrix matrix) //const TransformationMatrix& matrix)
+void SVGTransform::setMatrix(AffineTransform matrix)
 {
     m_type = SVG_TRANSFORM_MATRIX;
     m_angle = 0;
@@ -151,6 +149,5 @@ void SVGTransform::setSkewY(float angle)
     m_matrix.skewY(angle);
 }
 
-// vim:ts=4:noet
 #endif // ENABLE(SVG)
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTransform.h b/src/3rdparty/webkit/WebCore/svg/SVGTransform.h
index 0a5e4102b1..88912c24e7 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTransform.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTransform.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -24,7 +22,7 @@
 #define SVGTransform_h
 
 #if ENABLE(SVG)
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "FloatPoint.h"
 #include "SVGNames.h"
 
@@ -46,18 +44,17 @@ namespace WebCore {
  
         SVGTransform();
         SVGTransform(SVGTransformType);
-        explicit SVGTransform(const TransformationMatrix&);
+        explicit SVGTransform(const AffineTransform&);
         virtual ~SVGTransform();
                
         SVGTransformType type() const;
 
-        TransformationMatrix matrix() const;
+        AffineTransform matrix() const;
     
         float angle() const;
         FloatPoint rotationCenter() const;
 
-//        void setMatrix(const TransformationMatrix&);
-        void setMatrix(TransformationMatrix);
+        void setMatrix(AffineTransform);
 
         void setTranslate(float tx, float ty);
         void setScale(float sx, float sy);
@@ -71,14 +68,11 @@ namespace WebCore {
         
         bool isValid();
 
-        // Throughout SVG 1.1 'SVGTransform' is only used for the 'transform' attribute
-        const QualifiedName& associatedAttributeName() const { return SVGNames::transformAttr; }
-
     private:
         SVGTransformType m_type;
         float m_angle;
         FloatPoint m_center;
-        TransformationMatrix m_matrix;
+        AffineTransform m_matrix;
     };
 
     inline bool operator==(const SVGTransform& a, const SVGTransform& b)
@@ -95,5 +89,3 @@ namespace WebCore {
 
 #endif // ENABLE(SVG)
 #endif
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTransform.idl b/src/3rdparty/webkit/WebCore/svg/SVGTransform.idl
index 3163cd6e95..fc153a7da8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTransform.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTransform.idl
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -23,7 +21,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, GenerateConstructor, PODType=SVGTransform] SVGTransform { 
+    interface [Conditional=SVG, PODType=SVGTransform] SVGTransform { 
         // Transform Types
         const unsigned short SVG_TRANSFORM_UNKNOWN   = 0;
         const unsigned short SVG_TRANSFORM_MATRIX    = 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTransformDistance.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTransformDistance.cpp
index 00b53873c5..51dfd74e79 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTransformDistance.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTransformDistance.cpp
@@ -40,7 +40,7 @@ SVGTransformDistance::SVGTransformDistance()
 {
 }
 
-SVGTransformDistance::SVGTransformDistance(SVGTransform::SVGTransformType type, float angle, float cx, float cy, const TransformationMatrix& transform)
+SVGTransformDistance::SVGTransformDistance(SVGTransform::SVGTransformType type, float angle, float cx, float cy, const AffineTransform& transform)
     : m_type(type)
     , m_angle(angle)
     , m_cx(cx)
@@ -97,20 +97,20 @@ SVGTransformDistance SVGTransformDistance::scaledDistance(float scaleFactor) con
     case SVGTransform::SVG_TRANSFORM_UNKNOWN:
         return SVGTransformDistance();
     case SVGTransform::SVG_TRANSFORM_ROTATE:
-        return SVGTransformDistance(m_type, m_angle * scaleFactor, m_cx * scaleFactor, m_cy * scaleFactor, TransformationMatrix());
+        return SVGTransformDistance(m_type, m_angle * scaleFactor, m_cx * scaleFactor, m_cy * scaleFactor, AffineTransform());
     case SVGTransform::SVG_TRANSFORM_SCALE:
     case SVGTransform::SVG_TRANSFORM_MATRIX:
-        return SVGTransformDistance(m_type, m_angle * scaleFactor, m_cx * scaleFactor, m_cy * scaleFactor, TransformationMatrix(m_transform).scale(scaleFactor));
+        return SVGTransformDistance(m_type, m_angle * scaleFactor, m_cx * scaleFactor, m_cy * scaleFactor, AffineTransform(m_transform).scale(scaleFactor));
     case SVGTransform::SVG_TRANSFORM_TRANSLATE:
     {
-        TransformationMatrix newTransform(m_transform);
+        AffineTransform newTransform(m_transform);
         newTransform.setE(m_transform.e() * scaleFactor);
         newTransform.setF(m_transform.f() * scaleFactor);
         return SVGTransformDistance(m_type, 0, 0, 0, newTransform);
     }
     case SVGTransform::SVG_TRANSFORM_SKEWX:
     case SVGTransform::SVG_TRANSFORM_SKEWY:
-        return SVGTransformDistance(m_type, m_angle * scaleFactor, m_cx * scaleFactor, m_cy * scaleFactor, TransformationMatrix());
+        return SVGTransformDistance(m_type, m_angle * scaleFactor, m_cx * scaleFactor, m_cy * scaleFactor, AffineTransform());
     }
     
     ASSERT_NOT_REACHED();
@@ -251,7 +251,7 @@ SVGTransform SVGTransformDistance::addToSVGTransform(const SVGTransform& transfo
 
 bool SVGTransformDistance::isZero() const
 {
-    return (m_transform == TransformationMatrix() && m_angle == 0);
+    return (m_transform == AffineTransform() && m_angle == 0);
 }
 
 float SVGTransformDistance::distance() const
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTransformDistance.h b/src/3rdparty/webkit/WebCore/svg/SVGTransformDistance.h
index 470e2eb69f..7c54dc7f47 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTransformDistance.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTransformDistance.h
@@ -27,31 +27,31 @@
 
 namespace WebCore {
     
-    class TransformationMatrix;
-        
-    class SVGTransformDistance {
-    public:
-        SVGTransformDistance();
-        SVGTransformDistance(const SVGTransform& fromTransform, const SVGTransform& toTransform);
-        
-        SVGTransformDistance scaledDistance(float scaleFactor) const;
-        SVGTransform addToSVGTransform(const SVGTransform&) const;
-        void addSVGTransform(const SVGTransform&, bool absoluteValue = false);
-        
-        static SVGTransform addSVGTransforms(const SVGTransform&, const SVGTransform&);
-        
-        bool isZero() const;
+class AffineTransform;
+    
+class SVGTransformDistance {
+public:
+    SVGTransformDistance();
+    SVGTransformDistance(const SVGTransform& fromTransform, const SVGTransform& toTransform);
+    
+    SVGTransformDistance scaledDistance(float scaleFactor) const;
+    SVGTransform addToSVGTransform(const SVGTransform&) const;
+    void addSVGTransform(const SVGTransform&, bool absoluteValue = false);
+    
+    static SVGTransform addSVGTransforms(const SVGTransform&, const SVGTransform&);
+    
+    bool isZero() const;
+    
+    float distance() const;
+private:
+    SVGTransformDistance(SVGTransform::SVGTransformType, float angle, float cx, float cy, const AffineTransform&);
         
-        float distance() const;
-    private:
-        SVGTransformDistance(SVGTransform::SVGTransformType, float angle, float cx, float cy, const TransformationMatrix&);
-            
-        SVGTransform::SVGTransformType m_type;
-        float m_angle;
-        float m_cx;
-        float m_cy;
-        TransformationMatrix m_transform; // for storing scale, translation or matrix transforms
-    };
+    SVGTransform::SVGTransformType m_type;
+    float m_angle;
+    float m_cx;
+    float m_cy;
+    AffineTransform m_transform; // for storing scale, translation or matrix transforms
+};
 }
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTransformList.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTransformList.cpp
index 648f1e978d..38dbc9a6b8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTransformList.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTransformList.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -23,11 +21,12 @@
 #include "config.h"
 
 #if ENABLE(SVG)
-#include "TransformationMatrix.h"
-#include "SVGTransform.h"
-#include "SVGSVGElement.h"
 #include "SVGTransformList.h"
 
+#include "AffineTransform.h"
+#include "SVGSVGElement.h"
+#include "SVGTransform.h"
+
 using namespace WebCore;
 
 SVGTransformList::SVGTransformList(const QualifiedName& attributeName)
@@ -39,7 +38,7 @@ SVGTransformList::~SVGTransformList()
 {
 }
 
-SVGTransform SVGTransformList::createSVGTransformFromMatrix(const TransformationMatrix& matrix) const
+SVGTransform SVGTransformList::createSVGTransformFromMatrix(const AffineTransform& matrix) const
 {
     return SVGSVGElement::createSVGTransformFromMatrix(matrix);
 }
@@ -56,7 +55,7 @@ SVGTransform SVGTransformList::concatenate() const
     if (!length)
         return SVGTransform();
         
-    TransformationMatrix matrix;
+    AffineTransform matrix;
     ExceptionCode ec = 0;
     for (unsigned int i = 0; i < length; i++)
         matrix = getItem(i, ec).matrix() * matrix;
@@ -69,7 +68,7 @@ String SVGTransformList::valueAsString() const
     // TODO: We may want to build a real transform string, instead of concatting to a matrix(...).
     SVGTransform transform = concatenate();
     if (transform.type() == SVGTransform::SVG_TRANSFORM_MATRIX) {
-        TransformationMatrix matrix = transform.matrix();
+        AffineTransform matrix = transform.matrix();
         return String::format("matrix(%f %f %f %f %f %f)", matrix.a(), matrix.b(), matrix.c(), matrix.d(), matrix.e(), matrix.f());
     }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTransformList.h b/src/3rdparty/webkit/WebCore/svg/SVGTransformList.h
index d095fe4501..683f0f7191 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTransformList.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTransformList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -37,7 +35,7 @@ namespace WebCore {
         static PassRefPtr<SVGTransformList> create(const QualifiedName& attributeName) { return adoptRef(new SVGTransformList(attributeName)); }
         virtual ~SVGTransformList();
 
-        SVGTransform createSVGTransformFromMatrix(const TransformationMatrix&) const;
+        SVGTransform createSVGTransformFromMatrix(const AffineTransform&) const;
         SVGTransform consolidate();
 
         // Internal use only
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTransformList.idl b/src/3rdparty/webkit/WebCore/svg/SVGTransformList.idl
index 8c9c86e95d..d03351aedd 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTransformList.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTransformList.idl
@@ -29,19 +29,19 @@ module svg {
     interface [Conditional=SVG] SVGTransformList {
         readonly attribute unsigned long numberOfItems;
 
-        [JSCCustom] void clear()
+        void clear()
             raises(DOMException);
-        [JSCCustom] SVGTransform initialize(in SVGTransform item)
+        SVGTransform initialize(in SVGTransform item)
             raises(DOMException, SVGException);
-        [JSCCustom] SVGTransform getItem(in unsigned long index)
+        SVGTransform getItem(in unsigned long index)
             raises(DOMException);
-        [JSCCustom] SVGTransform insertItemBefore(in SVGTransform item, in unsigned long index)
+        SVGTransform insertItemBefore(in SVGTransform item, in unsigned long index)
             raises(DOMException, SVGException);
-        [JSCCustom] SVGTransform replaceItem(in SVGTransform item, in unsigned long index)
+        SVGTransform replaceItem(in SVGTransform item, in unsigned long index)
             raises(DOMException, SVGException);
-        [JSCCustom] SVGTransform removeItem(in unsigned long index)
+        SVGTransform removeItem(in unsigned long index)
             raises(DOMException);
-        [JSCCustom] SVGTransform appendItem(in SVGTransform item)
+        SVGTransform appendItem(in SVGTransform item)
             raises(DOMException, SVGException);
         SVGTransform createSVGTransformFromMatrix(in SVGMatrix matrix);
         SVGTransform consolidate();
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTransformable.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTransformable.cpp
index 17344eae10..d710a34e15 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTransformable.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTransformable.cpp
@@ -26,7 +26,7 @@
 #if ENABLE(SVG)
 #include "SVGTransformable.h"
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "FloatConversion.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
@@ -43,15 +43,15 @@ SVGTransformable::~SVGTransformable()
 {
 }
 
-TransformationMatrix SVGTransformable::getCTM(const SVGElement* element) const
+AffineTransform SVGTransformable::getCTM(const SVGElement* element) const
 {
-    TransformationMatrix ctm = SVGLocatable::getCTM(element);
+    AffineTransform ctm = SVGLocatable::getCTM(element);
     return animatedLocalTransform() * ctm;
 }
 
-TransformationMatrix SVGTransformable::getScreenCTM(const SVGElement* element) const
+AffineTransform SVGTransformable::getScreenCTM(const SVGElement* element) const
 {
-    TransformationMatrix ctm = SVGLocatable::getScreenCTM(element);
+    AffineTransform ctm = SVGLocatable::getScreenCTM(element);
     return animatedLocalTransform() * ctm;
 }
 
@@ -147,7 +147,7 @@ bool SVGTransformable::parseTransformValue(unsigned type, const UChar*& ptr, con
                   t.setRotate(values[0], values[1], values[2]);
             break;
         case SVGTransform::SVG_TRANSFORM_MATRIX:
-            t.setMatrix(TransformationMatrix(values[0], values[1], values[2], values[3], values[4], values[5]));
+            t.setMatrix(AffineTransform(values[0], values[1], values[2], values[3], values[4], values[5]));
             break;
     }
 
@@ -190,18 +190,23 @@ static inline bool parseAndSkipType(const UChar*& currTransform, const UChar* en
 bool SVGTransformable::parseTransformAttribute(SVGTransformList* list, const AtomicString& transform)
 {
     const UChar* start = transform.characters();
-    const UChar* end = start + transform.length();
-    return parseTransformAttribute(list, start, end);
+    return parseTransformAttribute(list, start, start + transform.length());
 }
 
-bool SVGTransformable::parseTransformAttribute(SVGTransformList* list, const UChar*& currTransform, const UChar* end)
+bool SVGTransformable::parseTransformAttribute(SVGTransformList* list, const UChar*& currTransform, const UChar* end, TransformParsingMode mode)
 {
+    ExceptionCode ec = 0;
+    if (mode == ClearList) {
+        list->clear(ec);
+        ASSERT(!ec);
+    }
+
     bool delimParsed = false;
     while (currTransform < end) {
         delimParsed = false;
         unsigned short type = SVGTransform::SVG_TRANSFORM_UNKNOWN;
         skipOptionalSpaces(currTransform, end);
-        
+
         if (!parseAndSkipType(currTransform, end, type))
             return false;
 
@@ -209,12 +214,11 @@ bool SVGTransformable::parseTransformAttribute(SVGTransformList* list, const UCh
         if (!parseTransformValue(type, currTransform, end, t))
             return false;
 
-        ExceptionCode ec = 0;
         list->appendItem(t, ec);
         skipOptionalSpaces(currTransform, end);
         if (currTransform < end && *currTransform == ',') {
             delimParsed = true;
-            currTransform++;
+            ++currTransform;
         }
         skipOptionalSpaces(currTransform, end);
     }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTransformable.h b/src/3rdparty/webkit/WebCore/svg/SVGTransformable.h
index da31c75a78..7579fa902b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTransformable.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTransformable.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -30,28 +28,33 @@
 
 namespace WebCore {
     
-    class TransformationMatrix;
-    class AtomicString;
-    class SVGTransform;
-    class QualifiedName;
-
-    class SVGTransformable : virtual public SVGLocatable {
-    public:
-        SVGTransformable();
-        virtual ~SVGTransformable();
-
-        static bool parseTransformAttribute(SVGTransformList*, const AtomicString& transform);
-        static bool parseTransformAttribute(SVGTransformList*, const UChar*& ptr, const UChar* end);
-        static bool parseTransformValue(unsigned type, const UChar*& ptr, const UChar* end, SVGTransform&);
-        
-        TransformationMatrix getCTM(const SVGElement*) const;
-        TransformationMatrix getScreenCTM(const SVGElement*) const;
-        
-        virtual TransformationMatrix animatedLocalTransform() const = 0;
-
-        bool isKnownAttribute(const QualifiedName&);
+class AffineTransform;
+class AtomicString;
+class SVGTransform;
+class QualifiedName;
+
+class SVGTransformable : virtual public SVGLocatable {
+public:
+    SVGTransformable();
+    virtual ~SVGTransformable();
+
+    enum TransformParsingMode {
+        ClearList,
+        DoNotClearList
     };
 
+    static bool parseTransformAttribute(SVGTransformList*, const AtomicString& transform);
+    static bool parseTransformAttribute(SVGTransformList*, const UChar*& ptr, const UChar* end, TransformParsingMode mode = ClearList);
+    static bool parseTransformValue(unsigned type, const UChar*& ptr, const UChar* end, SVGTransform&);
+    
+    AffineTransform getCTM(const SVGElement*) const;
+    AffineTransform getScreenCTM(const SVGElement*) const;
+    
+    virtual AffineTransform animatedLocalTransform() const = 0;
+
+    bool isKnownAttribute(const QualifiedName&);
+};
+
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTransformable.idl b/src/3rdparty/webkit/WebCore/svg/SVGTransformable.idl
index 02a4336173..13a4520fac 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTransformable.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTransformable.idl
@@ -26,7 +26,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, ObjCProtocol] SVGTransformable : SVGLocatable {
+    interface [Conditional=SVG, ObjCProtocol, OmitConstructor] SVGTransformable : SVGLocatable {
         readonly attribute SVGAnimatedTransformList transform;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp
index 24febc3142..5fe71ab31c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp
@@ -27,8 +27,6 @@
 
 namespace WebCore {
 
-char SVGURIReferenceIdentifier[] = "SVGURIReference";
-
 SVGURIReference::SVGURIReference()
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.h b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.h
index 812fb594f1..ea09f2e09b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008, 2009 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -29,7 +27,6 @@
 
 namespace WebCore {
 
-    extern char SVGURIReferenceIdentifier[];
     class MappedAttribute;
 
     class SVGURIReference {
@@ -43,7 +40,7 @@ namespace WebCore {
         static String getTarget(const String& url);
 
     protected:
-        virtual void setHrefBaseValue(SVGAnimatedTypeValue<String>::DecoratedType type) = 0;
+        virtual void setHrefBaseValue(SVGAnimatedPropertyTraits<String>::PassType) = 0;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.idl b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.idl
index 72bd9c81d5..4981eb1c94 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.idl
@@ -26,7 +26,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, ObjCProtocol] SVGURIReference {
+    interface [Conditional=SVG, ObjCProtocol, OmitConstructor] SVGURIReference {
         readonly attribute SVGAnimatedString href;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGUnitTypes.h b/src/3rdparty/webkit/WebCore/svg/SVGUnitTypes.h
index 6be737fe73..86d49b49c7 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGUnitTypes.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGUnitTypes.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -40,9 +38,9 @@ private:
     SVGUnitTypes() { }
 };
 
-} // namespace WebCore
+static inline SVGUnitTypes::SVGUnitType toUnitType(int type) { return static_cast<SVGUnitTypes::SVGUnitType>(type); }
 
-#endif // ENABLE(SVG)
-#endif // SVGUnitTypes_h
+}
 
-// vim:ts=4:noet
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGUnitTypes.idl b/src/3rdparty/webkit/WebCore/svg/SVGUnitTypes.idl
index 0c3791eeed..9095e7adae 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGUnitTypes.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGUnitTypes.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, GenerateConstructor] SVGUnitTypes {
+    interface [Conditional=SVG] SVGUnitTypes {
         // Unit Types
         const unsigned short SVG_UNIT_TYPE_UNKNOWN           = 0;
         const unsigned short SVG_UNIT_TYPE_USERSPACEONUSE    = 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp
index 42517bdbff..45bab6a75f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp
@@ -1,9 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
-    Copyright (C) Research In Motion Limited 2009. All rights reserved.
-
-    This file is part of the KDE project
+    Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -35,12 +33,13 @@
 #include "MappedAttribute.h"
 #include "NodeRenderStyle.h"
 #include "RegisteredEventListener.h"
-#include "RenderSVGTransformableContainer.h"
+#include "RenderSVGShadowTreeRootContainer.h"
 #include "SVGElementInstance.h"
 #include "SVGElementInstanceList.h"
 #include "SVGGElement.h"
 #include "SVGLength.h"
 #include "SVGPreserveAspectRatio.h"
+#include "SVGShadowTreeElements.h"
 #include "SVGSMILElement.h"
 #include "SVGSVGElement.h"
 #include "SVGSymbolElement.h"
@@ -61,12 +60,12 @@ SVGUseElement::SVGUseElement(const QualifiedName& tagName, Document* doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , SVGURIReference()
-    , m_x(this, SVGNames::xAttr, LengthModeWidth)
-    , m_y(this, SVGNames::yAttr, LengthModeHeight)
-    , m_width(this, SVGNames::widthAttr, LengthModeWidth)
-    , m_height(this, SVGNames::heightAttr, LengthModeHeight)
-    , m_href(this, XLinkNames::hrefAttr)
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_x(LengthModeWidth)
+    , m_y(LengthModeHeight)
+    , m_width(LengthModeWidth)
+    , m_height(LengthModeHeight)
+    , m_isPendingResource(false)
+    , m_needsShadowTreeRecreation(false)
 {
 }
 
@@ -76,6 +75,13 @@ SVGUseElement::~SVGUseElement()
 
 SVGElementInstance* SVGUseElement::instanceRoot() const
 {
+    // If there is no element instance tree, force immediate SVGElementInstance tree
+    // creation by asking the document to invoke our recalcStyle function - as we can't
+    // wait for the lazy creation to happen if e.g. JS wants to access the instanceRoot
+    // object right after creating the element on-the-fly
+    if (!m_targetElementInstance)
+        document()->updateLayoutIgnorePendingStylesheets();
+
     return m_targetElementInstance.get();
 }
 
@@ -114,14 +120,15 @@ void SVGUseElement::parseMappedAttribute(MappedAttribute* attr)
 
 void SVGUseElement::insertedIntoDocument()
 {
+    // This functions exists to assure assumptions made in the code regarding SVGElementInstance creation/destruction are satisfied.
     SVGElement::insertedIntoDocument();
-    buildPendingResource();
+    ASSERT(!m_targetElementInstance);
+    ASSERT(!m_isPendingResource);
 }
 
 void SVGUseElement::removedFromDocument()
 {
     m_targetElementInstance = 0;
-    m_shadowTreeRootElement = 0;
     SVGElement::removedFromDocument();
 }
 
@@ -129,87 +136,198 @@ void SVGUseElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledTransformableElement::svgAttributeChanged(attrName);
 
-    if (!attached())
+    if (!renderer())
+        return;
+
+    if (SVGURIReference::isKnownAttribute(attrName)) {
+        if (m_isPendingResource) {
+            document()->accessSVGExtensions()->removePendingResource(m_resourceId);
+            m_resourceId = String();
+            m_isPendingResource = false;
+        }
+
+        invalidateShadowTree();
+        return;
+    }
+
+    if (attrName == SVGNames::xAttr || attrName == SVGNames::yAttr) {
+        updateContainerOffsets();
         return;
+    }
 
-    if (attrName == SVGNames::xAttr || attrName == SVGNames::yAttr ||
-        attrName == SVGNames::widthAttr || attrName == SVGNames::heightAttr ||
-        SVGTests::isKnownAttribute(attrName) ||
-        SVGLangSpace::isKnownAttribute(attrName) ||
-        SVGExternalResourcesRequired::isKnownAttribute(attrName) ||
-        SVGURIReference::isKnownAttribute(attrName) ||
-        SVGStyledTransformableElement::isKnownAttribute(attrName)) {
-        buildPendingResource();
-
-        if (m_shadowTreeRootElement)
-            m_shadowTreeRootElement->setNeedsStyleRecalc();
+    if (attrName == SVGNames::widthAttr || attrName == SVGNames::heightAttr) {
+        updateContainerSizes();
+        return;
+    }
+
+    // Be very careful here, if svgAttributeChanged() has been called because a SVG CSS property changed, we do NOT want to reclone the tree!
+    if (SVGStyledElement::isKnownAttribute(attrName)) {
+        setNeedsStyleRecalc();
+        return;
+    }
+
+    if (SVGTests::isKnownAttribute(attrName)
+        || SVGLangSpace::isKnownAttribute(attrName)
+        || SVGExternalResourcesRequired::isKnownAttribute(attrName)
+        || SVGStyledTransformableElement::isKnownAttribute(attrName)) {
+        invalidateShadowTree();
     }
 }
 
-void SVGUseElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+void SVGUseElement::synchronizeProperty(const QualifiedName& attrName)
 {
-    SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    SVGStyledTransformableElement::synchronizeProperty(attrName);
 
-    if (!attached())
+    if (attrName == anyQName()) {
+        synchronizeX();
+        synchronizeY();
+        synchronizeWidth();
+        synchronizeHeight();
+        synchronizeExternalResourcesRequired();
+        synchronizeHref();
         return;
+    }
 
-    buildPendingResource();
+    if (attrName == SVGNames::xAttr)
+        synchronizeX();
+    else if (attrName == SVGNames::yAttr)
+        synchronizeY();
+    else if (attrName == SVGNames::widthAttr)
+        synchronizeWidth();
+    else if (attrName == SVGNames::heightAttr)
+        synchronizeHeight();
+    else if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+    else if (SVGURIReference::isKnownAttribute(attrName))
+        synchronizeHref();
+}
 
-    if (m_shadowTreeRootElement)
-        m_shadowTreeRootElement->setNeedsStyleRecalc();
+static void updateContainerSize(SVGUseElement* useElement, SVGElementInstance* targetInstance)
+{
+    // Depth-first used to write the method in early exit style, no particular other reason.
+    for (SVGElementInstance* instance = targetInstance->firstChild(); instance; instance = instance->nextSibling())
+        updateContainerSize(useElement, instance);
+
+    SVGElement* correspondingElement = targetInstance->correspondingElement();
+    ASSERT(correspondingElement);
+
+    bool isSymbolTag = correspondingElement->hasTagName(SVGNames::symbolTag);
+    if (!correspondingElement->hasTagName(SVGNames::svgTag) && !isSymbolTag)
+        return;
+
+    SVGElement* shadowTreeElement = targetInstance->shadowTreeElement();
+    ASSERT(shadowTreeElement);
+    ASSERT(shadowTreeElement->hasTagName(SVGNames::svgTag));
+
+    // Spec (<use> on <symbol>): This generated 'svg' will always have explicit values for attributes width and height.
+    // If attributes width and/or height are provided on the 'use' element, then these attributes
+    // will be transferred to the generated 'svg'. If attributes width and/or height are not specified,
+    // the generated 'svg' element will use values of 100% for these attributes.
+    
+    // Spec (<use> on <svg>): If attributes width and/or height are provided on the 'use' element, then these
+    // values will override the corresponding attributes on the 'svg' in the generated tree.
+
+    if (useElement->hasAttribute(SVGNames::widthAttr))
+        shadowTreeElement->setAttribute(SVGNames::widthAttr, useElement->getAttribute(SVGNames::widthAttr));
+    else if (isSymbolTag && shadowTreeElement->hasAttribute(SVGNames::widthAttr))
+        shadowTreeElement->setAttribute(SVGNames::widthAttr, "100%");
+
+    if (useElement->hasAttribute(SVGNames::heightAttr))
+        shadowTreeElement->setAttribute(SVGNames::heightAttr, useElement->getAttribute(SVGNames::heightAttr));
+    else if (isSymbolTag && shadowTreeElement->hasAttribute(SVGNames::heightAttr))
+        shadowTreeElement->setAttribute(SVGNames::heightAttr, "100%");
+}   
+
+void SVGUseElement::updateContainerSizes()
+{
+    if (!m_targetElementInstance)
+        return;
+
+    // Update whole subtree, scanning for shadow container elements, that correspond to <svg>/<symbol> tags
+    updateContainerSize(this, m_targetElementInstance.get());
+
+    if (renderer())
+        renderer()->setNeedsLayout(true);
 }
- 
-static bool shadowTreeContainsChangedNodes(SVGElementInstance* target)
+
+static void updateContainerOffset(SVGElementInstance* targetInstance)
 {
-    if (!target)      // when use is referencing an non-existing element, there will be no Instance tree built
-        return false;
+    // Depth-first used to write the method in early exit style, no particular other reason.
+    for (SVGElementInstance* instance = targetInstance->firstChild(); instance; instance = instance->nextSibling())
+        updateContainerOffset(instance);
 
-    if (target->needsUpdate())
-        return true;
+    SVGElement* correspondingElement = targetInstance->correspondingElement();
+    ASSERT(correspondingElement);
 
-    for (SVGElementInstance* instance = target->firstChild(); instance; instance = instance->nextSibling())
-        if (shadowTreeContainsChangedNodes(instance))
-            return true;
+    if (!correspondingElement->hasTagName(SVGNames::useTag))
+        return;
 
-    return false;
+    SVGElement* shadowTreeElement = targetInstance->shadowTreeElement();
+    ASSERT(shadowTreeElement);
+    ASSERT(shadowTreeElement->hasTagName(SVGNames::gTag));
+
+    if (!static_cast<SVGGElement*>(shadowTreeElement)->isShadowTreeContainerElement())
+        return;
+
+    // Spec: An additional transformation translate(x,y) is appended to the end
+    // (i.e., right-side) of the transform attribute on the generated 'g', where x
+    // and y represent the values of the x and y attributes on the 'use' element. 
+    SVGUseElement* useElement = static_cast<SVGUseElement*>(correspondingElement);
+    SVGShadowTreeContainerElement* containerElement = static_cast<SVGShadowTreeContainerElement*>(shadowTreeElement);
+    containerElement->setContainerOffset(useElement->x(), useElement->y());
 }
 
-void SVGUseElement::recalcStyle(StyleChange change)
+void SVGUseElement::updateContainerOffsets()
 {
-    if (attached() && needsStyleRecalc() && shadowTreeContainsChangedNodes(m_targetElementInstance.get())) {
-        buildPendingResource();
+    if (!m_targetElementInstance)
+        return;
+
+    // Update root container offset (not reachable through instance tree)
+    SVGElement* shadowRoot = m_targetElementInstance->shadowTreeElement();
+    ASSERT(shadowRoot);
+
+    Node* parentNode = shadowRoot->parentNode();
+    ASSERT(parentNode);
+    ASSERT(parentNode->isSVGElement());
+    ASSERT(parentNode->hasTagName(SVGNames::gTag));
+    ASSERT(static_cast<SVGGElement*>(parentNode)->isShadowTreeContainerElement());
+
+    SVGShadowTreeContainerElement* containerElement = static_cast<SVGShadowTreeContainerElement*>(parentNode);
+    containerElement->setContainerOffset(x(), y());
 
-        if (m_shadowTreeRootElement)
-            m_shadowTreeRootElement->setNeedsStyleRecalc();
+    // Update whole subtree, scanning for shadow container elements, marking a cloned use subtree
+    updateContainerOffset(m_targetElementInstance.get());
+
+    if (renderer())
+        renderer()->setNeedsLayout(true);
+}
+
+void SVGUseElement::recalcStyle(StyleChange change)
+{
+    // Eventually mark shadow root element needing style recalc
+    if (needsStyleRecalc() && m_targetElementInstance) {
+        if (SVGElement* shadowRoot = m_targetElementInstance->shadowTreeElement())
+            shadowRoot->setNeedsStyleRecalc();
     }
 
-    SVGStyledElement::recalcStyle(change);
+    SVGStyledTransformableElement::recalcStyle(change);
 
-    // The shadow tree root element is NOT a direct child element of us.
-    // So we have to take care it receives style updates, manually.
-    if (!m_shadowTreeRootElement || !m_shadowTreeRootElement->attached())
+    bool needsStyleUpdate = !m_needsShadowTreeRecreation;
+    if (m_needsShadowTreeRecreation) {
+        static_cast<RenderSVGShadowTreeRootContainer*>(renderer())->markShadowTreeForRecreation();
+        m_needsShadowTreeRecreation = false;
+    }
+
+    RenderSVGShadowTreeRootContainer* shadowRoot = static_cast<RenderSVGShadowTreeRootContainer*>(renderer());
+    if (!shadowRoot)
         return;
 
-    // Mimic Element::recalcStyle(). The main difference is that we don't call attach() on the
-    // shadow tree root element, but call attachShadowTree() here. Calling attach() will crash
-    // as the shadow tree root element has no (direct) parent node. Yes, shadow trees are tricky.
-    if (change >= Inherit || m_shadowTreeRootElement->needsStyleRecalc()) {
-        RefPtr<RenderStyle> newStyle = document()->styleSelector()->styleForElement(m_shadowTreeRootElement.get());
-        StyleChange ch = Node::diff(m_shadowTreeRootElement->renderStyle(), newStyle.get());
-        if (ch == Detach) {
-            ASSERT(m_shadowTreeRootElement->attached());
-            m_shadowTreeRootElement->detach();
-            attachShadowTree();
-
-            // attach recalulates the style for all children. No need to do it twice.
-            m_shadowTreeRootElement->setNeedsStyleRecalc(NoStyleChange);
-            m_shadowTreeRootElement->setChildNeedsStyleRecalc(false);
-            return;
-        }
-    }
+    shadowRoot->updateFromElement();
+
+    if (!needsStyleUpdate)
+        return;
 
-    // Only change==Detach needs special treatment, for anything else recalcStyle() works.
-    m_shadowTreeRootElement->recalcStyle(change);
+    shadowRoot->updateStyle(change);
 }
 
 #ifdef DUMP_INSTANCE_TREE
@@ -218,26 +336,30 @@ void dumpInstanceTree(unsigned int& depth, String& text, SVGElementInstance* tar
     SVGElement* element = targetInstance->correspondingElement();
     ASSERT(element);
 
+    SVGElement* shadowTreeElement = targetInstance->shadowTreeElement();
+    ASSERT(shadowTreeElement);
+
     String elementId = element->getIDAttribute();
     String elementNodeName = element->nodeName();
+    String shadowTreeElementNodeName = shadowTreeElement->nodeName();
     String parentNodeName = element->parentNode() ? element->parentNode()->nodeName() : "null";
     String firstChildNodeName = element->firstChild() ? element->firstChild()->nodeName() : "null";
 
     for (unsigned int i = 0; i < depth; ++i)
         text += "  ";
 
-    text += String::format("SVGElementInstance this=%p, (parentNode=%s, firstChild=%s, correspondingElement=%s (%p), shadowTreeElement=%p, id=%s)\n",
-                           targetInstance, parentNodeName.latin1().data(), firstChildNodeName.latin1().data(), elementNodeName.latin1().data(),
-                           element, targetInstance->shadowTreeElement(), elementId.latin1().data());
+    text += String::format("SVGElementInstance this=%p, (parentNode=%s (%p), firstChild=%s (%p), correspondingElement=%s (%p), shadowTreeElement=%s (%p), id=%s)\n",
+                           targetInstance, parentNodeName.latin1().data(), element->parentNode(), firstChildNodeName.latin1().data(), element->firstChild(),
+                           elementNodeName.latin1().data(), element, shadowTreeElementNodeName.latin1().data(), shadowTreeElement, elementId.latin1().data());
 
     for (unsigned int i = 0; i < depth; ++i)
         text += "  ";
 
-    HashSet<SVGElementInstance*> elementInstances = element->instancesForElement();
+    const HashSet<SVGElementInstance*>& elementInstances = element->instancesForElement();
     text += String::format("Corresponding element is associated with %i instance(s):\n", elementInstances.size());
 
-    HashSet<SVGElementInstance*>::iterator end = elementInstances.end();
-    for (HashSet<SVGElementInstance*>::iterator it = elementInstances.begin(); it != end; ++it) {
+    const HashSet<SVGElementInstance*>::const_iterator end = elementInstances.end();
+    for (HashSet<SVGElementInstance*>::const_iterator it = elementInstances.begin(); it != end; ++it) {
         for (unsigned int i = 0; i < depth; ++i)
             text += "  ";
 
@@ -284,16 +406,41 @@ static bool subtreeContainsDisallowedElement(Node* start)
 
 void SVGUseElement::buildPendingResource()
 {
+    // If we're called the first time (during shadow tree root creation from RenderSVGShadowTreeRootContainer)
+    // we either determine that our target is available or not - then we add ourselves to the pending resource list
+    // Once the pending resource appears, it will call buildPendingResource(), so we're called a second time.
     String id = SVGURIReference::getTarget(href());
     Element* targetElement = document()->getElementById(id);
+    ASSERT(!m_targetElementInstance);
 
     if (!targetElement) {
-        // TODO: We want to deregister as pending resource, if our href() changed!
-        // TODO: Move to svgAttributeChanged, once we're fixing use & the new dynamic update concept.
+        if (m_isPendingResource || id.isEmpty())
+            return;
+
+        m_isPendingResource = true;
+        m_resourceId = id;
         document()->accessSVGExtensions()->addPendingResource(id, this);
         return;
     }
 
+    if (m_isPendingResource) {
+        ASSERT(!m_targetElementInstance);
+        m_isPendingResource = false;    
+        invalidateShadowTree();
+    }
+}
+
+void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowRoot)
+{
+    String id = SVGURIReference::getTarget(href());
+    Element* targetElement = document()->getElementById(id);
+    if (!targetElement) {
+        // The only time we should get here is when the use element has not been
+        // given a resource to target.
+        ASSERT(m_resourceId.isEmpty());
+        return;
+    }
+
     // Do not build the shadow/instance tree for <use> elements living in a shadow tree.
     // The will be expanded soon anyway - see expandUseElementsInShadowTree().
     Node* parent = parentNode();
@@ -308,17 +455,13 @@ void SVGUseElement::buildPendingResource()
     if (targetElement && targetElement->isSVGElement())
         target = static_cast<SVGElement*>(targetElement);
 
-    if (m_targetElementInstance) {
-        m_targetElementInstance->forgetWrapper();
+    if (m_targetElementInstance)
         m_targetElementInstance = 0;
-    }
 
     // Do not allow self-referencing.
     // 'target' may be null, if it's a non SVG namespaced element.
-    if (!target || target == this) {
-        m_shadowTreeRootElement = 0;
+    if (!target || target == this)
         return;
-    }
 
     // Why a seperated instance/shadow tree? SVG demands it:
     // The instance tree is accesable from JavaScript, and has to
@@ -340,45 +483,44 @@ void SVGUseElement::buildPendingResource()
     // Non-appearing <use> content is easier to debug, then half-appearing content.
     if (foundProblem) {
         m_targetElementInstance = 0;
-        m_shadowTreeRootElement = 0;
         return;
     }
 
     // Assure instance tree building was successfull
     ASSERT(m_targetElementInstance);
+    ASSERT(!m_targetElementInstance->shadowTreeElement());
     ASSERT(m_targetElementInstance->correspondingUseElement() == this);
-
-    // Setup shadow tree root node
-    m_shadowTreeRootElement = new SVGGElement(SVGNames::gTag, document());
-    m_shadowTreeRootElement->setInDocument();
-    m_shadowTreeRootElement->setShadowParentNode(this);
-
-    // Spec: An additional transformation translate(x,y) is appended to the end
-    // (i.e., right-side) of the transform attribute on the generated 'g', where x
-    // and y represent the values of the x and y attributes on the 'use' element. 
-    if (x().value(this) != 0.0 || y().value(this) != 0.0) {
-        String transformString = String::format("translate(%f, %f)", x().value(this), y().value(this));
-        m_shadowTreeRootElement->setAttribute(SVGNames::transformAttr, transformString);
-    }
+    ASSERT(m_targetElementInstance->correspondingElement() == target);
 
     // Build shadow tree from instance tree
     // This also handles the special cases: <use> on <symbol>, <use> on <svg>.
-    buildShadowTree(target, m_targetElementInstance.get());
+    buildShadowTree(shadowRoot, target, m_targetElementInstance.get());
 
 #if ENABLE(SVG) && ENABLE(SVG_USE)
     // Expand all <use> elements in the shadow tree.
     // Expand means: replace the actual <use> element by what it references.
-    expandUseElementsInShadowTree(m_shadowTreeRootElement.get());
+    expandUseElementsInShadowTree(shadowRoot, shadowRoot);
 
     // Expand all <symbol> elements in the shadow tree.
     // Expand means: replace the actual <symbol> element by the <svg> element.
-    expandSymbolElementsInShadowTree(m_shadowTreeRootElement.get());
-
+    expandSymbolElementsInShadowTree(shadowRoot, shadowRoot);
 #endif
 
     // Now that the shadow tree is completly expanded, we can associate
     // shadow tree elements <-> instances in the instance tree.
-    associateInstancesWithShadowTreeElements(m_shadowTreeRootElement->firstChild(), m_targetElementInstance.get());
+    associateInstancesWithShadowTreeElements(shadowRoot->firstChild(), m_targetElementInstance.get());
+
+    // If no shadow tree element is present, this means that the reference root
+    // element was removed, as it is disallowed (ie. <use> on <foreignObject>)
+    // Do NOT leave an inconsistent instance tree around, instead destruct it.
+    if (!m_targetElementInstance->shadowTreeElement()) {
+        shadowRoot->removeAllChildren();
+        m_targetElementInstance = 0;
+        return;
+    }
+
+    // Consistency checks - this is assumed in updateContainerOffset().
+    ASSERT(m_targetElementInstance->shadowTreeElement()->parentNode() == shadowRoot);
 
     // Eventually dump instance tree
 #ifdef DUMP_INSTANCE_TREE
@@ -395,8 +537,8 @@ void SVGUseElement::buildPendingResource()
 
     PassRefPtr<XMLSerializer> serializer = XMLSerializer::create();
 
-    String markup = serializer->serializeToString(m_shadowTreeRootElement.get(), ec);
-    ASSERT(ec == 0);
+    String markup = serializer->serializeToString(shadowRoot, ec);
+    ASSERT(!ec);
 
     fprintf(stderr, "Dumping <use> shadow tree markup:\n%s\n", markup.latin1().data());
 #endif
@@ -404,30 +546,34 @@ void SVGUseElement::buildPendingResource()
     // Transfer event listeners assigned to the referenced element to our shadow tree elements.
     transferEventListenersToShadowTree(m_targetElementInstance.get());
 
-    // The DOM side is setup properly. Now we have to attach the root shadow
-    // tree element manually - using attach() won't work for "shadow nodes".
-    attachShadowTree();
+    // Update container offset/size
+    updateContainerOffsets();
+    updateContainerSizes();
 }
 
 RenderObject* SVGUseElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    return new (arena) RenderSVGTransformableContainer(this);
+    return new (arena) RenderSVGShadowTreeRootContainer(this);
+}
+
+static void updateFromElementCallback(Node* node)
+{
+    if (RenderObject* renderer = node->renderer())
+        renderer->updateFromElement();
 }
 
 void SVGUseElement::attach()
 {
     SVGStyledTransformableElement::attach();
 
-    // If we're a pending resource, this doesn't have any effect.
-    attachShadowTree();
+    if (renderer())
+        queuePostAttachCallback(updateFromElementCallback, this);
 }
 
 void SVGUseElement::detach()
 {
     SVGStyledTransformableElement::detach();
-
-    if (m_shadowTreeRootElement)
-        m_shadowTreeRootElement->detach();
+    m_targetElementInstance = 0;
 }
 
 static bool isDirectReference(Node* n)
@@ -443,16 +589,20 @@ static bool isDirectReference(Node* n)
 
 Path SVGUseElement::toClipPath() const
 {
-    if (!m_shadowTreeRootElement)
-        const_cast<SVGUseElement*>(this)->buildPendingResource();
+    Node* n = m_targetElementInstance ? m_targetElementInstance->shadowTreeElement() : 0;
+    if (!n)
+        return Path();
 
-    Node* n = m_shadowTreeRootElement->firstChild();
     if (n->isSVGElement() && static_cast<SVGElement*>(n)->isStyledTransformable()) {
         if (!isDirectReference(n))
             // Spec: Indirect references are an error (14.3.5)
             document()->accessSVGExtensions()->reportError("Not allowed to use indirect reference in <clip-path>");
-        else
-            return static_cast<SVGStyledTransformableElement*>(n)->toClipPath();
+        else {
+            Path clipPath = static_cast<SVGStyledTransformableElement*>(n)->toClipPath();
+            clipPath.translate(FloatSize(x().value(this), y().value(this)));
+            clipPath.transform(animatedLocalTransform());
+            return clipPath;
+        }
     }
 
     return Path();
@@ -480,11 +630,12 @@ void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* ta
             continue;
 
         // Create SVGElementInstance object, for both container/non-container nodes.
-        RefPtr<SVGElementInstance> instancePtr = SVGElementInstance::create(this, element);
-        targetInstance->appendChild(instancePtr.get());
+        RefPtr<SVGElementInstance> instance = SVGElementInstance::create(this, element);
+        SVGElementInstance* instancePtr = instance.get();
+        targetInstance->appendChild(instance.release());
 
         // Enter recursion, appending new instance tree nodes to the "instance" object.
-        buildInstanceTree(element, instancePtr.get(), foundProblem);
+        buildInstanceTree(element, instancePtr, foundProblem);
     }
 
     // Spec: If the referenced object is itself a 'use', or if there are 'use' subelements within the referenced
@@ -525,22 +676,11 @@ void SVGUseElement::handleDeepUseReferencing(SVGUseElement* use, SVGElementInsta
 
     // Create an instance object, even if we're dealing with a cycle
     RefPtr<SVGElementInstance> newInstance = SVGElementInstance::create(this, target);
-    targetInstance->appendChild(newInstance);
+    SVGElementInstance* newInstancePtr = newInstance.get();
+    targetInstance->appendChild(newInstance.release());
 
     // Eventually enter recursion to build SVGElementInstance objects for the sub-tree children
-    buildInstanceTree(target, newInstance.get(), foundProblem);
-}
-
-void SVGUseElement::alterShadowTreeForSVGTag(SVGElement* target)
-{
-    String widthString = String::number(width().value(this));
-    String heightString = String::number(height().value(this));
-
-    if (hasAttribute(SVGNames::widthAttr))
-        target->setAttribute(SVGNames::widthAttr, widthString);
-
-    if (hasAttribute(SVGNames::heightAttr))
-        target->setAttribute(SVGNames::heightAttr, heightString);
+    buildInstanceTree(target, newInstancePtr, foundProblem);
 }
 
 void SVGUseElement::removeDisallowedElementsFromSubtree(Node* subtree)
@@ -559,7 +699,7 @@ void SVGUseElement::removeDisallowedElementsFromSubtree(Node* subtree)
     }
 }
 
-void SVGUseElement::buildShadowTree(SVGElement* target, SVGElementInstance* targetInstance)
+void SVGUseElement::buildShadowTree(SVGShadowTreeRootElement* shadowRoot, SVGElement* target, SVGElementInstance* targetInstance)
 {
     // For instance <use> on <foreignObject> (direct case).
     if (isDisallowedElement(target))
@@ -581,16 +721,12 @@ void SVGUseElement::buildShadowTree(SVGElement* target, SVGElementInstance* targ
     ASSERT(newChildPtr);
 
     ExceptionCode ec = 0;
-    m_shadowTreeRootElement->appendChild(newChild.release(), ec);
-    ASSERT(ec == 0);
-
-    // Handle use referencing <svg> special case
-    if (target->hasTagName(SVGNames::svgTag))
-        alterShadowTreeForSVGTag(newChildPtr);
+    shadowRoot->appendChild(newChild.release(), ec);
+    ASSERT(!ec);
 }
 
 #if ENABLE(SVG) && ENABLE(SVG_USE)
-void SVGUseElement::expandUseElementsInShadowTree(Node* element)
+void SVGUseElement::expandUseElementsInShadowTree(SVGShadowTreeRootElement* shadowRoot, Node* element)
 {
     // Why expand the <use> elements in the shadow tree here, and not just
     // do this directly in buildShadowTree, if we encounter a <use> element?
@@ -609,41 +745,15 @@ void SVGUseElement::expandUseElementsInShadowTree(Node* element)
             target = static_cast<SVGElement*>(targetElement);
 
         // Don't ASSERT(target) here, it may be "pending", too.
-        if (target) {
-            // Setup sub-shadow tree root node
-            RefPtr<SVGElement> cloneParent = new SVGGElement(SVGNames::gTag, document());
-
-            // Spec: In the generated content, the 'use' will be replaced by 'g', where all attributes from the
-            // 'use' element except for x, y, width, height and xlink:href are transferred to the generated 'g' element.
-            transferUseAttributesToReplacedElement(use, cloneParent.get());
-
-            // Spec: An additional transformation translate(x,y) is appended to the end
-            // (i.e., right-side) of the transform attribute on the generated 'g', where x
-            // and y represent the values of the x and y attributes on the 'use' element.
-            if (use->x().value(this) != 0.0 || use->y().value(this) != 0.0) {
-                if (!cloneParent->hasAttribute(SVGNames::transformAttr)) {
-                    String transformString = String::format("translate(%f, %f)", use->x().value(this), use->y().value(this));
-                    cloneParent->setAttribute(SVGNames::transformAttr, transformString);
-                } else {
-                    String transformString = String::format(" translate(%f, %f)", use->x().value(this), use->y().value(this));
-                    const AtomicString& transformAttribute = cloneParent->getAttribute(SVGNames::transformAttr);
-                    cloneParent->setAttribute(SVGNames::transformAttr, transformAttribute + transformString); 
-                }
-            }
+        // Setup sub-shadow tree root node
+        RefPtr<SVGShadowTreeContainerElement> cloneParent = new SVGShadowTreeContainerElement(document());
 
-            ExceptionCode ec = 0;
- 
-            // For instance <use> on <foreignObject> (direct case).
-            if (isDisallowedElement(target)) {
-                // We still have to setup the <use> replacment (<g>). Otherwhise
-                // associateInstancesWithShadowTreeElements() makes wrong assumptions.
-                // Replace <use> with referenced content.
-                ASSERT(use->parentNode()); 
-                use->parentNode()->replaceChild(cloneParent.release(), use, ec);
-                ASSERT(ec == 0);
-                return;
-            }
+        // Spec: In the generated content, the 'use' will be replaced by 'g', where all attributes from the
+        // 'use' element except for x, y, width, height and xlink:href are transferred to the generated 'g' element.
+        transferUseAttributesToReplacedElement(use, cloneParent.get());
 
+        ExceptionCode ec = 0;
+        if (target && !isDisallowedElement(target)) {
             RefPtr<Element> newChild = target->cloneElementWithChildren();
 
             // We don't walk the target tree element-by-element, and clone each element,
@@ -660,28 +770,24 @@ void SVGUseElement::expandUseElementsInShadowTree(Node* element)
             ASSERT(newChildPtr);
 
             cloneParent->appendChild(newChild.release(), ec);
-            ASSERT(ec == 0);
-
-            // Replace <use> with referenced content.
-            ASSERT(use->parentNode()); 
-            use->parentNode()->replaceChild(cloneParent.release(), use, ec);
-            ASSERT(ec == 0);
+            ASSERT(!ec);
+        }
 
-            // Handle use referencing <svg> special case
-            if (target->hasTagName(SVGNames::svgTag))
-                alterShadowTreeForSVGTag(newChildPtr);
+        // Replace <use> with referenced content.
+        ASSERT(use->parentNode()); 
+        use->parentNode()->replaceChild(cloneParent.release(), use, ec);
+        ASSERT(!ec);
 
-            // Immediately stop here, and restart expanding.
-            expandUseElementsInShadowTree(m_shadowTreeRootElement.get());
-            return;
-        }
+        // Immediately stop here, and restart expanding.
+        expandUseElementsInShadowTree(shadowRoot, shadowRoot);
+        return;
     }
 
     for (RefPtr<Node> child = element->firstChild(); child; child = child->nextSibling())
-        expandUseElementsInShadowTree(child.get());
+        expandUseElementsInShadowTree(shadowRoot, child.get());
 }
 
-void SVGUseElement::expandSymbolElementsInShadowTree(Node* element)
+void SVGUseElement::expandSymbolElementsInShadowTree(SVGShadowTreeRootElement* shadowRoot, Node* element)
 {
     if (element->hasTagName(SVGNames::symbolTag)) {
         // Spec: The referenced 'symbol' and its contents are deep-cloned into the generated tree,
@@ -695,20 +801,12 @@ void SVGUseElement::expandSymbolElementsInShadowTree(Node* element)
         // Transfer all attributes from <symbol> to the new <svg> element
         svgElement->attributes()->setAttributes(*element->attributes());
 
-        // Explicitly re-set width/height values
-        String widthString = String::number(width().value(this));
-        String heightString = String::number(height().value(this)); 
-
-        svgElement->setAttribute(SVGNames::widthAttr, hasAttribute(SVGNames::widthAttr) ? widthString : "100%");
-        svgElement->setAttribute(SVGNames::heightAttr, hasAttribute(SVGNames::heightAttr) ? heightString : "100%");
-
-        ExceptionCode ec = 0;
-
         // Only clone symbol children, and add them to the new <svg> element    
+        ExceptionCode ec = 0;
         for (Node* child = element->firstChild(); child; child = child->nextSibling()) {
             RefPtr<Node> newChild = child->cloneNode(true);
             svgElement->appendChild(newChild.release(), ec);
-            ASSERT(ec == 0);
+            ASSERT(!ec);
         }
     
         // We don't walk the target tree element-by-element, and clone each element,
@@ -722,43 +820,19 @@ void SVGUseElement::expandSymbolElementsInShadowTree(Node* element)
         // Replace <symbol> with <svg>.
         ASSERT(element->parentNode()); 
         element->parentNode()->replaceChild(svgElement.release(), element, ec);
-        ASSERT(ec == 0);
+        ASSERT(!ec);
 
         // Immediately stop here, and restart expanding.
-        expandSymbolElementsInShadowTree(m_shadowTreeRootElement.get());
+        expandSymbolElementsInShadowTree(shadowRoot, shadowRoot);
         return;
     }
 
     for (RefPtr<Node> child = element->firstChild(); child; child = child->nextSibling())
-        expandSymbolElementsInShadowTree(child.get());
+        expandSymbolElementsInShadowTree(shadowRoot, child.get());
 }
 
 #endif
-    
-void SVGUseElement::attachShadowTree()
-{
-    if (!m_shadowTreeRootElement || m_shadowTreeRootElement->attached() || !document()->shouldCreateRenderers() || !attached() || !renderer())
-        return;
-
-    // Inspired by RenderTextControl::createSubtreeIfNeeded(). 
-    if (renderer()->canHaveChildren() && childShouldCreateRenderer(m_shadowTreeRootElement.get())) {
-        RefPtr<RenderStyle> style = m_shadowTreeRootElement->styleForRenderer();
-
-        if (m_shadowTreeRootElement->rendererIsNeeded(style.get())) {
-            m_shadowTreeRootElement->setRenderer(m_shadowTreeRootElement->createRenderer(document()->renderArena(), style.get()));
-            if (RenderObject* shadowRenderer = m_shadowTreeRootElement->renderer()) {
-                shadowRenderer->setStyle(style.release());
-                renderer()->addChild(shadowRenderer, m_shadowTreeRootElement->nextRenderer());
-                m_shadowTreeRootElement->setAttached();
-            }
-        }
 
-        // This will take care of attaching all shadow tree child nodes.
-        for (Node* child = m_shadowTreeRootElement->firstChild(); child; child = child->nextSibling())
-            child->attach();
-    }
-}
- 
 void SVGUseElement::transferEventListenersToShadowTree(SVGElementInstance* target)
 {
     if (!target)
@@ -772,7 +846,7 @@ void SVGUseElement::transferEventListenersToShadowTree(SVGElementInstance* targe
             EventListenerMap& map = d->eventListenerMap;
             EventListenerMap::iterator end = map.end();
             for (EventListenerMap::iterator it = map.begin(); it != end; ++it) {
-                EventListenerVector& entry = it->second;
+                EventListenerVector& entry = *it->second;
                 for (size_t i = 0; i < entry.size(); ++i) {
                     // Event listeners created from markup have already been transfered to the shadow tree during cloning.
                     if (entry[i].listener->wasCreatedFromMarkup())
@@ -829,6 +903,11 @@ void SVGUseElement::associateInstancesWithShadowTreeElements(Node* target, SVGEl
 
 SVGElementInstance* SVGUseElement::instanceForShadowTreeElement(Node* element) const
 {
+    if (!m_targetElementInstance) {
+        ASSERT(!inDocument());
+        return 0;
+    }
+
     return instanceForShadowTreeElement(element, m_targetElementInstance.get());
 }
 
@@ -846,14 +925,19 @@ SVGElementInstance* SVGUseElement::instanceForShadowTreeElement(Node* element, S
         return instance;
 
     for (SVGElementInstance* current = instance->firstChild(); current; current = current->nextSibling()) {
-        SVGElementInstance* search = instanceForShadowTreeElement(element, current);
-        if (search)
+        if (SVGElementInstance* search = instanceForShadowTreeElement(element, current))
             return search;
     }
 
     return 0;
 }
 
+void SVGUseElement::invalidateShadowTree()
+{
+    m_needsShadowTreeRecreation = true;
+    setNeedsStyleRecalc();
+}
+
 void SVGUseElement::transferUseAttributesToReplacedElement(SVGElement* from, SVGElement* to) const
 {
     ASSERT(from);
@@ -864,19 +948,24 @@ void SVGUseElement::transferUseAttributesToReplacedElement(SVGElement* from, SVG
     ExceptionCode ec = 0;
 
     to->removeAttribute(SVGNames::xAttr, ec);
-    ASSERT(ec == 0);
+    ASSERT(!ec);
 
     to->removeAttribute(SVGNames::yAttr, ec);
-    ASSERT(ec == 0);
+    ASSERT(!ec);
 
     to->removeAttribute(SVGNames::widthAttr, ec);
-    ASSERT(ec == 0);
+    ASSERT(!ec);
 
     to->removeAttribute(SVGNames::heightAttr, ec);
-    ASSERT(ec == 0);
+    ASSERT(!ec);
 
     to->removeAttribute(XLinkNames::hrefAttr, ec);
-    ASSERT(ec == 0);
+    ASSERT(!ec);
+}
+
+bool SVGUseElement::hasRelativeValues() const
+{
+    return x().isRelative() || y().isRelative() || width().isRelative() || height().isRelative();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.h b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.h
index 45ca783f6a..6fb3925778 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.h
@@ -32,6 +32,7 @@ namespace WebCore {
 
     class SVGElementInstance;
     class SVGLength;
+    class SVGShadowTreeRootElement;
 
     class SVGUseElement : public SVGStyledTransformableElement,
                           public SVGTests,
@@ -52,11 +53,10 @@ namespace WebCore {
         virtual void buildPendingResource();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
-
         virtual void svgAttributeChanged(const QualifiedName&);
-        virtual void recalcStyle(StyleChange = NoChange);
+        virtual void synchronizeProperty(const QualifiedName&);
 
+        virtual void recalcStyle(StyleChange = NoChange);
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
         virtual void attach();
         virtual void detach();
@@ -65,20 +65,26 @@ namespace WebCore {
 
         static void removeDisallowedElementsFromSubtree(Node* element);
         SVGElementInstance* instanceForShadowTreeElement(Node* element) const;
+        void invalidateShadowTree();
+
+    private:
+        friend class RenderSVGShadowTreeRootContainer;
+        bool isPendingResource() const { return m_isPendingResource; }
+        void buildShadowAndInstanceTree(SVGShadowTreeRootElement*);
 
     private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::xAttrString, SVGLength, X, x)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::yAttrString, SVGLength, Y, y)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::widthAttrString, SVGLength, Width, width)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::heightAttrString, SVGLength, Height, height)
+        virtual bool hasRelativeValues() const;
+
+        DECLARE_ANIMATED_PROPERTY(SVGUseElement, SVGNames::xAttr, SVGLength, X, x)
+        DECLARE_ANIMATED_PROPERTY(SVGUseElement, SVGNames::yAttr, SVGLength, Y, y)
+        DECLARE_ANIMATED_PROPERTY(SVGUseElement, SVGNames::widthAttr, SVGLength, Width, width)
+        DECLARE_ANIMATED_PROPERTY(SVGUseElement, SVGNames::heightAttr, SVGLength, Height, height)
 
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+        DECLARE_ANIMATED_PROPERTY(SVGUseElement, XLinkNames::hrefAttr, String, Href, href)
 
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGUseElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
 
     private:
         // Instance tree handling
@@ -86,18 +92,13 @@ namespace WebCore {
         void handleDeepUseReferencing(SVGUseElement* use, SVGElementInstance* targetInstance, bool& foundCycle);
 
         // Shadow tree handling
-        PassRefPtr<SVGSVGElement> buildShadowTreeForSymbolTag(SVGElement* target, SVGElementInstance* targetInstance);
-        void alterShadowTreeForSVGTag(SVGElement* target);
-
-        void buildShadowTree(SVGElement* target, SVGElementInstance* targetInstance);
+        void buildShadowTree(SVGShadowTreeRootElement*, SVGElement* target, SVGElementInstance* targetInstance);
 
 #if ENABLE(SVG) && ENABLE(SVG_USE)
-        void expandUseElementsInShadowTree(Node* element);
-        void expandSymbolElementsInShadowTree(Node* element);
+        void expandUseElementsInShadowTree(SVGShadowTreeRootElement*, Node* element);
+        void expandSymbolElementsInShadowTree(SVGShadowTreeRootElement*, Node* element);
 #endif
 
-        void attachShadowTree();
-
         // "Tree connector" 
         void associateInstancesWithShadowTreeElements(Node* target, SVGElementInstance* targetInstance);
         SVGElementInstance* instanceForShadowTreeElement(Node* element, SVGElementInstance* instance) const;
@@ -105,11 +106,16 @@ namespace WebCore {
         void transferUseAttributesToReplacedElement(SVGElement* from, SVGElement* to) const;
         void transferEventListenersToShadowTree(SVGElementInstance* target);
 
-        RefPtr<SVGElement> m_shadowTreeRootElement;
+        void updateContainerOffsets();
+        void updateContainerSizes();
+
+        bool m_isPendingResource;
+        bool m_needsShadowTreeRecreation;
+        String m_resourceId;
         RefPtr<SVGElementInstance> m_targetElementInstance;
     };
 
-} // namespace WebCore
+}
 
-#endif // ENABLE(SVG)
+#endif
 #endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp
index af1d1fe97d..aba7283786 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -40,9 +38,6 @@ SVGViewElement::SVGViewElement(const QualifiedName& tagName, Document* doc)
     , SVGExternalResourcesRequired()
     , SVGFitToViewBox()
     , SVGZoomAndPan()
-    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
-    , m_viewBox(this, SVGNames::viewBoxAttr)
-    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
 }
 
@@ -72,6 +67,25 @@ void SVGViewElement::parseMappedAttribute(MappedAttribute* attr)
     }
 }
 
+void SVGViewElement::synchronizeProperty(const QualifiedName& attrName)
+{
+    SVGStyledElement::synchronizeProperty(attrName);
+
+    if (attrName == anyQName()) {
+        synchronizeExternalResourcesRequired();
+        synchronizeViewBox();
+        synchronizePreserveAspectRatio();
+        return;
+    }
+
+    if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        synchronizeExternalResourcesRequired();
+    else if (SVGFitToViewBox::isKnownAttribute(attrName)) {
+        synchronizeViewBox();
+        synchronizePreserveAspectRatio();
+    }
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGViewElement.h b/src/3rdparty/webkit/WebCore/svg/SVGViewElement.h
index 33d0ae35c1..f913fcd2cf 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGViewElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGViewElement.h
@@ -39,6 +39,7 @@ namespace WebCore {
         virtual ~SVGViewElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
+        virtual void synchronizeProperty(const QualifiedName&);
 
         SVGStringList* viewTarget() const;
 
@@ -46,13 +47,11 @@ namespace WebCore {
 
     private:
         // SVGExternalResourcesRequired
-        ANIMATED_PROPERTY_DECLARATIONS(SVGViewElement, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+        DECLARE_ANIMATED_PROPERTY(SVGViewElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
  
         // SVGFitToViewBox
-        ANIMATED_PROPERTY_DECLARATIONS(SVGViewElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGViewElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+        DECLARE_ANIMATED_PROPERTY(SVGViewElement, SVGNames::viewBoxAttr, FloatRect, ViewBox, viewBox)
+        DECLARE_ANIMATED_PROPERTY(SVGViewElement, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
  
         mutable RefPtr<SVGStringList> m_viewTarget;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.cpp b/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.cpp
index e6ded33b5e..608bdbf281 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.cpp
@@ -35,8 +35,6 @@ SVGViewSpec::SVGViewSpec(const SVGSVGElement* contextElement)
     : SVGFitToViewBox()
     , SVGZoomAndPan()
     , m_contextElement(contextElement)
-    , m_viewBox(this, SVGNames::viewBoxAttr)
-    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
     , m_transform(SVGTransformList::create(SVGNames::transformAttr))
 {
 }
@@ -62,9 +60,7 @@ void SVGViewSpec::setViewBoxString(const String& viewBox)
 
 void SVGViewSpec::setPreserveAspectRatioString(const String& preserve)
 {
-    const UChar* c = preserve.characters();
-    const UChar* end = c + preserve.length();
-    preserveAspectRatioBaseValue()->parsePreserveAspectRatio(c, end);
+    SVGPreserveAspectRatio::parsePreserveAspectRatio(this, preserve);
 }
 
 void SVGViewSpec::setViewTargetString(const String& viewTargetString)
@@ -141,7 +137,9 @@ bool SVGViewSpec::parseViewSpec(const String& viewSpec)
             if (currViewSpec >= end || *currViewSpec != '(')
                 return false;
             currViewSpec++;
-            if (!preserveAspectRatioBaseValue()->parsePreserveAspectRatio(currViewSpec, end, false))
+            bool result = false; 
+            setPreserveAspectRatioBaseValue(SVGPreserveAspectRatio::parsePreserveAspectRatio(currViewSpec, end, false, result));
+            if (!result)
                 return false;
             if (currViewSpec >= end || *currViewSpec != ')')
                 return false;
@@ -152,7 +150,7 @@ bool SVGViewSpec::parseViewSpec(const String& viewSpec)
             if (currViewSpec >= end || *currViewSpec != '(')
                 return false;
             currViewSpec++;
-            SVGTransformable::parseTransformAttribute(m_transform.get(), currViewSpec, end);
+            SVGTransformable::parseTransformAttribute(m_transform.get(), currViewSpec, end, SVGTransformable::DoNotClearList);
             if (currViewSpec >= end || *currViewSpec != ')')
                 return false;
             currViewSpec++;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.h b/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.h
index 090b7ae8b3..12358dc17e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.h
@@ -33,7 +33,8 @@ namespace WebCore {
     class SVGTransformList;
 
     class SVGViewSpec : public SVGFitToViewBox,
-                        public SVGZoomAndPan {
+                        public SVGZoomAndPan,
+                        public Noncopyable {
     public:
         SVGViewSpec(const SVGSVGElement*);
         virtual ~SVGViewSpec();
@@ -51,14 +52,14 @@ namespace WebCore {
         String viewTargetString() const { return m_viewTargetString; }
         SVGElement* viewTarget() const;
 
-        const SVGSVGElement* contextElement() const { return m_contextElement; }
+        SVGSVGElement* contextElement() const { return const_cast<SVGSVGElement*>(m_contextElement); }
 
     private:
         const SVGSVGElement* m_contextElement;
 
         // SVGFitToViewBox
-        ANIMATED_PROPERTY_DECLARATIONS(SVGViewSpec, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGViewSpec, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+        DECLARE_ANIMATED_PROPERTY(SVGViewSpec, SVGNames::viewBoxAttr, FloatRect, ViewBox, viewBox)
+        DECLARE_ANIMATED_PROPERTY(SVGViewSpec, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
 
         mutable RefPtr<SVGTransformList> m_transform;
         String m_viewTargetString;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGZoomAndPan.cpp b/src/3rdparty/webkit/WebCore/svg/SVGZoomAndPan.cpp
index c5eafb2cd6..b1ea995652 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGZoomAndPan.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGZoomAndPan.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGZoomAndPan.h b/src/3rdparty/webkit/WebCore/svg/SVGZoomAndPan.h
index d7be34207c..c11f8e284b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGZoomAndPan.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGZoomAndPan.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGZoomAndPan.idl b/src/3rdparty/webkit/WebCore/svg/SVGZoomAndPan.idl
index 6d6958329b..bd738f3c5b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGZoomAndPan.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGZoomAndPan.idl
@@ -26,7 +26,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, GenerateConstructor, ObjCProtocol] SVGZoomAndPan {
+    interface [Conditional=SVG, ObjCProtocol] SVGZoomAndPan {
         // Zoom and Pan Types
         const unsigned short SVG_ZOOMANDPAN_UNKNOWN = 0;
         const unsigned short SVG_ZOOMANDPAN_DISABLE = 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGZoomEvent.cpp b/src/3rdparty/webkit/WebCore/svg/SVGZoomEvent.cpp
index 2d5a8707d1..92609b10a5 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGZoomEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGZoomEvent.cpp
@@ -3,8 +3,6 @@
     Copyright (C) 2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.cpp b/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.cpp
deleted file mode 100644
index be8ab78494..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.cpp
+++ /dev/null
@@ -1,145 +0,0 @@
-/*
-    Copyright (C) Research In Motion Limited 2009. All rights reserved.
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "SynchronizablePropertyController.h"
-
-#include "NamedNodeMap.h"
-#include "Node.h"
-#include "SVGAnimatedProperty.h"
-
-namespace WebCore {
-
-void SynchronizableProperties::addProperty(SVGAnimatedPropertyBase* base)
-{
-    m_bases.add(base);
-}
-
-void SynchronizableProperties::synchronize()
-{
-    ASSERT(!m_bases.isEmpty());
-    if (m_shouldSynchronize) {
-        BaseSet::iterator it = m_bases.begin();
-        BaseSet::iterator end = m_bases.end();
-
-        for (; it != end; ++it) {
-            SVGAnimatedPropertyBase* base = *it;
-            ASSERT(base);
-            base->synchronize();
-        }
-    }
-}
-
-void SynchronizableProperties::startAnimation()
-{
-    ASSERT(!m_bases.isEmpty());
-    BaseSet::iterator it = m_bases.begin();
-    BaseSet::iterator end = m_bases.end();
-
-    for (; it != end; ++it) {
-        SVGAnimatedPropertyBase* base = *it;
-        ASSERT(base);
-        base->startAnimation();
-    }
-}
-
-void SynchronizableProperties::stopAnimation()
-{
-    ASSERT(!m_bases.isEmpty());
-    BaseSet::iterator it = m_bases.begin();
-    BaseSet::iterator end = m_bases.end();
-
-    for (; it != end; ++it) {
-        SVGAnimatedPropertyBase* base = *it;
-        ASSERT(base);
-        base->stopAnimation();
-    }
-}
-
-SynchronizablePropertyController::SynchronizablePropertyController()
-{
-}
-
-void SynchronizablePropertyController::registerProperty(const QualifiedName& attrName, SVGAnimatedPropertyBase* base)
-{
-    // 'attrName' is ambigious. For instance in SVGMarkerElement both 'orientType' / 'orientAngle'
-    // SVG DOM objects are synchronized with the 'orient' attribute. This why we need a HashSet.
-    PropertyMap::iterator it = m_map.find(attrName.localName());
-    if (it == m_map.end()) {
-        SynchronizableProperties properties;
-        properties.addProperty(base);
-        m_map.set(attrName.localName(), properties);
-        return;
-    }
-
-    it->second.addProperty(base);
-}
-
-void SynchronizablePropertyController::setPropertyNeedsSynchronization(const QualifiedName& attrName)
-{
-    PropertyMap::iterator itProp = m_map.find(attrName.localName());
-    ASSERT(itProp != m_map.end());
-
-    itProp->second.setNeedsSynchronization();
-}
-
-void SynchronizablePropertyController::synchronizeProperty(const String& name)
-{
-    PropertyMap::iterator itProp = m_map.find(name);
-    if (itProp == m_map.end())
-        return;
-
-    itProp->second.synchronize();
-}
-
-void SynchronizablePropertyController::synchronizeAllProperties()
-{
-    if (m_map.isEmpty())
-        return;
-
-    PropertyMap::iterator itProp = m_map.begin();
-    PropertyMap::iterator endProp = m_map.end();
-
-    for (; itProp != endProp; ++itProp)
-        itProp->second.synchronize();
-}
-
-void SynchronizablePropertyController::startAnimation(const String& name)
-{
-    PropertyMap::iterator itProp = m_map.find(name);
-    if (itProp == m_map.end())
-        return;
-
-    itProp->second.startAnimation();
-}
-
-void SynchronizablePropertyController::stopAnimation(const String& name)
-{
-    PropertyMap::iterator itProp = m_map.find(name);
-    if (itProp == m_map.end())
-        return;
-
-    itProp->second.stopAnimation();
-}
-
-}
-
-#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.h b/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.h
deleted file mode 100644
index 1ec50265d1..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.h
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
-    Copyright (C) Research In Motion Limited 2009. All rights reserved.
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef SynchronizablePropertyController_h
-#define SynchronizablePropertyController_h
-
-#if ENABLE(SVG)
-#include "StringHash.h"
-#include <wtf/HashMap.h>
-#include <wtf/HashSet.h>
-#include <wtf/Noncopyable.h>
-
-namespace WebCore {
-
-class QualifiedName;
-class SVGAnimatedPropertyBase;
-
-class SynchronizableProperties {
-public:
-    SynchronizableProperties()
-        : m_shouldSynchronize(false)
-    {
-    }
-
-    void setNeedsSynchronization()
-    {
-        m_shouldSynchronize = true;
-    }
-
-    void addProperty(SVGAnimatedPropertyBase*);
-    void synchronize();
-    void startAnimation();
-    void stopAnimation();
-
-private:
-    typedef HashSet<SVGAnimatedPropertyBase*> BaseSet;
-
-    BaseSet m_bases;
-    bool m_shouldSynchronize;
-};
-
-// Helper class used exclusively by SVGElement to keep track of all animatable properties within a SVGElement,
-// and wheter they are supposed to be synchronized or not (depending wheter AnimatedPropertyTearOff's have been created)
-class SynchronizablePropertyController : public Noncopyable {
-public:
-    void registerProperty(const QualifiedName&, SVGAnimatedPropertyBase*);
-    void setPropertyNeedsSynchronization(const QualifiedName&);
-
-    void synchronizeProperty(const String&);
-    void synchronizeAllProperties();
-
-    void startAnimation(const String&);
-    void stopAnimation(const String&);
-
-private:
-    friend class SVGElement;
-    SynchronizablePropertyController();
-
-private:
-    typedef HashMap<String, SynchronizableProperties> PropertyMap;
-
-    PropertyMap m_map;
-};
-
-};
-
-#endif // ENABLE(SVG)
-#endif // SynchronizablePropertyController_h
diff --git a/src/3rdparty/webkit/WebCore/svg/SynchronizableTypeWrapper.h b/src/3rdparty/webkit/WebCore/svg/SynchronizableTypeWrapper.h
deleted file mode 100644
index 12f84263d9..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/SynchronizableTypeWrapper.h
+++ /dev/null
@@ -1,180 +0,0 @@
-/*
-    Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef SynchronizableTypeWrapper_h
-#define SynchronizableTypeWrapper_h
-
-#if ENABLE(SVG)
-#include <wtf/Noncopyable.h>
-
-namespace WebCore {
-
-    template<typename StoredType>
-    class SynchronizableTypeWrapperBase : public Noncopyable {
-    protected:
-        SynchronizableTypeWrapperBase();
-
-        template<typename AssignableType>
-        void assign(AssignableType type);
-
-        bool needsSynchronization() const;
-        void setSynchronized();
-
-    protected:
-        StoredType m_value;
-        bool m_needsSynchronization;
-    };
-
-    template<typename StoredType>
-    class SynchronizableTypeWrapper : private SynchronizableTypeWrapperBase<StoredType> {
-    public:
-        typedef SynchronizableTypeWrapperBase<StoredType> Base;
-        SynchronizableTypeWrapper();
- 
-        // "Forwarding constructors" for primitive type assignment with more than one argument, for exampe SVGLength
-        template<typename T1> SynchronizableTypeWrapper(const T1&);
-        template<typename T1, typename T2> SynchronizableTypeWrapper(const T1&, const T2&);
-        template<typename T1, typename T2, typename T3> SynchronizableTypeWrapper(const T1&, const T2&, const T3&);
-
-        SynchronizableTypeWrapper& operator=(const StoredType&);
-        operator StoredType() const;
-
-        using Base::needsSynchronization;
-        using Base::setSynchronized;
-
-    private:
-        using Base::m_value;
-    };
-
-    template<typename StoredPointerType>
-    class SynchronizableTypeWrapper<RefPtr<StoredPointerType> > : private SynchronizableTypeWrapperBase<RefPtr<StoredPointerType> > {
-    public:
-        typedef SynchronizableTypeWrapperBase<RefPtr<StoredPointerType> > Base;
-        SynchronizableTypeWrapper();
-        SynchronizableTypeWrapper(const PassRefPtr<StoredPointerType>&);
-
-        SynchronizableTypeWrapper& operator=(StoredPointerType*);
-        operator StoredPointerType*() const;
-
-        using Base::needsSynchronization;
-        using Base::setSynchronized;
-
-    private:
-        using Base::m_value;
-    };
-
-    // SynchronizableTypeWrapperBase implementation
-    template<typename StoredType>
-    inline SynchronizableTypeWrapperBase<StoredType>::SynchronizableTypeWrapperBase()
-        : m_value()
-        , m_needsSynchronization(false)
-    {
-    }
-
-    template<typename StoredType> template<typename AssignableType>
-    inline void SynchronizableTypeWrapperBase<StoredType>::assign(AssignableType type)
-    {
-        m_value = type;
-        m_needsSynchronization = true;
-    }
-
-    template<typename StoredType>
-    inline bool SynchronizableTypeWrapperBase<StoredType>::needsSynchronization() const
-    {
-        return m_needsSynchronization;
-    }
-
-    template<typename StoredType>
-    inline void SynchronizableTypeWrapperBase<StoredType>::setSynchronized()
-    {
-        m_needsSynchronization = false;
-    }
-
-    // SynchronizableTypeWrapper implementation for primitive types
-    template<typename StoredType>
-    inline SynchronizableTypeWrapper<StoredType>::SynchronizableTypeWrapper()
-        : Base()
-    {
-    }
-
-    template<typename StoredType> template<typename T1>
-    inline SynchronizableTypeWrapper<StoredType>::SynchronizableTypeWrapper(const T1& arg1)
-        : Base()
-    {
-        m_value = StoredType(arg1);
-    }
-
-    template<typename StoredType> template<typename T1, typename T2>
-    inline SynchronizableTypeWrapper<StoredType>::SynchronizableTypeWrapper(const T1& arg1, const T2& arg2)
-        : Base()
-    {
-        m_value = StoredType(arg1, arg2);
-    }
-
-    template<typename StoredType> template<typename T1, typename T2, typename T3>
-    inline SynchronizableTypeWrapper<StoredType>::SynchronizableTypeWrapper(const T1& arg1, const T2& arg2, const T3& arg3)
-        : Base()
-    {
-        m_value = StoredType(arg1, arg2, arg3);
-    }
-
-    template<typename StoredType>
-    inline SynchronizableTypeWrapper<StoredType>& SynchronizableTypeWrapper<StoredType>::operator=(const StoredType& other)
-    {
-        Base::assign(other);
-        return (*this);
-    }
-
-    template<typename StoredType>
-    inline SynchronizableTypeWrapper<StoredType>::operator StoredType() const
-    {
-        return m_value;
-    }
-
-    // SynchronizableTypeWrapper implementation for refcounted types
-    template<typename StoredPointerType>
-    inline SynchronizableTypeWrapper<RefPtr<StoredPointerType> >::SynchronizableTypeWrapper()
-        : Base()
-    {
-    }
-
-    template<typename StoredPointerType>
-    inline SynchronizableTypeWrapper<RefPtr<StoredPointerType> >::SynchronizableTypeWrapper(const PassRefPtr<StoredPointerType>& type)
-        : Base()
-    {
-        Base::m_value = type;
-    }
-
-    template<typename StoredPointerType>
-    inline SynchronizableTypeWrapper<RefPtr<StoredPointerType> >& SynchronizableTypeWrapper<RefPtr<StoredPointerType> >::operator=(StoredPointerType* other)
-    {
-        Base::assign(other);
-        return (*this);
-    }
-
-    template<typename StoredPointerType>
-    inline SynchronizableTypeWrapper<RefPtr<StoredPointerType> >::operator StoredPointerType*() const
-    {
-        return Base::m_value.get();
-    }
-
-};
-
-#endif
-#endif
diff --git a/src/3rdparty/webkit/WebCore/svg/animation/SMILTimeContainer.cpp b/src/3rdparty/webkit/WebCore/svg/animation/SMILTimeContainer.cpp
index a37e48166f..f0b479dd6d 100644
--- a/src/3rdparty/webkit/WebCore/svg/animation/SMILTimeContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/animation/SMILTimeContainer.cpp
@@ -46,6 +46,7 @@ SMILTimeContainer::SMILTimeContainer(SVGSVGElement* owner)
     : m_beginTime(0)
     , m_pauseTime(0)
     , m_accumulatedPauseTime(0)
+    , m_nextManualSampleTime(0)
     , m_documentOrderIndexesDirty(false)
     , m_timer(this, &SMILTimeContainer::timerFired)
     , m_ownerSVGElement(owner)
@@ -207,14 +208,45 @@ String SMILTimeContainer::baseValueFor(ElementAttributePair key)
     m_savedBaseValues.add(key, baseValue);
     return baseValue;
 }
-      
+
+void SMILTimeContainer::sampleAnimationAtTime(const String& elementId, double newTime)
+{
+    ASSERT(m_beginTime);
+    ASSERT(!isPaused());
+
+    // Fast-forward to the time DRT wants to sample
+    m_timer.stop();
+    m_nextSamplingTarget = elementId;
+    m_nextManualSampleTime = newTime;
+
+    updateAnimations(elapsed());
+}
+
 void SMILTimeContainer::updateAnimations(SMILTime elapsed)
 {
     SMILTime earliersFireTime = SMILTime::unresolved();
 
     Vector<SVGSMILElement*> toAnimate;
     copyToVector(m_scheduledAnimations, toAnimate);
-    
+
+    if (m_nextManualSampleTime) {
+        SMILTime samplingDiff;
+        for (unsigned n = 0; n < toAnimate.size(); ++n) {
+            SVGSMILElement* animation = toAnimate[n];
+            ASSERT(animation->timeContainer() == this);
+
+            SVGElement* targetElement = animation->targetElement();
+            if (!targetElement || targetElement->getIDAttribute() != m_nextSamplingTarget)
+                continue;
+
+            samplingDiff = animation->intervalBegin();
+            break;
+        }
+
+        elapsed = SMILTime(m_nextManualSampleTime) + samplingDiff;
+        m_nextManualSampleTime = 0;
+    }
+
     // Sort according to priority. Elements with later begin time have higher priority.
     // In case of a tie, document order decides. 
     // FIXME: This should also consider timing relationships between the elements. Dependents
diff --git a/src/3rdparty/webkit/WebCore/svg/animation/SMILTimeContainer.h b/src/3rdparty/webkit/WebCore/svg/animation/SMILTimeContainer.h
index 5cef5078fb..e11cc6f3b2 100644
--- a/src/3rdparty/webkit/WebCore/svg/animation/SMILTimeContainer.h
+++ b/src/3rdparty/webkit/WebCore/svg/animation/SMILTimeContainer.h
@@ -32,6 +32,7 @@
 #include "SMILTime.h"
 #include "StringHash.h"
 #include "Timer.h"
+#include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -60,6 +61,9 @@ namespace WebCore {
         
         void setDocumentOrderIndexesDirty() { m_documentOrderIndexesDirty = true; }
 
+        // Move to a specific time. Only used for DRT testing purposes.
+        void sampleAnimationAtTime(const String& elementId, double seconds);
+
     private:
         SMILTimeContainer(SVGSVGElement* owner);
         
@@ -76,7 +80,9 @@ namespace WebCore {
         double m_beginTime;
         double m_pauseTime;
         double m_accumulatedPauseTime;
-        
+        double m_nextManualSampleTime;
+        String m_nextSamplingTarget;
+
         bool m_documentOrderIndexesDirty;
         
         Timer<SMILTimeContainer> m_timer;
diff --git a/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.cpp b/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.cpp
index 3957b816ba..2bd33dd4f3 100644
--- a/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.cpp
@@ -56,9 +56,9 @@ static const double invalidCachedTime = -1.;
     
 class ConditionEventListener : public EventListener {
 public:
-    static PassRefPtr<ConditionEventListener> create(SVGSMILElement* animation, Element* eventBase, SVGSMILElement::Condition* condition)
+    static PassRefPtr<ConditionEventListener> create(SVGSMILElement* animation, SVGSMILElement::Condition* condition)
     {
-        return adoptRef(new ConditionEventListener(animation, eventBase, condition));
+        return adoptRef(new ConditionEventListener(animation, condition));
     }
 
     static const ConditionEventListener* cast(const EventListener* listener)
@@ -69,42 +69,38 @@ public:
     }
 
     virtual bool operator==(const EventListener& other);
-
-    void unregister()
+    
+    void disconnectAnimation()
     {
-        // If this has only one ref then the event base is dead already and we don't need to remove ourself.
-        if (!hasOneRef())
-            m_eventBase->removeEventListener(m_condition->m_name, this, false);
+        m_animation = 0;
     }
 
 private:
-    ConditionEventListener(SVGSMILElement* animation, Element* eventBase, SVGSMILElement::Condition* condition) 
+    ConditionEventListener(SVGSMILElement* animation, SVGSMILElement::Condition* condition) 
         : EventListener(ConditionEventListenerType)
         , m_animation(animation)
         , m_condition(condition) 
-        , m_eventBase(eventBase)
     {
-        m_eventBase->addEventListener(m_condition->m_name, this, false);
     }
 
     virtual void handleEvent(ScriptExecutionContext*, Event*);
 
     SVGSMILElement* m_animation;
     SVGSMILElement::Condition* m_condition;
-    Element* m_eventBase;
 };
 
 bool ConditionEventListener::operator==(const EventListener& listener)
 {
     if (const ConditionEventListener* conditionEventListener = ConditionEventListener::cast(&listener))
-        return m_animation == conditionEventListener->m_animation
-               && m_condition == conditionEventListener->m_condition
-               && m_eventBase == conditionEventListener->m_eventBase;
+        return m_animation == conditionEventListener->m_animation &&
+               m_condition == conditionEventListener->m_condition;
     return false;
 }
 
 void ConditionEventListener::handleEvent(ScriptExecutionContext*, Event* event) 
 {
+    if (!m_animation)
+        return;
     m_animation->handleConditionEvent(event, m_condition);
 }
 
@@ -394,6 +390,11 @@ void SVGSMILElement::attributeChanged(Attribute* attr, bool preserveDecls)
     }
 }
 
+inline Element* SVGSMILElement::eventBaseFor(const Condition& condition) const
+{
+    return condition.m_baseID.isEmpty() ? targetElement() : document()->getElementById(condition.m_baseID);
+}
+
 void SVGSMILElement::connectConditions()
 {
     if (m_conditionsConnected)
@@ -403,11 +404,12 @@ void SVGSMILElement::connectConditions()
         Condition& condition = m_conditions[n];
         if (condition.m_type == Condition::EventBase) {
             ASSERT(!condition.m_syncbase);
-            Element* eventBase = condition.m_baseID.isEmpty() ? targetElement() : document()->getElementById(condition.m_baseID);
+            Element* eventBase = eventBaseFor(condition);
             if (!eventBase)
                 continue;
             ASSERT(!condition.m_eventListener);
-            condition.m_eventListener = ConditionEventListener::create(this, eventBase, &condition);
+            condition.m_eventListener = ConditionEventListener::create(this, &condition);
+            eventBase->addEventListener(condition.m_name, condition.m_eventListener, false);
         } else if (condition.m_type == Condition::Syncbase) {
             ASSERT(!condition.m_baseID.isEmpty());
             condition.m_syncbase = document()->getElementById(condition.m_baseID);
@@ -430,10 +432,18 @@ void SVGSMILElement::disconnectConditions()
         Condition& condition = m_conditions[n];
         if (condition.m_type == Condition::EventBase) {
             ASSERT(!condition.m_syncbase);
-            if (condition.m_eventListener) {
-                condition.m_eventListener->unregister();
-                condition.m_eventListener = 0;
-            }
+            if (!condition.m_eventListener)
+                continue;
+            // Note: It's a memory optimization to try to remove our condition
+            // event listener, but it's not guaranteed to work, since we have
+            // no guarantee that eventBaseFor() will be able to find our condition's
+            // original eventBase. So, we also have to disconnect ourselves from
+            // our condition event listener, in case it later fires.
+            Element* eventBase = eventBaseFor(condition);
+            if (eventBase)
+                eventBase->removeEventListener(condition.m_name, condition.m_eventListener.get(), false);
+            condition.m_eventListener->disconnectAnimation();
+            condition.m_eventListener = 0;
         } else if (condition.m_type == Condition::Syncbase) {
             if (condition.m_syncbase) {
                 ASSERT(isSMILElement(condition.m_syncbase.get()));
diff --git a/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.h b/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.h
index b61f20d25e..8fcc2fcbfb 100644
--- a/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.h
@@ -133,7 +133,8 @@ private:
         };
         bool parseCondition(const String&, BeginOrEnd beginOrEnd);
         void parseBeginOrEnd(const String&, BeginOrEnd beginOrEnd);
-        
+        Element* eventBaseFor(const Condition&) const;
+
         void connectConditions();
         void disconnectConditions();
         
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
index b74e912278..febfce82df 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
@@ -30,6 +30,7 @@
 
 #include "CachedPage.h"
 #include "DocumentLoader.h"
+#include "FileChooser.h"
 #include "FloatRect.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -54,7 +55,7 @@
 
 namespace WebCore {
 
-class SVGImageChromeClient : public EmptyChromeClient {
+class SVGImageChromeClient : public EmptyChromeClient, public Noncopyable {
 public:
     SVGImageChromeClient(SVGImage* image)
         : m_image(image)
@@ -173,7 +174,7 @@ bool SVGImage::hasRelativeHeight() const
     return rootElement->height().unitType() == LengthTypePercentage;
 }
 
-void SVGImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator compositeOp)
+void SVGImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace, CompositeOperator compositeOp)
 {
     if (!m_page)
         return;
@@ -192,7 +193,7 @@ void SVGImage::draw(GraphicsContext* context, const FloatRect& dstRect, const Fl
 
     if (view->needsLayout())
         view->layout();
-    view->paint(context, enclosingIntRect(srcRect));
+    view->paint(context, IntRect(0, 0, view->width(), view->height()));
 
     if (compositeOp != CompositeSourceOver)
         context->endTransparencyLayer();
@@ -214,7 +215,7 @@ NativeImagePtr SVGImage::nativeImageForCurrentFrame()
         m_frameCache = ImageBuffer::create(size());
         if (!m_frameCache) // failed to allocate image
             return 0;
-        renderSubtreeToImage(m_frameCache.get(), m_page->mainFrame()->contentRenderer());
+        draw(m_frameCache->context(), rect(), rect(), DeviceColorSpace, CompositeSourceOver);
     }
     return m_frameCache->image()->nativeImageForCurrentFrame();
 }
@@ -245,7 +246,7 @@ bool SVGImage::dataChanged(bool allDataReceived)
         // FIXME: If this SVG ends up loading itself, we might leak the world.
         // The comment said that the Cache code does not know about CachedImages
         // holding Frames and won't know to break the cycle. But 
-        m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient, 0));
+        m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient, 0, 0));
         m_page->settings()->setJavaScriptEnabled(false);
         m_page->settings()->setPluginsEnabled(false);
 
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.h
index 0f0542953f..a0414fe781 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.h
@@ -66,7 +66,7 @@ namespace WebCore {
         virtual NativeImagePtr frameAtIndex(size_t) { return 0; }
         
         SVGImage(ImageObserver*);
-        virtual void draw(GraphicsContext*, const FloatRect& fromRect, const FloatRect& toRect, CompositeOperator);
+        virtual void draw(GraphicsContext*, const FloatRect& fromRect, const FloatRect& toRect, ColorSpace styleColorSpace, CompositeOperator);
         
         virtual NativeImagePtr nativeImageForCurrentFrame();
         
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.cpp
index 728ff1b86b..0ac3a358bd 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.cpp
@@ -57,9 +57,9 @@ TextStream& operator<<(TextStream& ts, const SVGPaintServer& paintServer)
     return paintServer.externalRepresentation(ts);
 }
 
-SVGPaintServer* getPaintServerById(Document* document, const AtomicString& id)
+SVGPaintServer* getPaintServerById(Document* document, const AtomicString& id, const RenderObject* object)
 {
-    SVGResource* resource = getResourceById(document, id);
+    SVGResource* resource = getResourceById(document, id, object);
     if (resource && resource->isPaintServer())
         return static_cast<SVGPaintServer*>(resource);
 
@@ -85,7 +85,7 @@ SVGPaintServer* SVGPaintServer::fillPaintServer(const RenderStyle* style, const
     if (paintType == SVGPaint::SVG_PAINTTYPE_URI ||
         paintType == SVGPaint::SVG_PAINTTYPE_URI_RGBCOLOR) {
         AtomicString id(SVGURIReference::getTarget(fill->uri()));
-        fillPaintServer = getPaintServerById(item->document(), id);
+        fillPaintServer = getPaintServerById(item->document(), id, item);
 
         SVGElement* svgElement = static_cast<SVGElement*>(item->node());
         ASSERT(svgElement && svgElement->document() && svgElement->isStyled());
@@ -123,10 +123,12 @@ SVGPaintServer* SVGPaintServer::strokePaintServer(const RenderStyle* style, cons
 
     SVGPaintServer* strokePaintServer = 0;
     SVGPaint::SVGPaintType paintType = stroke->paintType();
-    if (paintType == SVGPaint::SVG_PAINTTYPE_URI ||
-        paintType == SVGPaint::SVG_PAINTTYPE_URI_RGBCOLOR) {
+    if ((paintType == SVGPaint::SVG_PAINTTYPE_URI
+        || paintType == SVGPaint::SVG_PAINTTYPE_URI_RGBCOLOR)
+        && item->objectBoundingBox().width() != 0
+        && item->objectBoundingBox().height() != 0) {
         AtomicString id(SVGURIReference::getTarget(stroke->uri()));
-        strokePaintServer = getPaintServerById(item->document(), id);
+        strokePaintServer = getPaintServerById(item->document(), id, item);
 
         SVGElement* svgElement = static_cast<SVGElement*>(item->node());
         ASSERT(svgElement && svgElement->document() && svgElement->isStyled());
@@ -147,11 +149,16 @@ SVGPaintServer* SVGPaintServer::strokePaintServer(const RenderStyle* style, cons
         if (!strokePaintServerSolid->color().isValid())
             strokePaintServer = 0;
     }
+    if (!strokePaintServer) {
+        // default value (black), see bug 11017
+        strokePaintServer = sharedSolidPaintServer();
+        static_cast<SVGPaintServerSolid*>(strokePaintServer)->setColor(Color::black);
+    }
 
     return strokePaintServer;
 }
 
-void applyStrokeStyleToContext(GraphicsContext* context, RenderStyle* style, const RenderObject* object)
+void applyStrokeStyleToContext(GraphicsContext* context, const RenderStyle* style, const RenderObject* object)
 {
     context->setStrokeThickness(SVGRenderStyle::cssPrimitiveToLength(object, style->svgStyle()->strokeWidth(), 1.0f));
     context->setLineCap(style->svgStyle()->capStyle());
@@ -164,6 +171,11 @@ void applyStrokeStyleToContext(GraphicsContext* context, RenderStyle* style, con
     context->setLineDash(dashes, dashOffset);
 }
 
+bool SVGPaintServer::setup(GraphicsContext*& context, const RenderObject* object, SVGPaintTargetType type, bool isPaintingText) const
+{
+    return setup(context, object, object ? object->style() : 0, type, isPaintingText);
+}
+
 void SVGPaintServer::draw(GraphicsContext*& context, const RenderObject* path, SVGPaintTargetType type) const
 {
     if (!setup(context, path, type))
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.h
index 244243ccbb..d9d2218714 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.h
@@ -29,6 +29,7 @@
 #if ENABLE(SVG)
 
 #include "DashArray.h"
+#include "RenderObject.h"
 #include "SVGResource.h"
 
 #if PLATFORM(CG)
@@ -70,7 +71,9 @@ namespace WebCore {
         virtual void teardown(GraphicsContext*&, const RenderObject*, SVGPaintTargetType, bool isPaintingText = false) const;
         virtual void renderPath(GraphicsContext*&, const RenderObject*, SVGPaintTargetType) const;
 
-        virtual bool setup(GraphicsContext*&, const RenderObject*, SVGPaintTargetType, bool isPaintingText = false) const = 0;
+        virtual bool setup(GraphicsContext*&, const RenderObject*, const RenderStyle*, SVGPaintTargetType, bool isPaintingText = false) const = 0;
+
+        bool setup(GraphicsContext*&, const RenderObject*, SVGPaintTargetType, bool isPaintingText = false) const;
 
         static SVGPaintServer* strokePaintServer(const RenderStyle*, const RenderObject*);
         static SVGPaintServer* fillPaintServer(const RenderStyle*, const RenderObject*);
@@ -82,9 +85,9 @@ namespace WebCore {
 
     TextStream& operator<<(TextStream&, const SVGPaintServer&);
 
-    SVGPaintServer* getPaintServerById(Document*, const AtomicString&);
+    SVGPaintServer* getPaintServerById(Document*, const AtomicString&, const RenderObject*);
 
-    void applyStrokeStyleToContext(GraphicsContext*, RenderStyle*, const RenderObject*);
+    void applyStrokeStyleToContext(GraphicsContext*, const RenderStyle*, const RenderObject*);
     DashArray dashArrayFromRenderingStyle(const RenderStyle* style, RenderStyle* rootStyle);
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.cpp
index 4a8e9e0a0f..6e6ebfc17c 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.cpp
@@ -106,94 +106,88 @@ void SVGPaintServerGradient::setBoundingBoxMode(bool mode)
     m_boundingBoxMode = mode;
 }
 
-TransformationMatrix SVGPaintServerGradient::gradientTransform() const
+AffineTransform SVGPaintServerGradient::gradientTransform() const
 {
     return m_gradientTransform;
 }
 
-void SVGPaintServerGradient::setGradientTransform(const TransformationMatrix& transform)
+void SVGPaintServerGradient::setGradientTransform(const AffineTransform& transform)
 {
     m_gradientTransform = transform;
 }
 
 #if PLATFORM(CG)
-static inline const RenderObject* findTextRootObject(const RenderObject* start)
+static inline AffineTransform absoluteTransformForRenderer(const RenderObject* object)
 {
-    while (start && !start->isSVGText())
-        start = start->parent();
-    ASSERT(start);
-    ASSERT(start->isSVGText());
+    AffineTransform absoluteTransform;
 
-    return start;
+    const RenderObject* currentObject = object;
+    while (currentObject) {
+        absoluteTransform = currentObject->localToParentTransform() * absoluteTransform;
+        currentObject = currentObject->parent();
+    }
+
+    return absoluteTransform;
 }
 
 static inline bool createMaskAndSwapContextForTextGradient(
     GraphicsContext*& context, GraphicsContext*& savedContext,
     OwnPtr<ImageBuffer>& imageBuffer, const RenderObject* object)
 {
-    FloatRect maskBBox = const_cast<RenderObject*>(findTextRootObject(object))->objectBoundingBox();
-    IntRect maskRect = enclosingIntRect(object->absoluteTransform().mapRect(maskBBox));
+    const RenderObject* textRootBlock = findTextRootObject(object);
 
-    IntSize maskSize(maskRect.width(), maskRect.height());
-    clampImageBufferSizeToViewport(object->view()->frameView(), maskSize);
+    AffineTransform transform = absoluteTransformForRenderer(textRootBlock);
+    FloatRect maskAbsoluteBoundingBox = transform.mapRect(textRootBlock->repaintRectInLocalCoordinates());
 
-    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskSize);
+    IntRect maskImageRect = enclosingIntRect(maskAbsoluteBoundingBox);
+    if (maskImageRect.isEmpty())
+        return false;
 
+    // Allocate an image buffer as big as the absolute unclipped size of the object
+    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskImageRect.size());
     if (!maskImage)
         return false;
 
     GraphicsContext* maskImageContext = maskImage->context();
 
-    maskImageContext->save();
-    maskImageContext->translate(-maskRect.x(), -maskRect.y());
-    maskImageContext->concatCTM(object->absoluteTransform());
+    // Transform the mask image coordinate system to absolute screen coordinates
+    maskImageContext->translate(-maskAbsoluteBoundingBox.x(), -maskAbsoluteBoundingBox.y());
+    maskImageContext->concatCTM(transform);
 
     imageBuffer.set(maskImage.release());
     savedContext = context;
-
     context = maskImageContext;
 
     return true;
 }
 
-static inline TransformationMatrix clipToTextMask(GraphicsContext* context,
+static inline AffineTransform clipToTextMask(GraphicsContext* context,
     OwnPtr<ImageBuffer>& imageBuffer, const RenderObject* object,
     const SVGPaintServerGradient* gradientServer)
 {
-    FloatRect maskBBox = const_cast<RenderObject*>(findTextRootObject(object))->objectBoundingBox();
-
-    // Fixup transformations to be able to clip to mask
-    TransformationMatrix transform = object->absoluteTransform();
-    FloatRect textBoundary = transform.mapRect(maskBBox);
-
-    IntSize maskSize(lroundf(textBoundary.width()), lroundf(textBoundary.height()));
-    clampImageBufferSizeToViewport(object->view()->frameView(), maskSize);
-    textBoundary.setSize(textBoundary.size().shrunkTo(maskSize));
+    const RenderObject* textRootBlock = findTextRootObject(object);
+    context->clipToImageBuffer(textRootBlock->repaintRectInLocalCoordinates(), imageBuffer.get());
 
-    // Clip current context to mask image (gradient)
-    context->concatCTM(transform.inverse());
-    context->clipToImageBuffer(textBoundary, imageBuffer.get());
-    context->concatCTM(transform);
-
-    TransformationMatrix matrix;
+    AffineTransform matrix;
     if (gradientServer->boundingBoxMode()) {
-        matrix.translate(maskBBox.x(), maskBBox.y());
-        matrix.scaleNonUniform(maskBBox.width(), maskBBox.height());
+        FloatRect maskBoundingBox = textRootBlock->objectBoundingBox();
+        matrix.translate(maskBoundingBox.x(), maskBoundingBox.y());
+        matrix.scaleNonUniform(maskBoundingBox.width(), maskBoundingBox.height());
     }
     matrix.multiply(gradientServer->gradientTransform());
     return matrix;
 }
 #endif
 
-bool SVGPaintServerGradient::setup(GraphicsContext*& context, const RenderObject* object, SVGPaintTargetType type, bool isPaintingText) const
+bool SVGPaintServerGradient::setup(GraphicsContext*& context, const RenderObject* object, const RenderStyle*style, SVGPaintTargetType type, bool isPaintingText) const
 {
     m_ownerElement->buildGradient();
 
-    const SVGRenderStyle* style = object->style()->svgStyle();
-    bool isFilled = (type & ApplyToFillTargetType) && style->hasFill();
-    bool isStroked = (type & ApplyToStrokeTargetType) && style->hasStroke();
+    const SVGRenderStyle* svgStyle = style->svgStyle();
+    bool isFilled = (type & ApplyToFillTargetType) && svgStyle->hasFill();
+    bool isStroked = (type & ApplyToStrokeTargetType) && svgStyle->hasStroke();
 
-    ASSERT(isFilled && !isStroked || !isFilled && isStroked);
+    ASSERT((isFilled && !isStroked) || (!isFilled && isStroked));
 
     context->save();
 
@@ -208,17 +202,17 @@ bool SVGPaintServerGradient::setup(GraphicsContext*& context, const RenderObject
     }
 
     if (isFilled) {
-        context->setAlpha(style->fillOpacity());
+        context->setAlpha(svgStyle->fillOpacity());
         context->setFillGradient(m_gradient);
-        context->setFillRule(style->fillRule());
+        context->setFillRule(svgStyle->fillRule());
     }
     if (isStroked) {
-        context->setAlpha(style->strokeOpacity());
+        context->setAlpha(svgStyle->strokeOpacity());
         context->setStrokeGradient(m_gradient);
-        applyStrokeStyleToContext(context, object->style(), object);
+        applyStrokeStyleToContext(context, style, object);
     }
 
-    TransformationMatrix matrix;
+    AffineTransform matrix;
     // CG platforms will handle the gradient space transform for text in
     // teardown, so we don't apply it here.  For non-CG platforms, we
     // want the text bounding box applied to the gradient space transform now,
@@ -229,13 +223,6 @@ bool SVGPaintServerGradient::setup(GraphicsContext*& context, const RenderObject
     if (boundingBoxMode()) {
 #endif
         FloatRect bbox = object->objectBoundingBox();
-        // Don't use gradients for 1d objects like horizontal/vertical 
-        // lines or rectangles without width or height.
-        if (bbox.width() == 0 || bbox.height() == 0) {
-            Color color(0, 0, 0);
-            context->setStrokeColor(color);
-            return true;
-        }
         matrix.translate(bbox.x(), bbox.y());
         matrix.scaleNonUniform(bbox.width(), bbox.height());
     }
@@ -250,20 +237,18 @@ void SVGPaintServerGradient::teardown(GraphicsContext*& context, const RenderObj
 #if PLATFORM(CG)
     // renderPath() is not used when painting text, so we paint the gradient during teardown()
     if (isPaintingText && m_savedContext) {
-
         // Restore on-screen drawing context
         context = m_savedContext;
         m_savedContext = 0;
 
-        TransformationMatrix matrix = clipToTextMask(context, m_imageBuffer, object, this);
+        AffineTransform matrix = clipToTextMask(context, m_imageBuffer, object, this);
         m_gradient->setGradientSpaceTransform(matrix);
         context->setFillGradient(m_gradient);
+        
+        const RenderObject* textRootBlock = findTextRootObject(object);
+        context->fillRect(textRootBlock->repaintRectInLocalCoordinates());
 
-        FloatRect maskBBox = const_cast<RenderObject*>(findTextRootObject(object))->objectBoundingBox();
-
-        context->fillRect(maskBBox);
-
-        m_imageBuffer.clear(); // we're done with our text mask buffer
+        m_imageBuffer.clear();
     }
 #endif
     context->restore();
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.h
index b24c417be2..953b0d9997 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.h
@@ -29,7 +29,7 @@
 
 #if ENABLE(SVG)
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "Color.h"
 #include "Gradient.h"
 #include "GraphicsContext.h"
@@ -58,15 +58,15 @@ namespace WebCore {
         bool boundingBoxMode() const;
         void setBoundingBoxMode(bool mode = true);
 
-        TransformationMatrix gradientTransform() const;
-        void setGradientTransform(const TransformationMatrix&);
+        AffineTransform gradientTransform() const;
+        void setGradientTransform(const AffineTransform&);
 
         void setGradientStops(const Vector<SVGGradientStop>& stops) { m_stops = stops; }
         const Vector<SVGGradientStop>& gradientStops() const { return m_stops; }
 
         virtual TextStream& externalRepresentation(TextStream&) const;
 
-        virtual bool setup(GraphicsContext*&, const RenderObject*, SVGPaintTargetType, bool isPaintingText) const;
+        virtual bool setup(GraphicsContext*&, const RenderObject*, const RenderStyle*, SVGPaintTargetType, bool isPaintingText) const;
         virtual void teardown(GraphicsContext*&, const RenderObject*, SVGPaintTargetType, bool isPaintingText) const;
 
     protected:
@@ -76,7 +76,7 @@ namespace WebCore {
         Vector<SVGGradientStop> m_stops;
         RefPtr<Gradient> m_gradient;
         bool m_boundingBoxMode;
-        TransformationMatrix m_gradientTransform;
+        AffineTransform m_gradientTransform;
         const SVGGradientElement* m_ownerElement;
 
 #if PLATFORM(CG)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.cpp
index e825a0b412..7fc75fb3a4 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.cpp
@@ -29,6 +29,7 @@
 #if ENABLE(SVG)
 #include "SVGPaintServerPattern.h"
 
+#include "AffineTransform.h"
 #include "GraphicsContext.h"
 #include "Image.h"
 #include "ImageBuffer.h"
@@ -36,7 +37,6 @@
 #include "RenderObject.h"
 #include "SVGPatternElement.h"
 #include "SVGRenderTreeAsText.h"
-#include "TransformationMatrix.h"
 
 using namespace std;
 
@@ -73,12 +73,12 @@ void SVGPaintServerPattern::setTile(PassOwnPtr<ImageBuffer> tile)
     m_tile = tile;
 }
 
-TransformationMatrix SVGPaintServerPattern::patternTransform() const
+AffineTransform SVGPaintServerPattern::patternTransform() const
 {
     return m_patternTransform;
 }
 
-void SVGPaintServerPattern::setPatternTransform(const TransformationMatrix& transform)
+void SVGPaintServerPattern::setPatternTransform(const AffineTransform& transform)
 {
     m_patternTransform = transform;
 }
@@ -95,15 +95,15 @@ TextStream& SVGPaintServerPattern::externalRepresentation(TextStream& ts) const
     return ts;
 }
 
-bool SVGPaintServerPattern::setup(GraphicsContext*& context, const RenderObject* object, SVGPaintTargetType type, bool isPaintingText) const
+bool SVGPaintServerPattern::setup(GraphicsContext*& context, const RenderObject* object, const RenderStyle* style, SVGPaintTargetType type, bool isPaintingText) const
 {
     FloatRect targetRect = object->objectBoundingBox();
 
-    const SVGRenderStyle* style = object->style()->svgStyle();
-    bool isFilled = (type & ApplyToFillTargetType) && style->hasFill();
-    bool isStroked = (type & ApplyToStrokeTargetType) && style->hasStroke();
+    const SVGRenderStyle* svgStyle = style->svgStyle();
+    bool isFilled = (type & ApplyToFillTargetType) && svgStyle->hasFill();
+    bool isStroked = (type & ApplyToStrokeTargetType) && svgStyle->hasStroke();
 
-    ASSERT(isFilled && !isStroked || !isFilled && isStroked);
+    ASSERT((isFilled && !isStroked) || (!isFilled && isStroked));
 
     m_ownerElement->buildPattern(targetRect);
     if (!tile())
@@ -131,7 +131,7 @@ bool SVGPaintServerPattern::setup(GraphicsContext*& context, const RenderObject*
             tileImageContext->translate(0, patternBoundaries().height());
             for (int j = numX; j > 0; j--) {
                 tileImageContext->translate(patternBoundaries().width(), 0);
-                tileImageContext->drawImage(tile()->image(), tileRect, tileRect);
+                tileImageContext->drawImage(tile()->image(), style->colorSpace(), tileRect, tileRect);
             }
             tileImageContext->translate(-patternBoundaries().width() * numX, 0);
         }
@@ -143,17 +143,17 @@ bool SVGPaintServerPattern::setup(GraphicsContext*& context, const RenderObject*
         m_pattern = Pattern::create(tile()->image(), true, true);
 
     if (isFilled) {
-        context->setAlpha(style->fillOpacity());
+        context->setAlpha(svgStyle->fillOpacity());
         context->setFillPattern(m_pattern);
-        context->setFillRule(style->fillRule());
+        context->setFillRule(svgStyle->fillRule());
     }
     if (isStroked) {
-        context->setAlpha(style->strokeOpacity());
+        context->setAlpha(svgStyle->strokeOpacity());
         context->setStrokePattern(m_pattern);
-        applyStrokeStyleToContext(context, object->style(), object);
+        applyStrokeStyleToContext(context, style, object);
     }
 
-    TransformationMatrix matrix;
+    AffineTransform matrix;
     matrix.translate(patternBoundaries().x(), patternBoundaries().y());
     matrix.multiply(patternTransform());
     m_pattern->setPatternSpaceTransform(matrix);
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.h
index 253e0126cb..3d3da497f1 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.h
@@ -28,7 +28,7 @@
 
 #if ENABLE(SVG)
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "FloatRect.h"
 #include "Pattern.h"
 #include "SVGPaintServer.h"
@@ -59,12 +59,12 @@ namespace WebCore {
         ImageBuffer* tile() const;
         void setTile(PassOwnPtr<ImageBuffer>);
 
-        TransformationMatrix patternTransform() const;
-        void setPatternTransform(const TransformationMatrix&);
+        AffineTransform patternTransform() const;
+        void setPatternTransform(const AffineTransform&);
 
         virtual TextStream& externalRepresentation(TextStream&) const;
 
-        virtual bool setup(GraphicsContext*&, const RenderObject*, SVGPaintTargetType, bool isPaintingText) const;
+        virtual bool setup(GraphicsContext*&, const RenderObject*, const RenderStyle*, SVGPaintTargetType, bool isPaintingText) const;
         virtual void teardown(GraphicsContext*&, const RenderObject*, SVGPaintTargetType, bool isPaintingText) const;
 
     private:
@@ -72,7 +72,7 @@ namespace WebCore {
         
         OwnPtr<ImageBuffer> m_tile;
         const SVGPatternElement* m_ownerElement;
-        TransformationMatrix m_patternTransform;
+        AffineTransform m_patternTransform;
         FloatRect m_patternBoundaries;
 
         mutable RefPtr<Pattern> m_pattern;
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.cpp
index b333042d84..8921bb0382 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.cpp
@@ -60,14 +60,14 @@ TextStream& SVGPaintServerSolid::externalRepresentation(TextStream& ts) const
     return ts;
 }
 
-bool SVGPaintServerSolid::setup(GraphicsContext*& context, const RenderObject* object, SVGPaintTargetType type, bool isPaintingText) const
+bool SVGPaintServerSolid::setup(GraphicsContext*& context, const RenderObject* object, const RenderStyle* style, SVGPaintTargetType type, bool isPaintingText) const
 {
-    RenderStyle* style = object ? object->style() : 0;
     const SVGRenderStyle* svgStyle = style ? style->svgStyle() : 0;
+    ColorSpace colorSpace = style ? style->colorSpace() : DeviceColorSpace;
 
     if ((type & ApplyToFillTargetType) && (!style || svgStyle->hasFill())) {
         context->setAlpha(style ? svgStyle->fillOpacity() : 1);
-        context->setFillColor(color().rgb());
+        context->setFillColor(color().rgb(), colorSpace);
         context->setFillRule(style ? svgStyle->fillRule() : RULE_NONZERO);
 
         if (isPaintingText)
@@ -76,7 +76,7 @@ bool SVGPaintServerSolid::setup(GraphicsContext*& context, const RenderObject* o
 
     if ((type & ApplyToStrokeTargetType) && (!style || svgStyle->hasStroke())) {
         context->setAlpha(style ? svgStyle->strokeOpacity() : 1);
-        context->setStrokeColor(color().rgb());
+        context->setStrokeColor(color().rgb(), colorSpace);
 
         if (style)
             applyStrokeStyleToContext(context, style, object);
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.h
index 0166c87c59..680b0feed4 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.h
@@ -45,7 +45,7 @@ namespace WebCore {
 
         virtual TextStream& externalRepresentation(TextStream&) const;
 
-        virtual bool setup(GraphicsContext*&, const RenderObject*, SVGPaintTargetType, bool isPaintingText) const;
+        virtual bool setup(GraphicsContext*&, const RenderObject*, const RenderStyle*, SVGPaintTargetType, bool isPaintingText) const;
 
     private:
         SVGPaintServerSolid();
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResource.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResource.cpp
index 049edc7440..a071996d47 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResource.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResource.cpp
@@ -31,61 +31,30 @@
 #include "RenderPath.h"
 #include "SVGElement.h"
 #include "SVGStyledElement.h"
+#include <wtf/HashSet.h>
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
-SVGResource::SVGResource()
+typedef HashSet<SVGResource*> ResourceSet;
+
+static ResourceSet& resourceSet()
 {
+    DEFINE_STATIC_LOCAL(ResourceSet, set, ());
+    return set;
 }
 
-struct ResourceSet { 
-    ResourceSet() 
-    {
-        for (int i = 0; i < _ResourceTypeCount; i++)
-            resources[i] = 0;
-    }
-    SVGResource* resources[_ResourceTypeCount]; 
-};
-
-typedef HashMap<SVGStyledElement*, ResourceSet*> ResourceClientMap;
-
-static ResourceClientMap& clientMap()
+SVGResource::SVGResource()
 {
-    DEFINE_STATIC_LOCAL(ResourceClientMap, map, ());
-    return map;
+    ASSERT(!resourceSet().contains(this));
+    resourceSet().add(this);
 }
 
+
 SVGResource::~SVGResource()
 {
-    int type = -1;
-    HashSet<SVGStyledElement*>::iterator itr = m_clients.begin();
-    
-    for (; type < 0 && itr != m_clients.end(); ++itr) {
-        ResourceSet* target = clientMap().get(*itr);
-        if (!target)
-            continue;
-
-        for (int i = 0; i < _ResourceTypeCount; i++) {
-            if (target->resources[i] != this) 
-                continue;
-            type = i;
-            target->resources[i] = 0;
-            break;
-        }
-    }
-    
-    if (type < 0)
-        return;
-    
-    for (; itr != m_clients.end(); ++itr) {
-        ResourceSet* target = clientMap().get(*itr);
-        if (!target)
-            continue;
-        
-        if (target->resources[type] == this) 
-            target->resources[type] = 0;
-    }
+    ASSERT(resourceSet().contains(this));
+    resourceSet().remove(this);
 }
 
 void SVGResource::invalidate()
@@ -120,20 +89,15 @@ void SVGResource::invalidateClients(HashSet<SVGStyledElement*> clients)
 
 void SVGResource::removeClient(SVGStyledElement* item) 
 {
-    ResourceClientMap::iterator resourcePtr = clientMap().find(item);
-    if (resourcePtr == clientMap().end())
-        return;
-    
-    ResourceSet* set = resourcePtr->second;
-    ASSERT(set);
-    
-    clientMap().remove(resourcePtr);
-    
-    for (int i = 0; i < _ResourceTypeCount; i++)
-        if (set->resources[i])
-            set->resources[i]->m_clients.remove(item);
-    
-    delete set;
+    ResourceSet::iterator it = resourceSet().begin();
+    ResourceSet::iterator end = resourceSet().end();
+
+    for (; it != end; ++it) {
+        SVGResource* resource = *it;
+        if (!resource->m_clients.contains(item))
+            continue;
+        resource->m_clients.remove(item);
+    }
 }
 
 void SVGResource::addClient(SVGStyledElement* item)
@@ -142,17 +106,6 @@ void SVGResource::addClient(SVGStyledElement* item)
         return;
 
     m_clients.add(item);
-
-    ResourceSet* target = clientMap().get(item);
-    if (!target) 
-        target = new ResourceSet;
-
-    SVGResourceType type = resourceType();
-    if (SVGResource* oldResource = target->resources[type])
-        oldResource->m_clients.remove(item);
-
-    target->resources[type] = this;
-    clientMap().set(item, target);
 }
 
 TextStream& SVGResource::externalRepresentation(TextStream& ts) const
@@ -160,7 +113,7 @@ TextStream& SVGResource::externalRepresentation(TextStream& ts) const
     return ts;
 }
 
-SVGResource* getResourceById(Document* document, const AtomicString& id)
+SVGResource* getResourceById(Document* document, const AtomicString& id, const RenderObject* object)
 {
     if (id.isEmpty())
         return 0;
@@ -171,7 +124,7 @@ SVGResource* getResourceById(Document* document, const AtomicString& id)
         svgElement = static_cast<SVGElement*>(element);
 
     if (svgElement && svgElement->isStyled())
-        return static_cast<SVGStyledElement*>(svgElement)->canvasResource();
+        return static_cast<SVGStyledElement*>(svgElement)->canvasResource(object);
 
     return 0;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResource.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResource.h
index 7ee98f6337..6ddb907dbb 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResource.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResource.h
@@ -28,6 +28,7 @@
 
 #if ENABLE(SVG)
 #include "PlatformString.h"
+#include "RenderObject.h"
 #include "StringHash.h"
 
 #include <wtf/HashMap.h>
@@ -36,66 +37,60 @@
 
 namespace WebCore {
 
-    class AtomicString; 
-    class Document;
-    class SVGStyledElement;
-    class TextStream;
-
-    enum SVGResourceType {
-        // Painting mode
-        ClipperResourceType = 0,
-        MarkerResourceType,
-        ImageResourceType,
-        FilterResourceType,
-        MaskerResourceType,
-        PaintServerResourceType,
-        
-        // For resource tracking we need to know how many types of resource there are
-        _ResourceTypeCount
-    };
-
-    // The SVGResource file represent various graphics resources:
-    // - Filter resource
-    // - Clipper resource
-    // - Masker resource
-    // - Marker resource
-    // - Pattern resource
-    // - Linear/Radial gradient resource
-    //
-    // SVG creates/uses these resources.
-
-    class SVGResource : public RefCounted<SVGResource> {
-    public:
-        virtual ~SVGResource();
-      
-        virtual void invalidate();
-
-        void addClient(SVGStyledElement*);
-        virtual SVGResourceType resourceType() const = 0;
-        
-        bool isPaintServer() const { return resourceType() == PaintServerResourceType; }
-        bool isFilter() const { return resourceType() == FilterResourceType; }
-        bool isClipper() const { return resourceType() == ClipperResourceType; }
-        bool isMarker() const { return resourceType() == MarkerResourceType; }
-        bool isMasker() const { return resourceType() == MaskerResourceType; }
-
-        virtual TextStream& externalRepresentation(TextStream&) const;
-
-        static void invalidateClients(HashSet<SVGStyledElement*>);
-        static void removeClient(SVGStyledElement*);
-
-    protected:
-        SVGResource();
-
-    private:
-        HashSet<SVGStyledElement*> m_clients;
-    };
-
-    SVGResource* getResourceById(Document*, const AtomicString&);
+class AtomicString; 
+class Document;
+class SVGStyledElement;
+class TextStream;
+
+enum SVGResourceType {
+    // Painting mode
+    ImageResourceType,
+    FilterResourceType,
+    MarkerResourceType,
+    PaintServerResourceType,
     
-    TextStream& operator<<(TextStream&, const SVGResource&);
+    // For resource tracking we need to know how many types of resource there are
+    _ResourceTypeCount
+};
+
+// The SVGResource file represent various graphics resources:
+// - Filter resource
+// - Marker resource
+// - Pattern resource
+// - Linear/Radial gradient resource
+//
+// SVG creates/uses these resources.
+
+class SVGResource : public RefCounted<SVGResource> {
+public:
+    virtual ~SVGResource();
+  
+    virtual void invalidate();
+
+    void addClient(SVGStyledElement*);
+    virtual SVGResourceType resourceType() const = 0;
+    
+    bool isPaintServer() const { return resourceType() == PaintServerResourceType; }
+    bool isFilter() const { return resourceType() == FilterResourceType; }
+    bool isMarker() const { return resourceType() == MarkerResourceType; }
+
+    virtual TextStream& externalRepresentation(TextStream&) const;
+
+    static void invalidateClients(HashSet<SVGStyledElement*>);
+    static void removeClient(SVGStyledElement*);
+
+protected:
+    SVGResource();
 
-} // namespace WebCore
+private:
+    HashSet<SVGStyledElement*> m_clients;
+};
 
+SVGResource* getResourceById(Document*, const AtomicString&, const RenderObject*);
+
+TextStream& operator<<(TextStream&, const SVGResource&);
+
+}
+
+#endif
 #endif
-#endif // SVGResource_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceClipper.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceClipper.cpp
deleted file mode 100644
index 5998afb7eb..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceClipper.cpp
+++ /dev/null
@@ -1,139 +0,0 @@
-/*
- * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "SVGResourceClipper.h"
-
-#include "TransformationMatrix.h"
-#include "GraphicsContext.h"
-#include "SVGRenderTreeAsText.h"
-
-#if PLATFORM(CG)
-#include <ApplicationServices/ApplicationServices.h>
-#endif
-
-namespace WebCore {
-
-SVGResourceClipper::SVGResourceClipper()
-    : SVGResource()
-{
-}
-
-SVGResourceClipper::~SVGResourceClipper()
-{
-}
-
-void SVGResourceClipper::resetClipData()
-{
-    m_clipData.clear();
-}
-
-void SVGResourceClipper::applyClip(GraphicsContext* context, const FloatRect& boundingBox) const
-{
-    if (m_clipData.clipData().isEmpty())
-        return;
-
-    bool heterogenousClipRules = false;
-    WindRule clipRule = m_clipData.clipData()[0].windRule;
-
-    context->beginPath();
-
-    for (unsigned x = 0; x < m_clipData.clipData().size(); x++) {
-        ClipData clipData = m_clipData.clipData()[x];
-        if (clipData.windRule != clipRule)
-            heterogenousClipRules = true;
-        
-        Path clipPath = clipData.path;
-
-        if (clipData.bboxUnits) {
-            TransformationMatrix transform;
-            transform.translate(boundingBox.x(), boundingBox.y());
-            transform.scaleNonUniform(boundingBox.width(), boundingBox.height());
-            clipPath.transform(transform);
-        }
-        context->addPath(clipPath);
-    }
-
-    // FIXME!
-    // We don't currently allow for heterogenous clip rules.
-    // we would have to detect such, draw to a mask, and then clip
-    // to that mask
-    context->clipPath(clipRule);
-}
-
-void SVGResourceClipper::addClipData(const Path& path, WindRule rule, bool bboxUnits)
-{
-    m_clipData.addPath(path, rule, bboxUnits);
-}
-
-const ClipDataList& SVGResourceClipper::clipData() const
-{
-    return m_clipData;
-}
-
-TextStream& SVGResourceClipper::externalRepresentation(TextStream& ts) const
-{
-    ts << "[type=CLIPPER]";
-    ts << " [clip data=" << clipData().clipData() << "]";
-    return ts;
-}
-
-TextStream& operator<<(TextStream& ts, WindRule rule)
-{
-    switch (rule) {
-        case RULE_NONZERO:
-            ts << "NON-ZERO"; break;
-        case RULE_EVENODD:
-            ts << "EVEN-ODD"; break;
-    }
-
-    return ts;
-}
-
-TextStream& operator<<(TextStream& ts, const ClipData& d)
-{
-    ts << "[winding=" << d.windRule << "]";
-
-    if (d.bboxUnits)
-        ts << " [bounding box mode=" << d.bboxUnits << "]";
-
-    ts << " [path=" << d.path.debugString() << "]";
-    return ts;
-}
-
-SVGResourceClipper* getClipperById(Document* document, const AtomicString& id)
-{
-    SVGResource* resource = getResourceById(document, id);
-    if (resource && resource->isClipper())
-        return static_cast<SVGResourceClipper*>(resource);
-
-    return 0;
-}
-
-} // namespace WebCore
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceClipper.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceClipper.h
deleted file mode 100644
index 98c295f629..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceClipper.h
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef SVGResourceClipper_h
-#define SVGResourceClipper_h
-
-#if ENABLE(SVG)
-
-#include "SVGResource.h"
-#include "Path.h"
-
-namespace WebCore {
-
-    struct ClipData {
-        Path path;
-        WindRule windRule;
-        bool bboxUnits : 1;
-    };
-
-    class ClipDataList { 
-    public:
-        void addPath(const Path& pathData, WindRule windRule, bool bboxUnits)
-        {
-            ClipData clipData;
-            
-            clipData.path = pathData;
-            clipData.windRule = windRule;
-            clipData.bboxUnits = bboxUnits;
-            
-            m_clipData.append(clipData);
-        }
-        
-        void clear() { m_clipData.clear(); }
-        const Vector<ClipData>& clipData() const { return m_clipData; }
-        bool isEmpty() const { return m_clipData.isEmpty(); }
-    private:
-        Vector<ClipData> m_clipData;
-    };  
-
-    class GraphicsContext;
-
-    class SVGResourceClipper : public SVGResource {
-    public:
-        static PassRefPtr<SVGResourceClipper> create() { return adoptRef(new SVGResourceClipper); }
-        virtual ~SVGResourceClipper();
-      
-        void resetClipData();
-        void addClipData(const Path&, WindRule, bool bboxUnits);
-
-        const ClipDataList& clipData() const;
-        
-        virtual SVGResourceType resourceType() const { return ClipperResourceType; }
-        virtual TextStream& externalRepresentation(TextStream&) const;
-
-        // To be implemented by the specific rendering devices
-        void applyClip(GraphicsContext*, const FloatRect& boundingBox) const;
-    private:
-        SVGResourceClipper();
-        ClipDataList m_clipData;
-    };
-
-    TextStream& operator<<(TextStream&, WindRule);
-    TextStream& operator<<(TextStream&, const ClipData&);
-
-    SVGResourceClipper* getClipperById(Document*, const AtomicString&);
-
-} // namespace WebCore
-
-#endif
-
-#endif // SVGResourceClipper_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp
index 973743c1f2..72ae203143 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp
@@ -32,9 +32,14 @@
 #include "SVGFilter.h"
 #include "SVGFilterBuilder.h"
 #include "SVGFilterElement.h"
+#include "SVGRenderSupport.h"
 #include "SVGRenderTreeAsText.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
+static const float kMaxFilterSize = 5000.0f;
+
+using std::min;
+
 namespace WebCore {
 
 SVGResourceFilter::SVGResourceFilter(const SVGFilterElement* ownerElement)
@@ -42,37 +47,95 @@ SVGResourceFilter::SVGResourceFilter(const SVGFilterElement* ownerElement)
     , m_ownerElement(ownerElement)
     , m_filterBBoxMode(false)
     , m_effectBBoxMode(false)
+    , m_filterRes(false)
+    , m_scaleX(1.f)
+    , m_scaleY(1.f)
     , m_savedContext(0)
     , m_sourceGraphicBuffer(0)
 {
-    m_filterBuilder.set(new SVGFilterBuilder());
+    m_filterBuilder.set(new SVGFilterBuilder());    
 }
 
 SVGResourceFilter::~SVGResourceFilter()
 {
 }
 
+FloatRect SVGResourceFilter::filterBoundingBox(const FloatRect& obb) const
+{
+    return m_ownerElement->filterBoundingBox(obb);
+}
+
+static inline bool shouldProcessFilter(SVGResourceFilter* filter, const FloatRect& filterRect)
+{
+    return (!filter->scaleX() || !filter->scaleY() || !filterRect.width() || !filterRect.height());
+}
+
 void SVGResourceFilter::addFilterEffect(SVGFilterPrimitiveStandardAttributes* effectAttributes, PassRefPtr<FilterEffect> effect)
 {
     effectAttributes->setStandardAttributes(this, effect.get());
     builder()->add(effectAttributes->result(), effect);
 }
 
-void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObject* object)
+bool SVGResourceFilter::fitsInMaximumImageSize(const FloatSize& size)
+{
+    bool matchesFilterSize = true;
+    if (size.width() > kMaxFilterSize) {
+        m_scaleX *= kMaxFilterSize / size.width();
+        matchesFilterSize = false;
+    }
+    if (size.height() > kMaxFilterSize) {
+        m_scaleY *= kMaxFilterSize / size.height();
+        matchesFilterSize = false;
+    }
+
+    return matchesFilterSize;
+}
+
+bool SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObject* object)
 {
-    FloatRect targetRect = object->objectBoundingBox();
-    m_ownerElement->buildFilter(targetRect);
+    m_ownerElement->buildFilter(object->objectBoundingBox());
+    const SVGRenderBase* renderer = object->toSVGRenderBase();
+    if (!renderer)
+        return false;
+
+    FloatRect paintRect = renderer->strokeBoundingBox();
+    paintRect.unite(renderer->markerBoundingBox());
+
+    if (shouldProcessFilter(this, m_filterBBox))
+        return false;
 
     // clip sourceImage to filterRegion
-    FloatRect clippedSourceRect = targetRect;
+    FloatRect clippedSourceRect = paintRect;
     clippedSourceRect.intersect(m_filterBBox);
 
+    // scale filter size to filterRes
+    FloatRect tempSourceRect = clippedSourceRect;
+    if (m_filterRes) {
+        m_scaleX = m_filterResSize.width() / m_filterBBox.width();
+        m_scaleY = m_filterResSize.height() / m_filterBBox.height();
+    }
+
+    // scale to big sourceImage size to kMaxFilterSize
+    tempSourceRect.scale(m_scaleX, m_scaleY);
+    fitsInMaximumImageSize(tempSourceRect.size());
+
     // prepare Filters
-    m_filter = SVGFilter::create(targetRect, m_filterBBox, m_effectBBoxMode);
+    m_filter = SVGFilter::create(paintRect, m_filterBBox, m_effectBBoxMode);
+    m_filter->setFilterResolution(FloatSize(m_scaleX, m_scaleY));
 
     FilterEffect* lastEffect = m_filterBuilder->lastEffect();
-    if (lastEffect)
+    if (lastEffect) {
         lastEffect->calculateEffectRect(m_filter.get());
+        // at least one FilterEffect has a too big image size,
+        // recalculate the effect sizes with new scale factors
+        if (!fitsInMaximumImageSize(m_filter->maxImageSize())) {
+            m_filter->setFilterResolution(FloatSize(m_scaleX, m_scaleY));
+            lastEffect->calculateEffectRect(m_filter.get());
+        }
+    } else
+        return false;
+
+    clippedSourceRect.scale(m_scaleX, m_scaleY);
 
     // Draw the content of the current element and it's childs to a imageBuffer to get the SourceGraphic.
     // The size of the SourceGraphic is clipped to the size of the filterRegion.
@@ -80,18 +143,20 @@ void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObj
     OwnPtr<ImageBuffer> sourceGraphic(ImageBuffer::create(bufferRect.size(), LinearRGB));
     
     if (!sourceGraphic.get())
-        return;
+        return false;
 
     GraphicsContext* sourceGraphicContext = sourceGraphic->context();
-    sourceGraphicContext->translate(-targetRect.x(), -targetRect.y());
-    sourceGraphicContext->clearRect(FloatRect(FloatPoint(), targetRect.size()));
+    sourceGraphicContext->translate(-clippedSourceRect.x(), -clippedSourceRect.y());
+    sourceGraphicContext->scale(FloatSize(m_scaleX, m_scaleY));
+    sourceGraphicContext->clearRect(FloatRect(FloatPoint(), paintRect.size()));
     m_sourceGraphicBuffer.set(sourceGraphic.release());
     m_savedContext = context;
 
     context = sourceGraphicContext;
+    return true;
 }
 
-void SVGResourceFilter::applyFilter(GraphicsContext*& context, const RenderObject*)
+void SVGResourceFilter::applyFilter(GraphicsContext*& context, const RenderObject* object)
 {
     if (!m_savedContext)
         return;
@@ -113,7 +178,10 @@ void SVGResourceFilter::applyFilter(GraphicsContext*& context, const RenderObjec
 #if !PLATFORM(CG)
             resultImage->transformColorSpace(LinearRGB, DeviceRGB);
 #endif
-            context->drawImage(resultImage->image(), lastEffect->subRegion());
+            ColorSpace colorSpace = DeviceColorSpace;
+            if (object)
+                colorSpace = object->style()->colorSpace();
+            context->drawImage(resultImage->image(), colorSpace, lastEffect->subRegion());
         }
     }
 
@@ -145,9 +213,9 @@ TextStream& SVGResourceFilter::externalRepresentation(TextStream& ts) const
     return ts;
 }
 
-SVGResourceFilter* getFilterById(Document* document, const AtomicString& id)
+SVGResourceFilter* getFilterById(Document* document, const AtomicString& id, const RenderObject* object)
 {
-    SVGResource* resource = getResourceById(document, id);
+    SVGResource* resource = getResourceById(document, id, object);
     if (resource && resource->isFilter())
         return static_cast<SVGResourceFilter*>(resource);
 
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h
index 86b11fe5b4..f0db92bcfd 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h
@@ -26,8 +26,6 @@
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGResource.h"
 
-#include "Image.h"
-#include "ImageBuffer.h"
 #include "FloatRect.h"
 #include "RenderObject.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
@@ -53,6 +51,9 @@ public:
     
     virtual SVGResourceType resourceType() const { return FilterResourceType; }
 
+    void setFilterResolution(const FloatSize& filterResSize) { m_filterResSize = filterResSize; }
+    void setHasFilterResolution(bool filterRes) { m_filterRes = filterRes; }
+
     bool filterBoundingBoxMode() const { return m_filterBBoxMode; }
     void setFilterBoundingBoxMode(bool bboxMode) { m_filterBBoxMode = bboxMode; }
 
@@ -62,12 +63,17 @@ public:
     FloatRect filterRect() const { return m_filterRect; }
     void setFilterRect(const FloatRect& rect) { m_filterRect = rect; }
 
-    FloatRect filterBoundingBox() { return m_filterBBox; }
+    float scaleX() const { return m_scaleX; }
+    float scaleY() const { return m_scaleY; }
+
+    FloatRect filterBoundingBox(const FloatRect& obb) const;
     void setFilterBoundingBox(const FloatRect& rect) { m_filterBBox = rect; }
 
-    void prepareFilter(GraphicsContext*&, const RenderObject*);
+    bool prepareFilter(GraphicsContext*&, const RenderObject*);
     void applyFilter(GraphicsContext*&, const RenderObject*);
 
+    bool fitsInMaximumImageSize(const FloatSize&);
+
     void addFilterEffect(SVGFilterPrimitiveStandardAttributes*, PassRefPtr<FilterEffect>);
 
     SVGFilterBuilder* builder() { return m_filterBuilder.get(); }
@@ -81,9 +87,13 @@ private:
 
     bool m_filterBBoxMode : 1;
     bool m_effectBBoxMode : 1;
+    bool m_filterRes : 1;
+    float m_scaleX;
+    float m_scaleY;
 
     FloatRect m_filterRect;
     FloatRect m_filterBBox;
+    FloatSize m_filterResSize;
 
     OwnPtr<SVGFilterBuilder> m_filterBuilder;
     GraphicsContext* m_savedContext;
@@ -91,7 +101,7 @@ private:
     RefPtr<Filter> m_filter;
 };
 
-SVGResourceFilter* getFilterById(Document*, const AtomicString&);
+SVGResourceFilter* getFilterById(Document*, const AtomicString&, const RenderObject*);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMarker.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMarker.cpp
index 112e4d6c8a..2c036a4d9e 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMarker.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMarker.cpp
@@ -28,7 +28,7 @@
 #if ENABLE(SVG)
 #include "SVGResourceMarker.h"
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "GraphicsContext.h"
 #include "RenderSVGViewportContainer.h"
 #include "TextStream.h"
@@ -38,10 +38,8 @@ namespace WebCore {
 
 SVGResourceMarker::SVGResourceMarker()
     : SVGResource()
-    , m_refX(0.0)
-    , m_refY(0.0)
     , m_angle(-1) // just like using setAutoAngle()
-    , m_marker(0)
+    , m_renderer(0)
     , m_useStrokeWidth(true)
 {
 }
@@ -50,20 +48,20 @@ SVGResourceMarker::~SVGResourceMarker()
 {
 }
 
-void SVGResourceMarker::setMarker(RenderSVGViewportContainer* marker)
+AffineTransform SVGResourceMarker::markerTransformation(const FloatPoint& origin, float angle, float strokeWidth) const
 {
-    m_marker = marker;
-}
+    ASSERT(m_renderer);
 
-void SVGResourceMarker::setRef(double refX, double refY)
-{
-    m_refX = refX;
-    m_refY = refY;
+    AffineTransform transform;
+    transform.translate(origin.x(), origin.y());
+    transform.rotate(m_angle == -1 ? angle : m_angle);
+    transform = m_renderer->markerContentTransformation(transform, m_referencePoint, m_useStrokeWidth ? strokeWidth : -1);
+    return transform;
 }
 
-void SVGResourceMarker::draw(GraphicsContext* context, const FloatRect& rect, double x, double y, double strokeWidth, double angle)
+void SVGResourceMarker::draw(RenderObject::PaintInfo& paintInfo, const AffineTransform& transform)
 {
-    if (!m_marker)
+    if (!m_renderer)
         return;
 
     DEFINE_STATIC_LOCAL(HashSet<SVGResourceMarker*>, currentlyDrawingMarkers, ());
@@ -73,45 +71,18 @@ void SVGResourceMarker::draw(GraphicsContext* context, const FloatRect& rect, do
         return;
 
     currentlyDrawingMarkers.add(this);
-
-    TransformationMatrix transform;
-    transform.translate(x, y);
-    transform.rotate(m_angle > -1 ? m_angle : angle);
-
-    // refX and refY are given in coordinates relative to the viewport established by the marker, yet they affect
-    // the translation performed on the viewport itself.
-    TransformationMatrix viewportTransform;
-    if (m_useStrokeWidth)
-        viewportTransform.scaleNonUniform(strokeWidth, strokeWidth);
-    viewportTransform *= m_marker->viewportTransform();
-    double refX, refY;
-    viewportTransform.map(m_refX, m_refY, refX, refY);
-    transform.translate(-refX, -refY);
-
-    if (m_useStrokeWidth)
-        transform.scaleNonUniform(strokeWidth, strokeWidth);
-
-    // FIXME: PaintInfo should be passed into this method instead of being created here
-    // FIXME: bounding box fractions are lost
-    RenderObject::PaintInfo info(context, enclosingIntRect(rect), PaintPhaseForeground, 0, 0, 0);
-
-    context->save();
-    context->concatCTM(transform);
-    m_marker->setDrawsContents(true);
-    m_marker->paint(info, 0, 0);
-    m_marker->setDrawsContents(false);
-    context->restore();
-
-    m_cachedBounds = transform.mapRect(m_marker->absoluteClippedOverflowRect());
+    ASSERT(!m_renderer->drawsContents());
+    RenderObject::PaintInfo info(paintInfo);
+    info.context->save();
+    applyTransformToPaintInfo(info, transform);
+    m_renderer->setDrawsContents(true);
+    m_renderer->paint(info, 0, 0);
+    m_renderer->setDrawsContents(false);
+    info.context->restore();
 
     currentlyDrawingMarkers.remove(this);
 }
 
-FloatRect SVGResourceMarker::cachedBounds() const
-{
-    return m_cachedBounds;
-}
-
 TextStream& SVGResourceMarker::externalRepresentation(TextStream& ts) const
 {
     ts << "[type=MARKER]"
@@ -122,13 +93,13 @@ TextStream& SVGResourceMarker::externalRepresentation(TextStream& ts) const
     else
         ts << angle() << "]";
 
-    ts << " [ref x=" << refX() << " y=" << refY() << "]";
+    ts << " [ref x=" << m_referencePoint.x() << " y=" << m_referencePoint.y() << "]";
     return ts;
 }
 
-SVGResourceMarker* getMarkerById(Document* document, const AtomicString& id)
+SVGResourceMarker* getMarkerById(Document* document, const AtomicString& id, const RenderObject* object)
 {
-    SVGResource* resource = getResourceById(document, id);
+    SVGResource* resource = getResourceById(document, id, object);
     if (resource && resource->isMarker())
         return static_cast<SVGResourceMarker*>(resource);
 
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMarker.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMarker.h
index bb4039c051..f2ce33d0f9 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMarker.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMarker.h
@@ -27,25 +27,26 @@
 #define SVGResourceMarker_h
 
 #if ENABLE(SVG)
-
+#include "FloatPoint.h"
 #include "FloatRect.h"
+#include "RenderObject.h"
 #include "SVGResource.h"
 
 namespace WebCore {
 
-    class GraphicsContext;
     class RenderSVGViewportContainer;
+    class AffineTransform;
 
     class SVGResourceMarker : public SVGResource {
     public:
         static PassRefPtr<SVGResourceMarker> create() { return adoptRef(new SVGResourceMarker); }
         virtual ~SVGResourceMarker();
 
-        void setMarker(RenderSVGViewportContainer*);
+        RenderSVGViewportContainer* renderer() const { return m_renderer; }
+        void setRenderer(RenderSVGViewportContainer* marker) { m_renderer = marker; }
 
-        void setRef(double refX, double refY);
-        double refX() const { return m_refX; }
-        double refY() const { return m_refY; }
+        void setReferencePoint(const FloatPoint& point) { m_referencePoint = point; }
+        FloatPoint referencePoint() const { return m_referencePoint; }
 
         void setAngle(float angle) { m_angle = angle; }
         void setAutoAngle() { m_angle = -1; }
@@ -54,22 +55,22 @@ namespace WebCore {
         void setUseStrokeWidth(bool useStrokeWidth = true) { m_useStrokeWidth = useStrokeWidth; }
         bool useStrokeWidth() const { return m_useStrokeWidth; }
 
-        FloatRect cachedBounds() const;
-        void draw(GraphicsContext*, const FloatRect&, double x, double y, double strokeWidth = 1, double angle = 0);
-        
+        AffineTransform markerTransformation(const FloatPoint& origin, float angle, float strokeWidth) const;
+        void draw(RenderObject::PaintInfo&, const AffineTransform&);
+
         virtual SVGResourceType resourceType() const { return MarkerResourceType; }
         virtual TextStream& externalRepresentation(TextStream&) const;
 
     private:
         SVGResourceMarker();
-        double m_refX, m_refY;
-        FloatRect m_cachedBounds;
+
+        FloatPoint m_referencePoint;
         float m_angle;
-        RenderSVGViewportContainer* m_marker;
+        RenderSVGViewportContainer* m_renderer;
         bool m_useStrokeWidth;
     };
 
-    SVGResourceMarker* getMarkerById(Document*, const AtomicString&);
+    SVGResourceMarker* getMarkerById(Document*, const AtomicString&, const RenderObject*);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMasker.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMasker.cpp
deleted file mode 100644
index 97467c10bd..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMasker.cpp
+++ /dev/null
@@ -1,118 +0,0 @@
-/*
- * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "SVGResourceMasker.h"
-
-#include "CanvasPixelArray.h"
-#include "Image.h"
-#include "ImageBuffer.h"
-#include "ImageData.h"
-#include "GraphicsContext.h"
-#include "SVGMaskElement.h"
-#include "SVGRenderSupport.h"
-#include "SVGRenderStyle.h"
-#include "TextStream.h"
-
-#include <wtf/ByteArray.h>
-
-using namespace std;
-
-namespace WebCore {
-
-SVGResourceMasker::SVGResourceMasker(const SVGMaskElement* ownerElement)
-    : SVGResource()
-    , m_ownerElement(ownerElement)
-{
-}
-
-SVGResourceMasker::~SVGResourceMasker()
-{
-}
-
-void SVGResourceMasker::invalidate()
-{
-    SVGResource::invalidate();
-    m_mask.clear();
-}
-
-void SVGResourceMasker::applyMask(GraphicsContext* context, const FloatRect& boundingBox)
-{
-    if (!m_mask)
-        m_mask = m_ownerElement->drawMaskerContent(boundingBox, m_maskRect);
-
-    if (!m_mask)
-        return;
-
-    IntSize imageSize(m_mask->size());
-    IntRect intImageRect(0, 0, imageSize.width(), imageSize.height());
-
-    // Create new ImageBuffer to apply luminance
-    OwnPtr<ImageBuffer> luminancedImage = ImageBuffer::create(imageSize);
-    if (!luminancedImage)
-        return;
-
-    PassRefPtr<CanvasPixelArray> srcPixelArray(m_mask->getUnmultipliedImageData(intImageRect)->data());
-    PassRefPtr<ImageData> destImageData(luminancedImage->getUnmultipliedImageData(intImageRect));
-
-    for (unsigned pixelOffset = 0; pixelOffset < srcPixelArray->length(); pixelOffset++) {
-        unsigned pixelByteOffset = pixelOffset * 4;
-
-        unsigned char r = 0, g = 0, b = 0, a = 0;
-        srcPixelArray->get(pixelByteOffset, r);
-        srcPixelArray->get(pixelByteOffset + 1, g);
-        srcPixelArray->get(pixelByteOffset + 2, b);
-        srcPixelArray->get(pixelByteOffset + 3, a);
-
-        double luma = (r * 0.2125 + g * 0.7154 + b * 0.0721) * ((double)a / 255.0);
-
-        destImageData->data()->set(pixelByteOffset + 3, luma);
-    }
-
-    luminancedImage->putUnmultipliedImageData(destImageData.get(), intImageRect, IntPoint(0, 0));
-
-    context->clipToImageBuffer(m_maskRect, luminancedImage.get());
-}
-
-TextStream& SVGResourceMasker::externalRepresentation(TextStream& ts) const
-{
-    ts << "[type=MASKER]";
-    return ts;
-}
-
-SVGResourceMasker* getMaskerById(Document* document, const AtomicString& id)
-{
-    SVGResource* resource = getResourceById(document, id);
-    if (resource && resource->isMasker())
-        return static_cast<SVGResourceMasker*>(resource);
-
-    return 0;
-}
-
-} // namespace WebCore
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMasker.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMasker.h
deleted file mode 100644
index f945f56865..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMasker.h
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef SVGResourceMasker_h
-#define SVGResourceMasker_h
-
-#if ENABLE(SVG)
-
-#include "GraphicsContext.h"
-#include "SVGResource.h"
-
-#include <memory>
-
-#include <wtf/OwnPtr.h>
-#include <wtf/PassRefPtr.h>
-
-namespace WebCore {
-
-    class FloatRect;
-    class ImageBuffer;
-    class SVGMaskElement;
-
-    class SVGResourceMasker : public SVGResource {
-    public:
-        static PassRefPtr<SVGResourceMasker> create(const SVGMaskElement* ownerElement) { return adoptRef(new SVGResourceMasker(ownerElement)); }
-        virtual ~SVGResourceMasker();
-        
-        virtual void invalidate();
-        
-        virtual SVGResourceType resourceType() const { return MaskerResourceType; }
-        virtual TextStream& externalRepresentation(TextStream&) const;
-
-        // To be implemented by the specific rendering devices
-        void applyMask(GraphicsContext*, const FloatRect& boundingBox);
-
-    private:
-        SVGResourceMasker(const SVGMaskElement*);
-
-        const SVGMaskElement* m_ownerElement;
-        
-        OwnPtr<ImageBuffer> m_mask;
-        FloatRect m_maskRect;
-    };
-
-    SVGResourceMasker* getMaskerById(Document*, const AtomicString&);
-
-} // namespace WebCore
-
-#endif
-
-#endif // SVGResourceMasker_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGDistantLightSource.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGDistantLightSource.h
index 07ac16cd4b..db9b59de4d 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGDistantLightSource.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGDistantLightSource.h
@@ -30,11 +30,10 @@ namespace WebCore {
 
     class DistantLightSource : public LightSource {
     public:
-        DistantLightSource(float azimuth, float elevation)
-            : LightSource(LS_DISTANT)
-            , m_azimuth(azimuth)
-            , m_elevation(elevation)
-        { }
+        static PassRefPtr<DistantLightSource> create(float azimuth, float elevation)
+        {
+            return adoptRef(new DistantLightSource(azimuth, elevation));
+        }
 
         float azimuth() const { return m_azimuth; }
         float elevation() const { return m_elevation; }
@@ -42,6 +41,13 @@ namespace WebCore {
         virtual TextStream& externalRepresentation(TextStream&) const;
 
     private:
+        DistantLightSource(float azimuth, float elevation)
+            : LightSource(LS_DISTANT)
+            , m_azimuth(azimuth)
+            , m_elevation(elevation)
+        {
+        }
+
         float m_azimuth;
         float m_elevation;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp
index c5364786fc..93921df593 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp
@@ -30,7 +30,7 @@
 namespace WebCore {
 
 FEDiffuseLighting::FEDiffuseLighting(FilterEffect* in , const Color& lightingColor, const float& surfaceScale,
-    const float& diffuseConstant, const float& kernelUnitLengthX, const float& kernelUnitLengthY, LightSource* lightSource)
+    const float& diffuseConstant, const float& kernelUnitLengthX, const float& kernelUnitLengthY, PassRefPtr<LightSource> lightSource)
     : FilterEffect()
     , m_in(in)
     , m_lightingColor(lightingColor)
@@ -44,7 +44,7 @@ FEDiffuseLighting::FEDiffuseLighting(FilterEffect* in , const Color& lightingCol
 
 PassRefPtr<FEDiffuseLighting> FEDiffuseLighting::create(FilterEffect* in , const Color& lightingColor,
     const float& surfaceScale, const float& diffuseConstant, const float& kernelUnitLengthX,
-    const float& kernelUnitLengthY, LightSource* lightSource)
+    const float& kernelUnitLengthY, PassRefPtr<LightSource> lightSource)
 {
     return adoptRef(new FEDiffuseLighting(in, lightingColor, surfaceScale, diffuseConstant, kernelUnitLengthX, kernelUnitLengthY, lightSource));
 }
@@ -108,7 +108,7 @@ const LightSource* FEDiffuseLighting::lightSource() const
     return m_lightSource.get();
 }
 
-void FEDiffuseLighting::setLightSource(LightSource* lightSource)
+void FEDiffuseLighting::setLightSource(PassRefPtr<LightSource> lightSource)
 {    
     m_lightSource = lightSource;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h
index 71f8e22f0a..bf7f28e0bb 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h
@@ -34,7 +34,7 @@ namespace WebCore {
     class FEDiffuseLighting : public FilterEffect {
     public:
         static PassRefPtr<FEDiffuseLighting> create(FilterEffect*, const Color&, const float&, const float&,
-                const float&, const float&, LightSource*);
+                const float&, const float&, PassRefPtr<LightSource>);
         virtual ~FEDiffuseLighting();
 
         Color lightingColor() const;
@@ -53,7 +53,7 @@ namespace WebCore {
         void setKernelUnitLengthY(float);
 
         const LightSource* lightSource() const;
-        void setLightSource(LightSource*);
+        void setLightSource(PassRefPtr<LightSource>);
 
         virtual FloatRect uniteChildEffectSubregions(Filter* filter) { return calculateUnionOfChildEffectSubregions(filter, m_in.get()); }
         void apply(Filter*);
@@ -62,7 +62,7 @@ namespace WebCore {
         
     private:
         FEDiffuseLighting(FilterEffect*, const Color&, const float&, const float&,
-                const float&, const float&, LightSource*);
+                const float&, const float&, PassRefPtr<LightSource>);
 
         RefPtr<FilterEffect> m_in;
         Color m_lightingColor;
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp
index abb57ee9ce..a22bc944cd 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -23,8 +24,12 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEDisplacementMap.h"
-#include "SVGRenderTreeAsText.h"
+
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "GraphicsContext.h"
+#include "ImageData.h"
+#include "SVGRenderTreeAsText.h"
 
 namespace WebCore {
 
@@ -75,8 +80,53 @@ void FEDisplacementMap::setScale(float scale)
     m_scale = scale;
 }
 
-void FEDisplacementMap::apply(Filter*)
+void FEDisplacementMap::apply(Filter* filter)
 {
+    m_in->apply(filter);
+    m_in2->apply(filter);
+    if (!m_in->resultImage() || !m_in2->resultImage())
+        return;
+
+    if (m_xChannelSelector == CHANNEL_UNKNOWN || m_yChannelSelector == CHANNEL_UNKNOWN)
+        return;
+
+    if (!getEffectContext())
+        return;
+
+    IntRect effectADrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
+    RefPtr<CanvasPixelArray> srcPixelArrayA(m_in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
+
+    IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->scaledSubRegion());
+    RefPtr<CanvasPixelArray> srcPixelArrayB(m_in2->resultImage()->getUnmultipliedImageData(effectBDrawingRect)->data());
+
+    IntRect imageRect(IntPoint(), resultImage()->size());
+    RefPtr<ImageData> imageData = ImageData::create(imageRect.width(), imageRect.height());
+
+    ASSERT(srcPixelArrayA->length() == srcPixelArrayB->length());
+
+    float scaleX = m_scale / 255.f * filter->filterResolution().width();
+    float scaleY = m_scale / 255.f * filter->filterResolution().height();
+    float scaleAdjustmentX = (0.5f - 0.5f * m_scale) * filter->filterResolution().width();
+    float scaleAdjustmentY = (0.5f - 0.5f * m_scale) * filter->filterResolution().height();
+    int stride = imageRect.width() * 4;
+    for (int y = 0; y < imageRect.height(); ++y) {
+        int line = y * stride;
+        for (int x = 0; x < imageRect.width(); ++x) {
+            int dstIndex = line + x * 4;
+            int srcX = x + static_cast<int>(scaleX * srcPixelArrayB->get(dstIndex + m_xChannelSelector - 1) + scaleAdjustmentX);
+            int srcY = y + static_cast<int>(scaleY * srcPixelArrayB->get(dstIndex + m_yChannelSelector - 1) + scaleAdjustmentY);
+            for (unsigned channel = 0; channel < 4; ++channel) {
+                if (srcX < 0 || srcX >= imageRect.width() || srcY < 0 || srcY >= imageRect.height())
+                    imageData->data()->set(dstIndex + channel, static_cast<unsigned char>(0));
+                else {
+                    unsigned char pixelValue = srcPixelArrayA->get(srcY * stride + srcX * 4 + channel);
+                    imageData->data()->set(dstIndex + channel, pixelValue);
+                }
+            }
+
+        }
+    }
+    resultImage()->putPremultipliedImageData(imageData.get(), imageRect, IntPoint());
 }
 
 void FEDisplacementMap::dump()
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp
index 668209fa6f..648bf543b0 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp
@@ -70,7 +70,7 @@ void FEFlood::apply(Filter*)
         return;
 
     Color color = colorWithOverrideAlpha(floodColor().rgb(), floodOpacity());
-    filterContext->fillRect(FloatRect(FloatPoint(), subRegion().size()), color);
+    filterContext->fillRect(FloatRect(FloatPoint(), scaledSubRegion().size()), color, DeviceColorSpace);
 }
 
 void FEFlood::dump()
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.cpp
index e82328ab2c..950203a688 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2010 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -23,50 +24,42 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEImage.h"
-#include "SVGRenderTreeAsText.h"
+
+#include "AffineTransform.h"
 #include "Filter.h"
+#include "GraphicsContext.h"
+#include "SVGPreserveAspectRatio.h"
+#include "SVGRenderTreeAsText.h"
 
 namespace WebCore {
 
-FEImage::FEImage(CachedImage* cachedImage)
+FEImage::FEImage(RefPtr<Image> image, SVGPreserveAspectRatio preserveAspectRatio)
     : FilterEffect()
-    , m_cachedImage(cachedImage)
+    , m_image(image)
+    , m_preserveAspectRatio(preserveAspectRatio)
 {
-    m_cachedImage->addClient(this);
 }
 
-PassRefPtr<FEImage> FEImage::create(CachedImage* cachedImage)
+PassRefPtr<FEImage> FEImage::create(RefPtr<Image> image, SVGPreserveAspectRatio preserveAspectRatio)
 {
-    return adoptRef(new FEImage(cachedImage));
+    return adoptRef(new FEImage(image, preserveAspectRatio));
 }
 
-FEImage::~FEImage()
-{
-    if (m_cachedImage)
-        m_cachedImage->removeClient(this);
-}
-
-CachedImage* FEImage::cachedImage() const
+void FEImage::apply(Filter*)
 {
-    return m_cachedImage.get();
-}
+    if (!m_image.get())
+        return;
 
-void FEImage::setCachedImage(CachedImage* image)
-{
-    if (m_cachedImage == image)
+    GraphicsContext* filterContext = getEffectContext();
+    if (!filterContext)
         return;
-    
-    if (m_cachedImage)
-        m_cachedImage->removeClient(this);
 
-    m_cachedImage = image;
+    FloatRect srcRect(FloatPoint(), m_image->size());
+    FloatRect destRect(FloatPoint(), subRegion().size());
 
-    if (m_cachedImage)
-        m_cachedImage->addClient(this);
-}
+    m_preserveAspectRatio.transformRect(destRect, srcRect);
 
-void FEImage::apply(Filter*)
-{
+    filterContext->drawImage(m_image.get(), DeviceColorSpace, destRect, srcRect);
 }
 
 void FEImage::dump()
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.h
index f29d266c1f..01e9522d8f 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.h
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2010 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -23,33 +24,24 @@
 #define SVGFEImage_h
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
-#include "CachedImage.h"
-#include "CachedResourceClient.h"
-#include "CachedResourceHandle.h"
 #include "FilterEffect.h"
-#include "Filter.h"
+#include "SVGPreserveAspectRatio.h"
 
 namespace WebCore {
 
-    class FEImage : public FilterEffect
-                     , public CachedResourceClient {
+    class FEImage : public FilterEffect {
     public:
-        static PassRefPtr<FEImage> create(CachedImage*);
-        virtual ~FEImage();
-
-        // FIXME: We need to support <svg> (RenderObject*) as well as image data.
-
-        CachedImage* cachedImage() const;
-        void setCachedImage(CachedImage*);
+        static PassRefPtr<FEImage> create(RefPtr<Image>, SVGPreserveAspectRatio);
 
         void apply(Filter*);
         void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
         
     private:
-        FEImage(CachedImage*);
+        FEImage(RefPtr<Image>, SVGPreserveAspectRatio);
 
-        CachedResourceHandle<CachedImage> m_cachedImage;
+        RefPtr<Image> m_image;
+        SVGPreserveAspectRatio m_preserveAspectRatio;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.cpp
index acf3c4524d..6ea0fb9700 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.cpp
@@ -30,23 +30,23 @@
 
 namespace WebCore {
 
-FEMerge::FEMerge(const Vector<FilterEffect*>& mergeInputs) 
+FEMerge::FEMerge(const Vector<RefPtr<FilterEffect> >& mergeInputs) 
     : FilterEffect()
     , m_mergeInputs(mergeInputs)
 {
 }
 
-PassRefPtr<FEMerge> FEMerge::create(const Vector<FilterEffect*>& mergeInputs)
+PassRefPtr<FEMerge> FEMerge::create(const Vector<RefPtr<FilterEffect> >& mergeInputs)
 {
     return adoptRef(new FEMerge(mergeInputs));
 }
 
-const Vector<FilterEffect*>& FEMerge::mergeInputs() const
+const Vector<RefPtr<FilterEffect> >& FEMerge::mergeInputs() const
 {
     return m_mergeInputs;
 }
 
-void FEMerge::setMergeInputs(const Vector<FilterEffect*>& mergeInputs)
+void FEMerge::setMergeInputs(const Vector<RefPtr<FilterEffect> >& mergeInputs)
 {
     m_mergeInputs = mergeInputs;
 }
@@ -78,8 +78,8 @@ void FEMerge::apply(Filter* filter)
         return;
 
     for (unsigned i = 0; i < m_mergeInputs.size(); i++) {
-        FloatRect destRect = calculateDrawingRect(m_mergeInputs[i]->subRegion());
-        filterContext->drawImage(m_mergeInputs[i]->resultImage()->image(), destRect);
+        FloatRect destRect = calculateDrawingRect(m_mergeInputs[i]->scaledSubRegion());
+        filterContext->drawImage(m_mergeInputs[i]->resultImage()->image(), DeviceColorSpace, destRect);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.h
index 02fbfacd4f..7653be335d 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.h
@@ -31,10 +31,10 @@ namespace WebCore {
 
     class FEMerge : public FilterEffect {
     public:
-        static PassRefPtr<FEMerge> create(const Vector<FilterEffect*>&);
+        static PassRefPtr<FEMerge> create(const Vector<RefPtr<FilterEffect> >&);
 
-        const Vector<FilterEffect*>& mergeInputs() const;
-        void setMergeInputs(const Vector<FilterEffect*>& mergeInputs);
+        const Vector<RefPtr<FilterEffect> >& mergeInputs() const;
+        void setMergeInputs(const Vector<RefPtr<FilterEffect> >& mergeInputs);
 
         virtual FloatRect uniteChildEffectSubregions(Filter*);
         void apply(Filter*);
@@ -42,9 +42,9 @@ namespace WebCore {
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
-        FEMerge(const Vector<FilterEffect*>&);
+        FEMerge(const Vector<RefPtr<FilterEffect> >&);
 
-        Vector<FilterEffect*> m_mergeInputs;
+        Vector<RefPtr<FilterEffect> > m_mergeInputs;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
index f7fc5d8070..5204a46b44 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -23,8 +24,16 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEMorphology.h"
-#include "SVGRenderTreeAsText.h"
+
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "ImageData.h"
+#include "SVGRenderTreeAsText.h"
+
+#include <wtf/Vector.h>
+
+using std::min;
+using std::max;
 
 namespace WebCore {
 
@@ -72,8 +81,76 @@ void FEMorphology::setRadiusY(float radiusY)
     m_radiusY = radiusY;
 }
 
-void FEMorphology::apply(Filter*)
+void FEMorphology::apply(Filter* filter)
 {
+    m_in->apply(filter);
+    if (!m_in->resultImage())
+        return;
+    
+    if (!getEffectContext())
+        return;
+
+    setIsAlphaImage(m_in->isAlphaImage());
+
+    int radiusX = static_cast<int>(m_radiusX * filter->filterResolution().width());
+    int radiusY = static_cast<int>(m_radiusY * filter->filterResolution().height());
+    if (radiusX <= 0 || radiusY <= 0)
+        return;
+
+    IntRect imageRect(IntPoint(), resultImage()->size());
+    IntRect effectDrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
+    RefPtr<CanvasPixelArray> srcPixelArray(m_in->resultImage()->getPremultipliedImageData(effectDrawingRect)->data());
+    RefPtr<ImageData> imageData = ImageData::create(imageRect.width(), imageRect.height());
+
+    int effectWidth = effectDrawingRect.width() * 4;
+    
+    // Limit the radius size to effect dimensions
+    radiusX = min(effectDrawingRect.width() - 1, radiusX);
+    radiusY = min(effectDrawingRect.height() - 1, radiusY);
+    
+    Vector<unsigned char> extrema;
+    for (int y = 0; y < effectDrawingRect.height(); ++y) {
+        int startY = max(0, y - radiusY);
+        int endY = min(effectDrawingRect.height() - 1, y + radiusY);
+        for (unsigned channel = 0; channel < 4; ++channel) {
+            // Fill the kernel
+            extrema.clear();
+            for (int j = 0; j <= radiusX; ++j) {
+                unsigned char columnExtrema = srcPixelArray->get(startY * effectWidth + 4 * j + channel);
+                for (int i = startY; i <= endY; ++i) {
+                    unsigned char pixel = srcPixelArray->get(i * effectWidth + 4 * j + channel);
+                    if ((m_type == FEMORPHOLOGY_OPERATOR_ERODE && pixel <= columnExtrema) ||
+                        (m_type == FEMORPHOLOGY_OPERATOR_DILATE && pixel >= columnExtrema))
+                        columnExtrema = pixel;
+                }
+                extrema.append(columnExtrema);
+            }
+            
+            // Kernel is filled, get extrema of next column 
+            for (int x = 0; x < effectDrawingRect.width(); ++x) {
+                unsigned endX = min(x + radiusX, effectDrawingRect.width() - 1);
+                unsigned char columnExtrema = srcPixelArray->get(startY * effectWidth + endX * 4 + channel);
+                for (int i = startY; i <= endY; ++i) {
+                    unsigned char pixel = srcPixelArray->get(i * effectWidth + endX * 4 + channel);
+                    if ((m_type == FEMORPHOLOGY_OPERATOR_ERODE && pixel <= columnExtrema) ||
+                        (m_type == FEMORPHOLOGY_OPERATOR_DILATE && pixel >= columnExtrema))
+                        columnExtrema = pixel;
+                }
+                if (x - radiusX >= 0)
+                    extrema.remove(0);
+                if (x + radiusX <= effectDrawingRect.width())
+                    extrema.append(columnExtrema);
+                unsigned char entireExtrema = extrema[0];
+                for (unsigned kernelIndex = 0; kernelIndex < extrema.size(); ++kernelIndex) {
+                    if ((m_type == FEMORPHOLOGY_OPERATOR_ERODE && extrema[kernelIndex] <= entireExtrema) ||
+                        (m_type == FEMORPHOLOGY_OPERATOR_DILATE && extrema[kernelIndex] >= entireExtrema))
+                        entireExtrema = extrema[kernelIndex];
+                }
+                imageData->data()->set(y * effectWidth + 4 * x + channel, entireExtrema);
+            }
+        }
+    }
+    resultImage()->putPremultipliedImageData(imageData.get(), imageRect, IntPoint());
 }
 
 void FEMorphology::dump()
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEOffset.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEOffset.cpp
index ce9ee3df67..0066c3ec5e 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEOffset.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEOffset.cpp
@@ -74,17 +74,24 @@ void FEOffset::apply(Filter* filter)
     if (!filterContext)
         return;
 
+    setIsAlphaImage(m_in->isAlphaImage());
+
+    FloatRect sourceImageRect = filter->sourceImageRect();
+    sourceImageRect.scale(filter->filterResolution().width(), filter->filterResolution().height());
+
     if (filter->effectBoundingBoxMode()) {
-        setDx(dx() * filter->sourceImageRect().width());
-        setDy(dy() * filter->sourceImageRect().height());
+        m_dx *= sourceImageRect.width();
+        m_dy *= sourceImageRect.height();
     }
+    m_dx *= filter->filterResolution().width();
+    m_dy *= filter->filterResolution().height();
 
-    FloatRect dstRect = FloatRect(dx() + m_in->subRegion().x() - subRegion().x(),
-                                  dy() + m_in->subRegion().y() - subRegion().y(),
-                                  m_in->subRegion().width(),
-                                  m_in->subRegion().height());
+    FloatRect dstRect = FloatRect(m_dx + m_in->scaledSubRegion().x() - scaledSubRegion().x(),
+                                  m_dy + m_in->scaledSubRegion().y() - scaledSubRegion().y(),
+                                  m_in->scaledSubRegion().width(),
+                                  m_in->scaledSubRegion().height());
 
-    filterContext->drawImage(m_in->resultImage()->image(), dstRect);
+    filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, dstRect);
 }
 
 void FEOffset::dump()
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp
index eb0c280775..0b43abaf5b 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp
@@ -30,7 +30,7 @@ namespace WebCore {
 
 FESpecularLighting::FESpecularLighting(FilterEffect* in, const Color& lightingColor, const float& surfaceScale,
     const float& specularConstant, const float& specularExponent, const float& kernelUnitLengthX,
-    const float& kernelUnitLengthY, LightSource* lightSource)
+    const float& kernelUnitLengthY, PassRefPtr<LightSource> lightSource)
     : FilterEffect()
     , m_in(in)
     , m_lightingColor(lightingColor)
@@ -45,7 +45,7 @@ FESpecularLighting::FESpecularLighting(FilterEffect* in, const Color& lightingCo
 
 PassRefPtr<FESpecularLighting> FESpecularLighting::create(FilterEffect* in, const Color& lightingColor,
     const float& surfaceScale, const float& specularConstant, const float& specularExponent,
-    const float& kernelUnitLengthX, const float& kernelUnitLengthY, LightSource* lightSource)
+    const float& kernelUnitLengthX, const float& kernelUnitLengthY, PassRefPtr<LightSource> lightSource)
 {
     return adoptRef(new FESpecularLighting(in, lightingColor, surfaceScale, specularConstant, specularExponent,
         kernelUnitLengthX, kernelUnitLengthY, lightSource));
@@ -120,7 +120,7 @@ const LightSource* FESpecularLighting::lightSource() const
     return m_lightSource.get();
 }
 
-void FESpecularLighting::setLightSource(LightSource* lightSource)
+void FESpecularLighting::setLightSource(PassRefPtr<LightSource> lightSource)
 {
     m_lightSource = lightSource;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.h
index dec5163e46..f4947fdbb3 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.h
@@ -33,7 +33,7 @@ namespace WebCore {
     class FESpecularLighting : public FilterEffect {
     public:
         static PassRefPtr<FESpecularLighting> create(FilterEffect*, const Color&, const float&, const float&,
-            const float&, const float&, const float&, LightSource*);
+            const float&, const float&, const float&, PassRefPtr<LightSource>);
         virtual ~FESpecularLighting();
 
         Color lightingColor() const;
@@ -55,7 +55,7 @@ namespace WebCore {
         void setKernelUnitLengthY(float);
 
         const LightSource* lightSource() const;
-        void setLightSource(LightSource*);
+        void setLightSource(PassRefPtr<LightSource>);
 
         virtual FloatRect uniteEffectRect(Filter* filter) { return calculateUnionOfChildEffectSubregions(filter, m_in.get()); }
         void apply(Filter*);
@@ -64,7 +64,7 @@ namespace WebCore {
 
     private:
         FESpecularLighting(FilterEffect*, const Color&, const float&, const float&, const float&,
-            const float&, const float&, LightSource*);
+            const float&, const float&, PassRefPtr<LightSource>);
 
         RefPtr<FilterEffect> m_in;
         Color m_lightingColor;
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.cpp
index 3071501d9c..5bc21298ff 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.cpp
@@ -23,10 +23,10 @@
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFETile.h"
 
+#include "AffineTransform.h"
 #include "Filter.h"
 #include "GraphicsContext.h"
 #include "Pattern.h"
-#include "TransformationMatrix.h"
 #include "SVGRenderTreeAsText.h"
 
 namespace WebCore {
@@ -58,24 +58,29 @@ void FETile::apply(Filter* filter)
     if (!filterContext)
         return;
 
-    IntRect tileRect = enclosingIntRect(m_in->subRegion());
+    setIsAlphaImage(m_in->isAlphaImage());
+
+    IntRect tileRect = enclosingIntRect(m_in->scaledSubRegion());
 
     // Source input needs more attention. It has the size of the filterRegion but gives the
     // size of the cutted sourceImage back. This is part of the specification and optimization.
-    if (m_in->isSourceInput())
-        tileRect = enclosingIntRect(filter->filterRegion());
+    if (m_in->isSourceInput()) {
+        FloatRect filterRegion = filter->filterRegion();
+        filterRegion.scale(filter->filterResolution().width(), filter->filterResolution().height());
+        tileRect = enclosingIntRect(filterRegion);
+    }
 
     OwnPtr<ImageBuffer> tileImage = ImageBuffer::create(tileRect.size());
     GraphicsContext* tileImageContext = tileImage->context();
-    tileImageContext->drawImage(m_in->resultImage()->image(), IntPoint());
+    tileImageContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, IntPoint());
     RefPtr<Pattern> pattern = Pattern::create(tileImage->image(), true, true);
 
-    TransformationMatrix matrix;
-    matrix.translate(m_in->subRegion().x() - subRegion().x(), m_in->subRegion().y() - subRegion().y());
+    AffineTransform matrix;
+    matrix.translate(m_in->scaledSubRegion().x() - scaledSubRegion().x(), m_in->scaledSubRegion().y() - scaledSubRegion().y());
     pattern.get()->setPatternSpaceTransform(matrix);
 
     filterContext->setFillPattern(pattern);
-    filterContext->fillRect(FloatRect(FloatPoint(), subRegion().size()));
+    filterContext->fillRect(FloatRect(FloatPoint(), scaledSubRegion().size()));
 }
 
 void FETile::dump()
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.cpp
index 6bfcf39436..4ec4e6e896 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.cpp
@@ -34,7 +34,7 @@ SVGFilter::SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool
 
 void SVGFilter::calculateEffectSubRegion(FilterEffect* effect)
 {
-    FloatRect subRegionBBox = effect->subRegion();
+    FloatRect subRegionBBox = effect->effectBoundaries();
     FloatRect useBBox = effect->unionOfChildEffectSubregions();
     FloatRect newSubRegion = subRegionBBox;
 
@@ -70,6 +70,9 @@ void SVGFilter::calculateEffectSubRegion(FilterEffect* effect)
     newSubRegion.intersect(m_filterRect);
 
     effect->setSubRegion(newSubRegion);
+    newSubRegion.scale(filterResolution().width(), filterResolution().height());
+    effect->setScaledSubRegion(newSubRegion);
+    m_maxImageSize = m_maxImageSize.expandedTo(newSubRegion.size()); 
 }
 
 PassRefPtr<SVGFilter> SVGFilter::create(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.h
index f23d1ea999..c4714c6268 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.h
@@ -24,6 +24,7 @@
 #include "Filter.h"
 #include "FilterEffect.h"
 #include "FloatRect.h"
+#include "FloatSize.h"
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -35,15 +36,18 @@ namespace WebCore {
     public:
         static PassRefPtr<SVGFilter> create(const FloatRect&, const FloatRect&, bool);
 
-        bool effectBoundingBoxMode() { return m_effectBBoxMode; }
+        virtual bool effectBoundingBoxMode() const { return m_effectBBoxMode; }
 
-        FloatRect filterRegion() { return m_filterRect; }
-        FloatRect sourceImageRect() { return m_itemBox; }
-        void calculateEffectSubRegion(FilterEffect*);
+        virtual FloatRect filterRegion() const { return m_filterRect; }
+        virtual FloatRect sourceImageRect() const { return m_itemBox; }
+
+        virtual FloatSize maxImageSize() const { return m_maxImageSize; }
+        virtual void calculateEffectSubRegion(FilterEffect*);
 
     private:
         SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode);
 
+        FloatSize m_maxImageSize;
         FloatRect m_itemBox;
         FloatRect m_filterRect;
         bool m_effectBBoxMode;
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
index 67668d6511..fc6924af4e 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
@@ -42,14 +42,14 @@ SVGFilterBuilder::SVGFilterBuilder()
 void SVGFilterBuilder::add(const AtomicString& id, RefPtr<FilterEffect> effect)
 {
     if (id.isEmpty()) {
-        m_lastEffect = effect.get();
+        m_lastEffect = effect;
         return;
     }
 
     if (m_builtinEffects.contains(id))
         return;
 
-    m_lastEffect = effect.get();
+    m_lastEffect = effect;
     m_namedEffects.set(id, m_lastEffect);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGLightSource.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGLightSource.h
index 22b43c8a2b..6f0075c227 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGLightSource.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGLightSource.h
@@ -24,6 +24,7 @@
 #define SVGLightSource_h
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
+#include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGPointLightSource.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGPointLightSource.h
index 772e278f98..1e966cc8ae 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGPointLightSource.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGPointLightSource.h
@@ -31,16 +31,22 @@ namespace WebCore {
 
     class PointLightSource : public LightSource {
     public:
-        PointLightSource(const FloatPoint3D& position)
-            : LightSource(LS_POINT)
-            , m_position(position)
-        { }
+        static PassRefPtr<PointLightSource> create(const FloatPoint3D& position)
+        {
+            return adoptRef(new PointLightSource(position));
+        }
 
         const FloatPoint3D& position() const { return m_position; }
 
         virtual TextStream& externalRepresentation(TextStream&) const;
 
     private:
+        PointLightSource(const FloatPoint3D& position)
+            : LightSource(LS_POINT)
+            , m_position(position)
+        {
+        }
+
         FloatPoint3D m_position;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGSpotLightSource.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGSpotLightSource.h
index 9a787fb23d..05280d20e8 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGSpotLightSource.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGSpotLightSource.h
@@ -31,13 +31,11 @@ namespace WebCore {
 
     class SpotLightSource : public LightSource {
     public:
-        SpotLightSource(const FloatPoint3D& position, const FloatPoint3D& direction, float specularExponent, float limitingConeAngle)
-            : LightSource(LS_SPOT)
-            , m_position(position)
-            , m_direction(direction)
-            , m_specularExponent(specularExponent)
-            , m_limitingConeAngle(limitingConeAngle)
-        { }
+        static PassRefPtr<SpotLightSource> create(const FloatPoint3D& position, const FloatPoint3D& direction,
+                                                  float specularExponent, float limitingConeAngle)
+        {
+            return adoptRef(new SpotLightSource(position, direction, specularExponent, limitingConeAngle));
+        }
 
         const FloatPoint3D& position() const { return m_position; }
         const FloatPoint3D& direction() const { return m_direction; }
@@ -48,6 +46,16 @@ namespace WebCore {
         virtual TextStream& externalRepresentation(TextStream&) const;
 
     private:
+        SpotLightSource(const FloatPoint3D& position, const FloatPoint3D& direction,
+                        float specularExponent, float limitingConeAngle)
+            : LightSource(LS_SPOT)
+            , m_position(position)
+            , m_direction(direction)
+            , m_specularExponent(specularExponent)
+            , m_limitingConeAngle(limitingConeAngle)
+        {
+        }
+
         FloatPoint3D m_position;
         FloatPoint3D m_direction;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/svgattrs.in b/src/3rdparty/webkit/WebCore/svg/svgattrs.in
index 1ab5b064aa..608103956b 100644
--- a/src/3rdparty/webkit/WebCore/svg/svgattrs.in
+++ b/src/3rdparty/webkit/WebCore/svg/svgattrs.in
@@ -2,7 +2,6 @@ namespace="SVG"
 namespaceURI="http://www.w3.org/2000/svg"
 guardFactoryWith="ENABLE(SVG)"
 attrsNullNamespace
-exportStrings
 
 accent-height
 accumulate
diff --git a/src/3rdparty/webkit/WebCore/svg/svgtags.in b/src/3rdparty/webkit/WebCore/svg/svgtags.in
index 30a0e4cfd5..adc05f2f7b 100644
--- a/src/3rdparty/webkit/WebCore/svg/svgtags.in
+++ b/src/3rdparty/webkit/WebCore/svg/svgtags.in
@@ -1,8 +1,7 @@
 namespace="SVG"
 namespaceURI="http://www.w3.org/2000/svg"
 guardFactoryWith="ENABLE(SVG)"
-exportStrings
-
+ 
 a createWithNew
 #if ENABLE_SVG_FONTS
 altGlyph createWithNew
diff --git a/src/3rdparty/webkit/WebCore/svg/xlinkattrs.in b/src/3rdparty/webkit/WebCore/svg/xlinkattrs.in
index 2e4890378d..6e7fef1998 100644
--- a/src/3rdparty/webkit/WebCore/svg/xlinkattrs.in
+++ b/src/3rdparty/webkit/WebCore/svg/xlinkattrs.in
@@ -1,6 +1,5 @@
 namespace="XLink"
 namespaceURI="http://www.w3.org/1999/xlink"
-exportStrings
 
 actuate
 arcrole
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/SocketStreamHandleSoup.cpp b/src/3rdparty/webkit/WebCore/websockets/ThreadableWebSocketChannel.cpp
index 6aa33fce2c..28b9263f9b 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/SocketStreamHandleSoup.cpp
+++ b/src/3rdparty/webkit/WebCore/websockets/ThreadableWebSocketChannel.cpp
@@ -29,60 +29,46 @@
  */
 
 #include "config.h"
-#include "SocketStreamHandle.h"
 
-#include "KURL.h"
-#include "Logging.h"
-#include "NotImplemented.h"
-#include "SocketStreamHandleClient.h"
+#if ENABLE(WEB_SOCKETS)
 
-namespace WebCore {
+#include "ThreadableWebSocketChannel.h"
 
-SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient* client)
-    : SocketStreamHandleBase(url, client)
-{
-    LOG(Network, "SocketStreamHandle %p new client %p", this, m_client);
-    notImplemented();
-}
+#include "PlatformString.h"
+#include "ScriptExecutionContext.h"
+#include "ThreadableWebSocketChannelClientWrapper.h"
+#include "WebSocketChannel.h"
+#include "WebSocketChannelClient.h"
+#include "WorkerContext.h"
+#include "WorkerRunLoop.h"
+#include "WorkerThread.h"
+#include "WorkerThreadableWebSocketChannel.h"
 
-SocketStreamHandle::~SocketStreamHandle()
-{
-    LOG(Network, "SocketStreamHandle %p delete", this);
-    setClient(0);
-    notImplemented();
-}
+#include <wtf/PassRefPtr.h>
 
-int SocketStreamHandle::platformSend(const char*, int)
-{
-    LOG(Network, "SocketStreamHandle %p platformSend", this);
-    notImplemented();
-    return 0;
-}
+namespace WebCore {
 
-void SocketStreamHandle::platformClose()
-{
-    LOG(Network, "SocketStreamHandle %p platformClose", this);
-    notImplemented();
-}
+static const char webSocketChannelMode[] = "webSocketChannelMode";
 
-void SocketStreamHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge&)
+PassRefPtr<ThreadableWebSocketChannel> ThreadableWebSocketChannel::create(ScriptExecutionContext* context, WebSocketChannelClient* client, const KURL& url, const String& protocol)
 {
-    notImplemented();
-}
+    ASSERT(context);
+    ASSERT(client);
 
-void SocketStreamHandle::receivedCredential(const AuthenticationChallenge&, const Credential&)
-{
-    notImplemented();
-}
+#if ENABLE(WORKERS)
+    if (context->isWorkerContext()) {
+        WorkerContext* workerContext = static_cast<WorkerContext*>(context);
+        WorkerRunLoop& runLoop = workerContext->thread()->runLoop();
+        String mode = webSocketChannelMode;
+        mode.append(String::number(runLoop.createUniqueId()));
+        return WorkerThreadableWebSocketChannel::create(workerContext, client, mode, url, protocol);
+    }
+#endif // ENABLE(WORKERS)
 
-void SocketStreamHandle::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&)
-{
-    notImplemented();
+    ASSERT(context->isDocument());
+    return WebSocketChannel::create(context, client, url, protocol);
 }
 
-void SocketStreamHandle::receivedCancellation(const AuthenticationChallenge&)
-{
-    notImplemented();
-}
+} // namespace WebCore
 
-}  // namespace WebCore
+#endif // ENABLE(WEB_SOCKETS)
diff --git a/src/3rdparty/webkit/WebCore/websockets/ThreadableWebSocketChannel.h b/src/3rdparty/webkit/WebCore/websockets/ThreadableWebSocketChannel.h
new file mode 100644
index 0000000000..74ea4b4b9a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/websockets/ThreadableWebSocketChannel.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ThreadableWebSocketChannel_h
+#define ThreadableWebSocketChannel_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class KURL;
+class ScriptExecutionContext;
+class String;
+class WebSocketChannelClient;
+
+class ThreadableWebSocketChannel : public Noncopyable {
+public:
+    static PassRefPtr<ThreadableWebSocketChannel> create(ScriptExecutionContext*, WebSocketChannelClient*, const KURL&, const String& protocol);
+
+    virtual void connect() = 0;
+    virtual bool send(const String& message) = 0;
+    virtual unsigned long bufferedAmount() const = 0;
+    virtual void close() = 0;
+    virtual void disconnect() = 0; // Will suppress didClose().
+
+    void ref() { refThreadableWebSocketChannel(); }
+    void deref() { derefThreadableWebSocketChannel(); }
+
+protected:
+    virtual ~ThreadableWebSocketChannel() { }
+    virtual void refThreadableWebSocketChannel() = 0;
+    virtual void derefThreadableWebSocketChannel() = 0;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif // ThreadableWebSocketChannel_h
diff --git a/src/3rdparty/webkit/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h b/src/3rdparty/webkit/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
new file mode 100644
index 0000000000..28d61294d0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ThreadableWebSocketChannelClientWrapper_h
+#define ThreadableWebSocketChannelClientWrapper_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketChannelClient.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+class String;
+
+class ThreadableWebSocketChannelClientWrapper : public ThreadSafeShared<ThreadableWebSocketChannelClientWrapper> {
+public:
+    static PassRefPtr<ThreadableWebSocketChannelClientWrapper> create(WebSocketChannelClient* client)
+    {
+        return adoptRef(new ThreadableWebSocketChannelClientWrapper(client));
+    }
+
+    void clearSyncMethodDone()
+    {
+        m_syncMethodDone = false;
+    }
+    void setSyncMethodDone()
+    {
+        m_syncMethodDone = true;
+    }
+
+    bool syncMethodDone() const
+    {
+        return m_syncMethodDone;
+    }
+
+    bool sent() const
+    {
+        return m_sent;
+    }
+    void setSent(bool sent)
+    {
+        m_sent = sent;
+        m_syncMethodDone = true;
+    }
+
+    unsigned long bufferedAmount() const
+    {
+        return m_bufferedAmount;
+    }
+    void setBufferedAmount(unsigned long bufferedAmount)
+    {
+        m_bufferedAmount = bufferedAmount;
+        m_syncMethodDone = true;
+    }
+
+    void clearClient()
+    {
+        m_client = 0;
+    }
+
+    void didConnect()
+    {
+        if (m_client)
+            m_client->didConnect();
+    }
+
+    void didReceiveMessage(const String& msg)
+    {
+        if (m_client)
+            m_client->didReceiveMessage(msg);
+    }
+
+    void didClose(unsigned long unhandledBufferedAmount)
+    {
+        if (m_client)
+            m_client->didClose(unhandledBufferedAmount);
+    }
+
+protected:
+    ThreadableWebSocketChannelClientWrapper(WebSocketChannelClient* client)
+        : m_client(client)
+        , m_syncMethodDone(false)
+        , m_sent(false)
+        , m_bufferedAmount(0)
+    {
+    }
+
+    WebSocketChannelClient* m_client;
+    bool m_syncMethodDone;
+    bool m_sent;
+    unsigned long m_bufferedAmount;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif // ThreadableWebSocketChannelClientWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp b/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp
index 32e05591c0..f9d3052638 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp
@@ -43,36 +43,14 @@
 #include "Logging.h"
 #include "MessageEvent.h"
 #include "ScriptExecutionContext.h"
-#include "SecurityOrigin.h"
+#include "StringBuilder.h"
+#include "ThreadableWebSocketChannel.h"
 #include "WebSocketChannel.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
-class ProcessWebSocketEventTask : public ScriptExecutionContext::Task {
-public:
-    typedef void (WebSocket::*Method)(Event*);
-    static PassRefPtr<ProcessWebSocketEventTask> create(PassRefPtr<WebSocket> webSocket, PassRefPtr<Event> event)
-    {
-        return adoptRef(new ProcessWebSocketEventTask(webSocket, event));
-    }
-    virtual void performTask(ScriptExecutionContext*)
-    {
-        ExceptionCode ec = 0;
-        m_webSocket->dispatchEvent(m_event.get(), ec);
-        ASSERT(!ec);
-    }
-
-  private:
-    ProcessWebSocketEventTask(PassRefPtr<WebSocket> webSocket, PassRefPtr<Event> event)
-        : m_webSocket(webSocket)
-        , m_event(event) { }
-
-    RefPtr<WebSocket> m_webSocket;
-    RefPtr<Event> m_event;
-};
-
-static bool isValidProtocolString(const WebCore::String& protocol)
+static bool isValidProtocolString(const String& protocol)
 {
     if (protocol.isNull())
         return true;
@@ -80,12 +58,26 @@ static bool isValidProtocolString(const WebCore::String& protocol)
         return false;
     const UChar* characters = protocol.characters();
     for (size_t i = 0; i < protocol.length(); i++) {
-        if (characters[i] < 0x21 || characters[i] > 0x7E)
+        if (characters[i] < 0x20 || characters[i] > 0x7E)
             return false;
     }
     return true;
 }
 
+static String encodeProtocolString(const String& protocol)
+{
+    StringBuilder builder;
+    for (size_t i = 0; i < protocol.length(); i++) {
+        if (protocol[i] < 0x20 || protocol[i] > 0x7E)
+            builder.append(String::format("\\u%04X", protocol[i]));
+        else if (protocol[i] == 0x5c)
+            builder.append("\\\\");
+        else
+            builder.append(protocol[i]);
+    }
+    return builder.toString();
+}
+
 #if USE(V8)
 
 static bool webSocketsAvailable = false;
@@ -105,12 +97,13 @@ bool WebSocket::isAvailable()
 WebSocket::WebSocket(ScriptExecutionContext* context)
     : ActiveDOMObject(context, this)
     , m_state(CONNECTING)
+    , m_bufferedAmountAfterClose(0)
 {
 }
 
 WebSocket::~WebSocket()
 {
-    if (m_channel.get())
+    if (m_channel)
         m_channel->disconnect();
 }
 
@@ -125,22 +118,41 @@ void WebSocket::connect(const KURL& url, const String& protocol, ExceptionCode&
     m_url = url;
     m_protocol = protocol;
 
+    if (!m_url.isValid()) {
+        scriptExecutionContext()->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Invalid url for WebSocket " + url.string(), 0, scriptExecutionContext()->securityOrigin()->toString());
+        m_state = CLOSED;
+        ec = SYNTAX_ERR;
+        return;
+    }
+
     if (!m_url.protocolIs("ws") && !m_url.protocolIs("wss")) {
-        LOG_ERROR("Error: wrong url for WebSocket %s", url.string().utf8().data());
+        scriptExecutionContext()->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Wrong url scheme for WebSocket " + url.string(), 0, scriptExecutionContext()->securityOrigin()->toString());
+        m_state = CLOSED;
+        ec = SYNTAX_ERR;
+        return;
+    }
+    if (m_url.hasFragmentIdentifier()) {
+        scriptExecutionContext()->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "URL has fragment component " + url.string(), 0, scriptExecutionContext()->securityOrigin()->toString());
         m_state = CLOSED;
         ec = SYNTAX_ERR;
         return;
     }
     if (!isValidProtocolString(m_protocol)) {
-        LOG_ERROR("Error: wrong protocol for WebSocket %s", m_protocol.utf8().data());
+        scriptExecutionContext()->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Wrong protocol for WebSocket '" + encodeProtocolString(m_protocol) + "'", 0, scriptExecutionContext()->securityOrigin()->toString());
         m_state = CLOSED;
         ec = SYNTAX_ERR;
         return;
     }
-    // FIXME: if m_url.port() is blocking port, raise SECURITY_ERR.
+    if (!portAllowed(url)) {
+        scriptExecutionContext()->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, String::format("WebSocket port %d blocked", url.port()), 0, scriptExecutionContext()->securityOrigin()->toString());
+        m_state = CLOSED;
+        ec = SECURITY_ERR;
+        return;
+    }
 
-    m_channel = WebSocketChannel::create(scriptExecutionContext(), this, m_url, m_protocol);
+    m_channel = ThreadableWebSocketChannel::create(scriptExecutionContext(), this, m_url, m_protocol);
     m_channel->connect();
+    ActiveDOMObject::setPendingActivity(this);
 }
 
 bool WebSocket::send(const String& message, ExceptionCode& ec)
@@ -151,9 +163,12 @@ bool WebSocket::send(const String& message, ExceptionCode& ec)
         return false;
     }
     // No exception is raised if the connection was once established but has subsequently been closed.
-    if (m_state == CLOSED)
+    if (m_state == CLOSED) {
+        m_bufferedAmountAfterClose += message.utf8().length() + 2; // 2 for frameing
         return false;
+    }
     // FIXME: check message is valid utf8.
+    ASSERT(m_channel);
     return m_channel->send(message);
 }
 
@@ -163,6 +178,7 @@ void WebSocket::close()
     if (m_state == CLOSED)
         return;
     m_state = CLOSED;
+    m_bufferedAmountAfterClose = m_channel->bufferedAmount();
     m_channel->close();
 }
 
@@ -180,7 +196,7 @@ unsigned long WebSocket::bufferedAmount() const
 {
     if (m_state == OPEN)
         return m_channel->bufferedAmount();
-    return 0;
+    return m_bufferedAmountAfterClose;
 }
 
 ScriptExecutionContext* WebSocket::scriptExecutionContext() const
@@ -188,34 +204,68 @@ ScriptExecutionContext* WebSocket::scriptExecutionContext() const
     return ActiveDOMObject::scriptExecutionContext();
 }
 
+void WebSocket::contextDestroyed()
+{
+    LOG(Network, "WebSocket %p scriptExecutionContext destroyed", this);
+    ASSERT(!m_channel);
+    ASSERT(m_state == CLOSED);
+    ActiveDOMObject::contextDestroyed();
+}
+
+void WebSocket::stop()
+{
+    bool pending = hasPendingActivity();
+    if (m_channel)
+        m_channel->disconnect();
+    m_channel = 0;
+    m_state = CLOSED;
+    ActiveDOMObject::stop();
+    if (pending)
+        ActiveDOMObject::unsetPendingActivity(this);
+}
+
 void WebSocket::didConnect()
 {
     LOG(Network, "WebSocket %p didConnect", this);
-    if (m_state != CONNECTING || !scriptExecutionContext()) {
-        didClose();
+    if (m_state != CONNECTING) {
+        didClose(0);
         return;
     }
+    ASSERT(scriptExecutionContext());
     m_state = OPEN;
-    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, Event::create(eventNames().openEvent, false, false)));
+    dispatchEvent(Event::create(eventNames().openEvent, false, false));
 }
 
 void WebSocket::didReceiveMessage(const String& msg)
 {
     LOG(Network, "WebSocket %p didReceiveMessage %s", this, msg.utf8().data());
-    if (m_state != OPEN || !scriptExecutionContext())
+    if (m_state != OPEN)
         return;
+    ASSERT(scriptExecutionContext());
     RefPtr<MessageEvent> evt = MessageEvent::create();
-    // FIXME: origin, lastEventId, source, messagePort.
     evt->initMessageEvent(eventNames().messageEvent, false, false, SerializedScriptValue::create(msg), "", "", 0, 0);
-    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, evt));
+    dispatchEvent(evt);
+}
+
+void WebSocket::didReceiveMessageError()
+{
+    LOG(Network, "WebSocket %p didReceiveErrorMessage", this);
+    if (m_state != OPEN)
+        return;
+    ASSERT(scriptExecutionContext());
+    dispatchEvent(Event::create(eventNames().errorEvent, false, false));
 }
 
-void WebSocket::didClose()
+void WebSocket::didClose(unsigned long unhandledBufferedAmount)
 {
     LOG(Network, "WebSocket %p didClose", this);
     m_state = CLOSED;
-    if (scriptExecutionContext())
-        scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, Event::create(eventNames().closeEvent, false, false)));
+    m_bufferedAmountAfterClose += unhandledBufferedAmount;
+    ASSERT(scriptExecutionContext());
+    dispatchEvent(Event::create(eventNames().closeEvent, false, false));
+    m_channel = 0;
+    if (hasPendingActivity())
+        ActiveDOMObject::unsetPendingActivity(this);
 }
 
 EventTargetData* WebSocket::eventTargetData()
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocket.h b/src/3rdparty/webkit/WebCore/websockets/WebSocket.h
index 9ecbed741d..e91796f145 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocket.h
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocket.h
@@ -46,7 +46,7 @@
 namespace WebCore {
 
     class String;
-    class WebSocketChannel;
+    class ThreadableWebSocketChannel;
 
     class WebSocket : public RefCounted<WebSocket>, public EventTarget, public ActiveDOMObject, public WebSocketChannelClient {
     public:
@@ -76,28 +76,24 @@ namespace WebCore {
 
         DEFINE_ATTRIBUTE_EVENT_LISTENER(open);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(close);
 
         // EventTarget
         virtual WebSocket* toWebSocket() { return this; }
 
         virtual ScriptExecutionContext* scriptExecutionContext() const;
-
-        // ActiveDOMObject
-        //  virtual bool hasPendingActivity() const;
-        // virtual void contextDestroyed();
-        // virtual bool canSuspend() const;
-        // virtual void suspend();
-        // virtual void resume();
-        // virtual void stop();
+        virtual void contextDestroyed();
+        virtual void stop();
 
         using RefCounted<WebSocket>::ref;
         using RefCounted<WebSocket>::deref;
 
         // WebSocketChannelClient
         virtual void didConnect();
-        virtual void didReceiveMessage(const String& msg);
-        virtual void didClose();
+        virtual void didReceiveMessage(const String& message);
+        virtual void didReceiveMessageError();
+        virtual void didClose(unsigned long unhandledBufferedAmount);
 
     private:
         WebSocket(ScriptExecutionContext*);
@@ -107,20 +103,17 @@ namespace WebCore {
         virtual EventTargetData* eventTargetData();
         virtual EventTargetData* ensureEventTargetData();
 
-        void dispatchOpenEvent(Event*);
-        void dispatchMessageEvent(Event*);
-        void dispatchCloseEvent(Event*);
-
-        RefPtr<WebSocketChannel> m_channel;
+        RefPtr<ThreadableWebSocketChannel> m_channel;
 
         State m_state;
         KURL m_url;
         String m_protocol;
         EventTargetData m_eventTargetData;
+        unsigned long m_bufferedAmountAfterClose;
     };
 
-}  // namespace WebCore
+} // namespace WebCore
 
-#endif  // ENABLE(WEB_SOCKETS)
+#endif // ENABLE(WEB_SOCKETS)
 
-#endif  // WebSocket_h
+#endif // WebSocket_h
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocket.idl b/src/3rdparty/webkit/WebCore/websockets/WebSocket.idl
index c662940471..1707478e25 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocket.idl
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocket.idl
@@ -32,6 +32,7 @@ module websockets {
 
     interface [
         Conditional=WEB_SOCKETS,
+        CustomConstructor,    
         EventTarget,
         NoStaticTables
     ] WebSocket {
@@ -48,6 +49,7 @@ module websockets {
         // networking
         attribute EventListener onopen;
         attribute EventListener onmessage;
+        attribute EventListener onerror;
         attribute EventListener onclose;
 
         [Custom] boolean send(in DOMString data)
@@ -55,12 +57,12 @@ module websockets {
         void close();
 
         // EventTarget interface
-        [Custom] void addEventListener(in DOMString type,
-                                       in EventListener listener,
-                                       in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type,
+        [JSCCustom] void addEventListener(in DOMString type,
                                           in EventListener listener,
                                           in boolean useCapture);
+        [JSCCustom] void removeEventListener(in DOMString type,
+                                             in EventListener listener,
+                                             in boolean useCapture);
         boolean dispatchEvent(in Event evt)
             raises(EventException);
     };
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.cpp b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.cpp
index be388b42f4..3585cb7994 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.cpp
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.cpp
@@ -44,6 +44,7 @@
 #include "SocketStreamHandle.h"
 #include "StringHash.h"
 #include "WebSocketChannelClient.h"
+#include "WebSocketHandshake.h"
 
 #include <wtf/Deque.h>
 #include <wtf/FastMalloc.h>
@@ -57,7 +58,6 @@ WebSocketChannel::WebSocketChannel(ScriptExecutionContext* context, WebSocketCha
     , m_handshake(url, protocol, context)
     , m_buffer(0)
     , m_bufferSize(0)
-    , m_unhandledBufferSize(0)
 {
 }
 
@@ -69,7 +69,7 @@ WebSocketChannel::~WebSocketChannel()
 void WebSocketChannel::connect()
 {
     LOG(Network, "WebSocketChannel %p connect", this);
-    ASSERT(!m_handle.get());
+    ASSERT(!m_handle);
     m_handshake.reset();
     ref();
     m_handle = SocketStreamHandle::create(m_handshake.url(), this);
@@ -78,55 +78,47 @@ void WebSocketChannel::connect()
 bool WebSocketChannel::send(const String& msg)
 {
     LOG(Network, "WebSocketChannel %p send %s", this, msg.utf8().data());
+    ASSERT(m_handle);
     Vector<char> buf;
     buf.append('\0');  // frame type
     buf.append(msg.utf8().data(), msg.utf8().length());
     buf.append('\xff');  // frame end
-    if (!m_handle.get()) {
-        m_unhandledBufferSize += buf.size();
-        return false;
-    }
     return m_handle->send(buf.data(), buf.size());
 }
 
 unsigned long WebSocketChannel::bufferedAmount() const
 {
     LOG(Network, "WebSocketChannel %p bufferedAmount", this);
-    if (!m_handle.get())
-        return m_unhandledBufferSize;
+    ASSERT(m_handle);
     return m_handle->bufferedAmount();
 }
 
 void WebSocketChannel::close()
 {
     LOG(Network, "WebSocketChannel %p close", this);
-    if (m_handle.get())
+    if (m_handle)
         m_handle->close();  // will call didClose()
 }
 
 void WebSocketChannel::disconnect()
 {
     LOG(Network, "WebSocketChannel %p disconnect", this);
+    m_handshake.clearScriptExecutionContext();
     m_client = 0;
-    if (m_handle.get())
+    m_context = 0;
+    if (m_handle)
         m_handle->close();
 }
 
-void WebSocketChannel::willOpenStream(SocketStreamHandle*, const KURL&)
-{
-}
-
-void WebSocketChannel::willSendData(SocketStreamHandle*, const char*, int)
-{
-}
-
 void WebSocketChannel::didOpen(SocketStreamHandle* handle)
 {
     LOG(Network, "WebSocketChannel %p didOpen", this);
-    ASSERT(handle == m_handle.get());
+    ASSERT(handle == m_handle);
+    if (!m_context)
+        return;
     const CString& handshakeMessage = m_handshake.clientHandshakeMessage();
     if (!handle->send(handshakeMessage.data(), handshakeMessage.length())) {
-        LOG(Network, "Error in sending handshake message.");
+        m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Error sending handshake message.", 0, m_handshake.clientOrigin());
         handle->close();
     }
 }
@@ -134,14 +126,15 @@ void WebSocketChannel::didOpen(SocketStreamHandle* handle)
 void WebSocketChannel::didClose(SocketStreamHandle* handle)
 {
     LOG(Network, "WebSocketChannel %p didClose", this);
-    ASSERT(handle == m_handle.get() || !m_handle.get());
-    if (m_handle.get()) {
-        m_unhandledBufferSize = handle->bufferedAmount();
+    ASSERT_UNUSED(handle, handle == m_handle || !m_handle);
+    if (m_handle) {
+        unsigned long unhandledBufferedAmount = m_handle->bufferedAmount();
         WebSocketChannelClient* client = m_client;
         m_client = 0;
+        m_context = 0;
         m_handle = 0;
         if (client)
-            client->didClose();
+            client->didClose(unhandledBufferedAmount);
     }
     deref();
 }
@@ -149,16 +142,20 @@ void WebSocketChannel::didClose(SocketStreamHandle* handle)
 void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* data, int len)
 {
     LOG(Network, "WebSocketChannel %p didReceiveData %d", this, len);
-    ASSERT(handle == m_handle.get());
-    if (!appendToBuffer(data, len)) {
-        handle->close();
+    RefPtr<WebSocketChannel> protect(this); // The client can close the channel, potentially removing the last reference.
+    ASSERT(handle == m_handle);
+    if (!m_context) {
         return;
     }
     if (!m_client) {
         handle->close();
         return;
     }
-    if (m_handshake.mode() != WebSocketHandshake::Connected) {
+    if (!appendToBuffer(data, len)) {
+        handle->close();
+        return;
+    }
+    if (m_handshake.mode() == WebSocketHandshake::Incomplete) {
         int headerLength = m_handshake.readServerHandshake(m_buffer, m_bufferSize);
         if (headerLength <= 0)
             return;
@@ -167,13 +164,17 @@ void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* da
             if (!m_handshake.serverSetCookie().isEmpty()) {
                 if (m_context->isDocument()) {
                     Document* document = static_cast<Document*>(m_context);
-                    if (cookiesEnabled(document))
-                        document->setCookie(m_handshake.serverSetCookie());
+                    if (cookiesEnabled(document)) {
+                        ExceptionCode ec; // Exception (for sandboxed documents) ignored.
+                        document->setCookie(m_handshake.serverSetCookie(), ec);
+                    }
                 }
             }
             // FIXME: handle set-cookie2.
             LOG(Network, "WebSocketChannel %p connected", this);
             m_client->didConnect();
+            if (!m_client)
+                return;
             break;
         default:
             LOG(Network, "WebSocketChannel %p connection failed", this);
@@ -185,6 +186,8 @@ void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* da
             return;
         LOG(Network, "remaining in read buf %ul", m_bufferSize);
     }
+    if (m_handshake.mode() != WebSocketHandshake::Connected)
+        return;
 
     const char* nextFrame = m_buffer;
     const char* p = m_buffer;
@@ -193,19 +196,29 @@ void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* da
         unsigned char frameByte = static_cast<unsigned char>(*p++);
         if ((frameByte & 0x80) == 0x80) {
             int length = 0;
-            while (p < end && (*p & 0x80) == 0x80) {
+            while (p < end) {
                 if (length > std::numeric_limits<int>::max() / 128) {
                     LOG(Network, "frame length overflow %d", length);
+                    m_client->didReceiveMessageError();
+                    if (!m_client)
+                        return;
                     handle->close();
                     return;
                 }
-                length = length * 128 + (*p & 0x7f);
+                char msgByte = *p;
+                length = length * 128 + (msgByte & 0x7f);
                 ++p;
+                if (!(msgByte & 0x80))
+                    break;
             }
             if (p + length < end) {
                 p += length;
                 nextFrame = p;
-            }
+                m_client->didReceiveMessageError();
+                if (!m_client)
+                    return;
+            } else
+                break;
         } else {
             const char* msgStart = p;
             while (p < end && *p != '\xff')
@@ -213,6 +226,10 @@ void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* da
             if (p < end && *p == '\xff') {
                 if (frameByte == 0x00)
                     m_client->didReceiveMessage(String::fromUTF8(msgStart, p - msgStart));
+                else
+                    m_client->didReceiveMessageError();
+                if (!m_client)
+                    return;
                 ++p;
                 nextFrame = p;
             }
@@ -224,10 +241,18 @@ void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* da
 void WebSocketChannel::didFail(SocketStreamHandle* handle, const SocketStreamError&)
 {
     LOG(Network, "WebSocketChannel %p didFail", this);
-    ASSERT(handle == m_handle.get() || !m_handle.get());
+    ASSERT(handle == m_handle || !m_handle);
     handle->close();
 }
 
+void WebSocketChannel::didReceiveAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&)
+{
+}
+
+void WebSocketChannel::didCancelAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&)
+{
+}
+
 bool WebSocketChannel::appendToBuffer(const char* data, int len)
 {
     char* newBuffer = 0;
@@ -240,7 +265,7 @@ bool WebSocketChannel::appendToBuffer(const char* data, int len)
         m_bufferSize += len;
         return true;
     }
-    LOG(Network, "Too long WebSocket frame %d", m_bufferSize + len);
+    m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, String::format("WebSocket frame (at %d bytes) is too long.", m_bufferSize + len), 0, m_handshake.clientOrigin());
     return false;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.h b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.h
index ad38163a12..41a03abda5 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.h
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.h
@@ -34,6 +34,7 @@
 #if ENABLE(WEB_SOCKETS)
 
 #include "SocketStreamHandleClient.h"
+#include "ThreadableWebSocketChannel.h"
 #include "WebSocketHandshake.h"
 #include <wtf/RefCounted.h>
 
@@ -45,29 +46,33 @@ namespace WebCore {
     class SocketStreamError;
     class WebSocketChannelClient;
 
-    class WebSocketChannel : public RefCounted<WebSocketChannel>, public SocketStreamHandleClient {
+    class WebSocketChannel : public RefCounted<WebSocketChannel>, public SocketStreamHandleClient, public ThreadableWebSocketChannel {
     public:
         static PassRefPtr<WebSocketChannel> create(ScriptExecutionContext* context, WebSocketChannelClient* client, const KURL& url, const String& protocol) { return adoptRef(new WebSocketChannel(context, client, url, protocol)); }
         virtual ~WebSocketChannel();
 
         virtual void connect();
-
-        virtual bool send(const String& msg);
+        virtual bool send(const String& message);
         virtual unsigned long bufferedAmount() const;
-
         virtual void close();
+        virtual void disconnect(); // Will suppress didClose().
 
-        virtual void disconnect();
-
-        virtual void willOpenStream(SocketStreamHandle*, const KURL&);
-        virtual void willSendData(SocketStreamHandle*, const char*, int);
         virtual void didOpen(SocketStreamHandle*);
         virtual void didClose(SocketStreamHandle*);
         virtual void didReceiveData(SocketStreamHandle*, const char*, int);
         virtual void didFail(SocketStreamHandle*, const SocketStreamError&);
+        virtual void didReceiveAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&);
+        virtual void didCancelAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&);
+
+        using RefCounted<WebSocketChannel>::ref;
+        using RefCounted<WebSocketChannel>::deref;
+
+    protected:
+        virtual void refThreadableWebSocketChannel() { ref(); }
+        virtual void derefThreadableWebSocketChannel() { deref(); }
 
     private:
-        WebSocketChannel(ScriptExecutionContext*, WebSocketChannelClient*, const KURL&, const String&);
+        WebSocketChannel(ScriptExecutionContext*, WebSocketChannelClient*, const KURL&, const String& protocol);
 
         bool appendToBuffer(const char* data, int len);
         void skipBuffer(int len);
@@ -78,11 +83,10 @@ namespace WebCore {
         RefPtr<SocketStreamHandle> m_handle;
         char* m_buffer;
         int m_bufferSize;
-        unsigned long m_unhandledBufferSize;
     };
 
-}  // namespace WebCore
+} // namespace WebCore
 
-#endif  // ENABLE(WEB_SOCKETS)
+#endif // ENABLE(WEB_SOCKETS)
 
-#endif  // WebSocketChannel_h
+#endif // WebSocketChannel_h
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocketChannelClient.h b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannelClient.h
index 463cada9bd..1551073f6d 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocketChannelClient.h
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannelClient.h
@@ -40,14 +40,15 @@ namespace WebCore {
         virtual ~WebSocketChannelClient() { }
         virtual void didConnect() { }
         virtual void didReceiveMessage(const String&) { }
-        virtual void didClose() { }
+        virtual void didReceiveMessageError() { }
+        virtual void didClose(unsigned long /* unhandledBufferedAmount */) { }
 
     protected:
         WebSocketChannelClient() { }
     };
 
-}  // namespace WebCore
+} // namespace WebCore
 
-#endif  // ENABLE(WEB_SOCKETS)
+#endif // ENABLE(WEB_SOCKETS)
 
-#endif  // WebSocketChannelClient_h
+#endif // WebSocketChannelClient_h
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshake.cpp b/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshake.cpp
index 691fa1cdc4..a5f06724c3 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshake.cpp
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshake.cpp
@@ -36,6 +36,7 @@
 
 #include "AtomicString.h"
 #include "CString.h"
+#include "Cookie.h"
 #include "CookieJar.h"
 #include "Document.h"
 #include "HTTPHeaderMap.h"
@@ -74,6 +75,18 @@ static String extractResponseCode(const char* header, int len)
     return String(space1 + 1, space2 - space1 - 1);
 }
 
+static String resourceName(const KURL& url)
+{
+    String name = url.path();
+    if (name.isEmpty())
+        name = "/";
+    if (!url.query().isNull())
+        name += "?" + url.query();
+    ASSERT(!name.isEmpty());
+    ASSERT(!name.contains(' '));
+    return name;
+}
+
 WebSocketHandshake::WebSocketHandshake(const KURL& url, const String& protocol, ScriptExecutionContext* context)
     : m_url(url)
     , m_clientProtocol(protocol)
@@ -117,11 +130,6 @@ bool WebSocketHandshake::secure() const
     return m_secure;
 }
 
-void WebSocketHandshake::setSecure(bool secure)
-{
-    m_secure = secure;
-}
-
 String WebSocketHandshake::clientOrigin() const
 {
     return m_context->securityOrigin()->toString();
@@ -139,30 +147,25 @@ String WebSocketHandshake::clientLocation() const
             builder.append(String::number(m_url.port()));
         }
     }
-    builder.append(m_url.path());
+    builder.append(resourceName(m_url));
     return builder.toString();
 }
 
 CString WebSocketHandshake::clientHandshakeMessage() const
 {
+    // Keep the following consistent with clientHandshakeRequest().
     StringBuilder builder;
 
     builder.append("GET ");
-    builder.append(m_url.path());
-    if (!m_url.query().isEmpty()) {
-        builder.append("?");
-        builder.append(m_url.query());
-    }
+    builder.append(resourceName(m_url));
     builder.append(" HTTP/1.1\r\n");
     builder.append("Upgrade: WebSocket\r\n");
     builder.append("Connection: Upgrade\r\n");
     builder.append("Host: ");
     builder.append(m_url.host().lower());
-    if (m_url.port()) {
-        if ((!m_secure && m_url.port() != 80) || (m_secure && m_url.port() != 443)) {
-            builder.append(":");
-            builder.append(String::number(m_url.port()));
-        }
+    if (m_url.port() && ((!m_secure && m_url.port() != 80) || (m_secure && m_url.port() != 443))) {
+        builder.append(":");
+        builder.append(String::number(m_url.port()));
     }
     builder.append("\r\n");
     builder.append("Origin: ");
@@ -173,12 +176,11 @@ CString WebSocketHandshake::clientHandshakeMessage() const
         builder.append(m_clientProtocol);
         builder.append("\r\n");
     }
+
     KURL url = httpURLForAuthenticationAndCookies();
-    // FIXME: set authentication information or cookies for url.
-    // Set "Authorization: <credentials>" if authentication information exists for url.
     if (m_context->isDocument()) {
         Document* document = static_cast<Document*>(m_context);
-        String cookie = cookies(document, url);
+        String cookie = cookieRequestHeaderFieldValue(document, url);
         if (!cookie.isEmpty()) {
             builder.append("Cookie: ");
             builder.append(cookie);
@@ -186,10 +188,28 @@ CString WebSocketHandshake::clientHandshakeMessage() const
         }
         // Set "Cookie2: <cookie>" if cookies 2 exists for url?
     }
+
     builder.append("\r\n");
     return builder.toString().utf8();
 }
 
+WebSocketHandshakeRequest WebSocketHandshake::clientHandshakeRequest() const
+{
+    // Keep the following consistent with clientHandshakeMessage().
+    WebSocketHandshakeRequest request(m_url, clientOrigin(), m_clientProtocol);
+
+    KURL url = httpURLForAuthenticationAndCookies();
+    if (m_context->isDocument()) {
+        Document* document = static_cast<Document*>(m_context);
+        String cookie = cookieRequestHeaderFieldValue(document, url);
+        if (!cookie.isEmpty())
+            request.addExtraHeaderField("Cookie", cookie);
+        // Set "Cookie2: <cookie>" if cookies 2 exists for url?
+    }
+
+    return request;
+}
+
 void WebSocketHandshake::reset()
 {
     m_mode = Incomplete;
@@ -201,6 +221,11 @@ void WebSocketHandshake::reset()
     m_setCookie2 = String();
 }
 
+void WebSocketHandshake::clearScriptExecutionContext()
+{
+    m_context = 0;
+}
+
 int WebSocketHandshake::readServerHandshake(const char* header, size_t len)
 {
     m_mode = Incomplete;
@@ -213,40 +238,49 @@ int WebSocketHandshake::readServerHandshake(const char* header, size_t len)
     else {
         const String& code = extractResponseCode(header, len);
         if (code.isNull()) {
-            LOG(Network, "short server handshake: %s", header);
+            m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Short server handshake: " + String(header, len), 0, clientOrigin());
             return -1;
         }
         if (code.isEmpty()) {
-            LOG(Network, "no response code found: %s", header);
+            m_mode = Failed;
+            m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "No response code found: " + String(header, len), 0, clientOrigin());
             return len;
         }
         LOG(Network, "response code: %s", code.utf8().data());
         if (code == "401") {
-            LOG(Network, "Authentication required");
+            m_mode = Failed;
+            m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Authentication required, but not implemented yet.", 0, clientOrigin());
             return len;
         } else {
-            LOG(Network, "Mismatch server handshake: %s", header);
+            m_mode = Failed;
+            m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Unexpected response code:" + code, 0, clientOrigin());
             return len;
         }
     }
     const char* p = header + sizeof(webSocketServerHandshakeHeader) - 1;
-    const char* end = header + len + 1;
+    const char* end = header + len;
 
     if (m_mode == Normal) {
         size_t headerSize = end - p;
-        if (headerSize < sizeof(webSocketUpgradeHeader) - 1)
+        if (headerSize < sizeof(webSocketUpgradeHeader) - 1) {
+            m_mode = Incomplete;
             return 0;
+        }
         if (memcmp(p, webSocketUpgradeHeader, sizeof(webSocketUpgradeHeader) - 1)) {
-            LOG(Network, "Bad upgrade header: %s", p);
+            m_mode = Failed;
+            m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Bad Upgrade header: " + String(p, end - p), 0, clientOrigin());
             return p - header + sizeof(webSocketUpgradeHeader) - 1;
         }
         p += sizeof(webSocketUpgradeHeader) - 1;
 
         headerSize = end - p;
-        if (headerSize < sizeof(webSocketConnectionHeader) - 1)
+        if (headerSize < sizeof(webSocketConnectionHeader) - 1) {
+            m_mode = Incomplete;
             return -1;
+        }
         if (memcmp(p, webSocketConnectionHeader, sizeof(webSocketConnectionHeader) - 1)) {
-            LOG(Network, "Bad connection header: %s", p);
+            m_mode = Failed;
+            m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Bad Connection header: " + String(p, end - p), 0, clientOrigin());
             return p - header + sizeof(webSocketConnectionHeader) - 1;
         }
         p += sizeof(webSocketConnectionHeader) - 1;
@@ -254,6 +288,7 @@ int WebSocketHandshake::readServerHandshake(const char* header, size_t len)
 
     if (!strnstr(p, "\r\n\r\n", end - p)) {
         // Just hasn't been received fully yet.
+        m_mode = Incomplete;
         return -1;
     }
     HTTPHeaderMap headers;
@@ -337,7 +372,8 @@ void WebSocketHandshake::setServerSetCookie2(const String& setCookie2)
 KURL WebSocketHandshake::httpURLForAuthenticationAndCookies() const
 {
     KURL url = m_url.copy();
-    url.setProtocol(m_secure ? "https" : "http");
+    bool couldSetProtocol = url.setProtocol(m_secure ? "https" : "http");
+    ASSERT_UNUSED(couldSetProtocol, couldSetProtocol);
     return url;
 }
 
@@ -355,13 +391,13 @@ const char* WebSocketHandshake::readHTTPHeaders(const char* start, const char* e
                 if (name.isEmpty()) {
                     if (p + 1 < end && *(p + 1) == '\n')
                         return p + 2;
-                    LOG(Network, "CR doesn't follow LF p=%p end=%p", p, end);
+                    m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "CR doesn't follow LF at " + String(p, end - p), 0, clientOrigin());
                     return 0;
                 }
-                LOG(Network, "Unexpected CR in name");
+                m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Unexpected CR in name at " + String(p, end - p), 0, clientOrigin());
                 return 0;
             case '\n':
-                LOG(Network, "Unexpected LF in name");
+                m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Unexpected LF in name at " + String(p, end - p), 0, clientOrigin());
                 return 0;
             case ':':
                 break;
@@ -385,7 +421,7 @@ const char* WebSocketHandshake::readHTTPHeaders(const char* start, const char* e
             case '\r':
                 break;
             case '\n':
-                LOG(Network, "Unexpected LF in value");
+                m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Unexpected LF in value at " + String(p, end - p), 0, clientOrigin());
                 return 0;
             default:
                 value.append(*p);
@@ -396,7 +432,7 @@ const char* WebSocketHandshake::readHTTPHeaders(const char* start, const char* e
             }
         }
         if (p >= end || *p != '\n') {
-            LOG(Network, "CR doesn't follow LF after value p=%p end=%p", p, end);
+            m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "CR doesn't follow LF after value at " + String(p, end - p), 0, clientOrigin());
             return 0;
         }
         AtomicString nameStr(String::fromUTF8(name.data(), name.size()));
@@ -438,19 +474,25 @@ void WebSocketHandshake::checkResponseHeaders()
 {
     ASSERT(m_mode == Normal);
     m_mode = Failed;
-    if (m_wsOrigin.isNull() || m_wsLocation.isNull())
+    if (m_wsOrigin.isNull()) {
+        m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Error during WebSocket handshake: 'websocket-origin' header is missing", 0, clientOrigin());
+        return;
+    }
+    if (m_wsLocation.isNull()) {
+        m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Error during WebSocket handshake: 'websocket-location' header is missing", 0, clientOrigin());
         return;
+    }
 
     if (clientOrigin() != m_wsOrigin) {
-        LOG(Network, "Mismatch origin: %s != %s", clientOrigin().utf8().data(), m_wsOrigin.utf8().data());
+        m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Error during WebSocket handshake: origin mismatch: " + clientOrigin() + " != " + m_wsOrigin, 0, clientOrigin());
         return;
     }
     if (clientLocation() != m_wsLocation) {
-        LOG(Network, "Mismatch location: %s != %s", clientLocation().utf8().data(), m_wsLocation.utf8().data());
+        m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Error during WebSocket handshake: location mismatch: " + clientLocation() + " != " + m_wsLocation, 0, clientOrigin());
         return;
     }
     if (!m_clientProtocol.isEmpty() && m_clientProtocol != m_wsProtocol) {
-        LOG(Network, "Mismatch protocol: %s != %s", m_clientProtocol.utf8().data(), m_wsProtocol.utf8().data());
+        m_context->addMessage(ConsoleDestination, JSMessageSource, LogMessageType, ErrorMessageLevel, "Error during WebSocket handshake: protocol mismatch: " + m_clientProtocol + " != " + m_wsProtocol, 0, clientOrigin());
         return;
     }
     m_mode = Connected;
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshake.h b/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshake.h
index d5dbe68c9f..df199fff27 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshake.h
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshake.h
@@ -35,6 +35,7 @@
 
 #include "KURL.h"
 #include "PlatformString.h"
+#include "WebSocketHandshakeRequest.h"
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
@@ -58,14 +59,15 @@ namespace WebCore {
         void setClientProtocol(const String& protocol);
 
         bool secure() const;
-        void setSecure(bool secure);
 
         String clientOrigin() const;
         String clientLocation() const;
 
         CString clientHandshakeMessage() const;
+        WebSocketHandshakeRequest clientHandshakeRequest() const;
 
         void reset();
+        void clearScriptExecutionContext();
 
         int readServerHandshake(const char* header, size_t len);
         Mode mode() const;
@@ -106,8 +108,8 @@ namespace WebCore {
         String m_setCookie2;
     };
 
-}  // namespace WebCore
+} // namespace WebCore
 
-#endif  // ENABLE(WEB_SOCKETS)
+#endif // ENABLE(WEB_SOCKETS)
 
-#endif  // WebSocketHandshake_h
+#endif // WebSocketHandshake_h
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshakeRequest.cpp b/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshakeRequest.cpp
new file mode 100644
index 0000000000..9a41167d40
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshakeRequest.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2010 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketHandshakeRequest.h"
+
+#include "AtomicString.h"
+#include "StringBuilder.h"
+#include <utility>
+#include <wtf/Assertions.h>
+
+using namespace std;
+
+namespace WebCore {
+
+WebSocketHandshakeRequest::WebSocketHandshakeRequest(const KURL& url, const String& origin, const String& webSocketProtocol)
+    : m_url(url)
+    , m_secure(m_url.protocolIs("wss"))
+    , m_origin(origin)
+    , m_webSocketProtocol(webSocketProtocol)
+{
+    ASSERT(!origin.isNull());
+}
+
+WebSocketHandshakeRequest::~WebSocketHandshakeRequest()
+{
+}
+
+void WebSocketHandshakeRequest::addExtraHeaderField(const AtomicString& name, const String& value)
+{
+    m_extraHeaderFields.append(HeaderField(name, value));
+}
+
+void WebSocketHandshakeRequest::addExtraHeaderField(const char* name, const String& value)
+{
+    m_extraHeaderFields.append(HeaderField(name, value));
+}
+
+Vector<WebSocketHandshakeRequest::HeaderField> WebSocketHandshakeRequest::headerFields() const
+{
+    Vector<HeaderField> fields;
+    fields.append(HeaderField("Upgrade", "WebSocket"));
+    fields.append(HeaderField("Connection", "Upgrade"));
+    fields.append(HeaderField("Host", host()));
+    fields.append(HeaderField("Origin", m_origin));
+    if (!m_webSocketProtocol.isEmpty())
+        fields.append(HeaderField("WebSocket-Protocol", m_webSocketProtocol));
+    fields.append(m_extraHeaderFields);
+    return fields;
+}
+
+String WebSocketHandshakeRequest::host() const
+{
+    StringBuilder builder;
+    builder.append(m_url.host().lower());
+    if ((!m_secure && m_url.port() != 80) || (m_secure && m_url.port() != 443)) {
+        builder.append(":");
+        builder.append(String::number(m_url.port()));
+    }
+    return builder.toString();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshakeRequest.h b/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshakeRequest.h
new file mode 100644
index 0000000000..d48813548b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshakeRequest.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2010 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketHandshakeRequest_h
+#define WebSocketHandshakeRequest_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "KURL.h"
+#include "PlatformString.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class AtomicString;
+
+class WebSocketHandshakeRequest {
+public:
+    WebSocketHandshakeRequest(const KURL&, const String& origin, const String& webSocketProtocol);
+    ~WebSocketHandshakeRequest();
+
+    // According to current Web Socket protocol specification, four mandatory headers (Upgrade, Connection, Host, and Origin) and
+    // one optional header (WebSocket-Protocol) should be sent in this order, at the beginning of the handshake request.
+    // The remaining headers can be set by using the following function.
+    void addExtraHeaderField(const AtomicString& name, const String& value);
+    void addExtraHeaderField(const char* name, const String& value);
+
+    // Returns the list of header fields including five special ones.
+    typedef std::pair<AtomicString, String> HeaderField;
+    Vector<HeaderField> headerFields() const;
+
+private:
+    String host() const;
+
+    KURL m_url;
+    bool m_secure;
+    String m_origin;
+    String m_webSocketProtocol;
+    Vector<HeaderField> m_extraHeaderFields;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif // WebSocketHandshakeRequest_h
diff --git a/src/3rdparty/webkit/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp b/src/3rdparty/webkit/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp
new file mode 100644
index 0000000000..3dda1042ad
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp
@@ -0,0 +1,362 @@
+/*
+ * Copyright (C) 2009, 2010 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS) && ENABLE(WORKERS)
+
+#include "WorkerThreadableWebSocketChannel.h"
+
+#include "GenericWorkerTask.h"
+#include "PlatformString.h"
+#include "ScriptExecutionContext.h"
+#include "ThreadableWebSocketChannelClientWrapper.h"
+#include "WebSocketChannel.h"
+#include "WebSocketChannelClient.h"
+#include "WorkerContext.h"
+#include "WorkerLoaderProxy.h"
+#include "WorkerRunLoop.h"
+#include "WorkerThread.h"
+
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+WorkerThreadableWebSocketChannel::WorkerThreadableWebSocketChannel(WorkerContext* context, WebSocketChannelClient* client, const String& taskMode, const KURL& url, const String& protocol)
+    : m_workerContext(context)
+    , m_workerClientWrapper(ThreadableWebSocketChannelClientWrapper::create(client))
+    , m_bridge(new Bridge(m_workerClientWrapper, m_workerContext, taskMode, url, protocol))
+{
+}
+
+WorkerThreadableWebSocketChannel::~WorkerThreadableWebSocketChannel()
+{
+    if (m_bridge)
+        m_bridge->disconnect();
+}
+
+void WorkerThreadableWebSocketChannel::connect()
+{
+    if (m_bridge)
+        m_bridge->connect();
+}
+
+bool WorkerThreadableWebSocketChannel::send(const String& message)
+{
+    if (!m_bridge)
+        return false;
+    return m_bridge->send(message);
+}
+
+unsigned long WorkerThreadableWebSocketChannel::bufferedAmount() const
+{
+    if (!m_bridge)
+        return 0;
+    return m_bridge->bufferedAmount();
+}
+
+void WorkerThreadableWebSocketChannel::close()
+{
+    if (m_bridge)
+        m_bridge->close();
+}
+
+void WorkerThreadableWebSocketChannel::disconnect()
+{
+    m_bridge->disconnect();
+    m_bridge.clear();
+}
+
+WorkerThreadableWebSocketChannel::Peer::Peer(RefPtr<ThreadableWebSocketChannelClientWrapper> clientWrapper, WorkerLoaderProxy& loaderProxy, ScriptExecutionContext* context, const String& taskMode, const KURL& url, const String& protocol)
+    : m_workerClientWrapper(clientWrapper)
+    , m_loaderProxy(loaderProxy)
+    , m_mainWebSocketChannel(WebSocketChannel::create(context, this, url, protocol))
+    , m_taskMode(taskMode)
+{
+    ASSERT(isMainThread());
+}
+
+WorkerThreadableWebSocketChannel::Peer::~Peer()
+{
+    ASSERT(isMainThread());
+    if (m_mainWebSocketChannel)
+        m_mainWebSocketChannel->disconnect();
+}
+
+void WorkerThreadableWebSocketChannel::Peer::connect()
+{
+    ASSERT(isMainThread());
+    if (!m_mainWebSocketChannel)
+        return;
+    m_mainWebSocketChannel->connect();
+}
+
+static void workerContextDidSend(ScriptExecutionContext* context, RefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper, bool sent)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    workerClientWrapper->setSent(sent);
+}
+
+void WorkerThreadableWebSocketChannel::Peer::send(const String& message)
+{
+    ASSERT(isMainThread());
+    if (!m_mainWebSocketChannel || !m_workerClientWrapper)
+        return;
+    bool sent = m_mainWebSocketChannel->send(message);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidSend, m_workerClientWrapper, sent), m_taskMode);
+}
+
+static void workerContextDidGetBufferedAmount(ScriptExecutionContext* context, RefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper, unsigned long bufferedAmount)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    workerClientWrapper->setBufferedAmount(bufferedAmount);
+}
+
+void WorkerThreadableWebSocketChannel::Peer::bufferedAmount()
+{
+    ASSERT(isMainThread());
+    if (!m_mainWebSocketChannel || !m_workerClientWrapper)
+        return;
+    unsigned long bufferedAmount = m_mainWebSocketChannel->bufferedAmount();
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidGetBufferedAmount, m_workerClientWrapper, bufferedAmount), m_taskMode);
+}
+
+void WorkerThreadableWebSocketChannel::Peer::close()
+{
+    ASSERT(isMainThread());
+    if (!m_mainWebSocketChannel)
+        return;
+    m_mainWebSocketChannel->close();
+    m_mainWebSocketChannel = 0;
+}
+
+void WorkerThreadableWebSocketChannel::Peer::disconnect()
+{
+    ASSERT(isMainThread());
+    if (!m_mainWebSocketChannel)
+        return;
+    m_mainWebSocketChannel->disconnect();
+    m_mainWebSocketChannel = 0;
+}
+
+static void workerContextDidConnect(ScriptExecutionContext* context, RefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    workerClientWrapper->didConnect();
+}
+
+void WorkerThreadableWebSocketChannel::Peer::didConnect()
+{
+    ASSERT(isMainThread());
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidConnect, m_workerClientWrapper), m_taskMode);
+}
+
+static void workerContextDidReceiveMessage(ScriptExecutionContext* context, RefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper, const String& message)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    workerClientWrapper->didReceiveMessage(message);
+}
+
+void WorkerThreadableWebSocketChannel::Peer::didReceiveMessage(const String& message)
+{
+    ASSERT(isMainThread());
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveMessage, m_workerClientWrapper, message), m_taskMode);
+}
+
+static void workerContextDidClose(ScriptExecutionContext* context, RefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper, unsigned long unhandledBufferedAmount)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    workerClientWrapper->didClose(unhandledBufferedAmount);
+}
+
+void WorkerThreadableWebSocketChannel::Peer::didClose(unsigned long unhandledBufferedAmount)
+{
+    ASSERT(isMainThread());
+    m_mainWebSocketChannel = 0;
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidClose, m_workerClientWrapper, unhandledBufferedAmount), m_taskMode);
+}
+
+void WorkerThreadableWebSocketChannel::Bridge::setWebSocketChannel(ScriptExecutionContext* context, Bridge* thisPtr, Peer* peer, RefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    thisPtr->m_peer = peer;
+    workerClientWrapper->setSyncMethodDone();
+}
+
+void WorkerThreadableWebSocketChannel::Bridge::mainThreadCreateWebSocketChannel(ScriptExecutionContext* context, Bridge* thisPtr, RefPtr<ThreadableWebSocketChannelClientWrapper> clientWrapper, const String& taskMode, const KURL& url, const String& protocol)
+{
+    ASSERT(isMainThread());
+    ASSERT_UNUSED(context, context->isDocument());
+
+    Peer* peer = Peer::create(clientWrapper, thisPtr->m_loaderProxy, context, taskMode, url, protocol);
+    thisPtr->m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&Bridge::setWebSocketChannel, thisPtr, peer, clientWrapper), taskMode);
+}
+
+WorkerThreadableWebSocketChannel::Bridge::Bridge(PassRefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper, PassRefPtr<WorkerContext> workerContext, const String& taskMode, const KURL& url, const String& protocol)
+    : m_workerClientWrapper(workerClientWrapper)
+    , m_workerContext(workerContext)
+    , m_loaderProxy(m_workerContext->thread()->workerLoaderProxy())
+    , m_taskMode(taskMode)
+    , m_peer(0)
+{
+    ASSERT(m_workerClientWrapper.get());
+    setMethodNotCompleted();
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&Bridge::mainThreadCreateWebSocketChannel, this, m_workerClientWrapper, m_taskMode, url, protocol));
+    waitForMethodCompletion();
+    ASSERT(m_peer);
+}
+
+WorkerThreadableWebSocketChannel::Bridge::~Bridge()
+{
+    disconnect();
+}
+
+void WorkerThreadableWebSocketChannel::mainThreadConnect(ScriptExecutionContext* context, Peer* peer)
+{
+    ASSERT(isMainThread());
+    ASSERT_UNUSED(context, context->isDocument());
+    ASSERT(peer);
+
+    peer->connect();
+}
+
+void WorkerThreadableWebSocketChannel::Bridge::connect()
+{
+    ASSERT(m_workerClientWrapper);
+    ASSERT(m_peer);
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&WorkerThreadableWebSocketChannel::mainThreadConnect, m_peer));
+}
+
+void WorkerThreadableWebSocketChannel::mainThreadSend(ScriptExecutionContext* context, Peer* peer, const String& message)
+{
+    ASSERT(isMainThread());
+    ASSERT_UNUSED(context, context->isDocument());
+    ASSERT(peer);
+
+    peer->send(message);
+}
+
+bool WorkerThreadableWebSocketChannel::Bridge::send(const String& message)
+{
+    if (!m_workerClientWrapper)
+        return false;
+    ASSERT(m_peer);
+    setMethodNotCompleted();
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&WorkerThreadableWebSocketChannel::mainThreadSend, m_peer, message));
+    waitForMethodCompletion();
+    ThreadableWebSocketChannelClientWrapper* clientWrapper = m_workerClientWrapper.get();
+    return clientWrapper && clientWrapper->sent();
+}
+
+void WorkerThreadableWebSocketChannel::mainThreadBufferedAmount(ScriptExecutionContext* context, Peer* peer)
+{
+    ASSERT(isMainThread());
+    ASSERT_UNUSED(context, context->isDocument());
+    ASSERT(peer);
+
+    peer->bufferedAmount();
+}
+
+unsigned long WorkerThreadableWebSocketChannel::Bridge::bufferedAmount()
+{
+    if (!m_workerClientWrapper)
+        return 0;
+    ASSERT(m_peer);
+    setMethodNotCompleted();
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&WorkerThreadableWebSocketChannel::mainThreadBufferedAmount, m_peer));
+    waitForMethodCompletion();
+    ThreadableWebSocketChannelClientWrapper* clientWrapper = m_workerClientWrapper.get();
+    if (clientWrapper)
+        return clientWrapper->bufferedAmount();
+    return 0;
+}
+
+void WorkerThreadableWebSocketChannel::mainThreadClose(ScriptExecutionContext* context, Peer* peer)
+{
+    ASSERT(isMainThread());
+    ASSERT_UNUSED(context, context->isDocument());
+    ASSERT(peer);
+
+    peer->close();
+}
+
+void WorkerThreadableWebSocketChannel::Bridge::close()
+{
+    ASSERT(m_peer);
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&WorkerThreadableWebSocketChannel::mainThreadClose, m_peer));
+}
+
+void WorkerThreadableWebSocketChannel::mainThreadDestroy(ScriptExecutionContext* context, Peer* peer)
+{
+    ASSERT(isMainThread());
+    ASSERT_UNUSED(context, context->isDocument());
+    ASSERT(peer);
+
+    delete peer;
+}
+
+void WorkerThreadableWebSocketChannel::Bridge::disconnect()
+{
+    clearClientWrapper();
+    if (m_peer) {
+        Peer* peer = m_peer;
+        m_peer = 0;
+        m_loaderProxy.postTaskToLoader(createCallbackTask(&mainThreadDestroy, peer));
+    }
+    m_workerContext = 0;
+}
+
+void WorkerThreadableWebSocketChannel::Bridge::clearClientWrapper()
+{
+    m_workerClientWrapper->clearClient();
+}
+
+void WorkerThreadableWebSocketChannel::Bridge::setMethodNotCompleted()
+{
+    ASSERT(m_workerClientWrapper);
+    m_workerClientWrapper->clearSyncMethodDone();
+}
+
+void WorkerThreadableWebSocketChannel::Bridge::waitForMethodCompletion()
+{
+    if (!m_workerContext)
+        return;
+    WorkerRunLoop& runLoop = m_workerContext->thread()->runLoop();
+    MessageQueueWaitResult result = MessageQueueMessageReceived;
+    ThreadableWebSocketChannelClientWrapper* clientWrapper = m_workerClientWrapper.get();
+    while (clientWrapper && !clientWrapper->syncMethodDone() && result != MessageQueueTerminated) {
+        result = runLoop.runInMode(m_workerContext.get(), m_taskMode);
+        clientWrapper = m_workerClientWrapper.get();
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
diff --git a/src/3rdparty/webkit/WebCore/websockets/WorkerThreadableWebSocketChannel.h b/src/3rdparty/webkit/WebCore/websockets/WorkerThreadableWebSocketChannel.h
new file mode 100644
index 0000000000..a6a16806a3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/websockets/WorkerThreadableWebSocketChannel.h
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2009, 2010 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerThreadableWebSocketChannel_h
+#define WorkerThreadableWebSocketChannel_h
+
+#if ENABLE(WEB_SOCKETS) && ENABLE(WORKERS)
+
+#include "PlatformString.h"
+#include "ThreadableWebSocketChannel.h"
+#include "WebSocketChannelClient.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+class KURL;
+class ScriptExecutionContext;
+class ThreadableWebSocketChannelClientWrapper;
+class WorkerContext;
+class WorkerLoaderProxy;
+class WorkerRunLoop;
+
+class WorkerThreadableWebSocketChannel : public RefCounted<WorkerThreadableWebSocketChannel>, public ThreadableWebSocketChannel {
+public:
+    static PassRefPtr<ThreadableWebSocketChannel> create(WorkerContext* workerContext, WebSocketChannelClient* client, const String& taskMode, const KURL& url, const String& protocol)
+    {
+        return adoptRef(new WorkerThreadableWebSocketChannel(workerContext, client, taskMode, url, protocol));
+    }
+    virtual ~WorkerThreadableWebSocketChannel();
+
+    virtual void connect();
+    virtual bool send(const String& message);
+    virtual unsigned long bufferedAmount() const;
+    virtual void close();
+    virtual void disconnect(); // Will suppress didClose().
+
+    using RefCounted<WorkerThreadableWebSocketChannel>::ref;
+    using RefCounted<WorkerThreadableWebSocketChannel>::deref;
+
+protected:
+    virtual void refThreadableWebSocketChannel() { ref(); }
+    virtual void derefThreadableWebSocketChannel() { deref(); }
+
+private:
+    // Generated by the bridge.  The Peer and its bridge should have identical
+    // lifetimes.
+    class Peer : public WebSocketChannelClient, public Noncopyable {
+    public:
+        static Peer* create(RefPtr<ThreadableWebSocketChannelClientWrapper> clientWrapper, WorkerLoaderProxy& loaderProxy, ScriptExecutionContext* context, const String& taskMode, const KURL& url, const String& protocol)
+        {
+            return new Peer(clientWrapper, loaderProxy, context, taskMode, url, protocol);
+        }
+        ~Peer();
+
+        void connect();
+        void send(const String& message);
+        void bufferedAmount();
+        void close();
+        void disconnect();
+
+        virtual void didConnect();
+        virtual void didReceiveMessage(const String& message);
+        virtual void didClose(unsigned long unhandledBufferedAmount);
+
+    private:
+        Peer(RefPtr<ThreadableWebSocketChannelClientWrapper>, WorkerLoaderProxy&, ScriptExecutionContext*, const String& taskMode, const KURL&, const String& protocol);
+
+        RefPtr<ThreadableWebSocketChannelClientWrapper> m_workerClientWrapper;
+        WorkerLoaderProxy& m_loaderProxy;
+        RefPtr<ThreadableWebSocketChannel> m_mainWebSocketChannel;
+        String m_taskMode;
+    };
+
+    // Bridge for Peer.  Running on the worker thread.
+    class Bridge : public RefCounted<Bridge> {
+    public:
+        Bridge(PassRefPtr<ThreadableWebSocketChannelClientWrapper>, PassRefPtr<WorkerContext>, const String& taskMode, const KURL&, const String& protocol);
+        ~Bridge();
+        void connect();
+        bool send(const String& message);
+        unsigned long bufferedAmount();
+        void close();
+        void disconnect();
+
+        using RefCounted<Bridge>::ref;
+        using RefCounted<Bridge>::deref;
+
+    private:
+        static void setWebSocketChannel(ScriptExecutionContext*, Bridge* thisPtr, Peer*, RefPtr<ThreadableWebSocketChannelClientWrapper>);
+
+        // Executed on the main thread to create a Peer for this bridge.
+        static void mainThreadCreateWebSocketChannel(ScriptExecutionContext*, Bridge* thisPtr, RefPtr<ThreadableWebSocketChannelClientWrapper>, const String& taskMode, const KURL&, const String& protocol);
+
+        // Executed on the worker context's thread.
+        void clearClientWrapper();
+
+        void setMethodNotCompleted();
+        void waitForMethodCompletion();
+
+        RefPtr<ThreadableWebSocketChannelClientWrapper> m_workerClientWrapper;
+        RefPtr<WorkerContext> m_workerContext;
+        WorkerLoaderProxy& m_loaderProxy;
+        String m_taskMode;
+        Peer* m_peer;
+    };
+
+    WorkerThreadableWebSocketChannel(WorkerContext*, WebSocketChannelClient*, const String& taskMode, const KURL&, const String& protocol);
+
+    static void mainThreadConnect(ScriptExecutionContext*, Peer*);
+    static void mainThreadSend(ScriptExecutionContext*, Peer*, const String& message);
+    static void mainThreadBufferedAmount(ScriptExecutionContext*, Peer*);
+    static void mainThreadClose(ScriptExecutionContext*, Peer*);
+    static void mainThreadDestroy(ScriptExecutionContext*, Peer*);
+
+    RefPtr<WorkerContext> m_workerContext;
+    RefPtr<ThreadableWebSocketChannelClientWrapper> m_workerClientWrapper;
+    RefPtr<Bridge> m_bridge;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif // WorkerThreadableWebSocketChannel_h
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLAElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLAElement.cpp
index 074c371e32..55b26984bc 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLAElement.cpp
@@ -29,7 +29,6 @@
 #if ENABLE(WML)
 #include "WMLAElement.h"
 
-#include "DNS.h"
 #include "Event.h"
 #include "EventHandler.h"
 #include "EventNames.h"
@@ -40,6 +39,7 @@
 #include "MappedAttribute.h"
 #include "MouseEvent.h"
 #include "RenderBox.h"
+#include "ResourceHandle.h"
 #include "WMLNames.h"
 
 namespace WebCore {
@@ -61,7 +61,7 @@ void WMLAElement::parseMappedAttribute(MappedAttribute* attr)
         if (isLink() && document()->isDNSPrefetchEnabled()) {
             String value = attr->value();
             if (protocolIs(value, "http") || protocolIs(value, "https") || value.startsWith("//"))
-                prefetchDNS(document()->completeURL(value).host());
+                ResourceHandle::prepareForURL(document()->completeURL(value));
         }
     } else if (attr->name() == HTMLNames::nameAttr
                || attr->name() == HTMLNames::titleAttr
@@ -140,8 +140,8 @@ void WMLAElement::defaultEventHandler(Event* event)
         }
  
         if (!event->defaultPrevented() && document()->frame()) {
-            KURL url = document()->completeURL(deprecatedParseURL(getAttribute(HTMLNames::hrefAttr)));
-            document()->frame()->loader()->urlSelected(url, target(), event, false, false, true);
+            String url = document()->completeURL(deprecatedParseURL(getAttribute(HTMLNames::hrefAttr)));
+            document()->frame()->loader()->urlSelected(url, target(), event, false, false, true, SendReferrer);
         }
 
         event->setDefaultHandled();
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
index 818b8186a9..45752cdc8a 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
@@ -136,7 +136,7 @@ void WMLCardElement::handleIntrinsicEventIfNeeded()
     // Calculate the entry method of current card 
     WMLIntrinsicEventType eventType = WMLIntrinsicEventUnknown;
 
-    switch (loader->loadType()) {
+    switch (loader->policyChecker()->loadType()) {
     case FrameLoadTypeReload:
         break;
     case FrameLoadTypeBack:
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLDocument.cpp b/src/3rdparty/webkit/WebCore/wml/WMLDocument.cpp
index ef0bfc8a01..44f4e2b494 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLDocument.cpp
@@ -23,6 +23,7 @@
 #if ENABLE(WML)
 #include "WMLDocument.h"
 
+#include "BackForwardList.h"
 #include "Frame.h"
 #include "Page.h"
 #include "Tokenizer.h"
@@ -34,7 +35,7 @@
 namespace WebCore {
 
 WMLDocument::WMLDocument(Frame* frame)
-    : Document(frame, false) 
+    : Document(frame, false, false) 
     , m_activeCard(0)
 {
     clearXMLVersion();
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
index 50b0fe4add..3004aba1d4 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
@@ -60,7 +60,7 @@ bool WMLElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry&
     
 void WMLElement::parseMappedAttribute(MappedAttribute* attr)
 {
-    if (attr->name() == HTMLNames::idAttr
+    if (attr->name() == idAttributeName()
         || attr->name() == HTMLNames::classAttr
         || attr->name() == HTMLNames::styleAttr)
         return StyledElement::parseMappedAttribute(attr);
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLInputElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.cpp
index b027bf0187..979a2940e2 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.cpp
@@ -123,6 +123,11 @@ const AtomicString& WMLInputElement::formControlName() const
     return m_data.name();
 }
 
+const String& WMLInputElement::suggestedValue() const
+{
+    return m_data.suggestedValue();
+}
+
 String WMLInputElement::value() const
 {
     String value = m_data.value();
@@ -132,7 +137,7 @@ String WMLInputElement::value() const
     return value;
 }
 
-void WMLInputElement::setValue(const String& value)
+void WMLInputElement::setValue(const String& value, bool sendChangeEvent)
 {
     setFormControlValueMatchesRenderer(false);
     m_data.setValue(constrainValue(value));
@@ -151,6 +156,13 @@ void WMLInputElement::setValue(const String& value)
     InputElement::notifyFormStateChanged(this);
 }
 
+void WMLInputElement::setValueForUser(const String& value)
+{
+    /* InputElement class defines pure virtual function 'setValueForUser', which 
+       will be useful only in HTMLInputElement. Do nothing in 'WMLInputElement'.
+     */
+}
+
 void WMLInputElement::setValueFromRenderer(const String& value)
 {
     InputElement::setValueFromRenderer(m_data, this, this, value);
@@ -280,13 +292,13 @@ void WMLInputElement::defaultEventHandler(Event* evt)
     if (clickDefaultFormButton) {
         // Fire onChange for text fields.
         RenderObject* r = renderer();
-        if (r && toRenderTextControl(r)->isEdited()) {
-            dispatchEvent(eventNames().changeEvent, true, false);
+        if (r && toRenderTextControl(r)->wasChangedSinceLastChangeEvent()) {
+            dispatchEvent(Event::create(eventNames().changeEvent, true, false));
             
             // Refetch the renderer since arbitrary JS code run during onchange can do anything, including destroying it.
             r = renderer();
             if (r)
-                toRenderTextControl(r)->setEdited(false);
+                toRenderTextControl(r)->setChangedSinceLastChangeEvent(false);
         }
 
         evt->setDefaultHandled();
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLInputElement.h b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.h
index 98ea13a9d6..eea633be2e 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.h
@@ -56,8 +56,10 @@ public:
     virtual int size() const;
     virtual const AtomicString& formControlType() const;
     virtual const AtomicString& formControlName() const;
+    virtual const String& suggestedValue() const;
     virtual String value() const;
-    virtual void setValue(const String&);
+    virtual void setValue(const String&, bool sendChangeEvent = false);
+    virtual void setValueForUser(const String&);
     virtual void setValueFromRenderer(const String&);
 
     virtual bool saveFormControlState(String& value) const;
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPageState.cpp b/src/3rdparty/webkit/WebCore/wml/WMLPageState.cpp
index 3e1863d2dd..4cf3e34c72 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPageState.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPageState.cpp
@@ -24,6 +24,7 @@
 #if ENABLE(WML)
 #include "WMLPageState.h"
 
+#include "BackForwardList.h"
 #include "CString.h"
 #include "Document.h"
 #include "Frame.h"
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPageState.h b/src/3rdparty/webkit/WebCore/wml/WMLPageState.h
index a5d8b232cd..ed1ce8e713 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPageState.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPageState.h
@@ -25,6 +25,7 @@
 
 #if ENABLE(WML)
 #include "StringHash.h"
+#include <wtf/HashMap.h>
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.cpp
index 03ca05a4b5..e6041f432a 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.cpp
@@ -83,7 +83,6 @@ void WMLSelectElement::selectAll()
 
 void WMLSelectElement::recalcStyle(StyleChange change)
 {
-    SelectElement::recalcStyle(m_data, this);
     WMLFormControlElement::recalcStyle(change);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLVariables.cpp b/src/3rdparty/webkit/WebCore/wml/WMLVariables.cpp
index f48aa1c701..f7be400f06 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLVariables.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLVariables.cpp
@@ -251,7 +251,7 @@ String substituteVariableReferences(const String& reference, Document* document,
         if (!conversionMode.isEmpty()) {
             // Override default escape mode, if desired
             WMLVariableEscapingMode specifiedEscapeMode = WMLVariableEscapingNone; 
-            if (isValid = isValidVariableEscapingModeString(conversionMode, specifiedEscapeMode))
+            if ((isValid = isValidVariableEscapingModeString(conversionMode, specifiedEscapeMode)))
                 escapeMode = specifiedEscapeMode;
 
             if (!isValid)
diff --git a/src/3rdparty/webkit/WebCore/workers/AbstractWorker.cpp b/src/3rdparty/webkit/WebCore/workers/AbstractWorker.cpp
index 6ba892251e..10bc95f0c5 100644
--- a/src/3rdparty/webkit/WebCore/workers/AbstractWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/AbstractWorker.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -38,6 +38,7 @@
 #include "Event.h"
 #include "EventException.h"
 #include "EventNames.h"
+#include "InspectorController.h"
 #include "ScriptExecutionContext.h"
 #include "SecurityOrigin.h"
 
@@ -50,6 +51,21 @@ AbstractWorker::AbstractWorker(ScriptExecutionContext* context)
 
 AbstractWorker::~AbstractWorker()
 {
+    onDestroyWorker();
+}
+
+void AbstractWorker::onDestroyWorker()
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspector = scriptExecutionContext() ? scriptExecutionContext()->inspectorController() : 0)
+        inspector->didDestroyWorker(asID());
+#endif
+}
+
+void AbstractWorker::contextDestroyed()
+{
+    onDestroyWorker();
+    ActiveDOMObject::contextDestroyed(); 
 }
 
 KURL AbstractWorker::resolveURL(const String& url, ExceptionCode& ec)
diff --git a/src/3rdparty/webkit/WebCore/workers/AbstractWorker.h b/src/3rdparty/webkit/WebCore/workers/AbstractWorker.h
index 2209856071..789dba2327 100644
--- a/src/3rdparty/webkit/WebCore/workers/AbstractWorker.h
+++ b/src/3rdparty/webkit/WebCore/workers/AbstractWorker.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -57,18 +57,21 @@ namespace WebCore {
         using RefCounted<AbstractWorker>::ref;
         using RefCounted<AbstractWorker>::deref;
 
+        virtual void contextDestroyed();
         AbstractWorker(ScriptExecutionContext*);
         virtual ~AbstractWorker();
 
     protected:
         // Helper function that converts a URL to an absolute URL and checks the result for validity.
         KURL resolveURL(const String& url, ExceptionCode& ec);
+        intptr_t asID() const { return reinterpret_cast<intptr_t>(this); }
 
     private:
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
         virtual EventTargetData* eventTargetData();
         virtual EventTargetData* ensureEventTargetData();
+        void onDestroyWorker();
         
         EventTargetData m_eventTargetData;
     };
diff --git a/src/3rdparty/webkit/WebCore/workers/AbstractWorker.idl b/src/3rdparty/webkit/WebCore/workers/AbstractWorker.idl
index 00b8fbb41b..4361dfc4f6 100644
--- a/src/3rdparty/webkit/WebCore/workers/AbstractWorker.idl
+++ b/src/3rdparty/webkit/WebCore/workers/AbstractWorker.idl
@@ -33,18 +33,17 @@ module threads {
     interface [
         Conditional=WORKERS,
         CustomToJS,
-        EventTarget,
-        GenerateConstructor
+        EventTarget
     ] AbstractWorker {
 
         attribute EventListener onerror;
 
-        [Custom] void addEventListener(in DOMString type,
-                                       in EventListener listener,
-                                       in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type,
+        [JSCCustom] void addEventListener(in DOMString type,
                                           in EventListener listener,
                                           in boolean useCapture);
+        [JSCCustom] void removeEventListener(in DOMString type,
+                                             in EventListener listener,
+                                             in boolean useCapture);
         boolean dispatchEvent(in Event evt)
             raises(EventException);
     };
diff --git a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl
index f421b9af8d..8b73a06a88 100644
--- a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl
+++ b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl
@@ -35,7 +35,8 @@ module threads {
         ExtendsDOMGlobalObject,
         IsWorkerContext,
         GenerateNativeConverter,
-        NoStaticTables
+        NoStaticTables,
+        OmitConstructor
     ] DedicatedWorkerContext : WorkerContext {
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
diff --git a/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.cpp b/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.cpp
index 8b1a480e09..e4fa5d3740 100644
--- a/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.cpp
@@ -73,8 +73,8 @@ public:
     bool matches(const String& name, PassRefPtr<SecurityOrigin> origin, const KURL& urlToMatch) const;
 
     // WorkerLoaderProxy
-    virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>);
-    virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String&);
+    virtual void postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task>);
+    virtual void postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutionContext::Task>, const String&);
 
     // WorkerReportingProxy
     virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL);
@@ -128,7 +128,7 @@ bool SharedWorkerProxy::matches(const String& name, PassRefPtr<SecurityOrigin> o
     return name == m_name;
 }
 
-void SharedWorkerProxy::postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task> task)
+void SharedWorkerProxy::postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task> task)
 {
     MutexLocker lock(m_workerDocumentsLock);
 
@@ -144,7 +144,7 @@ void SharedWorkerProxy::postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task
     document->postTask(task);
 }
 
-void SharedWorkerProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+void SharedWorkerProxy::postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
     if (isClosing())
         return;
@@ -221,9 +221,9 @@ void SharedWorkerProxy::close()
 
 class SharedWorkerConnectTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<SharedWorkerConnectTask> create(PassOwnPtr<MessagePortChannel> channel)
+    static PassOwnPtr<SharedWorkerConnectTask> create(PassOwnPtr<MessagePortChannel> channel)
     {
-        return adoptRef(new SharedWorkerConnectTask(channel));
+        return new SharedWorkerConnectTask(channel);
     }
 
 private:
@@ -248,7 +248,7 @@ private:
 };
 
 // Loads the script on behalf of a worker.
-class SharedWorkerScriptLoader : public RefCounted<SharedWorkerScriptLoader>, public ActiveDOMObject, private WorkerScriptLoaderClient {
+class SharedWorkerScriptLoader : public RefCounted<SharedWorkerScriptLoader>, private WorkerScriptLoaderClient {
 public:
     SharedWorkerScriptLoader(PassRefPtr<SharedWorker>, PassOwnPtr<MessagePortChannel>, PassRefPtr<SharedWorkerProxy>);
     void load(const KURL&);
@@ -264,8 +264,7 @@ private:
 };
 
 SharedWorkerScriptLoader::SharedWorkerScriptLoader(PassRefPtr<SharedWorker> worker, PassOwnPtr<MessagePortChannel> port, PassRefPtr<SharedWorkerProxy> proxy)
-    : ActiveDOMObject(worker->scriptExecutionContext(), this)
-    , m_worker(worker)
+    : m_worker(worker)
     , m_port(port)
     , m_proxy(proxy)
 {
@@ -274,25 +273,27 @@ SharedWorkerScriptLoader::SharedWorkerScriptLoader(PassRefPtr<SharedWorker> work
 void SharedWorkerScriptLoader::load(const KURL& url)
 {
     // Mark this object as active for the duration of the load.
-    ASSERT(!hasPendingActivity());
     m_scriptLoader = new WorkerScriptLoader();
-    m_scriptLoader->loadAsynchronously(scriptExecutionContext(), url, DenyCrossOriginRequests, this);
+    m_scriptLoader->loadAsynchronously(m_worker->scriptExecutionContext(), url, DenyCrossOriginRequests, this);
 
-    // Stay alive until the load finishes.
-    setPendingActivity(this);
+    // Stay alive (and keep the SharedWorker and JS wrapper alive) until the load finishes.
+    this->ref();
     m_worker->setPendingActivity(m_worker.get());
 }
 
 void SharedWorkerScriptLoader::notifyFinished()
 {
+    // FIXME: This method is not guaranteed to be invoked if we are loading from WorkerContext (see comment for WorkerScriptLoaderClient::notifyFinished()).
+    // We need to address this before supporting nested workers.
+
     // Hand off the just-loaded code to the repository to start up the worker thread.
     if (m_scriptLoader->failed())
         m_worker->dispatchEvent(Event::create(eventNames().errorEvent, false, true));
     else
-        DefaultSharedWorkerRepository::instance().workerScriptLoaded(*m_proxy, scriptExecutionContext()->userAgent(m_scriptLoader->url()), m_scriptLoader->script(), m_port.release());
+        DefaultSharedWorkerRepository::instance().workerScriptLoaded(*m_proxy, m_worker->scriptExecutionContext()->userAgent(m_scriptLoader->url()), m_scriptLoader->script(), m_port.release());
 
     m_worker->unsetPendingActivity(m_worker.get());
-    unsetPendingActivity(this); // This frees this object - must be the last action in this function.
+    this->deref(); // This frees this object - must be the last action in this function.
 }
 
 DefaultSharedWorkerRepository& DefaultSharedWorkerRepository::instance()
diff --git a/src/3rdparty/webkit/WebCore/workers/GenericWorkerTask.h b/src/3rdparty/webkit/WebCore/workers/GenericWorkerTask.h
index d6a99949b0..a9839c6f1a 100644
--- a/src/3rdparty/webkit/WebCore/workers/GenericWorkerTask.h
+++ b/src/3rdparty/webkit/WebCore/workers/GenericWorkerTask.h
@@ -51,10 +51,6 @@ namespace WebCore {
         typedef T* ParamType;
     };
 
-    template<typename T> struct GenericWorkerTaskTraits<std::auto_ptr<T> > {
-        typedef std::auto_ptr<T> ParamType;
-    };
-
     template<typename T> struct GenericWorkerTaskTraits<PassRefPtr<T> > {
         typedef PassRefPtr<T> ParamType;
     };
@@ -70,9 +66,9 @@ namespace WebCore {
         typedef GenericWorkerTask1<P1, MP1> GenericWorkerTask;
         typedef typename GenericWorkerTaskTraits<P1>::ParamType Param1;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1));
+            return new GenericWorkerTask(method, parameter1);
         }
 
     private:
@@ -100,9 +96,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P1>::ParamType Param1;
         typedef typename GenericWorkerTaskTraits<P2>::ParamType Param2;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2));
+            return new GenericWorkerTask(method, parameter1, parameter2);
         }
 
     private:
@@ -133,9 +129,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P2>::ParamType Param2;
         typedef typename GenericWorkerTaskTraits<P3>::ParamType Param3;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3);
         }
 
     private:
@@ -169,9 +165,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P3>::ParamType Param3;
         typedef typename GenericWorkerTaskTraits<P4>::ParamType Param4;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4);
         }
 
     private:
@@ -208,9 +204,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P4>::ParamType Param4;
         typedef typename GenericWorkerTaskTraits<P5>::ParamType Param5;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5);
         }
 
     private:
@@ -250,9 +246,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P5>::ParamType Param5;
         typedef typename GenericWorkerTaskTraits<P6>::ParamType Param6;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6);
         }
 
     private:
@@ -295,9 +291,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P6>::ParamType Param6;
         typedef typename GenericWorkerTaskTraits<P7>::ParamType Param7;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6, Param7 parameter7)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6, Param7 parameter7)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6, parameter7));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6, parameter7);
         }
 
     private:
@@ -343,9 +339,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P7>::ParamType Param7;
         typedef typename GenericWorkerTaskTraits<P8>::ParamType Param8;
         
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6, Param7 parameter7, Param8 parameter8)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6, Param7 parameter7, Param8 parameter8)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6, parameter7, parameter8));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6, parameter7, parameter8);
         }
         
     private:
@@ -380,7 +376,7 @@ namespace WebCore {
     };
 
     template<typename P1, typename MP1>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1),
         const P1& parameter1)
     {
@@ -390,7 +386,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2),
         const P1& parameter1, const P2& parameter2)
     {
@@ -400,7 +396,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2, MP3),
         const P1& parameter1, const P2& parameter2, const P3& parameter3)
     {
@@ -411,7 +407,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4),
         const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4)
     {
@@ -423,7 +419,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5),
         const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4, const P5& parameter5)
     {
@@ -436,7 +432,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5, typename P6, typename MP6>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5, MP6),
         const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4, const P5& parameter5, const P6& parameter6)
     {
@@ -449,7 +445,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5, typename P6, typename MP6, typename P7, typename MP7>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5, MP6, MP7),
         const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4, const P5& parameter5, const P6& parameter6, const P7& parameter7)
     {
@@ -464,7 +460,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5, typename P6, typename MP6, typename P7, typename MP7, typename P8, typename MP8>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
                                                                 void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5, MP6, MP7, MP8),
                                                                 const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4, const P5& parameter5, const P6& parameter6, const P7& parameter7, const P8& parameter8)
     {
diff --git a/src/3rdparty/webkit/WebCore/workers/SharedWorker.cpp b/src/3rdparty/webkit/WebCore/workers/SharedWorker.cpp
index 71fcc68449..cd856ff143 100644
--- a/src/3rdparty/webkit/WebCore/workers/SharedWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/SharedWorker.cpp
@@ -34,6 +34,7 @@
 
 #include "SharedWorker.h"
 
+#include "InspectorController.h"
 #include "KURL.h"
 #include "MessageChannel.h"
 #include "MessagePort.h"
@@ -53,6 +54,10 @@ SharedWorker::SharedWorker(const String& url, const String& name, ScriptExecutio
     if (ec)
         return;
     SharedWorkerRepository::connect(this, remotePort.release(), scriptUrl, name, ec);
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspector = scriptExecutionContext()->inspectorController())
+        inspector->didCreateWorker(asID(), scriptUrl.string(), true);
+#endif
 }
 
 SharedWorker::~SharedWorker()
diff --git a/src/3rdparty/webkit/WebCore/workers/SharedWorker.idl b/src/3rdparty/webkit/WebCore/workers/SharedWorker.idl
index 09475f7428..c04f7cf8c8 100644
--- a/src/3rdparty/webkit/WebCore/workers/SharedWorker.idl
+++ b/src/3rdparty/webkit/WebCore/workers/SharedWorker.idl
@@ -32,6 +32,7 @@ module threads {
 
     interface [
         Conditional=SHARED_WORKERS,
+        CustomConstructor,
         CustomMarkFunction,
         GenerateNativeConverter,
         GenerateToJS
diff --git a/src/3rdparty/webkit/WebCore/workers/SharedWorkerContext.idl b/src/3rdparty/webkit/WebCore/workers/SharedWorkerContext.idl
index a48e5bdd66..9d01f4f8cb 100644
--- a/src/3rdparty/webkit/WebCore/workers/SharedWorkerContext.idl
+++ b/src/3rdparty/webkit/WebCore/workers/SharedWorkerContext.idl
@@ -35,7 +35,8 @@ module threads {
         ExtendsDOMGlobalObject,
         IsWorkerContext,
         GenerateNativeConverter,
-        NoStaticTables
+        NoStaticTables,
+        OmitConstructor
     ] SharedWorkerContext : WorkerContext {
 
         readonly attribute DOMString name;
diff --git a/src/3rdparty/webkit/WebCore/workers/Worker.cpp b/src/3rdparty/webkit/WebCore/workers/Worker.cpp
index 864b7c6865..2d41c9b75d 100644
--- a/src/3rdparty/webkit/WebCore/workers/Worker.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/Worker.cpp
@@ -40,6 +40,7 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "InspectorController.h"
 #include "MessageEvent.h"
 #include "TextEncoding.h"
 #include "WorkerContextProxy.h"
@@ -60,6 +61,10 @@ Worker::Worker(const String& url, ScriptExecutionContext* context, ExceptionCode
     m_scriptLoader = new WorkerScriptLoader();
     m_scriptLoader->loadAsynchronously(scriptExecutionContext(), scriptURL, DenyCrossOriginRequests, this);
     setPendingActivity(this);  // The worker context does not exist while loading, so we must ensure that the worker object is not collected, as well as its event listeners.
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspector = scriptExecutionContext()->inspectorController())
+        inspector->didCreateWorker(asID(), scriptURL.string(), false);
+#endif
 }
 
 Worker::~Worker()
diff --git a/src/3rdparty/webkit/WebCore/workers/Worker.idl b/src/3rdparty/webkit/WebCore/workers/Worker.idl
index 0382739907..54d406d3ca 100644
--- a/src/3rdparty/webkit/WebCore/workers/Worker.idl
+++ b/src/3rdparty/webkit/WebCore/workers/Worker.idl
@@ -28,6 +28,7 @@ module threads {
 
     interface [
         Conditional=WORKERS,
+        CustomConstructor,
         GenerateNativeConverter,
         GenerateToJS
     ] Worker : AbstractWorker {
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerContext.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerContext.cpp
index 9a88309f2a..7b4f293468 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerContext.cpp
@@ -32,6 +32,7 @@
 #include "WorkerContext.h"
 
 #include "ActiveDOMObject.h"
+#include "Database.h"
 #include "DOMTimer.h"
 #include "DOMWindow.h"
 #include "Event.h"
@@ -162,7 +163,7 @@ void WorkerContext::scriptImported(unsigned long, const String&)
     notImplemented();
 }
 
-void WorkerContext::postTask(PassRefPtr<Task> task)
+void WorkerContext::postTask(PassOwnPtr<Task> task)
 {
     thread()->runLoop().postTask(task);
 }
@@ -254,6 +255,27 @@ NotificationCenter* WorkerContext::webkitNotifications() const
 }
 #endif
 
+#if ENABLE(DATABASE)
+PassRefPtr<Database> WorkerContext::openDatabase(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode& ec)
+{
+    if (!securityOrigin()->canAccessDatabase()) {
+        ec = SECURITY_ERR;
+        return 0;
+    }
+
+    ASSERT(Database::isAvailable());
+    if (!Database::isAvailable())
+        return 0;
+
+    return Database::openDatabase(this, name, version, displayName, estimatedSize, creationCallback, ec);
+}
+#endif
+
+bool WorkerContext::isContextThread() const
+{
+    return currentThread() == thread()->threadID();
+}
+
 EventTargetData* WorkerContext::eventTargetData()
 {
     return &m_eventTargetData;
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerContext.h b/src/3rdparty/webkit/WebCore/workers/WorkerContext.h
index 9725cf7955..fb4a26dcaa 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerContext.h
@@ -30,11 +30,14 @@
 #if ENABLE(WORKERS)
 
 #include "AtomicStringHash.h"
+#include "Database.h"
+#include "DatabaseCallback.h"
 #include "EventListener.h"
 #include "EventNames.h"
 #include "EventTarget.h"
 #include "ScriptExecutionContext.h"
 #include "WorkerScriptController.h"
+#include <wtf/Assertions.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -42,6 +45,7 @@
 
 namespace WebCore {
 
+    class Database;
     class NotificationCenter;
     class ScheduledAction;
     class WorkerLocation;
@@ -65,16 +69,16 @@ namespace WebCore {
         virtual String userAgent(const KURL&) const;
 
         WorkerScriptController* script() { return m_script.get(); }
-        void clearScript() { return m_script.clear(); }
+        void clearScript() { m_script.clear(); }
 
-        WorkerThread* thread() { return m_thread; }
+        WorkerThread* thread() const { return m_thread; }
 
         bool hasPendingActivity() const;
 
         virtual void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
         virtual void scriptImported(unsigned long identifier, const String& sourceString);
 
-        virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
+        virtual void postTask(PassOwnPtr<Task>); // Executes the task on context's thread asynchronously.
 
         // WorkerGlobalScope
         WorkerContext* self() { return this; }
@@ -101,6 +105,17 @@ namespace WebCore {
         NotificationCenter* webkitNotifications() const;
 #endif
 
+#if ENABLE(DATABASE)
+        // HTML 5 client-side database
+        PassRefPtr<Database> openDatabase(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode&);
+        // Not implemented yet.
+        virtual bool isDatabaseReadOnly() const { return false; }
+        // Not implemented yet.
+        virtual void databaseExceededQuota(const String&) { }
+#endif
+        virtual bool isContextThread() const;
+
+
         // These methods are used for GC marking. See JSWorkerContext::markChildren(MarkStack&) in
         // JSWorkerContextCustom.cpp.
         WorkerNavigator* optionalNavigator() const { return m_navigator.get(); }
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerContext.idl b/src/3rdparty/webkit/WebCore/workers/WorkerContext.idl
index 0a5817cee6..abb8ea835c 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerContext.idl
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerContext.idl
@@ -34,7 +34,8 @@ module threads {
         ExtendsDOMGlobalObject,
         IsWorkerContext,
         LegacyParent=JSWorkerContextBase,
-        NoStaticTables
+        NoStaticTables,
+        OmitConstructor
     ] WorkerContext {
 
         // WorkerGlobalScope
@@ -61,12 +62,12 @@ module threads {
 
 
         // EventTarget interface
-        [Custom] void addEventListener(in DOMString type, 
-                                       in EventListener listener, 
-                                       in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type, 
+        [JSCCustom] void addEventListener(in DOMString type, 
                                           in EventListener listener, 
                                           in boolean useCapture);
+        [JSCCustom] void removeEventListener(in DOMString type, 
+                                             in EventListener listener, 
+                                             in boolean useCapture);
         boolean dispatchEvent(in Event evt)
             raises(EventException);
 
@@ -86,6 +87,9 @@ module threads {
         attribute [JSCCustomGetter] EventSourceConstructor EventSource;
 #endif
         attribute [JSCCustomGetter] XMLHttpRequestConstructor XMLHttpRequest;
+#if defined(ENABLE_WEB_SOCKETS) && ENABLE_WEB_SOCKETS
+        attribute [JSCCustomGetter,EnabledAtRuntime] WebSocketConstructor WebSocket; // Usable with the new operator
+#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerLoaderProxy.h b/src/3rdparty/webkit/WebCore/workers/WorkerLoaderProxy.h
index ac7cda160b..fe1bf51430 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerLoaderProxy.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerLoaderProxy.h
@@ -34,7 +34,7 @@
 #if ENABLE(WORKERS)
 
 #include "ScriptExecutionContext.h"
-#include <wtf/PassRefPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -50,11 +50,11 @@ namespace WebCore {
         virtual ~WorkerLoaderProxy() { }
 
         // Posts a task to the thread which runs the loading code (normally, the main thread).
-        virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>) = 0;
+        virtual void postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task>) = 0;
 
         // Posts callbacks from loading code to the WorkerContext. The 'mode' is used to differentiate
         // specific synchronous loading requests so they can be 'nested', per spec.
-        virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String& mode) = 0;
+        virtual void postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutionContext::Task>, const String& mode) = 0;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerLocation.idl b/src/3rdparty/webkit/WebCore/workers/WorkerLocation.idl
index 5551f18abc..429d522171 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerLocation.idl
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerLocation.idl
@@ -30,7 +30,6 @@ module threads {
 
     interface [
         Conditional=WORKERS,
-        GenerateConstructor,
         NoStaticTables
     ] WorkerLocation {
         readonly attribute DOMString href;
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp
index 0b666945b2..2e1dfe0c25 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp
@@ -46,9 +46,9 @@ namespace WebCore {
 
 class MessageWorkerContextTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerContextTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
+    static PassOwnPtr<MessageWorkerContextTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
     {
-        return adoptRef(new MessageWorkerContextTask(message, channels));
+        return new MessageWorkerContextTask(message, channels);
     }
 
 private:
@@ -74,9 +74,9 @@ private:
 
 class MessageWorkerTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
+    static PassOwnPtr<MessageWorkerTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
     {
-        return adoptRef(new MessageWorkerTask(message, channels, messagingProxy));
+        return new MessageWorkerTask(message, channels, messagingProxy);
     }
 
 private:
@@ -105,9 +105,9 @@ private:
 
 class WorkerExceptionTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<WorkerExceptionTask> create(const String& errorMessage, int lineNumber, const String& sourceURL, WorkerMessagingProxy* messagingProxy)
+    static PassOwnPtr<WorkerExceptionTask> create(const String& errorMessage, int lineNumber, const String& sourceURL, WorkerMessagingProxy* messagingProxy)
     {
-        return adoptRef(new WorkerExceptionTask(errorMessage, lineNumber, sourceURL, messagingProxy));
+        return new WorkerExceptionTask(errorMessage, lineNumber, sourceURL, messagingProxy);
     }
 
 private:
@@ -141,9 +141,9 @@ private:
 
 class WorkerContextDestroyedTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<WorkerContextDestroyedTask> create(WorkerMessagingProxy* messagingProxy)
+    static PassOwnPtr<WorkerContextDestroyedTask> create(WorkerMessagingProxy* messagingProxy)
     {
-        return adoptRef(new WorkerContextDestroyedTask(messagingProxy));
+        return new WorkerContextDestroyedTask(messagingProxy);
     }
 
 private:
@@ -162,9 +162,9 @@ private:
 
 class WorkerTerminateTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<WorkerTerminateTask> create(WorkerMessagingProxy* messagingProxy)
+    static PassOwnPtr<WorkerTerminateTask> create(WorkerMessagingProxy* messagingProxy)
     {
-        return adoptRef(new WorkerTerminateTask(messagingProxy));
+        return new WorkerTerminateTask(messagingProxy);
     }
 
 private:
@@ -183,9 +183,9 @@ private:
 
 class WorkerThreadActivityReportTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<WorkerThreadActivityReportTask> create(WorkerMessagingProxy* messagingProxy, bool confirmingMessage, bool hasPendingActivity)
+    static PassOwnPtr<WorkerThreadActivityReportTask> create(WorkerMessagingProxy* messagingProxy, bool confirmingMessage, bool hasPendingActivity)
     {
-        return adoptRef(new WorkerThreadActivityReportTask(messagingProxy, confirmingMessage, hasPendingActivity));
+        return new WorkerThreadActivityReportTask(messagingProxy, confirmingMessage, hasPendingActivity);
     }
 
 private:
@@ -257,7 +257,7 @@ void WorkerMessagingProxy::postMessageToWorkerContext(PassRefPtr<SerializedScrip
         m_queuedEarlyTasks.append(MessageWorkerContextTask::create(message, channels.release()));
 }
 
-void WorkerMessagingProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+void WorkerMessagingProxy::postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
     if (m_askedToTerminate)
         return;
@@ -266,7 +266,7 @@ void WorkerMessagingProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecu
     m_workerThread->runLoop().postTaskForMode(task, mode);
 }
 
-void WorkerMessagingProxy::postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task> task)
+void WorkerMessagingProxy::postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task> task)
 {
     // FIXME: In case of nested workers, this should go directly to the root Document context.
     ASSERT(m_scriptExecutionContext->isDocument());
@@ -304,7 +304,7 @@ void WorkerMessagingProxy::workerThreadCreated(PassRefPtr<DedicatedWorkerThread>
         m_workerThreadHadPendingActivity = true; // Worker initialization means a pending activity.
 
         for (unsigned i = 0; i < taskCount; ++i)
-            m_workerThread->runLoop().postTask(m_queuedEarlyTasks[i]);
+            m_workerThread->runLoop().postTask(m_queuedEarlyTasks[i].release());
         m_queuedEarlyTasks.clear();
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h
index 754102acf5..90b87f492f 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h
@@ -71,8 +71,8 @@ namespace WebCore {
         // Implementation of WorkerLoaderProxy.
         // These methods are called on different threads to schedule loading
         // requests and to send callbacks back to WorkerContext.
-        virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>);
-        virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String& mode);
+        virtual void postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task>);
+        virtual void postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutionContext::Task>, const String& mode);
 
         void workerThreadCreated(PassRefPtr<DedicatedWorkerThread>);
 
@@ -100,7 +100,7 @@ namespace WebCore {
 
         bool m_askedToTerminate;
 
-        Vector<RefPtr<ScriptExecutionContext::Task> > m_queuedEarlyTasks; // Tasks are queued here until there's a thread object created.
+        Vector<OwnPtr<ScriptExecutionContext::Task> > m_queuedEarlyTasks; // Tasks are queued here until there's a thread object created.
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp
index 6a58d526cd..83f243f804 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp
@@ -64,27 +64,6 @@ private:
     double m_nextFireTime;
 };
 
-class WorkerRunLoop::Task : public RefCounted<WorkerRunLoop::Task> {
-public:
-    static PassRefPtr<Task> create(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
-    {
-        return adoptRef(new Task(task, mode));
-    }
-
-    const String& mode() const { return m_mode; }
-    void performTask(ScriptExecutionContext* context) { m_task->performTask(context); }
-
-private:
-    Task(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
-        : m_task(task)
-        , m_mode(mode.crossThreadString())
-    {
-    }
-
-    RefPtr<ScriptExecutionContext::Task> m_task;
-    String m_mode;
-};
-
 class ModePredicate {
 public:
     ModePredicate(const String& mode)
@@ -98,7 +77,7 @@ public:
         return m_defaultMode;
     }
 
-    bool operator()(PassRefPtr<WorkerRunLoop::Task> task) const
+    bool operator()(WorkerRunLoop::Task* task) const
     {
         return m_defaultMode || m_mode == task->mode();
     }
@@ -169,13 +148,11 @@ MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const Mo
     ASSERT(context->thread());
     ASSERT(context->thread()->threadID() == currentThread());
 
-    double absoluteTime = (predicate.isDefaultMode() && m_sharedTimer->isActive()) ? m_sharedTimer->fireTime() : MessageQueue<RefPtr<Task> >::infiniteTime();
-    RefPtr<Task> task;
-    MessageQueueWaitResult result = m_messageQueue.waitForMessageFilteredWithTimeout(task, predicate, absoluteTime);
+    double absoluteTime = (predicate.isDefaultMode() && m_sharedTimer->isActive()) ? m_sharedTimer->fireTime() : MessageQueue<Task>::infiniteTime();
+    MessageQueueWaitResult result;
+    OwnPtr<WorkerRunLoop::Task> task = m_messageQueue.waitForMessageFilteredWithTimeout(result, predicate, absoluteTime);
 
-    // If the context is closing, don't dispatch any further tasks (per section 4.1.1 of the Web Workers spec).
-    if (context->isClosing())
-        return result;
+    // If the context is closing, don't execute any further JavaScript tasks (per section 4.1.1 of the Web Workers spec).  However, there may be implementation cleanup tasks in the queue, so keep running through it.
 
     switch (result) {
     case MessageQueueTerminated:
@@ -186,7 +163,8 @@ MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const Mo
         break;
 
     case MessageQueueTimeout:
-        m_sharedTimer->fire();
+        if (!context->isClosing())
+            m_sharedTimer->fire();
         break;
     }
 
@@ -198,16 +176,35 @@ void WorkerRunLoop::terminate()
     m_messageQueue.kill();
 }
 
-void WorkerRunLoop::postTask(PassRefPtr<ScriptExecutionContext::Task> task)
+void WorkerRunLoop::postTask(PassOwnPtr<ScriptExecutionContext::Task> task)
 {
     postTaskForMode(task, defaultMode());
 }
 
-void WorkerRunLoop::postTaskForMode(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+void WorkerRunLoop::postTaskForMode(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
     m_messageQueue.append(Task::create(task, mode.crossThreadString()));
 }
 
+PassOwnPtr<WorkerRunLoop::Task> WorkerRunLoop::Task::create(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
+{
+    return new Task(task, mode);
+}
+
+void WorkerRunLoop::Task::performTask(ScriptExecutionContext* context)
+{
+    WorkerContext* workerContext = static_cast<WorkerContext *>(context);
+    if (!workerContext->isClosing() || m_task->isCleanupTask())
+        m_task->performTask(context);
+}
+
+WorkerRunLoop::Task::Task(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
+    : m_task(task)
+    , m_mode(mode.crossThreadString())
+{
+}
+
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.h b/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.h
index 5f74f01aa7..9d4edfdfb8 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.h
@@ -36,7 +36,7 @@
 #include "ScriptExecutionContext.h"
 #include <wtf/MessageQueue.h>
 #include <wtf/OwnPtr.h>
-#include <wtf/PassRefPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -58,18 +58,32 @@ namespace WebCore {
         void terminate();
         bool terminated() { return m_messageQueue.killed(); }
 
-        void postTask(PassRefPtr<ScriptExecutionContext::Task>);
-        void postTaskForMode(PassRefPtr<ScriptExecutionContext::Task>, const String& mode);
+        void postTask(PassOwnPtr<ScriptExecutionContext::Task>);
+        void postTaskForMode(PassOwnPtr<ScriptExecutionContext::Task>, const String& mode);
 
         unsigned long createUniqueId() { return ++m_uniqueId; }
 
         static String defaultMode();
-        class Task;
+
+        class Task : public Noncopyable {
+        public:
+            static PassOwnPtr<Task> create(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode);
+            ~Task() { }
+            const String& mode() const { return m_mode; }
+            void performTask(ScriptExecutionContext* context);
+
+        private:
+            Task(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode);
+        
+            OwnPtr<ScriptExecutionContext::Task> m_task;
+            String m_mode;
+        };
+
     private:
         friend class RunLoopSetup;
         MessageQueueWaitResult runInMode(WorkerContext*, const ModePredicate&);
 
-        MessageQueue<RefPtr<Task> > m_messageQueue;
+        MessageQueue<Task> m_messageQueue;
         OwnPtr<WorkerSharedTimer> m_sharedTimer;
         int m_nestedCount;
         unsigned long m_uniqueId;
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoader.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoader.cpp
index 52baf2d380..fa7d3c4b5c 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoader.cpp
@@ -63,6 +63,7 @@ void WorkerScriptLoader::loadSynchronously(ScriptExecutionContext* scriptExecuti
     ThreadableLoaderOptions options;
     options.allowCredentials = true;
     options.crossOriginRequestPolicy = crossOriginRequestPolicy;
+    options.sendLoadCallbacks = true;
 
     WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(scriptExecutionContext), *request, *this, options);
 }
@@ -80,6 +81,7 @@ void WorkerScriptLoader::loadAsynchronously(ScriptExecutionContext* scriptExecut
     ThreadableLoaderOptions options;
     options.allowCredentials = true;
     options.crossOriginRequestPolicy = crossOriginRequestPolicy;
+    options.sendLoadCallbacks = true;
 
     m_threadableLoader = ThreadableLoader::create(scriptExecutionContext, this, *request, options);
 }
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoaderClient.h b/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoaderClient.h
index e3903c00b8..7dc3a1e94b 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoaderClient.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoaderClient.h
@@ -34,8 +34,10 @@ namespace WebCore {
 
     class WorkerScriptLoaderClient {
     public:
+        // FIXME: notifyFinished() is not currently guaranteed to be invoked if used from worker context and the worker shuts down in the middle of an operation.
+        // This will cause leaks when we support nested workers.
         virtual void notifyFinished() { }
-        
+
     protected:
         virtual ~WorkerScriptLoaderClient() { }
     };
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp
index 467157b592..3823ad4bfa 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp
@@ -30,6 +30,7 @@
 
 #include "WorkerThread.h"
 
+#include "DatabaseTask.h"
 #include "DedicatedWorkerContext.h"
 #include "KURL.h"
 #include "PlatformString.h"
@@ -57,9 +58,9 @@ unsigned WorkerThread::workerThreadCount()
 
 struct WorkerThreadStartupData : Noncopyable {
 public:
-    static std::auto_ptr<WorkerThreadStartupData> create(const KURL& scriptURL, const String& userAgent, const String& sourceCode)
+    static PassOwnPtr<WorkerThreadStartupData> create(const KURL& scriptURL, const String& userAgent, const String& sourceCode)
     {
-        return std::auto_ptr<WorkerThreadStartupData>(new WorkerThreadStartupData(scriptURL, userAgent, sourceCode));
+        return new WorkerThreadStartupData(scriptURL, userAgent, sourceCode);
     }
 
     KURL m_scriptURL;
@@ -135,9 +136,8 @@ void* WorkerThread::workerThread()
 
     ThreadIdentifier threadID = m_threadID;
 
-    m_workerContext->stopActiveDOMObjects();
-    m_workerContext->clearScript();
     ASSERT(m_workerContext->hasOneRef());
+
     // The below assignment will destroy the context, which will in turn notify messaging proxy.
     // We cannot let any objects survive past thread exit, because no other thread will run GC or otherwise destroy them.
     m_workerContext = 0;
@@ -154,17 +154,78 @@ void WorkerThread::runEventLoop()
     m_runLoop.run(m_workerContext.get());
 }
 
+class WorkerThreadShutdownFinishTask : public ScriptExecutionContext::Task {
+public:
+    static PassOwnPtr<WorkerThreadShutdownFinishTask> create()
+    {
+        return new WorkerThreadShutdownFinishTask();
+    }
+
+    virtual void performTask(ScriptExecutionContext *context)
+    {
+        ASSERT(context->isWorkerContext());
+        WorkerContext* workerContext = static_cast<WorkerContext*>(context);
+        workerContext->thread()->runLoop().terminate();
+    }
+
+    virtual bool isCleanupTask() const { return true; }
+};
+
+class WorkerThreadShutdownStartTask : public ScriptExecutionContext::Task {
+public:
+    static PassOwnPtr<WorkerThreadShutdownStartTask> create()
+    {
+        return new WorkerThreadShutdownStartTask();
+    }
+
+    virtual void performTask(ScriptExecutionContext *context)
+    {
+        ASSERT(context->isWorkerContext());
+        WorkerContext* workerContext = static_cast<WorkerContext*>(context);
+
+#if ENABLE(DATABASE)
+        // We currently ignore any DatabasePolicy used for the document's
+        // databases; if it's actually used anywhere, this should be revisited.
+        DatabaseTaskSynchronizer cleanupSync;
+        workerContext->stopDatabases(&cleanupSync);
+#endif
+
+        workerContext->stopActiveDOMObjects();
+
+        // Event listeners would keep DOMWrapperWorld objects alive for too long. Also, they have references to JS objects,
+        // which become dangling once Heap is destroyed.
+        workerContext->removeAllEventListeners();
+        workerContext->clearScript();
+
+#if ENABLE(DATABASE)
+        // We wait for the database thread to clean up all its stuff so that we
+        // can do more stringent leak checks as we exit.
+        cleanupSync.waitForTaskCompletion();
+#endif
+
+        // Stick a shutdown command at the end of the queue, so that we deal
+        // with all the cleanup tasks the databases post first.
+        workerContext->postTask(WorkerThreadShutdownFinishTask::create());
+    }
+
+    virtual bool isCleanupTask() const { return true; }
+};
+
 void WorkerThread::stop()
 {
     // Mutex protection is necessary because stop() can be called before the context is fully created.
     MutexLocker lock(m_threadCreationMutex);
 
     // Ensure that tasks are being handled by thread event loop. If script execution weren't forbidden, a while(1) loop in JS could keep the thread alive forever.
-    if (m_workerContext)
+    if (m_workerContext) {
         m_workerContext->script()->forbidExecution();
 
     // FIXME: Rudely killing the thread won't work when we allow nested workers, because they will try to post notifications of their destruction.
-    m_runLoop.terminate();
+    // This can likely use the same mechanism as used for databases above.
+
+        m_runLoop.postTask(WorkerThreadShutdownStartTask::create());
+    } else
+        m_runLoop.terminate();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/xml/DOMParser.idl b/src/3rdparty/webkit/WebCore/xml/DOMParser.idl
index 9caaa21d9a..90a8b5272f 100644
--- a/src/3rdparty/webkit/WebCore/xml/DOMParser.idl
+++ b/src/3rdparty/webkit/WebCore/xml/DOMParser.idl
@@ -18,7 +18,7 @@
  */
 
 module xpath {
-    interface [GenerateConstructor, CanBeConstructed] DOMParser {
+    interface [CanBeConstructed] DOMParser {
         Document parseFromString(in DOMString str, in DOMString contentType);
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp
index 87a65401e7..f10b589c8b 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp
@@ -22,16 +22,17 @@
 #include "config.h"
 #include "XMLHttpRequest.h"
 
+#include "Blob.h"
 #include "Cache.h"
 #include "CString.h"
 #include "CrossOriginAccessControl.h"
+#include "DOMFormData.h"
 #include "DOMImplementation.h"
 #include "Document.h"
 #include "Event.h"
 #include "EventException.h"
 #include "EventListener.h"
 #include "EventNames.h"
-#include "File.h"
 #include "HTTPParsers.h"
 #include "InspectorTimelineAgent.h"
 #include "ResourceError.h"
@@ -59,7 +60,7 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter xmlHttpRequestCounter("XMLHttpRequest");
 #endif
 
-struct XMLHttpRequestStaticData {
+struct XMLHttpRequestStaticData : Noncopyable {
     XMLHttpRequestStaticData();
     String m_proxyHeaderPrefix;
     String m_secHeaderPrefix;
@@ -157,6 +158,7 @@ XMLHttpRequest::XMLHttpRequest(ScriptExecutionContext* context)
     , m_receivedLength(0)
     , m_lastSendLineNumber(0)
     , m_exceptionCode(0)
+    , m_progressEventThrottle(this)
 {
     initializeXMLHttpRequestStaticData();
 #ifndef NDEBUG
@@ -214,7 +216,7 @@ Document* XMLHttpRequest::responseXML() const
             // The W3C spec requires this.
             m_responseXML = 0;
         } else {
-            m_responseXML = document()->implementation()->createDocument(0);
+            m_responseXML = Document::create(0);
             m_responseXML->open();
             m_responseXML->setURL(m_url);
             // FIXME: Set Last-Modified.
@@ -253,27 +255,30 @@ void XMLHttpRequest::callReadyStateChangeListener()
 
 #if ENABLE(INSPECTOR)
     InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext());
-    if (timelineAgent)
+    bool callTimelineAgentOnReadyStateChange = timelineAgent && hasEventListeners(eventNames().readystatechangeEvent);
+    if (callTimelineAgentOnReadyStateChange)
         timelineAgent->willChangeXHRReadyState(m_url.string(), m_state);
 #endif
 
-    dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().readystatechangeEvent));
+    m_progressEventThrottle.dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().readystatechangeEvent), m_state == DONE ? FlushProgressEvent : DoNotFlushProgressEvent);
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (callTimelineAgentOnReadyStateChange && (timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext())))
         timelineAgent->didChangeXHRReadyState();
 #endif
 
     if (m_state == DONE && !m_error) {
 #if ENABLE(INSPECTOR)
-        if (timelineAgent)
+        timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext());
+        bool callTimelineAgentOnLoad = timelineAgent && hasEventListeners(eventNames().loadEvent);
+        if (callTimelineAgentOnLoad)
             timelineAgent->willLoadXHR(m_url.string());
 #endif
 
-        dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadEvent));
+        m_progressEventThrottle.dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadEvent));
 
 #if ENABLE(INSPECTOR)
-        if (timelineAgent)
+        if (callTimelineAgentOnLoad && (timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext())))
             timelineAgent->didLoadXHR();
 #endif
     }
@@ -289,6 +294,11 @@ void XMLHttpRequest::setWithCredentials(bool value, ExceptionCode& ec)
     m_includeCredentials = value;
 }
 
+void XMLHttpRequest::open(const String& method, const KURL& url, ExceptionCode& ec)
+{
+    open(method, url, true, ec);
+}
+
 void XMLHttpRequest::open(const String& method, const KURL& url, bool async, ExceptionCode& ec)
 {
     internalAbort();
@@ -432,7 +442,7 @@ void XMLHttpRequest::send(const String& body, ExceptionCode& ec)
     createRequest(ec);
 }
 
-void XMLHttpRequest::send(File* body, ExceptionCode& ec)
+void XMLHttpRequest::send(Blob* body, ExceptionCode& ec)
 {
     if (!initSend(ec))
         return;
@@ -441,7 +451,30 @@ void XMLHttpRequest::send(File* body, ExceptionCode& ec)
         // FIXME: Should we set a Content-Type if one is not set.
         // FIXME: add support for uploading bundles.
         m_requestEntityBody = FormData::create();
+#if ENABLE(BLOB_SLICE)
+        m_requestEntityBody->appendFileRange(body->path(), body->start(), body->length(), body->modificationTime());
+#else
         m_requestEntityBody->appendFile(body->path(), false);
+#endif
+    }
+
+    createRequest(ec);
+}
+
+void XMLHttpRequest::send(DOMFormData* body, ExceptionCode& ec)
+{
+    if (!initSend(ec))
+        return;
+
+    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
+        m_requestEntityBody = FormData::createMultiPart(*body, document());
+
+        String contentType = getRequestHeader("Content-Type");
+        if (contentType.isEmpty()) {
+            contentType = "multipart/form-data; boundary=";
+            contentType += m_requestEntityBody->boundary().data();
+            setRequestHeaderInternal("Content-Type", contentType);
+        }
     }
 
     createRequest(ec);
@@ -454,7 +487,7 @@ void XMLHttpRequest::createRequest(ExceptionCode& ec)
     // Also, only async requests support upload progress events.
     bool forcePreflight = false;
     if (m_async) {
-        dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadstartEvent));
+        m_progressEventThrottle.dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadstartEvent));
         if (m_requestEntityBody && m_upload) {
             forcePreflight = m_upload->hasEventListeners();
             m_upload->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadstartEvent));
@@ -546,7 +579,7 @@ void XMLHttpRequest::abort()
         m_state = UNSENT;
     }
 
-    dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
+    m_progressEventThrottle.dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     if (!m_uploadComplete) {
         m_uploadComplete = true;
         if (m_upload && m_uploadEventsAllowed)
@@ -600,7 +633,7 @@ void XMLHttpRequest::genericError()
 void XMLHttpRequest::networkError()
 {
     genericError();
-    dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().errorEvent));
+    m_progressEventThrottle.dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().errorEvent));
     if (!m_uploadComplete) {
         m_uploadComplete = true;
         if (m_upload && m_uploadEventsAllowed)
@@ -612,7 +645,7 @@ void XMLHttpRequest::networkError()
 void XMLHttpRequest::abortError()
 {
     genericError();
-    dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
+    m_progressEventThrottle.dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     if (!m_uploadComplete) {
         m_uploadComplete = true;
         if (m_upload && m_uploadEventsAllowed)
@@ -629,8 +662,9 @@ void XMLHttpRequest::dropProtection()
     // out. But it is protected from GC while loading, so this
     // can't be recouped until the load is done, so only
     // report the extra cost at that point.
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*scriptExecutionContext()->globalData(), this))
-        JSC::Heap::heap(wrapper)->reportExtraMemoryCost(m_responseText.size() * 2);
+    JSC::JSGlobalData* globalData = scriptExecutionContext()->globalData();
+    if (hasCachedDOMObjectWrapper(globalData, this))
+        globalData->heap.reportExtraMemoryCost(m_responseText.size() * 2);
 #endif
 
     unsetPendingActivity(this);
@@ -914,9 +948,8 @@ void XMLHttpRequest::didReceiveData(const char* data, int len)
         long long expectedLength = m_response.expectedContentLength();
         m_receivedLength += len;
 
-        // FIXME: the spec requires that we dispatch the event according to the least
-        // frequent method between every 350ms (+/-200ms) and for every byte received.
-        dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().progressEvent, expectedLength && m_receivedLength <= expectedLength, static_cast<unsigned>(m_receivedLength), static_cast<unsigned>(expectedLength)));
+        bool lengthComputable = expectedLength && m_receivedLength <= expectedLength;
+        m_progressEventThrottle.dispatchProgressEvent(lengthComputable, static_cast<unsigned>(m_receivedLength), static_cast<unsigned>(expectedLength));
 
         if (m_state != LOADING)
             changeState(LOADING);
@@ -931,6 +964,16 @@ bool XMLHttpRequest::canSuspend() const
     return !m_loader;
 }
 
+void XMLHttpRequest::suspend()
+{
+    m_progressEventThrottle.suspend();
+}
+
+void XMLHttpRequest::resume()
+{
+    m_progressEventThrottle.resume();
+}
+
 void XMLHttpRequest::stop()
 {
     internalAbort();
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h
index c7e019254e..ca308cc456 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h
@@ -29,13 +29,15 @@
 #include "ResourceResponse.h"
 #include "ScriptString.h"
 #include "ThreadableLoaderClient.h"
+#include "XMLHttpRequestProgressEventThrottle.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
+class Blob;
 class Document;
-class File;
-struct ResourceRequest;
+class DOMFormData;
+class ResourceRequest;
 class TextResourceDecoder;
 class ThreadableLoader;
 
@@ -57,6 +59,8 @@ public:
 
     virtual void contextDestroyed();
     virtual bool canSuspend() const;
+    virtual void suspend();
+    virtual void resume();
     virtual void stop();
 
     virtual ScriptExecutionContext* scriptExecutionContext() const;
@@ -66,13 +70,15 @@ public:
     State readyState() const;
     bool withCredentials() const { return m_includeCredentials; }
     void setWithCredentials(bool, ExceptionCode&);
+    void open(const String& method, const KURL&, ExceptionCode&);
     void open(const String& method, const KURL&, bool async, ExceptionCode&);
     void open(const String& method, const KURL&, bool async, const String& user, ExceptionCode&);
     void open(const String& method, const KURL&, bool async, const String& user, const String& password, ExceptionCode&);
     void send(ExceptionCode&);
     void send(Document*, ExceptionCode&);
     void send(const String&, ExceptionCode&);
-    void send(File*, ExceptionCode&);
+    void send(Blob*, ExceptionCode&);
+    void send(DOMFormData*, ExceptionCode&);
     void abort();
     void setRequestHeader(const AtomicString& name, const String& value, ExceptionCode&);
     void overrideMimeType(const String& override);
@@ -184,6 +190,8 @@ private:
     ExceptionCode m_exceptionCode;
 
     EventTargetData m_eventTargetData;
+
+    XMLHttpRequestProgressEventThrottle m_progressEventThrottle;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.idl b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.idl
index 89d9c7f4ad..5a86fe50e1 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.idl
@@ -29,6 +29,7 @@
 module xml {
 
     interface [
+        CustomConstructor,
         CustomMarkFunction,
         EventTarget,
         NoStaticTables
@@ -90,12 +91,12 @@ module xml {
         [Custom] void overrideMimeType(in DOMString override);
 
         // EventTarget interface
-        [Custom] void addEventListener(in DOMString type, 
-                                      in EventListener listener, 
-                                      in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type, 
+        [JSCCustom] void addEventListener(in DOMString type, 
                                           in EventListener listener, 
                                           in boolean useCapture);
+        [JSCCustom] void removeEventListener(in DOMString type, 
+                                             in EventListener listener, 
+                                             in boolean useCapture);
         boolean dispatchEvent(in Event evt)
             raises(EventException);
     };
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestException.idl b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestException.idl
index 380e426c75..7121468eda 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestException.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestException.idl
@@ -29,7 +29,6 @@
 module xml {
 
     interface [
-        GenerateConstructor,
         NoStaticTables
     ] XMLHttpRequestException {
 
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestProgressEvent.idl b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestProgressEvent.idl
index 549308babf..bc5055af7b 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestProgressEvent.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestProgressEvent.idl
@@ -26,7 +26,6 @@
 module events {
 
     interface [
-        GenerateConstructor,
         NoStaticTables
     // We should also inherit from LSProgressEvent when the idl is added.
     ] XMLHttpRequestProgressEvent : ProgressEvent {
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestProgressEventThrottle.cpp b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestProgressEventThrottle.cpp
new file mode 100644
index 0000000000..0eb6398b5e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestProgressEventThrottle.cpp
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2010 Julien Chaffraix <jchaffraix@webkit.org>
+ * All right reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "XMLHttpRequestProgressEventThrottle.h"
+
+#include "EventTarget.h"
+#include "XMLHttpRequestProgressEvent.h"
+
+namespace WebCore {
+
+const double XMLHttpRequestProgressEventThrottle::minimumProgressEventDispatchingIntervalInSeconds = .05; // 50 ms per specification.
+
+XMLHttpRequestProgressEventThrottle::XMLHttpRequestProgressEventThrottle(EventTarget* target)
+    : m_target(target)
+    , m_loaded(0)
+    , m_total(0)
+    , m_suspended(false)
+{
+    ASSERT(target);
+}
+
+XMLHttpRequestProgressEventThrottle::~XMLHttpRequestProgressEventThrottle()
+{
+}
+
+void XMLHttpRequestProgressEventThrottle::dispatchProgressEvent(bool lengthComputable, unsigned loaded, unsigned total)
+{
+    ASSERT(!suspended());
+    if (!isActive()) {
+        // The timer is not active so the least frequent event for now is every byte.
+        // Just go ahead and dispatch the event.
+
+        // We should not have any pending loaded & total information from a previous run.
+        ASSERT(!m_loaded);
+        ASSERT(!m_total);
+
+        dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().progressEvent, lengthComputable, loaded, total));
+        startRepeating(minimumProgressEventDispatchingIntervalInSeconds);
+        return;
+    }
+
+    // The timer is already active so minimumProgressEventDispatchingIntervalInSeconds is the least frequent event.
+    m_lengthComputable = lengthComputable;
+    m_loaded = loaded;
+    m_total = total;
+}
+
+void XMLHttpRequestProgressEventThrottle::dispatchEvent(PassRefPtr<Event> event, ProgressEventAction progressEventAction)
+{
+    ASSERT(!suspended());
+    // We should not have any pending events from a previous resume.
+    ASSERT(!m_pausedEvent);
+
+    if (progressEventAction == FlushProgressEvent)
+        flushProgressEvent();
+
+    m_target->dispatchEvent(event);
+}
+
+void XMLHttpRequestProgressEventThrottle::flushProgressEvent()
+{
+    if (!hasEventToDispatch())
+        return;
+
+    PassRefPtr<Event> event = XMLHttpRequestProgressEvent::create(eventNames().progressEvent, m_lengthComputable, m_loaded, m_total);
+    m_loaded = 0;
+    m_total = 0;
+
+    // We stop the timer as this is called when no more events are supposed to occur.
+    stop();
+
+    m_target->dispatchEvent(event);
+}
+
+void XMLHttpRequestProgressEventThrottle::dispatchPausedEvent()
+{
+    ASSERT(!suspended());
+    if (!m_pausedEvent)
+        return;
+
+    m_target->dispatchEvent(m_pausedEvent);
+    m_pausedEvent = 0;
+}
+
+void XMLHttpRequestProgressEventThrottle::fired()
+{
+    ASSERT(isActive());
+    ASSERT(!suspended());
+    ASSERT(!m_pausedEvent);
+    if (!hasEventToDispatch()) {
+        // No progress event was queued since the previous dispatch, we can safely stop the timer.
+        stop();
+        return;
+    }
+
+    m_target->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().progressEvent, m_lengthComputable, m_loaded, m_total));
+    m_total = 0;
+    m_loaded = 0;
+}
+
+bool XMLHttpRequestProgressEventThrottle::hasEventToDispatch() const
+{
+    return (m_total || m_loaded) && isActive();
+}
+
+void XMLHttpRequestProgressEventThrottle::suspend()
+{
+    ASSERT(!m_pausedEvent);
+
+    m_suspended = true;
+    // If we have a progress event waiting to be dispatched,
+    // just queue it.
+    if (hasEventToDispatch()) {
+        m_pausedEvent = XMLHttpRequestProgressEvent::create(eventNames().progressEvent, m_lengthComputable, m_loaded, m_total);
+        m_total = 0;
+        m_loaded = 0;
+    }
+    stop();
+}
+
+void XMLHttpRequestProgressEventThrottle::resume()
+{
+    ASSERT(!m_loaded);
+    ASSERT(!m_total);
+
+    m_suspended = false;
+    dispatchPausedEvent();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestProgressEventThrottle.h b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestProgressEventThrottle.h
new file mode 100644
index 0000000000..f51aea1b8e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestProgressEventThrottle.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2010 Julien Chaffraix <jchaffraix@webkit.org>
+ * All right reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef XMLHttpRequestProgressEventThrottle_h
+#define XMLHttpRequestProgressEventThrottle_h
+
+#include "Timer.h"
+#include "wtf/PassRefPtr.h"
+#include "wtf/Vector.h"
+
+namespace WebCore {
+
+class Event;
+class EventTarget;
+
+enum ProgressEventAction {
+    DoNotFlushProgressEvent,
+    FlushProgressEvent
+};
+
+// This implements the XHR2 progress event dispatching: "dispatch a progress event called progress
+// about every 50ms or for every byte received, whichever is least frequent".
+class XMLHttpRequestProgressEventThrottle : public TimerBase {
+public:
+    XMLHttpRequestProgressEventThrottle(EventTarget*);
+    virtual ~XMLHttpRequestProgressEventThrottle();
+
+    void dispatchProgressEvent(bool lengthComputable, unsigned loaded, unsigned total);
+    void dispatchEvent(PassRefPtr<Event>, ProgressEventAction = DoNotFlushProgressEvent);
+
+    void suspend();
+    void resume();
+
+    bool suspended() const { return m_suspended; }
+
+private:
+    static const double minimumProgressEventDispatchingIntervalInSeconds;
+
+    virtual void fired();
+    void dispatchPausedEvent();
+    void flushProgressEvent();
+
+    bool hasEventToDispatch() const;
+
+    // Weak pointer to our XMLHttpRequest object as it is the one holding us.
+    EventTarget* m_target;
+
+    bool m_lengthComputable;
+    unsigned m_loaded;
+    unsigned m_total;
+
+    bool m_suspended;
+    RefPtr<Event> m_pausedEvent;
+};
+
+} // namespace WebCore
+
+#endif // XMLHttpRequestProgressEventThrottle_h
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.idl b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.idl
index 901b47cccd..a712a376a8 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.idl
@@ -31,7 +31,6 @@ module xml {
     interface [
         CustomMarkFunction,
         EventTarget,
-        GenerateConstructor,
         NoStaticTables
     ] XMLHttpRequestUpload {
         // From XMLHttpRequestEventTarget
@@ -43,12 +42,12 @@ module xml {
         attribute EventListener onprogress;
 
         // EventTarget interface
-        [Custom] void addEventListener(in DOMString type, 
-                                      in EventListener listener, 
-                                      in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type, 
+        [JSCCustom] void addEventListener(in DOMString type, 
                                           in EventListener listener, 
                                           in boolean useCapture);
+        [JSCCustom] void removeEventListener(in DOMString type, 
+                                             in EventListener listener, 
+                                             in boolean useCapture);
         boolean dispatchEvent(in Event evt)
             raises(EventException);
     };
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLSerializer.idl b/src/3rdparty/webkit/WebCore/xml/XMLSerializer.idl
index 6dcc3a470a..8c594467b0 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLSerializer.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XMLSerializer.idl
@@ -20,7 +20,7 @@
 
 module xpath {
 
-    interface [GenerateConstructor, CanBeConstructed] XMLSerializer {
+    interface [CanBeConstructed] XMLSerializer {
         DOMString serializeToString(in Node node)
             raises(DOMException);
     };
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathEvaluator.idl b/src/3rdparty/webkit/WebCore/xml/XPathEvaluator.idl
index da6155b244..c075b01218 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathEvaluator.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XPathEvaluator.idl
@@ -18,7 +18,7 @@
  */
 
 module xpath {
-    interface [GenerateConstructor, CanBeConstructed, Conditional=XPATH] XPathEvaluator {
+    interface [CanBeConstructed, Conditional=XPATH] XPathEvaluator {
         XPathExpression createExpression(in DOMString expression,
                                          in XPathNSResolver resolver)
             raises(core::DOMException);
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathException.idl b/src/3rdparty/webkit/WebCore/xml/XPathException.idl
index c3c95e37e9..d5a9af6d9c 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathException.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XPathException.idl
@@ -29,7 +29,6 @@
 module xpath {
 
     interface [
-        GenerateConstructor,
         Conditional=XPATH
     ] XPathException {
 
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathExpression.idl b/src/3rdparty/webkit/WebCore/xml/XPathExpression.idl
index c1fc15ee88..6b6ceeb954 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathExpression.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XPathExpression.idl
@@ -22,8 +22,7 @@ module xpath {
 
 
     interface [
-        Conditional=XPATH,
-        GenerateConstructor
+        Conditional=XPATH
     ] XPathExpression {
         [OldStyleObjC] XPathResult evaluate(in Node contextNode, 
                                             in unsigned short type, 
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathExpressionNode.h b/src/3rdparty/webkit/WebCore/xml/XPathExpressionNode.h
index 74b134e7b5..38070b95c6 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathExpressionNode.h
+++ b/src/3rdparty/webkit/WebCore/xml/XPathExpressionNode.h
@@ -39,7 +39,7 @@ namespace WebCore {
 
     namespace XPath {
         
-        struct EvaluationContext {
+        struct EvaluationContext : FastAllocBase {
             RefPtr<Node> node;
             unsigned long size;
             unsigned long position;
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathNSResolver.idl b/src/3rdparty/webkit/WebCore/xml/XPathNSResolver.idl
index 48c0113dad..4e996c2719 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathNSResolver.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XPathNSResolver.idl
@@ -20,7 +20,7 @@
 
 module xpath {
 
-    interface [ObjCProtocol, Conditional=XPATH] XPathNSResolver {
+    interface [ObjCProtocol, Conditional=XPATH, OmitConstructor] XPathNSResolver {
         [ConvertNullStringTo=Null] DOMString lookupNamespaceURI(in DOMString prefix);
     };
 
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathNodeSet.h b/src/3rdparty/webkit/WebCore/xml/XPathNodeSet.h
index 1130488e63..d5c47beab1 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathNodeSet.h
+++ b/src/3rdparty/webkit/WebCore/xml/XPathNodeSet.h
@@ -37,7 +37,7 @@ namespace WebCore {
 
     namespace XPath {
 
-        class NodeSet {
+        class NodeSet : public FastAllocBase {
         public:
             NodeSet() : m_isSorted(true), m_subtreesAreDisjoint(false) { }
             
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathResult.idl b/src/3rdparty/webkit/WebCore/xml/XPathResult.idl
index bc36c3e9c2..ebbff42d69 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathResult.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XPathResult.idl
@@ -19,7 +19,7 @@
 
 module xpath {
 
-    interface [GenerateConstructor, Conditional=XPATH] XPathResult {
+    interface [Conditional=XPATH] XPathResult {
         const unsigned short ANY_TYPE                       = 0;
         const unsigned short NUMBER_TYPE                    = 1;
         const unsigned short STRING_TYPE                    = 2;
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathStep.cpp b/src/3rdparty/webkit/WebCore/xml/XPathStep.cpp
index 411b616eb9..6e60952f3c 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathStep.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XPathStep.cpp
@@ -34,6 +34,7 @@
 #include "Document.h"
 #include "Element.h"
 #include "NamedNodeMap.h"
+#include "XMLNSNames.h"
 #include "XPathParser.h"
 #include "XPathUtil.h"
 
@@ -173,7 +174,7 @@ static inline bool nodeMatchesBasicTest(Node* node, Step::Axis axis, const Step:
                 ASSERT(node->isAttributeNode());
 
                 // In XPath land, namespace nodes are not accessible on the attribute axis.
-                if (node->namespaceURI() == "http://www.w3.org/2000/xmlns/")
+                if (node->namespaceURI() == XMLNSNames::xmlnsNamespaceURI)
                     return false;
 
                 if (name == starAtom)
@@ -193,9 +194,13 @@ static inline bool nodeMatchesBasicTest(Node* node, Step::Axis axis, const Step:
             if (name == starAtom)
                 return namespaceURI.isEmpty() || namespaceURI == node->namespaceURI();
 
-            if (node->isHTMLElement() && node->document()->isHTMLDocument()) {
-                // Paths without namespaces should match HTML elements in HTML documents despite those having an XHTML namespace. Names are compared case-insensitively.
-                return equalIgnoringCase(static_cast<Element*>(node)->localName(), name) && (namespaceURI.isNull() || namespaceURI == node->namespaceURI());
+            if (node->document()->isHTMLDocument()) {
+                if (node->isHTMLElement()) {
+                    // Paths without namespaces should match HTML elements in HTML documents despite those having an XHTML namespace. Names are compared case-insensitively.
+                    return equalIgnoringCase(static_cast<Element*>(node)->localName(), name) && (namespaceURI.isNull() || namespaceURI == node->namespaceURI());
+                }
+                // An expression without any prefix shouldn't match no-namespace nodes (because HTML5 says so).
+                return static_cast<Element*>(node)->hasLocalName(name) && namespaceURI == node->namespaceURI() && !namespaceURI.isNull();
             }
             return static_cast<Element*>(node)->hasLocalName(name) && namespaceURI == node->namespaceURI();
         }
@@ -331,7 +336,7 @@ void Step::nodesInAxis(Node* context, NodeSet& nodes) const
             // Avoid lazily creating attribute nodes for attributes that we do not need anyway.
             if (m_nodeTest.kind() == NodeTest::NameTest && m_nodeTest.data() != starAtom) {
                 RefPtr<Node> n = static_cast<Element*>(context)->getAttributeNodeNS(m_nodeTest.namespaceURI(), m_nodeTest.data());
-                if (n && n->namespaceURI() != "http://www.w3.org/2000/xmlns/") { // In XPath land, namespace nodes are not accessible on the attribute axis.
+                if (n && n->namespaceURI() != XMLNSNames::xmlnsNamespaceURI) { // In XPath land, namespace nodes are not accessible on the attribute axis.
                     if (nodeMatches(n.get(), AttributeAxis, m_nodeTest)) // Still need to check merged predicates.
                         nodes.append(n.release());
                 }
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathStep.h b/src/3rdparty/webkit/WebCore/xml/XPathStep.h
index 11612e92f0..ec022b3eb3 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathStep.h
+++ b/src/3rdparty/webkit/WebCore/xml/XPathStep.h
@@ -49,7 +49,7 @@ namespace WebCore {
                 SelfAxis
             };
             
-            class NodeTest {
+            class NodeTest : public FastAllocBase {
             public:
                 enum Kind {
                     TextNodeTest, CommentNodeTest, ProcessingInstructionNodeTest, AnyNodeTest, NameTest
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathValue.cpp b/src/3rdparty/webkit/WebCore/xml/XPathValue.cpp
index f5acb3894c..29e211e13c 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathValue.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XPathValue.cpp
@@ -68,12 +68,7 @@ NodeSet& Value::modifiableNodeSet()
     return m_data->m_nodeSet;
 }
 
-#if COMPILER(WINSCW)
-// FIXME --nl-- Symbian WINSCW compiler complains with 'ambiguous access to overloaded function' (double, unsigned long, unsigned int)
-unsigned int Value::toBoolean() const
-#else
 bool Value::toBoolean() const
-#endif
 {
     switch (m_type) {
         case NodeSetValue:
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathValue.h b/src/3rdparty/webkit/WebCore/xml/XPathValue.h
index bd44c91b3f..a0cd24ddca 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathValue.h
+++ b/src/3rdparty/webkit/WebCore/xml/XPathValue.h
@@ -66,11 +66,8 @@ namespace WebCore {
             Value(Node* value) : m_type(NodeSetValue), m_bool(false), m_number(0), m_data(ValueData::create()) { m_data->m_nodeSet.append(value); }
 
             // This is needed to safely implement constructing from bool - with normal function overloading, any pointer type would match.
-#if COMPILER(WINSCW)
-            Value(bool);
-#else
             template<typename T> Value(T);
-#endif
+
             static const struct AdoptTag {} adopt;
             Value(NodeSet& value, const AdoptTag&) : m_type(NodeSetValue), m_bool(false), m_number(0),  m_data(ValueData::create()) { value.swap(m_data->m_nodeSet); }
 
@@ -83,12 +80,7 @@ namespace WebCore {
 
             const NodeSet& toNodeSet() const;
             NodeSet& modifiableNodeSet();
-#if COMPILER(WINSCW)
-            // FIXME --nl-- Symbian WINSCW compiler complains with 'ambiguous access to overloaded function' (double, unsigned long, unsigned int)
-            unsigned int toBoolean() const;
-#else
             bool toBoolean() const;
-#endif
             double toNumber() const;
             String toString() const;
 
@@ -98,9 +90,8 @@ namespace WebCore {
             double m_number;
             RefPtr<ValueData> m_data;
         };
-#if !COMPILER(WINSCW)
+
         template<>
-#endif
         inline Value::Value(bool value)
             : m_type(BooleanValue)
             , m_bool(value)
diff --git a/src/3rdparty/webkit/WebCore/xml/XSLImportRule.cpp b/src/3rdparty/webkit/WebCore/xml/XSLImportRule.cpp
index b697c0d888..0908d754b3 100644
--- a/src/3rdparty/webkit/WebCore/xml/XSLImportRule.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XSLImportRule.cpp
@@ -52,13 +52,13 @@ XSLStyleSheet* XSLImportRule::parentStyleSheet() const
     return (parent() && parent()->isXSLStyleSheet()) ? static_cast<XSLStyleSheet*>(parent()) : 0;
 }
 
-void XSLImportRule::setXSLStyleSheet(const String& url, const String& sheet)
+void XSLImportRule::setXSLStyleSheet(const String& href, const KURL& baseURL, const String& sheet)
 {
     if (m_styleSheet)
         m_styleSheet->setParent(0);
-    
-    m_styleSheet = XSLStyleSheet::create(this, url);
-    
+
+    m_styleSheet = XSLStyleSheet::create(this, href, baseURL);
+
     XSLStyleSheet* parent = parentStyleSheet();
     if (parent)
         m_styleSheet->setParentStyleSheet(parent);
@@ -87,14 +87,14 @@ void XSLImportRule::loadSheet()
     
     String absHref = m_strHref;
     XSLStyleSheet* parentSheet = parentStyleSheet();
-    if (!parentSheet->href().isNull())
+    if (!parentSheet->finalURL().isNull())
         // use parent styleheet's URL as the base URL
-        absHref = KURL(KURL(ParsedURLString, parentSheet->href()), m_strHref).string();
+        absHref = KURL(parentSheet->finalURL(), m_strHref).string();
     
     // Check for a cycle in our import chain.  If we encounter a stylesheet
     // in our parent chain with the same URL, then just bail.
     for (parent = this->parent(); parent; parent = parent->parent()) {
-        if (parent->isXSLStyleSheet() && absHref == static_cast<XSLStyleSheet*>(parent)->href())
+        if (parent->isXSLStyleSheet() && absHref == static_cast<XSLStyleSheet*>(parent)->finalURL().string())
             return;
     }
     
diff --git a/src/3rdparty/webkit/WebCore/xml/XSLImportRule.h b/src/3rdparty/webkit/WebCore/xml/XSLImportRule.h
index fc7a7f8492..f3a9318676 100644
--- a/src/3rdparty/webkit/WebCore/xml/XSLImportRule.h
+++ b/src/3rdparty/webkit/WebCore/xml/XSLImportRule.h
@@ -57,7 +57,7 @@ private:
     virtual bool isImportRule() { return true; }
 
     // from CachedResourceClient
-    virtual void setXSLStyleSheet(const String& url, const String& sheet);
+    virtual void setXSLStyleSheet(const String& href, const KURL& baseURL, const String& sheet);
     
     String m_strHref;
     RefPtr<XSLStyleSheet> m_styleSheet;
diff --git a/src/3rdparty/webkit/WebCore/xml/XSLStyleSheet.h b/src/3rdparty/webkit/WebCore/xml/XSLStyleSheet.h
index c9729bb0a1..e6e40638e0 100644
--- a/src/3rdparty/webkit/WebCore/xml/XSLStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/xml/XSLStyleSheet.h
@@ -43,18 +43,18 @@ class XSLImportRule;
 class XSLStyleSheet : public StyleSheet {
 public:
 #if !USE(QXMLQUERY)
-    static PassRefPtr<XSLStyleSheet> create(XSLImportRule* parentImport, const String& href)
+    static PassRefPtr<XSLStyleSheet> create(XSLImportRule* parentImport, const String& originalURL, const KURL& finalURL)
     {
-        return adoptRef(new XSLStyleSheet(parentImport, href));
+        return adoptRef(new XSLStyleSheet(parentImport, originalURL, finalURL));
     }
 #endif
-    static PassRefPtr<XSLStyleSheet> create(Node* parentNode, const String& href)
+    static PassRefPtr<XSLStyleSheet> create(Node* parentNode, const String& originalURL, const KURL& finalURL)
     {
-        return adoptRef(new XSLStyleSheet(parentNode, href, false));
+        return adoptRef(new XSLStyleSheet(parentNode, originalURL, finalURL, false));
     }
-    static PassRefPtr<XSLStyleSheet> createEmbedded(Node* parentNode, const String& href)
+    static PassRefPtr<XSLStyleSheet> createInline(Node* parentNode, const KURL& finalURL)
     {
-        return adoptRef(new XSLStyleSheet(parentNode, href, true));
+        return adoptRef(new XSLStyleSheet(parentNode, finalURL.string(), finalURL, true));
     }
 
     virtual ~XSLStyleSheet();
@@ -90,9 +90,9 @@ public:
     bool processed() const { return m_processed; }
 
 private:
-    XSLStyleSheet(Node* parentNode, const String& href, bool embedded);
+    XSLStyleSheet(Node* parentNode, const String& originalURL, const KURL& finalURL, bool embedded);
 #if !USE(QXMLQUERY)
-    XSLStyleSheet(XSLImportRule* parentImport, const String& href);
+    XSLStyleSheet(XSLImportRule* parentImport, const String& originalURL, const KURL& finalURL);
 #endif
 
     Document* m_ownerDocument;
diff --git a/src/3rdparty/webkit/WebCore/xml/XSLStyleSheetLibxslt.cpp b/src/3rdparty/webkit/WebCore/xml/XSLStyleSheetLibxslt.cpp
index 2ae8b82355..dbd806a5b7 100644
--- a/src/3rdparty/webkit/WebCore/xml/XSLStyleSheetLibxslt.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XSLStyleSheetLibxslt.cpp
@@ -55,8 +55,8 @@ SOFT_LINK(libxslt, xsltLoadStylesheetPI, xsltStylesheetPtr, (xmlDocPtr doc), (do
 
 namespace WebCore {
 
-XSLStyleSheet::XSLStyleSheet(XSLImportRule* parentRule, const String& href)
-    : StyleSheet(parentRule, href)
+XSLStyleSheet::XSLStyleSheet(XSLImportRule* parentRule, const String& originalURL, const KURL& finalURL)
+    : StyleSheet(parentRule, originalURL, finalURL)
     , m_ownerDocument(0)
     , m_embedded(false)
     , m_processed(false) // Child sheets get marked as processed when the libxslt engine has finally seen them.
@@ -66,8 +66,8 @@ XSLStyleSheet::XSLStyleSheet(XSLImportRule* parentRule, const String& href)
 {
 }
 
-XSLStyleSheet::XSLStyleSheet(Node* parentNode, const String& href,  bool embedded)
-    : StyleSheet(parentNode, href)
+XSLStyleSheet::XSLStyleSheet(Node* parentNode, const String& originalURL, const KURL& finalURL,  bool embedded)
+    : StyleSheet(parentNode, originalURL, finalURL)
     , m_ownerDocument(parentNode->document())
     , m_embedded(embedded)
     , m_processed(true) // The root sheet starts off processed.
@@ -168,7 +168,7 @@ bool XSLStyleSheet::parseString(const String& string, bool)
     }
 
     m_stylesheetDoc = xmlCtxtReadMemory(ctxt, buffer, size,
-        href().utf8().data(),
+        finalURL().string().utf8().data(),
         BOMHighByte == 0xFF ? "UTF-16LE" : "UTF-16BE",
         XML_PARSE_NOENT | XML_PARSE_DTDATTR | XML_PARSE_NOWARNING | XML_PARSE_NOCDATA);
     xmlFreeParserCtxt(ctxt);
@@ -192,7 +192,7 @@ void XSLStyleSheet::loadChildSheets()
     if (m_embedded) {
         // We have to locate (by ID) the appropriate embedded stylesheet element, so that we can walk the
         // import/include list.
-        xmlAttrPtr idNode = xmlGetID(document(), (const xmlChar*)(href().utf8().data()));
+        xmlAttrPtr idNode = xmlGetID(document(), (const xmlChar*)(finalURL().string().utf8().data()));
         if (!idNode)
             return;
         stylesheetRoot = idNode->parent;
diff --git a/src/3rdparty/webkit/WebCore/xml/XSLStyleSheetQt.cpp b/src/3rdparty/webkit/WebCore/xml/XSLStyleSheetQt.cpp
index 6d27e2034f..cb55993974 100644
--- a/src/3rdparty/webkit/WebCore/xml/XSLStyleSheetQt.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XSLStyleSheetQt.cpp
@@ -33,8 +33,8 @@
 
 namespace WebCore {
 
-XSLStyleSheet::XSLStyleSheet(Node* parentNode, const String& href,  bool embedded)
-    : StyleSheet(parentNode, href)
+XSLStyleSheet::XSLStyleSheet(Node* parentNode, const String& originalURL, const KURL& finalURL,  bool embedded)
+    : StyleSheet(parentNode, originalURL, finalURL)
     , m_ownerDocument(parentNode->document())
     , m_embedded(embedded)
 {
diff --git a/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.cpp b/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.cpp
index b18224317e..b530d52353 100644
--- a/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.cpp
@@ -41,7 +41,6 @@
 #include "loader.h"
 #include "markup.h"
 #include <wtf/Assertions.h>
-#include <wtf/Platform.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -70,10 +69,10 @@ PassRefPtr<Document> XSLTProcessor::createDocumentFromSource(const String& sourc
 
     RefPtr<Document> result;
     if (sourceMIMEType == "text/plain") {
-        result = ownerDocument->implementation()->createDocument(frame);
+        result = Document::create(frame);
         transformTextStringToXHTMLDocumentString(documentSource);
     } else
-        result = ownerDocument->implementation()->createDocument(sourceMIMEType, frame, false);
+        result = DOMImplementation::createDocument(sourceMIMEType, frame, false);
 
     // Before parsing, we need to save & detach the old document and get the new document
     // in place. We have to do this only if we're rendering the result document.
diff --git a/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.idl b/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.idl
index 0a6ff9303f..28bd878a83 100644
--- a/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.idl
@@ -33,7 +33,8 @@ module xml {
     // http://bugs.webkit.org/show_bug.cgi?id=5446
 
     interface [
-        Conditional=XSLT
+        Conditional=XSLT,
+        CustomConstructor
     ] XSLTProcessor {
         
         [Custom] void importStylesheet(in Node stylesheet);
diff --git a/src/3rdparty/webkit/WebCore/xml/XSLTProcessorLibxslt.cpp b/src/3rdparty/webkit/WebCore/xml/XSLTProcessorLibxslt.cpp
index 200c56b66c..5fa49eae42 100644
--- a/src/3rdparty/webkit/WebCore/xml/XSLTProcessorLibxslt.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XSLTProcessorLibxslt.cpp
@@ -46,7 +46,6 @@
 #include <libxslt/variables.h>
 #include <libxslt/xsltutils.h>
 #include <wtf/Assertions.h>
-#include <wtf/Platform.h>
 #include <wtf/Vector.h>
 
 #if PLATFORM(MAC)
@@ -201,8 +200,8 @@ static const char** xsltParamArrayFromParameterMap(XSLTProcessor::ParameterMap&
     XSLTProcessor::ParameterMap::iterator end = parameters.end();
     unsigned index = 0;
     for (XSLTProcessor::ParameterMap::iterator it = parameters.begin(); it != end; ++it) {
-        parameterArray[index++] = strdup(it->first.utf8().data());
-        parameterArray[index++] = strdup(it->second.utf8().data());
+        parameterArray[index++] = fastStrDup(it->first.utf8().data());
+        parameterArray[index++] = fastStrDup(it->second.utf8().data());
     }
     parameterArray[index] = 0;
 
@@ -216,8 +215,8 @@ static void freeXsltParamArray(const char** params)
         return;
 
     while (*temp) {
-        free((void*)*(temp++)); // strdup returns malloc'd blocks, so we have to use free() here
-        free((void*)*(temp++));
+        fastFree((void*)*(temp++));
+        fastFree((void*)*(temp++));
     }
     fastFree(params);
 }
@@ -226,7 +225,8 @@ static xsltStylesheetPtr xsltStylesheetPointer(RefPtr<XSLStyleSheet>& cachedStyl
 {
     if (!cachedStylesheet && stylesheetRootNode) {
         cachedStylesheet = XSLStyleSheet::create(stylesheetRootNode->parent() ? stylesheetRootNode->parent() : stylesheetRootNode,
-            stylesheetRootNode->document()->url().string());
+            stylesheetRootNode->document()->url().string(),
+            stylesheetRootNode->document()->url()); // FIXME: Should we use baseURL here?
         cachedStylesheet->parseString(createMarkup(stylesheetRootNode));
     }
 
diff --git a/src/3rdparty/webkit/WebCore/xml/XSLTProcessorQt.cpp b/src/3rdparty/webkit/WebCore/xml/XSLTProcessorQt.cpp
index 3e05ca0b2b..29dbacf2b6 100644
--- a/src/3rdparty/webkit/WebCore/xml/XSLTProcessorQt.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XSLTProcessorQt.cpp
@@ -32,7 +32,6 @@
 #include "loader.h"
 #include "markup.h"
 #include <wtf/Assertions.h>
-#include <wtf/Platform.h>
 #include <wtf/Vector.h>
 
 #include <qabstractmessagehandler.h>
@@ -120,7 +119,9 @@ bool XSLTProcessor::transformToString(Node* sourceNode, String&, String& resultS
     RefPtr<XSLStyleSheet> stylesheet = m_stylesheet;
     if (!stylesheet && m_stylesheetRootNode) {
         Node* node = m_stylesheetRootNode.get();
-        stylesheet = XSLStyleSheet::create(node->parent() ? node->parent() : node, node->document()->url().string());
+        stylesheet = XSLStyleSheet::create(node->parent() ? node->parent() : node,
+            node->document()->url().string(),
+            node->document()->url()); // FIXME: Should we use baseURL here?
         stylesheet->parseString(createMarkup(node));
     }
 
diff --git a/src/3rdparty/webkit/WebCore/xml/xmlnsattrs.in b/src/3rdparty/webkit/WebCore/xml/xmlnsattrs.in
new file mode 100644
index 0000000000..7ac415a936
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/xml/xmlnsattrs.in
@@ -0,0 +1,4 @@
+namespace="XMLNS"
+namespaceURI="http://www.w3.org/2000/xmlns/"
+
+xmlns
diff --git a/src/3rdparty/webkit/WebKit.pri b/src/3rdparty/webkit/WebKit.pri
index 5188662ee5..e73703976d 100644
--- a/src/3rdparty/webkit/WebKit.pri
+++ b/src/3rdparty/webkit/WebKit.pri
@@ -1,13 +1,12 @@
 # Include file to make it easy to include WebKit into Qt projects
 
+# Detect that we are building as a standalone package by the presence of
+# either the generated files directory or as part of the Qt package through
+# QTDIR_build
+CONFIG(QTDIR_build): CONFIG += standalone_package
+else:exists($$PWD/WebCore/generated): CONFIG += standalone_package
 
-isEmpty(OUTPUT_DIR) {
-    CONFIG(debug, debug|release) {
-        OUTPUT_DIR=$$PWD/WebKitBuild/Debug
-    } else { # Release
-        OUTPUT_DIR=$$PWD/WebKitBuild/Release
-    }
-}
+CONFIG += depend_includepath
 
 DEFINES += BUILDING_QT__=1
 building-libs {
@@ -17,12 +16,16 @@ building-libs {
         QT += webkit
     } else {
         QMAKE_LIBDIR = $$OUTPUT_DIR/lib $$QMAKE_LIBDIR
+        QTWEBKITLIBNAME = QtWebKit
         mac:!static:contains(QT_CONFIG, qt_framework):!CONFIG(webkit_no_framework) {
-            LIBS += -framework QtWebKit
+            LIBS += -framework $$QTWEBKITLIBNAME
             QMAKE_FRAMEWORKPATH = $$OUTPUT_DIR/lib $$QMAKE_FRAMEWORKPATH
         } else {
             win32-*|wince* {
-                LIBS += -lQtWebKit$${QT_MAJOR_VERSION}
+                CONFIG(debug, debug|release):build_pass: QTWEBKITLIBNAME = $${QTWEBKITLIBNAME}d
+                QTWEBKITLIBNAME = $${QTWEBKITLIBNAME}$${QT_MAJOR_VERSION}
+                win32-g++: LIBS += -l$$QTWEBKITLIBNAME
+                else: LIBS += $${QTWEBKITLIBNAME}.lib
             } else {
                 LIBS += -lQtWebKit
                 symbian {
@@ -34,6 +37,7 @@ building-libs {
     }
     DEPENDPATH += $$PWD/WebKit/qt/Api
 }
+greaterThan(QT_MINOR_VERSION, 5):DEFINES += WTF_USE_ACCELERATED_COMPOSITING
 
 !mac:!unix|symbian {
     DEFINES += USE_SYSTEM_MALLOC
@@ -44,17 +48,15 @@ CONFIG(release, debug|release) {
 }
 
 BASE_DIR = $$PWD
-INCLUDEPATH += $$PWD/WebKit/qt/Api
+INCLUDEPATH += $$OUTPUT_DIR/include/QtWebKit
 
 CONFIG -= warn_on
-*-g++*:QMAKE_CXXFLAGS += -Wreturn-type -fno-strict-aliasing
-#QMAKE_CXXFLAGS += -Wall -Wno-undef -Wno-unused-parameter
+*-g++*:QMAKE_CXXFLAGS += -Wall -Wreturn-type -fno-strict-aliasing -Wcast-align -Wchar-subscripts -Wformat-security -Wreturn-type -Wno-unused-parameter -Wno-sign-compare -Wno-switch -Wno-switch-enum -Wundef -Wmissing-noreturn -Winit-self
 
 # Enable GNU compiler extensions to the ARM compiler for all Qt ports using RVCT
 symbian|*-armcc {
     RVCT_COMMON_CFLAGS = --gnu --diag_suppress 68,111,177,368,830,1293
     RVCT_COMMON_CXXFLAGS = $$RVCT_COMMON_CFLAGS --no_parse_templates
-    DEFINES *= QT_NO_UITOOLS
 }
 
 *-armcc {
@@ -66,75 +68,11 @@ symbian {
     QMAKE_CXXFLAGS.ARMCC += $$RVCT_COMMON_CXXFLAGS
 }
 
+symbian|maemo5: DEFINES *= QT_NO_UITOOLS
+
 contains(DEFINES, QT_NO_UITOOLS): CONFIG -= uitools
 
 # Disable a few warnings on Windows. The warnings are also
 # disabled in WebKitLibraries/win/tools/vsprops/common.vsprops
 win32-msvc*: QMAKE_CXXFLAGS += -wd4291 -wd4344 -wd4396 -wd4503 -wd4800 -wd4819 -wd4996
 
-#
-# For builds inside Qt we interpret the output rule and the input of each extra compiler manually
-# and add the resulting sources to the SOURCES variable, because the build inside Qt contains already
-# all the generated files. We do not need to generate any extra compiler rules in that case.
-#
-# In addition this function adds a new target called 'generated_files' that allows manually calling
-# all the extra compilers to generate all the necessary files for the build using 'make generated_files'
-#
-defineTest(addExtraCompiler) {
-    CONFIG(QTDIR_build) {
-        outputRule = $$eval($${1}.output)
-        outVariable = $$eval($${1}.variable_out)
-        !isEqual(outVariable,GENERATED_SOURCES):return(true)
-
-        input = $$eval($${1}.input)
-        input = $$eval($$input)
-
-        for(file,input) {
-            base = $$basename(file)
-            base ~= s/\..+//
-            newfile=$$replace(outputRule,\\$\\{QMAKE_FILE_BASE\\},$$base)
-            SOURCES += $$newfile
-        }
-
-        export(SOURCES)
-    } else {
-        QMAKE_EXTRA_COMPILERS += $$1
-        generated_files.depends += compiler_$${1}_make_all
-        export(QMAKE_EXTRA_COMPILERS)
-        export(generated_files.depends)
-    }
-    return(true)
-}
-
-defineTest(addExtraCompilerWithHeader) {
-    addExtraCompiler($$1)
-
-    eval(headerFile = $${2})
-    isEmpty(headerFile) {
-        eval($${1}_header.output = $$eval($${1}.output))
-        eval($${1}_header.output ~= s/\.cpp/.h/)
-        eval($${1}_header.output ~= s/\.c/.h/)
-    } else {
-        eval($${1}_header.output = $$headerFile)
-    }
-
-    eval($${1}_header.input = $$eval($${1}.input))
-    eval($${1}_header.commands = @echo -n '')
-    eval($${1}_header.depends = compiler_$${1}_make_all)
-    eval($${1}_header.variable_out = GENERATED_FILES)
-
-    export($${1}_header.output)
-    export($${1}_header.input)
-    export($${1}_header.commands)
-    export($${1}_header.depends)
-    export($${1}_header.variable_out)
-
-    !CONFIG(QTDIR_build): QMAKE_EXTRA_COMPILERS += $${1}_header
-
-    export(QMAKE_EXTRA_COMPILERS)
-    export(generated_files.depends)
-    export(SOURCES)
-
-    return(true)
-}
-
diff --git a/src/3rdparty/webkit/WebKit.pro b/src/3rdparty/webkit/WebKit.pro
new file mode 100644
index 0000000000..3c6b1a7b61
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit.pro
@@ -0,0 +1,35 @@
+TEMPLATE = subdirs
+CONFIG += ordered
+
+include(WebKit.pri)
+
+SUBDIRS += \
+        JavaScriptCore \
+        WebCore \
+        WebKitTools/QtLauncher
+
+!CONFIG(standalone_package) {
+    SUBDIRS += JavaScriptCore/jsc.pro \
+        WebKit/qt/tests \
+        WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro
+
+    !win32:!symbian {
+        SUBDIRS += WebKitTools/DumpRenderTree/qt/ImageDiff.pro
+        SUBDIRS += WebKitTools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
+    }
+
+}
+
+build-qtscript {
+    SUBDIRS += \
+        JavaScriptCore/qt/api/QtScript.pro \
+        JavaScriptCore/qt/tests
+}
+
+symbian {
+    # Forward the install target to WebCore. A workaround since INSTALLS is not implemented for symbian
+    install.commands = $(MAKE) -C WebCore install
+    QMAKE_EXTRA_TARGETS += install
+}
+
+include(WebKit/qt/docs/docs.pri)
diff --git a/src/3rdparty/webkit/WebKit/ChangeLog b/src/3rdparty/webkit/WebKit/ChangeLog
index 5006da7f66..bee32988fb 100644
--- a/src/3rdparty/webkit/WebKit/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/ChangeLog
@@ -1,3 +1,463 @@
+2010-03-22  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36328
+
+        * WebKit.xcodeproj/project.pbxproj: Remove WebNullPluginView and nullplugin.tiff from the project.
+
+2010-03-22  Darin Adler  <darin@apple.com>
+
+        * StringsNotToBeLocalized.txt: Updated for recent changes.
+
+2010-03-22  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36328
+
+        * English.lproj/Localizable.strings: Added "Missing Plug-in" string.
+
+2010-03-18  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add EFL port files to efl/ewk.
+        http://webkit.org/b/35931
+
+        * efl/ewk/ewk_settings.cpp: Added.
+        * efl/ewk/ewk_settings.h: Added.
+
+2010-03-17  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add default theme files to efl/DefaultTheme.
+        http://webkit.org/b/36240
+
+        * efl/DefaultTheme/widget/radio/img_radio_on.png: Added.
+        * efl/DefaultTheme/radio/img_radio_off_hover.png: Added.
+        * efl/DefaultTheme/radio/img_radio_on_hover.png: Added.
+        * efl/DefaultTheme/radio/img_radio_off.png: Added.
+        * efl/DefaultTheme/radio/img_radio_off_focus.png: Added.
+        * efl/DefaultTheme/radio/img_radio_on_focus.png: Added.
+        * efl/DefaultTheme/combo/combo_normal.png: Added.
+        * efl/DefaultTheme/combo/combo_focus_button.png: Added.
+        * efl/DefaultTheme/combo/combo_hover_button.png: Added.
+        * efl/DefaultTheme/combo/combo_hover.png: Added.
+        * efl/DefaultTheme/combo/combo_focus.png: Added.
+        * efl/DefaultTheme/combo/combo_press_button.png: Added.
+        * efl/DefaultTheme/combo/combo_normal_button.png: Added.
+        * efl/DefaultTheme/combo/combo_press.png: Added.
+        * efl/DefaultTheme/combo/icon.png: Added.
+        * efl/DefaultTheme/file/file_normal.png: Added.
+        * efl/DefaultTheme/file/file_press.png: Added.
+        * efl/DefaultTheme/file/file_hover.png: Added.
+        * efl/DefaultTheme/file/file_focus.png: Added.
+        * efl/DefaultTheme/search/cancel/cancel_normal_button.png: Added.
+        * efl/DefaultTheme/search/cancel/cancel_normal_button2.png: Added.
+        * efl/DefaultTheme/search/decoration/decoration_normal_button.png: Added.
+        * efl/DefaultTheme/search/field/field_focused.png: Added.
+        * efl/DefaultTheme/search/field/field_normal.png: Added.
+        * efl/DefaultTheme/search/field/field_hovered.png: Added.
+        * efl/DefaultTheme/entry/img_normal.png: Added.
+        * efl/DefaultTheme/entry/img_hovered.png: Added.
+        * efl/DefaultTheme/entry/img_focused.png: Added.
+        * efl/DefaultTheme/check/img_check_off_hover.png: Added.
+        * efl/DefaultTheme/check/img_check_on.png: Added.
+        * efl/DefaultTheme/check/img_check_off_focus.png: Added.
+        * efl/DefaultTheme/check/img_check_on_focus.png: Added.
+        * efl/DefaultTheme/check/img_check_off.png: Added.
+        * efl/DefaultTheme/check/img_check_on_hover.png: Added.
+        * efl/DefaultTheme/scrollbar/scrollbar_knob_h.png: Added.
+        * efl/DefaultTheme/scrollbar/scrollbar_knob_v.png: Added.
+        * efl/DefaultTheme/scrollbar/scrollbar_hilight.png: Added.
+        * efl/DefaultTheme/scrollbar/scrollbar_v.png: Added.
+        * efl/DefaultTheme/scrollbar/scrollbar_h.png: Added.
+        * efl/DefaultTheme/button/img_button_normal.png: Added.
+        * efl/DefaultTheme/button/img_button_focus.png: Added.
+        * efl/DefaultTheme/button/img_button_hover.png: Added.
+        * efl/DefaultTheme/button/img_button_press.png: Added.
+
+2010-03-17  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add EFL example browser to efl/EWebLauncher.
+        http://webkit.org/b/36176
+
+        * efl/EWebLauncher/main.c: Added.
+
+2010-03-16  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add EFL port files to efl/WebCoreSupport.
+        http://webkit.org/b/35916
+
+        * efl/WebCoreSupport/ContextMenuClientEfl.cpp: Added.
+        * efl/WebCoreSupport/ContextMenuClientEfl.h: Added.
+
+2010-03-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Introduce InspectorFrontendClient that provides InspectorFrontend with an interface to the embedder. InspectorClient now serves as a delegate for InspectorController and does not contain methods for managing inspector frontend window. That allows to create remote InspectorFrontendHost.
+
+        Introduce InspectorFrontendClient that would provide InspectorFrontend with an interface to the embedder
+        https://bugs.webkit.org/show_bug.cgi?id=35036
+
+        * efl/WebCoreSupport/InspectorClientEfl.cpp:
+        (WebCore::InspectorClientEfl::openInspectorFrontend):
+        * efl/WebCoreSupport/InspectorClientEfl.h:
+
+2010-03-13  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add EFL port files to efl/ewk.
+        http://webkit.org/b/35925
+
+        * efl/ewk/ewk_history.cpp: Added.
+        * efl/ewk/ewk_history.h: Added.
+
+2010-03-13  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add EFL port files to efl/ewk.
+        http://webkit.org/b/35928
+
+        * efl/ewk/ewk_main.cpp: Added.
+        * efl/ewk/ewk_main.h: Added.
+
+2010-03-13  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add EFL port files to efl/ewk.
+        http://webkit.org/b/35924
+
+        * efl/ewk/ewk_frame.cpp: Added.
+        * efl/ewk/ewk_frame.h: Added.
+
+2010-03-13  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add EFL port files to efl/ewk.
+        http://webkit.org/b/35936
+
+        * efl/ewk/ewk_view_single.c: Added.
+
+2010-03-13  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add EFL port files to efl/ewk.
+        http://webkit.org/b/35929
+
+        * efl/ewk/ewk_util.cpp: Added.
+        * efl/ewk/ewk_util.h: Added.
+
+2010-03-13  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add EFL port files to efl/ewk.
+        http://webkit.org/b/35934
+
+        * efl/ewk/EWebKit.h: Added.
+        * efl/ewk/ewk_eapi.h: Added.
+        * efl/ewk/ewk_logging.h: Added.
+        * efl/ewk/ewk_private.h: Added.
+
+2010-03-11  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Add EFL port files to efl/WebCoreSupport.
+        http://webkit.org/b/35917
+
+        * efl/WebCoreSupport/InspectorClientEfl.h: Added.
+        * efl/WebCoreSupport/InspectorClientEfl.cpp: Added.
+
+2010-03-11  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Add EFL port files to efl/WebCoreSupport.
+        http://webkit.org/b/35914
+
+        * efl/WebCoreSupport/DragClientEfl.h: Added.
+        * efl/WebCoreSupport/DragClientEfl.cpp: Added.
+
+2010-03-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Sort the project file.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2010-03-10  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Holger Freyther.
+
+        Add EFL port files to efl/WebCoreSupport.
+        http://webkit.org/b/35913
+
+        * efl/WebCoreSupport/ChromeClientEfl.cpp: Added.
+        * efl/WebCoreSupport/ChromeClientEfl.h: Added.
+
+2010-03-09  John Sullivan  <sullivan@apple.com>
+
+        Fixed localized string key collision. update-webkit-localized-strings now
+        runs without errors.
+
+        Reviewed by Adam Roben.
+
+        * English.lproj/Localizable.strings:
+        Regenerated.
+
+2010-03-09  John Sullivan  <sullivan@apple.com>
+
+        * StringsNotToBeLocalized.txt:
+        Brought this file up to date. update-webkit-localizable-strings still lists
+        one key collision, but that's a separate issue.
+
+2010-03-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a script to verify that WebKit framework headers are internally consistent.
+
+        * WebKit.xcodeproj/project.pbxproj: Run the script during the build and fail with
+        an error should the consistency check fail.
+
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35394
+        <rdar://problem/7685262> Make passing objects between Java and plug-ins work
+
+        * WebKit.xcodeproj/project.pbxproj: Added new files.
+
+2010-02-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Build fix.  Remove a symbol corresponding to an inline function from the linker export
+        file to prevent a weak external failure.
+
+        * WebKit.xcodeproj/project.pbxproj: Accommodate rename of script.
+
+2010-02-04  John Sullivan  <sullivan@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=34611
+        WebLocalizedString() could use an assertion that it is being called on the main thread
+
+        Reviewed by Tim Hatcher.
+
+        * WebKit.xcodeproj/project.pbxproj:
+        Updated for renamed file (WebLocalizableStrings.m -> WebLocalizableStrings.mm)
+
+2010-01-29  Mark Rowe  <mrowe@apple.com>
+
+        Sort Xcode projects.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2010-01-19  Dan Bernstein  <mitz@apple.com>
+
+        Redo DumpRenderTree build fix without making WebTypesInternal.h a private header
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2010-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix, no review.
+
+        Fix build of DumpRenderTree by making the header WebTypesInternal.h Private
+        in WebKit.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2010-01-19  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: The child <option> elements of a non-multiple <select> are not
+        exposed
+
+        https://bugs.webkit.org/show_bug.cgi?id=33773
+        <rdar://problem/7550556>
+
+        Reviewed by Alice Liu.
+
+        * English.lproj/Localizable.strings:
+        Add new localized strings.
+
+2010-01-13  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33610
+        <rdar://problem/7288546> Silverlight full screen performance problem seen on Snow Leopard.
+
+         * WebKit.xcodeproj/project.pbxproj: Link the project against OpenGL.
+
+2009-12-25  Darin Adler  <darin@apple.com>
+
+        * StringsNotToBeLocalized.txt: Updated for recent changes.
+
+2009-12-18  Dan Bernstein  <mitz@apple.com>
+
+        Updated localizable strings after r52368
+
+        * English.lproj/Localizable.strings:
+
+2009-12-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Add Mac WebKit side of the client based geolocation provider.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-12-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Disable debug variants of WebKit frameworks.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-12-16  John Sullivan  <sullivan@apple.com>
+
+        Brought this file up to date, sans review.
+
+        * StringsNotToBeLocalized.txt:
+
+2009-11-30  Mark Rowe  <mrowe@apple.com>
+
+        Use the correct path to Info.plist to avoid creating an empty file at the top of the WebKit directory.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * chromium/features.gypi:
+
+2009-11-24  Mark Rowe  <mrowe@apple.com>
+
+        Fix production builds where the source tree may be read-only.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-11-20  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt and Jon Honeycutt.
+
+        Add support for WebSerializedJSValue to WebKit.  This object wraps the SerializedScriptValue functionality in WebCore
+        and exposes the ability to do JS value serialization/deserialization to WebKit clients.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-11-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for 'math' role
+        https://bugs.webkit.org/show_bug.cgi?id=31706
+
+        * English.lproj/Localizable.strings:
+        * StringsNotToBeLocalized.txt:
+
+2009-11-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7035231>
+        Support closed caption in <video> element
+
+        * English.lproj/Localizable.strings:
+            Add strings for toggle captions button.
+
+2009-11-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <https://bugs.webkit.org/show_bug.cgi?id=27959>.
+        Support for validationMessage attribute, as per HTML5 specs.
+
+        * English.lproj/Localizable.strings: new localizable strings
+
+2009-11-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Make the Mac Geolocation API async.
+
+        * WebKit.xcodeproj/project.pbxproj: Remove WebGeolocation.
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Add WebFrameLoadDelegatePrivat.h to WebKit.xcodeproj
+
+        Fixes <http://webkit.org/b/31124> Tell the WebFrameLoadDelegate when
+        window objects in isolated worlds are cleared
+
+        Reviewed by Dave Hyatt.
+
+        * WebKit.xcodeproj/project.pbxproj: Added
+        WebFrameLoadDelegatePrivate.h, which already existed.
+
+2009-11-12  Adam Roben  <aroben@apple.com>
+
+        Replace worldIDs with world objects
+
+        Part of <http://webkit.org/b/31414> Implement new SPI for dealing with
+        user scripts/stylesheets and isolated worlds
+
+        Reviewed by Sam Weinig.
+
+        * WebKit.xcodeproj/project.pbxproj: Added WebScriptWorld to the project.
+
+2009-11-12  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ARIA: add alert type roles
+        https://bugs.webkit.org/show_bug.cgi?id=31392
+
+        * English.lproj/Localizable.strings:
+        * StringsNotToBeLocalized.txt:
+
+2009-11-02  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by John Sullivan and Mark Rowe.
+
+        <rdar://problem/7356733> Voiceover does not read correct media controller time values
+        
+        Fix localized strings for media controller time values.
+
+        * English.lproj/Localizable.strings:
+
+2009-11-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Support ARIA "tab" roles
+        https://bugs.webkit.org/show_bug.cgi?id=30842
+
+        Add a localizable string for tab panel.
+
+        * English.lproj/Localizable.strings:
+        * StringsNotToBeLocalized.txt:
+
 2009-10-27  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Darin Adler.
diff --git a/src/3rdparty/webkit/WebKit/StringsNotToBeLocalized.txt b/src/3rdparty/webkit/WebKit/StringsNotToBeLocalized.txt
deleted file mode 100644
index 3f1964d476..0000000000
--- a/src/3rdparty/webkit/WebKit/StringsNotToBeLocalized.txt
+++ /dev/null
@@ -1,811 +0,0 @@
-"    "
-" "
-" #%*[^\n\r]%*[\n\r]"
-" %32[^# \t\n\r]%*[^# \t\n\r] "
-" *POST*"
-" *target*"
-" >>>"
-" Mac OS X %@; %@) AppleWebKit/%@ (KHTML, like Gecko) %@"
-" Mac OS X %@; %@) AppleWebKit/%@ (KHTML, like Gecko)"
-" Version/3.2.1"
-"#"
-"%"
-"%.0f"
-"%.1lf"
-"%.2lu/%.2lu/%.10lu-%.10lu.cache"
-"%.2u/%.2u/%.10u-%.10u.cache"
-"%0.fpx"
-"%20"
-"%2d) "
-"%4u"
-"%@ %.0fpx %.0fpx %.0fpx"
-"%@ %.0fpx %.0fpx"
-"%@ %@"
-"%@%@"
-"%@, %@"
-"%@-%d"
-"%@/%s"
-"%@/.tmp%d"
-"%@/Library/Preferences/%@"
-"%@:%u"
-"%@://%@"
-"%@://%@/%@"
-"%@://%@:%d"
-"%d"
-"%d_%d"
-"%d_%d_%d"
-"%dpx"
-"%ld"
-"&ie=UTF-8&oe=UTF-8"
-"(%.0f, %.0f)"
-"+"
-","
-"-"
-"-1px"
-"-createPluginMIMETypesPreferences"
-"-khtml-text-decorations-in-effect"
-"."
-"._"
-".download"
-".html"
-".jpg"
-".svg"
-".xhtml"
-"/"
-"/Frameworks/PDFKit.framework"
-"/Library/Internet Plug-Ins"
-"/System/Library/Frameworks/ApplicationServices.framework/Frameworks/LangAnalysis.framework/LangAnalysis"
-"/System/Library/Frameworks/Carbon.framework/Frameworks/HIToolbox.framework/HIToolbox"
-"/Volumes"
-"/tmp/XXXXXX.tiff"
-"0"
-"062AEEE3-9E42-44DC-A8A9-236B216FE011"
-"1"
-"1000"
-"12px"
-"13"
-"16"
-"1800"
-"1px"
-"2"
-"3.1"
-"420+"
-"5CACD637-F82F-491F-947A-5DCA38AA0FEA"
-"6EB8D98F-2723-4472-88D3-5936F9D6E631"
-"7"
-"7.1"
-"9"
-":"
-"://"
-":/?#"
-";"
-"<!"
-"<%@ %@>"
-"<?"
-"<a "
-"<channel"
-"<feed"
-"<html"
-"<html>"
-"<rdf"
-"<rss"
-"<script"
-"<title>"
-">,?"
-"?"
-"@"
-"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-."
-"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+.-"
-"ARIAApplicationLog"
-"ARIAApplicationMarquee"
-"ARIAApplicationStatus"
-"ARIAApplicationTimer"
-"ARIADocument"
-"ARIADocumentArticle"
-"ARIADocumentNote"
-"ARIADocumentRegion"
-"ARIALandmarkApplication"
-"ARIALandmarkBanner"
-"ARIALandmarkComplementary"
-"ARIALandmarkContentInfo"
-"ARIALandmarkMain"
-"ARIALandmarkNavigation"
-"ARIALandmarkSearch"
-"ARIAUserInterfaceTooltip"
-"AXEnhancedUserInterface"
-"AccessibleBase"
-"AccessibleObjectFromWindow"
-"AllowsUndo"
-"Apple Web Archive pasteboard type"
-"AppleKeyboardUIMode"
-"AppleLanguages"
-"AppleTextDirection"
-"AudioElement"
-"BEGIN:VCALENDAR"
-"BEGIN:VCARD"
-"BP_CreatePluginMIMETypesPreferences"
-"CFDictionaryPropertyBag"
-"CSS"
-"Change Back to \\U201C%@\\U201D"
-"Content-Encoding"
-"Content-Length"
-"Content-Type"
-"CurrentTimeDisplay"
-"D"
-"DCMDictionaryServiceWindowShow"
-"DELEGATE METHODS"
-"DOCBASE"
-"DOMHTMLObjectElement"
-"DOMNode"
-"DYLD_FRAMEWORK_PATH"
-"DefaultDownloadDelegate"
-"DefaultPolicyDelegate"
-"DeleteBackward"
-"DeleteForward"
-"DeleteWordBackward"
-"DeleteWordForward"
-"DisableWebKitDeveloperExtras"
-"FD3B2381-0BB6-4B59-AF09-0E599C8901CF"
-"FastMallocFreeSizeInCaches"
-"FastMallocFreeSizeInHeap"
-"FastMallocHeapSize"
-"FastMallocReturnedSize"
-"FrameName"
-"FullscreenButton"
-"GEN_DOMObject"
-"GET"
-"GroupName"
-"HIDictionaryWindowShow"
-"HTTP "
-"Helvetica"
-"HostedNetscapePluginStream"
-"IDNScriptWhiteList"
-"IDNScriptWhiteList.txt"
-"IMM32.DLL"
-"If-Match"
-"If-Modified-Since"
-"If-None-Match"
-"If-Range"
-"If-Unmodified-Since"
-"ImmAssociateContextEx"
-"ImmGetCompositionStringW"
-"ImmGetContext"
-"ImmNotifyIME"
-"ImmReleaseContext"
-"ImmSetCandidateWindow"
-"ImmSetOpenStatus"
-"IncludeDebugMenu"
-"InsertBacktab"
-"InsertNewline"
-"InsertTab"
-"Intel"
-"JavaScript"
-"JavaScriptFreeSize"
-"JavaScriptHeapSize"
-"Joy!peff"
-"LTR"
-"Library/Caches"
-"Library/Internet Plug-Ins"
-"LresultFromObject"
-"MIME\\Database\\Content Type"
-"MainPageJavaScript.js"
-"MemoryStream"
-"MenuCommands"
-"Microsoft/com.microsoft.Messenger"
-"MoveDown"
-"MoveDownAndModifySelection"
-"MoveLeft"
-"MoveLeftAndModifySelection"
-"MovePageDown"
-"MovePageDownAndModifySelection"
-"MovePageUp"
-"MovePageUpAndModifySelection"
-"MoveRight"
-"MoveRightAndModifySelection"
-"MoveToBeginningOfDocument"
-"MoveToBeginningOfDocumentAndModifySelection"
-"MoveToBeginningOfLine"
-"MoveToBeginningOfLineAndModifySelection"
-"MoveToEndOfDocument"
-"MoveToEndOfDocumentAndModifySelection"
-"MoveToEndOfLine"
-"MoveToEndOfLineAndModifySelection"
-"MoveUp"
-"MoveUpAndModifySelection"
-"MoveWordLeft"
-"MoveWordLeftAndModifySelection"
-"MoveWordRight"
-"MoveWordRightAndModifySelection"
-"Mozilla/5.0 (Macintosh; U; "
-"Mozilla/5.0 (Windows; U; %s; %s) AppleWebKit/%s (KHTML, like Gecko)%s%s"
-"MuteButton"
-"NP_GetEntryPoints"
-"NP_Initialize"
-"NP_Shutdown"
-"NSAllowContinuousSpellChecking"
-"NSAllowsBaseWritingDirectionKeyBindings"
-"NSApplicationIcon"
-"NSCarbonWindow"
-"NSErrorFailingURLKey"
-"NSErrorFailingURLStringKey"
-"NSEvent"
-"NSView"
-"NeXT smart paste pasteboard type"
-"NetscapePluginInstanceProxy"
-"PDFDocument"
-"PDFPreviewView"
-"PDFView"
-"PDFViewChangedPage"
-"PDFViewDisplayModeChanged"
-"PDFViewScaleChanged"
-"PNG"
-"POST"
-"PPC"
-"PauseButton"
-"PlayButton"
-"Quartz.framework"
-"RTL"
-"Referer"
-"ReturnToRealtimeButton"
-"RewindButton"
-"SAMILang"
-"SAMIStyle"
-"Safari.exe"
-"SeekBackButton"
-"SeekForwardButton"
-"SelectAll"
-"Slider"
-"SliderThumb"
-"StatusDisplay"
-"TimeRemainingDisplay"
-"Times"
-"ToggleBold"
-"ToggleItalic"
-"U+0009"
-"U+001B"
-"UTF-8"
-"UnMuteButton"
-"UseBackForwardList"
-"User-Agent"
-"VideoElement"
-"Volumes"
-"W"
-"WEBKIT_UNSET_DYLD_FRAMEWORK_PATH"
-"WebActionButtonKey"
-"WebActionElementKey"
-"WebActionFormKey"
-"WebActionModifierFlagsKey"
-"WebActionNavigationTypeKey"
-"WebActionOriginalURLKey"
-"WebActionPropertyBag"
-"WebArchive"
-"WebAuthenticationPanel"
-"WebBackForwardList"
-"WebBackForwardList:\n"
-"WebCache"
-"WebCookieManager"
-"WebCoreStatistics"
-"WebDataRequest"
-"WebDataSource"
-"WebDatabaseDidModifyDatabaseNotification"
-"WebDatabaseDidModifyOriginNotification"
-"WebDatabaseDirectory"
-"WebDatabaseDisplayNameKey"
-"WebDatabaseExpectedSizeKey"
-"WebDatabaseIdentifierKey"
-"WebDatabaseManager"
-"WebDatabaseUsageKey"
-"WebDocumentLoader"
-"WebDownload"
-"WebDropSource"
-"WebElementDOMNode"
-"WebElementFrame"
-"WebElementImage"
-"WebElementImageAltString"
-"WebElementImageRect"
-"WebElementImageURL"
-"WebElementIsContentEditableKey"
-"WebElementIsSelected"
-"WebElementLinkIsLive"
-"WebElementLinkLabel"
-"WebElementLinkTitle"
-"WebElementLinkURL"
-"WebElementPropertyBag"
-"WebElementSpellingToolTip"
-"WebElementTargetFrame"
-"WebElementTitle"
-"WebError"
-"WebFrame"
-"WebFrameCanSuspendActiveDOMObjectsKey"
-"WebFrameHasPluginsKey"
-"WebFrameHasUnloadListenerKey"
-"WebFrameMainDocumentErrorKey"
-"WebFramePolicyListener"
-"WebFrameUsesApplicationCacheKey"
-"WebFrameUsesDatabasesKey"
-"WebFrameUsesGeolocationKey"
-"WebHTMLRepresentation"
-"WebHistory"
-"WebHistoryAllItemsRemovedNotification"
-"WebHistoryDates"
-"WebHistoryFileVersion"
-"WebHistoryItem"
-"WebHistoryItemChangedNotification"
-"WebHistoryItems"
-"WebHistoryItemsAddedNotification"
-"WebHistoryItemsDiscardedWhileLoadingNotification"
-"WebHistoryItemsRemovedNotification"
-"WebHistoryLoadedNotification"
-"WebHistorySavedNotification"
-"WebIconDatabase"
-"WebIconDatabaseDidAddIconNotification"
-"WebIconDatabaseDidRemoveAllIconsNotification"
-"WebIconDatabaseDirectoryDefaultsKey"
-"WebIconDatabaseEnabled"
-"WebIconDatabaseImportDirectoryDefaultsKey"
-"WebIconDatabaseVersion"
-"WebIconNotificationUserInfoURLKey"
-"WebInspector"
-"WebInspectorPointer"
-"WebInspectorPreferences"
-"WebInspectorWindowClass"
-"WebJavaScriptCollector"
-"WebJavaScriptTextInputPanel"
-"WebKitClassFactory"
-"WebKitDeveloperExtras"
-"WebKitErrorDomain"
-"WebKitErrorMIMETypeKey"
-"WebKitErrorPlugInNameKey"
-"WebKitErrorPlugInPageURLStringKey"
-"WebKitHistoryAgeInDaysLimit"
-"WebKitHistoryItemLimit"
-"WebKitInspectorHiddenPanels"
-"WebKitLocalCache"
-"WebKitLogLevel"
-"WebKitOmitPDFSupport"
-"WebKitOriginalBottomMargin"
-"WebKitOriginalTopMargin"
-"WebKitPDFs-XXXXXX"
-"WebKitPlugInStreamXXXXXX"
-"WebKitPluginHost.app"
-"WebKitPreferences.plist"
-"WebKitStatistics"
-"WebLoginWindowDidSwitchFromUserNotification"
-"WebLoginWindowDidSwitchToUserNotification"
-"WebMainResource"
-"WebModalDialogPretendWindow"
-"WebMutableURLRequest"
-"WebNodeHighlightPointer"
-"WebNodeHighlightWindowClass"
-"WebNotification"
-"WebNotificationCenter"
-"WebPageCacheDataSourceKey"
-"WebPageCacheDocumentViewKey"
-"WebPageCacheEntryDateKey"
-"WebPlugInAttributesKey"
-"WebPlugInBaseURLKey"
-"WebPlugInContainerKey"
-"WebPlugInContainingElementKey"
-"WebPlugInModeKey"
-"WebPlugInShouldLoadMainResourceKey"
-"WebPluginAttributes"
-"WebPluginBaseURL"
-"WebPluginContainer"
-"WebPluginDescription"
-"WebPluginExtensions"
-"WebPluginLocalizationName"
-"WebPluginMIMETypes"
-"WebPluginMIMETypesFilename"
-"WebPluginName"
-"WebPluginTypeDescription"
-"WebPluginTypeEnabled"
-"WebPluginWillPresentNativeUserInterface"
-"WebPreferences"
-"WebPreferences%d"
-"WebPreferencesChangedNotification"
-"WebPreferencesRemovedNotification"
-"WebProgressEstimateChangedNotification"
-"WebProgressFinishedNotification"
-"WebProgressStartedNotification"
-"WebResource"
-"WebResourceData"
-"WebResourceFrameName"
-"WebResourceHandler"
-"WebResourceMIMEType"
-"WebResourceResponse"
-"WebResourceTextEncodingName"
-"WebResourceURL"
-"WebScriptErrorDescription"
-"WebScriptErrorDomain"
-"WebScriptErrorLineNumber"
-"WebScriptObject"
-"WebScrollBar"
-"WebSecurityOrigin"
-"WebSiteURLToIconURLKey"
-"WebSubframeArchives"
-"WebSubresources"
-"WebTextRenderer"
-"WebURLAuthenticationChallenge"
-"WebURLAuthenticationChallengeSender"
-"WebURLCredential"
-"WebURLProtectionSpace"
-"WebURLResponse"
-"WebURLsWithTitlesPboardType"
-"WebView"
-"WebViewDidBeginEditingNotification"
-"WebViewDidChangeNotification"
-"WebViewDidChangeSelectionNotification"
-"WebViewDidChangeTypingStyleNotification"
-"WebViewDidEndEditingNotification"
-"WebViewWindowClass"
-"WebWorkersPrivate"
-"Windows %d.%d"
-"Windows 95"
-"Windows 98"
-"Windows 98; Win 9x 4.90"
-"Windows NT %d.%d"
-"XSL"
-"XXXXXX-"
-"\"@?"
-"\"\\"
-"\0"
-"\0*.*\0\0"
-"\\"
-"\\StringFileInfo\\%04x%04x\\ProductVersion"
-"\\StringFileInfo\\040904b0\\ProductVersion"
-"\\VarFileInfo\\Translation"
-"\\WebKit.resources"
-"\n        "
-"\n    "
-"\n"
-"\n--------------------------------------------\n"
-"\r"
-"\xFF\xD8\xFF\xE0"
-"_isUsingAcceleratedCompositing"
-"_top"
-"a"
-"ab"
-"about:"
-"actions"
-"anchorPoint"
-"applewebdata"
-"applewebdata://%@"
-"application.pdf"
-"application/atom+xml"
-"application/octet-stream"
-"application/pdf"
-"application/postscript"
-"application/rss+xml"
-"application/x-apple-msg-attachment"
-"application/x-java-applet"
-"application/x-webarchive"
-"application/xhtml+xml"
-"attributeKeys"
-"attributeValues"
-"b"
-"basefont"
-"bounds"
-"bundlePath"
-"c"
-"canGoBack"
-"canGoForward"
-"com.RealNetworks.RealOne Player"
-"com.adiumX.adiumX"
-"com.adobe.Acrobat"
-"com.adobe.Acrobat.Pro"
-"com.adobe.Contribute"
-"com.adobe.InCopy"
-"com.adobe.InDesign"
-"com.adobe.Installers.Setup"
-"com.adobe.Reader"
-"com.adobe.Soundbooth"
-"com.adobe.distiller"
-"com.adobe.dreamweaver-9.0"
-"com.alientechnology.Proteus"
-"com.app4mac.KidsBrowsercom.app4mac.wKiosk"
-"com.apple.Aperture"
-"com.apple.AppKit"
-"com.apple.Automator"
-"com.apple.Automator."
-"com.apple.AutomatorRunner"
-"com.apple.Dashcode"
-"com.apple.Dictionary"
-"com.apple.HIWebView"
-"com.apple.JavaAppletPlugin"
-"com.apple.JavaPluginCocoa"
-"com.apple.KeyboardUIModeDidChange"
-"com.apple.Mail"
-"com.apple.QuickTime Plugin.plugin"
-"com.apple.Safari"
-"com.apple.WebCore"
-"com.apple.WebKit"
-"com.apple.WebKit.PluginAgent"
-"com.apple.Xcode"
-"com.apple.dashboard.client"
-"com.apple.helpviewer"
-"com.apple.hiview"
-"com.apple.iChat"
-"com.apple.iWeb"
-"com.apple.installer"
-"com.apple.mail"
-"com.apple.quicktime.webplugin"
-"com.apple.universalaccess"
-"com.barebones.bbedit"
-"com.barebones.textwrangler"
-"com.barebones.yojimbo"
-"com.culturedcode.xyle"
-"com.e-frontier.shade10"
-"com.equinux.iSale4"
-"com.equinux.iSale5"
-"com.freeverse.bumpercar"
-"com.growl.growlframework"
-"com.intrarts.PandoraMan"
-"com.karelia.Sandvox"
-"com.lizardtech.NPDjVu"
-"com.macrabbit.CSSEdit"
-"com.macromates.textmate"
-"com.macromedia.Flash Player.plugin"
-"com.macromedia.fireworks"
-"com.microsoft.SilverlightPlugin"
-"com.microsoft.WMP.defaultplugin"
-"com.omnigroup.OmniWeb5"
-"com.panic.Coda"
-"com.ranchero.NetNewsWire"
-"com.realmacsoftware.rapidweaverpro"
-"com.red-sweater.marsedit"
-"com.sunrisebrowser.Sunrise"
-"com.thinkmac.NewsLife"
-"com.yahoo.messenger3"
-"contents"
-"contentsRect"
-"cp949"
-"cpuType"
-"de.codingmonkeys.SubEthaEdit"
-"dir"
-"displayTitle"
-"doctype"
-"en"
-"estimatedProgress"
-"fi.karppinen.Pyro"
-"file:"
-"frameName"
-"ftp:"
-"fullFrame"
-"groupName"
-"htm"
-"html"
-"http"
-"http:"
-"http://"
-"http://www.google.com/search?q="
-"https"
-"https:"
-"i"
-"icon.db"
-"image.pict"
-"image.png"
-"image.tiff"
-"image/jpeg"
-"image/pict"
-"image/png"
-"image/svg+xml"
-"image/tiff"
-"img"
-"info.colloquy"
-"insertText:"
-"inspectorStartsAttached"
-"isLoading"
-"isindex"
-"javascript:"
-"jpeg"
-"js"
-"kioskmode"
-"ks_c_5601-1987"
-"kungfoo.tv.ecto"
-"lastVisitWasFailure"
-"lastVisitWasHTTPNonGet"
-"lastVisitedDate"
-"line-through"
-"lineNumber"
-"localhost"
-"localized string not found"
-"localizedStrings"
-"mailto:"
-"mainFrameDocument"
-"mainFrameIcon"
-"mainFrameTitle"
-"mainFrameURL"
-"mimeType"
-"missingImage"
-"name: %@\npath: %@\nmimeTypes:\n%@\npluginDescription:%@"
-"net.hmdt-web.Shiira"
-"nullPlugin"
-"nullplugin"
-"oleacc.dll"
-"opacity"
-"org.xlife.NewsFire"
-"panEastCursor"
-"panIcon"
-"panNorthCursor"
-"panNorthEastCursor"
-"panNorthWestCursor"
-"panSouthCursor"
-"panSouthEastCursor"
-"panSouthWestCursor"
-"panWestCursor"
-"pluginHostPath"
-"pluginspage"
-"position"
-"public.url"
-"public.url-name"
-"r"
-"r+b"
-"redirectURLs"
-"rgb(%.0f,%.0f,%.0f)"
-"rgba(%.0f,%.0f,%.0f,%f)"
-"s"
-"searchCancel"
-"searchCancelPressed"
-"searchMagnifier"
-"searchMagnifierResults"
-"sourceURL"
-"src"
-"sub"
-"sublayerTransform"
-"sublayers"
-"text/calendar"
-"text/directory"
-"text/html"
-"text/ldif"
-"text/pdf"
-"text/plain"
-"text/qif"
-"text/rtf"
-"text/vcalendar"
-"text/vcard"
-"text/x-calendar"
-"text/x-csv"
-"text/x-qif"
-"text/x-vcalendar"
-"text/x-vcard"
-"text/x-vcf"
-"textAreaResizeCorner"
-"tiff"
-"transform"
-"txt"
-"u"
-"uk.co.opencommunity.vienna2"
-"userAgent"
-"userInfo"
-"utf-16"
-"verticalTextCursor"
-"visibleName"
-"visitCount"
-"webkit-fake-url"
-"webplugin"
-"x"
-"x-apple-web-kit/"
-"xml"
-"xsl"
-"zoomInCursor"
-"zoomOutCursor"
-"{A3676398-4485-4a9d-87DC-CB5A40E6351D}"
-"~/Library/Icons"
-"~/Library/WebKit/Databases"
-WebKit/mac/History/WebHistoryItem.mm:" in \"%@\""
-WebKit/mac/History/WebHistoryItem.mm:"children"
-WebKit/mac/History/WebHistoryItem.mm:"title"
-WebKit/mac/Misc/WebCache.mm:"Images"
-WebKit/mac/Misc/WebKitLogging.h:"<not running on main thread>"
-WebKit/mac/Misc/WebKitVersionChecks.m:"WebKit"
-WebKit/mac/Misc/WebNSNotificationCenterExtras.m:"name"
-WebKit/mac/Misc/WebNSNotificationCenterExtras.m:"object"
-WebKit/mac/Misc/WebNSURLExtras.mm:"file"
-WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm:" OK\n"
-WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm:": "
-WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm:"identity"
-WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm:"localization"
-WebKit/mac/Plugins/WebBaseNetscapePluginStream.mm:" OK\n"
-WebKit/mac/Plugins/WebBaseNetscapePluginStream.mm:": "
-WebKit/mac/Plugins/WebBaseNetscapePluginStream.mm:"identity"
-WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"DIRECT"
-WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"PROXY "
-WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"SOCKS "
-WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"basic"
-WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"digest"
-WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"true"
-WebKit/mac/Plugins/WebBasePluginPackage.mm:"Java Applet Plugin Enabler"
-WebKit/mac/Plugins/WebNetscapePluginPackage.mm:"RealPlayer Plugin"
-WebKit/mac/Plugins/WebNetscapePluginPackage.mm:"main"
-WebKit/mac/Plugins/WebNetscapePluginView.mm:"height"
-WebKit/mac/Plugins/WebNetscapePluginView.mm:"width"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"dialog"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"fullscreen"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"height"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"menuBarVisible"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"message"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"resizable"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"scrollbarsVisible"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"statusBarVisible"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"toolBarVisible"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"width"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"y"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"Down"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"Enter"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"Up"
-WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm:"height"
-WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm:"width"
-WebKit/mac/WebCoreSupport/WebInspectorClient.mm:"Menlo"
-WebKit/mac/WebCoreSupport/WebInspectorClient.mm:"Monaco"
-WebKit/mac/WebCoreSupport/WebInspectorClient.mm:"Web Inspector 2"
-WebKit/mac/WebCoreSupport/WebInspectorClient.mm:"inspector"
-WebKit/mac/WebView/WebHTMLView.mm:"'%@'"
-WebKit/mac/WebView/WebHTMLView.mm:"Version:"
-WebKit/mac/WebView/WebHTMLView.mm:"applet"
-WebKit/mac/WebView/WebHTMLView.mm:"baseline"
-WebKit/mac/WebView/WebHTMLView.mm:"black"
-WebKit/mac/WebView/WebHTMLView.mm:"body"
-WebKit/mac/WebView/WebHTMLView.mm:"bold"
-WebKit/mac/WebView/WebHTMLView.mm:"center"
-WebKit/mac/WebView/WebHTMLView.mm:"direction"
-WebKit/mac/WebView/WebHTMLView.mm:"font"
-WebKit/mac/WebView/WebHTMLView.mm:"head"
-WebKit/mac/WebView/WebHTMLView.mm:"italic"
-WebKit/mac/WebView/WebHTMLView.mm:"menu"
-WebKit/mac/WebView/WebHTMLView.mm:"none"
-WebKit/mac/WebView/WebHTMLView.mm:"normal"
-WebKit/mac/WebView/WebHTMLView.mm:"object"
-WebKit/mac/WebView/WebHTMLView.mm:"print"
-WebKit/mac/WebView/WebHTMLView.mm:"screen"
-WebKit/mac/WebView/WebHTMLView.mm:"strike"
-WebKit/mac/WebView/WebHTMLView.mm:"style"
-WebKit/mac/WebView/WebHTMLView.mm:"super"
-WebKit/mac/WebView/WebHTMLView.mm:"transparent"
-WebKit/mac/WebView/WebHTMLView.mm:"underline"
-WebKit/mac/WebView/WebHTMLView.mm:"white"
-WebKit/mac/WebView/WebPreferenceKeysPrivate.h
-WebKit/mac/WebView/WebPreferences.mm:"Apple Chancery"
-WebKit/mac/WebView/WebPreferences.mm:"Courier"
-WebKit/mac/WebView/WebPreferences.mm:"ISO-8859-1"
-WebKit/mac/WebView/WebPreferences.mm:"Identifier"
-WebKit/mac/WebView/WebPreferences.mm:"Papyrus"
-WebKit/mac/WebView/WebPreferences.mm:"Values"
-WebKit/mac/WebView/WebView.mm:"At least one WebView is still open."
-WebKit/mac/WebView/WebView.mm:"At least one WebView was closed with fast teardown."
-WebKit/mac/WebView/WebView.mm:"Preferences"
-WebKit/mac/WebView/WebView.mm:"Search With Google"
-WebKit/mac/WebView/WebView.mm:"control"
-WebKit/mac/WebView/WebView.mm:"data"
-WebKit/mac/WebView/WebView.mm:"decoder"
-WebKit/mac/WebView/WebView.mm:"frame"
-WebKit/mac/WebView/WebView.mm:"return "
-WebKit/win/AccessibleBase.cpp:"Alt+"
-WebKit/win/AccessibleBase.cpp:"Ctrl+"
-WebKit/win/AccessibleBase.cpp:"Description: "
-WebKit/win/AccessibleBase.cpp:"Shift+"
-WebKit/win/AccessibleBase.cpp:"Win+"
-WebKit/win/ProgIDMacros.h:"OpenSource"
-WebKit/win/ProgIDMacros.h:"WebKit."
-WebKit/win/WebCache.cpp:"images"
-WebKit/win/WebCache.cpp:"scripts"
-WebKit/win/WebCache.cpp:"style sheets"
-WebKit/win/WebCoreSupport/WebInspectorClient.cpp:"Courier New"
-WebKit/win/WebCoreSupport/WebInspectorClient.cpp:"Web Inspector "
-WebKit/win/WebCoreSupport/WebInspectorClient.cpp:"Web Inspector"
-WebKit/win/WebCoreSupport/WebInspectorClient.cpp:"inspector"
-WebKit/win/WebDatabaseManager.cpp:"Databases"
-WebKit/win/WebHistoryItem.cpp:"title"
-WebKit/win/WebPreferenceKeysPrivate.h
-WebKit/win/WebPreferences.cpp:"Arial"
-WebKit/win/WebPreferences.cpp:"Comic Sans MS"
-WebKit/win/WebPreferences.cpp:"Courier New"
-WebKit/win/WebPreferences.cpp:"Times New Roman"
-WebKit/win/WebURLResponse.cpp:"Extension"
-WebKit/win/WebView.cpp:"Cancel"
-WebKit/win/WebView.cpp:"Copy"
-WebKit/win/WebView.cpp:"Cut"
-WebKit/win/WebView.cpp:"Delete"
-WebKit/win/WebView.cpp:"Paste"
-WebKit/win/WebView.cpp:"Redo"
-WebKit/win/WebView.cpp:"Undo"
-WebKit/win/WebView.cpp:"about"
diff --git a/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig b/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig
index fabc00986e..6111faa103 100644
--- a/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig
+++ b/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig
@@ -21,8 +21,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-MAJOR_VERSION = 532;
-MINOR_VERSION = 4;
+MAJOR_VERSION = 533;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
@@ -31,7 +31,7 @@ BUNDLE_VERSION = $(BUNDLE_VERSION_$(CONFIGURATION));
 SHORT_VERSION_STRING = $(SHORT_VERSION_STRING_$(CONFIGURATION))
 
 // The system version prefix is based on the current system version.
-SYSTEM_VERSION_PREFIX = $(SYSTEM_VERSION_PREFIX_$(MAC_OS_X_VERSION_MAJOR));
+SYSTEM_VERSION_PREFIX = $(SYSTEM_VERSION_PREFIX_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 SYSTEM_VERSION_PREFIX_ = 4; // Some Tiger versions of Xcode don't set MAC_OS_X_VERSION_MAJOR.
 SYSTEM_VERSION_PREFIX_1040 = 4;
 SYSTEM_VERSION_PREFIX_1050 = 5;
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/DerivedSources.pro b/src/3rdparty/webkit/WebKit/qt/Api/DerivedSources.pro
new file mode 100644
index 0000000000..389fb5fbb1
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/Api/DerivedSources.pro
@@ -0,0 +1,107 @@
+TEMPLATE = lib
+TARGET = dummy
+
+include(headers.pri)
+
+CONFIG -= debug_and_release
+
+DESTDIR = ../../../include/QtWebKit
+
+QUOTE = ""
+DOUBLE_ESCAPED_QUOTE = ""
+ESCAPE = ""
+win32-msvc*|symbian {
+    ESCAPE = "^"
+} else:win32-g++:isEmpty(QMAKE_SH) {
+    # MinGW's make will run makefile commands using sh, even if make
+    #  was run from the Windows shell, if it finds sh in the path.
+    ESCAPE = "^"
+} else {
+    QUOTE = "\'"
+    DOUBLE_ESCAPED_QUOTE = "\\\'"
+}
+
+qtheader_module.target = $${DESTDIR}/QtWebKit
+qtheader_module.depends = $${_PRO_FILE_}
+qtheader_module.commands = echo $${QUOTE}$${LITERAL_HASH}ifndef QT_QTWEBKIT_MODULE_H$${QUOTE} > $${qtheader_module.target} &&
+qtheader_module.commands += echo $${QUOTE}$${LITERAL_HASH}define QT_QTWEBKIT_MODULE_H$${QUOTE} >> $${qtheader_module.target} &&
+qtheader_module.commands += echo $${QUOTE}$${LITERAL_HASH}include $${ESCAPE}<QtNetwork/QtNetwork$${ESCAPE}>$${QUOTE} >> $${qtheader_module.target} &&
+WEBKIT_CLASS_HEADERS = $${LITERAL_DOLLAR}$${LITERAL_DOLLAR}$${LITERAL_DOLLAR}$${LITERAL_DOLLAR}PWD/QtWebKit
+
+regex = ".*\sclass\sQWEBKIT_EXPORT\s(\w+)\s(.*)"
+
+for(HEADER, WEBKIT_API_HEADERS) {
+    # 1. Append to QtWebKit header that includes all other header files
+    # Quotes need to be escaped once more when placed in eval()
+    eval(qtheader_module.commands += echo $${DOUBLE_ESCAPED_QUOTE}\$${LITERAL_HASH}include \\\"$$basename(HEADER)\\\"$${DOUBLE_ESCAPED_QUOTE} >> $${qtheader_module.target} &&)
+
+    HEADER_NAME = $$basename(HEADER)
+    HEADER_TARGET = $$replace(HEADER_NAME, [^a-zA-Z0-9_], -)
+    HEADER_TARGET = "qtheader-$${HEADER_TARGET}"
+
+    # 2. Create forwarding header files for qwebframe.h, etc.
+    # Normally they contain absolute paths, for package builds we make the path relative so that
+    # the package sources are relocatable.
+
+    PATH_TO_HEADER = $$HEADER
+    CONFIG(standalone_package): PATH_TO_HEADER = ../../WebKit/qt/Api/$$basename(HEADER)
+
+    eval($${HEADER_TARGET}.target = $${DESTDIR}/$${HEADER_NAME})
+    eval($${HEADER_TARGET}.depends = $$HEADER)
+    eval($${HEADER_TARGET}.commands = echo $${DOUBLE_ESCAPED_QUOTE}\$${LITERAL_HASH}include \\\"$$PATH_TO_HEADER\\\"$${DOUBLE_ESCAPED_QUOTE} > $$eval($${HEADER_TARGET}.target))
+
+    QMAKE_EXTRA_TARGETS += $$HEADER_TARGET
+    qtheader_module.depends += $$eval($${HEADER_TARGET}.target)
+
+    # 3. Extract class names of exported classes from the headers and generate
+    # the class name header files
+
+    src_words = $$cat($$HEADER)
+    # Really make sure we're dealing with words
+    src_words = $$split(src_words, " ")
+
+    src = $$join(src_words, $${LITERAL_WHITESPACE})
+    for(ever) {
+        # Looking up by line is faster, so we try that first
+        res = $$find(src_words, "QWEBKIT_EXPORT")
+        isEmpty(res):break()
+
+        # Then do a slow lookup to ensure we're dealing with an exported class
+        res = $$find(src, $$regex)
+        isEmpty(res):break()
+
+        exp = $$replace(src, $$regex, "EXPORTED_CLASS = \1")
+        eval($$exp)
+
+        CLASS_TARGET = "qtheader_$${EXPORTED_CLASS}"
+
+        eval($${CLASS_TARGET}.target = $${DESTDIR}/$${EXPORTED_CLASS})
+        eval($${CLASS_TARGET}.depends = $$eval($${HEADER_TARGET}.target))
+        eval($${CLASS_TARGET}.commands = echo $${DOUBLE_ESCAPED_QUOTE}\$${LITERAL_HASH}include \\\"$$basename(HEADER)\\\"$${DOUBLE_ESCAPED_QUOTE} > $$eval($${CLASS_TARGET}.target))
+
+        QMAKE_EXTRA_TARGETS += $$CLASS_TARGET
+        WEBKIT_CLASS_HEADERS += $${LITERAL_DOLLAR}$${LITERAL_DOLLAR}$${LITERAL_DOLLAR}$${LITERAL_DOLLAR}PWD/$${EXPORTED_CLASS}
+
+        generated_files.depends += $$eval($${CLASS_TARGET}.target)
+        qtheader_pri.depends += $$eval($${CLASS_TARGET}.target)
+
+        # Qt's QRegExp does not support inline non-greedy matching,
+        # so we'll have to work around it by updating the haystack
+        src = $$replace(src, $$regex, "\2")
+        src_words = $$join(src, $${LITERAL_WHITESPACE})
+    }
+}
+
+qtheader_module.commands += echo $${QUOTE}$${LITERAL_HASH}endif // QT_QTWEBKIT_MODULE_H$${QUOTE} >> $${qtheader_module.target}
+QMAKE_EXTRA_TARGETS += qtheader_module
+
+qtheader_pri.target = $${DESTDIR}/classheaders.pri
+qtheader_pri.depends += $${_PRO_FILE_}
+qtheader_pri.commands = echo $${QUOTE}WEBKIT_CLASS_HEADERS = $${WEBKIT_CLASS_HEADERS}$${QUOTE} > $${qtheader_pri.target}
+QMAKE_EXTRA_TARGETS += qtheader_pri
+
+generated_files.depends += $${qtheader_module.target} $${qtheader_pri.target}
+QMAKE_EXTRA_TARGETS += generated_files
+
+
+
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
index 490ada1691..2878960521 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
@@ -22,27 +22,80 @@
 #include "qgraphicswebview.h"
 
 #include "qwebframe.h"
+#include "qwebframe_p.h"
 #include "qwebpage.h"
 #include "qwebpage_p.h"
 #include "QWebPageClient.h"
-#include <QtGui/QGraphicsScene>
-#include <QtGui/QGraphicsView>
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "IntRect.h"
+#include "TiledBackingStore.h"
+#include <QtCore/qmetaobject.h>
+#include <QtCore/qsharedpointer.h>
+#include <QtCore/qtimer.h>
 #include <QtGui/qapplication.h>
+#include <QtGui/qgraphicsscene.h>
 #include <QtGui/qgraphicssceneevent.h>
+#include <QtGui/qgraphicsview.h>
+#include <QtGui/qpixmapcache.h>
+#include <QtGui/qscrollbar.h>
 #include <QtGui/qstyleoption.h>
 #include <QtGui/qinputcontext.h>
 #if defined(Q_WS_X11)
 #include <QX11Info>
 #endif
+#include <Settings.h>
+
+// the overlay is here for one reason only: to have the scroll-bars and other
+// extra UI elements appear on top of any QGraphicsItems created by CSS compositing layers
+class QGraphicsWebViewOverlay : public QGraphicsItem {
+    public:
+    QGraphicsWebViewOverlay(QGraphicsWebView* view)
+            :QGraphicsItem(view)
+            , q(view)
+    {
+        setPos(0, 0);
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+        setFlag(QGraphicsItem::ItemUsesExtendedStyleOption, true);
+#endif
+        setCacheMode(QGraphicsItem::DeviceCoordinateCache);
+    }
+
+    QRectF boundingRect() const
+    {
+        return q->boundingRect();
+    }
+
+    void paint(QPainter* painter, const QStyleOptionGraphicsItem* options, QWidget*)
+    {
+        q->page()->mainFrame()->render(painter, static_cast<QWebFrame::RenderLayer>(QWebFrame::AllLayers&(~QWebFrame::ContentsLayer)), options->exposedRect.toRect());
+    }
+
+    friend class QGraphicsWebView;
+    QGraphicsWebView* q;
+};
 
 class QGraphicsWebViewPrivate : public QWebPageClient {
 public:
     QGraphicsWebViewPrivate(QGraphicsWebView* parent)
         : q(parent)
         , page(0)
-    {}
+        , resizesToContents(false)
+#if USE(ACCELERATED_COMPOSITING)
+        , rootGraphicsLayer(0)
+        , shouldSync(false)
+#endif
+    {
+#if USE(ACCELERATED_COMPOSITING)
+        // the overlay and stays alive for the lifetime of
+        // this QGraphicsWebView as the scrollbars are needed when there's no compositing
+        q->setFlag(QGraphicsItem::ItemUsesExtendedStyleOption);
+        syncMetaMethod = q->metaObject()->method(q->metaObject()->indexOfMethod("syncLayers()"));
+#endif
+    }
 
     virtual ~QGraphicsWebViewPrivate();
+
     virtual void scroll(int dx, int dy, const QRect&);
     virtual void update(const QRect& dirtyRect);
     virtual void setInputMethodEnabled(bool enable);
@@ -59,20 +112,135 @@ public:
     virtual QPalette palette() const;
     virtual int screenNumber() const;
     virtual QWidget* ownerWidget() const;
+    virtual QRect geometryRelativeToOwnerWidget() const;
 
     virtual QObject* pluginParent() const;
 
+    virtual QStyle* style() const;
+
+#if USE(ACCELERATED_COMPOSITING)
+    virtual void setRootGraphicsLayer(QGraphicsItem* layer);
+    virtual void markForSync(bool scheduleSync);
+    void updateCompositingScrollPosition();
+#endif
+
+    void updateResizesToContentsForPage();
+    QRectF graphicsItemVisibleRect() const;
+#if ENABLE(TILED_BACKING_STORE)
+    void updateTiledBackingStoreScale();
+#endif
+
+    void createOrDeleteOverlay();
+
+    void syncLayers();
+
+    void unsetPageIfExists();
+
     void _q_doLoadFinished(bool success);
+    void _q_contentsSizeChanged(const QSize&);
+    void _q_scaleChanged();
 
     void _q_updateMicroFocus();
     void _q_pageDestroyed();
 
     QGraphicsWebView* q;
     QWebPage* page;
+
+    bool resizesToContents;
+
+    // the overlay gets instantiated when the root layer is attached, and get deleted when it's detached
+    QSharedPointer<QGraphicsWebViewOverlay> overlay;
+
+    // we need to put the root graphics layer behind the overlay (which contains the scrollbar)
+    enum { RootGraphicsLayerZValue, OverlayZValue };
+
+#if USE(ACCELERATED_COMPOSITING)
+    QGraphicsItem* rootGraphicsLayer;
+    // we need to sync the layers if we get a special call from the WebCore
+    // compositor telling us to do so. We'll get that call from ChromeClientQt
+    bool shouldSync;
+
+    // we have to flush quite often, so we use a meta-method instead of QTimer::singleShot for putting the event in the queue
+    QMetaMethod syncMetaMethod;
+#endif
 };
 
 QGraphicsWebViewPrivate::~QGraphicsWebViewPrivate()
 {
+#if USE(ACCELERATED_COMPOSITING)
+    if (rootGraphicsLayer) {
+        // we don't need to delete the root graphics layer
+        // The lifecycle is managed in GraphicsLayerQt.cpp
+        rootGraphicsLayer->setParentItem(0);
+        q->scene()->removeItem(rootGraphicsLayer);
+    }
+#endif
+}
+
+void QGraphicsWebViewPrivate::createOrDeleteOverlay()
+{
+    bool useOverlay = false;
+    if (!resizesToContents) {
+#if USE(ACCELERATED_COMPOSITING)
+        useOverlay = useOverlay || rootGraphicsLayer;
+#endif
+#if ENABLE(TILED_BACKING_STORE)
+        useOverlay = useOverlay || QWebFramePrivate::core(q->page()->mainFrame())->tiledBackingStore();
+#endif
+    }
+    if (useOverlay == !!overlay)
+        return;
+    if (useOverlay) {
+        overlay = QSharedPointer<QGraphicsWebViewOverlay>(new QGraphicsWebViewOverlay(q));
+        overlay->setZValue(OverlayZValue);
+    } else
+        overlay.clear();
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+void QGraphicsWebViewPrivate::setRootGraphicsLayer(QGraphicsItem* layer)
+{
+    if (rootGraphicsLayer) {
+        rootGraphicsLayer->setParentItem(0);
+        q->scene()->removeItem(rootGraphicsLayer);
+        QWebFramePrivate::core(q->page()->mainFrame())->view()->syncCompositingStateRecursive();
+    }
+
+    rootGraphicsLayer = layer;
+
+    if (layer) {
+        layer->setFlag(QGraphicsItem::ItemClipsChildrenToShape, true);
+        layer->setParentItem(q);
+        layer->setZValue(RootGraphicsLayerZValue);
+        updateCompositingScrollPosition();
+    }
+    createOrDeleteOverlay();
+}
+
+void QGraphicsWebViewPrivate::markForSync(bool scheduleSync)
+{
+    shouldSync = true;
+    if (scheduleSync)
+        syncMetaMethod.invoke(q, Qt::QueuedConnection);
+}
+
+void QGraphicsWebViewPrivate::updateCompositingScrollPosition()
+{
+    if (rootGraphicsLayer && q->page() && q->page()->mainFrame()) {
+        const QPoint scrollPosition = q->page()->mainFrame()->scrollPosition();
+        rootGraphicsLayer->setPos(-scrollPosition);
+    }
+}
+#endif
+
+void QGraphicsWebViewPrivate::syncLayers()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (shouldSync) {
+        QWebFramePrivate::core(q->page()->mainFrame())->view()->syncCompositingStateRecursive();
+        shouldSync = false;
+    }
+#endif
 }
 
 void QGraphicsWebViewPrivate::_q_doLoadFinished(bool success)
@@ -107,11 +275,22 @@ void QGraphicsWebViewPrivate::_q_pageDestroyed()
 void QGraphicsWebViewPrivate::scroll(int dx, int dy, const QRect& rectToScroll)
 {
     q->scroll(qreal(dx), qreal(dy), QRectF(rectToScroll));
+
+#if USE(ACCELERATED_COMPOSITING)
+    updateCompositingScrollPosition();
+#endif
 }
 
 void QGraphicsWebViewPrivate::update(const QRect & dirtyRect)
 {
     q->update(QRectF(dirtyRect));
+
+    createOrDeleteOverlay();
+    if (overlay)
+        overlay->update(QRectF(dirtyRect));
+#if USE(ACCELERATED_COMPOSITING)
+    syncLayers();
+#endif
 }
 
 
@@ -160,10 +339,12 @@ QPalette QGraphicsWebViewPrivate::palette() const
 int QGraphicsWebViewPrivate::screenNumber() const
 {
 #if defined(Q_WS_X11)
-    const QList<QGraphicsView*> views = q->scene()->views();
+    if (QGraphicsScene* scene = q->scene()) {
+        const QList<QGraphicsView*> views = scene->views();
 
-    if (!views.isEmpty())
-        return views.at(0)->x11Info().screen();
+        if (!views.isEmpty())
+            return views.at(0)->x11Info().screen();
+    }
 #endif
 
     return 0;
@@ -171,8 +352,24 @@ int QGraphicsWebViewPrivate::screenNumber() const
 
 QWidget* QGraphicsWebViewPrivate::ownerWidget() const
 {
-    const QList<QGraphicsView*> views = q->scene()->views();
-    return views.value(0);
+    if (QGraphicsScene* scene = q->scene()) {
+        const QList<QGraphicsView*> views = scene->views();
+        return views.value(0);
+    }
+    return 0;
+}
+
+QRect QGraphicsWebViewPrivate::geometryRelativeToOwnerWidget() const
+{
+    if (!q->scene())
+        return QRect();
+
+    QList<QGraphicsView*> views = q->scene()->views();
+    if (views.isEmpty())
+        return QRect();
+
+    QGraphicsView* view = views.at(0);
+    return view->mapFromScene(q->boundingRect()).boundingRect();
 }
 
 QObject* QGraphicsWebViewPrivate::pluginParent() const
@@ -180,6 +377,74 @@ QObject* QGraphicsWebViewPrivate::pluginParent() const
     return q;
 }
 
+QStyle* QGraphicsWebViewPrivate::style() const
+{
+    return q->style();
+}
+
+void QGraphicsWebViewPrivate::updateResizesToContentsForPage()
+{
+    ASSERT(page);
+
+    if (resizesToContents) {
+        // resizes to contents mode requires preferred contents size to be set
+        if (!page->preferredContentsSize().isValid())
+            page->setPreferredContentsSize(QSize(960, 800));
+
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+        QObject::connect(page->mainFrame(), SIGNAL(contentsSizeChanged(QSize)),
+            q, SLOT(_q_contentsSizeChanged(const QSize&)), Qt::UniqueConnection);
+#else
+        QObject::connect(page->mainFrame(), SIGNAL(contentsSizeChanged(QSize)),
+            q, SLOT(_q_contentsSizeChanged(const QSize&)));
+#endif
+    } else {
+        QObject::disconnect(page->mainFrame(), SIGNAL(contentsSizeChanged(QSize)),
+                         q, SLOT(_q_contentsSizeChanged(const QSize&)));
+    }
+}
+
+void QGraphicsWebViewPrivate::_q_contentsSizeChanged(const QSize& size)
+{
+    if (!resizesToContents)
+        return;
+    q->setGeometry(QRectF(q->geometry().topLeft(), size));
+}
+
+void QGraphicsWebViewPrivate::_q_scaleChanged()
+{
+#if ENABLE(TILED_BACKING_STORE)
+    updateTiledBackingStoreScale();
+#endif
+}
+
+QRectF QGraphicsWebViewPrivate::graphicsItemVisibleRect() const
+{
+    if (!q->scene())
+        return QRectF();
+    QList<QGraphicsView*> views = q->scene()->views();
+    if (views.size() > 1) {
+        qDebug() << "QGraphicsWebView is in more than one graphics views, unable to compute the visible rect";
+        return QRectF();
+    }
+    if (views.size() < 1)
+        return QRectF();
+
+    int xPosition = views[0]->horizontalScrollBar()->value();
+    int yPosition = views[0]->verticalScrollBar()->value();
+    return q->mapRectFromScene(QRectF(QPoint(xPosition, yPosition), views[0]->viewport()->size()));
+}
+
+#if ENABLE(TILED_BACKING_STORE)
+void QGraphicsWebViewPrivate::updateTiledBackingStoreScale()
+{
+    WebCore::TiledBackingStore* backingStore = QWebFramePrivate::core(page->mainFrame())->tiledBackingStore();
+    if (!backingStore)
+        return;
+    backingStore->setContentsScale(q->scale());
+}
+#endif
+
 /*!
     \class QGraphicsWebView
     \brief The QGraphicsWebView class allows Web content to be added to a GraphicsView.
@@ -266,8 +531,16 @@ QGraphicsWebView::QGraphicsWebView(QGraphicsItem* parent)
 #if QT_VERSION >= 0x040600
     setFlag(QGraphicsItem::ItemUsesExtendedStyleOption, true);
 #endif
+    setAcceptDrops(true);
     setAcceptHoverEvents(true);
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    setAcceptTouchEvents(true);
+#endif
     setFocusPolicy(Qt::StrongFocus);
+    setFlag(QGraphicsItem::ItemClipsChildrenToShape, true);
+#if ENABLE(TILED_BACKING_STORE)
+    QObject::connect(this, SIGNAL(scaleChanged()), this, SLOT(_q_scaleChanged()));
+#endif
 }
 
 /*!
@@ -317,7 +590,26 @@ QWebPage* QGraphicsWebView::page() const
 */
 void QGraphicsWebView::paint(QPainter* painter, const QStyleOptionGraphicsItem* option, QWidget*)
 {
-    page()->mainFrame()->render(painter, option->exposedRect.toRect());
+#if ENABLE(TILED_BACKING_STORE)
+    if (WebCore::TiledBackingStore* backingStore = QWebFramePrivate::core(page()->mainFrame())->tiledBackingStore()) {
+        // FIXME: We should set the backing store viewport earlier than in paint
+        if (d->resizesToContents)
+            backingStore->viewportChanged(WebCore::IntRect(d->graphicsItemVisibleRect()));
+        else {
+            QRectF visibleRect(d->page->mainFrame()->scrollPosition(), d->page->mainFrame()->geometry().size());
+            backingStore->viewportChanged(WebCore::IntRect(visibleRect));
+        }
+        // QWebFrame::render is a public API, bypass it for tiled rendering so behavior does not need to change.
+        WebCore::GraphicsContext context(painter); 
+        page()->mainFrame()->d->renderFromTiledBackingStore(&context, option->exposedRect.toAlignedRect());
+        return;
+    } 
+#endif
+#if USE(ACCELERATED_COMPOSITING)
+    page()->mainFrame()->render(painter, d->overlay ? QWebFrame::ContentsLayer : QWebFrame::AllLayers, option->exposedRect.toAlignedRect());
+#else
+    page()->mainFrame()->render(painter, QWebFrame::AllLayers, option->exposedRect.toRect());
+#endif
 }
 
 /*! \reimp
@@ -325,6 +617,17 @@ void QGraphicsWebView::paint(QPainter* painter, const QStyleOptionGraphicsItem*
 bool QGraphicsWebView::sceneEvent(QEvent* event)
 {
     // Re-implemented in order to allows fixing event-related bugs in patch releases.
+
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    if (d->page && (event->type() == QEvent::TouchBegin
+                || event->type() == QEvent::TouchEnd
+                || event->type() == QEvent::TouchUpdate)) {
+        d->page->event(event);
+        if (event->isAccepted())
+            return true;
+    }
+#endif
+
     return QGraphicsWidget::sceneEvent(event);
 }
 
@@ -391,7 +694,6 @@ bool QGraphicsWebView::event(QEvent* event)
 #endif // QT_NO_CONTEXTMENU
         {
 #ifndef QT_NO_CURSOR
-#if QT_VERSION >= 0x040400
             if (event->type() == QEvent::CursorChange) {
                 // An unsetCursor will set the cursor to Qt::ArrowCursor.
                 // Thus this cursor change might be a QWidget::unsetCursor()
@@ -405,12 +707,34 @@ bool QGraphicsWebView::event(QEvent* event)
                     d->resetCursor();
             }
 #endif
-#endif
         }
     }
     return QGraphicsWidget::event(event);
 }
 
+void QGraphicsWebViewPrivate::unsetPageIfExists()
+{
+    if (!page)
+        return;
+
+    // if the page client is the special client constructed for
+    // delegating the responsibilities to a QWidget, we need
+    // to destroy it.
+
+    if (page->d->client && page->d->client->isQWidgetClient())
+        delete page->d->client;
+
+    page->d->client = 0;
+
+    // if the page was created by us, we own it and need to
+    // destroy it as well.
+
+    if (page->parent() == q)
+        delete page;
+    else
+        page->disconnect(q);
+}
+
 /*!
     Makes \a page the new web page of the web graphicsitem.
 
@@ -425,22 +749,23 @@ void QGraphicsWebView::setPage(QWebPage* page)
     if (d->page == page)
         return;
 
-    if (d->page) {
-        d->page->d->client = 0; // unset the page client
-        if (d->page->parent() == this)
-            delete d->page;
-        else
-            d->page->disconnect(this);
-    }
-
+    d->unsetPageIfExists();
     d->page = page;
+
     if (!d->page)
         return;
+
     d->page->d->client = d; // set the page client
 
+    if (d->overlay)
+        d->overlay->prepareGeometryChange();
+
     QSize size = geometry().size().toSize();
     page->setViewportSize(size);
 
+    if (d->resizesToContents)
+        d->updateResizesToContentsForPage();
+
     QWebFrame* mainFrame = d->page->mainFrame();
 
     connect(mainFrame, SIGNAL(titleChanged(QString)),
@@ -523,7 +848,6 @@ QIcon QGraphicsWebView::icon() const
 
 /*!
     \property QGraphicsWebView::zoomFactor
-    \since 4.5
     \brief the zoom factor for the view
 */
 
@@ -544,6 +868,9 @@ qreal QGraphicsWebView::zoomFactor() const
 */
 void QGraphicsWebView::updateGeometry()
 {
+    if (d->overlay)
+        d->overlay->prepareGeometryChange();
+
     QGraphicsWidget::updateGeometry();
 
     if (!d->page)
@@ -559,6 +886,9 @@ void QGraphicsWebView::setGeometry(const QRectF& rect)
 {
     QGraphicsWidget::setGeometry(rect);
 
+    if (d->overlay)
+        d->overlay->prepareGeometryChange();
+
     if (!d->page)
         return;
 
@@ -766,6 +1096,77 @@ bool QGraphicsWebView::findText(const QString &subString, QWebPage::FindFlags op
     return false;
 }
 
+/*!
+    \property QGraphicsWebView::resizesToContents
+    \brief whether the size of the QGraphicsWebView and its viewport changes to match the contents size
+    \since 4.7 
+
+    If this property is set, the QGraphicsWebView will automatically change its
+    size to match the size of the main frame contents. As a result the top level frame
+    will never have scrollbars. It will also make CSS fixed positioning to behave like absolute positioning
+    with elements positioned relative to the document instead of the viewport.
+
+    This property should be used in conjunction with the QWebPage::preferredContentsSize property.
+    If not explicitly set, the preferredContentsSize is automatically set to a reasonable value.
+
+    \sa QWebPage::setPreferredContentsSize()
+*/
+void QGraphicsWebView::setResizesToContents(bool enabled)
+{
+    if (d->resizesToContents == enabled)
+        return;
+    d->resizesToContents = enabled;
+    if (d->page)
+        d->updateResizesToContentsForPage();
+}
+
+bool QGraphicsWebView::resizesToContents() const
+{
+    return d->resizesToContents;
+}
+
+/*!
+    \property QGraphicsWebView::tiledBackingStoreFrozen
+    \brief whether the tiled backing store updates its contents
+    \since 4.7 
+
+    If the tiled backing store is enabled using QWebSettings::TiledBackingStoreEnabled attribute, this property
+    can be used to disable backing store updates temporarily. This can be useful for example for running
+    a smooth animation that changes the scale of the QGraphicsWebView.
+ 
+    When the backing store is unfrozen, its contents will be automatically updated to match the current
+    state of the document. If the QGraphicsWebView scale was changed, the backing store is also
+    re-rendered using the new scale.
+ 
+    If the tiled backing store is not enabled, this property does nothing.
+
+    \sa QWebSettings::TiledBackingStoreEnabled
+    \sa QGraphicsObject::scale
+*/
+bool QGraphicsWebView::isTiledBackingStoreFrozen() const
+{
+#if ENABLE(TILED_BACKING_STORE)
+    WebCore::TiledBackingStore* backingStore = QWebFramePrivate::core(page()->mainFrame())->tiledBackingStore();
+    if (!backingStore)
+        return false;
+    return backingStore->contentsFrozen();
+#else
+    return false;
+#endif
+}
+
+void QGraphicsWebView::setTiledBackingStoreFrozen(bool frozen)
+{
+#if ENABLE(TILED_BACKING_STORE)
+    WebCore::TiledBackingStore* backingStore = QWebFramePrivate::core(page()->mainFrame())->tiledBackingStore();
+    if (!backingStore)
+        return;
+    backingStore->setContentsFrozen(frozen);
+#else
+    UNUSED_PARAM(frozen);
+#endif
+}
+
 /*! \reimp
 */
 void QGraphicsWebView::hoverMoveEvent(QGraphicsSceneHoverEvent* ev)
@@ -903,10 +1304,8 @@ bool QGraphicsWebView::focusNextPrevChild(bool next)
 void QGraphicsWebView::dragEnterEvent(QGraphicsSceneDragDropEvent* ev)
 {
 #ifndef QT_NO_DRAGANDDROP
-    //if (d->page)
-    //    d->page->event(ev);
-    //Just remove this line below when the code above is working
-    Q_UNUSED(ev);
+    if (d->page)
+        d->page->event(ev);
 #else
     Q_UNUSED(ev);
 #endif
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
index 1b02f35698..88729d31e4 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
@@ -45,6 +45,8 @@ class QWEBKIT_EXPORT QGraphicsWebView : public QGraphicsWidget {
     Q_PROPERTY(QUrl url READ url WRITE setUrl NOTIFY urlChanged)
 
     Q_PROPERTY(bool modified READ isModified)
+    Q_PROPERTY(bool resizesToContents READ resizesToContents WRITE setResizesToContents)
+    Q_PROPERTY(bool tiledBackingStoreFrozen READ isTiledBackingStoreFrozen WRITE setTiledBackingStoreFrozen)
 
 public:
     explicit QGraphicsWebView(QGraphicsItem* parent = 0);
@@ -79,6 +81,12 @@ public:
 
     bool findText(const QString& subString, QWebPage::FindFlags options = 0);
 
+    bool resizesToContents() const;
+    void setResizesToContents(bool enabled);
+    
+    bool isTiledBackingStoreFrozen() const;
+    void setTiledBackingStoreFrozen(bool frozen);
+
     virtual void setGeometry(const QRectF& rect);
     virtual void updateGeometry();
     virtual void paint(QPainter*, const QStyleOptionGraphicsItem* options, QWidget* widget = 0);
@@ -136,6 +144,11 @@ private:
     Q_PRIVATE_SLOT(d, void _q_doLoadFinished(bool success))
     Q_PRIVATE_SLOT(d, void _q_updateMicroFocus())
     Q_PRIVATE_SLOT(d, void _q_pageDestroyed())
+    // we don't want to change the moc based on USE() macro, so this function is here
+    // but will be empty if ACCLERATED_COMPOSITING is disabled
+    Q_PRIVATE_SLOT(d, void syncLayers())
+    Q_PRIVATE_SLOT(d, void _q_contentsSizeChanged(const QSize&))
+    Q_PRIVATE_SLOT(d, void _q_scaleChanged())
 
     QGraphicsWebViewPrivate* const d;
     friend class QGraphicsWebViewPrivate;
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
index 441bec7526..955206d1ac 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
@@ -38,7 +38,6 @@
 #include "NodeList.h"
 #include "PropertyNameArray.h"
 #include "RenderImage.h"
-#include "ScriptFunctionCall.h"
 #include "StaticNodeList.h"
 #include "qt_runtime.h"
 #include "qwebframe.h"
@@ -865,25 +864,7 @@ QStringList QWebElement::classes() const
         return QStringList();
 
     QStringList classes =  attribute(QLatin1String("class")).simplified().split(QLatin1Char(' '), QString::SkipEmptyParts);
-#if QT_VERSION >= 0x040500
     classes.removeDuplicates();
-#else
-    int n = classes.size();
-    int j = 0;
-    QSet<QString> seen;
-    seen.reserve(n);
-    for (int i = 0; i < n; ++i) {
-        const QString& s = classes.at(i);
-        if (seen.contains(s))
-            continue;
-        seen.insert(s);
-        if (j != i)
-            classes[j] = s;
-        ++j;
-    }
-    if (n != j)
-        classes.erase(classes.begin() + j, classes.end());
-#endif
     return classes;
 }
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
index 13c341cd42..a87d388d85 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
@@ -32,6 +32,12 @@ namespace WebCore {
     class Node;
 }
 
+namespace JSC {
+namespace Bindings {
+    class QtWebElementRuntime;
+}
+}
+
 QT_BEGIN_NAMESPACE
 class QPainter;
 QT_END_NAMESPACE
@@ -153,6 +159,7 @@ private:
     friend class QWebHitTestResult;
     friend class QWebHitTestResultPrivate;
     friend class QWebPage;
+    friend class JSC::Bindings::QtWebElementRuntime;
 
     QWebElementPrivate* d;
     WebCore::Element* m_element;
@@ -255,4 +262,6 @@ private:
     QExplicitlySharedDataPointer<QWebElementCollectionPrivate> d;
 };
 
+Q_DECLARE_METATYPE(QWebElement)
+
 #endif // QWEBELEMENT_H
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
index 710e11b6c2..06c82baef4 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "qwebframe.h"
 
+#include "Bridge.h"
 #include "CallFrame.h"
 #include "Document.h"
 #include "DocumentLoader.h"
@@ -56,6 +57,8 @@
 #include "Scrollbar.h"
 #include "SelectionController.h"
 #include "SubstituteData.h"
+#include "SVGSMILElement.h"
+#include "TiledBackingStore.h"
 #include "htmlediting.h"
 #include "markup.h"
 #include "qt_instance.h"
@@ -66,7 +69,6 @@
 #include "qwebpage_p.h"
 #include "qwebsecurityorigin.h"
 #include "qwebsecurityorigin_p.h"
-#include "runtime.h"
 #include "runtime_object.h"
 #include "runtime_root.h"
 #include "wtf/HashMap.h"
@@ -77,14 +79,7 @@
 #include <qpainter.h>
 #include <qprinter.h>
 #include <qregion.h>
-
-#if QT_VERSION < 0x040400
-#include "qwebnetworkinterface.h"
-#endif
-
-#if QT_VERSION >= 0x040400
 #include <qnetworkrequest.h>
-#endif
 
 using namespace WebCore;
 
@@ -93,6 +88,20 @@ QT_BEGIN_NAMESPACE
 extern Q_GUI_EXPORT int qt_defaultDpi();
 QT_END_NAMESPACE
 
+void QWEBKIT_EXPORT qt_drt_setMediaType(QWebFrame* qframe, const QString& type)
+{
+    WebCore::Frame* frame = QWebFramePrivate::core(qframe);
+    WebCore::FrameView* view = frame->view();
+    view->setMediaType(type);
+    frame->document()->updateStyleSelector();
+    view->forceLayout();
+}
+
+bool QWEBKIT_EXPORT qt_drt_hasDocumentElement(QWebFrame* qframe)
+{
+    return QWebFramePrivate::core(qframe)->document()->documentElement();
+}
+
 void QWEBKIT_EXPORT qt_drt_setJavaScriptProfilingEnabled(QWebFrame* qframe, bool enabled)
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -150,6 +159,31 @@ bool QWEBKIT_EXPORT qt_drt_pauseTransitionOfProperty(QWebFrame *qframe, const QS
     return controller->pauseTransitionAtTime(coreNode->renderer(), propertyName, time);
 }
 
+// Pause a given SVG animation on the target node at a specific time.
+// This method is only intended to be used for testing the SVG animation system.
+bool QWEBKIT_EXPORT qt_drt_pauseSVGAnimation(QWebFrame *qframe, const QString &animationId, double time, const QString &elementId)
+{
+#if !ENABLE(SVG)
+    return false;
+#else
+    Frame* frame = QWebFramePrivate::core(qframe);
+    if (!frame)
+        return false;
+
+    Document* doc = frame->document();
+    Q_ASSERT(doc);
+
+    if (!doc->svgExtensions())
+        return false;
+
+    Node* coreNode = doc->getElementById(animationId);
+    if (!coreNode || !SVGSMILElement::isSMILElement(coreNode))
+        return false;
+
+    return doc->accessSVGExtensions()->sampleAnimationAtTime(elementId, static_cast<SVGSMILElement*>(coreNode), time);
+#endif
+}
+
 // Returns the total number of currently running animations (includes both CSS transitions and CSS animations).
 int QWEBKIT_EXPORT qt_drt_numberOfActiveAnimations(QWebFrame *qframe)
 {
@@ -196,6 +230,28 @@ QString QWEBKIT_EXPORT qt_drt_counterValueForElementById(QWebFrame* qFrame, cons
     return QString();
 }
 
+int QWEBKIT_EXPORT qt_drt_pageNumberForElementById(QWebFrame* qFrame, const QString& id, float width, float height)
+{
+    Frame* frame = QWebFramePrivate::core(qFrame);
+    if (!frame)
+        return -1;
+
+    Element* element = frame->document()->getElementById(AtomicString(id));
+    if (!element)
+        return -1;
+
+    return PrintContext::pageNumberForElement(element, FloatSize(width, height));
+}
+
+int QWEBKIT_EXPORT qt_drt_numberOfPages(QWebFrame* qFrame, float width, float height)
+{
+    Frame* frame = QWebFramePrivate::core(qFrame);
+    if (!frame)
+        return -1;
+
+    return PrintContext::numberOfPages(frame, FloatSize(width, height));
+}
+
 // Suspend active DOM objects in this frame.
 void QWEBKIT_EXPORT qt_suspendActiveDOMObjects(QWebFrame* qFrame)
 {
@@ -212,6 +268,93 @@ void QWEBKIT_EXPORT qt_resumeActiveDOMObjects(QWebFrame* qFrame)
         frame->document()->resumeActiveDOMObjects();
 }                        
 
+void QWEBKIT_EXPORT qt_drt_evaluateScriptInIsolatedWorld(QWebFrame* qFrame, int worldId, const QString& script)
+{
+    Frame* frame = QWebFramePrivate::core(qFrame);
+    if (frame)
+        JSC::JSValue result = frame->script()->executeScriptInWorld(mainThreadNormalWorld(), script, true).jsValue();
+}
+
+static bool webframe_scrollOverflow(WebCore::Frame* frame, int dx, int dy, const QPoint& pos)
+{
+    if (!frame || !frame->document() || !frame->eventHandler())
+        return false;
+
+    Node* node = frame->document()->elementFromPoint(pos.x(), pos.y());
+    if (!node)
+        return false;
+
+    RenderObject* renderer = node->renderer();
+    if (!renderer)
+        return false;
+
+    if (renderer->isListBox())
+        return false;
+
+    RenderLayer* renderLayer = renderer->enclosingLayer();
+    if (!renderLayer)
+        return false;
+
+    bool scrolledHorizontal = false;
+    bool scrolledVertical = false;
+
+    if (dx > 0)
+        scrolledHorizontal = renderLayer->scroll(ScrollRight, ScrollByPixel, dx);
+    else if (dx < 0)
+        scrolledHorizontal = renderLayer->scroll(ScrollLeft, ScrollByPixel, qAbs(dx));
+
+    if (dy > 0)
+        scrolledVertical = renderLayer->scroll(ScrollDown, ScrollByPixel, dy);
+    else if (dy < 0)
+        scrolledVertical = renderLayer->scroll(ScrollUp, ScrollByPixel, qAbs(dy));
+
+    return (scrolledHorizontal || scrolledVertical);
+}
+
+
+/*!
+  \internal
+  Scrolls nested frames starting at this frame, \a dx pixels to the right 
+  and \a dy pixels downward. Both \a dx and \a dy may be negative. First attempts
+  to scroll elements with CSS overflow at position pos, followed by this frame. If this 
+  frame doesn't scroll, attempts to scroll the parent
+*/
+void QWEBKIT_EXPORT qtwebkit_webframe_scrollRecursively(QWebFrame* qFrame, int dx, int dy, const QPoint& pos)
+{
+    Frame* frame = QWebFramePrivate::core(qFrame);
+
+    if (!frame || !frame->view())
+        return;
+    
+    if (!webframe_scrollOverflow(frame, dx, dy, pos)) {
+        do {
+            bool scrolledHorizontal = false;
+            bool scrolledVertical = false;
+            
+            IntSize scrollOffset = frame->view()->scrollOffset();
+            IntPoint maxScrollOffset = frame->view()->maximumScrollPosition();
+
+            if (dx > 0) // scroll right
+                scrolledHorizontal = scrollOffset.width() < maxScrollOffset.x();
+            else if (dx < 0) // scroll left
+                scrolledHorizontal = scrollOffset.width() > 0;
+
+            if (dy > 0) // scroll down
+                scrolledVertical = scrollOffset.height() < maxScrollOffset.y();
+            else if (dy < 0) //scroll up
+                scrolledVertical = scrollOffset.height() > 0;
+
+            if (scrolledHorizontal || scrolledVertical) {
+                frame->view()->scrollBy(IntSize(dx, dy));
+                return;
+            }
+            
+            frame = frame->tree()->parent(); 
+        } while (frame && frame->view());
+    }
+}
+
+
 QWebFrameData::QWebFrameData(WebCore::Page* parentPage, WebCore::Frame* parentFrame,
                              WebCore::HTMLFrameOwnerElement* ownerFrameElement,
                              const WebCore::String& frameName)
@@ -245,6 +388,21 @@ void QWebFramePrivate::init(QWebFrame *qframe, QWebFrameData *frameData)
     frame->init();
 }
 
+void QWebFramePrivate::setPage(QWebPage* newPage)
+{
+    if (page == newPage)
+        return;
+
+    // The QWebFrame is created as a child of QWebPage or a parent QWebFrame.
+    // That adds it to QObject's internal children list and ensures it will be
+    // deleted when parent QWebPage is deleted. Reparent if needed.
+    if (q->parent() == qobject_cast<QObject*>(page))
+        q->setParent(newPage);
+
+    page = newPage;
+    emit q->pageChanged();
+}
+
 WebCore::Scrollbar* QWebFramePrivate::horizontalScrollBar() const
 {
     if (!frame->view())
@@ -259,8 +417,11 @@ WebCore::Scrollbar* QWebFramePrivate::verticalScrollBar() const
     return frame->view()->verticalScrollbar();
 }
 
-void QWebFramePrivate::renderPrivate(QPainter *painter, QWebFrame::RenderLayer layer, const QRegion &clip)
+#if ENABLE(TILED_BACKING_STORE)
+void QWebFramePrivate::renderFromTiledBackingStore(GraphicsContext* context, const QRegion& clip)
 {
+    ASSERT(frame->tiledBackingStore());
+
     if (!frame->view() || !frame->contentRenderer())
         return;
 
@@ -268,15 +429,46 @@ void QWebFramePrivate::renderPrivate(QPainter *painter, QWebFrame::RenderLayer l
     if (vector.isEmpty())
         return;
 
-    GraphicsContext context(painter);
-    if (context.paintingDisabled() && !context.updatingControlTints())
+    QPainter* painter = context->platformContext();
+
+    WebCore::FrameView* view = frame->view();
+    
+    int scrollX = view->scrollX();
+    int scrollY = view->scrollY();
+    context->translate(-scrollX, -scrollY);
+
+    for (int i = 0; i < vector.size(); ++i) {
+        const QRect& clipRect = vector.at(i);
+
+        painter->save();
+        
+        QRect rect = clipRect.translated(scrollX, scrollY);
+        painter->setClipRect(rect, Qt::IntersectClip);
+
+        frame->tiledBackingStore()->paint(context, rect);
+
+        painter->restore();
+    }
+}
+#endif
+
+void QWebFramePrivate::renderRelativeCoords(GraphicsContext* context, QWebFrame::RenderLayer layer, const QRegion& clip)
+{
+    if (!frame->view() || !frame->contentRenderer())
+        return;
+
+    QVector<QRect> vector = clip.rects();
+    if (vector.isEmpty())
         return;
 
+    QPainter* painter = context->platformContext();
+
     WebCore::FrameView* view = frame->view();
     view->layoutIfNeededRecursive();
 
     for (int i = 0; i < vector.size(); ++i) {
         const QRect& clipRect = vector.at(i);
+
         QRect intersectedRect = clipRect.intersected(view->frameRect());
 
         painter->save();
@@ -286,84 +478,46 @@ void QWebFramePrivate::renderPrivate(QPainter *painter, QWebFrame::RenderLayer l
         int y = view->y();
 
         if (layer & QWebFrame::ContentsLayer) {
-            context.save();
+            context->save();
 
             int scrollX = view->scrollX();
             int scrollY = view->scrollY();
 
             QRect rect = intersectedRect;
-            context.translate(x, y);
+            context->translate(x, y);
             rect.translate(-x, -y);
-            context.translate(-scrollX, -scrollY);
+            context->translate(-scrollX, -scrollY);
             rect.translate(scrollX, scrollY);
-            context.clip(view->visibleContentRect());
+            context->clip(view->visibleContentRect());
 
-            view->paintContents(&context, rect);
+            view->paintContents(context, rect);
 
-            context.restore();
+            context->restore();
         }
 
         if (layer & QWebFrame::ScrollBarLayer
             && !view->scrollbarsSuppressed()
             && (view->horizontalScrollbar() || view->verticalScrollbar())) {
-            context.save();
+            context->save();
 
             QRect rect = intersectedRect;
-            context.translate(x, y);
+            context->translate(x, y);
             rect.translate(-x, -y);
 
-            view->paintScrollbars(&context, rect);
+            view->paintScrollbars(context, rect);
 
-            context.restore();
+            context->restore();
         }
 
+#if ENABLE(PAN_SCROLLING)
         if (layer & QWebFrame::PanIconLayer)
-            view->paintPanScrollIcon(&context);
+            view->paintPanScrollIcon(context);
+#endif
 
         painter->restore();
     }
 }
 
-static bool webframe_scrollOverflow(WebCore::Frame* frame, int dx, int dy, const QPoint& pos)
-{
-    if (!frame || !frame->document() || !frame->eventHandler())
-        return false;
-
-    Node* node = frame->document()->elementFromPoint(pos.x(), pos.y());
-    if (!node)
-        return false;
-
-    RenderObject* renderer = node->renderer();
-    if (!renderer)
-        return false;
-
-    if (renderer->isListBox())
-        return false;
-
-    RenderLayer* renderLayer = renderer->enclosingLayer();
-    if (!renderLayer)
-        return false;
-
-    bool scrolledHorizontal = false;
-    bool scrolledVertical = false;
-
-    if (dx > 0)
-        scrolledHorizontal = renderLayer->scroll(ScrollRight, ScrollByPixel, dx);
-    else if (dx < 0)
-        scrolledHorizontal = renderLayer->scroll(ScrollLeft, ScrollByPixel, qAbs(dx));
-
-    if (dy > 0)
-        scrolledVertical = renderLayer->scroll(ScrollDown, ScrollByPixel, dy);
-    else if (dy < 0)
-        scrolledVertical = renderLayer->scroll(ScrollUp, ScrollByPixel, qAbs(dy));
-
-    return (scrolledHorizontal || scrolledVertical);
-}
-
-
-
-
-
 /*!
     \class QWebFrame
     \since 4.4
@@ -554,7 +708,7 @@ QString QWebFrame::renderTreeDump() const
     if (d->frame->view() && d->frame->view()->layoutPending())
         d->frame->view()->layout();
 
-    return externalRepresentation(d->frame->contentRenderer());
+    return externalRepresentation(d->frame);
 }
 
 /*!
@@ -726,58 +880,16 @@ QWebPage *QWebFrame::page() const
 */
 void QWebFrame::load(const QUrl &url)
 {
-#if QT_VERSION < 0x040400
-    load(QWebNetworkRequest(ensureAbsoluteUrl(url)));
-#else
     load(QNetworkRequest(ensureAbsoluteUrl(url)));
-#endif
-}
-
-#if QT_VERSION < 0x040400
-/*!
-  Loads a network request, \a req, into this frame.
-
-  \note The view remains the same until enough data has arrived to display the new url.
-*/
-void QWebFrame::load(const QWebNetworkRequest &req)
-{
-    if (d->parentFrame())
-        d->page->d->insideOpenCall = true;
-
-    QUrl url = ensureAbsoluteUrl(req.url());
-    QHttpRequestHeader httpHeader = req.httpHeader();
-    QByteArray postData = req.postData();
-
-    WebCore::ResourceRequest request(url);
-
-    QString method = httpHeader.method();
-    if (!method.isEmpty())
-        request.setHTTPMethod(method);
-
-    QList<QPair<QString, QString> > values = httpHeader.values();
-    for (int i = 0; i < values.size(); ++i) {
-        const QPair<QString, QString> &val = values.at(i);
-        request.addHTTPHeaderField(val.first, val.second);
-    }
-
-    if (!postData.isEmpty())
-        request.setHTTPBody(WebCore::FormData::create(postData.constData(), postData.size()));
-
-    d->frame->loader()->load(request, false);
-
-    if (d->parentFrame())
-        d->page->d->insideOpenCall = false;
 }
 
-#else
-
 /*!
   Loads a network request, \a req, into this frame, using the method specified in \a
   operation.
 
   \a body is optional and is only used for POST operations.
 
-  \note The view remains the same until enough data has arrived to display the new \a url.
+  \note The view remains the same until enough data has arrived to display the new content.
 
   \sa setUrl()
 */
@@ -829,7 +941,6 @@ void QWebFrame::load(const QNetworkRequest &req,
     if (d->parentFrame())
         d->page->d->insideOpenCall = false;
 }
-#endif
 
 /*!
   Sets the content of this frame to \a html. \a baseUrl is optional and used to resolve relative
@@ -837,10 +948,6 @@ void QWebFrame::load(const QNetworkRequest &req,
 
   The \a html is loaded immediately; external objects are loaded asynchronously.
 
-  If a script in the \a html runs longer than the default script timeout (currently 10 seconds),
-  for example due to being blocked by a modal JavaScript alert dialog, this method will return
-  as soon as possible after the timeout and any subsequent \a html will be loaded asynchronously.
-
   When using this method WebKit assumes that external resources such as JavaScript programs or style
   sheets are encoded in UTF-8 unless otherwise specified. For example, the encoding of an external
   script can be specified through the charset attribute of the HTML script tag. It is also possible
@@ -942,11 +1049,13 @@ void QWebFrame::setScrollBarPolicy(Qt::Orientation orientation, Qt::ScrollBarPol
         d->horizontalScrollBarPolicy = policy;
         if (d->frame->view()) {
             d->frame->view()->setHorizontalScrollbarMode((ScrollbarMode)policy);
+            d->frame->view()->updateCanHaveScrollbars();
         }
     } else {
         d->verticalScrollBarPolicy = policy;
         if (d->frame->view()) {
             d->frame->view()->setVerticalScrollbarMode((ScrollbarMode)policy);
+            d->frame->view()->updateCanHaveScrollbars();
         }
     }
 }
@@ -1048,48 +1157,6 @@ void QWebFrame::scroll(int dx, int dy)
 }
 
 /*!
-  \internal
-  Scrolls nested frames starting at this frame, \a dx pixels to the right 
-  and \a dy pixels downward. Both \a dx and \a dy may be negative. First attempts
-  to scroll elements with CSS overflow at position pos, followed by this frame. If this 
-  frame doesn't scroll, attempts to scroll the parent
-*/
-void QWEBKIT_EXPORT qtwebkit_webframe_scrollRecursively(QWebFrame* qFrame, int dx, int dy, const QPoint& pos)
-{
-    Frame* frame = QWebFramePrivate::core(qFrame);
-
-    if (!frame || !frame->view())
-        return;
-    
-    if (!webframe_scrollOverflow(frame, dx, dy, pos)) {
-        do {
-            bool scrolledHorizontal = false;
-            bool scrolledVertical = false;
-            
-            IntSize scrollOffset = frame->view()->scrollOffset();
-            IntPoint maxScrollOffset = frame->view()->maximumScrollPosition();
-
-            if (dx > 0) // scroll right
-                scrolledHorizontal = scrollOffset.width() < maxScrollOffset.x();
-            else if (dx < 0) // scroll left
-                scrolledHorizontal = scrollOffset.width() > 0;
-
-            if (dy > 0) // scroll down
-                scrolledVertical = scrollOffset.height() < maxScrollOffset.y();
-            else if (dy < 0) //scroll up
-                scrolledVertical = scrollOffset.height() > 0;
-
-            if (scrolledHorizontal || scrolledVertical) {
-                frame->view()->scrollBy(IntSize(dx, dy));
-                return;
-            }
-            
-            frame = frame->tree()->parent(); 
-        } while (frame && frame->view());
-    }
-}
-
-/*!
   \property QWebFrame::scrollPosition
   \since 4.5
   \brief the position the frame is currently scrolled to.
@@ -1113,6 +1180,17 @@ void QWebFrame::setScrollPosition(const QPoint &pos)
 }
 
 /*!
+  \since 4.7
+  Scrolls the frame to the given \a anchor name.
+*/
+void QWebFrame::scrollToAnchor(const QString& anchor)
+{
+    FrameView *view = d->frame->view();
+    if (view)
+        view->scrollToAnchor(anchor);
+}
+
+/*!
   \since 4.6
   Render the \a layer of the frame using \a painter clipping to \a clip.
 
@@ -1121,29 +1199,41 @@ void QWebFrame::setScrollPosition(const QPoint &pos)
 
 void QWebFrame::render(QPainter* painter, RenderLayer layer, const QRegion& clip)
 {
+    GraphicsContext context(painter);
+    if (context.paintingDisabled() && !context.updatingControlTints())
+        return;
+
     if (!clip.isEmpty())
-        d->renderPrivate(painter, layer, clip);
+        d->renderRelativeCoords(&context, layer, clip);
     else if (d->frame->view())
-        d->renderPrivate(painter, layer, QRegion(d->frame->view()->frameRect()));
+        d->renderRelativeCoords(&context, layer, QRegion(d->frame->view()->frameRect()));
 }
 
 /*!
   Render the frame into \a painter clipping to \a clip.
 */
-void QWebFrame::render(QPainter *painter, const QRegion &clip)
+void QWebFrame::render(QPainter* painter, const QRegion& clip)
 {
-    d->renderPrivate(painter, AllLayers, clip);
+    GraphicsContext context(painter);
+    if (context.paintingDisabled() && !context.updatingControlTints())
+        return;
+
+    d->renderRelativeCoords(&context, AllLayers, clip);
 }
 
 /*!
   Render the frame into \a painter.
 */
-void QWebFrame::render(QPainter *painter)
+void QWebFrame::render(QPainter* painter)
 {
     if (!d->frame->view())
         return;
 
-    d->renderPrivate(painter, AllLayers, QRegion(d->frame->view()->frameRect()));
+    GraphicsContext context(painter);
+    if (context.paintingDisabled() && !context.updatingControlTints())
+        return;
+
+    d->renderRelativeCoords(&context, AllLayers, QRegion(d->frame->view()->frameRect()));
 }
 
 /*!
@@ -1164,7 +1254,7 @@ void QWebFrame::render(QPainter *painter)
 */
 void QWebFrame::setTextSizeMultiplier(qreal factor)
 {
-    d->frame->setZoomFactor(factor, /*isTextOnly*/true);
+    d->frame->setZoomFactor(factor, ZoomTextOnly);
 }
 
 /*!
@@ -1183,7 +1273,7 @@ qreal QWebFrame::textSizeMultiplier() const
 
 void QWebFrame::setZoomFactor(qreal factor)
 {
-    d->frame->setZoomFactor(factor, d->frame->isZoomFactorTextOnly());
+    d->frame->setZoomFactor(factor, d->frame->zoomMode());
 }
 
 qreal QWebFrame::zoomFactor() const
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.h
index 08285f84ad..ce9805b85b 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.h
@@ -26,9 +26,7 @@
 #include <QtCore/qvariant.h>
 #include <QtGui/qicon.h>
 #include <QtScript/qscriptengine.h>
-#if QT_VERSION >= 0x040400
 #include <QtNetwork/qnetworkaccessmanager.h>
-#endif
 #include "qwebkitglobal.h"
 
 QT_BEGIN_NAMESPACE
@@ -123,13 +121,9 @@ public:
     QWebPage *page() const;
 
     void load(const QUrl &url);
-#if QT_VERSION < 0x040400
-    void load(const QWebNetworkRequest &request);
-#else
     void load(const QNetworkRequest &request,
               QNetworkAccessManager::Operation operation = QNetworkAccessManager::GetOperation,
               const QByteArray &body = QByteArray());
-#endif
     void setHtml(const QString &html, const QUrl &baseUrl = QUrl());
     void setContent(const QByteArray &data, const QString &mimeType = QString(), const QUrl &baseUrl = QUrl());
 
@@ -165,6 +159,8 @@ public:
     QPoint scrollPosition() const;
     void setScrollPosition(const QPoint &pos);
 
+    void scrollToAnchor(const QString& anchor);
+
     enum RenderLayer {
         ContentsLayer = 0x10,
         ScrollBarLayer = 0x20,
@@ -222,7 +218,10 @@ Q_SIGNALS:
     void loadStarted();
     void loadFinished(bool ok);
 
+    void pageChanged();
+
 private:
+    friend class QGraphicsWebView;
     friend class QWebPage;
     friend class QWebPagePrivate;
     friend class QWebFramePrivate;
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h
index 095d1340a7..fcc37e7103 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h
@@ -25,6 +25,7 @@
 #include "qwebpage_p.h"
 
 #include "EventHandler.h"
+#include "GraphicsContext.h"
 #include "KURL.h"
 #include "PlatformString.h"
 #include "qwebelement.h"
@@ -72,6 +73,7 @@ public:
         , marginHeight(-1)
         {}
     void init(QWebFrame* qframe, QWebFrameData* frameData);
+    void setPage(QWebPage*);
 
     inline QWebFrame *parentFrame() { return qobject_cast<QWebFrame*>(q->parent()); }
 
@@ -81,9 +83,10 @@ public:
     static WebCore::Frame* core(QWebFrame*);
     static QWebFrame* kit(WebCore::Frame*);
 
-    void renderPrivate(QPainter*, QWebFrame::RenderLayer, const QRegion& clip);
-
-    bool scrollOverflow(int dx, int dy);
+    void renderRelativeCoords(WebCore::GraphicsContext*, QWebFrame::RenderLayer, const QRegion& clip);
+#if ENABLE(TILED_BACKING_STORE)
+    void renderFromTiledBackingStore(WebCore::GraphicsContext*, const QRegion& clip);
+#endif
 
     QWebFrame *q;
     Qt::ScrollBarPolicy horizontalScrollBarPolicy;
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector.cpp
index 1145744c3f..c0e5277710 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector.cpp
@@ -139,9 +139,6 @@ QSize QWebInspector::sizeHint() const
 /*! \reimp */
 bool QWebInspector::event(QEvent* ev)
 {
-    if (ev->type() == QEvent::Close && d->page)
-        d->page->d->inspectorController()->setWindowVisible(false);
-
     return QWidget::event(ev);
 }
 
@@ -154,14 +151,29 @@ void QWebInspector::resizeEvent(QResizeEvent* event)
 /*! \reimp */
 void QWebInspector::showEvent(QShowEvent* event)
 {
+#if ENABLE(INSPECTOR)
     // Allows QWebInspector::show() to init the inspector.
     if (d->page)
         d->page->d->inspectorController()->show();
+#endif
 }
 
 /*! \reimp */
 void QWebInspector::hideEvent(QHideEvent* event)
 {
+#if ENABLE(INSPECTOR)
+    if (d->page)
+        d->page->d->inspectorController()->close();
+#endif
+}
+
+/*! \reimp */
+void QWebInspector::closeEvent(QCloseEvent* event)
+{
+#if ENABLE(INSPECTOR)
+    if (d->page)
+        d->page->d->inspectorController()->close();
+#endif
 }
 
 /*! \internal */
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector.h
index a5c1ed5b4a..f192e921b6 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector.h
@@ -43,6 +43,7 @@ protected:
     void resizeEvent(QResizeEvent* event);
     void showEvent(QShowEvent* event);
     void hideEvent(QHideEvent* event);
+    void closeEvent(QCloseEvent* event);
 
 private:
     QWebInspectorPrivate* d;
@@ -51,5 +52,6 @@ private:
     friend class QWebPage;
     friend class QWebPagePrivate;
     friend class WebCore::InspectorClientQt;
+    friend class WebCore::InspectorFrontendClientQt;
 };
 #endif
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebkitglobal.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebkitglobal.h
index 0885bdc754..9e8979ff93 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebkitglobal.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebkitglobal.h
@@ -40,15 +40,4 @@
 #  endif
 #endif
 
-#if QT_VERSION < 0x040400
-    #ifndef QT_BEGIN_NAMESPACE
-    #define QT_BEGIN_NAMESPACE
-    #endif
-
-    #ifndef QT_END_NAMESPACE
-    #define QT_END_NAMESPACE
-    #endif
-#endif
-
-
 #endif // QWEBKITGLOBAL_H
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
index 97a4e4ed2b..4c92c9fc51 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
@@ -32,6 +32,8 @@
 #include "qwebsettings.h"
 #include "qwebkitversion.h"
 
+#include "Chrome.h"
+#include "ContextMenuController.h"
 #include "Frame.h"
 #include "FrameTree.h"
 #include "FrameLoader.h"
@@ -79,6 +81,7 @@
 #include "runtime/InitializeThreading.h"
 #include "PageGroup.h"
 #include "QWebPageClient.h"
+#include "WorkerThread.h"
 
 #include <QApplication>
 #include <QBasicTimer>
@@ -102,18 +105,29 @@
 #include <QStyle>
 #include <QSysInfo>
 #include <QTextCharFormat>
-#if QT_VERSION >= 0x040400
+#include <QTextDocument>
 #include <QNetworkAccessManager>
 #include <QNetworkRequest>
-#else
-#include "qwebnetworkinterface.h"
-#endif
 #if defined(Q_WS_X11)
 #include <QX11Info>
 #endif
 
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+#include <QTouchEvent>
+#include "PlatformTouchEvent.h"
+#endif
+
 using namespace WebCore;
 
+void QWEBKIT_EXPORT qt_wrt_setViewMode(QWebPage* page, const QString& mode)
+{
+    QWebPagePrivate::priv(page)->viewMode = mode;
+    WebCore::Frame* frame = QWebFramePrivate::core(page->mainFrame());
+    WebCore::FrameView* view = frame->view();
+    frame->document()->updateStyleSelector();
+    view->forceLayout();
+}
+
 void QWEBKIT_EXPORT qt_drt_overwritePluginDirectories()
 {
     PluginDatabase* db = PluginDatabase::installedPlugins(/* populate */ false);
@@ -126,12 +140,26 @@ void QWEBKIT_EXPORT qt_drt_overwritePluginDirectories()
     db->refresh();
 }
 
+int QWEBKIT_EXPORT qt_drt_workerThreadCount()
+{
+#if ENABLE(WORKERS)
+    return WebCore::WorkerThread::workerThreadCount();
+#else
+    return 0;
+#endif
+}
+
 bool QWebPagePrivate::drtRun = false;
 void QWEBKIT_EXPORT qt_drt_run(bool b)
 {
     QWebPagePrivate::drtRun = b;
 }
 
+void QWEBKIT_EXPORT qt_drt_setFrameFlatteningEnabled(QWebPage* page, bool enabled)
+{
+    QWebPagePrivate::core(page)->settings()->setFrameFlatteningEnabled(enabled);
+}
+
 void QWEBKIT_EXPORT qt_webpage_setGroupName(QWebPage* page, const QString& groupName)
 {
     page->handle()->page->setGroupName(groupName);
@@ -142,6 +170,45 @@ QString QWEBKIT_EXPORT qt_webpage_groupName(QWebPage* page)
     return page->handle()->page->groupName();
 }
 
+#if ENABLE(INSPECTOR)
+void QWEBKIT_EXPORT qt_drt_webinspector_executeScript(QWebPage* page, long callId, const QString& script)
+{
+    if (!page->handle()->page->inspectorController())
+        return;
+    page->handle()->page->inspectorController()->evaluateForTestInFrontend(callId, script);
+}
+
+void QWEBKIT_EXPORT qt_drt_webinspector_close(QWebPage* page)
+{
+    if (!page->handle()->page->inspectorController())
+        return;
+    page->handle()->page->inspectorController()->close();
+}
+
+void QWEBKIT_EXPORT qt_drt_webinspector_show(QWebPage* page)
+{
+    if (!page->handle()->page->inspectorController())
+        return;
+    page->handle()->page->inspectorController()->show();
+}
+
+void QWEBKIT_EXPORT qt_drt_setTimelineProfilingEnabled(QWebPage* page, bool enabled)
+{
+    InspectorController* controller = page->handle()->page->inspectorController();
+    if (!controller)
+        return;
+    if (enabled)
+        controller->startTimelineProfiler();
+    else
+        controller->stopTimelineProfiler();
+}
+#endif
+
+void QWEBKIT_EXPORT qt_drt_enableCaretBrowsing(QWebPage* page, bool value)
+{
+    page->handle()->page->settings()->setCaretBrowsingEnabled(value);
+}
+
 class QWebPageWidgetClient : public QWebPageClient {
 public:
     QWebPageWidgetClient(QWidget* view)
@@ -150,6 +217,8 @@ public:
         Q_ASSERT(view);
     }
 
+    virtual bool isQWidgetClient() const { return true; }
+
     virtual void scroll(int dx, int dy, const QRect&);
     virtual void update(const QRect& dirtyRect);
     virtual void setInputMethodEnabled(bool enable);
@@ -166,9 +235,12 @@ public:
     virtual QPalette palette() const;
     virtual int screenNumber() const;
     virtual QWidget* ownerWidget() const;
+    virtual QRect geometryRelativeToOwnerWidget() const;
 
     virtual QObject* pluginParent() const;
 
+    virtual QStyle* style() const;
+
     QWidget* view;
 };
 
@@ -221,10 +293,8 @@ QPalette QWebPageWidgetClient::palette() const
 int QWebPageWidgetClient::screenNumber() const
 {
 #if defined(Q_WS_X11)
-    if (view)
-        return view->x11Info().screen();
+    return view->x11Info().screen();
 #endif
-
     return 0;
 }
 
@@ -233,11 +303,21 @@ QWidget* QWebPageWidgetClient::ownerWidget() const
     return view;
 }
 
+QRect QWebPageWidgetClient::geometryRelativeToOwnerWidget() const
+{
+    return view->geometry();
+}
+
 QObject* QWebPageWidgetClient::pluginParent() const
 {
     return view;
 }
 
+QStyle* QWebPageWidgetClient::style() const
+{
+    return view->style();
+}
+
 // Lookup table mapping QWebPage::WebActions to the associated Editor commands
 static const char* editorCommandWebActions[] =
 {
@@ -341,8 +421,10 @@ static inline DragOperation dropActionToDragOp(Qt::DropActions actions)
     unsigned result = 0;
     if (actions & Qt::CopyAction)
         result |= DragOperationCopy;
+    // DragOperationgeneric represents InternetExplorer's equivalent of Move operation,
+    // hence it should be considered as "move"
     if (actions & Qt::MoveAction)
-        result |= DragOperationMove;
+        result |= (DragOperationMove | DragOperationGeneric);
     if (actions & Qt::LinkAction)
         result |= DragOperationLink;
     return (DragOperation)result;
@@ -355,6 +437,10 @@ static inline Qt::DropAction dragOpToDropAction(unsigned actions)
         result = Qt::CopyAction;
     else if (actions & DragOperationMove)
         result = Qt::MoveAction;
+    // DragOperationgeneric represents InternetExplorer's equivalent of Move operation,
+    // hence it should be considered as "move"
+    else if (actions & DragOperationGeneric)
+        result = Qt::MoveAction;
     else if (actions & DragOperationLink)
         result = Qt::LinkAction;
     return result;
@@ -366,11 +452,11 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
 #if QT_VERSION < 0x040600
     , view(0)
 #endif
+    , clickCausedFocus(false)
+    , viewportSize(QSize(0, 0))
     , inspectorFrontend(0)
     , inspector(0)
     , inspectorIsInternalOnly(false)
-    , viewportSize(QSize(0, 0))
-    , clickCausedFocus(false)
 {
     WebCore::InitializeLoggingChannelsIfNecessary();
     JSC::initializeThreading();
@@ -380,7 +466,7 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     contextMenuClient = new ContextMenuClientQt();
     editorClient = new EditorClientQt(q);
     page = new Page(chromeClient, contextMenuClient, editorClient,
-                    new DragClientQt(q), new InspectorClientQt(q), 0);
+                    new DragClientQt(q), new InspectorClientQt(q), 0, 0);
 
     settings = new QWebSettings(page->settings());
 
@@ -388,11 +474,7 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     undoStack = 0;
 #endif
     mainFrame = 0;
-#if QT_VERSION < 0x040400
-    networkInterface = 0;
-#else
     networkManager = 0;
-#endif
     pluginFactory = 0;
     insideOpenCall = false;
     forwardUnsupportedContent = false;
@@ -421,15 +503,16 @@ QWebPagePrivate::~QWebPagePrivate()
     delete page;
 }
 
-#if QT_VERSION < 0x040400
-bool QWebPagePrivate::acceptNavigationRequest(QWebFrame *frame, const QWebNetworkRequest &request, QWebPage::NavigationType type)
+WebCore::Page* QWebPagePrivate::core(QWebPage* page)
 {
-    if (insideOpenCall
-        && frame == mainFrame)
-        return true;
-    return q->acceptNavigationRequest(frame, request, type);
+    return page->d->page;
 }
-#else
+
+QWebPagePrivate* QWebPagePrivate::priv(QWebPage* page)
+{
+    return page->d;
+}
+
 bool QWebPagePrivate::acceptNavigationRequest(QWebFrame *frame, const QNetworkRequest &request, QWebPage::NavigationType type)
 {
     if (insideOpenCall
@@ -437,7 +520,6 @@ bool QWebPagePrivate::acceptNavigationRequest(QWebFrame *frame, const QNetworkRe
         return true;
     return q->acceptNavigationRequest(frame, request, type);
 }
-#endif
 
 void QWebPagePrivate::createMainFrame()
 {
@@ -473,7 +555,9 @@ static QWebPage::WebAction webActionForContextMenuAction(WebCore::ContextMenuAct
         case WebCore::ContextMenuItemTagBold: return QWebPage::ToggleBold;
         case WebCore::ContextMenuItemTagItalic: return QWebPage::ToggleItalic;
         case WebCore::ContextMenuItemTagUnderline: return QWebPage::ToggleUnderline;
+#if ENABLE(INSPECTOR)
         case WebCore::ContextMenuItemTagInspectElement: return QWebPage::InspectElement;
+#endif
         default: break;
     }
     return QWebPage::NoWebAction;
@@ -483,7 +567,10 @@ static QWebPage::WebAction webActionForContextMenuAction(WebCore::ContextMenuAct
 QMenu *QWebPagePrivate::createContextMenu(const WebCore::ContextMenu *webcoreMenu,
         const QList<WebCore::ContextMenuItem> *items, QBitArray *visitedWebActions)
 {
-    QMenu* menu = new QMenu(q->view());
+    if (!client)
+        return 0;
+
+    QMenu* menu = new QMenu(client->ownerWidget());
     for (int i = 0; i < items->count(); ++i) {
         const ContextMenuItem &item = items->at(i);
         switch (item.type()) {
@@ -991,10 +1078,8 @@ QWebPage::WebAction QWebPagePrivate::editorActionForKeyEvent(QKeyEvent* event)
         { QKeySequence::SelectEndOfDocument, QWebPage::SelectEndOfDocument },
         { QKeySequence::DeleteStartOfWord, QWebPage::DeleteStartOfWord },
         { QKeySequence::DeleteEndOfWord, QWebPage::DeleteEndOfWord },
-#if QT_VERSION >= 0x040500
         { QKeySequence::InsertParagraphSeparator, QWebPage::InsertParagraphSeparator },
         { QKeySequence::InsertLineSeparator, QWebPage::InsertLineSeparator },
-#endif
         { QKeySequence::SelectAll, QWebPage::SelectAll },
         { QKeySequence::UnknownKey, QWebPage::NoWebAction }
     };
@@ -1019,8 +1104,8 @@ void QWebPagePrivate::keyPressEvent(QKeyEvent *ev)
     if (!handled) {
         handled = true;
         QFont defaultFont;
-        if (q->view())
-            defaultFont = q->view()->font();
+        if (client)
+            defaultFont = client->ownerWidget()->font();
         QFontMetrics fm(defaultFont);
         if (!handleScrolling(ev, frame)) {
             switch (ev->key()) {
@@ -1079,8 +1164,9 @@ void QWebPagePrivate::focusOutEvent(QFocusEvent*)
     // and the focus frame. But don't tell the focus controller so that upon
     // focusInEvent() we can re-activate the frame.
     FocusController *focusController = page->focusController();
-    focusController->setActive(false);
+    // Call setFocused first so that window.onblur doesn't get called twice
     focusController->setFocused(false);
+    focusController->setActive(false);
 }
 
 void QWebPagePrivate::dragEnterEvent(QGraphicsSceneDragDropEvent* ev)
@@ -1102,8 +1188,9 @@ void QWebPagePrivate::dragEnterEvent(QDragEnterEvent* ev)
                       dropActionToDragOp(ev->possibleActions()));
     Qt::DropAction action = dragOpToDropAction(page->dragController()->dragEntered(&dragData));
     ev->setDropAction(action);
-    if (action != Qt::IgnoreAction)
-        ev->accept();
+    // We must accept this event in order to receive the drag move events that are sent
+    // while the drag and drop action is in progress.
+    ev->accept();
 #endif
 }
 
@@ -1143,9 +1230,11 @@ void QWebPagePrivate::dragMoveEvent(QDragMoveEvent* ev)
     DragData dragData(ev->mimeData(), ev->pos(), QCursor::pos(),
                       dropActionToDragOp(ev->possibleActions()));
     Qt::DropAction action = dragOpToDropAction(page->dragController()->dragUpdated(&dragData));
+    m_lastDropAction = action;
     ev->setDropAction(action);
-    if (action != Qt::IgnoreAction)
-        ev->accept();
+    // We must accept this event in order to receive the drag move events that are sent
+    // while the drag and drop action is in progress.
+    ev->accept();
 #endif
 }
 
@@ -1154,8 +1243,7 @@ void QWebPagePrivate::dropEvent(QGraphicsSceneDragDropEvent* ev)
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(ev->mimeData(), ev->pos().toPoint(),
             QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
-    Qt::DropAction action = dragOpToDropAction(page->dragController()->performDrag(&dragData));
-    if (action != Qt::IgnoreAction)
+    if (page->dragController()->performDrag(&dragData))
         ev->accept();
 #endif
 }
@@ -1163,10 +1251,11 @@ void QWebPagePrivate::dropEvent(QGraphicsSceneDragDropEvent* ev)
 void QWebPagePrivate::dropEvent(QDropEvent* ev)
 {
 #ifndef QT_NO_DRAGANDDROP
+    // Overwrite the defaults set by QDragManager::defaultAction()
+    ev->setDropAction(m_lastDropAction);
     DragData dragData(ev->mimeData(), ev->pos(), QCursor::pos(),
-                      dropActionToDragOp(ev->possibleActions()));
-    Qt::DropAction action = dragOpToDropAction(page->dragController()->performDrag(&dragData));
-    if (action != Qt::IgnoreAction)
+                      dropActionToDragOp(Qt::DropAction(ev->dropAction())));
+    if (page->dragController()->performDrag(&dragData))
         ev->accept();
 #endif
 }
@@ -1235,7 +1324,7 @@ void QWebPagePrivate::inputMethodEvent(QInputMethodEvent *ev)
             break;
         }
         case QInputMethodEvent::Cursor: {
-            frame->setCaretVisible(a.length); //if length is 0 cursor is invisible
+            frame->selection()->setCaretVisible(a.length); //if length is 0 cursor is invisible
             if (a.length > 0) {
                 RenderObject* caretRenderer = frame->selection()->caretRenderer();
                 if (caretRenderer) {
@@ -1313,16 +1402,16 @@ bool QWebPagePrivate::handleScrolling(QKeyEvent *ev, Frame *frame)
         granularity = ScrollByPage;
         direction = ScrollDown;
     } else if (ev == QKeySequence::MoveToPreviousPage
-               || (ev->key() == Qt::Key_Space) && (ev->modifiers() & Qt::ShiftModifier)) {
+               || ((ev->key() == Qt::Key_Space) && (ev->modifiers() & Qt::ShiftModifier))) {
         granularity = ScrollByPage;
         direction = ScrollUp;
     } else
 #endif // QT_NO_SHORTCUT
-    if (ev->key() == Qt::Key_Up && ev->modifiers() & Qt::ControlModifier
+    if ((ev->key() == Qt::Key_Up && ev->modifiers() & Qt::ControlModifier)
                || ev->key() == Qt::Key_Home) {
         granularity = ScrollByDocument;
         direction = ScrollUp;
-    } else if (ev->key() == Qt::Key_Down && ev->modifiers() & Qt::ControlModifier
+    } else if ((ev->key() == Qt::Key_Down && ev->modifiers() & Qt::ControlModifier)
                || ev->key() == Qt::Key_End) {
         granularity = ScrollByDocument;
         direction = ScrollDown;
@@ -1352,6 +1441,18 @@ bool QWebPagePrivate::handleScrolling(QKeyEvent *ev, Frame *frame)
     return frame->eventHandler()->scrollRecursively(direction, granularity);
 }
 
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+void QWebPagePrivate::touchEvent(QTouchEvent* event)
+{
+    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
+    if (!frame->view())
+        return;
+
+    bool accepted = frame->eventHandler()->handleTouchEvent(PlatformTouchEvent(event));
+    event->setAccepted(accepted);
+}
+#endif
+
 /*!
   This method is used by the input method to query a set of properties of the page
   to be able to support complex input method operations as support for surrounding
@@ -1380,6 +1481,11 @@ QVariant QWebPage::inputMethodQuery(Qt::InputMethodQuery property) const
 
     switch (property) {
         case Qt::ImMicroFocus: {
+            WebCore::FrameView* view = frame->view();
+            if (view && view->needsLayout()) {
+                // We can't access absoluteCaretBounds() while the view needs to layout.
+                return QVariant();
+            }
             return QVariant(frame->selection()->absoluteCaretBounds());
         }
         case Qt::ImFont: {
@@ -1478,6 +1584,7 @@ void QWebPagePrivate::setInspector(QWebInspector* insp)
 */
 QWebInspector* QWebPagePrivate::getOrCreateInspector()
 {
+#if ENABLE(INSPECTOR)
     if (!inspector) {
         QWebInspector* insp = new QWebInspector;
         insp->setPage(q);
@@ -1485,13 +1592,18 @@ QWebInspector* QWebPagePrivate::getOrCreateInspector()
 
         Q_ASSERT(inspector); // Associated through QWebInspector::setPage(q)
     }
+#endif
     return inspector;
 }
 
 /*! \internal */
 InspectorController* QWebPagePrivate::inspectorController()
 {
+#if ENABLE(INSPECTOR)
     return page->inspectorController();
+#else
+    return 0;
+#endif
 }
 
 
@@ -1691,7 +1803,7 @@ QWebPage::QWebPage(QObject *parent)
     : QObject(parent)
     , d(new QWebPagePrivate(this))
 {
-    setView(qobject_cast<QWidget *>(parent));
+    setView(qobject_cast<QWidget*>(parent));
 
     connect(this, SIGNAL(loadProgress(int)), this, SLOT(_q_onLoadProgressChanged(int)));
 #ifndef NDEBUG
@@ -1775,21 +1887,28 @@ QWebHistory *QWebPage::history() const
 
     \sa view()
 */
-void QWebPage::setView(QWidget *view)
-{
-    if (this->view() != view) {
-        d->view = view;
-        if (!view) {
-            delete d->client;
-            d->client = 0;
-        } else {
-            if (!d->client) 
-                d->client = new QWebPageWidgetClient(view);
-            else
-                static_cast<QWebPageWidgetClient*>(d->client)->view = view;
-        }
-        setViewportSize(view ? view->size() : QSize(0, 0));
+void QWebPage::setView(QWidget* view)
+{
+    if (this->view() == view)
+        return;
+
+    d->view = view;
+    setViewportSize(view ? view->size() : QSize(0, 0));
+
+    // If we have no client, we install a special client delegating
+    // the responsibility to the QWidget. This is the code path
+    // handling a.o. the "legacy" QWebView.
+    //
+    // If such a special delegate already exist, we substitute the view.
+
+    if (d->client) {
+        if (d->client->isQWidgetClient())
+            static_cast<QWebPageWidgetClient*>(d->client)->view = view;
+        return;
     }
+
+    if (view)
+        d->client = new QWebPageWidgetClient(view);
 }
 
 /*!
@@ -1830,7 +1949,8 @@ void QWebPage::javaScriptAlert(QWebFrame *frame, const QString& msg)
 {
     Q_UNUSED(frame)
 #ifndef QT_NO_MESSAGEBOX
-    QMessageBox::information(view(), tr("JavaScript Alert - %1").arg(mainFrame()->url().host()), msg, QMessageBox::Ok);
+    QWidget* parent = (d->client) ? d->client->ownerWidget() : 0;
+    QMessageBox::information(parent, tr("JavaScript Alert - %1").arg(mainFrame()->url().host()), Qt::escape(msg), QMessageBox::Ok);
 #endif
 }
 
@@ -1846,7 +1966,8 @@ bool QWebPage::javaScriptConfirm(QWebFrame *frame, const QString& msg)
 #ifdef QT_NO_MESSAGEBOX
     return true;
 #else
-    return QMessageBox::Yes == QMessageBox::information(view(), tr("JavaScript Confirm - %1").arg(mainFrame()->url().host()), msg, QMessageBox::Yes, QMessageBox::No);
+    QWidget* parent = (d->client) ? d->client->ownerWidget() : 0;
+    return QMessageBox::Yes == QMessageBox::information(parent, tr("JavaScript Confirm - %1").arg(mainFrame()->url().host()), Qt::escape(msg), QMessageBox::Yes, QMessageBox::No);
 #endif
 }
 
@@ -1865,7 +1986,8 @@ bool QWebPage::javaScriptPrompt(QWebFrame *frame, const QString& msg, const QStr
     Q_UNUSED(frame)
     bool ok = false;
 #ifndef QT_NO_INPUTDIALOG
-    QString x = QInputDialog::getText(view(), tr("JavaScript Prompt - %1").arg(mainFrame()->url().host()), msg, QLineEdit::Normal, defaultValue, &ok);
+    QWidget* parent = (d->client) ? d->client->ownerWidget() : 0;
+    QString x = QInputDialog::getText(parent, tr("JavaScript Prompt - %1").arg(mainFrame()->url().host()), Qt::escape(msg), QLineEdit::Normal, defaultValue, &ok);
     if (ok && result)
         *result = x;
 #endif
@@ -1890,7 +2012,8 @@ bool QWebPage::shouldInterruptJavaScript()
 #ifdef QT_NO_MESSAGEBOX
     return false;
 #else
-    return QMessageBox::Yes == QMessageBox::information(view(), tr("JavaScript Problem - %1").arg(mainFrame()->url().host()), tr("The script on this page appears to have a problem. Do you want to stop the script?"), QMessageBox::Yes, QMessageBox::No);
+    QWidget* parent = (d->client) ? d->client->ownerWidget() : 0;
+    return QMessageBox::Yes == QMessageBox::information(parent, tr("JavaScript Problem - %1").arg(mainFrame()->url().host()), tr("The script on this page appears to have a problem. Do you want to stop the script?"), QMessageBox::Yes, QMessageBox::No);
 #endif
 }
 
@@ -1903,11 +2026,13 @@ bool QWebPage::shouldInterruptJavaScript()
     If the view associated with the web page is a QWebView object, then the default implementation forwards
     the request to QWebView's createWindow() function; otherwise it returns a null pointer.
 
+    If \a type is WebModalDialog, the application must call setWindowModality(Qt::ApplicationModal) on the new window.
+
     \sa acceptNavigationRequest()
 */
 QWebPage *QWebPage::createWindow(WebWindowType type)
 {
-    QWebView *webView = qobject_cast<QWebView *>(view());
+    QWebView *webView = qobject_cast<QWebView*>(view());
     if (webView) {
         QWebView *newView = webView->createWindow(type);
         if (newView)
@@ -2033,11 +2158,13 @@ void QWebPage::triggerAction(WebAction action, bool)
             editor->setBaseWritingDirection(RightToLeftWritingDirection);
             break;
         case InspectElement: {
+#if ENABLE(INSPECTOR)
             if (!d->hitTestResult.isNull()) {
                 d->getOrCreateInspector(); // Make sure the inspector is created
                 d->inspector->show(); // The inspector is expected to be shown on inspection
                 d->page->inspectorController()->inspect(d->hitTestResult.d->innerNonSharedNode.get());
             }
+#endif
             break;
         }
         default:
@@ -2134,11 +2261,7 @@ void QWebPage::setPreferredContentsSize(const QSize &size) const
 
     \sa createWindow()
 */
-#if QT_VERSION >= 0x040400
 bool QWebPage::acceptNavigationRequest(QWebFrame *frame, const QNetworkRequest &request, QWebPage::NavigationType type)
-#else
-bool QWebPage::acceptNavigationRequest(QWebFrame *frame, const QWebNetworkRequest &request, QWebPage::NavigationType type)
-#endif
 {
     Q_UNUSED(frame)
     if (type == NavigationTypeLinkClicked) {
@@ -2193,7 +2316,7 @@ QAction *QWebPage::action(WebAction action) const
 
     QString text;
     QIcon icon;
-    QStyle *style = view() ? view()->style() : qApp->style();
+    QStyle *style = d->client ? d->client->style() : qApp->style();
     bool checkable = false;
 
     switch (action) {
@@ -2226,27 +2349,19 @@ QAction *QWebPage::action(WebAction action) const
 
         case Back:
             text = contextMenuItemTagGoBack();
-#if QT_VERSION >= 0x040400
             icon = style->standardIcon(QStyle::SP_ArrowBack);
-#endif
             break;
         case Forward:
             text = contextMenuItemTagGoForward();
-#if QT_VERSION >= 0x040400
             icon = style->standardIcon(QStyle::SP_ArrowForward);
-#endif
             break;
         case Stop:
             text = contextMenuItemTagStop();
-#if QT_VERSION >= 0x040400
             icon = style->standardIcon(QStyle::SP_BrowserStop);
-#endif
             break;
         case Reload:
             text = contextMenuItemTagReload();
-#if QT_VERSION >= 0x040400
             icon = style->standardIcon(QStyle::SP_BrowserReload);
-#endif
             break;
 
         case Cut:
@@ -2579,6 +2694,13 @@ bool QWebPage::event(QEvent *ev)
     case QEvent::Leave:
         d->leaveEvent(ev);
         break;
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    case QEvent::TouchBegin:
+    case QEvent::TouchUpdate:
+    case QEvent::TouchEnd:
+        d->touchEvent(static_cast<QTouchEvent*>(ev));
+        break;
+#endif
     default:
         return QObject::event(ev);
     }
@@ -2736,8 +2858,11 @@ void QWebPage::updatePositionDependentActions(const QPoint &pos)
         d->hitTestResult = QWebHitTestResult(new QWebHitTestResultPrivate(result));
     WebCore::ContextMenu menu(result);
     menu.populate();
+    
+#if ENABLE(INSPECTOR)
     if (d->page->inspectorController()->enabled())
         menu.addInspectElementItem();
+#endif
 
     QBitArray visitedWebActions(QWebPage::WebActionCount);
 
@@ -2888,7 +3013,8 @@ bool QWebPage::extension(Extension extension, const ExtensionOption *option, Ext
     if (extension == ChooseMultipleFilesExtension) {
         // FIXME: do not ignore suggestedFiles
         QStringList suggestedFiles = static_cast<const ChooseMultipleFilesExtensionOption*>(option)->suggestedFileNames;
-        QStringList names = QFileDialog::getOpenFileNames(view(), QString::null);
+        QWidget* parent = (d->client) ? d->client->ownerWidget() : 0;
+        QStringList names = QFileDialog::getOpenFileNames(parent, QString::null);
         static_cast<ChooseMultipleFilesExtensionReturn*>(output)->fileNames = names;
         return true;
     }
@@ -2970,41 +3096,13 @@ QString QWebPage::chooseFile(QWebFrame *parentFrame, const QString& suggestedFil
 {
     Q_UNUSED(parentFrame)
 #ifndef QT_NO_FILEDIALOG
-    return QFileDialog::getOpenFileName(view(), QString::null, suggestedFile);
+    QWidget* parent = (d->client) ? d->client->ownerWidget() : 0;
+    return QFileDialog::getOpenFileName(parent, QString::null, suggestedFile);
 #else
     return QString::null;
 #endif
 }
 
-#if QT_VERSION < 0x040400 && !defined qdoc
-
-void QWebPage::setNetworkInterface(QWebNetworkInterface *interface)
-{
-    d->networkInterface = interface;
-}
-
-QWebNetworkInterface *QWebPage::networkInterface() const
-{
-    if (d->networkInterface)
-        return d->networkInterface;
-    else
-        return QWebNetworkInterface::defaultInterface();
-}
-
-#ifndef QT_NO_NETWORKPROXY
-void QWebPage::setNetworkProxy(const QNetworkProxy& proxy)
-{
-    d->networkProxy = proxy;
-}
-
-QNetworkProxy QWebPage::networkProxy() const
-{
-    return d->networkProxy;
-}
-#endif
-
-#else
-
 /*!
     Sets the QNetworkAccessManager \a manager responsible for serving network requests for this
     QWebPage.
@@ -3038,8 +3136,6 @@ QNetworkAccessManager *QWebPage::networkAccessManager() const
     return d->networkManager;
 }
 
-#endif
-
 /*!
     Sets the QWebPluginFactory \a factory responsible for creating plugins embedded into this
     QWebPage.
@@ -3072,6 +3168,8 @@ QWebPluginFactory *QWebPage::pluginFactory() const
 
     "Mozilla/5.0 (%Platform%; %Security%; %Subplatform%; %Locale%) AppleWebKit/%WebKitVersion% (KHTML, like Gecko) %AppVersion Safari/%WebKitVersion%"
 
+    On mobile platforms such as Symbian S60 and Maemo, "Mobile Safari" is used instead of "Safari".
+
     In this string the following values are replaced at run-time:
     \list
     \o %Platform% and %Subplatform% are expanded to the windowing system and the operation system.
@@ -3279,8 +3377,8 @@ QString QWebPage::userAgentForUrl(const QUrl& url) const
 
     // Language
     QLocale locale;
-    if (view())
-        locale = view()->locale();
+    if (d->client)
+        locale = d->client->ownerWidget()->locale();
     QString name = locale.name();
     name[2] = QLatin1Char('-');
     ua.append(name);
@@ -3294,20 +3392,20 @@ QString QWebPage::userAgentForUrl(const QUrl& url) const
     QString appName = QCoreApplication::applicationName();
     if (!appName.isEmpty()) {
         ua.append(appName);
-#if QT_VERSION >= 0x040400
         QString appVer = QCoreApplication::applicationVersion();
         if (!appVer.isEmpty())
             ua.append(QLatin1Char('/') + appVer);
-#endif
     } else {
         // Qt version
         ua.append(QLatin1String("Qt/"));
         ua.append(QLatin1String(qVersion()));
     }
 
-    ua.append(QString(QLatin1String(" Safari/%1"))
-                      .arg(qWebKitVersion()));
-
+#if defined(Q_WS_S60) || defined(Q_WS_MAEMO_5)
+    ua.append(QString(QLatin1String(" Mobile Safari/%1")).arg(qWebKitVersion()));
+#else
+    ua.append(QString(QLatin1String(" Safari/%1")).arg(qWebKitVersion()));
+#endif
     return ua;
 }
 
@@ -3460,7 +3558,11 @@ quint64 QWebPage::bytesReceived() const
 /*!
     \fn void QWebPage::unsupportedContent(QNetworkReply *reply)
 
-    This signal is emitted when WebKit cannot handle a link the user navigated to.
+    This signal is emitted when WebKit cannot handle a link the user navigated to or a
+    web server's response includes a "Content-Disposition" header with the 'attachment' 
+    directive. If "Content-Disposition" is present in \a reply, the web server is indicating
+    that the client should prompt the user to save the content regardless of content-type. 
+    See RFC 2616 sections 19.5.1 for details about Content-Disposition.
 
     At signal emission time the meta-data of the QNetworkReply \a reply is available.
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
index 8c455b1490..24d0ed9cf4 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
@@ -54,6 +54,7 @@ namespace WebCore {
     class EditorClientQt;
     class FrameLoaderClientQt;
     class InspectorClientQt;
+    class InspectorFrontendClientQt;
     class ResourceHandle;
     class HitTestResult;
     class QNetworkReplyHandler;
@@ -208,20 +209,8 @@ public:
     QUndoStack *undoStack() const;
 #endif
 
-#if QT_VERSION < 0x040400 && !defined(qdoc)
-    void setNetworkInterface(QWebNetworkInterface *interface);
-    QWebNetworkInterface *networkInterface() const;
-
-    // #### why is this in the page itself?
-#ifndef QT_NO_NETWORKPROXY
-    void setNetworkProxy(const QNetworkProxy& proxy);
-    QNetworkProxy networkProxy() const;
-#endif
-
-#else
     void setNetworkAccessManager(QNetworkAccessManager *manager);
     QNetworkAccessManager *networkAccessManager() const;
-#endif
 
     void setPluginFactory(QWebPluginFactory *factory);
     QWebPluginFactory *pluginFactory() const;
@@ -334,10 +323,8 @@ Q_SIGNALS:
     void statusBarVisibilityChangeRequested(bool visible);
     void menuBarVisibilityChangeRequested(bool visible);
 
-#if QT_VERSION >= 0x040400
     void unsupportedContent(QNetworkReply *reply);
     void downloadRequested(const QNetworkRequest &request);
-#endif
 
     void microFocusChanged();
     void contentsChanged();
@@ -350,11 +337,7 @@ protected:
     virtual QWebPage *createWindow(WebWindowType type);
     virtual QObject *createPlugin(const QString &classid, const QUrl &url, const QStringList &paramNames, const QStringList &paramValues);
 
-#if QT_VERSION >= 0x040400
     virtual bool acceptNavigationRequest(QWebFrame *frame, const QNetworkRequest &request, NavigationType type);
-#else
-    virtual bool acceptNavigationRequest(QWebFrame *frame, const QWebNetworkRequest &request, NavigationType type);
-#endif
     virtual QString chooseFile(QWebFrame *originatingFrame, const QString& oldFile);
     virtual void javaScriptAlert(QWebFrame *originatingFrame, const QString& msg);
     virtual bool javaScriptConfirm(QWebFrame *originatingFrame, const QString& msg);
@@ -373,12 +356,15 @@ private:
     friend class QWebFrame;
     friend class QWebPagePrivate;
     friend class QWebView;
+    friend class QWebViewPrivate;
     friend class QGraphicsWebView;
+    friend class QGraphicsWebViewPrivate;
     friend class QWebInspector;
     friend class WebCore::ChromeClientQt;
     friend class WebCore::EditorClientQt;
     friend class WebCore::FrameLoaderClientQt;
     friend class WebCore::InspectorClientQt;
+    friend class WebCore::InspectorFrontendClientQt;
     friend class WebCore::ResourceHandle;
     friend class WebCore::QNetworkReplyHandler;
 };
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
index f0f842d099..0712d0cc39 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
@@ -62,6 +62,10 @@ class QWebPagePrivate {
 public:
     QWebPagePrivate(QWebPage*);
     ~QWebPagePrivate();
+
+    static WebCore::Page* core(QWebPage*);
+    static QWebPagePrivate* priv(QWebPage*);
+
     void createMainFrame();
 #ifndef QT_NO_CONTEXTMENU
     QMenu* createContextMenu(const WebCore::ContextMenu* webcoreMenu, const QList<WebCore::ContextMenuItem>* items, QBitArray* visitedWebActions);
@@ -114,6 +118,10 @@ public:
     void handleSoftwareInputPanel(Qt::MouseButton);
     bool handleScrolling(QKeyEvent*, WebCore::Frame*);
 
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    void touchEvent(QTouchEvent*);
+#endif
+
     void setInspector(QWebInspector*);
     QWebInspector* getOrCreateInspector();
     WebCore::InspectorController* inspectorController();
@@ -151,18 +159,8 @@ public:
 
     bool clickCausedFocus;
 
-#if QT_VERSION < 0x040400
-    bool acceptNavigationRequest(QWebFrame *frame, const QWebNetworkRequest &request, QWebPage::NavigationType type);
-
-    QWebNetworkInterface *networkInterface;
-#ifndef QT_NO_NETWORKPROXY
-    QNetworkProxy networkProxy;
-#endif
-
-#else
     bool acceptNavigationRequest(QWebFrame *frame, const QNetworkRequest &request, QWebPage::NavigationType type);
     QNetworkAccessManager *networkManager;
-#endif
 
     bool forwardUnsupportedContent;
     QWebPage::LinkDelegationPolicy linkPolicy;
@@ -186,6 +184,9 @@ public:
     QWidget* inspectorFrontend;
     QWebInspector* inspector;
     bool inspectorIsInternalOnly; // True if created through the Inspect context menu action
+    Qt::DropAction m_lastDropAction;
+
+    QString viewMode;
 
     static bool drtRun;
 };
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp
index 2a225c5765..6c26bd7ab4 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp
@@ -40,6 +40,11 @@ void QWEBKIT_EXPORT qt_drt_resetOriginAccessWhiteLists()
     SecurityOrigin::resetOriginAccessWhiteLists();
 }
 
+void QWEBKIT_EXPORT qt_drt_setDomainRelaxationForbiddenForURLScheme(bool forbidden, const QString& scheme)
+{
+    SecurityOrigin::setDomainRelaxationForbiddenForURLScheme(forbidden, scheme);
+}
+
 /*!
     \class QWebSecurityOrigin
     \since 4.5
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
index 79ef16f761..c759445dc2 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
@@ -26,6 +26,7 @@
 
 #include "Cache.h"
 #include "CrossOriginPreflightResultCache.h"
+#include "Database.h"
 #include "FontCache.h"
 #include "Page.h"
 #include "PageCache.h"
@@ -73,6 +74,7 @@ public:
     QString localStoragePath;
     QString offlineWebApplicationCachePath;
     qint64 offlineStorageDefaultQuota;
+    QUrl inspectorLocation;
 
     void apply();
     WebCore::Settings* settings;
@@ -90,6 +92,7 @@ static WebGraphicHash* graphics()
         hash->insert(QWebSettings::MissingPluginGraphic, QPixmap(QLatin1String(":webkit/resources/nullPlugin.png")));
         hash->insert(QWebSettings::DefaultFrameIconGraphic, QPixmap(QLatin1String(":webkit/resources/urlIcon.png")));
         hash->insert(QWebSettings::TextAreaSizeGripCornerGraphic, QPixmap(QLatin1String(":webkit/resources/textAreaResizeCorner.png")));
+        hash->insert(QWebSettings::DeleteButtonGraphic, QPixmap(QLatin1String(":webkit/resources/deleteButton.png")));
     }
 
     return hash;
@@ -151,7 +154,19 @@ void QWebSettingsPrivate::apply()
         value = attributes.value(QWebSettings::JavascriptEnabled,
                                       global->attributes.value(QWebSettings::JavascriptEnabled));
         settings->setJavaScriptEnabled(value);
+#if USE(ACCELERATED_COMPOSITING)
+        value = attributes.value(QWebSettings::AcceleratedCompositingEnabled,
+                                      global->attributes.value(QWebSettings::AcceleratedCompositingEnabled));
 
+        settings->setAcceleratedCompositingEnabled(value);
+#endif
+#if ENABLE(3D_CANVAS)
+        value = attributes.value(QWebSettings::WebGLEnabled,
+                                 global->attributes.value(QWebSettings::WebGLEnabled));
+
+        settings->setWebGLEnabled(value);
+#endif
+ 
         value = attributes.value(QWebSettings::JavascriptCanOpenWindows,
                                       global->attributes.value(QWebSettings::JavascriptCanOpenWindows));
         settings->setJavaScriptCanOpenWindowsAutomatically(value);
@@ -168,6 +183,10 @@ void QWebSettingsPrivate::apply()
                                       global->attributes.value(QWebSettings::PrivateBrowsingEnabled));
         settings->setPrivateBrowsingEnabled(value);
 
+        value = attributes.value(QWebSettings::SpatialNavigationEnabled,
+                                      global->attributes.value(QWebSettings::SpatialNavigationEnabled));
+        settings->setSpatialNavigationEnabled(value);
+
         value = attributes.value(QWebSettings::JavascriptCanAccessClipboard,
                                       global->attributes.value(QWebSettings::JavascriptCanAccessClipboard));
         settings->setDOMPasteAllowed(value);
@@ -176,6 +195,10 @@ void QWebSettingsPrivate::apply()
                                       global->attributes.value(QWebSettings::DeveloperExtrasEnabled));
         settings->setDeveloperExtrasEnabled(value);
 
+        value = attributes.value(QWebSettings::FrameFlatteningEnabled,
+                                      global->attributes.value(QWebSettings::FrameFlatteningEnabled));
+        settings->setFrameFlatteningEnabled(value);
+
         QUrl location = !userStyleSheetLocation.isEmpty() ? userStyleSheetLocation : global->userStyleSheetLocation;
         settings->setUserStyleSheetLocation(WebCore::KURL(location));
 
@@ -187,15 +210,17 @@ void QWebSettingsPrivate::apply()
 
         value = attributes.value(QWebSettings::ZoomTextOnly,
                                  global->attributes.value(QWebSettings::ZoomTextOnly));
-        settings->setZoomsTextOnly(value);
+        settings->setZoomMode(value ? WebCore::ZoomTextOnly : WebCore::ZoomPage);
 
         value = attributes.value(QWebSettings::PrintElementBackgrounds,
                                       global->attributes.value(QWebSettings::PrintElementBackgrounds));
         settings->setShouldPrintBackgrounds(value);
 
+#if ENABLE(DATABASE)
         value = attributes.value(QWebSettings::OfflineStorageDatabaseEnabled,
                                       global->attributes.value(QWebSettings::OfflineStorageDatabaseEnabled));
-        settings->setDatabasesEnabled(value);
+        WebCore::Database::setIsAvailable(value);
+#endif
 
         value = attributes.value(QWebSettings::OfflineWebApplicationCacheEnabled,
                                       global->attributes.value(QWebSettings::OfflineWebApplicationCacheEnabled));
@@ -203,12 +228,26 @@ void QWebSettingsPrivate::apply()
 
         value = attributes.value(QWebSettings::LocalStorageEnabled,
                                       global->attributes.value(QWebSettings::LocalStorageEnabled));
-                                                                                                                                  
         settings->setLocalStorageEnabled(value);
 
         value = attributes.value(QWebSettings::LocalContentCanAccessRemoteUrls,
                                       global->attributes.value(QWebSettings::LocalContentCanAccessRemoteUrls));
         settings->setAllowUniversalAccessFromFileURLs(value);
+
+        value = attributes.value(QWebSettings::LocalContentCanAccessFileUrls,
+                                      global->attributes.value(QWebSettings::LocalContentCanAccessFileUrls));
+        settings->setAllowFileAccessFromFileURLs(value);
+
+        value = attributes.value(QWebSettings::XSSAuditorEnabled,
+                                      global->attributes.value(QWebSettings::XSSAuditorEnabled));
+        settings->setXSSAuditorEnabled(value);
+
+#if ENABLE(TILED_BACKING_STORE)
+        value = attributes.value(QWebSettings::TiledBackingStoreEnabled,
+                                      global->attributes.value(QWebSettings::TiledBackingStoreEnabled));
+        settings->setTiledBackingStoreEnabled(value);
+#endif
+
         settings->setUsesPageCache(WebCore::pageCache()->capacity());
     } else {
         QList<QWebSettingsPrivate*> settings = *::allSettings();
@@ -338,6 +377,13 @@ QWebSettings* QWebSettings::globalSettings()
         Currently this enables the "Inspect" element in the context menu as
         well as the use of QWebInspector which controls the WebKit WebInspector
         for web site debugging.
+    \value SpatialNavigationEnabled Enables or disables the Spatial Navigation
+        feature, which consists in the ability to navigate between focusable
+        elements in a Web page, such as hyperlinks and form controls, by using
+        Left, Right, Up and Down arrow keys. For example, if an user presses the
+        Right key, heuristics determine whether there is an element he might be
+        trying to reach towards the right, and if there are multiple elements,
+        which element he probably wants.
     \value LinksIncludedInFocusChain Specifies whether hyperlinks should be
         included in the keyboard focus chain.
     \value ZoomTextOnly Specifies whether the zoom factor on a frame applies to
@@ -353,6 +399,25 @@ QWebSettings* QWebSettings::globalSettings()
     \value LocalStorageDatabaseEnabled \e{This enum value is deprecated.} Use
         QWebSettings::LocalStorageEnabled instead.
     \value LocalContentCanAccessRemoteUrls Specifies whether locally loaded documents are allowed to access remote urls.
+    \value LocalContentCanAccessFileUrls Specifies whether locally loaded documents are allowed to access other local urls.
+    \value XSSAuditorEnabled Specifies whether load requests should be monitored for cross-site scripting attempts.
+    \value AcceleratedCompositingEnabled This feature, when used in conjunction with
+        QGraphicsWebView, accelerates animations of web content. CSS animations of the transform and
+        opacity properties will be rendered by composing the cached content of the animated elements.
+        This feature is enabled by default
+    \value TiledBackingStoreEnabled This setting enables the tiled backing store feature
+        for a QGraphicsWebView. With the tiled backing store enabled, the web page contents in and around
+        the current visible area is speculatively cached to bitmap tiles. The tiles are automatically kept
+        in sync with the web page as it changes. Enabling tiling can significantly speed up painting heavy 
+        operations like scrolling. Enabling the feature increases memory consumption. It does not work well 
+        with contents using CSS fixed positioning (see also \l{QGraphicsWebView::}{resizesToContents} property).
+        \l{QGraphicsWebView::}{tiledBackingStoreFrozen} property allows application to temporarily freeze the contents of the backing store.
+    \value FrameFlatteningEnabled With this setting each subframe is expanded to its contents.
+        On touch devices, it is desired to not have any scrollable sub parts of the page
+        as it results in a confusing user experience, with scrolling sometimes scrolling sub parts
+        and at other times scrolling the page itself. For this reason iframes and framesets are
+        barely usable on touch devices. This will flatten all the frames to become one scrollable page.
+        Disabled by default.
 */
 
 /*!
@@ -376,6 +441,7 @@ QWebSettings::QWebSettings()
     d->attributes.insert(QWebSettings::AutoLoadImages, true);
     d->attributes.insert(QWebSettings::DnsPrefetchEnabled, false);
     d->attributes.insert(QWebSettings::JavascriptEnabled, true);
+    d->attributes.insert(QWebSettings::SpatialNavigationEnabled, false);
     d->attributes.insert(QWebSettings::LinksIncludedInFocusChain, true);
     d->attributes.insert(QWebSettings::ZoomTextOnly, false);
     d->attributes.insert(QWebSettings::PrintElementBackgrounds, true);
@@ -383,6 +449,11 @@ QWebSettings::QWebSettings()
     d->attributes.insert(QWebSettings::OfflineWebApplicationCacheEnabled, false);
     d->attributes.insert(QWebSettings::LocalStorageEnabled, false);
     d->attributes.insert(QWebSettings::LocalContentCanAccessRemoteUrls, false);
+    d->attributes.insert(QWebSettings::LocalContentCanAccessFileUrls, true);
+    d->attributes.insert(QWebSettings::AcceleratedCompositingEnabled, true);
+    d->attributes.insert(QWebSettings::WebGLEnabled, false);
+    d->attributes.insert(QWebSettings::TiledBackingStoreEnabled, false);
+    d->attributes.insert(QWebSettings::FrameFlatteningEnabled, false);
     d->offlineStorageDefaultQuota = 5 * 1024 * 1024;
     d->defaultTextEncoding = QLatin1String("iso-8859-1");
 }
@@ -451,7 +522,8 @@ void QWebSettings::resetFontSize(FontSize type)
     The \a location must be either a path on the local filesystem, or a data URL
     with UTF-8 and Base64 encoded data, such as:
 
-    "data:text/css;charset=utf-8;base64,cCB7IGJhY2tncm91bmQtY29sb3I6IHJlZCB9Ow==;"
+    "data:text/css;charset=utf-8;base64,cCB7IGJhY2tncm91bmQtY29sb3I6IHJlZCB9Ow=="
+    NOTE: In case the base 64 data is not valid the style will not be applied.
 
     \sa userStyleSheetUrl()
 */
@@ -884,6 +956,8 @@ QString QWebSettings::offlineWebApplicationCachePath()
 void QWebSettings::setOfflineWebApplicationCacheQuota(qint64 maximumSize)
 {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    WebCore::cacheStorage().empty();
+    WebCore::cacheStorage().vacuumDatabaseFile();
     WebCore::cacheStorage().setMaximumSize(maximumSize);
 #endif
 }
@@ -923,6 +997,31 @@ void QWebSettings::setLocalStoragePath(const QString& path)
 }
 
 /*!
+    \since 4.7
+
+    Specifies the \a location of a frontend to load with each web page when using Web Inspector.
+
+    \sa inspectorUrl()
+*/
+void QWebSettings::setInspectorUrl(const QUrl& location)
+{
+    d->inspectorLocation = location;
+    d->apply();
+}
+
+/*!
+    \since 4.7
+
+    Returns the location of the Web Inspector frontend.
+
+    \sa setInspectorUrl()
+*/
+QUrl QWebSettings::inspectorUrl() const
+{
+    return d->inspectorLocation;
+}
+
+/*!
     \since 4.6
     \relates QWebSettings
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
index 50cf424397..caba0d5dd6 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
@@ -67,13 +67,21 @@ public:
         LocalStorageDatabaseEnabled = LocalStorageEnabled,
 #endif
         LocalContentCanAccessRemoteUrls,
-        DnsPrefetchEnabled
+        DnsPrefetchEnabled,
+        XSSAuditorEnabled,
+        AcceleratedCompositingEnabled,
+        WebGLEnabled,
+        SpatialNavigationEnabled,
+        LocalContentCanAccessFileUrls,
+        TiledBackingStoreEnabled,
+        FrameFlatteningEnabled
     };
     enum WebGraphic {
         MissingImageGraphic,
         MissingPluginGraphic,
         DefaultFrameIconGraphic,
-        TextAreaSizeGripCornerGraphic
+        TextAreaSizeGripCornerGraphic,
+        DeleteButtonGraphic
     };
     enum FontSize {
         MinimumFontSize,
@@ -129,6 +137,9 @@ public:
     void setLocalStoragePath(const QString& path);
     QString localStoragePath() const; 
 
+    void setInspectorUrl(const QUrl &location);
+    QUrl inspectorUrl() const;
+
     static void clearMemoryCaches();
 
     static void enablePersistentStorage(const QString& path = QString());
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
index 79538ff8e1..4387f4ae52 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
@@ -22,10 +22,11 @@
 #include "config.h"
 #include "qwebview.h"
 
+#include "Page.h"
 #include "QWebPageClient.h"
+#include "Settings.h"
 #include "qwebframe.h"
 #include "qwebpage_p.h"
-
 #include "qbitmap.h"
 #include "qevent.h"
 #include "qpainter.h"
@@ -44,6 +45,7 @@ public:
     }
 
     void _q_pageDestroyed();
+    void unsetPageIfExists();
 
     QWebView *view;
     QWebPage *page;
@@ -59,96 +61,141 @@ void QWebViewPrivate::_q_pageDestroyed()
 
 #ifdef Q_WS_MAEMO_5
 #include "qabstractkineticscroller.h"
+#include "qapplication.h"
+
+// QCoreApplication::sendSpontaneousEvent() is private, hence this friend wrapper
+bool qt_sendSpontaneousEvent(QObject* receiver, QEvent* ev)
+{
+    return QCoreApplication::sendSpontaneousEvent(receiver, ev);
+}
 
-class QWebViewKineticScroller : public QAbstractKineticScroller {
+class QWebViewKineticScroller : public QObject, public QAbstractKineticScroller {
 public:
-    QWebViewKineticScroller() : QAbstractKineticScroller() {}
-    // remember the frame where the button was pressed
+    QWebViewKineticScroller()
+        : QObject()
+        , QAbstractKineticScroller()
+        , m_view(0)
+        , m_ignoreEvents(false)
+    {
+    }
+
+    void setWidget(QWebView* widget)
+    {
+        if (m_view) {
+            m_view->removeEventFilter(this);
+            QWebFrame* frame = m_view->page()->mainFrame();
+            frame->setScrollBarPolicy(Qt::Vertical, m_oldVerticalScrollBarPolicy);
+            frame->setScrollBarPolicy(Qt::Horizontal, m_oldHorizontalScrollBarPolicy);
+        }
+
+        m_view = widget;
+        setParent(m_view);
+        if (m_view) {
+            QWebFrame* frame = m_view->page()->mainFrame();
+            m_oldHorizontalScrollBarPolicy = frame->scrollBarPolicy(Qt::Horizontal);
+            m_oldVerticalScrollBarPolicy = frame->scrollBarPolicy(Qt::Vertical);
+            frame->setScrollBarPolicy(Qt::Vertical, Qt::ScrollBarAlwaysOff);
+            frame->setScrollBarPolicy(Qt::Horizontal, Qt::ScrollBarAlwaysOff);
+            m_view->installEventFilter(this);
+        }
+    }
+
+protected:
     bool eventFilter(QObject* o, QEvent* ev)
     {
+        if (!o || m_view != o || m_ignoreEvents || !m_view->isEnabled())
+            return QObject::eventFilter(o, ev);
+
+        bool res = false;
+
         switch (ev->type()) {
         case QEvent::MouseButtonPress: {
+            // remember the frame where the button was pressed
             QWebFrame* hitFrame = scrollingFrameAt(static_cast<QMouseEvent*>(ev)->pos());
             if (hitFrame)
                 m_frame = hitFrame;
-            break;
+            // fall through
         }
+        case QEvent::MouseMove:
+        case QEvent::MouseButtonRelease:
+        case QEvent::MouseButtonDblClick:
+            res = handleMouseEvent(static_cast<QMouseEvent*>(ev));
+            break;
         default:
             break;
         }
-        return QAbstractKineticScroller::eventFilter(o, ev);
+        return res ? true : QObject::eventFilter(o, ev);
     }
 
-protected:
-    QWebFrame* currentFrame() const
+    void cancelLeftMouseButtonPress(const QPoint& /* globalPressPos */)
     {
-        if (!m_frame.isNull())
-            return m_frame.data();
-
-        QWebView* view = static_cast<QWebView*>(widget());
-        QWebFrame* frame = view->page()->mainFrame();
-        return frame;
+        QMouseEvent cmem(QEvent::MouseMove, QPoint(-INT_MAX, -INT_MAX), Qt::LeftButton, QApplication::mouseButtons() | Qt::LeftButton, QApplication::keyboardModifiers());
+        sendEvent(m_view, &cmem);
+        QMouseEvent cmer(QEvent::MouseButtonRelease, QPoint(-INT_MAX, -INT_MAX), Qt::LeftButton, QApplication::mouseButtons() & ~Qt::LeftButton, QApplication::keyboardModifiers());
+        sendEvent(m_view, &cmer);
     }
 
-    // Returns the innermost frame at the given position that can scroll.
-    QWebFrame* scrollingFrameAt(const QPoint& pos) const
+    QWebFrame* currentFrame() const
     {
-        QWebView* view = static_cast<QWebView*>(widget());
-        QWebFrame* mainFrame = view->page()->mainFrame();
-        QWebFrame* hitFrame = mainFrame->hitTestContent(pos).frame();
-        QSize range = hitFrame->contentsSize() - hitFrame->geometry().size();
+        if (m_frame)
+            return m_frame;
 
-        while (hitFrame && range.width() <= 1 && range.height() <= 1)
-            hitFrame = hitFrame->parentFrame();
+        if (m_view)
+            return m_view->page()->mainFrame();
 
-        return hitFrame;
+        return 0;
     }
 
-    void attachToWidget()
+    // Returns the innermost frame at the given position that can scroll.
+    QWebFrame* scrollingFrameAt(const QPoint& pos) const
     {
-        QWebView* view = static_cast<QWebView*>(widget());
-        QWebFrame* mainFrame = view->page()->mainFrame();
-        m_oldHorizontalScrollBarPolicy = mainFrame->scrollBarPolicy(Qt::Horizontal);
-        m_oldVerticalScrollBarPolicy = mainFrame->scrollBarPolicy(Qt::Vertical);
-        mainFrame->setScrollBarPolicy(Qt::Vertical, Qt::ScrollBarAlwaysOff);
-        mainFrame->setScrollBarPolicy(Qt::Horizontal, Qt::ScrollBarAlwaysOff);
-        view->installEventFilter(this);
-    }
+        QWebFrame* hitFrame = 0;
+        if (m_view) {
+            QWebFrame* frame = m_view->page()->mainFrame();
+            hitFrame = frame->hitTestContent(pos).frame();
+            QSize range = hitFrame->contentsSize() - hitFrame->geometry().size();
 
-    void removeFromWidget()
-    {
-        QWebView* view = static_cast<QWebView*>(widget());
-        view->removeEventFilter(this);
-        QWebFrame* mainFrame = view->page()->mainFrame();
-        mainFrame->setScrollBarPolicy(Qt::Vertical, m_oldVerticalScrollBarPolicy);
-        mainFrame->setScrollBarPolicy(Qt::Horizontal, m_oldHorizontalScrollBarPolicy);
+            while (hitFrame && range.width() <= 1 && range.height() <= 1)
+                hitFrame = hitFrame->parentFrame();
+
+            return hitFrame;
+        }
     }
 
-    QRect positionRange() const
+    QPoint maximumScrollPosition() const
     {
-        QRect r;
         QWebFrame* frame = currentFrame();
-        r.setSize(frame->contentsSize() - frame->geometry().size());
-        return r;
+        QSize s = frame ? frame->contentsSize() - frame->geometry().size() : QSize(0, 0);
+        return QPoint(qMax(0, s.width()), qMax(0, s.height()));
     }
 
-    QPoint position() const
+    QPoint scrollPosition() const
     {
         QWebFrame* frame = currentFrame();
-        return frame->scrollPosition();
+        return frame ? frame->scrollPosition() : QPoint();
     }
 
     QSize viewportSize() const
     {
-        return static_cast<QWebView*>(widget())->page()->viewportSize();
+        return m_view ? m_view->page()->viewportSize() : QSize();
     }
 
-    void setPosition(const QPoint& point, const QPoint& /* overShootDelta */)
+    void setScrollPosition(const QPoint& point, const QPoint& /* overShootDelta */)
     {
         QWebFrame* frame = currentFrame();
-        frame->setScrollPosition(point);
+        if (frame)
+            frame->setScrollPosition(point);
     }
 
+    void sendEvent(QWidget* w, QEvent* ev)
+    {
+        m_ignoreEvents = true;
+        qt_sendSpontaneousEvent(w, ev);
+        m_ignoreEvents = false;
+    }
+
+    QWebView* m_view;
+    bool m_ignoreEvents;
     QPointer<QWebFrame> m_frame;
     Qt::ScrollBarPolicy m_oldVerticalScrollBarPolicy;
     Qt::ScrollBarPolicy m_oldHorizontalScrollBarPolicy;
@@ -253,9 +300,13 @@ QWebView::QWebView(QWidget *parent)
     setAttribute(Qt::WA_InputMethodEnabled);
 #endif
 
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    setAttribute(Qt::WA_AcceptTouchEvents);
+#endif
 #if defined(Q_WS_MAEMO_5)
     QAbstractKineticScroller* scroller = new QWebViewKineticScroller();
-    scroller->setWidget(this);
+    static_cast<QWebViewKineticScroller*>(scroller)->setWidget(this);
+    setProperty("kineticScroller", QVariant::fromValue(scroller));
 #endif
     setAcceptDrops(true);
 
@@ -297,6 +348,29 @@ QWebPage *QWebView::page() const
     return d->page;
 }
 
+void QWebViewPrivate::unsetPageIfExists()
+{
+    if (!page)
+        return;
+
+    // if the page client is the special client constructed for
+    // delegating the responsibilities to a QWidget, we need
+    // to destroy it.
+
+    if (page->d->client && page->d->client->isQWidgetClient())
+        delete page->d->client;
+
+    page->d->client = 0;
+
+    // if the page was created by us, we own it and need to
+    // destroy it as well.
+
+    if (page->parent() == view)
+        delete page;
+    else
+        page->disconnect(view);
+}
+
 /*!
     Makes \a page the new web page of the web view.
 
@@ -310,14 +384,10 @@ void QWebView::setPage(QWebPage* page)
 {
     if (d->page == page)
         return;
-    if (d->page) {
-        d->page->d->client = 0; // unset the page client
-        if (d->page->parent() == this)
-            delete d->page;
-        else
-            d->page->disconnect(this);
-    }
+
+    d->unsetPageIfExists();
     d->page = page;
+
     if (d->page) {
         d->page->setView(this);
         d->page->setPalette(palette());
@@ -345,6 +415,9 @@ void QWebView::setPage(QWebPage* page)
                 this, SLOT(updateMicroFocus()));
         connect(d->page, SIGNAL(destroyed()),
                 this, SLOT(_q_pageDestroyed()));
+#if USE(ACCELERATED_COMPOSITING)
+        d->page->d->page->settings()->setAcceleratedCompositingEnabled(false);
+#endif
     }
     setAttribute(Qt::WA_OpaquePaintEvent, d->page);
     update();
@@ -374,19 +447,11 @@ void QWebView::load(const QUrl &url)
     \sa url(), urlChanged()
 */
 
-#if QT_VERSION < 0x040400 && !defined(qdoc)
-void QWebView::load(const QWebNetworkRequest &request)
-#else
 void QWebView::load(const QNetworkRequest &request,
                     QNetworkAccessManager::Operation operation,
                     const QByteArray &body)
-#endif
 {
-    page()->mainFrame()->load(request
-#if QT_VERSION >= 0x040400
-                              , operation, body
-#endif
-                             );
+    page()->mainFrame()->load(request, operation, body);
 }
 
 /*!
@@ -740,7 +805,6 @@ bool QWebView::event(QEvent *e)
         if (e->type() == QEvent::ShortcutOverride) {
             d->page->event(e);
 #ifndef QT_NO_CURSOR
-#if QT_VERSION >= 0x040400
         } else if (e->type() == QEvent::CursorChange) {
             // An unsetCursor will set the cursor to Qt::ArrowCursor.
             // Thus this cursor change might be a QWidget::unsetCursor()
@@ -753,6 +817,13 @@ bool QWebView::event(QEvent *e)
             if (cursor().shape() == Qt::ArrowCursor)
                 d->page->d->client->resetCursor();
 #endif
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+        } else if (e->type() == QEvent::TouchBegin 
+                   || e->type() == QEvent::TouchEnd 
+                   || e->type() == QEvent::TouchUpdate) {
+            d->page->event(e);
+            if (e->isAccepted())
+                return true;
 #endif
         } else if (e->type() == QEvent::Leave)
             d->page->event(e);
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h
index 0f79c704ff..f681fbcd97 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h
@@ -27,9 +27,7 @@
 #include <QtGui/qicon.h>
 #include <QtGui/qpainter.h>
 #include <QtCore/qurl.h>
-#if QT_VERSION >= 0x040400
 #include <QtNetwork/qnetworkaccessmanager.h>
-#endif
 
 QT_BEGIN_NAMESPACE
 class QNetworkRequest;
@@ -61,13 +59,9 @@ public:
     void setPage(QWebPage* page);
 
     void load(const QUrl& url);
-#if QT_VERSION < 0x040400 && !defined(qdoc)
-    void load(const QWebNetworkRequest& request);
-#else
     void load(const QNetworkRequest& request,
               QNetworkAccessManager::Operation operation = QNetworkAccessManager::GetOperation,
               const QByteArray &body = QByteArray());
-#endif
     void setHtml(const QString& html, const QUrl& baseUrl = QUrl());
     void setContent(const QByteArray& data, const QString& mimeType = QString(), const QUrl& baseUrl = QUrl());
 
diff --git a/src/3rdparty/webkit/WebKit/qt/ChangeLog b/src/3rdparty/webkit/WebKit/qt/ChangeLog
index 64726c2a10..b6176de0c7 100644
--- a/src/3rdparty/webkit/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/qt/ChangeLog
@@ -1,3 +1,340 @@
+2010-04-02  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Maemo5 theme - customized popup for <select multiple> elements
+        https://bugs.webkit.org/show_bug.cgi?id=36368
+
+        Using QtMaemoWebPopup instead of QtFallbackWebPopup for Maemo.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::createSelectPopup):
+        * WebCoreSupport/QtFallbackWebPopup.cpp:
+        (WebCore::QtFallbackWebPopup::show):
+        (WebCore::QtFallbackWebPopup::populate):
+
+2010-04-01  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add Single and Multiple Selection Popup for Maemo 5.
+
+        [Qt] Maemo5 theme - popup dialogs
+        https://bugs.webkit.org/show_bug.cgi?id=36789
+
+        * WebCoreSupport/QtMaemoWebPopup.cpp:
+        (WebCore::Maemo5Popup::populateList):
+        (WebCore::Maemo5Popup::onItemSelected):
+        (WebCore::QtMaemoWebPopup::createSingleSelectionPopup):
+        (WebCore::QtMaemoWebPopup::createMultipleSelectionPopup):
+        (WebCore::Maemo5SingleSelectionPopup::Maemo5SingleSelectionPopup):
+        (WebCore::MultipleItemListDelegate::MultipleItemListDelegate):
+        (WebCore::MultipleItemListDelegate::paint):
+        (WebCore::Maemo5MultipleSelectionPopup::Maemo5MultipleSelectionPopup):
+        * WebCoreSupport/QtMaemoWebPopup.h:
+
+2010-03-30  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Maemo5 theme - QtMaemoWebPopup class
+        https://bugs.webkit.org/show_bug.cgi?id=36790
+
+        A new QtAbstractWebPopup descendant class to be used for maemo menu lists.
+        This is the first step. The next step will be the dialogs implementation that
+        will come in bug 36789 and finally to use QtMaemoWebPopup instead of QtFallbackWebPopup
+        that will come in bug 36368.
+
+        * WebCoreSupport/QtMaemoWebPopup.cpp: Added.
+        (WebCore::QtMaemoWebPopup::QtMaemoWebPopup):
+        (WebCore::QtMaemoWebPopup::~QtMaemoWebPopup):
+        (WebCore::QtMaemoWebPopup::createSingleSelectionPopup):
+        (WebCore::QtMaemoWebPopup::createMultipleSelectionPopup):
+        (WebCore::QtMaemoWebPopup::createPopup):
+        (WebCore::QtMaemoWebPopup::show):
+        (WebCore::QtMaemoWebPopup::hide):
+        (WebCore::QtMaemoWebPopup::popupClosed):
+        (WebCore::QtMaemoWebPopup::itemClicked):
+        * WebCoreSupport/QtMaemoWebPopup.h: Added.
+        (WebCore::Maemo5Popup::Maemo5Popup):
+
+2010-03-31  Antti Koivisto  <koivisto@iki.fi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36446
+        [Qt] QWebSettings::TiledBackingStoreEnabled attribute lacks documentation and default value
+
+        * Api/qgraphicswebview.cpp:
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+
+2010-03-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        Change due to renaming of frame flattening setting.
+
+        * Api/qwebpage.cpp:
+        (qt_drt_setFrameFlatteningEnabled):
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        * symbian/eabi/QtWebKitu.def:
+
+2010-03-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        Use 'Mobile Safari' instead of 'Safari' on mobile Qt platforms.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::userAgentForUrl):
+
+2010-03-22  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add support for Widgets 1.0: View Mode Media Feature
+        https://bugs.webkit.org/show_bug.cgi?id=35446
+
+        Add an internal Qt API for changing the view mode media feature
+        (http://www.w3.org/TR/widgets-vmmf/).
+
+        * Api/qwebpage.cpp:
+        (qt_wrt_setViewMode):
+        (QWebPagePrivate::priv):
+        * Api/qwebpage_p.h:
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::isDocked):
+        (WebCore::ChromeClientQt::isFloating):
+        (WebCore::ChromeClientQt::isApplication):
+        (WebCore::ChromeClientQt::isFullscreen):
+        * WebCoreSupport/ChromeClientQt.h:
+
+2010-03-29  Dawit Alemayehu  <adawit@kde.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Added support for handling the HTTP "Content-Disposition" header.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36395
+
+        Whenever a server response contains a "Content-Disposition: attachment..." header, 
+        treat the request as a download and emit the unsupportedContent signal.
+
+        * Api/qwebpage.cpp:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::download):
+        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForMIMEType):
+
+2010-03-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] unit tests don't compile inside of Qt
+
+        https://bugs.webkit.org/show_bug.cgi?id=36756
+
+        * tests/tests.pri: Don't do the target substitution inside Qt and find the sources
+        through VPATH instead of relying on the location of the .pro file exclusively.
+
+2010-03-25  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QtLauncher crashes on Mac OS and Linux when exiting with QGraphicsView mode enabled
+        https://bugs.webkit.org/show_bug.cgi?id=35251
+
+        Followed the way QWebView registers for the signal QWebPage::destroyed(), to prevent
+        QGraphicsWebView from referencing QWebPage after it was deleted.        
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::_q_pageDestroyed):
+        (QGraphicsWebView::setPage):
+        * Api/qgraphicswebview.h:
+
+2010-03-26  Olivier Goffart  <ogoffart@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Compile with QT_USE_FAST_OPERATOR_PLUS
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::populateSetting):
+        (WebCore::InspectorClientQt::storeSetting):
+
+2010-03-26  David Boddie  <dboddie@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Doc: Simplified Commercial Editions for Qt 4.7.
+
+        * docs/qtwebkit.qdoc:
+
+2010-03-25  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make QWebPage not depend on view() but use the client->ownerWidget()
+        instead. Also, handle the case where there is not page client.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::createContextMenu):
+        (QWebPagePrivate::keyPressEvent):
+        (QWebPage::javaScriptAlert):
+        (QWebPage::javaScriptConfirm):
+        (QWebPage::javaScriptPrompt):
+        (QWebPage::shouldInterruptJavaScript):
+        (QWebPage::createWindow):
+        (QWebPage::action):
+        (QWebPage::extension):
+        (QWebPage::chooseFile):
+        (QWebPage::userAgentForUrl):
+
+2010-03-23  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Calling setView(0) on a QWebPage being shown by a QGraphicsWebView,
+        would uninstall the page client, deleting the QGraphicsWebViewPrivate
+        instance. If called with an argument, it would do a wrong static_cast
+        and crash.
+
+        * Api/qwebpage.cpp:
+        (QWebPageWidgetClient::QWebPageWidgetClient):
+        (QWebPageWidgetClient::isQWidgetClient):
+        (QWebPageWidgetClient::screenNumber):
+        (QWebPage::QWebPage):
+        (QWebPage::setView):
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::unsetPageIfExists):
+        (QGraphicsWebView::setPage):
+        * Api/qwebpage.cpp:
+        (QWebPageWidgetClient::isQWidgetClient):
+        (QWebPageWidgetClient::screenNumber):
+        (QWebPage::QWebPage):
+        (QWebPage::setView):
+        * Api/qwebpage.h:
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::unsetPageIfExists):
+        (QWebView::setPage):
+
+2010-03-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement ChromeClient::windowResizerRect()
+
+        https://bugs.webkit.org/show_bug.cgi?id=21300
+
+        We assume the resize corner to be in the lower right corner of
+        the window and having the width and height of the scrollbars.
+
+        The helper function geometryRelativeToOwnerWidget() in the page
+        client is used to clip the resize rect to the actual size of the
+        viewport, not the size of the QGraphicsView.
+
+        * Api/qgraphicswebview.cpp:
+        * Api/qwebpage.cpp:
+        * WebCoreSupport/ChromeClientQt.cpp:
+
+2010-03-24  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add the FrameFlatteningEnabled WebAttribute to QWebSettings.
+
+        [Qt] Missing QWebSettings for Frame Flattening
+        https://bugs.webkit.org/show_bug.cgi?id=36553
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        * Api/qwebsettings.h:
+
+2010-03-26  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Symbian build fix.
+
+        [Qt] Updated the def file with new exports used by QtLauncher.
+
+        * symbian/eabi/QtWebKitu.def:
+
+2010-03-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make Icon::createIconForFiles() optional.
+        https://bugs.webkit.org/show_bug.cgi?id=35072
+
+        - Rename iconForFiles() to chooseIconForFiles().
+        - Call Icon::createIconForFiles() from chooseIconForFiles().
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::chooseIconForFiles):
+        * WebCoreSupport/ChromeClientQt.h:
+
+2010-03-23  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        QGraphicsWebView crash when calling setView on the QWebPage...
+        https://bugs.webkit.org/show_bug.cgi?id=36436
+
+        Checking for pageClient existance before showing popups.
+
+        * WebCoreSupport/QtFallbackWebPopup.cpp:
+        (WebCore::QtFallbackWebPopup::show):
+
+2010-03-23  Anders Bakken <anders.bakken@nokia.com>, Jesus Sanchez-Palencia <jesus.palencia@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Check if q->scene() is available before actually using it
+        on QGraphicsWebViewPrivate.
+
+        QGraphicsWebView crash
+        https://bugs.webkit.org/show_bug.cgi?id=32670
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::screenNumber):
+        (QGraphicsWebViewPrivate::ownerWidget):
+
+2010-03-23  David Leong  <david.leong@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Build fix for Symbian Def file.
+
+        * symbian/eabi/QtWebKitu.def:
+
+2010-03-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove support for Qt v4.4
+        https://bugs.webkit.org/show_bug.cgi?id=36389
+
+        * Api/qwebelement.cpp:
+        (QWebElement::classes):
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::editorActionForKeyEvent):
+        (QWebPage::userAgentForUrl):
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::handleKeyboardEvent):
+        * tests/tests.pro:
+
+2010-03-22  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix qdoc warnings
+        https://bugs.webkit.org/show_bug.cgi?id=36447
+
+        * Api/qgraphicswebview.cpp: Add missing ().
+        * Api/qwebframe.cpp: Remove reference to non-existent parameter "url".
+        * Api/qwebsettings.cpp:  Document parameter "location".
+
 2010-03-22  Jakub Wieczorek  <jwieczorek@webkit.org>
 
         Reviewed by Simon Hausmann.
@@ -23,28 +360,36 @@
         * tests/qwebpage/tst_qwebpage.cpp:
         (tst_QWebPage::inputMethods):
 
-2010-03-25  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
+2010-03-21  Kristian Amlie  <kristian.amlie@nokia.com>
 
-        [Qt] QtLauncher crashes on Mac OS and Linux when exiting with QGraphicsView mode enabled
-        https://bugs.webkit.org/show_bug.cgi?id=35251
+        Reviewed by Simon Hausmann.
 
-        Followed the way QWebView registers for the signal QWebPage::destroyed(), to prevent
-        QGraphicsWebView from referencing QWebPage after it was deleted.        
+        Fixed updating the VKB display when inputting into QGraphicsWebView.
+        https://bugs.webkit.org/show_bug.cgi?id=36292
 
         * Api/qgraphicswebview.cpp:
-        (QGraphicsWebViewPrivate::_q_pageDestroyed):
+        (QGraphicsWebViewPrivate::_q_updateMicroFocus):
         (QGraphicsWebView::setPage):
         * Api/qgraphicswebview.h:
 
-2010-03-23  David Leong  <david.leong@nokia.com>
+2010-03-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Reviewed by Laszlo Gombos.
+        Unreviewed.
 
-        Build fix for Symbian Def file.
+        Buildfix for Qt v4.5.
 
-        * symbian/eabi/QtWebKitu.def:
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewOverlay::q):
+
+2010-03-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Make it possible for the Qt DRT to set the media type from
+        the LayoutTestController.
+
+        * Api/qwebframe.cpp:
+        (qt_drt_setMediaType):
 
 2010-03-18  Joe Ligman  <joseph.ligman@nokia.com>
 
@@ -64,35 +409,286 @@
         * Api/qwebframe_p.h:
         * tests/qwebframe/tst_qwebframe.cpp:
 
-2009-12-18  Joe Ligman  <joseph.ligman@nokia.com>
+2010-03-18  Antti Koivisto  <koivisto@iki.fi>
 
         Reviewed by Kenneth Rohde Christiansen.
 
-        [Qt] Add new API to QWebFrame to scrollRecursively starting with any css overflow 
-        then checking current frame and then ancestors
-        https://bugs.webkit.org/show_bug.cgi?id=32668
+        https://bugs.webkit.org/show_bug.cgi?id=36102
+        [Qt] Scaling control API for tiled backing store
+        
+        The scale is set by passing the QGraphicsWebView scale to the backing store. The
+        only new API is the tiledBackingStoreFrozen property which allows disabling
+        all updates (for example during zoom animation).
 
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::_q_scaleChanged):
+        (QGraphicsWebViewPrivate::updateTiledBackingStoreScale):
+        (QGraphicsWebView::QGraphicsWebView):
+        (QGraphicsWebView::isTiledBackingStoreFrozen):
+        (QGraphicsWebView::setTiledBackingStoreFrozen):
+        * Api/qgraphicswebview.h:
         * Api/qwebframe.cpp:
-        (QWebFramePrivate::scrollOverflow):
-        (QWebFrame::scrollRecursively):
-        * Api/qwebframe.h:
         * Api/qwebframe_p.h:
-        * tests/qwebframe/qwebframe.qrc:
-        * tests/qwebframe/testiframe.html: Added.
-        * tests/qwebframe/testiframe2.html: Added.
-        * tests/qwebframe/tst_qwebframe.cpp:
 
-2010-03-21  Kristian Amlie  <kristian.amlie@nokia.com>
+2010-03-17  Antti Koivisto  <koivisto@iki.fi>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix Qt build with tiled backing store disabled.
+
+        * Api/qwebframe.cpp:
+        * Api/qwebframe_p.h:
+
+2010-03-17  Chang Shu  <chang.shu@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36139
+        [Qt] Clean up cache while setting cache quota. This behavior matches other platforms,
+        such as mac and gtk.
+
+         * Api/qwebsettings.cpp:
+        (QWebSettings::setOfflineWebApplicationCacheQuota):
+
+2010-03-17  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Enable accelerated compositing by default
+        https://bugs.webkit.org/show_bug.cgi?id=35866
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+
+2010-03-15  Antti Koivisto  <koivisto@iki.fi>
 
         Reviewed by Simon Hausmann.
 
-        Fixed updating the VKB display when inputting into QGraphicsWebView.
-        https://bugs.webkit.org/show_bug.cgi?id=36292
+        https://bugs.webkit.org/show_bug.cgi?id=36121
+        [Qt] Make WebKit scrollbars work with tiling
+        
+        - Use the scrollbar overlay (implemented for accelerated compositing) when in tiled mode. 
+        - Make overlay compile unconditionally, enable on demand. This removes bunch of unneeded ifdefs.
+        - Update the scroll position to the backing store as needed.
+        - Renamed some methods.
 
         * Api/qgraphicswebview.cpp:
-        (QGraphicsWebViewPrivate::_q_updateMicroFocus):
+        (QGraphicsWebViewPrivate::):
+        (QGraphicsWebViewPrivate::createOrDeleteOverlay):
+        (QGraphicsWebViewPrivate::setRootGraphicsLayer):
+        (QGraphicsWebViewPrivate::updateCompositingScrollPosition):
+        (QGraphicsWebViewPrivate::scroll):
+        (QGraphicsWebViewPrivate::update):
+        (QGraphicsWebViewPrivate::graphicsItemVisibleRect):
+        (QGraphicsWebView::paint):
         (QGraphicsWebView::setPage):
-        * Api/qgraphicswebview.h:
+        (QGraphicsWebView::updateGeometry):
+        (QGraphicsWebView::setGeometry):
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::renderFromTiledBackingStore):
+        * Api/qwebframe_p.h:
+
+2010-03-15  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix crash in QWebView::setPage()
+
+        tst_qwebpage was crashing on setPage(0)
+
+        https://bugs.webkit.org/show_bug.cgi?id=36137
+
+        * Api/qwebview.cpp:
+        (QWebView::setPage):
+
+2010-03-16  Yury Semikhatsky <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Introduce InspectorFrontendClient that provides InspectorFrontend with an interface to the embedder. InspectorClient now serves as a delegate for InspectorController and does not contain methods for managing inspector frontend window. That allows to create remote InspectorFrontendHost.
+
+        Introduce InspectorFrontendClient that would provide InspectorFrontend with an interface to the embedder
+        https://bugs.webkit.org/show_bug.cgi?id=35036
+
+        * Api/qwebinspector.cpp:
+        (QWebInspector::hideEvent):
+        (QWebInspector::closeEvent):
+        * Api/qwebinspector.h:
+        * Api/qwebpage.h:
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::openInspectorFrontend):
+        (WebCore::InspectorFrontendClientQt::InspectorFrontendClientQt):
+        (WebCore::InspectorFrontendClientQt::frontendLoaded):
+        (WebCore::InspectorFrontendClientQt::localizedStringsURL):
+        (WebCore::InspectorFrontendClientQt::hiddenPanels):
+        (WebCore::InspectorFrontendClientQt::bringToFront):
+        (WebCore::InspectorFrontendClientQt::closeWindow):
+        (WebCore::InspectorFrontendClientQt::attachWindow):
+        (WebCore::InspectorFrontendClientQt::detachWindow):
+        (WebCore::InspectorFrontendClientQt::setAttachedWindowHeight):
+        (WebCore::InspectorFrontendClientQt::inspectedURLChanged):
+        (WebCore::InspectorFrontendClientQt::updateWindowTitle):
+        * WebCoreSupport/InspectorClientQt.h:
+
+2010-03-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix if TILED_BACKING_STORE is disabled.
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::renderContentsLayerAbsoluteCoords):
+
+2010-03-14  Chang Shu  <chang.shu@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] [Symbian] Use Symbian native dialog providers for combo pupups.
+        https://bugs.webkit.org/show_bug.cgi?id=35919
+
+        * WebCoreSupport/QtFallbackWebPopup.cpp:
+        (WebCore::QtFallbackWebPopup::show):
+        (WebCore::ResetAndDestroy):
+        (WebCore::QtFallbackWebPopup::showS60BrowserDialog):
+        * WebCoreSupport/QtFallbackWebPopup.h:
+
+2010-03-14  Antti Koivisto  <koivisto@iki.fi>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35146
+        Support tiled backing store
+
+        Implements a basic tiled backing store mechanism. Tiles are created and 
+        deleted on demand. The page content is cached to the tiles. Tile content
+        is kept in sync with the document. Since the backing store covers area
+        larger than the currently visible viewport, the document can be scrolled
+        quickly without having to enter rendering tree painting.
+        
+        The tile management code is platform independent. This patch has simple QPixmap
+        based tile implementation for Qt.
+        
+        The feature is behind ENABLE_TILED_BACKING_STORE flag.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::visibleRect):
+        (QGraphicsWebView::paint):
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::renderContentsLayerAbsoluteCoords):
+        * Api/qwebframe.h:
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        * Api/qwebsettings.h:
+
+2010-03-13  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Enable accelerated compositing by default
+        https://bugs.webkit.org/show_bug.cgi?id=35866
+
+        Unreviewed. Roll-out r55955, because it broke 3 tests:
+        - animations/fill-mode-transform.html
+        - animations/play-state.html
+        - animations/simultaneous-start-left.html
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+
+2010-03-13  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Enable accelerated compositing by default
+        https://bugs.webkit.org/show_bug.cgi?id=35866
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+
+2010-03-11  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Remove invalidateContents, it isn't used and it never makes sense to only invalidate the contents.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        * WebCoreSupport/ChromeClientQt.h:
+
+2010-03-10  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add Support for WebKitEnableCaretBrowsing to Qt DRT
+
+        Unskip test fast/events/multiline-link-arrow-navigation.html
+        Fix typo (superfluous space) in QWebSettings docs.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35593
+
+        * Api/qwebpage.cpp:
+        (qt_drt_enableCaretBrowsing):
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply): fix typo in docs
+
+2010-03-02  Adam Treat  <atreat@rim.com>
+
+        Reviewed by Dave Hyatt.
+
+        Adapt the qt port to the refactoring of repaint methods.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34214
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::invalidateContents):
+        (WebCore::ChromeClientQt::invalidateWindow):
+        (WebCore::ChromeClientQt::invalidateContentsAndWindow):
+        (WebCore::ChromeClientQt::invalidateContentsForSlowScroll):
+        * WebCoreSupport/ChromeClientQt.h:
+
+2010-03-08  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove the now-redundant Settings fields for the Database
+        https://bugs.webkit.org/show_bug.cgi?id=35763
+
+        No new tests; this code isn't called.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply): Remove the call into Settings.
+
+2010-03-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Binary incompatibility between Qt 4.6's WebKit and trunk in QWebSettings
+        https://bugs.webkit.org/show_bug.cgi?id=35858
+
+        Moved the enum value added in r54873 to the end of the enum, to preserve
+        binary compatibility. DnsPrefetchEnabled was in the last release and needs
+        to remain after LocalContentCanAccessRemoteUrls.
+
+        * Api/qwebsettings.h:
+
+2010-03-06  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Remove unnecessary includes of wtf/Platform.h.  This is already pulled in by the prefix header.
+
+        * WebCoreSupport/EditCommandQt.cpp:
+
+2010-03-02  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
+
+        [Qt] QWebSettings attribute for toggle Spatial Navigation on/off
+        https://bugs.webkit.org/show_bug.cgi?id=33714 (Qt API part)
+
+        Added 'SpatialNavigationEnabled' attribute to QWebSettings.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        * Api/qwebsettings.h:
 
 2010-03-04  Simon Hausmann  <simon.hausmann@nokia.com>
 
@@ -107,15 +703,683 @@
 
         * Api/qwebelement.h:
 
-2010-01-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+2010-03-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make the OUTPUT_DIR variable in qmake projects independent of build-webkit's logic.
+
+        This also allows shadow builds relying only on qmake to work properly.
+
+        * tests/benchmarks/loading/loading.pro:
+        * tests/benchmarks/painting/painting.pro:
+        * tests/hybridPixmap/hybridPixmap.pro:
+        * tests/qgraphicswebview/qgraphicswebview.pro:
+        * tests/qwebelement/qwebelement.pro:
+        * tests/qwebframe/qwebframe.pro:
+        * tests/qwebhistory/qwebhistory.pro:
+        * tests/qwebhistoryinterface/qwebhistoryinterface.pro:
+        * tests/qwebinspector/qwebinspector.pro:
+        * tests/qwebpage/qwebpage.pro:
+        * tests/qwebplugindatabase/qwebplugindatabase.pro:
+
+2010-03-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix generation of forwarding headers
+
+        The dependencies were a bit wrong, so we ended up not generating
+        forwarding headers for qwebkitversion.h and qwebkitglobal.h
+
+        The forwarding headers are now the only targets depending on the
+        real headers. All other targets either depend on the generated
+        class headers, or the forwarding headers.
+
+        * Api/DerivedSources.pro:
+
+2010-03-02  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by David Levin.
+
+        Move database enable bit fully out of settings
+        This is stage one of a three-stage commit [webkit, then chromium, then
+        webkit again].  In this change I'm adding calls to
+        Database::setIsAvailable inside Settings::setDatabaseEnabled and
+        anywhere else that called it, and switching webkit fully over to using
+        that flag [added in a previous checkin].  Phase two will remove
+        Chromium's use of Settings for the Database, and phase three will remove
+        the Setting for the Database enable entirely, leaving only
+        Database::isAvailable/setIsAvailable.
+
+        No new tests; tested by existing storage tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35310
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):  Add a call to Database::setIsAvailable
+
+2010-03-02  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Symbian build fix.
+
+        [Qt] Updated the def file with one new export, to fix
+        QtLauncher linkage.
+
+        * symbian/eabi/QtWebKitu.def:
+
+2010-03-01  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Adam Barth.
+
+        Adapt to the new ZoomMode enum.
+        https://bugs.webkit.org/show_bug.cgi?id=35347
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::setTextSizeMultiplier):
+        (QWebFrame::setZoomFactor):
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+
+2010-02-26  Diego Gonzalez  <diego.gonzalez@openbossa.org>
 
         Reviewed by Simon Hausmann.
 
-        Do not set the combobox font on Maemo5 and S60; use the
-        default instead.
+        Fix documentation of QWebSettings::setUserStyleSheetUrl method
+
+        The base 64 data in the exemple shows a not valid code.
+
+        REGRESSION: QWebSettings::setUserStyleSheetUrl is not working with a data URL (Base64)
+        https://bugs.webkit.org/show_bug.cgi?id=34802
+
+        * Api/qwebsettings.cpp:
+
+2010-02-26  Jamey Hicks  <jamey.hicks@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] added QWebSettings::setInspectorUrl() and QWebSettings::inspectorUrl()
+
+        Enables the use of alternate Web Inspector frontends by changing
+        the location of the frontend.
+
+        This is required so that the Web Inspector may be run from an
+        external process or an external tool such as Eclipse or Aptana may
+        be used instead of the in-process Web Inspector UI.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=35340
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+        (QWebSettings::setInspectorUrl):
+        (QWebSettings::inspectorUrl):
+        * Api/qwebsettings.h:
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::createPage):
+
+2010-02-25  Jarkko Sakkinen  <jarkko.sakkinen@tieto.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Qt WebGL support
+
+        Adds enabling and disabling of WebGL support to QWebSettings.
+        https://bugs.webkit.org/show_bug.cgi?id=35153
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        * Api/qwebsettings.h:
+
+2010-02-19  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove QGVLauncher
+
+        https://bugs.webkit.org/show_bug.cgi?id=35292
+
+        * QGVLauncher/QGVLauncher.pro: Removed.
+        * QGVLauncher/main.cpp: Removed.
+
+2010-02-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Adds ChromeClient::cancelGeolocationPermissionRequestForFrame
+        https://bugs.webkit.org/show_bug.cgi?id=34962
+
+        This method is required so that a Geolocation object can cancel an
+        asynchronous permission request. This allows the chrome client to cancel
+        any UI it is showing for the permission request.
+
+        * WebCoreSupport/ChromeClientQt.h:
+        (WebCore::ChromeClientQt::cancelGeolocationPermissionRequestForFrame):
+
+2010-02-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed Symbian build fix.
+
+        [Qt] Updated the def file with new exports to enable
+        building DumpRenderTree.
+
+        * symbian/eabi/QtWebKitu.def:
+
+2010-02-18  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Minor improvement to hybrid QPixmap
+        https://bugs.webkit.org/show_bug.cgi?id=34507
+
+        * tests/hybridPixmap/test.html: use assignToHTMLImageElement on an
+        existing element instead of toHTMLImageElement which creates a new one
+
+2010-02-17  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin, Darin Fisher, Simon Hausmann.
+
+        When a live iframe element is moved between pages, it still depends on the old page.
+        https://bugs.webkit.org/show_bug.cgi?id=34382
+
+        * Api/qwebframe_p.h:
+        (QWebFramePrivate::setPage): Added.
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::didTransferChildFrameToNewDocument):
+        The QWebFrame caches a QWebPage which should be replaced when Frame is re-parented.
+        Also, the QWebFrame is a child (in QT terms) of QWebPage - so update that relationship as well.
+        Emit a signal that QWebFrame moved to a different QWebPage.
+
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2010-02-17  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduces new Icon loading interface in order to support
+        asynchronous loading.
+        https://bugs.webkit.org/show_bug.cgi?id=32054
+
+        Add an empty implementation of ChromeClient::iconForFiles().
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::iconForFiles):
+        * WebCoreSupport/ChromeClientQt.h:
+
+2010-02-17  Diego Gonzalez  <diego.gonzalez@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Make possible Qt DRT to get total number of pages to be printed
+
+        LayoutTests:
+            printing/numberOfPages.html
+
+        [Qt] DRT: Get total number of pages to be printed
+        https://bugs.webkit.org/show_bug.cgi?id=34955
+
+        * Api/qwebframe.cpp:
+        (qt_drt_numberOfPages):
+        (qt_drt_evaluateScriptInIsolatedWorld):
+
+2010-02-16  Ariya Hidayat  <ariya.hidayat@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Allow scrolling to an anchor programmatically.
+        https://bugs.webkit.org/show_bug.cgi?id=29856
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::scrollToAnchor): New API function.
+        * Api/qwebframe.h:
+        * tests/qwebframe/tst_qwebframe.cpp: New tests for scrollToAnchor().
+
+2010-02-16  Ariya Hidayat  <ariya.hidayat@gmail.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Fix building with Qt < 4.6.
+        https://bugs.webkit.org/show_bug.cgi?id=34885
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::updateResizesToContentsForPage):
+
+2010-02-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Symbian build fix.
+
+        Updated the def file with two new exports used by QtLauncher.
+
+        * symbian/eabi/QtWebKitu.def:
+
+2010-02-16  Ismail Donmez  <ismail@namtrac.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix compilation with inspector disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=32724
+
+        * Api/qwebpage.cpp:
+        (qt_drt_webinspector_executeScript):
+        (qt_drt_webinspector_close):
+        (qt_drt_webinspector_show):
+        (qt_drt_setTimelineProfilingEnabled):
+
+2010-02-16  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausman.
+
+        [Qt] Fix include paths for forwarding headers in standalone builds.
+
+        * Api/DerivedSources.pro: Use relative paths for package builds and added some
+        documentation.
+
+2010-02-15  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QtWebkit bridge: enable passing a QWebElement to a signal/slot/property
+        Add Q_DECLARE_METATYPE to QWebElement, add relevant tests to
+        tst_qwebframe
+        https://bugs.webkit.org/show_bug.cgi?id=34901
+
+        * Api/qwebelement.h: declare metatype
+        * tests/qwebframe/tst_qwebframe.cpp:
+        (MyQObject::webElementProperty): new test for QWebElement
+        (MyQObject::setWebElementProperty): new test for QWebElement
+        (MyQObject::myOverloadedSlot): new test for QWebElement
+
+2010-02-15  Robert Hogan  <robert@roberthogan.net>, Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] DRT: Support evaluateInWebInspector(), setTimelineProfilingEnabled().
+
+        Support LayoutTestController.evaluateInWebInspector(), setTimelineProfilingEnabled() in Qt DRT.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33096
+
+        This allows the following tests to pass:
+
+        inspector/console-format-collections.html
+        inspector/styles-iframe.html
+        inspector/syntax-highlight-css.html
+        inspector/syntax-highlight-javascript.html
+        inspector/timeline-enum-stability.html
+        inspector/timeline-layout.html
+        inspector/timeline-mark-timeline.html
+        inspector/timeline-paint.html
+        inspector/timeline-parse-html.html
+        inspector/timeline-recalculate-styles.html
+        inspector/timeline-script-tag-1.html
+        inspector/timeline-script-tag-2.html
+        inspector/timeline-trivial.html
+        inspector/cookie-resource-match.html
+        inspector/elements-img-tooltip.html
+        inspector/elements-panel-selection-on-refresh.html
+        inspector/inspected-objects-not-overriden.html
+        inspector/timeline-event-dispatch.html
+        inspector/timeline-network-resource.html
+        inspector/elements-panel-rewrite-href.html
+        inspector/console-dir.html
+        inspector/console-dirxml.html
+        inspector/console-format.html
+        inspector/console-tests.html
+        inspector/elements-panel-structure.html
+        inspector/evaluate-in-frontend.html
+        inspector/console-clear.html
+
+        * Api/qwebpage.cpp:
+        (qt_drt_webinspector_executeScript):
+        (qt_drt_webinspector_close):
+        (qt_drt_webinspector_show):
+        (qt_drt_setTimelineProfilingEnabled):
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (InspectorClientQt::createPage)
+
+2010-02-12  Antti Koivisto  <koivisto@iki.fi>
+
+        Reviewed by Kenneth Rohde Christiansen and Simon Hausmann.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34885
+        Add a QGraphicsWebView mode that makes it automatically resize itself to the size of the content.
+
+        This is useful for cases where the client wants to implement page panning and zooming by manipulating
+        the graphics item.
+        
+        Add a option to QGVLauncher to test this mode.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::QGraphicsWebViewPrivate):
+        (QGraphicsWebViewPrivate::updateResizesToContentsForPage):
+        (QGraphicsWebViewPrivate::_q_contentsSizeChanged):
+        (QGraphicsWebView::setPage):
+        (QGraphicsWebView::setResizesToContents):
+        (QGraphicsWebView::resizesToContents):
+        * Api/qgraphicswebview.h:
+        * QGVLauncher/main.cpp:
+        (WebView::WebView):
+        (MainView::MainView):
+        (MainView::setMainWidget):
+        (MainView::resizeEvent):
+        (main):
+
+2010-02-12  Diego Gonzalez  <diego.gonzalez@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Qt DRT now dump the frame loader callbacks when LayoutTestController()
+        method is called.
+
+        LayoutTests:
+            http/tests/security/mixedContent/data-url-script-in-iframe.html
+            http/tests/security/mixedContent/empty-url-plugin-in-frame.html
+            http/tests/security/mixedContent/insecure-css-in-iframe.html
+            http/tests/security/mixedContent/insecure-iframe-in-iframe.html
+            http/tests/security/mixedContent/insecure-image-in-iframe.html
+            http/tests/security/mixedContent/insecure-plugin-in-iframe.html
+            http/tests/security/mixedContent/insecure-script-in-iframe.html
+            http/tests/security/mixedContent/redirect-http-to-https-script-in-iframe.html
+            http/tests/security/mixedContent/redirect-https-to-http-script-in-iframe.html
+
+        [Qt] Make possible Qt DRT dump frame load callbacks
+        https://bugs.webkit.org/show_bug.cgi?id=34702
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::didDisplayInsecureContent):
+        (WebCore::FrameLoaderClientQt::didRunInsecureContent):
+
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make qtlauncher and qgvlauncher use the generated headers
+        path to make sure they are correctly generated.
+
+        * tests/tests.pri:
+
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Ensure relative paths in generated .pri files to ensure that
+        a source package with pre-generated derived sources can be compiled.
+
+        - Re-add a separate headers.pri file for WEBKIT_API_HEADERS
+        - Rename the generated headers.pri to classheaders.pri to avoid
+        confusion with the one generated by synqt since they don't have the
+        same content.
+        - Remove private headers list variable from classheaders.pri
+        - Use $$PWD in classheaders.pri
+        - Remove classheaders.pri from the installed files
+
+        * Api/DerivedSources.pro:
+
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Minor fixes on QtWebKit headers generation.
+
+        - Adds QtWebKit to the generated headers destination path
+        - Improve compatibility with MinGW
+
+        * Api/DerivedSources.pro:
+
+2010-02-09  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by nobody, build fix.
+
+        [Qt] Fix standalone build with MinGW.
+
+        * tests/qwebelement/tst_qwebelement.cpp:
+        * tests/tests.pri:
+
+2010-02-10  Diego Gonzalez  <diego.gonzalez@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Implement pageNumberForElementById() method in Qt DRT LayoutTestController,
+        to make Qt DRT able to get page number.
+
+        LayoutTests:
+            printing/page-break-always.html
+            printing/pageNumerForElementById.html
+            printing/css2.1/page-break-before-000.html
+            printing/css2.1/page-break-after-000.html
+            printing/css2.1/page-break-after-004.html
+            printing/css2.1/page-break-before-001.html
+            printing/css2.1/page-break-after-001.html
+            printing/css2.1/page-break-after-002.html
+            printing/css2.1/page-break-before-002.html
+            printing/css2.1/page-break-inside-000.html
+
+        [Qt] Make possible Qt DRT get a page number for element by ID
+        https://bugs.webkit.org/show_bug.cgi?id=34777
+
+        * Api/qwebframe.cpp:
+        (qt_drt_pageNumberForElementById):
+
+2010-02-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Unit test for window.runModalDialog
+        https://bugs.webkit.org/show_bug.cgi?id=34755
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (TestModalPage::TestModalPage):
+        (TestModalPage::createWindow):
+        (tst_QWebPage::showModalDialog):
+
+2010-02-09  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Sync with API changes in Maemo 5 kinetic scrolling
+
+        https://bugs.webkit.org/show_bug.cgi?id=34747
+
+        This is a forward-port of http://qt.gitorious.org/+qt-developers/qt/x11-maemo/commit/08497561
+
+        * Api/qwebview.cpp:
+        (qt_sendSpontaneousEvent):
+        (QWebViewKineticScroller::QWebViewKineticScroller):
+        (QWebViewKineticScroller::setWidget):
+        (QWebViewKineticScroller::eventFilter):
+        (QWebViewKineticScroller::cancelLeftMouseButtonPress):
+        (QWebViewKineticScroller::currentFrame):
+        (QWebViewKineticScroller::scrollingFrameAt):
+        (QWebViewKineticScroller::maximumScrollPosition):
+        (QWebViewKineticScroller::scrollPosition):
+        (QWebViewKineticScroller::viewportSize):
+        (QWebViewKineticScroller::setScrollPosition):
+        (QWebViewKineticScroller::sendEvent):
+        (QWebView::QWebView):
+
+2010-02-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Webkit in Qt does not have window.showModalDialog
+        https://bugs.webkit.org/show_bug.cgi?id=25585
+
+        Create a new eventloop when runModal() is called.
+        Added comemnt in QWebPage::createWindow that the application is responsible
+        for setting the modality of the appropriate window.
+
+        * Api/qwebpage.cpp:
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::ChromeClientQt):
+        (WebCore::ChromeClientQt::~ChromeClientQt):
+        (WebCore::ChromeClientQt::canRunModal):
+        (WebCore::ChromeClientQt::runModal):
+        * WebCoreSupport/ChromeClientQt.h:
+
+2010-01-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Implement flattening of framesets
+        https://bugs.webkit.org/show_bug.cgi?id=32717
+
+        Privately export the setFrameSetFlatteningEnabled setting for
+        use with the Qt DRT.
+
+        * Api/qwebpage.cpp:
+        (qt_drt_setFrameSetFlatteningEnabled):
+        (QWebPagePrivate::core):
+        * Api/qwebpage_p.h:
+
+2010-02-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Fix build on Windows
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        DerivedSources for our API headers failed on Windows,
+        due to Windows not accepting ; as a command separator,
+        not needing quotes for echo, and needing < and > escaped.
+
+        We now detect Windows and set these quote markers and
+        escape markers accordingly, as well as use && for separating
+        individual commands.
+
+        * Api/DerivedSources.pro:
+
+2010-02-05  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Remove unused inmport of ScriptFunctionCall.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=33592
+
+        * Api/qwebelement.cpp:
+
+2010-02-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Generate convenience headers (QWebView, etc) using qmake
+
+        In Qt this is done using syncqt, but we use a pro-file instead
+        that generates makefile-rules for each of the extra headers.
+
+        These extra headers are installed alongside the normal headers.
+
+        * Api/DerivedSources.pro: Added. List of headers + pro file magic
+        * Api/headers.pri: Removed, list of headers is now in the above file
+
+2010-02-04  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Tuning and optimizations to GraphicsLayerQt. Mainly reduced usage
+        of QTimer::singleShot, and moved syncLayers() from paint() to update()
+        https://bugs.webkit.org/show_bug.cgi?id=34062
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::update): Moved the sync operation to update
+        (QGraphicsWebView::paint): Moved the sync operation to update
+
+2010-02-03  Andras Becsi  <abecsi@webkit.org>
+
+        Unreviewed build fix.
+
+        [Qt] Roll-out r54281 because it broke the build on the Qt Release bot.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::QGraphicsWebViewPrivate):
+        (QGraphicsWebViewPrivate::markForSync):
+        (QGraphicsWebViewPrivate::update):
+        (QGraphicsWebView::paint):
+
+2010-02-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Do not use a proxy widget for the QComboBox on Maemo 5, as it
+        is not working properly and it is not needed at all, as the
+        comboboxes comes up in their full width on the screen and
+        do not depend on view.
 
         * WebCoreSupport/QtFallbackWebPopup.cpp:
-        (WebCore::QtFallbackWebPopup::populate):
+        (WebCore::QtFallbackWebPopup::show):
+
+2010-02-02  Jessie Berlin  <jberlin@webkit.org>
+
+        Rubber Stamped by Holger Freyther.
+
+        [Qt] Fix style issue identified in bug:
+        https://bugs.webkit.org/show_bug.cgi?id=34329
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientWebPage::InspectorClientWebPage):
+        Fix indentation.
+
+2010-02-01  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Enable inspecting the Web Inspector in QtLauncher
+
+        https://bugs.webkit.org/show_bug.cgi?id=34329
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientWebPage::InspectorClientWebPage):
+        Allow the DeveloperExtrasEnabled setting to default to true for the page containing the Web Inspector.
+
+2010-02-02  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Display HTML tags verbatim in JS alert/confirm/prompt boxes
+
+        https://bugs.webkit.org/show_bug.cgi?id=34429
+
+        * Api/qwebpage.cpp:
+        (QWebPage::javaScriptAlert):
+        (QWebPage::javaScriptConfirm):
+        (QWebPage::javaScriptPrompt):
+
+2010-02-02  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Enable a way to measure FPS in QGVLauncher
+        run QGVLauncher with --show-fps to see ongoing fps measurements
+        This is not meant as accurate FPS, but rather as a way to find
+        improvements/regressions
+        https://bugs.webkit.org/show_bug.cgi?id=34450
+
+        * QGVLauncher/main.cpp:
+        (MainView::MainView): initialize FPS values
+        (MainView::paintEvent): count a painted frame here
+        (MainView::printFps): we print the fps with qDebug every 5 seconds.
+
+2010-01-29  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] Android needs functionality in the ChromeClient to be informed when touch events are and are not needed by the webpage.
+        https://bugs.webkit.org/show_bug.cgi?id=34215
+
+        Add needTouchEvents() to the ChromeClient which is called when the page decides it needs or no longer needs to be informed of touch events.
+
+        * WebCoreSupport/ChromeClientQt.h:
+        (WebCore::ChromeClientQt::needTouchEvents): Add an empty implementation.
+
+2010-01-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann
+
+        Disable auto-uppercase and predictive text on Maemo5, just like the
+        build-in MicroB Browser.
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::setInputMethodState):
 
 2010-01-28  Andreas Kling  <andreas.kling@nokia.com>
 
@@ -141,15 +1405,15 @@
         (QWebViewKineticScroller::setPosition):
         (QWebView::QWebView):
 
-2010-01-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+2010-01-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Reviewed by Simon Hausmann
+        Reviewed by Simon Hausmann.
 
-        Disable auto-uppercase and predictive text on Maemo5, just like the
-        build-in MicroB Browser.
+        Do not set the combobox font on Maemo5 and S60; use the
+        default instead.
 
-        * WebCoreSupport/EditorClientQt.cpp:
-        (WebCore::EditorClientQt::setInputMethodState):
+        * WebCoreSupport/QtFallbackWebPopup.cpp:
+        (WebCore::QtFallbackWebPopup::populate):
 
 2010-01-28  Trond Kjernåsen <trond@trolltech.com>
 
@@ -160,6 +1424,44 @@
         * Api/qwebframe.cpp:
         (QWebFrame::print):
 
+2010-01-27  Diego Gonzalez  <diego.gonzalez@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] DRT Provide worker thread ability to track counters
+        https://bugs.webkit.org/show_bug.cgi?id=34221
+
+        Implement workerThreadCount() in LayoutTestController of Qt DRT
+
+        Tests:
+        fast/workers/dedicated-worker-lifecycle.html
+        fast/workers/shared-worker-frame-lifecycle.html
+        fast/workers/shared-worker-lifecycle.html
+        fast/workers/worker-lifecycle.html
+
+        * Api/qwebpage.cpp:
+        (qt_drt_workerThreadCount):
+
+2010-01-27  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Update the .def files with exported symbols
+
+        * symbian/eabi/QtWebKitu.def: Add two mangled missing new symbols for arm eabi.
+
+2010-01-27  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Meta-methods can't be introspected using ES5 API
+        https://bugs.webkit.org/show_bug.cgi?id=34087
+
+        Test that Object.getOwnPropertyDescriptor and
+        Object.getOwnPropertyNames work with meta-methods.
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+
 2010-01-26  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Kenneth Rohde Christiansen.
@@ -174,6 +1476,24 @@
         * WebCoreSupport/QtFallbackWebPopup.cpp:
         (WebCore::QtFallbackWebPopup::show):
 
+2010-01-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        First steps of the QtScript API.
+        
+        Two new classes were created; QScriptEngine and QScriptValue.
+        The first should encapsulate a javascript context and the second a script
+        value.
+        
+        This API is still in development, so it isn't compiled by default.
+        To trigger compilation, pass --qmakearg="CONFIG+=build-qtscript" to
+        build-webkit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32565
+
+        * docs/qtwebkit.qdocconf:
+
 2010-01-26  Holger Hans Peter Freyther  <zecke@selfish.org>
 
         Reviewed by Simon Hausmann.
@@ -202,6 +1522,19 @@
         (JSPromptPage::javaScriptPrompt):
         (tst_QWebPage::testJSPrompt):
 
+2010-01-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] In RenderThemeQt determine the QStyle from the page client instead of the page's view
+        https://bugs.webkit.org/show_bug.cgi?id=34053
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::style): Implement QWebPageClient::style() and return the graphics
+        widget's style.
+        * Api/qwebpage.cpp:
+        (QWebPageWidgetClient::style): Implement QWebPageClient::style() and return the widget's style.
+
 2010-01-25  Janne Koskinen  <janne.p.koskinen@digia.com>
 
         Reviewed by Simon Hausmann.
@@ -211,15 +1544,240 @@
 
         * symbian/backup_registration.xml: Added.
 
-2009-11-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+2010-01-23  Girish Ramakrishnan  <girish@forwardbias.in>
 
         Reviewed by Kenneth Rohde Christiansen.
 
-        [Qt] Fix QWebInspector destruction problem.
-        https://bugs.webkit.org/show_bug.cgi?id=31664
+        [Qt] Fix positioning of ComboBox popup in QGraphicsWebView.
+        
+        Wrap the popup in a QGraphicsProxyWidget, so that the popup
+        transforms with the item.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=33887
 
-        * Api/qwebpage.cpp:
-        (QWebPage::~QWebPage):
+        * WebCoreSupport/QtFallbackWebPopup.cpp:
+        (WebCore::QtFallbackWebPopupCombo::hidePopup):
+        (WebCore::QtFallbackWebPopup::QtFallbackWebPopup):
+        (WebCore::QtFallbackWebPopup::~QtFallbackWebPopup):
+        (WebCore::QtFallbackWebPopup::show):
+        * WebCoreSupport/QtFallbackWebPopup.h:
+
+2010-01-22  Peter Kasting  <pkasting@google.com>
+
+        Not reviewed, backout.
+
+        Back out r52673, which caused several regressions.
+        https://bugs.webkit.org/show_bug.cgi?id=32533
+
+        * WebCoreSupport/QtFallbackWebPopup.cpp:
+        (WebCore::QtFallbackWebPopupCombo::hidePopup):
+
+2010-01-22  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Save the QWebPageClient instead of the ownerWidget in QtAbstractWebPopup
+        
+        The QWebPageClient is required for the QtFallbackWebPopup. QtFallbackWebPopup will
+        need it to create a QGraphicsProxyWidget (in a future commit) for the 
+        QGraphicsWebView's web popup.
+
+        * WebCoreSupport/QtFallbackWebPopup.cpp:
+        (WebCore::QtFallbackWebPopup::show):
+
+2010-01-22  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        QState::polished() was renamed to QState::propertiesAssigned() when
+        Qt 4.6.0 was released.
+
+        * QGVLauncher/main.cpp:
+        (MainWindow::init):
+
+2010-01-21  Diego Gonzalez  <diego.gonzalez@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] add setDomainRelaxationForbiddenForURLScheme in Qt DRT
+        https://bugs.webkit.org/show_bug.cgi?id=33945
+
+        * Api/qwebsecurityorigin.cpp:
+        (qt_drt_setDomainRelaxationForbiddenForURLScheme):
+
+2010-01-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Implement GraphicsLayer for accelerated layer compositing
+        https://bugs.webkit.org/show_bug.cgi?id=33514
+
+        Here we have the QGraphicsWebView support for accelerated compositing
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewOverlay::q): access to container object
+        (QGraphicsWebViewOverlay::boundingRect): overlay has same rect as the
+        webview
+        (QGraphicsWebViewOverlay::paint): paint everything but the contents
+        (QGraphicsWebViewPrivate::QGraphicsWebViewPrivate): some vars needed
+        for accelerated compositing
+        (QGraphicsWebViewPrivate::):
+        (QGraphicsWebViewPrivate::~QGraphicsWebViewPrivate):
+        (QGraphicsWebViewPrivate::setRootGraphicsLayer): make sure we have a
+        scrollbar overlay, and that the new graphics layer is parented by the
+        web-view
+        (QGraphicsWebViewPrivate::markForSync): flush changes at earliest
+        convenience or during the next draw
+
+        (QGraphicsWebViewPrivate::updateCompositingScrollPosition): sync the
+        position of the compositing layer with the scroll position
+        (QGraphicsWebViewPrivate::syncLayers): flush changes now
+        (QGraphicsWebViewPrivate::scroll): make sure we also move the
+        compositing layer
+        (QGraphicsWebViewPrivate::update): also update the overlay if needed
+        (QGraphicsWebView::QGraphicsWebView): initialize overlay with 0
+        (QGraphicsWebView::paint): paint only contents if we have an overlay,
+        sync the compositing layers now if needed
+        (QGraphicsWebView::setPage): also clean up the compositing
+        (QGraphicsWebView::updateGeometry): also update overlay geo
+        (QGraphicsWebView::setGeometry): also update overlay geo
+        * Api/qgraphicswebview.h: reimp compositing stuff from QWebPageClient
+        * Api/qwebsettings.cpp: init new settings flag for compositing as
+        false
+        (QWebSettingsPrivate::apply): apply new settings flag for compositing
+        (QWebSettings::QWebSettings):
+        * Api/qwebsettings.h: new settings flag for compositing
+        * Api/qwebview.cpp: 
+        (QWebView::setPage): qwebview doesn't support compositing: always false
+        * QGVLauncher/main.cpp:
+        (WebView::WebView): some more cmdline arguments + compositing
+        (MainWindow::init): some more cmdline arguments
+        (main): ditto
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::attachRootGraphicsLayer): reimp for
+        accel-compositing
+        (WebCore::ChromeClientQt::setNeedsOneShotDrawingSynchronization):
+        reimp for accel compositing
+        (WebCore::ChromeClientQt::scheduleCompositingLayerSync): reimp for
+        accel compositing
+        * WebCoreSupport/ChromeClientQt.h: reimps for accel compositing
+
+2010-01-21  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Improve the autotests of QtWebkit
+        https://bugs.webkit.org/show_bug.cgi?id=32216
+
+        Remove qWait() of the test when possible.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::loadFinished):
+        (tst_QWebPage::database):
+        (tst_QWebPage::testEnablePersistentStorage):
+        (tst_QWebPage::errorPageExtension):
+        (tst_QWebPage::screenshot):
+
+2010-01-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Prospective build fix for the Qt build.
+
+        Fix compilation against Qt without WebKit support by not including QtWebKit/QWebView
+        but widget.h instead and instantiating QWebView through a typedef, to ensure we're using
+        our locally built WebKit.
+
+        * tests/hybridPixmap/widget.h:
+        * tests/hybridPixmap/widget.ui:
+
+2010-01-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Adding QPixmap/QImage support for the Qt hybrid layer
+        https://bugs.webkit.org/show_bug.cgi?id=32461
+
+        * tests/hybridPixmap: Added.
+        * tests/hybridPixmap/hybridPixmap.pro: Added.
+        * tests/hybridPixmap/resources.qrc: Added.
+        * tests/hybridPixmap/test.html: Added.
+        * tests/hybridPixmap/tst_hybridPixmap.cpp: Added.
+        (tst_hybridPixmap::tst_hybridPixmap): tests most of the use cases for
+        hybrid pixmap/image manipulation 
+        (tst_hybridPixmap::init): QTestLib initialization
+        (tst_hybridPixmap::cleanup): QTestLib cleanup
+        (tst_hybridPixmap::hybridPixmap): run the html file
+        * tests/hybridPixmap/widget.cpp: Added.
+        (Widget::Widget):
+        (Widget::refreshJS):
+        (Widget::start):
+        (Widget::completeTest):
+        (Widget::setPixmap):
+        (Widget::pixmap):
+        (Widget::setImage):
+        (Widget::image):
+        (Widget::~Widget):
+        (Widget::changeEvent):
+        (Widget::compare):
+        (Widget::imageSlot):
+        (Widget::pixmapSlot):
+        (Widget::randomSlot):
+        * tests/hybridPixmap/widget.h: Added.
+        * tests/hybridPixmap/widget.ui: Added.
+        * tests/tests.pro:
+
+2010-01-21  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Custom select popups.
+        https://bugs.webkit.org/show_bug.cgi?id=33418
+
+        Adjusting QtFallbackWebPopupCombo to the changes in WebCore layer.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::createSelectPopup):
+        * WebCoreSupport/ChromeClientQt.h:
+        * WebCoreSupport/QtFallbackWebPopup.cpp:
+        (WebCore::QtFallbackWebPopupCombo::QtFallbackWebPopupCombo):
+        (WebCore::QtFallbackWebPopupCombo::showPopup):
+        (WebCore::QtFallbackWebPopupCombo::hidePopup):
+        (WebCore::QtFallbackWebPopup::QtFallbackWebPopup):
+        (WebCore::QtFallbackWebPopup::~QtFallbackWebPopup):
+        (WebCore::QtFallbackWebPopup::show):
+        (WebCore::QtFallbackWebPopup::hide):
+        (WebCore::QtFallbackWebPopup::populate):
+        * WebCoreSupport/QtFallbackWebPopup.h:
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Renames WebCore/bridge/runtime.[cpp|h] to WebCore/bridge/Bridge.[cpp|h]
+        https://bugs.webkit.org/show_bug.cgi?id=33801
+
+        * Api/qwebframe.cpp:
+
+2010-01-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Drag and Drop source/destination code needs cleanup.
+        <https://bugs.webkit.org/show_bug.cgi?id=33691>.
+        
+        Update to new way of calling sourceOperation.
+
+        * WebCoreSupport/DragClientQt.cpp:
+        (WebCore::DragClientQt::startDrag):
+
+2010-01-14  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Symbian build fixes.
+
+        * tests/qwebpage/tst_qwebpage.cpp: Include util.h
+        * tests/tests.pri: Don't define TESTS_SOURCE_DIR, it doesn't work.
+        * tests/util.h: Define TESTS_SOURCE_DIR here, just like it's done in Qt.
 
 2010-01-14  Simon Hausmann  <simon.hausmann@nokia.com>
 
@@ -230,23 +1788,89 @@
         * symbian/bwins/QtWebKitu.def:
         * symbian/eabi/QtWebKitu.def:
 
-2009-12-18  Joe Ligman  <joseph.ligman@nokia.com>
+2010-01-13  Darin Adler  <darin@apple.com>
 
-        Reviewed by Kenneth Rohde Christiansen.
+        Reviewed by Dan Bernstein.
 
-        [Qt] Add new API to QWebFrame to scrollRecursively starting with any css overflow 
-        then checking current frame and then ancestors
-        https://bugs.webkit.org/show_bug.cgi?id=32668
+        Move more of the selection and caret painting code from Frame to SelectionController.
+        https://bugs.webkit.org/show_bug.cgi?id=33619
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::inputMethodEvent): Seems possibly wrong to be directly invoking this
+        setCaretVisible here, but I updated it to call it in its new location.
+
+2010-01-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Add private API for QWebFrame scrolling, to maintain binary compatibility with Qt 4.6.
+
+        This is just a temporary addition until we have introduced #ifdefs to allow
+        safely removing the private API again.
 
         * Api/qwebframe.cpp:
-        (QWebFramePrivate::scrollOverflow):
-        (QWebFrame::scrollRecursively):
-        * Api/qwebframe.h:
-        * Api/qwebframe_p.h:
-        * tests/qwebframe/qwebframe.qrc:
-        * tests/qwebframe/testiframe.html: Added.
-        * tests/qwebframe/testiframe2.html: Added.
-        * tests/qwebframe/tst_qwebframe.cpp:
+        (qtwebkit_webframe_scrollRecursively):
+
+2010-01-10  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Add enableXSSAuditor support to QWebSettings and DRT.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33419
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        * Api/qwebsettings.h:
+
+2010-01-09  Daniel Bates  <dbates@webkit.org>
+
+        No review, rolling out r53044.
+        http://trac.webkit.org/changeset/53044
+        https://bugs.webkit.org/show_bug.cgi?id=33419
+        
+        We need to look into this some more because the Qt
+        bot is failing the XSSAuditor tests. See bug #33419
+        for more details.
+
+        * Api/qwebsettings.cpp:
+        * Api/qwebsettings.h:
+
+2010-01-09  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33419
+
+        Adds support for the XSSAuditor to the Qt DRT.
+
+        * Api/qwebsettings.cpp: Updated comment to reflect added key XSSAuditorEnabled.
+        * Api/qwebsettings.h: Adds settings key XSSAuditorEnabled.
+
+2010-01-08  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Delegation client
+        https://bugs.webkit.org/show_bug.cgi?id=32826
+
+        Added method createPopup to ChromeClientQt used to create popups.
+        QtFallbackWebPopup moved from WebCore/platform/qt to
+        WebKit/qt/WebCoreSupport.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::createPopup):
+        * WebCoreSupport/ChromeClientQt.h:
+        * WebCoreSupport/QtFallbackWebPopup.cpp: Added.
+        (WebCore::QtFallbackWebPopup::QtFallbackWebPopup):
+        (WebCore::QtFallbackWebPopup::show):
+        (WebCore::QtFallbackWebPopup::populate):
+        (WebCore::QtFallbackWebPopup::showPopup):
+        (WebCore::QtFallbackWebPopup::hidePopup):
+        (WebCore::QtFallbackWebPopup::activeChanged):
+        (WebCore::QtFallbackWebPopup::setParent):
+        * WebCoreSupport/QtFallbackWebPopup.h: Added.
+        (WebCore::QtFallbackWebPopup::hide):
 
 2010-01-07  Yael Aharon  <yael.aharon@nokia.com>
 
@@ -275,6 +1899,93 @@
         (qt_suspendActiveDOMObjects):
         (qt_resumeActiveDOMObjects):
 
+2010-01-06  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Return an invalid Qt::ImMicroFocus if queried while the view needs to layout.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33204
+
+        * Api/qwebpage.cpp:
+        (QWebPage::inputMethodQuery):
+
+2010-01-05  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Drag & drop layout tests fail even when run manually
+        https://bugs.webkit.org/show_bug.cgi?id=33055
+
+        No new tests. Fix 3 layout tests when run manually.
+        fast/events/drag-and-drop.html
+        fast/events/drag-and-drop-dataTransfer-types-nocrash.html
+        fast/events/drag-and-drop-fire-drag-dragover.html
+        Running these tests in DRT will be fixed in 31332.
+
+        * Api/qwebpage.cpp:
+        (dropActionToDragOp):
+        (dragOpToDropAction):
+        (QWebPagePrivate::dragEnterEvent):
+        (QWebPagePrivate::dragMoveEvent):
+        (QWebPagePrivate::dropEvent):
+        Accept drag events even if they are not over a drop target. 
+        This is to ensure that drag events will continue to be delivered.
+
+        * Api/qwebpage_p.h:
+        * WebCoreSupport/DragClientQt.cpp:
+        (WebCore::dragOperationToDropActions):
+        (WebCore::dropActionToDragOperation):
+        (WebCore::DragClientQt::startDrag):
+        Send dragEnd event.
+
+2010-01-04  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33097
+
+        Cleans up the File menu to better conform to the File menu in Safari
+        both in terms of options and keyboard shortcuts. Adds a "Quit" menu
+        options to close all open windows.
+
+        * QGVLauncher/main.cpp:
+        (MainWindow::buildUI):
+
+2009-12-31  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Enable all HTML5 persistent features for QGVLauncher
+        https://bugs.webkit.org/show_bug.cgi?id=33086
+
+        * QGVLauncher/main.cpp: Call enablePersistentStorage()
+        (main):
+
+2009-12-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] It should be possible to disable inspector
+        https://bugs.webkit.org/show_bug.cgi?id=32724
+
+        This change fixes the build break. Some QtWebKit interfaces
+        will not be fully functional (most notable QWebInspector) if
+        INSPECTOR is disabled.
+
+        * Api/qwebinspector.cpp:
+        (QWebInspector::showEvent):
+        (QWebInspector::closeEvent):
+        * Api/qwebpage.cpp:
+        (webActionForContextMenuAction):
+        (QWebPagePrivate::getOrCreateInspector):
+        (QWebPagePrivate::inspectorController):
+        (QWebPage::triggerAction):
+        (QWebPage::updatePositionDependentActions):
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::showWindow):
+        (WebCore::InspectorClientQt::closeWindow):
+
 2009-12-30  Janne Koskinen  <janne.p.koskinen@digia.com>
 
         Reviewed by Simon Hausmann.
@@ -286,6 +1997,267 @@
         * symbian/bwins/QtWebKitu.def: Added.
         * symbian/eabi/QtWebKitu.def: Added.
 
+2009-12-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32925
+
+        Adds an Open File dialog to make it convenient to open a file
+        to view in the browser.
+
+        * QGVLauncher/main.cpp:
+        (MainWindow::load): Modified to call loadURL.
+        (MainWindow::openFile): Added.
+        (MainWindow::loadURL): Added.
+        (MainWindow::buildUI): Added menu item Open File.
+
+2009-12-29  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix crash on LayoutTests/fast/loader/empty-embed-src-attribute.html
+        
+        Related to https://bugs.webkit.org/show_bug.cgi?id=23806
+        
+        If an embedded document is loaded within a page and it has an empty
+        URL, use a blank URL for the load request.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=33017
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createFrame):
+
+2009-12-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Rubber-stamped by Simon Hausmann and Holger Freyther.
+
+        [Qt] Remove WebKit/qt/WebKitPart empty directory
+
+        The content of the directory has been removed by r34888.
+
+        * WebKitPart: Removed.
+
+2009-12-29  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] DRT: Frame loader callbacks differ from the Mac port
+        https://bugs.webkit.org/show_bug.cgi?id=32989
+
+        Remove messages from the callbacks that should not dump them to match
+        the expected results for the http/loading tests.
+
+        Unskip some http/loading tests which succeed now.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidPopStateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchWillClose):
+        (WebCore::FrameLoaderClientQt::dispatchDidReceiveIcon):
+        (WebCore::FrameLoaderClientQt::dispatchDidClearWindowObjectInWorld):
+
+2009-12-29  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] fix fast/dom/Window/window-onFocus.html
+        
+        Add support for layouttestcontroller.windowIsKey to Qt DRT and fix issue where
+        window.onblur was getting dispatched twice from QtWebKit.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32990
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::focusOutEvent):
+
+2009-12-24  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Gustavo Noronha.
+
+        Doc : QGraphicsWebView::zoomFactor was introduced in 4.6.
+        
+        * Api/qgraphicswebview.cpp:
+
+2009-12-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Holger Freyther.
+
+        Moved QtLauncher to WebKitTools/
+
+        * QtLauncher: Removed.
+        * QtLauncher/QtLauncher.pro: Removed.
+        * QtLauncher/main.cpp: Removed.
+
+2009-12-21  David Boddie  <dboddie@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Doc: Minor fixes to language.
+
+        * Api/qwebpage.cpp:
+
+2009-12-21  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Clean up the WebKit layer unit-tests
+
+            - Use tests.pri for common options
+            - Standardize file naming
+            - Move all resources to 'resources' subdir
+            - Standardize how TESTS_SOURCE_DIR is used
+            - Get rid of UID3 for symbian (autogenerated)
+            - Don't build app bundles on Mac OS X
+
+        * tests/benchmarks/loading/loading.pro: Added.
+        * tests/benchmarks/loading/tst_loading.pro: Removed.
+        * tests/benchmarks/painting/painting.pro: Added.
+        * tests/benchmarks/painting/tst_painting.pro: Removed.
+        * tests/qgraphicswebview/qgraphicswebview.pro:
+        * tests/qwebelement/qwebelement.pro:
+        * tests/qwebelement/qwebelement.qrc: Removed.
+        * tests/qwebelement/resources/image.png: Renamed from WebKit/qt/tests/qwebelement/image.png.
+        * tests/qwebelement/resources/style.css: Renamed from WebKit/qt/tests/qwebelement/style.css.
+        * tests/qwebelement/resources/style2.css: Renamed from WebKit/qt/tests/qwebelement/style2.css.
+        * tests/qwebelement/tst_qwebelement.qrc: Added.
+        * tests/qwebframe/qwebframe.pro:
+        * tests/qwebframe/qwebframe.qrc: Removed.
+        * tests/qwebframe/resources/image.png: Renamed from WebKit/qt/tests/qwebframe/image.png.
+        * tests/qwebframe/resources/style.css: Renamed from WebKit/qt/tests/qwebframe/style.css.
+        * tests/qwebframe/resources/test1.html: Renamed from WebKit/qt/tests/qwebframe/test1.html.
+        * tests/qwebframe/resources/test2.html: Renamed from WebKit/qt/tests/qwebframe/test2.html.
+        * tests/qwebframe/resources/testiframe.html: Renamed from WebKit/qt/tests/qwebframe/testiframe.html.
+        * tests/qwebframe/resources/testiframe2.html: Renamed from WebKit/qt/tests/qwebframe/testiframe2.html.
+        * tests/qwebframe/tst_qwebframe.cpp:
+        * tests/qwebframe/tst_qwebframe.qrc: Added.
+        * tests/qwebhistory/qwebhistory.pro:
+        * tests/qwebhistory/resources/page1.html: Renamed from WebKit/qt/tests/qwebhistory/data/page1.html.
+        * tests/qwebhistory/resources/page2.html: Renamed from WebKit/qt/tests/qwebhistory/data/page2.html.
+        * tests/qwebhistory/resources/page3.html: Renamed from WebKit/qt/tests/qwebhistory/data/page3.html.
+        * tests/qwebhistory/resources/page4.html: Renamed from WebKit/qt/tests/qwebhistory/data/page4.html.
+        * tests/qwebhistory/resources/page5.html: Renamed from WebKit/qt/tests/qwebhistory/data/page5.html.
+        * tests/qwebhistory/resources/page6.html: Renamed from WebKit/qt/tests/qwebhistory/data/page6.html.
+        * tests/qwebhistory/tst_qwebhistory.cpp:
+        (tst_QWebHistory::):
+        * tests/qwebhistory/tst_qwebhistory.qrc:
+        * tests/qwebhistoryinterface/qwebhistoryinterface.pro:
+        * tests/qwebinspector/qwebinspector.pro:
+        * tests/qwebpage/qwebpage.pro:
+        * tests/qwebpage/resources/frame_a.html: Renamed from WebKit/qt/tests/qwebpage/frametest/frame_a.html.
+        * tests/qwebpage/resources/iframe.html: Renamed from WebKit/qt/tests/qwebpage/frametest/iframe.html.
+        * tests/qwebpage/resources/iframe2.html: Renamed from WebKit/qt/tests/qwebpage/frametest/iframe2.html.
+        * tests/qwebpage/resources/iframe3.html: Renamed from WebKit/qt/tests/qwebpage/frametest/iframe3.html.
+        * tests/qwebpage/resources/index.html: Renamed from WebKit/qt/tests/qwebpage/frametest/index.html.
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::backActionUpdate):
+        (tst_QWebPage::frameAt):
+        (tst_QWebPage::errorPageExtensionInFrameset):
+        (tst_QWebPage::screenshot):
+        * tests/qwebpage/tst_qwebpage.qrc:
+        * tests/qwebplugindatabase/qwebplugindatabase.pro:
+        * tests/qwebview/qwebview.pro:
+        * tests/qwebview/resources/frame_a.html: Renamed from WebKit/qt/tests/qwebview/data/frame_a.html.
+        * tests/qwebview/resources/index.html: Renamed from WebKit/qt/tests/qwebview/data/index.html.
+        * tests/qwebview/tst_qwebview.cpp:
+        (tst_QWebView::reusePage):
+        (tst_QWebView::crashTests):
+        * tests/qwebview/tst_qwebview.qrc:
+        * tests/resources/image2.png: Renamed from WebKit/qt/tests/qwebframe/resources/image2.png.
+        * tests/tests.pri: Added.
+        * tests/tests.pro:
+
+2009-12-18  Ariya Hidayat  <ariya.hidayat@gmail.com>
+
+        Build fix, not reviewed.
+
+        * QtLauncher/main.cpp:
+        (MainWindow::setTouchMocking): Leave setTouchMocking as an empty
+        function for Qt < 4.6 so that moc still creates a slot for that.
+        Otherwise, it would have generated a linker error.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Qt build fix
+
+        * Api/qwebpage.cpp: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Qt build fix
+
+        * Api/qwebpage.cpp:
+        Added #includes.
+
+2009-12-18  Joe Ligman  <joseph.ligman@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add new API to QWebFrame to scrollRecursively starting with any css overflow 
+        then checking current frame and then ancestors
+        https://bugs.webkit.org/show_bug.cgi?id=32668
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::scrollOverflow):
+        (QWebFrame::scrollRecursively):
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+        * tests/qwebframe/qwebframe.qrc:
+        * tests/qwebframe/testiframe.html: Added.
+        * tests/qwebframe/testiframe2.html: Added.
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-12-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix infinite recursion in touch mocking.
+
+        Don't send the fake touch events to the view, as that'll trigger the
+        event filter again.
+
+        * QtLauncher/main.cpp:
+        (MainWindow::sendTouchEvent):
+
+2009-12-17  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add support for mocking touch events with Q(GV)Launcher
+        https://bugs.webkit.org/show_bug.cgi?id=32434
+
+        The event delivery should go through QCoreApplication::sendEvent()
+
+        * QtLauncher/main.cpp:
+        (MainWindow::sendTouchEvent):
+
+2009-12-17  Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add support for touch events in QWebView and QGraphicsWebView
+        https://bugs.webkit.org/show_bug.cgi?id=32432
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::QGraphicsWebView):
+        (QGraphicsWebView::sceneEvent):
+        * Api/qwebview.cpp:
+        (QWebView::QWebView):
+        (QWebView::event):
+
+2009-12-17  Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add support for mocking touch events with QtLauncher
+        https://bugs.webkit.org/show_bug.cgi?id=32434
+
+        * QtLauncher/main.cpp:
+        (MainWindow::MainWindow):
+        (MainWindow::sendTouchEvent):
+        (MainWindow::eventFilter):
+        (MainWindow::setTouchMocking):
+        (MainWindow::setupUI):
+
 2009-12-14  Holger Hans Peter Freyther  <zecke@selfish.org>
 
         Reviewed by Kenneth Rohde Christiansen.
@@ -311,18 +2283,10 @@
         * WebCoreSupport/ChromeClientQt.cpp:
         (WebCore::ChromeClientQt::runJavaScriptPrompt): Fixup null QString
 
-2009-12-21  David Boddie  <dboddie@trolltech.com>
+2009-11-24  Holger Hans Peter Freyther  <zecke@selfish.org>
 
         Reviewed by Simon Hausmann.
 
-        Doc: Minor fixes to language.
-
-        * Api/qwebpage.cpp:
-
-2009-12-15  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by NOBODY (OOPS!).
-
         [Qt] Do not disable the inspector on show and hide
         https://bugs.webkit.org/show_bug.cgi?id=31851
 
@@ -335,8 +2299,58 @@
         user of the inspector client.
 
         * Api/qwebinspector.cpp:
-        (QWebInspector::event):
         (QWebInspector::hideEvent):
+        (QWebInspector::closeEvent):
+        * Api/qwebinspector.h:
+
+2009-12-14  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Improve the autotests of QtWebkit
+        https://bugs.webkit.org/show_bug.cgi?id=32216
+
+        Refactor tst_qwebelement to remove the qWait()
+
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::style):
+
+2009-12-14  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the QWebPage inputMethods() autotest after r51758
+        to compare the Qt::ImFont property's family against an explicitly
+        previously configured family.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32491
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::inputMethods):
+
+2009-12-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32499
+        Add client based Geolocation provider
+
+        Add first cut of a client based Geolocation provider. This is guarded by
+        ENABLE(CLIENT_BASED_GEOLOCATION) and is off by default for now. This adds a
+        GeolocationControllerClient interface that no-one currently implements,
+        but will in a subsequent patch.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+
+2009-12-13  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add a test in Qt for https://bugs.webkit.org/show_bug.cgi?id=29005
+        https://bugs.webkit.org/show_bug.cgi?id=29008
+
+        * tests/qwebframe/tst_qwebframe.cpp:
 
 2009-12-13  Simon Hausmann  <hausmann@webkit.org>
 
@@ -351,6 +2365,263 @@
 
         * Api/qwebview.h:
 
+2009-12-11  Yael Aharon  <yael.aharon@nokia.com>
+
+        Unreviewed build fix for Qt versions < 4.6.
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+        * tests/qwebview/tst_qwebview.cpp:
+        (tst_QWebView::reusePage):
+
+2009-12-11  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Updated QWebElement documentation
+        
+        findAll() returns a QWebElementCollection, not QList<QWebElement>.
+
+        * docs/webkitsnippets/webelement/main.cpp:
+        (findAll):
+
+2009-12-11  Simon Hausmann  <hausmann@webkit.org>, Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Antti Koivisto.
+
+        Forward Qt touch events to the event handler as platform touch events.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32114
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::touchEvent):
+        (QWebPage::event):
+        * Api/qwebpage_p.h:
+
+2009-12-07  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Improve the autotests of QtWebkit
+        https://bugs.webkit.org/show_bug.cgi?id=32216
+
+        Remove the calls to qWait() of the autotest of QWebView
+
+        * tests/qwebview/tst_qwebview.cpp:
+        (tst_QWebView::reusePage):
+
+2009-12-07  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Improve the autotests of QtWebkit
+        https://bugs.webkit.org/show_bug.cgi?id=32216
+
+        Refactor tst_qwebframe to remove qWait() and use
+        the function waitForSignal() from util.h
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-12-07  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Improve the autotests of QtWebkit
+        https://bugs.webkit.org/show_bug.cgi?id=32216
+
+        Refactor the test of QGraphicsWebView:
+        -make waitForSignal() available to all the tests.
+        -remove QTest::qWait()
+
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (tst_QGraphicsWebView::crashOnViewlessWebPages):
+        * tests/util.h:
+        (waitForSignal):
+
+2009-12-07  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins: Force windowless mode when there is no native window handle
+        
+        Inject wmode=opaque while instantiating the plugin for the case when the
+        webpage is not backed by a native window handle.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32059
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createPlugin):
+
+2009-12-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Corrects QtLauncher style
+
+        * QtLauncher/main.cpp:
+        (WebPage::acceptNavigationRequest):
+        (MainWindow::MainWindow):
+        (MainWindow::webPage):
+        (MainWindow::webView):
+        (MainWindow::changeLocation):
+        (MainWindow::loadFinished):
+        (MainWindow::showLinkHover):
+        (MainWindow::zoomIn):
+        (MainWindow::zoomOut):
+        (MainWindow::print):
+        (MainWindow::setEditable):
+        (MainWindow::dumpHtml):
+        (MainWindow::selectElements):
+        (MainWindow::newWindow):
+        (MainWindow::setupUI):
+        (WebPage::createWindow):
+        (WebPage::createPlugin):
+        (main):
+
+2009-12-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QtLauncher: add a menu to show or hide the web inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=32149
+
+        * QtLauncher/main.cpp:
+        (WebInspector::WebInspector):
+        (WebInspector::showEvent):
+        (WebInspector::hideEvent):
+        (MainWindow::MainWindow):
+        (MainWindow::setupUI):
+
+2009-12-04  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        Split out the renderPrivate in two methods, one for working on
+        relative coordinates (relative to the viewport) and one for
+        working on absolute coordinates. The latter is more effecient
+        for implementing tiling, as you don't need translate the coords,
+        and because it avoid clipping to the viewport.
+
+        No behaviour changes, so no new tests.
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::renderContentsLayerAbsoluteCoords):
+        (QWebFramePrivate::renderRelativeCoords):
+        (QWebFrame::render):
+        * Api/qwebframe_p.h:
+
+2009-12-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Allow removing 'qrc' as a local security origin scheme
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+
+2009-12-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Clean up argument parsing in the QtLauncher
+
+        * QtLauncher/main.cpp:
+
+2009-12-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Prevent the inspector from closing its wrapping widget.
+        This is not necessary anymore since we now hide the embedded
+        close button.
+        https://bugs.webkit.org/show_bug.cgi?id=32149
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::showWindow):
+        (WebCore::InspectorClientQt::closeWindow):
+
+2009-12-03  İsmail Dönmez  <ismail@namtrac.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix compilation when SVG is disabled.
+
+        * Api/qwebframe.cpp:
+        (qt_drt_pauseSVGAnimation):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7214236> and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidPushStateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidReplaceStateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidPopStateWithinPage):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2009-12-03  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Simplify the settings support in inspector controller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32076
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::populateSetting):
+        (WebCore::InspectorClientQt::storeSetting):
+        (WebCore::variantToSetting):
+        (WebCore::settingToVariant):
+        * WebCoreSupport/InspectorClientQt.h:
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] The FrameLoaderClient is unaware of BackForwardList changes.
+        https://bugs.webkit.org/show_bug.cgi?id=31914
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidAddBackForwardItem): Add an empty implementation. Method added to FrameLoaderClient by Android (see bug).
+        (WebCore::FrameLoaderClientQt::dispatchDidRemoveBackForwardItem): ditto.
+        (WebCore::FrameLoaderClientQt::dispatchDidChangeBackForwardIndex): ditto.
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Try to fix Qt build.
+
+        * Api/qwebframe.cpp:
+        (qt_drt_pauseSVGAnimation):
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        Add SVG animation test framework with 'snapshot' functionality
+        https://bugs.webkit.org/show_bug.cgi?id=31897
+
+        Add API used by the new 'sampleSVGAnimationForElementAtTime' DRT method,
+        forwarding the call to SVGDocumentExtensions, if SVG is enabled.
+
+        Implemented just like the existing pauseAnimation* methods for CSS animations.
+
+        * Api/qwebframe.cpp:
+        (qt_drt_pauseSVGAnimation):
+
+2009-12-01  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31898
+
+        Makes QtLauncher default to the http scheme for URLs.
+
+        * QtLauncher/main.cpp:
+        (MainWindow::MainWindow):
+        (MainWindow::changeLocation):
+        (main):
+
 2009-11-30  Abhinav Mithal  <abhinav.mithal@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -361,6 +2632,17 @@
         * Api/qwebpage.cpp:
         (QWebPage::userAgentForUrl):
 
+2009-11-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix minor waning in QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=31963
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (ErrorPage::extension): Remove info wariable as it is
+        not used.
+
 2009-11-28  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Kenneth Rohde Christiansen.
@@ -377,6 +2659,32 @@
         * tests/qwebpage/tst_qwebpage.cpp:
         (tst_QWebPage::inputMethods):
 
+2009-11-26  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Holger Freyther.
+
+        Removed unused ICO image plugin handler.
+
+        * Plugins/ICOHandler.cpp: Removed.
+        * Plugins/ICOHandler.h: Removed.
+        * Plugins/Plugins.pro: Removed.
+
+2009-11-12  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Do not show the QWidget when the WebCore::Widget is hidden
+        https://bugs.webkit.org/show_bug.cgi?id=31203
+
+        The clipping code was making a QWidget visible even if the
+        WebCore::Widget was hidden. Fix the bug by calling setVisible
+        only if the WebCore::Widget Widget::isSelfVisible.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::QtPluginWidget::show): Override WebCore::Widget::show to call handleVisibility
+        (WebCore::QtPluginWidget::handleVisibility): New method to call setVisible when we are visible
+        (FrameLoaderClientQt::createPlugin): Hide the QWidget by default
+
 2009-11-23  David Boddie  <dboddie@trolltech.com>
 
         Reviewed by Simon Hausmann.
@@ -405,6 +2713,27 @@
 
         * tests/qwebframe/tst_qwebframe.cpp:
 
+2009-11-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add instantiation tests for QWebInspector.
+
+        * tests/qwebinspector/qwebinspector.pro: Added.
+        * tests/qwebinspector/tst_qwebinspector.cpp: Added.
+        (tst_QWebInspector::attachAndDestroy):
+        * tests/tests.pro:
+
+2009-11-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix QWebInspector destruction problem.
+        https://bugs.webkit.org/show_bug.cgi?id=31664
+
+        * Api/qwebpage.cpp:
+        (QWebPage::~QWebPage):
+
 2009-11-19  Olivier Goffart  <ogoffart@trolltech.com>
 
         Reviewed by Simon Hausmann.
@@ -424,6 +2753,60 @@
         (tst_QWebPage::modified):
         (tst_QWebPage::database):
 
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove support for Qt v4.3 or older versions
+        https://bugs.webkit.org/show_bug.cgi?id=29469
+
+        * Api/qcookiejar.cpp: Removed.
+        * Api/qcookiejar.h: Removed.
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::event):
+        * Api/qwebframe.cpp:
+        (QWebFrame::load):
+        * Api/qwebframe.h:
+        * Api/qwebkitglobal.h:
+        * Api/qwebnetworkinterface.cpp: Removed.
+        * Api/qwebnetworkinterface.h: Removed.
+        * Api/qwebnetworkinterface_p.h: Removed.
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        (QWebPagePrivate::acceptNavigationRequest):
+        (QWebPage::acceptNavigationRequest):
+        (QWebPage::action):
+        (QWebPage::userAgentForUrl):
+        * Api/qwebpage.h:
+        * Api/qwebpage_p.h:
+        * Api/qwebview.cpp:
+        (QWebView::load):
+        (QWebView::event):
+        * Api/qwebview.h:
+        * QtLauncher/main.cpp:
+        (MainWindow::print):
+        (MainWindow::setupUI):
+        (main):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::download):
+        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForNewWindowAction):
+        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForNavigationAction):
+        (WebCore::FrameLoaderClientQt::startDownload):
+        (WebCore::FrameLoaderClientQt::createPlugin):
+
+2009-11-18  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Add support for displaying deleteButton.
+        https://bugs.webkit.org/show_bug.cgi?id=31560
+
+        Test: LayoutTests/editing/deleting/5408255.html
+
+        * Api/qwebsettings.cpp:
+        (graphics):
+        * Api/qwebsettings.h:
+
 2009-11-18  Paul Olav Tvete  <paul.tvete@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -442,16 +2825,49 @@
 
         * docs/qtwebkit.qdoc:
 
-2009-11-18  Simon Hausmann  <simon.hausmann@nokia.com>
+2009-11-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Reviewed and suggested by Tor Arne Vestbø.
+        Reviewed by Simon Hausmann.
 
-        Fix the autotest after commit ecbb2c0dd21bfc197e1f7b53150ec9b1a1d8cb8f
-        to compare the Qt::ImFont property's family against an explicitly
-        previously configured family.
+        [Qt] Add QtLauncher support for opening links in the default browser
+
+        This can be triggered by either the context menu or by clicking a link
+        while holding down the Alt key. Opening a link in a new windows is
+        triggered by holding down Shift.
+
+        * QtLauncher/main.cpp:
+
+2009-11-17  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QGLLauncher does not support drag&drop of local files
+        https://bugs.webkit.org/show_bug.cgi?id=31057
+
+        Enable accepting files in QGraphicsWebView.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::QGraphicsWebView):
+        (QGraphicsWebView::dragEnterEvent):
+
+2009-11-17  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Kenneth Christiansen.
+
+        [Qt] better test coverage for ErrorPageExtension
+        https://bugs.webkit.org/show_bug.cgi?id=31583
+
+        Improved the coverage of current ErrorPageExtension tests by
+        adding autotests involving frameset and iframes.
 
         * tests/qwebpage/tst_qwebpage.cpp:
-        (tst_QWebPage::inputMethods):
+        (ErrorPage::extension): Make the ErrorPageExtension
+        to work for all frames, not only the main frame.
+        (tst_QWebPage::errorPageExtension): Stop using
+        the 'frameset.html' resouce in this method since
+        an autotest specific for frameset's is being added.
+        (tst_QWebPage::errorPageExtensionInIFrames): Added.
+        (tst_QWebPage::errorPageExtensionInFrameset): Added.
 
 2009-11-16  Simon Hausmann  <simon.hausmann@nokia.com>
 
@@ -476,35 +2892,20 @@
         * tests/qwebpage/tst_qwebpage.cpp:
         (tst_QWebPage::errorPageExtension):
 
-2009-11-16  Holger Hans Peter Freyther  <zecke@selfish.org>
+2009-11-13  Adam Roben  <aroben@apple.com>
 
-        Reviewed by NOBODY (OOPS!).
+        Update for changes to FrameLoaderClient
 
-        [Qt] Do not show the QWidget when the WebCore::Widget is hidden
-        https://bugs.webkit.org/show_bug.cgi?id=31203
+        Fixes <http://webkit.org/b/31124> Tell the WebFrameLoadDelegate when
+        window objects in isolated worlds are cleared
 
-        The clipping code was making a QWidget visible even if the
-        WebCore::Widget was hidden. Fix the bug by calling setVisible
-        only if the WebCore::Widget is shown.
+        Reviewed by Dave Hyatt.
 
         * WebCoreSupport/FrameLoaderClientQt.cpp:
-        (WebCore::QtPluginWidget::show): Override WebCore::Widget
-        (WebCore::QtPluginWidget::hide): Override WebCore::Widget
-        (WebCore::QtPluginWidget::handleVisibility): New method to call setVisible when we are visible
-        (FrameLoaderClientQt::createPlugin): Hide the QWidget by default
-
-2009-11-09  Benjamin Poulain  <benjamin.poulain@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30628
-        Add an API to get all the attributes from a QWebElement.
-
-        * Api/qwebelement.cpp:
-        (QWebElement::attributesName):
-        * Api/qwebelement.h:
-        * tests/qwebelement/tst_qwebelement.cpp:
-        (tst_QWebElement::listAttributes):
+        (WebCore::FrameLoaderClientQt::dispatchDidClearWindowObjectInWorld):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+        Replaced windowObjectCleared with this function. Does nothing if the
+        passed-in world is not the mainThreadNormalWorld().
 
 2009-11-13  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
 
@@ -517,6 +2918,18 @@
         (QWebSettingsPrivate::apply):
         (QWebSettings::setMaximumPagesInCache):
 
+2009-11-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix initial QWebView focus behavior.
+
+        focusController->setFocused(true) was not always called.
+        https://bugs.webkit.org/show_bug.cgi?id=31466
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::focusInEvent):
+
 2009-11-13  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -537,6 +2950,18 @@
 
         * docs/docs.pri:
 
+2009-11-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        externalRepresentation should take Frame as the argument
+        https://bugs.webkit.org/show_bug.cgi?id=31393
+
+        No new tests as this is just a refactoring.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::renderTreeDump):
+
 2009-11-12  Antonio Gomes  <tonikitoo@webkit.org>
 
         Reviewed by Jan Alonzo.
@@ -549,6 +2974,21 @@
 
         * Api/qwebpage.cpp:
 
+2009-11-12  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Custom printing shrink factors
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+
+        This reverts commit r49769. The public API for this needs to be reviewed
+        before its inclusion in Qt.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        * Api/qwebsettings.h:
+
 2009-11-11  Antonio Gomes  <tonikitoo@webkit.org>
 
         Reviewed by Kenneth Christiansen.
@@ -576,73 +3016,17 @@
         * Api/qgraphicswebview.cpp:
         * Api/qwebview.cpp:
 
-2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Few classes have virtual functions but non-virtual destructor
-        https://bugs.webkit.org/show_bug.cgi?id=31269
-
-        * Api/qgraphicswebview.cpp:
-        (QGraphicsWebViewPrivate::~QGraphicsWebViewPrivate): Add virtual
-        destructor.
-
-2009-10-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by NOBODY (OOPS!).
-
-        [Qt] Use the default timeout interval for JS as the HTML tokenizer delay for setHtml()
-
-        This ensures that long-running JavaScript (for example due to a modal alert() dialog),
-        will not trigger a deferred load after only 500ms (the default tokenizer delay) while
-        still giving a reasonable timeout (10 seconds) to prevent deadlock.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29381
-
-        * Api/qwebframe.cpp: Document the behaviour
-        * WebCoreSupport/FrameLoaderClientQt.cpp: set the custom tokenizer delay for substitute loads
-        * tests/qwebframe/tst_qwebframe.cpp: Add test
-
-2009-11-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Fix initial QWebView focus behavior.
-
-        focusController->setFocused(true) was not always called.
-        https://bugs.webkit.org/show_bug.cgi?id=31466
-
-        * Api/qwebpage.cpp:
-        (QWebPagePrivate::focusInEvent):
-
-2009-11-12  Benjamin Poulain  <benjamin.poulain@nokia.com>
+2009-11-11  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Reviewed by Kenneth Rohde Christiansen.
+        Unreviewed buildbot fix.
 
-        Custom printing shrink factors
-        https://bugs.webkit.org/show_bug.cgi?id=29042
-
-        This reverts commit r49769. The public API for this needs to be reviewed
-        before its inclusion in Qt.
-
-        * Api/qwebsettings.cpp:
-        (QWebSettingsPrivate::apply):
-        (QWebSettings::QWebSettings):
-        * Api/qwebsettings.h:
+        Export a method to the DRT to know if the document has a
+        document element.
 
-2009-11-11  Liang QI  <liang.qi@nokia.com>
-        Update documentation for the Qt API
-
-        * Api/qgraphicswebview.cpp:
-        * Api/qwebelement.cpp:
         * Api/qwebframe.cpp:
-        * Api/qwebsettings.cpp:
-        * Api/qwebview.cpp:
-
-2009-11-13  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
+        (qt_drt_hasDocumentElement):
 
+2009-11-11  Liang QI  <liang.qi@nokia.com>
 
         [Qt] Fix tst_qwebpage and tst_qwebframe compilation on Symbian.
 
@@ -691,6 +3075,38 @@
 
         * Api/qwebview.cpp:
 
+2009-11-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31323
+        Fix a few compiler warnings
+
+        * tests/qwebframe/tst_qwebframe.cpp: Add extra brackets 
+        to make it explicit where the else case belongs
+
+2009-11-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix enabling of software input panel when activating editable elements
+        in QGraphicsWebView.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::inputMethodEnabled): Implement method to
+        query for input method support.
+        * Api/qwebpage.cpp:
+        (QWebPageWidgetClient::inputMethodEnabled): Ditto for QWidget.
+        (QWebPagePrivate::handleSoftwareInputPanel): Don't use view() to
+        test for input method support. Instead query using QWebPageClient
+        and send the SIPR event to the ownerWidget() instead of the view().
+        The latter is null for QGraphicsWebView.
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (EventSpy::EventSpy):
+        (EventSpy::eventFilter):
+        (tst_QWebPage::inputMethods): Modify the test to verify that SIPR
+        events are dispatched when activating focusable content.
+
 2009-11-10  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
         Unreviewed documentation fixes.
@@ -713,27 +3129,58 @@
 
         * Api/qwebview.cpp:
 
-2009-11-11  Simon Hausmann  <simon.hausmann@nokia.com>
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Reviewed by Tor Arne Vestbø.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Fix enabling of software input panel when activating editable elements
-        in QGraphicsWebView.
+        [Qt] Few classes have virtual functions but non-virtual destructor
+        https://bugs.webkit.org/show_bug.cgi?id=31269
 
         * Api/qgraphicswebview.cpp:
-        (QGraphicsWebViewPrivate::inputMethodEnabled): Implement method to
-        query for input method support.
+        (QGraphicsWebViewPrivate::~QGraphicsWebViewPrivate): Add virtual
+        destructor.
+
+2009-11-09  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30628
+        Add an API to get all the attributes from a QWebElement.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::attributesName):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::listAttributes):
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=31040
+
         * Api/qwebpage.cpp:
-        (QWebPageWidgetClient::inputMethodEnabled): Ditto for QWidget.
-        (QWebPagePrivate::handleSoftwareInputPanel): Don't use view() to
-        test for input method support. Instead query using QWebPageClient
-        and send the SIPR event to the ownerWidget() instead of the view().
-        The latter is null for QGraphicsWebView.
-        * tests/qwebpage/tst_qwebpage.cpp:
-        (EventSpy::EventSpy):
-        (EventSpy::eventFilter):
-        (tst_QWebPage::inputMethods): Modify the test to verify that SIPR
-        events are dispatched when activating focusable content.
+        (QWebPagePrivate::handleScrolling):
+
+2009-11-09  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Track "can have scrollbar" state within FrameView independently of the
+        individual scrollbar states in ScrollView.
+
+        rdar://problem/7215132, https://bugs.webkit.org/show_bug.cgi?id=29167
+        REGRESSION (r48064): mint.com loses scrollbars after coming out of
+        edit mode.
+
+        rdar://problem/7314421, https://bugs.webkit.org/show_bug.cgi?id=30517
+        REGRESSION (r48064): Extra scroll bars in GarageBand Lesson Store.
+
+        Test: fast/overflow/scrollbar-restored.html
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::setScrollBarPolicy):
 
 2009-11-09  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
@@ -908,6 +3355,18 @@
 
         * Api/qgraphicswebview.h:
 
+2009-11-05  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add support for Shift-PageUp and Shift-PageDown key events.
+        https://bugs.webkit.org/show_bug.cgi?id=31166
+
+        Test: LayoutTests/editing/selection/shrink-selection-after-shift-pagedown.html
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::handleKeyboardEvent):
+
 2009-11-05  Simon Hausmann  <hausmann@webkit.org>
 
         Last Qt 4.5 build fix (*sigh*)
@@ -1087,6 +3546,32 @@
         (WebViewCrashTest::loading):
         (tst_QWebView::crashTests):
 
+2009-11-01  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Turn on warnings for QtWebKit for gcc
+        https://bugs.webkit.org/show_bug.cgi?id=30958
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate): Reorder initialization list 
+        to fix compiler warnings.
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::FrameLoaderClientQt): Ditto.
+
+2009-10-30  Evan Stade  <estade@chromium.org>
+
+        Reviewed by David Levin.
+
+        Notify the chrome when the focused node has changed.
+        https://bugs.webkit.org/show_bug.cgi?id=30832
+
+        Added stub implementation for new ChromeClient function.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::focusedNodeChanged):
+        * WebCoreSupport/ChromeClientQt.h:
+
 2009-10-30  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
index 0c5df4a794..45986b38b5 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
@@ -25,6 +25,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
+
 #include "config.h"
 #include "ChromeClientQt.h"
 
@@ -35,11 +36,23 @@
 #include "FrameLoaderClientQt.h"
 #include "FrameView.h"
 #include "HitTestResult.h"
+#include "Icon.h"
 #include "NotImplemented.h"
+#include "ScrollbarTheme.h"
 #include "WindowFeatures.h"
 #include "DatabaseTracker.h"
-#include "SecurityOrigin.h"
+#if defined(Q_WS_MAEMO_5)
+#include "QtMaemoWebPopup.h"
+#else
+#include "QtFallbackWebPopup.h"
+#endif
 #include "QWebPageClient.h"
+#include "SecurityOrigin.h"
+
+#include <qdebug.h>
+#include <qeventloop.h>
+#include <qtextdocument.h>
+#include <qtooltip.h>
 
 #include "qwebpage.h"
 #include "qwebpage_p.h"
@@ -48,22 +61,23 @@
 #include "qwebsecurityorigin_p.h"
 #include "qwebview.h"
 
-#include <qtooltip.h>
-#include <qtextdocument.h>
-
-namespace WebCore
-{
+#if USE(ACCELERATED_COMPOSITING)
+#include "GraphicsLayerQt.h"
+#endif
 
+namespace WebCore {
 
 ChromeClientQt::ChromeClientQt(QWebPage* webPage)
     : m_webPage(webPage)
+    , m_eventLoop(0)
 {
     toolBarsVisible = statusBarVisible = menuBarVisible = true;
 }
 
 ChromeClientQt::~ChromeClientQt()
 {
-
+    if (m_eventLoop)
+        m_eventLoop->exit();
 }
 
 void ChromeClientQt::setWindowRect(const FloatRect& rect)
@@ -141,6 +155,11 @@ void ChromeClientQt::takeFocus(FocusDirection)
 }
 
 
+void ChromeClientQt::focusedNodeChanged(WebCore::Node*)
+{
+}
+
+
 Page* ChromeClientQt::createWindow(Frame*, const FrameLoadRequest& request, const WindowFeatures& features)
 {
     QWebPage *newPage = m_webPage->createWindow(features.dialog ? QWebPage::WebModalDialog : QWebPage::WebBrowserWindow);
@@ -163,14 +182,16 @@ void ChromeClientQt::show()
 
 bool ChromeClientQt::canRunModal()
 {
-    notImplemented();
-    return false;
+    return true;
 }
 
 
 void ChromeClientQt::runModal()
 {
-    notImplemented();
+    m_eventLoop = new QEventLoop();
+    QEventLoop* eventLoop = m_eventLoop;
+    m_eventLoop->exec();
+    delete eventLoop;
 }
 
 
@@ -309,26 +330,62 @@ bool ChromeClientQt::tabsToLinks() const
 
 IntRect ChromeClientQt::windowResizerRect() const
 {
-    return IntRect();
+    if (!m_webPage)
+        return IntRect();
+
+    QWebPageClient* pageClient = platformPageClient();
+    if (!pageClient)
+        return IntRect();
+
+    QWidget* ownerWidget = pageClient->ownerWidget();
+    if (!ownerWidget)
+        return IntRect();
+
+    QWidget* topLevelWidget = ownerWidget->topLevelWidget();
+    QRect topLevelGeometry(topLevelWidget->geometry());
+
+    // There's no API in Qt to query for the size of the resizer, so we assume
+    // it has the same width and height as the scrollbar thickness.
+    int scollbarThickness = ScrollbarTheme::nativeTheme()->scrollbarThickness();
+
+    // There's no API in Qt to query for the position of the resizer. Sometimes
+    // it's drawn by the system, and sometimes it's a QSizeGrip. For RTL locales
+    // it might even be on the lower left side of the window, but in WebKit we
+    // always draw scrollbars on the right hand side, so we assume this to be the
+    // location when computing the resize rect to reserve for WebKit.
+    QPoint resizeCornerTopLeft = ownerWidget->mapFrom(topLevelWidget,
+            QPoint(topLevelGeometry.width(), topLevelGeometry.height())
+            - QPoint(scollbarThickness, scollbarThickness));
+
+    QRect resizeCornerRect = QRect(resizeCornerTopLeft, QSize(scollbarThickness, scollbarThickness));
+    return resizeCornerRect.intersected(pageClient->geometryRelativeToOwnerWidget());
+}
+
+void ChromeClientQt::invalidateWindow(const IntRect&, bool)
+{
+    notImplemented();
 }
 
-void ChromeClientQt::repaint(const IntRect& windowRect, bool contentChanged, bool, bool)
+void ChromeClientQt::invalidateContentsAndWindow(const IntRect& windowRect, bool immediate)
 {
     // No double buffer, so only update the QWidget if content changed.
-    if (contentChanged) {
-        if (platformPageClient()) {
-            QRect rect(windowRect);
-            rect = rect.intersected(QRect(QPoint(0, 0), m_webPage->viewportSize()));
-            if (!rect.isEmpty())
-                platformPageClient()->update(rect);
-        }
-        emit m_webPage->repaintRequested(windowRect);
+    if (platformPageClient()) {
+        QRect rect(windowRect);
+        rect = rect.intersected(QRect(QPoint(0, 0), m_webPage->viewportSize()));
+        if (!rect.isEmpty())
+            platformPageClient()->update(rect);
     }
+    emit m_webPage->repaintRequested(windowRect);
 
     // FIXME: There is no "immediate" support for window painting.  This should be done always whenever the flag
     // is set.
 }
 
+void ChromeClientQt::invalidateContentsForSlowScroll(const IntRect& windowRect, bool immediate)
+{
+    invalidateContentsAndWindow(windowRect, immediate);
+}
+
 void ChromeClientQt::scroll(const IntSize& delta, const IntRect& scrollViewRect, const IntRect&)
 {
     if (platformPageClient())
@@ -448,6 +505,11 @@ void ChromeClientQt::runOpenPanel(Frame* frame, PassRefPtr<FileChooser> prpFileC
     }
 }
 
+void ChromeClientQt::chooseIconForFiles(const Vector<String>& filenames, PassRefPtr<FileChooser> chooser)
+{
+    chooser->iconLoaded(Icon::createIconForFiles(filenames));
+}
+
 bool ChromeClientQt::setCursor(PlatformCursorHandle)
 {
     notImplemented();
@@ -460,4 +522,57 @@ void ChromeClientQt::requestGeolocationPermissionForFrame(Frame*, Geolocation*)
     notImplemented();
 }
 
+#if USE(ACCELERATED_COMPOSITING)
+void ChromeClientQt::attachRootGraphicsLayer(Frame* frame, GraphicsLayer* graphicsLayer)
+{    
+    if (platformPageClient())
+        platformPageClient()->setRootGraphicsLayer(graphicsLayer ? graphicsLayer->nativeLayer() : 0);
+}
+
+void ChromeClientQt::setNeedsOneShotDrawingSynchronization()
+{
+    // we want the layers to synchronize next time we update the screen anyway
+    if (platformPageClient())
+        platformPageClient()->markForSync(false);
+}
+
+void ChromeClientQt::scheduleCompositingLayerSync()
+{
+    // we want the layers to synchronize ASAP
+    if (platformPageClient())
+        platformPageClient()->markForSync(true);
+}
+#endif
+
+QtAbstractWebPopup* ChromeClientQt::createSelectPopup()
+{
+#if defined(Q_WS_MAEMO_5)
+    return new QtMaemoWebPopup;
+#else
+    return new QtFallbackWebPopup;
+#endif
+}
+
+#if ENABLE(WIDGETS_10_SUPPORT)
+bool ChromeClientQt::isDocked()
+{
+    return m_webPage->d->viewMode == "mini";
+}
+
+bool ChromeClientQt::isFloating()
+{
+    return m_webPage->d->viewMode == "floating";
+}
+
+bool ChromeClientQt::isApplication()
+{
+    return m_webPage->d->viewMode == "application";
+}
+
+bool ChromeClientQt::isFullscreen()
+{
+    return m_webPage->d->viewMode == "fullscreen";
+}
+#endif
+
 }
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.h b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.h
index 196c4fcd0a..90ad29e313 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.h
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.h
@@ -34,6 +34,7 @@
 #include "KURL.h"
 #include "PlatformString.h"
 
+class QEventLoop;
 class QWebPage;
 
 namespace WebCore {
@@ -42,6 +43,7 @@ namespace WebCore {
     class FloatRect;
     class Page;
     struct FrameLoadRequest;
+    class QtAbstractWebPopup;
 
     class ChromeClientQt : public ChromeClient
     {
@@ -63,6 +65,8 @@ namespace WebCore {
         virtual bool canTakeFocus(FocusDirection);
         virtual void takeFocus(FocusDirection);
 
+        virtual void focusedNodeChanged(Node*);
+
         virtual Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&);
         virtual void show();
 
@@ -101,8 +105,11 @@ namespace WebCore {
         virtual bool tabsToLinks() const;
         virtual IntRect windowResizerRect() const;
 
-        virtual void repaint(const IntRect&, bool contentChanged, bool immediate = false, bool repaintContentOnly = false);
+        virtual void invalidateWindow(const IntRect&, bool);
+        virtual void invalidateContentsAndWindow(const IntRect&, bool);
+        virtual void invalidateContentsForSlowScroll(const IntRect&, bool);
         virtual void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
+
         virtual IntPoint screenToWindow(const IntPoint&) const;
         virtual IntRect windowToScreen(const IntRect&) const;
         virtual PlatformPageClient platformPageClient() const;
@@ -120,7 +127,21 @@ namespace WebCore {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         virtual void reachedMaxAppCacheSize(int64_t spaceNeeded);
 #endif
+
+#if USE(ACCELERATED_COMPOSITING)
+        // see ChromeClient.h
+        // this is a hook for WebCore to tell us what we need to do with the GraphicsLayers
+        virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*);
+        virtual void setNeedsOneShotDrawingSynchronization();
+        virtual void scheduleCompositingLayerSync();
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+        virtual void needTouchEvents(bool) { }
+#endif
+
         virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
+        virtual void chooseIconForFiles(const Vector<String>&, PassRefPtr<FileChooser>);
 
         virtual void formStateDidChange(const Node*) { }
 
@@ -131,6 +152,16 @@ namespace WebCore {
         virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const {}
 
         virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*);
+        virtual void cancelGeolocationPermissionRequestForFrame(Frame*) { }
+
+#if ENABLE(WIDGETS_10_SUPPORT)
+        virtual bool isDocked();
+        virtual bool isFloating();
+        virtual bool isApplication();
+        virtual bool isFullscreen();
+#endif
+
+        QtAbstractWebPopup* createSelectPopup();
 
         QWebPage* m_webPage;
         WebCore::KURL lastHoverURL;
@@ -140,6 +171,7 @@ namespace WebCore {
         bool toolBarsVisible;
         bool statusBarVisible;
         bool menuBarVisible;
+        QEventLoop* m_eventLoop;
     };
 }
 
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp
index 99e438d50f..e48c3e3ab7 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp
@@ -27,6 +27,8 @@
 #include "DragClientQt.h"
 
 #include "ClipboardQt.h"
+#include "Frame.h"
+#include "PlatformMouseEvent.h"
 #include "qwebpage.h"
 
 #include <QDrag>
@@ -35,6 +37,32 @@
 
 namespace WebCore {
 
+static inline Qt::DropActions dragOperationsToDropActions(unsigned op)
+{
+    Qt::DropActions result = Qt::IgnoreAction;
+    if (op & DragOperationCopy)
+        result = Qt::CopyAction;
+    if (op & DragOperationMove)
+        result |= Qt::MoveAction;
+    if (op & DragOperationGeneric)
+        result |= Qt::MoveAction;
+    if (op & DragOperationLink)
+        result |= Qt::LinkAction;
+    return result;
+}
+
+static inline DragOperation dropActionToDragOperation(Qt::DropActions action)
+{
+    DragOperation result = DragOperationNone;
+    if (action & Qt::CopyAction)
+        result = DragOperationCopy;
+    if (action & Qt::LinkAction)
+        result = DragOperationLink;
+    if (action & Qt::MoveAction)
+        result = DragOperationMove;
+    return result;
+}
+
 DragDestinationAction DragClientQt::actionMaskForDrag(DragData*)
 {
     return DragDestinationActionAny;
@@ -58,7 +86,7 @@ void DragClientQt::willPerformDragSourceAction(DragSourceAction, const IntPoint&
 {
 }
 
-void DragClientQt::startDrag(DragImageRef, const IntPoint&, const IntPoint&, Clipboard* clipboard, Frame*, bool)
+void DragClientQt::startDrag(DragImageRef, const IntPoint&, const IntPoint&, Clipboard* clipboard, Frame* frame, bool)
 {
 #ifndef QT_NO_DRAGANDDROP
     QMimeData* clipboardData = static_cast<ClipboardQt*>(clipboard)->clipboardData();
@@ -66,10 +94,15 @@ void DragClientQt::startDrag(DragImageRef, const IntPoint&, const IntPoint&, Cli
     QWidget* view = m_webPage->view();
     if (view) {
         QDrag *drag = new QDrag(view);
-        if (clipboardData->hasImage())
+        if (clipboardData && clipboardData->hasImage())
             drag->setPixmap(qvariant_cast<QPixmap>(clipboardData->imageData()));
+        DragOperation dragOperationMask = clipboard->sourceOperation();
         drag->setMimeData(clipboardData);
-        drag->start();
+        Qt::DropAction actualDropAction = drag->exec(dragOperationsToDropActions(dragOperationMask));
+
+        // Send dragEnd event
+        PlatformMouseEvent me(m_webPage->view()->mapFromGlobal(QCursor::pos()), QCursor::pos(), LeftButton, MouseEventMoved, 0, false, false, false, false, 0);
+        frame->eventHandler()->dragSourceEndedAt(me, dropActionToDragOperation(actualDropAction));
     }
 #endif
 }
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditCommandQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditCommandQt.cpp
index a16684083a..756ba4c46e 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditCommandQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditCommandQt.cpp
@@ -18,7 +18,6 @@
 */
 
 #include "config.h"
-#include <wtf/Platform.h>
 #include "EditCommandQt.h"
 
 using namespace WebCore;
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
index 2d1a1ebf8d..7b7f61038a 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
@@ -384,18 +384,6 @@ void EditorClientQt::handleKeyboardEvent(KeyboardEvent* event)
         } else
 #endif // QT_NO_SHORTCUT
         switch (kevent->windowsVirtualKeyCode()) {
-#if QT_VERSION < 0x040500
-            case VK_RETURN:
-#ifdef QT_WS_MAC
-                if (kevent->shiftKey() || kevent->metaKey())
-#else
-                if (kevent->shiftKey())
-#endif
-                    frame->editor()->command("InsertLineBreak").execute();
-                else
-                    frame->editor()->command("InsertNewline").execute();
-                break;
-#endif
             case VK_BACK:
                 frame->editor()->deleteWithDirection(SelectionController::BACKWARD,
                         CharacterGranularity, false, true);
@@ -407,28 +395,38 @@ void EditorClientQt::handleKeyboardEvent(KeyboardEvent* event)
             case VK_LEFT:
                 if (kevent->shiftKey())
                     frame->editor()->command("MoveLeftAndModifySelection").execute();
-                else frame->editor()->command("MoveLeft").execute();
+                else
+                    frame->editor()->command("MoveLeft").execute();
                 break;
             case VK_RIGHT:
                 if (kevent->shiftKey())
                     frame->editor()->command("MoveRightAndModifySelection").execute();
-                else frame->editor()->command("MoveRight").execute();
+                else
+                    frame->editor()->command("MoveRight").execute();
                 break;
             case VK_UP:
                 if (kevent->shiftKey())
                     frame->editor()->command("MoveUpAndModifySelection").execute();
-                else frame->editor()->command("MoveUp").execute();
+                else
+                    frame->editor()->command("MoveUp").execute();
                 break;
             case VK_DOWN:
                 if (kevent->shiftKey())
                     frame->editor()->command("MoveDownAndModifySelection").execute();
-                else frame->editor()->command("MoveDown").execute();
+                else
+                    frame->editor()->command("MoveDown").execute();
                 break;
             case VK_PRIOR:  // PageUp
-                frame->editor()->command("MovePageUp").execute();
+                if (kevent->shiftKey())
+                    frame->editor()->command("MovePageUpAndModifySelection").execute();
+                else
+                    frame->editor()->command("MovePageUp").execute();
                 break;
             case VK_NEXT:  // PageDown
-                frame->editor()->command("MovePageDown").execute();
+                if (kevent->shiftKey())
+                    frame->editor()->command("MovePageDownAndModifySelection").execute();
+                else
+                    frame->editor()->command("MovePageDown").execute();
                 break;
             case VK_TAB:
                 return;
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index 5cabca04e3..c5c5739e46 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -1,9 +1,10 @@
 /*
  * Copyright (C) 2006 Zack Rusin <zack@kde.org>
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
- * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
  * Coypright (C) 2008 Holger Hans Peter Freyther
+ * Coypright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
  *
  * All rights reserved.
  *
@@ -37,7 +38,6 @@
 #include "FrameTree.h"
 #include "FrameView.h"
 #include "DocumentLoader.h"
-#include "JSDOMWindowBase.h"
 #include "MIMETypeRegistry.h"
 #include "ResourceResponse.h"
 #include "Page.h"
@@ -50,12 +50,14 @@
 #include "HTMLAppletElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLPlugInElement.h"
+#include "HTTPParsers.h"
 #include "NotImplemented.h"
 #include "QNetworkReplyHandler.h"
 #include "ResourceHandleInternal.h"
 #include "ResourceHandle.h"
-#include "Settings.h"
+#include "ScriptController.h"
 #include "ScriptString.h"
+#include "Settings.h"
 #include "QWebPageClient.h"
 
 #include "qwebpage.h"
@@ -69,14 +71,10 @@
 
 #include <QCoreApplication>
 #include <QDebug>
-#if QT_VERSION >= 0x040400
 #include <QGraphicsScene>
 #include <QGraphicsWidget>
 #include <QNetworkRequest>
 #include <QNetworkReply>
-#else
-#include "qwebnetworkinterface_p.h"
-#endif
 #include "qwebhistory_p.h"
 
 static bool dumpFrameLoaderCallbacks = false;
@@ -146,9 +144,9 @@ namespace WebCore
 FrameLoaderClientQt::FrameLoaderClientQt()
     : m_frame(0)
     , m_webFrame(0)
+    , m_firstData(false)
     , m_pluginView(0)
     , m_hasSentResponseToPlugin(false)
-    , m_firstData(false)
     , m_loadError (ResourceError())
 {
 }
@@ -308,11 +306,32 @@ void FrameLoaderClientQt::dispatchDidChangeLocationWithinPage()
     m_webFrame->page()->d->updateNavigationActions();
 }
 
+void FrameLoaderClientQt::dispatchDidPushStateWithinPage()
+{
+    if (dumpFrameLoaderCallbacks)
+        printf("%s - dispatchDidPushStateWithinPage\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
+        
+    notImplemented();
+}
 
-void FrameLoaderClientQt::dispatchWillClose()
+void FrameLoaderClientQt::dispatchDidReplaceStateWithinPage()
 {
     if (dumpFrameLoaderCallbacks)
-        printf("%s - willCloseFrame\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
+        printf("%s - dispatchDidReplaceStateWithinPage\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
+        
+    notImplemented();
+}
+
+void FrameLoaderClientQt::dispatchDidPopStateWithinPage()
+{
+    if (dumpFrameLoaderCallbacks)
+        printf("%s - dispatchDidPopStateWithinPage\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
+        
+    notImplemented();
+}
+
+void FrameLoaderClientQt::dispatchWillClose()
+{
 }
 
 
@@ -579,9 +598,6 @@ String FrameLoaderClientQt::userAgent(const KURL& url)
 
 void FrameLoaderClientQt::dispatchDidReceiveIcon()
 {
-    if (dumpFrameLoaderCallbacks)
-        printf("%s - didReceiveIconForFrame\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
-
     if (m_webFrame) {
         emit m_webFrame->iconChanged();
     }
@@ -601,10 +617,10 @@ bool FrameLoaderClientQt::canHandleRequest(const WebCore::ResourceRequest&) cons
     return true;
 }
 
-void FrameLoaderClientQt::windowObjectCleared()
+void FrameLoaderClientQt::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld* world)
 {
-    if (dumpFrameLoaderCallbacks)
-        printf("%s - didClearWindowObjectForFrame\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
+    if (world != mainThreadNormalWorld())
+        return;
 
     if (m_webFrame)
         emit m_webFrame->javaScriptWindowObjectCleared();
@@ -643,13 +659,31 @@ bool FrameLoaderClientQt::shouldGoToHistoryItem(WebCore::HistoryItem *) const
     return true;
 }
 
+void FrameLoaderClientQt::dispatchDidAddBackForwardItem(WebCore::HistoryItem*) const
+{
+}
+
+void FrameLoaderClientQt::dispatchDidRemoveBackForwardItem(WebCore::HistoryItem*) const
+{
+}
+
+void FrameLoaderClientQt::dispatchDidChangeBackForwardIndex() const
+{
+}
+
 void FrameLoaderClientQt::didDisplayInsecureContent()
 {
+    if (dumpFrameLoaderCallbacks)
+        printf("didDisplayInsecureContent\n");
+
     notImplemented();
 }
 
 void FrameLoaderClientQt::didRunInsecureContent(WebCore::SecurityOrigin*)
 {
+    if (dumpFrameLoaderCallbacks)
+        printf("didRunInsecureContent\n");
+
     notImplemented();
 }
 
@@ -771,22 +805,13 @@ bool FrameLoaderClientQt::shouldFallBack(const WebCore::ResourceError&)
 WTF::PassRefPtr<WebCore::DocumentLoader> FrameLoaderClientQt::createDocumentLoader(const WebCore::ResourceRequest& request, const SubstituteData& substituteData)
 {
     RefPtr<DocumentLoader> loader = DocumentLoader::create(request, substituteData);
-    if (substituteData.isValid()) {
+    if (substituteData.isValid())
         loader->setDeferMainResourceDataLoad(false);
-        // Use the default timeout interval for JS as the HTML tokenizer delay. This ensures
-        // that long-running JavaScript will still allow setHtml() to be synchronous, while
-        // still giving a reasonable timeout to prevent deadlock.
-        double delay = JSDOMWindowBase::commonJSGlobalData()->timeoutChecker.timeoutInterval() / 1000.0f;
-        m_frame->page()->setCustomHTMLTokenizerTimeDelay(delay);
-    } else {
-        m_frame->page()->setCustomHTMLTokenizerTimeDelay(-1);
-    }
     return loader.release();
 }
 
 void FrameLoaderClientQt::download(WebCore::ResourceHandle* handle, const WebCore::ResourceRequest&, const WebCore::ResourceRequest&, const WebCore::ResourceResponse&)
 {
-#if QT_VERSION >= 0x040400
     if (!m_webFrame)
         return;
 
@@ -795,11 +820,10 @@ void FrameLoaderClientQt::download(WebCore::ResourceHandle* handle, const WebCor
     if (reply) {
         QWebPage *page = m_webFrame->page();
         if (page->forwardUnsupportedContent())
-            emit m_webFrame->page()->unsupportedContent(reply);
+            emit page->unsupportedContent(reply);
         else
             reply->abort();
     }
-#endif
 }
 
 void FrameLoaderClientQt::assignIdentifierToInitialRequest(unsigned long identifier, WebCore::DocumentLoader*, const WebCore::ResourceRequest& request)
@@ -943,7 +967,9 @@ WebCore::Frame* FrameLoaderClientQt::dispatchCreatePage()
 void FrameLoaderClientQt::dispatchDecidePolicyForMIMEType(FramePolicyFunction function, const WebCore::String& MIMEType, const WebCore::ResourceRequest&)
 {
     // we need to call directly here
-    if (canShowMIMEType(MIMEType))
+    if (WebCore::shouldTreatAsAttachment(m_frame->loader()->activeDocumentLoader()->response()))
+        callPolicyFunction(function, PolicyDownload);    
+    else if (canShowMIMEType(MIMEType))
         callPolicyFunction(function, PolicyUse);
     else
         callPolicyFunction(function, PolicyDownload);
@@ -952,11 +978,7 @@ void FrameLoaderClientQt::dispatchDecidePolicyForMIMEType(FramePolicyFunction fu
 void FrameLoaderClientQt::dispatchDecidePolicyForNewWindowAction(FramePolicyFunction function, const WebCore::NavigationAction& action, const WebCore::ResourceRequest& request, PassRefPtr<WebCore::FormState>, const WebCore::String&)
 {
     Q_ASSERT(m_webFrame);
-#if QT_VERSION < 0x040400
-    QWebNetworkRequest r(request);
-#else
     QNetworkRequest r(request.toNetworkRequest(m_webFrame));
-#endif
     QWebPage* page = m_webFrame->page();
 
     if (!page->d->acceptNavigationRequest(0, r, QWebPage::NavigationType(action.type()))) {
@@ -977,11 +999,7 @@ void FrameLoaderClientQt::dispatchDecidePolicyForNewWindowAction(FramePolicyFunc
 void FrameLoaderClientQt::dispatchDecidePolicyForNavigationAction(FramePolicyFunction function, const WebCore::NavigationAction& action, const WebCore::ResourceRequest& request, PassRefPtr<WebCore::FormState>)
 {
     Q_ASSERT(m_webFrame);
-#if QT_VERSION < 0x040400
-    QWebNetworkRequest r(request);
-#else
     QNetworkRequest r(request.toNetworkRequest(m_webFrame));
-#endif
     QWebPage*page = m_webFrame->page();
 
     if (!page->d->acceptNavigationRequest(m_webFrame, r, QWebPage::NavigationType(action.type()))) {
@@ -1006,12 +1024,10 @@ void FrameLoaderClientQt::dispatchUnableToImplementPolicy(const WebCore::Resourc
 
 void FrameLoaderClientQt::startDownload(const WebCore::ResourceRequest& request)
 {
-#if QT_VERSION >= 0x040400
     if (!m_webFrame)
         return;
 
     emit m_webFrame->page()->downloadRequested(request.toNetworkRequest(m_webFrame));
-#endif
 }
 
 PassRefPtr<Frame> FrameLoaderClientQt::createFrame(const KURL& url, const String& name, HTMLFrameOwnerElement* ownerElement,
@@ -1021,7 +1037,12 @@ PassRefPtr<Frame> FrameLoaderClientQt::createFrame(const KURL& url, const String
         return 0;
 
     QWebFrameData frameData(m_frame->page(), m_frame, ownerElement, name);
-    frameData.url = url;
+
+    if (url.isEmpty())
+        frameData.url = blankURL();
+    else
+        frameData.url = url;
+
     frameData.referrer = referrer;
     frameData.allowsScrolling = allowsScrolling;
     frameData.marginWidth = marginWidth;
@@ -1048,6 +1069,24 @@ PassRefPtr<Frame> FrameLoaderClientQt::createFrame(const KURL& url, const String
     return frameData.frame.release();
 }
 
+void FrameLoaderClientQt::didTransferChildFrameToNewDocument()
+{
+    ASSERT(m_frame->ownerElement());
+
+    if (!m_webFrame)
+        return;
+
+    Frame* parentFrame = m_webFrame->d->frame->tree()->parent();
+    ASSERT(parentFrame);
+
+    if (QWebFrame* parent = QWebFramePrivate::kit(parentFrame)) {
+        m_webFrame->d->setPage(parent->page());
+
+        if (m_webFrame->parent() != qobject_cast<QObject*>(parent))
+            m_webFrame->setParent(parent);
+    }
+}
+
 ObjectContentType FrameLoaderClientQt::objectContentType(const KURL& url, const String& _mimeType)
 {
 //    qDebug()<<" ++++++++++++++++ url is "<<url.prettyURL()<<", mime = "<<_mimeType;
@@ -1097,11 +1136,7 @@ const unsigned numqStyleSheetProperties = sizeof(qstyleSheetProperties) / sizeof
 class QtPluginWidget: public Widget
 {
 public:
-    QtPluginWidget(QWidget* w = 0)
-        : Widget(w)
-        , m_visible(false)
-    {}
-
+    QtPluginWidget(QWidget* w = 0): Widget(w) {}
     ~QtPluginWidget()
     {
         if (platformWidget())
@@ -1135,25 +1170,16 @@ public:
         handleVisibility();
     }
 
-    virtual void hide()
-    {
-        m_visible = false;
-        Widget::hide();
-    }
-
     virtual void show()
     {
-        m_visible = true;
-        if (!platformWidget())
-            return;
-
-        handleVisibility();    
+        Widget::show();
+        handleVisibility();
     }
 
 private:
     void handleVisibility()
     {
-        if (!m_visible)
+        if (!isVisible())
             return;
 
         // if setMask is set with an empty QRegion, no clipping will
@@ -1161,8 +1187,6 @@ private:
         QRegion mask = platformWidget()->mask();
         platformWidget()->setVisible(!mask.isEmpty());
     }
-
-    bool m_visible;
 };
 
 #if QT_VERSION >= 0x040600
@@ -1262,13 +1286,11 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
 #endif // QT_NO_STYLE_STYLESHEET
     }
 
-#if QT_VERSION >= 0x040400
         if (!object) {
             QWebPluginFactory* factory = m_webFrame->page()->pluginFactory();
             if (factory)
                 object = factory->create(mimeType, qurl, params, values);
         }
-#endif
 
         if (object) {
             QWidget* widget = qobject_cast<QWidget*>(object);
@@ -1303,8 +1325,23 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
             // FIXME: make things work for widgetless plugins as well
             delete object;
     } else { // NPAPI Plugins
+        Vector<String> params = paramNames;
+        Vector<String> values = paramValues;
+        if (mimeType == "application/x-shockwave-flash") {
+            QWebPageClient* client = m_webFrame->page()->d->client;
+            if (!client || !qobject_cast<QWidget*>(client->pluginParent())) {
+                // inject wmode=opaque when there is no client or the client is not a QWebView
+                size_t wmodeIndex = params.find("wmode");
+                if (wmodeIndex == -1) {
+                    params.append("wmode");
+                    values.append("opaque");
+                } else
+                    values[wmodeIndex] = "opaque";
+            }
+        }
+
         RefPtr<PluginView> pluginView = PluginView::create(m_frame, pluginSize, element, url,
-            paramNames, paramValues, mimeType, loadManually);
+            params, values, mimeType, loadManually);
         return pluginView;
     }
 
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
index 66c4252866..adeb31c8ba 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
@@ -103,6 +103,9 @@ namespace WebCore {
         virtual void dispatchDidCancelClientRedirect();
         virtual void dispatchWillPerformClientRedirect(const KURL&, double interval, double fireDate);
         virtual void dispatchDidChangeLocationWithinPage();
+        virtual void dispatchDidPushStateWithinPage();
+        virtual void dispatchDidReplaceStateWithinPage();
+        virtual void dispatchDidPopStateWithinPage();
         virtual void dispatchWillClose();
         virtual void dispatchDidReceiveIcon();
         virtual void dispatchDidStartProvisionalLoad();
@@ -148,7 +151,9 @@ namespace WebCore {
         virtual void updateGlobalHistory();
         virtual void updateGlobalHistoryRedirectLinks();
         virtual bool shouldGoToHistoryItem(HistoryItem*) const;
-
+        virtual void dispatchDidAddBackForwardItem(HistoryItem*) const;
+        virtual void dispatchDidRemoveBackForwardItem(HistoryItem*) const;
+        virtual void dispatchDidChangeBackForwardIndex() const;
         virtual void didDisplayInsecureContent();
         virtual void didRunInsecureContent(SecurityOrigin*);
 
@@ -189,6 +194,7 @@ namespace WebCore {
 
         virtual PassRefPtr<Frame> createFrame(const KURL& url, const String& name, HTMLFrameOwnerElement* ownerElement,
                                    const String& referrer, bool allowsScrolling, int marginWidth, int marginHeight) ;
+        virtual void didTransferChildFrameToNewDocument();
         virtual PassRefPtr<Widget> createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool);
         virtual void redirectDataToPlugin(Widget* pluginWidget);
 
@@ -197,7 +203,7 @@ namespace WebCore {
         virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType);
         virtual String overrideMediaType() const;
 
-        virtual void windowObjectCleared();
+        virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*);
         virtual void documentElementAvailable();
         virtual void didPerformFirstNavigation() const;
 
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
index 5fbc876a8e..139499d119 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
@@ -50,17 +50,16 @@ namespace WebCore {
 static const QLatin1String settingStoragePrefix("Qt/QtWebKit/QWebInspector/");
 static const QLatin1String settingStorageTypeSuffix(".type");
 
-static InspectorController::Setting variantToSetting(const QVariant& qvariant);
-static QVariant settingToVariant(const InspectorController::Setting& icSetting);
+static String variantToSetting(const QVariant& qvariant);
+static QVariant settingToVariant(const String& value);
 
 class InspectorClientWebPage : public QWebPage {
     Q_OBJECT
     friend class InspectorClientQt;
 public:
     InspectorClientWebPage(QObject* parent = 0)
-    : QWebPage(parent)
+        : QWebPage(parent)
     {
-        settings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, false);
     }
 
     QWebPage* createWindow(QWebPage::WebWindowType)
@@ -82,190 +81,159 @@ void InspectorClientQt::inspectorDestroyed()
     delete this;
 }
 
-Page* InspectorClientQt::createPage()
+    
+void InspectorClientQt::openInspectorFrontend(WebCore::InspectorController*)
 {
     QWebView* inspectorView = new QWebView;
     InspectorClientWebPage* inspectorPage = new InspectorClientWebPage(inspectorView);
     inspectorView->setPage(inspectorPage);
-    m_inspectorView.set(inspectorView);
 
-    inspectorPage->mainFrame()->load(QString::fromLatin1("qrc:/webkit/inspector/inspector.html"));
+    QUrl inspectorUrl = m_inspectedWebPage->settings()->inspectorUrl();
+    if (!inspectorUrl.isValid())
+        inspectorUrl = QUrl("qrc:/webkit/inspector/inspector.html");
+    inspectorView->page()->mainFrame()->load(inspectorUrl);
     m_inspectedWebPage->d->inspectorFrontend = inspectorView;
     m_inspectedWebPage->d->getOrCreateInspector()->d->setFrontend(inspectorView);
 
-    return m_inspectorView->page()->d->page;
+    inspectorView->page()->d->page->inspectorController()->setInspectorFrontendClient(new InspectorFrontendClientQt(m_inspectedWebPage, inspectorView));
 }
 
-String InspectorClientQt::localizedStringsURL()
+void InspectorClientQt::highlight(Node*)
 {
     notImplemented();
-    return String();
 }
 
-String InspectorClientQt::hiddenPanels()
+void InspectorClientQt::hideHighlight()
 {
     notImplemented();
-    return String();
 }
 
-void InspectorClientQt::showWindow()
+void InspectorClientQt::populateSetting(const String& key, String* setting)
 {
-    updateWindowTitle();
+    QSettings qsettings;
+    if (qsettings.status() == QSettings::AccessError) {
+        // QCoreApplication::setOrganizationName and QCoreApplication::setApplicationName haven't been called
+        qWarning("QWebInspector: QSettings couldn't read configuration setting [%s].",
+                 qPrintable(static_cast<QString>(key)));
+        return;
+    }
 
-    m_inspectedWebPage->d->inspectorController()->setWindowVisible(true, true);
-    // We don't allow the inspector to ask for widget visibility itself because showWindow is
-    // not always called when we want.
-    // Inspecting an element or calling QWebInspector::show() should already have made the
-    // widget visible.
+    QString settingKey(settingStoragePrefix + QString(key));
+    QString storedValueType = qsettings.value(settingKey + settingStorageTypeSuffix).toString();
+    QVariant storedValue = qsettings.value(settingKey);
+    storedValue.convert(QVariant::nameToType(storedValueType.toAscii().data()));
+    *setting = variantToSetting(storedValue);
 }
 
-void InspectorClientQt::closeWindow()
+void InspectorClientQt::storeSetting(const String& key, const String& setting)
 {
-    if (m_inspectedWebPage->d->inspector)
-        m_inspectedWebPage->d->inspector->close();
-}
+    QSettings qsettings;
+    if (qsettings.status() == QSettings::AccessError) {
+        qWarning("QWebInspector: QSettings couldn't persist configuration setting [%s].",
+                 qPrintable(static_cast<QString>(key)));
+        return;
+    }
 
-void InspectorClientQt::attachWindow()
-{
-    notImplemented();
+    QVariant valueToStore = settingToVariant(setting);
+    QString settingKey(settingStoragePrefix + QString(key));
+    qsettings.setValue(settingKey, valueToStore);
+    qsettings.setValue(settingKey + settingStorageTypeSuffix, QVariant::typeToName(valueToStore.type()));
 }
 
-void InspectorClientQt::detachWindow()
+static String variantToSetting(const QVariant& qvariant)
 {
-    notImplemented();
+    String retVal;
+
+    switch (qvariant.type()) {
+    case QVariant::Bool:
+        retVal = qvariant.toBool() ? "true" : "false";
+    case QVariant::String:
+        retVal = qvariant.toString();
+    }
+
+    return retVal;
 }
 
-void InspectorClientQt::setAttachedWindowHeight(unsigned)
+static QVariant settingToVariant(const String& setting)
 {
-    notImplemented();
+    QVariant retVal;
+    retVal.setValue(static_cast<QString>(setting));
+    return retVal;
 }
 
-void InspectorClientQt::highlight(Node*)
+InspectorFrontendClientQt::InspectorFrontendClientQt(QWebPage* inspectedWebPage, PassOwnPtr<QWebView> inspectorView)
+    : InspectorFrontendClientLocal(inspectedWebPage->d->page->inspectorController(), inspectorView->page()->d->page) 
+    , m_inspectedWebPage(inspectedWebPage)
+    , m_inspectorView(inspectorView)
+    , m_destroyingInspectorView(false)
 {
-    notImplemented();
 }
 
-void InspectorClientQt::hideHighlight()
+void InspectorFrontendClientQt::frontendLoaded()
 {
-    notImplemented();
+    InspectorFrontendClientLocal::frontendLoaded();
+    setAttachedWindow(true);
 }
 
-void InspectorClientQt::inspectedURLChanged(const String& newURL)
+String InspectorFrontendClientQt::localizedStringsURL()
 {
-    m_inspectedURL = newURL;
-    updateWindowTitle();
+    notImplemented();
+    return String();
 }
 
-void InspectorClientQt::inspectorWindowObjectCleared()
+String InspectorFrontendClientQt::hiddenPanels()
 {
     notImplemented();
+    return String();
 }
 
-void InspectorClientQt::updateWindowTitle()
+void InspectorFrontendClientQt::bringToFront()
 {
-    if (m_inspectedWebPage->d->inspector) {
-        QString caption = QCoreApplication::translate("QWebPage", "Web Inspector - %2").arg(m_inspectedURL);
-        m_inspectedWebPage->d->inspector->setWindowTitle(caption);
-    }
+    updateWindowTitle();
 }
 
-void InspectorClientQt::populateSetting(const String& key, InspectorController::Setting& setting)
+void InspectorFrontendClientQt::closeWindow()
 {
-    QSettings qsettings;
-    if (qsettings.status() == QSettings::AccessError) {
-        // QCoreApplication::setOrganizationName and QCoreApplication::setApplicationName haven't been called
-        qWarning("QWebInspector: QSettings couldn't read configuration setting [%s].",
-                 qPrintable(static_cast<QString>(key)));
+    if (m_destroyingInspectorView)
         return;
-    }
+    m_destroyingInspectorView = true;
 
-    QString settingKey(settingStoragePrefix + QString(key));
-    QString storedValueType = qsettings.value(settingKey + settingStorageTypeSuffix).toString();
-    QVariant storedValue = qsettings.value(settingKey);
-    storedValue.convert(QVariant::nameToType(storedValueType.toAscii().data()));
-    setting = variantToSetting(storedValue);
+    // Clear reference from QWebInspector to the frontend view.
+    m_inspectedWebPage->d->getOrCreateInspector()->d->setFrontend(0);
+#if ENABLE(INSPECTOR)
+    m_inspectedWebPage->d->inspectorController()->disconnectFrontend();
+#endif
+    // Clear pointer before deleting WebView to avoid recursive calls to its destructor.
+    delete m_inspectorView.release();
 }
 
-void InspectorClientQt::storeSetting(const String& key, const InspectorController::Setting& setting)
+void InspectorFrontendClientQt::attachWindow()
 {
-    QSettings qsettings;
-    if (qsettings.status() == QSettings::AccessError) {
-        qWarning("QWebInspector: QSettings couldn't persist configuration setting [%s].",
-                 qPrintable(static_cast<QString>(key)));
-        return;
-    }
-
-    QVariant valueToStore = settingToVariant(setting);
-    QString settingKey(settingStoragePrefix + QString(key));
-    qsettings.setValue(settingKey, valueToStore);
-    qsettings.setValue(settingKey + settingStorageTypeSuffix, QVariant::typeToName(valueToStore.type()));
+    notImplemented();
 }
 
-void InspectorClientQt::removeSetting(const String&)
+void InspectorFrontendClientQt::detachWindow()
 {
     notImplemented();
 }
 
-static InspectorController::Setting variantToSetting(const QVariant& qvariant)
+void InspectorFrontendClientQt::setAttachedWindowHeight(unsigned)
 {
-    InspectorController::Setting retVal;
-
-    switch (qvariant.type()) {
-    case QVariant::Bool:
-        retVal.set(qvariant.toBool());
-        break;
-    case QVariant::Double:
-        retVal.set(qvariant.toDouble());
-        break;
-    case QVariant::Int:
-        retVal.set((long)qvariant.toInt());
-        break;
-    case QVariant::String:
-        retVal.set(qvariant.toString());
-        break;
-    case QVariant::StringList: {
-        QStringList qsList = qvariant.toStringList();
-        int listCount = qsList.count();
-        Vector<String> vector(listCount);
-        for (int i = 0; i < listCount; ++i)
-            vector[i] = qsList[i];
-        retVal.set(vector);
-        break;
-    }
-    }
-
-    return retVal;
+    notImplemented();
 }
 
-static QVariant settingToVariant(const InspectorController::Setting& icSetting)
+void InspectorFrontendClientQt::inspectedURLChanged(const String& newURL)
 {
-    QVariant retVal;
+    m_inspectedURL = newURL;
+    updateWindowTitle();
+}
 
-    switch (icSetting.type()) {
-    case InspectorController::Setting::StringType:
-        retVal.setValue(static_cast<QString>(icSetting.string()));
-        break;
-    case InspectorController::Setting::StringVectorType: {
-        const Vector<String>& vector = icSetting.stringVector();
-        Vector<String>::const_iterator iter;
-        QStringList qsList;
-        for (iter = vector.begin(); iter != vector.end(); ++iter)
-            qsList << *iter;
-        retVal.setValue(qsList);
-        break;
-    }
-    case InspectorController::Setting::DoubleType:
-        retVal.setValue(icSetting.doubleValue());
-        break;
-    case InspectorController::Setting::IntegerType:
-        retVal.setValue((int)icSetting.integerValue());
-        break;
-    case InspectorController::Setting::BooleanType:
-        retVal.setValue(icSetting.booleanValue());
-        break;
+void InspectorFrontendClientQt::updateWindowTitle()
+{
+    if (m_inspectedWebPage->d->inspector) {
+        QString caption = QCoreApplication::translate("QWebPage", "Web Inspector - %2").arg(m_inspectedURL);
+        m_inspectedWebPage->d->inspector->setWindowTitle(caption);
     }
-
-    return retVal;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.h b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.h
index ccf8b69b46..4beadabe98 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.h
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.h
@@ -31,53 +31,64 @@
 #define InspectorClientQt_h
 
 #include "InspectorClient.h"
+#include "InspectorFrontendClientLocal.h"
 #include "OwnPtr.h"
+#include "PassOwnPtr.h"
 #include <QtCore/QString>
 
 class QWebPage;
 class QWebView;
 
 namespace WebCore {
-    class Node;
-    class Page;
-    class String;
+class Node;
+class Page;
+class String;
 
-    class InspectorClientQt : public InspectorClient {
-    public:
-        InspectorClientQt(QWebPage*);
+class InspectorClientQt : public InspectorClient {
+public:
+    InspectorClientQt(QWebPage*);
 
-        virtual void inspectorDestroyed();
+    virtual void inspectorDestroyed();
 
-        virtual Page* createPage();
+    virtual void openInspectorFrontend(WebCore::InspectorController*);
 
-        virtual String localizedStringsURL();
+    virtual void highlight(Node*);
+    virtual void hideHighlight();
 
-        virtual String hiddenPanels();
+    virtual void populateSetting(const String& key, String* value);
+    virtual void storeSetting(const String& key, const String& value);
 
-        virtual void showWindow();
-        virtual void closeWindow();
+private:
+    QWebPage* m_inspectedWebPage;
+};
 
-        virtual void attachWindow();
-        virtual void detachWindow();
+class InspectorFrontendClientQt : public InspectorFrontendClientLocal {
+public:
+    InspectorFrontendClientQt(QWebPage* inspectedWebPage, PassOwnPtr<QWebView> inspectorView);
 
-        virtual void setAttachedWindowHeight(unsigned height);
+    virtual void frontendLoaded();
 
-        virtual void highlight(Node*);
-        virtual void hideHighlight();
-        virtual void inspectedURLChanged(const String& newURL);
+    virtual String localizedStringsURL();
 
-        virtual void populateSetting(const String& key, InspectorController::Setting&);
-        virtual void storeSetting(const String& key, const InspectorController::Setting&);
-        virtual void removeSetting(const String& key);
+    virtual String hiddenPanels();
 
-        virtual void inspectorWindowObjectCleared();
+    virtual void bringToFront();
+    virtual void closeWindow();
 
-    private:
-        void updateWindowTitle();
-        QWebPage* m_inspectedWebPage;
-        OwnPtr<QWebView> m_inspectorView;
-        QString m_inspectedURL;
-    };
+    virtual void attachWindow();
+    virtual void detachWindow();
+
+    virtual void setAttachedWindowHeight(unsigned height);
+
+    virtual void inspectedURLChanged(const String& newURL);
+
+private:
+    void updateWindowTitle();
+    QWebPage* m_inspectedWebPage;
+    OwnPtr<QWebView> m_inspectorView;
+    QString m_inspectedURL;
+    bool m_destroyingInspectorView;
+};
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp
new file mode 100644
index 0000000000..65a28fef59
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp
@@ -0,0 +1,225 @@
+/*
+ * Copyright (C) 2010 Girish Ramakrishnan <girish@forwardbias.in>
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#include "config.h"
+#include "QtFallbackWebPopup.h"
+
+#include "HostWindow.h"
+#include "PopupMenuClient.h"
+#include "QWebPageClient.h"
+#include "qgraphicswebview.h"
+#include <QAbstractItemView>
+#include <QApplication>
+#include <QGraphicsProxyWidget>
+#include <QGraphicsScene>
+#include <QGraphicsView>
+#include <QInputContext>
+#include <QMouseEvent>
+#include <QStandardItemModel>
+
+#if ENABLE(SYMBIAN_DIALOG_PROVIDERS)
+#include <BrCtlDialogsProvider.h>
+#include <BrowserDialogsProvider.h> // S60 platform private header file
+#include <e32base.h>
+#endif
+
+namespace WebCore {
+
+QtFallbackWebPopupCombo::QtFallbackWebPopupCombo(QtFallbackWebPopup& ownerPopup)
+    : m_ownerPopup(ownerPopup)
+{
+}
+
+void QtFallbackWebPopupCombo::showPopup()
+{
+    QComboBox::showPopup();
+    m_ownerPopup.m_popupVisible = true;
+}
+
+void QtFallbackWebPopupCombo::hidePopup()
+{
+    QWidget* activeFocus = QApplication::focusWidget();
+    if (activeFocus && activeFocus == QComboBox::view()
+        && activeFocus->testAttribute(Qt::WA_InputMethodEnabled)) {
+        QInputContext* qic = activeFocus->inputContext();
+        if (qic) {
+            qic->reset();
+            qic->setFocusWidget(0);
+        }
+    }
+
+    QComboBox::hidePopup();
+
+    if (QGraphicsProxyWidget* proxy = graphicsProxyWidget())
+        proxy->setVisible(false);
+
+    if (!m_ownerPopup.m_popupVisible)
+        return;
+
+    m_ownerPopup.m_popupVisible = false;
+    m_ownerPopup.popupDidHide();
+}
+
+// QtFallbackWebPopup
+
+QtFallbackWebPopup::QtFallbackWebPopup()
+    : QtAbstractWebPopup()
+    , m_popupVisible(false)
+    , m_combo(new QtFallbackWebPopupCombo(*this))
+    , m_proxy(0)
+{
+    connect(m_combo, SIGNAL(activated(int)),
+            SLOT(activeChanged(int)), Qt::QueuedConnection);
+}
+
+QtFallbackWebPopup::~QtFallbackWebPopup()
+{
+    // If we create a proxy, then the deletion of the proxy and the
+    // combo will be done by the proxy's parent (QGraphicsWebView)
+    if (!m_proxy)
+        delete m_combo;
+}
+
+void QtFallbackWebPopup::show()
+{
+    if (!pageClient())
+        return;
+
+#if ENABLE(SYMBIAN_DIALOG_PROVIDERS)
+    TRAP_IGNORE(showS60BrowserDialog());
+#else
+    populate();
+    m_combo->setCurrentIndex(currentIndex());
+
+    QRect rect = geometry();
+    if (QGraphicsWebView *webView = qobject_cast<QGraphicsWebView*>(pageClient()->pluginParent())) {
+        if (!m_proxy) {
+            m_proxy = new QGraphicsProxyWidget(webView);
+            m_proxy->setWidget(m_combo);
+        } else
+            m_proxy->setVisible(true);
+        m_proxy->setGeometry(rect);
+    } else {
+        m_combo->setParent(pageClient()->ownerWidget());
+        m_combo->setGeometry(QRect(rect.left(), rect.top(),
+                               rect.width(), m_combo->sizeHint().height()));
+
+    }
+
+    QMouseEvent event(QEvent::MouseButtonPress, QCursor::pos(), Qt::LeftButton,
+                      Qt::LeftButton, Qt::NoModifier);
+    QCoreApplication::sendEvent(m_combo, &event);
+#endif
+}
+
+#if ENABLE(SYMBIAN_DIALOG_PROVIDERS)
+
+static void ResetAndDestroy(TAny* aPtr)
+{
+    RPointerArray<HBufC>* items = reinterpret_cast<RPointerArray<HBufC>* >(aPtr);
+    items->ResetAndDestroy();
+}
+
+void QtFallbackWebPopup::showS60BrowserDialog()
+{
+    static MBrCtlDialogsProvider* dialogs = CBrowserDialogsProvider::NewL(0);
+    if (!dialogs)
+        return;
+
+    int size = itemCount();
+    CArrayFix<TBrCtlSelectOptionData>* options = new CArrayFixFlat<TBrCtlSelectOptionData>(qMax(1, size));
+    RPointerArray<HBufC> items(qMax(1, size));
+    CleanupStack::PushL(TCleanupItem(&ResetAndDestroy, &items));
+
+    for (int i = 0; i < size; i++) {
+        if (itemType(i) == Separator) {
+            TBrCtlSelectOptionData data(_L("----------"), false, false, false);
+            options->AppendL(data);
+        } else {
+            HBufC16* itemStr = HBufC16::NewL(itemText(i).length());
+            itemStr->Des().Copy((const TUint16*)itemText(i).utf16(), itemText(i).length());
+            CleanupStack::PushL(itemStr);
+            TBrCtlSelectOptionData data(*itemStr, i == currentIndex(), false, itemIsEnabled(i));
+            options->AppendL(data);
+            items.AppendL(itemStr);
+            CleanupStack::Pop();
+        }
+    }
+
+    dialogs->DialogSelectOptionL(KNullDesC(), (TBrCtlSelectOptionType)(ESelectTypeSingle | ESelectTypeWithFindPane), *options);
+
+    CleanupStack::PopAndDestroy(&items);
+
+    int newIndex;
+    for (newIndex = 0; newIndex < options->Count() && !options->At(newIndex).IsSelected(); newIndex++) {}
+    if (newIndex == options->Count())
+        newIndex = currentIndex();
+    
+    m_popupVisible = false;
+    popupDidHide();
+
+    if (currentIndex() != newIndex && newIndex >= 0)
+        valueChanged(newIndex);
+
+    delete options;
+}
+#endif
+
+void QtFallbackWebPopup::hide()
+{
+    m_combo->hidePopup();
+}
+
+void QtFallbackWebPopup::populate()
+{
+    m_combo->clear();
+
+    QStandardItemModel* model = qobject_cast<QStandardItemModel*>(m_combo->model());
+    Q_ASSERT(model);
+
+#if !defined(Q_WS_S60)
+    m_combo->setFont(font());
+#endif
+    for (int i = 0; i < itemCount(); ++i) {
+        switch (itemType(i)) {
+        case Separator:
+            m_combo->insertSeparator(i);
+            break;
+        case Group:
+            m_combo->insertItem(i, itemText(i));
+            model->item(i)->setEnabled(false);
+            break;
+        case Option:
+            m_combo->insertItem(i, itemText(i));
+            model->item(i)->setEnabled(itemIsEnabled(i));
+            break;
+        }
+    }
+}
+
+void QtFallbackWebPopup::activeChanged(int index)
+{
+    if (index < 0)
+        return;
+
+    valueChanged(index);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.h b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.h
new file mode 100644
index 0000000000..9d1183f8a8
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#ifndef QtFallbackWebPopup_h
+#define QtFallbackWebPopup_h
+
+#include "QtAbstractWebPopup.h"
+#include <QComboBox>
+
+class QGraphicsProxyWidget;
+
+namespace WebCore {
+
+class QtFallbackWebPopupCombo;
+
+class QtFallbackWebPopup : public QObject, public QtAbstractWebPopup {
+    Q_OBJECT
+public:
+    QtFallbackWebPopup();
+    ~QtFallbackWebPopup();
+
+    virtual void show();
+    virtual void hide();
+
+private slots:
+    void activeChanged(int);
+
+private:
+    friend class QtFallbackWebPopupCombo;
+    bool m_popupVisible;
+    QtFallbackWebPopupCombo* m_combo;
+    QGraphicsProxyWidget* m_proxy;
+
+    void populate();
+#if ENABLE(SYMBIAN_DIALOG_PROVIDERS)
+    void showS60BrowserDialog();
+#endif
+};
+
+class QtFallbackWebPopupCombo : public QComboBox {
+public:
+    QtFallbackWebPopupCombo(QtFallbackWebPopup& ownerPopup);
+    virtual void showPopup();
+    virtual void hidePopup();
+
+private:
+    QtFallbackWebPopup& m_ownerPopup;
+};
+
+}
+
+#endif // QtFallbackWebPopup_h
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/QtMaemoWebPopup.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/QtMaemoWebPopup.cpp
new file mode 100644
index 0000000000..29a16cb8cd
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/QtMaemoWebPopup.cpp
@@ -0,0 +1,220 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#include "config.h"
+#include "QtMaemoWebPopup.h"
+
+#include <QHBoxLayout>
+#include <QListWidget>
+#include <QListWidgetItem>
+#include <QPainter>
+#include <QPushButton>
+#include <QStyledItemDelegate>
+#include <QVBoxLayout>
+
+#include <libintl.h>
+
+
+namespace WebCore {
+
+static const int gMaemoListItemSize = 70;
+static const int gMaemoListPadding = 38;
+static const int gMaemoMaxVisibleItems = 5;
+
+void Maemo5Popup::populateList()
+{
+    QListWidgetItem* listItem;
+    for (int i = 0; i < m_data.itemCount(); ++i) {
+        if (m_data.itemType(i) == QtAbstractWebPopup::Option) {
+            listItem = new QListWidgetItem(m_data.itemText(i));
+            m_list->addItem(listItem);
+            listItem->setSelected(m_data.itemIsSelected(i));
+        } else if (m_data.itemType(i) == QtAbstractWebPopup::Group) {
+            listItem = new QListWidgetItem(m_data.itemText(i));
+            m_list->addItem(listItem);
+            listItem->setSelected(false);
+            listItem->setFlags(Qt::NoItemFlags);
+        }
+    }
+    connect(m_list, SIGNAL(itemClicked(QListWidgetItem*)), this, SLOT(onItemSelected(QListWidgetItem*)));
+}
+
+void Maemo5Popup::onItemSelected(QListWidgetItem* item)
+{
+    if (item->flags() != Qt::NoItemFlags)
+        emit itemClicked(m_list->row(item));
+}
+
+QtMaemoWebPopup::QtMaemoWebPopup()
+    : QtAbstractWebPopup()
+    , m_popup(0)
+{
+}
+
+QtMaemoWebPopup::~QtMaemoWebPopup()
+{
+    if (m_popup)
+        m_popup->deleteLater();
+}
+
+Maemo5Popup* QtMaemoWebPopup::createSingleSelectionPopup()
+{
+    return new Maemo5SingleSelectionPopup(*this);
+}
+
+Maemo5Popup* QtMaemoWebPopup::createMultipleSelectionPopup()
+{
+    return new Maemo5MultipleSelectionPopup(*this);
+}
+
+Maemo5Popup* QtMaemoWebPopup::createPopup()
+{
+    Maemo5Popup* result = multiple() ? createMultipleSelectionPopup() : createSingleSelectionPopup();
+    connect(result, SIGNAL(finished(int)), this, SLOT(popupClosed()));
+    connect(result, SIGNAL(itemClicked(int)), this, SLOT(itemClicked(int)));
+    return result;
+}
+
+void QtMaemoWebPopup::show()
+{
+    if (!pageClient() || m_popup)
+        return;
+
+    m_popup = createPopup();
+    m_popup->show();
+}
+
+void QtMaemoWebPopup::hide()
+{
+    if (!m_popup)
+        return;
+
+    m_popup->accept();
+}
+
+void QtMaemoWebPopup::popupClosed()
+{
+    if (!m_popup)
+        return;
+
+    m_popup->deleteLater();
+    m_popup = 0;
+    popupDidHide();
+}
+
+void QtMaemoWebPopup::itemClicked(int idx)
+{
+    selectItem(idx, true, false);
+}
+
+Maemo5SingleSelectionPopup::Maemo5SingleSelectionPopup(QtAbstractWebPopup& data)
+    : Maemo5Popup(data)
+{
+    // we try to get the standard list title the web browser is using
+    const char* title = ::dgettext("osso-browser-ui", "weba_ti_texlist_single");
+    if (qstrcmp(title, "weba_ti_texlist_single"))
+        setWindowTitle(QString::fromUtf8(title));
+    else
+        setWindowTitle("Select item");
+
+    QHBoxLayout* hLayout = new QHBoxLayout(this);
+    hLayout->setContentsMargins(0, 0, 0, 0);
+
+    m_list = new QListWidget(this);
+    populateList();
+
+    hLayout->addSpacing(gMaemoListPadding);
+    hLayout->addWidget(m_list);
+    hLayout->addSpacing(gMaemoListPadding);
+
+    connect(m_list, SIGNAL(itemClicked(QListWidgetItem*)), this, SLOT(accept()));
+
+    const int visibleItemCount = (m_list->count() > gMaemoMaxVisibleItems) ? gMaemoMaxVisibleItems : m_list->count();
+    resize(size().width(), visibleItemCount * gMaemoListItemSize);
+}
+
+
+class MultipleItemListDelegate : public QStyledItemDelegate {
+public:
+    MultipleItemListDelegate(QObject* parent = 0)
+           : QStyledItemDelegate(parent)
+    {
+        tickMark = QIcon::fromTheme("widgets_tickmark_list").pixmap(48, 48);
+    }
+
+    void paint(QPainter* painter, const QStyleOptionViewItem& option, const QModelIndex& index) const
+    {
+        QStyledItemDelegate::paint(painter, option, index);
+
+        if (option.state & QStyle::State_Selected)
+            painter->drawPixmap(option.rect.width() - tickMark.rect().width(), option.rect.y() + (option.rect.height() / 2 - tickMark.rect().height() / 2), tickMark);
+    }
+
+private:
+    QPixmap tickMark;
+};
+
+Maemo5MultipleSelectionPopup::Maemo5MultipleSelectionPopup(QtAbstractWebPopup& data)
+    : Maemo5Popup(data)
+{
+    // we try to get the standard list title the web browser is using
+    const char* title = ::dgettext("osso-browser-ui", "weba_ti_textlist_multi");
+    if (qstrcmp(title, "weba_ti_textlist_multi"))
+        setWindowTitle(QString::fromUtf8(title));
+    else
+        setWindowTitle("Select items");
+
+    QHBoxLayout* hLayout = new QHBoxLayout(this);
+    hLayout->setContentsMargins(0, 0, 0, 0);
+
+    m_list = new QListWidget(this);
+    m_list->setSelectionMode(QAbstractItemView::MultiSelection);
+    populateList();
+
+    MultipleItemListDelegate* delegate = new MultipleItemListDelegate(this);
+    m_list->setItemDelegate(delegate);
+
+    hLayout->addSpacing(gMaemoListPadding);
+    hLayout->addWidget(m_list);
+
+    QVBoxLayout* vLayout = new QVBoxLayout();
+
+    const int visibleItemCount = (m_list->count() > gMaemoMaxVisibleItems) ? gMaemoMaxVisibleItems : m_list->count();
+    vLayout->addSpacing((visibleItemCount - 1) * gMaemoListItemSize);
+
+    // we try to get the standard Done button title
+    QPushButton* done = new QPushButton(this);
+    title = ::dgettext("hildon-libs", "wdgt_bd_done");
+    if (qstrcmp(title, "wdgt_bd_done"))
+        done->setText(QString::fromUtf8(title));
+    else
+        done->setText("Done");
+
+    done->setMinimumWidth(178);
+    vLayout->addWidget(done);
+
+    hLayout->addSpacing(8);
+    hLayout->addLayout(vLayout);
+    hLayout->addSpacing(18);
+
+    connect(done, SIGNAL(clicked()), this, SLOT(accept()));
+    resize(size().width(), visibleItemCount * gMaemoListItemSize);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/QtMaemoWebPopup.h b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/QtMaemoWebPopup.h
new file mode 100644
index 0000000000..a163a20d3b
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/QtMaemoWebPopup.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#ifndef QtMaemoWebPopup_h
+#define QtMaemoWebPopup_h
+
+#include "QtAbstractWebPopup.h"
+
+#include <QDialog>
+
+class QListWidgetItem;
+class QListWidget;
+
+
+namespace WebCore {
+
+class Maemo5Popup : public QDialog {
+    Q_OBJECT
+public:
+    Maemo5Popup(QtAbstractWebPopup& data) : m_data(data) {}
+
+signals:
+    void itemClicked(int idx);
+
+protected slots:
+    void onItemSelected(QListWidgetItem* item);
+
+protected:
+    void populateList();
+
+    QtAbstractWebPopup& m_data;
+    QListWidget* m_list;
+};
+
+
+class QtMaemoWebPopup : public QObject, public QtAbstractWebPopup {
+    Q_OBJECT
+public:
+    QtMaemoWebPopup();
+    ~QtMaemoWebPopup();
+
+    virtual void show();
+    virtual void hide();
+
+private slots:
+    void popupClosed();
+    void itemClicked(int idx);
+
+private:
+    Maemo5Popup* m_popup;
+
+    Maemo5Popup* createPopup();
+    Maemo5Popup* createSingleSelectionPopup();
+    Maemo5Popup* createMultipleSelectionPopup();
+};
+
+
+class Maemo5SingleSelectionPopup : public Maemo5Popup {
+    Q_OBJECT
+public:
+    Maemo5SingleSelectionPopup(QtAbstractWebPopup& data);
+};
+
+
+class Maemo5MultipleSelectionPopup : public Maemo5Popup {
+    Q_OBJECT
+public:
+    Maemo5MultipleSelectionPopup(QtAbstractWebPopup& data);
+};
+
+}
+
+#endif // QtMaemoWebPopup_h
diff --git a/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdocconf b/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdocconf
index 8ee8f69427..292c124594 100644
--- a/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdocconf
+++ b/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdocconf
@@ -4,7 +4,7 @@ project     = qtwebkit
 description = "Qt WebKit API Documentation"
 
 headerdirs = $SRCDIR/WebKit/qt/Api
-sourcedirs = $SRCDIR/WebKit/qt/Api $SRCDIR/WebKit/qt/docs
+sourcedirs = $SRCDIR/WebKit/qt/Api $SRCDIR/WebKit/qt/docs $SRCDIR/JavaScriptCore/qt/api
 outputdir = $OUTPUT_DIR/doc/html
 outputformats = HTML
 sources.fileextensions  = "*.cpp *.doc *.qdoc *.h"
diff --git a/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/webelement/main.cpp b/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/webelement/main.cpp
index 2707ffbc3b..822b61c4cc 100644
--- a/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/webelement/main.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/webelement/main.cpp
@@ -53,8 +53,8 @@ static void findAll()
     */
 
 //! [FindAll intro]
-    QList<QWebElement> allSpans = document.findAll("span");
-    QList<QWebElement> introSpans = document.findAll("p.intro span");
+    QWebElementCollection allSpans = document.findAll("span");
+    QWebElementCollection introSpans = document.findAll("p.intro span");
 //! [FindAll intro] //! [FindAll]
 }
 
diff --git a/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def b/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def
index cfa8f7f2ff..582305f5ca 100644
--- a/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def
+++ b/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def
@@ -694,4 +694,25 @@ EXPORTS
 	_Z25qt_resumeActiveDOMObjectsP9QWebFrame @ 693 NONAME
 	_Z26qt_suspendActiveDOMObjectsP9QWebFrame @ 694 NONAME
 	_Z35qtwebkit_webframe_scrollRecursivelyP9QWebFrameii @ 695 NONAME ABSENT
+	_ZN13QWebInspector10closeEventEP11QCloseEvent @ 696 NONAME
+	_ZN9QWebFrame17scrollRecursivelyEii @ 697 NONAME ABSENT
+	_ZN16QGraphicsWebView20setResizesToContentsEb @ 698 NONAME
+	_ZNK16QGraphicsWebView17resizesToContentsEv @ 699 NONAME
+	_Z20qt_drt_numberOfPagesP9QWebFrameff @ 700 NONAME
+	_Z24qt_drt_pauseSVGAnimationP9QWebFrameRK7QStringdS3_ @ 701 NONAME
+	_Z24qt_drt_webinspector_showP8QWebPage @ 702 NONAME
+	_Z24qt_drt_workerThreadCountv @ 703 NONAME
+	_Z25qt_drt_hasDocumentElementP9QWebFrame @ 704 NONAME
+	_Z25qt_drt_webinspector_closeP8QWebPage @ 705 NONAME
+	_Z31qt_drt_pageNumberForElementByIdP9QWebFrameRK7QStringff @ 706 NONAME
+	_Z33qt_drt_webinspector_executeScriptP8QWebPagelRK7QString @ 707 NONAME
+	_Z34qt_drt_setTimelineProfilingEnabledP8QWebPageb @ 708 NONAME
+	_Z35qt_drt_setFrameFlatteningEnabledP8QWebPageb @ 709 NONAME
+	_Z36qt_drt_evaluateScriptInIsolatedWorldP9QWebFrameiRK7QString @ 710 NONAME
+	_Z47qt_drt_setDomainRelaxationForbiddenForURLSchemebRK7QString @ 711 NONAME
+	_ZN9QWebFrame11pageChangedEv @ 712 NONAME
+	_ZN9QWebFrame14scrollToAnchorERK7QString @ 713 NONAME
+	_ZN12QWebSettings15setInspectorUrlERK4QUrl @ 714 NONAME
 	_Z35qtwebkit_webframe_scrollRecursivelyP9QWebFrameiiRK6QPoint @ 715 NONAME
+	_ZN16QGraphicsWebView26setTiledBackingStoreFrozenEb @ 716 NONAME
+	_ZNK16QGraphicsWebView25isTiledBackingStoreFrozenEv @ 717 NONAME
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/loading/loading.pro b/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/loading/loading.pro
new file mode 100644
index 0000000000..024211fa6b
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/loading/loading.pro
@@ -0,0 +1,2 @@
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../../..
+include(../../tests.pri)
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/loading/tst_loading.pro b/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/loading/tst_loading.pro
deleted file mode 100644
index bc5e75f208..0000000000
--- a/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/loading/tst_loading.pro
+++ /dev/null
@@ -1,11 +0,0 @@
-TEMPLATE = app
-TARGET = tst_loading
-include(../../../../../WebKit.pri)
-SOURCES += tst_loading.cpp
-QT += testlib network
-QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
-
-symbian {
-    TARGET.UID3 = 0xA000E541
-    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
-}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/painting.pro b/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/painting.pro
new file mode 100644
index 0000000000..b4fc56a3f3
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/painting.pro
@@ -0,0 +1,2 @@
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../../..
+include(../../tests.pri)
\ No newline at end of file
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/tst_painting.pro b/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/tst_painting.pro
deleted file mode 100644
index 48c7072279..0000000000
--- a/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/tst_painting.pro
+++ /dev/null
@@ -1,11 +0,0 @@
-TEMPLATE = app
-TARGET = tst_painting
-include(../../../../../WebKit.pri)
-SOURCES += tst_painting.cpp
-QT += testlib network
-QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
-
-symbian {
-    TARGET.UID3 = 0xA000E542
-    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
-}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/hybridPixmap.pro b/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/hybridPixmap.pro
new file mode 100644
index 0000000000..9e808709dd
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/hybridPixmap.pro
@@ -0,0 +1,11 @@
+# -------------------------------------------------
+# Project created by QtCreator 2009-12-10T11:25:02
+# -------------------------------------------------
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+include(../tests.pri)
+TARGET = hybridPixmap
+SOURCES += widget.cpp
+HEADERS += widget.h
+FORMS += widget.ui
+RESOURCES += resources.qrc
+CONFIG += console
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/resources.qrc b/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/resources.qrc
new file mode 100644
index 0000000000..5fd47e32da
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/resources.qrc
@@ -0,0 +1,5 @@
+<RCC>
+    <qresource prefix="/">
+        <file>test.html</file>
+    </qresource>
+</RCC>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/test.html b/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/test.html
new file mode 100644
index 0000000000..0f2c345e47
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/test.html
@@ -0,0 +1,65 @@
+<html>
+    <head>
+        <style>
+            img { display: block; border-style: groove}
+        </style>
+        <script>
+            function startTest()
+            {
+                var obj = myWidget.image;
+                var pxm = myWidget.pixmap;
+
+                var img = new Image;
+                obj.assignToHTMLImageElement(img);
+                var img1 = document.getElementById("img1");
+                var img2 = document.getElementById("img2");
+                var img3 = document.getElementById("img3");
+                var img4 = document.getElementById("img4");
+                document.body.appendChild(img);
+                obj.assignToHTMLImageElement(img3);
+                pxm.assignToHTMLImageElement(img4);
+                myWidget.compare(pxm.width, img4.width);
+                myWidget.compare(obj.width, img3.width);
+                var signalsFired = 0;
+                myWidget.compare(obj.toString(),"[Qt Native Pixmap "+obj.width+","+obj.height+"]");
+                myWidget.compare(String(pxm),"[Qt Native Pixmap "+pxm.width+","+pxm.height+"]");
+
+                // this shouldn't work but shouldn't crash
+                myWidget.randomSlot("foobar");
+
+                myWidget.pixmapSignal.connect(function(imgFromSignal) {
+                    myWidget.compare(imgFromSignal.height, img2.height);
+                    if (++signalsFired == 2)
+                        myWidget.completeTest();
+                });
+
+                myWidget.imageSignal.connect(function(imgFromSignal) {
+                    myWidget.compare(pxm.height, img2.height);
+                    if (++signalsFired == 2)
+                        myWidget.completeTest();
+                });
+
+                function continueTestAfterImagesAreLoaded()
+                {
+                    if (img1.complete && img2.complete) {
+                        myWidget.compare(pxm.height, img2.height);
+                        myWidget.pixmapSlot(img);
+                        myWidget.imageSlot(pxm);
+                    }
+                }
+                img1.onload = continueTestAfterImagesAreLoaded;
+                img2.onload = continueTestAfterImagesAreLoaded;
+                img1.src = obj.toDataUrl();
+                img2.src = myWidget.pixmap.toDataUrl();
+                myWidget.image = pxm;
+                myWidget.pixmap = img;
+            }
+        </script>
+    </head>
+    <body onload="startTest()">
+        <img id="img1" />
+        <img id="img2" />
+        <img id="img3" />
+        <img id="img4" />
+    </body>
+</html>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/tst_hybridPixmap.cpp b/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/tst_hybridPixmap.cpp
new file mode 100644
index 0000000000..72dbb3b967
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/tst_hybridPixmap.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "../util.h"
+
+#include "widget.h"
+#include <QtTest/QtTest>
+
+class tst_hybridPixmap : public QObject {
+    Q_OBJECT
+
+public:
+    tst_hybridPixmap(QObject* o = 0) : QObject(o) {}
+
+public slots:
+    void init()
+    {
+    }
+
+    void cleanup()
+    {
+    }
+
+private slots:
+    void hybridPixmap()
+    {
+        Widget widget;
+        widget.show();
+        widget.start();
+        waitForSignal(&widget, SIGNAL(testComplete()));
+    }
+};
+
+QTEST_MAIN(tst_hybridPixmap)
+
+#include <tst_hybridPixmap.moc>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/widget.cpp b/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/widget.cpp
new file mode 100644
index 0000000000..cfdb1d6eeb
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/widget.cpp
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "widget.h"
+
+#include "qwebelement.h"
+#include "qwebframe.h"
+#include "ui_widget.h"
+#include <QPainter>
+#include <QtTest/QtTest>
+
+Widget::Widget(QWidget* parent) :
+    QWidget(parent),
+    ui(new Ui::Widget)
+{
+    ui->setupUi(this);
+}
+
+void Widget::refreshJS()
+{
+    ui->webView->page()->mainFrame()->addToJavaScriptWindowObject("myWidget", this);
+}
+void Widget::start()
+{
+    ui->webView->load(QUrl("qrc:///test.html"));
+    connect(ui->webView->page()->mainFrame(), SIGNAL(javaScriptWindowObjectCleared()), this, SLOT(refreshJS()));
+    ui->webView->page()->mainFrame()->addToJavaScriptWindowObject("myWidget", this);
+}
+
+void Widget::completeTest()
+{
+    QCOMPARE(ui->lbl1->pixmap()->size(), ui->lbl2->size());
+    QCOMPARE(ui->lbl3->size(), ui->lbl4->pixmap()->size());
+    QCOMPARE(ui->lbl2->size().width(), ui->webView->page()->mainFrame()->findFirstElement("#img1").evaluateJavaScript("this.width").toInt());
+    QCOMPARE(ui->lbl3->size().width(), ui->webView->page()->mainFrame()->findFirstElement("#img2").evaluateJavaScript("this.width").toInt());
+    emit testComplete();
+}
+
+void Widget::setPixmap(const QPixmap& p)
+{
+    ui->lbl1->setPixmap(p);
+}
+QPixmap Widget::pixmap() const
+{
+    QPixmap px(ui->lbl3->size());
+    {
+        QPainter p(&px);
+        ui->lbl3->render(&p);
+    }
+    return px;
+}
+void Widget::setImage(const QImage& img)
+{
+    ui->lbl4->setPixmap(QPixmap::fromImage(img));
+}
+
+QImage Widget::image() const
+{
+    QImage img(ui->lbl2->size(), QImage::Format_ARGB32);
+    {
+        QPainter p(&img);
+        ui->lbl2->render(&p);
+    }
+    return img;
+}
+
+Widget::~Widget()
+{
+    delete ui;
+}
+
+void Widget::changeEvent(QEvent* e)
+{
+    QWidget::changeEvent(e);
+    switch (e->type()) {
+    case QEvent::LanguageChange:
+        ui->retranslateUi(this);
+        break;
+    default:
+        break;
+    }
+}
+void Widget::compare(const QVariant& a, const QVariant& b)
+{
+    QCOMPARE(a, b);
+}
+
+void Widget::imageSlot(const QImage& img)
+{
+    QCOMPARE(img.size(), ui->lbl3->size());
+    emit pixmapSignal(QPixmap::fromImage(img));
+}
+
+void Widget::pixmapSlot(const QPixmap& pxm)
+{
+    QCOMPARE(pxm.size(), ui->lbl2->size());
+    emit imageSignal(ui->lbl4->pixmap()->toImage());
+}
+
+void Widget::randomSlot(const QPixmap& pxm)
+{
+    QVERIFY(pxm.isNull());
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/widget.h b/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/widget.h
new file mode 100644
index 0000000000..a49f8ba91f
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/widget.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifndef widget_h
+#define widget_h
+
+#include <QImage>
+#include <QPixmap>
+#include <QWidget>
+#include "qwebview.h"
+
+typedef QWebView WebView;
+
+namespace Ui {
+class Widget;
+}
+
+class Widget : public QWidget {
+    Q_OBJECT
+    Q_PROPERTY(QPixmap pixmap READ pixmap WRITE setPixmap)
+    Q_PROPERTY(QImage image READ image WRITE setImage)
+
+public:
+    Widget(QWidget* parent = 0);
+    ~Widget();
+    void setPixmap(const QPixmap&);
+    QPixmap pixmap() const;
+    void setImage(const QImage&);
+    QImage image() const;
+
+private slots:
+    void refreshJS();
+
+public slots:
+    void completeTest();
+    void start();
+    void compare(const QVariant& a, const QVariant& b);
+    void imageSlot(const QImage&);
+    void pixmapSlot(const QPixmap&);
+    void randomSlot(const QPixmap&);
+
+signals:
+    void testComplete();
+    void imageSignal(const QImage&);
+    void pixmapSignal(const QPixmap&);
+
+protected:
+    void changeEvent(QEvent* e);
+
+private:
+    Ui::Widget* ui;
+};
+
+#endif // widget_h
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/widget.ui b/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/widget.ui
new file mode 100644
index 0000000000..4f2b3b81bb
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/hybridPixmap/widget.ui
@@ -0,0 +1,95 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ui version="4.0">
+ <class>Widget</class>
+ <widget class="QWidget" name="Widget">
+  <property name="geometry">
+   <rect>
+    <x>0</x>
+    <y>0</y>
+    <width>600</width>
+    <height>400</height>
+   </rect>
+  </property>
+  <property name="windowTitle">
+   <string>Widget</string>
+  </property>
+  <layout class="QVBoxLayout" name="verticalLayout">
+   <item>
+    <widget class="WebView" name="webView" native="true">
+     <property name="url" stdset="0">
+      <url>
+       <string>about:blank</string>
+      </url>
+     </property>
+    </widget>
+   </item>
+   <item>
+    <layout class="QHBoxLayout" name="horizontalLayout">
+     <item>
+      <widget class="QLabel" name="lbl1">
+       <property name="text">
+        <string/>
+       </property>
+      </widget>
+     </item>
+     <item>
+      <widget class="QLabel" name="lbl2">
+       <property name="minimumSize">
+        <size>
+         <width>120</width>
+         <height>30</height>
+        </size>
+       </property>
+       <property name="maximumSize">
+        <size>
+         <width>120</width>
+         <height>30</height>
+        </size>
+       </property>
+       <property name="text">
+        <string>Image from Qt to HTML</string>
+       </property>
+      </widget>
+     </item>
+     <item>
+      <widget class="QLabel" name="lbl3">
+       <property name="text">
+        <string>Pixmap from Qt to HTML</string>
+       </property>
+      </widget>
+     </item>
+     <item>
+      <widget class="QLabel" name="lbl4">
+       <property name="text">
+        <string/>
+       </property>
+      </widget>
+     </item>
+     <item>
+      <spacer name="horizontalSpacer">
+       <property name="orientation">
+        <enum>Qt::Horizontal</enum>
+       </property>
+       <property name="sizeHint" stdset="0">
+        <size>
+         <width>40</width>
+         <height>20</height>
+        </size>
+       </property>
+      </spacer>
+     </item>
+    </layout>
+   </item>
+  </layout>
+ </widget>
+ <layoutdefault spacing="6" margin="11"/>
+ <customwidgets>
+  <customwidget>
+   <class>WebView</class>
+   <extends>QWidget</extends>
+   <header>widget.h</header>
+  </customwidget>
+ </customwidgets>
+ <resources/>
+ <connections/>
+</ui>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro b/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
index 57b44375ff..d056014db9 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
@@ -1,10 +1,2 @@
-TEMPLATE = app
-TARGET = tst_qgraphicswebview
-include(../../../../WebKit.pri)
-SOURCES  += tst_qgraphicswebview.cpp
-QT += testlib network
-QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
-
-symbian {
-    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
-}
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+include(../tests.pri)
\ No newline at end of file
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
index a52e167c2e..657e09f527 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
@@ -17,36 +17,13 @@
     Boston, MA 02110-1301, USA.
 */
 
+#include "../util.h"
 #include <QtTest/QtTest>
-
 #include <QGraphicsView>
 #include <qgraphicswebview.h>
 #include <qwebpage.h>
 #include <qwebframe.h>
 
-/**
- * Starts an event loop that runs until the given signal is received.
- * Optionally the event loop
- * can return earlier on a timeout.
- *
- * \return \p true if the requested signal was received
- *         \p false on timeout
- */
-static bool waitForSignal(QObject* obj, const char* signal, int timeout = 10000)
-{
-    QEventLoop loop;
-    QObject::connect(obj, signal, &loop, SLOT(quit()));
-    QTimer timer;
-    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
-    if (timeout > 0) {
-        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
-        timer.setSingleShot(true);
-        timer.start(timeout);
-    }
-    loop.exec();
-    return timeoutSpy.isEmpty();
-}
-
 class tst_QGraphicsWebView : public QObject
 {
     Q_OBJECT
@@ -113,7 +90,7 @@ void tst_QGraphicsWebView::crashOnViewlessWebPages()
     view.setSizePolicy(QSizePolicy::Expanding, QSizePolicy::Expanding);
     view.resize(600, 480);
     webView->resize(view.geometry().size());
-    QTest::qWait(200);
+    QCoreApplication::processEvents();
     view.show();
 
     page->mainFrame()->setHtml(QString("data:text/html,"
@@ -122,7 +99,7 @@ void tst_QGraphicsWebView::crashOnViewlessWebPages()
                                                 "<frame src=\"data:text/html,bar\">"
                                             "</frameset>"));
 
-    QVERIFY(::waitForSignal(page, SIGNAL(loadFinished(bool))));
+    QVERIFY(waitForSignal(page, SIGNAL(loadFinished(bool))));
 }
 
 QTEST_MAIN(tst_QGraphicsWebView)
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.pro
index c45a9ac5a1..d056014db9 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.pro
@@ -1,12 +1,2 @@
-TEMPLATE = app
-TARGET = tst_qwebelement
-include(../../../../WebKit.pri)
-SOURCES  += tst_qwebelement.cpp
-RESOURCES += qwebelement.qrc
-QT += testlib network
-QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
-
-symbian {
-    TARGET.UID3 = 0xA000E53A
-    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
-}
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+include(../tests.pri)
\ No newline at end of file
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.qrc b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.qrc
deleted file mode 100644
index 28b9d7b3a1..0000000000
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.qrc
+++ /dev/null
@@ -1,7 +0,0 @@
-<!DOCTYPE RCC><RCC version="1.0">
-<qresource prefix="/">
-<file>style.css</file>
-<file>style2.css</file>
-<file>image.png</file>
-</qresource>
-</RCC>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/image.png b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/resources/image.png
index 8d703640c1..8d703640c1 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/image.png
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/resources/image.png
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/style.css b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/resources/style.css
index 2713dfda9b..2713dfda9b 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/style.css
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/resources/style.css
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/style2.css b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/resources/style2.css
index 6575dcb040..6575dcb040 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/style2.css
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/resources/style2.css
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
index e9dae18cd4..8db0ec3642 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
@@ -19,38 +19,15 @@
 
 
 #include <QtTest/QtTest>
-
 #include <qwebpage.h>
 #include <qwidget.h>
 #include <qwebview.h>
 #include <qwebframe.h>
 #include <qwebelement.h>
+#include <util.h>
 //TESTED_CLASS=
 //TESTED_FILES=
 
-/**
- * Starts an event loop that runs until the given signal is received.
- Optionally the event loop
- * can return earlier on a timeout.
- *
- * \return \p true if the requested signal was received
- *         \p false on timeout
- */
-static bool waitForSignal(QObject* obj, const char* signal, int timeout = 0)
-{
-    QEventLoop loop;
-    QObject::connect(obj, signal, &loop, SLOT(quit()));
-    QTimer timer;
-    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
-    if (timeout > 0) {
-        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
-        timer.setSingleShot(true);
-        timer.start(timeout);
-    }
-    loop.exec();
-    return timeoutSpy.isEmpty();
-}
-
 class tst_QWebElement : public QObject
 {
     Q_OBJECT
@@ -576,9 +553,8 @@ void tst_QWebElement::style()
     "</body>";
 
     // in few seconds, the CSS should be completey loaded
-    QSignalSpy spy(m_page, SIGNAL(loadFinished(bool)));
     m_mainFrame->setHtml(html6);
-    QTest::qWait(200);
+    waitForSignal(m_page, SIGNAL(loadFinished(bool)), 200);
 
     p = m_mainFrame->documentElement().findAll("p").at(0);
     QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("blue"));
@@ -596,7 +572,7 @@ void tst_QWebElement::style()
 
     // in few seconds, the style should be completey loaded
     m_mainFrame->setHtml(html7);
-    QTest::qWait(200);
+    waitForSignal(m_page, SIGNAL(loadFinished(bool)), 200);
 
     p = m_mainFrame->documentElement().findAll("p").at(0);
     QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("black"));
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.qrc b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.qrc
new file mode 100644
index 0000000000..7384c76e05
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.qrc
@@ -0,0 +1,7 @@
+<!DOCTYPE RCC><RCC version="1.0">
+<qresource prefix="/">
+<file alias="style.css">resources/style.css</file>
+<file alias="style2.css">resources/style2.css</file>
+<file alias="image.png">resources/image.png</file>
+</qresource>
+</RCC>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro
index b8734cd751..d056014db9 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro
@@ -1,13 +1,2 @@
-TEMPLATE = app
-TARGET = tst_qwebframe
-include(../../../../WebKit.pri)
-SOURCES  += tst_qwebframe.cpp
-RESOURCES += qwebframe.qrc
-QT += testlib network
-QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
-!symbian:DEFINES += SRCDIR=\\\"$$PWD/resources\\\"
-
-symbian {
-    TARGET.UID3 = 0xA000E53D
-    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
-}
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+include(../tests.pri)
\ No newline at end of file
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.qrc b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.qrc
deleted file mode 100644
index 8afa0c16e8..0000000000
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.qrc
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE RCC><RCC version="1.0">
-<qresource prefix="/">
-<file>image.png</file>
-<file>style.css</file>
-<file>test1.html</file>
-<file>test2.html</file>
-<file>testiframe.html</file>
-<file>testiframe2.html</file>
-</qresource>
-</RCC>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/image.png b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/image.png
index 8d703640c1..8d703640c1 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/image.png
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/image.png
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/style.css b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/style.css
index c05b747f14..c05b747f14 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/style.css
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/style.css
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/test1.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/test1.html
index b323f966e9..b323f966e9 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/test1.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/test1.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/test2.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/test2.html
index 63ac1f6ecb..63ac1f6ecb 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/test2.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/test2.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/testiframe.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/testiframe.html
index 9f3ae853a7..9f3ae853a7 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/testiframe.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/testiframe.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/testiframe2.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/testiframe2.html
index 1913a8984b..1913a8984b 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/testiframe2.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/testiframe2.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 8cc79538c9..37f7b88325 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -38,40 +38,6 @@
 #endif
 #include "../util.h"
 
-#if defined(Q_OS_SYMBIAN)
-# define SRCDIR ""
-#endif
-
-//TESTED_CLASS=
-//TESTED_FILES=
-
-// Task 160192
-/**
- * Starts an event loop that runs until the given signal is received.
- Optionally the event loop
- * can return earlier on a timeout.
- *
- * \return \p true if the requested signal was received
- *         \p false on timeout
- */
-static bool waitForSignal(QObject* obj, const char* signal, int timeout = 0)
-{
-    QEventLoop loop;
-    QObject::connect(obj, signal, &loop, SLOT(quit()));
-    QTimer timer;
-    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
-    if (timeout > 0) {
-        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
-        timer.setSingleShot(true);
-        timer.start(timeout);
-    }
-    loop.exec();
-    return timeoutSpy.isEmpty();
-}
-
-/* Mostly a test for the JavaScript related parts of QWebFrame */
-
-
 struct CustomType {
     QString string;
 };
@@ -100,6 +66,7 @@ class MyQObject : public QObject
     Q_PROPERTY(int readOnlyProperty READ readOnlyProperty)
     Q_PROPERTY(QKeySequence shortcut READ shortcut WRITE setShortcut)
     Q_PROPERTY(CustomType propWithCustomType READ propWithCustomType WRITE setPropWithCustomType)
+    Q_PROPERTY(QWebElement webElementProperty READ webElementProperty WRITE setWebElementProperty)
     Q_ENUMS(Policy Strategy)
     Q_FLAGS(Ability)
 
@@ -215,6 +182,14 @@ public:
         m_shortcut = seq;
     }
 
+    QWebElement webElementProperty() const {
+        return m_webElement;
+    }
+
+    void setWebElementProperty(const QWebElement& element) {
+        m_webElement = element;
+    }
+
     CustomType propWithCustomType() const {
         return m_customType;
     }
@@ -467,6 +442,10 @@ public Q_SLOTS:
         m_qtFunctionInvoked = 35;
         m_actuals << arg;
     }
+    void myOverloadedSlot(const QWebElement &arg) {
+        m_qtFunctionInvoked = 36;
+        m_actuals << QVariant::fromValue<QWebElement>(arg);
+    }
 
     void qscript_call(int arg) {
         m_qtFunctionInvoked = 40;
@@ -501,6 +480,7 @@ private:
     int m_writeOnlyValue;
     int m_readOnlyValue;
     QKeySequence m_shortcut;
+    QWebElement m_webElement;
     CustomType m_customType;
     int m_qtFunctionInvoked;
     QVariantList m_actuals;
@@ -580,6 +560,7 @@ private slots:
     void enumerate();
     void objectDeleted();
     void typeConversion();
+    void arrayObjectEnumerable();
     void symmetricUrl();
     void progressSignal();
     void urlChange();
@@ -591,7 +572,6 @@ private slots:
     void setHtml();
     void setHtmlWithResource();
     void setHtmlWithBaseURL();
-    void setHtmlWithJSAlert();
     void ipv6HostEncoding();
     void metaData();
     void popupFocus();
@@ -604,8 +584,11 @@ private slots:
     void hasSetFocus();
     void render();
     void scrollPosition();
+    void scrollToAnchor();
     void evaluateWillCauseRepaint();
     void qObjectWrapperWithSameIdentity();
+    void introspectQtMethods_data();
+    void introspectQtMethods();
 
 private:
     QString  evalJS(const QString&s) {
@@ -706,7 +689,6 @@ void tst_QWebFrame::init()
     m_page = m_view->page();
     m_myObject = new MyQObject();
     m_page->mainFrame()->addToJavaScriptWindowObject("myObject", m_myObject);
-    QDir::setCurrent(SRCDIR);
 }
 
 void tst_QWebFrame::cleanup()
@@ -717,6 +699,7 @@ void tst_QWebFrame::cleanup()
 
 void tst_QWebFrame::getSetStaticProperty()
 {
+    m_page->mainFrame()->setHtml("<html><head><body></body></html>");
     QCOMPARE(evalJS("typeof myObject.noSuchProperty"), sUndefined);
 
     // initial value (set in MyQObject constructor)
@@ -856,6 +839,8 @@ void tst_QWebFrame::getSetStaticProperty()
     QCOMPARE(evalJS("myObject.stringListProperty[1]"), QLatin1String("two"));
     QCOMPARE(evalJS("typeof myObject.stringListProperty[2]"), sString);
     QCOMPARE(evalJS("myObject.stringListProperty[2]"), QLatin1String("true"));
+    evalJS("myObject.webElementProperty=document.body;");
+    QCOMPARE(evalJS("myObject.webElementProperty.tagName"), QLatin1String("BODY"));
 
     // try to delete
     QCOMPARE(evalJS("delete myObject.intProperty"), sFalse);
@@ -1918,6 +1903,12 @@ void tst_QWebFrame::overloadedSlots()
     f.call(QString(), QStringList() << m_engine->newVariant(QVariant("ciao")));
     QCOMPARE(m_myObject->qtFunctionInvoked(), 35);
     */
+
+    // should pick myOverloadedSlot(QRegExp)
+    m_myObject->resetQtFunctionInvoked();
+    evalJS("myObject.myOverloadedSlot(document.body)");
+    QCOMPARE(m_myObject->qtFunctionInvoked(), 36);
+
     // should pick myOverloadedSlot(QObject*)
     m_myObject->resetQtFunctionInvoked();
     evalJS("myObject.myOverloadedSlot(myObject)");
@@ -2101,6 +2092,31 @@ void tst_QWebFrame::typeConversion()
     // ### RegExps
 }
 
+class StringListTestObject : public QObject {
+    Q_OBJECT
+public Q_SLOTS:
+    QVariant stringList()
+    {
+        return QStringList() << "Q" << "t";
+    };
+};
+
+void tst_QWebFrame::arrayObjectEnumerable()
+{
+    QWebPage page;
+    QWebFrame* frame = page.mainFrame();
+    QObject* qobject = new StringListTestObject();
+    frame->addToJavaScriptWindowObject("test", qobject, QScriptEngine::ScriptOwnership);
+
+    const QString script("var stringArray = test.stringList();"
+                         "var result = '';"
+                         "for (var i in stringArray) {"
+                         "    result += stringArray[i];"
+                         "}"
+                         "result;");
+    QCOMPARE(frame->evaluateJavaScript(script).toString(), QString::fromLatin1("Qt"));
+}
+
 void tst_QWebFrame::symmetricUrl()
 {
     QVERIFY(m_view->url().isEmpty());
@@ -2244,7 +2260,7 @@ protected:
     virtual QNetworkReply* createRequest(Operation op, const QNetworkRequest& request, QIODevice* outgoingData)
     {
         QString url = request.url().toString();
-        if (op == QNetworkAccessManager::GetOperation)
+        if (op == QNetworkAccessManager::GetOperation) {
             if (url == "qrc:/test1.html" ||  url == "http://abcdef.abcdef/")
                 return new FakeReply(request, this);
 #ifndef QT_NO_OPENSSL
@@ -2255,6 +2271,7 @@ protected:
                 return reply;
             }
 #endif
+       }
 
         return QNetworkAccessManager::createRequest(op, request, outgoingData);
     }
@@ -2271,19 +2288,19 @@ void tst_QWebFrame::requestedUrl()
     page.setNetworkAccessManager(networkManager);
 
     frame->setUrl(QUrl("qrc:/test1.html"));
-    QTest::qWait(200);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(spy.count(), 1);
     QCOMPARE(frame->requestedUrl(), QUrl("qrc:/test1.html"));
     QCOMPARE(frame->url(), QUrl("qrc:/test2.html"));
 
     frame->setUrl(QUrl("qrc:/non-existent.html"));
-    QTest::qWait(200);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(spy.count(), 2);
     QCOMPARE(frame->requestedUrl(), QUrl("qrc:/non-existent.html"));
     QCOMPARE(frame->url(), QUrl("qrc:/non-existent.html"));
 
     frame->setUrl(QUrl("http://abcdef.abcdef"));
-    QTest::qWait(200);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(spy.count(), 3);
     QCOMPARE(frame->requestedUrl(), QUrl("http://abcdef.abcdef/"));
     QCOMPARE(frame->url(), QUrl("http://abcdef.abcdef/"));
@@ -2294,7 +2311,7 @@ void tst_QWebFrame::requestedUrl()
 
     QSignalSpy spy2(page.networkAccessManager(), SIGNAL(sslErrors(QNetworkReply*,QList<QSslError>)));
     frame->setUrl(QUrl("qrc:/fake-ssl-error.html"));
-    QTest::qWait(200);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(spy2.count(), 1);
     QCOMPARE(frame->requestedUrl(), QUrl("qrc:/fake-ssl-error.html"));
     QCOMPARE(frame->url(), QUrl("qrc:/fake-ssl-error.html"));
@@ -2352,7 +2369,7 @@ void tst_QWebFrame::setHtmlWithResource()
     // in few seconds, the image should be completey loaded
     QSignalSpy spy(&page, SIGNAL(loadFinished(bool)));
     frame->setHtml(html);
-    QTest::qWait(200);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(spy.count(), 1);
 
     QCOMPARE(frame->evaluateJavaScript("document.images.length").toInt(), 1);
@@ -2371,7 +2388,7 @@ void tst_QWebFrame::setHtmlWithResource()
 
     // in few seconds, the CSS should be completey loaded
     frame->setHtml(html2);
-    QTest::qWait(200);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(spy.size(), 2);
 
     QWebElement p = frame->documentElement().findAll("p").at(0);
@@ -2380,6 +2397,11 @@ void tst_QWebFrame::setHtmlWithResource()
 
 void tst_QWebFrame::setHtmlWithBaseURL()
 {
+    if (!QDir(TESTS_SOURCE_DIR).exists())
+        QSKIP(QString("This test requires access to resources found in '%1'").arg(TESTS_SOURCE_DIR).toLatin1().constData(), SkipAll);
+
+    QDir::setCurrent(TESTS_SOURCE_DIR);
+
     QString html("<html><body><p>hello world</p><img src='resources/image2.png'/></body></html>");
 
     QWebPage page;
@@ -2388,8 +2410,8 @@ void tst_QWebFrame::setHtmlWithBaseURL()
     // in few seconds, the image should be completey loaded
     QSignalSpy spy(&page, SIGNAL(loadFinished(bool)));
 
-    frame->setHtml(html, QUrl::fromLocalFile(QDir::currentPath()));
-    QTest::qWait(200);
+    frame->setHtml(html, QUrl::fromLocalFile(TESTS_SOURCE_DIR));
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(spy.count(), 1);
 
     QCOMPARE(frame->evaluateJavaScript("document.images.length").toInt(), 1);
@@ -2400,33 +2422,6 @@ void tst_QWebFrame::setHtmlWithBaseURL()
     QCOMPARE(m_view->page()->history()->count(), 0);
 }
 
-class MyPage : public QWebPage
-{
-public:
-    MyPage() :  QWebPage(), alerts(0) {}
-    int alerts;
-
-protected:
-    virtual void javaScriptAlert(QWebFrame*, const QString& msg)
-    {
-        alerts++;
-        QCOMPARE(msg, QString("foo"));
-        // Should not be enough to trigger deferred loading, since we've upped the HTML
-        // tokenizer delay in the Qt frameloader. See HTMLTokenizer::continueProcessing()
-        QTest::qWait(1000);
-    }
-};
-
-void tst_QWebFrame::setHtmlWithJSAlert()
-{
-    QString html("<html><head></head><body><script>alert('foo');</script><p>hello world</p></body></html>");
-    MyPage page;
-    m_view->setPage(&page);
-    page.mainFrame()->setHtml(html);
-    QCOMPARE(page.alerts, 1);
-    QCOMPARE(m_view->page()->mainFrame()->toHtml(), html);
-}
-
 class TestNetworkManager : public QNetworkAccessManager
 {
 public:
@@ -2521,21 +2516,22 @@ void tst_QWebFrame::popupFocus()
     QTest::mouseClick(&view, Qt::LeftButton, 0, QPoint(25, 25));
     QObject* webpopup = firstChildByClassName(&view, "WebCore::QWebPopup");
     QComboBox* combo = qobject_cast<QComboBox*>(webpopup);
+    QVERIFY(combo != 0);
     QTRY_VERIFY(!view.hasFocus() && combo->view()->hasFocus()); // Focus should be on the popup
 
     // hide the popup and check if focus is on the page
     combo->hidePopup();
     QTRY_VERIFY(view.hasFocus() && !combo->view()->hasFocus()); // Focus should be back on the WebView
 
-    // triple the flashing time, should at least blink twice already
-    int delay = qApp->cursorFlashTime() * 3;
+    // double the flashing time, should at least blink once already
+    int delay = qApp->cursorFlashTime() * 2;
 
     // focus the lineedit and check if it blinks
     QTest::mouseClick(&view, Qt::LeftButton, 0, QPoint(200, 25));
     m_popupTestView = &view;
     view.installEventFilter( this );
     QTest::qWait(delay);
-    QVERIFY2(m_popupTestPaintCount >= 4,
+    QVERIFY2(m_popupTestPaintCount >= 3,
              "The input field should have a blinking caret");
 }
 
@@ -2679,7 +2675,7 @@ void tst_QWebFrame::hasSetFocus()
     QSignalSpy loadSpy(m_page, SIGNAL(loadFinished(bool)));
     m_page->mainFrame()->setHtml(html);
 
-    QTest::qWait(200);
+    waitForSignal(m_page->mainFrame(), SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(loadSpy.size(), 1);
 
     QList<QWebFrame*> children = m_page->mainFrame()->childFrames();
@@ -2689,7 +2685,7 @@ void tst_QWebFrame::hasSetFocus()
                       "</body></html>");
     frame->setHtml(innerHtml);
 
-    QTest::qWait(200);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(loadSpy.size(), 2);
 
     m_page->mainFrame()->setFocus();
@@ -2768,6 +2764,38 @@ void tst_QWebFrame::scrollPosition()
     QCOMPARE(y, 29);
 }
 
+void tst_QWebFrame::scrollToAnchor()
+{
+    QWebPage page;
+    page.setViewportSize(QSize(480, 800));
+    QWebFrame* frame = page.mainFrame();
+
+    QString html("<html><body><p style=\"margin-bottom: 1500px;\">Hello.</p>"
+                 "<p><a id=\"foo\">This</a> is an anchor</p>"
+                 "<p style=\"margin-bottom: 1500px;\"><a id=\"bar\">This</a> is another anchor</p>"
+                 "</body></html>");
+    frame->setHtml(html);
+    frame->setScrollPosition(QPoint(0, 0));
+    QCOMPARE(frame->scrollPosition().x(), 0);
+    QCOMPARE(frame->scrollPosition().y(), 0);
+
+    QWebElement fooAnchor = frame->findFirstElement("a[id=foo]");
+
+    frame->scrollToAnchor("foo");
+    QCOMPARE(frame->scrollPosition().y(), fooAnchor.geometry().top());
+
+    frame->scrollToAnchor("bar");
+    frame->scrollToAnchor("foo");
+    QCOMPARE(frame->scrollPosition().y(), fooAnchor.geometry().top());
+
+    frame->scrollToAnchor("top");
+    QCOMPARE(frame->scrollPosition().y(), 0);
+
+    frame->scrollToAnchor("bar");
+    frame->scrollToAnchor("notexist");
+    QVERIFY(frame->scrollPosition().y() != 0);
+}
+
 void tst_QWebFrame::evaluateWillCauseRepaint()
 {
     QWebView view;
@@ -2776,14 +2804,16 @@ void tst_QWebFrame::evaluateWillCauseRepaint()
     view.setHtml(html);
     view.show();
 
-    QTest::qWait(200);
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    QTest::qWaitForWindowShown(&view);
+#else
+    QTest::qWait(2000); 
+#endif
 
     view.page()->mainFrame()->evaluateJavaScript(
         "document.getElementById('junk').style.display = 'none';");
 
     ::waitForSignal(view.page(), SIGNAL(repaintRequested(QRect)));
-
-    QTest::qWait(2000);
 }
 
 class TestFactory : public QObject
@@ -2824,5 +2854,47 @@ void tst_QWebFrame::qObjectWrapperWithSameIdentity()
     QCOMPARE(mainFrame->toPlainText(), QString("test2"));
 }
 
+void tst_QWebFrame::introspectQtMethods_data()
+{
+    QTest::addColumn<QString>("objectExpression");
+    QTest::addColumn<QString>("methodName");
+    QTest::addColumn<QStringList>("expectedPropertyNames");
+
+    QTest::newRow("myObject.mySignal")
+        << "myObject" << "mySignal" << (QStringList() << "connect" << "disconnect" << "length" << "name");
+    QTest::newRow("myObject.mySlot")
+        << "myObject" << "mySlot" << (QStringList() << "connect" << "disconnect" << "length" << "name");
+    QTest::newRow("myObject.myInvokable")
+        << "myObject" << "myInvokable" << (QStringList() << "connect" << "disconnect" << "length" << "name");
+    QTest::newRow("myObject.mySignal.connect")
+        << "myObject.mySignal" << "connect" << (QStringList() << "length" << "name");
+    QTest::newRow("myObject.mySignal.disconnect")
+        << "myObject.mySignal" << "disconnect" << (QStringList() << "length" << "name");
+}
+
+void tst_QWebFrame::introspectQtMethods()
+{
+    QFETCH(QString, objectExpression);
+    QFETCH(QString, methodName);
+    QFETCH(QStringList, expectedPropertyNames);
+
+    QString methodLookup = QString::fromLatin1("%0['%1']").arg(objectExpression).arg(methodName);
+    QCOMPARE(evalJSV(QString::fromLatin1("Object.getOwnPropertyNames(%0).sort()").arg(methodLookup)).toStringList(), expectedPropertyNames);
+
+    for (int i = 0; i < expectedPropertyNames.size(); ++i) {
+        QString name = expectedPropertyNames.at(i);
+        QCOMPARE(evalJS(QString::fromLatin1("%0.hasOwnProperty('%1')").arg(methodLookup).arg(name)), sTrue);
+        evalJS(QString::fromLatin1("var descriptor = Object.getOwnPropertyDescriptor(%0, '%1')").arg(methodLookup).arg(name));
+        QCOMPARE(evalJS("typeof descriptor"), QString::fromLatin1("object"));
+        QCOMPARE(evalJS("descriptor.get"), sUndefined);
+        QCOMPARE(evalJS("descriptor.set"), sUndefined);
+        QCOMPARE(evalJS(QString::fromLatin1("descriptor.value === %0['%1']").arg(methodLookup).arg(name)), sTrue);
+        QCOMPARE(evalJS(QString::fromLatin1("descriptor.enumerable")), sFalse);
+        QCOMPARE(evalJS(QString::fromLatin1("descriptor.configurable")), sFalse);
+    }
+
+    QVERIFY(evalJSV("var props=[]; for (var p in myObject.deleteLater) {props.push(p);}; props.sort()").toStringList().isEmpty());
+}
+
 QTEST_MAIN(tst_QWebFrame)
 #include "tst_qwebframe.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.qrc b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.qrc
new file mode 100644
index 0000000000..2a7d0b9c28
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.qrc
@@ -0,0 +1,10 @@
+<!DOCTYPE RCC><RCC version="1.0">
+<qresource prefix="/">
+<file alias="image.png">resources/image.png</file>
+<file alias="style.css">resources/style.css</file>
+<file alias="test1.html">resources/test1.html</file>
+<file alias="test2.html">resources/test2.html</file>
+<file alias="testiframe.html">resources/testiframe.html</file>
+<file alias="testiframe2.html">resources/testiframe2.html</file>
+</qresource>
+</RCC>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro
index 7445e3bac8..d056014db9 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro
@@ -1,12 +1,2 @@
-TEMPLATE = app
-TARGET = tst_qwebhistory
-include(../../../../WebKit.pri)
-SOURCES  += tst_qwebhistory.cpp
-RESOURCES  += tst_qwebhistory.qrc
-QT += testlib network
-QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
-
-symbian {
-    TARGET.UID3 = 0xA000E53B
-    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
-}
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+include(../tests.pri)
\ No newline at end of file
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page1.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/resources/page1.html
index 82fa4aff12..82fa4aff12 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page1.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/resources/page1.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page2.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/resources/page2.html
index 5307bdcfd9..5307bdcfd9 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page2.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/resources/page2.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page3.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/resources/page3.html
index 4e5547c7e0..4e5547c7e0 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page3.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/resources/page3.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page4.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/resources/page4.html
index 3c57aeddc9..3c57aeddc9 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page4.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/resources/page4.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page5.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/resources/page5.html
index 8593552794..8593552794 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page5.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/resources/page5.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page6.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/resources/page6.html
index c5bbc6f796..c5bbc6f796 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page6.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/resources/page6.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
index ec2d497b0c..e967dccb4f 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
@@ -37,7 +37,7 @@ public:
 protected :
     void loadPage(int nr)
     {
-        frame->load(QUrl("qrc:/data/page" + QString::number(nr) + ".html"));
+        frame->load(QUrl("qrc:/resources/page" + QString::number(nr) + ".html"));
         waitForLoadFinished.exec();
     }
 
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.qrc b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.qrc
index 7c5ff0e0f8..6e2f50a951 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.qrc
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.qrc
@@ -1,11 +1,11 @@
 <!DOCTYPE RCC><RCC version="1.0">
 <qresource>
-    <file>data/page1.html</file>
-    <file>data/page2.html</file>    
-    <file>data/page3.html</file>
-    <file>data/page4.html</file>
-    <file>data/page5.html</file>
-    <file>data/page6.html</file>
+    <file>resources/page1.html</file>
+    <file>resources/page2.html</file>    
+    <file>resources/page3.html</file>
+    <file>resources/page4.html</file>
+    <file>resources/page5.html</file>
+    <file>resources/page6.html</file>
 </qresource>
 </RCC>
 
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro
index 764f806df1..d056014db9 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro
@@ -1,11 +1,2 @@
-TEMPLATE = app
-TARGET = tst_qwebhistoryinterface
-include(../../../../WebKit.pri)
-SOURCES  += tst_qwebhistoryinterface.cpp
-QT += testlib network
-QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
-
-symbian {
-    TARGET.UID3 = 0xA000E53C
-    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
-}
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+include(../tests.pri)
\ No newline at end of file
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebinspector/qwebinspector.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebinspector/qwebinspector.pro
new file mode 100644
index 0000000000..ac5192926a
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebinspector/qwebinspector.pro
@@ -0,0 +1,2 @@
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+include(../tests.pri)
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebinspector/tst_qwebinspector.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebinspector/tst_qwebinspector.cpp
new file mode 100644
index 0000000000..12cd630cdf
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebinspector/tst_qwebinspector.cpp
@@ -0,0 +1,68 @@
+/*
+    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include <QtTest/QtTest>
+
+#include <qdir.h>
+#include <qwebinspector.h>
+#include <qwebpage.h>
+#include <qwebsettings.h>
+
+class tst_QWebInspector : public QObject {
+    Q_OBJECT
+
+private slots:
+    void attachAndDestroy();
+};
+
+void tst_QWebInspector::attachAndDestroy()
+{
+    {   // External inspector + manual destruction of page first
+        QWebPage* page = new QWebPage();
+        page->settings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, true);
+        QWebInspector* inspector = new QWebInspector();
+        inspector->setPage(page);
+        page->updatePositionDependentActions(QPoint(0, 0));
+        page->triggerAction(QWebPage::InspectElement);
+
+        delete page;
+        delete inspector;
+    }
+    {   // External inspector + manual destruction of inspector first
+        QWebPage* page = new QWebPage();
+        page->settings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, true);
+        QWebInspector* inspector = new QWebInspector();
+        inspector->setPage(page);
+        page->updatePositionDependentActions(QPoint(0, 0));
+        page->triggerAction(QWebPage::InspectElement);
+
+        delete inspector;
+        delete page;
+    }
+    {   // Internal inspector
+        QWebPage page;
+        page.settings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, true);
+        page.updatePositionDependentActions(QPoint(0, 0));
+        page.triggerAction(QWebPage::InspectElement);
+    }
+}
+
+QTEST_MAIN(tst_QWebInspector)
+
+#include "tst_qwebinspector.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
index 7853b28767..d056014db9 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
@@ -1,13 +1,2 @@
-TEMPLATE = app
-TARGET = tst_qwebpage
-include(../../../../WebKit.pri)
-SOURCES  += tst_qwebpage.cpp
-RESOURCES  += tst_qwebpage.qrc
-QT += testlib network
-QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
-!symbian:DEFINES += SRCDIR=\\\"$$PWD/\\\"
-
-symbian {
-    TARGET.UID3 = 0xA000E53E
-    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
-}
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+include(../tests.pri)
\ No newline at end of file
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/frame_a.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/resources/frame_a.html
index 9ff68f13a4..9ff68f13a4 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/frame_a.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/resources/frame_a.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/iframe.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/resources/iframe.html
index f17027c7a7..f17027c7a7 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/iframe.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/resources/iframe.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/iframe2.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/resources/iframe2.html
index 5017435975..5017435975 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/iframe2.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/resources/iframe2.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/iframe3.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/resources/iframe3.html
index ed6ac5b947..ed6ac5b947 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/iframe3.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/resources/iframe3.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/index.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/resources/index.html
index c53ad09a7a..c53ad09a7a 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/index.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/resources/index.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 55ee42abb6..4425bac207 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -19,72 +19,24 @@
     Boston, MA 02110-1301, USA.
 */
 
-
+#include "../util.h"
+#include <QDir>
+#include <QGraphicsWidget>
+#include <QLineEdit>
+#include <QMenu>
+#include <QPushButton>
 #include <QtTest/QtTest>
-
 #include <qgraphicsscene.h>
 #include <qgraphicsview.h>
 #include <qgraphicswebview.h>
+#include <qnetworkrequest.h>
+#include <qwebdatabase.h>
 #include <qwebelement.h>
-#include <qwebpage.h>
-#include <qwidget.h>
-#include <QGraphicsWidget>
-#include <qwebview.h>
 #include <qwebframe.h>
 #include <qwebhistory.h>
-#include <qnetworkrequest.h>
-#include <QDebug>
-#include <QLineEdit>
-#include <QMenu>
+#include <qwebpage.h>
 #include <qwebsecurityorigin.h>
-#include <qwebdatabase.h>
-#include <QPushButton>
-#include <QDir>
-
-#if defined(Q_OS_SYMBIAN)
-# define SRCDIR ""
-#endif
-
-// Will try to wait for the condition while allowing event processing
-#define QTRY_COMPARE(__expr, __expected) \
-    do { \
-        const int __step = 50; \
-        const int __timeout = 5000; \
-        if ((__expr) != (__expected)) { \
-            QTest::qWait(0); \
-        } \
-        for (int __i = 0; __i < __timeout && ((__expr) != (__expected)); __i+=__step) { \
-            QTest::qWait(__step); \
-        } \
-        QCOMPARE(__expr, __expected); \
-    } while(0)
-
-//TESTED_CLASS=
-//TESTED_FILES=
-
-// Task 160192
-/**
- * Starts an event loop that runs until the given signal is received.
- Optionally the event loop
- * can return earlier on a timeout.
- *
- * \return \p true if the requested signal was received
- *         \p false on timeout
- */
-static bool waitForSignal(QObject* obj, const char* signal, int timeout = 10000)
-{
-    QEventLoop loop;
-    QObject::connect(obj, signal, &loop, SLOT(quit()));
-    QTimer timer;
-    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
-    if (timeout > 0) {
-        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
-        timer.setSingleShot(true);
-        timer.start(timeout);
-    }
-    loop.exec();
-    return timeoutSpy.isEmpty();
-}
+#include <qwebview.h>
 
 class EventSpy : public QObject, public QList<QEvent::Type>
 {
@@ -148,6 +100,8 @@ private slots:
     void inputMethods();
     void defaultTextEncoding();
     void errorPageExtension();
+    void errorPageExtensionInIFrames();
+    void errorPageExtensionInFrameset();
 
     void crashTests_LazyInitializationOfMainFrame();
 
@@ -156,6 +110,7 @@ private slots:
 
     void originatingObjectInNetworkRequests();
     void testJSPrompt();
+    void showModalDialog();
 
 private:
     QWebView* m_view;
@@ -270,10 +225,8 @@ void tst_QWebPage::loadFinished()
                             "<frame src=\"data:text/html,bar\"></frameset>"), QUrl());
     QTRY_COMPARE(spyLoadFinished.count(), 1);
 
-    QTest::qWait(3000);
-
-    QVERIFY(spyLoadStarted.count() > 1);
-    QVERIFY(spyLoadFinished.count() > 1);
+    QTRY_VERIFY(spyLoadStarted.count() > 1);
+    QTRY_VERIFY(spyLoadFinished.count() > 1);
 
     spyLoadFinished.clear();
 
@@ -520,7 +473,6 @@ void tst_QWebPage::database()
     // Remove removed test :-)
     QWebDatabase::removeAllDatabases();
     QVERIFY(!origin.databases().size());
-    QTest::qWait(1000);
 }
 
 class PluginPage : public QWebPage
@@ -1275,7 +1227,7 @@ void tst_QWebPage::backActionUpdate()
     QAction *action = page->action(QWebPage::Back);
     QVERIFY(!action->isEnabled());
     QSignalSpy loadSpy(page, SIGNAL(loadFinished(bool)));
-    QUrl url = QUrl("qrc:///frametest/index.html");
+    QUrl url = QUrl("qrc:///resources/index.html");
     page->mainFrame()->load(url);
     QTRY_COMPARE(loadSpy.count(), 1);
     QVERIFY(!action->isEnabled());
@@ -1306,7 +1258,7 @@ void tst_QWebPage::frameAt()
     QWebView webView;
     QWebPage* webPage = webView.page();
     QSignalSpy loadSpy(webPage, SIGNAL(loadFinished(bool)));
-    QUrl url = QUrl("qrc:///frametest/iframe.html");
+    QUrl url = QUrl("qrc:///resources/iframe.html");
     webPage->mainFrame()->load(url);
     QTRY_COMPARE(loadSpy.count(), 1);
     frameAtHelper(webPage, webPage->mainFrame(), webPage->mainFrame()->pos());
@@ -1555,10 +1507,17 @@ void tst_QWebPage::protectBindingsRuntimeObjectsFromCollector()
 void tst_QWebPage::localURLSchemes()
 {
     int i = QWebSecurityOrigin::localSchemes().size();
+
     QWebSecurityOrigin::removeLocalScheme("file");
     QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i);
     QWebSecurityOrigin::addLocalScheme("file");
     QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i);
+
+    QWebSecurityOrigin::removeLocalScheme("qrc");
+    QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i - 1);
+    QWebSecurityOrigin::addLocalScheme("qrc");
+    QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i);
+
     QString myscheme = "myscheme";
     QWebSecurityOrigin::addLocalScheme(myscheme);
     QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i + 1);
@@ -1613,16 +1572,14 @@ void tst_QWebPage::testEnablePersistentStorage()
 
     QWebSettings::enablePersistentStorage();
 
-    // Give it some time to initialize - icon database needs it
-    QTest::qWait(1000);
 
-    QCOMPARE(webPage.settings()->testAttribute(QWebSettings::LocalStorageEnabled), true);
-    QCOMPARE(webPage.settings()->testAttribute(QWebSettings::OfflineStorageDatabaseEnabled), true);
-    QCOMPARE(webPage.settings()->testAttribute(QWebSettings::OfflineWebApplicationCacheEnabled), true);
+    QTRY_COMPARE(webPage.settings()->testAttribute(QWebSettings::LocalStorageEnabled), true);
+    QTRY_COMPARE(webPage.settings()->testAttribute(QWebSettings::OfflineStorageDatabaseEnabled), true);
+    QTRY_COMPARE(webPage.settings()->testAttribute(QWebSettings::OfflineWebApplicationCacheEnabled), true);
 
-    QVERIFY(!webPage.settings()->offlineStoragePath().isEmpty());
-    QVERIFY(!webPage.settings()->offlineWebApplicationCachePath().isEmpty());
-    QVERIFY(!webPage.settings()->iconDatabasePath().isEmpty());
+    QTRY_VERIFY(!webPage.settings()->offlineStoragePath().isEmpty());
+    QTRY_VERIFY(!webPage.settings()->offlineWebApplicationCachePath().isEmpty());
+    QTRY_VERIFY(!webPage.settings()->iconDatabasePath().isEmpty());
 }
 
 void tst_QWebPage::defaultTextEncoding()
@@ -1664,15 +1621,10 @@ public:
 
     virtual bool extension(Extension, const ExtensionOption* option, ExtensionReturn* output)
     {
-        const ErrorPageExtensionOption* info = static_cast<const ErrorPageExtensionOption*>(option);
         ErrorPageExtensionReturn* errorPage = static_cast<ErrorPageExtensionReturn*>(output);
 
-        if (info->frame == mainFrame()) {
-            errorPage->content = "data:text/html,error";
-            return true;
-        }
-
-        return false;
+        errorPage->content = "data:text/html,error";
+        return true;
     }
 };
 
@@ -1683,11 +1635,10 @@ void tst_QWebPage::errorPageExtension()
 
     QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
 
-    page->mainFrame()->load(QUrl("qrc:///frametest/index.html"));
+    m_view->setUrl(QUrl("data:text/html,foo"));
     QTRY_COMPARE(spyLoadFinished.count(), 1);
 
     page->mainFrame()->setUrl(QUrl("http://non.existent/url"));
-    QTest::qWait(2000);
     QTRY_COMPARE(spyLoadFinished.count(), 2);
     QCOMPARE(page->mainFrame()->toPlainText(), QString("data:text/html,error"));
     QCOMPARE(page->history()->count(), 2);
@@ -1696,20 +1647,48 @@ void tst_QWebPage::errorPageExtension()
     QCOMPARE(page->history()->canGoForward(), false);
 
     page->triggerAction(QWebPage::Back);
-    QTest::qWait(2000);
-    QCOMPARE(page->history()->canGoBack(), false);
-    QCOMPARE(page->history()->canGoForward(), true);
+    QTRY_COMPARE(page->history()->canGoBack(), false);
+    QTRY_COMPARE(page->history()->canGoForward(), true);
 
     page->triggerAction(QWebPage::Forward);
-    QTest::qWait(2000);
-    QCOMPARE(page->history()->canGoBack(), true);
-    QCOMPARE(page->history()->canGoForward(), false);
+    QTRY_COMPARE(page->history()->canGoBack(), true);
+    QTRY_COMPARE(page->history()->canGoForward(), false);
 
     page->triggerAction(QWebPage::Back);
-    QTest::qWait(2000);
-    QCOMPARE(page->history()->canGoBack(), false);
-    QCOMPARE(page->history()->canGoForward(), true);
-    QCOMPARE(page->history()->currentItem().url(), QUrl("qrc:///frametest/index.html"));
+    QTRY_COMPARE(page->history()->canGoBack(), false);
+    QTRY_COMPARE(page->history()->canGoForward(), true);
+    QTRY_COMPARE(page->history()->currentItem().url(), QUrl("data:text/html,foo"));
+
+    m_view->setPage(0);
+}
+
+void tst_QWebPage::errorPageExtensionInIFrames()
+{
+    ErrorPage* page = new ErrorPage;
+    m_view->setPage(page);
+
+    m_view->setHtml(QString("data:text/html,"
+                            "<h1>h1</h1>"
+                            "<iframe src='data:text/html,<p/>p'></iframe>"
+                            "<iframe src='non-existent.html'></iframe>"));
+    QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
+    QTRY_COMPARE(spyLoadFinished.count(), 1);
+
+    QCOMPARE(page->mainFrame()->childFrames()[1]->toPlainText(), QString("data:text/html,error"));
+
+    m_view->setPage(0);
+}
+
+void tst_QWebPage::errorPageExtensionInFrameset()
+{
+    ErrorPage* page = new ErrorPage;
+    m_view->setPage(page);
+
+    m_view->load(QUrl("qrc:///resources/index.html"));
+
+    QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
+    QTRY_COMPARE(spyLoadFinished.count(), 1);
+    QCOMPARE(page->mainFrame()->childFrames()[1]->toPlainText(), QString("data:text/html,error"));
 
     m_view->setPage(0);
 }
@@ -1754,17 +1733,17 @@ void tst_QWebPage::screenshot_data()
 
 void tst_QWebPage::screenshot()
 {
-    QDir::setCurrent(SRCDIR);
+    if (!QDir(TESTS_SOURCE_DIR).exists())
+        QSKIP(QString("This test requires access to resources found in '%1'").arg(TESTS_SOURCE_DIR).toLatin1().constData(), SkipAll);
+
+    QDir::setCurrent(TESTS_SOURCE_DIR);
 
     QFETCH(QString, html);
     QWebPage* page = new QWebPage;
     page->settings()->setAttribute(QWebSettings::PluginsEnabled, true);
     QWebFrame* mainFrame = page->mainFrame();
-    mainFrame->setHtml(html, QUrl::fromLocalFile(QDir::currentPath()));
-    if (html.contains("</embed>")) {
-        // some reasonable time for the PluginStream to feed test.swf to flash and start painting
-        QTest::qWait(2000);
-    }
+    mainFrame->setHtml(html, QUrl::fromLocalFile(TESTS_SOURCE_DIR));
+    ::waitForSignal(mainFrame, SIGNAL(loadFinished(bool)), 2000);
 
     // take screenshot without a view
     takeScreenshot(page);
@@ -1870,5 +1849,26 @@ void tst_QWebPage::testJSPrompt()
     QVERIFY(res);
 }
 
+class TestModalPage : public QWebPage
+{
+    Q_OBJECT
+public:
+    TestModalPage(QObject* parent = 0) : QWebPage(parent) {
+    }
+    virtual QWebPage* createWindow(WebWindowType) {
+        QWebPage* page = new TestModalPage();
+        connect(page, SIGNAL(windowCloseRequested()), page, SLOT(deleteLater()));
+        return page;
+    }
+};
+
+void tst_QWebPage::showModalDialog()
+{
+    TestModalPage page;
+    page.mainFrame()->setHtml(QString("<html></html>"));
+    QString res = page.mainFrame()->evaluateJavaScript("window.showModalDialog('javascript:window.returnValue=dialogArguments; window.close();', 'This is a test');").toString();
+    QCOMPARE(res, QString("This is a test"));
+}
+
 QTEST_MAIN(tst_QWebPage)
 #include "tst_qwebpage.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.qrc b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.qrc
index 3085ce2306..0627cb4de0 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.qrc
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.qrc
@@ -1,10 +1,10 @@
 <!DOCTYPE RCC><RCC version="1.0">
 <qresource>
-    <file>frametest/index.html</file>
-    <file>frametest/frame_a.html</file>
-    <file>frametest/iframe.html</file>
-    <file>frametest/iframe2.html</file>
-    <file>frametest/iframe3.html</file>
+    <file>resources/index.html</file>
+    <file>resources/frame_a.html</file>
+    <file>resources/iframe.html</file>
+    <file>resources/iframe2.html</file>
+    <file>resources/iframe3.html</file>
 </qresource>
 </RCC>
 
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro
index 569146abdc..ac5192926a 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro
@@ -1,11 +1,2 @@
-TEMPLATE = app
-TARGET = tst_qwebplugindatabase
-include(../../../../WebKit.pri)
-SOURCES  += tst_qwebplugindatabase.cpp
-QT += testlib network
-QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
-
-symbian {
-    TARGET.UID3 = 0xA000E540
-    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
-}
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+include(../tests.pri)
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
index 735537ba2c..4ca2bf6402 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
@@ -1,13 +1 @@
-TEMPLATE = app
-TARGET = tst_qwebview
-include(../../../../WebKit.pri)
-SOURCES  += tst_qwebview.cpp
-QT += testlib network
-QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
-RESOURCES  += tst_qwebview.qrc
-DEFINES += SRCDIR=\\\"$$PWD/\\\"
-
-symbian {
-    TARGET.UID3 = 0xA000E53F
-    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
-}
+include(../tests.pri)
\ No newline at end of file
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/data/frame_a.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/resources/frame_a.html
index 9ff68f13a4..9ff68f13a4 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/data/frame_a.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/resources/frame_a.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/data/index.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/resources/index.html
index c53ad09a7a..c53ad09a7a 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/data/index.html
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/resources/index.html
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
index 27daf38417..ebcf4bbb49 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
@@ -30,6 +30,8 @@
 #include <qwebkitversion.h>
 #include <qwebframe.h>
 
+#include <QDebug>
+
 class tst_QWebView : public QObject
 {
     Q_OBJECT
@@ -121,7 +123,10 @@ void tst_QWebView::reusePage_data()
 
 void tst_QWebView::reusePage()
 {
-    QDir::setCurrent(SRCDIR);
+    if (!QDir(TESTS_SOURCE_DIR).exists())
+        QSKIP(QString("This test requires access to resources found in '%1'").arg(TESTS_SOURCE_DIR).toLatin1().constData(), SkipAll);
+
+    QDir::setCurrent(TESTS_SOURCE_DIR);
 
     QFETCH(QString, html);
     QWebView* view1 = new QWebView;
@@ -129,21 +134,29 @@ void tst_QWebView::reusePage()
     view1->setPage(page);
     page->settings()->setAttribute(QWebSettings::PluginsEnabled, true);
     QWebFrame* mainFrame = page->mainFrame();
-    mainFrame->setHtml(html, QUrl::fromLocalFile(QDir::currentPath()));
+    mainFrame->setHtml(html, QUrl::fromLocalFile(TESTS_SOURCE_DIR));
     if (html.contains("</embed>")) {
         // some reasonable time for the PluginStream to feed test.swf to flash and start painting
-        QTest::qWait(2000);
+        waitForSignal(view1, SIGNAL(loadFinished(bool)), 2000);
     }
 
     view1->show();
-    QTest::qWait(2000);
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    QTest::qWaitForWindowShown(view1);
+#else
+    QTest::qWait(2000); 
+#endif
     delete view1;
     QVERIFY(page != 0); // deleting view must not have deleted the page, since it's not a child of view
 
     QWebView *view2 = new QWebView;
     view2->setPage(page);
     view2->show(); // in Windowless mode, you should still be able to see the plugin here
-    QTest::qWait(2000);
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    QTest::qWaitForWindowShown(view2);
+#else
+    QTest::qWait(2000); 
+#endif
     delete view2;
 
     delete page; // must not crash
@@ -185,7 +198,7 @@ void tst_QWebView::crashTests()
     // Test page should have frames.
     QWebView view;
     WebViewCrashTest tester(&view);
-    QUrl url("qrc:///data/index.html");
+    QUrl url("qrc:///resources/index.html");
     view.load(url);
     QTRY_VERIFY(tester.m_executed); // If fail it means that the test wasn't executed.
 }
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.qrc b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.qrc
index ede34a9831..5abc64c10e 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.qrc
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.qrc
@@ -1,7 +1,7 @@
 <!DOCTYPE RCC><RCC version="1.0">
 <qresource>
-    <file>data/index.html</file>
-    <file>data/frame_a.html</file>
+    <file>resources/index.html</file>
+    <file>resources/frame_a.html</file>
 </qresource>
 </RCC>
 
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/image2.png b/src/3rdparty/webkit/WebKit/qt/tests/resources/image2.png
index 8d703640c1..8d703640c1 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/image2.png
+++ b/src/3rdparty/webkit/WebKit/qt/tests/resources/image2.png
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/tests.pri b/src/3rdparty/webkit/WebKit/qt/tests/tests.pri
new file mode 100644
index 0000000000..0bdf6f6a92
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/tests.pri
@@ -0,0 +1,24 @@
+TEMPLATE = app
+CONFIG -= app_bundle
+
+VPATH += $$_PRO_FILE_PWD_
+!CONFIG(QTDIR_build):TARGET = tst_$$TARGET
+SOURCES += $${TARGET}.cpp
+INCLUDEPATH += \
+    $$PWD \
+    $$PWD/../Api
+
+exists($$_PRO_FILE_PWD_/$${TARGET}.qrc):RESOURCES += $$_PRO_FILE_PWD_/$${TARGET}.qrc
+
+include(../../../WebKit.pri)
+QT += testlib network
+
+QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian {
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
+
+# This define is used by some tests to look up resources in the source tree
+!symbian: DEFINES += TESTS_SOURCE_DIR=\\\"$$PWD/\\\"
+
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/tests.pro b/src/3rdparty/webkit/WebKit/qt/tests/tests.pro
index 939cd224ab..22fece5418 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/tests.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/tests.pro
@@ -1,4 +1,4 @@
 
 TEMPLATE = subdirs
-SUBDIRS = qwebframe qwebpage qwebelement qgraphicswebview qwebhistoryinterface qwebview qwebhistory
-greaterThan(QT_MINOR_VERSION, 4): SUBDIRS += benchmarks/painting/tst_painting.pro benchmarks/loading/tst_loading.pro
+SUBDIRS = qwebframe qwebpage qwebelement qgraphicswebview qwebhistoryinterface qwebview qwebhistory qwebinspector hybridPixmap
+SUBDIRS += benchmarks/painting benchmarks/loading
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/util.h b/src/3rdparty/webkit/WebKit/qt/tests/util.h
index 7f7e6137bc..c61bc6b899 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/util.h
+++ b/src/3rdparty/webkit/WebKit/qt/tests/util.h
@@ -18,6 +18,37 @@
 */
 // Functions and macros that really need to be in QTestLib
 
+#include <QEventLoop>
+#include <QSignalSpy>
+#include <QTimer>
+
+#if !defined(TESTS_SOURCE_DIR)
+#define TESTS_SOURCE_DIR ""
+#endif
+
+/**
+ * Starts an event loop that runs until the given signal is received.
+ * Optionally the event loop
+ * can return earlier on a timeout.
+ *
+ * \return \p true if the requested signal was received
+ *         \p false on timeout
+ */
+static bool waitForSignal(QObject* obj, const char* signal, int timeout = 10000)
+{
+    QEventLoop loop;
+    QObject::connect(obj, signal, &loop, SLOT(quit()));
+    QTimer timer;
+    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
+    if (timeout > 0) {
+        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
+        timer.setSingleShot(true);
+        timer.start(timeout);
+    }
+    loop.exec();
+    return timeoutSpy.isEmpty();
+}
+
 // Will try to wait for the condition while allowing event processing
 #define QTRY_VERIFY(__expr) \
     do { \
@@ -45,4 +76,3 @@
         } \
         QCOMPARE(__expr, __expected); \
     } while(0)
-
diff --git a/src/3rdparty/webkit/WebKit/scripts/generate-webkitversion.pl b/src/3rdparty/webkit/WebKit/scripts/generate-webkitversion.pl
deleted file mode 100644
index 0feb7707d8..0000000000
--- a/src/3rdparty/webkit/WebKit/scripts/generate-webkitversion.pl
+++ /dev/null
@@ -1,136 +0,0 @@
-#!/usr/bin/perl
-
-# Based on make_names.pl
-#
-# Copyright (C) 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
-# Copyright (C) 2009, Julien Chaffraix <jchaffraix@webkit.org>
-# Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
-# Copyright (C) 2009 Robert Hogan <robert@roberthogan.net>
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions
-# are met:
-#
-# 1.  Redistributions of source code must retain the above copyright
-#     notice, this list of conditions and the following disclaimer.
-# 2.  Redistributions in binary form must reproduce the above copyright
-#     notice, this list of conditions and the following disclaimer in the
-#     documentation and/or other materials provided with the distribution.
-# 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
-#     its contributors may be used to endorse or promote products derived
-#     from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
-# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
-# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-# This script reads Version.xcconfig and returns either or both of the major and minor
-# WebKit version numbers. It is currently used by WebKit.pri.
-
-use strict;
-
-use Config;
-use Getopt::Long;
-use File::Path;
-use Switch;
-
-my $usage = "generate-webkitversion --config WebKit/mac/Configurations/Version.xcconfig --outputDir <outputdir>";
-
-my $major_version = "";
-my $minor_version = "";
-# The appropriate Apple-maintained Version.xcconfig file for WebKit version information is in WebKit/mac/Configurations/.
-my $configFile = "./WebKit/mac/Configurations/Version.xcconfig";
-my $outputDir = "";
-
-GetOptions('config=s' => \$configFile,
-    'outputDir=s' => \$outputDir);
-
-die "You must specify a --config <file> " unless (length($configFile));
-die "You must specify a --outputDir <outputdir> " unless (length($outputDir));
-
-die "./WebKit/mac/Configurations/Version.xcconfig does not exist: use --config <file> to specify its correct location." unless (-e $configFile);
-die "$outputDir/ does not exist: use --outputDir <directory> to specify the location of an output directory that exists" unless (-e "$outputDir");
-
-unless (open INPUT, "<", $configFile) { print STDERR "File does not exist: $configFile\n";}
-while (my $line = <INPUT>) {
-    chomp $line;
-    if ($line =~ /^MAJOR_VERSION\s+=\s+\d+;/) {
-      $line =~ s/^(MAJOR_VERSION)\s+(=)\s+(\d+);/$3/;
-      $major_version = $line;
-    }
-    if ($line =~ /^MINOR_VERSION\s+=\s+\d+;/) {
-      $line =~ s/^(MINOR_VERSION)\s+(=)\s+(\d+);/$3/;
-      $minor_version = $line;
-    }
-}
-
-$major_version = "531" unless (length($major_version));
-$minor_version = "3" unless (length($minor_version));
-
-my $webKitVersionPath = "$outputDir/WebKitVersion.h";
-
-printWebKitVersionHeaderFile("$webKitVersionPath");
-
-sub printLicenseHeader
-{
-    my $F = shift;
-    print F "/*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
- *
- *
- * Copyright (C) 2009 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-
-";
-}
-
-sub printWebKitVersionHeaderFile
-{
-    my $headerPath = shift;
-    my $F;
-    open F, ">$headerPath";
-
-    printLicenseHeader($F);
-
-    print F "#ifndef WebKitVersion_h\n";
-    print F "#define WebKitVersion_h\n\n";
-
-    print F "#define WEBKIT_MAJOR_VERSION $major_version\n";
-    print F "#define WEBKIT_MINOR_VERSION $minor_version\n\n";
-
-    print F "#endif //WebKitVersion_h\n";
-
-    close F;
-}
-
-
-